{"format":1,"generated_at":"2026-11-13T17:17:45Z","sources":[{"id":"wordfence","name":"Wordfence Intelligence Community Edition","url":"https://www.wordfence.com/threat-intel/","license":"Free for commercial and non-commercial use; MITRE attribution required","attribution":"This record contains material that is subject to copyright Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation","fetched_at":"2026-11-13T16:20:47Z","records":88297}],"advisories":[{"id":"wordfence:000229b1-9ea9-4303-a79b-9ff24d1a8532","source":"wordfence","cve":"CVE-2026-115426","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.138 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/000229b1-9ea9-4303-a79b-9ff24d1a8532?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.138","to_inclusive":false,"patched_in":"0.9.138"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:34:50Z"},{"id":"wordfence:0004db27-9ea6-4387-ab1d-b95558784ed9","source":"wordfence","cve":"","title":"We\u2019re Open! <= 1.37 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0004db27-9ea6-4387-ab1d-b95558784ed9?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"1.37","to_inclusive":true,"patched_in":"1.38"}],"published":"2022-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0007d830-2e68-4c2f-8fac-f4363bc2d73d","source":"wordfence","cve":"","title":"Gift Cards (Gift Vouchers and Packages) <= 4.3.5 - Cross-Site Request Forgery in new_voucher_template.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0007d830-2e68-4c2f-8fac-f4363bc2d73d?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00086b84-c1ec-447a-a536-1c73eac1cc85","source":"wordfence","cve":"CVE-2021-25007","title":"MOLIE <= 0.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00086b84-c1ec-447a-a536-1c73eac1cc85?source=api-prod","affected":[{"type":"plugin","slug":"molie-instructure-canvas-linking-tool","name":"MOLIE \u2013 Instructure Canvas Linking tool","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0008b460-0c28-4e72-9c87-eda91989e39a","source":"wordfence","cve":"CVE-2024-35642","title":"Site Favicon <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0008b460-0c28-4e72-9c87-eda91989e39a?source=api-prod","affected":[{"type":"plugin","slug":"site-favicon","name":"Site Favicon","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:24:41Z"},{"id":"wordfence:000bf956-1781-4596-ac12-81691fdd789c","source":"wordfence","cve":"CVE-2024-8967","title":"PWA \u2014 easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/000bf956-1781-4596-ac12-81691fdd789c?source=api-prod","affected":[{"type":"plugin","slug":"iworks-pwa","name":"PWA \u2014 easy way to Progressive Web App","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-10-01T19:03:40Z","updated":"2024-10-02T07:35:26Z"},{"id":"wordfence:00107941-effc-4540-aa52-9e9725a417d6","source":"wordfence","cve":"CVE-2025-62743","title":"MyBookTable Bookstore <= 3.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00107941-effc-4540-aa52-9e9725a417d6?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:33:01Z"},{"id":"wordfence:001289a3-a1a9-441f-b399-e9b699094e1a","source":"wordfence","cve":"CVE-2024-11287","title":"Ebook Store <= 5.8001 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001289a3-a1a9-441f-b399-e9b699094e1a?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8001","to_inclusive":true,"patched_in":"5.8002"}],"published":"2024-12-20T18:47:20Z","updated":"2025-03-19T18:06:40Z"},{"id":"wordfence:0012eb8d-4a40-42d4-94af-307ce7d23e5f","source":"wordfence","cve":"CVE-2026-62008","title":"Orpheus <= 1.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0012eb8d-4a40-42d4-94af-307ce7d23e5f?source=api-prod","affected":[{"type":"theme","slug":"orpheus","name":"Orpheus","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:11Z"},{"id":"wordfence:00130f32-36eb-4a76-bac5-b6407edf1c48","source":"wordfence","cve":"CVE-2026-65521","title":"WP Social Ninja \u2013 Embed Social Feeds, User Reviews & Chat Widgets <= 4.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00130f32-36eb-4a76-bac5-b6407edf1c48?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-reviews","name":"WP Social Ninja \u2013 Embed Social Feeds, User Reviews & Chat Widgets","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:25:32Z"},{"id":"wordfence:00138875-d892-460c-b0ce-7a01335d26dc","source":"wordfence","cve":"CVE-2026-6020","title":"ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API","severity":"high","cvss":7.2,"cwe":"CWE-470","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00138875-d892-460c-b0ce-7a01335d26dc?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2026-08-04T18:38:44Z","updated":"2026-08-05T07:39:20Z"},{"id":"wordfence:00145a6b-26fd-4cba-a446-8236438075d8","source":"wordfence","cve":"CVE-2025-13847","title":"PhotoFade <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00145a6b-26fd-4cba-a446-8236438075d8?source=api-prod","affected":[{"type":"plugin","slug":"photofade","name":"PhotoFade","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:28:32Z","updated":"2026-01-07T09:20:50Z"},{"id":"wordfence:00149f27-8301-410e-898a-9363a83fdeae","source":"wordfence","cve":"CVE-2025-32514","title":"WooCommerce Estimate and Quote <= 1.0.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00149f27-8301-410e-898a-9363a83fdeae?source=api-prod","affected":[{"type":"plugin","slug":"wc-estimate-and-quote","name":"WooCommerce Estimate and Quote \u2013 Live Product Cost Estimation and Quotation system for WordPress","from":"*","from_inclusive":true,"to":"1.0.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:55:21Z"},{"id":"wordfence:00162c25-bf56-42cf-b9bd-f6435e788d3d","source":"wordfence","cve":"CVE-2025-68848","title":"amr cron manager <= 2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00162c25-bf56-42cf-b9bd-f6435e788d3d?source=api-prod","affected":[{"type":"plugin","slug":"amr-cron-manager","name":"amr cron manager","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-27T19:06:29Z"},{"id":"wordfence:0016c624-9c0c-4157-8597-8b374dff7f14","source":"wordfence","cve":"CVE-2022-2763","title":"WP Socializer \u2013 Simple & Easy Social Media Share Icons <= 7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0016c624-9c0c-4157-8597-8b374dff7f14?source=api-prod","affected":[{"type":"plugin","slug":"wp-socializer","name":"WP Socializer \u2013 Simple & Easy Social Media Share Icons","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.3"}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00187815-6706-4ec9-a566-4836de0d17c6","source":"wordfence","cve":"CVE-2019-20361","title":"Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection","severity":"high","cvss":8.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00187815-6706-4ec9-a566-4836de0d17c6?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00192a36-4b75-4dae-9a6e-0afb02ed5bad","source":"wordfence","cve":"CVE-2026-0996","title":"Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00192a36-4b75-4dae-9a6e-0afb02ed5bad?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"6.1.15"}],"published":"2026-02-09T17:19:48Z","updated":"2026-02-10T05:29:44Z"},{"id":"wordfence:001a7d43-4b00-42e9-bb0c-94a9d5721166","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.0 - Authorization Bypass to Private Message Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001a7d43-4b00-42e9-bb0c-94a9d5721166?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2021-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:001b452e-3f8a-4605-b77a-ba8fbd0d79d7","source":"wordfence","cve":"CVE-2024-9853","title":"ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001b452e-3f8a-4605-b77a-ba8fbd0d79d7?source=api-prod","affected":[{"type":"plugin","slug":"idsk-toolkit","name":"ID-SK Toolkit","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-10-25T20:09:46Z","updated":"2025-04-21T14:42:04Z"},{"id":"wordfence:001c6260-fa3d-49e7-873e-a96c1d6a2e97","source":"wordfence","cve":"CVE-2026-39589","title":"Webenvo <= 0.0.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001c6260-fa3d-49e7-873e-a96c1d6a2e97?source=api-prod","affected":[{"type":"theme","slug":"webenvo","name":"Webenvo","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":"0.0.7"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:31:48Z"},{"id":"wordfence:001e066f-6add-4426-8cd7-32229a9188d1","source":"wordfence","cve":"","title":"User Activity Log <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001e066f-6add-4426-8cd7-32229a9188d1?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:001f25c8-d9b5-4b24-9cd1-be726916079c","source":"wordfence","cve":"CVE-2024-5442","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/001f25c8-d9b5-4b24-9cd1-be726916079c?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.2","to_inclusive":true,"patched_in":"3.59.3"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T19:04:54Z"},{"id":"wordfence:00200994-e9a3-4fa2-84b6-b5fd79d4995f","source":"wordfence","cve":"CVE-2025-58215","title":"Ziston < 1.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00200994-e9a3-4fa2-84b6-b5fd79d4995f?source=api-prod","affected":[{"type":"theme","slug":"ziston","name":"Ziston - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2025-08-30T00:00:00Z","updated":"2025-09-11T14:17:24Z"},{"id":"wordfence:00234d96-cece-4217-89c9-1a329887e8da","source":"wordfence","cve":"CVE-2022-4473","title":"WidgetShortcode <= 0.3.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00234d96-cece-4217-89c9-1a329887e8da?source=api-prod","affected":[{"type":"plugin","slug":"widgetshortcode","name":"WidgetShortcode","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00243844-a2ec-42fd-84d9-03e89619e361","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce < 1.9 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00243844-a2ec-42fd-84d9-03e89619e361?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00272fe2-52aa-4183-8b57-6b51ad57c657","source":"wordfence","cve":"CVE-2023-3134","title":"Forminator <= 1.24.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00272fe2-52aa-4183-8b57-6b51ad57c657?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.24.1","to_inclusive":true,"patched_in":"1.24.4"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00274313-9079-4877-b72e-310e312aa814","source":"wordfence","cve":"","title":"Backup Migration <= 1.2.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00274313-9079-4877-b72e-310e312aa814?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:002c6fea-4b76-47a6-9a39-1195f18aa6f6","source":"wordfence","cve":"","title":"Live Scores for SportsPress <= 1.9.0 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/002c6fea-4b76-47a6-9a39-1195f18aa6f6?source=api-prod","affected":[{"type":"plugin","slug":"live-scores-for-sportspress","name":"Live Scores for SportsPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:002f5f49-d744-41a4-97b0-e22ad2d6b45b","source":"wordfence","cve":"CVE-2025-47694","title":"Blog Designer PRO for WordPress <= 3.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/002f5f49-d744-41a4-97b0-e22ad2d6b45b?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pro","name":"Blog Designer PRO for WordPress","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:40:41Z"},{"id":"wordfence:00323c12-151d-42e4-a85c-76400bce1ec8","source":"wordfence","cve":"CVE-2021-24791","title":"Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00323c12-151d-42e4-a85c-76400bce1ec8?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code-manager","name":"Header Footer Code Manager","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":false,"patched_in":"1.1.14"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0034df15-6039-422b-980c-009c2491a752","source":"wordfence","cve":"CVE-2026-25461","title":"Listeo-Core - Directory Plugin by Purethemes <= 2.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0034df15-6039-422b-980c-009c2491a752?source=api-prod","affected":[{"type":"plugin","slug":"listeo-core","name":"Listeo-Core - Directory Plugin by Purethemes","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-19T14:52:45Z"},{"id":"wordfence:003522cc-b425-4210-9740-5c1b0cce076d","source":"wordfence","cve":"CVE-2024-13880","title":"My Quota <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/003522cc-b425-4210-9740-5c1b0cce076d?source=api-prod","affected":[{"type":"plugin","slug":"my-quota","name":"My Quota","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:10:35Z"},{"id":"wordfence:003686a7-929b-4c17-bb4b-2a330506819c","source":"wordfence","cve":"CVE-2026-28174","title":"Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/003686a7-929b-4c17-bb4b-2a330506819c?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"4.1.19"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:07:00Z"},{"id":"wordfence:003694f8-23be-4c94-899d-76b9b8488202","source":"wordfence","cve":"CVE-2023-4642","title":"kk Star Ratings <= 5.4.5 - Race Condition to Multiple User Voting","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/003694f8-23be-4c94-899d-76b9b8488202?source=api-prod","affected":[{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00375b21-0395-46cc-a79a-47409769d503","source":"wordfence","cve":"CVE-2025-27283","title":"Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00375b21-0395-46cc-a79a-47409769d503?source=api-prod","affected":[{"type":"plugin","slug":"theme-file-duplicator","name":"Theme File Duplicator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:28:29Z"},{"id":"wordfence:00376356-4a85-4898-a101-710e1cb5c6bb","source":"wordfence","cve":"CVE-2012-0287","title":"WordPress Core <= 3.3 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00376356-4a85-4898-a101-710e1cb5c6bb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2012-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0037c6ba-7b77-4529-8c23-002624332f9b","source":"wordfence","cve":"CVE-2025-54027","title":"Support Board <= 3.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0037c6ba-7b77-4529-8c23-002624332f9b?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:56:35Z"},{"id":"wordfence:00380ab2-31cd-41af-9498-9eef32c2b6f0","source":"wordfence","cve":"CVE-2025-58976","title":"Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00380ab2-31cd-41af-9498-9eef32c2b6f0?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T17:58:00Z"},{"id":"wordfence:003e7fcf-c514-48fc-9db4-d7f079633149","source":"wordfence","cve":"CVE-2026-105996","title":"Booking Package < 1.7.31 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/003e7fcf-c514-48fc-9db4-d7f079633149?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.31","to_inclusive":false,"patched_in":"1.7.31"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:14:14Z"},{"id":"wordfence:004206fd-c46e-48d7-93f1-884b3261fdb6","source":"wordfence","cve":"","title":"AccessPress Social Icons <= 1.6.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/004206fd-c46e-48d7-93f1-884b3261fdb6?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-social-icons","name":"AccessPress Social Icons","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2017-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0042d5ba-62de-404e-9516-67cae618f684","source":"wordfence","cve":"CVE-2015-10094","title":"Fastly <= 0.97 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0042d5ba-62de-404e-9516-67cae618f684?source=api-prod","affected":[{"type":"plugin","slug":"fastly","name":"Fastly","from":"*","from_inclusive":true,"to":"0.97","to_inclusive":true,"patched_in":"0.98"}],"published":"2015-02-03T00:00:00Z","updated":"2024-02-07T14:17:29Z"},{"id":"wordfence:0043a09c-1ddd-4906-86a8-15dae2be8287","source":"wordfence","cve":"CVE-2026-77115","title":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content < 0.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0043a09c-1ddd-4906-86a8-15dae2be8287?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.8.6","to_inclusive":false,"patched_in":"0.8.6"}],"published":"2026-08-21T00:00:00Z","updated":"2026-09-02T14:30:01Z"},{"id":"wordfence:0045c5a4-0807-4e89-8639-0802e54ce6ab","source":"wordfence","cve":"CVE-2024-5901","title":"SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0045c5a4-0807-4e89-8639-0802e54ce6ab?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.62.2","to_inclusive":true,"patched_in":"1.62.3"}],"published":"2024-07-30T07:35:07Z","updated":"2024-07-30T20:30:05Z"},{"id":"wordfence:0045d2e8-0a5a-4b64-a27d-174fede659b0","source":"wordfence","cve":"CVE-2026-107098","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor 1.7.1037 - 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0045d2e8-0a5a-4b64-a27d-174fede659b0?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.7.1037","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:48Z"},{"id":"wordfence:0049583a-0ad3-45e4-a29e-4b8c33d09857","source":"wordfence","cve":"CVE-2026-12406","title":"User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0049583a-0ad3-45e4-a29e-4b8c33d09857?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-07-08T19:22:00Z","updated":"2026-07-30T17:05:59Z"},{"id":"wordfence:004e7773-31b9-47e5-a26b-64e75b6b2f9d","source":"wordfence","cve":"CVE-2024-49613","title":"Simple Code Insert Shortcode <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/004e7773-31b9-47e5-a26b-64e75b6b2f9d?source=api-prod","affected":[{"type":"plugin","slug":"simple-code-insert-shortcode","name":"Simple Code Insert Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:04:32Z"},{"id":"wordfence:00500322-0984-49f5-8a6f-8cf72d125e6a","source":"wordfence","cve":"CVE-2022-2354","title":"WP-DBManager <= 2.80.7 - Authenticated (Admin+) Remote Code Execution on Multi-Site","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00500322-0984-49f5-8a6f-8cf72d125e6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-dbmanager","name":"WP-DBManager","from":"*","from_inclusive":true,"to":"2.80.7","to_inclusive":true,"patched_in":"2.80.8"}],"published":"2022-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:005032e2-b5aa-44d8-855f-2aceee9e740f","source":"wordfence","cve":"CVE-2024-5002","title":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005032e2-b5aa-44d8-855f-2aceee9e740f?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20240319","to_inclusive":true,"patched_in":"20240516"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T18:32:00Z"},{"id":"wordfence:0051e869-47b1-42ea-911a-49a4462d33ca","source":"wordfence","cve":"CVE-2014-4583","title":"WP-Contact <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0051e869-47b1-42ea-911a-49a4462d33ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-sidebar-widget","name":"WP-Contact","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:005234f9-8ae2-455a-8dcd-5d29a6051270","source":"wordfence","cve":"","title":"Image Slider <= 1.1.119 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005234f9-8ae2-455a-8dcd-5d29a6051270?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.119","to_inclusive":true,"patched_in":"1.1.121"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0054c17a-09f1-4b54-afa4-6743cbb6ff51","source":"wordfence","cve":"CVE-2026-28122","title":"ListingPro Plugin <= 2.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0054c17a-09f1-4b54-afa4-6743cbb6ff51?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:32:59Z"},{"id":"wordfence:00599865-9091-46e1-b2a9-78cbd10f6f22","source":"wordfence","cve":"CVE-2012-6077","title":"W3 Total Cache <= 0.9.2.4 - Password Hash Extraction","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00599865-9091-46e1-b2a9-78cbd10f6f22?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.2.4","to_inclusive":true,"patched_in":"0.9.2.5"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:005a27c6-b9eb-466c-b0c3-ce52c25bb321","source":"wordfence","cve":"CVE-2024-5324","title":"XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005a27c6-b9eb-466c-b0c3-ce52c25bb321?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"side-cart-woocommerce","name":"Side Cart Woocommerce | Woocommerce Cart","from":"2.5","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"},{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"2.7.1","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"},{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-05T13:11:37Z","updated":"2024-07-15T13:35:45Z"},{"id":"wordfence:005b19ba-0ba5-437f-9d66-dfb0228f76a6","source":"wordfence","cve":"CVE-2026-114427","title":"GutenKit 2.5.0 - 2.5.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005b19ba-0ba5-437f-9d66-dfb0228f76a6?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"2.5.0","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:16:53Z"},{"id":"wordfence:005b22a5-9899-4d67-8353-5322ed0b4ae6","source":"wordfence","cve":"CVE-2024-37936","title":"Tabs For WPBakery Page Builder <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005b22a5-9899-4d67-8353-5322ed0b4ae6?source=api-prod","affected":[{"type":"plugin","slug":"tabs-for-visual-composer","name":"Tabs For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:35:38Z"},{"id":"wordfence:005b56c7-55ae-4db0-9ab2-3e22bd8a08ae","source":"wordfence","cve":"CVE-2022-46859","title":"Spiffy Calendar <= 4.9.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005b56c7-55ae-4db0-9ab2-3e22bd8a08ae?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:005bf2f0-892f-4248-afe3-263ae3d2ac54","source":"wordfence","cve":"CVE-2024-35681","title":"Comments \u2013 wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005bf2f0-892f-4248-afe3-263ae3d2ac54?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.18","to_inclusive":true,"patched_in":"7.6.19"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:30:59Z"},{"id":"wordfence:005d1abc-761d-4f9a-bc21-aad63e8efd66","source":"wordfence","cve":"CVE-2026-6271","title":"Career Section <= 1.7 -  Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005d1abc-761d-4f9a-bc21-aad63e8efd66?source=api-prod","affected":[{"type":"plugin","slug":"career-section","name":"Career Section","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-05-13T18:04:31Z","updated":"2026-05-14T06:44:09Z"},{"id":"wordfence:005fa621-3c49-4c23-add5-d6b7a9110055","source":"wordfence","cve":"CVE-2024-1071","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005fa621-3c49-4c23-add5-d6b7a9110055?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"2.1.3","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-02-23T00:00:00Z","updated":"2024-03-13T15:26:32Z"},{"id":"wordfence:005fc05c-6d82-49ca-b114-a3e64a3a572f","source":"wordfence","cve":"CVE-2024-6495","title":"Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/005fc05c-6d82-49ca-b114-a3e64a3a572f?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.36","to_inclusive":true,"patched_in":"4.10.37"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-12T12:46:55Z"},{"id":"wordfence:00612475-7efd-46f2-8196-666900ae7df3","source":"wordfence","cve":"CVE-2026-32384","title":"WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00612475-7efd-46f2-8196-666900ae7df3?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:55:08Z"},{"id":"wordfence:00622a39-7230-4263-8e25-b0917df80191","source":"wordfence","cve":"CVE-2021-38336","title":"Edit Comments XT <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00622a39-7230-4263-8e25-b0917df80191?source=api-prod","affected":[{"type":"plugin","slug":"edit-comments-xt","name":"Edit Comments XT","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0064244b-72a4-486d-aaad-be1f57e4a8a1","source":"wordfence","cve":"CVE-2024-6547","title":"Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0064244b-72a4-486d-aaad-be1f57e4a8a1?source=api-prod","affected":[{"type":"plugin","slug":"add-admin-css","name":"Add Admin CSS","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-07-26T13:03:15Z","updated":"2025-04-30T18:13:19Z"},{"id":"wordfence:00649f4e-30fe-4343-b7d9-44fb41aa2e47","source":"wordfence","cve":"CVE-2026-81427","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00649f4e-30fe-4343-b7d9-44fb41aa2e47?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":false,"patched_in":"2.7.2.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:37:56Z"},{"id":"wordfence:0064f4c0-ca94-4ce9-ba2f-e4a74b8b2fc2","source":"wordfence","cve":"CVE-2025-50050","title":"Jobs for WordPress <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0064f4c0-ca94-4ce9-ba2f-e4a74b8b2fc2?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.14","to_inclusive":true,"patched_in":"2.7.15"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T15:51:25Z"},{"id":"wordfence:006544c9-09ed-4cda-a903-4e3959fdb676","source":"wordfence","cve":"CVE-2020-9371","title":"Appointment Booking Calendar <= 1.3.34 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/006544c9-09ed-4cda-a903-4e3959fdb676?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.35","to_inclusive":false,"patched_in":"1.3.35"}],"published":"2020-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0066b63b-42ff-4edb-b17d-2210babc3502","source":"wordfence","cve":"CVE-2026-8082","title":"Bpost Shipping Platform <= 3.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0066b63b-42ff-4edb-b17d-2210babc3502?source=api-prod","affected":[{"type":"plugin","slug":"bpost-shipping-platform","name":"bpost-shipping-platform","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-29T23:12:18Z"},{"id":"wordfence:00675945-4a7f-49f5-8bde-bb0669edecab","source":"wordfence","cve":"CVE-2024-54258","title":"Ni CRM Lead <= 1.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00675945-4a7f-49f5-8bde-bb0669edecab?source=api-prod","affected":[{"type":"plugin","slug":"ni-crm-lead","name":"Ni CRM Lead","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:37:52Z"},{"id":"wordfence:00687370-8374-44cc-8fd1-53b462acd061","source":"wordfence","cve":"","title":"iPanorama 360 \u2013 WordPress Virtual Tour Builder <= 1.7.3 - Authenticated (Admin+) SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00687370-8374-44cc-8fd1-53b462acd061?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:006945a3-5f54-4bb8-9522-c832d59624a0","source":"wordfence","cve":"CVE-2024-11329","title":"Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/006945a3-5f54-4bb8-9522-c832d59624a0?source=api-prod","affected":[{"type":"plugin","slug":"comfino-payment-gateway","name":"ComfinoPay Payment Gateway","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2024-12-06T11:59:51Z","updated":"2024-12-12T15:37:57Z"},{"id":"wordfence:006d1fcd-77b4-4214-be71-b6d71afad072","source":"wordfence","cve":"CVE-2026-76877","title":"WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/006d1fcd-77b4-4214-be71-b6d71afad072?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-11-09T18:29:57Z","updated":"2026-11-11T14:52:46Z"},{"id":"wordfence:00717a4e-0157-4dbd-81b4-d88b476b1964","source":"wordfence","cve":"CVE-2025-23676","title":"LH Email <= 1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00717a4e-0157-4dbd-81b4-d88b476b1964?source=api-prod","affected":[{"type":"plugin","slug":"lh-email","name":"LH Email","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:56:20Z"},{"id":"wordfence:00733c55-1071-4406-9ff3-d67b6411353a","source":"wordfence","cve":"CVE-2025-68076","title":"Stockholm Core <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00733c55-1071-4406-9ff3-d67b6411353a?source=api-prod","affected":[{"type":"plugin","slug":"stockholm-core","name":"Stockholm Core","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-18T00:00:00Z","updated":"2025-12-20T20:27:51Z"},{"id":"wordfence:00747cde-efb3-486f-ac19-903dee69263d","source":"wordfence","cve":"CVE-2026-27335","title":"Ekoterra - NonProfit & Ecology Theme <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00747cde-efb3-486f-ac19-903dee69263d?source=api-prod","affected":[{"type":"theme","slug":"ekoterra","name":"Ekoterra - NonProfit & Ecology Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:39:50Z"},{"id":"wordfence:0077b81c-c74d-4b1b-99b1-9a8f7032b2dc","source":"wordfence","cve":"CVE-2025-31457","title":"LWS SMS <= 2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0077b81c-c74d-4b1b-99b1-9a8f7032b2dc?source=api-prod","affected":[{"type":"plugin","slug":"lws-sms","name":"LWS SMS","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:05:13Z"},{"id":"wordfence:00789ec1-8c0d-4c60-a4b6-29acace4c865","source":"wordfence","cve":"CVE-2026-27376","title":"Claue - Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00789ec1-8c0d-4c60-a4b6-29acace4c865?source=api-prod","affected":[{"type":"theme","slug":"claue","name":"Claue - Clean, Minimal Elementor WooCommerce Them","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T17:51:17Z"},{"id":"wordfence:00798eb5-b557-4749-84d4-c49b4603cb07","source":"wordfence","cve":"CVE-2026-107323","title":"Gallery PhotoBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00798eb5-b557-4749-84d4-c49b4603cb07?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:59:09Z"},{"id":"wordfence:007af51b-95b5-4b12-9f74-abf31f6de341","source":"wordfence","cve":"","title":"Real Estate 7 <= 3.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007af51b-95b5-4b12-9f74-abf31f6de341?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:007b3e8c-1a6d-4898-81f6-21fb0c4ecf3b","source":"wordfence","cve":"CVE-2025-46522","title":"Tabs <= 4.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007b3e8c-1a6d-4898-81f6-21fb0c4ecf3b?source=api-prod","affected":[{"type":"plugin","slug":"gt-tabs","name":"WordPress Tabs","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:09:37Z"},{"id":"wordfence:007d8935-974f-4bc4-833e-25ca50a50a29","source":"wordfence","cve":"CVE-2024-2220","title":"Button contact VR <= 4.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007d8935-974f-4bc4-833e-25ca50a50a29?source=api-prod","affected":[{"type":"plugin","slug":"button-contact-vr","name":"Buttonizer \u2013 Live Chat, AI Chatbot, Call, Chat, Contact Button","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2024-05-02T00:00:00Z","updated":"2024-07-08T20:36:44Z"},{"id":"wordfence:007df869-dacb-4b0a-9c98-50586934cdab","source":"wordfence","cve":"CVE-2025-13673","title":"Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007df869-dacb-4b0a-9c98-50586934cdab?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-02-27T18:54:35Z","updated":"2026-02-28T07:25:36Z"},{"id":"wordfence:007ec4b0-6ec7-4cd1-ba96-22f880c4282c","source":"wordfence","cve":"CVE-2026-110808","title":"Essential Addons for Elementor 6.6.0 - 6.8.7 - Authenticated (Author+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007ec4b0-6ec7-4cd1-ba96-22f880c4282c?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"6.6.0","from_inclusive":true,"to":"6.8.7","to_inclusive":true,"patched_in":"6.8.8"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:22:41Z"},{"id":"wordfence:007ec879-7241-4dd2-9b81-93e44786bbcb","source":"wordfence","cve":"CVE-2021-39352","title":"Catch Themes Demo Import <= 1.7 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/007ec879-7241-4dd2-9b81-93e44786bbcb?source=api-prod","affected":[{"type":"plugin","slug":"catch-themes-demo-import","name":"Catch Themes Demo Import","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2021-10-21T16:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0082e46d-fdbe-4ab7-bba3-0681a25d4495","source":"wordfence","cve":"CVE-2024-13869","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.112","to_inclusive":true,"patched_in":"0.9.113"}],"published":"2025-02-21T00:00:00Z","updated":"2025-02-23T03:14:32Z"},{"id":"wordfence:0084ec4e-1c10-4bfe-a7c6-155aa9a48dc1","source":"wordfence","cve":"CVE-2025-23868","title":"Chess Tempo Viewer <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0084ec4e-1c10-4bfe-a7c6-155aa9a48dc1?source=api-prod","affected":[{"type":"plugin","slug":"chesstempoviewer","name":"Chess Tempo Viewer","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:10:27Z"},{"id":"wordfence:008563a2-75c2-49f8-b581-a04b72ec2a10","source":"wordfence","cve":"CVE-2025-32611","title":"WooCommerce TBC Credit Card Payment Gateway (Free) <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/008563a2-75c2-49f8-b581-a04b72ec2a10?source=api-prod","affected":[{"type":"plugin","slug":"woo-tbc-payment-gateway","name":"WooCommerce TBC Credit Card Payment Gateway (Free)","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:59:40Z"},{"id":"wordfence:00866e54-42b0-4947-a194-48b8d5cad027","source":"wordfence","cve":"CVE-2025-49418","title":"Allmart <= 1.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00866e54-42b0-4947-a194-48b8d5cad027?source=api-prod","affected":[{"type":"plugin","slug":"allmart-core","name":"Allmart","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:11:44Z"},{"id":"wordfence:0088a97c-5a06-4500-a923-242499596aca","source":"wordfence","cve":"CVE-2025-12777","title":"YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0088a97c-5a06-4500-a923-242499596aca?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2025-11-18T14:28:55Z","updated":"2025-11-19T03:29:38Z"},{"id":"wordfence:0088d9d8-0b29-481f-ba0b-ef05764d40c2","source":"wordfence","cve":"CVE-2025-26973","title":"Social Sharing Plugin \u2013 Social Warfare <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0088d9d8-0b29-481f-ba0b-ef05764d40c2?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-02-19T00:00:00Z","updated":"2025-03-21T15:17:34Z"},{"id":"wordfence:0089498d-c4b3-4167-8bf4-8d9f68a4cbd0","source":"wordfence","cve":"CVE-2012-1835","title":"Timely All-in-One Events Calendar < 1.6 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0089498d-c4b3-4167-8bf4-8d9f68a4cbd0?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-event-calendar","name":"Timely All-in-One Events Calendar","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2012-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0089bbd3-d3e4-4a13-b1f8-bb10bf18200c","source":"wordfence","cve":"CVE-2025-53221","title":"CodeablePress <= 1.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0089bbd3-d3e4-4a13-b1f8-bb10bf18200c?source=api-prod","affected":[{"type":"plugin","slug":"codeablepress-simple-frontend-profile-picture-upload","name":"CodeablePress: Simple Frontend Profile Picture Upload","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:29:10Z"},{"id":"wordfence:008f3754-363d-4f72-86cc-1bcea3b5cdcc","source":"wordfence","cve":"CVE-2025-59002","title":"BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/008f3754-363d-4f72-86cc-1bcea3b5cdcc?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.16.3.3","to_inclusive":false,"patched_in":"3.16.3.3"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T12:41:18Z"},{"id":"wordfence:009084cf-0a49-41ab-8b3b-fe46c00a889b","source":"wordfence","cve":"CVE-2014-6444","title":"Titan Framework <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009084cf-0a49-41ab-8b3b-fe46c00a889b?source=api-prod","affected":[{"type":"plugin","slug":"titan-framework","name":"Titan Framework","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2014-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0092f02d-ec3a-4a11-bad9-67714d3d976e","source":"wordfence","cve":"CVE-2024-10362","title":"Social Media Share Buttons & Social Sharing Icons <= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0092f02d-ec3a-4a11-bad9-67714d3d976e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2024-10-31T00:00:00Z","updated":"2025-05-27T14:57:57Z"},{"id":"wordfence:00943fa8-6794-4b6b-adb8-8219482808d5","source":"wordfence","cve":"CVE-2025-69012","title":"Event Organiser <= 3.12.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00943fa8-6794-4b6b-adb8-8219482808d5?source=api-prod","affected":[{"type":"plugin","slug":"event-organiser","name":"Event Organiser","from":"*","from_inclusive":true,"to":"3.12.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-27T00:00:00Z","updated":"2026-01-05T19:04:02Z"},{"id":"wordfence:0098157e-c3e8-42e4-bd79-c9f2ea26f4db","source":"wordfence","cve":"CVE-2026-110034","title":"Salon Booking System <= 10.31.10 - Unauthenticated Negative Booking Total Creation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0098157e-c3e8-42e4-bd79-c9f2ea26f4db?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.10","to_inclusive":true,"patched_in":"10.31.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:31:31Z"},{"id":"wordfence:009829be-5149-4d1a-ac81-ac2a2cfd9964","source":"wordfence","cve":"CVE-2026-24996","title":"WPElemento Importer <= 0.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009829be-5149-4d1a-ac81-ac2a2cfd9964?source=api-prod","affected":[{"type":"plugin","slug":"wpelemento-importer","name":"WPElemento Importer","from":"*","from_inclusive":true,"to":"0.6.4","to_inclusive":true,"patched_in":"0.6.5"}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-02T20:43:38Z"},{"id":"wordfence:009899d4-4139-43ea-a7a1-dc3a1a9ea1e6","source":"wordfence","cve":"CVE-2022-1826","title":"Cross-Linker <= 3.0.1.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009899d4-4139-43ea-a7a1-dc3a1a9ea1e6?source=api-prod","affected":[{"type":"plugin","slug":"cross-linker","name":"Cross-Linker","from":"*","from_inclusive":true,"to":"3.0.1.9","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0099a8d7-827d-4215-9a2b-b3c268fb5e97","source":"wordfence","cve":"CVE-2024-9664","title":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0099a8d7-827d-4215-9a2b-b3c268fb5e97?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2025-02-07T03:05:08Z","updated":"2025-02-07T15:21:04Z"},{"id":"wordfence:0099c700-e1af-4d97-a518-151a9139ea35","source":"wordfence","cve":"CVE-2025-0951","title":"LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0099c700-e1af-4d97-a518-151a9139ea35?source=api-prod","affected":[{"type":"theme","slug":"aihub","name":"AI Hub - Startup & Technology WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"hub","name":"Hub - Responsive Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"archub","name":"ArcHub - Architecture and Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T03:42:43Z"},{"id":"wordfence:009a6ae4-e9b5-4199-be25-b60e06dc136b","source":"wordfence","cve":"CVE-2022-43491","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009a6ae4-e9b5-4199-be25-b60e06dc136b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2022-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:009a9210-531c-4b6c-83b6-8c97a4f492bd","source":"wordfence","cve":"CVE-2026-14236","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.4 - Open Redirect","severity":"medium","cvss":5.8,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009a9210-531c-4b6c-83b6-8c97a4f492bd?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T17:15:32Z"},{"id":"wordfence:009b9b0d-6cbd-402e-bc81-24661ff16b9d","source":"wordfence","cve":"CVE-2025-2108","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009b9b0d-6cbd-402e-bc81-24661ff16b9d?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.7.1","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-03-19T00:00:00Z","updated":"2025-06-11T20:04:10Z"},{"id":"wordfence:009e5f43-19e0-4110-890e-1df715f51a84","source":"wordfence","cve":"CVE-2025-31527","title":"WP Link Preview <= 1.4.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/009e5f43-19e0-4110-890e-1df715f51a84?source=api-prod","affected":[{"type":"plugin","slug":"wp-link-preview","name":"WP Link Preview","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-10T13:25:54Z"},{"id":"wordfence:00a1b66d-d81c-4539-846b-ff66301a94ca","source":"wordfence","cve":"CVE-2022-40223","title":"SearchWP Premium <= 4.2.5 - Authenticated (Subscriber+) Nonce Leakage and Authorization Bypass","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a1b66d-d81c-4539-846b-ff66301a94ca?source=api-prod","affected":[{"type":"plugin","slug":"searchwp","name":"SearchWP Premium","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00a33386-c401-4942-9dca-82555d2e87c6","source":"wordfence","cve":"CVE-2026-39448","title":"NOWPayments for WooCommerce \u2013 Crypto Payment Gateway <= 1.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a33386-c401-4942-9dca-82555d2e87c6?source=api-prod","affected":[{"type":"plugin","slug":"nowpayments-for-woocommerce","name":"NOWPayments for WooCommerce \u2013 Crypto Payment Gateway","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-06-29T00:00:00Z","updated":"2026-09-09T16:07:01Z"},{"id":"wordfence:00a3d8e3-17b1-488b-9c42-2479932c9bf7","source":"wordfence","cve":"CVE-2024-1450","title":"Shariff Wrapper <= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a3d8e3-17b1-488b-9c42-2479932c9bf7?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"4.6.11"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-20T20:43:19Z"},{"id":"wordfence:00a456bc-c795-41cd-a19e-906b6d5b2339","source":"wordfence","cve":"CVE-2025-58830","title":"Parallax Scrolling Enllax.js <= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a456bc-c795-41cd-a19e-906b6d5b2339?source=api-prod","affected":[{"type":"plugin","slug":"parallax-scrolling-enllax-js","name":"Parallax Scrolling Enllax.js","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:15:01Z"},{"id":"wordfence:00a7768f-5fd6-49ff-bcd6-e44dd59ae8d9","source":"wordfence","cve":"CVE-2024-39660","title":"Photo Engine <= 6.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a7768f-5fd6-49ff-bcd6-e44dd59ae8d9?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:10:53Z"},{"id":"wordfence:00a95ae7-3c58-4e5e-aaef-c04d1dacf27f","source":"wordfence","cve":"CVE-2025-1383","title":"Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a95ae7-3c58-4e5e-aaef-c04d1dacf27f?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2025-03-05T21:31:57Z","updated":"2025-03-06T11:11:02Z"},{"id":"wordfence:00a96f3c-a6c9-4305-82ec-fa35570ac2af","source":"wordfence","cve":"CVE-2024-38680","title":"Appmaker \u2013 Convert WooCommerce to Android & iOS Native Mobile Apps <= 1.36.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a96f3c-a6c9-4305-82ec-fa35570ac2af?source=api-prod","affected":[{"type":"plugin","slug":"appmaker-woocommerce-mobile-app-manager","name":"Appmaker \u2013 Convert WooCommerce to Android & iOS Native Mobile Apps","from":"*","from_inclusive":true,"to":"1.36.12","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:15:45Z"},{"id":"wordfence:00a9b83e-793e-46df-a3de-5728cf424d28","source":"wordfence","cve":"CVE-2025-22313","title":"Widgetize Pages Light <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00a9b83e-793e-46df-a3de-5728cf424d28?source=api-prod","affected":[{"type":"plugin","slug":"widgetize-pages-light","name":"Widgetize Pages Light","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:53:04Z"},{"id":"wordfence:00aa4e06-66ec-46cb-9a24-e63d64810d83","source":"wordfence","cve":"CVE-2025-58029","title":"Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00aa4e06-66ec-46cb-9a24-e63d64810d83?source=api-prod","affected":[{"type":"plugin","slug":"classic-widgets-with-block-based-widgets","name":"Classic Widgets with Block-based Widgets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:32:10Z"},{"id":"wordfence:00ab5d7e-be38-42ea-befc-e1d91de13d1b","source":"wordfence","cve":"CVE-2026-25435","title":"Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ab5d7e-be38-42ea-befc-e1d91de13d1b?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-26T20:40:05Z"},{"id":"wordfence:00aba7b3-4d4a-4aba-8e4e-2e8a928f6143","source":"wordfence","cve":"CVE-2024-43257","title":"Leopard - WordPress offload media <= 2.0.36 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00aba7b3-4d4a-4aba-8e4e-2e8a928f6143?source=api-prod","affected":[{"type":"plugin","slug":"leopard-wordpress-offload-media","name":"Leopard - WordPress Offload Media","from":"*","from_inclusive":true,"to":"2.0.36","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-08-12T00:00:00Z","updated":"2026-02-24T22:13:52Z"},{"id":"wordfence:00ae6b57-6ce2-4e39-91c9-7b2c5b38124b","source":"wordfence","cve":"CVE-2011-10033","title":"is-human <= 1.4.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ae6b57-6ce2-4e39-91c9-7b2c5b38124b?source=api-prod","affected":[{"type":"plugin","slug":"is-human","name":"is-human","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2011-05-16T00:00:00Z","updated":"2025-10-16T13:15:54Z"},{"id":"wordfence:00af4410-1f1f-4e88-8a6f-3f832fe3ed9a","source":"wordfence","cve":"CVE-2026-109895","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00af4410-1f1f-4e88-8a6f-3f832fe3ed9a?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:43:25Z"},{"id":"wordfence:00b1b289-1b14-4e97-a9de-1132d0eea06f","source":"wordfence","cve":"CVE-2025-46540","title":"GNA Search Shortcode <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b1b289-1b14-4e97-a9de-1132d0eea06f?source=api-prod","affected":[{"type":"plugin","slug":"gna-search-shortcode","name":"GNA Search Shortcode","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:31:33Z"},{"id":"wordfence:00b24f2f-af29-4297-b253-3242dc56542f","source":"wordfence","cve":"CVE-2025-24734","title":"Better Find and Replace <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b24f2f-af29-4297-b253-3242dc56542f?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-20T16:27:34Z"},{"id":"wordfence:00b278af-6ce6-4e70-a83a-a1b035542cd4","source":"wordfence","cve":"CVE-2024-10091","title":"ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b278af-6ce6-4e70-a83a-a1b035542cd4?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-10-25T14:08:18Z","updated":"2024-10-26T02:31:31Z"},{"id":"wordfence:00b4b903-4682-458b-9681-751179460b75","source":"wordfence","cve":"CVE-2019-10271","title":"Ultimate Member <= 2.0.39 - Unauthorized Profile Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b4b903-4682-458b-9681-751179460b75?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.40"}],"published":"2019-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00b60b53-77bf-4640-bf2b-84e011014623","source":"wordfence","cve":"CVE-2024-4268","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b60b53-77bf-4640-bf2b-84e011014623?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-07-01T21:45:10Z","updated":"2024-07-09T15:17:15Z"},{"id":"wordfence:00b81467-8d00-4816-895a-89d67c541c17","source":"wordfence","cve":"CVE-2024-0616","title":"Passster \u2013 Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00b81467-8d00-4816-895a-89d67c541c17?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.6.2","to_inclusive":true,"patched_in":"4.2.6.3"}],"published":"2024-02-08T00:00:00Z","updated":"2024-07-29T21:35:46Z"},{"id":"wordfence:00ba5eae-668a-4452-9562-9f49b730daaa","source":"wordfence","cve":"CVE-2024-35747","title":"Contact Form Builder, Contact Widget <= 2.1.7 - Authentication Request Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ba5eae-668a-4452-9562-9f49b730daaa?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-builder","name":"Contact Form Builder, Contact Widget","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:32:58Z"},{"id":"wordfence:00ba947e-a9c8-4787-9acb-0fa6e0487347","source":"wordfence","cve":"CVE-2025-64203","title":"Mailster < 4.1.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ba947e-a9c8-4787-9acb-0fa6e0487347?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster WordPress Newsletter Plugin","from":"*","from_inclusive":true,"to":"4.1.14","to_inclusive":false,"patched_in":"4.1.14"}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-19T16:45:00Z"},{"id":"wordfence:00bb89b7-e8f3-4ffc-8086-34f70a66e641","source":"wordfence","cve":"CVE-2025-53467","title":"Login-Logout <= 3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00bb89b7-e8f3-4ffc-8086-34f70a66e641?source=api-prod","affected":[{"type":"plugin","slug":"login-logout","name":"Login-Logout","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:01:31Z"},{"id":"wordfence:00bcfd8f-9785-449a-a0ea-16e2583d684a","source":"wordfence","cve":"CVE-2025-3623","title":"Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function","severity":"critical","cvss":9.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00bcfd8f-9785-449a-a0ea-16e2583d684a?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.4.0.1","to_inclusive":true,"patched_in":"6.4.0.2"}],"published":"2025-05-13T14:20:55Z","updated":"2025-06-13T14:08:35Z"},{"id":"wordfence:00bf8f2f-6ab4-4430-800b-5b97abe7589e","source":"wordfence","cve":"CVE-2024-6522","title":"Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00bf8f2f-6ab4-4430-800b-5b97abe7589e?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.12.1","to_inclusive":true,"patched_in":"7.13.0"},{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.12.1","to_inclusive":true,"patched_in":"7.13.0"}],"published":"2024-08-06T21:57:41Z","updated":"2024-08-07T11:00:06Z"},{"id":"wordfence:00c022a9-2062-4e99-8911-8cfad929a783","source":"wordfence","cve":"CVE-2015-9410","title":"PowerPress  <= 6.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c022a9-2062-4e99-8911-8cfad929a783?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2015-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00c44ede-326d-48f5-8c78-fe5d566018f3","source":"wordfence","cve":"CVE-2024-37454","title":"AWSM Team <= 1.3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c44ede-326d-48f5-8c78-fe5d566018f3?source=api-prod","affected":[{"type":"plugin","slug":"awsm-team","name":"AWSM Team \u2013 Team Showcase Plugin","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T19:00:57Z"},{"id":"wordfence:00c5eb87-3e08-489a-9b30-2fde4aa2274e","source":"wordfence","cve":"CVE-2026-103485","title":"Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c5eb87-3e08-489a-9b30-2fde4aa2274e?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"6.0"}],"published":"2026-10-28T20:45:22Z","updated":"2026-10-29T09:25:32Z"},{"id":"wordfence:00c7b97b-4c5e-436a-967e-007ee1d283fb","source":"wordfence","cve":"CVE-2025-8280","title":"Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c7b97b-4c5e-436a-967e-007ee1d283fb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-recaptcha","name":"Contact Form 7 reCAPTCHA","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-09-25T19:44:33Z"},{"id":"wordfence:00c89526-239b-4c5f-9740-7cc45635a6bd","source":"wordfence","cve":"CVE-2026-118073","title":"News Kit Addons For Elementor <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00c89526-239b-4c5f-9740-7cc45635a6bd?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T10:14:21Z","updated":"2026-11-03T19:39:40Z"},{"id":"wordfence:00cb5ce9-cca2-4e41-8d00-1d2ca7770dce","source":"wordfence","cve":"CVE-2015-9392","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Scripting via p_name parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00cb5ce9-cca2-4e41-8d00-1d2ca7770dce?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.63","to_inclusive":false,"patched_in":"1.5.63"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00d46496-4ca0-4297-a276-a40f91d50555","source":"wordfence","cve":"CVE-2025-53276","title":"Omnipress <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d46496-4ca0-4297-a276-a40f91d50555?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-06-27T00:00:00Z","updated":"2025-12-11T14:12:51Z"},{"id":"wordfence:00d5c081-d703-4195-aa92-204624d72203","source":"wordfence","cve":"CVE-2026-25307","title":"XStore Core < 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d5c081-d703-4195-aa92-204624d72203?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":false,"patched_in":"5.7"}],"published":"2026-01-19T00:00:00Z","updated":"2026-05-04T15:10:25Z"},{"id":"wordfence:00d69e80-36fa-4b74-8138-56c0bf576e44","source":"wordfence","cve":"CVE-2018-20155","title":"WP Maintenance Mode <= 2.0.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d69e80-36fa-4b74-8138-56c0bf576e44?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2016-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00d8124a-3bbc-42a0-afe1-e8e2dd9123fd","source":"wordfence","cve":"CVE-2025-24743","title":"RomethemeKit For Elementor <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d8124a-3bbc-42a0-afe1-e8e2dd9123fd?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:37:58Z"},{"id":"wordfence:00d8e7db-b1a4-4785-ba57-1dce0fd11dec","source":"wordfence","cve":"CVE-2026-25326","title":"CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d8e7db-b1a4-4785-ba57-1dce0fd11dec?source=api-prod","affected":[{"type":"plugin","slug":"cmsmasters-content-composer","name":"CMSMasters Content Composer","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-02-02T00:00:00Z","updated":"2026-02-26T19:51:59Z"},{"id":"wordfence:00d8ef65-477a-49d0-92c1-b5d70b068c39","source":"wordfence","cve":"CVE-2025-68011","title":"GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d8ef65-477a-49d0-92c1-b5d70b068c39?source=api-prod","affected":[{"type":"plugin","slug":"gls-shipping-for-woocommerce","name":"GLS Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-12-29T00:00:00Z","updated":"2026-02-23T21:45:10Z"},{"id":"wordfence:00d94fbc-3057-45f0-8b68-aa08f97ca372","source":"wordfence","cve":"CVE-2025-23602","title":"EELV Newsletter  <= 4.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d94fbc-3057-45f0-8b68-aa08f97ca372?source=api-prod","affected":[{"type":"plugin","slug":"eelv-newsletter","name":"EELV Newsletter","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:25:14Z"},{"id":"wordfence:00d96c28-34fc-4051-b8ea-7649f4f70813","source":"wordfence","cve":"CVE-2026-114708","title":"JetSmartFilters <= 3.8.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00d96c28-34fc-4051-b8ea-7649f4f70813?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.8.6.1","to_inclusive":true,"patched_in":"3.8.6.2"}],"published":"2026-10-26T10:36:00Z","updated":"2026-10-28T01:21:24Z"},{"id":"wordfence:00dbb2e7-5989-4fb9-b30b-ee582bf39e3f","source":"wordfence","cve":"CVE-2026-116609","title":"WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00dbb2e7-5989-4fb9-b30b-ee582bf39e3f?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.8","to_inclusive":true,"patched_in":"8.9"}],"published":"2026-10-27T17:51:05Z","updated":"2026-10-28T06:45:05Z"},{"id":"wordfence:00dc3911-c29e-4f4f-973c-8e4da5dd0e35","source":"wordfence","cve":"CVE-2024-50515","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00dc3911-c29e-4f4f-973c-8e4da5dd0e35?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.8.18"}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T18:54:40Z"},{"id":"wordfence:00dd9a3c-a9f9-4fd2-9c93-0def42cec496","source":"wordfence","cve":"CVE-2025-14904","title":"Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00dd9a3c-a9f9-4fd2-9c93-0def42cec496?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-email-subscribe","name":"Newsletter Email Subscribe","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:35:02Z","updated":"2026-01-07T06:35:57Z"},{"id":"wordfence:00df02cd-b4d3-477a-86ee-aa2f9b5216e8","source":"wordfence","cve":"CVE-2025-3234","title":"File Manager Pro \u2013 Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00df02cd-b4d3-477a-86ee-aa2f9b5216e8?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2025-06-13T17:25:06Z","updated":"2025-06-14T05:32:03Z"},{"id":"wordfence:00e070b7-bdf6-4a80-a3ee-628243f1cc25","source":"wordfence","cve":"CVE-2026-2413","title":"Ally \u2013 Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00e070b7-bdf6-4a80-a3ee-628243f1cc25?source=api-prod","affected":[{"type":"plugin","slug":"pojo-accessibility","name":"Web Accessibility (formally known as Ally) \u2013 WCAG Scanning, Guided Fixes, Usability Widget","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-03-10T16:11:03Z","updated":"2026-03-11T04:25:48Z"},{"id":"wordfence:00e71f8e-1657-4713-af99-8b8766080c3f","source":"wordfence","cve":"CVE-2025-23850","title":"Mojo Under Construction <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00e71f8e-1657-4713-af99-8b8766080c3f?source=api-prod","affected":[{"type":"plugin","slug":"mojo-under-construction","name":"Mojo Under Construction","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:46:24Z"},{"id":"wordfence:00ec14d4-d97b-40b1-b61b-05e911f49bb0","source":"wordfence","cve":"CVE-2024-5438","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T12:33:42Z"},{"id":"wordfence:00ec2f57-48ee-49ea-ae8f-e7b24bf4535c","source":"wordfence","cve":"CVE-2023-48747","title":"Booster for WooCommerce <= 7.1.2 - Missing Authorization to Product Creation/Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec2f57-48ee-49ea-ae8f-e7b24bf4535c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00ec7251-3be1-411a-b38e-1782d1691e18","source":"wordfence","cve":"CVE-2024-12267","title":"Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec7251-3be1-411a-b38e-1782d1691e18?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.8.5","to_inclusive":true,"patched_in":"1.3.8.6"}],"published":"2025-01-30T22:59:03Z","updated":"2025-01-31T11:11:11Z"},{"id":"wordfence:00eed43d-9818-4ed8-b7b9-7e6aed9a9c64","source":"wordfence","cve":"CVE-2025-10915","title":"Dreamer Blog <= 1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00eed43d-9818-4ed8-b7b9-7e6aed9a9c64?source=api-prod","affected":[{"type":"theme","slug":"dreamer-blog","name":"Dreamer Blog","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-14T00:00:00Z","updated":"2026-01-19T18:20:23Z"},{"id":"wordfence:00f33681-7edb-40a8-a1b4-433765ef7585","source":"wordfence","cve":"CVE-2024-32093","title":"Novelist <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f33681-7edb-40a8-a1b4-433765ef7585?source=api-prod","affected":[{"type":"plugin","slug":"novelist","name":"Novelist","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T19:07:38Z"},{"id":"wordfence:00f5812d-661e-4206-8c3d-127bc3d48961","source":"wordfence","cve":"","title":"Woocommerce Tabs Plugin, Add Custom Product Tabs <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f5812d-661e-4206-8c3d-127bc3d48961?source=api-prod","affected":[{"type":"plugin","slug":"fma-products-tabs-pro","name":"Woocommerce Tabs Plugin, Add Custom Product Tabs","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00f5cf90-cc63-4e51-b1be-1152abefc59d","source":"wordfence","cve":"CVE-2026-8877","title":"Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f5cf90-cc63-4e51-b1be-1152abefc59d?source=api-prod","affected":[{"type":"plugin","slug":"responsive-video-embedder","name":"Responsive Video Embedder","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:26:25Z","updated":"2026-05-27T05:31:18Z"},{"id":"wordfence:00f65117-e8f7-41d8-bdf4-c1fab03e4792","source":"wordfence","cve":"CVE-2025-12070","title":"ViaAds <= 2.1.2 - Cross-Site Request Forgery to API Key Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f65117-e8f7-41d8-bdf4-c1fab03e4792?source=api-prod","affected":[{"type":"plugin","slug":"viaads","name":"ViaAds","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-11-03T15:18:27Z","updated":"2025-11-17T20:46:30Z"},{"id":"wordfence:00f7a207-2dc0-4322-a23d-7cd2eb10c21e","source":"wordfence","cve":"CVE-2025-69018","title":"Web Directory Free <= 1.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f7a207-2dc0-4322-a23d-7cd2eb10c21e?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.12","to_inclusive":true,"patched_in":"1.7.13"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-05T19:05:06Z"},{"id":"wordfence:00f98ddd-69cc-4850-81e0-3da045d03775","source":"wordfence","cve":"CVE-2026-81765","title":"Tailored Tools <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f98ddd-69cc-4850-81e0-3da045d03775?source=api-prod","affected":[{"type":"plugin","slug":"tailored-tools","name":"Tailored Tools","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:36:47Z"},{"id":"wordfence:00f9fd4b-4730-4fa5-80b2-00d97dc72b8e","source":"wordfence","cve":"CVE-2008-0198","title":"WP-ContactForm <= 1.5.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00f9fd4b-4730-4fa5-80b2-00d97dc72b8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-contactform","name":"WP-ContactForm","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2008-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00fa12c7-5814-45f3-a35e-363cd0920e43","source":"wordfence","cve":"CVE-2023-25020","title":"Arigato Autoresponder and Newsletter <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fa12c7-5814-45f3-a35e-363cd0920e43?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.1.1"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00fa2ca1-a1bd-4b58-ae64-1b61534c1e3d","source":"wordfence","cve":"CVE-2018-10371","title":"WF Cookie Consent <= 1.1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fa2ca1-a1bd-4b58-ae64-1b61534c1e3d?source=api-prod","affected":[{"type":"plugin","slug":"wf-cookie-consent","name":"WF Cookie Consent","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2018-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00fbbd00-c98e-41b3-9777-3a0d1295c24b","source":"wordfence","cve":"CVE-2008-0204","title":"Math Comment Spam Protection <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fbbd00-c98e-41b3-9777-3a0d1295c24b?source=api-prod","affected":[{"type":"plugin","slug":"math-comment-spam-protection","name":"Math Comment Spam Protection","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2008-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:00fcd671-5160-4c5b-bab8-aaa829fe25d4","source":"wordfence","cve":"CVE-2026-12906","title":"RTMKit Addons for Elementor <= 2.0.8 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fcd671-5160-4c5b-bab8-aaa829fe25d4?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T13:42:04Z"},{"id":"wordfence:00fe4d88-0481-4861-ad26-a2493ffacdc6","source":"wordfence","cve":"CVE-2024-49269","title":"my flatonica <= 0.0.8 & my wooden under construction <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fe4d88-0481-4861-ad26-a2493ffacdc6?source=api-prod","affected":[{"type":"theme","slug":"my-engine","name":"my engine","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"my-flatonica","name":"my flatonica","from":"*","from_inclusive":true,"to":"0.0.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"my-money","name":"my money","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"my-depressive","name":"my depressive","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"my-wooden-under-construction","name":"my wooden under construction","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"my-zebra","name":"my zebra","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2025-01-22T20:05:24Z"},{"id":"wordfence:00fe71f4-365a-4151-90bd-a23a554c614c","source":"wordfence","cve":"CVE-2025-67590","title":"Ultimate FAQ <= 2.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/00fe71f4-365a-4151-90bd-a23a554c614c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-11-08T00:00:00Z","updated":"2025-12-11T17:09:24Z"},{"id":"wordfence:0101113b-70c2-4db4-b6b1-b2412f6e1214","source":"wordfence","cve":"CVE-2026-6344","title":"Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0101113b-70c2-4db4-b6b1-b2412f6e1214?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-05-05T17:53:19Z","updated":"2026-05-06T06:47:20Z"},{"id":"wordfence:010183f3-d614-4fe7-aa70-56d6b3fc5ddc","source":"wordfence","cve":"CVE-2025-25122","title":"WizShop <= 3.0.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010183f3-d614-4fe7-aa70-56d6b3fc5ddc?source=api-prod","affected":[{"type":"plugin","slug":"wizshop","name":"WizShop","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:51:13Z"},{"id":"wordfence:010300f9-adef-4958-ac77-6ff981833e9e","source":"wordfence","cve":"","title":"Blaze Slide Show <= 2.7 - Arbitrary File upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010300f9-adef-4958-ac77-6ff981833e9e?source=api-prod","affected":[{"type":"plugin","slug":"blaze-slide-show-for-wordpress","name":"Blaze Slideshow","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2016-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0104d718-2b55-4d2e-93db-dcca7da2913d","source":"wordfence","cve":"CVE-2025-22778","title":"Lijit Search <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0104d718-2b55-4d2e-93db-dcca7da2913d?source=api-prod","affected":[{"type":"plugin","slug":"wp-lijit-wijit","name":"Lijit Search","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:42:25Z"},{"id":"wordfence:0104fa43-06c6-4e98-bced-4dd6ce355203","source":"wordfence","cve":"CVE-2025-52750","title":"Emu2 <= 0.83b - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0104fa43-06c6-4e98-bced-4dd6ce355203?source=api-prod","affected":[{"type":"plugin","slug":"emu2-email-users-2","name":"Emu2 \u2013 Email Users 2","from":"*","from_inclusive":true,"to":"0.83b","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2025-11-04T16:04:12Z"},{"id":"wordfence:01055be6-42ae-405f-9c8b-7acf5297867e","source":"wordfence","cve":"CVE-2026-7620","title":"Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01055be6-42ae-405f-9c8b-7acf5297867e?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-07-10T14:35:09Z","updated":"2026-07-11T03:44:20Z"},{"id":"wordfence:010590bc-98fb-4afe-9c5e-80ad4c50a34e","source":"wordfence","cve":"CVE-2024-10802","title":"Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010590bc-98fb-4afe-9c5e-80ad4c50a34e?source=api-prod","affected":[{"type":"plugin","slug":"hash-elements","name":"Hash Elements","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T03:20:05Z"},{"id":"wordfence:01094597-4bdd-4928-959a-13306315389e","source":"wordfence","cve":"CVE-2026-22417","title":"Grand Wedding < 3.1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01094597-4bdd-4928-959a-13306315389e?source=api-prod","affected":[{"type":"theme","slug":"grandwedding","name":"Grand Wedding WordPress","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":false,"patched_in":"3.1.11"}],"published":"2026-03-03T00:00:00Z","updated":"2026-04-15T13:40:03Z"},{"id":"wordfence:010a2bcf-e1e9-4287-bb7c-88597bbadcbb","source":"wordfence","cve":"CVE-2026-121574","title":"Passster \u2013 Password Protect Pages and Content <= 4.3.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010a2bcf-e1e9-4287-bb7c-88597bbadcbb?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"4.3.21"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:28Z"},{"id":"wordfence:010ce1c3-dd07-4ed6-8908-0909c0842be8","source":"wordfence","cve":"CVE-2018-7543","title":"Duplicator <= 1.2.32 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010ce1c3-dd07-4ed6-8908-0909c0842be8?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.2.33"}],"published":"2018-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:010df788-42cf-4455-9f5f-b23d03905afb","source":"wordfence","cve":"CVE-2019-15840","title":"Facebook for WooCommerce <= 1.9.12 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010df788-42cf-4455-9f5f-b23d03905afb?source=api-prod","affected":[{"type":"plugin","slug":"facebook-for-woocommerce","name":"Meta for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2019-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:010f1cd4-da4c-4693-8d1a-a93e779e36f3","source":"wordfence","cve":"CVE-2025-60080","title":"PDF for Gravity Forms + Drag And Drop Template Builder <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/010f1cd4-da4c-4693-8d1a-a93e779e36f3?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-gravity-forms","name":"PDF for Gravity Forms + Drag And Drop Template Builder","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-08-23T00:00:00Z","updated":"2026-01-30T20:44:07Z"},{"id":"wordfence:01105d96-e181-4228-b785-074a4b49ce18","source":"wordfence","cve":"","title":"WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01105d96-e181-4228-b785-074a4b49ce18?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0111a73e-3d5a-4dd5-8974-dc43aafb5050","source":"wordfence","cve":"CVE-2024-54383","title":"WooCommerce PDF Vouchers < 4.9.9 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0111a73e-3d5a-4dd5-8974-dc43aafb5050?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":false,"patched_in":"4.9.9"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:33:02Z"},{"id":"wordfence:01139cbd-1116-4cf8-bdcb-cb182588d093","source":"wordfence","cve":"","title":"BlogVault WordPress Backup Plugin 1.40 - 1.44 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.3,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01139cbd-1116-4cf8-bdcb-cb182588d093?source=api-prod","affected":[{"type":"plugin","slug":"blogvault-real-time-backup","name":"BlogVault Backup & Staging","from":"1.40","from_inclusive":true,"to":"1.44","to_inclusive":true,"patched_in":"1.45"}],"published":"2017-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01142e56-ac59-40bc-b401-bbaf12c3a351","source":"wordfence","cve":"CVE-2025-68513","title":"Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01142e56-ac59-40bc-b401-bbaf12c3a351?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-12-27T00:00:00Z","updated":"2026-01-05T18:47:17Z"},{"id":"wordfence:0114a028-42ef-4668-815f-d62494565116","source":"wordfence","cve":"","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0114a028-42ef-4668-815f-d62494565116?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.11","to_inclusive":true,"patched_in":"6.4.12"}],"published":"2026-05-21T00:00:00Z","updated":"2026-06-01T16:34:48Z"},{"id":"wordfence:0114f098-713d-4eef-8643-901f607375de","source":"wordfence","cve":"CVE-2022-21664","title":"WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query","severity":"high","cvss":7.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0114f098-713d-4eef-8643-901f607375de?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":false,"patched_in":"4.1.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":false,"patched_in":"4.1.34"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01170186-3384-494b-83d3-86ba3cf74837","source":"wordfence","cve":"CVE-2024-34435","title":"Aiomatic <= 1.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01170186-3384-494b-83d3-86ba3cf74837?source=api-prod","affected":[{"type":"plugin","slug":"aiomatic-automatic-ai-content-writer","name":"Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:14:55Z"},{"id":"wordfence:01179ac2-ad68-4a5d-af67-70d57ed611d2","source":"wordfence","cve":"CVE-2015-9527","title":"Easy Digital Downloads \u2013 Simple Shipping <= 2.1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01179ac2-ad68-4a5d-af67-70d57ed611d2?source=api-prod","affected":[{"type":"plugin","slug":"simple-shipping-edd","name":"Easy Digital Downloads \u2013 Simple Shipping","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0119b7c3-0e5b-4448-98fc-662695012532","source":"wordfence","cve":"CVE-2024-47303","title":"Livemesh Addons for Elementor <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0119b7c3-0e5b-4448-98fc-662695012532?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.5","to_inclusive":true,"patched_in":"8.5.1"}],"published":"2024-09-25T00:00:00Z","updated":"2026-04-15T20:36:17Z"},{"id":"wordfence:011acdd3-8185-4288-968b-aa7cf33e3018","source":"wordfence","cve":"CVE-2025-58703","title":"Skyword API Plugin <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011acdd3-8185-4288-968b-aa7cf33e3018?source=api-prod","affected":[{"type":"plugin","slug":"skyword-plugin","name":"Skyword XMLRPC publishing","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2026-09-30T14:20:28Z"},{"id":"wordfence:011b1287-eb4b-4661-8797-bda4221616c1","source":"wordfence","cve":"CVE-2026-112219","title":"Download Monitor < 5.3.5 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011b1287-eb4b-4661-8797-bda4221616c1?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":false,"patched_in":"5.3.5"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:08:18Z"},{"id":"wordfence:011be772-a3e6-418f-ba83-e075af4b7e08","source":"wordfence","cve":"CVE-2025-30635","title":"IDonatePro <= 2.1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011be772-a3e6-418f-ba83-e075af4b7e08?source=api-prod","affected":[{"type":"plugin","slug":"idonate-pro","name":"IDonatePro - Blood Donation, Request And Donor Management WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:51:53Z"},{"id":"wordfence:011c8a06-298e-4a53-9ef8-552585426d79","source":"wordfence","cve":"CVE-2023-5071","title":"Sitekit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011c8a06-298e-4a53-9ef8-552585426d79?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:011d654a-637f-418c-8bd3-e87fd889f1ab","source":"wordfence","cve":"CVE-2024-9186","title":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011d654a-637f-418c-8bd3-e87fd889f1ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-12-12T19:16:19Z"},{"id":"wordfence:011e4419-6105-4405-a277-b765288c86d1","source":"wordfence","cve":"CVE-2026-112207","title":"Download Monitor <= 5.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011e4419-6105-4405-a277-b765288c86d1?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:16:29Z"},{"id":"wordfence:011fad07-0235-41e1-83b5-09588dd63d50","source":"wordfence","cve":"CVE-2015-4084","title":"Free counter <= 1.1 -  Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/011fad07-0235-41e1-83b5-09588dd63d50?source=api-prod","affected":[{"type":"plugin","slug":"free-counter","name":"Free counter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01280afb-4745-4f36-823e-ed794bb3353a","source":"wordfence","cve":"CVE-2026-1607","title":"Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01280afb-4745-4f36-823e-ed794bb3353a?source=api-prod","affected":[{"type":"plugin","slug":"surbma-bookingcom-shortcode","name":"Surbma | Booking.com Shortcode","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-04-13T14:39:51Z","updated":"2026-04-14T03:37:32Z"},{"id":"wordfence:012946d4-82ce-48b9-9b9a-1fc49846dca6","source":"wordfence","cve":"CVE-2023-5705","title":"VK Filter Search <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012946d4-82ce-48b9-9b9a-1fc49846dca6?source=api-prod","affected":[{"type":"plugin","slug":"vk-filter-search","name":"VK Filter Search","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01299aba-0dff-47fd-9e90-ee84f00a0f3b","source":"wordfence","cve":"CVE-2025-13660","title":"Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01299aba-0dff-47fd-9e90-ee84f00a0f3b?source=api-prod","affected":[{"type":"plugin","slug":"guest-support","name":"Guest Support \u2013 Customer Support Ticket System Without Login","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-12-11T18:29:24Z","updated":"2025-12-12T06:32:56Z"},{"id":"wordfence:012a558c-1f80-4f36-85d9-905f4ed0b6cb","source":"wordfence","cve":"CVE-2024-22305","title":"Contact Form builder with drag & drop - Kali Forms <= 2.3.36 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012a558c-1f80-4f36-85d9-905f4ed0b6cb?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.3.36","to_inclusive":true,"patched_in":"2.3.37"}],"published":"2024-01-17T00:00:00Z","updated":"2024-02-02T00:01:54Z"},{"id":"wordfence:012b3e9f-a926-42b3-b825-2314d9f72474","source":"wordfence","cve":"CVE-2026-22326","title":"Reprizo <= 1.0.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012b3e9f-a926-42b3-b825-2314d9f72474?source=api-prod","affected":[{"type":"theme","slug":"reprizo","name":"Reprizo - Jewelry & Watch Store Shopify Theme","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T15:59:17Z"},{"id":"wordfence:012b5334-afdc-47bd-8eaf-967b40fef59b","source":"wordfence","cve":"CVE-2024-32601","title":"Popup Anything <= 2.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012b5334-afdc-47bd-8eaf-967b40fef59b?source=api-prod","affected":[{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T14:27:21Z"},{"id":"wordfence:012e019f-9146-45bc-b4d7-aa724dbebdc6","source":"wordfence","cve":"CVE-2021-24635","title":"Visual Link Preview <= 2.2.2 - Unauthorised AJAX Calls","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012e019f-9146-45bc-b4d7-aa724dbebdc6?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:012e281d-7b9b-4ef1-ae8d-09984914a5e9","source":"wordfence","cve":"CVE-2025-60122","title":"HivePress Claim Listings <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012e281d-7b9b-4ef1-ae8d-09984914a5e9?source=api-prod","affected":[{"type":"plugin","slug":"hivepress-claim-listings","name":"HivePress Claim Listings","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-09-26T00:00:00Z","updated":"2026-11-03T22:44:50Z"},{"id":"wordfence:012e7aed-04d9-4795-9ea9-40dd72fa612f","source":"wordfence","cve":"CVE-2025-57943","title":"Skimlinks Affiliate Marketing Tool <= 1.3 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/012e7aed-04d9-4795-9ea9-40dd72fa612f?source=api-prod","affected":[{"type":"plugin","slug":"skimlinks","name":"Skimlinks Affiliate Marketing Tool","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:24:43Z"},{"id":"wordfence:0131921b-6f60-4da1-b5d9-d44a33d35cae","source":"wordfence","cve":"CVE-2023-31087","title":"JS Job Manager <= 2.0.0 - Cross-Site Request Forgery via multiple functions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0131921b-6f60-4da1-b5d9-d44a33d35cae?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:013661c3-66f3-46df-af63-801e159abbd2","source":"wordfence","cve":"CVE-2025-68867","title":"Effect Maker <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/013661c3-66f3-46df-af63-801e159abbd2?source=api-prod","affected":[{"type":"plugin","slug":"effect-maker","name":"Effect Maker","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T17:35:26Z"},{"id":"wordfence:01367ff4-1108-4ea5-90d1-030e384f1734","source":"wordfence","cve":"CVE-2024-13631","title":"Om Stripe <= 02.00.00 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01367ff4-1108-4ea5-90d1-030e384f1734?source=api-prod","affected":[{"type":"plugin","slug":"om-stripe","name":"Om Stripe","from":"*","from_inclusive":true,"to":"02.00.00","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-03-03T20:55:21Z"},{"id":"wordfence:0136b4e4-e22b-43a3-bad5-6fe397cdd7c8","source":"wordfence","cve":"CVE-2025-26557","title":"ViperBar <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0136b4e4-e22b-43a3-bad5-6fe397cdd7c8?source=api-prod","affected":[{"type":"plugin","slug":"viperbar","name":"ViperBar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:16:23Z"},{"id":"wordfence:01370a71-2611-4826-b08b-485839ca606a","source":"wordfence","cve":"CVE-2023-32511","title":"Booking Ultra Pro <= 1.1.8 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01370a71-2611-4826-b08b-485839ca606a?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01391c72-6829-4c17-af0b-597965ee9fca","source":"wordfence","cve":"CVE-2025-49397","title":"Colorbox Lightbox <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01391c72-6829-4c17-af0b-597965ee9fca?source=api-prod","affected":[{"type":"plugin","slug":"wp-colorbox","name":"WP Colorbox","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:09:35Z"},{"id":"wordfence:0139661f-75d2-44b7-8278-e31c24935a85","source":"wordfence","cve":"CVE-2025-53210","title":"ZoloBlocks <= 2.3.2 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0139661f-75d2-44b7-8278-e31c24935a85?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T15:02:13Z"},{"id":"wordfence:013bd345-ea5a-4104-a59e-639939a5452d","source":"wordfence","cve":"CVE-2026-112199","title":"YITH WooCommerce Wishlist <= 4.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/013bd345-ea5a-4104-a59e-639939a5452d?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.18.1","to_inclusive":true,"patched_in":"4.19.0"}],"published":"2026-10-19T12:06:00Z","updated":"2026-10-23T18:48:48Z"},{"id":"wordfence:013f6ad0-6ef1-44a1-9925-c60c61314f70","source":"wordfence","cve":"CVE-2025-22507","title":"WPMU Prefill Post <= 1.02 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/013f6ad0-6ef1-44a1-9925-c60c61314f70?source=api-prod","affected":[{"type":"plugin","slug":"wpmu-prefill-post","name":"WPMU Prefill Post","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:57:04Z"},{"id":"wordfence:013f7c26-8348-4c54-af61-473a720a5095","source":"wordfence","cve":"CVE-2024-6835","title":"Ivory Search \u2013 WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/013f7c26-8348-4c54-af61-473a720a5095?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2024-09-04T00:00:00Z","updated":"2024-09-05T06:41:39Z"},{"id":"wordfence:013ff32d-b3ea-4d36-87c3-a31de447e699","source":"wordfence","cve":"CVE-2026-39606","title":"BizReview <= 1.5.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/013ff32d-b3ea-4d36-87c3-a31de447e699?source=api-prod","affected":[{"type":"plugin","slug":"bizreview","name":"BizReview \u2013 Business and Google Place Review Plugin","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T00:00:00Z","updated":"2026-04-15T21:31:39Z"},{"id":"wordfence:01404fad-7b5a-485a-b557-c608fe25e6c9","source":"wordfence","cve":"CVE-2026-18432","title":"Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01404fad-7b5a-485a-b557-c608fe25e6c9?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.9","to_inclusive":true,"patched_in":"3.29.10"}],"published":"2026-08-15T15:30:21Z","updated":"2026-08-16T04:24:52Z"},{"id":"wordfence:01427553-bc1d-4927-9110-0facd301d976","source":"wordfence","cve":"CVE-2024-52441","title":"Quick Learn <= 1.0.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01427553-bc1d-4927-9110-0facd301d976?source=api-prod","affected":[{"type":"plugin","slug":"quick-learn","name":"Quick Learn","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:02:49Z"},{"id":"wordfence:014392ee-4b24-4b81-954e-fc87727436ab","source":"wordfence","cve":"CVE-2025-24568","title":"Starter Templates <= 4.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014392ee-4b24-4b81-954e-fc87727436ab?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.4.10"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T17:59:23Z"},{"id":"wordfence:0143b789-06ea-47da-9736-3266f91a9e33","source":"wordfence","cve":"CVE-2026-9615","title":"Flex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0143b789-06ea-47da-9736-3266f91a9e33?source=api-prod","affected":[{"type":"plugin","slug":"flex-import","name":"Flex Import","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-09-18T18:57:43Z","updated":"2026-09-19T07:43:11Z"},{"id":"wordfence:0144ae03-00ce-481d-8d29-7a484f1f6cbf","source":"wordfence","cve":"CVE-2025-11834","title":"WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0144ae03-00ce-481d-8d29-7a484f1f6cbf?source=api-prod","affected":[{"type":"plugin","slug":"wp-ad-gallery","name":"WP AD Gallery","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:16:44Z","updated":"2025-10-22T08:27:02Z"},{"id":"wordfence:01465fd0-defe-4754-a4a1-10073fcd1902","source":"wordfence","cve":"CVE-2026-57667","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01465fd0-defe-4754-a4a1-10073fcd1902?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:48:35Z"},{"id":"wordfence:014803c8-3319-48ad-98c7-d1f372d37ff2","source":"wordfence","cve":"CVE-2025-6740","title":"Contact Form 7 Database Addon <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014803c8-3319-48ad-98c7-d1f372d37ff2?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-07-03T21:37:34Z","updated":"2025-07-04T11:18:26Z"},{"id":"wordfence:01486af8-b378-4663-a9c5-167b8580db94","source":"wordfence","cve":"CVE-2022-2696","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01486af8-b378-4663-a9c5-167b8580db94?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0148c70f-38e4-43d9-994e-f2b01dd168a1","source":"wordfence","cve":"CVE-2026-16078","title":"WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0148c70f-38e4-43d9-994e-f2b01dd168a1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pos","name":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2026-07-22T20:32:41Z","updated":"2026-07-23T08:34:38Z"},{"id":"wordfence:0149ae49-5d40-4431-9612-04182afce2ec","source":"wordfence","cve":"CVE-2024-10784","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0149ae49-5d40-4431-9612-04182afce2ec?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.126","to_inclusive":true,"patched_in":"1.5.127"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:32Z"},{"id":"wordfence:014ccad9-a836-4a40-92d3-8c3320fbead8","source":"wordfence","cve":"CVE-2023-31221","title":"PDQ CSV <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014ccad9-a836-4a40-92d3-8c3320fbead8?source=api-prod","affected":[{"type":"plugin","slug":"pdq-csv","name":"PDQ CSV","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:014da588-9494-493e-8659-590b8e8c14a6","source":"wordfence","cve":"","title":"Spreadsheet Integration and Spreadsheet Integration Pro <= 3.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014da588-9494-493e-8659-590b8e8c14a6?source=api-prod","affected":[{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"},{"type":"plugin","slug":"wpgsi-professional","name":"wpgsi-professional","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2021-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:014dcf08-1968-4a3f-a772-2248e65dfb07","source":"wordfence","cve":"CVE-2014-2274","title":"Subscribe To Comments Reloaded <= 140129 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014dcf08-1968-4a3f-a772-2248e65dfb07?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments-reloaded","name":"Subscribe To Comments Reloaded","from":"*","from_inclusive":true,"to":"140129","to_inclusive":true,"patched_in":"140219"}],"published":"2014-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:014dd0ee-0bd0-477c-a0fa-bde8ce5a099c","source":"wordfence","cve":"CVE-2025-12746","title":"Tainacan <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014dd0ee-0bd0-477c-a0fa-bde8ce5a099c?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-11-20T18:46:14Z","updated":"2025-11-21T07:31:46Z"},{"id":"wordfence:014f1aae-10a0-4bc8-b176-dbdad94a6ad8","source":"wordfence","cve":"CVE-2022-0320","title":"Essential Addons for Elementor  <= 5.0.4 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/014f1aae-10a0-4bc8-b176-dbdad94a6ad8?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"1.0.0","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2022-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:015108f7-8818-42a6-83b9-5afa716b44c5","source":"wordfence","cve":"CVE-2026-86606","title":"iubenda <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/015108f7-8818-42a6-83b9-5afa716b44c5?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.13.6","to_inclusive":true,"patched_in":"3.13.7"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T20:08:28Z"},{"id":"wordfence:01515533-197c-41c0-9c2b-6f0317cdc375","source":"wordfence","cve":"CVE-2026-103370","title":"Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01515533-197c-41c0-9c2b-6f0317cdc375?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2026-10-27T18:38:24Z","updated":"2026-10-28T06:45:05Z"},{"id":"wordfence:0152bcc9-6d24-4475-848d-71fe88aa7e2a","source":"wordfence","cve":"CVE-2023-33327","title":"Leyka <= 3.30.2 - Privilege Escalation via Admin Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0152bcc9-6d24-4475-848d-71fe88aa7e2a?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.30.2","to_inclusive":true,"patched_in":"3.30.3"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01538008-bdd2-43f6-962d-5d97f38d9c10","source":"wordfence","cve":"CVE-2026-97074","title":"Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01538008-bdd2-43f6-962d-5d97f38d9c10?source=api-prod","affected":[{"type":"plugin","slug":"omnisend","name":"Newsletters, Email Marketing, SMS and Popups by Omnisend","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:28:15Z"},{"id":"wordfence:0153fb37-788e-42f2-9dfa-76418decf1f3","source":"wordfence","cve":"CVE-2025-9213","title":"TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0153fb37-788e-42f2-9dfa-76418decf1f3?source=api-prod","affected":[{"type":"plugin","slug":"textbuilder","name":"TextBuilder","from":"1.0.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-10-02T22:15:26Z","updated":"2025-10-03T11:17:07Z"},{"id":"wordfence:01540d78-ae46-4556-9a7f-3f8b8dbbcbd7","source":"wordfence","cve":"CVE-2026-96752","title":"Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01540d78-ae46-4556-9a7f-3f8b8dbbcbd7?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.7.10","to_inclusive":true,"patched_in":"5.7.11"}],"published":"2026-09-24T19:10:05Z","updated":"2026-09-25T07:40:24Z"},{"id":"wordfence:01573bd1-7ac0-4a12-9bf1-097db4d5ec1e","source":"wordfence","cve":"CVE-2026-97663","title":"Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01573bd1-7ac0-4a12-9bf1-097db4d5ec1e?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.122.0","to_inclusive":true,"patched_in":"5.123.0"}],"published":"2026-10-01T18:50:51Z","updated":"2026-10-02T07:39:21Z"},{"id":"wordfence:0158ebd2-1f32-4269-aa1e-e258dafa80ff","source":"wordfence","cve":"CVE-2025-28933","title":"MaxA/B <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0158ebd2-1f32-4269-aa1e-e258dafa80ff?source=api-prod","affected":[{"type":"plugin","slug":"maxab","name":"MaxA/B","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:22:40Z"},{"id":"wordfence:015942ef-fb6c-4b58-ab67-f7e903321f32","source":"wordfence","cve":"CVE-2026-24945","title":"Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/015942ef-fb6c-4b58-ab67-f7e903321f32?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.34","to_inclusive":true,"patched_in":"3.5.35"}],"published":"2025-12-13T00:00:00Z","updated":"2026-02-10T19:27:48Z"},{"id":"wordfence:015db31a-eadf-4159-9be4-a455de791e35","source":"wordfence","cve":"CVE-2026-2466","title":"DukaPress <= 3.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/015db31a-eadf-4159-9be4-a455de791e35?source=api-prod","affected":[{"type":"plugin","slug":"dukapress","name":"DukaPress","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-12T16:09:39Z"},{"id":"wordfence:016462cf-abe9-4c90-abd2-b5bb69348d7e","source":"wordfence","cve":"CVE-2024-3883","title":"3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/016462cf-abe9-4c90-abd2-b5bb69348d7e?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.15.4","to_inclusive":true,"patched_in":"1.15.5"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T08:32:12Z"},{"id":"wordfence:0166a2b2-24e2-4dd6-8842-d3e8dd7bb0dc","source":"wordfence","cve":"CVE-2024-5085","title":"Hash Form \u2013 Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0166a2b2-24e2-4dd6-8842-d3e8dd7bb0dc?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T14:31:38Z"},{"id":"wordfence:0169909e-c6cd-4d08-8301-5e09fce4429c","source":"wordfence","cve":"CVE-2026-111254","title":"W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0169909e-c6cd-4d08-8301-5e09fce4429c?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.7","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2026-10-30T18:04:38Z","updated":"2026-10-31T06:44:14Z"},{"id":"wordfence:016c56c0-38d2-4f84-a0bc-3c6c25847603","source":"wordfence","cve":"CVE-2025-26879","title":"s2Member Pro <= 241216 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/016c56c0-38d2-4f84-a0bc-3c6c25847603?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"241216","to_inclusive":true,"patched_in":"250214"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T18:16:09Z"},{"id":"wordfence:01707346-86c2-45c8-a2c9-81a147506fa4","source":"wordfence","cve":"CVE-2024-7415","title":"Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01707346-86c2-45c8-a2c9-81a147506fa4?source=api-prod","affected":[{"type":"plugin","slug":"remember-me-controls","name":"Remember Me Controls","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-06T03:30:40Z"},{"id":"wordfence:01724317-c2a1-45fc-b7da-7896eee5cd4a","source":"wordfence","cve":"CVE-2025-32556","title":"Simple Post Meta Manager <= 1.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01724317-c2a1-45fc-b7da-7896eee5cd4a?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-meta-manager","name":"Simple Post Meta Manager","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:55:07Z"},{"id":"wordfence:0173e2a3-452d-490b-8ed7-a049a476d137","source":"wordfence","cve":"CVE-2024-33939","title":"Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0173e2a3-452d-490b-8ed7-a049a476d137?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T18:50:32Z"},{"id":"wordfence:01762804-df33-4c4d-b8f6-d94a1e5b5fc9","source":"wordfence","cve":"","title":"Slideshow Gallery <= 1.5.3.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01762804-df33-4c4d-b8f6-d94a1e5b5fc9?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.5.3.1","to_inclusive":true,"patched_in":"1.5.3.2"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01769760-5bfe-4352-bc5b-141f078c0b6d","source":"wordfence","cve":"CVE-2025-3520","title":"Avatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01769760-5bfe-4352-bc5b-141f078c0b6d?source=api-prod","affected":[{"type":"plugin","slug":"avatar","name":"Avatar","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T12:41:04Z","updated":"2025-04-18T01:44:11Z"},{"id":"wordfence:0177ceb7-d507-468a-9b64-629237bc7306","source":"wordfence","cve":"CVE-2025-24601","title":"FundPress <= 2.0.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0177ceb7-d507-468a-9b64-629237bc7306?source=api-prod","affected":[{"type":"plugin","slug":"fundpress","name":"FundPress \u2013 WordPress Donation Plugin","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-28T16:10:19Z"},{"id":"wordfence:01785582-3568-4dfc-ae50-1ab92dbdcb8f","source":"wordfence","cve":"CVE-2024-51860","title":"Custom Dashboard Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01785582-3568-4dfc-ae50-1ab92dbdcb8f?source=api-prod","affected":[{"type":"plugin","slug":"create-custom-dashboard-widget","name":"Custom Dashboard Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:16:00Z"},{"id":"wordfence:017eeb19-d4e3-4def-b640-1656ab1cb8e5","source":"wordfence","cve":"CVE-2025-27351","title":"Local Search SEO Contact Page <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/017eeb19-d4e3-4def-b640-1656ab1cb8e5?source=api-prod","affected":[{"type":"plugin","slug":"local-search-seo-contact-page","name":"Local Search SEO Contact Page","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:12:15Z"},{"id":"wordfence:017f5894-be0d-4b0f-82bd-13bf7e2ff53f","source":"wordfence","cve":"CVE-2025-10049","title":"Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/017f5894-be0d-4b0f-82bd-13bf7e2ff53f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-filterable-portfolio","name":"Responsive Filterable Portfolio Gallery \u2013 Media Grid & Video Portfolio","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2025-09-09T18:22:56Z","updated":"2025-09-10T06:38:46Z"},{"id":"wordfence:017fe804-a1a5-4f8d-a531-e928d668dbc4","source":"wordfence","cve":"CVE-2023-49774","title":"WP Photo Album Plus <= 8.5.02.005 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/017fe804-a1a5-4f8d-a531-e928d668dbc4?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.5.02.005","to_inclusive":true,"patched_in":"8.6.01.005"}],"published":"2023-12-05T00:00:00Z","updated":"2024-02-05T17:31:47Z"},{"id":"wordfence:0180bf61-fdb4-40b3-bbb6-6bc76a85ed4e","source":"wordfence","cve":"CVE-2025-39484","title":"Entrada <= 5.7.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0180bf61-fdb4-40b3-bbb6-6bc76a85ed4e?source=api-prod","affected":[{"type":"theme","slug":"entrada","name":"Entrada","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:35:16Z"},{"id":"wordfence:0182ca6c-23f8-4212-bfd8-cb898e98b37b","source":"wordfence","cve":"CVE-2023-47516","title":"Category Post List Widget <= 2.0 - Unauthenticated Stored Cross-Site Scripting via custom_css","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0182ca6c-23f8-4212-bfd8-cb898e98b37b?source=api-prod","affected":[{"type":"plugin","slug":"category-post-list-widget","name":"Category Post List Widget","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0183625a-611c-4353-9d2a-7a25ae12709a","source":"wordfence","cve":"CVE-2024-5788","title":"Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0183625a-611c-4353-9d2a-7a25ae12709a?source=api-prod","affected":[{"type":"theme","slug":"silesia","name":"Silesia","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-27T18:53:42Z","updated":"2024-06-28T06:57:45Z"},{"id":"wordfence:01836c2c-0976-493e-8b13-1c7c702d1d2c","source":"wordfence","cve":"CVE-2024-4450","title":"AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01836c2c-0976-493e-8b13-1c7c702d1d2c?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2024-06-18T14:28:14Z","updated":"2024-08-01T20:29:14Z"},{"id":"wordfence:0183866d-1eab-4982-b62e-77751c7e738c","source":"wordfence","cve":"CVE-2026-15348","title":"Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter","severity":"medium","cvss":6.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0183866d-1eab-4982-b62e-77751c7e738c?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"7.0.5"}],"published":"2026-07-22T20:55:31Z","updated":"2026-07-23T09:33:56Z"},{"id":"wordfence:0184b2b5-0b50-407e-8911-b0845714ea17","source":"wordfence","cve":"CVE-2026-39615","title":"Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0184b2b5-0b50-407e-8911-b0845714ea17?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.53","to_inclusive":true,"patched_in":"3.3.54"}],"published":"2026-02-10T00:00:00Z","updated":"2026-04-15T21:33:34Z"},{"id":"wordfence:01857d1d-4b6c-4ab0-b2ef-6a948daedbe0","source":"wordfence","cve":"","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01857d1d-4b6c-4ab0-b2ef-6a948daedbe0?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.4.6.1","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0186dff1-28d3-46a4-bef2-83ec0400943d","source":"wordfence","cve":"CVE-2025-48108","title":"School Management <= 93.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0186dff1-28d3-46a4-bef2-83ec0400943d?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-09-25T20:48:47Z"},{"id":"wordfence:01878991-37c7-4c7b-b68c-d59ca66521e7","source":"wordfence","cve":"CVE-2023-46077","title":"The Awesome Feed \u2013 Custom Feed <= 2.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01878991-37c7-4c7b-b68c-d59ca66521e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-feed","name":"The Awesome Feed \u2013 Custom Feed","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01889c7b-f47b-4caf-8e35-4f8af188426e","source":"wordfence","cve":"CVE-2021-25065","title":"Smash Balloon Social Post Feed <= 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01889c7b-f47b-4caf-8e35-4f8af188426e?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2021-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:018912c2-befc-403c-8e60-161580e84f55","source":"wordfence","cve":"CVE-2022-3336","title":"Event Monster \u2013 Event Management, Tickets Booking, Upcoming Event <= 1.1.20 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/018912c2-befc-403c-8e60-161580e84f55?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01899316-4243-4542-9e2a-c99bc59c223d","source":"wordfence","cve":"CVE-2026-111840","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.5.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01899316-4243-4542-9e2a-c99bc59c223d?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.5.14","to_inclusive":true,"patched_in":"7.5.15"}],"published":"2026-10-19T13:23:55Z","updated":"2026-10-23T18:45:56Z"},{"id":"wordfence:0189d8cf-237f-4b5b-89f7-6346455d35a9","source":"wordfence","cve":"CVE-2024-49301","title":"G Meta Keywords <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0189d8cf-237f-4b5b-89f7-6346455d35a9?source=api-prod","affected":[{"type":"plugin","slug":"g-meta-keywords","name":"G Meta Keywords","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:55:13Z"},{"id":"wordfence:018a6d18-5845-486f-b945-ee454d41374f","source":"wordfence","cve":"CVE-2025-28862","title":"Comment Date and Gravatar remover <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/018a6d18-5845-486f-b945-ee454d41374f?source=api-prod","affected":[{"type":"plugin","slug":"remove-date-and-gravatar-under-comment","name":"Comment Date and Gravatar remover","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:34:24Z"},{"id":"wordfence:018fafb9-0e86-47b2-b747-04aab1c1d5e0","source":"wordfence","cve":"CVE-2026-39609","title":"Wava Payment <= 0.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/018fafb9-0e86-47b2-b747-04aab1c1d5e0?source=api-prod","affected":[{"type":"plugin","slug":"wava-payment","name":"Wava Payment Plugin","from":"*","from_inclusive":true,"to":"0.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-07T00:00:00Z","updated":"2026-04-15T21:17:15Z"},{"id":"wordfence:0191e5b0-b669-439b-8ad4-9f860e6ee637","source":"wordfence","cve":"CVE-2023-0660","title":"Smart Slider 3 <= 3.5.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0191e5b0-b669-439b-8ad4-9f860e6ee637?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.13","to_inclusive":true,"patched_in":"3.5.1.14"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01924511-f567-4162-b7cd-e9a51df9953e","source":"wordfence","cve":"CVE-2025-58927","title":"Stallion <= 1.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01924511-f567-4162-b7cd-e9a51df9953e?source=api-prod","affected":[{"type":"theme","slug":"stallion","name":"Stallion - Equestrian Club and Horse Riding School WordPess Theme","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:32:16Z"},{"id":"wordfence:01940eeb-b4a6-450d-b646-84f415ca92c9","source":"wordfence","cve":"CVE-2020-36670","title":"NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01940eeb-b4a6-450d-b646-84f415ca92c9?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.8"}],"published":"2020-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01943559-e05b-4dca-b322-d880b2729ee7","source":"wordfence","cve":"CVE-2023-1888","title":"Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01943559-e05b-4dca-b322-d880b2729ee7?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":"7.5.5"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0195bddf-eafe-45f2-9424-ffa235d9b4dc","source":"wordfence","cve":"CVE-2016-11004","title":"Elegant Themes Monarch < 1.2.7 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0195bddf-eafe-45f2-9424-ffa235d9b4dc?source=api-prod","affected":[{"type":"plugin","slug":"bloom","name":"Bloom Email Opt-In","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"monarch","name":"Monarch Social Sharing","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2016-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0195f3db-cf36-40ab-a818-9c00a269f065","source":"wordfence","cve":"CVE-2025-68003","title":"Shown Connector <= 1.2.10 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0195f3db-cf36-40ab-a818-9c00a269f065?source=api-prod","affected":[{"type":"plugin","slug":"shown-connector","name":"Shown Connector","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:31:24Z"},{"id":"wordfence:01984754-e332-4500-99a2-10a7b79967f5","source":"wordfence","cve":"CVE-2026-3339","title":"Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01984754-e332-4500-99a2-10a7b79967f5?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-20T23:25:10Z"},{"id":"wordfence:019893b8-bef1-46de-b38e-c5ebabacb878","source":"wordfence","cve":"CVE-2026-14307","title":"GeotargetingWP < 3.5.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/019893b8-bef1-46de-b38e-c5ebabacb878?source=api-prod","affected":[{"type":"plugin","slug":"geotargetingwp","name":"GeotargetingWP","from":"*","from_inclusive":true,"to":"3.5.6.2","to_inclusive":false,"patched_in":"3.5.6.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:30:22Z"},{"id":"wordfence:01996a4c-0ad8-4da8-bfa7-3442c5a67679","source":"wordfence","cve":"CVE-2025-9621","title":"WidgetPack Comment System <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01996a4c-0ad8-4da8-bfa7-3442c5a67679?source=api-prod","affected":[{"type":"plugin","slug":"widgetpack-comment-system","name":"WidgetPack Comment System","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:51:31Z","updated":"2025-10-11T09:28:36Z"},{"id":"wordfence:019c5e06-1345-4c8e-abb9-dc0ea5d55ef5","source":"wordfence","cve":"CVE-2023-52189","title":"Ideal Interactive Map <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/019c5e06-1345-4c8e-abb9-dc0ea5d55ef5?source=api-prod","affected":[{"type":"plugin","slug":"ideal-interactive-map","name":"Ideal Interactive Map","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:019cfdff-c67b-4451-984d-a7b6973ab61d","source":"wordfence","cve":"CVE-2024-43998","title":"Blogpoet <= 1.0.2 - Missing Authorization via blogpoet_install_and_activate_plugins()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/019cfdff-c67b-4451-984d-a7b6973ab61d?source=api-prod","affected":[{"type":"theme","slug":"blogpoet","name":"Blogpoet","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:23:45Z"},{"id":"wordfence:019f4735-a25c-46c7-8a7d-55351197bdf2","source":"wordfence","cve":"CVE-2015-1436","title":"Easing Slider <= 2.2.0.6 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/019f4735-a25c-46c7-8a7d-55351197bdf2?source=api-prod","affected":[{"type":"plugin","slug":"easing-slider","name":"Easing Slider","from":"*","from_inclusive":true,"to":"2.2.0.7","to_inclusive":false,"patched_in":"2.2.0.7"}],"published":"2015-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:019f85c8-e52b-40f7-8930-a2ddff0aaf97","source":"wordfence","cve":"CVE-2025-67553","title":"Advanced FAQ Manager <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/019f85c8-e52b-40f7-8930-a2ddff0aaf97?source=api-prod","affected":[{"type":"plugin","slug":"advanced-faq-manager","name":"Advanced FAQ Manager","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-10-24T00:00:00Z","updated":"2025-12-10T16:08:39Z"},{"id":"wordfence:01a120f0-fbdb-4836-a341-31452cc7ed0c","source":"wordfence","cve":"CVE-2024-6224","title":"Send email only on Reply to My Comment <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a120f0-fbdb-4836-a341-31452cc7ed0c?source=api-prod","affected":[{"type":"plugin","slug":"send-email-only-on-reply-to-my-comment","name":"Send email only on Reply to My Comment","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:16:56Z"},{"id":"wordfence:01a3b9ba-b18a-48d9-8365-d10f79fc6a6b","source":"wordfence","cve":"CVE-2024-5639","title":"User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a3b9ba-b18a-48d9-8365-d10f79fc6a6b?source=api-prod","affected":[{"type":"plugin","slug":"metronet-profile-picture","name":"User Profile Picture","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T06:58:20Z"},{"id":"wordfence:01a42d69-8230-4820-8f67-5e29a43f88db","source":"wordfence","cve":"CVE-2026-78288","title":"Beautiful taxonomy filters <= 2.4.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a42d69-8230-4820-8f67-5e29a43f88db?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-taxonomy-filters","name":"Beautiful taxonomy filters","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:51:57Z"},{"id":"wordfence:01a4d176-35a7-4397-aaba-6d75a40e79a4","source":"wordfence","cve":"CVE-2026-103307","title":"Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a4d176-35a7-4397-aaba-6d75a40e79a4?source=api-prod","affected":[{"type":"plugin","slug":"wc-walletdoc-payment-gateway","name":"Walletdoc Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:23:22Z"},{"id":"wordfence:01a52285-2d0c-4b29-8dab-18a3e3640e5c","source":"wordfence","cve":"CVE-2026-15457","title":"Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a52285-2d0c-4b29-8dab-18a3e3640e5c?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"6.0.14"}],"published":"2026-07-16T14:41:02Z","updated":"2026-07-30T12:36:24Z"},{"id":"wordfence:01a6a5bf-636b-416c-86fa-43f639624e80","source":"wordfence","cve":"CVE-2025-8147","title":"LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6a5bf-636b-416c-86fa-43f639624e80?source=api-prod","affected":[{"type":"plugin","slug":"lwscache","name":"LWSCache","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.9"}],"published":"2025-08-28T00:00:00Z","updated":"2025-08-29T04:25:28Z"},{"id":"wordfence:01a6cca8-cca9-4863-a879-20fdca23b334","source":"wordfence","cve":"CVE-2026-42686","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6cca8-cca9-4863-a879-20fdca23b334?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.2.1","to_inclusive":true,"patched_in":"4.3.2.2"}],"published":"2026-05-24T00:00:00Z","updated":"2026-05-26T19:29:26Z"},{"id":"wordfence:01a6dcf2-6f0b-494b-a18c-04bd9c44e0ce","source":"wordfence","cve":"CVE-2024-2691","title":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6dcf2-6f0b-494b-a18c-04bd9c44e0ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.43","to_inclusive":true,"patched_in":"3.1.44"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T08:32:31Z"},{"id":"wordfence:01a70f60-9207-48a9-9ba2-7a29813fa934","source":"wordfence","cve":"CVE-2025-60144","title":"Lenix scss compiler <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a70f60-9207-48a9-9ba2-7a29813fa934?source=api-prod","affected":[{"type":"plugin","slug":"lenix-scss-compiler","name":"Lenix scss compiler","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:14:44Z"},{"id":"wordfence:01a8221c-355d-453d-87a5-7a9b388b268b","source":"wordfence","cve":"CVE-2025-58686","title":"Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a8221c-355d-453d-87a5-7a9b388b268b?source=api-prod","affected":[{"type":"plugin","slug":"perfect-woocommerce-brands","name":"Perfect Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-23T19:47:14Z"},{"id":"wordfence:01a8c454-441b-4b72-90fa-21f291804875","source":"wordfence","cve":"CVE-2026-95593","title":"Ultimeter \u2013 the Ultimate Progress and Goals Meter <= 3.0.8 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01a8c454-441b-4b72-90fa-21f291804875?source=api-prod","affected":[{"type":"plugin","slug":"ultimeter","name":"Ultimeter \u2013 the Ultimate Progress and Goals Meter","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-09-23T10:17:00Z","updated":"2026-09-29T19:54:16Z"},{"id":"wordfence:01aa00db-43e5-4c8a-a005-77a39ec89c94","source":"wordfence","cve":"","title":"MemberPress Downloads <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01aa00db-43e5-4c8a-a005-77a39ec89c94?source=api-prod","affected":[{"type":"plugin","slug":"memberpress-downloads","name":"MemberPress Downloads","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01ab2ed8-ff2f-41ac-bbbd-d8878fd067d6","source":"wordfence","cve":"CVE-2023-52180","title":"Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 - Authenticated(Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ab2ed8-ff2f-41ac-bbbd-d8878fd067d6?source=api-prod","affected":[{"type":"plugin","slug":"zip-recipes","name":"Recipe Cards For Your Food Blog from Zip Recipes","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":false,"patched_in":"8.1.1"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01abc69a-65c3-4acc-b190-efd8da2ec76f","source":"wordfence","cve":"CVE-2026-66444","title":"Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01abc69a-65c3-4acc-b190-efd8da2ec76f?source=api-prod","affected":[{"type":"plugin","slug":"payment-forms-for-paystack","name":"Payment Forms for Paystack","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-08-10T00:00:00Z","updated":"2026-10-28T21:12:59Z"},{"id":"wordfence:01ac87f7-3f09-42cd-a344-05b8bd6b730d","source":"wordfence","cve":"CVE-2026-15985","title":"Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login","severity":"high","cvss":8.1,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ac87f7-3f09-42cd-a344-05b8bd6b730d?source=api-prod","affected":[{"type":"plugin","slug":"rtcl-verification","name":"Classified Listing - Mobile Number Verification","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-08-25T23:33:19Z","updated":"2026-08-26T11:36:39Z"},{"id":"wordfence:01acb93b-89ae-4024-9f43-5fd14a7bd5f6","source":"wordfence","cve":"CVE-2026-65447","title":"Contest Gallery <= 30.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01acb93b-89ae-4024-9f43-5fd14a7bd5f6?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.6","to_inclusive":true,"patched_in":"30.0.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:24:13Z"},{"id":"wordfence:01b1ebc8-e489-4053-9dbf-511cd83270d6","source":"wordfence","cve":"CVE-2025-54696","title":"WPFunnels <= 3.5.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b1ebc8-e489-4053-9dbf-511cd83270d6?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.5.26","to_inclusive":true,"patched_in":"3.5.27"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:04:53Z"},{"id":"wordfence:01b3013f-60b9-449b-a2a9-64e37a1454ef","source":"wordfence","cve":"","title":"JM Twitter Cards < 6.2 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b3013f-60b9-449b-a2a9-64e37a1454ef?source=api-prod","affected":[{"type":"plugin","slug":"jm-twitter-cards","name":"JM Twitter Cards","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":false,"patched_in":"6.2"}],"published":"2015-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01b384dd-112b-4680-9a37-05e19f4fca5e","source":"wordfence","cve":"CVE-2025-24565","title":"WP2LEADS <= 3.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b384dd-112b-4680-9a37-05e19f4fca5e?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-12-24T00:00:00Z","updated":"2025-02-26T21:22:48Z"},{"id":"wordfence:01b55b59-3107-4711-8be2-8b0803c0fa69","source":"wordfence","cve":"CVE-2017-18534","title":"Share on Diaspora < 0.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b55b59-3107-4711-8be2-8b0803c0fa69?source=api-prod","affected":[{"type":"plugin","slug":"share-on-diaspora","name":"Share on Diaspora","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":false,"patched_in":"0.7.2"}],"published":"2017-08-23T00:00:00Z","updated":"2024-08-15T18:01:10Z"},{"id":"wordfence:01b598a3-8437-4644-badb-438c34a364ed","source":"wordfence","cve":"CVE-2026-78270","title":"FluentCRM Pro <= 3.1.12 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b598a3-8437-4644-badb-438c34a364ed?source=api-prod","affected":[{"type":"plugin","slug":"fluentcrm-pro","name":"FluentCRM Pro \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-26T16:49:21Z"},{"id":"wordfence:01b63b2a-3634-4ff6-b56c-787eb6988714","source":"wordfence","cve":"CVE-2026-101890","title":"Prime Mover \u2013 Backup and Migration <= 2.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b63b2a-3634-4ff6-b56c-787eb6988714?source=api-prod","affected":[{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:37:58Z"},{"id":"wordfence:01b90498-0ddb-4eb3-b76d-de30ed03d7d0","source":"wordfence","cve":"CVE-2020-36735","title":"WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b90498-0ddb-4eb3-b76d-de30ed03d7d0?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2020-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01b9f536-cdab-4e38-b935-008cbd899a98","source":"wordfence","cve":"CVE-2014-4548","title":"Ruven Toolkit <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01b9f536-cdab-4e38-b935-008cbd899a98?source=api-prod","affected":[{"type":"plugin","slug":"ruven-toolkit","name":"Ruven Toolkit","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01ba179f-f515-4928-a96b-5ecb45b95811","source":"wordfence","cve":"CVE-2025-67516","title":"Store Locator WordPress <= 1.6.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ba179f-f515-4928-a96b-5ecb45b95811?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T16:58:03Z"},{"id":"wordfence:01ba4259-e76a-4876-b910-fd2688680739","source":"wordfence","cve":"CVE-2022-43462","title":"IP Blacklist Cloud <= 5.00 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ba4259-e76a-4876-b910-fd2688680739?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"5.00","to_inclusive":true,"patched_in":""}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01bacc7f-9b17-4889-88f2-fcf55f3e61d5","source":"wordfence","cve":"CVE-2025-62113","title":"Co-marquage service-public.fr <= 0.5.77 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01bacc7f-9b17-4889-88f2-fcf55f3e61d5?source=api-prod","affected":[{"type":"plugin","slug":"co-marquage-service-public","name":"Co-marquage service-public.fr","from":"*","from_inclusive":true,"to":"0.5.77","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:25:20Z"},{"id":"wordfence:01bb2c40-989f-46c4-84d3-c7b25a49a631","source":"wordfence","cve":"CVE-2025-47693","title":"FAT Services Booking <= 5.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01bb2c40-989f-46c4-84d3-c7b25a49a631?source=api-prod","affected":[{"type":"plugin","slug":"fat-services-booking","name":"FAT Services Booking","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:00:25Z"},{"id":"wordfence:01bd8a24-5580-4b16-94b3-c231d5fe7a01","source":"wordfence","cve":"CVE-2023-33216","title":"WooDiscuz \u2013 WooCommerce Comments <= 2.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01bd8a24-5580-4b16-94b3-c231d5fe7a01?source=api-prod","affected":[{"type":"plugin","slug":"woodiscuz-woocommerce-comments","name":"WooDiscuz \u2013 WooCommerce Comments","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01c1458d-3e38-4dbf-bb65-80465ea6d0ad","source":"wordfence","cve":"CVE-2023-6498","title":"Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c1458d-3e38-4dbf-bb65-80465ea6d0ad?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:35:46Z"},{"id":"wordfence:01c1dd65-4cf9-487f-ae3f-9cfaea177385","source":"wordfence","cve":"CVE-2019-15113","title":"Companion Sitemap Generator \u2013 HTML & XML <= 3.6.6 - Cross-Site Request Forgery and Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c1dd65-4cf9-487f-ae3f-9cfaea177385?source=api-prod","affected":[{"type":"plugin","slug":"companion-sitemap-generator","name":"Companion Sitemap Generator \u2013 Simple, Smart, and SEO-Ready","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2019-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01c3c913-2296-4ec3-b7cb-6418ab2f0ea1","source":"wordfence","cve":"CVE-2022-1474","title":"WP Event Manager \u2013 Easily Build your Calendar of Events! <= 3.1.27 - Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c3c913-2296-4ec3-b7cb-6418ab2f0ea1?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.28","to_inclusive":false,"patched_in":"3.1.28"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01c79167-69c5-4297-a03c-7218b1f123c7","source":"wordfence","cve":"CVE-2026-95588","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c79167-69c5-4297-a03c-7218b1f123c7?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"11.0.5","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:39:11Z"},{"id":"wordfence:01c8d909-ecfd-4443-9bef-e1b541e74c2b","source":"wordfence","cve":"CVE-2025-30863","title":"Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c8d909-ecfd-4443-9bef-e1b541e74c2b?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-contact-form-7-and-google-sheets","name":"Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:03:43Z"},{"id":"wordfence:01c9f196-bcf1-401b-992a-e7a60f9447f7","source":"wordfence","cve":"CVE-2017-2285","title":"Simple Custom CSS and JS <= 3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01c9f196-bcf1-401b-992a-e7a60f9447f7?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-js","name":"Simple Custom CSS and JS","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2017-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01cb63ab-2198-443a-8eee-ee4f1cf2fdc4","source":"wordfence","cve":"CVE-2024-43959","title":"Testimonials <= 3.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cb63ab-2198-443a-8eee-ee4f1cf2fdc4?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-08-26T00:00:00Z","updated":"2024-10-03T14:08:53Z"},{"id":"wordfence:01cc3955-ef2f-4e2b-8dc6-b26f5a3d2f89","source":"wordfence","cve":"CVE-2023-29422","title":"Dynamics 365 Integration <= 1.3.13 - Missing Authorization via init","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cc3955-ef2f-4e2b-8dc6-b26f5a3d2f89?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac","source":"wordfence","cve":"CVE-2023-27634","title":"Intrepidity <= 1.5.1 - Cross-Site Request Forgery via mytheme_add_admin","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cc613a-d0b5-4c8f-8961-8f8aaf63b8ac?source=api-prod","affected":[{"type":"theme","slug":"intrepidity","name":"intrepidity","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01ccc7b8-3dd4-4b83-bd53-687f7479b214","source":"wordfence","cve":"CVE-2024-12328","title":"MAS Elementor <= 1.1.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ccc7b8-3dd4-4b83-bd53-687f7479b214?source=api-prod","affected":[{"type":"plugin","slug":"mas-addons-for-elementor","name":"MAS Elementor","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T08:18:16Z"},{"id":"wordfence:01cce0b2-b43c-4b79-89a0-c1842cab1edc","source":"wordfence","cve":"CVE-2024-32952","title":"Max Addons Pro for Bricks <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cce0b2-b43c-4b79-89a0-c1842cab1edc?source=api-prod","affected":[{"type":"plugin","slug":"max-addons-pro-bricks","name":"Max Addons Pro for Bricks","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:46:51Z"},{"id":"wordfence:01cd05c3-9629-4da4-ae9d-f99003253b95","source":"wordfence","cve":"CVE-2026-4653","title":"Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cd05c3-9629-4da4-ae9d-f99003253b95?source=api-prod","affected":[{"type":"plugin","slug":"bp-toolkit","name":"Block, Suspend, Report for BuddyPress","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T06:52:44Z"},{"id":"wordfence:01cd3631-93fb-4016-baa4-8ea11b21acec","source":"wordfence","cve":"CVE-2025-13525","title":"WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cd3631-93fb-4016-baa4-8ea11b21acec?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-11-26T17:27:27Z","updated":"2025-11-27T05:31:57Z"},{"id":"wordfence:01cf3196-1817-4506-8f70-ca54cc5e09f9","source":"wordfence","cve":"CVE-2025-8721","title":"Workable API <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cf3196-1817-4506-8f70-ca54cc5e09f9?source=api-prod","affected":[{"type":"plugin","slug":"wrapper-for-workable-api","name":"Workable Api","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:50:09Z","updated":"2025-09-11T07:24:49Z"},{"id":"wordfence:01cfd7db-f62d-4110-b9a4-49ff1e4e5e68","source":"wordfence","cve":"CVE-2022-36352","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 5.0.3 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cfd7db-f62d-4110-b9a4-49ff1e4e5e68?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01cfe0da-0ffc-4046-b58a-a31f5d10d1bd","source":"wordfence","cve":"CVE-2022-3574","title":"WPForms Pro <= 1.7.6 - CSV Injection","severity":"high","cvss":7.2,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01cfe0da-0ffc-4046-b58a-a31f5d10d1bd?source=api-prod","affected":[{"type":"plugin","slug":"wpforms","name":"WPForms Pro","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2022-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01d0016c-f693-426a-94cb-5611760fd2d0","source":"wordfence","cve":"","title":"Kormosala <= 1.0.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d0016c-f693-426a-94cb-5611760fd2d0?source=api-prod","affected":[{"type":"theme","slug":"kormosala","name":"Kormosola","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2020-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01d040c8-5fd9-4dc7-af30-10c58571b16f","source":"wordfence","cve":"CVE-2026-18777","title":"TrueBooker \u2013 Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d040c8-5fd9-4dc7-af30-10c58571b16f?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:14:19Z"},{"id":"wordfence:01d115b7-38a7-4dfd-ac81-4d7ce71969b2","source":"wordfence","cve":"CVE-2025-58675","title":"Interact: Embed A Quiz On Your Site <= 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d115b7-38a7-4dfd-ac81-4d7ce71969b2?source=api-prod","affected":[{"type":"plugin","slug":"interact-quiz-embed","name":"Interact Quiz & Form Embed","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:27:41Z"},{"id":"wordfence:01d19333-d315-4715-8365-719260ae0ee4","source":"wordfence","cve":"","title":"Email Subscribers & Newsletters < 2.9.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d19333-d315-4715-8365-719260ae0ee4?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01d2ebc1-43f1-440f-afde-058e26270066","source":"wordfence","cve":"CVE-2025-60248","title":"WPC Product Options for WooCommerce < 3.1.3 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d2ebc1-43f1-440f-afde-058e26270066?source=api-prod","affected":[{"type":"plugin","slug":"wpc-product-options","name":"WPC Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2025-05-16T00:00:00Z","updated":"2026-04-15T13:34:43Z"},{"id":"wordfence:01d31d8a-4459-488a-9cbe-92761faa58b4","source":"wordfence","cve":"CVE-2023-5428","title":"Image vertical reel scroll slideshow <= 9.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d31d8a-4459-488a-9cbe-92761faa58b4?source=api-prod","affected":[{"type":"plugin","slug":"image-vertical-reel-scroll-slideshow","name":"Image vertical reel scroll slideshow","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"9.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01d3c9b4-fce5-41d4-8cd8-2b26f1fe171a","source":"wordfence","cve":"CVE-2025-52815","title":"CityGov <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d3c9b4-fce5-41d4-8cd8-2b26f1fe171a?source=api-prod","affected":[{"type":"theme","slug":"citygov","name":"CityGov - City Government & Municipal WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:40:29Z"},{"id":"wordfence:01d5e5b5-033c-4690-9857-3339e2831340","source":"wordfence","cve":"CVE-2024-9344","title":"BerqWP \u2013 Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d5e5b5-033c-4690-9857-3339e2831340?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T08:31:51Z"},{"id":"wordfence:01d5f559-d784-4399-9009-6edc584f8f09","source":"wordfence","cve":"CVE-2024-47346","title":"Newsletters <= 4.9.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d5f559-d784-4399-9009-6edc584f8f09?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.1","to_inclusive":true,"patched_in":"4.9.9.2"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:21:04Z"},{"id":"wordfence:01d62f2c-bfa0-4800-ae20-0c6038a03b3b","source":"wordfence","cve":"CVE-2026-17533","title":"All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d62f2c-bfa0-4800-ae20-0c6038a03b3b?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.108","to_inclusive":false,"patched_in":"7.108"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:20:54Z"},{"id":"wordfence:01d99cad-fb49-4260-9354-1cb1d532447d","source":"wordfence","cve":"CVE-2025-52735","title":"NextMove Lite <= 2.21.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d99cad-fb49-4260-9354-1cb1d532447d?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.21.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-12-04T20:24:44Z"},{"id":"wordfence:01d9b7c1-8f34-4c87-af68-a5e6c698b2d8","source":"wordfence","cve":"CVE-2026-8991","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01d9b7c1-8f34-4c87-af68-a5e6c698b2d8?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.7","to_inclusive":true,"patched_in":"1.3.9.8"}],"published":"2026-06-05T14:16:21Z","updated":"2026-06-06T02:28:33Z"},{"id":"wordfence:01da1829-e3f4-4246-ae3d-72377c4b232e","source":"wordfence","cve":"CVE-2023-45754","title":"Easy Testimonial Slider and Form <= 1.0.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01da1829-e3f4-4246-ae3d-72377c4b232e?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonial-rotator","name":"Easy Testimonial Slider and Form","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2023-10-12T00:00:00Z","updated":"2024-04-18T20:09:08Z"},{"id":"wordfence:01def852-367b-4f64-9c5a-58dcc3478b2e","source":"wordfence","cve":"CVE-2022-1559","title":"Clipr <= 1.2.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01def852-367b-4f64-9c5a-58dcc3478b2e?source=api-prod","affected":[{"type":"plugin","slug":"clipr","name":"Clipr","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01dfb46a-5721-415f-8a92-e874c46b8e47","source":"wordfence","cve":"CVE-2024-53730","title":"April's Call Posts <= 2.1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01dfb46a-5721-415f-8a92-e874c46b8e47?source=api-prod","affected":[{"type":"plugin","slug":"aprils-call-posts","name":"April's Call Posts","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-11-23T00:00:00Z","updated":"2025-07-18T14:10:56Z"},{"id":"wordfence:01e041ad-a340-40a1-bd6c-bf11faed4805","source":"wordfence","cve":"CVE-2026-22502","title":"Mr. Cobbler | Custom Shoemaking & Footwear Repairs WordPress Theme <= 1.1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e041ad-a340-40a1-bd6c-bf11faed4805?source=api-prod","affected":[{"type":"theme","slug":"mr-cobbler","name":"Mr. Cobbler | Custom Shoemaking & Footwear Repairs WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:13:59Z"},{"id":"wordfence:01e1b22f-9622-433f-bada-23d118dc3800","source":"wordfence","cve":"","title":"Simple Admin Language Change <= 2.0.1 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e1b22f-9622-433f-bada-23d118dc3800?source=api-prod","affected":[{"type":"plugin","slug":"simple-admin-language-change","name":"Simple Admin Language Change","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2021-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01e21584-949b-4d2b-b0e8-2f4abe8416b2","source":"wordfence","cve":"CVE-2024-35756","title":"Tooltip CK <= 2.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e21584-949b-4d2b-b0e8-2f4abe8416b2?source=api-prod","affected":[{"type":"plugin","slug":"tooltip-ck","name":"Tooltip CK","from":"*","from_inclusive":true,"to":"2.2.15","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-18T15:12:49Z"},{"id":"wordfence:01e41573-9329-48e1-9191-e8e1532f7afc","source":"wordfence","cve":"CVE-2020-36696","title":"Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e41573-9329-48e1-9191-e8e1532f7afc?source=api-prod","affected":[{"type":"plugin","slug":"product-input-fields-for-woocommerce","name":"Product Input Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01e55868-9032-4f3d-830c-01dac94bb364","source":"wordfence","cve":"CVE-2026-22465","title":"BuddyApp <= 1.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e55868-9032-4f3d-830c-01dac94bb364?source=api-prod","affected":[{"type":"theme","slug":"buddyapp","name":"BuddyApp - Mobile First Community WordPress theme","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T18:24:56Z"},{"id":"wordfence:01e8e53c-8d23-4bd3-9291-29f97df7c984","source":"wordfence","cve":"CVE-2021-24155","title":"Backup Guard <= 1.5.9 - Authenticated Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01e8e53c-8d23-4bd3-9291-29f97df7c984?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2021-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01eaa600-6ddf-492b-b2cf-ca560ce71db5","source":"wordfence","cve":"CVE-2026-39621","title":"SpicePress <= 2.3.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01eaa600-6ddf-492b-b2cf-ca560ce71db5?source=api-prod","affected":[{"type":"theme","slug":"spicepress","name":"SpicePress","from":"*","from_inclusive":true,"to":"2.3.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-07T13:45:19Z"},{"id":"wordfence:01ebc1b1-2dd3-4e91-93b2-fc8e5e93e925","source":"wordfence","cve":"CVE-2018-5776","title":"WordPress Core < 4.9.2 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ebc1b1-2dd3-4e91-93b2-fc8e5e93e925?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.24","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.24","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.22","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.21","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.21","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.14","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.13","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"3.7.25"}],"published":"2018-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01ec3ba3-4627-4072-b15d-44e98c652836","source":"wordfence","cve":"CVE-2026-16957","title":"Slim SEO <= 4.9.10 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ec3ba3-4627-4072-b15d-44e98c652836?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"4.9.11"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:44:24Z"},{"id":"wordfence:01eef49c-79c1-40a0-9b4b-05a699d47a41","source":"wordfence","cve":"CVE-2019-18855","title":"Safe SVG <= 1.9.4 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01eef49c-79c1-40a0-9b4b-05a699d47a41?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2019-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01ef62c8-e862-422c-948d-6d376d021c82","source":"wordfence","cve":"CVE-2024-8918","title":"File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload","severity":"high","cvss":7.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ef62c8-e862-422c-948d-6d376d021c82?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.9","to_inclusive":true,"patched_in":"8.3.10"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T06:43:23Z"},{"id":"wordfence:01efb3e5-3af4-4092-a43a-c249af86e423","source":"wordfence","cve":"CVE-2026-107865","title":"JetMenu <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01efb3e5-3af4-4092-a43a-c249af86e423?source=api-prod","affected":[{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.5.1"}],"published":"2026-10-12T09:02:00Z","updated":"2026-10-13T14:02:28Z"},{"id":"wordfence:01f038d7-2efd-41b2-8f4c-77bab80d8e91","source":"wordfence","cve":"CVE-2016-10968","title":"Community by PeepSo \u2013 Social Network, Membership, Registration, User Profiles < 1.6.1 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f038d7-2efd-41b2-8f4c-77bab80d8e91?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2016-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01f0b785-418e-468c-b9f8-53cd46aca881","source":"wordfence","cve":"","title":"Mingle Forum < 1.0.34 - Unauthenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f0b785-418e-468c-b9f8-53cd46aca881?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":false,"patched_in":"1.0.34"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01f0f734-b22e-4cd6-be99-ce6c2cd6f2c9","source":"wordfence","cve":"","title":"Indeed Membership Pro <= 7.5 - Remote Image File Inclusion","severity":"high","cvss":8.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f0f734-b22e-4cd6-be99-ce6c2cd6f2c9?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2019-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01f287b6-1720-4ece-9141-f906835b8bae","source":"wordfence","cve":"CVE-2026-19718","title":"The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force","severity":"critical","cvss":9.8,"cwe":"CWE-338","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f287b6-1720-4ece-9141-f906835b8bae?source=api-prod","affected":[{"type":"plugin","slug":"wpremote","name":"The WP Remote WordPress Plugin","from":"*","from_inclusive":true,"to":"6.65","to_inclusive":false,"patched_in":"6.65"},{"type":"plugin","slug":"blogvault-real-time-backup","name":"BlogVault Backup & Staging","from":"*","from_inclusive":true,"to":"6.65","to_inclusive":false,"patched_in":"6.65"},{"type":"plugin","slug":"malcare-security","name":"MalCare WordPress Security Plugin \u2013 Malware Scanner, Cleaner, Security Firewall","from":"*","from_inclusive":true,"to":"6.65","to_inclusive":false,"patched_in":"6.65"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T15:25:18Z"},{"id":"wordfence:01f4318f-b56b-4a34-987b-05edeee5da69","source":"wordfence","cve":"CVE-2023-47868","title":"wpForo Forum <= 2.2.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f4318f-b56b-4a34-987b-05edeee5da69?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-11-20T00:00:00Z","updated":"2024-03-12T09:11:33Z"},{"id":"wordfence:01f60df7-0602-4a00-9905-a91348811dfe","source":"wordfence","cve":"CVE-2023-27414","title":"Popup box <= 3.4.4 - Reflected Cross-Site Scripting via 'ays_pb_tab' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f60df7-0602-4a00-9905-a91348811dfe?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:01f798e7-f4e1-4cd8-b284-68101582fc2d","source":"wordfence","cve":"CVE-2026-25306","title":"XStore Core <= 5.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01f798e7-f4e1-4cd8-b284-68101582fc2d?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:12:51Z"},{"id":"wordfence:020052ba-dece-4e70-88e7-8bd8918b8376","source":"wordfence","cve":"CVE-2024-2126","title":"Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020052ba-dece-4e70-88e7-8bd8918b8376?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.32","to_inclusive":true,"patched_in":"2.10.33"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:26:32Z"},{"id":"wordfence:0200e405-b3cc-4560-ab5d-4c0cf9f03366","source":"wordfence","cve":"CVE-2025-23853","title":"NoFollow Free <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0200e405-b3cc-4560-ab5d-4c0cf9f03366?source=api-prod","affected":[{"type":"plugin","slug":"nofollow-free","name":"NoFollow Free","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:20:39Z"},{"id":"wordfence:0201d430-1254-4b09-b7a0-1443861ddf42","source":"wordfence","cve":"CVE-2025-26888","title":"WooCommerce Multilingual & Multicurrency <= 5.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0201d430-1254-4b09-b7a0-1443861ddf42?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:11:54Z"},{"id":"wordfence:020209b3-2175-4509-836a-8a60ed4f4b15","source":"wordfence","cve":"CVE-2026-103917","title":"Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020209b3-2175-4509-836a-8a60ed4f4b15?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.7","to_inclusive":true,"patched_in":"11.2.8"}],"published":"2026-11-06T18:16:28Z","updated":"2026-11-07T06:39:34Z"},{"id":"wordfence:0203f02b-4279-479d-8821-6398c2e5ff85","source":"wordfence","cve":"CVE-2026-107786","title":"CatFolders <= 2.5.6 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0203f02b-4279-479d-8821-6398c2e5ff85?source=api-prod","affected":[{"type":"plugin","slug":"catfolders","name":"CatFolders \u2013 WordPress Media Library Folders & Categories","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:11:04Z"},{"id":"wordfence:02066dcd-1f2f-4ed3-b1f4-7ea8711918e8","source":"wordfence","cve":"","title":"All In One WP Security 5.1.9 - Plaintext Storage of Credentials","severity":"medium","cvss":5.9,"cwe":"CWE-256","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02066dcd-1f2f-4ed3-b1f4-7ea8711918e8?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"5.1.9","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0206aead-d146-453d-99ed-3870f7dfdae9","source":"wordfence","cve":"CVE-2023-24008","title":"Maspik \u2013 Spam blacklist <= 0.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0206aead-d146-453d-99ed-3870f7dfdae9?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"0.7.8","to_inclusive":true,"patched_in":"0.7.9"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02073716-4f6a-4a51-933f-c5ab8dfbc08c","source":"wordfence","cve":"CVE-2024-22295","title":"Robo Gallery <= 3.2.17 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02073716-4f6a-4a51-933f-c5ab8dfbc08c?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.17","to_inclusive":true,"patched_in":"3.2.18"}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-24T16:56:02Z"},{"id":"wordfence:0209c6ab-cc49-4929-851d-b12c5decf975","source":"wordfence","cve":"CVE-2024-50496","title":"AR For WordPress <= 6.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0209c6ab-cc49-4929-851d-b12c5decf975?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-wordpress","name":"AR for WordPress","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":"7.0"}],"published":"2024-10-25T00:00:00Z","updated":"2024-11-11T16:57:56Z"},{"id":"wordfence:020bed37-9544-49b7-941d-3b7f509fdfdf","source":"wordfence","cve":"CVE-2026-6203","title":"User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020bed37-9544-49b7-941d-3b7f509fdfdf?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2026-04-13T09:51:38Z","updated":"2026-04-21T20:00:21Z"},{"id":"wordfence:020d14f8-e8e2-4da2-9a4b-4d15cb0994c8","source":"wordfence","cve":"CVE-2024-2933","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020d14f8-e8e2-4da2-9a4b-4d15cb0994c8?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2024-05-31T13:33:07Z","updated":"2024-06-01T01:54:55Z"},{"id":"wordfence:020da86b-63d6-4687-bf2d-ab10fe19e9ce","source":"wordfence","cve":"CVE-2026-32497","title":"User Verification by PickPlugins <= 2.0.45 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020da86b-63d6-4687-bf2d-ab10fe19e9ce?source=api-prod","affected":[{"type":"plugin","slug":"user-verification","name":"User Verification by PickPlugins","from":"*","from_inclusive":true,"to":"2.0.45","to_inclusive":true,"patched_in":"2.0.46"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T14:54:36Z"},{"id":"wordfence:020df8cb-a9ce-4f04-b88f-ceb988beeb75","source":"wordfence","cve":"CVE-2024-32795","title":"WPCal.io \u2013 Easy Meeting Scheduler <= 0.9.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/020df8cb-a9ce-4f04-b88f-ceb988beeb75?source=api-prod","affected":[{"type":"plugin","slug":"wpcal","name":"WPCal.io \u2013 Easy Meeting Scheduler","from":"*","from_inclusive":true,"to":"0.9.5.8","to_inclusive":true,"patched_in":"0.9.5.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-15T20:18:21Z"},{"id":"wordfence:02103a32-4fac-401a-b995-e86dd734484b","source":"wordfence","cve":"CVE-2026-16684","title":"Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02103a32-4fac-401a-b995-e86dd734484b?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.24","to_inclusive":true,"patched_in":"3.5.25"}],"published":"2026-07-31T19:26:26Z","updated":"2026-08-01T07:49:44Z"},{"id":"wordfence:0210637e-360b-422f-be96-43e6ac48fe64","source":"wordfence","cve":"CVE-2026-11872","title":"Clever Mega Menu for Visual Composer <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0210637e-360b-422f-be96-43e6ac48fe64?source=api-prod","affected":[{"type":"plugin","slug":"clever-mega-menu","name":"Clever Mega Menu for Visual Composer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:11:40Z"},{"id":"wordfence:0210ee40-543a-42ce-b7da-e5bbae19d852","source":"wordfence","cve":"CVE-2025-57907","title":"Heureka <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0210ee40-543a-42ce-b7da-e5bbae19d852?source=api-prod","affected":[{"type":"plugin","slug":"heureka","name":"Heureka","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-08-14T15:15:27Z"},{"id":"wordfence:0213cfce-6dee-4607-bc0f-2001fc208725","source":"wordfence","cve":"CVE-2026-66685","title":"Featured Video Plus <= 2.3.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0213cfce-6dee-4607-bc0f-2001fc208725?source=api-prod","affected":[{"type":"plugin","slug":"featured-video-plus","name":"Featured Video Plus","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:00:30Z"},{"id":"wordfence:021916e5-c0f3-4232-b4f5-daee85d2136a","source":"wordfence","cve":"CVE-2026-12982","title":"Document Gallery <= 5.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021916e5-c0f3-4232-b4f5-daee85d2136a?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:00:12Z"},{"id":"wordfence:0219851f-7fce-42e0-ba82-77af84b17d9f","source":"wordfence","cve":"CVE-2023-27458","title":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View <= 4.4.10 - Cross-Site Request Forgery via wpstream_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0219851f-7fce-42e0-ba82-77af84b17d9f?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.10.6"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:021a25c9-7fad-425f-8104-bb4852603613","source":"wordfence","cve":"CVE-2023-25455","title":"WordPress Social Login and Register <= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021a25c9-7fad-425f-8104-bb4852603613?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:021b755f-ebe9-450e-b829-d94f7228990d","source":"wordfence","cve":"CVE-2026-84907","title":"Eventin <= 4.1.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021b755f-ebe9-450e-b829-d94f7228990d?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:54:21Z"},{"id":"wordfence:021bd566-1663-46ba-a616-ab554b691cbb","source":"wordfence","cve":"CVE-2026-4365","title":"LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021bd566-1663-46ba-a616-ab554b691cbb?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2.8","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-04-13T12:59:29Z","updated":"2026-06-15T17:59:04Z"},{"id":"wordfence:021d8467-09a2-4bbf-8f6f-cad3e2702bd9","source":"wordfence","cve":"CVE-2026-116860","title":"Timetics \u2013 Appointment Booking Calendar & Scheduling <= 1.0.65 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021d8467-09a2-4bbf-8f6f-cad3e2702bd9?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.65","to_inclusive":true,"patched_in":"1.0.66"}],"published":"2026-10-30T14:42:00Z","updated":"2026-11-03T19:35:34Z"},{"id":"wordfence:021ff4e6-2e68-49d0-96ad-1cfb604b59cc","source":"wordfence","cve":"CVE-2025-58885","title":"Pathfinder <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/021ff4e6-2e68-49d0-96ad-1cfb604b59cc?source=api-prod","affected":[{"type":"theme","slug":"pathfinder","name":"Pathfinder - Transportation & Logistics WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:29:40Z"},{"id":"wordfence:02220c1d-a7f2-41eb-ac5f-f89d63c54a59","source":"wordfence","cve":"CVE-2026-39516","title":"Nexter Blocks <= 4.7.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02220c1d-a7f2-41eb-ac5f-f89d63c54a59?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-03-26T00:00:00Z","updated":"2026-05-05T15:14:17Z"},{"id":"wordfence:02225187-537c-42e6-b415-fe45c8850e66","source":"wordfence","cve":"CVE-2026-104647","title":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce < 2.1.7 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02225187-537c-42e6-b415-fe45c8850e66?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T23:23:36Z"},{"id":"wordfence:0227cc13-8f19-43a2-95a1-f6e729baf256","source":"wordfence","cve":"CVE-2025-48267","title":"WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0227cc13-8f19-43a2-95a1-f6e729baf256?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:17:14Z"},{"id":"wordfence:0227e5f0-61fa-4e78-9bd4-918fdde7ab58","source":"wordfence","cve":"","title":"WordPress Leads < 1.6.3 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0227e5f0-61fa-4e78-9bd4-918fdde7ab58?source=api-prod","affected":[{"type":"plugin","slug":"leads","name":"WordPress Leads","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2015-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02282e33-7e3e-42e1-a7b0-9b5ad326600d","source":"wordfence","cve":"CVE-2017-14847","title":"WPAMS - Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02282e33-7e3e-42e1-a7b0-9b5ad326600d?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"17-07-2019","to_inclusive":false,"patched_in":"17-07-2019"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0229b20f-65d7-4f55-a773-fd8da479723c","source":"wordfence","cve":"","title":"Car Rental by BestWebSoft < 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0229b20f-65d7-4f55-a773-fd8da479723c?source=api-prod","affected":[{"type":"plugin","slug":"car-rental","name":"Car Rental by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:022ab125-d086-40bf-aafb-65059b3c455f","source":"wordfence","cve":"CVE-2024-10054","title":"Happyforms <= 1.26.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/022ab125-d086-40bf-aafb-65059b3c455f?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.2","to_inclusive":true,"patched_in":"1.26.3"}],"published":"2024-11-20T00:00:00Z","updated":"2025-05-27T14:37:42Z"},{"id":"wordfence:022dcd52-0e6f-4979-9088-d257b6a5fc11","source":"wordfence","cve":"CVE-2021-24483","title":"Poll Maker <= 3.2.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/022dcd52-0e6f-4979-9088-d257b6a5fc11?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:022e4506-fe49-469d-ae48-641f121fc53b","source":"wordfence","cve":"CVE-2022-29421","title":"Countdown & Clock <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/022e4506-fe49-469d-ae48-641f121fc53b?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-04-28T11:30:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:022f6239-67f2-4680-aeed-34c98c953bea","source":"wordfence","cve":"CVE-2015-9415","title":"BJ Lazy Load < 1.0 - Remote File Inclusion via TimThumb","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/022f6239-67f2-4680-aeed-34c98c953bea?source=api-prod","affected":[{"type":"plugin","slug":"bj-lazy-load","name":"BJ Lazy Load","from":"0.7.5","from_inclusive":true,"to":"0.7.5","to_inclusive":true,"patched_in":"1.0"}],"published":"2015-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02319fc2-8a7e-4b3e-8711-724dcff7a233","source":"wordfence","cve":"CVE-2025-3581","title":"Newsletter  <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02319fc2-8a7e-4b3e-8711-724dcff7a233?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.8.4","to_inclusive":true,"patched_in":"8.8.5"}],"published":"2025-05-19T00:00:00Z","updated":"2025-06-17T15:09:42Z"},{"id":"wordfence:02325b2a-af00-4b99-91ae-64163a8980fc","source":"wordfence","cve":"CVE-2012-0901","title":"YouSayToo auto-publishing plugin <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02325b2a-af00-4b99-91ae-64163a8980fc?source=api-prod","affected":[{"type":"plugin","slug":"yousaytoo-auto-publishing-plugin","name":"YouSayToo auto-publishing plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0232a3a5-e91e-4213-8c21-900fc805bad7","source":"wordfence","cve":"","title":"Contact Builder by Themify <= 1.4.5 - Email Injection","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0232a3a5-e91e-4213-8c21-900fc805bad7?source=api-prod","affected":[{"type":"plugin","slug":"builder-contact","name":"Contact Builder by Themify","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2020-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0234419b-9e39-4153-a3b7-bb913f2b6bcd","source":"wordfence","cve":"","title":"WP phpMyAdmin <= 5.2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0234419b-9e39-4153-a3b7-bb913f2b6bcd?source=api-prod","affected":[{"type":"plugin","slug":"wp-phpmyadmin-extension","name":"WP phpMyAdmin","from":"*","from_inclusive":true,"to":"5.2.0.3","to_inclusive":true,"patched_in":"5.2.0.4"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0238801b-310a-43f9-bcc3-5b572868fc4d","source":"wordfence","cve":"CVE-2026-39440","title":"FunnelFormsPro <= 3.8.1 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0238801b-310a-43f9-bcc3-5b572868fc4d?source=api-prod","affected":[{"type":"plugin","slug":"Funnelforms-pro","name":"FunnelFormsPro","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T15:07:01Z"},{"id":"wordfence:0238c125-7b1e-4f01-a991-4583e872e3ff","source":"wordfence","cve":"CVE-2026-86311","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0238c125-7b1e-4f01-a991-4583e872e3ff?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.44","to_inclusive":true,"patched_in":"1.8.45"}],"published":"2026-09-16T15:18:42Z","updated":"2026-09-17T03:39:15Z"},{"id":"wordfence:023910d0-c2eb-41cd-9d42-606c4cbb8059","source":"wordfence","cve":"CVE-2020-12800","title":"Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/023910d0-c2eb-41cd-9d42-606c4cbb8059?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.3.2","to_inclusive":true,"patched_in":"1.3.3.3"}],"published":"2020-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02396b9d-5b13-48ad-b44a-da8eeb059514","source":"wordfence","cve":"CVE-2025-31741","title":"Easy Magazine <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02396b9d-5b13-48ad-b44a-da8eeb059514?source=api-prod","affected":[{"type":"plugin","slug":"filtr8-magazine","name":"Easy Magazine","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:24:40Z"},{"id":"wordfence:02399fc5-fe74-4ee5-ac63-78d971d2f99e","source":"wordfence","cve":"CVE-2024-33554","title":"XStore Core <= 5.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02399fc5-fe74-4ee5-ac63-78d971d2f99e?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:42:34Z"},{"id":"wordfence:023b70db-da91-4a35-9d1f-9c90534f29d0","source":"wordfence","cve":"CVE-2026-93535","title":"WP Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/023b70db-da91-4a35-9d1f-9c90534f29d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"5.3.17","to_inclusive":true,"patched_in":"5.3.18"}],"published":"2026-10-15T14:40:47Z","updated":"2026-10-16T03:38:40Z"},{"id":"wordfence:023bef79-a3ab-41f7-a287-955c6331c77e","source":"wordfence","cve":"CVE-2024-50512","title":"Posti Shipping <= 3.10.2 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/023bef79-a3ab-41f7-a287-955c6331c77e?source=api-prod","affected":[{"type":"plugin","slug":"posti-shipping","name":"Posti Shipping","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":true,"patched_in":"3.10.3"}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-12T17:44:41Z"},{"id":"wordfence:02402620-89db-448d-9028-379856735a2a","source":"wordfence","cve":"CVE-2024-24885","title":"Woocommerce Vietnam Checkout <= 2.0.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02402620-89db-448d-9028-379856735a2a?source=api-prod","affected":[{"type":"plugin","slug":"woo-vietnam-checkout","name":"Vietnam Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:41:22Z"},{"id":"wordfence:02409698-5421-4760-afcd-e53939082bfc","source":"wordfence","cve":"CVE-2023-23984","title":"Bubble Menu \u2013 circle floating menu <= 3.0.1 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02409698-5421-4760-afcd-e53939082bfc?source=api-prod","affected":[{"type":"plugin","slug":"bubble-menu","name":"Bubble Menu \u2013 Floating Button Menu with Sticky Navigation","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0241a9fc-ce42-4a97-9f33-f07cf53c0f52","source":"wordfence","cve":"CVE-2024-1323","title":"Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0241a9fc-ce42-4a97-9f33-f07cf53c0f52?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.31","to_inclusive":true,"patched_in":"2.10.32"}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-27T04:32:17Z"},{"id":"wordfence:02423824-e53a-4b69-a5c1-827343cbe9c5","source":"wordfence","cve":"CVE-2026-94298","title":"BuildKit <= 1.0.28 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02423824-e53a-4b69-a5c1-827343cbe9c5?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-builder","name":"BuildKit \u2013 Product Builder for WooCommerce \u2013 Custom PC Builder","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T00:07:20Z"},{"id":"wordfence:0242c1e3-0828-426a-a514-907204d009d0","source":"wordfence","cve":"CVE-2026-42759","title":"Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0242c1e3-0828-426a-a514-907204d009d0?source=api-prod","affected":[{"type":"plugin","slug":"amazonsimpleadmin","name":"Affiliate Super Assistent","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-01T16:03:29Z"},{"id":"wordfence:02461b79-d372-493f-9445-62b30b1db4cd","source":"wordfence","cve":"CVE-2025-69358","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02461b79-d372-493f-9445-62b30b1db4cd?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.6.0","to_inclusive":true,"patched_in":"4.2.7.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:53:36Z"},{"id":"wordfence:02480559-be5c-4d23-9e62-bb76fafb4f42","source":"wordfence","cve":"CVE-2025-2940","title":"Ninja Tables \u2013 Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02480559-be5c-4d23-9e62-bb76fafb4f42?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.18","to_inclusive":true,"patched_in":"5.0.19"}],"published":"2025-06-26T00:00:00Z","updated":"2025-06-27T08:23:58Z"},{"id":"wordfence:02485b2c-a53c-4e9c-96ad-db1d95a1df0e","source":"wordfence","cve":"CVE-2026-24391","title":"Car Dealer Automotive WordPress Theme \u2013 Responsive <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02485b2c-a53c-4e9c-96ad-db1d95a1df0e?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:27:08Z"},{"id":"wordfence:02487c67-9073-47ea-bf72-e33cc4184c7c","source":"wordfence","cve":"CVE-2026-81785","title":"Post Form \u2013 Registration Form \u2013 Profile Form for User Profiles \u2013 Frontend Content Forms for User Submissions (UGC) <= 2.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02487c67-9073-47ea-bf72-e33cc4184c7c?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-10-09T17:15:13Z"},{"id":"wordfence:0248f829-84de-40b9-bb63-354fbf06472d","source":"wordfence","cve":"","title":"WordPress Core < 6.0.2 - Authenticated SQL Injection","severity":"high","cvss":8.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0248f829-84de-40b9-bb63-354fbf06472d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.36","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.32","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.28","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.27","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.26","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.19","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.20","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.16","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.13","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.12","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"3.7.39"}],"published":"2022-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02490a4b-b2c0-4921-bbf2-678c44c96a5b","source":"wordfence","cve":"CVE-2024-34768","title":"Fastly <= 1.2.25 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02490a4b-b2c0-4921-bbf2-678c44c96a5b?source=api-prod","affected":[{"type":"plugin","slug":"fastly","name":"Fastly","from":"*","from_inclusive":true,"to":"1.2.25","to_inclusive":true,"patched_in":"1.2.26"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T20:14:28Z"},{"id":"wordfence:024a6a0f-f819-40e7-9618-71219c27aa64","source":"wordfence","cve":"CVE-2026-5820","title":"Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/024a6a0f-f819-40e7-9618-71219c27aa64?source=api-prod","affected":[{"type":"plugin","slug":"zypento-blocks","name":"Zypento Blocks","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:03:28Z","updated":"2026-05-11T21:04:18Z"},{"id":"wordfence:024af9de-d4c7-43ec-a602-c45ded3ddad3","source":"wordfence","cve":"CVE-2025-4774","title":"Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/024af9de-d4c7-43ec-a602-c45ded3ddad3?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.8","to_inclusive":true,"patched_in":"4.11.9"}],"published":"2025-06-09T22:02:57Z","updated":"2025-06-10T11:22:57Z"},{"id":"wordfence:024d5962-0e8f-43cb-90dc-c282a5e436f2","source":"wordfence","cve":"CVE-2026-15650","title":"RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/024d5962-0e8f-43cb-90dc-c282a5e436f2?source=api-prod","affected":[{"type":"plugin","slug":"rt-mega-menu","name":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-17T14:08:58Z","updated":"2026-09-18T02:27:54Z"},{"id":"wordfence:024f4058-065b-48b4-a08a-d9732d4375cd","source":"wordfence","cve":"CVE-2023-1919","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/024f4058-065b-48b4-a08a-d9732d4375cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:024fa9ff-d1ba-4c1f-aa51-1dbf5a5713d8","source":"wordfence","cve":"CVE-2024-48044","title":"ShortPixel Image Optimizer <= 5.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/024fa9ff-d1ba-4c1f-aa51-1dbf5a5713d8?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-10-13T00:00:00Z","updated":"2024-10-18T15:59:07Z"},{"id":"wordfence:0252d07a-cf84-479d-a71b-a9b13a9765d5","source":"wordfence","cve":"CVE-2021-24424","title":"WP Reset <= 1.86 - Authenticated Stored Cross-Site Scripting via extra_data Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0252d07a-cf84-479d-a71b-a9b13a9765d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset","from":"*","from_inclusive":true,"to":"1.86","to_inclusive":true,"patched_in":"1.90"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0253e3fa-c0ee-4c76-bd92-a450771cae0c","source":"wordfence","cve":"CVE-2026-24553","title":"Fraud Prevention For Woocommerce <= 2.3.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0253e3fa-c0ee-4c76-bd92-a450771cae0c?source=api-prod","affected":[{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-01-22T00:00:00Z","updated":"2026-02-24T22:21:59Z"},{"id":"wordfence:02540fe4-b690-46ab-b79b-a90c8d796ec4","source":"wordfence","cve":"CVE-2022-38086","title":"Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02540fe4-b690-46ab-b79b-a90c8d796ec4?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.0","to_inclusive":true,"patched_in":"5.12.1"}],"published":"2022-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0254726d-ce5b-454c-ab8b-d778beb375d4","source":"wordfence","cve":"CVE-2025-28991","title":"Evon <= 3.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0254726d-ce5b-454c-ab8b-d778beb375d4?source=api-prod","affected":[{"type":"theme","slug":"snsevon","name":"Evon - Bag Store WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:46:57Z"},{"id":"wordfence:0254cd1b-f8f6-400e-a48e-81bd553fe8d1","source":"wordfence","cve":"CVE-2025-11734","title":"Broken Link Checker by AIOSEO \u2013 Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Trashing","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0254cd1b-f8f6-400e-a48e-81bd553fe8d1?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker-seo","name":"Broken Link Checker by AIOSEO \u2013 Find & Fix Broken Internal, External & Video Links","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-11-17T20:46:55Z","updated":"2025-11-18T09:27:37Z"},{"id":"wordfence:02551726-672d-481a-8b77-ec7bf33a22c1","source":"wordfence","cve":"CVE-2023-22677","title":"WP Booklet <= 2.1.8 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02551726-672d-481a-8b77-ec7bf33a22c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-booklet","name":"WP Booklet","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0256b4ad-6094-4062-bdf7-c3fc0410557b","source":"wordfence","cve":"CVE-2025-4206","title":"WordPress CRM, Email & Marketing Automation for WordPress | Award Winner \u2014 Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0256b4ad-6094-4062-bdf7-c3fc0410557b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.1.1.2","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T11:11:21Z"},{"id":"wordfence:025a06c7-6573-4074-af4c-7b5836081943","source":"wordfence","cve":"CVE-2026-11578","title":"Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/025a06c7-6573-4074-af4c-7b5836081943?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-21T13:56:14Z"},{"id":"wordfence:025a13e6-5f0a-49ca-bd63-44e4095072bd","source":"wordfence","cve":"CVE-2023-52213","title":"Rate Star Review <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/025a13e6-5f0a-49ca-bd63-44e4095072bd?source=api-prod","affected":[{"type":"plugin","slug":"rate-star-review","name":"Rate Star Review Vote \u2013 AJAX Reviews, Votes, Star Ratings","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:025d576b-7342-4863-ac30-f1ff0205d638","source":"wordfence","cve":"CVE-2023-34169","title":"TS Webfonts for \u3055\u304f\u3089\u306e\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0 <= 3.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/025d576b-7342-4863-ac30-f1ff0205d638?source=api-prod","affected":[{"type":"plugin","slug":"ts-webfonts-for-sakura","name":"TS Webfonts for \u3055\u304f\u3089\u306e\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:026443b6-4ab5-4f31-8a8d-2019097bde4c","source":"wordfence","cve":"CVE-2023-41692","title":"Attorney <= 3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026443b6-4ab5-4f31-8a8d-2019097bde4c?source=api-prod","affected":[{"type":"theme","slug":"attorney","name":"Attorney","from":"*","from_inclusive":true,"to":"3","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02649a9e-036a-47fe-ab1a-26caf4f2be27","source":"wordfence","cve":"CVE-2022-45806","title":"Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02649a9e-036a-47fe-ab1a-26caf4f2be27?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02665811-15ba-434c-a4d0-df5402a128f4","source":"wordfence","cve":"","title":"Simple Ads Manager <= 2.9.8.125 - Unauthenticated PHP Objection Injection","severity":"high","cvss":8.3,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02665811-15ba-434c-a4d0-df5402a128f4?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.10.0.130","to_inclusive":false,"patched_in":"2.10.0.130"}],"published":"2017-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02699ada-f4bf-45c4-89e8-018dfff40ac1","source":"wordfence","cve":"","title":"Gallery - Video Gallery and YouTube Gallery <= 2.0.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02699ada-f4bf-45c4-89e8-018dfff40ac1?source=api-prod","affected":[{"type":"plugin","slug":"gallery-video","name":"Gallery - Video Gallery and YouTube Gallery","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2016-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:026a2e0d-4d30-4133-9118-055026aa9f4a","source":"wordfence","cve":"CVE-2026-0594","title":"List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026a2e0d-4d30-4133-9118-055026aa9f4a?source=api-prod","affected":[{"type":"plugin","slug":"list-site-contributors","name":"List Site Contributors","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:25:37Z","updated":"2026-01-14T05:28:03Z"},{"id":"wordfence:026b72f5-b650-4d48-8564-450a22ea7784","source":"wordfence","cve":"CVE-2025-23841","title":"Top Flash Embed <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026b72f5-b650-4d48-8564-450a22ea7784?source=api-prod","affected":[{"type":"plugin","slug":"top-flash-embed","name":"Top Flash Embed","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:34:49Z"},{"id":"wordfence:026ba3a0-5ad4-4506-88f2-a101a4f5e19e","source":"wordfence","cve":"CVE-2026-82304","title":"Music Store \u2013 WordPress eCommerce < 1.4.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026ba3a0-5ad4-4506-88f2-a101a4f5e19e?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:16:59Z"},{"id":"wordfence:026ce95f-3fa4-43d3-b786-1c379a210b50","source":"wordfence","cve":"CVE-2026-119176","title":"CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026ce95f-3fa4-43d3-b786-1c379a210b50?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.43","to_inclusive":true,"patched_in":"1.4.44"}],"published":"2026-10-30T16:20:55Z","updated":"2026-10-30T17:15:24Z"},{"id":"wordfence:026f8d9b-a66b-4a59-8375-fba587a4eef7","source":"wordfence","cve":"CVE-2024-1945","title":"ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026f8d9b-a66b-4a59-8375-fba587a4eef7?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:51:41Z"},{"id":"wordfence:026ff6f4-077e-4fee-8fbe-8176f8ca5af3","source":"wordfence","cve":"CVE-2023-47185","title":"wpDiscuz <= 7.6.11 - Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/026ff6f4-077e-4fee-8fbe-8176f8ca5af3?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.11","to_inclusive":true,"patched_in":"7.6.12"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02737f71-7ea6-4ce7-87e8-3988e3759f00","source":"wordfence","cve":"CVE-2024-44049","title":"Gutenberg Blocks \u2013 Unlimited blocks For Gutenberg <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02737f71-7ea6-4ce7-87e8-3988e3759f00?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-blocks","name":"Unlimited Addons For Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-09-16T00:00:00Z","updated":"2026-07-08T20:41:27Z"},{"id":"wordfence:0274f1c0-aae5-4f5d-9ce3-de93326c1d69","source":"wordfence","cve":"CVE-2026-16966","title":"Solace Extra < 1.7.0 - Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0274f1c0-aae5-4f5d-9ce3-de93326c1d69?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:17:33Z"},{"id":"wordfence:0279eb4e-36e1-4cdd-8afb-b3a71e2c726e","source":"wordfence","cve":"CVE-2025-31033","title":"Buddypress Humanity <= 1.2 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0279eb4e-36e1-4cdd-8afb-b3a71e2c726e?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-humanity","name":"Buddypress Humanity","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:21:25Z"},{"id":"wordfence:027fa70f-8777-4a0b-b2aa-18bcdcd99cbf","source":"wordfence","cve":"CVE-2021-24371","title":"RSVPMaker <= 8.7.2 - Server-Side Request Forgery","severity":"low","cvss":2.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/027fa70f-8777-4a0b-b2aa-18bcdcd99cbf?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":false,"patched_in":"8.7.4"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02822b64-7cfb-4cd1-a727-10f61603ece4","source":"wordfence","cve":"CVE-2025-68535","title":"Sunshine Photo Cart <= 3.5.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02822b64-7cfb-4cd1-a727-10f61603ece4?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.5.7.1","to_inclusive":true,"patched_in":"3.5.7.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-06T14:19:54Z"},{"id":"wordfence:0286fbd0-b303-4a53-b52f-653cd0f5fb20","source":"wordfence","cve":"CVE-2026-125847","title":"vdperanto <= 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0286fbd0-b303-4a53-b52f-653cd0f5fb20?source=api-prod","affected":[{"type":"theme","slug":"vdperanto","name":"vdperanto","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:49Z"},{"id":"wordfence:02888538-c2c7-4cba-acf3-77d76cef255e","source":"wordfence","cve":"CVE-2026-24976","title":"Organici Library <= 2.1.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02888538-c2c7-4cba-acf3-77d76cef255e?source=api-prod","affected":[{"type":"plugin","slug":"noo-organici-library","name":"Organici Library","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:09:18Z"},{"id":"wordfence:028a90c7-ded7-45ad-90ea-9f1a7d3743a0","source":"wordfence","cve":"CVE-2023-23981","title":"Conversational Forms for ChatBot <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/028a90c7-ded7-45ad-90ea-9f1a7d3743a0?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:028b11f9-bca6-49bd-b2ac-e387d3a3bcb4","source":"wordfence","cve":"CVE-2024-54397","title":"Go Animate <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/028b11f9-bca6-49bd-b2ac-e387d3a3bcb4?source=api-prod","affected":[{"type":"plugin","slug":"goanimate","name":"Go Animate","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:59:31Z"},{"id":"wordfence:02930a65-91b6-475e-9673-063ba5929b6c","source":"wordfence","cve":"CVE-2024-39627","title":"NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02930a65-91b6-475e-9673-063ba5929b6c?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.3","to_inclusive":true,"patched_in":"3.59.4"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:10:32Z"},{"id":"wordfence:0293f989-a5fa-46e3-896e-84f58c4e171e","source":"wordfence","cve":"CVE-2024-51940","title":"WP Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0293f989-a5fa-46e3-896e-84f58c4e171e?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-responsive-video","name":"WP Responsive Video","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:46:07Z"},{"id":"wordfence:0295711d-5da6-4e28-9151-b0ce762c7eb7","source":"wordfence","cve":"CVE-2022-1952","title":"Free Booking Plugin for Hotels, Restaurant and Car Rental \u2013 eaSYNC <= 1.1.15 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0295711d-5da6-4e28-9151-b0ce762c7eb7?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0296b9ce-22b5-4c00-b57d-9c33c3b100fe","source":"wordfence","cve":"CVE-2026-78269","title":"Shared Files \u2013 File Upload & Download Manager <= 1.7.69 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0296b9ce-22b5-4c00-b57d-9c33c3b100fe?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.69","to_inclusive":true,"patched_in":"1.7.70"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:10:51Z"},{"id":"wordfence:029719d5-d7b8-48f5-af97-7a4f55892c4f","source":"wordfence","cve":"CVE-2025-24773","title":"WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029719d5-d7b8-48f5-af97-7a4f55892c4f?source=api-prod","affected":[{"type":"plugin","slug":"wpcrm","name":"WPCRM - CRM for Contact form CF7 & WooCommerce","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T15:11:03Z"},{"id":"wordfence:0297cdfa-0798-417b-ba49-119669df329d","source":"wordfence","cve":"CVE-2024-51874","title":"ParOne Feeds <= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0297cdfa-0798-417b-ba49-119669df329d?source=api-prod","affected":[{"type":"plugin","slug":"parone","name":"ParOne Feeds","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2024-11-08T00:00:00Z","updated":"2025-01-30T21:48:04Z"},{"id":"wordfence:0297d524-e016-4f8d-920c-d58c62edb2a0","source":"wordfence","cve":"CVE-2026-3454","title":"GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0297d524-e016-4f8d-920c-d58c62edb2a0?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-05-04T17:58:25Z","updated":"2026-05-05T06:43:25Z"},{"id":"wordfence:0298f5e6-36b6-4005-b6ef-d38f2f86f0b1","source":"wordfence","cve":"CVE-2024-3060","title":"ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0298f5e6-36b6-4005-b6ef-d38f2f86f0b1?source=api-prod","affected":[{"type":"plugin","slug":"enl-newsletter","name":"ENL Newsletter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T15:17:59Z"},{"id":"wordfence:02990dd6-707a-4154-8f01-f4e27a9deb05","source":"wordfence","cve":"CVE-2025-58971","title":"Doctreat <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02990dd6-707a-4154-8f01-f4e27a9deb05?source=api-prod","affected":[{"type":"theme","slug":"doctreat","name":"Doctreat - Hospitals and Doctors Directory WordPress Listing Theme","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-08-02T00:00:00Z","updated":"2025-10-29T20:21:42Z"},{"id":"wordfence:029956d7-6e3f-4159-9f53-05691e0262fc","source":"wordfence","cve":"CVE-2025-4367","title":"Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029956d7-6e3f-4159-9f53-05691e0262fc?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.18","to_inclusive":true,"patched_in":"3.3.19"}],"published":"2025-06-18T15:05:22Z","updated":"2025-06-19T03:40:13Z"},{"id":"wordfence:02998107-9415-433a-8c64-5838324bdcc3","source":"wordfence","cve":"CVE-2025-48126","title":"Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02998107-9415-433a-8c64-5838324bdcc3?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2026-01-27T20:36:22Z"},{"id":"wordfence:029ab433-baf5-47e3-92bb-dad14e268779","source":"wordfence","cve":"CVE-2025-30997","title":"Car Repair Services <= 5.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029ab433-baf5-47e3-92bb-dad14e268779?source=api-prod","affected":[{"type":"theme","slug":"car-repair-services","name":"Car Repair Services & Auto Mechanic WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:28:36Z"},{"id":"wordfence:029b4554-518e-484e-9e3a-7275a5fe1f17","source":"wordfence","cve":"CVE-2025-24757","title":"uDesign <= 4.11.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029b4554-518e-484e-9e3a-7275a5fe1f17?source=api-prod","affected":[{"type":"theme","slug":"udesign","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.11.2","to_inclusive":true,"patched_in":"4.11.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:44:09Z"},{"id":"wordfence:029c3606-caba-4964-aefd-6000a1b4832d","source":"wordfence","cve":"","title":"WORDPRESS VIDEO GALLERY <= 3.0 - Improper Access Control","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029c3606-caba-4964-aefd-6000a1b4832d?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:029cf812-1172-487b-82e3-ec34ca6d151e","source":"wordfence","cve":"CVE-2026-74008","title":"Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029cf812-1172-487b-82e3-ec34ca6d151e?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.22","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T17:10:00Z","updated":"2026-09-10T19:28:47Z"},{"id":"wordfence:029f6286-5a97-4fe0-8c02-97d8cb2ed396","source":"wordfence","cve":"CVE-2025-15546","title":"Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/029f6286-5a97-4fe0-8c02-97d8cb2ed396?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2026-05-24T00:00:00Z","updated":"2026-09-17T14:49:30Z"},{"id":"wordfence:02a2341b-6462-4d9b-a4a1-dd8c965df7be","source":"wordfence","cve":"CVE-2026-110956","title":"asVereinbase <= 1.1.7 - Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02a2341b-6462-4d9b-a4a1-dd8c965df7be?source=api-prod","affected":[{"type":"plugin","slug":"asvereinbase","name":"asVereinbase \u2013 Club & Member Management for WP","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T15:01:40Z"},{"id":"wordfence:02a283b2-a369-4927-a54a-61f26bee6ace","source":"wordfence","cve":"CVE-2026-13741","title":"Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02a283b2-a369-4927-a54a-61f26bee6ace?source=api-prod","affected":[{"type":"plugin","slug":"digits","name":"Digits: WordPress Mobile Number Signup and Login","from":"*","from_inclusive":true,"to":"9.1.0.5","to_inclusive":true,"patched_in":"9.1.0.6"}],"published":"2026-07-15T20:26:08Z","updated":"2026-07-16T08:26:49Z"},{"id":"wordfence:02a6428f-beef-4491-ab5f-130a9e7924c2","source":"wordfence","cve":"CVE-2022-0403","title":"Bit File Manager \u2013 100% free file manager for WordPress <= 5.2.2 - Subscriber+ Arbitrary File Creation/Upload/Deletion","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02a6428f-beef-4491-ab5f-130a9e7924c2?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02a9a673-4e6b-4c06-b752-88b4ecf55d70","source":"wordfence","cve":"CVE-2025-67578","title":"Email Capture <= 3.12.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02a9a673-4e6b-4c06-b752-88b4ecf55d70?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.12.4","to_inclusive":true,"patched_in":"3.12.5"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-12T20:59:40Z"},{"id":"wordfence:02ac8b9e-bc59-4c46-9f9c-23e3b6ae615c","source":"wordfence","cve":"","title":"Picture Factory (Unspecified Versions) - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ac8b9e-bc59-4c46-9f9c-23e3b6ae615c?source=api-prod","affected":[{"type":"theme","slug":"picturefactory","name":"Picture Factory","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02ad47d5-f011-4e0a-af29-088852d1e886","source":"wordfence","cve":"CVE-2024-11420","title":"Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ad47d5-f011-4e0a-af29-088852d1e886?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.77","to_inclusive":true,"patched_in":"2.0.78"}],"published":"2024-12-04T00:00:00Z","updated":"2024-12-05T09:23:05Z"},{"id":"wordfence:02add5d4-6447-40ee-aaec-7a1929989201","source":"wordfence","cve":"CVE-2026-120512","title":"Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02add5d4-6447-40ee-aaec-7a1929989201?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.50","to_inclusive":true,"patched_in":"1.15.51"}],"published":"2026-11-06T13:47:23Z","updated":"2026-11-07T02:29:10Z"},{"id":"wordfence:02af50bf-d0f3-4dd7-89bd-dd60c33b5097","source":"wordfence","cve":"CVE-2024-43121","title":"HUSKY <= 1.3.6.1 - Authenticated (Shop Manager+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02af50bf-d0f3-4dd7-89bd-dd60c33b5097?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6.1","to_inclusive":true,"patched_in":"1.3.6.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:33:28Z"},{"id":"wordfence:02af9eab-fe69-4adb-b6e8-bf710b00af3f","source":"wordfence","cve":"CVE-2026-39668","title":"Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02af9eab-fe69-4adb-b6e8-bf710b00af3f?source=api-prod","affected":[{"type":"plugin","slug":"book-previewer-for-woocommerce","name":"Book Previewer for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:26:36Z"},{"id":"wordfence:02b03c4a-1b2a-4fd0-887d-930229dc384f","source":"wordfence","cve":"CVE-2026-2279","title":"myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b03c4a-1b2a-4fd0-887d-930229dc384f?source=api-prod","affected":[{"type":"plugin","slug":"mylinksdump","name":"myLinksDump","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:48Z","updated":"2026-03-21T03:26:28Z"},{"id":"wordfence:02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe","source":"wordfence","cve":"CVE-2026-3504","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b0d7d7-8a10-48de-b1e1-7e1f1fda6ffe?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T13:26:09Z"},{"id":"wordfence:02b24735-0310-4b00-9acc-a05557238697","source":"wordfence","cve":"CVE-2024-31345","title":"Auto Poster <= 1.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b24735-0310-4b00-9acc-a05557238697?source=api-prod","affected":[{"type":"plugin","slug":"auto-poster","name":"Auto Poster","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:14:40Z"},{"id":"wordfence:02b336ce-be41-4343-9817-0437bd2685c2","source":"wordfence","cve":"CVE-2023-48331","title":"MyBookTable Bookstore <= 3.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b336ce-be41-4343-9817-0437bd2685c2?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02b4dd72-7e6a-4430-bd75-f9dd3d6b0bf1","source":"wordfence","cve":"CVE-2025-25101","title":"Munk Sites <= 1.0.7 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b4dd72-7e6a-4430-bd75-f9dd3d6b0bf1?source=api-prod","affected":[{"type":"plugin","slug":"munk-sites","name":"Ready to use Gutenberg and Elementor Templates \u2013 Munk Sites","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:23:19Z"},{"id":"wordfence:02b5aefe-ba27-4273-927c-7779df83eb18","source":"wordfence","cve":"CVE-2023-28932","title":"WPMobile.App <= 11.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b5aefe-ba27-4273-927c-7779df83eb18?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.20","to_inclusive":true,"patched_in":"11.21"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02b61eb1-a93f-4437-87de-d698af8ef9f6","source":"wordfence","cve":"","title":"Blog2Social <= 6.9.3 - PHP Object Injection","severity":"high","cvss":8.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b61eb1-a93f-4437-87de-d698af8ef9f6?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.9.3","to_inclusive":true,"patched_in":"6.9.4"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02b75034-8db1-465b-837e-014e2c2e8b4d","source":"wordfence","cve":"CVE-2024-22284","title":"Asgaros Forum <= 2.7.2 - Unauthenticated PHP Object Injection in prepare_unread_status","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b75034-8db1-465b-837e-014e2c2e8b4d?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02b75b0a-9409-4593-bf25-65ff49576dee","source":"wordfence","cve":"CVE-2025-25172","title":"VidMov <= 1.9.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b75b0a-9409-4593-bf25-65ff49576dee?source=api-prod","affected":[{"type":"theme","slug":"vidmov","name":"VidMov - Video WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:57:45Z"},{"id":"wordfence:02b7bbdf-5cb9-4206-bee5-3b43f0f862ea","source":"wordfence","cve":"CVE-2026-42379","title":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.6.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b7bbdf-5cb9-4206-bee5-3b43f0f862ea?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T15:02:23Z"},{"id":"wordfence:02b91de7-3d1f-46c7-9a76-f1200926149a","source":"wordfence","cve":"CVE-2025-53293","title":"Dashboard Widget Sidebar <= 1.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b91de7-3d1f-46c7-9a76-f1200926149a?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-widget-sidebar","name":"Dashboard Widget Sidebar","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:37:08Z"},{"id":"wordfence:02b9450e-422f-45f1-a55b-cf401e39247c","source":"wordfence","cve":"CVE-2025-14053","title":"Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b9450e-422f-45f1-a55b-cf401e39247c?source=api-prod","affected":[{"type":"plugin","slug":"wish-to-go","name":"Travel Bucket List \u2013 Wish To Go","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:47:44Z","updated":"2026-01-07T09:20:51Z"},{"id":"wordfence:02b9a40a-2fb6-4d75-b4b4-a83b95df90e1","source":"wordfence","cve":"CVE-2014-7240","title":"Easy Contact Form Solution <= 1.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02b9a40a-2fb6-4d75-b4b4-a83b95df90e1?source=api-prod","affected":[{"type":"plugin","slug":"easy-contact-form-solution","name":"Easy Contact Form Solution","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02bb12db-0bc9-4c13-918f-1f90b500c165","source":"wordfence","cve":"","title":"PropertyHive < 1.4.26 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02bb12db-0bc9-4c13-918f-1f90b500c165?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"1.4.26","to_inclusive":false,"patched_in":"1.4.26"}],"published":"2018-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02bf7820-3314-4c12-aecd-074869e1c602","source":"wordfence","cve":"CVE-2025-31922","title":"CSS3 Accordions for WordPress <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02bf7820-3314-4c12-aecd-074869e1c602?source=api-prod","affected":[{"type":"plugin","slug":"css3_accordions","name":"CSS3 Accordions for WordPress","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-24T22:14:16Z"},{"id":"wordfence:02bfc849-0f36-4647-9290-eddbacdb419b","source":"wordfence","cve":"CVE-2023-26530","title":"Updraft <= 0.6.1 - Reflected Cross-Site Scripting via 'backup_timestamp'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02bfc849-0f36-4647-9290-eddbacdb419b?source=api-prod","affected":[{"type":"plugin","slug":"updraft","name":"Updraft","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02bfe680-d20d-4246-8fdb-11815114975a","source":"wordfence","cve":"CVE-2026-57696","title":"Picture Gallery \u2013 Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02bfe680-d20d-4246-8fdb-11815114975a?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2026-07-20T00:00:00Z","updated":"2026-07-29T13:29:20Z"},{"id":"wordfence:02c5e3ad-5cc3-40b1-a15a-10d53383abe6","source":"wordfence","cve":"CVE-2026-2126","title":"User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5e3ad-5cc3-40b1-a15a-10d53383abe6?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20260113","to_inclusive":true,"patched_in":"20260217"}],"published":"2026-02-17T20:36:12Z","updated":"2026-02-18T09:25:54Z"},{"id":"wordfence:02c5efef-bc92-411c-b77f-2359a72ef23b","source":"wordfence","cve":"CVE-2026-66675","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02c5efef-bc92-411c-b77f-2359a72ef23b?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.128","to_inclusive":true,"patched_in":"1.4.129"}],"published":"2026-11-07T09:43:47Z","updated":"2026-11-10T20:06:19Z"},{"id":"wordfence:02c6ec97-50cc-4c61-9bb7-b94250d5dda3","source":"wordfence","cve":"CVE-2024-7484","title":"CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02c6ec97-50cc-4c61-9bb7-b94250d5dda3?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-06T01:49:58Z"},{"id":"wordfence:02c9beba-dfa5-4a30-8355-62ff9a2630f7","source":"wordfence","cve":"CVE-2026-0688","title":"Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02c9beba-dfa5-4a30-8355-62ff9a2630f7?source=api-prod","affected":[{"type":"plugin","slug":"webmention","name":"Webmention","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-04-01T19:17:16Z","updated":"2026-04-02T07:39:35Z"},{"id":"wordfence:02cb377a-3208-4031-b81f-724218891eef","source":"wordfence","cve":"CVE-2026-97251","title":"Bus Ticket Booking with Seat Reservation <= 5.9.3 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02cb377a-3208-4031-b81f-724218891eef?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2026-10-01T13:29:40Z","updated":"2026-10-08T23:57:49Z"},{"id":"wordfence:02ce06d6-f5f6-4add-9dcd-5fc35aabfe9a","source":"wordfence","cve":"CVE-2025-62987","title":"Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ce06d6-f5f6-4add-9dcd-5fc35aabfe9a?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-29T14:37:01Z"},{"id":"wordfence:02cf0e1a-bd12-44b1-9bc5-1a5ec332b000","source":"wordfence","cve":"CVE-2025-7642","title":"Simpler Checkout 0.7.0 - 1.1.13 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02cf0e1a-bd12-44b1-9bc5-1a5ec332b000?source=api-prod","affected":[{"type":"plugin","slug":"simpler-checkout","name":"Simpler Checkout","from":"0.7.0","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-08-22T15:41:29Z","updated":"2025-08-28T15:25:29Z"},{"id":"wordfence:02cf711b-69af-4869-9ebd-31c657be1bc3","source":"wordfence","cve":"CVE-2019-16520","title":"All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02cf711b-69af-4869-9ebd-31c657be1bc3?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02cff893-4f41-4bb0-9fb0-344a3a8afa0b","source":"wordfence","cve":"CVE-2024-5141","title":"Rotating Tweets (Twitter widget and shortcode) <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02cff893-4f41-4bb0-9fb0-344a3a8afa0b?source=api-prod","affected":[{"type":"plugin","slug":"rotatingtweets","name":"Rotating Tweets (Twitter widget and shortcode)","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T15:44:04Z","updated":"2024-06-06T03:53:10Z"},{"id":"wordfence:02cffe63-dad2-4f6b-9530-7f494e3071d7","source":"wordfence","cve":"CVE-2023-45049","title":"YouTube Playlist Player <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02cffe63-dad2-4f6b-9530-7f494e3071d7?source=api-prod","affected":[{"type":"plugin","slug":"youtube-playlist-player","name":"Playlist Player for YouTube \u2013 Fast, Privacy-Friendly Playlists & Channel Feed","from":"*","from_inclusive":true,"to":"4.6.7","to_inclusive":true,"patched_in":"4.6.8"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02d11be0-2e2e-4c76-8a8e-f3f637b99809","source":"wordfence","cve":"CVE-2023-51523","title":"WooCommerce Easy Duplicate Product <= 0.3.0.7 - Missing Authorization via wedp_duplicate_product_action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d11be0-2e2e-4c76-8a8e-f3f637b99809?source=api-prod","affected":[{"type":"plugin","slug":"woo-easy-duplicate-product","name":"Easy Duplicate Product for WooCommerce","from":"*","from_inclusive":true,"to":"0.3.0.7","to_inclusive":true,"patched_in":"0.3.0.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02d4bc64-d05d-4151-bc38-523cbb2ef60c","source":"wordfence","cve":"CVE-2022-1777","title":"Filr \u2013 Secure document library <= 1.2.2 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d4bc64-d05d-4151-bc38-523cbb2ef60c?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.2.1","to_inclusive":false,"patched_in":"1.2.2.1"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02d61a68-0bcf-4a6d-8e19-c1546b9e59d9","source":"wordfence","cve":"CVE-2025-68586","title":"Cooked <= 1.11.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d61a68-0bcf-4a6d-8e19-c1546b9e59d9?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-15T17:57:32Z"},{"id":"wordfence:02d6e9c3-f040-4a41-a803-4bbe5f86c29b","source":"wordfence","cve":"CVE-2024-43153","title":"Woffice <= 5.4.10 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d6e9c3-f040-4a41-a803-4bbe5f86c29b?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"5.4.12"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:27:37Z"},{"id":"wordfence:02d994b7-2891-47d0-92d3-c33c4eac54f0","source":"wordfence","cve":"CVE-2024-32724","title":"Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy <= 2.1.1 - Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d994b7-2891-47d0-92d3-c33c4eac54f0?source=api-prod","affected":[{"type":"plugin","slug":"woo-aliexpress-dropshipping","name":"SharkDropship & Affiliate for AliExpress, eBay, Amazon, Etsy and Temu","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T13:48:28Z"},{"id":"wordfence:02d9eef8-0934-44c9-b5b5-98caf5c3c4cd","source":"wordfence","cve":"CVE-2026-116867","title":"Dynamic QR Code \u2013 generator <= 1.0.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02d9eef8-0934-44c9-b5b5-98caf5c3c4cd?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-qr-code","name":"Dynamic QR Code","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T10:19:03Z","updated":"2026-11-03T19:37:17Z"},{"id":"wordfence:02dcf609-e8ef-4ff5-a61e-6c513af04ca2","source":"wordfence","cve":"CVE-2023-29237","title":"Remove Duplicate Posts <= 1.3.5 - Missing Authorization to Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02dcf609-e8ef-4ff5-a61e-6c513af04ca2?source=api-prod","affected":[{"type":"plugin","slug":"remove-duplicate-posts","name":"Remove Duplicate Posts","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2023-07-24T00:00:00Z","updated":"2024-03-25T18:05:45Z"},{"id":"wordfence:02dd7f57-4379-4ea9-aced-67db6c8457d9","source":"wordfence","cve":"CVE-2025-57973","title":"WP-Members <= 3.5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02dd7f57-4379-4ea9-aced-67db6c8457d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4.2","to_inclusive":true,"patched_in":"3.5.4.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:39:20Z"},{"id":"wordfence:02ddfc75-8a9e-4a8e-8339-52348a963c69","source":"wordfence","cve":"CVE-2023-49175","title":"KP Fastest Tawk.to Chat <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ddfc75-8a9e-4a8e-8339-52348a963c69?source=api-prod","affected":[{"type":"plugin","slug":"kp-fastest-tawk-to-chat","name":"KP Fastest Tawk.to Chat","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02de9287-68e4-46ce-a491-3f6cbb7fc0ed","source":"wordfence","cve":"CVE-2026-0726","title":"Nexter Extension \u2013 Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02de9287-68e4-46ce-a491-3f6cbb7fc0ed?source=api-prod","affected":[{"type":"plugin","slug":"nexter-extension","name":"Nexter Extension \u2013 Security, Performance, Code Snippets & Site Toolkit","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-01-20T01:54:23Z","updated":"2026-01-20T14:26:32Z"},{"id":"wordfence:02e0b218-c3a4-4310-a13c-7fdb334594ab","source":"wordfence","cve":"CVE-2026-84091","title":"SUMIT Payment Gateway for WooCommerce <= 3.0.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e0b218-c3a4-4310-a13c-7fdb334594ab?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-officeguy","name":"SUMIT Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-29T19:35:07Z"},{"id":"wordfence:02e2b696-59cb-490b-a7e7-9883e591389b","source":"wordfence","cve":"","title":"WordPress Core 4.7.0 - 7.1.3 - Authenticated (Custom+) Stored Cross-Site Scripting via Externally-Supplied User Login Values","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e2b696-59cb-490b-a7e7-9883e591389b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.38","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.33","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.34","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"4.7.39"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T15:39:34Z"},{"id":"wordfence:02e3f64c-1076-4247-9ee5-c1105edcfb39","source":"wordfence","cve":"CVE-2026-15016","title":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e3f64c-1076-4247-9ee5-c1105edcfb39?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2026-07-27T23:51:13Z","updated":"2026-07-28T12:36:30Z"},{"id":"wordfence:02e58374-e641-42f6-a718-cd364e38855c","source":"wordfence","cve":"CVE-2026-74929","title":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker < 4.0.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e58374-e641-42f6-a718-cd364e38855c?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:04:18Z"},{"id":"wordfence:02e6145c-7aa5-48e2-837c-9674e7a72e42","source":"wordfence","cve":"CVE-2026-62127","title":"WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e6145c-7aa5-48e2-837c-9674e7a72e42?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-info-card","name":"WP Plugin Info Card \u2013 Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:28:29Z"},{"id":"wordfence:02e63068-02a8-4106-b64e-430c24815e55","source":"wordfence","cve":"CVE-2026-1379","title":"HTTP Headers <= 1.19.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e63068-02a8-4106-b64e-430c24815e55?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.19.4","to_inclusive":true,"patched_in":"1.19.5"}],"published":"2026-04-21T19:13:16Z","updated":"2026-07-09T19:50:19Z"},{"id":"wordfence:02e8a576-bf00-4da9-9795-bd6b22bb0b19","source":"wordfence","cve":"CVE-2022-36341","title":"AS \u2013 Create Pinterest Pinboard Pages <= 1.0 - Authenticated Options Change to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e8a576-bf00-4da9-9795-bd6b22bb0b19?source=api-prod","affected":[{"type":"plugin","slug":"as-create-pinterest-pinboard-pages","name":"AS \u2013 Create Pinterest Pinboard Pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02e918f8-8380-44f6-bd4f-4f58fd47d69a","source":"wordfence","cve":"CVE-2025-39481","title":"Eventer <= 3.9.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02e918f8-8380-44f6-bd4f-4f58fd47d69a?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-08-13T18:04:46Z"},{"id":"wordfence:02ea41ea-870e-4f32-bfad-d7e8248ff3b1","source":"wordfence","cve":"CVE-2025-68037","title":"Export Media URLs <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ea41ea-870e-4f32-bfad-d7e8248ff3b1?source=api-prod","affected":[{"type":"plugin","slug":"export-media-urls","name":"Export Media URLs","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T20:59:11Z"},{"id":"wordfence:02eadae8-7aa6-42f5-b807-9ed82332fa72","source":"wordfence","cve":"CVE-2023-47684","title":"Essential Grid <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02eadae8-7aa6-42f5-b807-9ed82332fa72?source=api-prod","affected":[{"type":"plugin","slug":"essential-grid","name":"Essential Grid Portfolio \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02ecd818-4c96-463e-b9ab-5900c1d01a39","source":"wordfence","cve":"CVE-2016-1000144","title":"Photoxhibit <= 2.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ecd818-4c96-463e-b9ab-5900c1d01a39?source=api-prod","affected":[{"type":"plugin","slug":"photoxhibit","name":"PhotoXhibit","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02ef976d-2240-4f1c-a313-9fe3130333f2","source":"wordfence","cve":"CVE-2025-52729","title":"Diza <= 1.3.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ef976d-2240-4f1c-a313-9fe3130333f2?source=api-prod","affected":[{"type":"theme","slug":"diza","name":"Diza - Pharmacy Store Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:37:28Z"},{"id":"wordfence:02f44f5b-c513-4aba-b895-65df681620c6","source":"wordfence","cve":"CVE-2026-12995","title":"Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f44f5b-c513-4aba-b895-65df681620c6?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.8"}],"published":"2026-09-21T18:42:31Z","updated":"2026-09-22T07:41:09Z"},{"id":"wordfence:02f4987d-575f-4ee7-a3b7-c76a16cf1fe2","source":"wordfence","cve":"CVE-2026-24599","title":"NextMove Lite <= 2.23.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f4987d-575f-4ee7-a3b7-c76a16cf1fe2?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.24.0"}],"published":"2026-01-15T00:00:00Z","updated":"2026-03-17T21:31:11Z"},{"id":"wordfence:02f7e67a-3d9e-4bc2-9ada-d07ddda97c98","source":"wordfence","cve":"CVE-2026-13598","title":"RestrictMate \u2013 Restrict Page, Post and any Content ( Content Restriction and Membership Plugin) < 1.3.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f7e67a-3d9e-4bc2-9ada-d07ddda97c98?source=api-prod","affected":[{"type":"plugin","slug":"restrictmate","name":"RestrictMate \u2013 Restrict Page, Post and any Content ( Content Restriction and Membership Plugin)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:44:27Z"},{"id":"wordfence:02f8faff-8629-490b-9bc7-378ebffcfd0f","source":"wordfence","cve":"CVE-2020-29171","title":"All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f8faff-8629-490b-9bc7-378ebffcfd0f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":false,"patched_in":"4.4.6"}],"published":"2020-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02f941bd-c42d-49de-9af0-374db3ce22f3","source":"wordfence","cve":"CVE-2025-30615","title":"WP e-Commerce Style Email <= 0.6.2 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f941bd-c42d-49de-9af0-374db3ce22f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce-style-email","name":"WP e-Commerce Style Email","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:27:45Z"},{"id":"wordfence:02f957f6-2327-41e0-99f5-7a6893eeb614","source":"wordfence","cve":"CVE-2024-34575","title":"DethemeKit For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02f957f6-2327-41e0-99f5-7a6893eeb614?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T17:14:25Z"},{"id":"wordfence:02fa5b75-ea77-4ba7-979e-6db2bdeae3b5","source":"wordfence","cve":"CVE-2025-24538","title":"BuddyPress Groups Extras <= 3.6.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fa5b75-ea77-4ba7-979e-6db2bdeae3b5?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-groups-extras","name":"BuddyPress Groups Extras","from":"*","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-11-08T00:00:00Z","updated":"2025-02-19T16:26:22Z"},{"id":"wordfence:02faea1f-ef4b-4b29-8c0d-e1ca6f7c1192","source":"wordfence","cve":"CVE-2025-67935","title":"Optimize < 2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02faea1f-ef4b-4b29-8c0d-e1ca6f7c1192?source=api-prod","affected":[{"type":"theme","slug":"optimizewp","name":"Optimize - SEO & Social Media WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T19:25:55Z"},{"id":"wordfence:02fceb91-7691-4629-b18b-57959e9f3f62","source":"wordfence","cve":"CVE-2024-2187","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fceb91-7691-4629-b18b-57959e9f3f62?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:28Z"},{"id":"wordfence:02fd8469-cd99-42dc-9a28-c0ea08512bb0","source":"wordfence","cve":"CVE-2023-2895","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fd8469-cd99-42dc-9a28-c0ea08512bb0?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02fde6b1-d709-4329-ae9c-fea444c1aec8","source":"wordfence","cve":"CVE-2023-32500","title":"Woodmart <= 7.1.1 - Cross-Site Request Forgery to License Update","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fde6b1-d709-4329-ae9c-fea444c1aec8?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02fe4a33-d059-461c-a03f-b7306ce6193f","source":"wordfence","cve":"","title":"GeoPlaces <= 4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fe4a33-d059-461c-a03f-b7306ce6193f?source=api-prod","affected":[{"type":"theme","slug":"geoplaces4beta","name":"Geo Places 4 Theme beta","from":"*","from_inclusive":true,"to":"4beta","to_inclusive":true,"patched_in":"5"},{"type":"theme","slug":"geoplaces4","name":"Geo Places 4 Theme","from":"*","from_inclusive":true,"to":"4","to_inclusive":true,"patched_in":"5"}],"published":"2013-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:02fe87e4-4275-4652-aec1-b25547071796","source":"wordfence","cve":"CVE-2025-15440","title":"iONE360 configurator <= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02fe87e4-4275-4652-aec1-b25547071796?source=api-prod","affected":[{"type":"plugin","slug":"ione360-configurator","name":"iONE360  configurator","from":"*","from_inclusive":true,"to":"2.0.57","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:07:30Z","updated":"2026-02-11T08:26:23Z"},{"id":"wordfence:02ff0705-aff7-45aa-ad38-f371438edd69","source":"wordfence","cve":"CVE-2026-87793","title":"Design Scuole Italia <= 2.18.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/02ff0705-aff7-45aa-ad38-f371438edd69?source=api-prod","affected":[{"type":"plugin","slug":"design-scuole-wordpress-theme","name":"design-scuole-wordpress-theme","from":"1.0","from_inclusive":true,"to":"2.18.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-16T17:53:14Z"},{"id":"wordfence:030534e2-bf7d-42e4-94a1-986f629bea15","source":"wordfence","cve":"CVE-2026-3659","title":"WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030534e2-bf7d-42e4-94a1-986f629bea15?source=api-prod","affected":[{"type":"plugin","slug":"wp-circliful","name":"WP Circliful","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:47:00Z","updated":"2026-04-15T08:28:13Z"},{"id":"wordfence:03056e70-77a2-47e9-b2b9-6cdda04ea2ca","source":"wordfence","cve":"CVE-2024-51936","title":"ESB Testimonials <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03056e70-77a2-47e9-b2b9-6cdda04ea2ca?source=api-prod","affected":[{"type":"plugin","slug":"esb-testimonials","name":"ESB Testimonials","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:23:51Z"},{"id":"wordfence:0306313b-5244-4303-8e98-1ae0570566a8","source":"wordfence","cve":"CVE-2025-59583","title":"Penci Filter Everything < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0306313b-5244-4303-8e98-1ae0570566a8?source=api-prod","affected":[{"type":"plugin","slug":"penci-filter-everything","name":"Penci Filter Everything","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:48:07Z"},{"id":"wordfence:0306c785-0dc3-44fb-a3cc-9afb5ab81651","source":"wordfence","cve":"CVE-2022-3824","title":"WP Admin UI Customize <= 1.5.12 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0306c785-0dc3-44fb-a3cc-9afb5ab81651?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-ui-customize","name":"WP Admin UI Customize","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.5.13"}],"published":"2022-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03073726-58d0-45b3-b7a6-7d12dbede919","source":"wordfence","cve":"CVE-2024-0977","title":"Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03073726-58d0-45b3-b7a6-7d12dbede919?source=api-prod","affected":[{"type":"plugin","slug":"timeline-widget-addon-for-elementor","name":"Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T07:32:21Z"},{"id":"wordfence:03075190-0312-43bb-9ea6-d8640eadb05b","source":"wordfence","cve":"CVE-2025-64220","title":"Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03075190-0312-43bb-9ea6-d8640eadb05b?source=api-prod","affected":[{"type":"plugin","slug":"Rey-Core","name":"Rey Core","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-04T15:44:31Z"},{"id":"wordfence:0307dbb7-4f82-429b-9be5-9e7c75603074","source":"wordfence","cve":"CVE-2016-20062","title":"Simply Poll <= 1.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0307dbb7-4f82-429b-9be5-9e7c75603074?source=api-prod","affected":[{"type":"plugin","slug":"simply-poll","name":"simply-poll","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T16:07:09Z"},{"id":"wordfence:030aa435-b9c3-4d82-86ea-ce3d4a266904","source":"wordfence","cve":"CVE-2025-48326","title":"Acclectic Media Organizer <= 1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030aa435-b9c3-4d82-86ea-ce3d4a266904?source=api-prod","affected":[{"type":"plugin","slug":"acclectic-media-organizer","name":"Acclectic Media Organizer","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-10-15T18:14:25Z"},{"id":"wordfence:030b26ac-344f-4919-9d2d-b85e5e1599f6","source":"wordfence","cve":"CVE-2025-68015","title":"Event Tickets with Ticket Scanner <= 2.8.5 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030b26ac-344f-4919-9d2d-b85e5e1599f6?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-01-15T00:00:00Z","updated":"2026-02-12T16:53:58Z"},{"id":"wordfence:030bb667-b8e6-4987-8af2-83cfa4bed8a6","source":"wordfence","cve":"CVE-2026-74019","title":"EPROLO-Dropshipping <= 2.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030bb667-b8e6-4987-8af2-83cfa4bed8a6?source=api-prod","affected":[{"type":"plugin","slug":"eprolo-dropshipping","name":"EPROLO-Dropshipping","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:06:20Z"},{"id":"wordfence:030d4038-cf31-4ad9-a89a-6cf5f6177c2e","source":"wordfence","cve":"CVE-2026-1796","title":"StyleBidet <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030d4038-cf31-4ad9-a89a-6cf5f6177c2e?source=api-prod","affected":[{"type":"plugin","slug":"stylebidet","name":"StyleBidet","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:26:55Z","updated":"2026-02-14T06:42:25Z"},{"id":"wordfence:030d65bb-ec5b-4d26-8f59-5db9a9005ba6","source":"wordfence","cve":"CVE-2026-8837","title":"WP Iframe Geo Style for Amazon affiliates <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030d65bb-ec5b-4d26-8f59-5db9a9005ba6?source=api-prod","affected":[{"type":"plugin","slug":"wp-iframe-geo-style-for-amazon-affiliates","name":"WP Iframe Geo Style for Amazon affiliates","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:53Z","updated":"2026-05-27T05:31:18Z"},{"id":"wordfence:030def71-2949-46d5-a545-f3472433324e","source":"wordfence","cve":"","title":"WP Google Fonts <= 3.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030def71-2949-46d5-a545-f3472433324e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-fonts","name":"WP Google Fonts","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2015-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:030ec6bb-f19d-4145-b3fb-bd647c154666","source":"wordfence","cve":"CVE-2024-32961","title":"Blocksy <= 2.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/030ec6bb-f19d-4145-b3fb-bd647c154666?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.33","to_inclusive":true,"patched_in":"2.0.34"}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T13:43:26Z"},{"id":"wordfence:0311b546-01a4-4be8-97f3-6df6cd79c3fe","source":"wordfence","cve":"CVE-2026-3334","title":"CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0311b546-01a4-4be8-97f3-6df6cd79c3fe?source=api-prod","affected":[{"type":"plugin","slug":"cms-commander-client","name":"CMS Commander \u2013 Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.288","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:31Z","updated":"2026-03-21T03:26:29Z"},{"id":"wordfence:03122c29-4ca5-426a-8240-74ce96dd21f2","source":"wordfence","cve":"CVE-2026-12133","title":"JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03122c29-4ca5-426a-8240-74ce96dd21f2?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2026-06-30T14:47:14Z","updated":"2026-07-01T03:43:34Z"},{"id":"wordfence:03123f2f-1241-445c-8d28-cb02e85795e3","source":"wordfence","cve":"CVE-2024-37563","title":"TOCHAT.BE <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03123f2f-1241-445c-8d28-cb02e85795e3?source=api-prod","affected":[{"type":"plugin","slug":"tochat-be","name":"TOCHAT.BE","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-12T12:33:41Z"},{"id":"wordfence:0312cea9-8205-4d09-874d-aef319d15c65","source":"wordfence","cve":"CVE-2025-47585","title":"Booking and Rental Manager <= 2.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0312cea9-8205-4d09-874d-aef319d15c65?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-28T15:16:30Z"},{"id":"wordfence:0315150d-451b-4a78-8657-793cf901068c","source":"wordfence","cve":"CVE-2025-31434","title":"FormLift for Infusionsoft Web Forms <= 7.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0315150d-451b-4a78-8657-793cf901068c?source=api-prod","affected":[{"type":"plugin","slug":"formlift","name":"FormLift for Keap (Legacy) Web Forms","from":"*","from_inclusive":true,"to":"7.5.19","to_inclusive":true,"patched_in":"7.5.20"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T19:51:36Z"},{"id":"wordfence:03155b4e-a148-4990-8d47-ab77ae7736c5","source":"wordfence","cve":"CVE-2024-6024","title":"ContentLock <= 1.0.3 - Cross-Site Request Forgery to Group/Email Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03155b4e-a148-4990-8d47-ab77ae7736c5?source=api-prod","affected":[{"type":"plugin","slug":"contentlock","name":"ContentLock","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-19T14:12:41Z"},{"id":"wordfence:0315f5de-7a46-4e16-b080-557ddfd180a2","source":"wordfence","cve":"","title":"Moment.js <= 2.29.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0315f5de-7a46-4e16-b080-557ddfd180a2?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03177018-94cb-4e14-9476-e2d369414c38","source":"wordfence","cve":"CVE-2023-50899","title":"Product Catalog Enquiry <= 5.0.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03177018-94cb-4e14-9476-e2d369414c38?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"5.0.3"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0318ec4a-185a-405d-90f8-008ba373114b","source":"wordfence","cve":"CVE-2024-1334","title":"ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0318ec4a-185a-405d-90f8-008ba373114b?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:40:55Z"},{"id":"wordfence:031995fb-48c4-4f56-8b64-d66a47b2fbe9","source":"wordfence","cve":"CVE-2023-50875","title":"Sensei LMS <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/031995fb-48c4-4f56-8b64-d66a47b2fbe9?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:031a1203-6b0d-453b-be8a-12e7f55cb401","source":"wordfence","cve":"CVE-2023-0831","title":"Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/031a1203-6b0d-453b-be8a-12e7f55cb401?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-page","name":"Under Construction","from":"*","from_inclusive":true,"to":"3.96","to_inclusive":true,"patched_in":"3.97"}],"published":"2023-02-10T00:00:00Z","updated":"2024-04-17T13:03:09Z"},{"id":"wordfence:031c2a61-3547-4c33-8ab8-c52585c8066a","source":"wordfence","cve":"","title":"OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/031c2a61-3547-4c33-8ab8-c52585c8066a?source=api-prod","affected":[{"type":"plugin","slug":"openinviter-for-wordpress","name":"OpenInviter for WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2013-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:031c31b2-6e27-47bb-9f63-2bbaa1edbbb2","source":"wordfence","cve":"CVE-2023-41239","title":"PowerPress <= 11.0.6 - Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/031c31b2-6e27-47bb-9f63-2bbaa1edbbb2?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.0.6","to_inclusive":true,"patched_in":"11.0.7"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:031df7ea-b341-40fc-981f-711883f08742","source":"wordfence","cve":"CVE-2025-66129","title":"Pochipp <= 1.18.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/031df7ea-b341-40fc-981f-711883f08742?source=api-prod","affected":[{"type":"plugin","slug":"pochipp","name":"Pochipp","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"}],"published":"2025-12-14T00:00:00Z","updated":"2026-01-06T18:51:26Z"},{"id":"wordfence:03226722-000c-4bfe-a09b-e75882274845","source":"wordfence","cve":"CVE-2026-8905","title":"Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03226722-000c-4bfe-a09b-e75882274845?source=api-prod","affected":[{"type":"plugin","slug":"osiris-signature-banner","name":"Osiris Signature Banner","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:38:47Z","updated":"2026-06-24T05:33:21Z"},{"id":"wordfence:0323b54b-c15b-4d2d-9e8f-3df87c84dd49","source":"wordfence","cve":"CVE-2023-6962","title":"WP Meta SEO <= 4.5.12 - Information Exposure via Meta Description","severity":"medium","cvss":5.3,"cwe":"CWE-1230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0323b54b-c15b-4d2d-9e8f-3df87c84dd49?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"4.5.13"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:35:47Z"},{"id":"wordfence:0324852f-9e19-467c-9b0b-4c9fe2dd1cc0","source":"wordfence","cve":"","title":"WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0324852f-9e19-467c-9b0b-4c9fe2dd1cc0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0324b2d0-9755-4079-b162-40e519bf462a","source":"wordfence","cve":"CVE-2026-18042","title":"Travel <= 12.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0324b2d0-9755-4079-b162-40e519bf462a?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":true,"patched_in":"12.0.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:08:56Z"},{"id":"wordfence:03258713-0a63-4469-ba44-b25998d2411f","source":"wordfence","cve":"CVE-2025-68590","title":"Integration for Contact Form 7 HubSpot <= 1.4.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03258713-0a63-4469-ba44-b25998d2411f?source=api-prod","affected":[{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T19:10:45Z"},{"id":"wordfence:032861f0-9d94-4f6a-a119-eb0e09b20c5d","source":"wordfence","cve":"CVE-2026-5158","title":"PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/032861f0-9d94-4f6a-a119-eb0e09b20c5d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":true,"patched_in":"5.0.14"}],"published":"2026-08-05T22:05:22Z","updated":"2026-08-06T11:29:19Z"},{"id":"wordfence:03288d4e-22cc-4995-a473-9eb0f90b91b2","source":"wordfence","cve":"CVE-2026-12514","title":"Shared Files Pro < 1.7.70 & Shared Files Free < 1.7.67 - Unauthenticated Limited File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03288d4e-22cc-4995-a473-9eb0f90b91b2?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.67","to_inclusive":false,"patched_in":"1.7.67"},{"type":"plugin","slug":"shared-files-pro","name":"Shared Files Pro","from":"*","from_inclusive":true,"to":"1.7.70","to_inclusive":false,"patched_in":"1.7.70"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:05:55Z"},{"id":"wordfence:032e775a-97be-4d93-bac3-094e35be4b11","source":"wordfence","cve":"CVE-2020-36697","title":"WP GDPR <= 2.1.1 - Missing Authorization Checks","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/032e775a-97be-4d93-bac3-094e35be4b11?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-core","name":"WP GDPR","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:032ec7ea-737c-4322-96ba-97d60cd2e08e","source":"wordfence","cve":"CVE-2026-39640","title":"Theme Editor <= 3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/032ec7ea-737c-4322-96ba-97d60cd2e08e?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-14T00:00:00Z","updated":"2026-04-15T21:36:50Z"},{"id":"wordfence:032f3363-83c0-4548-81f0-724a71931add","source":"wordfence","cve":"CVE-2022-41790","title":"WP Time Slots Booking Form <= 1.1.76 - Cross-Site Request Forgery to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/032f3363-83c0-4548-81f0-724a71931add?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.1.76","to_inclusive":true,"patched_in":"1.1.77"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:033069d2-8e0f-4c67-b18c-fdd471d85f87","source":"wordfence","cve":"CVE-2024-1852","title":"WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033069d2-8e0f-4c67-b18c-fdd471d85f87?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.9.2","to_inclusive":true,"patched_in":"3.4.9.3"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-09T18:58:29Z"},{"id":"wordfence:03329efa-6ffd-42e1-ab7e-cc21cb48866f","source":"wordfence","cve":"CVE-2022-0429","title":"WP Cerber Security <= 8.9.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03329efa-6ffd-42e1-ab7e-cc21cb48866f?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"8.9.5.2","to_inclusive":true,"patched_in":"8.9.6"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0332e106-1f97-4c52-b084-ea15d31dee72","source":"wordfence","cve":"CVE-2026-5108","title":"Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0332e106-1f97-4c52-b084-ea15d31dee72?source=api-prod","affected":[{"type":"plugin","slug":"super-progressive-web-apps","name":"Super Progressive Web Apps","from":"*","from_inclusive":true,"to":"2.2.43","to_inclusive":true,"patched_in":"2.2.44"}],"published":"2026-08-04T17:42:58Z","updated":"2026-08-05T06:37:53Z"},{"id":"wordfence:033333b2-58b1-4810-ac25-65f7c8f13a5b","source":"wordfence","cve":"CVE-2025-69374","title":"Eleblog \u2013 Elementor Blog And Magazine Addons <= 2.0.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033333b2-58b1-4810-ac25-65f7c8f13a5b?source=api-prod","affected":[{"type":"plugin","slug":"ele-blog","name":"Eleblog \u2013 Elementor Blog And Magazine Addons","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T20:58:00Z"},{"id":"wordfence:03354f47-ebf7-4242-89d0-1b937d418c6f","source":"wordfence","cve":"CVE-2024-43340","title":"AFI \u2013 The Easiest Integration Plugin <= 1.89.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03354f47-ebf7-4242-89d0-1b937d418c6f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.89.4","to_inclusive":true,"patched_in":"1.89.6"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:10:44Z"},{"id":"wordfence:033a7ca8-a858-4c03-9b7a-266bdf07aa12","source":"wordfence","cve":"CVE-2026-32549","title":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More < 6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033a7ca8-a858-4c03-9b7a-266bdf07aa12?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes","name":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":false,"patched_in":"6.5"}],"published":"2026-08-17T12:54:57Z","updated":"2026-09-02T21:33:55Z"},{"id":"wordfence:033b0f16-02fb-44b9-9e07-2393afe14cc5","source":"wordfence","cve":"CVE-2024-31122","title":"User Rights Access Manager <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033b0f16-02fb-44b9-9e07-2393afe14cc5?source=api-prod","affected":[{"type":"plugin","slug":"user-rights-access-manager","name":"User Rights Access Manager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:09:37Z"},{"id":"wordfence:033c0088-9562-46ee-9916-11a29162529b","source":"wordfence","cve":"CVE-2025-69353","title":"Proxy & VPN Blocker <= 3.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033c0088-9562-46ee-9916-11a29162529b?source=api-prod","affected":[{"type":"plugin","slug":"proxy-vpn-blocker","name":"Proxy & VPN Blocker","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-14T14:55:10Z"},{"id":"wordfence:033e8326-38ed-4d36-8a29-06f9c8a5e808","source":"wordfence","cve":"CVE-2026-27542","title":"Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033e8326-38ed-4d36-8a29-06f9c8a5e808?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-lead-capture","name":"Wholesale Lead Capture Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3.1","to_inclusive":true,"patched_in":"2.0.3.2"}],"published":"2026-02-20T00:00:00Z","updated":"2026-02-27T15:05:27Z"},{"id":"wordfence:033e9370-368d-4ffa-be6d-3a75e62aa86f","source":"wordfence","cve":"CVE-2026-81346","title":"Frontend Admin by DynamiApps < 3.29.11 - Authenticated (Subscriber+) Membership Plan Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033e9370-368d-4ffa-be6d-3a75e62aa86f?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.11","to_inclusive":false,"patched_in":"3.29.11"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:46:03Z"},{"id":"wordfence:033f8b21-6c5a-433f-b60d-5509fb203234","source":"wordfence","cve":"CVE-2025-49912","title":"Email Subscription Popup <= 1.2.26 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/033f8b21-6c5a-433f-b60d-5509fb203234?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.26","to_inclusive":true,"patched_in":"1.2.27"}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-29T14:37:44Z"},{"id":"wordfence:03412063-d73a-4c5c-8dc6-3e76a5d975a5","source":"wordfence","cve":"CVE-2026-93754","title":"payever \u2013 WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03412063-d73a-4c5c-8dc6-3e76a5d975a5?source=api-prod","affected":[{"type":"plugin","slug":"payever-woocommerce-gateway","name":"payever Checkout \u2013 Composable Payment Gateway","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2026-11-06T14:23:22Z","updated":"2026-11-07T02:29:10Z"},{"id":"wordfence:034246b2-e123-480d-afaf-cce9d42f1f03","source":"wordfence","cve":"CVE-2021-39342","title":"Credova_Financial <= 1.4.8 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034246b2-e123-480d-afaf-cce9d42f1f03?source=api-prod","affected":[{"type":"plugin","slug":"credova-financial","name":"Credova Financial","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2021-09-29T16:39:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03444a33-f1ad-439f-ae19-4013859959f0","source":"wordfence","cve":"CVE-2025-27289","title":"Restrict Taxonomies <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03444a33-f1ad-439f-ae19-4013859959f0?source=api-prod","affected":[{"type":"plugin","slug":"restrict-taxonomies","name":"Restrict Taxonomies","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:38:45Z"},{"id":"wordfence:0344f49b-f5f9-4729-ade0-cba6289406de","source":"wordfence","cve":"CVE-2025-14162","title":"BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0344f49b-f5f9-4729-ade0-cba6289406de?source=api-prod","affected":[{"type":"plugin","slug":"bmlt-wordpress-satellite-plugin","name":"BMLT WordPress Satellite","from":"*","from_inclusive":true,"to":"3.11.4","to_inclusive":true,"patched_in":"3.11.5"}],"published":"2025-12-11T14:28:25Z","updated":"2026-07-10T15:19:22Z"},{"id":"wordfence:0346d69e-49f3-4269-9cae-733691a7d11d","source":"wordfence","cve":"CVE-2025-26754","title":"Timeline Block <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0346d69e-49f3-4269-9cae-733691a7d11d?source=api-prod","affected":[{"type":"plugin","slug":"timeline-block-block","name":"Timeline Block \u2013 tell your story with elegant timelines","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:10:18Z"},{"id":"wordfence:0348d465-f351-4c52-b293-8b3b058292b9","source":"wordfence","cve":"CVE-2024-0618","title":"Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0348d465-f351-4c52-b293-8b3b058292b9?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2024-01-18T00:00:00Z","updated":"2024-07-29T21:35:47Z"},{"id":"wordfence:034ba83f-4ee3-40f1-a41a-8b3d0055a1ba","source":"wordfence","cve":"CVE-2025-1463","title":"Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034ba83f-4ee3-40f1-a41a-8b3d0055a1ba?source=api-prod","affected":[{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2025-03-04T22:06:29Z","updated":"2025-03-05T11:22:10Z"},{"id":"wordfence:034bb19b-1ee6-4ded-b907-a3f182745e67","source":"wordfence","cve":"CVE-2024-37101","title":"WP Post Author <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034bb19b-1ee6-4ded-b907-a3f182745e67?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T17:06:38Z"},{"id":"wordfence:034c38e3-98b7-4c31-8d43-981b1ba2ad22","source":"wordfence","cve":"CVE-2025-58641","title":"Exit Intent Popup <= 1.0.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034c38e3-98b7-4c31-8d43-981b1ba2ad22?source=api-prod","affected":[{"type":"plugin","slug":"exitintentpopup","name":"Exit Intent Popup","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:34:56Z"},{"id":"wordfence:034d3d52-cb77-40dd-85a1-81ca3bfd1f23","source":"wordfence","cve":"CVE-2024-11761","title":"LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034d3d52-cb77-40dd-85a1-81ca3bfd1f23?source=api-prod","affected":[{"type":"plugin","slug":"legalweb-cloud","name":"LegalWeb Cloud","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:20Z"},{"id":"wordfence:034e77ef-fb3f-4e62-be1b-c56c454c5ba8","source":"wordfence","cve":"CVE-2022-0642","title":"JivoChat Live Chat \u2013 WP live chat plugin for WordPress <= 1.3.5.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034e77ef-fb3f-4e62-be1b-c56c454c5ba8?source=api-prod","affected":[{"type":"plugin","slug":"jivochat","name":"JivoChat Live Chat \u2013 WP live chat plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.5.3","to_inclusive":true,"patched_in":"1.3.5.4"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:034ea306-148f-4a67-abac-a2c6a280745c","source":"wordfence","cve":"CVE-2025-25109","title":"WP Vehicle Manager <= 3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/034ea306-148f-4a67-abac-a2c6a280745c?source=api-prod","affected":[{"type":"plugin","slug":"js-vehicle-manager","name":"WP Vehicle Manager","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:50:55Z"},{"id":"wordfence:035097dd-8ebd-49b8-93ea-0f957594f130","source":"wordfence","cve":"CVE-2025-10496","title":"Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/035097dd-8ebd-49b8-93ea-0f957594f130?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-consent","name":"Cookie Notice & Consent","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-10-08T13:55:37Z","updated":"2025-10-09T02:09:53Z"},{"id":"wordfence:03509ba4-1e92-425d-9d2a-4e5bd96b6340","source":"wordfence","cve":"CVE-2023-54358","title":"Travel & Tours Meta Search <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03509ba4-1e92-425d-9d2a-4e5bd96b6340?source=api-prod","affected":[{"type":"plugin","slug":"adiaha-hotel","name":"Travel & Tours Meta Search","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-09T00:00:00Z","updated":"2026-07-29T21:34:52Z"},{"id":"wordfence:03542812-b6e5-421d-9ba6-43f1c779940f","source":"wordfence","cve":"CVE-2026-16597","title":"GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03542812-b6e5-421d-9ba6-43f1c779940f?source=api-prod","affected":[{"type":"plugin","slug":"duracelltomi-google-tag-manager","name":"GTM4WP \u2013 A Google Tag Manager (GTM) plugin for WordPress","from":"*","from_inclusive":true,"to":"1.22.3","to_inclusive":true,"patched_in":"1.22.4"}],"published":"2026-07-28T20:33:08Z","updated":"2026-09-10T18:12:35Z"},{"id":"wordfence:03564cae-df90-454b-8379-6ad9f22b7389","source":"wordfence","cve":"CVE-2024-2185","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03564cae-df90-454b-8379-6ad9f22b7389?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-11-15T13:07:06Z"},{"id":"wordfence:0358d8f8-f7fd-487e-b75c-08e1cfdeeeec","source":"wordfence","cve":"CVE-2024-43207","title":"Unite Gallery Lite <= 1.7.62 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0358d8f8-f7fd-487e-b75c-08e1cfdeeeec?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.7.62","to_inclusive":true,"patched_in":""}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:41:47Z"},{"id":"wordfence:0359434b-9d88-4a40-8e9f-ec354c8de816","source":"wordfence","cve":"CVE-2023-1068","title":"Download Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0359434b-9d88-4a40-8e9f-ec354c8de816?source=api-prod","affected":[{"type":"plugin","slug":"read-more-excerpt-link","name":"Read More Excerpt Link","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:035ada56-541d-47b3-8348-3401d94bb509","source":"wordfence","cve":"CVE-2024-4787","title":"Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/035ada56-541d-47b3-8348-3401d94bb509?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"3.1.75","to_inclusive":true,"patched_in":"3.1.76"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T03:20:12Z"},{"id":"wordfence:035d5f4a-1145-48e0-8388-e319088ebd52","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in admin_widgets_welcome function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/035d5f4a-1145-48e0-8388-e319088ebd52?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:035d9433-08db-4849-aae3-735be9f82f52","source":"wordfence","cve":"CVE-2023-7233","title":"GigPress <= 2.3.29 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/035d9433-08db-4849-aae3-735be9f82f52?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.29","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-03-22T17:32:48Z"},{"id":"wordfence:035f2be6-6c20-4f61-8302-bf36df633c80","source":"wordfence","cve":"CVE-2026-40737","title":"COMPE <= 1.1.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/035f2be6-6c20-4f61-8302-bf36df633c80?source=api-prod","affected":[{"type":"plugin","slug":"compe-woo-compare-products","name":"COMPE \u2013 WooCommerce Compare Products","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-03-14T00:00:00Z","updated":"2026-05-12T14:02:00Z"},{"id":"wordfence:0360c5d9-5534-4f6c-9b54-61c09a5d76f5","source":"wordfence","cve":"CVE-2025-63049","title":"ListingPro Lead Form <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0360c5d9-5534-4f6c-9b54-61c09a5d76f5?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-lead-form","name":"ListingPro Lead Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-12-11T16:29:33Z"},{"id":"wordfence:0360ec6f-8a26-4499-ba62-0254e63a23ba","source":"wordfence","cve":"CVE-2026-32342","title":"Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0360ec6f-8a26-4499-ba62-0254e63a23ba?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.1.2","to_inclusive":true,"patched_in":"6.7.1.3"}],"published":"2026-02-10T00:00:00Z","updated":"2026-04-15T21:02:19Z"},{"id":"wordfence:03623f00-2c3c-4590-92fe-a5eaac15b944","source":"wordfence","cve":"CVE-2024-13377","title":"GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03623f00-2c3c-4590-92fe-a5eaac15b944?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.1.3","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T09:36:40Z"},{"id":"wordfence:036467de-95bb-4bfd-9522-df8dc17f3102","source":"wordfence","cve":"CVE-2025-14675","title":"Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.11.2"}],"published":"2026-03-06T19:09:12Z","updated":"2026-03-07T07:22:03Z"},{"id":"wordfence:0368ec17-107c-476c-9627-b6a7ebc3c365","source":"wordfence","cve":"CVE-2026-66447","title":"Iptanus File Upload <= 5.1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0368ec17-107c-476c-9627-b6a7ebc3c365?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:03:04Z"},{"id":"wordfence:036cf299-80c2-48a8-befc-02899ab96e3c","source":"wordfence","cve":"CVE-2024-1055","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/036cf299-80c2-48a8-befc-02899ab96e3c?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.14","to_inclusive":true,"patched_in":"2.7.15"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T06:46:56Z"},{"id":"wordfence:03721b29-7b26-4166-bba1-81614b412a09","source":"wordfence","cve":"CVE-2026-15097","title":"Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03721b29-7b26-4166-bba1-81614b412a09?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.7.6","to_inclusive":true,"patched_in":"7.7.7"}],"published":"2026-07-10T15:31:43Z","updated":"2026-07-11T03:44:21Z"},{"id":"wordfence:03725477-7d7b-4ec9-8b9f-5ce9f8905243","source":"wordfence","cve":"CVE-2024-6584","title":"Jetpack Boost <= 3.4.6 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03725477-7d7b-4ec9-8b9f-5ce9f8905243?source=api-prod","affected":[{"type":"plugin","slug":"jetpack-boost","name":"Jetpack Boost \u2013 Website Speed, Performance and Critical CSS","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-01T20:04:58Z"},{"id":"wordfence:0372efe4-b5be-4601-be43-5c12332ea1a5","source":"wordfence","cve":"CVE-2023-2447","title":"UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0372efe4-b5be-4601-be43-5c12332ea1a5?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03733eb8-63c7-4798-9d87-e80a6112da6e","source":"wordfence","cve":"","title":"Daily Inspiration Generator <= 2.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03733eb8-63c7-4798-9d87-e80a6112da6e?source=api-prod","affected":[{"type":"plugin","slug":"daily-inspiration-generator","name":"Daily Inspiration Generator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03774303-c9f4-4666-ac88-78f92aaf81dc","source":"wordfence","cve":"CVE-2025-6792","title":"One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03774303-c9f4-4666-ac88-78f92aaf81dc?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-02-13T18:16:35Z","updated":"2026-09-18T19:53:32Z"},{"id":"wordfence:037882e8-4d66-47b9-8ca5-3fa3866b9125","source":"wordfence","cve":"","title":"ND Shortcodes <= 6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037882e8-4d66-47b9-8ca5-3fa3866b9125?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.6"}],"published":"2022-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:037a8b06-18be-4443-b54c-22f50c89d5b4","source":"wordfence","cve":"CVE-2016-10887","title":"All In One WP Security & Firewall <= 4.0.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037a8b06-18be-4443-b54c-22f50c89d5b4?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":false,"patched_in":"4.0.9"}],"published":"2019-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:037ac32a-dc2e-4e9f-9318-65dfee1c80e9","source":"wordfence","cve":"CVE-2025-13694","title":"AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037ac32a-dc2e-4e9f-9318-65dfee1c80e9?source=api-prod","affected":[{"type":"plugin","slug":"aa-block-country","name":"AA Block country","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:30:39Z","updated":"2026-01-07T09:20:51Z"},{"id":"wordfence:037b5c2c-510a-4fa5-b489-cb0478603be2","source":"wordfence","cve":"CVE-2026-0739","title":"WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037b5c2c-510a-4fa5-b489-cb0478603be2?source=api-prod","affected":[{"type":"plugin","slug":"wmf-mobile-redirector","name":"WMF Mobile Redirector","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:31:04Z","updated":"2026-01-14T06:40:04Z"},{"id":"wordfence:037b846f-3777-43ce-9895-b17203a4cbab","source":"wordfence","cve":"CVE-2025-67466","title":"Trinity Audio <= 5.23.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037b846f-3777-43ce-9895-b17203a4cbab?source=api-prod","affected":[{"type":"plugin","slug":"trinity-audio","name":"Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio","from":"*","from_inclusive":true,"to":"5.23.3","to_inclusive":true,"patched_in":"5.24"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T17:27:24Z"},{"id":"wordfence:037f09f2-edd8-40d7-8d1a-98d2638995c5","source":"wordfence","cve":"CVE-2026-111949","title":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037f09f2-edd8-40d7-8d1a-98d2638995c5?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"6.2.9","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:30:36Z"},{"id":"wordfence:037ff4f5-7855-43e8-af25-9a0fcd5f0b64","source":"wordfence","cve":"CVE-2023-23977","title":"WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/037ff4f5-7855-43e8-af25-9a0fcd5f0b64?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-comments","name":"Social Comments by Heateor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0386ed09-296d-4f33-9fe0-964c0c0a9652","source":"wordfence","cve":"CVE-2025-7955","title":"RingCentral Communications 1.5 - 1.6.8 - Missing Server\u2011Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0386ed09-296d-4f33-9fe0-964c0c0a9652?source=api-prod","affected":[{"type":"plugin","slug":"rccp-free","name":"RingCentral Communications Plugin \u2013 FREE","from":"1.5","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-08-27T16:25:29Z","updated":"2025-08-28T05:24:51Z"},{"id":"wordfence:038742d8-3da9-4e2a-bbd4-9ed6b31e8767","source":"wordfence","cve":"CVE-2023-49816","title":"Fix My Feed RSS Repair <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/038742d8-3da9-4e2a-bbd4-9ed6b31e8767?source=api-prod","affected":[{"type":"plugin","slug":"fix-my-feed-rss-repair","name":"Fix My Feed RSS Repair","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0388853e-4bf8-4627-876a-b842e7016de3","source":"wordfence","cve":"CVE-2022-3904","title":"MonsterInsights <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via Google Analytics","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0388853e-4bf8-4627-876a-b842e7016de3?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:038d1144-81b8-4e4b-b0d5-60516f02dbdf","source":"wordfence","cve":"CVE-2023-0262","title":"WP Airbnb Review Slider <= 3.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/038d1144-81b8-4e4b-b0d5-60516f02dbdf?source=api-prod","affected":[{"type":"plugin","slug":"wp-airbnb-review-slider","name":"WP Airbnb Review Slider","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:038ddfcd-093b-4234-a0b8-a3bf9a3d329f","source":"wordfence","cve":"CVE-2025-4689","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/038ddfcd-093b-4234-a0b8-a3bf9a3d329f?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:53:27Z","updated":"2025-07-02T03:47:22Z"},{"id":"wordfence:038deaeb-633f-49de-92d8-e593ceb47b1e","source":"wordfence","cve":"CVE-2026-32520","title":"RewardsWP \u2013 Loyalty Points & Referral Program for WooCommerce <= 1.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/038deaeb-633f-49de-92d8-e593ceb47b1e?source=api-prod","affected":[{"type":"plugin","slug":"rewardswp","name":"RewardsWP \u2013 Loyalty Points & Referral Program for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:11:21Z"},{"id":"wordfence:038e8775-aa53-4e45-ba4c-52ef169943ab","source":"wordfence","cve":"CVE-2026-82194","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/038e8775-aa53-4e45-ba4c-52ef169943ab?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.134","to_inclusive":false,"patched_in":"0.9.134"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:47:13Z"},{"id":"wordfence:0391145a-2707-4639-80d0-a8a98512ef66","source":"wordfence","cve":"CVE-2026-103479","title":"Pubjet | \u067e\u0627\u0628\u200c\u062c\u062a <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action","severity":"high","cvss":7.6,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0391145a-2707-4639-80d0-a8a98512ef66?source=api-prod","affected":[{"type":"plugin","slug":"pubjet","name":"Pubjet | \u067e\u0627\u0628\u200c\u062c\u062a","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-05T22:00:19Z","updated":"2026-11-06T11:17:35Z"},{"id":"wordfence:03918e5e-6bcd-493e-ba16-3875806a11fc","source":"wordfence","cve":"CVE-2026-92436","title":"Mailchimp for WooCommerce <= 6.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03918e5e-6bcd-493e-ba16-3875806a11fc?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:44:55Z"},{"id":"wordfence:039223cd-14c3-4ae8-89f8-4b24209cf248","source":"wordfence","cve":"CVE-2026-110039","title":"Smush <= 4.3.3 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039223cd-14c3-4ae8-89f8-4b24209cf248?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:31:21Z"},{"id":"wordfence:03926855-d2cc-4105-9927-5871002cb7a0","source":"wordfence","cve":"CVE-2021-24647","title":"Pie Register <= 3.7.1.5 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03926855-d2cc-4105-9927-5871002cb7a0?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":false,"patched_in":"3.7.1.6"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0394e4a9-28dc-4e20-8bc3-ed486172dcb8","source":"wordfence","cve":"CVE-2025-67528","title":"Urna <= 2.5.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0394e4a9-28dc-4e20-8bc3-ed486172dcb8?source=api-prod","affected":[{"type":"theme","slug":"urna","name":"Urna - All-in-one WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.12","to_inclusive":true,"patched_in":"2.5.13"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T16:59:21Z"},{"id":"wordfence:03956922-988a-4cb6-bf20-51878a5b1555","source":"wordfence","cve":"CVE-2026-1902","title":"Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03956922-988a-4cb6-bf20-51878a5b1555?source=api-prod","affected":[{"type":"plugin","slug":"hammas-calendar","name":"Hammas Calendar","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.5.12"}],"published":"2026-03-06T11:23:32Z","updated":"2026-03-07T01:21:21Z"},{"id":"wordfence:0395b775-a89d-45f5-ac38-d5786f4b4d1b","source":"wordfence","cve":"CVE-2015-2260","title":"Gravityforms <= 1.9.3.5 - SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0395b775-a89d-45f5-ac38-d5786f4b4d1b?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"1.9.3.5","to_inclusive":true,"patched_in":"1.9.3.6"}],"published":"2015-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:039641fe-820b-464f-a859-ba2b0ebd5844","source":"wordfence","cve":"CVE-2026-57401","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039641fe-820b-464f-a859-ba2b0ebd5844?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:16:30Z"},{"id":"wordfence:03986638-6fdb-4fa9-876c-fb6e90da38ea","source":"wordfence","cve":"CVE-2026-49778","title":"WPFunnels Pro <= 2.9.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03986638-6fdb-4fa9-876c-fb6e90da38ea?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels-pro","name":"WPFunnels Pro","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:54:27Z"},{"id":"wordfence:039a9e3d-0e88-4eae-9537-58682aaf7b10","source":"wordfence","cve":"CVE-2024-54253","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039a9e3d-0e88-4eae-9537-58682aaf7b10?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.6.5","to_inclusive":true,"patched_in":"1.4.6.6"}],"published":"2024-12-05T00:00:00Z","updated":"2025-02-11T20:42:30Z"},{"id":"wordfence:039ac1d9-ccb5-43d0-8b17-10d12b7df90e","source":"wordfence","cve":"CVE-2024-47302","title":"Fluent Support <= 1.8.0 - Insufficient Authorization on Email Verification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039ac1d9-ccb5-43d0-8b17-10d12b7df90e?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:40:44Z"},{"id":"wordfence:039b7dcc-fad6-4bc1-b0f9-7e888eb54412","source":"wordfence","cve":"CVE-2022-3860","title":"Visual Email Designer for WooCommerce <= 1.7.1 - Authenticated (Author+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039b7dcc-fad6-4bc1-b0f9-7e888eb54412?source=api-prod","affected":[{"type":"plugin","slug":"email-customizer-woocommerce","name":"Smackcoders \u2013 Email Template Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:039d2a35-fbd9-467b-ae98-2d47ff03fb2e","source":"wordfence","cve":"CVE-2022-47604","title":"AJAX Thumbnail Rebuild <= 1.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/039d2a35-fbd9-467b-ae98-2d47ff03fb2e?source=api-prod","affected":[{"type":"plugin","slug":"ajax-thumbnail-rebuild","name":"AJAX Thumbnail Rebuild","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03a1724c-8fea-4e9f-a4a1-9de236e1f15a","source":"wordfence","cve":"CVE-2022-46804","title":"Export Users Data Distinct <= 1.3 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03a1724c-8fea-4e9f-a4a1-9de236e1f15a?source=api-prod","affected":[{"type":"plugin","slug":"export-users-data-distinct","name":"Export Users Data Distinct","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-10-24T18:29:21Z"},{"id":"wordfence:03a37831-18cb-4e83-8f7d-e584160bd59a","source":"wordfence","cve":"CVE-2026-62046","title":"Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03a37831-18cb-4e83-8f7d-e584160bd59a?source=api-prod","affected":[{"type":"theme","slug":"gutentype","name":"Gutentype | 100% Gutenberg Blog Theme + Elementor","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:52:41Z","updated":"2026-10-13T13:58:24Z"},{"id":"wordfence:03a64a72-6643-4747-a916-000197cc2794","source":"wordfence","cve":"CVE-2024-3368","title":"All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03a64a72-6643-4747-a916-000197cc2794?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1.1"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-17T08:34:01Z"},{"id":"wordfence:03a96b11-ffda-40a9-897e-657847fc0d40","source":"wordfence","cve":"CVE-2025-23949","title":"Improved Sale Badges \u2013 Free Version <= 1.0.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03a96b11-ffda-40a9-897e-657847fc0d40?source=api-prod","affected":[{"type":"plugin","slug":"improved-sale-badges-free-version","name":"Improved Sale Badges \u2013 Free Version","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:37:03Z"},{"id":"wordfence:03abb277-d658-440a-a7f7-34d80d8d1cd6","source":"wordfence","cve":"CVE-2025-66153","title":"Headinger for Elementor <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03abb277-d658-440a-a7f7-34d80d8d1cd6?source=api-prod","affected":[{"type":"plugin","slug":"headinger-elementor","name":"Customizable heading for Elementor","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:49:16Z"},{"id":"wordfence:03ad3677-1b02-4f22-af50-e88b2ec83f54","source":"wordfence","cve":"CVE-2024-6011","title":"Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ad3677-1b02-4f22-af50-e88b2ec83f54?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T09:32:09Z"},{"id":"wordfence:03aed95b-26a1-4903-b5aa-35abc889295d","source":"wordfence","cve":"CVE-2025-68993","title":"Share, Print and PDF Products for WooCommerce <= 3.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03aed95b-26a1-4903-b5aa-35abc889295d?source=api-prod","affected":[{"type":"plugin","slug":"share-print-pdf-woocommerce","name":"Share, Print and PDF Products for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-06T15:29:20Z"},{"id":"wordfence:03afffcc-02fe-4054-8876-6a4e4d9de071","source":"wordfence","cve":"CVE-2024-12555","title":"SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03afffcc-02fe-4054-8876-6a4e4d9de071?source=api-prod","affected":[{"type":"plugin","slug":"sip-calculator","name":"SIP Calculator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:57:16Z","updated":"2024-12-14T04:23:37Z"},{"id":"wordfence:03b1376e-8ef3-4bd2-904b-6819aa21d144","source":"wordfence","cve":"","title":"Computer Repair Shop < 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b1376e-8ef3-4bd2-904b-6819aa21d144?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2020-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03b1d518-0e5d-4c28-af04-52611ad583a8","source":"wordfence","cve":"CVE-2025-11269","title":"Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b1d518-0e5d-4c28-af04-52611ad583a8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-10-24T17:28:32Z","updated":"2025-10-25T05:31:18Z"},{"id":"wordfence:03b37c90-4bb5-4003-a440-3fb57a5c1cae","source":"wordfence","cve":"CVE-2024-3648","title":"ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b37c90-4bb5-4003-a440-3fb57a5c1cae?source=api-prod","affected":[{"type":"plugin","slug":"sharethis-share-buttons","name":"ShareThis Share Buttons","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-31T15:30:04Z"},{"id":"wordfence:03b88862-012a-4dc6-9abb-99dc0d9408fd","source":"wordfence","cve":"CVE-2024-10399","title":"Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b88862-012a-4dc6-9abb-99dc0d9408fd?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":true,"patched_in":"5.0.14"}],"published":"2024-10-29T17:11:06Z","updated":"2024-10-30T05:32:14Z"},{"id":"wordfence:03b8b5a2-979d-42d0-86f5-48ee73162d22","source":"wordfence","cve":"CVE-2024-10045","title":"Transients Manager <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b8b5a2-979d-42d0-86f5-48ee73162d22?source=api-prod","affected":[{"type":"plugin","slug":"transients-manager","name":"Transients Manager","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-10-22T19:33:35Z","updated":"2024-10-23T07:34:53Z"},{"id":"wordfence:03b9187e-022a-48c1-a79c-c4629357de5a","source":"wordfence","cve":"CVE-2017-1002005","title":"DTracker <= 1.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03b9187e-022a-48c1-a79c-c4629357de5a?source=api-prod","affected":[{"type":"plugin","slug":"dtracker","name":"DTracker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03be4344-d388-4357-8a2e-c3b9c8b83017","source":"wordfence","cve":"","title":"e-signature < 1.5.6.8 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03be4344-d388-4357-8a2e-c3b9c8b83017?source=api-prod","affected":[{"type":"plugin","slug":"e-signature","name":"e-signature","from":"*","from_inclusive":true,"to":"1.5.6.8","to_inclusive":false,"patched_in":"1.5.6.8"}],"published":"2021-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03bf84e2-c101-416d-a953-c63ecd1dba7d","source":"wordfence","cve":"CVE-2023-0156","title":"All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03bf84e2-c101-416d-a953-c63ecd1dba7d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03c00601-5272-4c94-b248-62958c013d36","source":"wordfence","cve":"CVE-2026-22511","title":"NeoBeat <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c00601-5272-4c94-b248-62958c013d36?source=api-prod","affected":[{"type":"theme","slug":"neobeat","name":"NeoBeat - Music WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-03-06T00:00:00Z","updated":"2026-04-15T13:40:52Z"},{"id":"wordfence:03c0e3c8-9566-48ea-909f-08cdff422473","source":"wordfence","cve":"CVE-2024-13865","title":"S3Player \u2013 WooCommerce & Elementor Integration <= 4.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c0e3c8-9566-48ea-909f-08cdff422473?source=api-prod","affected":[{"type":"plugin","slug":"drm-protected-video-streaming","name":"S3Player \u2013 WooCommerce & Elementor Integration","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-26T00:00:00Z","updated":"2025-05-29T18:48:52Z"},{"id":"wordfence:03c2d0d4-e33e-4b12-9e84-ae6b7b6c3fe2","source":"wordfence","cve":"CVE-2025-58925","title":"Neptunus <= 1.0.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c2d0d4-e33e-4b12-9e84-ae6b7b6c3fe2?source=api-prod","affected":[{"type":"theme","slug":"neptunus","name":"Neptunus - Water & Amusement Park WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:31:51Z"},{"id":"wordfence:03c51b09-c304-488d-9405-0304597a7b97","source":"wordfence","cve":"CVE-2026-15383","title":"Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c51b09-c304-488d-9405-0304597a7b97?source=api-prod","affected":[{"type":"plugin","slug":"blog-floating-button","name":"Blog Floating Button","from":"*","from_inclusive":true,"to":"1.4.20","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:15:27Z"},{"id":"wordfence:03c5f9c6-3346-43fc-beb3-d0269b5599d1","source":"wordfence","cve":"CVE-2024-13522","title":"magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c5f9c6-3346-43fc-beb3-d0269b5599d1?source=api-prod","affected":[{"type":"plugin","slug":"magayo-lottery-results","name":"magayo Lottery Results","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:52:40Z","updated":"2025-02-18T04:21:12Z"},{"id":"wordfence:03c76e61-f263-459f-8618-7565225467e8","source":"wordfence","cve":"CVE-2024-11788","title":"StreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c76e61-f263-459f-8618-7565225467e8?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-youtube-integration","name":"StreamWeasels YouTube Integration","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:20Z"},{"id":"wordfence:03c8a13e-7484-40f1-907f-f3a5ace9f7e9","source":"wordfence","cve":"CVE-2024-30495","title":"Falang multilanguage <= 1.3.47 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c8a13e-7484-40f1-907f-f3a5ace9f7e9?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.47","to_inclusive":true,"patched_in":"1.3.48"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:59:05Z"},{"id":"wordfence:03c8ec0a-f75f-450f-86e7-a18dfbae9461","source":"wordfence","cve":"CVE-2023-25464","title":"Twitch Player <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c8ec0a-f75f-450f-86e7-a18dfbae9461?source=api-prod","affected":[{"type":"plugin","slug":"ttv-easy-embed-player","name":"Twitch Player","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2023-02-13T00:00:00Z","updated":"2026-03-27T10:39:35Z"},{"id":"wordfence:03c9e4c4-c680-474e-b172-d34d3eba2183","source":"wordfence","cve":"CVE-2023-27629","title":"Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03c9e4c4-c680-474e-b172-d34d3eba2183?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03cb41d2-67c8-457f-8d85-7aede8e12d44","source":"wordfence","cve":"CVE-2026-1246","title":"ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03cb41d2-67c8-457f-8d85-7aede8e12d44?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2026-02-04T18:35:26Z","updated":"2026-02-05T06:47:43Z"},{"id":"wordfence:03ccd474-42f4-4cbb-823e-93fe4db1bf80","source":"wordfence","cve":"CVE-2022-4100","title":"WP Cerber Security <= 9.4 - IP Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ccd474-42f4-4cbb-823e-93fe4db1bf80?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"9.4","to_inclusive":true,"patched_in":"9.5"}],"published":"2024-08-30T00:00:00Z","updated":"2024-08-31T08:35:16Z"},{"id":"wordfence:03cd1f6e-2400-44e7-b2b0-32c9890e1c1b","source":"wordfence","cve":"CVE-2022-43463","title":"Custom Product Tabs for WooCommerce <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03cd1f6e-2400-44e7-b2b0-32c9890e1c1b?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-custom-woocommerce-product-tabs","name":"Custom Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03d01f06-de18-45cd-9915-7529a1cf2e66","source":"wordfence","cve":"CVE-2026-105885","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d01f06-de18-45cd-9915-7529a1cf2e66?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.62","to_inclusive":true,"patched_in":"1.2.63"}],"published":"2026-10-08T13:04:26Z","updated":"2026-10-13T13:56:15Z"},{"id":"wordfence:03d02297-0cc6-4935-b282-9b95d8292954","source":"wordfence","cve":"CVE-2021-24600","title":"WP Dialog <= 1.2.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d02297-0cc6-4935-b282-9b95d8292954?source=api-prod","affected":[{"type":"plugin","slug":"wp-dialog","name":"WP Dialog","from":"*","from_inclusive":true,"to":"1.2.5.5","to_inclusive":true,"patched_in":""}],"published":"2021-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03d05c74-da50-4175-86f5-f39a89dbffd4","source":"wordfence","cve":"CVE-2023-27925","title":"VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Post","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d05c74-da50-4175-86f5-f39a89dbffd4?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks-pro","name":"VK Blocks Pro","from":"*","from_inclusive":true,"to":"1.53.0.1","to_inclusive":true,"patched_in":"1.54.0"},{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.53.0.1","to_inclusive":true,"patched_in":"1.54.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03d3f47d-4e17-46a9-a937-9222d3ebcde5","source":"wordfence","cve":"CVE-2026-16594","title":"Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d3f47d-4e17-46a9-a937-9222d3ebcde5?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:41:44Z"},{"id":"wordfence:03d50486-2546-4d59-9e20-2e692046a176","source":"wordfence","cve":"CVE-2025-28881","title":"Mobile Themes <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d50486-2546-4d59-9e20-2e692046a176?source=api-prod","affected":[{"type":"plugin","slug":"wp-mobile-themes","name":"WordPress Mobile Themes","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:23:15Z"},{"id":"wordfence:03d5c82e-f82f-4156-bb3e-e6eb365a6c36","source":"wordfence","cve":"CVE-2026-2355","title":"My Calendar \u2013 Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d5c82e-f82f-4156-bb3e-e6eb365a6c36?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2026-03-03T22:33:52Z","updated":"2026-03-04T11:22:36Z"},{"id":"wordfence:03d89a2d-51e5-420c-9a57-2999a30a9d16","source":"wordfence","cve":"CVE-2024-54309","title":"PostBox <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Log Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d89a2d-51e5-420c-9a57-2999a30a9d16?source=api-prod","affected":[{"type":"plugin","slug":"postbox-email-logs","name":"WP Email Log \u2013 PostBox","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:59:11Z"},{"id":"wordfence:03d8b8e7-5702-42d4-8cd9-ae3ff1a74a7e","source":"wordfence","cve":"","title":"Zero Spam for WordPress <= 5.4.4 - Authenticated(Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03d8b8e7-5702-42d4-8cd9-ae3ff1a74a7e?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":false,"patched_in":"5.4.5"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03ddef11-04cb-4639-afb0-f123b339b9ae","source":"wordfence","cve":"","title":"All in One SEO <= 2.2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ddef11-04cb-4639-afb0-f123b339b9ae?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.2.6.2","to_inclusive":false,"patched_in":"2.2.6.2"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03e23a91-530b-44c6-be54-04cbf35a8cda","source":"wordfence","cve":"CVE-2024-43305","title":"Custom Layouts \u2013 Post + Product grids made easy <= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e23a91-530b-44c6-be54-04cbf35a8cda?source=api-prod","affected":[{"type":"plugin","slug":"custom-layouts","name":"Custom Layouts \u2013 Post + Product grids made easy","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:59:37Z"},{"id":"wordfence:03e6fa1d-0d6a-43e9-97ff-da874a51474a","source":"wordfence","cve":"CVE-2022-0233","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 4.7.4 - Stored Cross-Site Scripting via Profile","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e6fa1d-0d6a-43e9-97ff-da874a51474a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.7"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03e845c0-5845-4d74-88e6-376c703b6145","source":"wordfence","cve":"CVE-2026-57804","title":"TheGem Theme Elements <= 5.11.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e845c0-5845-4d74-88e6-376c703b6145?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:34:36Z"},{"id":"wordfence:03e853be-510f-4957-a227-17ca9f825b12","source":"wordfence","cve":"CVE-2026-18351","title":"Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-for-elementor-forms","name":"Drag and Drop File Upload for Elementor Forms","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-09T12:51:01Z","updated":"2026-09-10T01:26:56Z"},{"id":"wordfence:03e96aea-30a2-4cd3-8967-52e1870cc293","source":"wordfence","cve":"CVE-2023-51496","title":"WooCommerce Warranty Requests <= 2.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03e96aea-30a2-4cd3-8967-52e1870cc293?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-warranty","name":"WooCommerce Warranty Requests","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03eed366-c018-44b9-bb72-56911e9957b8","source":"wordfence","cve":"CVE-2023-25706","title":"Robots.txt optimization <= 1.4.5 - Cross Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03eed366-c018-44b9-bb72-56911e9957b8?source=api-prod","affected":[{"type":"plugin","slug":"better-robots-txt","name":"Better Robots.txt \u2013 AI-Ready Crawl Control & Bot Governance","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03f3d048-5099-406e-b386-31cbbbf4df14","source":"wordfence","cve":"CVE-2025-23512","title":"Team 118GROUP Agent <= 1.6.0  - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03f3d048-5099-406e-b386-31cbbbf4df14?source=api-prod","affected":[{"type":"plugin","slug":"team-118group-agent","name":"Team 118GROUP Agent","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T15:59:57Z"},{"id":"wordfence:03f5d152-00cc-4a44-8918-d357f148e150","source":"wordfence","cve":"CVE-2026-32569","title":"WP Media folder <= 6.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03f5d152-00cc-4a44-8918-d357f148e150?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder","name":"WP Media folder","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:49:59Z"},{"id":"wordfence:03f636e6-271d-4516-8db1-dc268ff794e7","source":"wordfence","cve":"CVE-2026-115483","title":"Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03f636e6-271d-4516-8db1-dc268ff794e7?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T06:49:17Z","updated":"2026-11-10T19:31:31Z"},{"id":"wordfence:03f9d9bb-6a87-4da9-bbb0-65203d7250e9","source":"wordfence","cve":"CVE-2024-5459","title":"Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03f9d9bb-6a87-4da9-bbb0-65203d7250e9?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"2.4.17"}],"published":"2024-06-04T00:00:00Z","updated":"2024-06-05T12:45:38Z"},{"id":"wordfence:03fa3a62-c5b7-4772-b8fe-26ae476b4ae4","source":"wordfence","cve":"CVE-2025-32188","title":"Advanced Woo Labels <= 2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03fa3a62-c5b7-4772-b8fe-26ae476b4ae4?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.15","to_inclusive":true,"patched_in":"2.16"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-21T14:52:26Z"},{"id":"wordfence:03faec37-2cce-4e14-92f2-d941ab1b4ce9","source":"wordfence","cve":"CVE-2023-6826","title":"E2Pdf <= 1.20.25 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03faec37-2cce-4e14-92f2-d941ab1b4ce9?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.25","to_inclusive":true,"patched_in":"1.20.26"}],"published":"2023-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03faf5af-6123-4db3-828f-88861f8116de","source":"wordfence","cve":"CVE-2025-1524","title":"Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03faf5af-6123-4db3-828f-88861f8116de?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T20:25:06Z"},{"id":"wordfence:03fba6bb-ff30-42bb-936b-93c009a7e3f7","source":"wordfence","cve":"CVE-2024-3989","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03fba6bb-ff30-42bb-936b-93c009a7e3f7?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:17Z"},{"id":"wordfence:03fd0c97-7b50-4930-99ca-c9b37d7e4ade","source":"wordfence","cve":"","title":"Map Block for Google Maps <= 1.31 - Unprotected AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03fd0c97-7b50-4930-99ca-c9b37d7e4ade?source=api-prod","affected":[{"type":"plugin","slug":"map-block-gutenberg","name":"Map Block for Google Maps","from":"*","from_inclusive":true,"to":"1.32","to_inclusive":false,"patched_in":"1.32"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:03fd2eee-429c-4053-8105-e1816f99ea91","source":"wordfence","cve":"CVE-2025-9331","title":"Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03fd2eee-429c-4053-8105-e1816f99ea91?source=api-prod","affected":[{"type":"theme","slug":"spacious","name":"Spacious","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2025-08-21T22:13:50Z","updated":"2025-08-22T11:14:00Z"},{"id":"wordfence:03ffb77e-fcb2-42ff-9010-d067d746c543","source":"wordfence","cve":"CVE-2026-54185","title":"Cornerstone < 7.8.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/03ffb77e-fcb2-42ff-9010-d067d746c543?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"7.8.8","to_inclusive":false,"patched_in":"7.8.8"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:44:38Z"},{"id":"wordfence:040005bc-bdc3-4085-8192-cd0a7e38fee0","source":"wordfence","cve":"CVE-2022-43471","title":"WP Bootstrap Gallery <= 1.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/040005bc-bdc3-4085-8192-cd0a7e38fee0?source=api-prod","affected":[{"type":"plugin","slug":"wp-bootstrap-gallery","name":"WP Bootstrap Gallery","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04003542-fd62-4587-9834-70e7fe8f08ef","source":"wordfence","cve":"CVE-2021-4443","title":"WordPress Mega Menu <= 2.0.6 - Arbitrary File Creation","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04003542-fd62-4587-9834-70e7fe8f08ef?source=api-prod","affected":[{"type":"plugin","slug":"quadmenu","name":"QuadMenu \u2013 Mega Menu","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-02-22T00:00:00Z","updated":"2024-10-16T06:43:23Z"},{"id":"wordfence:04013d96-d1b2-4d97-ad10-c2739eb9bc30","source":"wordfence","cve":"CVE-2026-32363","title":"WPLifeCycle <= 3.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04013d96-d1b2-4d97-ad10-c2739eb9bc30?source=api-prod","affected":[{"type":"plugin","slug":"free-php-version-info","name":"WPLifeCycle \u2013 Free PHP Version Info & Website Manager","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T20:51:11Z"},{"id":"wordfence:0402e4a6-73ba-49e6-bf80-997ac83b4cfe","source":"wordfence","cve":"CVE-2025-14901","title":"Bit Form \u2013 Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0402e4a6-73ba-49e6-bf80-997ac83b4cfe?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.21.6","to_inclusive":true,"patched_in":"2.21.7"}],"published":"2026-01-06T17:34:11Z","updated":"2026-01-07T06:35:58Z"},{"id":"wordfence:04033a28-b58a-4584-926b-f43036b23247","source":"wordfence","cve":"CVE-2024-50484","title":"Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04033a28-b58a-4584-926b-f43036b23247?source=api-prod","affected":[{"type":"plugin","slug":"multi-purpose-mail-form","name":"Multi Purpose Mail Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:23:27Z"},{"id":"wordfence:04045549-6a8f-427e-bb73-26b2c75c8623","source":"wordfence","cve":"CVE-2025-30521","title":"GP Back To Top <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04045549-6a8f-427e-bb73-26b2c75c8623?source=api-prod","affected":[{"type":"plugin","slug":"gp-back-to-top","name":"GP Back To Top","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:00:07Z"},{"id":"wordfence:04045ec3-dd8e-4ac5-bd73-eef6205ecc62","source":"wordfence","cve":"CVE-2024-9861","title":"Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04045ec3-dd8e-4ac5-bd73-eef6205ecc62?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-firebase-sms-otp-verification","name":"Miniorange OTP Verification with Firebase","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T02:05:57Z"},{"id":"wordfence:04057d0b-f831-4629-af74-393bb77689e3","source":"wordfence","cve":"CVE-2024-33932","title":"Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04057d0b-f831-4629-af74-393bb77689e3?source=api-prod","affected":[{"type":"plugin","slug":"login-logout-register-menu","name":"Login Logout Register Menu","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:54:01Z"},{"id":"wordfence:0406b7a0-517d-4462-9b65-d4f708cf364d","source":"wordfence","cve":"CVE-2013-4240","title":"HMS Testimonials <= 2.0.10 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0406b7a0-517d-4462-9b65-d4f708cf364d?source=api-prod","affected":[{"type":"plugin","slug":"hms-testimonials","name":"HMS Testimonials","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2013-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0407223a-cd41-43d1-87b0-d6b83b57d4b3","source":"wordfence","cve":"CVE-2024-13796","title":"Post Grid and Gutenberg Blocks \u2013 ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0407223a-cd41-43d1-87b0-d6b83b57d4b3?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T04:21:56Z"},{"id":"wordfence:0407c2fa-5bca-4ef2-bba7-e5975ea94f60","source":"wordfence","cve":"CVE-2025-22541","title":"WP Delete Post Copies <= 5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0407c2fa-5bca-4ef2-bba7-e5975ea94f60?source=api-prod","affected":[{"type":"plugin","slug":"etruel-del-post-copies","name":"WP Delete Post Copies","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"6.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-04-04T12:56:23Z"},{"id":"wordfence:040ae20d-93e3-4c65-ba74-4ff0b5c1afc7","source":"wordfence","cve":"CVE-2022-2433","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/040ae20d-93e3-4c65-ba74-4ff0b5c1afc7?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2022-08-22T00:00:00Z","updated":"2025-08-21T17:23:41Z"},{"id":"wordfence:0417e2d7-0c0a-48e1-bf18-3f5e16b1b8a0","source":"wordfence","cve":"CVE-2024-3023","title":"AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0417e2d7-0c0a-48e1-bf18-3f5e16b1b8a0?source=api-prod","affected":[{"type":"plugin","slug":"announcekit","name":"AnnounceKit","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:51:42Z"},{"id":"wordfence:041807ab-9354-4438-8e8a-77140f41eedb","source":"wordfence","cve":"","title":"Ultimate Form Builder Lite <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041807ab-9354-4438-8e8a-77140f41eedb?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-form-builder-lite","name":"Contact Form for WordPress \u2013 Ultimate Form Builder Lite","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2017-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:041830b8-f059-46f5-961b-3ba908d161f9","source":"wordfence","cve":"CVE-2023-2896","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041830b8-f059-46f5-961b-3ba908d161f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:041851d8-99ce-48a6-8ff5-85418d8807be","source":"wordfence","cve":"CVE-2021-24775","title":"Document Embedder < 1.7.6 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041851d8-99ce-48a6-8ff5-85418d8807be?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:041a7c9a-d7dc-4742-b879-f1836f324a46","source":"wordfence","cve":"CVE-2026-8607","title":"myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041a7c9a-d7dc-4742-b879-f1836f324a46?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-06-16T17:41:46Z","updated":"2026-06-17T06:49:40Z"},{"id":"wordfence:041c21fb-f2f0-45cb-b3ae-20f3ae22c947","source":"wordfence","cve":"CVE-2024-9457","title":"WP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041c21fb-f2f0-45cb-b3ae-20f3ae22c947?source=api-prod","affected":[{"type":"plugin","slug":"cssjockey-add-ons","name":"WP Builder","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:35:13Z","updated":"2024-10-10T02:06:02Z"},{"id":"wordfence:041c4d44-28ee-49a4-8407-367ad2960cf6","source":"wordfence","cve":"CVE-2021-24683","title":"Weather Effect \u2013 Christmas Santa Snow Falling <= 1.3.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041c4d44-28ee-49a4-8407-367ad2960cf6?source=api-prod","affected":[{"type":"plugin","slug":"weather-effect","name":"Weather Effect","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2021-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:041e635a-9f97-4f54-8ecb-57bbbc321cfc","source":"wordfence","cve":"","title":"ProfilePress <= 4.10.3 - Reflected Cross-Site Scripting via error message","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/041e635a-9f97-4f54-8ecb-57bbbc321cfc?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.11.0","to_inclusive":false,"patched_in":"4.11.0"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0420c558-b6d0-4f95-9f78-869efab46089","source":"wordfence","cve":"CVE-2024-52502","title":"ImbaChat <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0420c558-b6d0-4f95-9f78-869efab46089?source=api-prod","affected":[{"type":"plugin","slug":"imbachat-widget","name":"ImbaChat","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:11:02Z"},{"id":"wordfence:0424e4af-5225-45ed-8bc6-40654851e44f","source":"wordfence","cve":"CVE-2025-32126","title":"Pay with Contact Form 7 <= 1.0.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0424e4af-5225-45ed-8bc6-40654851e44f?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-contact-form-7","name":"Pay with Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T13:08:01Z"},{"id":"wordfence:042b0d01-f9bc-4726-a41d-6849aea0f7e0","source":"wordfence","cve":"CVE-2025-58985","title":"Additional Custom Product Tabs for WooCommerce <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/042b0d01-f9bc-4726-a41d-6849aea0f7e0?source=api-prod","affected":[{"type":"plugin","slug":"product-tabs-for-woocommerce","name":"Additional Custom Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:15:01Z"},{"id":"wordfence:042d9bc7-50ea-4585-9789-b10ed40b0d14","source":"wordfence","cve":"CVE-2025-9343","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/042d9bc7-50ea-4585-9789-b10ed40b0d14?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-12-20T14:59:55Z","updated":"2025-12-21T03:20:04Z"},{"id":"wordfence:042f7090-2eab-44d2-82b2-ecabdb1d3f99","source":"wordfence","cve":"CVE-2018-20980","title":"Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/042f7090-2eab-44d2-82b2-ecabdb1d3f99?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":false,"patched_in":"3.2.15"}],"published":"2018-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:042f78a4-2256-4286-aa03-8bd8b7a79530","source":"wordfence","cve":"CVE-2026-9757","title":"GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/042f78a4-2256-4286-aa03-8bd8b7a79530?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.5.1"}],"published":"2026-05-29T20:40:30Z","updated":"2026-05-30T09:29:01Z"},{"id":"wordfence:04325ba9-73d1-403a-a0be-fbb9eb3aaff9","source":"wordfence","cve":"CVE-2024-50440","title":"CodePen Embedded Pens Shortcode <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04325ba9-73d1-403a-a0be-fbb9eb3aaff9?source=api-prod","affected":[{"type":"plugin","slug":"codepen-embedded-pen-shortcode","name":"CodePen Embedded Pens Shortcode","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:22:28Z"},{"id":"wordfence:043263a1-ce87-45a2-83ee-4b826c7ffd7d","source":"wordfence","cve":"CVE-2024-6026","title":"Slider by 10Web <= 1.2.55 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043263a1-ce87-45a2-83ee-4b826c7ffd7d?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.55","to_inclusive":true,"patched_in":"1.2.56"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-28T12:57:41Z"},{"id":"wordfence:04339a44-07f8-4394-8c89-92739d51e39c","source":"wordfence","cve":"CVE-2026-96346","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04339a44-07f8-4394-8c89-92739d51e39c?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.9","to_inclusive":true,"patched_in":"1.17.10"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:57:53Z"},{"id":"wordfence:0435ae14-c1fd-4611-acbe-5f3bafd4bb6a","source":"wordfence","cve":"CVE-2022-1707","title":"Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0435ae14-c1fd-4611-acbe-5f3bafd4bb6a?source=api-prod","affected":[{"type":"plugin","slug":"duracelltomi-google-tag-manager","name":"GTM4WP \u2013 A Google Tag Manager (GTM) plugin for WordPress","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.15.1"}],"published":"2022-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04383919-dae0-4865-b0ff-88049f8cd4db","source":"wordfence","cve":"CVE-2021-36916","title":"Hide My WP <= 6.2.3 - SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04383919-dae0-4865-b0ff-88049f8cd4db?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2021-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04390ec2-c4d4-4396-b64f-e5c878d87bc8","source":"wordfence","cve":"CVE-2025-68013","title":"Payment Gateway Authorize.Net CIM for WooCommerce <= 2.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04390ec2-c4d4-4396-b64f-e5c878d87bc8?source=api-prod","affected":[{"type":"plugin","slug":"authnet-cim-for-woo","name":"Payment Gateway Authorize.Net CIM for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-03-27T10:39:59Z"},{"id":"wordfence:0439d2ee-7742-4aa7-ba4e-db55c6b2718e","source":"wordfence","cve":"CVE-2023-5651","title":"WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0439d2ee-7742-4aa7-ba4e-db55c6b2718e?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-10-20T00:00:00Z","updated":"2024-10-24T18:30:48Z"},{"id":"wordfence:043a5f20-c7e8-4e93-ad05-82616a559800","source":"wordfence","cve":"CVE-2025-69370","title":"Capella <= 2.5.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043a5f20-c7e8-4e93-ad05-82616a559800?source=api-prod","affected":[{"type":"theme","slug":"capella","name":"Capella | Restaurant WordPress","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-01-29T00:00:00Z","updated":"2026-04-15T13:36:37Z"},{"id":"wordfence:043d0300-b4ee-41b9-a6c9-6b6601b02b53","source":"wordfence","cve":"CVE-2026-93927","title":"Veto <= 1.6.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043d0300-b4ee-41b9-a6c9-6b6601b02b53?source=api-prod","affected":[{"type":"theme","slug":"veto","name":"Veto - Politics, Campaign & Candidate WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:32:27Z"},{"id":"wordfence:043d64ed-78dd-442e-87c9-92b5b64260b8","source":"wordfence","cve":"CVE-2017-9061","title":"WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043d64ed-78dd-442e-87c9-92b5b64260b8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:043db2aa-368a-4925-81e8-0ad87a1efa16","source":"wordfence","cve":"CVE-2026-113353","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Custom+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043db2aa-368a-4925-81e8-0ad87a1efa16?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":false,"patched_in":""}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:36:48Z"},{"id":"wordfence:043e8bd1-37e8-422d-98df-606dc17a6db7","source":"wordfence","cve":"CVE-2024-50488","title":"Token Login <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043e8bd1-37e8-422d-98df-606dc17a6db7?source=api-prod","affected":[{"type":"plugin","slug":"token-login","name":"Auto Login using a secure tokenized url. Role wise login restriction.","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:32:07Z"},{"id":"wordfence:043ed446-3af3-4d90-8da7-b1fe73e06bba","source":"wordfence","cve":"CVE-2023-35098","title":"NextGen GalleryView <= 0.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043ed446-3af3-4d90-8da7-b1fe73e06bba?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-nextgen-galleryview","name":"WordPress NextGen GalleryView","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:043f5052-6606-4f0e-a6f2-d7276eb50106","source":"wordfence","cve":"CVE-2019-15831","title":"Visitor Traffic Real Time Statistics <= 1.12 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043f5052-6606-4f0e-a6f2-d7276eb50106?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:043f54f5-b552-437b-9648-615a083198ab","source":"wordfence","cve":"CVE-2026-110897","title":"PowerPack Lite for Beaver Builder <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/043f54f5-b552-437b-9648-615a083198ab?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-10-16T10:37:06Z","updated":"2026-10-23T18:24:23Z"},{"id":"wordfence:04401d7e-996d-4b46-b391-bfb0b065900b","source":"wordfence","cve":"CVE-2023-47692","title":"Flo Forms <= 1.0.41 - Missing Authorization via flo_send_test_email","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04401d7e-996d-4b46-b391-bfb0b065900b?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":true,"patched_in":"1.0.42"}],"published":"2023-11-09T00:00:00Z","updated":"2024-04-01T21:08:56Z"},{"id":"wordfence:04402ff7-14d3-4454-bfc3-1db30c93f716","source":"wordfence","cve":"CVE-2025-53573","title":"Epic Review <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04402ff7-14d3-4454-bfc3-1db30c93f716?source=api-prod","affected":[{"type":"plugin","slug":"epic-review","name":"Epic Review","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-08-30T00:00:00Z","updated":"2025-11-12T13:40:25Z"},{"id":"wordfence:04419d7c-e74e-4c64-a04e-58fcf9f6059d","source":"wordfence","cve":"CVE-2026-115256","title":"Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04419d7c-e74e-4c64-a04e-58fcf9f6059d?source=api-prod","affected":[{"type":"plugin","slug":"mail-debug-for-woocommerce","name":"Mail Debug for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:18:27Z"},{"id":"wordfence:0441bedd-4608-4347-9542-d70c21fdbc32","source":"wordfence","cve":"CVE-2025-49928","title":"JetWooBuilder <= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0441bedd-4608-4347-9542-d70c21fdbc32?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.1.20.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-10-29T21:18:59Z"},{"id":"wordfence:04434abc-963f-40b7-8ed6-29bd39cf64b9","source":"wordfence","cve":"CVE-2024-13616","title":"VikBooking Hotel Booking Engine & PMS <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04434abc-963f-40b7-8ed6-29bd39cf64b9?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:40:42Z"},{"id":"wordfence:0444eff7-88bd-4933-94c5-bcb21a044b88","source":"wordfence","cve":"","title":"Woocommerce Customers Manager < 26.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0444eff7-88bd-4933-94c5-bcb21a044b88?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"26.5","to_inclusive":true,"patched_in":"26.6"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0446af38-540d-4f3c-bffc-eeee0ef10a20","source":"wordfence","cve":"CVE-2025-23644","title":"QuoteMedia Tools <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0446af38-540d-4f3c-bffc-eeee0ef10a20?source=api-prod","affected":[{"type":"plugin","slug":"quotemedia-tools","name":"QuoteMedia Tools","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:11:56Z"},{"id":"wordfence:0448eb1c-1a4a-465e-aa30-e4af10d27560","source":"wordfence","cve":"","title":"Mini Cart <= 1.00.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0448eb1c-1a4a-465e-aa30-e4af10d27560?source=api-prod","affected":[{"type":"plugin","slug":"mini-cart","name":"mini-cart","from":"*","from_inclusive":true,"to":"1.00.1","to_inclusive":true,"patched_in":""}],"published":"2016-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:044babea-8c04-4461-be53-80f2171da619","source":"wordfence","cve":"CVE-2007-5710","title":"WordPress Core <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/044babea-8c04-4461-be53-80f2171da619?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2007-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:044c34da-ee4e-4c18-bf9e-96a49a5ea7d9","source":"wordfence","cve":"CVE-2023-37985","title":"Restaurant Menu and Food Ordering by Five Star Plugins <= 2.4.6 - Cross-Site Request Forgery via maybe_duplicate_item","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/044c34da-ee4e-4c18-bf9e-96a49a5ea7d9?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":false,"patched_in":"2.4.7"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:044d7480-ccd7-4ce8-bb5d-367ba5d0217c","source":"wordfence","cve":"CVE-2023-50369","title":"Alma \u2013 Pay in installments or later for WooCommerce <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/044d7480-ccd7-4ce8-bb5d-367ba5d0217c?source=api-prod","affected":[{"type":"plugin","slug":"alma-gateway-for-woocommerce","name":"Alma \u2013 Pay in installments or later for WooCommerce","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2023-12-07T00:00:00Z","updated":"2024-04-01T21:04:44Z"},{"id":"wordfence:044e110d-2435-41b8-8aec-917c329b944c","source":"wordfence","cve":"CVE-2023-23727","title":"Formilla Live Chat <= 1.3.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaID'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/044e110d-2435-41b8-8aec-917c329b944c?source=api-prod","affected":[{"type":"plugin","slug":"formilla-live-chat","name":"Live Chat by Formilla \u2013 Real-time Chat & Chatbots Plugin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04507310-bc97-4c97-8131-71ce5c9a6ce4","source":"wordfence","cve":"CVE-2026-62072","title":"Progress Planner <= 1.10.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04507310-bc97-4c97-8131-71ce5c9a6ce4?source=api-prod","affected":[{"type":"plugin","slug":"progress-planner","name":"Progress Planner","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2026-10-04T08:05:20Z","updated":"2026-10-08T23:38:16Z"},{"id":"wordfence:04516d92-7f66-47b3-aeae-6752e03c1f95","source":"wordfence","cve":"CVE-2014-9036","title":"WordPress Core < 4.0.1 - Cross-Site Scripting via CSS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04516d92-7f66-47b3-aeae-6752e03c1f95?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0451a7b8-7657-4b73-9ef1-cc3791349e59","source":"wordfence","cve":"","title":"Selio - Real Estate Directory <= 1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0451a7b8-7657-4b73-9ef1-cc3791349e59?source=api-prod","affected":[{"type":"theme","slug":"selio","name":"Selio","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0453355e-471f-42c9-8d62-15541f0542d8","source":"wordfence","cve":"CVE-2025-53441","title":"Greeny <= 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0453355e-471f-42c9-8d62-15541f0542d8?source=api-prod","affected":[{"type":"theme","slug":"greeny","name":"Greeny - Electric Car Dealership WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:26:04Z"},{"id":"wordfence:04565e7d-7f7d-4273-9be0-9f1b67209c9a","source":"wordfence","cve":"CVE-2025-25123","title":"Easy Related Posts <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04565e7d-7f7d-4273-9be0-9f1b67209c9a?source=api-prod","affected":[{"type":"plugin","slug":"easy-related-posts","name":"Easy Related Posts","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:15:52Z"},{"id":"wordfence:04567872-d4e3-43e9-88ca-6f60d135bb9c","source":"wordfence","cve":"CVE-2015-10078","title":"Resend Welcome Email <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04567872-d4e3-43e9-88ca-6f60d135bb9c?source=api-prod","affected":[{"type":"plugin","slug":"resend-welcome-email","name":"Resend Welcome Email","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2015-04-27T00:00:00Z","updated":"2024-02-07T14:25:01Z"},{"id":"wordfence:045717f4-0e31-41f8-b0c3-8118c768b648","source":"wordfence","cve":"CVE-2022-1896","title":"underConstruction <= 1.20 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045717f4-0e31-41f8-b0c3-8118c768b648?source=api-prod","affected":[{"type":"plugin","slug":"underconstruction","name":"underConstruction","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":false,"patched_in":"1.21"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0457cd72-d9ce-4b88-88ee-b1270359485f","source":"wordfence","cve":"CVE-2026-24543","title":"Materialis Companion <= 1.3.52 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0457cd72-d9ce-4b88-88ee-b1270359485f?source=api-prod","affected":[{"type":"plugin","slug":"materialis-companion","name":"Materialis Companion","from":"*","from_inclusive":true,"to":"1.3.52","to_inclusive":true,"patched_in":"1.3.53"}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-24T22:29:26Z"},{"id":"wordfence:0458282f-199f-4b1f-80e0-a17ac8811915","source":"wordfence","cve":"CVE-2025-52768","title":"Faith & Hope <= 2.13.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0458282f-199f-4b1f-80e0-a17ac8811915?source=api-prod","affected":[{"type":"theme","slug":"faith-hope","name":"Faith & Hope | Church & Religion Non-Profit WordPress Theme","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:24:04Z"},{"id":"wordfence:0458867f-c39e-4231-9ede-5ab1beb61878","source":"wordfence","cve":"CVE-2025-53320","title":"Free Downloads EDD <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0458867f-c39e-4231-9ede-5ab1beb61878?source=api-prod","affected":[{"type":"plugin","slug":"free-downloads-edd","name":"Free Downloads EDD","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:35:00Z"},{"id":"wordfence:04597908-7086-4158-ae2b-8aa634a217c6","source":"wordfence","cve":"CVE-2024-6225","title":"Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1  - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04597908-7086-4158-ae2b-8aa634a217c6?source=api-prod","affected":[{"type":"plugin","slug":"amelia","name":"Booking for Appointments and Events Calendar \u2013 Amelia Pro","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.6"},{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-06-20T00:00:00Z","updated":"2024-08-02T14:40:52Z"},{"id":"wordfence:0459a6bd-334d-43b7-b289-271108564a53","source":"wordfence","cve":"CVE-2024-6691","title":"Easy Digital Downloads \u2013 Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0459a6bd-334d-43b7-b289-271108564a53?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-10T02:01:21Z"},{"id":"wordfence:0459d852-4d6b-4457-ad8d-47a3cddded8b","source":"wordfence","cve":"CVE-2008-4734","title":"WP Comment Remix < 1.4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0459d852-4d6b-4457-ad8d-47a3cddded8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-remix","name":"WP Comment Remix","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2008-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:045e3aba-16b6-46f1-8c57-dd54e1e0e950","source":"wordfence","cve":"CVE-2024-52396","title":"WOLF <= 1.0.8.3 - Authenticated (Editor+) CSV Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045e3aba-16b6-46f1-8c57-dd54e1e0e950?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.3","to_inclusive":true,"patched_in":"1.0.8.4"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T14:01:22Z"},{"id":"wordfence:045f2be3-9a24-4f8b-8a09-8adeb751b218","source":"wordfence","cve":"CVE-2024-10883","title":"SimpleForm \u2013 Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045f2be3-9a24-4f8b-8a09-8adeb751b218?source=api-prod","affected":[{"type":"plugin","slug":"simpleform","name":"SimpleForm \u2013 Contact form made simple","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T14:58:27Z","updated":"2024-11-16T03:20:40Z"},{"id":"wordfence:045f52f2-b77d-4ddb-a674-0fccf3e6dc7d","source":"wordfence","cve":"CVE-2026-56045","title":"WordPress Automatic Plugin < 3.135.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045f52f2-b77d-4ddb-a674-0fccf3e6dc7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.135.1","to_inclusive":false,"patched_in":"3.135.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:01:33Z"},{"id":"wordfence:045fbe5b-0e63-4820-97a7-017dd72eb73a","source":"wordfence","cve":"CVE-2024-5343","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045fbe5b-0e63-4820-97a7-017dd72eb73a?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T05:37:45Z"},{"id":"wordfence:045fdfd8-7c4a-4fa8-81fd-f749777fb9ed","source":"wordfence","cve":"CVE-2025-67978","title":"Educare <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/045fdfd8-7c4a-4fa8-81fd-f749777fb9ed?source=api-prod","affected":[{"type":"plugin","slug":"educare","name":"Educare \u2013 Students & Result Management System","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T16:17:00Z"},{"id":"wordfence:04601634-d707-44a7-9b5f-46c4b9687469","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.0 - Authorization Bypass to Friend Invite","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04601634-d707-44a7-9b5f-46c4b9687469?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04604090-e40c-4480-8432-483ebbda5f45","source":"wordfence","cve":"CVE-2024-49303","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04604090-e40c-4480-8432-483ebbda5f45?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:41:53Z"},{"id":"wordfence:0462df4d-1be5-4834-817a-8df0300d3188","source":"wordfence","cve":"CVE-2025-31000","title":"Payment QR WooCommerce <= 1.1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0462df4d-1be5-4834-817a-8df0300d3188?source=api-prod","affected":[{"type":"plugin","slug":"payment-qr-woo","name":"Payment QR WooCommerce","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:08:52Z"},{"id":"wordfence:04641506-5b0e-48bc-ad50-c81dda996ecf","source":"wordfence","cve":"CVE-2024-7355","title":"Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameters","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04641506-5b0e-48bc-ad50-c81dda996ecf?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-08-07T00:01:25Z","updated":"2024-08-07T14:14:44Z"},{"id":"wordfence:0464aaaf-d1ad-4a65-b58a-28ec4b2e01a7","source":"wordfence","cve":"CVE-2024-54430","title":"EELV Newsletter <= 4.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0464aaaf-d1ad-4a65-b58a-28ec4b2e01a7?source=api-prod","affected":[{"type":"plugin","slug":"eelv-newsletter","name":"EELV Newsletter","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:29:33Z"},{"id":"wordfence:046526ef-3db9-47e4-b454-472def7935e6","source":"wordfence","cve":"CVE-2015-9273","title":"Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/046526ef-3db9-47e4-b454-472def7935e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.1.6.1","to_inclusive":false,"patched_in":"4.1.6.1"}],"published":"2015-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04676263-cdad-40cd-bb54-61beb727e09d","source":"wordfence","cve":"CVE-2025-8767","title":"AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection","severity":"medium","cvss":4.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04676263-cdad-40cd-bb54-61beb727e09d?source=api-prod","affected":[{"type":"plugin","slug":"football-leagues-by-anwppro","name":"AnWP Football Leagues","from":"*","from_inclusive":true,"to":"0.16.17","to_inclusive":true,"patched_in":"0.16.18"}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-12T06:42:41Z"},{"id":"wordfence:04689f95-30ea-4b68-b50c-c00ed6ab835b","source":"wordfence","cve":"CVE-2026-42734","title":"Geo Mashup <= 1.13.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04689f95-30ea-4b68-b50c-c00ed6ab835b?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.19","to_inclusive":true,"patched_in":"1.13.20"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:29:39Z"},{"id":"wordfence:046ecbe5-4b2f-40d3-8585-4d4230ba33f0","source":"wordfence","cve":"CVE-2023-30876","title":"Dave's WordPress Live Search <= 4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/046ecbe5-4b2f-40d3-8585-4d4230ba33f0?source=api-prod","affected":[{"type":"plugin","slug":"daves-wordpress-live-search","name":"Dave&#039;s WordPress Live Search","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:046f11b6-7d1a-4bd3-8250-4c5a50fab3ff","source":"wordfence","cve":"CVE-2024-6161","title":"Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/046f11b6-7d1a-4bd3-8250-4c5a50fab3ff?source=api-prod","affected":[{"type":"plugin","slug":"default-thumbnail-plus","name":"Default Thumbnail Plus","from":"*","from_inclusive":true,"to":"1.0.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:42Z"},{"id":"wordfence:046f1f8d-9e87-4ede-bcb8-56614a1f3235","source":"wordfence","cve":"CVE-2025-30834","title":"Bit Assist <= 1.5.4 - Unauthenticated Path Traversal","severity":"medium","cvss":5.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/046f1f8d-9e87-4ede-bcb8-56614a1f3235?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:02:18Z"},{"id":"wordfence:046fde5c-9f11-4f09-a4eb-83c289680a18","source":"wordfence","cve":"CVE-2015-9445","title":"Unite Gallery Lite <= 1.4.6 - Cross-Site Request Forgery & Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/046fde5c-9f11-4f09-a4eb-83c289680a18?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.5"}],"published":"2015-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04708871-a8eb-4afe-981f-aab965f6ea16","source":"wordfence","cve":"CVE-2024-54420","title":"Metrika <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04708871-a8eb-4afe-981f-aab965f6ea16?source=api-prod","affected":[{"type":"plugin","slug":"metrika","name":"Metrika","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:01:15Z"},{"id":"wordfence:0472804e-00cc-4c4c-97aa-86f433f65782","source":"wordfence","cve":"","title":"Maps Widget for Google Maps <= 4.23 - Cross-Site Request Forgery via dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0472804e-00cc-4c4c-97aa-86f433f65782?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-widget","name":"Maps Widget for Google Maps","from":"*","from_inclusive":true,"to":"4.23","to_inclusive":true,"patched_in":"4.24"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0472a98c-d1f0-4bc0-8005-157f9a58dc59","source":"wordfence","cve":"CVE-2026-105971","title":"Car Dealer <= 4.73 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0472a98c-d1f0-4bc0-8005-157f9a58dc59?source=api-prod","affected":[{"type":"plugin","slug":"cardealer","name":"Car Dealer (Dealership) and Vehicle sales","from":"*","from_inclusive":true,"to":"4.73","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:33:11Z"},{"id":"wordfence:047a72aa-db0e-44d8-8b03-2b9b28d697cd","source":"wordfence","cve":"CVE-2026-24533","title":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047a72aa-db0e-44d8-8b03-2b9b28d697cd?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2026-10-29T13:01:00Z","updated":"2026-11-03T19:52:12Z"},{"id":"wordfence:047aa84b-6e6a-4975-8a3f-3f8b4518704e","source":"wordfence","cve":"CVE-2022-41554","title":"Slideshow SE <= 2.5.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047aa84b-6e6a-4975-8a3f-3f8b4518704e?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-se","name":"Slideshow SE","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:047c04f7-f787-41b6-9d9a-0b58e26fea37","source":"wordfence","cve":"CVE-2024-9711","title":"EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Tournament Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047c04f7-f787-41b6-9d9a-0b58e26fea37?source=api-prod","affected":[{"type":"plugin","slug":"ekc-tournament-manager","name":"EKC Tournament Manager","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-11-14T00:00:00Z","updated":"2025-05-23T15:36:12Z"},{"id":"wordfence:047c1519-4dc1-496c-b494-41ce1009e703","source":"wordfence","cve":"CVE-2025-58979","title":"BerqWP <= 2.2.53 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047c1519-4dc1-496c-b494-41ce1009e703?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"2.2.53","to_inclusive":true,"patched_in":"2.2.54"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:23:46Z"},{"id":"wordfence:047cd34e-f2a1-4643-a1c5-3ead926b83ca","source":"wordfence","cve":"CVE-2023-28786","title":"iThemes Security <= 8.1.4 - Open Redirection via redirect_to_https","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047cd34e-f2a1-4643-a1c5-3ead926b83ca?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"8.1.4","to_inclusive":true,"patched_in":"8.1.5"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:047fd07c-ab07-49bf-8a94-8ae33c92f93e","source":"wordfence","cve":"CVE-2025-13144","title":"ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/047fd07c-ab07-49bf-8a94-8ae33c92f93e?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-12-04T17:24:04Z","updated":"2025-12-09T17:12:16Z"},{"id":"wordfence:04802c63-4a5d-4948-9ef1-cf89c4cc757e","source":"wordfence","cve":"CVE-2024-2544","title":"Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions","severity":"high","cvss":7.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04802c63-4a5d-4948-9ef1-cf89c4cc757e?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2024-06-14T00:00:00Z","updated":"2024-06-15T02:01:58Z"},{"id":"wordfence:048077bc-30da-472c-97ea-24317dbde712","source":"wordfence","cve":"CVE-2016-1000155","title":"WPSOLR \u2013 Elasticsearch and Solr search <= 8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048077bc-30da-472c-97ea-24317dbde712?source=api-prod","affected":[{"type":"plugin","slug":"wpsolr-search-engine","name":"WPSOLR \u2013 Elasticsearch and Solr search","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"8.7"}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:048277c4-f313-484d-a330-420e0682eee2","source":"wordfence","cve":"CVE-2023-45765","title":"WP ERP <= 1.12.6 - Missing Authorization via admin notice dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048277c4-f313-484d-a330-420e0682eee2?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.6","to_inclusive":true,"patched_in":"1.12.7"}],"published":"2023-10-12T00:00:00Z","updated":"2024-04-17T13:00:09Z"},{"id":"wordfence:0482d9c6-aa74-4d47-885c-17f14b38be6f","source":"wordfence","cve":"CVE-2021-24420","title":"Request a Quote <= 2.3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0482d9c6-aa74-4d47-885c-17f14b38be6f?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:048625e8-10b7-418d-a13b-329f1d7e0171","source":"wordfence","cve":"CVE-2024-12432","title":"WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key","severity":"high","cvss":8.1,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048625e8-10b7-418d-a13b-329f1d7e0171?source=api-prod","affected":[{"type":"plugin","slug":"wpc-shop-as-customer","name":"WPC Shop as a Customer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T03:22:02Z"},{"id":"wordfence:0486fca3-49d4-4edb-9b32-952a20ffa59f","source":"wordfence","cve":"CVE-2025-24761","title":"DSK < 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0486fca3-49d4-4edb-9b32-952a20ffa59f?source=api-prod","affected":[{"type":"theme","slug":"dsk","name":"DSK - Furniture Store WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2025-06-11T00:00:00Z","updated":"2026-02-24T22:22:31Z"},{"id":"wordfence:048768bf-326c-455e-919c-9691d6537062","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery via migrateCommonToProductOnly function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048768bf-326c-455e-919c-9691d6537062?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0487c6dd-7453-4473-9a13-6b699623f8a9","source":"wordfence","cve":"CVE-2026-89413","title":"Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0487c6dd-7453-4473-9a13-6b699623f8a9?source=api-prod","affected":[{"type":"plugin","slug":"filter-gallery","name":"Filter Gallery","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-17T18:31:56Z","updated":"2026-09-18T06:38:51Z"},{"id":"wordfence:04881aac-9d3b-48c0-b095-e91797df46e3","source":"wordfence","cve":"CVE-2026-18387","title":"Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04881aac-9d3b-48c0-b095-e91797df46e3?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"4.5.15"}],"published":"2026-08-14T15:11:52Z","updated":"2026-08-15T15:32:27Z"},{"id":"wordfence:0488a421-e725-4b64-94ee-3a81f4bc5451","source":"wordfence","cve":"CVE-2024-31282","title":"App Builder <= 3.8.7 - Open Redirection","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0488a421-e725-4b64-94ee-3a81f4bc5451?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.8"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:56:06Z"},{"id":"wordfence:048a55a4-f4b3-4203-8c0a-8778189a6a18","source":"wordfence","cve":"CVE-2025-26898","title":"Traveler <= 3.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048a55a4-f4b3-4203-8c0a-8778189a6a18?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-05-23T14:07:49Z"},{"id":"wordfence:048bc117-88df-44b3-a30c-692bad23050f","source":"wordfence","cve":"CVE-2023-6496","title":"Manage Notification E-mails <= 1.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048bc117-88df-44b3-a30c-692bad23050f?source=api-prod","affected":[{"type":"plugin","slug":"manage-notification-emails","name":"Manage Notification E-mails","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2023-12-08T00:00:00Z","updated":"2024-07-29T21:35:48Z"},{"id":"wordfence:048c37c2-0ace-4bf1-8cb8-554c4645be21","source":"wordfence","cve":"CVE-2022-1598","title":"WPQA - Builder forms Addon For WordPress  <= 5.4 - Unauthenticated Private Message Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048c37c2-0ace-4bf1-8cb8-554c4645be21?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:048e266f-5de5-4bcf-96ae-5c6ff969c5f7","source":"wordfence","cve":"CVE-2025-32158","title":"aThemes Addons for Elementor <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048e266f-5de5-4bcf-96ae-5c6ff969c5f7?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-04-04T00:00:00Z","updated":"2025-10-08T17:07:24Z"},{"id":"wordfence:048e81c3-8682-4b4f-a346-9e69e0cc07ad","source":"wordfence","cve":"CVE-2025-30560","title":"jQuery Dropdown Menu <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048e81c3-8682-4b4f-a346-9e69e0cc07ad?source=api-prod","affected":[{"type":"plugin","slug":"jquery-drop-down-menu-plugin","name":"jQuery Dropdown Menu","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:58:02Z"},{"id":"wordfence:048ea84c-0d53-434b-ae49-d804ec1de8c4","source":"wordfence","cve":"CVE-2024-7606","title":"Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/048ea84c-0d53-434b-ae49-d804ec1de8c4?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.28","to_inclusive":true,"patched_in":"3.2.29"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T05:30:56Z"},{"id":"wordfence:0490667e-4b82-4687-9354-205c37f13331","source":"wordfence","cve":"CVE-2014-9283","title":"BestWebSoft Captcha <= 4.0.6 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0490667e-4b82-4687-9354-205c37f13331?source=api-prod","affected":[{"type":"plugin","slug":"captcha-bws","name":"Captcha by BestWebSoft \u2013 Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2014-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04917cfe-2bfb-48cf-a060-ca3bfde8eba1","source":"wordfence","cve":"","title":"Falang multilanguage for WordPress < 1.3.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04917cfe-2bfb-48cf-a060-ca3bfde8eba1?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":false,"patched_in":"1.3.18"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0491b8b3-014e-4ef2-b3b6-9570063fffc5","source":"wordfence","cve":"CVE-2024-53822","title":"Pie Register Premium < 3.8.3.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0491b8b3-014e-4ef2-b3b6-9570063fffc5?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.3.3","to_inclusive":false,"patched_in":"3.8.3.3"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:56:34Z"},{"id":"wordfence:049657cf-9253-4a2d-a032-5f2f1d795eec","source":"wordfence","cve":"CVE-2024-51903","title":"WP Listings Pro <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049657cf-9253-4a2d-a032-5f2f1d795eec?source=api-prod","affected":[{"type":"plugin","slug":"wp-listings-pro","name":"WP Listings Pro","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:23:09Z"},{"id":"wordfence:04970416-06db-4339-ac22-34fde5a48f2a","source":"wordfence","cve":"CVE-2023-32742","title":"WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04970416-06db-4339-ac22-34fde5a48f2a?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:049a36b1-4e24-4ac9-a594-9cabdc0dfe0f","source":"wordfence","cve":"CVE-2024-11447","title":"Community by PeepSo \u2013 Social Network, Membership, Registration, User Profiles, Premium \u2013 Mobile App <=7.0.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049a36b1-4e24-4ac9-a594-9cabdc0dfe0f?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"7.0.3.0","to_inclusive":true,"patched_in":"7.0.4.0"}],"published":"2024-11-20T13:34:59Z","updated":"2025-04-14T19:00:19Z"},{"id":"wordfence:049b7e92-c648-49e5-bab9-1b893d44faf9","source":"wordfence","cve":"CVE-2026-39664","title":"Leadrebel <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049b7e92-c648-49e5-bab9-1b893d44faf9?source=api-prod","affected":[{"type":"plugin","slug":"leadrebel","name":"Leadrebel","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:25:46Z"},{"id":"wordfence:049ec264-3ed1-4741-937d-8a633ef0a627","source":"wordfence","cve":"CVE-2024-3022","title":"BookingPress \u2013 Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049ec264-3ed1-4741-937d-8a633ef0a627?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.87","to_inclusive":true,"patched_in":"1.0.88"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T01:56:56Z"},{"id":"wordfence:049ec60a-fa84-4c03-a766-7f2a56e5295a","source":"wordfence","cve":"CVE-2024-9021","title":"Relevanssi \u2013 A Better Search <= 4.23.0 (Free) and <= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049ec60a-fa84-4c03-a766-7f2a56e5295a?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.26.0","to_inclusive":true,"patched_in":"2.26.1"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.23.0","to_inclusive":true,"patched_in":"4.23.1"}],"published":"2024-09-17T00:00:00Z","updated":"2025-05-13T07:25:40Z"},{"id":"wordfence:049efe5a-3f68-46ad-b73a-1892f03c9d1d","source":"wordfence","cve":"CVE-2024-5789","title":"Triton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049efe5a-3f68-46ad-b73a-1892f03c9d1d?source=api-prod","affected":[{"type":"theme","slug":"triton-lite","name":"Triton Lite","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:33:13Z","updated":"2024-09-13T15:10:37Z"},{"id":"wordfence:049ffab1-677d-4112-9f1d-092ee01299f1","source":"wordfence","cve":"CVE-2026-4666","title":"wpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/049ffab1-677d-4112-9f1d-092ee01299f1?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-04-16T14:05:14Z","updated":"2026-04-17T02:25:05Z"},{"id":"wordfence:04a119c2-7fce-4836-8214-ca088f6c92ee","source":"wordfence","cve":"CVE-2025-66150","title":"Appender <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a119c2-7fce-4836-8214-ca088f6c92ee?source=api-prod","affected":[{"type":"plugin","slug":"appender","name":"Appender \u2013 Copycat Content Protection for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:44:28Z"},{"id":"wordfence:04a2c05a-11bb-450e-9ce9-783685730573","source":"wordfence","cve":"CVE-2025-7687","title":"Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a2c05a-11bb-450e-9ce9-783685730573?source=api-prod","affected":[{"type":"plugin","slug":"latest-post-accordian-slider","name":"Latest Post Accordian Slider","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T20:53:15Z","updated":"2025-07-22T09:22:42Z"},{"id":"wordfence:04a46249-b5b2-4082-b520-cdc4a1370bb1","source":"wordfence","cve":"CVE-2022-1442","title":"Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a46249-b5b2-4082-b520-cdc4a1370bb1?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2022-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04a64a52-f0a0-4559-834d-88d3edd1bb6a","source":"wordfence","cve":"CVE-2022-3243","title":"WP Ultimate CSV Importer <= 6.5.7 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a64a52-f0a0-4559-834d-88d3edd1bb6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04a6a3f3-6aa3-4262-8e55-054b664d5bd4","source":"wordfence","cve":"CVE-2024-51821","title":"WE \u2013 Client Logo Carousel <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a6a3f3-6aa3-4262-8e55-054b664d5bd4?source=api-prod","affected":[{"type":"plugin","slug":"we-client-logo-carousel","name":"WE \u2013 Client Logo Carousel","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:21:00Z"},{"id":"wordfence:04a6f9f1-1a59-482c-8a42-6f41e4c41cb4","source":"wordfence","cve":"CVE-2024-32577","title":"CBX Bookmark & Favorite <= 1.7.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a6f9f1-1a59-482c-8a42-6f41e4c41cb4?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"1.7.21","to_inclusive":true,"patched_in":"1.7.22"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:43:50Z"},{"id":"wordfence:04a79a78-a6d3-40ef-9b26-8e2e00534b7a","source":"wordfence","cve":"CVE-2023-24415","title":"ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a79a78-a6d3-40ef-9b26-8e2e00534b7a?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04a79c2c-8178-4311-9c1f-f4eb5128dec9","source":"wordfence","cve":"CVE-2018-1000512","title":"Tooltipy (tooltips for WP) <= 5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a79c2c-8178-4311-9c1f-f4eb5128dec9?source=api-prod","affected":[{"type":"plugin","slug":"bluet-keywords-tooltip-generator","name":"Tooltipy (tooltips for WP)","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":false,"patched_in":"5.1"}],"published":"2018-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04a937d0-9844-49d1-bcb5-0ee6026c3947","source":"wordfence","cve":"CVE-2022-3858","title":"Floating Chat Widget - Chaty <= 3.0.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a937d0-9844-49d1-bcb5-0ee6026c3947?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04a99e67-6af2-43c5-a21b-052eb683945c","source":"wordfence","cve":"CVE-2022-0206","title":"NewStatPress <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04a99e67-6af2-43c5-a21b-052eb683945c?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04aa7307-03c6-42f9-8219-fb6002c85050","source":"wordfence","cve":"CVE-2022-36356","title":"Culture Object <= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04aa7307-03c6-42f9-8219-fb6002c85050?source=api-prod","affected":[{"type":"plugin","slug":"culture-object","name":"Culture Object","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04ac6051-8b85-45e6-b097-45c7f68dfc6c","source":"wordfence","cve":"CVE-2026-103358","title":"Mailonix \u2013 Email Template Customizer for WooCommerce <= 1.3.4 - Unauthenticated Arbitrary Shortcode Injection","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ac6051-8b85-45e6-b097-45c7f68dfc6c?source=api-prod","affected":[{"type":"plugin","slug":"email-template-customizer-for-woo","name":"Mailonix \u2013 Email Template Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-10-12T00:00:00Z","updated":"2026-11-03T19:38:43Z"},{"id":"wordfence:04aca055-b62a-4c20-8347-0648a8545ef2","source":"wordfence","cve":"CVE-2026-96333","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.8.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04aca055-b62a-4c20-8347-0648a8545ef2?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.8.1","to_inclusive":true,"patched_in":"4.16.9"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-14T15:49:02Z"},{"id":"wordfence:04ad816b-0ac0-44b5-928a-5bb3e36523b2","source":"wordfence","cve":"","title":"Advance Menu Manager <= 3.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ad816b-0ac0-44b5-928a-5bb3e36523b2?source=api-prod","affected":[{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04ae2cd4-2842-4351-95e8-152eee73939e","source":"wordfence","cve":"CVE-2026-19116","title":"User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ae2cd4-2842-4351-95e8-152eee73939e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"4.3.11"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-10T19:24:11Z"},{"id":"wordfence:04af8675-1b1e-4f17-9eaf-87b49d8702e4","source":"wordfence","cve":"CVE-2026-32525","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.5.6.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04af8675-1b1e-4f17-9eaf-87b49d8702e4?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.5.6.1","to_inclusive":true,"patched_in":"3.5.6.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:56:51Z"},{"id":"wordfence:04afce48-88a0-4d46-af19-a534f89f70d7","source":"wordfence","cve":"CVE-2014-8622","title":"Compfight < 1.5 - Cross-Site Scrpting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04afce48-88a0-4d46-af19-a534f89f70d7?source=api-prod","affected":[{"type":"plugin","slug":"compfight","name":"Compfight","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2014-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04b2123d-ae0c-4984-95f5-7040f8604c92","source":"wordfence","cve":"CVE-2025-14481","title":"Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b2123d-ae0c-4984-95f5-7040f8604c92?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"26.5","to_inclusive":true,"patched_in":"26.6"}],"published":"2026-05-26T15:59:29Z","updated":"2026-05-27T04:29:03Z"},{"id":"wordfence:04b25119-ccd2-44e0-b8cd-59aa2f34cb0e","source":"wordfence","cve":"CVE-2026-116862","title":"WP REST Cache <= 2026.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b25119-ccd2-44e0-b8cd-59aa2f34cb0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-cache","name":"WP REST Cache","from":"*","from_inclusive":true,"to":"2026.3.1","to_inclusive":true,"patched_in":"2026.4.0"}],"published":"2026-10-30T07:14:50Z","updated":"2026-11-03T19:36:06Z"},{"id":"wordfence:04b341ae-f856-4bdb-b9d0-696c25131bd0","source":"wordfence","cve":"CVE-2026-27397","title":"Really Simple Security Pro <= 9.5.4.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b341ae-f856-4bdb-b9d0-696c25131bd0?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl-pro","name":"Really Simple Security Pro","from":"*","from_inclusive":true,"to":"9.5.4.0","to_inclusive":true,"patched_in":"9.5.4.1"}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:02:16Z"},{"id":"wordfence:04b42623-4577-4f5c-9474-d4a54674b9d6","source":"wordfence","cve":"CVE-2026-114429","title":"VR 8.5.49 - 9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b42623-4577-4f5c-9474-d4a54674b9d6?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"8.5.49","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:19:56Z"},{"id":"wordfence:04b7a2ba-e299-4781-8ee6-644938bf9629","source":"wordfence","cve":"","title":"MStore API < 3.4.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b7a2ba-e299-4781-8ee6-644938bf9629?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"3.4.5"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04b9ada5-8cb3-49df-9fc8-0517a3bfcc78","source":"wordfence","cve":"CVE-2026-91075","title":"Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b9ada5-8cb3-49df-9fc8-0517a3bfcc78?source=api-prod","affected":[{"type":"plugin","slug":"eupago-gateway-for-woocommerce","name":"Eupago Gateway For Woocommerce","from":"4.5.0","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-31T00:00:00Z","updated":"2026-11-05T15:41:35Z"},{"id":"wordfence:04b9c0c4-3f1a-4984-9b24-6de3dc78bde0","source":"wordfence","cve":"CVE-2026-17586","title":"VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04b9c0c4-3f1a-4984-9b24-6de3dc78bde0?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.118.0","to_inclusive":true,"patched_in":"9.119.0"}],"published":"2026-09-17T18:47:48Z","updated":"2026-09-18T07:39:58Z"},{"id":"wordfence:04bc4a20-0136-4fb4-9489-07140b2b86aa","source":"wordfence","cve":"CVE-2025-11981","title":"School Management System \u2013 WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04bc4a20-0136-4fb4-9489-07140b2b86aa?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2025-11-13T22:05:08Z","updated":"2025-11-14T11:20:19Z"},{"id":"wordfence:04bc8101-2676-4695-a498-f79be8221617","source":"wordfence","cve":"CVE-2024-11925","title":"WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04bc8101-2676-4695-a498-f79be8221617?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2024-11-27T19:13:40Z","updated":"2024-11-28T09:07:04Z"},{"id":"wordfence:04bdc2ef-a7aa-45a7-b600-be832eefa32e","source":"wordfence","cve":"","title":"Better Click To Tweet <= 5.10.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04bdc2ef-a7aa-45a7-b600-be832eefa32e?source=api-prod","affected":[{"type":"plugin","slug":"better-click-to-tweet","name":"Better Click To Share \u2013 Shareable Quote Boxes for X (Twitter)","from":"*","from_inclusive":true,"to":"5.10.3","to_inclusive":true,"patched_in":"5.10.4"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04beb4f4-abad-42a3-a817-3efbc02ed48e","source":"wordfence","cve":"CVE-2026-123475","title":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant <= 8.16.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04beb4f4-abad-42a3-a817-3efbc02ed48e?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.3","to_inclusive":true,"patched_in":"9.0.0"}],"published":"2026-11-07T10:39:07Z","updated":"2026-11-10T20:01:25Z"},{"id":"wordfence:04bec1c5-10a9-4093-b7dc-c40d3de87bfd","source":"wordfence","cve":"CVE-2025-22292","title":"Powerful Auto Chat <= 1.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04bec1c5-10a9-4093-b7dc-c40d3de87bfd?source=api-prod","affected":[{"type":"plugin","slug":"powers-triggers-of-woo-to-chat","name":"Powerful Auto Chat","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-02-24T16:05:38Z"},{"id":"wordfence:04bfad0d-9c6d-41b6-8c59-516eceef9a36","source":"wordfence","cve":"CVE-2013-4462","title":"Portable phpMyAdmin <= 1.5.0 - Authentication Bypass","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04bfad0d-9c6d-41b6-8c59-516eceef9a36?source=api-prod","affected":[{"type":"plugin","slug":"portable-phpmyadmin","name":"Portable phpMyAdmin","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2013-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04c00e94-11fc-4d43-8e9d-9de719b72616","source":"wordfence","cve":"CVE-2025-23608","title":"LIVE TV <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04c00e94-11fc-4d43-8e9d-9de719b72616?source=api-prod","affected":[{"type":"plugin","slug":"live-tv","name":"LIVE TV","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:08:18Z"},{"id":"wordfence:04c23273-47de-4f40-8254-14c86b8362ff","source":"wordfence","cve":"CVE-2025-23913","title":"WordPress Google Map Professional <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04c23273-47de-4f40-8254-14c86b8362ff?source=api-prod","affected":[{"type":"plugin","slug":"google-map-professional","name":"WordPress Google Map Professional (Map In Your Language)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:58:54Z"},{"id":"wordfence:04c2b756-72b3-4edb-8ee7-3ee0cb9c25e6","source":"wordfence","cve":"CVE-2026-66673","title":"Flatastic - Versatile MultiVendor WordPress Theme <= 2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04c2b756-72b3-4edb-8ee7-3ee0cb9c25e6?source=api-prod","affected":[{"type":"plugin","slug":"flatastic","name":"Flatastic - Versatile MultiVendor WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:12:05Z"},{"id":"wordfence:04c66c9e-da3b-4b33-9bbd-9bff0828633e","source":"wordfence","cve":"CVE-2026-95600","title":"TrustedLogin Connector <= 2.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04c66c9e-da3b-4b33-9bbd-9bff0828633e?source=api-prod","affected":[{"type":"plugin","slug":"trustedlogin-connector","name":"TrustedLogin Connector","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-23T13:55:14Z"},{"id":"wordfence:04c84f52-7a97-4d86-ab9a-f8b9dfbd213b","source":"wordfence","cve":"CVE-2025-66089","title":"Product Feed for WooCommerce <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04c84f52-7a97-4d86-ab9a-f8b9dfbd213b?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-product-feed","name":"WebToffee WooCommerce Product Feeds \u2013 Google Shopping, Pinterest, TikTok Ads, & More","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-25T15:51:11Z"},{"id":"wordfence:04cc4b99-8c27-4f95-b860-608c01af843b","source":"wordfence","cve":"CVE-2026-96562","title":"Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04cc4b99-8c27-4f95-b860-608c01af843b?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.14.1","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2026-10-15T15:59:56Z","updated":"2026-10-16T04:26:58Z"},{"id":"wordfence:04cd7528-65af-4280-a683-ffedf66a6940","source":"wordfence","cve":"CVE-2026-32394","title":"PublishPress Capabilities <= 2.31.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04cd7528-65af-4280-a683-ffedf66a6940?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.31.0","to_inclusive":true,"patched_in":"2.32.0"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T21:11:40Z"},{"id":"wordfence:04cd8da4-9da3-4c80-a77e-c2f792391593","source":"wordfence","cve":"CVE-2022-2445","title":"Ultimate Member \u2013 User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal","severity":"medium","cvss":4.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04cd8da4-9da3-4c80-a77e-c2f792391593?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"1.0","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04d51f3c-4dff-4777-b46c-516546560d90","source":"wordfence","cve":"CVE-2026-49073","title":"Booking (Reservation & Appointment) <= 3.0.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04d51f3c-4dff-4777-b46c-516546560d90?source=api-prod","affected":[{"type":"plugin","slug":"directorist-booking","name":"Booking (Reservation & Appointment)","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:22:43Z"},{"id":"wordfence:04d7a97c-c2f8-4c9e-b913-343c8e3dec26","source":"wordfence","cve":"CVE-2024-4664","title":"WP Chat App <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04d7a97c-c2f8-4c9e-b913-343c8e3dec26?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-06-06T00:00:00Z","updated":"2024-07-01T19:54:21Z"},{"id":"wordfence:04d8b1bf-d514-4908-a30e-6ff7b8e03f82","source":"wordfence","cve":"CVE-2012-6719","title":"Sharebar <= 1.2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04d8b1bf-d514-4908-a30e-6ff7b8e03f82?source=api-prod","affected":[{"type":"plugin","slug":"sharebar","name":"Sharebar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04d9c206-b40d-436a-93f3-bd7e3bb49892","source":"wordfence","cve":"CVE-2024-29930","title":"Crypto Converter Widget <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04d9c206-b40d-436a-93f3-bd7e3bb49892?source=api-prod","affected":[{"type":"plugin","slug":"crypto-converter-widget","name":"Crypto Converter \u26a1 Widget","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T16:39:13Z"},{"id":"wordfence:04df6505-46c1-4e66-a363-4ccebacb5e42","source":"wordfence","cve":"CVE-2023-28933","title":"Call Now Accessibility Button <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04df6505-46c1-4e66-a363-4ccebacb5e42?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-help-button","name":"Call Now Accessibility Button","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04df6d4b-7beb-4347-9f88-a6cfaad389aa","source":"wordfence","cve":"CVE-2025-58863","title":"Zoomify embed for WP <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04df6d4b-7beb-4347-9f88-a6cfaad389aa?source=api-prod","affected":[{"type":"plugin","slug":"zoom-image-shortcode","name":"Zoomify embed for WP","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:04:20Z"},{"id":"wordfence:04e0b17e-efab-4b08-8c8a-93e3e4baffaa","source":"wordfence","cve":"CVE-2019-17675","title":"WordPress Core < 5.2.4 - Type Confusion","severity":"medium","cvss":5.5,"cwe":"CWE-843","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04e0b17e-efab-4b08-8c8a-93e3e4baffaa?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04e0ddff-16af-4c85-b5b0-cf767684ee08","source":"wordfence","cve":"CVE-2024-6088","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04e0ddff-16af-4c85-b5b0-cf767684ee08?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8.1","to_inclusive":true,"patched_in":"4.2.6.8.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T11:01:35Z"},{"id":"wordfence:04e2f1f3-95c9-4a90-8c76-7b405a3815f7","source":"wordfence","cve":"CVE-2022-44583","title":"WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Download","severity":"high","cvss":8.6,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04e2f1f3-95c9-4a90-8c76-7b405a3815f7?source=api-prod","affected":[{"type":"plugin","slug":"watchtowerhq","name":"WatchTowerHQ","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":true,"patched_in":"3.6.16"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04e64fe3-6502-4303-b1f1-1bd62ca00a9c","source":"wordfence","cve":"CVE-2025-68562","title":"MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04e64fe3-6502-4303-b1f1-1bd62ca00a9c?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"8.7.4"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-06T14:39:55Z"},{"id":"wordfence:04ea5758-2400-4885-8342-c57d61206ef1","source":"wordfence","cve":"CVE-2026-126173","title":"AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ea5758-2400-4885-8342-c57d61206ef1?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp-webhooks","name":"AutomatorWP Webhooks","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-11-13T15:42:28Z","updated":"2026-11-13T15:42:28Z"},{"id":"wordfence:04eb82e4-1738-44c7-980e-8e33a7a3a23a","source":"wordfence","cve":"CVE-2026-3640","title":"STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04eb82e4-1738-44c7-980e-8e33a7a3a23a?source=api-prod","affected":[{"type":"plugin","slug":"strabl-a-checkout-solution","name":"STRABL \u2013 A checkout solution","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2026-06-18T17:50:04Z","updated":"2026-06-19T06:51:07Z"},{"id":"wordfence:04ee71cb-500c-4685-b26d-1460dee7c759","source":"wordfence","cve":"CVE-2026-81802","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.6.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ee71cb-500c-4685-b26d-1460dee7c759?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-09-07T13:37:00Z","updated":"2026-09-10T19:33:45Z"},{"id":"wordfence:04ef55ed-6aa3-488e-b233-acc44502ae5f","source":"wordfence","cve":"CVE-2025-32535","title":"DN Shipping by Weight for WooCommerce <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ef55ed-6aa3-488e-b233-acc44502ae5f?source=api-prod","affected":[{"type":"plugin","slug":"dn-shipping-by-weight","name":"Shipping by Weight for WooCommerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:24:05Z"},{"id":"wordfence:04f0bffb-07bd-41f1-8e65-17ded38a8e2e","source":"wordfence","cve":"CVE-2025-31550","title":"WP-LESS <= 1.9.6 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04f0bffb-07bd-41f1-8e65-17ded38a8e2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-less","name":"WP-LESS","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-16T15:14:03Z"},{"id":"wordfence:04f1f701-4793-4783-a274-19688fff181e","source":"wordfence","cve":"CVE-2025-46440","title":"kStats Reloaded <= 0.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04f1f701-4793-4783-a274-19688fff181e?source=api-prod","affected":[{"type":"plugin","slug":"kstats-reloaded","name":"kStats Reloaded","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:19:10Z"},{"id":"wordfence:04f2ebf8-5721-4db7-8fc0-f2ae05e94239","source":"wordfence","cve":"CVE-2023-5934","title":"Travelpayouts <= 1.1.12 - Cross-Site Request Forgery to Settings Import","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04f2ebf8-5721-4db7-8fc0-f2ae05e94239?source=api-prod","affected":[{"type":"plugin","slug":"travelpayouts","name":"Travelpayouts: All Travel Brands in One Place","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2024-01-26T00:00:00Z","updated":"2025-05-27T14:32:22Z"},{"id":"wordfence:04f37062-da7e-4c26-ab15-50dcef8ca301","source":"wordfence","cve":"CVE-2015-9481","title":"Diplomat Theme <= 1.0.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04f37062-da7e-4c26-ab15-50dcef8ca301?source=api-prod","affected":[{"type":"theme","slug":"diplomat","name":"Diplomat | Political Campaign, Party, Blog Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:04fd2d7a-fa75-4b9d-9514-5c24ca5ebc22","source":"wordfence","cve":"CVE-2024-13737","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04fd2d7a-fa75-4b9d-9514-5c24ca5ebc22?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.57","to_inclusive":true,"patched_in":"1.4.58"}],"published":"2025-03-21T14:06:43Z","updated":"2025-03-22T02:22:12Z"},{"id":"wordfence:04ffc248-2b5c-4c64-8bfd-361a8ff6a8af","source":"wordfence","cve":"CVE-2023-47516","title":"Category Post List Widget <= 2.0 - Cross-Site Request Forgery via get_cplw_settings","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04ffc248-2b5c-4c64-8bfd-361a8ff6a8af?source=api-prod","affected":[{"type":"plugin","slug":"category-post-list-widget","name":"Category Post List Widget","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0500c57a-3983-46e4-92fa-85f7fd47eba8","source":"wordfence","cve":"CVE-2024-6559","title":"XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0500c57a-3983-46e4-92fa-85f7fd47eba8?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T06:43:32Z"},{"id":"wordfence:050152d0-a99a-42ae-93fa-b6f9f1eddffc","source":"wordfence","cve":"CVE-2024-3748","title":"SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050152d0-a99a-42ae-93fa-b6f9f1eddffc?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.71","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:28:50Z"},{"id":"wordfence:0502c622-975f-4218-8b53-efd776fe9d99","source":"wordfence","cve":"CVE-2015-9313","title":"NewStatPress < 1.0.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0502c622-975f-4218-8b53-efd776fe9d99?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:050301c3-3236-43d2-9ecc-4469697d4c05","source":"wordfence","cve":"CVE-2024-38674","title":"SKT Addons for Elementor <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050301c3-3236-43d2-9ecc-4469697d4c05?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-10-07T20:28:20Z"},{"id":"wordfence:05042006-aff6-4ba6-ae67-249dc0dcbb93","source":"wordfence","cve":"CVE-2021-24550","title":"Broken Link Manager <= 0.6.5 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05042006-aff6-4ba6-ae67-249dc0dcbb93?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-manager","name":"Broken Link Manager","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05056d99-ce19-4d41-844f-7757361fbe24","source":"wordfence","cve":"CVE-2025-69394","title":"Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05056d99-ce19-4d41-844f-7757361fbe24?source=api-prod","affected":[{"type":"plugin","slug":"cnvrse","name":"Cnvrse","from":"*","from_inclusive":true,"to":"026.02.10.20","to_inclusive":false,"patched_in":"026.02.10.20"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T13:37:25Z"},{"id":"wordfence:0505d023-a5b9-4c86-aa9b-57ce2335f127","source":"wordfence","cve":"CVE-2024-38792","title":"Language Translate Widget for WordPress \u2013 ConveyThis <= 234 - Missing Authorization to Limited Option Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0505d023-a5b9-4c86-aa9b-57ce2335f127?source=api-prod","affected":[{"type":"plugin","slug":"conveythis-translate","name":"ConveyThis AI Multilingual Translation","from":"*","from_inclusive":true,"to":"234","to_inclusive":true,"patched_in":"235"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:02:09Z"},{"id":"wordfence:050647a8-6743-46e4-b31c-0b5bd4a1007f","source":"wordfence","cve":"CVE-2024-1503","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050647a8-6743-46e4-b31c-0b5bd4a1007f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T23:33:49Z"},{"id":"wordfence:0506f360-17c3-4cc8-9ac7-988c056c3caf","source":"wordfence","cve":"CVE-2022-3300","title":"Form Maker <= 1.15.5 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0506f360-17c3-4cc8-9ac7-988c056c3caf?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.5","to_inclusive":true,"patched_in":"1.15.6"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0509aaf1-8aae-42e5-84d3-ea9b431703f3","source":"wordfence","cve":"CVE-2025-14866","title":"Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0509aaf1-8aae-42e5-84d3-ea9b431703f3?source=api-prod","affected":[{"type":"plugin","slug":"melapress-role-editor","name":"Melapress Role Editor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-23T12:26:59Z"},{"id":"wordfence:050b6ad4-f1e4-403f-9e0e-7fc18504f661","source":"wordfence","cve":"CVE-2024-33551","title":"XStore Core <= 5.3.8 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050b6ad4-f1e4-403f-9e0e-7fc18504f661?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:42:35Z"},{"id":"wordfence:050ca18d-7596-4094-b24a-752857f5e478","source":"wordfence","cve":"CVE-2023-31078","title":"WP BrowserUpdate <= 4.4.1 - Cross-Site Request Forgery via wpbu_administration","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050ca18d-7596-4094-b24a-752857f5e478?source=api-prod","affected":[{"type":"plugin","slug":"wp-browser-update","name":"WP BrowserUpdate","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:050d0352-c0a5-41b0-bf40-914f6bf7cba4","source":"wordfence","cve":"CVE-2024-11442","title":"Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050d0352-c0a5-41b0-bf40-914f6bf7cba4?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-scroll-image-slideshow","name":"Horizontal scroll image slideshow","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:18:24Z","updated":"2024-12-12T03:23:04Z"},{"id":"wordfence:050f1c42-7635-41f4-a2b2-97461b5070c8","source":"wordfence","cve":"CVE-2025-23730","title":"FLX Dashboard Groups <= 0.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/050f1c42-7635-41f4-a2b2-97461b5070c8?source=api-prod","affected":[{"type":"plugin","slug":"flx-dashboard-groups","name":"FLX Dashboard Groups","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:54:09Z"},{"id":"wordfence:0512e478-210f-42a9-86ea-a892cd6cfcd1","source":"wordfence","cve":"","title":"Internal Links Manager <= 2.1.0 - Multiple Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0512e478-210f-42a9-86ea-a892cd6cfcd1?source=api-prod","affected":[{"type":"plugin","slug":"seo-automated-link-building","name":"Internal Links Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2020-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05131b5d-3837-4679-920b-8fadf74a69c9","source":"wordfence","cve":"CVE-2015-9523","title":"Easy Digital Downloads \u2013 Recommended Products <= 1.2.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05131b5d-3837-4679-920b-8fadf74a69c9?source=api-prod","affected":[{"type":"plugin","slug":"recommended-products-edd","name":"Recommended Products - EDD","from":"*","from_inclusive":true,"to":"1.2.3.2","to_inclusive":true,"patched_in":"1.2.3.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0513cd66-604c-428d-a19d-e41bb3b1a74d","source":"wordfence","cve":"CVE-2026-96337","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.17.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0513cd66-604c-428d-a19d-e41bb3b1a74d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.3","to_inclusive":true,"patched_in":"4.17.4"}],"published":"2026-10-02T07:49:25Z","updated":"2026-10-13T14:48:49Z"},{"id":"wordfence:05144b8d-2dad-4a40-abe7-ecde837ec350","source":"wordfence","cve":"CVE-2023-23899","title":"Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05144b8d-2dad-4a40-abe7-ecde837ec350?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05153b11-2f26-425e-99ab-93216861802b","source":"wordfence","cve":"CVE-2024-12025","title":"Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05153b11-2f26-425e-99ab-93216861802b?source=api-prod","affected":[{"type":"plugin","slug":"collapsing-categories","name":"Collapsing Categories","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T03:22:05Z"},{"id":"wordfence:0516aa04-ff94-4da4-80b7-ea351d11a288","source":"wordfence","cve":"CVE-2025-32492","title":"Admin Menu Post List <= 2.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0516aa04-ff94-4da4-80b7-ea351d11a288?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-post-list","name":"Admin Menu Post List","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:11:18Z"},{"id":"wordfence:05178bf3-3040-41aa-ba43-779376d30298","source":"wordfence","cve":"CVE-2025-1475","title":"WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05178bf3-3040-41aa-ba43-779376d30298?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T06:40:02Z"},{"id":"wordfence:0519d77a-2fbd-48d5-bc2b-9efb84f9e559","source":"wordfence","cve":"CVE-2024-48025","title":"Simple Baseball Scoreboard <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0519d77a-2fbd-48d5-bc2b-9efb84f9e559?source=api-prod","affected":[{"type":"plugin","slug":"simple-baseball-scoreboard","name":"Simple Baseball Scoreboard","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:50:27Z"},{"id":"wordfence:051a3967-ef86-49bc-b72c-23e43568fef6","source":"wordfence","cve":"CVE-2026-7654","title":"Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/051a3967-ef86-49bc-b72c-23e43568fef6?source=api-prod","affected":[{"type":"plugin","slug":"codepress-admin-columns","name":"Admin Columns","from":"*","from_inclusive":true,"to":"7.0.18","to_inclusive":true,"patched_in":"7.0.19"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-05T22:28:07Z"},{"id":"wordfence:051a987a-944a-4898-872b-0456f0f59b27","source":"wordfence","cve":"CVE-2024-9169","title":"litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/051a987a-944a-4898-872b-0456f0f59b27?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.5"}],"published":"2024-09-24T20:10:10Z","updated":"2025-06-05T17:22:05Z"},{"id":"wordfence:05206a31-033e-49b9-9b66-5a6165782643","source":"wordfence","cve":"","title":"Table of Contents Plus <= 2302 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05206a31-033e-49b9-9b66-5a6165782643?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-plus","name":"Table of Contents Plus \u2013 Automatic Table of Contents for Posts & Pages","from":"*","from_inclusive":true,"to":"2309","to_inclusive":false,"patched_in":"2309"}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05220967-dd42-4cb9-9c2f-9c7ac3c0926b","source":"wordfence","cve":"CVE-2023-39311","title":"Fusion Builder <= 3.11.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05220967-dd42-4cb9-9c2f-9c7ac3c0926b?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:052aeacb-6bb4-400f-993f-d1eff8dd1006","source":"wordfence","cve":"CVE-2025-69078","title":"Malta <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052aeacb-6bb4-400f-993f-d1eff8dd1006?source=api-prod","affected":[{"type":"theme","slug":"malta","name":"Malta - Windsurfing, Kitesurfing & Wakesurfing Center WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:31:15Z"},{"id":"wordfence:052b345a-7b71-4de5-9bf8-8b81cc1b4e77","source":"wordfence","cve":"CVE-2022-45815","title":"GDPR Compliance & Cookie Consent <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052b345a-7b71-4de5-9bf8-8b81cc1b4e77?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliance-cookie-consent","name":"GDPR Compliance & Cookie Consent","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:052be7d6-bc76-4af9-bf65-2494a46156fc","source":"wordfence","cve":"CVE-2025-46533","title":"Landing pages and Domain aliases for WordPress <= 0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052be7d6-bc76-4af9-bf65-2494a46156fc?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages-and-domain-aliases","name":"Landing pages and Domain aliases for WordPress","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:35:04Z"},{"id":"wordfence:052c4b9c-c944-4599-95a7-21a05775b875","source":"wordfence","cve":"","title":"WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Customizer Selective Refresh","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052c4b9c-c944-4599-95a7-21a05775b875?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"5.0.31"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T15:50:55Z"},{"id":"wordfence:052dce55-c02d-4e66-b500-bf6160a5b188","source":"wordfence","cve":"CVE-2022-2864","title":"demon image annotation <= 4.7 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052dce55-c02d-4e66-b500-bf6160a5b188?source=api-prod","affected":[{"type":"plugin","slug":"demon-image-annotation","name":"demon image annotation","from":"1.0","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:052ea3af-96d8-4e83-b4e7-3db30b556d0d","source":"wordfence","cve":"CVE-2023-34185","title":"NextGen GalleryView <= 0.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/052ea3af-96d8-4e83-b4e7-3db30b556d0d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-nextgen-galleryview","name":"WordPress NextGen GalleryView","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0531ca34-5d7b-4071-a1aa-934f14b87728","source":"wordfence","cve":"CVE-2023-5464","title":"Jquery accordion slideshow <= 8.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0531ca34-5d7b-4071-a1aa-934f14b87728?source=api-prod","affected":[{"type":"plugin","slug":"jquery-accordion-slideshow","name":"Jquery accordion slideshow","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0534bc03-5d7d-47fe-9c07-c9a61af38df2","source":"wordfence","cve":"CVE-2003-1598","title":"WordPress Core < 0.72 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0534bc03-5d7d-47fe-9c07-c9a61af38df2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"0.72","to_inclusive":false,"patched_in":"0.72"}],"published":"2003-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05379fe4-4924-4978-ad3f-a6208eee9d81","source":"wordfence","cve":"CVE-2026-25344","title":"Review Schema \u2013 Review & Structure Data Schema Plugin <= 2.2.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05379fe4-4924-4978-ad3f-a6208eee9d81?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:24:34Z"},{"id":"wordfence:0538f5dc-0f1e-40e7-a179-7b8d30b85ecc","source":"wordfence","cve":"CVE-2025-52823","title":"Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0538f5dc-0f1e-40e7-a179-7b8d30b85ecc?source=api-prod","affected":[{"type":"plugin","slug":"cubeportfolio","name":"WordPress Image Gallery Plugin \u2013 WordPress Photo Gallery","from":"*","from_inclusive":true,"to":"1.16.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:18:29Z"},{"id":"wordfence:053b72c6-07bb-4e9f-ae25-da4bce91ae6e","source":"wordfence","cve":"CVE-2023-45269","title":"Simple SEO <= 2.0.25 - Cross-Site Request Forgery via multiple admin_post functions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/053b72c6-07bb-4e9f-ae25-da4bce91ae6e?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"2.0.25","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:053bb01c-9e87-4836-ae1c-567272b21118","source":"wordfence","cve":"","title":"Registration Forms \u2013 User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations for WordPress  2.0.14 - 2.0.15 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/053bb01c-9e87-4836-ae1c-567272b21118?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"2.0.14","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2015-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:053d374e-68b2-4d48-af6d-45087d5ce211","source":"wordfence","cve":"CVE-2022-1612","title":"Webriti SMTP Mail <= 1.0 - Cross-Site Request Forgery to options update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/053d374e-68b2-4d48-af6d-45087d5ce211?source=api-prod","affected":[{"type":"plugin","slug":"webriti-smtp-mail","name":"Webriti SMTP Mail","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0540f70d-009a-4776-8717-f096e30a11d3","source":"wordfence","cve":"CVE-2024-13844","title":"Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0540f70d-009a-4776-8717-f096e30a11d3?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-03-07T16:21:23Z","updated":"2025-03-08T05:30:09Z"},{"id":"wordfence:0542f8bf-8fb1-4c47-89b7-106a6feacca1","source":"wordfence","cve":"CVE-2023-51410","title":"WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0542f8bf-8fb1-4c47-89b7-106a6feacca1?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-06T15:47:01Z"},{"id":"wordfence:05431aaa-5d8f-422c-b7ce-955a778f7f55","source":"wordfence","cve":"CVE-2015-9499","title":"Showbiz Pro Responsive Teaser WordPress Plugin <= 1.7.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05431aaa-5d8f-422c-b7ce-955a778f7f55?source=api-prod","affected":[{"type":"plugin","slug":"showbizpro","name":"Showbiz Pro Responsive Teaser WordPress Plugin","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2014-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05448e64-6179-4409-a197-7cdc3c4f1563","source":"wordfence","cve":"","title":"DrawBlog < 0.81 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05448e64-6179-4409-a197-7cdc3c4f1563?source=api-prod","affected":[{"type":"plugin","slug":"drawblog","name":"DrawBlog","from":"*","from_inclusive":true,"to":"0.81","to_inclusive":false,"patched_in":"0.81"}],"published":"2013-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05481984-7c18-4ec7-8d7c-831809c3e86b","source":"wordfence","cve":"CVE-2021-4337","title":"Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05481984-7c18-4ec7-8d7c-831809c3e86b?source=api-prod","affected":[{"type":"plugin","slug":"prdctfltr","name":"Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":false,"patched_in":"8.2.0"},{"type":"plugin","slug":"improved-sale-badges","name":"Improved Sale Badges for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":false,"patched_in":"4.4.0"},{"type":"plugin","slug":"xforwoocommerce","name":"XforWooCommerce","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"},{"type":"plugin","slug":"woocommerce-frontend-shop-manager","name":"Live Product Editor for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":false,"patched_in":"4.7.0"},{"type":"plugin","slug":"woocommerce-warranties-and-returns","name":"Warranties and Returns for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"},{"type":"plugin","slug":"price-commander-xforwc","name":"Price Commander for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"improved-variable-product-attributes","name":"Improved Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"},{"type":"plugin","slug":"spam-control-xforwc","name":"Comment and Review Spam Control for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"package-quantity-xforwc","name":"Package Quantity Discount","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"share-print-pdf-woocommerce","name":"Share, Print and PDF Products for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"},{"type":"plugin","slug":"bulk-add-to-cart-xforwc","name":"Bulk Add to Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"live-search-xforwc","name":"Live Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"},{"type":"plugin","slug":"floating-cart-xforwc","name":"Floating Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"add-tabs-xforwc","name":"Add Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"product-loops","name":"Product Loops for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"},{"type":"plugin","slug":"seo-for-woocommerce","name":"Autopilot SEO for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2021-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0548608d-17d5-46f4-9d64-6e3b0552bf9d","source":"wordfence","cve":"CVE-2026-5364","title":"Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0548608d-17d5-46f4-9d64-6e3b0552bf9d?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-for-contact-form-7","name":"Drag and Drop File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-04-23T16:36:09Z","updated":"2026-04-24T05:29:41Z"},{"id":"wordfence:054929b0-af2b-4253-af01-d510a265521c","source":"wordfence","cve":"CVE-2026-16600","title":"SmartAIPress <= 1.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/054929b0-af2b-4253-af01-d510a265521c?source=api-prod","affected":[{"type":"plugin","slug":"smartaipress","name":"SmartAIPress","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:34:55Z"},{"id":"wordfence:0549acd5-686b-4505-af68-f3f854096f63","source":"wordfence","cve":"CVE-2018-0585","title":"Ultimate Member <= 1.3.88 - Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0549acd5-686b-4505-af68-f3f854096f63?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.88","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:054bb123-132c-4c32-9fd1-a9f289cfdc35","source":"wordfence","cve":"CVE-2014-125093","title":"Ad Blocking Detector  <= 1.2.1 -  Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/054bb123-132c-4c32-9fd1-a9f289cfdc35?source=api-prod","affected":[{"type":"plugin","slug":"ad-blocking-detector","name":"Ad Blocking Detector","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2014-04-21T00:00:00Z","updated":"2024-06-20T16:44:09Z"},{"id":"wordfence:054bfe24-1501-4f97-a421-2de78d20d8cc","source":"wordfence","cve":"CVE-2026-110963","title":"Userplace <= 1.2.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/054bfe24-1501-4f97-a421-2de78d20d8cc?source=api-prod","affected":[{"type":"plugin","slug":"userplace-member-subscription-restriction-payments","name":"Userplace \u2013 Member Subscription, Restriction & Payments","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:14:40Z"},{"id":"wordfence:054da118-b268-4dbf-80d3-5ff885f00500","source":"wordfence","cve":"CVE-2026-16261","title":"Login Social <= 1.0.4 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/054da118-b268-4dbf-80d3-5ff885f00500?source=api-prod","affected":[{"type":"plugin","slug":"login-social","name":"login-social","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:26:23Z"},{"id":"wordfence:054f6ed4-75fc-4431-9249-48f41860d682","source":"wordfence","cve":"CVE-2017-17096","title":"Content Cards <= 0.9.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/054f6ed4-75fc-4431-9249-48f41860d682?source=api-prod","affected":[{"type":"plugin","slug":"content-cards","name":"Content Cards","from":"*","from_inclusive":true,"to":"0.9.6","to_inclusive":true,"patched_in":"0.9.7"}],"published":"2017-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0551a2ca-b920-4a60-9c16-0bb14fd63a23","source":"wordfence","cve":"CVE-2022-35725","title":"wp-forecast <= 7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0551a2ca-b920-4a60-9c16-0bb14fd63a23?source=api-prod","affected":[{"type":"plugin","slug":"wp-forecast","name":"wp-forecast","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"8.0"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0551bd2d-b196-4382-be33-07319c2e1614","source":"wordfence","cve":"CVE-2025-23635","title":"ePermissions <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0551bd2d-b196-4382-be33-07319c2e1614?source=api-prod","affected":[{"type":"plugin","slug":"epermissions","name":"ePermissions","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T21:04:33Z"},{"id":"wordfence:05529ca0-09f5-4047-9972-c0a2872ea857","source":"wordfence","cve":"CVE-2018-19040","title":"Media File Manager <= 1.4.2 -  Directory Traversal to Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05529ca0-09f5-4047-9972-c0a2872ea857?source=api-prod","affected":[{"type":"plugin","slug":"media-file-manager","name":"Media File Manager","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2018-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05544f69-bc9b-4270-80c9-96afe4793cb6","source":"wordfence","cve":"CVE-2009-2143","title":"FireStats < 1.6.2 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05544f69-bc9b-4270-80c9-96afe4793cb6?source=api-prod","affected":[{"type":"plugin","slug":"firestats","name":"firestats","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2009-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0556738f-5c3c-4ff6-9432-d666328dc5e5","source":"wordfence","cve":"CVE-2025-63043","title":"Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0556738f-5c3c-4ff6-9432-d666328dc5e5?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.19","to_inclusive":true,"patched_in":""}],"published":"2025-12-03T00:00:00Z","updated":"2026-07-16T18:46:50Z"},{"id":"wordfence:055979ad-84d9-4f72-872d-ee86b9b062af","source":"wordfence","cve":"CVE-2024-8397","title":"GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/055979ad-84d9-4f72-872d-ee86b9b062af?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-gdpr-cookie-consent","name":"GDPR Cookie Consent","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T15:46:29Z"},{"id":"wordfence:055a891b-ee05-431f-aaff-612b3fd1513d","source":"wordfence","cve":"CVE-2024-5280","title":"WP Affiliate Platform <= 6.5.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/055a891b-ee05-431f-aaff-612b3fd1513d?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T17:45:58Z"},{"id":"wordfence:055b7ed5-268a-485e-ac7d-8082dc9fb2ad","source":"wordfence","cve":"CVE-2023-5531","title":"Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/055b7ed5-268a-485e-ac7d-8082dc9fb2ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:055cc26b-1e24-4e39-89c8-bdc4a69ce938","source":"wordfence","cve":"CVE-2023-49842","title":"Rocket Maintenance Mode & Coming Soon Page <= 4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/055cc26b-1e24-4e39-89c8-bdc4a69ce938?source=api-prod","affected":[{"type":"plugin","slug":"rocket-maintenance-mode","name":"Rocket Maintenance Mode & Coming Soon Page","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-12-06T00:00:00Z","updated":"2024-03-22T15:21:47Z"},{"id":"wordfence:055d50de-8a7f-40fa-88e9-f57046c0c450","source":"wordfence","cve":"CVE-2025-49029","title":"Custom Login And Signup Widget <= 1.0 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/055d50de-8a7f-40fa-88e9-f57046c0c450?source=api-prod","affected":[{"type":"plugin","slug":"custom-login-and-signup-widget","name":"Custom Login And Signup Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T17:16:57Z"},{"id":"wordfence:05614ee6-ce14-44fe-a819-8f116563dbdd","source":"wordfence","cve":"CVE-2023-24398","title":"EZP Coming Soon Page <= 1.0.7.3 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05614ee6-ce14-44fe-a819-8f116563dbdd?source=api-prod","affected":[{"type":"plugin","slug":"easy-pie-coming-soon","name":"EZP Coming Soon Page","from":"*","from_inclusive":true,"to":"1.0.73","to_inclusive":true,"patched_in":"1.0.74"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0563d2f0-fb29-4030-8d01-c257dda78241","source":"wordfence","cve":"CVE-2023-25037","title":"Booking Calendar Contact Form <= 1.2.34 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0563d2f0-fb29-4030-8d01-c257dda78241?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.34","to_inclusive":true,"patched_in":"1.2.35"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0563f873-994d-47ab-a7b9-e85d1bc97f9e","source":"wordfence","cve":"CVE-2026-22367","title":"Coworking <= 1.6.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0563f873-994d-47ab-a7b9-e85d1bc97f9e?source=api-prod","affected":[{"type":"theme","slug":"coworking","name":"Coworking - Open Office & Creative Space WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:31:07Z"},{"id":"wordfence:0564a9a1-a767-4192-8cb0-65c6fc4d064d","source":"wordfence","cve":"CVE-2022-34857","title":"SP Project & Document Manager <= 4.59 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0564a9a1-a767-4192-8cb0-65c6fc4d064d?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.59","to_inclusive":true,"patched_in":"4.62"}],"published":"2022-08-10T12:34:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0565cdf1-55fe-4676-8529-8c79be5e8b01","source":"wordfence","cve":"CVE-2025-4172","title":"VerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0565cdf1-55fe-4676-8529-8c79be5e8b01?source=api-prod","affected":[{"type":"plugin","slug":"vertical-response-newsletter-widget","name":"VerticalResponse Newsletter Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:29:20Z","updated":"2025-05-03T01:43:04Z"},{"id":"wordfence:056819fb-7087-4794-9936-312ab54c96cd","source":"wordfence","cve":"CVE-2023-47806","title":"Disable User Login <= 1.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/056819fb-7087-4794-9936-312ab54c96cd?source=api-prod","affected":[{"type":"plugin","slug":"disable-user-login","name":"Disable User Login","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:056884d2-d737-4ae5-b800-cb2ff31347ab","source":"wordfence","cve":"CVE-2026-7623","title":"SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/056884d2-d737-4ae5-b800-cb2ff31347ab?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-07-31T12:34:14Z","updated":"2026-08-01T01:29:57Z"},{"id":"wordfence:056a6984-4753-4f52-87b0-1a3cc2f5bde2","source":"wordfence","cve":"CVE-2026-93900","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/056a6984-4753-4f52-87b0-1a3cc2f5bde2?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.44.3","to_inclusive":true,"patched_in":"1.44.4"}],"published":"2026-11-03T20:32:51Z","updated":"2026-11-04T09:26:06Z"},{"id":"wordfence:056a8372-82f3-4707-8bff-1ab91595f8dc","source":"wordfence","cve":"CVE-2025-68984","title":"Puca <= 2.6.39 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/056a8372-82f3-4707-8bff-1ab91595f8dc?source=api-prod","affected":[{"type":"theme","slug":"puca","name":"Puca - Optimized Mobile WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.6.39","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-05T19:01:35Z"},{"id":"wordfence:056d26da-6e43-4cc6-b2fd-13a5947a814e","source":"wordfence","cve":"","title":"SAICO <= 1.0.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/056d26da-6e43-4cc6-b2fd-13a5947a814e?source=api-prod","affected":[{"type":"theme","slug":"saico","name":"saico","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2013-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:057216e2-3fad-49fc-ac31-06dbd7b110f9","source":"wordfence","cve":"CVE-2025-68875","title":"Flaming Password Reset <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/057216e2-3fad-49fc-ac31-06dbd7b110f9?source=api-prod","affected":[{"type":"plugin","slug":"flaming-password-reset","name":"Flaming Password Reset","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:36:05Z"},{"id":"wordfence:0576737d-8330-4a80-af70-4f0eab6657ed","source":"wordfence","cve":"CVE-2023-37392","title":"WP Dummy Content Generator <= 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0576737d-8330-4a80-af70-4f0eab6657ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05770d2a-b4d2-49ef-9e32-4e52ae626417","source":"wordfence","cve":"CVE-2026-66670","title":"Mane <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05770d2a-b4d2-49ef-9e32-4e52ae626417?source=api-prod","affected":[{"type":"theme","slug":"mane","name":"Mane","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T11:41:36Z","updated":"2026-09-10T19:12:26Z"},{"id":"wordfence:0577200a-6565-4d2d-98f5-bffff972a61e","source":"wordfence","cve":"CVE-2024-56016","title":"Image Mapper <= 0.2.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0577200a-6565-4d2d-98f5-bffff972a61e?source=api-prod","affected":[{"type":"plugin","slug":"image-mapper","name":"Image Mapper","from":"*","from_inclusive":true,"to":"0.2.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-08T14:32:43Z"},{"id":"wordfence:05776ec2-b432-40f6-bd75-4e6ec103c497","source":"wordfence","cve":"CVE-2025-39475","title":"Arlo <= 6.0.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05776ec2-b432-40f6-bd75-4e6ec103c497?source=api-prod","affected":[{"type":"theme","slug":"arlo","name":"Arlo | Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:18:37Z"},{"id":"wordfence:0578c49e-f820-42dd-bd53-f4a281843e69","source":"wordfence","cve":"CVE-2024-23521","title":"Happyforms <= 1.25.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0578c49e-f820-42dd-bd53-f4a281843e69?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.25.10","to_inclusive":true,"patched_in":"1.25.11"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-23T15:48:09Z"},{"id":"wordfence:0578f4d1-5953-4fbe-8bc3-0569bee57a1a","source":"wordfence","cve":"CVE-2023-26540","title":"Houzez <= 2.7.1 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0578f4d1-5953-4fbe-8bc3-0569bee57a1a?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:057a440e-4917-45c5-90ab-bb8654eae68f","source":"wordfence","cve":"","title":"Quick Restaurant Menu <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/057a440e-4917-45c5-90ab-bb8654eae68f?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-menu","name":"Quick Restaurant Menu","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:057ab824-8071-4c3c-9a57-f9a0043a9ad5","source":"wordfence","cve":"","title":"Feed Them Social <= 4.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/057ab824-8071-4c3c-9a57-f9a0043a9ad5?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:057abffb-1c52-49ca-8791-ca44f0c5a011","source":"wordfence","cve":"CVE-2025-2526","title":"Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/057abffb-1c52-49ca-8791-ca44f0c5a011?source=api-prod","affected":[{"type":"theme","slug":"streamit","name":"Streamit","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T01:44:21Z"},{"id":"wordfence:057ded1d-e8b5-4134-ad20-39007096561a","source":"wordfence","cve":"CVE-2024-54252","title":"Pinpoint Booking System \u2013 #1 WordPress Booking Plugin <= 2.9.9.5.7 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/057ded1d-e8b5-4134-ad20-39007096561a?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.5.7","to_inclusive":true,"patched_in":"2.9.9.5.8"}],"published":"2024-12-05T00:00:00Z","updated":"2025-09-15T19:37:53Z"},{"id":"wordfence:05806b8f-bd39-4107-8d1a-54586f15d7a4","source":"wordfence","cve":"CVE-2025-31412","title":"JetProductGallery <= 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05806b8f-bd39-4107-8d1a-54586f15d7a4?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-product-gallery","name":"JetProductGallery","from":"*","from_inclusive":true,"to":"2.1.22","to_inclusive":true,"patched_in":"2.1.22.1"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T13:36:07Z"},{"id":"wordfence:05828bdc-74aa-4477-9178-f8cc6a34da42","source":"wordfence","cve":"CVE-2023-32602","title":"CALL ME NOW <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05828bdc-74aa-4477-9178-f8cc6a34da42?source=api-prod","affected":[{"type":"plugin","slug":"lokalyze-call-now","name":"CALL ME NOW","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0582fe7d-884c-4019-837a-861d36ccc842","source":"wordfence","cve":"CVE-2026-0916","title":"Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0582fe7d-884c-4019-837a-861d36ccc842?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-by-taxonomy","name":"Related Posts by Taxonomy","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-01-15T18:31:50Z","updated":"2026-01-23T19:02:03Z"},{"id":"wordfence:0584611c-39eb-4ed9-9e2b-aa04013f8f74","source":"wordfence","cve":"CVE-2025-30799","title":"WP Google Street View <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0584611c-39eb-4ed9-9e2b-aa04013f8f74?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-street-view","name":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:57:15Z"},{"id":"wordfence:0585969d-dd08-4058-9d72-138a55a2cdf1","source":"wordfence","cve":"CVE-2023-4506","title":"Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback","severity":"low","cvss":2.2,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0585969d-dd08-4058-9d72-138a55a2cdf1?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05873114-ceed-404c-9cc2-d85aa92ef6f3","source":"wordfence","cve":"CVE-2014-9037","title":"Wordpress Core < 4.0.1 - Hash Collision","severity":"high","cvss":8.1,"cwe":"CWE-916","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05873114-ceed-404c-9cc2-d85aa92ef6f3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0587bf5f-96cf-4a59-9209-6b559a013517","source":"wordfence","cve":"CVE-2024-37429","title":"Login with phone number <= 1.7.35 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0587bf5f-96cf-4a59-9209-6b559a013517?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.35","to_inclusive":true,"patched_in":"1.7.36"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:57:51Z"},{"id":"wordfence:058886bc-f7cf-48e0-80a8-66bb2a42bb09","source":"wordfence","cve":"CVE-2025-67618","title":"Brookside <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/058886bc-f7cf-48e0-80a8-66bb2a42bb09?source=api-prod","affected":[{"type":"theme","slug":"brookside","name":"Brookside","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T14:55:37Z"},{"id":"wordfence:058d1aa0-2ef6-49a4-b978-43a91c8e55f3","source":"wordfence","cve":"CVE-2024-0448","title":"Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/058d1aa0-2ef6-49a4-b978-43a91c8e55f3?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":true,"patched_in":"8.3.2"}],"published":"2024-01-25T00:00:00Z","updated":"2024-07-29T21:35:48Z"},{"id":"wordfence:058e47cd-55c8-48b3-8aa6-ef299886061d","source":"wordfence","cve":"CVE-2026-8698","title":"Cryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/058e47cd-55c8-48b3-8aa6-ef299886061d?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-prijsvergelijking-widget","name":"Cryptocurrency Prijsvergelijking Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:11Z","updated":"2026-05-27T05:31:18Z"},{"id":"wordfence:05909e9c-4f57-4556-bae9-b0b63a9a43ba","source":"wordfence","cve":"CVE-2024-11615","title":"Envolve Plugin <= 1.0 - Unauthenticated Language File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05909e9c-4f57-4556-bae9-b0b63a9a43ba?source=api-prod","affected":[{"type":"plugin","slug":"envolve-plugin","name":"Envolve Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-05-05T00:00:00Z","updated":"2025-05-05T16:21:46Z"},{"id":"wordfence:0590d3ad-8dd0-428e-aadd-581e53e83edb","source":"wordfence","cve":"CVE-2024-3978","title":"WordPress Jitsi Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0590d3ad-8dd0-428e-aadd-581e53e83edb?source=api-prod","affected":[{"type":"plugin","slug":"wp-jitsi-shortcodes","name":"WordPress Jitsi Shortcode","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:27:53Z"},{"id":"wordfence:0591afc1-58b2-4afb-bd7d-e0707fd1f62f","source":"wordfence","cve":"CVE-2025-60214","title":"Goldenblatt < 1.3.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0591afc1-58b2-4afb-bd7d-e0707fd1f62f?source=api-prod","affected":[{"type":"theme","slug":"goldenblatt","name":"Goldenblatt - Lawyer & Attorney WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2025-09-23T00:00:00Z","updated":"2025-11-04T16:25:46Z"},{"id":"wordfence:0592050d-4e72-4b40-a88b-b92e53c49e9e","source":"wordfence","cve":"CVE-2026-96661","title":"Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0592050d-4e72-4b40-a88b-b92e53c49e9e?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.25.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:37:47Z","updated":"2026-10-14T03:39:59Z"},{"id":"wordfence:0592380d-fd78-48ed-a180-299fc20a41ee","source":"wordfence","cve":"CVE-2026-77829","title":"Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0592380d-fd78-48ed-a180-299fc20a41ee?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-16T03:38:40Z"},{"id":"wordfence:0593311a-54d7-42b2-ad5e-185938b42452","source":"wordfence","cve":"","title":"Portfolio Gallery <= 1.0 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0593311a-54d7-42b2-ad5e-185938b42452?source=api-prod","affected":[{"type":"plugin","slug":"unitegallery","name":"Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0593c20d-3422-4817-9639-614254b609db","source":"wordfence","cve":"CVE-2026-8719","title":"AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0593c20d-3422-4817-9639-614254b609db?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"3.4.9","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-05-16T14:19:48Z","updated":"2026-05-17T02:27:03Z"},{"id":"wordfence:0594ed62-0a41-4819-89b8-ea31afbcac73","source":"wordfence","cve":"CVE-2024-6175","title":"Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0594ed62-0a41-4819-89b8-ea31afbcac73?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2024-07-17T13:49:56Z","updated":"2024-08-27T17:00:43Z"},{"id":"wordfence:0597a63d-2627-477f-874a-c35b6df7afd5","source":"wordfence","cve":"CVE-2024-10113","title":"WP AdCenter \u2013 Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0597a63d-2627-477f-874a-c35b6df7afd5?source=api-prod","affected":[{"type":"plugin","slug":"wpadcenter","name":"WP AdCenter \u2013 Ad Manager & Adsense Ads","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-11-14T16:36:44Z","updated":"2024-11-25T21:30:17Z"},{"id":"wordfence:05991bf2-ee61-4bf7-89df-c2f66db7caec","source":"wordfence","cve":"CVE-2024-30468","title":"All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05991bf2-ee61-4bf7-89df-c2f66db7caec?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2024-02-08T00:00:00Z","updated":"2024-04-03T17:04:08Z"},{"id":"wordfence:059c2d6d-1296-4463-96ae-a95ba7dad70a","source":"wordfence","cve":"CVE-2026-9197","title":"Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059c2d6d-1296-4463-96ae-a95ba7dad70a?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.36","to_inclusive":true,"patched_in":"3.5.1.37"}],"published":"2026-06-05T14:27:21Z","updated":"2026-06-06T02:28:33Z"},{"id":"wordfence:059d3ba9-8530-4977-b59a-f1c2976641d7","source":"wordfence","cve":"CVE-2024-8620","title":"MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059d3ba9-8530-4977-b59a-f1c2976641d7?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.92.2","to_inclusive":true,"patched_in":"2.93"}],"published":"2024-09-24T00:00:00Z","updated":"2025-05-29T22:41:10Z"},{"id":"wordfence:059e262b-ee63-4f8b-82ab-c12bcf70f879","source":"wordfence","cve":"CVE-2023-30749","title":"Optima Express + MarketBoost IDX Plugin <= 7.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059e262b-ee63-4f8b-82ab-c12bcf70f879?source=api-prod","affected":[{"type":"plugin","slug":"optima-express","name":"Optima Express IDX","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:059e358d-422d-48e8-a11e-fed52770f4d9","source":"wordfence","cve":"CVE-2025-22351","title":"Contact Form 7 Database \u2013 CFDB7 <= 1.0.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059e358d-422d-48e8-a11e-fed52770f4d9?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-database","name":"Contact Form 7 Database \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:36:15Z"},{"id":"wordfence:059e5358-6a29-4cae-96b4-23897797b367","source":"wordfence","cve":"CVE-2021-39320","title":"underConstruction <= 1.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059e5358-6a29-4cae-96b4-23897797b367?source=api-prod","affected":[{"type":"plugin","slug":"underconstruction","name":"underConstruction","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.19"}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:059ede2b-c163-464f-bf85-bb5ec5e6c620","source":"wordfence","cve":"CVE-2019-25738","title":"Hybrid Composer <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059ede2b-c163-464f-bf85-bb5ec5e6c620?source=api-prod","affected":[{"type":"plugin","slug":"hybrid-composer","name":"Hybrid Composer","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:32:18Z"},{"id":"wordfence:059f0c64-efcc-4b79-81eb-b4ae9e3e2826","source":"wordfence","cve":"CVE-2026-2502","title":"xmlrpc attacks blocker <= 1.0 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059f0c64-efcc-4b79-81eb-b4ae9e3e2826?source=api-prod","affected":[{"type":"plugin","slug":"xmlrpc-attacks-blocker","name":"xmlrpc attacks blocker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T16:00:32Z","updated":"2026-02-19T04:36:05Z"},{"id":"wordfence:059f526f-6769-4092-92b0-2ef6248963ee","source":"wordfence","cve":"CVE-2024-21748","title":"Icegram <= 3.1.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/059f526f-6769-4092-92b0-2ef6248963ee?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.21","to_inclusive":true,"patched_in":"3.1.22"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-08T20:27:50Z"},{"id":"wordfence:05a27a34-b324-4968-937e-2c0d24175d2a","source":"wordfence","cve":"CVE-2025-5391","title":"WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a27a34-b324-4968-937e-2c0d24175d2a?source=api-prod","affected":[{"type":"plugin","slug":"wc-purchase-orders","name":"Purchase Orders for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-08-11T13:49:35Z","updated":"2025-09-05T15:39:31Z"},{"id":"wordfence:05a36d46-236d-4a9a-8cf2-45d787e35f24","source":"wordfence","cve":"CVE-2026-105193","title":"Booking Calendar < 11.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a36d46-236d-4a9a-8cf2-45d787e35f24?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.8","to_inclusive":false,"patched_in":"11.8"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:35:15Z"},{"id":"wordfence:05a5b6be-0253-479c-a80f-19de7d8af1a5","source":"wordfence","cve":"CVE-2025-69156","title":"Kids Zone - Children WordPress <= 5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a5b6be-0253-479c-a80f-19de7d8af1a5?source=api-prod","affected":[{"type":"theme","slug":"kidszone","name":"Kids Zone - Children WordPress Theme","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:40:46Z"},{"id":"wordfence:05a67914-a4eb-4b2a-b626-1caab1c95501","source":"wordfence","cve":"CVE-2026-93513","title":"SiteSkite \u2013 Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a67914-a4eb-4b2a-b626-1caab1c95501?source=api-prod","affected":[{"type":"plugin","slug":"siteskite","name":"SiteSkite \u2013 Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-09-23T17:01:00Z","updated":"2026-09-29T19:46:37Z"},{"id":"wordfence:05a81b0e-2d25-44b5-b791-5b2aed94bbab","source":"wordfence","cve":"","title":"MyFTP <= 1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a81b0e-2d25-44b5-b791-5b2aed94bbab?source=api-prod","affected":[{"type":"plugin","slug":"myftp-ftp-like-plugin-for-wordpress","name":"myftp-ftp-like-plugin-for-wordpress","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05a9c77d-a8d6-41b6-a98e-f20638b959d6","source":"wordfence","cve":"CVE-2025-9131","title":"Ogulo \u2013 360\u00b0 Tour <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05a9c77d-a8d6-41b6-a98e-f20638b959d6?source=api-prod","affected":[{"type":"plugin","slug":"ogulo-360-tour","name":"Ogulo \u2013 360\u00b0 Tour","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-08-22T15:50:18Z","updated":"2025-10-17T19:41:09Z"},{"id":"wordfence:05aa6132-7591-4d2a-a44b-7d57a24ca8d8","source":"wordfence","cve":"CVE-2025-43834","title":"cookieBAR <= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05aa6132-7591-4d2a-a44b-7d57a24ca8d8?source=api-prod","affected":[{"type":"plugin","slug":"cookiebar","name":"cookieBAR","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:00:51Z"},{"id":"wordfence:05abc09f-903b-45a9-8cde-1bf8fd5d7d44","source":"wordfence","cve":"CVE-2025-12847","title":"All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05abc09f-903b-45a9-8cde-1bf8fd5d7d44?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2025-11-14T16:58:45Z","updated":"2025-11-15T05:45:33Z"},{"id":"wordfence:05adc3ce-209f-48ac-b5ef-8585bb9228ed","source":"wordfence","cve":"CVE-2026-16574","title":"Dokan <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05adc3ce-209f-48ac-b5ef-8585bb9228ed?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:41:09Z"},{"id":"wordfence:05b051bc-3b1c-412e-b3d0-98ff2c8bc06e","source":"wordfence","cve":"CVE-2024-3602","title":"Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers \u2013 Promolayer <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b051bc-3b1c-412e-b3d0-98ff2c8bc06e?source=api-prod","affected":[{"type":"plugin","slug":"promolayer-popup-builder","name":"Promolayer \u2013 Popup Builder & Abandonment Preventer","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-06-19T12:18:10Z","updated":"2024-07-01T15:02:03Z"},{"id":"wordfence:05b15f33-0f95-458f-8c21-16c0dd98c8bc","source":"wordfence","cve":"CVE-2025-4406","title":"wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b15f33-0f95-458f-8c21-16c0dd98c8bc?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-07-09T12:30:57Z","updated":"2025-07-10T01:43:43Z"},{"id":"wordfence:05b3c8de-6802-4eb2-855c-b13a9005963f","source":"wordfence","cve":"CVE-2025-54727","title":"CM On Demand Search And Replace <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b3c8de-6802-4eb2-855c-b13a9005963f?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:48:42Z"},{"id":"wordfence:05b434f7-6bce-4ad0-bd12-db5b01f14953","source":"wordfence","cve":"CVE-2023-45071","title":"Form Maker by 10Web <= 1.15.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b434f7-6bce-4ad0-bd12-db5b01f14953?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.18","to_inclusive":true,"patched_in":"1.15.19"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05b44698-c55f-48ff-8f98-8478b2564e38","source":"wordfence","cve":"CVE-2025-30807","title":"Next-Cart Store to WooCommerce Migration <= 3.9.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b44698-c55f-48ff-8f98-8478b2564e38?source=api-prod","affected":[{"type":"plugin","slug":"nextcart-woocommerce-migration","name":"Next-Cart Store to WooCommerce Migration","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-10T13:06:54Z"},{"id":"wordfence:05b4ef18-5224-419c-b69e-fedd1a56aabd","source":"wordfence","cve":"CVE-2026-97284","title":"Icegram Engage \u2013 Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b4ef18-5224-419c-b69e-fedd1a56aabd?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.44"}],"published":"2026-10-01T11:47:44Z","updated":"2026-10-09T00:16:11Z"},{"id":"wordfence:05b9b37e-8295-42c3-8641-0689aa2ccbb4","source":"wordfence","cve":"CVE-2026-106470","title":"Data Access <= 5.5.87 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05b9b37e-8295-42c3-8641-0689aa2ccbb4?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.87","to_inclusive":true,"patched_in":"5.5.88"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:21:04Z"},{"id":"wordfence:05bb119f-06e4-4f56-afc8-0c5a25266b02","source":"wordfence","cve":"CVE-2024-12003","title":"WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05bb119f-06e4-4f56-afc8-0c5a25266b02?source=api-prod","affected":[{"type":"plugin","slug":"wp-system","name":"WP System","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:30:01Z","updated":"2024-12-06T08:24:49Z"},{"id":"wordfence:05c1ee52-02c9-440b-9269-14ea8b73be45","source":"wordfence","cve":"CVE-2025-13354","title":"Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c1ee52-02c9-440b-9269-14ea8b73be45?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.40.1","to_inclusive":true,"patched_in":"3.41.0"}],"published":"2025-12-03T00:31:09Z","updated":"2025-12-03T13:52:44Z"},{"id":"wordfence:05c2707c-c737-4f95-83e0-b0a4e0883d4b","source":"wordfence","cve":"CVE-2023-32124","title":"Publish Confirm Message <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c2707c-c737-4f95-83e0-b0a4e0883d4b?source=api-prod","affected":[{"type":"plugin","slug":"publish-confirm-message","name":"Publish Confirm Message","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05c40628-b8fc-48ff-8819-c0955d69fce0","source":"wordfence","cve":"","title":"Pipdig Power Pack (P3) <= 4.7.3 - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c40628-b8fc-48ff-8819-c0955d69fce0?source=api-prod","affected":[{"type":"plugin","slug":"p3","name":"Pipdig Power Pack (P3)","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2019-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05c44865-26ba-44c1-8ffd-bf28c0463a54","source":"wordfence","cve":"CVE-2025-5035","title":"Firelight Lightbox <= 2.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c44865-26ba-44c1-8ffd-bf28c0463a54?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T15:29:14Z"},{"id":"wordfence:05c4d7e3-f8a8-4c11-b962-38922b0801f9","source":"wordfence","cve":"","title":"s2Framework <= 4.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c4d7e3-f8a8-4c11-b962-38922b0801f9?source=api-prod","affected":[{"type":"plugin","slug":"s2Framework","name":"s2Framework","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05c4eece-6f4c-4a19-8eea-f6d82f3bcb14","source":"wordfence","cve":"CVE-2026-28097","title":"Artrium <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c4eece-6f4c-4a19-8eea-f6d82f3bcb14?source=api-prod","affected":[{"type":"theme","slug":"artrium","name":"Artrium - Creative Agency & Web Studio WP Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:06:33Z"},{"id":"wordfence:05c50442-570b-45cf-816a-c7a5b712ba21","source":"wordfence","cve":"CVE-2026-17576","title":"InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c50442-570b-45cf-816a-c7a5b712ba21?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.13.9","to_inclusive":true,"patched_in":"1.13.10"}],"published":"2026-09-17T18:35:29Z","updated":"2026-09-18T06:38:52Z"},{"id":"wordfence:05c68377-feb6-442d-a3a0-1fbc246c7cbf","source":"wordfence","cve":"CVE-2023-4634","title":"Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.09","to_inclusive":true,"patched_in":"3.10"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05c7267e-2e0c-48e9-bdaa-c8bc0b9ec8a6","source":"wordfence","cve":"CVE-2024-9376","title":"Kata Plus \u2013 Addons for Elementor \u2013 Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05c7267e-2e0c-48e9-bdaa-c8bc0b9ec8a6?source=api-prod","affected":[{"type":"plugin","slug":"kata-plus","name":"Kata Plus \u2013 Addons for Elementor \u2013 Widgets, Extensions and Templates","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-10-28T20:39:05Z","updated":"2024-10-29T09:31:29Z"},{"id":"wordfence:05cac571-6689-4a69-b600-3cfeaa1d3c47","source":"wordfence","cve":"CVE-2024-31100","title":"Popup Cart Lite for WooCommerce <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05cac571-6689-4a69-b600-3cfeaa1d3c47?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-woocart-popup-lite","name":"Popup Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:56:05Z"},{"id":"wordfence:05cd8f96-533a-4036-a01f-6ba1ad2d2b5e","source":"wordfence","cve":"CVE-2024-2129","title":"WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05cd8f96-533a-4036-a01f-6ba1ad2d2b5e?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-03-19T00:00:00Z","updated":"2024-06-06T12:44:11Z"},{"id":"wordfence:05ce62ce-a02f-431e-95b1-ade38988e3ad","source":"wordfence","cve":"CVE-2026-6898","title":"WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ce62ce-a02f-431e-95b1-ade38988e3ad?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.31.0"}],"published":"2026-05-22T16:22:39Z","updated":"2026-05-23T04:27:17Z"},{"id":"wordfence:05cf8f25-d8ee-4208-aef9-0c4d995b7901","source":"wordfence","cve":"CVE-2025-26911","title":"System Dashboard <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05cf8f25-d8ee-4208-aef9-0c4d995b7901?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:43:26Z"},{"id":"wordfence:05d063e3-4863-4dd5-9219-6240b9b3f939","source":"wordfence","cve":"CVE-2026-39502","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d063e3-4863-4dd5-9219-6240b9b3f939?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.38","to_inclusive":true,"patched_in":"1.15.39"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:10:58Z"},{"id":"wordfence:05d26003-ae7e-480a-bd63-1c5f5e9c3cab","source":"wordfence","cve":"CVE-2024-29936","title":"Image Hover Effects \u2013 Elementor Addon <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d26003-ae7e-480a-bd63-1c5f5e9c3cab?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-addon-for-elementor","name":"Image Hover Effects \u2013 Elementor Addon","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:06:28Z"},{"id":"wordfence:05d32a0f-b299-4dfd-8d92-4bd0a9872a0b","source":"wordfence","cve":"CVE-2024-44023","title":"ABCApp Creator <= 1.1.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d32a0f-b299-4dfd-8d92-4bd0a9872a0b?source=api-prod","affected":[{"type":"plugin","slug":"abcapp-creator","name":"ABC APP CREATOR","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:29:22Z"},{"id":"wordfence:05d41013-4dd7-43f1-9b3b-e5ae8e7f91b6","source":"wordfence","cve":"CVE-2025-46494","title":"WidgetKit Pro <= 1.13.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d41013-4dd7-43f1-9b3b-e5ae8e7f91b6?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-pro","name":"WidgetKit Pro","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:17:12Z"},{"id":"wordfence:05d54ed7-8cb0-4886-9ee7-dee451c42b94","source":"wordfence","cve":"CVE-2026-103066","title":"WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d54ed7-8cb0-4886-9ee7-dee451c42b94?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2026-10-03T18:41:28Z","updated":"2026-10-08T23:00:13Z"},{"id":"wordfence:05d633f5-151a-4462-a6a0-5a638d7c3404","source":"wordfence","cve":"CVE-2026-3657","title":"My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d633f5-151a-4462-a6a0-5a638d7c3404?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2026-03-11T13:35:56Z","updated":"2026-03-12T02:22:36Z"},{"id":"wordfence:05d6b27f-b1e5-4bb8-b7db-f8295a5e0d5b","source":"wordfence","cve":"CVE-2021-4338","title":"404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation","severity":"medium","cvss":6.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d6b27f-b1e5-4bb8-b7db-f8295a5e0d5b?source=api-prod","affected":[{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2021-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05d86f94-1a1c-42d6-b0db-e19c5cbd1766","source":"wordfence","cve":"","title":"PDF & Print by BestWebSoft \u2013 WordPress Posts and Pages PDF Generator Plugin < 1.7.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05d86f94-1a1c-42d6-b0db-e19c5cbd1766?source=api-prod","affected":[{"type":"plugin","slug":"pdf-print","name":"PDF & Print by BestWebSoft \u2013 WordPress Posts and Pages PDF Generator Plugin","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2014-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05da4808-385c-4e9f-96f8-5d5c04e7371b","source":"wordfence","cve":"CVE-2023-23669","title":"MainWP Wordfence Extension <= 4.0.7 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05da4808-385c-4e9f-96f8-5d5c04e7371b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-wordfence-extension","name":"MainWP Wordfence Extension","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05db21e4-9c51-4d66-8f40-c0afacfb9728","source":"wordfence","cve":"CVE-2025-69086","title":"Issabella <= 1.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05db21e4-9c51-4d66-8f40-c0afacfb9728?source=api-prod","affected":[{"type":"theme","slug":"issabella","name":"Isabella - Digital Marketing Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:37:06Z"},{"id":"wordfence:05db28b4-a3de-402d-bc5b-06d5347d6724","source":"wordfence","cve":"CVE-2026-104800","title":"AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05db28b4-a3de-402d-bc5b-06d5347d6724?source=api-prod","affected":[{"type":"plugin","slug":"wp-site-age-gate","name":"AGE-GATE","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:18:30Z","updated":"2026-10-14T03:39:59Z"},{"id":"wordfence:05dbb5f4-b73b-46b4-9177-ba1d36fe0ee7","source":"wordfence","cve":"CVE-2026-15104","title":"BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dbb5f4-b73b-46b4-9177-ba1d36fe0ee7?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2026-07-09T19:06:20Z","updated":"2026-07-10T07:48:40Z"},{"id":"wordfence:05dbfd37-38bc-44e8-9ba9-81baca7bb6d0","source":"wordfence","cve":"CVE-2026-32486","title":"Travel Booking <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dbfd37-38bc-44e8-9ba9-81baca7bb6d0?source=api-prod","affected":[{"type":"theme","slug":"travel-booking","name":"Travel Booking","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T21:07:14Z"},{"id":"wordfence:05dccb32-e638-4929-a788-3998bc3acd75","source":"wordfence","cve":"CVE-2026-101326","title":"Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dccb32-e638-4929-a788-3998bc3acd75?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-10-30T17:25:29Z","updated":"2026-10-31T05:33:07Z"},{"id":"wordfence:05dcfd2d-6488-4f82-b20b-4968e4a00796","source":"wordfence","cve":"CVE-2023-23998","title":"VikRentCar Car Rental Management System <= 1.3.0 - Authenticated (Admin+) Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dcfd2d-6488-4f82-b20b-4968e4a00796?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05dd1686-76e3-498b-80b8-c4befc545fc8","source":"wordfence","cve":"CVE-2026-2608","title":"Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dd1686-76e3-498b-80b8-c4befc545fc8?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.32","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T11:20:42Z"},{"id":"wordfence:05dd3819-3566-43f6-a932-8931f51d6e8e","source":"wordfence","cve":"CVE-2025-30541","title":"Info Boxes Shortcode and Widget <= 1.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dd3819-3566-43f6-a932-8931f51d6e8e?source=api-prod","affected":[{"type":"plugin","slug":"info-boxes-shortcode-and-widget","name":"Info Boxes Shortcode and Widget","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:01:31Z"},{"id":"wordfence:05dd7c96-7880-44a8-a06f-037bc627fd8d","source":"wordfence","cve":"CVE-2023-5706","title":"VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05dd7c96-7880-44a8-a06f-037bc627fd8d?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.63.0.1","to_inclusive":true,"patched_in":"1.64.0.0"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05de038f-eff4-4b00-930c-3d2335345869","source":"wordfence","cve":"CVE-2026-12100","title":"URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05de038f-eff4-4b00-930c-3d2335345869?source=api-prod","affected":[{"type":"plugin","slug":"link-preview","name":"URL Preview","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:41:58Z","updated":"2026-06-24T05:33:21Z"},{"id":"wordfence:05de06b1-52bb-47f7-af5e-e9320cf0437f","source":"wordfence","cve":"CVE-2022-2716","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text Editor","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05de06b1-52bb-47f7-af5e-e9320cf0437f?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.5.5.2","to_inclusive":true,"patched_in":"2.5.5.3"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05e1d30e-441b-44e2-a89b-eba905384673","source":"wordfence","cve":"CVE-2026-13611","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05e1d30e-441b-44e2-a89b-eba905384673?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-03T16:36:51Z"},{"id":"wordfence:05e43452-66db-4184-a7bf-9f744b547b64","source":"wordfence","cve":"CVE-2026-16295","title":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer < 2.4.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05e43452-66db-4184-a7bf-9f744b547b64?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":false,"patched_in":"2.4.3"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:23:31Z"},{"id":"wordfence:05e8ec0d-74ad-483a-914d-f40c0cfc9b24","source":"wordfence","cve":"CVE-2024-13688","title":"Admin and Site Enhancements (ASE) <= 7.6.9 - Password Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05e8ec0d-74ad-483a-914d-f40c0cfc9b24?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.6.9","to_inclusive":true,"patched_in":"7.6.10"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-30T19:53:53Z"},{"id":"wordfence:05ea5a3c-084a-458f-b0b1-8a9b82e4656a","source":"wordfence","cve":"","title":"Comment Rating <= 2.9.32 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ea5a3c-084a-458f-b0b1-8a9b82e4656a?source=api-prod","affected":[{"type":"plugin","slug":"comment-rating","name":"Comment Rating","from":"*","from_inclusive":true,"to":"2.9.32","to_inclusive":true,"patched_in":""}],"published":"2013-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05eb85a9-ee82-44d0-b9d4-a369e408dbd9","source":"wordfence","cve":"CVE-2024-3629","title":"HL Twitter <= 2014.1.18 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05eb85a9-ee82-44d0-b9d4-a369e408dbd9?source=api-prod","affected":[{"type":"plugin","slug":"hl-twitter","name":"HL Twitter","from":"*","from_inclusive":true,"to":"2014.1.18","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T12:59:48Z"},{"id":"wordfence:05ebdcca-ef90-4bbd-ac5e-05f57bf0c7d7","source":"wordfence","cve":"CVE-2024-48031","title":"Featured Posts with Multiple Custom Groups (FPMCG) <= 4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ebdcca-ef90-4bbd-ac5e-05f57bf0c7d7?source=api-prod","affected":[{"type":"plugin","slug":"featured-posts-with-multiple-custom-groups-fpmcg","name":"Featured Posts with Multiple Custom Groups (FPMCG)","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:49:07Z"},{"id":"wordfence:05ee4692-451b-4ff4-9bf0-8a16d39404ea","source":"wordfence","cve":"CVE-2022-2629","title":"Top Bar <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ee4692-451b-4ff4-9bf0-8a16d39404ea?source=api-prod","affected":[{"type":"plugin","slug":"top-bar","name":"Top Bar","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05eeb878-e5f4-4cdb-b106-baea66b71f10","source":"wordfence","cve":"CVE-2026-39509","title":"Directorist <= 8.5.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05eeb878-e5f4-4cdb-b106-baea66b71f10?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.5.10","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T21:27:21Z"},{"id":"wordfence:05f175e6-08a9-4199-948c-5bd8b3caaa39","source":"wordfence","cve":"CVE-2026-1217","title":"Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f175e6-08a9-4199-948c-5bd8b3caaa39?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post","name":"Yoast Duplicate Post","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2026-03-17T20:54:49Z","updated":"2026-03-18T09:28:30Z"},{"id":"wordfence:05f40082-30ed-45f7-81d5-d5334a51fcea","source":"wordfence","cve":"CVE-2024-12004","title":"WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f40082-30ed-45f7-81d5-d5334a51fcea?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-notes","name":"WPC Order Notes for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-12-10T20:27:30Z","updated":"2024-12-11T08:57:59Z"},{"id":"wordfence:05f5addb-ab1d-4b67-b969-3b95d43be790","source":"wordfence","cve":"CVE-2023-39987","title":"wSecure Lite <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f5addb-ab1d-4b67-b969-3b95d43be790?source=api-prod","affected":[{"type":"plugin","slug":"wsecure","name":"wsecure lite","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-08-09T00:00:00Z","updated":"2026-07-08T20:41:19Z"},{"id":"wordfence:05f73a26-f637-4a1a-9f8c-98be8a146f00","source":"wordfence","cve":"CVE-2025-12188","title":"Posts Navigation Links for Sections and Headings - Free by WP Masters <= 1.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f73a26-f637-4a1a-9f8c-98be8a146f00?source=api-prod","affected":[{"type":"plugin","slug":"posts-navigation-links-for-sections-and-headings-free-by-wp-masters","name":"Posts Navigation Links for Sections and Headings \u2013 Free by WP Masters","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:28:56Z","updated":"2025-11-04T04:27:12Z"},{"id":"wordfence:05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946","source":"wordfence","cve":"CVE-2023-0084","title":"Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05f87510-28c3-4ad1-b2be-2408a199cf68","source":"wordfence","cve":"CVE-2025-0749","title":"Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05f87510-28c3-4ad1-b2be-2408a199cf68?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T01:44:53Z"},{"id":"wordfence:05fae1f8-0546-4505-8749-a9deea237d10","source":"wordfence","cve":"CVE-2026-39652","title":"iGMS Direct Booking <= 1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05fae1f8-0546-4505-8749-a9deea237d10?source=api-prod","affected":[{"type":"plugin","slug":"igms-direct-booking","name":"iGMS Direct Booking","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-02-15T00:00:00Z","updated":"2026-09-16T17:30:53Z"},{"id":"wordfence:05fc4b17-7922-45a4-aac8-a47b3f50ce69","source":"wordfence","cve":"CVE-2025-5303","title":"LTL Freight Quotes \u2013 Freightview Edition <= 1.0.11, LTL Freight Quotes \u2013 Daylight Edition <=2.2.6 and LTL Freight Quotes \u2013 Day & Ross Edition <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05fc4b17-7922-45a4-aac8-a47b3f50ce69?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-freightview-edition","name":"LTL Freight Quotes \u2013 Freightview Edition","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"},{"type":"plugin","slug":"ltl-freight-quotes-day-ross-edition","name":"LTL Freight Quotes \u2013 Day & Ross Edition","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"},{"type":"plugin","slug":"ltl-freight-quotes-daylight-edition","name":"LTL Freight Quotes \u2013 Daylight Edition","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-06-06T20:22:12Z","updated":"2025-06-07T08:22:28Z"},{"id":"wordfence:05fe1929-9e39-4b2f-a3fc-e692267d731b","source":"wordfence","cve":"CVE-2022-2628","title":"DSGVO All in one for WP <= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05fe1929-9e39-4b2f-a3fc-e692267d731b?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.3"}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:05fe7d6d-c206-4444-aab2-e4f64b143710","source":"wordfence","cve":"CVE-2025-66083","title":"WpEvently <= 5.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05fe7d6d-c206-4444-aab2-e4f64b143710?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T16:02:01Z"},{"id":"wordfence:05ff1b1e-f7ba-485d-9421-9bb38f6831ef","source":"wordfence","cve":"CVE-2019-25218","title":"Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.3 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ff1b1e-f7ba-485d-9421-9bb38f6831ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-photo-gallery","name":"Photo Gallery Slideshow & Masonry Tiled Gallery","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-19T03:31:08Z"},{"id":"wordfence:05ff8080-59e5-4d48-a69b-275a89eef758","source":"wordfence","cve":"CVE-2022-40702","title":"Advanced Local Pickup for WooCommerce <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/05ff8080-59e5-4d48-a69b-275a89eef758?source=api-prod","affected":[{"type":"plugin","slug":"advanced-local-pickup-for-woocommerce","name":"Advanced Local Pickup for WooCommerce \u2013 Click & Collect, In-Store Pickup","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06017af2-58d9-40e3-bb87-2f29c3e89560","source":"wordfence","cve":"CVE-2026-96578","title":"GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06017af2-58d9-40e3-bb87-2f29c3e89560?source=api-prod","affected":[{"type":"plugin","slug":"gspeech","name":"GSpeech TTS \u2013 WordPress Text To Speech Plugin","from":"*","from_inclusive":true,"to":"3.22.0","to_inclusive":true,"patched_in":"3.22.1"}],"published":"2026-10-01T18:59:11Z","updated":"2026-10-02T07:39:21Z"},{"id":"wordfence:06022ca3-7b2e-499b-b2ca-dffc52973fdf","source":"wordfence","cve":"CVE-2026-96899","title":"Optima Express 8.6.0 - 8.7.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06022ca3-7b2e-499b-b2ca-dffc52973fdf?source=api-prod","affected":[{"type":"plugin","slug":"optima-express","name":"Optima Express IDX","from":"8.6.0","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":"8.7.6"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T20:11:48Z"},{"id":"wordfence:06039853-18fb-4391-b777-53ca1e4f12e9","source":"wordfence","cve":"CVE-2026-104391","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06039853-18fb-4391-b777-53ca1e4f12e9?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.7","to_inclusive":true,"patched_in":"11.2.8"}],"published":"2026-10-07T09:14:00Z","updated":"2026-10-08T23:08:20Z"},{"id":"wordfence:06047667-2a24-4e1c-9389-11daceff4d23","source":"wordfence","cve":"CVE-2024-11181","title":"Greenshift \u2013 animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06047667-2a24-4e1c-9389-11daceff4d23?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"9.9.9.3","to_inclusive":true,"patched_in":"9.9.9.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:34Z"},{"id":"wordfence:0605bc15-3a97-46f4-8244-29220ed5ab31","source":"wordfence","cve":"CVE-2025-4381","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0605bc15-3a97-46f4-8244-29220ed5ab31?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:53:40Z","updated":"2025-07-02T03:47:22Z"},{"id":"wordfence:06063978-6c61-42e0-bf03-092aaa20d850","source":"wordfence","cve":"CVE-2025-9710","title":"Responsive Lightbox & Gallery <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06063978-6c61-42e0-bf03-092aaa20d850?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-09-15T00:00:00Z","updated":"2025-10-16T14:26:35Z"},{"id":"wordfence:0608fb1c-0c01-40b6-9506-2e2336523df2","source":"wordfence","cve":"CVE-2026-13332","title":"Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0608fb1c-0c01-40b6-9506-2e2336523df2?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T17:05:18Z"},{"id":"wordfence:060bbe04-e8fa-4aee-ad69-d3398645fb3f","source":"wordfence","cve":"CVE-2026-118534","title":"Directorist <= 8.10 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060bbe04-e8fa-4aee-ad69-d3398645fb3f?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:23:54Z"},{"id":"wordfence:060dd6aa-0864-4357-9e78-bd7797af58a0","source":"wordfence","cve":"CVE-2024-56289","title":"Groundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060dd6aa-0864-4357-9e78-bd7797af58a0?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"3.7.3.3","to_inclusive":true,"patched_in":"3.7.3.4"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:11:47Z"},{"id":"wordfence:060f31ab-cfa4-4ca8-846a-de76848b28fb","source":"wordfence","cve":"CVE-2023-7287","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060f31ab-cfa4-4ca8-846a-de76848b28fb?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:24Z"},{"id":"wordfence:060f7e19-072a-486e-9d6c-df73ee63078f","source":"wordfence","cve":"CVE-2026-27988","title":"Equadio <= 1.1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060f7e19-072a-486e-9d6c-df73ee63078f?source=api-prod","affected":[{"type":"theme","slug":"equadio","name":"Equadio","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:57:15Z"},{"id":"wordfence:060ff51b-536d-4022-a68a-f77dc6c9c814","source":"wordfence","cve":"CVE-2026-96567","title":"MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060ff51b-536d-4022-a68a-f77dc6c9c814?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-10-01T19:20:14Z","updated":"2026-10-02T07:39:21Z"},{"id":"wordfence:060ff8af-738f-448a-8aa9-bc00bc2bfbeb","source":"wordfence","cve":"CVE-2024-48047","title":"Linked Variation for WooCommerce <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/060ff8af-738f-448a-8aa9-bc00bc2bfbeb?source=api-prod","affected":[{"type":"plugin","slug":"linked-variation-for-woocommerce","name":"Linked Variation for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-10-14T00:00:00Z","updated":"2025-03-25T18:48:48Z"},{"id":"wordfence:0612c0be-f1c0-4f74-a769-e4616f103ee6","source":"wordfence","cve":"CVE-2026-6708","title":"HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0612c0be-f1c0-4f74-a769-e4616f103ee6?source=api-prod","affected":[{"type":"plugin","slug":"hel-online-classroom","name":"HEL Online Classroom: AI-powered Online Classrooms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:04:17Z","updated":"2026-05-12T07:48:15Z"},{"id":"wordfence:0612c377-ec67-43b3-add0-5e9b0696eea1","source":"wordfence","cve":"CVE-2026-42751","title":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar <= 2.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0612c377-ec67-43b3-add0-5e9b0696eea1?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.1.19"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-01T16:04:33Z"},{"id":"wordfence:06156cb7-baa0-4e66-a146-505b09698a4a","source":"wordfence","cve":"CVE-2026-57398","title":"Real Estate Manager Pro <= 12.8.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06156cb7-baa0-4e66-a146-505b09698a4a?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager-pro","name":"Real Estate Manager Pro","from":"*","from_inclusive":true,"to":"12.8.3","to_inclusive":true,"patched_in":"12.8.4"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:44:41Z"},{"id":"wordfence:0615d1be-f9fa-45b3-9d5b-3ad1f36be8e1","source":"wordfence","cve":"CVE-2024-3627","title":"Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0615d1be-f9fa-45b3-9d5b-3ad1f36be8e1?source=api-prod","affected":[{"type":"plugin","slug":"wheel-of-life","name":"Wheel of Life: Coaching and Assessment Tool for Life Coach","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-06-19T12:15:38Z","updated":"2024-07-01T13:30:51Z"},{"id":"wordfence:0616a69a-20a5-476c-904a-881b31b9da18","source":"wordfence","cve":"CVE-2025-62121","title":"Logo Slider , Logo Carousel , Logo showcase , Client Logo <= 1.8.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0616a69a-20a5-476c-904a-881b31b9da18?source=api-prod","affected":[{"type":"plugin","slug":"tc-logo-slider","name":"Logo Slider , Logo Carousel , Logo showcase , Client Logo","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:26:57Z"},{"id":"wordfence:06187bf0-7e3b-49c0-9f34-3d717e8d8ece","source":"wordfence","cve":"","title":"Lazy Load < 0.6.1 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06187bf0-7e3b-49c0-9f34-3d717e8d8ece?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load","name":"Lazy Load","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":false,"patched_in":"0.6.1"}],"published":"2016-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:061a14bf-d067-4924-b2f4-2f5986204532","source":"wordfence","cve":"","title":"SureForms <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061a14bf-d067-4924-b2f4-2f5986204532?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-02-15T00:00:00Z","updated":"2026-02-24T19:26:24Z"},{"id":"wordfence:061ada09-932f-4d2c-aa9e-c53f1d711c85","source":"wordfence","cve":"CVE-2024-4364","title":"Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061ada09-932f-4d2c-aa9e-c53f1d711c85?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-06-05T14:59:22Z","updated":"2024-06-06T03:32:51Z"},{"id":"wordfence:061b1f95-26da-4d1a-9e0a-6f83adf56d2e","source":"wordfence","cve":"CVE-2026-110268","title":"Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061b1f95-26da-4d1a-9e0a-6f83adf56d2e?source=api-prod","affected":[{"type":"plugin","slug":"post-export-import-with-media","name":"Post Export Import with Media","from":"*","from_inclusive":true,"to":"1.17.2","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2026-10-16T14:43:02Z","updated":"2026-10-17T03:43:26Z"},{"id":"wordfence:061eb5a2-2112-4379-8d10-1493a843c5f7","source":"wordfence","cve":"CVE-2025-67927","title":"Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061eb5a2-2112-4379-8d10-1493a843c5f7?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.8.8","to_inclusive":true,"patched_in":"0.8.9"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-13T17:48:10Z"},{"id":"wordfence:061eeba3-10ad-4272-9880-dc01d4368683","source":"wordfence","cve":"CVE-2026-8841","title":"Extra Settings for RocketChat <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061eeba3-10ad-4272-9880-dc01d4368683?source=api-prod","affected":[{"type":"plugin","slug":"extra-settings-for-rocketchat","name":"Extra Settings for RocketChat","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:15Z","updated":"2026-06-09T03:41:16Z"},{"id":"wordfence:061f022b-b922-4499-bb34-8ea91ba5ace3","source":"wordfence","cve":"CVE-2025-14996","title":"AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/061f022b-b922-4499-bb34-8ea91ba5ace3?source=api-prod","affected":[{"type":"plugin","slug":"as-password-field-in-default-registration-form","name":"AS Password Field In Default Registration Form","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-05T16:08:45Z","updated":"2026-01-06T04:31:54Z"},{"id":"wordfence:062007c4-84ce-472e-b8e6-f255f6453a3a","source":"wordfence","cve":"CVE-2025-62954","title":"Revive Old Posts <= 9.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062007c4-84ce-472e-b8e6-f255f6453a3a?source=api-prod","affected":[{"type":"plugin","slug":"tweet-old-post","name":"Revive Social \u2013 Social Media Auto Post and Scheduling Automation Plugin","from":"*","from_inclusive":true,"to":"9.3.3","to_inclusive":true,"patched_in":"9.3.4"}],"published":"2025-10-14T00:00:00Z","updated":"2025-11-07T17:33:53Z"},{"id":"wordfence:062205fa-90a4-49c3-9b27-cd34217bd8ac","source":"wordfence","cve":"CVE-2026-81810","title":"All-in-One WP Migration and Backup <= 7.110 - Authenticated (Admin+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062205fa-90a4-49c3-9b27-cd34217bd8ac?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.110","to_inclusive":true,"patched_in":"7.111"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:33:16Z"},{"id":"wordfence:0624108b-cd60-4278-802d-d4853f73ec6a","source":"wordfence","cve":"CVE-2024-10552","title":"Flexmls\u00ae IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0624108b-cd60-4278-802d-d4853f73ec6a?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.14.26","to_inclusive":true,"patched_in":"3.14.27"}],"published":"2025-01-24T18:17:54Z","updated":"2025-01-25T06:40:39Z"},{"id":"wordfence:062620fc-3d37-4913-bcc7-ce5e9b812d6c","source":"wordfence","cve":"CVE-2025-26740","title":"SpaBiz <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062620fc-3d37-4913-bcc7-ce5e9b812d6c?source=api-prod","affected":[{"type":"theme","slug":"spabiz","name":"SpaBiz","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:47:02Z"},{"id":"wordfence:062844b8-5d19-447f-86df-7b084fa275cb","source":"wordfence","cve":"CVE-2024-51673","title":"HT Politic <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062844b8-5d19-447f-86df-7b084fa275cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-politic","name":"HT Politic \u2013 For Political WordPress Themes / Website","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:25:16Z"},{"id":"wordfence:06294c35-6d58-4270-b143-757831fc5da6","source":"wordfence","cve":"","title":"Campaign URL Builder <= 1.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Create Link","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06294c35-6d58-4270-b143-757831fc5da6?source=api-prod","affected":[{"type":"plugin","slug":"campaign-url-builder","name":"Campaign URL Builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0629798c-ede2-43ac-9ec4-2cd99cd34ae2","source":"wordfence","cve":"CVE-2024-3581","title":"MaxGalleria <= 6.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0629798c-ede2-43ac-9ec4-2cd99cd34ae2?source=api-prod","affected":[{"type":"plugin","slug":"maxgalleria","name":"MaxGalleria","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:51:42Z"},{"id":"wordfence:062af58f-32e6-4551-b82b-a2766ad5644c","source":"wordfence","cve":"CVE-2025-11804","title":"JB News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062af58f-32e6-4551-b82b-a2766ad5644c?source=api-prod","affected":[{"type":"plugin","slug":"jb-news-ticker","name":"JB News Ticker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:18:50Z","updated":"2025-10-22T08:27:03Z"},{"id":"wordfence:062d906d-5a6e-4180-a2f2-18411334b9a1","source":"wordfence","cve":"CVE-2023-6946","title":"Autotitle for WordPress <= 1.0.3 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062d906d-5a6e-4180-a2f2-18411334b9a1?source=api-prod","affected":[{"type":"plugin","slug":"autotitle-for-wordpress","name":"Autotitle for WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:062f5bc7-9d53-4a28-b603-9901ce2175d8","source":"wordfence","cve":"","title":"Smash Balloon Social Photo Feed <= 1.4.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/062f5bc7-9d53-4a28-b603-9901ce2175d8?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"1.4.6.2","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2016-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:063011d3-d744-46a7-9069-89e3a8f843f3","source":"wordfence","cve":"CVE-2026-65475","title":"Modula Image Gallery \u2013 Photo Grid & Video Gallery  2.14.25-2.14.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063011d3-d744-46a7-9069-89e3a8f843f3?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"2.14.25","from_inclusive":true,"to":"2.14.30","to_inclusive":true,"patched_in":"2.14.31"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:51:55Z"},{"id":"wordfence:063021f1-aeaf-4acc-bdb7-f5ba7bc1313c","source":"wordfence","cve":"CVE-2025-31859","title":"Feedbucket \u2013 Website Feedback Tool <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063021f1-aeaf-4acc-bdb7-f5ba7bc1313c?source=api-prod","affected":[{"type":"plugin","slug":"feedbucket","name":"Feedbucket \u2013 Website Feedback Tool","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-04-01T00:00:00Z","updated":"2025-07-10T14:54:27Z"},{"id":"wordfence:0630956f-4add-45a7-95ae-657c90b6c2b7","source":"wordfence","cve":"CVE-2026-25372","title":"Academy LMS <= 3.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0630956f-4add-45a7-95ae-657c90b6c2b7?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T19:23:06Z"},{"id":"wordfence:063224fe-3cf8-40b6-8645-86c8e8dc876e","source":"wordfence","cve":"CVE-2024-29925","title":"Post Grid, Slider & Carousel Ultimate <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063224fe-3cf8-40b6-8645-86c8e8dc876e?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:41:36Z"},{"id":"wordfence:063345b7-040b-4576-8634-663eda9135fa","source":"wordfence","cve":"CVE-2025-24673","title":"Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063345b7-040b-4576-8634-663eda9135fa?source=api-prod","affected":[{"type":"plugin","slug":"ketchup-shortcodes-pack","name":"Ketchup Shortcodes","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":"0.2.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:41:17Z"},{"id":"wordfence:06334fad-eb1d-4abe-b183-a9e11eedd3d2","source":"wordfence","cve":"CVE-2014-4547","title":"Rezgo Online Booking < 1.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06334fad-eb1d-4abe-b183-a9e11eedd3d2?source=api-prod","affected":[{"type":"plugin","slug":"rezgo","name":"Rezgo Online Booking","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0633bf06-6580-4feb-b98a-c465df3e2bed","source":"wordfence","cve":"CVE-2025-14444","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0633bf06-6580-4feb-b98a-c465df3e2bed?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.6.9","to_inclusive":true,"patched_in":"6.0.7.0"}],"published":"2026-02-17T21:54:57Z","updated":"2026-02-18T10:20:54Z"},{"id":"wordfence:063457b6-b02b-4f4c-b746-576b7b919e67","source":"wordfence","cve":"CVE-2015-9377","title":"iThemes Builder Depot Theme < 5.0.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063457b6-b02b-4f4c-b746-576b7b919e67?source=api-prod","affected":[{"type":"theme","slug":"BuilderChild-Depot","name":"BuilderChild-Depot","from":"*","from_inclusive":true,"to":"5.0.30","to_inclusive":false,"patched_in":"5.0.30"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0635264e-91d0-4855-b811-dcbf724b3400","source":"wordfence","cve":"CVE-2026-85127","title":"VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0635264e-91d0-4855-b811-dcbf724b3400?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"1.8.8","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:37:43Z"},{"id":"wordfence:06359274-37ae-47f5-824c-25600c5b06eb","source":"wordfence","cve":"CVE-2024-10645","title":"Blogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via br","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06359274-37ae-47f5-824c-25600c5b06eb?source=api-prod","affected":[{"type":"plugin","slug":"blogger-301-redirect","name":"Blogger 301 Redirect","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T19:50:57Z","updated":"2024-11-16T08:35:38Z"},{"id":"wordfence:06362518-f2ee-485f-9e0e-1b1ada9c72db","source":"wordfence","cve":"CVE-2025-14875","title":"HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06362518-f2ee-485f-9e0e-1b1ada9c72db?source=api-prod","affected":[{"type":"plugin","slug":"hblpay-payment-gateway-for-woocommerce","name":"HBLPAY Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-01-06T18:34:42Z","updated":"2026-01-15T18:01:25Z"},{"id":"wordfence:063826cc-7ff3-4869-9831-f6a4a4bbe74c","source":"wordfence","cve":"CVE-2023-6989","title":"Shield Security \u2013 Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063826cc-7ff3-4869-9831-f6a4a4bbe74c?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"18.5.9","to_inclusive":true,"patched_in":"18.5.10"}],"published":"2024-02-05T00:00:00Z","updated":"2024-07-29T21:35:48Z"},{"id":"wordfence:06382aab-8a92-43a2-a4fa-7bbd21967326","source":"wordfence","cve":"CVE-2025-47672","title":"miniOrange Discord Integration <= 2.2.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06382aab-8a92-43a2-a4fa-7bbd21967326?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-discord-integration","name":"miniOrange Discord Integration","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-05-22T00:00:00Z","updated":"2026-07-08T20:58:35Z"},{"id":"wordfence:0638c8f3-070a-4b42-ba58-396f3f259b9d","source":"wordfence","cve":"CVE-2024-5345","title":"Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0638c8f3-070a-4b42-ba58-396f3f259b9d?source=api-prod","affected":[{"type":"plugin","slug":"responsive-owl-carousel-elementor","name":"Responsive Owl Carousel for Elementor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-05-30T14:04:20Z","updated":"2024-05-31T02:41:08Z"},{"id":"wordfence:063a245d-bd9e-49ac-bdf0-549a25eba9fe","source":"wordfence","cve":"CVE-2025-12124","title":"FitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063a245d-bd9e-49ac-bdf0-549a25eba9fe?source=api-prod","affected":[{"type":"plugin","slug":"fitvids-for-wordpress","name":"FitVids for WordPress","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:28:48Z","updated":"2025-12-05T05:31:23Z"},{"id":"wordfence:063abf5d-d704-4e16-8ee7-58a3370993b9","source":"wordfence","cve":"CVE-2025-39386","title":"Hospital Management System <= 47.0(20-11-2023) - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063abf5d-d704-4e16-8ee7-58a3370993b9?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:19:47Z"},{"id":"wordfence:063b50e3-1369-4240-b695-6ac336f4ea75","source":"wordfence","cve":"CVE-2026-23543","title":"Essential Addons for Elementor <= 6.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063b50e3-1369-4240-b695-6ac336f4ea75?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2025-11-18T00:00:00Z","updated":"2026-05-04T15:15:43Z"},{"id":"wordfence:063d452b-2a35-40aa-a002-ea55da778222","source":"wordfence","cve":"CVE-2024-12266","title":"ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063d452b-2a35-40aa-a002-ea55da778222?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-dynamic-pricing-and-discounts","name":"ELEX WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T04:22:44Z"},{"id":"wordfence:063f47f5-277c-420e-b080-fd4908468848","source":"wordfence","cve":"CVE-2025-22532","title":"Simple Photo Sphere <= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/063f47f5-277c-420e-b080-fd4908468848?source=api-prod","affected":[{"type":"plugin","slug":"simple-photo-sphere","name":"Simple Photo Sphere","from":"*","from_inclusive":true,"to":"0.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:43:22Z"},{"id":"wordfence:0640538c-b076-453c-a32e-f33b4e1c77ae","source":"wordfence","cve":"CVE-2025-7650","title":"BizCalendar Web <= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0640538c-b076-453c-a32e-f33b4e1c77ae?source=api-prod","affected":[{"type":"plugin","slug":"bizcalendar-web","name":"BizCalendar Web","from":"*","from_inclusive":true,"to":"1.1.0.53","to_inclusive":true,"patched_in":"1.1.0.54"}],"published":"2025-08-14T20:14:14Z","updated":"2025-10-14T19:14:50Z"},{"id":"wordfence:06424d9f-0064-4101-b819-688489a18eee","source":"wordfence","cve":"CVE-2023-5743","title":"Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06424d9f-0064-4101-b819-688489a18eee?source=api-prod","affected":[{"type":"plugin","slug":"telephone-number-linker","name":"Telephone Number Linker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0644cfb3-04ff-4c6f-8a1a-aa416f044e4e","source":"wordfence","cve":"CVE-2024-39657","title":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0644cfb3-04ff-4c6f-8a1a-aa416f044e4e?source=api-prod","affected":[{"type":"plugin","slug":"sender-net-automated-emails","name":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.18","to_inclusive":true,"patched_in":"2.6.19"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:27:18Z"},{"id":"wordfence:0646fcba-afe5-49a2-acd5-e15d009926c4","source":"wordfence","cve":"CVE-2024-3585","title":"Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0646fcba-afe5-49a2-acd5-e15d009926c4?source=api-prod","affected":[{"type":"plugin","slug":"send-pdf-for-contact-form-7","name":"Send PDF for Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.2.3","to_inclusive":true,"patched_in":"1.0.2.4"}],"published":"2024-04-23T00:00:00Z","updated":"2024-05-02T16:51:43Z"},{"id":"wordfence:064b3500-1040-4e9a-9dff-c00ad35d2354","source":"wordfence","cve":"CVE-2026-12713","title":"WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/064b3500-1040-4e9a-9dff-c00ad35d2354?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.3","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:00:01Z"},{"id":"wordfence:064e7ea2-949e-4f5b-adba-0890f8c6ad25","source":"wordfence","cve":"CVE-2025-15157","title":"Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/064e7ea2-949e-4f5b-adba-0890f8c6ad25?source=api-prod","affected":[{"type":"plugin","slug":"starfish-reviews","name":"Starfish Review Generation & Marketing for WordPress","from":"*","from_inclusive":true,"to":"3.1.19","to_inclusive":true,"patched_in":"3.1.20"}],"published":"2026-02-13T08:50:24Z","updated":"2026-06-25T13:33:09Z"},{"id":"wordfence:065009f6-f568-4fbe-8efd-9ced1e3da54e","source":"wordfence","cve":"CVE-2025-32117","title":"Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/065009f6-f568-4fbe-8efd-9ced1e3da54e?source=api-prod","affected":[{"type":"plugin","slug":"widgetize-pages-light","name":"Widgetize Pages Light","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-as-shortcodes","name":"Widgets as Shortcodes","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-05-05T15:00:45Z"},{"id":"wordfence:06503fb4-1891-4279-bce9-9667d00f69e1","source":"wordfence","cve":"CVE-2024-10554","title":"WordPress WP-Advanced-Search <= 3.3.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06503fb4-1891-4279-bce9-9667d00f69e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.9.2","to_inclusive":true,"patched_in":"3.3.9.3"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:06:07Z"},{"id":"wordfence:06511129-fb43-4ac1-9f5d-c637c9577293","source":"wordfence","cve":"CVE-2023-25793","title":"Link Juice Keeper <= 2.0.2 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06511129-fb43-4ac1-9f5d-c637c9577293?source=api-prod","affected":[{"type":"plugin","slug":"link-juice-keeper","name":"Link Juice Keeper","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06513dfe-f263-48b7-ba01-2c205247095b","source":"wordfence","cve":"CVE-2023-6196","title":"Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06513dfe-f263-48b7-ba01-2c205247095b?source=api-prod","affected":[{"type":"plugin","slug":"audio-merchant","name":"Audio Merchant","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0652b19c-52c8-4d77-973f-1e93a5ba811c","source":"wordfence","cve":"CVE-2013-2703","title":"Facebook Members < 5.0.5 - Cross-Site Request Forgery","severity":"high","cvss":7.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0652b19c-52c8-4d77-973f-1e93a5ba811c?source=api-prod","affected":[{"type":"plugin","slug":"facebook-members","name":"Facebook Members","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":false,"patched_in":"5.0.5"}],"published":"2013-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:065404e3-fab5-4aa2-94c5-bee28dc2b7b6","source":"wordfence","cve":"CVE-2026-16992","title":"Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/065404e3-fab5-4aa2-94c5-bee28dc2b7b6?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-18T14:58:44Z"},{"id":"wordfence:06549752-8808-467e-a383-51395ffaa614","source":"wordfence","cve":"CVE-2025-23789","title":"URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06549752-8808-467e-a383-51395ffaa614?source=api-prod","affected":[{"type":"plugin","slug":"easy-broken-link-checker","name":"URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-03T21:52:50Z"},{"id":"wordfence:0654ddef-0a6e-4241-b226-947b5b0415b1","source":"wordfence","cve":"CVE-2015-2195","title":"WP Media Cleaner <= 2.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0654ddef-0a6e-4241-b226-947b5b0415b1?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-cleaner","name":"WP Media Cleaner","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2015-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0654e3c9-106d-4d90-a4e4-9705c36f7564","source":"wordfence","cve":"CVE-2024-11383","title":"CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0654e3c9-106d-4d90-a4e4-9705c36f7564?source=api-prod","affected":[{"type":"plugin","slug":"cc-canadian-mortgage-calculator","name":"CC Canadian Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-01-06T16:19:47Z","updated":"2025-01-07T04:21:56Z"},{"id":"wordfence:0655cd61-8ebe-47f8-a21b-6311c98a7193","source":"wordfence","cve":"CVE-2024-33929","title":"Directorist <= 7.8.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0655cd61-8ebe-47f8-a21b-6311c98a7193?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.8.6","to_inclusive":true,"patched_in":"7.9.0"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:14:27Z"},{"id":"wordfence:0659aca3-6b72-460f-8bf4-e7ad17b74773","source":"wordfence","cve":"CVE-2023-47696","title":"Product Enquiry for WooCommerce <= 3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0659aca3-6b72-460f-8bf4-e7ad17b74773?source=api-prod","affected":[{"type":"plugin","slug":"gm-woocommerce-quote-popup","name":"Product Enquiry for WooCommerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-11-09T00:00:00Z","updated":"2025-01-20T18:06:40Z"},{"id":"wordfence:065c25a0-1117-4230-a3f8-4e9d7db052b1","source":"wordfence","cve":"CVE-2026-24560","title":"Cloudinary <= 3.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/065c25a0-1117-4230-a3f8-4e9d7db052b1?source=api-prod","affected":[{"type":"plugin","slug":"cloudinary-image-management-and-manipulation-in-the-cloud-cdn","name":"Cloudinary \u2013 Deliver Images and Videos at Scale","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-01-22T00:00:00Z","updated":"2026-07-08T20:46:28Z"},{"id":"wordfence:065d01b6-30e0-4bc8-bd70-25996c2df879","source":"wordfence","cve":"CVE-2025-13866","title":"Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow_flow_social_auth AJAX action","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/065d01b6-30e0-4bc8-bd70-25996c2df879?source=api-prod","affected":[{"type":"plugin","slug":"flow-flow-social-streams","name":"Flow-Flow Social Feed & Social Wall","from":"3.0.0","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2025-12-11T15:12:01Z","updated":"2026-07-11T00:30:50Z"},{"id":"wordfence:066077db-85ad-449a-9519-325703bcfec6","source":"wordfence","cve":"CVE-2026-18037","title":"Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066077db-85ad-449a-9519-325703bcfec6?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-18T15:00:21Z"},{"id":"wordfence:0660d753-177e-419a-9e81-3ee2d08cfbc0","source":"wordfence","cve":"CVE-2023-35876","title":"WooCommerce Square <= 3.8.1 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0660d753-177e-419a-9e81-3ee2d08cfbc0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06614b39-392b-46c0-969c-99dde4dbd042","source":"wordfence","cve":"CVE-2025-49277","title":"Blogprise <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06614b39-392b-46c0-969c-99dde4dbd042?source=api-prod","affected":[{"type":"theme","slug":"blogprise","name":"Blogprise","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-02T19:53:02Z"},{"id":"wordfence:066458ec-3f79-4f9e-869f-df06b4f2659e","source":"wordfence","cve":"CVE-2026-12967","title":"WCFM Membership <= 2.12.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066458ec-3f79-4f9e-869f-df06b4f2659e?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T20:03:59Z"},{"id":"wordfence:06662ba5-1d27-4b44-8f5a-947e1392f688","source":"wordfence","cve":"CVE-2026-57778","title":"Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06662ba5-1d27-4b44-8f5a-947e1392f688?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:38:28Z"},{"id":"wordfence:0667ba74-71d4-4661-8682-cd4ec5087b8e","source":"wordfence","cve":"CVE-2026-115237","title":"Grand Job <= 1.2.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0667ba74-71d4-4661-8682-cd4ec5087b8e?source=api-prod","affected":[{"type":"plugin","slug":"grand-job","name":"Grand Job","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:44:14Z"},{"id":"wordfence:066b3b77-7888-4037-b443-a3c6fb540cf7","source":"wordfence","cve":"CVE-2015-9416","title":"WPML 2.9.3-3.2.6 - Cross-Site Scripting in Accept-Language Header","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066b3b77-7888-4037-b443-a3c6fb540cf7?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"2.9.3","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2015-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:066c9327-6d72-41f9-895e-d14fe6471832","source":"wordfence","cve":"CVE-2023-3118","title":"Export All URLs <= 4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066c9327-6d72-41f9-895e-d14fe6471832?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:066de6fc-a304-4faa-8706-3358fc2dbf0f","source":"wordfence","cve":"CVE-2025-66098","title":"Travelers' Map <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066de6fc-a304-4faa-8706-3358fc2dbf0f?source=api-prod","affected":[{"type":"plugin","slug":"travelers-map","name":"Travelers' Map","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-11-09T00:00:00Z","updated":"2025-11-24T21:00:11Z"},{"id":"wordfence:066dfb01-4f3c-4d5a-8fbf-7e58dfc7ac91","source":"wordfence","cve":"CVE-2024-31348","title":"Testimonials <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066dfb01-4f3c-4d5a-8fbf-7e58dfc7ac91?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:31:16Z"},{"id":"wordfence:066e127f-9217-4b92-8c8c-0e3881c10cd4","source":"wordfence","cve":"CVE-2024-54264","title":"Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066e127f-9217-4b92-8c8c-0e3881c10cd4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-shortcodes-creator","name":"Shortcodes Blocks Creator Ultimate","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2026-04-15T20:37:36Z"},{"id":"wordfence:066e9f46-83a5-4a2f-ae09-6d06c5c66817","source":"wordfence","cve":"CVE-2022-3764","title":"Form Vibes <= 1.4.5 - Authenticated (Admininstrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/066e9f46-83a5-4a2f-ae09-6d06c5c66817?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:067031e8-6aa8-451c-a318-b1848c7a4f92","source":"wordfence","cve":"CVE-2025-15364","title":"Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword","severity":"high","cvss":7.3,"cwe":"CWE-353","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067031e8-6aa8-451c-a318-b1848c7a4f92?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.40","to_inclusive":true,"patched_in":"3.3.41"}],"published":"2026-01-05T13:11:34Z","updated":"2026-01-06T01:50:12Z"},{"id":"wordfence:06738434-ccd4-4e87-8163-d56ff3b4b5c8","source":"wordfence","cve":"","title":"Download Manager <= 3.1.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06738434-ccd4-4e87-8163-d56ff3b4b5c8?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.18","to_inclusive":false,"patched_in":"3.1.18"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06752651-4c7f-48dd-989c-c254c6ca7ae4","source":"wordfence","cve":"CVE-2025-9352","title":"Pronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06752651-4c7f-48dd-989c-c254c6ca7ae4?source=api-prod","affected":[{"type":"plugin","slug":"pronamic-google-maps","name":"Pronamic Google Maps","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T01:46:28Z"},{"id":"wordfence:0677560d-4f2c-4f33-83cc-a958e92852b6","source":"wordfence","cve":"CVE-2025-30967","title":"WPJobBoard < 5.11.1 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0677560d-4f2c-4f33-83cc-a958e92852b6?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":false,"patched_in":"5.11.1"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:48:40Z"},{"id":"wordfence:06781d74-ed45-432d-8d80-d90918b85e04","source":"wordfence","cve":"CVE-2024-31238","title":"Smart Online Order for Clover <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06781d74-ed45-432d-8d80-d90918b85e04?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:48:02Z"},{"id":"wordfence:067a5f6c-7ad1-49ac-a581-b50fa89a5f39","source":"wordfence","cve":"CVE-2021-24366","title":"Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067a5f6c-7ad1-49ac-a581-b50fa89a5f39?source=api-prod","affected":[{"type":"plugin","slug":"codepress-admin-columns","name":"Admin Columns","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.3"},{"type":"plugin","slug":"admin-columns-pro","name":"Admin Columns Pro","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":false,"patched_in":"5.5.1"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:067b70a5-ad1a-446f-832f-cbf3088d2f59","source":"wordfence","cve":"CVE-2026-57760","title":"Sendcloud Shipping <= 1.0.31 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067b70a5-ad1a-446f-832f-cbf3088d2f59?source=api-prod","affected":[{"type":"plugin","slug":"sendcloud-connected-shipping","name":"Sendcloud for WooCommerce: Automated Shipping, Branded Tracking & Returns","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.32"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:17:52Z"},{"id":"wordfence:067bfeaf-f3dd-4188-b53a-72b2d81a87eb","source":"wordfence","cve":"CVE-2024-25098","title":"PB oEmbed HTML5 Audio <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067bfeaf-f3dd-4188-b53a-72b2d81a87eb?source=api-prod","affected":[{"type":"plugin","slug":"pb-oembed-html5-audio-with-cache-support","name":"PB oEmbed HTML5 Audio \u2013 with Cache Support","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:29:56Z"},{"id":"wordfence:067c974c-b3bb-4f06-8f7c-3963112c40d2","source":"wordfence","cve":"CVE-2025-0956","title":"WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=api-prod","affected":[{"type":"plugin","slug":"rac","name":"WooCommerce Recover Abandoned Cart","from":"*","from_inclusive":true,"to":"24.4.0","to_inclusive":true,"patched_in":"24.5.0"}],"published":"2025-03-04T21:10:26Z","updated":"2025-05-27T20:02:40Z"},{"id":"wordfence:067ce322-9d37-4d90-92f3-ca5ada591797","source":"wordfence","cve":"","title":"ADIF Log Search Widget <= 1.0f - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067ce322-9d37-4d90-92f3-ca5ada591797?source=api-prod","affected":[{"type":"plugin","slug":"adif-log-search-widget","name":"ADIF Log Search Widget","from":"*","from_inclusive":true,"to":"1.0f","to_inclusive":true,"patched_in":""}],"published":"2013-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:067dde3a-f2d6-44c6-b64e-c8a850dd4d37","source":"wordfence","cve":"CVE-2024-10778","title":"BuddyPress Builder for Elementor \u2013 BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/067dde3a-f2d6-44c6-b64e-c8a850dd4d37?source=api-prod","affected":[{"type":"plugin","slug":"stax-buddy-builder","name":"BuddyPress Builder for Elementor \u2013 BuddyBuilder","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-11-12T13:22:37Z","updated":"2024-11-15T16:04:33Z"},{"id":"wordfence:06804bed-17c5-413c-a31b-f6f039015e26","source":"wordfence","cve":"CVE-2026-8883","title":"Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06804bed-17c5-413c-a31b-f6f039015e26?source=api-prod","affected":[{"type":"plugin","slug":"global-body-mass-index-calculator","name":"Global Body Mass Index Calculator","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-06-08T15:07:06Z","updated":"2026-09-18T18:58:28Z"},{"id":"wordfence:06838a3f-5291-4950-be80-4a2391d9276f","source":"wordfence","cve":"CVE-2025-60044","title":"Fribbo <= 1.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06838a3f-5291-4950-be80-4a2391d9276f?source=api-prod","affected":[{"type":"theme","slug":"fribbo","name":"Fribbo - Freebies Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:37:34Z"},{"id":"wordfence:0685abc6-eac6-46c5-87ae-52e2af9301c2","source":"wordfence","cve":"CVE-2024-49329","title":"WP REST API FNS <= 1.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0685abc6-eac6-46c5-87ae-52e2af9301c2?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-fns","name":"WP REST API FNS Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:16:29Z"},{"id":"wordfence:06862d82-fc24-4433-bd73-3139c5394be9","source":"wordfence","cve":"CVE-2026-32510","title":"Kamperen < 1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06862d82-fc24-4433-bd73-3139c5394be9?source=api-prod","affected":[{"type":"theme","slug":"kamperen","name":"Kamperen - Camping and Adventure Tourism WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:57:46Z"},{"id":"wordfence:06863974-e428-418b-891a-ade59ee46c4f","source":"wordfence","cve":"CVE-2023-1669","title":"SEOPress <= 6.5.0.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06863974-e428-418b-891a-ade59ee46c4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"6.5.0.2","to_inclusive":true,"patched_in":"6.5.0.3"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06871a2f-5d1d-4e40-86c5-dd6620555380","source":"wordfence","cve":"CVE-2026-87965","title":"Easy Appointments <= 4.0.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06871a2f-5d1d-4e40-86c5-dd6620555380?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"4.0.2.1","to_inclusive":true,"patched_in":"4.0.2.2"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:46:19Z"},{"id":"wordfence:0687e101-3c96-4c9b-941a-1b0fed2f76e2","source":"wordfence","cve":"CVE-2024-4486","title":"Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0687e101-3c96-4c9b-941a-1b0fed2f76e2?source=api-prod","affected":[{"type":"plugin","slug":"awesome-contact-form7-for-elementor","name":"Awesome Contact Form7 for Elementor","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-05-22T12:55:26Z","updated":"2024-05-24T13:10:28Z"},{"id":"wordfence:06881386-3c92-426b-948d-58e8a8bee624","source":"wordfence","cve":"CVE-2024-9108","title":"Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06881386-3c92-426b-948d-58e8a8bee624?source=api-prod","affected":[{"type":"plugin","slug":"wechat-social-login","name":"Wechat Social login \u5fae\u4fe1QQ\u9489\u9489\u767b\u5f55\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:08Z"},{"id":"wordfence:06887ecb-dc3e-4c8b-b163-c24e05f6e78e","source":"wordfence","cve":"","title":"WordPress Core 6.4.0 - 7.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via Interactivity Router Uploaded Text Files","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06887ecb-dc3e-4c8b-b163-c24e05f6e78e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.14","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.14","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T16:19:53Z"},{"id":"wordfence:068c0d0c-1cbe-4853-af60-81b702d6ae87","source":"wordfence","cve":"CVE-2026-94080","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.70 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068c0d0c-1cbe-4853-af60-81b702d6ae87?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.70","to_inclusive":true,"patched_in":"2.1.72"}],"published":"2026-09-23T09:14:00Z","updated":"2026-09-29T19:49:09Z"},{"id":"wordfence:068c7475-87b7-4c60-ad6b-c4d311075ff7","source":"wordfence","cve":"CVE-2025-66056","title":"Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068c7475-87b7-4c60-ad6b-c4d311075ff7?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.10.0","to_inclusive":false,"patched_in":"6.10.0"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-25T15:36:24Z"},{"id":"wordfence:068cb509-7451-4f2f-a65c-ed7686c6f6d7","source":"wordfence","cve":"CVE-2014-5460","title":"Slideshow Gallery < 1.4.7 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068cb509-7451-4f2f-a65c-ed7686c6f6d7?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2014-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:068cb545-8ced-45a1-a50a-1b6a38e99741","source":"wordfence","cve":"CVE-2019-19198","title":"Scoutnet Kalender <= 1.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068cb545-8ced-45a1-a50a-1b6a38e99741?source=api-prod","affected":[{"type":"plugin","slug":"scoutnet-kalender","name":"Scoutnet Kalender","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2019-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:068d9502-705e-45dc-a7fb-e75866226fdd","source":"wordfence","cve":"CVE-2022-1392","title":"Videos sync PDF <= 1.7.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068d9502-705e-45dc-a7fb-e75866226fdd?source=api-prod","affected":[{"type":"plugin","slug":"video-synchro-pdf","name":"Videos sync PDF","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:068da172-629d-422a-bcd5-1b73af2a5933","source":"wordfence","cve":"CVE-2011-10004","title":"Recip.ly <= 1.1.7 - Unauthenticated Arbitrary File Upload in uploadImage.php","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/068da172-629d-422a-bcd5-1b73af2a5933?source=api-prod","affected":[{"type":"plugin","slug":"reciply","name":"Recip.ly Plugin","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06900b4b-6607-4b25-b4bc-2e2906160421","source":"wordfence","cve":"CVE-2025-13339","title":"Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06900b4b-6607-4b25-b4bc-2e2906160421?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-12-09T16:23:50Z","updated":"2025-12-10T04:24:14Z"},{"id":"wordfence:06902ed3-5d36-47e1-9851-febd77ca966e","source":"wordfence","cve":"CVE-2025-23571","title":"Internal Links Generator <= 3.51 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06902ed3-5d36-47e1-9851-febd77ca966e?source=api-prod","affected":[{"type":"plugin","slug":"internal-links-generator","name":"Internal Links Generator","from":"*","from_inclusive":true,"to":"3.51","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:45:59Z"},{"id":"wordfence:06905738-7e1c-4d1a-97d2-f68f978ad8ed","source":"wordfence","cve":"","title":"Duplicator <= 0.5.26 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06905738-7e1c-4d1a-97d2-f68f978ad8ed?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"0.5.28","to_inclusive":false,"patched_in":"0.5.28"}],"published":"2015-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:069132ee-53a9-44a2-ae6c-8a83463aed9e","source":"wordfence","cve":"CVE-2026-107097","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor 1.3.71 - 1.7.1069 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069132ee-53a9-44a2-ae6c-8a83463aed9e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.3.71","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:58Z"},{"id":"wordfence:069134e8-e34b-4007-8583-137f40c29d00","source":"wordfence","cve":"CVE-2025-62068","title":"e2pdf <= 1.28.09 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069134e8-e34b-4007-8583-137f40c29d00?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.28.09","to_inclusive":true,"patched_in":"1.28.10"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:48:51Z"},{"id":"wordfence:06919817-a2ce-4914-bf1c-7763c1cde543","source":"wordfence","cve":"CVE-2024-56042","title":"WPLMS < 1.9.9.5.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06919817-a2ce-4914-bf1c-7763c1cde543?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.5.3","to_inclusive":false,"patched_in":"1.9.9.5.3"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:02:10Z"},{"id":"wordfence:0691cff0-86ed-47d3-9492-5ebc930d3eb7","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth <= 3.9.1 - Cross-Site Scripting via LaTeX markup within HTML elements","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0691cff0-86ed-47d3-9492-5ebc930d3eb7?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2016-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06929eb6-8f00-480f-9bf7-de8a7f5d7c6c","source":"wordfence","cve":"CVE-2025-22584","title":"Timeline Pro <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via [placeholder]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06929eb6-8f00-480f-9bf7-de8a7f5d7c6c?source=api-prod","affected":[{"type":"plugin","slug":"timeline-pro","name":"Timeline Pro","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:46:40Z"},{"id":"wordfence:0694b4f7-c28d-4456-8157-d20446790f3c","source":"wordfence","cve":"CVE-2019-15864","title":"Breadcrumbs by menu < 1.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0694b4f7-c28d-4456-8157-d20446790f3c?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumbs-by-menu","name":"Breadcrumbs by menu","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2019-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0696b9e2-3685-4bea-8b1f-74e2dc927532","source":"wordfence","cve":"CVE-2025-10212","title":"SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-health-check","name":"SiteAlert (Formerly WP Health)","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:55:46Z","updated":"2025-10-03T11:17:07Z"},{"id":"wordfence:06982502-6055-4a79-93ef-4896ba086322","source":"wordfence","cve":"CVE-2024-13663","title":"Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06982502-6055-4a79-93ef-4896ba086322?source=api-prod","affected":[{"type":"plugin","slug":"coaching-staffs","name":"Coaching Staffs","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-02-18T19:27:50Z","updated":"2025-06-13T15:09:08Z"},{"id":"wordfence:069a56a1-ca17-43cc-a51f-51b6111f5b61","source":"wordfence","cve":"CVE-2025-14277","title":"Prime Slider \u2013 Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069a56a1-ca17-43cc-a51f-51b6111f5b61?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-12-17T23:36:23Z","updated":"2025-12-18T12:22:29Z"},{"id":"wordfence:069b2f3e-da9d-476c-a9fa-1b7d445a704b","source":"wordfence","cve":"CVE-2024-12816","title":"NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069b2f3e-da9d-476c-a9fa-1b7d445a704b?source=api-prod","affected":[{"type":"plugin","slug":"notice-board-by-towkir","name":"NOTICE BOARD BY TOWKIR","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:40:32Z","updated":"2025-01-25T07:24:15Z"},{"id":"wordfence:069bd7ab-1b78-4465-8e13-5ef903f7e45f","source":"wordfence","cve":"CVE-2019-14773","title":"Woody Ad Snippets <= 2.2.5 - Arbitrary Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069bd7ab-1b78-4465-8e13-5ef903f7e45f?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2019-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:069d0ae9-c6fe-4375-8e8a-deb51119c66e","source":"wordfence","cve":"CVE-2025-47483","title":"Easy Replace Image <= 3.5.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069d0ae9-c6fe-4375-8e8a-deb51119c66e?source=api-prod","affected":[{"type":"plugin","slug":"easy-replace-image","name":"Easy Replace Image","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:29:44Z"},{"id":"wordfence:069efaf5-8e8b-46f2-93ac-e3648b06855d","source":"wordfence","cve":"CVE-2026-32448","title":"Podlove Podcast Publisher <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/069efaf5-8e8b-46f2-93ac-e3648b06855d?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-03-08T00:00:00Z","updated":"2026-04-15T21:21:48Z"},{"id":"wordfence:06a29065-8e20-4ead-865f-addd84917336","source":"wordfence","cve":"CVE-2025-57940","title":"Append extensions on Pages <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06a29065-8e20-4ead-865f-addd84917336?source=api-prod","affected":[{"type":"plugin","slug":"append-extensions-on-pages","name":"Append extensions on Pages","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:26:52Z"},{"id":"wordfence:06a7e784-49c3-44fd-882b-c76ab8d871e2","source":"wordfence","cve":"CVE-2022-27850","title":"Simple Ajax Chat <= 20220115 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06a7e784-49c3-44fd-882b-c76ab8d871e2?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20220115","to_inclusive":true,"patched_in":"20220216"}],"published":"2022-04-15T10:48:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06a7ff0b-ec6b-490c-9bb0-fbb5c1c337c4","source":"wordfence","cve":"CVE-2025-22777","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06a7ff0b-ec6b-490c-9bb0-fbb5c1c337c4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.19.3","to_inclusive":true,"patched_in":"3.19.4"}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-10T18:52:18Z"},{"id":"wordfence:06a92619-5281-414e-8846-be0db38df89d","source":"wordfence","cve":"CVE-2023-46198","title":"Appointment Calendar <= 2.9.6 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06a92619-5281-414e-8846-be0db38df89d?source=api-prod","affected":[{"type":"plugin","slug":"appointment-calendar","name":"Appointment Calendar","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06aa63ce-47f0-4095-ab5a-72c5dc6aabe3","source":"wordfence","cve":"CVE-2025-23563","title":"Explore pages <= 1.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06aa63ce-47f0-4095-ab5a-72c5dc6aabe3?source=api-prod","affected":[{"type":"plugin","slug":"explore-pages","name":"Explore pages","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:56:24Z"},{"id":"wordfence:06ac994a-1f49-4c7f-ba76-054deaf25c51","source":"wordfence","cve":"CVE-2025-69361","title":"Post Expirator <= 4.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ac994a-1f49-4c7f-ba76-054deaf25c51?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2026-01-11T00:00:00Z","updated":"2026-01-14T15:12:15Z"},{"id":"wordfence:06b290c2-e458-46da-abed-0ab5d63d1550","source":"wordfence","cve":"CVE-2025-10731","title":"ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b290c2-e458-46da-abed-0ab5d63d1550?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-03-22T16:26:51Z","updated":"2026-03-23T05:29:40Z"},{"id":"wordfence:06b31f3a-8516-427c-b819-7bcf2717705b","source":"wordfence","cve":"CVE-2024-49676","title":"Custom Icons for Elementor <= 0.3.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b31f3a-8516-427c-b819-7bcf2717705b?source=api-prod","affected":[{"type":"plugin","slug":"custom-icons-for-elementor","name":"Custom Icons for Elementor","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":"0.3.4"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:14:53Z"},{"id":"wordfence:06b332de-4f94-47dc-a573-53514adaf5c0","source":"wordfence","cve":"CVE-2023-45105","title":"affiliate-toolkit \u2013 WordPress Affiliate Plugin <= 3.3.9 - Open Redirect via atkpout.php","severity":"low","cvss":3.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b332de-4f94-47dc-a573-53514adaf5c0?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06b3396e-4f94-4b5f-a427-453a87067ffb","source":"wordfence","cve":"CVE-2025-58654","title":"xili-language <= 2.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b3396e-4f94-4b5f-a427-453a87067ffb?source=api-prod","affected":[{"type":"plugin","slug":"xili-language","name":"xili-language","from":"*","from_inclusive":true,"to":"2.21.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:47:07Z"},{"id":"wordfence:06b4888d-b9cc-491e-bbcc-13f3e4bfe77a","source":"wordfence","cve":"CVE-2025-30982","title":"MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b4888d-b9cc-491e-bbcc-13f3e4bfe77a?source=api-prod","affected":[{"type":"plugin","slug":"mybookprogress","name":"MyBookProgress by Stormhill Media","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T13:52:41Z"},{"id":"wordfence:06b6c668-5f5d-4cf6-a3c6-4af755c72bca","source":"wordfence","cve":"CVE-2022-4306","title":"Panda Pods Repeater Field <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b6c668-5f5d-4cf6-a3c6-4af755c72bca?source=api-prod","affected":[{"type":"plugin","slug":"panda-pods-repeater-field","name":"Panda Pods Repeater Field","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06b8d1ce-fd4d-423d-aadf-f114f8a92add","source":"wordfence","cve":"CVE-2017-9418","title":"WP-Testimonials <= 3.4.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b8d1ce-fd4d-423d-aadf-f114f8a92add?source=api-prod","affected":[{"type":"plugin","slug":"wp-testimonials","name":"WP-Testimonials","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2017-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06b92517-5431-43ed-ad3b-80bfd0981b93","source":"wordfence","cve":"CVE-2016-10888","title":"All In One WP Security & Firewall <= 4.0.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b92517-5431-43ed-ad3b-80bfd0981b93?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2016-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06b965a6-cbc4-4127-80f6-3d4398a2613c","source":"wordfence","cve":"CVE-2026-84834","title":"JobSearch WP Job Board <= 3.2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06b965a6-cbc4-4127-80f6-3d4398a2613c?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:27:36Z"},{"id":"wordfence:06bc7a24-eafc-4b06-852e-9b596f107805","source":"wordfence","cve":"","title":"Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06bc7a24-eafc-4b06-852e-9b596f107805?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.6.0.2","to_inclusive":false,"patched_in":"1.6.0.2"}],"published":"2020-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06bccd2e-6891-433a-9f5b-3ec0c30afef4","source":"wordfence","cve":"CVE-2026-2354","title":"Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06bccd2e-6891-433a-9f5b-3ec0c30afef4?source=api-prod","affected":[{"type":"plugin","slug":"swiss-toolkit-for-wp","name":"Swiss Toolkit For WP","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-10T15:27:04Z","updated":"2026-07-11T03:44:21Z"},{"id":"wordfence:06c1dc58-483e-49f7-aff0-e5a1e70bb149","source":"wordfence","cve":"CVE-2025-11872","title":"Material Design Iconic Font Integration <= 2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c1dc58-483e-49f7-aff0-e5a1e70bb149?source=api-prod","affected":[{"type":"plugin","slug":"material-design-iconic-font-integration","name":"Material Design Iconic Font Integration","from":"*","from_inclusive":true,"to":"2","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:21:38Z","updated":"2025-10-22T08:27:03Z"},{"id":"wordfence:06c3959a-0b25-4534-b7f6-af561c5aad06","source":"wordfence","cve":"CVE-2025-29004","title":"Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c3959a-0b25-4534-b7f6-af561c5aad06?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-flat-countdown","name":"wordpress-flat-countdown","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:46:44Z"},{"id":"wordfence:06c3de6d-92e7-46f8-86a9-37f027767fc0","source":"wordfence","cve":"CVE-2024-13887","title":"Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c3de6d-92e7-46f8-86a9-37f027767fc0?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.14","to_inclusive":true,"patched_in":"6.4.15"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T03:21:03Z"},{"id":"wordfence:06c63f82-fe0f-435c-9cf8-5db6a7ce0677","source":"wordfence","cve":"CVE-2021-24797","title":"Tickera <= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c63f82-fe0f-435c-9cf8-5db6a7ce0677?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.4.8.2","to_inclusive":true,"patched_in":"3.4.8.3"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06c76b28-3a0a-4070-be37-1aa5908eb888","source":"wordfence","cve":"CVE-2025-58983","title":"Include Me <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c76b28-3a0a-4070-be37-1aa5908eb888?source=api-prod","affected":[{"type":"plugin","slug":"include-me","name":"Include Me","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:13:19Z"},{"id":"wordfence:06c86c87-840c-4ca6-9582-98254194eb1b","source":"wordfence","cve":"CVE-2023-40677","title":"Vertical Marquee Plugin <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06c86c87-840c-4ca6-9582-98254194eb1b?source=api-prod","affected":[{"type":"plugin","slug":"vertical-marquee-plugin","name":"Vertical marquee plugin","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06ccfd81-065f-4151-97ea-dd6d4fc79337","source":"wordfence","cve":"CVE-2024-43285","title":"Presto Player <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ccfd81-065f-4151-97ea-dd6d4fc79337?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:27:30Z"},{"id":"wordfence:06d374b0-a4a6-4f0e-af85-66b3a50b1354","source":"wordfence","cve":"","title":"Portfolio Responsive Gallery <= 1.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06d374b0-a4a6-4f0e-af85-66b3a50b1354?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-responsive-gallery","name":"Portfolio Responsive Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06d4a12c-9503-4e89-85e7-64838a42dc28","source":"wordfence","cve":"CVE-2024-53729","title":"Blizzard Quotes <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06d4a12c-9503-4e89-85e7-64838a42dc28?source=api-prod","affected":[{"type":"plugin","slug":"blizzard-quotes","name":"Blizzard Quotes","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-12-12T18:36:59Z"},{"id":"wordfence:06d58e94-225e-43ca-823b-60d921a2dd8d","source":"wordfence","cve":"CVE-2026-39701","title":"ShopWP <= 5.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06d58e94-225e-43ca-823b-60d921a2dd8d?source=api-prod","affected":[{"type":"plugin","slug":"wpshopify","name":"ShopWP","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:32:26Z"},{"id":"wordfence:06dac603-fd41-4401-88a9-5de87813e81a","source":"wordfence","cve":"CVE-2025-62932","title":"Table Block by RioVizual <= 3.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06dac603-fd41-4401-88a9-5de87813e81a?source=api-prod","affected":[{"type":"plugin","slug":"riovizual","name":"RioVizual \u2014 Table Blocks for Comparison, Pricing and Pros & Cons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-10-06T00:00:00Z","updated":"2026-07-08T20:45:36Z"},{"id":"wordfence:06daef36-0873-444f-88eb-3ede68f3afdd","source":"wordfence","cve":"CVE-2023-26532","title":"Social Auto Poster <= 2.1.4 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06daef36-0873-444f-88eb-3ede68f3afdd?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-facebook-auto-post","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06dcb84f-8293-403d-a3f2-7c5bea7aaae3","source":"wordfence","cve":"","title":"Construct <= 1.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06dcb84f-8293-403d-a3f2-7c5bea7aaae3?source=api-prod","affected":[{"type":"theme","slug":"construct","name":"Construct","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06de719e-edee-42f2-b715-efcf98fffea6","source":"wordfence","cve":"CVE-2026-27079","title":"Amfissa <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06de719e-edee-42f2-b715-efcf98fffea6?source=api-prod","affected":[{"type":"theme","slug":"amfissa","name":"Amfissa - Organic Olive Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-03-10T00:00:00Z","updated":"2026-04-15T13:41:33Z"},{"id":"wordfence:06dfc3da-6f61-433c-a1e1-48749b654fcd","source":"wordfence","cve":"CVE-2024-51791","title":"Forms <= 2.8.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06dfc3da-6f61-433c-a1e1-48749b654fcd?source=api-prod","affected":[{"type":"plugin","slug":"forms-by-made-it","name":"Forms","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T16:51:25Z"},{"id":"wordfence:06dfc5d3-3d11-4091-9253-248f799dee75","source":"wordfence","cve":"CVE-2026-39450","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06dfc5d3-3d11-4091-9253-248f799dee75?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:12:48Z"},{"id":"wordfence:06e0f191-27e7-478d-a6ad-351b22311fbf","source":"wordfence","cve":"CVE-2026-65560","title":"Houzez Property Feed <= 2.5.48 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06e0f191-27e7-478d-a6ad-351b22311fbf?source=api-prod","affected":[{"type":"plugin","slug":"houzez-property-feed","name":"Houzez Property Feed","from":"*","from_inclusive":true,"to":"2.5.48","to_inclusive":true,"patched_in":"2.5.49"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:14:05Z"},{"id":"wordfence:06e408f3-3d10-4454-ab71-64f7acd4c850","source":"wordfence","cve":"CVE-2022-1757","title":"pagebar <= 2.65 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06e408f3-3d10-4454-ab71-64f7acd4c850?source=api-prod","affected":[{"type":"plugin","slug":"pagebar","name":"Pagebar2","from":"*","from_inclusive":true,"to":"2.65","to_inclusive":true,"patched_in":"2.66"}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06e48355-6932-4401-8787-e6432444930f","source":"wordfence","cve":"CVE-2024-2031","title":"Video Conferencing with Zoom <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06e48355-6932-4401-8787-e6432444930f?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T19:32:29Z"},{"id":"wordfence:06e4d7e3-c800-4b3d-9504-c69aa9a918fb","source":"wordfence","cve":"CVE-2006-0986","title":"WordPress Core < 2.0.2 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06e4d7e3-c800-4b3d-9504-c69aa9a918fb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2006-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06e90f64-f64e-4871-9106-1d7af02f13d2","source":"wordfence","cve":"","title":"Nuance <= 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06e90f64-f64e-4871-9106-1d7af02f13d2?source=api-prod","affected":[{"type":"theme","slug":"nuance","name":"Nuance","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2013-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06eaf624-aedf-453d-8457-d03a572fac0d","source":"wordfence","cve":"CVE-2025-11749","title":"AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06eaf624-aedf-453d-8457-d03a572fac0d?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-11-04T17:19:25Z","updated":"2025-11-05T05:31:26Z"},{"id":"wordfence:06eaf73f-273c-4733-9ff9-2d8034221814","source":"wordfence","cve":"CVE-2023-40208","title":"Stock Ticker <= 3.23.3 - Reflected Cross-Site Scripting in ajax_stockticker_load","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06eaf73f-273c-4733-9ff9-2d8034221814?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.23.3","to_inclusive":true,"patched_in":"3.23.4"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06ec5c60-169c-4bbb-92bf-802805d46c62","source":"wordfence","cve":"CVE-2026-10148","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ec5c60-169c-4bbb-92bf-802805d46c62?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-12T12:30:04Z"},{"id":"wordfence:06ec9ff7-1dd5-4b9b-8f15-cd9523a708a1","source":"wordfence","cve":"","title":"ALO EasyMail Newsletter <= 2.9.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ec9ff7-1dd5-4b9b-8f15-cd9523a708a1?source=api-prod","affected":[{"type":"plugin","slug":"alo-easymail","name":"ALO EasyMail Newsletter","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":false,"patched_in":"2.9.3"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06ecc40c-6a63-4354-9f49-1925896622f5","source":"wordfence","cve":"CVE-2026-5737","title":"Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ecc40c-6a63-4354-9f49-1925896622f5?source=api-prod","affected":[{"type":"plugin","slug":"independent-analytics","name":"Independent Analytics \u2013 WordPress Analytics Plugin","from":"*","from_inclusive":true,"to":"2.14.9","to_inclusive":true,"patched_in":"2.14.10"}],"published":"2026-05-27T14:52:43Z","updated":"2026-05-28T03:27:26Z"},{"id":"wordfence:06ef1f0c-fdcc-4aaf-9e48-19b5be52351d","source":"wordfence","cve":"CVE-2024-4035","title":"Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef1f0c-fdcc-4aaf-9e48-19b5be52351d?source=api-prod","affected":[{"type":"plugin","slug":"gt3-photo-video-gallery","name":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery","from":"*","from_inclusive":true,"to":"2.7.7.21","to_inclusive":true,"patched_in":"2.7.7.22"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T09:29:57Z"},{"id":"wordfence:06ef2a3b-96d5-40eb-8b35-2b4e3d90f7f6","source":"wordfence","cve":"CVE-2025-32620","title":"Doppler Forms <= 2.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef2a3b-96d5-40eb-8b35-2b4e3d90f7f6?source=api-prod","affected":[{"type":"plugin","slug":"doppler-form","name":"Doppler Easy Multichannel Marketing enhanced with IA","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-04-10T00:00:00Z","updated":"2025-07-21T20:47:43Z"},{"id":"wordfence:06ef69f0-34d3-4389-8a81-a4d9922f1468","source":"wordfence","cve":"CVE-2023-6632","title":"Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef69f0-34d3-4389-8a81-a4d9922f1468?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons-pro","name":"Happy Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"2.9.1.1","to_inclusive":true,"patched_in":"2.10.0"},{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.9.1.1","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:35:49Z"},{"id":"wordfence:06ef9a21-e2b9-40c7-9de5-cff175fa10a5","source":"wordfence","cve":"CVE-2026-1004","title":"Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef9a21-e2b9-40c7-9de5-cff175fa10a5?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2026-01-15T20:04:09Z","updated":"2026-01-16T08:23:38Z"},{"id":"wordfence:06efa097-38dc-4499-b163-7a6254b25f72","source":"wordfence","cve":"CVE-2026-8940","title":"WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06efa097-38dc-4499-b163-7a6254b25f72?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-sort-posts","name":"WP Meta Sort Posts","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:06:15Z","updated":"2026-06-09T03:41:17Z"},{"id":"wordfence:06efdaff-2a03-4a08-bb74-1fae183c5842","source":"wordfence","cve":"CVE-2025-26991","title":"WPPizza <= 3.19.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06efdaff-2a03-4a08-bb74-1fae183c5842?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.19.4","to_inclusive":true,"patched_in":"3.19.5"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:20:30Z"},{"id":"wordfence:06f0d53d-734c-4cc1-902d-bdf4826036bf","source":"wordfence","cve":"CVE-2026-3570","title":"Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f0d53d-734c-4cc1-902d-bdf4826036bf?source=api-prod","affected":[{"type":"plugin","slug":"smarter-analytics","name":"Smarter Analytics","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:14Z","updated":"2026-03-21T03:26:30Z"},{"id":"wordfence:06f1880a-dcb7-4b7b-a9a2-e7201b3d6235","source":"wordfence","cve":"CVE-2026-62090","title":"WineShop - Food & Wine Store WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f1880a-dcb7-4b7b-a9a2-e7201b3d6235?source=api-prod","affected":[{"type":"theme","slug":"wineshop","name":"WineShop - Food & Wine Store WordPress Theme","from":"*","from_inclusive":true,"to":"3.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:36:56Z","updated":"2026-10-13T14:17:07Z"},{"id":"wordfence:06f33e18-0bdd-4c56-a8df-fc1969b9ecf8","source":"wordfence","cve":"CVE-2023-4277","title":"Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Change","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f33e18-0bdd-4c56-a8df-fc1969b9ecf8?source=api-prod","affected":[{"type":"plugin","slug":"realia","name":"Realia","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06f37e3d-4c26-46fa-8928-8dd899ce3317","source":"wordfence","cve":"CVE-2026-96534","title":"Modern Events Calendar (Lite & Pro) <= 7.36.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f37e3d-4c26-46fa-8928-8dd899ce3317?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.36.0","to_inclusive":true,"patched_in":"7.37.0"},{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.36.0","to_inclusive":true,"patched_in":"7.37.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:58:05Z"},{"id":"wordfence:06f3c08a-9791-4c66-a173-8bbbb38d05ab","source":"wordfence","cve":"CVE-2022-3691","title":"DeepL Pro API Translation <= 1.7.4 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f3c08a-9791-4c66-a173-8bbbb38d05ab?source=api-prod","affected":[{"type":"plugin","slug":"wpdeepl","name":"Translation with DeepL API","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06f4b453-6f22-4de3-9aa8-e057959de684","source":"wordfence","cve":"CVE-2026-114707","title":"JetElements <= 2.9.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f4b453-6f22-4de3-9aa8-e057959de684?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.5","to_inclusive":true,"patched_in":"2.9.2.6"}],"published":"2026-10-26T10:28:00Z","updated":"2026-10-28T01:21:12Z"},{"id":"wordfence:06f4b68c-eb17-470a-a119-5143eff7117e","source":"wordfence","cve":"CVE-2025-49300","title":"Traveler Option Tree <= 2.8 - Authenticated (Editor+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f4b68c-eb17-470a-a119-5143eff7117e?source=api-prod","affected":[{"type":"plugin","slug":"custom-option-tree","name":"Traveler Option Tree","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-19T20:41:06Z"},{"id":"wordfence:06f4e758-3328-4ac1-956a-cfadddd12e53","source":"wordfence","cve":"CVE-2025-14065","title":"Simple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f4e758-3328-4ac1-956a-cfadddd12e53?source=api-prod","affected":[{"type":"plugin","slug":"simple-bike-rental","name":"Simple Bike Rental","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-12-11T21:44:51Z","updated":"2026-03-27T10:41:23Z"},{"id":"wordfence:06f54d42-597c-45c5-ae9a-1a134ab6f59f","source":"wordfence","cve":"CVE-2026-18464","title":"Maps Pro <= 6.1.2 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f54d42-597c-45c5-ae9a-1a134ab6f59f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-gold","name":"WP Maps Pro","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:33:54Z"},{"id":"wordfence:06f56834-e1e9-4a02-988a-df4c563182c4","source":"wordfence","cve":"CVE-2023-45837","title":"Ultimate Taxonomy Manager <= 2.0 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f56834-e1e9-4a02-988a-df4c563182c4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-taxonomy-manager","name":"Ultimate Taxonomy Manager","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06f9965e-2a3d-4203-ac32-802ec8cd5ef5","source":"wordfence","cve":"CVE-2026-78287","title":"STAGGS \u2013 Product Configurator Toolkit <= 3.3.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06f9965e-2a3d-4203-ac32-802ec8cd5ef5?source=api-prod","affected":[{"type":"plugin","slug":"staggs","name":"STAGGS \u2013 Product Configurator Toolkit","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:01Z"},{"id":"wordfence:06fa63f7-13c6-4280-b6c8-db27e5e73a6a","source":"wordfence","cve":"CVE-2025-62125","title":"Custom Background Changer <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06fa63f7-13c6-4280-b6c8-db27e5e73a6a?source=api-prod","affected":[{"type":"plugin","slug":"custom-background-changer","name":"Custom Background Changer","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-08-14T15:16:07Z"},{"id":"wordfence:06fc92e9-b2c0-46a0-99b2-10cf0d564f7b","source":"wordfence","cve":"CVE-2026-54814","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.109 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06fc92e9-b2c0-46a0-99b2-10cf0d564f7b?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.109","to_inclusive":true,"patched_in":"1.4.110"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:56:56Z"},{"id":"wordfence:06fee60a-e96c-49ce-9007-0d402ef46d72","source":"wordfence","cve":"","title":"Chocolate WP \u2013 Responsive Photography Theme (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06fee60a-e96c-49ce-9007-0d402ef46d72?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:06ff683d-b3ef-4cae-84f4-be6ada37d5bf","source":"wordfence","cve":"","title":"Visitor Maps <= 1.5.8.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/06ff683d-b3ef-4cae-84f4-be6ada37d5bf?source=api-prod","affected":[{"type":"plugin","slug":"visitor-maps","name":"visitor-maps","from":"*","from_inclusive":true,"to":"1.5.8.6","to_inclusive":true,"patched_in":"1.5.8.7"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07043be9-c81e-4021-90af-976ae57c0bec","source":"wordfence","cve":"CVE-2025-12016","title":"qnotsquiz <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07043be9-c81e-4021-90af-976ae57c0bec?source=api-prod","affected":[{"type":"plugin","slug":"qnotsquiz","name":"qnotsquiz","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T19:55:50Z","updated":"2025-10-24T08:23:56Z"},{"id":"wordfence:0705042b-c187-4886-90ca-3bf46910e239","source":"wordfence","cve":"CVE-2026-76559","title":"Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0705042b-c187-4886-90ca-3bf46910e239?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:50:15Z"},{"id":"wordfence:070616c9-b6a3-43d9-a82d-5cbcffc39ad9","source":"wordfence","cve":"CVE-2026-8868","title":"Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070616c9-b6a3-43d9-a82d-5cbcffc39ad9?source=api-prod","affected":[{"type":"plugin","slug":"single-mailchimp","name":"Single Mailchimp","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:05Z","updated":"2026-05-27T05:31:19Z"},{"id":"wordfence:07067eb5-d15e-4342-914f-5e2a08ea8bb4","source":"wordfence","cve":"","title":"WP Live Chat Support <= 4.3.5 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07067eb5-d15e-4342-914f-5e2a08ea8bb4?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2015-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07068c38-9cae-4f3e-beee-388de26b9741","source":"wordfence","cve":"CVE-2025-32306","title":"Radio Player Shoutcast & Icecast WordPress Plugin <= 4.4.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07068c38-9cae-4f3e-beee-388de26b9741?source=api-prod","affected":[{"type":"plugin","slug":"audio4-html5","name":"Radio Player Shoutcast & Icecast WordPress Plugin","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-24T22:14:47Z"},{"id":"wordfence:07069f39-f892-4c19-8e0b-e5e17b1ffb21","source":"wordfence","cve":"CVE-2026-9188","title":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07069f39-f892-4c19-8e0b-e5e17b1ffb21?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-07-01T20:20:27Z","updated":"2026-07-02T08:33:04Z"},{"id":"wordfence:07088f04-5c83-40e1-966b-11dce82bfaed","source":"wordfence","cve":"CVE-2025-58834","title":"short.io <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07088f04-5c83-40e1-966b-11dce82bfaed?source=api-prod","affected":[{"type":"plugin","slug":"wp-shortcm","name":"short.io","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T13:33:38Z"},{"id":"wordfence:070a5d26-9126-4d0e-9421-739090bea421","source":"wordfence","cve":"CVE-2014-10394","title":"Rich Counter < 1.2.0 - JavaScript Injection","severity":"high","cvss":7.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070a5d26-9126-4d0e-9421-739090bea421?source=api-prod","affected":[{"type":"plugin","slug":"rich-counter","name":"Rich Counter","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2014-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:070ccd70-22c3-47f1-9dce-a884bff9ea76","source":"wordfence","cve":"CVE-2026-13253","title":"Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070ccd70-22c3-47f1-9dce-a884bff9ea76?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.31","to_inclusive":true,"patched_in":"5.0.32"}],"published":"2026-07-08T18:16:25Z","updated":"2026-07-09T06:52:44Z"},{"id":"wordfence:070d7310-ae5f-4486-9b93-36253e24f895","source":"wordfence","cve":"CVE-2025-68515","title":"WP Booking System \u2013 Booking Calendar <= 2.0.19.12 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070d7310-ae5f-4486-9b93-36253e24f895?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.19.12","to_inclusive":true,"patched_in":"2.0.19.13"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T18:24:16Z"},{"id":"wordfence:070f66ae-65aa-4670-8b69-103070a000a4","source":"wordfence","cve":"CVE-2024-13406","title":"XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070f66ae-65aa-4670-8b69-103070a000a4?source=api-prod","affected":[{"type":"plugin","slug":"xml-for-google-merchant-center","name":"XML for Google Merchant Center","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:03:51Z"},{"id":"wordfence:070f6820-e70c-4325-b5cb-d2010da34dce","source":"wordfence","cve":"CVE-2024-3583","title":"Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070f6820-e70c-4325-b5cb-d2010da34dce?source=api-prod","affected":[{"type":"plugin","slug":"simple-facebook-plugin","name":"Simple Like Page \u2013 Fast & Privacy-Friendly Page Embeds","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-05-29T21:40:21Z","updated":"2024-05-31T15:30:05Z"},{"id":"wordfence:070f6a8e-a06d-4f48-9703-933515a3098c","source":"wordfence","cve":"CVE-2022-4783","title":"Youtube Channel Gallery <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070f6a8e-a06d-4f48-9703-933515a3098c?source=api-prod","affected":[{"type":"plugin","slug":"youtube-channel-gallery","name":"Youtube Channel Gallery","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:070fc3ec-b611-4ae6-9168-11a8c3c5d814","source":"wordfence","cve":"CVE-2026-112838","title":"VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070fc3ec-b611-4ae6-9168-11a8c3c5d814?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:17Z"},{"id":"wordfence:070fd387-c0ca-47bf-a37a-530c1ffdb6ed","source":"wordfence","cve":"CVE-2016-0770","title":"Connections Business Directory < 8.5.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070fd387-c0ca-47bf-a37a-530c1ffdb6ed?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"8.5.9","to_inclusive":false,"patched_in":"8.5.9"}],"published":"2016-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:071195d6-3452-4241-a8d3-92efc84e4850","source":"wordfence","cve":"CVE-2024-2771","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/071195d6-3452-4241-a8d3-92efc84e4850?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"5.1.17"}],"published":"2024-05-17T19:02:43Z","updated":"2024-05-18T07:38:21Z"},{"id":"wordfence:07129ff6-0bbd-4717-842c-6d50a19eca39","source":"wordfence","cve":"CVE-2026-116558","title":"Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07129ff6-0bbd-4717-842c-6d50a19eca39?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2026-11-06T18:19:28Z","updated":"2026-11-07T06:39:34Z"},{"id":"wordfence:0714273b-014e-4bed-b394-138f46a77eaa","source":"wordfence","cve":"CVE-2026-15401","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0714273b-014e-4bed-b394-138f46a77eaa?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.13","to_inclusive":true,"patched_in":"1.8.14"}],"published":"2026-07-23T20:31:52Z","updated":"2026-07-24T09:31:45Z"},{"id":"wordfence:0715b5bf-8123-4e75-95e1-4b7d39f37d64","source":"wordfence","cve":"CVE-2026-11399","title":"Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0715b5bf-8123-4e75-95e1-4b7d39f37d64?source=api-prod","affected":[{"type":"plugin","slug":"support-ticket-system-for-woocommerce","name":"Helpdesk Support Ticket System for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-02T17:09:22Z","updated":"2026-10-03T05:29:13Z"},{"id":"wordfence:0716471e-388c-43e5-abc3-84c78569e61a","source":"wordfence","cve":"CVE-2021-25016","title":"Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button - Chaty <= 2.8.2 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0716471e-388c-43e5-abc3-84c78569e61a?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0716485b-e94b-4e09-9c01-1059017bfcc8","source":"wordfence","cve":"CVE-2025-3781","title":"Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0716485b-e94b-4e09-9c01-1059017bfcc8?source=api-prod","affected":[{"type":"plugin","slug":"raisely-donation-form","name":"Raisely Donation Form","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-05-20T20:32:42Z","updated":"2025-05-30T18:04:27Z"},{"id":"wordfence:0719bd79-3b6f-4407-ae83-5fa463c63953","source":"wordfence","cve":"CVE-2026-16259","title":"Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0719bd79-3b6f-4407-ae83-5fa463c63953?source=api-prod","affected":[{"type":"plugin","slug":"uix-usercenter","name":"Uix UserCenter","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:31:41Z"},{"id":"wordfence:0719db26-da88-4bda-ae83-f489591c8128","source":"wordfence","cve":"CVE-2014-9100","title":"WhyDoWork AdSense <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0719db26-da88-4bda-ae83-f489591c8128?source=api-prod","affected":[{"type":"plugin","slug":"whydowork-adsense","name":"WhyDoWork AdSense","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:071b5c32-b6ac-402a-af74-6ecd05279d93","source":"wordfence","cve":"CVE-2023-23884","title":"Kanban Boards for WordPress <= 2.5.21 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/071b5c32-b6ac-402a-af74-6ecd05279d93?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.21","to_inclusive":true,"patched_in":""}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:071cbf50-3af4-4d61-8f49-e967e30294be","source":"wordfence","cve":"CVE-2025-64369","title":"Contact Form Email <= 1.3.58 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/071cbf50-3af4-4d61-8f49-e967e30294be?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.58","to_inclusive":true,"patched_in":"1.3.59"}],"published":"2025-11-15T00:00:00Z","updated":"2025-11-17T19:11:24Z"},{"id":"wordfence:07204802-b58a-45ae-9779-137f14e730e5","source":"wordfence","cve":"CVE-2026-62060","title":"Captivate Sync <= 3.3.2 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07204802-b58a-45ae-9779-137f14e730e5?source=api-prod","affected":[{"type":"plugin","slug":"captivatesync-trade","name":"Captivate Sync","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-10-01T12:39:00Z","updated":"2026-10-08T23:37:34Z"},{"id":"wordfence:072092ef-17bc-4b8b-bf8b-bd69a761c56a","source":"wordfence","cve":"CVE-2023-26325","title":"ReviewX \u2013 Multi-criteria Rating & Reviews for WooCommerce <= 1.6.8 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/072092ef-17bc-4b8b-bf8b-bd69a761c56a?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07244763-3482-4cfb-8ae4-d19f312011aa","source":"wordfence","cve":"CVE-2024-10390","title":"Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07244763-3482-4cfb-8ae4-d19f312011aa?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-telegram-chat-cc","name":"Elfsight Telegram Chat CC","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-18T16:31:32Z"},{"id":"wordfence:0724ba92-c895-4698-b48d-61dd6353d4da","source":"wordfence","cve":"CVE-2024-37111","title":"WishList Member X < 3.26.7 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0724ba92-c895-4698-b48d-61dd6353d4da?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-24T22:21:18Z"},{"id":"wordfence:0725a122-9ad3-45bf-bf80-80881520634a","source":"wordfence","cve":"CVE-2025-22804","title":"Author Avatars List/Block <= 2.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0725a122-9ad3-45bf-bf80-80881520634a?source=api-prod","affected":[{"type":"plugin","slug":"author-avatars","name":"Author Avatars List/Block","from":"*","from_inclusive":true,"to":"2.1.23","to_inclusive":true,"patched_in":"2.1.24"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:55:57Z"},{"id":"wordfence:0725c03e-d85a-4e93-9f1f-b9b83fb2e5ed","source":"wordfence","cve":"CVE-2026-97260","title":"MaxGalleria <= 6.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0725c03e-d85a-4e93-9f1f-b9b83fb2e5ed?source=api-prod","affected":[{"type":"plugin","slug":"maxgalleria","name":"MaxGalleria","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2026-10-01T12:11:25Z","updated":"2026-10-09T00:13:43Z"},{"id":"wordfence:0725c0ac-91a7-4359-b911-a450635b09bb","source":"wordfence","cve":"CVE-2021-24546","title":"EditorsKit <= 1.31.5 - Authenticated (Contributor+) Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0725c0ac-91a7-4359-b911-a450635b09bb?source=api-prod","affected":[{"type":"plugin","slug":"block-options","name":"Gutenberg Block Editor Toolkit \u2013 EditorsKit","from":"*","from_inclusive":true,"to":"1.31.5","to_inclusive":true,"patched_in":"1.31.6"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07287a85-df00-408a-8b02-978fd3116155","source":"wordfence","cve":"CVE-2024-1568","title":"Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07287a85-df00-408a-8b02-978fd3116155?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.52","to_inclusive":true,"patched_in":"2.21"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T06:46:48Z"},{"id":"wordfence:0728b42b-5ec7-46a2-a9a5-3316107e9324","source":"wordfence","cve":"CVE-2026-4279","title":"Bread & Butter: Content Gating for Verified Leads <= 8.6.0.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0728b42b-5ec7-46a2-a9a5-3316107e9324?source=api-prod","affected":[{"type":"plugin","slug":"bread-butter","name":"Bread & Butter \u2013 Identify Website Visitors, Score Leads & Gate Content","from":"*","from_inclusive":true,"to":"8.6.0.107","to_inclusive":true,"patched_in":"8.7.0.139"}],"published":"2026-04-21T19:07:06Z","updated":"2026-07-10T17:20:28Z"},{"id":"wordfence:0728e7ac-2091-41de-90a0-e231c4b99ab0","source":"wordfence","cve":"","title":"WooThemes WooFramework < 5.3.10 - Remote Code Execution via Shortcodes","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0728e7ac-2091-41de-90a0-e231c4b99ab0?source=api-prod","affected":[{"type":"theme","slug":"wootique","name":"Wootique","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"},{"type":"theme","slug":"canvas","name":"Canvas","from":"*","from_inclusive":true,"to":"4.7.10","to_inclusive":true,"patched_in":"4.7.11"},{"type":"theme","slug":"woostore","name":"WooStore","from":"*","from_inclusive":true,"to":"1.3.32","to_inclusive":true,"patched_in":"1.4"},{"type":"theme","slug":"sentient","name":"Sentient","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2012-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:072a1fb5-aedc-4556-909f-61bbda37dfa2","source":"wordfence","cve":"CVE-2025-64201","title":"PowerPress Podcasting <= 11.13.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/072a1fb5-aedc-4556-909f-61bbda37dfa2?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.13.12","to_inclusive":true,"patched_in":"11.14"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-04T15:25:48Z"},{"id":"wordfence:072b66dd-a5d3-46b5-92ec-9cc83b8ea8ef","source":"wordfence","cve":"CVE-2024-43966","title":"WP Testimonial Widget <= 3.1 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/072b66dd-a5d3-46b5-92ec-9cc83b8ea8ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-testimonial-widget","name":"WP Testimonial Widget","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-11-07T21:42:24Z"},{"id":"wordfence:072fbfe7-37df-412e-bddb-68837473b3d6","source":"wordfence","cve":"CVE-2007-4482","title":"Pool <= 1.0.7 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/072fbfe7-37df-412e-bddb-68837473b3d6?source=api-prod","affected":[{"type":"theme","slug":"pool","name":"Pool","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1"}],"published":"2007-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07300429-c445-4d2a-90aa-5072a17f8113","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via maybe_install_suggested_plugins","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07300429-c445-4d2a-90aa-5072a17f8113?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0733261f-a2e1-4bd1-a57d-fdaaa8c904db","source":"wordfence","cve":"CVE-2025-3103","title":"CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0733261f-a2e1-4bd1-a57d-fdaaa8c904db?source=api-prod","affected":[{"type":"plugin","slug":"elementor_widget_clever_radio_player","name":"CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T04:21:14Z"},{"id":"wordfence:07357de3-bbf5-40d3-a171-3b624b572e6c","source":"wordfence","cve":"CVE-2024-33642","title":"Advanced Post List  <= 0.5.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07357de3-bbf5-40d3-a171-3b624b572e6c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-list","name":"Advanced Post List","from":"*","from_inclusive":true,"to":"0.5.6.1","to_inclusive":true,"patched_in":"0.5.6.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-27T18:10:11Z"},{"id":"wordfence:07361278-7abb-4d22-a8df-218d3f982483","source":"wordfence","cve":"CVE-2026-9104","title":"Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07361278-7abb-4d22-a8df-218d3f982483?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"2.6.3","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-05-21T14:52:57Z","updated":"2026-05-22T03:39:20Z"},{"id":"wordfence:07372843-f7d3-4ae4-96b4-ef3f475504ff","source":"wordfence","cve":"CVE-2022-47436","title":"Yatra <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07372843-f7d3-4ae4-96b4-ef3f475504ff?source=api-prod","affected":[{"type":"plugin","slug":"yatra","name":"Yatra \u2013 Travel Booking & Tour Operator Software","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07380092-6fe9-4f9e-ae13-3219e355dbd5","source":"wordfence","cve":"CVE-2025-58875","title":"WP Github Gist <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07380092-6fe9-4f9e-ae13-3219e355dbd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-github-gist","name":"WP Github Gist","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T22:09:31Z"},{"id":"wordfence:0739b5ec-b1c4-4451-97c1-f8d5ed26a2d5","source":"wordfence","cve":"CVE-2025-6786","title":"DocCheck Login <= 1.1.5 - Unauthorized Post Access","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0739b5ec-b1c4-4451-97c1-f8d5ed26a2d5?source=api-prod","affected":[{"type":"plugin","slug":"doccheck-login","name":"DocCheck Login","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-07-03T12:24:08Z","updated":"2025-07-25T15:06:52Z"},{"id":"wordfence:073a3b48-7c21-4511-a8e4-3443ef05fd0b","source":"wordfence","cve":"CVE-2023-23737","title":"MainWP Broken Link Checker <= 4.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/073a3b48-7c21-4511-a8e4-3443ef05fd0b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-broken-links-checker-extension","name":"MainWP Broken Link Checker","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:073db945-becb-4b81-a1f9-7b73c30a8c50","source":"wordfence","cve":"CVE-2025-69006","title":"AM Events <= 1.13.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/073db945-becb-4b81-a1f9-7b73c30a8c50?source=api-prod","affected":[{"type":"plugin","slug":"am-events","name":"AM Events","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:03:05Z"},{"id":"wordfence:073f1c3b-638a-4d83-9dd2-6fc07e164b21","source":"wordfence","cve":"CVE-2025-49366","title":"Hanani <= 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/073f1c3b-638a-4d83-9dd2-6fc07e164b21?source=api-prod","affected":[{"type":"theme","slug":"hanani","name":"Hanani | Jewish Community & Synagogue WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:21:55Z"},{"id":"wordfence:0741bbf2-1098-41f4-a6d4-7e5c8f75f30b","source":"wordfence","cve":"CVE-2024-43226","title":"WP Dashboard Notes <= 1.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0741bbf2-1098-41f4-a6d4-7e5c8f75f30b?source=api-prod","affected":[{"type":"plugin","slug":"wp-dashboard-notes","name":"WP Dashboard Notes","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-14T18:54:18Z"},{"id":"wordfence:07422361-3c7c-4e3c-bbfb-097c7fe5f2b4","source":"wordfence","cve":"","title":"Gutenberg Template and Pattern Library & Redux Framework <= 4.1.20 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07422361-3c7c-4e3c-bbfb-097c7fe5f2b4?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2020-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:074393ae-ff1e-4477-aaaa-24a6976dd2c2","source":"wordfence","cve":"CVE-2024-9600","title":"Ditty <= 3.1.46 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074393ae-ff1e-4477-aaaa-24a6976dd2c2?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.46","to_inclusive":true,"patched_in":"3.1.47"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-15T19:26:34Z"},{"id":"wordfence:0745c9a7-3972-4089-81ae-835dfeb4dc48","source":"wordfence","cve":"CVE-2025-22497","title":"Simple Google Calendar Outlook Events Block Widget <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0745c9a7-3972-4089-81ae-835dfeb4dc48?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-icalendar-widget","name":"Simple Google Calendar Outlook Events Widget","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-02-11T00:00:00Z","updated":"2025-03-06T20:37:52Z"},{"id":"wordfence:0747b104-5be6-44eb-b62c-0026f810573c","source":"wordfence","cve":"","title":"SEO Plugin by Squirrly SEO < 6.1.5 - Missing Authorization Checks","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0747b104-5be6-44eb-b62c-0026f810573c?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":false,"patched_in":"6.1.5"}],"published":"2016-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0747bba7-01fa-4d70-a419-2732cd25a9ad","source":"wordfence","cve":"CVE-2026-65574","title":"Abogado - Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0747bba7-01fa-4d70-a419-2732cd25a9ad?source=api-prod","affected":[{"type":"theme","slug":"abogado","name":"Abogado - Lawyer WordPress Theme","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:58:03Z"},{"id":"wordfence:0747c996-982c-42a9-942e-2fa7056127f8","source":"wordfence","cve":"CVE-2025-68561","title":"AutomatorWP <= 5.2.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0747c996-982c-42a9-942e-2fa7056127f8?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2025-06-19T00:00:00Z","updated":"2026-01-05T18:51:03Z"},{"id":"wordfence:0748838a-191a-4dde-80c9-7898c1de6adc","source":"wordfence","cve":"CVE-2026-59543","title":"Advanced Views \u2013 Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver\u2026 <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution","severity":"medium","cvss":4.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0748838a-191a-4dde-80c9-7898c1de6adc?source=api-prod","affected":[{"type":"plugin","slug":"acf-views","name":"Advanced Views \u2013 Display Framework \u2013 Gutenberg/Elementor/Shortcode","from":"*","from_inclusive":true,"to":"3.8.11","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:57:27Z"},{"id":"wordfence:074c95bb-c68e-452d-bd2e-c44866aeedba","source":"wordfence","cve":"CVE-2026-18843","title":"Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074c95bb-c68e-452d-bd2e-c44866aeedba?source=api-prod","affected":[{"type":"plugin","slug":"bb-plugin","name":"Beaver Builder Plugin (Starter Version)","from":"*","from_inclusive":true,"to":"2.11.0.1","to_inclusive":true,"patched_in":"2.11.0.2"}],"published":"2026-09-04T17:38:13Z","updated":"2026-09-05T06:37:55Z"},{"id":"wordfence:074d7b46-60e0-4d4a-904a-696ac7948a35","source":"wordfence","cve":"CVE-2024-31924","title":"EWWW Image Optimizer <= 7.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074d7b46-60e0-4d4a-904a-696ac7948a35?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-05-07T20:46:45Z"},{"id":"wordfence:074d8ccc-4fd6-4d46-9bc2-98d209f5a6a1","source":"wordfence","cve":"CVE-2024-11723","title":"kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074d8ccc-4fd6-4d46-9bc2-98d209f5a6a1?source=api-prod","affected":[{"type":"plugin","slug":"kvcore-idx","name":"kvCORE IDX","from":"*","from_inclusive":true,"to":"2.3.35","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:24:36Z","updated":"2024-12-12T04:23:09Z"},{"id":"wordfence:074d9712-9b26-47da-9e24-49854fd7257c","source":"wordfence","cve":"CVE-2026-4082","title":"ER Swiffy Insert <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074d9712-9b26-47da-9e24-49854fd7257c?source=api-prod","affected":[{"type":"plugin","slug":"er-swiffy-insert","name":"ER Swiffy Insert","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:24Z","updated":"2026-04-22T07:45:30Z"},{"id":"wordfence:074d995e-42cc-42f0-bdbe-de181180b511","source":"wordfence","cve":"CVE-2024-35723","title":"Dashboard To-Do List <= 1.2.0 - Missing Authorization via ardtdw_widgetsetup()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074d995e-42cc-42f0-bdbe-de181180b511?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-to-do-list","name":"Dashboard To-Do List","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:52:04Z"},{"id":"wordfence:074e8e37-147d-47ea-93ed-652d7de7be9e","source":"wordfence","cve":"CVE-2023-32238","title":"TheGem < 5.8.1.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/074e8e37-147d-47ea-93ed-652d7de7be9e?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.8.1.1","to_inclusive":false,"patched_in":"5.8.1.1"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0752b4f3-b9f0-4c39-8e4c-2db188600087","source":"wordfence","cve":"CVE-2023-51677","title":"Schema & Structured Data for WP & AMP <= 1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0752b4f3-b9f0-4c39-8e4c-2db188600087?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.24"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07534aa5-a7c4-4dc7-82ac-7e9c568f524c","source":"wordfence","cve":"CVE-2024-47339","title":"WP Mail Catcher <= 2.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07534aa5-a7c4-4dc7-82ac-7e9c568f524c?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:23:52Z"},{"id":"wordfence:0753bd90-0f1a-4efa-9cbd-7cc80d91e84f","source":"wordfence","cve":"CVE-2023-45061","title":"WP Job Openings <= 3.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0753bd90-0f1a-4efa-9cbd-7cc80d91e84f?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-openings","name":"HireZoot \u2013 Job Listings, Career Page & Recruitment Tool","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-10-03T00:00:00Z","updated":"2024-08-16T17:35:48Z"},{"id":"wordfence:0753e172-3ff7-42a9-8651-d12573406d11","source":"wordfence","cve":"","title":"WP eCommerce <= 3.8.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0753e172-3ff7-42a9-8651-d12573406d11?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.9.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:075709e0-5f00-4d7b-80f6-96e3b4b4a895","source":"wordfence","cve":"CVE-2024-12315","title":"Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/075709e0-5f00-4d7b-80f6-96e3b4b4a895?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.10"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T08:25:45Z"},{"id":"wordfence:0758e317-d67e-4767-bbaa-cfcbf86d4819","source":"wordfence","cve":"CVE-2025-31853","title":"Smartarget Popup <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0758e317-d67e-4767-bbaa-cfcbf86d4819?source=api-prod","affected":[{"type":"plugin","slug":"smartarget-popup","name":"Smartarget Popup","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-04-01T00:00:00Z","updated":"2026-07-08T20:42:47Z"},{"id":"wordfence:075d6557-8fb4-4e69-924f-feff3d2827ed","source":"wordfence","cve":"CVE-2024-37957","title":"Bradmax Player <= 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/075d6557-8fb4-4e69-924f-feff3d2827ed?source=api-prod","affected":[{"type":"plugin","slug":"bradmax-player","name":"Bradmax Player","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2024-07-10T00:00:00Z","updated":"2024-09-23T18:10:38Z"},{"id":"wordfence:075dce39-f06c-4ab3-a1ec-2669f32a81ab","source":"wordfence","cve":"CVE-2026-32501","title":"WP Configurator Pro <= 3.7.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/075dce39-f06c-4ab3-a1ec-2669f32a81ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-configurator-pro","name":"WP Configurator Pro","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:23:51Z"},{"id":"wordfence:075e64fb-acaf-4f0f-bbc8-db7855184970","source":"wordfence","cve":"CVE-2019-11843","title":"MailPoet \u2013 emails and newsletters in WordPress <= 3.23.1 - Reflected Cross-Site Scripting via URL parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/075e64fb-acaf-4f0f-bbc8-db7855184970?source=api-prod","affected":[{"type":"plugin","slug":"mailpoet","name":"MailPoet \u2013 Newsletters, Email Marketing, and Automation","from":"*","from_inclusive":true,"to":"3.23.2","to_inclusive":false,"patched_in":"3.23.2"}],"published":"2019-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:075f328b-e854-4312-98d1-634acd6b1c22","source":"wordfence","cve":"CVE-2025-54699","title":"Masteriyo - LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/075f328b-e854-4312-98d1-634acd6b1c22?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.18.3","to_inclusive":true,"patched_in":"1.18.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:57:23Z"},{"id":"wordfence:0760bc9f-0f02-47fd-9865-d9d269a69778","source":"wordfence","cve":"CVE-2026-19709","title":"Membership For WooCommerce < 3.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0760bc9f-0f02-47fd-9865-d9d269a69778?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:12:42Z"},{"id":"wordfence:0764d59b-c9bc-4f3c-98df-69ccb7f4bc2d","source":"wordfence","cve":"CVE-2017-1002010","title":"Membership Simplified <= 1.58 Beta - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0764d59b-c9bc-4f3c-98df-69ccb7f4bc2d?source=api-prod","affected":[{"type":"plugin","slug":"membership-simplified-for-oap-members-only","name":"Membership Simplified","from":"*","from_inclusive":true,"to":"1.58","to_inclusive":false,"patched_in":"1.58"}],"published":"2017-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:076526c3-a188-49a0-afcb-85c1f8d5d605","source":"wordfence","cve":"CVE-2025-52783","title":"Change Cart button Colors WooCommerce <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076526c3-a188-49a0-afcb-85c1f8d5d605?source=api-prod","affected":[{"type":"plugin","slug":"wc-style","name":"Change Cart button Colors WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:01:02Z"},{"id":"wordfence:076607ec-d848-4b4e-986b-31287f8f0ae4","source":"wordfence","cve":"CVE-2026-109381","title":"Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076607ec-d848-4b4e-986b-31287f8f0ae4?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2026-10-27T17:41:38Z","updated":"2026-10-28T06:45:06Z"},{"id":"wordfence:07663fae-53e9-45d2-834c-6e1392484e0a","source":"wordfence","cve":"CVE-2023-46087","title":"Who Hit The Page \u2013 Hit Counter <= 1.4.14.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07663fae-53e9-45d2-834c-6e1392484e0a?source=api-prod","affected":[{"type":"plugin","slug":"who-hit-the-page-hit-counter","name":"Who Hit The Page \u2013 Hit Counter","from":"*","from_inclusive":true,"to":"1.4.14.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0767e5ef-477f-4b0c-a86e-6298614c9777","source":"wordfence","cve":"CVE-2026-14826","title":"Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0767e5ef-477f-4b0c-a86e-6298614c9777?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.3","to_inclusive":true,"patched_in":"11.2.4"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T22:57:37Z"},{"id":"wordfence:07693689-2f61-41dc-9fa1-b6e5f0073dc5","source":"wordfence","cve":"CVE-2024-30244","title":"Church Admin <= 4.0.27 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07693689-2f61-41dc-9fa1-b6e5f0073dc5?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"4.0.28"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-11T13:33:28Z"},{"id":"wordfence:076d1b28-bc43-4e70-995c-71b236e7f698","source":"wordfence","cve":"CVE-2024-44036","title":"Kodex Posts likes <= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076d1b28-bc43-4e70-995c-71b236e7f698?source=api-prod","affected":[{"type":"plugin","slug":"kodex-posts-likes","name":"Kodex Posts likes","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T19:54:23Z"},{"id":"wordfence:076e063d-716f-4b45-af23-83d1deec4af4","source":"wordfence","cve":"CVE-2025-57902","title":"RIS Version Switcher &#8211; Downgrade or Upgrade WP Versions Easily <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076e063d-716f-4b45-af23-83d1deec4af4?source=api-prod","affected":[{"type":"plugin","slug":"ris-version-switcher","name":"RIS Version Switcher \u2013 Downgrade or Upgrade WP Versions Easily","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:09:41Z"},{"id":"wordfence:076e79f0-88db-4216-8920-7c16ace4f07b","source":"wordfence","cve":"CVE-2025-53456","title":"SEO Backlink Monitor <= 1.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076e79f0-88db-4216-8920-7c16ace4f07b?source=api-prod","affected":[{"type":"plugin","slug":"seo-backlink-monitor","name":"SEO Backlink Monitor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T13:53:50Z"},{"id":"wordfence:076f36fb-c2fb-43e0-a027-1351d3995489","source":"wordfence","cve":"CVE-2024-10728","title":"PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076f36fb-c2fb-43e0-a027-1351d3995489?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.16","to_inclusive":true,"patched_in":"4.1.17"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-16T04:29:15Z"},{"id":"wordfence:07712191-03b6-4de4-b0a4-e6f03ce9dc81","source":"wordfence","cve":"","title":"Restaurant & Cafe Addon for Elementor <= 1.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07712191-03b6-4de4-b0a4-e6f03ce9dc81?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07729c28-a73a-46f4-853e-116792d612f5","source":"wordfence","cve":"CVE-2024-13419","title":"Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07729c28-a73a-46f4-853e-116792d612f5?source=api-prod","affected":[{"type":"plugin","slug":"beyot-framework","name":"Beyot Framework","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"benaa-framework","name":"Benaa Framework","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"g5plus-auteur","name":"Auteur Framework","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"april-framework","name":"April Framework","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:18Z"},{"id":"wordfence:077538e2-ef9a-490f-9188-31f9cb82aaf7","source":"wordfence","cve":"CVE-2024-12005","title":"WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077538e2-ef9a-490f-9188-31f9cb82aaf7?source=api-prod","affected":[{"type":"plugin","slug":"wp-bibtex","name":"WP-BibTeX","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-01-20T20:29:19Z","updated":"2025-01-21T09:21:10Z"},{"id":"wordfence:0775b36b-d543-41f9-a20d-f629b40c70d7","source":"wordfence","cve":"CVE-2023-28995","title":"Configurable Tag Cloud <= 5.2 - Cross-Site Request Forgery via ctc_options_page()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0775b36b-d543-41f9-a20d-f629b40c70d7?source=api-prod","affected":[{"type":"plugin","slug":"configurable-tag-cloud-widget","name":"Configurable Tag Cloud (CTC)","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0776af6c-d31a-46b1-8e4f-d2f503bf0db7","source":"wordfence","cve":"CVE-2026-112861","title":"Participants Database <= 2.7.8.5 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0776af6c-d31a-46b1-8e4f-d2f503bf0db7?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-20T17:47:00Z","updated":"2026-10-23T18:53:25Z"},{"id":"wordfence:07775638-270b-4424-8e2a-3ead1d752c88","source":"wordfence","cve":"CVE-2025-11809","title":"WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07775638-270b-4424-8e2a-3ead1d752c88?source=api-prod","affected":[{"type":"plugin","slug":"wp-force-images-download","name":"WP-Force Images Download","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-10-21T20:17:11Z","updated":"2025-10-30T14:15:56Z"},{"id":"wordfence:0777f759-6980-4572-a866-0210bd5f5085","source":"wordfence","cve":"CVE-2026-3335","title":"Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0777f759-6980-4572-a866-0210bd5f5085?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-03-20T15:13:52Z","updated":"2026-05-12T19:57:44Z"},{"id":"wordfence:0778c676-92e6-4813-a564-06463fc84eec","source":"wordfence","cve":"CVE-2024-13399","title":"Gosign \u2013 Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0778c676-92e6-4813-a564-06463fc84eec?source=api-prod","affected":[{"type":"plugin","slug":"gosign-posts-slider-block","name":"Gosign \u2013 Posts Slider Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T14:11:16Z","updated":"2025-01-31T02:24:17Z"},{"id":"wordfence:077a31e7-de4b-418f-ac90-5c51a690bc65","source":"wordfence","cve":"CVE-2024-10184","title":"SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077a31e7-de4b-418f-ac90-5c51a690bc65?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-kick-integration","name":"StreamWeasels Kick Integration","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-10-28T21:38:16Z","updated":"2024-10-29T11:01:33Z"},{"id":"wordfence:077a8f33-8a15-4bd6-9ce5-b549c321b967","source":"wordfence","cve":"CVE-2026-32570","title":"Progressify - Progressive Web App (PWA) <= 1.6.0 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077a8f33-8a15-4bd6-9ce5-b549c321b967?source=api-prod","affected":[{"type":"plugin","slug":"progressify","name":"Progressify \u2013 All-in-One Progressive Web App (PWA)","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:50:36Z"},{"id":"wordfence:077b3483-ab1c-401d-aa67-c4da5fca90b4","source":"wordfence","cve":"","title":"File Manager <= 4.8 - Missing Authorization on AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077b3483-ab1c-401d-aa67-c4da5fca90b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2019-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:077c36f3-91ee-4fac-8303-2222816e4707","source":"wordfence","cve":"CVE-2025-31059","title":"WBW Product Table PRO <= 2.2.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077c36f3-91ee-4fac-8303-2222816e4707?source=api-prod","affected":[{"type":"plugin","slug":"woo-producttables-pro","name":"WBW Product Table Pro","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-05-30T00:00:00Z","updated":"2026-02-10T20:04:42Z"},{"id":"wordfence:077ec165-edd3-4c2c-b1ea-01ca5b80f779","source":"wordfence","cve":"CVE-2023-23822","title":"UTM Tracker <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077ec165-edd3-4c2c-b1ea-01ca5b80f779?source=api-prod","affected":[{"type":"plugin","slug":"utm-tracker","name":"UTM Tracker","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:077f3152-9735-41c7-9a17-5202b3ee3152","source":"wordfence","cve":"CVE-2025-22640","title":"Paytm Payment Donation <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/077f3152-9735-41c7-9a17-5202b3ee3152?source=api-prod","affected":[{"type":"plugin","slug":"paytm-donation","name":"Paytm Payment Donation","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-03-04T20:43:19Z"},{"id":"wordfence:0782046b-2475-4fda-be91-4866253bf1b7","source":"wordfence","cve":"CVE-2024-51870","title":"Ultimate Flipbox Addon for Elementor  1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0782046b-2475-4fda-be91-4866253bf1b7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-flipbox-addon-for-elementor","name":"Flipbox Addon for Elementor","from":"1.0.4","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-23T17:36:09Z"},{"id":"wordfence:0782bc16-7d21-4205-af01-97e3ad3db40b","source":"wordfence","cve":"CVE-2024-10180","title":"Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0782bc16-7d21-4205-af01-97e3ad3db40b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-repeatable-fields","name":"Contact Form 7 \u2013 Repeatable Fields","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-10-23T23:47:38Z","updated":"2024-10-24T12:32:58Z"},{"id":"wordfence:07847ba1-cbce-4d81-bd24-46887ac31a5d","source":"wordfence","cve":"CVE-2024-7702","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07847ba1-cbce-4d81-bd24-46887ac31a5d?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"2.0","from_inclusive":true,"to":"2.13.9","to_inclusive":true,"patched_in":"2.13.10"}],"published":"2024-08-19T15:12:53Z","updated":"2024-08-20T03:21:07Z"},{"id":"wordfence:07852d60-c772-46c7-a94f-b2164bd0e3d1","source":"wordfence","cve":"CVE-2026-118638","title":"Mapster WP Maps <= 2.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07852d60-c772-46c7-a94f-b2164bd0e3d1?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:49:08Z"},{"id":"wordfence:078603e7-d597-4090-9c53-14ed98674269","source":"wordfence","cve":"CVE-2026-16056","title":"Contest Gallery <= 30.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078603e7-d597-4090-9c53-14ed98674269?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.6","to_inclusive":true,"patched_in":"30.0.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:34:24Z"},{"id":"wordfence:0788095e-38d0-49cf-b8e1-1f25e3b4e795","source":"wordfence","cve":"CVE-2025-9544","title":"Doppler Forms = 2.5.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0788095e-38d0-49cf-b8e1-1f25e3b4e795?source=api-prod","affected":[{"type":"plugin","slug":"doppler-form","name":"Doppler Easy Multichannel Marketing enhanced with IA","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-10-08T00:00:00Z","updated":"2025-11-04T14:35:16Z"},{"id":"wordfence:0788659e-be5b-413d-b4fb-d60df07075e1","source":"wordfence","cve":"CVE-2017-6817","title":"WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0788659e-be5b-413d-b4fb-d60df07075e1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0788e172-c9f0-4aa5-806b-183491f92bc3","source":"wordfence","cve":"CVE-2025-54053","title":"Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0788e172-c9f0-4aa5-806b-183491f92bc3?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.2.1"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-11T18:05:35Z"},{"id":"wordfence:078a0647-fc3a-436c-bf00-8776b16e66ff","source":"wordfence","cve":"CVE-2024-2931","title":"WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078a0647-fc3a-436c-bf00-8776b16e66ff?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-user-role-editor","name":"WPFront User Role Editor","from":"*","from_inclusive":true,"to":"3.2.1.11184","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T08:32:29Z"},{"id":"wordfence:078b58df-ca2f-4c44-896b-f0e0f7d3bf2b","source":"wordfence","cve":"CVE-2024-10146","title":"Simple File List <= 6.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078b58df-ca2f-4c44-896b-f0e0f7d3bf2b?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.12","to_inclusive":true,"patched_in":"6.1.13"}],"published":"2024-10-24T00:00:00Z","updated":"2024-12-12T18:05:58Z"},{"id":"wordfence:078d06ad-555b-4de4-a032-d81440c7dfb5","source":"wordfence","cve":"","title":"Smart SEO Tool-WordPress SEO\u4f18\u5316\u63d2\u4ef6 <= 4.0.1 - Cross-Site Request Forgery via 'wp_ajax_wb_smart_seo_tool'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078d06ad-555b-4de4-a032-d81440c7dfb5?source=api-prod","affected":[{"type":"plugin","slug":"smart-seo-tool","name":"Smart SEO Tool \u2013 SEO\u4f18\u5316\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":false,"patched_in":"4.0.2"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:078d66c5-dc99-43d6-bba1-afcbf857b450","source":"wordfence","cve":"CVE-2025-49370","title":"Lymcoin <= 1.3.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078d66c5-dc99-43d6-bba1-afcbf857b450?source=api-prod","affected":[{"type":"theme","slug":"lymcoin","name":"Lymcoin | ICO Cryptocurrency WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:22:43Z"},{"id":"wordfence:078ddf47-a17e-4359-8ea8-39e6d5267a0f","source":"wordfence","cve":"CVE-2025-25124","title":"Status Updater <= 1.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078ddf47-a17e-4359-8ea8-39e6d5267a0f?source=api-prod","affected":[{"type":"plugin","slug":"fb-status-updater","name":"Status Updater","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:18:18Z"},{"id":"wordfence:078e110d-2e57-4bcf-b3fb-a4bbf70ea362","source":"wordfence","cve":"CVE-2024-12680","title":"Prisna GWT \u2013 Google Website Translator <= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/078e110d-2e57-4bcf-b3fb-a4bbf70ea362?source=api-prod","affected":[{"type":"plugin","slug":"google-website-translator","name":"Prisna GWT \u2013 Google Website Translator","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-23T15:12:09Z"},{"id":"wordfence:07904ed6-ff3c-41b6-a0ee-87fdbfd14bea","source":"wordfence","cve":"CVE-2025-24613","title":"FV Thoughtful Comments <= 0.3.5 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07904ed6-ff3c-41b6-a0ee-87fdbfd14bea?source=api-prod","affected":[{"type":"plugin","slug":"thoughtful-comments","name":"FV Thoughtful Comments","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":"0.3.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:42:44Z"},{"id":"wordfence:0790f2ec-8d83-4b0e-9eaf-2891917529e7","source":"wordfence","cve":"CVE-2024-54254","title":"Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0790f2ec-8d83-4b0e-9eaf-2891917529e7?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.3.1"}],"published":"2024-12-05T00:00:00Z","updated":"2026-04-15T20:37:23Z"},{"id":"wordfence:0793a054-b213-4519-bc30-ce835979248b","source":"wordfence","cve":"","title":"Custom Field Suite <= 2.4 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0793a054-b213-4519-bc30-ce835979248b?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2015-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:079b5c51-1e59-400c-ad68-10dab1f105b3","source":"wordfence","cve":"CVE-2026-12689","title":"ProfileGrid <= 5.9.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/079b5c51-1e59-400c-ad68-10dab1f105b3?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.6","to_inclusive":true,"patched_in":"5.9.9.7"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-29T22:39:29Z"},{"id":"wordfence:079b7337-db2f-4de5-8339-d1dd445ddf54","source":"wordfence","cve":"CVE-2025-60129","title":"Yext <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/079b7337-db2f-4de5-8339-d1dd445ddf54?source=api-prod","affected":[{"type":"plugin","slug":"yext","name":"Yext Plugin","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:17:53Z"},{"id":"wordfence:079c77f1-3aab-4457-ad66-a2a2d9a55b2e","source":"wordfence","cve":"CVE-2024-10832","title":"Posti Shipping <= 3.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/079c77f1-3aab-4457-ad66-a2a2d9a55b2e?source=api-prod","affected":[{"type":"plugin","slug":"posti-shipping","name":"Posti Shipping","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-12-03T14:18:07Z","updated":"2024-12-24T16:55:41Z"},{"id":"wordfence:079d60c1-a15a-4d3e-b295-8c1e024b74ef","source":"wordfence","cve":"CVE-2023-6036","title":"Web3 <= 2.8.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/079d60c1-a15a-4d3e-b295-8c1e024b74ef?source=api-prod","affected":[{"type":"plugin","slug":"web3-authentication","name":"Web3 \u2013 Crypto wallet Login & NFT token gating","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-22T17:12:10Z"},{"id":"wordfence:079f6ade-86b9-4fad-b739-5cb7aa69a740","source":"wordfence","cve":"CVE-2025-22775","title":"Catalog Importer, Scraper & Crawler <= 5.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/079f6ade-86b9-4fad-b739-5cb7aa69a740?source=api-prod","affected":[{"type":"plugin","slug":"intelligent-importer","name":"Catalog Importer, Scraper & Crawler","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-01-14T00:00:00Z","updated":"2025-03-13T19:20:56Z"},{"id":"wordfence:07a0ffbe-bcc1-4686-bd91-a98cf1e2aeec","source":"wordfence","cve":"CVE-2025-48107","title":"Uncode < 2.9.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a0ffbe-bcc1-4686-bd91-a98cf1e2aeec?source=api-prod","affected":[{"type":"theme","slug":"uncode","name":"Uncode","from":"*","from_inclusive":true,"to":"2.9.4.4","to_inclusive":false,"patched_in":"2.9.4.4"}],"published":"2025-08-26T00:00:00Z","updated":"2025-10-15T18:05:36Z"},{"id":"wordfence:07a31d5c-b8c5-4523-8883-ba1e919c0ab1","source":"wordfence","cve":"CVE-2022-4476","title":"Download Manager <= 3.2.61 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a31d5c-b8c5-4523-8883-ba1e919c0ab1?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.61","to_inclusive":true,"patched_in":"3.2.62"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07a357f4-011e-45d3-bce3-6b5e38cada38","source":"wordfence","cve":"CVE-2025-32674","title":"Product Excel Import Export & Bulk Edit for WooCommerce <= 4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a357f4-011e-45d3-bce3-6b5e38cada38?source=api-prod","affected":[{"type":"plugin","slug":"webd-woocommerce-product-excel-importer-bulk-edit","name":"Product Excel Import Export & Bulk Edit for WooCommerce","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:58:13Z"},{"id":"wordfence:07a3db33-3787-4b63-835d-8e3026206842","source":"wordfence","cve":"CVE-2024-5326","title":"Post Grid Gutenberg Blocks and WordPress Blog Plugin \u2013 PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a3db33-3787-4b63-835d-8e3026206842?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-05-29T00:00:00Z","updated":"2024-05-30T10:59:29Z"},{"id":"wordfence:07a4101b-a46c-4e61-a23c-aaa341ee5bd7","source":"wordfence","cve":"CVE-2025-62924","title":"Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a4101b-a46c-4e61-a23c-aaa341ee5bd7?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.17","to_inclusive":true,"patched_in":"2.3.18"}],"published":"2025-10-04T00:00:00Z","updated":"2025-11-10T15:29:07Z"},{"id":"wordfence:07a58033-5c2d-4550-99ba-57037327a661","source":"wordfence","cve":"CVE-2026-25363","title":"FooGallery <= 3.1.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a58033-5c2d-4550-99ba-57037327a661?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-02-15T00:00:00Z","updated":"2026-02-24T19:26:55Z"},{"id":"wordfence:07a69a69-de18-4a31-97aa-380b8499a4eb","source":"wordfence","cve":"CVE-2025-69348","title":"The Events Calendar Countdown Addon <= 1.4.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a69a69-de18-4a31-97aa-380b8499a4eb?source=api-prod","affected":[{"type":"plugin","slug":"countdown-for-the-events-calendar","name":"Event Countdown for The Events Calendar","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":true,"patched_in":"1.4.16"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T15:06:19Z"},{"id":"wordfence:07a82335-d738-4c14-b385-04843f12e4ef","source":"wordfence","cve":"","title":"WP Users Media <= 4.2.3 - Cross-Site Request Forgery in wpusme_save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07a82335-d738-4c14-b385-04843f12e4ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-users-media","name":"WP Users Media","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07aafbe4-d2ac-4cc3-beb4-37e681ed5285","source":"wordfence","cve":"CVE-2025-9496","title":"Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07aafbe4-d2ac-4cc3-beb4-37e681ed5285?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T07:25:56Z"},{"id":"wordfence:07ab0bb5-841a-46ea-a726-bee17428a5df","source":"wordfence","cve":"CVE-2025-69378","title":"Product Filter for WooCommerce <= 9.1.2 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ab0bb5-841a-46ea-a726-bee17428a5df?source=api-prod","affected":[{"type":"plugin","slug":"prdctfltr","name":"Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2026-02-05T00:00:00Z","updated":"2026-06-18T20:30:45Z"},{"id":"wordfence:07abe182-370f-4241-9631-387a7930f2f6","source":"wordfence","cve":"CVE-2023-52219","title":"Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07abe182-370f-4241-9631-387a7930f2f6?source=api-prod","affected":[{"type":"plugin","slug":"gecka-terms-thumbnails","name":"Gecka Terms Thumbnails","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07ac1921-6d3b-44b3-ad8d-66e18698c025","source":"wordfence","cve":"CVE-2017-18548","title":"Note Press < 0.1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ac1921-6d3b-44b3-ad8d-66e18698c025?source=api-prod","affected":[{"type":"plugin","slug":"note-press","name":"Note Press","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":false,"patched_in":"0.1.2"}],"published":"2017-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07aee352-dfef-4762-a93d-e131737d0535","source":"wordfence","cve":"CVE-2022-29437","title":"Image Slider by NextCode <= 1.1.2 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07aee352-dfef-4762-a93d-e131737d0535?source=api-prod","affected":[{"type":"plugin","slug":"baslider","name":"Image Slider by NextCode \u2013 Photo & Video Slider","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T10:08:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07aee46a-a32d-4d31-9541-4e183299b09c","source":"wordfence","cve":"CVE-2016-10924","title":"Zedna eBook download < 1.2 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07aee46a-a32d-4d31-9541-4e183299b09c?source=api-prod","affected":[{"type":"plugin","slug":"ebook-download","name":"Zedna eBook download","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2016-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07aeed92-f3e9-4a25-a7e0-b364cb98f5dd","source":"wordfence","cve":"CVE-2021-24941","title":"Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07aeed92-f3e9-4a25-a7e0-b364cb98f5dd?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07b075a6-2339-4562-a096-0a46b58f1e9f","source":"wordfence","cve":"CVE-2022-47171","title":"IP Vault \u2013 WP Firewall <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b075a6-2339-4562-a096-0a46b58f1e9f?source=api-prod","affected":[{"type":"plugin","slug":"ip-vault-wp-firewall","name":"Two-factor authentication (formerly IP Vault)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07b1dc05-1340-4ea3-9315-3e1ca4a0cb7f","source":"wordfence","cve":"CVE-2025-9215","title":"StoreEngine \u2013 Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b1dc05-1340-4ea3-9315-3e1ca4a0cb7f?source=api-prod","affected":[{"type":"plugin","slug":"storeengine","name":"StoreEngine \u2014 Complete eCommerce Solution with Memberships, Licensing, Affiliates & More","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T06:17:50Z"},{"id":"wordfence:07b1efbd-0caf-412d-ac1b-ab1b27c32b8c","source":"wordfence","cve":"CVE-2020-7108","title":"LearnDash 3.0.0-3.1.1 - Reflected Cross Site Scripting issue on the [ld_profile] search field","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b1efbd-0caf-412d-ac1b-ab1b27c32b8c?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"3.0.0","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2020-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07b34541-25df-407b-8d56-16e3e510d83a","source":"wordfence","cve":"CVE-2022-24775","title":"guzzlehttp/psr7 <= 1.84 and 2.0.0-2.1.0 - Improper Input Validation","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b34541-25df-407b-8d56-16e3e510d83a?source=api-prod","affected":[{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07b48c64-aa54-4b9b-b1ee-c0f065e2aaa4","source":"wordfence","cve":"CVE-2024-10880","title":"JobBoardWP \u2013 Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b48c64-aa54-4b9b-b1ee-c0f065e2aaa4?source=api-prod","affected":[{"type":"plugin","slug":"jobboardwp","name":"JobBoardWP \u2013 Job Board Listings and Submissions","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:20Z"},{"id":"wordfence:07b6aad4-fbaf-4c0c-b2b7-6e264a1afb9b","source":"wordfence","cve":"CVE-2024-4410","title":"IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b6aad4-fbaf-4c0c-b2b7-6e264a1afb9b?source=api-prod","affected":[{"type":"plugin","slug":"ignitiondeck","name":"IgnitionDeck Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2024-07-26T00:00:00Z","updated":"2024-09-20T22:22:40Z"},{"id":"wordfence:07b7c6ed-c3dc-4daa-8921-eeb856e45386","source":"wordfence","cve":"CVE-2026-48973","title":"SVG Support <= 2.5.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b7c6ed-c3dc-4daa-8921-eeb856e45386?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.5.14","to_inclusive":true,"patched_in":"2.5.15"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:10:05Z"},{"id":"wordfence:07b96ff4-bd2b-4089-8c6a-6196dc678fb1","source":"wordfence","cve":"CVE-2025-31546","title":"Swiss Toolkit For WP <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07b96ff4-bd2b-4089-8c6a-6196dc678fb1?source=api-prod","affected":[{"type":"plugin","slug":"swiss-toolkit-for-wp","name":"Swiss Toolkit For WP","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-06-12T18:36:22Z"},{"id":"wordfence:07bb17bd-c534-4b11-a1dd-7d2f2786ffec","source":"wordfence","cve":"CVE-2021-24465","title":"Meow Gallery (+ Gallery Block) <= 4.1.8 - SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07bb17bd-c534-4b11-a1dd-7d2f2786ffec?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":false,"patched_in":"4.1.9"}],"published":"2021-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07bccf56-99b2-42e6-93ab-606af65e6cac","source":"wordfence","cve":"","title":"Site5 Various Affected Themes (Various Versions) - Email Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07bccf56-99b2-42e6-93ab-606af65e6cac?source=api-prod","affected":[{"type":"theme","slug":"boldy","name":"boldy","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"rockwell","name":"rockwell","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"webfolio","name":"webfolio","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"simplo","name":"simplo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wise","name":"Wise","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"prosume","name":"prosume","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"diary","name":"diary","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"designpile","name":"designpile","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"journalcrunch","name":"journalcrunch","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"alltuts","name":"alltuts","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"colorbold","name":"colorbold","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"xmas","name":"xmas","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07bcf9e3-a38b-4003-be3a-f076293886dd","source":"wordfence","cve":"CVE-2025-22797","title":"Gallery and Lightbox <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07bcf9e3-a38b-4003-be3a-f076293886dd?source=api-prod","affected":[{"type":"plugin","slug":"gallery-and-lightbox","name":"Gallery and Lightbox","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T16:45:46Z"},{"id":"wordfence:07c01ab7-8bf8-4aa5-b5e6-8e47a3bf1f7c","source":"wordfence","cve":"CVE-2022-40200","title":"wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c01ab7-8bf8-4aa5-b5e6-8e47a3bf1f7c?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07c0516b-ee3a-4a80-8db7-e6372bb294a1","source":"wordfence","cve":"CVE-2022-0649","title":"AdRotate \u2013 Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Group Names","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c0516b-ee3a-4a80-8db7-e6372bb294a1?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.8.23","to_inclusive":false,"patched_in":"5.8.23"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07c0b4c5-d76e-4bdc-87d1-3144a1466c77","source":"wordfence","cve":"","title":"SupportCandy <= 3.1.3 - Sensitive Data Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c0b4c5-d76e-4bdc-87d1-3144a1466c77?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07c0f5a5-3455-4f06-b481-f4d678309c50","source":"wordfence","cve":"CVE-2023-4598","title":"Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c0f5a5-3455-4f06-b481-f4d678309c50?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07c16127-6840-40bc-b208-ee8c18dc514b","source":"wordfence","cve":"CVE-2026-27378","title":"Advanced Partial Payment or Deposit for WooCommerce <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c16127-6840-40bc-b208-ee8c18dc514b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-partial-payment-or-deposit-for-woocommerce","name":"Advanced Partial Payment or Deposit for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:17:30Z"},{"id":"wordfence:07c25607-032c-4456-9e67-f02d2627eab3","source":"wordfence","cve":"CVE-2026-10077","title":"YOOtheme Pro <= 5.0.34 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c25607-032c-4456-9e67-f02d2627eab3?source=api-prod","affected":[{"type":"theme","slug":"yootheme","name":"YOOtheme Pro","from":"*","from_inclusive":true,"to":"5.0.34","to_inclusive":true,"patched_in":"5.0.35"}],"published":"2026-06-11T00:00:00Z","updated":"2026-09-18T14:39:23Z"},{"id":"wordfence:07c26175-51fa-4050-b048-fb4bf8fb5ae1","source":"wordfence","cve":"CVE-2025-39577","title":"PropertyHive <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c26175-51fa-4050-b048-fb4bf8fb5ae1?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:42:05Z"},{"id":"wordfence:07c3c8d9-64c9-4d16-9a35-8477b358123f","source":"wordfence","cve":"CVE-2023-27427","title":"CRM Memberships <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c3c8d9-64c9-4d16-9a35-8477b358123f?source=api-prod","affected":[{"type":"plugin","slug":"crm-memberships","name":"CRM Memberships","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.5"}],"published":"2023-04-24T00:00:00Z","updated":"2025-10-08T16:59:12Z"},{"id":"wordfence:07c41a9d-9c16-4d0c-a966-91ea5299847a","source":"wordfence","cve":"CVE-2026-87774","title":"Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c41a9d-9c16-4d0c-a966-91ea5299847a?source=api-prod","affected":[{"type":"plugin","slug":"tz-wrs-core","name":"Tz Weekly Radio Schedule","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:44:17Z"},{"id":"wordfence:07c719fd-690e-42e6-90ac-c4d55553a7cc","source":"wordfence","cve":"CVE-2023-6821","title":"Error Log Viewer <= 1.1.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c719fd-690e-42e6-90ac-c4d55553a7cc?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer","name":"Error Log Viewer by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-27T14:55:15Z"},{"id":"wordfence:07c79459-66b8-4c93-a1cd-6e3ede95643f","source":"wordfence","cve":"CVE-2026-1865","title":"User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c79459-66b8-4c93-a1cd-6e3ede95643f?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-04-07T23:11:46Z","updated":"2026-04-08T11:17:26Z"},{"id":"wordfence:07c92f79-94ac-4153-9ab2-9608601508b0","source":"wordfence","cve":"CVE-2025-10054","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07c92f79-94ac-4153-9ab2-9608601508b0?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-11-20T00:00:00Z","updated":"2026-03-27T10:41:52Z"},{"id":"wordfence:07ca231c-5b88-4721-a01f-8c135d4cf50b","source":"wordfence","cve":"CVE-2022-41805","title":"Booster for WooCommerce <= 5.6.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ca231c-5b88-4721-a01f-8c135d4cf50b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07caada7-a984-42c0-88a5-d8772ceb83b5","source":"wordfence","cve":"CVE-2026-39798","title":"TrueBooker \u2013 Appointment Booking and Scheduler System <= 1.2.9 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07caada7-a984-42c0-88a5-d8772ceb83b5?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-28T21:16:09Z"},{"id":"wordfence:07cb3d57-d768-49a5-8af0-9dc4384487d5","source":"wordfence","cve":"CVE-2026-7563","title":"Classified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07cb3d57-d768-49a5-8af0-9dc4384487d5?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.10","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-05-14T19:53:53Z","updated":"2026-05-15T08:27:21Z"},{"id":"wordfence:07cdc2db-e748-40c9-a2fe-31aef0725dad","source":"wordfence","cve":"CVE-2019-9574","title":"WP Human Resource Management < 2.2.6 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07cdc2db-e748-40c9-a2fe-31aef0725dad?source=api-prod","affected":[{"type":"plugin","slug":"hrm","name":"WP Human Resource Management","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2019-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07d1c715-3620-4b82-a883-57b24c8cd031","source":"wordfence","cve":"CVE-2017-18578","title":"Crafty Social Buttons < 1.5.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07d1c715-3620-4b82-a883-57b24c8cd031?source=api-prod","affected":[{"type":"plugin","slug":"crafty-social-buttons","name":"Crafty Social Buttons","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2017-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07d697c5-1c15-4d3a-8637-cc4fd408f209","source":"wordfence","cve":"CVE-2026-15273","title":"Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07d697c5-1c15-4d3a-8637-cc4fd408f209?source=api-prod","affected":[{"type":"plugin","slug":"automatic-css","name":"Automatic.css","from":"4.0.0","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-09-25T14:07:53Z","updated":"2026-09-28T17:29:59Z"},{"id":"wordfence:07db1f50-0d53-4462-b9e9-9c3de1212201","source":"wordfence","cve":"CVE-2025-68020","title":"WANotifier <= 2.7.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07db1f50-0d53-4462-b9e9-9c3de1212201?source=api-prod","affected":[{"type":"plugin","slug":"notifier","name":"WANotifier for Forms and Actions","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-01-20T00:00:00Z","updated":"2026-04-15T13:34:44Z"},{"id":"wordfence:07dc60e0-a0b4-4db6-8033-ebd01fb697d0","source":"wordfence","cve":"CVE-2025-22527","title":"Mailing Group Listserv <= 2.0.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07dc60e0-a0b4-4db6-8033-ebd01fb697d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailing-group","name":"Mailing Group Listserv","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-04-10T15:09:10Z"},{"id":"wordfence:07e013b5-40e1-4187-951f-ee3b02371727","source":"wordfence","cve":"CVE-2024-6487","title":"Inline Related Posts <= 3.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07e013b5-40e1-4187-951f-ee3b02371727?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-06T13:53:36Z"},{"id":"wordfence:07e110b3-ef10-482d-a564-c9f23631e5f3","source":"wordfence","cve":"CVE-2023-29098","title":"CopySafe Web Protection <= 3.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07e110b3-ef10-482d-a564-c9f23631e5f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-copysafe-web","name":"CopySafe Web Protection \u2013 Copy Protect Images","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":true,"patched_in":"3.14"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07e415f9-42f1-4c80-a023-38f460f634d3","source":"wordfence","cve":"CVE-2026-4081","title":"ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07e415f9-42f1-4c80-a023-38f460f634d3?source=api-prod","affected":[{"type":"plugin","slug":"zem-stl-viewer","name":"ZeM STL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:45:23Z","updated":"2026-06-02T07:48:27Z"},{"id":"wordfence:07e7f03e-0d5d-4405-a0e7-9547fc762f0e","source":"wordfence","cve":"CVE-2024-2250","title":"130+ Widgets | Best Addons For Elementor \u2013 FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07e7f03e-0d5d-4405-a0e7-9547fc762f0e?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T07:31:03Z"},{"id":"wordfence:07e9ae6a-7734-40ee-9287-ae0a99b1fc31","source":"wordfence","cve":"CVE-2022-2599","title":"Anti-Malware Security and Brute-Force Firewall <= 4.21.74 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07e9ae6a-7734-40ee-9287-ae0a99b1fc31?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.21.74","to_inclusive":true,"patched_in":"4.21.83"}],"published":"2022-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07ea9b9b-e28f-484f-9338-8d40f3f8d6d2","source":"wordfence","cve":"","title":"Block WP Login <= 1.3.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ea9b9b-e28f-484f-9338-8d40f3f8d6d2?source=api-prod","affected":[{"type":"plugin","slug":"block-wp-login","name":"Block wp-login","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2019-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07eab536-6f20-45ec-9f9e-70ab35555db2","source":"wordfence","cve":"CVE-2023-49815","title":"WappPress <= 5.0.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07eab536-6f20-45ec-9f9e-70ab35555db2?source=api-prod","affected":[{"type":"plugin","slug":"wapppress-builds-android-app-for-website","name":"WappPress \u2013 Convert Site to App Fast \u2013 WordPress to Mobile App Builder","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07eb71fc-6588-490d-8947-3077ec4a9045","source":"wordfence","cve":"CVE-2025-14736","title":"Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07eb71fc-6588-490d-8947-3077ec4a9045?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.29","to_inclusive":true,"patched_in":"3.28.30"}],"published":"2026-01-08T17:45:03Z","updated":"2026-03-06T12:17:57Z"},{"id":"wordfence:07ebb174-656b-4761-ada0-557e0384d003","source":"wordfence","cve":"CVE-2024-38764","title":"i-transform <= 3.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ebb174-656b-4761-ada0-557e0384d003?source=api-prod","affected":[{"type":"theme","slug":"i-transform","name":"i-transform","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-15T18:12:08Z"},{"id":"wordfence:07ebb176-a1f8-4a5c-8d81-a83fda4b0af3","source":"wordfence","cve":"CVE-2025-7641","title":"Assistant for NextGEN Gallery <= 1.0.9 - Unauthenticated Arbitrary Directory Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ebb176-a1f8-4a5c-8d81-a83fda4b0af3?source=api-prod","affected":[{"type":"plugin","slug":"assistant-for-nextgen-gallery","name":"Assistant for NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:15:19Z","updated":"2025-08-15T08:25:38Z"},{"id":"wordfence:07ec6ced-2628-4ab5-8083-c5008a19587e","source":"wordfence","cve":"CVE-2026-66482","title":"Drone Media | Aerial Photography & Videography Theme <= 2.2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ec6ced-2628-4ab5-8083-c5008a19587e?source=api-prod","affected":[{"type":"theme","slug":"drone-media","name":"Drone Media | Aerial Photography & Videography Theme","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:52:58Z","updated":"2026-10-13T14:04:59Z"},{"id":"wordfence:07ede585-c0d2-4643-9c36-7b5da5f721bd","source":"wordfence","cve":"CVE-2023-0514","title":"Membership Database <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07ede585-c0d2-4643-9c36-7b5da5f721bd?source=api-prod","affected":[{"type":"plugin","slug":"member-database","name":"Membership Database","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07eec594-6c46-4df0-92f1-f090e510d79d","source":"wordfence","cve":"CVE-2022-1166","title":"Noo JobMonster <= 4.6.6 - Sensitive Information Disclosure via Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07eec594-6c46-4df0-92f1-f090e510d79d?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.6.1"}],"published":"2020-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07f16cf7-94ad-4203-9d71-8e6e349d8c89","source":"wordfence","cve":"CVE-2026-25035","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f16cf7-94ad-4203-9d71-8e6e349d8c89?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.2.2","to_inclusive":true,"patched_in":"28.1.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:20:26Z"},{"id":"wordfence:07f25481-51c1-4d02-85c6-561bee587587","source":"wordfence","cve":"CVE-2024-10884","title":"SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f25481-51c1-4d02-85c6-561bee587587?source=api-prod","affected":[{"type":"plugin","slug":"simpleform-contact-form-submissions","name":"SimpleForm Contact Form Submissions","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:09:05Z","updated":"2024-11-16T03:20:40Z"},{"id":"wordfence:07f343cd-5181-48a3-bee7-a60dd9771d07","source":"wordfence","cve":"CVE-2025-57886","title":"Accessibility Checker by Equalize Digital <= 1.30.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f343cd-5181-48a3-bee7-a60dd9771d07?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":true,"patched_in":"1.30.1"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:12:47Z"},{"id":"wordfence:07f6bf26-0b01-48be-bfe1-8213c5d5983f","source":"wordfence","cve":"CVE-2024-50427","title":"SurveyJS: Drag & Drop WordPress Form Builder <= 1.9.136 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f6bf26-0b01-48be-bfe1-8213c5d5983f?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.9.136","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:12:25Z"},{"id":"wordfence:07f7ef07-0f14-4b74-8d47-d5dece4954b0","source":"wordfence","cve":"CVE-2025-3953","title":"WP Statistics \u2013 The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f7ef07-0f14-4b74-8d47-d5dece4954b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.13.3","to_inclusive":true,"patched_in":"14.13.4"}],"published":"2025-04-29T00:00:00Z","updated":"2026-03-27T10:57:16Z"},{"id":"wordfence:07f8d3c3-0f1b-4d55-b85b-e41fdea1fb7b","source":"wordfence","cve":"CVE-2025-68527","title":"Academy LMS <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f8d3c3-0f1b-4d55-b85b-e41fdea1fb7b?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:03:15Z"},{"id":"wordfence:07f97b57-4258-4bd0-88f0-851e87dfd061","source":"wordfence","cve":"CVE-2017-20055","title":"Contact Form Plugin <= 4.0.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07f97b57-4258-4bd0-88f0-851e87dfd061?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-lite","name":"Contact Form Plugin","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07fa22aa-52fc-4453-8935-132bdd8800a5","source":"wordfence","cve":"CVE-2025-23815","title":"root Cookie <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fa22aa-52fc-4453-8935-132bdd8800a5?source=api-prod","affected":[{"type":"plugin","slug":"root-cookie","name":"root Cookie","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:32:36Z"},{"id":"wordfence:07fa7b1a-9137-4049-a20a-8eb6df7ca578","source":"wordfence","cve":"CVE-2024-8319","title":"Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fa7b1a-9137-4049-a20a-8eb6df7ca578?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.11.20","to_inclusive":true,"patched_in":"2.11.21"}],"published":"2024-08-29T00:00:00Z","updated":"2024-08-30T07:33:10Z"},{"id":"wordfence:07fc1249-a50d-4038-8cbe-35ff7a3d28b3","source":"wordfence","cve":"CVE-2019-13635","title":"WP Fastest Cache <= 0.8.9.5 - Directory Traversal","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fc1249-a50d-4038-8cbe-35ff7a3d28b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.9.5","to_inclusive":true,"patched_in":"0.8.9.6"}],"published":"2019-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:07fd6bee-5b00-4fc1-9f7a-3857fd35c763","source":"wordfence","cve":"CVE-2025-5701","title":"HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fd6bee-5b00-4fc1-9f7a-3857fd35c763?source=api-prod","affected":[{"type":"plugin","slug":"hypercomments","name":"HyperComments","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T22:12:40Z","updated":"2026-03-27T10:42:54Z"},{"id":"wordfence:07fda92e-a085-42c7-a16d-1eace1dee195","source":"wordfence","cve":"CVE-2026-13425","title":"Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fda92e-a085-42c7-a16d-1eace1dee195?source=api-prod","affected":[{"type":"plugin","slug":"database-for-cf7","name":"Database for CF7","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T19:00:57Z","updated":"2026-07-29T07:48:01Z"},{"id":"wordfence:08021121-94a1-4569-b8ab-417eec2be993","source":"wordfence","cve":"CVE-2024-8702","title":"Backup Database <= 4.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08021121-94a1-4569-b8ab-417eec2be993?source=api-prod","affected":[{"type":"plugin","slug":"backup-database","name":"Backup Database","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":""}],"published":"2024-09-20T00:00:00Z","updated":"2024-09-24T15:56:47Z"},{"id":"wordfence:0802e074-be51-4440-856f-e372e0821adb","source":"wordfence","cve":"CVE-2025-9978","title":"Jeg Kit for Elementor \u2013 Powerful Elementor Addons, Widgets & Templates for WordPress < 2.6.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0802e074-be51-4440-856f-e372e0821adb?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-10-03T00:00:00Z","updated":"2025-10-28T18:32:22Z"},{"id":"wordfence:08033270-5547-437b-95e6-e004b78df5e4","source":"wordfence","cve":"CVE-2024-10682","title":"Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08033270-5547-437b-95e6-e004b78df5e4?source=api-prod","affected":[{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.11.7","to_inclusive":true,"patched_in":"3.12"}],"published":"2024-11-20T13:37:35Z","updated":"2024-11-22T15:48:02Z"},{"id":"wordfence:08057fa2-90e1-4537-a828-a2c5902b348c","source":"wordfence","cve":"CVE-2026-75930","title":"FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08057fa2-90e1-4537-a828-a2c5902b348c?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-08-24T14:32:34Z","updated":"2026-08-25T03:27:06Z"},{"id":"wordfence:08066126-95d6-4112-8635-5f45ed5af678","source":"wordfence","cve":"CVE-2026-19728","title":"Extra Product Options Builder for WooCommerce < 1.2.176 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08066126-95d6-4112-8635-5f45ed5af678?source=api-prod","affected":[{"type":"plugin","slug":"additional-product-fields-for-woocommerce","name":"Extra Product Options Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.176","to_inclusive":false,"patched_in":"1.2.176"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:04:22Z"},{"id":"wordfence:080683bb-713f-4aa8-b635-90c96f358bec","source":"wordfence","cve":"CVE-2025-13645","title":"Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/080683bb-713f-4aa8-b635-90c96f358bec?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"2.13.1","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2025-12-02T14:05:24Z","updated":"2025-12-03T02:25:28Z"},{"id":"wordfence:080740e3-ca04-48b4-8b34-64f5e42b1185","source":"wordfence","cve":"CVE-2026-6803","title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via AJAX Actions 'removeGroup' and 'clear'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/080740e3-ca04-48b4-8b34-64f5e42b1185?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-07-10T15:17:03Z","updated":"2026-07-11T03:44:21Z"},{"id":"wordfence:08077781-a9e5-421b-8768-777f9f7ab4aa","source":"wordfence","cve":"CVE-2026-65565","title":"Survey Maker by AYS <= 5.2.3.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08077781-a9e5-421b-8768-777f9f7ab4aa?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.2.3.3","to_inclusive":true,"patched_in":"5.2.3.4"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:13:53Z"},{"id":"wordfence:080f3a37-ed11-456c-8c2a-4120bb6fa189","source":"wordfence","cve":"CVE-2026-16979","title":"SmartCrawl SEO checker, analyzer & optimizer < 3.16.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/080f3a37-ed11-456c-8c2a-4120bb6fa189?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.16.3","to_inclusive":false,"patched_in":"3.16.3"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:15:37Z"},{"id":"wordfence:08115f30-f38b-4c13-803e-5de873f83a17","source":"wordfence","cve":"","title":"Custom Post Type UI <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08115f30-f38b-4c13-803e-5de873f83a17?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-ui","name":"Custom Post Type UI","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2020-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0811ca0c-940c-43fc-ad78-c6db062839b7","source":"wordfence","cve":"CVE-2026-111596","title":"Kliken: Ads + Pixel for Meta <= 1.2.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0811ca0c-940c-43fc-ad78-c6db062839b7?source=api-prod","affected":[{"type":"plugin","slug":"kliken-ads-pixel-for-meta","name":"Kliken: Ads + Pixel for Meta","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:28:51Z"},{"id":"wordfence:08137a9e-6e4d-4ca6-954e-e98a44b0c9be","source":"wordfence","cve":"CVE-2025-5084","title":"Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08137a9e-6e4d-4ca6-954e-e98a44b0c9be?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.13","to_inclusive":true,"patched_in":"3.4.14"}],"published":"2025-07-23T20:38:35Z","updated":"2025-09-11T14:39:00Z"},{"id":"wordfence:08139129-8d9b-4cb7-b7c9-6fd0e2cb740a","source":"wordfence","cve":"CVE-2024-37939","title":"Patricia Lite <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08139129-8d9b-4cb7-b7c9-6fd0e2cb740a?source=api-prod","affected":[{"type":"theme","slug":"patricia-lite","name":"Patricia Lite","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:43:06Z"},{"id":"wordfence:0814c64e-f786-4cc3-85ee-c8cfbebf7e2c","source":"wordfence","cve":"CVE-2024-30199","title":"WP-Lister Lite for Amazon <= 2.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0814c64e-f786-4cc3-85ee-c8cfbebf7e2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-amazon","name":"WP-Lister Lite for Amazon","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:25:27Z"},{"id":"wordfence:0814e7b3-404a-4db5-b564-46c9086ec048","source":"wordfence","cve":"CVE-2024-2782","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0814e7b3-404a-4db5-b564-46c9086ec048?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"5.1.17"}],"published":"2024-05-17T19:02:45Z","updated":"2024-05-18T07:38:33Z"},{"id":"wordfence:08159865-1411-4a07-b5db-f4ba5bf2d633","source":"wordfence","cve":"CVE-2024-5038","title":"Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08159865-1411-4a07-b5db-f4ba5bf2d633?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.276","to_inclusive":true,"patched_in":"1.0.277"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-06T11:03:02Z"},{"id":"wordfence:0817afa2-ec6f-42cc-89ae-f43c08c2980b","source":"wordfence","cve":"CVE-2026-84818","title":"Open User Map \u2013 Interactive Leaflet Maps <= 1.4.50 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0817afa2-ec6f-42cc-89ae-f43c08c2980b?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.50","to_inclusive":true,"patched_in":"1.4.51"}],"published":"2026-09-07T13:32:16Z","updated":"2026-09-10T19:36:14Z"},{"id":"wordfence:08186560-16f5-4b53-985f-d708895c79c1","source":"wordfence","cve":"CVE-2025-23434","title":"Easy EU Cookie law <= 1.3.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08186560-16f5-4b53-985f-d708895c79c1?source=api-prod","affected":[{"type":"plugin","slug":"easy-eu-cookie-law","name":"Easy EU Cookie law","from":"*","from_inclusive":true,"to":"1.3.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:13:27Z"},{"id":"wordfence:081a5fda-abe2-4f20-bea2-3f7dd3c3a6cf","source":"wordfence","cve":"CVE-2022-2939","title":"WP Cerber Security <= 9.0 - User Enumeration Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/081a5fda-abe2-4f20-bea2-3f7dd3c3a6cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"9.1"}],"published":"2022-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:081bd3a9-2139-416f-bb36-b86aef6fa6db","source":"wordfence","cve":"CVE-2021-24227","title":"Patreon WordPress < 1.7.0 - Local File Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/081bd3a9-2139-416f-bb36-b86aef6fa6db?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:081c6629-6c4d-4336-b93e-3c4817ca8d77","source":"wordfence","cve":"CVE-2025-54016","title":"Videopack <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/081c6629-6c4d-4336-b93e-3c4817ca8d77?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-thumbnail-generator","name":"Videopack","from":"*","from_inclusive":true,"to":"4.10.3","to_inclusive":true,"patched_in":"4.10.4"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:42:57Z"},{"id":"wordfence:081e76e4-60ec-496d-979b-d128771af475","source":"wordfence","cve":"CVE-2024-2906","title":"Radio Player <= 2.0.73 - Missing Authorization via get_players","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/081e76e4-60ec-496d-979b-d128771af475?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T15:16:47Z"},{"id":"wordfence:081f2603-229b-42f2-b5b1-f89d105a31d5","source":"wordfence","cve":"CVE-2024-39619","title":"ListingPro Plugin <= 2.9.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/081f2603-229b-42f2-b5b1-f89d105a31d5?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2025-03-24T15:25:02Z"},{"id":"wordfence:08208cb1-2d57-49f9-8ac7-b59caa0cf5fa","source":"wordfence","cve":"CVE-2024-1366","title":"Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08208cb1-2d57-49f9-8ac7-b59caa0cf5fa?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T05:32:40Z"},{"id":"wordfence:08220b23-d6fa-4005-bbbb-019412d328a5","source":"wordfence","cve":"CVE-2023-5667","title":"Tab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08220b23-d6fa-4005-bbbb-019412d328a5?source=api-prod","affected":[{"type":"plugin","slug":"tabs-pro","name":"Tab Ultimate \u2013 Responsive Tabs Plugin with Block, Shortcode & Widget","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0823d1d9-4f3b-4ac0-8cd1-ad208ebc325f","source":"wordfence","cve":"CVE-2024-10942","title":"All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0823d1d9-4f3b-4ac0-8cd1-ad208ebc325f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.89","to_inclusive":true,"patched_in":"7.90"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T12:42:26Z"},{"id":"wordfence:08260a34-c612-4f17-94e5-3231d77a3a84","source":"wordfence","cve":"CVE-2025-49961","title":"Breeze Checkout <= 1.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08260a34-c612-4f17-94e5-3231d77a3a84?source=api-prod","affected":[{"type":"plugin","slug":"breeze-checkout","name":"Breeze Checkout","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-19T00:00:00Z","updated":"2025-10-29T21:01:41Z"},{"id":"wordfence:08264ef7-940f-46b6-9880-34d730adad3c","source":"wordfence","cve":"CVE-2026-2440","title":"SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08264ef7-940f-46b6-9880-34d730adad3c?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:58Z","updated":"2026-04-15T16:50:40Z"},{"id":"wordfence:0828a4a4-2dd5-4dff-8563-c81d6b24b949","source":"wordfence","cve":"CVE-2024-8665","title":"YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0828a4a4-2dd5-4dff-8563-c81d6b24b949?source=api-prod","affected":[{"type":"plugin","slug":"yith-custom-login","name":"YITH Custom Login","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-09-12T18:13:16Z","updated":"2024-09-13T06:47:26Z"},{"id":"wordfence:0829eb0b-fee2-4522-b06c-be541c6fbef1","source":"wordfence","cve":"CVE-2025-48142","title":"Bookify <= 1.0.9 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0829eb0b-fee2-4522-b06c-be541c6fbef1?source=api-prod","affected":[{"type":"plugin","slug":"bookify","name":"Bookify \u2013 Appointment Booking & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-07-29T00:00:00Z","updated":"2025-08-04T21:13:04Z"},{"id":"wordfence:082b57a9-4703-4908-9119-47fc4034c35d","source":"wordfence","cve":"CVE-2022-1051","title":"WPQA - Builder forms Addon For WordPress < 5.2 - Stored Cross-Site Scripting via Profile fields","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082b57a9-4703-4908-9119-47fc4034c35d?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:082c7f53-ec14-4235-9a09-9cd0a5312ac2","source":"wordfence","cve":"CVE-2026-2388","title":"Reviews and Rating \u2013 Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082c7f53-ec14-4235-9a09-9cd0a5312ac2?source=api-prod","affected":[{"type":"plugin","slug":"g-business-reviews-rating","name":"Reviews and Rating \u2013 Google Reviews","from":"*","from_inclusive":true,"to":"5.10","to_inclusive":true,"patched_in":"6.0"}],"published":"2026-08-25T21:26:19Z","updated":"2026-10-08T15:30:16Z"},{"id":"wordfence:082dd8b3-da2e-492c-9fc0-44a261df4ba4","source":"wordfence","cve":"CVE-2026-65506","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082dd8b3-da2e-492c-9fc0-44a261df4ba4?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.12","to_inclusive":true,"patched_in":"5.13"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:29:19Z"},{"id":"wordfence:082ebebc-22c2-49c1-b9a4-0a973de3cad7","source":"wordfence","cve":"CVE-2024-51868","title":"DuoGeek Blocks  0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082ebebc-22c2-49c1-b9a4-0a973de3cad7?source=api-prod","affected":[{"type":"plugin","slug":"duogeek-blocks","name":"DuoGeek \u2013 Gutenberg Blocks","from":"0.1.1","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:17:42Z"},{"id":"wordfence:082efb3c-dbe4-49b5-abec-da91f2d463eb","source":"wordfence","cve":"CVE-2022-1228","title":"Opensea <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082efb3c-dbe4-49b5-abec-da91f2d463eb?source=api-prod","affected":[{"type":"plugin","slug":"opensea","name":"Opensea","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2022-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:082f810c-d55e-4190-908c-c7dd9c2e59a5","source":"wordfence","cve":"CVE-2026-6646","title":"The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/082f810c-d55e-4190-908c-c7dd9c2e59a5?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"14.3.2","to_inclusive":true,"patched_in":"14.3.3"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-15T06:45:57Z"},{"id":"wordfence:0830d0c3-99c0-423e-99ab-f0c1cbec52d9","source":"wordfence","cve":"CVE-2025-13679","title":"Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0830d0c3-99c0-423e-99ab-f0c1cbec52d9?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-01-07T18:46:16Z","updated":"2026-01-08T07:04:14Z"},{"id":"wordfence:0833e55f-22aa-44c9-aff6-1f3b74016e4c","source":"wordfence","cve":"CVE-2024-13808","title":"Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0833e55f-22aa-44c9-aff6-1f3b74016e4c?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons-pro","name":"Xpro Elementor Addons - Pro","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-26T04:22:37Z"},{"id":"wordfence:0837ba20-4b47-4cc8-9eb3-322289513d79","source":"wordfence","cve":"CVE-2024-2302","title":"Easy Digital Downloads \u2013 Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0837ba20-4b47-4cc8-9eb3-322289513d79?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-09T18:58:30Z"},{"id":"wordfence:0838daec-6e83-4e19-93e1-a7645daf1294","source":"wordfence","cve":"CVE-2025-10916","title":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More < 1.0.4 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0838daec-6e83-4e19-93e1-a7645daf1294?source=api-prod","affected":[{"type":"plugin","slug":"formgent","name":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:57:14Z"},{"id":"wordfence:0838f085-8ff7-4c6a-bd5b-af99f666377b","source":"wordfence","cve":"CVE-2026-4655","title":"Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0838f085-8ff7-4c6a-bd5b-af99f666377b?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.4.2","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2026-04-07T19:36:01Z","updated":"2026-04-08T07:43:02Z"},{"id":"wordfence:08396330-4fb8-4df0-b7eb-3d3b847cb9b0","source":"wordfence","cve":"CVE-2014-9392","title":"PictoBrowser Gallery <= 0.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08396330-4fb8-4df0-b7eb-3d3b847cb9b0?source=api-prod","affected":[{"type":"plugin","slug":"pictobrowser-gallery","name":"PictoBrowser","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:083accd0-8338-47c6-b396-96679b95dd40","source":"wordfence","cve":"CVE-2026-6228","title":"Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083accd0-8338-47c6-b396-96679b95dd40?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.36","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2026-05-14T19:18:22Z","updated":"2026-05-15T07:46:36Z"},{"id":"wordfence:083b9005-4daf-4562-86cf-d126a6bd1e62","source":"wordfence","cve":"CVE-2026-96335","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083b9005-4daf-4562-86cf-d126a6bd1e62?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2","to_inclusive":true,"patched_in":"1.57.3"}],"published":"2026-10-02T06:43:25Z","updated":"2026-10-09T00:09:33Z"},{"id":"wordfence:083cc89e-0352-44ff-abcb-87f3c5375a31","source":"wordfence","cve":"CVE-2018-0602","title":"Email Subscribers & Newsletters <= 3.4.12 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083cc89e-0352-44ff-abcb-87f3c5375a31?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"3.4.12","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2018-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:083d368c-ba38-433a-b499-c00d205bd331","source":"wordfence","cve":"CVE-2021-24330","title":"Funnel Builder by CartFlows <= 1.6.12 - Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083d368c-ba38-433a-b499-c00d205bd331?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":false,"patched_in":"1.6.13"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:083dd550-6d62-4e2e-8571-ef3c5597e816","source":"wordfence","cve":"CVE-2026-56068","title":"JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083dd550-6d62-4e2e-8571-ef3c5597e816?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10.2","to_inclusive":true,"patched_in":"3.8.11"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:58:16Z"},{"id":"wordfence:083fa428-a13f-4a3a-97e8-316a3856b281","source":"wordfence","cve":"CVE-2026-65518","title":"Accept Donations with PayPal & Stripe <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/083fa428-a13f-4a3a-97e8-316a3856b281?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:42:42Z"},{"id":"wordfence:0841127c-fe81-47b1-964f-15e006f618af","source":"wordfence","cve":"CVE-2024-9456","title":"WP Awesome Login <= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0841127c-fe81-47b1-964f-15e006f618af?source=api-prod","affected":[{"type":"plugin","slug":"wp-awesome-login","name":"WP Awesome Login","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T16:23:51Z","updated":"2024-10-26T04:30:31Z"},{"id":"wordfence:08450bde-e5cf-4fc9-8df8-99d6d24bc3bf","source":"wordfence","cve":"CVE-2025-30576","title":"Hacklog Remote Image Autosave <= 2.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08450bde-e5cf-4fc9-8df8-99d6d24bc3bf?source=api-prod","affected":[{"type":"plugin","slug":"hacklog-remote-image-autosave","name":"Hacklog Remote Image Autosave","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:58:25Z"},{"id":"wordfence:0848d526-9530-40f3-8430-499d96b9a1b1","source":"wordfence","cve":"CVE-2007-3544","title":"WordPress Core <= 2.2.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0848d526-9530-40f3-8430-499d96b9a1b1?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0849d86b-5cf1-4346-a9e9-a54768837969","source":"wordfence","cve":"CVE-2024-1717","title":"Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0849d86b-5cf1-4346-a9e9-a54768837969?source=api-prod","affected":[{"type":"plugin","slug":"admin-notices-manager","name":"Admin Notices Manager","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-06-03T16:41:25Z","updated":"2024-06-17T14:42:37Z"},{"id":"wordfence:084a209f-c67b-4df9-9f4b-c537ea065a50","source":"wordfence","cve":"CVE-2022-46821","title":"Emails & Newsletters with Jackmail <= 1.2.22 - Authenticated (Subscriber+) CSV Injecton","severity":"medium","cvss":6.0,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/084a209f-c67b-4df9-9f4b-c537ea065a50?source=api-prod","affected":[{"type":"plugin","slug":"jackmail-newsletters","name":"Emails & Newsletters with Jackmail","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":""}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:084d0604-096d-4fec-a764-13e5c163ab5e","source":"wordfence","cve":"CVE-2025-49880","title":"CubeWP Forms <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/084d0604-096d-4fec-a764-13e5c163ab5e?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-forms","name":"CubeWP Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:46:56Z"},{"id":"wordfence:084e3f78-275b-4692-9cce-e17074f55cfb","source":"wordfence","cve":"CVE-2026-6227","title":"BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/084e3f78-275b-4692-9cce-e17074f55cfb?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2026-04-13T14:13:09Z","updated":"2026-04-14T02:25:47Z"},{"id":"wordfence:08511020-6129-4f55-a25e-7ed86efa721d","source":"wordfence","cve":"CVE-2022-3694","title":"Syncee \u2013 Global Dropshipping <= 1.0.9 - Missing Authorization.","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08511020-6129-4f55-a25e-7ed86efa721d?source=api-prod","affected":[{"type":"plugin","slug":"syncee-global-dropshipping","name":"Syncee Premium Dropshipping & Wholesale","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:085213ea-297d-451d-8fad-69937f0dcbad","source":"wordfence","cve":"CVE-2025-32693","title":"WebinarPress <= 1.33.27 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085213ea-297d-451d-8fad-69937f0dcbad?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.27","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:42:45Z"},{"id":"wordfence:0854a9d9-3da2-443b-ad2b-ef3136407be3","source":"wordfence","cve":"CVE-2025-31007","title":"Billplz Addon for Contact Form 7 <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0854a9d9-3da2-443b-ad2b-ef3136407be3?source=api-prod","affected":[{"type":"plugin","slug":"billplz-for-contact-form-7","name":"Billplz Addon for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T20:47:32Z"},{"id":"wordfence:0856f3bf-da17-44bb-aa30-26f9fb6e22b1","source":"wordfence","cve":"CVE-2025-12412","title":"Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0856f3bf-da17-44bb-aa30-26f9fb6e22b1?source=api-prod","affected":[{"type":"plugin","slug":"top-bar-notification","name":"Top Bar Notification","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:32:45Z","updated":"2025-11-04T04:27:12Z"},{"id":"wordfence:08593415-bbc9-4159-b5d5-84e4dde6c2c9","source":"wordfence","cve":"CVE-2023-45056","title":"Open User Map | Everybody can add locations <= 1.3.26 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08593415-bbc9-4159-b5d5-84e4dde6c2c9?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.3.26","to_inclusive":true,"patched_in":"1.3.27"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:085a4fae-c3f4-45f9-ab30-846c6297d04e","source":"wordfence","cve":"CVE-2026-3138","title":"Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085a4fae-c3f4-45f9-ab30-846c6297d04e?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-03-23T16:11:48Z","updated":"2026-03-24T04:27:49Z"},{"id":"wordfence:085b39e4-2e38-4e9d-af1a-f8981d5c6ed5","source":"wordfence","cve":"CVE-2017-18500","title":"Social Buttons Pack by BestWebSoft < 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085b39e4-2e38-4e9d-af1a-f8981d5c6ed5?source=api-prod","affected":[{"type":"plugin","slug":"social-buttons-pack","name":"Social Buttons Pack by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:085d06e1-31d3-4c01-8d8e-588c04b79ae3","source":"wordfence","cve":"CVE-2024-9650","title":"WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085d06e1-31d3-4c01-8d8e-588c04b79ae3?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.6.1","to_inclusive":true,"patched_in":"9.7.0"}],"published":"2024-10-23T00:00:00Z","updated":"2024-10-24T11:03:15Z"},{"id":"wordfence:085da0fa-9487-4938-94ea-c1593be7c023","source":"wordfence","cve":"CVE-2022-3343","title":"WPQA - Builder forms Addon For WordPress (<= 5.9.2),  Himer (<= 1.9.3) and Discy (<= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085da0fa-9487-4938-94ea-c1593be7c023?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"5.9.3"},{"type":"theme","slug":"discy","name":"Discy - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":""}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:085ea0e9-5b00-4038-a01b-2aebd0aa0809","source":"wordfence","cve":"CVE-2014-100009","title":"JS Multi Hotel <= 2.2.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/085ea0e9-5b00-4038-a01b-2aebd0aa0809?source=api-prod","affected":[{"type":"plugin","slug":"js-multihotel","name":"JS Multi Hotel","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2014-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08622a0a-2182-440b-a909-4ca6538f5008","source":"wordfence","cve":"CVE-2025-31031","title":"Job Colors for WP Job Manager <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08622a0a-2182-440b-a909-4ca6538f5008?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager-colors","name":"Job Colors for WP Job Manager","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:57:46Z"},{"id":"wordfence:08630dfd-df43-4a5a-8fc7-ba8ff753db3d","source":"wordfence","cve":"CVE-2023-47764","title":"Ditty <= 3.1.24 - Missing Authorization via save_ditty_permissions_check","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08630dfd-df43-4a5a-8fc7-ba8ff753db3d?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":"3.1.25"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08640d56-fc76-4062-ab08-19415ad77e5e","source":"wordfence","cve":"CVE-2025-9045","title":"Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-10-02T22:34:33Z","updated":"2025-11-06T15:16:51Z"},{"id":"wordfence:08654b91-60de-4dfb-9133-2a80e191d505","source":"wordfence","cve":"CVE-2026-103234","title":"Ultimate Review <= 2.4.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08654b91-60de-4dfb-9133-2a80e191d505?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:16:36Z"},{"id":"wordfence:0866f9b9-f3e5-48eb-92e0-06bdb2fd2720","source":"wordfence","cve":"CVE-2025-49985","title":"Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0866f9b9-f3e5-48eb-92e0-06bdb2fd2720?source=api-prod","affected":[{"type":"plugin","slug":"auto-upload-images","name":"Auto Upload Images","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2025-06-19T00:00:00Z","updated":"2026-09-23T20:49:26Z"},{"id":"wordfence:0867f6a6-17f6-48d3-8ef2-bf89f5b28b05","source":"wordfence","cve":"CVE-2026-14356","title":"FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0867f6a6-17f6-48d3-8ef2-bf89f5b28b05?source=api-prod","affected":[{"type":"plugin","slug":"fleekdash","name":"FleekDash V2","from":"*","from_inclusive":true,"to":"2.6.2.2","to_inclusive":true,"patched_in":"2.6.2.5"}],"published":"2026-07-29T15:09:59Z","updated":"2026-07-30T04:03:13Z"},{"id":"wordfence:0868b6ba-3b73-4b8a-a8b4-3cea8771ba33","source":"wordfence","cve":"CVE-2024-3628","title":"EasyEvent <= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0868b6ba-3b73-4b8a-a8b4-3cea8771ba33?source=api-prod","affected":[{"type":"plugin","slug":"easyevent","name":"EasyEvent","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-08T14:07:40Z"},{"id":"wordfence:086a32cc-f3af-4dab-921e-9ae6d1b73ae8","source":"wordfence","cve":"CVE-2025-68046","title":"Contact Form & Lead Form Elementor Builder <= 2.0.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086a32cc-f3af-4dab-921e-9ae6d1b73ae8?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-01-20T00:00:00Z","updated":"2026-02-24T22:15:13Z"},{"id":"wordfence:086a8577-eb23-4e05-8ff6-7bbfef62d25c","source":"wordfence","cve":"CVE-2026-97347","title":"Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086a8577-eb23-4e05-8ff6-7bbfef62d25c?source=api-prod","affected":[{"type":"plugin","slug":"post-views-stats-counter","name":"Post Views Stats Counter","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T20:23:54Z","updated":"2026-09-30T08:28:03Z"},{"id":"wordfence:086b51b5-c9f6-4b30-8fa1-4bcc005c66ab","source":"wordfence","cve":"CVE-2015-2314","title":"WPML <= 3.1.9 - SQL Injection via lang Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086b51b5-c9f6-4b30-8fa1-4bcc005c66ab?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.9.1"}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:086cd6a0-adb6-4e12-b34c-630297f036f3","source":"wordfence","cve":"CVE-2024-2541","title":"Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086cd6a0-adb6-4e12-b34c-630297f036f3?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2024-08-28T23:41:29Z","updated":"2025-03-21T16:44:20Z"},{"id":"wordfence:086eea65-9669-4397-9e35-76df4ee31e70","source":"wordfence","cve":"CVE-2024-3972","title":"Similarity <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086eea65-9669-4397-9e35-76df4ee31e70?source=api-prod","affected":[{"type":"plugin","slug":"similarity","name":"Similarity","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:29:42Z"},{"id":"wordfence:086ff82e-d954-4ded-af72-b3ea3523d443","source":"wordfence","cve":"CVE-2025-31462","title":"CGM Event Calendar <= 0.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/086ff82e-d954-4ded-af72-b3ea3523d443?source=api-prod","affected":[{"type":"plugin","slug":"cgm-event-calendar","name":"CGM Event Calendar","from":"*","from_inclusive":true,"to":"0.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:49:08Z"},{"id":"wordfence:087034aa-efd0-44b9-9a2f-3a625806bcaa","source":"wordfence","cve":"CVE-2024-12628","title":"bodi0\u2019s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/087034aa-efd0-44b9-9a2f-3a625806bcaa?source=api-prod","affected":[{"type":"plugin","slug":"bodi0s-easy-cache","name":"bodi0`s Easy cache","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":"0.9"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:13Z"},{"id":"wordfence:0870de2d-bca5-4d57-a07f-877a416ce0d5","source":"wordfence","cve":"CVE-2022-4939","title":"WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0870de2d-bca5-4d57-a07f-877a416ce0d5?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08746755-9abe-4120-8ffb-90f2f9f1b7cf","source":"wordfence","cve":"CVE-2022-4369","title":"WP-Lister Lite for Amazon <= 2.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08746755-9abe-4120-8ffb-90f2f9f1b7cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-amazon","name":"WP-Lister Lite for Amazon","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:087818b9-0d4a-4264-9fbd-465a873d5c62","source":"wordfence","cve":"CVE-2026-110902","title":"Event Tickets and Registration <= 5.30.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/087818b9-0d4a-4264-9fbd-465a873d5c62?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.1","to_inclusive":true,"patched_in":"5.30.2"}],"published":"2026-10-19T12:38:00Z","updated":"2026-10-23T18:40:16Z"},{"id":"wordfence:0879bfe6-0b73-4bdc-9770-f8b2a3da2686","source":"wordfence","cve":"CVE-2024-50463","title":"Sunshine Photo Cart <= 3.2.9 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0879bfe6-0b73-4bdc-9770-f8b2a3da2686?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:03:28Z"},{"id":"wordfence:087b6943-5da8-44fe-8614-832768444178","source":"wordfence","cve":"CVE-2025-12842","title":"Booking Plugin for WordPress Appointments \u2013 Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/087b6943-5da8-44fe-8614-832768444178?source=api-prod","affected":[{"type":"plugin","slug":"timeslot","name":"Time Slot \u2013 Booking and Appointment System","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-11-18T17:24:42Z","updated":"2025-11-19T05:45:10Z"},{"id":"wordfence:087df130-d75f-4792-b3f9-c78ddb0f7a48","source":"wordfence","cve":"CVE-2025-24640","title":"Empty Tags Remover <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/087df130-d75f-4792-b3f9-c78ddb0f7a48?source=api-prod","affected":[{"type":"plugin","slug":"empty-tags-remover","name":"Empty Tags Remover","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-01-20T00:00:00Z","updated":"2025-04-22T21:46:31Z"},{"id":"wordfence:08801f53-3c57-41a3-a637-4b52637cc612","source":"wordfence","cve":"CVE-2023-6266","title":"Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08801f53-3c57-41a3-a637-4b52637cc612?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2023-11-30T00:00:00Z","updated":"2024-07-29T21:35:49Z"},{"id":"wordfence:0880ad7a-8886-44dd-9860-37b79d8e9a18","source":"wordfence","cve":"CVE-2025-49329","title":"Store Locator WordPress <= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0880ad7a-8886-44dd-9860-37b79d8e9a18?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T14:53:43Z"},{"id":"wordfence:08814d06-0039-49cc-bcbb-96cb01129e3c","source":"wordfence","cve":"CVE-2023-51520","title":"Booking Calendar <= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08814d06-0039-49cc-bcbb-96cb01129e3c?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.7.4","to_inclusive":false,"patched_in":"9.7.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0881efbe-9b47-4b56-be2d-12258460b429","source":"wordfence","cve":"CVE-2025-2889","title":"Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0881efbe-9b47-4b56-be2d-12258460b429?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.7.3","to_inclusive":true,"patched_in":"7.8"}],"published":"2025-04-04T11:06:08Z","updated":"2025-04-04T23:22:04Z"},{"id":"wordfence:0886a451-319f-4678-b8a1-abb7faf11804","source":"wordfence","cve":"CVE-2026-27339","title":"Buzz Stone | Magazine & Viral Blog WordPress <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0886a451-319f-4678-b8a1-abb7faf11804?source=api-prod","affected":[{"type":"theme","slug":"buzzstone","name":"Buzz Stone | Magazine & Viral Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:31:46Z"},{"id":"wordfence:0886fa16-4292-4223-af01-9aa1f36490f7","source":"wordfence","cve":"CVE-2024-2831","title":"Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0886fa16-4292-4223-af01-9aa1f36490f7?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2024-04-29T00:00:00Z","updated":"2024-06-05T13:45:40Z"},{"id":"wordfence:0888cda8-63ca-44f6-a3eb-765c14a7e6c7","source":"wordfence","cve":"CVE-2026-8418","title":"Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0888cda8-63ca-44f6-a3eb-765c14a7e6c7?source=api-prod","affected":[{"type":"plugin","slug":"game-catalog","name":"Games Catalog","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:06:27Z","updated":"2026-05-20T01:25:44Z"},{"id":"wordfence:08891bd4-2f2a-4d9a-b6b4-d6f2043489d0","source":"wordfence","cve":"CVE-2025-62974","title":"Headline Analyzer <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08891bd4-2f2a-4d9a-b6b4-d6f2043489d0?source=api-prod","affected":[{"type":"plugin","slug":"headline-analyzer","name":"Headline Analyzer","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-10-29T14:40:24Z"},{"id":"wordfence:088aead8-37bb-4277-81e0-b7e2c13e9072","source":"wordfence","cve":"CVE-2023-1126","title":"WP FEvents Book <= 0.46 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/088aead8-37bb-4277-81e0-b7e2c13e9072?source=api-prod","affected":[{"type":"plugin","slug":"wp-fevents-book","name":"WP FEvents Book","from":"*","from_inclusive":true,"to":"0.46","to_inclusive":true,"patched_in":""}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:088e0d77-06bf-4420-88fb-2c6f8051ece5","source":"wordfence","cve":"CVE-2023-37892","title":"Shortcode IMDB <= 6.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/088e0d77-06bf-4420-88fb-2c6f8051ece5?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-imdb","name":"Shortcode IMDB","from":"*","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:088ea35b-ef64-4c1b-8a08-5dce02ca3da9","source":"wordfence","cve":"CVE-2026-110898","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets <= 6.8.5 - Authenticated (Author+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/088ea35b-ef64-4c1b-8a08-5dce02ca3da9?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.5","to_inclusive":true,"patched_in":"6.8.6"}],"published":"2026-10-17T08:22:57Z","updated":"2026-10-23T18:39:34Z"},{"id":"wordfence:08906577-162c-4875-b16c-18d4912c2611","source":"wordfence","cve":"CVE-2026-10586","title":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08906577-162c-4875-b16c-18d4912c2611?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.1.4"}],"published":"2026-06-04T10:40:13Z","updated":"2026-06-04T23:28:52Z"},{"id":"wordfence:08916934-c9b8-4bc0-8b8c-991ed0b78be2","source":"wordfence","cve":"CVE-2014-4542","title":"Ooorl <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08916934-c9b8-4bc0-8b8c-991ed0b78be2?source=api-prod","affected":[{"type":"plugin","slug":"ooorl","name":"ooorl","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:089406e7-4f6a-416b-9077-e17c44069300","source":"wordfence","cve":"CVE-2024-12475","title":"WP Multi Store Locator <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089406e7-4f6a-416b-9077-e17c44069300?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-01-03T21:37:03Z","updated":"2025-01-04T11:16:32Z"},{"id":"wordfence:08940eaf-48fb-4e40-9667-cde710738542","source":"wordfence","cve":"CVE-2024-38673","title":"Multisite Content Copier/Updater <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08940eaf-48fb-4e40-9667-cde710738542?source=api-prod","affected":[{"type":"plugin","slug":"wp-multisite-content-copier","name":"WP Multisite Content Copier/Updater","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-30T20:05:05Z"},{"id":"wordfence:08976f26-435b-4a44-bb17-53bfa8cc0e88","source":"wordfence","cve":"CVE-2026-32437","title":"VW Portfolio <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08976f26-435b-4a44-bb17-53bfa8cc0e88?source=api-prod","affected":[{"type":"theme","slug":"vw-portfolio","name":"VW Portfolio","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:04:55Z"},{"id":"wordfence:0897d622-8e73-4bc0-a5f9-77bf8ddb4f93","source":"wordfence","cve":"CVE-2014-7958","title":"BulletProof Security < .51.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0897d622-8e73-4bc0-a5f9-77bf8ddb4f93?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".51.1","to_inclusive":false,"patched_in":".51.1"}],"published":"2014-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0898f9f0-8801-444b-aa69-f4eb4ee3fe1b","source":"wordfence","cve":"CVE-2026-92424","title":"Content Egg <= 11.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0898f9f0-8801-444b-aa69-f4eb4ee3fe1b?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"11.8.0","to_inclusive":true,"patched_in":"11.9.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:02:46Z"},{"id":"wordfence:089a93a1-0868-4c1d-930a-7e6fcf0aee94","source":"wordfence","cve":"CVE-2025-48231","title":"Booking Calendar Contact Form <= 1.2.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089a93a1-0868-4c1d-930a-7e6fcf0aee94?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.58","to_inclusive":true,"patched_in":"1.2.59"}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-08T18:31:23Z"},{"id":"wordfence:089b3a1b-0f4b-4ba5-85d8-c1f6b74fe7eb","source":"wordfence","cve":"CVE-2025-12043","title":"Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089b3a1b-0f4b-4ba5-85d8-c1f6b74fe7eb?source=api-prod","affected":[{"type":"plugin","slug":"auyautochat-for-wp","name":"Autochat Automatic Conversation","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:14:49Z","updated":"2025-11-25T07:28:18Z"},{"id":"wordfence:089c0c4c-abe1-43e5-a462-b4b22e7a6ca6","source":"wordfence","cve":"CVE-2026-74922","title":"Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089c0c4c-abe1-43e5-a462-b4b22e7a6ca6?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"4.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-06T15:19:47Z"},{"id":"wordfence:089ccbab-65dd-4c2c-aa86-a948f245716b","source":"wordfence","cve":"CVE-2026-84150","title":"Directorist <= 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089ccbab-65dd-4c2c-aa86-a948f245716b?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:50:39Z"},{"id":"wordfence:089cde8a-2896-4e4c-90c1-30605ccc919d","source":"wordfence","cve":"CVE-2022-1657","title":"JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089cde8a-2896-4e4c-90c1-30605ccc919d?source=api-prod","affected":[{"type":"theme","slug":"jupiter","name":"Jupiter","from":"*","from_inclusive":true,"to":"6.10.1","to_inclusive":true,"patched_in":"6.10.2"},{"type":"theme","slug":"jupiterx","name":"JupiterX","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:089ffe9a-e222-4630-b889-2b1e527dac6f","source":"wordfence","cve":"CVE-2023-6064","title":"PayHere Payment Gateway <= 2.2.11 - Information Disclosure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/089ffe9a-e222-4630-b889-2b1e527dac6f?source=api-prod","affected":[{"type":"plugin","slug":"payhere-payment-gateway","name":"PayHere Payment Gateway","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2023-12-07T00:00:00Z","updated":"2024-02-06T16:35:43Z"},{"id":"wordfence:08a15d7d-a7e6-4742-b02d-d74aa1d09550","source":"wordfence","cve":"CVE-2025-69065","title":"Snow Mountain <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08a15d7d-a7e6-4742-b02d-d74aa1d09550?source=api-prod","affected":[{"type":"theme","slug":"snowmountain","name":"Snow Mountain | Ski Resort & Snowboard School WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:45:15Z"},{"id":"wordfence:08a98c08-cddc-4bc3-bc07-15d084070abd","source":"wordfence","cve":"","title":"WooCommerce Subscription < 4.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08a98c08-cddc-4bc3-bc07-15d084070abd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":false,"patched_in":"4.6.0"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08aa24a3-4306-4857-88ac-ecdcc578cdf5","source":"wordfence","cve":"CVE-2022-2538","title":"WP Hide & Security Enhancer <= 1.7.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08aa24a3-4306-4857-88ac-ecdcc578cdf5?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-security-enhancer","name":"WP Hide & Security Enhancer","from":"*","from_inclusive":true,"to":"1.7.9.2","to_inclusive":true,"patched_in":"1.8"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08aabd8d-8add-423e-835f-dc4d8bbdb72c","source":"wordfence","cve":"CVE-2025-48120","title":"MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08aabd8d-8add-423e-835f-dc4d8bbdb72c?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.6.9","to_inclusive":true,"patched_in":"8.6.10"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-12T18:26:48Z"},{"id":"wordfence:08ab3d7d-b58a-4dec-a085-84a9938be328","source":"wordfence","cve":"CVE-2023-7252","title":"Tickera \u2013 WordPress Event Ticketing <= 3.5.2.4 - Insecure Direct Object Reference to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ab3d7d-b58a-4dec-a085-84a9938be328?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.2.4","to_inclusive":true,"patched_in":"3.5.2.5"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-24T13:18:14Z"},{"id":"wordfence:08ad76c6-8e63-4015-b0d9-5699f24f36ca","source":"wordfence","cve":"CVE-2025-55707","title":"PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ad76c6-8e63-4015-b0d9-5699f24f36ca?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.35","to_inclusive":true,"patched_in":"4.1.36"}],"published":"2025-08-29T00:00:00Z","updated":"2025-12-20T21:29:45Z"},{"id":"wordfence:08b0f5e0-f68a-4fea-9d62-468956012a6d","source":"wordfence","cve":"CVE-2024-10770","title":"Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b0f5e0-f68a-4fea-9d62-468956012a6d?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T04:32:25Z"},{"id":"wordfence:08b18825-9c2f-4304-afbe-7e4dc1b81227","source":"wordfence","cve":"CVE-2025-49345","title":"WP-EasyArchives <= 3.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b18825-9c2f-4304-afbe-7e4dc1b81227?source=api-prod","affected":[{"type":"plugin","slug":"wp-easyarchives","name":"WP-EasyArchives","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:16:56Z"},{"id":"wordfence:08b378c9-32c0-4f90-9fbb-c07a24e4121d","source":"wordfence","cve":"CVE-2025-64361","title":"Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b378c9-32c0-4f90-9fbb-c07a24e4121d?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-04T14:41:55Z"},{"id":"wordfence:08b5f399-018c-4e0b-aefc-55463d4ac48d","source":"wordfence","cve":"CVE-2023-35776","title":"Sermon'e <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b5f399-018c-4e0b-aefc-55463d4ac48d?source=api-prod","affected":[{"type":"plugin","slug":"sermone-online-sermons-management","name":"Sermon'e \u2013 Sermons Online","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08b5f8dc-bacb-4e6f-a4c0-c709fb48413f","source":"wordfence","cve":"CVE-2024-51778","title":"Satisfaction Reports from Help Scout <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b5f8dc-bacb-4e6f-a4c0-c709fb48413f?source=api-prod","affected":[{"type":"plugin","slug":"happiness-reports-for-help-scout","name":"Satisfaction Reports from Help Scout","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:16:41Z"},{"id":"wordfence:08b75a3b-fb12-4b71-b207-468558e40fec","source":"wordfence","cve":"CVE-2024-56233","title":"Kintpv Wooconnect <= 8.129 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b75a3b-fb12-4b71-b207-468558e40fec?source=api-prod","affected":[{"type":"plugin","slug":"kintpv-connect","name":"KinTPV WooConnect","from":"*","from_inclusive":true,"to":"8.129","to_inclusive":true,"patched_in":"8.141"}],"published":"2024-12-19T00:00:00Z","updated":"2025-05-29T20:15:45Z"},{"id":"wordfence:08b75cac-7b1d-4bed-a1b7-bd1e872f2b4f","source":"wordfence","cve":"","title":"Fatal Error Notify <= 1.5.2 - Cross-Site Request Forgery to Test Error Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b75cac-7b1d-4bed-a1b7-bd1e872f2b4f?source=api-prod","affected":[{"type":"plugin","slug":"fatal-error-notify","name":"Fatal Error Notify","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-01-30T00:00:00Z","updated":"2024-01-31T00:16:12Z"},{"id":"wordfence:08b7aa6b-4532-4365-9b73-4453c714be95","source":"wordfence","cve":"CVE-2026-32474","title":"Templatiq <= 0.2.5 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b7aa6b-4532-4365-9b73-4453c714be95?source=api-prod","affected":[{"type":"plugin","slug":"templatiq","name":"Templatiq","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:30:45Z"},{"id":"wordfence:08b8f1ad-f616-4ceb-9c53-9d53aac370c9","source":"wordfence","cve":"CVE-2024-31263","title":"Loan Repayment Calculator and Application Form <= 2.9.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b8f1ad-f616-4ceb-9c53-9d53aac370c9?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:53:31Z"},{"id":"wordfence:08b8f61d-d6e7-41c0-87ab-2d7310c8899d","source":"wordfence","cve":"CVE-2025-32484","title":"WP-Planification <= 2.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b8f61d-d6e7-41c0-87ab-2d7310c8899d?source=api-prod","affected":[{"type":"plugin","slug":"wp-planification","name":"WP-Planification \u2013 WP-Planning","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:05:53Z"},{"id":"wordfence:08b98e8d-21cc-48e9-8b4e-304cc1168d0f","source":"wordfence","cve":"CVE-2026-42695","title":"FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08b98e8d-21cc-48e9-8b4e-304cc1168d0f?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.54.7212","to_inclusive":true,"patched_in":"7.5.55.7212"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:43:21Z"},{"id":"wordfence:08ba0f2a-f3eb-4d79-abba-99e64df0fe4b","source":"wordfence","cve":"CVE-2021-24162","title":"Responsive Menu <= 4.0.3 - Cross-Site Request Forgery to Setting Modification","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ba0f2a-f3eb-4d79-abba-99e64df0fe4b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-menu","name":"Responsive Menu \u2013 Mobile Menu & Hamburger Menu Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08bbde25-bb9a-469c-83de-b680bb501ad6","source":"wordfence","cve":"CVE-2023-29171","title":"Magic Post Thumbnail <= 4.1.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08bbde25-bb9a-469c-83de-b680bb501ad6?source=api-prod","affected":[{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08bd24ca-eec6-4b62-af49-192496e65a5b","source":"wordfence","cve":"CVE-2024-4742","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08bd24ca-eec6-4b62-af49-192496e65a5b?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-06-19T12:20:57Z","updated":"2025-01-31T20:39:11Z"},{"id":"wordfence:08bdd036-904d-41c4-a4a7-d8236840255e","source":"wordfence","cve":"CVE-2026-81283","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08bdd036-904d-41c4-a4a7-d8236840255e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"4.3.11"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T13:42:20Z"},{"id":"wordfence:08beb583-096d-453c-9690-b46e410afb1b","source":"wordfence","cve":"CVE-2024-10866","title":"Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08beb583-096d-453c-9690-b46e410afb1b?source=api-prod","affected":[{"type":"plugin","slug":"export-import-menus","name":"Export Import Menus","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-01-06T19:18:59Z","updated":"2025-01-07T07:22:33Z"},{"id":"wordfence:08bebfbd-08f4-45d9-9570-46f5c848afca","source":"wordfence","cve":"","title":"User Meta \u2013 User Profile Builder and User management plugin 1.1.1 - Arbitrary File Upload","severity":"medium","cvss":6.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08bebfbd-08f4-45d9-9570-46f5c848afca?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"1.1.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08beecef-3f46-4087-801a-3fe920e29ab4","source":"wordfence","cve":"CVE-2026-84021","title":"Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08beecef-3f46-4087-801a-3fe920e29ab4?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":false,"patched_in":"5.9.8"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:25Z"},{"id":"wordfence:08bfa13b-7335-4973-a5e5-e0d09cbf5b06","source":"wordfence","cve":"CVE-2024-54277","title":"Nias course <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08bfa13b-7335-4973-a5e5-e0d09cbf5b06?source=api-prod","affected":[{"type":"plugin","slug":"nias-course","name":"Nias Course Builder","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-03-19T17:01:11Z"},{"id":"wordfence:08c0ea6c-7e2f-482f-b30c-0e3bcd992159","source":"wordfence","cve":"CVE-2023-0724","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folder","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08c0ea6c-7e2f-482f-b30c-0e3bcd992159?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08c14611-c785-484d-9fdf-7d71c39f63df","source":"wordfence","cve":"","title":"Global Flash Gallery <= 0.15.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08c14611-c785-484d-9fdf-7d71c39f63df?source=api-prod","affected":[{"type":"plugin","slug":"global-flash-galleries","name":"Global Flash Gallery","from":"*","from_inclusive":true,"to":"0.15.1","to_inclusive":true,"patched_in":"0.15.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08c79118-9dad-44fd-b683-7950276d3808","source":"wordfence","cve":"CVE-2024-1907","title":"Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08c79118-9dad-44fd-b683-7950276d3808?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:41:25Z"},{"id":"wordfence:08c957fb-05e8-489e-846e-1afb0ca6750f","source":"wordfence","cve":"","title":"Gallery PhotoBlocks <= 1.2.8 - Missing Authorization Checks","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08c957fb-05e8-489e-846e-1afb0ca6750f?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08ca186a-2486-4a58-9c53-03e9eba13e66","source":"wordfence","cve":"CVE-2023-2982","title":"WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.6.4","to_inclusive":true,"patched_in":"7.6.5"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08cb2162-fac3-47af-9292-116095ee40dc","source":"wordfence","cve":"CVE-2024-43331","title":"WP SMS <= 6.9.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08cb2162-fac3-47af-9292-116095ee40dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.9.3","to_inclusive":true,"patched_in":"6.9.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T23:08:57Z"},{"id":"wordfence:08cb8ba1-1976-438b-8e0b-0a8be08aad6c","source":"wordfence","cve":"CVE-2026-6510","title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08cb8ba1-1976-438b-8e0b-0a8be08aad6c?source=api-prod","affected":[{"type":"plugin","slug":"infusedwooPRO","name":"InfusedWoo Pro","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-13T18:11:16Z","updated":"2026-05-14T06:44:09Z"},{"id":"wordfence:08ccd4a3-ea1f-49b3-b4ce-ab1e247e1f76","source":"wordfence","cve":"CVE-2024-3520","title":"Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ccd4a3-ea1f-49b3-b4ce-ab1e247e1f76?source=api-prod","affected":[{"type":"plugin","slug":"country-state-city-auto-dropdown","name":"Country State City Dropdown CF7","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:51:44Z"},{"id":"wordfence:08d15c46-d15f-4803-80be-90bf33335c18","source":"wordfence","cve":"CVE-2026-0686","title":"Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d15c46-d15f-4803-80be-90bf33335c18?source=api-prod","affected":[{"type":"plugin","slug":"webmention","name":"Webmention","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-04-01T19:17:15Z","updated":"2026-04-02T07:39:35Z"},{"id":"wordfence:08d18e18-b9f2-4a4d-bf9b-4a64a7881a4f","source":"wordfence","cve":"CVE-2011-3855","title":"F8 Lite <= 4.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d18e18-b9f2-4a4d-bf9b-4a64a7881a4f?source=api-prod","affected":[{"type":"theme","slug":"f8-lite","name":"F8 Lite","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08d2d4cc-b349-4a91-8a38-b0c305627ac0","source":"wordfence","cve":"CVE-2026-22513","title":"Triompher | Golf Course & Sports Club WordPress Theme <= 1.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d2d4cc-b349-4a91-8a38-b0c305627ac0?source=api-prod","affected":[{"type":"theme","slug":"triompher","name":"Triompher | Golf Course & Sports Club WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:13:14Z"},{"id":"wordfence:08d43c67-df40-4f1a-a351-803e59edee13","source":"wordfence","cve":"CVE-2023-6983","title":"Display custom fields in the frontend \u2013 Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d43c67-df40-4f1a-a351-803e59edee13?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-to-display-post-and-user-data","name":"Display custom fields in the frontend \u2013 Post and User Profile Fields","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-07-29T21:35:49Z"},{"id":"wordfence:08d475b0-9de5-4a88-821a-af995d954435","source":"wordfence","cve":"CVE-2025-32599","title":"Task Scheduler <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d475b0-9de5-4a88-821a-af995d954435?source=api-prod","affected":[{"type":"plugin","slug":"task-scheduler","name":"Task Scheduler","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:48:34Z"},{"id":"wordfence:08d4bf7e-fae9-4be6-9e97-e8b6532523ff","source":"wordfence","cve":"CVE-2019-10869","title":"Ninja Forms - File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d4bf7e-fae9-4be6-9e97-e8b6532523ff?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.0.23","to_inclusive":false,"patched_in":"3.0.23"}],"published":"2019-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08d4ed49-1338-422f-b55f-a102f2d1d6c8","source":"wordfence","cve":"CVE-2026-0867","title":"Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08d4ed49-1338-422f-b55f-a102f2d1d6c8?source=api-prod","affected":[{"type":"plugin","slug":"essential-widgets","name":"Essential Widgets","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-02-04T18:41:50Z","updated":"2026-02-05T06:47:43Z"},{"id":"wordfence:08ded669-7e43-4da4-87e7-c7d75fa53d8b","source":"wordfence","cve":"CVE-2017-5942","title":"WP Mail <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ded669-7e43-4da4-87e7-c7d75fa53d8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail","name":"WP Mail","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2016-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08dee232-7373-4da4-9c2c-c3aa52f9b588","source":"wordfence","cve":"CVE-2023-5089","title":"Defender Security <= 4.0.2 - Hide Login Page Feature Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08dee232-7373-4da4-9c2c-c3aa52f9b588?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2023-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08df7ef5-fff0-4808-a79e-4d85cc9e2fa7","source":"wordfence","cve":"CVE-2026-57415","title":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08df7ef5-fff0-4808-a79e-4d85cc9e2fa7?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:25:22Z"},{"id":"wordfence:08e44434-8908-4c63-9e5b-9a8b387255d9","source":"wordfence","cve":"CVE-2024-12237","title":"Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08e44434-8908-4c63-9e5b-9a8b387255d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-photo-gallery","name":"Photo Gallery Slideshow & Masonry Tiled Gallery","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-01-03T09:55:47Z","updated":"2025-01-03T22:22:05Z"},{"id":"wordfence:08e62276-f004-48ca-bb00-2f81e6ac4892","source":"wordfence","cve":"CVE-2026-17553","title":"Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08e62276-f004-48ca-bb00-2f81e6ac4892?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2026-09-08T14:56:09Z","updated":"2026-09-09T03:28:46Z"},{"id":"wordfence:08e7125a-0fab-4a4c-8428-127f71847810","source":"wordfence","cve":"CVE-2022-1695","title":"WP Simple Adsense Insertion <= 2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08e7125a-0fab-4a4c-8428-127f71847810?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-plugin-for-simple-google-adsense-insertion","name":"WP Simple Adsense Insertion","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2022-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08e9a8f1-e5ed-4af7-ab37-31bab8850dbd","source":"wordfence","cve":"CVE-2025-27362","title":"Petito <= 1.6.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08e9a8f1-e5ed-4af7-ab37-31bab8850dbd?source=api-prod","affected":[{"type":"theme","slug":"bw-petito","name":"Petito - Animals and Pets Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-06-09T00:00:00Z","updated":"2026-02-24T22:23:33Z"},{"id":"wordfence:08e9e7f4-0f25-4bc1-85b7-4b504ed38582","source":"wordfence","cve":"","title":"Coditor <= 1.1 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08e9e7f4-0f25-4bc1-85b7-4b504ed38582?source=api-prod","affected":[{"type":"plugin","slug":"coditor","name":"Coditor \u2013 Code Editor","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08eb1d49-9928-43f8-97fc-14105e3a4a25","source":"wordfence","cve":"CVE-2019-20209","title":"CTHthemes CityBook < 2.3.4, TownHub < 1.0.6, EasyBook < 1.2.2 Themes - Authenticated Post Deleition via IDOR","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08eb1d49-9928-43f8-97fc-14105e3a4a25?source=api-prod","affected":[{"type":"theme","slug":"easybook","name":"EasyBook \u2013 Hotel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"theme","slug":"townhub","name":"TownHub - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"},{"type":"theme","slug":"citybook","name":"CityBook - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2019-12-27T00:00:00Z","updated":"2026-03-27T10:43:40Z"},{"id":"wordfence:08ec2376-dfe3-4aeb-8173-01e88309f540","source":"wordfence","cve":"CVE-2025-4202","title":"Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ec2376-dfe3-4aeb-8173-01e88309f540?source=api-prod","affected":[{"type":"plugin","slug":"commenting-feature","name":"Multicollab: Content Team Collaboration and Editorial Workflow","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2026-05-15T00:00:00Z","updated":"2026-05-16T12:30:19Z"},{"id":"wordfence:08ecde76-3249-4be2-81b8-cccc60f73063","source":"wordfence","cve":"CVE-2025-24610","title":"Restrict Anonymous Access <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ecde76-3249-4be2-81b8-cccc60f73063?source=api-prod","affected":[{"type":"plugin","slug":"restrict-anonymous-access","name":"Restrict Anonymous Access","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:52:25Z"},{"id":"wordfence:08ef43cc-42ea-43bd-a590-4f9b2c719491","source":"wordfence","cve":"CVE-2026-6913","title":"Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ef43cc-42ea-43bd-a590-4f9b2c719491?source=api-prod","affected":[{"type":"plugin","slug":"shortcodely","name":"Shortcodely","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:04:55Z","updated":"2026-05-12T07:48:16Z"},{"id":"wordfence:08ef71da-50f2-4f7e-8a23-23adbabee09d","source":"wordfence","cve":"CVE-2024-9851","title":"LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ef71da-50f2-4f7e-8a23-23adbabee09d?source=api-prod","affected":[{"type":"plugin","slug":"tour-operator","name":"Tour Operator","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-11-20T13:43:45Z","updated":"2025-01-10T14:00:01Z"},{"id":"wordfence:08efd1c4-8024-465f-9f29-02e78c4228ab","source":"wordfence","cve":"CVE-2025-47637","title":"STAGGS <= 2.11.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08efd1c4-8024-465f-9f29-02e78c4228ab?source=api-prod","affected":[{"type":"plugin","slug":"staggs","name":"STAGGS \u2013 Product Configurator Toolkit","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-23T13:52:47Z"},{"id":"wordfence:08f4445b-9c79-42e3-be45-d07f72c00a01","source":"wordfence","cve":"CVE-2024-33921","title":"ReviewX <= 1.6.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f4445b-9c79-42e3-be45-d07f72c00a01?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.21","to_inclusive":true,"patched_in":"1.6.22"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:34:29Z"},{"id":"wordfence:08f55882-d19f-43a3-a370-17d041493944","source":"wordfence","cve":"CVE-2023-51405","title":"BookingPress <= 1.0.74 - Booking Price Manipulation via bookingpress_confirm_booking","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f55882-d19f-43a3-a370-17d041493944?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.74","to_inclusive":true,"patched_in":"1.0.75"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08f59eb8-8865-401f-bb02-3192184e0415","source":"wordfence","cve":"CVE-2022-0422","title":"White Label MS <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f59eb8-8865-401f-bb02-3192184e0415?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08f7800a-3c05-4654-b909-625c304d4129","source":"wordfence","cve":"CVE-2026-14834","title":"Mailgun for WordPress <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Mailgun List Subscription","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f7800a-3c05-4654-b909-625c304d4129?source=api-prod","affected":[{"type":"plugin","slug":"mailgun","name":"Mailgun for WordPress","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T14:09:10Z"},{"id":"wordfence:08f83fd1-5e8c-472f-819a-6078a5d2a56b","source":"wordfence","cve":"CVE-2009-2336","title":"WordPress Core & WordPress MU < 2.8.1 - Username Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-203","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f83fd1-5e8c-472f-819a-6078a5d2a56b?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2009-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08f8606a-d590-4836-b634-fa9bd3e59bf4","source":"wordfence","cve":"CVE-2024-22303","title":"Houzez <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8606a-d590-4836-b634-fa9bd3e59bf4?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-09-17T00:00:00Z","updated":"2024-10-04T18:46:38Z"},{"id":"wordfence:08f8f489-6b31-45d8-a122-bbaa283a2b10","source":"wordfence","cve":"CVE-2026-13246","title":"GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8f489-6b31-45d8-a122-bbaa283a2b10?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.0","to_inclusive":true,"patched_in":"4.16.1"}],"published":"2026-06-30T14:48:48Z","updated":"2026-07-01T03:43:34Z"},{"id":"wordfence:08f95cc3-6c75-4258-909f-3fc802cbdcae","source":"wordfence","cve":"CVE-2026-62091","title":"Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08f95cc3-6c75-4258-909f-3fc802cbdcae?source=api-prod","affected":[{"type":"theme","slug":"armania","name":"Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:23:34Z"},{"id":"wordfence:08fb51d6-30c1-4a48-b626-a8c6f203ac83","source":"wordfence","cve":"CVE-2023-50843","title":"Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08fb51d6-30c1-4a48-b626-a8c6f203ac83?source=api-prod","affected":[{"type":"plugin","slug":"mediaburst-email-to-sms","name":"Clockwork SMS Notfications","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08fb698f-c87c-4200-85fe-3fe72745633e","source":"wordfence","cve":"CVE-2023-5412","title":"Image horizontal reel scroll slideshow <= 13.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08fb698f-c87c-4200-85fe-3fe72745633e?source=api-prod","affected":[{"type":"plugin","slug":"image-horizontal-reel-scroll-slideshow","name":"Image horizontal reel scroll slideshow","from":"*","from_inclusive":true,"to":"13.2","to_inclusive":true,"patched_in":"13.3"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:08fcba30-d28a-4e92-b7cd-ef1a4f37faf9","source":"wordfence","cve":"CVE-2025-67994","title":"YayCurrency <= 3.3 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08fcba30-d28a-4e92-b7cd-ef1a4f37faf9?source=api-prod","affected":[{"type":"plugin","slug":"yaycurrency","name":"YayCurrency \u2013 WooCommerce Multi-Currency Switcher","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:19:41Z"},{"id":"wordfence:08fe2e28-5b19-4ce6-914a-304fe82a8ee0","source":"wordfence","cve":"CVE-2025-27011","title":"Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08fe2e28-5b19-4ce6-914a-304fe82a8ee0?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:22:21Z"},{"id":"wordfence:08fec79c-888d-40e0-8e5f-6981658b67a8","source":"wordfence","cve":"CVE-2025-49336","title":"Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08fec79c-888d-40e0-8e5f-6981658b67a8?source=api-prod","affected":[{"type":"plugin","slug":"pondol-bbs","name":"Pondol BBS","from":"*","from_inclusive":true,"to":"1.1.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T10:11:08Z","updated":"2026-02-02T20:56:55Z"},{"id":"wordfence:08ffb478-7280-4fbc-bc5f-482c1348091e","source":"wordfence","cve":"CVE-2022-3840","title":"Google Apps Login <= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/08ffb478-7280-4fbc-bc5f-482c1348091e?source=api-prod","affected":[{"type":"plugin","slug":"google-apps-login","name":"Login for Google Apps by WPAuth","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2022-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0901533b-1be7-4c94-8f9e-dc63e3e441ef","source":"wordfence","cve":"CVE-2025-62925","title":"Conversios.io <= 7.2.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0901533b-1be7-4c94-8f9e-dc63e3e441ef?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"7.2.13","to_inclusive":true,"patched_in":"7.2.14"}],"published":"2025-10-05T00:00:00Z","updated":"2025-12-11T20:42:40Z"},{"id":"wordfence:09020bbf-6222-4a75-b01f-cfd615a44765","source":"wordfence","cve":"CVE-2024-12774","title":"Altra Side Menu <= 2.0 - Cross-Site Request Forgery to Arbitrary Menu Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09020bbf-6222-4a75-b01f-cfd615a44765?source=api-prod","affected":[{"type":"plugin","slug":"altra-side-menu","name":"Altra Side Menu","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:31:32Z"},{"id":"wordfence:09023fe2-52dd-43af-ae4f-1fb46654f305","source":"wordfence","cve":"CVE-2023-7253","title":"Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.13.0 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09023fe2-52dd-43af-ae4f-1fb46654f305?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2024-04-03T00:00:00Z","updated":"2024-05-01T14:51:58Z"},{"id":"wordfence:0903521d-3b07-4539-97c9-15e6bbe2cc2e","source":"wordfence","cve":"CVE-2025-14835","title":"WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0903521d-3b07-4539-97c9-15e6bbe2cc2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.1.05.008","to_inclusive":true,"patched_in":"9.1.05.009"}],"published":"2026-01-06T16:37:04Z","updated":"2026-01-07T05:25:55Z"},{"id":"wordfence:0903bd2b-240f-4791-bfa6-f727d193af4a","source":"wordfence","cve":"","title":"Booster for WooCommerce 7.0.0 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0903bd2b-240f-4791-bfa6-f727d193af4a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"7.0.0","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2023-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09050c1e-26e0-46e7-b5f0-ebaff4066b0a","source":"wordfence","cve":"","title":"Optimize Database after Deleting Revisions <= 5.0.110 - Missing Authorization via 'odb_csv_download'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09050c1e-26e0-46e7-b5f0-ebaff4066b0a?source=api-prod","affected":[{"type":"plugin","slug":"rvg-optimize-database","name":"Optimize Database after Deleting Revisions","from":"*","from_inclusive":true,"to":"5.0.110","to_inclusive":true,"patched_in":"5.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0906e9b0-5093-4ddd-8868-8fcaad8e3a5b","source":"wordfence","cve":"CVE-2025-1483","title":"LTL Freight Quotes \u2013 GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0906e9b0-5093-4ddd-8868-8fcaad8e3a5b?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-globaltranz-edition","name":"LTL Freight Quotes \u2013 GlobalTranz Edition","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.3.13"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T09:21:39Z"},{"id":"wordfence:0907c74e-0bb8-4761-aabf-79d880c78415","source":"wordfence","cve":"CVE-2024-4422","title":"Comparison Slider <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0907c74e-0bb8-4761-aabf-79d880c78415?source=api-prod","affected":[{"type":"plugin","slug":"comparison-slider","name":"Comparison Slider","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T19:51:11Z","updated":"2024-05-30T08:30:11Z"},{"id":"wordfence:090c1ba1-1b73-4c83-a17f-993293c5621b","source":"wordfence","cve":"CVE-2015-9515","title":"Easy Digital Downloads \u2013 htaccess Editor < 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/090c1ba1-1b73-4c83-a17f-993293c5621b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads-htaccess-editor","name":"Easy Digital Downloads \u2013 htaccess Editor","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:090dfd34-375d-4cfb-87fc-7ad00bc6c5cb","source":"wordfence","cve":"CVE-2026-112359","title":"WPMobile.App \u2013 Android and iOS App Builder <= 11.86 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/090dfd34-375d-4cfb-87fc-7ad00bc6c5cb?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.86","to_inclusive":true,"patched_in":"11.87"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:08Z"},{"id":"wordfence:09127277-9e71-484d-b674-52af693c995b","source":"wordfence","cve":"CVE-2026-5464","title":"ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09127277-9e71-484d-b674-52af693c995b?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2026-04-22T19:44:42Z","updated":"2026-04-23T08:28:26Z"},{"id":"wordfence:0913da2d-2512-436f-ae65-3a83e221c618","source":"wordfence","cve":"CVE-2026-24571","title":"BOX NOW Delivery <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0913da2d-2512-436f-ae65-3a83e221c618?source=api-prod","affected":[{"type":"plugin","slug":"box-now-delivery","name":"BOX NOW Delivery","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-01-21T00:00:00Z","updated":"2026-04-15T13:35:36Z"},{"id":"wordfence:09152aa7-5c10-416a-aa77-a0cde1b6442e","source":"wordfence","cve":"CVE-2020-24948","title":"Autoptimize <= 2.7.6 - Authenticated Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09152aa7-5c10-416a-aa77-a0cde1b6442e?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2020-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09165fa9-75d2-43ec-8f71-1f43bf6ff7fd","source":"wordfence","cve":"CVE-2025-48317","title":"WooCommerce Payment Gateway for Saferpay <= 0.4.9 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09165fa9-75d2-43ec-8f71-1f43bf6ff7fd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payment-gateway-for-saferpay","name":"WooCommerce Payment Gateway for Saferpay","from":"*","from_inclusive":true,"to":"0.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:52:57Z"},{"id":"wordfence:09168f7b-4789-48c8-93d8-99b0d0eb8c53","source":"wordfence","cve":"CVE-2026-62042","title":"Scripts n Styles <= 3.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09168f7b-4789-48c8-93d8-99b0d0eb8c53?source=api-prod","affected":[{"type":"plugin","slug":"scripts-n-styles","name":"Scripts n Styles","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:12:26Z"},{"id":"wordfence:091b2d1d-983a-45ab-935e-635991e8bc8b","source":"wordfence","cve":"CVE-2014-9013","title":"WP Marketplace \u2013 Complete Shopping Cart / eCommerce Solution <= 2.4.0 - Arbitrary File Download","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/091b2d1d-983a-45ab-935e-635991e8bc8b?source=api-prod","affected":[{"type":"plugin","slug":"wpmarketplace","name":"WP Marketplace \u2013 Complete Shopping Cart / eCommerce Solution","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2015-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:091c6cb3-dc5a-4fb8-a1a5-770b2361401f","source":"wordfence","cve":"CVE-2023-22702","title":"WPMobile.App \u2014 Android and iOS Mobile Application <= 11.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/091c6cb3-dc5a-4fb8-a1a5-770b2361401f?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.13","to_inclusive":true,"patched_in":"11.14"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:091d306d-cce4-426e-a18f-38bdaa802264","source":"wordfence","cve":"CVE-2022-47603","title":"Gallery \u2013 Image and Video Gallery with Thumbnails <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/091d306d-cce4-426e-a18f-38bdaa802264?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:091dadcb-71ac-4321-b3aa-72b5fbbd9163","source":"wordfence","cve":"CVE-2024-9627","title":"TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure","severity":"high","cvss":8.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/091dadcb-71ac-4321-b3aa-72b5fbbd9163?source=api-prod","affected":[{"type":"plugin","slug":"green-wp-telegram-bot-by-teplitsa","name":"TeploBot \u2013 Telegram Bot for WP","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T06:50:30Z"},{"id":"wordfence:092061a5-5315-4401-8503-6153f660acdc","source":"wordfence","cve":"CVE-2026-42668","title":"Omnisend for WooCommerce <= 1.18.0 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token","severity":"high","cvss":7.5,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/092061a5-5315-4401-8503-6153f660acdc?source=api-prod","affected":[{"type":"plugin","slug":"omnisend-connect","name":"Email Marketing for WooCommerce by Omnisend","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-13T15:43:29Z"},{"id":"wordfence:0920fc70-1c4b-45ff-86f6-14640286b5e6","source":"wordfence","cve":"CVE-2026-11775","title":"User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0920fc70-1c4b-45ff-86f6-14640286b5e6?source=api-prod","affected":[{"type":"plugin","slug":"user-admin-simplifier","name":"User Admin Simplifier","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-06-18T13:52:53Z","updated":"2026-06-19T02:29:39Z"},{"id":"wordfence:0922d221-70c6-41d3-9da2-aa16d67e7c14","source":"wordfence","cve":"CVE-2014-4846","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Responsive WordPress Plugin <= 2.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0922d221-70c6-41d3-9da2-aa16d67e7c14?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0923bbb1-3c67-4503-adc4-86955a8ec63d","source":"wordfence","cve":"CVE-2025-58633","title":"Booking Ultra Pro <= 1.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0923bbb1-3c67-4503-adc4-86955a8ec63d?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:30:09Z"},{"id":"wordfence:0925fb98-2233-4f4b-8e70-c52d0b5086f1","source":"wordfence","cve":"CVE-2025-57945","title":"WP Advanced PDF <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0925fb98-2233-4f4b-8e70-c52d0b5086f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-pdf","name":"WP Advanced PDF","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:57:26Z"},{"id":"wordfence:0926bcf2-9cce-420d-a02f-52675224a71b","source":"wordfence","cve":"CVE-2023-4925","title":"Easy Forms for Mailchimp <= 6.8.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0926bcf2-9cce-420d-a02f-52675224a71b?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":""}],"published":"2023-12-21T00:00:00Z","updated":"2024-02-06T17:27:37Z"},{"id":"wordfence:09277f30-9b6a-4cc9-bc8c-09c360da917a","source":"wordfence","cve":"CVE-2022-1568","title":"Team Members <= 5.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09277f30-9b6a-4cc9-bc8c-09c360da917a?source=api-prod","affected":[{"type":"plugin","slug":"team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:092dd21d-2282-4a44-9667-e437387deec6","source":"wordfence","cve":"CVE-2026-109703","title":"WPGraphQL <= 2.26.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/092dd21d-2282-4a44-9667-e437387deec6?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"2.26.0","to_inclusive":true,"patched_in":"2.26.1"}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-10T23:21:35Z"},{"id":"wordfence:092e13db-1667-458c-a1c0-f35c167d5d45","source":"wordfence","cve":"CVE-2025-48088","title":"Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/092e13db-1667-458c-a1c0-f35c167d5d45?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.1","to_inclusive":false,"patched_in":"3.21.1"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T15:06:31Z"},{"id":"wordfence:093058f1-c717-424f-9bd5-4838df8d20a1","source":"wordfence","cve":"CVE-2025-10147","title":"Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093058f1-c717-424f-9bd5-4838df8d20a1?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-23T08:26:15Z"},{"id":"wordfence:0930e4f2-125f-4d37-a051-418f5e8c536d","source":"wordfence","cve":"CVE-2025-31886","title":"Social proof testimonials and reviews by Repuso <= 5.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0930e4f2-125f-4d37-a051-418f5e8c536d?source=api-prod","affected":[{"type":"plugin","slug":"social-testimonials-and-reviews-widget","name":"Reviews Widgets for Google & 45+ platforms by Repuso","from":"*","from_inclusive":true,"to":"5.21","to_inclusive":true,"patched_in":"5.22"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:26:00Z"},{"id":"wordfence:09316a23-3a99-47f2-9c3f-795dc0a4a792","source":"wordfence","cve":"CVE-2024-8486","title":"Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09316a23-3a99-47f2-9c3f-795dc0a4a792?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.16.3","to_inclusive":true,"patched_in":"2.16.4"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T07:39:01Z"},{"id":"wordfence:0931f279-2dac-4663-9344-df27b43a7e64","source":"wordfence","cve":"CVE-2024-5942","title":"Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=api-prod","affected":[{"type":"plugin","slug":"page-or-post-clone","name":"Fast Page & Post Duplicator","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T04:33:30Z"},{"id":"wordfence:0933ea77-2de0-4cd5-a589-a4c1d474f119","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'rawdata' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0933ea77-2de0-4cd5-a589-a4c1d474f119?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0935ede4-05bc-48a2-94a3-8d92002e02bb","source":"wordfence","cve":"CVE-2025-10679","title":"ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0935ede4-05bc-48a2-94a3-8d92002e02bb?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-03-22T16:26:52Z","updated":"2026-03-23T05:29:40Z"},{"id":"wordfence:093611bc-1b09-4654-a7f8-b4c6bd7c72c5","source":"wordfence","cve":"CVE-2025-52821","title":"Video List Manager <= 1.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093611bc-1b09-4654-a7f8-b4c6bd7c72c5?source=api-prod","affected":[{"type":"plugin","slug":"video-list-manager","name":"Video List Manager","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:13:06Z"},{"id":"wordfence:093959d3-a8a9-4ff1-856d-7ea121e330cc","source":"wordfence","cve":"CVE-2024-51573","title":"ML Responsive Audio player with playlist Shortcode <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093959d3-a8a9-4ff1-856d-7ea121e330cc?source=api-prod","affected":[{"type":"plugin","slug":"mlr-audio","name":"ML Responsive Audio player with playlist Shortcode","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:58:42Z"},{"id":"wordfence:093af92e-bbc2-463a-8547-0e48fb356655","source":"wordfence","cve":"CVE-2023-6811","title":"Language Translate Widget for WordPress \u2013 ConveyThis <= 223 - Unauthenticated Stored Cross-Site Scripting via api_key","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093af92e-bbc2-463a-8547-0e48fb356655?source=api-prod","affected":[{"type":"plugin","slug":"conveythis-translate","name":"ConveyThis AI Multilingual Translation","from":"*","from_inclusive":true,"to":"223","to_inclusive":true,"patched_in":"224"}],"published":"2024-04-10T00:00:00Z","updated":"2024-07-29T21:35:50Z"},{"id":"wordfence:093dc35d-3d7d-4fa4-af57-835b96df8984","source":"wordfence","cve":"CVE-2015-3421","title":"eShop <= 6.3.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093dc35d-3d7d-4fa4-af57-835b96df8984?source=api-prod","affected":[{"type":"plugin","slug":"eshop","name":"eShop","from":"*","from_inclusive":true,"to":"6.3.12","to_inclusive":false,"patched_in":"6.3.12"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:093f69c8-890b-4885-81bf-e46d994c3fdb","source":"wordfence","cve":"CVE-2025-58593","title":"Orbit Fox by ThemeIsle <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/093f69c8-890b-4885-81bf-e46d994c3fdb?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T20:52:17Z"},{"id":"wordfence:09406c75-d1ae-4baf-95a1-2c6a492dcf40","source":"wordfence","cve":"CVE-2026-54848","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09406c75-d1ae-4baf-95a1-2c6a492dcf40?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-25T13:27:55Z"},{"id":"wordfence:09437329-f01a-4998-90ec-e4b2e271e896","source":"wordfence","cve":"CVE-2023-37888","title":"Shortcodes and extra features for Phlox theme <= 2.14.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09437329-f01a-4998-90ec-e4b2e271e896?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0945e251-9044-4c04-869d-c6ffb6368cc3","source":"wordfence","cve":"CVE-2026-110032","title":"Salon Booking System <= 10.31.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0945e251-9044-4c04-869d-c6ffb6368cc3?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.10","to_inclusive":true,"patched_in":"10.31.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:31:00Z"},{"id":"wordfence:09463140-2edc-4458-900b-a898d115f34d","source":"wordfence","cve":"CVE-2026-39696","title":"Elfsight WhatsApp Chat CC <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09463140-2edc-4458-900b-a898d115f34d?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-whatsapp-chat","name":"WhatsApp Chat - WordPress WhatsApp Chat","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-05-05T15:45:40Z"},{"id":"wordfence:09467946-0ee7-45e7-969e-ec30863bfa3e","source":"wordfence","cve":"CVE-2015-5532","title":"Paid Memberships Pro < 1.8.4.3 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09467946-0ee7-45e7-969e-ec30863bfa3e?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"1.8.4.3","to_inclusive":false,"patched_in":"1.8.4.3"}],"published":"2015-07-22T00:00:00Z","updated":"2025-08-28T13:14:25Z"},{"id":"wordfence:0946fab3-6299-4f62-9664-c0a049e2dbb3","source":"wordfence","cve":"CVE-2024-13587","title":"Zigaform \u2013 Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0946fab3-6299-4f62-9664-c0a049e2dbb3?source=api-prod","affected":[{"type":"plugin","slug":"zigaform-calculator-cost-estimation-form-builder-lite","name":"Zigaform \u2013 Price Calculator & Cost Estimation Form Builder Lite","from":"*","from_inclusive":true,"to":"7.4.7","to_inclusive":true,"patched_in":"7.4.8"}],"published":"2025-02-17T15:43:37Z","updated":"2025-02-20T14:46:50Z"},{"id":"wordfence:09479df1-ff7e-4df8-9aea-8c7622ecea4e","source":"wordfence","cve":"CVE-2023-0490","title":"f(x) TOC <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09479df1-ff7e-4df8-9aea-8c7622ecea4e?source=api-prod","affected":[{"type":"plugin","slug":"fx-toc","name":"f(x) TOC","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:094972e6-7e02-4060-b069-e39c8cde9331","source":"wordfence","cve":"CVE-2025-1562","title":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094972e6-7e02-4060-b069-e39c8cde9331?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-06-17T19:19:26Z","updated":"2025-06-18T07:22:46Z"},{"id":"wordfence:094a768d-85f8-4b6a-8aa3-e243f2e4b505","source":"wordfence","cve":"CVE-2026-103518","title":"FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094a768d-85f8-4b6a-8aa3-e243f2e4b505?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-10-15T15:31:49Z","updated":"2026-10-16T03:38:40Z"},{"id":"wordfence:094aa8ea-42f0-484f-80fe-a0bf3a110adc","source":"wordfence","cve":"CVE-2024-38759","title":"Search & Replace <= 3.2.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094aa8ea-42f0-484f-80fe-a0bf3a110adc?source=api-prod","affected":[{"type":"plugin","slug":"search-and-replace","name":"Search & Replace","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-26T22:20:06Z"},{"id":"wordfence:094bf4e2-b774-4015-b6c6-c829c16556eb","source":"wordfence","cve":"CVE-2023-40009","title":"WP Pipes <= 1.4.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094bf4e2-b774-4015-b6c6-c829c16556eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:094c0952-4e28-4ed0-80ae-14fcf10cf2e1","source":"wordfence","cve":"","title":"Survey Maker \u2013 Best WordPress Survey Plugin <= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094c0952-4e28-4ed0-80ae-14fcf10cf2e1?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:094c5011-41f6-420b-b566-e77fd55d9011","source":"wordfence","cve":"","title":"Gmedia Photo Gallery < 1.2.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094c5011-41f6-420b-b566-e77fd55d9011?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2014-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:094d4fb1-1b8e-4d0c-9e79-91ecf39caf9f","source":"wordfence","cve":"CVE-2026-39541","title":"Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/094d4fb1-1b8e-4d0c-9e79-91ecf39caf9f?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.38","to_inclusive":true,"patched_in":"1.1.39"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:28:45Z"},{"id":"wordfence:09506d1c-986e-45c8-b43c-7f2578eb2dbd","source":"wordfence","cve":"CVE-2025-30935","title":"Contact Form <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09506d1c-986e-45c8-b43c-7f2578eb2dbd?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-ready","name":"Contact Form","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:52:22Z"},{"id":"wordfence:0951bc88-aa4e-4584-8203-9e02af322494","source":"wordfence","cve":"CVE-2026-13355","title":"Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0951bc88-aa4e-4584-8203-9e02af322494?source=api-prod","affected":[{"type":"plugin","slug":"mb-user-profile","name":"Meta Box User Profile","from":"*","from_inclusive":true,"to":"2.5.16","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"meta-box-aio","name":"Meta Box AIO","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.12.0"},{"type":"plugin","slug":"mb-frontend-submission","name":"Meta Box Frontend Submission","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2026-09-21T16:26:40Z","updated":"2026-10-08T17:26:21Z"},{"id":"wordfence:0953c534-e5fb-4d6d-9a67-5b3503dde77d","source":"wordfence","cve":"CVE-2026-103331","title":"UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0953c534-e5fb-4d6d-9a67-5b3503dde77d?source=api-prod","affected":[{"type":"plugin","slug":"unipay-payment-gateway-for-woocommerce","name":"UniPAY Payment Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:25:38Z"},{"id":"wordfence:09547dae-85dc-481d-9eb1-423d8faadc80","source":"wordfence","cve":"CVE-2023-49824","title":"Product Catalog Feed by PixelYourSite <= 2.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09547dae-85dc-481d-9eb1-423d8faadc80?source=api-prod","affected":[{"type":"plugin","slug":"product-catalog-feed","name":"Product Catalog Feed by PixelYourSite","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09551d22-c8c2-435c-9d00-bb4833497c16","source":"wordfence","cve":"CVE-2023-46079","title":"Ashe Extra <= 1.2.91 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09551d22-c8c2-435c-9d00-bb4833497c16?source=api-prod","affected":[{"type":"plugin","slug":"ashe-extra","name":"Ashe Extra","from":"*","from_inclusive":true,"to":"1.2.91","to_inclusive":true,"patched_in":"1.2.92"}],"published":"2023-10-16T00:00:00Z","updated":"2024-11-21T17:19:52Z"},{"id":"wordfence:0955a596-d4bb-48fa-a515-a1aafe34048b","source":"wordfence","cve":"CVE-2025-31855","title":"SMM API <= 6.0.30 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0955a596-d4bb-48fa-a515-a1aafe34048b?source=api-prod","affected":[{"type":"plugin","slug":"smm-api","name":"SMM API","from":"*","from_inclusive":true,"to":"6.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-05T18:36:46Z"},{"id":"wordfence:095724bb-9949-4c62-9a11-02f1cd4c6043","source":"wordfence","cve":"CVE-2022-4023","title":"3DPrint <= 3.5.6.8 - Cross-Site Request Forgery to Arbitrary File Download","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095724bb-9949-4c62-9a11-02f1cd4c6043?source=api-prod","affected":[{"type":"plugin","slug":"3dprint","name":"3DPrint","from":"*","from_inclusive":true,"to":"3.5.6.9","to_inclusive":true,"patched_in":""}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09588c2a-1631-4924-8277-d47f096493c5","source":"wordfence","cve":"CVE-2026-12657","title":"LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09588c2a-1631-4924-8277-d47f096493c5?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-07-01T20:02:14Z","updated":"2026-07-02T08:33:05Z"},{"id":"wordfence:09597618-8695-4631-8c3b-4e7580d58c86","source":"wordfence","cve":"CVE-2023-48742","title":"License Manager for WooCommerce <= 2.2.10 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09597618-8695-4631-8c3b-4e7580d58c86?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:095a2262-1da2-4f79-896c-6d48eb079a7b","source":"wordfence","cve":"CVE-2024-4218","title":"AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actions","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095a2262-1da2-4f79-896c-6d48eb079a7b?source=api-prod","affected":[{"type":"plugin","slug":"affieasy","name":"AffiEasy","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-05-29T15:52:55Z","updated":"2024-06-06T12:12:27Z"},{"id":"wordfence:095b23b7-71ab-41eb-b666-73df2e1a7eb4","source":"wordfence","cve":"CVE-2024-4605","title":"Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095b23b7-71ab-41eb-b666-73df2e1a7eb4?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-05-08T00:00:00Z","updated":"2026-05-15T13:16:45Z"},{"id":"wordfence:095bee95-d3a7-4203-96eb-90f1f0eab84f","source":"wordfence","cve":"CVE-2021-23150","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.0.77.31 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095bee95-d3a7-4203-96eb-90f1f0eab84f?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.77.31","to_inclusive":true,"patched_in":"1.0.77.32"}],"published":"2021-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:095c6359-112d-4abc-a69b-a623dfd103c0","source":"wordfence","cve":"CVE-2025-11970","title":"Emplibot \u2013 AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":4.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095c6359-112d-4abc-a69b-a623dfd103c0?source=api-prod","affected":[{"type":"plugin","slug":"emplibot","name":"Emplibot \u2013 AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-12-12T15:26:29Z","updated":"2025-12-13T04:31:20Z"},{"id":"wordfence:095cc3dc-7a3e-473f-a762-de327c7ef28b","source":"wordfence","cve":"CVE-2021-24640","title":"WordPress Slider Block Gutenslider <= 5.1.5 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095cc3dc-7a3e-473f-a762-de327c7ef28b?source=api-prod","affected":[{"type":"plugin","slug":"gutenslider","name":"Gutenslider \u2013 Image & Video Slider Block","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":false,"patched_in":"5.2.0"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:095e93d0-ad0d-4613-887e-5e47a2ef2b96","source":"wordfence","cve":"CVE-2026-96278","title":"WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/095e93d0-ad0d-4613-887e-5e47a2ef2b96?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.03.002","to_inclusive":true,"patched_in":"9.3.03.003"}],"published":"2026-10-09T18:46:24Z","updated":"2026-10-10T07:41:42Z"},{"id":"wordfence:09613e4a-0dbe-430a-ab75-725038218803","source":"wordfence","cve":"CVE-2021-24481","title":"Any Hostname <= 1.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09613e4a-0dbe-430a-ab75-725038218803?source=api-prod","affected":[{"type":"plugin","slug":"any-hostname","name":"Any Hostname","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09618198-06fd-438b-a526-c7bf5b2570a8","source":"wordfence","cve":"CVE-2018-0511","title":"WP Retina 2x <= 5.2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09618198-06fd-438b-a526-c7bf5b2570a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-retina-2x","name":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2017-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:096257a4-6ee9-41e1-8a59-4ffcd309f83c","source":"wordfence","cve":"CVE-2023-1925","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/096257a4-6ee9-41e1-8a59-4ffcd309f83c?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09631637-55e2-4e1e-9dcb-bba205be5f43","source":"wordfence","cve":"CVE-2023-52193","title":"Page Builder: Live Composer <= 1.5.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09631637-55e2-4e1e-9dcb-bba205be5f43?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.23","to_inclusive":true,"patched_in":"1.5.24"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0963d6ee-6d27-4239-9e31-2750f5217594","source":"wordfence","cve":"CVE-2025-32670","title":"Spark GF Failed Submissions <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0963d6ee-6d27-4239-9e31-2750f5217594?source=api-prod","affected":[{"type":"plugin","slug":"spark-gf-failed-submissions","name":"Spark GF Failed Submissions","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-08T18:12:01Z"},{"id":"wordfence:0965b39c-ad17-458d-93be-9b565f48183b","source":"wordfence","cve":"CVE-2026-81741","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation < 4.7.2 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0965b39c-ad17-458d-93be-9b565f48183b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":false,"patched_in":"4.7.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T15:05:29Z"},{"id":"wordfence:0966057b-8a3c-4d3c-84cb-cf36f1d97922","source":"wordfence","cve":"CVE-2024-2033","title":"Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0966057b-8a3c-4d3c-84cb-cf36f1d97922?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2024-03-22T00:00:00Z","updated":"2024-04-09T18:58:30Z"},{"id":"wordfence:09675029-0204-4692-8280-cdb674fb86df","source":"wordfence","cve":"CVE-2026-78261","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09675029-0204-4692-8280-cdb674fb86df?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T21:07:23Z"},{"id":"wordfence:09679bd2-c416-4037-bfa4-d56ba862113c","source":"wordfence","cve":"CVE-2021-25114","title":"Paid Memberships Pro <= 2.6.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09679bd2-c416-4037-bfa4-d56ba862113c?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":false,"patched_in":"2.6.7"}],"published":"2022-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0968fe3b-2256-41e8-8cc9-e800dd7f8c27","source":"wordfence","cve":"CVE-2024-11583","title":"Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.9 - Missing Authorization to Icon Font Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0968fe3b-2256-41e8-8cc9-e800dd7f8c27?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-01-30T00:56:47Z","updated":"2025-03-21T17:12:44Z"},{"id":"wordfence:096ea1e3-a6c3-43c7-94f0-6c5617dd3fa9","source":"wordfence","cve":"CVE-2024-32588","title":"LearnPress Export Import <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/096ea1e3-a6c3-43c7-94f0-6c5617dd3fa9?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T14:56:51Z"},{"id":"wordfence:0975cc9d-7130-4802-bba2-b52d4b79edcd","source":"wordfence","cve":"CVE-2024-37559","title":"Counterpoint <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0975cc9d-7130-4802-bba2-b52d4b79edcd?source=api-prod","affected":[{"type":"theme","slug":"counterpoint","name":"Counterpoint","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-11T13:58:16Z"},{"id":"wordfence:09768e37-7ba8-43b6-93df-3d201fe780ba","source":"wordfence","cve":"","title":"Woostify <= 1.9.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09768e37-7ba8-43b6-93df-3d201fe780ba?source=api-prod","affected":[{"type":"theme","slug":"woostify","name":"Woostify","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0976ab6c-d7ad-47c6-9017-2cc6ebd8158f","source":"wordfence","cve":"CVE-2025-47557","title":"MapSVG <= 8.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0976ab6c-d7ad-47c6-9017-2cc6ebd8158f?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.5.31","to_inclusive":true,"patched_in":"8.6.11"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-24T22:15:34Z"},{"id":"wordfence:09773141-883b-40e3-bd20-d3115c02e023","source":"wordfence","cve":"","title":"Login Lockdown <= 2.06 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09773141-883b-40e3-bd20-d3115c02e023?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.06","to_inclusive":true,"patched_in":"2.07"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:097760a6-0b8b-437d-a6ad-29675cbb5091","source":"wordfence","cve":"CVE-2026-32424","title":"Sprout Clients <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097760a6-0b8b-437d-a6ad-29675cbb5091?source=api-prod","affected":[{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-02-27T00:00:00Z","updated":"2026-04-15T21:17:22Z"},{"id":"wordfence:09779cc3-96ea-4b50-b28c-c5690edf082f","source":"wordfence","cve":"CVE-2025-26940","title":"Pie Register Premium <= 3.8.3.2 - Authenticated (Subscriber+) Limited File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09779cc3-96ea-4b50-b28c-c5690edf082f?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.3.2","to_inclusive":true,"patched_in":"3.8.3.3"}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:02:22Z"},{"id":"wordfence:097a9d0f-fa38-4fdc-9048-43dd65e7652c","source":"wordfence","cve":"CVE-2026-3141","title":"FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097a9d0f-fa38-4fdc-9048-43dd65e7652c?source=api-prod","affected":[{"type":"plugin","slug":"formgent","name":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-07-31T17:05:12Z","updated":"2026-08-01T05:33:54Z"},{"id":"wordfence:097b1530-64fa-45b2-85f3-c6a2311405b5","source":"wordfence","cve":"CVE-2026-15282","title":"Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097b1530-64fa-45b2-85f3-c6a2311405b5?source=api-prod","affected":[{"type":"plugin","slug":"instant-appointment","name":"Instant Appointment","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T21:44:00Z","updated":"2026-07-10T04:31:20Z"},{"id":"wordfence:097c3257-6479-4169-ac17-cb1629aef7a1","source":"wordfence","cve":"CVE-2025-14803","title":"Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097c3257-6479-4169-ac17-cb1629aef7a1?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.7","to_inclusive":true,"patched_in":"9.1.8"}],"published":"2025-12-19T00:00:00Z","updated":"2026-01-13T22:04:49Z"},{"id":"wordfence:097f6887-e15f-4e35-ab12-1115630e13cc","source":"wordfence","cve":"CVE-2023-22690","title":"Ebook Store < 5.78 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097f6887-e15f-4e35-ab12-1115630e13cc?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.78","to_inclusive":false,"patched_in":"5.78"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:097fb50e-ed0e-41ae-a55b-bc2279267472","source":"wordfence","cve":"CVE-2026-32578","title":"ECPay Ecommerce for WooCommerce <= 1.1.2606090 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097fb50e-ed0e-41ae-a55b-bc2279267472?source=api-prod","affected":[{"type":"plugin","slug":"ecpay-ecommerce-for-woocommerce","name":"ECPay Ecommerce for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2606090","to_inclusive":true,"patched_in":"1.1.2610150"}],"published":"2026-10-04T08:26:36Z","updated":"2026-10-28T21:15:49Z"},{"id":"wordfence:097fdc88-9424-4de9-9a03-d4ea724da13f","source":"wordfence","cve":"CVE-2024-22149","title":"cformsII <= 15.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/097fdc88-9424-4de9-9a03-d4ea724da13f?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.0.6","to_inclusive":true,"patched_in":"15.0.7"}],"published":"2024-01-15T00:00:00Z","updated":"2025-05-02T11:43:16Z"},{"id":"wordfence:09814382-476b-4686-b3e8-d80aade92b1f","source":"wordfence","cve":"CVE-2024-6158","title":"Category Posts Widget <= 4.9.16 & Pro < 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09814382-476b-4686-b3e8-d80aade92b1f?source=api-prod","affected":[{"type":"plugin","slug":"category-posts","name":"Category Posts Block","from":"*","from_inclusive":true,"to":"4.9.16","to_inclusive":true,"patched_in":"4.9.17"},{"type":"plugin","slug":"term-and-category-based-posts-widget","name":"Terms and Category Based Posts Widget","from":"*","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"4.9.13"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:22:33Z"},{"id":"wordfence:098177e8-2d81-4a9f-bcf4-5f649c9c47ca","source":"wordfence","cve":"CVE-2026-27074","title":"Shortcoder \u2014 Create Shortcodes for Anything <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098177e8-2d81-4a9f-bcf4-5f649c9c47ca?source=api-prod","affected":[{"type":"plugin","slug":"shortcoder","name":"Shortcoder \u2014 Create Shortcodes for Anything","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2026-01-09T00:00:00Z","updated":"2026-03-06T18:54:22Z"},{"id":"wordfence:0982cc3e-87d7-49d2-afa3-8c18355d7968","source":"wordfence","cve":"CVE-2026-0751","title":"Payment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0982cc3e-87d7-49d2-afa3-8c18355d7968?source=api-prod","affected":[{"type":"plugin","slug":"payment-page","name":"Payment Page \u2013 Stripe Payment Forms for Donations, Subscriptions & Recurring Payments","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-02-13T18:30:19Z","updated":"2026-02-24T19:13:40Z"},{"id":"wordfence:09831b2f-8f79-4833-8fc6-f1af56c6abc8","source":"wordfence","cve":"CVE-2024-12558","title":"WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09831b2f-8f79-4833-8fc6-f1af56c6abc8?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2024-12-20T20:57:01Z","updated":"2024-12-21T09:23:54Z"},{"id":"wordfence:098348de-f6b5-4eab-ae41-2dd32ca951fd","source":"wordfence","cve":"CVE-2025-62985","title":"Simple Pull Quote <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098348de-f6b5-4eab-ae41-2dd32ca951fd?source=api-prod","affected":[{"type":"plugin","slug":"simple-pull-quote","name":"Simple Pull Quote","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-10-23T00:00:00Z","updated":"2025-12-11T19:43:13Z"},{"id":"wordfence:09870d90-80b1-4650-9b00-0dc005702aee","source":"wordfence","cve":"","title":"NextGEN Smooth Gallery <= 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09870d90-80b1-4650-9b00-0dc005702aee?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-smooth-gallery","name":"nextgen-smooth-gallery","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2013-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0987285b-4daf-4979-934b-7fa4a0ded99f","source":"wordfence","cve":"CVE-2016-4567","title":"WordPress Core < 4.5.2 - Cross-Site Scripting via MediaElement.js","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0987285b-4daf-4979-934b-7fa4a0ded99f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.13","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.13","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"3.7.14"}],"published":"2016-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0987f9a5-eb11-4756-a09a-26dc66a8c690","source":"wordfence","cve":"CVE-2021-24423","title":"UpdraftPlus WordPress Backup Plugin < 1.6.59 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0987f9a5-eb11-4756-a09a-26dc66a8c690?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.6.59","to_inclusive":false,"patched_in":"1.6.59"}],"published":"2021-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09890f42-b9ee-4812-8cf2-f638ba9fb20f","source":"wordfence","cve":"CVE-2024-9214","title":"Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09890f42-b9ee-4812-8cf2-f638ba9fb20f?source=api-prod","affected":[{"type":"plugin","slug":"additional-product-fields-for-woocommerce","name":"Extra Product Options Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.133","to_inclusive":true,"patched_in":"1.2.134"}],"published":"2024-10-23T22:12:53Z","updated":"2024-10-24T11:03:16Z"},{"id":"wordfence:098b979f-337d-4fbd-bfcc-0e8a281e6982","source":"wordfence","cve":"CVE-2026-1570","title":"Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098b979f-337d-4fbd-bfcc-0e8a281e6982?source=api-prod","affected":[{"type":"plugin","slug":"simple-bible-verse-via-shortcode","name":"Simple Bible Verse via Shortcode","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:25:23Z","updated":"2026-02-07T08:26:36Z"},{"id":"wordfence:098c3f4c-b6bc-462a-98ef-30e6a68d74cf","source":"wordfence","cve":"CVE-2025-14029","title":"Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098c3f4c-b6bc-462a-98ef-30e6a68d74cf?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2026-01-16T15:39:05Z","updated":"2026-01-17T04:34:00Z"},{"id":"wordfence:098dfee2-ba0b-420f-89ed-8ad1e41faec4","source":"wordfence","cve":"CVE-2024-1178","title":"SportsPress \u2013 Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098dfee2-ba0b-420f-89ed-8ad1e41faec4?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.17","to_inclusive":true,"patched_in":"2.7.18"}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:55:47Z"},{"id":"wordfence:098efef9-f5e0-4827-bd4e-88867b7dc3b7","source":"wordfence","cve":"CVE-2023-6290","title":"SEOPress \u2013 On-site SEO <= 7.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098efef9-f5e0-4827-bd4e-88867b7dc3b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.3"}],"published":"2023-12-26T00:00:00Z","updated":"2024-02-06T13:52:22Z"},{"id":"wordfence:098f219d-77e5-46f9-b8c2-fa8ccdc5af38","source":"wordfence","cve":"","title":"MainWP Maintenance Extension <= 4.1.1 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/098f219d-77e5-46f9-b8c2-fa8ccdc5af38?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-maintenance-extension","name":"MainWP Maintenance Extension","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09925777-5a25-4c7a-bc05-970512992943","source":"wordfence","cve":"CVE-2026-25405","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09925777-5a25-4c7a-bc05-970512992943?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-28T21:11:25Z"},{"id":"wordfence:0992ac60-14c6-4432-bd6e-c11c6a7bf603","source":"wordfence","cve":"CVE-2024-2278","title":"Themify \u2013 WooCommerce Product Filter <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0992ac60-14c6-4432-bd6e-c11c6a7bf603?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-03-11T00:00:00Z","updated":"2026-03-27T10:43:57Z"},{"id":"wordfence:09932277-8af3-4790-96f0-fe5af0a0ed29","source":"wordfence","cve":"CVE-2023-25037","title":"Booking Calendar Contact Form <= 1.2.34 - Cross-Site Request Forgery via cpdexbccf_feedback","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09932277-8af3-4790-96f0-fe5af0a0ed29?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.34","to_inclusive":true,"patched_in":"1.2.35"}],"published":"2023-02-06T00:00:00Z","updated":"2024-10-15T18:47:32Z"},{"id":"wordfence:09935fd1-5a95-411a-a820-60888be7b059","source":"wordfence","cve":"","title":"WordPress Core < 3.8.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09935fd1-5a95-411a-a820-60888be7b059?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8.1","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2014-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099393a7-2497-44ff-8d94-dd8e9209d425","source":"wordfence","cve":"CVE-2026-22376","title":"Parkivia <= 1.1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099393a7-2497-44ff-8d94-dd8e9209d425?source=api-prod","affected":[{"type":"theme","slug":"parkivia","name":"Parkivia | Auto Parking & Car Maintenance WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:29:30Z"},{"id":"wordfence:09952b56-a064-46f9-b037-be86cf6df781","source":"wordfence","cve":"CVE-2021-24744","title":"Cimatti Contact Forms <= 1.4.11 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09952b56-a064-46f9-b037-be86cf6df781?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":false,"patched_in":"1.4.12"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09980ab2-b67c-40ea-8920-8786aca80927","source":"wordfence","cve":"CVE-2026-11869","title":"DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09980ab2-b67c-40ea-8920-8786aca80927?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.39","to_inclusive":true,"patched_in":"3.1.40"}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:59:27Z"},{"id":"wordfence:09989141-43ba-446c-8230-0485add7a1e2","source":"wordfence","cve":"CVE-2025-12660","title":"Padlet Shortcode <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09989141-43ba-446c-8230-0485add7a1e2?source=api-prod","affected":[{"type":"plugin","slug":"wallwisher-shortcode","name":"Padlet Shortcode","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:22:22Z","updated":"2025-11-21T07:31:45Z"},{"id":"wordfence:0999a738-9fae-4043-99eb-ff222a7608fa","source":"wordfence","cve":"CVE-2023-34176","title":"Chilexpress woo oficial <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0999a738-9fae-4043-99eb-ff222a7608fa?source=api-prod","affected":[{"type":"plugin","slug":"chilexpress-oficial","name":"Chilexpress woo oficial","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099af779-ab6f-4fad-a4a9-832e5a892fdd","source":"wordfence","cve":"CVE-2022-4475","title":"Collapse-O-Matic <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099af779-ab6f-4fad-a4a9-832e5a892fdd?source=api-prod","affected":[{"type":"plugin","slug":"jquery-collapse-o-matic","name":"Collapse-O-Matic","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099b176a-dab0-41c4-a69d-0c5d8a03463a","source":"wordfence","cve":"CVE-2026-19084","title":"Shared Files Pro < 1.7.70 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099b176a-dab0-41c4-a69d-0c5d8a03463a?source=api-prod","affected":[{"type":"plugin","slug":"shared-files-pro","name":"Shared Files Pro","from":"*","from_inclusive":true,"to":"1.7.70","to_inclusive":false,"patched_in":"1.7.70"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:13:59Z"},{"id":"wordfence:099b2244-1371-4418-b5ef-b28ac030dedd","source":"wordfence","cve":"CVE-2015-9303","title":"Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099b2244-1371-4418-b5ef-b28ac030dedd?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"6.0.1"}],"published":"2015-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099b8d92-6806-445f-aec9-514dce53fc5f","source":"wordfence","cve":"CVE-2025-39552","title":"Zephyr Project Manager <= 3.3.200 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099b8d92-6806-445f-aec9-514dce53fc5f?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.200","to_inclusive":true,"patched_in":"3.3.201"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-30T22:16:02Z"},{"id":"wordfence:099c8e23-31e3-47de-a33a-fe5812ca14d3","source":"wordfence","cve":"","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 1.25.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099c8e23-31e3-47de-a33a-fe5812ca14d3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.25.5","to_inclusive":true,"patched_in":"1.25.6"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099cc754-6a56-498f-848a-a242733e7fb0","source":"wordfence","cve":"CVE-2023-5674","title":"WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL Injection via id","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099cc754-6a56-498f-848a-a242733e7fb0?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-20T00:00:00Z","updated":"2024-02-06T15:46:05Z"},{"id":"wordfence:099dd38b-29f0-4b37-bb79-c7297baa9617","source":"wordfence","cve":"CVE-2025-48281","title":"MyStyle Custom Product Designer <= 3.21.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099dd38b-29f0-4b37-bb79-c7297baa9617?source=api-prod","affected":[{"type":"plugin","slug":"mystyle-custom-product-designer","name":"MyStyle Custom Product Designer","from":"*","from_inclusive":true,"to":"3.21.1","to_inclusive":true,"patched_in":"3.21.2"}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:39:21Z"},{"id":"wordfence:099dfb18-fc73-4a19-b017-1675c9acfa2f","source":"wordfence","cve":"CVE-2023-25453","title":"WordPress Tables <= 1.3.9 - Reflected Cross-Site Scripting via error_msg","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099dfb18-fc73-4a19-b017-1675c9acfa2f?source=api-prod","affected":[{"type":"plugin","slug":"wptables","name":"WordPress Tables","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:099e8784-48d2-4be7-9549-b9dbe57fe637","source":"wordfence","cve":"CVE-2025-49938","title":"JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099e8784-48d2-4be7-9549-b9dbe57fe637?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-09-18T00:00:00Z","updated":"2025-10-29T20:17:55Z"},{"id":"wordfence:099f4139-8680-4b12-9d0e-ee4e361151e5","source":"wordfence","cve":"CVE-2025-49863","title":"Advanced Sermons <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/099f4139-8680-4b12-9d0e-ee4e361151e5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-sermons","name":"Advanced Sermons","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:53:00Z"},{"id":"wordfence:09a01a43-5900-4dc6-a5f7-9d1529094ac0","source":"wordfence","cve":"CVE-2025-67566","title":"Woffice Core <= 5.4.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a01a43-5900-4dc6-a5f7-9d1529094ac0?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.30","to_inclusive":true,"patched_in":"5.4.31"}],"published":"2025-11-14T00:00:00Z","updated":"2025-12-11T17:03:16Z"},{"id":"wordfence:09a052a1-6e69-4972-9dab-802754cfb93a","source":"wordfence","cve":"CVE-2022-4658","title":"RSSImport <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a052a1-6e69-4972-9dab-802754cfb93a?source=api-prod","affected":[{"type":"plugin","slug":"rss-import","name":"RSSImport","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09a0639e-4b14-4dc9-a50c-d18234faa7b1","source":"wordfence","cve":"CVE-2023-41648","title":"Login and Logout Redirect <= 2.0.2 -  Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a0639e-4b14-4dc9-a50c-d18234faa7b1?source=api-prod","affected":[{"type":"plugin","slug":"login-and-logout-redirect","name":"Login and Logout Redirect","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09a1388e-6c87-44cd-a137-4212b569423b","source":"wordfence","cve":"CVE-2023-40327","title":"Putler Connector for WooCommerce <= 2.12.0 - Missing Authorization via 'putler_connector_sync_complete'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a1388e-6c87-44cd-a137-4212b569423b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-putler-connector","name":"Putler \u2013 Simple WooCommerce Analytics for your Store","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2023-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09a16956-5dab-4ef1-9037-fdd28bcc2e26","source":"wordfence","cve":"CVE-2025-15671","title":"Welcart e-Commerce < 2.12.1 - Unauthenticated Session Fixation","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a16956-5dab-4ef1-9037-fdd28bcc2e26?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":false,"patched_in":"2.12.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-02T14:47:38Z"},{"id":"wordfence:09a4e0e6-3be4-4f55-8816-8eeb3e24f2ca","source":"wordfence","cve":"CVE-2025-58611","title":"Tickera <= 3.5.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a4e0e6-3be4-4f55-8816-8eeb3e24f2ca?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.5.6","to_inclusive":true,"patched_in":"3.5.5.8"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:21:13Z"},{"id":"wordfence:09a58aa8-d93d-4328-b6db-916e314b07c3","source":"wordfence","cve":"CVE-2026-28061","title":"Tiger Claw <= 1.1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a58aa8-d93d-4328-b6db-916e314b07c3?source=api-prod","affected":[{"type":"theme","slug":"tiger-claw","name":"Tiger Claw","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:27:17Z"},{"id":"wordfence:09a5f79c-d961-4903-8449-d2261c878388","source":"wordfence","cve":"CVE-2025-26584","title":"TBTestimonials <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a5f79c-d961-4903-8449-d2261c878388?source=api-prod","affected":[{"type":"plugin","slug":"tb-testimonials","name":"TBTestimonials","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-17T18:01:09Z"},{"id":"wordfence:09a7b90a-9a6a-41c3-a15a-9a8d9731102f","source":"wordfence","cve":"CVE-2025-24616","title":"Uix Page Builder <= 1.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a7b90a-9a6a-41c3-a15a-9a8d9731102f?source=api-prod","affected":[{"type":"plugin","slug":"uix-page-builder","name":"Uix Page Builder","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-01-20T00:00:00Z","updated":"2025-02-21T14:41:35Z"},{"id":"wordfence:09a8868e-c81c-464a-9ebf-18e77ae8173f","source":"wordfence","cve":"CVE-2025-24551","title":"Radio Buttons and Swatches for WooCommerce <= 1.1.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09a8868e-c81c-464a-9ebf-18e77ae8173f?source=api-prod","affected":[{"type":"plugin","slug":"variations-radio-buttons-for-woocommerce","name":"Radio Buttons and Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"}],"published":"2024-11-15T00:00:00Z","updated":"2025-02-19T16:55:16Z"},{"id":"wordfence:09aa2a44-8665-4f70-97a5-2e869c4610a4","source":"wordfence","cve":"CVE-2022-3923","title":"ActiveCampaign for WooCommerce <= 1.9.6 - Missing Authorization to Error Log Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09aa2a44-8665-4f70-97a5-2e869c4610a4?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-for-woocommerce","name":"ActiveCampaign for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09ab30ba-61a3-456d-b657-bf4fb679f48b","source":"wordfence","cve":"CVE-2026-85131","title":"WPLP Cookie Consent <= 4.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ab30ba-61a3-456d-b657-bf4fb679f48b?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:24:48Z"},{"id":"wordfence:09ac7546-0572-4446-99f7-fe84f76fac9b","source":"wordfence","cve":"CVE-2024-43972","title":"PageLayer <= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ac7546-0572-4446-99f7-fe84f76fac9b?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2024-08-28T00:00:00Z","updated":"2024-10-15T19:15:22Z"},{"id":"wordfence:09ac79b4-f072-4f15-9f4d-89d0bcdf8fa3","source":"wordfence","cve":"CVE-2025-32247","title":"AI Content Creator <= 1.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ac79b4-f072-4f15-9f4d-89d0bcdf8fa3?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-creator","name":"AI Content Creator \u2013 Easy ChatGPT powered article generator","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-26T18:15:13Z"},{"id":"wordfence:09ac96f8-e138-48fe-bd95-5356fc222004","source":"wordfence","cve":"CVE-2021-24579","title":"Bold Page Builder <= 3.1.5 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ac96f8-e138-48fe-bd95-5356fc222004?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09acf85a-37eb-40c0-9343-35b4e1c04a11","source":"wordfence","cve":"CVE-2026-107864","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09acf85a-37eb-40c0-9343-35b4e1c04a11?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-12T09:05:00Z","updated":"2026-10-13T14:02:09Z"},{"id":"wordfence:09adad1b-3678-487a-9e37-579fec938c14","source":"wordfence","cve":"CVE-2026-14567","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09adad1b-3678-487a-9e37-579fec938c14?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":false,"patched_in":"4.3.10"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:57:07Z"},{"id":"wordfence:09adfe7e-f154-4143-827f-957ded3ffc8f","source":"wordfence","cve":"CVE-2025-1093","title":"AIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09adfe7e-f154-4143-827f-957ded3ffc8f?source=api-prod","affected":[{"type":"theme","slug":"aihub","name":"AI Hub - Startup & Technology WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-04-18T14:37:49Z","updated":"2025-04-19T03:21:23Z"},{"id":"wordfence:09afbbd2-52c6-48a6-a2f0-b1509d864e7e","source":"wordfence","cve":"CVE-2024-11973","title":"Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09afbbd2-52c6-48a6-a2f0-b1509d864e7e?source=api-prod","affected":[{"type":"plugin","slug":"quran-text-multilanguage","name":"Quran multilanguage Text & Audio","from":"*","from_inclusive":true,"to":"2.3.21","to_inclusive":true,"patched_in":"2.3.22"}],"published":"2024-12-09T21:09:02Z","updated":"2024-12-10T09:24:26Z"},{"id":"wordfence:09b0bfd3-93a7-4f13-828d-772f54085a60","source":"wordfence","cve":"CVE-2023-47767","title":"Interactive World Map <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09b0bfd3-93a7-4f13-828d-772f54085a60?source=api-prod","affected":[{"type":"plugin","slug":"interactive-world-map","name":"Interactive World Map","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-03-14T12:51:08Z"},{"id":"wordfence:09b26b78-b587-42f6-a9e3-c2945e91d29e","source":"wordfence","cve":"CVE-2024-32808","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09b26b78-b587-42f6-a9e3-c2945e91d29e?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T17:07:15Z"},{"id":"wordfence:09b2d763-63ce-4cc7-aa04-589bb8697ce9","source":"wordfence","cve":"CVE-2024-12618","title":"Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09b2d763-63ce-4cc7-aa04-589bb8697ce9?source=api-prod","affected":[{"type":"plugin","slug":"newsletter2go","name":"Newsletter2Go","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-09T11:10:53Z"},{"id":"wordfence:09b315e6-d973-467d-8b8d-4b7b4a7ca3f8","source":"wordfence","cve":"CVE-2024-3217","title":"WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09b315e6-d973-467d-8b8d-4b7b4a7ca3f8?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-05T07:34:35Z"},{"id":"wordfence:09b68ffe-f8b2-4cde-b36e-b14da58d0bca","source":"wordfence","cve":"CVE-2026-73189","title":"WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09b68ffe-f8b2-4cde-b36e-b14da58d0bca?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T17:21:55Z"},{"id":"wordfence:09bc815e-cf79-4d94-a934-366c251be551","source":"wordfence","cve":"CVE-2024-32818","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09bc815e-cf79-4d94-a934-366c251be551?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.3.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:48:10Z"},{"id":"wordfence:09bdfade-85d0-4922-a83a-3e213adfa4ed","source":"wordfence","cve":"CVE-2023-37971","title":"WooCommerce Product Stock Alert <= 2.0.1 - Missing Authorization via API","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09bdfade-85d0-4922-a83a-3e213adfa4ed?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-stock-alert","name":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09bef3c5-991d-4eb1-b613-0b7d45ab5329","source":"wordfence","cve":"CVE-2024-3630","title":"HL Twitter <= 2014.1.18 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09bef3c5-991d-4eb1-b613-0b7d45ab5329?source=api-prod","affected":[{"type":"plugin","slug":"hl-twitter","name":"HL Twitter","from":"*","from_inclusive":true,"to":"2014.1.18","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:02:15Z"},{"id":"wordfence:09bfe9c2-fea2-4876-8f7c-0bd14060e4ad","source":"wordfence","cve":"CVE-2025-57971","title":"SALESmanago <= 3.8.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09bfe9c2-fea2-4876-8f7c-0bd14060e4ad?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T22:22:37Z"},{"id":"wordfence:09c04863-a454-4f05-9403-aff39dbccd43","source":"wordfence","cve":"CVE-2024-12047","title":"WP Compress \u2013 Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c04863-a454-4f05-9403-aff39dbccd43?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.30.03","to_inclusive":true,"patched_in":"6.30.04"}],"published":"2025-01-03T18:49:21Z","updated":"2025-01-04T07:24:23Z"},{"id":"wordfence:09c26c7a-49f2-4d3e-9443-05dfb96f9eb2","source":"wordfence","cve":"CVE-2026-22428","title":"Tooth Fairy - Dentist & Dental Clinic WordPress Theme <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c26c7a-49f2-4d3e-9443-05dfb96f9eb2?source=api-prod","affected":[{"type":"theme","slug":"tooth-fairy","name":"Tooth Fairy - Dentist & Dental Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:38:00Z"},{"id":"wordfence:09c4412f-69ea-4214-ae07-6b6b8ff1c101","source":"wordfence","cve":"CVE-2024-52472","title":"Weather Atlas Widget <= 3.0.3 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c4412f-69ea-4214-ae07-6b6b8ff1c101?source=api-prod","affected":[{"type":"plugin","slug":"weather-atlas","name":"Weather Atlas Widget","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.04"}],"published":"2024-11-18T00:00:00Z","updated":"2025-07-08T15:13:55Z"},{"id":"wordfence:09c59fb5-8264-4277-a821-dbfee0900f64","source":"wordfence","cve":"CVE-2013-5962","title":"Complete Gallery Manager <= 3.3.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c59fb5-8264-4277-a821-dbfee0900f64?source=api-prod","affected":[{"type":"plugin","slug":"complete-gallery-manager","name":"Complete Gallery Manager for WordPress | Galleries","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":false,"patched_in":"3.3.4"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09c60d0a-bc1f-407f-aa0e-2ae0b7db5ae3","source":"wordfence","cve":"CVE-2023-38381","title":"WP-FlyBox <= 6.46 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c60d0a-bc1f-407f-aa0e-2ae0b7db5ae3?source=api-prod","affected":[{"type":"plugin","slug":"wp-flybox","name":"WP-FlyBox","from":"*","from_inclusive":true,"to":"6.46","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09c63c2f-d2d3-4c39-8329-0e0e5b62db98","source":"wordfence","cve":"CVE-2026-92548","title":"WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c63c2f-d2d3-4c39-8329-0e0e5b62db98?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2026-09-30T15:39:19Z","updated":"2026-10-01T04:27:34Z"},{"id":"wordfence:09c67364-a1cb-45cd-8573-1fd1b2325824","source":"wordfence","cve":"CVE-2026-66704","title":"Gutenverse Companion <= 2.5.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c67364-a1cb-45cd-8573-1fd1b2325824?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-companion","name":"Gutenverse Companion","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:50:27Z"},{"id":"wordfence:09c8db69-60fa-4087-9096-5d34ce44f616","source":"wordfence","cve":"CVE-2026-12732","title":"LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09c8db69-60fa-4087-9096-5d34ce44f616?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2026-06-30T19:00:11Z","updated":"2026-07-01T07:53:36Z"},{"id":"wordfence:09cbead3-1ab1-4b6b-a366-3160abb903a6","source":"wordfence","cve":"CVE-2025-62977","title":"\u767e\u5ea6\u7ad9\u957fSEO\u5408\u96c6(\u652f\u6301\u767e\u5ea6/\u795e\u9a6c/Bing/\u5934\u6761\u63a8\u9001) <= 2.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09cbead3-1ab1-4b6b-a366-3160abb903a6?source=api-prod","affected":[{"type":"plugin","slug":"baiduseo","name":"SEO\u5408\u96c6(\u652f\u6301\u767e\u5ea6/Google/Bing/GEO\u4f18\u5316)","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-10-19T00:00:00Z","updated":"2025-11-07T16:54:20Z"},{"id":"wordfence:09cff621-3cf3-496e-ab91-66d088fe79dc","source":"wordfence","cve":"CVE-2022-4484","title":"Super Socializer <= 7.13.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09cff621-3cf3-496e-ab91-66d088fe79dc?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.44","to_inclusive":true,"patched_in":"7.13.45"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09d1ba79-ce29-43e9-83b7-0f9d7e644f20","source":"wordfence","cve":"CVE-2025-60049","title":"Soleil <= 1.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09d1ba79-ce29-43e9-83b7-0f9d7e644f20?source=api-prod","affected":[{"type":"theme","slug":"soleil","name":"Soleil - Solar Panels WordPress Theme","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:38:38Z"},{"id":"wordfence:09d9785a-db71-4735-b86b-7fa10cf36a0b","source":"wordfence","cve":"CVE-2025-4212","title":"Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09d9785a-db71-4735-b86b-7fa10cf36a0b?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-11-17T20:47:11Z","updated":"2025-11-18T09:27:35Z"},{"id":"wordfence:09dac668-fe4d-4119-a055-1a358fc4aacf","source":"wordfence","cve":"CVE-2023-22697","title":"Survey Maker <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09dac668-fe4d-4119-a055-1a358fc4aacf?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-01-27T00:00:00Z","updated":"2025-01-17T13:09:50Z"},{"id":"wordfence:09e158d2-f9a6-41a6-a91f-1763a1a44b04","source":"wordfence","cve":"CVE-2026-4604","title":"Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e158d2-f9a6-41a6-a91f-1763a1a44b04?source=api-prod","affected":[{"type":"plugin","slug":"klubraum-membership-request","name":"Klubraum Membership Request","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-07-28T21:17:00Z","updated":"2026-07-29T09:31:13Z"},{"id":"wordfence:09e20941-ee86-46a0-8b79-e7cd703c61af","source":"wordfence","cve":"CVE-2025-46261","title":"Seriously Simple Podcasting <= 3.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e20941-ee86-46a0-8b79-e7cd703c61af?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:17:16Z"},{"id":"wordfence:09e28b72-55c6-4f2f-b689-a8989945651b","source":"wordfence","cve":"CVE-2023-34171","title":"WP Report Post <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e28b72-55c6-4f2f-b689-a8989945651b?source=api-prod","affected":[{"type":"plugin","slug":"wp-report-post","name":"WP Report Post","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09e2d2d2-c79e-467d-a1a0-602d0d2d2709","source":"wordfence","cve":"CVE-2026-61960","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions <= 8.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e2d2d2-c79e-467d-a1a0-602d0d2d2709?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.0","to_inclusive":true,"patched_in":"8.5.1"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:11:44Z"},{"id":"wordfence:09e5391d-2671-4bb4-9adc-29b5fdb59240","source":"wordfence","cve":"CVE-2026-24364","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5391d-2671-4bb4-9adc-29b5fdb59240?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:58:35Z"},{"id":"wordfence:09e5aa34-ab28-4349-ac5f-6a0479e641e5","source":"wordfence","cve":"CVE-2024-1843","title":"Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5aa34-ab28-4349-ac5f-6a0479e641e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.3.1"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:26:33Z"},{"id":"wordfence:09e8e3a1-bec3-4362-8c3f-16b5a03eeed4","source":"wordfence","cve":"CVE-2026-105413","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.51 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09e8e3a1-bec3-4362-8c3f-16b5a03eeed4?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.51","to_inclusive":false,"patched_in":"1.15.51"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:32:56Z"},{"id":"wordfence:09ec4633-7639-4d46-8070-9fc6909bc610","source":"wordfence","cve":"CVE-2023-27440","title":"Types <= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ec4633-7639-4d46-8070-9fc6909bc610?source=api-prod","affected":[{"type":"plugin","slug":"types","name":"Toolset Types \u2013 Custom Post Types, Custom Fields and Taxonomies","from":"*","from_inclusive":true,"to":"3.4.17","to_inclusive":true,"patched_in":"3.4.18"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09ed1806-31b9-4851-99b1-a30eef4979a1","source":"wordfence","cve":"CVE-2022-2241","title":"Featured Image from URL (FIFU) <= 3.9.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ed1806-31b9-4851-99b1-a30eef4979a1?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09ee0155-7424-42ff-bfd6-244912857009","source":"wordfence","cve":"CVE-2014-9688","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ee0155-7424-42ff-bfd6-244912857009?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":false,"patched_in":"2.8.10"}],"published":"2014-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09ee6179-8071-4628-9d2b-dfbb32ef1804","source":"wordfence","cve":"CVE-2015-9384","title":"Relevant \u2013 Related, Featured, Latest, and Popular Posts by BestWebSoft <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ee6179-8071-4628-9d2b-dfbb32ef1804?source=api-prod","affected":[{"type":"plugin","slug":"relevant","name":"Relevant \u2013 Related, Featured, Latest, and Popular Posts by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2015-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09f01dcc-685b-485b-8572-cdf73d0157dc","source":"wordfence","cve":"CVE-2025-12015","title":"Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f01dcc-685b-485b-8572-cdf73d0157dc?source=api-prod","affected":[{"type":"plugin","slug":"quicq","name":"Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-12T20:23:46Z","updated":"2025-11-13T08:27:47Z"},{"id":"wordfence:09f136e9-0888-456c-8bb6-e0300b601f05","source":"wordfence","cve":"CVE-2024-53799","title":"FloristPress <= 7.3.0 - Missing Authorization to Sensitive Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f136e9-0888-456c-8bb6-e0300b601f05?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:51:31Z"},{"id":"wordfence:09f2cb22-07e2-4fe5-8c2a-9d4420ee26ed","source":"wordfence","cve":"CVE-2024-1507","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f2cb22-07e2-4fe5-8c2a-9d4420ee26ed?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.3","to_inclusive":true,"patched_in":"3.13.4"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-14T18:25:53Z"},{"id":"wordfence:09f328f6-8a66-46bf-80d9-3ffeaecfec32","source":"wordfence","cve":"CVE-2023-47821","title":"Email Encoder Bundle <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f328f6-8a66-46bf-80d9-3ffeaecfec32?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09f450bb-28c1-4c1e-ae13-afd53759e02f","source":"wordfence","cve":"CVE-2024-33679","title":"FameTheme Demo Importer <= 1.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f450bb-28c1-4c1e-ae13-afd53759e02f?source=api-prod","affected":[{"type":"plugin","slug":"famethemes-demo-importer","name":"FameTheme Demo Importer","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-26T00:00:00Z","updated":"2024-06-05T19:35:07Z"},{"id":"wordfence:09f590ad-c99a-4577-a709-98c88d3acc87","source":"wordfence","cve":"CVE-2023-37981","title":"Authors List <= 2.0.2 - Reflected Cross-Site Scripting via al_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09f590ad-c99a-4577-a709-98c88d3acc87?source=api-prod","affected":[{"type":"plugin","slug":"authors-list","name":"Authors List","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09fb88e4-4846-40d3-8a79-a6a867bfb59f","source":"wordfence","cve":"CVE-2024-8910","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id","severity":"medium","cvss":4.3,"cwe":"CWE-1230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09fb88e4-4846-40d3-8a79-a6a867bfb59f?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T06:49:00Z"},{"id":"wordfence:09fc03e4-0e83-4817-ab29-f45937c21f8e","source":"wordfence","cve":"CVE-2025-31786","title":"Simple Icons <= 2.8.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09fc03e4-0e83-4817-ab29-f45937c21f8e?source=api-prod","affected":[{"type":"plugin","slug":"simple-icons","name":"Popular Brand Icons \u2013 Simple Icons","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:19:44Z"},{"id":"wordfence:09fc8d80-8231-4183-9626-c90f4fee5eb4","source":"wordfence","cve":"CVE-2019-1000031","title":"article2pdf <= 0.27 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09fc8d80-8231-4183-9626-c90f4fee5eb4?source=api-prod","affected":[{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.24","from_inclusive":true,"to":"0.24","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.25","from_inclusive":true,"to":"0.25","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.26","from_inclusive":true,"to":"0.26","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.27","from_inclusive":true,"to":"0.27","to_inclusive":true,"patched_in":""}],"published":"2019-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:09fd13db-3dbb-4684-8bd8-2bb3eb91cf6a","source":"wordfence","cve":"CVE-2025-49908","title":"WPC Countdown Timer for WooCommerce <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09fd13db-3dbb-4684-8bd8-2bb3eb91cf6a?source=api-prod","affected":[{"type":"plugin","slug":"wpc-countdown-timer","name":"WPC Countdown Timer for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-10-20T00:00:00Z","updated":"2025-10-29T15:48:33Z"},{"id":"wordfence:09ffb955-61cb-461d-8868-06bed94b262e","source":"wordfence","cve":"CVE-2026-73393","title":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/09ffb955-61cb-461d-8868-06bed94b262e?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.47","to_inclusive":true,"patched_in":"10.48"}],"published":"2026-08-17T12:59:34Z","updated":"2026-09-24T19:35:07Z"},{"id":"wordfence:0a00efc3-59a8-4601-a869-7455edabdeed","source":"wordfence","cve":"CVE-2024-1747","title":"WooCommerce Customers Manager <= 30.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a00efc3-59a8-4601-a869-7455edabdeed?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"30.1","to_inclusive":true,"patched_in":"30.2"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-09T15:38:18Z"},{"id":"wordfence:0a00f8a3-81ac-4464-a7d4-2cfffe942c38","source":"wordfence","cve":"CVE-2026-115250","title":"Text Typing \u2013 grab attention with animated typing headlines < 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a00f8a3-81ac-4464-a7d4-2cfffe942c38?source=api-prod","affected":[{"type":"plugin","slug":"text-typing","name":"Text Typing \u2013 grab attention with animated typing headlines","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:35:17Z"},{"id":"wordfence:0a01e1c9-67f4-4cc1-b58b-9cc141889d66","source":"wordfence","cve":"CVE-2025-13641","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a01e1c9-67f4-4cc1-b58b-9cc141889d66?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.12","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-12-17T00:00:00Z","updated":"2025-12-18T18:51:30Z"},{"id":"wordfence:0a023692-18f6-4863-8802-d613f6ddf083","source":"wordfence","cve":"CVE-2026-87070","title":"Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a023692-18f6-4863-8802-d613f6ddf083?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:13:28Z"},{"id":"wordfence:0a0314ab-4658-48c4-9a90-48a19cbceeaa","source":"wordfence","cve":"CVE-2025-23542","title":"RDP Linkedin Login <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a0314ab-4658-48c4-9a90-48a19cbceeaa?source=api-prod","affected":[{"type":"plugin","slug":"rdp-linkedin-login","name":"RDP Linkedin Login","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:04:00Z"},{"id":"wordfence:0a03184e-ab6f-4a71-9f1e-2bbe9a8b299e","source":"wordfence","cve":"CVE-2026-27392","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a03184e-ab6f-4a71-9f1e-2bbe9a8b299e?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:49:14Z"},{"id":"wordfence:0a0ced4d-368d-4f12-9099-1f8c0b0fe245","source":"wordfence","cve":"CVE-2023-4298","title":"123.chat <= 1.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a0ced4d-368d-4f12-9099-1f8c0b0fe245?source=api-prod","affected":[{"type":"plugin","slug":"123-chat-videochat","name":"123.chat \u2013 1:1 Live Video Chat Tool Plugin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a0ee752-7fc4-46d3-9e0f-8b9317b0ea72","source":"wordfence","cve":"CVE-2025-13903","title":"PullQuote <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a0ee752-7fc4-46d3-9e0f-8b9317b0ea72?source=api-prod","affected":[{"type":"plugin","slug":"pullquote","name":"PullQuote","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:54:08Z","updated":"2026-01-09T11:15:30Z"},{"id":"wordfence:0a10570c-542a-494c-9dea-96a58b91139e","source":"wordfence","cve":"CVE-2026-88996","title":"WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a10570c-542a-494c-9dea-96a58b91139e?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.2.1"}],"published":"2026-09-24T19:08:46Z","updated":"2026-09-25T07:40:24Z"},{"id":"wordfence:0a13e87d-51cd-43b0-a658-900a174738fc","source":"wordfence","cve":"CVE-2024-5993","title":"Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a13e87d-51cd-43b0-a658-900a174738fc?source=api-prod","affected":[{"type":"plugin","slug":"cliengo","name":"Cliengo \u2013 Chatbot","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-01T20:18:06Z"},{"id":"wordfence:0a158653-f80c-48a3-840e-20ee7e85925a","source":"wordfence","cve":"CVE-2023-3245","title":"Floating Chat Widget - Chaty <= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a158653-f80c-48a3-840e-20ee7e85925a?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a16651c-613b-462b-9d73-10a74892ecdc","source":"wordfence","cve":"CVE-2008-1930","title":"WordPress Core < 2.5.1 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a16651c-613b-462b-9d73-10a74892ecdc?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2008-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a1824ff-7dc3-4b21-aaa2-0079c5c0b5b8","source":"wordfence","cve":"CVE-2025-53574","title":"Doliconnect <= 9.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1824ff-7dc3-4b21-aaa2-0079c5c0b5b8?source=api-prod","affected":[{"type":"plugin","slug":"doliconnect","name":"Doliconnect","from":"*","from_inclusive":true,"to":"9.3.2","to_inclusive":true,"patched_in":"9.4.2"}],"published":"2025-08-23T00:00:00Z","updated":"2025-11-11T18:24:52Z"},{"id":"wordfence:0a1ba486-095a-482a-adbe-e51b140b2db7","source":"wordfence","cve":"CVE-2026-110033","title":"Salon Booking System <= 10.31.10 - Authenticated (Salon Staff+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1ba486-095a-482a-adbe-e51b140b2db7?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.10","to_inclusive":true,"patched_in":"10.31.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:31:13Z"},{"id":"wordfence:0a1cf60b-47bd-4e67-8fe4-6cf46809f2b2","source":"wordfence","cve":"CVE-2024-10316","title":"Stratum \u2013 Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1cf60b-47bd-4e67-8fe4-6cf46809f2b2?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T11:02:19Z"},{"id":"wordfence:0a1e0d55-2894-450b-afaf-134a13512403","source":"wordfence","cve":"CVE-2023-3510","title":"FTP Access <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1e0d55-2894-450b-afaf-134a13512403?source=api-prod","affected":[{"type":"plugin","slug":"ftp-access","name":"FTP Access","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-22T00:00:00Z","updated":"2024-10-24T18:33:19Z"},{"id":"wordfence:0a1fa859-e06c-4ce2-9325-e0be01882a88","source":"wordfence","cve":"CVE-2025-62897","title":"WP Recipe Maker < 10.1.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a1fa859-e06c-4ce2-9325-e0be01882a88?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.1.0","to_inclusive":false,"patched_in":"10.1.0"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-29T16:46:28Z"},{"id":"wordfence:0a23e40d-9b9e-42ee-9319-c088e1024313","source":"wordfence","cve":"CVE-2024-43302","title":"Fonts <= 3.7.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a23e40d-9b9e-42ee-9319-c088e1024313?source=api-prod","affected":[{"type":"plugin","slug":"olympus-google-fonts","name":"Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:12:13Z"},{"id":"wordfence:0a24a4a6-f297-4049-83f6-3a39fedee16a","source":"wordfence","cve":"CVE-2024-51574","title":"Simple Goods <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a24a4a6-f297-4049-83f6-3a39fedee16a?source=api-prod","affected":[{"type":"plugin","slug":"simple-goods","name":"Simple Goods","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:15:39Z"},{"id":"wordfence:0a261178-291f-4259-9c4d-1e7687b7fd79","source":"wordfence","cve":"CVE-2026-119497","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a261178-291f-4259-9c4d-1e7687b7fd79?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10.6","to_inclusive":true,"patched_in":"8.10.7"}],"published":"2026-11-07T09:44:34Z","updated":"2026-11-10T19:29:06Z"},{"id":"wordfence:0a2740bc-5d4a-4449-b28a-5bf84b03c878","source":"wordfence","cve":"CVE-2022-1221","title":"Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2740bc-5d4a-4449-b28a-5bf84b03c878?source=api-prod","affected":[{"type":"plugin","slug":"gwyns-imagemap-selector","name":"Gwyn's Imagemap Selector","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a281774-226a-4cb7-ba4a-ebb76f20eb47","source":"wordfence","cve":"CVE-2024-8282","title":"Ibtana \u2013 WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a281774-226a-4cb7-ba4a-ebb76f20eb47?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.4.4","to_inclusive":true,"patched_in":"1.2.4.5"}],"published":"2024-10-01T21:17:15Z","updated":"2024-10-02T09:31:59Z"},{"id":"wordfence:0a28a161-3dbc-4ef0-a2ce-4c102cf3cbb0","source":"wordfence","cve":"CVE-2024-0593","title":"Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a28a161-3dbc-4ef0-a2ce-4c102cf3cbb0?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.10.8","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-29T21:35:50Z"},{"id":"wordfence:0a2a29ea-3ff3-4b80-8a40-1a00491076ff","source":"wordfence","cve":"CVE-2023-25068","title":"Magazine Edge <= 1.13 - Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2a29ea-3ff3-4b80-8a40-1a00491076ff?source=api-prod","affected":[{"type":"theme","slug":"magazine-edge","name":"Magazine Edge","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a2c56e5-23c7-47da-9f30-b41cef5297b8","source":"wordfence","cve":"CVE-2025-49075","title":"Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2c56e5-23c7-47da-9f30-b41cef5297b8?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":"1.0.44"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:45:34Z"},{"id":"wordfence:0a2e1c32-cf0e-4733-babd-d8b9cfe68535","source":"wordfence","cve":"CVE-2025-59588","title":"Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2e1c32-cf0e-4733-babd-d8b9cfe68535?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.8","to_inclusive":true,"patched_in":"8.6.9"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:55:54Z"},{"id":"wordfence:0a2e647e-fb3b-4d5f-abb4-87923269c399","source":"wordfence","cve":"CVE-2026-54824","title":"Quads Ads Manager for Google AdSense <= 3.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2e647e-fb3b-4d5f-abb4-87923269c399?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T13:53:08Z"},{"id":"wordfence:0a2f60a9-c061-4ef9-a582-c82eb1311e5a","source":"wordfence","cve":"CVE-2020-16140","title":"GreenMart \u2013 Organic & Food WooCommerce WordPress Theme < 2.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2f60a9-c061-4ef9-a582-c82eb1311e5a?source=api-prod","affected":[{"type":"theme","slug":"greenmart","name":"GreenMart \u2013 Organic & Food WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":false,"patched_in":"2.4.3"}],"published":"2020-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a2fd29f-c603-40f2-85e1-6c6885f40f56","source":"wordfence","cve":"CVE-2026-111961","title":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a2fd29f-c603-40f2-85e1-6c6885f40f56?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":false,"patched_in":"1.5.10"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:58Z"},{"id":"wordfence:0a308fde-1c44-4c34-ace5-6820dc949f53","source":"wordfence","cve":"CVE-2024-1692","title":"BoldGrid Easy SEO \u2013 Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a308fde-1c44-4c34-ace5-6820dc949f53?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-easy-seo","name":"BoldGrid Easy SEO \u2013 Simple and Effective SEO","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":true,"patched_in":"1.6.14"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T04:31:10Z"},{"id":"wordfence:0a309bf8-7fe3-4033-993c-3c8dba0f216d","source":"wordfence","cve":"CVE-2026-7634","title":"SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a309bf8-7fe3-4033-993c-3c8dba0f216d?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"5.4.12"}],"published":"2026-05-27T18:28:54Z","updated":"2026-05-28T06:45:38Z"},{"id":"wordfence:0a30d35c-9883-4b0f-83a2-494401c45d8e","source":"wordfence","cve":"CVE-2024-6520","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a30d35c-9883-4b0f-83a2-494401c45d8e?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2024-07-26T23:27:30Z","updated":"2024-07-29T14:18:16Z"},{"id":"wordfence:0a317e17-e2e9-4c33-90c6-85e38be35883","source":"wordfence","cve":"CVE-2026-115949","title":"Better Post & Filter Widgets for Elementor <= 1.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a317e17-e2e9-4c33-90c6-85e38be35883?source=api-prod","affected":[{"type":"plugin","slug":"better-post-filter-widgets-for-elementor","name":"Better Post & Filter Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-10-26T10:07:00Z","updated":"2026-10-28T01:24:23Z"},{"id":"wordfence:0a32b02f-db40-42fe-b46c-4a5f2bc9ba09","source":"wordfence","cve":"CVE-2026-32475","title":"Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a32b02f-db40-42fe-b46c-4a5f2bc9ba09?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-08-19T19:18:53Z","updated":"2026-08-19T19:18:54Z"},{"id":"wordfence:0a33282c-2adb-4f26-8fc4-918a48bfd040","source":"wordfence","cve":"","title":"WordPress prettyPhoto <= 1.1 - DOM Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a33282c-2adb-4f26-8fc4-918a48bfd040?source=api-prod","affected":[{"type":"plugin","slug":"prettyphoto","name":"PrettyPhoto \u2013 Simple Lightbox Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2015-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a37f3bf-5eaf-449d-a1d0-c86ae1a61078","source":"wordfence","cve":"CVE-2026-1800","title":"Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=api-prod","affected":[{"type":"plugin","slug":"fonts-manager-custom-fonts","name":"Fonts Manager | Custom Fonts","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:41Z","updated":"2026-03-21T03:26:31Z"},{"id":"wordfence:0a397025-ada7-4a59-80b9-5a778ea27776","source":"wordfence","cve":"CVE-2024-5479","title":"Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a397025-ada7-4a59-80b9-5a778ea27776?source=api-prod","affected":[{"type":"plugin","slug":"easy-pixels-by-jevnet","name":"Easy Pixels","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T19:40:05Z","updated":"2024-07-09T08:33:02Z"},{"id":"wordfence:0a3ae696-f67d-4ed2-b307-d2f36b6f188c","source":"wordfence","cve":"CVE-2023-6972","title":"Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a3ae696-f67d-4ed2-b307-d2f36b6f188c?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-12-22T00:00:00Z","updated":"2024-07-29T21:35:50Z"},{"id":"wordfence:0a3cfa87-ad48-401c-b823-f61d5a7af680","source":"wordfence","cve":"CVE-2015-9342","title":"WP Rollback < 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a3cfa87-ad48-401c-b823-f61d5a7af680?source=api-prod","affected":[{"type":"plugin","slug":"wp-rollback","name":"WP Rollback \u2013 Rollback Plugins and Themes","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2015-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a403d54-4075-449c-8c2d-39d2829babaa","source":"wordfence","cve":"CVE-2026-57770","title":"Grand Photography WordPress <= 5.7.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a403d54-4075-449c-8c2d-39d2829babaa?source=api-prod","affected":[{"type":"theme","slug":"grandphotography","name":"Grand Photography WordPress","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:20:05Z"},{"id":"wordfence:0a41d0b9-da73-4d7a-b46e-ee74f4d0897d","source":"wordfence","cve":"CVE-2025-22298","title":"Hive Support \u2013 WordPress Help Desk <= 1.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a41d0b9-da73-4d7a-b46e-ee74f4d0897d?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:19:13Z"},{"id":"wordfence:0a421399-0b93-4eb8-a76f-ec0079ae2582","source":"wordfence","cve":"CVE-2026-81796","title":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a421399-0b93-4eb8-a76f-ec0079ae2582?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"12.0.3","to_inclusive":true,"patched_in":"12.0.4"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-23T14:30:45Z"},{"id":"wordfence:0a42449f-aef1-42b8-af58-4f4aab7008f3","source":"wordfence","cve":"CVE-2022-0218","title":"WP HTML Mail <= 3.0.9 - Missing Authorization on Rest Route","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a42449f-aef1-42b8-af58-4f4aab7008f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-mail","name":"Email Template Designer \u2013 WP HTML Mail","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a434d66-ac97-4801-8985-047dcc7c3eb4","source":"wordfence","cve":"CVE-2024-32108","title":"Convert Post Types  <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a434d66-ac97-4801-8985-047dcc7c3eb4?source=api-prod","affected":[{"type":"plugin","slug":"convert-post-types","name":"Convert Post Types","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:20:59Z"},{"id":"wordfence:0a439cd6-c9d1-42d0-9067-4b425f2869a9","source":"wordfence","cve":"","title":"Portfolio Gallery <= 1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a439cd6-c9d1-42d0-9067-4b425f2869a9?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-gallery","name":"Portfolio Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a43cc7c-1918-4a5a-a878-52e5d02b784b","source":"wordfence","cve":"CVE-2026-39633","title":"Grand Car Rental <= 3.6.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a43cc7c-1918-4a5a-a878-52e5d02b784b?source=api-prod","affected":[{"type":"theme","slug":"grandcarrental","name":"Grand Car Rental | Limousine HTML Template","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-05T15:34:44Z"},{"id":"wordfence:0a44013c-00c6-4d47-867c-a42091c96efd","source":"wordfence","cve":"CVE-2025-22802","title":"Email Templates Customizer for WordPress \u2013 Drag And Drop Email Templates Builder \u2013 YeeMail <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a44013c-00c6-4d47-867c-a42091c96efd?source=api-prod","affected":[{"type":"plugin","slug":"yeemail","name":"YeeMail \u2014 Email Template Builder & Customizer","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:08:34Z"},{"id":"wordfence:0a4435e4-f057-4582-bc2d-2ab4c19ccaf4","source":"wordfence","cve":"CVE-2025-30888","title":"Custom Fields Account Registration For Woocommerce <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a4435e4-f057-4582-bc2d-2ab4c19ccaf4?source=api-prod","affected":[{"type":"plugin","slug":"custom-fields-account-registration-for-woocommerce","name":"Custom Fields Account Registration For Woocommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:41:14Z"},{"id":"wordfence:0a4521af-692a-4a84-ba9b-1904a42786c1","source":"wordfence","cve":"CVE-2026-2375","title":"App Builder \u2013 Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a4521af-692a-4a84-ba9b-1904a42786c1?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:29Z","updated":"2026-09-09T16:35:07Z"},{"id":"wordfence:0a45d62f-bd41-4a69-be61-c4d6a7ec555c","source":"wordfence","cve":"","title":"FlagEm (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a45d62f-bd41-4a69-be61-c4d6a7ec555c?source=api-prod","affected":[{"type":"plugin","slug":"FlagEm","name":"FlagEm","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a46420e-8ca5-43ac-8475-786e24185f55","source":"wordfence","cve":"CVE-2017-6102","title":"Rockhoist Badges <= 1.2.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a46420e-8ca5-43ac-8475-786e24185f55?source=api-prod","affected":[{"type":"plugin","slug":"rockhoist-badges","name":"wordpress plugin rockhoist-badges","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2017-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a49a22e-d54e-461d-83c2-8278494eac13","source":"wordfence","cve":"CVE-2024-1804","title":"Tutor LMS \u2013 Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49a22e-d54e-461d-83c2-8278494eac13?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-migration-tool","name":"Tutor LMS \u2013 Migration Tool","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-07-26T00:00:00Z","updated":"2025-07-24T17:38:45Z"},{"id":"wordfence:0a49c8df-0524-41af-b095-b5953e6f68d8","source":"wordfence","cve":"","title":"iThemes Security <= 5.6.1 - Sensitive Information Exposure via Diff Response","severity":"medium","cvss":5.3,"cwe":"CWE-204","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49c8df-0524-41af-b095-b5953e6f68d8?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2016-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a49d74a-01a6-4bd9-bc93-0006f9fe9503","source":"wordfence","cve":"","title":"BuddyForms Hook Fields <= 1.3.8 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49d74a-01a6-4bd9-bc93-0006f9fe9503?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms-hook-fields","name":"Display Data on your site! Create Dynamic Content Templates from any form of data. Works with ACF, Pods, BuddyPress/ BuddyBoss","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a4aad30-ff74-43ef-9739-225602624255","source":"wordfence","cve":"CVE-2025-49260","title":"Aora <= 1.3.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a4aad30-ff74-43ef-9739-225602624255?source=api-prod","affected":[{"type":"theme","slug":"aora","name":"Aora - Home & Lifestyle Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T13:44:20Z"},{"id":"wordfence:0a4c33bd-1394-4015-812b-dfcee5cf829a","source":"wordfence","cve":"CVE-2025-25105","title":"Pop Up <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a4c33bd-1394-4015-812b-dfcee5cf829a?source=api-prod","affected":[{"type":"plugin","slug":"popup-seo-optimized","name":"Pop Up","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:26:14Z"},{"id":"wordfence:0a540897-694a-43d1-bdd8-5aeb07389a51","source":"wordfence","cve":"CVE-2014-5180","title":"HDW Player Plugin (Video Player & Video Gallery) <= 2.4.2 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a540897-694a-43d1-bdd8-5aeb07389a51?source=api-prod","affected":[{"type":"plugin","slug":"hdw-player-video-player-video-gallery","name":"HDW Player Plugin (Video Player & Video Gallery)","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"3.0"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a55956f-3bda-46ac-9d6e-24dada30046f","source":"wordfence","cve":"CVE-2025-30563","title":"Tidekey <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a55956f-3bda-46ac-9d6e-24dada30046f?source=api-prod","affected":[{"type":"plugin","slug":"tidekey","name":"Tidekey","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:49:23Z"},{"id":"wordfence:0a56b177-3af4-46ee-93d8-f1a36115f43e","source":"wordfence","cve":"CVE-2025-22782","title":"WR Price List Manager For Woocommerce <= 1.0.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a56b177-3af4-46ee-93d8-f1a36115f43e?source=api-prod","affected":[{"type":"plugin","slug":"wr-price-list-for-woocommerce","name":"WRN Pricing Rules for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-01-13T00:00:00Z","updated":"2026-06-18T13:51:06Z"},{"id":"wordfence:0a576c71-615c-4333-8cd3-93343ce64f7b","source":"wordfence","cve":"CVE-2025-11820","title":"Graphina \u2013 Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a576c71-615c-4333-8cd3-93343ce64f7b?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-11-04T21:12:51Z","updated":"2025-11-05T09:27:41Z"},{"id":"wordfence:0a58d45b-c91b-4141-992e-336650d7252b","source":"wordfence","cve":"CVE-2023-41866","title":"Automatic YouTube Gallery <= 2.3.3 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a58d45b-c91b-4141-992e-336650d7252b?source=api-prod","affected":[{"type":"plugin","slug":"automatic-youtube-gallery","name":"Automatic YouTube Gallery \u2013 Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a598274-3c67-4751-94d6-49abed38422c","source":"wordfence","cve":"CVE-2023-28497","title":"Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_galleries","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a598274-3c67-4751-94d6-49abed38422c?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a5a0ca6-f355-4110-a533-04e46c741ec9","source":"wordfence","cve":"","title":"a3 Lazy Load <= 2.6.0 - Cross-Site Request Forgery to Settings Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5a0ca6-f355-4110-a533-04e46c741ec9?source=api-prod","affected":[{"type":"plugin","slug":"a3-portfolio","name":"a3 Portfolio","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"},{"type":"plugin","slug":"woocommerce-dynamic-gallery","name":"Dynamic Product Gallery for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"},{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"},{"type":"plugin","slug":"woocommerce-products-quick-view","name":"Products Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"},{"type":"plugin","slug":"a3-responsive-slider","name":"a3 Responsive Slider","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"},{"type":"plugin","slug":"woo-widget-product-slideshow","name":"Product Widget Slider for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"},{"type":"plugin","slug":"woocommerce-compare-products","name":"Compare Products for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"},{"type":"plugin","slug":"woocommerce-product-sort-and-display","name":"Product Sort and Display for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"},{"type":"plugin","slug":"a3-lazy-load","name":"a3 Lazy Load","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"wp-email-template","name":"WP Email Template","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a5a411f-ac34-42ac-952d-f1fadf1e2c72","source":"wordfence","cve":"CVE-2026-103062","title":"TranslatePress \u2013 Translate Multilingual sites with AI Translation <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5a411f-ac34-42ac-952d-f1fadf1e2c72?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-10-02T06:45:25Z","updated":"2026-10-08T23:14:30Z"},{"id":"wordfence:0a5a4b0e-f490-4f62-83cc-bef892e4c6ec","source":"wordfence","cve":"CVE-2025-22325","title":"Autocompleter <= 1.3.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5a4b0e-f490-4f62-83cc-bef892e4c6ec?source=api-prod","affected":[{"type":"plugin","slug":"autocompleter","name":"Autocompleter","from":"*","from_inclusive":true,"to":"1.3.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:05:04Z"},{"id":"wordfence:0a5a547c-6b24-4cb6-ad0e-b12a8f37472a","source":"wordfence","cve":"CVE-2021-24689","title":"Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5a547c-6b24-4cb6-ad0e-b12a8f37472a?source=api-prod","affected":[{"type":"plugin","slug":"lastform","name":"Contact Forms \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a5ac584-61e4-4318-9e8d-9b5a7f1daf3d","source":"wordfence","cve":"CVE-2021-24411","title":"Social Tape <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5ac584-61e4-4318-9e8d-9b5a7f1daf3d?source=api-prod","affected":[{"type":"plugin","slug":"social-tape","name":"Social Tape","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a5bfb48-03f5-43dc-ad1c-e7773559c919","source":"wordfence","cve":"CVE-2026-84815","title":"Enfold - Responsive Multi-Purpose Theme <= 8.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5bfb48-03f5-43dc-ad1c-e7773559c919?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"enfold","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":"8.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:15:57Z"},{"id":"wordfence:0a5c8f46-a686-4b77-8a22-8dec92a96350","source":"wordfence","cve":"CVE-2024-11376","title":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5c8f46-a686-4b77-8a22-8dec92a96350?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"241216","to_inclusive":true,"patched_in":"250214"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:12Z"},{"id":"wordfence:0a5f2e1a-2216-4885-9b74-a08142816f2b","source":"wordfence","cve":"CVE-2024-10567","title":"TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5f2e1a-2216-4885-9b74-a08142816f2b?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T08:22:47Z"},{"id":"wordfence:0a5fdadc-9229-45d4-b6cb-2fb81b39f31e","source":"wordfence","cve":"CVE-2025-22524","title":"formafzar <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5fdadc-9229-45d4-b6cb-2fb81b39f31e?source=api-prod","affected":[{"type":"plugin","slug":"formafzar","name":"\u0641\u0631\u0645 \u0633\u0627\u0632 \u0641\u0631\u0645 \u0627\u0641\u0632\u0627\u0631","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:34:31Z"},{"id":"wordfence:0a60b55b-0c76-4b7c-9d16-a3cbd181eb3b","source":"wordfence","cve":"CVE-2026-92554","title":"ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a60b55b-0c76-4b7c-9d16-a3cbd181eb3b?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-09-17T19:15:40Z","updated":"2026-09-18T07:39:59Z"},{"id":"wordfence:0a60ed96-a2c9-45a5-a294-a48c0155683e","source":"wordfence","cve":"CVE-2025-31585","title":"Leadfox for WordPress <= 2.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a60ed96-a2c9-45a5-a294-a48c0155683e?source=api-prod","affected":[{"type":"plugin","slug":"leadfox","name":"Leadfox for WordPress","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-03-31T00:00:00Z","updated":"2025-11-17T19:25:54Z"},{"id":"wordfence:0a617faf-cc1f-453b-b5aa-e357613adee4","source":"wordfence","cve":"CVE-2025-54681","title":"Connector for Gravity Forms and Google Sheets <= 1.2.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a617faf-cc1f-453b-b5aa-e357613adee4?source=api-prod","affected":[{"type":"plugin","slug":"wp-gravity-forms-spreadsheets","name":"Connector for Gravity Forms and Google Sheets","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:53:47Z"},{"id":"wordfence:0a64e3b3-338d-4cf8-91f3-0ff4732549b4","source":"wordfence","cve":"CVE-2012-5350","title":"Pay With Tweet <= 1.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a64e3b3-338d-4cf8-91f3-0ff4732549b4?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-tweet","name":"Pay With Tweet","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2012-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a652464-73b7-4189-be80-2ee12fa25868","source":"wordfence","cve":"CVE-2025-31576","title":"PostmarkApp Email Integrator <= 2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a652464-73b7-4189-be80-2ee12fa25868?source=api-prod","affected":[{"type":"plugin","slug":"postmarkapp-email-integrator","name":"PostmarkApp Email Integrator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-04-15T13:28:05Z"},{"id":"wordfence:0a656052-3b8a-4a93-b4f8-372b448a8373","source":"wordfence","cve":"CVE-2021-24633","title":"Countdown Block <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a656052-3b8a-4a93-b4f8-372b448a8373?source=api-prod","affected":[{"type":"plugin","slug":"wp-countdown-block","name":"Countdown Block","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a6615fd-7c37-45d9-a657-0ba00df840e5","source":"wordfence","cve":"CVE-2021-4339","title":"uListing <= 1.6.6 - Unauthenticated Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6615fd-7c37-45d9-a657-0ba00df840e5?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a6627e5-8831-4724-a427-aaf5ebb67f57","source":"wordfence","cve":"CVE-2024-37489","title":"Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6627e5-8831-4724-a427-aaf5ebb67f57?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T20:46:42Z"},{"id":"wordfence:0a66f763-dc1a-4b8e-9193-88d790cc64ec","source":"wordfence","cve":"CVE-2025-47456","title":"WP Gravity Forms Zendesk <= 1.1.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a66f763-dc1a-4b8e-9193-88d790cc64ec?source=api-prod","affected":[{"type":"plugin","slug":"gf-zendesk","name":"WP Gravity Forms Zendesk","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:57:24Z"},{"id":"wordfence:0a6707ef-aab7-449c-8160-034bc188a998","source":"wordfence","cve":"CVE-2018-14028","title":"WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6707ef-aab7-449c-8160-034bc188a998?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.39","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.36","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.32","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.31","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.30","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.27","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.27","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.23","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.24","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.20","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.17","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.19","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.16","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.14","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.13","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.12","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.10","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.8","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"4.1.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"4.1.40"}],"published":"2018-08-04T00:00:00Z","updated":"2024-08-02T17:55:25Z"},{"id":"wordfence:0a679e17-f522-44c1-b4b5-30301c3aef88","source":"wordfence","cve":"CVE-2026-118629","title":"All-in-One Video Gallery <= 4.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a679e17-f522-44c1-b4b5-30301c3aef88?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:48:49Z"},{"id":"wordfence:0a6996fd-9252-43e6-9c4d-01692e1f279e","source":"wordfence","cve":"CVE-2026-94503","title":"Zombify <= 1.7.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6996fd-9252-43e6-9c4d-01692e1f279e?source=api-prod","affected":[{"type":"plugin","slug":"zombify","name":"Zombify","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:31:17Z"},{"id":"wordfence:0a69e4e0-0872-4604-98ae-6a0502e7e965","source":"wordfence","cve":"CVE-2025-60244","title":"TableOn <= 1.0.5.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a69e4e0-0872-4604-98ae-6a0502e7e965?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-05-22T00:00:00Z","updated":"2026-05-04T14:38:38Z"},{"id":"wordfence:0a6b87a8-2ebf-4db6-bf09-e9642708b2aa","source":"wordfence","cve":"","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 2.10.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6b87a8-2ebf-4db6-bf09-e9642708b2aa?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a6c5e9a-754f-41c8-b27b-caa133b5070f","source":"wordfence","cve":"CVE-2022-3427","title":"Corner Ad <= 1.0.56 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6c5e9a-754f-41c8-b27b-caa133b5070f?source=api-prod","affected":[{"type":"plugin","slug":"corner-ad","name":"Corner Ad","from":"*","from_inclusive":true,"to":"1.0.56","to_inclusive":true,"patched_in":"1.0.57"}],"published":"2022-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a6df89e-acd1-4b3d-ab51-6522b7bc13f6","source":"wordfence","cve":"CVE-2025-58219","title":"Show Pages List <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6df89e-acd1-4b3d-ab51-6522b7bc13f6?source=api-prod","affected":[{"type":"plugin","slug":"show-pages-list","name":"Show Pages List","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:33:30Z"},{"id":"wordfence:0a6e56ac-76e6-4ba0-8fbb-159fd8cb7dd1","source":"wordfence","cve":"CVE-2025-23604","title":"Rezdy Reloaded <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6e56ac-76e6-4ba0-8fbb-159fd8cb7dd1?source=api-prod","affected":[{"type":"plugin","slug":"reloaded-rezdy","name":"Rezdy Reloaded","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:26:03Z"},{"id":"wordfence:0a6efa0a-43df-4455-b0e2-135416ef79dc","source":"wordfence","cve":"CVE-2026-108496","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6efa0a-43df-4455-b0e2-135416ef79dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.23","to_inclusive":true,"patched_in":"2.9.24"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:47:01Z"},{"id":"wordfence:0a70063e-b2d5-44a3-9a6f-3bbc9f4a0ff3","source":"wordfence","cve":"CVE-2025-47623","title":"Easy PayPal Buy Now Button <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a70063e-b2d5-44a3-9a6f-3bbc9f4a0ff3?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-16T14:13:16Z"},{"id":"wordfence:0a714536-c6fd-495b-b774-104657329a74","source":"wordfence","cve":"CVE-2024-7386","title":"Premium Packages \u2013 Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a714536-c6fd-495b-b774-104657329a74?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2024-09-24T12:16:17Z","updated":"2024-09-25T13:29:40Z"},{"id":"wordfence:0a73d326-cd27-4719-8c26-3aa5dce837c0","source":"wordfence","cve":"CVE-2021-24773","title":"WordPress Download Manager <= 3.2.15 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a73d326-cd27-4719-8c26-3aa5dce837c0?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":false,"patched_in":"3.2.16"}],"published":"2021-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a769f8a-c1c1-4be1-b7ae-e1cb6eeda28c","source":"wordfence","cve":"CVE-2021-25077","title":"Store Toolkit for WooCommerce <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a769f8a-c1c1-4be1-b7ae-e1cb6eeda28c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-store-toolkit","name":"Store Toolkit \u2013  WooCommerce Extensions, Quick Enhancements & Handy Tools","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a77ea13-5ac2-427a-8e1c-a5fa29c9f2dc","source":"wordfence","cve":"CVE-2025-62069","title":"MDTF <= 1.3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a77ea13-5ac2-427a-8e1c-a5fa29c9f2dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.8","to_inclusive":true,"patched_in":"1.3.3.9"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T21:03:38Z"},{"id":"wordfence:0a79eb25-a7d1-4102-97e6-8fa8db9ed03e","source":"wordfence","cve":"CVE-2024-6554","title":"Branda \u2013 White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a79eb25-a7d1-4102-97e6-8fa8db9ed03e?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.18","to_inclusive":true,"patched_in":"3.4.19"}],"published":"2024-07-10T14:57:15Z","updated":"2024-07-11T03:33:19Z"},{"id":"wordfence:0a79f8f6-a708-4db1-806d-1f782bbcfd16","source":"wordfence","cve":"CVE-2024-13127","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a79f8f6-a708-4db1-806d-1f782bbcfd16?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.5","to_inclusive":true,"patched_in":"4.2.7.5.1"}],"published":"2025-01-29T00:00:00Z","updated":"2025-02-25T15:28:01Z"},{"id":"wordfence:0a7bc8b3-d000-46a1-aa36-eef38cb06e08","source":"wordfence","cve":"CVE-2025-63059","title":"Ninja Popups <= 4.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a7bc8b3-d000-46a1-aa36-eef38cb06e08?source=api-prod","affected":[{"type":"plugin","slug":"arscode-ninja-popups","name":"Ninja Popups","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-11T16:30:05Z"},{"id":"wordfence:0a7ca5b2-be79-4fd1-b480-98db0902a1c1","source":"wordfence","cve":"CVE-2026-119511","title":"MoreConvert Wishlist for WooCommerce <= 2.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a7ca5b2-be79-4fd1-b480-98db0902a1c1?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-11-07T09:09:00Z","updated":"2026-11-10T19:32:17Z"},{"id":"wordfence:0a7d3128-672f-457f-a601-575ec71b5af0","source":"wordfence","cve":"CVE-2026-28012","title":"Gridiron <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a7d3128-672f-457f-a601-575ec71b5af0?source=api-prod","affected":[{"type":"theme","slug":"gridiron","name":"Gridiron | American Football & NFL Team WordPress","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:57:24Z"},{"id":"wordfence:0a7f2fc6-6932-4bf9-8c73-4a20f4c4bd68","source":"wordfence","cve":"CVE-2026-49068","title":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce <= 7.8.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a7f2fc6-6932-4bf9-8c73-4a20f4c4bd68?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-06-09T00:00:00Z","updated":"2026-06-18T13:24:00Z"},{"id":"wordfence:0a803999-0ea6-498a-b4a9-fafcbe205bf9","source":"wordfence","cve":"CVE-2026-97281","title":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a803999-0ea6-498a-b4a9-fafcbe205bf9?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-10-01T13:34:52Z","updated":"2026-10-09T00:15:50Z"},{"id":"wordfence:0a8089e1-51ca-4e27-930c-d0bb57bbd641","source":"wordfence","cve":"CVE-2024-49261","title":"Arkhe Blocks <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8089e1-51ca-4e27-930c-d0bb57bbd641?source=api-prod","affected":[{"type":"plugin","slug":"arkhe-blocks","name":"Arkhe Blocks","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.27.0"}],"published":"2024-10-14T00:00:00Z","updated":"2024-11-15T15:02:27Z"},{"id":"wordfence:0a809457-0a85-481a-b075-5239f656477c","source":"wordfence","cve":"CVE-2026-54830","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin <= 2.7.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a809457-0a85-481a-b075-5239f656477c?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.19","to_inclusive":true,"patched_in":"2.7.20"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:53:57Z"},{"id":"wordfence:0a80f2c7-7464-4587-8093-349a507cc4a6","source":"wordfence","cve":"CVE-2026-82186","title":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a80f2c7-7464-4587-8093-349a507cc4a6?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":false,"patched_in":"4.4.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:08:59Z"},{"id":"wordfence:0a8127e5-b5e6-4545-9e38-f3fa9daabcf2","source":"wordfence","cve":"CVE-2022-38059","title":"Access Code Feeder <= 1.0.3 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8127e5-b5e6-4545-9e38-f3fa9daabcf2?source=api-prod","affected":[{"type":"plugin","slug":"access-code-feeder","name":"Access Code Feeder","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a83285f-e623-443a-a173-97593cade046","source":"wordfence","cve":"CVE-2026-104653","title":"Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a83285f-e623-443a-a173-97593cade046?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:26:38Z"},{"id":"wordfence:0a8453c4-effd-48fc-99c8-fc1f90cd23ea","source":"wordfence","cve":"CVE-2026-8383","title":"LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8453c4-effd-48fc-99c8-fc1f90cd23ea?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-06-27T00:00:00Z","updated":"2026-08-21T14:11:07Z"},{"id":"wordfence:0a86f6ed-9755-4265-bc0d-2d0e18e9982f","source":"wordfence","cve":"CVE-2024-0699","title":"AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a86f6ed-9755-4265-bc0d-2d0e18e9982f?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-01-18T00:00:00Z","updated":"2024-07-29T21:35:50Z"},{"id":"wordfence:0a8972da-ac16-4010-a639-91e3ee46b36e","source":"wordfence","cve":"CVE-2024-13823","title":"360 Product Rotation <= 1.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8972da-ac16-4010-a639-91e3ee46b36e?source=api-prod","affected":[{"type":"plugin","slug":"360-product-rotation","name":"360 Product Rotation","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-11T00:00:00Z","updated":"2025-05-29T18:47:30Z"},{"id":"wordfence:0a8a49c4-21e8-447c-94da-8241c7d66c29","source":"wordfence","cve":"CVE-2026-4131","title":"WP Responsive Popup + Optin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8a49c4-21e8-447c-94da-8241c7d66c29?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-optin","name":"WP Responsive Popup + Optin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:08:08Z","updated":"2026-04-22T07:45:30Z"},{"id":"wordfence:0a8aa964-d18c-420d-864b-9ee5cb5e2f0f","source":"wordfence","cve":"CVE-2024-44018","title":"Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8aa964-d18c-420d-864b-9ee5cb5e2f0f?source=api-prod","affected":[{"type":"plugin","slug":"instant-chat-wp","name":"Instant Chat Floating Button for WordPress Websites","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:32:43Z"},{"id":"wordfence:0a8b0825-dca2-4593-87d0-149bb516a696","source":"wordfence","cve":"CVE-2026-41559","title":"SafeSnap \u2013 Verified WordPress Backup & Restore <= 2.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8b0825-dca2-4593-87d0-149bb516a696?source=api-prod","affected":[{"type":"plugin","slug":"safesnap","name":"SafeSnap \u2013 Verified WordPress Backup & Restore","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:30:25Z","updated":"2026-10-08T23:33:15Z"},{"id":"wordfence:0a8b5554-b4d9-48f2-ad16-cf96aabcbb6f","source":"wordfence","cve":"CVE-2023-4805","title":"Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8b5554-b4d9-48f2-ad16-cf96aabcbb6f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a8de5b1-fefc-40b0-8f4d-435e6bd2f452","source":"wordfence","cve":"CVE-2014-10013","title":"WordPress Classifieds Plugin \u2013 Ad Directory & Listings by AWP Classifieds < 3.0 - SQL Injection","severity":"medium","cvss":6.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8de5b1-fefc-40b0-8f4d-435e6bd2f452?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2014-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a8fc12b-4ca1-42ea-9362-8c39de27c98d","source":"wordfence","cve":"CVE-2025-69367","title":"Oyster - Photography WordPress <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8fc12b-4ca1-42ea-9362-8c39de27c98d?source=api-prod","affected":[{"type":"theme","slug":"oyster","name":"Oyster - Photography WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:03:50Z"},{"id":"wordfence:0a907a0c-e9d2-4ba6-a149-dd8114837cad","source":"wordfence","cve":"CVE-2025-47598","title":"History Log by click5 <= 1.0.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a907a0c-e9d2-4ba6-a149-dd8114837cad?source=api-prod","affected":[{"type":"plugin","slug":"history-log-by-click5","name":"History Log by click5","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-05-30T00:00:00Z","updated":"2026-11-10T23:17:56Z"},{"id":"wordfence:0a90820f-3920-40e0-be81-17efe4dca177","source":"wordfence","cve":"CVE-2026-61990","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a90820f-3920-40e0-be81-17efe4dca177?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-11-07T09:11:00Z","updated":"2026-11-10T20:05:38Z"},{"id":"wordfence:0a934aad-5097-4fec-871b-4eb601240db2","source":"wordfence","cve":"CVE-2026-57769","title":"Grand Photography WordPress <= 5.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a934aad-5097-4fec-871b-4eb601240db2?source=api-prod","affected":[{"type":"theme","slug":"grandphotography","name":"Grand Photography WordPress","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:41:53Z"},{"id":"wordfence:0a938042-bad6-4fe0-8905-148d07a22996","source":"wordfence","cve":"CVE-2024-13829","title":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto <= 8.0.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a938042-bad6-4fe0-8905-148d07a22996?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":true,"patched_in":"8.0.9"}],"published":"2025-02-04T16:23:28Z","updated":"2025-02-05T05:22:33Z"},{"id":"wordfence:0a941aef-85f6-4719-b6ab-ace77a03e93e","source":"wordfence","cve":"CVE-2022-4705","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a94841f-b1dd-44f4-b7a1-65a9fdf7b18d","source":"wordfence","cve":"CVE-2024-0797","title":"Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a94841f-b1dd-44f4-b7a1-65a9fdf7b18d?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.1","to_inclusive":true,"patched_in":"1.0.6.2"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T21:21:33Z"},{"id":"wordfence:0a95f73a-eaf7-4b8c-b127-0ceef87c80fb","source":"wordfence","cve":"CVE-2018-21012","title":"CF7 Invisible reCAPTCHA < 1.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a95f73a-eaf7-4b8c-b127-0ceef87c80fb?source=api-prod","affected":[{"type":"plugin","slug":"cf7-invisible-recaptcha","name":"CF7 Invisible reCAPTCHA","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2018-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a9793b6-2186-46ef-b204-d8f8f154ebf3","source":"wordfence","cve":"CVE-2024-10528","title":"Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9793b6-2186-46ef-b204-d8f8f154ebf3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T05:33:48Z"},{"id":"wordfence:0a97a217-b00b-4268-a472-8d62ae1d18e3","source":"wordfence","cve":"CVE-2026-9834","title":"WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a97a217-b00b-4268-a472-8d62ae1d18e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"7.11","to_inclusive":true,"patched_in":"7.12"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-02T08:33:05Z"},{"id":"wordfence:0a98bc45-afcd-46e7-8664-f656b9845231","source":"wordfence","cve":"CVE-2026-76551","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a98bc45-afcd-46e7-8664-f656b9845231?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:24:47Z"},{"id":"wordfence:0a99ccde-4c8c-4c77-9199-c21dba35c19f","source":"wordfence","cve":"CVE-2022-0628","title":"Mega Menu <= 3.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a99ccde-4c8c-4c77-9199-c21dba35c19f?source=api-prod","affected":[{"type":"plugin","slug":"ap-mega-menu","name":"Mega Menu Plugin for WordPress \u2013 AP Mega Menu","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a9b4c03-e7ec-48d6-87fe-67e8a5780703","source":"wordfence","cve":"","title":"a3 Responsive Slider <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9b4c03-e7ec-48d6-87fe-67e8a5780703?source=api-prod","affected":[{"type":"plugin","slug":"a3-responsive-slider","name":"a3 Responsive Slider","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0a9bef24-ee99-4121-a4ea-ffd126b69b57","source":"wordfence","cve":"CVE-2025-30927","title":"Wordapp <= 1.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9bef24-ee99-4121-a4ea-ffd126b69b57?source=api-prod","affected":[{"type":"plugin","slug":"wordapp","name":"Wordapp","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:28:07Z"},{"id":"wordfence:0a9dd9b6-28c7-4f7d-95bb-e93ccc6abc30","source":"wordfence","cve":"CVE-2014-4589","title":"WP Silverlight Media Player <= 0.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9dd9b6-28c7-4f7d-95bb-e93ccc6abc30?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-player","name":"wp-media-player","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0aa0d5cb-c74b-4687-a41c-a01810c20428","source":"wordfence","cve":"CVE-2026-66581","title":"JetEngine <= 3.8.14.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa0d5cb-c74b-4687-a41c-a01810c20428?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14.1","to_inclusive":true,"patched_in":"3.8.14.2"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:04Z"},{"id":"wordfence:0aa21fad-4dd0-4ccd-a325-de3532a6ffaf","source":"wordfence","cve":"CVE-2024-12415","title":"AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa21fad-4dd0-4ccd-a325-de3532a6ffaf?source=api-prod","affected":[{"type":"plugin","slug":"infographic-and-list-builder-ilist","name":"AI Infographic Maker","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-01-30T22:49:01Z","updated":"2025-01-31T11:11:11Z"},{"id":"wordfence:0aa2843b-ce3a-4fe8-bcde-77ffaf34fce0","source":"wordfence","cve":"CVE-2025-54723","title":"DentiCare < 1.4.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa2843b-ce3a-4fe8-bcde-77ffaf34fce0?source=api-prod","affected":[{"type":"theme","slug":"denticare","name":"DentiCare - Medical & Dentist WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T12:42:34Z"},{"id":"wordfence:0aa3bee5-a194-4618-8f32-a0a781fe8dc6","source":"wordfence","cve":"CVE-2017-18608","title":"Spot.IM Comments < 4.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa3bee5-a194-4618-8f32-a0a781fe8dc6?source=api-prod","affected":[{"type":"plugin","slug":"spotim-comments","name":"Spot.IM Comments","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2017-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0aa3ec9b-80d5-4e31-8045-43c8d151cab8","source":"wordfence","cve":"CVE-2024-2385","title":"Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa3ec9b-80d5-4e31-8045-43c8d151cab8?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":"8.4.1"}],"published":"2024-07-03T14:51:55Z","updated":"2024-07-19T15:36:23Z"},{"id":"wordfence:0aa925c8-7c65-45a4-95ca-a37290d74e86","source":"wordfence","cve":"CVE-2025-47469","title":"Media Hygiene <= 4.0.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa925c8-7c65-45a4-95ca-a37290d74e86?source=api-prod","affected":[{"type":"plugin","slug":"media-hygiene","name":"Media Hygiene: Remove or Delete Unused Images and More!","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:45:18Z"},{"id":"wordfence:0aab68b4-fd5a-4471-bd29-a1a6dbfcf4ec","source":"wordfence","cve":"CVE-2026-97343","title":"Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aab68b4-fd5a-4471-bd29-a1a6dbfcf4ec?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-10-02T18:37:47Z","updated":"2026-10-03T06:38:20Z"},{"id":"wordfence:0aac81b0-8d40-4c16-99b0-558ad7132698","source":"wordfence","cve":"CVE-2024-2908","title":"Call Now Button <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aac81b0-8d40-4c16-99b0-558ad7132698?source=api-prod","affected":[{"type":"plugin","slug":"call-now-button","name":"Call Now Button \u2013 The Free Click to Call Button for WordPress","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-08-01T12:54:15Z"},{"id":"wordfence:0aad7f55-d1f0-45f9-ba8b-74170c32374f","source":"wordfence","cve":"CVE-2023-35884","title":"EventPrime <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aad7f55-d1f0-45f9-ba8b-74170c32374f?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ab4cdcd-1ca8-4ee9-87ab-bf4ce33f94d3","source":"wordfence","cve":"CVE-2026-6808","title":"Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab4cdcd-1ca8-4ee9-87ab-bf4ce33f94d3?source=api-prod","affected":[{"type":"plugin","slug":"awesome-pricing-tables-lite-by-optimalplugins","name":"Pricing Tables for WP","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:05:46Z","updated":"2026-05-12T07:48:16Z"},{"id":"wordfence:0ab546cc-b099-4d26-bf42-785952fcfd8c","source":"wordfence","cve":"CVE-2024-3068","title":"Custom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab546cc-b099-4d26-bf42-785952fcfd8c?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:18Z"},{"id":"wordfence:0ab82117-73dd-4257-8dfc-01dadcc3a83f","source":"wordfence","cve":"CVE-2022-1567","title":"WP JS <= 2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab82117-73dd-4257-8dfc-01dadcc3a83f?source=api-prod","affected":[{"type":"plugin","slug":"wp-js","name":"WP JS","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0abad47f-a806-4cdd-a11f-015b997b5e86","source":"wordfence","cve":"CVE-2023-46630","title":"Admin and Site Enhancements (ASE) <= 5.7.1 - Password Protection Mode Security Feature Bypass","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abad47f-a806-4cdd-a11f-015b997b5e86?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0abbdf2c-b1f8-4431-b892-1d7972749af6","source":"wordfence","cve":"CVE-2026-17090","title":"Beaver Builder Page Builder <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abbdf2c-b1f8-4431-b892-1d7972749af6?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.10.2.2","to_inclusive":true,"patched_in":"2.10.3.2"}],"published":"2026-08-14T14:57:42Z","updated":"2026-08-15T03:25:59Z"},{"id":"wordfence:0abd2533-5cb3-4568-8ad2-f2852ab3a8db","source":"wordfence","cve":"CVE-2024-1061","title":"HTML5 Video Player <= 2.5.24 - Unauthenticated SQL Injection via id","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abd2533-5cb3-4568-8ad2-f2852ab3a8db?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.24","to_inclusive":true,"patched_in":"2.5.25"}],"published":"2024-01-31T00:00:00Z","updated":"2024-05-30T20:39:54Z"},{"id":"wordfence:0abd5ca3-177f-43ef-b2ed-b3d7973c714e","source":"wordfence","cve":"CVE-2025-66527","title":"Lobo <= 2.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abd5ca3-177f-43ef-b2ed-b3d7973c714e?source=api-prod","affected":[{"type":"theme","slug":"lobo","name":"Lobo - WordPress Portfolio for Freelancers & Agencies","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2025-11-14T00:00:00Z","updated":"2025-12-11T16:39:13Z"},{"id":"wordfence:0abf6311-c66d-4318-8734-2237e46f2b6d","source":"wordfence","cve":"CVE-2025-32217","title":"Ai Image Alt Text Generator for WP <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abf6311-c66d-4318-8734-2237e46f2b6d?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-alt-text-generator-for-wp","name":"Ai Image Alt Text Generator for WP","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-06-27T17:23:40Z"},{"id":"wordfence:0abf9705-2716-403f-9348-e43a8d8fb1d2","source":"wordfence","cve":"CVE-2024-9170","title":"Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abf9705-2716-403f-9348-e43a8d8fb1d2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.2.4"}],"published":"2024-11-25T20:30:56Z","updated":"2024-11-26T08:31:53Z"},{"id":"wordfence:0abffda9-1f37-4e2a-9b85-2a7a204f1ed7","source":"wordfence","cve":"CVE-2025-62739","title":"Add Custom Codes <= 4.80 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0abffda9-1f37-4e2a-9b85-2a7a204f1ed7?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-codes","name":"Add Custom Codes \u2013 Insert Header, Footer, Custom PHP Snippets, CSS, Javascript","from":"*","from_inclusive":true,"to":"4.80","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-12-05T00:00:00Z","updated":"2026-03-17T21:27:43Z"},{"id":"wordfence:0ac31c39-abbc-427f-aba3-d9ec3b51c4d2","source":"wordfence","cve":"CVE-2023-45752","title":"Post Gallery <= 2.3.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ac31c39-abbc-427f-aba3-d9ec3b51c4d2?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-gallery","name":"Post Gallery","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ac5ab31-83d9-42be-a6b1-f65303e9c801","source":"wordfence","cve":"CVE-2024-50533","title":"Domain Sharding <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ac5ab31-83d9-42be-a6b1-f65303e9c801?source=api-prod","affected":[{"type":"plugin","slug":"domain-sharding","name":"Domain Sharding","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T13:41:24Z"},{"id":"wordfence:0ac6603f-7eed-424e-a56b-f45d4a7f7b2a","source":"wordfence","cve":"CVE-2014-6315","title":"Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting","severity":"low","cvss":3.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ac6603f-7eed-424e-a56b-f45d4a7f7b2a?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2014-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ac7a936-70fa-41ce-89f7-ec6a77964c96","source":"wordfence","cve":"CVE-2012-6635","title":"WordPress Core <= 3.3.2 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ac7a936-70fa-41ce-89f7-ec6a77964c96?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2012-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0aca6ac7-2002-4099-a17e-91f47b56b660","source":"wordfence","cve":"CVE-2025-62074","title":"WPMobile.App <= 11.71 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aca6ac7-2002-4099-a17e-91f47b56b660?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.71","to_inclusive":true,"patched_in":"11.72"}],"published":"2025-10-26T00:00:00Z","updated":"2025-10-29T14:35:59Z"},{"id":"wordfence:0acb365c-b5f2-4377-875b-69278a8ff96e","source":"wordfence","cve":"CVE-2026-6812","title":"Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0acb365c-b5f2-4377-875b-69278a8ff96e?source=api-prod","affected":[{"type":"theme","slug":"ona","name":"Ona","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.27"}],"published":"2026-05-01T16:42:01Z","updated":"2026-05-02T05:29:27Z"},{"id":"wordfence:0acd781e-e5f7-4c4d-9478-5a13726b1786","source":"wordfence","cve":"CVE-2026-39735","title":"JetEngine <= 3.9.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0acd781e-e5f7-4c4d-9478-5a13726b1786?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.9.0.1","to_inclusive":true,"patched_in":"3.9.0.2"}],"published":"2026-10-29T12:58:00Z","updated":"2026-11-03T19:55:16Z"},{"id":"wordfence:0aced5de-e9df-4ffe-9d10-93dc3897ef4c","source":"wordfence","cve":"CVE-2024-30496","title":"Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aced5de-e9df-4ffe-9d10-93dc3897ef4c?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:49:26Z"},{"id":"wordfence:0acf3219-1443-42cc-b3c9-cffb8fd8af07","source":"wordfence","cve":"CVE-2024-43262","title":"Busiprof <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0acf3219-1443-42cc-b3c9-cffb8fd8af07?source=api-prod","affected":[{"type":"theme","slug":"busiprof","name":"Busiprof","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:39:58Z"},{"id":"wordfence:0ad0eed1-777a-432b-a190-b8a7ed10d71a","source":"wordfence","cve":"","title":"Gmedia Photo Gallery <= 1.6.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ad0eed1-777a-432b-a190-b8a7ed10d71a?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2015-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ad44770-91da-4265-b292-e6e41538d0f4","source":"wordfence","cve":"CVE-2024-49290","title":"Cooked Pro < 1.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ad44770-91da-4265-b292-e6e41538d0f4?source=api-prod","affected":[{"type":"plugin","slug":"cooked-pro","name":"Cooked Pro","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:39:10Z"},{"id":"wordfence:0ad4aa67-0b40-4dcf-a7f8-0b333f622041","source":"wordfence","cve":"CVE-2026-16569","title":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.69 - Missing Authorization to Authenticated (Subscriber+) Stock Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ad4aa67-0b40-4dcf-a7f8-0b333f622041?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-for-woocommerce","name":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce","from":"*","from_inclusive":true,"to":"0.4.69","to_inclusive":true,"patched_in":""}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T15:11:23Z"},{"id":"wordfence:0ad806df-0a5c-4ef0-a335-2e34c9b62662","source":"wordfence","cve":"CVE-2022-0399","title":"Advanced Product Labels for WooCommerce <= 1.2.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ad806df-0a5c-4ef0-a335-2e34c9b62662?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-labels-for-woocommerce","name":"Advanced Product Labels for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3.7","to_inclusive":false,"patched_in":"1.2.3.7"}],"published":"2022-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ad981a8-1678-495c-b3dc-baa151aa0d9c","source":"wordfence","cve":"CVE-2025-32180","title":"CSS3 Tooltips for WordPress <= 1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ad981a8-1678-495c-b3dc-baa151aa0d9c?source=api-prod","affected":[{"type":"plugin","slug":"css3_tooltips","name":"CSS3 Tooltips for WordPress","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-24T22:15:45Z"},{"id":"wordfence:0ada25c7-a636-45cd-b2ee-984b8f676011","source":"wordfence","cve":"CVE-2025-58650","title":"All In One SEO Pack <= 4.8.7.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ada25c7-a636-45cd-b2ee-984b8f676011?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.8.7.1","to_inclusive":true,"patched_in":"4.8.7.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-06T20:18:47Z"},{"id":"wordfence:0adad1bc-8803-4c20-ae9f-ab8b66d1e6df","source":"wordfence","cve":"CVE-2026-68564","title":"NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0adad1bc-8803-4c20-ae9f-ab8b66d1e6df?source=api-prod","affected":[{"type":"plugin","slug":"notificationx-pro","name":"NotificationX Pro","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-01T13:20:45Z"},{"id":"wordfence:0add0b7c-c47a-4ff0-b750-9b1433970d85","source":"wordfence","cve":"CVE-2024-45411","title":"Timber <= 1.23.1 - Use of a Vulnerable Dependency","severity":"medium","cvss":6.5,"cwe":"CWE-1395","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0add0b7c-c47a-4ff0-b750-9b1433970d85?source=api-prod","affected":[{"type":"plugin","slug":"timber-library","name":"Timber","from":"*","from_inclusive":true,"to":"1.23.1","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2025-07-24T00:00:00Z","updated":"2025-07-24T19:51:31Z"},{"id":"wordfence:0add23c7-fef1-48c1-8395-5ddd2f4f8e8d","source":"wordfence","cve":"CVE-2026-54195","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0add23c7-fef1-48c1-8395-5ddd2f4f8e8d?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.0.1","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:59:52Z"},{"id":"wordfence:0ade8c7a-bc07-40e9-8974-a1c59b2d9343","source":"wordfence","cve":"CVE-2026-40739","title":"LuxeDrive - Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ade8c7a-bc07-40e9-8974-a1c59b2d9343?source=api-prod","affected":[{"type":"theme","slug":"luxedrive","name":"LuxeDrive - Limousine and Car Rental WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:43:41Z"},{"id":"wordfence:0ae13f3a-4cb9-4ba6-ab2f-c92f1e14cc18","source":"wordfence","cve":"CVE-2026-96838","title":"Blacklist Manager \u2013 WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae13f3a-4cb9-4ba6-ab2f-c92f1e14cc18?source=api-prod","affected":[{"type":"plugin","slug":"wc-blacklist-manager","name":"Blacklist Manager \u2013 WooCommerce Anti-Fraud, Blacklist & Checkout Verification","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:40:27Z"},{"id":"wordfence:0ae16c4e-0151-4414-8612-ec8eb92505fd","source":"wordfence","cve":"CVE-2024-13461","title":"Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae16c4e-0151-4414-8612-ec8eb92505fd?source=api-prod","affected":[{"type":"plugin","slug":"autoship-cloud","name":"Autoship Cloud for WooCommerce Subscription Products","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-02-20T00:00:00Z","updated":"2025-02-21T09:21:06Z"},{"id":"wordfence:0ae1cfe2-db79-46ba-bf10-0ee47f98e204","source":"wordfence","cve":"CVE-2026-18946","title":"Contact Form to Any API <= 3.0.6 - Unauthenticated Sensitive File Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae1cfe2-db79-46ba-bf10-0ee47f98e204?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:45:20Z"},{"id":"wordfence:0ae243af-619f-4405-b1e0-9b44c1869501","source":"wordfence","cve":"","title":"Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae243af-619f-4405-b1e0-9b44c1869501?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.0.84","to_inclusive":false,"patched_in":"1.0.84"}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ae3c252-d2a9-48b8-99a9-53dbc0701ee0","source":"wordfence","cve":"CVE-2026-120844","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 7.1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae3c252-d2a9-48b8-99a9-53dbc0701ee0?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"7.1.4"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:57:51Z"},{"id":"wordfence:0ae3cf36-ca3a-4f6d-90c3-6fb67c6862b9","source":"wordfence","cve":"CVE-2026-12251","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae3cf36-ca3a-4f6d-90c3-6fb67c6862b9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":false,"patched_in":"2.12.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-14T12:43:43Z"},{"id":"wordfence:0ae8f5a1-680d-47c4-b009-16601eac13d9","source":"wordfence","cve":"CVE-2025-25092","title":"All push notification for WP <= 1.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae8f5a1-680d-47c4-b009-16601eac13d9?source=api-prod","affected":[{"type":"plugin","slug":"all-push-notification","name":"All push notification for WP","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:13:13Z"},{"id":"wordfence:0aea5564-b1b9-4d57-9f7e-81dd791c8d48","source":"wordfence","cve":"CVE-2023-39925","title":"Community by PeepSo <= 6.1.6.0 - Cross-Site Request Forgery via delete","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aea5564-b1b9-4d57-9f7e-81dd791c8d48?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.1.6.0","to_inclusive":true,"patched_in":"6.2.0.0"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0aeaeb51-23ae-46f3-ba81-be261fc1aa29","source":"wordfence","cve":"CVE-2025-46435","title":"Time Based Greeting <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeaeb51-23ae-46f3-ba81-be261fc1aa29?source=api-prod","affected":[{"type":"plugin","slug":"time-based-greeting","name":"Time Based Greeting","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:18:48Z"},{"id":"wordfence:0aeaf421-513b-4c9d-bd36-58af28c86bc1","source":"wordfence","cve":"CVE-2024-5574","title":"WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeaf421-513b-4c9d-bd36-58af28c86bc1?source=api-prod","affected":[{"type":"plugin","slug":"wp-magazine-modules-lite","name":"WP Magazine Modules Lite","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T05:37:46Z"},{"id":"wordfence:0aeb63e7-a24d-4d76-a8c7-f082dad87a55","source":"wordfence","cve":"CVE-2024-2732","title":"Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeb63e7-a24d-4d76-a8c7-f082dad87a55?source=api-prod","affected":[{"type":"plugin","slug":"themify-shortcodes","name":"Themify Shortcodes","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-26T01:58:55Z"},{"id":"wordfence:0aee8486-59d1-40a2-b200-a6e97318e6ee","source":"wordfence","cve":"CVE-2025-47601","title":"MaxiBlocks <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aee8486-59d1-40a2-b200-a6e97318e6ee?source=api-prod","affected":[{"type":"plugin","slug":"maxi-blocks","name":"MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-10T14:46:16Z"},{"id":"wordfence:0aeef472-0f09-458f-a0dc-b7de190b9b6d","source":"wordfence","cve":"CVE-2023-0371","title":"EmbedSocial \u2013 Social Media Feeds, Reviews and Galleries = 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeef472-0f09-458f-a0dc-b7de190b9b6d?source=api-prod","affected":[{"type":"plugin","slug":"embedalbum-pro","name":"EmbedSocial \u2013 Social Media Feeds, Reviews and Galleries","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0af219a7-6596-47b2-ab8e-a71f20218759","source":"wordfence","cve":"CVE-2025-15019","title":"BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af219a7-6596-47b2-ab8e-a71f20218759?source=api-prod","affected":[{"type":"plugin","slug":"bulk-image-alt-text-with-yoast","name":"Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-01-08T17:58:05Z","updated":"2026-01-09T06:34:56Z"},{"id":"wordfence:0af3c74e-af3e-4dd5-9612-b1a573737276","source":"wordfence","cve":"CVE-2025-48153","title":"Import CDN-Remote Images <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af3c74e-af3e-4dd5-9612-b1a573737276?source=api-prod","affected":[{"type":"plugin","slug":"import-cdn-remote-images","name":"Import CDN-Remote Images","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:13:25Z"},{"id":"wordfence:0af451be-2477-453c-a230-7f3fb804398b","source":"wordfence","cve":"CVE-2023-6520","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af451be-2477-453c-a230-7f3fb804398b?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:35:51Z"},{"id":"wordfence:0af6e55d-def9-4bb1-ade9-56aa8184961c","source":"wordfence","cve":"CVE-2022-4017","title":"Booster (<= 6.0.0), Booster Plus (<= 6.0.0), and Booster Elite (<= 6.0.0) for WooCommerce - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af6e55d-def9-4bb1-ade9-56aa8184961c?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"},{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2023-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0af80be2-b80b-4a25-9df6-a8ae75ad9cdd","source":"wordfence","cve":"CVE-2019-1010257","title":"article2pdf 0.24 - 0.27 - Information Disclosure","severity":"critical","cvss":9.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af80be2-b80b-4a25-9df6-a8ae75ad9cdd?source=api-prod","affected":[{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.24","from_inclusive":true,"to":"0.24","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.25","from_inclusive":true,"to":"0.25","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.26","from_inclusive":true,"to":"0.26","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"article2pdf","name":"article2pdf","from":"0.27","from_inclusive":true,"to":"0.27","to_inclusive":true,"patched_in":""}],"published":"2019-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0af8b7f0-50e4-4988-a82f-963f8b03d067","source":"wordfence","cve":"CVE-2026-39439","title":"WebSamurai <= 1.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af8b7f0-50e4-4988-a82f-963f8b03d067?source=api-prod","affected":[{"type":"plugin","slug":"websamurai","name":"WebSamurai","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-02T14:43:00Z","updated":"2026-10-08T23:21:43Z"},{"id":"wordfence:0af8ff06-68e2-4a0c-9de4-d06a6a2e86c9","source":"wordfence","cve":"CVE-2026-96649","title":"Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af8ff06-68e2-4a0c-9de4-d06a6a2e86c9?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission-manager-lite","name":"Frontend Post Submission Manager Lite \u2013 Guest Post and Frontend Submission Forms","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-09-29T13:55:34Z","updated":"2026-09-30T02:27:20Z"},{"id":"wordfence:0af9df66-8d82-4ae8-85a1-656d8ea40a7a","source":"wordfence","cve":"CVE-2026-9017","title":"NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0af9df66-8d82-4ae8-85a1-656d8ea40a7a?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-07-10T17:40:45Z","updated":"2026-07-11T06:50:32Z"},{"id":"wordfence:0afc702c-4d46-489d-abf1-047b44fbe2fc","source":"wordfence","cve":"CVE-2025-22341","title":"Hide Login+ <= 3.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afc702c-4d46-489d-abf1-047b44fbe2fc?source=api-prod","affected":[{"type":"plugin","slug":"hide-login","name":"Hide Login+","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-19T16:54:06Z"},{"id":"wordfence:0afc98b1-e1ee-4c77-89fc-9ccb045c6733","source":"wordfence","cve":"CVE-2024-33587","title":"Secure Copy Content Protection and Content Locking <= 3.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afc98b1-e1ee-4c77-89fc-9ccb045c6733?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:10:25Z"},{"id":"wordfence:0afcdec7-dd22-4f10-b8f9-96a1e57d8f0b","source":"wordfence","cve":"","title":"Thinkun Remind <= 1.1.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afcdec7-dd22-4f10-b8f9-96a1e57d8f0b?source=api-prod","affected":[{"type":"plugin","slug":"thinkun-remind","name":"Thinkun Remind","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2012-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0afcfe15-2d7d-4c96-a408-28f35577a927","source":"wordfence","cve":"CVE-2025-15466","title":"Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afcfe15-2d7d-4c96-a408-28f35577a927?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2026-01-19T10:31:17Z","updated":"2026-01-19T23:21:52Z"},{"id":"wordfence:0afd981e-3ae8-4450-9750-23ff6fe612dc","source":"wordfence","cve":"CVE-2024-4451","title":"Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afd981e-3ae8-4450-9750-23ff6fe612dc?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.276","to_inclusive":true,"patched_in":"1.0.277"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T06:52:22Z"},{"id":"wordfence:0afdc88e-7a0c-49a1-819e-cb1e263d1f78","source":"wordfence","cve":"CVE-2025-32239","title":"Social Share Buttons & Analytics Plugin \u2013 GetSocial.io <= 4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afdc88e-7a0c-49a1-819e-cb1e263d1f78?source=api-prod","affected":[{"type":"plugin","slug":"wp-share-buttons-analytics-by-getsocial","name":"Social Share Buttons & Analytics Plugin \u2013 GetSocial.io","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T15:37:34Z"},{"id":"wordfence:0afe37bb-fa8a-4e7b-93c6-c44b3fbeb904","source":"wordfence","cve":"CVE-2025-10046","title":"ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0afe37bb-fa8a-4e7b-93c6-c44b3fbeb904?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-google-product-feed-plugin-basic","name":"ELEX WooCommerce Google Shopping (Google Product Feed)","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T06:43:00Z"},{"id":"wordfence:0b03bca1-84e3-4220-b39b-69044c42e9f9","source":"wordfence","cve":"CVE-2025-12966","title":"All-in-One Video Gallery 4.5.4 - 4.5.7 \u2013 Authenticated (Author+) Arbitrary File Upload via Import ZIP","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b03bca1-84e3-4220-b39b-69044c42e9f9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"4.5.4","from_inclusive":true,"to":"4.5.7","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2025-12-05T21:16:07Z","updated":"2025-12-06T09:25:59Z"},{"id":"wordfence:0b040a18-bd85-41c9-9add-65de79f5b79c","source":"wordfence","cve":"CVE-2026-65501","title":"Shiptastic for WooCommerce <= 5.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b040a18-bd85-41c9-9add-65de79f5b79c?source=api-prod","affected":[{"type":"plugin","slug":"shiptastic-for-woocommerce","name":"Shiptastic for WooCommerce","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:43:38Z"},{"id":"wordfence:0b045f3d-8412-4e35-b369-2b485639274d","source":"wordfence","cve":"CVE-2026-18978","title":"LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b045f3d-8412-4e35-b369-2b485639274d?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.9"}],"published":"2026-08-27T15:19:36Z","updated":"2026-08-28T03:39:34Z"},{"id":"wordfence:0b04ab77-880b-423a-bba6-59822f0463bc","source":"wordfence","cve":"CVE-2024-25092","title":"NextMove Lite <= 2.17.0 -  Missing Authorization to Authenticated(Subscriber+) Plugin Activation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b04ab77-880b-423a-bba6-59822f0463bc?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.18.0"}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-13T19:44:34Z"},{"id":"wordfence:0b04ea62-8e6b-4876-a9f8-7bc342e837f4","source":"wordfence","cve":"CVE-2021-24364","title":"Jannah - Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b04ea62-8e6b-4876-a9f8-7bc342e837f4?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"5.4.4"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b070542-83fc-4086-a40d-15a8d31fadc5","source":"wordfence","cve":"CVE-2025-8906","title":"Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b070542-83fc-4086-a40d-15a8d31fadc5?source=api-prod","affected":[{"type":"plugin","slug":"widgets-for-tiktok-video-feed","name":"Widgets for Tiktok Feed","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-09-25T13:31:12Z","updated":"2025-09-26T01:47:26Z"},{"id":"wordfence:0b08fe5c-dbf4-4c22-a403-f5a6495de2f5","source":"wordfence","cve":"CVE-2022-1626","title":"Sharebar <= 1.4.1 - Cross-Site Request Forgery to Settings Update & Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b08fe5c-dbf4-4c22-a403-f5a6495de2f5?source=api-prod","affected":[{"type":"plugin","slug":"sharebar","name":"Sharebar","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b09d496-0e03-48a4-acf7-57febe18ed0a","source":"wordfence","cve":"CVE-2023-6684","title":"Ibtana \u2013 WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b09d496-0e03-48a4-acf7-57febe18ed0a?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.2.1"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b0ff994-0348-48e4-86d4-eb723744f2b0","source":"wordfence","cve":"CVE-2026-11371","title":"BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b0ff994-0348-48e4-86d4-eb723744f2b0?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T21:46:50Z"},{"id":"wordfence:0b151b74-b08c-4d84-aca8-5fb768c84a9e","source":"wordfence","cve":"CVE-2024-13626","title":"VR Frases <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b151b74-b08c-4d84-aca8-5fb768c84a9e?source=api-prod","affected":[{"type":"plugin","slug":"vr-frases","name":"VR-Frases","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-01-27T00:00:00Z","updated":"2025-07-24T19:07:49Z"},{"id":"wordfence:0b16152a-2dbb-4ab2-86af-fbb5f3b25246","source":"wordfence","cve":"CVE-2026-104643","title":"Easy HTTPS Redirection (SSL) <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b16152a-2dbb-4ab2-86af-fbb5f3b25246?source=api-prod","affected":[{"type":"plugin","slug":"https-redirection","name":"Easy HTTPS Redirection (SSL)","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:03:23Z"},{"id":"wordfence:0b1718bd-dce8-4c18-ac3f-a2974af0a671","source":"wordfence","cve":"CVE-2026-27087","title":"Wolverine Framework <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b1718bd-dce8-4c18-ac3f-a2974af0a671?source=api-prod","affected":[{"type":"plugin","slug":"wolverine-framework","name":"Wolverine Framework","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:44:29Z"},{"id":"wordfence:0b1907d5-6588-4646-82f1-620d44624f4e","source":"wordfence","cve":"CVE-2026-62068","title":"Teoro <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b1907d5-6588-4646-82f1-620d44624f4e?source=api-prod","affected":[{"type":"theme","slug":"teoro-wp","name":"Teoro - One Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:39:25Z"},{"id":"wordfence:0b19e8c0-4451-4fe2-9915-e879aa0ab410","source":"wordfence","cve":"CVE-2025-30873","title":"Greenshift <= 11.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b19e8c0-4451-4fe2-9915-e879aa0ab410?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:52:56Z"},{"id":"wordfence:0b2051e8-3195-498a-9d76-8645fd8476c1","source":"wordfence","cve":"CVE-2026-57624","title":"Blocksy Companion Pro <= 2.1.46 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2051e8-3195-498a-9d76-8645fd8476c1?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion-pro","name":"Blocksy Companion Pro","from":"*","from_inclusive":true,"to":"2.1.46","to_inclusive":true,"patched_in":"2.1.47"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:19:27Z"},{"id":"wordfence:0b20d638-82cb-48ce-96fa-fd42d06f649f","source":"wordfence","cve":"CVE-2024-2936","title":"Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b20d638-82cb-48ce-96fa-fd42d06f649f?source=api-prod","affected":[{"type":"plugin","slug":"sydney-toolbox","name":"Sydney Toolbox","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.27"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T05:35:35Z"},{"id":"wordfence:0b2132db-761f-48ff-a737-115e07c77425","source":"wordfence","cve":"CVE-2024-32777","title":"BizPrint <= 4.3.39 - Missing Authorization via showTemplatePreview()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2132db-761f-48ff-a737-115e07c77425?source=api-prod","affected":[{"type":"plugin","slug":"print-google-cloud-print-gcp-woocommerce","name":"Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.","from":"*","from_inclusive":true,"to":"4.3.39","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:05:52Z"},{"id":"wordfence:0b230ff1-4971-4ec5-a0e9-21df90fc6e98","source":"wordfence","cve":"CVE-2020-8417","title":"Code Snippets <= 2.13.3 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b230ff1-4971-4ec5-a0e9-21df90fc6e98?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2020-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b238414-b8fa-4251-8ad4-1bb693b90a27","source":"wordfence","cve":"","title":"Magn WP Drag And Drop Media Uploader <= 1.2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b238414-b8fa-4251-8ad4-1bb693b90a27?source=api-prod","affected":[{"type":"plugin","slug":"magn-html5-drag-and-drop-media-uploader","name":"Magn WP Drag And Drop Media Uploader","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2013-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b25252b-fad3-4212-be72-94e94779ef67","source":"wordfence","cve":"CVE-2023-49819","title":"Structured Content <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b25252b-fad3-4212-be72-94e94779ef67?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b270ec6-8dc1-432b-bf68-671966a9761a","source":"wordfence","cve":"CVE-2024-5151","title":"SULly <= 4.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b270ec6-8dc1-432b-bf68-671966a9761a?source=api-prod","affected":[{"type":"plugin","slug":"sully","name":"SULly","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:19:04Z"},{"id":"wordfence:0b283d17-b89f-467d-8a79-cdf7b9bfdb65","source":"wordfence","cve":"CVE-2026-111109","title":"Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b283d17-b89f-467d-8a79-cdf7b9bfdb65?source=api-prod","affected":[{"type":"plugin","slug":"webmention","name":"Webmention","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"}],"published":"2026-10-30T18:16:01Z","updated":"2026-10-31T06:44:14Z"},{"id":"wordfence:0b284bf9-8720-4417-9433-be147b06023a","source":"wordfence","cve":"CVE-2026-110662","title":"MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b284bf9-8720-4417-9433-be147b06023a?source=api-prod","affected":[{"type":"plugin","slug":"mxchat-basic","name":"MxChat \u2013 AI Chatbot & Content Generation for WordPress","from":"*","from_inclusive":true,"to":"3.2.25","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2026-10-27T17:41:18Z","updated":"2026-10-28T06:45:06Z"},{"id":"wordfence:0b2a2a47-0650-4f80-9b67-017f35954db0","source":"wordfence","cve":"CVE-2025-54669","title":"MapSVG < 8.7.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2a2a47-0650-4f80-9b67-017f35954db0?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.7.4","to_inclusive":false,"patched_in":"8.7.4"}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-11T14:52:35Z"},{"id":"wordfence:0b2e684c-bce5-4709-be44-a84d8f1d6881","source":"wordfence","cve":"CVE-2026-103692","title":"Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2e684c-bce5-4709-be44-a84d8f1d6881?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"3.0.0","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:33:13Z"},{"id":"wordfence:0b2e9103-16a8-4350-97ee-ae05a90850f6","source":"wordfence","cve":"CVE-2026-3424","title":"kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b2e9103-16a8-4350-97ee-ae05a90850f6?source=api-prod","affected":[{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.4.10.3","to_inclusive":true,"patched_in":"5.4.10.4"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T11:30:39Z"},{"id":"wordfence:0b301c6e-a3c5-4435-9bc9-fab18085fe2d","source":"wordfence","cve":"CVE-2026-14503","title":"pCloud WP Backup <= 2.0.3 -  Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b301c6e-a3c5-4435-9bc9-fab18085fe2d?source=api-prod","affected":[{"type":"plugin","slug":"pcloud-wp-backup","name":"pCloud WP Backup","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-07-16T15:14:49Z","updated":"2026-07-17T03:43:42Z"},{"id":"wordfence:0b31e3a8-2202-48f7-9809-b82356ca8765","source":"wordfence","cve":"CVE-2026-86608","title":"Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated Arbitrary User Meta Corruption","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b31e3a8-2202-48f7-9809-b82356ca8765?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"9.8.0","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:11:06Z"},{"id":"wordfence:0b328511-783e-447b-9c6b-2d54f165b59b","source":"wordfence","cve":"CVE-2024-55997","title":"Order Delivery & Pickup Location Date Time ( Free Version ) <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b328511-783e-447b-9c6b-2d54f165b59b?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-pickup-location-date-time-free-version","name":"Order Delivery & Pickup Location Date Time ( Free Version )","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T17:02:38Z"},{"id":"wordfence:0b32c63d-ce6b-4fac-8198-3a598fc84f7a","source":"wordfence","cve":"CVE-2026-22335","title":"WooCommerce Frontend Manager \u2013 Ultimate < 6.7.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b32c63d-ce6b-4fac-8198-3a598fc84f7a?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager-ultimate","name":"WooCommerce Frontend Manager \u2013 Ultimate","from":"*","from_inclusive":true,"to":"6.7.7","to_inclusive":false,"patched_in":"6.7.7"}],"published":"2026-01-15T00:00:00Z","updated":"2026-02-24T22:24:07Z"},{"id":"wordfence:0b3798e3-45fe-4829-9012-dc728d4af87f","source":"wordfence","cve":"CVE-2024-13528","title":"Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b3798e3-45fe-4829-9012-dc728d4af87f?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T09:22:49Z"},{"id":"wordfence:0b395777-2e2a-4dc3-9b0c-ce4c9d22d7e9","source":"wordfence","cve":"CVE-2026-11360","title":"Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b395777-2e2a-4dc3-9b0c-ce4c9d22d7e9?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-06-17T16:45:50Z","updated":"2026-06-18T05:34:28Z"},{"id":"wordfence:0b3acc5f-b2a5-4e7b-a596-9a934fe6ff87","source":"wordfence","cve":"CVE-2021-24456","title":"Quiz Maker <= 6.2.0.8 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b3acc5f-b2a5-4e7b-a596-9a934fe6ff87?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.2.0.9","to_inclusive":false,"patched_in":"6.2.0.9"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b3fa78c-d97f-43bf-b3e9-47d6aa41b458","source":"wordfence","cve":"","title":"Advanced Local Pickup for WooCommerce <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b3fa78c-d97f-43bf-b3e9-47d6aa41b458?source=api-prod","affected":[{"type":"plugin","slug":"advanced-local-pickup-for-woocommerce","name":"Advanced Local Pickup for WooCommerce \u2013 Click & Collect, In-Store Pickup","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b40c664-95e0-4928-a5c2-b26277607ef5","source":"wordfence","cve":"CVE-2026-27057","title":"Penci Filter Everything <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b40c664-95e0-4928-a5c2-b26277607ef5?source=api-prod","affected":[{"type":"plugin","slug":"penci-filter-everything","name":"Penci Filter Everything","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-11T00:00:00Z","updated":"2026-02-26T19:57:53Z"},{"id":"wordfence:0b4178d1-e54d-4902-933d-49f9d4400b0e","source":"wordfence","cve":"CVE-2026-65496","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4178d1-e54d-4902-933d-49f9d4400b0e?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-17T04:13:45Z"},{"id":"wordfence:0b449e4b-8678-4389-a17d-a4f66ac6960f","source":"wordfence","cve":"CVE-2026-105078","title":"WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b449e4b-8678-4389-a17d-a4f66ac6960f?source=api-prod","affected":[{"type":"plugin","slug":"wp-store-locator","name":"WP Store Locator","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:15:08Z"},{"id":"wordfence:0b458e27-331b-4ae2-ade8-8b14aeffb1e2","source":"wordfence","cve":"CVE-2022-47598","title":"WP Super Popup <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b458e27-331b-4ae2-ade8-8b14aeffb1e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-popup","name":"WP Super Popup","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b45b352-4bc4-4338-9812-649541db4f4a","source":"wordfence","cve":"CVE-2026-66477","title":"Gillion <= 4.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b45b352-4bc4-4338-9812-649541db4f4a?source=api-prod","affected":[{"type":"theme","slug":"gillion","name":"Gillion | Multi-Concept Blog/Magazine & Shop WordPress AMP Theme","from":"*","from_inclusive":true,"to":"4.13","to_inclusive":true,"patched_in":"4.14"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:40:08Z"},{"id":"wordfence:0b4651d8-dad7-4f6f-a47d-2095b9d2bdca","source":"wordfence","cve":"CVE-2023-28792","title":"Continuous Image Carousel With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4651d8-dad7-4f6f-a47d-2095b9d2bdca?source=api-prod","affected":[{"type":"plugin","slug":"continuous-image-carousel-with-lightbox","name":"Image Ticker & Logo Slider \u2013 Continuous Auto-Scroll Carousel with Lightbox","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b4860ac-b036-4533-8b70-0942f926c939","source":"wordfence","cve":"CVE-2026-121770","title":"VISeek \u2013 Easy Custom Search <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4860ac-b036-4533-8b70-0942f926c939?source=api-prod","affected":[{"type":"plugin","slug":"viseek-easy-custom-search","name":"VISeek \u2013 Easy Custom Search","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:45Z"},{"id":"wordfence:0b48a35a-1110-4b63-bd7e-cc82350afa0e","source":"wordfence","cve":"CVE-2026-24568","title":"Travel <= 11.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b48a35a-1110-4b63-bd7e-cc82350afa0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":true,"patched_in":"11.1.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-02-03T20:01:44Z"},{"id":"wordfence:0b493316-511d-479f-b65c-c04ecd17171f","source":"wordfence","cve":"CVE-2023-0171","title":"jQuery T(-) Countdown Widget <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b493316-511d-479f-b65c-c04ecd17171f?source=api-prod","affected":[{"type":"plugin","slug":"jquery-t-countdown-widget","name":"jQuery T(-) Countdown Widget","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.24"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b498d75-509c-4533-9493-4f3eab9cbef4","source":"wordfence","cve":"CVE-2026-110069","title":"Modern Events Calendar Lite <= 7.36.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b498d75-509c-4533-9493-4f3eab9cbef4?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.36.0","to_inclusive":true,"patched_in":"7.37.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:31:33Z"},{"id":"wordfence:0b4a0dff-1054-4f50-8ff5-e3cc2b45d77b","source":"wordfence","cve":"","title":"Image Optimizer by 10web <= 1.0.25 - Directory Traversal to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4a0dff-1054-4f50-8ff5-e3cc2b45d77b?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer-wd","name":"Image Optimizer by 10web \u2013 Image Optimizer and Compression plugin","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":false,"patched_in":"1.0.26"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b4b0cd0-dcc2-4790-8aeb-a304088dea3c","source":"wordfence","cve":"","title":"Xerte Online <= 0.35 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4b0cd0-dcc2-4790-8aeb-a304088dea3c?source=api-prod","affected":[{"type":"plugin","slug":"xerte-online","name":"Xerte Online","from":"*","from_inclusive":true,"to":"0.35","to_inclusive":true,"patched_in":"0.36"}],"published":"2013-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b4c6210-4469-4be2-a0c3-5a6f4695ade9","source":"wordfence","cve":"CVE-2026-119508","title":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4c6210-4469-4be2-a0c3-5a6f4695ade9?source=api-prod","affected":[{"type":"plugin","slug":"radius-booking","name":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2026-11-07T10:18:00Z","updated":"2026-11-10T19:31:51Z"},{"id":"wordfence:0b4cb873-77b7-44f9-820c-38e5d43393f3","source":"wordfence","cve":"CVE-2024-12406","title":"Library Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4cb873-77b7-44f9-820c-38e5d43393f3?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-12-11T15:36:49Z","updated":"2025-10-23T20:15:16Z"},{"id":"wordfence:0b4cbe21-9f1b-425b-8141-ae075baaf717","source":"wordfence","cve":"CVE-2025-12349","title":"Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4cbe21-9f1b-425b-8141-ae075baaf717?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":"5.9.11"}],"published":"2025-11-18T16:15:48Z","updated":"2025-11-19T04:28:19Z"},{"id":"wordfence:0b4e6dae-f38c-4f5b-ae1d-cf998946c675","source":"wordfence","cve":"CVE-2023-2527","title":"Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.2.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4e6dae-f38c-4f5b-ae1d-cf998946c675?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zoho","name":"WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u2013 CRM, Bigin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b4ec57a-c52a-40c1-897a-db67efbd7177","source":"wordfence","cve":"CVE-2017-17094","title":"WordPress Core < 4.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4ec57a-c52a-40c1-897a-db67efbd7177?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.21","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2017-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b5148bc-d06a-4857-b780-92c370098ff3","source":"wordfence","cve":"CVE-2025-49400","title":"PressApps Knowledge Base Contextual Sidebar Addon <= 4.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b5148bc-d06a-4857-b780-92c370098ff3?source=api-prod","affected":[{"type":"plugin","slug":"pressapps-knowledge-base","name":"PressApps Knowledge Base Contextual Sidebar Addon","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:24:20Z"},{"id":"wordfence:0b51caf3-eff4-491f-b354-7d8939548a64","source":"wordfence","cve":"CVE-2023-48771","title":"File Gallery <= 1.8.5.4 - Reflected Cross-Site Scripting via post_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b51caf3-eff4-491f-b354-7d8939548a64?source=api-prod","affected":[{"type":"plugin","slug":"file-gallery","name":"File Gallery","from":"*","from_inclusive":true,"to":"1.8.5.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b52cc2a-c511-4801-8a95-f90d8d980c85","source":"wordfence","cve":"CVE-2021-24931","title":"Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b52cc2a-c511-4801-8a95-f90d8d980c85?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b53e5a4-1a56-41a7-b00c-484b1a93dfe4","source":"wordfence","cve":"CVE-2026-84744","title":"WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b53e5a4-1a56-41a7-b00c-484b1a93dfe4?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"1.5.0.1","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.2.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:51:43Z"},{"id":"wordfence:0b540fed-e358-485f-8c12-f2241078459a","source":"wordfence","cve":"CVE-2013-6797","title":"Blue Wrench Video Widget < 2.0.0 - Cross-Site Request Forgery and to Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b540fed-e358-485f-8c12-f2241078459a?source=api-prod","affected":[{"type":"plugin","slug":"blue-wrench-videos-widget","name":"Blue Wrench Video Widget","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2013-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b56f54b-978e-41ea-8cbe-846facb71cd3","source":"wordfence","cve":"CVE-2026-8703","title":"Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b56f54b-978e-41ea-8cbe-846facb71cd3?source=api-prod","affected":[{"type":"plugin","slug":"endless-scroll","name":"Endless Scroll","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:42Z","updated":"2026-05-27T05:31:19Z"},{"id":"wordfence:0b57a51f-7989-4e99-a339-70f831405696","source":"wordfence","cve":"CVE-2026-16734","title":"Stripe Payment Forms by WP Full Pay <= 8.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b57a51f-7989-4e99-a339-70f831405696?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.1","to_inclusive":true,"patched_in":"8.5.2"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-15T21:47:45Z"},{"id":"wordfence:0b5894d8-0d3c-44cc-94a3-d8a46e0c0ef2","source":"wordfence","cve":"CVE-2025-26869","title":"Build <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b5894d8-0d3c-44cc-94a3-d8a46e0c0ef2?source=api-prod","affected":[{"type":"theme","slug":"build","name":"Build","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:57:52Z"},{"id":"wordfence:0b606ded-ab50-486a-9337-97ee9f452f12","source":"wordfence","cve":"CVE-2026-0740","title":"Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.26","to_inclusive":true,"patched_in":"3.3.27"}],"published":"2026-04-06T15:57:44Z","updated":"2026-04-07T04:26:00Z"},{"id":"wordfence:0b658052-f283-4a47-a440-dbd7acded186","source":"wordfence","cve":"CVE-2025-15611","title":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups < 5.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b658052-f283-4a47-a440-dbd7acded186?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":false,"patched_in":"5.5.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:11:26Z"},{"id":"wordfence:0b668f45-c7fb-481b-bc8e-115e5b7248c9","source":"wordfence","cve":"CVE-2023-3122","title":"GD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b668f45-c7fb-481b-bc8e-115e5b7248c9?source=api-prod","affected":[{"type":"plugin","slug":"gd-mail-queue","name":"GD Mail Queue","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2023-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b6a84d7-9e77-4a2f-b065-872e8650e75e","source":"wordfence","cve":"CVE-2025-14000","title":"Membership Plugin \u2013 Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b6a84d7-9e77-4a2f-b065-872e8650e75e?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2025-12-22T00:00:00Z","updated":"2025-12-23T11:13:54Z"},{"id":"wordfence:0b6e9430-bb78-47c3-9958-4f40028c3d93","source":"wordfence","cve":"CVE-2014-2598","title":"Quick Page/Post Redirect Plugin < 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b6e9430-bb78-47c3-9958-4f40028c3d93?source=api-prod","affected":[{"type":"plugin","slug":"quick-pagepost-redirect-plugin","name":"Quick Page/Post Redirect Plugin","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":false,"patched_in":"5.0.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b7073e8-10cf-4fe0-9eb6-f9acd509598c","source":"wordfence","cve":"CVE-2015-1383","title":"Geo Mashup < 1.8.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b7073e8-10cf-4fe0-9eb6-f9acd509598c?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2015-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b7234b0-edfc-417c-8ef4-394d62cf83f7","source":"wordfence","cve":"CVE-2024-35758","title":"Interface <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b7234b0-edfc-417c-8ef4-394d62cf83f7?source=api-prod","affected":[{"type":"theme","slug":"interface","name":"Interface","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-01T19:26:16Z"},{"id":"wordfence:0b72cf6f-4924-4fa5-8e1a-4054dfe73be0","source":"wordfence","cve":"CVE-2023-5435","title":"Up down image slideshow gallery <= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b72cf6f-4924-4fa5-8e1a-4054dfe73be0?source=api-prod","affected":[{"type":"plugin","slug":"up-down-image-slideshow-gallery","name":"Up down image slideshow gallery","from":"*","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":"12.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b738d0a-39e2-46e3-9b62-920599543220","source":"wordfence","cve":"CVE-2025-69328","title":"Booking and Rental Manager <= 2.5.9 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b738d0a-39e2-46e3-9b62-920599543220?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:03:19Z"},{"id":"wordfence:0b748dc9-4d44-41dd-b159-380214e7646a","source":"wordfence","cve":"CVE-2014-4944","title":"BSK PDF Manager <= 1.4 - Authenticated SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b748dc9-4d44-41dd-b159-380214e7646a?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b751496-86b1-4480-98d6-28579e4044a0","source":"wordfence","cve":"CVE-2026-25454","title":"The League <= 4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b751496-86b1-4480-98d6-28579e4044a0?source=api-prod","affected":[{"type":"theme","slug":"the-league","name":"The League - Sports News & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:12:03Z"},{"id":"wordfence:0b75c681-ecd2-4603-8819-07b2e9b8d547","source":"wordfence","cve":"CVE-2022-3180","title":"WPGateway <= 3.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b75c681-ecd2-4603-8819-07b2e9b8d547?source=api-prod","affected":[{"type":"plugin","slug":"wpgateway","name":"WPGateway","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2022-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b75cad9-9f76-4839-8eb2-40d84662846d","source":"wordfence","cve":"CVE-2026-4267","title":"Query Monitor <= 3.20.3 - Reflected Cross-Site Scripting via Request URI","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b75cad9-9f76-4839-8eb2-40d84662846d?source=api-prod","affected":[{"type":"plugin","slug":"query-monitor","name":"Query Monitor","from":"*","from_inclusive":true,"to":"3.20.3","to_inclusive":true,"patched_in":"3.20.4"}],"published":"2026-03-30T23:21:22Z","updated":"2026-04-06T15:18:46Z"},{"id":"wordfence:0b768777-d502-47b4-bf78-03c4cd525063","source":"wordfence","cve":"CVE-2024-47371","title":"WP MyLinks <= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b768777-d502-47b4-bf78-03c4cd525063?source=api-prod","affected":[{"type":"plugin","slug":"wp-mylinks","name":"WP MyLinks","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:27:02Z"},{"id":"wordfence:0b77243f-f48b-4a94-9d60-bf96dc26fe77","source":"wordfence","cve":"CVE-2025-14109","title":"AH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b77243f-f48b-4a94-9d60-bf96dc26fe77?source=api-prod","affected":[{"type":"plugin","slug":"ah-shortcodes","name":"AH Shortcodes","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:47:21Z","updated":"2026-01-07T09:20:51Z"},{"id":"wordfence:0b787d6f-d002-4f09-8336-ebb91321e20b","source":"wordfence","cve":"CVE-2025-3105","title":"Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b787d6f-d002-4f09-8336-ebb91321e20b?source=api-prod","affected":[{"type":"plugin","slug":"vehica-core","name":"Vehica Core","from":"*","from_inclusive":true,"to":"1.0.97","to_inclusive":true,"patched_in":"1.0.98"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-04T07:27:42Z"},{"id":"wordfence:0b78d34f-6702-45dd-ba56-46e9c547bc9f","source":"wordfence","cve":"CVE-2026-19945","title":"WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b78d34f-6702-45dd-ba56-46e9c547bc9f?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-09-08T15:51:37Z","updated":"2026-09-09T04:28:34Z"},{"id":"wordfence:0b79a851-1212-4a9c-89fe-b5f2d50ec18c","source":"wordfence","cve":"CVE-2023-0546","title":"FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b79a851-1212-4a9c-89fe-b5f2d50ec18c?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"4.3.25"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b7d7b64-8194-4b81-83f5-1f3b23109455","source":"wordfence","cve":"","title":"Guest Author <= 2.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b7d7b64-8194-4b81-83f5-1f3b23109455?source=api-prod","affected":[{"type":"plugin","slug":"guest-author","name":"Guest Author","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b7da6f7-d486-44e5-9eeb-21feb119a48b","source":"wordfence","cve":"CVE-2022-37342","title":"Add Shortcodes Actions And Filters <= 2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b7da6f7-d486-44e5-9eeb-21feb119a48b?source=api-prod","affected":[{"type":"plugin","slug":"add-actions-and-filters","name":"Add Shortcodes Actions And Filters","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b80d2d5-1b2c-4bc8-aba6-dc9266005d36","source":"wordfence","cve":"CVE-2026-28053","title":"Miller <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b80d2d5-1b2c-4bc8-aba6-dc9266005d36?source=api-prod","affected":[{"type":"theme","slug":"christine-miller","name":"Miller | Personal Assistant & Administrative Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:10:06Z"},{"id":"wordfence:0b80e90d-72bd-4253-b84b-d2706e1abd4c","source":"wordfence","cve":"CVE-2023-49821","title":"LiveChat <= 4.5.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b80e90d-72bd-4253-b84b-d2706e1abd4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-software-for-wordpress","name":"LiveChat \u2013 Live Chat Plugin for WP Websites","from":"*","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"4.5.16"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b82f5da-42ef-40b4-bfa4-26b88a3328db","source":"wordfence","cve":"CVE-2017-12946","title":"Easy Modal < 2.1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b82f5da-42ef-40b4-bfa4-26b88a3328db?source=api-prod","affected":[{"type":"plugin","slug":"easy-modal","name":"Easy Modal","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b82fae0-4eec-41ea-90e2-9d08258805b3","source":"wordfence","cve":"CVE-2023-41131","title":"Sp*tify Play Button for WordPress <= 2.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b82fae0-4eec-41ea-90e2-9d08258805b3?source=api-prod","affected":[{"type":"plugin","slug":"spotify-play-button-for-wordpress","name":"Sp*tify Play Button for WordPress","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"2.11"}],"published":"2023-10-03T00:00:00Z","updated":"2024-11-15T15:24:51Z"},{"id":"wordfence:0b85fc9c-f98d-44c5-8c5e-b9541c6c83b0","source":"wordfence","cve":"CVE-2025-69028","title":"weForms <= 1.6.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b85fc9c-f98d-44c5-8c5e-b9541c6c83b0?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.25","to_inclusive":true,"patched_in":"1.6.26"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:58:53Z"},{"id":"wordfence:0b870d35-7e10-4fb5-8c3b-2bf299d1f3d5","source":"wordfence","cve":"CVE-2026-6555","title":"ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b870d35-7e10-4fb5-8c3b-2bf299d1f3d5?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-05-19T12:03:25Z","updated":"2026-06-23T00:48:26Z"},{"id":"wordfence:0b88ab64-26c7-4182-bd46-c5f5df052af3","source":"wordfence","cve":"CVE-2025-31771","title":"Team Members for Elementor Page Builder <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b88ab64-26c7-4182-bd46-c5f5df052af3?source=api-prod","affected":[{"type":"plugin","slug":"team-members-for-elementor","name":"Team Members for Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:24:46Z"},{"id":"wordfence:0b8a9c85-a7cd-469c-834b-d1d89387cf63","source":"wordfence","cve":"CVE-2014-7956","title":"Pods <= 2.4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b8a9c85-a7cd-469c-834b-d1d89387cf63?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.5"}],"published":"2015-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b8af407-b49d-4d3f-a7a5-c3ad3d56fcba","source":"wordfence","cve":"","title":"WP Statistics <= 8.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b8af407-b49d-4d3f-a7a5-c3ad3d56fcba?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":"8.5"}],"published":"2014-12-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b8d337b-2d2c-4769-9ac0-6e22ba39a42f","source":"wordfence","cve":"CVE-2021-25096","title":"IP2Location Country Blocker <= 2.26.4 - Ban Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b8d337b-2d2c-4769-9ac0-6e22ba39a42f?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.26.4","to_inclusive":true,"patched_in":"2.26.5"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b8dcab4-dd13-4c08-8623-37a50dcbda1b","source":"wordfence","cve":"CVE-2021-24696","title":"Simple Download Monitor <= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b8dcab4-dd13-4c08-8623-37a50dcbda1b?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b90503b-6186-48b5-a85a-3602f318872e","source":"wordfence","cve":"CVE-2018-6468","title":"flickrRSS <= 5.3.1 - Cross-Site Scripting via flickrRSS_id","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b90503b-6186-48b5-a85a-3602f318872e?source=api-prod","affected":[{"type":"plugin","slug":"flickr-rss","name":"flickrRSS","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":""}],"published":"2018-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0b922cd8-870e-4297-bd75-7e8f3e7e6e1f","source":"wordfence","cve":"CVE-2026-24596","title":"Related Posts Thumbnails Plugin for WordPress <= 4.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b922cd8-870e-4297-bd75-7e8f3e7e6e1f?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-thumbnails","name":"Related Posts Thumbnails","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-01-15T00:00:00Z","updated":"2026-03-17T21:31:24Z"},{"id":"wordfence:0b92afdf-51e0-4cf5-9f2b-997b9ff98b23","source":"wordfence","cve":"CVE-2025-3863","title":"Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b92afdf-51e0-4cf5-9f2b-997b9ff98b23?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel-slider-for-elementor","name":"Post Carousel Slider for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-06-25T13:45:39Z","updated":"2025-06-26T02:06:32Z"},{"id":"wordfence:0b93b20c-32ff-467f-82f7-31ef2bf13d8e","source":"wordfence","cve":"CVE-2026-113485","title":"Media Library Assistant < 3.42 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b93b20c-32ff-467f-82f7-31ef2bf13d8e?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":false,"patched_in":"3.42"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:26:18Z"},{"id":"wordfence:0b95749b-c522-42cd-aa99-36bdf15541c3","source":"wordfence","cve":"CVE-2022-4110","title":"Eventify < 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b95749b-c522-42cd-aa99-36bdf15541c3?source=api-prod","affected":[{"type":"plugin","slug":"eventify","name":"Eventify \u2013 Events, Lists and Calendar","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2022-11-30T00:00:00Z","updated":"2026-10-28T21:02:30Z"},{"id":"wordfence:0b9a9a95-1041-4c40-94da-d871aa876cdc","source":"wordfence","cve":"CVE-2026-93944","title":"Camelia | Floral Studio Florist WordPress Theme <= 1.2.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9a9a95-1041-4c40-94da-d871aa876cdc?source=api-prod","affected":[{"type":"theme","slug":"camelia","name":"Camelia | Floral Studio Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:52:15Z","updated":"2026-10-13T14:29:47Z"},{"id":"wordfence:0b9b6f5b-54e0-4603-abd7-394c7bd2af54","source":"wordfence","cve":"CVE-2025-14358","title":"REHub Framework <= 19.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9b6f5b-54e0-4603-abd7-394c7bd2af54?source=api-prod","affected":[{"type":"plugin","slug":"rehub-framework","name":"reHub Framework","from":"*","from_inclusive":true,"to":"19.9.5","to_inclusive":true,"patched_in":"19.9.9.6"}],"published":"2026-01-07T00:00:00Z","updated":"2026-02-24T22:16:07Z"},{"id":"wordfence:0b9e11f5-5a05-4867-abd8-fb07c84a49b0","source":"wordfence","cve":"CVE-2026-4086","title":"WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e11f5-5a05-4867-abd8-fb07c84a49b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-random-button","name":"WP Random Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:00Z","updated":"2026-03-21T03:26:32Z"},{"id":"wordfence:0b9e18b2-b49a-4833-8f3c-1b95477325d5","source":"wordfence","cve":"CVE-2025-24770","title":"CraftXtore <= 1.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e18b2-b49a-4833-8f3c-1b95477325d5?source=api-prod","affected":[{"type":"theme","slug":"bw-craftxtore","name":"CraftXtore - Handmade, Ceramics and Pottery Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T13:48:01Z"},{"id":"wordfence:0b9e6f21-4c26-4ff8-9d0f-c66cd537fdcc","source":"wordfence","cve":"CVE-2024-12590","title":"WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e6f21-4c26-4ff8-9d0f-c66cd537fdcc?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-gallery","name":"WP Youtube Gallery","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-01-06T15:04:02Z","updated":"2025-01-30T22:30:21Z"},{"id":"wordfence:0b9f4615-278f-4762-98ce-5c9d806da1a5","source":"wordfence","cve":"CVE-2024-37103","title":"Education Zone <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9f4615-278f-4762-98ce-5c9d806da1a5?source=api-prod","affected":[{"type":"theme","slug":"education-zone","name":"Education Zone","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:46:58Z"},{"id":"wordfence:0ba153e1-b46c-404d-81ec-21bc7dfa3d8a","source":"wordfence","cve":"CVE-2026-86448","title":"LearnPress <= 4.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba153e1-b46c-404d-81ec-21bc7dfa3d8a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:57:19Z"},{"id":"wordfence:0ba32415-cd57-4927-a405-27f3960d542d","source":"wordfence","cve":"CVE-2026-88930","title":"Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba32415-cd57-4927-a405-27f3960d542d?source=api-prod","affected":[{"type":"plugin","slug":"social-web-suite","name":"Social Web Suite \u2013 Social Media Auto Post, Social Media Auto Publish","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:19:22Z"},{"id":"wordfence:0ba551a4-109d-4e28-b497-539264095134","source":"wordfence","cve":"","title":"WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3","severity":"medium","cvss":5.3,"cwe":"CWE-324","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba551a4-109d-4e28-b497-539264095134?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.12","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.2.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.2.13"}],"published":"2021-11-10T00:00:00Z","updated":"2024-02-07T15:16:07Z"},{"id":"wordfence:0ba5da2b-6944-4243-a4f2-0f887abf7a66","source":"wordfence","cve":"CVE-2024-1514","title":"WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba5da2b-6944-4243-a4f2-0f887abf7a66?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:05Z"},{"id":"wordfence:0ba9568f-8ecc-4395-a5a4-bdbb280d3c37","source":"wordfence","cve":"CVE-2025-23485","title":"RS Survey <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba9568f-8ecc-4395-a5a4-bdbb280d3c37?source=api-prod","affected":[{"type":"plugin","slug":"rs-survey","name":"RS Survey","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T18:45:39Z"},{"id":"wordfence:0baaa6b7-3884-465e-bae3-46edab6312d4","source":"wordfence","cve":"CVE-2025-11760","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2025-10-24T13:42:10Z","updated":"2025-10-25T01:45:56Z"},{"id":"wordfence:0baad93a-cc04-486f-afbd-964deb7d54b2","source":"wordfence","cve":"CVE-2026-89004","title":"WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0baad93a-cc04-486f-afbd-964deb7d54b2?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.25","to_inclusive":true,"patched_in":"2.8.26"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:57:01Z"},{"id":"wordfence:0bac75e0-f7cb-44b8-8267-043b359a8671","source":"wordfence","cve":"CVE-2025-30851","title":"Tickera <= 3.5.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bac75e0-f7cb-44b8-8267-043b359a8671?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.5.2","to_inclusive":true,"patched_in":"3.5.5.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:31:25Z"},{"id":"wordfence:0bad2522-434c-4f0e-a39d-203c24a4f29a","source":"wordfence","cve":"CVE-2026-87971","title":"If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bad2522-434c-4f0e-a39d-203c24a4f29a?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"1.4.4","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:25:46Z"},{"id":"wordfence:0bae0ab5-05c9-41f2-a51d-fb9eaf81e0f8","source":"wordfence","cve":"CVE-2025-32150","title":"Real Estate Manager <= 7.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bae0ab5-05c9-41f2-a51d-fb9eaf81e0f8?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:0bb02fd7-1090-4139-ae0e-977fdec5da7f","source":"wordfence","cve":"CVE-2025-8462","title":"RT Easy Builder <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb02fd7-1090-4139-ae0e-977fdec5da7f?source=api-prod","affected":[{"type":"plugin","slug":"rt-easy-builder-advanced-addons-for-elementor","name":"RT Easy Builder \u2013 Advanced addons for Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-08-11T13:48:34Z","updated":"2026-09-22T18:41:00Z"},{"id":"wordfence:0bb11092-4367-4f51-9dd7-22fbd655a03f","source":"wordfence","cve":"CVE-2025-7852","title":"WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-07-23T16:22:34Z","updated":"2025-07-24T04:24:12Z"},{"id":"wordfence:0bb13936-cbc0-4cba-bd62-ef6d9728a65a","source":"wordfence","cve":"CVE-2016-1000127","title":"AJAX Random Post <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb13936-cbc0-4cba-bd62-ef6d9728a65a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-random-post","name":"ajax-random-post","from":"*","from_inclusive":true,"to":"2.00","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bb28557-7023-481f-a05b-0b9a22d7a456","source":"wordfence","cve":"CVE-2025-14170","title":"Vimeo SimpleGallery <= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb28557-7023-481f-a05b-0b9a22d7a456?source=api-prod","affected":[{"type":"plugin","slug":"vimeo-simplegallery","name":"Vimeo SimpleGallery","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:25:50Z","updated":"2026-03-27T10:44:48Z"},{"id":"wordfence:0bb43b6c-4f14-401c-9964-1c4c19fc9e51","source":"wordfence","cve":"","title":"Title Field Validation <= 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb43b6c-4f14-401c-9964-1c4c19fc9e51?source=api-prod","affected":[{"type":"plugin","slug":"title-field-validation","name":"Title Field Validation","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bb76d11-f16f-4067-a786-37b8e553b609","source":"wordfence","cve":"CVE-2025-47658","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb76d11-f16f-4067-a786-37b8e553b609?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-05-08T00:00:00Z","updated":"2025-11-21T17:52:56Z"},{"id":"wordfence:0bb7920b-2999-4bd3-bfef-3b9971f845e9","source":"wordfence","cve":"CVE-2022-4795","title":"Galleries by Angie Makes <= 1.67 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb7920b-2999-4bd3-bfef-3b9971f845e9?source=api-prod","affected":[{"type":"plugin","slug":"wc-shortcodes","name":"Shortcodes by Angie Makes","from":"*","from_inclusive":true,"to":"1.67","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bb90162-314a-4d49-8fd3-2b1b42c5ad63","source":"wordfence","cve":"CVE-2024-31942","title":"Calendarista Basic Edition <= 3.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb90162-314a-4d49-8fd3-2b1b42c5ad63?source=api-prod","affected":[{"type":"plugin","slug":"calendarista-basic-edition","name":"Calendarista Basic Edition \u2013 WordPress appointment booking system","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:04:41Z"},{"id":"wordfence:0bb96da1-9c17-4264-ac29-b5ff8dec745d","source":"wordfence","cve":"CVE-2026-2419","title":"WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb96da1-9c17-4264-ac29-b5ff8dec745d?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.69","to_inclusive":true,"patched_in":"1.69.1"}],"published":"2026-02-17T19:12:08Z","updated":"2026-09-16T18:12:41Z"},{"id":"wordfence:0bba24d4-d906-4e00-a98f-25934e927641","source":"wordfence","cve":"CVE-2025-53340","title":"Awesome Support <= 6.3.6 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bba24d4-d906-4e00-a98f-25934e927641?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"6.3.7"}],"published":"2025-08-14T00:00:00Z","updated":"2026-01-13T17:06:12Z"},{"id":"wordfence:0bba9e06-4c5b-43e4-a51b-af57c5390c8a","source":"wordfence","cve":"CVE-2022-29432","title":"wpDataTables <= 2.1.27 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bba9e06-4c5b-43e4-a51b-af57c5390c8a?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.28"}],"published":"2022-05-06T13:37:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bbb2ae1-4e5a-47cc-827c-5102d0a51690","source":"wordfence","cve":"CVE-2026-106010","title":"BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbb2ae1-4e5a-47cc-827c-5102d0a51690?source=api-prod","affected":[{"type":"plugin","slug":"bdm-digital-payment-gateway","name":"BDM Digital Payment Gateway","from":"1.2.7","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-28T21:20:54Z"},{"id":"wordfence:0bbbefce-4451-410d-bc19-f489318dda4a","source":"wordfence","cve":"CVE-2023-38395","title":"WP Clone Menu <= 1.0.1 - Missing Authorization to Menu Clone","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbbefce-4451-410d-bc19-f489318dda4a?source=api-prod","affected":[{"type":"plugin","slug":"clone-menu","name":"WP Clone Menu","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bbdbd0f-19cc-4a1e-9167-fbdb6d45ffbe","source":"wordfence","cve":"CVE-2017-18572","title":"GNUCommerce < 1.4.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbdbd0f-19cc-4a1e-9167-fbdb6d45ffbe?source=api-prod","affected":[{"type":"plugin","slug":"gnucommerce","name":"GNUCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b","source":"wordfence","cve":"CVE-2025-13512","title":"CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b?source=api-prod","affected":[{"type":"plugin","slug":"cosign-sso","name":"CoSign Single Signon","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:39:21Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:0bc1ebf6-2797-43cc-8c7a-930da29d6c78","source":"wordfence","cve":"CVE-2022-2115","title":"Popup Anything \u2013 A Marketing Popup and Lead Generation Conversions <= 2.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc1ebf6-2797-43cc-8c7a-930da29d6c78?source=api-prod","affected":[{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bc1f99e-1aa8-431a-a2ab-bdee5ece602f","source":"wordfence","cve":"CVE-2022-30545","title":"5 Anker Connect <= 1.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc1f99e-1aa8-431a-a2ab-bdee5ece602f?source=api-prod","affected":[{"type":"plugin","slug":"5-anker-connect","name":"5 Anker Connect","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bc330d5-7362-4158-90dc-b4ccb5e58ff3","source":"wordfence","cve":"CVE-2025-32161","title":"Arkhe Blocks <= 2.27.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc330d5-7362-4158-90dc-b4ccb5e58ff3?source=api-prod","affected":[{"type":"plugin","slug":"arkhe-blocks","name":"Arkhe Blocks","from":"*","from_inclusive":true,"to":"2.27.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T18:39:35Z"},{"id":"wordfence:0bc772a6-95a1-4420-bd97-1778002e2168","source":"wordfence","cve":"CVE-2023-5823","title":"TK Google Fonts GDPR Compliant <= 2.2.11 - Missing Authorization to Font Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc772a6-95a1-4420-bd97-1778002e2168?source=api-prod","affected":[{"type":"plugin","slug":"tk-google-fonts","name":"TK Google Fonts","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bc784d4-4ecc-4f28-8e35-9e96e10a751c","source":"wordfence","cve":"CVE-2025-30917","title":"SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc784d4-4ecc-4f28-8e35-9e96e10a751c?source=api-prod","affected":[{"type":"plugin","slug":"sku-for-woocommerce","name":"SKU Generator for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:44:12Z"},{"id":"wordfence:0bc7ad47-aac9-4192-af04-234962f46f49","source":"wordfence","cve":"CVE-2024-35169","title":"All Bootstrap Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc7ad47-aac9-4192-af04-234962f46f49?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:19:13Z"},{"id":"wordfence:0bc7f5dd-a1eb-442d-9913-e391208e7f26","source":"wordfence","cve":"CVE-2023-34033","title":"Ajax Pagination and Infinite Scroll <= 2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bc7f5dd-a1eb-442d-9913-e391208e7f26?source=api-prod","affected":[{"type":"plugin","slug":"malinky-ajax-pagination","name":"Ajax Pagination and Infinite Scroll","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bcc1457-abbc-4bd9-a0a8-80e3d5624d95","source":"wordfence","cve":"CVE-2023-36506","title":"YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bcc1457-abbc-4bd9-a0a8-80e3d5624d95?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-waiting-list","name":"YITH WooCommerce Waitlist","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bd20f7e-ed2a-4890-b337-9763cfd67bd1","source":"wordfence","cve":"CVE-2026-116854","title":"WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd20f7e-ed2a-4890-b337-9763cfd67bd1?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":"8.4.1"}],"published":"2026-10-30T07:21:31Z","updated":"2026-11-03T19:34:40Z"},{"id":"wordfence:0bd24676-7ac3-4e8b-90a2-0cb754eea764","source":"wordfence","cve":"CVE-2026-84936","title":"EmbedPress \u2013 PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd24676-7ac3-4e8b-90a2-0cb754eea764?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"4.6.0","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:54:52Z"},{"id":"wordfence:0bd35ef1-ed28-44db-a1f6-74bc83974c71","source":"wordfence","cve":"CVE-2024-32792","title":"Hummingbird <= 3.7.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd35ef1-ed28-44db-a1f6-74bc83974c71?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:50:10Z"},{"id":"wordfence:0bd92f91-d9b1-4f6f-ac1a-477950ea2e80","source":"wordfence","cve":"CVE-2026-1431","title":"Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd92f91-d9b1-4f6f-ac1a-477950ea2e80?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.13","to_inclusive":true,"patched_in":"10.14.14"}],"published":"2026-01-30T16:06:31Z","updated":"2026-01-31T04:35:15Z"},{"id":"wordfence:0bde3052-ae8e-4434-962a-88d3c8328a9c","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'redirectionPageContent' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bde3052-ae8e-4434-962a-88d3c8328a9c?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bdf70f2-36a0-4a6a-bd95-6216c0ce4ab4","source":"wordfence","cve":"CVE-2025-49278","title":"Blogty <= 1.0.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bdf70f2-36a0-4a6a-bd95-6216c0ce4ab4?source=api-prod","affected":[{"type":"theme","slug":"blogty","name":"Blogty","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:35:35Z"},{"id":"wordfence:0bdf8765-1774-4d05-892a-055a06104e87","source":"wordfence","cve":"CVE-2026-42638","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bdf8765-1774-4d05-892a-055a06104e87?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.1.1"}],"published":"2026-10-05T16:18:22Z","updated":"2026-10-08T23:50:33Z"},{"id":"wordfence:0be21ac7-4f61-44fc-9ffc-ab65faa549f6","source":"wordfence","cve":"","title":"tencentcloud-cos <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be21ac7-4f61-44fc-9ffc-ab65faa549f6?source=api-prod","affected":[{"type":"plugin","slug":"tencentcloud-cos","name":"tencentcloud-cos","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0be418fa-f1cf-4aaf-bc94-c8e04186a54b","source":"wordfence","cve":"CVE-2023-4628","title":"LadiApp <= 4.4 - Cross-Site Request Forgery via ladiflow_save_hook()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be418fa-f1cf-4aaf-bc94-c8e04186a54b?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:54Z"},{"id":"wordfence:0be428ae-40ae-4cc0-82ad-d121b6d2d27e","source":"wordfence","cve":"CVE-2023-0712","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be428ae-40ae-4cc0-82ad-d121b6d2d27e?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0be5795a-9eea-40fc-9783-dbf501a2144d","source":"wordfence","cve":"CVE-2025-30587","title":"LH OGP Meta <= 1.73 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be5795a-9eea-40fc-9783-dbf501a2144d?source=api-prod","affected":[{"type":"plugin","slug":"lh-ogp-meta-tags","name":"LH OGP Meta","from":"*","from_inclusive":true,"to":"1.73","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:02:38Z"},{"id":"wordfence:0be6658d-aec8-404c-a994-bde10a3cdbac","source":"wordfence","cve":"CVE-2025-12751","title":"WSChat \u2013 WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be6658d-aec8-404c-a994-bde10a3cdbac?source=api-prod","affected":[{"type":"plugin","slug":"wschat-live-chat","name":"WSChat \u2013 WordPress Live Chat","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2025-11-18T17:25:44Z","updated":"2025-11-19T05:45:11Z"},{"id":"wordfence:0be84866-2a49-42da-b498-962fc1bcb811","source":"wordfence","cve":"CVE-2023-51669","title":"Product Code for WooCommerce <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be84866-2a49-42da-b498-962fc1bcb811?source=api-prod","affected":[{"type":"plugin","slug":"product-code-for-woocommerce","name":"Product Code for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0be8c668-0f1c-4f83-8a71-49c8bb9b67ae","source":"wordfence","cve":"CVE-2023-2084","title":"Essential Blocks <= 4.0.6 - Missing Authorization via get","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0be8c668-0f1c-4f83-8a71-49c8bb9b67ae?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0beaa7ce-40aa-429e-80fd-d04e75489b92","source":"wordfence","cve":"CVE-2023-46636","title":"Custom Header Images <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0beaa7ce-40aa-429e-80fd-d04e75489b92?source=api-prod","affected":[{"type":"plugin","slug":"custom-header-images","name":"Custom Header Images","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0beed2f2-3d20-4e09-9db2-129824889839","source":"wordfence","cve":"CVE-2026-39716","title":"Flipmart <= 2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0beed2f2-3d20-4e09-9db2-129824889839?source=api-prod","affected":[{"type":"theme","slug":"flipmart","name":"Flipmart - MegaOne Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-02T00:00:00Z","updated":"2026-05-05T15:50:42Z"},{"id":"wordfence:0bef7f4a-3a1d-406e-905d-3051f1ee409d","source":"wordfence","cve":"CVE-2024-50453","title":"The Pack Elementor addons <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bef7f4a-3a1d-406e-905d-3051f1ee409d?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:02:08Z"},{"id":"wordfence:0bef99e0-1c97-4058-83a4-faa36ebcbf1f","source":"wordfence","cve":"CVE-2024-51931","title":"AzonBox <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bef99e0-1c97-4058-83a4-faa36ebcbf1f?source=api-prod","affected":[{"type":"plugin","slug":"azonbox","name":"AzonBox","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:40:46Z"},{"id":"wordfence:0bf117e2-9e59-4028-b77f-7fce2e7174f3","source":"wordfence","cve":"CVE-2026-2941","title":"Linksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf117e2-9e59-4028-b77f-7fce2e7174f3?source=api-prod","affected":[{"type":"plugin","slug":"linksy-search-and-replace","name":"Linksy Search and Replace","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T14:38:04Z","updated":"2026-09-09T16:35:00Z"},{"id":"wordfence:0bf1fe22-2cee-4828-bd68-7269b66152b3","source":"wordfence","cve":"CVE-2024-32510","title":"WP Cost Estimation & Payment Forms Builder <= 10.1.75 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf1fe22-2cee-4828-bd68-7269b66152b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"10.1.75","to_inclusive":true,"patched_in":"10.1.76"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:53:29Z"},{"id":"wordfence:0bf67b6d-5e72-433d-9e41-9fdf8d99a3ae","source":"wordfence","cve":"CVE-2015-9468","title":"Broken Link Manager <= 0.4.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf67b6d-5e72-433d-9e41-9fdf8d99a3ae?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-manager","name":"Broken Link Manager","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":"0.5.0"}],"published":"2015-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bf6d6f7-e63c-4ee6-a918-1da9940ac915","source":"wordfence","cve":"CVE-2025-25152","title":"Smart DoFollow <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf6d6f7-e63c-4ee6-a918-1da9940ac915?source=api-prod","affected":[{"type":"plugin","slug":"smart-dofollow","name":"Smart DoFollow","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:30:25Z"},{"id":"wordfence:0bf85146-8d82-4101-a914-b6d632460366","source":"wordfence","cve":"CVE-2014-5181","title":"Last.fm Rotation <= 1.0 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bf85146-8d82-4101-a914-b6d632460366?source=api-prod","affected":[{"type":"plugin","slug":"lastfm-rotation","name":"lastfm-rotation","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0bfa1392-375a-4be2-ad4d-2c9d5fe3267c","source":"wordfence","cve":"CVE-2026-115871","title":"WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"4.19.0","to_inclusive":true,"patched_in":"4.20.0"}],"published":"2026-11-12T21:00:20Z","updated":"2026-11-13T09:35:11Z"},{"id":"wordfence:0bffed9d-d156-4141-8e0c-112d68dea133","source":"wordfence","cve":"CVE-2025-26748","title":"Arkhe <= 3.11.0 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bffed9d-d156-4141-8e0c-112d68dea133?source=api-prod","affected":[{"type":"theme","slug":"arkhe","name":"Arkhe","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2025-04-11T00:00:00Z","updated":"2026-09-09T15:51:37Z"},{"id":"wordfence:0c007090-9d9b-4ee7-8f77-91abd4373051","source":"wordfence","cve":"CVE-2024-5441","title":"Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.11.0","to_inclusive":true,"patched_in":"7.12.0"},{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.11.0","to_inclusive":true,"patched_in":"7.12.0"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T05:34:20Z"},{"id":"wordfence:0c00f3c0-8374-4966-9496-dd62f183f75a","source":"wordfence","cve":"CVE-2022-1455","title":"Call Now Button <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c00f3c0-8374-4966-9496-dd62f183f75a?source=api-prod","affected":[{"type":"plugin","slug":"call-now-button","name":"Call Now Button \u2013 The Free Click to Call Button for WordPress","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c05dcd9-71d2-4881-b5aa-335821ff95b3","source":"wordfence","cve":"CVE-2025-26983","title":"Recipe Card Blocks for Gutenberg & Elementor <= 3.4.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c05dcd9-71d2-4881-b5aa-335821ff95b3?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:22:31Z"},{"id":"wordfence:0c06880e-06cc-4204-a031-355de4de3af2","source":"wordfence","cve":"CVE-2025-13139","title":"SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c06880e-06cc-4204-a031-355de4de3af2?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-01-23T20:33:23Z","updated":"2026-02-03T19:02:26Z"},{"id":"wordfence:0c06d868-ac71-401a-9b8e-ee04a099c095","source":"wordfence","cve":"","title":"Support Board <= 3.4.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c06d868-ac71-401a-9b8e-ee04a099c095?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c0827fd-05e6-48bb-9592-bcc373d5f77d","source":"wordfence","cve":"CVE-2026-1885","title":"Slideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0827fd-05e6-48bb-9592-bcc373d5f77d?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-wp","name":"Slideshow Wp","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:08:21Z","updated":"2026-02-11T08:26:24Z"},{"id":"wordfence:0c08f285-1002-4919-9dd7-ac97bf131092","source":"wordfence","cve":"CVE-2026-123461","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c08f285-1002-4919-9dd7-ac97bf131092?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2026-11-07T17:23:00Z","updated":"2026-11-10T19:58:23Z"},{"id":"wordfence:0c0c1e62-1a1c-4a76-bd99-7ede232dc965","source":"wordfence","cve":"CVE-2021-24975","title":"NextScripts: Social Networks Auto-Poster <= 4.3.23 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0c1e62-1a1c-4a76-bd99-7ede232dc965?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.3.24","to_inclusive":false,"patched_in":"4.3.24"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c0c698e-a5c2-473c-8dfb-31745b7d7c38","source":"wordfence","cve":"","title":"Predictive Search for WooCommerce <= 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0c698e-a5c2-473c-8dfb-31745b7d7c38?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-predictive-search","name":"Predictive Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2012-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c0dd466-a78a-4b79-b9bd-5363f69d9a4c","source":"wordfence","cve":"CVE-2024-2342","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0dd466-a78a-4b79-b9bd-5363f69d9a4c?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.7","to_inclusive":true,"patched_in":"1.6.7.9"}],"published":"2024-03-20T00:00:00Z","updated":"2024-04-09T18:58:31Z"},{"id":"wordfence:0c0e9a09-0362-4046-a409-41a88154c7ba","source":"wordfence","cve":"CVE-2015-6920","title":"sourceAFRICA <= 0.1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0e9a09-0362-4046-a409-41a88154c7ba?source=api-prod","affected":[{"type":"plugin","slug":"sourceafrica","name":"sourceAFRICA","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2015-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c0fe97a-a9e4-46e0-bb53-135c2d9a69a4","source":"wordfence","cve":"CVE-2026-93293","title":"Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c0fe97a-a9e4-46e0-bb53-135c2d9a69a4?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2026-10-28T17:00:16Z","updated":"2026-10-29T05:30:33Z"},{"id":"wordfence:0c11668c-6dc3-4539-b2be-bf6528bed73e","source":"wordfence","cve":"CVE-2025-3605","title":"Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c11668c-6dc3-4539-b2be-bf6528bed73e?source=api-prod","affected":[{"type":"plugin","slug":"frontend-login-and-registration-blocks","name":"Login, Registration and Lost Password Blocks","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-05-08T00:00:00Z","updated":"2025-08-15T14:00:35Z"},{"id":"wordfence:0c157d70-1d4d-482e-8996-bc047a801681","source":"wordfence","cve":"CVE-2022-1324","title":"Event Timeline <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c157d70-1d4d-482e-8996-bc047a801681?source=api-prod","affected":[{"type":"plugin","slug":"rich-event-timeline","name":"Event Timeline \u2013 Vertical Timeline","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c173356-7228-4253-bb28-2c2e11af76fd","source":"wordfence","cve":"CVE-2026-3358","title":"Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c173356-7228-4253-bb28-2c2e11af76fd?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-04-10T11:46:32Z","updated":"2026-04-11T01:24:57Z"},{"id":"wordfence:0c1758fc-5b0b-4071-b31b-1d72e34cc924","source":"wordfence","cve":"CVE-2024-10164","title":"Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1758fc-5b0b-4071-b31b-1d72e34cc924?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2024-11-20T13:54:25Z","updated":"2025-03-13T19:42:49Z"},{"id":"wordfence:0c187d78-9f1d-4e55-a611-755ee30f855b","source":"wordfence","cve":"CVE-2026-15426","title":"AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c187d78-9f1d-4e55-a611-755ee30f855b?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-08-11T06:12:22Z","updated":"2026-08-11T18:26:33Z"},{"id":"wordfence:0c18e637-a117-4154-84b8-8afa84ac6feb","source":"wordfence","cve":"CVE-2025-58848","title":"WP likes <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c18e637-a117-4154-84b8-8afa84ac6feb?source=api-prod","affected":[{"type":"plugin","slug":"wp-likes","name":"WP likes","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:25:59Z"},{"id":"wordfence:0c19d041-c26b-453e-b0fd-4304205469e4","source":"wordfence","cve":"CVE-2025-32202","title":"Insert or Embed Articulate Content into WordPress <= 4.3000000025 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c19d041-c26b-453e-b0fd-4304205469e4?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000025","to_inclusive":true,"patched_in":"4.3000000026"}],"published":"2025-04-08T00:00:00Z","updated":"2025-08-05T12:56:14Z"},{"id":"wordfence:0c1c343c-ef16-4468-a983-0dc9fd152dd5","source":"wordfence","cve":"CVE-2025-13889","title":"Simple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1c343c-ef16-4468-a983-0dc9fd152dd5?source=api-prod","affected":[{"type":"plugin","slug":"simple-nivo-slider","name":"Simple Nivo Slider","from":"*","from_inclusive":true,"to":"0.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:22:12Z","updated":"2025-12-12T03:20:38Z"},{"id":"wordfence:0c1c8310-76c3-4505-9504-993e594804a4","source":"wordfence","cve":"CVE-2024-32797","title":"WP LinkedIn Auto Publish <= 8.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1c8310-76c3-4505-9504-993e594804a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-linkedin-auto-publish","name":"WP LinkedIn Auto Publish","from":"*","from_inclusive":true,"to":"8.11","to_inclusive":true,"patched_in":"8.12"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:46:07Z"},{"id":"wordfence:0c1e2397-72a8-464c-93c7-d518e6611149","source":"wordfence","cve":"CVE-2026-14864","title":"JetEngine < 3.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1e2397-72a8-464c-93c7-d518e6611149?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.12","to_inclusive":false,"patched_in":"3.8.12"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:27:04Z"},{"id":"wordfence:0c1ebc88-0987-46d6-9e80-6f3aa50d10af","source":"wordfence","cve":"CVE-2021-24275","title":"Popup by Supsystic <= 1.10.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1ebc88-0987-46d6-9e80-6f3aa50d10af?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.5"}],"published":"2021-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c20f87e-3670-444c-aa8a-28988dfe2fd9","source":"wordfence","cve":"CVE-2023-23818","title":"WP Register Profile With Shortcode <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c20f87e-3670-444c-aa8a-28988dfe2fd9?source=api-prod","affected":[{"type":"plugin","slug":"wp-register-profile-with-shortcode","name":"WP Register Profile With Shortcode","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c21c980-e560-4d66-acb0-59485f8f7f35","source":"wordfence","cve":"CVE-2026-111839","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c21c980-e560-4d66-acb0-59485f8f7f35?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.3.7","to_inclusive":true,"patched_in":"7.3.8"}],"published":"2026-10-19T12:13:00Z","updated":"2026-10-23T18:45:44Z"},{"id":"wordfence:0c225026-8ee8-4f93-8dcb-eafd653e6045","source":"wordfence","cve":"CVE-2026-86842","title":"Real3D Flipbook Lite <= 5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c225026-8ee8-4f93-8dcb-eafd653e6045?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2026-09-21T00:00:00Z","updated":"2026-10-08T23:45:21Z"},{"id":"wordfence:0c2266b8-cc23-46de-bc80-09e3d6294854","source":"wordfence","cve":"CVE-2026-9055","title":"Booking for Appointments and Events Calendar \u2013 Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c2266b8-cc23-46de-bc80-09e3d6294854?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"8.0","from_inclusive":true,"to":"9.6.2","to_inclusive":true,"patched_in":"9.6.3"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-02T04:26:46Z"},{"id":"wordfence:0c23cc3c-3c76-4ba8-8fa6-6ed0507a35c9","source":"wordfence","cve":"CVE-2025-14735","title":"Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c23cc3c-3c76-4ba8-8fa6-6ed0507a35c9?source=api-prod","affected":[{"type":"plugin","slug":"afiliados-de-amazon-lite","name":"Amazon affiliate lite Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:05:07Z","updated":"2025-12-20T03:20:21Z"},{"id":"wordfence:0c28545d-c7cd-469f-bccf-90e8b52fd4e7","source":"wordfence","cve":"CVE-2025-14844","title":"Membership Plugin \u2013 Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure","severity":"high","cvss":8.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c28545d-c7cd-469f-bccf-90e8b52fd4e7?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":true,"patched_in":"3.2.17"}],"published":"2026-01-15T20:39:14Z","updated":"2026-01-16T09:23:49Z"},{"id":"wordfence:0c2925c1-f5c6-45b9-bc61-96f325c0372f","source":"wordfence","cve":"CVE-2023-33310","title":"Unite Gallery Lite <= 1.7.59 - Authenticated(Administrator+) Local File Inclusion via 'view' parameter","severity":"medium","cvss":5.0,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c2925c1-f5c6-45b9-bc61-96f325c0372f?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.7.59","to_inclusive":true,"patched_in":"1.7.60"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c29e242-b05c-4876-8948-1278982d6fbc","source":"wordfence","cve":"CVE-2024-10480","title":"3DPrint Lite <= 2.0.9.9 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c29e242-b05c-4876-8948-1278982d6fbc?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.0.9.9","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-11-15T00:00:00Z","updated":"2024-12-12T19:04:05Z"},{"id":"wordfence:0c2c5b41-bc56-428f-9edc-2a8fd8212310","source":"wordfence","cve":"CVE-2021-38335","title":"Wise Agent Capture Forms <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c2c5b41-bc56-428f-9edc-2a8fd8212310?source=api-prod","affected":[{"type":"plugin","slug":"wiseagentleadform","name":"Wise Agent Lead Forms","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c2ec7bc-713d-46a0-95a9-ac7ce35084c3","source":"wordfence","cve":"CVE-2026-92404","title":"MgoSync 2.1.5 - 2.1.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c2ec7bc-713d-46a0-95a9-ac7ce35084c3?source=api-prod","affected":[{"type":"plugin","slug":"megamo","name":"MgoSync \u2013 European dropshipping and suppliers","from":"2.1.5","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T20:11:46Z"},{"id":"wordfence:0c30cfa6-dee2-40d2-b5ac-06451e9218fb","source":"wordfence","cve":"CVE-2025-58960","title":"IP Based Login <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c30cfa6-dee2-40d2-b5ac-06451e9218fb?source=api-prod","affected":[{"type":"plugin","slug":"ip-based-login","name":"IP Based Login","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:03:18Z"},{"id":"wordfence:0c347b9f-d297-4cb5-9c4a-1001d845ed5a","source":"wordfence","cve":"CVE-2025-14467","title":"WP Job Portal <= 2.5.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c347b9f-d297-4cb5-9c4a-1001d845ed5a?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-12-11T15:05:46Z","updated":"2026-05-27T14:57:25Z"},{"id":"wordfence:0c34d49a-0009-4856-9edb-517e2bf50d00","source":"wordfence","cve":"CVE-2026-28108","title":"LambertGroup - AllInOne - Banner with Thumbnails <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c34d49a-0009-4856-9edb-517e2bf50d00?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-thumbnailsBanner","name":"LambertGroup - AllInOne - Banner with Thumbnails","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:31:48Z"},{"id":"wordfence:0c3a3ba5-1d32-421f-9fdb-22fe274702e5","source":"wordfence","cve":"CVE-2026-81432","title":"JetStyleManager for Gutenberg < 1.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c3a3ba5-1d32-421f-9fdb-22fe274702e5?source=api-prod","affected":[{"type":"plugin","slug":"jet-style-manager","name":"JetStyleManager for Gutenberg","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-22T18:42:29Z"},{"id":"wordfence:0c3ecf70-544f-49c1-a943-86df89685b58","source":"wordfence","cve":"CVE-2026-73391","title":"Total Donations <= 2.0.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c3ecf70-544f-49c1-a943-86df89685b58?source=api-prod","affected":[{"type":"plugin","slug":"totaldonations","name":"Total Donations","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-01T13:22:22Z"},{"id":"wordfence:0c3fe714-94c9-47ea-b073-a082e4713977","source":"wordfence","cve":"CVE-2016-10955","title":"CYSTEME Finder <= 1.3 - Arbitrary File Upload/Read","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c3fe714-94c9-47ea-b073-a082e4713977?source=api-prod","affected":[{"type":"plugin","slug":"cysteme-finder","name":"CYSTEME Finder, the admin files explorer","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2016-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c410d91-08cc-496d-9c8e-c57f107399da","source":"wordfence","cve":"CVE-2024-1289","title":"LearnPress <= 4.2.6.3 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c410d91-08cc-496d-9c8e-c57f107399da?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.3","to_inclusive":true,"patched_in":"4.2.6.4"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:58:31Z"},{"id":"wordfence:0c424ffa-2aa8-4126-afba-d93ae696e7fa","source":"wordfence","cve":"CVE-2025-68055","title":"Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c424ffa-2aa8-4126-afba-d93ae696e7fa?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2025-11-27T00:00:00Z","updated":"2026-01-07T14:41:47Z"},{"id":"wordfence:0c43a88c-6374-414f-97ae-26ba15d75cdc","source":"wordfence","cve":"CVE-2023-5669","title":"Featured Image Caption <= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c43a88c-6374-414f-97ae-26ba15d75cdc?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-caption","name":"Featured Image Caption","from":"*","from_inclusive":true,"to":"0.8.10","to_inclusive":true,"patched_in":"0.8.11"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c43b078-44e0-43ed-9762-b65575443576","source":"wordfence","cve":"CVE-2025-32577","title":"Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c43b078-44e0-43ed-9762-b65575443576?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:22:45Z"},{"id":"wordfence:0c458644-a799-4bea-abcb-06a946dc19df","source":"wordfence","cve":"CVE-2023-4314","title":"wpDataTables - Tables & Table Charts <= 2.1.65 - Authenticated(Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c458644-a799-4bea-abcb-06a946dc19df?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.1.66","to_inclusive":false,"patched_in":"2.1.66"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c467a78-1ba4-4c0d-84e6-db54fc1b0c63","source":"wordfence","cve":"CVE-2024-54271","title":"WPCargo Track & Trace <= 8.0.1 - Missing authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c467a78-1ba4-4c0d-84e6-db54fc1b0c63?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-05-21T13:32:05Z"},{"id":"wordfence:0c479ceb-170f-46d6-b1ce-ca5469147d5f","source":"wordfence","cve":"CVE-2025-64637","title":"Auros Core <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c479ceb-170f-46d6-b1ce-ca5469147d5f?source=api-prod","affected":[{"type":"plugin","slug":"auros-core","name":"Auros Core","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T11:42:21Z"},{"id":"wordfence:0c4d2829-9f99-4a2d-9bde-476fae2c99a4","source":"wordfence","cve":"CVE-2013-1407","title":"Events Manager < 5.3.5 & Events Manager Pro < 2.2.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4d2829-9f99-4a2d-9bde-476fae2c99a4?source=api-prod","affected":[{"type":"plugin","slug":"events-manager-pro","name":"Events Manager Pro","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"},{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":false,"patched_in":"5.3.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c4d61ad-2375-4e5c-b047-cb345388f5e9","source":"wordfence","cve":"CVE-2026-15152","title":"Hotel Booking <= 2.3.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4d61ad-2375-4e5c-b047-cb345388f5e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-07-09T00:00:00Z","updated":"2026-08-21T15:33:58Z"},{"id":"wordfence:0c4e0d48-fde1-45dd-8e06-4582cf677579","source":"wordfence","cve":"CVE-2023-6813","title":"Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4e0d48-fde1-45dd-8e06-4582cf677579?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-29T21:35:51Z"},{"id":"wordfence:0c4eb735-46bc-4eed-9d9a-b3bd42d18eed","source":"wordfence","cve":"CVE-2023-22687","title":"Freesoul Deactivate Plugins <= 1.9.4.0 - Information Disclosure","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c4eb735-46bc-4eed-9d9a-b3bd42d18eed?source=api-prod","affected":[{"type":"plugin","slug":"freesoul-deactivate-plugins","name":"Freesoul Deactivate Plugins \u2013 Disable plugins on individual WordPress pages","from":"*","from_inclusive":true,"to":"1.9.4.0","to_inclusive":true,"patched_in":"1.9.4.1"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c50059d-967d-45bc-be1c-6642474be603","source":"wordfence","cve":"CVE-2025-31630","title":"The Business <= 1.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c50059d-967d-45bc-be1c-6642474be603?source=api-prod","affected":[{"type":"theme","slug":"nrgbusiness","name":"The Business - Powerful One Page Biz Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:54:34Z"},{"id":"wordfence:0c50e839-79c8-40c4-b2c4-b168e8537bfa","source":"wordfence","cve":"CVE-2025-25156","title":"Quote Comments <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c50e839-79c8-40c4-b2c4-b168e8537bfa?source=api-prod","affected":[{"type":"plugin","slug":"quote-comments","name":"Quote Comments","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-05-14T14:16:17Z"},{"id":"wordfence:0c528e73-e8e5-4935-bfc0-f3bab4f33492","source":"wordfence","cve":"CVE-2026-62023","title":"Unlimited Elements for Elementor <= 2.0.26 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c528e73-e8e5-4935-bfc0-f3bab4f33492?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2026-10-30T18:13:00Z","updated":"2026-11-03T20:07:23Z"},{"id":"wordfence:0c533277-5cea-419f-93ec-e510c0fbd75d","source":"wordfence","cve":"CVE-2023-51416","title":"Env\u00edaloSimple <= 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c533277-5cea-419f-93ec-e510c0fbd75d?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-06-05T20:03:36Z"},{"id":"wordfence:0c54166e-2af2-409d-8c67-9c07f2028543","source":"wordfence","cve":"CVE-2024-10008","title":"Masteriyo LMS \u2013 eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c54166e-2af2-409d-8c67-9c07f2028543?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2024-10-28T16:31:51Z","updated":"2024-10-29T05:32:38Z"},{"id":"wordfence:0c54bbfe-f505-4c93-89fb-1a624bfcfe10","source":"wordfence","cve":"","title":"WP Construction Mode <= 1.91 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c54bbfe-f505-4c93-89fb-1a624bfcfe10?source=api-prod","affected":[{"type":"plugin","slug":"wp-construction-mode","name":"WP Construction Mode","from":"*","from_inclusive":true,"to":"1.91","to_inclusive":true,"patched_in":"1.92"}],"published":"2014-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c563a5a-0fa9-49cd-9177-9860a8be9997","source":"wordfence","cve":"CVE-2025-64199","title":"WpResidence <= 5.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c563a5a-0fa9-49cd-9177-9860a8be9997?source=api-prod","affected":[{"type":"theme","slug":"wpresidence","name":"WpResidence","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.2.1"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-04T14:55:03Z"},{"id":"wordfence:0c58aa3a-b6ba-4e3c-8d4f-1c27ba518b1a","source":"wordfence","cve":"CVE-2026-82125","title":"Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c58aa3a-b6ba-4e3c-8d4f-1c27ba518b1a?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.65","to_inclusive":true,"patched_in":"1.66"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:18:27Z"},{"id":"wordfence:0c58c1c6-cdda-463c-9a76-4ace96138dcb","source":"wordfence","cve":"","title":"Google Forms < 0.92 - Unauthenticated Server Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c58c1c6-cdda-463c-9a76-4ace96138dcb?source=api-prod","affected":[{"type":"plugin","slug":"wpgform","name":"Google Forms","from":"*","from_inclusive":true,"to":"0.92","to_inclusive":false,"patched_in":"0.92"}],"published":"2018-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c594cf6-d5d8-4927-b61e-145a86a318c3","source":"wordfence","cve":"CVE-2026-24994","title":"Sunshine Photo Cart <= 3.5.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c594cf6-d5d8-4927-b61e-145a86a318c3?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.5.7.2","to_inclusive":true,"patched_in":"3.5.7.3"}],"published":"2026-01-23T00:00:00Z","updated":"2026-02-02T20:46:10Z"},{"id":"wordfence:0c5b48a9-b9cc-4d8e-8ceb-5a816328d71e","source":"wordfence","cve":"CVE-2025-24656","title":"Realtyna Provisioning <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c5b48a9-b9cc-4d8e-8ceb-5a816328d71e?source=api-prod","affected":[{"type":"plugin","slug":"realtyna-provisioning","name":"Realtyna Provisioning","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-25T17:07:04Z"},{"id":"wordfence:0c5e3ca4-fbba-4428-ab3b-e955aa9f60d4","source":"wordfence","cve":"CVE-2026-81758","title":"OwnerRez <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c5e3ca4-fbba-4428-ab3b-e955aa9f60d4?source=api-prod","affected":[{"type":"plugin","slug":"ownerrez","name":"OwnerRez","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:36:05Z"},{"id":"wordfence:0c676a46-3e3f-4dc0-ba7f-acf1f100fb4a","source":"wordfence","cve":"CVE-2024-32095","title":"MultiParcels Shipping For WooCommerce < 1.16.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c676a46-3e3f-4dc0-ba7f-acf1f100fb4a?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.16.9","to_inclusive":false,"patched_in":"1.16.9"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T19:05:29Z"},{"id":"wordfence:0c6a49d1-633b-47aa-8390-5df3bf8f71a5","source":"wordfence","cve":"","title":"WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c6a49d1-633b-47aa-8390-5df3bf8f71a5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":false,"patched_in":"4.6.2"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2020-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c6bc786-341a-4ab6-b86e-d21bb3dbf298","source":"wordfence","cve":"","title":"WP VK-\u4ed8\u8d39\u5185\u5bb9\u63d2\u4ef6 <= 1.3.3 - Cross-Site Request Forgery via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c6bc786-341a-4ab6-b86e-d21bb3dbf298?source=api-prod","affected":[{"type":"plugin","slug":"wp-vk","name":"WP VK-\u4ed8\u8d39\u5185\u5bb9\u63d2\u4ef6\uff08\u4ed8\u8d39\u9605\u8bfb/\u8d44\u6599/\u5de5\u5177\u8f6f\u4ef6\u8d44\u6e90\u7ba1\u7406\uff09","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2023-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c6c26d5-d4a1-49d7-890a-71d31b7afa89","source":"wordfence","cve":"CVE-2024-50525","title":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint <= 2.0.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c6c26d5-d4a1-49d7-890a-71d31b7afa89?source=api-prod","affected":[{"type":"plugin","slug":"helloprint","name":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-10-30T00:00:00Z","updated":"2024-12-02T20:49:31Z"},{"id":"wordfence:0c6f44ba-a8c1-4248-8f54-ee86d4b5aa20","source":"wordfence","cve":"CVE-2012-1068","title":"WP-RecentComments <= 2.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c6f44ba-a8c1-4248-8f54-ee86d4b5aa20?source=api-prod","affected":[{"type":"plugin","slug":"wp-recentcomments","name":"WP-RecentComments","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2011-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c70206d-5c4a-4068-8182-e93378c26350","source":"wordfence","cve":"CVE-2021-38321","title":"Custom Menu <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c70206d-5c4a-4068-8182-e93378c26350?source=api-prod","affected":[{"type":"plugin","slug":"custom-sub-menus","name":"Custom Menu Plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T20:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c714138-1224-4966-8191-64a99505b8e8","source":"wordfence","cve":"CVE-2025-30995","title":"Widgetize Pages Light <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c714138-1224-4966-8191-64a99505b8e8?source=api-prod","affected":[{"type":"plugin","slug":"widgetize-pages-light","name":"Widgetize Pages Light","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:05:07Z"},{"id":"wordfence:0c720222-5237-4276-937d-cfa7f8e2c65a","source":"wordfence","cve":"CVE-2026-123478","title":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.9.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c720222-5237-4276-937d-cfa7f8e2c65a?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:18Z"},{"id":"wordfence:0c747bc9-582c-4b9f-85a4-469c446d50f5","source":"wordfence","cve":"CVE-2024-7384","title":"AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c747bc9-582c-4b9f-85a4-469c446d50f5?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"9.7.2","to_inclusive":true,"patched_in":"9.8.0"}],"published":"2024-08-21T13:54:14Z","updated":"2024-08-22T02:02:02Z"},{"id":"wordfence:0c7497fc-e42c-49a6-99ee-6ec774cc4617","source":"wordfence","cve":"CVE-2023-46200","title":"Smart App Banner <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7497fc-e42c-49a6-99ee-6ec774cc4617?source=api-prod","affected":[{"type":"plugin","slug":"smart-app-banner","name":"Smart App Banner","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-10-18T00:00:00Z","updated":"2024-03-11T08:21:12Z"},{"id":"wordfence:0c788d06-6a80-4e34-92bb-b87f21916810","source":"wordfence","cve":"CVE-2022-2114","title":"Data Tables Generator By Supsystic <= 1.10.19 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c788d06-6a80-4e34-92bb-b87f21916810?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.10.19","to_inclusive":true,"patched_in":"1.10.20"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c796ee7-5394-40f3-9158-1a006efbf085","source":"wordfence","cve":"CVE-2025-3076","title":"Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c796ee7-5394-40f3-9158-1a006efbf085?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2025-06-09T16:22:07Z","updated":"2025-06-10T04:23:11Z"},{"id":"wordfence:0c799ee5-d8ee-4aec-b9a5-f93c150de6bd","source":"wordfence","cve":"CVE-2023-39991","title":"BigBlueButton <= 3.0.0-beta.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c799ee5-d8ee-4aec-b9a5-f93c150de6bd?source=api-prod","affected":[{"type":"plugin","slug":"bigbluebutton","name":"BigBlueButton","from":"*","from_inclusive":true,"to":"3.0.0-beta.4","to_inclusive":true,"patched_in":""}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c79e795-0f96-4b20-b4d0-d78fa1aea0f1","source":"wordfence","cve":"CVE-2026-24363","title":"WP Cost Estimation < 10.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c79e795-0f96-4b20-b4d0-d78fa1aea0f1?source=api-prod","affected":[{"type":"plugin","slug":"WP_Estimation_Form","name":"WP Cost Estimation","from":"*","from_inclusive":true,"to":"10.3.0","to_inclusive":false,"patched_in":"10.3.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:43:02Z"},{"id":"wordfence:0c79eb10-2f4f-4d02-ad73-e74477afc947","source":"wordfence","cve":"CVE-2025-60124","title":"Simple Colorbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c79eb10-2f4f-4d02-ad73-e74477afc947?source=api-prod","affected":[{"type":"plugin","slug":"simple-colorbox","name":"Simple Colorbox","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:18:50Z"},{"id":"wordfence:0c7a23b2-0d42-4e35-94aa-4cd6e25d8a9b","source":"wordfence","cve":"CVE-2026-40763","title":"Royal Elementor Addons <= 1.7.1056 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7a23b2-0d42-4e35-94aa-4cd6e25d8a9b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-03-31T00:00:00Z","updated":"2026-05-07T14:02:22Z"},{"id":"wordfence:0c7b4263-0c7b-4a1a-b168-88e6591c82bb","source":"wordfence","cve":"CVE-2014-4522","title":"dsSearchAgent: WordPress Edition <= 1.0-beta10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7b4263-0c7b-4a1a-b168-88e6591c82bb?source=api-prod","affected":[{"type":"plugin","slug":"dssearchagent-wordpress-edition","name":"dsSearchAgent: WordPress Edition","from":"*","from_inclusive":true,"to":"1.0-beta10","to_inclusive":false,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c7b7c7b-8bcb-4ff9-904c-5b4428e34644","source":"wordfence","cve":"CVE-2026-103334","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin <= 2.7.24 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7b7c7b-8bcb-4ff9-904c-5b4428e34644?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.24","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-10-03T17:40:54Z","updated":"2026-10-08T23:17:25Z"},{"id":"wordfence:0c7beb26-a4ac-47a3-9ee1-64f399e3218b","source":"wordfence","cve":"","title":"User Rights Access Manager <= 1.0.3 - Missing Authorization","severity":"medium","cvss":6.6,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7beb26-a4ac-47a3-9ee1-64f399e3218b?source=api-prod","affected":[{"type":"plugin","slug":"user-rights-access-manager","name":"User Rights Access Manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2021-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c7ffb7a-5f63-4653-af69-fe925cd0f2eb","source":"wordfence","cve":"CVE-2026-32560","title":"MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c7ffb7a-5f63-4653-af69-fe925cd0f2eb?source=api-prod","affected":[{"type":"plugin","slug":"magicai-wp","name":"MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:30:58Z"},{"id":"wordfence:0c80cbad-39ea-4f75-a025-6b9667560845","source":"wordfence","cve":"","title":"Float to Top Button <= 2.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c80cbad-39ea-4f75-a025-6b9667560845?source=api-prod","affected":[{"type":"plugin","slug":"float-to-top-button","name":"Float to Top Button","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c81eabe-93c2-4838-af35-ad1c0ba458af","source":"wordfence","cve":"CVE-2026-65477","title":"Tonda Core <= 2.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c81eabe-93c2-4838-af35-ad1c0ba458af?source=api-prod","affected":[{"type":"plugin","slug":"tonda-core","name":"Tonda Core","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:40:21Z"},{"id":"wordfence:0c822394-4ce1-4bb0-a8cd-bc3557f0e65d","source":"wordfence","cve":"CVE-2026-5092","title":"Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c822394-4ce1-4bb0-a8cd-bc3557f0e65d?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.9","to_inclusive":true,"patched_in":"12.9.0"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T11:05:43Z"},{"id":"wordfence:0c824844-8095-45ac-b202-8ab368198dc4","source":"wordfence","cve":"CVE-2026-22358","title":"Electrician - Electrical Service WordPress <= 5.6 - Unauthenticated Server-Side Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c824844-8095-45ac-b202-8ab368198dc4?source=api-prod","affected":[{"type":"plugin","slug":"electrician","name":"Electrician - Electricity Services WordPress Theme","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T22:02:36Z"},{"id":"wordfence:0c829230-7527-4ae2-a5c8-db2371e4cd5a","source":"wordfence","cve":"CVE-2022-1560","title":"Amministrazione Aperta <= 3.7.3 - Admin+ Local File Inclusion","severity":"medium","cvss":5.4,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c829230-7527-4ae2-a5c8-db2371e4cd5a?source=api-prod","affected":[{"type":"plugin","slug":"amministrazione-aperta","name":"Amministrazione Aperta","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.8"}],"published":"2022-03-23T00:00:00Z","updated":"2026-07-29T21:27:04Z"},{"id":"wordfence:0c84075b-4685-4706-91d0-05ce6cd276ca","source":"wordfence","cve":"CVE-2022-4781","title":"Accordion Shortcodes <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c84075b-4685-4706-91d0-05ce6cd276ca?source=api-prod","affected":[{"type":"plugin","slug":"accordion-shortcodes","name":"Accordion Shortcodes","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0c88c526-5978-4319-885b-8edac3f028a4","source":"wordfence","cve":"CVE-2025-49914","title":"Restaurant Menu by MotoPress <= 2.4.7 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c88c526-5978-4319-885b-8edac3f028a4?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-19T21:01:20Z"},{"id":"wordfence:0c8af063-cfce-47c2-885c-faa50dd89204","source":"wordfence","cve":"CVE-2026-115592","title":"OceanWP <= 4.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c8af063-cfce-47c2-885c-faa50dd89204?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.8"}],"published":"2026-10-27T10:30:09Z","updated":"2026-11-03T19:26:38Z"},{"id":"wordfence:0c8e538b-7157-42d3-abee-8259c6715cd5","source":"wordfence","cve":"CVE-2024-13776","title":"ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c8e538b-7157-42d3-abee-8259c6715cd5?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T16:43:10Z","updated":"2025-04-05T05:32:14Z"},{"id":"wordfence:0c922b7b-5502-48b7-8193-0fbf995b21e8","source":"wordfence","cve":"CVE-2025-15702","title":"Cloud Blocks <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c922b7b-5502-48b7-8193-0fbf995b21e8?source=api-prod","affected":[{"type":"plugin","slug":"cloud-blocks","name":"Cloud Blocks","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:06:40Z"},{"id":"wordfence:0c943b6b-9b54-4569-a027-11571f152b6c","source":"wordfence","cve":"CVE-2026-15349","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c943b6b-9b54-4569-a027-11571f152b6c?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.6","to_inclusive":true,"patched_in":"1.17.7"}],"published":"2026-07-16T14:45:19Z","updated":"2026-07-17T03:43:42Z"},{"id":"wordfence:0c944e08-1b70-4b56-80eb-f588c0fab5b6","source":"wordfence","cve":"CVE-2024-4895","title":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c944e08-1b70-4b56-80eb-f588c0fab5b6?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"3.4.2.12","to_inclusive":true,"patched_in":"3.4.2.14"}],"published":"2024-05-22T14:10:41Z","updated":"2024-05-23T02:33:07Z"},{"id":"wordfence:0c963224-e680-4ca6-85ae-07cd0ee6c1d4","source":"wordfence","cve":"CVE-2026-15665","title":"Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c963224-e680-4ca6-85ae-07cd0ee6c1d4?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-23T18:29:33Z","updated":"2026-07-24T06:51:58Z"},{"id":"wordfence:0c9687fc-ee21-45c3-a655-da1dd1bf7b2e","source":"wordfence","cve":"CVE-2025-7022","title":"My Reservation System <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c9687fc-ee21-45c3-a655-da1dd1bf7b2e?source=api-prod","affected":[{"type":"plugin","slug":"my-reservation-system","name":"My Reservation System","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-08-01T19:57:19Z"},{"id":"wordfence:0c976b67-8236-4b34-be93-075beea11f0e","source":"wordfence","cve":"CVE-2026-42667","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c976b67-8236-4b34-be93-075beea11f0e?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.4","to_inclusive":true,"patched_in":"27.5"}],"published":"2026-05-10T00:00:00Z","updated":"2026-05-19T16:42:09Z"},{"id":"wordfence:0c976e5a-2f6c-4632-99a7-a512b3dd38e6","source":"wordfence","cve":"CVE-2024-8189","title":"WP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c976e5a-2f6c-4632-99a7-a512b3dd38e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.17","to_inclusive":true,"patched_in":"0.1.18"}],"published":"2024-09-27T00:00:00Z","updated":"2024-09-28T12:31:55Z"},{"id":"wordfence:0c98026c-28a9-4c69-9f34-4c3bd4f75d85","source":"wordfence","cve":"CVE-2024-6448","title":"Mollie Payments for WooCommerce <= 7.7.0 -  Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c98026c-28a9-4c69-9f34-4c3bd4f75d85?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.7.0","to_inclusive":true,"patched_in":"7.8.0"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T03:36:54Z"},{"id":"wordfence:0c984d61-df91-411b-a2b3-f816b0ff80ee","source":"wordfence","cve":"CVE-2025-10268","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.5.1 - Directory Traversal to Unauthenticated Folder Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c984d61-df91-411b-a2b3-f816b0ff80ee?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-06-04T00:00:00Z","updated":"2026-10-30T17:16:07Z"},{"id":"wordfence:0c9856db-3779-4649-9a48-1c7b6d019816","source":"wordfence","cve":"CVE-2025-11368","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0c9856db-3779-4649-9a48-1c7b6d019816?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.9.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-11-20T16:53:10Z","updated":"2025-11-21T05:32:05Z"},{"id":"wordfence:0ca7291d-1309-4129-8244-cff6b6de45c0","source":"wordfence","cve":"CVE-2025-24652","title":"WP Duplicate \u2013 WordPress Migration Plugin <= 1.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ca7291d-1309-4129-8244-cff6b6de45c0?source=api-prod","affected":[{"type":"plugin","slug":"local-sync","name":"WP Duplicate \u2013 WordPress Migration Plugin","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:33:35Z"},{"id":"wordfence:0ca9e920-3c7a-4991-8c24-2e55c4f4767c","source":"wordfence","cve":"CVE-2022-38716","title":"Motors \u2013 Car Dealer & Classified Ads <= 1.4.5 - Cross-Site Request Forgery via Multiple Functions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ca9e920-3c7a-4991-8c24-2e55c4f4767c?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cac1dc0-87dc-43eb-9db1-638a91200b43","source":"wordfence","cve":"CVE-2024-9061","title":"WP Popup Builder \u2013 Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cac1dc0-87dc-43eb-9db1-638a91200b43?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-builder","name":"WP Popup Builder \u2013 Popup Forms and Marketing Lead Generation","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T07:31:49Z"},{"id":"wordfence:0cac7f96-eb64-427d-9a95-b8bf1c675af0","source":"wordfence","cve":"CVE-2023-48319","title":"Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cac7f96-eb64-427d-9a95-b8bf1c675af0?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":false,"patched_in":"8.7"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cad8c48-5c96-484c-acda-b33d8d8d10d3","source":"wordfence","cve":"CVE-2025-13138","title":"WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cad8c48-5c96-484c-acda-b33d8d8d10d3?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-11-20T20:36:08Z","updated":"2025-11-21T09:27:00Z"},{"id":"wordfence:0cae2bb8-33e7-47b0-861d-b976a67660ae","source":"wordfence","cve":"CVE-2024-1782","title":"Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cae2bb8-33e7-47b0-861d-b976a67660ae?source=api-prod","affected":[{"type":"plugin","slug":"blue-triad-ezanalytics","name":"Blue Triad EZAnalytics","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:55:58Z"},{"id":"wordfence:0cae43cb-a0b7-4067-95b3-26fec31ebf42","source":"wordfence","cve":"CVE-2025-14395","title":"Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cae43cb-a0b7-4067-95b3-26fec31ebf42?source=api-prod","affected":[{"type":"plugin","slug":"popover-windows","name":"Popover Windows","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:09:40Z","updated":"2025-12-13T04:31:20Z"},{"id":"wordfence:0caedaa2-4ac7-4402-9f4b-4bb39ff232cc","source":"wordfence","cve":"CVE-2025-31590","title":"WP Date and Time Shortcode <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0caedaa2-4ac7-4402-9f4b-4bb39ff232cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-date-and-time-shortcode","name":"WP Date and Time Shortcode","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T20:50:31Z"},{"id":"wordfence:0caf1660-b85e-46e1-9270-a8e14c6bbf52","source":"wordfence","cve":"","title":"SpiderVPlayer < 1.5.18 - Multiple Blind Authenticated SQL Injections","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0caf1660-b85e-46e1-9270-a8e14c6bbf52?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"1.5.18","to_inclusive":false,"patched_in":"1.5.18"}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cb21974-7745-4765-825f-adeca7e589e1","source":"wordfence","cve":"CVE-2025-30883","title":"Trust.Reviews <= 2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb21974-7745-4765-825f-adeca7e589e1?source=api-prod","affected":[{"type":"plugin","slug":"fb-reviews-widget","name":"Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:15:06Z"},{"id":"wordfence:0cb43deb-63f6-42d8-8dd6-55a59fca31ae","source":"wordfence","cve":"CVE-2024-2132","title":"Ultimate Bootstrap Elements for Elementor <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb43deb-63f6-42d8-8dd6-55a59fca31ae?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T08:38:54Z"},{"id":"wordfence:0cb48233-0885-4634-9298-b42c45219ee6","source":"wordfence","cve":"CVE-2024-43152","title":"3D FlipBook \u2013 PDF Flipbook Viewer, Flipbook Image Gallery <= 1.15.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb48233-0885-4634-9298-b42c45219ee6?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.15.6","to_inclusive":true,"patched_in":"1.15.7"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:12:18Z"},{"id":"wordfence:0cb5974c-945e-4a47-85c9-0e5dc97b44d0","source":"wordfence","cve":"CVE-2026-120836","title":"Meta Box \u2013 A Framework for Dynamic Websites <= 5.15.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb5974c-945e-4a47-85c9-0e5dc97b44d0?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.15.3","to_inclusive":true,"patched_in":"5.15.4"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:57:36Z"},{"id":"wordfence:0cb5df54-a6a7-4c2e-8df0-5d050218622e","source":"wordfence","cve":"CVE-2023-41951","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization via export_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb5df54-a6a7-4c2e-8df0-5d050218622e?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.14","to_inclusive":true,"patched_in":"4.6.15"}],"published":"2023-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cb67f55-6d21-4a4e-9651-fcf671788d16","source":"wordfence","cve":"CVE-2024-1798","title":"Tutor LMS \u2013 Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb67f55-6d21-4a4e-9651-fcf671788d16?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-migration-tool","name":"Tutor LMS \u2013 Migration Tool","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-07-26T13:10:32Z","updated":"2025-07-24T17:38:36Z"},{"id":"wordfence:0cb84b6a-ac06-436b-906f-282ea3a66e1e","source":"wordfence","cve":"CVE-2026-91020","title":"WebToffee Gift Cards for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary Gift Card Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb84b6a-ac06-436b-906f-282ea3a66e1e?source=api-prod","affected":[{"type":"plugin","slug":"wt-gift-cards-woocommerce","name":"WebToffee Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:27:55Z"},{"id":"wordfence:0cb8bd81-72a4-4b53-850b-78cc5e05043f","source":"wordfence","cve":"CVE-2023-24387","title":"Organization chart <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb8bd81-72a4-4b53-850b-78cc5e05043f?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cba362e-c1e3-4840-941f-b8af8469f771","source":"wordfence","cve":"CVE-2023-35050","title":"Elementor Pro <= 3.13.0 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cba362e-c1e3-4840-941f-b8af8469f771?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.13.1"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cbbfe17-4ca1-4f95-9bad-a5111a233872","source":"wordfence","cve":"CVE-2024-54405","title":"ECT Social Share <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbbfe17-4ca1-4f95-9bad-a5111a233872?source=api-prod","affected":[{"type":"plugin","slug":"ect-social-share","name":"ECT Social Share","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:41:59Z"},{"id":"wordfence:0cbc3828-7fdc-4128-bd6e-79911756eae4","source":"wordfence","cve":"CVE-2024-37919","title":"Timeline Module for Beaver Builder <= 1.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbc3828-7fdc-4128-bd6e-79911756eae4?source=api-prod","affected":[{"type":"plugin","slug":"timeline-for-beaver-builder","name":"Timeline Module for Beaver Builder","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-08T16:01:42Z"},{"id":"wordfence:0cbdf679-1657-4249-a433-8fe0cddd94be","source":"wordfence","cve":"CVE-2024-1122","title":"Event Manager, Events Calendar, Events Tickets for WooCommerce \u2013 Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cbdf679-1657-4249-a433-8fe0cddd94be?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"3.3.50","to_inclusive":true,"patched_in":"3.3.51"}],"published":"2024-02-08T00:00:00Z","updated":"2024-02-09T04:31:54Z"},{"id":"wordfence:0cc2261a-889e-40ec-8382-48de65b91b34","source":"wordfence","cve":"CVE-2024-13457","title":"Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cc2261a-889e-40ec-8382-48de65b91b34?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.18.1","to_inclusive":true,"patched_in":"5.18.1.1"}],"published":"2025-01-29T18:25:56Z","updated":"2025-01-30T06:41:09Z"},{"id":"wordfence:0cc9cad8-0e2f-4ecf-9ca7-15ca060879c1","source":"wordfence","cve":"CVE-2026-15333","title":"Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cc9cad8-0e2f-4ecf-9ca7-15ca060879c1?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-07-23T18:27:40Z","updated":"2026-07-24T06:51:58Z"},{"id":"wordfence:0cca8b75-c4f5-47ef-90a1-c1270e2f37c1","source":"wordfence","cve":"CVE-2024-10869","title":"GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cca8b75-c4f5-47ef-90a1-c1270e2f37c1?source=api-prod","affected":[{"type":"plugin","slug":"guardgiant","name":"WordPress Brute Force Protection \u2013 Stop Brute Force Attacks","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T15:09:47Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:0ccc60f3-122f-4959-b629-4b83d17083ad","source":"wordfence","cve":"CVE-2026-32356","title":"Robo Gallery <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ccc60f3-122f-4959-b629-4b83d17083ad?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-02-14T00:00:00Z","updated":"2026-04-15T21:04:46Z"},{"id":"wordfence:0ccf1582-7d3d-4ca0-b241-d6deaa79a994","source":"wordfence","cve":"CVE-2025-58663","title":"Qubely <= 1.8.14 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ccf1582-7d3d-4ca0-b241-d6deaa79a994?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2026-11-10T09:47:17Z"},{"id":"wordfence:0cd1ded8-d8e8-48d2-bf6a-7041bd220fb2","source":"wordfence","cve":"CVE-2024-38778","title":"WP Fast Total Search <= 1.69.234 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd1ded8-d8e8-48d2-bf6a-7041bd220fb2?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.69.234","to_inclusive":true,"patched_in":"1.70.236"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:00:27Z"},{"id":"wordfence:0cd2ad77-c5de-470d-bc17-729233e4ab92","source":"wordfence","cve":"CVE-2024-12500","title":"Philantro \u2013 Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd2ad77-c5de-470d-bc17-729233e4ab92?source=api-prod","affected":[{"type":"plugin","slug":"philantro","name":"Philantro \u2013 Donations and Donor Management","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-17T23:09:44Z"},{"id":"wordfence:0cd408be-0e96-4e9f-97d0-977519c8837a","source":"wordfence","cve":"CVE-2026-115301","title":"Contact Form by Supsystic <= 1.11.0 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd408be-0e96-4e9f-97d0-977519c8837a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T19:26:00Z"},{"id":"wordfence:0cd4b65d-b916-432f-bb59-d2f8a9aadeac","source":"wordfence","cve":"CVE-2025-14040","title":"Automotive Car Dealership Business WordPress Theme <= 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd4b65d-b916-432f-bb59-d2f8a9aadeac?source=api-prod","affected":[{"type":"theme","slug":"automotive","name":"Automotive Car Dealership Business WordPress Theme","from":"*","from_inclusive":true,"to":"13.4","to_inclusive":true,"patched_in":"13.4.2"}],"published":"2026-02-26T18:08:31Z","updated":"2026-02-27T06:43:49Z"},{"id":"wordfence:0cd4d88d-0a88-4b81-a2f6-a98a0ddfdfb6","source":"wordfence","cve":"CVE-2009-1030","title":"WordPress MU < 2.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd4d88d-0a88-4b81-a2f6-a98a0ddfdfb6?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2009-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cd62935-f865-43ff-b727-f17b6fc5976d","source":"wordfence","cve":"CVE-2025-22349","title":"WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd62935-f865-43ff-b727-f17b6fc5976d?source=api-prod","affected":[{"type":"plugin","slug":"wp-auctions","name":"WordPress Auction Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:44:15Z"},{"id":"wordfence:0cd63116-cb0e-4ba6-bd25-18b68cd982d9","source":"wordfence","cve":"CVE-2026-83544","title":"Greenshift \u2013 animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd63116-cb0e-4ba6-bd25-18b68cd982d9?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.0","to_inclusive":false,"patched_in":"13.2.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:14Z"},{"id":"wordfence:0cd63268-49ed-43cc-9b91-ad2840220768","source":"wordfence","cve":"CVE-2025-68892","title":"Scroll rss excerpt <= 5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd63268-49ed-43cc-9b91-ad2840220768?source=api-prod","affected":[{"type":"plugin","slug":"scroll-rss-excerpt","name":"Scroll rss excerpt","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:37:11Z"},{"id":"wordfence:0cd6350c-6da8-4d5a-8ceb-d587ddf40d1d","source":"wordfence","cve":"CVE-2022-29440","title":"Promotion Slider <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd6350c-6da8-4d5a-8ceb-d587ddf40d1d?source=api-prod","affected":[{"type":"plugin","slug":"promotion-slider","name":"Promotion Slider","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-22T00:00:00Z","updated":"2025-01-31T20:31:43Z"},{"id":"wordfence:0cd6474f-72e1-4ec2-a056-3c05a0dfa173","source":"wordfence","cve":"CVE-2023-30478","title":"Newsletters <= 4.8.8 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd6474f-72e1-4ec2-a056-3c05a0dfa173?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2023-04-13T00:00:00Z","updated":"2024-04-11T16:37:21Z"},{"id":"wordfence:0cd66329-098e-4adf-b66f-d82a47720629","source":"wordfence","cve":"CVE-2018-5158","title":"pdf.js < 2.0.943 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd66329-098e-4adf-b66f-d82a47720629?source=api-prod","affected":[{"type":"plugin","slug":"algori-pdf-viewer","name":"Algori PDF Viewer","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-11-08T14:03:14Z","updated":"2024-11-08T16:56:03Z"},{"id":"wordfence:0cd72420-dca1-455d-92a6-a178b4b26eab","source":"wordfence","cve":"CVE-2024-3237","title":"ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd72420-dca1-455d-92a6-a178b4b26eab?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.5.25","to_inclusive":true,"patched_in":"3.5.26"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-04T03:31:03Z"},{"id":"wordfence:0cd80bd6-9018-4732-8240-8ffe4fa03227","source":"wordfence","cve":"CVE-2026-120365","title":"WP Customer Area <= 8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd80bd6-9018-4732-8240-8ffe4fa03227?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2026-11-07T10:25:00Z","updated":"2026-11-10T19:36:27Z"},{"id":"wordfence:0cd880c9-75fe-420b-ae41-558678adb57b","source":"wordfence","cve":"CVE-2026-14244","title":"Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd880c9-75fe-420b-ae41-558678adb57b?source=api-prod","affected":[{"type":"plugin","slug":"jssor-slider","name":"Jssor Slider by jssor.com","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:30:06Z","updated":"2026-07-08T04:30:49Z"},{"id":"wordfence:0cd96a4b-8985-430d-b1b6-4176b6dd0bc1","source":"wordfence","cve":"CVE-2026-32494","title":"Image Slider by Ays- Responsive Slider and Carousel <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd96a4b-8985-430d-b1b6-4176b6dd0bc1?source=api-prod","affected":[{"type":"plugin","slug":"ays-slider","name":"Image Slider by Ays- Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:48:56Z"},{"id":"wordfence:0cdadbf2-8b5d-4018-8cee-0d0fb07696f9","source":"wordfence","cve":"CVE-2024-11758","title":"WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdadbf2-8b5d-4018-8cee-0d0fb07696f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-spid-italia","name":"WP SPID Italia","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.12"}],"published":"2025-01-10T19:04:34Z","updated":"2025-02-13T22:14:07Z"},{"id":"wordfence:0cdd5562-8755-4ca3-9c16-a5b364f8408b","source":"wordfence","cve":"CVE-2026-19658","title":"Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cdd5562-8755-4ca3-9c16-a5b364f8408b?source=api-prod","affected":[{"type":"plugin","slug":"give-tributes","name":"Give Tributes","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.1.1"}],"published":"2026-09-21T15:55:06Z","updated":"2026-09-22T04:27:39Z"},{"id":"wordfence:0cde6b5b-f760-467b-940f-06a1f983ddc4","source":"wordfence","cve":"CVE-2021-24153","title":"Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cde6b5b-f760-467b-940f-06a1f983ddc4?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2016-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ce2786e-2918-4dc0-99c4-db447216e140","source":"wordfence","cve":"","title":"Resize Image After Upload <= 1.8.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce2786e-2918-4dc0-99c4-db447216e140?source=api-prod","affected":[{"type":"plugin","slug":"resize-image-after-upload","name":"Resize Image After Upload","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ce2a9fe-3364-46b5-a6ae-b4feb3e20647","source":"wordfence","cve":"CVE-2024-9072","title":"GDPR-Extensions-com \u2013 Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce2a9fe-3364-46b5-a6ae-b4feb3e20647?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-consent-manager","name":"GDPR-Extensions-com \u2013 Consent Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-10-09T13:28:33Z","updated":"2024-11-15T15:23:09Z"},{"id":"wordfence:0ce2d464-b467-47cb-b3ac-0487de778434","source":"wordfence","cve":"CVE-2025-31640","title":"Magic Responsive Slider and Carousel WordPress <= 1.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce2d464-b467-47cb-b3ac-0487de778434?source=api-prod","affected":[{"type":"plugin","slug":"magic-carousel","name":"Magic Responsive Slider and Carousel WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-24T22:24:19Z"},{"id":"wordfence:0ce2dc45-0e23-4fba-8ef3-543db2a02eda","source":"wordfence","cve":"CVE-2024-29758","title":"Co-marquage service-public.fr <= 0.5.72 - Reflected Cross-Site Scripting via search_term","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce2dc45-0e23-4fba-8ef3-543db2a02eda?source=api-prod","affected":[{"type":"plugin","slug":"co-marquage-service-public","name":"Co-marquage service-public.fr","from":"*","from_inclusive":true,"to":"0.5.72","to_inclusive":true,"patched_in":"0.5.73"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T16:33:59Z"},{"id":"wordfence:0ce738ee-bbb6-462a-aeae-0523200e320f","source":"wordfence","cve":"CVE-2024-31274","title":"EmbedPress <= 3.9.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce738ee-bbb6-462a-aeae-0523200e320f?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.9.12"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:50:17Z"},{"id":"wordfence:0ce75db8-cf80-4d97-833b-1cb70f0eb93b","source":"wordfence","cve":"CVE-2025-22575","title":"SUPER RESPONSIVE SLIDER <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce75db8-cf80-4d97-833b-1cb70f0eb93b?source=api-prod","affected":[{"type":"plugin","slug":"super-slider","name":"SUPER RESPONSIVE SLIDER","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:05:49Z"},{"id":"wordfence:0ce8ed18-2164-4b5a-b1d3-fda8d348ebf9","source":"wordfence","cve":"CVE-2021-39312","title":"True Ranker <= 2.2.2 - Directory Traversal/Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce8ed18-2164-4b5a-b1d3-fda8d348ebf9?source=api-prod","affected":[{"type":"plugin","slug":"seo-local-rank","name":"TrueRanker","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2021-12-13T12:43:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cebc614-7ceb-49ed-96d7-57f7cc61c396","source":"wordfence","cve":"CVE-2025-48110","title":"Link View <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cebc614-7ceb-49ed-96d7-57f7cc61c396?source=api-prod","affected":[{"type":"plugin","slug":"link-view","name":"Link View","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:11:55Z"},{"id":"wordfence:0ced1c79-97fe-4841-9a02-ffb9f336212a","source":"wordfence","cve":"CVE-2024-10837","title":"SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ced1c79-97fe-4841-9a02-ffb9f336212a?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"2.7.29","to_inclusive":true,"patched_in":"2.7.30"}],"published":"2024-11-09T00:08:17Z","updated":"2024-11-09T12:30:21Z"},{"id":"wordfence:0cedce2a-b261-4e3f-b901-fa73ab49ca15","source":"wordfence","cve":"CVE-2026-22336","title":"Directorist Booking <= 2.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cedce2a-b261-4e3f-b901-fa73ab49ca15?source=api-prod","affected":[{"type":"plugin","slug":"directorist-booking","name":"Booking (Reservation & Appointment)","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:52:17Z"},{"id":"wordfence:0cee20a7-3730-4ee8-85db-79d9d2e9e4c4","source":"wordfence","cve":"CVE-2026-57709","title":"Membership For WooCommerce <= 3.1.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cee20a7-3730-4ee8-85db-79d9d2e9e4c4?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:41:42Z"},{"id":"wordfence:0cee3379-7f53-408b-a77d-8eb69cbf3f63","source":"wordfence","cve":"CVE-2025-23582","title":"Bulk Categories Assign <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cee3379-7f53-408b-a77d-8eb69cbf3f63?source=api-prod","affected":[{"type":"plugin","slug":"bulk-categories-assign","name":"Bulk Categories Assign","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:48:46Z"},{"id":"wordfence:0cef43a2-7917-4abd-b8f5-4a7604eadb70","source":"wordfence","cve":"CVE-2024-32445","title":"WebinarIgnition <= 3.05.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cef43a2-7917-4abd-b8f5-4a7604eadb70?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"3.05.8","to_inclusive":true,"patched_in":"3.06.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T20:57:46Z"},{"id":"wordfence:0cefa293-c934-413e-b946-07e3060472ee","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization in ajaxCalculatePrice function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cefa293-c934-413e-b946-07e3060472ee?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cf60aad-1c74-4da2-b62a-42582a74e0e9","source":"wordfence","cve":"CVE-2026-10525","title":"NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf60aad-1c74-4da2-b62a-42582a74e0e9?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-29T21:46:04Z"},{"id":"wordfence:0cf614a2-d5fe-4881-9a88-c993da58ca2a","source":"wordfence","cve":"CVE-2025-57976","title":"CardCom Payment Gateway <= 3.5.1.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf614a2-d5fe-4881-9a88-c993da58ca2a?source=api-prod","affected":[{"type":"plugin","slug":"woo-cardcom-payment-gateway","name":"CardCom Payment Gateway","from":"*","from_inclusive":true,"to":"3.5.1.0","to_inclusive":true,"patched_in":"3.5.1.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-28T21:08:30Z"},{"id":"wordfence:0cf65972-a651-41b0-8f57-709e0ff685fa","source":"wordfence","cve":"CVE-2024-43937","title":"WP Crowdfunding <= 2.1.10 - Missing Authorization to Authenticated (Subscriber+) to Enable/Disable Addons","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf65972-a651-41b0-8f57-709e0ff685fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2024-08-26T00:00:00Z","updated":"2024-10-24T18:35:15Z"},{"id":"wordfence:0cf7ec81-625b-4abf-9304-256701e933ee","source":"wordfence","cve":"CVE-2024-30542","title":"WholesaleX <= 1.3.2 - Unauthenticated Privilege Escalation","severity":"medium","cvss":6.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf7ec81-625b-4abf-9304-256701e933ee?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:44:47Z"},{"id":"wordfence:0cf965c9-32e4-4c8d-97cf-a30afdc5aac3","source":"wordfence","cve":"CVE-2026-81768","title":"Super Store Finder <= 7.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf965c9-32e4-4c8d-97cf-a30afdc5aac3?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.10","to_inclusive":true,"patched_in":"7.11"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:48:49Z"},{"id":"wordfence:0cf9c390-81d7-45d4-a6df-22b16235d11b","source":"wordfence","cve":"CVE-2023-35778","title":"Recent Posts Slider <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cf9c390-81d7-45d4-a6df-22b16235d11b?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-slider","name":"Recent Posts Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cfb24d4-1af1-4218-b506-6063549e7b6f","source":"wordfence","cve":"CVE-2026-120848","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.8.3 - Authenticated (Vendor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cfb24d4-1af1-4218-b506-6063549e7b6f?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-11-07T08:51:00Z","updated":"2026-11-10T19:40:09Z"},{"id":"wordfence:0cfd7098-05c9-45c3-95eb-613894867743","source":"wordfence","cve":"CVE-2026-39480","title":"BackupBliss \u2013 Backup & Migration with Free Cloud Storage <= 2.1.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cfd7098-05c9-45c3-95eb-613894867743?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:47:26Z"},{"id":"wordfence:0cfdb6de-41f8-4bea-a017-5708fceee762","source":"wordfence","cve":"","title":"Social Share Button <= 2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cfdb6de-41f8-4bea-a017-5708fceee762?source=api-prod","affected":[{"type":"plugin","slug":"social-share-button","name":"Social Share Button","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0cff4eee-0063-4ad9-bd14-b940431688a6","source":"wordfence","cve":"CVE-2026-97197","title":"WebToffee WP Backup and Migration <= 1.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cff4eee-0063-4ad9-bd14-b940431688a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:47:54Z"},{"id":"wordfence:0cff5ca7-887b-4d4d-8592-e40876fbe000","source":"wordfence","cve":"CVE-2025-31379","title":"Insert HTML Here <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0cff5ca7-887b-4d4d-8592-e40876fbe000?source=api-prod","affected":[{"type":"plugin","slug":"insert-html-here","name":"Insert HTML Here","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:09:25Z"},{"id":"wordfence:0d00b50c-949a-4fd0-9eab-3555d263fcc7","source":"wordfence","cve":"CVE-2025-14074","title":"PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d00b50c-949a-4fd0-9eab-3555d263fcc7?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-contact-form-7","name":"PDF for Contact Form 7 + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.3.3","to_inclusive":true,"patched_in":"6.3.4"}],"published":"2025-12-11T21:11:01Z","updated":"2026-03-27T10:45:18Z"},{"id":"wordfence:0d00e477-8e01-4144-86e6-f1cc00fb1d0a","source":"wordfence","cve":"CVE-2021-24610","title":"TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d00e477-8e01-4144-86e6-f1cc00fb1d0a?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d012f97-9ccb-4ff6-a24a-df3c10bacc63","source":"wordfence","cve":"CVE-2026-39465","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d012f97-9ccb-4ff6-a24a-df3c10bacc63?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.106.0","to_inclusive":true,"patched_in":"3.107.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:39:10Z"},{"id":"wordfence:0d017b2c-1e15-401a-ae57-4653ca41b7e6","source":"wordfence","cve":"CVE-2023-23747","title":"MainWP Buddy Extension <= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d017b2c-1e15-401a-ae57-4653ca41b7e6?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-buddy-extension","name":"MainWP Buddy Extension","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d041b14-0d05-4bfe-bd5c-7e06d7b108b8","source":"wordfence","cve":"CVE-2023-49831","title":"RegistrationMagic <= 5.2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d041b14-0d05-4bfe-bd5c-7e06d7b108b8?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.3.0","to_inclusive":true,"patched_in":"5.2.3.1"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d04b822-a48a-485e-b9b5-f5a213307c71","source":"wordfence","cve":"CVE-2024-7389","title":"Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-522","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.29.1","to_inclusive":true,"patched_in":"1.29.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-02T04:29:56Z"},{"id":"wordfence:0d0a03e5-b09c-430d-aa65-8ef9e01cf241","source":"wordfence","cve":"CVE-2025-5258","title":"Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d0a03e5-b09c-430d-aa65-8ef9e01cf241?source=api-prod","affected":[{"type":"plugin","slug":"conference-scheduler","name":"Conference Scheduler","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-06-23T18:33:45Z","updated":"2025-06-24T07:29:30Z"},{"id":"wordfence:0d10f5cd-d449-46f1-a347-f45a1db65999","source":"wordfence","cve":"CVE-2023-25459","title":"Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d10f5cd-d449-46f1-a347-f45a1db65999?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d1102e9-212d-42d1-90ec-91a8b18d3393","source":"wordfence","cve":"CVE-2026-112858","title":"Rhodos - Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1102e9-212d-42d1-90ec-91a8b18d3393?source=api-prod","affected":[{"type":"theme","slug":"rhodos","name":"Rhodos - Business Portfolio Elementor Blocks & Template Kit","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:44Z"},{"id":"wordfence:0d127114-9c80-4722-953a-3ee1382b9f81","source":"wordfence","cve":"CVE-2025-11878","title":"ST Categories Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d127114-9c80-4722-953a-3ee1382b9f81?source=api-prod","affected":[{"type":"plugin","slug":"st-category-wp","name":"ST Categories Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:17:25Z","updated":"2025-10-22T08:27:04Z"},{"id":"wordfence:0d1456bb-9ecb-406e-b1c8-b582bee094a9","source":"wordfence","cve":"CVE-2025-68040","title":"Project Manager <= 3.0.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1456bb-9ecb-406e-b1c8-b582bee094a9?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-27T20:43:50Z"},{"id":"wordfence:0d18b0b1-8f1c-4eb3-8098-116d5da932bf","source":"wordfence","cve":"CVE-2026-84737","title":"Freeton WP <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d18b0b1-8f1c-4eb3-8098-116d5da932bf?source=api-prod","affected":[{"type":"plugin","slug":"freeton-wp","name":"Freeton WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:28:08Z"},{"id":"wordfence:0d195034-4617-474d-a4b1-b299c1607f89","source":"wordfence","cve":"CVE-2025-14468","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d195034-4617-474d-a4b1-b299c1607f89?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2026-01-06T16:00:31Z","updated":"2026-01-15T21:12:10Z"},{"id":"wordfence:0d1a12b9-ac2e-4c60-8dd5-484944bb0ab8","source":"wordfence","cve":"","title":"Custom Permalinks <= 1.1 -Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1a12b9-ac2e-4c60-8dd5-484944bb0ab8?source=api-prod","affected":[{"type":"plugin","slug":"custom-permalinks","name":"Custom Permalinks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2018-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d1a9adb-ade4-4ac5-ad68-1354a4418db0","source":"wordfence","cve":"CVE-2024-50492","title":"ScottCart <= 1.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1a9adb-ade4-4ac5-ad68-1354a4418db0?source=api-prod","affected":[{"type":"plugin","slug":"scottcart","name":"WordPress eCommerce \u2013 ScottCart","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:39:13Z"},{"id":"wordfence:0d1b2539-bff0-4185-8162-9e8b75183bb8","source":"wordfence","cve":"CVE-2024-49279","title":"Hyperlink Group Block <= 1.17.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1b2539-bff0-4185-8162-9e8b75183bb8?source=api-prod","affected":[{"type":"plugin","slug":"hyperlink-group-block","name":"Hyperlink Group Block","from":"*","from_inclusive":true,"to":"1.17.5","to_inclusive":true,"patched_in":"1.17.6"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-25T20:14:31Z"},{"id":"wordfence:0d1c85c3-2aa7-4b65-a771-a4571746bfc9","source":"wordfence","cve":"CVE-2025-49854","title":"Slim SEO <= 4.5.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1c85c3-2aa7-4b65-a771-a4571746bfc9?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T15:03:57Z"},{"id":"wordfence:0d1ff67c-f644-46d1-abad-e5fc2b177786","source":"wordfence","cve":"CVE-2026-25473","title":"WZone <= 14.0.31 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d1ff67c-f644-46d1-abad-e5fc2b177786?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.0.31","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-05-04T15:34:50Z"},{"id":"wordfence:0d20bae1-5a94-402b-9001-725b433c9d55","source":"wordfence","cve":"CVE-2021-24225","title":"Advanced Booking Calendar <= 1.6.6 - Reflected Cross-Site Scripting via calId Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d20bae1-5a94-402b-9001-725b433c9d55?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"}],"published":"2021-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d2136e8-6769-4493-859b-dec8803be285","source":"wordfence","cve":"CVE-2025-30582","title":"DyaPress ERP/CRM <= 18.0.2.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2136e8-6769-4493-859b-dec8803be285?source=api-prod","affected":[{"type":"plugin","slug":"dyapress","name":"DyaPress ERP/CRM","from":"*","from_inclusive":true,"to":"18.0.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:43:03Z"},{"id":"wordfence:0d2309cd-625e-4508-8d60-25817023aa15","source":"wordfence","cve":"CVE-2019-5972","title":"Online Lesson Booking <= 0.8.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2309cd-625e-4508-8d60-25817023aa15?source=api-prod","affected":[{"type":"plugin","slug":"online-lesson-booking-system","name":"Online Lesson Booking","from":"*","from_inclusive":true,"to":"0.8.6","to_inclusive":true,"patched_in":"0.8.7"}],"published":"2019-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d24ac1e-6aa7-4a5a-89e6-821456efd861","source":"wordfence","cve":"CVE-2026-119480","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.7.1 - Authenticated (Subscriber+) Arbitrary Media Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d24ac1e-6aa7-4a5a-89e6-821456efd861?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.7.1","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:51:00Z"},{"id":"wordfence:0d28ca71-2a7c-470f-9f84-ff89460e7f96","source":"wordfence","cve":"CVE-2026-92412","title":"Five Star Restaurant Reviews <= 2.3.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d28ca71-2a7c-470f-9f84-ff89460e7f96?source=api-prod","affected":[{"type":"plugin","slug":"good-reviews-wp","name":"Five Star Restaurant Reviews","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.3.14"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T00:02:36Z"},{"id":"wordfence:0d28ff12-e267-44b2-b9fe-8270cdd7b540","source":"wordfence","cve":"CVE-2026-66614","title":"GEO Plugin by Squirrly SEO <= 14.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d28ff12-e267-44b2-b9fe-8270cdd7b540?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"14.2.2","to_inclusive":true,"patched_in":"14.2.3"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:25:34Z"},{"id":"wordfence:0d2bd628-4df2-47f3-a9c8-35f544fc240c","source":"wordfence","cve":"CVE-2026-45210","title":"Broadstreet Ads <= 1.52.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2bd628-4df2-47f3-a9c8-35f544fc240c?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.52.2","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-02-21T00:00:00Z","updated":"2026-07-10T19:23:17Z"},{"id":"wordfence:0d2daa67-50b6-4850-92bf-49f29b1d8eb7","source":"wordfence","cve":"CVE-2017-18613","title":"Trust Form <= 2.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2daa67-50b6-4850-92bf-49f29b1d8eb7?source=api-prod","affected":[{"type":"plugin","slug":"trust-form","name":"trust-form","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2018-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d2dc86e-f937-429f-9baa-0eb0a8715513","source":"wordfence","cve":"CVE-2024-4661","title":"WP Reset <= 2.02 - Missing Authorization to License Key Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.03"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T05:44:29Z"},{"id":"wordfence:0d2f534b-804e-4def-bcc6-7418ad7d1ffd","source":"wordfence","cve":"CVE-2026-109985","title":"xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2f534b-804e-4def-bcc6-7418ad7d1ffd?source=api-prod","affected":[{"type":"plugin","slug":"xspeed","name":"xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-10-16T14:43:31Z","updated":"2026-10-17T03:43:27Z"},{"id":"wordfence:0d3010a9-10fa-40ec-9791-3ac993123f93","source":"wordfence","cve":"CVE-2015-0895","title":"All In One WP Security & Firewall <= 3.8.9 - Cross-Site Request Forgery","severity":"low","cvss":3.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d3010a9-10fa-40ec-9791-3ac993123f93?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2015-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d36650d-6997-457d-ac8d-04f98e2080ef","source":"wordfence","cve":"CVE-2026-19796","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d36650d-6997-457d-ac8d-04f98e2080ef?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-08-31T15:52:29Z","updated":"2026-09-01T04:27:48Z"},{"id":"wordfence:0d379aab-9fc7-4012-83d9-f55a1bd26918","source":"wordfence","cve":"CVE-2025-24664","title":"LTL Freight Quotes \u2013 Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d379aab-9fc7-4012-83d9-f55a1bd26918?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-worldwide-express-edition","name":"LTL Freight Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.0.20","to_inclusive":true,"patched_in":"5.0.21"}],"published":"2025-01-18T00:00:00Z","updated":"2025-03-04T19:33:09Z"},{"id":"wordfence:0d3aa440-29a8-47cd-98f4-cf1cbdf92f66","source":"wordfence","cve":"CVE-2024-3026","title":"WordPress Button Plugin MaxButtons <= 9.7.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d3aa440-29a8-47cd-98f4-cf1cbdf92f66?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.7.7","to_inclusive":true,"patched_in":"9.7.8"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-10T17:24:03Z"},{"id":"wordfence:0d3f7676-5ab0-4fe0-a0be-786f4cf84056","source":"wordfence","cve":"CVE-2023-48764","title":"WordPress Brute Force Protection \u2013 Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d3f7676-5ab0-4fe0-a0be-786f4cf84056?source=api-prod","affected":[{"type":"plugin","slug":"guardgiant","name":"WordPress Brute Force Protection \u2013 Stop Brute Force Attacks","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d3fa716-6f11-428c-b2da-2bb768a92fe0","source":"wordfence","cve":"CVE-2023-28690","title":"WP BrowserUpdate <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d3fa716-6f11-428c-b2da-2bb768a92fe0?source=api-prod","affected":[{"type":"plugin","slug":"wp-browser-update","name":"WP BrowserUpdate","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2023-04-26T00:00:00Z","updated":"2026-03-27T10:46:30Z"},{"id":"wordfence:0d40c05d-dc30-47b1-aea5-cd2b72d4c4c0","source":"wordfence","cve":"CVE-2026-9280","title":"Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d40c05d-dc30-47b1-aea5-cd2b72d4c4c0?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.15","to_inclusive":true,"patched_in":"2.8.16"}],"published":"2026-06-05T14:15:21Z","updated":"2026-06-06T02:28:34Z"},{"id":"wordfence:0d423c90-89ca-4295-92eb-d26acd445db0","source":"wordfence","cve":"CVE-2026-59521","title":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials <= 3.1.15 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d423c90-89ca-4295-92eb-d26acd445db0?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:50:52Z"},{"id":"wordfence:0d42ca2f-f061-4cd1-812b-46d42c440498","source":"wordfence","cve":"CVE-2025-0865","title":"WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d42ca2f-f061-4cd1-812b-46d42c440498?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-category-management","name":"WP Media Category Management","from":"2.0","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-02-18T19:23:39Z","updated":"2025-02-19T07:32:06Z"},{"id":"wordfence:0d4420bf-1095-44ca-8fa6-dd5ea11c7489","source":"wordfence","cve":"","title":"Findgo <= 1.3.31 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d4420bf-1095-44ca-8fa6-dd5ea11c7489?source=api-prod","affected":[{"type":"theme","slug":"findgo","name":"Findgo - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.32","to_inclusive":false,"patched_in":"1.3.32"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d443d5f-ccf7-4eed-a5cb-ead0466a9d42","source":"wordfence","cve":"CVE-2016-1000149","title":"Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d443d5f-ccf7-4eed-a5cb-ead0466a9d42?source=api-prod","affected":[{"type":"plugin","slug":"simpel-reserveren","name":"Simpel Reserveren 3","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2016-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d4c5ff9-d4aa-4270-b00b-41353b32c8e5","source":"wordfence","cve":"CVE-2022-3855","title":"404 to Start <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d4c5ff9-d4aa-4270-b00b-41353b32c8e5?source=api-prod","affected":[{"type":"plugin","slug":"404-to-start","name":"404 to Start","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d4e3560-2208-4122-812e-0c506fe45126","source":"wordfence","cve":"","title":"Autoptimize <= 2.1.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d4e3560-2208-4122-812e-0c506fe45126?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2017-06-19T00:00:00Z","updated":"2024-06-14T20:03:07Z"},{"id":"wordfence:0d50eda3-20d8-436b-968c-9d8eeccaa0c9","source":"wordfence","cve":"","title":"Sparky <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d50eda3-20d8-436b-968c-9d8eeccaa0c9?source=api-prod","affected":[{"type":"theme","slug":"sparky","name":"Sparky","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d50f217-7a53-49bf-9ce9-9922d0b3e18b","source":"wordfence","cve":"","title":"WP Ultimate CSV Importer <= 3.7 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d50f217-7a53-49bf-9ce9-9922d0b3e18b?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2015-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d517094-8038-4951-b16a-db7bf2c31851","source":"wordfence","cve":"CVE-2014-8877","title":"CM Download Manager <= 2.0.3 - Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d517094-8038-4951-b16a-db7bf2c31851?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2014-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d547ba1-bfe5-4dce-a02e-90d865ebea86","source":"wordfence","cve":"CVE-2026-32472","title":"Online Contact Widget-\u591a\u5408\u4e00\u5728\u7ebf\u5ba2\u670d\u63d2\u4ef6 <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d547ba1-bfe5-4dce-a02e-90d865ebea86?source=api-prod","affected":[{"type":"plugin","slug":"online-contact-widget","name":"Online Contact Widget-\u591a\u5408\u4e00\u5728\u7ebf\u5ba2\u670d\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:16:04Z"},{"id":"wordfence:0d54e5ad-0a97-4dd4-b53b-ad3f885dc506","source":"wordfence","cve":"CVE-2024-31347","title":"Tracking Code Manager <= 2.1.0 - Missing Authorization via change_order()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d54e5ad-0a97-4dd4-b53b-ad3f885dc506?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:59:32Z"},{"id":"wordfence:0d583c43-7da9-40c6-a71d-ec5834e6c427","source":"wordfence","cve":"CVE-2025-28955","title":"Easy Video Player Wordpress & WooCommerce <= 10.0 - Unauthenticated Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d583c43-7da9-40c6-a71d-ec5834e6c427?source=api-prod","affected":[{"type":"theme","slug":"fwdevp","name":"Easy Video Player Wordpress & WooCommerce Plugin","from":"*","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:08:06Z"},{"id":"wordfence:0d594e40-ae4d-43f7-b57e-8070a68d1c94","source":"wordfence","cve":"CVE-2013-2108","title":"WP Cleanfix <= 3.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d594e40-ae4d-43f7-b57e-8070a68d1c94?source=api-prod","affected":[{"type":"plugin","slug":"wp-cleanfix","name":"WP CleanFix","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2012-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d5a0c05-736f-4fb9-9358-894977664bf4","source":"wordfence","cve":"","title":"Event Calendar <= 1.1.44 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5a0c05-736f-4fb9-9358-894977664bf4?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.1.45","to_inclusive":false,"patched_in":"1.1.45"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d5d4571-f6a1-4994-9763-84578b65941c","source":"wordfence","cve":"CVE-2024-0974","title":"Social Media Widget <= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5d4571-f6a1-4994-9763-84578b65941c?source=api-prod","affected":[{"type":"plugin","slug":"social-media-widget","name":"Social Media Widget","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-08T13:15:19Z"},{"id":"wordfence:0d5d47bd-4f05-4dc7-84c1-f7bc1196ee16","source":"wordfence","cve":"CVE-2024-4107","title":"Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5d47bd-4f05-4dc7-84c1-f7bc1196ee16?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":true,"patched_in":"3.21.2"}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-09T20:03:19Z"},{"id":"wordfence:0d5e4dae-7964-4b24-bab2-db523de5f1f4","source":"wordfence","cve":"CVE-2024-38761","title":"Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5e4dae-7964-4b24-bab2-db523de5f1f4?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.99","to_inclusive":true,"patched_in":"3.3.100"}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-15T18:17:52Z"},{"id":"wordfence:0d5f2531-216e-4214-a74b-bdf8011432e1","source":"wordfence","cve":"CVE-2026-28129","title":"Little Birdies | Multipurpose Children PSD Template <= 1.3.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5f2531-216e-4214-a74b-bdf8011432e1?source=api-prod","affected":[{"type":"theme","slug":"little-birdies","name":"Little Birdies | Multipurpose Children PSD Template","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:34:49Z"},{"id":"wordfence:0d61468b-8fda-4775-8099-a34ddf34566b","source":"wordfence","cve":"CVE-2026-120513","title":"Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter","severity":"high","cvss":8.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d61468b-8fda-4775-8099-a34ddf34566b?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-11-09T18:20:39Z","updated":"2026-11-10T06:47:01Z"},{"id":"wordfence:0d627ee7-1175-4621-a477-1e9ec2d05eee","source":"wordfence","cve":"CVE-2023-5745","title":"Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d627ee7-1175-4621-a477-1e9ec2d05eee?source=api-prod","affected":[{"type":"plugin","slug":"reusable-text-blocks","name":"Reusable Text Blocks","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d6914fa-d968-44c0-be88-b3e8c8d3ebf1","source":"wordfence","cve":"CVE-2025-25154","title":"Custom Comment Notifications <= 1.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d6914fa-d968-44c0-be88-b3e8c8d3ebf1?source=api-prod","affected":[{"type":"plugin","slug":"custom-comment-notifications","name":"Custom Comment Notifications","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:14:33Z"},{"id":"wordfence:0d6adf41-6cb1-4c11-940d-fabc9298f3af","source":"wordfence","cve":"CVE-2024-32727","title":"RomethemeForm For Elementor <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d6adf41-6cb1-4c11-940d-fabc9298f3af?source=api-prod","affected":[{"type":"plugin","slug":"romethemeform","name":"RTMForm \u2013 Contact Form, Multi-Step Forms & Form Templates for Elementor","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:09:47Z"},{"id":"wordfence:0d6af3cd-1a92-428f-a51c-f01a3ba6ebae","source":"wordfence","cve":"","title":"Enfold - Responsive Multi-Purpose Theme < 4.2.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d6af3cd-1a92-428f-a51c-f01a3ba6ebae?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"}],"published":"2018-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d6f500c-3fad-4394-b8a3-0c128d0d57f4","source":"wordfence","cve":"CVE-2024-13669","title":"CalendApp <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d6f500c-3fad-4394-b8a3-0c128d0d57f4?source=api-prod","affected":[{"type":"plugin","slug":"calendapp","name":"CalendApp","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:27:30Z"},{"id":"wordfence:0d700939-aeac-4848-aa12-33498ec464de","source":"wordfence","cve":"CVE-2026-57389","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d700939-aeac-4848-aa12-33498ec464de?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:23:18Z"},{"id":"wordfence:0d71e500-04f7-44bf-a6d6-f3ea2e95741c","source":"wordfence","cve":"CVE-2026-103517","title":"Airwallex Online Payments Gateway <= 1.35.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d71e500-04f7-44bf-a6d6-f3ea2e95741c?source=api-prod","affected":[{"type":"plugin","slug":"airwallex-online-payments-gateway","name":"Airwallex Online Payments Gateway","from":"*","from_inclusive":true,"to":"1.35.0","to_inclusive":true,"patched_in":"1.36.0"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T13:35:52Z"},{"id":"wordfence:0d758977-2e78-4395-bd18-7f25aecf8a55","source":"wordfence","cve":"CVE-2026-66642","title":"WP Umbrella: Security Backup Restore & Monitoring  2.24.2-2.26.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d758977-2e78-4395-bd18-7f25aecf8a55?source=api-prod","affected":[{"type":"plugin","slug":"wp-health","name":"WP Umbrella: Security Backup Restore & Monitoring","from":"2.24.2","from_inclusive":true,"to":"2.26.2","to_inclusive":true,"patched_in":"2.27.0"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:51:24Z"},{"id":"wordfence:0d794052-1ba2-4772-bc15-5d9732e015e1","source":"wordfence","cve":"CVE-2021-39353","title":"Easy Registration Forms <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d794052-1ba2-4772-bc15-5d9732e015e1?source=api-prod","affected":[{"type":"plugin","slug":"easy-registration-forms","name":"Easy Registration Forms","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2021-11-18T16:42:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d7b3f2a-0a82-4cd4-96a9-2b1257d7b13c","source":"wordfence","cve":"CVE-2024-32716","title":"StreamWeasels Twitch Integration <= 1.7.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d7b3f2a-0a82-4cd4-96a9-2b1257d7b13c?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:39:42Z"},{"id":"wordfence:0d7b65eb-ec97-4307-be01-ed4c0d6d2f10","source":"wordfence","cve":"CVE-2024-50501","title":"Kata Plus <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d7b65eb-ec97-4307-be01-ed4c0d6d2f10?source=api-prod","affected":[{"type":"plugin","slug":"kata-plus","name":"Kata Plus \u2013 Addons for Elementor \u2013 Widgets, Extensions and Templates","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:33:57Z"},{"id":"wordfence:0d7fec5d-895e-4366-a31c-248a3daf8937","source":"wordfence","cve":"CVE-2011-4926","title":"Adminimize <= 1.7.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d7fec5d-895e-4366-a31c-248a3daf8937?source=api-prod","affected":[{"type":"plugin","slug":"adminimize","name":"Adminimize","from":"*","from_inclusive":true,"to":"1.7.21","to_inclusive":true,"patched_in":"1.7.22"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d806853-48c7-4c1c-9a9f-37d493695682","source":"wordfence","cve":"CVE-2022-27862","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d806853-48c7-4c1c-9a9f-37d493695682?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-04-18T10:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d82ab22-da6d-4526-a70a-519589b29187","source":"wordfence","cve":"CVE-2021-24735","title":"Compact WP Audio Player <= 1.9.6 - Setting Change via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d82ab22-da6d-4526-a70a-519589b29187?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d82c866-5b35-414e-bd72-30530930d5d8","source":"wordfence","cve":"CVE-2024-11230","title":"Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d82c866-5b35-414e-bd72-30530930d5d8?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.46","to_inclusive":true,"patched_in":"1.6.47"}],"published":"2024-12-22T16:21:51Z","updated":"2024-12-23T04:23:14Z"},{"id":"wordfence:0d837229-52fa-42ae-b733-8fbeb444f110","source":"wordfence","cve":"CVE-2025-9873","title":"a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d837229-52fa-42ae-b733-8fbeb444f110?source=api-prod","affected":[{"type":"plugin","slug":"a3-lazy-load","name":"a3 Lazy Load","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2025-12-12T15:42:39Z","updated":"2025-12-13T04:31:22Z"},{"id":"wordfence:0d87a375-81b8-4f81-8fd5-46608c84faca","source":"wordfence","cve":"CVE-2025-25081","title":"Embed RSS <= 3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d87a375-81b8-4f81-8fd5-46608c84faca?source=api-prod","affected":[{"type":"plugin","slug":"embed-rss","name":"Embed RSS","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:05:50Z"},{"id":"wordfence:0d8a8aa7-8344-4ca7-8194-9bc679d18661","source":"wordfence","cve":"CVE-2020-10196","title":"Popup Builder <= 3.63 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8a8aa7-8344-4ca7-8194-9bc679d18661?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"3.63","to_inclusive":true,"patched_in":"3.64.1"}],"published":"2020-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d8bc203-c17a-4b31-8f9e-695f9e638cda","source":"wordfence","cve":"CVE-2026-5075","title":"All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8bc203-c17a-4b31-8f9e-695f9e638cda?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.7.1"}],"published":"2026-05-19T14:51:29Z","updated":"2026-05-20T03:28:14Z"},{"id":"wordfence:0d8c043c-e347-4dc8-8a72-943a7e6c4394","source":"wordfence","cve":"CVE-2024-0792","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8c043c-e347-4dc8-8a72-943a7e6c4394?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:35:52Z"},{"id":"wordfence:0d8ea1c2-7c6e-43b3-97ca-a06438d51d11","source":"wordfence","cve":"CVE-2024-7291","title":"JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.3.4.1","to_inclusive":true,"patched_in":"3.3.4.2"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-03T06:41:43Z"},{"id":"wordfence:0d9077cf-10cc-47cd-aca8-8f2110ccc407","source":"wordfence","cve":"CVE-2022-2072","title":"Name Directory <= 1.25.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9077cf-10cc-47cd-aca8-8f2110ccc407?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.25.2","to_inclusive":true,"patched_in":"1.25.3"}],"published":"2022-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d915285-3768-4d54-8da6-8c7ec23aec25","source":"wordfence","cve":"CVE-2026-39769","title":"Graphina \u2013 Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d915285-3768-4d54-8da6-8c7ec23aec25?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-28T21:16:18Z"},{"id":"wordfence:0d943691-66cf-4018-9eb6-5f20db0a95a9","source":"wordfence","cve":"CVE-2017-18600","title":"Premium WordPress Form Builder <= 3.2.31 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d943691-66cf-4018-9eb6-5f20db0a95a9?source=api-prod","affected":[{"type":"plugin","slug":"formcraft3","name":"FormCraft","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2017-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d96465a-d1b6-4991-8e81-e80a0d15a902","source":"wordfence","cve":"CVE-2025-10166","title":"Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d96465a-d1b6-4991-8e81-e80a0d15a902?source=api-prod","affected":[{"type":"plugin","slug":"social-media-shortcodes","name":"Social Media Shortcodes","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-09-16T13:39:18Z","updated":"2025-09-17T01:49:14Z"},{"id":"wordfence:0d9712c2-1698-4c67-a700-a4598cb25a95","source":"wordfence","cve":"CVE-2025-11803","title":"WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9712c2-1698-4c67-a700-a4598cb25a95?source=api-prod","affected":[{"type":"plugin","slug":"wpsite-shortcode","name":"WPSite Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:32:10Z","updated":"2025-11-21T08:28:13Z"},{"id":"wordfence:0d9817ff-ca56-4941-97bc-f26defe7ddd5","source":"wordfence","cve":"CVE-2024-12041","title":"Directorist \u2013 AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9817ff-ca56-4941-97bc-f26defe7ddd5?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.0.12","to_inclusive":true,"patched_in":"8.1"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T05:30:37Z"},{"id":"wordfence:0d98c849-4178-4cee-846b-2c136bc56daf","source":"wordfence","cve":"CVE-2020-36736","title":"WooCommerce Checkout & Funnel Builder by CartFlows \u2013 Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d98c849-4178-4cee-846b-2c136bc56daf?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":false,"patched_in":"1.5.16"}],"published":"2020-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d997e98-dfb6-4f41-8711-7645d2a9435e","source":"wordfence","cve":"CVE-2025-47540","title":"weMail <= 1.14.13 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d997e98-dfb6-4f41-8711-7645d2a9435e?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.13","to_inclusive":true,"patched_in":"1.14.14"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:27:22Z"},{"id":"wordfence:0d999ef8-303e-4707-ace8-64563e899651","source":"wordfence","cve":"CVE-2024-32776","title":"AppPresser <= 4.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d999ef8-303e-4707-ace8-64563e899651?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:28:23Z"},{"id":"wordfence:0d9ba01b-09ae-4d35-8bec-30e7673c2a20","source":"wordfence","cve":"CVE-2026-65445","title":"Ad Invalid Click Protector (AICP) <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9ba01b-09ae-4d35-8bec-30e7673c2a20?source=api-prod","affected":[{"type":"plugin","slug":"ad-invalid-click-protector","name":"Ad Invalid Click Protector (AICP)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:08:52Z"},{"id":"wordfence:0d9cea4e-b619-4935-bb7c-a64ddf52d480","source":"wordfence","cve":"CVE-2023-51673","title":"Stylish Price List <= 7.0.17 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9cea4e-b619-4935-bb7c-a64ddf52d480?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"7.0.17","to_inclusive":true,"patched_in":"7.0.18"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0d9d32fd-a3ec-40f6-a38f-faa4b354e4d4","source":"wordfence","cve":"CVE-2025-49966","title":"Oganro Travel Portal Search Widget for HotelBeds APITUDE API <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9d32fd-a3ec-40f6-a38f-faa4b354e4d4?source=api-prod","affected":[{"type":"plugin","slug":"oganro-travel-portal-search-widget-for-hotelbeds-apitude-api","name":"Oganro Travel Portal Search Widget for HotelBeds APITUDE API","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:45:01Z"},{"id":"wordfence:0da1cc3b-5d6b-4ca0-9d8a-31c63ab5b9c9","source":"wordfence","cve":"","title":"WordPress Core < 6.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0da1cc3b-5d6b-4ca0-9d8a-31c63ab5b9c9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.38","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.6","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"4.1.38"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0da6a080-260f-4b19-a32c-453d2781389a","source":"wordfence","cve":"CVE-2025-13196","title":"Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6a080-260f-4b19-a32c-453d2781389a?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2025-11-17T20:54:12Z","updated":"2025-11-18T09:27:37Z"},{"id":"wordfence:0da6d357-e55f-4bf6-9cd7-50e3dc712434","source":"wordfence","cve":"CVE-2025-4585","title":"IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6d357-e55f-4bf6-9cd7-50e3dc712434?source=api-prod","affected":[{"type":"plugin","slug":"irm-newsroom","name":"IRM Newsroom","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2025-06-12T13:12:04Z","updated":"2025-11-05T21:35:26Z"},{"id":"wordfence:0dad759d-9b44-47ca-8410-e39f65dc919c","source":"wordfence","cve":"CVE-2024-2791","title":"Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dad759d-9b44-47ca-8410-e39f65dc919c?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T05:32:49Z"},{"id":"wordfence:0daebb47-a9fb-45c7-8519-54f6fd5faa1c","source":"wordfence","cve":"CVE-2025-22318","title":"Standard Box Sizes \u2013 for WooCommerce <= 1.6.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0daebb47-a9fb-45c7-8519-54f6fd5faa1c?source=api-prod","affected":[{"type":"plugin","slug":"standard-box-sizes","name":"Standard Box Sizes \u2013 for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":true,"patched_in":"1.6.14"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T21:57:33Z"},{"id":"wordfence:0db18319-6552-42f1-b304-aca61780c12c","source":"wordfence","cve":"CVE-2026-66600","title":"Media Library Assistant <= 3.39 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db18319-6552-42f1-b304-aca61780c12c?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.39","to_inclusive":true,"patched_in":"3.40"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:34Z"},{"id":"wordfence:0db32d66-4def-4356-96d8-74ba49e7604a","source":"wordfence","cve":"","title":"Social Ring (Facebook Like, Google +1, ReTweet, LinkedIn and Pin It) <= 1.1.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db32d66-4def-4356-96d8-74ba49e7604a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-social-ring","name":"Social Ring (Facebook Like, Google +1, ReTweet, LinkedIn and Pin It)","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2014-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0db3f234-111f-4c79-bb54-1a21e4fedb8c","source":"wordfence","cve":"CVE-2020-10568","title":"WPML < 4.3.7 - Cross-Site Request Forgery Bypass","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db3f234-111f-4c79-bb54-1a21e4fedb8c?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":false,"patched_in":"4.3.7"}],"published":"2020-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0db4671e-1989-44a4-babe-ed699c7f3a52","source":"wordfence","cve":"CVE-2025-3616","title":"Greenshift  11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db4671e-1989-44a4-babe-ed699c7f3a52?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"11.4","from_inclusive":true,"to":"11.4.5","to_inclusive":true,"patched_in":"11.4.6"}],"published":"2025-04-21T15:48:15Z","updated":"2025-04-22T04:21:33Z"},{"id":"wordfence:0db59761-fbce-475e-aa76-c9d589b335eb","source":"wordfence","cve":"CVE-2024-51776","title":"Daily Image <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db59761-fbce-475e-aa76-c9d589b335eb?source=api-prod","affected":[{"type":"plugin","slug":"daily-image","name":"Daily Image","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:55:38Z"},{"id":"wordfence:0db63414-b8c3-41bf-a6df-4b6113ea7388","source":"wordfence","cve":"CVE-2024-53764","title":"Softtemplates For Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db63414-b8c3-41bf-a6df-4b6113ea7388?source=api-prod","affected":[{"type":"plugin","slug":"softtemplates-for-elementor","name":"Softtemplates For Elementor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-11-28T00:00:00Z","updated":"2026-11-10T23:17:04Z"},{"id":"wordfence:0db85f84-04e9-42eb-a16b-96554fbfd186","source":"wordfence","cve":"CVE-2025-11533","title":"WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=api-prod","affected":[{"type":"plugin","slug":"wp-freeio","name":"WP Freeio","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":"1.2.22"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T07:25:56Z"},{"id":"wordfence:0dbacaae-1d41-4d29-b477-e624822e287d","source":"wordfence","cve":"CVE-2024-52491","title":"Sticky Social Icons <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dbacaae-1d41-4d29-b477-e624822e287d?source=api-prod","affected":[{"type":"plugin","slug":"sticky-social-icons","name":"Sticky Social Icons","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-12-12T18:40:37Z"},{"id":"wordfence:0dbaf893-e117-448f-a1b3-9c4b4caea7e7","source":"wordfence","cve":"CVE-2022-2146","title":"Import CSV Files <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dbaf893-e117-448f-a1b3-9c4b4caea7e7?source=api-prod","affected":[{"type":"plugin","slug":"import-csv-files","name":"Import CSV Files","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dbce573-fced-4c0f-ba1e-2932c166545c","source":"wordfence","cve":"CVE-2025-39443","title":"Verge3D <= 4.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dbce573-fced-4c0f-ba1e-2932c166545c?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:55:16Z"},{"id":"wordfence:0dbed7a2-730d-42f2-9d57-3f07900d33e3","source":"wordfence","cve":"CVE-2021-24414","title":"Video Player for YouTube <= 1.3 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dbed7a2-730d-42f2-9d57-3f07900d33e3?source=api-prod","affected":[{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2021-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dc20a45-15b5-42d3-a484-988a394ee658","source":"wordfence","cve":"CVE-2020-6166","title":"Minimal Coming Soon & Maintenance Mode <= 2.16 - Missing Authorization to Export Settings/Theme Change","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc20a45-15b5-42d3-a484-988a394ee658?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":false,"patched_in":"2.17"}],"published":"2020-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dc29b0c-3325-4524-8848-4857d5aa204e","source":"wordfence","cve":"CVE-2025-53327","title":"Aioseo Multibyte Descriptions <= 0.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc29b0c-3325-4524-8848-4857d5aa204e?source=api-prod","affected":[{"type":"plugin","slug":"aioseo-multibyte-descriptions","name":"Aioseo Multibyte Descriptions","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:21:59Z"},{"id":"wordfence:0dc5479e-629b-4ad8-8bef-b35e22372eb4","source":"wordfence","cve":"CVE-2024-51619","title":"Market 360 Viewer <= 1.01 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc5479e-629b-4ad8-8bef-b35e22372eb4?source=api-prod","affected":[{"type":"plugin","slug":"market-360-viewer","name":"Market 360 Viewer","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:35:51Z"},{"id":"wordfence:0dc59091-8d13-4c07-a158-a46483e49104","source":"wordfence","cve":"CVE-2026-66466","title":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc59091-8d13-4c07-a158-a46483e49104?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-25T23:14:00Z"},{"id":"wordfence:0dc5c05d-51b7-4aee-bb4e-366ded45c4d8","source":"wordfence","cve":"CVE-2025-7437","title":"Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc5c05d-51b7-4aee-bb4e-366ded45c4d8?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8012","to_inclusive":true,"patched_in":"5.8013"}],"published":"2025-07-23T16:22:34Z","updated":"2025-07-24T04:24:13Z"},{"id":"wordfence:0dc77221-836b-45cd-a234-19dbf28ed0e7","source":"wordfence","cve":"CVE-2026-103421","title":"WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc77221-836b-45cd-a234-19dbf28ed0e7?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.84","to_inclusive":true,"patched_in":"11.85"}],"published":"2026-10-02T17:42:22Z","updated":"2026-10-03T06:38:21Z"},{"id":"wordfence:0dc82635-e3c4-4a15-93ef-e2cacbfae799","source":"wordfence","cve":"CVE-2024-35755","title":"Weather Widget Pro <= 1.1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc82635-e3c4-4a15-93ef-e2cacbfae799?source=api-prod","affected":[{"type":"plugin","slug":"weather-in-any-city-widget","name":"Weather Widget Pro \u2013 Weather Forecast Widget, Block & Shortcode (No API Key)","from":"*","from_inclusive":true,"to":"1.1.40","to_inclusive":true,"patched_in":"1.1.41"}],"published":"2024-06-07T00:00:00Z","updated":"2024-07-31T21:01:01Z"},{"id":"wordfence:0dc856f0-4dcb-408d-baec-ab34a88ee724","source":"wordfence","cve":"CVE-2026-116393","title":"Optima Express IDX <= 9.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc856f0-4dcb-408d-baec-ab34a88ee724?source=api-prod","affected":[{"type":"plugin","slug":"optima-express","name":"Optima Express IDX","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-26T12:49:39Z","updated":"2026-11-03T19:30:14Z"},{"id":"wordfence:0dc8f7cf-d8be-4229-b823-3bd9bc9f6eda","source":"wordfence","cve":"CVE-2023-5583","title":"WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc8f7cf-d8be-4229-b823-3bd9bc9f6eda?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-galleries","name":"WP Simple Galleries","from":"*","from_inclusive":true,"to":"1.34","to_inclusive":true,"patched_in":""}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dc9adad-0bf5-4e21-8dd0-19d4d5311aa8","source":"wordfence","cve":"CVE-2026-84761","title":"LiteSpeed Cache <= 7.9 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc9adad-0bf5-4e21-8dd0-19d4d5311aa8?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:34:58Z"},{"id":"wordfence:0dca168f-a383-42fc-91ba-d78a5d7e6724","source":"wordfence","cve":"CVE-2024-4734","title":"Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dca168f-a383-42fc-91ba-d78a5d7e6724?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.6.1","to_inclusive":true,"patched_in":"1.26.7"}],"published":"2024-05-14T12:08:10Z","updated":"2024-05-15T01:56:54Z"},{"id":"wordfence:0dca2c66-64df-44c7-9c75-330dddf582c8","source":"wordfence","cve":"CVE-2024-13581","title":"Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dca2c66-64df-44c7-9c75-330dddf582c8?source=api-prod","affected":[{"type":"plugin","slug":"simple-charts","name":"Simple Charts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:45:38Z","updated":"2025-02-18T04:21:10Z"},{"id":"wordfence:0dd1706c-fb3b-4a5d-947a-435954eb0b15","source":"wordfence","cve":"","title":"Add Hierarchy (parent) to post <= 3.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd1706c-fb3b-4a5d-947a-435954eb0b15?source=api-prod","affected":[{"type":"plugin","slug":"add-hierarchy-parent-to-post","name":"Add Hierarchy (parent) to post","from":"*","from_inclusive":true,"to":"3.12","to_inclusive":true,"patched_in":"3.13"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dd1ded1-8966-4247-ab75-17980f00f9b9","source":"wordfence","cve":"CVE-2022-1037","title":"EXMAGE \u2013 WordPress Image Links <= 1.0.6 - Admin+ Blind SSRF","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd1ded1-8966-4247-ab75-17980f00f9b9?source=api-prod","affected":[{"type":"plugin","slug":"exmage-wp-image-links","name":"EXMAGE \u2013 WordPress Image Links","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2022-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dd23096-d27f-4a50-a720-ef84d1fd7070","source":"wordfence","cve":"CVE-2026-80341","title":"Payment Plugins for PayPal WooCommerce <= 2.0.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd23096-d27f-4a50-a720-ef84d1fd7070?source=api-prod","affected":[{"type":"plugin","slug":"pymntpl-paypal-woocommerce","name":"Payment Plugins for PayPal WooCommerce","from":"*","from_inclusive":true,"to":"2.0.25","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:16:59Z"},{"id":"wordfence:0dd2705e-d78c-4f31-b28f-1ba8b2495c80","source":"wordfence","cve":"CVE-2014-4563","title":"Cloak & Encrypt < 3.8.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd2705e-d78c-4f31-b28f-1ba8b2495c80?source=api-prod","affected":[{"type":"plugin","slug":"url-cloak-encrypt","name":"URL Cloak & Encrypt","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":false,"patched_in":"3.8.0"}],"published":"2014-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0dd53fad-1bd7-41ed-95cb-205a9b421724","source":"wordfence","cve":"CVE-2025-10307","title":"Backuply \u2013 Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd53fad-1bd7-41ed-95cb-205a9b421724?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T06:43:29Z"},{"id":"wordfence:0dd93514-657c-4b04-931a-23f3d405fb88","source":"wordfence","cve":"CVE-2024-9530","title":"Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd93514-657c-4b04-931a-23f3d405fb88?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-10-22T19:29:15Z","updated":"2024-10-23T07:34:54Z"},{"id":"wordfence:0dda8e76-22aa-400b-b4c1-b24e6e1141ac","source":"wordfence","cve":"CVE-2022-2424","title":"Google Maps Anywhere <= 1.2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dda8e76-22aa-400b-b4c1-b24e6e1141ac?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-anywhere","name":"Google Maps Anywhere","from":"*","from_inclusive":true,"to":"1.2.6.3","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ddb582a-e966-4c0b-a743-29d8943f846b","source":"wordfence","cve":"","title":"WordPress Core 5.9 - 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddb582a-e966-4c0b-a743-29d8943f846b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.2","to_inclusive":false,"patched_in":"5.9.2"}],"published":"2022-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ddc518c-02a0-46a5-93e9-0d92a045b35b","source":"wordfence","cve":"CVE-2026-109990","title":"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc518c-02a0-46a5-93e9-0d92a045b35b?source=api-prod","affected":[{"type":"plugin","slug":"flying-scripts","name":"Flying Scripts: Delay JavaScript to Improve Site Speed & Performance","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2026-10-15T15:35:09Z","updated":"2026-10-16T03:38:40Z"},{"id":"wordfence:0ddc7488-4cc0-4e17-8c81-26cbcbe8bdae","source":"wordfence","cve":"","title":"silverOrchid <= 1.5.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddc7488-4cc0-4e17-8c81-26cbcbe8bdae?source=api-prod","affected":[{"type":"theme","slug":"silverorchid","name":"silverOrchid","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2013-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ddf73e1-cd45-45f7-9635-eb4052d34f67","source":"wordfence","cve":"CVE-2026-81293","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddf73e1-cd45-45f7-9635-eb4052d34f67?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.81","to_inclusive":true,"patched_in":"5.5.82"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:50:14Z"},{"id":"wordfence:0de0e5d5-7023-4026-ad82-3c2443569326","source":"wordfence","cve":"CVE-2022-41643","title":"Accessibility  <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de0e5d5-7023-4026-ad82-3c2443569326?source=api-prod","affected":[{"type":"plugin","slug":"accessibility","name":"Accessibility","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0de639a9-37a6-4a72-8afb-ff43de81a83c","source":"wordfence","cve":"CVE-2026-10734","title":"Infility Global <= 2.15.34 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de639a9-37a6-4a72-8afb-ff43de81a83c?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.34","to_inclusive":true,"patched_in":"2.15.35"}],"published":"2026-08-15T18:15:51Z","updated":"2026-09-18T19:49:48Z"},{"id":"wordfence:0de689a0-3f4e-4d2c-865b-deed36716f05","source":"wordfence","cve":"CVE-2025-53992","title":"JetTricks <= 1.5.4.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de689a0-3f4e-4d2c-865b-deed36716f05?source=api-prod","affected":[{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.5.4.1","to_inclusive":true,"patched_in":"1.5.4.2"}],"published":"2025-07-16T00:00:00Z","updated":"2026-03-27T10:46:55Z"},{"id":"wordfence:0de75f3f-1e6b-42ea-9f08-54c32e37b4c7","source":"wordfence","cve":"CVE-2022-45812","title":"Exxp <= 2.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de75f3f-1e6b-42ea-9f08-54c32e37b4c7?source=api-prod","affected":[{"type":"plugin","slug":"exxp-wp","name":"Exxp","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0de79672-f0ba-42d3-a44a-01b93801d7de","source":"wordfence","cve":"CVE-2024-24847","title":"CalculatorPro Calculators <= 1.1.7 - Reflected Cross-Site Scripting via CP_preview_calc","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0de79672-f0ba-42d3-a44a-01b93801d7de?source=api-prod","affected":[{"type":"plugin","slug":"calculatorpro-calculators","name":"CalculatorPro Calculators","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-06T14:57:03Z"},{"id":"wordfence:0def2dcf-2874-4159-a2e0-e747a1be1b79","source":"wordfence","cve":"CVE-2024-35670","title":"Integrate Google Drive <= 1.3.93 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0def2dcf-2874-4159-a2e0-e747a1be1b79?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.93","to_inclusive":true,"patched_in":"1.3.94"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:51:25Z"},{"id":"wordfence:0def7637-edf4-4ae2-a2e7-31ccb3b52d71","source":"wordfence","cve":"CVE-2026-7651","title":"User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0def7637-edf4-4ae2-a2e7-31ccb3b52d71?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2026-05-27T00:00:00Z","updated":"2026-05-28T06:45:39Z"},{"id":"wordfence:0df152a1-908c-4ef7-bf48-69c05b13fced","source":"wordfence","cve":"CVE-2025-1485","title":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df152a1-908c-4ef7-bf48-69c05b13fced?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"},{"type":"plugin","slug":"real-cookie-banner-pro","name":"Real Cookie Banner Pro","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2025-05-12T00:00:00Z","updated":"2025-06-06T13:53:13Z"},{"id":"wordfence:0df493cb-2b5e-4a16-b6d8-4cd9a473540d","source":"wordfence","cve":"CVE-2023-49833","title":"Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df493cb-2b5e-4a16-b6d8-4cd9a473540d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0df56974-a26b-4a43-8c0c-435b921d7755","source":"wordfence","cve":"CVE-2026-62126","title":"SAML Single Sign On \u2013 SSO Login <= 6.1.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df56974-a26b-4a43-8c0c-435b921d7755?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:53Z"},{"id":"wordfence:0df57ee1-e22c-4532-b784-408d61f4d28f","source":"wordfence","cve":"CVE-2026-39437","title":"Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df57ee1-e22c-4532-b784-408d61f4d28f?source=api-prod","affected":[{"type":"plugin","slug":"product-quantity-for-woocommerce","name":"Min Max Step Quantity Limits Manager for WooCommerce","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:57:21Z"},{"id":"wordfence:0df6f15f-308f-4397-9a67-6a6dab992568","source":"wordfence","cve":"CVE-2022-28222","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df6f15f-308f-4397-9a67-6a6dab992568?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.173","to_inclusive":true,"patched_in":"5.174.1"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0df7f413-2631-46d9-8c0b-d66f05a02c01","source":"wordfence","cve":"CVE-2024-11103","title":"Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0df7f413-2631-46d9-8c0b-d66f05a02c01?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"24.0.7","to_inclusive":true,"patched_in":"24.0.8"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:47:10Z"},{"id":"wordfence:0dfbee4c-b720-4d10-bfe0-fe9dc12e6268","source":"wordfence","cve":"CVE-2024-9165","title":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfbee4c-b720-4d10-bfe0-fe9dc12e6268?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-10-30T18:09:00Z","updated":"2024-11-08T16:14:33Z"},{"id":"wordfence:0dfc8957-78b8-4c55-ba95-52d95b086341","source":"wordfence","cve":"CVE-2024-9756","title":"Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfc8957-78b8-4c55-ba95-52d95b086341?source=api-prod","affected":[{"type":"plugin","slug":"order-attachments-for-woocommerce","name":"Order Attachments for WooCommerce","from":"2.0","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-10-11T17:52:13Z","updated":"2024-10-12T06:51:10Z"},{"id":"wordfence:0dfd1e36-1ff5-467c-bafe-fbcade37fe9c","source":"wordfence","cve":"CVE-2026-14930","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System < 3.1.4 - Unauthenticated Arbitrary Media Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfd1e36-1ff5-467c-bafe-fbcade37fe9c?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-14T13:37:40Z"},{"id":"wordfence:0dfe0947-5790-49ba-aa3d-6bc61c12b355","source":"wordfence","cve":"CVE-2025-14064","title":"BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0dfe0947-5790-49ba-aa3d-6bc61c12b355?source=api-prod","affected":[{"type":"plugin","slug":"buddytask","name":"BuddyTask","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-12-11T14:24:56Z","updated":"2026-03-27T10:47:34Z"},{"id":"wordfence:0e01a17f-e9e6-4be1-8559-6d4a8957acf6","source":"wordfence","cve":"CVE-2026-16532","title":"Link Library <= 7.9.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e01a17f-e9e6-4be1-8559-6d4a8957acf6?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":true,"patched_in":"7.9.3"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-15T21:41:35Z"},{"id":"wordfence:0e030ff8-ea9d-4b4f-8b5a-28eaa18b14de","source":"wordfence","cve":"CVE-2025-49423","title":"Bulk YouTube Post Creator <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e030ff8-ea9d-4b4f-8b5a-28eaa18b14de?source=api-prod","affected":[{"type":"plugin","slug":"bulk-youtube-post-creator","name":"Bulk YouTube Post Creator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T16:58:10Z"},{"id":"wordfence:0e0332d1-b83b-4347-95ef-3429de5a8cca","source":"wordfence","cve":"CVE-2026-11608","title":"WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0332d1-b83b-4347-95ef-3429de5a8cca?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-09-18T19:40:47Z","updated":"2026-09-19T07:43:12Z"},{"id":"wordfence:0e03aeed-abb3-4ac8-8ff5-72ddc2430b94","source":"wordfence","cve":"CVE-2024-32109","title":"WP Matterport Shortcode <= 2.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e03aeed-abb3-4ac8-8ff5-72ddc2430b94?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-gallery-for-matterport-showcase","name":"Matterport Shortcode","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-03T19:07:26Z"},{"id":"wordfence:0e05142e-04a3-483e-a4af-035df3609b9d","source":"wordfence","cve":"CVE-2021-24690","title":"Chained Quiz < 1.2.7.2 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e05142e-04a3-483e-a4af-035df3609b9d?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.2.7.2","to_inclusive":false,"patched_in":"1.2.7.2"}],"published":"2021-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e05bad8-2093-4ca8-8c24-ae513ae4f1b9","source":"wordfence","cve":"CVE-2025-24772","title":"Pay with Contact Form 7 <= 1.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e05bad8-2093-4ca8-8c24-ae513ae4f1b9?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-contact-form-7","name":"Pay with Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:31:58Z"},{"id":"wordfence:0e078ff5-c35c-45cc-a792-197eaf2710f6","source":"wordfence","cve":"CVE-2026-104307","title":"BackUpWordPress <= 3.14 - Authenticated (Subscriber+) Arbitrary Backup Directory Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e078ff5-c35c-45cc-a792-197eaf2710f6?source=api-prod","affected":[{"type":"plugin","slug":"backupwordpress","name":"BackUpWordPress","from":"*","from_inclusive":true,"to":"3.14","to_inclusive":true,"patched_in":"3.15"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:33:00Z"},{"id":"wordfence:0e087ed4-6f40-4a00-9cdb-1453ac298188","source":"wordfence","cve":"CVE-2025-49401","title":"Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e087ed4-6f40-4a00-9cdb-1453ac298188?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.2.5","to_inclusive":true,"patched_in":"10.2.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:23:42Z"},{"id":"wordfence:0e0bee7c-8dce-421c-af16-7e5152797e6c","source":"wordfence","cve":"CVE-2025-1511","title":"User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0bee7c-8dce-421c-af16-7e5152797e6c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-02-27T16:48:16Z","updated":"2025-02-28T05:23:17Z"},{"id":"wordfence:0e0e0c15-caf6-4166-a365-a2a73cd9ebc4","source":"wordfence","cve":"CVE-2023-32240","title":"WoodMart <= 7.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0e0c15-caf6-4166-a365-a2a73cd9ebc4?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e0ebe1d-b6cf-4ff5-ae6c-c8c226a000d4","source":"wordfence","cve":"CVE-2025-22540","title":"Emailing Subscription <= 1.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0ebe1d-b6cf-4ff5-ae6c-c8c226a000d4?source=api-prod","affected":[{"type":"plugin","slug":"email-suscripcion","name":"Emailing Subscription","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:53:36Z"},{"id":"wordfence:0e0f2516-0fa7-415e-868e-6bd259bc6546","source":"wordfence","cve":"CVE-2026-7526","title":"PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0f2516-0fa7-415e-868e-6bd259bc6546?source=api-prod","affected":[{"type":"plugin","slug":"pdf-embedder","name":"PDF Embedder \u2013 PDF Viewer & Embed PDF Files for WordPress","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-05-27T18:49:03Z","updated":"2026-08-22T00:32:02Z"},{"id":"wordfence:0e1193b1-6e5a-4ecc-ae97-1a3129ad330e","source":"wordfence","cve":"CVE-2022-47182","title":"APIExperts Square for WooCommerce <= 4.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1193b1-6e5a-4ecc-ae97-1a3129ad330e?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2023-07-26T00:00:00Z","updated":"2024-05-29T20:10:28Z"},{"id":"wordfence:0e1300be-07e3-44b6-9ced-a16825274d22","source":"wordfence","cve":"CVE-2023-48739","title":"Porto Theme - Functionality <= 2.11.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1300be-07e3-44b6-9ced-a16825274d22?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e14b479-07bb-46f7-8542-577cb1b60d27","source":"wordfence","cve":"CVE-2024-43229","title":"WP Search Analytics <= 1.4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e14b479-07bb-46f7-8542-577cb1b60d27?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:08:40Z"},{"id":"wordfence:0e170f98-692b-48f1-92b0-530cbe21440b","source":"wordfence","cve":"CVE-2024-7877","title":"Appointment Booking Calendar <= - Authenticated (Admin+) Stored Cross-Site Scripting via Notification Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e170f98-692b-48f1-92b0-530cbe21440b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.53","to_inclusive":true,"patched_in":"1.6.7.55"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-15T19:18:30Z"},{"id":"wordfence:0e181135-ebee-4a2c-922b-9144c977e39f","source":"wordfence","cve":"CVE-2026-120852","title":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e181135-ebee-4a2c-922b-9144c977e39f?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:59:38Z"},{"id":"wordfence:0e1913e9-94bf-4466-b368-eba745f182be","source":"wordfence","cve":"CVE-2024-8245","title":"GamiPress - Reset User <= 1.0.0 - Cross-Site Request Forgery to GamiPress User Data Removal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1913e9-94bf-4466-b368-eba745f182be?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-reset-user","name":"GamiPress \u2013 Reset User","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-09-04T00:00:00Z","updated":"2025-05-30T18:34:20Z"},{"id":"wordfence:0e1915d9-8ea9-4ab2-9746-3c49bc0bd7c8","source":"wordfence","cve":"CVE-2023-4811","title":"Wordpress File Upload <= 4.23.2 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1915d9-8ea9-4ab2-9746-3c49bc0bd7c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.23.3","to_inclusive":false,"patched_in":"4.23.3"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e1982bd-3ea8-48cd-8b89-39910567525c","source":"wordfence","cve":"CVE-2025-5284","title":"Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1982bd-3ea8-48cd-8b89-39910567525c?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.8.2","to_inclusive":true,"patched_in":"2.0.8.3"}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-16T09:22:57Z"},{"id":"wordfence:0e1bbf81-a61e-48d6-8485-9a6b6278dc39","source":"wordfence","cve":"CVE-2025-60099","title":"Embed Any Document <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1bbf81-a61e-48d6-8485-9a6b6278dc39?source=api-prod","affected":[{"type":"plugin","slug":"embed-any-document","name":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2025-09-26T00:00:00Z","updated":"2025-11-07T17:40:30Z"},{"id":"wordfence:0e1d9c22-dcd3-47f9-aac0-c9626aa2821c","source":"wordfence","cve":"CVE-2024-2376","title":"WPQA Builder <= 6.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1d9c22-dcd3-47f9-aac0-c9626aa2821c?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T19:02:53Z"},{"id":"wordfence:0e1e17c9-b9ee-495a-be49-9aa88f8023a2","source":"wordfence","cve":"CVE-2024-10814","title":"Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1e17c9-b9ee-495a-be49-9aa88f8023a2?source=api-prod","affected":[{"type":"plugin","slug":"simple-embed-code","name":"Code Embed","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-11-08T16:18:27Z","updated":"2024-11-09T04:32:26Z"},{"id":"wordfence:0e1fb4b5-7020-4228-8831-324bbf748c51","source":"wordfence","cve":"CVE-2026-82843","title":"OAuth Server <= 6.3.0 - Authenticated (Subscriber+) Arbitrary User Identity Token Issuance to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1fb4b5-7020-4228-8831-324bbf748c51?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-20-server","name":"WP OAuth Server ( Login with WordPress )","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:06:02Z"},{"id":"wordfence:0e1fce43-03c0-4863-bf0c-60a3c510a01d","source":"wordfence","cve":"CVE-2024-32774","title":"ProfileGrid  <= 5.8.2 - Bypass Group Members Limit","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1fce43-03c0-4863-bf0c-60a3c510a01d?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.8.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T17:14:23Z"},{"id":"wordfence:0e2268fc-5f29-4c69-9585-81240354ae77","source":"wordfence","cve":"CVE-2024-0970","title":"User Activity Tracking and Log <= 4.1.3 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2268fc-5f29-4c69-9585-81240354ae77?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-tracking-and-log","name":"User Activity Tracking and Log","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-01-29T00:00:00Z","updated":"2024-02-06T14:31:33Z"},{"id":"wordfence:0e227024-af7e-44f8-bed9-70d361ab590f","source":"wordfence","cve":"CVE-2025-22767","title":"GlobalPayments WooCommerce <= 1.13.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e227024-af7e-44f8-bed9-70d361ab590f?source=api-prod","affected":[{"type":"plugin","slug":"global-payments-woocommerce","name":"GlobalPayments Gateway Provider for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2025-03-18T00:00:00Z","updated":"2025-04-17T13:07:59Z"},{"id":"wordfence:0e22815e-1f06-4a46-90eb-98125ae97ba4","source":"wordfence","cve":"CVE-2021-24150","title":"Like Button Rating \u2665 LikeBtn < 2.6.32 - Server-Side Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e22815e-1f06-4a46-90eb-98125ae97ba4?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.32","to_inclusive":false,"patched_in":"2.6.32"}],"published":"2021-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e230f9f-5eda-4362-973b-ada9cf425697","source":"wordfence","cve":"CVE-2024-1810","title":"Archivist \u2013 Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e230f9f-5eda-4362-973b-ada9cf425697?source=api-prod","affected":[{"type":"plugin","slug":"archivist-custom-archive-templates","name":"Archivist \u2013 Custom Archive Templates","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2024-02-23T00:00:00Z","updated":"2024-02-24T04:32:29Z"},{"id":"wordfence:0e23e207-637a-4105-b9cd-ad86591af5d1","source":"wordfence","cve":"CVE-2025-22681","title":"Content Cloner <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e23e207-637a-4105-b9cd-ad86591af5d1?source=api-prod","affected":[{"type":"plugin","slug":"super-seo-content-cloner","name":"Super SEO Content Cloner","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:41:18Z"},{"id":"wordfence:0e240f4b-dfdf-4954-af39-34e24a05a2ed","source":"wordfence","cve":"CVE-2021-24716","title":"Modern Events Calendar Lite <= 5.22.2 - Authenticated Stored Cross Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e240f4b-dfdf-4954-af39-34e24a05a2ed?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.22.2","to_inclusive":true,"patched_in":"5.22.3"}],"published":"2021-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e24c8f4-32c9-4c21-88d9-588913cbb474","source":"wordfence","cve":"CVE-2024-3074","title":"Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e24c8f4-32c9-4c21-88d9-588913cbb474?source=api-prod","affected":[{"type":"plugin","slug":"fd-elementor-imagebox","name":"Elementor ImageBox","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-24T12:04:23Z"},{"id":"wordfence:0e2734d5-b985-4153-ada1-06cc2992dcbd","source":"wordfence","cve":"CVE-2025-31411","title":"Linet ERP-Woocommerce Integration <= 3.5.12 - Authenticated (Admin+) Arbitrary File Read & Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2734d5-b985-4153-ada1-06cc2992dcbd?source=api-prod","affected":[{"type":"plugin","slug":"linet-erp-woocommerce-integration","name":"Linet ERP Integration For Woocommerce","from":"*","from_inclusive":true,"to":"3.5.12","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-14T14:21:41Z"},{"id":"wordfence:0e2774fc-f028-436c-a8af-3c17378b9743","source":"wordfence","cve":"CVE-2025-5288","title":"REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2774fc-f028-436c-a8af-3c17378b9743?source=api-prod","affected":[{"type":"plugin","slug":"import-export-with-custom-rest-api","name":"REST API | Custom API Generator For Cross Platform And Import Export In WP","from":"1.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:10:13Z","updated":"2025-06-13T01:47:46Z"},{"id":"wordfence:0e27a9cb-0df8-4570-b7b5-7aa6c15d2e43","source":"wordfence","cve":"CVE-2021-24390","title":"WordPress\u652f\u4ed8\u5b9dAlipay|\u8d22\u4ed8\u901aTenpay|\u8d1d\u5b9dPayPal\u96c6\u6210\u63d2\u4ef6 <= 3.7.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e27a9cb-0df8-4570-b7b5-7aa6c15d2e43?source=api-prod","affected":[{"type":"plugin","slug":"alipay","name":"WordPress\u652f\u4ed8\u5b9dAlipay|\u8d22\u4ed8\u901aTenpay|\u8d1d\u5b9dPayPal\u96c6\u6210\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e27b0a8-e052-49ed-8744-a2376aa386f5","source":"wordfence","cve":"CVE-2023-5141","title":"BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e27b0a8-e052-49ed-8744-a2376aa386f5?source=api-prod","affected":[{"type":"plugin","slug":"bsk-contact-form-7-blacklist","name":"BSK Contact Form 7 Blacklist","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e2a2769-1309-4aad-8411-4445efea2b66","source":"wordfence","cve":"CVE-2026-1655","title":"EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2a2769-1309-4aad-8411-4445efea2b66?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.4","to_inclusive":true,"patched_in":"4.2.8.5"}],"published":"2026-02-17T19:22:53Z","updated":"2026-02-18T07:25:43Z"},{"id":"wordfence:0e2cf779-2355-461f-a289-11612e15acc6","source":"wordfence","cve":"CVE-2024-35710","title":"Podlove Web Player <= 5.7.3 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2cf779-2355-461f-a289-11612e15acc6?source=api-prod","affected":[{"type":"plugin","slug":"podlove-web-player","name":"Podlove Web Player","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:54:24Z"},{"id":"wordfence:0e2d8c68-62b5-43c0-bf01-7feb259a009a","source":"wordfence","cve":"CVE-2025-60190","title":"Immocaster WordPress <= 1.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2d8c68-62b5-43c0-bf01-7feb259a009a?source=api-prod","affected":[{"type":"plugin","slug":"immocaster","name":"Immocaster WordPress Plugin","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-11-11T18:25:16Z"},{"id":"wordfence:0e2e3c0e-9ac3-4f6f-b49f-2e50e0fb905f","source":"wordfence","cve":"CVE-2025-24721","title":"Easy YouTube Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2e3c0e-9ac3-4f6f-b49f-2e50e0fb905f?source=api-prod","affected":[{"type":"plugin","slug":"easy-youtube-gallery","name":"Easy YouTube Gallery","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:35:14Z"},{"id":"wordfence:0e2e6a72-941e-4b30-b622-ed8ccfc7c504","source":"wordfence","cve":"CVE-2025-49873","title":"Elessi <= 6.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2e6a72-941e-4b30-b622-ed8ccfc7c504?source=api-prod","affected":[{"type":"theme","slug":"elessi-theme","name":"Elessi - WooCommerce AJAX WordPress Theme - RTL support","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T15:44:31Z"},{"id":"wordfence:0e3034ae-957f-410d-80ef-4dc2b0e91ff5","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.3.37 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e3034ae-957f-410d-80ef-4dc2b0e91ff5?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.3.38","to_inclusive":false,"patched_in":"1.3.38"}],"published":"2017-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e30d2ca-1918-4fcf-979e-7cae0d84529e","source":"wordfence","cve":"CVE-2020-35135","title":"Ultimate Category Excluder <= 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e30d2ca-1918-4fcf-979e-7cae0d84529e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-category-excluder","name":"Ultimate Category Excluder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2020-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e344974-08c8-45a5-a0f4-3780ce00928b","source":"wordfence","cve":"CVE-2026-96558","title":"Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e344974-08c8-45a5-a0f4-3780ce00928b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.6","to_inclusive":true,"patched_in":"11.2.7"}],"published":"2026-10-09T17:31:34Z","updated":"2026-10-10T06:40:08Z"},{"id":"wordfence:0e346146-1c00-4e03-a6c7-372566d7ffc9","source":"wordfence","cve":"CVE-2022-4932","title":"Total Upkeep <= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e346146-1c00-4e03-a6c7-372566d7ffc9?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.14.13","to_inclusive":true,"patched_in":"1.14.14"}],"published":"2022-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e3575f8-7adc-4546-9f78-bcb2cf3caa2a","source":"wordfence","cve":"CVE-2025-7781","title":"WP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via \u2018cs_job_title\u2019","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e3575f8-7adc-4546-9f78-bcb2cf3caa2a?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.7"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-10T11:17:07Z"},{"id":"wordfence:0e363267-0b15-46e8-a112-d24dd6b8a22e","source":"wordfence","cve":"CVE-2026-32372","title":"ShopBuilder \u2013 Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e363267-0b15-46e8-a112-d24dd6b8a22e?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2026-02-18T00:00:00Z","updated":"2026-05-05T14:26:43Z"},{"id":"wordfence:0e38b567-9567-4b08-8fab-3971547394b0","source":"wordfence","cve":"CVE-2006-4208","title":"Skippy WP-DB Backup (Legacy Plugin) <= 1.7 - Authenticated (Admin+) Directory Traversal","severity":"medium","cvss":5.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e38b567-9567-4b08-8fab-3971547394b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup.php","name":"Skippy WP-DB Backup (Legacy Core Plugin)","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2006-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e399651-8992-4949-b7a7-4e8ce199b47a","source":"wordfence","cve":"CVE-2026-6075","title":"Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Form","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e399651-8992-4949-b7a7-4e8ce199b47a?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-05-28T18:57:53Z","updated":"2026-05-29T07:46:52Z"},{"id":"wordfence:0e3adbc2-fa45-4c35-a214-2b101e8c9748","source":"wordfence","cve":"CVE-2022-45825","title":"WPComplete <= 2.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e3adbc2-fa45-4c35-a214-2b101e8c9748?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":false,"patched_in":"2.9.5"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e3f8108-6b1b-4720-a450-e58b1833b608","source":"wordfence","cve":"CVE-2024-43259","title":"Order Export for WooCommerce <= 3.23 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e3f8108-6b1b-4720-a450-e58b1833b608?source=api-prod","affected":[{"type":"plugin","slug":"order-export-and-more-for-woocommerce","name":"Order Export for WooCommerce","from":"*","from_inclusive":true,"to":"3.23","to_inclusive":true,"patched_in":"3.24"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-27T16:36:59Z"},{"id":"wordfence:0e407409-989d-48f8-8135-6071015a6064","source":"wordfence","cve":"CVE-2024-43265","title":"Analytify <= 5.3.1 - Cross-Site Request Forgery to Opt-out","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e407409-989d-48f8-8135-6071015a6064?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:36:03Z"},{"id":"wordfence:0e41384f-1dec-418b-be48-fc61def5ca28","source":"wordfence","cve":"","title":"Elementor Website Builder <= 2.7.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e41384f-1dec-418b-be48-fc61def5ca28?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2020-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e430180-5b89-4d06-b729-d0fdbefa8185","source":"wordfence","cve":"","title":"MWB Point of Sale (POS) for WooCommerce <= 1.0.0 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e430180-5b89-4d06-b729-d0fdbefa8185?source=api-prod","affected":[{"type":"plugin","slug":"mwb-point-of-sale-pos-for-woocommerce","name":"MWB Point of Sale (POS) for WooCommerce- Generate Barcodes, Process your Bills, Synchronize, Your Online-Offline Orders","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e43d6fc-28f1-4208-a529-f264304fe8aa","source":"wordfence","cve":"CVE-2022-4309","title":"Subscribe2 <= 10.37 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e43d6fc-28f1-4208-a529-f264304fe8aa?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.37","to_inclusive":true,"patched_in":"10.38"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e452c66-ac10-4960-9e99-ddd7ae3b56cf","source":"wordfence","cve":"CVE-2025-31392","title":"Smart Product Gallery Slider <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e452c66-ac10-4960-9e99-ddd7ae3b56cf?source=api-prod","affected":[{"type":"plugin","slug":"smart-product-gallery-slider","name":"Smart Product Gallery Slider","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:56:07Z"},{"id":"wordfence:0e454573-4b34-40e3-b4c3-10eb71dfa03e","source":"wordfence","cve":"","title":"Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Cross-Site Request Forgery to Course Modifications","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e454573-4b34-40e3-b4c3-10eb71dfa03e?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-courses","name":"Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e4588d1-f21e-48ba-a8cb-d18c421f000a","source":"wordfence","cve":"CVE-2024-9893","title":"Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4588d1-f21e-48ba-a8cb-d18c421f000a?source=api-prod","affected":[{"type":"plugin","slug":"nextend-social-login-pro","name":"Nextend Social Login Pro","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2024-10-15T00:00:00Z","updated":"2025-02-19T17:27:32Z"},{"id":"wordfence:0e46ac8d-89ee-4480-bb96-83f2044a4323","source":"wordfence","cve":"CVE-2026-5809","title":"wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter","severity":"high","cvss":7.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e46ac8d-89ee-4480-bb96-83f2044a4323?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-04-10T18:51:03Z","updated":"2026-04-14T08:07:42Z"},{"id":"wordfence:0e475e02-494a-4ad0-a83c-d027c3a32989","source":"wordfence","cve":"CVE-2026-0548","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-01-20T01:46:19Z","updated":"2026-01-20T14:26:32Z"},{"id":"wordfence:0e477b9f-a2bf-4c2a-935b-82a93797f1bd","source":"wordfence","cve":"CVE-2025-39559","title":"Bring Fraktguiden for WooCommerce <= 1.11.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e477b9f-a2bf-4c2a-935b-82a93797f1bd?source=api-prod","affected":[{"type":"plugin","slug":"bring-fraktguiden-for-woocommerce","name":"Bring Fraktguiden for WooCommerce","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:03:45Z"},{"id":"wordfence:0e47daed-42cc-4d96-82a1-a3e65af9fa88","source":"wordfence","cve":"CVE-2024-10882","title":"Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e47daed-42cc-4d96-82a1-a3e65af9fa88?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:14Z"},{"id":"wordfence:0e48d160-fb9b-495d-b4ce-6228762e2604","source":"wordfence","cve":"CVE-2026-123704","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e48d160-fb9b-495d-b4ce-6228762e2604?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:03:34Z"},{"id":"wordfence:0e4aee28-d0cc-4705-9be6-fe5299f2e0fc","source":"wordfence","cve":"CVE-2024-22294","title":"IP2Location Country Blocker <= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4aee28-d0cc-4705-9be6-fe5299f2e0fc?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.33.3","to_inclusive":true,"patched_in":"2.33.4"}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e4c0500-9081-446e-b34b-968c718dfce0","source":"wordfence","cve":"","title":"Ultimate TinyMCE < 3.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4c0500-9081-446e-b34b-968c718dfce0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-tinymce","name":"Ultimate TinyMCE","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e4e5558-a2ee-43d4-bd3e-8c12669a8a90","source":"wordfence","cve":"CVE-2026-86795","title":"Community Events <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4e5558-a2ee-43d4-bd3e-8c12669a8a90?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:08:41Z"},{"id":"wordfence:0e4f4bc3-8fe8-401b-9027-b6f91b6c521f","source":"wordfence","cve":"CVE-2025-46260","title":"Sky Addons for Elementor <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4f4bc3-8fe8-401b-9027-b6f91b6c521f?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:21:07Z"},{"id":"wordfence:0e4f6305-d003-478e-a8ef-0b254084f56f","source":"wordfence","cve":"CVE-2023-45065","title":"Bulk NoIndex & NoFollow Toolkit <= 1.42 - Reflected Cross-Site Scripting via 's'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4f6305-d003-478e-a8ef-0b254084f56f?source=api-prod","affected":[{"type":"plugin","slug":"bulk-noindex-nofollow-toolkit-by-mad-fish","name":"Bulk NoIndex & NoFollow Toolkit","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e4fab94-1cfa-4738-8483-1d0b5e05872a","source":"wordfence","cve":"CVE-2026-57315","title":"Blocksy Companion Pro <= 2.1.45 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4fab94-1cfa-4738-8483-1d0b5e05872a?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion-pro","name":"Blocksy Companion Pro","from":"*","from_inclusive":true,"to":"2.1.45","to_inclusive":true,"patched_in":"2.1.46"}],"published":"2026-06-26T00:00:00Z","updated":"2026-08-21T12:58:35Z"},{"id":"wordfence:0e4fcb06-77e9-4de2-91cd-d6876622a77b","source":"wordfence","cve":"CVE-2025-58902","title":"Lighthouse <= 1.2.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4fcb06-77e9-4de2-91cd-d6876622a77b?source=api-prod","affected":[{"type":"theme","slug":"lighthouseschool","name":"Lighthouse | School for Kids with Disabilities & Special Needs WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:16:59Z"},{"id":"wordfence:0e4fec06-13d3-49ce-afe5-8dca15cf1f0a","source":"wordfence","cve":"CVE-2019-11871","title":"Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e4fec06-13d3-49ce-afe5-8dca15cf1f0a?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.5.14","to_inclusive":true,"patched_in":"2.5.15"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e50b6a0-180b-45dd-a65b-f6b3161b068c","source":"wordfence","cve":"CVE-2025-23704","title":"Your Lightbox <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e50b6a0-180b-45dd-a65b-f6b3161b068c?source=api-prod","affected":[{"type":"plugin","slug":"your-lightbox","name":"Your Lightbox","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:09:31Z"},{"id":"wordfence:0e52475e-2a04-4973-b419-fb477fe872e5","source":"wordfence","cve":"CVE-2026-10627","title":"Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e52475e-2a04-4973-b419-fb477fe872e5?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-08-24T14:06:57Z","updated":"2026-08-25T02:26:49Z"},{"id":"wordfence:0e549e4c-9f2e-40a4-9b07-7edb34bc0c9f","source":"wordfence","cve":"CVE-2024-12049","title":"Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e549e4c-9f2e-40a4-9b07-7edb34bc0c9f?source=api-prod","affected":[{"type":"plugin","slug":"woo-ukrposhta","name":"Ukrposhta","from":"*","from_inclusive":true,"to":"1.17.11","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2025-01-06T16:21:03Z","updated":"2025-01-14T15:28:16Z"},{"id":"wordfence:0e556ca2-1b83-4589-bff8-64323eb594e7","source":"wordfence","cve":"CVE-2024-25100","title":"Coupon Referral Program <= 1.8.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e556ca2-1b83-4589-bff8-64323eb594e7?source=api-prod","affected":[{"type":"plugin","slug":"coupon-referral-program","name":"Coupon Referral Program","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2024-02-05T00:00:00Z","updated":"2025-09-19T15:35:29Z"},{"id":"wordfence:0e55c464-1ece-4dc2-b814-3a94ca90ae79","source":"wordfence","cve":"CVE-2025-49331","title":"eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e55c464-1ece-4dc2-b814-3a94ca90ae79?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-06-22T00:00:00Z","updated":"2025-07-01T19:10:54Z"},{"id":"wordfence:0e5617a2-5670-4d98-a36b-942f71634642","source":"wordfence","cve":"CVE-2025-3439","title":"Everest Forms \u2013 Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e5617a2-5670-4d98-a36b-942f71634642?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-11T12:42:24Z"},{"id":"wordfence:0e5674e2-593a-4f53-bb03-9184eccc3244","source":"wordfence","cve":"CVE-2022-2658","title":"WP Spell Check <= 9.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e5674e2-593a-4f53-bb03-9184eccc3244?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"9.12","to_inclusive":true,"patched_in":"9.13"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e57cf85-eec0-4cf6-a800-ceb2b46e2bcd","source":"wordfence","cve":"CVE-2024-11873","title":"glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e57cf85-eec0-4cf6-a800-ceb2b46e2bcd?source=api-prod","affected":[{"type":"plugin","slug":"glomex-oembed","name":"glomex oEmbed","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2024-12-13T15:49:31Z","updated":"2025-01-17T14:26:24Z"},{"id":"wordfence:0e590759-0fba-4c64-bc63-7d907e8ff4fc","source":"wordfence","cve":"CVE-2026-86604","title":"GTranslate <= 5.0.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e590759-0fba-4c64-bc63-7d907e8ff4fc?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:37:50Z"},{"id":"wordfence:0e5c0e0e-9851-4d28-a87b-b55fc7f76e0b","source":"wordfence","cve":"CVE-2026-23976","title":"Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e5c0e0e-9851-4d28-a87b-b55fc7f76e0b?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:16:53Z"},{"id":"wordfence:0e5c11dc-8326-494e-ac2c-b612c9424ff3","source":"wordfence","cve":"CVE-2025-25158","title":"Uncomplicated SEO <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e5c11dc-8326-494e-ac2c-b612c9424ff3?source=api-prod","affected":[{"type":"plugin","slug":"uncomplicated-seo","name":"Uncomplicated SEO","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:12:26Z"},{"id":"wordfence:0e5cc0ce-3785-4240-863e-d1396db6e8ef","source":"wordfence","cve":"CVE-2026-9199","title":"Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e5cc0ce-3785-4240-863e-d1396db6e8ef?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.42.1","to_inclusive":true,"patched_in":"1.43.0"}],"published":"2026-06-17T16:07:31Z","updated":"2026-06-18T04:31:08Z"},{"id":"wordfence:0e604d56-572f-4d60-b5ad-14c02ba9cc94","source":"wordfence","cve":"","title":"DSubscribers < 1.2.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e604d56-572f-4d60-b5ad-14c02ba9cc94?source=api-prod","affected":[{"type":"plugin","slug":"dsubscribers","name":"DSubscribers","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2017-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e606ceb-a7b4-4e60-ae2c-8939bd5acbfe","source":"wordfence","cve":"CVE-2025-47464","title":"Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e606ceb-a7b4-4e60-ae2c-8939bd5acbfe?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:31:23Z"},{"id":"wordfence:0e61c98d-a6f4-4ac0-b9f9-2b936c030413","source":"wordfence","cve":"CVE-2024-11285","title":"WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e61c98d-a6f4-4ac0-b9f9-2b936c030413?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:31Z"},{"id":"wordfence:0e62203e-b1e3-409c-b07a-3a88bee87e99","source":"wordfence","cve":"CVE-2026-28180","title":"Mercado Pago payments for WooCommerce <= 8.9.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e62203e-b1e3-409c-b07a-3a88bee87e99?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mercadopago","name":"Mercado Pago payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:04:29Z"},{"id":"wordfence:0e62968e-2b0f-4ee6-8ae9-f84d5ff39dba","source":"wordfence","cve":"CVE-2026-39432","title":"Timetics \u2013 Appointment Booking & Scheduling <= 1.0.53 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e62968e-2b0f-4ee6-8ae9-f84d5ff39dba?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.53","to_inclusive":true,"patched_in":"1.0.54"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:41:32Z"},{"id":"wordfence:0e630401-0409-443c-944d-553a372d150d","source":"wordfence","cve":"CVE-2018-5315","title":"WP Events Calendar Plugin <= 1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e630401-0409-443c-944d-553a372d150d?source=api-prod","affected":[{"type":"plugin","slug":"events","name":"WP Events Calendar Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2018-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e63ca03-f0dc-484d-8e2d-f77527595872","source":"wordfence","cve":"CVE-2024-8703","title":"Z-Downloads <= 1.11.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e63ca03-f0dc-484d-8e2d-f77527595872?source=api-prod","affected":[{"type":"plugin","slug":"z-downloads","name":"Z-Downloads","from":"*","from_inclusive":true,"to":"1.11.5","to_inclusive":true,"patched_in":"1.11.6"}],"published":"2024-08-09T00:00:00Z","updated":"2025-05-23T14:58:14Z"},{"id":"wordfence:0e6492e5-a506-4d77-96d2-08f700b6ee76","source":"wordfence","cve":"CVE-2025-5337","title":"Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e6492e5-a506-4d77-96d2-08f700b6ee76?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.98.0","to_inclusive":true,"patched_in":"3.99.0"}],"published":"2025-06-13T21:11:34Z","updated":"2025-06-14T09:23:33Z"},{"id":"wordfence:0e656123-cae4-4e0c-a80a-98526be293a8","source":"wordfence","cve":"CVE-2025-3065","title":"Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e656123-cae4-4e0c-a80a-98526be293a8?source=api-prod","affected":[{"type":"plugin","slug":"database-toolset","name":"Database Toolset","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:48:48Z","updated":"2025-04-24T08:23:48Z"},{"id":"wordfence:0e65a794-1901-4e54-be4f-9422fe444057","source":"wordfence","cve":"CVE-2025-12895","title":"Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e65a794-1901-4e54-be4f-9422fe444057?source=api-prod","affected":[{"type":"theme","slug":"kalium","name":"Kalium 3 | Creative WordPress & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.29","to_inclusive":true,"patched_in":"3.30"}],"published":"2026-01-15T01:00:00Z","updated":"2026-01-15T13:23:24Z"},{"id":"wordfence:0e6616d0-0690-4bf4-9228-33679b926b90","source":"wordfence","cve":"CVE-2022-3601","title":"Image Hover Effects Css3 <= 4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e6616d0-0690-4bf4-9228-33679b926b90?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-css3","name":"Image Hover Effects Css3","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e67ce3b-144f-4ce1-b658-47d865312c6a","source":"wordfence","cve":"CVE-2023-45609","title":"Powr Pack <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e67ce3b-144f-4ce1-b658-47d865312c6a?source=api-prod","affected":[{"type":"plugin","slug":"powr-pack","name":"Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e69325d-49a9-4cd6-a359-7a926e77144e","source":"wordfence","cve":"CVE-2025-49425","title":"Konami Easter Egg <= v0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e69325d-49a9-4cd6-a359-7a926e77144e?source=api-prod","affected":[{"type":"plugin","slug":"konami-easter-egg","name":"Konami Easter Egg","from":"*","from_inclusive":true,"to":"v0.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:28:46Z"},{"id":"wordfence:0e70184f-94b6-4742-b99b-6eec9d28f17c","source":"wordfence","cve":"CVE-2025-1657","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e70184f-94b6-4742-b99b-6eec9d28f17c?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T14:22:04Z","updated":"2025-04-17T13:06:50Z"},{"id":"wordfence:0e7130ca-f550-439c-81ec-e48737ff3956","source":"wordfence","cve":"CVE-2025-58854","title":"Ultimate AJAX Login <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7130ca-f550-439c-81ec-e48737ff3956?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-ajax-login","name":"Ultimate AJAX Login","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:22:13Z"},{"id":"wordfence:0e725ec0-4897-4ba7-a803-80e8aafacbd1","source":"wordfence","cve":"CVE-2024-44004","title":"WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e725ec0-4897-4ba7-a803-80e8aafacbd1?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.3","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2024-09-16T00:00:00Z","updated":"2026-08-14T15:12:56Z"},{"id":"wordfence:0e73d1cc-d7df-4ba2-8e68-514ade56595c","source":"wordfence","cve":"CVE-2026-56056","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e73d1cc-d7df-4ba2-8e68-514ade56595c?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.7","to_inclusive":true,"patched_in":"7.9.8"}],"published":"2026-10-29T12:58:00Z","updated":"2026-11-03T20:05:42Z"},{"id":"wordfence:0e75c346-8152-4c4f-995a-7ab90a31feb0","source":"wordfence","cve":"CVE-2025-26878","title":"Autoship Cloud for WooCommerce Subscription Products <= 2.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e75c346-8152-4c4f-995a-7ab90a31feb0?source=api-prod","affected":[{"type":"plugin","slug":"autoship-cloud","name":"Autoship Cloud for WooCommerce Subscription Products","from":"*","from_inclusive":true,"to":"2.8.0.1","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T16:51:16Z"},{"id":"wordfence:0e7654a1-0020-4bf1-86be-bdb238a9fe0d","source":"wordfence","cve":"CVE-2025-5071","title":"AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7654a1-0020-4bf1-86be-bdb238a9fe0d?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"2.8.0","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-19T09:23:48Z"},{"id":"wordfence:0e7825de-dc11-4471-820b-a5b189a7d61c","source":"wordfence","cve":"CVE-2025-23875","title":"Better Protected Pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7825de-dc11-4471-820b-a5b189a7d61c?source=api-prod","affected":[{"type":"plugin","slug":"better-protected-pages","name":"Better Protected Pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:40:47Z"},{"id":"wordfence:0e78b5db-3f38-4ed7-9bec-6dd55d44f04f","source":"wordfence","cve":"CVE-2026-107752","title":"Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e78b5db-3f38-4ed7-9bec-6dd55d44f04f?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.4","to_inclusive":true,"patched_in":"2.12.5"}],"published":"2026-10-16T14:35:00Z","updated":"2026-10-17T03:43:27Z"},{"id":"wordfence:0e79a2b2-0491-4778-996d-0a0a80b2a338","source":"wordfence","cve":"CVE-2026-12853","title":"Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e79a2b2-0491-4778-996d-0a0a80b2a338?source=api-prod","affected":[{"type":"plugin","slug":"flamingo","name":"Flamingo","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-07T12:29:04Z"},{"id":"wordfence:0e7ac22f-cb50-46b6-b244-22b5e8dc8142","source":"wordfence","cve":"CVE-2023-27608","title":"Points and Rewards for WooCommerce <= 1.5.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7ac22f-cb50-46b6-b244-22b5e8dc8142?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e7af92f-985b-4200-b147-53e98d03399b","source":"wordfence","cve":"CVE-2025-68891","title":"App Bar <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7af92f-985b-4200-b147-53e98d03399b?source=api-prod","affected":[{"type":"plugin","slug":"wp-app-bar","name":"WP App Bar","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:36:58Z"},{"id":"wordfence:0e7b694f-8926-4bba-be77-42ade5d1c3b4","source":"wordfence","cve":"CVE-2014-10393","title":"cformsII <= 10.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7b694f-8926-4bba-be77-42ade5d1c3b4?source=api-prod","affected":[{"type":"plugin","slug":"cforms","name":"cforms","from":"*","from_inclusive":true,"to":"10.5","to_inclusive":false,"patched_in":"10.5"}],"published":"2014-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e7e7c70-4d07-4550-9cf8-5135b87b67ca","source":"wordfence","cve":"CVE-2024-1641","title":"Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7e7c70-4d07-4550-9cf8-5135b87b67ca?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.2.96","to_inclusive":true,"patched_in":"2.2.97"}],"published":"2024-03-13T00:00:00Z","updated":"2024-07-31T15:35:24Z"},{"id":"wordfence:0e7e9fcc-804a-46a8-95cd-b358ba7681ec","source":"wordfence","cve":"CVE-2025-13729","title":"Entry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7e9fcc-804a-46a8-95cd-b358ba7681ec?source=api-prod","affected":[{"type":"plugin","slug":"entry-views","name":"Entry Views","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:18:42Z","updated":"2026-01-09T09:19:48Z"},{"id":"wordfence:0e81b6c1-5af5-4ad4-92db-9dba76399857","source":"wordfence","cve":"CVE-2026-2487","title":"Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e81b6c1-5af5-4ad4-92db-9dba76399857?source=api-prod","affected":[{"type":"plugin","slug":"admin-custom-login","name":"Admin Custom Login","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2026-08-15T15:24:50Z","updated":"2026-08-16T03:24:53Z"},{"id":"wordfence:0e828fbc-d465-4d69-b7d6-42e2ad87f73d","source":"wordfence","cve":"CVE-2023-23834","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to Plugin Activation","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e828fbc-d465-4d69-b7d6-42e2ad87f73d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e843c18-fbd7-4413-86f9-8d72bcdcb9da","source":"wordfence","cve":"CVE-2025-27003","title":"Quick Paypal Payments <= 5.7.46 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e843c18-fbd7-4413-86f9-8d72bcdcb9da?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.46","to_inclusive":true,"patched_in":"5.7.47"}],"published":"2025-09-04T00:00:00Z","updated":"2025-09-09T22:17:08Z"},{"id":"wordfence:0e89f295-df1e-48a6-b19e-7a73b24ac402","source":"wordfence","cve":"CVE-2025-66053","title":"Enfold <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e89f295-df1e-48a6-b19e-7a73b24ac402?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-24T20:59:28Z"},{"id":"wordfence:0e8a4400-1169-4015-ae95-9c3109b728fa","source":"wordfence","cve":"CVE-2025-32692","title":"WP Subscription Forms <= 1.2.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e8a4400-1169-4015-ae95-9c3109b728fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscription-forms","name":"WP Subscription Forms \u2013 Subscription Form Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:37:37Z"},{"id":"wordfence:0e8c8203-43b1-4840-9990-18f538589834","source":"wordfence","cve":"CVE-2026-42777","title":"Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e8c8203-43b1-4840-9990-18f538589834?source=api-prod","affected":[{"type":"theme","slug":"aalto","name":"Aalto - Architecture and Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:23:45Z"},{"id":"wordfence:0e8f2dba-9108-4531-8428-e66b406349b6","source":"wordfence","cve":"CVE-2025-24661","title":"Taxi Booking Manager for WooCommerce \u2013 WordPress plugin | Ecab <= 1.1.8 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e8f2dba-9108-4531-8428-e66b406349b6?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-01-20T00:00:00Z","updated":"2025-02-25T17:11:44Z"},{"id":"wordfence:0e8f63e3-6392-4152-94a5-eb953d7e53fb","source":"wordfence","cve":"CVE-2019-17236","title":"IgniteUp \u2013 Coming Soon and Maintenance Mode <= 3.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e8f63e3-6392-4152-94a5-eb953d7e53fb?source=api-prod","affected":[{"type":"plugin","slug":"igniteup","name":"IgniteUp \u2013 Coming Soon and Maintenance Mode","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2019-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e91d482-e417-4406-9156-b1dde0bf46e2","source":"wordfence","cve":"CVE-2025-66106","title":"Featured Post Creative <= 1.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e91d482-e417-4406-9156-b1dde0bf46e2?source=api-prod","affected":[{"type":"plugin","slug":"featured-post-creative","name":"Featured Post Creative","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-01T17:18:10Z"},{"id":"wordfence:0e926467-51f5-4fb4-a9d8-3cb72f212cd6","source":"wordfence","cve":"CVE-2024-32949","title":"Integrate Google Drive <= 1.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e926467-51f5-4fb4-a9d8-3cb72f212cd6?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.91"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:57:33Z"},{"id":"wordfence:0e9324ba-1cbf-4326-80b5-7b9d969441ad","source":"wordfence","cve":"CVE-2024-1348","title":"Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9324ba-1cbf-4326-80b5-7b9d969441ad?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:33:08Z"},{"id":"wordfence:0e951b97-3d17-4360-8fec-393e2f0c13d2","source":"wordfence","cve":"CVE-2024-12268","title":"Responsive Blocks \u2013 WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e951b97-3d17-4360-8fec-393e2f0c13d2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T11:09:52Z"},{"id":"wordfence:0e98a899-1578-45bf-ba1d-92703e38abd9","source":"wordfence","cve":"CVE-2025-12578","title":"Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e98a899-1578-45bf-ba1d-92703e38abd9?source=api-prod","affected":[{"type":"plugin","slug":"reuters-direct","name":"Reuters Direct","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:20:46Z","updated":"2025-11-27T02:26:12Z"},{"id":"wordfence:0e99531c-8742-4f91-8525-65bb3cb06644","source":"wordfence","cve":"CVE-2022-4539","title":"Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e99531c-8742-4f91-8525-65bb3cb06644?source=api-prod","affected":[{"type":"plugin","slug":"web-application-firewall","name":"Web Application Firewall \u2013 website security","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-08-30T00:00:00Z","updated":"2024-08-31T09:35:55Z"},{"id":"wordfence:0e9bac4c-3a07-4a76-b2bd-365aae455086","source":"wordfence","cve":"CVE-2013-2702","title":"Easy Plugin for AdSense < 6.10 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9bac4c-3a07-4a76-b2bd-365aae455086?source=api-prod","affected":[{"type":"plugin","slug":"easy-adsense-lite","name":"Easy Plugin for AdSense","from":"*","from_inclusive":true,"to":"6.10","to_inclusive":false,"patched_in":"6.10"}],"published":"2013-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0e9cd38a-b2cd-4801-a06b-4e965fa72e04","source":"wordfence","cve":"CVE-2024-6152","title":"Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9cd38a-b2cd-4801-a06b-4e965fa72e04?source=api-prod","affected":[{"type":"plugin","slug":"flipbox-builder","name":"Flipbox Builder","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:04:08Z","updated":"2024-07-27T01:51:03Z"},{"id":"wordfence:0e9d5382-d37d-4a40-8f22-e32b8ee98859","source":"wordfence","cve":"CVE-2024-3268","title":"YouTube Video Gallery by YouTube Showcase \u2013 Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9d5382-d37d-4a40-8f22-e32b8ee98859?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-21T11:33:17Z"},{"id":"wordfence:0e9dc5e3-9d72-4c04-8ba9-56428a6fdddd","source":"wordfence","cve":"CVE-2026-12900","title":"Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9dc5e3-9d72-4c04-8ba9-56428a6fdddd?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.28","to_inclusive":true,"patched_in":"2.19.29"}],"published":"2026-07-20T09:16:50Z","updated":"2026-07-20T21:29:58Z"},{"id":"wordfence:0e9e2864-6624-497f-8bec-df8360ed3f4a","source":"wordfence","cve":"CVE-2024-0254","title":"(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9e2864-6624-497f-8bec-df8360ed3f4a?source=api-prod","affected":[{"type":"plugin","slug":"guest-author-name","name":"(Simply) Guest Author Name","from":"*","from_inclusive":true,"to":"4.34","to_inclusive":true,"patched_in":"4.35"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:35:52Z"},{"id":"wordfence:0e9ec6af-fa51-4e14-abf6-450c1ca6f8d5","source":"wordfence","cve":"CVE-2025-4685","title":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9ec6af-fa51-4e14-abf6-450c1ca6f8d5?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2025-07-20T18:48:55Z","updated":"2025-07-21T07:23:25Z"},{"id":"wordfence:0ea0f826-5ae9-4dad-89d0-9fc9f10f526b","source":"wordfence","cve":"CVE-2021-24156","title":"Testimonial Rotator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ea0f826-5ae9-4dad-89d0-9fc9f10f526b?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-rotator","name":"Testimonial Rotator","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2021-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ea59a87-1b69-42fa-afc4-d68b33df94b1","source":"wordfence","cve":"CVE-2025-23928","title":"Google Org Chart <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ea59a87-1b69-42fa-afc4-d68b33df94b1?source=api-prod","affected":[{"type":"plugin","slug":"google-org-chart","name":"Google Org Chart","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:47:56Z"},{"id":"wordfence:0ea82fcc-09b1-4015-8858-becfa60d3a8f","source":"wordfence","cve":"CVE-2018-25324","title":"Simple Fields <=  0.3.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ea82fcc-09b1-4015-8858-becfa60d3a8f?source=api-prod","affected":[{"type":"plugin","slug":"simple-fields","name":"Simple Fields","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-17T00:00:00Z","updated":"2026-07-29T19:54:31Z"},{"id":"wordfence:0ea99921-5dda-42aa-99f8-43e52f3362c8","source":"wordfence","cve":"CVE-2024-37557","title":"WP Cookie Law Info <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ea99921-5dda-42aa-99f8-43e52f3362c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookie-law-info","name":"WP Cookie Law Info","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T14:12:37Z"},{"id":"wordfence:0ea9e69c-8a8e-41ab-99e7-f47d89ae0467","source":"wordfence","cve":"CVE-2025-58852","title":"MSTW League Manager <= 2.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ea9e69c-8a8e-41ab-99e7-f47d89ae0467?source=api-prod","affected":[{"type":"plugin","slug":"mstw-league-manager","name":"MSTW League Manager","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:13:34Z"},{"id":"wordfence:0eae9c5a-8a11-4293-a7e1-2c5d77c75284","source":"wordfence","cve":"CVE-2021-24827","title":"Asgaros Forum <= 1.15.12 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eae9c5a-8a11-4293-a7e1-2c5d77c75284?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"1.15.12","to_inclusive":true,"patched_in":"1.15.13"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0eafe473-9177-47c4-aa1e-2350cb827447","source":"wordfence","cve":"CVE-2024-0256","title":"Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eafe473-9177-47c4-aa1e-2350cb827447?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-07-29T21:35:52Z"},{"id":"wordfence:0eb2c608-1a1f-4c74-aa24-b955db052559","source":"wordfence","cve":"CVE-2025-64352","title":"Essential Addons for Elementor <= 6.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb2c608-1a1f-4c74-aa24-b955db052559?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2025-09-17T00:00:00Z","updated":"2025-11-04T15:53:01Z"},{"id":"wordfence:0eb50d3f-9e01-4e3d-a3ed-8c3fec006be6","source":"wordfence","cve":"CVE-2023-6485","title":"Html5 Video Player <= 2.5.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb50d3f-9e01-4e3d-a3ed-8c3fec006be6?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.18","to_inclusive":true,"patched_in":"2.5.19"}],"published":"2023-12-08T00:00:00Z","updated":"2024-05-30T20:35:25Z"},{"id":"wordfence:0eb875d6-03ff-441e-9a4e-69aa577c8587","source":"wordfence","cve":"CVE-2022-3137","title":"Taskbuilder <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb875d6-03ff-441e-9a4e-69aa577c8587?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0eb8e3b7-20ef-46dc-9519-8176f9ccd459","source":"wordfence","cve":"CVE-2025-22715","title":"Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb8e3b7-20ef-46dc-9519-8176f9ccd459?source=api-prod","affected":[{"type":"plugin","slug":"WP_AttractiveDonationsSystem","name":"WP Attractive Donations System - Easy Stripe & Paypal donations","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:02:35Z"},{"id":"wordfence:0eb90948-b2b6-4e30-b903-95b7bce5d734","source":"wordfence","cve":"","title":"Paid Memberships Pro \u2013 Restrict Member Access to Content, Courses, Communities \u2013 Free or Paid Subscriptions <= 2.5.2 - IDOR to Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb90948-b2b6-4e30-b903-95b7bce5d734?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":false,"patched_in":"2.5.3"}],"published":"2021-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0eb94259-5f24-49dd-bf4b-0c1dd996d9d4","source":"wordfence","cve":"CVE-2025-69315","title":"Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb94259-5f24-49dd-bf4b-0c1dd996d9d4?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.15","to_inclusive":true,"patched_in":"1.6.9.17"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T18:39:59Z"},{"id":"wordfence:0eb9d676-4fa0-4bdc-af44-5d7e1dd8c6e6","source":"wordfence","cve":"CVE-2024-9302","title":"App Builder \u2013 Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eb9d676-4fa0-4bdc-af44-5d7e1dd8c6e6?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T06:51:23Z"},{"id":"wordfence:0ebaf76d-b659-41d2-8c66-4d6204678222","source":"wordfence","cve":"CVE-2025-47593","title":"Really Simple Under Construction Page <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ebaf76d-b659-41d2-8c66-4d6204678222?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-under-construction","name":"Really Simple Under Construction Page \u2013 Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-05-07T00:00:00Z","updated":"2026-06-18T13:50:47Z"},{"id":"wordfence:0ebc4c47-a286-4135-90ee-eccad8579661","source":"wordfence","cve":"CVE-2022-0471","title":"Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ebc4c47-a286-4135-90ee-eccad8579661?source=api-prod","affected":[{"type":"plugin","slug":"favicon-by-realfavicongenerator","name":"Favicon by RealFaviconGenerator","from":"*","from_inclusive":true,"to":"1.3.23","to_inclusive":false,"patched_in":"1.3.23"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ec2293c-4240-4ed5-8752-059214f85cc3","source":"wordfence","cve":"CVE-2026-78396","title":"Link Library <= 7.9.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec2293c-4240-4ed5-8752-059214f85cc3?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.0","to_inclusive":true,"patched_in":"7.10.0"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T20:11:38Z"},{"id":"wordfence:0ec64507-b77e-4685-978f-7408fe8db5ee","source":"wordfence","cve":"CVE-2023-47648","title":"EazyDocs <= 2.3.5 - Missing Authorization via doc_one_page and edit_doc_one_page","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec64507-b77e-4685-978f-7408fe8db5ee?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2023-11-07T00:00:00Z","updated":"2024-02-06T16:43:47Z"},{"id":"wordfence:0ec68efc-a162-42ef-bd63-9179ea748472","source":"wordfence","cve":"CVE-2026-119478","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.56 - Authenticated (Subscriber+) Arbitrary Shortcode Exeuction","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec68efc-a162-42ef-bd63-9179ea748472?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.56","to_inclusive":true,"patched_in":"3.7.57"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:49:11Z"},{"id":"wordfence:0ec84f54-5cb9-4788-ab78-4f744f0a4029","source":"wordfence","cve":"CVE-2025-31583","title":"WP Copy Media URL <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec84f54-5cb9-4788-ab78-4f744f0a4029?source=api-prod","affected":[{"type":"plugin","slug":"wp-copy-media-url","name":"WP Copy Media URL","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:35:28Z"},{"id":"wordfence:0ec8a72e-0153-4c2b-bdda-c6474cc2aadb","source":"wordfence","cve":"","title":"bbPress <= 2.5.9 - Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec8a72e-0153-4c2b-bdda-c6474cc2aadb?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ec90144-bfd8-4840-8b0f-73340386b7d5","source":"wordfence","cve":"CVE-2022-3822","title":"Donations via PayPal <= 1.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec90144-bfd8-4840-8b0f-73340386b7d5?source=api-prod","affected":[{"type":"plugin","slug":"paypal-donations","name":"Donations via PayPal","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ec94789-0386-4122-a446-be14bd3bb999","source":"wordfence","cve":"CVE-2026-96826","title":"W4 Post List <= 3.0.6 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ec94789-0386-4122-a446-be14bd3bb999?source=api-prod","affected":[{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-09-23T19:22:00Z","updated":"2026-09-29T19:56:12Z"},{"id":"wordfence:0eca4a3f-8f08-447b-8092-0432d67c56e9","source":"wordfence","cve":"CVE-2026-13393","title":"ElementsKit Lite <= 3.10.0 - Authenticated (Subsite administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eca4a3f-8f08-447b-8092-0432d67c56e9?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.01"}],"published":"2026-07-14T00:00:00Z","updated":"2026-08-15T21:16:44Z"},{"id":"wordfence:0ecba857-03d8-4a2e-9450-146d442f5533","source":"wordfence","cve":"CVE-2025-9344","title":"UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ecba857-03d8-4a2e-9450-146d442f5533?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.42","to_inclusive":true,"patched_in":"1.2.43"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T01:46:29Z"},{"id":"wordfence:0ed40cd3-b0af-4276-9723-640ada7c6f86","source":"wordfence","cve":"CVE-2024-56022","title":"Preloader by WordPress Monsters <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed40cd3-b0af-4276-9723-640ada7c6f86?source=api-prod","affected":[{"type":"plugin","slug":"preloader-sws","name":"Preloader by WordPress Monsters","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:03:55Z"},{"id":"wordfence:0ed49e0d-3b8e-4add-a8e7-4cc1852ed7a6","source":"wordfence","cve":"CVE-2025-53319","title":"Raptive Ads <= 3.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed49e0d-3b8e-4add-a8e7-4cc1852ed7a6?source=api-prod","affected":[{"type":"plugin","slug":"adthrive-ads","name":"Raptive Ads","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:04:48Z"},{"id":"wordfence:0ed5a9c4-5148-4c3f-81fd-78bdde31f258","source":"wordfence","cve":"CVE-2015-10131","title":"TFO Graphviz <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed5a9c4-5148-4c3f-81fd-78bdde31f258?source=api-prod","affected":[{"type":"plugin","slug":"tfo-graphviz","name":"TFO Graphviz","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.10"}],"published":"2015-05-25T00:00:00Z","updated":"2024-04-24T14:12:34Z"},{"id":"wordfence:0ed683bf-be49-43e9-a1ba-9af7c2bf97b1","source":"wordfence","cve":"CVE-2014-9308","title":"Shopping Cart & eCommerce Store < 3.0.16 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed683bf-be49-43e9-a1ba-9af7c2bf97b1?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"3.0.16","to_inclusive":false,"patched_in":"3.0.16"}],"published":"2015-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ed74f7f-d629-4d07-b73e-eaa78f11ea70","source":"wordfence","cve":"CVE-2022-3850","title":"Find and Replace All <= 1.3 - Cross-Site Request Forgery to Arbitrary Content Replacement","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed74f7f-d629-4d07-b73e-eaa78f11ea70?source=api-prod","affected":[{"type":"plugin","slug":"find-and-replace-all","name":"Find and Replace All","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ed8ee65-d910-42a4-b6de-3229346dc59e","source":"wordfence","cve":"CVE-2017-6815","title":"WordPress Core < 4.7.3 - Bypass URL Validation","severity":"medium","cvss":6.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ed8ee65-d910-42a4-b6de-3229346dc59e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0edb6b7c-8a78-44b9-a5d6-b4a563c92484","source":"wordfence","cve":"CVE-2025-6461","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0edb6b7c-8a78-44b9-a5d6-b4a563c92484?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2026-01-24T13:59:04Z","updated":"2026-01-25T02:22:37Z"},{"id":"wordfence:0edbb65e-d80c-47b6-875a-7b0d6bec9554","source":"wordfence","cve":"CVE-2026-15609","title":"Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0edbb65e-d80c-47b6-875a-7b0d6bec9554?source=api-prod","affected":[{"type":"theme","slug":"bridge","name":"Bridge - Creative Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"30.8.9.1","to_inclusive":true,"patched_in":"30.8.9.2"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T13:03:44Z"},{"id":"wordfence:0ede0053-f885-40b3-a539-edf8df5f12bf","source":"wordfence","cve":"CVE-2024-49644","title":"Accessibility by AllAccessible <= 1.3.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ede0053-f885-40b3-a539-edf8df5f12bf?source=api-prod","affected":[{"type":"plugin","slug":"allaccessible","name":"Accessibility by AllAccessible","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:34:35Z"},{"id":"wordfence:0ee09d0f-3b0a-4875-9e01-ff4b4257199d","source":"wordfence","cve":"CVE-2026-85683","title":"Jane Menu <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee09d0f-3b0a-4875-9e01-ff4b4257199d?source=api-prod","affected":[{"type":"plugin","slug":"jane-menu","name":"Jane Menu","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:43:16Z"},{"id":"wordfence:0ee3b389-60c9-4f8e-9428-a71a6d9b20aa","source":"wordfence","cve":"CVE-2025-8059","title":"B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee3b389-60c9-4f8e-9428-a71a6d9b20aa?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-08-11T16:24:23Z","updated":"2025-08-12T04:25:42Z"},{"id":"wordfence:0ee4fe34-e6ae-4f37-a1a7-ebb153ae7a67","source":"wordfence","cve":"","title":"Realia <= 1.4.0 - Arbitrary Post Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee4fe34-e6ae-4f37-a1a7-ebb153ae7a67?source=api-prod","affected":[{"type":"plugin","slug":"realia","name":"Realia","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2020-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ee60943-b583-4a99-8e62-846b380c98aa","source":"wordfence","cve":"CVE-2024-8791","title":"Donation Forms by Charitable \u2013 Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee60943-b583-4a99-8e62-846b380c98aa?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.1.14","to_inclusive":true,"patched_in":"1.8.1.15"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T02:31:03Z"},{"id":"wordfence:0ee6da38-3287-4ec2-919d-46ed3a0df2ac","source":"wordfence","cve":"CVE-2026-107416","title":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar <= 6.5.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee6da38-3287-4ec2-919d-46ed3a0df2ac?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2026-10-13T12:43:05Z","updated":"2026-10-23T18:07:10Z"},{"id":"wordfence:0ee7b30f-9d06-421c-af30-f20b774d389e","source":"wordfence","cve":"CVE-2022-45838","title":"ARForms Form Builder <= 1.5.6 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee7b30f-9d06-421c-af30-f20b774d389e?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0eec9744-6dbd-42bd-b9c5-c9d792cecf4b","source":"wordfence","cve":"CVE-2024-1760","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eec9744-6dbd-42bd-b9c5-c9d792cecf4b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.6.20","to_inclusive":true,"patched_in":"1.6.6.24"}],"published":"2024-03-05T00:00:00Z","updated":"2024-03-06T05:33:25Z"},{"id":"wordfence:0eedb898-406a-4dcc-b61f-cc1d6be9aa20","source":"wordfence","cve":"CVE-2026-27374","title":"WooCommerce Order Details <= 3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eedb898-406a-4dcc-b61f-cc1d6be9aa20?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-order-details","name":"WooCommerce Order Details","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T17:50:26Z"},{"id":"wordfence:0eef0902-c18b-452c-ab90-89f4094b7754","source":"wordfence","cve":"CVE-2026-111848","title":"Geo Mashup <= 1.13.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eef0902-c18b-452c-ab90-89f4094b7754?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.22","to_inclusive":true,"patched_in":"1.13.23"}],"published":"2026-10-19T13:33:03Z","updated":"2026-10-23T18:46:59Z"},{"id":"wordfence:0eef88db-eec5-4df2-8751-5f616ff99b1a","source":"wordfence","cve":"CVE-2026-119486","title":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eef88db-eec5-4df2-8751-5f616ff99b1a?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-11-07T10:11:00Z","updated":"2026-11-10T19:27:07Z"},{"id":"wordfence:0ef1679f-44ec-448a-a77b-489ac9bfaa7a","source":"wordfence","cve":"CVE-2025-9560","title":"Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.334","to_inclusive":true,"patched_in":"1.0.335"}],"published":"2025-10-10T14:09:28Z","updated":"2025-10-11T02:24:51Z"},{"id":"wordfence:0ef23749-21de-4c99-8fd6-4488ab16887e","source":"wordfence","cve":"CVE-2024-43312","title":"WPC Frequently Bought Together for WooCommerce <= 7.1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef23749-21de-4c99-8fd6-4488ab16887e?source=api-prod","affected":[{"type":"plugin","slug":"woo-bought-together","name":"WPC Frequently Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.9","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:38:47Z"},{"id":"wordfence:0ef2953f-da65-422f-b893-833b49907c55","source":"wordfence","cve":"CVE-2025-67470","title":"Portfolio and Projects <= 1.5.5 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef2953f-da65-422f-b893-833b49907c55?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-and-projects","name":"Portfolio and Projects","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-11T15:50:54Z"},{"id":"wordfence:0ef6a03b-8373-42e6-a15c-b99b22f5cee0","source":"wordfence","cve":"CVE-2025-39412","title":"Master Slider <= 3.11.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef6a03b-8373-42e6-a15c-b99b22f5cee0?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2025-04-17T00:00:00Z","updated":"2026-05-11T19:54:36Z"},{"id":"wordfence:0ef7d891-0efa-45e5-ad16-2f34fc017c8f","source":"wordfence","cve":"","title":"ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef7d891-0efa-45e5-ad16-2f34fc017c8f?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-google-product-feed-plugin-basic","name":"ELEX WooCommerce Google Shopping (Google Product Feed)","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ef8024c-d5e5-4921-a161-01507cb4f2bd","source":"wordfence","cve":"CVE-2024-34800","title":"Crafthemes Demo Import <= 3.3 - Missing Authorization to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef8024c-d5e5-4921-a161-01507cb4f2bd?source=api-prod","affected":[{"type":"plugin","slug":"crafthemes-demo-import","name":"Crafthemes Demo Import","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2024-05-20T00:00:00Z","updated":"2026-04-15T13:27:08Z"},{"id":"wordfence:0ef82a52-0a32-4dc4-b027-3d2098549404","source":"wordfence","cve":"CVE-2025-6252","title":"Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef82a52-0a32-4dc4-b027-3d2098549404?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-06-27T16:10:13Z","updated":"2025-06-28T04:21:34Z"},{"id":"wordfence:0ef8f81e-b241-43c3-9045-610cdbc08be1","source":"wordfence","cve":"CVE-2025-26870","title":"JetEngine <= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef8f81e-b241-43c3-9045-610cdbc08be1?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.6.4.1","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:10:53Z"},{"id":"wordfence:0efc41ea-701d-44ce-9fec-b4d1459f63b1","source":"wordfence","cve":"CVE-2024-37220","title":"Optinly <= 1.0.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0efc41ea-701d-44ce-9fec-b4d1459f63b1?source=api-prod","affected":[{"type":"plugin","slug":"optinly","name":"Optinly \u2013 Exit Intent, Newsletter Popups, Gamification & Opt-in Forms","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-15T17:00:57Z"},{"id":"wordfence:0efd41da-8270-4ed0-8b08-9790e51dd830","source":"wordfence","cve":"CVE-2026-95526","title":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0efd41da-8270-4ed0-8b08-9790e51dd830?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-10-04T07:36:15Z","updated":"2026-10-09T00:08:44Z"},{"id":"wordfence:0efe8bbd-c1c9-48ed-adab-34c0ac3da8bf","source":"wordfence","cve":"CVE-2026-10833","title":"Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0efe8bbd-c1c9-48ed-adab-34c0ac3da8bf?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-06-24T14:50:31Z","updated":"2026-06-25T03:42:21Z"},{"id":"wordfence:0efebdcb-c3fb-435a-8687-6abdd5f9334b","source":"wordfence","cve":"CVE-2023-38475","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0efebdcb-c3fb-435a-8687-6abdd5f9334b?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0eff89a8-07b7-49fc-b68d-9efd87fcac3c","source":"wordfence","cve":"CVE-2010-5106","title":"WordPress Core < 3.0.3 - Access Control Bypass","severity":"medium","cvss":6.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0eff89a8-07b7-49fc-b68d-9efd87fcac3c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2010-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0efff314-b14f-4af4-b225-ba7e41d01b2e","source":"wordfence","cve":"","title":"Smash Balloon Plugins (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0efff314-b14f-4af4-b225-ba7e41d01b2e?source=api-prod","affected":[{"type":"plugin","slug":"feeds-for-youtube","name":"Feeds for YouTube (YouTube video, channel, and gallery plugin)","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"},{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"},{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"2.19.1","to_inclusive":true,"patched_in":"2.19.2"}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f0051d5-b236-420c-ae65-14610d05c6d1","source":"wordfence","cve":"CVE-2022-0651","title":"WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via current_page_type","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f0051d5-b236-420c-ae65-14610d05c6d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f00b138-5c4b-4f75-94b1-82721cba2668","source":"wordfence","cve":"CVE-2024-3954","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f00b138-5c4b-4f75-94b1-82721cba2668?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.38","to_inclusive":true,"patched_in":"3.1.39"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:19Z"},{"id":"wordfence:0f01c9c8-acd4-44c0-8866-a0a819828006","source":"wordfence","cve":"","title":"All 404 Redirect to Homepage & Broken images Redirection <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f01c9c8-acd4-44c0-8866-a0a819828006?source=api-prod","affected":[{"type":"plugin","slug":"all-404-redirect-to-homepage","name":"All 404 Redirect to Homepage","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f01ee24-544b-45cb-9cf3-7db8263d8e54","source":"wordfence","cve":"CVE-2023-31229","title":"WP Directory Kit <= 1.1.9 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f01ee24-544b-45cb-9cf3-7db8263d8e54?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f01f69e-0ff8-4771-9bf5-53ef78438cc2","source":"wordfence","cve":"CVE-2024-11940","title":"Property Hive Mortgage Calculator <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f01f69e-0ff8-4771-9bf5-53ef78438cc2?source=api-prod","affected":[{"type":"plugin","slug":"property-hive-mortgage-calculator","name":"Property Hive Mortgage Calculator","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-09T19:52:15Z","updated":"2024-12-10T08:23:41Z"},{"id":"wordfence:0f02b258-d911-401e-8b32-57166d75bde7","source":"wordfence","cve":"CVE-2024-54216","title":"ARForms <= 6.4.1 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Read","severity":"high","cvss":7.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f02b258-d911-401e-8b32-57166d75bde7?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:55:03Z"},{"id":"wordfence:0f02cc66-7782-45fe-ae5e-340ff7ae1fe9","source":"wordfence","cve":"CVE-2023-24377","title":"Ecwid Ecommerce Shopping Cart <= 6.11.3 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f02cc66-7782-45fe-ae5e-340ff7ae1fe9?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.11.3","to_inclusive":true,"patched_in":"6.11.4"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f09cb59-dbbb-48a3-aeac-377f6ec87b88","source":"wordfence","cve":"CVE-2026-8624","title":"LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f09cb59-dbbb-48a3-aeac-377f6ec87b88?source=api-prod","affected":[{"type":"plugin","slug":"lj-comments-import-reloaded","name":"LJ comments import: reloaded","from":"*","from_inclusive":true,"to":"0.97.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:08:00Z","updated":"2026-05-20T01:25:46Z"},{"id":"wordfence:0f0f50e0-7015-4f00-880b-6eb94961177f","source":"wordfence","cve":"CVE-2021-25107","title":"Form Store to DB <= 1.1.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f0f50e0-7015-4f00-880b-6eb94961177f?source=api-prod","affected":[{"type":"plugin","slug":"cf7-store-to-db-lite","name":"Form Store to DB","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f10c476-ce0c-4204-8f68-46c12dac1ade","source":"wordfence","cve":"","title":"Featured Posts by BestWebSoft < 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f10c476-ce0c-4204-8f68-46c12dac1ade?source=api-prod","affected":[{"type":"plugin","slug":"bws-featured-posts","name":"Featured Posts by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f11a49c-f352-4ae8-bad9-b55b2ef76353","source":"wordfence","cve":"CVE-2026-116562","title":"Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f11a49c-f352-4ae8-bad9-b55b2ef76353?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.128","to_inclusive":true,"patched_in":"1.4.129"}],"published":"2026-11-06T14:12:20Z","updated":"2026-11-07T02:29:11Z"},{"id":"wordfence:0f13b2dd-4832-4646-828c-ba2df1eb7d33","source":"wordfence","cve":"CVE-2022-34149","title":"WP OAuth Server <= 3.0.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f13b2dd-4832-4646-828c-ba2df1eb7d33?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-20-server","name":"WP OAuth Server ( Login with WordPress )","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f166e2e-6dd5-4453-8448-b7d7905dbf49","source":"wordfence","cve":"CVE-2026-118054","title":"LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f166e2e-6dd5-4453-8448-b7d7905dbf49?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-course-review","name":"LearnPress \u2013 Course Review","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-11-06T14:09:17Z","updated":"2026-11-07T02:29:12Z"},{"id":"wordfence:0f17a161-83c8-4e83-a3e1-3e9f2e5f2c00","source":"wordfence","cve":"CVE-2026-48968","title":"Master Slider \u2013 Responsive Touch Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f17a161-83c8-4e83-a3e1-3e9f2e5f2c00?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:27:54Z"},{"id":"wordfence:0f18a1c5-a0b7-49f9-acc1-5604304fd72f","source":"wordfence","cve":"CVE-2023-46784","title":"ICS Calendar <= 10.12.0.1 - Authenticated(Contributor+) Directory Traversal via _url_get_contents","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f18a1c5-a0b7-49f9-acc1-5604304fd72f?source=api-prod","affected":[{"type":"plugin","slug":"ics-calendar","name":"ICS Calendar","from":"*","from_inclusive":true,"to":"10.12.0.2","to_inclusive":false,"patched_in":"10.12.0.2"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f19194c-dbe8-455d-bee7-2f7d4ce9224f","source":"wordfence","cve":"CVE-2016-7169","title":"WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f19194c-dbe8-455d-bee7-2f7d4ce9224f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.15","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.15","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.13","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"3.7.16"}],"published":"2016-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f1c95a2-a3d8-41d5-a635-9dcd012dbdbb","source":"wordfence","cve":"CVE-2025-30594","title":"Include URL <= 0.3.5 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f1c95a2-a3d8-41d5-a635-9dcd012dbdbb?source=api-prod","affected":[{"type":"plugin","slug":"include-url","name":"Include URL","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-08T13:43:42Z"},{"id":"wordfence:0f1cce87-3e59-48c1-9d38-adaa739f20db","source":"wordfence","cve":"","title":"Realia <= 0.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f1cce87-3e59-48c1-9d38-adaa739f20db?source=api-prod","affected":[{"type":"plugin","slug":"realia","name":"Realia","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":false,"patched_in":"0.9.2"}],"published":"2016-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f1f0b69-1c38-45e9-a3d6-b7a85f6ed78c","source":"wordfence","cve":"CVE-2025-53561","title":"Prevent files / folders access <= 2.6.0 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f1f0b69-1c38-45e9-a3d6-b7a85f6ed78c?source=api-prod","affected":[{"type":"plugin","slug":"prevent-file-access","name":"Prevent Files / Folders Access","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:49:04Z"},{"id":"wordfence:0f204d39-8a4a-4008-adc6-3ba72531f5a2","source":"wordfence","cve":"CVE-2024-12512","title":"Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f204d39-8a4a-4008-adc6-3ba72531f5a2?source=api-prod","affected":[{"type":"plugin","slug":"ask-me-anything-anonymously","name":"Ask Me Anything (Anonymously)","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:44:29Z","updated":"2025-01-25T07:24:13Z"},{"id":"wordfence:0f206117-2da0-4c7b-9ef1-cb6986210ac0","source":"wordfence","cve":"CVE-2026-119513","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 5.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f206117-2da0-4c7b-9ef1-cb6986210ac0?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-11-07T10:40:00Z","updated":"2026-11-10T19:32:39Z"},{"id":"wordfence:0f20c7d3-8987-4dc0-9d97-98a29adbab85","source":"wordfence","cve":"CVE-2023-3492","title":"WP Shopping Pages <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f20c7d3-8987-4dc0-9d97-98a29adbab85?source=api-prod","affected":[{"type":"plugin","slug":"shopping-pages","name":"WP Shopping Pages","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f210f6b-091f-45bf-be1e-872db3ab7b59","source":"wordfence","cve":"CVE-2014-7139","title":"Contact Form DB <= 2.8.19 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f210f6b-091f-45bf-be1e-872db3ab7b59?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-to-database-extension","name":"Contact Form DB","from":"*","from_inclusive":true,"to":"2.8.19","to_inclusive":true,"patched_in":"2.8.20"}],"published":"2014-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f218010-8429-4a8a-b7f6-e45945a2a1ba","source":"wordfence","cve":"CVE-2022-47600","title":"Mass Email To users <= 1.1.4 - Unauthenticated Reflected Cross-Site Scripting via 'entrant'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f218010-8429-4a8a-b7f6-e45945a2a1ba?source=api-prod","affected":[{"type":"plugin","slug":"mass-email-to-users","name":"Mass Email To Users","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f21d7a2-3b4f-487f-a64a-b963427233b3","source":"wordfence","cve":"CVE-2025-14366","title":"Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f21d7a2-3b4f-487f-a64a-b963427233b3?source=api-prod","affected":[{"type":"plugin","slug":"eyewear-prescription-form","name":"Eyewear prescription form","from":"*","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2025-12-12T16:04:31Z","updated":"2026-07-09T19:16:25Z"},{"id":"wordfence:0f2371df-8ee0-4a26-a33d-337c129dc7d3","source":"wordfence","cve":"","title":"SEO Rank Reporter <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2371df-8ee0-4a26-a33d-337c129dc7d3?source=api-prod","affected":[{"type":"plugin","slug":"seo-rank-reporter","name":"SEO Rank Reporter","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f23aa0e-eb1f-4310-9615-d67eb39389fe","source":"wordfence","cve":"CVE-2014-10017","title":"Welcart e-Commerce <=  2.9.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f23aa0e-eb1f-4310-9615-d67eb39389fe?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2014-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f281ef5-bb2e-42f9-be51-6f7bd3069f59","source":"wordfence","cve":"CVE-2024-4643","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f281ef5-bb2e-42f9-be51-6f7bd3069f59?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2024-08-01T20:56:56Z","updated":"2024-08-08T15:22:43Z"},{"id":"wordfence:0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a","source":"wordfence","cve":"CVE-2025-9808","title":"The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.2","to_inclusive":true,"patched_in":"6.15.3"}],"published":"2025-09-15T16:24:56Z","updated":"2025-09-16T05:25:29Z"},{"id":"wordfence:0f2c46f7-b7c9-41a5-8cf9-61a683c3922c","source":"wordfence","cve":"CVE-2021-36886","title":"Contact Form 7 Database Addon \u2013 CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2c46f7-b7c9-41a5-8cf9-61a683c3922c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.5.9","to_inclusive":true,"patched_in":"1.2.6.1"}],"published":"2021-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f2e39b3-c18c-4660-b23d-00790156bc7f","source":"wordfence","cve":"","title":"Ultimate Product Catalog < 3.1.3 - Multiple Vulnerabilities","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2e39b3-c18c-4660-b23d-00790156bc7f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f2ebd89-d34f-4f08-9654-049355fdfa3f","source":"wordfence","cve":"CVE-2023-3524","title":"WPCode <= 2.0.13 - Unauthenticated Reflected Cross-Site Scripting via Tag Filter Links","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2ebd89-d34f-4f08-9654-049355fdfa3f?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers","name":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.13.1"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f325945-8394-4ff5-8868-2b1c464cd91f","source":"wordfence","cve":"CVE-2024-47348","title":"YellowPencil Visual CSS Style Editor <= 7.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f325945-8394-4ff5-8868-2b1c464cd91f?source=api-prod","affected":[{"type":"plugin","slug":"yellow-pencil-visual-theme-customizer","name":"Visual CSS Style Editor","from":"*","from_inclusive":true,"to":"7.6.4","to_inclusive":true,"patched_in":"7.6.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:42:38Z"},{"id":"wordfence:0f3303db-9ba6-4638-ba96-151cf91db85b","source":"wordfence","cve":"CVE-2023-45010","title":"Complete Open Graph <= 3.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3303db-9ba6-4638-ba96-151cf91db85b?source=api-prod","affected":[{"type":"plugin","slug":"complete-open-graph","name":"Complete Open Graph","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f3411f3-ca2f-407a-8af5-a6a350d67734","source":"wordfence","cve":"CVE-2026-118079","title":"FV Flowplayer Video Player <= 7.5.56.7212 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3411f3-ca2f-407a-8af5-a6a350d67734?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7212","to_inclusive":true,"patched_in":"7.5.57.7212"}],"published":"2026-10-28T08:24:43Z","updated":"2026-11-03T19:41:39Z"},{"id":"wordfence:0f35cc8b-11be-4664-be48-12a8db872d66","source":"wordfence","cve":"CVE-2022-0784","title":"Title Experiments Free <= 9.0.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f35cc8b-11be-4664-be48-12a8db872d66?source=api-prod","affected":[{"type":"plugin","slug":"wp-experiments-free","name":"Title Experiments Free","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":false,"patched_in":"9.0.1"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f361332-63d8-4a9c-93b2-eeea428a178e","source":"wordfence","cve":"CVE-2025-58948","title":"Aromatica <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f361332-63d8-4a9c-93b2-eeea428a178e?source=api-prod","affected":[{"type":"theme","slug":"aromatica","name":"Aromatica - Cafe & Coffee Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-19T16:36:14Z"},{"id":"wordfence:0f36a924-6a68-40ff-bf1a-9ebcad1c2fc6","source":"wordfence","cve":"CVE-2016-1209","title":"Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f36a924-6a68-40ff-bf1a-9ebcad1c2fc6?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"2.9.36","from_inclusive":true,"to":"2.9.42","to_inclusive":true,"patched_in":"2.9.42.1"}],"published":"2016-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f37578f-a331-40c7-b3aa-a53f15f2f885","source":"wordfence","cve":"CVE-2026-109937","title":"Otter Blocks <= 3.2.2 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f37578f-a331-40c7-b3aa-a53f15f2f885?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:44:28Z"},{"id":"wordfence:0f379d56-c4d6-4a87-82b5-ca9a62a9b319","source":"wordfence","cve":"CVE-2026-13736","title":"NewPath WildApricotPress Add-on \u2013 Member Directory <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f379d56-c4d6-4a87-82b5-ca9a62a9b319?source=api-prod","affected":[{"type":"plugin","slug":"newpath-wildapricotpress-add-on-member-directory","name":"NewPath WildApricotPress Add-on \u2013 Member Directory","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-22T18:42:20Z"},{"id":"wordfence:0f38e5f0-6c62-4c0a-99f9-09bc20ee87d4","source":"wordfence","cve":"CVE-2026-13345","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.6.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f38e5f0-6c62-4c0a-99f9-09bc20ee87d4?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.10","to_inclusive":false,"patched_in":"6.6.10"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:37:07Z"},{"id":"wordfence:0f3b3c1a-1d45-4e2f-854a-171fe759257b","source":"wordfence","cve":"CVE-2025-8723","title":"Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3b3c1a-1d45-4e2f-854a-171fe759257b?source=api-prod","affected":[{"type":"plugin","slug":"cf-image-resizing","name":"Cloudflare Image Resizing \u2013 Optimize & Accelerate Your Images","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2025-08-18T19:08:51Z","updated":"2025-08-19T07:26:27Z"},{"id":"wordfence:0f3b74db-22a4-4638-8662-0c8cfbee6493","source":"wordfence","cve":"CVE-2019-15326","title":"Import and export users and customers <= 1.14.2.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3b74db-22a4-4638-8662-0c8cfbee6493?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.14.2.1","to_inclusive":true,"patched_in":"1.14.2.2"}],"published":"2019-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f3c3629-b7a9-4f83-a821-64119ed662ce","source":"wordfence","cve":"CVE-2022-32970","title":"Themify Portfolio Post <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3c3629-b7a9-4f83-a821-64119ed662ce?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f3df75e-cf2f-4076-b5ff-b8540408044a","source":"wordfence","cve":"CVE-2023-23646","title":"Album Gallery \u2013 WordPress Gallery <= 1.4.9 - Cross-Site Request Forgery via album-gallery-column-settings.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3df75e-cf2f-4076-b5ff-b8540408044a?source=api-prod","affected":[{"type":"plugin","slug":"new-album-gallery","name":"Album Gallery for Photo & Video","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f3f5429-f328-4000-a9ac-7d828f9386fc","source":"wordfence","cve":"CVE-2025-46232","title":"Download Alt Text AI <= 1.9.93 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3f5429-f328-4000-a9ac-7d828f9386fc?source=api-prod","affected":[{"type":"plugin","slug":"alttext-ai","name":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility","from":"*","from_inclusive":true,"to":"1.9.93","to_inclusive":true,"patched_in":"1.9.94"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:22:21Z"},{"id":"wordfence:0f3f5f23-487b-4fd2-9c3f-616478b03f1e","source":"wordfence","cve":"CVE-2026-125435","title":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates <= 3.1.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f3f5f23-487b-4fd2-9c3f-616478b03f1e?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:11Z"},{"id":"wordfence:0f40a2ff-93e8-4216-b6eb-47058b254ee3","source":"wordfence","cve":"CVE-2024-49652","title":"3D Work In Progress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f40a2ff-93e8-4216-b6eb-47058b254ee3?source=api-prod","affected":[{"type":"plugin","slug":"renee-work-in-progress","name":"3D Work In Progress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:12:43Z"},{"id":"wordfence:0f42b2be-2a7d-470a-896d-6148e31e4cce","source":"wordfence","cve":"CVE-2026-13334","title":"Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f42b2be-2a7d-470a-896d-6148e31e4cce?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-07-08T19:17:27Z","updated":"2026-07-09T07:55:12Z"},{"id":"wordfence:0f42f0be-5386-448b-9e65-5d2584cc2175","source":"wordfence","cve":"CVE-2025-11086","title":"Academy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f42f0be-5386-448b-9e65-5d2584cc2175?source=api-prod","affected":[{"type":"plugin","slug":"academy-pro","name":"Academy LMS Pro","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-22T11:25:19Z"},{"id":"wordfence:0f44fcc8-c5e0-44f5-92c3-6603b19a06fe","source":"wordfence","cve":"CVE-2025-1529","title":"AM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f44fcc8-c5e0-44f5-92c3-6603b19a06fe?source=api-prod","affected":[{"type":"plugin","slug":"am-lottieplayer","name":"AM LottiePlayer","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-01T11:11:40Z"},{"id":"wordfence:0f45583e-1438-47af-871c-efd59345c727","source":"wordfence","cve":"CVE-2026-2420","title":"LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f45583e-1438-47af-871c-efd59345c727?source=api-prod","affected":[{"type":"plugin","slug":"ltm-popup-form","name":"LotekMedia Popup Form","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:48:27Z","updated":"2026-03-07T07:22:03Z"},{"id":"wordfence:0f45738b-fff6-438e-8870-508c622c1752","source":"wordfence","cve":"CVE-2023-46086","title":"affiliate-toolkit \u2013 WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f45738b-fff6-438e-8870-508c622c1752?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f461dea-3572-4abd-8cd2-c1e60fc233f7","source":"wordfence","cve":"CVE-2024-50448","title":"YITH WooCommerce Product Add-Ons <= 4.14.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f461dea-3572-4abd-8cd2-c1e60fc233f7?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:56:11Z"},{"id":"wordfence:0f473b8a-26c7-4a91-aed1-d7df1506c8f9","source":"wordfence","cve":"CVE-2025-66147","title":"Coder for Elementor <= 1.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f473b8a-26c7-4a91-aed1-d7df1506c8f9?source=api-prod","affected":[{"type":"plugin","slug":"coder-elementor","name":"Coder for Elementor","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2025-12-19T17:02:41Z"},{"id":"wordfence:0f4aa403-5a8e-4e4d-a009-3f7bfdc7ada3","source":"wordfence","cve":"","title":"Love Travel 1.0 - 1.9 - Reflected Cross-Site Scripting and Cross-Frame Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4aa403-5a8e-4e4d-a009-3f7bfdc7ada3?source=api-prod","affected":[{"type":"theme","slug":"lovetravel","name":"Love Travel","from":"1.0","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2020-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f4bb514-80bd-4d66-a60f-0a6a287af5de","source":"wordfence","cve":"CVE-2023-0589","title":"WP Image Carousel WordPress - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4bb514-80bd-4d66-a60f-0a6a287af5de?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-carousel","name":"WP Image Carousel","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f4bba27-efdc-4b2d-80be-4a5c17ef5e7c","source":"wordfence","cve":"CVE-2021-24265","title":"Rife Elementor Extensions & Templates <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4bba27-efdc-4b2d-80be-4a5c17ef5e7c?source=api-prod","affected":[{"type":"plugin","slug":"rife-elementor-extensions","name":"Rife Extensions & Templates for Elementor","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f4c9abb-d42d-4f59-8364-f1fb4d06ffbc","source":"wordfence","cve":"CVE-2026-25377","title":"Addon Jobsearch Chat <= 3.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4c9abb-d42d-4f59-8364-f1fb4d06ffbc?source=api-prod","affected":[{"type":"plugin","slug":"addon-jobsearch-chat","name":"Addon Jobsearch Chat","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:45:20Z"},{"id":"wordfence:0f4ecda0-1eaa-44e7-8ef5-20c967b5da9f","source":"wordfence","cve":"CVE-2025-12167","title":"Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4ecda0-1eaa-44e7-8ef5-20c967b5da9f?source=api-prod","affected":[{"type":"plugin","slug":"integrate-contact-form-7-and-aweber","name":"Connect Contact Form 7 and AWeber","from":"*","from_inclusive":true,"to":"0.1.42","to_inclusive":true,"patched_in":"0.1.43"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:46Z"},{"id":"wordfence:0f4f8b84-3f65-430b-b749-6afae8d53153","source":"wordfence","cve":"CVE-2025-4684","title":"BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f4f8b84-3f65-430b-b749-6afae8d53153?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.13.1","to_inclusive":true,"patched_in":"3.2.13.2"}],"published":"2025-07-31T21:41:04Z","updated":"2025-08-01T11:18:55Z"},{"id":"wordfence:0f522dfe-f2c2-4adb-980c-1f03d3c26e12","source":"wordfence","cve":"CVE-2024-11396","title":"Event monster <= 1.4.3 - Information Exposure Via Visitors List Export","severity":"medium","cvss":5.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f522dfe-f2c2-4adb-980c-1f03d3c26e12?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-01-13T11:10:18Z","updated":"2025-01-13T23:21:40Z"},{"id":"wordfence:0f537479-d5ec-46bb-a04e-2c33a2abc759","source":"wordfence","cve":"CVE-2024-2830","title":"WordPress Tag and Category Manager \u2013 AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f537479-d5ec-46bb-a04e-2c33a2abc759?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.20.0"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T02:32:41Z"},{"id":"wordfence:0f54574f-e640-4cfb-b03e-fd23f3bd574b","source":"wordfence","cve":"CVE-2025-26979","title":"Funnel Builder by FunnelKit <= 3.9.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f54574f-e640-4cfb-b03e-fd23f3bd574b?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:27:56Z"},{"id":"wordfence:0f54f61c-f75d-4640-8150-e8b60b26dcf9","source":"wordfence","cve":"CVE-2025-67925","title":"Corpkit <= 2.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f54f61c-f75d-4640-8150-e8b60b26dcf9?source=api-prod","affected":[{"type":"theme","slug":"corpkit","name":"Corpkit - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:21:03Z"},{"id":"wordfence:0f56427e-6103-43ae-ae2e-23f520646535","source":"wordfence","cve":"CVE-2025-23816","title":"Metaphor Widgets <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f56427e-6103-43ae-ae2e-23f520646535?source=api-prod","affected":[{"type":"plugin","slug":"mtphr-widgets","name":"Metaphor Widgets","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:02:40Z"},{"id":"wordfence:0f57458b-0cd2-4958-8190-c89076771e86","source":"wordfence","cve":"CVE-2014-4570","title":"VideoWhisper Video Presentation <= 3.25 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f57458b-0cd2-4958-8190-c89076771e86?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-video-presentation","name":"VideoWhisper Video Presentation","from":"*","from_inclusive":true,"to":"3.25","to_inclusive":true,"patched_in":"3.31"}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f58bfbc-82b7-4155-af19-d17d5ed4238b","source":"wordfence","cve":"CVE-2025-22819","title":"Qr Code and Barcode Scanner Reader <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f58bfbc-82b7-4155-af19-d17d5ed4238b?source=api-prod","affected":[{"type":"plugin","slug":"qr-code-and-barcode-scanner-reader","name":"Qr Code and Barcode Scanner Reader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:03:24Z"},{"id":"wordfence:0f59baba-646b-4f47-9b0e-04cb8fdf0459","source":"wordfence","cve":"CVE-2025-53240","title":"WordPress Photo Gallery <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f59baba-646b-4f47-9b0e-04cb8fdf0459?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery-portfolio","name":"WordPress Photo Gallery \u2013 Portfolio, Image Gallery & Video Gallery","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-08T15:47:58Z","updated":"2026-02-03T13:42:02Z"},{"id":"wordfence:0f5a247e-21a2-4c02-9a64-0bf2254108e2","source":"wordfence","cve":"CVE-2025-28970","title":"WP Optimize By xTraffic <= 5.1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f5a247e-21a2-4c02-9a64-0bf2254108e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimize-by-xtraffic","name":"WP Optimize By xTraffic","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:13:05Z"},{"id":"wordfence:0f5a48ec-da62-4a9d-a8a5-30da7b6d23f6","source":"wordfence","cve":"CVE-2025-54940","title":"Advanced Custom Fields <= 6.4.2. - HTML Injection","severity":"medium","cvss":4.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f5a48ec-da62-4a9d-a8a5-30da7b6d23f6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-25T15:55:47Z"},{"id":"wordfence:0f5f8bd5-435a-4a53-8fa2-55674f39b78b","source":"wordfence","cve":"CVE-2023-4254","title":"ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f5f8bd5-435a-4a53-8fa2-55674f39b78b?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f64cbff-96a2-45e6-b37a-a7d4702fdf09","source":"wordfence","cve":"CVE-2024-34802","title":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization to Unauthenticated Ad Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f64cbff-96a2-45e6-b37a-a7d4702fdf09?source=api-prod","affected":[{"type":"plugin","slug":"adfoxly","name":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-20T00:00:00Z","updated":"2024-08-02T15:06:16Z"},{"id":"wordfence:0f68ffc1-c909-4dce-ba78-9e83c791f304","source":"wordfence","cve":"CVE-2026-103696","title":"Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f68ffc1-c909-4dce-ba78-9e83c791f304?source=api-prod","affected":[{"type":"plugin","slug":"mobile-builder","name":"Mobile builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:02:25Z"},{"id":"wordfence:0f6ad375-da04-4b56-8077-e26c148e7527","source":"wordfence","cve":"CVE-2024-11008","title":"Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6ad375-da04-4b56-8077-e26c148e7527?source=api-prod","affected":[{"type":"plugin","slug":"members","name":"Members \u2013 Membership & User Role Editor Plugin","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-11T10:57:58Z"},{"id":"wordfence:0f6b6b32-bcde-4c40-a954-c5c62eb3436e","source":"wordfence","cve":"CVE-2026-93300","title":"EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6b6b32-bcde-4c40-a954-c5c62eb3436e?source=api-prod","affected":[{"type":"plugin","slug":"eventon-subscriber","name":"EventON - Subscriber","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-19T17:35:41Z","updated":"2026-10-20T05:39:18Z"},{"id":"wordfence:0f6bc166-8489-44bc-862e-dd4dcc1dcff8","source":"wordfence","cve":"CVE-2021-24209","title":"WP Super Cache <= 1.7.1 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6bc166-8489-44bc-862e-dd4dcc1dcff8?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f6be03e-1aa1-4e34-b899-90a55423a80b","source":"wordfence","cve":"CVE-2025-39482","title":"Eventer <= 3.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6be03e-1aa1-4e34-b899-90a55423a80b?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-08-13T18:04:47Z"},{"id":"wordfence:0f6cca7a-b8ff-4ca5-b813-e611eac07695","source":"wordfence","cve":"CVE-2025-2328","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6cca7a-b8ff-4ca5-b813-e611eac07695?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.8.7","to_inclusive":true,"patched_in":"1.3.8.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-03-28T06:51:45Z"},{"id":"wordfence:0f6d0ba7-f9e8-493b-9e6d-62f1c662e21e","source":"wordfence","cve":"CVE-2026-7565","title":"LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6d0ba7-f9e8-493b-9e6d-62f1c662e21e?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2026-06-05T14:19:01Z","updated":"2026-06-06T02:28:34Z"},{"id":"wordfence:0f6d3435-61b9-4986-9da9-b58d1bbc2271","source":"wordfence","cve":"CVE-2026-59540","title":"SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6d3435-61b9-4986-9da9-b58d1bbc2271?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:52:04Z"},{"id":"wordfence:0f6e7fcd-f5f5-47a0-9d8a-74e2f67d10b5","source":"wordfence","cve":"CVE-2024-5039","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6e7fcd-f5f5-47a0-9d8a-74e2f67d10b5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.3","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-29T12:43:41Z"},{"id":"wordfence:0f6fa9c6-8a2b-49ca-ad7f-3aa51d671422","source":"wordfence","cve":"","title":"SEO Link Rotator <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f6fa9c6-8a2b-49ca-ad7f-3aa51d671422?source=api-prod","affected":[{"type":"plugin","slug":"seolinkrotator","name":"seolinkrotator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f70407e-712f-4856-8edb-b0ad89b0bf50","source":"wordfence","cve":"CVE-2024-13628","title":"WP Pricing Table <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f70407e-712f-4856-8edb-b0ad89b0bf50?source=api-prod","affected":[{"type":"plugin","slug":"wp-pricing-table","name":"WP Pricing Table","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:29:02Z"},{"id":"wordfence:0f704143-8842-485c-b419-f78b903b4184","source":"wordfence","cve":"CVE-2025-68557","title":"Chakra test <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f704143-8842-485c-b419-f78b903b4184?source=api-prod","affected":[{"type":"plugin","slug":"chakra-test","name":"Chakra test","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-06T14:37:12Z"},{"id":"wordfence:0f70e1b6-2963-43f6-b60f-65830d030d79","source":"wordfence","cve":"","title":"Global Multisite Search <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f70e1b6-2963-43f6-b60f-65830d030d79?source=api-prod","affected":[{"type":"plugin","slug":"global-multisite-search","name":"Global Multisite Search","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f721733-2245-4d8d-9881-91cc0b48551b","source":"wordfence","cve":"CVE-2024-13584","title":"Picture Gallery \u2013 Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f721733-2245-4d8d-9881-91cc0b48551b?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.5.19","to_inclusive":true,"patched_in":"1.5.20"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T03:21:31Z"},{"id":"wordfence:0f75c6bf-1b93-49d5-b5fb-e59b4e67432f","source":"wordfence","cve":"CVE-2023-2405","title":"CRM and Lead Management by vcita <= 2.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f75c6bf-1b93-49d5-b5fb-e59b4e67432f?source=api-prod","affected":[{"type":"plugin","slug":"crm-customer-relationship-management-by-vcita","name":"CRM and Lead Management by vcita","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2023-06-02T00:00:00Z","updated":"2025-03-20T15:32:34Z"},{"id":"wordfence:0f76c9f8-c57a-4875-b581-f67c9c60021c","source":"wordfence","cve":"CVE-2025-6851","title":"Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f76c9f8-c57a-4875-b581-f67c9c60021c?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-notifier","name":"Broken Link Notifier","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-07-10T19:50:33Z","updated":"2025-07-11T08:22:24Z"},{"id":"wordfence:0f775cb9-5799-4f79-bab4-8936bfb1fad1","source":"wordfence","cve":"CVE-2025-32553","title":"RestroPress <= 3.2.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f775cb9-5799-4f79-bab4-8936bfb1fad1?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.2.8.6","to_inclusive":true,"patched_in":"3.2.8.6.1"}],"published":"2025-04-09T00:00:00Z","updated":"2026-04-15T15:13:16Z"},{"id":"wordfence:0f77d41a-8b72-412f-9560-267bc50f9aec","source":"wordfence","cve":"","title":"Active Directory Integration / LDAP Integration <= 3.6.94 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f77d41a-8b72-412f-9560-267bc50f9aec?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"3.6.95","to_inclusive":false,"patched_in":"3.6.95"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f78479f-8e28-4fa4-bf2b-eefedffa4d72","source":"wordfence","cve":"CVE-2026-11614","title":"Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f78479f-8e28-4fa4-bf2b-eefedffa4d72?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-06-23T14:01:09Z","updated":"2026-06-24T02:29:07Z"},{"id":"wordfence:0f792909-ddfa-4d31-8bbb-1a7e94fb5f0b","source":"wordfence","cve":"CVE-2026-81795","title":"Page Visits Counter \u2013 Lite <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f792909-ddfa-4d31-8bbb-1a7e94fb5f0b?source=api-prod","affected":[{"type":"plugin","slug":"page-visits-counter-lite","name":"Page Visits Counter \u2013 Lite","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:26:01Z"},{"id":"wordfence:0f79de56-1db4-44f0-a1fd-d1f0429a4539","source":"wordfence","cve":"CVE-2025-39533","title":"Starfish Review Generation & Marketing <= 3.1.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f79de56-1db4-44f0-a1fd-d1f0429a4539?source=api-prod","affected":[{"type":"plugin","slug":"starfish-reviews","name":"Starfish Review Generation & Marketing for WordPress","from":"*","from_inclusive":true,"to":"3.1.19","to_inclusive":true,"patched_in":"3.1.20"}],"published":"2025-04-16T00:00:00Z","updated":"2026-03-17T21:21:54Z"},{"id":"wordfence:0f7a32e2-d481-4b2b-bfad-8748f15140bb","source":"wordfence","cve":"CVE-2025-49313","title":"BRW <= 1.8.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7a32e2-d481-4b2b-bfad-8748f15140bb?source=api-prod","affected":[{"type":"plugin","slug":"ova-brw","name":"BRW - Booking Rental Plugin WooCommerce","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:08:06Z"},{"id":"wordfence:0f7b119d-ec56-40cb-80ef-67585dadad77","source":"wordfence","cve":"CVE-2026-2257","title":"GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API","severity":"medium","cvss":6.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7b119d-ec56-40cb-80ef-67585dadad77?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-03-12T19:30:34Z","updated":"2026-03-13T08:25:19Z"},{"id":"wordfence:0f7c43d4-cf21-4324-bc77-50bdc2c24661","source":"wordfence","cve":"CVE-2022-2541","title":"uContext for Amazon <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7c43d4-cf21-4324-bc77-50bdc2c24661?source=api-prod","affected":[{"type":"plugin","slug":"ucontext-for-amazon","name":"uContext for Amazon","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f7f19fa-f3d9-41e9-94f5-9d817330f1ef","source":"wordfence","cve":"CVE-2024-11882","title":"FAQ And Answers \u2013 Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7f19fa-f3d9-41e9-94f5-9d817330f1ef?source=api-prod","affected":[{"type":"plugin","slug":"faq-and-answers","name":"Awesome FAQ \u2013 answer questions before customers ask","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:18Z"},{"id":"wordfence:0f7f91f6-9fe6-4bbf-ba3c-380ba2e97dcd","source":"wordfence","cve":"CVE-2024-8117","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7f91f6-9fe6-4bbf-ba3c-380ba2e97dcd?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T06:49:03Z"},{"id":"wordfence:0f803e16-7f47-4696-927f-450aaa5fda5e","source":"wordfence","cve":"CVE-2021-24300","title":"PickPlugins Product Slider for WooCommerce <= 1.13.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f803e16-7f47-4696-927f-450aaa5fda5e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-slider","name":"Product Slider, Product Grid, Product Masonry","from":"*","from_inclusive":true,"to":"1.13.21","to_inclusive":true,"patched_in":"1.13.22"}],"published":"2021-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f80e642-cbda-4651-82fb-4f8a043eb29f","source":"wordfence","cve":"CVE-2026-120514","title":"Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f80e642-cbda-4651-82fb-4f8a043eb29f?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.209","to_inclusive":true,"patched_in":"3.3.210"}],"published":"2026-11-06T21:25:15Z","updated":"2026-11-07T09:25:44Z"},{"id":"wordfence:0f831d48-733a-4e79-8559-92b03b8d0356","source":"wordfence","cve":"CVE-2023-46615","title":"KD Coming Soon <= 1.7 - Unauthenticated PHP Object Injection via cetitle","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f831d48-733a-4e79-8559-92b03b8d0356?source=api-prod","affected":[{"type":"plugin","slug":"kd-coming-soon","name":"KD Coming Soon","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f835e7c-f921-449d-9ffc-dd0fd141119d","source":"wordfence","cve":"CVE-2025-48291","title":"Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f835e7c-f921-449d-9ffc-dd0fd141119d?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"26.0.6","to_inclusive":true,"patched_in":"26.0.7"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T17:59:39Z"},{"id":"wordfence:0f83e62e-0a6f-4d95-93c4-552d59245552","source":"wordfence","cve":"CVE-2025-22762","title":"WordPress HelpDesk & Support Ticket System Plugin \u2013 Octrace Support <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f83e62e-0a6f-4d95-93c4-552d59245552?source=api-prod","affected":[{"type":"plugin","slug":"octrace-support","name":"WordPress HelpDesk & Support Ticket System Plugin \u2013 Octrace Support","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:06:52Z"},{"id":"wordfence:0f84599a-3fd4-4a09-9df3-a8d41cf1da2d","source":"wordfence","cve":"CVE-2025-31810","title":"Question Answer <= 1.2.70 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f84599a-3fd4-4a09-9df3-a8d41cf1da2d?source=api-prod","affected":[{"type":"plugin","slug":"question-answer","name":"PickPlugins Question Answer","from":"*","from_inclusive":true,"to":"1.2.70","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:10:56Z"},{"id":"wordfence:0f8619e9-525d-425a-88c4-464cca570277","source":"wordfence","cve":"CVE-2025-22578","title":"WP Cookie <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8619e9-525d-425a-88c4-464cca570277?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookie","name":"WP Cookie","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:49:39Z"},{"id":"wordfence:0f86e1ef-c898-4a54-8204-a9ec4caab586","source":"wordfence","cve":"CVE-2024-30201","title":"WordPress Importer <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f86e1ef-c898-4a54-8204-a9ec4caab586?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:32:24Z"},{"id":"wordfence:0f87d37a-879f-4506-a651-8c965a558e28","source":"wordfence","cve":"","title":"Thumbnail carousel slider < 1.0.1 - Stored Cross-Site Scripting and Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f87d37a-879f-4506-a651-8c965a558e28?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2020-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f88631c-25d2-4b67-91b3-a4f0168623ec","source":"wordfence","cve":"CVE-2026-22407","title":"Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f88631c-25d2-4b67-91b3-a4f0168623ec?source=api-prod","affected":[{"type":"theme","slug":"roam","name":"Roam - Travel & Tourism WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:28:12Z"},{"id":"wordfence:0f89ae50-0dbe-4dc0-9f19-ab3d001aceaa","source":"wordfence","cve":"CVE-2026-122001","title":"Komfortkasse for WooCommerce <= 1.4.8 - Cross-Site Request Forgery to Administrator Account Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f89ae50-0dbe-4dc0-9f19-ab3d001aceaa?source=api-prod","affected":[{"type":"plugin","slug":"komfortkasse-for-woocommerce","name":"Komfortkasse for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:15:36Z"},{"id":"wordfence:0f8aa38b-85c5-45a7-b5cd-9ecd43a3c340","source":"wordfence","cve":"CVE-2024-1774","title":"Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8aa38b-85c5-45a7-b5cd-9ecd43a3c340?source=api-prod","affected":[{"type":"plugin","slug":"customily-v2","name":"Customily Product Personalizer","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-09T18:58:32Z"},{"id":"wordfence:0f8c0697-73dc-481e-8d9b-d3e0de4bded3","source":"wordfence","cve":"CVE-2026-57790","title":"Billey <= 2.1.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8c0697-73dc-481e-8d9b-d3e0de4bded3?source=api-prod","affected":[{"type":"theme","slug":"billey","name":"Billey - Creative Portfolio & Agency Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:58:17Z"},{"id":"wordfence:0f8cc16d-4e42-47b0-8ba0-df3252071826","source":"wordfence","cve":"CVE-2024-33561","title":"XStore <= 9.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8cc16d-4e42-47b0-8ba0-df3252071826?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:47:27Z"},{"id":"wordfence:0f8e1495-c5e1-4bb9-92e9-b27b9b997a5f","source":"wordfence","cve":"CVE-2024-9119","title":"SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8e1495-c5e1-4bb9-92e9-b27b9b997a5f?source=api-prod","affected":[{"type":"plugin","slug":"svg-complete","name":"SVG Complete","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:26:48Z","updated":"2024-10-01T07:30:07Z"},{"id":"wordfence:0f8e2fec-c388-449e-892a-c09c09587028","source":"wordfence","cve":"CVE-2026-12979","title":"FunnelKit <= 3.15.0.5 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8e2fec-c388-449e-892a-c09c09587028?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.5","to_inclusive":true,"patched_in":"3.15.0.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T13:45:57Z"},{"id":"wordfence:0f916d4c-fb79-4d7c-a5a6-08d1e159ebd3","source":"wordfence","cve":"CVE-2026-27039","title":"WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f916d4c-fb79-4d7c-a5a6-08d1e159ebd3?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.0.31","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:53:49Z"},{"id":"wordfence:0f9229f2-e7dd-43c9-9c15-9b76c13e895b","source":"wordfence","cve":"CVE-2023-40001","title":"iThemes Sync <= 2.1.13 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9229f2-e7dd-43c9-9c15-9b76c13e895b?source=api-prod","affected":[{"type":"plugin","slug":"ithemes-sync","name":"Kadence Central \u2013 Site Management, Backups, Security, and Reporting","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":false,"patched_in":"2.1.14"}],"published":"2023-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f93f3c4-555c-4fb5-b4ad-b03cdba82fb8","source":"wordfence","cve":"CVE-2024-9768","title":"Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f93f3c4-555c-4fb5-b4ad-b03cdba82fb8?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.14","to_inclusive":true,"patched_in":"6.14.1"}],"published":"2024-10-31T00:00:00Z","updated":"2024-12-12T19:25:27Z"},{"id":"wordfence:0f963cd2-0069-4e58-a5e5-8a9bfea65168","source":"wordfence","cve":"CVE-2021-24473","title":"User Profile Picture < 2.6.0 - Authenticated Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f963cd2-0069-4e58-a5e5-8a9bfea65168?source=api-prod","affected":[{"type":"plugin","slug":"users-profile-picture","name":"User Profile Picture \u2013 Custom Local Avatars","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":false,"patched_in":"2.6.0"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0f986535-efc2-470e-bb50-e0964bb775b3","source":"wordfence","cve":"CVE-2024-49270","title":"Smart Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f986535-efc2-470e-bb50-e0964bb775b3?source=api-prod","affected":[{"type":"plugin","slug":"smart-blocks","name":"Smart Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:09:07Z"},{"id":"wordfence:0f98d063-616e-4c26-ae54-78c8580066ca","source":"wordfence","cve":"CVE-2025-32153","title":"VG WooCarousel <= 1.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f98d063-616e-4c26-ae54-78c8580066ca?source=api-prod","affected":[{"type":"plugin","slug":"vg-woocarousel","name":"VG WooCarousel","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:51:11Z"},{"id":"wordfence:0f99e32b-3985-4c50-817e-f54245e8b9c1","source":"wordfence","cve":"CVE-2025-8566","title":"GutenBee \u2013 Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f99e32b-3985-4c50-817e-f54245e8b9c1?source=api-prod","affected":[{"type":"plugin","slug":"gutenbee","name":"GutenBee \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"}],"published":"2025-09-29T15:28:37Z","updated":"2026-09-10T19:17:37Z"},{"id":"wordfence:0f9ab443-212e-4904-baf6-7eaa9d9370ea","source":"wordfence","cve":"CVE-2025-53225","title":"e-Boekhouden.nl <= 1.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9ab443-212e-4904-baf6-7eaa9d9370ea?source=api-prod","affected":[{"type":"plugin","slug":"e-boekhoudennl-connector","name":"e-Boekhouden.nl","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:00:43Z"},{"id":"wordfence:0f9b6979-2662-4d2f-9656-b880dd80832c","source":"wordfence","cve":"CVE-2024-13091","title":"WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9b6979-2662-4d2f-9656-b880dd80832c?source=api-prod","affected":[{"type":"plugin","slug":"wpbot-pro","name":"WPBot Pro Wordpress Chatbot","from":"*","from_inclusive":true,"to":"13.5.4","to_inclusive":true,"patched_in":"13.5.6"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-21T23:20:51Z"},{"id":"wordfence:0f9b800e-f09c-40ad-9863-fd245e35033d","source":"wordfence","cve":"CVE-2026-32479","title":"Visitor Traffic Real Time Statistics pro <= 11.17 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9b800e-f09c-40ad-9863-fd245e35033d?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.17","to_inclusive":true,"patched_in":"11.18"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:52:10Z"},{"id":"wordfence:0f9c5bed-a399-43e2-be40-d669e90d3736","source":"wordfence","cve":"CVE-2024-2085","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9c5bed-a399-43e2-be40-d669e90d3736?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:51:45Z"},{"id":"wordfence:0f9d18a4-262b-4011-91e9-b29a27a76470","source":"wordfence","cve":"CVE-2026-4162","title":"Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9d18a4-262b-4011-91e9-b29a27a76470?source=api-prod","affected":[{"type":"plugin","slug":"gravitysmtp","name":"Gravity SMTP","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-04-09T21:01:07Z","updated":"2026-04-10T09:25:59Z"},{"id":"wordfence:0f9eb9cb-ead9-4ddf-b40b-a0ce2f4910f6","source":"wordfence","cve":"CVE-2024-0376","title":"Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9eb9cb-ead9-4ddf-b40b-a0ce2f4910f6?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.16","to_inclusive":true,"patched_in":"4.10.17"}],"published":"2024-04-09T00:00:00Z","updated":"2024-07-29T21:35:53Z"},{"id":"wordfence:0fa0b67b-edc8-4f91-bf67-167df63cf7bd","source":"wordfence","cve":"CVE-2013-4944","title":"BuddyPress Extended Friendship Request < 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa0b67b-edc8-4f91-bf67-167df63cf7bd?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-extended-friendship-request","name":"BuddyPress Extended Friendship Request","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2013-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fa4585d-9ffa-4a32-aeb7-60cdad63187b","source":"wordfence","cve":"","title":"WP Backup+ (Unknown Versions) - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa4585d-9ffa-4a32-aeb7-60cdad63187b?source=api-prod","affected":[{"type":"plugin","slug":"wp-backup-plus","name":"WP Backup+","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fa49df8-6989-4099-be06-8b232c4f90ef","source":"wordfence","cve":"CVE-2024-35734","title":"WP Time Slots Booking Form <= 1.2.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa49df8-6989-4099-be06-8b232c4f90ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:24:02Z"},{"id":"wordfence:0fa5b6f2-94cc-47b8-986a-a3c525a7e777","source":"wordfence","cve":"CVE-2024-5802","title":"URL Shortener by MyShop <= 1.0.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa5b6f2-94cc-47b8-986a-a3c525a7e777?source=api-prod","affected":[{"type":"plugin","slug":"mts-url-shortener","name":"URL Shortener by MyThemeShop","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-23T20:35:53Z"},{"id":"wordfence:0fa6a112-ee69-43eb-bded-daba2c2c4dc5","source":"wordfence","cve":"CVE-2026-1844","title":"PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa6a112-ee69-43eb-bded-daba2c2c4dc5?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"12.4.0.2","to_inclusive":true,"patched_in":"12.4.0.3"}],"published":"2026-02-13T08:43:25Z","updated":"2026-02-13T21:23:04Z"},{"id":"wordfence:0fa7e6f6-92b2-494b-8c7a-76ba8213b610","source":"wordfence","cve":"CVE-2024-12034","title":"Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock","severity":"medium","cvss":5.3,"cwe":"CWE-340","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa7e6f6-92b2-494b-8c7a-76ba8213b610?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:44Z"},{"id":"wordfence:0fa84344-8672-43e1-a430-094021f7366f","source":"wordfence","cve":"CVE-2024-11341","title":"Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa84344-8672-43e1-a430-094021f7366f?source=api-prod","affected":[{"type":"plugin","slug":"eelv-redirection","name":"Simple Redirection","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-12-04T00:00:00Z","updated":"2024-12-05T09:23:07Z"},{"id":"wordfence:0faa8f07-88c1-4638-9de5-e202807866e1","source":"wordfence","cve":"CVE-2026-3328","title":"Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0faa8f07-88c1-4638-9de5-e202807866e1?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.31","to_inclusive":true,"patched_in":"3.28.32"}],"published":"2026-03-25T14:11:27Z","updated":"2026-03-26T02:25:19Z"},{"id":"wordfence:0faba4ff-c1a6-4ea0-878f-a80e9e2e4dd2","source":"wordfence","cve":"CVE-2026-111834","title":"Mang Board <= 2.4.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0faba4ff-c1a6-4ea0-878f-a80e9e2e4dd2?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-10-19T13:40:53Z","updated":"2026-10-23T18:44:50Z"},{"id":"wordfence:0fac8e7a-7379-4c0c-8c05-a8af1e37850c","source":"wordfence","cve":"CVE-2026-28112","title":"AllInOne - Banner Rotator <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fac8e7a-7379-4c0c-8c05-a8af1e37850c?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-bannerRotator","name":"AllInOne - Banner Rotator","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:32:26Z"},{"id":"wordfence:0faca93b-b1b7-4157-a764-6d754c8b3976","source":"wordfence","cve":"CVE-2026-57783","title":"Speaker <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0faca93b-b1b7-4157-a764-6d754c8b3976?source=api-prod","affected":[{"type":"plugin","slug":"speaker","name":"Speaker","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:02:48Z"},{"id":"wordfence:0facb49f-7276-4f50-862d-5d421026b0a8","source":"wordfence","cve":"CVE-2026-27090","title":"Kenta Companion <= 1.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0facb49f-7276-4f50-862d-5d421026b0a8?source=api-prod","affected":[{"type":"plugin","slug":"kenta-companion","name":"Kenta Companion","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-26T19:59:09Z"},{"id":"wordfence:0fad1834-0ee1-4542-a5a7-55a32861c81d","source":"wordfence","cve":"CVE-2024-8104","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fad1834-0ee1-4542-a5a7-55a32861c81d?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T06:49:04Z"},{"id":"wordfence:0fae3a9b-5f9a-441b-9ac9-55f24e342187","source":"wordfence","cve":"CVE-2026-89047","title":"Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fae3a9b-5f9a-441b-9ac9-55f24e342187?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-09-30T19:13:22Z","updated":"2026-10-01T07:40:22Z"},{"id":"wordfence:0fae8440-ce36-45ba-bed2-af30162e4c1b","source":"wordfence","cve":"CVE-2023-32590","title":"Subscribe to Category <= 2.7.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fae8440-ce36-45ba-bed2-af30162e4c1b?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-category","name":"Subscribe to Category","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fb06de8-97d6-46c3-83ef-93a209540259","source":"wordfence","cve":"CVE-2024-7848","title":"User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb06de8-97d6-46c3-83ef-93a209540259?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-08-21T00:00:00Z","updated":"2024-08-22T10:58:41Z"},{"id":"wordfence:0fb13522-95d7-428a-bbc6-e278f814e863","source":"wordfence","cve":"CVE-2024-53812","title":"WP GeoNames <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb13522-95d7-428a-bbc6-e278f814e863?source=api-prod","affected":[{"type":"plugin","slug":"wp-geonames","name":"WP GeoNames","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:07:33Z"},{"id":"wordfence:0fb1a2c2-581d-47ed-a180-9f70fdf79066","source":"wordfence","cve":"CVE-2024-10265","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb1a2c2-581d-47ed-a180-9f70fdf79066?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.30","to_inclusive":true,"patched_in":"1.15.31"}],"published":"2024-11-10T00:07:43Z","updated":"2024-11-10T12:30:34Z"},{"id":"wordfence:0fb1e5f5-dc27-4d8a-9561-388ef12e4d39","source":"wordfence","cve":"CVE-2025-69080","title":"Gecko <= 1.9.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb1e5f5-dc27-4d8a-9561-388ef12e4d39?source=api-prod","affected":[{"type":"theme","slug":"gecko","name":"Gecko 6.0 - Responsive Shopify Theme - RTL support","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-15T17:29:58Z"},{"id":"wordfence:0fb4927e-c9e0-4112-a35c-63878afd9481","source":"wordfence","cve":"CVE-2026-121783","title":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.90 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb4927e-c9e0-4112-a35c-63878afd9481?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.90","to_inclusive":true,"patched_in":"5.5.91"}],"published":"2026-11-07T10:14:00Z","updated":"2026-11-10T19:50:16Z"},{"id":"wordfence:0fb82b48-3cf8-47a5-b68d-e37a1823a125","source":"wordfence","cve":"CVE-2023-46201","title":"Auto Login New User After Registration <= 1.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via alnuar_auto_login_new_user_after_registration_redirect","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb82b48-3cf8-47a5-b68d-e37a1823a125?source=api-prod","affected":[{"type":"plugin","slug":"auto-login-new-user-after-registration","name":"Auto Login New User After Registration","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fb8e956-3a95-4e55-9816-be7eddb5835d","source":"wordfence","cve":"CVE-2024-7422","title":"Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb8e956-3a95-4e55-9816-be7eddb5835d?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T03:29:33Z"},{"id":"wordfence:0fb9b039-eb04-4c27-89eb-1932c9c31962","source":"wordfence","cve":"CVE-2020-36698","title":"Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb9b039-eb04-4c27-89eb-1932c9c31962?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.50","to_inclusive":true,"patched_in":"2.51"}],"published":"2020-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fbb1044-dd42-469d-9299-135ef2e609e0","source":"wordfence","cve":"CVE-2016-6635","title":"WordPress Core < 4.5 - Cross-Site Request Forgery  via wp_ajax_wp_compression_test","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fbb1044-dd42-469d-9299-135ef2e609e0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":false,"patched_in":"4.5"}],"published":"2016-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fbc5cd6-7a81-4c85-b51b-9a3f27b923e2","source":"wordfence","cve":"CVE-2026-54820","title":"JetBooking <= 4.0.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fbc5cd6-7a81-4c85-b51b-9a3f27b923e2?source=api-prod","affected":[{"type":"plugin","slug":"jet-booking","name":"JetBooking","from":"*","from_inclusive":true,"to":"4.0.4.1","to_inclusive":true,"patched_in":"4.0.4.2"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:55:42Z"},{"id":"wordfence:0fbebb2d-20ca-4b52-8505-d9d3499ad0b2","source":"wordfence","cve":"CVE-2026-110030","title":"Hide Price Until Login <= 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fbebb2d-20ca-4b52-8505-d9d3499ad0b2?source=api-prod","affected":[{"type":"plugin","slug":"hide-price-until-login","name":"Hide Price Until Login","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:22:04Z"},{"id":"wordfence:0fc16431-62b3-4d8e-924d-93d06b0fb89a","source":"wordfence","cve":"CVE-2025-69397","title":"Tint <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc16431-62b3-4d8e-924d-93d06b0fb89a?source=api-prod","affected":[{"type":"theme","slug":"tint","name":"Tint - Renovation, Painting & Wallpapering WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:33:36Z"},{"id":"wordfence:0fc19c02-6dc0-4d4b-82fd-c72653d890dc","source":"wordfence","cve":"CVE-2025-39558","title":"CRM Perks <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc19c02-6dc0-4d4b-82fd-c72653d890dc?source=api-prod","affected":[{"type":"plugin","slug":"support-x","name":"CRM Perks \u2013 WordPress HelpDesk Integration \u2013 Zendesk, Freshdesk, HelpScout","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:46:31Z"},{"id":"wordfence:0fc1e642-3eb8-426b-8d9b-66770aa8bbe4","source":"wordfence","cve":"CVE-2025-31580","title":"Ni WooCommerce Product Enquiry <= 4.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc1e642-3eb8-426b-8d9b-66770aa8bbe4?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-product-enquiry","name":"Ni WooCommerce Product Enquiry","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2025-03-31T00:00:00Z","updated":"2026-09-16T17:29:00Z"},{"id":"wordfence:0fc2b6cb-cca1-4d90-a229-12ec9d1f4b8b","source":"wordfence","cve":"CVE-2017-18507","title":"WP Live Chat Support <= 7.1.04 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc2b6cb-cca1-4d90-a229-12ec9d1f4b8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"7.1.04","to_inclusive":true,"patched_in":"7.1.05"}],"published":"2017-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fc2c20a-8927-4234-be08-1122e2a13a85","source":"wordfence","cve":"CVE-2025-26914","title":"Variable Inspector <= 2.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc2c20a-8927-4234-be08-1122e2a13a85?source=api-prod","affected":[{"type":"plugin","slug":"variable-inspector","name":"Variable Inspector","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:23:00Z"},{"id":"wordfence:0fc675e8-8ba1-40b0-829e-7a48d5eb586d","source":"wordfence","cve":"CVE-2023-47698","title":"Japanized For WooCommerce <= 2.6.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc675e8-8ba1-40b0-829e-7a48d5eb586d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fc6cc1b-7d49-48cd-9bce-d37c6dcfece9","source":"wordfence","cve":"CVE-2024-13805","title":"Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc6cc1b-7d49-48cd-9bce-d37c6dcfece9?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.14","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T09:21:16Z"},{"id":"wordfence:0fc781bc-d0e6-4fce-95aa-ff34caa072da","source":"wordfence","cve":"CVE-2025-28945","title":"Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc781bc-d0e6-4fce-95aa-ff34caa072da?source=api-prod","affected":[{"type":"theme","slug":"valen","name":"Valen - Sport, Fashion WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:50:32Z"},{"id":"wordfence:0fc7e35d-ca94-4a69-8a8d-6f358203863c","source":"wordfence","cve":"CVE-2026-66454","title":"WP Social Avatar <= 1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc7e35d-ca94-4a69-8a8d-6f358203863c?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-avatar","name":"WP Social Avatar","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:54:10Z"},{"id":"wordfence:0fc8b13b-6b84-45e5-bf34-fde1594ac85b","source":"wordfence","cve":"CVE-2026-112857","title":"Reprizo - Jewelry & Watch Store Shopify Theme <= 1.0.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc8b13b-6b84-45e5-bf34-fde1594ac85b?source=api-prod","affected":[{"type":"theme","slug":"reprizo","name":"Reprizo - Jewelry & Watch Store Shopify Theme","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:35Z"},{"id":"wordfence:0fcb1237-5d96-47f6-9f0c-3a0fd72ca91f","source":"wordfence","cve":"CVE-2015-9471","title":"ZoomSounds <= 2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcb1237-5d96-47f6-9f0c-3a0fd72ca91f?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2015-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fcdd6b5-a273-4916-a894-a753be0a7921","source":"wordfence","cve":"CVE-2022-1186","title":"Be POPIA Compliant <= 1.1.5 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcdd6b5-a273-4916-a894-a753be0a7921?source=api-prod","affected":[{"type":"plugin","slug":"be-popia-compliant","name":"Be POPIA Compliant","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fcdfba2-aa19-4d0c-8880-5ee2c0680555","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Shared User Instance Weakness","severity":"low","cvss":3.7,"cwe":"CWE-488","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcdfba2-aa19-4d0c-8880-5ee2c0680555?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fd0928c-801d-4449-a5e5-536e3fb902e9","source":"wordfence","cve":"CVE-2026-24636","title":"Sugar Calendar (Lite) <= 3.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fd0928c-801d-4449-a5e5-536e3fb902e9?source=api-prod","affected":[{"type":"plugin","slug":"sugar-calendar-lite","name":"Sugar Calendar \u2013 Events Calendar, Event Tickets, and Events Management Platform","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2026-01-05T08:00:47Z","updated":"2026-04-14T14:33:25Z"},{"id":"wordfence:0fd1cbbe-68b8-4a19-aea9-1e943d97c9c3","source":"wordfence","cve":"CVE-2015-1384","title":"Banner Effect Header < 1.2.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fd1cbbe-68b8-4a19-aea9-1e943d97c9c3?source=api-prod","affected":[{"type":"plugin","slug":"banner-effect-header","name":"Banner Effect Header","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2015-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fd87512-def0-4e59-aa2d-b166919474f3","source":"wordfence","cve":"CVE-2024-10436","title":"WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fd87512-def0-4e59-aa2d-b166919474f3?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-messages","name":"WPC Smart Messages for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-10-28T20:37:06Z","updated":"2024-10-29T09:31:29Z"},{"id":"wordfence:0fda86d9-2b80-47f9-bfb5-4bdb780a718f","source":"wordfence","cve":"CVE-2024-38697","title":"Goftino <= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fda86d9-2b80-47f9-bfb5-4bdb780a718f?source=api-prod","affected":[{"type":"plugin","slug":"goftino","name":"Goftino","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:21:12Z"},{"id":"wordfence:0fdc2dac-b3ea-40bd-987b-e6c47e74aefc","source":"wordfence","cve":"CVE-2023-50374","title":"CMP \u2013 Coming Soon & Maintenance <= 4.1.10 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fdc2dac-b3ea-40bd-987b-e6c47e74aefc?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-04T01:41:29Z"},{"id":"wordfence:0fddf084-2be2-4359-b318-a483dee0bd4e","source":"wordfence","cve":"CVE-2015-4697","title":"Google Analyticator <= 6.4.9.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fddf084-2be2-4359-b318-a483dee0bd4e?source=api-prod","affected":[{"type":"plugin","slug":"google-analyticator","name":"Analyticator","from":"*","from_inclusive":true,"to":"6.4.9.4","to_inclusive":false,"patched_in":"6.4.9.4"}],"published":"2015-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fdf116a-9b12-4fc6-985b-b4868dd6848e","source":"wordfence","cve":"CVE-2025-39367","title":"KLEO < 5.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fdf116a-9b12-4fc6-985b-b4868dd6848e?source=api-prod","affected":[{"type":"theme","slug":"kleo","name":"KLEO - Community Focused & Multi-Purpose BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"5.4.4"}],"published":"2025-04-29T00:00:00Z","updated":"2025-04-30T19:46:31Z"},{"id":"wordfence:0fe28cf5-466d-4a28-b6bd-6d77c54b97f9","source":"wordfence","cve":"CVE-2024-31285","title":"WordPress Tooltips <= 9.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe28cf5-466d-4a28-b6bd-6d77c54b97f9?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-tooltips","name":"Tooltips for WordPress","from":"*","from_inclusive":true,"to":"9.4.9","to_inclusive":true,"patched_in":"9.5.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:11:29Z"},{"id":"wordfence:0fe2bc91-2c8a-46ca-99cb-187d5c688305","source":"wordfence","cve":"CVE-2025-68576","title":"Virusdie <= 1.1.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe2bc91-2c8a-46ca-99cb-187d5c688305?source=api-prod","affected":[{"type":"plugin","slug":"virusdie","name":"Virusdie | One-click website security","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-06T14:32:49Z"},{"id":"wordfence:0fe2e1d6-7431-4121-93ad-cfe7837ac374","source":"wordfence","cve":"CVE-2024-49702","title":"myCred Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe2e1d6-7431-4121-93ad-cfe7837ac374?source=api-prod","affected":[{"type":"plugin","slug":"mycred-for-elementor","name":"myCred for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:04:58Z"},{"id":"wordfence:0fe551db-2073-4eeb-83da-9ce8c2c031e1","source":"wordfence","cve":"CVE-2024-6315","title":"Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe551db-2073-4eeb-83da-9ce8c2c031e1?source=api-prod","affected":[{"type":"plugin","slug":"blox-page-builder","name":"Blox Page Builder","from":"*","from_inclusive":true,"to":"1.0.65","to_inclusive":true,"patched_in":""}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-06T01:49:57Z"},{"id":"wordfence:0fe57abe-4354-46de-a742-d86722c381d8","source":"wordfence","cve":"CVE-2026-65558","title":"AffiliateX \u2013 Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking <= 2.3.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe57abe-4354-46de-a742-d86722c381d8?source=api-prod","affected":[{"type":"plugin","slug":"affiliatex","name":"AffiliateX \u2013 Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-29T12:14:21Z"},{"id":"wordfence:0fe5a834-487e-4da8-8b30-384427e26e6b","source":"wordfence","cve":"","title":"Booster for WooCommerce <= 5.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe5a834-487e-4da8-8b30-384427e26e6b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fe77926-8a43-42ce-9d3d-3aac2334dcbd","source":"wordfence","cve":"CVE-2025-14280","title":"PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe77926-8a43-42ce-9d3d-3aac2334dcbd?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.1.5","to_inclusive":true,"patched_in":"11.1.5.1"}],"published":"2025-12-29T05:47:53Z","updated":"2025-12-29T18:20:50Z"},{"id":"wordfence:0fe783fe-994b-4274-b51d-0679657bcf32","source":"wordfence","cve":"CVE-2025-69292","title":"Membership <= 1.6.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe783fe-994b-4274-b51d-0679657bcf32?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:52:08Z"},{"id":"wordfence:0fe79ca5-2811-44eb-a340-a41383f9d42e","source":"wordfence","cve":"CVE-2021-46780","title":"Easy Google Maps <= 1.9.31 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe79ca5-2811-44eb-a340-a41383f9d42e?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.9.31","to_inclusive":true,"patched_in":"1.9.32"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0fe89884-b428-4caf-b67a-5aaa41fafa9d","source":"wordfence","cve":"CVE-2025-67532","title":"Hara <= 1.2.17 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe89884-b428-4caf-b67a-5aaa41fafa9d?source=api-prod","affected":[{"type":"theme","slug":"hara","name":"Hara - Beauty and Cosmetics Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T16:59:59Z"},{"id":"wordfence:0fe987f0-6887-4ad1-a748-eb987bb574fa","source":"wordfence","cve":"CVE-2026-1377","title":"imwptip <= 1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe987f0-6887-4ad1-a748-eb987bb574fa?source=api-prod","affected":[{"type":"plugin","slug":"imwptip","name":"imwptip","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:49:03Z","updated":"2026-01-28T11:23:37Z"},{"id":"wordfence:0feaff52-062f-45d3-bece-b2c78bdd720e","source":"wordfence","cve":"CVE-2022-1527","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0feaff52-062f-45d3-bece-b2c78bdd720e?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0feb873e-0a89-4dd0-9f6b-489504f954af","source":"wordfence","cve":"CVE-2026-90984","title":"Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0feb873e-0a89-4dd0-9f6b-489504f954af?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:49:11Z"},{"id":"wordfence:0febc283-6c4a-472a-a211-0df853d63f7b","source":"wordfence","cve":"CVE-2024-34547","title":"Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0febc283-6c4a-472a-a211-0df853d63f7b?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":true,"patched_in":"1.1.35"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:57:44Z"},{"id":"wordfence:0fee990a-8ac0-40a2-9f25-96defd62263d","source":"wordfence","cve":"CVE-2014-5155","title":"Theme My Login <= 6.3.9 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0fee990a-8ac0-40a2-9f25-96defd62263d?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"6.3.10","to_inclusive":false,"patched_in":"6.3.10"}],"published":"2014-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0feeca6b-b611-44d3-90a6-569e4d2ccf5a","source":"wordfence","cve":"CVE-2023-51532","title":"Icegram <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0feeca6b-b611-44d3-90a6-569e4d2ccf5a?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.19","to_inclusive":true,"patched_in":"3.1.20"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0feed03e-fedf-4443-94e0-fbb2c8baba71","source":"wordfence","cve":"CVE-2026-111311","title":"DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0feed03e-fedf-4443-94e0-fbb2c8baba71?source=api-prod","affected":[{"type":"plugin","slug":"doublescale","name":"DoubleScale CRM | All-in-One CRM \u2013 Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-10-15T20:10:25Z","updated":"2026-10-16T08:27:42Z"},{"id":"wordfence:0ff001c2-95f9-42a2-b5a3-74937be41756","source":"wordfence","cve":"CVE-2023-50826","title":"Menu Image, Icons made easy <= 3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff001c2-95f9-42a2-b5a3-74937be41756?source=api-prod","affected":[{"type":"plugin","slug":"menu-image","name":"Menu Image, Icons made easy","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ff05b7a-874a-4262-98a8-963f5fa1e48b","source":"wordfence","cve":"CVE-2025-26885","title":"Assistant <= 1.5.1 - Authenticated (Editor+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff05b7a-874a-4262-98a8-963f5fa1e48b?source=api-prod","affected":[{"type":"plugin","slug":"assistant","name":"Assistant \u2013 Every Day Productivity Apps","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.1.1"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T20:33:16Z"},{"id":"wordfence:0ff16836-b333-4f2c-b998-04c95d3be9c2","source":"wordfence","cve":"CVE-2025-24690","title":"Formality <= 1.5.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff16836-b333-4f2c-b998-04c95d3be9c2?source=api-prod","affected":[{"type":"plugin","slug":"formality","name":"Formality","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:10:20Z"},{"id":"wordfence:0ff2bbe3-430d-4ef7-b2eb-30d0b69107d5","source":"wordfence","cve":"CVE-2025-26937","title":"Icon List Block <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff2bbe3-430d-4ef7-b2eb-30d0b69107d5?source=api-prod","affected":[{"type":"plugin","slug":"icon-list-block","name":"Icon List Block \u2013 Add Icon-Based Lists with Custom Styles","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:10:48Z"},{"id":"wordfence:0ff3a292-3924-4823-867a-fedb2c1cdd00","source":"wordfence","cve":"CVE-2025-10896","title":"Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff3a292-3924-4823-867a-fedb2c1cdd00?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks-for-gutenberg","name":"Master Blocks \u2013 Ultimate Blocks for Marketers","from":"*","from_inclusive":true,"to":"1.4.1.3","to_inclusive":true,"patched_in":"1.4.1.4"},{"type":"plugin","slug":"image-comparison-elementor-addon","name":"Image Comparison Addon for Elementor","from":"*","from_inclusive":true,"to":"1.0.2.2","to_inclusive":true,"patched_in":"1.0.2.3"},{"type":"plugin","slug":"image-hover-effects-elementor-addon","name":"Image Hover Effects for Elementor","from":"*","from_inclusive":true,"to":"1.0.2.3","to_inclusive":true,"patched_in":"1.0.2.4"},{"type":"plugin","slug":"content-locker-for-elementor","name":"Content Locker for Elementor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-11-03T15:52:24Z","updated":"2025-11-07T16:44:15Z"},{"id":"wordfence:0ff464d0-7aa4-4a79-a8d2-ea51398c40f9","source":"wordfence","cve":"CVE-2017-18518","title":"SMTP by BestWebSoft <= 1.0.9 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff464d0-7aa4-4a79-a8d2-ea51398c40f9?source=api-prod","affected":[{"type":"plugin","slug":"bws-smtp","name":"SMTP by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ff49f18-d6a6-46c9-a0be-e80dfe407992","source":"wordfence","cve":"CVE-2024-50415","title":"Ads.txt & App-ads.txt Manager for WordPress <= 1.1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff49f18-d6a6-46c9-a0be-e80dfe407992?source=api-prod","affected":[{"type":"plugin","slug":"app-ads-txt","name":"Ads.txt & App-ads.txt Manager for WordPress","from":"*","from_inclusive":true,"to":"1.1.7.1","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:24:44Z"},{"id":"wordfence:0ff67beb-638e-4d74-8d0e-6aece9207bb9","source":"wordfence","cve":"","title":"About Author <= 1.3.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff67beb-638e-4d74-8d0e-6aece9207bb9?source=api-prod","affected":[{"type":"plugin","slug":"about-author","name":"About Author","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2019-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ff96c12-1388-48a9-adf4-feca77a37ba7","source":"wordfence","cve":"CVE-2020-20625","title":"Sliced Invoices < 3.8.4 - Authenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ff96c12-1388-48a9-adf4-feca77a37ba7?source=api-prod","affected":[{"type":"plugin","slug":"sliced-invoices","name":"Sliced Invoices \u2013 WordPress Invoice Plugin","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":false,"patched_in":"3.8.4"}],"published":"2019-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ffc7596-436d-4f29-8921-013d6c20b7ae","source":"wordfence","cve":"CVE-2026-94665","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 6.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ffc7596-436d-4f29-8921-013d6c20b7ae?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:48:46Z"},{"id":"wordfence:0ffd60d2-ae8d-4738-a4f4-6df6e0ffa8c6","source":"wordfence","cve":"CVE-2023-0955","title":"WP Statistics <= 13.2.16 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ffd60d2-ae8d-4738-a4f4-6df6e0ffa8c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.16","to_inclusive":true,"patched_in":"14.0"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:0ffd695b-33e3-49b6-ad3a-98b2a645f827","source":"wordfence","cve":"CVE-2024-33950","title":"Archives Calendar Widget <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0ffd695b-33e3-49b6-ad3a-98b2a645f827?source=api-prod","affected":[{"type":"plugin","slug":"archives-calendar-widget","name":"Archives Calendar Widget","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T14:00:06Z"},{"id":"wordfence:1000c6db-800f-4f10-976b-5b946d5cc174","source":"wordfence","cve":"CVE-2025-32610","title":"Foliopress WYSIWYG <= 2.6.18 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1000c6db-800f-4f10-976b-5b946d5cc174?source=api-prod","affected":[{"type":"plugin","slug":"foliopress-wysiwyg","name":"Foliopress WYSIWYG","from":"*","from_inclusive":true,"to":"2.6.18","to_inclusive":true,"patched_in":"2.6.19"}],"published":"2025-04-09T00:00:00Z","updated":"2026-05-11T19:39:22Z"},{"id":"wordfence:10019db4-a408-4441-895b-2c8bfe3fc92e","source":"wordfence","cve":"CVE-2026-25438","title":"Gutenberg Blocks \u2013 Unlimited blocks For Gutenberg <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10019db4-a408-4441-895b-2c8bfe3fc92e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-blocks","name":"Unlimited Addons For Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-03-18T00:00:00Z","updated":"2026-07-08T20:47:09Z"},{"id":"wordfence:10021498-73c8-4767-b059-f282ddc35963","source":"wordfence","cve":"CVE-2023-39997","title":"Popup by Supsystic <= 1.10.19 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10021498-73c8-4767-b059-f282ddc35963?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.19","to_inclusive":true,"patched_in":"1.10.20"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10029296-1cb8-47dd-a0f0-833a906e72b5","source":"wordfence","cve":"CVE-2025-49906","title":"WPComplete <= 2.9.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10029296-1cb8-47dd-a0f0-833a906e72b5?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.3","to_inclusive":true,"patched_in":"2.9.5.4"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-29T15:36:36Z"},{"id":"wordfence:1005eb8c-da5a-4422-9d65-0f341ad755b2","source":"wordfence","cve":"CVE-2026-5710","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.6 - Unauthenticated Limited Arbitrary File Read via mfile Field","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1005eb8c-da5a-4422-9d65-0f341ad755b2?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.6","to_inclusive":true,"patched_in":"1.3.9.7"}],"published":"2026-04-17T04:37:14Z","updated":"2026-04-17T17:25:54Z"},{"id":"wordfence:10063035-5f91-4dbe-b559-ea5be50d6950","source":"wordfence","cve":"CVE-2026-103423","title":"Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10063035-5f91-4dbe-b559-ea5be50d6950?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2026-10-13T12:14:45Z","updated":"2026-10-29T18:30:55Z"},{"id":"wordfence:10073500-0fd6-48f1-a087-8615b4e68e6a","source":"wordfence","cve":"CVE-2026-112222","title":"Surfer \u2013 WordPress Plugin <= 1.8.0.744 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10073500-0fd6-48f1-a087-8615b4e68e6a?source=api-prod","affected":[{"type":"plugin","slug":"surferseo","name":"Surfer \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.8.0.744","to_inclusive":true,"patched_in":"1.8.1.759"}],"published":"2026-10-19T13:28:00Z","updated":"2026-10-23T18:34:16Z"},{"id":"wordfence:1009c839-849f-47ce-bfab-c297aacbc23c","source":"wordfence","cve":"CVE-2022-41619","title":"Image Zoom <= 1.8.8 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1009c839-849f-47ce-bfab-c297aacbc23c?source=api-prod","affected":[{"type":"plugin","slug":"image-zoom","name":"Image Zoom","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":""}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:100b6786-7cad-4d65-b457-9beb179e293a","source":"wordfence","cve":"CVE-2023-52122","title":"Simple Job Board <= 2.10.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/100b6786-7cad-4d65-b457-9beb179e293a?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:100b700f-8812-48be-8a04-28f60a57b35f","source":"wordfence","cve":"CVE-2023-38400","title":"Enfold <= 5.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/100b700f-8812-48be-8a04-28f60a57b35f?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:100c1022-c9ce-4c11-b9f3-761faca2ba7b","source":"wordfence","cve":"CVE-2026-90964","title":"Essential Real Estate <= 5.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/100c1022-c9ce-4c11-b9f3-761faca2ba7b?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:10:10Z"},{"id":"wordfence:100cc190-d274-45d2-804d-78390816e5f0","source":"wordfence","cve":"CVE-2025-32481","title":"Nino Social Connect <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/100cc190-d274-45d2-804d-78390816e5f0?source=api-prod","affected":[{"type":"plugin","slug":"nino-social-connect","name":"Nino Social Connect","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:48:52Z"},{"id":"wordfence:100f6ccd-02d3-4b9e-8dd4-957a518c2a55","source":"wordfence","cve":"CVE-2024-11928","title":"iChart \u2013 Easy Charts and Graphs <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/100f6ccd-02d3-4b9e-8dd4-957a518c2a55?source=api-prod","affected":[{"type":"plugin","slug":"ichart","name":"iChart \u2013 Easy Charts and Graphs","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-12-09T22:19:10Z","updated":"2024-12-10T11:09:15Z"},{"id":"wordfence:10101e3f-8c8a-4a62-bf41-809983a3b610","source":"wordfence","cve":"CVE-2024-35706","title":"Heateor Social Login WordPress <= 1.1.32 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10101e3f-8c8a-4a62-bf41-809983a3b610?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:35:09Z"},{"id":"wordfence:1012f06d-2306-44bc-9235-528c1632be16","source":"wordfence","cve":"CVE-2024-34421","title":"BlogLentor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1012f06d-2306-44bc-9235-528c1632be16?source=api-prod","affected":[{"type":"plugin","slug":"bloglentor-for-elementor","name":"BlogLentor \u2013 Blog Designer Pack for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-07-08T20:21:08Z"},{"id":"wordfence:101451de-1ed4-4717-86c5-a41feafd4c7e","source":"wordfence","cve":"CVE-2024-12710","title":"WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101451de-1ed4-4717-86c5-a41feafd4c7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-appbox","name":"WP-Appbox","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T04:22:46Z"},{"id":"wordfence:101675ae-88cf-42fc-b9ea-5dd37cdf7464","source":"wordfence","cve":"CVE-2025-13322","title":"WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101675ae-88cf-42fc-b9ea-5dd37cdf7464?source=api-prod","affected":[{"type":"plugin","slug":"wp-audio-gallery","name":"WP AUDIO GALLERY","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:19:12Z","updated":"2025-11-21T07:31:46Z"},{"id":"wordfence:1016f16c-0ab2-4cac-a7a5-8d93a37e7894","source":"wordfence","cve":"CVE-2024-1959","title":"Social Sharing Plugin \u2013 Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1016f16c-0ab2-4cac-a7a5-8d93a37e7894?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.4.6.1","to_inclusive":true,"patched_in":"4.4.6.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:45Z"},{"id":"wordfence:101945f6-d709-4c99-8c80-def9dd2fa636","source":"wordfence","cve":"CVE-2023-47242","title":"ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101945f6-d709-4c99-8c80-def9dd2fa636?source=api-prod","affected":[{"type":"plugin","slug":"avcp","name":"ANAC XML Bandi di Gara","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2023-11-07T00:00:00Z","updated":"2025-05-29T19:29:50Z"},{"id":"wordfence:101a3dfd-101e-4ae2-85d1-a6b3c9d6ca71","source":"wordfence","cve":"CVE-2022-1910","title":"Shortcodes and extra features for Phlox theme <= 2.9.7 - Reflected Cross-Site-Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101a3dfd-101e-4ae2-85d1-a6b3c9d6ca71?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":false,"patched_in":"2.9.8"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:101b5012-7f12-4b6d-b9c8-aafb0b9bf039","source":"wordfence","cve":"CVE-2025-62742","title":"Curator.io <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101b5012-7f12-4b6d-b9c8-aafb0b9bf039?source=api-prod","affected":[{"type":"plugin","slug":"curatorio","name":"Curator.io","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-27T21:51:21Z"},{"id":"wordfence:101dd211-c3eb-4d27-9194-841bc2a968e6","source":"wordfence","cve":"CVE-2023-41802","title":"Super Socializer <= 7.13.54 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101dd211-c3eb-4d27-9194-841bc2a968e6?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.54","to_inclusive":true,"patched_in":"7.13.55"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:101edd24-3f9e-4055-8547-9cd7e2b626b5","source":"wordfence","cve":"CVE-2017-18544","title":"Invite Anyone < 1.3.16 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101edd24-3f9e-4055-8547-9cd7e2b626b5?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"}],"published":"2017-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:101f8390-7fd1-427d-a62e-83c527adedec","source":"wordfence","cve":"","title":"DZS Video Gallery <= 8.60 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101f8390-7fd1-427d-a62e-83c527adedec?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"8.60","to_inclusive":true,"patched_in":""}],"published":"2016-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:101fd983-bf41-4d3f-81a3-ddc14c55dfea","source":"wordfence","cve":"CVE-2025-22670","title":"VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/101fd983-bf41-4d3f-81a3-ddc14c55dfea?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:08:03Z"},{"id":"wordfence:10207866-6615-486b-a60a-a522ed8a0285","source":"wordfence","cve":"CVE-2026-15306","title":"Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10207866-6615-486b-a60a-a522ed8a0285?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2026-07-15T15:12:36Z","updated":"2026-07-16T03:44:31Z"},{"id":"wordfence:102223a1-07f5-485b-a6af-49cf316d9797","source":"wordfence","cve":"CVE-2025-2005","title":"Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102223a1-07f5-485b-a6af-49cf316d9797?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.32","to_inclusive":true,"patched_in":"3.2.33"}],"published":"2025-04-01T20:37:06Z","updated":"2025-11-05T21:22:36Z"},{"id":"wordfence:1023edcb-9879-4dde-b62e-3ce65d7fef2f","source":"wordfence","cve":"CVE-2023-35917","title":"WooCommerce PayPal Payments <= 2.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1023edcb-9879-4dde-b62e-3ce65d7fef2f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-paypal-payments","name":"WooCommerce PayPal Payments","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10253537-1a54-471c-bf0d-e8523b0c6ae1","source":"wordfence","cve":"CVE-2025-30569","title":"WP Featured Entries <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10253537-1a54-471c-bf0d-e8523b0c6ae1?source=api-prod","affected":[{"type":"plugin","slug":"wp-featured-entries","name":"WP Featured Entries","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:52:30Z"},{"id":"wordfence:10262aa9-5656-4a2b-aeb5-060018798369","source":"wordfence","cve":"CVE-2026-1781","title":"MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10262aa9-5656-4a2b-aeb5-060018798369?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.11.1","to_inclusive":true,"patched_in":"4.12.0"}],"published":"2026-03-10T13:11:15Z","updated":"2026-03-11T01:22:03Z"},{"id":"wordfence:1026b753-e82b-4fa3-9023-c36ab9863b29","source":"wordfence","cve":"CVE-2024-1242","title":"Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1026b753-e82b-4fa3-9023-c36ab9863b29?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.18","to_inclusive":true,"patched_in":"4.10.19"}],"published":"2024-02-14T00:00:00Z","updated":"2024-05-31T15:30:06Z"},{"id":"wordfence:10293e5a-15ea-42c1-a0df-b95f723a75a3","source":"wordfence","cve":"CVE-2026-103425","title":"Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10293e5a-15ea-42c1-a0df-b95f723a75a3?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2026-10-13T12:14:52Z","updated":"2026-10-14T01:27:14Z"},{"id":"wordfence:10295de5-1dc5-46bd-84d9-bee7514bab7f","source":"wordfence","cve":"CVE-2026-108480","title":"Skydropx <= 2.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10295de5-1dc5-46bd-84d9-bee7514bab7f?source=api-prod","affected":[{"type":"plugin","slug":"skydropx","name":"Skydropx","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-10-12T17:41:30Z","updated":"2026-10-23T18:08:54Z"},{"id":"wordfence:102982a5-23c3-40e1-99c4-34b013ec7712","source":"wordfence","cve":"CVE-2025-27335","title":"Auto Tag Links <= 1.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102982a5-23c3-40e1-99c4-34b013ec7712?source=api-prod","affected":[{"type":"plugin","slug":"auto-tag-links","name":"Auto Tag Links","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:29:22Z"},{"id":"wordfence:102a90a7-da55-44df-9d3f-111637bf131e","source":"wordfence","cve":"CVE-2025-49266","title":"Ultimate Reviews <= 3.2.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102a90a7-da55-44df-9d3f-111637bf131e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-reviews","name":"Ultimate Reviews","from":"*","from_inclusive":true,"to":"3.2.14","to_inclusive":true,"patched_in":"3.2.15"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T15:15:13Z"},{"id":"wordfence:102ab838-9011-4da6-bc24-179be1328bcc","source":"wordfence","cve":"CVE-2015-2216","title":"PhotoCrati Theme <= 4.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102ab838-9011-4da6-bc24-179be1328bcc?source=api-prod","affected":[{"type":"theme","slug":"photocrati-theme","name":"Photocrati","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2011-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:102bab51-2dc7-4013-8273-21e2ff6cdf79","source":"wordfence","cve":"CVE-2023-5509","title":"myStickymenu <= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Lead Deletion","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102bab51-2dc7-4013-8273-21e2ff6cdf79?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:102e17f3-2c56-48c0-b8f5-992a69abfacc","source":"wordfence","cve":"CVE-2024-43989","title":"Justified Image Grid <= 4.6.1 - Unauthenticated Server-Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102e17f3-2c56-48c0-b8f5-992a69abfacc?source=api-prod","affected":[{"type":"plugin","slug":"justified-image-grid","name":"Justified Image Grid - Premium WordPress Gallery","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-08-29T00:00:00Z","updated":"2025-02-24T13:57:08Z"},{"id":"wordfence:102e32d5-5ccc-43f8-adef-f0e2b145bf53","source":"wordfence","cve":"CVE-2025-68038","title":"Icegram Express Pro <= 5.9.13 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102e32d5-5ccc-43f8-adef-f0e2b145bf53?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers-premium","name":"Icegram Express Pro","from":"*","from_inclusive":true,"to":"5.9.14","to_inclusive":false,"patched_in":"5.9.14"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-24T22:24:39Z"},{"id":"wordfence:102ed3c9-33ed-462a-83df-5a57f2621780","source":"wordfence","cve":"CVE-2012-0896","title":"Count per Day <= 3.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/102ed3c9-33ed-462a-83df-5a57f2621780?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2012-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1032227b-f2bc-4fc5-bc8d-91a84c631680","source":"wordfence","cve":"CVE-2014-4527","title":"EnvialoSimple: Email Marketing y Newsletters < 1.98 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1032227b-f2bc-4fc5-bc8d-91a84c631680?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"1.97","to_inclusive":true,"patched_in":"1.98"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1032f7b0-db98-4b25-bdff-dcaf2758f266","source":"wordfence","cve":"CVE-2020-6850","title":"SAML Single Sign On \u2013 SAML SSO Login <= 4.8.83 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1032f7b0-db98-4b25-bdff-dcaf2758f266?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"4.8.83","to_inclusive":true,"patched_in":"4.8.84"}],"published":"2020-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10339a77-7c1a-4030-9061-15c699545b16","source":"wordfence","cve":"CVE-2024-22159","title":"WOLF <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via profile_title","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10339a77-7c1a-4030-9061-15c699545b16?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.8.1"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1034c063-0898-4acf-bb55-69e78667a592","source":"wordfence","cve":"CVE-2026-95590","title":"Tainacan <= 1.2.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1034c063-0898-4acf-bb55-69e78667a592?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-09-23T12:54:16Z","updated":"2026-09-29T20:08:55Z"},{"id":"wordfence:1034f0f4-52e4-4f4c-81fc-51b4720f306a","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_script_save","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1034f0f4-52e4-4f4c-81fc-51b4720f306a?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1036a34d-ec03-4bec-8455-02c83fdb8b36","source":"wordfence","cve":"CVE-2025-5588","title":"Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1036a34d-ec03-4bec-8455-02c83fdb8b36?source=api-prod","affected":[{"type":"plugin","slug":"image-editor-by-pixo","name":"Image Editor by Pixo","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-06-25T13:44:00Z","updated":"2025-06-26T01:44:38Z"},{"id":"wordfence:103a3e6e-8891-4a6f-a949-f8a5e19df8bf","source":"wordfence","cve":"CVE-2025-60135","title":"WeShare Buttons <= 13.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103a3e6e-8891-4a6f-a949-f8a5e19df8bf?source=api-prod","affected":[{"type":"plugin","slug":"e-mailit","name":"WeShareAI \u2013 AI-Powered Share Buttons (formerly E-MAILiT)","from":"*","from_inclusive":true,"to":"13.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:16:34Z"},{"id":"wordfence:103a7e7b-74bb-4691-8670-c66ed2144596","source":"wordfence","cve":"CVE-2023-0631","title":"Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes","severity":"high","cvss":7.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103a7e7b-74bb-4691-8670-c66ed2144596?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:103b7db9-1571-4fce-852f-68d5df7ee4ba","source":"wordfence","cve":"CVE-2021-24197","title":"wpDataTables (Premium) <= 3.4.1 - Improper Access Control leading to Table Permission Takeover","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103b7db9-1571-4fce-852f-68d5df7ee4ba?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:103c39ca-b5fa-43da-91d9-29357e54e432","source":"wordfence","cve":"CVE-2026-112243","title":"Duplicator < 5.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103c39ca-b5fa-43da-91d9-29357e54e432?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T15:27:56Z"},{"id":"wordfence:103cbd07-4698-4b64-820d-d2df3fce95da","source":"wordfence","cve":"","title":"Age Gate <= 2.16.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103cbd07-4698-4b64-820d-d2df3fce95da?source=api-prod","affected":[{"type":"plugin","slug":"age-gate","name":"Age Gate","from":"*","from_inclusive":true,"to":"2.16.4","to_inclusive":false,"patched_in":"2.16.4"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:103ce24e-1c21-4c25-b3d0-6f595bf58979","source":"wordfence","cve":"CVE-2016-4827","title":"Welcart e-Commerce <= 1.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103ce24e-1c21-4c25-b3d0-6f595bf58979?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2016-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:103db583-9399-4a45-a316-808b55fc6a6c","source":"wordfence","cve":"CVE-2024-5207","title":"POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103db583-9399-4a45-a316-808b55fc6a6c?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2024-05-22T00:00:00Z","updated":"2024-07-29T21:35:53Z"},{"id":"wordfence:103dea33-0c30-460e-80e4-fead18928a62","source":"wordfence","cve":"CVE-2024-4896","title":"WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103dea33-0c30-460e-80e4-fead18928a62?source=api-prod","affected":[{"type":"plugin","slug":"wpb-elementor-addons","name":"WPB Addons for Elementor \u2013 News Ticker, Timeline, Team & More Widgets","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-05-21T20:15:32Z","updated":"2024-05-22T08:31:22Z"},{"id":"wordfence:103e7658-78d6-414d-ad68-e9adf77f1c60","source":"wordfence","cve":"CVE-2024-49263","title":"My Favorites <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/103e7658-78d6-414d-ad68-e9adf77f1c60?source=api-prod","affected":[{"type":"plugin","slug":"my-favorites","name":"My Favorites","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-21T15:41:49Z"},{"id":"wordfence:10409673-43dc-4c05-a996-120d753ebd6d","source":"wordfence","cve":"CVE-2024-10665","title":"Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10409673-43dc-4c05-a996-120d753ebd6d?source=api-prod","affected":[{"type":"plugin","slug":"yaad-sarig-payment-gateway-for-wc","name":"Yaad Sarig Payment Gateway For WC","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-11-19T21:04:13Z","updated":"2024-11-27T13:49:51Z"},{"id":"wordfence:104b3c01-4623-43cb-aed4-16e3be62e1f9","source":"wordfence","cve":"CVE-2024-0383","title":"WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/104b3c01-4623-43cb-aed4-16e3be62e1f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-29T21:35:54Z"},{"id":"wordfence:104badec-6e6e-44bb-936b-d135dd80890d","source":"wordfence","cve":"CVE-2024-28000","title":"LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/104badec-6e6e-44bb-936b-d135dd80890d?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.3.0.1","to_inclusive":true,"patched_in":"6.4"}],"published":"2024-08-21T00:00:00Z","updated":"2025-04-24T17:58:27Z"},{"id":"wordfence:1053bded-5594-462d-9637-ca1a25173bdd","source":"wordfence","cve":"CVE-2026-110880","title":"Kit (formerly ConvertKit) \u2013 Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1053bded-5594-462d-9637-ca1a25173bdd?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-10-16T10:41:25Z","updated":"2026-10-23T18:21:58Z"},{"id":"wordfence:1053ff60-469f-4940-a865-35ed28fc769a","source":"wordfence","cve":"","title":"Easy Coming Soon <= 1.6.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1053ff60-469f-4940-a865-35ed28fc769a?source=api-prod","affected":[{"type":"plugin","slug":"easy-coming-soon","name":"Easy Coming Soon","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2015-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10543a3b-e1ac-4c6b-b511-4cbd45924f6f","source":"wordfence","cve":"CVE-2026-65462","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10543a3b-e1ac-4c6b-b511-4cbd45924f6f?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:53:51Z"},{"id":"wordfence:10546cbe-17ba-481a-b464-18d83fab8b32","source":"wordfence","cve":"CVE-2026-15214","title":"Subscriptions for WooCommerce <= 2.0.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Detail Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10546cbe-17ba-481a-b464-18d83fab8b32?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:34:49Z"},{"id":"wordfence:10552714-c8fb-455c-ad61-c0ef2db4b69f","source":"wordfence","cve":"CVE-2026-9662","title":"Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10552714-c8fb-455c-ad61-c0ef2db4b69f?source=api-prod","affected":[{"type":"plugin","slug":"recoverexit-for-woocommerce","name":"Recover Exit For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:06:35Z","updated":"2026-06-09T03:41:18Z"},{"id":"wordfence:1055bba0-7dbd-4382-afaf-ecea442c527c","source":"wordfence","cve":"CVE-2026-8443","title":"WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1055bba0-7dbd-4382-afaf-ecea442c527c?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.6.8","to_inclusive":true,"patched_in":"12.7.0"}],"published":"2026-06-15T17:04:29Z","updated":"2026-06-16T05:33:33Z"},{"id":"wordfence:1056804b-c317-4b9f-85ce-41b4ed0ac40a","source":"wordfence","cve":"CVE-2023-0270","title":"YaMaps <= 0.6.25 - Authenticaterd (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1056804b-c317-4b9f-85ce-41b4ed0ac40a?source=api-prod","affected":[{"type":"plugin","slug":"yamaps","name":"YaMaps for WordPress Plugin","from":"*","from_inclusive":true,"to":"0.6.25","to_inclusive":true,"patched_in":"0.6.26"}],"published":"2023-01-17T00:00:00Z","updated":"2024-10-23T08:37:13Z"},{"id":"wordfence:105783a4-d572-4378-8fdb-e9bbfeb17592","source":"wordfence","cve":"CVE-2026-49108","title":"Moderno < 1.43 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/105783a4-d572-4378-8fdb-e9bbfeb17592?source=api-prod","affected":[{"type":"theme","slug":"moderno","name":"Moderno \u2013 Fashion & Clothing, Furniture","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":false,"patched_in":"1.43"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:40:20Z"},{"id":"wordfence:1057b1ee-9bcb-4b3b-bbc0-3262e658bb97","source":"wordfence","cve":"CVE-2026-3830","title":"Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1057b1ee-9bcb-4b3b-bbc0-3262e658bb97?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:53:01Z"},{"id":"wordfence:1058078b-3afa-4fe7-913a-b6fc32252bf6","source":"wordfence","cve":"CVE-2025-4666","title":"ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1058078b-3afa-4fe7-913a-b6fc32252bf6?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.15","to_inclusive":true,"patched_in":"7.4"}],"published":"2025-06-10T14:40:35Z","updated":"2025-11-05T19:35:40Z"},{"id":"wordfence:10590944-e08e-4980-846d-7a88880b2dcd","source":"wordfence","cve":"CVE-2023-45830","title":"Accessibility Suite by Online ADA <= 4.12 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10590944-e08e-4980-846d-7a88880b2dcd?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.12","to_inclusive":true,"patched_in":"4.13"}],"published":"2023-10-13T00:00:00Z","updated":"2024-10-24T18:37:24Z"},{"id":"wordfence:105ae6be-2cb7-4ab2-8e4c-5d3ff84c5b9f","source":"wordfence","cve":"CVE-2024-30501","title":"Download Monitor <= 4.9.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/105ae6be-2cb7-4ab2-8e4c-5d3ff84c5b9f?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":false,"patched_in":"4.9.5"}],"published":"2024-01-08T00:00:00Z","updated":"2024-04-04T00:55:34Z"},{"id":"wordfence:105dcbbb-9ee2-4a5a-9b65-bbac931d1080","source":"wordfence","cve":"CVE-2022-47160","title":"Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":6.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/105dcbbb-9ee2-4a5a-9b65-bbac931d1080?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2022-12-14T00:00:00Z","updated":"2024-10-24T18:37:46Z"},{"id":"wordfence:105f501c-741d-4352-b080-e6730d0a7200","source":"wordfence","cve":"CVE-2025-58977","title":"WP eBay Product Feeds <= 3.4.8 - Authenticated (Contributor+) Server Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/105f501c-741d-4352-b080-e6730d0a7200?source=api-prod","affected":[{"type":"plugin","slug":"ebay-feeds-for-wordpress","name":"WP eBay Product Feeds","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:11:53Z"},{"id":"wordfence:1063ce43-ca4f-41c0-b094-0d07dbd3bdd0","source":"wordfence","cve":"CVE-2025-68028","title":"GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1063ce43-ca4f-41c0-b094-0d07dbd3bdd0?source=api-prod","affected":[{"type":"plugin","slug":"ga-for-wp","name":"TrueAna \u2013 True Analytics Dashboard","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-02-05T00:00:00Z","updated":"2026-07-31T12:15:41Z"},{"id":"wordfence:1063ecb4-a0a0-47d9-8629-f4f6a29bf5c9","source":"wordfence","cve":"CVE-2023-24004","title":"Image and Video Lightbox, Image Popup <= 2.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1063ecb4-a0a0-47d9-8629-f4f6a29bf5c9?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-popup","name":"Image and Video Lightbox, Image PopUp","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:106451c1-e0e7-4318-ac27-e17943874a8f","source":"wordfence","cve":"CVE-2025-23597","title":"Rio Photo Gallery <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/106451c1-e0e7-4318-ac27-e17943874a8f?source=api-prod","affected":[{"type":"plugin","slug":"rio-photo-gallery","name":"Rio Photo Gallery","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:13:42Z"},{"id":"wordfence:1067cc82-3595-4228-a7a2-5b3be7677b1f","source":"wordfence","cve":"CVE-2025-9203","title":"Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1067cc82-3595-4228-a7a2-5b3be7677b1f?source=api-prod","affected":[{"type":"plugin","slug":"media-player-addons-for-elementor","name":"Media Player Addons for Elementor \u2013 Audio and Video Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-09-16T17:45:37Z","updated":"2025-09-17T06:17:50Z"},{"id":"wordfence:10685fdc-fe13-44a4-9058-57b57905a24d","source":"wordfence","cve":"CVE-2024-51689","title":"CF7 WOW Styler <= 1.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10685fdc-fe13-44a4-9058-57b57905a24d?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-20T21:16:31Z"},{"id":"wordfence:1069434a-b8cb-4e29-995d-f31b18d1843f","source":"wordfence","cve":"CVE-2012-3814","title":"Font Uploader <= 1.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1069434a-b8cb-4e29-995d-f31b18d1843f?source=api-prod","affected":[{"type":"plugin","slug":"font-uploader","name":"WordPress Font Uploader","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1069c845-30b9-4aca-8a60-8b66c48365af","source":"wordfence","cve":"CVE-2024-6548","title":"Add Admin JavaScript <= 2.0 - Unauthenticated Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1069c845-30b9-4aca-8a60-8b66c48365af?source=api-prod","affected":[{"type":"plugin","slug":"add-admin-javascript","name":"Add Admin JavaScript","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:03:40Z","updated":"2024-07-27T01:51:03Z"},{"id":"wordfence:106a604f-0bff-444e-9d76-f6508bcc0cea","source":"wordfence","cve":"CVE-2023-38387","title":"Elastic Email Sender <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/106a604f-0bff-444e-9d76-f6508bcc0cea?source=api-prod","affected":[{"type":"plugin","slug":"elastic-email-sender","name":"Elastic Email Sender","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:106b31ed-d509-4551-a134-02193ab22fe1","source":"wordfence","cve":"CVE-2025-14615","title":"DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/106b31ed-d509-4551-a134-02193ab22fe1?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-builder","name":"DASHBOARD BUILDER \u2013 WordPress plugin for Charts and Graphs","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:22:32Z","updated":"2026-01-14T05:28:03Z"},{"id":"wordfence:106fd83b-2ab0-4fcf-8c73-ba18ba9dbe56","source":"wordfence","cve":"CVE-2026-65446","title":"Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/106fd83b-2ab0-4fcf-8c73-ba18ba9dbe56?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:24:04Z"},{"id":"wordfence:107031b3-5071-490a-a8f7-060212b1724c","source":"wordfence","cve":"CVE-2025-11894","title":"Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107031b3-5071-490a-a8f7-060212b1724c?source=api-prod","affected":[{"type":"plugin","slug":"shelf-planner","name":"Shelf Planner Inventory Management for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-11-10T15:15:22Z","updated":"2025-12-12T16:57:34Z"},{"id":"wordfence:10704eeb-728c-43fc-9d58-36438480c8df","source":"wordfence","cve":"CVE-2026-77788","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) Arbitrary Post/User Meta Overwrite","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10704eeb-728c-43fc-9d58-36438480c8df?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:22:32Z"},{"id":"wordfence:1071a052-4c76-45cb-acf5-c7ae90acfc63","source":"wordfence","cve":"CVE-2026-28102","title":"UberSlider Classic <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1071a052-4c76-45cb-acf5-c7ae90acfc63?source=api-prod","affected":[{"type":"plugin","slug":"uberSlider_classic","name":"uberSlider_classic","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:10:33Z"},{"id":"wordfence:10724b12-fbe4-4da1-b3f5-157b2702996d","source":"wordfence","cve":"CVE-2025-58841","title":"Media Author <= 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10724b12-fbe4-4da1-b3f5-157b2702996d?source=api-prod","affected":[{"type":"plugin","slug":"media-author","name":"Media Author","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T19:38:51Z"},{"id":"wordfence:1072ad88-5760-4f2a-82b3-d515d6f73e52","source":"wordfence","cve":"CVE-2022-2268","title":"WP All Import <= 3.6.7 - Admin+ Arbitrary File Upload","severity":"medium","cvss":4.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1072ad88-5760-4f2a-82b3-d515d6f73e52?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2022-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10735038-69dd-4b74-9374-38379832cdcb","source":"wordfence","cve":"CVE-2025-15524","title":"Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10735038-69dd-4b74-9374-38379832cdcb?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2026-02-10T12:28:05Z","updated":"2026-02-11T01:23:33Z"},{"id":"wordfence:1074115c-31eb-4276-915b-7fc8b17239d7","source":"wordfence","cve":"CVE-2025-23574","title":"CubePM <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1074115c-31eb-4276-915b-7fc8b17239d7?source=api-prod","affected":[{"type":"plugin","slug":"cubepm","name":"CubePM","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:42:00Z"},{"id":"wordfence:107548a1-3b5b-4838-815b-32b86e1b7ff5","source":"wordfence","cve":"CVE-2024-7382","title":"Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107548a1-3b5b-4838-815b-32b86e1b7ff5?source=api-prod","affected":[{"type":"plugin","slug":"linkify-text","name":"Linkify Text","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-08T20:36:19Z","updated":"2024-08-09T09:30:10Z"},{"id":"wordfence:10786490-9032-41c2-9353-aacf9ea3e229","source":"wordfence","cve":"CVE-2025-30579","title":"Pesapal Gateway for Woocommerce <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10786490-9032-41c2-9353-aacf9ea3e229?source=api-prod","affected":[{"type":"plugin","slug":"pesapal-for-woocommerce","name":"Pesapal Gateway for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:13:03Z"},{"id":"wordfence:107918e4-fb21-40df-818d-a71b78b26928","source":"wordfence","cve":"CVE-2022-4301","title":"Sunshine Photo Cart <= 2.9.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107918e4-fb21-40df-818d-a71b78b26928?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.9.14","to_inclusive":true,"patched_in":"2.9.15"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1079282d-3183-4190-8a54-d6085d27935a","source":"wordfence","cve":"CVE-2024-38675","title":"Arkhe Blocks <= 2.22.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1079282d-3183-4190-8a54-d6085d27935a?source=api-prod","affected":[{"type":"plugin","slug":"arkhe-blocks","name":"Arkhe Blocks","from":"*","from_inclusive":true,"to":"2.22.1","to_inclusive":true,"patched_in":"2.23.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-22T17:37:35Z"},{"id":"wordfence:1079b96d-0435-42f1-b5b2-d36e674c0c9c","source":"wordfence","cve":"CVE-2026-39471","title":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF <= 6.4.3 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1079b96d-0435-42f1-b5b2-d36e674c0c9c?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:59:54Z"},{"id":"wordfence:107a0612-5e58-428b-a097-1c4012e89449","source":"wordfence","cve":"CVE-2024-48035","title":"ACF Images Search And Insert <= 1.1.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107a0612-5e58-428b-a097-1c4012e89449?source=api-prod","affected":[{"type":"plugin","slug":"acf-images-search-and-insert","name":"ACF Images Search And Insert","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:39:16Z"},{"id":"wordfence:107afaa6-6c0b-43fb-9713-ebc4f1189ea6","source":"wordfence","cve":"CVE-2024-5726","title":"Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107afaa6-6c0b-43fb-9713-ebc4f1189ea6?source=api-prod","affected":[{"type":"plugin","slug":"timeline-event-history","name":"Timeline Event History","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-07-17T14:02:39Z","updated":"2024-08-30T23:43:17Z"},{"id":"wordfence:107c82fa-fcb1-40df-9c53-bc8f23810f2a","source":"wordfence","cve":"CVE-2024-32125","title":"BA Book Everything <= 1.6.4 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107c82fa-fcb1-40df-9c53-bc8f23810f2a?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:47:14Z"},{"id":"wordfence:107cb15f-4b2e-4ed4-8e8a-4f716f4873db","source":"wordfence","cve":"CVE-2026-4301","title":"Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107cb15f-4b2e-4ed4-8e8a-4f716f4873db?source=api-prod","affected":[{"type":"plugin","slug":"rate-star-review","name":"Rate Star Review Vote \u2013 AJAX Reviews, Votes, Star Ratings","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-05-11T19:07:44Z","updated":"2026-05-14T18:53:34Z"},{"id":"wordfence:107f19b5-b67d-4242-b312-531c31b9a73c","source":"wordfence","cve":"CVE-2026-18442","title":"WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/107f19b5-b67d-4242-b312-531c31b9a73c?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-09-17T18:48:44Z","updated":"2026-09-18T07:39:59Z"},{"id":"wordfence:1080810b-ec9a-44fb-b4da-49b28646a441","source":"wordfence","cve":"CVE-2024-6000","title":"FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload","severity":"high","cvss":7.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=api-prod","affected":[{"type":"plugin","slug":"fooevents","name":"FooEvents for WooCommerce","from":"*","from_inclusive":true,"to":"1.19.20","to_inclusive":true,"patched_in":"1.19.21"}],"published":"2024-06-14T00:00:00Z","updated":"2024-06-15T03:27:40Z"},{"id":"wordfence:10818590-6412-458f-a473-b24dc0b293dd","source":"wordfence","cve":"CVE-2021-24617","title":"GamePress \u2013 The Game Database Plugin <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10818590-6412-458f-a473-b24dc0b293dd?source=api-prod","affected":[{"type":"plugin","slug":"gamepress","name":"GamePress \u2013 The Game Database Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1081eeb1-3240-478d-8679-7bf9293b5a95","source":"wordfence","cve":"CVE-2020-36157","title":"Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles","severity":"critical","cvss":10.0,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1081eeb1-3240-478d-8679-7bf9293b5a95?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":false,"patched_in":"2.1.12"}],"published":"2020-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1082c8a8-d9a2-4706-9e8a-d665f856b100","source":"wordfence","cve":"CVE-2026-62003","title":"Mission <= 1.22 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1082c8a8-d9a2-4706-9e8a-d665f856b100?source=api-prod","affected":[{"type":"theme","slug":"mission","name":"Mission","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:32Z"},{"id":"wordfence:10864109-8155-414e-be96-58e4dc2401b1","source":"wordfence","cve":"CVE-2026-18317","title":"Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10864109-8155-414e-be96-58e4dc2401b1?source=api-prod","affected":[{"type":"plugin","slug":"foxtool","name":"Foxtool All-in-One: Contact chat button, Custom login, Media optimize images","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-09-17T18:33:38Z","updated":"2026-09-18T06:38:52Z"},{"id":"wordfence:1087f744-44c2-4fa1-92d9-872a5bfd571d","source":"wordfence","cve":"CVE-2021-42546","title":"Use-Your-Drive < 1.18.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1087f744-44c2-4fa1-92d9-872a5bfd571d?source=api-prod","affected":[{"type":"plugin","slug":"use-your-drive","name":"Use-your-Drive | Google Drive plugin for WordPress","from":"*","from_inclusive":true,"to":"1.18.3","to_inclusive":false,"patched_in":"1.18.3"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1088098e-ae44-469f-8dc8-c6221c8ee5fd","source":"wordfence","cve":"CVE-2025-31622","title":"Advanced Typekit <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1088098e-ae44-469f-8dc8-c6221c8ee5fd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-typekit","name":"Advanced Typekit","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T18:38:59Z"},{"id":"wordfence:1088f498-e718-41bc-866e-7027352a2a5b","source":"wordfence","cve":"CVE-2023-6501","title":"Splashscreen <= 0.20 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1088f498-e718-41bc-866e-7027352a2a5b?source=api-prod","affected":[{"type":"plugin","slug":"splashscreen","name":"Splashscreen","from":"*","from_inclusive":true,"to":"0.20","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1089ab17-b780-4840-8dcd-c50258513634","source":"wordfence","cve":"CVE-2024-0893","title":"Schema App Structured Data <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1089ab17-b780-4840-8dcd-c50258513634?source=api-prod","affected":[{"type":"plugin","slug":"schema-app-structured-data-for-schemaorg","name":"Schema App Structured Data","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-05-23T18:14:16Z","updated":"2024-07-03T15:36:10Z"},{"id":"wordfence:108a2ea3-a612-46a2-b29a-7ae794f8470c","source":"wordfence","cve":"CVE-2015-9358","title":"FeedWordPress < 2015.0514 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/108a2ea3-a612-46a2-b29a-7ae794f8470c?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2015.0514","to_inclusive":false,"patched_in":"2015.0514"}],"published":"2015-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:108cd0dd-f5c9-4ca8-989e-0ae5384ff6c1","source":"wordfence","cve":"CVE-2025-31841","title":"FPW Category Thumbnails <= 1.9.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/108cd0dd-f5c9-4ca8-989e-0ae5384ff6c1?source=api-prod","affected":[{"type":"plugin","slug":"fpw-category-thumbnails","name":"FPW Category Thumbnails","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2026-02-15T16:13:33Z"},{"id":"wordfence:108e9578-e586-4ed8-b0b2-dc6c26bf530e","source":"wordfence","cve":"CVE-2022-4486","title":"Meteor Slides <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/108e9578-e586-4ed8-b0b2-dc6c26bf530e?source=api-prod","affected":[{"type":"plugin","slug":"meteor-slides","name":"Meteor Slides","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:108f3e7b-f4c1-445c-914c-97960b21b5fa","source":"wordfence","cve":"CVE-2022-4714","title":"WP Dark Mode <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/108f3e7b-f4c1-445c-914c-97960b21b5fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:108fc77a-b260-4bbf-a551-7593bbecc6e0","source":"wordfence","cve":"CVE-2025-63039","title":"ListingPro <= 2.9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/108fc77a-b260-4bbf-a551-7593bbecc6e0?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-19T16:59:17Z"},{"id":"wordfence:1090acfc-5b0c-478a-ac71-db54fdaefdf5","source":"wordfence","cve":"CVE-2024-4788","title":"Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=api-prod","affected":[{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-06-05T12:57:19Z","updated":"2024-07-03T14:55:00Z"},{"id":"wordfence:1091862b-784b-496f-a951-6784544cb51b","source":"wordfence","cve":"CVE-2022-45374","title":"YARPP <= 5.30.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1091862b-784b-496f-a951-6784544cb51b?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.4","to_inclusive":true,"patched_in":"5.30.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10929cb2-9e91-4253-a1c2-337e5ff5174e","source":"wordfence","cve":"CVE-2026-121858","title":"Event Tickets with Ticket Scanner <= 3.2.8 - Authenticated (Custom+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10929cb2-9e91-4253-a1c2-337e5ff5174e?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:13:17Z"},{"id":"wordfence:109317dc-630a-4670-8871-85b3dcc1d006","source":"wordfence","cve":"CVE-2025-31812","title":"BuddyPress Members Only <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/109317dc-630a-4670-8871-85b3dcc1d006?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-members-only","name":"BuddyPress Members Only","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-11-10T15:31:24Z"},{"id":"wordfence:10933105-50d7-407a-b123-10b5f00ba688","source":"wordfence","cve":"CVE-2024-50469","title":"Textboxes <= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10933105-50d7-407a-b123-10b5f00ba688?source=api-prod","affected":[{"type":"plugin","slug":"textboxes","name":"Textboxes","from":"*","from_inclusive":true,"to":"0.1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:49:38Z"},{"id":"wordfence:109427de-3b8a-46cc-a888-6fea4f72a31a","source":"wordfence","cve":"CVE-2022-2556","title":"Mailchimp for WooCommerce <= 2.7.1 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":4.9,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/109427de-3b8a-46cc-a888-6fea4f72a31a?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2022-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10945855-675a-4a85-8bb2-84bc40c1b826","source":"wordfence","cve":"CVE-2025-4968","title":"WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.5"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-24T03:39:05Z"},{"id":"wordfence:1096177a-a816-4ce6-9dec-4232b1e121e7","source":"wordfence","cve":"CVE-2025-23614","title":"WordPress Additional Logins <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1096177a-a816-4ce6-9dec-4232b1e121e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-additional-logins","name":"WordPress Additional Logins","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:51:19Z"},{"id":"wordfence:109a99ca-1173-4367-b8a7-c3d8cffcfcaf","source":"wordfence","cve":"CVE-2024-6843","title":"Chatbot with ChatGPT <= 2.4.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/109a99ca-1173-4367-b8a7-c3d8cffcfcaf?source=api-prod","affected":[{"type":"plugin","slug":"smartsearchwp","name":"AI Chatbot & Semantic Search: ChatGPT Answers From Your Content","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-01T20:07:15Z"},{"id":"wordfence:109b4947-f690-4158-9e6a-00f2005a6938","source":"wordfence","cve":"CVE-2017-20066","title":"Adminer <= 1.4.5 - Security Bypass to Database Login","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/109b4947-f690-4158-9e6a-00f2005a6938?source=api-prod","affected":[{"type":"plugin","slug":"adminer","name":"adminer","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10a0abd6-1905-4a90-8488-29d44df7aeb9","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 6.97 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a0abd6-1905-4a90-8488-29d44df7aeb9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":false,"patched_in":"7.0"}],"published":"2019-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10a13871-c98e-4785-ab41-18e548e07c05","source":"wordfence","cve":"CVE-2026-120515","title":"SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a13871-c98e-4785-ab41-18e548e07c05?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":"10.4"}],"published":"2026-11-06T18:32:02Z","updated":"2026-11-07T06:39:35Z"},{"id":"wordfence:10a2905b-c0c5-4504-a7b8-9284cf059679","source":"wordfence","cve":"CVE-2026-88791","title":"Safe Redirect Manager <= 2.2.0 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a2905b-c0c5-4504-a7b8-9284cf059679?source=api-prod","affected":[{"type":"plugin","slug":"safe-redirect-manager","name":"Safe Redirect Manager","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:26:16Z"},{"id":"wordfence:10a33af0-d68e-479b-9c08-4abeeb62f5a9","source":"wordfence","cve":"CVE-2026-39752","title":"Job Postings <= 2.8.2 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a33af0-d68e-479b-9c08-4abeeb62f5a9?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:10:53Z"},{"id":"wordfence:10a36e37-4188-403f-9b17-d7e79b8b8a6d","source":"wordfence","cve":"CVE-2022-2434","title":"String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a36e37-4188-403f-9b17-d7e79b8b8a6d?source=api-prod","affected":[{"type":"plugin","slug":"string-locator","name":"String locator","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10a54a3b-db6d-45c5-9280-7042ccc17ccd","source":"wordfence","cve":"","title":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters < 8.1 - Multiple Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a54a3b-db6d-45c5-9280-7042ccc17ccd?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":false,"patched_in":"8.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10a6f9cb-5adf-44b0-b7d1-f245637e00b3","source":"wordfence","cve":"CVE-2026-32422","title":"EasyCart <= 5.8.13 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a6f9cb-5adf-44b0-b7d1-f245637e00b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"5.8.14"}],"published":"2026-02-27T00:00:00Z","updated":"2026-04-15T21:01:56Z"},{"id":"wordfence:10a811f3-0c5b-4e06-a9bb-338d36d0b5eb","source":"wordfence","cve":"CVE-2016-5835","title":"WordPress Core < 4.5.3 - Revision History Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10a811f3-0c5b-4e06-a9bb-338d36d0b5eb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10aa1dd7-f909-4ebe-b29b-2f2743b3e08a","source":"wordfence","cve":"CVE-2024-0602","title":"Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10aa1dd7-f909-4ebe-b29b-2f2743b3e08a?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.9","to_inclusive":true,"patched_in":"5.30.10"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-29T21:35:54Z"},{"id":"wordfence:10aaf8de-677d-466e-8736-bf1c5ca17495","source":"wordfence","cve":"CVE-2025-27265","title":"Google Maps for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10aaf8de-677d-466e-8736-bf1c5ca17495?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-for-wordpress","name":"Google Maps for WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:09:08Z"},{"id":"wordfence:10ab67ed-2660-4c4d-8aeb-688b5fec1c1e","source":"wordfence","cve":"CVE-2025-26548","title":"Random Image Selector <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ab67ed-2660-4c4d-8aeb-688b5fec1c1e?source=api-prod","affected":[{"type":"plugin","slug":"random-image-selector","name":"Random Image Selector","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:38:29Z"},{"id":"wordfence:10ac9e80-7aa9-4cc5-ad37-f15f8d12ed16","source":"wordfence","cve":"CVE-2017-18591","title":"GD Rating System < 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ac9e80-7aa9-4cc5-ad37-f15f8d12ed16?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2017-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10b08a05-3561-4d05-985b-6a2339a547a7","source":"wordfence","cve":"CVE-2024-4971","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b08a05-3561-4d05-985b-6a2339a547a7?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.6","to_inclusive":true,"patched_in":"4.2.6.7"}],"published":"2024-05-21T16:40:45Z","updated":"2024-05-22T05:32:50Z"},{"id":"wordfence:10b3256b-5271-44b8-ab4d-05156d4f674b","source":"wordfence","cve":"CVE-2024-10879","title":"ForumWP \u2013 Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b3256b-5271-44b8-ab4d-05156d4f674b?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-12-05T19:50:45Z","updated":"2024-12-12T14:18:13Z"},{"id":"wordfence:10b46c11-1b34-4da4-a24d-103c663ca315","source":"wordfence","cve":"CVE-2022-45836","title":"Download Manager <= 3.2.59 - Refleced Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b46c11-1b34-4da4-a24d-103c663ca315?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.59","to_inclusive":true,"patched_in":"3.2.60"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10b47054-29cc-4859-bdfc-4dde1437c037","source":"wordfence","cve":"CVE-2024-4934","title":"Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker <= 9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b47054-29cc-4859-bdfc-4dde1437c037?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":true,"patched_in":"9.0.2"}],"published":"2024-06-10T00:00:00Z","updated":"2024-07-02T13:08:27Z"},{"id":"wordfence:10b7a88f-ce46-42aa-ab5a-81f38288a659","source":"wordfence","cve":"CVE-2021-4340","title":"uListing <= 1.6.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b7a88f-ce46-42aa-ab5a-81f38288a659?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10b9d703-de9d-472a-bdfb-bc9a41bf375e","source":"wordfence","cve":"CVE-2025-2109","title":"WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10b9d703-de9d-472a-bdfb-bc9a41bf375e?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.30.15","to_inclusive":true,"patched_in":"6.30.16"}],"published":"2025-03-24T21:29:56Z","updated":"2025-03-25T11:12:31Z"},{"id":"wordfence:10bad8bc-ee0a-48e6-b7f9-6651a7ab3049","source":"wordfence","cve":"CVE-2024-4620","title":"ARForms Form Builder <= 6.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10bad8bc-ee0a-48e6-b7f9-6651a7ab3049?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.6"}],"published":"2024-05-17T00:00:00Z","updated":"2024-06-18T15:08:34Z"},{"id":"wordfence:10c1402d-613d-4d72-b488-c0af2bee4d59","source":"wordfence","cve":"","title":"MathJax-LaTeX < 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c1402d-613d-4d72-b488-c0af2bee4d59?source=api-prod","affected":[{"type":"plugin","slug":"mathjax-latex","name":"MathJax-LaTeX","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2013-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10c17e74-dced-483e-bcaf-00ff5b11059c","source":"wordfence","cve":"CVE-2025-14742","title":"WP Recipe Maker <= 10.6.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c17e74-dced-483e-bcaf-00ff5b11059c?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.6.0","to_inclusive":true,"patched_in":"10.6.1"}],"published":"2026-02-24T21:09:18Z","updated":"2026-06-15T18:13:23Z"},{"id":"wordfence:10c1b000-537a-4009-a740-19666505989e","source":"wordfence","cve":"CVE-2023-50828","title":"Ultimate Dashboard <= 3.7.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c1b000-537a-4009-a740-19666505989e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.7.11","to_inclusive":true,"patched_in":"3.7.12"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10c31c9c-ada9-43b5-a595-ca00b12d6840","source":"wordfence","cve":"CVE-2024-10568","title":"Ajax Search Lite <= 4.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c31c9c-ada9-43b5-a595-ca00b12d6840?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.12.3","to_inclusive":true,"patched_in":"4.12.4"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-12T17:01:00Z"},{"id":"wordfence:10c41b59-c83e-4f72-8b20-10db731e23c2","source":"wordfence","cve":"CVE-2017-18522","title":"EELV Newsletter < 4.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c41b59-c83e-4f72-8b20-10db731e23c2?source=api-prod","affected":[{"type":"plugin","slug":"eelv-newsletter","name":"EELV Newsletter","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":false,"patched_in":"4.6.1"}],"published":"2017-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10c5ed1e-1288-4b57-a26c-874c15dcef08","source":"wordfence","cve":"CVE-2024-13095","title":"WP Triggers Lite <= 2.5.3 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c5ed1e-1288-4b57-a26c-874c15dcef08?source=api-prod","affected":[{"type":"plugin","slug":"wp-triggers-lite","name":"WP Triggers Lite","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:33:40Z"},{"id":"wordfence:10c65f72-a115-4340-8ed3-ac1e2ce014d2","source":"wordfence","cve":"CVE-2026-32536","title":"Green Downloads <= 2.08 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c65f72-a115-4340-8ed3-ac1e2ce014d2?source=api-prod","affected":[{"type":"plugin","slug":"halfdata-paypal-green-downloads","name":"Green Downloads","from":"*","from_inclusive":true,"to":"2.08","to_inclusive":true,"patched_in":"2.09"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:24:37Z"},{"id":"wordfence:10c8dc50-2c69-4c9d-a546-8ffcfcbb6ee1","source":"wordfence","cve":"CVE-2025-23666","title":"Management-screen-droptiles <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10c8dc50-2c69-4c9d-a546-8ffcfcbb6ee1?source=api-prod","affected":[{"type":"plugin","slug":"cxc-sawa","name":"Management-screen-droptiles","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:06:14Z"},{"id":"wordfence:10cc54a9-4b3d-4584-a90e-7828cd9cdc26","source":"wordfence","cve":"CVE-2026-32344","title":"Corpiva <= 1.0.96 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10cc54a9-4b3d-4584-a90e-7828cd9cdc26?source=api-prod","affected":[{"type":"theme","slug":"corpiva","name":"Corpiva","from":"*","from_inclusive":true,"to":"1.0.96","to_inclusive":true,"patched_in":"1.0.97"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:47:45Z"},{"id":"wordfence:10ccb769-b186-41c4-b0e8-84b9c4d5e7b0","source":"wordfence","cve":"CVE-2024-35698","title":"YITH WooCommerce Tab Manager <= 1.35.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ccb769-b186-41c4-b0e8-84b9c4d5e7b0?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-tab-manager","name":"YITH WooCommerce Tab Manager","from":"*","from_inclusive":true,"to":"1.35.0","to_inclusive":true,"patched_in":"1.35.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:34:29Z"},{"id":"wordfence:10cf5046-0781-4a32-b6e0-8da68ea96512","source":"wordfence","cve":"CVE-2026-94681","title":"WP Store Locator < 3.0.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10cf5046-0781-4a32-b6e0-8da68ea96512?source=api-prod","affected":[{"type":"plugin","slug":"wp-store-locator","name":"WP Store Locator","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:36:15Z"},{"id":"wordfence:10cfc6e2-1502-45cb-b868-32228b3ccdd9","source":"wordfence","cve":"CVE-2024-49296","title":"Custom Add to Cart Button Label and Link <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10cfc6e2-1502-45cb-b868-32228b3ccdd9?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-cart-button","name":"Custom Add to Cart Button Label and Link for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-10-15T00:00:00Z","updated":"2025-08-11T13:55:37Z"},{"id":"wordfence:10d10207-b1ba-48d2-8cd6-74bf0a186bde","source":"wordfence","cve":"CVE-2025-47558","title":"MapSVG <= 8.6.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d10207-b1ba-48d2-8cd6-74bf0a186bde?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.6.13","to_inclusive":false,"patched_in":"8.6.13"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-24T22:25:02Z"},{"id":"wordfence:10d5bc57-9512-4f70-98fc-e1307178a071","source":"wordfence","cve":"CVE-2025-31637","title":"SHOUT <= 3.5.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d5bc57-9512-4f70-98fc-e1307178a071?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio8-html5-radio_ads","name":"SHOUT","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:18:00Z"},{"id":"wordfence:10d7a50c-41e9-41b7-a171-d72dbe08e7b7","source":"wordfence","cve":"CVE-2025-13754","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d7a50c-41e9-41b7-a171-d72dbe08e7b7?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.16","to_inclusive":true,"patched_in":"1.6.9.17"}],"published":"2025-12-18T18:13:50Z","updated":"2025-12-19T06:48:22Z"},{"id":"wordfence:10d861c2-8ebf-4ba8-a493-0ab3aa43aa76","source":"wordfence","cve":"CVE-2015-9229","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 2.1.15 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d861c2-8ebf-4ba8-a493-0ab3aa43aa76?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.23"}],"published":"2015-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10d926d7-bcc9-4424-8422-90edc36f0ad4","source":"wordfence","cve":"CVE-2024-29118","title":"Scrollsequence <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d926d7-bcc9-4424-8422-90edc36f0ad4?source=api-prod","affected":[{"type":"plugin","slug":"scrollsequence","name":"Scrollsequence \u2013 Cinematic Scroll Image Animation Plugin","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T20:41:42Z"},{"id":"wordfence:10d92d5e-1c23-4f6a-bfab-0756876190a5","source":"wordfence","cve":"CVE-2024-6637","title":"WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password","severity":"high","cvss":7.3,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T07:37:52Z"},{"id":"wordfence:10dba353-f12f-49c0-a0fb-8de112a43031","source":"wordfence","cve":"CVE-2026-115955","title":"Advanced Post Block \u2013 Display Your Posts Exactly How You Want <= 2.5.1 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10dba353-f12f-49c0-a0fb-8de112a43031?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-block","name":"Advanced Post Block \u2013 Display Your Posts Exactly How You Want","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T15:10:04Z"},{"id":"wordfence:10dbaf83-03c4-409d-b31a-198eab101dd1","source":"wordfence","cve":"CVE-2025-69311","title":"Broadstreet Ads <= 1.52.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10dbaf83-03c4-409d-b31a-198eab101dd1?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.52.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:46:26Z"},{"id":"wordfence:10dbed32-1766-4746-b820-3f17d774ba04","source":"wordfence","cve":"CVE-2025-58824","title":"Shk Corporate <= 2.4.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10dbed32-1766-4746-b820-3f17d774ba04?source=api-prod","affected":[{"type":"theme","slug":"shk-corporate","name":"Shk Corporate","from":"*","from_inclusive":true,"to":"2.4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T20:05:23Z"},{"id":"wordfence:10debbb6-065d-4e44-8569-168974d4c080","source":"wordfence","cve":"CVE-2026-111403","title":"WP Inventory Manager <= 2.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10debbb6-065d-4e44-8569-168974d4c080?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2026-11-07T09:40:19Z","updated":"2026-11-10T19:15:01Z"},{"id":"wordfence:10e05707-02cb-42de-8399-4556d76b01b3","source":"wordfence","cve":"CVE-2022-4158","title":"Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e05707-02cb-42de-8399-4556d76b01b3?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10e1b3ac-f002-4108-9682-5fe300f07adb","source":"wordfence","cve":"CVE-2024-1176","title":"HT Easy GA4 \u2013 Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e1b3ac-f002-4108-9682-5fe300f07adb?source=api-prod","affected":[{"type":"plugin","slug":"ht-easy-google-analytics","name":"HT Easy GA4 \u2013 Google Analytics WordPress Plugin","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-22T13:51:09Z"},{"id":"wordfence:10e49bdd-3a72-4bb7-ba31-21ba4a5b377f","source":"wordfence","cve":"","title":"SAML Single Sign On \u2013 SAML SSO Login <= 4.8.75 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e49bdd-3a72-4bb7-ba31-21ba4a5b377f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"4.8.75","to_inclusive":true,"patched_in":"4.8.76"}],"published":"2019-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10e4c52d-c82f-4393-9a56-5714b3a108d1","source":"wordfence","cve":"CVE-2026-2471","title":"WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e4c52d-c82f-4393-9a56-5714b3a108d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":"1.16"}],"published":"2026-02-27T17:58:35Z","updated":"2026-02-28T06:27:45Z"},{"id":"wordfence:10e7000b-597a-4165-8604-cb6b29714abb","source":"wordfence","cve":"CVE-2026-77830","title":"Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e7000b-597a-4165-8604-cb6b29714abb?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.86","to_inclusive":true,"patched_in":"6.87"}],"published":"2026-09-04T18:03:03Z","updated":"2026-09-05T06:37:55Z"},{"id":"wordfence:10e98088-423d-45bb-ae90-51e895d2929b","source":"wordfence","cve":"CVE-2015-10140","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 2.8.1.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10e98088-423d-45bb-ae90-51e895d2929b?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"2.8.1.1","to_inclusive":true,"patched_in":"2.8.1.2"}],"published":"2015-10-10T00:00:00Z","updated":"2025-07-25T14:04:11Z"},{"id":"wordfence:10ea2183-3f4e-44bd-a726-0910fe71df13","source":"wordfence","cve":"CVE-2025-52831","title":"Video List Manager <= 1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ea2183-3f4e-44bd-a726-0910fe71df13?source=api-prod","affected":[{"type":"plugin","slug":"video-list-manager","name":"Video List Manager","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:54:23Z"},{"id":"wordfence:10ea8f3a-35d6-494e-90f6-9165320cf99c","source":"wordfence","cve":"CVE-2024-3671","title":"Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ea8f3a-35d6-494e-90f6-9165320cf99c?source=api-prod","affected":[{"type":"plugin","slug":"print-o-matic","name":"Print-O-Matic","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T19:14:14Z","updated":"2024-05-22T07:37:23Z"},{"id":"wordfence:10ed13e9-f196-47cc-9e45-a7646444cc5b","source":"wordfence","cve":"CVE-2016-11006","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Unauthorized Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ed13e9-f196-47cc-9e45-a7646444cc5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10ede689-4434-47fc-bf94-ca6da678ae01","source":"wordfence","cve":"CVE-2021-24168","title":"Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ede689-4434-47fc-bf94-ca6da678ae01?source=api-prod","affected":[{"type":"plugin","slug":"easy-contact-form-pro","name":"Easy Contact Form Pro","from":"*","from_inclusive":true,"to":"1.1.1.9","to_inclusive":false,"patched_in":"1.1.1.9"}],"published":"2021-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10ee015a-c60b-4236-bb7a-9d3ffd944bf9","source":"wordfence","cve":"CVE-2016-10928","title":"OneLogin SAML SSO < 2.2.0 - Authentication Bypass","severity":"high","cvss":7.5,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ee015a-c60b-4236-bb7a-9d3ffd944bf9?source=api-prod","affected":[{"type":"plugin","slug":"onelogin-saml-sso","name":"OneLogin SAML SSO","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2016-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10ef8475-4ec5-4412-97f6-3abdb4442b92","source":"wordfence","cve":"CVE-2022-47158","title":"alfred24 Click & Collect <= 1.1.7 - Authenticated (Administrator+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ef8475-4ec5-4412-97f6-3abdb4442b92?source=api-prod","affected":[{"type":"plugin","slug":"alfred-click-collect","name":"alfred24 Click & Collect","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10f00859-3adf-40ff-8f33-827bbb1f62df","source":"wordfence","cve":"CVE-2024-1390","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10f00859-3adf-40ff-8f33-827bbb1f62df?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2024-02-13T00:00:00Z","updated":"2024-02-20T18:56:19Z"},{"id":"wordfence:10f28404-acd0-40de-af42-2970b5b25bde","source":"wordfence","cve":"CVE-2023-2178","title":"Aajoda Testimonials <= 2.2.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10f28404-acd0-40de-af42-2970b5b25bde?source=api-prod","affected":[{"type":"plugin","slug":"aajoda-testimonials","name":"Aajoda Testimonials","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:10f5eef7-ea2f-44ee-8907-da53ced19180","source":"wordfence","cve":"CVE-2026-15178","title":"Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10f5eef7-ea2f-44ee-8907-da53ced19180?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.2.6"}],"published":"2026-10-09T17:52:31Z","updated":"2026-10-10T06:40:08Z"},{"id":"wordfence:10f7688e-019c-4c6b-a6ac-dacb66bcc36f","source":"wordfence","cve":"CVE-2024-51787","title":"ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10f7688e-019c-4c6b-a6ac-dacb66bcc36f?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T19:56:01Z"},{"id":"wordfence:10fbb942-6fe2-4257-821a-37d00cad4606","source":"wordfence","cve":"CVE-2026-105875","title":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10fbb942-6fe2-4257-821a-37d00cad4606?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-10-07T09:15:00Z","updated":"2026-10-08T23:32:13Z"},{"id":"wordfence:10fcfddf-0ed7-471d-86bf-c38e7021c6a4","source":"wordfence","cve":"CVE-2024-8802","title":"Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10fcfddf-0ed7-471d-86bf-c38e7021c6a4?source=api-prod","affected":[{"type":"plugin","slug":"clio-grow-form","name":"Clio Grow Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-10-03T13:31:22Z","updated":"2024-10-24T19:54:32Z"},{"id":"wordfence:10ff714f-b720-473e-8308-359829f19700","source":"wordfence","cve":"CVE-2026-118437","title":"BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Arbitrary Guest Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ff714f-b720-473e-8308-359829f19700?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"2.8.8","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:41:19Z"},{"id":"wordfence:10ffe689-143a-4232-8094-45844dc5262b","source":"wordfence","cve":"CVE-2024-22304","title":"FreshMail For WordPress <= 2.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/10ffe689-143a-4232-8094-45844dc5262b?source=api-prod","affected":[{"type":"plugin","slug":"freshmail-integration","name":"FreshMail For WordPress","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-24T16:52:21Z"},{"id":"wordfence:1101bfe6-2075-4f44-933b-6d9f372100a2","source":"wordfence","cve":"CVE-2023-41240","title":"Pricing Deals for WooCommerce <= 2.0.3.2 - Missing Authorization via vtprd_ajax_clone_rule","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1101bfe6-2075-4f44-933b-6d9f372100a2?source=api-prod","affected":[{"type":"plugin","slug":"pricing-deals-for-woocommerce","name":"Pricing Deals for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1102b3ef-5f55-46ce-bcd9-c364b2f7e82f","source":"wordfence","cve":"CVE-2024-56261","title":"Project Showcase <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1102b3ef-5f55-46ce-bcd9-c364b2f7e82f?source=api-prod","affected":[{"type":"plugin","slug":"gs-projects","name":"Project Showcase \u2013 Case Studies, Project Portfolio & Project Grid","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:13:28Z"},{"id":"wordfence:11043029-1b77-4e18-bdd8-fca2eadc6901","source":"wordfence","cve":"CVE-2010-4402","title":"Register Plus <= 3.5.11 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11043029-1b77-4e18-bdd8-fca2eadc6901?source=api-prod","affected":[{"type":"plugin","slug":"register-plus","name":"Register Plus","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":""}],"published":"2010-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1106e7b2-eac7-459d-8eb3-fe84c76f3b67","source":"wordfence","cve":"CVE-2023-51540","title":"Custom 404 Pro <= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via logging","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1106e7b2-eac7-459d-8eb3-fe84c76f3b67?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:110a1b28-50e0-430e-82d4-c254d73836e2","source":"wordfence","cve":"CVE-2026-2594","title":"Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/110a1b28-50e0-430e-82d4-c254d73836e2?source=api-prod","affected":[{"type":"plugin","slug":"smart-custom-fields","name":"Smart Custom Fields","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2026-07-16T13:18:27Z","updated":"2026-07-17T01:30:52Z"},{"id":"wordfence:110c6d41-e814-41c9-a3e7-d94ec3d953e6","source":"wordfence","cve":"CVE-2023-4603","title":"Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/110c6d41-e814-41c9-a3e7-d94ec3d953e6?source=api-prod","affected":[{"type":"plugin","slug":"star-cloudprnt-for-woocommerce","name":"Star CloudPRNT for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:110e5e67-b318-4ab2-9b4d-59aabcf7db7c","source":"wordfence","cve":"CVE-2024-3107","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/110e5e67-b318-4ab2-9b4d-59aabcf7db7c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":true,"patched_in":"2.12.7"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:51:46Z"},{"id":"wordfence:110e888d-69fc-4682-b908-2b62288c5227","source":"wordfence","cve":"CVE-2026-78003","title":"Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys","severity":"critical","cvss":9.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/110e888d-69fc-4682-b908-2b62288c5227?source=api-prod","affected":[{"type":"plugin","slug":"mailgun","name":"Mailgun for WordPress","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T08:26:39Z"},{"id":"wordfence:110f4ca6-3e59-4348-bb45-6e5fcfa81491","source":"wordfence","cve":"CVE-2012-6079","title":"W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/110f4ca6-3e59-4348-bb45-6e5fcfa81491?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.2.4","to_inclusive":true,"patched_in":"0.9.2.5"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1114a84e-3425-402f-bcdc-a2ee05b2dbc9","source":"wordfence","cve":"CVE-2025-12677","title":"KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1114a84e-3425-402f-bcdc-a2ee05b2dbc9?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-05T07:28:17Z"},{"id":"wordfence:1115e1e9-92f4-462f-94d3-a64b8362a035","source":"wordfence","cve":"CVE-2026-81742","title":"BE REST Endpoints <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1115e1e9-92f4-462f-94d3-a64b8362a035?source=api-prod","affected":[{"type":"plugin","slug":"be-rest-endpoints","name":"BE REST Endpoints","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:53:47Z"},{"id":"wordfence:11177270-cc73-4c65-9f72-8c0a0a89bed5","source":"wordfence","cve":"","title":"404 to 301 \u2013 Redirect, Log and Notify 404 Errors <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11177270-cc73-4c65-9f72-8c0a0a89bed5?source=api-prod","affected":[{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1118a318-270f-427d-8a9f-5e753fa50b14","source":"wordfence","cve":"CVE-2026-62032","title":"DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.27 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1118a318-270f-427d-8a9f-5e753fa50b14?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.27","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T12:52:57Z","updated":"2026-10-13T14:11:14Z"},{"id":"wordfence:111a0507-aa51-4e4e-a582-9007041c811b","source":"wordfence","cve":"CVE-2024-11749","title":"App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/111a0507-aa51-4e4e-a582-9007041c811b?source=api-prod","affected":[{"type":"plugin","slug":"appizy-app-embed","name":"App Embed","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T05:23:53Z"},{"id":"wordfence:111a1e7f-bc87-4130-a0b2-422d0f98afb6","source":"wordfence","cve":"CVE-2025-0859","title":"Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/111a1e7f-bc87-4130-a0b2-422d0f98afb6?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.6","to_inclusive":true,"patched_in":"1.27.7"}],"published":"2025-02-05T20:32:49Z","updated":"2025-02-06T09:21:19Z"},{"id":"wordfence:111c46c3-7c70-454b-8e99-1552cf0104e2","source":"wordfence","cve":"","title":"WP Front-End Repository Manager <= 1.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/111c46c3-7c70-454b-8e99-1552cf0104e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-repository","name":"WP Front-End Repository Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2015-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1122313e-7dcd-4b21-b382-898e5168e5d3","source":"wordfence","cve":"CVE-2025-30547","title":"WP Cards <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1122313e-7dcd-4b21-b382-898e5168e5d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-cards","name":"WP Cards","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:53:57Z"},{"id":"wordfence:1123fcf4-fdfa-4862-9102-920a91868c37","source":"wordfence","cve":"CVE-2026-110029","title":"Squeeze <= 1.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1123fcf4-fdfa-4862-9102-920a91868c37?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:15:45Z"},{"id":"wordfence:112456a9-8bb6-4007-87da-6d0fba912498","source":"wordfence","cve":"CVE-2024-13696","title":"Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112456a9-8bb6-4007-87da-6d0fba912498?source=api-prod","affected":[{"type":"plugin","slug":"flexible-wishlist","name":"Flexible Wishlist for WooCommerce \u2013 Ecommerce Wishlist & Save for later","from":"*","from_inclusive":true,"to":"1.2.25","to_inclusive":true,"patched_in":"1.2.26"}],"published":"2025-01-28T18:40:58Z","updated":"2025-01-29T07:21:27Z"},{"id":"wordfence:112564b7-bf3c-4c17-8113-e05ab75edf6a","source":"wordfence","cve":"","title":"ImageLinks Interactive Image Builder <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112564b7-bf3c-4c17-8113-e05ab75edf6a?source=api-prod","affected":[{"type":"plugin","slug":"imagelinks-interactive-image-builder-lite","name":"ImageLinks \u2013 Interactive Image Builder with Hotspots","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1127a5f3-1698-45e9-85bd-4eebfdbe56d4","source":"wordfence","cve":"CVE-2024-9345","title":"Product Delivery Date for WooCommerce \u2013 Lite <= 2.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1127a5f3-1698-45e9-85bd-4eebfdbe56d4?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-10-03T13:40:51Z","updated":"2024-10-04T02:04:51Z"},{"id":"wordfence:1127fe1e-4359-4dff-93a7-392a8bfded51","source":"wordfence","cve":"","title":"WP Courses LMS <= 3.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1127fe1e-4359-4dff-93a7-392a8bfded51?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11280431-ee39-45da-909a-e9efc0e6266f","source":"wordfence","cve":"","title":"Avada <= 7.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11280431-ee39-45da-909a-e9efc0e6266f?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.4.1","to_inclusive":true,"patched_in":"7.4.2"}],"published":"2021-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1128aca9-329d-4a3f-b0b0-36a4172524c5","source":"wordfence","cve":"CVE-2026-57324","title":"GIFT4U \u2013 Gift Cards All in One for Woo <= 1.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1128aca9-329d-4a3f-b0b0-36a4172524c5?source=api-prod","affected":[{"type":"plugin","slug":"gift4u-gift-cards-all-in-one-for-woo","name":"GIFT4U \u2013 Gift Cards All in One for Woo","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:55:41Z"},{"id":"wordfence:11296672-cbf3-4b2c-a871-abff487f20f5","source":"wordfence","cve":"CVE-2025-39382","title":"ACF: Google Font Selector <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11296672-cbf3-4b2c-a871-abff487f20f5?source=api-prod","affected":[{"type":"plugin","slug":"acf-google-font-selector-field","name":"ACF: Google Font Selector","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:05:02Z"},{"id":"wordfence:112cea93-fa4b-4692-8c8b-e74255f61939","source":"wordfence","cve":"CVE-2026-5226","title":"Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-04-10T11:39:59Z","updated":"2026-04-13T12:04:37Z"},{"id":"wordfence:112e4abe-aac7-4fac-b03f-b998374846c4","source":"wordfence","cve":"CVE-2022-3151","title":"WP Custom Cursors <= 3.0 - Cross-Site Request Forgery to Cursor Manipulation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112e4abe-aac7-4fac-b03f-b998374846c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:112ece28-27ac-4d3c-b302-7acab43390fb","source":"wordfence","cve":"CVE-2024-10527","title":"Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112ece28-27ac-4d3c-b302-7acab43390fb?source=api-prod","affected":[{"type":"plugin","slug":"spacer","name":"Spacer","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:23:34Z","updated":"2025-01-07T04:21:57Z"},{"id":"wordfence:112ed4f2-fe91-4d83-a3f7-eaf889870af4","source":"wordfence","cve":"CVE-2022-3590","title":"WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery","severity":"medium","cvss":4.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/112ed4f2-fe91-4d83-a3f7-eaf889870af4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1.30","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-06T00:00:00Z","updated":"2026-10-09T19:20:44Z"},{"id":"wordfence:11305d35-07d6-4c61-a0c7-035671229f07","source":"wordfence","cve":"CVE-2023-34032","title":"bbPress Toolkit <= 1.0.12 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11305d35-07d6-4c61-a0c7-035671229f07?source=api-prod","affected":[{"type":"plugin","slug":"bbp-toolkit","name":"bbPress Toolkit","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11314a07-70f7-4a63-837f-4812905a55fe","source":"wordfence","cve":"CVE-2026-75921","title":"Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction","severity":"high","cvss":7.2,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11314a07-70f7-4a63-837f-4812905a55fe?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-08-31T15:55:27Z","updated":"2026-09-01T04:27:48Z"},{"id":"wordfence:113287e2-0d8e-4109-ab24-ba2283cc9964","source":"wordfence","cve":"CVE-2025-23901","title":"GravatarLocalCache <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113287e2-0d8e-4109-ab24-ba2283cc9964?source=api-prod","affected":[{"type":"plugin","slug":"gravatarlocalcache","name":"GravatarLocalCache","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:18:31Z"},{"id":"wordfence:1133aab2-172e-47d0-9e3c-1caaca474f5c","source":"wordfence","cve":"CVE-2026-112828","title":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1133aab2-172e-47d0-9e3c-1caaca474f5c?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2026-10-26T08:45:00Z","updated":"2026-10-28T01:16:39Z"},{"id":"wordfence:11349bc4-b432-4225-82a4-30bc9d0057f9","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11349bc4-b432-4225-82a4-30bc9d0057f9?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker-pro","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1134c44c-d4d9-4f75-80f9-e6d7cfafebec","source":"wordfence","cve":"CVE-2026-124251","title":"WPIDE \u2013 File Manager & Code Editor <= 3.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1134c44c-d4d9-4f75-80f9-e6d7cfafebec?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2026-11-10T00:00:00Z","updated":"2026-11-11T16:08:14Z"},{"id":"wordfence:1134c9ea-bbec-4f5d-acb0-1ae978346cfc","source":"wordfence","cve":"CVE-2026-54808","title":"WP Travel Gutenberg Blocks <= 3.9.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1134c9ea-bbec-4f5d-acb0-1ae978346cfc?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-blocks","name":"WP Travel Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:42:23Z"},{"id":"wordfence:113554f9-b8f0-4bdd-be90-0093fb520022","source":"wordfence","cve":"","title":"Duplicate Page and Post <= 2.1.1 - Malicious Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113554f9-b8f0-4bdd-be90-0093fb520022?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-page-and-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2017-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1137f15c-4adc-49d5-94a4-f1ea543b0dac","source":"wordfence","cve":"CVE-2025-58793","title":"WPB Elementor Addons <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1137f15c-4adc-49d5-94a4-f1ea543b0dac?source=api-prod","affected":[{"type":"plugin","slug":"wpb-elementor-addons","name":"WPB Addons for Elementor \u2013 News Ticker, Timeline, Team & More Widgets","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:02:28Z"},{"id":"wordfence:11386b6a-632c-451a-b726-846f74b6f42d","source":"wordfence","cve":"CVE-2024-2492","title":"PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11386b6a-632c-451a-b726-846f74b6f42d?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.18","to_inclusive":true,"patched_in":"2.7.19"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-09T18:58:33Z"},{"id":"wordfence:113aa171-c5b2-4cb0-808d-cd56594bacb1","source":"wordfence","cve":"CVE-2025-58594","title":"Brizy <= 2.7.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113aa171-c5b2-4cb0-808d-cd56594bacb1?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.7.13"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:29:25Z"},{"id":"wordfence:113b3093-18fe-40ae-85af-aae1945201db","source":"wordfence","cve":"CVE-2025-5933","title":"RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113b3093-18fe-40ae-85af-aae1945201db?source=api-prod","affected":[{"type":"plugin","slug":"rd-wapp","name":"RD Contacto","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:22:53Z","updated":"2025-07-04T01:44:00Z"},{"id":"wordfence:113c154d-94a0-41da-a5ed-d9b2617e1c2c","source":"wordfence","cve":"CVE-2024-4892","title":"BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113c154d-94a0-41da-a5ed-d9b2617e1c2c?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"12.5.0","to_inclusive":true,"patched_in":"12.5.1"}],"published":"2024-06-11T12:16:19Z","updated":"2024-06-12T01:55:23Z"},{"id":"wordfence:113d3dfe-02f7-455e-a4e1-2bea2dec93f3","source":"wordfence","cve":"CVE-2025-39464","title":"AdminQuickbar <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113d3dfe-02f7-455e-a4e1-2bea2dec93f3?source=api-prod","affected":[{"type":"plugin","slug":"adminquickbar","name":"AdminQuickbar","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:13:19Z"},{"id":"wordfence:113dcd4d-e62f-44dc-8087-28d265ef66be","source":"wordfence","cve":"CVE-2018-5361","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113dcd4d-e62f-44dc-8087-28d265ef66be?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:113f0cb7-a5eb-42d5-ad42-871c0381b617","source":"wordfence","cve":"CVE-2023-44241","title":"Keap Landing Pages <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/113f0cb7-a5eb-42d5-ad42-871c0381b617?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-landing-pages","name":"Keap Landing Pages","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11401ad7-6064-475c-92f6-ce72a56e9a83","source":"wordfence","cve":"CVE-2021-24653","title":"Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11401ad7-6064-475c-92f6-ce72a56e9a83?source=api-prod","affected":[{"type":"plugin","slug":"cookie-bar","name":"Cookie Bar","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2021-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1141546c-ef98-49fc-9774-b9169c56da23","source":"wordfence","cve":"CVE-2026-121873","title":"Redirection for Contact Form 7 < 3.2.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1141546c-ef98-49fc-9774-b9169c56da23?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":false,"patched_in":"3.2.16"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:11Z"},{"id":"wordfence:11419311-4369-4882-9841-9523571b2d35","source":"wordfence","cve":"CVE-2025-49244","title":"Shortcodes Ultimate <= 7.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11419311-4369-4882-9841-9523571b2d35?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:32:54Z"},{"id":"wordfence:1144e0d9-692e-45a5-ac63-bcdd64a8bd8a","source":"wordfence","cve":"CVE-2025-12379","title":"Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1144e0d9-692e-45a5-ac63-bcdd64a8bd8a?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.13","to_inclusive":true,"patched_in":"2.17.14"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T13:47:36Z"},{"id":"wordfence:1144ed12-57bd-4f80-9df8-0aee1fcf6343","source":"wordfence","cve":"CVE-2026-25331","title":"Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1144ed12-57bd-4f80-9df8-0aee1fcf6343?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-02-14T00:00:00Z","updated":"2026-02-24T18:54:30Z"},{"id":"wordfence:1148b18d-7af1-41c6-bd7f-1b2d53cb44e6","source":"wordfence","cve":"CVE-2024-9519","title":"UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1148b18d-7af1-41c6-bd7f-1b2d53cb44e6?source=api-prod","affected":[{"type":"plugin","slug":"userplus","name":"User registration & user profile \u2013 UserPlus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:03Z"},{"id":"wordfence:114c3952-3b62-42cb-8762-515ac02f92c4","source":"wordfence","cve":"CVE-2026-42632","title":"Qode Real Estate <= 1.1.7.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/114c3952-3b62-42cb-8762-515ac02f92c4?source=api-prod","affected":[{"type":"plugin","slug":"qode-real-estate","name":"Qode Real Estate","from":"*","from_inclusive":true,"to":"1.1.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T16:27:36Z"},{"id":"wordfence:114cf149-e923-4e21-9eb0-e38941799304","source":"wordfence","cve":"CVE-2023-44996","title":"Post View Count <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/114cf149-e923-4e21-9eb0-e38941799304?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-post-view","name":"Post View Count","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-12-24T16:59:00Z"},{"id":"wordfence:114e8ba9-b6b0-4b54-982c-8e9efaa616c7","source":"wordfence","cve":"CVE-2024-30528","title":"Spiffy Calendar <= 4.9.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/114e8ba9-b6b0-4b54-982c-8e9efaa616c7?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"4.9.11"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:33:40Z"},{"id":"wordfence:114ea55e-a3a4-420e-9202-73ebbd95d7b4","source":"wordfence","cve":"CVE-2021-24127","title":"ThirstyAffiliates Affiliate Link Manager <= 3.9.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/114ea55e-a3a4-420e-9202-73ebbd95d7b4?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2020-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:114ff636-6b51-43a2-b2c8-19e01e94176f","source":"wordfence","cve":"","title":"Vithy (Unknown Versions) - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/114ff636-6b51-43a2-b2c8-19e01e94176f?source=api-prod","affected":[{"type":"theme","slug":"vithy","name":"Vithy","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1153eef6-f220-4f96-bf82-fb54496c6582","source":"wordfence","cve":"CVE-2025-25119","title":"Woocommerce osCommerce Sync <= 2.0.20 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1153eef6-f220-4f96-bf82-fb54496c6582?source=api-prod","affected":[{"type":"plugin","slug":"woo-oscommerce-sync","name":"Woocommerce osCommerce Sync","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:43:55Z"},{"id":"wordfence:11542fc6-33e2-40b9-be74-9fbb788f6915","source":"wordfence","cve":"CVE-2021-24671","title":"MX Time Zone Clocks <= 3.4 - Contributor+ Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11542fc6-33e2-40b9-be74-9fbb788f6915?source=api-prod","affected":[{"type":"plugin","slug":"mx-time-zone-clocks","name":"MX Time Zone Clocks","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1158081c-97da-4026-be16-994f4e41c92f","source":"wordfence","cve":"CVE-2023-6042","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.2 - Improper Input Validation to Arbitrary Email Sending to Admin","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1158081c-97da-4026-be16-994f4e41c92f?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-12-15T00:00:00Z","updated":"2024-02-06T16:39:45Z"},{"id":"wordfence:1159df49-2a37-44fc-a9f2-68948fde1df6","source":"wordfence","cve":"CVE-2026-103338","title":"Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1159df49-2a37-44fc-a9f2-68948fde1df6?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T12:23:00Z","updated":"2026-10-08T23:18:00Z"},{"id":"wordfence:115a63bd-65ca-4ccb-affd-c14119d6b9a3","source":"wordfence","cve":"CVE-2025-32127","title":"onOffice for WP-Websites <= 6.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/115a63bd-65ca-4ccb-affd-c14119d6b9a3?source=api-prod","affected":[{"type":"plugin","slug":"onoffice-for-wp-websites","name":"onOffice for WP-Websites","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-09-11T14:56:31Z"},{"id":"wordfence:115ad0b2-febe-485a-8fb5-9bd6edc37ef7","source":"wordfence","cve":"CVE-2023-4635","title":"EventON <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/115ad0b2-febe-485a-8fb5-9bd6edc37ef7?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:115d549c-2dea-4d94-9c50-75b8149be1e4","source":"wordfence","cve":"CVE-2021-24333","title":"Content Copy Protection & Prevent Image Save <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/115d549c-2dea-4d94-9c50-75b8149be1e4?source=api-prod","affected":[{"type":"plugin","slug":"prevent-content-copy-image-save","name":"Content Copy Protection & Prevent Image Save","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:115f966d-b0f4-46c0-af05-48dd5bf72098","source":"wordfence","cve":"","title":"WP Shop <= 3.4.3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/115f966d-b0f4-46c0-af05-48dd5bf72098?source=api-prod","affected":[{"type":"plugin","slug":"wp-shop-original","name":"WP Shop","from":"*","from_inclusive":true,"to":"3.4.3.19","to_inclusive":false,"patched_in":"3.4.3.19"}],"published":"2015-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1160c535-c01f-4243-925b-60bffa0b186f","source":"wordfence","cve":"CVE-2026-112855","title":"Redy <= 1.3.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1160c535-c01f-4243-925b-60bffa0b186f?source=api-prod","affected":[{"type":"theme","slug":"redy","name":"redy","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:57:02Z"},{"id":"wordfence:1161af9d-89f7-429f-a481-5a3008f3be8a","source":"wordfence","cve":"CVE-2025-66104","title":"Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1161af9d-89f7-429f-a481-5a3008f3be8a?source=api-prod","affected":[{"type":"plugin","slug":"cf-images","name":"Offload, AI & Optimize with Cloudflare Images","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2025-11-20T00:00:00Z","updated":"2025-12-20T19:56:57Z"},{"id":"wordfence:1161f41b-1594-4b1b-8a89-44a5a5a9dca6","source":"wordfence","cve":"CVE-2021-38345","title":"Brizy Page Builder <= 2.3.11 - Incorrect Authorization Checks Allowing Post Modification","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1161f41b-1594-4b1b-8a89-44a5a5a9dca6?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"1.0.125","to_inclusive":true,"patched_in":"1.0.126"},{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"1.0.127","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"1.0.126"}],"published":"2020-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11653fa1-c6f5-4bcc-81d2-dd469300b40a","source":"wordfence","cve":"CVE-2021-28121","title":"Virtual Robots.txt < 1.10 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11653fa1-c6f5-4bcc-81d2-dd469300b40a?source=api-prod","affected":[{"type":"plugin","slug":"virtual-robotstxt-littlebizzy","name":"Virtual Robots.txt","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.10"}],"published":"2021-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:116593ea-7fbb-45c7-aa34-0b6d8f7cc0e2","source":"wordfence","cve":"CVE-2024-49661","title":"leenk.me <= 2.16.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/116593ea-7fbb-45c7-aa34-0b6d8f7cc0e2?source=api-prod","affected":[{"type":"plugin","slug":"leenkme","name":"leenk.me","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:00:37Z"},{"id":"wordfence:1165c68d-3da4-45f3-b054-4904e54d18ac","source":"wordfence","cve":"CVE-2023-28173","title":"Google XML Sitemap for Images <= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1165c68d-3da4-45f3-b054-4904e54d18ac?source=api-prod","affected":[{"type":"plugin","slug":"google-image-sitemap","name":"Google XML Sitemap for Images","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11681152-e4f0-4cea-8fc8-f297368e4b15","source":"wordfence","cve":"CVE-2019-16289","title":"Woody Ad Snippets <= 2.2.8 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11681152-e4f0-4cea-8fc8-f297368e4b15?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2019-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:116a9d87-e271-4f7b-a509-63d4a172f1db","source":"wordfence","cve":"CVE-2025-52749","title":"Uji Countdown <= 2.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/116a9d87-e271-4f7b-a509-63d4a172f1db?source=api-prod","affected":[{"type":"plugin","slug":"uji-countdown","name":"Uji Countdown","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-10-29T19:14:19Z"},{"id":"wordfence:116c57c2-6257-40b3-a838-194f8959be16","source":"wordfence","cve":"CVE-2026-5410","title":"Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/116c57c2-6257-40b3-a838-194f8959be16?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2026-09-18T19:55:15Z","updated":"2026-09-19T08:27:21Z"},{"id":"wordfence:116e7099-2e30-4369-971c-85479709b99f","source":"wordfence","cve":"CVE-2026-78363","title":"MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/116e7099-2e30-4369-971c-85479709b99f?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":false,"patched_in":"5.1.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-09T14:15:07Z"},{"id":"wordfence:116f9dad-24be-4156-932e-742fa9a4919e","source":"wordfence","cve":"CVE-2025-25164","title":"Meta Accelerator <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/116f9dad-24be-4156-932e-742fa9a4919e?source=api-prod","affected":[{"type":"plugin","slug":"meta-accelerator","name":"Meta Accelerator","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:14:15Z"},{"id":"wordfence:1171a510-ae5c-4f8e-99a2-aa98cf54d82e","source":"wordfence","cve":"CVE-2024-35684","title":"ElasticPress <= 5.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1171a510-ae5c-4f8e-99a2-aa98cf54d82e?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:41:56Z"},{"id":"wordfence:1173e2ad-c53d-4d37-9c77-4b63f04ff335","source":"wordfence","cve":"CVE-2024-0677","title":"Pz-LinkCard <= 2.5.2 - Sever-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1173e2ad-c53d-4d37-9c77-4b63f04ff335?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-28T23:33:10Z"},{"id":"wordfence:11782a65-30b9-400e-8fe0-ab9f05ba5e42","source":"wordfence","cve":"CVE-2024-11282","title":"Passster \u2013 Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11782a65-30b9-400e-8fe0-ab9f05ba5e42?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"4.2.11"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:56Z"},{"id":"wordfence:117945cd-5a96-49ad-b031-0a6616b890bb","source":"wordfence","cve":"CVE-2026-28570","title":"Vavo Core <= 2.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/117945cd-5a96-49ad-b031-0a6616b890bb?source=api-prod","affected":[{"type":"plugin","slug":"vavo-core","name":"Vavo Core","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T16:35:05Z"},{"id":"wordfence:11795557-74c0-469a-9751-adc759f9214b","source":"wordfence","cve":"CVE-2023-48776","title":"Download canvasio3D Light <= 2.5.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11795557-74c0-469a-9751-adc759f9214b?source=api-prod","affected":[{"type":"plugin","slug":"canvasio3d-light","name":"canvasio3D Light","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-25T17:47:47Z"},{"id":"wordfence:117e797a-1878-4b5f-9846-4a73b5396ece","source":"wordfence","cve":"CVE-2008-0222","title":"Wp-FileManager <= 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/117e797a-1878-4b5f-9846-4a73b5396ece?source=api-prod","affected":[{"type":"plugin","slug":"wp-filemanager","name":"wp-FileManager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2008-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:117f4f17-40db-45a8-aa0d-73a93f2b2646","source":"wordfence","cve":"CVE-2026-109701","title":"PAYCOMET for WooCommerce <= 5.45 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/117f4f17-40db-45a8-aa0d-73a93f2b2646?source=api-prod","affected":[{"type":"plugin","slug":"paytpv-for-woocommerce","name":"PAYCOMET for WooCommerce","from":"*","from_inclusive":true,"to":"5.45","to_inclusive":true,"patched_in":"5.46"}],"published":"2026-10-15T16:52:03Z","updated":"2026-10-23T18:12:27Z"},{"id":"wordfence:11807042-be3c-4780-bb47-ecc54aead5f2","source":"wordfence","cve":"CVE-2025-22718","title":"FAT Event Lite <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11807042-be3c-4780-bb47-ecc54aead5f2?source=api-prod","affected":[{"type":"plugin","slug":"fat-event-lite","name":"FAT Event Lite","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T20:50:16Z"},{"id":"wordfence:11859241-f6d1-4395-95f3-b36e84025b57","source":"wordfence","cve":"CVE-2026-120840","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11859241-f6d1-4395-95f3-b36e84025b57?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-11-07T10:10:00Z","updated":"2026-11-10T19:38:43Z"},{"id":"wordfence:11867941-bc8d-49eb-9b0e-5d141cf7bf58","source":"wordfence","cve":"CVE-2025-63050","title":"REHub Framework < 19.9.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11867941-bc8d-49eb-9b0e-5d141cf7bf58?source=api-prod","affected":[{"type":"plugin","slug":"rehub-framework","name":"reHub Framework","from":"*","from_inclusive":true,"to":"19.9.9.7","to_inclusive":false,"patched_in":"19.9.9.7"}],"published":"2025-10-18T00:00:00Z","updated":"2026-04-15T13:31:41Z"},{"id":"wordfence:1186aca4-012b-4512-9ab3-166b9f84d725","source":"wordfence","cve":"CVE-2026-107646","title":"HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1186aca4-012b-4512-9ab3-166b9f84d725?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-10-15T17:35:35Z","updated":"2026-10-16T06:41:00Z"},{"id":"wordfence:118b9d85-1246-47f7-bdef-af47075576f2","source":"wordfence","cve":"CVE-2011-4568","title":"FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/118b9d85-1246-47f7-bdef-af47075576f2?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2011-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:118e1a8c-a638-4571-9ce9-cf2cba4b9b06","source":"wordfence","cve":"CVE-2023-40678","title":"Simple URLs <= 117 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/118e1a8c-a638-4571-9ce9-cf2cba4b9b06?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"117","to_inclusive":true,"patched_in":"118"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:118eedee-3816-49e3-b924-f4ed67eede3e","source":"wordfence","cve":"CVE-2025-31584","title":"Elfsight Testimonials Slider <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/118eedee-3816-49e3-b924-f4ed67eede3e?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-testimonials-slider","name":"Elfsight Testimonials Slider","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:15:22Z"},{"id":"wordfence:11938a57-3eb7-4e7d-99ae-c6cf508cb4c7","source":"wordfence","cve":"CVE-2024-29809","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11938a57-3eb7-4e7d-99ae-c6cf508cb4c7?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T15:33:26Z"},{"id":"wordfence:1194c11d-948c-4d6c-9cc7-7b0d05d7ce4c","source":"wordfence","cve":"CVE-2025-54017","title":"Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1194c11d-948c-4d6c-9cc7-7b0d05d7ce4c?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.15.4","to_inclusive":true,"patched_in":"2.15.5"}],"published":"2025-07-29T00:00:00Z","updated":"2025-08-04T21:33:18Z"},{"id":"wordfence:1196b20e-5fa4-44bf-8cdc-35e1c0db0c74","source":"wordfence","cve":"CVE-2026-39692","title":"tagDiv Composer <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1196b20e-5fa4-44bf-8cdc-35e1c0db0c74?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2026-02-24T00:00:00Z","updated":"2026-05-21T20:30:24Z"},{"id":"wordfence:1197a66e-4557-458f-b8fd-b7a8e7586817","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 2.53 - Sensitive Information Disclosure","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1197a66e-4557-458f-b8fd-b7a8e7586817?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.53","to_inclusive":false,"patched_in":"2.53"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1197e7ce-3ed4-4ed0-be41-54bce0a8c679","source":"wordfence","cve":"CVE-2026-103301","title":"Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1197e7ce-3ed4-4ed0-be41-54bce0a8c679?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-for-telcell","name":"Payment Gateway for Telcell","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T17:05:48Z"},{"id":"wordfence:119835f0-6416-4161-8fd4-b876a566b8a4","source":"wordfence","cve":"CVE-2026-87831","title":"Checkout Field Manager <= 7.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/119835f0-6416-4161-8fd4-b876a566b8a4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.9.6","to_inclusive":true,"patched_in":"7.9.7"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:45:03Z"},{"id":"wordfence:1199f213-4e1f-47ec-b202-e711f040f64f","source":"wordfence","cve":"CVE-2025-58926","title":"Cerebrum <= 1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1199f213-4e1f-47ec-b202-e711f040f64f?source=api-prod","affected":[{"type":"theme","slug":"cerebrum","name":"Cerebrum - Counseling & Psychology WordPress Theme","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:32:04Z"},{"id":"wordfence:119d48fb-9992-4a48-94c6-cf1c3bf986f5","source":"wordfence","cve":"CVE-2026-95514","title":"Netgsm <= 2.10.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/119d48fb-9992-4a48-94c6-cf1c3bf986f5?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:10:04Z"},{"id":"wordfence:119f33f6-cc07-48bc-b691-c01242fa01b7","source":"wordfence","cve":"CVE-2025-58940","title":"Basil <= 1.3.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/119f33f6-cc07-48bc-b691-c01242fa01b7?source=api-prod","affected":[{"type":"theme","slug":"basil","name":"Basil","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T22:01:54Z"},{"id":"wordfence:119f87d0-dcd7-487a-bee5-ebcfbcb0a62a","source":"wordfence","cve":"CVE-2024-6017","title":"Music Request Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/119f87d0-dcd7-487a-bee5-ebcfbcb0a62a?source=api-prod","affected":[{"type":"plugin","slug":"music-request-manager","name":"Music Request Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:18:39Z"},{"id":"wordfence:119fe499-88c4-413f-a44a-2b3acfdbdeb5","source":"wordfence","cve":"CVE-2026-1257","title":"Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/119fe499-88c4-413f-a44a-2b3acfdbdeb5?source=api-prod","affected":[{"type":"plugin","slug":"administrative-shortcodes","name":"Administrative Shortcodes","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:21:03Z","updated":"2026-01-24T07:26:39Z"},{"id":"wordfence:11a3d6e1-d158-45a9-b3c0-c496ce86b3ef","source":"wordfence","cve":"CVE-2025-23596","title":"Notifik\u00e1cie.sk <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11a3d6e1-d158-45a9-b3c0-c496ce86b3ef?source=api-prod","affected":[{"type":"plugin","slug":"notifikacie-sk","name":"Notifik\u00e1cie.sk","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T15:58:09Z"},{"id":"wordfence:11a469e8-d6af-4ad7-98aa-9f74d0318947","source":"wordfence","cve":"CVE-2025-67991","title":"User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11a469e8-d6af-4ad7-98aa-9f74d0318947?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.8","to_inclusive":true,"patched_in":"16.9"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:49:44Z"},{"id":"wordfence:11a61bef-da3b-46d6-8f78-0d4f9922f671","source":"wordfence","cve":"CVE-2026-59557","title":"Events Made Easy <= 3.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11a61bef-da3b-46d6-8f78-0d4f9922f671?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:20:26Z"},{"id":"wordfence:11a7e69d-4bb3-4a7f-89c8-c705987aeb5d","source":"wordfence","cve":"CVE-2024-51803","title":"Inline Click To Tweet <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11a7e69d-4bb3-4a7f-89c8-c705987aeb5d?source=api-prod","affected":[{"type":"plugin","slug":"inline-click-to-tweet","name":"Inline Click To Tweet","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:34:29Z"},{"id":"wordfence:11a93cca-7ca1-4e7d-a54c-e50ef7ef0c75","source":"wordfence","cve":"CVE-2026-97189","title":"Advanced Custom Fields <= 6.8.10 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11a93cca-7ca1-4e7d-a54c-e50ef7ef0c75?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"6.8.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T20:12:00Z"},{"id":"wordfence:11aa7971-9770-47fc-960e-44fe43321b53","source":"wordfence","cve":"CVE-2021-34667","title":"Calendar_plugin <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11aa7971-9770-47fc-960e-44fe43321b53?source=api-prod","affected":[{"type":"plugin","slug":"calendar-plugin","name":"Calendar_plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11aac185-191b-4f7b-8472-84d3decd582f","source":"wordfence","cve":"CVE-2024-11891","title":"Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11aac185-191b-4f7b-8472-84d3decd582f?source=api-prod","affected":[{"type":"plugin","slug":"perfect-font-awesome-integration","name":"Perfect Font Awesome Integration","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:10Z"},{"id":"wordfence:11aaec16-930d-44f6-abe5-4f7fdc32f252","source":"wordfence","cve":"","title":"LayerSlider <= 6.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11aaec16-930d-44f6-abe5-4f7fdc32f252?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2017-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11ad51d9-d0b6-4a47-875c-d7a6727f4d7c","source":"wordfence","cve":"CVE-2025-54668","title":"myCred <= 2.9.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ad51d9-d0b6-4a47-875c-d7a6727f4d7c?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.4.3","to_inclusive":true,"patched_in":"2.9.4.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:01:27Z"},{"id":"wordfence:11ad65cd-941f-4605-8b69-59146b2d59db","source":"wordfence","cve":"CVE-2016-10896","title":"SEO Redirection <= 4.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ad65cd-941f-4605-8b69-59146b2d59db?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"}],"published":"2015-08-25T00:00:00Z","updated":"2024-08-15T18:02:01Z"},{"id":"wordfence:11aec50c-2531-4d30-92da-8513fdca741e","source":"wordfence","cve":"","title":"Checkout Fields Manager for WooCommerce <= 5.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11aec50c-2531-4d30-92da-8513fdca741e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11b5f0a1-bf22-46be-a165-c62f1077da0f","source":"wordfence","cve":"CVE-2024-1974","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11b5f0a1-bf22-46be-a165-c62f1077da0f?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-05-23T16:06:00Z","updated":"2024-05-23T16:06:00Z"},{"id":"wordfence:11b640a9-a031-4061-a4d2-93decd634acf","source":"wordfence","cve":"CVE-2021-24545","title":"WP HTML Author Bio <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11b640a9-a031-4061-a4d2-93decd634acf?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-author-bio-by-ahmad-awais","name":"WP HTML Author Bio","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11b73932-7e0d-418b-8e51-d4fb768a0955","source":"wordfence","cve":"CVE-2014-125132","title":"Blogroll Fun \u2013 Show  Last Post and Last Update Time < 0.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11b73932-7e0d-418b-8e51-d4fb768a0955?source=api-prod","affected":[{"type":"plugin","slug":"blogroll-fun","name":"Blogroll Fun \u2013 Show  Last Post and Last Update Time","from":"*","from_inclusive":true,"to":"0.8.5","to_inclusive":false,"patched_in":"0.8.5"}],"published":"2014-07-07T00:00:00Z","updated":"2026-10-28T15:13:00Z"},{"id":"wordfence:11b7aaa7-1655-41db-8579-95ade38d3155","source":"wordfence","cve":"CVE-2026-88905","title":"KeyWord Collector <= 1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11b7aaa7-1655-41db-8579-95ade38d3155?source=api-prod","affected":[{"type":"plugin","slug":"keyword-collector","name":"KeyWord Collector","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:19:03Z"},{"id":"wordfence:11b8c13b-2167-4fca-a981-a331fadc0439","source":"wordfence","cve":"CVE-2024-2702","title":"Olive One Click Demo Import <= 1.1.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11b8c13b-2167-4fca-a981-a331fadc0439?source=api-prod","affected":[{"type":"plugin","slug":"olive-one-click-demo-import","name":"Olive One Click Demo Import","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-03-20T00:00:00Z","updated":"2024-04-29T13:58:13Z"},{"id":"wordfence:11ba187b-1fe4-4077-ad9d-a07660133e91","source":"wordfence","cve":"CVE-2026-11616","title":"Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ba187b-1fe4-4077-ad9d-a07660133e91?source=api-prod","affected":[{"type":"plugin","slug":"events-for-geodirectory","name":"Events Calendar for GeoDirectory","from":"*","from_inclusive":true,"to":"2.3.28","to_inclusive":true,"patched_in":"2.3.29"}],"published":"2026-06-08T19:02:22Z","updated":"2026-06-09T07:49:57Z"},{"id":"wordfence:11bb7190-023b-45e1-99a5-7313c489ef45","source":"wordfence","cve":"CVE-2026-1499","title":"WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11bb7190-023b-45e1-99a5-7313c489ef45?source=api-prod","affected":[{"type":"plugin","slug":"local-sync","name":"WP Duplicate \u2013 WordPress Migration Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-02-05T19:59:16Z","updated":"2026-03-27T10:48:45Z"},{"id":"wordfence:11bdcf58-be0c-4fdb-ac15-ee4c3afe7275","source":"wordfence","cve":"CVE-2022-45079","title":"Loginizer <= 1.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11bdcf58-be0c-4fdb-ac15-ee4c3afe7275?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11c369eb-7e5b-4fcf-a526-23466ebad420","source":"wordfence","cve":"CVE-2014-5183","title":"Simple Retail Menus <= 4.0.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11c369eb-7e5b-4fcf-a526-23466ebad420?source=api-prod","affected":[{"type":"plugin","slug":"simple-retail-menus","name":"Simple Retail Menus","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1"}],"published":"2015-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11c4b855-8589-4ad2-b414-566ac8eb4632","source":"wordfence","cve":"CVE-2020-36699","title":"Quick Page/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11c4b855-8589-4ad2-b414-566ac8eb4632?source=api-prod","affected":[{"type":"plugin","slug":"quick-pagepost-redirect-plugin","name":"Quick Page/Post Redirect Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2020-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11c7abc5-1a41-4eab-b603-064baf978ddd","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11c7abc5-1a41-4eab-b603-064baf978ddd?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker-pro","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11c7b2a8-33fd-4dc4-8373-09f672053b8c","source":"wordfence","cve":"CVE-2025-23487","title":"Easy Gallery <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11c7b2a8-33fd-4dc4-8373-09f672053b8c?source=api-prod","affected":[{"type":"plugin","slug":"simple-gallery-odihost","name":"Easy Gallery","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-10T18:46:33Z"},{"id":"wordfence:11c9124d-80e0-435d-9eb4-901c4f481a6f","source":"wordfence","cve":"CVE-2023-3664","title":"FileOrganizer <= 1.0.3 - Authenticated (Admin+) Arbitrary File Access","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11c9124d-80e0-435d-9eb4-901c4f481a6f?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11cc8c6e-b60e-46b3-966e-07b1fb2bf8e9","source":"wordfence","cve":"CVE-2023-47232","title":"WP Affiliate Disclosure <= 1.2.6 - Cross-Site Request Forgery via check_capability","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11cc8c6e-b60e-46b3-966e-07b1fb2bf8e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-disclosure","name":"WP Affiliate Disclosure","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11ccafd9-dad5-4b7d-b913-7821dd52d12b","source":"wordfence","cve":"CVE-2024-9653","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ccafd9-dad5-4b7d-b913-7821dd52d12b?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T05:32:28Z"},{"id":"wordfence:11cdb92f-f8ed-4717-a252-3edb4fb963ab","source":"wordfence","cve":"CVE-2026-15147","title":"Five Star Restaurant Reservations <= 2.7.22 - Unauthenticated Insecure Direct Object Reference to Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11cdb92f-f8ed-4717-a252-3edb4fb963ab?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.22","to_inclusive":true,"patched_in":"2.7.23"}],"published":"2026-07-20T00:00:00Z","updated":"2026-09-17T15:12:25Z"},{"id":"wordfence:11d292fd-c166-477f-900f-b3c339ec7d8e","source":"wordfence","cve":"CVE-2026-119520","title":"Spectra Legacy \u2013 Gutenberg Blocks <= 2.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d292fd-c166-477f-900f-b3c339ec7d8e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.20.4","to_inclusive":true,"patched_in":"2.20.5"}],"published":"2026-11-07T10:08:00Z","updated":"2026-11-10T19:34:18Z"},{"id":"wordfence:11d45287-f875-4cc9-aaf6-47158fe32858","source":"wordfence","cve":"CVE-2025-8871","title":"Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature","severity":"medium","cvss":5.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms-pro","name":"Everest Forms Pro","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2025-11-04T14:21:07Z","updated":"2025-11-05T02:25:52Z"},{"id":"wordfence:11d49c89-43be-4e12-86b5-aa7a72a89803","source":"wordfence","cve":"CVE-2024-13361","title":"AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d49c89-43be-4e12-86b5-aa7a72a89803?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.96","to_inclusive":true,"patched_in":"1.8.97"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:29:39Z"},{"id":"wordfence:11d4c028-94c1-4b78-92f8-0f3303725651","source":"wordfence","cve":"CVE-2024-5346","title":"Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d4c028-94c1-4b78-92f8-0f3303725651?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.18.7","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2024-06-21T13:15:56Z","updated":"2024-06-22T02:01:03Z"},{"id":"wordfence:11d53df8-f7b3-467c-8b3a-515974f1ea69","source":"wordfence","cve":"CVE-2005-2108","title":"WordPress Core < 1.5.1.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d53df8-f7b3-467c-8b3a-515974f1ea69?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.3","to_inclusive":false,"patched_in":"1.5.1.3"}],"published":"2005-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11d5f187-e919-43f6-88c7-db5ffa6bd793","source":"wordfence","cve":"CVE-2026-19862","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection","severity":"medium","cvss":5.3,"cwe":"CWE-113","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d5f187-e919-43f6-88c7-db5ffa6bd793?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.2","to_inclusive":false,"patched_in":"3.6.5.2"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:53:27Z"},{"id":"wordfence:11d68c98-3d7e-42af-be61-6bb5428b73b6","source":"wordfence","cve":"CVE-2026-12734","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11d68c98-3d7e-42af-be61-6bb5428b73b6?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-02T12:00:12Z","updated":"2026-07-03T01:28:19Z"},{"id":"wordfence:11dba817-b913-42b1-baa0-ec480674f858","source":"wordfence","cve":"CVE-2025-68566","title":"My auctions allegro <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11dba817-b913-42b1-baa0-ec480674f858?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-12-17T00:00:00Z","updated":"2026-10-28T21:09:06Z"},{"id":"wordfence:11dbc647-fa96-4c63-8f13-0c8ea6f33919","source":"wordfence","cve":"CVE-2024-39659","title":"WP-PostRatings <= 1.91.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11dbc647-fa96-4c63-8f13-0c8ea6f33919?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings","name":"WP-PostRatings","from":"*","from_inclusive":true,"to":"1.91.1","to_inclusive":true,"patched_in":"1.91.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:13:07Z"},{"id":"wordfence:11dceac7-7ff8-4384-9046-919c38947c32","source":"wordfence","cve":"CVE-2024-4392","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11dceac7-7ff8-4384-9046-919c38947c32?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"13.3.1","to_inclusive":true,"patched_in":"13.4"}],"published":"2024-05-13T20:29:28Z","updated":"2024-05-14T08:32:31Z"},{"id":"wordfence:11deeb2a-db8c-4380-a541-0c78781f78c6","source":"wordfence","cve":"CVE-2024-37944","title":"WP Travel Engine <= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11deeb2a-db8c-4380-a541-0c78781f78c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T14:01:13Z"},{"id":"wordfence:11e21460-ea79-4c19-82a9-388825985673","source":"wordfence","cve":"CVE-2025-32503","title":"Link Shield <= 0.5.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11e21460-ea79-4c19-82a9-388825985673?source=api-prod","affected":[{"type":"plugin","slug":"link-shield","name":"Link Shield","from":"*","from_inclusive":true,"to":"0.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-07-24T14:56:47Z"},{"id":"wordfence:11e31621-295a-4d34-8f11-65408bc75260","source":"wordfence","cve":"CVE-2024-43287","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.82 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11e31621-295a-4d34-8f11-65408bc75260?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.82","to_inclusive":true,"patched_in":"3.1.83"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:20:02Z"},{"id":"wordfence:11e7617d-6d45-4e8d-a82f-fc9da4aeabcf","source":"wordfence","cve":"CVE-2026-39628","title":"DukaMarket <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11e7617d-6d45-4e8d-a82f-fc9da4aeabcf?source=api-prod","affected":[{"type":"theme","slug":"dukamarket","name":"Duka Market - Multipurpose eCommerce Template","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-12T00:00:00Z","updated":"2026-05-05T15:28:00Z"},{"id":"wordfence:11e7e798-9fb9-4cff-a96f-a0003f203f5f","source":"wordfence","cve":"CVE-2025-14770","title":"Shipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11e7e798-9fb9-4cff-a96f-a0003f203f5f?source=api-prod","affected":[{"type":"plugin","slug":"shipping-rate-by-cities","name":"Shipping Rate By Cities","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-13T17:31:36Z","updated":"2026-01-19T16:58:15Z"},{"id":"wordfence:11e97adc-b402-4d82-ae39-4dccbd70bcf2","source":"wordfence","cve":"","title":"Elementor Addon Elements <= 1.11.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11e97adc-b402-4d82-ae39-4dccbd70bcf2?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.11.7","to_inclusive":true,"patched_in":"1.11.8"}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11ea3e40-8802-43ea-9816-973a15d7904d","source":"wordfence","cve":"CVE-2022-38077","title":"WP OnlineSupport, Essential Plugin Popup Anything <= 2.2.1 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ea3e40-8802-43ea-9816-973a15d7904d?source=api-prod","affected":[{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11ecc255-cf8a-4fa9-a04a-d17946b1f167","source":"wordfence","cve":"CVE-2025-30797","title":"Greek Multi Tool \u2013 Fix peralinks, accents, auto create menus and more <= 2.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ecc255-cf8a-4fa9-a04a-d17946b1f167?source=api-prod","affected":[{"type":"plugin","slug":"greek-multi-tool","name":"Greek Multi Tool","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:16:51Z"},{"id":"wordfence:11f01584-e389-4551-b151-f3f0686d1d5d","source":"wordfence","cve":"CVE-2025-7046","title":"Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11f01584-e389-4551-b151-f3f0686d1d5d?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-elementor","name":"PowerFolio \u2013 Portfolio & Image Gallery for Elementor","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-07-03T12:06:22Z","updated":"2025-07-04T01:44:00Z"},{"id":"wordfence:11f367a0-3a1a-474b-8dae-b3b0f942574a","source":"wordfence","cve":"CVE-2026-19859","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11f367a0-3a1a-474b-8dae-b3b0f942574a?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.2","to_inclusive":false,"patched_in":"3.6.5.2"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:44:45Z"},{"id":"wordfence:11f3c5bf-19cd-422a-a7f8-358669c78db5","source":"wordfence","cve":"CVE-2025-49860","title":"Majestic Support <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11f3c5bf-19cd-422a-a7f8-358669c78db5?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:47:42Z"},{"id":"wordfence:11f74b86-a050-4247-b310-045bf48fd4bd","source":"wordfence","cve":"CVE-2023-1343","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'attach_rule'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11f74b86-a050-4247-b310-045bf48fd4bd?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11f883d2-c183-4cc9-a330-6c50610a5c39","source":"wordfence","cve":"","title":"Shariff Sharing < 1.0.8 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11f883d2-c183-4cc9-a330-6c50610a5c39?source=api-prod","affected":[{"type":"plugin","slug":"shariff-sharing","name":"Shariff for WordPress","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2014-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11fb823c-c3d3-456d-b606-b01a8307c25a","source":"wordfence","cve":"CVE-2024-5342","title":"Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11fb823c-c3d3-456d-b606-b01a8307c25a?source=api-prod","affected":[{"type":"plugin","slug":"simple-image-popup-shortcode","name":"Simple Image Popup Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T13:02:03Z","updated":"2024-06-06T02:02:52Z"},{"id":"wordfence:11fbe76c-dc5c-413c-b6a8-d0f4aa56935d","source":"wordfence","cve":"CVE-2025-13587","title":"Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-2fa-via-email","name":"Two Factor (2FA) Authentication via Email","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2026-02-18T15:31:37Z","updated":"2026-02-19T04:36:06Z"},{"id":"wordfence:11fc48b0-cee2-4392-866b-5c0f366e5d98","source":"wordfence","cve":"CVE-2023-38383","title":"Language <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11fc48b0-cee2-4392-866b-5c0f366e5d98?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-language","name":"WordPress Language","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11fd8768-0168-4e3b-9c2d-659fc4101a73","source":"wordfence","cve":"CVE-2023-23651","title":"MainWP Google Analytics Extension <= 4.0.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11fd8768-0168-4e3b-9c2d-659fc4101a73?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-google-analytics-extension","name":"MainWP Google Analytics Extension","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:11ffb8a1-55d2-44c5-bcd2-ba866b94e8bc","source":"wordfence","cve":"CVE-2023-4482","title":"Auto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/11ffb8a1-55d2-44c5-bcd2-ba866b94e8bc?source=api-prod","affected":[{"type":"plugin","slug":"amazon-auto-links","name":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1200d2b3-2c1b-44a4-bf87-2d9b0121d6cb","source":"wordfence","cve":"CVE-2022-29419","title":"3xSocializer <= 0.98.22 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1200d2b3-2c1b-44a4-bf87-2d9b0121d6cb?source=api-prod","affected":[{"type":"plugin","slug":"3xsocializer","name":"3xSocializer","from":"*","from_inclusive":true,"to":"0.98.22","to_inclusive":true,"patched_in":""}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:120313be-9f98-4448-9f5d-a77186a6ff08","source":"wordfence","cve":"CVE-2024-1069","title":"Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120313be-9f98-4448-9f5d-a77186a6ff08?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-01-30T00:00:00Z","updated":"2024-01-31T02:35:10Z"},{"id":"wordfence:120514af-41d8-49ca-be87-28c7d4777fee","source":"wordfence","cve":"CVE-2008-0203","title":"Cryptographp <= 1.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120514af-41d8-49ca-be87-28c7d4777fee?source=api-prod","affected":[{"type":"plugin","slug":"cryptographp","name":"Cryptographp","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2007-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:120566a0-7e10-4a07-9de9-98e11d8145b1","source":"wordfence","cve":"CVE-2025-9540","title":"Markup Markdown <= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120566a0-7e10-4a07-9de9-98e11d8145b1?source=api-prod","affected":[{"type":"plugin","slug":"markup-markdown","name":"Markup Markdown","from":"*","from_inclusive":true,"to":"3.20.9","to_inclusive":true,"patched_in":"3.20.10"}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-25T19:14:49Z"},{"id":"wordfence:12072b77-fe68-4304-8230-7c137a8d05ac","source":"wordfence","cve":"CVE-2010-5293","title":"WordPress Core < 3.0.2 - Spam Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12072b77-fe68-4304-8230-7c137a8d05ac?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2010-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12081e8c-7aec-4450-a1a6-15250e7037f4","source":"wordfence","cve":"","title":"Debug Bar <= 1.85 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12081e8c-7aec-4450-a1a6-15250e7037f4?source=api-prod","affected":[{"type":"plugin","slug":"enable-wp-debug-from-admin-dashboard","name":"Debug Bar \u2013 Enable WP_DEBUG from admin dashboard","from":"*","from_inclusive":true,"to":"1.85","to_inclusive":true,"patched_in":"1.86"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1208ac78-4a56-4daa-b935-d579f07f8e8e","source":"wordfence","cve":"CVE-2026-8616","title":"Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1208ac78-4a56-4daa-b935-d579f07f8e8e?source=api-prod","affected":[{"type":"plugin","slug":"fense-block-vpn-proxy","name":"Fense Block Vpn & Proxy","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-07-16T14:07:41Z","updated":"2026-07-17T02:31:30Z"},{"id":"wordfence:120a75c5-4fff-4a77-b376-d6968853b40e","source":"wordfence","cve":"CVE-2023-7074","title":"WP Social Bookmark Menu <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120a75c5-4fff-4a77-b376-d6968853b40e?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-bookmark-menu","name":"WP SOCIAL BOOKMARK MENU","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:120ba9e5-9594-4a4f-b475-ef3fcf5f4565","source":"wordfence","cve":"CVE-2025-12661","title":"Pollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120ba9e5-9594-4a4f-b475-ef3fcf5f4565?source=api-prod","affected":[{"type":"plugin","slug":"pollcaster-shortcode","name":"Pollcaster Shortcode Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:21:08Z","updated":"2025-11-21T07:31:46Z"},{"id":"wordfence:120bc64f-05ec-41e7-9ed4-d88014f4a3ea","source":"wordfence","cve":"CVE-2026-13005","title":"MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120bc64f-05ec-41e7-9ed4-d88014f4a3ea?source=api-prod","affected":[{"type":"plugin","slug":"mxchat-basic","name":"MxChat \u2013 AI Chatbot & Content Generation for WordPress","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2026-07-15T13:58:58Z","updated":"2026-07-16T02:30:58Z"},{"id":"wordfence:120c9d81-0dff-4b70-b565-fedda2c089e8","source":"wordfence","cve":"CVE-2025-64190","title":"XStore Core < 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120c9d81-0dff-4b70-b565-fedda2c089e8?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":false,"patched_in":"5.6"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T20:30:57Z"},{"id":"wordfence:120d6040-1af1-46fd-9a9c-9c0d4c2e3b64","source":"wordfence","cve":"CVE-2025-67955","title":"MyHome Core <= 4.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120d6040-1af1-46fd-9a9c-9c0d4c2e3b64?source=api-prod","affected":[{"type":"plugin","slug":"myhome-core","name":"MyHome Core","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:52:08Z"},{"id":"wordfence:120e6a19-fae3-4083-a72e-36867e7eb18a","source":"wordfence","cve":"","title":"Advanced XML Reader <= 0.3.4 - External Entity Injection","severity":"critical","cvss":9.1,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120e6a19-fae3-4083-a72e-36867e7eb18a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-xml-reader","name":"Advanced XML Reader","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2013-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:120f15aa-ccef-49be-8743-e77d699601e2","source":"wordfence","cve":"CVE-2025-24683","title":"RSVP and Event Management Plugin <= 2.7.14 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120f15aa-ccef-49be-8743-e77d699601e2?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.14","to_inclusive":true,"patched_in":"2.7.15"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:08:00Z"},{"id":"wordfence:120fa415-81e3-4084-8943-df83cde334c5","source":"wordfence","cve":"CVE-2009-2854","title":"WordPress Core < 2.8.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/120fa415-81e3-4084-8943-df83cde334c5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2009-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:121022ad-a569-4a80-96ee-c7911db81a30","source":"wordfence","cve":"CVE-2021-34650","title":"eID Easy <= 4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121022ad-a569-4a80-96ee-c7911db81a30?source=api-prod","affected":[{"type":"plugin","slug":"smart-id","name":"eID Easy","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2021-09-17T18:48:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:121160a3-b090-4a33-9615-fa4626631bec","source":"wordfence","cve":"CVE-2024-32523","title":"Mailster <= 4.0.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121160a3-b090-4a33-9615-fa4626631bec?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster - Email Newsletter Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T12:51:29Z"},{"id":"wordfence:1212dfc7-41d4-4c16-960a-7afc882ec4db","source":"wordfence","cve":"CVE-2021-24645","title":"Booking.com Product Helper <= 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1212dfc7-41d4-4c16-960a-7afc882ec4db?source=api-prod","affected":[{"type":"plugin","slug":"bookingcom-product-helper","name":"Booking.com Product Helper","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1213a21f-a9c1-4da3-99b5-4a5a0673073f","source":"wordfence","cve":"CVE-2026-2023","title":"WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1213a21f-a9c1-4da3-99b5-4a5a0673073f?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-info-card","name":"WP Plugin Info Card \u2013 Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-02-17T17:12:43Z","updated":"2026-02-18T05:29:17Z"},{"id":"wordfence:12188a74-b1a6-4aa4-88b4-2d0d0dd32916","source":"wordfence","cve":"CVE-2024-31430","title":"BEAR <= 1.1.4.1 & WOLF <= 1.0.8.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12188a74-b1a6-4aa4-88b4-2d0d0dd32916?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4.1","to_inclusive":true,"patched_in":"1.1.4.2"},{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":"1.0.8.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:55:17Z"},{"id":"wordfence:1218ed3b-badc-464e-adbc-76fb4f6af008","source":"wordfence","cve":"CVE-2023-46189","title":"Google Calendar Events <= 3.2.5 - Cross-Site Request Forgery via bulk_actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1218ed3b-badc-464e-adbc-76fb4f6af008?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:121a3b46-0b31-4f28-b98e-fc06760548ae","source":"wordfence","cve":"","title":"Data Tables Generator by Supsystic <= 1.9.99 - Time-Based Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121a3b46-0b31-4f28-b98e-fc06760548ae?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.9.99","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:121a65ba-2d14-462e-bf2b-10210430e07a","source":"wordfence","cve":"CVE-2025-63036","title":"Ronneby Theme Core <= 1.5.68 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121a65ba-2d14-462e-bf2b-10210430e07a?source=api-prod","affected":[{"type":"plugin","slug":"ronneby-core","name":"Ronneby Theme Core","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":true,"patched_in":""}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-11T16:26:28Z"},{"id":"wordfence:121afcc4-754c-4f4b-8b02-9b5a4a248041","source":"wordfence","cve":"CVE-2021-24223","title":"N5 Upload Form <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121afcc4-754c-4f4b-8b02-9b5a4a248041?source=api-prod","affected":[{"type":"plugin","slug":"n5-uploadform","name":"N5 Upload Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:121c8bcd-ebfd-4e2f-8417-836db846b5a4","source":"wordfence","cve":"CVE-2026-57382","title":"Simple File List <= 6.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121c8bcd-ebfd-4e2f-8417-836db846b5a4?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:47:39Z"},{"id":"wordfence:121cad41-d3cd-4042-b568-3d91909a38d3","source":"wordfence","cve":"CVE-2024-31939","title":"Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121cad41-d3cd-4042-b568-3d91909a38d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:55:07Z"},{"id":"wordfence:121d5d4d-cf15-4c20-afb5-aa3375f2ef62","source":"wordfence","cve":"CVE-2024-49260","title":"WordPress Gallery Plugin \u2013 Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121d5d4d-cf15-4c20-afb5-aa3375f2ef62?source=api-prod","affected":[{"type":"plugin","slug":"limb-gallery","name":"Limb Gallery | Create Beautiful Image & Video Galleries","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:24:48Z"},{"id":"wordfence:121d5d7c-3307-4fac-88d0-82cc19fc349c","source":"wordfence","cve":"CVE-2026-103342","title":"Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/121d5d7c-3307-4fac-88d0-82cc19fc349c?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T13:58:58Z","updated":"2026-10-08T23:18:44Z"},{"id":"wordfence:12263ca7-41d8-4ef2-b644-ddfcae8c9665","source":"wordfence","cve":"CVE-2016-10973","title":"Brafton < 3.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12263ca7-41d8-4ef2-b644-ddfcae8c9665?source=api-prod","affected":[{"type":"plugin","slug":"BraftonWordpressPlugin","name":"Brafton","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":false,"patched_in":"3.4.8"}],"published":"2016-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1227f3bc-0bb3-4b80-ad69-2d4314fafbe4","source":"wordfence","cve":"CVE-2024-1447","title":"Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1227f3bc-0bb3-4b80-ad69-2d4314fafbe4?source=api-prod","affected":[{"type":"plugin","slug":"sydney-toolbox","name":"Sydney Toolbox","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T18:56:20Z"},{"id":"wordfence:122a08f7-4e82-494a-b1a9-00ae3d9465ff","source":"wordfence","cve":"CVE-2024-51856","title":"Moose Elementor Kit <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/122a08f7-4e82-494a-b1a9-00ae3d9465ff?source=api-prod","affected":[{"type":"plugin","slug":"moose-elementor-kit","name":"Moose Elementor Kit","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-20T00:17:35Z"},{"id":"wordfence:122b75d2-e882-45b9-baf1-acf847f8d60a","source":"wordfence","cve":"CVE-2024-5483","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/122b75d2-e882-45b9-baf1-acf847f8d60a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8","to_inclusive":true,"patched_in":"4.2.6.8.1"}],"published":"2024-06-04T14:20:10Z","updated":"2024-06-05T02:34:32Z"},{"id":"wordfence:12316a14-57e9-4e00-ad6b-04df3b169d73","source":"wordfence","cve":"CVE-2026-96648","title":"Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12316a14-57e9-4e00-ad6b-04df3b169d73?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.15.1","to_inclusive":true,"patched_in":"1.15.3"}],"published":"2026-10-09T15:29:34Z","updated":"2026-10-10T04:26:43Z"},{"id":"wordfence:12349179-e61c-42b8-b0ff-5b49fc4906c1","source":"wordfence","cve":"CVE-2024-11437","title":"Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12349179-e61c-42b8-b0ff-5b49fc4906c1?source=api-prod","affected":[{"type":"plugin","slug":"timeline-designer","name":"Timeline Designer","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-01-06T15:09:42Z","updated":"2025-08-15T14:21:19Z"},{"id":"wordfence:1237f0b3-540a-4734-8966-4798799fef65","source":"wordfence","cve":"CVE-2024-30536","title":"Slugs Manager <= 2.6.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1237f0b3-540a-4734-8966-4798799fef65?source=api-prod","affected":[{"type":"plugin","slug":"remove-old-slugspermalinks","name":"Slugs Manager: Delete Old Permalinks from WordPress Database","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:42:39Z"},{"id":"wordfence:1239fa45-f914-4922-ac4e-c0753553730a","source":"wordfence","cve":"CVE-2026-42690","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1239fa45-f914-4922-ac4e-c0753553730a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T21:14:38Z"},{"id":"wordfence:123ac22c-545b-4deb-b31a-29f6dba15018","source":"wordfence","cve":"CVE-2025-66117","title":"Easy Form <= 2.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/123ac22c-545b-4deb-b31a-29f6dba15018?source=api-prod","affected":[{"type":"plugin","slug":"easy-form","name":"Easy Form","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-20T19:57:57Z"},{"id":"wordfence:123c0279-a7f6-4a4b-a5e1-79702e295303","source":"wordfence","cve":"CVE-2025-32679","title":"User Registration Using Contact Form 7 <= 2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/123c0279-a7f6-4a4b-a5e1-79702e295303?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-using-contact-form-7","name":"User Registration Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-12-19T14:24:39Z"},{"id":"wordfence:123c2958-3335-4212-8ed0-b2a56a5272f3","source":"wordfence","cve":"CVE-2022-30544","title":"OSM - OpenStreetMap <= 6.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/123c2958-3335-4212-8ed0-b2a56a5272f3?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:123d6216-3174-40c9-bdb9-405e5a5ca129","source":"wordfence","cve":"CVE-2024-30438","title":"Print Page block <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/123d6216-3174-40c9-bdb9-405e5a5ca129?source=api-prod","affected":[{"type":"plugin","slug":"print-page","name":"Print Page Block \u2013 make any page printable in one click","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T21:02:26Z"},{"id":"wordfence:123e1758-3384-4ea7-96dd-d6adcce40392","source":"wordfence","cve":"CVE-2026-6226","title":"Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/123e1758-3384-4ea7-96dd-d6adcce40392?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.2","to_inclusive":true,"patched_in":"3.29.3"}],"published":"2026-05-27T00:00:00Z","updated":"2026-05-28T08:27:39Z"},{"id":"wordfence:1243c93c-d6ff-4353-bd14-ba0170caf580","source":"wordfence","cve":"CVE-2025-23973","title":"SpecFit-Virtual Try On Woocommerce <= 10.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1243c93c-d6ff-4353-bd14-ba0170caf580?source=api-prod","affected":[{"type":"plugin","slug":"try-on-for-woocommerce","name":"SpecFit | Try & Shop \u2013 AI Virtual Try-On for WooCommerce","from":"*","from_inclusive":true,"to":"10.0.21","to_inclusive":true,"patched_in":"10.0.22"}],"published":"2025-06-18T00:00:00Z","updated":"2026-06-18T13:39:33Z"},{"id":"wordfence:12443e0c-2a03-4f62-bf89-cf0497f44a26","source":"wordfence","cve":"CVE-2025-8722","title":"Content Views <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12443e0c-2a03-4f62-bf89-cf0497f44a26?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-09-05T14:43:59Z","updated":"2025-09-06T03:22:36Z"},{"id":"wordfence:12447571-7770-4872-afb3-eaf11d5b47cf","source":"wordfence","cve":"CVE-2025-32112","title":"Sidebar Manager Light <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12447571-7770-4872-afb3-eaf11d5b47cf?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-manager-light","name":"Sidebar Manager Light","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T18:28:16Z"},{"id":"wordfence:124bf96a-9ace-428a-897b-24243d5cb260","source":"wordfence","cve":"CVE-2026-23803","title":"Smart Auto Upload Images \u2013 Import External Images <= 1.2.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/124bf96a-9ace-428a-897b-24243d5cb260?source=api-prod","affected":[{"type":"plugin","slug":"smart-auto-upload-images","name":"Smart Auto Upload Images \u2013 Import External Images","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-01-03T00:00:00Z","updated":"2026-05-04T15:18:12Z"},{"id":"wordfence:124f2b72-d8da-46ba-844f-e9cc01441702","source":"wordfence","cve":"CVE-2026-13731","title":"WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/124f2b72-d8da-46ba-844f-e9cc01441702?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.4.9","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2026-06-30T15:06:02Z","updated":"2026-07-01T03:43:34Z"},{"id":"wordfence:124f4cd0-68a8-4d6c-8112-a3b03e5a49b1","source":"wordfence","cve":"CVE-2025-14429","title":"AeroLand <= 1.6.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/124f4cd0-68a8-4d6c-8112-a3b03e5a49b1?source=api-prod","affected":[{"type":"theme","slug":"aeroland","name":"AeroLand - App Landing Software Website WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:40:07Z"},{"id":"wordfence:12515236-753e-49e8-b8c8-b0c8831c6005","source":"wordfence","cve":"CVE-2024-9269","title":"Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12515236-753e-49e8-b8c8-b0c8831c6005?source=api-prod","affected":[{"type":"plugin","slug":"relogo","name":"Relogo","from":"*","from_inclusive":true,"to":"0.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:22:28Z","updated":"2024-10-01T07:30:08Z"},{"id":"wordfence:125277bc-5232-49bd-8f29-3aa8e0ee354b","source":"wordfence","cve":"CVE-2025-31405","title":"Fami WooCommerce Compare <= 1.0.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125277bc-5232-49bd-8f29-3aa8e0ee354b?source=api-prod","affected":[{"type":"plugin","slug":"fami-woocommerce-compare","name":"Fami WooCommerce Compare","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:43:38Z"},{"id":"wordfence:12532f84-bc76-4968-a01f-f879ab41b901","source":"wordfence","cve":"CVE-2023-6165","title":"Restrict Usernames Emails Characters <= 3.1.3 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12532f84-bc76-4968-a01f-f879ab41b901?source=api-prod","affected":[{"type":"plugin","slug":"restrict-usernames-emails-characters","name":"Restrict Usernames Emails Characters","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T20:31:27Z"},{"id":"wordfence:125354d8-95b5-4498-be66-8673b6d9aaff","source":"wordfence","cve":"CVE-2025-23636","title":"My Favorite Car <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125354d8-95b5-4498-be66-8673b6d9aaff?source=api-prod","affected":[{"type":"plugin","slug":"my-favorite-cars","name":"My Favorite Car","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:47:59Z"},{"id":"wordfence:1254e0ad-852e-4fd4-8317-61bfbbc9f737","source":"wordfence","cve":"","title":"External Links <= 2.55 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1254e0ad-852e-4fd4-8317-61bfbbc9f737?source=api-prod","affected":[{"type":"plugin","slug":"wp-external-links","name":"External Links \u2013 nofollow, noopener & new window","from":"*","from_inclusive":true,"to":"2.55","to_inclusive":true,"patched_in":"2.56"}],"published":"2022-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:125517dd-7caf-4774-9e21-e8648b633657","source":"wordfence","cve":"CVE-2024-54395","title":"Increase Sociability <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125517dd-7caf-4774-9e21-e8648b633657?source=api-prod","affected":[{"type":"plugin","slug":"increase-sociability","name":"Increase Sociability","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:53:14Z"},{"id":"wordfence:12560b8e-9c47-4f7f-ac9c-d86f17914ba3","source":"wordfence","cve":"CVE-2023-2549","title":"Feather Login Page 1.0.7 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12560b8e-9c47-4f7f-ac9c-d86f17914ba3?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"1.0.7","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12573522-b708-43cb-802c-f5f9fbffbc8d","source":"wordfence","cve":"CVE-2026-124413","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12573522-b708-43cb-802c-f5f9fbffbc8d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:10Z"},{"id":"wordfence:1257da54-e008-4e25-bc83-36246f00960e","source":"wordfence","cve":"CVE-2021-34625","title":"WP Upload Restriction <= 2.2.4 \u2013 Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1257da54-e008-4e25-bc83-36246f00960e?source=api-prod","affected":[{"type":"plugin","slug":"wp-upload-restriction","name":"WP Upload Restriction","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2021-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12589b0a-5067-4368-a5a8-639cf381c0a6","source":"wordfence","cve":"CVE-2023-5971","title":"Save as PDF Plugin by Pdfcrowd <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12589b0a-5067-4368-a5a8-639cf381c0a6?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-16T12:42:15Z"},{"id":"wordfence:125a1d8d-8cd9-439c-b765-198ad369f987","source":"wordfence","cve":"CVE-2024-11436","title":"Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125a1d8d-8cd9-439c-b765-198ad369f987?source=api-prod","affected":[{"type":"plugin","slug":"pie-forms-for-wp","name":"Pie Forms \u2014 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.4.19","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-07T01:45:48Z"},{"id":"wordfence:125e11a3-c497-484e-940b-2bcdf7f2c1ab","source":"wordfence","cve":"CVE-2021-42548","title":"Share-one-Drive <= 1.15.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125e11a3-c497-484e-940b-2bcdf7f2c1ab?source=api-prod","affected":[{"type":"plugin","slug":"share-one-drive","name":"Share-one-Drive","from":"*","from_inclusive":true,"to":"1.15.3","to_inclusive":false,"patched_in":"1.15.3"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:125e7ea3-574a-4760-b10b-7a98d94c87a5","source":"wordfence","cve":"CVE-2023-2841","title":"Advanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125e7ea3-574a-4760-b10b-7a98d94c87a5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-local-pickup-for-woocommerce","name":"Advanced Local Pickup for WooCommerce \u2013 Click & Collect, In-Store Pickup","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:125eb557-0566-48e2-a966-f9255e877e0f","source":"wordfence","cve":"CVE-2024-12280","title":"WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/125eb557-0566-48e2-a966-f9255e877e0f?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.2.4","to_inclusive":true,"patched_in":"8.2.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-18T14:33:40Z"},{"id":"wordfence:1261881f-7a04-47fb-8176-6a9ac2088f8d","source":"wordfence","cve":"CVE-2026-15664","title":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1261881f-7a04-47fb-8176-6a9ac2088f8d?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-09-18T19:22:19Z","updated":"2026-09-19T07:43:12Z"},{"id":"wordfence:1261ad29-e4c1-4385-9f41-d3f3eecbb7dc","source":"wordfence","cve":"","title":"Feather12 (Unkown Versions) - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1261ad29-e4c1-4385-9f41-d3f3eecbb7dc?source=api-prod","affected":[{"type":"theme","slug":"feather12","name":"Feather12","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12643dd9-3b5e-45ea-9a64-a5b00c9202c8","source":"wordfence","cve":"CVE-2025-7374","title":"WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.7"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-10T11:17:08Z"},{"id":"wordfence:12660851-c899-4ec2-b40e-e62391dafdbf","source":"wordfence","cve":"CVE-2023-28667","title":"Lead Generated <= 1.23 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12660851-c899-4ec2-b40e-e62391dafdbf?source=api-prod","affected":[{"type":"plugin","slug":"lead-generated","name":"Lead Generated","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.25"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12660e7a-51fc-42c5-8a09-49df1db51efb","source":"wordfence","cve":"CVE-2023-47813","title":"Better RSS Widget <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12660e7a-51fc-42c5-8a09-49df1db51efb?source=api-prod","affected":[{"type":"plugin","slug":"better-rss-widget","name":"Better RSS Widget","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1266c6df-214b-4b6b-8f1d-a67385469bf5","source":"wordfence","cve":"CVE-2024-2256","title":"oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1266c6df-214b-4b6b-8f1d-a67385469bf5?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.2"}],"published":"2024-03-14T00:00:00Z","updated":"2024-03-14T20:34:23Z"},{"id":"wordfence:1268604c-08eb-4d86-8e97-9cdaa3e19c1f","source":"wordfence","cve":"CVE-2023-2893","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_deactivate_product","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1268604c-08eb-4d86-8e97-9cdaa3e19c1f?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1268bdb9-7f80-4fdc-a95a-d51b0ab83e17","source":"wordfence","cve":"CVE-2022-47430","title":"The School Management \u2013 Education & Learning Management <= 4.1 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1268bdb9-7f80-4fdc-a95a-d51b0ab83e17?source=api-prod","affected":[{"type":"plugin","slug":"school-management-system","name":"The School Management \u2013 Education & Learning ERP","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:126c77fa-11c5-431f-8fc9-0375ed6c8a91","source":"wordfence","cve":"CVE-2024-9583","title":"RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/126c77fa-11c5-431f-8fc9-0375ed6c8a91?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.23.12","to_inclusive":true,"patched_in":"4.23.13"}],"published":"2024-10-22T18:44:01Z","updated":"2024-10-23T06:45:05Z"},{"id":"wordfence:126e2b92-322e-440c-a924-1b604330f164","source":"wordfence","cve":"CVE-2025-12086","title":"Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/126e2b92-322e-440c-a924-1b604330f164?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-11-20T18:57:45Z","updated":"2025-11-21T07:31:49Z"},{"id":"wordfence:12735e6b-9ed5-4bf6-ab72-36a5218fa43c","source":"wordfence","cve":"CVE-2025-39433","title":"Bknewsticker <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12735e6b-9ed5-4bf6-ab72-36a5218fa43c?source=api-prod","affected":[{"type":"plugin","slug":"bknewsticker","name":"Bknewsticker","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:34:59Z"},{"id":"wordfence:127691c4-dc63-44e0-b591-b342a3809888","source":"wordfence","cve":"CVE-2024-10892","title":"Cost Calculator Builder <= 3.2.42 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/127691c4-dc63-44e0-b591-b342a3809888?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.42","to_inclusive":true,"patched_in":"3.2.43"}],"published":"2024-11-27T00:00:00Z","updated":"2025-01-08T15:21:22Z"},{"id":"wordfence:12772ebe-b146-4cff-bc95-3ec7045f15ab","source":"wordfence","cve":"CVE-2024-2430","title":"Website Content in Page or Post <= 2024.03.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12772ebe-b146-4cff-bc95-3ec7045f15ab?source=api-prod","affected":[{"type":"plugin","slug":"show-website-content-in-wordpress-page-or-post","name":"Website Content in Page or Post \u2013 Embed website content in posts and pages","from":"*","from_inclusive":true,"to":"2024.03.27","to_inclusive":true,"patched_in":"2024.04.09"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-01T14:37:56Z"},{"id":"wordfence:12777db6-125e-42dc-b4b5-694826ec3579","source":"wordfence","cve":"CVE-2025-58248","title":"Pinterest Pinboard Widget <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12777db6-125e-42dc-b4b5-694826ec3579?source=api-prod","affected":[{"type":"plugin","slug":"pinterest-pinboard-widget","name":"Pinterest Pinboard Widget","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:38:37Z"},{"id":"wordfence:127b20c4-cd7c-4d04-b32f-bcc26beb2c35","source":"wordfence","cve":"CVE-2024-4543","title":"Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/127b20c4-cd7c-4d04-b32f-bcc26beb2c35?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-variables","name":"Snippet Shortcodes","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2024-07-02T00:00:00Z","updated":"2024-07-03T04:31:34Z"},{"id":"wordfence:12817b77-17d0-418c-a9a1-87d0057da90e","source":"wordfence","cve":"CVE-2026-57317","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.12.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12817b77-17d0-418c-a9a1-87d0057da90e?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.2","to_inclusive":true,"patched_in":"1.6.12.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:56:26Z"},{"id":"wordfence:1281a4d8-fa77-45b4-b0b4-e3bed1b4a4ea","source":"wordfence","cve":"","title":"Euclid <= All Versions - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1281a4d8-fa77-45b4-b0b4-e3bed1b4a4ea?source=api-prod","affected":[{"type":"theme","slug":"euclid","name":"Euclid - Tech Corporate Multilingual WP Theme | Business","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12837ce3-eeeb-4034-a90d-fc615056a818","source":"wordfence","cve":"CVE-2018-8719","title":"WP Security Audit Log <= 3.1.1 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12837ce3-eeeb-4034-a90d-fc615056a818?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2018-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1283e839-8588-4a76-9c1e-61562526166d","source":"wordfence","cve":"CVE-2025-4389","title":"Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=api-prod","affected":[{"type":"plugin","slug":"crawlomatic-multipage-scraper-post-generator","name":"Crawlomatic Multipage Scraper Post Generator","from":"*","from_inclusive":true,"to":"2.6.8.1","to_inclusive":true,"patched_in":"2.6.8.2"}],"published":"2025-05-16T16:29:47Z","updated":"2025-05-17T05:30:34Z"},{"id":"wordfence:12849d7e-1685-4e03-be0c-0672545fcd2b","source":"wordfence","cve":"","title":"Express Shop <= 4.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12849d7e-1685-4e03-be0c-0672545fcd2b?source=api-prod","affected":[{"type":"plugin","slug":"express-shop","name":"Express Shop for WooCommerce Product Table","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1285322f-be3a-4015-b96d-79589a0897c8","source":"wordfence","cve":"CVE-2026-96570","title":"Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1285322f-be3a-4015-b96d-79589a0897c8?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.67","to_inclusive":true,"patched_in":"1.68"}],"published":"2026-10-15T16:55:01Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:12891613-1447-4e5d-bf01-fa14abe6e9d6","source":"wordfence","cve":"CVE-2024-51607","title":"Golf Tracker <= 0.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12891613-1447-4e5d-bf01-fa14abe6e9d6?source=api-prod","affected":[{"type":"plugin","slug":"golf-tracker","name":"Golf Tracker","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:34:52Z"},{"id":"wordfence:1289ead7-1af1-417d-aa47-7d07268f956c","source":"wordfence","cve":"","title":"Popup Box <= 3.7.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1289ead7-1af1-417d-aa47-7d07268f956c?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:128bc7ee-9763-415f-b726-0e63d4b62271","source":"wordfence","cve":"CVE-2024-13374","title":"WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128bc7ee-9763-415f-b726-0e63d4b62271?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-manager","name":"WP Table Manager","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T05:28:40Z"},{"id":"wordfence:128c6ab5-ddcf-4775-b390-db49da79e548","source":"wordfence","cve":"CVE-2025-5920","title":"Sharable Password Protected Posts <= 1.1.0 - Unauthenticated Password protected Post Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128c6ab5-ddcf-4775-b390-db49da79e548?source=api-prod","affected":[{"type":"plugin","slug":"sharable-password-protected-posts","name":"Private Post Share","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-06-13T00:00:00Z","updated":"2025-07-09T15:28:09Z"},{"id":"wordfence:128cad05-4dda-47fe-bbb4-471371613728","source":"wordfence","cve":"CVE-2025-23680","title":"Narnoo Operator <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128cad05-4dda-47fe-bbb4-471371613728?source=api-prod","affected":[{"type":"plugin","slug":"narnoo-shortcodes","name":"Narnoo Operator","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:08:37Z"},{"id":"wordfence:128d3046-94a0-465c-9225-a3ce652f5282","source":"wordfence","cve":"CVE-2023-50824","title":"Insert or Embed Articulate Content into WordPress <= 4.3000000021 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128d3046-94a0-465c-9225-a3ce652f5282?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000021","to_inclusive":true,"patched_in":"4.3000000023"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-24T14:07:20Z"},{"id":"wordfence:128d45ec-941c-414c-b341-9964dc748132","source":"wordfence","cve":"CVE-2024-9306","title":"WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128d45ec-941c-414c-b341-9964dc748132?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.6","to_inclusive":true,"patched_in":"10.6.1"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T06:48:41Z"},{"id":"wordfence:128f0e5e-96c7-474e-bfc9-ea18536b4a54","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'layouts' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/128f0e5e-96c7-474e-bfc9-ea18536b4a54?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12913ac3-82a7-42e9-ba44-8e6577e0fbc7","source":"wordfence","cve":"CVE-2025-50031","title":"DB Backup <= 6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12913ac3-82a7-42e9-ba44-8e6577e0fbc7?source=api-prod","affected":[{"type":"plugin","slug":"db-backup","name":"DB Backup","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:56:03Z"},{"id":"wordfence:12923175-4db4-4afc-9e9b-b9f139f24a79","source":"wordfence","cve":"CVE-2026-111178","title":"WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12923175-4db4-4afc-9e9b-b9f139f24a79?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.1","to_inclusive":true,"patched_in":"2.1.0.2"}],"published":"2026-10-15T17:35:14Z","updated":"2026-10-16T06:41:00Z"},{"id":"wordfence:129343bc-c049-4ced-9451-e6083558c814","source":"wordfence","cve":"CVE-2025-62905","title":"Query Posts <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/129343bc-c049-4ced-9451-e6083558c814?source=api-prod","affected":[{"type":"plugin","slug":"query-posts","name":"Query Posts","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2025-10-29T15:04:50Z"},{"id":"wordfence:12946a87-0b61-45ea-aae3-385d860b0db8","source":"wordfence","cve":"CVE-2015-9536","title":"Easy Digital Downloads (EDD) Twenty-Twelve < 1.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12946a87-0b61-45ea-aae3-385d860b0db8?source=api-prod","affected":[{"type":"theme","slug":"twenty-twelve-edd","name":"Twenty Twelve EDD","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12959cc5-d088-4e2c-8658-e54900839aa6","source":"wordfence","cve":"CVE-2026-40784","title":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 1.91.2 - Authenticated (Board Member+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12959cc5-d088-4e2c-8658-e54900839aa6?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"1.91.2","to_inclusive":true,"patched_in":"1.91.3"}],"published":"2026-04-15T00:00:00Z","updated":"2026-04-21T15:35:14Z"},{"id":"wordfence:1295f1a0-1f5a-4707-96cc-c408a6819e87","source":"wordfence","cve":"","title":"Elegant Themes (Various Versions) - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1295f1a0-1f5a-4707-96cc-c408a6819e87?source=api-prod","affected":[{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":true,"patched_in":"2.17.3"},{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"3.17.2","to_inclusive":true,"patched_in":"3.17.3"},{"type":"theme","slug":"extra","name":"Divi Extra","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":true,"patched_in":"2.17.3"}],"published":"2018-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:129cc3b0-4f48-4846-902e-be5cd339f537","source":"wordfence","cve":"CVE-2024-2345","title":"FileBird \u2013 WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/129cc3b0-4f48-4846-902e-be5cd339f537?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-31T15:30:07Z"},{"id":"wordfence:129f810d-ff83-4428-9f98-6a6aa8817783","source":"wordfence","cve":"CVE-2025-7384","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/129f810d-ff83-4428-9f98-6a6aa8817783?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-13T04:22:58Z"},{"id":"wordfence:12a1085e-fd28-4f3a-a0e0-9de15a42756d","source":"wordfence","cve":"CVE-2025-68893","title":"Image shrinker <= 1.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a1085e-fd28-4f3a-a0e0-9de15a42756d?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-shrinker","name":"WordPress Image shrinker","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-27T00:00:00Z","updated":"2026-01-06T14:52:18Z"},{"id":"wordfence:12a12f2d-c9d0-437c-9cb0-d5fff7a09d5f","source":"wordfence","cve":"CVE-2026-97300","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a12f2d-c9d0-437c-9cb0-d5fff7a09d5f?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.1.26"}],"published":"2026-10-05T14:36:48Z","updated":"2026-10-09T00:17:14Z"},{"id":"wordfence:12a195a0-f992-462d-9b4e-69e8a2975635","source":"wordfence","cve":"CVE-2023-51354","title":"Webba Booking <= 4.5.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a195a0-f992-462d-9b4e-69e8a2975635?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"4.5.33","to_inclusive":true,"patched_in":"5.0"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12a296db-ecc0-409b-8718-0c208504053a","source":"wordfence","cve":"CVE-2026-4020","title":"Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=api-prod","affected":[{"type":"plugin","slug":"gravitysmtp","name":"Gravity SMTP","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-03-30T12:09:08Z","updated":"2026-05-13T17:53:32Z"},{"id":"wordfence:12a576ee-f8a9-4740-b87b-091a46970d53","source":"wordfence","cve":"CVE-2023-31214","title":"WP Quick Post Duplicator <= 2.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a576ee-f8a9-4740-b87b-091a46970d53?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-post-duplicator","name":"WP Quick Post Duplicator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-24T01:31:21Z"},{"id":"wordfence:12a750c6-85b6-48fc-b006-adf0121610dc","source":"wordfence","cve":"CVE-2025-10181","title":"Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a750c6-85b6-48fc-b006-adf0121610dc?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-09-19T00:00:00Z","updated":"2025-09-20T04:27:55Z"},{"id":"wordfence:12a89b8f-554c-4d92-adb2-ec84138d568d","source":"wordfence","cve":"CVE-2025-6538","title":"Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a89b8f-554c-4d92-adb2-ec84138d568d?source=api-prod","affected":[{"type":"plugin","slug":"post-rating-and-review","name":"Post Rating and Review","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T14:06:26Z","updated":"2025-06-26T02:06:32Z"},{"id":"wordfence:12a94f5b-bc30-4a65-b397-54488c836ec3","source":"wordfence","cve":"CVE-2023-0583","title":"VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a94f5b-bc30-4a65-b397-54488c836ec3?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.57.0.5","to_inclusive":true,"patched_in":"1.57.0.10"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12a9fbe8-445a-478a-b6ce-cd669ccb6a2d","source":"wordfence","cve":"CVE-2023-5860","title":"Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12a9fbe8-445a-478a-b6ce-cd669ccb6a2d?source=api-prod","affected":[{"type":"plugin","slug":"icons-font-loader","name":"Icons Font Loader \u2013 use web icons anywhere on your site, fast","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12ab3e54-a0b9-4420-ac90-f16e23688cca","source":"wordfence","cve":"CVE-2024-13640","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ab3e54-a0b9-4420-ac90-f16e23688cca?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T04:21:04Z"},{"id":"wordfence:12acf651-6476-491b-84b3-afbc6c655b17","source":"wordfence","cve":"CVE-2023-3186","title":"Popup by Supsystic <= 1.10.18 - Prototype Pollution","severity":"high","cvss":7.1,"cwe":"CWE-1321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12acf651-6476-491b-84b3-afbc6c655b17?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.19","to_inclusive":false,"patched_in":"1.10.19"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12ad3c6c-9a01-4801-b754-79e6e1b2d2a3","source":"wordfence","cve":"","title":"WooCommerce Product Carousel, Slider & Grid Ultimate <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ad3c6c-9a01-4801-b754-79e6e1b2d2a3?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12adf619-4be8-4ecf-8f67-284fc44d87d0","source":"wordfence","cve":"CVE-2024-27955","title":"Automatic <= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12adf619-4be8-4ecf-8f67-284fc44d87d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.92.0","to_inclusive":true,"patched_in":"3.92.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:32:19Z"},{"id":"wordfence:12b14418-28f0-4786-b8f8-a637fe007b6c","source":"wordfence","cve":"CVE-2025-13667","title":"WP Recipe Manager <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b14418-28f0-4786-b8f8-a637fe007b6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-manager","name":"WP Recipe Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:28:14Z","updated":"2026-01-07T09:20:52Z"},{"id":"wordfence:12b1b1b4-a62f-451e-a78d-c1d85202a4cf","source":"wordfence","cve":"CVE-2024-11356","title":"Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b1b1b4-a62f-451e-a78d-c1d85202a4cf?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":false,"patched_in":"5.3.4"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-18T14:55:06Z"},{"id":"wordfence:12b4d9e6-761f-4857-a701-7d22d4ee0288","source":"wordfence","cve":"","title":"Make, formerly Integromat Connector <= 1.5.1 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b4d9e6-761f-4857-a701-7d22d4ee0288?source=api-prod","affected":[{"type":"plugin","slug":"integromat-connector","name":"Make Connector","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12b4e363-248f-469a-a958-0b1ec5c6e37f","source":"wordfence","cve":"CVE-2024-12271","title":"360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b4e363-248f-469a-a958-0b1ec5c6e37f?source=api-prod","affected":[{"type":"plugin","slug":"360deg-javascript-viewer","name":"360 Javascript Viewer","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T12:42:13Z"},{"id":"wordfence:12b808a9-93d8-4fd4-b194-044f3a5376b8","source":"wordfence","cve":"CVE-2024-50417","title":"Bold Page Builder <= 5.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b808a9-93d8-4fd4-b194-044f3a5376b8?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:22:13Z"},{"id":"wordfence:12b81441-d22c-4211-a8da-811182de622d","source":"wordfence","cve":"","title":"Laposta Signup Embed <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12b81441-d22c-4211-a8da-811182de622d?source=api-prod","affected":[{"type":"plugin","slug":"laposta-signup-embed","name":"Laposta Signup Embed","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12bb4bb9-e908-43ad-8fb1-59418580f5e1","source":"wordfence","cve":"CVE-2025-12493","title":"ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12bb4bb9-e908-43ad-8fb1-59418580f5e1?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-11-03T00:00:00Z","updated":"2025-11-04T11:19:29Z"},{"id":"wordfence:12bcc338-9e16-410f-bf3b-3756bc9b7024","source":"wordfence","cve":"CVE-2025-10311","title":"Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12bcc338-9e16-410f-bf3b-3756bc9b7024?source=api-prod","affected":[{"type":"plugin","slug":"comment-info-detector","name":"Comment Info Detector","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:15:55Z","updated":"2025-10-03T11:17:07Z"},{"id":"wordfence:12bda95f-8d77-43ff-af22-9a574e0ca5e9","source":"wordfence","cve":"CVE-2026-116407","title":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar <= 6.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12bda95f-8d77-43ff-af22-9a574e0ca5e9?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2026-10-30T15:08:00Z","updated":"2026-11-03T19:31:37Z"},{"id":"wordfence:12be30fc-2d7e-4326-b949-45138796c1a9","source":"wordfence","cve":"CVE-2026-16062","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12be30fc-2d7e-4326-b949-45138796c1a9?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":false,"patched_in":"5.3.7"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:25:47Z"},{"id":"wordfence:12bebb01-74ea-4722-99ed-2322d35da8c2","source":"wordfence","cve":"CVE-2026-22340","title":"WPJobster <= 6.3.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12bebb01-74ea-4722-99ed-2322d35da8c2?source=api-prod","affected":[{"type":"theme","slug":"wpjobster","name":"Jobster","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:28:14Z"},{"id":"wordfence:12bf1cd8-cd55-4771-b2bb-597797b1b949","source":"wordfence","cve":"CVE-2026-5347","title":"WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12bf1cd8-cd55-4771-b2bb-597797b1b949?source=api-prod","affected":[{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2026-04-23T16:45:59Z","updated":"2026-04-24T05:29:41Z"},{"id":"wordfence:12c29a44-f9e4-439a-bc3f-18a3640f7924","source":"wordfence","cve":"CVE-2026-12937","title":"Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12c29a44-f9e4-439a-bc3f-18a3640f7924?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.22.7","to_inclusive":true,"patched_in":"2.22.8"}],"published":"2026-06-24T18:36:44Z","updated":"2026-06-25T06:51:35Z"},{"id":"wordfence:12c56bf6-ce9b-4c4b-ad7d-0fa54ad221f2","source":"wordfence","cve":"CVE-2026-32391","title":"SmartFix < 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12c56bf6-ce9b-4c4b-ad7d-0fa54ad221f2?source=api-prod","affected":[{"type":"theme","slug":"smartfix","name":"smartfix","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-15T20:56:19Z"},{"id":"wordfence:12c5f64d-1c17-4900-8372-daff5f31e645","source":"wordfence","cve":"CVE-2025-48312","title":"WPAvatar <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12c5f64d-1c17-4900-8372-daff5f31e645?source=api-prod","affected":[{"type":"plugin","slug":"wpavatar","name":"WPAvatar","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:20:53Z"},{"id":"wordfence:12c7661c-0700-4370-9272-d8a19b17006e","source":"wordfence","cve":"CVE-2026-15336","title":"Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12c7661c-0700-4370-9272-d8a19b17006e?source=api-prod","affected":[{"type":"plugin","slug":"catch-themes-demo-import","name":"Catch Themes Demo Import","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2026-07-15T13:49:24Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:12c9dc6c-22ed-4f60-a85c-83b660e69544","source":"wordfence","cve":"CVE-2026-81793","title":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12c9dc6c-22ed-4f60-a85c-83b660e69544?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:24:45Z"},{"id":"wordfence:12ce97ba-8053-481f-bcd7-05d5e8292adb","source":"wordfence","cve":"CVE-2023-2300","title":"Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ce97ba-8053-481f-bcd7-05d5e8292adb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-a-meeting-scheduler-by-vcita","name":"Contact Form Builder by vcita","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12cfebb8-ae89-410b-a492-340f1553e83e","source":"wordfence","cve":"CVE-2024-8965","title":"Absolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12cfebb8-ae89-410b-a492-340f1553e83e?source=api-prod","affected":[{"type":"plugin","slug":"absolute-reviews","name":"Absolute Reviews","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-09-26T00:00:00Z","updated":"2024-09-27T05:31:03Z"},{"id":"wordfence:12d29542-2b7a-428f-9733-c51bfde18b87","source":"wordfence","cve":"CVE-2025-62095","title":"Bootstrap Modals <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d29542-2b7a-428f-9733-c51bfde18b87?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-modals","name":"Bootstrap Modals","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:23:26Z"},{"id":"wordfence:12d2f4fd-fa4d-4583-91fb-7a1f2708ad8a","source":"wordfence","cve":"CVE-2026-22431","title":"Wabi-Sabi <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d2f4fd-fa4d-4583-91fb-7a1f2708ad8a?source=api-prod","affected":[{"type":"theme","slug":"wabi-sabi","name":"wabi-sabi","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:37:34Z"},{"id":"wordfence:12d370c8-ab17-4f84-8b1b-224a30802753","source":"wordfence","cve":"CVE-2025-47576","title":"Bimber - Viral Magazine WordPress Theme <= 9.2.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d370c8-ab17-4f84-8b1b-224a30802753?source=api-prod","affected":[{"type":"theme","slug":"bimber","name":"Bimber - Viral Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"9.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-13T00:00:00Z","updated":"2025-05-22T13:22:22Z"},{"id":"wordfence:12d465d2-cd89-476e-b70a-743151a23053","source":"wordfence","cve":"CVE-2025-6215","title":"Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d465d2-cd89-476e-b70a-743151a23053?source=api-prod","affected":[{"type":"plugin","slug":"omnishop","name":"Omnishop \u2013 Mobile shop apps complementing your WooCommerce webshop","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T14:02:17Z","updated":"2025-07-23T02:24:37Z"},{"id":"wordfence:12d58869-4b5c-4150-9df3-596f7db616f7","source":"wordfence","cve":"CVE-2025-15655","title":"School Management <= 93.2.0 - Authenticated (Support staff+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d58869-4b5c-4150-9df3-596f7db616f7?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2026-09-18T14:31:54Z"},{"id":"wordfence:12d7a152-90cd-4c92-90c4-81c594e6c9ac","source":"wordfence","cve":"","title":"Booking Ultra Pro <= 1.1.5 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d7a152-90cd-4c92-90c4-81c594e6c9ac?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12d84de4-d97e-40cc-9805-fc9b7de8fa21","source":"wordfence","cve":"CVE-2023-25704","title":"Interactive SVG Image Map Builder <= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12d84de4-d97e-40cc-9805-fc9b7de8fa21?source=api-prod","affected":[{"type":"plugin","slug":"interactive-image-map-builder","name":"Interactive Image Map Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12da096e-35f1-4e44-9425-15a393831139","source":"wordfence","cve":"CVE-2025-60061","title":"Kicker <= 2.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12da096e-35f1-4e44-9425-15a393831139?source=api-prod","affected":[{"type":"theme","slug":"kicker","name":"Kicker - Blog Magazine Theme","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:41:11Z"},{"id":"wordfence:12da87e1-6a44-4b36-be7c-8d7ec51d71d7","source":"wordfence","cve":"CVE-2025-58659","title":"Helpie FAQ <= 1.45 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12da87e1-6a44-4b36-be7c-8d7ec51d71d7?source=api-prod","affected":[{"type":"plugin","slug":"helpie-faq","name":"Helpie FAQ \u2014 Accordion, Docs & Knowledge Base","from":"*","from_inclusive":true,"to":"1.45","to_inclusive":true,"patched_in":"1.46"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-15T18:13:28Z"},{"id":"wordfence:12dc548c-01df-4934-9d18-1d4584545599","source":"wordfence","cve":"CVE-2025-22783","title":"SEO Plugin by Squirrly SEO <= 12.4.03 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc548c-01df-4934-9d18-1d4584545599?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.03","to_inclusive":true,"patched_in":"12.4.06"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:20:30Z"},{"id":"wordfence:12dc6952-d7a8-46da-ba7b-e8816c9c7cbf","source":"wordfence","cve":"CVE-2024-12173","title":"Master Slider <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc6952-d7a8-46da-ba7b-e8816c9c7cbf?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2025-01-29T00:00:00Z","updated":"2025-02-26T22:12:03Z"},{"id":"wordfence:12dc9e63-17bb-4755-be3c-ae8b26edd3cd","source":"wordfence","cve":"CVE-2024-1536","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc9e63-17bb-4755-be3c-ae8b26edd3cd?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:26:34Z"},{"id":"wordfence:12ddef9e-6aa3-4b0b-bbee-6ac985f6865a","source":"wordfence","cve":"CVE-2024-35775","title":"Slider by Soliloquy <= 2.7.6 - Missing Authorization to Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ddef9e-6aa3-4b0b-bbee-6ac985f6865a?source=api-prod","affected":[{"type":"plugin","slug":"soliloquy-lite","name":"Slider by Soliloquy \u2013 Responsive Image Slider for WordPress","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:50:52Z"},{"id":"wordfence:12e2645c-7df1-4fbe-baa1-6b932062682b","source":"wordfence","cve":"CVE-2016-10965","title":"Real3D Flipbook <= 1.0.0 - Directory Traversal","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12e2645c-7df1-4fbe-baa1-6b932062682b?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2016-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12e64de4-d50f-44df-b150-d23ec9f3a0d5","source":"wordfence","cve":"CVE-2024-53809","title":"Namaste! LMS <= 2.6.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12e64de4-d50f-44df-b150-d23ec9f3a0d5?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.4.1","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T21:09:58Z"},{"id":"wordfence:12e74e1a-71d0-4447-ac77-62073af5de88","source":"wordfence","cve":"CVE-2019-9910","title":"KingComposer <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12e74e1a-71d0-4447-ac77-62073af5de88?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12ea26be-93e4-43de-bb32-21cdc2f80569","source":"wordfence","cve":"CVE-2021-24693","title":"Simple Download Monitor <= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail","severity":"critical","cvss":9.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ea26be-93e4-43de-bb32-21cdc2f80569?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12ec2c2f-a86c-4b8f-b7fd-5917e31e1cd0","source":"wordfence","cve":"CVE-2026-119070","title":"Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ec2c2f-a86c-4b8f-b7fd-5917e31e1cd0?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"4.2.18"}],"published":"2026-11-06T14:24:12Z","updated":"2026-11-07T02:29:12Z"},{"id":"wordfence:12ecb8ae-9aa3-4826-959e-cbac8eb5e76c","source":"wordfence","cve":"CVE-2026-23805","title":"Media Search Enhanced <= 0.9.1 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ecb8ae-9aa3-4826-959e-cbac8eb5e76c?source=api-prod","affected":[{"type":"plugin","slug":"media-search-enhanced","name":"Media Search Enhanced","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2026-01-07T00:00:00Z","updated":"2026-02-26T19:50:00Z"},{"id":"wordfence:12ecf3d5-1457-405a-8856-517c7d2f2db1","source":"wordfence","cve":"CVE-2021-4393","title":"eCommerce Product Catalog Plugin for WordPress <= 3.0.17 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12ecf3d5-1457-405a-8856-517c7d2f2db1?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":false,"patched_in":"3.0.18"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12f0394a-de18-4f61-b93d-34b30ae6106a","source":"wordfence","cve":"CVE-2026-39492","title":"WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f0394a-de18-4f61-b93d-34b30ae6106a?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:10:45Z"},{"id":"wordfence:12f093bd-5230-4103-b571-80543c1b43cf","source":"wordfence","cve":"CVE-2026-92715","title":"Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f093bd-5230-4103-b571-80543c1b43cf?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-16T14:55:54Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:12f1cbc1-42c1-4ace-88ec-8aa981367c85","source":"wordfence","cve":"CVE-2026-96574","title":"User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f1cbc1-42c1-4ace-88ec-8aa981367c85?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.12","to_inclusive":true,"patched_in":"4.3.13"}],"published":"2026-10-09T18:28:57Z","updated":"2026-10-10T06:40:09Z"},{"id":"wordfence:12f2d3d3-4cc1-4569-9183-62f4841e72f7","source":"wordfence","cve":"CVE-2026-110701","title":"CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f2d3d3-4cc1-4569-9183-62f4841e72f7?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.42","to_inclusive":true,"patched_in":"1.4.43"}],"published":"2026-10-15T17:57:19Z","updated":"2026-10-16T06:41:00Z"},{"id":"wordfence:12f314c5-ba73-4204-b276-904d9de7c099","source":"wordfence","cve":"CVE-2024-43242","title":"Indeed Membership Pro <= 12.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f314c5-ba73-4204-b276-904d9de7c099?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":true,"patched_in":"12.8"}],"published":"2024-08-12T00:00:00Z","updated":"2024-11-13T21:40:46Z"},{"id":"wordfence:12f319df-41eb-484a-8fca-af6ae76f4179","source":"wordfence","cve":"CVE-2024-12287","title":"Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f319df-41eb-484a-8fca-af6ae76f4179?source=api-prod","affected":[{"type":"plugin","slug":"biagiotti-membership","name":"Biagiotti Membership","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T07:02:45Z"},{"id":"wordfence:12f3dc64-322d-4015-8c57-eaa41c9a1829","source":"wordfence","cve":"CVE-2024-6180","title":"EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f3dc64-322d-4015-8c57-eaa41c9a1829?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.15","to_inclusive":true,"patched_in":"2.2.16"}],"published":"2024-07-08T19:38:22Z","updated":"2024-07-30T20:03:06Z"},{"id":"wordfence:12f73a24-3301-499f-8e49-87b151f87f66","source":"wordfence","cve":"CVE-2025-29003","title":"The Holiday Calendar <= 1.18.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f73a24-3301-499f-8e49-87b151f87f66?source=api-prod","affected":[{"type":"plugin","slug":"the-holiday-calendar","name":"The Holiday Calendar","from":"*","from_inclusive":true,"to":"1.18.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:31:54Z"},{"id":"wordfence:12f7c109-2752-4584-99e4-d94dafe3e81a","source":"wordfence","cve":"CVE-2025-68026","title":"LC Wizard <= 2.1.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f7c109-2752-4584-99e4-d94dafe3e81a?source=api-prod","affected":[{"type":"plugin","slug":"ghl-wizard","name":"Connector Wizard (formerly LC Wizard)","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:30:34Z"},{"id":"wordfence:12f7f9a0-96b0-4a61-b763-12ff679bf43d","source":"wordfence","cve":"","title":"Coru LFMember <= 1.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f7f9a0-96b0-4a61-b763-12ff679bf43d?source=api-prod","affected":[{"type":"plugin","slug":"coru-lfmember","name":"Coru LFMember","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:12f9464b-d3d5-4000-8839-c63c77eca9b5","source":"wordfence","cve":"CVE-2025-58207","title":"Ai Image Alt Text Generator for WP <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12f9464b-d3d5-4000-8839-c63c77eca9b5?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-alt-text-generator-for-wp","name":"Ai Image Alt Text Generator for WP","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-08-23T00:00:00Z","updated":"2025-11-12T13:57:36Z"},{"id":"wordfence:12fb237d-348c-4b3d-bc8e-21ab85ec49b4","source":"wordfence","cve":"CVE-2025-31595","title":"Timeline Event History <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12fb237d-348c-4b3d-bc8e-21ab85ec49b4?source=api-prod","affected":[{"type":"plugin","slug":"timeline-event-history","name":"Timeline Event History","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2026-01-16T11:29:02Z"},{"id":"wordfence:12fd3157-6dfc-478f-81eb-49db1fb66b7f","source":"wordfence","cve":"CVE-2026-19778","title":"WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12fd3157-6dfc-478f-81eb-49db1fb66b7f?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.23.7","to_inclusive":true,"patched_in":"2.23.8"}],"published":"2026-09-08T18:47:09Z","updated":"2026-09-09T07:40:55Z"},{"id":"wordfence:12fdf8e4-2408-4400-a5ce-82f77b34e725","source":"wordfence","cve":"CVE-2026-16985","title":"Squeeze <= 1.7.11 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12fdf8e4-2408-4400-a5ce-82f77b34e725?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.7.11","to_inclusive":true,"patched_in":"1.7.12"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:29:58Z"},{"id":"wordfence:12fe64ad-2998-4f41-b8d7-aa5921b0d0d9","source":"wordfence","cve":"CVE-2024-39663","title":"WP Fast Total Search <= 1.68.232 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/12fe64ad-2998-4f41-b8d7-aa5921b0d0d9?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.68.232","to_inclusive":true,"patched_in":"1.69.234"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:36:30Z"},{"id":"wordfence:1301c8af-d81a-40f1-96fa-e8252309d8a4","source":"wordfence","cve":"CVE-2024-2098","title":"Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary","severity":"high","cvss":7.5,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1301c8af-d81a-40f1-96fa-e8252309d8a4?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.89","to_inclusive":true,"patched_in":"3.2.90"}],"published":"2024-06-12T00:00:00Z","updated":"2024-06-13T05:34:46Z"},{"id":"wordfence:13031db7-aeac-4d44-94f9-1cdb84781a55","source":"wordfence","cve":"CVE-2017-15919","title":"Ultimate Form Builder Lite <= 1.3.6 - SQL Injection to PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13031db7-aeac-4d44-94f9-1cdb84781a55?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-form-builder-lite","name":"Contact Form for WordPress \u2013 Ultimate Form Builder Lite","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2017-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13033a3c-f020-4821-a7ad-bfcfca407df0","source":"wordfence","cve":"CVE-2018-0590","title":"Ultimate Member < 2.0.4 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13033a3c-f020-4821-a7ad-bfcfca407df0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2018-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13046019-f390-48ae-bf08-53293c41f178","source":"wordfence","cve":"CVE-2022-45828","title":"NOO Timetable <= 2.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13046019-f390-48ae-bf08-53293c41f178?source=api-prod","affected":[{"type":"plugin","slug":"noo-timetable","name":"NOO Timetable","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1305abf3-542a-4f97-bbe9-1568d697aa82","source":"wordfence","cve":"CVE-2025-54722","title":"WooTour <= 3.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1305abf3-542a-4f97-bbe9-1568d697aa82?source=api-prod","affected":[{"type":"theme","slug":"woo-tour","name":"WooTour","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-11-12T13:57:15Z"},{"id":"wordfence:130637ce-d70a-4831-8b88-a2a6e8a95c42","source":"wordfence","cve":"CVE-2024-1870","title":"Colibri Page Builder <= 1.0.260 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130637ce-d70a-4831-8b88-a2a6e8a95c42?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.260","to_inclusive":true,"patched_in":"1.0.263"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-09T09:37:46Z"},{"id":"wordfence:130759b9-dc5d-4b0b-a0af-84e750b9b18b","source":"wordfence","cve":"CVE-2024-52403","title":"User Management <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130759b9-dc5d-4b0b-a0af-84e750b9b18b?source=api-prod","affected":[{"type":"plugin","slug":"user-management","name":"User Management","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-11-13T00:00:00Z","updated":"2024-12-06T12:58:51Z"},{"id":"wordfence:13088645-8233-40fb-8755-cbdf44c0eaf7","source":"wordfence","cve":"CVE-2024-6687","title":"CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13088645-8233-40fb-8755-cbdf44c0eaf7?source=api-prod","affected":[{"type":"plugin","slug":"ctt-expresso-para-woocommerce","name":"CTT Expresso para WooCommerce","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2024-07-31T00:00:00Z","updated":"2024-08-01T01:59:32Z"},{"id":"wordfence:130ae053-2458-4789-a255-5df4753f1e8d","source":"wordfence","cve":"CVE-2024-56036","title":"odPhotogallery <= 0.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130ae053-2458-4789-a255-5df4753f1e8d?source=api-prod","affected":[{"type":"plugin","slug":"od-photogallery-plugin","name":"odPhotogalleryPlugin","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:02:55Z"},{"id":"wordfence:130b069d-d224-44af-b2b4-26be7e081f6b","source":"wordfence","cve":"CVE-2023-28499","title":"Slide Anything <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130b069d-d224-44af-b2b4-26be7e081f6b?source=api-prod","affected":[{"type":"plugin","slug":"slide-anything","name":"Slide Anything \u2013 Responsive Content / HTML Slider and Carousel","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:130c3bbf-19a9-4e11-b6f2-5a08bbf7b123","source":"wordfence","cve":"","title":"Mega Main Menu <= 2.2.2 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130c3bbf-19a9-4e11-b6f2-5a08bbf7b123?source=api-prod","affected":[{"type":"plugin","slug":"mega_main_menu","name":"Mega Main Menu","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:130ca8ea-74ac-4e0e-ada1-1694d0de7b94","source":"wordfence","cve":"CVE-2025-46505","title":"Peekaboo <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130ca8ea-74ac-4e0e-ada1-1694d0de7b94?source=api-prod","affected":[{"type":"plugin","slug":"peekaboo","name":"Peekaboo","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:36:43Z"},{"id":"wordfence:130f34d8-462a-4812-8526-67beb9ad5efb","source":"wordfence","cve":"CVE-2025-13732","title":"s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130f34d8-462a-4812-8526-67beb9ad5efb?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"251005","to_inclusive":true,"patched_in":"260101"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:07Z"},{"id":"wordfence:130fbb1c-3fc8-4eb0-8f29-6632e413f24c","source":"wordfence","cve":"CVE-2026-65482","title":"LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/130fbb1c-3fc8-4eb0-8f29-6632e413f24c?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-21T00:14:05Z"},{"id":"wordfence:13101551-d62e-4b27-9156-5b3d022f0e55","source":"wordfence","cve":"CVE-2023-25047","title":"RSVPMaker <= 9.9.3 - Authenticated (Admin+) SQL Injection via 'delete' parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13101551-d62e-4b27-9156-5b3d022f0e55?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"9.9.3","to_inclusive":true,"patched_in":"9.9.4"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1312ad63-02ed-414d-b807-1a0666da7cf1","source":"wordfence","cve":"CVE-2024-38757","title":"Typebot <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1312ad63-02ed-414d-b807-1a0666da7cf1?source=api-prod","affected":[{"type":"plugin","slug":"typebot","name":"Typebot","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-07-11T00:00:00Z","updated":"2025-01-09T15:11:34Z"},{"id":"wordfence:1313c714-d4d4-4ec8-bae8-99af0cee2f43","source":"wordfence","cve":"CVE-2021-24247","title":"Contact Form Check Tester <= 1.0.2 - Authenticated (Subscriber+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1313c714-d4d4-4ec8-bae8-99af0cee2f43?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-check-tester","name":"Contact Form Check Tester","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13159a71-c183-4fc2-98af-8b9e60508a1c","source":"wordfence","cve":"CVE-2024-25596","title":"Doofinder for WooCommerce <= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13159a71-c183-4fc2-98af-8b9e60508a1c?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T18:04:57Z"},{"id":"wordfence:131614fa-fcaa-4105-b3ce-9926a413dd42","source":"wordfence","cve":"CVE-2024-8542","title":"Everest Forms <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/131614fa-fcaa-4105-b3ce-9926a413dd42?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.3.1"}],"published":"2024-08-01T00:00:00Z","updated":"2024-10-22T20:01:35Z"},{"id":"wordfence:131a6a35-e0d2-4613-8614-24bf11011098","source":"wordfence","cve":"CVE-2026-1045","title":"Viet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/131a6a35-e0d2-4613-8614-24bf11011098?source=api-prod","affected":[{"type":"plugin","slug":"viet-contact","name":"Viet contact","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-19T17:05:13Z","updated":"2026-01-20T05:30:17Z"},{"id":"wordfence:131b5d57-2af1-4cc5-8b4e-019a050c3bb8","source":"wordfence","cve":"CVE-2024-10836","title":"Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/131b5d57-2af1-4cc5-8b4e-019a050c3bb8?source=api-prod","affected":[{"type":"theme","slug":"flixita","name":"Flixita","from":"*","from_inclusive":true,"to":"1.0.82","to_inclusive":true,"patched_in":"1.0.83"}],"published":"2024-12-05T14:50:57Z","updated":"2024-12-06T03:25:38Z"},{"id":"wordfence:131d07ad-4e87-4137-a5df-2b74db1e9ae8","source":"wordfence","cve":"CVE-2026-5340","title":"Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/131d07ad-4e87-4137-a5df-2b74db1e9ae8?source=api-prod","affected":[{"type":"plugin","slug":"fancy-image-show","name":"Fancy Image Show","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:03:52Z","updated":"2026-05-12T07:48:18Z"},{"id":"wordfence:131fdc77-d7b8-4bbe-88b0-28d9aaa06a3b","source":"wordfence","cve":"CVE-2025-24549","title":"Post Meta <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/131fdc77-d7b8-4bbe-88b0-28d9aaa06a3b?source=api-prod","affected":[{"type":"plugin","slug":"post-meta","name":"Post Meta","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:38:42Z"},{"id":"wordfence:13209280-5822-492b-94fa-780ce6d38924","source":"wordfence","cve":"CVE-2025-31742","title":"Dima Take Action <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13209280-5822-492b-94fa-780ce6d38924?source=api-prod","affected":[{"type":"plugin","slug":"dima-take-action","name":"Dima Take Action","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:16:56Z"},{"id":"wordfence:1322e229-5e0b-4c3d-ae96-e211a2831842","source":"wordfence","cve":"CVE-2023-30487","title":"LearnPress - Export/Import Courses <= 4.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1322e229-5e0b-4c3d-ae96-e211a2831842?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1323b0c9-18dd-4cc4-8fe9-b1cf9583a5d1","source":"wordfence","cve":"CVE-2026-39736","title":"JetEngine <= 3.9.0.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1323b0c9-18dd-4cc4-8fe9-b1cf9583a5d1?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.9.0.1","to_inclusive":true,"patched_in":"3.9.0.2"}],"published":"2026-10-29T14:07:00Z","updated":"2026-11-03T19:55:34Z"},{"id":"wordfence:13245eab-9a72-44d7-bbcd-a0d3e2879814","source":"wordfence","cve":"CVE-2023-51414","title":"Env\u00edaloSimple <= 2.1 Unauthenticated PHP Object Injection","severity":"medium","cvss":6.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13245eab-9a72-44d7-bbcd-a0d3e2879814?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:132a6661-c21b-4ba6-955a-2c905425de6a","source":"wordfence","cve":"CVE-2021-24494","title":"WP Offload SES Lite <= 1.4.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/132a6661-c21b-4ba6-955a-2c905425de6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ses","name":"WP Offload SES Lite","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:132df187-f5da-4a7e-a807-16327742bf6e","source":"wordfence","cve":"CVE-2026-111838","title":"ThemeHunk Customizer <= 2.8.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/132df187-f5da-4a7e-a807-16327742bf6e?source=api-prod","affected":[{"type":"plugin","slug":"themehunk-customizer","name":"ThemeHunk Customizer","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2026-10-19T13:24:06Z","updated":"2026-10-23T18:30:33Z"},{"id":"wordfence:132efd40-1c90-4d2a-a87c-504526b7a7d4","source":"wordfence","cve":"CVE-2025-13626","title":"myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/132efd40-1c90-4d2a-a87c-504526b7a7d4?source=api-prod","affected":[{"type":"plugin","slug":"mylco","name":"myLCO","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T16:46:25Z","updated":"2026-01-05T16:41:25Z"},{"id":"wordfence:133057a1-4cd5-4e46-9407-d01d80859991","source":"wordfence","cve":"CVE-2024-31121","title":"HeartThis <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133057a1-4cd5-4e46-9407-d01d80859991?source=api-prod","affected":[{"type":"plugin","slug":"heart-this","name":"HeartThis","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:36:20Z"},{"id":"wordfence:13344366-feb0-4987-9543-222e3d35dab3","source":"wordfence","cve":"CVE-2024-4942","title":"Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13344366-feb0-4987-9543-222e3d35dab3?source=api-prod","affected":[{"type":"plugin","slug":"custom-dash","name":"Custom Dash","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T13:00:09Z","updated":"2024-06-06T02:02:53Z"},{"id":"wordfence:13348eb5-5001-4ec4-bc6a-44795bbed203","source":"wordfence","cve":"CVE-2025-13543","title":"PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13348eb5-5001-4ec4-bc6a-44795bbed203?source=api-prod","affected":[{"type":"plugin","slug":"postgallery","name":"PostGallery","from":"*","from_inclusive":true,"to":"1.12.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T07:28:57Z","updated":"2025-12-04T20:27:30Z"},{"id":"wordfence:13389191-cbda-4c39-8598-7c2b41f31da7","source":"wordfence","cve":"CVE-2024-4433","title":"Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13389191-cbda-4c39-8598-7c2b41f31da7?source=api-prod","affected":[{"type":"plugin","slug":"simple-image-popup","name":"Simple Image Popup","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-05-02T00:00:00Z","updated":"2024-12-24T16:00:47Z"},{"id":"wordfence:13396465-f41c-4b0b-ad1f-8c580f3e22e5","source":"wordfence","cve":"CVE-2026-105989","title":"Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13396465-f41c-4b0b-ad1f-8c580f3e22e5?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-extension","name":"Accept PayPal Payments using Contact Form 7","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:40:42Z"},{"id":"wordfence:133a6fe8-e011-4749-b95d-e41a03a50aab","source":"wordfence","cve":"CVE-2024-35669","title":"Debug Log Manager <= 2.3.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133a6fe8-e011-4749-b95d-e41a03a50aab?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:39:09Z"},{"id":"wordfence:133a7a71-4428-4ada-8ed7-a7c6fe54a0cb","source":"wordfence","cve":"CVE-2026-93880","title":"Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133a7a71-4428-4ada-8ed7-a7c6fe54a0cb?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.0","to_inclusive":true,"patched_in":"13.2.1"}],"published":"2026-10-01T18:56:55Z","updated":"2026-10-02T07:39:22Z"},{"id":"wordfence:133beb2d-0618-4ad7-922a-29df4d2bea1e","source":"wordfence","cve":"CVE-2025-49866","title":"Beautiful Cookie Consent Banner <= 4.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133beb2d-0618-4ad7-922a-29df4d2bea1e?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-and-responsive-cookie-consent","name":"Beautiful Cookie Consent Banner","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:38:48Z"},{"id":"wordfence:133c212e-9a9e-4538-a07d-05abac741ad9","source":"wordfence","cve":"CVE-2025-24593","title":"Edwiser Bridge \u2013 WordPress Moodle LMS Integration <= 3.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133c212e-9a9e-4538-a07d-05abac741ad9?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-12-25T00:00:00Z","updated":"2025-02-24T16:12:40Z"},{"id":"wordfence:133e2834-ed47-4e76-b353-0de028657a6e","source":"wordfence","cve":"CVE-2025-2561","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/133e2834-ed47-4e76-b353-0de028657a6e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2025-04-28T00:00:00Z","updated":"2025-05-23T15:20:51Z"},{"id":"wordfence:1340aeb3-12a0-4965-95db-45d753935812","source":"wordfence","cve":"CVE-2026-92536","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1340aeb3-12a0-4965-95db-45d753935812?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.4","to_inclusive":true,"patched_in":"4.17.5"}],"published":"2026-10-02T14:31:10Z","updated":"2026-10-03T03:25:44Z"},{"id":"wordfence:134130a9-4750-4a63-88a0-60d4285acb77","source":"wordfence","cve":"CVE-2025-13413","title":"Country Blocker for AdSense <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/134130a9-4750-4a63-88a0-60d4285acb77?source=api-prod","affected":[{"type":"plugin","slug":"country-blocker-for-adsense","name":"Country Blocker for AdSense","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:38:49Z","updated":"2026-02-19T04:36:06Z"},{"id":"wordfence:13436238-f14a-445b-9a9b-fbcf23b7b498","source":"wordfence","cve":"CVE-2024-5426","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13436238-f14a-445b-9a9b-fbcf23b7b498?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.23","to_inclusive":true,"patched_in":"1.8.24"}],"published":"2024-06-06T21:15:26Z","updated":"2024-06-07T09:33:35Z"},{"id":"wordfence:1346a475-7057-467a-a88f-9ba6ec690dde","source":"wordfence","cve":"CVE-2025-58898","title":"HealthHub <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1346a475-7057-467a-a88f-9ba6ec690dde?source=api-prod","affected":[{"type":"theme","slug":"healthhub","name":"HealthHub - Health & Medical Doctor WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:30:47Z"},{"id":"wordfence:134a3615-a9fa-48b5-8cd1-4c3fb24a777a","source":"wordfence","cve":"CVE-2024-31362","title":"ProfileGrid  <= 5.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/134a3615-a9fa-48b5-8cd1-4c3fb24a777a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T15:13:55Z"},{"id":"wordfence:134ad095-b0a0-4f0f-832d-3e558d4a250a","source":"wordfence","cve":"CVE-2024-3105","title":"Woody code snippets \u2013 Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/134ad095-b0a0-4f0f-832d-3e558d4a250a?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-06-14T20:26:37Z","updated":"2024-06-15T08:42:14Z"},{"id":"wordfence:134b6e4d-c38f-4d52-b6dd-fd49ea0e6581","source":"wordfence","cve":"CVE-2013-3262","title":"Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/134b6e4d-c38f-4d52-b6dd-fd49ea0e6581?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"3.3.6.2","to_inclusive":false,"patched_in":"3.3.6.2"}],"published":"2013-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:134e09a8-f89a-4282-b2e8-09b84f04aae7","source":"wordfence","cve":"CVE-2015-1000007","title":"wptf-image-gallery <= 1.0.3 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/134e09a8-f89a-4282-b2e8-09b84f04aae7?source=api-prod","affected":[{"type":"plugin","slug":"wptf-image-gallery","name":"wptf-image-gallery","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2015-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13517c2f-43ce-4e9a-81c4-d422b0e7273a","source":"wordfence","cve":"CVE-2024-9049","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13517c2f-43ce-4e9a-81c4-d422b0e7273a?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.3.6","to_inclusive":true,"patched_in":"2.8.3.7"}],"published":"2024-09-26T00:00:00Z","updated":"2024-09-27T06:53:59Z"},{"id":"wordfence:1351cd6b-ae22-4363-b36b-f892c504f5d9","source":"wordfence","cve":"CVE-2016-2222","title":"WordPress Core < 4.4.2 - Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1351cd6b-ae22-4363-b36b-f892c504f5d9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.12","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"3.7.13"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:135213d6-8058-4573-a97d-a95b0708d807","source":"wordfence","cve":"","title":"Ptengine \u2013 Heatmap Analytics < 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135213d6-8058-4573-a97d-a95b0708d807?source=api-prod","affected":[{"type":"plugin","slug":"ptengine-real-time-web-analytics-and-heatmap","name":"Ptengine \u2013 Heatmap Analytics","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2015-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1355bc94-7110-4d61-855e-78889e58dcad","source":"wordfence","cve":"CVE-2021-4384","title":"WordPress Photo Gallery \u2013 Image Gallery <= 1.0.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1355bc94-7110-4d61-855e-78889e58dcad?source=api-prod","affected":[{"type":"plugin","slug":"photo-contest","name":"WordPress Photo Gallery \u2013 Image Gallery","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2021-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1356ec70-4264-4687-8082-7d87a8978082","source":"wordfence","cve":"CVE-2026-104993","title":"GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1356ec70-4264-4687-8082-7d87a8978082?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.188","to_inclusive":true,"patched_in":"2.8.189"}],"published":"2026-10-09T15:53:18Z","updated":"2026-10-10T04:26:44Z"},{"id":"wordfence:13571c69-c11d-47c0-b911-60a0c2482b50","source":"wordfence","cve":"CVE-2026-84820","title":"Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13571c69-c11d-47c0-b911-60a0c2482b50?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2026-09-07T12:13:45Z","updated":"2026-09-10T19:21:27Z"},{"id":"wordfence:135783c5-8175-4775-a013-f1e2bef04479","source":"wordfence","cve":"CVE-2026-6397","title":"Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135783c5-8175-4775-a013-f1e2bef04479?source=api-prod","affected":[{"type":"plugin","slug":"sticky","name":"Sticky","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:04:07Z","updated":"2026-05-20T01:25:46Z"},{"id":"wordfence:1358a74a-56cd-4cfb-88db-80f8817d2ed4","source":"wordfence","cve":"CVE-2026-18365","title":"Zportals <= 6.4.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1358a74a-56cd-4cfb-88db-80f8817d2ed4?source=api-prod","affected":[{"type":"plugin","slug":"zportals","name":"Zportals","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T13:45:06Z"},{"id":"wordfence:1359945a-cf4e-4883-830b-53a3fcd40e56","source":"wordfence","cve":"CVE-2026-11987","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1359945a-cf4e-4883-830b-53a3fcd40e56?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-26T17:54:35Z","updated":"2026-06-27T06:50:55Z"},{"id":"wordfence:135ab17b-5b91-484a-8bec-6f77d694ae62","source":"wordfence","cve":"","title":"WPE Indoshipping <= 2.5.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135ab17b-5b91-484a-8bec-6f77d694ae62?source=api-prod","affected":[{"type":"plugin","slug":"wpe-indoshipping","name":"WPE Indoshipping","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:135c33bb-5ec2-4697-9340-1d2651ff3a0b","source":"wordfence","cve":"CVE-2025-14155","title":"Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.53","to_inclusive":true,"patched_in":"4.11.54"}],"published":"2025-12-22T00:00:00Z","updated":"2026-02-13T19:10:07Z"},{"id":"wordfence:135e55e0-c133-4b66-88ed-92e0083c53a5","source":"wordfence","cve":"CVE-2026-15250","title":"LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135e55e0-c133-4b66-88ed-92e0083c53a5?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"5.6.8"}],"published":"2026-07-10T00:00:00Z","updated":"2026-08-21T15:36:31Z"},{"id":"wordfence:135e6916-5350-4495-a4b7-84631c6c5e65","source":"wordfence","cve":"CVE-2025-58934","title":"The Gig <= 1.18.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/135e6916-5350-4495-a4b7-84631c6c5e65?source=api-prod","affected":[{"type":"theme","slug":"thegig","name":"The Gig - Stand-up Club & Night Bar WordPress Theme","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-20T20:30:40Z"},{"id":"wordfence:13602c35-a0f7-4651-af9a-0be9e581893a","source":"wordfence","cve":"CVE-2026-6641","title":"Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13602c35-a0f7-4651-af9a-0be9e581893a?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-11T07:39:07Z"},{"id":"wordfence:13606d05-20fc-4926-8d8c-a92457a2cb40","source":"wordfence","cve":"CVE-2026-84252","title":"click5 CRM add-on to WPForms <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13606d05-20fc-4926-8d8c-a92457a2cb40?source=api-prod","affected":[{"type":"plugin","slug":"wpf-add-on-by-click5","name":"click5 CRM add-on to WPForms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:10:53Z"},{"id":"wordfence:13617b70-9b57-4873-9942-12bffed411e2","source":"wordfence","cve":"CVE-2023-49828","title":"WooCommerce Payments <= 6.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13617b70-9b57-4873-9942-12bffed411e2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13629598-d45d-4ff5-aeb5-6ac881d25183","source":"wordfence","cve":"CVE-2024-6172","title":"Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13629598-d45d-4ff5-aeb5-6ac881d25183?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.25","to_inclusive":true,"patched_in":"5.7.26"}],"published":"2024-07-01T18:34:02Z","updated":"2024-07-02T12:58:24Z"},{"id":"wordfence:1363df2e-5543-47d9-878c-e5bf9c6a772c","source":"wordfence","cve":"CVE-2026-93902","title":"Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1363df2e-5543-47d9-878c-e5bf9c6a772c?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.7.7","to_inclusive":true,"patched_in":"8.7.8"}],"published":"2026-11-06T15:51:33Z","updated":"2026-11-07T04:27:11Z"},{"id":"wordfence:13648a6d-481d-4eb4-82c8-30476454793e","source":"wordfence","cve":"CVE-2026-16276","title":"Classified Listing <= 5.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13648a6d-481d-4eb4-82c8-30476454793e?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-15T21:39:10Z"},{"id":"wordfence:13657ad7-7185-4be2-98e2-aeaf8514ad4d","source":"wordfence","cve":"CVE-2021-24429","title":"Salon booking system < 6.3.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13657ad7-7185-4be2-98e2-aeaf8514ad4d?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":false,"patched_in":"6.3.1"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:136616d7-e6f3-4964-abc4-527074122c78","source":"wordfence","cve":"CVE-2024-13730","title":"Podlove Podcast Publisher <= 4.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136616d7-e6f3-4964-abc4-527074122c78?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-23T15:15:07Z"},{"id":"wordfence:136b7e71-c299-4747-90f5-27ed9ba275db","source":"wordfence","cve":"CVE-2026-95598","title":"Search in Place <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136b7e71-c299-4747-90f5-27ed9ba275db?source=api-prod","affected":[{"type":"plugin","slug":"search-in-place","name":"Search in Place","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:51:30Z"},{"id":"wordfence:136bf4c5-5309-479e-8d6b-f8a7334da9b0","source":"wordfence","cve":"CVE-2022-47163","title":"WP CSV to Database <= 2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136bf4c5-5309-479e-8d6b-f8a7334da9b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-csv-to-database","name":"WP CSV to Database \u2013 Insert CSV file content into WordPress database","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:136d63c4-c985-413f-8d8b-b57e11d1d230","source":"wordfence","cve":"CVE-2025-3853","title":"WPshop 2 \u2013 E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136d63c4-c985-413f-8d8b-b57e11d1d230?source=api-prod","affected":[{"type":"plugin","slug":"wpshop","name":"WPshop 2 \u2013 E-Commerce","from":"2.0.0","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-05-06T00:00:00Z","updated":"2026-03-27T10:49:08Z"},{"id":"wordfence:136dabc7-7120-47ed-9b70-d2eae13819c0","source":"wordfence","cve":"CVE-2025-23982","title":"Fare Calculator <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136dabc7-7120-47ed-9b70-d2eae13819c0?source=api-prod","affected":[{"type":"plugin","slug":"fare-calculator","name":"Fare Calculator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:29:41Z"},{"id":"wordfence:136eb400-d5cf-4b73-a8e4-9484faa81049","source":"wordfence","cve":"CVE-2025-39401","title":"WPAMS <= 44.0 (17-08-2023) - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136eb400-d5cf-4b73-a8e4-9484faa81049?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:45:42Z"},{"id":"wordfence:136ecfa1-5591-4636-bc30-6c68ddc7f277","source":"wordfence","cve":"CVE-2024-13554","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136ecfa1-5591-4636-bc30-6c68ddc7f277?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.13","to_inclusive":true,"patched_in":"3.0.14"}],"published":"2025-02-11T15:21:02Z","updated":"2025-02-12T03:21:38Z"},{"id":"wordfence:136f8e94-a09a-48c4-bea9-e8b21d3fd91f","source":"wordfence","cve":"CVE-2026-91050","title":"Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136f8e94-a09a-48c4-bea9-e8b21d3fd91f?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-10-09T17:18:27Z","updated":"2026-10-10T05:30:56Z"},{"id":"wordfence:136f9667-ee76-4feb-9fc1-860cdb9e84cf","source":"wordfence","cve":"CVE-2025-66086","title":"SMS Alert Order Notifications <= 3.8.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/136f9667-ee76-4feb-9fc1-860cdb9e84cf?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-11T15:47:32Z"},{"id":"wordfence:13703cee-a277-4f8a-ad45-53c82118682b","source":"wordfence","cve":"CVE-2024-6884","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13703cee-a277-4f8a-ad45-53c82118682b?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.28","to_inclusive":true,"patched_in":"3.2.39"}],"published":"2024-07-18T00:00:00Z","updated":"2024-09-04T15:07:56Z"},{"id":"wordfence:1371d1ea-a415-4cd8-bc99-a530670ffb94","source":"wordfence","cve":"CVE-2024-49323","title":"All in One Slider <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1371d1ea-a415-4cd8-bc99-a530670ffb94?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-slider","name":"All in One Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-12-12T17:15:28Z"},{"id":"wordfence:13728336-42b8-4857-9753-c91b7cb028fa","source":"wordfence","cve":"CVE-2026-59525","title":"Participants Database <= 2.7.8.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13728336-42b8-4857-9753-c91b7cb028fa?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.3","to_inclusive":true,"patched_in":"2.7.8.4"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:51:26Z"},{"id":"wordfence:137327c8-01cb-4074-9424-89d826a9586e","source":"wordfence","cve":"CVE-2025-15033","title":"WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/137327c8-01cb-4074-9424-89d826a9586e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"10.0","from_inclusive":true,"to":"10.0.4","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"10.1","from_inclusive":true,"to":"10.1.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"10.2","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"10.3","from_inclusive":true,"to":"10.3.6","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.1","from_inclusive":true,"to":"8.1.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.2","from_inclusive":true,"to":"8.2.3","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.3","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.4","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.5","from_inclusive":true,"to":"8.5.3","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.6","from_inclusive":true,"to":"8.6.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.7","from_inclusive":true,"to":"8.7.1","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.8","from_inclusive":true,"to":"8.8.5","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.9","from_inclusive":true,"to":"8.9.3","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.0","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.1","from_inclusive":true,"to":"9.1.4","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.2","from_inclusive":true,"to":"9.2.3","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.3","from_inclusive":true,"to":"9.3.4","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.4","from_inclusive":true,"to":"9.4.3","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.5","from_inclusive":true,"to":"9.5.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.6","from_inclusive":true,"to":"9.6.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.7","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.8","from_inclusive":true,"to":"9.8.5","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.9","from_inclusive":true,"to":"9.9.5","to_inclusive":true,"patched_in":"8.1.3"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-15T16:55:55Z"},{"id":"wordfence:1374b266-4b20-4706-a4d2-482122964693","source":"wordfence","cve":"CVE-2012-4919","title":"WordPress Gallery Plugin <= 1.4 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1374b266-4b20-4706-a4d2-482122964693?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gallery-plugin","name":"WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2013-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1374efcf-028a-4707-bb28-3e4d49ed2877","source":"wordfence","cve":"CVE-2024-56209","title":"Kleo < 5.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1374efcf-028a-4707-bb28-3e4d49ed2877?source=api-prod","affected":[{"type":"theme","slug":"kleo","name":"KLEO - Community Focused & Multi-Purpose BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"5.4.4"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:59:34Z"},{"id":"wordfence:13753c4d-1b51-4db2-a69e-523857a50e55","source":"wordfence","cve":"CVE-2024-12444","title":"WP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13753c4d-1b51-4db2-a69e-523857a50e55?source=api-prod","affected":[{"type":"plugin","slug":"wp-dispensary","name":"WP Dispensary","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:42:16Z","updated":"2025-01-30T13:41:55Z"},{"id":"wordfence:1375ac68-31e4-4473-9757-bd86411c716f","source":"wordfence","cve":"CVE-2019-5980","title":"Related YouTube Videos <= 1.9.8 - Cross-site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1375ac68-31e4-4473-9757-bd86411c716f?source=api-prod","affected":[{"type":"plugin","slug":"related-youtube-videos","name":"Related YouTube Videos","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":false,"patched_in":"1.9.9"}],"published":"2019-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1375c43c-498f-4d68-ac9c-201592d26919","source":"wordfence","cve":"CVE-2023-37998","title":"Disabler <= 3.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1375c43c-498f-4d68-ac9c-201592d26919?source=api-prod","affected":[{"type":"plugin","slug":"disabler","name":"Disabler","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-07-20T00:00:00Z","updated":"2024-05-03T19:03:49Z"},{"id":"wordfence:137623ec-1e40-4b66-a273-706b630580fe","source":"wordfence","cve":"CVE-2026-16595","title":"Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/137623ec-1e40-4b66-a273-706b630580fe?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:41:56Z"},{"id":"wordfence:13791cb9-280e-4a48-aa52-85127d6ac0a1","source":"wordfence","cve":"CVE-2026-57730","title":"Flatsome <= 3.20.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13791cb9-280e-4a48-aa52-85127d6ac0a1?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:42:37Z"},{"id":"wordfence:1379bd6a-529e-42b9-bc01-8373b314c771","source":"wordfence","cve":"CVE-2026-66636","title":"Wise Chat <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1379bd6a-529e-42b9-bc01-8373b314c771?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-08-18T00:00:00Z","updated":"2026-10-13T17:14:20Z"},{"id":"wordfence:137ca3b1-703f-4032-8574-02401f4d2e22","source":"wordfence","cve":"CVE-2025-48257","title":"Projectopia <= 5.1.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/137ca3b1-703f-4032-8574-02401f4d2e22?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.17","to_inclusive":true,"patched_in":"5.1.18"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:30:10Z"},{"id":"wordfence:137e97be-6d70-44c8-8b28-7e110d85768e","source":"wordfence","cve":"CVE-2024-51836","title":"Wezido <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/137e97be-6d70-44c8-8b28-7e110d85768e?source=api-prod","affected":[{"type":"plugin","slug":"wezido-elementor-addon-based-on-easy-digital-downloads","name":"Wezido \u2013 Elementor Addon Based on Easy Digital Downloads","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:21:37Z"},{"id":"wordfence:13839b12-2823-4cc6-a950-f51f37391e60","source":"wordfence","cve":"CVE-2025-31548","title":"Ultimate Push Notifications <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13839b12-2823-4cc6-a950-f51f37391e60?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-push-notifications","name":"Ultimate Push Notifications","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-04-01T00:00:00Z","updated":"2026-09-23T14:28:21Z"},{"id":"wordfence:1383a701-d2b5-44fb-823f-0640ad4961fb","source":"wordfence","cve":"CVE-2025-68840","title":"iRobots.txt SEO <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1383a701-d2b5-44fb-823f-0640ad4961fb?source=api-prod","affected":[{"type":"plugin","slug":"irobotstxt-seo","name":"iRobots.txt SEO","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:19:07Z"},{"id":"wordfence:13843a16-7ae3-412d-a2ac-7a5ee556b6e2","source":"wordfence","cve":"CVE-2019-16332","title":"API Bearer Auth < 20190907 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13843a16-7ae3-412d-a2ac-7a5ee556b6e2?source=api-prod","affected":[{"type":"plugin","slug":"api-bearer-auth","name":"API Bearer Auth","from":"*","from_inclusive":true,"to":"20190907","to_inclusive":false,"patched_in":"20190907"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1384c53a-9c6f-4372-98e4-14c9ba213968","source":"wordfence","cve":"CVE-2024-37948","title":"Caxton \u2013 Create Pro page layouts in Gutenberg <= 1.30.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1384c53a-9c6f-4372-98e4-14c9ba213968?source=api-prod","affected":[{"type":"plugin","slug":"caxton","name":"Caxton \u2013 Create Pro page layouts in Gutenberg","from":"*","from_inclusive":true,"to":"1.30.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:17:46Z"},{"id":"wordfence:1387338d-776d-47b3-882e-a395bc27bcb1","source":"wordfence","cve":"CVE-2025-23481","title":"Ni WooCommerce Sales Report Email <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1387338d-776d-47b3-882e-a395bc27bcb1?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-sales-report-email","name":"Ni WooCommerce Sales Report Email","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:52:11Z"},{"id":"wordfence:13874012-09b4-4e6a-a364-07321dbd0167","source":"wordfence","cve":"CVE-2022-2149","title":"Very Simple Breadcrumb <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13874012-09b4-4e6a-a364-07321dbd0167?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-breadcrumb","name":"Very Simple Breadcrumb","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:138818d2-f66b-4503-9df6-b89765191d50","source":"wordfence","cve":"CVE-2025-64375","title":"Social Ninja <= 3.20.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/138818d2-f66b-4503-9df6-b89765191d50?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-reviews","name":"WP Social Ninja \u2013 Embed Social Feeds, User Reviews & Chat Widgets","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2025-11-14T00:00:00Z","updated":"2025-12-20T19:41:12Z"},{"id":"wordfence:1388873f-8053-4ba9-8707-093bc0e8f2f5","source":"wordfence","cve":"CVE-2023-35879","title":"WooCommerce Product Vendors <= 2.1.78 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1388873f-8053-4ba9-8707-093bc0e8f2f5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.78","to_inclusive":true,"patched_in":"2.1.79"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13889b4a-f31d-440e-8d78-fe5b4390b8c9","source":"wordfence","cve":"CVE-2026-39738","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.6.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13889b4a-f31d-440e-8d78-fe5b4390b8c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.8.6.1","to_inclusive":true,"patched_in":"3.8.6.2"}],"published":"2026-10-30T07:09:57Z","updated":"2026-11-03T19:56:09Z"},{"id":"wordfence:138c636b-27fb-4d76-b01c-60a10749913d","source":"wordfence","cve":"CVE-2024-33638","title":"Smart Maintenance Mode <= 1.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/138c636b-27fb-4d76-b01c-60a10749913d?source=api-prod","affected":[{"type":"plugin","slug":"smart-maintenance-mode","name":"Smart Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2025-04-17T12:53:44Z"},{"id":"wordfence:138e0a38-c922-44d1-9fe6-2439ec32cf39","source":"wordfence","cve":"","title":"Rank Math SEO <= 1.0.42.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/138e0a38-c922-44d1-9fe6-2439ec32cf39?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.42.2","to_inclusive":false,"patched_in":"1.0.42.2"}],"published":"2020-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:139009b5-69d4-44ca-820c-766645828e5e","source":"wordfence","cve":"CVE-2025-13608","title":"CC Child Pages <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/139009b5-69d4-44ca-820c-766645828e5e?source=api-prod","affected":[{"type":"plugin","slug":"cc-child-pages","name":"CC Child Pages","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-12-15T02:16:08Z","updated":"2025-12-15T14:25:09Z"},{"id":"wordfence:1390b079-784c-4c36-bec4-a70cd8484ca5","source":"wordfence","cve":"CVE-2026-93897","title":"GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1390b079-784c-4c36-bec4-a70cd8484ca5?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.181","to_inclusive":true,"patched_in":"2.8.182"}],"published":"2026-09-24T18:18:33Z","updated":"2026-09-25T06:39:52Z"},{"id":"wordfence:13929b51-b32e-401c-a642-49f7cd2d07bf","source":"wordfence","cve":"CVE-2025-8081","title":"Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13929b51-b32e-401c-a642-49f7cd2d07bf?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.30.2","to_inclusive":true,"patched_in":"3.30.3"}],"published":"2025-08-11T17:08:06Z","updated":"2025-08-12T05:27:11Z"},{"id":"wordfence:1394b739-9d3a-4162-a7ca-3d20025eba52","source":"wordfence","cve":"CVE-2024-54339","title":"GeoFlickr <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1394b739-9d3a-4162-a7ca-3d20025eba52?source=api-prod","affected":[{"type":"plugin","slug":"geoflickr","name":"GeoFlickr","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:12:31Z"},{"id":"wordfence:13968257-593d-433e-9583-5bb5d6c6b2d5","source":"wordfence","cve":"CVE-2016-10941","title":"Podlove Podcast Publisher < 2.3.16 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13968257-593d-433e-9583-5bb5d6c6b2d5?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":false,"patched_in":"2.3.16"}],"published":"2016-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13981037-e698-42a7-9471-e27486cf1a4e","source":"wordfence","cve":"","title":"WP Super Cache <= 1.4.4 - Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-548","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13981037-e698-42a7-9471-e27486cf1a4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2015-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13981d82-5e27-4cde-8bb7-2ab6155741e3","source":"wordfence","cve":"CVE-2025-31830","title":"Printus <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13981d82-5e27-4cde-8bb7-2ab6155741e3?source=api-prod","affected":[{"type":"plugin","slug":"printus-cloud-printing-for-woocommerce","name":"Printus \u2013 Automatic Cloud Order Printing for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:09:53Z"},{"id":"wordfence:1398e296-9b20-4f8e-85f2-896888abc67e","source":"wordfence","cve":"CVE-2023-6272","title":"Theme My Login 2FA < 1.2 - 2FA Bypass via Brute Force","severity":"medium","cvss":5.4,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1398e296-9b20-4f8e-85f2-896888abc67e?source=api-prod","affected":[{"type":"plugin","slug":"tml-2fa","name":"Theme My Login 2fa","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:139a264b-082b-45db-ac9e-4974bf86c56f","source":"wordfence","cve":"CVE-2025-12045","title":"Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/139a264b-082b-45db-ac9e-4974bf86c56f?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2025-11-03T00:00:00Z","updated":"2025-11-04T11:19:29Z"},{"id":"wordfence:139ac1ad-d04d-48fc-85a4-6d07cd2e824a","source":"wordfence","cve":"CVE-2025-22574","title":"ICS Button <= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/139ac1ad-d04d-48fc-85a4-6d07cd2e824a?source=api-prod","affected":[{"type":"plugin","slug":"ics-button","name":"ICS Button","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:37:25Z"},{"id":"wordfence:139b081d-17b1-4e1f-9d22-cf3f9de123f5","source":"wordfence","cve":"CVE-2023-23826","title":"Add Posts to Pages <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/139b081d-17b1-4e1f-9d22-cf3f9de123f5?source=api-prod","affected":[{"type":"plugin","slug":"add-posts-to-pages","name":"Add Posts to Pages","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:139d4ec2-1147-4332-a56d-633890f32560","source":"wordfence","cve":"CVE-2023-49834","title":"WOOCS \u2013 WooCommerce Currency Switcher <= 1.4.1.4 - Cross-Site Request Forgery via delete_profiles_data","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/139d4ec2-1147-4332-a56d-633890f32560?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1.4","to_inclusive":true,"patched_in":"1.4.1.5"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13a0dd72-1124-4b5d-9bad-fe4fea8e3e68","source":"wordfence","cve":"CVE-2023-25708","title":"WP VR <= 8.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13a0dd72-1124-4b5d-9bad-fe4fea8e3e68?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.7","to_inclusive":true,"patched_in":"8.2.8"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13a1e293-f539-4d19-8fe8-392c126fd1c4","source":"wordfence","cve":"","title":"intouch <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13a1e293-f539-4d19-8fe8-392c126fd1c4?source=api-prod","affected":[{"type":"plugin","slug":"intouch","name":"intouch","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13a206ea-0890-4535-9da7-54a7a45f0452","source":"wordfence","cve":"CVE-2024-4280","title":"White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13a206ea-0890-4535-9da7-54a7a45f0452?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-05-09T16:34:33Z","updated":"2024-05-10T05:34:55Z"},{"id":"wordfence:13a52c43-c14c-4322-9191-297e6c647d92","source":"wordfence","cve":"CVE-2026-97660","title":"WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13a52c43-c14c-4322-9191-297e6c647d92?source=api-prod","affected":[{"type":"plugin","slug":"wpc-product-options","name":"WPC Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-10-02T17:43:39Z","updated":"2026-10-03T06:38:21Z"},{"id":"wordfence:13a96e78-c83c-4ff1-a751-3dbaeb683d9d","source":"wordfence","cve":"CVE-2026-6818","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13a96e78-c83c-4ff1-a751-3dbaeb683d9d?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2026-07-07T23:14:46Z","updated":"2026-07-08T11:30:31Z"},{"id":"wordfence:13aa1288-257a-417e-aad8-86075c9b9abe","source":"wordfence","cve":"CVE-2025-24571","title":"WP Fast Total Search <= 1.78.258 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13aa1288-257a-417e-aad8-86075c9b9abe?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.78.258","to_inclusive":true,"patched_in":"1.79.262"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:05:32Z"},{"id":"wordfence:13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb","source":"wordfence","cve":"CVE-2026-89270","title":"Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13af3a6e-d3ef-41f0-9424-fe2c9b17c8bb?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2026-10-30T17:33:51Z","updated":"2026-10-31T06:44:14Z"},{"id":"wordfence:13b0f306-cfd1-4c36-b694-de7968f0ae1c","source":"wordfence","cve":"CVE-2022-41647","title":"Optinly <= 1.0.18 - Missing Authorization to Plugin Settings Change","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b0f306-cfd1-4c36-b694-de7968f0ae1c?source=api-prod","affected":[{"type":"plugin","slug":"optinly","name":"Optinly \u2013 Exit Intent, Newsletter Popups, Gamification & Opt-in Forms","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2022-10-12T00:00:00Z","updated":"2024-07-15T17:00:49Z"},{"id":"wordfence:13b2fb59-35ef-40de-a48a-2972777d2682","source":"wordfence","cve":"CVE-2015-9301","title":"WordPress Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms < 3.2.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b2fb59-35ef-40de-a48a-2972777d2682?source=api-prod","affected":[{"type":"plugin","slug":"liveforms","name":"Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2015-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13b4efa1-3f52-476c-80fe-b36ccb62a24b","source":"wordfence","cve":"","title":"Podcasting Plugin by TSG < 3.0.5 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b4efa1-3f52-476c-80fe-b36ccb62a24b?source=api-prod","affected":[{"type":"plugin","slug":"podcasting","name":"Podcasting Plugin by TSG","from":"*","from_inclusive":true,"to":"3.0.4.1","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13b5292f-4484-498b-b6b7-2895871ab794","source":"wordfence","cve":"CVE-2024-9687","title":"WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b5292f-4484-498b-b6b7-2895871ab794?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-login-telegram","name":"AuthPress","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-15T02:03:49Z"},{"id":"wordfence:13b63844-0ff8-47d3-beef-990a835fdb1c","source":"wordfence","cve":"CVE-2026-57785","title":"ApusListing <= 1.2.63 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b63844-0ff8-47d3-beef-990a835fdb1c?source=api-prod","affected":[{"type":"theme","slug":"apuslisting","name":"ApusListing - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":"1.2.64"}],"published":"2026-02-14T00:00:00Z","updated":"2026-07-30T12:29:55Z"},{"id":"wordfence:13b79de0-9ef9-4b7f-aa57-75877b4a39c0","source":"wordfence","cve":"CVE-2025-30886","title":"JS Help Desk <= 2.9.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b79de0-9ef9-4b7f-aa57-75877b4a39c0?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:20:14Z"},{"id":"wordfence:13b7a2e4-59f4-4d61-a165-a830ccfb696a","source":"wordfence","cve":"CVE-2025-1973","title":"Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-21T23:19:01Z","updated":"2025-03-22T11:23:33Z"},{"id":"wordfence:13ba9152-b9a0-4201-ba91-c41686b4d953","source":"wordfence","cve":"CVE-2021-24165","title":"Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13ba9152-b9a0-4201-ba91-c41686b4d953?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.34","to_inclusive":false,"patched_in":"3.4.34"}],"published":"2021-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13ba9474-b1ca-4ba4-ad94-88f7795a4c3c","source":"wordfence","cve":"CVE-2025-54045","title":"CM On Demand Search And Replace <= 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13ba9474-b1ca-4ba4-ad94-88f7795a4c3c?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2025-06-30T00:00:00Z","updated":"2026-10-13T16:55:29Z"},{"id":"wordfence:13bdd763-8785-4441-8798-5bcc906cb9b4","source":"wordfence","cve":"CVE-2026-14290","title":"Embed Google Photos Album Easily <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13bdd763-8785-4441-8798-5bcc906cb9b4?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-photos-album-easily","name":"Embed Google Photos album","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-15T21:04:15Z"},{"id":"wordfence:13bde27a-8741-4b86-a45b-7acbaf7d6dde","source":"wordfence","cve":"CVE-2017-20248","title":"Apptha Slider Gallery <= 1.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13bde27a-8741-4b86-a45b-7acbaf7d6dde?source=api-prod","affected":[{"type":"plugin","slug":"apptha-slider-gallery","name":"apptha-slider-gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T17:39:09Z"},{"id":"wordfence:13be8a88-bcd3-4ce9-9538-e93c78323456","source":"wordfence","cve":"CVE-2024-34370","title":"EAN for WooCommerce <= 4.8.9 - Authenticated (Shop Manager+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13be8a88-bcd3-4ce9-9538-e93c78323456?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2024-05-03T00:00:00Z","updated":"2026-03-27T11:05:37Z"},{"id":"wordfence:13bf0f76-0375-432b-9f67-21f9bfefcdde","source":"wordfence","cve":"CVE-2026-81764","title":"Email Essentials <= 6.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13bf0f76-0375-432b-9f67-21f9bfefcdde?source=api-prod","affected":[{"type":"plugin","slug":"email-essentials","name":"Email Essentials","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:36:37Z"},{"id":"wordfence:13c03af2-0bd8-4e81-8ae9-2d702da71fc8","source":"wordfence","cve":"CVE-2022-47588","title":"Simple Photo Gallery <= 1.8.1 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c03af2-0bd8-4e81-8ae9-2d702da71fc8?source=api-prod","affected":[{"type":"plugin","slug":"simple-photo-gallery","name":"Simple Photo Gallery","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13c07b63-f436-45ae-9c00-d1e593a32754","source":"wordfence","cve":"","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.1.0 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c07b63-f436-45ae-9c00-d1e593a32754?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13c22ad6-eecb-4f05-9dce-76a721b4744c","source":"wordfence","cve":"CVE-2021-24357","title":"FooGallery <= 2.0.34 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c22ad6-eecb-4f05-9dce-76a721b4744c?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.0.35","to_inclusive":false,"patched_in":"2.0.35"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13c2b6d2-29d6-4193-80f6-87be0d64968f","source":"wordfence","cve":"CVE-2026-106166","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c2b6d2-29d6-4193-80f6-87be0d64968f?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"9.2.1","from_inclusive":true,"to":"9.3.0","to_inclusive":true,"patched_in":"9.3.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:34Z"},{"id":"wordfence:13c607d9-a8fe-4a03-972c-d0c1b752c7d8","source":"wordfence","cve":"CVE-2021-24445","title":"My Site Audit <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c607d9-a8fe-4a03-972c-d0c1b752c7d8?source=api-prod","affected":[{"type":"plugin","slug":"site-audit","name":"My Site Audit","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13c66a8f-b35f-4943-8880-0799b0d150f7","source":"wordfence","cve":"CVE-2024-0791","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c66a8f-b35f-4943-8880-0799b0d150f7?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":"1.0.8.2"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-05T21:21:35Z"},{"id":"wordfence:13c749cc-af7a-4f2e-b79f-80915dde4bde","source":"wordfence","cve":"CVE-2026-96769","title":"Extend B2B - Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c749cc-af7a-4f2e-b79f-80915dde4bde?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-roles-permissions","name":"Extend B2B - Companies and Users Management for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-09T16:20:47Z","updated":"2026-11-10T04:43:01Z"},{"id":"wordfence:13c969f3-55d7-4a05-aec8-460bb6faf9da","source":"wordfence","cve":"CVE-2026-32456","title":"Admin Menu Editor <= 1.14.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c969f3-55d7-4a05-aec8-460bb6faf9da?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-editor","name":"Admin Menu Editor","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":"1.15"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:56:50Z"},{"id":"wordfence:13c9a71f-ec0a-4d4a-be08-787aa22a0fae","source":"wordfence","cve":"","title":"Appointment Booking Calendar <= 1.2.24 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13c9a71f-ec0a-4d4a-be08-787aa22a0fae?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.24","to_inclusive":true,"patched_in":"1.2.25"}],"published":"2016-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13cb5c62-34fb-4bbc-b42a-cc8a16d51258","source":"wordfence","cve":"","title":"Email Artillery (MASS EMAIL) <= 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cb5c62-34fb-4bbc-b42a-cc8a16d51258?source=api-prod","affected":[{"type":"plugin","slug":"email-artillery","name":"Email Artillery (MASS EMAIL)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13cce634-42ee-46c2-98c1-009749ac0d37","source":"wordfence","cve":"CVE-2026-32382","title":"Digital Download <= 1.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cce634-42ee-46c2-98c1-009749ac0d37?source=api-prod","affected":[{"type":"theme","slug":"digital-download","name":"Digital Download","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:54:41Z"},{"id":"wordfence:13cced58-1546-4afb-949a-f6d0ce8145c1","source":"wordfence","cve":"CVE-2025-28902","title":"Contact Form 7 Select Box Editor Button <= 0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cced58-1546-4afb-949a-f6d0ce8145c1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-select-box-editor-button","name":"Contact Form 7 Select Box Editor Button","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:48:55Z"},{"id":"wordfence:13cde31e-8b20-42a2-ad5b-b5154c90f765","source":"wordfence","cve":"CVE-2024-51910","title":"Assist24 Help Desk <= 20150401.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cde31e-8b20-42a2-ad5b-b5154c90f765?source=api-prod","affected":[{"type":"plugin","slug":"assist24it","name":"Assist24 Help Desk","from":"*","from_inclusive":true,"to":"20150401.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:37:56Z"},{"id":"wordfence:13cfa202-ab90-46c0-ab53-00995bfdcaa3","source":"wordfence","cve":"CVE-2023-6133","title":"Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.27.0","to_inclusive":true,"patched_in":"1.28.0"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13cfcc7a-8529-4bd5-9842-b9ad8eb5f4b3","source":"wordfence","cve":"CVE-2024-29832","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfcc7a-8529-4bd5-9842-b9ad8eb5f4b3?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T15:24:35Z"},{"id":"wordfence:13d07e9d-0e28-4d28-b1e9-168a83e98bf6","source":"wordfence","cve":"CVE-2026-65481","title":"Vino <= 1.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d07e9d-0e28-4d28-b1e9-168a83e98bf6?source=api-prod","affected":[{"type":"theme","slug":"vino","name":"Vino - A Refined Winery, Wine Bar and Vineyard WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:38:12Z"},{"id":"wordfence:13d0eb8a-5b63-460e-b4ba-a3ed80c84fc2","source":"wordfence","cve":"CVE-2023-23814","title":"CP Multi View Event Calendar <= 1.4.13 - Insufficient Authorization","severity":"low","cvss":3.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d0eb8a-5b63-460e-b4ba-a3ed80c84fc2?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13d16955-056d-45c5-b0d1-891767e866b2","source":"wordfence","cve":"","title":"CMS Tree Page View < 1.4 - Missing Authorization Checks","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d16955-056d-45c5-b0d1-891767e866b2?source=api-prod","affected":[{"type":"plugin","slug":"cms-tree-page-view","name":"CMS Tree Page View \u2013 Reorder Pages with a Drag-and-Drop Tree","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2017-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13d2a333-1f45-457e-a48b-38c1e0793eeb","source":"wordfence","cve":"CVE-2024-30450","title":"OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d2a333-1f45-457e-a48b-38c1e0793eeb?source=api-prod","affected":[{"type":"plugin","slug":"stepbyteservice-openstreetmap","name":"OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T21:06:27Z"},{"id":"wordfence:13d31af8-c606-4c83-be15-4446c4f330aa","source":"wordfence","cve":"CVE-2021-20678","title":"Paid Memberships Pro <= 2.5.5 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d31af8-c606-4c83-be15-4446c4f330aa?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":false,"patched_in":"2.5.6"}],"published":"2021-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13d53257-9dc7-4b7c-9472-72769099386c","source":"wordfence","cve":"CVE-2024-56024","title":"Custom Dashboard Widget <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d53257-9dc7-4b7c-9472-72769099386c?source=api-prod","affected":[{"type":"plugin","slug":"create-custom-dashboard-widget","name":"Custom Dashboard Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:51:17Z"},{"id":"wordfence:13d544ae-fbca-42d9-9d74-5e018092e097","source":"wordfence","cve":"CVE-2024-7876","title":"Appointment Booking Calendar <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d544ae-fbca-42d9-9d74-5e018092e097?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.53","to_inclusive":true,"patched_in":"1.6.7.55"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-15T19:18:36Z"},{"id":"wordfence:13d9a59f-1a1a-4936-a5ab-8a5e0c50303b","source":"wordfence","cve":"CVE-2024-11194","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13d9a59f-1a1a-4936-a5ab-8a5e0c50303b?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.1.15.1","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-19T11:32:12Z"},{"id":"wordfence:13dbda83-d309-4723-9876-1b19f5ab4620","source":"wordfence","cve":"CVE-2026-1540","title":"Spam Protect for Contact Form 7 < 1.2.10 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13dbda83-d309-4723-9876-1b19f5ab4620?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form-7-spam-blocker","name":"Spam Protect for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":false,"patched_in":"1.2.10"}],"published":"2026-03-12T00:00:00Z","updated":"2026-04-15T19:40:55Z"},{"id":"wordfence:13e77d77-8f09-4fb9-8ff9-a8e66afe0393","source":"wordfence","cve":"CVE-2014-4576","title":"WordPress Social Login <= 2.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13e77d77-8f09-4fb9-8ff9-a8e66afe0393?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-social-login","name":"WordPress Social Login","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13e7c4ab-7856-41a5-8cd9-4f8118af534d","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery <= 3.0.101 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13e7c4ab-7856-41a5-8cd9-4f8118af534d?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"3.0.101","to_inclusive":true,"patched_in":"3.0.102"}],"published":"2015-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13e8f16b-b5a3-4be1-9557-e11cd9ffaea7","source":"wordfence","cve":"","title":"Enhanced Admin Plugin < 1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13e8f16b-b5a3-4be1-9557-e11cd9ffaea7?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-plugin-admin","name":"Enhanced Plugin Admin","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":false,"patched_in":"1.16"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13e939ed-8c4f-43f0-b19b-3f6a48242cb4","source":"wordfence","cve":"CVE-2024-7846","title":"YITH WooCommerce Ajax Search <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13e939ed-8c4f-43f0-b19b-3f6a48242cb4?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-09-02T00:00:00Z","updated":"2024-10-04T16:48:37Z"},{"id":"wordfence:13e9deb0-73e1-44ea-820b-6cffe924b74b","source":"wordfence","cve":"CVE-2025-28865","title":"WP Colorful Tag Cloud <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13e9deb0-73e1-44ea-820b-6cffe924b74b?source=api-prod","affected":[{"type":"plugin","slug":"wp-colorful-tag-cloud","name":"WP Colorful Tag Cloud","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:46:13Z"},{"id":"wordfence:13eed921-d4da-4729-a02f-c9485f7b3266","source":"wordfence","cve":"CVE-2025-49960","title":"LeadBI Plugin for WordPress <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13eed921-d4da-4729-a02f-c9485f7b3266?source=api-prod","affected":[{"type":"plugin","slug":"leadbi","name":"LeadBI Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T00:00:00Z","updated":"2025-10-29T19:31:38Z"},{"id":"wordfence:13f2cce3-21ce-4c33-8628-f4f2dce7dcf9","source":"wordfence","cve":"CVE-2026-110379","title":"Quiz Maker by AYS <= 6.7.1.91 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13f2cce3-21ce-4c33-8628-f4f2dce7dcf9?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.1.91","to_inclusive":true,"patched_in":"6.7.1.92"}],"published":"2026-10-17T08:21:23Z","updated":"2026-10-23T18:35:10Z"},{"id":"wordfence:13f33422-13ba-4696-a473-cf8ca00d4b0c","source":"wordfence","cve":"CVE-2024-29764","title":"Molongui <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13f33422-13ba-4696-a473-cf8ca00d4b0c?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:16:03Z"},{"id":"wordfence:13f6bf06-2c24-43ac-9412-08b3d4914a21","source":"wordfence","cve":"CVE-2014-4598","title":"wp-tmkm-amazon < 1.5.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13f6bf06-2c24-43ac-9412-08b3d4914a21?source=api-prod","affected":[{"type":"plugin","slug":"wp-tmkm-amazon","name":"wp-tmkm-amazon","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13f87248-cc0b-4351-b79d-6efc5190b021","source":"wordfence","cve":"CVE-2024-13552","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13f87248-cc0b-4351-b79d-6efc5190b021?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-03-06T20:26:26Z","updated":"2025-03-07T09:21:16Z"},{"id":"wordfence:13fb725f-cb16-49e3-b545-14266538c604","source":"wordfence","cve":"","title":"RokIntroScroller <= 1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fb725f-cb16-49e3-b545-14266538c604?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokintroscroller","name":"RokIntroScroller","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2013-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13fb7904-8641-43ae-bcfe-00ca5416e949","source":"wordfence","cve":"CVE-2024-32677","title":"LoginPress Pro < 3.0 - Missing Authorization to License Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fb7904-8641-43ae-bcfe-00ca5416e949?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-07T07:14:25Z"},{"id":"wordfence:13fb8d16-2904-4c04-9ea6-5bafdf30f563","source":"wordfence","cve":"CVE-2024-8091","title":"Enhanced Search Box <= 0.6.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fb8d16-2904-4c04-9ea6-5bafdf30f563?source=api-prod","affected":[{"type":"plugin","slug":"extended-search-plugin","name":"Enhanced Search Box","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T22:15:23Z"},{"id":"wordfence:13fcbff8-8560-48ca-82df-8b620961d9c6","source":"wordfence","cve":"CVE-2025-13972","title":"WatchTowerHQ <= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fcbff8-8560-48ca-82df-8b620961d9c6?source=api-prod","affected":[{"type":"plugin","slug":"watchtowerhq","name":"WatchTowerHQ","from":"*","from_inclusive":true,"to":"3.16.0","to_inclusive":true,"patched_in":"3.16.1"}],"published":"2025-12-11T14:28:08Z","updated":"2026-01-13T17:16:16Z"},{"id":"wordfence:13fcfae2-33ad-44a7-885c-70e64b0074d8","source":"wordfence","cve":"CVE-2026-13413","title":"CMP - Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fcfae2-33ad-44a7-885c-70e64b0074d8?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.19","to_inclusive":true,"patched_in":"4.1.20"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T12:44:37Z"},{"id":"wordfence:13fd7509-6d61-4eb0-9f85-cc40e074b819","source":"wordfence","cve":"CVE-2023-5005","title":"Autocomplete Location field Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13fd7509-6d61-4eb0-9f85-cc40e074b819?source=api-prod","affected":[{"type":"plugin","slug":"autocomplete-location-field-contact-form-7","name":"Autocomplete Location Field for Contact Form 7","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:13ffe550-699a-4244-b0e1-859c113d77c0","source":"wordfence","cve":"CVE-2025-10167","title":"Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/13ffe550-699a-4244-b0e1-859c113d77c0?source=api-prod","affected":[{"type":"plugin","slug":"stock-snapshot-for-woocommerce","name":"Stock History & Reports Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-10-10T20:52:10Z","updated":"2025-10-14T19:14:10Z"},{"id":"wordfence:14014260-e872-48d8-8788-f89dbeec2080","source":"wordfence","cve":"CVE-2026-2027","title":"AMP Enhancer <= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14014260-e872-48d8-8788-f89dbeec2080?source=api-prod","affected":[{"type":"plugin","slug":"amp-enhancer","name":"AMP Enhancer \u2013 Compatibility Layer for Official AMP Plugin","from":"*","from_inclusive":true,"to":"1.0.49","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T16:20:49Z","updated":"2026-02-14T04:35:40Z"},{"id":"wordfence:140262fc-23d0-4c30-9ce8-da9ccf2159df","source":"wordfence","cve":"CVE-2025-25166","title":"InLocation <= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140262fc-23d0-4c30-9ce8-da9ccf2159df?source=api-prod","affected":[{"type":"plugin","slug":"inlocation","name":"InLocation","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:21:15Z"},{"id":"wordfence:14026e96-7e21-45db-b258-13b014ec478c","source":"wordfence","cve":"CVE-2023-0453","title":"WP Private Message < 1.0.6 - Insecure Direct Object Reference","severity":"high","cvss":7.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14026e96-7e21-45db-b258-13b014ec478c?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-message","name":"WP Private Message","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14039d7d-bd5a-4c6b-96b0-46f86536e085","source":"wordfence","cve":"CVE-2014-3841","title":"Contact Bank \u2013 Contact Form Builder for WordPress <= 2.0.19 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14039d7d-bd5a-4c6b-96b0-46f86536e085?source=api-prod","affected":[{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2014-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14043276-ba0a-4862-a1a7-00b4c372c5bc","source":"wordfence","cve":"CVE-2025-0469","title":"Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14043276-ba0a-4862-a1a7-00b4c372c5bc?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"1.39.2","from_inclusive":true,"to":"1.39.2","to_inclusive":true,"patched_in":"1.39.3"}],"published":"2025-02-26T16:21:30Z","updated":"2025-02-27T04:21:45Z"},{"id":"wordfence:1404c675-49b3-48a5-8aac-826c58755b8e","source":"wordfence","cve":"CVE-2024-13438","title":"SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1404c675-49b3-48a5-8aac-826c58755b8e?source=api-prod","affected":[{"type":"plugin","slug":"speedsize-ai-image-optimizer","name":"SpeedSize Image & Video AI-Optimizer","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T05:22:29Z"},{"id":"wordfence:1404f034-2d1d-44b2-87e5-61f72f215417","source":"wordfence","cve":"CVE-2024-10936","title":"String Locator <= 2.6.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1404f034-2d1d-44b2-87e5-61f72f215417?source=api-prod","affected":[{"type":"plugin","slug":"string-locator","name":"String locator","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-21T08:22:11Z"},{"id":"wordfence:1405cdd2-2b68-4b2f-bae6-9465c96da918","source":"wordfence","cve":"CVE-2025-69094","title":"Unicamp - University and College WordPress Theme <= 2.2.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1405cdd2-2b68-4b2f-bae6-9465c96da918?source=api-prod","affected":[{"type":"theme","slug":"unicamp","name":"Unicamp - University and College WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:52:37Z"},{"id":"wordfence:1405d8e3-3aa8-4a32-ac55-a260eda3d68c","source":"wordfence","cve":"CVE-2024-38701","title":"Academy LMS <= 2.0.4 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1405d8e3-3aa8-4a32-ac55-a260eda3d68c?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-16T19:25:20Z"},{"id":"wordfence:1405e58a-0783-46f7-bbf0-9645777ed64e","source":"wordfence","cve":"CVE-2025-22789","title":"polka dots <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1405e58a-0783-46f7-bbf0-9645777ed64e?source=api-prod","affected":[{"type":"theme","slug":"polka-dots","name":"Polka Dots","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:09:26Z"},{"id":"wordfence:140a6fd3-e446-44ea-94eb-9c8d12f7b7ed","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140a6fd3-e446-44ea-94eb-9c8d12f7b7ed?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:140b1f50-7c04-4396-ab0a-098bd06c80a8","source":"wordfence","cve":"CVE-2023-46313","title":"Zotpress <= 7.3.4 - Reflected Cross-Site Scripting via 'PHP_SELF'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140b1f50-7c04-4396-ab0a-098bd06c80a8?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2023-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:140c0d22-dc26-4100-a5c0-a2f8a6f98d97","source":"wordfence","cve":"CVE-2024-9205","title":"Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140c0d22-dc26-4100-a5c0-a2f8a6f98d97?source=api-prod","affected":[{"type":"plugin","slug":"maximum-products-per-user-for-woocommerce","name":"Maximum Products per User for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2024-10-09T13:47:01Z","updated":"2024-10-10T02:06:04Z"},{"id":"wordfence:140f633c-c2e4-4b3c-befc-d870e06be970","source":"wordfence","cve":"CVE-2025-2479","title":"Easy Custom Admin Bar <= 1.0 - Reflected Cross-Site Scripting via msg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140f633c-c2e4-4b3c-befc-d870e06be970?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-admin-bar","name":"Easy Custom Admin Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T17:54:14Z","updated":"2025-03-22T06:41:09Z"},{"id":"wordfence:140fa6e8-4381-4df2-af62-44d40b116daf","source":"wordfence","cve":"CVE-2025-0723","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/140fa6e8-4381-4df2-af62-44d40b116daf?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.7","to_inclusive":true,"patched_in":"5.9.4.8"}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-22T04:22:06Z"},{"id":"wordfence:1410d37a-fa8d-41e1-bed7-1c1436b52a83","source":"wordfence","cve":"CVE-2023-37887","title":"WPSchoolPress <= 2.2.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1410d37a-fa8d-41e1-bed7-1c1436b52a83?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1410ee86-90ec-4913-bc74-d8954d141d72","source":"wordfence","cve":"CVE-2026-40762","title":"WPGraphQL < 2.11.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1410ee86-90ec-4913-bc74-d8954d141d72?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":false,"patched_in":"2.11.1"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:43:47Z"},{"id":"wordfence:141137a4-609f-4ea9-beba-d37b48144c29","source":"wordfence","cve":"CVE-2025-14389","title":"WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/141137a4-609f-4ea9-beba-d37b48144c29?source=api-prod","affected":[{"type":"plugin","slug":"wpblogsync","name":"WPBlogSyn","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:16:52Z","updated":"2026-01-14T05:28:04Z"},{"id":"wordfence:1417fad0-51a0-4091-8f7b-4e8925fd71a0","source":"wordfence","cve":"CVE-2024-31374","title":"AppPresser <= 4.3.0 - Cross-Site Request Forgery via force_logging_off()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1417fad0-51a0-4091-8f7b-4e8925fd71a0?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:49:01Z"},{"id":"wordfence:1419f089-7656-43a1-aeee-c33eef604c84","source":"wordfence","cve":"","title":"Ultimate Product Catalog < 2.1.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1419f089-7656-43a1-aeee-c33eef604c84?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:141c33be-36f5-4db6-92f7-f04fa647af08","source":"wordfence","cve":"CVE-2025-66107","title":"Subscriptions & Memberships for PayPal <= 1.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/141c33be-36f5-4db6-92f7-f04fa647af08?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-memberships-for-paypal","name":"Subscriptions & Memberships for PayPal","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T17:33:39Z"},{"id":"wordfence:141e5e08-efc3-4da7-ada3-4774dac88884","source":"wordfence","cve":"CVE-2024-29788","title":"Podlove Web Player <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/141e5e08-efc3-4da7-ada3-4774dac88884?source=api-prod","affected":[{"type":"plugin","slug":"podlove-web-player","name":"Podlove Web Player","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-10-24T19:05:20Z"},{"id":"wordfence:141f6986-7e1d-43b7-8f45-b485f37b3436","source":"wordfence","cve":"CVE-2026-117588","title":"Google Review Slider <= 18.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/141f6986-7e1d-43b7-8f45-b485f37b3436?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"18.10","to_inclusive":true,"patched_in":"18.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T12:44:48Z"},{"id":"wordfence:1420e4e0-e163-4b64-9b54-26e274530e2f","source":"wordfence","cve":"CVE-2026-112221","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1420e4e0-e163-4b64-9b54-26e274530e2f?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-10-19T13:32:05Z","updated":"2026-10-23T18:49:06Z"},{"id":"wordfence:142361c0-ec89-403f-8336-98faf1e43ddd","source":"wordfence","cve":"CVE-2026-86798","title":"HootBoard <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/142361c0-ec89-403f-8336-98faf1e43ddd?source=api-prod","affected":[{"type":"plugin","slug":"hootboard","name":"HootBoard \u2013 Bulletin Board For Your Organization & Team Communication","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:14:43Z"},{"id":"wordfence:14250ff2-66e4-48f9-8f73-7f245079134c","source":"wordfence","cve":"CVE-2024-38763","title":"Popularis Verse <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14250ff2-66e4-48f9-8f73-7f245079134c?source=api-prod","affected":[{"type":"theme","slug":"popularis-verse","name":"Popularis Verse","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-07-12T00:00:00Z","updated":"2024-09-12T20:54:59Z"},{"id":"wordfence:1426bebe-d3c4-4f83-9b50-fae8c2373209","source":"wordfence","cve":"CVE-2023-33309","title":"Duplicator Pro <= 4.5.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1426bebe-d3c4-4f83-9b50-fae8c2373209?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"4.5.11.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1427ab4f-be7c-4c5c-92a5-aa486c113ba9","source":"wordfence","cve":"CVE-2025-49927","title":"JetWooBuilder <= 2.1.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1427ab4f-be7c-4c5c-92a5-aa486c113ba9?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.20.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-08-03T00:00:00Z","updated":"2026-01-07T14:32:01Z"},{"id":"wordfence:142bcbdd-7495-49be-a5b3-8ba1674cd64d","source":"wordfence","cve":"CVE-2014-5186","title":"All Video Gallery Plugin for WordPress <= 1.2 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/142bcbdd-7495-49be-a5b3-8ba1674cd64d?source=api-prod","affected":[{"type":"plugin","slug":"all-video-gallery","name":"All Video Gallery Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1431dcfe-08b7-40d3-b82b-d0b101873c39","source":"wordfence","cve":"CVE-2026-12397","title":"Job Portal <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Email Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1431dcfe-08b7-40d3-b82b-d0b101873c39?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T13:01:28Z"},{"id":"wordfence:1432907e-bcd0-498f-9356-f269a252bc4b","source":"wordfence","cve":"CVE-2014-2838","title":"GD Star Rating <= 1.9.22 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1432907e-bcd0-498f-9356-f269a252bc4b?source=api-prod","affected":[{"type":"plugin","slug":"gd-star-rating","name":"GD Star Rating","from":"*","from_inclusive":true,"to":"1.9.22","to_inclusive":true,"patched_in":""}],"published":"2014-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14351561-bd31-4aaa-931a-e72917458013","source":"wordfence","cve":"CVE-2023-6968","title":"The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14351561-bd31-4aaa-931a-e72917458013?source=api-prod","affected":[{"type":"plugin","slug":"the-moneytizer","name":"The Moneytizer","from":"*","from_inclusive":true,"to":"9.6.3","to_inclusive":true,"patched_in":"10.0.1"}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-29T21:35:54Z"},{"id":"wordfence:14376064-13c4-4874-afea-395af2a1933d","source":"wordfence","cve":"CVE-2023-22672","title":"vSlider Multi Image Slider <= 4.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14376064-13c4-4874-afea-395af2a1933d?source=api-prod","affected":[{"type":"plugin","slug":"vslider","name":"vSlider Multi Image Slider for WordPress","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:143c3a66-ac67-48e1-800f-8479fd963da3","source":"wordfence","cve":"CVE-2026-8354","title":"Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/143c3a66-ac67-48e1-800f-8479fd963da3?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2026-09-18T19:58:44Z","updated":"2026-09-19T08:27:21Z"},{"id":"wordfence:143c5f1f-032c-4207-9401-20f18efcad9d","source":"wordfence","cve":"CVE-2025-5531","title":"Staff Directory \u2013 Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/143c5f1f-032c-4207-9401-20f18efcad9d?source=api-prod","affected":[{"type":"plugin","slug":"employee-directory","name":"Employee Directory \u2013 Staff & Team Directory","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2025-06-03T00:00:00Z","updated":"2025-07-30T08:23:07Z"},{"id":"wordfence:143e28b0-56cf-4d8d-9147-60a85a595290","source":"wordfence","cve":"CVE-2024-4749","title":"WP eMember <= 10.3.8 - Reflected Cross-Site Scripting via 'fieldId'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/143e28b0-56cf-4d8d-9147-60a85a595290?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.3.8","to_inclusive":true,"patched_in":"10.3.9"}],"published":"2024-05-14T00:00:00Z","updated":"2024-07-23T19:25:33Z"},{"id":"wordfence:144555bc-b92f-4339-a1b2-397dfe6a78de","source":"wordfence","cve":"CVE-2025-47463","title":"Stock Locations for WooCommerce <= 2.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144555bc-b92f-4339-a1b2-397dfe6a78de?source=api-prod","affected":[{"type":"plugin","slug":"stock-locations-for-woocommerce","name":"Stock Locations for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2025-06-07T00:00:00Z","updated":"2025-06-10T18:15:00Z"},{"id":"wordfence:144895c9-5800-435e-9f75-a8de17ca2d93","source":"wordfence","cve":"CVE-2023-0911","title":"Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144895c9-5800-435e-9f75-a8de17ca2d93?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.7","to_inclusive":true,"patched_in":"5.12.8"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1448f0d2-6b1f-45de-8e3a-81b9445cb16d","source":"wordfence","cve":"CVE-2025-53237","title":"Wizard Cloak <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1448f0d2-6b1f-45de-8e3a-81b9445cb16d?source=api-prod","affected":[{"type":"plugin","slug":"wp-wizard-cloak","name":"WP Wizard Cloak","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T00:00:00Z","updated":"2026-02-26T19:49:12Z"},{"id":"wordfence:144d755a-e61a-4ecd-9d9a-9c6e3a1e6ea2","source":"wordfence","cve":"CVE-2024-10310","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144d755a-e61a-4ecd-9d9a-9c6e3a1e6ea2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-02T02:03:04Z"},{"id":"wordfence:144d7817-5916-4fbd-8ef6-e4c66c55a119","source":"wordfence","cve":"CVE-2025-47491","title":"Contact Form Widget <= 1.4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144d7817-5916-4fbd-8ef6-e4c66c55a119?source=api-prod","affected":[{"type":"plugin","slug":"new-contact-form-widget","name":"Contact Form Widget \u2013 Responsive Contact Form, Query Form & Form Builder","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:39:47Z"},{"id":"wordfence:144df910-67d2-4e3b-9ccf-04ebd5d1bf8b","source":"wordfence","cve":"CVE-2014-3961","title":"Participants Database < 1.5.4.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144df910-67d2-4e3b-9ccf-04ebd5d1bf8b?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"1.5.4.9","to_inclusive":false,"patched_in":"1.5.4.9"}],"published":"2014-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:144efb5e-ef90-433c-9122-dfcfebb10921","source":"wordfence","cve":"CVE-2026-57755","title":"Mosaic Gallery \u2013 Advanced Gallery <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/144efb5e-ef90-433c-9122-dfcfebb10921?source=api-prod","affected":[{"type":"plugin","slug":"mosaic-gallery-advanced-gallery","name":"Mosaic Gallery \u2013 Advanced Gallery","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:41:32Z"},{"id":"wordfence:1451e291-f25a-4402-a613-c94330e4bf05","source":"wordfence","cve":"CVE-2025-22761","title":"Ajax Contact Form <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1451e291-f25a-4402-a613-c94330e4bf05?source=api-prod","affected":[{"type":"plugin","slug":"fws-ajax-contact-form","name":"Simple Contact Form \u2013 Accessible & Anti-Spam","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2025-01-14T00:00:00Z","updated":"2025-03-25T19:18:56Z"},{"id":"wordfence:1453815d-4e28-41ec-9aa4-4fd2899c619a","source":"wordfence","cve":"","title":"Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1453815d-4e28-41ec-9aa4-4fd2899c619a?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2024-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1454af30-319a-44b7-a83e-2d774cfbc8d1","source":"wordfence","cve":"CVE-2024-9241","title":"PDF Image Generator <= 1.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1454af30-319a-44b7-a83e-2d774cfbc8d1?source=api-prod","affected":[{"type":"plugin","slug":"pdf-image-generator","name":"PDF Image Generator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:45:20Z","updated":"2024-10-01T08:30:14Z"},{"id":"wordfence:1456d58b-c651-4cf0-a32a-945320b4a2e8","source":"wordfence","cve":"CVE-2026-125844","title":"vice <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1456d58b-c651-4cf0-a32a-945320b4a2e8?source=api-prod","affected":[{"type":"theme","slug":"vice","name":"vice","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:22Z"},{"id":"wordfence:1458c525-d867-447b-acba-123759789ec8","source":"wordfence","cve":"CVE-2026-16617","title":"Simple File List <= 6.3.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1458c525-d867-447b-acba-123759789ec8?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.11","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:15:49Z"},{"id":"wordfence:145a2ba1-67c1-4446-9269-cdbfdce77ef9","source":"wordfence","cve":"CVE-2024-49220","title":"Cookie Scanner <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/145a2ba1-67c1-4446-9269-cdbfdce77ef9?source=api-prod","affected":[{"type":"plugin","slug":"cookie-scanner","name":"Cookie Scanner \u2013 automated cookie list","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:36:13Z"},{"id":"wordfence:145c0ecc-3af1-4e31-b7e3-329564fb0a21","source":"wordfence","cve":"CVE-2024-51575","title":"Extender All In One For Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/145c0ecc-3af1-4e31-b7e3-329564fb0a21?source=api-prod","affected":[{"type":"plugin","slug":"extender-all-in-one-for-elementor","name":"Extender All In One For Elementor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:42:43Z"},{"id":"wordfence:145cae1e-1e38-49bb-a63f-204246de6a37","source":"wordfence","cve":"CVE-2026-9331","title":"EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/145cae1e-1e38-49bb-a63f-204246de6a37?source=api-prod","affected":[{"type":"plugin","slug":"edd-products-feed-pro","name":"EDD Product Catalog Feed by PixelYourSite","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T09:27:56Z"},{"id":"wordfence:145deebd-1e15-4f8a-878c-9424c2cd9601","source":"wordfence","cve":"CVE-2025-11087","title":"Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/145deebd-1e15-4f8a-878c-9424c2cd9601?source=api-prod","affected":[{"type":"plugin","slug":"zegen-core","name":"Zegen Core","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-11-21T07:31:39Z","updated":"2025-11-21T20:29:04Z"},{"id":"wordfence:145fec62-87a7-4641-9ce4-dca5afb47d69","source":"wordfence","cve":"","title":"Add to home screen WP Plugin <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/145fec62-87a7-4641-9ce4-dca5afb47d69?source=api-prod","affected":[{"type":"plugin","slug":"add-to-home-screen-wp","name":"Add to Home Screen & Progressive Web App","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2022-12-06T00:00:00Z","updated":"2025-03-13T19:54:27Z"},{"id":"wordfence:1460dc44-dd64-4fd6-952b-1f5d4285bfa4","source":"wordfence","cve":"CVE-2023-37979","title":"Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1460dc44-dd64-4fd6-952b-1f5d4285bfa4?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1462f52b-98f0-40de-8f95-717992c7cbc6","source":"wordfence","cve":"CVE-2026-12987","title":"Events Manager <= 7.3.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1462f52b-98f0-40de-8f95-717992c7cbc6?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-29T23:15:22Z"},{"id":"wordfence:1463cfe6-e158-44b2-a7ae-215e56d33856","source":"wordfence","cve":"CVE-2025-68000","title":"Testimonial Slider <= 2.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1463cfe6-e158-44b2-a7ae-215e56d33856?source=api-prod","affected":[{"type":"plugin","slug":"testimonial","name":"Testimonial \u2013 Testimonial Slider, Reviews Slider, Testimonial By AI","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-14T19:38:33Z"},{"id":"wordfence:1465dbb6-1ec3-425f-9b7e-6dff6b120606","source":"wordfence","cve":"CVE-2022-38139","title":"RD Station <= 5.1.3 - Cross-Site Request Forgery to Plugin Log Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1465dbb6-1ec3-425f-9b7e-6dff6b120606?source=api-prod","affected":[{"type":"plugin","slug":"integracao-rd-station","name":"RD Station","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14667d93-4fba-4c50-8228-737ae91f2789","source":"wordfence","cve":"","title":"MailPoet Newsletters <= 2.6.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14667d93-4fba-4c50-8228-737ae91f2789?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14689386-fca5-48a6-9494-4a79b920d5f8","source":"wordfence","cve":"CVE-2012-4421","title":"WordPress Core < 3.4.2 - Missing Authorization Checks on create_post","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14689386-fca5-48a6-9494-4a79b920d5f8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2012-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:146b4d69-70bc-4843-b76c-d91de0cefc9d","source":"wordfence","cve":"CVE-2024-32440","title":"Asgaros Forum <= 2.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/146b4d69-70bc-4843-b76c-d91de0cefc9d?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T18:01:46Z"},{"id":"wordfence:146c8783-ba59-41da-9e95-7401865b7b8c","source":"wordfence","cve":"CVE-2014-9173","title":"Google Doc Embedder < 2.5.17 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/146c8783-ba59-41da-9e95-7401865b7b8c?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.5.17","to_inclusive":false,"patched_in":"2.5.17"}],"published":"2015-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1471bd32-4b91-4351-957f-e0a497d471ec","source":"wordfence","cve":"CVE-2025-30895","title":"WpEvently <= 4.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1471bd32-4b91-4351-957f-e0a497d471ec?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:38:59Z"},{"id":"wordfence:1471fb10-004f-4e69-a14d-1c4bd1210b49","source":"wordfence","cve":"CVE-2026-125455","title":"Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1471fb10-004f-4e69-a14d-1c4bd1210b49?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"5.9.12"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:19Z"},{"id":"wordfence:1473bb66-8586-4174-b6ce-32502ad7a9c7","source":"wordfence","cve":"CVE-2025-68512","title":"Real 3D FlipBook <= 4.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1473bb66-8586-4174-b6ce-32502ad7a9c7?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"4.11.4","to_inclusive":true,"patched_in":"4.16.4"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-05T18:47:04Z"},{"id":"wordfence:14759eb0-455f-4b7d-abab-4e4d89b32bb1","source":"wordfence","cve":"CVE-2025-10754","title":"DocoDoco Store Locator <= 1.0.1 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14759eb0-455f-4b7d-abab-4e4d89b32bb1?source=api-prod","affected":[{"type":"plugin","slug":"docodoco-store-locator","name":"DocoDoco Store Locator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T20:03:06Z","updated":"2025-10-15T08:25:49Z"},{"id":"wordfence:1475f3c4-b1ff-422c-a832-f6261361c240","source":"wordfence","cve":"CVE-2026-9234","title":"JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1475f3c4-b1ff-422c-a832-f6261361c240?source=api-prod","affected":[{"type":"plugin","slug":"woo-jtl-connector","name":"JTL-Connector for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-06-01T19:43:29Z","updated":"2026-09-18T19:48:13Z"},{"id":"wordfence:1479071c-85c3-41fd-8ad7-f0dee32f201b","source":"wordfence","cve":"CVE-2025-3419","title":"Event Manager, Events Calendar, Tickets, Registrations \u2013 Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1479071c-85c3-41fd-8ad7-f0dee32f201b?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"4.0.27"}],"published":"2025-05-07T16:25:44Z","updated":"2025-05-12T19:22:07Z"},{"id":"wordfence:147ad116-04fa-4dfa-9b96-26f361e19256","source":"wordfence","cve":"CVE-2024-8095","title":"BabelZ \u2013 Google Translate Widget <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/147ad116-04fa-4dfa-9b96-26f361e19256?source=api-prod","affected":[{"type":"plugin","slug":"babelz","name":"BabelZ \u2013 Google Translate Widget","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-24T15:37:07Z"},{"id":"wordfence:147b7be2-8bbe-4e95-bfcb-1c4ff8a41a3b","source":"wordfence","cve":"CVE-2022-1656","title":"JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/147b7be2-8bbe-4e95-bfcb-1c4ff8a41a3b?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"},{"type":"theme","slug":"jupiterx","name":"JupiterX","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:147bada2-036d-4e35-9ba2-59ad382afeb9","source":"wordfence","cve":"CVE-2024-49234","title":"Plexx Elementor Extension <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/147bada2-036d-4e35-9ba2-59ad382afeb9?source=api-prod","affected":[{"type":"plugin","slug":"plexx-elementor-extension","name":"Plexx Elementor Extension","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-21T15:44:02Z"},{"id":"wordfence:147c8d60-1ed1-4d01-8160-7d500b30ab98","source":"wordfence","cve":"CVE-2025-69364","title":"Breeze <= 2.2.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/147c8d60-1ed1-4d01-8160-7d500b30ab98?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.2.21","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:44:55Z"},{"id":"wordfence:147e47f8-c40b-4ae7-8627-b32b36e4d14f","source":"wordfence","cve":"CVE-2023-46151","title":"Product Category Tree <= 2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/147e47f8-c40b-4ae7-8627-b32b36e4d14f?source=api-prod","affected":[{"type":"plugin","slug":"product-category-tree","name":"Product Category Tree","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:148573a1-ccdc-4515-8e49-b1b04911abcf","source":"wordfence","cve":"CVE-2026-27428","title":"Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/148573a1-ccdc-4515-8e49-b1b04911abcf?source=api-prod","affected":[{"type":"plugin","slug":"eagle-booking","name":"Eagle Booking","from":"*","from_inclusive":true,"to":"1.3.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T14:47:35Z"},{"id":"wordfence:1485dda6-bf83-4076-80c9-dc7ea9d58155","source":"wordfence","cve":"CVE-2023-3219","title":"EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1485dda6-bf83-4076-80c9-dc7ea9d58155?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":false,"patched_in":"4.4"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14877ff6-e393-41a3-91c1-fe7f477297cc","source":"wordfence","cve":"CVE-2025-6065","title":"Image Resizer On The Fly <= 1.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14877ff6-e393-41a3-91c1-fe7f477297cc?source=api-prod","affected":[{"type":"plugin","slug":"image-resizer-on-the-fly","name":"Image Resizer On The Fly","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:37:45Z","updated":"2025-06-14T08:23:21Z"},{"id":"wordfence:148794ea-3bc9-4084-bdb9-6ee63a781a39","source":"wordfence","cve":"CVE-2023-5417","title":"Funnelforms Free <= 3.4 - Missing Authorization to Category Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/148794ea-3bc9-4084-bdb9-6ee63a781a39?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14894c36-f657-4368-bc7f-60121ec08c13","source":"wordfence","cve":"CVE-2024-1896","title":"Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14894c36-f657-4368-bc7f-60121ec08c13?source=api-prod","affected":[{"type":"plugin","slug":"new-photo-gallery","name":"Photo Gallery \u2013 Image, Video & Portfolio","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-21T15:19:08Z"},{"id":"wordfence:148ca1d5-c20d-40dc-b078-ecd76d4d6c0b","source":"wordfence","cve":"CVE-2024-4532","title":"Business Card <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Card Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/148ca1d5-c20d-40dc-b078-ecd76d4d6c0b?source=api-prod","affected":[{"type":"plugin","slug":"business-card-by-esterox-100","name":"Business Card","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T00:29:52Z"},{"id":"wordfence:148cc174-c6cf-46d7-98d7-1a07e19055e1","source":"wordfence","cve":"","title":"Page Restrict <= 2.2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/148cc174-c6cf-46d7-98d7-1a07e19055e1?source=api-prod","affected":[{"type":"plugin","slug":"pagerestrict","name":"Page Restrict","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1492440d-c6c8-46c0-bc88-c9e3f9933ad4","source":"wordfence","cve":"CVE-2024-4083","title":"Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1492440d-c6c8-46c0-bc88-c9e3f9933ad4?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-booking","name":"Easy Restaurant Table Booking","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:51:47Z"},{"id":"wordfence:149428d3-60ff-4c27-8d6f-c5f628d2331b","source":"wordfence","cve":"CVE-2026-125438","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1235 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149428d3-60ff-4c27-8d6f-c5f628d2331b?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1235","to_inclusive":true,"patched_in":"4.1236"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:36Z"},{"id":"wordfence:14958861-305e-4a9b-b428-de204cd6781e","source":"wordfence","cve":"","title":"404 Solution <= 2.33.2 - Authenticated (Administrator+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14958861-305e-4a9b-b428-de204cd6781e?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.34.0","to_inclusive":false,"patched_in":"2.34.0"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1496ce98-ee19-4f37-9ec7-eb0fafb5df19","source":"wordfence","cve":"CVE-2023-2470","title":"Add to Feedly <= 1.2.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1496ce98-ee19-4f37-9ec7-eb0fafb5df19?source=api-prod","affected":[{"type":"plugin","slug":"add-to-feedly","name":"Add to Feedly","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1497a6e4-fc4a-4f12-bd89-01d468ccd128","source":"wordfence","cve":"CVE-2026-59547","title":"Payment Gateway for PayPal on WooCommerce <= 9.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1497a6e4-fc4a-4f12-bd89-01d468ccd128?source=api-prod","affected":[{"type":"plugin","slug":"woo-paypal-gateway","name":"Payment Gateway for PayPal on WooCommerce","from":"*","from_inclusive":true,"to":"9.1.4","to_inclusive":true,"patched_in":"9.1.5"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:31:30Z"},{"id":"wordfence:14981949-271c-4f98-a6a1-b00619f1436d","source":"wordfence","cve":"CVE-2025-13538","title":"FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14981949-271c-4f98-a6a1-b00619f1436d?source=api-prod","affected":[{"type":"plugin","slug":"findall-listing","name":"FindAll Listing","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-11-26T16:08:16Z","updated":"2025-11-27T04:36:43Z"},{"id":"wordfence:14993c04-7fe3-4c42-a605-2e431df14d79","source":"wordfence","cve":"CVE-2024-0910","title":"Restrict for Elementor <= 1.0.7 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14993c04-7fe3-4c42-a605-2e431df14d79?source=api-prod","affected":[{"type":"plugin","slug":"restrict-for-elementor","name":"Restrict for Elementor","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-06-05T13:10:13Z","updated":"2024-07-01T15:36:21Z"},{"id":"wordfence:149a1db3-2c18-4651-9e25-25b4854a31f1","source":"wordfence","cve":"CVE-2026-121870","title":"Simpler Checkout < 1.5.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149a1db3-2c18-4651-9e25-25b4854a31f1?source=api-prod","affected":[{"type":"plugin","slug":"simpler-checkout","name":"Simpler Checkout","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:51Z"},{"id":"wordfence:149c1da7-9da8-4e3f-8d34-39ce464847b1","source":"wordfence","cve":"CVE-2025-30616","title":"Latest Custom Post Type Updates <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149c1da7-9da8-4e3f-8d34-39ce464847b1?source=api-prod","affected":[{"type":"plugin","slug":"latest-custom-post-type-updates","name":"Latest Custom Post Type Updates","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T13:37:25Z"},{"id":"wordfence:149e60cc-9612-4651-b02d-4b68a3533d36","source":"wordfence","cve":"CVE-2025-11876","title":"Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149e60cc-9612-4651-b02d-4b68a3533d36?source=api-prod","affected":[{"type":"plugin","slug":"mailgun-subscriptions","name":"Mailgun Subscriptions","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-12-11T18:35:18Z","updated":"2025-12-12T07:20:33Z"},{"id":"wordfence:149eb7ef-be96-442e-925e-01d8d76e3a1a","source":"wordfence","cve":"CVE-2019-16781","title":"WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149eb7ef-be96-442e-925e-01d8d76e3a1a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.20","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.19","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.16","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.15","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2019-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:149edbdf-4a27-4d79-8dd1-b5b3efbf648b","source":"wordfence","cve":"CVE-2025-0507","title":"Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149edbdf-4a27-4d79-8dd1-b5b3efbf648b?source=api-prod","affected":[{"type":"plugin","slug":"ploxel","name":"Ticketmeo \u2013 Sell Tickets \u2013 Event Ticketing","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T04:21:47Z"},{"id":"wordfence:149ef56e-b9a6-4d28-9c90-0e2fa917ada6","source":"wordfence","cve":"CVE-2026-32452","title":"Avada (Fusion) Builder < 3.15.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149ef56e-b9a6-4d28-9c90-0e2fa917ada6?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":false,"patched_in":"3.15.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:44:24Z"},{"id":"wordfence:149f5463-8777-4906-b87e-14f5b8178763","source":"wordfence","cve":"CVE-2026-84771","title":"PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.3 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149f5463-8777-4906-b87e-14f5b8178763?source=api-prod","affected":[{"type":"plugin","slug":"press-permit-core","name":"PublishPress Permissions: Access Control, Content Permissions, User Access","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:36:16Z"},{"id":"wordfence:149fbc16-c35d-4f4b-9bae-13c05451de54","source":"wordfence","cve":"CVE-2025-31924","title":"Crafts & Arts <= 2.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/149fbc16-c35d-4f4b-9bae-13c05451de54?source=api-prod","affected":[{"type":"theme","slug":"crafts-and-arts","name":"Crafts & Arts - Handmade Artist WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T15:38:18Z"},{"id":"wordfence:14a0f10a-2e78-44da-ace1-172aece6eba6","source":"wordfence","cve":"CVE-2026-88927","title":"rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14a0f10a-2e78-44da-ace1-172aece6eba6?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.14","to_inclusive":false,"patched_in":"4.7.14"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:40:33Z"},{"id":"wordfence:14a1b8af-bd32-4245-92d6-549cae68c626","source":"wordfence","cve":"CVE-2021-25003","title":"WPCargo <= 6.8.9 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14a1b8af-bd32-4245-92d6-549cae68c626?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":false,"patched_in":"6.9.0"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14a20f9c-cf5a-4d57-b723-ad29a12c8881","source":"wordfence","cve":"CVE-2023-28622","title":"Easy Slider Revolution <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14a20f9c-cf5a-4d57-b723-ad29a12c8881?source=api-prod","affected":[{"type":"plugin","slug":"easy-slider-revolution","name":"Easy Slider","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-04-21T00:00:00Z","updated":"2024-07-09T13:25:03Z"},{"id":"wordfence:14a41df0-d283-4870-b6a4-a8e2c258f9ed","source":"wordfence","cve":"CVE-2026-120851","title":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 4.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14a41df0-d283-4870-b6a4-a8e2c258f9ed?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:59:05Z"},{"id":"wordfence:14a84b47-b176-475f-b983-00416b603fc4","source":"wordfence","cve":"CVE-2026-56012","title":"Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14a84b47-b176-475f-b983-00416b603fc4?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:51:03Z"},{"id":"wordfence:14ab5d7c-ab46-4a53-b0d2-8b331e204cf3","source":"wordfence","cve":"CVE-2024-8543","title":"Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ab5d7c-ab46-4a53-b0d2-8b331e204cf3?source=api-prod","affected":[{"type":"plugin","slug":"slider-comparison-image-before-and-after","name":"Slider comparison image before and after","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-09T20:41:34Z","updated":"2024-09-10T09:30:18Z"},{"id":"wordfence:14acb770-9a32-4308-993d-a3d3dec91f78","source":"wordfence","cve":"CVE-2024-32567","title":"DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14acb770-9a32-4308-993d-a3d3dec91f78?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T11:48:51Z"},{"id":"wordfence:14ad420b-df09-48de-8e36-d8edf0647837","source":"wordfence","cve":"CVE-2022-0707","title":"Easy Digital Downloads <= 2.11.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ad420b-df09-48de-8e36-d8edf0647837?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.11.6","to_inclusive":false,"patched_in":"2.11.6"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14ae1f7a-be81-4f4f-8cea-7afb824186aa","source":"wordfence","cve":"CVE-2024-37548","title":"Meks Easy Ads Widget <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ae1f7a-be81-4f4f-8cea-7afb824186aa?source=api-prod","affected":[{"type":"plugin","slug":"meks-easy-ads-widget","name":"Meks Easy Ads Widget","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-26T20:00:43Z"},{"id":"wordfence:14ae2d0f-5c50-4498-8809-e3425d61ed0e","source":"wordfence","cve":"CVE-2025-23941","title":"MeinTurnierplan.de Widget Viewer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ae2d0f-5c50-4498-8809-e3425d61ed0e?source=api-prod","affected":[{"type":"plugin","slug":"meinturnierplande-widget-viewer","name":"MeinTurnierplan.de Widget Viewer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:00:23Z"},{"id":"wordfence:14aff362-2f49-460e-94db-1e0573c91c88","source":"wordfence","cve":"CVE-2025-30614","title":"Google Font Fix <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14aff362-2f49-460e-94db-1e0573c91c88?source=api-prod","affected":[{"type":"plugin","slug":"google-font-fix","name":"Google Font Fix","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:52:17Z"},{"id":"wordfence:14b10f8e-37dd-4a34-87da-c09fdb8e09b3","source":"wordfence","cve":"CVE-2024-54250","title":"Prodigy Commerce <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b10f8e-37dd-4a34-87da-c09fdb8e09b3?source=api-prod","affected":[{"type":"plugin","slug":"prodigy-commerce","name":"Prodigy Commerce","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:55:42Z"},{"id":"wordfence:14b2fa77-dc51-47b4-913a-9129f95ba766","source":"wordfence","cve":"CVE-2023-32586","title":"Soundcloud Is Gold <= 2.5.1 - Missing Authorization to Soundcloud User Add","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b2fa77-dc51-47b4-913a-9129f95ba766?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-is-gold","name":"SoundCloud Is Gold","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14b323e6-1a21-419f-83cc-74cf07cbb6d4","source":"wordfence","cve":"CVE-2025-32295","title":"Salon Booking Pro <= 10.10.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b323e6-1a21-419f-83cc-74cf07cbb6d4?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-plugin-pro-cc","name":"Salon Booking Pro","from":"*","from_inclusive":true,"to":"10.10.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T20:06:46Z"},{"id":"wordfence:14b334ee-ab3b-4b18-a776-c0831c4ff855","source":"wordfence","cve":"CVE-2021-36893","title":"Responsive Tabs <= 4.0.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b334ee-ab3b-4b18-a776-c0831c4ff855?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs","name":"Responsive Tabs","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2022-04-11T10:38:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14b45907-2602-40b4-a497-9c1d4823c386","source":"wordfence","cve":"CVE-2025-26539","title":"Embed Google Map <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b45907-2602-40b4-a497-9c1d4823c386?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-map","name":"Embed Google Map","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:40:21Z"},{"id":"wordfence:14b6f5b6-66ab-4c47-853e-7551fad39478","source":"wordfence","cve":"CVE-2022-27849","title":"Simple Ajax Chat Plugin <= 20220115 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b6f5b6-66ab-4c47-853e-7551fad39478?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20220115","to_inclusive":true,"patched_in":"20220216"}],"published":"2022-04-15T10:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14b7fd1e-6e2d-49bb-8492-b072afeebd88","source":"wordfence","cve":"CVE-2017-5493","title":"WordPress Core < 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup","severity":"medium","cvss":5.3,"cwe":"CWE-338","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b7fd1e-6e2d-49bb-8492-b072afeebd88?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14b89618-8a30-4b8c-9490-f05e8fa8ca8a","source":"wordfence","cve":"CVE-2026-0690","title":"FlatPM \u2013 Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b89618-8a30-4b8c-9490-f05e8fa8ca8a?source=api-prod","affected":[{"type":"plugin","slug":"flatpm-wp","name":"FlatPM \u2013 Ad Manager, AdSense and Custom Code","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-01-20T01:56:29Z","updated":"2026-01-20T14:26:32Z"},{"id":"wordfence:14b9fbd2-206d-49e2-9b53-a7ba459ee518","source":"wordfence","cve":"CVE-2024-56005","title":"Posti Shipping <= 3.10.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14b9fbd2-206d-49e2-9b53-a7ba459ee518?source=api-prod","affected":[{"type":"plugin","slug":"posti-shipping","name":"Posti Shipping","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:16:10Z"},{"id":"wordfence:14baad86-ef7d-4d9c-b878-ea97f66b37a0","source":"wordfence","cve":"CVE-2026-65550","title":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14baad86-ef7d-4d9c-b878-ea97f66b37a0?source=api-prod","affected":[{"type":"plugin","slug":"tabs-responsive","name":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:29:50Z"},{"id":"wordfence:14bb850e-df8a-46f0-b320-d8aedd763901","source":"wordfence","cve":"CVE-2026-96563","title":"Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14bb850e-df8a-46f0-b320-d8aedd763901?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.124","to_inclusive":true,"patched_in":"1.4.125"}],"published":"2026-10-09T19:21:17Z","updated":"2026-10-22T19:44:37Z"},{"id":"wordfence:14bc8256-227e-409a-b853-9157416b46ea","source":"wordfence","cve":"CVE-2024-53800","title":"Rezgo Online Booking <= 4.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14bc8256-227e-409a-b853-9157416b46ea?source=api-prod","affected":[{"type":"plugin","slug":"rezgo","name":"Rezgo Online Booking","from":"*","from_inclusive":true,"to":"4.17","to_inclusive":true,"patched_in":"4.17.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-05-05T18:29:30Z"},{"id":"wordfence:14bf2f2e-4607-4817-ab8c-d986315964bc","source":"wordfence","cve":"CVE-2026-28100","title":"UberSlider PerpetuumMobile <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14bf2f2e-4607-4817-ab8c-d986315964bc?source=api-prod","affected":[{"type":"plugin","slug":"uberSlider_perpetuummobile","name":"UberSlider - Layer Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:08:53Z"},{"id":"wordfence:14bf654e-c4f1-4267-811e-6d796c14834a","source":"wordfence","cve":"CVE-2023-31088","title":"Floating Action Button <= <=1.2.1 - Cross-Site Request Forgery to Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14bf654e-c4f1-4267-811e-6d796c14834a?source=api-prod","affected":[{"type":"plugin","slug":"floating-action-button","name":"Floating Action Button","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14c07d55-285b-4c7c-bed6-4c5224a7044a","source":"wordfence","cve":"","title":"Extra Charges To Payment Gateway For WooCommerce <= 2.0.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c07d55-285b-4c7c-bed6-4c5224a7044a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-extra-charges-to-payment-gateways","name":"Extra Charges To Payment Gateway For WooCommerce (Standard)","from":"*","from_inclusive":true,"to":"2.0.2.1","to_inclusive":true,"patched_in":""}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14c24bff-91a1-402a-a9d1-a1a7800db62f","source":"wordfence","cve":"CVE-2025-11992","title":"Multi Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c24bff-91a1-402a-a9d1-a1a7800db62f?source=api-prod","affected":[{"type":"plugin","slug":"mislider","name":"Multi Item Responsive Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T20:09:57Z","updated":"2025-10-24T08:23:56Z"},{"id":"wordfence:14c3b53c-ba98-4e93-ba65-6da11816d7a6","source":"wordfence","cve":"CVE-2026-1643","title":"MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c3b53c-ba98-4e93-ba65-6da11816d7a6?source=api-prod","affected":[{"type":"plugin","slug":"mp-ukagaka","name":"MP-Ukagaka","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:23:36Z","updated":"2026-02-07T08:26:37Z"},{"id":"wordfence:14c40974-b527-43b2-9e70-b85c5d98c4ad","source":"wordfence","cve":"CVE-2026-110888","title":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c40974-b527-43b2-9e70-b85c5d98c4ad?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-10-15T17:46:00Z","updated":"2026-10-23T18:37:58Z"},{"id":"wordfence:14c5fd0c-0872-4b05-b28b-11353e9276d0","source":"wordfence","cve":"CVE-2026-32441","title":"Comments Import & Export <= 2.4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c5fd0c-0872-4b05-b28b-11353e9276d0?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:20:46Z"},{"id":"wordfence:14c857aa-5c6e-4a1a-b122-efb5d53a56cb","source":"wordfence","cve":"CVE-2025-22580","title":"Biltorvet Dealer Tools <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c857aa-5c6e-4a1a-b122-efb5d53a56cb?source=api-prod","affected":[{"type":"plugin","slug":"biltorvet-dealer-tools","name":"Biltorvet Dealer Tools","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:30:15Z"},{"id":"wordfence:14c94d47-c911-4874-a897-58f4c0800329","source":"wordfence","cve":"CVE-2023-23734","title":"Userlike <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c94d47-c911-4874-a897-58f4c0800329?source=api-prod","affected":[{"type":"plugin","slug":"userlike","name":"Lime Connect (formerly Userlike) \u2013 WordPress Live Chat plugin","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14c9dc08-6965-4a22-a97a-5afc8152887d","source":"wordfence","cve":"CVE-2020-13892","title":"SportsPress <= 2.7.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14c9dc08-6965-4a22-a97a-5afc8152887d?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2020-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14ccd915-a513-45a4-84d3-b2b1fb893f1c","source":"wordfence","cve":"","title":"Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Request Forgery","severity":"low","cvss":3.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ccd915-a513-45a4-84d3-b2b1fb893f1c?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.15.23","to_inclusive":false,"patched_in":"4.15.23"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14d2198a-4117-4182-9b03-9fa463da03d9","source":"wordfence","cve":"CVE-2025-66127","title":"Essential Real Estate <= 5.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d2198a-4117-4182-9b03-9fa463da03d9?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2025-12-14T00:00:00Z","updated":"2026-11-03T22:45:04Z"},{"id":"wordfence:14d3b859-def9-4949-95bc-f25067674811","source":"wordfence","cve":"CVE-2024-35672","title":"Netgsm <= 2.9.32 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d3b859-def9-4949-95bc-f25067674811?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.9.32","to_inclusive":true,"patched_in":"2.9.33"}],"published":"2024-05-10T00:00:00Z","updated":"2024-11-20T15:10:59Z"},{"id":"wordfence:14d41282-740d-4602-b869-c2b313c96fbc","source":"wordfence","cve":"CVE-2025-22641","title":"FM Notification Bar <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d41282-740d-4602-b869-c2b313c96fbc?source=api-prod","affected":[{"type":"plugin","slug":"fm-notification-bar","name":"FM Notification Bar","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:19:07Z"},{"id":"wordfence:14d44753-fbfb-4538-b8ae-0e2a13b14c8e","source":"wordfence","cve":"CVE-2015-2089","title":"CrossSlide jQuery Plugin <= 2.0.5 - Multiple Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d44753-fbfb-4538-b8ae-0e2a13b14c8e?source=api-prod","affected":[{"type":"plugin","slug":"crossslide-jquery-plugin-for-wordpress","name":"Cross Slide","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2015-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14d48a81-c6b5-415f-8c82-5fd40b2e790a","source":"wordfence","cve":"CVE-2019-13571","title":"Advanced Contact Form 7 DB <= 1.6.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d48a81-c6b5-415f-8c82-5fd40b2e790a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14d52936-8fb6-464b-9c0f-038fba0ee57f","source":"wordfence","cve":"CVE-2024-56252","title":"Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d52936-8fb6-464b-9c0f-038fba0ee57f?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:08:37Z"},{"id":"wordfence:14d62f8f-b1fb-4716-9c95-5352f1e4a02c","source":"wordfence","cve":"CVE-2026-89001","title":"WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d62f8f-b1fb-4716-9c95-5352f1e4a02c?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.26","to_inclusive":true,"patched_in":"2.8.27"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:56:30Z"},{"id":"wordfence:14d71220-be60-498d-92ca-055f1c237060","source":"wordfence","cve":"CVE-2024-6167","title":"Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d71220-be60-498d-92ca-055f1c237060?source=api-prod","affected":[{"type":"plugin","slug":"just-custom-fields","name":"Just Custom Fields","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-22T12:47:03Z"},{"id":"wordfence:14d7d6a9-64f7-4209-8ee9-eac4d7a8dea1","source":"wordfence","cve":"CVE-2025-46241","title":"Appointment Booking Calendar <= 1.3.92 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d7d6a9-64f7-4209-8ee9-eac4d7a8dea1?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.92","to_inclusive":true,"patched_in":"1.3.93"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:23:52Z"},{"id":"wordfence:14d81210-9360-4153-9b5a-35d12cc0cbf0","source":"wordfence","cve":"CVE-2011-5328","title":"User Access Manager < 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d81210-9360-4153-9b5a-35d12cc0cbf0?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2011-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14d84ad4-904b-4000-af82-b1b68c724aa2","source":"wordfence","cve":"","title":"Elegance <= 2.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14d84ad4-904b-4000-af82-b1b68c724aa2?source=api-prod","affected":[{"type":"theme","slug":"elegance","name":"Elegance","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14da4735-894e-408a-864b-cdc76feacde9","source":"wordfence","cve":"CVE-2024-33584","title":"Video Conferencing with Zoom <= 4.4.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14da4735-894e-408a-864b-cdc76feacde9?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:48:52Z"},{"id":"wordfence:14dcc17f-8252-44d0-ba31-f12f7f53593a","source":"wordfence","cve":"CVE-2025-23477","title":"Realty Workstation <= 1.0.45 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14dcc17f-8252-44d0-ba31-f12f7f53593a?source=api-prod","affected":[{"type":"plugin","slug":"realty-workstation","name":"Realty Workstation","from":"*","from_inclusive":true,"to":"1.0.45","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:18:09Z"},{"id":"wordfence:14dcd7a0-4fa7-4b07-b2d1-5d6c605c7fc5","source":"wordfence","cve":"CVE-2026-93662","title":"Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14dcd7a0-4fa7-4b07-b2d1-5d6c605c7fc5?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"7.4.1","from_inclusive":true,"to":"7.4.4","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T20:03:22Z"},{"id":"wordfence:14dd84e5-69fa-4de9-b72c-dfedfd85582c","source":"wordfence","cve":"CVE-2021-24204","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14dd84e5-69fa-4de9-b72c-dfedfd85582c?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14e00e65-32ce-4bd3-b118-5f92af6aa979","source":"wordfence","cve":"CVE-2026-24376","title":"WPVulnerability <= 4.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14e00e65-32ce-4bd3-b118-5f92af6aa979?source=api-prod","affected":[{"type":"plugin","slug":"wpvulnerability","name":"WPVulnerability","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.1.1"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:32:48Z"},{"id":"wordfence:14e6e06c-edc0-44ef-ba07-50fcfc4fd7b1","source":"wordfence","cve":"CVE-2023-3507","title":"WooCommerce Pre-Orders <= 2.0.2 - Cross-Site Request Forgery to Order Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14e6e06c-edc0-44ef-ba07-50fcfc4fd7b1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pre-orders","name":"WooCommerce Pre-Orders","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14e832ec-7181-44d9-8d26-2f77e6111763","source":"wordfence","cve":"CVE-2023-25993","title":"Top 10 \u2013 Popular posts plugin for WordPress <= 3.2.3 - Missing Authorization on tptn_ajax_clearcache","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14e832ec-7181-44d9-8d26-2f77e6111763?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14e897f0-11e6-43b1-908c-be4ecdc7fd58","source":"wordfence","cve":"CVE-2024-4043","title":"WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14e897f0-11e6-43b1-908c-be4ecdc7fd58?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-post-grid","name":"WP Ultimate Post Grid","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2024-05-22T17:51:53Z","updated":"2024-05-23T06:46:05Z"},{"id":"wordfence:14e9d0a2-a1cb-4d3e-b6df-fba01d476936","source":"wordfence","cve":"CVE-2024-49297","title":"Zoho CRM Lead Magnet <= 1.7.9.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14e9d0a2-a1cb-4d3e-b6df-fba01d476936?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.7.9.7","to_inclusive":true,"patched_in":"1.7.9.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-11T16:30:33Z"},{"id":"wordfence:14ebc642-ebe4-4493-859b-22192bc5b10d","source":"wordfence","cve":"CVE-2025-67990","title":"GMap Targeting <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ebc642-ebe4-4493-859b-22192bc5b10d?source=api-prod","affected":[{"type":"plugin","slug":"gmap-targeting","name":"GMap Targeting \u2013 Simple Targeting Inside Google Maps","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:11:39Z"},{"id":"wordfence:14ee389b-8f98-4991-9a61-9da596013fea","source":"wordfence","cve":"CVE-2017-18501","title":"Social Login by BestWebSoft <= 0.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ee389b-8f98-4991-9a61-9da596013fea?source=api-prod","affected":[{"type":"plugin","slug":"social-login-bws","name":"Social Login by BestWebSoft","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"0.2"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14ee4247-4cfe-440b-add2-d5d840b1f114","source":"wordfence","cve":"CVE-2025-12666","title":"Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ee4247-4cfe-440b-add2-d5d840b1f114?source=api-prod","affected":[{"type":"plugin","slug":"google-drive-upload-and-download-link","name":"Google Drive upload and download link","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:19:55Z","updated":"2025-11-27T02:26:12Z"},{"id":"wordfence:14ee8268-1371-42c9-9861-e9a11f4fbd95","source":"wordfence","cve":"CVE-2024-54334","title":"Quran Phrases About Most People Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ee8268-1371-42c9-9861-e9a11f4fbd95?source=api-prod","affected":[{"type":"plugin","slug":"quran-phrases-about-most-people-shortcodes","name":"Quran Phrases About Most People Shortcodes","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:19:44Z"},{"id":"wordfence:14f030bd-8d8d-4152-817d-d72c9b7a0152","source":"wordfence","cve":"CVE-2024-24932","title":"VK Poster Group <= 2.0.3 - Reflected Cross-Site Scripting via vkp_repost","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14f030bd-8d8d-4152-817d-d72c9b7a0152?source=api-prod","affected":[{"type":"plugin","slug":"vk-poster-group","name":"VK Poster Group","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T18:51:37Z"},{"id":"wordfence:14f0df3e-4333-49d8-a318-6f9fa614c23e","source":"wordfence","cve":"CVE-2021-24602","title":"HM Multiple Roles <= 1.2 - Privilege Escalation via Arbitrary Role Change","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14f0df3e-4333-49d8-a318-6f9fa614c23e?source=api-prod","affected":[{"type":"plugin","slug":"hm-multiple-roles","name":"HM Multiple Roles","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14f5a5c5-1c06-49fb-accd-0cbe992b9d3a","source":"wordfence","cve":"CVE-2024-51693","title":"Search order by product SKU for WooCommerce <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14f5a5c5-1c06-49fb-accd-0cbe992b9d3a?source=api-prod","affected":[{"type":"plugin","slug":"search-order-by-product-sku-for-woocommerce","name":"Search order by product SKU for WooCommerce","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:45:32Z"},{"id":"wordfence:14f665ba-b312-4167-a235-8d6aa3fbace9","source":"wordfence","cve":"CVE-2025-64633","title":"Norebro Extra <= 1.6.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14f665ba-b312-4167-a235-8d6aa3fbace9?source=api-prod","affected":[{"type":"plugin","slug":"norebro-extra","name":"Norebro Extra","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-12-20T19:28:58Z"},{"id":"wordfence:14f86410-a21c-43ee-8d78-6fcce3a5b99b","source":"wordfence","cve":"","title":"Uploader <= 1.0.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14f86410-a21c-43ee-8d78-6fcce3a5b99b?source=api-prod","affected":[{"type":"plugin","slug":"uploader","name":"Uploader","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14fb6cde-3ab5-4360-add2-c0b0fa4ca114","source":"wordfence","cve":"CVE-2013-6280","title":"Social Sharing Toolkit < 2.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14fb6cde-3ab5-4360-add2-c0b0fa4ca114?source=api-prod","affected":[{"type":"plugin","slug":"social-sharing-toolkit","name":"Social Sharing Toolkit","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2013-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:14fdd10e-283e-4978-9efa-73bc02c9c297","source":"wordfence","cve":"CVE-2024-54387","title":"Posts Date Ranges <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14fdd10e-283e-4978-9efa-73bc02c9c297?source=api-prod","affected":[{"type":"plugin","slug":"posts-date-ranges","name":"Posts Date Ranges","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:52:50Z"},{"id":"wordfence:14feb451-2ece-467b-abf0-7abac26e40c1","source":"wordfence","cve":"CVE-2024-34444","title":"Slider Revolution <= 6.6.20 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14feb451-2ece-467b-abf0-7abac26e40c1?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.20","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2024-05-28T00:00:00Z","updated":"2024-06-05T13:39:28Z"},{"id":"wordfence:14fede14-bdf1-41e1-8ea9-188acbb41aa1","source":"wordfence","cve":"CVE-2024-30525","title":"Move Addons for Elementor <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14fede14-bdf1-41e1-8ea9-188acbb41aa1?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T15:21:10Z"},{"id":"wordfence:14ff5609-2345-4073-8239-0ce27fa0957c","source":"wordfence","cve":"CVE-2024-30237","title":"Slider by Supsystic <= 1.8.10 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ff5609-2345-4073-8239-0ce27fa0957c?source=api-prod","affected":[{"type":"plugin","slug":"slider-by-supsystic","name":"Slider by Supsystic","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.11"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:54:05Z"},{"id":"wordfence:14ffe10e-e1a6-4752-9ff9-d2b01a49521e","source":"wordfence","cve":"CVE-2023-6555","title":"Email Subscription Popup <= 1.2.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/14ffe10e-e1a6-4752-9ff9-d2b01a49521e?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2023-12-15T00:00:00Z","updated":"2024-02-06T15:04:36Z"},{"id":"wordfence:150021d3-71bb-41c0-bb1c-5843e94ec0b6","source":"wordfence","cve":"CVE-2023-35910","title":"Quasar form <= 6.1 - Authenticated (Subscriber+) SQL Injection via 'id'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/150021d3-71bb-41c0-bb1c-5843e94ec0b6?source=api-prod","affected":[{"type":"plugin","slug":"quasar-form","name":"Quasar form free \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1500c72a-0621-4f97-9cab-0c9c8abeaf8f","source":"wordfence","cve":"CVE-2024-13914","title":"File Manager Advanced Shortcode <= Multiple Versions - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1500c72a-0621-4f97-9cab-0c9c8abeaf8f?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced-shortcode","name":"File Manager Advanced Shortcode","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"advanced-file-manager-pro-premium","name":"File Manager Advanced Shortcode","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-05-14T00:00:00Z","updated":"2025-07-01T17:36:06Z"},{"id":"wordfence:15060474-1378-4811-8427-4d61271d9ce0","source":"wordfence","cve":"CVE-2026-116869","title":"myPOS Checkout <= 1.4.5 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15060474-1378-4811-8427-4d61271d9ce0?source=api-prod","affected":[{"type":"plugin","slug":"mypos-virtual-for-woocommerce","name":"myPOS Checkout","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T10:16:09Z","updated":"2026-11-03T19:37:57Z"},{"id":"wordfence:1507628c-4a81-47de-a06f-a5d573eebffb","source":"wordfence","cve":"CVE-2015-9373","title":"PayPal Pro Add-on for iThemes Exchange < 1.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1507628c-4a81-47de-a06f-a5d573eebffb?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-paypal-pro","name":"PayPal Pro Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1508ae48-099c-44a2-a1c8-000a5e5acbef","source":"wordfence","cve":"CVE-2025-1249","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 6.6.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1508ae48-099c-44a2-a1c8-000a5e5acbef?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.6.4.1","to_inclusive":true,"patched_in":"6.6.4.2"}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T21:15:53Z"},{"id":"wordfence:150a6dda-84de-49b1-9a8a-fcc1e0ba73d1","source":"wordfence","cve":"","title":"PDF & Print Button Joliprint <= 1.3.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/150a6dda-84de-49b1-9a8a-fcc1e0ba73d1?source=api-prod","affected":[{"type":"plugin","slug":"joliprint","name":"PDF & Print Button Joliprint","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:150ac796-d77b-4915-8bbf-9f9b54be8eaf","source":"wordfence","cve":"CVE-2026-10623","title":"PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via 'quiz_id', 'item_id', and 'rule_id' Parameters","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/150ac796-d77b-4915-8bbf-9f9b54be8eaf?source=api-prod","affected":[{"type":"plugin","slug":"pressprimer-quiz","name":"PressPrimer Quiz \u2013 AI Quiz Maker, Exam Builder & LMS Assessment Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-06-17T16:50:00Z","updated":"2026-06-18T05:34:26Z"},{"id":"wordfence:150d9d64-6f7f-4646-b03f-dbc63fd0e791","source":"wordfence","cve":"CVE-2024-30531","title":"Nelio Content <= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/150d9d64-6f7f-4646-b03f-dbc63fd0e791?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T01:50:17Z"},{"id":"wordfence:15123d5f-eb24-46e3-81ec-7dd4f108a42d","source":"wordfence","cve":"CVE-2023-23827","title":"Google Maps v3 Shortcode <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15123d5f-eb24-46e3-81ec-7dd4f108a42d?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-v3-shortcode","name":"Google Maps v3 Shortcode","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1512d911-167f-4653-ab20-cb057b83dab1","source":"wordfence","cve":"CVE-2024-6346","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel \u2013 Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1512d911-167f-4653-ab20-cb057b83dab1?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.85","to_inclusive":true,"patched_in":"2.2.86"}],"published":"2024-07-31T21:17:28Z","updated":"2024-08-02T14:42:13Z"},{"id":"wordfence:1512dcea-11b5-4176-973b-aa3fc088865b","source":"wordfence","cve":"CVE-2025-5209","title":"Ivory Search \u2013 WordPress Search Plugin <= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1512dcea-11b5-4176-973b-aa3fc088865b?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"5.5.10"}],"published":"2025-05-27T00:00:00Z","updated":"2025-07-09T15:06:31Z"},{"id":"wordfence:1516280e-796e-4011-b15f-b754860ad414","source":"wordfence","cve":"CVE-2024-2922","title":"Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1516280e-796e-4011-b15f-b754860ad414?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-05T15:28:30Z","updated":"2024-07-01T17:16:57Z"},{"id":"wordfence:1516ebe7-4d16-4e97-9baa-bc5857f95126","source":"wordfence","cve":"CVE-2026-6041","title":"Buzz Comments <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1516ebe7-4d16-4e97-9baa-bc5857f95126?source=api-prod","affected":[{"type":"plugin","slug":"buzz-comments","name":"Buzz Comments","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:03:15Z","updated":"2026-04-22T07:45:31Z"},{"id":"wordfence:151753f3-d6b4-443f-bc09-f859dcb56294","source":"wordfence","cve":"CVE-2020-37246","title":"Backup by Supsystic <= 2.3.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/151753f3-d6b4-443f-bc09-f859dcb56294?source=api-prod","affected":[{"type":"plugin","slug":"backup-by-supsystic","name":"Backup by Supsystic","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-16T00:00:00Z","updated":"2026-07-29T20:41:32Z"},{"id":"wordfence:15177d1b-ef48-49e3-9bd9-34262ed2c134","source":"wordfence","cve":"CVE-2026-7562","title":"WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15177d1b-ef48-49e3-9bd9-34262ed2c134?source=api-prod","affected":[{"type":"plugin","slug":"wp-redirection","name":"WP-Redirection","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:05:33Z","updated":"2026-05-12T07:48:18Z"},{"id":"wordfence:15178478-5208-4869-a9f0-07e8e11ef0d5","source":"wordfence","cve":"CVE-2024-43281","title":"Void Elementor Post Grid Addon for Elementor Page builder <= 2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15178478-5208-4869-a9f0-07e8e11ef0d5?source=api-prod","affected":[{"type":"plugin","slug":"void-elementor-post-grid-addon-for-elementor-page-builder","name":"Void Elementor Post Grid Addon for Elementor Page builder","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:32:43Z"},{"id":"wordfence:1518653c-e64d-4aba-b7f8-a928b8f2cbe3","source":"wordfence","cve":"CVE-2022-38063","title":"Social Login WP <= 5.0.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1518653c-e64d-4aba-b7f8-a928b8f2cbe3?source=api-prod","affected":[{"type":"plugin","slug":"social-login-wp","name":"Social Login WP","from":"*","from_inclusive":true,"to":"5.0.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:151b0aa9-c5c9-48ab-8b73-22ee42666824","source":"wordfence","cve":"CVE-2024-12462","title":"YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/151b0aa9-c5c9-48ab-8b73-22ee42666824?source=api-prod","affected":[{"type":"plugin","slug":"yogo-booking","name":"YOGO Booking","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-01-06T16:16:28Z","updated":"2025-01-30T22:20:46Z"},{"id":"wordfence:1522d23b-7655-4fde-a18b-b46c6625185f","source":"wordfence","cve":"","title":"UsersWP \u2013 User Registration & User Profile <= 1.2.2.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1522d23b-7655-4fde-a18b-b46c6625185f?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.2.28","to_inclusive":true,"patched_in":"1.2.2.29"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:152384a2-69e0-41be-b02a-634fca714f4b","source":"wordfence","cve":"CVE-2025-58796","title":"Elementor Element Condition <= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/152384a2-69e0-41be-b02a-634fca714f4b?source=api-prod","affected":[{"type":"plugin","slug":"ele-conditions","name":"Ele Conditions for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-09-05T00:00:00Z","updated":"2026-05-11T19:39:50Z"},{"id":"wordfence:1523db36-fdc6-4a9d-bb2c-d9b28668a3fc","source":"wordfence","cve":"","title":"Real Estate by Templatic (Unknown Version) - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1523db36-fdc6-4a9d-bb2c-d9b28668a3fc?source=api-prod","affected":[{"type":"theme","slug":"realestate","name":"Real Estate by Templatic","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15253d0c-3425-4065-94d2-969939e858ca","source":"wordfence","cve":"CVE-2024-29808","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15253d0c-3425-4065-94d2-969939e858ca?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T15:25:15Z"},{"id":"wordfence:1525e1c9-4b94-4f9f-92c5-fc69fe000771","source":"wordfence","cve":"CVE-2023-3080","title":"WP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1525e1c9-4b94-4f9f-92c5-fc69fe000771?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:152b63ce-7047-4cd2-beec-d640becd48e4","source":"wordfence","cve":"CVE-2026-106597","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/152b63ce-7047-4cd2-beec-d640becd48e4?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:46Z"},{"id":"wordfence:1531ed5e-cb47-447d-87dc-5a06a88073d5","source":"wordfence","cve":"CVE-2025-22799","title":"Neon Product Designer <= 2.1.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1531ed5e-cb47-447d-87dc-5a06a88073d5?source=api-prod","affected":[{"type":"plugin","slug":"neon-product-designer-for-woocommerce","name":"Neon Product Designer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:59:35Z"},{"id":"wordfence:153213ee-d1c6-4cc7-a297-e25266b705a8","source":"wordfence","cve":"CVE-2024-13056","title":"Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/153213ee-d1c6-4cc7-a297-e25266b705a8?source=api-prod","affected":[{"type":"plugin","slug":"dyn-business-panel","name":"Dyn Business Panel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:35:25Z"},{"id":"wordfence:15349295-4ee7-4746-ae34-200ffd24aa82","source":"wordfence","cve":"CVE-2024-32684","title":"Wp Ultimate Review <= 2.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15349295-4ee7-4746-ae34-200ffd24aa82?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:29:14Z"},{"id":"wordfence:1534f67d-cf3f-4185-9aa6-01ae5dee4f26","source":"wordfence","cve":"CVE-2023-33995","title":"Photo Gallery <= 1.8.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1534f67d-cf3f-4185-9aa6-01ae5dee4f26?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.16","to_inclusive":false,"patched_in":"1.8.16"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15357b2b-acc4-45a2-9183-fd0e910ee943","source":"wordfence","cve":"CVE-2025-23723","title":"Plestar Directory Listing  <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15357b2b-acc4-45a2-9183-fd0e910ee943?source=api-prod","affected":[{"type":"plugin","slug":"plestar-directory-listing","name":"Plestar Directory Listing","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:50:39Z"},{"id":"wordfence:1535a174-ab59-4c6e-8080-ef818e00b070","source":"wordfence","cve":"CVE-2025-7688","title":"Add User Meta <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1535a174-ab59-4c6e-8080-ef818e00b070?source=api-prod","affected":[{"type":"plugin","slug":"add-user-meta","name":"Add User Meta","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:14:35Z","updated":"2025-08-15T08:25:38Z"},{"id":"wordfence:153647b8-c5eb-47f5-b375-0baec367287f","source":"wordfence","cve":"CVE-2025-1986","title":"Gutentor <= 3.4.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/153647b8-c5eb-47f5-b375-0baec367287f?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-10T13:04:48Z"},{"id":"wordfence:1537d291-1b46-470a-8fce-21b3419443b8","source":"wordfence","cve":"CVE-2026-66667","title":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1537d291-1b46-470a-8fce-21b3419443b8?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:44:13Z"},{"id":"wordfence:153a9a08-66b3-40fd-963d-93058c863a80","source":"wordfence","cve":"","title":"Email Queue by BestWebSoft < 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/153a9a08-66b3-40fd-963d-93058c863a80?source=api-prod","affected":[{"type":"plugin","slug":"email-queue","name":"Email Queue by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:153cb585-4eea-4959-85b1-2487be11f116","source":"wordfence","cve":"CVE-2024-3717","title":"Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/153cb585-4eea-4959-85b1-2487be11f116?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.7.7","to_inclusive":true,"patched_in":"1.3.7.8"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:51:48Z"},{"id":"wordfence:153e435b-9986-4242-a89b-12e8f1552803","source":"wordfence","cve":"CVE-2023-25960","title":"Zendrop \u2013 Global Dropshipping <= 1.0.0 - SQL Injection in setMetaData","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/153e435b-9986-4242-a89b-12e8f1552803?source=api-prod","affected":[{"type":"plugin","slug":"zendrop-dropshipping-and-fulfillment","name":"Zendrop \u2013 Global Dropshipping","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1540bf3e-2928-476c-8e5b-241b80dd699f","source":"wordfence","cve":"CVE-2024-32444","title":"RealHomes <= 4.3.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1540bf3e-2928-476c-8e5b-241b80dd699f?source=api-prod","affected":[{"type":"theme","slug":"realhomes","name":"RH - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2025-01-20T00:00:00Z","updated":"2025-05-12T17:20:50Z"},{"id":"wordfence:15416268-c040-46be-bf4d-252dc9a1ffad","source":"wordfence","cve":"CVE-2025-31906","title":"WP Profitshare <= 1.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15416268-c040-46be-bf4d-252dc9a1ffad?source=api-prod","affected":[{"type":"plugin","slug":"wp-profitshare","name":"WP Profitshare","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:35:59Z"},{"id":"wordfence:1543265e-dbbf-4d48-aaa9-353e2a5c3fe9","source":"wordfence","cve":"CVE-2026-16087","title":"Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1543265e-dbbf-4d48-aaa9-353e2a5c3fe9?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.42","to_inclusive":true,"patched_in":"3.1.43"}],"published":"2026-07-31T19:32:23Z","updated":"2026-08-01T07:49:45Z"},{"id":"wordfence:15477c00-0764-4850-8bce-d65b6b1cbe4c","source":"wordfence","cve":"CVE-2026-4124","title":"Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15477c00-0764-4850-8bce-d65b6b1cbe4c?source=api-prod","affected":[{"type":"plugin","slug":"ziggeo","name":"Ziggeo","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T02:25:05Z"},{"id":"wordfence:15494ccf-7c9d-4566-9e80-2da94172a3dd","source":"wordfence","cve":"CVE-2026-4431","title":"Easy Post Submission <= 2.3.0 - Missing Authorization","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15494ccf-7c9d-4566-9e80-2da94172a3dd?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-submission","name":"Easy Post Submission \u2013 Frontend Posting, Guest Publishing & Submit Content for WordPress","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-08-04T19:34:10Z","updated":"2026-08-05T07:39:20Z"},{"id":"wordfence:154a838c-f8bb-4568-b066-a78264c75eea","source":"wordfence","cve":"CVE-2023-33923","title":"Multiple Themes (Various Versions) - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/154a838c-f8bb-4568-b066-a78264c75eea?source=api-prod","affected":[{"type":"theme","slug":"viral-news","name":"Viral News","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"},{"type":"theme","slug":"hashone","name":"HashOne","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"theme","slug":"viral","name":"Viral","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:154b3a1a-7246-42de-a555-2c655778d59e","source":"wordfence","cve":"CVE-2025-6064","title":"WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/154b3a1a-7246-42de-a555-2c655778d59e?source=api-prod","affected":[{"type":"plugin","slug":"wp-url-shortener","name":"WP URL Shortener","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:45:34Z","updated":"2025-06-14T08:23:22Z"},{"id":"wordfence:154d2fc1-15da-4e0d-a5fc-a5d708fad410","source":"wordfence","cve":"CVE-2026-19848","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/154d2fc1-15da-4e0d-a5fc-a5d708fad410?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.1","to_inclusive":false,"patched_in":"4.17.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:35:33Z"},{"id":"wordfence:154fc656-3a33-4783-a941-10bb848244b3","source":"wordfence","cve":"CVE-2026-4160","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/154fc656-3a33-4783-a941-10bb848244b3?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"6.1.21","from_inclusive":true,"to":"6.1.21","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-04-16T00:53:13Z","updated":"2026-04-16T13:29:13Z"},{"id":"wordfence:154fe2be-5393-4e6b-b113-04f43bd501d9","source":"wordfence","cve":"CVE-2026-28086","title":"Run Gran <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/154fe2be-5393-4e6b-b113-04f43bd501d9?source=api-prod","affected":[{"type":"theme","slug":"run-gran","name":"Run Gran","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:58:43Z"},{"id":"wordfence:15517a81-0913-4922-be2b-aaf9abc52a84","source":"wordfence","cve":"CVE-2018-18017","title":"Slideshow Gallery <= 1.6.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15517a81-0913-4922-be2b-aaf9abc52a84?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2018-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1559fb43-cc5e-4dd2-80d8-06a137c7276d","source":"wordfence","cve":"CVE-2023-46085","title":"Wp Ultimate Review <= 2.3.0 - Cross-Site Request Forgery via wur_settings_view","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1559fb43-cc5e-4dd2-80d8-06a137c7276d?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-03-22T15:24:33Z"},{"id":"wordfence:155e3de1-e115-4683-bb4d-a0c5667dc3d3","source":"wordfence","cve":"","title":"WP Post Author <= 3.2.3 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/155e3de1-e115-4683-bb4d-a0c5667dc3d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:155e43f2-d46f-413f-bedd-7ab8905c1c35","source":"wordfence","cve":"CVE-2020-7948","title":"Login by Auth0 <= 3.11.3 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/155e43f2-d46f-413f-bedd-7ab8905c1c35?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:155f494b-be25-4269-9d3b-379309619bbe","source":"wordfence","cve":"CVE-2024-13216","title":"HT Event \u2013 WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor","severity":"medium","cvss":4.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/155f494b-be25-4269-9d3b-379309619bbe?source=api-prod","affected":[{"type":"plugin","slug":"ht-event","name":"HT Event \u2013 WordPress Event Manager Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-01-30T16:49:09Z","updated":"2025-02-11T20:51:16Z"},{"id":"wordfence:155f765c-65ab-443a-a4b7-50d916e2903c","source":"wordfence","cve":"CVE-2024-27951","title":"Multiple Page Generator Plugin \u2013 MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/155f765c-65ab-443a-a4b7-50d916e2903c?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:27:55Z"},{"id":"wordfence:1560b740-4018-4b08-9399-2fc87e16ea7b","source":"wordfence","cve":"CVE-2015-9335","title":"Limit Attempts by BestWebSoft \u2013 WordPress Anti-Bot and Security Plugin for Login and Forms < 1.1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1560b740-4018-4b08-9399-2fc87e16ea7b?source=api-prod","affected":[{"type":"plugin","slug":"limit-attempts","name":"Limit Attempts by BestWebSoft \u2013 WordPress Anti-Bot and Security Plugin for Login and Forms","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2015-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1560f91e-a6ae-4c11-8d54-3b3df5155b8f","source":"wordfence","cve":"CVE-2026-118077","title":"Spexo Addons for Elementor \u2013 Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor <= 1.2.3 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1560f91e-a6ae-4c11-8d54-3b3df5155b8f?source=api-prod","affected":[{"type":"plugin","slug":"sastra-essential-addons-for-elementor","name":"Spexo Addons for Elementor \u2013 Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:27:25Z","updated":"2026-11-03T19:40:59Z"},{"id":"wordfence:15613da5-f900-4a33-8eec-6c9e52ed30fc","source":"wordfence","cve":"CVE-2025-1481","title":"Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15613da5-f900-4a33-8eec-6c9e52ed30fc?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-cleaner-lite","name":"Shortcode Cleaner Lite","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T14:16:32Z","updated":"2025-03-08T02:24:02Z"},{"id":"wordfence:156209c0-27d0-4c87-883a-bf9376f8858c","source":"wordfence","cve":"CVE-2025-58604","title":"Mail Mint <= 1.18.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156209c0-27d0-4c87-883a-bf9376f8858c?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.18.5","to_inclusive":true,"patched_in":"1.18.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:24:49Z"},{"id":"wordfence:1564429b-0fb7-4c97-9802-8360e6ff3568","source":"wordfence","cve":"CVE-2025-32116","title":"QR Master <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1564429b-0fb7-4c97-9802-8360e6ff3568?source=api-prod","affected":[{"type":"plugin","slug":"qr-master","name":"QR Master","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:46:28Z"},{"id":"wordfence:15654ff3-2e61-44d2-ae3f-4a353db320cb","source":"wordfence","cve":"","title":"Smush \u2013 Lazy Load Images, Optimize & Compress Images <= 3.0.0 - Authenticated PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15654ff3-2e61-44d2-ae3f-4a353db320cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2018-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15655362-b77f-4ba4-a823-17085de55f85","source":"wordfence","cve":"CVE-2021-34658","title":"Simple Popup Newsletter <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15655362-b77f-4ba4-a823-17085de55f85?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-newsletter","name":"Simple Popup Newsletter","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:156581cb-f3d8-4253-af4d-cdc59b95d763","source":"wordfence","cve":"CVE-2026-32405","title":"WoodMart <= 8.3.9 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156581cb-f3d8-4253-af4d-cdc59b95d763?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.9","to_inclusive":true,"patched_in":"8.4.0"}],"published":"2026-02-22T00:00:00Z","updated":"2026-05-05T14:37:03Z"},{"id":"wordfence:15672f90-3192-452c-a4f2-be6db00b7888","source":"wordfence","cve":"CVE-2023-0043","title":"Custom Add User <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15672f90-3192-452c-a4f2-be6db00b7888?source=api-prod","affected":[{"type":"plugin","slug":"custom-add-user","name":"Custom Add User","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15679ce4-984a-4933-86c5-c8349b03abf9","source":"wordfence","cve":"CVE-2022-3634","title":"Contact Form 7 Database Addon <= 1.2.6.3 - CSV Injection","severity":"high","cvss":7.2,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15679ce4-984a-4933-86c5-c8349b03abf9?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.6.3","to_inclusive":true,"patched_in":"1.2.6.5"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15681d8b-df7b-48c5-bba8-658baf9b9bf1","source":"wordfence","cve":"CVE-2021-24803","title":"Core Tweaks WP Setup <= 4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15681d8b-df7b-48c5-bba8-658baf9b9bf1?source=api-prod","affected":[{"type":"plugin","slug":"seo-automatic-wp-core-tweaks","name":"Core Tweaks WP Setup","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:156945e1-80dc-4fb4-958f-bb87722e96fb","source":"wordfence","cve":"CVE-2025-3427","title":"3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156945e1-80dc-4fb4-958f-bb87722e96fb?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.1.3.6","to_inclusive":true,"patched_in":"2.1.3.7"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:01:02Z"},{"id":"wordfence:156b955d-e978-4ff5-ab56-35af257b3199","source":"wordfence","cve":"CVE-2022-33201","title":"MailerLite \u2013 Signup forms (official) <= 1.5.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156b955d-e978-4ff5-ab56-35af257b3199?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:156b9e3f-0a99-4fbc-88a4-1ed5e5e6b896","source":"wordfence","cve":"CVE-2024-34752","title":"Landing Page Builder <= 1.5.1.8 - Reflected Cross-Site Scripting via pageType","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156b9e3f-0a99-4fbc-88a4-1ed5e5e6b896?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.1.8","to_inclusive":true,"patched_in":"1.5.1.9"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:49:35Z"},{"id":"wordfence:156e64f2-87a4-40a0-bac8-3dc1f702b0a1","source":"wordfence","cve":"","title":"Events Manager <= 5.9.7.1 - CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156e64f2-87a4-40a0-bac8-3dc1f702b0a1?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.7.1","to_inclusive":true,"patched_in":"5.9.7.2"}],"published":"2020-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:156eb99d-087b-4716-8ba8-3a1bdc008f58","source":"wordfence","cve":"CVE-2025-53281","title":"WPB Category Slider for WooCommerce <= 1.71 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/156eb99d-087b-4716-8ba8-3a1bdc008f58?source=api-prod","affected":[{"type":"plugin","slug":"wpb-woocommerce-category-slider","name":"WPB Category Slider for WooCommerce \u2013 Responsive Product Category Carousel & Enhanced UX","from":"*","from_inclusive":true,"to":"1.71","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:45:25Z"},{"id":"wordfence:15705cf2-f396-4b19-b58a-144b000f61e5","source":"wordfence","cve":"CVE-2021-36846","title":"Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button \u2013 Chaty <= 2.8.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15705cf2-f396-4b19-b58a-144b000f61e5?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2022-04-07T22:27:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15754167-77f5-4a23-982f-8356f9925358","source":"wordfence","cve":"CVE-2026-13712","title":"Divi 5.0 - 5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15754167-77f5-4a23-982f-8356f9925358?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"5.0","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-08-14T00:00:00Z","updated":"2026-09-10T01:07:10Z"},{"id":"wordfence:1575e301-a26f-485e-bdf3-526b71c8306a","source":"wordfence","cve":"","title":"Better Font Awesome <= 2.0.1 - Missing Authorization to Plugin Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1575e301-a26f-485e-bdf3-526b71c8306a?source=api-prod","affected":[{"type":"plugin","slug":"better-font-awesome","name":"Better Font Awesome","from":"2.0.1","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2022-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1575f0ad-0a77-4047-844c-48db4c8b4e91","source":"wordfence","cve":"CVE-2023-2607","title":"Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1575f0ad-0a77-4047-844c-48db4c8b4e91?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.3.17","to_inclusive":true,"patched_in":"3.3.18"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:157847ac-f893-47fb-9e26-697f0ec124f0","source":"wordfence","cve":"CVE-2026-65468","title":"JetBooking <= 4.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157847ac-f893-47fb-9e26-697f0ec124f0?source=api-prod","affected":[{"type":"plugin","slug":"jet-booking","name":"JetBooking","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.2.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:53:02Z"},{"id":"wordfence:157a02dc-542e-4b2b-a847-9abccccda20c","source":"wordfence","cve":"CVE-2024-35649","title":"Save as PDF Plugin by Pdfcrowd <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157a02dc-542e-4b2b-a847-9abccccda20c?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T19:07:22Z"},{"id":"wordfence:157a0e97-5600-4736-846c-146668d27710","source":"wordfence","cve":"CVE-2025-52825","title":"Real Estate Manager <= 7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157a0e97-5600-4736-846c-146668d27710?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:157b3095-b662-465e-a975-5b71b5d4ba2a","source":"wordfence","cve":"","title":"Real Estate 7 <= 3.3.4 - Reflected Cross-Site Scripting via ct_additional_features","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157b3095-b662-465e-a975-5b71b5d4ba2a?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:157ba92e-7dbe-4754-b9b9-20953d5a7896","source":"wordfence","cve":"CVE-2026-78281","title":"CP Media Player \u2013 Audio Player and Video Player <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157ba92e-7dbe-4754-b9b9-20953d5a7896?source=api-prod","affected":[{"type":"plugin","slug":"audio-and-video-player","name":"CP Media Player \u2013 Audio Player and Video Player","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T21:07:43Z"},{"id":"wordfence:157c5aff-8a3e-4ca3-8ac7-e054df6db912","source":"wordfence","cve":"CVE-2025-66166","title":"Lottier for Elementor <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157c5aff-8a3e-4ca3-8ac7-e054df6db912?source=api-prod","affected":[{"type":"plugin","slug":"lottier-elementor","name":"Lottier for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-20T20:32:43Z"},{"id":"wordfence:157d473d-68f6-40ff-b73c-17e3ca528ee4","source":"wordfence","cve":"CVE-2025-32626","title":"JS Job Manager <= 2.0.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157d473d-68f6-40ff-b73c-17e3ca528ee4?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T19:15:58Z"},{"id":"wordfence:157eddd4-67f0-4a07-b3ab-11dbfb9f12aa","source":"wordfence","cve":"CVE-2023-5096","title":"HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/157eddd4-67f0-4a07-b3ab-11dbfb9f12aa?source=api-prod","affected":[{"type":"plugin","slug":"hk-filter-and-search","name":"HTML filter and csv-file search","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2023-10-30T00:00:00Z","updated":"2025-09-19T13:14:25Z"},{"id":"wordfence:158000e9-b8bd-4adb-b634-534d31471def","source":"wordfence","cve":"CVE-2025-69002","title":"OneLife <= 3.9 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/158000e9-b8bd-4adb-b634-534d31471def?source=api-prod","affected":[{"type":"theme","slug":"onelife","name":"OneLife - Medical WordPress Theme","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:55:55Z"},{"id":"wordfence:15880d3b-87de-4b59-878c-e36e73c45e8a","source":"wordfence","cve":"CVE-2025-10726","title":"WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15880d3b-87de-4b59-878c-e36e73c45e8a?source=api-prod","affected":[{"type":"plugin","slug":"wprecovery","name":"WPRecovery","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:35:53Z","updated":"2025-10-03T11:17:07Z"},{"id":"wordfence:158958ca-2e56-4102-9bcd-b235c7f49b65","source":"wordfence","cve":"CVE-2024-53798","title":"FloristPress <= 7.3.0 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/158958ca-2e56-4102-9bcd-b235c7f49b65?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:54:15Z"},{"id":"wordfence:158a63c1-1b2e-4fbf-ac86-43471ba8ebc2","source":"wordfence","cve":"CVE-2023-49191","title":"GDPR Cookie Consent by Supsystic <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/158a63c1-1b2e-4fbf-ac86-43471ba8ebc2?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliance-by-supsystic","name":"GDPR Cookie Consent by Supsystic","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:158e5a3f-32f4-40b8-840e-2c70a9485b1a","source":"wordfence","cve":"CVE-2024-51900","title":"What Would Seth Godin Do <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/158e5a3f-32f4-40b8-840e-2c70a9485b1a?source=api-prod","affected":[{"type":"plugin","slug":"what-would-seth-godin-do","name":"What Would Seth Godin Do","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:59:47Z"},{"id":"wordfence:15903e57-75e1-428c-b042-bf4c1c521db9","source":"wordfence","cve":"CVE-2025-46466","title":"Modern Polls <= 1.0.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15903e57-75e1-428c-b042-bf4c1c521db9?source=api-prod","affected":[{"type":"plugin","slug":"modern-polls","name":"Modern Polls","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:11:03Z"},{"id":"wordfence:15909c21-4286-4572-85b4-909a6167313e","source":"wordfence","cve":"CVE-2026-104671","title":"TutorStarter <= 4.0.3 - Unauthenticated Unauthorized User Account Creation","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15909c21-4286-4572-85b4-909a6167313e?source=api-prod","affected":[{"type":"theme","slug":"tutorstarter","name":"TutorStarter","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T19:12:01Z"},{"id":"wordfence:1592108b-acc0-47da-bbff-3202cbc345e7","source":"wordfence","cve":"CVE-2026-1822","title":"WP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1592108b-acc0-47da-bbff-3202cbc345e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-ng-weather","name":"WP NG Weather","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:16Z","updated":"2026-03-21T03:26:33Z"},{"id":"wordfence:159304a1-b015-44cd-9540-88b3e306dcc8","source":"wordfence","cve":"CVE-2026-28005","title":"Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159304a1-b015-44cd-9540-88b3e306dcc8?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.19","to_inclusive":true,"patched_in":"1.5.19.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:45:31Z"},{"id":"wordfence:15947764-a070-4715-bd44-cb79b62ed59d","source":"wordfence","cve":"CVE-2023-5232","title":"Font Awesome More Icons <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15947764-a070-4715-bd44-cb79b62ed59d?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome-more-icons","name":"Font Awesome More Icons","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1595f231-d300-484a-a0e1-1e2bc7b82ed3","source":"wordfence","cve":"CVE-2025-14980","title":"BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1595f231-d300-484a-a0e1-1e2bc7b82ed3?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-01-08T17:52:33Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:15967a0f-2512-4418-b503-b9d53032d40f","source":"wordfence","cve":"CVE-2019-19111","title":"wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15967a0f-2512-4418-b503-b9d53032d40f?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2020-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1597759b-48e3-4d7f-91d1-8f15f3cbdb62","source":"wordfence","cve":"CVE-2025-0717","title":"Social Slider Feed <= 2.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1597759b-48e3-4d7f-91d1-8f15f3cbdb62?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:47:52Z"},{"id":"wordfence:1597859c-2808-4e0f-aa8d-4e2727728e22","source":"wordfence","cve":"CVE-2023-34382","title":"Dokan <=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1597859c-2808-4e0f-aa8d-4e2727728e22?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.7.20","to_inclusive":false,"patched_in":"3.7.20"}],"published":"2023-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:159b5565-f4d8-4514-9397-20b6a0890475","source":"wordfence","cve":"CVE-2006-3390","title":"WordPress Core < 2.0.4 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159b5565-f4d8-4514-9397-20b6a0890475?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2006-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:159d031b-0362-4625-9d98-3908401c8ee8","source":"wordfence","cve":"CVE-2026-18437","title":"MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159d031b-0362-4625-9d98-3908401c8ee8?source=api-prod","affected":[{"type":"plugin","slug":"mailerpress","name":"MailerPress \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-07-30T20:21:58Z","updated":"2026-07-31T08:30:15Z"},{"id":"wordfence:159db1fd-0627-4407-a60e-01791ab3a382","source":"wordfence","cve":"CVE-2026-42631","title":"Qode Music <= 2.1.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159db1fd-0627-4407-a60e-01791ab3a382?source=api-prod","affected":[{"type":"plugin","slug":"qode-music","name":"Qode Music","from":"*","from_inclusive":true,"to":"2.1.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T16:27:25Z"},{"id":"wordfence:159ddb06-e7c4-4279-a8a1-c78a02e15891","source":"wordfence","cve":"CVE-2024-2656","title":"Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159ddb06-e7c4-4279-a8a1-c78a02e15891?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"5.7.16"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T03:32:05Z"},{"id":"wordfence:159e14fc-0512-421a-8bbe-d16c0b04ddf9","source":"wordfence","cve":"CVE-2024-24869","title":"Total Upkeep <= 1.15.8 - Improper Authorization to Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/159e14fc-0512-421a-8bbe-d16c0b04ddf9?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.15.8","to_inclusive":true,"patched_in":"1.15.9"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T17:06:03Z"},{"id":"wordfence:15a533e6-675f-4c32-9b88-111e6a5f6bf7","source":"wordfence","cve":"CVE-2025-60081","title":"PDF for Contact Form 7 <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15a533e6-675f-4c32-9b88-111e6a5f6bf7?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-contact-form-7","name":"PDF for Contact Form 7 + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-08-23T00:00:00Z","updated":"2026-01-30T20:41:16Z"},{"id":"wordfence:15a9718f-f877-4e33-8f7a-950791c4ca85","source":"wordfence","cve":"CVE-2025-0682","title":"ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.34.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-25T05:30:07Z"},{"id":"wordfence:15aabe3b-1b77-4e4e-9710-cf06924dbcbf","source":"wordfence","cve":"CVE-2025-12163","title":"Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15aabe3b-1b77-4e4e-9710-cf06924dbcbf?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-12-04T16:31:20Z","updated":"2025-12-11T14:16:56Z"},{"id":"wordfence:15aba6ee-8345-401d-adf9-3fde0f5169bc","source":"wordfence","cve":"CVE-2021-24992","title":"Buttonizer - Smart Floating Action Button <= 2.5.4 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15aba6ee-8345-401d-adf9-3fde0f5169bc?source=api-prod","affected":[{"type":"plugin","slug":"buttonizer-multifunctional-button","name":"Buttonizer \u2013 Floating Menus, Sticky Buttons, & Popup Builder","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15abde72-515a-4e1c-af4c-d9da56a5cbe2","source":"wordfence","cve":"CVE-2014-8604","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15abde72-515a-4e1c-af4c-d9da56a5cbe2?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15acf0bd-5e83-4513-865a-853b381c482b","source":"wordfence","cve":"CVE-2026-92540","title":"Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15acf0bd-5e83-4513-865a-853b381c482b?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:29:11Z"},{"id":"wordfence:15b0cf88-cbb1-4264-af89-302822089284","source":"wordfence","cve":"CVE-2025-30954","title":"WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b0cf88-cbb1-4264-af89-302822089284?source=api-prod","affected":[{"type":"plugin","slug":"gf-constant-contact","name":"WP Gravity Forms Constant Contact Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-11-07T17:50:00Z"},{"id":"wordfence:15b2a08f-2122-4eaf-ab46-1945cf6a68ca","source":"wordfence","cve":"CVE-2024-8481","title":"Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b2a08f-2122-4eaf-ab46-1945cf6a68ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-special-textboxes","name":"Special Text Boxes","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2024-09-24T12:19:21Z","updated":"2024-10-15T11:46:58Z"},{"id":"wordfence:15b30ecb-e3ce-4092-841b-3a1b2553596a","source":"wordfence","cve":"CVE-2024-2840","title":"Enhanced Media Library <= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b30ecb-e3ce-4092-841b-3a1b2553596a?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-media-library","name":"Enhanced Media Library","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":true,"patched_in":"2.8.10"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:51:48Z"},{"id":"wordfence:15b4b132-1e27-454d-9ba0-9d1a552e1844","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.1 - Missing Authorization to Group Creation","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b4b132-1e27-454d-9ba0-9d1a552e1844?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15b57809-6062-48ca-8572-26032928cd16","source":"wordfence","cve":"CVE-2023-2572","title":"Survey Maker <= 3.4.6 - Reflected Cross-Site Scripting via 'page' parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b57809-6062-48ca-8572-26032928cd16?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15b60d5e-fedc-4428-9546-cbb26b99572e","source":"wordfence","cve":"CVE-2025-22757","title":"CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b60d5e-fedc-4428-9546-cbb26b99572e?source=api-prod","affected":[{"type":"plugin","slug":"codebard-help-desk","name":"CodeBard Help Desk","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-24T16:02:54Z"},{"id":"wordfence:15b7008f-07fc-4f8a-b214-8ac0c4cf6d99","source":"wordfence","cve":"CVE-2023-47187","title":"Animated Rotating Words <= 5.4 - Cross-Site Request Forgery via save_admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b7008f-07fc-4f8a-b214-8ac0c4cf6d99?source=api-prod","affected":[{"type":"plugin","slug":"css3-rotating-words","name":"SmartText Rotator \u2013 Add Motion to Your Words","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15b831eb-ab28-4e42-940b-6943d836d230","source":"wordfence","cve":"CVE-2024-30534","title":"Calendarista Basic Edition <= 3.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b831eb-ab28-4e42-940b-6943d836d230?source=api-prod","affected":[{"type":"plugin","slug":"calendarista-basic-edition","name":"Calendarista Basic Edition \u2013 WordPress appointment booking system","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T15:01:13Z"},{"id":"wordfence:15b86ae0-93f0-4035-80c3-b3a713077b32","source":"wordfence","cve":"CVE-2022-1758","title":"Genki Pre-Publish Reminder <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b86ae0-93f0-4035-80c3-b3a713077b32?source=api-prod","affected":[{"type":"plugin","slug":"genki-pre-publish-reminder","name":"Genki Pre-Publish Reminder","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15b93e63-5ef2-4fb1-8c6b-28fcfab8e34d","source":"wordfence","cve":"CVE-2023-33313","title":"WIP Custom Login <= 1.2.9 - Cross-Site Request Forgery via save_option","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b93e63-5ef2-4fb1-8c6b-28fcfab8e34d?source=api-prod","affected":[{"type":"plugin","slug":"wip-custom-login","name":"WIP Custom Login","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15b9d69c-012d-4a28-b8b1-15e6dd22979e","source":"wordfence","cve":"CVE-2022-0884","title":"Profile Builder <= 3.6.7 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15b9d69c-012d-4a28-b8b1-15e6dd22979e?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":false,"patched_in":"3.6.8"}],"published":"2022-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15ba1c72-708c-4f8a-9ad8-9741abac63a2","source":"wordfence","cve":"CVE-2026-22514","title":"Unica - Event Planning & Wedding WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ba1c72-708c-4f8a-9ad8-9741abac63a2?source=api-prod","affected":[{"type":"theme","slug":"unica","name":"Unica - Event Planning & Wedding WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T00:00:00Z","updated":"2026-03-12T16:12:42Z"},{"id":"wordfence:15c11a0e-6185-4072-88c6-303090adf898","source":"wordfence","cve":"CVE-2015-1784","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery < 2.0.77.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c11a0e-6185-4072-88c6-303090adf898?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.0.77.3","to_inclusive":false,"patched_in":"2.0.77.3"}],"published":"2015-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15c1d7e1-e510-4cba-8da1-79e18b2eed22","source":"wordfence","cve":"CVE-2024-29812","title":"ReviewX <= 1.6.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c1d7e1-e510-4cba-8da1-79e18b2eed22?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.22","to_inclusive":true,"patched_in":"1.6.23"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:45:41Z"},{"id":"wordfence:15c2316f-99ef-42fd-85ca-e905e711436a","source":"wordfence","cve":"CVE-2025-62891","title":"Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c2316f-99ef-42fd-85ca-e905e711436a?source=api-prod","affected":[{"type":"plugin","slug":"off-canvas-sidebars","name":"Off-Canvas Sidebars & Menus (Slidebars)","from":"*","from_inclusive":true,"to":"0.5.8.5","to_inclusive":true,"patched_in":"0.5.9"}],"published":"2025-08-24T00:00:00Z","updated":"2025-11-04T14:23:11Z"},{"id":"wordfence:15c2cc20-8d10-4e77-8009-df91e171183f","source":"wordfence","cve":"CVE-2022-42459","title":"Image Hover Effects Ultimate <= 9.7.1 - Authenticated (Admin+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c2cc20-8d10-4e77-8009-df91e171183f?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"9.7.2"}],"published":"2022-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15c35ed2-a614-4cac-8a2e-b1a2417919d7","source":"wordfence","cve":"CVE-2014-3921","title":"Simple Popup Images  <= 1.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c35ed2-a614-4cac-8a2e-b1a2417919d7?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-images","name":"simple-popup-images","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2014-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15c8addc-e40b-4ad2-9e7b-c721d10164d6","source":"wordfence","cve":"CVE-2022-47156","title":"GS Insever Portfolio <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15c8addc-e40b-4ad2-9e7b-c721d10164d6?source=api-prod","affected":[{"type":"plugin","slug":"gs-instagram-portfolio","name":"GS Insever Portfolio","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15caa471-91a9-421b-83df-1be31bbc6ffb","source":"wordfence","cve":"CVE-2026-19439","title":"Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15caa471-91a9-421b-83df-1be31bbc6ffb?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"3.0.3","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:33:45Z"},{"id":"wordfence:15cad3f3-5a23-427f-8dd2-8edf38245fe0","source":"wordfence","cve":"CVE-2025-66064","title":"Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15cad3f3-5a23-427f-8dd2-8edf38245fe0?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.20","to_inclusive":true,"patched_in":"1.12.21"}],"published":"2025-11-21T00:00:00Z","updated":"2025-11-25T15:55:08Z"},{"id":"wordfence:15cb0e8a-907c-4fc0-9ea0-bbce956723a1","source":"wordfence","cve":"CVE-2026-11580","title":"Kali Forms <= 2.4.16 - Authenticated (Contributor+) Insecure Direct Object Reference to Post Metadata Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15cb0e8a-907c-4fc0-9ea0-bbce956723a1?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"2.4.17"}],"published":"2026-06-24T00:00:00Z","updated":"2026-07-30T12:06:19Z"},{"id":"wordfence:15ccc672-f692-4d6b-abe6-15f6ea42902b","source":"wordfence","cve":"CVE-2024-43122","title":"Robin image optimizer <= 1.6.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ccc672-f692-4d6b-abe6-15f6ea42902b?source=api-prod","affected":[{"type":"plugin","slug":"robin-image-optimizer","name":"Robin Image Optimizer \u2013 Unlimited Image Optimization, WebP & AVIF","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:55:38Z"},{"id":"wordfence:15ce2e54-ca5a-4dbc-9795-6e989e85b330","source":"wordfence","cve":"CVE-2024-22135","title":"Order Export & Order Import for WooCommerce <= 2.4.3 - Authenticated (Shop Manager+) Arbitrary File Upload via upload_import_file","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ce2e54-ca5a-4dbc-9795-6e989e85b330?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15ce5666-f020-4264-989d-713e4520e012","source":"wordfence","cve":"CVE-2021-24994","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.68 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ce5666-f020-4264-989d-713e4520e012?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.69","to_inclusive":false,"patched_in":"0.9.69"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15cf34d8-256b-495e-9385-a5d526bfb335","source":"wordfence","cve":"CVE-2024-1710","title":"Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15cf34d8-256b-495e-9385-a5d526bfb335?source=api-prod","affected":[{"type":"plugin","slug":"addon-library","name":"Addon Library","from":"*","from_inclusive":true,"to":"1.3.76","to_inclusive":true,"patched_in":""}],"published":"2024-02-23T00:00:00Z","updated":"2024-02-24T09:38:21Z"},{"id":"wordfence:15d01325-82c1-4889-8bde-940e6c8a8001","source":"wordfence","cve":"CVE-2026-96963","title":"Pie Register <= 3.8.4.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d01325-82c1-4889-8bde-940e6c8a8001?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.15","to_inclusive":true,"patched_in":"3.8.4.16"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T20:11:47Z"},{"id":"wordfence:15d29d58-9e28-4e18-aeb9-9c63cb308673","source":"wordfence","cve":"CVE-2024-8513","title":"QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d29d58-9e28-4e18-aeb9-9c63cb308673?source=api-prod","affected":[{"type":"plugin","slug":"qa-heatmap-analytics","name":"QA Assistants \u2013 Driven by data","from":"*","from_inclusive":true,"to":"4.1.1.1","to_inclusive":true,"patched_in":"4.1.1.2"}],"published":"2024-10-09T00:00:00Z","updated":"2025-01-31T20:30:00Z"},{"id":"wordfence:15d32a30-6079-475f-a870-c0d3ff945581","source":"wordfence","cve":"CVE-2026-84781","title":"Gallery PhotoBlocks <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d32a30-6079-475f-a870-c0d3ff945581?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:35:20Z"},{"id":"wordfence:15d36bb4-788a-4491-954c-74814866e07a","source":"wordfence","cve":"CVE-2025-31075","title":"MicroPayments <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d36bb4-788a-4491-954c-74814866e07a?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"2.9.29","to_inclusive":true,"patched_in":"2.9.30"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:11:16Z"},{"id":"wordfence:15d479e7-f0b8-4175-84b0-cd611b73233a","source":"wordfence","cve":"","title":"Portfolio \u2013 WordPress Portfolio Plugin <= 2.8.8 - Cross-Site Request Forgery in rtport_spare_me","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d479e7-f0b8-4175-84b0-cd611b73233a?source=api-prod","affected":[{"type":"plugin","slug":"tlp-portfolio","name":"Radius Portfolio \u2013 Filterable Grid, Gallery & Slider Portfolio","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15d5a7e9-7fae-447b-880f-a1bc45ec43c4","source":"wordfence","cve":"CVE-2026-57392","title":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d5a7e9-7fae-447b-880f-a1bc45ec43c4?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.22.5","to_inclusive":true,"patched_in":"2.22.6"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:45:59Z"},{"id":"wordfence:15d61530-5ef9-4dce-8ace-6d8cc07c7b5e","source":"wordfence","cve":"CVE-2023-23828","title":"WP Category Post List Widget <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d61530-5ef9-4dce-8ace-6d8cc07c7b5e?source=api-prod","affected":[{"type":"plugin","slug":"wp-category-posts-list","name":"WP Category Post List Widget","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15d66474-e215-4d28-b6fb-259c90053212","source":"wordfence","cve":"","title":"Portrait-Archiv.com Photostore < 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d66474-e215-4d28-b6fb-259c90053212?source=api-prod","affected":[{"type":"plugin","slug":"portrait-archiv-shop","name":"Portrait-Archiv Photostore \u2013 Sell Photos & Client Galleries","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"}],"published":"2019-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15d66a77-d650-4209-9ad4-b2e157cd123a","source":"wordfence","cve":"CVE-2022-0423","title":"3D FlipBook <= 1.12.0 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d66a77-d650-4209-9ad4-b2e157cd123a?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":false,"patched_in":"1.12.1"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15d6cdb5-5259-46d5-8649-a3abcde4fb47","source":"wordfence","cve":"CVE-2025-23625","title":"Unique UX <= 0.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d6cdb5-5259-46d5-8649-a3abcde4fb47?source=api-prod","affected":[{"type":"plugin","slug":"unique-ux","name":"Unique UX","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:36:30Z"},{"id":"wordfence:15d9817c-910d-4ce1-a5fb-67a2b6580e16","source":"wordfence","cve":"CVE-2026-3368","title":"Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d9817c-910d-4ce1-a5fb-67a2b6580e16?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-03-20T10:55:45Z","updated":"2026-03-20T23:25:10Z"},{"id":"wordfence:15d9c743-5700-482a-a6bc-ecf541ea9e7d","source":"wordfence","cve":"","title":"leads5050-visitor-insights <= 1.0.5 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15d9c743-5700-482a-a6bc-ecf541ea9e7d?source=api-prod","affected":[{"type":"plugin","slug":"leads-5050-visitor-insights","name":"Leads5050 Visitor Insights","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15db421c-3744-492a-830d-0f12bafdd6a8","source":"wordfence","cve":"CVE-2025-62150","title":"History Timeline <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15db421c-3744-492a-830d-0f12bafdd6a8?source=api-prod","affected":[{"type":"plugin","slug":"timeline-awesome","name":"History Timeline for Biography, Company History & Event Timeline","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:32:21Z"},{"id":"wordfence:15dc1661-793a-43dd-8a12-8f51da6cb304","source":"wordfence","cve":"CVE-2026-93747","title":"wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15dc1661-793a-43dd-8a12-8f51da6cb304?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-09-24T19:09:27Z","updated":"2026-09-25T07:40:25Z"},{"id":"wordfence:15deb0db-5a13-4018-88e5-5f5cb61bd495","source":"wordfence","cve":"CVE-2016-11000","title":"Export WordPress Data with Advanced Filters < 1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15deb0db-5a13-4018-88e5-5f5cb61bd495?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2016-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15dedb2b-b96d-4d05-a8c9-cf414321f6a2","source":"wordfence","cve":"CVE-2026-110012","title":"Salon Booking System <= 10.31.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15dedb2b-b96d-4d05-a8c9-cf414321f6a2?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.2","to_inclusive":true,"patched_in":"10.31.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:14:59Z"},{"id":"wordfence:15e06f6e-2a13-490e-8e41-d9f7db8e78e0","source":"wordfence","cve":"CVE-2014-4586","title":"wp-football <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e06f6e-2a13-490e-8e41-d9f7db8e78e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-football","name":"wp-football","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15e22320-317e-48b6-b718-9ede2481b622","source":"wordfence","cve":"CVE-2026-115610","title":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e22320-317e-48b6-b718-9ede2481b622?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-29T14:19:00Z","updated":"2026-11-03T19:28:00Z"},{"id":"wordfence:15e2efa7-3e29-4ea7-a781-3290725fcc76","source":"wordfence","cve":"CVE-2025-53582","title":"WordLift <= 3.54.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e2efa7-3e29-4ea7-a781-3290725fcc76?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.54.5","to_inclusive":true,"patched_in":"3.54.6"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:48:35Z"},{"id":"wordfence:15e65a86-db8e-4a4a-b9c6-c688021a514f","source":"wordfence","cve":"CVE-2025-14127","title":"Testimonial Master <= 0.2.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e65a86-db8e-4a4a-b9c6-c688021a514f?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-master","name":"Testimonial Master","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:37:23Z","updated":"2026-01-07T09:20:52Z"},{"id":"wordfence:15e671e5-a9a6-4439-93cc-8d46fe0cde16","source":"wordfence","cve":"CVE-2025-12089","title":"Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e671e5-a9a6-4439-93cc-8d46fe0cde16?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.10.45","to_inclusive":true,"patched_in":"1.10.46"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-13T03:27:36Z"},{"id":"wordfence:15e86f80-b18c-42f7-bc41-6a3112cbb162","source":"wordfence","cve":"CVE-2022-2567","title":"Form Builder CP <= 1.2.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e86f80-b18c-42f7-bc41-6a3112cbb162?source=api-prod","affected":[{"type":"plugin","slug":"cp-easy-form-builder","name":"Form Builder CP","from":"*","from_inclusive":true,"to":"1.2.31","to_inclusive":true,"patched_in":"1.2.32"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15e8c123-15e9-448b-b4eb-979b70d87f50","source":"wordfence","cve":"CVE-2024-51674","title":"Sastra Essential Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e8c123-15e9-448b-b4eb-979b70d87f50?source=api-prod","affected":[{"type":"plugin","slug":"sastra-essential-addons-for-elementor","name":"Spexo Addons for Elementor \u2013 Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:13:42Z"},{"id":"wordfence:15e90f19-e4cb-4096-8192-85d4f1f5ec24","source":"wordfence","cve":"CVE-2026-65544","title":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer <= 7.14.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e90f19-e4cb-4096-8192-85d4f1f5ec24?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.14.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:30:32Z"},{"id":"wordfence:15e9f32a-0317-4b2d-8a39-59aac40b9101","source":"wordfence","cve":"CVE-2026-124253","title":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More <= 5.5.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15e9f32a-0317-4b2d-8a39-59aac40b9101?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.5.2.8","to_inclusive":true,"patched_in":"5.5.2.9"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:09Z"},{"id":"wordfence:15eaba51-e46f-4725-a6f9-7969bf00db5a","source":"wordfence","cve":"CVE-2026-42674","title":"Advanced Access Manager \u2013 Access Governance for WordPress <= 7.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15eaba51-e46f-4725-a6f9-7969bf00db5a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-19T16:24:27Z"},{"id":"wordfence:15ec3b68-0461-4b99-81e1-0d776b97a4eb","source":"wordfence","cve":"CVE-2022-3811","title":"EU Cookie Law <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ec3b68-0461-4b99-81e1-0d776b97a4eb?source=api-prod","affected":[{"type":"plugin","slug":"eu-cookie-law","name":"EU Cookie Law for GDPR/CCPA","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15ed3837-2a52-4d1d-81da-a704aceac684","source":"wordfence","cve":"CVE-2026-65473","title":"Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ed3837-2a52-4d1d-81da-a704aceac684?source=api-prod","affected":[{"type":"plugin","slug":"virtue-toolkit","name":"Virtue/Ascend/Pinnacle Toolkit","from":"*","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"4.9.12.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:37:11Z"},{"id":"wordfence:15edf742-61e4-4b4f-915d-99e6b3332f5f","source":"wordfence","cve":"CVE-2024-32674","title":"Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15edf742-61e4-4b4f-915d-99e6b3332f5f?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.31","to_inclusive":true,"patched_in":"1.1.32"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-16T12:40:31Z"},{"id":"wordfence:15ee70d7-1e55-46a3-9b4c-5b04fa7fea04","source":"wordfence","cve":"CVE-2026-102564","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15ee70d7-1e55-46a3-9b4c-5b04fa7fea04?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-06T22:44:38Z","updated":"2026-11-07T11:26:24Z"},{"id":"wordfence:15eef02a-d6c9-4956-9e19-b8f3340768ff","source":"wordfence","cve":"CVE-2026-15795","title":"Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15eef02a-d6c9-4956-9e19-b8f3340768ff?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2026-10-02T17:33:39Z","updated":"2026-10-03T06:38:21Z"},{"id":"wordfence:15f00b65-8304-4132-a2cf-8145444ecfb1","source":"wordfence","cve":"CVE-2023-49183","title":"NextScripts <= 4.4.2 - Reflected Cross-Site Scripting via code","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f00b65-8304-4132-a2cf-8145444ecfb1?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15f03dc6-2881-4f70-925c-80ef9ce40be2","source":"wordfence","cve":"CVE-2021-24841","title":"Helpful <= 4.4.58 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f03dc6-2881-4f70-925c-80ef9ce40be2?source=api-prod","affected":[{"type":"plugin","slug":"helpful","name":"Helpful","from":"*","from_inclusive":true,"to":"4.4.59","to_inclusive":false,"patched_in":"4.4.59"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15f1a14e-7536-4f6e-ad6d-a3bcb09efec6","source":"wordfence","cve":"CVE-2025-32513","title":"Nomupay Payment Processing Gateway <= 7.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f1a14e-7536-4f6e-ad6d-a3bcb09efec6?source=api-prod","affected":[{"type":"plugin","slug":"totalprocessing-card-payments","name":"Total processing card payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:19:10Z"},{"id":"wordfence:15f23748-fc32-4ea1-bd23-7b13ec1409af","source":"wordfence","cve":"CVE-2026-103688","title":"Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f23748-fc32-4ea1-bd23-7b13ec1409af?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:15:11Z"},{"id":"wordfence:15f2c277-45ba-40a8-8123-17e23afbf68b","source":"wordfence","cve":"CVE-2025-23995","title":"Tantyyellow <= 1.0.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f2c277-45ba-40a8-8123-17e23afbf68b?source=api-prod","affected":[{"type":"theme","slug":"tantyyellow","name":"Tantyyellow","from":"*","from_inclusive":true,"to":"1.0.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-22T20:33:31Z"},{"id":"wordfence:15f38932-2687-4d71-8793-843058a657d1","source":"wordfence","cve":"CVE-2021-36823","title":"Absolutely Glamorous Custom Admin <= 6.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f38932-2687-4d71-8793-843058a657d1?source=api-prod","affected":[{"type":"plugin","slug":"ag-custom-admin","name":"AGCA \u2013 Custom Dashboard & Login Page","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.9"}],"published":"2021-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15f38b3e-69fe-436f-ba4b-7985ec9dac00","source":"wordfence","cve":"CVE-2024-13538","title":"BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f38b3e-69fe-436f-ba4b-7985ec9dac00?source=api-prod","affected":[{"type":"plugin","slug":"bigbuy-wc-dropshipping-connector","name":"BigBuy Dropshipping Connector for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-02-17T15:49:19Z","updated":"2025-04-30T15:21:29Z"},{"id":"wordfence:15f39c64-2586-4fd0-97d2-19dd8ad04a8f","source":"wordfence","cve":"CVE-2025-30896","title":"WP ERP <= 1.13.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f39c64-2586-4fd0-97d2-19dd8ad04a8f?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.4","to_inclusive":true,"patched_in":"1.14.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:13:15Z"},{"id":"wordfence:15f3a6e1-6126-4825-b2b1-e40dc5694f43","source":"wordfence","cve":"","title":"Atarim - Client Interface <= 3.9.1 - Missing Authorization via AJAX actions","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f3a6e1-6126-4825-b2b1-e40dc5694f43?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":false,"patched_in":"3.9.2"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15f3ca33-50b8-4cd3-bcd1-5a73a3a06fc3","source":"wordfence","cve":"CVE-2015-9349","title":"CKEditor for WordPress <= 4.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f3ca33-50b8-4cd3-bcd1-5a73a3a06fc3?source=api-prod","affected":[{"type":"plugin","slug":"ckeditor-for-wordpress","name":"CKEditor for WordPress","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.3.1"}],"published":"2015-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:15f62766-d843-4fdb-a77e-fd7738c1a50c","source":"wordfence","cve":"CVE-2025-66163","title":"Masker for Elementor <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f62766-d843-4fdb-a77e-fd7738c1a50c?source=api-prod","affected":[{"type":"plugin","slug":"masker-elementor","name":"Masker for Elementor","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:05:07Z"},{"id":"wordfence:15f6d7cc-c921-4711-a2fa-0dfff23a6a5e","source":"wordfence","cve":"CVE-2026-115608","title":"JetEngine <= 3.9.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15f6d7cc-c921-4711-a2fa-0dfff23a6a5e?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.0.1"}],"published":"2026-10-26T10:27:00Z","updated":"2026-10-28T01:23:41Z"},{"id":"wordfence:15fb0a26-e415-4ccb-b83d-d8f7b36bce66","source":"wordfence","cve":"CVE-2026-4333","title":"LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-04-07T15:19:06Z","updated":"2026-04-08T03:36:07Z"},{"id":"wordfence:15fbfb20-50c7-4390-afa3-e6b9c95a2551","source":"wordfence","cve":"CVE-2026-56039","title":"Quick Interest Slider <= 3.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15fbfb20-50c7-4390-afa3-e6b9c95a2551?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T18:50:49Z"},{"id":"wordfence:15fcdfb8-36c7-4077-ac36-5ee846dca137","source":"wordfence","cve":"CVE-2026-91022","title":"Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15fcdfb8-36c7-4077-ac36-5ee846dca137?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.123","to_inclusive":true,"patched_in":"1.4.124"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T13:28:52Z"},{"id":"wordfence:15fecefa-f1f1-47f3-8ad7-ec7772ecafc4","source":"wordfence","cve":"CVE-2015-1172","title":"Holding Pattern <= 0.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/15fecefa-f1f1-47f3-8ad7-ec7772ecafc4?source=api-prod","affected":[{"type":"theme","slug":"holding_pattern","name":"Holding Pattern","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2015-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1600466e-ad45-4dc7-916b-6c97301d2b03","source":"wordfence","cve":"CVE-2026-12905","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1600466e-ad45-4dc7-916b-6c97301d2b03?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.7","to_inclusive":true,"patched_in":"28.0"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T04:24:49Z"},{"id":"wordfence:1603c61b-11a3-41e5-b339-a9411b02f383","source":"wordfence","cve":"CVE-2024-8515","title":"Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1603c61b-11a3-41e5-b339-a9411b02f383?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-21T16:44:16Z"},{"id":"wordfence:16041d22-51ff-4fa4-99fb-20a60b557634","source":"wordfence","cve":"CVE-2026-9240","title":"Colissimo Officiel : M\u00e9thodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16041d22-51ff-4fa4-99fb-20a60b557634?source=api-prod","affected":[{"type":"plugin","slug":"colissimo-shipping-methods-for-woocommerce","name":"Colissimo shipping methods for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-07-08T20:39:21Z","updated":"2026-07-09T09:31:19Z"},{"id":"wordfence:16073ffd-d95a-4e1e-9593-c2e5ae57f303","source":"wordfence","cve":"CVE-2024-4382","title":"CB (legacy) <= 0.9.4.18 - Cross-Site Request Forgery to Code/Timeframe/Booking Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16073ffd-d95a-4e1e-9593-c2e5ae57f303?source=api-prod","affected":[{"type":"plugin","slug":"commons-booking","name":"CB (legacy)","from":"*","from_inclusive":true,"to":"0.9.4.18","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:14:23Z"},{"id":"wordfence:160740a2-f5e1-49d6-a380-e6bf33646300","source":"wordfence","cve":"CVE-2017-18601","title":"IBPS Online Exam <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/160740a2-f5e1-49d6-a380-e6bf33646300?source=api-prod","affected":[{"type":"plugin","slug":"examapp","name":"IBPS Online Exam Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:160dd5b9-ed70-4617-9bff-59e33f9ea2d8","source":"wordfence","cve":"CVE-2024-4372","title":"Carousel Slider <= 2.2.10 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/160dd5b9-ed70-4617-9bff-59e33f9ea2d8?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-13T21:59:47Z"},{"id":"wordfence:16102d4c-86d6-471e-b787-54e4bc14b5a2","source":"wordfence","cve":"CVE-2016-5832","title":"WordPress Core < 4.5.3 - Cross-Site Scripting via Customizer","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16102d4c-86d6-471e-b787-54e4bc14b5a2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1610b3dd-582e-4ff2-956a-95845361c66b","source":"wordfence","cve":"","title":"Dyslexiefont Free <= 0.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1610b3dd-582e-4ff2-956a-95845361c66b?source=api-prod","affected":[{"type":"plugin","slug":"dyslexiefont","name":"Dyslexiefont Free","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1612b10d-1ee7-4ea1-93f3-bde2f1667e1b","source":"wordfence","cve":"","title":"RokStories <= 1.25 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1612b10d-1ee7-4ea1-93f3-bde2f1667e1b?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokstories","name":"RokStories","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16130c5d-9865-4953-b078-0b448722e36d","source":"wordfence","cve":"CVE-2023-39921","title":"Molongui <= 4.6.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16130c5d-9865-4953-b078-0b448722e36d?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16187b39-9b3a-4b1c-806c-37b62483a719","source":"wordfence","cve":"CVE-2026-10782","title":"RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16187b39-9b3a-4b1c-806c-37b62483a719?source=api-prod","affected":[{"type":"plugin","slug":"inspiry-memberships","name":"RealHomes Memberships","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-07-31T19:49:06Z","updated":"2026-08-01T07:49:45Z"},{"id":"wordfence:161c2365-932f-44d0-a76c-4aeb01f9379c","source":"wordfence","cve":"CVE-2025-47520","title":"Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/161c2365-932f-44d0-a76c-4aeb01f9379c?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.5.1","to_inclusive":true,"patched_in":"1.8.5.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:07:20Z"},{"id":"wordfence:161d92e3-d255-4967-9449-be263a46bec8","source":"wordfence","cve":"CVE-2025-14982","title":"Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/161d92e3-d255-4967-9449-be263a46bec8?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.11","to_inclusive":true,"patched_in":"10.14.12"}],"published":"2026-01-15T16:11:56Z","updated":"2026-01-16T04:44:34Z"},{"id":"wordfence:1621937e-1f4c-4031-a4dd-f7b22c2af1b9","source":"wordfence","cve":"CVE-2025-23669","title":"WP Smart Tooltip <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1621937e-1f4c-4031-a4dd-f7b22c2af1b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-tool-tip","name":"WP Smart Tooltip","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:43:13Z"},{"id":"wordfence:1622691e-a28d-4dd3-ab05-ed53943010e5","source":"wordfence","cve":"CVE-2026-97288","title":"WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1622691e-a28d-4dd3-ab05-ed53943010e5?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:29:52Z"},{"id":"wordfence:1623c6a1-e4dd-4c23-b00b-26b19a319038","source":"wordfence","cve":"CVE-2024-50546","title":"MyOrderDesk <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1623c6a1-e4dd-4c23-b00b-26b19a319038?source=api-prod","affected":[{"type":"plugin","slug":"myorderdesk","name":"MyOrderDesk","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-10-31T00:00:00Z","updated":"2025-01-09T14:49:10Z"},{"id":"wordfence:162595bb-d41b-4dfd-bfda-3a1e5794eaaf","source":"wordfence","cve":"","title":"Simple Ticker <= 3.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162595bb-d41b-4dfd-bfda-3a1e5794eaaf?source=api-prod","affected":[{"type":"plugin","slug":"simple-ticker","name":"Simple Ticker","from":"*","from_inclusive":true,"to":"3.05","to_inclusive":true,"patched_in":"3.06"}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16259ef4-d4c4-4908-b638-346a244e5ea8","source":"wordfence","cve":"CVE-2026-103304","title":"eaSYNC <= 1.3.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16259ef4-d4c4-4908-b638-346a244e5ea8?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.3.30","to_inclusive":true,"patched_in":"1.3.31"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:01:54Z"},{"id":"wordfence:1625a77d-bbca-4d18-ae6f-03030ac51d5b","source":"wordfence","cve":"CVE-2021-24753","title":"Rich Reviews by Starfish <= 1.9.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1625a77d-bbca-4d18-ae6f-03030ac51d5b?source=api-prod","affected":[{"type":"plugin","slug":"rich-reviews","name":"Rich Reviews by Starfish","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":false,"patched_in":"1.9.6"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1627e235-7836-43dc-a3f6-7f79da6ab229","source":"wordfence","cve":"CVE-2025-3614","title":"ElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1627e235-7836-43dc-a3f6-7f79da6ab229?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-07-24T09:38:18Z","updated":"2025-07-24T22:23:37Z"},{"id":"wordfence:1627ec2a-f91d-4ed7-acb8-a3fb63b45731","source":"wordfence","cve":"CVE-2023-48320","title":"Video Player <= 1.5.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1627ec2a-f91d-4ed7-acb8-a3fb63b45731?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"1.5.22","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1628656a-8aa6-4b97-8935-73bc5ab6b6c2","source":"wordfence","cve":"CVE-2026-103072","title":"VillaTheme Core <= 1.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1628656a-8aa6-4b97-8935-73bc5ab6b6c2?source=api-prod","affected":[{"type":"plugin","slug":"villatheme-core","name":"VillaTheme Core","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:37Z"},{"id":"wordfence:162a1813-ac5f-4daa-9b3b-4039931ae671","source":"wordfence","cve":"CVE-2026-54857","title":"Quirky <= 1.23 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162a1813-ac5f-4daa-9b3b-4039931ae671?source=api-prod","affected":[{"type":"theme","slug":"quirky","name":"Quirky - NFT, Token & Artist Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-04T21:58:13Z"},{"id":"wordfence:162a194c-a7de-44c4-a659-8188e303b6a2","source":"wordfence","cve":"","title":"WooCommerce <= 3.6.4 - Missing File Type Validation","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162a194c-a7de-44c4-a659-8188e303b6a2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2019-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:162a9203-d169-4d96-9839-110f6a9e4ad3","source":"wordfence","cve":"CVE-2021-24442","title":"Poll, Survey, Questionnaire and Voting system <= 1.5.2 - Unauthenticated Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162a9203-d169-4d96-9839-110f6a9e4ad3?source=api-prod","affected":[{"type":"plugin","slug":"polls-widget","name":"Poll, Survey, Questionnaire and Voting system","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2021-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:162afd58-3534-401b-9119-c1c26e15cd0f","source":"wordfence","cve":"CVE-2023-5951","title":"Welcart e-Commerce <= 2.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162afd58-3534-401b-9119-c1c26e15cd0f?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2023-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:162dff28-94ea-4a47-a6cb-a13317cf1a04","source":"wordfence","cve":"CVE-2023-0992","title":"Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162dff28-94ea-4a47-a6cb-a13317cf1a04?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"17.0.18","to_inclusive":false,"patched_in":"17.0.18"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:162e95c3-6344-4fd9-8666-b8b9e0121531","source":"wordfence","cve":"CVE-2026-103312","title":"Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/162e95c3-6344-4fd9-8666-b8b9e0121531?source=api-prod","affected":[{"type":"plugin","slug":"payment-integration-wompi","name":"Payment Integration Wompi","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-24T00:00:00Z","updated":"2026-10-28T01:13:22Z"},{"id":"wordfence:1630129e-d983-4c44-92a4-357e1e471c9a","source":"wordfence","cve":"CVE-2026-57396","title":"Free Gifts for WooCommerce <= 13.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1630129e-d983-4c44-92a4-357e1e471c9a?source=api-prod","affected":[{"type":"plugin","slug":"free-gifts-for-woocommerce","name":"Free Gifts for WooCommerce","from":"*","from_inclusive":true,"to":"13.1.0","to_inclusive":true,"patched_in":"13.3.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:06:40Z"},{"id":"wordfence:16308adf-b5d0-4519-8b1e-3d200003e8be","source":"wordfence","cve":"CVE-2025-59591","title":"wpDiscuz <= 7.6.33 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16308adf-b5d0-4519-8b1e-3d200003e8be?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.33","to_inclusive":true,"patched_in":"7.6.34"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:39:42Z"},{"id":"wordfence:16320b5e-1cb5-4e6d-ad2e-8ccd9cfa45ef","source":"wordfence","cve":"CVE-2024-3064","title":"Elementor Addons, Widgets and Enhancements \u2013 Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16320b5e-1cb5-4e6d-ad2e-8ccd9cfa45ef?source=api-prod","affected":[{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-04T00:00:00Z","updated":"2024-07-10T20:48:07Z"},{"id":"wordfence:16323cea-92f2-4c85-a6b2-dad476d3538f","source":"wordfence","cve":"CVE-2026-85571","title":"Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16323cea-92f2-4c85-a6b2-dad476d3538f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"4.0.5","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:44:06Z"},{"id":"wordfence:163328e9-2918-4bc0-8bbc-90d7e992754d","source":"wordfence","cve":"CVE-2023-32799","title":"WooCommerce Ship to Multiple Addresses <= 3.8.3 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/163328e9-2918-4bc0-8bbc-90d7e992754d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-multiple-addresses","name":"WooCommerce Ship to Multiple Addresses","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16375398-c5c9-465f-9a2f-4c08f76b090b","source":"wordfence","cve":"CVE-2026-100158","title":"SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16375398-c5c9-465f-9a2f-4c08f76b090b?source=api-prod","affected":[{"type":"plugin","slug":"sql-chart-builder","name":"SQL Chart Builder","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-10-15T17:01:02Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:1637e069-ab26-4d25-88b6-e8e66560fd49","source":"wordfence","cve":"CVE-2026-94661","title":"JetBlog <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1637e069-ab26-4d25-88b6-e8e66560fd49?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.10.1"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:49:08Z"},{"id":"wordfence:1638145c-2bc8-45d4-904e-b1aba124a0e3","source":"wordfence","cve":"CVE-2019-17229","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1638145c-2bc8-45d4-904e-b1aba124a0e3?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2019-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16391236-10c8-495e-a0a9-431d1a5aad3f","source":"wordfence","cve":"CVE-2025-52794","title":"Creative Contact Form <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16391236-10c8-495e-a0a9-431d1a5aad3f?source=api-prod","affected":[{"type":"plugin","slug":"sexy-contact-form","name":"Creative Contact Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:58:02Z"},{"id":"wordfence:163d42df-148f-431c-891e-dbdc09bf2ae1","source":"wordfence","cve":"CVE-2025-14294","title":"Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/163d42df-148f-431c-891e-dbdc09bf2ae1?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:07Z"},{"id":"wordfence:163ec640-13bc-40da-88e2-4c8c079a247b","source":"wordfence","cve":"CVE-2025-58030","title":"Page-list <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/163ec640-13bc-40da-88e2-4c8c079a247b?source=api-prod","affected":[{"type":"plugin","slug":"page-list","name":"Page-list","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-24T22:25:22Z"},{"id":"wordfence:163f120e-533a-4054-b5d1-331950ad02a7","source":"wordfence","cve":"CVE-2025-32480","title":"Windows Live Writer <=  0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/163f120e-533a-4054-b5d1-331950ad02a7?source=api-prod","affected":[{"type":"plugin","slug":"windows-live-writer","name":"Windows Live Writer","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:03:21Z"},{"id":"wordfence:163fc78a-753e-4aa4-80d5-1b2a5f68e65a","source":"wordfence","cve":"CVE-2024-7691","title":"Flaming Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/163fc78a-753e-4aa4-80d5-1b2a5f68e65a?source=api-prod","affected":[{"type":"plugin","slug":"flaming-forms","name":"Flaming Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-15T18:06:13Z"},{"id":"wordfence:1641758d-a7d7-4677-98a6-cb4a6fea0c63","source":"wordfence","cve":"CVE-2022-40195","title":"PCA Predict <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1641758d-a7d7-4677-98a6-cb4a6fea0c63?source=api-prod","affected":[{"type":"plugin","slug":"address-email-and-phone-validation","name":"PCA Predict","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16429860-d2a6-4b08-b2da-012ec2d4e2c3","source":"wordfence","cve":"CVE-2026-49082","title":"Chatway Live Chat \u2013 AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16429860-d2a6-4b08-b2da-012ec2d4e2c3?source=api-prod","affected":[{"type":"plugin","slug":"chatway-live-chat","name":"Chatway Live Chat \u2013 AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:40:37Z"},{"id":"wordfence:1643fe92-961c-40de-93c1-78cfeb09506d","source":"wordfence","cve":"CVE-2026-8842","title":"Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1643fe92-961c-40de-93c1-78cfeb09506d?source=api-prod","affected":[{"type":"plugin","slug":"google-plus-name-link-popup-badge","name":"Google+ Link Name","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:52Z","updated":"2026-05-27T05:31:20Z"},{"id":"wordfence:16444905-b111-4b4f-a9f0-d8728da2ebfb","source":"wordfence","cve":"CVE-2025-6739","title":"WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16444905-b111-4b4f-a9f0-d8728da2ebfb?source=api-prod","affected":[{"type":"plugin","slug":"wpquiz","name":"WPQuiz","from":"*","from_inclusive":true,"to":"0.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-04T01:44:01Z"},{"id":"wordfence:1644c2c3-11fa-48d6-ad99-416f27df4483","source":"wordfence","cve":"CVE-2023-0098","title":"Simple URLs <= 114 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1644c2c3-11fa-48d6-ad99-416f27df4483?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"114","to_inclusive":true,"patched_in":"115"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1646f96c-f0f4-433a-ac5e-04c1c251972d","source":"wordfence","cve":"CVE-2025-2477","title":"CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1646f96c-f0f4-433a-ac5e-04c1c251972d?source=api-prod","affected":[{"type":"plugin","slug":"cryokey","name":"CryoKey","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T18:19:41Z","updated":"2025-03-22T06:41:09Z"},{"id":"wordfence:1647ac13-d9d1-46ae-93e7-855f55160e03","source":"wordfence","cve":"","title":"Organization chart <= 1.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1647ac13-d9d1-46ae-93e7-855f55160e03?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"1.4.1","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2022-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:164a1e09-e967-450c-8938-84c18ebf267d","source":"wordfence","cve":"CVE-2024-24840","title":"Element Pack Elementor Addons <= 5.4.11 - Missing Authorization via bdt_duplicate_as_draft","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/164a1e09-e967-450c-8938-84c18ebf267d?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"5.4.12"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T17:22:05Z"},{"id":"wordfence:164a276a-612f-416f-b9ef-1c2e6dd0e8e4","source":"wordfence","cve":"CVE-2026-109368","title":"WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/164a276a-612f-416f-b9ef-1c2e6dd0e8e4?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.3","to_inclusive":true,"patched_in":"2.1.0.4"}],"published":"2026-10-16T14:38:46Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:164e9694-3cfd-4cac-8376-deabb1738abf","source":"wordfence","cve":"CVE-2025-64382","title":"Order Export & Order Import for WooCommerce <= 2.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/164e9694-3cfd-4cac-8376-deabb1738abf?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-17T19:19:03Z"},{"id":"wordfence:164ec659-e1a6-4267-b6e9-4e37a402e503","source":"wordfence","cve":"CVE-2023-28497","title":"Slideshow Gallery LITE <= 1.7.6 - Cross-Site Request Forgery via admin_slides","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/164ec659-e1a6-4267-b6e9-4e37a402e503?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16505049-4908-4405-aba4-0e2a03fad575","source":"wordfence","cve":"CVE-2026-22439","title":"Green Planet | Environmental Non-Profit WordPress Theme <= 1.1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16505049-4908-4405-aba4-0e2a03fad575?source=api-prod","affected":[{"type":"theme","slug":"green-planet","name":"Green Planet | Environmental Non-Profit WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:36:17Z"},{"id":"wordfence:1653c4e0-c5e5-44c6-a84d-cdd070696ac4","source":"wordfence","cve":"CVE-2017-6576","title":"Mail Masta <= 1.0 - SQL Injection via id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1653c4e0-c5e5-44c6-a84d-cdd070696ac4?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1653de8f-62eb-488b-9e97-8b30221b509f","source":"wordfence","cve":"CVE-2024-3957","title":"Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1653de8f-62eb-488b-9e97-8b30221b509f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.8","to_inclusive":true,"patched_in":"7.1.9"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:51:49Z"},{"id":"wordfence:1653e5a9-d2bb-42e3-be0d-27356fbde2ce","source":"wordfence","cve":"CVE-2026-1854","title":"Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1653e5a9-d2bb-42e3-be0d-27356fbde2ce?source=api-prod","affected":[{"type":"plugin","slug":"post-flagger","name":"Post Flagger","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:35Z","updated":"2026-03-21T03:26:35Z"},{"id":"wordfence:165406fe-c6a5-4d2b-aad9-a860957a446e","source":"wordfence","cve":"CVE-2025-22308","title":"Smart Custom Fields <= 5.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165406fe-c6a5-4d2b-aad9-a860957a446e?source=api-prod","affected":[{"type":"plugin","slug":"smart-custom-fields","name":"Smart Custom Fields","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-05-30T18:10:42Z"},{"id":"wordfence:16569267-ab52-4b96-86f0-d37c470a3938","source":"wordfence","cve":"CVE-2024-10913","title":"Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16569267-ab52-4b96-86f0-d37c470a3938?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T13:55:13Z"},{"id":"wordfence:165a3c28-ea89-44bd-9de0-38d931f98de2","source":"wordfence","cve":"CVE-2024-30522","title":"Newsletter <= 8.2.0 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165a3c28-ea89-44bd-9de0-38d931f98de2?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:59:21Z"},{"id":"wordfence:165ab739-070c-42e8-83d2-003eb1120fe0","source":"wordfence","cve":"CVE-2026-110381","title":"Simply Schedule Appointments <= 1.6.12.35 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165ab739-070c-42e8-83d2-003eb1120fe0?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.35","to_inclusive":true,"patched_in":"1.6.12.37"}],"published":"2026-10-15T17:47:00Z","updated":"2026-10-23T18:35:30Z"},{"id":"wordfence:165bafd4-0cef-4936-af21-6a8ffcfccaef","source":"wordfence","cve":"CVE-2024-11338","title":"PIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165bafd4-0cef-4936-af21-6a8ffcfccaef?source=api-prod","affected":[{"type":"plugin","slug":"pixnet","name":"PIXNET Plugin","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:15:44Z","updated":"2025-01-07T04:21:56Z"},{"id":"wordfence:165bf4d4-0f97-4c51-bc55-ad14f3e4aae9","source":"wordfence","cve":"CVE-2023-38397","title":"Gestion-Pymes <= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165bf4d4-0f97-4c51-bc55-ad14f3e4aae9?source=api-prod","affected":[{"type":"plugin","slug":"gestion-pymes","name":"Gestion-Pymes","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:165d7b45-6f62-4db6-8890-c785d575727c","source":"wordfence","cve":"CVE-2026-22453","title":"Pets Club <= 2.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165d7b45-6f62-4db6-8890-c785d575727c?source=api-prod","affected":[{"type":"theme","slug":"petclub","name":"Pets Club - Pet Care WordPress Theme + Shop","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:06:16Z"},{"id":"wordfence:165f988d-ec6d-44f7-8884-23aedc2fcb08","source":"wordfence","cve":"CVE-2024-11896","title":"Text Prompter \u2013 Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/165f988d-ec6d-44f7-8884-23aedc2fcb08?source=api-prod","affected":[{"type":"plugin","slug":"ai-content","name":"Text Prompter \u2013 Unlimited chatgpt text prompts for openai tasks","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T08:22:04Z"},{"id":"wordfence:1661bb28-e5b4-4319-84bb-6cbeac266147","source":"wordfence","cve":"CVE-2024-12404","title":"CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1661bb28-e5b4-4319-84bb-6cbeac266147?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-shortcode","name":"CF Internal Link Shortcode","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T13:52:33Z","updated":"2025-01-11T02:20:53Z"},{"id":"wordfence:16630c5a-802e-404a-b90b-be7b906345b0","source":"wordfence","cve":"CVE-2021-25036","title":"All in One SEO 4.0.0 - 4.1.5.2 Authorization Bypass","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16630c5a-802e-404a-b90b-be7b906345b0?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"4.0.0","from_inclusive":true,"to":"4.1.5.2","to_inclusive":true,"patched_in":"4.1.5.3"}],"published":"2021-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1663be8e-a6b8-4e0d-97d0-af7db2a2875c","source":"wordfence","cve":"CVE-2026-11823","title":"BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1663be8e-a6b8-4e0d-97d0-af7db2a2875c?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking-pro","name":"BookingPress Appointment Booking Pro","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-06-30T17:17:57Z","updated":"2026-07-01T05:35:29Z"},{"id":"wordfence:1663c940-9b02-494a-8767-fbddb383405c","source":"wordfence","cve":"CVE-2026-107424","title":"Frontend Dashboard <= 3.0.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1663c940-9b02-494a-8767-fbddb383405c?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:50:06Z"},{"id":"wordfence:1664fef3-6416-4678-9ee7-bed2184d7490","source":"wordfence","cve":"","title":"Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1664fef3-6416-4678-9ee7-bed2184d7490?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2021-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1665bf5a-3bf0-4907-a7df-a2fe26f11869","source":"wordfence","cve":"CVE-2026-15993","title":"Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1665bf5a-3bf0-4907-a7df-a2fe26f11869?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.44","to_inclusive":true,"patched_in":"1.15.45"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-15T03:25:59Z"},{"id":"wordfence:1665f2d0-899b-4f9b-91b1-e5799c3b4d3d","source":"wordfence","cve":"CVE-2025-2797","title":"Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1665f2d0-899b-4f9b-91b1-e5799c3b4d3d?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.21","to_inclusive":true,"patched_in":"5.4.22"}],"published":"2025-04-03T00:00:00Z","updated":"2025-06-09T19:27:38Z"},{"id":"wordfence:1665fda6-005d-42ba-883d-2e3ad7abe0ba","source":"wordfence","cve":"CVE-2023-33317","title":"WooCommerce Warranty Requests <= 2.1.6 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1665fda6-005d-42ba-883d-2e3ad7abe0ba?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-warranty","name":"WooCommerce Warranty Requests","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1666170c-6489-4fbb-8356-f1a7790d74d6","source":"wordfence","cve":"CVE-2024-47634","title":"CartBounty \u2013 Save and recover abandoned carts for WooCommerce <= 8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1666170c-6489-4fbb-8356-f1a7790d74d6?source=api-prod","affected":[{"type":"plugin","slug":"woo-save-abandoned-carts","name":"CartBounty \u2013 Save and recover abandoned carts for WooCommerce","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:20:50Z"},{"id":"wordfence:166c56b4-bf94-4b95-9efe-16219d85f273","source":"wordfence","cve":"CVE-2025-24764","title":"(Simply) Guest Author Name <= 4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/166c56b4-bf94-4b95-9efe-16219d85f273?source=api-prod","affected":[{"type":"plugin","slug":"guest-author-name","name":"(Simply) Guest Author Name","from":"*","from_inclusive":true,"to":"4.36","to_inclusive":true,"patched_in":"4.40"}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-21T20:42:50Z"},{"id":"wordfence:166dfe2c-6efd-48ad-bbcd-e3dc0e9ede05","source":"wordfence","cve":"CVE-2026-56063","title":"Block for Mailchimp \u2013 Add Email Subscription Forms and Collect Leads <= 1.1.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/166dfe2c-6efd-48ad-bbcd-e3dc0e9ede05?source=api-prod","affected":[{"type":"plugin","slug":"block-for-mailchimp","name":"Block for Mailchimp \u2013 grow your email list with signup forms","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:59:04Z"},{"id":"wordfence:166e1d3a-3fd9-4ab0-ba0d-707c6d59e0cd","source":"wordfence","cve":"CVE-2026-12108","title":"Highlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/166e1d3a-3fd9-4ab0-ba0d-707c6d59e0cd?source=api-prod","affected":[{"type":"plugin","slug":"highlighting-code-block","name":"Highlighting Code Block","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-07-09T19:36:03Z","updated":"2026-07-10T07:48:40Z"},{"id":"wordfence:1671405d-27db-4485-87c0-c6405c93f6ad","source":"wordfence","cve":"CVE-2025-23943","title":"PDF.js Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1671405d-27db-4485-87c0-c6405c93f6ad?source=api-prod","affected":[{"type":"plugin","slug":"pdfjs-shortcode","name":"PDF.js Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:08:39Z"},{"id":"wordfence:1671e437-09f0-46bc-87ef-3a5712c3dc98","source":"wordfence","cve":"CVE-2023-28417","title":"Dynamics 365 Integration <= 1.3.12 - Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1671e437-09f0-46bc-87ef-3a5712c3dc98?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1672e8fb-900b-4c2a-b9fd-e64dbb1046af","source":"wordfence","cve":"CVE-2025-23953","title":"user files <= 2.4.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1672e8fb-900b-4c2a-b9fd-e64dbb1046af?source=api-prod","affected":[{"type":"plugin","slug":"user-files","name":"user files","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:04:51Z"},{"id":"wordfence:16735e63-d652-4b0e-b454-2bd13368d8a7","source":"wordfence","cve":"CVE-2025-12170","title":"Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16735e63-d652-4b0e-b454-2bd13368d8a7?source=api-prod","affected":[{"type":"plugin","slug":"checkbox","name":"morkva Checkbox Integration","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":true,"patched_in":"2.8.11"}],"published":"2025-11-20T18:51:31Z","updated":"2025-11-21T07:31:49Z"},{"id":"wordfence:167436b7-3d2b-46fc-a1bc-2bcfd899182e","source":"wordfence","cve":"CVE-2024-37927","title":"Jobmonster <= 4.7.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/167436b7-3d2b-46fc-a1bc-2bcfd899182e?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2024-07-09T00:00:00Z","updated":"2025-01-21T14:09:46Z"},{"id":"wordfence:1674e81e-6a75-436c-b219-8ec0a484a134","source":"wordfence","cve":"CVE-2024-3934","title":"Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1674e81e-6a75-436c-b219-8ec0a484a134?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mercadopago","name":"Mercado Pago payments for WooCommerce","from":"7.3.0","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2024-07-19T15:14:26Z","updated":"2024-07-20T03:30:44Z"},{"id":"wordfence:1675d695-96e1-4fbe-ae42-42a4668f36e0","source":"wordfence","cve":"CVE-2026-62113","title":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1675d695-96e1-4fbe-ae42-42a4668f36e0?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:26:46Z"},{"id":"wordfence:16763837-2bcb-4b7a-9f2d-4855ea277b64","source":"wordfence","cve":"CVE-2025-60210","title":"Everest Forms - Frontend Listing <= 1.0.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16763837-2bcb-4b7a-9f2d-4855ea277b64?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms-frontend-listing","name":"Everest Forms - Frontend Listing","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-02T00:00:00Z","updated":"2026-07-21T15:22:26Z"},{"id":"wordfence:167ae586-1f18-43ac-a7c1-e67a00ce8787","source":"wordfence","cve":"CVE-2023-24418","title":"Tiny carousel horizontal slider plus <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/167ae586-1f18-43ac-a7c1-e67a00ce8787?source=api-prod","affected":[{"type":"plugin","slug":"tiny-carousel-horizontal-slider-plus","name":"Tiny carousel horizontal slider plus","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:167d3e1d-be74-4bfb-b3bf-e2c53d90e12f","source":"wordfence","cve":"CVE-2024-56063","title":"Essential Addons for Elementor <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/167d3e1d-be74-4bfb-b3bf-e2c53d90e12f?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:53:22Z"},{"id":"wordfence:167dedfa-36cc-4b01-8ea4-8eda8742953c","source":"wordfence","cve":"CVE-2024-11203","title":"EmbedPress \u2013 Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/167dedfa-36cc-4b01-8ea4-8eda8742953c?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:20Z"},{"id":"wordfence:1680078c-0dbe-4586-b793-3bf2ddea96ba","source":"wordfence","cve":"CVE-2014-9292","title":"jRSS Widget <= 1.2 - Server-Side Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1680078c-0dbe-4586-b793-3bf2ddea96ba?source=api-prod","affected":[{"type":"plugin","slug":"jrss-widget","name":"jRSS Widget","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16800ece-da9c-431b-a015-42bd30b646e2","source":"wordfence","cve":"CVE-2023-3409","title":"Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16800ece-da9c-431b-a015-42bd30b646e2?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T08:37:23Z"},{"id":"wordfence:16805921-3c4c-43ce-b1e2-7c91da8f0a7e","source":"wordfence","cve":"CVE-2025-59549","title":"GetResponse Forms <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16805921-3c4c-43ce-b1e2-7c91da8f0a7e?source=api-prod","affected":[{"type":"plugin","slug":"getresponse","name":"GetResponse Forms by Optin Cat","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:01:52Z"},{"id":"wordfence:16820eda-e5ff-48d1-81bc-355ee916119b","source":"wordfence","cve":"CVE-2025-47643","title":"ELEX Product Feed for WooCommerce <= 3.1.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16820eda-e5ff-48d1-81bc-355ee916119b?source=api-prod","affected":[{"type":"plugin","slug":"elex-product-feed","name":"ELEX Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-10-30T14:13:43Z"},{"id":"wordfence:1682d8d5-665d-4ed8-825c-556e3d3184e3","source":"wordfence","cve":"CVE-2025-31624","title":"Processing Projects <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1682d8d5-665d-4ed8-825c-556e3d3184e3?source=api-prod","affected":[{"type":"plugin","slug":"processing-projects","name":"Processing Projects","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:09:00Z"},{"id":"wordfence:16836d06-e248-4653-bc12-e193e6f9e6bf","source":"wordfence","cve":"CVE-2026-102565","title":"BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16836d06-e248-4653-bc12-e193e6f9e6bf?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.8.28","to_inclusive":true,"patched_in":"1.8.29"}],"published":"2026-10-01T18:34:22Z","updated":"2026-10-02T06:38:59Z"},{"id":"wordfence:1686f4ad-b114-4e4f-b8f7-8ea7c31b2672","source":"wordfence","cve":"CVE-2026-92713","title":"Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1686f4ad-b114-4e4f-b8f7-8ea7c31b2672?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-09-24T18:50:18Z","updated":"2026-09-25T07:40:25Z"},{"id":"wordfence:1688e2d5-ef79-434f-82ca-7630c5c9343c","source":"wordfence","cve":"CVE-2026-48870","title":"King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1688e2d5-ef79-434f-82ca-7630c5c9343c?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.62","to_inclusive":true,"patched_in":"51.1.63"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:36:18Z"},{"id":"wordfence:1689c9bc-4af8-437a-b403-6af9ca4fd959","source":"wordfence","cve":"CVE-2026-32365","title":"Collapsing Archives <= 3.0.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1689c9bc-4af8-437a-b403-6af9ca4fd959?source=api-prod","affected":[{"type":"plugin","slug":"collapsing-archives","name":"Collapsing Archives","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-02-16T00:00:00Z","updated":"2026-04-15T20:51:27Z"},{"id":"wordfence:168dd2d4-bffb-4187-afc7-02fef8cb51a7","source":"wordfence","cve":"CVE-2024-9697","title":"Social Rocket \u2013 Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168dd2d4-bffb-4187-afc7-02fef8cb51a7?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.4.1"}],"published":"2025-01-06T16:28:47Z","updated":"2026-01-13T16:41:22Z"},{"id":"wordfence:168e7eac-21ad-43ca-93d1-73c38e12bc29","source":"wordfence","cve":"CVE-2025-11238","title":"Watu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168e7eac-21ad-43ca-93d1-73c38e12bc29?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2025-10-24T16:54:19Z","updated":"2025-10-25T05:31:18Z"},{"id":"wordfence:168e8512-d551-47f9-bc2b-c458180a6d13","source":"wordfence","cve":"CVE-2023-30752","title":"External Videos <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168e8512-d551-47f9-bc2b-c458180a6d13?source=api-prod","affected":[{"type":"plugin","slug":"external-videos","name":"External Videos","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:168ecee3-4b06-444d-9703-dc33293d4a90","source":"wordfence","cve":"CVE-2026-123128","title":"GemBooking <= 1.7.0 - Unauthenticated Team Member Double-Booking","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168ecee3-4b06-444d-9703-dc33293d4a90?source=api-prod","affected":[{"type":"plugin","slug":"gembooking","name":"GemBooking \u2013 Appointment Booking, Booking Calendar & Reservations","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:17:56Z"},{"id":"wordfence:168f993a-21ce-4548-9c37-7e80d5c4e00e","source":"wordfence","cve":"CVE-2026-81756","title":"Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168f993a-21ce-4548-9c37-7e80d5c4e00e?source=api-prod","affected":[{"type":"plugin","slug":"smart-marketing-for-wp","name":"Smart Marketing SMS and Newsletters Forms","from":"*","from_inclusive":true,"to":"5.1.24","to_inclusive":true,"patched_in":"5.1.25"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:35:54Z"},{"id":"wordfence:168ff5ec-52f2-4234-aee4-6d460b72d6c5","source":"wordfence","cve":"CVE-2023-23994","title":"Auto Hide Admin Bar <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/168ff5ec-52f2-4234-aee4-6d460b72d6c5?source=api-prod","affected":[{"type":"plugin","slug":"auto-hide-admin-bar","name":"Auto Hide Admin Bar","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1690631b-0e5d-45d1-9db6-6ac426874762","source":"wordfence","cve":"CVE-2024-7605","title":"HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1690631b-0e5d-45d1-9db6-6ac426874762?source=api-prod","affected":[{"type":"plugin","slug":"helloasso","name":"HelloAsso","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2024-09-04T00:00:00Z","updated":"2024-09-05T11:00:14Z"},{"id":"wordfence:16919724-e495-492e-8cc7-639e6d8473c2","source":"wordfence","cve":"CVE-2021-25074","title":"WebP Converter for Media <= 4.0.2 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16919724-e495-492e-8cc7-639e6d8473c2?source=api-prod","affected":[{"type":"plugin","slug":"webp-converter-for-media","name":"Converter for Media \u2013 Optimize images | Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16934359-4824-47b3-a83d-d7e536ed384e","source":"wordfence","cve":"CVE-2026-105972","title":"Menu Cart for WooCommerce < 3.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16934359-4824-47b3-a83d-d7e536ed384e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-menu-bar-cart","name":"Menu Cart for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:14:23Z"},{"id":"wordfence:16988713-a4d4-4d6a-bafb-3441ab54f14b","source":"wordfence","cve":"CVE-2024-37115","title":"Newspack Blocks <= 3.0.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16988713-a4d4-4d6a-bafb-3441ab54f14b?source=api-prod","affected":[{"type":"plugin","slug":"newspack-blocks","name":"Newspack Blocks","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-27T13:08:57Z"},{"id":"wordfence:1698c93e-7ed1-4914-80d5-7e198a5360bf","source":"wordfence","cve":"CVE-2025-24550","title":"Job Manager by JobScore <= 2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1698c93e-7ed1-4914-80d5-7e198a5360bf?source=api-prod","affected":[{"type":"plugin","slug":"job-manager-by-jobscore","name":"Job Manager by JobScore","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-11-16T00:00:00Z","updated":"2025-04-22T21:16:41Z"},{"id":"wordfence:16992d67-f450-47a1-8c4a-c56f7390ba2f","source":"wordfence","cve":"CVE-2026-27364","title":"Style Kits for Elementor <= 2.6.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16992d67-f450-47a1-8c4a-c56f7390ba2f?source=api-prod","affected":[{"type":"plugin","slug":"analogwp-templates","name":"Style Kits for Elementor","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2026-08-24T12:39:37Z","updated":"2026-09-10T19:09:42Z"},{"id":"wordfence:169a857f-1ae0-40f6-8a34-10c573af59c5","source":"wordfence","cve":"CVE-2024-13612","title":"Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/169a857f-1ae0-40f6-8a34-10c573af59c5?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T12:21:32Z"},{"id":"wordfence:169cb1b8-8a37-4a8b-b824-c31ef132b88a","source":"wordfence","cve":"CVE-2023-44984","title":"bbp style pack <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/169cb1b8-8a37-4a8b-b824-c31ef132b88a?source=api-prod","affected":[{"type":"plugin","slug":"bbp-style-pack","name":"bbp style pack","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":false,"patched_in":"5.6.8"}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:169d06e1-055b-422a-a466-155ec43e0dbb","source":"wordfence","cve":"CVE-2024-49604","title":"Simple User Registration <= 6.7 - Missing Authorization to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/169d06e1-055b-422a-a466-155ec43e0dbb?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.8"}],"published":"2024-10-17T00:00:00Z","updated":"2026-01-30T20:36:42Z"},{"id":"wordfence:169d8cd5-0dee-45d1-b5e2-6fd2bc0973c4","source":"wordfence","cve":"CVE-2026-22476","title":"Etchy <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/169d8cd5-0dee-45d1-b5e2-6fd2bc0973c4?source=api-prod","affected":[{"type":"theme","slug":"etchy","name":"Etchy - Print Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:49:46Z"},{"id":"wordfence:169f2767-da20-4199-9997-438a62f6aee4","source":"wordfence","cve":"","title":"reCaptcha by BestWebSoft < 1.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/169f2767-da20-4199-9997-438a62f6aee4?source=api-prod","affected":[{"type":"plugin","slug":"google-captcha","name":"reCaptcha by BestWebSoft","from":"*","from_inclusive":true,"to":"1.28","to_inclusive":false,"patched_in":"1.28"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16a285b1-7a20-455f-8f74-2e468dd436d3","source":"wordfence","cve":"CVE-2025-5490","title":"Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a285b1-7a20-455f-8f74-2e468dd436d3?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.12.4","to_inclusive":true,"patched_in":"2.12.5"}],"published":"2025-06-18T16:35:19Z","updated":"2025-06-25T13:34:29Z"},{"id":"wordfence:16a3469d-6264-4ed7-b6ae-fdd7a80c8ca5","source":"wordfence","cve":"","title":"Chronopost & Mondial relay pour WooCommerce - WCMultiShipping <= 2.3.7 - Incorrect Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a3469d-6264-4ed7-b6ae-fdd7a80c8ca5?source=api-prod","affected":[{"type":"plugin","slug":"wc-multishipping","name":"WCMultiShipping \u2014 Mondial Relay, Inpost & Chronopost for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16a4665a-df79-4def-8215-df44dffdd332","source":"wordfence","cve":"CVE-2026-66701","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a4665a-df79-4def-8215-df44dffdd332?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.16.5","to_inclusive":true,"patched_in":"3.16.6"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:43:51Z"},{"id":"wordfence:16a4ebde-7c92-4ad2-9c8d-3bef0a8c600b","source":"wordfence","cve":"CVE-2012-5177","title":"Welcart e-Commerce < 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a4ebde-7c92-4ad2-9c8d-3bef0a8c600b?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2012-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16a70662-d32c-4dfd-a1b2-0876ba4671ab","source":"wordfence","cve":"CVE-2025-46537","title":"Section Widget <= 3.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a70662-d32c-4dfd-a1b2-0876ba4671ab?source=api-prod","affected":[{"type":"plugin","slug":"section-widget","name":"Section Widget","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:19:43Z"},{"id":"wordfence:16a94e89-f21a-4cf4-8917-563c5353f2e3","source":"wordfence","cve":"CVE-2026-112866","title":"Product Filter for WooCommerce by WBW <= 3.4.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16a94e89-f21a-4cf4-8917-563c5353f2e3?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-10-22T07:29:42Z","updated":"2026-10-28T01:17:22Z"},{"id":"wordfence:16ac3161-c539-4cc2-9535-d4a21690a7da","source":"wordfence","cve":"CVE-2025-23997","title":"Tamara Checkout <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16ac3161-c539-4cc2-9535-d4a21690a7da?source=api-prod","affected":[{"type":"plugin","slug":"tamara-checkout","name":"Tamara Checkout","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.9.1"}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-28T16:09:18Z"},{"id":"wordfence:16ac73ae-6a0a-4c9b-8830-e0745061e587","source":"wordfence","cve":"CVE-2026-18109","title":"W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16ac73ae-6a0a-4c9b-8830-e0745061e587?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2026-08-13T14:23:18Z","updated":"2026-08-14T02:25:48Z"},{"id":"wordfence:16af4d96-e7e0-4b13-90a5-ddf62909271a","source":"wordfence","cve":"CVE-2016-1000112","title":"Contus Video Comments <= 1.0 - Remote File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16af4d96-e7e0-4b13-90a5-ddf62909271a?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-comments","name":"contus-video-comments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16af8724-595c-4daa-80bd-8125a32cc502","source":"wordfence","cve":"CVE-2024-1768","title":"Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16af8724-595c-4daa-80bd-8125a32cc502?source=api-prod","affected":[{"type":"plugin","slug":"clever-fox","name":"Clever Fox","from":"*","from_inclusive":true,"to":"25.2.0","to_inclusive":true,"patched_in":"25.2.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T02:39:28Z"},{"id":"wordfence:16b0947e-3bb2-4150-b810-2e77de3e75da","source":"wordfence","cve":"CVE-2022-37330","title":"WHA Crossword <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b0947e-3bb2-4150-b810-2e77de3e75da?source=api-prod","affected":[{"type":"plugin","slug":"wha-crossword","name":"WHA Crossword","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16b37992-a87e-42bb-ab0f-cb32506874e9","source":"wordfence","cve":"CVE-2024-29819","title":"WPFront Notification Bar <= 3.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b37992-a87e-42bb-ab0f-cb32506874e9?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-notification-bar","name":"WPFront Notification Bar","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:37:53Z"},{"id":"wordfence:16b407ab-9687-4a10-b458-ad39661e4fb0","source":"wordfence","cve":"CVE-2021-24200","title":"wpDataTables (Premium) <= 3.4.1 - Blind SQL Injection via length Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b407ab-9687-4a10-b458-ad39661e4fb0?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16b5ad20-a264-49fa-aafc-e137ac0d81fa","source":"wordfence","cve":"CVE-2025-22755","title":"WP Headmaster <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b5ad20-a264-49fa-aafc-e137ac0d81fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-headmaster","name":"WP Headmaster","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:41:39Z"},{"id":"wordfence:16b609d7-28d5-479f-a508-394d7319c56e","source":"wordfence","cve":"CVE-2026-66682","title":"Abandoned Cart Pro for WooCommerce <= 10.4.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b609d7-28d5-479f-a508-394d7319c56e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:03:57Z"},{"id":"wordfence:16b7d53d-155d-4ccc-889f-102e6b3bd372","source":"wordfence","cve":"CVE-2026-108484","title":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.27 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b7d53d-155d-4ccc-889f-102e6b3bd372?source=api-prod","affected":[{"type":"plugin","slug":"wp-payment-form","name":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management","from":"*","from_inclusive":true,"to":"4.6.27","to_inclusive":true,"patched_in":"4.6.28"}],"published":"2026-10-12T17:40:19Z","updated":"2026-10-23T18:24:16Z"},{"id":"wordfence:16b8851c-171b-43cc-85ef-28c01d7e090f","source":"wordfence","cve":"CVE-2025-27321","title":"Blightly Explorer <= 2.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16b8851c-171b-43cc-85ef-28c01d7e090f?source=api-prod","affected":[{"type":"plugin","slug":"blighty-explorer","name":"Blighty Explorer","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:29:57Z"},{"id":"wordfence:16bbabe5-e8cf-43fa-ae7d-326045464192","source":"wordfence","cve":"CVE-2026-24964","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16bbabe5-e8cf-43fa-ae7d-326045464192?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.2.1","to_inclusive":true,"patched_in":"28.1.2.2"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T14:02:45Z"},{"id":"wordfence:16bce371-b524-48eb-8537-3f9df802abd3","source":"wordfence","cve":"CVE-2026-14495","title":"DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token","severity":"high","cvss":8.8,"cwe":"CWE-338","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16bce371-b524-48eb-8537-3f9df802abd3?source=api-prod","affected":[{"type":"plugin","slug":"dologin","name":"DoLogin Security","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2026-07-07T16:39:40Z","updated":"2026-07-22T20:45:20Z"},{"id":"wordfence:16bce38a-07fa-43b7-aacb-6c932c3d0987","source":"wordfence","cve":"CVE-2022-0760","title":"Simple Link Directory <= 7.7.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16bce38a-07fa-43b7-aacb-6c932c3d0987?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"7.7.2","to_inclusive":false,"patched_in":"7.7.2"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16bd14a1-e69b-4b7d-8c0e-a294e120d2a6","source":"wordfence","cve":"CVE-2023-30877","title":"XML for Google Merchant Center <= 3.0.1 - Reflected Cross-Site Scripting via page parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16bd14a1-e69b-4b7d-8c0e-a294e120d2a6?source=api-prod","affected":[{"type":"plugin","slug":"xml-for-google-merchant-center","name":"XML for Google Merchant Center","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16c0a3b7-25b0-457e-b883-a780bc6a29a7","source":"wordfence","cve":"CVE-2022-0885","title":"Member Hero <= 1.0.9 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c0a3b7-25b0-457e-b883-a780bc6a29a7?source=api-prod","affected":[{"type":"plugin","slug":"member-hero","name":"Member Hero","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16c212d8-21e2-407f-b2ea-0ca519da26dd","source":"wordfence","cve":"CVE-2025-13001","title":"Donation <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c212d8-21e2-407f-b2ea-0ca519da26dd?source=api-prod","affected":[{"type":"plugin","slug":"donation","name":"donation","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-11T00:00:00Z","updated":"2026-03-27T10:51:01Z"},{"id":"wordfence:16c4c9ff-2d57-4cba-adad-72d012bd12f7","source":"wordfence","cve":"CVE-2024-50414","title":"Button contact VR <= 4.7.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c4c9ff-2d57-4cba-adad-72d012bd12f7?source=api-prod","affected":[{"type":"plugin","slug":"button-contact-vr","name":"Buttonizer \u2013 Live Chat, AI Chatbot, Call, Chat, Contact Button","from":"*","from_inclusive":true,"to":"4.7.9.1","to_inclusive":true,"patched_in":"4.7.10"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:25:21Z"},{"id":"wordfence:16c6fec8-81ec-477a-9942-10fd3adb8fa4","source":"wordfence","cve":"CVE-2026-1888","title":"Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c6fec8-81ec-477a-9942-10fd3adb8fa4?source=api-prod","affected":[{"type":"plugin","slug":"docus","name":"Docus \u2013 YouTube Video Playlist","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-02-05T18:37:47Z","updated":"2026-02-06T06:46:28Z"},{"id":"wordfence:16c70597-32a0-4771-877b-c57cf7550ee7","source":"wordfence","cve":"CVE-2022-37402","title":"AFS Analytics <= 4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c70597-32a0-4771-877b-c57cf7550ee7?source=api-prod","affected":[{"type":"plugin","slug":"addfreestats","name":"AFS Analytics","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16c7813c-7814-43f1-b051-e7e8690de21e","source":"wordfence","cve":"CVE-2024-31268","title":"AppPresser <= 4.3.0 - Cross-Site Request Forgery via toggle_logging_callback()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c7813c-7814-43f1-b051-e7e8690de21e?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:26:00Z"},{"id":"wordfence:16c99f2c-105d-4082-81ad-ffe1d970208d","source":"wordfence","cve":"CVE-2026-12378","title":"BookingPress <= 1.5.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c99f2c-105d-4082-81ad-ffe1d970208d?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-06-17T00:00:00Z","updated":"2026-08-29T00:39:39Z"},{"id":"wordfence:16c9ed4a-9e9f-4f10-b3fd-7f0db2c86112","source":"wordfence","cve":"CVE-2025-13007","title":"WP Social Ninja \u2013 Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16c9ed4a-9e9f-4f10-b3fd-7f0db2c86112?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-reviews","name":"WP Social Ninja \u2013 Embed Social Feeds, User Reviews & Chat Widgets","from":"*","from_inclusive":true,"to":"3.20.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-12-01T17:36:25Z","updated":"2025-12-02T06:40:25Z"},{"id":"wordfence:16cd88cc-b459-43a9-ae0e-08c01957a111","source":"wordfence","cve":"CVE-2025-48131","title":"UltraAddons Elementor Lite <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16cd88cc-b459-43a9-ae0e-08c01957a111?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:55:42Z"},{"id":"wordfence:16d083bc-d726-4291-bc6d-a7bf83fa78c3","source":"wordfence","cve":"CVE-2026-5162","title":"Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d083bc-d726-4291-bc6d-a7bf83fa78c3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-04-16T13:10:11Z","updated":"2026-04-17T01:24:36Z"},{"id":"wordfence:16d0c7ad-e9d3-42c9-ac73-cc8184c9d60d","source":"wordfence","cve":"CVE-2025-15445","title":"Restaurant Cafeteria <= 0.4.6 - Missing Authorization to (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d0c7ad-e9d3-42c9-ac73-cc8184c9d60d?source=api-prod","affected":[{"type":"theme","slug":"restaurant-cafeteria","name":"Restaurant Cafeteria","from":"*","from_inclusive":true,"to":"0.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T00:00:00Z","updated":"2026-05-04T14:32:01Z"},{"id":"wordfence:16d1eb4a-c68a-43b9-a514-d8751687709a","source":"wordfence","cve":"CVE-2024-32582","title":"Debug Log Manager <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d1eb4a-c68a-43b9-a514-d8751687709a?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:36:17Z"},{"id":"wordfence:16d41531-5250-421e-93d6-29176e1f252d","source":"wordfence","cve":"CVE-2025-23675","title":"Import Users to MailChimp <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d41531-5250-421e-93d6-29176e1f252d?source=api-prod","affected":[{"type":"plugin","slug":"import-users-to-mailchimp","name":"Import Users to MailChimp","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:20:21Z"},{"id":"wordfence:16d4ff25-3dae-437f-b6a5-703a3b879904","source":"wordfence","cve":"CVE-2025-23951","title":"Gallery: Hybrid \u2013 Advanced Visual Gallery <= 1.4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d4ff25-3dae-437f-b6a5-703a3b879904?source=api-prod","affected":[{"type":"plugin","slug":"hybrid-gallery","name":"Gallery: Hybrid \u2013 Advanced Visual Gallery","from":"*","from_inclusive":true,"to":"1.4.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:49:36Z"},{"id":"wordfence:16d5d7a1-6d90-44cd-a4cf-e55e83ea0670","source":"wordfence","cve":"CVE-2026-123464","title":"The Events Calendar <= 6.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d5d7a1-6d90-44cd-a4cf-e55e83ea0670?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.3","to_inclusive":true,"patched_in":"6.18.3.1"}],"published":"2026-11-07T09:15:00Z","updated":"2026-11-10T19:59:09Z"},{"id":"wordfence:16d8eab2-953a-46bf-a0f6-296bcea86305","source":"wordfence","cve":"CVE-2024-3565","title":"Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16d8eab2-953a-46bf-a0f6-296bcea86305?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-01T03:31:17Z"},{"id":"wordfence:16dc1927-2171-4234-805b-6e4eed99fa90","source":"wordfence","cve":"CVE-2023-45068","title":"Contact Form by Supsystic <= 1.7.27 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16dc1927-2171-4234-805b-6e4eed99fa90?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.27","to_inclusive":true,"patched_in":"1.7.28"}],"published":"2023-10-03T00:00:00Z","updated":"2024-10-07T20:31:34Z"},{"id":"wordfence:16dca898-1a98-4e0b-8f48-dc01ba2dc4e6","source":"wordfence","cve":"CVE-2026-5581","title":"Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16dca898-1a98-4e0b-8f48-dc01ba2dc4e6?source=api-prod","affected":[{"type":"plugin","slug":"gf-multi-uploader","name":"Multi Uploader for Gravity Forms","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-08-04T18:27:23Z","updated":"2026-08-05T06:37:53Z"},{"id":"wordfence:16dd90c3-3962-4c8e-993f-b6824c48ab76","source":"wordfence","cve":"CVE-2025-14339","title":"weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16dd90c3-3962-4c8e-993f-b6824c48ab76?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-02-20T20:58:51Z","updated":"2026-02-21T09:28:01Z"},{"id":"wordfence:16ded5aa-c8e8-4d98-b07f-e689ad0e03c7","source":"wordfence","cve":"CVE-2026-10091","title":"Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16ded5aa-c8e8-4d98-b07f-e689ad0e03c7?source=api-prod","affected":[{"type":"plugin","slug":"email-javascript-cloaker","name":"Email JavaScript Cloak","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:36:54Z","updated":"2026-06-24T05:33:22Z"},{"id":"wordfence:16e1d37a-4eb7-45dc-8993-a501fb2aaf73","source":"wordfence","cve":"CVE-2025-12041","title":"ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e1d37a-4eb7-45dc-8993-a501fb2aaf73?source=api-prod","affected":[{"type":"plugin","slug":"eri-file-library","name":"ERI File Library","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-10-30T20:31:13Z","updated":"2025-10-31T09:27:20Z"},{"id":"wordfence:16e2c051-6ec6-4b09-8802-adb537fa9af0","source":"wordfence","cve":"","title":"Visual Form Builder <= 2.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e2c051-6ec6-4b09-8802-adb537fa9af0?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e3ca1b-817d-4f03-92ae-346a56271c47","source":"wordfence","cve":"CVE-2021-24148","title":"MStore API <= 3.1.9 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e3ca1b-817d-4f03-92ae-346a56271c47?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2021-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e63535-28bc-4a3d-a201-4216dc786d98","source":"wordfence","cve":"CVE-2022-1456","title":"Poll Maker <= 4.0.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e63535-28bc-4a3d-a201-4216dc786d98?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2022-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e6dc49-5edf-4ce4-95c9-19ef04a77379","source":"wordfence","cve":"CVE-2020-9394","title":"Pricing Table by Supsystic <= 1.8.1 - Cross-Site Request Forgery to Cross-Site Scripting and Setting Changes","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e6dc49-5edf-4ce4-95c9-19ef04a77379?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e7a7c5-b845-4f28-bee6-fde54d003e13","source":"wordfence","cve":"CVE-2021-34665","title":"WP SEO Tags <= 2.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7a7c5-b845-4f28-bee6-fde54d003e13?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-tags","name":"WP SEO Tags","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e7adef-68ab-4dd6-bd80-252622cfe705","source":"wordfence","cve":"CVE-2025-14635","title":"Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e7adef-68ab-4dd6-bd80-252622cfe705?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.20.3","to_inclusive":true,"patched_in":"3.20.4"}],"published":"2025-12-22T22:08:35Z","updated":"2025-12-23T11:13:54Z"},{"id":"wordfence:16e8e097-a332-4c8e-87fb-aabe5d00ae05","source":"wordfence","cve":"CVE-2023-0873","title":"Kanban Boards for WordPress <= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e8e097-a332-4c8e-87fb-aabe5d00ae05?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.20","to_inclusive":true,"patched_in":"2.5.21"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16e8fcd3-9fc6-440f-b7d8-28f49eca6303","source":"wordfence","cve":"CVE-2026-14566","title":"Advanced Customized Prompts <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16e8fcd3-9fc6-440f-b7d8-28f49eca6303?source=api-prod","affected":[{"type":"plugin","slug":"advanced-customized-prompts","name":"Advanced Customized Prompts","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:33:47Z"},{"id":"wordfence:16f183a6-b8db-461e-b17d-2faa528ff0ff","source":"wordfence","cve":"CVE-2023-30746","title":"Booqable Rental Plugin <= 2.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16f183a6-b8db-461e-b17d-2faa528ff0ff?source=api-prod","affected":[{"type":"plugin","slug":"booqable-rental-reservations","name":"Booqable Rental Plugin","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:16f40b76-8f69-46de-a3e0-b7124dc74c00","source":"wordfence","cve":"CVE-2024-37250","title":"Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16f40b76-8f69-46de-a3e0-b7124dc74c00?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-06-26T00:00:00Z","updated":"2024-12-12T19:34:17Z"},{"id":"wordfence:16f5a104-dce0-4249-91b9-67f99cce16d3","source":"wordfence","cve":"CVE-2024-4838","title":"ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16f5a104-dce0-4249-91b9-67f99cce16d3?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.5.26","to_inclusive":true,"patched_in":"3.5.26.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T18:40:39Z"},{"id":"wordfence:16f9ca70-50fe-4fab-8a58-57af795dc000","source":"wordfence","cve":"CVE-2026-8944","title":"Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16f9ca70-50fe-4fab-8a58-57af795dc000?source=api-prod","affected":[{"type":"plugin","slug":"io-engagement-analytics","name":"Plugin for Google Analytics by IO technologies","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T16:17:18Z","updated":"2026-06-30T04:30:17Z"},{"id":"wordfence:16f9e2c9-e7cb-41a1-a4b0-8e848e87b6c4","source":"wordfence","cve":"CVE-2026-86850","title":"SKU Error Fixer for WooCommerce <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16f9e2c9-e7cb-41a1-a4b0-8e848e87b6c4?source=api-prod","affected":[{"type":"plugin","slug":"sku-error-fixer-for-woocommerce","name":"SKU Error Fixer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:15:02Z"},{"id":"wordfence:16fd140b-c976-4425-8ac5-a524b8cf1a42","source":"wordfence","cve":"CVE-2024-38794","title":"Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16fd140b-c976-4425-8ac5-a524b8cf1a42?source=api-prod","affected":[{"type":"plugin","slug":"post-type-archive-mapping","name":"Custom Query Blocks","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:09:12Z"},{"id":"wordfence:16fdea34-021d-46de-acfc-eb23331875d4","source":"wordfence","cve":"CVE-2026-97332","title":"User Private Files <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/16fdea34-021d-46de-acfc-eb23331875d4?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T00:19:08Z"},{"id":"wordfence:1701275d-8d29-449b-9804-f8f35c550e94","source":"wordfence","cve":"CVE-2025-30880","title":"JS Help Desk <= 2.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1701275d-8d29-449b-9804-f8f35c550e94?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:19:56Z"},{"id":"wordfence:17031e21-e697-4e01-8848-c3957f5dac7f","source":"wordfence","cve":"CVE-2023-28532","title":"Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17031e21-e697-4e01-8848-c3957f5dac7f?source=api-prod","affected":[{"type":"theme","slug":"real-estate-directory","name":"Real Estate Directory","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1703a5be-f399-4ea5-8d98-a2efda674aa6","source":"wordfence","cve":"CVE-2025-9130","title":"Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1703a5be-f399-4ea5-8d98-a2efda674aa6?source=api-prod","affected":[{"type":"plugin","slug":"unify","name":"Unify","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2025-10-02T22:11:23Z","updated":"2025-10-17T19:14:29Z"},{"id":"wordfence:1704cffa-75ed-415e-864f-de7ff8eea8dc","source":"wordfence","cve":"CVE-2026-14995","title":"Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1704cffa-75ed-415e-864f-de7ff8eea8dc?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.15.1","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2026-09-30T20:10:48Z","updated":"2026-10-01T08:28:40Z"},{"id":"wordfence:1707b5ba-56ce-46e5-97fc-918005f5ae49","source":"wordfence","cve":"CVE-2025-47466","title":"Ultimate WP Mail <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1707b5ba-56ce-46e5-97fc-918005f5ae49?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:23:15Z"},{"id":"wordfence:17093f18-09e2-425c-b1fc-60766234be49","source":"wordfence","cve":"CVE-2024-9638","title":"Category Posts Widget <= 4.9.17 - Authenticated (Admin+) Stored Cross-Site SCripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17093f18-09e2-425c-b1fc-60766234be49?source=api-prod","affected":[{"type":"plugin","slug":"category-posts","name":"Category Posts Block","from":"*","from_inclusive":true,"to":"4.9.17","to_inclusive":true,"patched_in":"4.9.18"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-14T18:49:44Z"},{"id":"wordfence:170a4cf2-d379-4c4e-b9e5-fb3b3bd91a40","source":"wordfence","cve":"CVE-2025-6201","title":"Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/170a4cf2-d379-4c4e-b9e5-fb3b3bd91a40?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.49.0","to_inclusive":true,"patched_in":"1.49.1"}],"published":"2025-06-18T13:52:25Z","updated":"2025-06-19T02:10:36Z"},{"id":"wordfence:170bb0cc-85c0-41e2-a7e0-a082aee1e6c0","source":"wordfence","cve":"CVE-2026-42653","title":"Affiliate Program Suite \u2014 SliceWP Affiliates <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/170bb0cc-85c0-41e2-a7e0-a082aee1e6c0?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-05-06T00:00:00Z","updated":"2026-05-11T20:30:29Z"},{"id":"wordfence:170c9eba-9593-4e35-b663-b2d4fad85060","source":"wordfence","cve":"CVE-2026-25458","title":"Moments <= 2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/170c9eba-9593-4e35-b663-b2d4fad85060?source=api-prod","affected":[{"type":"theme","slug":"moments","name":"moments","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-19T14:52:16Z"},{"id":"wordfence:170cd2e3-e31b-452e-8c15-d44a8be7757b","source":"wordfence","cve":"CVE-2025-9518","title":"atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/170cd2e3-e31b-452e-8c15-d44a8be7757b?source=api-prod","affected":[{"type":"plugin","slug":"atec-debug","name":"atec Debug","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":"1.2.23"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-04T04:23:48Z"},{"id":"wordfence:171311a2-637d-4ac2-9b0f-6026bd477199","source":"wordfence","cve":"CVE-2023-25996","title":"Booster Elite for WooCommerce < 8.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/171311a2-637d-4ac2-9b0f-6026bd477199?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":false,"patched_in":"8.4.0"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-13T19:08:51Z"},{"id":"wordfence:1714c26f-775a-4ccc-8b55-e85ca1fb3a84","source":"wordfence","cve":"CVE-2022-0228","title":"Popup Builder <= 4.0.6 - Authenticated SQL Injection via order & orderby Parameters","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1714c26f-775a-4ccc-8b55-e85ca1fb3a84?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17150263-261d-422f-8b36-a2981d4aaad3","source":"wordfence","cve":"CVE-2023-3419","title":"tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17150263-261d-422f-8b36-a2981d4aaad3?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T09:38:54Z"},{"id":"wordfence:17150f49-8a03-4834-b8e0-275599a0e406","source":"wordfence","cve":"CVE-2025-49282","title":"Magze <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17150f49-8a03-4834-b8e0-275599a0e406?source=api-prod","affected":[{"type":"theme","slug":"magze","name":"Magze","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:54:45Z"},{"id":"wordfence:1716743f-8259-40fb-bc9b-53e3dfef8816","source":"wordfence","cve":"CVE-2025-10139","title":"WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1716743f-8259-40fb-bc9b-53e3dfef8816?source=api-prod","affected":[{"type":"plugin","slug":"wp-bookwidgets","name":"WP BookWidgets","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":"0.10"}],"published":"2025-10-14T20:01:01Z","updated":"2025-10-21T20:14:03Z"},{"id":"wordfence:1716ef84-759e-4b40-aaa3-ae6ead41fcb5","source":"wordfence","cve":"CVE-2022-0593","title":"Login with phone number <= 1.3.6 - Unauthenticated Remote Plugin Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1716ef84-759e-4b40-aaa3-ae6ead41fcb5?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1718f2eb-6235-498f-8c1e-402c1caf7d02","source":"wordfence","cve":"CVE-2022-4021","title":"Permalink Manager Lite <= 2.2.20.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1718f2eb-6235-498f-8c1e-402c1caf7d02?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.2.20.1","to_inclusive":true,"patched_in":"2.2.20.2"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:171ee69a-d0d6-4d1e-b477-4d285be918f4","source":"wordfence","cve":"CVE-2015-9230","title":"BulletProof Security < .52.5 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/171ee69a-d0d6-4d1e-b477-4d285be918f4?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".52.5","to_inclusive":false,"patched_in":".52.5"}],"published":"2014-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:171faddd-c60c-4d07-834e-d8149703513b","source":"wordfence","cve":"CVE-2022-23912","title":"Testimonial WordPress Plugin < 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/171faddd-c60c-4d07-834e-d8149703513b?source=api-prod","affected":[{"type":"plugin","slug":"ap-custom-testimonial","name":"Testimonial WordPress Plugin \u2013 AP Custom Testimonial","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2022-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:171fe5db-0b43-47ba-b215-87ce9d7b5095","source":"wordfence","cve":"CVE-2025-6054","title":"YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/171fe5db-0b43-47ba-b215-87ce9d7b5095?source=api-prod","affected":[{"type":"plugin","slug":"yanewsflash","name":"YANewsflash","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T14:03:11Z","updated":"2025-07-23T02:24:37Z"},{"id":"wordfence:17215b12-a134-40e1-b431-22372dabd18f","source":"wordfence","cve":"CVE-2025-67465","title":"Simple Link Directory <= 8.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17215b12-a134-40e1-b431-22372dabd18f?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:59:42Z"},{"id":"wordfence:1723a465-75ca-4fea-ad9c-d96ffb5625a8","source":"wordfence","cve":"CVE-2023-2803","title":"Ultimate Addons for Contact Form 7 <= 3.1.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1723a465-75ca-4fea-ad9c-d96ffb5625a8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.1.29","to_inclusive":false,"patched_in":"3.1.29"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17240221-01b2-4a21-9e9f-f940280c0fb7","source":"wordfence","cve":"CVE-2025-8216","title":"Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17240221-01b2-4a21-9e9f-f940280c0fb7?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-07-28T20:40:12Z","updated":"2025-07-29T09:23:46Z"},{"id":"wordfence:17240c75-4e2a-45d2-8114-414c7e81af87","source":"wordfence","cve":"CVE-2023-31215","title":"Dropshipping & Affiliation with Amazon <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17240c75-4e2a-45d2-8114-414c7e81af87?source=api-prod","affected":[{"type":"plugin","slug":"wp-amazon-shop","name":"Dropshipping & Affiliation with Amazon","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1725c7f3-2fac-4714-a63e-6c43694483fc","source":"wordfence","cve":"CVE-2024-6033","title":"Event Manager, Events Calendar, Tickets, Registrations \u2013 Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1725c7f3-2fac-4714-a63e-6c43694483fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2024-07-16T00:00:00Z","updated":"2024-07-17T06:45:08Z"},{"id":"wordfence:1729d0de-1f5f-4349-b592-5841d01ed33a","source":"wordfence","cve":"CVE-2024-13471","title":"DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1729d0de-1f5f-4349-b592-5841d01ed33a?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-core-features","name":"DesignThemes Core Features","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-03-04T21:27:19Z","updated":"2025-03-27T17:11:00Z"},{"id":"wordfence:172a8c2c-dbfe-425a-9091-c9f20290cf03","source":"wordfence","cve":"CVE-2025-25153","title":"Simple Auto Tag <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172a8c2c-dbfe-425a-9091-c9f20290cf03?source=api-prod","affected":[{"type":"plugin","slug":"simple-auto-tag","name":"Simple Auto Tag","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:29:15Z"},{"id":"wordfence:172b2191-6595-47dd-bf2d-97dc3d17e5ca","source":"wordfence","cve":"CVE-2023-24420","title":"Admin side data storage for Contact Form 7 <= 1.1.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172b2191-6595-47dd-bf2d-97dc3d17e5ca?source=api-prod","affected":[{"type":"plugin","slug":"admin-side-data-storage-for-contact-form-7","name":"Admin side data storage for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:172b6b54-d1de-48f9-ad2f-00d62d7e91fd","source":"wordfence","cve":"CVE-2024-11889","title":"My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172b6b54-d1de-48f9-ad2f-00d62d7e91fd?source=api-prod","affected":[{"type":"plugin","slug":"my-idx-home-search","name":"My IDX Home Search","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-12-13T15:56:20Z","updated":"2024-12-21T16:08:21Z"},{"id":"wordfence:172d4a39-a46f-4ffd-a4cc-3f53c78a3c4e","source":"wordfence","cve":"CVE-2025-31921","title":"WP Ultimate Tours Builder <= 1.055 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172d4a39-a46f-4ffd-a4cc-3f53c78a3c4e?source=api-prod","affected":[{"type":"plugin","slug":"WP_UltimateToursBuilder","name":"WP Ultimate Tours Builder","from":"*","from_inclusive":true,"to":"1.055","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:23:01Z"},{"id":"wordfence:172d8ffc-7ed3-43a6-942c-93b476a4fb50","source":"wordfence","cve":"CVE-2022-4760","title":"OneClick Chat to Order <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172d8ffc-7ed3-43a6-942c-93b476a4fb50?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.4.1","to_inclusive":true,"patched_in":"1.0.4.2"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:172e740c-f69d-4b35-87fd-167530c5f8a0","source":"wordfence","cve":"CVE-2025-27301","title":"NHR Options Table Manager <= 1.1.2 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/172e740c-f69d-4b35-87fd-167530c5f8a0?source=api-prod","affected":[{"type":"plugin","slug":"nhrrob-options-table-manager","name":"NHR Database Cleaner & Optimizer \u2013 Revisions, Transients, Autoload & Options Manager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-18T18:05:54Z"},{"id":"wordfence:17301be2-f2bc-4b59-b0ab-65591ffcfa3e","source":"wordfence","cve":"CVE-2025-8413","title":"Listeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17301be2-f2bc-4b59-b0ab-65591ffcfa3e?source=api-prod","affected":[{"type":"theme","slug":"listeo","name":"Listeo - Directory & Listings With Booking - WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-10-24T17:11:49Z","updated":"2025-10-25T05:31:18Z"},{"id":"wordfence:173305ee-9c89-4192-8ccf-227947b142d1","source":"wordfence","cve":"CVE-2025-11822","title":"WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/173305ee-9c89-4192-8ccf-227947b142d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-bootstrap-tabs","name":"WP Bootstrap Tabs","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:56:08Z","updated":"2025-11-11T03:30:32Z"},{"id":"wordfence:1733d882-23c0-4c9b-b6c1-2841b0eb4c43","source":"wordfence","cve":"CVE-2026-62124","title":"N7 <= 2.21 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1733d882-23c0-4c9b-b6c1-2841b0eb4c43?source=api-prod","affected":[{"type":"theme","slug":"n7-golf-club","name":"N7","from":"*","from_inclusive":true,"to":"2.21","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:32:18Z","updated":"2026-10-13T14:03:05Z"},{"id":"wordfence:173661aa-6895-41d6-8869-6abfd2eadf31","source":"wordfence","cve":"CVE-2023-34173","title":"Yandex Metrica Counter <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/173661aa-6895-41d6-8869-6abfd2eadf31?source=api-prod","affected":[{"type":"plugin","slug":"counter-yandex-metrica","name":"Yandex Metrica Counter","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:173adc9e-64e6-40da-9ef1-31e35cb179b2","source":"wordfence","cve":"CVE-2024-51937","title":"IA Map Analytics Basic <= 20170413 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/173adc9e-64e6-40da-9ef1-31e35cb179b2?source=api-prod","affected":[{"type":"plugin","slug":"ia-map-analytics-basic","name":"IA Map Analytics Basic","from":"*","from_inclusive":true,"to":"20170413","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:33:12Z"},{"id":"wordfence:173c20d5-05aa-4f19-9bbe-985585b09de2","source":"wordfence","cve":"CVE-2024-56224","title":"Ledenbeheer <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/173c20d5-05aa-4f19-9bbe-985585b09de2?source=api-prod","affected":[{"type":"plugin","slug":"ledenbeheer-external-connection","name":"Ledenbeheer","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:00:30Z"},{"id":"wordfence:173c8c8a-a015-4522-b957-1805f520a77d","source":"wordfence","cve":"CVE-2023-50834","title":"WooCommerce Menu Extension <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/173c8c8a-a015-4522-b957-1805f520a77d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-menu-extension","name":"WooCommerce Menu Extension","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:174064fb-b222-4820-b175-980aa8ff8383","source":"wordfence","cve":"CVE-2025-30633","title":"Amazon Native Shopping Recommendations <= 1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174064fb-b222-4820-b175-980aa8ff8383?source=api-prod","affected":[{"type":"plugin","slug":"woozone-contextual","name":"woozone-contextual","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:19:12Z"},{"id":"wordfence:174217c5-0763-4ebb-876b-b4b9c15afa1b","source":"wordfence","cve":"CVE-2026-111579","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder < 1.58.4 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174217c5-0763-4ebb-876b-b4b9c15afa1b?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.4","to_inclusive":false,"patched_in":"1.58.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:59Z"},{"id":"wordfence:17422c79-494a-4c90-a48c-1aad9e0fa4c2","source":"wordfence","cve":"CVE-2016-10875","title":"WP Database Backup <= 4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17422c79-494a-4c90-a48c-1aad9e0fa4c2?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17428e0d-15ca-409e-a764-857d1cff201e","source":"wordfence","cve":"CVE-2026-16950","title":"Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17428e0d-15ca-409e-a764-857d1cff201e?source=api-prod","affected":[{"type":"plugin","slug":"product-shortlist","name":"Product Shortlist","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:00:26Z"},{"id":"wordfence:17452a29-bcef-451a-9893-a436ac5d3b80","source":"wordfence","cve":"CVE-2026-6675","title":"Responsive Blocks <= 2.2.0 - Unauthenticated Open Email Relay via REST API 'email_to' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17452a29-bcef-451a-9893-a436ac5d3b80?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-04-20T14:13:38Z","updated":"2026-04-21T02:25:39Z"},{"id":"wordfence:17453fa5-af14-477b-9b3d-b245511ad8ce","source":"wordfence","cve":"","title":"Auto Affiliate Links <= 6.4.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17453fa5-af14-477b-9b3d-b245511ad8ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.2.5","to_inclusive":true,"patched_in":"6.4.2.6"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17457ff2-917d-4cc4-8c5e-c80cd320cc90","source":"wordfence","cve":"CVE-2024-9521","title":"SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17457ff2-917d-4cc4-8c5e-c80cd320cc90?source=api-prod","affected":[{"type":"plugin","slug":"seo-manager","name":"SEO Manager","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:00Z"},{"id":"wordfence:1746da3b-397d-4027-b76d-4c57fadf32c4","source":"wordfence","cve":"CVE-2015-5609","title":"Image Export < 1.1.1 - Path Traversal","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1746da3b-397d-4027-b76d-4c57fadf32c4?source=api-prod","affected":[{"type":"plugin","slug":"image-export","name":"Image Export","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:174b9b5a-82a3-4ee4-b926-edb27e38652a","source":"wordfence","cve":"CVE-2026-2687","title":"Reading progressbar < 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174b9b5a-82a3-4ee4-b926-edb27e38652a?source=api-prod","affected":[{"type":"plugin","slug":"reading-progress-bar","name":"Reading progressbar","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T14:56:41Z"},{"id":"wordfence:174bcee9-cb2d-4181-8168-df5d28de8484","source":"wordfence","cve":"CVE-2025-32685","title":"WP Inquiries <= 0.2.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174bcee9-cb2d-4181-8168-df5d28de8484?source=api-prod","affected":[{"type":"plugin","slug":"wp-inquiries","name":"WP Inquiries","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:44:58Z"},{"id":"wordfence:174c4050-8eed-4641-85d2-4b66702e03a6","source":"wordfence","cve":"CVE-2019-12346","title":"SAML Single Sign On \u2013 SAML SSO Login < 4.8.73 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174c4050-8eed-4641-85d2-4b66702e03a6?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"4.8.73","to_inclusive":false,"patched_in":"4.8.73"}],"published":"2019-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:174e2bf3-2531-4a53-ade6-3df7e976ed29","source":"wordfence","cve":"CVE-2023-35090","title":"MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174e2bf3-2531-4a53-ade6-3df7e976ed29?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:174e6344-3919-4c73-8810-33de379ff463","source":"wordfence","cve":"","title":"LayerSlider <= 6.2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174e6344-3919-4c73-8810-33de379ff463?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2017-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:174eae70-15d7-4772-8fcd-dc4c0fca5b7d","source":"wordfence","cve":"CVE-2022-2435","title":"AnyMind Widget <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/174eae70-15d7-4772-8fcd-dc4c0fca5b7d?source=api-prod","affected":[{"type":"plugin","slug":"anymind-widget","name":"AnyMind Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17508063-3cd7-4b61-b7be-23a71b75f6a2","source":"wordfence","cve":"CVE-2024-4334","title":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17508063-3cd7-4b61-b7be-23a71b75f6a2?source=api-prod","affected":[{"type":"plugin","slug":"supreme-modules-for-divi","name":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:51:49Z"},{"id":"wordfence:1753ce91-762e-4fb7-a164-ee5bc9dcd323","source":"wordfence","cve":"CVE-2026-10823","title":"YMC Smart Filter <= 3.11.2 - Unauthenticated Private/Draft Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1753ce91-762e-4fb7-a164-ee5bc9dcd323?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2026-06-05T00:00:00Z","updated":"2026-08-21T13:35:24Z"},{"id":"wordfence:1754293e-ed27-4b5e-92f3-aea23127e0bc","source":"wordfence","cve":"CVE-2026-66438","title":"Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1754293e-ed27-4b5e-92f3-aea23127e0bc?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:11:03Z"},{"id":"wordfence:1754cced-d3e4-40af-b0e9-9089a92db3dc","source":"wordfence","cve":"CVE-2024-3822","title":"Base64 Encoder/Decoder <= 0.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1754cced-d3e4-40af-b0e9-9089a92db3dc?source=api-prod","affected":[{"type":"plugin","slug":"base64-encoderdecoder","name":"Base64 Encoder/Decoder","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:15:25Z"},{"id":"wordfence:175a69da-c47a-40f3-98c7-7cfcdf98f9f6","source":"wordfence","cve":"CVE-2024-10046","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175a69da-c47a-40f3-98c7-7cfcdf98f9f6?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2024-12-06T12:22:34Z","updated":"2024-12-07T01:45:49Z"},{"id":"wordfence:175b64d3-0abd-4a65-b419-d6248a7deb2f","source":"wordfence","cve":"CVE-2021-24891","title":"Elementor Website Builder <= 3.4.7 - DOM-based Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175b64d3-0abd-4a65-b419-d6248a7deb2f?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"0.1.0","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2021-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:175cb977-dcba-429f-814c-6de078e23472","source":"wordfence","cve":"CVE-2024-4205","title":"Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175cb977-dcba-429f-814c-6de078e23472?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.31","to_inclusive":true,"patched_in":"4.10.32"}],"published":"2024-05-30T00:00:00Z","updated":"2024-05-31T05:31:57Z"},{"id":"wordfence:175cf134-ece5-4c31-80e5-f3ac62fc20bd","source":"wordfence","cve":"CVE-2024-54350","title":"hmd <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175cf134-ece5-4c31-80e5-f3ac62fc20bd?source=api-prod","affected":[{"type":"theme","slug":"hmd","name":"hmd","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:59:03Z"},{"id":"wordfence:175d0550-3489-4601-8819-a30511544773","source":"wordfence","cve":"CVE-2025-46463","title":"Mailing Group Listserv <= 3.0.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175d0550-3489-4601-8819-a30511544773?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailing-group","name":"Mailing Group Listserv","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:09:36Z"},{"id":"wordfence:175d1830-2ece-40f6-b862-cb853dae96f5","source":"wordfence","cve":"CVE-2025-30837","title":"WooCommerce Fattureincloud <= 2.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175d1830-2ece-40f6-b862-cb853dae96f5?source=api-prod","affected":[{"type":"plugin","slug":"woo-fattureincloud","name":"WFatture for WooCommerce Fattureincloud","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:53:25Z"},{"id":"wordfence:175d4508-d638-4153-bd0d-30f0e50ba774","source":"wordfence","cve":"CVE-2025-50020","title":"RDFa Breadcrumb <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175d4508-d638-4153-bd0d-30f0e50ba774?source=api-prod","affected":[{"type":"plugin","slug":"rdfa-breadcrumb","name":"RDFa Breadcrumb","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:48:52Z"},{"id":"wordfence:175d8dc0-fc12-464b-b651-50a060851eb2","source":"wordfence","cve":"","title":"Trust Payments Gateway (3DS2) <= 1.2.0 -  Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175d8dc0-fc12-464b-b651-50a060851eb2?source=api-prod","affected":[{"type":"plugin","slug":"trust-payments-gateway-3ds2","name":"Trust Payments Gateway for WooCommerce (JavaScript Library)","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:175dd04d-ce06-45a0-8cfe-14498e2f9198","source":"wordfence","cve":"CVE-2024-0983","title":"ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175dd04d-ce06-45a0-8cfe-14498e2f9198?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:35:55Z"},{"id":"wordfence:175e08ce-aec2-427a-90e0-f955711d58b2","source":"wordfence","cve":"CVE-2024-1803","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175e08ce-aec2-427a-90e0-f955711d58b2?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T12:43:28Z"},{"id":"wordfence:175eba7e-454b-4ba3-bbb5-22bd56734f5c","source":"wordfence","cve":"CVE-2022-1751","title":"Skitter Slideshow <= 2.5.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175eba7e-454b-4ba3-bbb5-22bd56734f5c?source=api-prod","affected":[{"type":"plugin","slug":"wp-skitter-slideshow","name":"Skitter Slideshow","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2022-06-07T00:00:00Z","updated":"2024-08-17T07:34:18Z"},{"id":"wordfence:175fe7f4-ac92-4c52-9889-47635c21cd9b","source":"wordfence","cve":"CVE-2024-12607","title":"School Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/175fe7f4-ac92-4c52-9889-47635c21cd9b?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":"93.0.0"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:21Z"},{"id":"wordfence:1760fe6e-8153-4479-ae32-2e2f0fa54e12","source":"wordfence","cve":"CVE-2025-14143","title":"Ayo Shortcodes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1760fe6e-8153-4479-ae32-2e2f0fa54e12?source=api-prod","affected":[{"type":"plugin","slug":"ayo-shortcodes","name":"Ayo Shortcodes","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:29:48Z","updated":"2025-12-12T03:20:40Z"},{"id":"wordfence:17621978-cff5-4e63-bf6e-f1349da74730","source":"wordfence","cve":"CVE-2026-11880","title":"Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17621978-cff5-4e63-bf6e-f1349da74730?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T14:00:06Z"},{"id":"wordfence:17641096-1c7f-43f7-90d6-14c368c95d72","source":"wordfence","cve":"CVE-2024-52411","title":"Advanced Personalization <= 1.1.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17641096-1c7f-43f7-90d6-14c368c95d72?source=api-prod","affected":[{"type":"plugin","slug":"personalization-by-flowcraft","name":"Advanced Personalization","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:26:29Z"},{"id":"wordfence:17646179-47ad-4846-a581-3e713df43c32","source":"wordfence","cve":"CVE-2016-5836","title":"WordPress Core < 4.5.3 - Denial of Service via oEmbed Protocol","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17646179-47ad-4846-a581-3e713df43c32?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1766727d-ba54-4b46-b362-415c14be027d","source":"wordfence","cve":"CVE-2024-11012","title":"Notibar \u2013 Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1766727d-ba54-4b46-b362-415c14be027d?source=api-prod","affected":[{"type":"plugin","slug":"notibar","name":"Notibar \u2013 Notification Bar for WordPress","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-12-12T20:33:37Z","updated":"2024-12-13T09:27:28Z"},{"id":"wordfence:1767776f-b130-4123-8a84-ce4a21248cff","source":"wordfence","cve":"CVE-2025-26994","title":"Zigaform \u2013 Price Calculator & Cost Estimation Form Builder Lite <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1767776f-b130-4123-8a84-ce4a21248cff?source=api-prod","affected":[{"type":"plugin","slug":"zigaform-calculator-cost-estimation-form-builder-lite","name":"Zigaform \u2013 Price Calculator & Cost Estimation Form Builder Lite","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:21:27Z"},{"id":"wordfence:176798cc-9f5f-4524-9172-8f0497e4fc11","source":"wordfence","cve":"CVE-2014-2040","title":"Media File Renamer < 1.9.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/176798cc-9f5f-4524-9172-8f0497e4fc11?source=api-prod","affected":[{"type":"plugin","slug":"media-file-renamer","name":"Media File Renamer: Rename Images & Files for SEO (AI-Powered)","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":false,"patched_in":"1.9.4"}],"published":"2014-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:176a01ae-0f67-4e4a-a9b7-d91cbae2b810","source":"wordfence","cve":"CVE-2025-24639","title":"Korea for WooCommerce <= 1.1.11 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/176a01ae-0f67-4e4a-a9b7-d91cbae2b810?source=api-prod","affected":[{"type":"plugin","slug":"korea-for-woocommerce","name":"Korea for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-24T16:08:05Z"},{"id":"wordfence:176a2200-db90-4a16-b8bc-da85471ff8d1","source":"wordfence","cve":"CVE-2025-32676","title":"Verowa Connect <= 3.0.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/176a2200-db90-4a16-b8bc-da85471ff8d1?source=api-prod","affected":[{"type":"plugin","slug":"verowa-connect","name":"Verowa Connect","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-17T14:18:04Z"},{"id":"wordfence:176b9fe6-e025-45c4-83ac-4a782c25e041","source":"wordfence","cve":"CVE-2026-25013","title":"Phox Hosting <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/176b9fe6-e025-45c4-83ac-4a782c25e041?source=api-prod","affected":[{"type":"plugin","slug":"phox-host","name":"Phox - Hosting WordPress & WHMCS Theme","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:35:06Z"},{"id":"wordfence:177236a2-97bf-4ab9-9a8f-6d4f004bb74b","source":"wordfence","cve":"CVE-2026-62010","title":"Avventure <= 1.1.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177236a2-97bf-4ab9-9a8f-6d4f004bb74b?source=api-prod","affected":[{"type":"theme","slug":"avventure","name":"Avventure","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:37:17Z"},{"id":"wordfence:177340de-d488-4896-a78c-7b5cce2371b4","source":"wordfence","cve":"CVE-2026-32576","title":"Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177340de-d488-4896-a78c-7b5cce2371b4?source=api-prod","affected":[{"type":"plugin","slug":"woorechnung","name":"Faktur Pro for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-10-04T08:26:50Z","updated":"2026-10-28T21:15:59Z"},{"id":"wordfence:17735732-a6c4-4d84-8b8c-c1730b887e8f","source":"wordfence","cve":"CVE-2025-47670","title":"WordPress Social Login and Register <= 7.6.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17735732-a6c4-4d84-8b8c-c1730b887e8f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.6.10","to_inclusive":true,"patched_in":"7.7.0"}],"published":"2025-05-21T00:00:00Z","updated":"2025-09-29T16:10:57Z"},{"id":"wordfence:1774b9b6-b98b-410c-98eb-326eda53adca","source":"wordfence","cve":"CVE-2013-5098","title":"Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1774b9b6-b98b-410c-98eb-326eda53adca?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"3.3.6.2","to_inclusive":false,"patched_in":"3.3.6.2"}],"published":"2013-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1775a56e-3590-499e-89b6-79d69d80fa0e","source":"wordfence","cve":"CVE-2015-9431","title":"qTranslate X < 3.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1775a56e-3590-499e-89b6-79d69d80fa0e?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-x","name":"qTranslate X","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":false,"patched_in":"3.4.4"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1777d037-d72d-44a6-946a-a97e20bd2839","source":"wordfence","cve":"CVE-2026-81200","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.42 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1777d037-d72d-44a6-946a-a97e20bd2839?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.42","to_inclusive":false,"patched_in":"3.7.42"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:48:28Z"},{"id":"wordfence:177900d6-c52e-4ac4-a74d-412e453f9d05","source":"wordfence","cve":"CVE-2025-12416","title":"Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177900d6-c52e-4ac4-a74d-412e453f9d05?source=api-prod","affected":[{"type":"plugin","slug":"pagerank-tools","name":"Pagerank tools","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:37:53Z","updated":"2025-11-04T04:27:13Z"},{"id":"wordfence:177929c5-d32f-4f0a-afc1-6d4a7091dfd5","source":"wordfence","cve":"CVE-2024-34556","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177929c5-d32f-4f0a-afc1-6d4a7091dfd5?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:23:17Z"},{"id":"wordfence:17792afd-c40c-44cb-844e-86020adfc9eb","source":"wordfence","cve":"CVE-2025-26750","title":"Vitepos \u2013 Point of sale (POS) <= 3.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17792afd-c40c-44cb-844e-86020adfc9eb?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-24T16:01:55Z"},{"id":"wordfence:17798563-851b-4f31-aa38-919ec629da94","source":"wordfence","cve":"CVE-2025-31893","title":"Botnet Attack Blocker <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17798563-851b-4f31-aa38-919ec629da94?source=api-prod","affected":[{"type":"plugin","slug":"botnet-attack-blocker","name":"Botnet Attack Blocker","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T18:43:19Z"},{"id":"wordfence:177a2bda-6c40-4ff6-a53f-e6b2a8408d8a","source":"wordfence","cve":"CVE-2024-27194","title":"Fontific | Google Fonts <= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all","severity":"high","cvss":8.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177a2bda-6c40-4ff6-a53f-e6b2a8408d8a?source=api-prod","affected":[{"type":"plugin","slug":"fontific","name":"Fontific | Google Fonts","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T19:13:00Z"},{"id":"wordfence:177aca03-683b-48e1-911f-c966b171626b","source":"wordfence","cve":"CVE-2026-103996","title":"If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177aca03-683b-48e1-911f-c966b171626b?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-10-27T18:30:39Z","updated":"2026-10-28T06:45:07Z"},{"id":"wordfence:177f7111-b487-4e52-9106-54e0095a5dd4","source":"wordfence","cve":"CVE-2024-30548","title":"underConstruction <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177f7111-b487-4e52-9106-54e0095a5dd4?source=api-prod","affected":[{"type":"plugin","slug":"underconstruction","name":"underConstruction","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:08:31Z"},{"id":"wordfence:177ffbef-b029-4f41-a2f7-a848b5275cc2","source":"wordfence","cve":"CVE-2025-64208","title":"Jannah - Extensions <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/177ffbef-b029-4f41-a2f7-a848b5275cc2?source=api-prod","affected":[{"type":"plugin","slug":"jannah-extensions","name":"Jannah - Extensions","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-04T14:54:57Z"},{"id":"wordfence:1780e19e-5836-4601-a2e8-a758b245f14f","source":"wordfence","cve":"CVE-2025-23767","title":"Marmoset Viewer <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1780e19e-5836-4601-a2e8-a758b245f14f?source=api-prod","affected":[{"type":"plugin","slug":"marmoset-viewer","name":"Marmoset Viewer","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T17:00:00Z"},{"id":"wordfence:17872fe4-b566-44ca-8218-3677fb75cb1c","source":"wordfence","cve":"CVE-2024-13780","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17872fe4-b566-44ca-8218-3677fb75cb1c?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:44Z"},{"id":"wordfence:178911d9-0552-4f44-aae5-06fc9734cfac","source":"wordfence","cve":"CVE-2024-38735","title":"Event post <= 5.9.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/178911d9-0552-4f44-aae5-06fc9734cfac?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.5","to_inclusive":true,"patched_in":"5.9.6"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-07T13:23:03Z"},{"id":"wordfence:1789b78a-4733-40b9-b28f-f63aeb4c0f0b","source":"wordfence","cve":"CVE-2025-47577","title":"TI WooCommerce Wishlist <= 2.9.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1789b78a-4733-40b9-b28f-f63aeb4c0f0b?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-05T18:49:04Z"},{"id":"wordfence:178b2493-dee3-47ef-9e61-c1d832c33518","source":"wordfence","cve":"CVE-2025-58879","title":"Festy <= 1.13.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/178b2493-dee3-47ef-9e61-c1d832c33518?source=api-prod","affected":[{"type":"theme","slug":"festy","name":"Festy - Theme Park, Circus & Festival WordPress Theme","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:29:27Z"},{"id":"wordfence:178e2537-e900-4264-9b29-1bb5bac36f48","source":"wordfence","cve":"CVE-2026-10207","title":"PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/178e2537-e900-4264-9b29-1bb5bac36f48?source=api-prod","affected":[{"type":"plugin","slug":"question-answer","name":"PickPlugins Question Answer","from":"*","from_inclusive":true,"to":"1.2.73","to_inclusive":true,"patched_in":""}],"published":"2026-07-27T21:29:31Z","updated":"2026-07-28T09:30:15Z"},{"id":"wordfence:17906039-0130-4e24-b932-1ba19d3d58ff","source":"wordfence","cve":"CVE-2024-32708","title":"Maintenance Mode by helderk <= 3.0.1 - Unauthenticated IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17906039-0130-4e24-b932-1ba19d3d58ff?source=api-prod","affected":[{"type":"plugin","slug":"hkdev-maintenance-mode","name":"Maintenance Mode","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:37:32Z"},{"id":"wordfence:179094a4-a243-4ce7-8a8d-aa439fe5c223","source":"wordfence","cve":"CVE-2026-81289","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/179094a4-a243-4ce7-8a8d-aa439fe5c223?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.13.1","to_inclusive":true,"patched_in":"5.14"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T13:26:36Z"},{"id":"wordfence:1793922f-c03a-4b66-a2e0-5729f0d4c4d2","source":"wordfence","cve":"CVE-2024-27969","title":"Free Downloads WooCommerce <= 3.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1793922f-c03a-4b66-a2e0-5729f0d4c4d2?source=api-prod","affected":[{"type":"plugin","slug":"download-now-for-woocommerce","name":"Free Downloads WooCommerce","from":"*","from_inclusive":true,"to":"3.5.8.2","to_inclusive":true,"patched_in":"3.5.8.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T19:25:20Z"},{"id":"wordfence:1793f086-e9b9-4616-a26f-84dc3eb9578b","source":"wordfence","cve":"CVE-2026-121579","title":"Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1793f086-e9b9-4616-a26f-84dc3eb9578b?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:04:08Z"},{"id":"wordfence:17941fbb-c5da-4f5c-a617-3792eb4ef395","source":"wordfence","cve":"CVE-2024-0869","title":"Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17941fbb-c5da-4f5c-a617-3792eb4ef395?source=api-prod","affected":[{"type":"plugin","slug":"instant-images","name":"Instant Images \u2013 One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-01-29T00:00:00Z","updated":"2024-05-01T15:29:04Z"},{"id":"wordfence:1794ef89-3949-44b4-9d42-80cd827ef730","source":"wordfence","cve":"CVE-2025-7648","title":"Ruven Themes: Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1794ef89-3949-44b4-9d42-80cd827ef730?source=api-prod","affected":[{"type":"plugin","slug":"ruven-themes-shortcodes","name":"Ruven Themes: Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:20:58Z","updated":"2025-07-18T04:22:59Z"},{"id":"wordfence:17951f68-8481-477b-a940-cce637f6ec54","source":"wordfence","cve":"CVE-2025-7049","title":"WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17951f68-8481-477b-a940-cce637f6ec54?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-09T17:42:53Z","updated":"2025-09-10T06:38:46Z"},{"id":"wordfence:179751c8-a634-4a2e-be29-46be0aad79c8","source":"wordfence","cve":"CVE-2022-29417","title":"ShortPixel Adaptive Images <= 3.3.1 - Subscriber+ Arbitrary Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/179751c8-a634-4a2e-be29-46be0aad79c8?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2022-04-25T10:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:179821bb-5b0d-4c41-a410-db433987a870","source":"wordfence","cve":"CVE-2021-24450","title":"ProfilePress <= 3.1.7 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/179821bb-5b0d-4c41-a410-db433987a870?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":false,"patched_in":"3.1.8"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17988a66-5b48-4f57-96f8-74e539bc875e","source":"wordfence","cve":"CVE-2024-10016","title":"File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17988a66-5b48-4f57-96f8-74e539bc875e?source=api-prod","affected":[{"type":"plugin","slug":"file-upload-types","name":"File Upload Types by WPForms","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-10-24T20:07:47Z","updated":"2024-10-25T19:01:23Z"},{"id":"wordfence:179c4920-5a03-4cf4-9e77-a814c3004769","source":"wordfence","cve":"CVE-2015-9438","title":"Display Widgets <= 2.03 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/179c4920-5a03-4cf4-9e77-a814c3004769?source=api-prod","affected":[{"type":"plugin","slug":"display-widgets","name":"Display Widgets","from":"*","from_inclusive":true,"to":"2.03","to_inclusive":true,"patched_in":"2.04"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:179eb680-e8d8-4918-96e3-e67217771c29","source":"wordfence","cve":"CVE-2025-3794","title":"WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.5.1"}],"published":"2025-05-09T10:00:45Z","updated":"2025-05-09T22:22:12Z"},{"id":"wordfence:17a0d8b3-e54d-4af4-8915-e8b192cc138b","source":"wordfence","cve":"CVE-2024-11881","title":"Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17a0d8b3-e54d-4af4-8915-e8b192cc138b?source=api-prod","affected":[{"type":"plugin","slug":"easy-waveform-player","name":"Easy Waveform Player","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-12-17T14:17:45Z","updated":"2024-12-18T02:26:08Z"},{"id":"wordfence:17a4bd5c-0cd3-46e4-b6ee-edf87f0e92ca","source":"wordfence","cve":"CVE-2023-32520","title":"WCP Contact Form <= 3.1.0 - Missing Authorization via downloadCsv","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17a4bd5c-0cd3-46e4-b6ee-edf87f0e92ca?source=api-prod","affected":[{"type":"plugin","slug":"wcp-contact-form","name":"WCP Contact Form","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17a787da-5630-42ec-b5b0-47435db765a7","source":"wordfence","cve":"CVE-2023-2761","title":"User Activity Log <= 1.6.2 - Authenticated(Administrator+) SQL Injection via txtsearch","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17a787da-5630-42ec-b5b0-47435db765a7?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17ab4800-0afd-4c39-970a-bd8dcc6a8b93","source":"wordfence","cve":"CVE-2023-34030","title":"Complianz <= 6.4.5 (Premium <= 6.4.7) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ab4800-0afd-4c39-970a-bd8dcc6a8b93?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr-premium","name":"Complianz Premium \u2013 GDPR/CCPA Cookie Consent","from":"*","from_inclusive":true,"to":"6.4.7","to_inclusive":true,"patched_in":"6.4.8"},{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17acbf24-b0ae-42c8-af8f-17e82213507d","source":"wordfence","cve":"CVE-2024-11434","title":"WP \u2013 Bulk SMS \u2013 by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17acbf24-b0ae-42c8-af8f-17e82213507d?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulk-sms","name":"WP \u2013 Bulk SMS \u2013 by SMS.to","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:18:23Z","updated":"2025-01-07T04:21:56Z"},{"id":"wordfence:17ae3f22-6426-48f7-93e6-c0ad515b329a","source":"wordfence","cve":"CVE-2024-8549","title":"Simple Calendar \u2013 Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ae3f22-6426-48f7-93e6-c0ad515b329a?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-09-24T12:31:06Z","updated":"2024-09-25T02:05:03Z"},{"id":"wordfence:17b0366c-f170-420d-b0d5-5c2f9f9e1cca","source":"wordfence","cve":"CVE-2024-6846","title":"Chatbot with ChatGPT  <= 2.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17b0366c-f170-420d-b0d5-5c2f9f9e1cca?source=api-prod","affected":[{"type":"plugin","slug":"smartsearchwp","name":"AI Chatbot & Semantic Search: ChatGPT Answers From Your Content","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-08-14T00:00:00Z","updated":"2024-09-12T15:56:53Z"},{"id":"wordfence:17b16fa4-9ea7-4bc5-accb-8249ed7280aa","source":"wordfence","cve":"CVE-2025-58218","title":"Small Package Quotes \u2013 USPS Edition <= 1.3.9 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17b16fa4-9ea7-4bc5-accb-8249ed7280aa?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-usps-edition","name":"Small Package Quotes \u2013 USPS Edition","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T21:03:33Z"},{"id":"wordfence:17b20df5-4adf-47ce-bddf-2ec0b9499de8","source":"wordfence","cve":"CVE-2023-6897","title":"EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17b20df5-4adf-47ce-bddf-2ec0b9499de8?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2024-04-17T00:00:00Z","updated":"2024-07-29T21:35:55Z"},{"id":"wordfence:17b6caa3-3566-48d4-988a-5a0f22b2a3f2","source":"wordfence","cve":"CVE-2026-68567","title":"EasyTest \u2013 Simplify A/B Testing <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17b6caa3-3566-48d4-988a-5a0f22b2a3f2?source=api-prod","affected":[{"type":"plugin","slug":"convertpro","name":"EasyTest \u2013 Simplify A/B Testing","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:23:13Z"},{"id":"wordfence:17b8da07-1cfd-46d3-92fd-5d2d70c8c470","source":"wordfence","cve":"CVE-2025-27269","title":".htaccess Login block <= 0.9a - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17b8da07-1cfd-46d3-92fd-5d2d70c8c470?source=api-prod","affected":[{"type":"plugin","slug":"htaccess-login-block","name":".htaccess Login block","from":"*","from_inclusive":true,"to":"0.9a","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:36:25Z"},{"id":"wordfence:17bc3a9f-2bf9-44e3-81ef-bfa932085da9","source":"wordfence","cve":"CVE-2023-5711","title":"System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17bc3a9f-2bf9-44e3-81ef-bfa932085da9?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-12-06T00:00:00Z","updated":"2024-02-19T15:28:42Z"},{"id":"wordfence:17bcf47f-4fca-4e16-a097-ed8e0f3420d0","source":"wordfence","cve":"CVE-2025-23799","title":".TUBE Video Curator <= 1.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17bcf47f-4fca-4e16-a097-ed8e0f3420d0?source=api-prod","affected":[{"type":"plugin","slug":"tube-video-curator","name":".TUBE Video Curator","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:14:26Z"},{"id":"wordfence:17bdb184-5e2c-44dc-83db-c315d62851fe","source":"wordfence","cve":"CVE-2026-103067","title":"Memberful \u2013 Membership Plugin <= 1.81.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17bdb184-5e2c-44dc-83db-c315d62851fe?source=api-prod","affected":[{"type":"plugin","slug":"memberful-wp","name":"Memberful \u2013 Membership Plugin","from":"*","from_inclusive":true,"to":"1.81.0","to_inclusive":true,"patched_in":"1.81.1"}],"published":"2026-10-01T12:17:00Z","updated":"2026-10-08T23:00:24Z"},{"id":"wordfence:17c06c83-6707-4233-a1c3-ef4cdcf93982","source":"wordfence","cve":"CVE-2024-8490","title":"PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17c06c83-6707-4233-a1c3-ef4cdcf93982?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-17T07:33:31Z"},{"id":"wordfence:17c1de7b-5178-4fbe-a515-169de4323ae7","source":"wordfence","cve":"CVE-2025-1065","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17c1de7b-5178-4fbe-a515-169de4323ae7?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.11.8","to_inclusive":true,"patched_in":"3.11.9"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T05:27:00Z"},{"id":"wordfence:17c6a91c-e2a6-4f17-b145-145e9e7a0079","source":"wordfence","cve":"CVE-2023-46147","title":"Themify Ultra <= 7.3.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17c6a91c-e2a6-4f17-b145-145e9e7a0079?source=api-prod","affected":[{"type":"theme","slug":"themify-ultra","name":"Themify Ultra","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-04-22T14:15:32Z"},{"id":"wordfence:17c7c61d-c110-448e-ad8a-bc1c00393524","source":"wordfence","cve":"CVE-2023-1921","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17c7c61d-c110-448e-ad8a-bc1c00393524?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17cb080f-83f5-4917-af76-bfcc741ae053","source":"wordfence","cve":"CVE-2024-29125","title":"Coupon Affiliates <= 5.12.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cb080f-83f5-4917-af76-bfcc741ae053?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.12.7","to_inclusive":true,"patched_in":"5.12.8"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T21:01:49Z"},{"id":"wordfence:17cb7420-b4e1-4959-beae-d3c0a8c4b1ff","source":"wordfence","cve":"","title":"VR Calendar <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cb7420-b4e1-4959-beae-d3c0a8c4b1ff?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17cbcf67-f10d-41bc-acf7-98e5d99b50af","source":"wordfence","cve":"CVE-2024-24832","title":"EventPrime <= 3.3.9 - Improper Input Validation via save_event_booking","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cbcf67-f10d-41bc-acf7-98e5d99b50af?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:05:49Z"},{"id":"wordfence:17cc137e-da04-42ea-9336-24c4e0b9264a","source":"wordfence","cve":"CVE-2024-52373","title":"Devexhub Gallery <= 2.0.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cc137e-da04-42ea-9336-24c4e0b9264a?source=api-prod","affected":[{"type":"plugin","slug":"devexhub-gallery","name":"Devexhub Gallery","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:40:31Z"},{"id":"wordfence:17cc2c82-7234-4350-92dc-9d064d68ad7a","source":"wordfence","cve":"CVE-2026-103083","title":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cc2c82-7234-4350-92dc-9d064d68ad7a?source=api-prod","affected":[{"type":"plugin","slug":"elex-bulk-edit-products-prices-attributes-for-woocommerce-basic","name":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-10-15T18:00:00Z","updated":"2026-10-23T18:16:26Z"},{"id":"wordfence:17ccf3f5-ac71-4827-bf11-9a5199f8752e","source":"wordfence","cve":"","title":"AJAX Random Posts <= 0.3.3 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ccf3f5-ac71-4827-bf11-9a5199f8752e?source=api-prod","affected":[{"type":"plugin","slug":"ajax-random-posts","name":"AJAX Random Posts","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2017-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17ce0f19-04be-4e76-a332-e153d4703534","source":"wordfence","cve":"CVE-2024-55975","title":"Dr Affiliate <= 1.2.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ce0f19-04be-4e76-a332-e153d4703534?source=api-prod","affected":[{"type":"plugin","slug":"dr-affiliate","name":"Dr Affiliate","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:03:19Z"},{"id":"wordfence:17cffc76-7b41-4dc0-90cc-695b6f5474ce","source":"wordfence","cve":"CVE-2024-49276","title":"Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17cffc76-7b41-4dc0-90cc-695b6f5474ce?source=api-prod","affected":[{"type":"plugin","slug":"clio-grow-form","name":"Clio Grow Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-24T16:38:41Z"},{"id":"wordfence:17d11c96-fd3c-478e-9b0e-ba58116ee27f","source":"wordfence","cve":"CVE-2021-25022","title":"UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d11c96-fd3c-478e-9b0e-ba58116ee27f?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.16.66","to_inclusive":false,"patched_in":"1.16.66"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17d12a35-35a1-4f7b-aa03-33ddafe17f5b","source":"wordfence","cve":"CVE-2023-28659","title":"Waiting: One-click countdowns <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'pbc_down[meta][id]'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d12a35-35a1-4f7b-aa03-33ddafe17f5b?source=api-prod","affected":[{"type":"plugin","slug":"waiting","name":"Waiting: One-click countdowns","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17d1b133-99ec-4dfa-83d4-189606989cb6","source":"wordfence","cve":"CVE-2025-58835","title":"Bonus for Woo <= 7.6.6 - Insufficient Input Validation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d1b133-99ec-4dfa-83d4-189606989cb6?source=api-prod","affected":[{"type":"plugin","slug":"bonus-for-woo","name":"Bonus for Woo","from":"*","from_inclusive":true,"to":"7.6.6","to_inclusive":true,"patched_in":"7.6.7"}],"published":"2025-09-05T00:00:00Z","updated":"2026-03-17T21:25:31Z"},{"id":"wordfence:17d295d6-c594-4342-8be7-37f472a6310c","source":"wordfence","cve":"CVE-2025-62041","title":"TheGem (Elementor) <= 5.10.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d295d6-c594-4342-8be7-37f472a6310c?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"5.10.5.1","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-12T00:00:00Z","updated":"2025-10-29T15:18:22Z"},{"id":"wordfence:17d3a2e4-d6f3-4302-91b0-2408ccd8958a","source":"wordfence","cve":"CVE-2014-7182","title":"WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d3a2e4-d6f3-4302-91b0-2408ccd8958a?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"6.0.27","to_inclusive":false,"patched_in":"6.0.27"}],"published":"2014-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17d4002d-3e87-46a7-9be6-c36e40c31c4a","source":"wordfence","cve":"CVE-2021-24217","title":"Meta pixel for WordPress <= 2.2.2 - PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d4002d-3e87-46a7-9be6-c36e40c31c4a?source=api-prod","affected":[{"type":"plugin","slug":"official-facebook-pixel","name":"Meta pixel for WordPress","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2021-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17d5253c-5000-40c7-a7fd-f75d4badfb5e","source":"wordfence","cve":"CVE-2025-12177","title":"Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key","severity":"medium","cvss":5.3,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d5253c-5000-40c7-a7fd-f75d4badfb5e?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.30","to_inclusive":true,"patched_in":"3.3.31"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:46Z"},{"id":"wordfence:17d59705-7bd6-4b61-a849-867d76316ca3","source":"wordfence","cve":"CVE-2024-51601","title":"Website price calculator <= 4.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d59705-7bd6-4b61-a849-867d76316ca3?source=api-prod","affected":[{"type":"plugin","slug":"price-calculator-to-your-website","name":"Website price calculator","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:36:39Z"},{"id":"wordfence:17d8e2e9-5e3f-433b-be1a-6ea765eba547","source":"wordfence","cve":"CVE-2024-6328","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17d8e2e9-5e3f-433b-be1a-6ea765eba547?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.14.7","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-12T10:59:56Z"},{"id":"wordfence:17dbfb82-e380-464a-bfaf-2d0f6bf07f25","source":"wordfence","cve":"CVE-2023-5308","title":"Podcast Subscribe Buttons <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dbfb82-e380-464a-bfaf-2d0f6bf07f25?source=api-prod","affected":[{"type":"plugin","slug":"podcast-subscribe-buttons","name":"Podcast Subscribe Buttons","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17dc6988-bbbe-4997-b5f1-230f8003138e","source":"wordfence","cve":"CVE-2025-26999","title":"ProfileGrid  <= 5.9.4.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dc6988-bbbe-4997-b5f1-230f8003138e?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.3","to_inclusive":true,"patched_in":"5.9.4.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:34:54Z"},{"id":"wordfence:17dcacaf-0e2a-4bef-b944-fb7e43d25777","source":"wordfence","cve":"CVE-2024-3495","title":"Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dcacaf-0e2a-4bef-b944-fb7e43d25777?source=api-prod","affected":[{"type":"plugin","slug":"country-state-city-auto-dropdown","name":"Country State City Dropdown CF7","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-05-21T19:38:42Z","updated":"2024-05-22T08:31:22Z"},{"id":"wordfence:17dcb057-6fa6-488c-9d59-22dcdba3fd2f","source":"wordfence","cve":"CVE-2021-24152","title":"Popup Builder <= 3.73 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dcb057-6fa6-488c-9d59-22dcdba3fd2f?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"3.73","to_inclusive":true,"patched_in":"3.74"}],"published":"2021-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17dd0477-daa8-4c51-a40e-44fba62b2d7c","source":"wordfence","cve":"CVE-2025-31053","title":"KBx Pro Ultimate < 8.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dd0477-daa8-4c51-a40e-44fba62b2d7c?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase-helpdesk-pro","name":"KBx Pro Ultimate","from":"*","from_inclusive":true,"to":"8.0.5","to_inclusive":false,"patched_in":"8.0.5"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-24T22:25:42Z"},{"id":"wordfence:17dd97b6-a186-4351-b08b-1eff696e25b1","source":"wordfence","cve":"CVE-2021-4134","title":"Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17dd97b6-a186-4351-b08b-1eff696e25b1?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2022-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17de5b96-7a61-4f37-a921-6a023cc40812","source":"wordfence","cve":"CVE-2026-3423","title":"Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17de5b96-7a61-4f37-a921-6a023cc40812?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":true,"patched_in":"1.12.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T11:29:28Z"},{"id":"wordfence:17deea99-0f5b-4fac-9586-e84b772d9956","source":"wordfence","cve":"CVE-2026-80518","title":"Ultimate CSV Importer <= 9.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17deea99-0f5b-4fac-9586-e84b772d9956?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:54:40Z"},{"id":"wordfence:17e4376e-2b77-4c86-b962-ea4d7d8f534d","source":"wordfence","cve":"CVE-2021-24771","title":"Inspirational Quote Rotator <= 1.0.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17e4376e-2b77-4c86-b962-ea4d7d8f534d?source=api-prod","affected":[{"type":"plugin","slug":"inspirational-quote-rotator","name":"Inspirational Quote Rotator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17e6537a-37b6-4f13-8bf0-e47e54062979","source":"wordfence","cve":"CVE-2024-38679","title":"Animated Typed JS Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17e6537a-37b6-4f13-8bf0-e47e54062979?source=api-prod","affected":[{"type":"plugin","slug":"animated-typed-js-shortcode","name":"Animated Typed JS Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-30T20:26:55Z"},{"id":"wordfence:17e853b2-c7ab-478c-9c89-d8e3a42d1a42","source":"wordfence","cve":"CVE-2025-12976","title":"Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17e853b2-c7ab-478c-9c89-d8e3a42d1a42?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.2.2.1","to_inclusive":true,"patched_in":"7.2.3"}],"published":"2025-12-17T00:00:00Z","updated":"2025-12-18T07:20:46Z"},{"id":"wordfence:17e8a743-7985-4b28-b854-ac052a834f3a","source":"wordfence","cve":"CVE-2025-12087","title":"Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17e8a743-7985-4b28-b854-ac052a834f3a?source=api-prod","affected":[{"type":"plugin","slug":"aco-wishlist-for-woocommerce","name":"Wishlist and Save for later for Woocommerce","from":"*","from_inclusive":true,"to":"1.1.22","to_inclusive":true,"patched_in":"1.1.23"}],"published":"2025-11-11T15:47:17Z","updated":"2025-11-12T04:29:10Z"},{"id":"wordfence:17e95c94-0a63-494e-b4b0-823b9cd0f7d3","source":"wordfence","cve":"CVE-2026-93755","title":"Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17e95c94-0a63-494e-b4b0-823b9cd0f7d3?source=api-prod","affected":[{"type":"plugin","slug":"happyforms-upgrade","name":"Happyforms Pro","from":"*","from_inclusive":true,"to":"1.38.9","to_inclusive":true,"patched_in":"1.38.10"}],"published":"2026-11-06T21:54:47Z","updated":"2026-11-07T11:26:25Z"},{"id":"wordfence:17ecebfd-b07f-415f-892f-e069ab84031a","source":"wordfence","cve":"CVE-2024-10178","title":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ecebfd-b07f-415f-892f-e069ab84031a?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-12-04T16:20:44Z","updated":"2024-12-05T04:23:54Z"},{"id":"wordfence:17ed7349-c570-4a0a-903e-302328eef793","source":"wordfence","cve":"CVE-2026-94170","title":"Social Sharing Plugin \u2013 Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ed7349-c570-4a0a-903e-302328eef793?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.79","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:47:14Z"},{"id":"wordfence:17ee6e87-2534-4397-833e-e0a1cd5d947c","source":"wordfence","cve":"CVE-2025-68034","title":"CleverReach\u00ae WP <= 1.5.21 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ee6e87-2534-4397-833e-e0a1cd5d947c?source=api-prod","affected":[{"type":"plugin","slug":"cleverreach-wp","name":"CleverReach\u00ae WP","from":"*","from_inclusive":true,"to":"1.5.21","to_inclusive":true,"patched_in":"1.5.22"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-30T20:39:39Z"},{"id":"wordfence:17f0dc1b-af69-4bcc-9714-f6432cfca668","source":"wordfence","cve":"CVE-2025-46471","title":"WP Custom Post Popup <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f0dc1b-af69-4bcc-9714-f6432cfca668?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-popup","name":"WP Custom Post Popup","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:29:46Z"},{"id":"wordfence:17f118c5-c485-448b-8ab7-3f7fd44be583","source":"wordfence","cve":"CVE-2022-4750","title":"WP Responsive Testimonials Slider And Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f118c5-c485-448b-8ab7-3f7fd44be583?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-testimonials-slider-and-widget","name":"WP Responsive Testimonials Slider And Widget","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17f12e75-0bb6-48ed-9ba2-17caab268d61","source":"wordfence","cve":"CVE-2024-12597","title":"HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f12e75-0bb6-48ed-9ba2-17caab268d61?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T06:41:53Z"},{"id":"wordfence:17f17cae-f444-4fa1-9090-ec6ea267ef2e","source":"wordfence","cve":"CVE-2025-11891","title":"Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-538","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f17cae-f444-4fa1-9090-ec6ea267ef2e?source=api-prod","affected":[{"type":"plugin","slug":"shelf-planner","name":"Shelf Planner Inventory Management for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-11-10T15:14:22Z","updated":"2025-12-12T16:58:08Z"},{"id":"wordfence:17f2a0d5-6640-4ef9-a219-93a92571a5d3","source":"wordfence","cve":"CVE-2013-0286","title":"Pinboard <= 1.1.10 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f2a0d5-6640-4ef9-a219-93a92571a5d3?source=api-prod","affected":[{"type":"theme","slug":"pinboard","name":"Pinboard","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2013-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17f2b07d-82de-4e25-9b17-ef4a1132e6c0","source":"wordfence","cve":"CVE-2023-25472","title":"Podlove Podcast Publisher <= 3.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f2b07d-82de-4e25-9b17-ef4a1132e6c0?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17f40832-8ae5-443a-aa98-f0e61d1152cc","source":"wordfence","cve":"CVE-2024-13568","title":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f40832-8ae5-443a-aa98-f0e61d1152cc?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-02-28T15:27:49Z","updated":"2025-03-03T15:32:08Z"},{"id":"wordfence:17f411fb-364c-4652-a277-bdfee36325f5","source":"wordfence","cve":"CVE-2026-45216","title":"Smart Manager \u2013 Advanced WooCommerce Bulk Edit & Inventory Management <= 8.85.0 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f411fb-364c-4652-a277-bdfee36325f5?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.85.0","to_inclusive":true,"patched_in":"8.86.0"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T16:24:22Z"},{"id":"wordfence:17f4961c-394b-46dc-b228-14ce81c92009","source":"wordfence","cve":"CVE-2026-118046","title":"JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f4961c-394b-46dc-b228-14ce81c92009?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-11-06T13:58:40Z","updated":"2026-11-07T02:29:12Z"},{"id":"wordfence:17f4b7c7-0a4b-41e0-9e31-252a17fd40df","source":"wordfence","cve":"CVE-2026-85130","title":"WPLP Cookie Consent <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f4b7c7-0a4b-41e0-9e31-252a17fd40df?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:40:26Z"},{"id":"wordfence:17f4d448-d9d8-4bee-b216-42f9b77c30be","source":"wordfence","cve":"CVE-2026-54802","title":"SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f4d448-d9d8-4bee-b216-42f9b77c30be?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:23:10Z"},{"id":"wordfence:17f7be7f-f675-4c9f-a7b3-525a3c3c5775","source":"wordfence","cve":"CVE-2025-8464","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie","severity":"medium","cvss":5.3,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7be7f-f675-4c9f-a7b3-525a3c3c5775?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.0","to_inclusive":true,"patched_in":"1.3.9.1"}],"published":"2025-08-15T19:13:08Z","updated":"2025-08-16T07:25:29Z"},{"id":"wordfence:17f7c974-492d-4775-b602-bbec36d3bd8f","source":"wordfence","cve":"CVE-2025-58255","title":"Custom Post Type Images <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f7c974-492d-4775-b602-bbec36d3bd8f?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-types-image","name":"Custom Post Type Images","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:39:39Z"},{"id":"wordfence:17f85a52-7f55-4e11-8be3-f088eaad41b3","source":"wordfence","cve":"CVE-2021-24829","title":"Visitor Traffic Real Time Statistics <= 3.8 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f85a52-7f55-4e11-8be3-f088eaad41b3?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17f8e2a0-b23f-4706-8438-7a6573a29933","source":"wordfence","cve":"CVE-2022-36376","title":"Rank Math SEO <= 1.0.95 - Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17f8e2a0-b23f-4706-8438-7a6573a29933?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.95","to_inclusive":true,"patched_in":"1.0.95.1"}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17fa37ae-5683-4b5f-995f-934f469141a5","source":"wordfence","cve":"CVE-2022-2386","title":"Crowdsignal Dashboard \u2013 Polls, Surveys & more <= 3.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17fa37ae-5683-4b5f-995f-934f469141a5?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:17faa495-7758-49ec-8418-c5175f9615f2","source":"wordfence","cve":"CVE-2026-87959","title":"WPBot 8.7.2 - 8.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17faa495-7758-49ec-8418-c5175f9615f2?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"8.7.2","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":"8.7.6"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T20:13:22Z"},{"id":"wordfence:17fd14e7-503a-49e4-9344-5f8d51801eb3","source":"wordfence","cve":"CVE-2024-13791","title":"Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function","severity":"medium","cvss":4.9,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17fd14e7-503a-49e4-9344-5f8d51801eb3?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-02-13T22:19:23Z","updated":"2025-02-14T11:10:58Z"},{"id":"wordfence:17ffdd6d-3c6c-4f47-9f1c-a0f4c0f5fcdf","source":"wordfence","cve":"CVE-2024-29138","title":"Restrict User Access \u2013 Membership Plugin with Force <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/17ffdd6d-3c6c-4f47-9f1c-a0f4c0f5fcdf?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:57:22Z"},{"id":"wordfence:18003103-3a14-4cbc-8bed-87a8ab050308","source":"wordfence","cve":"CVE-2025-7725","title":"Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery \u2013 Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18003103-3a14-4cbc-8bed-87a8ab050308?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"26.1.0","to_inclusive":true,"patched_in":"26.1.1"}],"published":"2025-07-31T16:20:34Z","updated":"2025-08-01T04:24:29Z"},{"id":"wordfence:1801fd3e-d56f-4540-9700-9e9de8b465e1","source":"wordfence","cve":"CVE-2026-4373","title":"JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field","severity":"high","cvss":7.5,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.5.6.2","to_inclusive":true,"patched_in":"3.5.6.3"}],"published":"2026-03-20T18:28:08Z","updated":"2026-03-21T06:45:14Z"},{"id":"wordfence:1802a6f2-83d2-4f6d-a64b-0d9f4b4b12f7","source":"wordfence","cve":"CVE-2026-66632","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1802a6f2-83d2-4f6d-a64b-0d9f4b4b12f7?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.42.1","to_inclusive":true,"patched_in":"1.42.3"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:51:07Z"},{"id":"wordfence:18062c98-862c-4f53-9cfd-6ff4970e933a","source":"wordfence","cve":"CVE-2026-105059","title":"WP Comment Cleaner \u2013 Delete All Comments, Disable Comments, Bulk Delete & Remove Comments <= 7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18062c98-862c-4f53-9cfd-6ff4970e933a?source=api-prod","affected":[{"type":"plugin","slug":"delete-all-comments-of-website","name":"WP Comment Cleaner \u2013 Delete All Comments, Disable Comments, Bulk Delete & Remove Comments","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.2"}],"published":"2026-10-05T09:50:19Z","updated":"2026-10-08T23:14:17Z"},{"id":"wordfence:180711f3-1a3b-4b10-9046-e63c0e1b9ab5","source":"wordfence","cve":"CVE-2022-36373","title":"MP3 jPlayer <= 2.7.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/180711f3-1a3b-4b10-9046-e63c0e1b9ab5?source=api-prod","affected":[{"type":"plugin","slug":"mp3-jplayer","name":"MP3-jPlayer","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1807b544-e5fd-403b-85a6-e20bd4f10dec","source":"wordfence","cve":"CVE-2026-100147","title":"FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1807b544-e5fd-403b-85a6-e20bd4f10dec?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.16.0.5","to_inclusive":true,"patched_in":"3.16.0.6"}],"published":"2026-10-09T19:41:06Z","updated":"2026-10-10T07:41:43Z"},{"id":"wordfence:18086779-a7db-4550-b44f-c10a5bf974cf","source":"wordfence","cve":"CVE-2025-58671","title":"Auction Feed <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18086779-a7db-4550-b44f-c10a5bf974cf?source=api-prod","affected":[{"type":"plugin","slug":"auction-feed","name":"Auction Feed","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:49:57Z"},{"id":"wordfence:180a0111-984d-4563-91ea-6f75c3210056","source":"wordfence","cve":"CVE-2026-48887","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/180a0111-984d-4563-91ea-6f75c3210056?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:49:07Z"},{"id":"wordfence:180ab1ce-3f5c-4768-9f94-23ed4bc59a4b","source":"wordfence","cve":"CVE-2025-59568","title":"Zoho Flow <= 2.14.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/180ab1ce-3f5c-4768-9f94-23ed4bc59a4b?source=api-prod","affected":[{"type":"plugin","slug":"zoho-flow","name":"Zoho Flow \u2013 No-Code Workflow Automation","from":"*","from_inclusive":true,"to":"2.14.1","to_inclusive":true,"patched_in":"2.14.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:58:58Z"},{"id":"wordfence:180f6542-5f48-4d3c-87f7-1bfcb2d8a0c5","source":"wordfence","cve":"CVE-2025-66158","title":"Gmaper for Elementor <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/180f6542-5f48-4d3c-87f7-1bfcb2d8a0c5?source=api-prod","affected":[{"type":"plugin","slug":"gmaper-elementor","name":"Google Maps for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T21:01:44Z"},{"id":"wordfence:1810cea5-cfca-4699-bf09-0e474d04acb6","source":"wordfence","cve":"CVE-2023-45074","title":"Advanced Page Visit Counter <= 7.1.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1810cea5-cfca-4699-bf09-0e474d04acb6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"8.0.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1810e2f1-1a0f-46ad-861d-2e52f0421b94","source":"wordfence","cve":"CVE-2025-32585","title":"Shop Products Filter <= 1.2 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1810e2f1-1a0f-46ad-861d-2e52f0421b94?source=api-prod","affected":[{"type":"plugin","slug":"trusty-woo-products-filter","name":"Shop Products Filter","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-11-13T13:16:44Z"},{"id":"wordfence:18112fac-8674-408a-bc65-1513abed1747","source":"wordfence","cve":"CVE-2025-68506","title":"Docket Cache <= 24.07.03 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18112fac-8674-408a-bc65-1513abed1747?source=api-prod","affected":[{"type":"plugin","slug":"docket-cache","name":"Docket Cache \u2013 Object Cache Accelerator","from":"*","from_inclusive":true,"to":"24.07.03","to_inclusive":true,"patched_in":"24.07.04"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-05T18:46:39Z"},{"id":"wordfence:1811827d-88ae-45e0-a41e-d15fd0adf44a","source":"wordfence","cve":"CVE-2023-35916","title":"WooCommerce Payments <= 5.9.0 - Missing Authorization via redirect_pay_for_order_to_update_payment_method","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1811827d-88ae-45e0-a41e-d15fd0adf44a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1813aaca-3d5a-4650-8a8d-6b54311670f4","source":"wordfence","cve":"CVE-2024-32691","title":"Active Products Tables for WooCommerce <= 1.0.6.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1813aaca-3d5a-4650-8a8d-6b54311670f4?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.2","to_inclusive":true,"patched_in":"1.0.6.3"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T13:15:19Z"},{"id":"wordfence:181403fe-42be-4136-8ff5-5ef40904124b","source":"wordfence","cve":"CVE-2024-37253","title":"WP Directory Kit <= 1.3.6 - Authenticated (Admin+) HTML Injection","severity":"low","cvss":2.7,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181403fe-42be-4136-8ff5-5ef40904124b?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-06-26T00:00:00Z","updated":"2024-07-23T20:39:24Z"},{"id":"wordfence:1814537d-8307-4d1f-86c8-801519172be5","source":"wordfence","cve":"CVE-2021-4341","title":"uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1814537d-8307-4d1f-86c8-801519172be5?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1814ad55-0807-4def-b584-6dbbc5d6eb72","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress <= 3.9.5 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1814ad55-0807-4def-b584-6dbbc5d6eb72?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.10"}],"published":"2014-11-24T00:00:00Z","updated":"2025-06-04T17:18:12Z"},{"id":"wordfence:1814d2ad-73b1-4440-9cd6-7c5c569c4fb2","source":"wordfence","cve":"CVE-2018-20979","title":"Contact Form 7 <= 5.0.3 - Authorization Bypass","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1814d2ad-73b1-4440-9cd6-7c5c569c4fb2?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":false,"patched_in":"5.0.4"}],"published":"2018-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1816a385-0b50-4f0d-848c-f583c247c8fc","source":"wordfence","cve":"CVE-2022-0592","title":"MapSVG <= 6.2.19 - SQL Injection","severity":"high","cvss":7.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1816a385-0b50-4f0d-848c-f583c247c8fc?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"6.2.20","to_inclusive":false,"patched_in":"6.2.20"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1819f2eb-51ef-4ba4-9137-ab64710fa6c8","source":"wordfence","cve":"CVE-2025-13062","title":"Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1819f2eb-51ef-4ba4-9137-ab64710fa6c8?source=api-prod","affected":[{"type":"plugin","slug":"supreme-modules-for-divi","name":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder","from":"*","from_inclusive":true,"to":"2.5.62","to_inclusive":true,"patched_in":"2.5.63"}],"published":"2026-01-15T01:09:33Z","updated":"2026-01-15T13:23:25Z"},{"id":"wordfence:181ad412-2c16-4866-b477-7ce65996adb9","source":"wordfence","cve":"CVE-2026-66437","title":"Feedzy <= 5.2.4 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181ad412-2c16-4866-b477-7ce65996adb9?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:25:53Z"},{"id":"wordfence:181be35c-0aec-48b0-a43b-181284cdb2e2","source":"wordfence","cve":"CVE-2017-18576","title":"Event Notifier <= 1.2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181be35c-0aec-48b0-a43b-181284cdb2e2?source=api-prod","affected":[{"type":"plugin","slug":"event-notifier","name":"Event Notifier","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2017-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:181e351f-7dc8-4bef-a746-4736413601a8","source":"wordfence","cve":"CVE-2025-31045","title":"elfsight Contact Form widget <= 2.3.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181e351f-7dc8-4bef-a746-4736413601a8?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-contact-form","name":"elfsight-contact-form","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-12T13:31:38Z"},{"id":"wordfence:181e41d6-1599-4229-ace8-0bdb5735858f","source":"wordfence","cve":"","title":"Google Alert and Twitter Plugin <= 3.1.5 - Multiple Vulnerabilities","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181e41d6-1599-4229-ace8-0bdb5735858f?source=api-prod","affected":[{"type":"plugin","slug":"GoogleAlertandtwitterplugin","name":"Google Alert and Twitter Plugin","from":"3.1.5","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2013-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:181e6f3a-dbcf-44a6-b725-6325d9e56453","source":"wordfence","cve":"CVE-2024-7064","title":"ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181e6f3a-dbcf-44a6-b725-6325d9e56453?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2024-08-14T00:00:00Z","updated":"2024-08-15T05:30:57Z"},{"id":"wordfence:181eb0e4-3529-4069-91b4-6f6c6ee2c786","source":"wordfence","cve":"CVE-2024-44015","title":"Users Control <= 1.0.16 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181eb0e4-3529-4069-91b4-6f6c6ee2c786?source=api-prod","affected":[{"type":"plugin","slug":"users-control","name":"UsersControl \u2013 Users Profile, Free or Paid Subscriptions, User Access Restriction  & Members Directory","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:35:50Z"},{"id":"wordfence:181edcec-a57d-4516-935d-6777d2de77ae","source":"wordfence","cve":"CVE-2024-1318","title":"RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181edcec-a57d-4516-935d-6777d2de77ae?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-20T18:56:21Z"},{"id":"wordfence:181f578f-011b-4819-8b4d-1e7e78176e10","source":"wordfence","cve":"CVE-2026-57662","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/181f578f-011b-4819-8b4d-1e7e78176e10?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.0","to_inclusive":true,"patched_in":"30.0.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:48:48Z"},{"id":"wordfence:1822fd58-0dba-4b15-9702-32e3aa4405b3","source":"wordfence","cve":"CVE-2024-1239","title":"ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1822fd58-0dba-4b15-9702-32e3aa4405b3?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T02:34:27Z"},{"id":"wordfence:182370f5-0f56-4757-8276-1399606c1a2d","source":"wordfence","cve":"CVE-2007-2483","title":"WP-Table <= 1.43 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/182370f5-0f56-4757-8276-1399606c1a2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-table","name":"WP-Table","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":"1.44"}],"published":"2007-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1824b530-0e9f-43ec-ab79-8a1057e9c1e5","source":"wordfence","cve":"CVE-2025-32134","title":"URL Shortify <= 1.10.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1824b530-0e9f-43ec-ab79-8a1057e9c1e5?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.10.5.1","to_inclusive":true,"patched_in":"1.10.6"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-29T19:26:25Z"},{"id":"wordfence:1829b4b7-5042-4972-ad05-e9a7adbf3026","source":"wordfence","cve":"CVE-2015-2824","title":"Simple Ads Manager < 2.7.97 - Multiple SQL Injections","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1829b4b7-5042-4972-ad05-e9a7adbf3026?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.7.97","to_inclusive":false,"patched_in":"2.7.97"}],"published":"2015-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1829d178-a35b-4577-9522-8765efec7775","source":"wordfence","cve":"CVE-2024-56047","title":"WPLMS < 1.9.9.5.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1829d178-a35b-4577-9522-8765efec7775?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.3","to_inclusive":false,"patched_in":"1.9.9.5.3"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:56:11Z"},{"id":"wordfence:1830f1be-f95f-422e-9e3b-5f2e46ec5d15","source":"wordfence","cve":"CVE-2026-57765","title":"Shopping Cart & eCommerce Store <= 5.9.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1830f1be-f95f-422e-9e3b-5f2e46ec5d15?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:18:01Z"},{"id":"wordfence:1831f7b0-3425-4ee9-ae64-25a5728fa83b","source":"wordfence","cve":"CVE-2025-31788","title":"AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1831f7b0-3425-4ee9-ae64-25a5728fa83b?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-performance-accelerator","name":"AIO Performance Profiler, Monitor, Optimize, Compress & Debug","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-06-30T07:58:30Z"},{"id":"wordfence:183282c6-2069-4fb5-acbd-539aea265d74","source":"wordfence","cve":"CVE-2026-57718","title":"Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/183282c6-2069-4fb5-acbd-539aea265d74?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:21:22Z"},{"id":"wordfence:1832b11a-0706-438a-9a25-d384ac49d2bf","source":"wordfence","cve":"CVE-2021-24789","title":"Flat Preloader < 1.5.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1832b11a-0706-438a-9a25-d384ac49d2bf?source=api-prod","affected":[{"type":"plugin","slug":"flat-preloader","name":"Flat Preloader","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1833720c-e714-4ec5-9ebb-24a4612195d6","source":"wordfence","cve":"","title":"Work The Flow <= 2.3.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1833720c-e714-4ec5-9ebb-24a4612195d6?source=api-prod","affected":[{"type":"plugin","slug":"work-the-flow-file-upload","name":"Work The Flow File Upload","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2014-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18368ad4-4c35-4b08-8297-2ebdf1bb6e46","source":"wordfence","cve":"CVE-2022-41132","title":"Ezoic <= 2.8.8 - Missing Authorization to Stored Cross-Site Scripting","severity":"critical","cvss":9.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18368ad4-4c35-4b08-8297-2ebdf1bb6e46?source=api-prod","affected":[{"type":"plugin","slug":"ezoic-integration","name":"Ezoic","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2022-11-17T00:00:00Z","updated":"2024-12-03T21:49:09Z"},{"id":"wordfence:183d1be9-4c05-4107-b039-3711034ef774","source":"wordfence","cve":"CVE-2024-12060","title":"WP Media Optimizer (.webp) <= 1.4.0 - Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/183d1be9-4c05-4107-b039-3711034ef774?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-optimizer-webp","name":"WP Media Optimizer (.webp)","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:42:47Z","updated":"2024-12-06T08:24:49Z"},{"id":"wordfence:1842ffa7-a9e9-4b35-bec2-e3f9e8622c1c","source":"wordfence","cve":"CVE-2025-53988","title":"JetBlocks For Elementor <= 1.3.18 - Authenticated (Subscriber+) Information Disclsoure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1842ffa7-a9e9-4b35-bec2-e3f9e8622c1c?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2025-07-16T00:00:00Z","updated":"2026-03-27T10:51:23Z"},{"id":"wordfence:18455e08-6593-4835-bd72-beb04bda2930","source":"wordfence","cve":"CVE-2024-1664","title":"Responsive Gallery Grid <= 2.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18455e08-6593-4835-bd72-beb04bda2930?source=api-prod","affected":[{"type":"plugin","slug":"responsive-gallery-grid","name":"Responsive Gallery Grid","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-11T12:59:23Z"},{"id":"wordfence:18458883-6cca-46d1-8437-4e646f4eafda","source":"wordfence","cve":"CVE-2020-35951","title":"Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":8.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18458883-6cca-46d1-8437-4e646f4eafda?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":false,"patched_in":"7.0.1"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18464483-1d2f-4a4e-a1cc-6c1ddcc2dcf5","source":"wordfence","cve":"CVE-2024-0847","title":"5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18464483-1d2f-4a4e-a1cc-6c1ddcc2dcf5?source=api-prod","affected":[{"type":"plugin","slug":"5280-bootstrap-modal-contact-form","name":"5280 Bootstrap Modal Contact Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-07-29T21:35:55Z"},{"id":"wordfence:184885b0-66cd-433d-bfea-d7e8bbb02731","source":"wordfence","cve":"CVE-2021-24698","title":"Simple Download Monitor <= 3.9.5 - Contributor+ Arbitrary Thumbnail Removal","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/184885b0-66cd-433d-bfea-d7e8bbb02731?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":false,"patched_in":"3.9.6"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18498171-7db1-4ebb-8fe0-a66d9343cb46","source":"wordfence","cve":"CVE-2024-5973","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18498171-7db1-4ebb-8fe0-a66d9343cb46?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.3.23","to_inclusive":true,"patched_in":"3.3.24"}],"published":"2024-07-01T00:00:00Z","updated":"2024-08-09T20:35:22Z"},{"id":"wordfence:184b9ae4-945a-4602-99da-679ff9db3029","source":"wordfence","cve":"CVE-2024-43317","title":"RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/184b9ae4-945a-4602-99da-679ff9db3029?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.1.0","to_inclusive":true,"patched_in":"6.0.1.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:09:03Z"},{"id":"wordfence:184c07ad-e0d9-47c9-9582-828947cc97f9","source":"wordfence","cve":"CVE-2022-2737","title":"WP STAGING \u2013 Backup Duplicator & Migration <= 2.9.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/184c07ad-e0d9-47c9-9582-828947cc97f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"2.9.17","to_inclusive":true,"patched_in":"2.9.18"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:184ee992-1479-4528-9ff7-036affaecdbb","source":"wordfence","cve":"","title":"WP Mega Menu <= 1.3.6 - Unauthenticated Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/184ee992-1479-4528-9ff7-036affaecdbb?source=api-prod","affected":[{"type":"plugin","slug":"wp-megamenu","name":"WP Mega Menu","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2020-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1850e6bd-04bc-4510-aba9-e51431363231","source":"wordfence","cve":"CVE-2025-10293","title":"Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1850e6bd-04bc-4510-aba9-e51431363231?source=api-prod","affected":[{"type":"plugin","slug":"keyy","name":"Keyy Two Factor Authentication (like Clef)","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T20:04:20Z","updated":"2025-10-15T08:25:52Z"},{"id":"wordfence:18510b77-1c73-4f19-88e6-572936132d73","source":"wordfence","cve":"CVE-2026-39517","title":"Blog Filter <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18510b77-1c73-4f19-88e6-572936132d73?source=api-prod","affected":[{"type":"plugin","slug":"blog-filter","name":"Blog Filter \u2013 Post Grid Filter by Category or Tag","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-07T13:44:23Z"},{"id":"wordfence:18530601-a294-448c-a1b2-c3995f9042ac","source":"wordfence","cve":"CVE-2023-2764","title":"Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18530601-a294-448c-a1b2-c3995f9042ac?source=api-prod","affected":[{"type":"plugin","slug":"draw-attention","name":"Interactive Image Map Plugin \u2013 Draw Attention","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18531eed-3150-424c-970c-5975afe7546a","source":"wordfence","cve":"CVE-2023-48317","title":"Display Custom Post <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18531eed-3150-424c-970c-5975afe7546a?source=api-prod","affected":[{"type":"plugin","slug":"display-custom-post","name":"Display Custom Post","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:185371b1-5c72-424d-a5b8-42c67aa9380c","source":"wordfence","cve":"CVE-2025-5012","title":"Workreap <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media'","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185371b1-5c72-424d-a5b8-42c67aa9380c?source=api-prod","affected":[{"type":"plugin","slug":"workreap","name":"Workreap","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2025-06-11T16:31:13Z","updated":"2025-06-12T05:23:39Z"},{"id":"wordfence:18557f4a-05b2-4cb4-afef-19c5c63c37a4","source":"wordfence","cve":"","title":"LB Mixed Slideshow for WordPress <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18557f4a-05b2-4cb4-afef-19c5c63c37a4?source=api-prod","affected":[{"type":"plugin","slug":"lb-mixed-slideshow","name":"LB Mixed Slideshow for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18592ba2-cacb-461d-bacd-bc8f44a6126f","source":"wordfence","cve":"CVE-2016-10989","title":"leenk.me <= 2.5.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18592ba2-cacb-461d-bacd-bc8f44a6126f?source=api-prod","affected":[{"type":"plugin","slug":"leenkme","name":"leenk.me","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2016-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:185c755a-8b57-4943-b7fc-c520f5dd0348","source":"wordfence","cve":"CVE-2026-112840","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185c755a-8b57-4943-b7fc-c520f5dd0348?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-10-20T15:10:00Z","updated":"2026-10-23T18:52:42Z"},{"id":"wordfence:185c9962-aa4a-4049-acdb-3f439c420c5a","source":"wordfence","cve":"CVE-2024-29921","title":"Photo Gallery by Supsystic <= 1.15.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185c9962-aa4a-4049-acdb-3f439c420c5a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.15.16","to_inclusive":true,"patched_in":"1.15.17"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T13:57:12Z"},{"id":"wordfence:185d380e-7e23-4260-bdeb-e88c8625f690","source":"wordfence","cve":"CVE-2026-39667","title":"Korea SNS <= 1.7.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185d380e-7e23-4260-bdeb-e88c8625f690?source=api-prod","affected":[{"type":"plugin","slug":"korea-sns","name":"Korea SNS","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:26:24Z"},{"id":"wordfence:185d692c-bc67-44de-82c7-bcbe454dc178","source":"wordfence","cve":"CVE-2024-44019","title":"Contact Form 7 Campaign Monitor Extension <= 0.4.67 - Missing Authorization to Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185d692c-bc67-44de-82c7-bcbe454dc178?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-campaign-monitor-extension","name":"Contact Form 7 Campaign Monitor Extension","from":"*","from_inclusive":true,"to":"0.4.67","to_inclusive":true,"patched_in":"0.4.68"}],"published":"2024-09-24T00:00:00Z","updated":"2026-11-10T23:16:55Z"},{"id":"wordfence:185f9dc4-39e6-422a-97e2-7e8814ccf64a","source":"wordfence","cve":"","title":"Real Estate 7 <= 3.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/185f9dc4-39e6-422a-97e2-7e8814ccf64a?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2020-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:186180ed-321f-4618-8828-65b93fa054a4","source":"wordfence","cve":"CVE-2023-28170","title":"Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/186180ed-321f-4618-8828-65b93fa054a4?source=api-prod","affected":[{"type":"plugin","slug":"theme-demo-import","name":"Theme Demo Import","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-09T00:00:00Z","updated":"2024-07-08T16:47:57Z"},{"id":"wordfence:1861d943-ac58-4a44-ab50-e39101e82013","source":"wordfence","cve":"CVE-2024-35679","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1861d943-ac58-4a44-ab50-e39101e82013?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:31:15Z"},{"id":"wordfence:1862242a-9a00-4e6b-94a2-5599200f1040","source":"wordfence","cve":"CVE-2024-6859","title":"WP MultiTasking <= 0.1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1862242a-9a00-4e6b-94a2-5599200f1040?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-15T20:17:27Z"},{"id":"wordfence:18643abb-171c-43d9-ad62-3414679eb402","source":"wordfence","cve":"CVE-2024-5644","title":"WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18643abb-171c-43d9-ad62-3414679eb402?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:02:49Z"},{"id":"wordfence:186517cd-e444-457a-9e10-583f41595511","source":"wordfence","cve":"CVE-2015-9530","title":"Easy Digital Downloads \u2013 Upload File <= 1.0.4 - Arbitrary File Upload/Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/186517cd-e444-457a-9e10-583f41595511?source=api-prod","affected":[{"type":"plugin","slug":"edd-upload-file","name":"Easy Digital Downloads \u2013 Upload File","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2015-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1867be0d-c91a-47a4-a5f2-4948749cfeaf","source":"wordfence","cve":"CVE-2024-43141","title":"Participants Database <= 2.5.9.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1867be0d-c91a-47a4-a5f2-4948749cfeaf?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.5.9.2","to_inclusive":true,"patched_in":"2.5.9.3"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:25:34Z"},{"id":"wordfence:18696937-5cc5-4e14-940d-fc25468377a3","source":"wordfence","cve":"CVE-2025-13893","title":"Lesson Plan Book <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18696937-5cc5-4e14-940d-fc25468377a3?source=api-prod","affected":[{"type":"plugin","slug":"lesson-plan-book","name":"Lesson Plan Book","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:37:35Z","updated":"2026-01-09T11:15:30Z"},{"id":"wordfence:186b9f06-e637-4f04-a3c3-13ec8496402c","source":"wordfence","cve":"CVE-2026-25424","title":"Mediavine Control Panel <= 2.10.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/186b9f06-e637-4f04-a3c3-13ec8496402c?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-control-panel","name":"Mediavine Control Panel","from":"*","from_inclusive":true,"to":"2.10.10","to_inclusive":true,"patched_in":"2.10.11"}],"published":"2026-07-22T00:00:00Z","updated":"2026-09-09T16:07:26Z"},{"id":"wordfence:186e4147-4cb4-4337-9c3c-d47589b06b20","source":"wordfence","cve":"CVE-2024-33683","title":"Hide Dashboard Notifications <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/186e4147-4cb4-4337-9c3c-d47589b06b20?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-backed-notices","name":"Hide Dashboard Notifications","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T14:11:28Z"},{"id":"wordfence:18739406-fa04-4045-9539-4e943dfe6084","source":"wordfence","cve":"CVE-2025-32302","title":"Winnex <= 1.3.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18739406-fa04-4045-9539-4e943dfe6084?source=api-prod","affected":[{"type":"theme","slug":"winnex","name":"winnex","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:27:33Z"},{"id":"wordfence:187777a4-3438-489c-ad3b-7e16753189d6","source":"wordfence","cve":"CVE-2026-102435","title":"Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187777a4-3438-489c-ad3b-7e16753189d6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.54","to_inclusive":true,"patched_in":"3.5.55"}],"published":"2026-11-02T07:07:46Z","updated":"2026-11-02T19:31:31Z"},{"id":"wordfence:18779761-66fd-437f-a8e3-7ee1b6e36dc7","source":"wordfence","cve":"CVE-2025-49368","title":"Palladio <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18779761-66fd-437f-a8e3-7ee1b6e36dc7?source=api-prod","affected":[{"type":"theme","slug":"palladio","name":"Palladio | Interior Design & Architecture WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:22:20Z"},{"id":"wordfence:1877f94c-3761-4af2-b093-cd2a4e60d63b","source":"wordfence","cve":"CVE-2014-4017","title":"Conversion Ninja (Unspecified Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1877f94c-3761-4af2-b093-cd2a4e60d63b?source=api-prod","affected":[{"type":"plugin","slug":"conversionninja","name":"Conversion Ninja","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1878f096-942f-4bc1-ba5f-419ff7ca535c","source":"wordfence","cve":"CVE-2025-53197","title":"Cookiebot <= 4.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1878f096-942f-4bc1-ba5f-419ff7ca535c?source=api-prod","affected":[{"type":"plugin","slug":"cookiebot","name":"Cookiebot \u2013 Cookie Banner & Cookie Consent for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:26:15Z"},{"id":"wordfence:1878f40e-18f4-448c-bf70-61b4eed1c0ff","source":"wordfence","cve":"CVE-2022-29450","title":"Admin Management Xtended <= 2.4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1878f40e-18f4-448c-bf70-61b4eed1c0ff?source=api-prod","affected":[{"type":"plugin","slug":"admin-management-xtended","name":"Admin Management Xtended","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2022-05-27T12:53:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1879fc8e-614b-4938-9274-e35de8db393f","source":"wordfence","cve":"CVE-2025-30941","title":"Pinterest Verify Meta Tag <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1879fc8e-614b-4938-9274-e35de8db393f?source=api-prod","affected":[{"type":"plugin","slug":"pinterest-verify-meta-tag","name":"Pinterest Verify Meta Tag","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:08:33Z"},{"id":"wordfence:187a420d-a5a5-4b0e-945b-c5694243e68f","source":"wordfence","cve":"CVE-2026-16649","title":"Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187a420d-a5a5-4b0e-945b-c5694243e68f?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-09-04T18:06:53Z","updated":"2026-09-05T06:37:56Z"},{"id":"wordfence:187b072d-6314-4ac1-a924-b14324b2fd8d","source":"wordfence","cve":"CVE-2026-6703","title":"Responsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187b072d-6314-4ac1-a924-b14324b2fd8d?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"2.0.9","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-04-20T17:50:51Z","updated":"2026-04-21T06:44:02Z"},{"id":"wordfence:187c9a53-d0b7-472b-8f5d-fe114737bafe","source":"wordfence","cve":"CVE-2026-120843","title":"Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187c9a53-d0b7-472b-8f5d-fe114737bafe?source=api-prod","affected":[{"type":"plugin","slug":"posts-data-table","name":"Posts Table with Search & Sort","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:39:17Z"},{"id":"wordfence:187d4d8d-d1e1-4171-b54d-38455cc659b8","source":"wordfence","cve":"CVE-2025-22726","title":"nK Themes Helper <= 1.7.9 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187d4d8d-d1e1-4171-b54d-38455cc659b8?source=api-prod","affected":[{"type":"plugin","slug":"nk-themes-helper","name":"nK Themes Helper","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:04:24Z"},{"id":"wordfence:187df8e0-80f0-4805-823b-80627b76db2a","source":"wordfence","cve":"","title":"Facebook Survey Pro <= 1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187df8e0-80f0-4805-823b-80627b76db2a?source=api-prod","affected":[{"type":"plugin","slug":"fbsurveypro","name":"Facebook Survey Pro","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:187fa947-f041-4cfd-9b2a-ee4c9254f2b3","source":"wordfence","cve":"CVE-2025-22284","title":"LTL Freight Quotes \u2013 Unishippers Edition <= 2.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/187fa947-f041-4cfd-9b2a-ee4c9254f2b3?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-unishippers-edition","name":"LTL Freight Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-18T20:29:59Z"},{"id":"wordfence:1882bb92-8e4e-484f-bded-05802de9a64e","source":"wordfence","cve":"CVE-2024-5081","title":"Wp EMember < 10.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1882bb92-8e4e-484f-bded-05802de9a64e?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.7.0","to_inclusive":false,"patched_in":"10.7.0"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-09T20:05:22Z"},{"id":"wordfence:188498ae-e985-470f-9c71-666875ceb333","source":"wordfence","cve":"CVE-2025-30597","title":"IG Shortcodes <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188498ae-e985-470f-9c71-666875ceb333?source=api-prod","affected":[{"type":"plugin","slug":"ig-shortcodes","name":"IG Shortcodes","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T21:00:38Z"},{"id":"wordfence:1889c1ba-f49f-474c-8d0a-0ae46fb92deb","source":"wordfence","cve":"CVE-2025-11496","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1889c1ba-f49f-474c-8d0a-0ae46fb92deb?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-12-20T14:14:55Z","updated":"2025-12-21T02:20:30Z"},{"id":"wordfence:188b6da2-1d4f-44af-82e1-a642170bcb36","source":"wordfence","cve":"CVE-2021-24401","title":"WP Domain Redirect <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188b6da2-1d4f-44af-82e1-a642170bcb36?source=api-prod","affected":[{"type":"plugin","slug":"wp-domain-redirect","name":"WP Domain Redirect","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:188baddc-134c-4a82-898b-9b038e795893","source":"wordfence","cve":"CVE-2025-6348","title":"Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188baddc-134c-4a82-898b-9b038e795893?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.28","to_inclusive":true,"patched_in":"3.5.1.29"}],"published":"2025-07-29T19:33:29Z","updated":"2025-07-30T08:23:04Z"},{"id":"wordfence:188c4417-962a-4b28-b215-1c567b39ba7a","source":"wordfence","cve":"CVE-2023-45751","title":"Nexter Extension <= 2.0.3 - Authenticated(Editor+) Remote Code Execution via metabox","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188c4417-962a-4b28-b215-1c567b39ba7a?source=api-prod","affected":[{"type":"plugin","slug":"nexter-extension","name":"Nexter Extension \u2013 Security, Performance, Code Snippets & Site Toolkit","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:188d1e4e-9fd6-4a26-920b-a0a9f203f9d1","source":"wordfence","cve":"CVE-2025-24607","title":"IdeaPush <= 8.72 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188d1e4e-9fd6-4a26-920b-a0a9f203f9d1?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.72","to_inclusive":true,"patched_in":"8.73"}],"published":"2024-12-27T00:00:00Z","updated":"2025-02-24T15:37:33Z"},{"id":"wordfence:188d812c-2955-4b0c-ae1c-b42c0f60b73b","source":"wordfence","cve":"CVE-2026-1356","title":"Converter for Media \u2013 Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src","severity":"medium","cvss":4.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=api-prod","affected":[{"type":"plugin","slug":"webp-converter-for-media","name":"Converter for Media \u2013 Optimize images | Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2026-02-11T21:24:23Z","updated":"2026-02-12T09:25:52Z"},{"id":"wordfence:188eef67-de66-49c2-aa6c-2cf3b886ff66","source":"wordfence","cve":"CVE-2025-6207","title":"WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188eef67-de66-49c2-aa6c-2cf3b886ff66?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.9.29"}],"published":"2025-08-04T18:51:53Z","updated":"2026-01-19T16:28:52Z"},{"id":"wordfence:188f00f8-82f2-4166-9d6e-af996fe66422","source":"wordfence","cve":"CVE-2026-1614","title":"Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188f00f8-82f2-4166-9d6e-af996fe66422?source=api-prod","affected":[{"type":"plugin","slug":"rise-blocks","name":"Rise Blocks \u2013 A Complete Gutenberg Page Builder","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T18:45:53Z","updated":"2026-02-25T06:54:54Z"},{"id":"wordfence:188f7c1d-e8ad-4114-9aa4-c3e8b51c5f2c","source":"wordfence","cve":"CVE-2026-19806","title":"Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/188f7c1d-e8ad-4114-9aa4-c3e8b51c5f2c?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.52","to_inclusive":true,"patched_in":"1.4.53"}],"published":"2026-08-31T16:02:05Z","updated":"2026-09-01T04:27:49Z"},{"id":"wordfence:189090a0-26fd-4a0e-b663-24d28266b56b","source":"wordfence","cve":"CVE-2026-34887","title":"Kubio AI Page Builder <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/189090a0-26fd-4a0e-b663-24d28266b56b?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-03-31T00:00:00Z","updated":"2026-04-02T14:48:51Z"},{"id":"wordfence:1891a8b7-3c70-4be1-80e1-fdc787261cbd","source":"wordfence","cve":"CVE-2026-66647","title":"Homlisti <= 3.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1891a8b7-3c70-4be1-80e1-fdc787261cbd?source=api-prod","affected":[{"type":"theme","slug":"homlisti","name":"Homlisti","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:16:02Z"},{"id":"wordfence:189259d3-b591-4b8c-8423-e220c6bab265","source":"wordfence","cve":"CVE-2025-31066","title":"Acerola <= 1.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/189259d3-b591-4b8c-8423-e220c6bab265?source=api-prod","affected":[{"type":"theme","slug":"acerola","name":"Acerola - Ultra Minimalist Agency Theme","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-29T16:48:33Z"},{"id":"wordfence:1892b510-abac-4282-b0f6-69da46ec1c8d","source":"wordfence","cve":"CVE-2026-16578","title":"Admin Safety Guard <= 1.3.0 - Unauthenticated User Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1892b510-abac-4282-b0f6-69da46ec1c8d?source=api-prod","affected":[{"type":"plugin","slug":"admin-safety-guard","name":"Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA & Brute Force Protection","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:41:39Z"},{"id":"wordfence:18932ef8-c0fe-4423-81bd-2f136451463e","source":"wordfence","cve":"CVE-2025-26957","title":"Affiliate Coupons <= 1.7.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18932ef8-c0fe-4423-81bd-2f136451463e?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-coupons","name":"Affiliate Coupons \u2013 Coupon Display Manager \u2013 Excellent Tool for Affiliate Marketers","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:25:53Z"},{"id":"wordfence:189430b2-cf7f-46e3-b5b0-c9515b64e731","source":"wordfence","cve":"CVE-2022-1608","title":"OnePress Social Locker <= 5.6.2 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/189430b2-cf7f-46e3-b5b0-c9515b64e731?source=api-prod","affected":[{"type":"plugin","slug":"social-locker","name":"OnePress Social Locker","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1894a25e-c004-4e0f-8064-66470eebdb7f","source":"wordfence","cve":"CVE-2025-32603","title":"WP Online Users Stats <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1894a25e-c004-4e0f-8064-66470eebdb7f?source=api-prod","affected":[{"type":"plugin","slug":"wp-online-users-stats","name":"WP Online Users Stats","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:45:22Z"},{"id":"wordfence:1896885a-a104-464a-bb57-2c3c73ff9415","source":"wordfence","cve":"CVE-2025-13414","title":"Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1896885a-a104-464a-bb57-2c3c73ff9415?source=api-prod","affected":[{"type":"plugin","slug":"chamber-dashboard-business-directory","name":"Chamber Dashboard Business Directory","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:17:22Z","updated":"2025-11-25T07:28:19Z"},{"id":"wordfence:1898fbe5-de5d-45e3-95be-db500f093908","source":"wordfence","cve":"CVE-2025-49253","title":"Lasa <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1898fbe5-de5d-45e3-95be-db500f093908?source=api-prod","affected":[{"type":"theme","slug":"lasa","name":"Lasa - Creative Minimal WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:28:01Z"},{"id":"wordfence:1899b329-d636-47e4-be87-02dc64028e5e","source":"wordfence","cve":"CVE-2025-32146","title":"JS Job Manager <= 2.0.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1899b329-d636-47e4-be87-02dc64028e5e?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:44:55Z"},{"id":"wordfence:1899e5ec-ad87-4182-81b6-3b777d117e93","source":"wordfence","cve":"CVE-2015-9294","title":"All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1899e5ec-ad87-4182-81b6-3b777d117e93?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:189c2409-5111-489c-bd91-86f6a6a6cdcb","source":"wordfence","cve":"CVE-2026-27425","title":"Automotive Listings <= 18.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/189c2409-5111-489c-bd91-86f6a6a6cdcb?source=api-prod","affected":[{"type":"plugin","slug":"automotive","name":"Automotive Listings","from":"*","from_inclusive":true,"to":"18.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:51:23Z"},{"id":"wordfence:189d22e0-c16a-48ab-a278-a132cd1057b6","source":"wordfence","cve":"CVE-2016-11018","title":"Huge-IT gallery-images <= 1.8.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/189d22e0-c16a-48ab-a278-a132cd1057b6?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2016-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18a0b8f2-4512-46a5-92a6-66d375c986dd","source":"wordfence","cve":"CVE-2023-3720","title":"Upload Media By URL <= 1.0.7 - Cross-Site Request Forgery via 'umbu_download'","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a0b8f2-4512-46a5-92a6-66d375c986dd?source=api-prod","affected":[{"type":"plugin","slug":"upload-media-by-url","name":"Upload Media By URL","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-08-02T00:00:00Z","updated":"2026-10-01T23:02:06Z"},{"id":"wordfence:18a20bd4-a172-40b5-9ff3-77e593cff4f5","source":"wordfence","cve":"CVE-2025-22334","title":"Education LMS <= 0.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a20bd4-a172-40b5-9ff3-77e593cff4f5?source=api-prod","affected":[{"type":"theme","slug":"education-lms","name":"Education LMS","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:06:40Z"},{"id":"wordfence:18a37063-31aa-4b1f-b1a5-1ea921a20686","source":"wordfence","cve":"CVE-2024-6828","title":"Redux Framework 4.4.12 -  4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a37063-31aa-4b1f-b1a5-1ea921a20686?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"4.4.12","from_inclusive":true,"to":"4.4.17","to_inclusive":true,"patched_in":"4.4.18"}],"published":"2024-07-22T12:05:44Z","updated":"2024-09-05T14:50:59Z"},{"id":"wordfence:18a41bef-feed-4096-a1f4-9c99caac6ce9","source":"wordfence","cve":"CVE-2023-1331","title":"Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin Reset","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a41bef-feed-4096-a1f4-9c99caac6ce9?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18a4fa4b-5c99-4347-8b34-e49f7e0972be","source":"wordfence","cve":"CVE-2026-3577","title":"Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a4fa4b-5c99-4347-8b34-e49f7e0972be?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-20T00:00:00Z","updated":"2026-09-08T19:48:46Z"},{"id":"wordfence:18a58071-b394-4dc0-9759-6373a5f22f47","source":"wordfence","cve":"CVE-2024-38705","title":"ElementInvader Addons for Elementor <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a58071-b394-4dc0-9759-6373a5f22f47?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-07-11T00:00:00Z","updated":"2024-09-03T16:37:12Z"},{"id":"wordfence:18a7c676-0d88-4492-abc9-150592c80ecf","source":"wordfence","cve":"CVE-2025-69383","title":"shop <= 2.6.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a7c676-0d88-4492-abc9-150592c80ecf?source=api-prod","affected":[{"type":"plugin","slug":"wpshop","name":"WPshop 2 \u2013 E-Commerce","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:49:03Z"},{"id":"wordfence:18a9953c-e3a0-46ee-9a53-984c411ce408","source":"wordfence","cve":"CVE-2024-30560","title":"DX-Watermark <= 1.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18a9953c-e3a0-46ee-9a53-984c411ce408?source=api-prod","affected":[{"type":"plugin","slug":"dx-watermark","name":"DX-Watermark","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:32:43Z"},{"id":"wordfence:18aa817d-80e0-4c6f-852f-c8a91c9507c4","source":"wordfence","cve":"","title":"Slideshow Gallery <= 1.5.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18aa817d-80e0-4c6f-852f-c8a91c9507c4?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.5.3.4","to_inclusive":false,"patched_in":"1.5.3.4"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18aafcc3-6493-47f2-903b-148afe620625","source":"wordfence","cve":"CVE-2024-54378","title":"Quietly Insights <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18aafcc3-6493-47f2-903b-148afe620625?source=api-prod","affected":[{"type":"plugin","slug":"quietly-insights","name":"Quietly Insights","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:33:51Z"},{"id":"wordfence:18acd104-a5a5-4811-9aea-abc227a1712c","source":"wordfence","cve":"CVE-2024-24935","title":"Basic Log Viewer <= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18acd104-a5a5-4811-9aea-abc227a1712c?source=api-prod","affected":[{"type":"plugin","slug":"wpsimpletools-log-viewer","name":"Basic Log Viewer","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T15:22:08Z"},{"id":"wordfence:18afd787-2b1f-452c-90d8-75e0df9322fa","source":"wordfence","cve":"CVE-2021-24329","title":"WP Super Cache <= 1.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18afd787-2b1f-452c-90d8-75e0df9322fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":false,"patched_in":"1.7.3"}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18b2d99a-f55c-4a05-8442-e1fddd59181f","source":"wordfence","cve":"CVE-2024-2666","title":"Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b2d99a-f55c-4a05-8442-e1fddd59181f?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.24","to_inclusive":true,"patched_in":"4.10.25"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T03:31:22Z"},{"id":"wordfence:18b54d30-b876-4704-9456-28df8db0efda","source":"wordfence","cve":"CVE-2025-22283","title":"GetSocial <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b54d30-b876-4704-9456-28df8db0efda?source=api-prod","affected":[{"type":"plugin","slug":"getsocial","name":"GetSocial","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-17T17:54:13Z"},{"id":"wordfence:18b5777c-d176-4214-81ac-b92188704196","source":"wordfence","cve":"CVE-2016-11002","title":"ElegantThemes <= 1.2.3 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b5777c-d176-4214-81ac-b92188704196?source=api-prod","affected":[{"type":"theme","slug":"extra","name":"Divi Extra","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2016-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18b64b4a-e290-4efb-baa6-5cceb988ac87","source":"wordfence","cve":"CVE-2025-58827","title":"Job Board Manager <= 2.1.61 - Authenticated (Job Poster+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b64b4a-e290-4efb-baa6-5cceb988ac87?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.61","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:41:30Z"},{"id":"wordfence:18b77c9b-6614-4a3f-a003-54567d9c4408","source":"wordfence","cve":"CVE-2026-9721","title":"Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b77c9b-6614-4a3f-a003-54567d9c4408?source=api-prod","affected":[{"type":"plugin","slug":"book-a-room-event-calendar","name":"Book a Room Event Calendar","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:40:58Z","updated":"2026-06-24T05:33:22Z"},{"id":"wordfence:18b9e6c0-f1c3-4ef5-b0da-671828508781","source":"wordfence","cve":"CVE-2024-52405","title":"B-Banner Slider <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18b9e6c0-f1c3-4ef5-b0da-671828508781?source=api-prod","affected":[{"type":"plugin","slug":"b-banner-slider","name":"B-Banner Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:04:42Z"},{"id":"wordfence:18bb20d5-325c-4a72-890c-edd38ab03cea","source":"wordfence","cve":"CVE-2026-89027","title":"JWT Authentication for WP REST APIs <= 4.7.0 - Unauthenticated Authentication Method Downgrade via 'mo_rest_api_test_config' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18bb20d5-325c-4a72-890c-edd38ab03cea?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-authentication","name":"JWT Authentication for WP REST APIs","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-16T19:06:36Z"},{"id":"wordfence:18bcd2ad-1989-4e2b-b82e-fddc4201c5a6","source":"wordfence","cve":"CVE-2025-14903","title":"Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18bcd2ad-1989-4e2b-b82e-fddc4201c5a6?source=api-prod","affected":[{"type":"plugin","slug":"simple-crypto-shortcodes","name":"Simple Crypto Shortcodes","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:16:43Z","updated":"2026-01-24T07:26:40Z"},{"id":"wordfence:18be0679-7083-4189-b3fe-5ec6cd2e6f76","source":"wordfence","cve":"CVE-2026-39525","title":"Booking Activities <= 1.16.48.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18be0679-7083-4189-b3fe-5ec6cd2e6f76?source=api-prod","affected":[{"type":"plugin","slug":"booking-activities","name":"Booking Activities","from":"*","from_inclusive":true,"to":"1.16.48.1","to_inclusive":true,"patched_in":"1.17.0"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T14:49:43Z"},{"id":"wordfence:18c0673c-5e49-4324-a4fc-ae74f64cba94","source":"wordfence","cve":"CVE-2025-23914","title":"Optimize Your Campaigns \u2013 Google Shopping \u2013 Google Ads \u2013 Google Adwords <= 3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c0673c-5e49-4324-a4fc-ae74f64cba94?source=api-prod","affected":[{"type":"plugin","slug":"muzaara-adwords-optimize-dashboard","name":"Optimize Your Campaigns \u2013 Google Shopping \u2013 Google Ads \u2013 Google Adwords","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:21:27Z"},{"id":"wordfence:18c0ecc5-b3e2-4ac0-b901-dae397e2d57c","source":"wordfence","cve":"CVE-2023-24406","title":"Simple Popup Images <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c0ecc5-b3e2-4ac0-b901-dae397e2d57c?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup","name":"Simple PopUp","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18c0f717-6825-4421-af53-68f1cf502f81","source":"wordfence","cve":"CVE-2024-11921","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c0f717-6825-4421-af53-68f1cf502f81?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.18.0","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2024-12-06T00:00:00Z","updated":"2025-01-17T13:19:38Z"},{"id":"wordfence:18c1a5a0-dee0-45ee-9e8b-0937b392eccd","source":"wordfence","cve":"CVE-2026-96662","title":"Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c1a5a0-dee0-45ee-9e8b-0937b392eccd?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-10-09T19:23:35Z","updated":"2026-10-10T07:41:43Z"},{"id":"wordfence:18c64296-9f84-426d-a6a0-209faf56c0b9","source":"wordfence","cve":"CVE-2026-22492","title":"Docket Cache <= 24.07.04 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c64296-9f84-426d-a6a0-209faf56c0b9?source=api-prod","affected":[{"type":"plugin","slug":"docket-cache","name":"Docket Cache \u2013 Object Cache Accelerator","from":"*","from_inclusive":true,"to":"24.07.04","to_inclusive":true,"patched_in":"24.07.05"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:10:42Z"},{"id":"wordfence:18c80a60-55d5-4a71-932d-a10b2fb328ce","source":"wordfence","cve":"CVE-2025-53326","title":"Gutenify <= 1.5.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18c80a60-55d5-4a71-932d-a10b2fb328ce?source=api-prod","affected":[{"type":"plugin","slug":"gutenify","name":"Gutenify \u2013 Visual Site Builder Blocks & Starter Templates","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-22T14:47:53Z"},{"id":"wordfence:18cbf346-91a3-4856-930e-7753eb1470d9","source":"wordfence","cve":"","title":"Chart Builder <= 1.9.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18cbf346-91a3-4856-930e-7753eb1470d9?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18ce05fa-0b10-4796-9e78-03e653b862da","source":"wordfence","cve":"CVE-2025-7772","title":"Malcure Malware Scanner \u2014 #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18ce05fa-0b10-4796-9e78-03e653b862da?source=api-prod","affected":[{"type":"plugin","slug":"wp-malware-removal","name":"Malcure Malware Shield \u2014 Removal, Repair, Monitor","from":"*","from_inclusive":true,"to":"16.8","to_inclusive":true,"patched_in":"16.9"}],"published":"2025-06-12T00:00:00Z","updated":"2025-07-18T06:45:32Z"},{"id":"wordfence:18cf444b-d3c8-4292-bc41-10240824e3a1","source":"wordfence","cve":"CVE-2026-111843","title":"Rootblox \u2013 Header & Footer Builder for Full Site Editing (FSE) <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18cf444b-d3c8-4292-bc41-10240824e3a1?source=api-prod","affected":[{"type":"plugin","slug":"rootblox","name":"Rootblox \u2013 Header & Footer Builder for Full Site Editing (FSE)","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-10-20T15:11:00Z","updated":"2026-10-23T18:31:16Z"},{"id":"wordfence:18d1ba80-ddf6-4076-bc78-78647b964bcf","source":"wordfence","cve":"CVE-2023-47842","title":"CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d1ba80-ddf6-4076-bc78-78647b964bcf?source=api-prod","affected":[{"type":"plugin","slug":"catablog","name":"CataBlog","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18d1feee-347c-4f43-a01b-67b3d0a5b2d6","source":"wordfence","cve":"CVE-2024-9848","title":"Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d1feee-347c-4f43-a01b-67b3d0a5b2d6?source=api-prod","affected":[{"type":"plugin","slug":"product-customizer-light","name":"Product Customizer Light","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:48:00Z","updated":"2024-10-18T04:32:50Z"},{"id":"wordfence:18d33d68-9719-4e74-a594-bc4add38ceee","source":"wordfence","cve":"CVE-2023-1805","title":"Product Catalog Feed by PixelYourSite <= 2.1.0 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d33d68-9719-4e74-a594-bc4add38ceee?source=api-prod","affected":[{"type":"plugin","slug":"product-catalog-feed","name":"Product Catalog Feed by PixelYourSite","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18d37650-057d-4cd1-bfeb-e40885d22566","source":"wordfence","cve":"CVE-2024-13779","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d37650-057d-4cd1-bfeb-e40885d22566?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:44Z"},{"id":"wordfence:18d615ff-f617-48fb-bf9c-0f6faff18c64","source":"wordfence","cve":"CVE-2025-30981","title":"WP-Recall <= 16.26.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d615ff-f617-48fb-bf9c-0f6faff18c64?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:11:37Z"},{"id":"wordfence:18d6dffd-8df3-4611-ad94-6d806aa7328a","source":"wordfence","cve":"CVE-2024-13623","title":"Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d6dffd-8df3-4611-ad94-6d806aa7328a?source=api-prod","affected":[{"type":"plugin","slug":"order-export-and-more-for-woocommerce","name":"Order Export for WooCommerce","from":"*","from_inclusive":true,"to":"3.24","to_inclusive":true,"patched_in":"3.25"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T06:40:18Z"},{"id":"wordfence:18d9c8f2-1d27-40de-8841-5fe21dcf620b","source":"wordfence","cve":"CVE-2025-49355","title":"Accessibility Press <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18d9c8f2-1d27-40de-8841-5fe21dcf620b?source=api-prod","affected":[{"type":"plugin","slug":"ilogic-accessibility","name":"Accessibility Press","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:18:06Z"},{"id":"wordfence:18daa19e-81f8-4ea8-837b-3f1fce26d2b2","source":"wordfence","cve":"CVE-2025-32287","title":"Responsive HTML5 Audio Player PRO With Playlist <= 3.5.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18daa19e-81f8-4ea8-837b-3f1fce26d2b2?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio2-html5","name":"Responsive HTML5 Audio Player PRO With Playlist","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:14:33Z"},{"id":"wordfence:18dacb4b-7eb7-4de2-b889-e36c11ad4a04","source":"wordfence","cve":"","title":"Nexos - Real Estate <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18dacb4b-7eb7-4de2-b889-e36c11ad4a04?source=api-prod","affected":[{"type":"theme","slug":"nexos","name":"Nexos - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2020-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18dc9c01-c849-40c3-87ec-5eebc9660aff","source":"wordfence","cve":"CVE-2026-116563","title":"Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18dc9c01-c849-40c3-87ec-5eebc9660aff?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-10-30T17:16:16Z","updated":"2026-10-31T05:33:07Z"},{"id":"wordfence:18dd1b86-3206-4cd7-a20b-33240c139aa5","source":"wordfence","cve":"CVE-2023-40203","title":"MailChimp Forms by MailMunch <= 3.1.4 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18dd1b86-3206-4cd7-a20b-33240c139aa5?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18dd8fae-2e89-4771-955a-173efc68304a","source":"wordfence","cve":"CVE-2026-95602","title":"YITH Request a Quote for WooCommerce < 4.46.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18dd8fae-2e89-4771-955a-173efc68304a?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"4.46.1","to_inclusive":false,"patched_in":"4.46.1"}],"published":"2026-09-23T07:48:53Z","updated":"2026-09-29T19:54:37Z"},{"id":"wordfence:18ded977-5297-4b6f-b9f3-0567f995d08a","source":"wordfence","cve":"CVE-2024-9865","title":"EventPrime \u2013 Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18ded977-5297-4b6f-b9f3-0567f995d08a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.4.7","to_inclusive":true,"patched_in":"4.0.4.8"}],"published":"2024-10-23T00:00:00Z","updated":"2024-10-24T06:50:23Z"},{"id":"wordfence:18e0140e-ac24-48c6-aea0-bb0da203a817","source":"wordfence","cve":"CVE-2023-6987","title":"String Locator <= 2.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e0140e-ac24-48c6-aea0-bb0da203a817?source=api-prod","affected":[{"type":"plugin","slug":"string-locator","name":"String locator","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-08-23T13:40:19Z","updated":"2024-08-24T02:02:28Z"},{"id":"wordfence:18e2263c-7945-4dc8-9a58-fb86167fbeed","source":"wordfence","cve":"CVE-2026-28188","title":"Hydra Booking <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2263c-7945-4dc8-9a58-fb86167fbeed?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:09:37Z"},{"id":"wordfence:18e24a2e-cbc6-4285-b846-bea513b6ff69","source":"wordfence","cve":"CVE-2024-1690","title":"TeraWallet \u2013 Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e24a2e-cbc6-4285-b846-bea513b6ff69?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:26:34Z"},{"id":"wordfence:18e2a443-381c-46cd-85c7-20716f4e59c1","source":"wordfence","cve":"CVE-2024-12518","title":"shMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2a443-381c-46cd-85c7-20716f4e59c1?source=api-prod","affected":[{"type":"plugin","slug":"shmapper-by-teplitsa","name":"ShMapper by Teplitsa","from":"*","from_inclusive":true,"to":"1.4.18","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T04:22:44Z"},{"id":"wordfence:18e2e0e5-495f-4f55-b7d8-94193fc2ad12","source":"wordfence","cve":"CVE-2024-2091","title":"Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2e0e5-495f-4f55-b7d8-94193fc2ad12?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-02T14:43:53Z"},{"id":"wordfence:18e51b35-90fa-4ea0-95f9-644ab864b406","source":"wordfence","cve":"CVE-2022-0445","title":"WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent < 2.14.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e51b35-90fa-4ea0-95f9-644ab864b406?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"2.14.2","to_inclusive":false,"patched_in":"2.14.2"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18e562fb-9035-4f2d-a2d3-9a74ff1e4e32","source":"wordfence","cve":"CVE-2022-2754","title":"Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e562fb-9035-4f2d-a2d3-9a74ff1e4e32?source=api-prod","affected":[{"type":"plugin","slug":"ketchup-restaurant-reservations","name":"Ketchup Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18e8f72b-daa0-4a9f-a67b-d9be9a0862d2","source":"wordfence","cve":"CVE-2022-3194","title":"Dokan <= 3.6.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18e8f72b-daa0-4a9f-a67b-d9be9a0862d2?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18ea9880-817f-41d0-a552-b43deac46bb3","source":"wordfence","cve":"CVE-2025-23713","title":"Hack me if you can <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18ea9880-817f-41d0-a552-b43deac46bb3?source=api-prod","affected":[{"type":"plugin","slug":"hack-me-if-you-can","name":"Hack me if you can","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:18:59Z"},{"id":"wordfence:18eb8b2a-8e08-4f78-9501-927c025ea574","source":"wordfence","cve":"CVE-2024-37431","title":"Mesmerize <= 1.6.120 - Cross-Site Request Forgery to Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18eb8b2a-8e08-4f78-9501-927c025ea574?source=api-prod","affected":[{"type":"theme","slug":"mesmerize","name":"Mesmerize","from":"*","from_inclusive":true,"to":"1.6.120","to_inclusive":true,"patched_in":"1.6.124"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:50:58Z"},{"id":"wordfence:18f04566-3a63-41f3-aa9b-766304d56499","source":"wordfence","cve":"","title":"TH Side Cart and Menu Cart for Woocommerce <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f04566-3a63-41f3-aa9b-766304d56499?source=api-prod","affected":[{"type":"plugin","slug":"th-all-in-one-woo-cart","name":"ThemeHunk \u2013 Side Cart, Ajax Cart & Menu Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18f0d0fd-3d1a-4e93-8e06-9cae7d64faf7","source":"wordfence","cve":"CVE-2024-37561","title":"Plugin Notes Plus <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f0d0fd-3d1a-4e93-8e06-9cae7d64faf7?source=api-prod","affected":[{"type":"plugin","slug":"plugin-notes-plus","name":"Plugin Notes Plus","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-19T13:55:26Z"},{"id":"wordfence:18f16148-b4a8-4f89-af0d-c0baba8f9ccf","source":"wordfence","cve":"CVE-2024-3047","title":"PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f16148-b4a8-4f89-af0d-c0baba8f9ccf?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:51:50Z"},{"id":"wordfence:18f48182-eb54-4834-bf39-1bdb1e010a6e","source":"wordfence","cve":"CVE-2026-14235","title":"Download Manager <= 3.3.61 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f48182-eb54-4834-bf39-1bdb1e010a6e?source=api-prod","affected":[{"type":"plugin","slug":"downloadmanager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.61","to_inclusive":true,"patched_in":"3.3.62"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T16:59:27Z"},{"id":"wordfence:18f726d6-61a2-4cdb-b09f-bedc19695d63","source":"wordfence","cve":"CVE-2026-116866","title":"Extra Fees for WooCommerce <= 4.4.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f726d6-61a2-4cdb-b09f-bedc19695d63?source=api-prod","affected":[{"type":"plugin","slug":"woo-conditional-product-fees-for-checkout","name":"Extra Fees for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T07:16:02Z","updated":"2026-11-03T19:36:58Z"},{"id":"wordfence:18f7664b-6e2b-4422-8d6e-5bc4e6611069","source":"wordfence","cve":"CVE-2026-27435","title":"Woffice CRM <= 5.4.32 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18f7664b-6e2b-4422-8d6e-5bc4e6611069?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.32","to_inclusive":true,"patched_in":"5.4.33"}],"published":"2026-06-29T00:00:00Z","updated":"2026-08-17T00:15:01Z"},{"id":"wordfence:18fd631d-9e9b-46ee-953f-61ad3458e1dd","source":"wordfence","cve":"CVE-2022-0441","title":"MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fd631d-9e9b-46ee-953f-61ad3458e1dd?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18fddc88-53d5-42c0-946f-f88ef6abb39f","source":"wordfence","cve":"CVE-2026-94541","title":"WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fddc88-53d5-42c0-946f-f88ef6abb39f?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.82","to_inclusive":true,"patched_in":"11.85"}],"published":"2026-10-01T21:14:53Z","updated":"2026-10-02T09:25:55Z"},{"id":"wordfence:18fe9769-3681-4a5e-866a-640b4cc76199","source":"wordfence","cve":"CVE-2023-50376","title":"Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18fe9769-3681-4a5e-866a-640b4cc76199?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":false,"patched_in":"4.3.9"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:18ff2556-9e20-42f6-a8fb-b81473c42576","source":"wordfence","cve":"CVE-2023-0477","title":"Auto Featured Image (Auto Post Thumbnail) <= 3.9.15 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/18ff2556-9e20-42f6-a8fb-b81473c42576?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.9.16"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1900941d-cbb6-4384-977e-6c40f65b2789","source":"wordfence","cve":"CVE-2022-1627","title":"My Private Site <= 3.0.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1900941d-cbb6-4384-977e-6c40f65b2789?source=api-prod","affected":[{"type":"plugin","slug":"jonradio-private-site","name":"My Private Site \u2013 Make Your Whole Site Private, Force Login & Block Registration Spam","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2022-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1900dbd2-9048-4da3-9aa1-fad89ba67a9e","source":"wordfence","cve":"CVE-2025-31418","title":"Gravel <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1900dbd2-9048-4da3-9aa1-fad89ba67a9e?source=api-prod","affected":[{"type":"theme","slug":"gravel","name":"Gravel","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T13:28:43Z"},{"id":"wordfence:190106bd-05ac-4a8f-b7a5-a042092a5713","source":"wordfence","cve":"CVE-2012-6622","title":"WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190106bd-05ac-4a8f-b7a5-a042092a5713?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1903354e-f53a-4005-b93b-c91d268f7a5d","source":"wordfence","cve":"CVE-2014-4545","title":"Pro Quoter Plugin <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1903354e-f53a-4005-b93b-c91d268f7a5d?source=api-prod","affected":[{"type":"plugin","slug":"proquoter","name":"proquoter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1903527e-d7d9-48a0-b59d-65ec5e14def2","source":"wordfence","cve":"CVE-2024-2455","title":"Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1903527e-d7d9-48a0-b59d-65ec5e14def2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack","name":"Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin","from":"*","from_inclusive":true,"to":"7.9.0","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2024-07-31T16:46:28Z","updated":"2024-08-01T12:43:27Z"},{"id":"wordfence:190492ec-5982-4dce-9e97-16a518a01a27","source":"wordfence","cve":"CVE-2025-15482","title":"Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190492ec-5982-4dce-9e97-16a518a01a27?source=api-prod","affected":[{"type":"plugin","slug":"chapa-payment-gateway-for-woocommerce","name":"Chapa Payment Gateway Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:32:34Z","updated":"2026-02-04T08:25:28Z"},{"id":"wordfence:19062e84-7ce5-400e-a404-2bb4286cc09e","source":"wordfence","cve":"CVE-2022-3082","title":"miniOrange Discord Integration <= 2.1.5 - Missing Authorization to Plugin Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19062e84-7ce5-400e-a404-2bb4286cc09e?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-discord-integration","name":"miniOrange Discord Integration","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19071f16-fa14-447c-ac71-73e1b4c783e1","source":"wordfence","cve":"CVE-2024-35693","title":"12 Step Meeting List <= 3.14.33 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19071f16-fa14-447c-ac71-73e1b4c783e1?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.14.33","to_inclusive":true,"patched_in":"3.14.34"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:47:28Z"},{"id":"wordfence:1907308f-a722-48ce-8da4-a6c21ee29575","source":"wordfence","cve":"CVE-2025-14378","title":"Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1907308f-a722-48ce-8da4-a6c21ee29575?source=api-prod","affected":[{"type":"plugin","slug":"quick-testimonials","name":"Quick Testimonials","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:10:59Z","updated":"2025-12-13T04:31:21Z"},{"id":"wordfence:190a21cd-9716-4a57-a793-63309c339427","source":"wordfence","cve":"CVE-2024-13520","title":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190a21cd-9716-4a57-a793-63309c339427?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2025-02-19T21:09:28Z","updated":"2025-03-03T15:34:48Z"},{"id":"wordfence:190a3b11-c6ca-4666-8c7f-b22bb4a4961d","source":"wordfence","cve":"CVE-2025-3866","title":"Add Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190a3b11-c6ca-4666-8c7f-b22bb4a4961d?source=api-prod","affected":[{"type":"plugin","slug":"add-google-plus-one-social-share-button","name":"Add Google +1 (Plus one) social share Button","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T18:32:13Z","updated":"2025-04-25T06:45:27Z"},{"id":"wordfence:190c8744-b8e0-4722-ae0a-f18d7c058dfe","source":"wordfence","cve":"CVE-2026-31916","title":"Latest Post Shortcode <= 14.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190c8744-b8e0-4722-ae0a-f18d7c058dfe?source=api-prod","affected":[{"type":"plugin","slug":"latest-post-shortcode","name":"Latest Post Shortcode","from":"*","from_inclusive":true,"to":"14.2.1","to_inclusive":true,"patched_in":"14.2.2"}],"published":"2026-02-03T00:00:00Z","updated":"2026-04-15T20:43:18Z"},{"id":"wordfence:190d9996-5a3b-477f-9191-d60ce3c33dd9","source":"wordfence","cve":"CVE-2026-107754","title":"GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190d9996-5a3b-477f-9191-d60ce3c33dd9?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.190","to_inclusive":true,"patched_in":"2.8.191"}],"published":"2026-10-13T19:14:23Z","updated":"2026-10-14T07:43:31Z"},{"id":"wordfence:190edd82-840d-4468-8f5a-127cce049336","source":"wordfence","cve":"","title":"YITH Request a Quote for WooCommerce <= 1.6.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190edd82-840d-4468-8f5a-127cce049336?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:190f4aa9-3d99-494a-8ef4-e099dedbd9e4","source":"wordfence","cve":"CVE-2025-26573","title":"Rizzi Guestbook <= 4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/190f4aa9-3d99-494a-8ef4-e099dedbd9e4?source=api-prod","affected":[{"type":"plugin","slug":"rizzi-guestbook","name":"Rizzi Guestbook","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:16:19Z"},{"id":"wordfence:191759f5-8801-4483-933c-77811b63eb4f","source":"wordfence","cve":"CVE-2024-32589","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191759f5-8801-4483-933c-77811b63eb4f?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T13:36:30Z"},{"id":"wordfence:1917eabd-0ba2-4878-87ea-8c0c9c00b6f5","source":"wordfence","cve":"","title":"Shortcode For Current Date <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1917eabd-0ba2-4878-87ea-8c0c9c00b6f5?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-for-current-date","name":"Shortcode for Current Date","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2022-07-07T00:00:00Z","updated":"2025-01-31T20:31:59Z"},{"id":"wordfence:191a74ed-d5f2-4347-9969-10102d1504b8","source":"wordfence","cve":"CVE-2025-27357","title":"\u00d6nceki Yaz\u0131 Link <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191a74ed-d5f2-4347-9969-10102d1504b8?source=api-prod","affected":[{"type":"plugin","slug":"onceki-yazi-linki","name":"\u00d6nceki Yaz\u0131 Link","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:40:13Z"},{"id":"wordfence:191a98c7-ea37-48a7-b04b-c0941fa0b22a","source":"wordfence","cve":"CVE-2025-69107","title":"Rosaleen <= 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191a98c7-ea37-48a7-b04b-c0941fa0b22a?source=api-prod","affected":[{"type":"theme","slug":"rosaleen","name":"Rosaleen","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:43:38Z"},{"id":"wordfence:191c3c86-0704-4d3c-b7ba-22cefbdc65f1","source":"wordfence","cve":"CVE-2024-37112","title":"WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191c3c86-0704-4d3c-b7ba-22cefbdc65f1?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-24T22:19:54Z"},{"id":"wordfence:191c7d9e-79a1-400d-8f05-5fab422ae042","source":"wordfence","cve":"CVE-2026-66629","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191c7d9e-79a1-400d-8f05-5fab422ae042?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-09T16:11:28Z"},{"id":"wordfence:191d5bcc-70d8-430b-9215-00ffdc04be87","source":"wordfence","cve":"CVE-2023-6991","title":"JSM file_get_contents() Shortcode <= 2.7.0 - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191d5bcc-70d8-430b-9215-00ffdc04be87?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-get-contents","name":"JSM file_get_contents() Shortcode","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:191ec7ea-6ca7-4943-8709-f372ae5a81c7","source":"wordfence","cve":"CVE-2026-11901","title":"WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191ec7ea-6ca7-4943-8709-f372ae5a81c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-07-10T16:57:17Z","updated":"2026-07-11T05:35:44Z"},{"id":"wordfence:191f5bc3-9b8e-4ec7-b8b3-91572ef97911","source":"wordfence","cve":"CVE-2026-40744","title":"Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191f5bc3-9b8e-4ec7-b8b3-91572ef97911?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.10.1.2","to_inclusive":true,"patched_in":"2.10.1.5"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-07T14:02:19Z"},{"id":"wordfence:191fdd77-1119-4cd1-9de2-8a7e39a3385a","source":"wordfence","cve":"CVE-2025-32522","title":"License Manager for WooCommerce <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/191fdd77-1119-4cd1-9de2-8a7e39a3385a?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:11:29Z"},{"id":"wordfence:19202eb5-9a04-4484-8ca2-746610c31fe6","source":"wordfence","cve":"CVE-2024-32579","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19202eb5-9a04-4484-8ca2-746610c31fe6?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:38:22Z"},{"id":"wordfence:1920b343-f0fb-47f0-ad87-27d600b7ac80","source":"wordfence","cve":"CVE-2026-84904","title":"King Addons for Elementor 51.1.56 - 51.1.80 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1920b343-f0fb-47f0-ad87-27d600b7ac80?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.80","to_inclusive":true,"patched_in":"51.1.81"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:20:58Z"},{"id":"wordfence:1921371f-5d07-4288-8e8e-d5f43c619357","source":"wordfence","cve":"CVE-2026-27078","title":"Emaurri <= 1.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1921371f-5d07-4288-8e8e-d5f43c619357?source=api-prod","affected":[{"type":"theme","slug":"emaurri","name":"Emaurri - Architecture and Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-03-10T00:00:00Z","updated":"2026-04-15T13:41:23Z"},{"id":"wordfence:1921dcf9-d23b-4566-a0e5-9e9d5875ef82","source":"wordfence","cve":"CVE-2024-30520","title":"Carousel Anything For WPBakery Page Builder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1921dcf9-d23b-4566-a0e5-9e9d5875ef82?source=api-prod","affected":[{"type":"plugin","slug":"carousel-anything","name":"Carousel Anything For WPBakery Page Builder \u2013 Touch Slider and Carousel","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:21:25Z"},{"id":"wordfence:192335c4-b244-4308-bd3a-cf96c1461309","source":"wordfence","cve":"CVE-2023-47758","title":"Multi Step Form <= 1.7.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192335c4-b244-4308-bd3a-cf96c1461309?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.12","to_inclusive":true,"patched_in":"1.7.13"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19233e1d-fcbe-4391-a7a7-03524698ab18","source":"wordfence","cve":"CVE-2026-32341","title":"Benevolent <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19233e1d-fcbe-4391-a7a7-03524698ab18?source=api-prod","affected":[{"type":"theme","slug":"benevolent","name":"Benevolent","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:47:04Z"},{"id":"wordfence:19235851-bea5-46ec-92cd-8d800e1aa23a","source":"wordfence","cve":"CVE-2026-24536","title":"Webpushr <= 4.38.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19235851-bea5-46ec-92cd-8d800e1aa23a?source=api-prod","affected":[{"type":"plugin","slug":"webpushr-web-push-notifications","name":"Web Push Notifications \u2013 Webpushr","from":"*","from_inclusive":true,"to":"4.38.0","to_inclusive":true,"patched_in":"4.39.0"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-06T20:22:58Z"},{"id":"wordfence:192428e8-8ace-411b-b668-6c5fc27899b5","source":"wordfence","cve":"CVE-2026-95589","title":"Advanced Partial Payment or Deposit for WooCommerce <= 4.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192428e8-8ace-411b-b668-6c5fc27899b5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-partial-payment-or-deposit-for-woocommerce","name":"Advanced Partial Payment or Deposit for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:33:08Z"},{"id":"wordfence:19257e49-addb-4882-af5f-8de0d90a4a86","source":"wordfence","cve":"CVE-2025-13137","title":"Live Sales Notification for Woocommerce \u2013 Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19257e49-addb-4882-af5f-8de0d90a4a86?source=api-prod","affected":[{"type":"plugin","slug":"woomotiv","name":"Live Sales Notification for Woocommerce \u2013 Woomotiv","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:44:31Z","updated":"2025-12-06T05:49:21Z"},{"id":"wordfence:192728d1-786d-41eb-9133-ad8517052478","source":"wordfence","cve":"CVE-2022-41623","title":"ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium <= 1.1.0 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192728d1-786d-41eb-9133-ad8517052478?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-alidropship","name":"ALD - AliExpress Dropshipping and Fulfillment for WooCommerce Premium","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19276873-0626-4ad7-a198-ed3312effbee","source":"wordfence","cve":"CVE-2024-34553","title":"Stockholm Core <= 2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19276873-0626-4ad7-a198-ed3312effbee?source=api-prod","affected":[{"type":"plugin","slug":"stockholm-core","name":"Stockholm Core","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:54:51Z"},{"id":"wordfence:19286e18-f30d-40e8-80fa-cd1b4d065f80","source":"wordfence","cve":"CVE-2024-39652","title":"WooCommerce PDF Vouchers <= 4.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19286e18-f30d-40e8-80fa-cd1b4d065f80?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:31:17Z"},{"id":"wordfence:1928f8e4-8bbe-4a3f-8284-aa12ca2f5176","source":"wordfence","cve":"CVE-2024-0761","title":"File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames","severity":"high","cvss":8.1,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1928f8e4-8bbe-4a3f-8284-aa12ca2f5176?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2024-01-22T00:00:00Z","updated":"2025-10-30T01:48:06Z"},{"id":"wordfence:19290ae2-0eec-4b95-baa6-44f507a75e0a","source":"wordfence","cve":"CVE-2026-13703","title":"SEO Redirection Plugin \u2013 301 Redirect Manager <= 9.18 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19290ae2-0eec-4b95-baa6-44f507a75e0a?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"9.18","to_inclusive":true,"patched_in":"9.19"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-17T16:05:17Z"},{"id":"wordfence:192b5920-5405-49b8-8224-3afb36f3f816","source":"wordfence","cve":"CVE-2022-4829","title":"Show-Hide / Collapse-Expand <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192b5920-5405-49b8-8224-3afb36f3f816?source=api-prod","affected":[{"type":"plugin","slug":"show-hidecollapse-expand","name":"Show-Hide / Collapse-Expand","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:192b8ab0-f80e-4c0e-9cc0-df567d5791a8","source":"wordfence","cve":"CVE-2024-12076","title":"Target Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192b8ab0-f80e-4c0e-9cc0-df567d5791a8?source=api-prod","affected":[{"type":"plugin","slug":"brid-video-easy-publish","name":"Target Video Easy Publish","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2025-01-24T19:11:39Z","updated":"2025-01-25T07:24:13Z"},{"id":"wordfence:192e303f-3792-4dde-a4a9-30944720cabb","source":"wordfence","cve":"CVE-2025-47502","title":"Mollie Forms <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/192e303f-3792-4dde-a4a9-30944720cabb?source=api-prod","affected":[{"type":"plugin","slug":"mollie-forms","name":"Mollie Forms","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.7.13"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:18:52Z"},{"id":"wordfence:193178a6-d566-4e0a-aa74-8d80a7c8ba04","source":"wordfence","cve":"CVE-2024-11414","title":"RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193178a6-d566-4e0a-aa74-8d80a7c8ba04?source=api-prod","affected":[{"type":"plugin","slug":"recipepress-reloaded","name":"RecipePress Reloaded","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:43:30Z","updated":"2024-11-21T02:06:22Z"},{"id":"wordfence:1932c9b4-2fea-40f8-9748-09ded8143c11","source":"wordfence","cve":"CVE-2024-10470","title":"WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1932c9b4-2fea-40f8-9748-09ded8143c11?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"4.962","to_inclusive":true,"patched_in":"4.963"}],"published":"2024-11-08T17:34:40Z","updated":"2024-11-09T05:40:22Z"},{"id":"wordfence:19336fd5-a974-442b-baac-3101b38d6a20","source":"wordfence","cve":"CVE-2026-22412","title":"Eona <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19336fd5-a974-442b-baac-3101b38d6a20?source=api-prod","affected":[{"type":"theme","slug":"eona","name":"Eona - Fashion WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:34:47Z"},{"id":"wordfence:19339b9f-8242-44a5-8239-7ef347ffbaad","source":"wordfence","cve":"CVE-2026-1393","title":"Add Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19339b9f-8242-44a5-8239-7ef347ffbaad?source=api-prod","affected":[{"type":"plugin","slug":"add-google-social-profiles-to-knowledge-graph-box","name":"Add Google Social Profiles to Knowledge Graph Box","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:19:44Z","updated":"2026-03-21T03:26:36Z"},{"id":"wordfence:19342af0-9389-4fc3-8946-56d738a73d04","source":"wordfence","cve":"CVE-2025-1286","title":"Download HTML TinyMCE Button <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19342af0-9389-4fc3-8946-56d738a73d04?source=api-prod","affected":[{"type":"plugin","slug":"download-html-tinymce-button","name":"Download HTML TinyMCE Button","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:06:48Z"},{"id":"wordfence:19388563-d0d0-4f15-966f-706b08bb8331","source":"wordfence","cve":"CVE-2025-23812","title":"Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19388563-d0d0-4f15-966f-706b08bb8331?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-round-robin-lead-distribution","name":"Contact Form 7 Round Robin Lead Distribution","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:17:12Z"},{"id":"wordfence:193b3f41-1e11-4265-8922-92f6a91ec426","source":"wordfence","cve":"CVE-2026-118637","title":"Simple Download Monitor < 4.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193b3f41-1e11-4265-8922-92f6a91ec426?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":false,"patched_in":"4.1.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:33:37Z"},{"id":"wordfence:193bd3b8-1af9-496a-ad77-dd5253612272","source":"wordfence","cve":"CVE-2026-57726","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193bd3b8-1af9-496a-ad77-dd5253612272?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"6.0.13"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:57:25Z"},{"id":"wordfence:193c9fe9-17bc-47e7-b93d-dfcebcf8004d","source":"wordfence","cve":"CVE-2024-13343","title":"WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193c9fe9-17bc-47e7-b93d-dfcebcf8004d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"31.3","to_inclusive":true,"patched_in":"31.4"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:12Z"},{"id":"wordfence:193d9625-34ab-497f-987e-5a53ca01e73e","source":"wordfence","cve":"CVE-2025-5340","title":"Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193d9625-34ab-497f-987e-5a53ca01e73e?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-elementor","name":"Music Player for Elementor \u2013 Audio Player & Podcast Player","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-06-02T22:20:46Z","updated":"2025-06-03T11:22:26Z"},{"id":"wordfence:193eeb92-f0af-4c6a-ac44-3166023a3006","source":"wordfence","cve":"CVE-2024-5638","title":"Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193eeb92-f0af-4c6a-ac44-3166023a3006?source=api-prod","affected":[{"type":"theme","slug":"formula","name":"Formula","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":"0.5.2"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T05:44:29Z"},{"id":"wordfence:193f0a25-4400-40e0-8070-94fbf9c28c11","source":"wordfence","cve":"CVE-2024-56053","title":"WPLMS < 1.9.9.5.3 - Authenticated (Instructor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/193f0a25-4400-40e0-8070-94fbf9c28c11?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.3","to_inclusive":false,"patched_in":"1.9.9.5.3"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:47:44Z"},{"id":"wordfence:19418da4-bef4-4cbc-901c-f2aeee39b3cf","source":"wordfence","cve":"CVE-2024-21752","title":"Ajax Search Lite <= 4.11.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19418da4-bef4-4cbc-901c-f2aeee39b3cf?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.11.4","to_inclusive":true,"patched_in":"4.11.5"}],"published":"2024-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1941f1e7-c65f-4894-8de7-1aeacf35fc69","source":"wordfence","cve":"CVE-2026-11588","title":"EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1941f1e7-c65f-4894-8de7-1aeacf35fc69?source=api-prod","affected":[{"type":"plugin","slug":"eonsr-aeo-agent","name":"EONSR AEO Agent","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-15T20:59:17Z"},{"id":"wordfence:19439622-6396-4f10-ab71-aa243b6812fa","source":"wordfence","cve":"CVE-2024-3053","title":"Forminator \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19439622-6396-4f10-ab71-aa243b6812fa?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.29.2","to_inclusive":true,"patched_in":"1.29.3"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-09T18:58:34Z"},{"id":"wordfence:194a4dd0-9cd2-477b-8926-360f8a8a0a0f","source":"wordfence","cve":"CVE-2025-53260","title":"File Manager Plugin For Wordpress <= 7.5 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/194a4dd0-9cd2-477b-8926-360f8a8a0a0f?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-plugin-for-wordpress","name":"File Manager Plugin For WordPress","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:33:14Z"},{"id":"wordfence:194ee4a0-87c3-42e5-9676-8dd355838b78","source":"wordfence","cve":"CVE-2026-4347","title":"MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/194ee4a0-87c3-42e5-9676-8dd355838b78?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-04-01T16:50:15Z","updated":"2026-04-02T05:28:10Z"},{"id":"wordfence:194f71d8-43d7-4a1f-8390-2c1efd0b0a23","source":"wordfence","cve":"CVE-2022-36296","title":"ActiveDEMAND <= 0.2.27 - Missing Authorization Checks","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/194f71d8-43d7-4a1f-8390-2c1efd0b0a23?source=api-prod","affected":[{"type":"plugin","slug":"activedemand","name":"ActiveDEMAND","from":"*","from_inclusive":true,"to":"0.2.27","to_inclusive":true,"patched_in":"0.2.28"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:194face3-36ac-4137-af9a-0b98f60e3afb","source":"wordfence","cve":"CVE-2020-36737","title":"Import / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/194face3-36ac-4137-af9a-0b98f60e3afb?source=api-prod","affected":[{"type":"plugin","slug":"astra-import-export","name":"Import / Export Customizer Settings","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1951ad6c-17b5-44ae-85e2-376b99df742e","source":"wordfence","cve":"CVE-2024-1693","title":"SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.70","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:20Z"},{"id":"wordfence:1954040c-2188-48b7-9f21-9a0c851c9165","source":"wordfence","cve":"CVE-2024-9416","title":"Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1954040c-2188-48b7-9f21-9a0c851c9165?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2025-04-02T23:40:23Z","updated":"2025-04-03T12:22:37Z"},{"id":"wordfence:19544e08-fa14-4251-bcc2-e46ebccca075","source":"wordfence","cve":"CVE-2026-14226","title":"Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19544e08-fa14-4251-bcc2-e46ebccca075?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.28","to_inclusive":false,"patched_in":"3.12.28"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-14T15:21:58Z"},{"id":"wordfence:1954a659-668f-4d09-b6d5-d1dbafb5b030","source":"wordfence","cve":"CVE-2024-56263","title":"GS Shots for Dribbble <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1954a659-668f-4d09-b6d5-d1dbafb5b030?source=api-prod","affected":[{"type":"plugin","slug":"gs-dribbble-portfolio","name":"GS Shots for Dribbble","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:12:57Z"},{"id":"wordfence:19565648-d080-416e-b421-5cd08a7c62ab","source":"wordfence","cve":"CVE-2025-29012","title":"CF7 7 Mailchimp Add-on < 2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19565648-d080-416e-b421-5cd08a7c62ab?source=api-prod","affected":[{"type":"plugin","slug":"CF7-mailchimp-addon","name":"CF7 7 Mailchimp Add-on","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2025-07-04T00:00:00Z","updated":"2026-02-24T22:26:08Z"},{"id":"wordfence:1957089c-615b-470e-95f1-59d156c09694","source":"wordfence","cve":"CVE-2026-92997","title":"Click n Chat <= 1.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1957089c-615b-470e-95f1-59d156c09694?source=api-prod","affected":[{"type":"plugin","slug":"click-n-chat","name":"Click n Chat (Chat Widget Integration)","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:46:02Z"},{"id":"wordfence:195788de-129e-4112-bcab-a7835c8164ca","source":"wordfence","cve":"CVE-2024-43253","title":"Smart Online Order for Clover <= 1.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/195788de-129e-4112-bcab-a7835c8164ca?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-08-12T00:00:00Z","updated":"2024-09-06T15:28:57Z"},{"id":"wordfence:1958c166-282d-4469-b79d-4e959e0492c1","source":"wordfence","cve":"","title":"Post Meta Data Manager <= 1.2.0 - Missing Authorization to Post, Term, and User Meta Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1958c166-282d-4469-b79d-4e959e0492c1?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:195ac5fe-11e9-4ae4-b9ef-2bf1692789a9","source":"wordfence","cve":"CVE-2025-57968","title":"VikRestaurants Table Reservations and Take-Away <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/195ac5fe-11e9-4ae4-b9ef-2bf1692789a9?source=api-prod","affected":[{"type":"plugin","slug":"vikrestaurants","name":"VikRestaurants Table Reservations and Take-Away","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-12-09T17:18:00Z"},{"id":"wordfence:195cc773-b3ea-4619-af2d-b106a9d23a6a","source":"wordfence","cve":"CVE-2024-37251","title":"Advanced Custom Fields Pro <= 6.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/195cc773-b3ea-4619-af2d-b106a9d23a6a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-06-26T00:00:00Z","updated":"2025-01-17T13:42:25Z"},{"id":"wordfence:195f86a5-e3dc-4414-bbe3-dea312bf30a9","source":"wordfence","cve":"CVE-2026-15414","title":"Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/195f86a5-e3dc-4414-bbe3-dea312bf30a9?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-07-31T12:27:03Z","updated":"2026-08-01T01:29:57Z"},{"id":"wordfence:19617191-be47-4067-b53d-cd3f2ba51698","source":"wordfence","cve":"CVE-2025-49364","title":"Ludos Paradise <= 2.1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19617191-be47-4067-b53d-cd3f2ba51698?source=api-prod","affected":[{"type":"theme","slug":"ludos-paradise","name":"Ludos Paradise | Video Gaming Blog & Clan Esports WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:21:31Z"},{"id":"wordfence:196cbc3f-b794-49e2-8769-b5277c2b8f76","source":"wordfence","cve":"CVE-2021-25014","title":"Ibtana \u2013 WordPress Website Builder <= 1.1.4.7 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/196cbc3f-b794-49e2-8769-b5277c2b8f76?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.1.4.9","to_inclusive":false,"patched_in":"1.1.4.9"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:196d472b-b268-48f1-8dda-ee6d9e659483","source":"wordfence","cve":"CVE-2025-62026","title":"Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/196d472b-b268-48f1-8dda-ee6d9e659483?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.13.2","to_inclusive":true,"patched_in":"3.2.14"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:15:25Z"},{"id":"wordfence:196e629f-7c77-4bcb-8224-305a0108b630","source":"wordfence","cve":"CVE-2024-12365","title":"W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery","severity":"high","cvss":8.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/196e629f-7c77-4bcb-8224-305a0108b630?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-01-13T17:58:37Z","updated":"2025-01-14T07:05:40Z"},{"id":"wordfence:19700658-1bef-4e85-a995-d86fff508cdf","source":"wordfence","cve":"CVE-2025-11186","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19700658-1bef-4e85-a995-d86fff508cdf?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-11-21T16:28:14Z","updated":"2025-11-22T05:07:43Z"},{"id":"wordfence:197252d7-3098-43cd-b680-3d857ddb29ba","source":"wordfence","cve":"CVE-2026-116752","title":"GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197252d7-3098-43cd-b680-3d857ddb29ba?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.197","to_inclusive":true,"patched_in":"2.8.198"}],"published":"2026-10-30T20:46:33Z","updated":"2026-10-31T09:29:25Z"},{"id":"wordfence:1972c2f5-636e-4891-a0fb-e80207787e43","source":"wordfence","cve":"CVE-2024-49275","title":"IdeaPush <= 8.69 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1972c2f5-636e-4891-a0fb-e80207787e43?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.69","to_inclusive":true,"patched_in":"8.71"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:39:27Z"},{"id":"wordfence:19737921-5d5e-4a1a-82f7-e771cccfff49","source":"wordfence","cve":"CVE-2025-49892","title":"Pending Order Bot <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19737921-5d5e-4a1a-82f7-e771cccfff49?source=api-prod","affected":[{"type":"plugin","slug":"pending-order-bot","name":"Pending Order Bot","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-25T17:24:34Z"},{"id":"wordfence:19738a82-8c31-45bb-a869-68e357299eb5","source":"wordfence","cve":"CVE-2025-13403","title":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19738a82-8c31-45bb-a869-68e357299eb5?source=api-prod","affected":[{"type":"plugin","slug":"employee-spotlight","name":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-12-12T14:37:44Z","updated":"2026-03-27T10:52:12Z"},{"id":"wordfence:19743a65-00be-47ec-a2c2-a6bac759b745","source":"wordfence","cve":"CVE-2024-50445","title":"Selection Lite <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19743a65-00be-47ec-a2c2-a6bac759b745?source=api-prod","affected":[{"type":"plugin","slug":"selection-lite","name":"Selection Lite","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:47:42Z"},{"id":"wordfence:197449f5-9304-49df-9261-a354145fc00e","source":"wordfence","cve":"CVE-2026-4388","title":"Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197449f5-9304-49df-9261-a354145fc00e?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.40","to_inclusive":true,"patched_in":"1.15.41"}],"published":"2026-04-13T13:52:02Z","updated":"2026-04-14T02:25:48Z"},{"id":"wordfence:197760d1-395d-4dfb-aaa7-5fc5fc0a1ecb","source":"wordfence","cve":"CVE-2026-16143","title":"VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197760d1-395d-4dfb-aaa7-5fc5fc0a1ecb?source=api-prod","affected":[{"type":"plugin","slug":"vikrentitems","name":"VikRentItems Flexible Rental Management System","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-08-04T16:07:23Z","updated":"2026-08-05T04:25:24Z"},{"id":"wordfence:1978fd4f-f130-4e72-85df-24a6f9aebfe2","source":"wordfence","cve":"CVE-2026-1845","title":"Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1978fd4f-f130-4e72-85df-24a6f9aebfe2?source=api-prod","affected":[{"type":"plugin","slug":"re-pro","name":"Real Estate Pro","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:15:26Z","updated":"2026-04-22T07:45:31Z"},{"id":"wordfence:19796773-3d5f-458d-aab1-743b6835c71b","source":"wordfence","cve":"CVE-2023-30868","title":"CMS Tree Page View <= 1.6.7 - Reflected Cross-Site Scripting via 'post_type'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19796773-3d5f-458d-aab1-743b6835c71b?source=api-prod","affected":[{"type":"plugin","slug":"cms-tree-page-view","name":"CMS Tree Page View \u2013 Reorder Pages with a Drag-and-Drop Tree","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":false,"patched_in":"1.6.8"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:197be163-4504-4caa-b729-c3293463cfb5","source":"wordfence","cve":"CVE-2025-4396","title":"Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197be163-4504-4caa-b729-c3293463cfb5?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.27.5","to_inclusive":true,"patched_in":"2.27.6"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.24.4","to_inclusive":true,"patched_in":"4.24.5"}],"published":"2025-05-12T14:38:29Z","updated":"2025-05-16T17:36:36Z"},{"id":"wordfence:197efd6a-b0f4-459d-b7e5-f8ff5b5e3003","source":"wordfence","cve":"CVE-2022-36340","title":"MailOptin <= 1.2.49.0 - Missing Authorization to Cache Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/197efd6a-b0f4-459d-b7e5-f8ff5b5e3003?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.49.0","to_inclusive":true,"patched_in":"1.2.50.0"}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1980418a-f0e2-436c-b1b1-d1d822ca45cf","source":"wordfence","cve":"CVE-2026-110894","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1980418a-f0e2-436c-b1b1-d1d822ca45cf?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"1.12.3"}],"published":"2026-10-22T07:32:00Z","updated":"2026-10-23T18:38:51Z"},{"id":"wordfence:1981e94e-f565-4e3d-9464-f7f2fc023341","source":"wordfence","cve":"CVE-2026-74018","title":"Warehouse Cargo <= 2.7.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1981e94e-f565-4e3d-9464-f7f2fc023341?source=api-prod","affected":[{"type":"theme","slug":"warehouse-cargo","name":"Warehouse Cargo","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:06:29Z"},{"id":"wordfence:1983cc82-c527-47d9-84ba-f903dda1b1ca","source":"wordfence","cve":"CVE-2021-24997","title":"WP Guppy < 1.3 - Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1983cc82-c527-47d9-84ba-f903dda1b1ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-guppy","name":"WP Guppy","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1984abee-a74c-48d7-874f-c4421243e5e5","source":"wordfence","cve":"CVE-2026-93485","title":"WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1984abee-a74c-48d7-874f-c4421243e5e5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:03:49Z"},{"id":"wordfence:1984f80e-06ec-4d7f-9a75-e05e7b73b57c","source":"wordfence","cve":"CVE-2026-92245","title":"Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1984f80e-06ec-4d7f-9a75-e05e7b73b57c?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.32","to_inclusive":true,"patched_in":"1.6.12.33"}],"published":"2026-09-30T14:44:49Z","updated":"2026-10-01T03:28:23Z"},{"id":"wordfence:19868c11-67a7-420f-911d-520e00f2f4f5","source":"wordfence","cve":"CVE-2026-57768","title":"Houzez Login Register <= 3.3.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19868c11-67a7-420f-911d-520e00f2f4f5?source=api-prod","affected":[{"type":"plugin","slug":"houzez-login-register","name":"Houzez Login Register","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T17:37:29Z"},{"id":"wordfence:1988ff5e-2d3f-4901-8bcc-eb0a7da7566c","source":"wordfence","cve":"CVE-2024-11832","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1988ff5e-2d3f-4901-8bcc-eb0a7da7566c?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.4.4","to_inclusive":true,"patched_in":"2.8.5.3"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:49Z"},{"id":"wordfence:1989fe85-5c32-4671-bd20-f9d05cb5034c","source":"wordfence","cve":"CVE-2024-11900","title":"Portfolio \u2013 Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1989fe85-5c32-4671-bd20-f9d05cb5034c?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-pro","name":"Portfolio \u2013 Filterable Masonry Portfolio Gallery for Professionals","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T10:39:21Z","updated":"2024-12-16T23:24:16Z"},{"id":"wordfence:198a24e6-af98-42ed-bf58-73b7ec99838b","source":"wordfence","cve":"CVE-2012-10017","title":"Portfolio Plugin <= 2.04 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198a24e6-af98-42ed-bf58-73b7ec99838b?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-by-lisa-westlund","name":"Portfolio Plugin","from":"*","from_inclusive":true,"to":"2.04","to_inclusive":true,"patched_in":"2.05"}],"published":"2012-07-24T00:00:00Z","updated":"2024-02-07T14:51:36Z"},{"id":"wordfence:198ad1bf-7ce1-4367-bef7-1f58113c0719","source":"wordfence","cve":"CVE-2024-30486","title":"Media Library Folders <= 8.1.7 - Authenticated (Author+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198ad1bf-7ce1-4367-bef7-1f58113c0719?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.1.7","to_inclusive":true,"patched_in":"8.1.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:00:17Z"},{"id":"wordfence:198b56cd-ac1a-4963-a2db-0a04f6b2fa2c","source":"wordfence","cve":"CVE-2025-22816","title":"Power Mag <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198b56cd-ac1a-4963-a2db-0a04f6b2fa2c?source=api-prod","affected":[{"type":"theme","slug":"power-mag","name":"Power Mag","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:03:00Z"},{"id":"wordfence:198c0b6e-e22f-44f5-84e6-c23f0fd444f6","source":"wordfence","cve":"CVE-2026-84899","title":"VikWidgetsLoader \u2013 Collection of Widgets < 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198c0b6e-e22f-44f5-84e6-c23f0fd444f6?source=api-prod","affected":[{"type":"plugin","slug":"vikwidgetsloader","name":"VikWidgetsLoader \u2013 Collection of Widgets","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:03:23Z"},{"id":"wordfence:198cb3bb-73fe-45ae-b8e0-b7ee8dda9547","source":"wordfence","cve":"CVE-2024-1158","title":"Post Form \u2013 Registration Form \u2013 Profile Form for User Profiles \u2013 Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198cb3bb-73fe-45ae-b8e0-b7ee8dda9547?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-13T15:26:35Z"},{"id":"wordfence:198e8f56-5354-4e5d-af51-54e95d34e25c","source":"wordfence","cve":"","title":"Recently <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/198e8f56-5354-4e5d-af51-54e95d34e25c?source=api-prod","affected":[{"type":"plugin","slug":"recently","name":"Recently","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19919262-404c-43cb-b7a4-c401542779db","source":"wordfence","cve":"CVE-2026-119035","title":"Schema & Structured Data for WP & AMP < 1.70 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19919262-404c-43cb-b7a4-c401542779db?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.70","to_inclusive":false,"patched_in":"1.70"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:46Z"},{"id":"wordfence:19958187-7eb1-479e-bd36-d40974ae65ca","source":"wordfence","cve":"CVE-2023-51358","title":"Block IPs for Gravity Forms <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19958187-7eb1-479e-bd36-d40974ae65ca?source=api-prod","affected":[{"type":"plugin","slug":"gf-block-ips","name":"Block IPs for Gravity Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19977399-5ea9-4ebb-9be8-dbbc91d1174c","source":"wordfence","cve":"CVE-2026-42701","title":"YayMail \u2013 WooCommerce Email Customizer <= 4.4.6 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19977399-5ea9-4ebb-9be8-dbbc91d1174c?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-10-13T12:49:41Z","updated":"2026-11-03T19:58:33Z"},{"id":"wordfence:19983f79-b439-4bb0-8f29-8312f1ff9791","source":"wordfence","cve":"CVE-2023-2705","title":"gAppointments - Appointment booking addon for Gravity Forms <= 1.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19983f79-b439-4bb0-8f29-8312f1ff9791?source=api-prod","affected":[{"type":"plugin","slug":"gAppointments","name":"gAppointments - Appointment booking addon for Gravity Forms","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1998cadb-2eb3-4819-aa7c-59e4f777c7f8","source":"wordfence","cve":"CVE-2023-7065","title":"Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1998cadb-2eb3-4819-aa7c-59e4f777c7f8?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2024.4","to_inclusive":true,"patched_in":"2024.5"}],"published":"2024-05-03T00:00:00Z","updated":"2024-07-29T21:35:56Z"},{"id":"wordfence:199a280f-a629-44f5-8ebe-399d86b5e0f1","source":"wordfence","cve":"","title":"Social Media Widget by Acurax < 2.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/199a280f-a629-44f5-8ebe-399d86b5e0f1?source=api-prod","affected":[{"type":"plugin","slug":"acurax-social-media-widget","name":"Social Media Widget by Acurax","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2015-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:199a4e3d-fad6-4923-b804-fcb1c6980381","source":"wordfence","cve":"CVE-2026-74002","title":"Booking Calendar <= 11.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/199a4e3d-fad6-4923-b804-fcb1c6980381?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.7","to_inclusive":true,"patched_in":"11.8"}],"published":"2026-09-16T18:14:00Z","updated":"2026-09-22T18:49:02Z"},{"id":"wordfence:199c5480-f1ca-4607-a236-41ef177d8b42","source":"wordfence","cve":"CVE-2025-22632","title":"WooCommerce Pricing \u2013 Product Pricing <= 1.0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/199c5480-f1ca-4607-a236-41ef177d8b42?source=api-prod","affected":[{"type":"plugin","slug":"woo-pricing-table","name":"WooCommerce Pricing \u2013 Product Pricing","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-26T22:44:08Z"},{"id":"wordfence:199d3a1f-bfde-4081-bb68-ebb6f9d360b2","source":"wordfence","cve":"CVE-2023-39166","title":"tagDiv Composer < 4.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/199d3a1f-bfde-4081-bb68-ebb6f9d360b2?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":false,"patched_in":"4.4"}],"published":"2023-07-25T00:00:00Z","updated":"2024-04-02T13:03:20Z"},{"id":"wordfence:19a10039-2fe0-4489-86bf-f93c0e18a1a0","source":"wordfence","cve":"CVE-2025-46227","title":"Custom Related Posts <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a10039-2fe0-4489-86bf-f93c0e18a1a0?source=api-prod","affected":[{"type":"plugin","slug":"custom-related-posts","name":"Custom Related Posts","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:40:43Z"},{"id":"wordfence:19a3d5a5-4673-41e7-9868-99699852f330","source":"wordfence","cve":"CVE-2025-12039","title":"BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a3d5a5-4673-41e7-9868-99699852f330?source=api-prod","affected":[{"type":"plugin","slug":"bigbuy-wc-dropshipping-connector","name":"BigBuy Dropshipping Connector for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-11-20T20:01:03Z","updated":"2026-09-14T17:09:08Z"},{"id":"wordfence:19a3fc90-b81c-4451-80e0-cead99a2dcd9","source":"wordfence","cve":"CVE-2026-4088","title":"Switch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a3fc90-b81c-4451-80e0-cead99a2dcd9?source=api-prod","affected":[{"type":"plugin","slug":"switch-cta-box","name":"Switch CTA Box","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:56Z","updated":"2026-04-22T07:45:31Z"},{"id":"wordfence:19a54519-239c-4b2e-859d-c9aac54165c7","source":"wordfence","cve":"CVE-2025-62071","title":"Social proof testimonials and reviews by Repuso <= 5.29 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a54519-239c-4b2e-859d-c9aac54165c7?source=api-prod","affected":[{"type":"plugin","slug":"social-testimonials-and-reviews-widget","name":"Reviews Widgets for Google & 45+ platforms by Repuso","from":"*","from_inclusive":true,"to":"5.29","to_inclusive":true,"patched_in":"5.30"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:10:04Z"},{"id":"wordfence:19a5a9f3-637c-42af-9775-5651a14cf516","source":"wordfence","cve":"CVE-2024-0625","title":"WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a5a9f3-637c-42af-9775-5651a14cf516?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-notification-bar","name":"WPFront Notification Bar","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:35:56Z"},{"id":"wordfence:19a672c6-e911-46bb-a55b-c5788eedca3e","source":"wordfence","cve":"CVE-2024-12529","title":"brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a672c6-e911-46bb-a55b-c5788eedca3e?source=api-prod","affected":[{"type":"plugin","slug":"brodos-net-onlineshop","name":"brodos.net Onlineshop Plugin","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:44:50Z","updated":"2025-01-25T07:24:14Z"},{"id":"wordfence:19a6b19c-244d-4b30-8db2-b4d06a5f5509","source":"wordfence","cve":"CVE-2025-14913","title":"Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a6b19c-244d-4b30-8db2-b4d06a5f5509?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission-manager-lite","name":"Frontend Post Submission Manager Lite \u2013 Guest Post and Frontend Submission Forms","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-12-25T11:05:20Z","updated":"2025-12-25T23:20:02Z"},{"id":"wordfence:19a70aa0-7075-4922-8feb-25b7fbe9da42","source":"wordfence","cve":"CVE-2023-3344","title":"Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a70aa0-7075-4922-8feb-25b7fbe9da42?source=api-prod","affected":[{"type":"plugin","slug":"auto-location-for-wp-job-manager","name":"Auto Location for WP Job Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19a8265b-4a92-41d3-a051-61c60d44bc67","source":"wordfence","cve":"CVE-2024-13101","title":"WP MediaTagger <= 4.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a8265b-4a92-41d3-a051-61c60d44bc67?source=api-prod","affected":[{"type":"plugin","slug":"wp-mediatagger","name":"WP MediaTagger","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:52:56Z"},{"id":"wordfence:19a8c690-ebdd-44a9-a042-7363b8f8b0b3","source":"wordfence","cve":"CVE-2026-120671","title":"UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a8c690-ebdd-44a9-a042-7363b8f8b0b3?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.80","to_inclusive":true,"patched_in":"1.2.81"}],"published":"2026-11-05T20:36:36Z","updated":"2026-11-06T08:38:06Z"},{"id":"wordfence:19a9b952-84db-4911-bb50-52d74ec01cb8","source":"wordfence","cve":"CVE-2026-77807","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19a9b952-84db-4911-bb50-52d74ec01cb8?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"11.0.4","to_inclusive":true,"patched_in":"11.0.5"}],"published":"2026-09-10T11:10:31Z","updated":"2026-09-10T23:27:03Z"},{"id":"wordfence:19aa5070-2336-4139-a05c-ca6f1a1a0e30","source":"wordfence","cve":"CVE-2025-32246","title":"1-Click Backup &amp; Restore Database <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19aa5070-2336-4139-a05c-ca6f1a1a0e30?source=api-prod","affected":[{"type":"plugin","slug":"1-click-backup-restore-database-by-sunbytes","name":"1-Click Backup & Restore Database","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T14:04:14Z"},{"id":"wordfence:19aa998d-4a1a-43d7-a600-3320d19ee84f","source":"wordfence","cve":"CVE-2025-49309","title":"HT Team Member <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19aa998d-4a1a-43d7-a600-3320d19ee84f?source=api-prod","affected":[{"type":"plugin","slug":"ht-team-member","name":"WP Team \u2013 WordPress Team Member Plugin","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:00:12Z"},{"id":"wordfence:19ac688c-d07c-40fa-8155-e3ae45e17b5b","source":"wordfence","cve":"CVE-2025-30784","title":"WP Subscription Forms <= 1.2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ac688c-d07c-40fa-8155-e3ae45e17b5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscription-forms","name":"WP Subscription Forms \u2013 Subscription Form Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:24:11Z"},{"id":"wordfence:19ad787d-e027-48f5-8b5f-9263338b4fc3","source":"wordfence","cve":"CVE-2024-11294","title":"Memberful <= 1.73.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ad787d-e027-48f5-8b5f-9263338b4fc3?source=api-prod","affected":[{"type":"plugin","slug":"memberful-wp","name":"Memberful \u2013 Membership Plugin","from":"*","from_inclusive":true,"to":"1.73.9","to_inclusive":true,"patched_in":"1.74.0"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T08:22:47Z"},{"id":"wordfence:19b159ca-4b41-48b4-880d-9b9dc44b3463","source":"wordfence","cve":"CVE-2026-0717","title":"LottieFiles \u2013 Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=api-prod","affected":[{"type":"plugin","slug":"lottiefiles","name":"LottieFiles","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-01-13T16:45:26Z","updated":"2026-02-06T17:36:04Z"},{"id":"wordfence:19b21013-136a-41b0-a667-39f23ccedf2e","source":"wordfence","cve":"","title":"Contact Form to DB <= 1.7.0 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b21013-136a-41b0-a667-39f23ccedf2e?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19b307a8-b01e-484a-b67f-73cbbc66a87b","source":"wordfence","cve":"CVE-2025-49968","title":"XML Travel Portal Widget <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b307a8-b01e-484a-b67f-73cbbc66a87b?source=api-prod","affected":[{"type":"plugin","slug":"oganro-reservation-widget","name":"XML Travel Portal Widget","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:44:23Z"},{"id":"wordfence:19b4a27d-d9de-4567-86cd-8ec821ee299a","source":"wordfence","cve":"CVE-2014-7957","title":"Pods <= 2.4.3 - Multiple Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b4a27d-d9de-4567-86cd-8ec821ee299a?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.5"}],"published":"2015-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19b69d1e-84fd-446e-8de3-dad73bede5bb","source":"wordfence","cve":"CVE-2024-54285","title":"SeedProd Pro <= 6.18.13 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b69d1e-84fd-446e-8de3-dad73bede5bb?source=api-prod","affected":[{"type":"plugin","slug":"seedprod-coming-soon-pro-5","name":"SeedProd Pro","from":"*","from_inclusive":true,"to":"6.18.13","to_inclusive":true,"patched_in":"6.18.14"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-31T15:46:07Z"},{"id":"wordfence:19b7cadd-b1b9-4f1d-ab30-78e0b46ad21a","source":"wordfence","cve":"CVE-2022-4480","title":"Click to Chat <= 3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19b7cadd-b1b9-4f1d-ab30-78e0b46ad21a?source=api-prod","affected":[{"type":"plugin","slug":"click-to-chat-for-whatsapp","name":"Click to Chat \u2013 HoliThemes","from":"*","from_inclusive":true,"to":"3.18","to_inclusive":true,"patched_in":"3.18.1"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19bd105a-823d-4a85-87e1-54291274a842","source":"wordfence","cve":"","title":"Export to Text <= 2.4 - Unauthenticated Post Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19bd105a-823d-4a85-87e1-54291274a842?source=api-prod","affected":[{"type":"plugin","slug":"export-to-text","name":"Export to Text","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19bd46d7-7ed9-4bef-9f8d-0e51ed59e533","source":"wordfence","cve":"CVE-2025-23728","title":"AuMenu <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19bd46d7-7ed9-4bef-9f8d-0e51ed59e533?source=api-prod","affected":[{"type":"plugin","slug":"aumenu","name":"AuMenu","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:13:19Z"},{"id":"wordfence:19bdbde1-1414-4113-890e-b6c96b8a6e11","source":"wordfence","cve":"CVE-2024-5418","title":"DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19bdbde1-1414-4113-890e-b6c96b8a6e11?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-05-30T14:31:51Z","updated":"2024-05-31T02:41:09Z"},{"id":"wordfence:19bf7a68-e76d-4740-9f35-b6084094f59b","source":"wordfence","cve":"CVE-2025-0357","title":"WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19bf7a68-e76d-4740-9f35-b6084094f59b?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.10"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-25T01:44:37Z"},{"id":"wordfence:19bf984d-fb2b-4a7e-828c-4f75175b4c1f","source":"wordfence","cve":"CVE-2016-10912","title":"Universal Analytics <= 1.3.0 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19bf984d-fb2b-4a7e-828c-4f75175b4c1f?source=api-prod","affected":[{"type":"plugin","slug":"universal-analytics","name":"Universal Analytics","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2016-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19c2d455-ae47-49bd-9bb8-1f87b0c76c32","source":"wordfence","cve":"CVE-2022-45831","title":"Image Hover Effects Plugin - Caption Hover with Carousel <= 2.8 - Unauthenticated Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c2d455-ae47-49bd-9bb8-1f87b0c76c32?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-with-carousel","name":"Image Hover Effects for Elementor with Lightbox and Flipbox","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19c370f1-322b-4c35-b100-244547373e1a","source":"wordfence","cve":"CVE-2022-4060","title":"User Post Gallery - UPG <= 2.19 - Missing Authorization to Remote Command Execution","severity":"critical","cvss":9.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c370f1-322b-4c35-b100-244547373e1a?source=api-prod","affected":[{"type":"plugin","slug":"wp-upg","name":"User Post Gallery \u2013 UPG","from":"2.19","from_inclusive":true,"to":"2.19","to_inclusive":true,"patched_in":""}],"published":"2022-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19c3d7dd-ccde-463c-abd9-f2c67961251a","source":"wordfence","cve":"CVE-2025-23922","title":"iSpring Embedder <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c3d7dd-ccde-463c-abd9-f2c67961251a?source=api-prod","affected":[{"type":"plugin","slug":"embed-ispring","name":"iSpring Embedder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:58:52Z"},{"id":"wordfence:19c463d1-41fa-4386-b755-a14d1e68c5bd","source":"wordfence","cve":"CVE-2024-8987","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c463d1-41fa-4386-b755-a14d1e68c5bd?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-10-09T13:31:04Z","updated":"2024-11-13T15:57:42Z"},{"id":"wordfence:19c4d9f5-ffc4-4778-bbf8-2bb770018c3e","source":"wordfence","cve":"CVE-2025-32631","title":"Oxygen MyData for WooCommerce <= 1.0.64 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c4d9f5-ffc4-4778-bbf8-2bb770018c3e?source=api-prod","affected":[{"type":"plugin","slug":"oxygen-mydata","name":"Oxygen MyData for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.64","to_inclusive":true,"patched_in":"1.0.65"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-21T14:56:20Z"},{"id":"wordfence:19c78420-bcd9-49b3-b958-d742ebe71db6","source":"wordfence","cve":"CVE-2026-86706","title":"Quick quotes <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c78420-bcd9-49b3-b958-d742ebe71db6?source=api-prod","affected":[{"type":"plugin","slug":"quick-quotes-wpshare247","name":"Quick quotes \u2013 WPSHARE247","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:14:11Z"},{"id":"wordfence:19c824ce-40e2-44fb-a356-6a02bd13cc67","source":"wordfence","cve":"CVE-2025-27270","title":"Residential Address Detection <= 2.5.4 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c824ce-40e2-44fb-a356-6a02bd13cc67?source=api-prod","affected":[{"type":"plugin","slug":"residential-address-detection","name":"Residential Address Detection","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:47:20Z"},{"id":"wordfence:19c88a9a-1f97-4a46-b759-9ca030d577e7","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c88a9a-1f97-4a46-b759-9ca030d577e7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19c9cf3e-553b-4cbd-9f2c-803e188a2581","source":"wordfence","cve":"CVE-2023-41800","title":"UniConsent Cookie Consent CMP for GDPR / CCPA <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19c9cf3e-553b-4cbd-9f2c-803e188a2581?source=api-prod","affected":[{"type":"plugin","slug":"uniconsent-cmp","name":"UniConsent Cookie Consent CMP \u2013 Consent Manager","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19cb39d4-f2b4-4f94-8896-ba714567e1ed","source":"wordfence","cve":"CVE-2023-3575","title":"Quiz And Survey Master <= 8.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19cb39d4-f2b4-4f94-8896-ba714567e1ed?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.10","to_inclusive":true,"patched_in":"8.1.11"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19cc7f5b-545a-4f68-bc37-269cc84364ad","source":"wordfence","cve":"CVE-2025-69326","title":"NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19cc7f5b-545a-4f68-bc37-269cc84364ad?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.7","to_inclusive":true,"patched_in":"9.1.8"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T22:03:43Z"},{"id":"wordfence:19ce52b7-15b5-4a23-bf0f-2517443b8242","source":"wordfence","cve":"CVE-2026-82124","title":"Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ce52b7-15b5-4a23-bf0f-2517443b8242?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.65","to_inclusive":true,"patched_in":"1.66"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:37:17Z"},{"id":"wordfence:19cff824-7fb7-4b60-bfc4-2157c9ecb0bf","source":"wordfence","cve":"CVE-2026-32459","title":"UpsellWP \u2013 WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19cff824-7fb7-4b60-bfc4-2157c9ecb0bf?source=api-prod","affected":[{"type":"plugin","slug":"checkout-upsell-and-order-bumps","name":"UpsellWP \u2013 Upsell and Related Products Offers for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-03-14T00:00:00Z","updated":"2026-03-19T14:56:21Z"},{"id":"wordfence:19d08a16-51c1-4255-b0e0-01307e1783ca","source":"wordfence","cve":"CVE-2023-34182","title":"LH Password Changer <= 1.55 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d08a16-51c1-4255-b0e0-01307e1783ca?source=api-prod","affected":[{"type":"plugin","slug":"lh-password-changer","name":"LH Password Changer","from":"*","from_inclusive":true,"to":"1.55","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19d12676-dbab-4954-90f7-cd8125bca881","source":"wordfence","cve":"CVE-2026-39681","title":"Homeo <= 1.2.59 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d12676-dbab-4954-90f7-cd8125bca881?source=api-prod","affected":[{"type":"theme","slug":"homeo","name":"Homeo - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.59","to_inclusive":true,"patched_in":""}],"published":"2026-02-21T00:00:00Z","updated":"2026-05-05T15:42:22Z"},{"id":"wordfence:19d15d0e-40be-434d-a4c9-d835d4f81230","source":"wordfence","cve":"CVE-2025-58811","title":"Ultimate Client Dash <= 4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d15d0e-40be-434d-a4c9-d835d4f81230?source=api-prod","affected":[{"type":"plugin","slug":"ulimate-client-dash","name":"Ultimate Client Dash","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2025-09-05T00:00:00Z","updated":"2026-05-12T14:17:15Z"},{"id":"wordfence:19d1c0ee-9f9b-42a1-8d25-f8ba07e15b0c","source":"wordfence","cve":"CVE-2025-47586","title":"Motors - Events <= 1.4.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d1c0ee-9f9b-42a1-8d25-f8ba07e15b0c?source=api-prod","affected":[{"type":"plugin","slug":"stm-motors-events","name":"Motors - Events","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T14:08:51Z"},{"id":"wordfence:19d394d8-bdc5-4cb5-b210-269197294020","source":"wordfence","cve":"CVE-2024-30441","title":"Post Grid <= 2.2.74 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d394d8-bdc5-4cb5-b210-269197294020?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.74","to_inclusive":true,"patched_in":"2.2.76"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:57:53Z"},{"id":"wordfence:19d50a14-dbef-476d-8171-24ef84f380f3","source":"wordfence","cve":"CVE-2025-62883","title":"Premmerce User Roles <= 1.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d50a14-dbef-476d-8171-24ef84f380f3?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-06-13T00:00:00Z","updated":"2026-02-24T22:17:41Z"},{"id":"wordfence:19d724f3-96fb-4834-aa56-6b8d30f0e34d","source":"wordfence","cve":"CVE-2021-24571","title":"HD Quiz <= 1.8.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d724f3-96fb-4834-aa56-6b8d30f0e34d?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz","name":"HD Quiz","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":false,"patched_in":"1.8.4"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19d89e6c-72e7-48b1-bcc6-38d1f994cff6","source":"wordfence","cve":"CVE-2025-26542","title":"Zalo Live Chat <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19d89e6c-72e7-48b1-bcc6-38d1f994cff6?source=api-prod","affected":[{"type":"plugin","slug":"zalo-live-chat","name":"Zalo Live Chat","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:17:42Z"},{"id":"wordfence:19da439e-2ff2-4119-b688-27bc7f206a5d","source":"wordfence","cve":"CVE-2026-24986","title":"Simple Membership WP user Import <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19da439e-2ff2-4119-b688-27bc7f206a5d?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership-wp-user-import","name":"Simple Membership WP user Import","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-01-20T00:00:00Z","updated":"2026-02-10T19:55:29Z"},{"id":"wordfence:19db591b-1e59-4ff7-b339-bea869083bbc","source":"wordfence","cve":"CVE-2024-43974","title":"ReviveNews <= 1.0.2 - Missing Authorization via revivenews_install_and_activate_plugins()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19db591b-1e59-4ff7-b339-bea869083bbc?source=api-prod","affected":[{"type":"theme","slug":"revivenews","name":"ReviveNews","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:01:16Z"},{"id":"wordfence:19dbf43a-708c-42fa-b4bd-5b9319ec9468","source":"wordfence","cve":"CVE-2026-123482","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19dbf43a-708c-42fa-b4bd-5b9319ec9468?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-07T16:38:37Z","updated":"2026-11-10T20:02:25Z"},{"id":"wordfence:19dc0b31-9e34-493c-ab38-6cae64c75162","source":"wordfence","cve":"","title":"WP Js External Link Info <= 1.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19dc0b31-9e34-493c-ab38-6cae64c75162?source=api-prod","affected":[{"type":"plugin","slug":"wp-js-external-link-info","name":"WP Js External Link Info","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":""}],"published":"2014-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19dd6670-2813-4944-abcd-c26fb9b82092","source":"wordfence","cve":"CVE-2023-51696","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19dd6670-2813-4944-abcd-c26fb9b82092?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.20","to_inclusive":true,"patched_in":"6.21"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19e0757c-593b-42ef-87b2-2eca23416b2d","source":"wordfence","cve":"CVE-2025-30865","title":"3DPrint Lite <= 2.1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e0757c-593b-42ef-87b2-2eca23416b2d?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.1.3.5","to_inclusive":true,"patched_in":"2.1.3.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:36:42Z"},{"id":"wordfence:19e1421d-8cb4-44b6-a982-769539b19582","source":"wordfence","cve":"CVE-2025-14128","title":"Stumble! for WordPress <= 1.1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e1421d-8cb4-44b6-a982-769539b19582?source=api-prod","affected":[{"type":"plugin","slug":"stumble-for-wordpress","name":"Stumble! for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:32:07Z","updated":"2026-01-07T09:20:52Z"},{"id":"wordfence:19e3197c-c15b-45a8-85d9-b60b06ae96db","source":"wordfence","cve":"CVE-2026-106466","title":"JWT Auth <= 3.0.2 - Unauthenticated Persistent Unauthorized Account Access","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e3197c-c15b-45a8-85d9-b60b06ae96db?source=api-prod","affected":[{"type":"plugin","slug":"jwt-auth","name":"JWT Auth \u2013 WordPress JSON Web Token Authentication","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:35:34Z"},{"id":"wordfence:19e46bdd-3dd2-4199-8efa-fb1c0d25957b","source":"wordfence","cve":"CVE-2025-69368","title":"SOHO - Photography WordPress <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e46bdd-3dd2-4199-8efa-fb1c0d25957b?source=api-prod","affected":[{"type":"theme","slug":"soho","name":"SOHO - Photography WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T20:53:11Z"},{"id":"wordfence:19e48549-8a28-4626-b0b5-b781cd01fa5b","source":"wordfence","cve":"CVE-2026-12421","title":"ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e48549-8a28-4626-b0b5-b781cd01fa5b?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2026-07-22T18:42:16Z","updated":"2026-08-25T13:54:19Z"},{"id":"wordfence:19e6bd3b-8d03-4617-8be2-3cdaeb85fac0","source":"wordfence","cve":"CVE-2021-25011","title":"WP Google Map <= 1.8.0 - Subscriber+ Arbitrary Post Deletion and Plugin Settings Update","severity":"medium","cvss":5.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e6bd3b-8d03-4617-8be2-3cdaeb85fac0?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2021-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19e73c54-9951-474d-bcc8-1fa6349d46c0","source":"wordfence","cve":"CVE-2025-23615","title":"Interactive Page Hierarchy <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e73c54-9951-474d-bcc8-1fa6349d46c0?source=api-prod","affected":[{"type":"plugin","slug":"interactive-page-hierarchy","name":"Interactive Page Hierarchy","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T21:00:44Z"},{"id":"wordfence:19e7a841-e7b0-410d-ae33-f31811efd919","source":"wordfence","cve":"CVE-2023-7269","title":"ArtPlacer Widget <= 2.21.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e7a841-e7b0-410d-ae33-f31811efd919?source=api-prod","affected":[{"type":"plugin","slug":"artplacer-widget","name":"ArtPlacer Widget","from":"*","from_inclusive":true,"to":"2.21.1","to_inclusive":true,"patched_in":"2.21.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-08-02T18:10:30Z"},{"id":"wordfence:19e89442-e9cd-4493-a338-b887b436c37c","source":"wordfence","cve":"CVE-2026-57676","title":"Simple User Avatar <= 4.9 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e89442-e9cd-4493-a338-b887b436c37c?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-avatar","name":"Simple User Avatar","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-02T11:36:21Z"},{"id":"wordfence:19e8d0a3-56b1-4d4a-ad49-f28707d3b037","source":"wordfence","cve":"CVE-2025-24555","title":"Subscription DNA <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e8d0a3-56b1-4d4a-ad49-f28707d3b037?source=api-prod","affected":[{"type":"plugin","slug":"subscriptiondna","name":"Subscription DNA\u00ae","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:22:25Z"},{"id":"wordfence:19e9735c-ddaa-4b38-ad21-b2f13c0d4461","source":"wordfence","cve":"CVE-2024-49266","title":"WP-Spreadplugin <= 4.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e9735c-ddaa-4b38-ad21-b2f13c0d4461?source=api-prod","affected":[{"type":"plugin","slug":"wp-spreadplugin","name":"WP-Spreadplugin","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:11:04Z"},{"id":"wordfence:19e9a9f7-d2e3-4ebb-b121-99c7c81ede4f","source":"wordfence","cve":"CVE-2021-24960","title":"WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e9a9f7-d2e3-4ebb-b121-99c7c81ede4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":false,"patched_in":"4.16.3"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19e9d1bb-bbdf-473d-8479-0656834c278a","source":"wordfence","cve":"CVE-2026-27997","title":"Maxify <= 1.0.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19e9d1bb-bbdf-473d-8479-0656834c278a?source=api-prod","affected":[{"type":"theme","slug":"maxify","name":"Maxify","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:37:21Z"},{"id":"wordfence:19ec4be7-200d-418b-8af2-8460edbc817a","source":"wordfence","cve":"CVE-2026-12698","title":"wpForo Forum <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Account Status Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ec4be7-200d-418b-8af2-8460edbc817a?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-17T16:05:57Z"},{"id":"wordfence:19ed8044-e7fb-482f-9a20-931ccd2a4e47","source":"wordfence","cve":"CVE-2025-27290","title":"Erima Zarinpal Donate <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ed8044-e7fb-482f-9a20-931ccd2a4e47?source=api-prod","affected":[{"type":"plugin","slug":"erima-zarinpal-donate","name":"Erima Zarinpal Donate","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:33:43Z"},{"id":"wordfence:19eec720-a223-422c-8e39-298a5c27b866","source":"wordfence","cve":"CVE-2025-32576","title":"WP shop <= 2.6.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19eec720-a223-422c-8e39-298a5c27b866?source=api-prod","affected":[{"type":"plugin","slug":"wpshop","name":"WPshop 2 \u2013 E-Commerce","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:07:59Z"},{"id":"wordfence:19ef4080-0463-4a5c-a532-4877f60c82dc","source":"wordfence","cve":"CVE-2025-28905","title":"Featured Posts Grid <= 1.7 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19ef4080-0463-4a5c-a532-4877f60c82dc?source=api-prod","affected":[{"type":"plugin","slug":"featured-posts-grid","name":"Featured Posts Grid","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:04:22Z"},{"id":"wordfence:19f05572-21e2-4fd4-b5dd-d2c423e83fa0","source":"wordfence","cve":"CVE-2026-119510","title":"MoreConvert Wishlist for WooCommerce <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f05572-21e2-4fd4-b5dd-d2c423e83fa0?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-11-07T09:00:00Z","updated":"2026-11-10T19:32:04Z"},{"id":"wordfence:19f126f8-1d59-44b5-8e0e-c37f1fbedf5a","source":"wordfence","cve":"CVE-2023-1339","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'uucss_update_rule'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f126f8-1d59-44b5-8e0e-c37f1fbedf5a?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19f2fe7c-f702-4db6-9914-2839a62ffdd5","source":"wordfence","cve":"CVE-2022-1323","title":"Discy - Social Questions and Answers WordPress Theme <= 4.9 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f2fe7c-f702-4db6-9914-2839a62ffdd5?source=api-prod","affected":[{"type":"theme","slug":"discy","name":"Discy - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19f3d3a4-1742-4e3f-97c5-acf960c3cdb5","source":"wordfence","cve":"","title":"Ultimate Form Builder Lite <= 1.3.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f3d3a4-1742-4e3f-97c5-acf960c3cdb5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-form-builder-lite","name":"Contact Form for WordPress \u2013 Ultimate Form Builder Lite","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2018-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19f737a8-21e6-49d3-95b9-24fb6e5d7af7","source":"wordfence","cve":"","title":"InPost Gallery < 2.1.2.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f737a8-21e6-49d3-95b9-24fb6e5d7af7?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.2.1","to_inclusive":false,"patched_in":"2.1.2.1"}],"published":"2016-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19f8a656-696c-4e4f-a0a6-c71010a1ee12","source":"wordfence","cve":"CVE-2024-38699","title":"Wallet System for WooCommerce <= 2.5.13 - Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f8a656-696c-4e4f-a0a6-c71010a1ee12?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.5.13","to_inclusive":true,"patched_in":"2.5.14"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:18:18Z"},{"id":"wordfence:19f8eb9b-f416-4ef4-bb75-f561579ce22f","source":"wordfence","cve":"CVE-2024-5883","title":"Ultimate Classified Listings <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f8eb9b-f416-4ef4-bb75-f561579ce22f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-15T20:11:23Z"},{"id":"wordfence:19f94c4f-145b-4058-aabd-06525fce3cea","source":"wordfence","cve":"CVE-2023-6158","title":"EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f94c4f-145b-4058-aabd-06525fce3cea?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:35:56Z"},{"id":"wordfence:19f97cc8-4a35-44fd-b9f5-978f5997d08a","source":"wordfence","cve":"CVE-2015-7320","title":"Appointment Booking Calendar <= 1.1.7 - Multiple Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19f97cc8-4a35-44fd-b9f5-978f5997d08a?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2015-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19fbb332-f660-4572-82a3-c68e0bc7efcf","source":"wordfence","cve":"","title":"ListingPro - WordPress Directory & Listing Theme < 2.5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19fbb332-f660-4572-82a3-c68e0bc7efcf?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2020-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:19fe28c0-c0ef-49aa-91c1-2e273201babd","source":"wordfence","cve":"CVE-2024-33564","title":"XStore <= 9.3.8 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/19fe28c0-c0ef-49aa-91c1-2e273201babd?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:47:51Z"},{"id":"wordfence:1a0136e2-97f5-4368-a805-0f60d1b8ad11","source":"wordfence","cve":"CVE-2024-12340","title":"Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0136e2-97f5-4368-a805-0f60d1b8ad11?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T09:22:40Z"},{"id":"wordfence:1a020b1a-f0de-45c6-9750-be5154042949","source":"wordfence","cve":"CVE-2026-22438","title":"TheBi <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a020b1a-f0de-45c6-9750-be5154042949?source=api-prod","affected":[{"type":"theme","slug":"thebi","name":"TheBi - Photography WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:21:59Z"},{"id":"wordfence:1a033ffd-bcff-4803-812b-abfc6d5135e5","source":"wordfence","cve":"CVE-2026-24554","title":"Subscription & Recurring Payment for WooCommerce <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a033ffd-bcff-4803-812b-abfc6d5135e5?source=api-prod","affected":[{"type":"plugin","slug":"subscription","name":"Subscriptions for WooCommerce with Stripe Recurring Payments","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:12:09Z"},{"id":"wordfence:1a081788-007e-463b-b757-afefcf4c6e17","source":"wordfence","cve":"CVE-2023-24416","title":"All In One Favicon <= 4.7 - Authenticated(Admin+) Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a081788-007e-463b-b757-afefcf4c6e17?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-favicon","name":"All In One Favicon","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a09dcc4-37ee-425d-b824-a593c22d711f","source":"wordfence","cve":"CVE-2024-9449","title":"Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a09dcc4-37ee-425d-b824-a593c22d711f?source=api-prod","affected":[{"type":"plugin","slug":"auto-iframe","name":"Auto iFrame","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-10-08T17:35:38Z","updated":"2024-10-09T06:44:38Z"},{"id":"wordfence:1a0b2d5f-688e-44d7-8fa1-2fb4e49e048c","source":"wordfence","cve":"CVE-2025-69377","title":"User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0b2d5f-688e-44d7-8fa1-2fb4e49e048c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"17.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:07:50Z"},{"id":"wordfence:1a0ba31d-d2d8-4614-8f77-a041c25c0519","source":"wordfence","cve":"CVE-2023-1090","title":"SMTP Mailing Queue <= 1.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0ba31d-d2d8-4614-8f77-a041c25c0519?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mailing-queue","name":"SMTP Mailing Queue","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a0e93cb-4311-4b38-8eb4-17152e1f3475","source":"wordfence","cve":"CVE-2023-23862","title":"Vertical scroll recent post <= 14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0e93cb-4311-4b38-8eb4-17152e1f3475?source=api-prod","affected":[{"type":"plugin","slug":"vertical-scroll-recent-post","name":"Vertical scroll recent post","from":"*","from_inclusive":true,"to":"14.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a0f671d-d596-4225-bffd-57776224dd0e","source":"wordfence","cve":"CVE-2026-13701","title":"Advanced Excerpt <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0f671d-d596-4225-bffd-57776224dd0e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-excerpt","name":"Advanced Excerpt","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:02:59Z"},{"id":"wordfence:1a0fa7f6-cc1a-45fe-881d-694c81b841c7","source":"wordfence","cve":"CVE-2022-4156","title":"Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0fa7f6-cc1a-45fe-881d-694c81b841c7?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a0fcd50-e9d6-49a5-979f-61f953b1a1cd","source":"wordfence","cve":"","title":"Safe SVG <= 1.9.5 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0fcd50-e9d6-49a5-979f-61f953b1a1cd?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2019-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a10af61-6451-4dda-aeda-ba8fa44bee35","source":"wordfence","cve":"CVE-2021-24879","title":"SupportCandy \u2013 Helpdesk & Support Ticket System <= 2.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a10af61-6451-4dda-aeda-ba8fa44bee35?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2022-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a10cc0e-3b74-4a18-9ef8-7370a45d64ef","source":"wordfence","cve":"CVE-2025-39450","title":"JetTabs <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a10cc0e-3b74-4a18-9ef8-7370a45d64ef?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:29:00Z"},{"id":"wordfence:1a12f472-0ae1-4c3c-b7e3-85f637fe58c5","source":"wordfence","cve":"CVE-2024-1477","title":"Easy Maintenance Mode <= 1.4.2 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a12f472-0ae1-4c3c-b7e3-85f637fe58c5?source=api-prod","affected":[{"type":"plugin","slug":"easy-maintenance-mode-coming-soon","name":"Easy Maintenance Mode","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T06:48:23Z"},{"id":"wordfence:1a148e36-951d-4cfd-96df-f059bd4756bc","source":"wordfence","cve":"CVE-2025-23763","title":"WAH Forms <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a148e36-951d-4cfd-96df-f059bd4756bc?source=api-prod","affected":[{"type":"plugin","slug":"wah-forms","name":"WAH Forms","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:38:43Z"},{"id":"wordfence:1a14b674-620e-4247-a200-92d9f23acbca","source":"wordfence","cve":"CVE-2020-10257","title":"ThemeREX Addons (Various Versions) - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a14b674-620e-4247-a200-92d9f23acbca?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"1.6.49.6","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.49.6.2","from_inclusive":true,"to":"1.6.49.6.3","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.49.8","from_inclusive":true,"to":"1.6.49.9","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.50","from_inclusive":true,"to":"1.6.50.2","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.51","from_inclusive":true,"to":"1.6.51.4","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.52","from_inclusive":true,"to":"1.6.52.3","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.53","from_inclusive":true,"to":"1.6.53.4","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.54","from_inclusive":true,"to":"1.6.54.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.55","from_inclusive":true,"to":"1.6.55.8","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.56","from_inclusive":true,"to":"1.6.56.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.57","from_inclusive":true,"to":"1.6.57.4","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.58.2","from_inclusive":true,"to":"1.6.58.3","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.59","from_inclusive":true,"to":"1.6.59","to_inclusive":true,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.59.1","from_inclusive":true,"to":"1.6.59.1","to_inclusive":true,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.59.1.1","from_inclusive":true,"to":"1.6.59.1.2","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.59.2","from_inclusive":true,"to":"1.6.59.4","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.60","from_inclusive":true,"to":"1.6.60.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.61","from_inclusive":true,"to":"1.6.61","to_inclusive":true,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.61.1","from_inclusive":true,"to":"1.6.61.1","to_inclusive":true,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.61.1.0","from_inclusive":true,"to":"1.6.61.1.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.61.2","from_inclusive":true,"to":"1.6.61.2.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.65","from_inclusive":true,"to":"1.6.65.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.66","from_inclusive":true,"to":"1.6.66.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.6.67","from_inclusive":true,"to":"1.6.67.1","to_inclusive":false,"patched_in":"1.6.49.6"},{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"1.70.3","from_inclusive":true,"to":"1.70.3","to_inclusive":true,"patched_in":"1.6.49.6"}],"published":"2020-03-09T00:00:00Z","updated":"2024-09-04T13:18:24Z"},{"id":"wordfence:1a14b86f-a5c8-4ec2-9940-68a37a6c4a86","source":"wordfence","cve":"CVE-2024-7432","title":"Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a14b86f-a5c8-4ec2-9940-68a37a6c4a86?source=api-prod","affected":[{"type":"theme","slug":"unseen-blog","name":"Unseen Blog","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:08Z"},{"id":"wordfence:1a158d1b-648a-4ded-a814-c342ea03ecdf","source":"wordfence","cve":"CVE-2026-97353","title":"News Kit Addons For Elementor <= 1.4.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a158d1b-648a-4ded-a814-c342ea03ecdf?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T01:29:00Z"},{"id":"wordfence:1a16379e-9f51-4cba-a477-a6aeaf5ba6f5","source":"wordfence","cve":"CVE-2026-86824","title":"Newsletter <= 9.3.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a16379e-9f51-4cba-a477-a6aeaf5ba6f5?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-email-mailing-list","name":"Newsletter","from":"*","from_inclusive":true,"to":"9.3.7","to_inclusive":true,"patched_in":"9.3.8"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:54:36Z"},{"id":"wordfence:1a182243-b24a-4c46-8b65-6b38d8509a51","source":"wordfence","cve":"CVE-2025-14457","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion","severity":"low","cvss":3.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a182243-b24a-4c46-8b65-6b38d8509a51?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.2","to_inclusive":true,"patched_in":"1.3.9.3"}],"published":"2026-01-14T18:17:14Z","updated":"2026-01-15T06:45:05Z"},{"id":"wordfence:1a1af528-79c6-4197-b247-9789b290a642","source":"wordfence","cve":"CVE-2017-13138","title":"Bridge - Creative Multipurpose WordPress Theme < 11.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1af528-79c6-4197-b247-9789b290a642?source=api-prod","affected":[{"type":"theme","slug":"bridge","name":"Bridge - Creative Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"11.2","to_inclusive":false,"patched_in":"11.2"}],"published":"2017-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a1c4f7a-bd24-4ccc-9f4c-98341e7edfed","source":"wordfence","cve":"CVE-2025-58944","title":"Manufactory <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1c4f7a-bd24-4ccc-9f4c-98341e7edfed?source=api-prod","affected":[{"type":"theme","slug":"manufactory","name":"Manufactory - Industrial WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:35:24Z"},{"id":"wordfence:1a1fc6c9-50cd-40fd-a777-9eed98aab797","source":"wordfence","cve":"CVE-2021-4451","title":"NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1fc6c9-50cd-40fd-a777-9eed98aab797?source=api-prod","affected":[{"type":"plugin","slug":"ninjafirewall","name":"NinjaFirewall (WP Edition) \u2013 Advanced Security Plugin and Firewall","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":false,"patched_in":"4.3.4"}],"published":"2021-05-30T00:00:00Z","updated":"2024-10-16T06:43:24Z"},{"id":"wordfence:1a2002fd-7fe4-4cc1-8b74-096a0db09247","source":"wordfence","cve":"CVE-2025-46250","title":"VForm <= 3.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2002fd-7fe4-4cc1-8b74-096a0db09247?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:24:24Z"},{"id":"wordfence:1a20dc1d-eb7c-47ac-ad9a-ec4c0d5db62e","source":"wordfence","cve":"CVE-2025-0366","title":"Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a20dc1d-eb7c-47ac-ad9a-ec4c0d5db62e?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"4.8.8"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:13:25Z"},{"id":"wordfence:1a23ee5c-275f-4d51-8199-1cc2b0086f73","source":"wordfence","cve":"CVE-2025-1768","title":"SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a23ee5c-275f-4d51-8199-1cc2b0086f73?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.05","to_inclusive":true,"patched_in":"12.4.06"}],"published":"2025-03-06T22:02:49Z","updated":"2025-03-07T20:23:37Z"},{"id":"wordfence:1a253ebd-c1c1-4a8f-a02a-67b244f840ce","source":"wordfence","cve":"CVE-2024-49606","title":"Google Map Locations <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a253ebd-c1c1-4a8f-a02a-67b244f840ce?source=api-prod","affected":[{"type":"plugin","slug":"google-map-locations","name":"Google Map Locations","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:11:03Z"},{"id":"wordfence:1a2acbf7-ec3f-44d7-b166-ad0745a2e9ad","source":"wordfence","cve":"CVE-2025-58632","title":"Dadevarzan WordPress Common <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2acbf7-ec3f-44d7-b166-ad0745a2e9ad?source=api-prod","affected":[{"type":"plugin","slug":"dadevarzan-common","name":"Dadevarzan WordPress Common","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:36:09Z"},{"id":"wordfence:1a2b0ff4-9471-4fd0-ac1a-ed5b7b4af4ff","source":"wordfence","cve":"CVE-2024-10848","title":"NewsMunch <= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2b0ff4-9471-4fd0-ac1a-ed5b7b4af4ff?source=api-prod","affected":[{"type":"theme","slug":"newsmunch","name":"NewsMunch","from":"*","from_inclusive":true,"to":"1.0.35","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2024-12-04T00:00:00Z","updated":"2024-12-05T09:23:06Z"},{"id":"wordfence:1a2f0d07-33bb-4d68-9c81-61f13a004804","source":"wordfence","cve":"CVE-2026-66431","title":"Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2f0d07-33bb-4d68-9c81-61f13a004804?source=api-prod","affected":[{"type":"plugin","slug":"clink-gateway-for-woocommerce","name":"Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:55:37Z"},{"id":"wordfence:1a2fb050-1a7c-45cc-86c7-02331d47f780","source":"wordfence","cve":"","title":"WPSchoolPress <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a2fb050-1a7c-45cc-86c7-02331d47f780?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a3037cd-43b8-4f6e-a3e5-b8c48d2a0dbe","source":"wordfence","cve":"CVE-2026-16650","title":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3037cd-43b8-4f6e-a3e5-b8c48d2a0dbe?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":false,"patched_in":"1.8.12"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-24T16:40:53Z"},{"id":"wordfence:1a304e9a-9518-4a6a-b36a-963cb329f5c3","source":"wordfence","cve":"CVE-2024-5665","title":"Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a304e9a-9518-4a6a-b36a-963cb329f5c3?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"2.7.1","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-06-05T19:24:25Z","updated":"2024-06-06T07:37:12Z"},{"id":"wordfence:1a3056b4-06ab-430b-9c67-b915d6cbaf06","source":"wordfence","cve":"CVE-2026-22392","title":"Cortex <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3056b4-06ab-430b-9c67-b915d6cbaf06?source=api-prod","affected":[{"type":"theme","slug":"cortex","name":"Cortex - Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:38:58Z"},{"id":"wordfence:1a3137a1-8e46-44c6-8edd-ad9fc4d66e0b","source":"wordfence","cve":"CVE-2024-5226","title":"Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3137a1-8e46-44c6-8edd-ad9fc4d66e0b?source=api-prod","affected":[{"type":"plugin","slug":"fuse-social-floating-sidebar","name":"Fuse Social Icons","from":"*","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"5.4.11"}],"published":"2024-08-07T17:11:32Z","updated":"2024-08-08T05:31:46Z"},{"id":"wordfence:1a331934-3bf2-4406-bc45-a897a3da5d90","source":"wordfence","cve":"CVE-2025-24727","title":"Contact Form Email <= 1.3.52 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a331934-3bf2-4406-bc45-a897a3da5d90?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.52","to_inclusive":true,"patched_in":"1.3.53"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:33:19Z"},{"id":"wordfence:1a358381-fe1e-4ebd-ba28-069ee8580ec3","source":"wordfence","cve":"CVE-2025-67592","title":"My Calendar <= 3.6.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a358381-fe1e-4ebd-ba28-069ee8580ec3?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"3.6.17"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:21:39Z"},{"id":"wordfence:1a367b5a-cfba-41fa-9243-256a391a4661","source":"wordfence","cve":"CVE-2022-3350","title":"Contact Bank <= 3.0.30 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a367b5a-cfba-41fa-9243-256a391a4661?source=api-prod","affected":[{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.0.30","to_inclusive":true,"patched_in":""}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a374d8a-3754-4228-95ed-dc0ba1df40da","source":"wordfence","cve":"CVE-2024-25592","title":"Broken Link Checker <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a374d8a-3754-4228-95ed-dc0ba1df40da?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T17:59:47Z"},{"id":"wordfence:1a385af7-4094-4a1e-9f1f-6291698f71af","source":"wordfence","cve":"CVE-2025-32291","title":"SUMO Affiliates Pro < 11.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a385af7-4094-4a1e-9f1f-6291698f71af?source=api-prod","affected":[{"type":"plugin","slug":"affs","name":"SUMO Affiliates Pro","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":false,"patched_in":"11.1.0"}],"published":"2025-05-30T00:00:00Z","updated":"2026-02-24T22:26:32Z"},{"id":"wordfence:1a38e571-a92a-4a47-9507-8a989be4b405","source":"wordfence","cve":"CVE-2025-53298","title":"Plugin Inspector <= 1.5 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a38e571-a92a-4a47-9507-8a989be4b405?source=api-prod","affected":[{"type":"plugin","slug":"plugin-inspector","name":"Plugin Inspector","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:32:17Z"},{"id":"wordfence:1a3ca502-177e-4337-93e3-347c773d2761","source":"wordfence","cve":"CVE-2026-18050","title":"Events Manager <= 7.3 - Unauthenticated Pending Upload Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3ca502-177e-4337-93e3-347c773d2761?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-21T15:48:09Z"},{"id":"wordfence:1a3ebfba-7523-48a4-a315-4395be2cebef","source":"wordfence","cve":"CVE-2024-24712","title":"Heateor Social Login <= 1.1.30 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3ebfba-7523-48a4-a315-4395be2cebef?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T15:29:02Z"},{"id":"wordfence:1a3fe49b-cc0d-4b29-aae5-46307483b8d4","source":"wordfence","cve":"CVE-2026-2918","title":"Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions","severity":"medium","cvss":6.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a3fe49b-cc0d-4b29-aae5-46307483b8d4?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":true,"patched_in":"3.21.1"}],"published":"2026-03-10T19:04:44Z","updated":"2026-06-23T15:04:30Z"},{"id":"wordfence:1a4321d5-b472-4571-8dc1-96419b59c6c7","source":"wordfence","cve":"CVE-2025-24649","title":"Admin and Site Enhancements (ASE) <= 7.6.2 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4321d5-b472-4571-8dc1-96419b59c6c7?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:23:22Z"},{"id":"wordfence:1a4414b1-6a49-42f8-9927-93763d1502ce","source":"wordfence","cve":"CVE-2026-8096","title":"Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4414b1-6a49-42f8-9927-93763d1502ce?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2026-05-19T06:22:39Z","updated":"2026-05-19T18:33:52Z"},{"id":"wordfence:1a45c992-9d93-4dc9-be08-35aae6a90708","source":"wordfence","cve":"CVE-2026-93937","title":"Hygia - Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a45c992-9d93-4dc9-be08-35aae6a90708?source=api-prod","affected":[{"type":"theme","slug":"hygia","name":"Hygia - Cleaning Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:48:52Z","updated":"2026-10-13T14:27:54Z"},{"id":"wordfence:1a46da16-2442-45cf-858f-0681b1106cc2","source":"wordfence","cve":"","title":"SEO Plugin by Squirrly SEO < 6.1.5 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a46da16-2442-45cf-858f-0681b1106cc2?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":false,"patched_in":"6.1.5"}],"published":"2016-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a46fd57-4cb9-4d98-89b6-926d74b2ab33","source":"wordfence","cve":"CVE-2023-4731","title":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026 <= 4.4 - Cross-Site Request Forgery via init_endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a46fd57-4cb9-4d98-89b6-926d74b2ab33?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:54Z"},{"id":"wordfence:1a47b096-43c8-4fc4-9fe1-0afa311a420c","source":"wordfence","cve":"CVE-2025-22729","title":"VOD Infomaniak <= 1.5.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a47b096-43c8-4fc4-9fe1-0afa311a420c?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:22:51Z"},{"id":"wordfence:1a4bc52d-5771-4e7b-a394-772f2a5edbd7","source":"wordfence","cve":"CVE-2024-3663","title":"WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4bc52d-5771-4e7b-a394-772f2a5edbd7?source=api-prod","affected":[{"type":"plugin","slug":"wp-scraper","name":"WP Scraper","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"5.8"}],"published":"2024-05-21T18:42:12Z","updated":"2024-05-31T16:04:26Z"},{"id":"wordfence:1a4c89ae-fd46-4713-831b-f6d8699d9158","source":"wordfence","cve":"CVE-2025-22708","title":"Mitech <= 2.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4c89ae-fd46-4713-831b-f6d8699d9158?source=api-prod","affected":[{"type":"theme","slug":"mitech","name":"Mitech - Technology IT Solutions & Services WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:57:19Z"},{"id":"wordfence:1a4cc739-0563-4ca2-931d-818a0c285257","source":"wordfence","cve":"CVE-2012-2109","title":"BuddyPress - 1.5-1.5.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4cc739-0563-4ca2-931d-818a0c285257?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"1.5","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2012-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a4dfbbe-19b9-4e8a-bf2f-c6a3d4759848","source":"wordfence","cve":"CVE-2025-49949","title":"Templazee <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4dfbbe-19b9-4e8a-bf2f-c6a3d4759848?source=api-prod","affected":[{"type":"plugin","slug":"templazee","name":"Templazee \u2013 A collection of Blocks and Template Library","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-09T00:00:00Z","updated":"2025-10-29T21:04:41Z"},{"id":"wordfence:1a507489-f337-4b47-9506-daea1b426798","source":"wordfence","cve":"CVE-2023-1554","title":"Quick Paypal Payments <= 5.7.26.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a507489-f337-4b47-9506-daea1b426798?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.26.3","to_inclusive":true,"patched_in":"5.7.26.4"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a53bcf5-61ed-427c-9efd-29c9309d2426","source":"wordfence","cve":"CVE-2026-120518","title":"BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a53bcf5-61ed-427c-9efd-29c9309d2426?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-xprofile-image-field","name":"BuddyPress XProfile Custom Image Field","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:18:38Z","updated":"2026-11-03T04:43:06Z"},{"id":"wordfence:1a54f8cc-cadb-4496-bcc4-ef8387b72300","source":"wordfence","cve":"CVE-2026-12557","title":"Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a54f8cc-cadb-4496-bcc4-ef8387b72300?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.29","to_inclusive":true,"patched_in":"3.3.30"}],"published":"2026-07-02T16:04:30Z","updated":"2026-07-03T04:30:16Z"},{"id":"wordfence:1a576033-d3f5-48cf-b0b9-b11ea388a6d9","source":"wordfence","cve":"CVE-2024-35779","title":"Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a576033-d3f5-48cf-b0b9-b11ea388a6d9?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.42","to_inclusive":true,"patched_in":"1.5.43"}],"published":"2024-06-19T00:00:00Z","updated":"2024-07-01T16:50:21Z"},{"id":"wordfence:1a5ac5f9-aaf4-4a7f-9d1d-fc8f5e632c21","source":"wordfence","cve":"CVE-2024-53722","title":"Favicon My Blog <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5ac5f9-aaf4-4a7f-9d1d-fc8f5e632c21?source=api-prod","affected":[{"type":"plugin","slug":"favicon-my-blog","name":"Favicon My Blog","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T18:49:27Z"},{"id":"wordfence:1a5b5b9d-9549-4931-8b27-c8a0d5bcf53c","source":"wordfence","cve":"CVE-2025-32132","title":"FunnelCockpit <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5b5b9d-9549-4931-8b27-c8a0d5bcf53c?source=api-prod","affected":[{"type":"plugin","slug":"funnelcockpit","name":"FunnelCockpit","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-04-04T00:00:00Z","updated":"2025-08-05T12:57:26Z"},{"id":"wordfence:1a5d4e67-3faa-4da2-be9b-65cf6fd03c53","source":"wordfence","cve":"CVE-2025-4840","title":"Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5d4e67-3faa-4da2-be9b-65cf6fd03c53?source=api-prod","affected":[{"type":"plugin","slug":"inprosysmedia-likes-dislikes-post","name":"Likes and Dislikes Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-07-09T14:44:36Z"},{"id":"wordfence:1a5d9290-b480-45f7-9ac7-a20475b805e8","source":"wordfence","cve":"CVE-2021-24180","title":"Related Posts for WordPress <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5d9290-b480-45f7-9ac7-a20475b805e8?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a5ef5b3-2900-44f0-9e13-66fbdc937b38","source":"wordfence","cve":"CVE-2026-1070","title":"Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5ef5b3-2900-44f0-9e13-66fbdc937b38?source=api-prod","affected":[{"type":"plugin","slug":"user-counter","name":"Alex User Counter","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:22:53Z","updated":"2026-01-24T07:26:41Z"},{"id":"wordfence:1a5f48ac-a992-4496-b86b-f2e4554d4bd7","source":"wordfence","cve":"CVE-2026-18356","title":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention < 3.3.5 - Unauthenticated Username Denylist Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5f48ac-a992-4496-b86b-f2e4554d4bd7?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":false,"patched_in":"3.3.5"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-18T15:02:21Z"},{"id":"wordfence:1a5f970a-e6a0-4dc7-8e99-342a32f5fd49","source":"wordfence","cve":"CVE-2025-6784","title":"Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a5f970a-e6a0-4dc7-8e99-342a32f5fd49?source=api-prod","affected":[{"type":"plugin","slug":"code-engine","name":"Code Engine \u2013 PHP Snippets, AI Functions & Automation for WordPress","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":"0.3.6"}],"published":"2026-07-10T16:42:48Z","updated":"2026-07-11T05:35:44Z"},{"id":"wordfence:1a618dbf-1180-4937-8466-5abc784a3365","source":"wordfence","cve":"CVE-2025-9896","title":"HidePost <= 2.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a618dbf-1180-4937-8466-5abc784a3365?source=api-prod","affected":[{"type":"plugin","slug":"hidepost","name":"HidePost","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:33:02Z","updated":"2025-09-27T06:47:13Z"},{"id":"wordfence:1a657a1d-3b01-444c-af4e-c9ebebfbc01a","source":"wordfence","cve":"CVE-2026-25327","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin <= 2.7.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a657a1d-3b01-444c-af4e-c9ebebfbc01a?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:18:23Z"},{"id":"wordfence:1a65e397-a4ec-414f-899c-cf381f475296","source":"wordfence","cve":"CVE-2025-49065","title":"Visit Counter <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a65e397-a4ec-414f-899c-cf381f475296?source=api-prod","affected":[{"type":"plugin","slug":"visit-counter","name":"Visit Counter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:40:25Z"},{"id":"wordfence:1a67b1b3-eb39-4e9a-ba44-ea637fc3bba1","source":"wordfence","cve":"CVE-2025-7820","title":"SKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass","severity":"high","cvss":7.5,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a67b1b3-eb39-4e9a-ba44-ea637fc3bba1?source=api-prod","affected":[{"type":"plugin","slug":"skt-paypal-for-woocommerce","name":"SKT PayPal for WooCommerce","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-11-26T16:26:34Z","updated":"2025-11-27T04:36:43Z"},{"id":"wordfence:1a67d846-d27c-4a82-a30d-813d9b37da1d","source":"wordfence","cve":"CVE-2024-35687","title":"Link Library <= 7.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a67d846-d27c-4a82-a30d-813d9b37da1d?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:45:58Z"},{"id":"wordfence:1a684ca7-0856-418e-9229-3e74dafb5c89","source":"wordfence","cve":"","title":"WP Database Backup < 3.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a684ca7-0856-418e-9229-3e74dafb5c89?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a697391-f30d-403f-9046-8fa219a49302","source":"wordfence","cve":"CVE-2024-3469","title":"GP Premium <= 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a697391-f30d-403f-9046-8fa219a49302?source=api-prod","affected":[{"type":"plugin","slug":"gp-premium","name":"GP Premium","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-06-04T19:49:55Z","updated":"2024-06-05T12:45:45Z"},{"id":"wordfence:1a6ba67d-d10d-4590-8398-26b29c044fb3","source":"wordfence","cve":"CVE-2026-59522","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a6ba67d-d10d-4590-8398-26b29c044fb3?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.5","to_inclusive":true,"patched_in":"1.17.6"}],"published":"2026-07-15T00:00:00Z","updated":"2026-07-21T18:03:29Z"},{"id":"wordfence:1a6bc58f-9cf3-4d3f-a10e-0ccde0b890a3","source":"wordfence","cve":"","title":"Injection Guard <= 1.2.1 - Cross-Site Request Forgery to Whitelist Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a6bc58f-9cf3-4d3f-a10e-0ccde0b890a3?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a6fbb60-811a-4763-b301-694bc8d387e7","source":"wordfence","cve":"CVE-2024-29777","title":"Forminator <= 1.29.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a6fbb60-811a-4763-b301-694bc8d387e7?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.29.0","to_inclusive":true,"patched_in":"1.29.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:52:34Z"},{"id":"wordfence:1a71508b-7c8b-4132-9419-e9e455d2e359","source":"wordfence","cve":"CVE-2026-32574","title":"Smart Forms \u2013 when you need more than just a contact form <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a71508b-7c8b-4132-9419-e9e455d2e359?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.104","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:29:32Z","updated":"2026-10-08T23:19:53Z"},{"id":"wordfence:1a7298ae-e1e6-4d3f-b4fb-9f9db9f3832d","source":"wordfence","cve":"CVE-2022-1686","title":"Five Minute Webshop <= 1.3.2 - Authenticated (Admin+) SQL Injection via id","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7298ae-e1e6-4d3f-b4fb-9f9db9f3832d?source=api-prod","affected":[{"type":"plugin","slug":"five-minute-webshop","name":"Five Minute Webshop","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a73c078-ce66-4131-8bd7-6fd48fc9fa84","source":"wordfence","cve":"CVE-2025-11220","title":"Elementor <= 3.33.3  - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a73c078-ce66-4131-8bd7-6fd48fc9fa84?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.33.3","to_inclusive":true,"patched_in":"3.33.4"}],"published":"2025-12-15T22:04:49Z","updated":"2025-12-16T11:15:46Z"},{"id":"wordfence:1a74252c-1385-4ee7-aeaa-f0476336b1e6","source":"wordfence","cve":"CVE-2025-31423","title":"Umberto <= 1.2.8 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a74252c-1385-4ee7-aeaa-f0476336b1e6?source=api-prod","affected":[{"type":"theme","slug":"umberto","name":"Umberto - Mushroom Farm & Organic Products Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:44:03Z"},{"id":"wordfence:1a74d58c-a416-4cf4-a87e-ba6ca51710a9","source":"wordfence","cve":"CVE-2026-81654","title":"NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a74d58c-a416-4cf4-a87e-ba6ca51710a9?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:32:38Z"},{"id":"wordfence:1a74d5f4-1dd8-4d49-b4ce-8ba7ac9cbcc7","source":"wordfence","cve":"CVE-2026-3279","title":"Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a74d5f4-1dd8-4d49-b4ce-8ba7ac9cbcc7?source=api-prod","affected":[{"type":"plugin","slug":"enable-jquery-migrate-helper","name":"Enable jQuery Migrate Helper","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:35:02Z","updated":"2026-05-27T06:46:16Z"},{"id":"wordfence:1a76571a-f820-4902-afa9-287b59a11d14","source":"wordfence","cve":"","title":"Nested Pages <= 3.0.7 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a76571a-f820-4902-afa9-287b59a11d14?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2019-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a766b5b-e21e-4009-86d9-7f0a5c91ed51","source":"wordfence","cve":"CVE-2023-7089","title":"Easy SVG Allow <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a766b5b-e21e-4009-86d9-7f0a5c91ed51?source=api-prod","affected":[{"type":"plugin","slug":"easy-svg-image-allow","name":"Easy SVG Allow","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a7687fe-6246-4bd3-9d4f-e7fa6398f265","source":"wordfence","cve":"CVE-2021-38325","title":"User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7687fe-6246-4bd3-9d4f-e7fa6398f265?source=api-prod","affected":[{"type":"plugin","slug":"user-activation-email","name":"User Activation Email","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a79d08e-9429-4895-bc0c-cfaa8eb161d6","source":"wordfence","cve":"CVE-2026-1378","title":"WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a79d08e-9429-4895-bc0c-cfaa8eb161d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-re-order","name":"WP Posts Re-order","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:19:15Z","updated":"2026-03-21T03:26:36Z"},{"id":"wordfence:1a7bb274-9bbf-4d78-ad81-0e7ac6b7b265","source":"wordfence","cve":"CVE-2024-11781","title":"Smart Agenda \u2013 Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7bb274-9bbf-4d78-ad81-0e7ac6b7b265?source=api-prod","affected":[{"type":"plugin","slug":"smart-agenda-prise-de-rendez-vous-en-ligne","name":"SmartAgenda \u2013 Prise de rendez-vous en ligne","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:19Z"},{"id":"wordfence:1a7bdae1-b28a-4fc6-9538-944ffeb32796","source":"wordfence","cve":"CVE-2026-8678","title":"MyParcel <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7bdae1-b28a-4fc6-9538-944ffeb32796?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-myparcel","name":"MyParcel","from":"*","from_inclusive":true,"to":"4.25.1","to_inclusive":true,"patched_in":"4.25.2"}],"published":"2026-07-10T14:19:37Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:1a7dbb6e-abb3-4fd9-8ca8-a3cd628fcf5b","source":"wordfence","cve":"CVE-2026-52715","title":"GEO my WP <= 4.5.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7dbb6e-abb3-4fd9-8ca8-a3cd628fcf5b?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.5.1"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:01:17Z"},{"id":"wordfence:1a7dbb82-b484-4b86-b8dc-7a1e7291dec2","source":"wordfence","cve":"CVE-2026-8893","title":"Express Payment For Stripe <= 1.28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7dbb82-b484-4b86-b8dc-7a1e7291dec2?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-express","name":"Express Payment For Stripe","from":"*","from_inclusive":true,"to":"1.28.0","to_inclusive":true,"patched_in":"1.28.2"}],"published":"2026-06-05T10:34:47Z","updated":"2026-06-05T23:28:24Z"},{"id":"wordfence:1a7de110-e581-4cf7-9f2f-edb4a305dff5","source":"wordfence","cve":"CVE-2026-32386","title":"Envo Extra <= 1.9.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7de110-e581-4cf7-9f2f-edb4a305dff5?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.9.13","to_inclusive":true,"patched_in":"1.9.14"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:55:36Z"},{"id":"wordfence:1a7e7ed5-941e-4348-86c5-34989197081a","source":"wordfence","cve":"CVE-2026-77009","title":"WatchMan-Site7 <= 4.2.0 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7e7ed5-941e-4348-86c5-34989197081a?source=api-prod","affected":[{"type":"plugin","slug":"watchman-site7","name":"WatchMan-Site7","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-16T15:46:36Z"},{"id":"wordfence:1a815110-888e-419d-bcad-745c4efec1ef","source":"wordfence","cve":"CVE-2026-10524","title":"CoCart <= 4.8.0 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a815110-888e-419d-bcad-745c4efec1ef?source=api-prod","affected":[{"type":"plugin","slug":"cart-rest-api-for-woocommerce","name":"CoCart \u2013 Headless REST API for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-21T14:01:51Z"},{"id":"wordfence:1a849338-8dd9-49d2-ab7c-29d4b729877b","source":"wordfence","cve":"CVE-2024-30426","title":"Hash Elements <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a849338-8dd9-49d2-ab7c-29d4b729877b?source=api-prod","affected":[{"type":"plugin","slug":"hash-elements","name":"Hash Elements","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:35:09Z"},{"id":"wordfence:1a850176-973c-49aa-a420-e379223b6dc3","source":"wordfence","cve":"CVE-2023-2224","title":"SEO By 10Web <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a850176-973c-49aa-a420-e379223b6dc3?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-10web","name":"SEO by 10Web","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a8b194c-371f-4adc-98fa-8f4e47a38ee7","source":"wordfence","cve":"CVE-2023-0694","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8b194c-371f-4adc-98fa-8f4e47a38ee7?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a8b22b4-151c-4f42-a0a0-966dc5eb7a9d","source":"wordfence","cve":"CVE-2023-25986","title":"PayGreen \u2013 Ancienne version <= 4.10.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8b22b4-151c-4f42-a0a0-966dc5eb7a9d?source=api-prod","affected":[{"type":"plugin","slug":"paygreen-woocommerce","name":"PayGreen \u2013 Ancienne version","from":"*","from_inclusive":true,"to":"4.10.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a8ca426-34cd-4c98-ae24-f3f31a7fcae5","source":"wordfence","cve":"CVE-2025-0805","title":"Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8ca426-34cd-4c98-ae24-f3f31a7fcae5?source=api-prod","affected":[{"type":"plugin","slug":"mortgage-loan-calculator","name":"Mortgage Calculator","from":"*","from_inclusive":true,"to":"1.5.20","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:44:47Z","updated":"2025-02-18T04:21:13Z"},{"id":"wordfence:1a8f71ab-e787-44ba-b159-08f66df8a5fd","source":"wordfence","cve":"CVE-2025-59584","title":"Penci Podcast <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a8f71ab-e787-44ba-b159-08f66df8a5fd?source=api-prod","affected":[{"type":"plugin","slug":"penci-podcast","name":"Penci Podcast","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:47:22Z"},{"id":"wordfence:1a90be4a-1cc1-43b2-9990-a60c2837cacc","source":"wordfence","cve":"CVE-2025-27346","title":"Rebuild Permalinks <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a90be4a-1cc1-43b2-9990-a60c2837cacc?source=api-prod","affected":[{"type":"plugin","slug":"rebuild-permalinks","name":"Rebuild Permalinks","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:38:28Z"},{"id":"wordfence:1a91e973-f669-49a6-8c74-f6fbc4dc8db9","source":"wordfence","cve":"","title":"Clean Login 1.12.6.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a91e973-f669-49a6-8c74-f6fbc4dc8db9?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"1.12.6.3","from_inclusive":true,"to":"1.12.6.3","to_inclusive":true,"patched_in":"1.12.6.4"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1a93ff8a-364f-4ec4-9c32-208c7a3e1fc1","source":"wordfence","cve":"CVE-2026-3005","title":"List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a93ff8a-364f-4ec4-9c32-208c7a3e1fc1?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.94.0","to_inclusive":true,"patched_in":"0.95.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T12:28:10Z"},{"id":"wordfence:1a97e50f-c3ce-4e25-80c5-3de5e45431fb","source":"wordfence","cve":"CVE-2026-16250","title":"Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a97e50f-c3ce-4e25-80c5-3de5e45431fb?source=api-prod","affected":[{"type":"plugin","slug":"personal-qr-message","name":"Personal QR Message","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:23:23Z"},{"id":"wordfence:1a9a254e-f964-49ac-a239-ba9898230b00","source":"wordfence","cve":"CVE-2024-54360","title":"Gutensee <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a9a254e-f964-49ac-a239-ba9898230b00?source=api-prod","affected":[{"type":"plugin","slug":"gutensee","name":"Gutensee","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-06T15:18:17Z"},{"id":"wordfence:1a9ff565-ce51-4888-92c0-d7d3a096fde1","source":"wordfence","cve":"CVE-2025-31421","title":"Srbtranslatin <= 3.2.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1a9ff565-ce51-4888-92c0-d7d3a096fde1?source=api-prod","affected":[{"type":"plugin","slug":"srbtranslatin","name":"SrbTransLatin \u2013 Serbian Latinisation","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T13:21:03Z"},{"id":"wordfence:1aa0fd9d-6c9f-4110-92a0-064fa4b9b589","source":"wordfence","cve":"CVE-2023-45645","title":"WP Open Street Map <= 1.25 - Cross-Site Request Forgery via wp_openstreetmaps","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa0fd9d-6c9f-4110-92a0-064fa4b9b589?source=api-prod","affected":[{"type":"plugin","slug":"wp-open-street-map","name":"WP Open Street Map","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.30"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aa50601-5d1a-4d01-9053-5bf7bc4772d7","source":"wordfence","cve":"CVE-2026-24617","title":"Easy Modal <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa50601-5d1a-4d01-9053-5bf7bc4772d7?source=api-prod","affected":[{"type":"plugin","slug":"easy-modal","name":"Easy Modal","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-01-11T13:44:04Z","updated":"2026-09-16T17:45:42Z"},{"id":"wordfence:1aa793ca-a68b-44e1-88d3-f5d9098a9494","source":"wordfence","cve":"CVE-2025-12549","title":"Rozy - Flower Shop <= 1.2.25 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa793ca-a68b-44e1-88d3-f5d9098a9494?source=api-prod","affected":[{"type":"theme","slug":"rozy","name":"Rozy - Flower Shop WooCommerce WordPress Theme (4+ Indexes + Mobile Layouts Ready)","from":"*","from_inclusive":true,"to":"1.2.25","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:34:21Z"},{"id":"wordfence:1aa7a7f9-f331-4d06-94ea-182535080a90","source":"wordfence","cve":"CVE-2019-14788","title":"Newsletters <= 4.6.18 - Directory Traversal","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa7a7f9-f331-4d06-94ea-182535080a90?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":false,"patched_in":"4.6.19"}],"published":"2019-07-01T00:00:00Z","updated":"2024-08-15T18:04:16Z"},{"id":"wordfence:1aa7d0c2-27ec-47ad-8baa-c281c273078e","source":"wordfence","cve":"CVE-2023-6967","title":"Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa7d0c2-27ec-47ad-8baa-c281c273078e?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.7.31","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.8","from_inclusive":true,"to":"2.8.23.2","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3","from_inclusive":true,"to":"3.0.10.2","to_inclusive":false,"patched_in":"2.7.31.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-07-29T21:35:56Z"},{"id":"wordfence:1aa97f41-1bbd-4ab6-8edd-aef370edfedf","source":"wordfence","cve":"CVE-2025-62757","title":"WebMan Amplifier <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa97f41-1bbd-4ab6-8edd-aef370edfedf?source=api-prod","affected":[{"type":"plugin","slug":"webman-amplifier","name":"WebMan Amplifier","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-16T22:09:50Z"},{"id":"wordfence:1aa9d836-4e13-4c6a-b1e6-a8f984805842","source":"wordfence","cve":"CVE-2025-2542","title":"Your Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aa9d836-4e13-4c6a-b1e6-a8f984805842?source=api-prod","affected":[{"type":"plugin","slug":"your-simple-svg-support","name":"Your Simple SVG Support","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-03-24T21:16:05Z","updated":"2025-03-25T09:22:02Z"},{"id":"wordfence:1aab38ba-ade7-48c9-ac7c-dff1237a9d89","source":"wordfence","cve":"CVE-2026-57663","title":"Recipe Cards For Your Food Blog from Zip Recipes <= 8.2.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aab38ba-ade7-48c9-ac7c-dff1237a9d89?source=api-prod","affected":[{"type":"plugin","slug":"zip-recipes","name":"Recipe Cards For Your Food Blog from Zip Recipes","from":"*","from_inclusive":true,"to":"8.2.7","to_inclusive":true,"patched_in":"8.2.8"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:34:01Z"},{"id":"wordfence:1aac7677-53f4-4944-9bdc-7e07b09c6c13","source":"wordfence","cve":"CVE-2019-15819","title":"ND Restaurant Reservations <= 1.3 - Options Change","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aac7677-53f4-4944-9bdc-7e07b09c6c13?source=api-prod","affected":[{"type":"plugin","slug":"nd-restaurant-reservations","name":"Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.5"}],"published":"2019-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aadb04c-a483-4f9b-8246-3dd7e158fcc2","source":"wordfence","cve":"","title":"Ready! Ecommerce Shopping Cart < 0.5.1 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aadb04c-a483-4f9b-8246-3dd7e158fcc2?source=api-prod","affected":[{"type":"plugin","slug":"ready-ecommerce","name":"Ready! Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":false,"patched_in":"0.5.1"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aae04fc-1bd8-4a0f-a481-032c17640c8b","source":"wordfence","cve":"CVE-2026-14240","title":"Tourmaster <= 5.4.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aae04fc-1bd8-4a0f-a481-032c17640c8b?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-17T16:30:54Z"},{"id":"wordfence:1ab05954-9999-43ff-8e3c-a987e2da1956","source":"wordfence","cve":"CVE-2023-2406","title":"Event Registration Calendar By vcita <= 1.3.1 & Online Payments \u2013 Get Paid with PayPal, Square & Stripe <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab05954-9999-43ff-8e3c-a987e2da1956?source=api-prod","affected":[{"type":"plugin","slug":"event-registration-calendar-by-vcita","name":"Event Registration Calendar By vcita","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"paypal-payment-button-by-vcita","name":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ab0d9f3-0185-41f1-bab5-f47f828fa79c","source":"wordfence","cve":"","title":"MiwoFTP < 1.0.6 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab0d9f3-0185-41f1-bab5-f47f828fa79c?source=api-prod","affected":[{"type":"plugin","slug":"miwoftp","name":"miwoftp","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2015-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ab1c745-1a0a-4c6c-af31-63844a2a8ac0","source":"wordfence","cve":"CVE-2025-67616","title":"Mella <= 1.2.29 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab1c745-1a0a-4c6c-af31-63844a2a8ac0?source=api-prod","affected":[{"type":"theme","slug":"mella","name":"Mella - Minimalist Ajax eCommerce PSD Template","from":"*","from_inclusive":true,"to":"1.2.29","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:29:57Z"},{"id":"wordfence:1ab4dc20-ce50-4ad0-aff4-9fc529d1911f","source":"wordfence","cve":"CVE-2012-2401","title":"WordPress Core <= 3.3.1 - Same Origin Policy Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab4dc20-ce50-4ad0-aff4-9fc529d1911f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2012-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ab56d29-7e35-4bc3-812e-d82890f60c8e","source":"wordfence","cve":"CVE-2023-52136","title":"Custom Twitter Feeds (Tweets Widget) <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab56d29-7e35-4bc3-812e-d82890f60c8e?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ab68c56-baf1-4507-86e8-9582a46eb544","source":"wordfence","cve":"CVE-2025-39409","title":"WordPress Video Robot - The Ultimate Video Importer <= 1.20.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab68c56-baf1-4507-86e8-9582a46eb544?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-robot","name":"WordPress Video Robot - The Ultimate Video Importer","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:26:41Z"},{"id":"wordfence:1ab970f5-35d1-43e9-891c-87a2a3e464c6","source":"wordfence","cve":"CVE-2025-7438","title":"MasterStudy LMS \u2013 Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"4.7.10"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-18T06:45:34Z"},{"id":"wordfence:1abdc53b-7abe-422b-aeea-5bf31733bdad","source":"wordfence","cve":"CVE-2019-14795","title":"Toggle The Title <= 1.4 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1abdc53b-7abe-422b-aeea-5bf31733bdad?source=api-prod","affected":[{"type":"plugin","slug":"toggle-the-title","name":"Toggle The Title","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2019-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1abee6b1-618b-491c-8017-d74e43c6aa47","source":"wordfence","cve":"CVE-2025-26770","title":"Waymark <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1abee6b1-618b-491c-8017-d74e43c6aa47?source=api-prod","affected":[{"type":"plugin","slug":"waymark","name":"Waymark","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:10:56Z"},{"id":"wordfence:1abf0bbd-c502-4db8-9e01-413517082dd8","source":"wordfence","cve":"CVE-2013-10030","title":"WordPress Exit Box Lite <= 1.06 - Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1abf0bbd-c502-4db8-9e01-413517082dd8?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-exit-box-lite","name":"WordPress Exit Box Lite","from":"1.06","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":"1.10"}],"published":"2013-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ac1c9f7-3f8f-41d3-af53-f0ee0466e383","source":"wordfence","cve":"CVE-2025-69314","title":"Werkstatt < 4.8.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac1c9f7-3f8f-41d3-af53-f0ee0466e383?source=api-prod","affected":[{"type":"theme","slug":"werkstatt","name":"Werkstatt - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":false,"patched_in":"4.8.3"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:56:47Z"},{"id":"wordfence:1ac218f6-0bfa-480c-9159-d75a027022ba","source":"wordfence","cve":"CVE-2024-10627","title":"WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac218f6-0bfa-480c-9159-d75a027022ba?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-support-ticket-system","name":"WooCommerce Support Ticket System","from":"*","from_inclusive":true,"to":"17.7","to_inclusive":true,"patched_in":"17.8"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:30:47Z"},{"id":"wordfence:1ac39498-3171-4d91-a911-381c8ed751dc","source":"wordfence","cve":"CVE-2014-2053","title":"WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness","severity":"medium","cvss":5.3,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac39498-3171-4d91-a911-381c8ed751dc?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":false,"patched_in":"3.9.2"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ac42a0f-19e9-4ce2-9708-d7aff1609c47","source":"wordfence","cve":"CVE-2025-39515","title":"Attendance Manager <= 0.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac42a0f-19e9-4ce2-9708-d7aff1609c47?source=api-prod","affected":[{"type":"plugin","slug":"attendance-manager","name":"Attendance Manager","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:13:59Z"},{"id":"wordfence:1ac58649-4c1a-4c2c-a94b-a3cf08ecb4df","source":"wordfence","cve":"CVE-2019-15870","title":"CarSpot \u2013 Dealership Wordpress Classified Theme < 2.1.7 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac58649-4c1a-4c2c-a94b-a3cf08ecb4df?source=api-prod","affected":[{"type":"theme","slug":"carspot","name":"CarSpot \u2013 Dealership Wordpress Classified Theme","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"}],"published":"2019-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ac6422f-0bb1-4586-adbb-71b04b2a8e63","source":"wordfence","cve":"CVE-2025-43841","title":"WP Vegas <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac6422f-0bb1-4586-adbb-71b04b2a8e63?source=api-prod","affected":[{"type":"plugin","slug":"vegas-fullscreen-background-slider","name":"WP Vegas","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:05:00Z"},{"id":"wordfence:1ac8fb0b-21a9-4b94-bb24-b349a7fe3305","source":"wordfence","cve":"CVE-2024-5344","title":"The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac8fb0b-21a9-4b94-bb24-b349a7fe3305?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2024-06-20T14:04:46Z","updated":"2024-06-21T02:05:42Z"},{"id":"wordfence:1acaa09d-762b-47df-97a1-cf5681fb19b3","source":"wordfence","cve":"CVE-2026-11974","title":"Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1acaa09d-762b-47df-97a1-cf5681fb19b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder-addon","name":"Media folder Addon","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-08T00:00:00Z","updated":"2026-08-07T18:24:10Z"},{"id":"wordfence:1acbd8e5-e384-4e29-9ab3-139b778320fc","source":"wordfence","cve":"CVE-2025-69034","title":"Lekker <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1acbd8e5-e384-4e29-9ab3-139b778320fc?source=api-prod","affected":[{"type":"theme","slug":"lekker","name":"Lekker - Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-06T15:51:31Z"},{"id":"wordfence:1accc41e-41d2-49e3-a80a-6b95b02cb42e","source":"wordfence","cve":"CVE-2023-49832","title":"Site Reviews <= 6.10.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1accc41e-41d2-49e3-a80a-6b95b02cb42e?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.10.3","to_inclusive":false,"patched_in":"6.10.3"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aced2cc-13d6-47d1-8f27-4aa8448ae763","source":"wordfence","cve":"CVE-2026-24973","title":"Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aced2cc-13d6-47d1-8f27-4aa8448ae763?source=api-prod","affected":[{"type":"theme","slug":"noo-citilights","name":"Support for CitiLights - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-19T14:55:48Z"},{"id":"wordfence:1acfa5d1-c1ba-4ba5-9511-0f4adbe5b9ca","source":"wordfence","cve":"CVE-2024-7850","title":"BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1acfa5d1-c1ba-4ba5-9511-0f4adbe5b9ca?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-search","name":"BP Profile Search","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.8"}],"published":"2024-08-19T13:39:17Z","updated":"2024-08-20T02:03:10Z"},{"id":"wordfence:1ad0d6eb-aafa-4f0b-bf1c-73d94e361087","source":"wordfence","cve":"CVE-2024-11465","title":"Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad0d6eb-aafa-4f0b-bf1c-73d94e361087?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-custom-woocommerce-product-tabs","name":"Custom Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-01-06T15:37:29Z","updated":"2025-04-17T13:09:25Z"},{"id":"wordfence:1ad22035-c971-4ce6-af4b-c78aa8a54f6a","source":"wordfence","cve":"CVE-2026-85570","title":"Tutor LMS 1.6.4 - 4.1.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad22035-c971-4ce6-af4b-c78aa8a54f6a?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"1.6.4","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:07:53Z"},{"id":"wordfence:1ad2b168-5874-4b0f-8710-d9ed9afc54bf","source":"wordfence","cve":"","title":"FAQs Manager <= 1.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad2b168-5874-4b0f-8710-d9ed9afc54bf?source=api-prod","affected":[{"type":"plugin","slug":"faqs-manager","name":"FAQs Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ad366f1-2369-4fb2-aeda-301c85cf6801","source":"wordfence","cve":"CVE-2023-23671","title":"Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad366f1-2369-4fb2-aeda-301c85cf6801?source=api-prod","affected":[{"type":"plugin","slug":"slider-slideshow","name":"Layer Slider","from":"*","from_inclusive":true,"to":"1.1.9.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ad38d18-689c-41ab-9e33-fccbf6791cdb","source":"wordfence","cve":"CVE-2017-6104","title":"Wordpress Plugin Mobile App Native 3.0 <= 3.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad38d18-689c-41ab-9e33-fccbf6791cdb?source=api-prod","affected":[{"type":"plugin","slug":"zen-mobile-app-native","name":"Wordpress Plugin Mobile App Native 3.0","from":"3.0","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ad42de2-9ed1-4cf6-a031-22789be4cbe2","source":"wordfence","cve":"CVE-2026-106013","title":"Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad42de2-9ed1-4cf6-a031-22789be4cbe2?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.61.0","to_inclusive":true,"patched_in":"4.62.0"}],"published":"2026-10-27T11:37:04Z","updated":"2026-10-28T01:30:49Z"},{"id":"wordfence:1ad5d2b2-fca8-46bb-8a03-02be07f2a800","source":"wordfence","cve":"CVE-2024-10532","title":"Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad5d2b2-fca8-46bb-8a03-02be07f2a800?source=api-prod","affected":[{"type":"plugin","slug":"bard-extra","name":"Bard Extra","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-11-20T13:55:11Z","updated":"2024-11-21T16:18:47Z"},{"id":"wordfence:1ad889f7-41cb-461f-8dc1-69236b06fb63","source":"wordfence","cve":"","title":"Add Any Extension to Pages <= 1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad889f7-41cb-461f-8dc1-69236b06fb63?source=api-prod","affected":[{"type":"plugin","slug":"add-any-extension-to-pages","name":"Add Any Extension to Pages","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ada39db-b316-4270-ac9c-3770b473d6a8","source":"wordfence","cve":"CVE-2025-8064","title":"Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ada39db-b316-4270-ac9c-3770b473d6a8?source=api-prod","affected":[{"type":"plugin","slug":"biblesupersearch","name":"Bible SuperSearch","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2025-08-20T20:41:27Z","updated":"2025-08-21T09:26:02Z"},{"id":"wordfence:1adcc627-c371-452b-95b7-25c659117116","source":"wordfence","cve":"CVE-2022-4496","title":"SAML Single Sign On \u2013 SSO Login Premium Multisite < 20.0.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1adcc627-c371-452b-95b7-25c659117116?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login Standard","from":"16","from_inclusive":true,"to":"16.0.8","to_inclusive":false,"patched_in":"16.0.8"},{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login Premium","from":"12","from_inclusive":true,"to":"12.1.0","to_inclusive":false,"patched_in":"12.1.0"},{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login Premium Multisite","from":"20","from_inclusive":true,"to":"20.0.7","to_inclusive":false,"patched_in":"20.0.7"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1add47ea-6a7b-443a-b31d-3bb6c0d5d72d","source":"wordfence","cve":"CVE-2023-1112","title":"Drag and Drop Multiple File Upload PRO <= 2.10.9 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1add47ea-6a7b-443a-b31d-3bb6c0d5d72d?source=api-prod","affected":[{"type":"plugin","slug":"drag-n-drop-upload-cf7-pro","name":"Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard","from":"*","from_inclusive":true,"to":"2.10.9","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1add8693-20df-431e-ad3b-b23322f1fa03","source":"wordfence","cve":"CVE-2025-14540","title":"Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1add8693-20df-431e-ad3b-b23322f1fa03?source=api-prod","affected":[{"type":"plugin","slug":"userback","name":"Userback","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-12-12T16:08:34Z","updated":"2026-06-24T14:56:03Z"},{"id":"wordfence:1ae01053-e6cd-4ddf-9e2a-4658cdb60f8e","source":"wordfence","cve":"","title":"PHPRelativePath Library - Various Plugins (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ae01053-e6cd-4ddf-9e2a-4658cdb60f8e?source=api-prod","affected":[{"type":"plugin","slug":"mpl-publisher","name":"MPL-Publisher \u2014 Ebook & Audiobook Creator","from":"*","from_inclusive":true,"to":"1.29.1","to_inclusive":true,"patched_in":"1.29.2"},{"type":"plugin","slug":"woo-pdf-invoices-bulk-download","name":"WooCommerce PDF Invoice Bulk Download","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"read-offline","name":"Read Offline","from":"*","from_inclusive":true,"to":"0.9.17","to_inclusive":true,"patched_in":""}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aea4732-9e7d-406f-b848-ff223104f176","source":"wordfence","cve":"CVE-2024-47349","title":"WPMobile.App <= 11.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aea4732-9e7d-406f-b848-ff223104f176?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.50","to_inclusive":true,"patched_in":"11.51"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:29:49Z"},{"id":"wordfence:1aea8fe3-7c75-4d3a-847a-ce0d1f9700f1","source":"wordfence","cve":"CVE-2023-23867","title":"Button Builder \u2013 Buttons X <= 0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aea8fe3-7c75-4d3a-847a-ce0d1f9700f1?source=api-prod","affected":[{"type":"plugin","slug":"buttons-x","name":"Button Builder \u2013 Buttons X","from":"*","from_inclusive":true,"to":"0.8.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aeafeec-7202-4ee6-b724-8dcf98591294","source":"wordfence","cve":"CVE-2024-11381","title":"Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aeafeec-7202-4ee6-b724-8dcf98591294?source=api-prod","affected":[{"type":"plugin","slug":"control-horas","name":"Control horas","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-21T00:00:00Z","updated":"2024-11-22T05:33:41Z"},{"id":"wordfence:1aec4b0c-43d5-4baf-aef8-0a5ee2453fe2","source":"wordfence","cve":"CVE-2025-54003","title":"Depot <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aec4b0c-43d5-4baf-aef8-0a5ee2453fe2?source=api-prod","affected":[{"type":"theme","slug":"depot","name":"Depot - eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:53:18Z"},{"id":"wordfence:1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87","source":"wordfence","cve":"CVE-2023-3203","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aed51a2-9fd4-43bb-b72d-ae8e51ee6e87?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1aedd621-73e0-46e0-8d25-3511e01d7a4e","source":"wordfence","cve":"CVE-2024-51628","title":"EzyOnlineBookings Online Booking System Widget <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1aedd621-73e0-46e0-8d25-3511e01d7a4e?source=api-prod","affected":[{"type":"plugin","slug":"ezyonlinebookings-online-booking-system","name":"EzyOnlineBookings Online Booking System Widget","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:43:35Z"},{"id":"wordfence:1af2bb8c-b168-40bb-a172-a7c9d7531e1f","source":"wordfence","cve":"CVE-2025-47695","title":"Blog Designer PRO <= 3.4.7 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1af2bb8c-b168-40bb-a172-a7c9d7531e1f?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pro","name":"Blog Designer PRO for WordPress","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-19T13:54:10Z"},{"id":"wordfence:1af442f7-b57c-47bd-9733-5e6bb5c89443","source":"wordfence","cve":"CVE-2023-46639","title":"kk Star Ratings <= 5.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1af442f7-b57c-47bd-9733-5e6bb5c89443?source=api-prod","affected":[{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1af5f7be-cfe2-4e0b-ae84-e44095644d84","source":"wordfence","cve":"CVE-2021-24224","title":"Easy Form Builder <= 1.0 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1af5f7be-cfe2-4e0b-ae84-e44095644d84?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder-by-bitware","name":"Easy Form Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1af8d91a-f87f-42d4-b277-d4372d580ca0","source":"wordfence","cve":"CVE-2024-51902","title":"TinyCode <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1af8d91a-f87f-42d4-b277-d4372d580ca0?source=api-prod","affected":[{"type":"plugin","slug":"tinycode","name":"TinyCode","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:18:16Z"},{"id":"wordfence:1afb94ab-b3ba-4598-8ff4-f9ffc6717371","source":"wordfence","cve":"CVE-2026-2729","title":"Forminator \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1afb94ab-b3ba-4598-8ff4-f9ffc6717371?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.52.0","to_inclusive":true,"patched_in":"1.52.1"}],"published":"2026-05-04T17:34:23Z","updated":"2026-05-05T06:43:30Z"},{"id":"wordfence:1b000835-7f9d-44b4-92a3-ffce6e06d2ec","source":"wordfence","cve":"CVE-2022-2383","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b000835-7f9d-44b4-92a3-ffce6e06d2ec?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b0094ed-1066-44da-b317-de8db91fa013","source":"wordfence","cve":"CVE-2026-94154","title":"Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b0094ed-1066-44da-b317-de8db91fa013?source=api-prod","affected":[{"type":"plugin","slug":"aurora-heatmap","name":"Aurora Heatmap","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-10-07T11:01:47Z","updated":"2026-10-07T23:27:15Z"},{"id":"wordfence:1b00e42b-9c03-4a3c-86b7-1552f7700b2f","source":"wordfence","cve":"CVE-2024-37463","title":"CRM Perks Forms <= 1.1.5 - Missing Authorization to Unauthenticated Form Submission","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b00e42b-9c03-4a3c-86b7-1552f7700b2f?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T13:52:10Z"},{"id":"wordfence:1b01991c-de16-43c4-bb11-c8730230ce51","source":"wordfence","cve":"CVE-2024-10588","title":"Debug Tool <= 2.2 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b01991c-de16-43c4-bb11-c8730230ce51?source=api-prod","affected":[{"type":"plugin","slug":"debug-tool","name":"Debug Tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T14:06:33Z","updated":"2024-11-09T02:31:59Z"},{"id":"wordfence:1b038c9e-9053-43aa-99f2-cba660d2a7ff","source":"wordfence","cve":"CVE-2024-33949","title":"Min and Max Purchase for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b038c9e-9053-43aa-99f2-cba660d2a7ff?source=api-prod","affected":[{"type":"plugin","slug":"min-and-max-purchase-for-woocommerce","name":"Min and Max Purchase for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:52:57Z"},{"id":"wordfence:1b05171e-e27f-437b-b9a8-0636da7bee8d","source":"wordfence","cve":"CVE-2026-93908","title":"Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b05171e-e27f-437b-b9a8-0636da7bee8d?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2026-09-29T20:23:45Z","updated":"2026-10-21T00:10:58Z"},{"id":"wordfence:1b05191b-4f4a-487a-9fbf-843a4787511e","source":"wordfence","cve":"CVE-2024-30480","title":"CGC Maintenance Mode <= 1.2 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b05191b-4f4a-487a-9fbf-843a4787511e?source=api-prod","affected":[{"type":"plugin","slug":"cgc-maintenance-mode","name":"CGC Maintenance Mode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:55:08Z"},{"id":"wordfence:1b07c449-eea5-4bf6-98a7-747358b423ee","source":"wordfence","cve":"CVE-2026-76547","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b07c449-eea5-4bf6-98a7-747358b423ee?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:49:30Z"},{"id":"wordfence:1b097ab2-7675-4409-b22a-ad70cee35ab1","source":"wordfence","cve":"CVE-2023-24000","title":"GamiPress <= 2.5.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b097ab2-7675-4409-b22a-ad70cee35ab1?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.7.1"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b0c1afc-0e77-4a56-89cb-84e2fcc8aa21","source":"wordfence","cve":"CVE-2024-28850","title":"WP Crontrol <= 1.16.1 - Remote Code Execution","severity":"high","cvss":7.5,"cwe":"CWE-494","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b0c1afc-0e77-4a56-89cb-84e2fcc8aa21?source=api-prod","affected":[{"type":"plugin","slug":"wp-crontrol","name":"WP Crontrol","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2024-03-24T00:00:00Z","updated":"2025-04-25T20:51:51Z"},{"id":"wordfence:1b0e8594-785c-4e15-b037-3834a01da793","source":"wordfence","cve":"CVE-2026-57632","title":"Email Marketing for WooCommerce by Omnisend <= 1.19.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b0e8594-785c-4e15-b037-3834a01da793?source=api-prod","affected":[{"type":"plugin","slug":"omnisend-connect","name":"Email Marketing for WooCommerce by Omnisend","from":"*","from_inclusive":true,"to":"1.19.0","to_inclusive":true,"patched_in":"1.19.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:37:35Z"},{"id":"wordfence:1b0ef8d9-0754-4a37-bbe5-1eab71a74cc1","source":"wordfence","cve":"CVE-2026-105191","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce < 1.17.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b0ef8d9-0754-4a37-bbe5-1eab71a74cc1?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.11","to_inclusive":false,"patched_in":"1.17.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:37:11Z"},{"id":"wordfence:1b125b0d-caf7-4685-963d-9b627ec3dbd7","source":"wordfence","cve":"CVE-2026-81784","title":"Wise Chat <= 3.4.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b125b0d-caf7-4685-963d-9b627ec3dbd7?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-09-08T00:00:00Z","updated":"2026-10-13T17:00:21Z"},{"id":"wordfence:1b1268ae-51b0-4243-9cc8-c8564c121ff2","source":"wordfence","cve":"CVE-2026-39673","title":"iZooto <= 3.7.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1268ae-51b0-4243-9cc8-c8564c121ff2?source=api-prod","affected":[{"type":"plugin","slug":"izooto-web-push","name":"iZooto \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-26T18:18:43Z"},{"id":"wordfence:1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c","source":"wordfence","cve":"CVE-2026-5356","title":"LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1338c4-36a8-47b0-b3cf-c5dc690f8c1c?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2026-07-07T23:37:02Z","updated":"2026-07-08T12:33:15Z"},{"id":"wordfence:1b162ef2-7428-47cc-91c6-c8f66512c5dc","source":"wordfence","cve":"CVE-2015-5151","title":"Slider Revolution <= 4.2.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b162ef2-7428-47cc-91c6-c8f66512c5dc?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2014-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b1b61e6-2130-4462-a974-977dfe600371","source":"wordfence","cve":"CVE-2025-32526","title":"Zephyr Project Manager <= 3.3.101 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1b61e6-2130-4462-a974-977dfe600371?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.101","to_inclusive":true,"patched_in":"3.3.102"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:13:52Z"},{"id":"wordfence:1b1d2d03-f96a-4495-bdf9-0f48ad9cefd6","source":"wordfence","cve":"CVE-2025-23686","title":"Admin Menu Organizer <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1d2d03-f96a-4495-bdf9-0f48ad9cefd6?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-organizer","name":"Admin Menu Organizer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:00:46Z"},{"id":"wordfence:1b1d4180-091c-4679-a8d2-a6915ec05772","source":"wordfence","cve":"CVE-2017-18505","title":"BestWebSoft's Twitter < 2.55 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1d4180-091c-4679-a8d2-a6915ec05772?source=api-prod","affected":[{"type":"plugin","slug":"twitter-plugin","name":"BestWebSoft's Twitter","from":"*","from_inclusive":true,"to":"2.55","to_inclusive":false,"patched_in":"2.55"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b1db6b8-f005-488f-b2cc-667acc700b0a","source":"wordfence","cve":"CVE-2023-45070","title":"Form Maker by 10Web <= 1.15.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b1db6b8-f005-488f-b2cc-667acc700b0a?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.18","to_inclusive":true,"patched_in":"1.15.19"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b21bdfd-42ec-43fe-b581-04276b86c50b","source":"wordfence","cve":"CVE-2025-15511","title":"Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b21bdfd-42ec-43fe-b581-04276b86c50b?source=api-prod","affected":[{"type":"plugin","slug":"rupantorpay","name":"Rupantorpay","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:47:14Z","updated":"2026-01-28T11:23:38Z"},{"id":"wordfence:1b22067d-49a5-488a-8575-9a32f50ac861","source":"wordfence","cve":"CVE-2026-105056","title":"eCommerce Product Catalog <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b22067d-49a5-488a-8575-9a32f50ac861?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-10-05T08:46:00Z","updated":"2026-10-08T23:28:54Z"},{"id":"wordfence:1b245791-6aac-4ee3-9278-5b7c01f13263","source":"wordfence","cve":"CVE-2024-32796","title":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress <= 3.42.10 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b245791-6aac-4ee3-9278-5b7c01f13263?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"*","from_inclusive":true,"to":"3.42.10","to_inclusive":true,"patched_in":"3.43.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:44:07Z"},{"id":"wordfence:1b25df18-dd9a-4b24-8187-283d5f3f334e","source":"wordfence","cve":"CVE-2024-24833","title":"Happy Addons for Elementor <= 3.10.1 - Missing Authorization via add_row_actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b25df18-dd9a-4b24-8187-283d5f3f334e?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T17:56:35Z"},{"id":"wordfence:1b29048e-cf06-463c-82e0-f1d973e50232","source":"wordfence","cve":"CVE-2023-51398","title":"Ultimate Addons for Beaver Builder <= 1.35.14 - Authenticated(Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b29048e-cf06-463c-82e0-f1d973e50232?source=api-prod","affected":[{"type":"plugin","slug":"bb-ultimate-addon","name":"Ultimate Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.35.14","to_inclusive":true,"patched_in":"1.35.15"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b2ac807-c6e1-43de-8385-240ccae87e81","source":"wordfence","cve":"CVE-2022-1830","title":"Amazon Einzeltitellinks <= 1.3.3 - Cross-Site Request Forgery to Arbitrary Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2ac807-c6e1-43de-8385-240ccae87e81?source=api-prod","affected":[{"type":"plugin","slug":"amazon-einzeltitellinks","name":"Amazon Einzeltitellinks","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b2ad299-03b1-4b9e-a241-d2ad2d85c3ac","source":"wordfence","cve":"CVE-2026-0820","title":"RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2ad299-03b1-4b9e-a241-d2ad2d85c3ac?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1116","to_inclusive":true,"patched_in":"4.1121"}],"published":"2026-01-16T14:36:16Z","updated":"2026-03-27T10:53:06Z"},{"id":"wordfence:1b2ae827-0d22-430b-8de3-bd2a15bc6e23","source":"wordfence","cve":"CVE-2025-47579","title":"Photography <= 7.5.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2ae827-0d22-430b-8de3-bd2a15bc6e23?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"Photography","from":"*","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-18T14:58:13Z"},{"id":"wordfence:1b2b49af-1bed-4c81-95c2-f8b80c06a829","source":"wordfence","cve":"CVE-2024-37493","title":"Posterity <= 3.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2b49af-1bed-4c81-95c2-f8b80c06a829?source=api-prod","affected":[{"type":"theme","slug":"posterity","name":"Posterity","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:08:47Z"},{"id":"wordfence:1b2cf896-7cb8-4a1e-bd8c-4da339965138","source":"wordfence","cve":"CVE-2024-53824","title":"All Bootstrap Blocks <= 1.3.19 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2cf896-7cb8-4a1e-bd8c-4da339965138?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:35:44Z"},{"id":"wordfence:1b313177-d329-40a4-8a90-ce14b5cb90a9","source":"wordfence","cve":"","title":"Alpine PhotoTile For Instagram < 1.2.9  - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b313177-d329-40a4-8a90-ce14b5cb90a9?source=api-prod","affected":[{"type":"plugin","slug":"alpine-photo-tile-for-instagram","name":"Alpine Photo Tile for Instagram","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b34a4aa-bcaa-4be5-a059-6f2efa3a8198","source":"wordfence","cve":"CVE-2024-1846","title":"Responsive Tabs <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b34a4aa-bcaa-4be5-a059-6f2efa3a8198?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs","name":"Responsive Tabs","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-24T16:13:57Z"},{"id":"wordfence:1b3610f3-d589-4a45-9f80-6b66205de093","source":"wordfence","cve":"CVE-2026-15248","title":"Meta Box < 5.13.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3610f3-d589-4a45-9f80-6b66205de093?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.13.1","to_inclusive":false,"patched_in":"5.13.1"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:26:51Z"},{"id":"wordfence:1b36fc50-7573-466e-883e-8d26f243c4d0","source":"wordfence","cve":"CVE-2024-9660","title":"School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b36fc50-7573-466e-883e-8d26f243c4d0?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"91.5.0","to_inclusive":true,"patched_in":"92.0.0"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T07:38:04Z"},{"id":"wordfence:1b377236-bb56-4d31-837a-c5064d46a6c6","source":"wordfence","cve":"CVE-2023-45109","title":"WhitePage <= 1.1.5 - Cross-Site Request Forgery via params_api_form.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b377236-bb56-4d31-837a-c5064d46a6c6?source=api-prod","affected":[{"type":"plugin","slug":"white-page-publication","name":"WhitePage","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b384e1a-4e6d-4272-b9b2-bbb6b9baa5d2","source":"wordfence","cve":"CVE-2025-53307","title":"WordPress Assistant <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b384e1a-4e6d-4272-b9b2-bbb6b9baa5d2?source=api-prod","affected":[{"type":"plugin","slug":"assistant","name":"Assistant \u2013 Every Day Productivity Apps","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-15T19:32:42Z"},{"id":"wordfence:1b38e7ec-6663-4253-9c60-61ed34be22c1","source":"wordfence","cve":"CVE-2023-0373","title":"Lightweight Accordion <= 1.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b38e7ec-6663-4253-9c60-61ed34be22c1?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-accordion","name":"Lightweight Accordion","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":"1.5.15"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b3948ef-11be-450d-ad20-e4bebc16e790","source":"wordfence","cve":"CVE-2024-13391","title":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3948ef-11be-450d-ad20-e4bebc16e790?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"2.9.29","to_inclusive":true,"patched_in":"2.9.30"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:06Z"},{"id":"wordfence:1b3b4b45-5964-490a-991b-c9eb79c670e2","source":"wordfence","cve":"CVE-2023-32119","title":"WPO365 | Mail Integration for Office 365 / Outlook <= 1.9.0 - reflected Cross-Site Scripting via error_description","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3b4b45-5964-490a-991b-c9eb79c670e2?source=api-prod","affected":[{"type":"plugin","slug":"mail-integration-365","name":"WPO365 | Mail Integration for Office 365 / Outlook","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b3b8a6c-1c84-4abe-ad4a-02302b04987b","source":"wordfence","cve":"CVE-2026-8692","title":"Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3b8a6c-1c84-4abe-ad4a-02302b04987b?source=api-prod","affected":[{"type":"plugin","slug":"vedrixa-forms-registration-builder","name":"Vedrixa Forms \u2013 User Registration Form, Signup Form & Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-05-21T19:24:47Z","updated":"2026-05-22T07:50:24Z"},{"id":"wordfence:1b3bd31f-0f5a-4b4a-811b-5482db866bd5","source":"wordfence","cve":"CVE-2025-9631","title":"AutoCatSet <= 2.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3bd31f-0f5a-4b4a-811b-5482db866bd5?source=api-prod","affected":[{"type":"plugin","slug":"autocatset","name":"AutoCatSet","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:53:17Z","updated":"2025-09-11T07:24:49Z"},{"id":"wordfence:1b3be300-5b7f-4844-8637-1bb8c939ed4c","source":"wordfence","cve":"CVE-2023-5822","title":"Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3be300-5b7f-4844-8637-1bb8c939ed4c?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.7.3","to_inclusive":true,"patched_in":"1.3.7.4"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b3df470-d0b7-49e8-bcb2-ac999e0b71d1","source":"wordfence","cve":"CVE-2022-2429","title":"Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3df470-d0b7-49e8-bcb2-ac999e0b71d1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-sms-notifications","name":"Ultimate SMS Notifications for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b3faa60-b341-4550-b41a-79d41a15e802","source":"wordfence","cve":"CVE-2026-103300","title":"Eurobank WooCommerce Payment Gateway < 2.1.2 - Unauthenticated Order Payment Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3faa60-b341-4550-b41a-79d41a15e802?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-for-eurobank","name":"Eurobank WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-11-10T23:22:34Z"},{"id":"wordfence:1b423aca-e0d2-487d-a861-a2b589c2a62e","source":"wordfence","cve":"CVE-2018-20101","title":"Import users from CSV with meta <= 1.12 - Import Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b423aca-e0d2-487d-a861-a2b589c2a62e?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":false,"patched_in":"1.12.1"}],"published":"2018-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b4630f7-74db-46c4-bf86-f1ff64be3463","source":"wordfence","cve":"CVE-2023-51419","title":"BERTHA AI Plugin <= 1.11.10.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4630f7-74db-46c4-bf86-f1ff64be3463?source=api-prod","affected":[{"type":"plugin","slug":"bertha-ai-free","name":"BERTHA AI. Your AI co-pilot for WordPress and Chrome","from":"*","from_inclusive":true,"to":"1.11.10.8","to_inclusive":false,"patched_in":"1.11.10.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b4acf11-114a-4e97-89cd-1d387f14a730","source":"wordfence","cve":"CVE-2025-10738","title":"URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T18:31:33Z","updated":"2025-12-13T06:33:55Z"},{"id":"wordfence:1b4d798e-75f2-4fc9-9d1f-1345a80623ee","source":"wordfence","cve":"CVE-2025-25150","title":"uListing <= 2.1.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4d798e-75f2-4fc9-9d1f-1345a80623ee?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:59:49Z"},{"id":"wordfence:1b4eb0a1-69ad-4e0d-9760-752ec0589314","source":"wordfence","cve":"CVE-2021-24374","title":"JetPack <= 9.7 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4eb0a1-69ad-4e0d-9760-752ec0589314?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.0","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.1","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.2","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.3","from_inclusive":true,"to":"2.3.9","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.4","from_inclusive":true,"to":"2.4.6","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.5","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.6","from_inclusive":true,"to":"2.6.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.7","from_inclusive":true,"to":"2.7.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.8","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.9","from_inclusive":true,"to":"2.9.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.0","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.1","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.2","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.3","from_inclusive":true,"to":"3.3.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.4","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.5","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.6","from_inclusive":true,"to":"3.6.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.9","from_inclusive":true,"to":"3.9.8","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.0","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.1","from_inclusive":true,"to":"4.1.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.3","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.5","from_inclusive":true,"to":"4.5.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.9","from_inclusive":true,"to":"4.9.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.0","from_inclusive":true,"to":"5.0.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.5","from_inclusive":true,"to":"5.5.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.6","from_inclusive":true,"to":"5.6.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.8","from_inclusive":true,"to":"5.8.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.9","from_inclusive":true,"to":"5.9.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.2","from_inclusive":true,"to":"6.2.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.3","from_inclusive":true,"to":"6.3.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.4","from_inclusive":true,"to":"6.4.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.5","from_inclusive":true,"to":"6.5.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.6","from_inclusive":true,"to":"6.6.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.7","from_inclusive":true,"to":"6.7.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.9","from_inclusive":true,"to":"6.9.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.0","from_inclusive":true,"to":"7.0.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.1","from_inclusive":true,"to":"7.1.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.2","from_inclusive":true,"to":"7.2.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.3","from_inclusive":true,"to":"7.3.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.4","from_inclusive":true,"to":"7.4.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.5","from_inclusive":true,"to":"7.5.5","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.6","from_inclusive":true,"to":"7.6.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.7","from_inclusive":true,"to":"7.7.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.8","from_inclusive":true,"to":"7.8.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.9","from_inclusive":true,"to":"7.9.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.0","from_inclusive":true,"to":"8.0.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.1","from_inclusive":true,"to":"8.1.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.2","from_inclusive":true,"to":"8.2.4","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.3","from_inclusive":true,"to":"8.3.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.4","from_inclusive":true,"to":"8.4.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.5","from_inclusive":true,"to":"8.5.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.6","from_inclusive":true,"to":"8.6.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.7","from_inclusive":true,"to":"8.7.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.8","from_inclusive":true,"to":"8.8.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.9","from_inclusive":true,"to":"8.9.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.0","from_inclusive":true,"to":"9.0.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.1","from_inclusive":true,"to":"9.1.1","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.2","from_inclusive":true,"to":"9.2.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.3","from_inclusive":true,"to":"9.3.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.4","from_inclusive":true,"to":"9.4.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.5","from_inclusive":true,"to":"9.5.3","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.6","from_inclusive":true,"to":"9.6.2","to_inclusive":false,"patched_in":"2.0.8"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.7","from_inclusive":true,"to":"9.7.1","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b54ce63-ea6e-40e0-a66b-9a08e81f77be","source":"wordfence","cve":"CVE-2025-68896","title":"WDV One Page Docs <= 1.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b54ce63-ea6e-40e0-a66b-9a08e81f77be?source=api-prod","affected":[{"type":"plugin","slug":"wdv-one-page-docs","name":"WDV One Page Docs \u2013 Documentation Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T15:54:36Z"},{"id":"wordfence:1b57cbaa-8a5f-4a00-9c77-6b187c416594","source":"wordfence","cve":"CVE-2025-30780","title":"Audio Album <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b57cbaa-8a5f-4a00-9c77-6b187c416594?source=api-prod","affected":[{"type":"plugin","slug":"audio-album","name":"Audio Album","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:26:22Z"},{"id":"wordfence:1b583679-898f-47c3-aea5-0e3667c4043d","source":"wordfence","cve":"CVE-2025-31537","title":"Bulk NoIndex & NoFollow Toolkit <= 2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b583679-898f-47c3-aea5-0e3667c4043d?source=api-prod","affected":[{"type":"plugin","slug":"bulk-noindex-nofollow-toolkit-by-mad-fish","name":"Bulk NoIndex & NoFollow Toolkit","from":"*","from_inclusive":true,"to":"2.16","to_inclusive":true,"patched_in":"2.20"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-18T13:43:04Z"},{"id":"wordfence:1b5a0c87-59b0-4da4-8949-0957f8e1b479","source":"wordfence","cve":"CVE-2026-9711","title":"EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a0c87-59b0-4da4-8949-0957f8e1b479?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T20:41:25Z","updated":"2026-06-30T09:31:48Z"},{"id":"wordfence:1b5a4289-6228-4b77-9929-864b88c34dbe","source":"wordfence","cve":"","title":"Fusion <= 2.1 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a4289-6228-4b77-9929-864b88c34dbe?source=api-prod","affected":[{"type":"theme","slug":"fushion-theme","name":"Fusion","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b5a6633-4ce3-4249-a5b0-d8f960aae903","source":"wordfence","cve":"CVE-2024-13123","title":"AFI \u2013 The Easiest Integration Plugin <= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a6633-4ce3-4249-a5b0-d8f960aae903?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.99.0","to_inclusive":true,"patched_in":"1.100.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:20:22Z"},{"id":"wordfence:1b5cf360-0163-4a7c-8979-ec89ec80ad62","source":"wordfence","cve":"CVE-2025-1513","title":"Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery \u2013 Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5cf360-0163-4a7c-8979-ec89ec80ad62?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"26.0.0.1","to_inclusive":true,"patched_in":"26.0.1"}],"published":"2025-02-27T16:40:04Z","updated":"2025-02-28T05:23:17Z"},{"id":"wordfence:1b5de554-1d2f-4932-9f93-1333b07edeba","source":"wordfence","cve":"CVE-2024-10795","title":"Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5de554-1d2f-4932-9f93-1333b07edeba?source=api-prod","affected":[{"type":"plugin","slug":"popularis-extra","name":"Popularis Extra","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-16T02:02:27Z"},{"id":"wordfence:1b5dee10-7dd3-4ce7-9e37-e54fc98dbc7b","source":"wordfence","cve":"CVE-2025-32664","title":"Nepali Date Utilities <= 1.0.16 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5dee10-7dd3-4ce7-9e37-e54fc98dbc7b?source=api-prod","affected":[{"type":"plugin","slug":"nepali-date-utilities","name":"Nepali Date Utilities","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-04-09T00:00:00Z","updated":"2026-11-03T22:43:50Z"},{"id":"wordfence:1b602526-3b79-45ed-bada-598e33b9106c","source":"wordfence","cve":"CVE-2025-53247","title":"BlogMarks < 1.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b602526-3b79-45ed-bada-598e33b9106c?source=api-prod","affected":[{"type":"theme","slug":"blogmarks","name":"BlogMarks","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2025-08-21T00:00:00Z","updated":"2026-05-26T18:16:58Z"},{"id":"wordfence:1b621316-6955-4dc9-9534-c53cfea9a783","source":"wordfence","cve":"CVE-2026-119481","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b621316-6955-4dc9-9534-c53cfea9a783?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.7.1","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:11Z"},{"id":"wordfence:1b631b92-b8fb-4f9b-ae2a-bbfd16440ebb","source":"wordfence","cve":"CVE-2014-9368","title":"twitterDash <= 2.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b631b92-b8fb-4f9b-ae2a-bbfd16440ebb?source=api-prod","affected":[{"type":"plugin","slug":"twitterdash","name":"twitterDash","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b645d0e-daee-4926-af47-05cacf811fbf","source":"wordfence","cve":"CVE-2023-28774","title":"Review Stream <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b645d0e-daee-4926-af47-05cacf811fbf?source=api-prod","affected":[{"type":"plugin","slug":"review-stream","name":"Review Stream","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b660260-e335-4be0-a266-0cdc9a4d7504","source":"wordfence","cve":"CVE-2021-25013","title":"Qubely <= 1.7.7 - Missing Authorization to Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b660260-e335-4be0-a266-0cdc9a4d7504?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":false,"patched_in":"1.7.8"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b68ff1e-ef79-4c11-a73c-591177d8dffe","source":"wordfence","cve":"CVE-2024-11456","title":"Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b68ff1e-ef79-4c11-a73c-591177d8dffe?source=api-prod","affected":[{"type":"plugin","slug":"contest-code-checker","name":"Run Contests, Raffles, and Giveaways with ContestsWP","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T08:31:11Z"},{"id":"wordfence:1b693646-efdb-44c7-a8d8-48315d19fe23","source":"wordfence","cve":"CVE-2026-27328","title":"EduBlink <= 2.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b693646-efdb-44c7-a8d8-48315d19fe23?source=api-prod","affected":[{"type":"theme","slug":"edublink","name":"EduBlink - Education & Online Course WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T00:00:00Z","updated":"2026-05-04T15:37:28Z"},{"id":"wordfence:1b69831e-19ab-4812-b657-dc4febe15077","source":"wordfence","cve":"CVE-2013-4625","title":"Duplicator \u2013 WordPress Migration Plugin <= 0.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b69831e-19ab-4812-b657-dc4febe15077?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"0.4.4","to_inclusive":true,"patched_in":"0.4.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b70b9b1-bde9-4a32-ae7b-a4c8d73abbc4","source":"wordfence","cve":"CVE-2023-5228","title":"User Registration \u2013 Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b70b9b1-bde9-4a32-ae7b-a4c8d73abbc4?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.0.4.1","to_inclusive":true,"patched_in":"3.0.4.2"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b71eae9-9727-49c9-9926-85689286983f","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b71eae9-9727-49c9-9926-85689286983f?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b73402b-444c-47ad-9c05-7be6e6440123","source":"wordfence","cve":"CVE-2024-3718","title":"The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b73402b-444c-47ad-9c05-7be6e6440123?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2024-05-23T00:00:00Z","updated":"2024-06-13T14:15:49Z"},{"id":"wordfence:1b75da76-1a58-4f8e-9b4f-d2e40d09f9ea","source":"wordfence","cve":"CVE-2021-24334","title":"Instant Images \u2013 One Click Unsplash, Pixabay and Pexels Uploads <= 4.4.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b75da76-1a58-4f8e-9b4f-d2e40d09f9ea?source=api-prod","affected":[{"type":"plugin","slug":"instant-images","name":"Instant Images \u2013 One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.0.1"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b786e22-9fbe-4d84-9139-3d18f9339d2f","source":"wordfence","cve":"CVE-2025-53468","title":"Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b786e22-9fbe-4d84-9139-3d18f9339d2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-tabber-widget","name":"Wp tabber widget","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:01:49Z"},{"id":"wordfence:1b8085e5-073a-4de1-95d7-6a1aa331d6f6","source":"wordfence","cve":"CVE-2025-28988","title":"WP Front User Submit / Front Editor <= 4.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8085e5-073a-4de1-95d7-6a1aa331d6f6?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T16:44:29Z"},{"id":"wordfence:1b80f389-19f9-49a5-aab8-3096838ccfe5","source":"wordfence","cve":"CVE-2025-57967","title":"WPB Quick View for WooCommerce <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b80f389-19f9-49a5-aab8-3096838ccfe5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-lightbox","name":"WPB Quick View Popup for WooCommerce \u2013 Fast Product Preview Modal & AJAX Quick View","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-12-18T18:43:39Z"},{"id":"wordfence:1b82ce74-11ac-4719-961d-a16717ce023b","source":"wordfence","cve":"CVE-2025-14428","title":"My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b82ce74-11ac-4719-961d-a16717ce023b?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-01T16:19:30Z"},{"id":"wordfence:1b847857-5dc9-4793-b9d6-759f27377fe3","source":"wordfence","cve":"CVE-2023-48750","title":"Void Elementor Post Grid Addon for Elementor Page builder <= 2.1.10 - Missing Authorization to Review Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b847857-5dc9-4793-b9d6-759f27377fe3?source=api-prod","affected":[{"type":"plugin","slug":"void-elementor-post-grid-addon-for-elementor-page-builder","name":"Void Elementor Post Grid Addon for Elementor Page builder","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b85306d-ffb6-487d-a981-6fc04b27e751","source":"wordfence","cve":"CVE-2019-16524","title":"Easy Fancybox <= 1.8.17 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b85306d-ffb6-487d-a981-6fc04b27e751?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"1.8.17","to_inclusive":true,"patched_in":"1.8.18"}],"published":"2019-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b87fe3d-a88d-477a-8d91-4d7c2dba4a43","source":"wordfence","cve":"CVE-2024-1234","title":"Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b87fe3d-a88d-477a-8d91-4d7c2dba4a43?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:26:35Z"},{"id":"wordfence:1b89910b-ca2c-45a0-8b82-2bb9607fbe20","source":"wordfence","cve":"CVE-2025-49274","title":"Neom Blog <= 0.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b89910b-ca2c-45a0-8b82-2bb9607fbe20?source=api-prod","affected":[{"type":"theme","slug":"neom-blog","name":"Neom Blog","from":"*","from_inclusive":true,"to":"0.0.9","to_inclusive":true,"patched_in":"0.1.0"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-01T14:01:53Z"},{"id":"wordfence:1b8b0f14-f31a-45cd-bb98-0b717059aa80","source":"wordfence","cve":"CVE-2023-3708","title":"Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8b0f14-f31a-45cd-bb98-0b717059aa80?source=api-prod","affected":[{"type":"theme","slug":"everse","name":"Everse","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.12"},{"type":"theme","slug":"nokke","name":"Nokke","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"theme","slug":"medikaid","name":"MedikAid | Medical Health Care RTL WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"theme","slug":"arendelle","name":"Arendelle","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"},{"type":"theme","slug":"amela","name":"Amela","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b8d866e-e187-4ff5-bed7-b03e2a213c11","source":"wordfence","cve":"CVE-2024-37440","title":"Church Admin <= 4.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8d866e-e187-4ff5-bed7-b03e2a213c11?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:20:33Z"},{"id":"wordfence:1b8d88e4-a9dc-4740-b836-99f730beefcb","source":"wordfence","cve":"CVE-2025-6680","title":"Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8d88e4-a9dc-4740-b836-99f730beefcb?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-10-24T17:20:18Z","updated":"2025-10-25T05:31:19Z"},{"id":"wordfence:1b8ef792-c2a8-4fc5-bee7-4de3b6b007c9","source":"wordfence","cve":"CVE-2022-42494","title":"All in One SEO Pro <= 4.2.5.1 - Authenticated (Admin+) Server Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8ef792-c2a8-4fc5-bee7-4de3b6b007c9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack-pro","name":"All in One SEO Pro \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic","from":"*","from_inclusive":true,"to":"4.2.5.1","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b902d46-ff27-486f-836d-f55a8048f08c","source":"wordfence","cve":"CVE-2024-12809","title":"Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b902d46-ff27-486f-836d-f55a8048f08c?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":"1.0.44"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T06:40:03Z"},{"id":"wordfence:1b9103b9-a33d-4838-9454-70fa5277c5a0","source":"wordfence","cve":"CVE-2025-24647","title":"WooCommerce Cloak Affiliate Links <= 1.0.35 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b9103b9-a33d-4838-9454-70fa5277c5a0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-cloak-affiliate-links","name":"Cloak Affiliate Links for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.35","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:26:20Z"},{"id":"wordfence:1b92f42e-d596-434f-b42e-2cd34f6f95a1","source":"wordfence","cve":"CVE-2025-23858","title":"Custom Users Order <= 4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b92f42e-d596-434f-b42e-2cd34f6f95a1?source=api-prod","affected":[{"type":"plugin","slug":"custom-users-order","name":"Custom Users Order","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T22:10:27Z"},{"id":"wordfence:1b94583f-405e-4fd3-849e-33563b72f698","source":"wordfence","cve":"CVE-2024-32959","title":"Sirv <= 7.2.2 - Missing Authorization to Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b94583f-405e-4fd3-849e-33563b72f698?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":"7.2.3"}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T17:28:51Z"},{"id":"wordfence:1b948297-7ca1-4c5a-9ade-6b26e7bbcd62","source":"wordfence","cve":"CVE-2025-67998","title":"Miraculous Elementor <= 2.0.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b948297-7ca1-4c5a-9ade-6b26e7bbcd62?source=api-prod","affected":[{"type":"plugin","slug":"miraculous-el","name":"Miraculous Elementor","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-17T14:55:55Z"},{"id":"wordfence:1b996e76-770f-41cc-9601-4e1a3e0127bf","source":"wordfence","cve":"CVE-2022-25601","title":"Contact Form X <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b996e76-770f-41cc-9601-4e1a3e0127bf?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-x","name":"Contact Form X","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2022-02-25T15:41:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b9bebab-e0e4-4f54-b297-aec0dcecf13e","source":"wordfence","cve":"CVE-2026-101889","title":"Prime Mover \u2013 Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary Directory Deletion","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b9bebab-e0e4-4f54-b297-aec0dcecf13e?source=api-prod","affected":[{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:37:07Z"},{"id":"wordfence:1b9cb5b8-2282-4197-b3f3-01b920529326","source":"wordfence","cve":"CVE-2026-27991","title":"Avventure <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b9cb5b8-2282-4197-b3f3-01b920529326?source=api-prod","affected":[{"type":"theme","slug":"avventure","name":"Avventure","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:16:45Z"},{"id":"wordfence:1b9ed184-814d-46cb-979c-908bc9359fae","source":"wordfence","cve":"","title":"Swift SMTP <= 5.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b9ed184-814d-46cb-979c-908bc9359fae?source=api-prod","affected":[{"type":"plugin","slug":"welcome-email-editor","name":"Swift SMTP (formerly Welcome Email Editor)","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1b9f3e68-b069-4f41-87a1-ffaa287215b9","source":"wordfence","cve":"CVE-2025-31386","title":"Simple:Press <= 6.10.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1b9f3e68-b069-4f41-87a1-ffaa287215b9?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.11.5","to_inclusive":true,"patched_in":"6.11.6"}],"published":"2025-03-31T00:00:00Z","updated":"2025-08-11T13:58:50Z"},{"id":"wordfence:1ba077d6-b3d3-4a28-8b08-b8bf947e900c","source":"wordfence","cve":"CVE-2025-32666","title":"Hive Support <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba077d6-b3d3-4a28-8b08-b8bf947e900c?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-04-15T00:00:00Z","updated":"2025-06-17T14:13:20Z"},{"id":"wordfence:1ba0a31c-d98e-435d-8a78-90a8585e737d","source":"wordfence","cve":"CVE-2026-61992","title":"GEO my WP <= 4.5.5.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba0a31c-d98e-435d-8a78-90a8585e737d?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5.3","to_inclusive":true,"patched_in":"4.5.5.4"}],"published":"2026-10-13T06:29:42Z","updated":"2026-11-03T20:06:04Z"},{"id":"wordfence:1ba1844f-96fb-458e-b428-bbc896977cd1","source":"wordfence","cve":"CVE-2024-32133","title":"EZ Form Calculator <= 2.14.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba1844f-96fb-458e-b428-bbc896977cd1?source=api-prod","affected":[{"type":"plugin","slug":"ez-form-calculator","name":"EZ Form Calculator","from":"*","from_inclusive":true,"to":"2.14.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:14:49Z"},{"id":"wordfence:1ba33c84-5198-4c77-8995-d0a315d68990","source":"wordfence","cve":"CVE-2024-1637","title":"360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba33c84-5198-4c77-8995-d0a315d68990?source=api-prod","affected":[{"type":"plugin","slug":"360deg-javascript-viewer","name":"360 Javascript Viewer","from":"*","from_inclusive":true,"to":"1.7.12","to_inclusive":true,"patched_in":"1.7.13"}],"published":"2024-03-21T00:00:00Z","updated":"2024-04-09T18:58:36Z"},{"id":"wordfence:1ba55302-b38f-4932-bbba-cdd517380ad7","source":"wordfence","cve":"CVE-2026-63030","title":"WordPress Core 6.9 -  7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion","severity":"critical","cvss":9.8,"cwe":"CWE-670","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba55302-b38f-4932-bbba-cdd517380ad7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.5","to_inclusive":false,"patched_in":"6.9.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.2","to_inclusive":false,"patched_in":"6.9.5"}],"published":"2026-07-17T00:00:00Z","updated":"2026-07-23T20:15:23Z"},{"id":"wordfence:1ba56d68-e104-4a79-b5b4-627f9617043b","source":"wordfence","cve":"CVE-2023-27460","title":"CP Contact Form with Paypal <= 1.3.34 - Authenticated Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba56d68-e104-4a79-b5b4-627f9617043b?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.34","to_inclusive":true,"patched_in":"1.3.35"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ba68898-da5d-40ef-87b8-51fd256788cc","source":"wordfence","cve":"CVE-2025-53245","title":"Logo Changer <= 1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba68898-da5d-40ef-87b8-51fd256788cc?source=api-prod","affected":[{"type":"plugin","slug":"am-login-logo","name":"WP Logo Changer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-07T00:00:00Z","updated":"2025-11-11T17:12:58Z"},{"id":"wordfence:1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea","source":"wordfence","cve":"CVE-2025-2871","title":"WordPress Mega Menu \u2013 QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ba7b675-54d6-4f0e-b60f-1c7fa6ff24ea?source=api-prod","affected":[{"type":"plugin","slug":"quadmenu","name":"QuadMenu \u2013 Mega Menu","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T03:21:37Z"},{"id":"wordfence:1baa699e-b071-490c-b932-2dea603165e1","source":"wordfence","cve":"CVE-2026-6495","title":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load < 7.8.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1baa699e-b071-490c-b932-2dea603165e1?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.8.4","to_inclusive":false,"patched_in":"7.8.4"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:19:52Z"},{"id":"wordfence:1baa7b7a-49b5-48bd-b45f-31fae707c199","source":"wordfence","cve":"CVE-2022-45377","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.0.8 - Missing Authorization in upload and delete_file","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1baa7b7a-49b5-48bd-b45f-31fae707c199?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-02-23T00:00:00Z","updated":"2024-10-15T18:47:50Z"},{"id":"wordfence:1baa93da-9b55-45e7-b9a9-db331b5d0584","source":"wordfence","cve":"CVE-2024-9292","title":"Bridge Core <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1baa93da-9b55-45e7-b9a9-db331b5d0584?source=api-prod","affected":[{"type":"plugin","slug":"bridge-core","name":"Bridge Core","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T05:36:29Z"},{"id":"wordfence:1bad3803-77c3-4c9f-906c-ba5b1886c997","source":"wordfence","cve":"","title":"GB Team Stats <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bad3803-77c3-4c9f-906c-ba5b1886c997?source=api-prod","affected":[{"type":"plugin","slug":"gbteamstats","name":"GB Team Stats","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bae23a4-0f25-430f-8bad-6ec7b2de3dbe","source":"wordfence","cve":"CVE-2022-0149","title":"WooCommerce \u2013 Store Exporter <= 2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bae23a4-0f25-430f-8bad-6ec7b2de3dbe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bae6d3a-40eb-4af6-be4e-9bc6be1a4b07","source":"wordfence","cve":"CVE-2024-2583","title":"Shortcodes Ultimate <= 7.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_color' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bae6d3a-40eb-4af6-be4e-9bc6be1a4b07?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"7.0.5"}],"published":"2024-03-23T00:00:00Z","updated":"2024-04-25T12:58:06Z"},{"id":"wordfence:1baf7c7e-b5e9-40b5-9c96-abe6ebcf2b2a","source":"wordfence","cve":"CVE-2021-24868","title":"Document Embedder <= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1baf7c7e-b5e9-40b5-9c96-abe6ebcf2b2a?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":false,"patched_in":"1.7.9"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bb089fd-2c6d-45fd-84e2-8531d31785e2","source":"wordfence","cve":"CVE-2024-10303","title":"Marin <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb089fd-2c6d-45fd-84e2-8531d31785e2?source=api-prod","affected":[{"type":"theme","slug":"marin","name":"Marin","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":"0.1.2"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:35:27Z"},{"id":"wordfence:1bb1db1b-bf25-4a09-9c8a-e7b1ef42cc7a","source":"wordfence","cve":"CVE-2024-54436","title":"Jet Footer Code <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb1db1b-bf25-4a09-9c8a-e7b1ef42cc7a?source=api-prod","affected":[{"type":"plugin","slug":"jet-footer-code","name":"Jet Footer Code","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T17:07:47Z"},{"id":"wordfence:1bb25412-8f63-4a9d-84bd-44fac59c6eed","source":"wordfence","cve":"CVE-2025-10648","title":"Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb25412-8f63-4a9d-84bd-44fac59c6eed?source=api-prod","affected":[{"type":"plugin","slug":"login-with-yourmembership","name":"Login with YourMembership \u2013 YM SSO Login","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-10-14T19:58:07Z","updated":"2025-11-07T16:48:15Z"},{"id":"wordfence:1bb2b1f9-fd76-440e-a64c-ff11622efec1","source":"wordfence","cve":"CVE-2018-19041","title":"Media File Manager <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb2b1f9-fd76-440e-a64c-ff11622efec1?source=api-prod","affected":[{"type":"plugin","slug":"media-file-manager","name":"Media File Manager","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2018-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bb313ba-aae3-4f5d-a68c-0cd11c633901","source":"wordfence","cve":"CVE-2026-114695","title":"VOD Infomaniak <= 1.5.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb313ba-aae3-4f5d-a68c-0cd11c633901?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":"1.5.15"}],"published":"2026-10-22T07:55:42Z","updated":"2026-10-28T01:20:28Z"},{"id":"wordfence:1bb409f0-ccbd-4dfa-b097-b29ee539daa3","source":"wordfence","cve":"CVE-2026-4326","title":"Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb409f0-ccbd-4dfa-b097-b29ee539daa3?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor-builder","name":"Vertex Addons for Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T01:25:55Z"},{"id":"wordfence:1bb4674e-71e4-43db-ad9e-36ab15432149","source":"wordfence","cve":"CVE-2021-24370","title":"Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb4674e-71e4-43db-ad9e-36ab15432149?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":false,"patched_in":"4.6.9"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bb55b22-a0d0-424f-8e4f-57d3f239c149","source":"wordfence","cve":"CVE-2023-1338","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'attach_rule'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb55b22-a0d0-424f-8e4f-57d3f239c149?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bb58556-29be-4272-85fc-bb2b7c72abf4","source":"wordfence","cve":"CVE-2025-13852","title":"Debt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb58556-29be-4272-85fc-bb2b7c72abf4?source=api-prod","affected":[{"type":"plugin","slug":"debtcom-business-in-a-box","name":"Debt.com Business in a Box","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:36:17Z","updated":"2026-01-09T11:15:31Z"},{"id":"wordfence:1bb832f8-c489-4d8c-82a9-dd7f62a9b1ad","source":"wordfence","cve":"CVE-2026-84756","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb832f8-c489-4d8c-82a9-dd7f62a9b1ad?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.11.11","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:32:35Z"},{"id":"wordfence:1bb9259e-f65a-4cb3-9401-35be0212c182","source":"wordfence","cve":"CVE-2025-68842","title":"Widget Logic Visual <= 1.52 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb9259e-f65a-4cb3-9401-35be0212c182?source=api-prod","affected":[{"type":"plugin","slug":"widget-logic-visual","name":"Widget Logic Visual","from":"*","from_inclusive":true,"to":"1.52","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:18:24Z"},{"id":"wordfence:1bbba961-a1e6-440a-9b39-919363f7031d","source":"wordfence","cve":"CVE-2024-33537","title":"WP Portfolio <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbba961-a1e6-440a-9b39-919363f7031d?source=api-prod","affected":[{"type":"theme","slug":"wp-portfolio","name":"WP Portfolio","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:59:35Z"},{"id":"wordfence:1bbbec13-50ea-4dd1-ab6e-f44814813edb","source":"wordfence","cve":"CVE-2026-32378","title":"Book Landing Page <= 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbbec13-50ea-4dd1-ab6e-f44814813edb?source=api-prod","affected":[{"type":"theme","slug":"book-landing-page","name":"Book Landing Page","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:53:49Z"},{"id":"wordfence:1bbc24f8-ceb7-44c4-8691-7786cbb4f69b","source":"wordfence","cve":"CVE-2026-11899","title":"PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbc24f8-ceb7-44c4-8691-7786cbb4f69b?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-09-18T19:30:10Z","updated":"2026-09-19T07:43:13Z"},{"id":"wordfence:1bbe01b8-24ed-4e1e-bafc-0f4dea96c1f3","source":"wordfence","cve":"CVE-2024-9636","title":"Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bbe01b8-24ed-4e1e-bafc-0f4dea96c1f3?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"2.2.85","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2025-01-14T21:19:54Z","updated":"2025-01-15T09:25:54Z"},{"id":"wordfence:1bc0aa64-57a6-44ef-974a-70991cc3820f","source":"wordfence","cve":"CVE-2019-20041","title":"WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc0aa64-57a6-44ef-974a-70991cc3820f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.20","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.19","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.16","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.15","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2019-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bc19bfa-ce44-4654-b074-c8126b60a155","source":"wordfence","cve":"","title":"Hybrid Composer <= 1.4.6 - Missing Authorization to Arbitrary Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc19bfa-ce44-4654-b074-c8126b60a155?source=api-prod","affected":[{"type":"plugin","slug":"hybrid-composer","name":"Hybrid Composer","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2019-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bc3529c-6161-4b89-8a35-c3a9b7b8c308","source":"wordfence","cve":"CVE-2026-109220","title":"PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc3529c-6161-4b89-8a35-c3a9b7b8c308?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-woocommerce","name":"PDF Invoice for WooCommerce + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2026-10-30T17:33:25Z","updated":"2026-10-31T06:44:15Z"},{"id":"wordfence:1bc6508b-f646-4d52-bc8d-bdac443ed2fe","source":"wordfence","cve":"CVE-2025-14393","title":"Wpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc6508b-f646-4d52-bc8d-bdac443ed2fe?source=api-prod","affected":[{"type":"plugin","slug":"wpik-wordpress-basic-ajax-form","name":"Wpik WordPress Basic Ajax Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:09:18Z","updated":"2025-12-12T03:20:40Z"},{"id":"wordfence:1bc697b3-20f6-46df-a250-f2009a60200e","source":"wordfence","cve":"CVE-2024-2170","title":"VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc697b3-20f6-46df-a250-f2009a60200e?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.96.0.1","to_inclusive":true,"patched_in":"9.97.0.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-26T04:31:43Z"},{"id":"wordfence:1bc9d02d-7916-4845-bb9d-f5eb2666b772","source":"wordfence","cve":"CVE-2014-4517","title":"CBI Referral Manager <= 1.2.1 Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc9d02d-7916-4845-bb9d-f5eb2666b772?source=api-prod","affected":[{"type":"plugin","slug":"cbi-referral-manager","name":"CBI Referral Manager","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bcb675e-bd69-4003-9adc-45a2e0d66347","source":"wordfence","cve":"CVE-2025-30947","title":"Cool fade popup <= 10.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bcb675e-bd69-4003-9adc-45a2e0d66347?source=api-prod","affected":[{"type":"plugin","slug":"cool-fade-popup","name":"Cool fade popup","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:57:44Z"},{"id":"wordfence:1bcb8dd6-a088-4004-b631-4520806b2c23","source":"wordfence","cve":"CVE-2026-95528","title":"Core Web Vitals & PageSpeed Booster <= 1.0.31 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bcb8dd6-a088-4004-b631-4520806b2c23?source=api-prod","affected":[{"type":"plugin","slug":"core-web-vitals-pagespeed-booster","name":"Core Web Vitals & PageSpeed Booster","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.32"}],"published":"2026-09-23T13:22:43Z","updated":"2026-09-29T19:53:21Z"},{"id":"wordfence:1bcb9ba1-63f9-4de9-b1da-405231cd1d14","source":"wordfence","cve":"CVE-2025-22327","title":"EO4WP <= 1.0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bcb9ba1-63f9-4de9-b1da-405231cd1d14?source=api-prod","affected":[{"type":"plugin","slug":"fw-integration-for-emailoctopus","name":"EO4WP: EmailOctopus for WordPress","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":"1.0.8.2"}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-11T21:30:50Z"},{"id":"wordfence:1bcc6192-b9fa-4444-b06d-2b44d53d9cfe","source":"wordfence","cve":"","title":"WP Elegant Testimonial <= 1.1.6 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bcc6192-b9fa-4444-b06d-2b44d53d9cfe?source=api-prod","affected":[{"type":"plugin","slug":"wp-elegant-testimonial","name":"WP Elegant Testimonial","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2020-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bccf576-25c7-4dcd-9f07-cb41100dc45f","source":"wordfence","cve":"CVE-2026-78361","title":"zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bccf576-25c7-4dcd-9f07-cb41100dc45f?source=api-prod","affected":[{"type":"plugin","slug":"zipmoney-payments-woocommerce","name":"zipMoney(Zip Co) Payments Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:09:57Z"},{"id":"wordfence:1bce11fa-428d-4f44-9ce4-e12e79c43ff1","source":"wordfence","cve":"","title":"Allure Real Estate Theme for Placester <= 0.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bce11fa-428d-4f44-9ce4-e12e79c43ff1?source=api-prod","affected":[{"type":"theme","slug":"allure-real-estate-theme-for-placester","name":"Allure Real Estate Theme for Placester","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bd007fd-eee9-4c3c-b509-63e180e3fd28","source":"wordfence","cve":"CVE-2021-25111","title":"English WordPress Admin <= 1.5.1.1 - Unauthenticated Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd007fd-eee9-4c3c-b509-63e180e3fd28?source=api-prod","affected":[{"type":"plugin","slug":"english-wp-admin","name":"English WordPress Admin","from":"*","from_inclusive":true,"to":"1.5.1.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2022-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bd0f172-2cd3-4839-9df9-64475554d3b2","source":"wordfence","cve":"CVE-2024-2484","title":"Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd0f172-2cd3-4839-9df9-64475554d3b2?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.34","to_inclusive":true,"patched_in":"2.10.35"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-22T02:01:06Z"},{"id":"wordfence:1bd308a4-7157-4bc6-a55b-c6a4a62510a9","source":"wordfence","cve":"CVE-2024-8538","title":"Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd308a4-7157-4bc6-a55b-c6a4a62510a9?source=api-prod","affected":[{"type":"plugin","slug":"tuxedo-big-file-uploads","name":"Big File Uploads \u2013 Increase Maximum File Upload Size","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-09-06T00:00:00Z","updated":"2024-09-07T08:37:02Z"},{"id":"wordfence:1bd44471-1a9c-4465-a52a-be64d51e7ea1","source":"wordfence","cve":"CVE-2024-9106","title":"Wechat Social login <= 1.3.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd44471-1a9c-4465-a52a-be64d51e7ea1?source=api-prod","affected":[{"type":"plugin","slug":"wechat-social-login","name":"Wechat Social login \u5fae\u4fe1QQ\u9489\u9489\u767b\u5f55\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:10Z"},{"id":"wordfence:1bd45442-0614-4dd0-bffa-11de68233dd4","source":"wordfence","cve":"CVE-2025-32496","title":"Ultra Demo Importer <= 1.0.5 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd45442-0614-4dd0-bffa-11de68233dd4?source=api-prod","affected":[{"type":"plugin","slug":"ut-demo-importer","name":"Ultra Demo Importer","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:01:08Z"},{"id":"wordfence:1bd61124-d4af-4c88-be96-579c735b7b49","source":"wordfence","cve":"CVE-2025-6041","title":"yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd61124-d4af-4c88-be96-579c735b7b49?source=api-prod","affected":[{"type":"plugin","slug":"ycontributors","name":"yContributors","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:23:34Z","updated":"2025-07-04T01:44:01Z"},{"id":"wordfence:1bd77f8e-2210-48c0-a4d9-53eca0abeb00","source":"wordfence","cve":"CVE-2025-63061","title":"Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd77f8e-2210-48c0-a4d9-53eca0abeb00?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"kallyas","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2025-12-10T16:02:16Z"},{"id":"wordfence:1bd80ab9-260a-46c5-949e-c1d5dcb32523","source":"wordfence","cve":"CVE-2015-9337","title":"Profile Builder <= 2.1.3 - Missing Access Controls","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd80ab9-260a-46c5-949e-c1d5dcb32523?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2015-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bd8b315-97a9-40f4-99cb-76f347a5c1e9","source":"wordfence","cve":"CVE-2025-57884","title":"Greenshift <= 12.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd8b315-97a9-40f4-99cb-76f347a5c1e9?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.1.1","to_inclusive":true,"patched_in":"12.1.2"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-25T20:08:05Z"},{"id":"wordfence:1bda01a0-e995-4642-81e3-4a72e6754af6","source":"wordfence","cve":"","title":"Simple Social Media Share Buttons 2.0.4 - 2.0.21 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bda01a0-e995-4642-81e3-4a72e6754af6?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"2.0.4","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2019-02-11T00:00:00Z","updated":"2024-06-17T17:09:22Z"},{"id":"wordfence:1bdae07c-cb80-4566-9b90-7b144c6ceeb0","source":"wordfence","cve":"CVE-2025-14125","title":"Complag <= 1.0.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bdae07c-cb80-4566-9b90-7b144c6ceeb0?source=api-prod","affected":[{"type":"plugin","slug":"omplag","name":"Complag","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:27:49Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:1bdba04e-df4d-4094-877e-611d69e2e25d","source":"wordfence","cve":"CVE-2020-36700","title":"Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bdba04e-df4d-4094-877e-611d69e2e25d?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2020-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bdccdaa-7770-4f3c-abdc-9e8e96ef8a03","source":"wordfence","cve":"CVE-2026-109697","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bdccdaa-7770-4f3c-abdc-9e8e96ef8a03?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:58Z"},{"id":"wordfence:1be29c83-ff1a-46d9-a00d-d273a7015d10","source":"wordfence","cve":"CVE-2025-49393","title":"Sign-up Sheets <= 2.3.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be29c83-ff1a-46d9-a00d-d273a7015d10?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T12:43:07Z"},{"id":"wordfence:1be519d5-b505-4b5d-9f14-c8544e8f8298","source":"wordfence","cve":"CVE-2025-5842","title":"Modern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be519d5-b505-4b5d-9f14-c8544e8f8298?source=api-prod","affected":[{"type":"plugin","slug":"mdl-shortcodes","name":"Modern Design Library","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-06-25T20:44:26Z","updated":"2025-06-26T09:22:03Z"},{"id":"wordfence:1be557db-daa8-4d86-819a-462f29da884b","source":"wordfence","cve":"CVE-2025-1119","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be557db-daa8-4d86-819a-462f29da884b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.8.5","to_inclusive":true,"patched_in":"1.6.8.7"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-28T18:09:55Z"},{"id":"wordfence:1be5da88-723a-4386-a73e-3fe90eefb6ba","source":"wordfence","cve":"CVE-2023-1325","title":"Easy Forms for MailChimp <= 6.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be5da88-723a-4386-a73e-3fe90eefb6ba?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"6.8.7"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1be686d3-16b1-4ec7-b304-848ca4d7162c","source":"wordfence","cve":"CVE-2024-1904","title":"MasterStudy LMS  <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be686d3-16b1-4ec7-b304-848ca4d7162c?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.2.13","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-03-15T00:00:00Z","updated":"2024-04-09T18:58:37Z"},{"id":"wordfence:1be68c82-c22c-4d45-8c7f-a7aa21fe3ddf","source":"wordfence","cve":"CVE-2019-14786","title":"Rank Math SEO <= 1.0.27 - Authenticated Settings Reset via reset-cmb Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be68c82-c22c-4d45-8c7f-a7aa21fe3ddf?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.27.1","to_inclusive":false,"patched_in":"1.0.27.1"}],"published":"2019-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1be94fa8-ecaf-46e2-a2d6-9d6a4c7343bf","source":"wordfence","cve":"CVE-2026-48880","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1be94fa8-ecaf-46e2-a2d6-9d6a4c7343bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:51:00Z"},{"id":"wordfence:1bea21d5-da96-48fd-89bb-57aea88af793","source":"wordfence","cve":"CVE-2026-22355","title":"Simple XML Sitemap <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bea21d5-da96-48fd-89bb-57aea88af793?source=api-prod","affected":[{"type":"plugin","slug":"simple-xml-sitemap","name":"Simple XML Sitemap","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T19:36:18Z"},{"id":"wordfence:1bea55b5-b2d7-4eaf-8868-d2645ce18619","source":"wordfence","cve":"CVE-2024-8797","title":"WP Booking System \u2013 Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bea55b5-b2d7-4eaf-8868-d2645ce18619?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.19.8","to_inclusive":true,"patched_in":"2.0.19.9"}],"published":"2024-09-13T00:00:00Z","updated":"2026-10-09T10:06:28Z"},{"id":"wordfence:1beb2a35-0346-4aa1-8cc3-a18a47e82eb3","source":"wordfence","cve":"CVE-2024-1849","title":"WP Customer Reviews <= 3.7.0 - Authenticated (Contributor+) Malicious Redirect via HTTP-EQUIV Injection","severity":"medium","cvss":6.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1beb2a35-0346-4aa1-8cc3-a18a47e82eb3?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2024-03-25T00:00:00Z","updated":"2026-09-04T17:18:21Z"},{"id":"wordfence:1bebb24c-c141-4fcf-8288-9b8faaaf69c9","source":"wordfence","cve":"CVE-2024-38704","title":"WordPress Team Manager <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bebb24c-c141-4fcf-8288-9b8faaaf69c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-team-manager","name":"Dynamic Team Manager \u2013 Team Member Showcase with grid, slider, table  Elementor widget & shortcode","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:58:52Z"},{"id":"wordfence:1bee1eeb-5354-47c9-9ae1-b1608d87d7bb","source":"wordfence","cve":"CVE-2024-10080","title":"WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bee1eeb-5354-47c9-9ae1-b1608d87d7bb?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-types","name":"WP Easy Post Types","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-18T07:35:25Z"},{"id":"wordfence:1befba2d-cd16-48d1-8499-d848a649cf9d","source":"wordfence","cve":"CVE-2026-25374","title":"Spa and Salon <= 1.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1befba2d-cd16-48d1-8499-d848a649cf9d?source=api-prod","affected":[{"type":"theme","slug":"spa-and-salon","name":"Spa and Salon","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-24T19:22:24Z"},{"id":"wordfence:1bf139cb-4505-4abb-882f-08d7a66aa76f","source":"wordfence","cve":"CVE-2025-31767","title":"Post Custom Templates Lite <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf139cb-4505-4abb-882f-08d7a66aa76f?source=api-prod","affected":[{"type":"plugin","slug":"post-custom-templates-lite","name":"Post Custom Templates Lite","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:08:08Z"},{"id":"wordfence:1bf63dd3-9fd1-4b72-b7e0-48155312c48f","source":"wordfence","cve":"CVE-2026-101920","title":"Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf63dd3-9fd1-4b72-b7e0-48155312c48f?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"5.2.12","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-09T19:41:21Z","updated":"2026-10-10T07:41:44Z"},{"id":"wordfence:1bf78bc1-55d7-4230-913f-d7c521225367","source":"wordfence","cve":"CVE-2026-15604","title":"Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf78bc1-55d7-4230-913f-d7c521225367?source=api-prod","affected":[{"type":"plugin","slug":"toocheke-companion","name":"Toocheke Companion","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"2.11"}],"published":"2026-08-15T17:23:02Z","updated":"2026-08-16T05:27:27Z"},{"id":"wordfence:1bf798b5-2a5c-42d9-a4b3-d3ed056e1fdb","source":"wordfence","cve":"CVE-2023-47686","title":"Arigato Autoresponder and Newsletter <= 2.7.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf798b5-2a5c-42d9-a4b3-d3ed056e1fdb?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.2.2","to_inclusive":true,"patched_in":"2.7.2.3"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bf805fc-4b27-47c4-b24e-79158cffaac4","source":"wordfence","cve":"CVE-2021-24517","title":"Stop Spammers Security <= 2021.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf805fc-4b27-47c4-b24e-79158cffaac4?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2021.18","to_inclusive":false,"patched_in":"2021.18"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bf8ebeb-71dc-468b-82a1-005e1c4e23d9","source":"wordfence","cve":"CVE-2025-23716","title":"Login Watchdog  <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bf8ebeb-71dc-468b-82a1-005e1c4e23d9?source=api-prod","affected":[{"type":"plugin","slug":"login-watchdog","name":"Login Watchdog","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:27:32Z"},{"id":"wordfence:1bfa1538-7722-458d-a6a5-adde03e21e1a","source":"wordfence","cve":"CVE-2026-15025","title":"Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfa1538-7722-458d-a6a5-adde03e21e1a?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2026-07-27T23:27:10Z","updated":"2026-07-28T11:32:46Z"},{"id":"wordfence:1bfb0bab-20d0-4172-b912-7f209cad4c3b","source":"wordfence","cve":"CVE-2026-88764","title":"Simple Membership < 4.7.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfb0bab-20d0-4172-b912-7f209cad4c3b?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":false,"patched_in":"4.7.8"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:26:04Z"},{"id":"wordfence:1bfb5d34-738d-4842-be93-9668fceb3334","source":"wordfence","cve":"CVE-2023-34009","title":"Social Media & Share Icons <= 2.8.1 - Missing Authorization via handle_installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfb5d34-738d-4842-be93-9668fceb3334?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1bfba54f-961d-4889-9272-0020c9fa0801","source":"wordfence","cve":"CVE-2026-15947","title":"Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfba54f-961d-4889-9272-0020c9fa0801?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.6.23","to_inclusive":true,"patched_in":"2.6.24"}],"published":"2026-09-18T19:15:12Z","updated":"2026-09-19T07:43:13Z"},{"id":"wordfence:1bfc5467-6610-4516-8c50-d47d05e2677d","source":"wordfence","cve":"CVE-2026-4668","title":"Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1bfc5467-6610-4516-8c50-d47d05e2677d?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-31T10:30:53Z","updated":"2026-03-31T23:25:46Z"},{"id":"wordfence:1c025fc0-5dac-4a18-8338-fefb2a1fca5a","source":"wordfence","cve":"CVE-2024-3555","title":"Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c025fc0-5dac-4a18-8338-fefb2a1fca5a?source=api-prod","affected":[{"type":"plugin","slug":"social-link-pages","name":"Social Link Pages: link-in-bio landing pages for your social media profiles","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:10:53Z","updated":"2024-06-04T05:32:13Z"},{"id":"wordfence:1c02e03a-7f96-4efa-9071-4a76fb21900d","source":"wordfence","cve":"CVE-2025-12034","title":"Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c02e03a-7f96-4efa-9071-4a76fb21900d?source=api-prod","affected":[{"type":"plugin","slug":"fast-velocity-minify","name":"Fast Velocity Minify","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-10-24T18:28:09Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:1c051bfd-2754-4faf-8062-91752555166c","source":"wordfence","cve":"CVE-2023-2168","title":"TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c051bfd-2754-4faf-8062-91752555166c?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c0572a5-6cc9-43ab-a4a3-c8d3b93c8fcf","source":"wordfence","cve":"CVE-2024-0451","title":"AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback","severity":"medium","cvss":5.0,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0572a5-6cc9-43ab-a4a3-c8d3b93c8fcf?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2024-05-21T00:00:00Z","updated":"2024-07-29T21:35:57Z"},{"id":"wordfence:1c06a572-a0c0-477a-9f8f-abe355cb87f7","source":"wordfence","cve":"CVE-2025-32511","title":"Make Email Customizer for WooCommerce <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c06a572-a0c0-477a-9f8f-abe355cb87f7?source=api-prod","affected":[{"type":"plugin","slug":"make-email-customizer-for-woocommerce","name":"Make Email Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:12:59Z"},{"id":"wordfence:1c074e03-b452-4aea-aa1d-36657ba311e1","source":"wordfence","cve":"CVE-2016-10871","title":"MailChimp for WordPress <= 4.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c074e03-b452-4aea-aa1d-36657ba311e1?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":false,"patched_in":"4.0.11"}],"published":"2016-12-13T00:00:00Z","updated":"2026-03-27T11:09:20Z"},{"id":"wordfence:1c088264-64a2-4a36-ae3b-fdf60f3837e2","source":"wordfence","cve":"CVE-2024-13583","title":"Simple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c088264-64a2-4a36-ae3b-fdf60f3837e2?source=api-prod","affected":[{"type":"plugin","slug":"simple-gallery-with-filter","name":"Simple Gallery with Filter","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T09:21:51Z"},{"id":"wordfence:1c08b7a7-297b-4ad7-b829-3ccbae7b2e41","source":"wordfence","cve":"CVE-2021-38360","title":"wp-publications < 1.1 - Local File Inclusion","severity":"high","cvss":8.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c08b7a7-297b-4ad7-b829-3ccbae7b2e41?source=api-prod","affected":[{"type":"plugin","slug":"wp-publications","name":"wp-publications","from":"*","from_inclusive":true,"to":"0.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c08c309-af52-4aed-8cc3-b93488f3396f","source":"wordfence","cve":"CVE-2026-32328","title":"Lemmony < 1.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c08c309-af52-4aed-8cc3-b93488f3396f?source=api-prod","affected":[{"type":"theme","slug":"lemmony","name":"Lemmony","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2026-02-08T00:00:00Z","updated":"2026-04-15T20:44:26Z"},{"id":"wordfence:1c09743a-cf0a-4eaa-8508-ecde32de4fce","source":"wordfence","cve":"","title":"WP Product Review Lite <= 3.7.5 - Unauthenticated Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c09743a-cf0a-4eaa-8508-ecde32de4fce?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-review","name":"WP Product Review Lite","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":false,"patched_in":"3.7.6"}],"published":"2020-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c09fa88-8981-414e-ad24-7460b81ea295","source":"wordfence","cve":"CVE-2025-66060","title":"Seriously Simple Podcasting <= 3.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c09fa88-8981-414e-ad24-7460b81ea295?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2025-11-09T00:00:00Z","updated":"2025-11-25T15:37:42Z"},{"id":"wordfence:1c0a544a-b5f3-41bf-9313-28188662ea56","source":"wordfence","cve":"CVE-2024-12122","title":"ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0a544a-b5f3-41bf-9313-28188662ea56?source=api-prod","affected":[{"type":"plugin","slug":"resads","name":"ResAds","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:09:09Z","updated":"2025-01-09T11:10:53Z"},{"id":"wordfence:1c0c6a45-2c4a-4a23-84e6-7a9759796824","source":"wordfence","cve":"CVE-2025-10412","title":"Product Options and Price Calculation Formulas for WooCommerce \u2013 Uni CPO (Premium) <= 4.9.55 - Unauthenticated Arbitrary File Upload via 'uni_cpo_upload_file'","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0c6a45-2c4a-4a23-84e6-7a9759796824?source=api-prod","affected":[{"type":"plugin","slug":"uni-woo-custom-product-options-premium","name":"Product Options and Price Calculation Formulas for WooCommerce \u2013 Uni CPO (Premium)","from":"*","from_inclusive":true,"to":"4.9.55","to_inclusive":true,"patched_in":"4.9.56"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-16T14:55:10Z"},{"id":"wordfence:1c0d18d3-8758-41ae-b104-dac69eee4ac9","source":"wordfence","cve":"CVE-2023-25969","title":"TH Side Cart and Menu Cart for Woocommerce <= 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0d18d3-8758-41ae-b104-dac69eee4ac9?source=api-prod","affected":[{"type":"plugin","slug":"th-all-in-one-woo-cart","name":"ThemeHunk \u2013 Side Cart, Ajax Cart & Menu Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c0e1973-0aa1-4787-b503-3b38476acdbb","source":"wordfence","cve":"CVE-2025-30988","title":"Elite Video Player <= 10.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0e1973-0aa1-4787-b503-3b38476acdbb?source=api-prod","affected":[{"type":"plugin","slug":"elite-video-player","name":"Elite Video Player","from":"*","from_inclusive":true,"to":"10.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T15:01:43Z"},{"id":"wordfence:1c0e5c85-72c3-4f09-aade-ec5a82b9cc41","source":"wordfence","cve":"CVE-2024-13732","title":"Responsive Blocks \u2013 WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0e5c85-72c3-4f09-aade-ec5a82b9cc41?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-29T20:00:24Z","updated":"2025-01-30T08:21:27Z"},{"id":"wordfence:1c0f613e-5ee6-447c-b508-702627223979","source":"wordfence","cve":"CVE-2025-30890","title":"Login Widget for Ultimate Member <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0f613e-5ee6-447c-b508-702627223979?source=api-prod","affected":[{"type":"plugin","slug":"login-widget-for-ultimate-member","name":"Login Widget for Ultimate Member","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:36:59Z"},{"id":"wordfence:1c0f9116-15b0-47e1-b842-aa76cc903ebf","source":"wordfence","cve":"CVE-2026-24955","title":"Whizz Plugins <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0f9116-15b0-47e1-b842-aa76cc903ebf?source=api-prod","affected":[{"type":"plugin","slug":"whizz-plugins","name":"Whizz Plugins","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T14:57:18Z"},{"id":"wordfence:1c120385-c761-4684-ab5c-f08cd803c253","source":"wordfence","cve":"CVE-2025-48104","title":"Floating Window Music Player <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c120385-c761-4684-ab5c-f08cd803c253?source=api-prod","affected":[{"type":"plugin","slug":"floating-window-music-player","name":"Floating Window Music Player","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-09-09T22:11:57Z"},{"id":"wordfence:1c13f00e-3048-44cf-8979-2b0b0c508f3a","source":"wordfence","cve":"CVE-2023-0586","title":"All in One SEO Pack  <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c13f00e-3048-44cf-8979-2b0b0c508f3a?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c17909f-bf69-4d72-80d2-0574b964bb4f","source":"wordfence","cve":"CVE-2025-32604","title":"AWSA Shipping <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c17909f-bf69-4d72-80d2-0574b964bb4f?source=api-prod","affected":[{"type":"plugin","slug":"awsa-shipping","name":"AWSA Shipping \u2013 Advanced Shipping for Woocommerce and Dokan","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:13:40Z"},{"id":"wordfence:1c19520b-531a-48d8-acfd-fc35bf860bc2","source":"wordfence","cve":"CVE-2026-61944","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c19520b-531a-48d8-acfd-fc35bf860bc2?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.7","to_inclusive":true,"patched_in":"27.8"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:03:05Z"},{"id":"wordfence:1c1c7ec9-d01f-433d-abec-dc2b6ff684c7","source":"wordfence","cve":"CVE-2025-7847","title":"AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1c7ec9-d01f-433d-abec-dc2b6ff684c7?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"2.9.3","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-07-30T16:06:38Z","updated":"2025-07-31T04:26:20Z"},{"id":"wordfence:1c1ca3cc-544a-4d75-aaf3-e26e2fc5ce5a","source":"wordfence","cve":"CVE-2025-57998","title":"E-namad &amp; Shamed Logo Manager <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1ca3cc-544a-4d75-aaf3-e26e2fc5ce5a?source=api-prod","affected":[{"type":"plugin","slug":"e-namad-shamed-logo-manager","name":"E-namad & Shamed Logo Manager","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:26:50Z"},{"id":"wordfence:1c1ce474-ecce-4d21-b174-cb54a2441b2b","source":"wordfence","cve":"CVE-2026-1993","title":"ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1ce474-ecce-4d21-b174-cb54a2441b2b?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"7.1.0","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2026-03-10T21:02:36Z","updated":"2026-03-11T09:25:45Z"},{"id":"wordfence:1c1e1c18-fecd-45a9-a515-11073c9f1aec","source":"wordfence","cve":"CVE-2025-53196","title":"JetEngine <= 3.7.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1e1c18-fecd-45a9-a515-11073c9f1aec?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:12:49Z"},{"id":"wordfence:1c2153f5-1c8b-4095-a0a8-849a7ee967c1","source":"wordfence","cve":"CVE-2017-14842","title":"SMSmaster \u2013 Multipurpose SMS Gateway for Wordpress (All Versions) - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c2153f5-1c8b-4095-a0a8-849a7ee967c1?source=api-prod","affected":[{"type":"plugin","slug":"smsmaster","name":"SMSmaster \u2013 Multipurpose SMS Gateway for Wordpress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c220091-4094-4f72-aaf1-a426f07aef5b","source":"wordfence","cve":"CVE-2026-25334","title":"Salon Booking System Pro < 10.30.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c220091-4094-4f72-aaf1-a426f07aef5b?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-plugin-pro","name":"Salon Booking System Pro","from":"*","from_inclusive":true,"to":"10.30.12","to_inclusive":false,"patched_in":"10.30.12"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:32:29Z"},{"id":"wordfence:1c225bea-78db-4f4c-a201-833436c1df78","source":"wordfence","cve":"CVE-2019-15648","title":"Insert or Embed Articulate Content into WordPress < 4.29991 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c225bea-78db-4f4c-a201-833436c1df78?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.29991","to_inclusive":false,"patched_in":"4.29991"}],"published":"2019-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c22717f-494e-4f62-9691-ee5a3366a487","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'deleteRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c22717f-494e-4f62-9691-ee5a3366a487?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c22de8c-e6e1-4b85-8d9f-619e9f63129e","source":"wordfence","cve":"CVE-2024-12040","title":"Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c22de8c-e6e1-4b85-8d9f-619e9f63129e?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:20Z"},{"id":"wordfence:1c23d163-1053-403f-80bc-ea8f76fff4e2","source":"wordfence","cve":"CVE-2020-9454","title":"RegistrationMagic \u2013 Custom Registration Forms and User Login <= 4.6.0.3 - Cross-Site Request Forgery to Settings Modification","severity":"high","cvss":8.0,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c23d163-1053-403f-80bc-ea8f76fff4e2?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.4","to_inclusive":false,"patched_in":"4.6.0.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c24a03a-95d8-4354-bb26-8575d70f2253","source":"wordfence","cve":"CVE-2018-5657","title":"Coming Soon <= 1.1.18 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c24a03a-95d8-4354-bb26-8575d70f2253?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":false,"patched_in":"1.1.19"}],"published":"2018-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c24f881-52bc-4210-9037-bcdd1e4aa895","source":"wordfence","cve":"CVE-2023-47649","title":"Best Restaurant Menu by PriceListo <= 1.3.1 - Cross-Site Request Forgery via menu_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c24f881-52bc-4210-9037-bcdd1e4aa895?source=api-prod","affected":[{"type":"plugin","slug":"best-restaurant-menu-by-pricelisto","name":"Great Restaurant Menu WP","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-28T23:38:09Z"},{"id":"wordfence:1c29168e-083b-45a6-b535-e3cfc9042bfb","source":"wordfence","cve":"CVE-2026-119523","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c29168e-083b-45a6-b535-e3cfc9042bfb?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-11-07T10:31:00Z","updated":"2026-11-10T19:34:49Z"},{"id":"wordfence:1c2b9858-eb0c-42bd-bc32-c58c0f809fc8","source":"wordfence","cve":"CVE-2024-2962","title":"Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c2b9858-eb0c-42bd-bc32-c58c0f809fc8?source=api-prod","affected":[{"type":"theme","slug":"networker","name":"Networker - Tech News WordPress Theme with Dark Mode","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T08:31:14Z"},{"id":"wordfence:1c2f4b74-2568-4e5a-b55f-0130096bc19f","source":"wordfence","cve":"CVE-2024-1448","title":"Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c2f4b74-2568-4e5a-b55f-0130096bc19f?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.56","to_inclusive":true,"patched_in":"3.3.57"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-20T18:56:21Z"},{"id":"wordfence:1c307340-2911-46b9-9c90-0a7ebad8a0e9","source":"wordfence","cve":"","title":"Smash Balloon Social Photo Feed <= 1.11.3 - Cross-Site Request Forgery to Back-Up Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c307340-2911-46b9-9c90-0a7ebad8a0e9?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":false,"patched_in":"1.12"}],"published":"2019-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c3247d1-c230-44f5-8151-355c2078f01b","source":"wordfence","cve":"CVE-2025-47572","title":"School Management <= 93.0.0 - Authenticated (Student+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3247d1-c230-44f5-8151-355c2078f01b?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T14:35:27Z"},{"id":"wordfence:1c33c193-618d-4e36-bb36-350cac6e2948","source":"wordfence","cve":"CVE-2024-13605","title":"Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c33c193-618d-4e36-bb36-350cac6e2948?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.32","to_inclusive":true,"patched_in":"1.15.33"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T22:49:05Z"},{"id":"wordfence:1c36c69c-dc6c-436c-95c1-a0f7fe526fa6","source":"wordfence","cve":"CVE-2025-50022","title":"WP-FB-AutoConnect <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c36c69c-dc6c-436c-95c1-a0f7fe526fa6?source=api-prod","affected":[{"type":"plugin","slug":"wp-fb-autoconnect","name":"WP Social AutoConnect","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:57:31Z"},{"id":"wordfence:1c3850d9-640d-4554-b21c-8448a560ebb2","source":"wordfence","cve":"CVE-2026-106610","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3850d9-640d-4554-b21c-8448a560ebb2?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.8"}],"published":"2026-10-08T17:55:23Z","updated":"2026-10-13T13:58:29Z"},{"id":"wordfence:1c387b07-baf6-4c62-943e-4bd121160ceb","source":"wordfence","cve":"CVE-2023-2528","title":"Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c387b07-baf6-4c62-943e-4bd121160ceb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.24","to_inclusive":true,"patched_in":"1.7.25"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c3a29ec-16f0-4fad-b188-7a683d123bb8","source":"wordfence","cve":"CVE-2026-39488","title":"SureCart <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3a29ec-16f0-4fad-b188-7a683d123bb8?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-03-26T00:00:00Z","updated":"2026-04-15T21:25:15Z"},{"id":"wordfence:1c3b0fe6-796b-41c7-b989-439081be181f","source":"wordfence","cve":"CVE-2026-4792","title":"Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3b0fe6-796b-41c7-b989-439081be181f?source=api-prod","affected":[{"type":"plugin","slug":"bread","name":"Bread","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2026-09-18T18:45:41Z","updated":"2026-09-19T07:43:13Z"},{"id":"wordfence:1c3cfaa5-00e3-41b6-8f38-cebdd5dec180","source":"wordfence","cve":"CVE-2026-104898","title":"Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body","severity":"medium","cvss":6.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3cfaa5-00e3-41b6-8f38-cebdd5dec180?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.5"}],"published":"2026-10-09T15:20:04Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:1c3d4c96-63a7-4f3b-a9ac-095be241f840","source":"wordfence","cve":"CVE-2023-2498","title":"Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3d4c96-63a7-4f3b-a9ac-095be241f840?source=api-prod","affected":[{"type":"plugin","slug":"go_pricing","name":"Go Pricing - WordPress Responsive Pricing Tables","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c3e1a05-ae8c-4438-afd9-d1d0a39484c2","source":"wordfence","cve":"CVE-2024-35766","title":"WPPizza \u2013 A Restaurant Plugin <= 3.18.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3e1a05-ae8c-4438-afd9-d1d0a39484c2?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.18.13","to_inclusive":true,"patched_in":"3.18.14"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-02T12:55:05Z"},{"id":"wordfence:1c3fbca2-f11f-4f9c-9d70-eea98bdfd3b0","source":"wordfence","cve":"CVE-2026-3712","title":"PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter","severity":"high","cvss":7.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3fbca2-f11f-4f9c-9d70-eea98bdfd3b0?source=api-prod","affected":[{"type":"plugin","slug":"phastpress","name":"PhastPress","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"}],"published":"2026-10-14T16:23:32Z","updated":"2026-10-15T04:26:51Z"},{"id":"wordfence:1c40c28f-554f-42d0-9f6d-a899d8f61519","source":"wordfence","cve":"CVE-2023-30778","title":"PowerPress <= 10.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c40c28f-554f-42d0-9f6d-a899d8f61519?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"10.0.1","to_inclusive":true,"patched_in":"10.0.2"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c4169aa-785e-460e-8578-8dc842097daa","source":"wordfence","cve":"CVE-2026-104028","title":"Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c4169aa-785e-460e-8578-8dc842097daa?source=api-prod","affected":[{"type":"plugin","slug":"4nton-extensions","name":"Anton Extensions","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:36:54Z"},{"id":"wordfence:1c432dbe-8542-41de-966a-b2699d1685ce","source":"wordfence","cve":"CVE-2024-9611","title":"Increase upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c432dbe-8542-41de-966a-b2699d1685ce?source=api-prod","affected":[{"type":"plugin","slug":"increase-upload-file-size-maximum-execution-time-limit","name":"Increase upload file size & Maximum Execution Time limit","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:15Z"},{"id":"wordfence:1c441ceb-0363-4117-afd6-afa253343cbe","source":"wordfence","cve":"CVE-2025-12393","title":"Free Quotation <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c441ceb-0363-4117-afd6-afa253343cbe?source=api-prod","affected":[{"type":"plugin","slug":"free-quotation","name":"Free Quotation","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:56:53Z","updated":"2025-11-04T04:27:14Z"},{"id":"wordfence:1c442d6b-a272-4fb1-8f8e-8cdda326be6d","source":"wordfence","cve":"CVE-2024-52408","title":"Push Notifications for WordPress by PushAssist <= 3.0.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c442d6b-a272-4fb1-8f8e-8cdda326be6d?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-wp-by-pushassist","name":"Push Notifications for WordPress by PushAssist","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:12:12Z"},{"id":"wordfence:1c443add-d02b-4a32-bd88-812b2ff747ed","source":"wordfence","cve":"CVE-2026-103063","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c443add-d02b-4a32-bd88-812b2ff747ed?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-10-01T12:33:00Z","updated":"2026-10-08T23:14:40Z"},{"id":"wordfence:1c47f708-12c2-488b-b13f-9091f58f5369","source":"wordfence","cve":"CVE-2026-49466","title":"Draft List < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c47f708-12c2-488b-b13f-9091f58f5369?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2026-05-20T00:00:00Z","updated":"2026-09-16T18:04:46Z"},{"id":"wordfence:1c49babd-0ad1-46ce-a096-a5069e51d823","source":"wordfence","cve":"CVE-2026-105977","title":"Portfolio Filter Gallery 2.0.2 - 2.2.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c49babd-0ad1-46ce-a096-a5069e51d823?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-filter-gallery","name":"Portfolio Filter Gallery \u2013 Photo Gallery","from":"2.0.2","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:56:16Z"},{"id":"wordfence:1c49f37f-62eb-40ce-9c9e-e7e8785fc114","source":"wordfence","cve":"CVE-2025-22786","title":"ElementInvader Addons for Elementor <= 1.2.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c49f37f-62eb-40ce-9c9e-e7e8785fc114?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:49:37Z"},{"id":"wordfence:1c4b3c9a-ed3e-460b-ac35-dd2c91b30cd8","source":"wordfence","cve":"CVE-2025-53444","title":"UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c4b3c9a-ed3e-460b-ac35-dd2c91b30cd8?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.11","to_inclusive":false,"patched_in":"5.1.11"}],"published":"2026-04-15T00:00:00Z","updated":"2026-04-21T15:19:10Z"},{"id":"wordfence:1c4fcaa5-357a-4b70-8653-3874a234f07d","source":"wordfence","cve":"CVE-2023-36528","title":"kk Star Ratings <= 5.4.3 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c4fcaa5-357a-4b70-8653-3874a234f07d?source=api-prod","affected":[{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c4fd888-aeaf-4451-a151-8f884bc22f0b","source":"wordfence","cve":"CVE-2026-0812","title":"LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c4fd888-aeaf-4451-a151-8f884bc22f0b?source=api-prod","affected":[{"type":"plugin","slug":"linkedin-sc","name":"LinkedIn SC","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:32:02Z","updated":"2026-01-14T06:40:05Z"},{"id":"wordfence:1c507681-61e9-4bf0-8fe5-e2f401a7a8be","source":"wordfence","cve":"CVE-2025-1306","title":"Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c507681-61e9-4bf0-8fe5-e2f401a7a8be?source=api-prod","affected":[{"type":"theme","slug":"newscrunch","name":"Newscrunch","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.4.1"}],"published":"2025-03-03T15:46:15Z","updated":"2025-03-04T04:26:08Z"},{"id":"wordfence:1c5108f3-d80c-4646-8d40-3bdd1361c6ab","source":"wordfence","cve":"CVE-2026-0727","title":"Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c5108f3-d80c-4646-8d40-3bdd1361c6ab?source=api-prod","affected":[{"type":"plugin","slug":"accordion-and-accordion-slider","name":"Accordion and Accordion Slider","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-02-13T18:20:34Z","updated":"2026-02-14T06:42:28Z"},{"id":"wordfence:1c51a3f8-dee1-4744-8353-864312c89021","source":"wordfence","cve":"CVE-2022-44595","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c51a3f8-dee1-4744-8353-864312c89021?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c544990-9fd2-4f1b-a02c-a13959d68580","source":"wordfence","cve":"CVE-2024-2864","title":"Buddypress Moderation <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c544990-9fd2-4f1b-a02c-a13959d68580?source=api-prod","affected":[{"type":"plugin","slug":"youzify-moderation","name":"BuddyPress Moderation","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-25T00:00:00Z","updated":"2024-11-25T07:59:57Z"},{"id":"wordfence:1c59e016-9651-4346-b045-6a312042ceca","source":"wordfence","cve":"CVE-2026-112869","title":"We\u2019re Open! <= 2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c59e016-9651-4346-b045-6a312042ceca?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2026-10-22T07:22:30Z","updated":"2026-10-28T01:17:32Z"},{"id":"wordfence:1c5d214e-65e2-4158-a88f-58bef7c9952b","source":"wordfence","cve":"CVE-2016-1000135","title":"HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting via channel parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c5d214e-65e2-4158-a88f-58bef7c9952b?source=api-prod","affected":[{"type":"plugin","slug":"hdw-tube","name":"HDW WordPress Video Gallery","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c61b3a7-25a9-4890-a294-378883ebe11d","source":"wordfence","cve":"CVE-2024-32829","title":"Data Tables Generator by Supsystic <= 1.10.31 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c61b3a7-25a9-4890-a294-378883ebe11d?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.10.31","to_inclusive":true,"patched_in":"1.10.32"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:35:34Z"},{"id":"wordfence:1c63eaea-0a0f-412b-9f1a-3091de3a653a","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.4 - Missing Authorization to Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c63eaea-0a0f-412b-9f1a-3091de3a653a?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c642df9-559d-4dfa-8c17-4136d9b948d7","source":"wordfence","cve":"CVE-2025-47482","title":"SKT Skill Bar <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c642df9-559d-4dfa-8c17-4136d9b948d7?source=api-prod","affected":[{"type":"plugin","slug":"skt-skill-bar","name":"SKT Skill Bar","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:29:18Z"},{"id":"wordfence:1c648de5-14b3-4c7f-a1c2-46d91b56b0ff","source":"wordfence","cve":"CVE-2007-2485","title":"Myflash < 1.11 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c648de5-14b3-4c7f-a1c2-46d91b56b0ff?source=api-prod","affected":[{"type":"plugin","slug":"myflash","name":"Myflash","from":"*","from_inclusive":true,"to":"1.00","to_inclusive":true,"patched_in":"1.11"}],"published":"2007-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c649083-d311-42ce-83be-9aca5933ed47","source":"wordfence","cve":"CVE-2024-4751","title":"WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c649083-d311-42ce-83be-9aca5933ed47?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayers-request","name":"GoPrayer","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-05-24T00:00:00Z","updated":"2024-07-01T14:54:32Z"},{"id":"wordfence:1c667631-7934-467e-baa2-7c3b0160c3a5","source":"wordfence","cve":"CVE-2023-4506","title":"Active Directory Integration / LDAP Integration <= 4.1.9 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c667631-7934-467e-baa2-7c3b0160c3a5?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.1.10"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c679280-a7c6-4c29-914a-bea98c78b37a","source":"wordfence","cve":"CVE-2026-86797","title":"Pricing Table \u2013 Block \u2013 Show Product or Service Pricing in Table Format 1.0.7 - 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c679280-a7c6-4c29-914a-bea98c78b37a?source=api-prod","affected":[{"type":"plugin","slug":"b-pricing-table","name":"Pricing Table \u2013 Block \u2013 Show Product or Service Pricing in Table Format","from":"1.0.7","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:40:54Z"},{"id":"wordfence:1c688fc1-a8af-4fcd-9f23-5f653da86f78","source":"wordfence","cve":"CVE-2026-115282","title":"Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c688fc1-a8af-4fcd-9f23-5f653da86f78?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"2.6.4","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T19:25:46Z"},{"id":"wordfence:1c69162b-2e9e-4cf2-9db5-e2a9be00cbd9","source":"wordfence","cve":"CVE-2026-116853","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.19.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c69162b-2e9e-4cf2-9db5-e2a9be00cbd9?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.1","to_inclusive":true,"patched_in":"4.19.0.2"}],"published":"2026-10-30T08:26:24Z","updated":"2026-11-03T19:34:21Z"},{"id":"wordfence:1c6a1956-73aa-4ac3-ae1c-ef5f62bad718","source":"wordfence","cve":"CVE-2024-12253","title":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6a1956-73aa-4ac3-ae1c-ef5f62bad718?source=api-prod","affected":[{"type":"plugin","slug":"simple-e-commerce-shopping-cart","name":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:09:57Z","updated":"2024-12-07T09:26:01Z"},{"id":"wordfence:1c6b2c4b-5ea5-471d-9114-d2b469b6c59b","source":"wordfence","cve":"CVE-2023-2320","title":"CF7 Google Sheets Connector <= 5.0.1 - Reflected Cross-Site Scripting via 'code'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6b2c4b-5ea5-471d-9114-d2b469b6c59b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-sheets-connector-pro","name":"CF7 Google Sheets Connector Pro","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"},{"type":"plugin","slug":"cf7-google-sheets-connector","name":"GSheetConnector \u2013 CF7 Google Sheets Connector & Save CF7 Entries to Database","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c6bf45b-b02d-43bb-b682-7f1ae994e1d3","source":"wordfence","cve":"CVE-2021-4343","title":"uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6bf45b-b02d-43bb-b682-7f1ae994e1d3?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c6d5a66-0eec-4a73-ad78-2b66a688c67a","source":"wordfence","cve":"CVE-2024-33923","title":"SP Project & Document Manager  <= 4.69 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6d5a66-0eec-4a73-ad78-2b66a688c67a?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.69","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:43:03Z"},{"id":"wordfence:1c6dd146-a99e-4317-a703-de34735317c8","source":"wordfence","cve":"CVE-2024-8916","title":"Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6dd146-a99e-4317-a703-de34735317c8?source=api-prod","affected":[{"type":"plugin","slug":"suki-sites-import","name":"Suki Sites Import","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:45:37Z","updated":"2024-10-18T04:32:50Z"},{"id":"wordfence:1c6f7733-8c6d-487c-91e7-cc7df90cb962","source":"wordfence","cve":"CVE-2025-30530","title":"AI Preloader <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6f7733-8c6d-487c-91e7-cc7df90cb962?source=api-prod","affected":[{"type":"plugin","slug":"ai-preloader","name":"AI Preloader","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:39:46Z"},{"id":"wordfence:1c703856-9519-4181-9312-dcf862840bd9","source":"wordfence","cve":"CVE-2020-35948","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin 4.2.1 - 4.2.12 - Unprotected AJAX Actions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c703856-9519-4181-9312-dcf862840bd9?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"4.2.1","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"4.2.153"}],"published":"2020-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c73724c-c099-49ba-93f4-23e1c8cb4028","source":"wordfence","cve":"CVE-2025-59552","title":"Save as PDF <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c73724c-c099-49ba-93f4-23e1c8cb4028?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:01:33Z"},{"id":"wordfence:1c74e434-460f-4ba7-a105-8a8ce766fc2d","source":"wordfence","cve":"CVE-2025-58831","title":"Parallax Scrolling Enllax.js <= 0.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c74e434-460f-4ba7-a105-8a8ce766fc2d?source=api-prod","affected":[{"type":"plugin","slug":"parallax-scrolling-enllax-js","name":"Parallax Scrolling Enllax.js","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:14:38Z"},{"id":"wordfence:1c7504e5-26a2-4387-8b79-43d6cf6fd0dc","source":"wordfence","cve":"CVE-2025-68014","title":"AweBooking <= 3.2.26 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7504e5-26a2-4387-8b79-43d6cf6fd0dc?source=api-prod","affected":[{"type":"plugin","slug":"awebooking","name":"AweBooking \u2013 Hotel Booking System","from":"*","from_inclusive":true,"to":"3.2.26","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T14:28:54Z"},{"id":"wordfence:1c75edd2-fc38-48b1-b58c-1d19c95c3db8","source":"wordfence","cve":"CVE-2023-44997","title":"WP Forms Puzzle Captcha <= 4.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c75edd2-fc38-48b1-b58c-1d19c95c3db8?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-puzzle-captcha","name":"WP Forms Puzzle Captcha","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c78009f-c422-408b-a604-1bab4474debd","source":"wordfence","cve":"CVE-2025-64273","title":"Email marketing for WordPress by GetResponse Official <= 1.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c78009f-c422-408b-a604-1bab4474debd?source=api-prod","affected":[{"type":"plugin","slug":"getresponse-official","name":"GetResponse Official","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-09-25T00:00:00Z","updated":"2025-12-20T19:22:34Z"},{"id":"wordfence:1c7a69f1-7206-4405-9821-2edfb77cd7a7","source":"wordfence","cve":"CVE-2026-108487","title":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7a69f1-7206-4405-9821-2edfb77cd7a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:44:21Z"},{"id":"wordfence:1c7c0c35-5f44-488f-9fe1-269ea4a73854","source":"wordfence","cve":"CVE-2023-3277","title":"MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c0c35-5f44-488f-9fe1-269ea4a73854?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.10.7","to_inclusive":true,"patched_in":"4.10.8"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c7c74cf-a109-4f77-a740-5a43ccd4e96a","source":"wordfence","cve":"CVE-2024-0385","title":"Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c7c74cf-a109-4f77-a740-5a43ccd4e96a?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:35:57Z"},{"id":"wordfence:1c8034ff-cf36-498f-9efc-a4e6bbb92b2c","source":"wordfence","cve":"CVE-2023-1918","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8034ff-cf36-498f-9efc-a4e6bbb92b2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c8152c5-7d72-48a1-9140-8b0341c86023","source":"wordfence","cve":"CVE-2023-28694","title":"Wbcom Designs \u2013 BuddyPress Activity Social Share <= 3.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8152c5-7d72-48a1-9140-8b0341c86023?source=api-prod","affected":[{"type":"plugin","slug":"bp-activity-social-share","name":"Wbcom Designs \u2013 BuddyPress Activity Social Share","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2023-03-22T00:00:00Z","updated":"2024-02-19T17:49:02Z"},{"id":"wordfence:1c85e5e0-d8ee-46d3-99b1-df6c6744f020","source":"wordfence","cve":"CVE-2023-48762","title":"Multiple Plugins by Crocoblock <= (Various Versions) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c85e5e0-d8ee-46d3-99b1-df6c6744f020?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.2.1"},{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.1.25.1","to_inclusive":true,"patched_in":"2.1.25.2"},{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.5.1"},{"type":"plugin","slug":"jet-theme-core","name":"JetThemeCore for Elementor","from":"*","from_inclusive":true,"to":"2.1.2.1","to_inclusive":true,"patched_in":"2.1.2.2"},{"type":"plugin","slug":"jet-compare-wishlist","name":"JetCompareWishlist","from":"*","from_inclusive":true,"to":"1.5.5.1","to_inclusive":true,"patched_in":"1.5.5.2"},{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.13.1"},{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.2.1"},{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.7.2","to_inclusive":true,"patched_in":"2.1.7.3"},{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.2.1"},{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.2.5.1","to_inclusive":true,"patched_in":"3.2.5.2"},{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":true,"patched_in":"1.4.6.2"},{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"},{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.8.1"},{"type":"plugin","slug":"jet-woo-product-gallery","name":"JetProductGallery","from":"*","from_inclusive":true,"to":"2.1.13.1","to_inclusive":true,"patched_in":"2.1.13.2"},{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.2.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c866d8d-399c-4bda-a3c9-17c7e5d2ffb8","source":"wordfence","cve":"CVE-2023-0695","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c866d8d-399c-4bda-a3c9-17c7e5d2ffb8?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c874d4a-7ec0-4024-bc05-80160388507c","source":"wordfence","cve":"CVE-2026-28132","title":"WooCommerce Photo Reviews <= 1.4.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c874d4a-7ec0-4024-bc05-80160388507c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-photo-reviews","name":"WooCommerce Photo Reviews Premium","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-27T00:00:00Z","updated":"2026-05-05T13:34:53Z"},{"id":"wordfence:1c894de0-2ea7-4002-9c26-0e3e59744a5e","source":"wordfence","cve":"CVE-2024-43335","title":"Responsive Blocks \u2013 WordPress Gutenberg Blocks <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c894de0-2ea7-4002-9c26-0e3e59744a5e?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:12:28Z"},{"id":"wordfence:1c8b8391-8d18-49ad-a5ee-2ba7a9090e6b","source":"wordfence","cve":"CVE-2024-34377","title":"Video Gallery \u2013 Api Gallery, YouTube and Vimeo, Link Gallery <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8b8391-8d18-49ad-a5ee-2ba7a9090e6b?source=api-prod","affected":[{"type":"plugin","slug":"new-video-gallery","name":"Video Gallery \u2013 YouTube, Vimeo Gallery & YouTube API","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:13:59Z"},{"id":"wordfence:1c8bcbf8-1848-4f7a-89d8-5894de0bb18b","source":"wordfence","cve":"CVE-2024-13333","title":"Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8bcbf8-1848-4f7a-89d8-5894de0bb18b?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"5.2.12","from_inclusive":true,"to":"5.2.13","to_inclusive":true,"patched_in":"5.2.14"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T05:29:27Z"},{"id":"wordfence:1c8c1fec-0e87-46f7-83c5-8f9e9aa97b4f","source":"wordfence","cve":"CVE-2026-9241","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8c1fec-0e87-46f7-83c5-8f9e9aa97b4f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-05-27T14:49:48Z","updated":"2026-05-28T03:27:27Z"},{"id":"wordfence:1c8de019-4ec1-49fd-9b0b-c2b1b6908ba8","source":"wordfence","cve":"CVE-2025-12350","title":"DominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8de019-4ec1-49fd-9b0b-c2b1b6908ba8?source=api-prod","affected":[{"type":"plugin","slug":"dominokit","name":"DominoKit","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:31:29Z","updated":"2025-11-04T04:27:14Z"},{"id":"wordfence:1c8e615a-a1fc-428d-93bc-27c5d6d758eb","source":"wordfence","cve":"CVE-2025-63015","title":"WooCommerce Payment Gateway \u2013 Paysera <= 3.10.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8e615a-a1fc-428d-93bc-27c5d6d758eb?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-paysera","name":"Paysera Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2025-12-04T00:00:00Z","updated":"2026-01-23T19:10:46Z"},{"id":"wordfence:1c8e6f5e-d403-497d-bedc-d570d35ca00f","source":"wordfence","cve":"CVE-2025-63072","title":"Cornerstone <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8e6f5e-d403-497d-bedc-d570d35ca00f?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"7.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-06T00:00:00Z","updated":"2025-12-10T16:03:32Z"},{"id":"wordfence:1c8e814b-3828-4b3f-a9ad-b3758ab9b109","source":"wordfence","cve":"CVE-2025-0863","title":"Flexmls\u00ae IDX <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8e814b-3828-4b3f-a9ad-b3758ab9b109?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.14.28","to_inclusive":true,"patched_in":"3.14.29"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T07:22:24Z"},{"id":"wordfence:1c8fe389-ff44-4be3-889b-0006977f4f3c","source":"wordfence","cve":"CVE-2025-11256","title":"Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8fe389-ff44-4be3-889b-0006977f4f3c?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-10-17T19:09:49Z","updated":"2025-10-18T07:26:32Z"},{"id":"wordfence:1c9266b8-cf27-4a55-ae5a-0beda19f0fbf","source":"wordfence","cve":"CVE-2024-43323","title":"ReviewX \u2013 Multi-criteria Rating & Reviews for WooCommerce <= 1.6.28 - Insufficient Input Validation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9266b8-cf27-4a55-ae5a-0beda19f0fbf?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.28","to_inclusive":true,"patched_in":"1.6.29"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:33:18Z"},{"id":"wordfence:1c93b564-5428-4b0e-bbe8-f1e1e68940ac","source":"wordfence","cve":"CVE-2026-9109","title":"GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c93b564-5428-4b0e-bbe8-f1e1e68940ac?source=api-prod","affected":[{"type":"plugin","slug":"gptranslate","name":"GPTranslate \u2013 Multilingual AI Translation Agent for WordPress: Translate Your Site with AI","from":"*","from_inclusive":true,"to":"2.31","to_inclusive":true,"patched_in":"2.32"}],"published":"2026-06-12T17:00:41Z","updated":"2026-06-13T05:32:42Z"},{"id":"wordfence:1c93c412-541a-429f-b18e-7b75c8ebdf67","source":"wordfence","cve":"CVE-2023-0360","title":"Location Weather <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c93c412-541a-429f-b18e-7b75c8ebdf67?source=api-prod","affected":[{"type":"plugin","slug":"location-weather","name":"Location Weather \u2013 WordPress Weather Forecast, Air Quality & Weather Widget","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c94028c-a774-45ac-817d-ad9b966a3b51","source":"wordfence","cve":"CVE-2023-1549","title":"Ad Inserter <= 2.7.25 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c94028c-a774-45ac-817d-ad9b966a3b51?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.25","to_inclusive":true,"patched_in":"2.7.26"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c98e8f4-49b4-4d1e-8e11-e38b676d4af0","source":"wordfence","cve":"CVE-2024-11227","title":"Memberlite Shortcodes <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c98e8f4-49b4-4d1e-8e11-e38b676d4af0?source=api-prod","affected":[{"type":"plugin","slug":"memberlite-shortcodes","name":"Memberlite Shortcodes","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-11-22T21:03:31Z","updated":"2024-11-23T09:39:08Z"},{"id":"wordfence:1c995da3-83c4-4734-8d4f-24c34f12919c","source":"wordfence","cve":"CVE-2015-9421","title":"Olevmedia Shortcodes <= 1.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c995da3-83c4-4734-8d4f-24c34f12919c?source=api-prod","affected":[{"type":"plugin","slug":"olevmedia-shortcodes","name":"Olevmedia Shortcodes","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1c9b7866-d4e4-4ed0-a94b-1daef73a10bc","source":"wordfence","cve":"CVE-2024-37099","title":"GiveWP <= 3.14.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9b7866-d4e4-4ed0-a94b-1daef73a10bc?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2024-08-09T00:00:00Z","updated":"2026-05-07T13:59:03Z"},{"id":"wordfence:1c9c7c79-4ea4-4d6f-84a4-7a09e716adae","source":"wordfence","cve":"CVE-2026-27086","title":"Woodmart < 8.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9c7c79-4ea4-4d6f-84a4-7a09e716adae?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.8","to_inclusive":false,"patched_in":"8.3.8"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:22:47Z"},{"id":"wordfence:1c9e7f0b-7154-4ba0-a8a2-da16891d43d9","source":"wordfence","cve":"CVE-2026-111947","title":"Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9e7f0b-7154-4ba0-a8a2-da16891d43d9?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:32:40Z"},{"id":"wordfence:1c9eaa0f-870b-4bc1-9fcd-b354e794597d","source":"wordfence","cve":"CVE-2026-84098","title":"Directorist 3.1.0 - 8.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9eaa0f-870b-4bc1-9fcd-b354e794597d?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"3.1.0","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:50:27Z"},{"id":"wordfence:1ca3fe43-c579-4a8d-8747-6573f3ec7901","source":"wordfence","cve":"CVE-2025-53324","title":"Gutenify <= 1.5.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ca3fe43-c579-4a8d-8747-6573f3ec7901?source=api-prod","affected":[{"type":"plugin","slug":"gutenify","name":"Gutenify \u2013 Visual Site Builder Blocks & Starter Templates","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2025-09-23T00:00:00Z","updated":"2025-10-14T19:12:47Z"},{"id":"wordfence:1ca51afc-801f-4d3c-8df0-b663de976578","source":"wordfence","cve":"CVE-2026-109150","title":"PageNavi Style <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ca51afc-801f-4d3c-8df0-b663de976578?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagenavi-style","name":"WP PageNavi Style","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:40:15Z"},{"id":"wordfence:1caa8baa-0783-4bc9-af03-46a3a2cf3538","source":"wordfence","cve":"CVE-2024-12333","title":"WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1caa8baa-0783-4bc9-af03-46a3a2cf3538?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.0.3","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T08:22:34Z"},{"id":"wordfence:1cab1bef-c8c5-45ee-921e-0d01736e74c6","source":"wordfence","cve":"CVE-2024-25927","title":"postMash \u2013 custom post order <= 1.2.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cab1bef-c8c5-45ee-921e-0d01736e74c6?source=api-prod","affected":[{"type":"plugin","slug":"postmash","name":"postMash \u2013 custom post order","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-02-15T00:00:00Z","updated":"2024-02-20T19:38:43Z"},{"id":"wordfence:1cac2397-bb38-40d6-b90d-68e3ea136267","source":"wordfence","cve":"CVE-2026-9010","title":"Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cac2397-bb38-40d6-b90d-68e3ea136267?source=api-prod","affected":[{"type":"plugin","slug":"boost","name":"Boost","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-05-19T14:25:02Z","updated":"2026-05-20T02:27:47Z"},{"id":"wordfence:1cae9918-be0b-416f-a81b-d08c826d8612","source":"wordfence","cve":"CVE-2026-57345","title":"Internal Links Manager <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cae9918-be0b-416f-a81b-d08c826d8612?source=api-prod","affected":[{"type":"plugin","slug":"seo-automated-link-building","name":"Internal Links Manager","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:08:35Z"},{"id":"wordfence:1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2","source":"wordfence","cve":"CVE-2026-8685","title":"Infility Global <= 2.15.19 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1caeb5e0-9e4e-4c9e-a6e4-881fb81dc5f2?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.19","to_inclusive":true,"patched_in":"2.15.20"}],"published":"2026-05-19T12:07:43Z","updated":"2026-09-18T19:50:41Z"},{"id":"wordfence:1cb1d8a3-91dd-419e-bc4e-57842afeb7b1","source":"wordfence","cve":"CVE-2022-43482","title":"Appointment Booking Calendar <= 1.3.69 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cb1d8a3-91dd-419e-bc4e-57842afeb7b1?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.69","to_inclusive":true,"patched_in":"1.3.70"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cb265d8-eb18-42ee-9141-2fe81c0c4585","source":"wordfence","cve":"CVE-2023-22693","title":"WP Google Tag Manager <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cb265d8-eb18-42ee-9141-2fe81c0c4585?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-tag-manager","name":"WP Google Tag Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cb488d7-8b9d-440d-a04b-834639845eb4","source":"wordfence","cve":"CVE-2025-62970","title":"Link Whisper Free <= 0.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cb488d7-8b9d-440d-a04b-834639845eb4?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":"0.9.3"}],"published":"2025-10-18T00:00:00Z","updated":"2026-05-19T12:57:20Z"},{"id":"wordfence:1cb8b203-7971-4c92-a499-50b9dc04cd83","source":"wordfence","cve":"CVE-2025-39363","title":"Custom Login and Registration <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cb8b203-7971-4c92-a499-50b9dc04cd83?source=api-prod","affected":[{"type":"plugin","slug":"ms-registration","name":"Custom Login and Registration","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:19:27Z"},{"id":"wordfence:1cbad810-530c-4160-af5d-7e57ecc40dac","source":"wordfence","cve":"CVE-2024-47333","title":"Loops & Logic <= 4.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbad810-530c-4160-af5d-7e57ecc40dac?source=api-prod","affected":[{"type":"plugin","slug":"tangible-loops-and-logic","name":"Tangible: Loops & Logic","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:08:31Z"},{"id":"wordfence:1cbb309c-015b-4bdb-917a-a67e028484e6","source":"wordfence","cve":"CVE-2021-24490","title":"Email Artillery (MASS EMAIL) <= 4.1 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbb309c-015b-4bdb-917a-a67e028484e6?source=api-prod","affected":[{"type":"plugin","slug":"email-artillery","name":"Email Artillery (MASS EMAIL)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cbc482f-25b2-4709-8e6a-426fcd5b9fe0","source":"wordfence","cve":"CVE-2026-42670","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin <= 2.7.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbc482f-25b2-4709-8e6a-426fcd5b9fe0?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.14","to_inclusive":true,"patched_in":"2.7.15"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T13:33:47Z"},{"id":"wordfence:1cbd298c-cba3-4986-b44c-a75b005b4340","source":"wordfence","cve":"CVE-2007-10003","title":"The Hacker's Diet <= 0.9.6b - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbd298c-cba3-4986-b44c-a75b005b4340?source=api-prod","affected":[{"type":"plugin","slug":"the-hackers-diet","name":"The Hacker's Diet","from":"*","from_inclusive":true,"to":"0.9.6b","to_inclusive":true,"patched_in":"0.9.7b"}],"published":"2007-04-30T00:00:00Z","updated":"2024-02-12T14:51:59Z"},{"id":"wordfence:1cbd95bb-6f13-48c9-a51e-5f7bf7a296df","source":"wordfence","cve":"CVE-2024-3285","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbd95bb-6f13-48c9-a51e-5f7bf7a296df?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.70.0","to_inclusive":true,"patched_in":"3.70.1"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-11T07:31:38Z"},{"id":"wordfence:1cc1727e-92a6-484d-bdd1-d79aec534df5","source":"wordfence","cve":"CVE-2025-39384","title":"Product Lister for eBay <= 2.0.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc1727e-92a6-484d-bdd1-d79aec534df5?source=api-prod","affected":[{"type":"plugin","slug":"product-lister-ebay","name":"Product Lister for eBay","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:08:26Z"},{"id":"wordfence:1cc2bc18-8182-4716-bb34-ffb574d8c874","source":"wordfence","cve":"CVE-2024-48041","title":"CM Tooltip Glossary <= 4.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc2bc18-8182-4716-bb34-ffb574d8c874?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":"4.3.11"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:48:02Z"},{"id":"wordfence:1cc50245-365a-419d-a85c-fbd658d004ae","source":"wordfence","cve":"CVE-2023-4253","title":"ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc50245-365a-419d-a85c-fbd658d004ae?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cc64898-8724-4ba5-9260-02c647812cc8","source":"wordfence","cve":"CVE-2026-22481","title":"BD Courier Order Ratio Checker <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc64898-8724-4ba5-9260-02c647812cc8?source=api-prod","affected":[{"type":"plugin","slug":"bd-courier-order-ratio-checker","name":"BD Courier Order Ratio Checker","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T19:25:41Z"},{"id":"wordfence:1cc8c6f2-c38c-4e41-8c16-bb18fc5755bd","source":"wordfence","cve":"CVE-2026-39535","title":"Display Eventbrite Events <= 6.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc8c6f2-c38c-4e41-8c16-bb18fc5755bd?source=api-prod","affected":[{"type":"plugin","slug":"widget-for-eventbrite-api","name":"Display Eventbrite Events","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:13:11Z"},{"id":"wordfence:1ccb16c9-7a04-4c8f-9eaa-7efbd84991b3","source":"wordfence","cve":"CVE-2026-13172","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ccb16c9-7a04-4c8f-9eaa-7efbd84991b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":false,"patched_in":"4.1.22"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T17:53:00Z"},{"id":"wordfence:1ccc8b30-1bdf-4335-85a9-79c6f9a88afc","source":"wordfence","cve":"CVE-2025-14618","title":"Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ccc8b30-1bdf-4335-85a9-79c6f9a88afc?source=api-prod","affected":[{"type":"plugin","slug":"sweet-energy-efficiency","name":"Sweet Energy Efficiency","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-12-17T23:38:07Z","updated":"2025-12-18T12:22:29Z"},{"id":"wordfence:1cd087ec-2cb1-4853-a10f-a1e31089177b","source":"wordfence","cve":"CVE-2026-75134","title":"SEOWriting <= 1.12.5 - Authenticated (Contributor +) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd087ec-2cb1-4853-a10f-a1e31089177b?source=api-prod","affected":[{"type":"plugin","slug":"seowriting","name":"SEO WRITING \u2013 AI Writer for SEO & AI Search","from":"*","from_inclusive":true,"to":"1.12.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-16T15:45:45Z"},{"id":"wordfence:1cd2d269-5af2-40ab-b424-505c95c56688","source":"wordfence","cve":"CVE-2025-12186","title":"Weekly Planner <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd2d269-5af2-40ab-b424-505c95c56688?source=api-prod","affected":[{"type":"plugin","slug":"weekly-planner","name":"Weekly Planner","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:39:52Z","updated":"2025-12-05T06:07:17Z"},{"id":"wordfence:1cd5acfc-0338-4958-8f46-3d7b14ef0e14","source":"wordfence","cve":"CVE-2025-62734","title":"Media Library Downloader <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd5acfc-0338-4958-8f46-3d7b14ef0e14?source=api-prod","affected":[{"type":"plugin","slug":"media-library-downloader","name":"Media Library Downloader","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-12-04T00:00:00Z","updated":"2026-06-08T16:13:10Z"},{"id":"wordfence:1cd5fa89-ed3b-4ac1-9200-9f5eb26cb534","source":"wordfence","cve":"CVE-2024-1418","title":"CGC Maintenance Mode <= 1.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd5fa89-ed3b-4ac1-9200-9f5eb26cb534?source=api-prod","affected":[{"type":"plugin","slug":"cgc-maintenance-mode","name":"CGC Maintenance Mode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T05:34:22Z"},{"id":"wordfence:1cd877e6-e000-437d-ba9f-0640350277e4","source":"wordfence","cve":"CVE-2024-1815","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd877e6-e000-437d-ba9f-0640350277e4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.12.8","to_inclusive":true,"patched_in":"2.12.9"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T11:02:37Z"},{"id":"wordfence:1cd9ebdc-8c97-47a5-9147-40684d74bddd","source":"wordfence","cve":"CVE-2024-51694","title":"Geotagged Media <= 0.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd9ebdc-8c97-47a5-9147-40684d74bddd?source=api-prod","affected":[{"type":"plugin","slug":"geotagged-media","name":"Geotagged Media","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:12:53Z"},{"id":"wordfence:1cda31a4-4c79-4567-a527-6510c31d2843","source":"wordfence","cve":"CVE-2023-28154","title":"webpack JS package <= 5.75.0 - Sandbox Bypass","severity":"high","cvss":8.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cda31a4-4c79-4567-a527-6510c31d2843?source=api-prod","affected":[{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.4.0"},{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2023-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cda411b-b277-4b4d-9087-dadede4b67dd","source":"wordfence","cve":"CVE-2024-2295","title":"Contact Form Manager <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cda411b-b277-4b4d-9087-dadede4b67dd?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-manager","name":"Contact Form Manager","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-01T07:35:56Z"},{"id":"wordfence:1cdadc61-8a8d-446a-8f7e-9fecd7d687b1","source":"wordfence","cve":"CVE-2025-69025","title":"Poptics <= 1.0.20 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cdadc61-8a8d-446a-8f7e-9fecd7d687b1?source=api-prod","affected":[{"type":"plugin","slug":"poptics","name":"Poptics \u2013 Popup Builder, Email Opt-ins, Exit-Intent & WooCommerce Popups Sales","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:39:56Z"},{"id":"wordfence:1cdfbc7a-e3c2-44c1-af83-b2b78be01e5e","source":"wordfence","cve":"CVE-2024-43237","title":"WordPress Tag Cloud Plugin \u2013 Tag Groups <= 2.0.3 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cdfbc7a-e3c2-44c1-af83-b2b78be01e5e?source=api-prod","affected":[{"type":"plugin","slug":"tag-groups","name":"PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T16:01:50Z"},{"id":"wordfence:1ce1316b-674a-4436-968f-9ffca4e8f726","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.16.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ce1316b-674a-4436-968f-9ffca4e8f726?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":true,"patched_in":"5.16.2"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ce15d38-c5bc-441b-976a-60a3e90b5a30","source":"wordfence","cve":"CVE-2022-2222","title":"Download Monitor <= 4.5.9 - Authenticated Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ce15d38-c5bc-441b-976a-60a3e90b5a30?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"4.5.91"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ce34561-e50f-409f-a6c8-e54d27d5d72b","source":"wordfence","cve":"CVE-2026-121570","title":"RSVP and Event Management <= 2.7.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ce34561-e50f-409f-a6c8-e54d27d5d72b?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.17","to_inclusive":true,"patched_in":"2.7.18"}],"published":"2026-11-07T10:39:30Z","updated":"2026-11-10T19:43:04Z"},{"id":"wordfence:1ce7c895-e94c-46bd-9de1-f5fde29c3475","source":"wordfence","cve":"CVE-2020-36738","title":"Cool Timeline (Horizontal & Vertical Timeline) <= 2.0.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ce7c895-e94c-46bd-9de1-f5fde29c3475?source=api-prod","affected":[{"type":"plugin","slug":"cool-timeline","name":"Cool Timeline (Horizontal & Vertical Timeline)","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ceae0dc-205a-4a24-a912-b632c9ca7e6f","source":"wordfence","cve":"CVE-2024-5744","title":"WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ceae0dc-205a-4a24-a912-b632c9ca7e6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.6","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-23T19:44:40Z"},{"id":"wordfence:1cebb69a-3096-48fa-903c-b4eff62eec6d","source":"wordfence","cve":"CVE-2025-63018","title":"Bard <= 2.229 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebb69a-3096-48fa-903c-b4eff62eec6d?source=api-prod","affected":[{"type":"theme","slug":"bard","name":"Bard","from":"*","from_inclusive":true,"to":"2.229","to_inclusive":true,"patched_in":""}],"published":"2025-10-31T15:58:23Z","updated":"2026-02-03T13:42:47Z"},{"id":"wordfence:1cebcf16-ae7f-45c4-8e1d-80ede4c32106","source":"wordfence","cve":"CVE-2025-12955","title":"Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cebcf16-ae7f-45c4-8e1d-80ede4c32106?source=api-prod","affected":[{"type":"plugin","slug":"live-sales-notifications-for-woocommerce","name":"PiWeb Live sales notification for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.39","to_inclusive":true,"patched_in":"2.3.40"}],"published":"2025-11-17T20:54:37Z","updated":"2025-11-18T09:27:37Z"},{"id":"wordfence:1cec03d3-0e80-4025-b782-1ce9c3237569","source":"wordfence","cve":"CVE-2023-23973","title":"Contact Us Page \u2013 Contact People <= 3.7.0 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cec03d3-0e80-4025-b782-1ce9c3237569?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cee249d-0a0e-4675-9e35-3a177a3b74a2","source":"wordfence","cve":"CVE-2024-12341","title":"Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cee249d-0a0e-4675-9e35-3a177a3b74a2?source=api-prod","affected":[{"type":"plugin","slug":"custom-skins-contact-form-7","name":"Custom Skins Contact Form 7","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:19:18Z","updated":"2024-12-12T03:23:04Z"},{"id":"wordfence:1cee24a0-0897-4f48-bdca-0a5118899bed","source":"wordfence","cve":"CVE-2025-48323","title":"Advance Food Menu <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cee24a0-0897-4f48-bdca-0a5118899bed?source=api-prod","affected":[{"type":"plugin","slug":"advance-food-menu","name":"Advance Food Menu","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:58:51Z"},{"id":"wordfence:1cee38cd-b36b-4e3e-bfc6-3c6de18fda33","source":"wordfence","cve":"CVE-2025-32255","title":"StaffList <= 3.2.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cee38cd-b36b-4e3e-bfc6-3c6de18fda33?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-12-04T20:22:30Z"},{"id":"wordfence:1cefe584-c1b0-418c-bade-ca4092807b1b","source":"wordfence","cve":"CVE-2014-10379","title":"Yoast Duplicate Post <= 2.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cefe584-c1b0-418c-bade-ca4092807b1b?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post","name":"Yoast Duplicate Post","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cf23d79-5bd3-4224-835d-174653ddd504","source":"wordfence","cve":"CVE-2025-4216","title":"DIOT SCADA with MQTT <= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf23d79-5bd3-4224-835d-174653ddd504?source=api-prod","affected":[{"type":"plugin","slug":"ecava-diot-scada","name":"DIOT SCADA with MQTT","from":"*","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:42:24Z","updated":"2025-06-14T08:23:22Z"},{"id":"wordfence:1cf2739f-9001-409a-9b7f-024931729da3","source":"wordfence","cve":"CVE-2021-24694","title":"Simple Download Monitor <= 3.9.10 - Contributor+ Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf2739f-9001-409a-9b7f-024931729da3?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.9.11"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cf3190c-e247-4bcc-99e0-2ab2d2fa0590","source":"wordfence","cve":"CVE-2024-4003","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf3190c-e247-4bcc-99e0-2ab2d2fa0590?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.15","to_inclusive":true,"patched_in":"5.9.16"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:51:51Z"},{"id":"wordfence:1cf44639-60ce-4a3c-aa4a-550dd9327039","source":"wordfence","cve":"CVE-2017-18555","title":"Booking Calendar - Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf44639-60ce-4a3c-aa4a-550dd9327039?source=api-prod","affected":[{"type":"plugin","slug":"booking-sms","name":"Booking Calendar \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2017-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1cf5c5e0-3194-44a5-b6a7-77b7e8fc1ab9","source":"wordfence","cve":"CVE-2025-32165","title":"Doppler Forms <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf5c5e0-3194-44a5-b6a7-77b7e8fc1ab9?source=api-prod","affected":[{"type":"plugin","slug":"doppler-form","name":"Doppler Easy Multichannel Marketing enhanced with IA","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-10-10T20:44:26Z"},{"id":"wordfence:1cf65f79-d386-4dd4-a360-b2f764dfaf19","source":"wordfence","cve":"CVE-2025-3876","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf65f79-d386-4dd4-a360-b2f764dfaf19?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2025-05-09T21:58:31Z","updated":"2025-05-10T11:22:46Z"},{"id":"wordfence:1cf77ee7-4736-40cf-b399-5e384e2c305f","source":"wordfence","cve":"CVE-2026-88843","title":"MasterStudy LMS 3.5.29 -  3.7.49 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cf77ee7-4736-40cf-b399-5e384e2c305f?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"3.5.29","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:14:48Z"},{"id":"wordfence:1cfb8568-e525-4048-9d39-34a50d2ba386","source":"wordfence","cve":"CVE-2026-106603","title":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfb8568-e525-4048-9d39-34a50d2ba386?source=api-prod","affected":[{"type":"plugin","slug":"holler-box","name":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:31:48Z"},{"id":"wordfence:1cfba6a0-d473-4b8a-8b37-b58d00a51a92","source":"wordfence","cve":"CVE-2026-86610","title":"Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfba6a0-d473-4b8a-8b37-b58d00a51a92?source=api-prod","affected":[{"type":"plugin","slug":"downloadmanager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.70","to_inclusive":true,"patched_in":"3.3.71"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:42:31Z"},{"id":"wordfence:1cfbb817-1bb2-4829-9a63-d8e579053000","source":"wordfence","cve":"CVE-2024-11438","title":"StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfbb817-1bb2-4829-9a63-d8e579053000?source=api-prod","affected":[{"type":"plugin","slug":"stream-status-for-twitch","name":"StreamWeasels Online Status Bar","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T05:33:49Z"},{"id":"wordfence:1cfc48bc-1768-49ef-bb22-7fa2c6691b23","source":"wordfence","cve":"CVE-2026-77189","title":"Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfc48bc-1768-49ef-bb22-7fa2c6691b23?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.12.1","to_inclusive":true,"patched_in":"1.8.12.2"}],"published":"2026-08-31T17:03:35Z","updated":"2026-09-01T05:30:40Z"},{"id":"wordfence:1cfe6f79-d5af-4f63-9f6a-39ae34f150e8","source":"wordfence","cve":"CVE-2026-39706","title":"Make My Trivia <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfe6f79-d5af-4f63-9f6a-39ae34f150e8?source=api-prod","affected":[{"type":"plugin","slug":"trivialy","name":"Make My Trivia","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:33:31Z"},{"id":"wordfence:1cfe8902-9ddf-4dac-80ca-17589b737cd5","source":"wordfence","cve":"CVE-2026-119156","title":"Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cfe8902-9ddf-4dac-80ca-17589b737cd5?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager Pro","from":"6.0.0","from_inclusive":true,"to":"7.5.9","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2026-11-06T23:44:33Z","updated":"2026-11-12T16:55:35Z"},{"id":"wordfence:1cffd0a4-e720-444d-ac07-463b790fdfd9","source":"wordfence","cve":"CVE-2026-94239","title":"Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1cffd0a4-e720-444d-ac07-463b790fdfd9?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:23:07Z"},{"id":"wordfence:1d0166c9-1349-45df-9e0f-ff4bc1a67c73","source":"wordfence","cve":"CVE-2024-43313","title":"FormFacade <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d0166c9-1349-45df-9e0f-ff4bc1a67c73?source=api-prod","affected":[{"type":"plugin","slug":"formfacade","name":"FormFacade \u2013 Embed Google Forms in your website","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T12:55:30Z"},{"id":"wordfence:1d063d01-5f67-4c7f-ab71-01708456e82b","source":"wordfence","cve":"CVE-2022-1749","title":"WPMK Ajax Finder <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d063d01-5f67-4c7f-ab71-01708456e82b?source=api-prod","affected":[{"type":"plugin","slug":"find-any-think","name":"WPMK Ajax Finder","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d064a64-3dee-4930-af87-21c9af3d1d1e","source":"wordfence","cve":"CVE-2026-81798","title":"Easy Appointments <= 4.0.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d064a64-3dee-4930-af87-21c9af3d1d1e?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"4.0.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-07T12:32:57Z","updated":"2026-09-10T19:18:36Z"},{"id":"wordfence:1d072660-515c-4fd9-903b-815447786e03","source":"wordfence","cve":"CVE-2026-16778","title":"Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d072660-515c-4fd9-903b-815447786e03?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.21","to_inclusive":true,"patched_in":"2.1.22"}],"published":"2026-09-21T19:04:19Z","updated":"2026-09-22T07:41:10Z"},{"id":"wordfence:1d07eefc-f406-4da4-addb-559caa6dc208","source":"wordfence","cve":"CVE-2022-2940","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d07eefc-f406-4da4-addb-559caa6dc208?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-11-14T00:00:00Z","updated":"2026-03-27T10:55:16Z"},{"id":"wordfence:1d0a40f8-4c31-447d-ac28-73cfe7a07687","source":"wordfence","cve":"CVE-2023-6243","title":"EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d0a40f8-4c31-447d-ac28-73cfe7a07687?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-19T06:42:00Z"},{"id":"wordfence:1d0d562f-cf21-487b-8386-066d24bdbb13","source":"wordfence","cve":"CVE-2026-15153","title":"WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d0d562f-cf21-487b-8386-066d24bdbb13?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:40:17Z"},{"id":"wordfence:1d107c38-3930-42bc-b67a-63cfed49f799","source":"wordfence","cve":"CVE-2026-104651","title":"Yaad Sarig Payment Gateway For WC <= 2.2.12 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d107c38-3930-42bc-b67a-63cfed49f799?source=api-prod","affected":[{"type":"plugin","slug":"yaad-sarig-payment-gateway-for-wc","name":"Yaad Sarig Payment Gateway For WC","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:11:16Z"},{"id":"wordfence:1d119ee0-4c16-46b1-ae45-8e0c6de0081b","source":"wordfence","cve":"CVE-2024-49232","title":"El mejor Cluster <= 1.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d119ee0-4c16-46b1-ae45-8e0c6de0081b?source=api-prod","affected":[{"type":"plugin","slug":"mejorcluster","name":"El mejor Cluster","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2024-10-14T00:00:00Z","updated":"2024-12-05T16:50:20Z"},{"id":"wordfence:1d12f5c5-2f81-4cf5-9ba9-e0949fc5bb48","source":"wordfence","cve":"CVE-2025-53329","title":"Spo\u0142eczno\u015bciowa 6 PL 2013 <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d12f5c5-2f81-4cf5-9ba9-e0949fc5bb48?source=api-prod","affected":[{"type":"plugin","slug":"spolecznosciowa-6-pl-2013","name":"Spo\u0142eczno\u015bciowa 6 PL 2013","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:25:29Z"},{"id":"wordfence:1d14779f-3ee5-4a55-b49d-e9162db2f4a2","source":"wordfence","cve":"","title":"WP Statistics < 8.3.1 - Multiple Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d14779f-3ee5-4a55-b49d-e9162db2f4a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":false,"patched_in":"8.3.1"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d17d3ce-2478-498b-8364-75d2449a9b58","source":"wordfence","cve":"CVE-2019-15324","title":"Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d17d3ce-2478-498b-8364-75d2449a9b58?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.4.21","to_inclusive":true,"patched_in":"2.4.22"}],"published":"2019-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d1866b0-93b0-4c11-9779-ca237034e1ab","source":"wordfence","cve":"CVE-2025-69408","title":"HealthFirst <= 1.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d1866b0-93b0-4c11-9779-ca237034e1ab?source=api-prod","affected":[{"type":"theme","slug":"healthfirst","name":"HealthFirst - Nutrition and Recipes WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T13:36:57Z"},{"id":"wordfence:1d18b3ad-57ea-40cb-8a35-0ae31efc8973","source":"wordfence","cve":"CVE-2024-54398","title":"Flaming Forms <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d18b3ad-57ea-40cb-8a35-0ae31efc8973?source=api-prod","affected":[{"type":"plugin","slug":"flaming-forms","name":"Flaming Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:00:20Z"},{"id":"wordfence:1d211a77-82fe-4835-ac06-acec9e06864a","source":"wordfence","cve":"CVE-2026-86782","title":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator 4.0.0 - 4.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d211a77-82fe-4835-ac06-acec9e06864a?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"4.0.0","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:27:49Z"},{"id":"wordfence:1d24dbdf-8fb0-41c3-8c35-e0d65c6b96f5","source":"wordfence","cve":"CVE-2023-30483","title":"Watu Quiz <= 3.3.9.2 - Reflected Cross-Site Scripting via 'question'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d24dbdf-8fb0-41c3-8c35-e0d65c6b96f5?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.3.9.2","to_inclusive":true,"patched_in":"3.3.9.3"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d261e25-7355-4220-882c-f3266c64252a","source":"wordfence","cve":"CVE-2021-24474","title":"Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting via id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d261e25-7355-4220-882c-f3266c64252a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-weather","name":"Awesome Weather Widget","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d28e118-07d3-483e-87b8-66ccdb79e879","source":"wordfence","cve":"CVE-2025-8896","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d28e118-07d3-483e-87b8-66ccdb79e879?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.14.3","to_inclusive":true,"patched_in":"3.14.4"}],"published":"2025-08-15T18:31:53Z","updated":"2025-08-16T06:39:22Z"},{"id":"wordfence:1d29880e-fdca-4e13-96a4-8be34d4b6325","source":"wordfence","cve":"CVE-2025-15691","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d29880e-fdca-4e13-96a4-8be34d4b6325?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":false,"patched_in":"3.13.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:24:52Z"},{"id":"wordfence:1d2a2032-3d39-4195-8e6c-ab884164721a","source":"wordfence","cve":"CVE-2025-12468","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a2032-3d39-4195-8e6c-ab884164721a?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.6.4.1","to_inclusive":true,"patched_in":"3.6.4.2"}],"published":"2025-11-04T21:17:26Z","updated":"2025-11-05T19:09:46Z"},{"id":"wordfence:1d2a3e10-e76b-4a5b-bb5a-2a99e48be094","source":"wordfence","cve":"CVE-2024-54390","title":"TagGator <= 1.54 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2a3e10-e76b-4a5b-bb5a-2a99e48be094?source=api-prod","affected":[{"type":"plugin","slug":"taggator","name":"TagGator","from":"*","from_inclusive":true,"to":"1.54","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:52:25Z"},{"id":"wordfence:1d2ae0d0-f666-4750-9ce0-70a061fe2a49","source":"wordfence","cve":"CVE-2024-12308","title":"Logo Slider <= 4.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2ae0d0-f666-4750-9ce0-70a061fe2a49?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T22:46:26Z"},{"id":"wordfence:1d2aef81-f8f1-47a4-8c9c-e46e3a0cbe0d","source":"wordfence","cve":"CVE-2025-23495","title":"WooCommerce Order Search <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2aef81-f8f1-47a4-8c9c-e46e3a0cbe0d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-order-searching","name":"WooCommerce Order Search","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:39:03Z"},{"id":"wordfence:1d2b7215-d3a7-4e5a-ae9b-65fecc26dceb","source":"wordfence","cve":"CVE-2025-4208","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2b7215-d3a7-4e5a-ae9b-65fecc26dceb?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.9.1","to_inclusive":true,"patched_in":"8.9.2"}],"published":"2025-05-07T21:30:44Z","updated":"2025-05-08T11:13:44Z"},{"id":"wordfence:1d2b78e0-1b82-4074-8051-e44dcfe3ac51","source":"wordfence","cve":"CVE-2024-43261","title":"Compute Links <= 1.2.1 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2b78e0-1b82-4074-8051-e44dcfe3ac51?source=api-prod","affected":[{"type":"plugin","slug":"compute-links","name":"Compute Links","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T15:10:59Z"},{"id":"wordfence:1d2ba8ea-a75f-4069-b67d-f832acb1deef","source":"wordfence","cve":"CVE-2024-8850","title":"MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2ba8ea-a75f-4069-b67d-f832acb1deef?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"4.9.9","from_inclusive":true,"to":"4.9.16","to_inclusive":true,"patched_in":"4.9.17"}],"published":"2024-09-18T00:00:00Z","updated":"2024-09-25T17:16:48Z"},{"id":"wordfence:1d2c6f19-025e-4c17-b5d9-4bbddbaf66d1","source":"wordfence","cve":"CVE-2023-24394","title":"iframe popup <= 3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2c6f19-025e-4c17-b5d9-4bbddbaf66d1?source=api-prod","affected":[{"type":"plugin","slug":"iframe-popup","name":"iframe popup","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d2c89ed-7bc3-48d0-a86b-8e1ca5ece261","source":"wordfence","cve":"CVE-2026-125708","title":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 10.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2c89ed-7bc3-48d0-a86b-8e1ca5ece261?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"10.0.4","to_inclusive":true,"patched_in":"10.0.5"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:34Z"},{"id":"wordfence:1d2da608-81a4-47b5-b23d-d18ab7bc2aa9","source":"wordfence","cve":"CVE-2024-30459","title":"AI WP Writer <= 3.6.5 - Missing Authorization","severity":"medium","cvss":5.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2da608-81a4-47b5-b23d-d18ab7bc2aa9?source=api-prod","affected":[{"type":"plugin","slug":"ai-wp-writer","name":"AI WP Writer \u2013 SEO content generator, chatGPT, Gemini, Claude","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.5.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T14:57:04Z"},{"id":"wordfence:1d2ebbc4-dc8b-47e5-b8d9-758424de4426","source":"wordfence","cve":"CVE-2022-2891","title":"WP 2FA <= 2.2.1 - Time-Based TOTP attack to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-204","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2ebbc4-dc8b-47e5-b8d9-758424de4426?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d2f17b9-efe9-40be-8b01-1eb73ccaf212","source":"wordfence","cve":"CVE-2025-32194","title":"LA-Studio Element Kit for Elementor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2f17b9-efe9-40be-8b01-1eb73ccaf212?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-23T17:49:59Z"},{"id":"wordfence:1d2f973a-1fb3-4c75-8c33-6d1fadf9c906","source":"wordfence","cve":"CVE-2005-1102","title":"WordPress Core <= 1.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2f973a-1fb3-4c75-8c33-6d1fadf9c906?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.1.2"}],"published":"2005-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d305711-7a84-46c2-b333-02f5a745d76c","source":"wordfence","cve":"CVE-2007-5106","title":"WordPress Core < 2.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d305711-7a84-46c2-b333-02f5a745d76c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2007-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d35a56e-2fc8-40b4-9796-b18e153993ae","source":"wordfence","cve":"CVE-2026-91016","title":"Motors <= 1.4.120 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d35a56e-2fc8-40b4-9796-b18e153993ae?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.120","to_inclusive":true,"patched_in":"1.4.121"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:05Z"},{"id":"wordfence:1d3771ee-b664-4416-93b7-96ab1e3510cc","source":"wordfence","cve":"CVE-2022-23984","title":"Comments - wpDiscuz <= 7.3.11 Sensitive Information Disclosure","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3771ee-b664-4416-93b7-96ab1e3510cc?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.3.11","to_inclusive":true,"patched_in":"7.3.12"}],"published":"2022-02-10T08:34:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d387d8e-198c-476a-9688-6842a871571e","source":"wordfence","cve":"CVE-2025-47468","title":"Hash Form <= 1.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d387d8e-198c-476a-9688-6842a871571e?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:34:17Z"},{"id":"wordfence:1d39f77a-8355-4b0d-aeb7-81c5e56effeb","source":"wordfence","cve":"CVE-2026-25448","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d39f77a-8355-4b0d-aeb7-81c5e56effeb?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.10","to_inclusive":true,"patched_in":"1.17.11"}],"published":"2026-10-29T14:41:00Z","updated":"2026-11-03T19:52:25Z"},{"id":"wordfence:1d3b7d56-ae4f-403c-a123-ac03e3074962","source":"wordfence","cve":"CVE-2026-82214","title":"Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3b7d56-ae4f-403c-a123-ac03e3074962?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"8.4.6","from_inclusive":true,"to":"9.18","to_inclusive":true,"patched_in":"9.19"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T20:12:22Z"},{"id":"wordfence:1d3cc32b-e415-4350-811a-c799a6ec24b6","source":"wordfence","cve":"CVE-2026-14306","title":"Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3cc32b-e415-4350-811a-c799a6ec24b6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.13","to_inclusive":true,"patched_in":"3.9.14"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-21T14:17:50Z"},{"id":"wordfence:1d3e476d-0885-4e8c-a682-bd64d9f13b53","source":"wordfence","cve":"CVE-2024-5704","title":"XPlainer \u2013 WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3e476d-0885-4e8c-a682-bd64d9f13b53?source=api-prod","affected":[{"type":"plugin","slug":"faq-for-woocommerce","name":"Happy FAQs \u2013 FAQ, Product FAQ & Help Center","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-01T20:22:26Z"},{"id":"wordfence:1d3eddce-1b41-4a33-8d57-bd594cf06a06","source":"wordfence","cve":"CVE-2026-75908","title":"Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3eddce-1b41-4a33-8d57-bd594cf06a06?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.17","to_inclusive":true,"patched_in":"4.18"}],"published":"2026-08-24T22:25:17Z","updated":"2026-08-25T11:27:10Z"},{"id":"wordfence:1d3f18e3-4c84-43a9-b2a3-8d381f92d39c","source":"wordfence","cve":"CVE-2026-124408","title":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3f18e3-4c84-43a9-b2a3-8d381f92d39c?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.22","to_inclusive":true,"patched_in":"3.0.23"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:02Z"},{"id":"wordfence:1d3ffa2d-ba09-4702-a4fa-d3d2f0ba5329","source":"wordfence","cve":"CVE-2026-123474","title":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates <= 2.3.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3ffa2d-ba09-4702-a4fa-d3d2f0ba5329?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.3.18","to_inclusive":true,"patched_in":"2.3.19"}],"published":"2026-11-07T12:35:00Z","updated":"2026-11-10T20:01:12Z"},{"id":"wordfence:1d4276c2-7c53-425b-9b97-b6812fc32047","source":"wordfence","cve":"CVE-2025-63038","title":"Custom Admin Interface <= 7.40 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4276c2-7c53-425b-9b97-b6812fc32047?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.40","to_inclusive":true,"patched_in":"7.41"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-08T21:17:10Z"},{"id":"wordfence:1d430b33-1607-46b3-8780-ac5cfbb7d6ec","source":"wordfence","cve":"","title":"EventCalendar <= 1.1.45 - Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d430b33-1607-46b3-8780-ac5cfbb7d6ec?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.1.45","to_inclusive":true,"patched_in":"1.1.46"}],"published":"2021-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d445043-f5dd-438c-968c-eedd096089ae","source":"wordfence","cve":"CVE-2025-39579","title":"Membership For WooCommerce <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d445043-f5dd-438c-968c-eedd096089ae?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:31:48Z"},{"id":"wordfence:1d4469e4-5d99-4a56-bde8-9a0aaca7794f","source":"wordfence","cve":"CVE-2024-7869","title":"123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4469e4-5d99-4a56-bde8-9a0aaca7794f?source=api-prod","affected":[{"type":"plugin","slug":"123-chat-videochat","name":"123.chat - Video Chat","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:12Z"},{"id":"wordfence:1d45bd32-d693-40e6-9b30-9e0b91eb4660","source":"wordfence","cve":"CVE-2023-32801","title":"WooCommerce Composite Products <= 8.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d45bd32-d693-40e6-9b30-9e0b91eb4660?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-composite-products","name":"WooCommerce Composite Products","from":"*","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":"8.7.6"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d45dcf3-9d1b-4370-ac63-e19f60ef9df6","source":"wordfence","cve":"CVE-2024-51834","title":"Luzuk Slider <= 0.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d45dcf3-9d1b-4370-ac63-e19f60ef9df6?source=api-prod","affected":[{"type":"plugin","slug":"luzuk-slider","name":"Luzuk Slider","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:41:02Z"},{"id":"wordfence:1d46033d-27aa-4d92-aa41-3547a3d17aff","source":"wordfence","cve":"CVE-2026-42738","title":"Smart Online Order for Clover <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d46033d-27aa-4d92-aa41-3547a3d17aff?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:08:05Z"},{"id":"wordfence:1d4b1446-f525-406a-9374-31c8a754d378","source":"wordfence","cve":"CVE-2025-62005","title":"SUMO Memberships for WooCommerce < 7.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4b1446-f525-406a-9374-31c8a754d378?source=api-prod","affected":[{"type":"plugin","slug":"sumomemberships","name":"SUMO Memberships for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":false,"patched_in":"7.8.0"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-23T14:37:05Z"},{"id":"wordfence:1d4cdfad-c5e9-42f7-bf20-d62afa179ccb","source":"wordfence","cve":"CVE-2026-118082","title":"BuddyBoss Platform <= 3.5.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4cdfad-c5e9-42f7-bf20-d62afa179ccb?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-04T21:39:49Z"},{"id":"wordfence:1d4da874-23c8-4df4-b776-6046ce8d705a","source":"wordfence","cve":"CVE-2026-9601","title":"Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4da874-23c8-4df4-b776-6046ce8d705a?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.19.9","to_inclusive":true,"patched_in":"3.19.10"}],"published":"2026-11-06T15:38:25Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:1d4dfcb3-8749-4b63-b68e-cc2742f82381","source":"wordfence","cve":"CVE-2025-48357","title":"Century ToolKit <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4dfcb3-8749-4b63-b68e-cc2742f82381?source=api-prod","affected":[{"type":"plugin","slug":"century-toolkit","name":"Century ToolKit","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:47:26Z"},{"id":"wordfence:1d4ecdfd-3970-4b87-831b-82bfb5a3c390","source":"wordfence","cve":"CVE-2025-24542","title":"Icegram <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d4ecdfd-3970-4b87-831b-82bfb5a3c390?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:40:07Z"},{"id":"wordfence:1d54bd25-148f-4e9a-bd31-77b52efd5499","source":"wordfence","cve":"CVE-2024-54363","title":"Wp NssUser Register <= 1.0.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d54bd25-148f-4e9a-bd31-77b52efd5499?source=api-prod","affected":[{"type":"plugin","slug":"wp-nssuser-register","name":"Wp NssUser Register","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:31:30Z"},{"id":"wordfence:1d59151c-aa50-4183-b429-143580961cb1","source":"wordfence","cve":"CVE-2026-85113","title":"GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d59151c-aa50-4183-b429-143580961cb1?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.8","to_inclusive":true,"patched_in":"4.16.9"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:55:03Z"},{"id":"wordfence:1d5987cd-1304-487c-8d1c-cab0510fbb84","source":"wordfence","cve":"CVE-2018-6389","title":"WordPress Core < 5.0 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5987cd-1304-487c-8d1c-cab0510fbb84?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2018-02-05T00:00:00Z","updated":"2024-02-06T20:23:03Z"},{"id":"wordfence:1d5ac3df-ddaf-4c78-acd3-baddea42443f","source":"wordfence","cve":"CVE-2023-50827","title":"Accredible Certificates & Open Badges <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5ac3df-ddaf-4c78-acd3-baddea42443f?source=api-prod","affected":[{"type":"plugin","slug":"accredible-certificates","name":"Accredible Certificates & Open Badges","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2023-12-19T00:00:00Z","updated":"2025-05-21T13:41:35Z"},{"id":"wordfence:1d5c7b7a-9207-4970-88b1-fac00cd1964a","source":"wordfence","cve":"CVE-2026-108483","title":"Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5c7b7a-9207-4970-88b1-fac00cd1964a?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2026-10-12T17:40:06Z","updated":"2026-10-23T18:24:05Z"},{"id":"wordfence:1d5d2217-306c-4ea2-9727-5c02f7d67c2d","source":"wordfence","cve":"CVE-2022-46806","title":"Cart All In One For WooCommerce <= 1.1.10 - Cross-Site Request Forgery to Cart Changes","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5d2217-306c-4ea2-9727-5c02f7d67c2d?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-all-in-one","name":"CartSuite \u2013 Cart All In One For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d5d4264-a293-43fc-98a9-b490a37b0c6b","source":"wordfence","cve":"CVE-2024-6720","title":"Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Answers Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5d4264-a293-43fc-98a9-b490a37b0c6b?source=api-prod","affected":[{"type":"plugin","slug":"light-poll","name":"Light Poll","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-15T20:14:51Z"},{"id":"wordfence:1d5ef241-d517-4ac3-8416-eed1428ae7ba","source":"wordfence","cve":"CVE-2024-50491","title":"RSVP ME <= 1.9.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5ef241-d517-4ac3-8416-eed1428ae7ba?source=api-prod","affected":[{"type":"plugin","slug":"rsvp-me","name":"RSVP ME","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:40:52Z"},{"id":"wordfence:1d5f9fc7-fc85-4326-9295-470e8208c35a","source":"wordfence","cve":"CVE-2024-33637","title":"Solid Affiliate <= 1.9.1 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d5f9fc7-fc85-4326-9295-470e8208c35a?source=api-prod","affected":[{"type":"plugin","slug":"solid-affiliate","name":"Solid Affiliate","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:10:10Z"},{"id":"wordfence:1d61ab0b-7559-4ba0-bbf7-cbc40e5c188b","source":"wordfence","cve":"CVE-2025-23478","title":"Photo Video Store <= 21.07 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d61ab0b-7559-4ba0-bbf7-cbc40e5c188b?source=api-prod","affected":[{"type":"plugin","slug":"photo-video-store","name":"Photo Video Store","from":"*","from_inclusive":true,"to":"21.07","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:49:28Z"},{"id":"wordfence:1d633f71-3b2b-4fe3-80f1-4c2dcc86313c","source":"wordfence","cve":"CVE-2024-12214","title":"WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d633f71-3b2b-4fe3-80f1-4c2dcc86313c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-hss-extension-for-streaming-video","name":"WooCommerce HSS Extension for Streaming Video","from":"*","from_inclusive":true,"to":"3.31","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:04:34Z","updated":"2025-01-07T04:21:57Z"},{"id":"wordfence:1d640d8e-7730-47e1-9f01-b9656f1ebb1c","source":"wordfence","cve":"CVE-2025-49296","title":"GrandPrix <= 1.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d640d8e-7730-47e1-9f01-b9656f1ebb1c?source=api-prod","affected":[{"type":"theme","slug":"grandprix","name":"GrandPrix - Motorcycle WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:16:28Z"},{"id":"wordfence:1d641e9e-e690-48ff-a28b-f4068d372aab","source":"wordfence","cve":"CVE-2024-43992","title":"LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d641e9e-e690-48ff-a28b-f4068d372aab?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"LatePoint Plugin","from":"*","from_inclusive":true,"to":"4.9.91","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:29:12Z"},{"id":"wordfence:1d667556-4cab-4f92-aa43-75e7722b3af6","source":"wordfence","cve":"CVE-2023-23866","title":"Interactive Geo Maps <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d667556-4cab-4f92-aa43-75e7722b3af6?source=api-prod","affected":[{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d68ea19-9592-483a-a5fd-635819f9b863","source":"wordfence","cve":"","title":"Easy Custom JS And CSS <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d68ea19-9592-483a-a5fd-635819f9b863?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-js-and-css","name":"WordPress Easy Custom Js And Css Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d6c9765-6936-4b22-835e-e899f62c14c9","source":"wordfence","cve":"CVE-2023-3133","title":"Tutor LMS <= 2.2.0 - Missing Authorization via REST API","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6c9765-6936-4b22-835e-e899f62c14c9?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d6d22ca-16bf-4f4d-a397-f2f8a035c2c0","source":"wordfence","cve":"CVE-2026-89007","title":"Bookit <= 2.6.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6d22ca-16bf-4f4d-a397-f2f8a035c2c0?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.4","to_inclusive":true,"patched_in":"2.6.0.5"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:16:39Z"},{"id":"wordfence:1d6e97cd-7da7-43ab-bd88-ebd442d50aa3","source":"wordfence","cve":"CVE-2024-31093","title":"Broken Images <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6e97cd-7da7-43ab-bd88-ebd442d50aa3?source=api-prod","affected":[{"type":"plugin","slug":"wp-broken-images","name":"Broken Images","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:57:18Z"},{"id":"wordfence:1d6f8410-538a-4d9c-89aa-5f57724d7d5f","source":"wordfence","cve":"CVE-2025-26958","title":"JetBlog <= 2.4.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6f8410-538a-4d9c-89aa-5f57724d7d5f?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.3.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:08:32Z"},{"id":"wordfence:1d6faee0-716e-4aa9-a841-5231c7aaff21","source":"wordfence","cve":"CVE-2015-9368","title":"Easy EU Value Added (VAT) Taxes < 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6faee0-716e-4aa9-a841-5231c7aaff21?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-easy-eu-vat-taxes","name":"Easy EU Value Added (VAT) Taxes Add-on","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d72ff0c-cbee-42a6-8bee-29a5e522a18d","source":"wordfence","cve":"CVE-2024-37223","title":"Restaurant Reservations <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d72ff0c-cbee-42a6-8bee-29a5e522a18d?source=api-prod","affected":[{"type":"plugin","slug":"nd-restaurant-reservations","name":"Restaurant Reservations","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:38:25Z"},{"id":"wordfence:1d730927-fe60-4f44-a7f7-37277d9cf542","source":"wordfence","cve":"CVE-2026-84167","title":"Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d730927-fe60-4f44-a7f7-37277d9cf542?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:09:54Z"},{"id":"wordfence:1d73f773-f084-40da-b18f-8b30b0d0c08a","source":"wordfence","cve":"","title":"VideoJS (Various Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d73f773-f084-40da-b18f-8b30b0d0c08a?source=api-prod","affected":[{"type":"plugin","slug":"s3-video","name":"S3 Video Plugin","from":"*","from_inclusive":true,"to":"0.98","to_inclusive":false,"patched_in":"0.98"},{"type":"plugin","slug":"EasySqueezePage","name":"EasySqueezePage","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"external-video-for-everybody","name":"External \"Video for Everybody\"","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"},{"type":"plugin","slug":"video-embed-thumbnail-generator","name":"Videopack","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1"},{"type":"plugin","slug":"1player","name":"1player","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2015-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d7440ae-f939-478c-8861-57020537dd44","source":"wordfence","cve":"CVE-2019-5971","title":"Attendance Manager <= 0.5.6 - Cross-site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7440ae-f939-478c-8861-57020537dd44?source=api-prod","affected":[{"type":"plugin","slug":"attendance-manager","name":"Attendance Manager","from":"*","from_inclusive":true,"to":"0.5.6","to_inclusive":true,"patched_in":"0.5.7"}],"published":"2019-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d779ad1-fdbe-444c-85c5-99146a1a03d8","source":"wordfence","cve":"CVE-2025-6058","title":"WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d779ad1-fdbe-444c-85c5-99146a1a03d8?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-12T04:22:21Z"},{"id":"wordfence:1d7860bf-3f3d-4bd2-82b0-7bb94d00ff30","source":"wordfence","cve":"CVE-2021-24815","title":"Paypal Donation <= 1.3.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7860bf-3f3d-4bd2-82b0-7bb94d00ff30?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d78b823-fdff-41b2-8059-6564e3eb668d","source":"wordfence","cve":"CVE-2024-11133","title":"Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d78b823-fdff-41b2-8059-6564e3eb668d?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.9.5","to_inclusive":true,"patched_in":"3.9.9.5.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-21T04:53:28Z"},{"id":"wordfence:1d79213c-bff3-4849-acc8-f658222ecdae","source":"wordfence","cve":"CVE-2025-31591","title":"Exit Popup Free <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d79213c-bff3-4849-acc8-f658222ecdae?source=api-prod","affected":[{"type":"plugin","slug":"exit-popup-free","name":"Exit Popup Free","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:23:23Z"},{"id":"wordfence:1d79432d-7977-4279-ac69-8e9db682800e","source":"wordfence","cve":"CVE-2020-6010","title":"LearnPress <= 3.2.6.7 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d79432d-7977-4279-ac69-8e9db682800e?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.6.7","to_inclusive":true,"patched_in":"3.2.6.8"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d7d8e85-c9cb-4fa5-9632-61f33048838d","source":"wordfence","cve":"CVE-2018-5663","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via button_text_link parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7d8e85-c9cb-4fa5-9632-61f33048838d?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d7d9521-4814-411d-859f-c7645551d3c5","source":"wordfence","cve":"CVE-2022-40968","title":"2kb Amazon Affiliates Store <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7d9521-4814-411d-859f-c7645551d3c5?source=api-prod","affected":[{"type":"plugin","slug":"2kb-amazon-affiliates-store","name":"2kb Amazon Affiliates Store","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d7f1283-a274-49a2-8bec-da178771b13a","source":"wordfence","cve":"CVE-2024-4413","title":"Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7f1283-a274-49a2-8bec-da178771b13a?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"4.11.1","to_inclusive":true,"patched_in":"4.11.2"}],"published":"2024-05-10T09:13:08Z","updated":"2024-05-10T21:32:41Z"},{"id":"wordfence:1d7ffc0b-2706-4707-9b8f-edcb418058ca","source":"wordfence","cve":"CVE-2026-8939","title":"Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d7ffc0b-2706-4707-9b8f-edcb418058ca?source=api-prod","affected":[{"type":"plugin","slug":"search-simple-fields","name":"Search Simple Fields","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:34Z","updated":"2026-05-27T05:31:20Z"},{"id":"wordfence:1d8331ce-666d-4d5a-b9cd-08562e3eea43","source":"wordfence","cve":"CVE-2021-24541","title":"Wonder PDF Embed <= 1.6 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8331ce-666d-4d5a-b9cd-08562e3eea43?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-pdf-embed","name":"Wonder PDF Embed","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d83a76a-2d23-4c68-9642-03b66e2208b0","source":"wordfence","cve":"CVE-2026-87896","title":"Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d83a76a-2d23-4c68-9642-03b66e2208b0?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:45:52Z"},{"id":"wordfence:1d845767-1e5f-43f0-9fc6-a897c2d5c3dd","source":"wordfence","cve":"CVE-2026-3253","title":"MailerLite \u2013 Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.7.21","to_inclusive":true,"patched_in":"1.7.22"}],"published":"2026-09-23T21:46:24Z","updated":"2026-09-24T11:31:08Z"},{"id":"wordfence:1d852dba-39ea-4cc9-9fcf-7f2ac3e1b5d0","source":"wordfence","cve":"CVE-2025-11765","title":"Stock Tools <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d852dba-39ea-4cc9-9fcf-7f2ac3e1b5d0?source=api-prod","affected":[{"type":"plugin","slug":"stock-tools","name":"Stock Tools","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:23:07Z","updated":"2025-11-21T07:31:47Z"},{"id":"wordfence:1d86d716-baf7-44fb-b319-4f8069c4e6dd","source":"wordfence","cve":"CVE-2026-32478","title":"WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d86d716-baf7-44fb-b319-4f8069c4e6dd?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager-business","name":"WP Project Manager Pro","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T07:10:54Z","updated":"2026-09-10T19:10:35Z"},{"id":"wordfence:1d87d225-7de4-49f8-9cba-391d718af7fd","source":"wordfence","cve":"CVE-2018-18461","title":"Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d87d225-7de4-49f8-9cba-391d718af7fd?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2018-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d8b79cc-287e-420b-8eb8-6345a62e9fb9","source":"wordfence","cve":"CVE-2025-11827","title":"Oboxmedia Ads <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8b79cc-287e-420b-8eb8-6345a62e9fb9?source=api-prod","affected":[{"type":"plugin","slug":"oboxmedia-ads","name":"Oboxmedia Ads","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:22:40Z","updated":"2025-10-22T08:27:05Z"},{"id":"wordfence:1d8c1290-8367-4378-8171-8a60bdb2f146","source":"wordfence","cve":"CVE-2025-31458","title":"Video Embedder <= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8c1290-8367-4378-8171-8a60bdb2f146?source=api-prod","affected":[{"type":"plugin","slug":"video-embedder","name":"Video Embedder","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-04T13:09:02Z"},{"id":"wordfence:1d8c53cd-c35e-44db-8e61-da8f02ee6025","source":"wordfence","cve":"CVE-2026-65539","title":"Kwayy HTML Sitemap <= 5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8c53cd-c35e-44db-8e61-da8f02ee6025?source=api-prod","affected":[{"type":"plugin","slug":"kwayy-html-sitemap","name":"Kwayy HTML Sitemap","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-09-09T16:08:00Z"},{"id":"wordfence:1d8c5b14-6a4c-4d66-85cc-b6ab3b886ff7","source":"wordfence","cve":"CVE-2024-27964","title":"Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8c5b14-6a4c-4d66-85cc-b6ab3b886ff7?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.10"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:19:03Z"},{"id":"wordfence:1d8d393e-764c-491d-8afb-7d4f8d0c387a","source":"wordfence","cve":"CVE-2026-15964","title":"Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8d393e-764c-491d-8afb-7d4f8d0c387a?source=api-prod","affected":[{"type":"plugin","slug":"single-sign-on-for-tng","name":"Single Sign On For TNG","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-07-31T20:08:40Z","updated":"2026-08-19T20:51:44Z"},{"id":"wordfence:1d8e07b0-428f-4089-9ada-f9d2475bfe91","source":"wordfence","cve":"CVE-2026-22384","title":"Applay - Shortcodes <= 3.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8e07b0-428f-4089-9ada-f9d2475bfe91?source=api-prod","affected":[{"type":"plugin","slug":"applay-shortcodes","name":"Applay - Shortcodes","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:18:35Z"},{"id":"wordfence:1d8f3874-dca7-404c-802a-a6b5d935e3a3","source":"wordfence","cve":"CVE-2025-24667","title":"Small Package Quotes \u2013 Worldwide Express Edition <= 5.2.17 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8f3874-dca7-404c-802a-a6b5d935e3a3?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-wwe-edition","name":"Small Package Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.17","to_inclusive":true,"patched_in":"5.2.18"}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-28T16:18:26Z"},{"id":"wordfence:1d8f6965-1fe3-4f24-bd6b-9026e91bc5db","source":"wordfence","cve":"CVE-2025-10493","title":"Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8f6965-1fe3-4f24-bd6b-9026e91bc5db?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-09-17T00:00:00Z","updated":"2025-09-18T06:49:47Z"},{"id":"wordfence:1d8fa778-420f-4cc4-a609-17c426789a35","source":"wordfence","cve":"CVE-2025-49952","title":"Houzez <= 4.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8fa778-420f-4cc4-a609-17c426789a35?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-11-04T16:53:35Z"},{"id":"wordfence:1d92ce83-03de-4981-8d90-0b8d2a2d16ef","source":"wordfence","cve":"CVE-2022-1760","title":"Core Control <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d92ce83-03de-4981-8d90-0b8d2a2d16ef?source=api-prod","affected":[{"type":"plugin","slug":"core-control","name":"Core Control","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-05-24T00:00:00Z","updated":"2024-02-06T01:09:22Z"},{"id":"wordfence:1d93db2c-7baf-42d8-9b4a-be91b27221a7","source":"wordfence","cve":"CVE-2024-2459","title":"UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d93db2c-7baf-42d8-9b4a-be91b27221a7?source=api-prod","affected":[{"type":"plugin","slug":"ux-flat","name":"UX Flat","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2024-03-19T00:00:00Z","updated":"2024-07-11T18:43:20Z"},{"id":"wordfence:1d95e90d-f8f4-4e9f-b8c9-cfd89516679e","source":"wordfence","cve":"CVE-2025-22790","title":"moseter <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d95e90d-f8f4-4e9f-b8c9-cfd89516679e?source=api-prod","affected":[{"type":"theme","slug":"moseter","name":"moseter","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:02:20Z"},{"id":"wordfence:1d95ec4b-0cbc-49c6-821e-7050d8045159","source":"wordfence","cve":"CVE-2024-12521","title":"Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d95ec4b-0cbc-49c6-821e-7050d8045159?source=api-prod","affected":[{"type":"plugin","slug":"slotti-ajanvaraus","name":"Slotti Ajanvaraus","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T03:18:10Z"},{"id":"wordfence:1d99c8a8-daeb-402b-990d-6bacf6e9a780","source":"wordfence","cve":"CVE-2025-13967","title":"Woodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d99c8a8-daeb-402b-990d-6bacf6e9a780?source=api-prod","affected":[{"type":"plugin","slug":"woodpecker","name":"Woodpecker for WordPress","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:54:57Z","updated":"2026-01-09T11:15:31Z"},{"id":"wordfence:1d9c4c5c-78cd-4c58-911a-fb67de0c1dca","source":"wordfence","cve":"CVE-2023-0271","title":"WP Font Awesome <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9c4c5c-78cd-4c58-911a-fb67de0c1dca?source=api-prod","affected":[{"type":"plugin","slug":"wp-font-awesome","name":"WP Font Awesome","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1d9d5afb-d38d-442c-8511-f1683739a1da","source":"wordfence","cve":"CVE-2025-0861","title":"VR-Frases (collect & share quotes) <= 3.0.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9d5afb-d38d-442c-8511-f1683739a1da?source=api-prod","affected":[{"type":"plugin","slug":"vr-frases","name":"VR-Frases","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-01-29T21:19:54Z","updated":"2025-07-24T19:09:37Z"},{"id":"wordfence:1d9e80da-4cc6-425c-892f-1ff34b07583f","source":"wordfence","cve":"CVE-2024-27999","title":"Preview E-mails for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9e80da-4cc6-425c-892f-1ff34b07583f?source=api-prod","affected":[{"type":"plugin","slug":"woo-preview-emails","name":"Preview E-mails for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T19:58:51Z"},{"id":"wordfence:1d9ff834-8a11-4ec7-9371-15d56bc84106","source":"wordfence","cve":"CVE-2025-0820","title":"Clicface Trombi <= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9ff834-8a11-4ec7-9371-15d56bc84106?source=api-prod","affected":[{"type":"plugin","slug":"clicface-trombi","name":"Clicface Trombi","from":"*","from_inclusive":true,"to":"2.08","to_inclusive":true,"patched_in":""}],"published":"2025-02-28T15:27:06Z","updated":"2025-03-01T04:21:49Z"},{"id":"wordfence:1d9ffbf3-520a-4563-85e1-27c1cc544856","source":"wordfence","cve":"CVE-2022-0769","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 3.1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9ffbf3-520a-4563-85e1-27c1cc544856?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1da09e8c-e9d8-4bbf-afdd-4bf49dc3b598","source":"wordfence","cve":"CVE-2025-30546","title":"Cackle <= 4.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da09e8c-e9d8-4bbf-afdd-4bf49dc3b598?source=api-prod","affected":[{"type":"plugin","slug":"cackle","name":"Cackle","from":"*","from_inclusive":true,"to":"4.33","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:14:20Z"},{"id":"wordfence:1da18430-1bd0-4f63-9e22-5d26de2be410","source":"wordfence","cve":"CVE-2025-12138","title":"URL Image Importer <= 1.0.6 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da18430-1bd0-4f63-9e22-5d26de2be410?source=api-prod","affected":[{"type":"plugin","slug":"url-image-importer","name":"URL Image Importer \u2013 Import External Images to the Media Library from URL, CSV & XML","from":"1.0","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-11-20T18:48:27Z","updated":"2025-11-21T07:31:49Z"},{"id":"wordfence:1da1d851-10ba-45e8-a486-03ac409075a4","source":"wordfence","cve":"CVE-2025-12685","title":"WPBookit <= 1.0.7 - Cross-Site Request Forgery to Customer Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da1d851-10ba-45e8-a486-03ac409075a4?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T00:00:00Z","updated":"2026-01-07T05:51:23Z"},{"id":"wordfence:1da28958-fee8-4108-9c7a-6e9b9b5ccc0f","source":"wordfence","cve":"CVE-2025-31790","title":"Posten <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da28958-fee8-4108-9c7a-6e9b9b5ccc0f?source=api-prod","affected":[{"type":"plugin","slug":"posten-post-blocks","name":"Posten \u2013 Gutenberg Post Block","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:08:22Z"},{"id":"wordfence:1da39f3d-512c-49e0-89cb-672783e5ca4e","source":"wordfence","cve":"CVE-2023-28367","title":"VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da39f3d-512c-49e0-89cb-672783e5ca4e?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.88.1.0","to_inclusive":true,"patched_in":"9.88.2.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1da53718-c2a2-45d0-ad43-daff3c68342d","source":"wordfence","cve":"CVE-2024-1733","title":"Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da53718-c2a2-45d0-ad43-daff3c68342d?source=api-prod","affected":[{"type":"plugin","slug":"word-replacer-ultra","name":"Word Replacer Pro","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T05:40:00Z"},{"id":"wordfence:1da8894c-fd19-4ea1-9c05-e519c0131061","source":"wordfence","cve":"CVE-2020-35938","title":"Team Showcase <= 1.22.15 - Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da8894c-fd19-4ea1-9c05-e519c0131061?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.16","to_inclusive":false,"patched_in":"1.22.16"}],"published":"2020-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1da9b3a0-dac8-41e4-b59c-968292c5da01","source":"wordfence","cve":"CVE-2026-94390","title":"Hide Shipping Method For WooCommerce <= 1.5.4 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1da9b3a0-dac8-41e4-b59c-968292c5da01?source=api-prod","affected":[{"type":"plugin","slug":"hide-shipping-method-for-woocommerce","name":"Hide Shipping Method For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-10-01T11:53:32Z","updated":"2026-10-08T23:51:38Z"},{"id":"wordfence:1daaab1a-ce0e-461d-940e-27b5b3f60e32","source":"wordfence","cve":"CVE-2024-31302","title":"Contact Form Email <= 1.3.44 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1daaab1a-ce0e-461d-940e-27b5b3f60e32?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.44","to_inclusive":true,"patched_in":"1.3.45"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:19:16Z"},{"id":"wordfence:1dab93f3-8068-4655-aa3d-a9f4c8dc9d61","source":"wordfence","cve":"CVE-2022-4487","title":"Easy Accordion <= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dab93f3-8068-4655-aa3d-a9f4c8dc9d61?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-free","name":"Easy Accordion \u2013 AI-Powered FAQ & Accordion Blocks, Product FAQ","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dad9de0-5e43-4dfd-a56c-5e9efff35c0a","source":"wordfence","cve":"CVE-2023-27618","title":"Store Locator WordPress <= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dad9de0-5e43-4dfd-a56c-5e9efff35c0a?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dafd962-3abe-4e39-9ab2-4d1df44f74d8","source":"wordfence","cve":"CVE-2026-97247","title":"Blocksy Companion <= 2.1.55 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dafd962-3abe-4e39-9ab2-4d1df44f74d8?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.55","to_inclusive":true,"patched_in":"2.1.56"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:35Z"},{"id":"wordfence:1db1c415-7c57-47bb-82d9-44168259ae1a","source":"wordfence","cve":"CVE-2024-30537","title":"WPC Badge Management for WooCommerce <= 2.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1db1c415-7c57-47bb-82d9-44168259ae1a?source=api-prod","affected":[{"type":"plugin","slug":"wpc-badge-management","name":"WPC Badge Management for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:51:51Z"},{"id":"wordfence:1db28477-8982-4e47-b5ed-26fd211ee925","source":"wordfence","cve":"CVE-2026-16502","title":"Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1db28477-8982-4e47-b5ed-26fd211ee925?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.1.19"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:29:58Z"},{"id":"wordfence:1db2aa6f-b9e8-4de9-b5f3-07cbec17871a","source":"wordfence","cve":"CVE-2026-84745","title":"The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1db2aa6f-b9e8-4de9-b5f3-07cbec17871a?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.3.1","to_inclusive":false,"patched_in":"6.17.3.1"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:19:43Z"},{"id":"wordfence:1dba61bb-2d26-483e-835f-c3841f07efe6","source":"wordfence","cve":"CVE-2024-39631","title":"Contest Gallery <= 23.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dba61bb-2d26-483e-835f-c3841f07efe6?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"23.1.2","to_inclusive":true,"patched_in":"23.1.3"}],"published":"2024-07-24T00:00:00Z","updated":"2024-08-01T12:55:45Z"},{"id":"wordfence:1dbdc673-b0ee-4d1d-8cd9-603056f41cda","source":"wordfence","cve":"CVE-2023-6295","title":"SiteOrigin Widgets Bundle < 1.51.0 - Authenticated (Admin+) Local File Inclusion","severity":"medium","cvss":5.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dbdc673-b0ee-4d1d-8cd9-603056f41cda?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.50.1","to_inclusive":true,"patched_in":"1.51.0"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dc1a20a-6e7e-4f5c-b0a0-cc79d6e4b0c4","source":"wordfence","cve":"CVE-2024-2444","title":"Inline Related Posts <= 3.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc1a20a-6e7e-4f5c-b0a0-cc79d6e4b0c4?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-28T16:30:23Z"},{"id":"wordfence:1dc30a32-3b02-4226-8a73-5086949ed92c","source":"wordfence","cve":"CVE-2025-59586","title":"Penci Portfolio <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc30a32-3b02-4226-8a73-5086949ed92c?source=api-prod","affected":[{"type":"plugin","slug":"penci-portfolio","name":"Penci Portfolio","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:43:10Z"},{"id":"wordfence:1dc4acdc-754f-4ee0-947d-ff0c277e8181","source":"wordfence","cve":"CVE-2024-8915","title":"Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc4acdc-754f-4ee0-947d-ff0c277e8181?source=api-prod","affected":[{"type":"plugin","slug":"category-icon","name":"Category Icon","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-10-11T20:10:19Z","updated":"2024-10-12T08:41:03Z"},{"id":"wordfence:1dc733ec-6cc8-40fc-b4c4-1fad4bcd9f21","source":"wordfence","cve":"","title":"Email Tracker \u2013 Email Tracking Plugin to track Emails for Open and Email Links Click (Compatible with WooCommerce) < 5.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc733ec-6cc8-40fc-b4c4-1fad4bcd9f21?source=api-prod","affected":[{"type":"plugin","slug":"email-tracker","name":"Email Tracker","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":false,"patched_in":"5.2.6"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dc7341f-35ee-45ab-a243-d450cc870014","source":"wordfence","cve":"CVE-2024-12585","title":"Property Hive <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc7341f-35ee-45ab-a243-d450cc870014?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-20T18:26:27Z"},{"id":"wordfence:1dcab187-c26e-43cb-bd6a-ff05041626da","source":"wordfence","cve":"CVE-2025-14124","title":"Team <= 5.0.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcab187-c26e-43cb-bd6a-ff05041626da?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-13T21:54:07Z"},{"id":"wordfence:1dcb1ac2-48f9-4d7c-9fd4-cf1c47e35a71","source":"wordfence","cve":"CVE-2026-65578","title":"Agora \u2014 Event & Conference WordPress Theme <= 1.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcb1ac2-48f9-4d7c-9fd4-cf1c47e35a71?source=api-prod","affected":[{"type":"theme","slug":"agora","name":"Agora \u2014 Event & Conference WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:21Z"},{"id":"wordfence:1dcbd3b3-33b7-47f1-bd04-5f60587ae184","source":"wordfence","cve":"CVE-2025-23866","title":"EU DSGVO Helper <= 1.0.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcbd3b3-33b7-47f1-bd04-5f60587ae184?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo","name":"EU DSGVO Helper","from":"*","from_inclusive":true,"to":"1.0.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:18:02Z"},{"id":"wordfence:1dccb69e-b3d8-44b5-8f5e-931e5afe2bd1","source":"wordfence","cve":"CVE-2023-38385","title":"JupiterX Core  3.0.0 - 3.3.0 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dccb69e-b3d8-44b5-8f5e-931e5afe2bd1?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"3.0.0","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dccdbbd-fd3c-4d76-a05a-42f1c7f7132f","source":"wordfence","cve":"CVE-2020-11497","title":"NAB Transact < 2.1.2 - Payment System Bypass","severity":"high","cvss":7.5,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dccdbbd-fd3c-4d76-a05a-42f1c7f7132f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-nab-dp","name":"NAB Transact","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2020-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dcdc56b-88c6-442b-871d-07fa0c238048","source":"wordfence","cve":"CVE-2025-69410","title":"Belletrist <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcdc56b-88c6-442b-871d-07fa0c238048?source=api-prod","affected":[{"type":"theme","slug":"belletrist","name":"Belletrist - Blog Theme for WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:25:55Z"},{"id":"wordfence:1dcf68fd-e9d3-4a46-8bd4-15c2598b91fe","source":"wordfence","cve":"CVE-2026-9242","title":"RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcf68fd-e9d3-4a46-8bd4-15c2598b91fe?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.8.6","to_inclusive":true,"patched_in":"6.0.8.7"}],"published":"2026-06-26T18:09:49Z","updated":"2026-06-27T06:50:56Z"},{"id":"wordfence:1dcf9af8-efdd-4f43-8d33-e62290c81ddd","source":"wordfence","cve":"CVE-2026-15785","title":"Joinchat <= 6.3.1 - Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcf9af8-efdd-4f43-8d33-e62290c81ddd?source=api-prod","affected":[{"type":"plugin","slug":"creame-whatsapp-me","name":"Joinchat \u2013 Enhanced \u201cclick to chat\u201d","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-11-10T19:25:00Z","updated":"2026-11-11T07:26:40Z"},{"id":"wordfence:1dcfbdad-a70b-4244-b89d-ddd13d7397a0","source":"wordfence","cve":"CVE-2024-37961","title":"codoc <= 0.9.51.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcfbdad-a70b-4244-b89d-ddd13d7397a0?source=api-prod","affected":[{"type":"plugin","slug":"codoc","name":"codoc","from":"*","from_inclusive":true,"to":"0.9.51.12","to_inclusive":true,"patched_in":"0.9.52"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-19T14:11:09Z"},{"id":"wordfence:1dd094b8-440a-47ae-8edc-c23f1909d607","source":"wordfence","cve":"CVE-2026-15602","title":"NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd094b8-440a-47ae-8edc-c23f1909d607?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.4","to_inclusive":true,"patched_in":"9.2.5"}],"published":"2026-08-15T15:35:26Z","updated":"2026-08-16T04:24:53Z"},{"id":"wordfence:1dd0bb5b-2eb5-46f0-8942-2885b1138b70","source":"wordfence","cve":"CVE-2025-14796","title":"My Album Gallery <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd0bb5b-2eb5-46f0-8942-2885b1138b70?source=api-prod","affected":[{"type":"plugin","slug":"my-album-gallery","name":"My Album Gallery","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:39:29Z","updated":"2026-01-07T09:20:53Z"},{"id":"wordfence:1dd1aa7f-c0a4-456a-b179-e0a11c2fabd0","source":"wordfence","cve":"CVE-2026-81812","title":"Elementor <= 4.3.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd1aa7f-c0a4-456a-b179-e0a11c2fabd0?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:57:52Z"},{"id":"wordfence:1dd2ac9e-210b-4d8d-a048-df0df6b10c13","source":"wordfence","cve":"CVE-2025-30583","title":"Pro Rank Tracker <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd2ac9e-210b-4d8d-a048-df0df6b10c13?source=api-prod","affected":[{"type":"plugin","slug":"proranktracker","name":"Pro Rank Tracker","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:04:31Z"},{"id":"wordfence:1dd3e203-dcc4-47b5-ab65-324bcff5b91b","source":"wordfence","cve":"CVE-2014-2316","title":"Search Everything <= 7.0.2 - SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd3e203-dcc4-47b5-ab65-324bcff5b91b?source=api-prod","affected":[{"type":"plugin","slug":"search-everything","name":"Search Everything","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":false,"patched_in":"7.0.3"}],"published":"2014-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dd4e39a-9b2f-4728-b026-2dee60257c46","source":"wordfence","cve":"CVE-2025-14469","title":"Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd4e39a-9b2f-4728-b026-2dee60257c46?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2026-07-31T18:34:12Z","updated":"2026-08-01T06:48:47Z"},{"id":"wordfence:1dd8a463-a4af-4297-be6b-0192a4534bb5","source":"wordfence","cve":"CVE-2025-26747","title":"RainbowNews <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd8a463-a4af-4297-be6b-0192a4534bb5?source=api-prod","affected":[{"type":"theme","slug":"rainbownews","name":"RainbowNews","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:40:13Z"},{"id":"wordfence:1dd8f008-b0a9-488b-a203-d041209cc3dc","source":"wordfence","cve":"CVE-2026-104050","title":"Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd8f008-b0a9-488b-a203-d041209cc3dc?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:21:50Z"},{"id":"wordfence:1dd928cb-5466-424e-a87a-3a9618edb56b","source":"wordfence","cve":"","title":"Phone Orders for WooCommerce <= 3.7.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dd928cb-5466-424e-a87a-3a9618edb56b?source=api-prod","affected":[{"type":"plugin","slug":"phone-orders-for-woocommerce","name":"Phone Orders for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ddb9fc8-bed4-42ff-9664-6ea8fb136ec0","source":"wordfence","cve":"CVE-2014-4567","title":"HTML5 Webcam Microphone Recorder Forms < 1.55 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ddb9fc8-bed4-42ff-9664-6ea8fb136ec0?source=api-prod","affected":[{"type":"plugin","slug":"video-comments-webcam-recorder","name":"Webcam/Screen/Mic Recorder for Video Comments and Forms","from":"*","from_inclusive":true,"to":"1.55","to_inclusive":true,"patched_in":"1.55.3"}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ddcd2eb-fd7a-48b7-b9ea-3632d49e9734","source":"wordfence","cve":"","title":"MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ddcd2eb-fd7a-48b7-b9ea-3632d49e9734?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"2.9.34","to_inclusive":true,"patched_in":"2.9.35"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ddfd5d9-a7e4-42a8-8419-9a35b4781d3c","source":"wordfence","cve":"CVE-2022-47594","title":"Essential Blocks for Gutenberg <= 3.8.5 -  Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ddfd5d9-a7e4-42a8-8419-9a35b4781d3c?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1de10a71-3b73-451e-ad24-2038b37a52f8","source":"wordfence","cve":"CVE-2026-39672","title":"ShipTime: Discounted Shipping Rates <= 1.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de10a71-3b73-451e-ad24-2038b37a52f8?source=api-prod","affected":[{"type":"plugin","slug":"shiptime-discount-shipping","name":"ShipTime: Discount Shipping","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-02-19T00:00:00Z","updated":"2026-07-28T19:05:28Z"},{"id":"wordfence:1de12d1c-5ac4-4f80-b33d-a689a6916ee0","source":"wordfence","cve":"CVE-2025-6742","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de12d1c-5ac4-4f80-b33d-a689a6916ee0?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"0.0","from_inclusive":true,"to":"0.0.13","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.0","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.2","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.3","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.4","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.5","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.6","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.7","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"0.0.14"}],"published":"2025-07-08T17:20:32Z","updated":"2025-07-09T05:23:41Z"},{"id":"wordfence:1de269b5-7262-45c8-8819-00982f196597","source":"wordfence","cve":"CVE-2024-9967","title":"WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de269b5-7262-45c8-8819-00982f196597?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-more","name":"WP show more","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T19:52:23Z","updated":"2024-10-26T08:35:59Z"},{"id":"wordfence:1de2b2c2-ae69-447b-83df-4e5cd4c8d337","source":"wordfence","cve":"CVE-2026-73366","title":"Easy Google Maps <= 1.13.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de2b2c2-ae69-447b-83df-4e5cd4c8d337?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.14.0"}],"published":"2026-08-17T13:16:55Z","updated":"2026-09-10T19:27:40Z"},{"id":"wordfence:1de36458-d7e5-43cf-af40-0fd7a6eea5bb","source":"wordfence","cve":"","title":"WP Support Plus Responsive Ticket System <= 8.0.7 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de36458-d7e5-43cf-af40-0fd7a6eea5bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":false,"patched_in":"8.0.8"}],"published":"2017-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1de3e564-c5a8-424c-9e94-b15956b9c2af","source":"wordfence","cve":"CVE-2025-23576","title":"WP Intro.JS Plugin <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de3e564-c5a8-424c-9e94-b15956b9c2af?source=api-prod","affected":[{"type":"plugin","slug":"wp-intro-js-tours","name":"WP Intro.JS Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:14:58Z"},{"id":"wordfence:1de41980-93bb-4831-bb31-50675499f648","source":"wordfence","cve":"CVE-2021-24769","title":"Permalink Manager Lite <= 2.2.12 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de41980-93bb-4831-bb31-50675499f648?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13.1"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1de69b7e-944a-4d89-a7de-2fae5ab83171","source":"wordfence","cve":"CVE-2017-9288","title":"Raygun4WP <= 1.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de69b7e-944a-4d89-a7de-2fae5ab83171?source=api-prod","affected":[{"type":"plugin","slug":"raygun4wp","name":"Raygun","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2017-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1de6c0d9-efa8-4c86-9d57-7aa92a0eda96","source":"wordfence","cve":"CVE-2024-37923","title":"Cliengo \u2013 Chatbot <= 3.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de6c0d9-efa8-4c86-9d57-7aa92a0eda96?source=api-prod","affected":[{"type":"plugin","slug":"cliengo","name":"Cliengo \u2013 Chatbot","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-07-09T00:00:00Z","updated":"2026-04-15T13:27:20Z"},{"id":"wordfence:1de8da4c-dee7-4d59-a475-a969008aa0d4","source":"wordfence","cve":"CVE-2024-13430","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de8da4c-dee7-4d59-a475-a969008aa0d4?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T08:22:07Z"},{"id":"wordfence:1de9183c-95b9-4500-85e2-08dcee956360","source":"wordfence","cve":"CVE-2021-4455","title":"Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1de9183c-95b9-4500-85e2-08dcee956360?source=api-prod","affected":[{"type":"plugin","slug":"smart-product-review","name":"Wordpress Plugin Smart Product Review","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2021-11-16T00:00:00Z","updated":"2025-04-19T07:23:39Z"},{"id":"wordfence:1decdfd8-a2e8-49af-ade8-01d19814b6fb","source":"wordfence","cve":"","title":"Flagallery-skins <= 1.1.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1decdfd8-a2e8-49af-ade8-01d19814b6fb?source=api-prod","affected":[{"type":"plugin","slug":"flagallery-skins","name":"Flagallery-skins","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2013-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1dede245-a48a-4e0c-afb8-8ddc4896c724","source":"wordfence","cve":"CVE-2026-22501","title":"Mounthood | Ski and Snowboarding HTML Template <= 1.3.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dede245-a48a-4e0c-afb8-8ddc4896c724?source=api-prod","affected":[{"type":"theme","slug":"mounthood","name":"Mounthood | Ski and Snowboarding HTML Template","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:33:49Z"},{"id":"wordfence:1defa728-9f9d-4e8f-8f6c-432c615da7f5","source":"wordfence","cve":"CVE-2026-7517","title":"Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1defa728-9f9d-4e8f-8f6c-432c615da7f5?source=api-prod","affected":[{"type":"plugin","slug":"custom-payment-gateways-woocommerce","name":"Custom Payment Gateways for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-06-30T15:45:01Z","updated":"2026-07-01T04:32:26Z"},{"id":"wordfence:1df04293-87e9-4ab4-975d-54d36a993ab0","source":"wordfence","cve":"CVE-2023-4636","title":"WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df04293-87e9-4ab4-975d-54d36a993ab0?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1df16802-c102-4ff2-b8ff-8a588905d3f7","source":"wordfence","cve":"CVE-2024-7786","title":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning <= 4.24.1 - Unauthenticated Email Template Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df16802-c102-4ff2-b8ff-8a588905d3f7?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.24.1","to_inclusive":true,"patched_in":"4.24.2"}],"published":"2024-08-14T00:00:00Z","updated":"2024-09-12T15:18:37Z"},{"id":"wordfence:1df1e56e-7a1f-4e89-8df2-bda9dc1ec1dc","source":"wordfence","cve":"CVE-2023-0097","title":"Post Grid, Post Carousel, & List Category Posts <= 2.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df1e56e-7a1f-4e89-8df2-bda9dc1ec1dc?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1df31843-0af7-486c-b0aa-4eaf72a7e70f","source":"wordfence","cve":"CVE-2023-5525","title":"Limit Login Attempts Reloaded <= 2.25.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df31843-0af7-486c-b0aa-4eaf72a7e70f?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"2.25.25","to_inclusive":true,"patched_in":"2.25.26"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1df421ac-c8fc-4505-989e-1d822ca6de7a","source":"wordfence","cve":"CVE-2024-27189","title":"WP Social Widget <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df421ac-c8fc-4505-989e-1d822ca6de7a?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-widget","name":"WP Social Widget","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-28T19:31:04Z"},{"id":"wordfence:1df6d436-c183-4ace-bd6c-1f22fbe7240f","source":"wordfence","cve":"CVE-2020-22277","title":"Import and export users and customers <= 1.16.3.5 - CSV injection via a customer's profile","severity":"high","cvss":7.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df6d436-c183-4ace-bd6c-1f22fbe7240f?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.16.3.5","to_inclusive":true,"patched_in":"1.16.3.6"}],"published":"2020-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1df74d3d-b7c9-4cf8-b1a7-d2b0b4f706d2","source":"wordfence","cve":"CVE-2021-24460","title":"Popup Like box \u2013 Page Plugin < 3.5.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df74d3d-b7c9-4cf8-b1a7-d2b0b4f706d2?source=api-prod","affected":[{"type":"plugin","slug":"ays-facebook-popup-likebox","name":"Popup Like box \u2013 Page Plugin","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1df84722-8036-4c9c-b9f7-b49852fad4cd","source":"wordfence","cve":"CVE-2025-25129","title":"Callback Request <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1df84722-8036-4c9c-b9f7-b49852fad4cd?source=api-prod","affected":[{"type":"plugin","slug":"callback-request","name":"Callback Request","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:09:07Z"},{"id":"wordfence:1dfb0ffa-79a9-4866-a66d-3c359bf0c6ad","source":"wordfence","cve":"CVE-2026-115673","title":"Anti-Spam by CleanTalk <= 6.90 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dfb0ffa-79a9-4866-a66d-3c359bf0c6ad?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.90","to_inclusive":true,"patched_in":"6.91"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:19:07Z"},{"id":"wordfence:1dfb9957-1326-474d-94bc-3472901c112b","source":"wordfence","cve":"CVE-2026-95865","title":"Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dfb9957-1326-474d-94bc-3472901c112b?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.11.0.5","to_inclusive":true,"patched_in":"2.11.0.6"}],"published":"2026-10-02T14:18:17Z","updated":"2026-10-03T02:25:35Z"},{"id":"wordfence:1dff665d-df42-4b67-bea2-4d6273714d8d","source":"wordfence","cve":"CVE-2025-54039","title":"Animator <= 3.0.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dff665d-df42-4b67-bea2-4d6273714d8d?source=api-prod","affected":[{"type":"plugin","slug":"scroll-triggered-animations","name":"Animator \u2013 Scroll Triggered Animations","from":"*","from_inclusive":true,"to":"3.0.16","to_inclusive":true,"patched_in":"3.0.17"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:21:33Z"},{"id":"wordfence:1dffbb2d-69d1-495c-8c96-64c5fd878fcd","source":"wordfence","cve":"CVE-2023-41666","title":"Stock Quotes List <= 2.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1dffbb2d-69d1-495c-8c96-64c5fd878fcd?source=api-prod","affected":[{"type":"plugin","slug":"stock-quotes-list","name":"Stock Quotes List","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2023-09-04T00:00:00Z","updated":"2024-03-07T18:01:19Z"},{"id":"wordfence:1e012c3c-b81a-4fb8-b72f-6d2898734535","source":"wordfence","cve":"CVE-2025-23657","title":"WordPress-to-candidate for Salesforce CRM <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e012c3c-b81a-4fb8-b72f-6d2898734535?source=api-prod","affected":[{"type":"plugin","slug":"salesforce-wordpress-to-candidate","name":"WordPress-to-candidate for Salesforce CRM","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:26:32Z"},{"id":"wordfence:1e030085-a323-4275-848a-3c6cbc587748","source":"wordfence","cve":"CVE-2026-57674","title":"Timetics \u2013 Appointment Booking Calendar & Scheduling System <= 1.0.58 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e030085-a323-4275-848a-3c6cbc587748?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.58","to_inclusive":true,"patched_in":"1.0.59"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:02:35Z"},{"id":"wordfence:1e0426e9-f6d8-40aa-9ceb-a3e5515ac316","source":"wordfence","cve":"CVE-2021-24394","title":"Easy Testimonial Manager <= 1.2.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0426e9-f6d8-40aa-9ceb-a3e5515ac316?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonial-manager","name":"Easy Testimonial Manager","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e07562d-ab3a-47bc-9bb1-b952f769f5e5","source":"wordfence","cve":"CVE-2022-1566","title":"Quotes llama <= 0.7 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e07562d-ab3a-47bc-9bb1-b952f769f5e5?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e07593a-3d12-4afe-a21e-fc85bd6d4bef","source":"wordfence","cve":"CVE-2024-30550","title":"Responsive Image Gallery, Gallery Album <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e07593a-3d12-4afe-a21e-fc85bd6d4bef?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:33:06Z"},{"id":"wordfence:1e07e570-e4c0-472c-b582-40a87a6507bf","source":"wordfence","cve":"CVE-2024-30454","title":"WP SMS <= 6.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e07e570-e4c0-472c-b582-40a87a6507bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":true,"patched_in":"6.6.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:04:53Z"},{"id":"wordfence:1e08ab05-748a-440f-b4ce-b58554cbc9e4","source":"wordfence","cve":"CVE-2025-47509","title":"Top 10 <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e08ab05-748a-440f-b4ce-b58554cbc9e4?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:32:20Z"},{"id":"wordfence:1e0c77a6-08fd-4d54-8ecd-6e5fe0e03e14","source":"wordfence","cve":"CVE-2023-2744","title":"WP ERP <= 1.12.3 - Authenticated (Administrator+) SQL Injection via 'type'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0c77a6-08fd-4d54-8ecd-6e5fe0e03e14?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":false,"patched_in":"1.12.4"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e0cf512-f676-4f47-abaa-5198998376b7","source":"wordfence","cve":"CVE-2025-13387","title":"Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0cf512-f676-4f47-abaa-5198998376b7?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":true,"patched_in":"1.5.18"}],"published":"2025-12-01T16:23:27Z","updated":"2025-12-02T04:37:14Z"},{"id":"wordfence:1e0f35be-fbd1-4063-a1c8-a8e4398d8f0a","source":"wordfence","cve":"CVE-2025-2577","title":"Bitspecter Suite <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0f35be-fbd1-4063-a1c8-a8e4398d8f0a?source=api-prod","affected":[{"type":"plugin","slug":"bitspecter-suite","name":"Bitspecter Suite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-03-21T22:14:30Z","updated":"2025-03-22T11:18:41Z"},{"id":"wordfence:1e0f7686-1c8c-49d6-9d0b-3c8df6c24d0d","source":"wordfence","cve":"CVE-2024-13547","title":"aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0f7686-1c8c-49d6-9d0b-3c8df6c24d0d?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:12Z"},{"id":"wordfence:1e0fd85a-2164-4b83-822e-845662591a78","source":"wordfence","cve":"CVE-2023-45604","title":"Get Custom Field Values <= 4.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e0fd85a-2164-4b83-822e-845662591a78?source=api-prod","affected":[{"type":"plugin","slug":"get-custom-field-values","name":"Get Custom Field Values","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e12494c-e777-4ee1-be70-7469141f968f","source":"wordfence","cve":"CVE-2025-23572","title":"UpDownUpDown <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e12494c-e777-4ee1-be70-7469141f968f?source=api-prod","affected":[{"type":"plugin","slug":"updownupdown-postcomment-voting","name":"UpDownUpDown","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:47:50Z"},{"id":"wordfence:1e177e54-1a17-49d3-85b5-e4c6bf154320","source":"wordfence","cve":"CVE-2024-22027","title":"Quiz Maker <= 6.5.0.5 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e177e54-1a17-49d3-85b5-e4c6bf154320?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.0.5","to_inclusive":true,"patched_in":"6.5.0.6"}],"published":"2024-01-12T00:00:00Z","updated":"2024-02-06T14:40:16Z"},{"id":"wordfence:1e18c00b-fd26-4ac3-adf8-fd52d139e33f","source":"wordfence","cve":"CVE-2026-49111","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e18c00b-fd26-4ac3-adf8-fd52d139e33f?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:52:09Z"},{"id":"wordfence:1e193bb9-bb16-4a77-877b-fa0ab29a6c74","source":"wordfence","cve":"CVE-2026-10736","title":"Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e193bb9-bb16-4a77-877b-fa0ab29a6c74?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.9.12"}],"published":"2026-06-17T17:23:24Z","updated":"2026-06-18T05:34:28Z"},{"id":"wordfence:1e19ef28-5223-4ced-b9f2-3c5aa5d91264","source":"wordfence","cve":"CVE-2025-60171","title":"Conditional Cart Messages for WooCommerce &#8211; YourPlugins.com <= 1.2.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e19ef28-5223-4ced-b9f2-3c5aa5d91264?source=api-prod","affected":[{"type":"plugin","slug":"yourplugins-wc-conditional-cart-notices","name":"Conditional Cart Messages for WooCommerce \u2013 YourPlugins.com","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-09-26T00:00:00Z","updated":"2026-09-23T14:28:57Z"},{"id":"wordfence:1e1b06d0-f348-4a8b-8730-a87d8e2ba2a1","source":"wordfence","cve":"CVE-2024-11848","title":"NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1b06d0-f348-4a8b-8730-a87d8e2ba2a1?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.17.6"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T11:24:38Z"},{"id":"wordfence:1e1b4c96-8fe5-4e89-afb5-5e5de97bba52","source":"wordfence","cve":"CVE-2025-26566","title":"In Stock Mailer for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1b4c96-8fe5-4e89-afb5-5e5de97bba52?source=api-prod","affected":[{"type":"plugin","slug":"in-stock-mailer-for-woocommerce","name":"In Stock Mailer for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:15:09Z"},{"id":"wordfence:1e1badce-2245-4680-9f59-d67fae468ba0","source":"wordfence","cve":"CVE-2026-22486","title":"Re Gallery \u2013 Responsive Photo Gallery <= 1.18.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1badce-2245-4680-9f59-d67fae468ba0?source=api-prod","affected":[{"type":"plugin","slug":"regallery","name":"Photo Gallery by Re Gallery: Responsive Image Gallery with AI SEO","from":"*","from_inclusive":true,"to":"1.18.9","to_inclusive":true,"patched_in":"1.18.10"}],"published":"2026-01-07T00:00:00Z","updated":"2026-04-15T13:33:48Z"},{"id":"wordfence:1e1bf208-c188-4dfb-85ff-bf395ed2cbec","source":"wordfence","cve":"CVE-2025-26923","title":"Event post <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1bf208-c188-4dfb-85ff-bf395ed2cbec?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"5.9.9"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:07:38Z"},{"id":"wordfence:1e1d008d-28a4-4827-8d25-158307382394","source":"wordfence","cve":"CVE-2024-56204","title":"Sinking Dropdowns <= 1.25 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1d008d-28a4-4827-8d25-158307382394?source=api-prod","affected":[{"type":"plugin","slug":"sinking-dropdowns","name":"Sinking Dropdowns WordPress","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:27:00Z"},{"id":"wordfence:1e1d2883-59d4-49c8-9a02-cf61c78df7a7","source":"wordfence","cve":"CVE-2025-23989","title":"Internal Link Builder <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1d2883-59d4-49c8-9a02-cf61c78df7a7?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-builder","name":"Internal Link Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:31:31Z"},{"id":"wordfence:1e1d8afa-0a38-434b-b3d8-04019010ab21","source":"wordfence","cve":"CVE-2022-25810","title":"Transposh WordPress Translation <= 1.0.9.1 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1d8afa-0a38-434b-b3d8-04019010ab21?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.1","to_inclusive":true,"patched_in":"1.0.9.2"}],"published":"2022-07-22T00:00:00Z","updated":"2025-07-21T13:46:56Z"},{"id":"wordfence:1e1db52a-3966-4e04-b0ed-08bda9ba1ff6","source":"wordfence","cve":"CVE-2023-52145","title":"Republish Old Posts <= 1.21 - Cross-Site Request Forgery via rop_options_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1db52a-3966-4e04-b0ed-08bda9ba1ff6?source=api-prod","affected":[{"type":"plugin","slug":"republish-old-posts","name":"Republish Old Posts","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.27"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e1e8486-22ed-4034-bdfc-6c9f0e2fbc95","source":"wordfence","cve":"CVE-2025-28904","title":"Web Directory Free <= 1.7.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1e8486-22ed-4034-bdfc-6c9f0e2fbc95?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:52:23Z"},{"id":"wordfence:1e223e0e-959f-498e-8c0e-daae36bd28cb","source":"wordfence","cve":"","title":"WP Easy Gallery <= 2.7 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e223e0e-959f-498e-8c0e-daae36bd28cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e2423b3-1246-4733-8443-69786d532b4a","source":"wordfence","cve":"CVE-2024-52446","title":"Buying Buddy IDX CRM <= 1.2.8 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2423b3-1246-4733-8443-69786d532b4a?source=api-prod","affected":[{"type":"plugin","slug":"buying-buddy-idx-crm","name":"Buying Buddy IDX CRM \u2013 Real Estate MLS Plugin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-11-18T00:00:00Z","updated":"2025-05-02T11:45:48Z"},{"id":"wordfence:1e257954-9e44-4939-8e01-efceb3c0953a","source":"wordfence","cve":"CVE-2024-2163","title":"Ninja Beaver Add-ons for Beaver Builder <= 2.4.5 -  Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e257954-9e44-4939-8e01-efceb3c0953a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-beaver-lite-addons-for-beaver-builder","name":"Ninja Beaver Add-ons for Beaver Builder","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T19:30:07Z","updated":"2024-07-02T13:29:57Z"},{"id":"wordfence:1e25a0df-c548-45d0-8672-c35fbc71e0c3","source":"wordfence","cve":"CVE-2022-2089","title":"Bold Page Builder <= 4.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e25a0df-c548-45d0-8672-c35fbc71e0c3?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e273170-9c37-4f34-ab46-097d3eac47df","source":"wordfence","cve":"CVE-2026-14845","title":"NewStatPress < 1.4.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e273170-9c37-4f34-ab46-097d3eac47df?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:07:51Z"},{"id":"wordfence:1e280530-74de-42d2-bffe-3db24f72636d","source":"wordfence","cve":"CVE-2025-24716","title":"Herd Effects <= 6.2.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e280530-74de-42d2-bffe-3db24f72636d?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:12:10Z"},{"id":"wordfence:1e2b9845-53d6-438d-87cc-8b6badae007d","source":"wordfence","cve":"CVE-2025-53215","title":"Yahoo! WebPlayer <=  2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2b9845-53d6-438d-87cc-8b6badae007d?source=api-prod","affected":[{"type":"plugin","slug":"yahoo-media-player","name":"Yahoo! WebPlayer","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:23:04Z"},{"id":"wordfence:1e2b99ac-62f4-4180-aabe-91a5c717ea71","source":"wordfence","cve":"CVE-2026-57334","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration <= 4.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2b99ac-62f4-4180-aabe-91a5c717ea71?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:10:53Z"},{"id":"wordfence:1e2c40ea-5d0a-4f1c-99e8-ef0b54bbd20a","source":"wordfence","cve":"CVE-2022-44742","title":"Community Events <= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2c40ea-5d0a-4f1c-99e8-ef0b54bbd20a?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e2c937c-1ff8-4bcc-913b-83bade37d754","source":"wordfence","cve":"CVE-2025-0661","title":"DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2c937c-1ff8-4bcc-913b-83bade37d754?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T06:58:04Z"},{"id":"wordfence:1e2dab05-97ce-4f53-8069-2577c5c25b16","source":"wordfence","cve":"CVE-2025-3470","title":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2dab05-97ce-4f53-8069-2577c5c25b16?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-04-14T11:33:59Z","updated":"2025-09-19T06:59:14Z"},{"id":"wordfence:1e3110ae-5e82-4176-bf9d-6c56b13f9c27","source":"wordfence","cve":"CVE-2024-31230","title":"ShortPixel Adaptive Images <= 3.8.2 - Missing Authorization in activate_ai_handler and deactivate_ai_handler","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3110ae-5e82-4176-bf9d-6c56b13f9c27?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-04-02T00:00:00Z","updated":"2024-04-06T17:09:18Z"},{"id":"wordfence:1e32c5e4-d83e-4d3a-9681-74dbde0ae66e","source":"wordfence","cve":"CVE-2026-84088","title":"Xpro Elementor Addons <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e32c5e4-d83e-4d3a-9681-74dbde0ae66e?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:52:56Z"},{"id":"wordfence:1e340264-7cc0-4598-972f-aaa1fda2096b","source":"wordfence","cve":"CVE-2022-29438","title":"Image Slider by NextCode <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e340264-7cc0-4598-972f-aaa1fda2096b?source=api-prod","affected":[{"type":"plugin","slug":"baslider","name":"Image Slider by NextCode \u2013 Photo & Video Slider","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e35b077-8bb4-49fb-bd79-d9086d9a26dc","source":"wordfence","cve":"CVE-2024-32584","title":"TeraWallet \u2013 Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.5.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35b077-8bb4-49fb-bd79-d9086d9a26dc?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-24T15:32:30Z"},{"id":"wordfence:1e35eb83-716e-4177-99ba-24a884725265","source":"wordfence","cve":"CVE-2025-13604","title":"Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.168","to_inclusive":true,"patched_in":"2.169"}],"published":"2025-12-08T16:28:49Z","updated":"2025-12-09T04:36:25Z"},{"id":"wordfence:1e37e54b-9c00-4d04-9c81-791242d45d6c","source":"wordfence","cve":"","title":"iDump iPhone to WordPress Photo Uploader <= 1.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e37e54b-9c00-4d04-9c81-791242d45d6c?source=api-prod","affected":[{"type":"plugin","slug":"i-dump-iphone-to-wordpress-photo-uploader","name":"Windows Desktop and iPhone Photo Uploader","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2015-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e38b830-21e6-4bbb-a867-979518125fa6","source":"wordfence","cve":"CVE-2024-52482","title":"Ortto <= 1.0.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e38b830-21e6-4bbb-a867-979518125fa6?source=api-prod","affected":[{"type":"plugin","slug":"autopilot","name":"Ortto","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:43:38Z"},{"id":"wordfence:1e3ba5cf-1c70-4b6e-ab76-0103dad44732","source":"wordfence","cve":"CVE-2026-22517","title":"GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3ba5cf-1c70-4b6e-ab76-0103dad44732?source=api-prod","affected":[{"type":"plugin","slug":"ga-for-wp","name":"TrueAna \u2013 True Analytics Dashboard","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-01-07T00:00:00Z","updated":"2026-08-14T15:16:33Z"},{"id":"wordfence:1e3d70f2-11c1-4e3e-a409-bd4571165d60","source":"wordfence","cve":"CVE-2025-68983","title":"Greenmart <= 4.2.11 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3d70f2-11c1-4e3e-a409-bd4571165d60?source=api-prod","affected":[{"type":"theme","slug":"greenmart","name":"GreenMart \u2013 Organic & Food WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-06T15:18:17Z"},{"id":"wordfence:1e3e628f-b5e7-40fd-9d34-4a3b23e1e0e7","source":"wordfence","cve":"CVE-2024-8480","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3e628f-b5e7-40fd-9d34-4a3b23e1e0e7?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2024-08-21T17:42:14Z","updated":"2024-09-06T03:30:40Z"},{"id":"wordfence:1e3ee917-6022-413c-a575-d4eb4e210700","source":"wordfence","cve":"CVE-2025-49055","title":"Lead Capturing Pages <= 2.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3ee917-6022-413c-a575-d4eb4e210700?source=api-prod","affected":[{"type":"plugin","slug":"wp-lead-capture","name":"WP Lead Capturing Pages","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:48:40Z"},{"id":"wordfence:1e3f3b97-f6f5-44c3-9caa-f8a387b819e6","source":"wordfence","cve":"CVE-2025-23693","title":"Secure CAPTCHA <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e3f3b97-f6f5-44c3-9caa-f8a387b819e6?source=api-prod","affected":[{"type":"plugin","slug":"secure-captcha","name":"Secure CAPTCHA","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:34:25Z"},{"id":"wordfence:1e41e776-f6d1-4d84-9b40-5613762b9e28","source":"wordfence","cve":"CVE-2026-27330","title":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e41e776-f6d1-4d84-9b40-5613762b9e28?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-for-woocommerce","name":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce","from":"*","from_inclusive":true,"to":"0.4.62","to_inclusive":true,"patched_in":"0.4.63"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:50:57Z"},{"id":"wordfence:1e47528d-993c-434c-a077-9c614e56f39f","source":"wordfence","cve":"CVE-2014-9394","title":"PWGRandom <= 1.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e47528d-993c-434c-a077-9c614e56f39f?source=api-prod","affected":[{"type":"plugin","slug":"pwgrandom","name":"PWGRandom","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e48639e-01bb-4980-be6f-bcea3dd16fc5","source":"wordfence","cve":"CVE-2022-36345","title":"Download Plugin <= 2.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e48639e-01bb-4980-be6f-bcea3dd16fc5?source=api-prod","affected":[{"type":"plugin","slug":"download-plugin","name":"Download Plugin","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e498dd0-0adc-425f-aae2-67c75c202f48","source":"wordfence","cve":"CVE-2024-54314","title":"Primary Addon for Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e498dd0-0adc-425f-aae2-67c75c202f48?source=api-prod","affected":[{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:53:14Z"},{"id":"wordfence:1e4c655c-9cdf-4106-9cf5-fc153de12d14","source":"wordfence","cve":"CVE-2022-4479","title":"Table of Contents Plus <= 2106 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4c655c-9cdf-4106-9cf5-fc153de12d14?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-plus","name":"Table of Contents Plus \u2013 Automatic Table of Contents for Posts & Pages","from":"*","from_inclusive":true,"to":"2106","to_inclusive":true,"patched_in":"2212"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e4d03f0-408c-47da-bae9-38614603f02b","source":"wordfence","cve":"","title":"SimpleDark <= 1.2.11 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4d03f0-408c-47da-bae9-38614603f02b?source=api-prod","affected":[{"type":"theme","slug":"simpledark","name":"SimpleDark","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2011-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e4e27e0-bbb0-498a-b425-9e9d60dfed0f","source":"wordfence","cve":"CVE-2025-12411","title":"Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":7.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e27e0-bbb0-498a-b425-9e9d60dfed0f?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-11-17T20:08:58Z","updated":"2026-02-25T15:57:31Z"},{"id":"wordfence:1e4e8960-b0c1-4dbb-ba97-e45b88fb06c0","source":"wordfence","cve":"CVE-2026-1673","title":"BEAR \u2013 Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4e8960-b0c1-4dbb-ba97-e45b88fb06c0?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-04-07T00:00:00Z","updated":"2026-07-23T23:27:39Z"},{"id":"wordfence:1e4f0d78-caa0-4575-a090-e1c12d4ed8fd","source":"wordfence","cve":"CVE-2024-34770","title":"Popup Maker \u2013 Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f0d78-caa0-4575-a090-e1c12d4ed8fd?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker-wp","name":"Popup Maker \u2013 Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-05-17T00:00:00Z","updated":"2024-09-09T20:29:04Z"},{"id":"wordfence:1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99","source":"wordfence","cve":"CVE-2026-109219","title":"Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"2.4.4","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-10-15T16:07:17Z","updated":"2026-10-23T18:29:28Z"},{"id":"wordfence:1e4f9ce4-93ea-4a42-9eea-cb57e40a3e8c","source":"wordfence","cve":"CVE-2024-51709","title":"TeleAdmin <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f9ce4-93ea-4a42-9eea-cb57e40a3e8c?source=api-prod","affected":[{"type":"plugin","slug":"teleadmin","name":"TeleAdmin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:57:50Z"},{"id":"wordfence:1e4fdc0f-585a-488e-8df9-9bbd1dca824f","source":"wordfence","cve":"CVE-2026-19220","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4fdc0f-585a-488e-8df9-9bbd1dca824f?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.1","to_inclusive":false,"patched_in":"1.57.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:55:06Z"},{"id":"wordfence:1e518d40-deda-438a-9787-b3cf7faad7a4","source":"wordfence","cve":"CVE-2022-1273","title":"Import WP \u2013 Import and Export WordPress data to XML or CSV files <= 2.4.5 - Authenticated Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e518d40-deda-438a-9787-b3cf7faad7a4?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e5381fe-940b-404e-b2f2-1fd1c4ee5d78","source":"wordfence","cve":"CVE-2022-45076","title":"Flexible Elementor Panel <= 2.3.8 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5381fe-940b-404e-b2f2-1fd1c4ee5d78?source=api-prod","affected":[{"type":"plugin","slug":"flexible-elementor-panel","name":"Flexible Editor Panel for Elementor","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e567aec-07e5-494a-936d-93b40d3e3043","source":"wordfence","cve":"CVE-2023-1929","title":"WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e567aec-07e5-494a-936d-93b40d3e3043?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e5a9cf2-2f1a-418c-99db-0c96077710eb","source":"wordfence","cve":"CVE-2026-39592","title":"DEPART <= 1.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5a9cf2-2f1a-418c-99db-0c96077710eb?source=api-prod","affected":[{"type":"plugin","slug":"depart-deposit-and-part-payment-for-woo","name":"DEPART \u2013 Deposit and Part payment for Woo","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-02-25T00:00:00Z","updated":"2026-05-07T13:59:54Z"},{"id":"wordfence:1e5cbe1f-0a16-4301-a83c-af9456afe44d","source":"wordfence","cve":"CVE-2024-22292","title":"WP To Do <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5cbe1f-0a16-4301-a83c-af9456afe44d?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-01-17T00:00:00Z","updated":"2024-02-14T14:45:22Z"},{"id":"wordfence:1e5e16c9-53d2-4fdd-8370-920b22f52033","source":"wordfence","cve":"","title":"WooCommerce <= 2.6.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5e16c9-53d2-4fdd-8370-920b22f52033?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e5e85b2-0caf-47ba-add3-3a33599c54c5","source":"wordfence","cve":"CVE-2025-27333","title":"Protected wp-login <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5e85b2-0caf-47ba-add3-3a33599c54c5?source=api-prod","affected":[{"type":"plugin","slug":"protected-wp-login","name":"Protected wp-login","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:38:11Z"},{"id":"wordfence:1e5fc079-32a0-472d-9ed2-8b5ddd0ddbc1","source":"wordfence","cve":"CVE-2026-96343","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5fc079-32a0-472d-9ed2-8b5ddd0ddbc1?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.9","to_inclusive":true,"patched_in":"1.17.10"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:47:43Z"},{"id":"wordfence:1e5fc3c7-f4cb-4e2a-acce-2258bb476abf","source":"wordfence","cve":"CVE-2024-52463","title":"Post By Email <= 1.0.4b - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e5fc3c7-f4cb-4e2a-acce-2258bb476abf?source=api-prod","affected":[{"type":"plugin","slug":"post-by-email","name":"Post By Email","from":"*","from_inclusive":true,"to":"1.0.4b","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T16:18:49Z"},{"id":"wordfence:1e61cc33-d58e-425e-9835-4d45461edbac","source":"wordfence","cve":"CVE-2025-39506","title":"Nasa Core <= 6.3.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e61cc33-d58e-425e-9835-4d45461edbac?source=api-prod","affected":[{"type":"plugin","slug":"nasa-core","name":"Nasa Core","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:18:35Z"},{"id":"wordfence:1e6327b0-a047-4f8c-8e95-88f2e4b7089f","source":"wordfence","cve":"CVE-2024-32802","title":"BP Better Messages <= 2.4.32 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e6327b0-a047-4f8c-8e95-88f2e4b7089f?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.4.32","to_inclusive":true,"patched_in":"2.4.33"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:57:26Z"},{"id":"wordfence:1e636fdd-6081-45f0-8e5d-71991ca7ed1a","source":"wordfence","cve":"CVE-2025-30538","title":"Simple Optimizer <= 1.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e636fdd-6081-45f0-8e5d-71991ca7ed1a?source=api-prod","affected":[{"type":"plugin","slug":"simple-optimizer","name":"Simple Optimizer","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:23:07Z"},{"id":"wordfence:1e65922a-3498-4946-8415-3d922e85e46a","source":"wordfence","cve":"CVE-2024-6330","title":"GEO my WordPress <= 4.5.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e65922a-3498-4946-8415-3d922e85e46a?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.0.1","to_inclusive":true,"patched_in":"4.5.0.2"}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-28T22:22:56Z"},{"id":"wordfence:1e661db1-73f2-4f22-9215-884219b7e65a","source":"wordfence","cve":"CVE-2026-40723","title":"Bricks Builder <= 2.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e661db1-73f2-4f22-9215-884219b7e65a?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-02-24T00:00:00Z","updated":"2026-09-18T15:02:08Z"},{"id":"wordfence:1e665e28-1940-4de2-8bbf-1e38585ede38","source":"wordfence","cve":"CVE-2025-31904","title":"Ebook Downloader <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e665e28-1940-4de2-8bbf-1e38585ede38?source=api-prod","affected":[{"type":"plugin","slug":"ebook-downloader","name":"Ebook Downloader","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:11:19Z"},{"id":"wordfence:1e6c1e98-72a2-4e74-bfd4-4054187d4d19","source":"wordfence","cve":"CVE-2022-0775","title":"WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e6c1e98-72a2-4e74-bfd4-4054187d4d19?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2022-02-22T00:00:00Z","updated":"2024-02-06T01:25:50Z"},{"id":"wordfence:1e716cf9-198c-4a32-883d-3f90dd399aee","source":"wordfence","cve":"CVE-2024-9503","title":"Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e716cf9-198c-4a32-883d-3f90dd399aee?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-coming-soon-redirect-animation","name":"Maintenance & Coming Soon Redirect Animation","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-12-19T18:09:03Z","updated":"2025-03-12T13:20:05Z"},{"id":"wordfence:1e72d5c7-c601-4775-a825-4786bbd1b5f0","source":"wordfence","cve":"CVE-2024-8761","title":"Share This Image <= 2.03 - Open Redirect via link Parameter","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e72d5c7-c601-4775-a825-4786bbd1b5f0?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.03","to_inclusive":true,"patched_in":"2.04"}],"published":"2024-09-16T19:55:52Z","updated":"2024-09-17T08:32:09Z"},{"id":"wordfence:1e72fd72-9771-442c-86d9-5dcc21df6c09","source":"wordfence","cve":"CVE-2026-65537","title":"Cyr to Lat Reloaded \u2013 Transliteration of Links and File Names <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e72fd72-9771-442c-86d9-5dcc21df6c09?source=api-prod","affected":[{"type":"plugin","slug":"cyr-and-lat","name":"Cyr to Lat Reloaded \u2013 Transliteration of Links and File Names","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:40:06Z"},{"id":"wordfence:1e74389d-7718-4259-b6ad-158d977c2c8b","source":"wordfence","cve":"CVE-2025-69087","title":"FreeAgent <= 2.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e74389d-7718-4259-b6ad-158d977c2c8b?source=api-prod","affected":[{"type":"theme","slug":"freeagent","name":"FreeAgent - Freelance Marketplace Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T14:38:45Z"},{"id":"wordfence:1e74b877-45dc-457c-b22c-a0629b305706","source":"wordfence","cve":"CVE-2025-28893","title":"Visual Text Editor <= 1.2.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e74b877-45dc-457c-b22c-a0629b305706?source=api-prod","affected":[{"type":"plugin","slug":"visual-text-editor","name":"Visual Text Editor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:49:39Z"},{"id":"wordfence:1e77760b-4e61-462c-9245-0e40f161d565","source":"wordfence","cve":"CVE-2022-44633","title":"YITH WooCommerce Gift Cards Premium <= 3.23.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e77760b-4e61-462c-9245-0e40f161d565?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-gift-cards-premium","name":"YITH WooCommerce Gift Cards Premium","from":"*","from_inclusive":true,"to":"3.23.1","to_inclusive":true,"patched_in":"3.24.0"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e7bc0b1-a4ba-42f6-b6c9-0dcf2f8975ad","source":"wordfence","cve":"CVE-2025-54748","title":"MapSVG < 8.6.12 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7bc0b1-a4ba-42f6-b6c9-0dcf2f8975ad?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.6.12","to_inclusive":false,"patched_in":"8.6.12"}],"published":"2025-07-31T00:00:00Z","updated":"2025-12-19T21:49:47Z"},{"id":"wordfence:1e7c1eab-78d7-48f8-810b-db6cea668d92","source":"wordfence","cve":"CVE-2022-47595","title":"WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7c1eab-78d7-48f8-810b-db6cea668d92?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.15","to_inclusive":true,"patched_in":"9.0.16"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e7efb39-fada-4167-825c-21cc31948a63","source":"wordfence","cve":"CVE-2025-11737","title":"VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7efb39-fada-4167-825c-21cc31948a63?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.112.3","to_inclusive":true,"patched_in":"9.112.4"}],"published":"2026-02-17T16:43:06Z","updated":"2026-05-12T14:38:32Z"},{"id":"wordfence:1e7f5355-b87b-4720-8998-c081d005827b","source":"wordfence","cve":"CVE-2025-8316","title":"Certifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7f5355-b87b-4720-8998-c081d005827b?source=api-prod","affected":[{"type":"plugin","slug":"certifica-wp","name":"Certifica WP","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:45:09Z","updated":"2025-09-11T07:24:50Z"},{"id":"wordfence:1e8060bc-900f-4f2d-a24e-13dc1d830fc1","source":"wordfence","cve":"","title":"Social Rocket <= 1.2.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8060bc-900f-4f2d-a24e-13dc1d830fc1?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2020-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e81208c-771f-409e-b665-b07def0ca774","source":"wordfence","cve":"CVE-2023-23641","title":"Uji Popup <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via uji_popup_code shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e81208c-771f-409e-b665-b07def0ca774?source=api-prod","affected":[{"type":"plugin","slug":"uji-popup","name":"Uji Popup","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e82c950-54dd-4bdf-9c7c-e880c934ddc9","source":"wordfence","cve":"CVE-2026-1071","title":"Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e82c950-54dd-4bdf-9c7c-e880c934ddc9?source=api-prod","affected":[{"type":"plugin","slug":"carta-online","name":"Carta Online","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2026-03-06T18:48:13Z","updated":"2026-07-10T16:24:38Z"},{"id":"wordfence:1e82f614-b6f0-4e78-a337-a286a33f91e6","source":"wordfence","cve":"CVE-2025-31606","title":"SP Blog Designer <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e82f614-b6f0-4e78-a337-a286a33f91e6?source=api-prod","affected":[{"type":"plugin","slug":"sp-blog-designer","name":"SP Blog Designer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:26:50Z"},{"id":"wordfence:1e84fbbf-05b0-497b-81d8-1b029d24cddd","source":"wordfence","cve":"CVE-2021-24248","title":"Business Directory Plugin <= 5.11 - Authenticated PHP4 Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e84fbbf-05b0-497b-81d8-1b029d24cddd?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2021-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e855031-eddd-45bc-9ed2-80cae03a45df","source":"wordfence","cve":"CVE-2022-4107","title":"SMSA Shipping for WooCommerce <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e855031-eddd-45bc-9ed2-80cae03a45df?source=api-prod","affected":[{"type":"plugin","slug":"smsa-shipping-for-woocommerce","name":"SMSA Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e8abfd1-6e16-4c86-b430-44cec21a5267","source":"wordfence","cve":"CVE-2022-4473","title":"Widget Shortcode <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8abfd1-6e16-4c86-b430-44cec21a5267?source=api-prod","affected":[{"type":"plugin","slug":"widget-shortcode","name":"Widget Shortcode","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e8c8000-1156-4763-880e-0a6e3e9a8116","source":"wordfence","cve":"CVE-2026-39547","title":"Getaway < 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8c8000-1156-4763-880e-0a6e3e9a8116?source=api-prod","affected":[{"type":"theme","slug":"getaway","name":"Getaway - Travel & Tourism WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:10:26Z"},{"id":"wordfence:1e8e0257-a745-495f-a103-c032b95209fc","source":"wordfence","cve":"CVE-2023-6846","title":"File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8e0257-a745-495f-a103-c032b95209fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:35:57Z"},{"id":"wordfence:1e8f0ef8-4916-4b62-a062-f169ba15448e","source":"wordfence","cve":"CVE-2026-14188","title":"Easy Appointments < 3.12.28 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8f0ef8-4916-4b62-a062-f169ba15448e?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.28","to_inclusive":false,"patched_in":"3.12.28"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-14T15:22:11Z"},{"id":"wordfence:1e8f71cc-3197-4cdb-9e3b-a544f689df2d","source":"wordfence","cve":"CVE-2024-52490","title":"Pathomation <= 2.5.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e8f71cc-3197-4cdb-9e3b-a544f689df2d?source=api-prod","affected":[{"type":"plugin","slug":"pathomation","name":"Pathomation","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T17:52:58Z"},{"id":"wordfence:1e91e58d-a7b8-4d86-8c2d-9baaccb3e953","source":"wordfence","cve":"CVE-2026-96768","title":"GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e91e58d-a7b8-4d86-8c2d-9baaccb3e953?source=api-prod","affected":[{"type":"plugin","slug":"gosmtp-pro","name":"GoSMTP Pro","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-10-15T20:34:23Z","updated":"2026-10-16T09:26:36Z"},{"id":"wordfence:1e93ce8c-5489-48e9-85a1-00ef897d0d74","source":"wordfence","cve":"CVE-2025-49293","title":"Crawlomatic Multisite Scraper Post Generator <= 2.6.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e93ce8c-5489-48e9-85a1-00ef897d0d74?source=api-prod","affected":[{"type":"plugin","slug":"crawlomatic-multipage-scraper-post-generator","name":"Crawlomatic Multipage Scraper Post Generator","from":"*","from_inclusive":true,"to":"2.6.8.2","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:33:12Z"},{"id":"wordfence:1e9458e4-570e-4871-84ac-380107037b1c","source":"wordfence","cve":"CVE-2022-47173","title":"Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms \u2013 Advanced Form Integration <= 1.62.0 - Authenticated (Admin+) Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9458e4-570e-4871-84ac-380107037b1c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.62.0","to_inclusive":true,"patched_in":"1.63.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e9506bd-10a6-40ab-8162-cf4fad9cb882","source":"wordfence","cve":"CVE-2021-24539","title":"Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 1.6.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9506bd-10a6-40ab-8162-cf4fad9cb882?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-wp","name":"Coming Soon, Under Construction & Maintenance Mode By Dazzler","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e9641e2-fe33-4e22-895e-7974b4da6866","source":"wordfence","cve":"CVE-2022-36791","title":"Torro Forms <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9641e2-fe33-4e22-895e-7974b4da6866?source=api-prod","affected":[{"type":"plugin","slug":"torro-forms","name":"Torro Forms","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2022-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e98b763-29b9-435d-a436-d4df64234b4d","source":"wordfence","cve":"CVE-2023-47849","title":"BlossomThemes Email Newsletter <= 2.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e98b763-29b9-435d-a436-d4df64234b4d?source=api-prod","affected":[{"type":"plugin","slug":"blossomthemes-email-newsletter","name":"BlossomThemes Email Newsletter","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e9957a4-4323-4290-9c56-b51de9f0cbe9","source":"wordfence","cve":"CVE-2026-96348","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 28.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9957a4-4323-4290-9c56-b51de9f0cbe9?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:52:09Z"},{"id":"wordfence:1e99c10d-6632-4520-9239-9b831becd103","source":"wordfence","cve":"CVE-2022-4391","title":"Vision Interactive <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e99c10d-6632-4520-9239-9b831becd103?source=api-prod","affected":[{"type":"plugin","slug":"vision","name":"Vision \u2013 Interactive Image Map with Hotspots Builder","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1e9a1484-2000-47fa-9890-fa02eddabcd9","source":"wordfence","cve":"CVE-2025-10579","title":"BackWPup 5 - 5.5.0 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9a1484-2000-47fa-9890-fa02eddabcd9?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"5","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2025-10-24T15:31:35Z","updated":"2025-10-29T13:53:30Z"},{"id":"wordfence:1e9b094a-29ba-4be3-9033-fd915fae1820","source":"wordfence","cve":"CVE-2026-9341","title":"Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9b094a-29ba-4be3-9033-fd915fae1820?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-07-13T00:00:00Z","updated":"2026-07-14T11:30:42Z"},{"id":"wordfence:1e9c10d2-7aa8-4b99-8cdb-81e8e464fa8a","source":"wordfence","cve":"CVE-2026-62079","title":"Qi Addons For Elementor <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9c10d2-7aa8-4b99-8cdb-81e8e464fa8a?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:40:42Z"},{"id":"wordfence:1e9fa1f8-5070-4e2f-a5ee-810eccf7ec4d","source":"wordfence","cve":"CVE-2026-24580","title":"Ecwid Shopping Cart <= 7.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9fa1f8-5070-4e2f-a5ee-810eccf7ec4d?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2026-01-19T00:00:00Z","updated":"2026-02-03T19:03:32Z"},{"id":"wordfence:1ea35f34-e721-48cd-8088-e1df646c72eb","source":"wordfence","cve":"CVE-2026-97249","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.9 - Unauthenticated Unauthorized Subscription Activation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ea35f34-e721-48cd-8088-e1df646c72eb?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T17:51:21Z"},{"id":"wordfence:1ea40b96-4693-4f98-8e6e-2ed8186cedd8","source":"wordfence","cve":"CVE-2023-4505","title":"Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passback","severity":"low","cvss":2.2,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ea40b96-4693-4f98-8e6e-2ed8186cedd8?source=api-prod","affected":[{"type":"plugin","slug":"ldap-ad-staff-employee-directory-search","name":"Staff/Employee Business Directory for Active Directory","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ea4b216-0b29-45eb-bd61-962f76265ba6","source":"wordfence","cve":"CVE-2023-0059","title":"Youzify <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ea4b216-0b29-45eb-bd61-962f76265ba6?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ead1a18-9429-472e-9e88-e792eaa23ae9","source":"wordfence","cve":"CVE-2022-4031","title":"Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification","severity":"low","cvss":3.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead1a18-9429-472e-9e88-e792eaa23ae9?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ead46fd-5744-4fbb-9efd-980f9216abbc","source":"wordfence","cve":"CVE-2024-0839","title":"FeedWordPress <= 2022.0222 - Insecure Direct Object Referece","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2022.0222","to_inclusive":true,"patched_in":"2024.0428"}],"published":"2024-03-04T00:00:00Z","updated":"2024-07-29T21:35:58Z"},{"id":"wordfence:1ead6a38-b495-47d2-8d40-1f17e64fd1ff","source":"wordfence","cve":"CVE-2014-3937","title":"Contextual Related Posts < 1.8.10.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead6a38-b495-47d2-8d40-1f17e64fd1ff?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"1.8.10.2","to_inclusive":false,"patched_in":"1.8.10.2"}],"published":"2014-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1eade2ed-9a75-4857-a2c5-a21e016e7029","source":"wordfence","cve":"CVE-2024-12601","title":"Calculated Fields Form <= 5.2.63 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eade2ed-9a75-4857-a2c5-a21e016e7029?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.2.63","to_inclusive":true,"patched_in":"5.2.64"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T11:10:21Z"},{"id":"wordfence:1eaee0f6-968c-4004-83e7-f79baf3ff88d","source":"wordfence","cve":"CVE-2025-4597","title":"Woo Slider Pro - Drag Drop Slider Builder For WooCommerce <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eaee0f6-968c-4004-83e7-f79baf3ff88d?source=api-prod","affected":[{"type":"plugin","slug":"woo-slider-pro-drag-drop-slider-builder-for-woocommerce","name":"Woo Slider Pro \u2013 Drag Drop Slider Builder For WooCommerce","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T21:41:13Z","updated":"2025-05-30T11:15:09Z"},{"id":"wordfence:1eb1622f-19fb-472e-871b-9a456f80f390","source":"wordfence","cve":"CVE-2025-13383","title":"Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb1622f-19fb-472e-871b-9a456f80f390?source=api-prod","affected":[{"type":"plugin","slug":"job-board","name":"Job Board by BestWebSoft","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-11-24T19:08:56Z","updated":"2025-12-03T15:50:16Z"},{"id":"wordfence:1eb25ef3-28ea-4f8f-932a-e90ca1914e8d","source":"wordfence","cve":"CVE-2023-51675","title":"Advanced Access Manager <= 6.9.18 - Authenticated (Author+) Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb25ef3-28ea-4f8f-932a-e90ca1914e8d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.9.18","to_inclusive":true,"patched_in":"6.9.19"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1eb76b3f-b7ac-4de2-a3fa-fbbebc81996c","source":"wordfence","cve":"CVE-2025-23895","title":"Add RSS <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb76b3f-b7ac-4de2-a3fa-fbbebc81996c?source=api-prod","affected":[{"type":"plugin","slug":"add-rss","name":"Add RSS","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:35:26Z"},{"id":"wordfence:1eb7e894-f4fc-4d0a-bb6b-e42334c15c55","source":"wordfence","cve":"CVE-2025-23449","title":"Simple shortcode buttons <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb7e894-f4fc-4d0a-bb6b-e42334c15c55?source=api-prod","affected":[{"type":"plugin","slug":"simple-shortcode-buttons","name":"Simple shortcode buttons","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:31:06Z"},{"id":"wordfence:1eb8ab26-35a6-4cac-a1c1-08a8b886e308","source":"wordfence","cve":"CVE-2026-113615","title":"GS JWT Authentication <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eb8ab26-35a6-4cac-a1c1-08a8b886e308?source=api-prod","affected":[{"type":"plugin","slug":"gs-jwt-auth-and-otp-varification","name":"GS JWT Authentication for WP REST API","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:15:28Z"},{"id":"wordfence:1eba0dbc-c3e3-4d63-92e3-75100e3b0c14","source":"wordfence","cve":"CVE-2025-57903","title":"WooCommerce Additional Fees On Checkout (Free) <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eba0dbc-c3e3-4d63-92e3-75100e3b0c14?source=api-prod","affected":[{"type":"plugin","slug":"woo-additional-fees-on-checkout-wordpress","name":"Additional Fees For WooCommerce Checkout","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T18:12:08Z"},{"id":"wordfence:1ebb5d2c-2357-49a0-ac39-045cc1d4c0b3","source":"wordfence","cve":"CVE-2025-49381","title":"ads.txt Guru Connect <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebb5d2c-2357-49a0-ac39-045cc1d4c0b3?source=api-prod","affected":[{"type":"plugin","slug":"adstxt-guru-connect","name":"ads.txt Guru Connect","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:43:47Z"},{"id":"wordfence:1ebb6ebe-3a66-4ad8-9bba-c09354810159","source":"wordfence","cve":"CVE-2021-25090","title":"GridKit Portfolio <= 2.0.0 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebb6ebe-3a66-4ad8-9bba-c09354810159?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-wp","name":"Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2022-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ebd0156-bae1-44a2-8c8a-e5bddd094653","source":"wordfence","cve":"CVE-2025-39374","title":"Best Posts Summary <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebd0156-bae1-44a2-8c8a-e5bddd094653?source=api-prod","affected":[{"type":"plugin","slug":"best-posts-summary","name":"Best Posts Summary","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T21:58:29Z"},{"id":"wordfence:1ebd14d2-b4a4-4935-a71b-b0167ce7e9eb","source":"wordfence","cve":"CVE-2026-108067","title":"FV Flowplayer Video Player < 7.5.56.7212 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebd14d2-b4a4-4935-a71b-b0167ce7e9eb?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7212","to_inclusive":false,"patched_in":"7.5.56.7212"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:36:50Z"},{"id":"wordfence:1ebe0767-db22-4995-bdf1-5ebb48f960e9","source":"wordfence","cve":"CVE-2025-14370","title":"Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebe0767-db22-4995-bdf1-5ebb48f960e9?source=api-prod","affected":[{"type":"plugin","slug":"quote-comments","name":"Quote Comments","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:35:28Z","updated":"2026-03-27T10:55:52Z"},{"id":"wordfence:1ebfb030-c9b7-477a-8fe3-78e97da6bea9","source":"wordfence","cve":"CVE-2026-18496","title":"Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ebfb030-c9b7-477a-8fe3-78e97da6bea9?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.4.3","to_inclusive":true,"patched_in":"11.5"}],"published":"2026-10-09T17:02:51Z","updated":"2026-10-10T05:30:56Z"},{"id":"wordfence:1ec0f7d1-a8d0-4dfd-96f5-aee0329bb8ca","source":"wordfence","cve":"CVE-2024-35715","title":"Bloglo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec0f7d1-a8d0-4dfd-96f5-aee0329bb8ca?source=api-prod","affected":[{"type":"theme","slug":"bloglo","name":"Bloglo","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T14:06:59Z"},{"id":"wordfence:1ec14b1e-6d1a-4451-9fce-ac064623d92f","source":"wordfence","cve":"CVE-2024-12402","title":"Themes Coder \u2013 Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec14b1e-6d1a-4451-9fce-ac064623d92f?source=api-prod","affected":[{"type":"plugin","slug":"tc-ecommerce","name":"TC Ecommerce \u2013 Create Android & iOS Apps for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-01-06T15:09:57Z","updated":"2025-07-24T19:03:58Z"},{"id":"wordfence:1ec186b0-72f0-4017-ad24-1c82247a23ec","source":"wordfence","cve":"CVE-2023-23877","title":"Pinterest RSS Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec186b0-72f0-4017-ad24-1c82247a23ec?source=api-prod","affected":[{"type":"plugin","slug":"pinterest-rss-widget","name":"Pinterest RSS Widget","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ec207cd-cae5-4950-bbc8-d28f108b4ae7","source":"wordfence","cve":"CVE-2024-0659","title":"Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec207cd-cae5-4950-bbc8-d28f108b4ae7?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2024-02-02T00:00:00Z","updated":"2024-07-29T21:35:58Z"},{"id":"wordfence:1ec3cc3e-c11b-43b6-9dd0-caa5ccfb90c8","source":"wordfence","cve":"CVE-2025-2257","title":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec3cc3e-c11b-43b6-9dd0-caa5ccfb90c8?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.16.10","to_inclusive":true,"patched_in":"1.17.0"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T08:21:51Z"},{"id":"wordfence:1ec45848-33b1-4088-ba06-9a12d291120e","source":"wordfence","cve":"","title":"Better WP Security <= 3.5.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec45848-33b1-4088-ba06-9a12d291120e?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ec4633a-0742-4646-accd-cc0b9e01302a","source":"wordfence","cve":"CVE-2024-13777","title":"ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec4633a-0742-4646-accd-cc0b9e01302a?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:11:58Z","updated":"2025-03-05T09:21:45Z"},{"id":"wordfence:1ec5edef-cd51-4321-91bb-d1bfce58cd45","source":"wordfence","cve":"CVE-2026-32586","title":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec5edef-cd51-4321-91bb-d1bfce58cd45?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.11.3","to_inclusive":false,"patched_in":"7.11.3"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:51:01Z"},{"id":"wordfence:1ec7d4f6-75fa-497b-a639-f7c365c7f195","source":"wordfence","cve":"CVE-2025-58876","title":"Aparat Video Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec7d4f6-75fa-497b-a639-f7c365c7f195?source=api-prod","affected":[{"type":"plugin","slug":"aparat-shortcode","name":"Aparat Video Shortcode","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:27:04Z"},{"id":"wordfence:1ec907bc-bd10-4dc5-be35-4f2aaf5ef444","source":"wordfence","cve":"CVE-2026-0800","title":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec907bc-bd10-4dc5-be35-4f2aaf5ef444?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20251210","to_inclusive":true,"patched_in":"20260110"}],"published":"2026-01-23T19:55:08Z","updated":"2026-01-24T08:26:34Z"},{"id":"wordfence:1ece669f-2e88-4c41-a566-5521424e9c69","source":"wordfence","cve":"CVE-2025-58626","title":"RumbleTalk Live Group Chat <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ece669f-2e88-4c41-a566-5521424e9c69?source=api-prod","affected":[{"type":"plugin","slug":"rumbletalk-chat-a-chat-with-themes","name":"RumbleTalk Group Chat  for Communities & Live Events","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T20:28:52Z"},{"id":"wordfence:1ecf2247-5861-4206-9329-f0389a35076b","source":"wordfence","cve":"CVE-2024-31110","title":"Contact Form 7 Newsletter <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ecf2247-5861-4206-9329-f0389a35076b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-newsletter","name":"Contact Form 7 Newsletter","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:24:43Z"},{"id":"wordfence:1ed075f2-778a-49f5-bd6e-439cd3f1cee6","source":"wordfence","cve":"CVE-2024-11455","title":"Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed075f2-778a-49f5-bd6e-439cd3f1cee6?source=api-prod","affected":[{"type":"plugin","slug":"include-mastodon-feed","name":"Include Mastodon Feed","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2024-11-20T13:44:45Z","updated":"2024-11-22T16:23:45Z"},{"id":"wordfence:1ed34888-ae77-4e48-9c2d-de3202fb2eb7","source":"wordfence","cve":"CVE-2026-66606","title":"SmartSMTP <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed34888-ae77-4e48-9c2d-de3202fb2eb7?source=api-prod","affected":[{"type":"plugin","slug":"smart-smtp","name":"SmartSMTP","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:08:11Z"},{"id":"wordfence:1ed6c1c2-8fbd-4bcb-854a-492d1060364b","source":"wordfence","cve":"CVE-2024-11107","title":"System Dashboard <= 2.8.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed6c1c2-8fbd-4bcb-854a-492d1060364b?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.14","to_inclusive":true,"patched_in":"2.8.15"}],"published":"2024-11-19T00:00:00Z","updated":"2024-12-12T18:20:07Z"},{"id":"wordfence:1ed98565-3f86-46c0-a696-13d678f2d523","source":"wordfence","cve":"","title":"Rank Math SEO <= 1.0.26 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ed98565-3f86-46c0-a696-13d678f2d523?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2019-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1edc84fd-8cb5-4899-9444-1b6ae3144917","source":"wordfence","cve":"CVE-2025-6238","title":"AI Engine 2.8.4 - Insecure OAuth Implementation","severity":"high","cvss":8.0,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1edc84fd-8cb5-4899-9444-1b6ae3144917?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"2.8.4","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-04T01:44:02Z"},{"id":"wordfence:1ede7a25-9bb2-408e-b7fb-e5bd4f594351","source":"wordfence","cve":"CVE-2023-4402","title":"Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ede7a25-9bb2-408e-b7fb-e5bd4f594351?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks-pro","name":"Essential Blocks Pro","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ededa54-654f-48dc-87d5-7321e041e6fb","source":"wordfence","cve":"CVE-2024-30543","title":"Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ededa54-654f-48dc-87d5-7321e041e6fb?source=api-prod","affected":[{"type":"plugin","slug":"whizzy","name":"Whizzy","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:43:13Z"},{"id":"wordfence:1ee1a4de-25be-46fa-907e-1856862ae52e","source":"wordfence","cve":"CVE-2017-18508","title":"WP Live Chat Support <= 7.1.02 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee1a4de-25be-46fa-907e-1856862ae52e?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"7.1.02","to_inclusive":true,"patched_in":"7.1.03"}],"published":"2017-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ee41498-f5c6-48c3-a0db-55a1fe6e7f92","source":"wordfence","cve":"CVE-2024-8044","title":"infolinks Ad Wrap <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee41498-f5c6-48c3-a0db-55a1fe6e7f92?source=api-prod","affected":[{"type":"plugin","slug":"infolinks-ad-wrap","name":"infolinks Ad Wrap","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T21:53:30Z"},{"id":"wordfence:1ee47f62-93f5-40ed-8c1d-555a21eb714a","source":"wordfence","cve":"CVE-2021-24851","title":"Insert Pages <= 3.6.1 - Contributor+ Arbitrary Posts/Pages Access","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee47f62-93f5-40ed-8c1d-555a21eb714a?source=api-prod","affected":[{"type":"plugin","slug":"insert-pages","name":"Insert Pages","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ee5868f-7240-45ca-9f8a-b1489b2cc21c","source":"wordfence","cve":"CVE-2026-19222","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee5868f-7240-45ca-9f8a-b1489b2cc21c?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0.7","to_inclusive":false,"patched_in":"1.57.0.7"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:52:23Z"},{"id":"wordfence:1ee59a73-c449-462d-9ff0-b652be56b73b","source":"wordfence","cve":"CVE-2026-85653","title":"Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee59a73-c449-462d-9ff0-b652be56b73b?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-21T16:46:11Z","updated":"2026-09-22T05:30:43Z"},{"id":"wordfence:1ee7fe5f-0939-4604-99fb-2ddd06f30c88","source":"wordfence","cve":"CVE-2024-3590","title":"LetterPress \u2013 Elevate Your WordPress Site&#039;s E-Mail Campaigns and Marketing < 2.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee7fe5f-0939-4604-99fb-2ddd06f30c88?source=api-prod","affected":[{"type":"plugin","slug":"letterpress","name":"LetterPress \u2013 Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2024-04-18T00:00:00Z","updated":"2026-10-28T21:05:59Z"},{"id":"wordfence:1eedab61-e94b-4793-8bf6-cfadd94a5778","source":"wordfence","cve":"CVE-2025-12373","title":"Torod \u2013 The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eedab61-e94b-4793-8bf6-cfadd94a5778?source=api-prod","affected":[{"type":"plugin","slug":"torod","name":"Torod \u2013 WooCommerce Shipping for Saudi Arabia & GCC","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-12-04T17:32:53Z","updated":"2025-12-09T17:14:23Z"},{"id":"wordfence:1eeea385-734c-4403-8886-e3ad6dc47140","source":"wordfence","cve":"CVE-2022-2775","title":"Fast Flow <= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eeea385-734c-4403-8886-e3ad6dc47140?source=api-prod","affected":[{"type":"plugin","slug":"fast-flow-dashboard","name":"Fast Flow","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2022-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1eef338a-ccc7-41a2-b87a-0945e39380d2","source":"wordfence","cve":"CVE-2026-2506","title":"EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eef338a-ccc7-41a2-b87a-0945e39380d2?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator","name":"EM Cost Calculator","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:47:40Z","updated":"2026-02-26T01:24:13Z"},{"id":"wordfence:1ef02ecc-6a7b-4782-a891-a1d66d770c81","source":"wordfence","cve":"CVE-2023-45758","title":"Amministrazione Trasparente <= 8.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef02ecc-6a7b-4782-a891-a1d66d770c81?source=api-prod","affected":[{"type":"plugin","slug":"amministrazione-trasparente","name":"Amministrazione Trasparente","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":true,"patched_in":"8.0.5"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ef13f92-ae45-411a-b7b4-cdaf299afc8a","source":"wordfence","cve":"CVE-2024-54296","title":"CoSchool LMS <= 1.4- Missing Authorization to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef13f92-ae45-411a-b7b4-cdaf299afc8a?source=api-prod","affected":[{"type":"plugin","slug":"coschool","name":"CoSchool LMS \u2013 A complete Learning Management System to Create and Sell Your Courses Online","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-04-25T14:47:44Z"},{"id":"wordfence:1ef2a04a-de2c-4421-876a-aec5093f8970","source":"wordfence","cve":"CVE-2025-49925","title":"WPLMS <= 1.9.9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef2a04a-de2c-4421-876a-aec5093f8970?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.7","to_inclusive":true,"patched_in":"1.9.9.8"}],"published":"2025-09-14T00:00:00Z","updated":"2025-11-04T18:19:54Z"},{"id":"wordfence:1ef31d64-ff37-432d-ae4b-7ab451a44e06","source":"wordfence","cve":"CVE-2024-51626","title":"Woocommerce Quote Calculator <= 1.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef31d64-ff37-432d-ae4b-7ab451a44e06?source=api-prod","affected":[{"type":"plugin","slug":"woo-quote-calculator-order","name":"Woocommerce Quote Calculator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:41:17Z"},{"id":"wordfence:1ef51ffb-df1e-442d-abc8-3a0308099a0b","source":"wordfence","cve":"CVE-2025-14371","title":"TaxoPress <= 3.41.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef51ffb-df1e-442d-abc8-3a0308099a0b?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.41.0","to_inclusive":true,"patched_in":"3.42.0"}],"published":"2026-01-05T19:03:27Z","updated":"2026-02-13T19:11:12Z"},{"id":"wordfence:1ef82f14-f6e3-4e9a-9656-d2d15fbfefb8","source":"wordfence","cve":"CVE-2024-47341","title":"WP-DownloadManager <= 1.68.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef82f14-f6e3-4e9a-9656-d2d15fbfefb8?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.8","to_inclusive":true,"patched_in":"1.68.9"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:22:33Z"},{"id":"wordfence:1ef93096-ee09-4ea2-b299-3e173d731b8b","source":"wordfence","cve":"CVE-2025-22697","title":"Responsive Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ef93096-ee09-4ea2-b299-3e173d731b8b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:47:01Z"},{"id":"wordfence:1efb9215-542b-46a1-b358-f3d27339a920","source":"wordfence","cve":"CVE-2023-32598","title":"Featured Image Pro Post Grid <= 5.14 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1efb9215-542b-46a1-b358-f3d27339a920?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-pro","name":"Featured Image Pro Post Grid","from":"*","from_inclusive":true,"to":"5.14","to_inclusive":true,"patched_in":"5.15"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1eff0c32-8475-4efa-b412-32746d1ebbaf","source":"wordfence","cve":"CVE-2024-11607","title":"GTPayment Donations <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1eff0c32-8475-4efa-b412-32746d1ebbaf?source=api-prod","affected":[{"type":"plugin","slug":"gtpayment-donation","name":"GTPayment Donations","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-29T00:00:00Z","updated":"2025-01-17T13:56:38Z"},{"id":"wordfence:1f002228-f7a4-4a63-8a87-87969dedf5bf","source":"wordfence","cve":"CVE-2026-115963","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f002228-f7a4-4a63-8a87-87969dedf5bf?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.3.9","to_inclusive":true,"patched_in":"7.3.12"}],"published":"2026-10-27T10:17:20Z","updated":"2026-11-03T19:28:45Z"},{"id":"wordfence:1f04fa24-95e3-4480-858e-9101ecae05e3","source":"wordfence","cve":"CVE-2026-65533","title":"Smart SEO Tool \u2013 SEO\u4f18\u5316\u63d2\u4ef6 <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f04fa24-95e3-4480-858e-9101ecae05e3?source=api-prod","affected":[{"type":"plugin","slug":"smart-seo-tool","name":"Smart SEO Tool \u2013 SEO\u4f18\u5316\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:25:45Z"},{"id":"wordfence:1f06b855-c1e1-4378-a340-9dda2919fb83","source":"wordfence","cve":"CVE-2023-46208","title":"Motors \u2013 Car Dealer & Classified Ads <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f06b855-c1e1-4378-a340-9dda2919fb83?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2023-10-19T00:00:00Z","updated":"2024-05-23T15:46:42Z"},{"id":"wordfence:1f077e15-4974-405e-9e93-ecbef3883c06","source":"wordfence","cve":"CVE-2025-27308","title":"WP Video Posts <= 3.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f077e15-4974-405e-9e93-ecbef3883c06?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-posts","name":"WP Video Posts","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:42:09Z"},{"id":"wordfence:1f08dc7a-487f-460e-9a09-a3265990d0cd","source":"wordfence","cve":"CVE-2026-22432","title":"Woopy - Multipurpose Store WooCommerce WordPress Shop Theme <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f08dc7a-487f-460e-9a09-a3265990d0cd?source=api-prod","affected":[{"type":"theme","slug":"woopy","name":"Woopy - Multipurpose Store WooCommerce WordPress Shop Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:37:22Z"},{"id":"wordfence:1f092dae-e298-42e3-b494-fc7b7669b300","source":"wordfence","cve":"","title":"All In One WP Security & Firewall <= 4.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f092dae-e298-42e3-b494-fc7b7669b300?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f0a1439-d10c-4dfc-9a40-7319debe3c51","source":"wordfence","cve":"CVE-2026-120544","title":"Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a1439-d10c-4dfc-9a40-7319debe3c51?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-10-02T16:31:44Z","updated":"2026-11-03T04:43:07Z"},{"id":"wordfence:1f0a3c78-ba3e-445c-9612-94e80ef9d018","source":"wordfence","cve":"CVE-2024-43163","title":"ParcelPanel <= 4.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a3c78-ba3e-445c-9612-94e80ef9d018?source=api-prod","affected":[{"type":"plugin","slug":"parcelpanel","name":"CWILL (Formerly ParcelPanel) \u2013 Shipment Tracking, Tracking & Order Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:14:55Z"},{"id":"wordfence:1f0a4f00-d437-4138-92a2-c21e5c94eb1d","source":"wordfence","cve":"CVE-2025-69056","title":"Hotel Listing <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0a4f00-d437-4138-92a2-c21e5c94eb1d?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listings","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:51:19Z"},{"id":"wordfence:1f0b4db0-2ccd-47e8-8f40-82e97726f815","source":"wordfence","cve":"CVE-2026-107763","title":"Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0b4db0-2ccd-47e8-8f40-82e97726f815?source=api-prod","affected":[{"type":"plugin","slug":"fastcache-by-host-it","name":"Fastcache by Host.it","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-17T02:31:05Z"},{"id":"wordfence:1f0cc96c-8439-4e44-9e86-35d78ff53bc9","source":"wordfence","cve":"CVE-2025-60076","title":"Ray Enterprise Translation <= 1.7.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0cc96c-8439-4e44-9e86-35d78ff53bc9?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-08-30T00:00:00Z","updated":"2026-01-30T20:46:04Z"},{"id":"wordfence:1f12cdb6-df2d-419d-a29c-1ff7f9d098f4","source":"wordfence","cve":"CVE-2026-11898","title":"White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f12cdb6-df2d-419d-a29c-1ff7f9d098f4?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.7.13"}],"published":"2026-07-10T16:44:07Z","updated":"2026-07-11T05:35:45Z"},{"id":"wordfence:1f13a1c9-db26-4243-b8ee-f25eac51afa2","source":"wordfence","cve":"CVE-2022-3829","title":"Font Awesome 4 Menus <= 4.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f13a1c9-db26-4243-b8ee-f25eac51afa2?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome-4-menus","name":"Font Awesome 4 Menus","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f18147d-60e6-447d-a6f5-6ad7b633e62c","source":"wordfence","cve":"CVE-2023-51480","title":"Active Products Tables for WooCommerce <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f18147d-60e6-447d-a6f5-6ad7b633e62c?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.6.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f1b02cd-2e62-4f61-a0d4-6f4ea9c4b616","source":"wordfence","cve":"CVE-2025-60199","title":"InHype - Blog & Magazine WordPress <= 1.5.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f1b02cd-2e62-4f61-a0d4-6f4ea9c4b616?source=api-prod","affected":[{"type":"theme","slug":"inhype","name":"InHype - Blog & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2025-11-12T14:01:37Z"},{"id":"wordfence:1f1dcec6-1fcf-40e8-a15b-647b7161b6b5","source":"wordfence","cve":"CVE-2023-45638","title":"Eupago Gateway For Woocommerce <= 3.1.9 - Cross-Site Request Forgery via eupago_page_content","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f1dcec6-1fcf-40e8-a15b-647b7161b6b5?source=api-prod","affected":[{"type":"plugin","slug":"eupago-gateway-for-woocommerce","name":"Eupago Gateway For Woocommerce","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f1e2e91-cbc7-4cef-8bfc-ef09904df116","source":"wordfence","cve":"CVE-2025-23591","title":"blu Logistics <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f1e2e91-cbc7-4cef-8bfc-ef09904df116?source=api-prod","affected":[{"type":"plugin","slug":"blu-logistics","name":"blu Logistics","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:50:23Z"},{"id":"wordfence:1f1ff736-76e6-4e5d-a00e-68eef20265f2","source":"wordfence","cve":"CVE-2026-28007","title":"Coinpress <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f1ff736-76e6-4e5d-a00e-68eef20265f2?source=api-prod","affected":[{"type":"theme","slug":"coinpress","name":"Coinpress","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:40:50Z"},{"id":"wordfence:1f2135ab-ef76-4539-81ad-51abc4e051ce","source":"wordfence","cve":"CVE-2024-29798","title":"Gratisfaction <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2135ab-ef76-4539-81ad-51abc4e051ce?source=api-prod","affected":[{"type":"plugin","slug":"gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce","name":"Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T13:56:49Z"},{"id":"wordfence:1f21b4d7-3893-4838-8c0e-768c66746700","source":"wordfence","cve":"CVE-2026-27093","title":"Tripgo < 1.5.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f21b4d7-3893-4838-8c0e-768c66746700?source=api-prod","affected":[{"type":"theme","slug":"tripgo","name":"Tour Booking WordPress Theme - Tripgo","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2026-03-05T00:00:00Z","updated":"2026-04-15T13:40:32Z"},{"id":"wordfence:1f21f3b1-920b-415b-bd93-27eb2be5de19","source":"wordfence","cve":"CVE-2026-25029","title":"KIDZ <= 5.24 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f21f3b1-920b-415b-bd93-27eb2be5de19?source=api-prod","affected":[{"type":"theme","slug":"kidz","name":"KIDZ - Kids Store and Baby Shop Theme","from":"*","from_inclusive":true,"to":"5.24","to_inclusive":true,"patched_in":"5.25"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:01:04Z"},{"id":"wordfence:1f22cb85-2abc-43ab-9f83-c304d618c7d9","source":"wordfence","cve":"CVE-2024-50536","title":"GDReseller <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f22cb85-2abc-43ab-9f83-c304d618c7d9?source=api-prod","affected":[{"type":"plugin","slug":"gdreseller","name":"GDReseller","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:43:58Z"},{"id":"wordfence:1f25cabc-8886-4d30-af16-07d344db2fff","source":"wordfence","cve":"CVE-2015-5227","title":"WordPress Landing Pages <= 1.9.0 - Unauthenticated Remote Command Execution","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f25cabc-8886-4d30-af16-07d344db2fff?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":false,"patched_in":"1.9.2"}],"published":"2015-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f2845a5-7572-4533-8949-08bee99fca20","source":"wordfence","cve":"CVE-2007-0109","title":"WordPress < 2.0.6 -  Username Enumeration via Error Messages","severity":"medium","cvss":5.3,"cwe":"CWE-204","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2845a5-7572-4533-8949-08bee99fca20?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2007-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f286857-2fd3-4884-982f-47773f7af636","source":"wordfence","cve":"CVE-2015-2194","title":"Fusion <= 3.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f286857-2fd3-4884-982f-47773f7af636?source=api-prod","affected":[{"type":"theme","slug":"fusion-delisted","name":"Fusion","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2015-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f2b4030-92b1-4795-b72e-761632dd523d","source":"wordfence","cve":"CVE-2024-13718","title":"Flexible Wishlist for WooCommerce \u2013 Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2b4030-92b1-4795-b72e-761632dd523d?source=api-prod","affected":[{"type":"plugin","slug":"flexible-wishlist","name":"Flexible Wishlist for WooCommerce \u2013 Ecommerce Wishlist & Save for later","from":"*","from_inclusive":true,"to":"1.2.26","to_inclusive":true,"patched_in":"1.2.27"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T08:21:45Z"},{"id":"wordfence:1f2cfb14-1076-492f-8a1b-ae04b47dc6fa","source":"wordfence","cve":"CVE-2024-6845","title":"Chatbot with ChatGPT  <= 2.4.5 - Missing Authorization to Unauthenticated OpenAI API Key Exposure","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2cfb14-1076-492f-8a1b-ae04b47dc6fa?source=api-prod","affected":[{"type":"plugin","slug":"smartsearchwp","name":"AI Chatbot & Semantic Search: ChatGPT Answers From Your Content","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2024-09-04T00:00:00Z","updated":"2024-10-04T17:18:15Z"},{"id":"wordfence:1f2d149b-fe63-4fa3-b840-02dc8c5f9323","source":"wordfence","cve":"","title":"Food Store < 1.3.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2d149b-fe63-4fa3-b840-02dc8c5f9323?source=api-prod","affected":[{"type":"plugin","slug":"food-store","name":"Food Store \u2013 Online Food Delivery & Pickup","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f2f390b-332b-452c-9fe7-ccd1a45390dd","source":"wordfence","cve":"CVE-2024-13346","title":"Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2f390b-332b-452c-9fe7-ccd1a45390dd?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.13","to_inclusive":true,"patched_in":"7.11.14"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T06:58:04Z"},{"id":"wordfence:1f2fd69f-d432-4eb2-9d28-cfd7dd100e82","source":"wordfence","cve":"CVE-2026-107762","title":"Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2fd69f-d432-4eb2-9d28-cfd7dd100e82?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-10-16T14:25:22Z","updated":"2026-10-17T02:31:05Z"},{"id":"wordfence:1f30ffe6-1045-454c-9f68-98a8a5183e1a","source":"wordfence","cve":"CVE-2025-39508","title":"Nasa Core < 6.4.4. - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f30ffe6-1045-454c-9f68-98a8a5183e1a?source=api-prod","affected":[{"type":"plugin","slug":"nasa-core","name":"Nasa Core","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":false,"patched_in":"6.4.4"}],"published":"2025-06-12T00:00:00Z","updated":"2026-02-24T22:20:30Z"},{"id":"wordfence:1f32008c-4a41-4b3a-8701-e2d950fca1b5","source":"wordfence","cve":"CVE-2026-88845","title":"MasterStudy LMS <= 3.7.49 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f32008c-4a41-4b3a-8701-e2d950fca1b5?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:16:13Z"},{"id":"wordfence:1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214","source":"wordfence","cve":"CVE-2023-0693","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f33a8db-7cd0-4a53-b2c1-cd5b7cd16214?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f34302c-b08c-4542-9aa9-c66fe1f0288d","source":"wordfence","cve":"","title":"WP-CopyProtect [Protect your blog posts] <= 3.0.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f34302c-b08c-4542-9aa9-c66fe1f0288d?source=api-prod","affected":[{"type":"plugin","slug":"wp-copyprotect","name":"WP-CopyProtect [Protect your blog posts]","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2015-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f35d2c6-b631-40ba-b92a-972a891d4623","source":"wordfence","cve":"CVE-2026-13747","title":"Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35d2c6-b631-40ba-b92a-972a891d4623?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2026-10-30T15:46:36Z","updated":"2026-10-30T17:15:25Z"},{"id":"wordfence:1f35f646-1bd6-4785-bdc2-c815644b2b2d","source":"wordfence","cve":"CVE-2026-93882","title":"LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35f646-1bd6-4785-bdc2-c815644b2b2d?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2026-09-30T19:10:55Z","updated":"2026-10-01T07:40:23Z"},{"id":"wordfence:1f35fd20-a5ff-40e3-8af0-df3876c41ef8","source":"wordfence","cve":"CVE-2025-53250","title":"Chartbeat <= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35fd20-a5ff-40e3-8af0-df3876c41ef8?source=api-prod","affected":[{"type":"plugin","slug":"chartbeat","name":"Chartbeat","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:59:28Z"},{"id":"wordfence:1f36f0d8-4510-4d94-b8e5-5a3d98b0a8b4","source":"wordfence","cve":"CVE-2026-49106","title":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f36f0d8-4510-4d94-b8e5-5a3d98b0a8b4?source=api-prod","affected":[{"type":"plugin","slug":"cf7-constant-contact","name":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:46:00Z"},{"id":"wordfence:1f36ff03-b599-4f2c-859e-751ac51b652d","source":"wordfence","cve":"CVE-2017-18497","title":"WordPress Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms <= 3.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f36ff03-b599-4f2c-859e-751ac51b652d?source=api-prod","affected":[{"type":"plugin","slug":"liveforms","name":"Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":false,"patched_in":"3.4.0"}],"published":"2017-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f376368-3a1f-4c8a-b14d-142b20f5e57c","source":"wordfence","cve":"CVE-2025-30911","title":"RomethemeKit For Elementor <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f376368-3a1f-4c8a-b14d-142b20f5e57c?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:11:07Z"},{"id":"wordfence:1f378686-6479-424f-a321-b66fd7f78ca5","source":"wordfence","cve":"CVE-2025-25157","title":"WP Church Center <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f378686-6479-424f-a321-b66fd7f78ca5?source=api-prod","affected":[{"type":"plugin","slug":"wp-church-center","name":"WP Church Center","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:13:20Z"},{"id":"wordfence:1f37ed0e-3e03-4f00-9967-16047beab1cf","source":"wordfence","cve":"CVE-2023-49166","title":"MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f37ed0e-3e03-4f00-9967-16047beab1cf?source=api-prod","affected":[{"type":"plugin","slug":"msync","name":"MSync","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f38676b-270f-4b0f-bc98-a14a26b86a50","source":"wordfence","cve":"CVE-2024-7429","title":"Zotpress <= 7.3.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.12","to_inclusive":true,"patched_in":"7.3.13"}],"published":"2024-11-04T20:39:16Z","updated":"2024-11-05T09:30:58Z"},{"id":"wordfence:1f386d27-8aae-4f18-9311-3dd018ea1c85","source":"wordfence","cve":"CVE-2024-54315","title":"Events Addon for Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f386d27-8aae-4f18-9311-3dd018ea1c85?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:50:38Z"},{"id":"wordfence:1f38aca5-0d69-421e-a3f2-d12cd593a88a","source":"wordfence","cve":"","title":"Easy Social Icons <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38aca5-0d69-421e-a3f2-d12cd593a88a?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f39c2db-cf9a-4abf-bb43-f7e860b656d4","source":"wordfence","cve":"CVE-2024-37495","title":"Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f39c2db-cf9a-4abf-bb43-f7e860b656d4?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T20:44:58Z"},{"id":"wordfence:1f3ab230-f6e2-4150-a4af-178da8c244dd","source":"wordfence","cve":"CVE-2025-39353","title":"Grand Restaurant WordPress <= 7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f3ab230-f6e2-4150-a4af-178da8c244dd?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T19:42:10Z"},{"id":"wordfence:1f3b5d85-a8b0-43ac-b593-a61e20b9a4ca","source":"wordfence","cve":"CVE-2025-2580","title":"Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f3b5d85-a8b0-43ac-b593-a61e20b9a4ca?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.18.3","to_inclusive":true,"patched_in":"2.18.4"}],"published":"2025-04-24T16:58:42Z","updated":"2025-04-25T05:25:07Z"},{"id":"wordfence:1f402bc3-c63c-43ef-9fca-11bdd7c2b529","source":"wordfence","cve":"CVE-2025-68985","title":"Aora <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f402bc3-c63c-43ef-9fca-11bdd7c2b529?source=api-prod","affected":[{"type":"theme","slug":"aora","name":"Aora - Home & Lifestyle Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-05T19:01:49Z"},{"id":"wordfence:1f404b2f-536d-4549-b74b-90b8bbd0edae","source":"wordfence","cve":"CVE-2025-59577","title":"MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f404b2f-536d-4549-b74b-90b8bbd0edae?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":"3.6.21"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:07:57Z"},{"id":"wordfence:1f41101c-c54f-4e97-a0fb-79a17d5f0929","source":"wordfence","cve":"CVE-2025-11814","title":"Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f41101c-c54f-4e97-a0fb-79a17d5f0929?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.1","to_inclusive":false,"patched_in":"3.21.1"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-16T04:27:15Z"},{"id":"wordfence:1f413fc2-8543-4478-987d-d983581027bf","source":"wordfence","cve":"CVE-2023-6806","title":"Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f413fc2-8543-4478-987d-d983581027bf?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-02-06T00:00:00Z","updated":"2024-07-29T21:35:58Z"},{"id":"wordfence:1f42b3fc-cb2a-4e95-a55b-608ae64d8b58","source":"wordfence","cve":"CVE-2022-43468","title":"WordPress Popular Posts <= 6.0.5 - Unauthenticated Views Changes","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f42b3fc-cb2a-4e95-a55b-608ae64d8b58?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2022-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f439d60-0295-4ea8-b16d-9cdd0d866a8d","source":"wordfence","cve":"CVE-2026-17607","title":"WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f439d60-0295-4ea8-b16d-9cdd0d866a8d?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-09-17T18:52:03Z","updated":"2026-09-18T07:40:00Z"},{"id":"wordfence:1f463ed1-06ad-430f-b450-1a73dc54f8a7","source":"wordfence","cve":"CVE-2024-0382","title":"WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f463ed1-06ad-430f-b450-1a73dc54f8a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:35:58Z"},{"id":"wordfence:1f467dde-5b62-407e-bedb-9836630eaabe","source":"wordfence","cve":"CVE-2025-57918","title":"LinkedInclude <= 3.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f467dde-5b62-407e-bedb-9836630eaabe?source=api-prod","affected":[{"type":"plugin","slug":"linkedinclude","name":"LinkedInclude","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:21:39Z"},{"id":"wordfence:1f4b0be8-d2d7-4198-98a4-bb59561ff92e","source":"wordfence","cve":"CVE-2025-30914","title":"Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f4b0be8-d2d7-4198-98a4-bb59561ff92e?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:28:28Z"},{"id":"wordfence:1f4b45f6-8b6e-49f5-84e4-511431aef2c2","source":"wordfence","cve":"CVE-2025-69117","title":"Ingenioso <= 1.14.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f4b45f6-8b6e-49f5-84e4-511431aef2c2?source=api-prod","affected":[{"type":"theme","slug":"ingenioso","name":"Ingenioso","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:39:40Z"},{"id":"wordfence:1f4bd246-5632-4701-aa57-3855e73e6eb6","source":"wordfence","cve":"CVE-2021-36876","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f4bd246-5632-4701-aa57-3855e73e6eb6?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T04:29:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f4d0432-d0b7-47ed-80be-1f1296e59ca1","source":"wordfence","cve":"CVE-2026-119521","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f4d0432-d0b7-47ed-80be-1f1296e59ca1?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:40:14Z"},{"id":"wordfence:1f4f66fd-189a-4036-8e44-c401647bc655","source":"wordfence","cve":"CVE-2025-39499","title":"Medicare <= 2.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f4f66fd-189a-4036-8e44-c401647bc655?source=api-prod","affected":[{"type":"theme","slug":"medicare","name":"Medicare","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-05-20T00:00:00Z","updated":"2026-02-24T22:18:19Z"},{"id":"wordfence:1f528c89-2b8c-4750-b9eb-47ebd8c1630e","source":"wordfence","cve":"CVE-2025-8487","title":"Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f528c89-2b8c-4750-b9eb-47ebd8c1630e?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2025-09-18T14:48:40Z","updated":"2025-09-19T03:34:48Z"},{"id":"wordfence:1f533cf9-bec8-48a8-87e3-99117a9948f1","source":"wordfence","cve":"CVE-2026-65536","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u062d\u0645\u0644 \u0648 \u0646\u0642\u0644 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | \u067e\u0633\u062a \u067e\u06cc\u0634\u062a\u0627\u0632\u060c \u062a\u06cc\u067e\u0627\u06a9\u0633 \u0648 \u067e\u06cc\u06a9 \u0645\u0648\u062a\u0648\u0631\u06cc <= 4.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f533cf9-bec8-48a8-87e3-99117a9948f1?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-shipping","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u062d\u0645\u0644 \u0648 \u0646\u0642\u0644 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | \u067e\u0633\u062a \u067e\u06cc\u0634\u062a\u0627\u0632\u060c \u062a\u06cc\u067e\u0627\u06a9\u0633 \u0648 \u067e\u06cc\u06a9 \u0645\u0648\u062a\u0648\u0631\u06cc","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:25:18Z"},{"id":"wordfence:1f533dbd-4dd0-48ec-b083-e6284acab067","source":"wordfence","cve":"CVE-2022-4310","title":"Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f533dbd-4dd0-48ec-b083-e6284acab067?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f5390b1-c85b-4bf6-ab38-6ae0efe72ffa","source":"wordfence","cve":"CVE-2026-15735","title":"Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5390b1-c85b-4bf6-ab38-6ae0efe72ffa?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-28T13:28:53Z","updated":"2026-07-29T01:29:40Z"},{"id":"wordfence:1f545c20-5be1-42bc-9268-640590ee4bf2","source":"wordfence","cve":"CVE-2023-37391","title":"WordPress Mobile Pack <= 3.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f545c20-5be1-42bc-9268-640590ee4bf2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-mobile-pack","name":"WordPress Mobile Pack \u2013 Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f55296d-f459-4bd4-979e-5286cc489159","source":"wordfence","cve":"CVE-2026-104392","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f55296d-f459-4bd4-979e-5286cc489159?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.7","to_inclusive":true,"patched_in":"11.2.8"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:25:36Z"},{"id":"wordfence:1f589345-a081-4d27-ac4a-6edc44b96f91","source":"wordfence","cve":"CVE-2024-4858","title":"Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f589345-a081-4d27-ac4a-6edc44b96f91?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-carousel-elementor","name":"Testimonial Carousel For Elementor","from":"*","from_inclusive":true,"to":"10.2.0","to_inclusive":true,"patched_in":"10.2.1"}],"published":"2024-05-24T14:43:53Z","updated":"2024-05-25T02:57:33Z"},{"id":"wordfence:1f5b4f9a-4067-4514-9027-b645921d807f","source":"wordfence","cve":"CVE-2015-7669","title":"Easy2Map <= 1.2.9 - Directory Traversal and Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5b4f9a-4067-4514-9027-b645921d807f?source=api-prod","affected":[{"type":"plugin","slug":"easy2map","name":"Easy2Map","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2015-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15","source":"wordfence","cve":"CVE-2025-8666","title":"Testimonial Carousel For Elementor <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-carousel-elementor","name":"Testimonial Carousel For Elementor","from":"*","from_inclusive":true,"to":"11.6.2","to_inclusive":true,"patched_in":"11.7.0"}],"published":"2025-10-24T17:10:52Z","updated":"2025-10-25T05:31:19Z"},{"id":"wordfence:1f5c6cc0-5026-4903-a96a-db4ec3258ad2","source":"wordfence","cve":"CVE-2026-57652","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5c6cc0-5026-4903-a96a-db4ec3258ad2?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:24:15Z"},{"id":"wordfence:1f622e20-2f7e-44ed-8237-fbf25323d2ce","source":"wordfence","cve":"CVE-2023-26539","title":"Advanced Text Widget  <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f622e20-2f7e-44ed-8237-fbf25323d2ce?source=api-prod","affected":[{"type":"plugin","slug":"advanced-text-widget","name":"Advanced Text Widget","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f628801-8c11-4464-a440-879f97949bf6","source":"wordfence","cve":"CVE-2024-31925","title":"F4 Improvements <= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f628801-8c11-4464-a440-879f97949bf6?source=api-prod","affected":[{"type":"plugin","slug":"f4-improvements","name":"F4 Improvements","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:54:21Z"},{"id":"wordfence:1f63287f-cf9f-486c-b0fc-20302601e241","source":"wordfence","cve":"CVE-2025-26951","title":"C9 Blocks <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f63287f-cf9f-486c-b0fc-20302601e241?source=api-prod","affected":[{"type":"plugin","slug":"c9-blocks","name":"C9 Blocks","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:14:16Z"},{"id":"wordfence:1f645d0c-d641-4fff-a4f4-33c037de30e9","source":"wordfence","cve":"CVE-2026-15100","title":"Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f645d0c-d641-4fff-a4f4-33c037de30e9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.32","to_inclusive":true,"patched_in":"5.0.33"}],"published":"2026-07-23T14:31:26Z","updated":"2026-07-24T02:32:00Z"},{"id":"wordfence:1f66cdcf-cbe5-43e0-ad18-c2b9c4491ed4","source":"wordfence","cve":"CVE-2024-10582","title":"Music Player for Elementor \u2013 Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f66cdcf-cbe5-43e0-ad18-c2b9c4491ed4?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-elementor","name":"Music Player for Elementor \u2013 Audio Player & Podcast Player","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-11-14T16:40:38Z","updated":"2024-11-15T05:30:55Z"},{"id":"wordfence:1f6b4d46-dd5e-4dbf-b168-9423bef1c1fb","source":"wordfence","cve":"CVE-2026-27336","title":"Consultor | A Business Financial Advisor PSD Template <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b4d46-dd5e-4dbf-b168-9423bef1c1fb?source=api-prod","affected":[{"type":"theme","slug":"consultor","name":"Consultor | A Business Financial Advisor PSD Template","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:40:03Z"},{"id":"wordfence:1f6b73e0-c154-4bc4-90bc-0929053b77b0","source":"wordfence","cve":"CVE-2026-109516","title":"Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6b73e0-c154-4bc4-90bc-0929053b77b0?source=api-prod","affected":[{"type":"plugin","slug":"bot-for-telegram-on-woocommerce","name":"Bot for Telegram on WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:44:39Z","updated":"2026-10-29T03:39:13Z"},{"id":"wordfence:1f6dd110-b81f-4a99-8108-82911530b801","source":"wordfence","cve":"CVE-2025-62010","title":"Famita <= 1.54 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6dd110-b81f-4a99-8108-82911530b801?source=api-prod","affected":[{"type":"theme","slug":"famita","name":"Famita - Minimalist WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.54","to_inclusive":true,"patched_in":"1.55.1"}],"published":"2025-08-30T00:00:00Z","updated":"2025-11-12T14:02:44Z"},{"id":"wordfence:1f6e9583-ca67-469c-a665-590a2e7e2a6f","source":"wordfence","cve":"CVE-2025-60069","title":"MinimogWP <= 3.9.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f6e9583-ca67-469c-a665-590a2e7e2a6f?source=api-prod","affected":[{"type":"theme","slug":"minimog","name":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-02T00:00:00Z","updated":"2025-12-20T21:08:06Z"},{"id":"wordfence:1f714f97-5e1a-498a-9722-1e4bb883c5c7","source":"wordfence","cve":"","title":"Minimist <= 1.2.5  - Prototype Pollution","severity":"critical","cvss":9.8,"cwe":"CWE-915","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f714f97-5e1a-498a-9722-1e4bb883c5c7?source=api-prod","affected":[{"type":"plugin","slug":"convert-to-blocks","name":"Convert to Blocks","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"ad-refresh-control","name":"Ad Refresh Control","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f71b558-e8c0-441e-b437-a7f30ad13513","source":"wordfence","cve":"CVE-2026-92969","title":"HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f71b558-e8c0-441e-b437-a7f30ad13513?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-09-21T18:55:00Z","updated":"2026-09-22T07:41:10Z"},{"id":"wordfence:1f72a309-8ef8-4943-8e64-38bb7909397a","source":"wordfence","cve":"CVE-2025-2821","title":"Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f72a309-8ef8-4943-8e64-38bb7909397a?source=api-prod","affected":[{"type":"plugin","slug":"search-exclude","name":"Search Exclude","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-05-06T12:55:08Z","updated":"2025-05-07T01:57:47Z"},{"id":"wordfence:1f77efe6-34d9-4112-b7c1-6b4e1b307796","source":"wordfence","cve":"CVE-2026-97188","title":"String Locator <= 2.6.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f77efe6-34d9-4112-b7c1-6b4e1b307796?source=api-prod","affected":[{"type":"plugin","slug":"string-locator","name":"String locator","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:56:22Z"},{"id":"wordfence:1f784dfa-5c31-4c44-9230-7beac7f56893","source":"wordfence","cve":"CVE-2024-6432","title":"Content Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f784dfa-5c31-4c44-9230-7beac7f56893?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-02-19T21:17:14Z","updated":"2025-02-20T09:21:39Z"},{"id":"wordfence:1f7aa23c-ffa7-481b-8481-a36c7ed599d8","source":"wordfence","cve":"CVE-2025-14873","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7aa23c-ffa7-481b-8481-a36c7ed599d8?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-02-13T18:24:03Z","updated":"2026-02-14T06:42:28Z"},{"id":"wordfence:1f7e2323-42e9-4cc7-b3f4-d133e0073b7b","source":"wordfence","cve":"CVE-2022-3076","title":"CM Download Manager <= 2.8.5 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7e2323-42e9-4cc7-b3f4-d133e0073b7b?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f7e9eb5-e222-43fa-a14f-b9cbced6b8f5","source":"wordfence","cve":"CVE-2025-11378","title":"ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7e9eb5-e222-43fa-a14f-b9cbced6b8f5?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"6.3.5"}],"published":"2025-10-17T14:41:31Z","updated":"2025-10-18T03:33:23Z"},{"id":"wordfence:1f7f4308-6f6c-4eec-9ebc-9c7709c14662","source":"wordfence","cve":"CVE-2025-23525","title":"Kv Compose Email From Dashboard <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7f4308-6f6c-4eec-9ebc-9c7709c14662?source=api-prod","affected":[{"type":"plugin","slug":"kv-send-email-from-admin","name":"Kv Compose Email From Dashboard","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-19T17:04:05Z"},{"id":"wordfence:1f7f6713-a29d-429f-9882-3527da8d9b5b","source":"wordfence","cve":"CVE-2025-49452","title":"PostaPanduri <= 2.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7f6713-a29d-429f-9882-3527da8d9b5b?source=api-prod","affected":[{"type":"plugin","slug":"postapanduri","name":"PostaPanduri","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-06-12T00:00:00Z","updated":"2025-07-08T15:19:12Z"},{"id":"wordfence:1f80dc1b-2622-4cf5-9975-3609bfa21333","source":"wordfence","cve":"CVE-2026-96767","title":"NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f80dc1b-2622-4cf5-9975-3609bfa21333?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.3.2","to_inclusive":true,"patched_in":"9.3.3"}],"published":"2026-10-28T21:29:29Z","updated":"2026-10-29T11:27:14Z"},{"id":"wordfence:1f818aad-8d05-4665-a7dc-50bc56cbde5f","source":"wordfence","cve":"CVE-2024-11430","title":"SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f818aad-8d05-4665-a7dc-50bc56cbde5f?source=api-prod","affected":[{"type":"plugin","slug":"sql-chart-builder","name":"SQL Chart Builder","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2024-12-11T15:19:02Z","updated":"2025-11-05T19:02:52Z"},{"id":"wordfence:1f81d9f2-f7a1-4085-aa20-d991cecacd23","source":"wordfence","cve":"CVE-2021-24347","title":"SP Project & Document Manager <= 4.21 - Authenticated Shell Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f81d9f2-f7a1-4085-aa20-d991cecacd23?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.22","to_inclusive":false,"patched_in":"4.22"}],"published":"2021-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f82845c-55db-491a-90c1-326884abb5d6","source":"wordfence","cve":"CVE-2014-4574","title":"WebEngage Feedback, Survey and Notification < 2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f82845c-55db-491a-90c1-326884abb5d6?source=api-prod","affected":[{"type":"plugin","slug":"webengage","name":"WebEngage Feedback, Survey and Notification","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f839f14-f35a-4ed1-9827-1eb33fb82843","source":"wordfence","cve":"CVE-2026-41561","title":"Museder RestoreOne <= 2.7.277 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f839f14-f35a-4ed1-9827-1eb33fb82843?source=api-prod","affected":[{"type":"plugin","slug":"museder-restoreone","name":"Museder RestoreOne","from":"*","from_inclusive":true,"to":"2.7.277","to_inclusive":true,"patched_in":"2.7.278"}],"published":"2026-10-05T15:29:39Z","updated":"2026-11-03T22:46:48Z"},{"id":"wordfence:1f846ffa-0dfa-4549-845a-7884a390462a","source":"wordfence","cve":"CVE-2018-1000773","title":"WordPress Core < 5.0.1 - PHAR Unserialization","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f846ffa-0dfa-4549-845a-7884a390462a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f862575-afd8-4e38-8780-40e86ad9b5da","source":"wordfence","cve":"CVE-2021-24594","title":"Translate WordPress - Google Language Translator <= 6.0.11 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f862575-afd8-4e38-8780-40e86ad9b5da?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.12","to_inclusive":false,"patched_in":"6.0.12"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f862ed1-007b-48ac-bb39-be7648e0b48a","source":"wordfence","cve":"CVE-2026-27342","title":"TopFit - Fitness and Gym WordPress <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f862ed1-007b-48ac-bb39-be7648e0b48a?source=api-prod","affected":[{"type":"theme","slug":"topfit","name":"TopFit - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:33:10Z"},{"id":"wordfence:1f8634d1-9201-4af5-9e06-c28ffcb51046","source":"wordfence","cve":"CVE-2023-23888","title":"RankMath SEO <= 1.0.107.2 - Authenticated (Contributor+) Local File Inclusion","severity":"medium","cvss":6.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8634d1-9201-4af5-9e06-c28ffcb51046?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.107.2","to_inclusive":true,"patched_in":"1.0.107.3"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f87135a-4018-4985-bfff-4c59736af26d","source":"wordfence","cve":"CVE-2024-4149","title":"Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f87135a-4018-4985-bfff-4c59736af26d?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-05-23T00:00:00Z","updated":"2024-06-18T15:29:20Z"},{"id":"wordfence:1f87298b-8dae-4201-8f3b-477eaab3663d","source":"wordfence","cve":"CVE-2025-0898","title":"Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f87298b-8dae-4201-8f3b-477eaab3663d?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons-pro","name":"Xpro Elementor Addons - Pro","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-05-26T20:55:23Z","updated":"2026-05-27T09:27:32Z"},{"id":"wordfence:1f891b68-72c4-4f94-bd49-52576ad710f9","source":"wordfence","cve":"CVE-2025-10656","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation","severity":"critical","cvss":9.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f891b68-72c4-4f94-bd49-52576ad710f9?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T19:51:05Z","updated":"2026-07-29T15:15:24Z"},{"id":"wordfence:1f8a69ba-2663-4c54-8aef-4c5b0f851186","source":"wordfence","cve":"CVE-2023-23795","title":"Form Builder <= 1.9.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8a69ba-2663-4c54-8aef-4c5b0f851186?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-add","name":"Form Builder | Create Responsive Contact Forms","from":"*","from_inclusive":true,"to":"1.9.9.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f8cca7b-c674-4d07-9ec2-9c9b9ebb492f","source":"wordfence","cve":"CVE-2026-22473","title":"Dental Clinic <= 3.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8cca7b-c674-4d07-9ec2-9c9b9ebb492f?source=api-prod","affected":[{"type":"theme","slug":"dental","name":"Dental Clinic","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:45:07Z"},{"id":"wordfence:1f8f8378-676e-455a-aaad-b80c1a4dc717","source":"wordfence","cve":"CVE-2022-2040","title":"Brizy Page Builder <= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element URL","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8f8378-676e-455a-aaad-b80c1a4dc717?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f8fd161-4a26-4b02-abe8-f0b7eac22a48","source":"wordfence","cve":"CVE-2025-62943","title":"Next Page, Not Next Post <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f8fd161-4a26-4b02-abe8-f0b7eac22a48?source=api-prod","affected":[{"type":"plugin","slug":"next-page-not-next-post","name":"Next Page, Not Next Post","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:51:44Z"},{"id":"wordfence:1f90b93a-8f8f-4403-94dc-ae222622b96d","source":"wordfence","cve":"CVE-2025-52827","title":"Nuss <= 1.3.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f90b93a-8f8f-4403-94dc-ae222622b96d?source=api-prod","affected":[{"type":"theme","slug":"nuss","name":"Nuss - Hotel Booking WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:11:56Z"},{"id":"wordfence:1f9277d8-ac81-4950-a1e5-4e6c6b042f84","source":"wordfence","cve":"CVE-2024-11119","title":"BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9277d8-ac81-4950-a1e5-4e6c6b042f84?source=api-prod","affected":[{"type":"plugin","slug":"bne-gallery-extended","name":"BNE Gallery Extended","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-11-25T20:16:04Z","updated":"2024-11-26T08:31:56Z"},{"id":"wordfence:1f93ecf7-ba49-47f6-abe3-33e3bc6e7054","source":"wordfence","cve":"CVE-2015-7235","title":"CP Reservation Calendar < 1.1.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f93ecf7-ba49-47f6-abe3-33e3bc6e7054?source=api-prod","affected":[{"type":"plugin","slug":"cp-reservation-calendar","name":"CP Reservation Calendar","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"}],"published":"2015-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f955d88-ab4c-4cf4-a23b-91119d412716","source":"wordfence","cve":"CVE-2024-0842","title":"Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 -  Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f955d88-ab4c-4cf4-a23b-91119d412716?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-02-08T00:00:00Z","updated":"2024-07-29T21:35:58Z"},{"id":"wordfence:1f95bd2d-c835-4824-b241-f645b4a8fdb2","source":"wordfence","cve":"CVE-2015-6535","title":"YouTube Embed <= 3.3.2 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f95bd2d-c835-4824-b241-f645b4a8fdb2?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed","name":"Embeds for YouTube","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f96a0f3-8ebf-40b7-8498-157373e95b22","source":"wordfence","cve":"CVE-2025-63025","title":"Xagio SEO <= 7.1.0.37 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f96a0f3-8ebf-40b7-8498-157373e95b22?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.37","to_inclusive":true,"patched_in":"7.1.0.38"}],"published":"2025-12-04T00:00:00Z","updated":"2026-05-26T18:32:56Z"},{"id":"wordfence:1f9760f8-459d-4dcf-941d-f8f3f1e266ce","source":"wordfence","cve":"CVE-2008-0206","title":"Captcha! <= 2.5d - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9760f8-459d-4dcf-941d-f8f3f1e266ce?source=api-prod","affected":[{"type":"plugin","slug":"captcha-offrepo","name":"Captcha!","from":"*","from_inclusive":true,"to":"2.5d","to_inclusive":true,"patched_in":"2.6"}],"published":"2007-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f97d70f-213a-4417-8ef4-94688ed4fd80","source":"wordfence","cve":"CVE-2025-31587","title":"Elfsight Testimonials Slider <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f97d70f-213a-4417-8ef4-94688ed4fd80?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-testimonials-slider","name":"Elfsight Testimonials Slider","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:14:25Z"},{"id":"wordfence:1f99a653-0ba2-48bc-a5be-a7e9ee10b5bd","source":"wordfence","cve":"CVE-2025-31764","title":"Cache control by Cacholong <= 5.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f99a653-0ba2-48bc-a5be-a7e9ee10b5bd?source=api-prod","affected":[{"type":"plugin","slug":"cache-control-by-cacholong","name":"Cache control by Cacholong","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-06-23T17:33:23Z"},{"id":"wordfence:1f99b366-1a94-41ed-813a-bb13893604d0","source":"wordfence","cve":"CVE-2024-9849","title":"Real3D Flipbook Lite \u2013 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f99b366-1a94-41ed-813a-bb13893604d0?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2024-11-15T15:06:58Z","updated":"2024-11-19T16:37:00Z"},{"id":"wordfence:1f9b02c1-2cd7-48ee-b568-4c42bc0ded96","source":"wordfence","cve":"CVE-2021-33851","title":"Customize Login Image <= 3.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9b02c1-2cd7-48ee-b568-4c42bc0ded96?source=api-prod","affected":[{"type":"plugin","slug":"customize-login-image","name":"Customize Login Image","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2021-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f9bf735-a6ad-45c5-becd-efa8b44c9282","source":"wordfence","cve":"CVE-2024-12567","title":"Email Subscribers by Icegram Express \u2013 Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9bf735-a6ad-45c5-becd-efa8b44c9282?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.44","to_inclusive":true,"patched_in":"5.7.45"}],"published":"2024-12-23T00:00:00Z","updated":"2025-01-17T12:32:57Z"},{"id":"wordfence:1f9d4d86-9d5f-4888-9cc4-d55c117ae4ea","source":"wordfence","cve":"CVE-2024-3206","title":"Different Menu in Different Pages \u2013 Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9d4d86-9d5f-4888-9cc4-d55c117ae4ea?source=api-prod","affected":[{"type":"plugin","slug":"different-menus-in-different-pages","name":"Different Menu in Different Pages \u2013 Conditional Menu","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-21T16:31:46Z"},{"id":"wordfence:1f9d8bbe-205f-44b6-a0c6-89b9135e6363","source":"wordfence","cve":"","title":"Contest Gallery \u2013 Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9d8bbe-205f-44b6-a0c6-89b9135e6363?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"17.0.4","to_inclusive":true,"patched_in":"17.0.5"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1f9ead21-6846-4ab0-97e3-84e68b60b3a8","source":"wordfence","cve":"CVE-2026-84821","title":"WP Fast Total Search \u2013 The Power of Indexed Search <= 1.82.284 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9ead21-6846-4ab0-97e3-84e68b60b3a8?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.82.284","to_inclusive":true,"patched_in":"1.83.286"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:35:55Z"},{"id":"wordfence:1fa39169-1cba-43ce-aa29-adf7ce09ce75","source":"wordfence","cve":"CVE-2021-24321","title":"Bello - Directory & Listing <= 1.5.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa39169-1cba-43ce-aa29-adf7ce09ce75?source=api-prod","affected":[{"type":"theme","slug":"bello","name":"Bello - Directory & Listing","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2021-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fa45912-3d26-4284-8957-5977aaf36a03","source":"wordfence","cve":"CVE-2020-35942","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa45912-3d26-4284-8957-5977aaf36a03?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fa45fa7-b1da-42f0-945b-2a6b0db5ba91","source":"wordfence","cve":"CVE-2023-0522","title":"Enable/Disable Auto Login when Register <= 1.1.0 Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa45fa7-b1da-42f0-945b-2a6b0db5ba91?source=api-prod","affected":[{"type":"plugin","slug":"auto-login-when-resister","name":"Enable/Disable Auto Login when Register","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fa69450-cf44-42d2-80c8-a0fd6d669510","source":"wordfence","cve":"CVE-2025-68552","title":"WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa69450-cf44-42d2-80c8-a0fd6d669510?source=api-prod","affected":[{"type":"plugin","slug":"woo-coming-soon-product","name":"WooCommerce Coming Soon Product with Countdown","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-17T14:53:34Z"},{"id":"wordfence:1fa87357-09c0-4e99-8ceb-41a7987c4a57","source":"wordfence","cve":"CVE-2022-47431","title":"Open RDW kenteken voertuiginformatie <= 2.0.14 - Reflected Cross-Site Scripting via open_data_rdw_kenteken","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa87357-09c0-4e99-8ceb-41a7987c4a57?source=api-prod","affected":[{"type":"plugin","slug":"open-rdw-kenteken-voertuiginformatie","name":"Tussendoor \u2013 Open RDW","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fa8dba0-0227-428d-a6de-c4247c40e481","source":"wordfence","cve":"CVE-2024-13423","title":"Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa8dba0-0227-428d-a6de-c4247c40e481?source=api-prod","affected":[{"type":"theme","slug":"sparkling","name":"Sparkling","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2025-03-04T21:26:16Z","updated":"2025-04-10T15:11:49Z"},{"id":"wordfence:1fab5d06-ff39-4b7c-808b-bd199c2a3329","source":"wordfence","cve":"CVE-2020-28650","title":"WPBakery Page Builder for WordPress <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fab5d06-ff39-4b7c-808b-bd199c2a3329?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2020-10-07T00:00:00Z","updated":"2025-07-15T13:26:56Z"},{"id":"wordfence:1fabe52a-b51e-4383-ac88-8f30e083c9bb","source":"wordfence","cve":"CVE-2026-89101","title":"Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fabe52a-b51e-4383-ac88-8f30e083c9bb?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-11-05T22:19:09Z","updated":"2026-11-06T11:17:35Z"},{"id":"wordfence:1fb05281-205f-4d9c-aac9-2b37e069a6fb","source":"wordfence","cve":"CVE-2024-9504","title":"Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb05281-205f-4d9c-aac9-2b37e069a6fb?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T07:31:32Z"},{"id":"wordfence:1fb194ad-cbbb-4da7-9fd5-16dc429dfc83","source":"wordfence","cve":"CVE-2026-118187","title":"PublishPress Revisions <= 4.3.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb194ad-cbbb-4da7-9fd5-16dc429dfc83?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:21:26Z"},{"id":"wordfence:1fb84512-82c3-4def-a11b-ba0b7d64c41f","source":"wordfence","cve":"CVE-2025-22693","title":"Contest Gallery <= 25.1.0 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb84512-82c3-4def-a11b-ba0b7d64c41f?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"25.1.0","to_inclusive":true,"patched_in":"25.1.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:48:22Z"},{"id":"wordfence:1fb8b65f-150d-4dbf-8609-5ac72eb42ddc","source":"wordfence","cve":"CVE-2026-121612","title":"WPBruiser Security \u2013 No CAPTCHA Anti-Spam & Login Protection <= 3.6.2 - Authenticated (Subscriber+) Brute-Force Lockout Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb8b65f-150d-4dbf-8609-5ac72eb42ddc?source=api-prod","affected":[{"type":"plugin","slug":"goodbye-captcha","name":"WPBruiser Security \u2013 No CAPTCHA Anti-Spam & Login Protection","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:05:01Z"},{"id":"wordfence:1fb9cf14-e016-42b9-9a09-e762fcdbcee6","source":"wordfence","cve":"CVE-2026-62102","title":"Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb9cf14-e016-42b9-9a09-e762fcdbcee6?source=api-prod","affected":[{"type":"plugin","slug":"gatographql","name":"Gato GraphQL","from":"*","from_inclusive":true,"to":"19.2.3","to_inclusive":true,"patched_in":"19.2.4"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:07:45Z"},{"id":"wordfence:1fba5a76-1316-4ab6-9bf1-057bcae27e93","source":"wordfence","cve":"CVE-2026-85305","title":"SEOPress \u2013 AI SEO Plugin & On-site SEO <= 10.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fba5a76-1316-4ab6-9bf1-057bcae27e93?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":"10.2"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:25:56Z"},{"id":"wordfence:1fba61bd-d290-4fdf-8fac-a0158570a069","source":"wordfence","cve":"CVE-2025-63021","title":"Valenti Engine <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fba61bd-d290-4fdf-8fac-a0158570a069?source=api-prod","affected":[{"type":"plugin","slug":"valenti-engine","name":"Valenti Engine","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:28:02Z"},{"id":"wordfence:1fbd47c2-e1c0-4b72-a211-d143ffcc9d88","source":"wordfence","cve":"CVE-2025-23474","title":"Live Dashboard <= 0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fbd47c2-e1c0-4b72-a211-d143ffcc9d88?source=api-prod","affected":[{"type":"plugin","slug":"live-dashboard","name":"Live Dashboard","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:33:50Z"},{"id":"wordfence:1fc0f287-8f39-4580-b58e-c308a603ba32","source":"wordfence","cve":"CVE-2025-60151","title":"WP Gravity Forms HubSpot <= 1.2.5 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc0f287-8f39-4580-b58e-c308a603ba32?source=api-prod","affected":[{"type":"plugin","slug":"gf-hubspot","name":"WP Gravity Forms HubSpot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-30T15:02:12Z"},{"id":"wordfence:1fc179bb-cb08-4e85-887e-784016a58c26","source":"wordfence","cve":"CVE-2025-31089","title":"Order Splitter for WooCommerce <= 5.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc179bb-cb08-4e85-887e-784016a58c26?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-splitter","name":"Order Splitter for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T13:12:49Z"},{"id":"wordfence:1fc24fba-db71-46ba-9b92-0a084fdab5df","source":"wordfence","cve":"CVE-2026-100513","title":"CF7 Views \u2013 Complete Entry Management for Contact Form 7 <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc24fba-db71-46ba-9b92-0a084fdab5df?source=api-prod","affected":[{"type":"plugin","slug":"cf7-views","name":"CF7 Views \u2013 Complete Entry Management for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:30:03Z"},{"id":"wordfence:1fc3f65e-5fbe-403b-b7cd-dde16a7e5778","source":"wordfence","cve":"","title":"WordPress Core < 6.3.2 \u2013 Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc3f65e-5fbe-403b-b7cd-dde16a7e5778?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1.38","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"4.1.39"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fc447bc-841c-443f-9949-a0d852762fd9","source":"wordfence","cve":"CVE-2024-48045","title":"Happy Addons for Elementor <= 3.12.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc447bc-841c-443f-9949-a0d852762fd9?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.12.3","to_inclusive":true,"patched_in":"3.12.4"}],"published":"2024-10-13T00:00:00Z","updated":"2024-10-18T15:57:09Z"},{"id":"wordfence:1fc4eaec-b5d8-4707-9260-bac02a4b1866","source":"wordfence","cve":"CVE-2025-14075","title":"WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc4eaec-b5d8-4707-9260-bac02a4b1866?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2026-01-16T14:00:37Z","updated":"2026-01-17T02:22:30Z"},{"id":"wordfence:1fc58078-7520-4ee7-b5a1-d6a362ac1860","source":"wordfence","cve":"CVE-2023-27446","title":"DeepL Pro API translation <= 2.1.4 - Cross-Site Request Forgery via saveSettings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc58078-7520-4ee7-b5a1-d6a362ac1860?source=api-prod","affected":[{"type":"plugin","slug":"wpdeepl","name":"Translation with DeepL API","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fc5f0ac-3323-4e6c-8900-10e13294ff9a","source":"wordfence","cve":"CVE-2025-8781","title":"Bookster \u2013 WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc5f0ac-3323-4e6c-8900-10e13294ff9a?source=api-prod","affected":[{"type":"plugin","slug":"bookster","name":"Bookster \u2013 Appointment Booking Management System","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T12:28:34Z"},{"id":"wordfence:1fc67bb9-178e-466d-a6c2-adaa377924bd","source":"wordfence","cve":"CVE-2022-1573","title":"HTML2WP <= 1.0.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc67bb9-178e-466d-a6c2-adaa377924bd?source=api-prod","affected":[{"type":"plugin","slug":"html2wp","name":"HTML2WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fc860d4-fa26-489a-acd5-edbf7116d817","source":"wordfence","cve":"CVE-2024-22297","title":"CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fc860d4-fa26-489a-acd5-edbf7116d817?source=api-prod","affected":[{"type":"plugin","slug":"cbxgooglemap","name":"CBX Map for Google Map & OpenStreetMap","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-08T19:08:45Z"},{"id":"wordfence:1fcbe3d1-449c-4135-bbf5-9ea9236e5328","source":"wordfence","cve":"CVE-2020-36739","title":"Feed Them Social \u2013 Page, Post, Video, and Photo Galleries <= 2.8.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fcbe3d1-449c-4135-bbf5-9ea9236e5328?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":false,"patched_in":"2.8.7"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fcd3eec-057a-44f9-a255-e6814a22471b","source":"wordfence","cve":"CVE-2015-0920","title":"Banner Effect Header <= 1.2.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fcd3eec-057a-44f9-a255-e6814a22471b?source=api-prod","affected":[{"type":"plugin","slug":"banner-effect-header","name":"Banner Effect Header","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2015-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fcd44c2-5b06-4c3c-b6b2-c58771245fe2","source":"wordfence","cve":"CVE-2020-24147","title":"WordPress Importer : Import any XML File to WordPress < 1.0.1 - Server-Side Request Forgery","severity":"critical","cvss":9.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fcd44c2-5b06-4c3c-b6b2-c58771245fe2?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fce3120-1e50-464f-bfa9-a9260e47afa2","source":"wordfence","cve":"CVE-2025-58018","title":"Mail Subscribe List <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fce3120-1e50-464f-bfa9-a9260e47afa2?source=api-prod","affected":[{"type":"plugin","slug":"mail-subscribe-list","name":"Mail Subscribe List","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:29:54Z"},{"id":"wordfence:1fce54b1-e1e6-4742-9eb3-bbfb613ccd70","source":"wordfence","cve":"CVE-2024-1370","title":"Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fce54b1-e1e6-4742-9eb3-bbfb613ccd70?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-page","name":"Maintenance Page","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:26:36Z"},{"id":"wordfence:1fd0a887-db61-4b2d-af52-ec1d9c525663","source":"wordfence","cve":"CVE-2024-10510","title":"adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd0a887-db61-4b2d-af52-ec1d9c525663?source=api-prod","affected":[{"type":"plugin","slug":"adbuddy-adblocker-detection","name":"adBuddy+ (AdBlocker Detection) by NetfunkDesign","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-07T00:00:00Z","updated":"2024-12-12T19:12:17Z"},{"id":"wordfence:1fd0b13c-7447-45da-9608-80b7629d9bbf","source":"wordfence","cve":"CVE-2024-8760","title":"Stackable \u2013 Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd0b13c-7447-45da-9608-80b7629d9bbf?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.13.6","to_inclusive":true,"patched_in":"3.13.7"}],"published":"2024-10-11T20:24:52Z","updated":"2024-10-12T08:41:04Z"},{"id":"wordfence:1fd359f8-1622-4883-b161-d50056cf9c03","source":"wordfence","cve":"CVE-2026-22434","title":"Crown Art | Drawing and Music School WordPress Theme <= 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd359f8-1622-4883-b161-d50056cf9c03?source=api-prod","affected":[{"type":"theme","slug":"crown-art","name":"Crown Art | Drawing and Music School WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:36:56Z"},{"id":"wordfence:1fd45d76-d82b-46e6-b9fc-95d2d977fcd2","source":"wordfence","cve":"CVE-2025-22549","title":"WP Github <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd45d76-d82b-46e6-b9fc-95d2d977fcd2?source=api-prod","affected":[{"type":"plugin","slug":"wp-github","name":"WP Github","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:50:25Z"},{"id":"wordfence:1fd566e5-90f5-4f67-8998-85cabea33e93","source":"wordfence","cve":"CVE-2022-3209","title":"Soledad <= 8.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd566e5-90f5-4f67-8998-85cabea33e93?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.2.4","to_inclusive":true,"patched_in":"8.2.5"}],"published":"2022-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fd5c090-9a05-4487-aa7e-97dc091e7f18","source":"wordfence","cve":"CVE-2025-23726","title":"ComparePress <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd5c090-9a05-4487-aa7e-97dc091e7f18?source=api-prod","affected":[{"type":"plugin","slug":"comparepress","name":"ComparePress","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:29:47Z"},{"id":"wordfence:1fd5d806-916e-4ae6-a8a8-2b72a441a3fe","source":"wordfence","cve":"CVE-2025-32517","title":"MultiMailer <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd5d806-916e-4ae6-a8a8-2b72a441a3fe?source=api-prod","affected":[{"type":"plugin","slug":"scand-multi-mailer","name":"MultiMailer","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:35:47Z"},{"id":"wordfence:1fd62c3d-2c15-4d1c-9210-4c2aca379fe3","source":"wordfence","cve":"CVE-2026-2714","title":"Institute Management <= 5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd62c3d-2c15-4d1c-9210-4c2aca379fe3?source=api-prod","affected":[{"type":"plugin","slug":"institute-management","name":"Institute Management \u2013 Learning Management System","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T20:53:19Z","updated":"2026-04-22T07:45:32Z"},{"id":"wordfence:1fd84e08-abc2-4655-999c-6dcdaa7f372c","source":"wordfence","cve":"CVE-2025-58688","title":"Casengo Live Chat Support <= 2.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd84e08-abc2-4655-999c-6dcdaa7f372c?source=api-prod","affected":[{"type":"plugin","slug":"the-casengo-chat-widget","name":"Casengo Live Chat Support","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:53:13Z"},{"id":"wordfence:1fd9d526-8d3a-423c-99de-78bff95d24c5","source":"wordfence","cve":"CVE-2026-23806","title":"Job Postings <= 2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd9d526-8d3a-423c-99de-78bff95d24c5?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:56:07Z"},{"id":"wordfence:1fdb1314-5979-42bb-96dd-cc1648283c4e","source":"wordfence","cve":"CVE-2024-54228","title":"Wot Elementor Widgets <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdb1314-5979-42bb-96dd-cc1648283c4e?source=api-prod","affected":[{"type":"plugin","slug":"wot-elementor-widgets","name":"Wot Elementor Widgets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:43:11Z"},{"id":"wordfence:1fdbcfc7-1db6-4379-98fb-af2e1a7a7aaf","source":"wordfence","cve":"CVE-2026-57701","title":"Real Estate Manager Pro <= 12.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdbcfc7-1db6-4379-98fb-af2e1a7a7aaf?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager-pro","name":"Real Estate Manager Pro","from":"*","from_inclusive":true,"to":"12.8.5","to_inclusive":true,"patched_in":"12.8.6"}],"published":"2026-07-20T00:00:00Z","updated":"2026-07-27T15:57:46Z"},{"id":"wordfence:1fdbddd7-8713-48c8-98d6-0a155ca68325","source":"wordfence","cve":"CVE-2026-2382","title":"FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdbddd7-8713-48c8-98d6-0a155ca68325?source=api-prod","affected":[{"type":"plugin","slug":"fpw-category-thumbnails","name":"FPW Category Thumbnails","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:45:34Z","updated":"2026-10-25T05:34:50Z"},{"id":"wordfence:1fdc5c50-1d5b-4141-9524-f0e01c097a87","source":"wordfence","cve":"CVE-2026-109385","title":"UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdc5c50-1d5b-4141-9524-f0e01c097a87?source=api-prod","affected":[{"type":"plugin","slug":"uichemy","name":"UiChemy \u2013 Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-10-27T17:44:10Z","updated":"2026-10-28T06:45:07Z"},{"id":"wordfence:1fdc68b3-271c-43e1-a785-195f68d790f7","source":"wordfence","cve":"CVE-2025-22286","title":"LTL Freight Quotes \u2013 Worldwide Express Edition <= 5.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdc68b3-271c-43e1-a785-195f68d790f7?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-worldwide-express-edition","name":"LTL Freight Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.0.21","to_inclusive":true,"patched_in":"5.0.22"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-18T20:31:21Z"},{"id":"wordfence:1fdd0a4c-ce47-44bc-b9a5-a8f2af12da85","source":"wordfence","cve":"CVE-2023-33321","title":"EventPrime <= 2.8.6 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdd0a4c-ce47-44bc-b9a5-a8f2af12da85?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fdf895c-dd2a-4e2c-b323-a42226982cb7","source":"wordfence","cve":"CVE-2026-104023","title":"Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fdf895c-dd2a-4e2c-b323-a42226982cb7?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2026-10-09T17:27:27Z","updated":"2026-10-10T05:30:57Z"},{"id":"wordfence:1fe082a7-3d36-48b4-b81f-1e65e5ea430d","source":"wordfence","cve":"CVE-2024-11466","title":"Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe082a7-3d36-48b4-b81f-1e65e5ea430d?source=api-prod","affected":[{"type":"plugin","slug":"dp-intro-tours","name":"Intro Tour Tutorial DeepPresentation","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2024-12-03T00:00:00Z","updated":"2025-02-26T21:26:19Z"},{"id":"wordfence:1fe1582c-d48a-437e-93bd-6ae2e5aec3e3","source":"wordfence","cve":"CVE-2026-39539","title":"Alloggio - Hotel Booking WordPress Theme <= 2.1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe1582c-d48a-437e-93bd-6ae2e5aec3e3?source=api-prod","affected":[{"type":"theme","slug":"alloggio","name":"Alloggio - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:06:15Z"},{"id":"wordfence:1fe257e6-4bdf-49ef-adbb-f82ce378e3e7","source":"wordfence","cve":"CVE-2022-0421","title":"Five Star Restaurant Reservations <= 2.4.11 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe257e6-4bdf-49ef-adbb-f82ce378e3e7?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":"2.4.12"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fe2ea48-6764-4b1c-a811-423fac23f98a","source":"wordfence","cve":"CVE-2026-24581","title":"Points and Rewards for WooCommerce <= 2.9.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe2ea48-6764-4b1c-a811-423fac23f98a?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:40:25Z"},{"id":"wordfence:1fe363b2-8c70-45cd-9fdc-8979f894efd8","source":"wordfence","cve":"CVE-2026-5149","title":"RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe363b2-8c70-45cd-9fdc-8979f894efd8?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-06-15T17:15:45Z","updated":"2026-06-16T05:33:33Z"},{"id":"wordfence:1fe3e2bf-9fbd-4534-8389-8383cb2370a8","source":"wordfence","cve":"CVE-2026-25430","title":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe3e2bf-9fbd-4534-8389-8383cb2370a8?source=api-prod","affected":[{"type":"plugin","slug":"cf7-mailchimp","name":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:48:34Z"},{"id":"wordfence:1fe40943-d2b5-47e9-bc3b-712b5e161099","source":"wordfence","cve":"CVE-2024-43955","title":"Droip < 2.5.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe40943-d2b5-47e9-bc3b-712b5e161099?source=api-prod","affected":[{"type":"plugin","slug":"droip","name":"Droip","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2024-08-26T00:00:00Z","updated":"2026-05-11T21:17:23Z"},{"id":"wordfence:1fe73b99-f113-4514-ae13-e22f897608b2","source":"wordfence","cve":"CVE-2025-63030","title":"New User Approve <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe73b99-f113-4514-ae13-e22f897608b2?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-11-08T00:00:00Z","updated":"2026-02-26T15:23:26Z"},{"id":"wordfence:1fe86509-2667-4786-87b2-247d043ce995","source":"wordfence","cve":"CVE-2026-95603","title":"Reycob Product Import Export <= 2.3.0 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe86509-2667-4786-87b2-247d043ce995?source=api-prod","affected":[{"type":"plugin","slug":"reycob-product-import-export","name":"Reycob Product Import Export","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-09-23T12:01:44Z","updated":"2026-09-29T19:54:47Z"},{"id":"wordfence:1fe8e59b-435e-4370-bc47-568f0e1c7052","source":"wordfence","cve":"CVE-2026-84753","title":"Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe8e59b-435e-4370-bc47-568f0e1c7052?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:27:58Z"},{"id":"wordfence:1fe961c5-de2b-4494-9d89-6bcc7f6d8cd9","source":"wordfence","cve":"CVE-2022-44576","title":"AgentEasy Properties <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe961c5-de2b-4494-9d89-6bcc7f6d8cd9?source=api-prod","affected":[{"type":"plugin","slug":"agenteasy-properties","name":"AgentEasy Properties","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40","source":"wordfence","cve":"CVE-2024-5810","title":"WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials","severity":"medium","cvss":5.3,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=api-prod","affected":[{"type":"plugin","slug":"wp2speed","name":"WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T19:47:02Z","updated":"2024-07-09T08:33:03Z"},{"id":"wordfence:1fe9bc3d-058b-4c36-809b-007b95c33750","source":"wordfence","cve":"CVE-2026-104648","title":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce < 2.1.7 - Authenticated (Editor+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe9bc3d-058b-4c36-809b-007b95c33750?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T23:23:49Z"},{"id":"wordfence:1feb3fa0-5fd9-443a-830c-cb1700ff30df","source":"wordfence","cve":"CVE-2024-30533","title":"Layouts for Elementor <= 1.7 - Missing Authorization to Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1feb3fa0-5fd9-443a-830c-cb1700ff30df?source=api-prod","affected":[{"type":"plugin","slug":"layouts-for-elementor","name":"Layouts for Elementor","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T14:50:15Z"},{"id":"wordfence:1febe071-b296-4958-a9e8-9be9391f2390","source":"wordfence","cve":"CVE-2025-14725","title":"Internal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1febe071-b296-4958-a9e8-9be9391f2390?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-builder","name":"Internal Link Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:46:56Z","updated":"2026-01-14T05:28:05Z"},{"id":"wordfence:1febe2d8-d354-4c78-a611-c1bb0937e53d","source":"wordfence","cve":"CVE-2024-4574","title":"Graphina \u2013 Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1febe2d8-d354-4c78-a611-c1bb0937e53d?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2024-05-10T10:03:51Z","updated":"2024-05-10T22:33:10Z"},{"id":"wordfence:1fecbe10-7b55-4087-859d-c5a2f824c065","source":"wordfence","cve":"CVE-2026-96822","title":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin <= 4.8.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fecbe10-7b55-4087-859d-c5a2f824c065?source=api-prod","affected":[{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2026-09-29T07:14:41Z","updated":"2026-10-09T00:10:37Z"},{"id":"wordfence:1fed22d4-8526-429c-950b-c5affe108a93","source":"wordfence","cve":"CVE-2026-19094","title":"Tutor LMS \u2013 eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1fed22d4-8526-429c-950b-c5affe108a93?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:39:37Z"},{"id":"wordfence:1feddb10-5790-45d9-99e8-401c2f60bdf4","source":"wordfence","cve":"CVE-2025-32624","title":"Czater.pl \u2013 live chat i telefon <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1feddb10-5790-45d9-99e8-401c2f60bdf4?source=api-prod","affected":[{"type":"plugin","slug":"czater","name":"Czater.pl \u2013 live chat i telefon","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:28:46Z"},{"id":"wordfence:1ff179fc-911d-4143-b2a2-5187d2aec67b","source":"wordfence","cve":"CVE-2026-89031","title":"Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff179fc-911d-4143-b2a2-5187d2aec67b?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:21:09Z"},{"id":"wordfence:1ff5889e-b9fd-494f-b25d-78e85e94d34c","source":"wordfence","cve":"CVE-2026-5582","title":"FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff5889e-b9fd-494f-b25d-78e85e94d34c?source=api-prod","affected":[{"type":"plugin","slug":"fusewp","name":"FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)","from":"*","from_inclusive":true,"to":"1.1.24.2","to_inclusive":true,"patched_in":"1.1.25.2"}],"published":"2026-07-28T21:20:38Z","updated":"2026-07-30T13:18:49Z"},{"id":"wordfence:1ff77089-c6c9-49af-8b08-0977a526fa23","source":"wordfence","cve":"CVE-2024-43309","title":"WP Telegram Widget and Join Link <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff77089-c6c9-49af-8b08-0977a526fa23?source=api-prod","affected":[{"type":"plugin","slug":"wptelegram-widget","name":"WP Telegram Widget and Join Link","from":"*","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.28"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:21:46Z"},{"id":"wordfence:1ff7d2d5-d1f7-43e4-a174-d62d0b1a3d0b","source":"wordfence","cve":"CVE-2026-32579","title":"Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff7d2d5-d1f7-43e4-a174-d62d0b1a3d0b?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-10-04T08:26:22Z","updated":"2026-10-13T17:01:37Z"},{"id":"wordfence:1ff97ee8-9732-4d26-b5e8-b744730e9c5a","source":"wordfence","cve":"CVE-2025-6040","title":"Easy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ff97ee8-9732-4d26-b5e8-b744730e9c5a?source=api-prod","affected":[{"type":"plugin","slug":"easy-flashcards","name":"Easy Flashcards","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:43:09Z","updated":"2025-06-14T08:23:23Z"},{"id":"wordfence:1ffb9a8e-b08f-451b-bdb5-268d7b618b66","source":"wordfence","cve":"CVE-2023-24375","title":"WordPress Social Login and Register <=7.5.12 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ffb9a8e-b08f-451b-bdb5-268d7b618b66?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"7.5.12","from_inclusive":true,"to":"7.5.12","to_inclusive":true,"patched_in":"7.5.13"}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:1ffbff82-85ba-4f6f-b2de-9ba99003d981","source":"wordfence","cve":"CVE-2024-37090","title":"Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ffbff82-85ba-4f6f-b2de-9ba99003d981?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T20:37:10Z"},{"id":"wordfence:1ffd28cb-6e70-447b-958d-f325b6226a22","source":"wordfence","cve":"CVE-2026-65572","title":"A.Williams <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1ffd28cb-6e70-447b-958d-f325b6226a22?source=api-prod","affected":[{"type":"plugin","slug":"alisha-williams","name":"A.Williams","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:59:34Z"},{"id":"wordfence:2000b23f-d8a2-4b83-9bf7-b90cb16718f3","source":"wordfence","cve":"CVE-2025-13495","title":"FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2000b23f-d8a2-4b83-9bf7-b90cb16718f3?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-12-02T15:10:18Z","updated":"2025-12-03T03:27:14Z"},{"id":"wordfence:2001d14c-2738-4d34-b465-0a76c2f772e6","source":"wordfence","cve":"CVE-2024-35656","title":"Elementor Pro <= 3.21.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2001d14c-2738-4d34-b465-0a76c2f772e6?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.21.2","to_inclusive":true,"patched_in":"3.21.3"}],"published":"2024-06-28T00:00:00Z","updated":"2024-09-03T16:37:32Z"},{"id":"wordfence:200229af-06c5-42a2-a1ed-7763279fc794","source":"wordfence","cve":"CVE-2025-60087","title":"Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200229af-06c5-42a2-a1ed-7763279fc794?source=api-prod","affected":[{"type":"plugin","slug":"extensive-vc-addon","name":"Extensive VC Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-08-15T00:00:00Z","updated":"2026-10-28T21:08:05Z"},{"id":"wordfence:2002ac51-79c1-4cee-92ff-c58927f27cce","source":"wordfence","cve":"CVE-2025-27354","title":"Simple Email Subscriber <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2002ac51-79c1-4cee-92ff-c58927f27cce?source=api-prod","affected":[{"type":"plugin","slug":"simple-email-subscriber","name":"Simple Email Subscriber","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:39:04Z"},{"id":"wordfence:2002b29b-c817-48a9-b65c-ad1bff2c0935","source":"wordfence","cve":"CVE-2026-54834","title":"Object Cache 4 everyone <= 2.3.2 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2002b29b-c817-48a9-b65c-ad1bff2c0935?source=api-prod","affected":[{"type":"plugin","slug":"object-cache-4-everyone","name":"Object Cache 4 everyone","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T13:37:54Z"},{"id":"wordfence:2002fa81-3a4f-4a88-ba52-ed06969d51a3","source":"wordfence","cve":"","title":"Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2002fa81-3a4f-4a88-ba52-ed06969d51a3?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20033eb0-512f-48ea-8ef7-e22701a2c5d7","source":"wordfence","cve":"CVE-2021-24847","title":"SEO Redirection <= 8.1 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20033eb0-512f-48ea-8ef7-e22701a2c5d7?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2003cef3-06b0-4012-9629-19c0765553dd","source":"wordfence","cve":"CVE-2024-29095","title":"Site Reviews <= 6.11.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2003cef3-06b0-4012-9629-19c0765553dd?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.11.6","to_inclusive":true,"patched_in":"6.11.7"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:44:57Z"},{"id":"wordfence:20042ecf-a8fd-4b36-80d9-d338c8795433","source":"wordfence","cve":"CVE-2026-110664","title":"Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20042ecf-a8fd-4b36-80d9-d338c8795433?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.2.8","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2026-10-15T17:44:06Z","updated":"2026-10-16T06:41:01Z"},{"id":"wordfence:20066389-f20c-45af-9d86-44549f331b3d","source":"wordfence","cve":"CVE-2024-56041","title":"VibeBP < 1.9.9.5.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20066389-f20c-45af-9d86-44549f331b3d?source=api-prod","affected":[{"type":"plugin","slug":"vibebp","name":"VibeBP","from":"*","from_inclusive":true,"to":"1.9.9.5.1","to_inclusive":false,"patched_in":"1.9.9.5.1"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:23:12Z"},{"id":"wordfence:2006dbb8-2aa8-4890-b6ce-18257c64b970","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2006dbb8-2aa8-4890-b6ce-18257c64b970?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2020-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2006dc4c-ec1a-45ab-94a3-1f86d80e70ca","source":"wordfence","cve":"CVE-2025-12129","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2006dc4c-ec1a-45ab-94a3-1f86d80e70ca?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2026-01-16T19:16:27Z","updated":"2026-01-17T07:27:37Z"},{"id":"wordfence:20077e55-fe75-49c7-ba3f-ccd683a3f722","source":"wordfence","cve":"","title":"Vithy (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20077e55-fe75-49c7-ba3f-ccd683a3f722?source=api-prod","affected":[{"type":"theme","slug":"vithy","name":"Vithy","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20087364-11d6-4346-8b80-c3a3739598f9","source":"wordfence","cve":"CVE-2025-23758","title":"Pootle button <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20087364-11d6-4346-8b80-c3a3739598f9?source=api-prod","affected":[{"type":"plugin","slug":"pootle-button","name":"pootle button","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:09:48Z"},{"id":"wordfence:2008df3e-29d2-4d64-b850-c83c2a6a9996","source":"wordfence","cve":"CVE-2025-23963","title":"Mark Posts <= 2.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2008df3e-29d2-4d64-b850-c83c2a6a9996?source=api-prod","affected":[{"type":"plugin","slug":"mark-posts","name":"Mark Posts","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-30T14:33:14Z"},{"id":"wordfence:2009a0d7-ce42-46b5-986d-33e3d06a513d","source":"wordfence","cve":"CVE-2026-42659","title":"AFI \u2013 The Easiest Integration Plugin <= 1.126.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2009a0d7-ce42-46b5-986d-33e3d06a513d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.126.12","to_inclusive":true,"patched_in":"1.127.0"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:55:55Z"},{"id":"wordfence:2009db96-e0e6-4a61-948a-4e1cdab2a6f4","source":"wordfence","cve":"CVE-2025-23742","title":"Podamibe Twilio Private Call <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2009db96-e0e6-4a61-948a-4e1cdab2a6f4?source=api-prod","affected":[{"type":"plugin","slug":"podamibe-twilio-private-call","name":"Podamibe Twilio Private Call","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:10:17Z"},{"id":"wordfence:200b3446-6107-434b-b46d-2078461f3f94","source":"wordfence","cve":"CVE-2024-9778","title":"ImagePress \u2013 Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200b3446-6107-434b-b46d-2078461f3f94?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery","name":"ImagePress \u2013 Front-End Photo Uploads & Member Galleries","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T05:39:38Z"},{"id":"wordfence:200b579a-0287-4e2a-afb2-3b77b94dad25","source":"wordfence","cve":"CVE-2024-45458","title":"Spiffy Calendar <= 4.9.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200b579a-0287-4e2a-afb2-3b77b94dad25?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"4.9.14"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T15:57:08Z"},{"id":"wordfence:200baebd-7fd1-4df6-99ab-71f999b4e85a","source":"wordfence","cve":"CVE-2024-35724","title":"Bosa Elementor Addons and Templates for WooCommerce <= 1.0.12 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200baebd-7fd1-4df6-99ab-71f999b4e85a?source=api-prod","affected":[{"type":"plugin","slug":"bosa-elementor-for-woocommerce","name":"BEW \u2013 Elementor Addons, Templates & AI Builder","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:48:51Z"},{"id":"wordfence:200f6173-72cd-4bf7-86b7-f5308b84364b","source":"wordfence","cve":"CVE-2026-61959","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 6.4.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200f6173-72cd-4bf7-86b7-f5308b84364b?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.24","to_inclusive":true,"patched_in":"6.4.25"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:33:57Z"},{"id":"wordfence:200f724e-7911-46d0-82c0-ffa207d8ee17","source":"wordfence","cve":"CVE-2025-47641","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.3.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200f724e-7911-46d0-82c0-ffa207d8ee17?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-18T16:30:57Z"},{"id":"wordfence:200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df","source":"wordfence","cve":"CVE-2023-4245","title":"WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/200fbfc1-df21-43b0-8eb1-b2ba0cc0c0df?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.91","to_inclusive":true,"patched_in":"1.2.92"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2011db9d-7237-4843-8c15-63b8fb60de5d","source":"wordfence","cve":"CVE-2024-13578","title":"WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2011db9d-7237-4843-8c15-63b8fb60de5d?source=api-prod","affected":[{"type":"plugin","slug":"wp-bibtex","name":"WP-BibTeX","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:48:55Z","updated":"2025-02-18T04:21:11Z"},{"id":"wordfence:2012090d-fd96-4609-aef1-0e3ec5dd2e38","source":"wordfence","cve":"CVE-2017-18527","title":"Pagination by BestWebSoft <= 1.0.6 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2012090d-fd96-4609-aef1-0e3ec5dd2e38?source=api-prod","affected":[{"type":"plugin","slug":"pagination","name":"Pagination by BestWebSoft \u2013 Customizable WordPress Content Splitter and Navigation Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2013b9ac-7853-40b9-8bef-7207ccd58eb1","source":"wordfence","cve":"CVE-2026-61957","title":"miniorange otp verification <= 5.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2013b9ac-7853-40b9-8bef-7207ccd58eb1?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:21:27Z"},{"id":"wordfence:20140f76-b369-4191-bfd1-0f508112ce0a","source":"wordfence","cve":"CVE-2015-4703","title":"WordPress Renaming Tool by Vlajo <= 1.0 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20140f76-b369-4191-bfd1-0f508112ce0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-instance-rename","name":"WordPress Renaming Tool by Vlajo","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20151f80-c25f-482e-a2b0-34607dba9d1e","source":"wordfence","cve":"CVE-2023-52149","title":"Floating Button <= 6.0 - Cross-Site Request Forgery via process_bulk_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20151f80-c25f-482e-a2b0-34607dba9d1e?source=api-prod","affected":[{"type":"plugin","slug":"floating-button","name":"Floating Button \u2013 Easily Create Sticky, Fixed & Floating Buttons","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2016224c-a9f9-4161-885f-310830f48038","source":"wordfence","cve":"","title":"WP Timed Popout <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2016224c-a9f9-4161-885f-310830f48038?source=api-prod","affected":[{"type":"plugin","slug":"wp-timed-popup","name":"Timed Popup WordPress Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20188fd3-c330-4c76-912b-72731e14c450","source":"wordfence","cve":"CVE-2026-3891","title":"Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20188fd3-c330-4c76-912b-72731e14c450?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-pix-for-woocommerce","name":"Pix for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-03-12T18:45:33Z","updated":"2026-03-13T07:23:48Z"},{"id":"wordfence:20199c88-1800-4d18-a0ee-0219be77b429","source":"wordfence","cve":"CVE-2023-49847","title":"Annual Archive <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20199c88-1800-4d18-a0ee-0219be77b429?source=api-prod","affected":[{"type":"plugin","slug":"anual-archive","name":"Annual Archive","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:201b25bb-b39f-4fb7-b5d7-ca9fe9dd89e0","source":"wordfence","cve":"CVE-2025-29006","title":"Direct Checkout for WooCommerce Lite <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/201b25bb-b39f-4fb7-b5d7-ca9fe9dd89e0?source=api-prod","affected":[{"type":"plugin","slug":"woo-direct-checkout-lite","name":"Direct Checkout for WooCommerce Lite","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:27:29Z"},{"id":"wordfence:201ff7b6-d72a-43c3-a7b1-c4f917c9d27f","source":"wordfence","cve":"CVE-2025-5338","title":"Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/201ff7b6-d72a-43c3-a7b1-c4f917c9d27f?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1028","to_inclusive":true,"patched_in":"1.7.1029"}],"published":"2025-06-25T20:58:34Z","updated":"2025-08-18T20:21:00Z"},{"id":"wordfence:20203ff8-34ff-496c-b51c-8cad3ded8bf7","source":"wordfence","cve":"CVE-2026-57425","title":"Autopay dla WooCommerce <= 2.2.27 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20203ff8-34ff-496c-b51c-8cad3ded8bf7?source=api-prod","affected":[{"type":"plugin","slug":"pay-wp","name":"Autopay dla WooCommerce","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T17:46:51Z"},{"id":"wordfence:20227433-a2f0-4a00-b6cc-95708135c0b8","source":"wordfence","cve":"CVE-2013-2640","title":"MailUp newsletter sign-up form < 1.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20227433-a2f0-4a00-b6cc-95708135c0b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailup","name":"MailUp newsletter sign-up form","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2013-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2022fa8b-2b2a-43a3-9447-90eed326f187","source":"wordfence","cve":"CVE-2012-5178","title":"Welcart e-Commerce < 1.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2022fa8b-2b2a-43a3-9447-90eed326f187?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2012-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20232d70-72b2-47b7-ac7e-ad07892864ef","source":"wordfence","cve":"CVE-2025-14732","title":"Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20232d70-72b2-47b7-ac7e-ad07892864ef?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.35.5","to_inclusive":true,"patched_in":"3.35.6"}],"published":"2026-04-07T12:55:13Z","updated":"2026-04-08T01:24:43Z"},{"id":"wordfence:20262161-6189-4c28-8ccb-5c4c12521928","source":"wordfence","cve":"CVE-2025-53454","title":"Ultimate WP Mail <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20262161-6189-4c28-8ccb-5c4c12521928?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T22:29:04Z"},{"id":"wordfence:20283c28-6640-4082-82ca-7f8769e4ccc0","source":"wordfence","cve":"CVE-2008-4671","title":"WordPress MU < 2.6 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20283c28-6640-4082-82ca-7f8769e4ccc0?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2008-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2029ab3b-25e0-443c-936c-c5cfb44c32c8","source":"wordfence","cve":"CVE-2026-116537","title":"Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2029ab3b-25e0-443c-936c-c5cfb44c32c8?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.10.0","to_inclusive":true,"patched_in":"7.10.1"}],"published":"2026-11-06T21:53:49Z","updated":"2026-11-07T11:26:25Z"},{"id":"wordfence:202a2d02-a069-43d1-9ebe-59828e828c03","source":"wordfence","cve":"CVE-2026-93953","title":"Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation","severity":"high","cvss":8.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-10-15T15:13:08Z","updated":"2026-10-16T03:38:41Z"},{"id":"wordfence:202a8493-6df0-4a5e-b6bf-099219830e01","source":"wordfence","cve":"CVE-2025-12851","title":"My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202a8493-6df0-4a5e-b6bf-099219830e01?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.32","to_inclusive":true,"patched_in":"3.6.33"}],"published":"2025-12-04T20:41:27Z","updated":"2025-12-05T09:27:11Z"},{"id":"wordfence:202a8724-14da-4edb-870e-2fee205b1d53","source":"wordfence","cve":"","title":"Vision Interactive For WordPress <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202a8724-14da-4edb-870e-2fee205b1d53?source=api-prod","affected":[{"type":"plugin","slug":"vision","name":"Vision \u2013 Interactive Image Map with Hotspots Builder","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:202c14d0-9207-47cb-9410-ca4c70d7b6d2","source":"wordfence","cve":"CVE-2022-1961","title":"Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202c14d0-9207-47cb-9410-ca4c70d7b6d2?source=api-prod","affected":[{"type":"plugin","slug":"duracelltomi-google-tag-manager","name":"GTM4WP \u2013 A Google Tag Manager (GTM) plugin for WordPress","from":"*","from_inclusive":true,"to":"1.15.1","to_inclusive":true,"patched_in":"1.15.2"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:202c22f1-48ce-4724-be5f-dece2a6f9adb","source":"wordfence","cve":"CVE-2024-53782","title":"Photo Video Store <= 21.07 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202c22f1-48ce-4724-be5f-dece2a6f9adb?source=api-prod","affected":[{"type":"plugin","slug":"photo-video-store","name":"Photo Video Store","from":"*","from_inclusive":true,"to":"21.07","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:10:14Z"},{"id":"wordfence:202d5cda-0957-401b-93ea-7794e08339d1","source":"wordfence","cve":"CVE-2025-26961","title":"Fresh Framework <= 1.70.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202d5cda-0957-401b-93ea-7794e08339d1?source=api-prod","affected":[{"type":"plugin","slug":"fresh-framework","name":"Fresh Framework","from":"*","from_inclusive":true,"to":"1.70.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:31:50Z"},{"id":"wordfence:202dfb5c-6660-4d07-b10d-750fec28a3fe","source":"wordfence","cve":"CVE-2024-49693","title":"Mega Elements <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/202dfb5c-6660-4d07-b10d-750fec28a3fe?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:03:46Z"},{"id":"wordfence:20301685-9b76-4dd3-8185-3a4463f3201b","source":"wordfence","cve":"CVE-2025-5532","title":"Faculty Staff and Student Directory Plugin \u2013 Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=api-prod","affected":[{"type":"plugin","slug":"campus-directory","name":"Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-06-03T00:00:00Z","updated":"2025-07-30T08:23:07Z"},{"id":"wordfence:2030698f-1180-432b-9a66-3039fdda79fd","source":"wordfence","cve":"","title":"Booster for WooCommerce <= 5.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2030698f-1180-432b-9a66-3039fdda79fd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2022-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20378a65-d11a-4ef7-b604-59c962994d6a","source":"wordfence","cve":"CVE-2024-50467","title":"Scrollbar by webxapp \u2013 Best vertical/horizontal scrollbars plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20378a65-d11a-4ef7-b604-59c962994d6a?source=api-prod","affected":[{"type":"plugin","slug":"scrollbar-by-webxapp","name":"Scrollbar by webxapp \u2013 Best vertical/horizontal scrollbars plugin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:46:39Z"},{"id":"wordfence:203950f3-f327-4d9e-afcf-8467aab23712","source":"wordfence","cve":"CVE-2025-55715","title":"Otter - Gutenberg Block <= 3.1.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/203950f3-f327-4d9e-afcf-8467aab23712?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:58:39Z"},{"id":"wordfence:203ab09f-7344-4cab-86bf-0c1ec545d78f","source":"wordfence","cve":"CVE-2024-5088","title":"Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/203ab09f-7344-4cab-86bf-0c1ec545d78f?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-18T11:35:59Z"},{"id":"wordfence:203ba9ca-2054-465f-ad93-ff103cade8aa","source":"wordfence","cve":"CVE-2021-24198","title":"wpDataTables (Premium) <= 3.4.1 - Improper Access Control leading to Table Data Deletion","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/203ba9ca-2054-465f-ad93-ff103cade8aa?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:203f20b0-5bf1-457c-b8fa-7788d21fa32f","source":"wordfence","cve":"CVE-2026-111577","title":"GoSMTP \u2013 SMTP for WordPress < 1.2.5 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/203f20b0-5bf1-457c-b8fa-7788d21fa32f?source=api-prod","affected":[{"type":"plugin","slug":"gosmtp","name":"GoSMTP \u2013 SMTP for WordPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:15:22Z"},{"id":"wordfence:203f850e-1eed-4c49-b733-4ac2ce9b6772","source":"wordfence","cve":"CVE-2026-110017","title":"Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/203f850e-1eed-4c49-b733-4ac2ce9b6772?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2026-10-15T16:37:56Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:204107bc-721c-46a9-a8c3-102240f66fc2","source":"wordfence","cve":"CVE-2025-32276","title":"Administrator Z  < 2026.05.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/204107bc-721c-46a9-a8c3-102240f66fc2?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2026.05.10","to_inclusive":false,"patched_in":"2026.05.10"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-11T19:54:01Z"},{"id":"wordfence:2046c6cf-32fa-4fac-a4bc-00f11f739d14","source":"wordfence","cve":"CVE-2022-2269","title":"Website File Changes Monitor <= 1.8.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2046c6cf-32fa-4fac-a4bc-00f11f739d14?source=api-prod","affected":[{"type":"plugin","slug":"website-file-changes-monitor","name":"Melapress File Monitor","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:204728c8-b8a8-4d6f-99de-80bb4fd432b3","source":"wordfence","cve":"CVE-2026-108499","title":"Knowledge Base <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/204728c8-b8a8-4d6f-99de-80bb4fd432b3?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-10-15T18:17:00Z","updated":"2026-10-23T18:25:08Z"},{"id":"wordfence:2049712a-6ff2-4e2a-98f8-93a493a5bfd3","source":"wordfence","cve":"CVE-2026-14352","title":"AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2049712a-6ff2-4e2a-98f8-93a493a5bfd3?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-woocommerce","name":"AR for WooCommerce","from":"*","from_inclusive":true,"to":"8.40","to_inclusive":true,"patched_in":"8.41"}],"published":"2026-07-02T15:48:04Z","updated":"2026-07-03T04:30:16Z"},{"id":"wordfence:204cfe20-9df1-4f6c-a38c-a21b43dde385","source":"wordfence","cve":"CVE-2025-0321","title":"ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/204cfe20-9df1-4f6c-a38c-a21b43dde385?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2025-01-27T19:08:19Z","updated":"2025-01-28T07:21:41Z"},{"id":"wordfence:2052278d-f1df-4a31-8688-11c7c8d20e07","source":"wordfence","cve":"","title":"Groundhogg <= 2.0.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2052278d-f1df-4a31-8688-11c7c8d20e07?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.8.1","to_inclusive":true,"patched_in":"2.0.9.11"}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20584675-0d4a-4215-8132-e9ea95bee09b","source":"wordfence","cve":"CVE-2024-9885","title":"Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20584675-0d4a-4215-8132-e9ea95bee09b?source=api-prod","affected":[{"type":"plugin","slug":"widget-or-sidebar-per-shortcode","name":"Widget or Sidebar Shortcode","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T14:05:19Z","updated":"2024-10-30T02:32:18Z"},{"id":"wordfence:20589c53-56ff-41ba-857d-40b947a0e55c","source":"wordfence","cve":"CVE-2025-14486","title":"PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20589c53-56ff-41ba-857d-40b947a0e55c?source=api-prod","affected":[{"type":"plugin","slug":"pixelplay","name":"PixelPlay","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-21T19:38:39Z","updated":"2026-09-22T07:41:10Z"},{"id":"wordfence:20590ca1-78f1-47d4-be6e-9378d850103f","source":"wordfence","cve":"CVE-2024-54205","title":"Paloma Widget <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20590ca1-78f1-47d4-be6e-9378d850103f?source=api-prod","affected":[{"type":"plugin","slug":"postman-widget","name":"Paloma Widget","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T22:02:30Z"},{"id":"wordfence:205a3e43-8ac6-4a0d-86d3-bb433a992e3d","source":"wordfence","cve":"","title":"RokIntroScroller <= 1.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/205a3e43-8ac6-4a0d-86d3-bb433a992e3d?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokintroscroller","name":"RokIntroScroller","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2013-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:205a6972-b49f-4b6d-b0de-7a047d5ee496","source":"wordfence","cve":"CVE-2021-34626","title":"WP Upload Restriction <= 2.2.4 - Missing Authorization Checks","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/205a6972-b49f-4b6d-b0de-7a047d5ee496?source=api-prod","affected":[{"type":"plugin","slug":"wp-upload-restriction","name":"WP Upload Restriction","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2021-07-02T15:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:205d639c-6fc9-425c-b7ec-89217e02a028","source":"wordfence","cve":"CVE-2022-0619","title":"Database Peek  <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/205d639c-6fc9-425c-b7ec-89217e02a028?source=api-prod","affected":[{"type":"plugin","slug":"database-peek","name":"Database Peek","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:205e0b90-0d84-4b16-b968-8ec7770f0695","source":"wordfence","cve":"CVE-2015-9479","title":"ACF Frontend Display <= 2.0.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/205e0b90-0d84-4b16-b968-8ec7770f0695?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-display","name":"acf-frontend-display","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2015-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:205efe4d-45c3-4180-b839-ab2ba94ec94a","source":"wordfence","cve":"CVE-2025-49327","title":"ShortLinks Pro <= 1.0.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/205efe4d-45c3-4180-b839-ab2ba94ec94a?source=api-prod","affected":[{"type":"plugin","slug":"shortlinkspro","name":"ShortLinks Pro \u2013 Affiliate Links, Link Shortening, Click Tracking & Marketing","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:38:13Z"},{"id":"wordfence:2061a442-eccd-4a57-a5c5-a432fcea8394","source":"wordfence","cve":"","title":"Administrator Z <= 2022.9.28 - Unauthorized File Upload via ACF","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2061a442-eccd-4a57-a5c5-a432fcea8394?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2022.9.28","to_inclusive":true,"patched_in":"2022.9.29"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:206261fa-58b6-4407-b8e1-2315836b6c88","source":"wordfence","cve":"CVE-2023-48769","title":"Chat Bubble <= 2.3 - Cross-Site Request Forgery via cbb_submit_settings_data","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206261fa-58b6-4407-b8e1-2315836b6c88?source=api-prod","affected":[{"type":"plugin","slug":"chat-bubble","name":"Chat Bubble \u2013 Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2062df27-e553-4753-9362-ee1c1cc6e9f5","source":"wordfence","cve":"CVE-2025-60184","title":"SEO Search Permalink <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2062df27-e553-4753-9362-ee1c1cc6e9f5?source=api-prod","affected":[{"type":"plugin","slug":"seo-search-permalink","name":"SEO Search Permalink","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:07:49Z"},{"id":"wordfence:20641b8d-3742-4088-bb29-ed54056fa229","source":"wordfence","cve":"CVE-2025-49338","title":"Flowbox <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20641b8d-3742-4088-bb29-ed54056fa229?source=api-prod","affected":[{"type":"plugin","slug":"flowbox","name":"Flowbox","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:15:47Z"},{"id":"wordfence:2067541c-8642-42a4-82ad-ea4db78f8a4a","source":"wordfence","cve":"CVE-2026-100517","title":"Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2067541c-8642-42a4-82ad-ea4db78f8a4a?source=api-prod","affected":[{"type":"plugin","slug":"woo-photo-reviews","name":"Revopic \u2013 Photo Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.30","to_inclusive":true,"patched_in":"1.2.31"}],"published":"2026-10-01T11:30:48Z","updated":"2026-10-08T23:09:26Z"},{"id":"wordfence:206a7117-0c4a-49e1-b7a4-74c330c6e4e2","source":"wordfence","cve":"CVE-2025-26545","title":"Related Posts Line-up-Exactly by Milliard <= 0.0.22 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206a7117-0c4a-49e1-b7a4-74c330c6e4e2?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-line-up-exactry-by-milliard","name":"Related Posts Line-up-Exactly by Milliard","from":"*","from_inclusive":true,"to":"0.0.22","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:37:30Z"},{"id":"wordfence:206c386c-15c2-4701-a011-e54d0cb3596c","source":"wordfence","cve":"CVE-2026-39634","title":"Grand Portfolio <= 3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206c386c-15c2-4701-a011-e54d0cb3596c?source=api-prod","affected":[{"type":"theme","slug":"grandportfolio","name":"Grand Portfolio WordPress","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-05T15:35:29Z"},{"id":"wordfence:206c3f15-72d2-4aac-9500-0f794485639e","source":"wordfence","cve":"CVE-2019-6703","title":"Total Donations <= 2.0.5 - Missing Authorization to Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206c3f15-72d2-4aac-9500-0f794485639e?source=api-prod","affected":[{"type":"plugin","slug":"total-donations","name":"Total Donations","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2019-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:206c5736-d9d9-4029-afdf-d76251cc81ac","source":"wordfence","cve":"CVE-2024-3985","title":"Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206c5736-d9d9-4029-afdf-d76251cc81ac?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.4","to_inclusive":true,"patched_in":"2.6.9.5"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:52Z"},{"id":"wordfence:206cf03f-3536-4b13-8e8b-58032671c873","source":"wordfence","cve":"CVE-2025-23588","title":"WOW Best CSS Compiler <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206cf03f-3536-4b13-8e8b-58032671c873?source=api-prod","affected":[{"type":"plugin","slug":"best-css-compiler","name":"WOW Best CSS Compiler","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:49:36Z"},{"id":"wordfence:206d343d-6ed6-461c-bf7d-cf5011ed956f","source":"wordfence","cve":"CVE-2024-29090","title":"AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206d343d-6ed6-461c-bf7d-cf5011ed956f?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T19:40:57Z"},{"id":"wordfence:206eee58-af07-426d-8c11-7a5e5ec52ddc","source":"wordfence","cve":"CVE-2024-56286","title":"Classic Addons \u2013 WPBakery Page Builder <= 3.0 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/206eee58-af07-426d-8c11-7a5e5ec52ddc?source=api-prod","affected":[{"type":"plugin","slug":"classic-addons-wpbakery-page-builder-addons","name":"Classic Addons \u2013 WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:28:15Z"},{"id":"wordfence:2070c6e6-d830-4d1c-9408-5cb2254a00e5","source":"wordfence","cve":"CVE-2024-12119","title":"FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2070c6e6-d830-4d1c-9408-5cb2254a00e5?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2025-03-07T16:21:23Z","updated":"2025-03-08T05:30:09Z"},{"id":"wordfence:207169b7-98ab-4c34-a4e8-ff3dfb6953ed","source":"wordfence","cve":"CVE-2026-114192","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207169b7-98ab-4c34-a4e8-ff3dfb6953ed?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2026-10-22T13:13:17Z","updated":"2026-10-28T01:19:24Z"},{"id":"wordfence:20720912-6bfd-4df1-97c7-7025c16d7a0f","source":"wordfence","cve":"CVE-2024-13704","title":"Super Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20720912-6bfd-4df1-97c7-7025c16d7a0f?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:13Z"},{"id":"wordfence:207447bb-b9ce-4535-b6b9-8a54d06823ab","source":"wordfence","cve":"CVE-2026-119033","title":"Schema & Structured Data for WP & AMP < 1.70 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207447bb-b9ce-4535-b6b9-8a54d06823ab?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.70","to_inclusive":false,"patched_in":"1.70"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:03Z"},{"id":"wordfence:20746c92-6e63-47dd-b0f7-9d20bdbdd9cb","source":"wordfence","cve":"CVE-2015-10087","title":"DesignFolio Plus Theme (Unkown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20746c92-6e63-47dd-b0f7-9d20bdbdd9cb?source=api-prod","affected":[{"type":"theme","slug":"designfolio-plus","name":"DesignFolio Pllus","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2077bd81-52bd-4aa7-85f6-9abb02aec65b","source":"wordfence","cve":"","title":"JCH Optimize <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2077bd81-52bd-4aa7-85f6-9abb02aec65b?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2023-08-08T00:00:00Z","updated":"2024-04-03T15:18:44Z"},{"id":"wordfence:20793de1-468f-4b9d-8e1f-b05dc204c0fb","source":"wordfence","cve":"CVE-2023-25981","title":"Post, Registration and Profile Form Builder \u2013 FrontEnd Editor BuddyForms \u2013 Easy WordPress Forms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20793de1-468f-4b9d-8e1f-b05dc204c0fb?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:207b40fa-2062-48d6-990b-f05cbbf8fb8e","source":"wordfence","cve":"CVE-2023-2407","title":"Event Registration Calendar By vcita <= 1.3.1 & Online Payments \u2013 Get Paid with PayPal, Square & Stripe <= 3.10.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207b40fa-2062-48d6-990b-f05cbbf8fb8e?source=api-prod","affected":[{"type":"plugin","slug":"event-registration-calendar-by-vcita","name":"Event Registration Calendar By vcita","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"paypal-payment-button-by-vcita","name":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.20.0"}],"published":"2023-06-02T00:00:00Z","updated":"2025-03-19T16:51:50Z"},{"id":"wordfence:207d4d50-0276-41d6-91f6-fcc0a9c3033f","source":"wordfence","cve":"CVE-2026-106604","title":"YITH WooCommerce Compare <= 3.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207d4d50-0276-41d6-91f6-fcc0a9c3033f?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":true,"patched_in":"3.15.1"}],"published":"2026-10-15T18:01:00Z","updated":"2026-10-23T18:06:14Z"},{"id":"wordfence:207eedfc-8b42-49be-be7a-98da38ad7ee6","source":"wordfence","cve":"CVE-2025-47450","title":"Simple File List <= 6.1.13 - Missing Authorization to Unauthenticated Minor Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207eedfc-8b42-49be-be7a-98da38ad7ee6?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.13","to_inclusive":true,"patched_in":"6.1.14"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:38:00Z"},{"id":"wordfence:207f7684-aeee-4267-ba29-ca9aacc0a690","source":"wordfence","cve":"CVE-2012-6716","title":"Events Manager < 5.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207f7684-aeee-4267-ba29-ca9aacc0a690?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":false,"patched_in":"5.1.7"}],"published":"2012-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:207fc33b-ccf6-4c39-976d-41e6a89ad1ec","source":"wordfence","cve":"CVE-2026-19892","title":"InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/207fc33b-ccf6-4c39-976d-41e6a89ad1ec?source=api-prod","affected":[{"type":"plugin","slug":"infusedwooPRO","name":"InfusedWoo Pro","from":"*","from_inclusive":true,"to":"5.1.17","to_inclusive":true,"patched_in":"5.1.18"}],"published":"2026-08-24T15:00:27Z","updated":"2026-08-25T03:27:06Z"},{"id":"wordfence:208052ca-3ecc-4efd-8772-0cfa4db08a03","source":"wordfence","cve":"CVE-2025-47605","title":"WP jQuery DataTable <= 4.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/208052ca-3ecc-4efd-8772-0cfa4db08a03?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-datatable","name":"WP jQuery DataTable","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:36:56Z"},{"id":"wordfence:20813a6f-672e-4c06-a5a6-737483f4d402","source":"wordfence","cve":"CVE-2024-37276","title":"Featured Image from URL <= 4.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20813a6f-672e-4c06-a5a6-737483f4d402?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:26:10Z"},{"id":"wordfence:20816039-0b1c-420a-b5f4-b5370d0331da","source":"wordfence","cve":"CVE-2026-17577","title":"SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20816039-0b1c-420a-b5f4-b5370d0331da?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.7.42","to_inclusive":true,"patched_in":"4.7.43"}],"published":"2026-09-24T18:57:17Z","updated":"2026-09-25T07:40:25Z"},{"id":"wordfence:20835df3-677c-4136-af50-46bc272e4f9e","source":"wordfence","cve":"","title":"Pie Register \u2013 User Registration Forms. Invitation based registrations, Custom Login, Payments <= 3.7.2.3 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20835df3-677c-4136-af50-46bc272e4f9e?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.7.2.4","to_inclusive":false,"patched_in":"3.7.2.4"}],"published":"2021-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2083fdf7-e251-4162-b38f-8dab4395a8a7","source":"wordfence","cve":"CVE-2026-15283","title":"WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2083fdf7-e251-4162-b38f-8dab4395a8a7?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backup-mainwp","name":"WPvivid Backup for MainWP","from":"*","from_inclusive":true,"to":"0.9.33","to_inclusive":true,"patched_in":"0.9.34"}],"published":"2024-04-05T00:00:00Z","updated":"2026-07-10T04:31:20Z"},{"id":"wordfence:20842e95-4b91-4138-9e32-7c090724bf64","source":"wordfence","cve":"CVE-2023-6970","title":"WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20842e95-4b91-4138-9e32-7c090724bf64?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:35:59Z"},{"id":"wordfence:2085c9a3-1cc7-4750-875e-d20c7f94bb78","source":"wordfence","cve":"CVE-2021-36898","title":"Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2085c9a3-1cc7-4750-875e-d20c7f94bb78?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20863474-01f7-45f7-b71f-b7ea920649ec","source":"wordfence","cve":"CVE-2025-47592","title":"Legal Terms and Conditions Popup for User Login and WooCommerce Checkout \u2013 TPUL <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20863474-01f7-45f7-b71f-b7ea920649ec?source=api-prod","affected":[{"type":"plugin","slug":"terms-popup-on-user-login","name":"Legal Terms and Conditions Popup for User Login and WooCommerce Checkout","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-05-07T00:00:00Z","updated":"2025-09-22T14:38:59Z"},{"id":"wordfence:2089b54c-9a34-4701-84bf-56b64e51982b","source":"wordfence","cve":"CVE-2025-30811","title":"ValidateCertify <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2089b54c-9a34-4701-84bf-56b64e51982b?source=api-prod","affected":[{"type":"plugin","slug":"validar-certificados-de-cursos","name":"ValidateCertify Free","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:17:35Z"},{"id":"wordfence:208c5ed1-879f-45ea-833e-d2e54c4f063f","source":"wordfence","cve":"CVE-2023-4839","title":"WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/208c5ed1-879f-45ea-833e-d2e54c4f063f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.32","to_inclusive":true,"patched_in":"9.0.33"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T01:57:28Z"},{"id":"wordfence:208c8f55-14e0-47c4-b310-dd7b7edbadd4","source":"wordfence","cve":"CVE-2026-13011","title":"ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/208c8f55-14e0-47c4-b310-dd7b7edbadd4?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.5","to_inclusive":true,"patched_in":"1.17.6"}],"published":"2026-07-08T19:13:55Z","updated":"2026-07-09T07:55:12Z"},{"id":"wordfence:208d0cf6-5f30-4072-860a-75f37b1c2b33","source":"wordfence","cve":"CVE-2026-118086","title":"WP BASE Booking of Appointments, Services and Events <= 6.5.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/208d0cf6-5f30-4072-860a-75f37b1c2b33?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.6.1"}],"published":"2026-10-30T08:50:00Z","updated":"2026-11-10T23:23:21Z"},{"id":"wordfence:208f9475-446c-4cf1-9d70-a845cf9b3005","source":"wordfence","cve":"CVE-2026-19946","title":"Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-09-08T17:09:42Z","updated":"2026-09-09T05:31:03Z"},{"id":"wordfence:209019bd-b214-4389-a972-42e38d501203","source":"wordfence","cve":"CVE-2025-0916","title":"YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/209019bd-b214-4389-a972-42e38d501203?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"2.4.9","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2025-02-18T22:01:38Z","updated":"2025-04-10T22:34:38Z"},{"id":"wordfence:20910787-b99d-475e-acc9-cc2bb669aa56","source":"wordfence","cve":"","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20910787-b99d-475e-acc9-cc2bb669aa56?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:209341fa-6761-4bc4-a921-afa98495a087","source":"wordfence","cve":"CVE-2025-4431","title":"Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/209341fa-6761-4bc4-a921-afa98495a087?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-plus","name":"Featured Image Plus \u2013 Bulk Edit Featured Images, Unsplash & Alt Text Manager","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-05-29T19:23:15Z","updated":"2025-05-30T18:03:41Z"},{"id":"wordfence:2097ab8b-6f7b-4a64-b31a-be3a09ae12bf","source":"wordfence","cve":"CVE-2024-35663","title":"WP Translate <= 5.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2097ab8b-6f7b-4a64-b31a-be3a09ae12bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-translate","name":"WP Translate \u2013 WordPress Translation Plugin","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:48:09Z"},{"id":"wordfence:20989781-def0-4ffd-bf24-40ed34b3e922","source":"wordfence","cve":"CVE-2021-20714","title":"WP Fastest Cache <= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20989781-def0-4ffd-bf24-40ed34b3e922?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.9.1.7","to_inclusive":false,"patched_in":"0.9.1.7"}],"published":"2021-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:209e229f-2a96-4088-b84a-2ac1cd764081","source":"wordfence","cve":"CVE-2025-23983","title":"Tijaji <= 1.43 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/209e229f-2a96-4088-b84a-2ac1cd764081?source=api-prod","affected":[{"type":"theme","slug":"tijaji","name":"TIJAJI","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:34:09Z"},{"id":"wordfence:20a04283-4afd-442c-894c-98a765705404","source":"wordfence","cve":"CVE-2025-25102","title":"Yahoo BOSS <= 0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20a04283-4afd-442c-894c-98a765705404?source=api-prod","affected":[{"type":"plugin","slug":"yahoo-boss","name":"Yahoo BOSS","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:05:13Z"},{"id":"wordfence:20a67cde-612a-4c57-83d6-a5d8f3716a2d","source":"wordfence","cve":"CVE-2024-12599","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20a67cde-612a-4c57-83d6-a5d8f3716a2d?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-02-10T00:00:00Z","updated":"2026-03-27T11:13:27Z"},{"id":"wordfence:20a6a58f-b6c0-4132-932b-c6def8e9e7c0","source":"wordfence","cve":"CVE-2023-2707","title":"gAppointments <= 1.9.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20a6a58f-b6c0-4132-932b-c6def8e9e7c0?source=api-prod","affected":[{"type":"plugin","slug":"gAppointments","name":"gAppointments - Appointment booking addon for Gravity Forms","from":"*","from_inclusive":true,"to":"1.9.5.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20aa674b-e504-4548-8d71-f9ba654ffe54","source":"wordfence","cve":"CVE-2025-24597","title":"Barcode Generator for WooCommerce \u2013 Show barcodes on products, orders, invoices and other pages <= 2.0.2 - Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20aa674b-e504-4548-8d71-f9ba654ffe54?source=api-prod","affected":[{"type":"plugin","slug":"embedding-barcodes-into-product-pages-and-orders","name":"Barcode Generator for WooCommerce \u2013 Show barcodes on products, orders, invoices and other pages","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-12-26T00:00:00Z","updated":"2025-02-24T16:05:50Z"},{"id":"wordfence:20aa8703-ff25-4ac9-a7d8-2036e8c2574a","source":"wordfence","cve":"CVE-2025-31578","title":"Fonts Manager | Custom Fonts <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20aa8703-ff25-4ac9-a7d8-2036e8c2574a?source=api-prod","affected":[{"type":"plugin","slug":"fonts-manager-custom-fonts","name":"Fonts Manager | Custom Fonts","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:25:25Z"},{"id":"wordfence:20afddaa-5185-4224-a302-2d74461be648","source":"wordfence","cve":"CVE-2025-58026","title":"Termageddon: Cookie Consent & Privacy Compliance <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20afddaa-5185-4224-a302-2d74461be648?source=api-prod","affected":[{"type":"plugin","slug":"termageddon-usercentrics","name":"Termageddon: Cookie Consent & Privacy Compliance","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:04:02Z"},{"id":"wordfence:20b0a946-f429-4615-9d16-4a95a9120c3d","source":"wordfence","cve":"CVE-2024-10894","title":"Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b0a946-f429-4615-9d16-4a95a9120c3d?source=api-prod","affected":[{"type":"plugin","slug":"payment-forms-for-paystack","name":"Payment Forms for Paystack","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-04-09T18:12:59Z","updated":"2025-04-30T15:05:48Z"},{"id":"wordfence:20b0c4c5-ee44-471a-bf6f-d2aa9fa2563d","source":"wordfence","cve":"CVE-2025-23964","title":"Google Plus <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b0c4c5-ee44-471a-bf6f-d2aa9fa2563d?source=api-prod","affected":[{"type":"plugin","slug":"google-plus-google","name":"Google Plus","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:14:23Z"},{"id":"wordfence:20b11bbb-fd27-4c0c-9205-fd2164c39392","source":"wordfence","cve":"CVE-2025-1453","title":"Category Posts Widget <= 4.9.19 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b11bbb-fd27-4c0c-9205-fd2164c39392?source=api-prod","affected":[{"type":"plugin","slug":"category-posts","name":"Category Posts Block","from":"*","from_inclusive":true,"to":"4.9.19","to_inclusive":true,"patched_in":"4.9.20"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-30T20:08:51Z"},{"id":"wordfence:20b31652-02af-4c1a-a3c8-a4cca69c8ae2","source":"wordfence","cve":"CVE-2025-67931","title":"BulletProof Security <= 6.9 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b31652-02af-4c1a-a3c8-a4cca69c8ae2?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T14:23:27Z"},{"id":"wordfence:20b3b64f-e6d7-4ccd-98f3-417390bd2393","source":"wordfence","cve":"CVE-2025-31843","title":"OpenAI Tools for WordPress & WooCommerce <= 2.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b3b64f-e6d7-4ccd-98f3-417390bd2393?source=api-prod","affected":[{"type":"plugin","slug":"openai-tools-for-wp-wc","name":"OpenAI Tools for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:49:08Z"},{"id":"wordfence:20b3c88f-a0df-4814-83b6-27440c5ad38e","source":"wordfence","cve":"CVE-2025-13898","title":"Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b3c88f-a0df-4814-83b6-27440c5ad38e?source=api-prod","affected":[{"type":"plugin","slug":"ultra-skype-button","name":"Ultra Skype Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T16:46:09Z","updated":"2025-12-06T05:49:22Z"},{"id":"wordfence:20b3cd2a-ee32-49e0-8281-16afb8e42448","source":"wordfence","cve":"CVE-2023-27429","title":"Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b3cd2a-ee32-49e0-8281-16afb8e42448?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2023-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20b9dcd9-d87d-46ef-82b1-30743fcdc909","source":"wordfence","cve":"CVE-2026-24390","title":"Kentha Elementor Widgets < 3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20b9dcd9-d87d-46ef-82b1-30743fcdc909?source=api-prod","affected":[{"type":"plugin","slug":"kentha-elementor","name":"Kentha Elementor Widgets","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2026-01-24T00:00:00Z","updated":"2026-01-28T13:44:01Z"},{"id":"wordfence:20ba8f45-d101-46e1-b2c3-4f6a588a8fc9","source":"wordfence","cve":"CVE-2025-31884","title":"Norse Rune Oracle Plugin <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20ba8f45-d101-46e1-b2c3-4f6a588a8fc9?source=api-prod","affected":[{"type":"plugin","slug":"norse-runes-oracle","name":"Norse Rune Oracle Plugin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:59:00Z"},{"id":"wordfence:20bacfc2-8a25-425f-8013-c6221b0a7be6","source":"wordfence","cve":"CVE-2026-86834","title":"MetForm 2.2.1 - 4.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20bacfc2-8a25-425f-8013-c6221b0a7be6?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"2.2.1","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:58:38Z"},{"id":"wordfence:20be9a37-9e9f-4791-a27c-e0db007be787","source":"wordfence","cve":"CVE-2024-8658","title":"myCred \u2013 Loyalty Points and Rewards plugin for WordPress and WooCommerce \u2013 Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20be9a37-9e9f-4791-a27c-e0db007be787?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T05:32:13Z"},{"id":"wordfence:20c50747-6b87-46d4-8232-597509a3b70f","source":"wordfence","cve":"CVE-2025-49941","title":"GlamChic <= 1.0.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20c50747-6b87-46d4-8232-597509a3b70f?source=api-prod","affected":[{"type":"theme","slug":"glamchic","name":"GlamChic | Beauty Blog WordPress Theme + Store","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:23:24Z"},{"id":"wordfence:20c92582-311e-45f9-8bbe-00c87d7e5656","source":"wordfence","cve":"CVE-2026-90977","title":"Clean Login <= 1.18 - Unauthenticated CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20c92582-311e-45f9-8bbe-00c87d7e5656?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.19"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:26:07Z"},{"id":"wordfence:20caab24-4af7-4592-9b18-f2f5acb423c9","source":"wordfence","cve":"CVE-2025-4602","title":"eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read","severity":"medium","cvss":5.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20caab24-4af7-4592-9b18-f2f5acb423c9?source=api-prod","affected":[{"type":"plugin","slug":"store-manager-connector","name":"eMagicOne Store Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-05-23T14:33:31Z","updated":"2025-11-05T21:28:16Z"},{"id":"wordfence:20cab852-8c95-4069-99c9-c6caa1ced97e","source":"wordfence","cve":"CVE-2026-108686","title":"Post Author <= 4.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20cab852-8c95-4069-99c9-c6caa1ced97e?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:21:39Z"},{"id":"wordfence:20cc328e-ebe0-48b0-aeff-ae19ee1fda96","source":"wordfence","cve":"CVE-2026-66669","title":"Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More <= 4.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20cc328e-ebe0-48b0-aeff-ae19ee1fda96?source=api-prod","affected":[{"type":"plugin","slug":"superb-blocks","name":"Superb Addons: Blocks, Patterns, Pre-built Pages, Sliders, Popups, Free Forms, Animations & More","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T16:10:47Z"},{"id":"wordfence:20cd08ac-826f-40dd-804a-546b0c334b66","source":"wordfence","cve":"CVE-2024-4700","title":"WP Table Builder \u2013 WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd08ac-826f-40dd-804a-546b0c334b66?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2024-05-20T21:19:23Z","updated":"2024-05-21T09:31:49Z"},{"id":"wordfence:20cd3fff-0488-4bc2-961b-2427925e6a96","source":"wordfence","cve":"CVE-2024-1358","title":"Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd3fff-0488-4bc2-961b-2427925e6a96?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:26:37Z"},{"id":"wordfence:20d16cc4-3bc2-4f1b-b7ba-17993199a997","source":"wordfence","cve":"CVE-2024-29097","title":"User profile <= 2.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d16cc4-3bc2-4f1b-b7ba-17993199a997?source=api-prod","affected":[{"type":"plugin","slug":"user-profile","name":"User profile","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:57:35Z"},{"id":"wordfence:20d30931-bfaf-47bb-9265-b326c959b871","source":"wordfence","cve":"CVE-2024-48042","title":"Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d30931-bfaf-47bb-9265-b326c959b871?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.28","to_inclusive":true,"patched_in":"1.7.29"}],"published":"2024-10-13T00:00:00Z","updated":"2024-10-18T16:01:34Z"},{"id":"wordfence:20d5848e-7772-45dc-ad6f-edb9164c8d44","source":"wordfence","cve":"CVE-2015-1000008","title":"MP3-jPlayer <= 2.4.2 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d5848e-7772-45dc-ad6f-edb9164c8d44?source=api-prod","affected":[{"type":"plugin","slug":"mp3-jplayer","name":"MP3-jPlayer","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":false,"patched_in":"2.5"}],"published":"2015-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20d5ff9e-9920-47c7-aa8d-e4f9f1646080","source":"wordfence","cve":"CVE-2024-31272","title":"ARForms Form Builder <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d5ff9e-9920-47c7-aa8d-e4f9f1646080?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:31:22Z"},{"id":"wordfence:20d744a0-ae5f-4a16-8736-bb3a2cb6d881","source":"wordfence","cve":"CVE-2026-14822","title":"Event Tickets and Registration < 5.29.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d744a0-ae5f-4a16-8736-bb3a2cb6d881?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.0.1","to_inclusive":false,"patched_in":"5.29.0.1"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:28:14Z"},{"id":"wordfence:20d989d9-6bf0-4f9f-acf4-b4c3452855cc","source":"wordfence","cve":"CVE-2022-47605","title":"Custom 404 Pro <= 3.7.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20d989d9-6bf0-4f9f-acf4-b4c3452855cc?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20da63ad-4b94-417a-b117-5270fe095aab","source":"wordfence","cve":"CVE-2026-18666","title":"Library Management System <= 3.6.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20da63ad-4b94-417a-b117-5270fe095aab?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-15T21:42:31Z"},{"id":"wordfence:20daf751-176d-48f2-ac68-480fda89cee1","source":"wordfence","cve":"","title":"WordPress Pinterest Plugin <= 1.6.1 - Stored (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20daf751-176d-48f2-ac68-480fda89cee1?source=api-prod","affected":[{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20de9544-b2fe-470c-a7a4-b662b59d6d31","source":"wordfence","cve":"CVE-2013-5977","title":"Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20de9544-b2fe-470c-a7a4-b662b59d6d31?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.1.15","to_inclusive":false,"patched_in":"1.5.1.15"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20deedff-8980-4ac2-a74e-c52cfe57e839","source":"wordfence","cve":"CVE-2018-5670","title":"Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20deedff-8980-4ac2-a74e-c52cfe57e839?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20df30e2-7e59-479c-946d-e0128b7d8401","source":"wordfence","cve":"CVE-2014-10376","title":"I Recommend This < 3.7.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20df30e2-7e59-479c-946d-e0128b7d8401?source=api-prod","affected":[{"type":"plugin","slug":"i-recommend-this","name":"I Recommend This \u2013 Love/Like Button for WordPress Posts","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.7.3"}],"published":"2014-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20e00a22-5044-4daf-9e6f-2e7267ed21c5","source":"wordfence","cve":"CVE-2026-101165","title":"Mollie Payments for WooCommerce < 8.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e00a22-5044-4daf-9e6f-2e7267ed21c5?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":false,"patched_in":"8.2.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:37:43Z"},{"id":"wordfence:20e0367f-7f17-49fe-a19c-5defcea909e2","source":"wordfence","cve":"CVE-2025-23589","title":"ContentOptin Lite \u2013 WP Content Upgrade Plugin <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e0367f-7f17-49fe-a19c-5defcea909e2?source=api-prod","affected":[{"type":"plugin","slug":"contentoptin","name":"ContentOptin Lite \u2013 WP Content Upgrade Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T16:31:43Z"},{"id":"wordfence:20e0e651-8330-4062-8fb4-f0545befcb1a","source":"wordfence","cve":"CVE-2025-7486","title":"Ebook Store <= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e0e651-8330-4062-8fb4-f0545befcb1a?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8012","to_inclusive":true,"patched_in":"5.8013"}],"published":"2025-07-21T09:53:32Z","updated":"2025-07-21T22:21:58Z"},{"id":"wordfence:20e2454f-f49b-413f-ae45-8b628b30a780","source":"wordfence","cve":"CVE-2024-13700","title":"Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e2454f-f49b-413f-ae45-8b628b30a780?source=api-prod","affected":[{"type":"plugin","slug":"embed-swagger-ui","name":"Embed Swagger UI","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:41:56Z"},{"id":"wordfence:20e2f410-72a9-4d94-b80d-1cb625c08962","source":"wordfence","cve":"CVE-2026-12470","title":"CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e2f410-72a9-4d94-b80d-1cb625c08962?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"4.1.18"}],"published":"2026-09-21T16:45:20Z","updated":"2026-09-22T05:30:43Z"},{"id":"wordfence:20e51573-d555-4928-87df-ea5f5ca70848","source":"wordfence","cve":"CVE-2025-32251","title":"Jetpack Feedback Exporter <= 1.23 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20e51573-d555-4928-87df-ea5f5ca70848?source=api-prod","affected":[{"type":"plugin","slug":"jetpack-feedback-exporter","name":"Jetpack Feedback Exporter","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T13:17:19Z"},{"id":"wordfence:20ecc8ea-305c-49a2-bb1e-35624b16e1f5","source":"wordfence","cve":"CVE-2024-56270","title":"WP SecureSubmit <= 1.5.18 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20ecc8ea-305c-49a2-bb1e-35624b16e1f5?source=api-prod","affected":[{"type":"plugin","slug":"securesubmit","name":"WP SecureSubmit","from":"*","from_inclusive":true,"to":"1.5.18","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-03-13T20:15:38Z"},{"id":"wordfence:20ee6bc7-2732-4da3-b005-a971d12b0e32","source":"wordfence","cve":"CVE-2026-13331","title":"Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20ee6bc7-2732-4da3-b005-a971d12b0e32?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-27T01:27:21Z"},{"id":"wordfence:20eff8fc-0572-40b9-ab28-758c7ab8ed73","source":"wordfence","cve":"CVE-2021-24140","title":"Ajax Load More plugin < 5.3.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20eff8fc-0572-40b9-ab28-758c7ab8ed73?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"5.3.2"}],"published":"2020-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20f0058b-ccc2-45e7-bce1-8f5debefc3aa","source":"wordfence","cve":"CVE-2026-14212","title":"Booking for Appointments and Events Calendar \u2013 Amelia 9.0 - 9.7 - Authenticated (Provider+) Arbitrary Provider Password Update","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20f0058b-ccc2-45e7-bce1-8f5debefc3aa?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"9.0","from_inclusive":true,"to":"9.7","to_inclusive":true,"patched_in":"9.8"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:10:41Z"},{"id":"wordfence:20f0e9ae-786b-4ba8-a6d5-92bf31ebc2c7","source":"wordfence","cve":"CVE-2026-11900","title":"Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20f0e9ae-786b-4ba8-a6d5-92bf31ebc2c7?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.16","to_inclusive":true,"patched_in":"2.8.17"}],"published":"2026-07-02T19:01:12Z","updated":"2026-07-03T07:53:08Z"},{"id":"wordfence:20f1600e-6404-4f60-b415-e6588e26f97d","source":"wordfence","cve":"CVE-2024-49612","title":"SW Contact Form <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20f1600e-6404-4f60-b415-e6588e26f97d?source=api-prod","affected":[{"type":"plugin","slug":"sw-contact-form","name":"SW Contact Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:09:21Z"},{"id":"wordfence:20f31e48-0dbb-498a-a400-681cacea7c9c","source":"wordfence","cve":"CVE-2023-41952","title":"Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20f31e48-0dbb-498a-a400-681cacea7c9c?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":false,"patched_in":"5.0.9"}],"published":"2023-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:20f461d1-aeb2-4913-804c-6a081e48765a","source":"wordfence","cve":"CVE-2025-8592","title":"Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20f461d1-aeb2-4913-804c-6a081e48765a?source=api-prod","affected":[{"type":"theme","slug":"inspiro","name":"Inspiro","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-08-20T16:43:50Z","updated":"2025-08-21T05:28:13Z"},{"id":"wordfence:20fb2c18-2502-4d2a-b329-da60070a42ea","source":"wordfence","cve":"CVE-2025-47621","title":"Meks Flexible Shortcodes <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20fb2c18-2502-4d2a-b329-da60070a42ea?source=api-prod","affected":[{"type":"plugin","slug":"meks-flexible-shortcodes","name":"Meks Flexible Shortcodes","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:17:58Z"},{"id":"wordfence:20fc675c-08a4-4d77-9872-335d23146906","source":"wordfence","cve":"CVE-2024-13401","title":"Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20fc675c-08a4-4d77-9872-335d23146906?source=api-prod","affected":[{"type":"plugin","slug":"wp-paypal","name":"Payment Button for PayPal","from":"*","from_inclusive":true,"to":"1.2.3.35","to_inclusive":true,"patched_in":"1.2.3.36"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T04:30:19Z"},{"id":"wordfence:20fdbe6b-45a8-41f4-8dde-35a0f9ea04a1","source":"wordfence","cve":"CVE-2024-5057","title":"Easy Digital Downloads <= 3.2.12 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/20fdbe6b-45a8-41f4-8dde-35a0f9ea04a1?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:16:29Z"},{"id":"wordfence:2100071c-aa66-445b-acef-7655e64f47e0","source":"wordfence","cve":"CVE-2024-3111","title":"H5P <= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2100071c-aa66-445b-acef-7655e64f47e0?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.15.7","to_inclusive":true,"patched_in":"1.15.8"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-26T18:17:40Z"},{"id":"wordfence:2100d720-bfb4-451d-9907-e0b77ef507a5","source":"wordfence","cve":"CVE-2026-15145","title":"Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2100d720-bfb4-451d-9907-e0b77ef507a5?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.11","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2026-07-20T19:35:03Z","updated":"2026-07-21T07:51:21Z"},{"id":"wordfence:2100f72a-ff75-4429-8dc6-be5b6e3c84cb","source":"wordfence","cve":"CVE-2026-109590","title":"Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2100f72a-ff75-4429-8dc6-be5b6e3c84cb?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2026-10-27T17:44:52Z","updated":"2026-10-28T06:45:07Z"},{"id":"wordfence:21019e1f-3d09-4727-8788-281c647d39dc","source":"wordfence","cve":"CVE-2026-24639","title":"Photo Block \u2013 A Modern Image Block With Lightbox and Caption Support <= 1.7.1 - Authenticated (Author+) Sever-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21019e1f-3d09-4727-8788-281c647d39dc?source=api-prod","affected":[{"type":"plugin","slug":"photo-block","name":"Photo Block \u2013 A Modern Image Block With Lightbox and Caption Support","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:50:52Z"},{"id":"wordfence:2105a26a-0813-4f63-a28d-6b3bd68ea9a1","source":"wordfence","cve":"CVE-2026-14292","title":"Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2105a26a-0813-4f63-a28d-6b3bd68ea9a1?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.66","to_inclusive":false,"patched_in":"3.3.66"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:19:07Z"},{"id":"wordfence:21065544-8a48-485b-88af-2e638b400de4","source":"wordfence","cve":"CVE-2026-11783","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21065544-8a48-485b-88af-2e638b400de4?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-26T17:53:42Z","updated":"2026-06-27T06:50:56Z"},{"id":"wordfence:210e9d94-ae2a-4dd9-a151-0bafbac68d18","source":"wordfence","cve":"CVE-2024-11690","title":"Financial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/210e9d94-ae2a-4dd9-a151-0bafbac68d18?source=api-prod","affected":[{"type":"plugin","slug":"live-stock-prices-for-wordpress","name":"Financial Stocks & Crypto Market Data Plugin","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:16:14Z","updated":"2025-01-07T04:21:59Z"},{"id":"wordfence:210fa57c-7cf7-4ff1-84c4-5b3b6bd87a28","source":"wordfence","cve":"CVE-2025-31598","title":"Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/210fa57c-7cf7-4ff1-84c4-5b3b6bd87a28?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-pricing-woocommerce","name":"Price by Quantity & Bulk Quantity Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-03-31T00:00:00Z","updated":"2025-10-30T14:57:46Z"},{"id":"wordfence:210fd125-285d-4d07-bd39-b5ea222025ea","source":"wordfence","cve":"CVE-2024-7955","title":"Starbox \u2013 the Author Box for Humans <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/210fd125-285d-4d07-bd39-b5ea222025ea?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2024-08-20T00:00:00Z","updated":"2024-09-12T15:15:06Z"},{"id":"wordfence:2111df14-63a3-4e3c-87b8-d0e71812d32c","source":"wordfence","cve":"CVE-2014-8800","title":"Nextend Social Login and Register <= 1.5.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2111df14-63a3-4e3c-87b8-d0e71812d32c?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2014-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:211350ac-24c4-4aa7-aea6-5dc44f753185","source":"wordfence","cve":"CVE-2022-1577","title":"Database Backup for WordPress <= 2.5.1 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211350ac-24c4-4aa7-aea6-5dc44f753185?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2022-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2116340a-160f-493c-abe3-75b05282d78a","source":"wordfence","cve":"CVE-2025-11816","title":"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2116340a-160f-493c-abe3-75b05282d78a?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-10-31T13:45:14Z","updated":"2025-11-01T01:47:40Z"},{"id":"wordfence:211634f6-afc4-4841-8851-6c56a248af95","source":"wordfence","cve":"CVE-2014-2839","title":"GD Star Rating <= 1.9.22 - Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211634f6-afc4-4841-8851-6c56a248af95?source=api-prod","affected":[{"type":"plugin","slug":"gd-star-rating","name":"GD Star Rating","from":"*","from_inclusive":true,"to":"1.9.22","to_inclusive":true,"patched_in":""}],"published":"2014-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:211a104c-4311-4df9-9083-9cae92ea50b5","source":"wordfence","cve":"CVE-2025-62913","title":"Opal Service <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211a104c-4311-4df9-9083-9cae92ea50b5?source=api-prod","affected":[{"type":"plugin","slug":"opal-service","name":"Opal Service","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:02:52Z"},{"id":"wordfence:211aa83e-e97b-4fd7-8cfe-308ac698c17e","source":"wordfence","cve":"CVE-2022-36282","title":"Search Exclude <= 1.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211aa83e-e97b-4fd7-8cfe-308ac698c17e?source=api-prod","affected":[{"type":"plugin","slug":"search-exclude","name":"Search Exclude","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:211b8b76-d770-443b-ba95-84b30adc5d48","source":"wordfence","cve":"CVE-2025-46513","title":"All in One Time Clock Lite <= 1.3.325 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211b8b76-d770-443b-ba95-84b30adc5d48?source=api-prod","affected":[{"type":"plugin","slug":"aio-time-clock-lite","name":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier","from":"*","from_inclusive":true,"to":"1.3.325","to_inclusive":true,"patched_in":"1.3.326"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-05T18:30:36Z"},{"id":"wordfence:211ffeb3-6f6b-4b90-b229-acdee49a801a","source":"wordfence","cve":"CVE-2024-35655","title":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content <= 0.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/211ffeb3-6f6b-4b90-b229-acdee49a801a?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.6.9","to_inclusive":true,"patched_in":"0.7.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-08-13T20:55:53Z"},{"id":"wordfence:2121d9fa-bab4-489d-89bc-07a8660bc3d1","source":"wordfence","cve":"CVE-2026-12738","title":"WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2121d9fa-bab4-489d-89bc-07a8660bc3d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-07-10T16:56:12Z","updated":"2026-07-11T05:35:46Z"},{"id":"wordfence:21238925-b87c-43ea-b4ab-9b5d311d3a0a","source":"wordfence","cve":"CVE-2024-2968","title":"WP-Eggdrop <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21238925-b87c-43ea-b4ab-9b5d311d3a0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-eggdrop","name":"WP-Eggdrop","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:43:56Z"},{"id":"wordfence:2123a3cc-08f1-4e30-ac61-275d45cd1227","source":"wordfence","cve":"CVE-2024-31431","title":"Product Input Fields for WooCommerce <= 1.7.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2123a3cc-08f1-4e30-ac61-275d45cd1227?source=api-prod","affected":[{"type":"plugin","slug":"product-input-fields-for-woocommerce","name":"Product Input Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:54:56Z"},{"id":"wordfence:21241eb0-bfc7-4219-98de-a7a23d930c2d","source":"wordfence","cve":"CVE-2025-22680","title":"Ad Inserter Pro <= 2.7.39 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21241eb0-bfc7-4219-98de-a7a23d930c2d?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter-pro","name":"Ad Inserter Pro","from":"*","from_inclusive":true,"to":"2.7.39","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T21:52:51Z"},{"id":"wordfence:21260efc-1518-4343-ad75-9992a97a58b1","source":"wordfence","cve":"CVE-2025-23646","title":"Library Instruction Recorder <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21260efc-1518-4343-ad75-9992a97a58b1?source=api-prod","affected":[{"type":"plugin","slug":"library-instruction-recorder","name":"Library Instruction Recorder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:47:43Z"},{"id":"wordfence:21291ed7-cdc0-4698-9ec4-8417160845ed","source":"wordfence","cve":"CVE-2023-6634","title":"LearnPress <= 4.2.5.7 - Command Injection","severity":"high","cvss":8.1,"cwe":"CWE-88","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21291ed7-cdc0-4698-9ec4-8417160845ed?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.5.7","to_inclusive":true,"patched_in":"4.2.5.8"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:35:59Z"},{"id":"wordfence:212b7da7-bd3e-42df-8b50-a3eb472cf440","source":"wordfence","cve":"CVE-2023-23716","title":"Zendesk Support for WordPress <= 1.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212b7da7-bd3e-42df-8b50-a3eb472cf440?source=api-prod","affected":[{"type":"plugin","slug":"zendesk","name":"Zendesk Support for WordPress","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:212dd123-42d4-4dd2-a2e2-bf0c43e805bf","source":"wordfence","cve":"CVE-2023-32579","title":"Forget About Shortcode Buttons <= 2.1.2 - Missing Authorization via fasc_buttons","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212dd123-42d4-4dd2-a2e2-bf0c43e805bf?source=api-prod","affected":[{"type":"plugin","slug":"forget-about-shortcode-buttons","name":"Forget About Shortcode Buttons","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:212e33f8-438b-4781-913f-a4f9f6d24a89","source":"wordfence","cve":"CVE-2024-29910","title":"Dropdown Multisite selector <= 0.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212e33f8-438b-4781-913f-a4f9f6d24a89?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-multisite-selector","name":"Dropdown Multisite Selector","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":"0.9.2.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T17:09:04Z"},{"id":"wordfence:212e5d55-5b28-41d6-86a0-d247d6c81f0d","source":"wordfence","cve":"CVE-2026-1390","title":"Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212e5d55-5b28-41d6-86a0-d247d6c81f0d?source=api-prod","affected":[{"type":"plugin","slug":"redirect-countdown","name":"Redirect countdown","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:19:25Z","updated":"2026-03-21T03:26:37Z"},{"id":"wordfence:212e8f84-22a9-4b9e-b440-280f8569846f","source":"wordfence","cve":"CVE-2024-13508","title":"Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212e8f84-22a9-4b9e-b440-280f8569846f?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.6.72","to_inclusive":true,"patched_in":"1.6.73"}],"published":"2025-02-18T10:25:55Z","updated":"2025-02-18T23:22:00Z"},{"id":"wordfence:212ee91a-9713-4a1a-ac55-742a89eb2704","source":"wordfence","cve":"CVE-2025-69338","title":"Riode Core <= 1.6.26 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/212ee91a-9713-4a1a-ac55-742a89eb2704?source=api-prod","affected":[{"type":"plugin","slug":"riode-core","name":"Riode Core","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.27"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:36:31Z"},{"id":"wordfence:2130847a-b6c5-412e-8d90-ba42d3fb21f6","source":"wordfence","cve":"CVE-2026-0626","title":"WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2130847a-b6c5-412e-8d90-ba42d3fb21f6?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-04-03T22:13:01Z","updated":"2026-04-04T11:16:18Z"},{"id":"wordfence:2131e418-bd95-4bd1-868f-0bd3b4abdf78","source":"wordfence","cve":"","title":"Tainacan <= 0.18.9 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2131e418-bd95-4bd1-868f-0bd3b4abdf78?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.18.9","to_inclusive":true,"patched_in":"0.18.10"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21322495-a709-45a9-b8df-c3a3aeb1f260","source":"wordfence","cve":"CVE-2024-31120","title":"Responsive Image Gallery, Gallery Album <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21322495-a709-45a9-b8df-c3a3aeb1f260?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:32:33Z"},{"id":"wordfence:2132b06e-c1ad-4c3f-a693-cb531256db05","source":"wordfence","cve":"CVE-2025-15696","title":"Real3D Flipbook Lite <= 5.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2132b06e-c1ad-4c3f-a693-cb531256db05?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2026-09-21T00:00:00Z","updated":"2026-10-08T23:44:51Z"},{"id":"wordfence:2132d5b4-583d-46c0-be5e-6664bee9cad2","source":"wordfence","cve":"CVE-2024-32508","title":"DethemeKit For Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2132d5b4-583d-46c0-be5e-6664bee9cad2?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:29:29Z"},{"id":"wordfence:21340ccf-eae5-4089-876f-60c3d6510d4a","source":"wordfence","cve":"CVE-2024-30524","title":"PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21340ccf-eae5-4089-876f-60c3d6510d4a?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-for-elementor","name":"PDF Viewer for Elementor","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:56:24Z"},{"id":"wordfence:21341d9c-9f04-4bc6-b9fc-6fa8afd3cf5c","source":"wordfence","cve":"CVE-2024-3665","title":"Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21341d9c-9f04-4bc6-b9fc-6fa8afd3cf5c?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.216","to_inclusive":true,"patched_in":"1.0.217"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T09:32:54Z"},{"id":"wordfence:2134bfd6-db71-4117-87a7-6ad4107d3b39","source":"wordfence","cve":"CVE-2026-22450","title":"Don Peppe <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2134bfd6-db71-4117-87a7-6ad4107d3b39?source=api-prod","affected":[{"type":"theme","slug":"donpeppe","name":"Don Peppe - Pizza and Fast Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-03T00:00:00Z","updated":"2026-01-14T20:18:12Z"},{"id":"wordfence:2134cdb7-6319-44b5-a280-781616caae04","source":"wordfence","cve":"CVE-2025-39530","title":"Site Search 360 <= 2.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2134cdb7-6319-44b5-a280-781616caae04?source=api-prod","affected":[{"type":"plugin","slug":"site-search-360","name":"Site Search 360","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:51:29Z"},{"id":"wordfence:2135a6d4-8d4d-4e2b-8b34-5a07456493ec","source":"wordfence","cve":"CVE-2025-46445","title":"External Markdown <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2135a6d4-8d4d-4e2b-8b34-5a07456493ec?source=api-prod","affected":[{"type":"plugin","slug":"external-markdown","name":"External Markdown","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:30:25Z"},{"id":"wordfence:2136cad8-6b0b-4458-a357-6e98f1ac3e0b","source":"wordfence","cve":"CVE-2024-13217","title":"Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas","severity":"medium","cvss":4.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2136cad8-6b0b-4458-a357-6e98f1ac3e0b?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":true,"patched_in":"2.6.12"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T11:13:34Z"},{"id":"wordfence:2137dfdc-38ef-4a6a-99c7-c79c2bbb34f6","source":"wordfence","cve":"CVE-2026-62130","title":"WPML Multilingual & Multicurrency for WooCommerce <= 5.5.8 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2137dfdc-38ef-4a6a-99c7-c79c2bbb34f6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-10-08T17:07:59Z","updated":"2026-10-13T14:18:59Z"},{"id":"wordfence:21389122-cb39-45d1-a889-b830d3a55603","source":"wordfence","cve":"CVE-2026-4283","title":"WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21389122-cb39-45d1-a889-b830d3a55603?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.38","to_inclusive":true,"patched_in":"3.1.39"}],"published":"2026-03-23T16:27:36Z","updated":"2026-03-24T04:27:50Z"},{"id":"wordfence:213a40fe-a143-46c9-b383-83c3fc31675d","source":"wordfence","cve":"CVE-2025-13456","title":"Shopbuilder <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/213a40fe-a143-46c9-b383-83c3fc31675d?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-12-12T00:00:00Z","updated":"2026-01-06T16:19:01Z"},{"id":"wordfence:213a67d3-3670-490b-bcee-cd29867fa217","source":"wordfence","cve":"CVE-2025-69406","title":"FreightCo <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/213a67d3-3670-490b-bcee-cd29867fa217?source=api-prod","affected":[{"type":"theme","slug":"freightco","name":"FreightCo \u2013 Free Transportation & Logistics WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:26:20Z"},{"id":"wordfence:213aa9cf-5d3b-485a-997d-583a46053b4f","source":"wordfence","cve":"CVE-2026-25030","title":"Goldish < 3.47 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/213aa9cf-5d3b-485a-997d-583a46053b4f?source=api-prod","affected":[{"type":"theme","slug":"goldish","name":"Goldish - Jewelry Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.47","to_inclusive":false,"patched_in":"3.47"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:07:20Z"},{"id":"wordfence:213b6dec-a64d-4597-a079-8fb82df9c8b4","source":"wordfence","cve":"CVE-2022-1685","title":"Five Minute Webshop <= 1.3.2 - Authenticated (Admin+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/213b6dec-a64d-4597-a079-8fb82df9c8b4?source=api-prod","affected":[{"type":"plugin","slug":"five-minute-webshop","name":"Five Minute Webshop","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:213fde1b-13dc-442a-8f48-4b1074155a6f","source":"wordfence","cve":"CVE-2022-4157","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/213fde1b-13dc-442a-8f48-4b1074155a6f?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2144ba9f-cb0a-4b54-a23f-3ecb2548a490","source":"wordfence","cve":"CVE-2019-17673","title":"WordPress Core < 5.2.4 - Cache Poisoning","severity":"high","cvss":7.3,"cwe":"CWE-444","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2144ba9f-cb0a-4b54-a23f-3ecb2548a490?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.14","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21456889-058c-46a5-80c3-a0c8f90cd3bf","source":"wordfence","cve":"CVE-2020-11928","title":"Media Library Assistant <= 2.81 - Remote Code Execution via tax_query, meta_query, date_query Parameters","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21456889-058c-46a5-80c3-a0c8f90cd3bf?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"2.81","to_inclusive":true,"patched_in":"2.82"}],"published":"2019-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2148809e-b7fe-4104-b70f-d4137c85e92f","source":"wordfence","cve":"CVE-2023-38384","title":"eaSYNC <= 1.3.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2148809e-b7fe-4104-b70f-d4137c85e92f?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2023-07-20T00:00:00Z","updated":"2024-04-01T21:26:50Z"},{"id":"wordfence:2149f8e6-4991-45a6-ae8f-d1cf928d6bd7","source":"wordfence","cve":"CVE-2026-94123","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 4.5.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2149f8e6-4991-45a6-ae8f-d1cf928d6bd7?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:56:56Z"},{"id":"wordfence:2151249a-8e7a-4c7b-89ff-5058942368fb","source":"wordfence","cve":"CVE-2026-114630","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2151249a-8e7a-4c7b-89ff-5058942368fb?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-11-05T22:16:19Z","updated":"2026-11-06T11:17:35Z"},{"id":"wordfence:2152b820-2eb1-4f08-ab3f-10bd2692eea5","source":"wordfence","cve":"CVE-2025-31533","title":"Salesmate Add-On for Gravity Forms <= 2.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2152b820-2eb1-4f08-ab3f-10bd2692eea5?source=api-prod","affected":[{"type":"plugin","slug":"gf-salesmate-add-on","name":"Salesmate Add-On for Gravity Forms","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-03-31T00:00:00Z","updated":"2025-05-21T13:58:46Z"},{"id":"wordfence:2153f7e2-0d39-4784-a1f5-aa77959306a7","source":"wordfence","cve":"CVE-2016-10706","title":"Jetpack <= 4.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2153f7e2-0d39-4784-a1f5-aa77959306a7?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21542a9e-efa2-4655-b076-d282e3678fdf","source":"wordfence","cve":"CVE-2023-41687","title":"Goods Catalog <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21542a9e-efa2-4655-b076-d282e3678fdf?source=api-prod","affected":[{"type":"plugin","slug":"goods-catalog","name":"Goods Catalog","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2154383e-eabb-4964-8991-423dd68d5efb","source":"wordfence","cve":"CVE-2024-0628","title":"WP RSS Aggregator <= 4.23.5 - Authenticated (Admin+) Server-Side Request Forgery via RSS Feed Source","severity":"low","cvss":3.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2154383e-eabb-4964-8991-423dd68d5efb?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"4.23.5","from_inclusive":true,"to":"4.23.5","to_inclusive":true,"patched_in":"4.23.6"}],"published":"2024-02-06T00:00:00Z","updated":"2024-07-29T21:35:59Z"},{"id":"wordfence:21552524-9f3f-4ef1-b8bc-9eb6ebfaac12","source":"wordfence","cve":"CVE-2026-1890","title":"LeadConnector < 3.0.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21552524-9f3f-4ef1-b8bc-9eb6ebfaac12?source=api-prod","affected":[{"type":"plugin","slug":"leadconnector","name":"LeadConnector","from":"*","from_inclusive":true,"to":"3.0.22","to_inclusive":false,"patched_in":"3.0.22"}],"published":"2026-03-30T00:00:00Z","updated":"2026-04-09T16:08:47Z"},{"id":"wordfence:21559bcf-37ca-4063-8651-98076dd87ed2","source":"wordfence","cve":"CVE-2026-84026","title":"Directorist 8.1 - 8.9.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21559bcf-37ca-4063-8651-98076dd87ed2?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"8.1","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:49:24Z"},{"id":"wordfence:2156af57-d98b-4d0a-b7aa-0281c951c82f","source":"wordfence","cve":"CVE-2016-1000134","title":"HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting via playlist parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2156af57-d98b-4d0a-b7aa-0281c951c82f?source=api-prod","affected":[{"type":"plugin","slug":"hdw-tube","name":"HDW WordPress Video Gallery","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2158052d-aff0-4492-94a4-a0ffe3dd013c","source":"wordfence","cve":"CVE-2026-39717","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2158052d-aff0-4492-94a4-a0ffe3dd013c?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-02T14:49:00Z","updated":"2026-11-03T21:02:41Z"},{"id":"wordfence:215937d9-739b-4198-b375-6d171bbac64a","source":"wordfence","cve":"CVE-2021-4333","title":"WP Statistics <= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215937d9-739b-4198-b375-6d171bbac64a?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.1","to_inclusive":true,"patched_in":"13.1.2"}],"published":"2021-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21597f22-2690-4a3d-965f-bc99326b7e64","source":"wordfence","cve":"CVE-2024-29804","title":"Fancy Comments WordPress <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21597f22-2690-4a3d-965f-bc99326b7e64?source=api-prod","affected":[{"type":"plugin","slug":"fancy-facebook-comments","name":"Fancy Comments WordPress","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:25:04Z"},{"id":"wordfence:215a9f92-e922-4fa3-a4ac-83af788f4e55","source":"wordfence","cve":"CVE-2026-100179","title":"Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215a9f92-e922-4fa3-a4ac-83af788f4e55?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.5.1.3","to_inclusive":true,"patched_in":"5.5.1.4"}],"published":"2026-09-30T20:14:18Z","updated":"2026-10-01T08:28:41Z"},{"id":"wordfence:215aaad5-bf34-4817-a220-7077e9aa808b","source":"wordfence","cve":"CVE-2026-9810","title":"AI Chatbot & Workflow Automation by AIWU <= 1.5.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215aaad5-bf34-4817-a220-7077e9aa808b?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T12:42:00Z"},{"id":"wordfence:215be163-f362-4bda-b81a-65ec955968a2","source":"wordfence","cve":"CVE-2024-10677","title":"BTEV <= Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215be163-f362-4bda-b81a-65ec955968a2?source=api-prod","affected":[{"type":"plugin","slug":"bluetrait-event-viewer","name":"BTEV","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-25T17:33:29Z"},{"id":"wordfence:215ca15c-6a59-4ab3-953d-ae26a597dff5","source":"wordfence","cve":"CVE-2026-88846","title":"MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215ca15c-6a59-4ab3-953d-ae26a597dff5?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:16:43Z"},{"id":"wordfence:215d5d9e-dabb-462d-8c51-952f8c497b78","source":"wordfence","cve":"CVE-2023-6223","title":"LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.5.7","to_inclusive":true,"patched_in":"4.2.5.8"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:00Z"},{"id":"wordfence:215ea2de-538b-4f24-98f8-67b8314453cd","source":"wordfence","cve":"CVE-2021-24588","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215ea2de-538b-4f24-98f8-67b8314453cd?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":false,"patched_in":"3.4.7"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:215f5ab4-44be-4db0-86d5-e7ff0630e15d","source":"wordfence","cve":"CVE-2025-31097","title":"Material Dashboard <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/215f5ab4-44be-4db0-86d5-e7ff0630e15d?source=api-prod","affected":[{"type":"plugin","slug":"material-dashboard","name":"Material Dashboard","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:46:59Z"},{"id":"wordfence:2160cf45-e1a1-475f-9de9-8ae7345a9b19","source":"wordfence","cve":"CVE-2025-47591","title":"Bulk Featured Image <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2160cf45-e1a1-475f-9de9-8ae7345a9b19?source=api-prod","affected":[{"type":"plugin","slug":"bulk-featured-image","name":"Bulk Featured Image","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:31:56Z"},{"id":"wordfence:21614b80-f632-466b-9612-f616bbbc267d","source":"wordfence","cve":"CVE-2018-8729","title":"Activity Log <= 2.4.0 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21614b80-f632-466b-9612-f616bbbc267d?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2018-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21616ffc-44aa-45ca-8304-cb9d4ab5621d","source":"wordfence","cve":"CVE-2025-31541","title":"TuriTop Booking System <= 1.0.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21616ffc-44aa-45ca-8304-cb9d4ab5621d?source=api-prod","affected":[{"type":"plugin","slug":"turitop-booking-system","name":"TuriTop Booking System","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2025-04-03T00:00:00Z","updated":"2026-08-14T15:13:47Z"},{"id":"wordfence:21618fba-3f57-43b2-b9ea-13484301755d","source":"wordfence","cve":"CVE-2024-31341","title":"Profile Builder <= 3.11.2 - Restricted Email Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21618fba-3f57-43b2-b9ea-13484301755d?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:13:23Z"},{"id":"wordfence:2161ecdc-d3c2-4ede-9c42-28f30fa0f91e","source":"wordfence","cve":"CVE-2026-111110","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2161ecdc-d3c2-4ede-9c42-28f30fa0f91e?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.61","to_inclusive":true,"patched_in":"2.8.62"}],"published":"2026-10-16T19:36:58Z","updated":"2026-10-17T07:51:24Z"},{"id":"wordfence:2162601a-3b94-4d6b-959e-99ba68d1271a","source":"wordfence","cve":"CVE-2024-38748","title":"EleForms <= 2.9.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2162601a-3b94-4d6b-959e-99ba68d1271a?source=api-prod","affected":[{"type":"plugin","slug":"all-contact-form-integration-for-elementor","name":"EleForms \u2013 All In One Form Integration including DB for Elementor","from":"*","from_inclusive":true,"to":"2.9.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-16T20:09:25Z"},{"id":"wordfence:2163af55-1ea4-4c60-b9f0-baf99297c6bc","source":"wordfence","cve":"CVE-2023-6065","title":"Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2163af55-1ea4-4c60-b9f0-baf99297c6bc?source=api-prod","affected":[{"type":"plugin","slug":"quttera-web-malware-scanner","name":"Quttera ThreatSign \u2013 Web Malware Scanner for WordPress","from":"*","from_inclusive":true,"to":"3.4.1.48","to_inclusive":true,"patched_in":"3.4.2.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2164289e-dc9a-4659-85fe-0818092466c4","source":"wordfence","cve":"CVE-2026-111820","title":"Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2164289e-dc9a-4659-85fe-0818092466c4?source=api-prod","affected":[{"type":"plugin","slug":"analytics-insights","name":"Analytics Insights \u2013 Google Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"6.4"}],"published":"2026-10-26T16:34:07Z","updated":"2026-10-27T05:30:32Z"},{"id":"wordfence:21690b9c-ffec-4195-8c0f-2b1801552bc6","source":"wordfence","cve":"CVE-2024-10540","title":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21690b9c-ffec-4195-8c0f-2b1801552bc6?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-02T02:03:07Z"},{"id":"wordfence:216e20f1-f26c-4fd0-ba85-d28379c498ed","source":"wordfence","cve":"CVE-2026-109693","title":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.5 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/216e20f1-f26c-4fd0-ba85-d28379c498ed?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-10-13T11:00:24Z","updated":"2026-10-23T18:26:34Z"},{"id":"wordfence:216e3087-52f1-4b2e-a31c-0c2ddf41aefb","source":"wordfence","cve":"CVE-2026-91108","title":"Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/216e3087-52f1-4b2e-a31c-0c2ddf41aefb?source=api-prod","affected":[{"type":"plugin","slug":"alttext-ai","name":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility","from":"*","from_inclusive":true,"to":"1.10.41","to_inclusive":true,"patched_in":"1.10.42"}],"published":"2026-10-02T16:34:58Z","updated":"2026-10-03T05:29:14Z"},{"id":"wordfence:216f1faf-362a-4218-93f1-9f1f4ad171aa","source":"wordfence","cve":"CVE-2026-80071","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/216f1faf-362a-4218-93f1-9f1f4ad171aa?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":false,"patched_in":"5.2.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T20:07:43Z"},{"id":"wordfence:21708205-dd43-4b22-9151-bc6f882422cb","source":"wordfence","cve":"CVE-2025-10163","title":"List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21708205-dd43-4b22-9151-bc6f882422cb?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.91.0","to_inclusive":true,"patched_in":"0.92.0"}],"published":"2025-12-10T14:30:38Z","updated":"2025-12-11T03:27:11Z"},{"id":"wordfence:21718974-6229-42ee-be71-fbd14be190d2","source":"wordfence","cve":"CVE-2026-11881","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21718974-6229-42ee-be71-fbd14be190d2?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":false,"patched_in":"6.2.6"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:38:24Z"},{"id":"wordfence:21720383-6857-4289-973c-32f2adb8dbec","source":"wordfence","cve":"CVE-2026-12869","title":"Header Footer Builder for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21720383-6857-4289-973c-32f2adb8dbec?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-builder-for-elementor","name":"Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T22:25:08Z"},{"id":"wordfence:217445a3-5abf-4690-88f1-ba8822392424","source":"wordfence","cve":"CVE-2025-69407","title":"Struktur <= 2.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217445a3-5abf-4690-88f1-ba8822392424?source=api-prod","affected":[{"type":"theme","slug":"struktur","name":"Struktur - Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:43:41Z"},{"id":"wordfence:2175a181-8287-4524-ae83-a7e64ce2edd3","source":"wordfence","cve":"CVE-2026-108477","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2175a181-8287-4524-ae83-a7e64ce2edd3?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2026-10-12T16:09:00Z","updated":"2026-10-13T14:04:23Z"},{"id":"wordfence:217893b9-c5cb-43ff-899f-23d8da931044","source":"wordfence","cve":"CVE-2026-116847","title":"Mang Board <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217893b9-c5cb-43ff-899f-23d8da931044?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-10-30T08:28:55Z","updated":"2026-11-03T19:32:32Z"},{"id":"wordfence:2178b39c-5341-4f53-82be-668b400d7f25","source":"wordfence","cve":"CVE-2023-46089","title":"Userback <= 1.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2178b39c-5341-4f53-82be-668b400d7f25?source=api-prod","affected":[{"type":"plugin","slug":"userback","name":"Userback","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:217b1213-de46-4c1d-baea-41a859bfcc60","source":"wordfence","cve":"CVE-2024-43336","title":"WP User Manager <= 2.9.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217b1213-de46-4c1d-baea-41a859bfcc60?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":true,"patched_in":"2.9.11"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-09T20:27:45Z"},{"id":"wordfence:217b4ed7-90d3-4871-b034-7e1b324dc6a2","source":"wordfence","cve":"CVE-2022-1301","title":"WP Contact Slider <= 2.4.6 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217b4ed7-90d3-4871-b034-7e1b324dc6a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-slider","name":"WP Contact Slider \u2013 Contact Form Slider Widget","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:217c7916-0bd1-4499-8ecc-00961ddcc6e8","source":"wordfence","cve":"CVE-2025-68008","title":"Mail <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217c7916-0bd1-4499-8ecc-00961ddcc6e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail","name":"WP Mail","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:52:45Z"},{"id":"wordfence:217cbfc8-1b5d-49b1-976e-237b4ed059d4","source":"wordfence","cve":"CVE-2025-48351","title":"Kento Splash Screen <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217cbfc8-1b5d-49b1-976e-237b4ed059d4?source=api-prod","affected":[{"type":"plugin","slug":"kento-splash-screen","name":"Kento Splash Screen","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T13:54:58Z"},{"id":"wordfence:217cc880-8400-4a97-a024-7b55e6ab69dd","source":"wordfence","cve":"CVE-2024-37108","title":"WishList Member X < 3.26.7 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217cc880-8400-4a97-a024-7b55e6ab69dd?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T15:00:01Z"},{"id":"wordfence:217d3148-d411-4fff-a4f6-d5d02ef207af","source":"wordfence","cve":"CVE-2024-2226","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217d3148-d411-4fff-a4f6-d5d02ef207af?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:37Z"},{"id":"wordfence:217d68dc-6133-4b7e-9d8f-bb8fc18f1c12","source":"wordfence","cve":"","title":"001 Prime Strategy Translate Accelerator <= 1.1.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217d68dc-6133-4b7e-9d8f-bb8fc18f1c12?source=api-prod","affected":[{"type":"plugin","slug":"001-prime-strategy-translate-accelerator","name":"001 Prime Strategy Translate Accelerator","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:217da4de-38df-41ff-b138-f12d4f8999cd","source":"wordfence","cve":"CVE-2024-8547","title":"Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217da4de-38df-41ff-b138-f12d4f8999cd?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-plugin","name":"Simple Popup Plugin","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2024-09-27T13:55:41Z","updated":"2024-10-04T12:34:37Z"},{"id":"wordfence:217f3595-3c35-46c1-a02c-e8829732a719","source":"wordfence","cve":"CVE-2024-12493","title":"Files Download Delay <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/217f3595-3c35-46c1-a02c-e8829732a719?source=api-prod","affected":[{"type":"plugin","slug":"files-download-delay","name":"Files Download Delay","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:02:33Z","updated":"2025-01-09T11:10:54Z"},{"id":"wordfence:2180dc08-25a8-474b-b382-5ce359de04b5","source":"wordfence","cve":"CVE-2022-4124","title":"Popup Manager <= 1.6.6 - Missing Authorization to Arbitrary Popup Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2180dc08-25a8-474b-b382-5ce359de04b5?source=api-prod","affected":[{"type":"plugin","slug":"popup-manager","name":"Popup Manager","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2181ede3-d8ac-4b62-98e5-7f4448a8cee4","source":"wordfence","cve":"CVE-2024-32083","title":"Easy Logo <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2181ede3-d8ac-4b62-98e5-7f4448a8cee4?source=api-prod","affected":[{"type":"plugin","slug":"easylogo","name":"Easy Logo","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T15:50:03Z"},{"id":"wordfence:21869bed-4678-4091-a0c5-cafd2306c207","source":"wordfence","cve":"CVE-2026-22399","title":"Holmes - Digital Agency WordPress Theme <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21869bed-4678-4091-a0c5-cafd2306c207?source=api-prod","affected":[{"type":"theme","slug":"holmes","name":"Holmes - Digital Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:42:41Z"},{"id":"wordfence:2187311d-6651-4eca-806d-aa2ff9fae4e2","source":"wordfence","cve":"CVE-2024-10570","title":"Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2187311d-6651-4eca-806d-aa2ff9fae4e2?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.145","to_inclusive":true,"patched_in":"2.145.1"}],"published":"2024-11-25T17:07:52Z","updated":"2024-11-26T05:33:02Z"},{"id":"wordfence:218b4564-bfaf-4e65-94c4-b6b15b60b707","source":"wordfence","cve":"CVE-2022-45074","title":"Activity Reactions For Buddypress <= 1.0.22 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218b4564-bfaf-4e65-94c4-b6b15b60b707?source=api-prod","affected":[{"type":"plugin","slug":"activity-reactions-for-buddypress","name":"Activity Reactions For Buddypress","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":""}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:218c91f5-8328-4ab2-a52a-66c32934a130","source":"wordfence","cve":"CVE-2026-56023","title":"UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218c91f5-8328-4ab2-a52a-66c32934a130?source=api-prod","affected":[{"type":"plugin","slug":"upi-qr-code-payment-for-woocommerce","name":"UPI QR Code Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:33:12Z"},{"id":"wordfence:218d0d28-16db-4d9c-b643-6cc2edfc74e2","source":"wordfence","cve":"CVE-2025-9374","title":"Ultimate Tag Warrior Importer <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218d0d28-16db-4d9c-b643-6cc2edfc74e2?source=api-prod","affected":[{"type":"plugin","slug":"utw-importer","name":"Ultimate Tag Warrior Importer","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-28T15:44:35Z","updated":"2025-08-29T04:25:29Z"},{"id":"wordfence:218e4ed5-661b-49e1-8b23-457a93fd53fa","source":"wordfence","cve":"CVE-2025-15516","title":"All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218e4ed5-661b-49e1-8b23-457a93fd53fa?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"4.1.0","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-01-23T19:29:41Z","updated":"2026-01-24T08:26:34Z"},{"id":"wordfence:218e68b5-57a9-4d2f-9a13-4d159e12dbd9","source":"wordfence","cve":"CVE-2024-13925","title":"Klarna Checkout for WooCommerce <= 2.13.4 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218e68b5-57a9-4d2f-9a13-4d159e12dbd9?source=api-prod","affected":[{"type":"plugin","slug":"klarna-checkout-for-woocommerce","name":"Kustom Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T18:30:32Z"},{"id":"wordfence:218f08d5-c1cb-462c-abc5-d5b41044f8aa","source":"wordfence","cve":"CVE-2016-10890","title":"Activity Log <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/218f08d5-c1cb-462c-abc5-d5b41044f8aa?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2016-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21930a4f-2f78-42c5-8ffa-2993333db2fe","source":"wordfence","cve":"","title":"Ultimate Product Catalogue < 3.1.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21930a4f-2f78-42c5-8ffa-2993333db2fe?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2015-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21931b7b-3c3d-4297-878e-bc0f187557a0","source":"wordfence","cve":"CVE-2026-115807","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute","severity":"high","cvss":7.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21931b7b-3c3d-4297-878e-bc0f187557a0?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-20T13:40:10Z","updated":"2026-10-24T04:32:10Z"},{"id":"wordfence:219614b7-2394-490c-baf4-14a12249c4b5","source":"wordfence","cve":"CVE-2022-42882","title":"Simple CSV/XLS Exporter <= 1.5.8 - CSV Injection","severity":"medium","cvss":5.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219614b7-2394-490c-baf4-14a12249c4b5?source=api-prod","affected":[{"type":"plugin","slug":"simple-csv-xls-exporter","name":"Simple CSV/XLS Exporter","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2196197f-ccae-4893-b939-12980d20b9f6","source":"wordfence","cve":"CVE-2025-23674","title":"Bit.ly linker <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2196197f-ccae-4893-b939-12980d20b9f6?source=api-prod","affected":[{"type":"plugin","slug":"bitly-linker","name":"Bit.ly linker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:04:50Z"},{"id":"wordfence:219770af-d01e-4ebb-acf5-b4a647a0e16e","source":"wordfence","cve":"CVE-2025-58231","title":"Bitly <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219770af-d01e-4ebb-acf5-b4a647a0e16e?source=api-prod","affected":[{"type":"plugin","slug":"wp-bitly","name":"Bitly's WordPress Plugin","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:35:31Z"},{"id":"wordfence:21990e54-c3a2-4bca-b164-132ad456e651","source":"wordfence","cve":"CVE-2024-4365","title":"Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21990e54-c3a2-4bca-b164-132ad456e651?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2024.3","to_inclusive":true,"patched_in":"2024.4"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T16:30:52Z"},{"id":"wordfence:219ad118-8186-4d35-bf47-632eb9d81d31","source":"wordfence","cve":"CVE-2026-119500","title":"HTML5 Video Player \u2013 embed fast, responsive videos with ease <= 2.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219ad118-8186-4d35-bf47-632eb9d81d31?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.14.1","to_inclusive":true,"patched_in":"2.14.2"}],"published":"2026-11-07T10:11:00Z","updated":"2026-11-10T19:29:52Z"},{"id":"wordfence:219b29a6-6148-4cc9-960c-b28f2d90236e","source":"wordfence","cve":"CVE-2026-96741","title":"DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219b29a6-6148-4cc9-960c-b28f2d90236e?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:46:16Z","updated":"2026-10-29T03:39:13Z"},{"id":"wordfence:219de193-32d0-40b0-a471-bf8bf6e2bb62","source":"wordfence","cve":"CVE-2022-3556","title":"Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219de193-32d0-40b0-a471-bf8bf6e2bb62?source=api-prod","affected":[{"type":"plugin","slug":"cab-fare-calculator","name":"Cab fare calculator","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-09-04T00:00:00Z","updated":"2024-10-18T14:14:55Z"},{"id":"wordfence:219f732e-abd8-463c-a43e-f92371356e3d","source":"wordfence","cve":"CVE-2025-57935","title":"Bot Block &#8211; Stop Spam Referrals in Google Analytics <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/219f732e-abd8-463c-a43e-f92371356e3d?source=api-prod","affected":[{"type":"plugin","slug":"bot-block-stop-spam-google-analytics-referrals","name":"Bot Block \u2013 Stop Spam Referrals in Google Analytics","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:39:05Z"},{"id":"wordfence:21a15a21-1d35-4fbc-9c01-ded68287fc65","source":"wordfence","cve":"","title":"Reality | Estate Multipurpose WordPress Theme <= 2.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a15a21-1d35-4fbc-9c01-ded68287fc65?source=api-prod","affected":[{"type":"theme","slug":"reality","name":"Reality | Estate Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2020-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21a1a6c2-0eb1-4ee3-abf0-76b84adca01b","source":"wordfence","cve":"","title":"iThemes Security < 7.9.1 and iThemes Security Pro < 6.8.4 - Hidden Login Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a1a6c2-0eb1-4ee3-abf0-76b84adca01b?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"7.9.1","to_inclusive":false,"patched_in":"7.9.1"},{"type":"plugin","slug":"ithemes-security-pro","name":"iThemes Security Pro","from":"*","from_inclusive":true,"to":"6.8.4","to_inclusive":false,"patched_in":"6.8.4"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21a1b117-945f-49bc-9ea1-313afa93bf32","source":"wordfence","cve":"CVE-2024-43328","title":"EmbedPress <= 4.0.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a1b117-945f-49bc-9ea1-313afa93bf32?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:29:17Z"},{"id":"wordfence:21a27a8b-f599-42b9-9439-4456995dd3fe","source":"wordfence","cve":"CVE-2020-11023","title":"jQuery Manager for WordPress <= 1.10.4 &  jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency","severity":"medium","cvss":6.5,"cwe":"CWE-1395","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a27a8b-f599-42b9-9439-4456995dd3fe?source=api-prod","affected":[{"type":"plugin","slug":"jquery-manager","name":"jQuery Manager for WordPress","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.5"},{"type":"plugin","slug":"enable-jquery-migrate-helper","name":"Enable jQuery Migrate Helper","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2020-07-20T00:00:00Z","updated":"2025-01-17T17:31:36Z"},{"id":"wordfence:21a31d61-84eb-47bf-a4d3-e14089127e6c","source":"wordfence","cve":"CVE-2022-4551","title":"Rich Table of Contents <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a31d61-84eb-47bf-a4d3-e14089127e6c?source=api-prod","affected":[{"type":"plugin","slug":"rich-table-of-content","name":"Rich Table of Contents","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21a3e3f1-9503-49f4-9b84-8b7c38c22e69","source":"wordfence","cve":"CVE-2025-49392","title":"Themify Audio Dock <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a3e3f1-9503-49f4-9b84-8b7c38c22e69?source=api-prod","affected":[{"type":"plugin","slug":"themify-audio-dock","name":"Themify Audio Dock","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:06:57Z"},{"id":"wordfence:21a7bb17-aaa6-49c8-a433-483fac4d555f","source":"wordfence","cve":"CVE-2025-67534","title":"Rencontre <= 3.13.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21a7bb17-aaa6-49c8-a433-483fac4d555f?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.13.7","to_inclusive":true,"patched_in":"3.13.8"}],"published":"2025-11-30T00:00:00Z","updated":"2025-12-11T16:44:39Z"},{"id":"wordfence:21aa8edc-0ba4-4bb1-857e-007b2364f665","source":"wordfence","cve":"CVE-2026-16593","title":"Directory Kit <= 1.5.8 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21aa8edc-0ba4-4bb1-857e-007b2364f665?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-09-12T00:00:00Z","updated":"2026-10-22T23:56:41Z"},{"id":"wordfence:21ab1a1e-53f5-4cd2-a9c5-0b0065f14a6a","source":"wordfence","cve":"CVE-2022-29436","title":"Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ab1a1e-53f5-4cd2-a9c5-0b0065f14a6a?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets-extended","name":"Code Snippets Extended","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T14:51:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21ae9136-a60c-483d-bdf4-b0c55796560d","source":"wordfence","cve":"CVE-2022-44632","title":"Content Repeater <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ae9136-a60c-483d-bdf4-b0c55796560d?source=api-prod","affected":[{"type":"plugin","slug":"content-repeater","name":"Content Repeater \u2013 Custom Posts Simplified","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21b4d1a1-55fe-4241-820c-203991d724c4","source":"wordfence","cve":"CVE-2023-6924","title":"Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21b4d1a1-55fe-4241-820c-203991d724c4?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.18","to_inclusive":true,"patched_in":"1.8.19"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21b59c8c-671a-45a9-8774-d059c4ad15ba","source":"wordfence","cve":"CVE-2025-69313","title":"PostX <= 5.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21b59c8c-671a-45a9-8774-d059c4ad15ba?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:40:52Z"},{"id":"wordfence:21b6748a-43fb-4326-ac1f-d3ae2a6700f2","source":"wordfence","cve":"CVE-2025-11874","title":"Slippy Slider \u2013 Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21b6748a-43fb-4326-ac1f-d3ae2a6700f2?source=api-prod","affected":[{"type":"plugin","slug":"slippy-slider-responsive-touch-navigation-slider","name":"Slippy Slider \u2013 Responsive Touch Navigation Slider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:26:07Z","updated":"2025-11-11T03:30:33Z"},{"id":"wordfence:21b8fcfe-bdae-414a-a0d2-f20bfd604037","source":"wordfence","cve":"CVE-2021-24268","title":"JetWidgets For Elementor <= 1.0.8 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21b8fcfe-bdae-414a-a0d2-f20bfd604037?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21bc2595-0760-42a6-b11b-3f7609223d8b","source":"wordfence","cve":"CVE-2024-30509","title":"SellKit <= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21bc2595-0760-42a6-b11b-3f7609223d8b?source=api-prod","affected":[{"type":"plugin","slug":"sellkit","name":"SellKit \u2013 Funnel builder and checkout optimizer for WooCommerce to sell more, faster","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T14:42:57Z"},{"id":"wordfence:21bc466b-dc2e-468d-b793-6659913e4664","source":"wordfence","cve":"CVE-2026-66583","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21bc466b-dc2e-468d-b793-6659913e4664?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0","to_inclusive":true,"patched_in":"1.57.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:22Z"},{"id":"wordfence:21bcb740-6340-4ff7-815f-539175936ca1","source":"wordfence","cve":"CVE-2024-24707","title":"Cwicly <= 1.4.0.2 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21bcb740-6340-4ff7-815f-539175936ca1?source=api-prod","affected":[{"type":"plugin","slug":"cwicly","name":"Cwicly","from":"*","from_inclusive":true,"to":"1.4.0.2","to_inclusive":true,"patched_in":"1.4.0.3"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T19:31:18Z"},{"id":"wordfence:21be2215-8ce0-438e-94e0-6a350b8cc952","source":"wordfence","cve":"CVE-2024-4845","title":"Icegram Express  <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21be2215-8ce0-438e-94e0-6a350b8cc952?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.22","to_inclusive":true,"patched_in":"5.7.23"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-12T09:33:11Z"},{"id":"wordfence:21c09207-38a1-47ae-ae1e-52f8eea4785d","source":"wordfence","cve":"CVE-2024-11325","title":"AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21c09207-38a1-47ae-ae1e-52f8eea4785d?source=api-prod","affected":[{"type":"plugin","slug":"aweber-wp","name":"AWeber Forms by Optin Cat","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-12-02T21:31:48Z","updated":"2024-12-03T09:32:01Z"},{"id":"wordfence:21c31df6-7515-48f5-ad74-fe116e836da8","source":"wordfence","cve":"CVE-2022-47592","title":"MagicForm <= 0.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21c31df6-7515-48f5-ad74-fe116e836da8?source=api-prod","affected":[{"type":"plugin","slug":"magicform","name":"MagicForm","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21c87602-bbe7-4fde-8ba2-031120212a8b","source":"wordfence","cve":"","title":"WP Symposium < 15.8 - Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21c87602-bbe7-4fde-8ba2-031120212a8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"15.8","to_inclusive":false,"patched_in":"15.8"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21ca7d14-a6b1-4d02-81c7-bfc5623c4818","source":"wordfence","cve":"CVE-2025-48079","title":"ProfileGrid  <= 5.9.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ca7d14-a6b1-4d02-81c7-bfc5623c4818?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.1","to_inclusive":true,"patched_in":"5.9.5.2"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:56:08Z"},{"id":"wordfence:21cb424c-4efd-4c12-a08a-6d574f118c28","source":"wordfence","cve":"CVE-2023-2439","title":"UserPro <= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cb424c-4efd-4c12-a08a-6d574f118c28?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"5.1.5","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-31T02:35:10Z"},{"id":"wordfence:21cc3f71-7591-4111-a58a-d863df74587f","source":"wordfence","cve":"CVE-2022-4016","title":"Booster (<= 5.6.6), Booster Plus (<= 5.6.5), and Booster Elite (<= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cc3f71-7591-4111-a58a-d863df74587f?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.6.6"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"},{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21cc5aec-ab5f-412b-aed0-bb41584a84cf","source":"wordfence","cve":"CVE-2023-39919","title":"wpShopGermany - Protected Shops <= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cc5aec-ab5f-412b-aed0-bb41584a84cf?source=api-prod","affected":[{"type":"plugin","slug":"wpshopgermany-protectedshops","name":"wpShopGermany \u2013 Protected Shops","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21ccb2cc-6ae2-4a2e-9daa-3f0d57caedce","source":"wordfence","cve":"CVE-2026-54846","title":"Syncee Premium Dropshipping & Wholesale <= 1.0.27 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ccb2cc-6ae2-4a2e-9daa-3f0d57caedce?source=api-prod","affected":[{"type":"plugin","slug":"syncee-global-dropshipping","name":"Syncee Premium Dropshipping & Wholesale","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.0.28"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:35:36Z"},{"id":"wordfence:21cd81aa-c3f2-4413-8a07-06c065f47569","source":"wordfence","cve":"CVE-2024-37239","title":"Branda <= 3.4.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cd81aa-c3f2-4413-8a07-06c065f47569?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.17","to_inclusive":true,"patched_in":"3.4.18"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:42:31Z"},{"id":"wordfence:21cd8cb8-2a29-4b66-ab7a-8d8b2f85e2e0","source":"wordfence","cve":"CVE-2025-11517","title":"Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cd8cb8-2a29-4b66-ab7a-8d8b2f85e2e0?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.26.5","to_inclusive":true,"patched_in":"5.26.6"}],"published":"2025-10-17T18:07:22Z","updated":"2025-10-18T06:42:44Z"},{"id":"wordfence:21cf5a39-831b-4423-b901-98bf15416fc8","source":"wordfence","cve":"CVE-2013-0291","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21cf5a39-831b-4423-b901-98bf15416fc8?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"1.9.10","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2013-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21d0af22-ecce-4533-ba5d-46d6f49fff52","source":"wordfence","cve":"CVE-2022-3984","title":"Flowerplayer Video Player <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d0af22-ecce-4533-ba5d-46d6f49fff52?source=api-prod","affected":[{"type":"plugin","slug":"flowplayer6-video-player","name":"Flowplayer Video Player","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21d1c8c9-dcfc-4368-acc2-67e4e3605f16","source":"wordfence","cve":"CVE-2025-67591","title":"JNews Paywall < 12.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d1c8c9-dcfc-4368-acc2-67e4e3605f16?source=api-prod","affected":[{"type":"plugin","slug":"jnews-paywall","name":"JNews Paywall","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":false,"patched_in":"12.0.1"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:58:12Z"},{"id":"wordfence:21d1feae-e70f-439d-8992-f136211fdde0","source":"wordfence","cve":"CVE-2024-0897","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d1feae-e70f-439d-8992-f136211fdde0?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.2","to_inclusive":true,"patched_in":"2.7.4.3"}],"published":"2024-02-20T00:00:00Z","updated":"2024-05-31T15:30:09Z"},{"id":"wordfence:21d244f4-f0cd-4d4d-8c6a-edea6b7b8145","source":"wordfence","cve":"CVE-2013-1401","title":"WordPress Poll <= 34.05 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d244f4-f0cd-4d4d-8c6a-edea6b7b8145?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-wordpress-poll","name":"WordPress Poll","from":"*","from_inclusive":true,"to":"34.05","to_inclusive":true,"patched_in":"34.06"}],"published":"2013-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21d79573-59af-44e4-b9b0-7fc712bae48c","source":"wordfence","cve":"CVE-2025-67929","title":"TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d79573-59af-44e4-b9b0-7fc712bae48c?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-20T20:22:33Z"},{"id":"wordfence:21d8a074-f38b-4799-a7c2-92a5e7142924","source":"wordfence","cve":"CVE-2025-32113","title":"Libro de Reclamaciones y Quejas <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21d8a074-f38b-4799-a7c2-92a5e7142924?source=api-prod","affected":[{"type":"plugin","slug":"libro-de-reclamaciones-y-quejas","name":"Libro de Reclamaciones y Quejas","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-04-04T00:00:00Z","updated":"2026-10-28T21:06:32Z"},{"id":"wordfence:21da3c10-72b9-4c04-8586-dcf6dcf55852","source":"wordfence","cve":"CVE-2024-37933","title":"Woocommerce OpenPos <= 6.4.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21da3c10-72b9-4c04-8586-dcf6dcf55852?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-openpos","name":"Openpos - WooCommerce Point Of Sale(POS)","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-27T13:29:39Z"},{"id":"wordfence:21da92d2-c38d-4a12-b850-bd0b580aaa54","source":"wordfence","cve":"CVE-2024-13907","title":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":4.9,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21da92d2-c38d-4a12-b850-bd0b580aaa54?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.16.8","to_inclusive":true,"patched_in":"1.16.9"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T06:48:39Z"},{"id":"wordfence:21dae604-4986-4ceb-ba58-88634b4bfe8c","source":"wordfence","cve":"CVE-2025-60079","title":"Parallax Section block <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dae604-4986-4ceb-ba58-88634b4bfe8c?source=api-prod","affected":[{"type":"plugin","slug":"parallax-section","name":"Parallax Section Block \u2013 Add Parallax Scrolling Effects to Sections","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-26T00:00:00Z","updated":"2025-12-20T15:41:27Z"},{"id":"wordfence:21dbe11c-8c9f-4b4c-98ef-3ba6eb5bb686","source":"wordfence","cve":"","title":"Universal Star Rating <= 1.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dbe11c-8c9f-4b4c-98ef-3ba6eb5bb686?source=api-prod","affected":[{"type":"plugin","slug":"universal-star-rating","name":"Universal Star Rating","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21dcb733-0477-46b3-a409-9823c03cbdca","source":"wordfence","cve":"CVE-2026-57630","title":"Blocksy Companion Pro <= 2.1.46 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dcb733-0477-46b3-a409-9823c03cbdca?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion-pro","name":"Blocksy Companion Pro","from":"*","from_inclusive":true,"to":"2.1.46","to_inclusive":true,"patched_in":"2.1.47"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:16:58Z"},{"id":"wordfence:21dd21cb-35b7-47df-a9f0-6fd92c45a8ce","source":"wordfence","cve":"CVE-2020-8799","title":"WTI Like Post <= 1.4.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dd21cb-35b7-47df-a9f0-6fd92c45a8ce?source=api-prod","affected":[{"type":"plugin","slug":"wti-like-post","name":"WTI Like Post","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"}],"published":"2020-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21dd2899-cb2d-4266-be79-bdf00e60e9a7","source":"wordfence","cve":"CVE-2021-3135","title":"Newspaper Lite < 11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dd2899-cb2d-4266-be79-bdf00e60e9a7?source=api-prod","affected":[{"type":"theme","slug":"newspaper-lite","name":"Newspaper Lite","from":"*","from_inclusive":true,"to":"10.3.9.1","to_inclusive":true,"patched_in":"11.0"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21dd96e0-8c1c-4593-8a75-079125192001","source":"wordfence","cve":"CVE-2020-27344","title":"CM Download Manager <= 2.7.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21dd96e0-8c1c-4593-8a75-079125192001?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2020-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21df75e6-1f3e-4a08-a620-92b44fb48899","source":"wordfence","cve":"CVE-2024-11867","title":"Companion Portfolio \u2013 Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21df75e6-1f3e-4a08-a620-92b44fb48899?source=api-prod","affected":[{"type":"plugin","slug":"companion-portfolio","name":"Companion Portfolio \u2013 Responsive Portfolio Plugin","from":"*","from_inclusive":true,"to":"2.4.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:48:18Z","updated":"2024-12-14T04:23:40Z"},{"id":"wordfence:21e06220-c8f0-4754-ba19-8df519be4038","source":"wordfence","cve":"CVE-2022-3302","title":"AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e06220-c8f0-4754-ba19-8df519be4038?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.185","to_inclusive":true,"patched_in":"5.185.1"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21e12c72-7898-4896-9852-ebb10e5f9a3b","source":"wordfence","cve":"CVE-2024-4448","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e12c72-7898-4896-9852-ebb10e5f9a3b?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.9.20"}],"published":"2024-05-09T19:32:53Z","updated":"2024-10-24T19:07:49Z"},{"id":"wordfence:21e397a4-0b32-4b13-a46b-c465acea0796","source":"wordfence","cve":"CVE-2026-2554","title":"WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e397a4-0b32-4b13-a46b-c465acea0796?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.25","to_inclusive":true,"patched_in":"6.7.26"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T13:26:13Z"},{"id":"wordfence:21e3d4a5-aaf3-4f42-8868-cd8c9bccd026","source":"wordfence","cve":"CVE-2022-0246","title":"iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip","severity":"medium","cvss":6.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e3d4a5-aaf3-4f42-8868-cd8c9bccd026?source=api-prod","affected":[{"type":"plugin","slug":"iq-block-country","name":"iQ Block Country","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":false,"patched_in":"1.2.13"}],"published":"2022-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21e49adb-01a7-41d9-bb51-bac60d49e293","source":"wordfence","cve":"CVE-2024-31381","title":"Spotlight Social Media Feeds <= 1.6.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e49adb-01a7-41d9-bb51-bac60d49e293?source=api-prod","affected":[{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.6.11"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:23:11Z"},{"id":"wordfence:21e4b1fe-993b-4898-a523-e0a858c30a38","source":"wordfence","cve":"","title":"TagGator Plugin < 1.33 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e4b1fe-993b-4898-a523-e0a858c30a38?source=api-prod","affected":[{"type":"plugin","slug":"taggator","name":"TagGator","from":"*","from_inclusive":true,"to":"1.33","to_inclusive":false,"patched_in":"1.33"}],"published":"2012-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21e7658d-b213-4e9c-b3c0-7a84654aa729","source":"wordfence","cve":"CVE-2024-51923","title":"Websand Subscription Form <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21e7658d-b213-4e9c-b3c0-7a84654aa729?source=api-prod","affected":[{"type":"plugin","slug":"websand-subscription-form","name":"Websand Subscription Form","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:21:19Z"},{"id":"wordfence:21ec0fc9-4fb2-43fd-aba5-8f452d35d7b8","source":"wordfence","cve":"CVE-2009-4170","title":"WP-Cumulus <= 1.20 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ec0fc9-4fb2-43fd-aba5-8f452d35d7b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-cumulus","name":"WP Cumulus","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":"1.23"}],"published":"2009-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21ede7f9-12ee-49ef-b645-b7cf3771ebd2","source":"wordfence","cve":"CVE-2026-88802","title":"Mobile Events Manager <= 1.4.8.3 & MDJM Event Management < 1.7.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ede7f9-12ee-49ef-b645-b7cf3771ebd2?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.5","to_inclusive":false,"patched_in":"1.7.8.5"},{"type":"plugin","slug":"mobile-events-manager","name":"Mobile Events Manager","from":"*","from_inclusive":true,"to":"1.4.8.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:27:40Z"},{"id":"wordfence:21f710ee-5040-4916-9fde-efc6d3b90943","source":"wordfence","cve":"CVE-2023-39917","title":"Photo Gallery by Ays <= 5.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21f710ee-5040-4916-9fde-efc6d3b90943?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21f8908c-bcfc-4ca1-bc8b-80a80c4a5a4f","source":"wordfence","cve":"CVE-2024-7147","title":"JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8908c-bcfc-4ca1-bc8b-80a80c4a5a4f?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.12.1"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T10:59:54Z"},{"id":"wordfence:21f8f5be-b513-4040-af39-c1a61d7e313f","source":"wordfence","cve":"CVE-2025-3404","title":"Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8f5be-b513-4040-af39-c1a61d7e313f?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2025-04-18T18:52:05Z","updated":"2025-04-19T07:23:40Z"},{"id":"wordfence:21f917a4-efee-421b-98b1-a9b18c7527d2","source":"wordfence","cve":"CVE-2023-46606","title":"AtomChat <= 1.1.4 - Missing Authorization via credits REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21f917a4-efee-421b-98b1-a9b18c7527d2?source=api-prod","affected":[{"type":"plugin","slug":"atomchat","name":"Group Chat & Video Chat by AtomChat","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-10-24T00:00:00Z","updated":"2024-10-30T17:50:07Z"},{"id":"wordfence:21fb5a51-f1e6-49d2-8289-4f4146bc9b28","source":"wordfence","cve":"CVE-2017-18503","title":"Twitter Cards Meta \u2013 Best Twitter Card Plugin for WordPress < 2.5.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21fb5a51-f1e6-49d2-8289-4f4146bc9b28?source=api-prod","affected":[{"type":"plugin","slug":"twitter-cards-meta","name":"Twitter Cards Meta \u2013 Best Twitter Card Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2017-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:21fe167a-9925-438d-974d-66bbe676ed29","source":"wordfence","cve":"CVE-2025-32479","title":"Flags Widget <= 1.0.7 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21fe167a-9925-438d-974d-66bbe676ed29?source=api-prod","affected":[{"type":"plugin","slug":"flags-widget","name":"Flags Widget","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:35:45Z"},{"id":"wordfence:21fed5a3-1bb2-4581-95b4-badff98bed42","source":"wordfence","cve":"CVE-2024-3266","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21fed5a3-1bb2-4581-95b4-badff98bed42?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-09T18:58:38Z"},{"id":"wordfence:21ffbb00-7c84-4d00-9a7f-0e412d8d5ed7","source":"wordfence","cve":"CVE-2025-10660","title":"WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/21ffbb00-7c84-4d00-9a7f-0e412d8d5ed7?source=api-prod","affected":[{"type":"plugin","slug":"wp-dashboard-chat","name":"WP Dashboard Chat","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T20:03:22Z","updated":"2025-10-15T08:25:50Z"},{"id":"wordfence:220055ff-683c-47a4-8817-b3e70bb9dc81","source":"wordfence","cve":"","title":"Adapta RGPD <= 1.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220055ff-683c-47a4-8817-b3e70bb9dc81?source=api-prod","affected":[{"type":"plugin","slug":"adapta-rgpd","name":"Adapta RGPD","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22005d74-de46-4b0b-baaf-0bfd69d01240","source":"wordfence","cve":"CVE-2025-32588","title":"Credova_Financial <= 2.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22005d74-de46-4b0b-baaf-0bfd69d01240?source=api-prod","affected":[{"type":"plugin","slug":"credova-financial","name":"Credova Financial","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-21T14:17:57Z"},{"id":"wordfence:220133fe-ebf3-4cfe-8882-1c961b384ff3","source":"wordfence","cve":"CVE-2018-11105","title":"3CX Live Chat <= 8.0.07 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220133fe-ebf3-4cfe-8882-1c961b384ff3?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.07","to_inclusive":true,"patched_in":"8.0.08"}],"published":"2018-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22025f2d-763a-4dbf-bad9-b71934195f78","source":"wordfence","cve":"CVE-2025-49407","title":"Houzez <= 4.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22025f2d-763a-4dbf-bad9-b71934195f78?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:10:43Z"},{"id":"wordfence:2204017a-0363-4f2f-909a-e0826463477c","source":"wordfence","cve":"CVE-2023-30782","title":"Church Admin <= 3.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2204017a-0363-4f2f-909a-e0826463477c?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:220487de-2a1c-47ec-ac65-db1af44aed3d","source":"wordfence","cve":"CVE-2025-11741","title":"WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220487de-2a1c-47ec-ac65-db1af44aed3d?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-quick-view","name":"WPC Smart Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2025-10-17T18:24:47Z","updated":"2025-10-18T06:42:44Z"},{"id":"wordfence:2205a0c8-0834-440b-9fee-3223de05a3ac","source":"wordfence","cve":"CVE-2024-56000","title":"K Elements <= 5.3.9 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2205a0c8-0834-440b-9fee-3223de05a3ac?source=api-prod","affected":[{"type":"plugin","slug":"k-elements","name":"K Elements","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-26T21:39:13Z"},{"id":"wordfence:22074d7a-5dbd-4a0c-bc5d-e4c983e5edb4","source":"wordfence","cve":"CVE-2024-4150","title":"Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22074d7a-5dbd-4a0c-bc5d-e4c983e5edb4?source=api-prod","affected":[{"type":"plugin","slug":"simple-basic-contact-form","name":"Simple Basic Contact Form","from":"*","from_inclusive":true,"to":"20221201","to_inclusive":true,"patched_in":"20240502"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:20Z"},{"id":"wordfence:22076415-c093-4c8f-b7bc-108d203185e3","source":"wordfence","cve":"CVE-2026-12500","title":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22076415-c093-4c8f-b7bc-108d203185e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"6.8.2"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T22:52:24Z"},{"id":"wordfence:220766ef-29a6-46f6-8c67-d1879db79400","source":"wordfence","cve":"CVE-2023-37993","title":"wpShopGermany IT-RECHT KANZLEI <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220766ef-29a6-46f6-8c67-d1879db79400?source=api-prod","affected":[{"type":"plugin","slug":"wpshopgermany-it-recht-kanzlei","name":"wpShopGermany IT-RECHT KANZLEI","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:220b0e71-8e80-4a29-982e-259a475835fe","source":"wordfence","cve":"CVE-2024-9887","title":"Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220b0e71-8e80-4a29-982e-259a475835fe?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-wp-as-saml-idp","name":"SAML IDP (Identity Provider) \u2013 Login with Website Users","from":"*","from_inclusive":true,"to":"1.15.6","to_inclusive":true,"patched_in":"1.15.7"}],"published":"2024-11-15T20:41:13Z","updated":"2024-11-16T09:36:34Z"},{"id":"wordfence:220bafb6-2d34-4ee2-88a2-3913911bbea6","source":"wordfence","cve":"CVE-2024-51638","title":"Awesome Shortcodes For Genesis  1.1.8 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220bafb6-2d34-4ee2-88a2-3913911bbea6?source=api-prod","affected":[{"type":"plugin","slug":"awesome-shortcodes-for-genesis","name":"Awesome Shortcodes For Genesis","from":"1.1.8","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:40:42Z"},{"id":"wordfence:220ca462-6a5b-440e-badf-d253e2b6b1f0","source":"wordfence","cve":"CVE-2024-0237","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220ca462-6a5b-440e-badf-d253e2b6b1f0?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-12T14:55:17Z"},{"id":"wordfence:220e47ca-3a5d-492f-9c16-44c12e4668ae","source":"wordfence","cve":"CVE-2026-40805","title":"PeepSo <= 9.0.5.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/220e47ca-3a5d-492f-9c16-44c12e4668ae?source=api-prod","affected":[{"type":"plugin","slug":"peepso","name":"peepso","from":"*","from_inclusive":true,"to":"9.0.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T16:25:54Z"},{"id":"wordfence:2210b056-49d4-4212-8e65-1215c71b7e9a","source":"wordfence","cve":"CVE-2024-39629","title":"Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2210b056-49d4-4212-8e65-1215c71b7e9a?source=api-prod","affected":[{"type":"theme","slug":"himalayas","name":"Himalayas","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-22T00:00:00Z","updated":"2024-09-03T16:37:45Z"},{"id":"wordfence:2211d0d0-e7ab-485f-81b0-f52f87b7d01e","source":"wordfence","cve":"CVE-2016-1160","title":"WP Favorite Posts <= 1.6.5 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2211d0d0-e7ab-485f-81b0-f52f87b7d01e?source=api-prod","affected":[{"type":"plugin","slug":"wp-favorite-posts","name":"WP Favorite Posts","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2016-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2212585b-1437-40a8-a5da-5b5c9f88c365","source":"wordfence","cve":"CVE-2026-9175","title":"Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2212585b-1437-40a8-a5da-5b5c9f88c365?source=api-prod","affected":[{"type":"plugin","slug":"devs-accounting","name":"Devs Accounting \u2013 Simple Accounting and Invoicing Solution","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-06-23T16:39:37Z","updated":"2026-07-22T20:44:48Z"},{"id":"wordfence:2214264d-0f3e-455b-9420-c6a1e0d7562c","source":"wordfence","cve":"CVE-2023-47188","title":"Simple Job Board <= 2.10.5 - Missing Authorization","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2214264d-0f3e-455b-9420-c6a1e0d7562c?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.6"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22143fe3-e599-4b44-99c0-ba66d88ff5d6","source":"wordfence","cve":"CVE-2024-11918","title":"Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22143fe3-e599-4b44-99c0-ba66d88ff5d6?source=api-prod","affected":[{"type":"plugin","slug":"image-alt-text","name":"Image Alt Text","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:06:42Z"},{"id":"wordfence:2216d82c-29ae-4355-8118-6ebc49726c12","source":"wordfence","cve":"CVE-2025-12366","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2216d82c-29ae-4355-8118-6ebc49726c12?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-11-12T15:20:40Z","updated":"2025-11-13T03:27:37Z"},{"id":"wordfence:22172d16-bcde-4516-bce0-222fbb7a76f7","source":"wordfence","cve":"CVE-2026-5137","title":"RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22172d16-bcde-4516-bce0-222fbb7a76f7?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-07-02T21:01:30Z","updated":"2026-07-06T16:32:55Z"},{"id":"wordfence:22175f1f-1dc0-45a1-a72e-3135ea6de7fc","source":"wordfence","cve":"CVE-2026-13604","title":"Pixelavo \u2013 Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22175f1f-1dc0-45a1-a72e-3135ea6de7fc?source=api-prod","affected":[{"type":"plugin","slug":"pixelavo","name":"Pixelavo \u2013 Server Side Tracking & Pixel + AI Ads Tools","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:13:45Z"},{"id":"wordfence:221872e2-7929-4fba-8a57-7d9fd73a76db","source":"wordfence","cve":"CVE-2010-5297","title":"WordPress Core < 3.0.1 - Missing Authorization","severity":"medium","cvss":4.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221872e2-7929-4fba-8a57-7d9fd73a76db?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2010-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:221a8ff6-1f6e-41a0-82ef-eaa14ff84a26","source":"wordfence","cve":"CVE-2014-4594","title":"WordPress Responsive Preview <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221a8ff6-1f6e-41a0-82ef-eaa14ff84a26?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-preview","name":"WordPress Responsive Preview","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:221be0f2-61ee-4130-be4a-0df72d3e0197","source":"wordfence","cve":"CVE-2024-5799","title":"CM Pop-Up Banners <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221be0f2-61ee-4130-be4a-0df72d3e0197?source=api-prod","affected":[{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-04T15:39:54Z"},{"id":"wordfence:221c62a8-09c9-405a-bddf-06638437bd39","source":"wordfence","cve":"CVE-2026-8494","title":"Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221c62a8-09c9-405a-bddf-06638437bd39?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.5.3.3","to_inclusive":true,"patched_in":"2.5.3.4"}],"published":"2026-06-16T17:40:02Z","updated":"2026-06-17T06:49:40Z"},{"id":"wordfence:221dab8e-2f8d-47d7-b9f5-a2f0d4edcef7","source":"wordfence","cve":"CVE-2026-6381","title":"WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221dab8e-2f8d-47d7-b9f5-a2f0d4edcef7?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":false,"patched_in":"4.9.3"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:34:40Z"},{"id":"wordfence:221f9cbb-7988-4671-8f14-da3e63c280e6","source":"wordfence","cve":"CVE-2018-19796","title":"Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/221f9cbb-7988-4671-8f14-da3e63c280e6?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.3.19.1"}],"published":"2018-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:222079a2-20f1-4d53-8420-46ccc50988a8","source":"wordfence","cve":"CVE-2026-65437","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222079a2-20f1-4d53-8420-46ccc50988a8?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.82","to_inclusive":true,"patched_in":"6.83"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:22:42Z"},{"id":"wordfence:222241ce-f534-435a-8667-8cc1d527ef95","source":"wordfence","cve":"CVE-2026-2390","title":"Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222241ce-f534-435a-8667-8cc1d527ef95?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-07T11:27:25Z"},{"id":"wordfence:222325e9-3048-45f7-9a66-a713d096d44e","source":"wordfence","cve":"CVE-2021-24932","title":"Auto Featured Image <= 3.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222325e9-3048-45f7-9a66-a713d096d44e?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22245bb5-a310-4cd2-98e3-6611e71ff7fa","source":"wordfence","cve":"CVE-2024-9585","title":"Image Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22245bb5-a310-4cd2-98e3-6611e71ff7fa?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images","from":"*","from_inclusive":true,"to":"6.0.20","to_inclusive":true,"patched_in":"6.0.21"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T17:32:19Z"},{"id":"wordfence:2224b17e-e327-4b86-85db-ad878f989839","source":"wordfence","cve":"","title":"QAEngine <= 1.4 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2224b17e-e327-4b86-85db-ad878f989839?source=api-prod","affected":[{"type":"theme","slug":"qaengine","name":"QAEngine","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2015-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:222639d6-37b1-4323-ac37-6b7a43438451","source":"wordfence","cve":"CVE-2026-78068","title":"Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222639d6-37b1-4323-ac37-6b7a43438451?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-table-field","name":"Table Field Add-on for ACF and SCF","from":"*","from_inclusive":true,"to":"1.3.35","to_inclusive":true,"patched_in":"1.3.40"}],"published":"2026-10-09T17:04:35Z","updated":"2026-10-10T05:30:57Z"},{"id":"wordfence:22263d92-e434-45c2-8a71-0effd9b2a361","source":"wordfence","cve":"CVE-2026-62015","title":"Gamezone <= 1.1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22263d92-e434-45c2-8a71-0effd9b2a361?source=api-prod","affected":[{"type":"theme","slug":"gamezone","name":"gamezone","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:37:07Z"},{"id":"wordfence:222678d0-cb1f-43c6-a6f0-37ea0be8cd3d","source":"wordfence","cve":"CVE-2021-25066","title":"Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222678d0-cb1f-43c6-a6f0-37ea0be8cd3d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.6.11"}],"published":"2022-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2227cde8-5ed6-44dd-80cc-2a85aaa172c1","source":"wordfence","cve":"CVE-2024-30456","title":"WPCS <= 1.2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2227cde8-5ed6-44dd-80cc-2a85aaa172c1?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.2.0.1","to_inclusive":true,"patched_in":"1.2.0.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T17:06:58Z"},{"id":"wordfence:22283650-36bf-43e5-a57e-a91025fb2af7","source":"wordfence","cve":"CVE-2024-5703","title":"Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22283650-36bf-43e5-a57e-a91025fb2af7?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.26","to_inclusive":true,"patched_in":"5.7.27"}],"published":"2024-07-16T18:52:06Z","updated":"2024-08-02T14:43:04Z"},{"id":"wordfence:222848a7-e079-4d56-9917-ec1d916efdcf","source":"wordfence","cve":"CVE-2025-46541","title":"WP-reCAPTCHA-bp <= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222848a7-e079-4d56-9917-ec1d916efdcf?source=api-prod","affected":[{"type":"plugin","slug":"wp-recaptcha-bp","name":"WP-reCAPTCHA-bp","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:45:14Z"},{"id":"wordfence:22293238-3b0d-417a-8daf-68bbf0389d19","source":"wordfence","cve":"CVE-2026-84849","title":"Pre-Orders for WooCommerce <= 2.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22293238-3b0d-417a-8daf-68bbf0389d19?source=api-prod","affected":[{"type":"plugin","slug":"pre-orders-for-woocommerce","name":"Pre-Orders for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-09-03T00:00:00Z","updated":"2026-11-10T23:20:00Z"},{"id":"wordfence:222aa8cb-95f4-4fe1-82c8-3acf82960cc0","source":"wordfence","cve":"CVE-2024-30178","title":"Simply Static <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222aa8cb-95f4-4fe1-82c8-3acf82960cc0?source=api-prod","affected":[{"type":"plugin","slug":"simply-static","name":"Simply Static \u2013 The Static Site Generator","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:48:42Z"},{"id":"wordfence:222cd8a3-39d4-40d6-8687-0e927ed48e07","source":"wordfence","cve":"CVE-2026-39071","title":"Spiffy Calendar <= 5.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222cd8a3-39d4-40d6-8687-0e927ed48e07?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-16T18:23:21Z"},{"id":"wordfence:222db62c-8ffc-4b79-8f04-101caf82186d","source":"wordfence","cve":"CVE-2025-62047","title":"Case Addons < 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222db62c-8ffc-4b79-8f04-101caf82186d?source=api-prod","affected":[{"type":"plugin","slug":"case-addons","name":"Case Addons","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-29T15:59:18Z"},{"id":"wordfence:222e0f27-f269-4751-9544-1a6cb03ab3a7","source":"wordfence","cve":"CVE-2026-16310","title":"MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7?source=api-prod","affected":[{"type":"plugin","slug":"memberdash","name":"MemberDash","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2026-09-05T13:51:16Z","updated":"2026-09-06T02:26:51Z"},{"id":"wordfence:222f9d6b-2b97-4531-b085-bf3c8f9d89d7","source":"wordfence","cve":"CVE-2025-64209","title":"Masterstudy < 4.8.122 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222f9d6b-2b97-4531-b085-bf3c8f9d89d7?source=api-prod","affected":[{"type":"theme","slug":"masterstudy","name":"Masterstudy - Education WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.122","to_inclusive":false,"patched_in":"4.8.122"}],"published":"2025-10-12T00:00:00Z","updated":"2025-12-20T19:03:33Z"},{"id":"wordfence:222fab17-65bf-43af-9a42-475fd2643a69","source":"wordfence","cve":"CVE-2026-57711","title":"SupportCandy \u2013 AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/222fab17-65bf-43af-9a42-475fd2643a69?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:32:26Z"},{"id":"wordfence:223373fc-9d78-47f0-b283-109f8e00b802","source":"wordfence","cve":"CVE-2022-2461","title":"Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2025-07-21T14:11:04Z"},{"id":"wordfence:22337457-f040-489a-a6a5-d8cfcec329b5","source":"wordfence","cve":"CVE-2026-32564","title":"ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22337457-f040-489a-a6a5-d8cfcec329b5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-post-type","name":"ACPT (Premium)","from":"*","from_inclusive":true,"to":"2.0.63","to_inclusive":true,"patched_in":""}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:51:07Z"},{"id":"wordfence:22345e9c-e654-4c72-b452-ed340f9ef6c1","source":"wordfence","cve":"CVE-2025-31765","title":"GDPR Cookie Notice <= 1.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22345e9c-e654-4c72-b452-ed340f9ef6c1?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-notice","name":"GDPR Cookie Notice","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:22:12Z"},{"id":"wordfence:22351b90-fc34-44ce-9241-4a0f01eb7b1c","source":"wordfence","cve":"CVE-2025-15001","title":"FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1c?source=api-prod","affected":[{"type":"plugin","slug":"registration-password","name":"FS Registration Password","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-05T16:31:31Z","updated":"2026-01-06T04:31:55Z"},{"id":"wordfence:22356f42-af5e-4479-919c-9ceac42e686f","source":"wordfence","cve":"CVE-2014-9473","title":"cformsII < 14.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22356f42-af5e-4479-919c-9ceac42e686f?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"14.8","to_inclusive":false,"patched_in":"14.8"}],"published":"2014-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2238c9ba-6d00-4a21-a050-7b8a5f307964","source":"wordfence","cve":"","title":"WordPress Facebook <= 1.0.13 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2238c9ba-6d00-4a21-a050-7b8a5f307964?source=api-prod","affected":[{"type":"plugin","slug":"spider-facebook","name":"WDSocialWidgets","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2017-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22399b2a-75e5-428d-a9a2-8b42e23c1825","source":"wordfence","cve":"CVE-2026-119163","title":"FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22399b2a-75e5-428d-a9a2-8b42e23c1825?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.8.5.2","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-10-30T18:36:44Z","updated":"2026-10-31T06:44:15Z"},{"id":"wordfence:223a6c35-712a-458c-8708-6981c9041fe1","source":"wordfence","cve":"CVE-2023-39158","title":"Woocommerce Category Banner Management <= 2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223a6c35-712a-458c-8708-6981c9041fe1?source=api-prod","affected":[{"type":"plugin","slug":"banner-management-for-woocommerce","name":"Banner Management For WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:223ace0a-5a98-4714-90d5-06fe96bc9a2d","source":"wordfence","cve":"CVE-2014-9396","title":"SimpleFlickr <= 3.0.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223ace0a-5a98-4714-90d5-06fe96bc9a2d?source=api-prod","affected":[{"type":"plugin","slug":"simpleflickr","name":"simpleflickr","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2015-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:223d62cc-61ee-4818-9521-a772c1d57d59","source":"wordfence","cve":"CVE-2025-14887","title":"twinklesmtp \u2013 Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223d62cc-61ee-4818-9521-a772c1d57d59?source=api-prod","affected":[{"type":"plugin","slug":"twinklesmtp","name":"twinklesmtp \u2013 Email Service Provider For WordPress","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:34:10Z","updated":"2026-01-07T06:35:59Z"},{"id":"wordfence:2240b2d3-b4cc-445f-b207-0ccbd527a0f3","source":"wordfence","cve":"","title":"RokStories <= 1.25 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2240b2d3-b4cc-445f-b207-0ccbd527a0f3?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokstories","name":"RokStories","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2241fa07-b6b7-4e5d-8951-ae844a7b88e8","source":"wordfence","cve":"CVE-2023-25796","title":"WP BaiDu Submit <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2241fa07-b6b7-4e5d-8951-ae844a7b88e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-baidu-submit","name":"WP BaiDu Submit","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22420c2d-788c-4577-ae54-7b48f6063f5d","source":"wordfence","cve":"CVE-2024-1128","title":"Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A","severity":"medium","cvss":5.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22420c2d-788c-4577-ae54-7b48f6063f5d?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-31T15:39:51Z"},{"id":"wordfence:224233bc-68f3-40e4-8182-4831ccce93fb","source":"wordfence","cve":"CVE-2024-31077","title":"Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/224233bc-68f3-40e4-8182-4831ccce93fb?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.29.2","to_inclusive":true,"patched_in":"1.29.3"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-24T12:56:55Z"},{"id":"wordfence:2242c86e-c769-4104-b266-0cdcd90ccf63","source":"wordfence","cve":"CVE-2025-10310","title":"Rich Snippet Site Report <= 2.0.0105 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2242c86e-c769-4104-b266-0cdcd90ccf63?source=api-prod","affected":[{"type":"plugin","slug":"easysnippet","name":"Rich Snippet Site Report","from":"*","from_inclusive":true,"to":"2.0.0105","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:47:01Z","updated":"2025-10-15T08:25:51Z"},{"id":"wordfence:22445eb5-b37b-4bdb-95cc-d07b8630cd84","source":"wordfence","cve":"CVE-2025-32250","title":"Rollbar <= 2.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22445eb5-b37b-4bdb-95cc-d07b8630cd84?source=api-prod","affected":[{"type":"plugin","slug":"rollbar","name":"Rollbar","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-10-21T20:16:12Z"},{"id":"wordfence:2244945a-5b3a-463d-9910-46a6f7afaf6c","source":"wordfence","cve":"CVE-2025-13367","title":"User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2025-12-15T02:13:58Z","updated":"2025-12-15T14:25:11Z"},{"id":"wordfence:22476135-8951-4012-845b-46a5dfbfc1f5","source":"wordfence","cve":"","title":"Gallery PhotoBlocks <= 1.1.5 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22476135-8951-4012-845b-46a5dfbfc1f5?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2020-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22479c6a-83ea-4c09-b192-4384ffbdcbf7","source":"wordfence","cve":"CVE-2023-33326","title":"EventPrime <= 2.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22479c6a-83ea-4c09-b192-4384ffbdcbf7?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2249ef72-9955-4636-b32f-e88720923268","source":"wordfence","cve":"CVE-2025-10488","title":"Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2249ef72-9955-4636-b32f-e88720923268?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.4.8","to_inclusive":true,"patched_in":"8.4.9"}],"published":"2025-10-24T17:34:40Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:224a2d6d-7fdc-43a8-a8c9-26213b604433","source":"wordfence","cve":"CVE-2024-5021","title":"WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery","severity":"critical","cvss":9.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/224a2d6d-7fdc-43a8-a8c9-26213b604433?source=api-prod","affected":[{"type":"plugin","slug":"nimble-portfolio","name":"WordPress Picture / Portfolio / Media Gallery","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T14:30:24Z","updated":"2024-06-19T03:12:28Z"},{"id":"wordfence:224a3ca4-954e-4e39-adc7-2a37d1a7a026","source":"wordfence","cve":"CVE-2025-58877","title":"Javo Core <= 3.0.0.529 - Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/224a3ca4-954e-4e39-adc7-2a37d1a7a026?source=api-prod","affected":[{"type":"plugin","slug":"javo-core","name":"Javo Core","from":"*","from_inclusive":true,"to":"3.0.0.529","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-12-19T21:59:46Z"},{"id":"wordfence:224a9234-2cf3-48ca-878e-3d7207629beb","source":"wordfence","cve":"CVE-2022-2937","title":"Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Title & Description","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/224a9234-2cf3-48ca-878e-3d7207629beb?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.3","to_inclusive":true,"patched_in":"9.8.0"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:224bf516-fac7-492f-87b9-912472ca01c9","source":"wordfence","cve":"CVE-2024-43948","title":"WP Armour Extended <= 1.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/224bf516-fac7-492f-87b9-912472ca01c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-armour-extended","name":"WP Armour Extended","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.32"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:16:25Z"},{"id":"wordfence:22506d45-40db-47c4-91b2-ab4f49703bf9","source":"wordfence","cve":"CVE-2023-34178","title":"Groundhogg <= 2.7.11 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22506d45-40db-47c4-91b2-ab4f49703bf9?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.7.11.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2250d512-dfe0-47d3-a61f-4e501d105f30","source":"wordfence","cve":"CVE-2023-49187","title":"Adifier (Premium Theme) < 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2250d512-dfe0-47d3-a61f-4e501d105f30?source=api-prod","affected":[{"type":"theme","slug":"adifier","name":"adifier","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2250fa2d-82f5-4553-a52e-0c43d215aaba","source":"wordfence","cve":"CVE-2007-5800","title":"BackUpWordPress <= 0.4.2b - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2250fa2d-82f5-4553-a52e-0c43d215aaba?source=api-prod","affected":[{"type":"plugin","slug":"backupwordpress","name":"BackUpWordPress","from":"*","from_inclusive":true,"to":"0.4.3","to_inclusive":false,"patched_in":"0.4.3"}],"published":"2007-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:225123aa-1ef9-4431-b4b1-b5ac5e034ef4","source":"wordfence","cve":"CVE-2022-22735","title":"Simple Quotation <= 1.3.2 - SQL injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225123aa-1ef9-4431-b4b1-b5ac5e034ef4?source=api-prod","affected":[{"type":"plugin","slug":"simple-quotation","name":"Simple Quotation","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2253cb38-3688-4e4d-afd1-582c8743c89a","source":"wordfence","cve":"","title":"301 Redirects - Easy Redirect Manager <= 2.72 - Cross-Site Request Forgery via dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2253cb38-3688-4e4d-afd1-582c8743c89a?source=api-prod","affected":[{"type":"plugin","slug":"eps-301-redirects","name":"301 Redirects \u2013 Redirect Manager","from":"*","from_inclusive":true,"to":"2.72","to_inclusive":true,"patched_in":"2.73"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:225900ea-ab59-4864-a65b-583730d2703f","source":"wordfence","cve":"CVE-2022-23911","title":"AP Custom Testimonial <= 1.4.7 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225900ea-ab59-4864-a65b-583730d2703f?source=api-prod","affected":[{"type":"plugin","slug":"ap-custom-testimonial","name":"Testimonial WordPress Plugin \u2013 AP Custom Testimonial","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2022-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:225916f2-b582-47e6-a603-54e5e28fda41","source":"wordfence","cve":"CVE-2025-50029","title":"AI Tools <= 4.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225916f2-b582-47e6-a603-54e5e28fda41?source=api-prod","affected":[{"type":"plugin","slug":"artificial-intelligence-auto-content-generator","name":"AI Tools \u2013 Chatbot, ChatGPT, Content Generator, Image Generator, Artificial Intelligence GPT","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:44:17Z"},{"id":"wordfence:2259ae51-447c-431d-97af-7fddefb0f349","source":"wordfence","cve":"CVE-2025-32926","title":"Grand Restaurant WordPress <= 7.0 - Unauthenticated PHP Object Injection via Path Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2259ae51-447c-431d-97af-7fddefb0f349?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:14:52Z"},{"id":"wordfence:225ac126-7448-4faf-92c7-ee96831b272e","source":"wordfence","cve":"CVE-2023-32105","title":"WPPizza <= 3.17.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225ac126-7448-4faf-92c7-ee96831b272e?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.17.1","to_inclusive":true,"patched_in":"3.17.2"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:225cfe20-e927-4c5d-8314-092738c30fa9","source":"wordfence","cve":"CVE-2026-88928","title":"PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225cfe20-e927-4c5d-8314-092738c30fa9?source=api-prod","affected":[{"type":"plugin","slug":"paytpv-for-woocommerce","name":"PAYCOMET for WooCommerce","from":"5.36","from_inclusive":true,"to":"5.45","to_inclusive":true,"patched_in":"5.46"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T22:17:42Z"},{"id":"wordfence:225ea5b3-08a9-40c2-a755-7783475946c4","source":"wordfence","cve":"CVE-2022-47167","title":"Crayon Syntax Highlighter <= 2.8.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/225ea5b3-08a9-40c2-a755-7783475946c4?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22602d63-235a-4bdb-b907-e61be04e96c5","source":"wordfence","cve":"","title":"WP Easy Gallery <= 1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22602d63-235a-4bdb-b907-e61be04e96c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2263d356-b2ed-4e16-98ee-b01d4274d1d9","source":"wordfence","cve":"CVE-2025-12633","title":"Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2263d356-b2ed-4e16-98ee-b01d4274d1d9?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-11-11T19:23:08Z","updated":"2025-11-12T07:27:43Z"},{"id":"wordfence:22652d78-577c-4467-9b6e-55811ebf6412","source":"wordfence","cve":"CVE-2026-48888","title":"WooCommerce < 11.1.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22652d78-577c-4467-9b6e-55811ebf6412?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":false,"patched_in":"11.1.0"}],"published":"2026-09-07T12:18:19Z","updated":"2026-09-10T19:27:00Z"},{"id":"wordfence:226baf3e-1b28-4196-9438-0b17fef4c5af","source":"wordfence","cve":"CVE-2024-11229","title":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/226baf3e-1b28-4196-9438-0b17fef4c5af?source=api-prod","affected":[{"type":"plugin","slug":"mshop-naver-talktalk","name":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-11-22T23:35:08Z","updated":"2024-11-23T11:39:48Z"},{"id":"wordfence:226c312e-38f0-4dac-bf5a-bce6df24aacc","source":"wordfence","cve":"CVE-2026-14315","title":"Pixel Tag Manager for WooCommerce \u2013 Google Analytics 4, Google Ads, and More Pixels < 2.2.1 - Unauthenticated Conversion Forge","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/226c312e-38f0-4dac-bf5a-bce6df24aacc?source=api-prod","affected":[{"type":"plugin","slug":"pixel-manager-for-woocommerce","name":"Pixel Tag Manager for WooCommerce \u2013 Google Analytics 4, Google Ads, and More Pixels","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-14T12:39:56Z"},{"id":"wordfence:226dba48-e984-4149-bc0e-aacedb35bcdf","source":"wordfence","cve":"CVE-2025-23429","title":"Altima Lookbook Free for WooCommerce <= 1.1.0 - Refletced Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/226dba48-e984-4149-bc0e-aacedb35bcdf?source=api-prod","affected":[{"type":"plugin","slug":"altima-lookbook-free-for-woocommerce","name":"Altima Lookbook Free for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:02:40Z"},{"id":"wordfence:226e772e-6973-4ff0-9a02-5be503f292c8","source":"wordfence","cve":"CVE-2024-32700","title":"Kognetiks Chatbot for WordPress <= 2.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/226e772e-6973-4ff0-9a02-5be503f292c8?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-17T13:40:45Z"},{"id":"wordfence:226fa189-1ad7-467a-8274-b18e171f6448","source":"wordfence","cve":"CVE-2026-87918","title":"WPBot \u2013 AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/226fa189-1ad7-467a-8274-b18e171f6448?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.7","to_inclusive":false,"patched_in":"8.5.7"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:15:04Z"},{"id":"wordfence:2270b66f-b07c-44ce-b161-7b2123f8c21e","source":"wordfence","cve":"CVE-2026-9618","title":"PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2270b66f-b07c-44ce-b161-7b2123f8c21e?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"*","from_inclusive":true,"to":"1.120.46","to_inclusive":true,"patched_in":"1.120.47"}],"published":"2026-05-27T18:40:26Z","updated":"2026-05-28T06:45:39Z"},{"id":"wordfence:22713937-d834-46cf-83ec-6f9f61b548e3","source":"wordfence","cve":"","title":"Conditional Marketing Mailer for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22713937-d834-46cf-83ec-6f9f61b548e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode-site-under-construction","name":"WP Maintenance Mode & Site Under Construction","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.6"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22716408-8015-4ada-965b-4941a4b0e38c","source":"wordfence","cve":"CVE-2025-22353","title":"BVD Easy Gallery Manager <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22716408-8015-4ada-965b-4941a4b0e38c?source=api-prod","affected":[{"type":"plugin","slug":"bvd-easy-gallery-manager","name":"BVD Easy Gallery Manager","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:00:08Z"},{"id":"wordfence:22738841-b25c-4519-9b94-e64a3fdf6cea","source":"wordfence","cve":"CVE-2024-54227","title":"Minimum and Maximum Quantity for WooCommerce <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22738841-b25c-4519-9b94-e64a3fdf6cea?source=api-prod","affected":[{"type":"plugin","slug":"min-and-max-quantity-for-woocommerce","name":"Minimum and Maximum Quantity for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-06T15:16:14Z"},{"id":"wordfence:2273f637-a80d-46af-8ce6-dfcd25a87679","source":"wordfence","cve":"CVE-2025-47645","title":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2273f637-a80d-46af-8ce6-dfcd25a87679?source=api-prod","affected":[{"type":"plugin","slug":"elex-bulk-edit-products-prices-attributes-for-woocommerce-basic","name":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-21T20:49:56Z"},{"id":"wordfence:2274a464-4eeb-4c8a-b138-44fef6b4a3a5","source":"wordfence","cve":"CVE-2026-90992","title":"Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2274a464-4eeb-4c8a-b138-44fef6b4a3a5?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"4.5.15"}],"published":"2026-09-30T20:01:14Z","updated":"2026-10-01T08:28:41Z"},{"id":"wordfence:22754d5f-a048-4734-ae11-30a26d6608ce","source":"wordfence","cve":"CVE-2025-68874","title":"Visitor Stats Widget <= 1.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22754d5f-a048-4734-ae11-30a26d6608ce?source=api-prod","affected":[{"type":"plugin","slug":"visitor-stats-widget","name":"Visitor Stats Widget","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:35:52Z"},{"id":"wordfence:22755d65-d187-438a-9a3f-e7d38497282b","source":"wordfence","cve":"CVE-2023-23660","title":"MainWP Maintenance Extension <= 4.1.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22755d65-d187-438a-9a3f-e7d38497282b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-maintenance-extension","name":"MainWP Maintenance Extension","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2275f49d-2b31-4e24-aa3f-16f5febd2738","source":"wordfence","cve":"CVE-2024-56253","title":"Data Tables Generator by Supsystic <= 1.10.36 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2275f49d-2b31-4e24-aa3f-16f5febd2738?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.10.36","to_inclusive":true,"patched_in":"1.10.37"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:46:21Z"},{"id":"wordfence:2277e9d3-9589-42a7-9649-50afbf20a94a","source":"wordfence","cve":"CVE-2026-65491","title":"Query Wrangler <= 1.5.57 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2277e9d3-9589-42a7-9649-50afbf20a94a?source=api-prod","affected":[{"type":"plugin","slug":"query-wrangler","name":"Query Wrangler","from":"*","from_inclusive":true,"to":"1.5.57","to_inclusive":true,"patched_in":"1.5.58"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:34:34Z"},{"id":"wordfence:227886e8-99d9-49b3-a1a8-b06b02d331bc","source":"wordfence","cve":"","title":"Like Button Rating <= 2.5.3 - Arbitrary Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227886e8-99d9-49b3-a1a8-b06b02d331bc?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2017-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:227c8700-6e53-4f06-9620-5dde2ffc4fde","source":"wordfence","cve":"CVE-2025-68998","title":"Heateor Social Login <= 1.1.39 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227c8700-6e53-4f06-9620-5dde2ffc4fde?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.39","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:02:51Z"},{"id":"wordfence:227cdc5a-ed5e-4ae2-b423-19a7881958a4","source":"wordfence","cve":"CVE-2026-119496","title":"Media Library Assistant <= 3.43 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227cdc5a-ed5e-4ae2-b423-19a7881958a4?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":true,"patched_in":"3.44"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:52:37Z"},{"id":"wordfence:227cf3fe-4e76-4827-ac92-788bca450b52","source":"wordfence","cve":"CVE-2023-2606","title":"WP Brutal AI < 2.06 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227cf3fe-4e76-4827-ac92-788bca450b52?source=api-prod","affected":[{"type":"plugin","slug":"wpbrutalai","name":"WP Brutal AI","from":"*","from_inclusive":true,"to":"2.06","to_inclusive":false,"patched_in":"2.06"}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:227d81e8-7380-4bc8-8127-046ff87bb4b1","source":"wordfence","cve":"CVE-2026-32408","title":"Brizy <= 2.7.23 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227d81e8-7380-4bc8-8127-046ff87bb4b1?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.7.23","to_inclusive":true,"patched_in":"2.7.24"}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T21:14:19Z"},{"id":"wordfence:227fb6d1-3515-4172-9d7c-57a66d17858f","source":"wordfence","cve":"CVE-2019-11185","title":"WP Live Chat Support Pro <= 8.0.26 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/227fb6d1-3515-4172-9d7c-57a66d17858f?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support-pro","name":"wp-live-chat-support-pro","from":"*","from_inclusive":true,"to":"8.0.26","to_inclusive":true,"patched_in":"8.0.27"}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:228079da-3c69-423c-b69b-f1a670258772","source":"wordfence","cve":"CVE-2024-7413","title":"Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228079da-3c69-423c-b69b-f1a670258772?source=api-prod","affected":[{"type":"plugin","slug":"obfuscate-email","name":"Obfuscate Email","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-08T20:36:42Z","updated":"2024-08-09T09:30:11Z"},{"id":"wordfence:228147c2-97c6-4910-b9b2-d6ca62fc1760","source":"wordfence","cve":"CVE-2022-34347","title":"Download Manager <= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228147c2-97c6-4910-b9b2-d6ca62fc1760?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.48","to_inclusive":true,"patched_in":"3.2.49"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2283210d-d3b6-433f-ab17-5b29d7752aa6","source":"wordfence","cve":"CVE-2026-56024","title":"WP Easy Pay \u2013 Payment and Donation form Builder for Square <= 4.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2283210d-d3b6-433f-ab17-5b29d7752aa6?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-06-18T00:00:00Z","updated":"2026-07-28T19:41:54Z"},{"id":"wordfence:2283b147-b904-4086-8cb1-6d8969ccbaf6","source":"wordfence","cve":"CVE-2026-32409","title":"Forminator <= 1.50.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2283b147-b904-4086-8cb1-6d8969ccbaf6?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.50.2","to_inclusive":true,"patched_in":"1.50.3"}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T21:14:34Z"},{"id":"wordfence:22842e7a-9cbb-4b29-b4cb-7d9b8d6b7b1a","source":"wordfence","cve":"CVE-2024-31363","title":"LifterLMS <= 7.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22842e7a-9cbb-4b29-b4cb-7d9b8d6b7b1a?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.5.0","to_inclusive":true,"patched_in":"7.5.1"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T14:47:28Z"},{"id":"wordfence:228763ff-e6b0-4bba-b74f-50652e32c050","source":"wordfence","cve":"CVE-2025-22780","title":"wp-pano <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228763ff-e6b0-4bba-b74f-50652e32c050?source=api-prod","affected":[{"type":"plugin","slug":"wp-pano","name":"wp-pano","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:43:23Z"},{"id":"wordfence:228a3c72-fbb0-48bc-8066-6ca954a14421","source":"wordfence","cve":"","title":"Push Notification for Post and BuddyPress <= 1.63 - Missing Authorization to Unauthenticated Admin Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228a3c72-fbb0-48bc-8066-6ca954a14421?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"1.64","to_inclusive":false,"patched_in":"1.64"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:228d63a5-5053-4692-9801-4860325da153","source":"wordfence","cve":"CVE-2026-12729","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228d63a5-5053-4692-9801-4860325da153?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-02T11:59:24Z","updated":"2026-07-03T01:28:20Z"},{"id":"wordfence:228de538-90c7-4f7d-a076-dd0a01458e38","source":"wordfence","cve":"CVE-2024-30558","title":"Add Shortcodes Actions And Filters <= 2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228de538-90c7-4f7d-a076-dd0a01458e38?source=api-prod","affected":[{"type":"plugin","slug":"add-actions-and-filters","name":"Add Shortcodes Actions And Filters","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:05:26Z"},{"id":"wordfence:228e2e73-33c9-40bc-85c7-6e63f394b81f","source":"wordfence","cve":"CVE-2026-112822","title":"Workreap Core < 3.4.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228e2e73-33c9-40bc-85c7-6e63f394b81f?source=api-prod","affected":[{"type":"plugin","slug":"workreap_core","name":"Workreap Core","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":false,"patched_in":"3.4.4"}],"published":"2026-10-20T10:28:13Z","updated":"2026-10-23T18:51:09Z"},{"id":"wordfence:228fab65-e5c2-41d1-ad41-fac4862894f2","source":"wordfence","cve":"CVE-2024-6256","title":"Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/228fab65-e5c2-41d1-ad41-fac4862894f2?source=api-prod","affected":[{"type":"plugin","slug":"feeds-for-youtube","name":"Feeds for YouTube (YouTube video, channel, and gallery plugin)","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-11T06:43:13Z"},{"id":"wordfence:2290b13e-a5c6-4ec7-86c0-f2cd2a880e8e","source":"wordfence","cve":"CVE-2023-7154","title":"Hubbub Lite <= 1.31.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2290b13e-a5c6-4ec7-86c0-f2cd2a880e8e?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.31.1","to_inclusive":true,"patched_in":"1.32.0"}],"published":"2024-01-11T00:00:00Z","updated":"2024-02-06T13:54:09Z"},{"id":"wordfence:2290c2a0-2b13-4aee-9d04-0ea6ec20d81d","source":"wordfence","cve":"CVE-2025-62140","title":"Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2290c2a0-2b13-4aee-9d04-0ea6ec20d81d?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.65","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-07-02T15:39:43Z"},{"id":"wordfence:229235de-03c6-4560-b0ea-ab21fde256be","source":"wordfence","cve":"CVE-2023-52205","title":"HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229235de-03c6-4560-b0ea-ab21fde256be?source=api-prod","affected":[{"type":"plugin","slug":"html5-soundcloud-player-with-playlist","name":"HTML5 SoundCloud Player with Playlist Free","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:229245a5-468d-47b9-8f26-d23d593e91da","source":"wordfence","cve":"CVE-2023-6985","title":"10Web AI Assistant \u2013 AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229245a5-468d-47b9-8f26-d23d593e91da?source=api-prod","affected":[{"type":"plugin","slug":"ai-assistant-by-10web","name":"10Web AI Assistant \u2013 AI content writing assistant","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-01-25T00:00:00Z","updated":"2024-07-29T21:36:00Z"},{"id":"wordfence:22930940-8e2c-446a-954c-90d617f3ca6d","source":"wordfence","cve":"CVE-2026-5193","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user","severity":"medium","cvss":6.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22930940-8e2c-446a-954c-90d617f3ca6d?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2026-05-13T18:07:43Z","updated":"2026-05-14T06:44:10Z"},{"id":"wordfence:2294251f-ef51-4ef7-ad7a-905cc2bc00b3","source":"wordfence","cve":"CVE-2023-37867","title":"Yet Another Stars Rating <= 3.3.8 - Missing Authorization to Vote Tampering","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2294251f-ef51-4ef7-ad7a-905cc2bc00b3?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2294565a-987e-4837-ab22-6e7bff498044","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2294565a-987e-4837-ab22-6e7bff498044?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:229490c3-d820-4831-b105-a429512c2c60","source":"wordfence","cve":"CVE-2024-6392","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229490c3-d820-4831-b105-a429512c2c60?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2024-07-11T09:29:49Z","updated":"2024-07-11T21:31:35Z"},{"id":"wordfence:2294bec1-c469-4190-bb50-2f64be0539c5","source":"wordfence","cve":"CVE-2026-111956","title":"WholesaleX <= 3.0.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2294bec1-c469-4190-bb50-2f64be0539c5?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:48:09Z"},{"id":"wordfence:2295b532-7833-4f5d-9778-de26390b04bd","source":"wordfence","cve":"CVE-2021-24906","title":"Protect WP Admin <= 3.6 - Unauthenticated Plugin Deactivation","severity":"high","cvss":7.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2295b532-7833-4f5d-9778-de26390b04bd?source=api-prod","affected":[{"type":"plugin","slug":"protect-wp-admin","name":"Protect WP Admin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2021-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:229a4e61-571c-44c6-9972-4dfc743afffe","source":"wordfence","cve":"CVE-2026-8489","title":"Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229a4e61-571c-44c6-9972-4dfc743afffe?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.4","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-07-02T15:57:05Z","updated":"2026-07-03T04:30:16Z"},{"id":"wordfence:229c146d-3f99-4f63-9a6f-997075846815","source":"wordfence","cve":"CVE-2025-14397","title":"Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229c146d-3f99-4f63-9a6f-997075846815?source=api-prod","affected":[{"type":"plugin","slug":"postem-ipsum","name":"Postem Ipsum","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:05:44Z","updated":"2025-12-13T04:31:22Z"},{"id":"wordfence:229c88ea-c091-43b6-ac4d-31bccdd13a07","source":"wordfence","cve":"CVE-2025-8315","title":"WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229c88ea-c091-43b6-ac4d-31bccdd13a07?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-08-04T17:36:03Z","updated":"2025-08-05T06:39:48Z"},{"id":"wordfence:229e3e0e-daf4-4ed0-93c3-46a65efc52d1","source":"wordfence","cve":"CVE-2024-50410","title":"Namaste! LMS <= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229e3e0e-daf4-4ed0-93c3-46a65efc52d1?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.4.1"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:39:24Z"},{"id":"wordfence:229e7ca9-ed6b-4191-9fd2-c1db86230988","source":"wordfence","cve":"CVE-2026-85117","title":"LukasApps CAPTCHA tools for Contact Form 7 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229e7ca9-ed6b-4191-9fd2-c1db86230988?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-simple-recaptcha","name":"LukasApps CAPTCHA tools for Contact Form 7","from":"0.1.7","from_inclusive":true,"to":"0.1.8","to_inclusive":true,"patched_in":"0.1.9"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T14:35:01Z"},{"id":"wordfence:22a02e75-4ab1-48fb-b618-b1dff2fcd97f","source":"wordfence","cve":"CVE-2024-11767","title":"NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a02e75-4ab1-48fb-b618-b1dff2fcd97f?source=api-prod","affected":[{"type":"plugin","slug":"newsmanapp","name":"NewsmanApp","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2024-12-12T16:04:29Z","updated":"2024-12-13T04:23:27Z"},{"id":"wordfence:22a0f10f-0a67-4f4a-99db-a625bec20bdc","source":"wordfence","cve":"","title":"Image Gallery - Responsive Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting via thumbtext","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a0f10f-0a67-4f4a-99db-a625bec20bdc?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2015-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22a1920e-2a3f-4996-873d-26e3930e6929","source":"wordfence","cve":"CVE-2024-31283","title":"Advanced Local Pickup for WooCommerce <= 1.6.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a1920e-2a3f-4996-873d-26e3930e6929?source=api-prod","affected":[{"type":"plugin","slug":"advanced-local-pickup-for-woocommerce","name":"Advanced Local Pickup for WooCommerce \u2013 Click & Collect, In-Store Pickup","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:22:28Z"},{"id":"wordfence:22a30301-f409-4c53-84d7-7799fb41c25b","source":"wordfence","cve":"CVE-2025-7655","title":"Live Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a30301-f409-4c53-84d7-7799fb41c25b?source=api-prod","affected":[{"type":"plugin","slug":"live-stream-badger","name":"Live Stream Badger","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T14:12:10Z","updated":"2025-07-19T02:22:57Z"},{"id":"wordfence:22a32bb6-fe22-4c5e-91f6-de3c38d7d19e","source":"wordfence","cve":"CVE-2024-34417","title":"Viet Nam Affiliate <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a32bb6-fe22-4c5e-91f6-de3c38d7d19e?source=api-prod","affected":[{"type":"plugin","slug":"viet-nam-affiliate","name":"Viet Nam Affiliate","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:15:12Z"},{"id":"wordfence:22a42dc3-0b9b-47c8-9236-5dc3b58149c5","source":"wordfence","cve":"CVE-2008-0845","title":"WP People <= 3.4.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a42dc3-0b9b-47c8-9236-5dc3b58149c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-people","name":"WP People","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2008-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22a4b2b3-16f5-49b9-ac15-7abe903eac5f","source":"wordfence","cve":"CVE-2025-58017","title":"Ultimate Store Kit Elementor Addons <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a4b2b3-16f5-49b9-ac15-7abe903eac5f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T15:00:57Z"},{"id":"wordfence:22a5020a-ab81-43be-b160-082347a2a2d9","source":"wordfence","cve":"CVE-2022-4324","title":"Custom Field Template <= 2.5.7 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a5020a-ab81-43be-b160-082347a2a2d9?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22a73d1a-02ba-4453-a2c8-0b79a75313f6","source":"wordfence","cve":"CVE-2026-59536","title":"CoCart \u2013 Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a73d1a-02ba-4453-a2c8-0b79a75313f6?source=api-prod","affected":[{"type":"plugin","slug":"cart-rest-api-for-woocommerce","name":"CoCart \u2013 Headless REST API for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:23:10Z"},{"id":"wordfence:22a798d7-03e6-4083-9af2-235238b09fc9","source":"wordfence","cve":"CVE-2026-84812","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a798d7-03e6-4083-9af2-235238b09fc9?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.27","to_inclusive":true,"patched_in":"2.15.28"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:32:19Z"},{"id":"wordfence:22a79d2b-44f8-406d-baea-8bfba291b462","source":"wordfence","cve":"CVE-2026-14833","title":"Lightbox with PhotoSwipe <= 5.8.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a79d2b-44f8-406d-baea-8bfba291b462?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-photoswipe","name":"Lightbox with PhotoSwipe","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-15T21:07:14Z"},{"id":"wordfence:22a9c0f6-7a20-4ed1-9afa-887adc790c80","source":"wordfence","cve":"CVE-2024-31087","title":"pageMash > Page Management <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22a9c0f6-7a20-4ed1-9afa-887adc790c80?source=api-prod","affected":[{"type":"plugin","slug":"pagemash","name":"pageMash > Page Management","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:55:30Z"},{"id":"wordfence:22ab3baa-34a3-4554-9c05-ebd5c9e5279b","source":"wordfence","cve":"CVE-2025-32561","title":"WP_DEBUG Toggle <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ab3baa-34a3-4554-9c05-ebd5c9e5279b?source=api-prod","affected":[{"type":"plugin","slug":"enable-wp-debug-toggle","name":"WP_DEBUG Toggle","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:22:53Z"},{"id":"wordfence:22ab67a7-7b9a-407e-a41f-2245d1100e67","source":"wordfence","cve":"CVE-2026-90922","title":"Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ab67a7-7b9a-407e-a41f-2245d1100e67?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:03:33Z"},{"id":"wordfence:22b16275-f46b-4338-b95f-1939ec85316d","source":"wordfence","cve":"","title":"Coupon Tab for DirectoryPress (pp-coupon-tab) <= 0.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b16275-f46b-4338-b95f-1939ec85316d?source=api-prod","affected":[{"type":"plugin","slug":"coupon-tab-for-directorypress-pp","name":"Coupon Tab for DirectoryPress (pp-coupon-tab)","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b17fcb-0c97-462d-b67c-6da2919478d5","source":"wordfence","cve":"CVE-2023-49193","title":"Social Pug <= 1.30.0 - Missing Authorization via multiple admin_init actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b17fcb-0c97-462d-b67c-6da2919478d5?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":true,"patched_in":"1.30.1"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b18a9c-89e5-43e1-9553-5862df25bf47","source":"wordfence","cve":"CVE-2022-4024","title":"Pie Register <= 3.8.1.2 - Missing Authorization to Arbitrary User Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b18a9c-89e5-43e1-9553-5862df25bf47?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.1.2","to_inclusive":true,"patched_in":"3.8.1.3"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b2a290-36ea-45ba-b43d-6820247121fa","source":"wordfence","cve":"CVE-2025-58620","title":"PDF for WPForms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b2a290-36ea-45ba-b43d-6820247121fa?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:34:15Z"},{"id":"wordfence:22b33944-443e-48fe-9fd0-4d48fe03072b","source":"wordfence","cve":"CVE-2016-1000140","title":"New Year Firework <= 1.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b33944-443e-48fe-9fd0-4d48fe03072b?source=api-prod","affected":[{"type":"plugin","slug":"new-year-firework","name":"new-year-firework","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b3ee70-7ba6-4f8a-add4-3c7f4765b3d1","source":"wordfence","cve":"CVE-2015-5733","title":"WordPress Core < 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b3ee70-7ba6-4f8a-add4-3c7f4765b3d1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b539c8-a6f1-4543-9e63-08ee4d468ee0","source":"wordfence","cve":"CVE-2022-0875","title":"Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b539c8-a6f1-4543-9e63-08ee4d468ee0?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-google-authenticator","name":"Login with TOTP (Google Authenticator, Microsoft Authenticator)","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22b55747-8b46-4812-9345-0db03500105f","source":"wordfence","cve":"CVE-2026-4798","title":"Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b55747-8b46-4812-9345-0db03500105f?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-05-12T21:06:24Z","updated":"2026-05-13T09:26:13Z"},{"id":"wordfence:22b59b36-ba47-4c10-8f43-a29ae3b9d446","source":"wordfence","cve":"CVE-2024-8107","title":"Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b59b36-ba47-4c10-8f43-a29ae3b9d446?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.18","to_inclusive":true,"patched_in":"6.7.19"}],"published":"2024-09-30T18:27:40Z","updated":"2024-10-01T06:39:53Z"},{"id":"wordfence:22b5c1ea-0055-475b-a6c5-81085d9f4822","source":"wordfence","cve":"CVE-2026-86799","title":"Forms < 3.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b5c1ea-0055-475b-a6c5-81085d9f4822?source=api-prod","affected":[{"type":"plugin","slug":"forms-by-made-it","name":"Forms","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:21:56Z"},{"id":"wordfence:22b63369-c6ea-42e9-bea3-d15837da7732","source":"wordfence","cve":"CVE-2026-3243","title":"Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b63369-c6ea-42e9-bea3-d15837da7732?source=api-prod","affected":[{"type":"plugin","slug":"advanced-members","name":"Advanced Members for ACF","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-08T11:16:57Z"},{"id":"wordfence:22b742d7-e9fe-48ea-ae7f-579bd3c32c44","source":"wordfence","cve":"CVE-2024-31307","title":"Easy Social Share Buttons <= 9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b742d7-e9fe-48ea-ae7f-579bd3c32c44?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons3","name":"Easy Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"9.4","to_inclusive":true,"patched_in":"9.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:40:15Z"},{"id":"wordfence:22b89c2f-a42d-4e2f-b344-81d8363a332f","source":"wordfence","cve":"CVE-2026-96830","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22b89c2f-a42d-4e2f-b344-81d8363a332f?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.9","to_inclusive":true,"patched_in":"4.17.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:00Z"},{"id":"wordfence:22ba0eaf-f514-420a-9680-8126f6dcdde9","source":"wordfence","cve":"CVE-2024-0326","title":"Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ba0eaf-f514-420a-9680-8126f6dcdde9?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"4.0.18"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:36:00Z"},{"id":"wordfence:22bc7a0c-8a89-461b-8838-788dd6d5c63b","source":"wordfence","cve":"CVE-2022-47170","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.48  - Authenticated (Admin+) Cross Site Scripting (XSS)","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22bc7a0c-8a89-461b-8838-788dd6d5c63b?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.48","to_inclusive":true,"patched_in":"1.5.49"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22bcfd36-ecf9-4d2c-ac94-94ffa0340c4c","source":"wordfence","cve":"CVE-2026-0617","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22bcfd36-ecf9-4d2c-ac94-94ffa0340c4c?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-02-02T18:30:30Z","updated":"2026-02-03T06:38:05Z"},{"id":"wordfence:22be5fb5-143e-4934-9f93-e17def18e883","source":"wordfence","cve":"CVE-2026-0911","title":"Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22be5fb5-143e-4934-9f93-e17def18e883?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.9.2","to_inclusive":true,"patched_in":"7.8.9.3"}],"published":"2026-01-23T23:49:25Z","updated":"2026-01-24T12:27:18Z"},{"id":"wordfence:22bf2719-335d-4331-8c59-648f6f903ffa","source":"wordfence","cve":"CVE-2011-0700","title":"WordPress Core <= 3.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22bf2719-335d-4331-8c59-648f6f903ffa?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2007-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22bf5b65-8ec4-477c-a6bd-c90b99f560a8","source":"wordfence","cve":"CVE-2010-1186","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 1.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22bf5b65-8ec4-477c-a6bd-c90b99f560a8?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2010-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22c03ddb-befe-4ac5-86b1-46d95d313b5e","source":"wordfence","cve":"CVE-2024-13624","title":"WPMovieLibrary <= 2.1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c03ddb-befe-4ac5-86b1-46d95d313b5e?source=api-prod","affected":[{"type":"plugin","slug":"wpmovielibrary","name":"WPMovieLibrary","from":"*","from_inclusive":true,"to":"2.1.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:36:20Z"},{"id":"wordfence:22c2b12b-dc80-4127-86bd-21d4f1988e56","source":"wordfence","cve":"CVE-2026-57618","title":"Neve PRO <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c2b12b-dc80-4127-86bd-21d4f1988e56?source=api-prod","affected":[{"type":"theme","slug":"neve-pro-addon","name":"Neve PRO","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:10:52Z"},{"id":"wordfence:22c4b981-6135-4c44-aa68-f0d51704a68c","source":"wordfence","cve":"CVE-2024-2491","title":"PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c4b981-6135-4c44-aa68-f0d51704a68c?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.17","to_inclusive":true,"patched_in":"2.7.18"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T09:37:29Z"},{"id":"wordfence:22c63226-2bc6-40be-a5d1-1bd169fc78b8","source":"wordfence","cve":"CVE-2023-5468","title":"Slick Contact Forms <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c63226-2bc6-40be-a5d1-1bd169fc78b8?source=api-prod","affected":[{"type":"plugin","slug":"slick-contact-forms","name":"Slick Contact Forms","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22c6f81b-d456-44b9-ba6c-8b207a9ee6e1","source":"wordfence","cve":"CVE-2026-1557","title":"WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c6f81b-d456-44b9-ba6c-8b207a9ee6e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-images","name":"WP Responsive Images","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:50:15Z","updated":"2026-02-26T01:24:14Z"},{"id":"wordfence:22c82c75-a1ab-45a6-90ef-50b993ede483","source":"wordfence","cve":"CVE-2025-60108","title":"LambertGroup - AllInOne - Banner with Thumbnails <= 3.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22c82c75-a1ab-45a6-90ef-50b993ede483?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-thumbnailsBanner","name":"LambertGroup - AllInOne - Banner with Thumbnails","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:21:54Z"},{"id":"wordfence:22cb2bc4-ddf1-4e23-af1c-4f59ff88e9e1","source":"wordfence","cve":"","title":"Spider Calendar < 1.1.3 - Multiple Vulnerabilities","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22cb2bc4-ddf1-4e23-af1c-4f59ff88e9e1?source=api-prod","affected":[{"type":"plugin","slug":"spider-calendar","name":"spider-calendar","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2012-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22cc3d7b-b85c-473b-9573-44d36dde7b82","source":"wordfence","cve":"CVE-2024-56009","title":"Spreadr Woocommerce <= 1.0.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22cc3d7b-b85c-473b-9573-44d36dde7b82?source=api-prod","affected":[{"type":"plugin","slug":"spreadr-for-woocomerce","name":"Spreadr Woocommerce Plugin \u2013 Amazon Importer for Dropshipping and Affiliate","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T11:19:13Z"},{"id":"wordfence:22cc6da1-fd22-4b2a-90ab-24086879f0f6","source":"wordfence","cve":"CVE-2025-2809","title":"azurecurve Shortcodes in Comments <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22cc6da1-fd22-4b2a-90ab-24086879f0f6?source=api-prod","affected":[{"type":"plugin","slug":"azurecurve-shortcodes-in-comments","name":"azurecurve Shortcodes in Comments","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T18:09:45Z","updated":"2025-04-10T07:02:39Z"},{"id":"wordfence:22cfa0da-9370-4d95-8b23-024447fd84cd","source":"wordfence","cve":"CVE-2025-39383","title":"Xews Lite <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22cfa0da-9370-4d95-8b23-024447fd84cd?source=api-prod","affected":[{"type":"theme","slug":"xews-lite","name":"Xews Lite","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:09:51Z"},{"id":"wordfence:22cfbaa1-5412-4944-899c-7ae41d017384","source":"wordfence","cve":"CVE-2023-41237","title":"Arya Multipurpose Pro <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22cfbaa1-5412-4944-899c-7ae41d017384?source=api-prod","affected":[{"type":"theme","slug":"arya-multipurpose-pro","name":"Arya Multipurpose Pro","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22d1ccf3-ac1a-4dfc-81c3-b8eb88795bc1","source":"wordfence","cve":"CVE-2024-4158","title":"Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d1ccf3-ac1a-4dfc-81c3-b8eb88795bc1?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.42","to_inclusive":true,"patched_in":"2.0.43"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:21Z"},{"id":"wordfence:22d222e8-adbc-4217-a820-e9196521fd03","source":"wordfence","cve":"CVE-2025-22747","title":"Foundation Columns <= 0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d222e8-adbc-4217-a820-e9196521fd03?source=api-prod","affected":[{"type":"plugin","slug":"foundation-columns","name":"Foundation Columns","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T16:44:41Z"},{"id":"wordfence:22d50526-e21f-412d-9eed-b9b1f48c3358","source":"wordfence","cve":"CVE-2022-1822","title":"Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d50526-e21f-412d-9eed-b9b1f48c3358?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"3.2.40","from_inclusive":true,"to":"3.2.40","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22d58028-a12c-4d72-b275-ba37a58dc10d","source":"wordfence","cve":"CVE-2023-22674","title":"Dashicons + Custom Post Types <= 1.0.2 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d58028-a12c-4d72-b275-ba37a58dc10d?source=api-prod","affected":[{"type":"plugin","slug":"dashicons-cpt","name":"Dashicons + Custom Post Types","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22d5a45b-41bd-4f65-b8b7-d7efb2b9cecf","source":"wordfence","cve":"CVE-2024-48027","title":"External featured image from bing <= 1.0.2 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d5a45b-41bd-4f65-b8b7-d7efb2b9cecf?source=api-prod","affected":[{"type":"plugin","slug":"external-featured-image-from-bing","name":"External featured image from bing","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:58:30Z"},{"id":"wordfence:22d6aa93-b265-41eb-9be9-cd066292f2ea","source":"wordfence","cve":"CVE-2025-8574","title":"Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion","severity":"high","cvss":8.7,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d6aa93-b265-41eb-9be9-cd066292f2ea?source=api-prod","affected":[{"type":"plugin","slug":"database-cleaner","name":"Database Cleaner: Cleanup, Optimization & Repair","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-10-30T00:00:00Z","updated":"2026-10-30T17:15:25Z"},{"id":"wordfence:22d8847d-f73f-40ad-8b8c-8e602d226be5","source":"wordfence","cve":"CVE-2024-43164","title":"Blockspare <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d8847d-f73f-40ad-8b8c-8e602d226be5?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:20:11Z"},{"id":"wordfence:22d8f1db-1b7e-4b68-a381-01f51dd34b2b","source":"wordfence","cve":"CVE-2025-4946","title":"Vikinger <= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d8f1db-1b7e-4b68-a381-01f51dd34b2b?source=api-prod","affected":[{"type":"theme","slug":"vikinger","name":"Vikinger","from":"*","from_inclusive":true,"to":"1.9.32","to_inclusive":true,"patched_in":"1.9.33"}],"published":"2025-07-01T20:29:16Z","updated":"2025-07-02T09:23:23Z"},{"id":"wordfence:22d972d3-5bc5-4c2c-852a-63cb8f232a6f","source":"wordfence","cve":"CVE-2026-104337","title":"Razorpay for WooCommerce <= 4.8.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d972d3-5bc5-4c2c-852a-63cb8f232a6f?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:08:23Z"},{"id":"wordfence:22d9ccd6-24fb-4863-b5ac-b22b9958007b","source":"wordfence","cve":"CVE-2024-35764","title":"Church Admin <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d9ccd6-24fb-4863-b5ac-b22b9958007b?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-02T12:56:51Z"},{"id":"wordfence:22d9e438-4b59-4622-9b2e-096c7bde4a00","source":"wordfence","cve":"CVE-2026-82226","title":"Tickera \u2013 Sell Tickets & Manage Events <= 3.6.0.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22d9e438-4b59-4622-9b2e-096c7bde4a00?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.2","to_inclusive":true,"patched_in":"3.6.0.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:51:26Z"},{"id":"wordfence:22dbd787-2b9a-4883-9203-c79fc241596d","source":"wordfence","cve":"CVE-2022-40209","title":"WordPress Importer: Import any XML File to WordPress <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22dbd787-2b9a-4883-9203-c79fc241596d?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2022-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22dcdd92-75d1-44aa-aaae-434ec4bdc20f","source":"wordfence","cve":"CVE-2015-9502","title":"Auberge < 1.4.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22dcdd92-75d1-44aa-aaae-434ec4bdc20f?source=api-prod","affected":[{"type":"theme","slug":"auberge","name":"Auberge","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22dced08-20b1-4f21-8c43-148d40a29701","source":"wordfence","cve":"CVE-2025-49444","title":"Reformer for Elementor <= 1.0.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22dced08-20b1-4f21-8c43-148d40a29701?source=api-prod","affected":[{"type":"plugin","slug":"reformer-elementor","name":"ReFormer \u2013 Multichannel Contact Form for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T14:41:08Z"},{"id":"wordfence:22dd9fbb-77d2-48cd-91a5-eba39ef9d2c1","source":"wordfence","cve":"CVE-2026-23550","title":"Modular DS <= 2.5.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22dd9fbb-77d2-48cd-91a5-eba39ef9d2c1?source=api-prod","affected":[{"type":"plugin","slug":"modular-connector","name":"Modular DS: Monitor, update, and backup multiple websites","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-01-14T00:00:00Z","updated":"2026-01-22T13:54:17Z"},{"id":"wordfence:22ddafad-9214-4d32-9fc3-3f3c759633ad","source":"wordfence","cve":"CVE-2024-10341","title":"League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ddafad-9214-4d32-9fc3-3f3c759633ad?source=api-prod","affected":[{"type":"plugin","slug":"league-of-legends-shortcodes","name":"League of Legends Shortcodes","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T07:37:57Z"},{"id":"wordfence:22de2da7-f7db-46de-9305-52bce6e56937","source":"wordfence","cve":"","title":"WP LESS to CSS <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22de2da7-f7db-46de-9305-52bce6e56937?source=api-prod","affected":[{"type":"plugin","slug":"wp-less-to-css","name":"WP LESS to CSS","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22defe19-28ac-43b3-814d-5a2038380adb","source":"wordfence","cve":"CVE-2026-9008","title":"Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22defe19-28ac-43b3-814d-5a2038380adb?source=api-prod","affected":[{"type":"plugin","slug":"page-list","name":"Page-list","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2026-06-05T12:41:56Z","updated":"2026-06-06T01:26:09Z"},{"id":"wordfence:22e0060d-7852-4326-98bc-1c49bebe6205","source":"wordfence","cve":"CVE-2026-3552","title":"SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e0060d-7852-4326-98bc-1c49bebe6205?source=api-prod","affected":[{"type":"plugin","slug":"surflink","name":"SurfLink \u2013 Link Manager & Backup Restore","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":false,"patched_in":"2.6.0"}],"published":"2026-07-10T15:30:12Z","updated":"2026-07-11T03:44:22Z"},{"id":"wordfence:22e09431-dd71-4a90-84ba-4b676ec8ccb3","source":"wordfence","cve":"CVE-2024-30446","title":"CRM Perks Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e09431-dd71-4a90-84ba-4b676ec8ccb3?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:54:33Z"},{"id":"wordfence:22e1be31-7a05-4089-9830-c27b70176e76","source":"wordfence","cve":"CVE-2026-12685","title":"EscortWP <= 3.6.2 - Backdoored Software","severity":"medium","cvss":5.3,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e1be31-7a05-4089-9830-c27b70176e76?source=api-prod","affected":[{"type":"theme","slug":"escortwp","name":"EscortWP","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-16T00:00:00Z","updated":"2026-07-30T13:18:53Z"},{"id":"wordfence:22e273d9-a268-4dc5-b1f6-3bc5c29232c5","source":"wordfence","cve":"CVE-2026-19949","title":"All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e273d9-a268-4dc5-b1f6-3bc5c29232c5?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.109","to_inclusive":true,"patched_in":"7.110"}],"published":"2026-08-24T22:05:27Z","updated":"2026-08-25T11:27:11Z"},{"id":"wordfence:22e284d3-1ccc-47e4-9e98-c7a38b97446b","source":"wordfence","cve":"CVE-2026-17589","title":"Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e284d3-1ccc-47e4-9e98-c7a38b97446b?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"5.9.3"}],"published":"2026-08-31T15:59:56Z","updated":"2026-09-01T04:27:49Z"},{"id":"wordfence:22e4eb2a-2c2b-4f4f-821e-8d2d7e558364","source":"wordfence","cve":"CVE-2024-3890","title":"Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e4eb2a-2c2b-4f4f-821e-8d2d7e558364?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.6","to_inclusive":true,"patched_in":"3.10.7"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T07:28:18Z"},{"id":"wordfence:22e91e0a-052f-4d35-a608-3caf865d2f80","source":"wordfence","cve":"CVE-2026-39578","title":"Valiance <= 1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22e91e0a-052f-4d35-a608-3caf865d2f80?source=api-prod","affected":[{"type":"theme","slug":"valiance","name":"Valiance - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:59:00Z"},{"id":"wordfence:22eda61d-c802-4e9b-a68c-d5ff7d69890c","source":"wordfence","cve":"CVE-2026-13175","title":"Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22eda61d-c802-4e9b-a68c-d5ff7d69890c?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T20:03:34Z"},{"id":"wordfence:22f02c44-7482-4986-a4a2-1354d8a5006a","source":"wordfence","cve":"CVE-2026-78536","title":"Robokassa payment gateway for Woocommerce <= 1.8.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f02c44-7482-4986-a4a2-1354d8a5006a?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-09-09T00:00:00Z","updated":"2026-10-13T17:00:45Z"},{"id":"wordfence:22f05048-df38-4f26-82a3-53caac995283","source":"wordfence","cve":"CVE-2026-6378","title":"Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f05048-df38-4f26-82a3-53caac995283?source=api-prod","affected":[{"type":"plugin","slug":"maxi-blocks","name":"MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2026-05-01T14:44:43Z","updated":"2026-05-02T03:36:42Z"},{"id":"wordfence:22f291eb-d1f8-40d6-b020-f6364164dc40","source":"wordfence","cve":"CVE-2025-10138","title":"This-or-That by Andr\u00e9 Boekhorst <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f291eb-d1f8-40d6-b020-f6364164dc40?source=api-prod","affected":[{"type":"plugin","slug":"this-or-that","name":"This-or-That","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:19:54Z","updated":"2025-10-22T08:27:05Z"},{"id":"wordfence:22f54e4b-2f9a-40b2-b1d2-38f046b71a05","source":"wordfence","cve":"CVE-2026-45209","title":"MyCryptoCheckout \u2013 Bitcoin, Ethereum, and 100+ altcoins for WooCommerce <= 2.161 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f54e4b-2f9a-40b2-b1d2-38f046b71a05?source=api-prod","affected":[{"type":"plugin","slug":"mycryptocheckout","name":"MyCryptoCheckout \u2013 Bitcoin, Ethereum, and 100+ altcoins for WooCommerce","from":"*","from_inclusive":true,"to":"2.161","to_inclusive":true,"patched_in":"2.162"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T13:18:48Z"},{"id":"wordfence:22f58318-90ce-4f98-991c-1270d6768f5c","source":"wordfence","cve":"CVE-2010-4403","title":"Register Plus <= 3.5.11 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f58318-90ce-4f98-991c-1270d6768f5c?source=api-prod","affected":[{"type":"plugin","slug":"register-plus","name":"Register Plus","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":""}],"published":"2010-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22f6a369-7068-4df8-9c6c-f20cceb0c39b","source":"wordfence","cve":"CVE-2026-57649","title":"Shoppable Images (Lookbook) for WooCommerce <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f6a369-7068-4df8-9c6c-f20cceb0c39b?source=api-prod","affected":[{"type":"plugin","slug":"mabel-shoppable-images-lite","name":"Shoppable Images (Lookbook) for WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:36:23Z"},{"id":"wordfence:22f79a03-9195-4d5d-a189-9b5e1d3307c8","source":"wordfence","cve":"","title":"Contact Form 7 Database Addon <= 1.2.5.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f79a03-9195-4d5d-a189-9b5e1d3307c8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.5.4","to_inclusive":false,"patched_in":"1.2.5.4"}],"published":"2021-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22f7de11-dbaa-4e56-b727-fab9c36a1217","source":"wordfence","cve":"CVE-2026-94294","title":"App Builder 3.8.4 - 5.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f7de11-dbaa-4e56-b727-fab9c36a1217?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"3.8.4","from_inclusive":true,"to":"5.7.0","to_inclusive":true,"patched_in":"5.7.1"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:47:41Z"},{"id":"wordfence:22f98afa-eb14-4326-9971-49092c711249","source":"wordfence","cve":"CVE-2024-37558","title":"WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"low","cvss":3.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22f98afa-eb14-4326-9971-49092c711249?source=api-prod","affected":[{"type":"plugin","slug":"wpfavicon","name":"WPFavicon","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T13:57:41Z"},{"id":"wordfence:22fa10c0-4efd-4b4d-84a6-cc6db647f6dc","source":"wordfence","cve":"CVE-2025-11560","title":"Team Members Showcase <= 3.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa10c0-4efd-4b4d-84a6-cc6db647f6dc?source=api-prod","affected":[{"type":"plugin","slug":"wps-team","name":"Team Members Showcase","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2025-10-22T00:00:00Z","updated":"2025-11-17T18:22:49Z"},{"id":"wordfence:22fa3f61-51c8-47b0-a4af-149491c32573","source":"wordfence","cve":"CVE-2025-8619","title":"OSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa3f61-51c8-47b0-a4af-149491c32573?source=api-prod","affected":[{"type":"plugin","slug":"osm-map-elementor","name":"OSM Map Widget for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-08-28T15:44:06Z","updated":"2026-09-10T19:28:23Z"},{"id":"wordfence:22fa8290-ebab-4fa4-bcba-0053c3b79f76","source":"wordfence","cve":"CVE-2025-6459","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa8290-ebab-4fa4-bcba-0053c3b79f76?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:53:53Z","updated":"2025-07-02T03:47:22Z"},{"id":"wordfence:22fa9343-0b6e-47d5-9ebc-2c8902428b8b","source":"wordfence","cve":"","title":"Limit Login Attempts Plus <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa9343-0b6e-47d5-9ebc-2c8902428b8b?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-plus","name":"Limit Login Attempts Plus \u2013 WordPress Limit Login Attempts By Felix","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22faab6d-a63f-4052-b7c6-92e11e4ca723","source":"wordfence","cve":"","title":"Securimage-WP Plugin < 3.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22faab6d-a63f-4052-b7c6-92e11e4ca723?source=api-prod","affected":[{"type":"plugin","slug":"securimage-wp","name":"Securimage-WP","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":false,"patched_in":"3.5.1"}],"published":"2013-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22fb6ed8-18e7-450a-8db0-83c45ac258b6","source":"wordfence","cve":"CVE-2025-64373","title":"Traveler < 3.2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fb6ed8-18e7-450a-8db0-83c45ac258b6?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-19T17:06:02Z"},{"id":"wordfence:22fd58a6-2bcb-4190-8440-a7df7848ad9e","source":"wordfence","cve":"CVE-2021-25027","title":"PowerPack Addons for Elementor <= 2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fd58a6-2bcb-4190-8440-a7df7848ad9e?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22fe2fd1-e0f2-41fb-b96a-99de88416a55","source":"wordfence","cve":"CVE-2025-58933","title":"Anubis <= 1.25 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22fe2fd1-e0f2-41fb-b96a-99de88416a55?source=api-prod","affected":[{"type":"theme","slug":"anubis","name":"Anubis - Funeral & Burial Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:33:34Z"},{"id":"wordfence:22ff0b0c-ffd9-4aae-9e49-069fd1b47f17","source":"wordfence","cve":"CVE-2023-5809","title":"Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ff0b0c-ffd9-4aae-9e49-069fd1b47f17?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":false,"patched_in":"3.8.7"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:22ff4b09-063b-425e-9d59-be2e5d283186","source":"wordfence","cve":"CVE-2023-41665","title":"Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/22ff4b09-063b-425e-9d59-be2e5d283186?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.33.1","to_inclusive":false,"patched_in":"2.33.1"}],"published":"2023-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23003405-29c5-41e2-9081-35f05a08a0c3","source":"wordfence","cve":"CVE-2025-32921","title":"Arrival <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23003405-29c5-41e2-9081-35f05a08a0c3?source=api-prod","affected":[{"type":"theme","slug":"arrival","name":"Arrival","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:05:38Z"},{"id":"wordfence:23049e7b-07ea-449c-963a-841a08659442","source":"wordfence","cve":"CVE-2026-78001","title":"Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23049e7b-07ea-449c-963a-841a08659442?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.13","to_inclusive":true,"patched_in":"1.27.14"}],"published":"2026-10-14T16:36:00Z","updated":"2026-10-15T05:30:21Z"},{"id":"wordfence:2304e4dc-0dc6-4ded-b8e6-8d76d70f63d7","source":"wordfence","cve":"CVE-2023-5756","title":"Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2304e4dc-0dc6-4ded-b8e6-8d76d70f63d7?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2305462c-0a00-4423-8dc2-e32628c4864d","source":"wordfence","cve":"CVE-2026-2263","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2305462c-0a00-4423-8dc2-e32628c4864d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.10.2","to_inclusive":true,"patched_in":"7.8.11"}],"published":"2026-04-07T10:52:41Z","updated":"2026-04-07T23:25:26Z"},{"id":"wordfence:23068a98-623d-4eb3-a7c5-6af410de4320","source":"wordfence","cve":"CVE-2026-14483","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23068a98-623d-4eb3-a7c5-6af410de4320?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-07-30T16:55:48Z","updated":"2026-08-15T20:23:50Z"},{"id":"wordfence:230b3f2f-44cf-46eb-8e6a-3c52f2ea2fb9","source":"wordfence","cve":"CVE-2024-10326","title":"RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/230b3f2f-44cf-46eb-8e6a-3c52f2ea2fb9?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-01-14T00:00:00Z","updated":"2025-03-08T12:21:34Z"},{"id":"wordfence:230b6a10-1505-4f66-ba98-df6257a80668","source":"wordfence","cve":"CVE-2022-27629","title":"MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership <= 1.9.5 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/230b6a10-1505-4f66-ba98-df6257a80668?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2022-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:230eb20c-2d0e-4056-b341-4c2db584b70a","source":"wordfence","cve":"CVE-2024-10852","title":"Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/230eb20c-2d0e-4056-b341-4c2db584b70a?source=api-prod","affected":[{"type":"plugin","slug":"buy-one-click-woocommerce","name":"Buy one click for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-11-12T13:28:31Z","updated":"2026-09-24T14:46:45Z"},{"id":"wordfence:230f40c1-a8a9-4932-a3f1-ecddc52acca9","source":"wordfence","cve":"CVE-2024-43344","title":"Icegram <= 3.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/230f40c1-a8a9-4932-a3f1-ecddc52acca9?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.25","to_inclusive":true,"patched_in":"3.1.26"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:06:51Z"},{"id":"wordfence:230fbbd0-f6fb-4906-851a-a41b65cdd1c3","source":"wordfence","cve":"CVE-2026-4077","title":"Ecover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/230fbbd0-f6fb-4906-851a-a41b65cdd1c3?source=api-prod","affected":[{"type":"plugin","slug":"ecover-builder-for-dummies","name":"Ecover Builder For Dummies","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:19Z","updated":"2026-03-21T03:26:37Z"},{"id":"wordfence:23106867-372f-424f-a83e-f50b3c47e37a","source":"wordfence","cve":"CVE-2025-54706","title":"Magical Posts Display <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23106867-372f-424f-a83e-f50b3c47e37a?source=api-prod","affected":[{"type":"plugin","slug":"magical-posts-display","name":"Magical Posts Display \u2013 Elementor Advanced Posts widgets","from":"*","from_inclusive":true,"to":"1.2.52","to_inclusive":true,"patched_in":"1.2.53"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:00:34Z"},{"id":"wordfence:23132298-f1de-4085-a76f-f007b8b7de15","source":"wordfence","cve":"","title":"WordPress Geolocation Plugin \u2013 CF Geo Plugin <= 7.13.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23132298-f1de-4085-a76f-f007b8b7de15?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"7.13.11","to_inclusive":true,"patched_in":"7.13.12"}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23146e22-0935-4907-8849-600bc390e83c","source":"wordfence","cve":"CVE-2026-66570","title":"Iptanus File Upload <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23146e22-0935-4907-8849-600bc390e83c?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-10-30T15:55:33Z","updated":"2026-11-03T20:10:37Z"},{"id":"wordfence:2314cfeb-52e4-40c5-91e9-ebd7d7eab809","source":"wordfence","cve":"CVE-2019-15109","title":"The Events Calendar <= 4.8.1 - Cross-Site Scripting via tribe_paged Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2314cfeb-52e4-40c5-91e9-ebd7d7eab809?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":false,"patched_in":"4.8.2"}],"published":"2019-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2314df91-4e0a-4c8b-8f8e-8b8ae1b88524","source":"wordfence","cve":"CVE-2026-111068","title":"DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2314df91-4e0a-4c8b-8f8e-8b8ae1b88524?source=api-prod","affected":[{"type":"plugin","slug":"designsetgo","name":"DesignSetGo","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2026-10-27T17:37:10Z","updated":"2026-10-28T06:45:08Z"},{"id":"wordfence:2318b3e1-268d-45fa-83bf-c6e88f1b9013","source":"wordfence","cve":"CVE-2023-3105","title":"LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2318b3e1-268d-45fa-83bf-c6e88f1b9013?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.0.1"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:231b1b64-96fd-4d58-a312-2bdc4a05090a","source":"wordfence","cve":"CVE-2026-111979","title":"GiveWP <= 4.19.0.0 - Authenticated (Give Worker+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/231b1b64-96fd-4d58-a312-2bdc4a05090a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:05:48Z"},{"id":"wordfence:231d90b7-6bac-440e-953f-e69ca39ff46e","source":"wordfence","cve":"CVE-2026-24551","title":"Monetag Official <= 1.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/231d90b7-6bac-440e-953f-e69ca39ff46e?source=api-prod","affected":[{"type":"plugin","slug":"monetag-official","name":"Monetag Official Plugin","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-27T19:06:07Z"},{"id":"wordfence:231dbf87-2e17-4b4b-9eac-34a8b4a791ba","source":"wordfence","cve":"","title":"Elements For Elementor <= 1.9 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/231dbf87-2e17-4b4b-9eac-34a8b4a791ba?source=api-prod","affected":[{"type":"plugin","slug":"nd-elements","name":"Elements For Elementor","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:231f1e11-661d-40e4-a139-0ee2be95d551","source":"wordfence","cve":"CVE-2024-37094","title":"MasterStudy LMS <= 3.2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/231f1e11-661d-40e4-a139-0ee2be95d551?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:29:18Z"},{"id":"wordfence:2321c06c-f4b7-4a70-b8bf-3b3d815b836d","source":"wordfence","cve":"CVE-2025-46538","title":"Inline Text Popup <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2321c06c-f4b7-4a70-b8bf-3b3d815b836d?source=api-prod","affected":[{"type":"plugin","slug":"inline-text-popup","name":"Inline Text Popup","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:34:38Z"},{"id":"wordfence:232378ba-5992-4ac0-975b-8c329bce83b6","source":"wordfence","cve":"CVE-2024-9883","title":"Pods <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232378ba-5992-4ac0-975b-8c329bce83b6?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.7.1"}],"published":"2024-10-15T00:00:00Z","updated":"2026-09-16T23:58:18Z"},{"id":"wordfence:23239fc1-8683-446e-bc61-03d819edf99d","source":"wordfence","cve":"CVE-2020-14207","title":"DiveBook <= 1.1.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23239fc1-8683-446e-bc61-03d819edf99d?source=api-prod","affected":[{"type":"plugin","slug":"divebook","name":"DiveBook","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2020-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23245dee-a1d3-4ed6-860b-1644d79c7b57","source":"wordfence","cve":"CVE-2026-123468","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.128 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23245dee-a1d3-4ed6-860b-1644d79c7b57?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.128","to_inclusive":true,"patched_in":"1.4.129"}],"published":"2026-11-07T10:40:00Z","updated":"2026-11-10T20:00:18Z"},{"id":"wordfence:2326984b-8f2b-4922-8141-2fed0548101b","source":"wordfence","cve":"CVE-2025-22343","title":"wpSOL <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2326984b-8f2b-4922-8141-2fed0548101b?source=api-prod","affected":[{"type":"plugin","slug":"wpsol","name":"wpSOL","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:53:51Z"},{"id":"wordfence:2326ad3a-3b75-4a78-aebc-bb5814e221b4","source":"wordfence","cve":"CVE-2025-67626","title":"SEO Search <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2326ad3a-3b75-4a78-aebc-bb5814e221b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-search","name":"Pretty Search Permalinks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-12-20T00:00:00Z","updated":"2026-02-25T14:30:20Z"},{"id":"wordfence:2328efaf-4174-48f0-b575-1939d6af9216","source":"wordfence","cve":"CVE-2025-32203","title":"Falling things <= 1.08 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2328efaf-4174-48f0-b575-1939d6af9216?source=api-prod","affected":[{"type":"plugin","slug":"falling-things","name":"Falling Things","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":true,"patched_in":"1.09"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T13:02:03Z"},{"id":"wordfence:2329870b-3285-4fb2-92d1-8107eb101dff","source":"wordfence","cve":"CVE-2026-107653","title":"SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2329870b-3285-4fb2-92d1-8107eb101dff?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-10-30T17:44:45Z","updated":"2026-10-31T06:44:16Z"},{"id":"wordfence:232a274f-c194-4c5b-a1a8-899a822e47fc","source":"wordfence","cve":"CVE-2021-4096","title":"Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232a274f-c194-4c5b-a1a8-899a822e47fc?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2022-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:232cdd3b-4683-4e95-bdfd-acf0f32aeb2a","source":"wordfence","cve":"CVE-2024-1845","title":"VikRentCar Car Rental Management System <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232cdd3b-4683-4e95-bdfd-acf0f32aeb2a?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-07-20T00:00:00Z","updated":"2024-07-23T20:47:28Z"},{"id":"wordfence:232dd4fa-748e-4b65-8b78-7b2d8e9831aa","source":"wordfence","cve":"CVE-2019-13573","title":"FV Flowplayer Video Player <= 7.3.18.727 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232dd4fa-748e-4b65-8b78-7b2d8e9831aa?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.18.727","to_inclusive":true,"patched_in":"7.3.19.727"}],"published":"2019-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:232e6464-bd6c-4086-989a-00b84056c431","source":"wordfence","cve":"CVE-2024-32824","title":"Evergreen Content Poster <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232e6464-bd6c-4086-989a-00b84056c431?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:42:46Z"},{"id":"wordfence:232f3a15-3bd3-44fa-aa07-f055e8fcda88","source":"wordfence","cve":"CVE-2025-9334","title":"Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/232f3a15-3bd3-44fa-aa07-f055e8fcda88?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T05:52:43Z"},{"id":"wordfence:2330005e-c3ab-4556-aba9-f194a1ace329","source":"wordfence","cve":"","title":"WP Events <= 2.3.4 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2330005e-c3ab-4556-aba9-f194a1ace329?source=api-prod","affected":[{"type":"plugin","slug":"wp-events","name":"Events","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2017-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2330b18e-0907-47e1-b91f-1fe466bcf76b","source":"wordfence","cve":"","title":"Sprout Invoices <= 20.5.3 - Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2330b18e-0907-47e1-b91f-1fe466bcf76b?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.5.4","to_inclusive":false,"patched_in":"20.5.4"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2330e381-7db3-4b79-8827-818d2ea954b5","source":"wordfence","cve":"CVE-2026-19769","title":"Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2330e381-7db3-4b79-8827-818d2ea954b5?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-09-04T17:43:32Z","updated":"2026-09-05T06:37:56Z"},{"id":"wordfence:23311ce1-0e94-4bff-8d92-388ccc600506","source":"wordfence","cve":"CVE-2017-18524","title":"Football Pool < 2.6.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23311ce1-0e94-4bff-8d92-388ccc600506?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":false,"patched_in":"2.6.5"}],"published":"2017-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2331a587-b731-43d9-b813-9f08efc60bfc","source":"wordfence","cve":"CVE-2022-35277","title":"GetResponse <= 5.5.19 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2331a587-b731-43d9-b813-9f08efc60bfc?source=api-prod","affected":[{"type":"plugin","slug":"getresponse-integration","name":"GetResponse for WordPress","from":"*","from_inclusive":true,"to":"5.5.19","to_inclusive":true,"patched_in":"5.5.21"}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:233319cc-10fc-4a15-be35-df772e700639","source":"wordfence","cve":"CVE-2024-7716","title":"Logo Slider \u2013 Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation <= 3.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233319cc-10fc-4a15-be35-df772e700639?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2024-08-20T00:00:00Z","updated":"2024-09-12T15:07:20Z"},{"id":"wordfence:23334d94-e5b8-4c88-8765-02ad19e17248","source":"wordfence","cve":"CVE-2023-2767","title":"WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23334d94-e5b8-4c88-8765-02ad19e17248?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"},{"type":"plugin","slug":"wordpress-file-upload-pro","name":"WordPress File Upload Pro","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2335533d-c38a-450c-9fa1-0e236b5e92e6","source":"wordfence","cve":"CVE-2024-13684","title":"Reset <= 1.6 - Cross-Site Request Forgery to Database Reset","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2335533d-c38a-450c-9fa1-0e236b5e92e6?source=api-prod","affected":[{"type":"plugin","slug":"reset","name":"Reset \u2013 WordPress Database Reset Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-02-17T15:48:29Z","updated":"2025-03-03T15:31:30Z"},{"id":"wordfence:23393ac6-49b5-47b5-b999-3bf1ed0e88eb","source":"wordfence","cve":"CVE-2026-32568","title":"WooCommerce Designer Pro <= 1.9.33 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23393ac6-49b5-47b5-b999-3bf1ed0e88eb?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.33","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:36:16Z","updated":"2026-10-08T23:19:21Z"},{"id":"wordfence:23399606-20b6-4d0b-b613-06dc838dc1e7","source":"wordfence","cve":"CVE-2023-5952","title":"Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23399606-20b6-4d0b-b613-06dc838dc1e7?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2023-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2339c392-49bc-4744-b82a-d40f3bb4a81e","source":"wordfence","cve":"CVE-2020-24313","title":"Ultimate Appointment Booking & Scheduling < 1.1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2339c392-49bc-4744-b82a-d40f3bb4a81e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-appointment-scheduling","name":"Ultimate Appointment Booking & Scheduling","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"}],"published":"2020-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2339ebbf-2302-4e83-9743-ca79fda20f05","source":"wordfence","cve":"CVE-2024-5489","title":"Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2339ebbf-2302-4e83-9743-ca79fda20f05?source=api-prod","affected":[{"type":"plugin","slug":"custom-font-uploader","name":"Wbcom Designs \u2013 Custom Font Uploader","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-06T11:33:43Z"},{"id":"wordfence:2339ee6e-29b6-4c77-b345-cac3569b37a9","source":"wordfence","cve":"CVE-2025-58230","title":"ZoloBlocks <= 2.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2339ee6e-29b6-4c77-b345-cac3569b37a9?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.3.13"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-21T20:37:21Z"},{"id":"wordfence:233a29f5-12bf-4849-9b28-4458a0b0c940","source":"wordfence","cve":"CVE-2024-1361","title":"Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233a29f5-12bf-4849-9b28-4458a0b0c940?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.253","to_inclusive":true,"patched_in":"1.0.260"}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T11:03:45Z"},{"id":"wordfence:233a6ff1-d2ce-46f7-9644-fd136491eac1","source":"wordfence","cve":"CVE-2026-87979","title":"Paymob for WooCommerce <= 4.1.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233a6ff1-d2ce-46f7-9644-fd136491eac1?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.14"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:55:07Z"},{"id":"wordfence:233a75c7-9e45-4509-8f7c-584e2f5b38c7","source":"wordfence","cve":"CVE-2025-47687","title":"StoreKeeper for WooCommerce <= 14.4.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233a75c7-9e45-4509-8f7c-584e2f5b38c7?source=api-prod","affected":[{"type":"plugin","slug":"storekeeper-for-woocommerce","name":"StoreKeeper for WooCommerce","from":"*","from_inclusive":true,"to":"14.4.4","to_inclusive":true,"patched_in":"14.4.5"}],"published":"2025-05-09T00:00:00Z","updated":"2025-09-19T18:33:42Z"},{"id":"wordfence:233aab46-ec09-4c26-b4fc-2f095c225754","source":"wordfence","cve":"CVE-2025-62946","title":"Everest Backup <= 2.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233aab46-ec09-4c26-b4fc-2f095c225754?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2025-10-10T00:00:00Z","updated":"2025-11-24T19:25:30Z"},{"id":"wordfence:233df260-be3f-4d4b-9af8-a31a3577df1a","source":"wordfence","cve":"CVE-2025-23619","title":"Catch Duplicate Switcher <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233df260-be3f-4d4b-9af8-a31a3577df1a?source=api-prod","affected":[{"type":"plugin","slug":"catch-duplicate-switcher","name":"Catch Duplicate Switcher","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-01-16T00:00:00Z","updated":"2026-06-02T10:54:25Z"},{"id":"wordfence:233f3415-9d4f-4ddb-af69-55c832ff67a1","source":"wordfence","cve":"CVE-2026-14568","title":"User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/233f3415-9d4f-4ddb-af69-55c832ff67a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":false,"patched_in":"4.3.8"}],"published":"2026-07-06T00:00:00Z","updated":"2026-08-07T18:35:36Z"},{"id":"wordfence:23447ee8-e852-4ddf-a333-5d0df01c4195","source":"wordfence","cve":"CVE-2024-12682","title":"Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23447ee8-e852-4ddf-a333-5d0df01c4195?source=api-prod","affected":[{"type":"plugin","slug":"smart-maintenance-mode","name":"Smart Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:22:08Z"},{"id":"wordfence:2345c972-9fd4-4709-8bde-315ab54f60e2","source":"wordfence","cve":"CVE-2023-2303","title":"Contact Form and Calls To Action by vcita <= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2345c972-9fd4-4709-8bde-315ab54f60e2?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-a-meeting-scheduler-by-vcita","name":"Contact Form Builder by vcita","from":"*","from_inclusive":true,"to":"4.10.5","to_inclusive":true,"patched_in":"4.10.6"}],"published":"2023-06-02T00:00:00Z","updated":"2025-03-18T20:02:32Z"},{"id":"wordfence:234789db-1440-40ac-83e7-b8afb0ba4b5f","source":"wordfence","cve":"CVE-2024-12278","title":"Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234789db-1440-40ac-83e7-b8afb0ba4b5f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T20:19:14Z"},{"id":"wordfence:234a4cd9-4149-4ef0-b543-762a44cce73d","source":"wordfence","cve":"CVE-2025-22316","title":"WPBITS Addons For Elementor Page Builder <= 1.5.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234a4cd9-4149-4ef0-b543-762a44cce73d?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:55:02Z"},{"id":"wordfence:234a847b-3ffa-4c5c-9bba-39df227de0bc","source":"wordfence","cve":"","title":"Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234a847b-3ffa-4c5c-9bba-39df227de0bc?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2021-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:234abb7b-c810-489b-98d5-194340afdfb8","source":"wordfence","cve":"CVE-2026-114694","title":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234abb7b-c810-489b-98d5-194340afdfb8?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.8","to_inclusive":true,"patched_in":"7.4.9"}],"published":"2026-10-22T07:51:14Z","updated":"2026-10-28T01:20:18Z"},{"id":"wordfence:234c8c32-0661-4f54-ab16-c630d9aae82e","source":"wordfence","cve":"CVE-2025-49409","title":"SensorPress <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234c8c32-0661-4f54-ab16-c630d9aae82e?source=api-prod","affected":[{"type":"plugin","slug":"sensorpress-uptime-monitoring","name":"SensorPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:08:54Z"},{"id":"wordfence:234d79fc-5f00-457d-a693-ad3f6d38447b","source":"wordfence","cve":"CVE-2026-101924","title":"NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234d79fc-5f00-457d-a693-ad3f6d38447b?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:41:47Z","updated":"2026-10-14T04:28:11Z"},{"id":"wordfence:234df0e5-d1be-4354-8bfc-761bed1e9aa9","source":"wordfence","cve":"CVE-2023-2701","title":"Gravity Forms <= 2.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234df0e5-d1be-4354-8bfc-761bed1e9aa9?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2023-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:234df811-92d9-4645-b242-eb2c09bc6202","source":"wordfence","cve":"CVE-2023-49857","title":"Awesome Support <= 6.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/234df811-92d9-4645-b242-eb2c09bc6202?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2023-12-07T00:00:00Z","updated":"2026-05-07T13:57:59Z"},{"id":"wordfence:23518a21-7b76-4edb-9a35-b6f623ed50a7","source":"wordfence","cve":"CVE-2026-3001","title":"Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23518a21-7b76-4edb-9a35-b6f623ed50a7?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-27T07:45:55Z"},{"id":"wordfence:23521bba-8f3a-4d87-901a-cf2d666eefa4","source":"wordfence","cve":"CVE-2022-0814","title":"Ubigeo de Per\u00fa para Woocommerce y WordPress <= 3.6.3 - Unauthenticated SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23521bba-8f3a-4d87-901a-cf2d666eefa4?source=api-prod","affected":[{"type":"plugin","slug":"ubigeo-peru","name":"Ubigeo de Per\u00fa para Woocommerce y WordPress","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":false,"patched_in":"3.6.4"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2352dce7-5302-4892-9ae2-bf814f029af4","source":"wordfence","cve":"CVE-2023-37387","title":"Classified Listing <= 2.4.5 - Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2352dce7-5302-4892-9ae2-bf814f029af4?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23554f8a-9df4-483f-a929-4c5d76644cc2","source":"wordfence","cve":"CVE-2025-8073","title":"Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23554f8a-9df4-483f-a929-4c5d76644cc2?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-ajax-product-filters-for-woocommerce","name":"Dynamic AJAX Product Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-08-27T17:41:28Z","updated":"2025-08-28T06:42:36Z"},{"id":"wordfence:23587460-1d9e-47d4-9077-67d15ee38ca6","source":"wordfence","cve":"CVE-2025-28940","title":"Back To Top <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23587460-1d9e-47d4-9077-67d15ee38ca6?source=api-prod","affected":[{"type":"plugin","slug":"backtotop","name":"Back To Top","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:43:04Z"},{"id":"wordfence:235a637f-7617-485b-8a3e-15abfb21f8c2","source":"wordfence","cve":"CVE-2026-42721","title":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/235a637f-7617-485b-8a3e-15abfb21f8c2?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-10-07T09:56:00Z","updated":"2026-10-13T17:03:21Z"},{"id":"wordfence:235b197f-030e-4da2-8edf-e263fab6df14","source":"wordfence","cve":"CVE-2024-38715","title":"ExS Widgets <= 0.3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/235b197f-030e-4da2-8edf-e263fab6df14?source=api-prod","affected":[{"type":"plugin","slug":"exs-widgets","name":"ExS Widgets","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":"0.3.2"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-23T17:20:22Z"},{"id":"wordfence:235c9967-808f-45f2-85cf-7ee7a523593d","source":"wordfence","cve":"CVE-2015-4109","title":"Users Ultra <= 1.5.15 - Multiple SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/235c9967-808f-45f2-85cf-7ee7a523593d?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.5.16"}],"published":"2015-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23610b0a-3a70-4f67-9ff3-6291e2912922","source":"wordfence","cve":"CVE-2025-69296","title":"Aardvark <= 4.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23610b0a-3a70-4f67-9ff3-6291e2912922?source=api-prod","affected":[{"type":"theme","slug":"aardvark","name":"Aardvark - Community, Membership, BuddyPress Theme","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:36:10Z"},{"id":"wordfence:23623d4c-5859-48f8-b28d-3e3f15bade7d","source":"wordfence","cve":"CVE-2025-11873","title":"WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23623d4c-5859-48f8-b28d-3e3f15bade7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-bbcode","name":"WP BBCode","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:19:18Z","updated":"2025-11-11T03:30:33Z"},{"id":"wordfence:236387f0-b58e-4ef1-b370-a0703a7902eb","source":"wordfence","cve":"CVE-2023-34373","title":"Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236387f0-b58e-4ef1-b370-a0703a7902eb?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.93","to_inclusive":true,"patched_in":"3.3.94"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2363b377-b74e-43ad-969f-6bce0bac6000","source":"wordfence","cve":"CVE-2025-48314","title":"Add Code To Head <= 1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2363b377-b74e-43ad-969f-6bce0bac6000?source=api-prod","affected":[{"type":"plugin","slug":"add-code-to-head","name":"Add Code To Head","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.23"}],"published":"2025-08-25T00:00:00Z","updated":"2026-04-25T15:34:25Z"},{"id":"wordfence:2363b412-f14b-41e5-a1a7-707f5db2ce65","source":"wordfence","cve":"CVE-2025-39519","title":"Bulk Page Stub Creator <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2363b412-f14b-41e5-a1a7-707f5db2ce65?source=api-prod","affected":[{"type":"plugin","slug":"bulk-page-stub-creator","name":"Bulk Page Stub Creator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-30T13:42:37Z"},{"id":"wordfence:236876d4-7838-400d-839a-ce257bf42645","source":"wordfence","cve":"CVE-2024-39680","title":"Cooked \u2013 Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236876d4-7838-400d-839a-ce257bf42645?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-09T14:01:04Z"},{"id":"wordfence:23689d5e-46a4-4387-8f49-1bf9a5e7c550","source":"wordfence","cve":"CVE-2025-67597","title":"Fluent Booking <= 1.9.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23689d5e-46a4-4387-8f49-1bf9a5e7c550?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2025-11-25T00:00:00Z","updated":"2025-12-11T17:09:56Z"},{"id":"wordfence:2368e46a-022c-4829-80f1-7d010e8587ed","source":"wordfence","cve":"CVE-2026-25329","title":"Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2368e46a-022c-4829-80f1-7d010e8587ed?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.4","to_inclusive":true,"patched_in":"10.3.5"}],"published":"2026-02-05T00:00:00Z","updated":"2026-05-04T15:26:56Z"},{"id":"wordfence:23695c20-d8a1-4aea-92b9-f404e2cdc2fa","source":"wordfence","cve":"CVE-2017-20243","title":"Car Park Booking System <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":8.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23695c20-d8a1-4aea-92b9-f404e2cdc2fa?source=api-prod","affected":[{"type":"plugin","slug":"car-park-booking-system-for-wordpress","name":"Car Park Booking System for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T20:19:05Z"},{"id":"wordfence:2369c5f6-ba25-4bd9-a2b2-508399f285f1","source":"wordfence","cve":"CVE-2025-28903","title":"Driving Directions <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2369c5f6-ba25-4bd9-a2b2-508399f285f1?source=api-prod","affected":[{"type":"plugin","slug":"ddirections","name":"Driving Directions","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:59:00Z"},{"id":"wordfence:236bb9a8-49f7-4b75-a0b1-fa4ff65394f8","source":"wordfence","cve":"CVE-2025-31069","title":"HotStar \u2013 Multi-Purpose Business Theme <= 1.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236bb9a8-49f7-4b75-a0b1-fa4ff65394f8?source=api-prod","affected":[{"type":"theme","slug":"hotstar","name":"HotStar \u2013 MultiPurpose Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T15:52:44Z"},{"id":"wordfence:236dd639-7f05-4fe8-bb81-5d023ebe7962","source":"wordfence","cve":"CVE-2018-11486","title":"Advance Search for WooCommerce <= 1.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236dd639-7f05-4fe8-bb81-5d023ebe7962?source=api-prod","affected":[{"type":"plugin","slug":"woo-advance-search","name":"Advance Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2018-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:236eb45e-dfe1-4646-ad19-ba3ec859bb8e","source":"wordfence","cve":"CVE-2025-31770","title":"Content Manager Light <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236eb45e-dfe1-4646-ad19-ba3ec859bb8e?source=api-prod","affected":[{"type":"plugin","slug":"content-manager-light","name":"Content Manager Light","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:14:09Z"},{"id":"wordfence:236f5a78-435a-48d1-9dd7-c42a2155cb88","source":"wordfence","cve":"CVE-2026-4071","title":"BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/236f5a78-435a-48d1-9dd7-c42a2155cb88?source=api-prod","affected":[{"type":"plugin","slug":"birdseed","name":"BirdSeed","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:45:13Z","updated":"2026-06-02T07:48:28Z"},{"id":"wordfence:2372e851-97dd-449b-b356-f43f6fd409df","source":"wordfence","cve":"CVE-2025-31915","title":"Pixel WordPress Form BuilderPlugin & Autoresponder <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2372e851-97dd-449b-b356-f43f6fd409df?source=api-prod","affected":[{"type":"plugin","slug":"pixel-formbuilder","name":"Pixel WordPress Form BuilderPlugin & Autoresponder","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:09:03Z"},{"id":"wordfence:2375027c-9619-40fc-811d-7f4ba02bee53","source":"wordfence","cve":"CVE-2023-7174","title":"aBitGone CommentSafe <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2375027c-9619-40fc-811d-7f4ba02bee53?source=api-prod","affected":[{"type":"plugin","slug":"abitgone-commentsafe","name":"aBitGone CommentSafe","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:45:03Z"},{"id":"wordfence:23782888-eff0-4996-8369-6a19459248a4","source":"wordfence","cve":"CVE-2026-82213","title":"Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23782888-eff0-4996-8369-6a19459248a4?source=api-prod","affected":[{"type":"plugin","slug":"nexi-xpay-build","name":"Nexi XPay Build","from":"7.6.1","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:07:24Z"},{"id":"wordfence:2379a029-cc0d-4fa2-9aeb-47a4abd6b51a","source":"wordfence","cve":"CVE-2022-40312","title":"GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler","severity":"medium","cvss":4.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2379a029-cc0d-4fa2-9aeb-47a4abd6b51a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:237b4427-56e8-45af-b932-3610acf3651f","source":"wordfence","cve":"CVE-2025-49346","title":"Simple Archive Generator <= 5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/237b4427-56e8-45af-b932-3610acf3651f?source=api-prod","affected":[{"type":"plugin","slug":"simple-archive-generator","name":"Simple Archive Generator","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:17:10Z"},{"id":"wordfence:237fcdb7-aef9-4d35-baf4-7d382e8b7f3c","source":"wordfence","cve":"CVE-2024-32552","title":"Tagbox \u2013 UGC Galleries, Social Media Widgets, User Reviews & Analytics <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/237fcdb7-aef9-4d35-baf4-7d382e8b7f3c?source=api-prod","affected":[{"type":"plugin","slug":"taggbox-widget","name":"Taggbox: Social Media Feed Widget","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:14:47Z"},{"id":"wordfence:2387408b-3017-42c8-8663-3d7d5f858c8a","source":"wordfence","cve":"CVE-2025-31414","title":"Cost Calculator Builder <= 3.2.65 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2387408b-3017-42c8-8663-3d7d5f858c8a?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.65","to_inclusive":true,"patched_in":"3.2.66"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T13:15:00Z"},{"id":"wordfence:2389068b-b61d-4598-9a8a-8316a7421907","source":"wordfence","cve":"CVE-2024-37488","title":"HelloAsso <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2389068b-b61d-4598-9a8a-8316a7421907?source=api-prod","affected":[{"type":"plugin","slug":"helloasso","name":"HelloAsso","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:45:59Z"},{"id":"wordfence:2389eaae-374a-41c1-b28e-595841cda9a2","source":"wordfence","cve":"CVE-2025-48259","title":"WP Mapa Politico Espa\u00f1a <= 3.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2389eaae-374a-41c1-b28e-595841cda9a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-mapa-politico-spain","name":"WP Mapa Politico Espa\u00f1a","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T17:04:25Z"},{"id":"wordfence:2389f614-a9e6-479c-a713-71271d3a35c6","source":"wordfence","cve":"CVE-2024-39654","title":"Sign-up Sheets <= 2.2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2389f614-a9e6-479c-a713-71271d3a35c6?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:21:36Z"},{"id":"wordfence:238be5d8-8987-4ab0-ae8c-b07794d55bbe","source":"wordfence","cve":"CVE-2026-42698","title":"Tutor LMS \u2013 eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/238be5d8-8987-4ab0-ae8c-b07794d55bbe?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:43:43Z"},{"id":"wordfence:238dc80f-0d82-44e2-a950-321defb2361b","source":"wordfence","cve":"CVE-2015-9500","title":"Exquisite - Ultimate Newspaper Theme <= 1.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/238dc80f-0d82-44e2-a950-321defb2361b?source=api-prod","affected":[{"type":"theme","slug":"exquisite-wp","name":"Exquisite - Ultimate Newspaper Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2015-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:238f6d81-78ba-426c-866a-31f9279e4f99","source":"wordfence","cve":"CVE-2021-4385","title":"WP Private Content Plus <= 3.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/238f6d81-78ba-426c-866a-31f9279e4f99?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23924342-3b1d-4360-bd87-104091283e35","source":"wordfence","cve":"","title":"BuddyBuilder - BuddyPress Builder for Elementor <= 1.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23924342-3b1d-4360-bd87-104091283e35?source=api-prod","affected":[{"type":"plugin","slug":"stax-buddy-builder","name":"BuddyPress Builder for Elementor \u2013 BuddyBuilder","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23953909-4836-4226-b00b-eb0e24cc3ad7","source":"wordfence","cve":"CVE-2025-13989","title":"WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23953909-4836-4226-b00b-eb0e24cc3ad7?source=api-prod","affected":[{"type":"plugin","slug":"wp-dropzone","name":"WP Dropzone","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-12-11T15:09:54Z","updated":"2026-07-31T19:53:27Z"},{"id":"wordfence:23980e13-b632-43ec-938e-8171884cb87b","source":"wordfence","cve":"CVE-2023-27889","title":"LIQUID SPEECH BALLOON <= 1.1.8 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23980e13-b632-43ec-938e-8171884cb87b?source=api-prod","affected":[{"type":"plugin","slug":"liquid-speech-balloon","name":"LIQUID SPEECH BALLOON","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:239a02be-894e-446d-8fbc-66f8668e4da6","source":"wordfence","cve":"CVE-2026-84258","title":"click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/239a02be-894e-446d-8fbc-66f8668e4da6?source=api-prod","affected":[{"type":"plugin","slug":"click5-crm-add-on-to-ninja-forms","name":"click5 CRM add-on to Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:11:57Z"},{"id":"wordfence:239bdac1-c14b-42ff-bee5-130d0bf3394c","source":"wordfence","cve":"","title":"Custom Sidebars < 2.1.0.2 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/239bdac1-c14b-42ff-bee5-130d0bf3394c?source=api-prod","affected":[{"type":"plugin","slug":"custom-sidebars","name":"Custom Sidebars \u2013 Dynamic Sidebar Classic Widget Area Manager","from":"*","from_inclusive":true,"to":"2.1.0.2","to_inclusive":false,"patched_in":"2.1.0.2"}],"published":"2015-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:239dbe6b-3643-4d79-ab09-c3f7c53c6b0c","source":"wordfence","cve":"CVE-2025-27340","title":"F12-Profiler <= 1.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/239dbe6b-3643-4d79-ab09-c3f7c53c6b0c?source=api-prod","affected":[{"type":"plugin","slug":"f12-profiler","name":"F12 Profiler","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-04T13:06:48Z"},{"id":"wordfence:239f6fdc-d0d8-48e1-9ede-79087c1ee251","source":"wordfence","cve":"CVE-2025-49430","title":"Ultimate Video Player WordPress & WooCommerce Plugin <= 10.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/239f6fdc-d0d8-48e1-9ede-79087c1ee251?source=api-prod","affected":[{"type":"plugin","slug":"fwduvp","name":"Ultimate Video Player WordPress & WooCommerce Plugin","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-10T00:00:00Z","updated":"2025-09-25T20:22:15Z"},{"id":"wordfence:23a003aa-d929-4ec3-9d6f-da97222342dc","source":"wordfence","cve":"CVE-2022-4451","title":"Sassy Social Share <= 3.3.44 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a003aa-d929-4ec3-9d6f-da97222342dc?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.44","to_inclusive":true,"patched_in":"3.3.45"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a003fa-b640-499b-b927-03e8ce4fbd62","source":"wordfence","cve":"CVE-2025-58223","title":"VoucherPress <= 1.5.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a003fa-b640-499b-b927-03e8ce4fbd62?source=api-prod","affected":[{"type":"plugin","slug":"voucherpress","name":"VoucherPress","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:34:17Z"},{"id":"wordfence:23a01c60-d843-4fc5-a5fa-677f452008b5","source":"wordfence","cve":"CVE-2021-24531","title":"Charitable \u2013 Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a01c60-d843-4fc5-a5fa-677f452008b5?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.6.50","to_inclusive":true,"patched_in":"1.6.51"}],"published":"2021-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a081d4-443d-4b3b-8c89-9eb0e23c961e","source":"wordfence","cve":"CVE-2024-10187","title":"myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a081d4-443d-4b3b-8c89-9eb0e23c961e?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2024-11-07T21:21:56Z","updated":"2024-11-08T09:29:34Z"},{"id":"wordfence:23a0dcdf-e98f-4e24-9900-49ca522b8038","source":"wordfence","cve":"CVE-2024-9884","title":"T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a0dcdf-e98f-4e24-9900-49ca522b8038?source=api-prod","affected":[{"type":"plugin","slug":"t-countdown","name":"T(-) Countdown","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T13:32:45Z","updated":"2024-10-30T02:04:33Z"},{"id":"wordfence:23a1128f-b8a1-4dec-adf4-43fb96806b60","source":"wordfence","cve":"CVE-2025-54719","title":"Yogi - Health Beauty & Yoga <= 2.9.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a1128f-b8a1-4dec-adf4-43fb96806b60?source=api-prod","affected":[{"type":"theme","slug":"noo-yogi","name":"Yogi - Health Beauty & Yoga WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-08-02T00:00:00Z","updated":"2025-11-12T13:43:41Z"},{"id":"wordfence:23a1dad4-599e-4d3f-b1d5-c77ec1bbcf22","source":"wordfence","cve":"CVE-2025-66133","title":"Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a1dad4-599e-4d3f-b1d5-c77ec1bbcf22?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:54:10Z"},{"id":"wordfence:23a20e57-0228-4e37-a105-e693c05a0a24","source":"wordfence","cve":"CVE-2022-40686","title":"Creative Mail <= 1.5.4 - Cross-Site Request Forgery to Plugin Deactivation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a20e57-0228-4e37-a105-e693c05a0a24?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a2b1ac-2183-48ae-8376-fb950fe83fd9","source":"wordfence","cve":"CVE-2023-33329","title":"Custom Post Type Generator <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a2b1ac-2183-48ae-8376-fb950fe83fd9?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-generator","name":"Custom Post Type Generator","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a2fd80-65cb-4e92-978d-c365f08b4c0b","source":"wordfence","cve":"","title":"Subpages Extended <= 1.6.6 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a2fd80-65cb-4e92-978d-c365f08b4c0b?source=api-prod","affected":[{"type":"plugin","slug":"subpages-extended","name":"Subpages Extended","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2022-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a32202-d037-4931-823a-482ae2c6a18f","source":"wordfence","cve":"CVE-2026-96525","title":"MCP Server for WordPress <= 1.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a32202-d037-4931-823a-482ae2c6a18f?source=api-prod","affected":[{"type":"plugin","slug":"ai-workflow-automation-ai-agent-hub","name":"MCP Server for WordPress \u2013 Connect Claude, ChatGPT & Gemini | AtlasMCP","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:55:19Z"},{"id":"wordfence:23a3a4c5-0af0-4b5f-b3c7-bf670efea84f","source":"wordfence","cve":"CVE-2024-0250","title":"Analytics Insights <= 6.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a3a4c5-0af0-4b5f-b3c7-bf670efea84f?source=api-prod","affected":[{"type":"plugin","slug":"analytics-insights","name":"Analytics Insights \u2013 Google Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-22T17:48:41Z"},{"id":"wordfence:23a50221-af0c-46e6-94d5-1d07f6b6fb01","source":"wordfence","cve":"CVE-2026-12424","title":"ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a50221-af0c-46e6-94d5-1d07f6b6fb01?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.3"}],"published":"2026-11-10T19:05:30Z","updated":"2026-11-11T07:26:40Z"},{"id":"wordfence:23a56043-5dcb-435b-8fde-b09c52466c40","source":"wordfence","cve":"CVE-2024-51667","title":"Paytium <= 4.4.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a56043-5dcb-435b-8fde-b09c52466c40?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:30:42Z"},{"id":"wordfence:23a66e6b-cec0-4110-9bef-a5d41ce1c954","source":"wordfence","cve":"CVE-2024-4156","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a66e6b-cec0-4110-9bef-a5d41ce1c954?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.17","to_inclusive":true,"patched_in":"5.9.18"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:51:52Z"},{"id":"wordfence:23a73680-ed13-4250-95e8-2933403f54e6","source":"wordfence","cve":"CVE-2026-14328","title":"Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a73680-ed13-4250-95e8-2933403f54e6?source=api-prod","affected":[{"type":"plugin","slug":"plugins-on-steroids","name":"Eazy Plugin Manager","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-27T21:29:11Z","updated":"2026-09-18T19:19:36Z"},{"id":"wordfence:23a94578-f395-4ec1-8a08-52ca233cc832","source":"wordfence","cve":"CVE-2021-24958","title":"Meks Easy Photo Feed Widget < 1.2.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a94578-f395-4ec1-8a08-52ca233cc832?source=api-prod","affected":[{"type":"plugin","slug":"meks-easy-instagram-widget","name":"Meks Easy Photo Feed Widget","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2021-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23a95be7-4d23-4595-ae89-48bfcb4c78c5","source":"wordfence","cve":"CVE-2025-49237","title":"POEditor <= 0.9.10 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a95be7-4d23-4595-ae89-48bfcb4c78c5?source=api-prod","affected":[{"type":"plugin","slug":"poeditor","name":"POEditor","from":"*","from_inclusive":true,"to":"0.9.10","to_inclusive":true,"patched_in":"0.9.11"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:33:22Z"},{"id":"wordfence:23a9b6ee-55d9-4e44-926b-f253e83ca78c","source":"wordfence","cve":"CVE-2025-68981","title":"HomeFix Elementor Portfolio <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23a9b6ee-55d9-4e44-926b-f253e83ca78c?source=api-prod","affected":[{"type":"plugin","slug":"homefix-ele-portfolio","name":"HomeFix Elementor Portfolio","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-06T15:16:39Z"},{"id":"wordfence:23aa8a2f-9238-4d93-b2d2-de7838ccb156","source":"wordfence","cve":"CVE-2015-3314","title":"Tune Library < 1.5.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23aa8a2f-9238-4d93-b2d2-de7838ccb156?source=api-prod","affected":[{"type":"plugin","slug":"tune-library","name":"Tune Library","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23ad80bd-3e35-4610-b917-7242a4292adf","source":"wordfence","cve":"CVE-2024-6724","title":"Generate Images \u2013 Magic Post Thumbnail <= 5.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ad80bd-3e35-4610-b917-7242a4292adf?source=api-prod","affected":[{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-14T20:24:57Z"},{"id":"wordfence:23ae17a6-a745-42c4-8627-ad1c41b66e0e","source":"wordfence","cve":"CVE-2024-6639","title":"MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ae17a6-a745-42c4-8627-ad1c41b66e0e?source=api-prod","affected":[{"type":"theme","slug":"MDx","name":"MDx","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-12T13:49:22Z"},{"id":"wordfence:23af50ec-e293-4c06-be64-474057e25845","source":"wordfence","cve":"CVE-2024-29909","title":"Travelers' Map <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23af50ec-e293-4c06-be64-474057e25845?source=api-prod","affected":[{"type":"plugin","slug":"travelers-map","name":"Travelers' Map","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:07:52Z"},{"id":"wordfence:23b018d3-3451-4ae8-b571-07e931ad23df","source":"wordfence","cve":"CVE-2023-25058","title":"Schema - All In One Schema Rich Snippets <= 1.6.5 - Cross-Site Request Forgery in rich_snippet_dashboard","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b018d3-3451-4ae8-b571-07e931ad23df?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-schemaorg-rich-snippets","name":"Schema \u2013 All In One Schema Rich Snippets","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23b21dbd-caf7-49fc-bed4-4017151ee4ad","source":"wordfence","cve":"CVE-2026-1948","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b21dbd-caf7-49fc-bed4-4017151ee4ad?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.9","to_inclusive":true,"patched_in":"9.1.10"}],"published":"2026-03-13T15:17:36Z","updated":"2026-03-14T03:24:14Z"},{"id":"wordfence:23b2d82a-5c2b-405e-b52e-b1b968f3f48a","source":"wordfence","cve":"CVE-2025-32573","title":"KiotViet Sync <= 1.8.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b2d82a-5c2b-405e-b52e-b1b968f3f48a?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-04-15T00:00:00Z","updated":"2025-05-16T15:17:00Z"},{"id":"wordfence:23b2fc40-d8e3-4b84-ab8d-ff82a6f21842","source":"wordfence","cve":"CVE-2016-6634","title":"WordPress Core < 4.5 - Cross-Site Scripting via Network Settings Page","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b2fc40-d8e3-4b84-ab8d-ff82a6f21842?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":false,"patched_in":"4.5"}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23b33b77-2e72-4959-bdce-646e968f2a73","source":"wordfence","cve":"CVE-2024-8432","title":"Appointment & Event Booking Calendar Plugin \u2013 Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b33b77-2e72-4959-bdce-646e968f2a73?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"5.0.48","to_inclusive":true,"patched_in":"5.0.50"}],"published":"2024-09-23T13:28:09Z","updated":"2024-09-24T01:56:46Z"},{"id":"wordfence:23b3570c-cd8e-4dec-bbad-6374c44530bd","source":"wordfence","cve":"CVE-2024-12820","title":"MK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b3570c-cd8e-4dec-bbad-6374c44530bd?source=api-prod","affected":[{"type":"plugin","slug":"google-distance-calculator","name":"MK Google Directions","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-02-27T16:43:07Z","updated":"2025-02-28T05:23:17Z"},{"id":"wordfence:23b46e5b-ce1e-4215-921c-edea7fd6c56a","source":"wordfence","cve":"CVE-2023-5537","title":"Delete Usermetas <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b46e5b-ce1e-4215-921c-edea7fd6c56a?source=api-prod","affected":[{"type":"plugin","slug":"delete-usermetas","name":"Delete Usermetas","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23b4e19d-d8ba-469c-8463-bace9a7d9726","source":"wordfence","cve":"CVE-2025-31920","title":"WP Guppy <= 4.3.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b4e19d-d8ba-469c-8463-bace9a7d9726?source=api-prod","affected":[{"type":"plugin","slug":"wp-guppy","name":"WP Guppy","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:57:35Z"},{"id":"wordfence:23b56bc5-0253-43bf-a4db-f924bfaf1225","source":"wordfence","cve":"CVE-2025-4429","title":"Gearside Developer Dashboard <= 1.0.72 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b56bc5-0253-43bf-a4db-f924bfaf1225?source=api-prod","affected":[{"type":"plugin","slug":"gearside-developer-dashboard","name":"Gearside Developer Dashboard","from":"*","from_inclusive":true,"to":"1.0.72","to_inclusive":true,"patched_in":""}],"published":"2025-05-09T00:00:00Z","updated":"2025-06-02T20:00:32Z"},{"id":"wordfence:23b5cc65-70d2-46b1-a37a-97af231aff51","source":"wordfence","cve":"CVE-2014-10382","title":"Featured Comments < 1.2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b5cc65-70d2-46b1-a37a-97af231aff51?source=api-prod","affected":[{"type":"plugin","slug":"feature-comments","name":"Featured Comments","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2014-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23b6e418-5560-4543-9042-5f338df315e5","source":"wordfence","cve":"CVE-2024-37520","title":"ShopBuilder \u2013 Elementor WooCommerce Builder Addons <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b6e418-5560-4543-9042-5f338df315e5?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-11T13:19:19Z"},{"id":"wordfence:23b75226-e7c9-4b22-aa1b-1a7d400856d2","source":"wordfence","cve":"","title":"Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b75226-e7c9-4b22-aa1b-1a7d400856d2?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23b75e50-1d8b-4a5d-9979-5938613e1e86","source":"wordfence","cve":"CVE-2026-119219","title":"Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23b75e50-1d8b-4a5d-9979-5938613e1e86?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.62.0","to_inclusive":true,"patched_in":"4.63.0"}],"published":"2026-11-06T14:00:59Z","updated":"2026-11-07T02:29:13Z"},{"id":"wordfence:23bcd8b4-04c9-4b7e-b114-70f2675ca2bd","source":"wordfence","cve":"CVE-2025-26875","title":"Multiple Shipping And Billing Address For Woocommerce <= 1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23bcd8b4-04c9-4b7e-b114-70f2675ca2bd?source=api-prod","affected":[{"type":"plugin","slug":"different-shipping-and-billing-address-for-woocommerce","name":"Multiple Shipping And Billing Address For WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-10T14:40:47Z"},{"id":"wordfence:23bfcdd1-b99d-47eb-9f88-96f9ecc53b32","source":"wordfence","cve":"CVE-2024-4010","title":"Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23bfcdd1-b99d-47eb-9f88-96f9ecc53b32?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"5.7.20"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T08:34:14Z"},{"id":"wordfence:23bff566-ec45-4b87-adfd-6e4fade97e9f","source":"wordfence","cve":"CVE-2026-23542","title":"Grand Restaurant <= 7.0.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23bff566-ec45-4b87-adfd-6e4fade97e9f?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-25T15:12:41Z"},{"id":"wordfence:23c7a244-4dee-403d-aaad-f6ca97567d1c","source":"wordfence","cve":"CVE-2025-39441","title":"Dashboard Notepads <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23c7a244-4dee-403d-aaad-f6ca97567d1c?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-notepads","name":"Dashboard Notepads","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:39:32Z"},{"id":"wordfence:23c89d9f-8958-4333-8604-54173c31efac","source":"wordfence","cve":"CVE-2024-13767","title":"Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23c89d9f-8958-4333-8604-54173c31efac?source=api-prod","affected":[{"type":"plugin","slug":"live-2d","name":"Live2DWebCanvas","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2025-01-30T14:13:17Z","updated":"2025-04-30T15:18:33Z"},{"id":"wordfence:23c99d3c-5ee5-4793-92a4-f49bf345c634","source":"wordfence","cve":"CVE-2025-48123","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23c99d3c-5ee5-4793-92a4-f49bf345c634?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-09-18T14:34:58Z"},{"id":"wordfence:23c9cb06-70c0-4d91-8147-256a77c65d7a","source":"wordfence","cve":"CVE-2025-30808","title":"About Author <= 1.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23c9cb06-70c0-4d91-8147-256a77c65d7a?source=api-prod","affected":[{"type":"plugin","slug":"about-author","name":"About Author","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:25:09Z"},{"id":"wordfence:23ca6846-83b7-4daa-b17b-6ca8c758dbb0","source":"wordfence","cve":"CVE-2025-25085","title":"WP SimpleWeather <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ca6846-83b7-4daa-b17b-6ca8c758dbb0?source=api-prod","affected":[{"type":"plugin","slug":"wp-simpleweather","name":"WP SimpleWeather","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:46:19Z"},{"id":"wordfence:23caef95-36b6-40aa-8dd7-51a376790a40","source":"wordfence","cve":"CVE-2024-0324","title":"User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update","severity":"high","cvss":8.2,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23caef95-36b6-40aa-8dd7-51a376790a40?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2024-01-16T00:00:00Z","updated":"2024-07-29T21:36:00Z"},{"id":"wordfence:23cdd891-bfa0-472c-b99f-5aac45202bc8","source":"wordfence","cve":"CVE-2025-32191","title":"News Element Elementor Blog Magazine <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23cdd891-bfa0-472c-b99f-5aac45202bc8?source=api-prod","affected":[{"type":"plugin","slug":"news-element","name":"News Element Elementor Blog Magazine","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:56:55Z"},{"id":"wordfence:23ceca79-03f0-4ed8-a02f-c3502f8dd968","source":"wordfence","cve":"CVE-2026-87854","title":"Subscriptions for WooCommerce <= 2.0.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ceca79-03f0-4ed8-a02f-c3502f8dd968?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:00:38Z"},{"id":"wordfence:23d49ee8-9afb-479a-85e7-a83cd5ae5186","source":"wordfence","cve":"CVE-2025-48117","title":"WooCommerce POS <= 1.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d49ee8-9afb-479a-85e7-a83cd5ae5186?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pos","name":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-22T13:47:51Z"},{"id":"wordfence:23d5e2ba-3a8a-4ded-aba9-fa0a7228a398","source":"wordfence","cve":"CVE-2024-31353","title":"Slideshow Gallery <= 1.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d5e2ba-3a8a-4ded-aba9-fa0a7228a398?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-04-07T00:00:00Z","updated":"2024-06-07T12:51:30Z"},{"id":"wordfence:23d75811-37cc-4bb0-94a3-0f8dd363c679","source":"wordfence","cve":"CVE-2025-32149","title":"teachPress <= 9.0.11 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d75811-37cc-4bb0-94a3-0f8dd363c679?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.11","to_inclusive":true,"patched_in":"9.0.12"}],"published":"2025-04-04T00:00:00Z","updated":"2026-02-26T15:05:48Z"},{"id":"wordfence:23d762e9-d43f-4520-a6f1-c920417a2436","source":"wordfence","cve":"CVE-2024-32830","title":"BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery","severity":"critical","cvss":9.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d762e9-d43f-4520-a6f1-c920417a2436?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T13:53:27Z"},{"id":"wordfence:23d7b6fc-0eb7-4bd1-ac48-3797aec08496","source":"wordfence","cve":"CVE-2025-32224","title":"Privyr CRM <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d7b6fc-0eb7-4bd1-ac48-3797aec08496?source=api-prod","affected":[{"type":"plugin","slug":"privy-crm-integration","name":"Privyr CRM \u2013 Instant Lead Alerts for Contact Forms","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:15:43Z"},{"id":"wordfence:23d8c56b-01f1-48b4-a58d-958457be738f","source":"wordfence","cve":"CVE-2014-100001","title":"SEO Plugin LiveOptim <= 1.1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23d8c56b-01f1-48b4-a58d-958457be738f?source=api-prod","affected":[{"type":"plugin","slug":"liveoptim","name":"SEO Plugin LiveOptim","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2014-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23da892a-62c1-4c4b-8b86-4b55018c309b","source":"wordfence","cve":"CVE-2024-44034","title":"WPSPX <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23da892a-62c1-4c4b-8b86-4b55018c309b?source=api-prod","affected":[{"type":"plugin","slug":"wpspx","name":"WPSPX","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:40:39Z"},{"id":"wordfence:23e04283-5644-4e23-bc42-0a0963a38b71","source":"wordfence","cve":"CVE-2024-33635","title":"Piotnet Addons For Elementor Pro <= 7.1.17 - Missing Authorization to Arbitrary Post/Page Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e04283-5644-4e23-bc42-0a0963a38b71?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:25:31Z"},{"id":"wordfence:23e0f61b-f122-46f7-83c8-7fcb022c45e9","source":"wordfence","cve":"CVE-2021-24363","title":"Photo Gallery <= 1.5.74 - File Upload Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e0f61b-f122-46f7-83c8-7fcb022c45e9?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.75","to_inclusive":false,"patched_in":"1.5.75"}],"published":"2021-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23e1a1e0-fcc2-441f-b77e-1b3d991262ea","source":"wordfence","cve":"CVE-2025-49033","title":"ProfileGrid  <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e1a1e0-fcc2-441f-b77e-1b3d991262ea?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.3","to_inclusive":true,"patched_in":"5.9.5.4"}],"published":"2025-07-24T00:00:00Z","updated":"2025-07-28T20:36:07Z"},{"id":"wordfence:23e1fffa-9170-4bc2-ad7e-27708a08033b","source":"wordfence","cve":"CVE-2024-12043","title":"Prime Slider \u2013 Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e1fffa-9170-4bc2-ad7e-27708a08033b?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.16.5","to_inclusive":true,"patched_in":"3.16.6"}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-23T11:13:29Z"},{"id":"wordfence:23e39019-c322-4027-84f2-faabd9ca4983","source":"wordfence","cve":"CVE-2023-6781","title":"Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e39019-c322-4027-84f2-faabd9ca4983?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.26","to_inclusive":true,"patched_in":"2.10.27"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:36:00Z"},{"id":"wordfence:23e3c738-268e-4467-ad73-fe9b355b3000","source":"wordfence","cve":"CVE-2025-31600","title":"DesignO <= 2.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e3c738-268e-4467-ad73-fe9b355b3000?source=api-prod","affected":[{"type":"plugin","slug":"designo","name":"DesignO","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:08:11Z"},{"id":"wordfence:23e47daa-79e7-4ed3-a88a-0f090e9aa277","source":"wordfence","cve":"CVE-2025-4583","title":"Smash Balloon Instagram Feed <= 6.9.0 (Free) & <= 6.8.0 (Pro) - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23e47daa-79e7-4ed3-a88a-0f090e9aa277?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"},{"type":"plugin","slug":"instagram-feed-pro","name":"Smash Balloon Instagram Feed Pro","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2025-05-28T16:22:08Z","updated":"2025-06-26T15:31:29Z"},{"id":"wordfence:23ea062b-9d9f-4db0-9263-95bacf7def73","source":"wordfence","cve":"CVE-2024-56257","title":"Coins MarketCap <= 5.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ea062b-9d9f-4db0-9263-95bacf7def73?source=api-prod","affected":[{"type":"plugin","slug":"coins-marketcap","name":"Coins MarketCap","from":"*","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"5.5.9"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:04:31Z"},{"id":"wordfence:23ece2d6-5eff-4897-ab4b-56443b77fdf0","source":"wordfence","cve":"CVE-2025-53583","title":"Employee Spotlight <= 5.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ece2d6-5eff-4897-ab4b-56443b77fdf0?source=api-prod","affected":[{"type":"plugin","slug":"employee-spotlight","name":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:53:53Z"},{"id":"wordfence:23ee5d94-5a51-4ee3-945c-422f3f07634e","source":"wordfence","cve":"CVE-2024-33648","title":"Recencio Book Reviews <= 1.66.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ee5d94-5a51-4ee3-945c-422f3f07634e?source=api-prod","affected":[{"type":"plugin","slug":"recencio-book-reviews","name":"Recencio Book Reviews","from":"*","from_inclusive":true,"to":"1.66.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:51:14Z"},{"id":"wordfence:23f00e28-4ad1-4ae6-8d43-12097ee6bf90","source":"wordfence","cve":"CVE-2024-54408","title":"Youtube Video Grid <= 1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f00e28-4ad1-4ae6-8d43-12097ee6bf90?source=api-prod","affected":[{"type":"plugin","slug":"youmax-channel-embeds-for-youtube-businesses","name":"Youtube Video Grid | Youmax","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:31:53Z"},{"id":"wordfence:23f0315f-5523-4e16-8adf-f9fe9254032a","source":"wordfence","cve":"","title":"Super Store Finder <= 6.1, Super Interactive Maps <= 1.9, Super Logo Showcase <= 2.2  - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f0315f-5523-4e16-8adf-f9fe9254032a?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"},{"type":"plugin","slug":"superlogoshowcase-wp","name":"Super Logos Showcase for WordPress","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"super-interactive-maps","name":"Super Interactive Maps","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2020-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23f1b1da-2ac0-49c1-bb32-2fe2cfd56192","source":"wordfence","cve":"","title":"Real Testimonials <= 2.1.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f1b1da-2ac0-49c1-bb32-2fe2cfd56192?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2"}],"published":"2020-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23f53ff1-f0bc-4ad3-9b9e-cf365f064066","source":"wordfence","cve":"CVE-2024-13655","title":"Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f53ff1-f0bc-4ad3-9b9e-cf365f064066?source=api-prod","affected":[{"type":"theme","slug":"flex-mag","name":"Flex Mag - Responsive WordPress News Theme","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T06:40:03Z"},{"id":"wordfence:23f58949-6cc7-45a3-a6a0-58213bb03679","source":"wordfence","cve":"CVE-2022-25604","title":"Price Table <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f58949-6cc7-45a3-a6a0-58213bb03679?source=api-prod","affected":[{"type":"plugin","slug":"pricetable","name":"Price Table","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2022-01-27T11:22:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23f7f4ad-f9d5-44b7-8354-5145b003fd20","source":"wordfence","cve":"CVE-2023-23806","title":"WordPress Custom Settings <= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f7f4ad-f9d5-44b7-8354-5145b003fd20?source=api-prod","affected":[{"type":"plugin","slug":"custom-settings","name":"WordPress Custom Settings","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23f8e757-a4ed-4929-9647-dfe5a21689aa","source":"wordfence","cve":"CVE-2024-43969","title":"Spiffy Calendar <= 4.9.12 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f8e757-a4ed-4929-9647-dfe5a21689aa?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"4.9.13"}],"published":"2024-08-28T00:00:00Z","updated":"2024-10-04T16:26:21Z"},{"id":"wordfence:23f9d758-4b5e-44e5-9f58-a37b01c4ffdb","source":"wordfence","cve":"CVE-2021-4386","title":"WP Security Question <= 1.0.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23f9d758-4b5e-44e5-9f58-a37b01c4ffdb?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-questions","name":"WP Security Question","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23fbb011-cf60-4c75-ac68-b5d0dfa3c356","source":"wordfence","cve":"CVE-2019-11565","title":"Print My Blog <= 1.6.6 - Server-Side Request Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23fbb011-cf60-4c75-ac68-b5d0dfa3c356?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2019-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:23fc3221-73b0-4407-a5d7-f145c3dbc1e6","source":"wordfence","cve":"CVE-2025-52710","title":"File Manager Pro <= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23fc3221-73b0-4407-a5d7-f145c3dbc1e6?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:06:29Z"},{"id":"wordfence:23feb72c-7e6f-436b-b56e-dc6185302d31","source":"wordfence","cve":"CVE-2024-1794","title":"Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23feb72c-7e6f-436b-b56e-dc6185302d31?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.29.0","to_inclusive":true,"patched_in":"1.29.1"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-09T18:58:38Z"},{"id":"wordfence:23ff12f0-eb9d-4bb3-8db0-0e794c0f0594","source":"wordfence","cve":"CVE-2024-5708","title":"WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/23ff12f0-eb9d-4bb3-8db0-0e794c0f0594?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-06T05:32:01Z"},{"id":"wordfence:24009534-3a57-4ed3-b841-72e87e2a6925","source":"wordfence","cve":"CVE-2026-23799","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24009534-3a57-4ed3-b841-72e87e2a6925?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:57:17Z"},{"id":"wordfence:2403dd59-7b9e-490e-86d8-5a10f9eee616","source":"wordfence","cve":"CVE-2024-13478","title":"LTL Freight Quotes \u2013 TForce Edition <= 3.6.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2403dd59-7b9e-490e-86d8-5a10f9eee616?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-ups-edition","name":"LTL Freight Quotes \u2013 TForce Edition","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:39Z"},{"id":"wordfence:240691c4-35c5-40e1-b1ab-a500ffcdac73","source":"wordfence","cve":"CVE-2023-1122","title":"Simple Giveaways <= 2.45.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Form, Prize, and Sharing Method Fields","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240691c4-35c5-40e1-b1ab-a500ffcdac73?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":true,"patched_in":"2.45.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2406db9d-ab51-4a16-83ba-5076135a0369","source":"wordfence","cve":"CVE-2026-87888","title":"YayPricing \u2013 WooCommerce Dynamic Pricing & Discounts < 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2406db9d-ab51-4a16-83ba-5076135a0369?source=api-prod","affected":[{"type":"plugin","slug":"yaypricing","name":"YayPricing \u2013 WooCommerce Dynamic Pricing & Discounts","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":false,"patched_in":"3.5.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T20:07:21Z"},{"id":"wordfence:24092cd1-cf89-49c1-a607-4d5d06d0c804","source":"wordfence","cve":"CVE-2024-48028","title":"IP Loc8 <= 1.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24092cd1-cf89-49c1-a607-4d5d06d0c804?source=api-prod","affected":[{"type":"plugin","slug":"ip-loc8","name":"IP Loc8","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:54:52Z"},{"id":"wordfence:240bf16c-2535-45ae-939b-e288225a3082","source":"wordfence","cve":"CVE-2025-22525","title":"Donation Block For PayPal <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240bf16c-2535-45ae-939b-e288225a3082?source=api-prod","affected":[{"type":"plugin","slug":"donations-block","name":"Donation Block For PayPal","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-01-07T00:00:00Z","updated":"2025-07-25T15:06:23Z"},{"id":"wordfence:240cc19a-9bae-4e69-a16f-46901daaa945","source":"wordfence","cve":"","title":"Brandfolder \u2013 Digital Asset Management Simplified. < 3.0.1 - Local/Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240cc19a-9bae-4e69-a16f-46901daaa945?source=api-prod","affected":[{"type":"plugin","slug":"brandfolder","name":"Brandfolder \u2013 Digital Asset Management Simplified.","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2016-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:240ceafb-55a1-44cd-ae4f-efeb2e58f9bb","source":"wordfence","cve":"CVE-2026-87762","title":"Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240ceafb-55a1-44cd-ae4f-efeb2e58f9bb?source=api-prod","affected":[{"type":"plugin","slug":"adwised","name":"Adwised Web Push Notification","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:16:15Z"},{"id":"wordfence:240f05b0-876d-449c-ade0-118b1e3ab206","source":"wordfence","cve":"CVE-2025-62087","title":"Sticky Notes for WP Dashboard <= 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240f05b0-876d-449c-ade0-118b1e3ab206?source=api-prod","affected":[{"type":"plugin","slug":"wb-sticky-notes","name":"Sticky Notes for WP Dashboard","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-25T14:39:44Z"},{"id":"wordfence:240f1845-5566-43d7-9125-78c244e2913a","source":"wordfence","cve":"CVE-2026-57335","title":"Quads Ads Manager for Google AdSense <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240f1845-5566-43d7-9125-78c244e2913a?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:55:28Z"},{"id":"wordfence:240fbd3b-3daf-415e-9551-76e3909508da","source":"wordfence","cve":"CVE-2025-23873","title":"Category D3 Tree <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/240fbd3b-3daf-415e-9551-76e3909508da?source=api-prod","affected":[{"type":"plugin","slug":"category-d3-tree","name":"Category D3 Tree","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:09:02Z"},{"id":"wordfence:241073e4-b8f2-4dd3-ad66-6dda8c61b42c","source":"wordfence","cve":"CVE-2015-2755","title":"AB Google Map Travel (AB-MAP) < 4.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241073e4-b8f2-4dd3-ad66-6dda8c61b42c?source=api-prod","affected":[{"type":"plugin","slug":"ab-google-map-travel","name":"AB Google Map Travel (AB-MAP)","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2015-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24118410-e5a5-46fa-ac33-ce58cb2f75a3","source":"wordfence","cve":"CVE-2025-14545","title":"YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24118410-e5a5-46fa-ac33-ce58cb2f75a3?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"5.0.26","to_inclusive":false,"patched_in":"5.0.26"}],"published":"2026-03-19T00:00:00Z","updated":"2026-04-15T18:43:55Z"},{"id":"wordfence:24120d7f-e382-45d5-aeab-bc302415c1f1","source":"wordfence","cve":"CVE-2024-54441","title":"Utech World Time <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24120d7f-e382-45d5-aeab-bc302415c1f1?source=api-prod","affected":[{"type":"plugin","slug":"utech-world-time-for-wp","name":"Utech World Time","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:56:13Z"},{"id":"wordfence:24123a4f-da33-4d50-9e82-18f910de6619","source":"wordfence","cve":"CVE-2021-24457","title":"Portfolio Responsive Gallery <= 1.1.7 - Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24123a4f-da33-4d50-9e82-18f910de6619?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-responsive-gallery","name":"Portfolio Responsive Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24142874-95f9-448d-8cf2-14a65fc946ab","source":"wordfence","cve":"CVE-2024-1287","title":"Paid Memberships Pro - Member Directory Add On < 1.2.6 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24142874-95f9-448d-8cf2-14a65fc946ab?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-member-directory","name":"Paid Memberships Pro - Member Directory Add On","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T17:07:56Z"},{"id":"wordfence:24142bf8-15e7-460d-83a3-52dc57537498","source":"wordfence","cve":"CVE-2024-5285","title":"WP Affiliate Platform <= 6.5.1 - Cross-Site Request Forgery to Afilliate Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24142bf8-15e7-460d-83a3-52dc57537498?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-09T17:42:37Z"},{"id":"wordfence:24184443-9737-4117-89cf-02cf1e2a07f2","source":"wordfence","cve":"CVE-2024-5170","title":"Logo Manager For Enamad <= 0.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24184443-9737-4117-89cf-02cf1e2a07f2?source=api-prod","affected":[{"type":"plugin","slug":"logo-manager-for-enamad","name":"Logo Manager For Enamad \u2013  \u0644\u0648\u06af\u0648\u06cc \u0646\u0645\u0627\u062f \u0627\u0644\u06a9\u062a\u0631\u0648\u0646\u06cc\u06a9\u06cc","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":true,"patched_in":"0.7.3"}],"published":"2024-08-27T00:00:00Z","updated":"2024-11-04T21:47:41Z"},{"id":"wordfence:241b29c2-eaeb-4abb-a33c-631e768e03b8","source":"wordfence","cve":"CVE-2025-13417","title":"Plugin Organizer <= 10.2.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241b29c2-eaeb-4abb-a33c-631e768e03b8?source=api-prod","affected":[{"type":"plugin","slug":"plugin-organizer","name":"Plugin Organizer","from":"*","from_inclusive":true,"to":"10.2.3","to_inclusive":true,"patched_in":"10.2.4"}],"published":"2025-12-08T00:00:00Z","updated":"2026-01-06T16:02:51Z"},{"id":"wordfence:241d75ca-55e3-461a-9844-52e69904da1b","source":"wordfence","cve":"CVE-2025-3453","title":"Password Protected \u2013 Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241d75ca-55e3-461a-9844-52e69904da1b?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-17T11:13:07Z"},{"id":"wordfence:241d7a82-5fa5-40e3-9336-823644ca17f0","source":"wordfence","cve":"CVE-2026-15005","title":"Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241d7a82-5fa5-40e3-9336-823644ca17f0?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-07-15T20:13:46Z","updated":"2026-07-31T13:28:32Z"},{"id":"wordfence:241d9cd3-9331-49b2-8083-dc646070488e","source":"wordfence","cve":"CVE-2026-6230","title":"Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241d9cd3-9331-49b2-8083-dc646070488e?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-07-07T23:15:47Z","updated":"2026-07-08T11:30:32Z"},{"id":"wordfence:241da621-b892-4263-8409-a40ac5a1ade3","source":"wordfence","cve":"CVE-2023-47650","title":"Add Local Avatar <= 12.1 - Cross-Site Request Forgery via manage_avatar_cache","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241da621-b892-4263-8409-a40ac5a1ade3?source=api-prod","affected":[{"type":"plugin","slug":"add-local-avatar","name":"Add Local Avatar","from":"*","from_inclusive":true,"to":"12.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:241dc2e4-b079-407b-b610-c40b23d038cb","source":"wordfence","cve":"CVE-2020-9456","title":"RegistrationMagic \u2013 Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/241dc2e4-b079-407b-b610-c40b23d038cb?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.4","to_inclusive":false,"patched_in":"4.6.0.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24225f47-cec2-4270-88f0-8696ebfb7168","source":"wordfence","cve":"CVE-2025-11877","title":"User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24225f47-cec2-4270-88f0-8696ebfb7168?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:31:04Z","updated":"2026-02-03T20:36:34Z"},{"id":"wordfence:24226595-6ae7-44c2-a159-5b69808273fa","source":"wordfence","cve":"CVE-2024-24886","title":"Product Labels For Woocommerce <= 1.5.3 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24226595-6ae7-44c2-a159-5b69808273fa?source=api-prod","affected":[{"type":"plugin","slug":"aco-product-labels-for-woocommerce","name":"Product Labels For Woocommerce (Sale Badges)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:25:49Z"},{"id":"wordfence:24254691-f27c-4f6d-adb0-3b9e0b48b4ac","source":"wordfence","cve":"CVE-2026-65453","title":"Ebook Store <= 6.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24254691-f27c-4f6d-adb0-3b9e0b48b4ac?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"6.19","to_inclusive":true,"patched_in":"6.20"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:54:53Z"},{"id":"wordfence:242677f4-5aff-48d5-9b92-e5594069b394","source":"wordfence","cve":"CVE-2026-114180","title":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242677f4-5aff-48d5-9b92-e5594069b394?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-10-22T06:50:00Z","updated":"2026-10-23T18:54:27Z"},{"id":"wordfence:242819d5-0cc5-463f-984a-8e70e032bfe4","source":"wordfence","cve":"CVE-2025-67523","title":"Exhibz <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242819d5-0cc5-463f-984a-8e70e032bfe4?source=api-prod","affected":[{"type":"theme","slug":"exhibz","name":"Exhibz | Event Conference WordPress Theme (AI Powered)","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2025-12-13T00:00:00Z","updated":"2025-12-19T17:15:10Z"},{"id":"wordfence:24285f69-6474-4a2d-9c20-af27f1ca98c9","source":"wordfence","cve":"CVE-2025-24714","title":"Bubble Menu \u2013 circle floating menu <= 4.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24285f69-6474-4a2d-9c20-af27f1ca98c9?source=api-prod","affected":[{"type":"plugin","slug":"bubble-menu","name":"Bubble Menu \u2013 Floating Button Menu with Sticky Navigation","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:00:54Z"},{"id":"wordfence:242a3c60-b8ca-43cc-92d7-eb3830381512","source":"wordfence","cve":"CVE-2025-12027","title":"Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242a3c60-b8ca-43cc-92d7-eb3830381512?source=api-prod","affected":[{"type":"plugin","slug":"mesmerize-companion","name":"Mesmerize Companion","from":"*","from_inclusive":true,"to":"1.6.158","to_inclusive":true,"patched_in":"1.6.162"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:10Z"},{"id":"wordfence:242ad00b-3602-4988-ab7a-76fba2e9d4cf","source":"wordfence","cve":"CVE-2025-4603","title":"eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242ad00b-3602-4988-ab7a-76fba2e9d4cf?source=api-prod","affected":[{"type":"plugin","slug":"store-manager-connector","name":"eMagicOne Store Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-05-23T14:33:21Z","updated":"2025-11-05T21:28:05Z"},{"id":"wordfence:242ad509-32fd-4b28-b6e2-6c49b7288dde","source":"wordfence","cve":"CVE-2025-26549","title":"WP Html Page Sitemap <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242ad509-32fd-4b28-b6e2-6c49b7288dde?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-page-sitemap","name":"WP Html Page Sitemap","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:39:44Z"},{"id":"wordfence:242b274d-a922-4db5-ac7a-b74cbf8212da","source":"wordfence","cve":"CVE-2025-54720","title":"Nest Addons <= 1.6.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242b274d-a922-4db5-ac7a-b74cbf8212da?source=api-prod","affected":[{"type":"plugin","slug":"nest-addons","name":"Nest Addons","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:57:42Z"},{"id":"wordfence:242e99d1-db27-45fa-a90d-5a26c2d1901b","source":"wordfence","cve":"","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/242e99d1-db27-45fa-a90d-5a26c2d1901b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:243200f4-5a5d-4275-bf2b-f4cb6099d145","source":"wordfence","cve":"CVE-2025-12072","title":"Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/243200f4-5a5d-4275-bf2b-f4cb6099d145?source=api-prod","affected":[{"type":"plugin","slug":"disable-contect-editor-for-specific-template","name":"Disable Content Editor For Specific Template","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T20:09:19Z","updated":"2025-10-24T08:23:57Z"},{"id":"wordfence:24347126-56f5-4fb2-afcd-52af0b879eb0","source":"wordfence","cve":"CVE-2026-34903","title":"Ocean Extra <= 2.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24347126-56f5-4fb2-afcd-52af0b879eb0?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:48:14Z"},{"id":"wordfence:24349a73-d543-433b-9f7c-b12f914fc80f","source":"wordfence","cve":"","title":"Forym <= 1.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24349a73-d543-433b-9f7c-b12f914fc80f?source=api-prod","affected":[{"type":"plugin","slug":"forym","name":"Forym","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24351ff6-874d-427b-8fd6-3ebc5c53ec4a","source":"wordfence","cve":"CVE-2025-32241","title":"Official CleverReach Plugin for WooCommerce <= 3.4.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24351ff6-874d-427b-8fd6-3ebc5c53ec4a?source=api-prod","affected":[{"type":"plugin","slug":"cleverreach-wc","name":"Official CleverReach\u00ae Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-07T16:51:47Z"},{"id":"wordfence:2436ec79-9691-4a1a-a22e-57c5d83b2394","source":"wordfence","cve":"CVE-2025-62892","title":"Sunshine Photo Cart <= 3.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2436ec79-9691-4a1a-a22e-57c5d83b2394?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-08-29T00:00:00Z","updated":"2025-11-04T18:29:32Z"},{"id":"wordfence:243d7c43-9aef-44a6-a63a-862ff8881060","source":"wordfence","cve":"CVE-2025-47444","title":"FiboSearch <= 1.32.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/243d7c43-9aef-44a6-a63a-862ff8881060?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.32.1","to_inclusive":true,"patched_in":"1.32.2"}],"published":"2026-01-07T00:00:00Z","updated":"2026-04-15T20:55:50Z"},{"id":"wordfence:243e3d0d-3a4f-4817-84ac-0346c2d69152","source":"wordfence","cve":"CVE-2026-19253","title":"Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/243e3d0d-3a4f-4817-84ac-0346c2d69152?source=api-prod","affected":[{"type":"plugin","slug":"cache-enabler","name":"Cache Enabler","from":"*","from_inclusive":true,"to":"1.8.16","to_inclusive":true,"patched_in":"1.8.17"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T12:48:20Z"},{"id":"wordfence:244051ef-5357-4b16-b690-46c8fea56847","source":"wordfence","cve":"CVE-2026-89333","title":"Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244051ef-5357-4b16-b690-46c8fea56847?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2026-09-18T14:02:05Z","updated":"2026-09-19T02:27:08Z"},{"id":"wordfence:24458c37-ebcc-471b-9044-78f24667f7a6","source":"wordfence","cve":"CVE-2022-47599","title":"Bit File Manager <= 5.2.7 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24458c37-ebcc-471b-9044-78f24667f7a6?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"6.0"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24486605-9324-4f19-9ca3-340d006432db","source":"wordfence","cve":"CVE-2023-3051","title":"Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24486605-9324-4f19-9ca3-340d006432db?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-by-azexo","name":"Page Builder with Image Map by AZEXO","from":"*","from_inclusive":true,"to":"1.27.133","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:244a23a2-8899-4ab4-8f8d-62756e4ea56b","source":"wordfence","cve":"CVE-2018-10234","title":"Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244a23a2-8899-4ab4-8f8d-62756e4ea56b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2018-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:244b6773-8983-4435-8d1c-240bcc54e061","source":"wordfence","cve":"CVE-2024-52430","title":"Lis Video Gallery <= 0.2.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244b6773-8983-4435-8d1c-240bcc54e061?source=api-prod","affected":[{"type":"plugin","slug":"lis-video-gallery","name":"Lis Video Gallery","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:32:03Z"},{"id":"wordfence:244d4c73-3b50-4426-9730-f854372d2ba5","source":"wordfence","cve":"CVE-2024-4689","title":"ShortPixel Adaptive Images <= 3.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244d4c73-3b50-4426-9730-f854372d2ba5?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-16T12:53:29Z"},{"id":"wordfence:244eba91-343a-4e91-96b8-207686d02ce6","source":"wordfence","cve":"CVE-2025-63070","title":"Download Manager <= 3.3.32 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244eba91-343a-4e91-96b8-207686d02ce6?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.32","to_inclusive":true,"patched_in":"3.3.33"}],"published":"2025-09-30T00:00:00Z","updated":"2025-12-11T16:48:52Z"},{"id":"wordfence:244f087a-ddc6-4f48-812d-3fed9e1536a0","source":"wordfence","cve":"CVE-2026-25345","title":"Mixed Media Gallery Blocks <= 3.3.2 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/244f087a-ddc6-4f48-812d-3fed9e1536a0?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.2.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:38:10Z"},{"id":"wordfence:2450277e-589d-4153-bd3f-ffed1a8b4340","source":"wordfence","cve":"CVE-2014-10396","title":"Epic Church by Organized Themes <= 3.6 - Arbitrary File Download","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2450277e-589d-4153-bd3f-ffed1a8b4340?source=api-prod","affected":[{"type":"theme","slug":"epic-church","name":"Epic Church by Organized Themes","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24517dc6-4995-48ee-9b02-5c7c29d359f6","source":"wordfence","cve":"CVE-2023-51424","title":"WebinarIgnition <= 3.05.0 - Missing Authorization to Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24517dc6-4995-48ee-9b02-5c7c29d359f6?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"3.05.0","to_inclusive":true,"patched_in":"3.05.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-05T16:39:36Z"},{"id":"wordfence:24525b6d-016a-4e9a-9521-eac082faab6f","source":"wordfence","cve":"","title":"WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Non-HTML Whitespace in Block Delimiters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24525b6d-016a-4e9a-9521-eac082faab6f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"5.0.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"5.0.31"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T16:28:48Z"},{"id":"wordfence:24578138-a0f3-4175-abea-eff0fbcba169","source":"wordfence","cve":"CVE-2026-24578","title":"Admin login URL Change <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24578138-a0f3-4175-abea-eff0fbcba169?source=api-prod","affected":[{"type":"plugin","slug":"admin-login-url-change","name":"Admin login URL Change","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-01-20T00:00:00Z","updated":"2026-05-26T18:18:21Z"},{"id":"wordfence:245ae6f7-3539-4c91-89f1-29d1e12493b7","source":"wordfence","cve":"CVE-2022-2389","title":"Abandoned Cart Recovery for WooCommerce by Autonami <= 2.1.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245ae6f7-3539-4c91-89f1-29d1e12493b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:245d89e5-52cc-44b1-a858-0ca0aacb4e26","source":"wordfence","cve":"CVE-2020-36852","title":"Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245d89e5-52cc-44b1-a858-0ca0aacb4e26?source=api-prod","affected":[{"type":"plugin","slug":"custom-searchable-data-entry-system","name":"Custom Searchable Data Entry System","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2020-03-06T00:00:00Z","updated":"2025-10-01T06:42:27Z"},{"id":"wordfence:245d909e-7efe-4467-96e2-143efced4ffe","source":"wordfence","cve":"CVE-2024-51613","title":"TradeMe widgets <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245d909e-7efe-4467-96e2-143efced4ffe?source=api-prod","affected":[{"type":"plugin","slug":"trademe-widget","name":"TradeMe widgets","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:19:05Z"},{"id":"wordfence:245e2a05-34e7-402c-b230-5c41ee88264b","source":"wordfence","cve":"CVE-2025-62994","title":"AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245e2a05-34e7-402c-b230-5c41ee88264b?source=api-prod","affected":[{"type":"plugin","slug":"ai-co-pilot-for-wp","name":"WP AI CoPilot \u2013 AI content writer plugin, ChatGPT WordPress, GPT-3/4 , Ai assistance","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-12-04T00:00:00Z","updated":"2026-01-15T18:06:13Z"},{"id":"wordfence:245e43e0-3391-486d-9ecf-3e745bceaa1f","source":"wordfence","cve":"CVE-2019-5979","title":"Personalized WooCommerce Cart Page <= 2.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245e43e0-3391-486d-9ecf-3e745bceaa1f?source=api-prod","affected":[{"type":"plugin","slug":"personalize-woocommerce-cart-page","name":"GoHero Store Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2019-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:245e9117-ca63-458e-a094-60a759f5ec19","source":"wordfence","cve":"CVE-2023-3525","title":"Getnet Argentina para Woocommerce 0.0.1 - 0.0.4 - Authorization Bypass via webhook","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245e9117-ca63-458e-a094-60a759f5ec19?source=api-prod","affected":[{"type":"plugin","slug":"integrar-getnet-con-woo","name":"Getnet Argentina para WooCommerce","from":"0.0.1","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":"0.0.5"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:245f8eec-d496-4298-800d-ea1120640e2d","source":"wordfence","cve":"","title":"Captchinoo, admin login page protection with Google recaptcha <= 2.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245f8eec-d496-4298-800d-ea1120640e2d?source=api-prod","affected":[{"type":"plugin","slug":"captchinoo-captcha-for-login-form-protection","name":"Captchinoo, admin login page protection with Google recaptcha","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:245fade9-ecbb-4d41-ae2a-07331f6c25ba","source":"wordfence","cve":"CVE-2024-55986","title":"Service <= 1.0.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/245fade9-ecbb-4d41-ae2a-07331f6c25ba?source=api-prod","affected":[{"type":"plugin","slug":"service","name":"Service","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:11:37Z"},{"id":"wordfence:2460058f-8cc5-416d-aac2-24a4a62d1c99","source":"wordfence","cve":"CVE-2026-106099","title":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.84 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2460058f-8cc5-416d-aac2-24a4a62d1c99?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.84","to_inclusive":false,"patched_in":"5.5.84"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:44Z"},{"id":"wordfence:2460e7c4-76dc-4bc3-bc06-b52df64f5353","source":"wordfence","cve":"CVE-2025-11168","title":"Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=api-prod","affected":[{"type":"plugin","slug":"mementor-core","name":"Mementor Core","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-11-10T15:06:10Z","updated":"2026-09-18T19:14:04Z"},{"id":"wordfence:24655637-5464-47c9-ae21-f692b3a9d05c","source":"wordfence","cve":"CVE-2026-94274","title":"YayReviews 1.0.4 - 1.4.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24655637-5464-47c9-ae21-f692b3a9d05c?source=api-prod","affected":[{"type":"plugin","slug":"yay-customer-reviews-woocommerce","name":"YayReviews \u2013 Advanced Customer Reviews for WooCommerce","from":"1.0.4","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:06:06Z"},{"id":"wordfence:24666f75-9179-4043-841b-4dd83be078e8","source":"wordfence","cve":"CVE-2026-8761","title":"Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24666f75-9179-4043-841b-4dd83be078e8?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-08-04T16:12:41Z","updated":"2026-08-05T13:33:07Z"},{"id":"wordfence:24696285-094a-40a6-af33-6b7aefbbdc05","source":"wordfence","cve":"CVE-2025-31928","title":"Multimedia Responsive Carousel with Image Video Audio Support <= 2.6.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24696285-094a-40a6-af33-6b7aefbbdc05?source=api-prod","affected":[{"type":"plugin","slug":"multimedia-carousel","name":"Multimedia Responsive Carousel with Image Video Audio Support","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:09:11Z"},{"id":"wordfence:24697253-62b9-45ff-8427-ee437e0d271f","source":"wordfence","cve":"CVE-2025-49887","title":"Product XML Feed Manager for WooCommerce <= 2.9.3 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24697253-62b9-45ff-8427-ee437e0d271f?source=api-prod","affected":[{"type":"plugin","slug":"product-xml-feeds-for-woocommerce","name":"Product XML Feed Manager for WooCommerce \u2013 Google Shopping, Social Sites, Skroutz & More","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:18:04Z"},{"id":"wordfence:246a66ea-7f2f-44e6-825b-5556eacc33ab","source":"wordfence","cve":"CVE-2024-13449","title":"Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/246a66ea-7f2f-44e6-825b-5556eacc33ab?source=api-prod","affected":[{"type":"plugin","slug":"boom-fest","name":"Boom Fest","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-01-24T00:00:00Z","updated":"2026-03-27T10:59:47Z"},{"id":"wordfence:246bf014-c52b-4d5d-b80a-7f3345aaa47a","source":"wordfence","cve":"CVE-2024-50429","title":"Magazine Blocks <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/246bf014-c52b-4d5d-b80a-7f3345aaa47a?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:44:39Z"},{"id":"wordfence:246dee15-82e0-4630-8d95-d2419e9eaef8","source":"wordfence","cve":"CVE-2026-0894","title":"Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/246dee15-82e0-4630-8d95-d2419e9eaef8?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-04-17T21:21:37Z","updated":"2026-04-18T09:26:54Z"},{"id":"wordfence:246e227f-a22d-43bb-8bd0-63d9b4803f26","source":"wordfence","cve":"CVE-2025-22296","title":"Hash Elements <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/246e227f-a22d-43bb-8bd0-63d9b4803f26?source=api-prod","affected":[{"type":"plugin","slug":"hash-elements","name":"Hash Elements","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-03-03T15:43:15Z"},{"id":"wordfence:246eea09-abe5-41e9-811e-5cddedbbe01e","source":"wordfence","cve":"","title":"iThemes Security <= 5.3.5 - Missing Capabilities Check","severity":"high","cvss":7.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/246eea09-abe5-41e9-811e-5cddedbbe01e?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":false,"patched_in":"5.3.6"}],"published":"2016-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2471d06b-7d9a-41b9-b38c-3f40322d8a5b","source":"wordfence","cve":"CVE-2022-3401","title":"Bricks 1.2 - 1.5.3 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2471d06b-7d9a-41b9-b38c-3f40322d8a5b?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"1.2","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24741fa0-5075-445b-91fe-d896a9101b45","source":"wordfence","cve":"CVE-2024-47312","title":"Classic Editor and Classic Widgets <= 1.4.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24741fa0-5075-445b-91fe-d896a9101b45?source=api-prod","affected":[{"type":"plugin","slug":"classic-editor-and-classic-widgets","name":"Classic Editor and Classic Widgets","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:34:17Z"},{"id":"wordfence:24747507-8f24-499e-a257-d379dc171e18","source":"wordfence","cve":"CVE-2023-2715","title":"Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24747507-8f24-499e-a257-d379dc171e18?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.8.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24759d97-2b00-4812-8407-640b545a235a","source":"wordfence","cve":"","title":"WordPress to Freshsales Integration <= 1.3.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24759d97-2b00-4812-8407-640b545a235a?source=api-prod","affected":[{"type":"plugin","slug":"codup-wp-freshsales","name":"WordPress to Freshsales Integration","from":"*","from_inclusive":true,"to":"1.3.2.2","to_inclusive":true,"patched_in":"1.3.2.3"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24781100-68cc-4d1a-9c02-cf1378fae7c5","source":"wordfence","cve":"CVE-2025-64246","title":"Accessibility by AudioEye <= 1.0.49 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24781100-68cc-4d1a-9c02-cf1378fae7c5?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-by-audioeye","name":"Accessibility by AudioEye","from":"*","from_inclusive":true,"to":"1.0.49","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T16:57:34Z"},{"id":"wordfence:24798f70-07bd-435c-ac92-97a6842b78c7","source":"wordfence","cve":"CVE-2024-13864","title":"Countdown Timer <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24798f70-07bd-435c-ac92-97a6842b78c7?source=api-prod","affected":[{"type":"plugin","slug":"timer-countdown","name":"Countdown Timer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-26T23:01:15Z"},{"id":"wordfence:247a095b-0a92-4fee-85cf-c3041a061d62","source":"wordfence","cve":"CVE-2021-24995","title":"HTML5 Responsive FAQ <= 2.8.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247a095b-0a92-4fee-85cf-c3041a061d62?source=api-prod","affected":[{"type":"plugin","slug":"html5-responsive-faq","name":"HTML5 Responsive FAQ","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":""}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:247a2034-a734-4c9c-8fe5-2c7c22b9ae24","source":"wordfence","cve":"CVE-2026-104409","title":"Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247a2034-a734-4c9c-8fe5-2c7c22b9ae24?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.13","to_inclusive":true,"patched_in":"3.6.14"}],"published":"2026-10-05T08:05:00Z","updated":"2026-10-08T23:26:06Z"},{"id":"wordfence:247aaa80-344b-43a9-b8f9-d1a7b5af6065","source":"wordfence","cve":"CVE-2024-43341","title":"Hello Agency <= 1.0.5 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247aaa80-344b-43a9-b8f9-d1a7b5af6065?source=api-prod","affected":[{"type":"theme","slug":"hello-agency","name":"Hello Agency","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:06:37Z"},{"id":"wordfence:247b1921-70a6-4e65-819a-2895bc395e9f","source":"wordfence","cve":"CVE-2026-6639","title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247b1921-70a6-4e65-819a-2895bc395e9f?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.19"}],"published":"2026-08-04T17:34:18Z","updated":"2026-08-05T06:37:54Z"},{"id":"wordfence:247df9e2-0a63-49ad-86fa-cb4c6e62c4cf","source":"wordfence","cve":"CVE-2026-3173","title":"Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247df9e2-0a63-49ad-86fa-cb4c6e62c4cf?source=api-prod","affected":[{"type":"plugin","slug":"display-a-meta-field-as-block","name":"Meta Field Block \u2013 Display Custom Fields for ACF, Meta Box and More","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-05-27T00:00:00Z","updated":"2026-05-28T05:30:42Z"},{"id":"wordfence:247e252a-ac4f-4567-813b-1ceb8b5f6a22","source":"wordfence","cve":"CVE-2025-23934","title":"Giveaways and Contests by PromoSimple <= 1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247e252a-ac4f-4567-813b-1ceb8b5f6a22?source=api-prod","affected":[{"type":"plugin","slug":"giveaways-contests-by-promosimple","name":"Giveaways and Contests by PromoSimple","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:46:53Z"},{"id":"wordfence:247e599a-74e2-41d5-a1ba-978a807e6544","source":"wordfence","cve":"CVE-2024-9593","title":"Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution","severity":"high","cvss":8.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247e599a-74e2-41d5-a1ba-978a807e6544?source=api-prod","affected":[{"type":"plugin","slug":"time-clock-pro","name":"Time Clock Pro","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"},{"type":"plugin","slug":"time-clock","name":"Time Clock \u2013 A WordPress Employee & Volunteer Time Clock Plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-18T17:32:30Z"},{"id":"wordfence:247ee5bf-1e77-4461-b9f7-28b051b78af7","source":"wordfence","cve":"CVE-2025-32668","title":"Real Estate Manager <= 7.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247ee5bf-1e77-4461-b9f7-28b051b78af7?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:247f6b86-767b-479f-90d4-79345699dd59","source":"wordfence","cve":"","title":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress <= 7.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/247f6b86-767b-479f-90d4-79345699dd59?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2480091f-2b5d-440c-9617-934d097b3a63","source":"wordfence","cve":"","title":"InFocus <= 3.3 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2480091f-2b5d-440c-9617-934d097b3a63?source=api-prod","affected":[{"type":"theme","slug":"infocus","name":"InFocus","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2481f37b-a220-435d-9b43-6e7c5f42034f","source":"wordfence","cve":"CVE-2017-1001000","title":"WordPress Core < 4.7.2 -  Arbitrary Page Modification","severity":"high","cvss":7.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2481f37b-a220-435d-9b43-6e7c5f42034f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.7.18"}],"published":"2017-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2482ef4b-697a-45a0-b45e-85b2af5b4735","source":"wordfence","cve":"CVE-2023-24382","title":"Material Design Icons for Page Builders <= 1.4.2 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2482ef4b-697a-45a0-b45e-85b2af5b4735?source=api-prod","affected":[{"type":"plugin","slug":"material-design-icons-for-elementor","name":"Material Design Icons for Page Builders","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2483875a-84de-4a40-a69e-aee68da1ce3b","source":"wordfence","cve":"CVE-2026-1620","title":"Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2483875a-84de-4a40-a69e-aee68da1ce3b?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T17:56:59Z","updated":"2026-04-16T06:44:51Z"},{"id":"wordfence:248750b0-0fed-4c31-aeeb-709da3e7e2a1","source":"wordfence","cve":"CVE-2024-33912","title":"Academy LMS <= 1.9.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/248750b0-0fed-4c31-aeeb-709da3e7e2a1?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"1.9.16","to_inclusive":true,"patched_in":"1.9.17"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:09:51Z"},{"id":"wordfence:24889552-0db6-44e6-9b12-f31b5e92a42e","source":"wordfence","cve":"CVE-2024-12810","title":"JobCareer | Job Board Responsive WordPress Theme <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrative Actions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24889552-0db6-44e6-9b12-f31b5e92a42e?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T11:15:51Z"},{"id":"wordfence:24890c27-6db1-4ca9-8ebd-601fbce93d88","source":"wordfence","cve":"CVE-2026-75963","title":"Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24890c27-6db1-4ca9-8ebd-601fbce93d88?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-08-19T17:09:00Z","updated":"2026-08-20T05:30:44Z"},{"id":"wordfence:2489e649-27f7-4ca0-8655-0957016fa89a","source":"wordfence","cve":"CVE-2024-9518","title":"UserPlus <= 2.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2489e649-27f7-4ca0-8655-0957016fa89a?source=api-prod","affected":[{"type":"plugin","slug":"userplus","name":"User registration & user profile \u2013 UserPlus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:05Z"},{"id":"wordfence:248a9cb2-24e8-46b2-9ef8-23a8444a922d","source":"wordfence","cve":"CVE-2024-7588","title":"Gutenberg Blocks, Page Builder \u2013 ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/248a9cb2-24e8-46b2-9ef8-23a8444a922d?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.84","to_inclusive":true,"patched_in":"2.2.88"}],"published":"2024-08-13T00:00:00Z","updated":"2024-08-14T04:29:56Z"},{"id":"wordfence:248b74d3-5228-473d-a79a-743566898606","source":"wordfence","cve":"","title":"Simple Calendar <= 3.1.42 - Cross-Site Request Forgery to Transient Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/248b74d3-5228-473d-a79a-743566898606?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.1.42","to_inclusive":true,"patched_in":"3.1.43"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:248d6315-ee4f-4a2a-855d-f913c72259d6","source":"wordfence","cve":"CVE-2026-116409","title":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/248d6315-ee4f-4a2a-855d-f913c72259d6?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-27T10:30:35Z","updated":"2026-11-03T19:31:57Z"},{"id":"wordfence:248e8bb0-a9d4-4bc8-90bf-d568f15b7d34","source":"wordfence","cve":"CVE-2026-52701","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/248e8bb0-a9d4-4bc8-90bf-d568f15b7d34?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-06-22T00:00:00Z","updated":"2026-06-29T19:07:50Z"},{"id":"wordfence:24902fab-44ea-44c9-bcf5-70960cfeb402","source":"wordfence","cve":"CVE-2026-2268","title":"Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24902fab-44ea-44c9-bcf5-70960cfeb402?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.0","to_inclusive":true,"patched_in":"3.14.1"}],"published":"2026-02-09T20:41:41Z","updated":"2026-02-10T09:26:07Z"},{"id":"wordfence:2490a51c-718f-463b-ab80-82d48deb2f1a","source":"wordfence","cve":"CVE-2022-1582","title":"External Links in New Window / New Tab <= 1.42 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2490a51c-718f-463b-ab80-82d48deb2f1a?source=api-prod","affected":[{"type":"plugin","slug":"open-external-links-in-a-new-window","name":"External Links in New Window / New Tab","from":"*","from_inclusive":true,"to":"1.42","to_inclusive":true,"patched_in":"1.43"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2491d502-8087-4e95-b047-a3b196322d94","source":"wordfence","cve":"CVE-2021-24385","title":"Filebird 4.7.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2491d502-8087-4e95-b047-a3b196322d94?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"4.7.3","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2021-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24929e4a-e29e-45a4-a28a-e8424681b75f","source":"wordfence","cve":"CVE-2026-85348","title":"GDPR Data Request Form 1.5 - 1.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24929e4a-e29e-45a4-a28a-e8424681b75f?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-data-request-form","name":"GDPR Data Request Form","from":"1.5","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-28T21:17:58Z"},{"id":"wordfence:2493a2f8-d4e4-4c42-b748-5632b96b085e","source":"wordfence","cve":"CVE-2022-2638","title":"Export All URLs <= 4.3 - Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2493a2f8-d4e4-4c42-b748-5632b96b085e?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24971249-ea45-4477-a219-075fd8a1399c","source":"wordfence","cve":"CVE-2025-60208","title":"Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24971249-ea45-4477-a219-075fd8a1399c?source=api-prod","affected":[{"type":"plugin","slug":"acf-cpt-options-pages","name":"Advanced Custom Fields : CPT Options Pages","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-21T00:00:00Z","updated":"2025-11-04T15:30:48Z"},{"id":"wordfence:2497837d-dec6-4a1d-be88-5c0e659eeb46","source":"wordfence","cve":"CVE-2023-22708","title":"Kraken.io Image Optimizer <= 2.6.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2497837d-dec6-4a1d-be88-5c0e659eeb46?source=api-prod","affected":[{"type":"plugin","slug":"kraken-image-optimizer","name":"Kraken.io Image Optimizer \u2013 Compress, Convert to WebP & AVIF, Resize & Bulk Optimize","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24986bbe-6584-4d0a-829c-684c60527482","source":"wordfence","cve":"CVE-2026-49764","title":"RegistrationMagic \u2013 User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24986bbe-6584-4d0a-829c-684c60527482?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.8.6","to_inclusive":true,"patched_in":"6.0.8.7"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:58:10Z"},{"id":"wordfence:2498c73f-b45d-44db-a67e-d325b758096f","source":"wordfence","cve":"CVE-2025-24762","title":"TicketBAI Facturas para WooCommerce <= 3.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2498c73f-b45d-44db-a67e-d325b758096f?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticketbai","name":"TicketBAI Facturas para WooCommerce","from":"*","from_inclusive":true,"to":"3.21","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-17T14:09:19Z"},{"id":"wordfence:249ac834-e7de-42cc-9ac1-82e7c18eac31","source":"wordfence","cve":"CVE-2019-15660","title":"WP-Members <= 3.2.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249ac834-e7de-42cc-9ac1-82e7c18eac31?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8.1"}],"published":"2019-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:249acca6-49b4-4ddf-af75-31f68921fc19","source":"wordfence","cve":"CVE-2019-16523","title":"Events Manager <= 5.9.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249acca6-49b4-4ddf-af75-31f68921fc19?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.5","to_inclusive":true,"patched_in":"5.9.6"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:249ad768-3706-47c6-ad1d-f11900b87608","source":"wordfence","cve":"CVE-2024-32782","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249ad768-3706-47c6-ad1d-f11900b87608?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T13:54:39Z"},{"id":"wordfence:249b08c5-7429-4690-9f08-fc3f049aa62c","source":"wordfence","cve":"CVE-2024-6885","title":"MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249b08c5-7429-4690-9f08-fc3f049aa62c?source=api-prod","affected":[{"type":"plugin","slug":"maxi-blocks","name":"MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-07-22T13:02:24Z","updated":"2024-07-23T02:01:43Z"},{"id":"wordfence:249caa5b-c1b0-4b72-98f3-31bbb574c834","source":"wordfence","cve":"CVE-2020-20634","title":"Elementor Website Builder <= 2.9.5 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249caa5b-c1b0-4b72-98f3-31bbb574c834?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2020-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:249ccc77-0daf-41bc-b5c5-991bf17d645d","source":"wordfence","cve":"CVE-2024-3668","title":"PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-732","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249ccc77-0daf-41bc-b5c5-991bf17d645d?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"2.10.17","to_inclusive":true,"patched_in":"2.10.18"}],"published":"2024-06-07T16:16:46Z","updated":"2024-06-08T04:32:37Z"},{"id":"wordfence:249cd9db-dd30-44e5-9c02-65a15cfbce8e","source":"wordfence","cve":"CVE-2026-86603","title":"Recipe Maker <= 10.8.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/249cd9db-dd30-44e5-9c02-65a15cfbce8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:52:41Z"},{"id":"wordfence:24a041d0-d443-453d-bd7d-65cceee48b14","source":"wordfence","cve":"CVE-2023-23982","title":"WPFrom Email <= 1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24a041d0-d443-453d-bd7d-65cceee48b14?source=api-prod","affected":[{"type":"plugin","slug":"wpfrom-email","name":"WPFrom Email","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24a33857-5df2-4747-950e-f5a87fd287c6","source":"wordfence","cve":"CVE-2024-11413","title":"HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24a33857-5df2-4747-950e-f5a87fd287c6?source=api-prod","affected":[{"type":"plugin","slug":"hostfact-bestelformulier-integratie","name":"HostFact bestelformulier integratie","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-12-11T15:22:05Z","updated":"2025-03-18T18:17:25Z"},{"id":"wordfence:24a6b716-2f23-447c-b156-6124538efbcd","source":"wordfence","cve":"CVE-2025-23750","title":"Custom Widget Creator <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24a6b716-2f23-447c-b156-6124538efbcd?source=api-prod","affected":[{"type":"plugin","slug":"custom-widget-creator","name":"Custom Widget Creator","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:14:42Z"},{"id":"wordfence:24a802cc-bec3-48ac-a2af-34fba3939c17","source":"wordfence","cve":"CVE-2024-52371","title":"Global Gateway e4 | Payeezy Gateway | <= 2.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24a802cc-bec3-48ac-a2af-34fba3939c17?source=api-prod","affected":[{"type":"plugin","slug":"globe-gateway-e4","name":"Global Gateway e4 | Payeezy Gateway |","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:30:22Z"},{"id":"wordfence:24a88f20-ddc4-4544-ac18-ed538ecfa1c7","source":"wordfence","cve":"CVE-2015-1000013","title":"Csv2WPeC Coupon <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24a88f20-ddc4-4544-ac18-ed538ecfa1c7?source=api-prod","affected":[{"type":"plugin","slug":"csv2wpec-coupon","name":"Csv2WPeC Coupon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2016-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24aa005f-30c2-4708-bbbe-8eece2cd19cc","source":"wordfence","cve":"CVE-2025-31036","title":"WPSolr <= 24.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24aa005f-30c2-4708-bbbe-8eece2cd19cc?source=api-prod","affected":[{"type":"plugin","slug":"wpsolr-free","name":"WPSOLR \u2014 One plugin. All the best search & recommendation engines.","from":"*","from_inclusive":true,"to":"24.0","to_inclusive":true,"patched_in":"24.0.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-23T18:12:12Z"},{"id":"wordfence:24aa6c0b-88bc-4c3e-ada7-2e89d84bdfc3","source":"wordfence","cve":"CVE-2024-13797","title":"PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24aa6c0b-88bc-4c3e-ada7-2e89d84bdfc3?source=api-prod","affected":[{"type":"theme","slug":"pressmart","name":"PressMart - Modern Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:17Z"},{"id":"wordfence:24aadf0c-0266-4c39-ac7b-d6f09053d903","source":"wordfence","cve":"CVE-2020-8819","title":"CardGate Payments for WooCommerce <= 3.1.15 - Lack of Origin Validation","severity":"high","cvss":8.1,"cwe":"CWE-346","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24aadf0c-0266-4c39-ac7b-d6f09053d903?source=api-prod","affected":[{"type":"plugin","slug":"cardgate","name":"CardGate Payments for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":false,"patched_in":"3.1.16"}],"published":"2020-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24ac60fe-d751-43c7-89c1-5c0c9651e8f8","source":"wordfence","cve":"CVE-2023-4826","title":"SocialDriver < 2024 - Prototype Pollution","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ac60fe-d751-43c7-89c1-5c0c9651e8f8?source=api-prod","affected":[{"type":"plugin","slug":"socialdriver","name":"Socialdriver","from":"*","from_inclusive":true,"to":"2024","to_inclusive":false,"patched_in":"2024"}],"published":"2023-09-11T00:00:00Z","updated":"2024-03-22T16:37:13Z"},{"id":"wordfence:24b1fc7b-ee31-48ef-84c3-40eef4d35981","source":"wordfence","cve":"CVE-2026-42715","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.47 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b1fc7b-ee31-48ef-84c3-40eef4d35981?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.47","to_inclusive":true,"patched_in":"1.8.48"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-28T21:18:41Z"},{"id":"wordfence:24b26f17-f973-4a0e-85e2-a70a394246e2","source":"wordfence","cve":"CVE-2023-0491","title":"Schedulicity - Easy Online Scheduling <= 2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b26f17-f973-4a0e-85e2-a70a394246e2?source=api-prod","affected":[{"type":"plugin","slug":"schedulicity-online-appointment-booking","name":"Schedulicity \u2013 Easy Online Scheduling","from":"*","from_inclusive":true,"to":"2.21","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24b319e6-1903-44a9-9f69-0e5ebe891870","source":"wordfence","cve":"CVE-2015-9470","title":"History Collection <=1.1.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b319e6-1903-44a9-9f69-0e5ebe891870?source=api-prod","affected":[{"type":"plugin","slug":"history-collection","name":"History Collection","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2015-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24b3423b-66df-46ad-ae92-20e7ffbd1614","source":"wordfence","cve":"CVE-2025-68078","title":"Salient Portfolio <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b3423b-66df-46ad-ae92-20e7ffbd1614?source=api-prod","affected":[{"type":"theme","slug":"salient-portfolio","name":"Salient Portfolio","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-10-09T00:00:00Z","updated":"2025-12-20T20:28:42Z"},{"id":"wordfence:24b4eace-7672-4dae-9c0c-bbd1d79765a9","source":"wordfence","cve":"CVE-2025-47440","title":"WPAdverts <= 2.2.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b4eace-7672-4dae-9c0c-bbd1d79765a9?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:54:34Z"},{"id":"wordfence:24b587a5-77dc-4544-8d5d-b503c8006a35","source":"wordfence","cve":"CVE-2026-39729","title":"Edwiser Bridge \u2013 WordPress Moodle Integration <= 4.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b587a5-77dc-4544-8d5d-b503c8006a35?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:26:35Z","updated":"2026-10-08T23:24:26Z"},{"id":"wordfence:24b7e8d7-a9f2-4192-97c0-b7cbc1669a2a","source":"wordfence","cve":"CVE-2024-47322","title":"WP Timeline \u2013 Vertical and Horizontal timeline plugin <= 3.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b7e8d7-a9f2-4192-97c0-b7cbc1669a2a?source=api-prod","affected":[{"type":"plugin","slug":"wp-timelines","name":"WP Timeline \u2013 Vertical and Horizontal timeline plugin","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:30:23Z"},{"id":"wordfence:24b87f27-f2de-4e5f-95df-bb5719c9e790","source":"wordfence","cve":"CVE-2025-22512","title":"Help Scout <= 6.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b87f27-f2de-4e5f-95df-bb5719c9e790?source=api-prod","affected":[{"type":"plugin","slug":"help-scout","name":"Help Scout","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2025-01-07T00:00:00Z","updated":"2025-05-07T14:00:18Z"},{"id":"wordfence:24b89ed2-9dfb-4068-8459-cb2e708c7778","source":"wordfence","cve":"CVE-2015-7989","title":"WordPress Core < 4.3.1 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b89ed2-9dfb-4068-8459-cb2e708c7778?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"3.7.11"}],"published":"2015-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24b9984c-ec33-4492-815b-67a21ac4da0e","source":"wordfence","cve":"CVE-2023-4686","title":"WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9984c-ec33-4492-815b-67a21ac4da0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24b9bf5a-19ac-4e99-b32d-1ab681356a1b","source":"wordfence","cve":"CVE-2026-1572","title":"Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9bf5a-19ac-4e99-b32d-1ab681356a1b?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T17:57:15Z","updated":"2026-04-16T06:44:51Z"},{"id":"wordfence:24ba85a0-dbc7-4c9d-a67f-d449c1d275ab","source":"wordfence","cve":"CVE-2021-4074","title":"WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ba85a0-dbc7-4c9d-a67f-d449c1d275ab?source=api-prod","affected":[{"type":"plugin","slug":"whmcs-bridge","name":"WHMCS Bridge","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.3"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24ba8d30-843f-4178-9b10-3c3dc720205c","source":"wordfence","cve":"CVE-2022-29420","title":"Countdown & Clock <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ba8d30-843f-4178-9b10-3c3dc720205c?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-04-28T10:50:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24bdffdc-1a4d-4a1c-8393-cf89f0a63bf9","source":"wordfence","cve":"CVE-2024-13849","title":"Cookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24bdffdc-1a4d-4a1c-8393-cf89f0a63bf9?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-bar","name":"Cookie Notice Bar","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-19T21:09:00Z","updated":"2025-02-20T09:21:40Z"},{"id":"wordfence:24be03a7-4632-4bb1-beb9-d83abdd363b9","source":"wordfence","cve":"CVE-2024-32141","title":"Libsyn Publisher Hub <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24be03a7-4632-4bb1-beb9-d83abdd363b9?source=api-prod","affected":[{"type":"plugin","slug":"libsyn-podcasting","name":"Libsyn Publisher Hub","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:02:42Z"},{"id":"wordfence:24c2ae7d-e34c-4139-a5a3-b4fa22b84ee1","source":"wordfence","cve":"CVE-2026-78527","title":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews <= 3.3.10 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c2ae7d-e34c-4139-a5a3-b4fa22b84ee1?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"3.3.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-30T09:17:35Z","updated":"2026-11-03T20:11:57Z"},{"id":"wordfence:24c3d004-da8b-40ec-b52e-6923d4c824e8","source":"wordfence","cve":"","title":"Daily Edition <= 1.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c3d004-da8b-40ec-b52e-6923d4c824e8?source=api-prod","affected":[{"type":"theme","slug":"dailyedition","name":"Daily Edition","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24c4449e-0f20-4c77-a83c-05f547a9d853","source":"wordfence","cve":"CVE-2024-32779","title":"Vision Interactive <= 1.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c4449e-0f20-4c77-a83c-05f547a9d853?source=api-prod","affected":[{"type":"plugin","slug":"vision","name":"Vision \u2013 Interactive Image Map with Hotspots Builder","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:21:25Z"},{"id":"wordfence:24c54ef5-ad02-4767-bca6-f74c539d3068","source":"wordfence","cve":"CVE-2024-13567","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c54ef5-ad02-4767-bca6-f74c539d3068?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T05:22:46Z"},{"id":"wordfence:24c67243-0452-4820-bfb4-b7ac4804aa4b","source":"wordfence","cve":"CVE-2023-29100","title":"The7 <= 11.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c67243-0452-4820-bfb4-b7ac4804aa4b?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"11.6.0","to_inclusive":true,"patched_in":"11.6.1"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24c78d62-c2d0-4699-bd80-e8deef301eb3","source":"wordfence","cve":"","title":"CP Image Store with Slideshow < 1.0.6 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c78d62-c2d0-4699-bd80-e8deef301eb3?source=api-prod","affected":[{"type":"plugin","slug":"cp-image-store","name":"CP Image Store with Slideshow","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2015-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24c7e7da-39b4-4969-b24f-be7a8628236b","source":"wordfence","cve":"CVE-2021-25120","title":"Easy Social Feed <= 6.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c7e7da-39b4-4969-b24f-be7a8628236b?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.2.7"},{"type":"plugin","slug":"easy-facebook-likebox-premium","name":"Easy Social Feed Pro","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.2.7"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24c9a333-e60e-481b-ba27-65094f4f8d39","source":"wordfence","cve":"CVE-2025-49885","title":"Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 5.0.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c9a333-e60e-481b-ba27-65094f4f8d39?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-wc-pro","name":"Drag and Drop Multiple File Upload (Pro) - WooCommerce","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2025-06-23T00:00:00Z","updated":"2026-05-04T14:44:11Z"},{"id":"wordfence:24c9ff14-1d24-4c8c-b3d5-c2e0b5eb25fb","source":"wordfence","cve":"CVE-2026-54189","title":"JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24c9ff14-1d24-4c8c-b3d5-c2e0b5eb25fb?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.8.10.1"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:58:51Z"},{"id":"wordfence:24cad8ef-f0c4-4306-bd8e-4ce59baa424d","source":"wordfence","cve":"CVE-2024-34755","title":"Integration for Contact Form 7 and Salesforce <= <=1.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24cad8ef-f0c4-4306-bd8e-4ce59baa424d?source=api-prod","affected":[{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:04:11Z"},{"id":"wordfence:24ccc2cb-3c5d-48cd-bc40-2717145b4912","source":"wordfence","cve":"CVE-2024-10669","title":"Countdown Timer block \u2013 Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ccc2cb-3c5d-48cd-bc40-2717145b4912?source=api-prod","affected":[{"type":"plugin","slug":"countdown-time","name":"Countdown Timer Block \u2013 build urgency for events and launches","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T04:32:26Z"},{"id":"wordfence:24cdd50f-742c-457c-85f7-9cccaf366e87","source":"wordfence","cve":"CVE-2026-12904","title":"Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24cdd50f-742c-457c-85f7-9cccaf366e87?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-06-30T14:57:59Z","updated":"2026-07-01T03:43:34Z"},{"id":"wordfence:24ce9ae1-da02-4ef1-aeb5-1f6b98f41f5a","source":"wordfence","cve":"CVE-2024-51618","title":"Custom Admin Menu <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ce9ae1-da02-4ef1-aeb5-1f6b98f41f5a?source=api-prod","affected":[{"type":"plugin","slug":"custom-admin-menu","name":"Custom Admin Menu","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:34:34Z"},{"id":"wordfence:24d0229c-0f1b-42df-b89a-ce0b8a3fda7e","source":"wordfence","cve":"CVE-2023-3135","title":"Mailtree Log Mail <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d0229c-0f1b-42df-b89a-ce0b8a3fda7e?source=api-prod","affected":[{"type":"plugin","slug":"mailtree-log-mail","name":"Mailtree Log Mail","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24d050ad-0816-46a3-a37e-17356acf88d2","source":"wordfence","cve":"CVE-2014-9341","title":"yURL ReTwitt <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d050ad-0816-46a3-a37e-17356acf88d2?source=api-prod","affected":[{"type":"plugin","slug":"yurl-retwitt","name":"yurl-retwitt","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24d08127-67b6-434a-8dbe-233a47854f9b","source":"wordfence","cve":"CVE-2022-1913","title":"Add Post URL <= 2.1.0 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d08127-67b6-434a-8dbe-233a47854f9b?source=api-prod","affected":[{"type":"plugin","slug":"wp-posturl","name":"Add Post URL","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24d081e3-4291-427c-bf2c-726d93aa00ac","source":"wordfence","cve":"CVE-2015-1000003","title":"filedownload < 1.4 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d081e3-4291-427c-bf2c-726d93aa00ac?source=api-prod","affected":[{"type":"plugin","slug":"filedownload","name":"filedownload","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2015-07-11T00:00:00Z","updated":"2024-08-15T18:13:37Z"},{"id":"wordfence:24d14261-e295-4397-bad0-7a4b69b06908","source":"wordfence","cve":"CVE-2019-20180","title":"TablePress <= 1.14 - Authenticated (Author+) CSV Injection","severity":"high","cvss":8.0,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d14261-e295-4397-bad0-7a4b69b06908?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":"2.0"}],"published":"2020-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24d63989-e0b7-46fd-98db-c2c17c90a270","source":"wordfence","cve":"CVE-2025-50052","title":"Flexo Counter <= 1.0001 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d63989-e0b7-46fd-98db-c2c17c90a270?source=api-prod","affected":[{"type":"plugin","slug":"flexo-countdown","name":"Flexo Counter","from":"*","from_inclusive":true,"to":"1.0001","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T16:43:41Z"},{"id":"wordfence:24d777c8-e863-492f-8e1d-2c319d9ccf16","source":"wordfence","cve":"CVE-2026-111021","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d777c8-e863-492f-8e1d-2c319d9ccf16?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"7.2.0","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:13:55Z"},{"id":"wordfence:24d84e7c-7a7a-4b29-95ee-60718c48840f","source":"wordfence","cve":"CVE-2026-8938","title":"auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d84e7c-7a7a-4b29-95ee-60718c48840f?source=api-prod","affected":[{"type":"plugin","slug":"auto-making-json-ld","name":"auto making JSON-LD","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:24Z","updated":"2026-05-27T05:31:20Z"},{"id":"wordfence:24d95932-c9f2-4ef1-b2c2-2f4ae1226b34","source":"wordfence","cve":"CVE-2026-12584","title":"Payment Gateway for Redsys & WooCommerce Lite <= 7.0.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24d95932-c9f2-4ef1-b2c2-2f4ae1226b34?source=api-prod","affected":[{"type":"plugin","slug":"woo-redsys-gateway-light","name":"Payment Gateway for Redsys & WooCommerce Lite","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-17T16:02:54Z"},{"id":"wordfence:24da83d5-b462-4a98-88b9-853af5628f63","source":"wordfence","cve":"CVE-2025-46441","title":"Section Widget <= 3.3.1 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24da83d5-b462-4a98-88b9-853af5628f63?source=api-prod","affected":[{"type":"plugin","slug":"section-widget","name":"Section Widget","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-08T13:22:38Z"},{"id":"wordfence:24ddc594-e06b-4559-acb0-9a3277579bb1","source":"wordfence","cve":"CVE-2024-32105","title":"ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ddc594-e06b-4559-acb0-9a3277579bb1?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-dynamic-pricing-and-discounts","name":"ELEX WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T14:26:23Z"},{"id":"wordfence:24df10fb-5143-478e-90f0-27f604ad43ee","source":"wordfence","cve":"CVE-2024-13227","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24df10fb-5143-478e-90f0-27f604ad43ee?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.235","to_inclusive":true,"patched_in":"1.0.236"}],"published":"2025-02-12T16:21:31Z","updated":"2025-02-13T04:21:49Z"},{"id":"wordfence:24e00c0d-08ff-4c68-a1dd-77b513545efd","source":"wordfence","cve":"CVE-2024-6756","title":"Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e00c0d-08ff-4c68-a1dd-77b513545efd?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:55Z"},{"id":"wordfence:24e03ae4-e59f-4f6d-bef8-c1c0caf684dc","source":"wordfence","cve":"CVE-2026-42711","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e03ae4-e59f-4f6d-bef8-c1c0caf684dc?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:36:32Z"},{"id":"wordfence:24e105bd-7df0-423f-9fc0-fa5e4899f976","source":"wordfence","cve":"CVE-2026-122062","title":"Pronamic Pay & Pronamic Pay doneren met Mollie <= 11.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e105bd-7df0-423f-9fc0-fa5e4899f976?source=api-prod","affected":[{"type":"plugin","slug":"pronamic-pay-doneren-met-mollie","name":"Pronamic Pay doneren met Mollie","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:15:59Z"},{"id":"wordfence:24e27ec0-a543-4900-839e-fbe4bc5a746f","source":"wordfence","cve":"CVE-2025-23861","title":"Debt Calculator <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e27ec0-a543-4900-839e-fbe4bc5a746f?source=api-prod","affected":[{"type":"plugin","slug":"debt-calculator","name":"Debt Calculator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:55:18Z"},{"id":"wordfence:24e2b96c-665f-4616-ac99-1a2b1b0a9ccd","source":"wordfence","cve":"CVE-2023-4800","title":"DoLogin Security <= 3.7 - Missing Authorization on Dashboard Widget","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e2b96c-665f-4616-ac99-1a2b1b0a9ccd?source=api-prod","affected":[{"type":"plugin","slug":"dologin","name":"DoLogin Security","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24e6f868-258b-4b32-8215-bb2f360cda06","source":"wordfence","cve":"CVE-2025-24700","title":"WP Event Aggregator <= 1.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e6f868-258b-4b32-8215-bb2f360cda06?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-aggregator","name":"WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-02-01T00:00:00Z","updated":"2025-02-12T18:44:20Z"},{"id":"wordfence:24e7c30e-dac9-418a-ae0b-499f192139a4","source":"wordfence","cve":"CVE-2026-66440","title":"WPIDE \u2013 File Manager & Code Editor <= 3.5.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e7c30e-dac9-418a-ae0b-499f192139a4?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:01:47Z"},{"id":"wordfence:24e8513c-f8d4-4e32-8212-191f5b5893b5","source":"wordfence","cve":"CVE-2022-2187","title":"Contact Form 7 Captcha <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e8513c-f8d4-4e32-8212-191f5b5893b5?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-simple-recaptcha","name":"LukasApps CAPTCHA tools for Contact Form 7","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":"0.1.2"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24e8d1a4-9853-4f60-a371-7fdbe86d554b","source":"wordfence","cve":"CVE-2023-1597","title":"tagDiv Cloud Library < 2.7 - Missing Authorization to Arbitrary User Metadata Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24e8d1a4-9853-4f60-a371-7fdbe86d554b?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"12.3","to_inclusive":true,"patched_in":"12.4"},{"type":"plugin","slug":"td-cloud-library","name":"tagDiv Cloud Library","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24eb524c-1705-43a5-8041-4549ebb49155","source":"wordfence","cve":"CVE-2022-42462","title":"IP Blacklist Cloud <= 5.00 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24eb524c-1705-43a5-8041-4549ebb49155?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"5.00","to_inclusive":true,"patched_in":""}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24ebaf12-cf7c-4bc3-b028-27ee4b6b2a45","source":"wordfence","cve":"CVE-2024-29122","title":"FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ebaf12-cf7c-4bc3-b028-27ee4b6b2a45?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.41.7212","to_inclusive":true,"patched_in":"7.5.44.7212"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:42:42Z"},{"id":"wordfence:24ef5844-93d6-4ba3-bd0a-b8837bbd7baf","source":"wordfence","cve":"CVE-2023-6137","title":"Frontier Post <= 6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24ef5844-93d6-4ba3-bd0a-b8837bbd7baf?source=api-prod","affected":[{"type":"plugin","slug":"frontier-post","name":"Frontier Post","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24f112eb-4abe-4acf-a769-c93246e30958","source":"wordfence","cve":"CVE-2026-104749","title":"Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f112eb-4abe-4acf-a769-c93246e30958?source=api-prod","affected":[{"type":"plugin","slug":"bit-integrations","name":"Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2026-10-13T12:13:21Z","updated":"2026-10-14T01:27:15Z"},{"id":"wordfence:24f13f9a-b240-4e32-9f12-117dbe7ecac4","source":"wordfence","cve":"","title":"Multivendor Marketplace Solution for WooCommerce <= 3.7.3 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f13f9a-b240-4e32-9f12-117dbe7ecac4?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:24f23230-7012-48c0-85e7-71518340cf95","source":"wordfence","cve":"CVE-2024-37092","title":"Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f23230-7012-48c0-85e7-71518340cf95?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T20:33:56Z"},{"id":"wordfence:24f2eafc-c8eb-4d78-af5e-1a589d7e4d21","source":"wordfence","cve":"CVE-2024-33947","title":"RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f2eafc-c8eb-4d78-af5e-1a589d7e4d21?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.3.2.0","to_inclusive":true,"patched_in":"5.3.2.1"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:57:51Z"},{"id":"wordfence:24f31bbf-883f-4903-847a-7bfc3e45654c","source":"wordfence","cve":"CVE-2025-7778","title":"Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f31bbf-883f-4903-847a-7bfc3e45654c?source=api-prod","affected":[{"type":"plugin","slug":"icons-factory","name":"Icons Factory","from":"*","from_inclusive":true,"to":"1.6.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:15:38Z","updated":"2025-08-15T08:25:39Z"},{"id":"wordfence:24f6c4e4-11c3-476f-9f50-42053b625ab8","source":"wordfence","cve":"CVE-2025-4127","title":"WP SEO Structured Data Schema <= 2.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24f6c4e4-11c3-476f-9f50-42053b625ab8?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-structured-data-schema","name":"WP SEO Structured Data Schema","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-05-07T17:42:22Z","updated":"2025-05-08T06:39:53Z"},{"id":"wordfence:24fb24cc-c29f-4d2d-87ba-5d211386e7dd","source":"wordfence","cve":"CVE-2026-15160","title":"Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24fb24cc-c29f-4d2d-87ba-5d211386e7dd?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-excel-export","name":"Ninja Forms - Excel Export","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-07-16T13:44:09Z","updated":"2026-07-17T02:31:32Z"},{"id":"wordfence:24fc2554-375a-4216-91bf-41921cc4b436","source":"wordfence","cve":"CVE-2023-41128","title":"WP Roadmap <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/24fc2554-375a-4216-91bf-41921cc4b436?source=api-prod","affected":[{"type":"plugin","slug":"wp-roadmap","name":"WP Roadmap \u2013 Product Feedback Board","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25018b54-9938-4261-80fb-d0c59d7fe456","source":"wordfence","cve":"CVE-2025-48095","title":"Survey Maker <= 5.1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25018b54-9938-4261-80fb-d0c59d7fe456?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.8.8","to_inclusive":true,"patched_in":"5.1.8.9"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T15:08:04Z"},{"id":"wordfence:250202d5-3a0d-494c-8386-1f4cd015ad7e","source":"wordfence","cve":"CVE-2025-3058","title":"Xelion Webchat <=  9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250202d5-3a0d-494c-8386-1f4cd015ad7e?source=api-prod","affected":[{"type":"plugin","slug":"xelion-webchat","name":"Xelion Webchat","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.2.0"}],"published":"2025-04-23T19:47:14Z","updated":"2025-04-30T13:34:24Z"},{"id":"wordfence:25031afe-5c23-45e2-a6b5-61189bfe5047","source":"wordfence","cve":"CVE-2024-7892","title":"adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25031afe-5c23-45e2-a6b5-61189bfe5047?source=api-prod","affected":[{"type":"plugin","slug":"adstxt","name":"adstxt Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-04T00:00:00Z","updated":"2024-10-04T17:13:50Z"},{"id":"wordfence:2503b101-62a8-4865-b4c6-b69416141087","source":"wordfence","cve":"CVE-2026-86717","title":"Insurify <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2503b101-62a8-4865-b4c6-b69416141087?source=api-prod","affected":[{"type":"plugin","slug":"insurify","name":"Insurify \u2013 Order & Shipping Protection","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:14:30Z"},{"id":"wordfence:2505860b-74e5-45c3-852c-3c6fabcb61d1","source":"wordfence","cve":"CVE-2025-68072","title":"Easy Property Listings <= 3.5.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2505860b-74e5-45c3-852c-3c6fabcb61d1?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.20","to_inclusive":true,"patched_in":"3.5.21"}],"published":"2026-01-22T00:00:00Z","updated":"2026-03-17T21:32:36Z"},{"id":"wordfence:2505ffdd-d697-4c69-8f75-0bc4d09e1b1f","source":"wordfence","cve":"","title":"Inline Related Posts <= 3.0.4 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2505ffdd-d697-4c69-8f75-0bc4d09e1b1f?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2021-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:250788a8-55d1-416b-bf1c-2170e8483ccc","source":"wordfence","cve":"CVE-2022-4155","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250788a8-55d1-416b-bf1c-2170e8483ccc?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2508adc4-2a2f-4b6c-9b5a-da85d94226a0","source":"wordfence","cve":"CVE-2023-23670","title":"WordPress Fancy Comments <= 1.2.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2508adc4-2a2f-4b6c-9b5a-da85d94226a0?source=api-prod","affected":[{"type":"plugin","slug":"fancy-facebook-comments","name":"Fancy Comments WordPress","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:250aefe5-5af4-478b-ab0a-aca71caec20d","source":"wordfence","cve":"CVE-2026-103323","title":"Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250aefe5-5af4-478b-ab0a-aca71caec20d?source=api-prod","affected":[{"type":"plugin","slug":"woo-epos-now-integration","name":"Integration for Epos Now and WooCommerce","from":"4.6.0","from_inclusive":true,"to":"4.11.1","to_inclusive":true,"patched_in":"4.11.2"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:02:13Z"},{"id":"wordfence:250b606d-9bc5-4f74-88f8-472d7d9799d3","source":"wordfence","cve":"CVE-2026-32487","title":"Lawyer Landing Page <= 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250b606d-9bc5-4f74-88f8-472d7d9799d3?source=api-prod","affected":[{"type":"theme","slug":"lawyer-landing-page","name":"Lawyer Landing Page","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T21:07:27Z"},{"id":"wordfence:250b8588-5f5c-41c1-b866-a1233a7f8910","source":"wordfence","cve":"CVE-2025-30593","title":"Include URL <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250b8588-5f5c-41c1-b866-a1233a7f8910?source=api-prod","affected":[{"type":"plugin","slug":"include-url","name":"Include URL","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T21:01:29Z"},{"id":"wordfence:250ce6a5-d479-419b-b2b0-306895f2b782","source":"wordfence","cve":"CVE-2025-58653","title":"JSM file_get_contents() Shortcode <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250ce6a5-d479-419b-b2b0-306895f2b782?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-get-contents","name":"JSM file_get_contents() Shortcode","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:46:54Z"},{"id":"wordfence:250d1bea-793d-4c13-976b-bfc3ff7d9160","source":"wordfence","cve":"CVE-2025-3099","title":"Advanced Search by My Solr Server <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250d1bea-793d-4c13-976b-bfc3ff7d9160?source=api-prod","affected":[{"type":"plugin","slug":"advanced-search-by-my-solr-server","name":"Advanced Search by My Solr Server","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:29:32Z","updated":"2025-04-02T09:21:43Z"},{"id":"wordfence:250edcf8-b56e-4714-9207-25bab2adaf9c","source":"wordfence","cve":"CVE-2022-1755","title":"SVG Support <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/250edcf8-b56e-4714-9207-25bab2adaf9c?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.5"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25114f3c-30dc-456f-85a8-df4e06751dec","source":"wordfence","cve":"CVE-2026-94077","title":"Safe SVG <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25114f3c-30dc-456f-85a8-df4e06751dec?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:43:14Z"},{"id":"wordfence:25122475-fc2c-4a8c-90d3-f4a85fb3a8cc","source":"wordfence","cve":"CVE-2023-49192","title":"Enhanced Text Widget <= 1.6.3 - Missing Authorization via etw_hide_admin_notification_callback","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25122475-fc2c-4a8c-90d3-f4a85fb3a8cc?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25128675-665e-4608-b7a2-5378b0fe8a2c","source":"wordfence","cve":"CVE-2025-31397","title":"Bus Ticket Booking with Seat Reservation for WooCommerce <= 1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25128675-665e-4608-b7a2-5378b0fe8a2c?source=api-prod","affected":[{"type":"plugin","slug":"scw-bus-seat-reservation","name":"Bus Ticket Booking with Seat Reservation for WooCommerce","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:44:03Z"},{"id":"wordfence:2513a199-30a8-45a9-80b3-1f6e51534c88","source":"wordfence","cve":"","title":"Nightlife Theme (All Known Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2513a199-30a8-45a9-80b3-1f6e51534c88?source=api-prod","affected":[{"type":"theme","slug":"nightlife","name":"nightlife","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-31T00:00:00Z","updated":"2024-10-23T12:44:54Z"},{"id":"wordfence:2514c343-3a34-4580-abe8-fc0192408860","source":"wordfence","cve":"CVE-2025-22332","title":"CloudFlare(R) Cache Purge <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2514c343-3a34-4580-abe8-fc0192408860?source=api-prod","affected":[{"type":"plugin","slug":"cloudflare-cache-purge","name":"CloudFlare(R) Cache Purge","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-20T15:57:26Z"},{"id":"wordfence:251943ed-65d2-4635-9c84-2cf671233543","source":"wordfence","cve":"CVE-2026-18579","title":"WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/251943ed-65d2-4635-9c84-2cf671233543?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.08.003","to_inclusive":true,"patched_in":"9.2.10.001"}],"published":"2026-09-10T14:45:00Z","updated":"2026-09-11T03:39:34Z"},{"id":"wordfence:25199281-5286-4d75-8d27-26ce215e0993","source":"wordfence","cve":"CVE-2023-5241","title":"AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file","severity":"critical","cvss":9.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25199281-5286-4d75-8d27-26ce215e0993?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"},{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"4.9.2","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:251b17a7-781f-4f17-af90-9a6fbae69243","source":"wordfence","cve":"CVE-2024-13901","title":"Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/251b17a7-781f-4f17-af90-9a6fbae69243?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T05:31:00Z"},{"id":"wordfence:251d4eb6-d87d-4d1e-9dac-30f24b4e65ef","source":"wordfence","cve":"CVE-2026-111031","title":"Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/251d4eb6-d87d-4d1e-9dac-30f24b4e65ef?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":false,"patched_in":"2.12.6"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:26:35Z"},{"id":"wordfence:25200656-a6a2-42f2-a607-26d4ff502cbf","source":"wordfence","cve":"CVE-2023-0709","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25200656-a6a2-42f2-a607-26d4ff502cbf?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25205cb9-6d8b-456a-82b8-7257668f2972","source":"wordfence","cve":"CVE-2024-4477","title":"WP Logs Book <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25205cb9-6d8b-456a-82b8-7257668f2972?source=api-prod","affected":[{"type":"plugin","slug":"wp-logs-book","name":"WP Logs Book","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:19:29Z"},{"id":"wordfence:252153ec-3811-484a-984f-eeb6ed9229a5","source":"wordfence","cve":"CVE-2023-49775","title":"CSV Importer <= 0.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/252153ec-3811-484a-984f-eeb6ed9229a5?source=api-prod","affected":[{"type":"plugin","slug":"csv-importer","name":"CSV Importer","from":"*","from_inclusive":true,"to":"0.3.8","to_inclusive":true,"patched_in":"0.3.9"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2523f85d-be90-4334-b8d5-8021ec05283d","source":"wordfence","cve":"CVE-2021-34635","title":"Poll Maker <= 3.2.8 \u2013 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2523f85d-be90-4334-b8d5-8021ec05283d?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25250755-0d22-44f4-8930-3a60efd61e32","source":"wordfence","cve":"CVE-2016-10994","title":"Truemag (Unknown Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25250755-0d22-44f4-8930-3a60efd61e32?source=api-prod","affected":[{"type":"theme","slug":"truemag","name":"Truemag","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2016-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2525ed97-b701-4f95-8d8c-202e816723c5","source":"wordfence","cve":"CVE-2026-19803","title":"Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2525ed97-b701-4f95-8d8c-202e816723c5?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2026-11-06T15:17:27Z","updated":"2026-11-07T03:28:04Z"},{"id":"wordfence:252726f5-62d4-4c1c-a4bc-44cd0fe94356","source":"wordfence","cve":"CVE-2026-40777","title":"wpsection <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/252726f5-62d4-4c1c-a4bc-44cd0fe94356?source=api-prod","affected":[{"type":"plugin","slug":"wpsection","name":"wpsection","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:27:24Z"},{"id":"wordfence:252c616f-2198-43d7-8767-3704f192a391","source":"wordfence","cve":"CVE-2025-48286","title":"ReDi Restaurant Reservation <= 24.1209 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/252c616f-2198-43d7-8767-3704f192a391?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.1209","to_inclusive":true,"patched_in":"25.0513"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T10:55:28Z"},{"id":"wordfence:252eed6a-2e4f-4840-9c51-87feb1cdc8fd","source":"wordfence","cve":"CVE-2025-22668","title":"Awesome Event Booking <= 2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/252eed6a-2e4f-4840-9c51-87feb1cdc8fd?source=api-prod","affected":[{"type":"plugin","slug":"awesome-event-booking","name":"Awesome Event Booking","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:02:45Z"},{"id":"wordfence:25302010-202a-458e-93b6-2e6b8604c091","source":"wordfence","cve":"CVE-2025-8685","title":"Wp chart generator <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25302010-202a-458e-93b6-2e6b8604c091?source=api-prod","affected":[{"type":"plugin","slug":"wp-chart-generator","name":"Wp chart generator","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T14:04:41Z","updated":"2025-08-12T02:24:46Z"},{"id":"wordfence:2535c00f-7725-48f2-a4a7-ea351b6f463b","source":"wordfence","cve":"CVE-2025-60161","title":"ZoloBlocks <= 2.3.11 - Unauthenticated Sever-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2535c00f-7725-48f2-a4a7-ea351b6f463b?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-14T16:10:20Z"},{"id":"wordfence:253d4985-d00e-40d4-b07c-42e613b4e53a","source":"wordfence","cve":"CVE-2025-52780","title":"Logo Manager For Samandehi <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/253d4985-d00e-40d4-b07c-42e613b4e53a?source=api-prod","affected":[{"type":"plugin","slug":"samandehi-logo-manager","name":"Logo Manager For Samandehi","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:57:19Z"},{"id":"wordfence:253dcecb-b88d-423c-8e74-1d59581e2893","source":"wordfence","cve":"CVE-2024-11359","title":"Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/253dcecb-b88d-423c-8e74-1d59581e2893?source=api-prod","affected":[{"type":"plugin","slug":"library-bookshelves","name":"Library Bookshelves","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:20Z"},{"id":"wordfence:2540bd75-ba5e-4aaf-9e65-8fc22c8b87cf","source":"wordfence","cve":"","title":"Social Media Widget <= 2.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2540bd75-ba5e-4aaf-9e65-8fc22c8b87cf?source=api-prod","affected":[{"type":"plugin","slug":"acurax-social-media-widget","name":"Social Media Widget by Acurax","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:254291b3-a30d-44ff-9df4-6ba700a9efc9","source":"wordfence","cve":"CVE-2024-0892","title":"Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254291b3-a30d-44ff-9df4-6ba700a9efc9?source=api-prod","affected":[{"type":"plugin","slug":"schema-app-structured-data-for-schemaorg","name":"Schema App Structured Data","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-06-13T00:00:00Z","updated":"2024-07-03T15:36:00Z"},{"id":"wordfence:25441444-f19c-4a68-9a2d-37c61189f457","source":"wordfence","cve":"CVE-2025-66136","title":"Carter for Elementor <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25441444-f19c-4a68-9a2d-37c61189f457?source=api-prod","affected":[{"type":"plugin","slug":"carter-elementor","name":"Advanced WooCommerce Cart for Elementor","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:54:15Z"},{"id":"wordfence:254591f4-9925-44c2-9644-34450520b53d","source":"wordfence","cve":"CVE-2026-79618","title":"User Frontend <= 4.3.11 - Authenticated (Subscriber+) Subscription-Gated Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254591f4-9925-44c2-9644-34450520b53d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:21:50Z"},{"id":"wordfence:25462492-59d2-44b7-81c3-93ac04a08bcc","source":"wordfence","cve":"CVE-2024-5061","title":"Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25462492-59d2-44b7-81c3-93ac04a08bcc?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-08-29T14:54:04Z","updated":"2024-09-10T20:35:19Z"},{"id":"wordfence:2546ea7e-133a-44b8-9cdb-1b345a45d583","source":"wordfence","cve":"CVE-2023-6161","title":"WP Crowdfunding <= 2.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2546ea7e-133a-44b8-9cdb-1b345a45d583?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-12-13T00:00:00Z","updated":"2024-02-06T15:08:12Z"},{"id":"wordfence:2547ec16-76c8-4cc2-b10b-d321324d9363","source":"wordfence","cve":"CVE-2025-26892","title":"Celestial Aura <= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2547ec16-76c8-4cc2-b10b-d321324d9363?source=api-prod","affected":[{"type":"theme","slug":"celestial-aura","name":"Celestial Aura","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T18:49:35Z"},{"id":"wordfence:2548d5b0-1f1a-4847-a5ea-e3bb6f7a5013","source":"wordfence","cve":"CVE-2023-44148","title":"Astra Bulk Edit <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2548d5b0-1f1a-4847-a5ea-e3bb6f7a5013?source=api-prod","affected":[{"type":"plugin","slug":"astra-bulk-edit","name":"Astra Bulk Edit","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2549394c-2f2f-4d90-a11c-ba6f28c3ea39","source":"wordfence","cve":"CVE-2025-47689","title":"Video Blogster Lite <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2549394c-2f2f-4d90-a11c-ba6f28c3ea39?source=api-prod","affected":[{"type":"plugin","slug":"video-blogster-lite","name":"Video Blogster Lite","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:41:53Z"},{"id":"wordfence:254b40a6-d89e-49d3-96b3-9b946d3e05f2","source":"wordfence","cve":"CVE-2026-28149","title":"Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254b40a6-d89e-49d3-96b3-9b946d3e05f2?source=api-prod","affected":[{"type":"plugin","slug":"headless-single-sign-on","name":"Headless SSO Plugin for WP","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T22:03:36Z"},{"id":"wordfence:254b5dd2-c3d9-45d9-8328-6cc8ef29c9db","source":"wordfence","cve":"CVE-2017-8295","title":"Wordpress Core < 5.5 - Unauthorized Password Reset via Interception","severity":"medium","cvss":5.9,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254b5dd2-c3d9-45d9-8328-6cc8ef29c9db?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":false,"patched_in":"5.5"}],"published":"2017-05-03T00:00:00Z","updated":"2024-02-15T14:14:01Z"},{"id":"wordfence:254c16d2-f725-4ae5-974b-7f092f16201f","source":"wordfence","cve":"CVE-2026-96896","title":"Malcure Malware Shield <= 19.9.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254c16d2-f725-4ae5-974b-7f092f16201f?source=api-prod","affected":[{"type":"plugin","slug":"wp-malware-removal","name":"Malcure Malware Shield \u2014 Removal, Repair, Monitor","from":"*","from_inclusive":true,"to":"19.9.6","to_inclusive":true,"patched_in":"19.9.7"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:14:42Z"},{"id":"wordfence:254f3a1c-0d5d-499b-9da7-129f21ba70af","source":"wordfence","cve":"CVE-2024-2239","title":"Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/254f3a1c-0d5d-499b-9da7-129f21ba70af?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:32:37Z"},{"id":"wordfence:2553a858-bbea-4ef2-8d45-e0a665123065","source":"wordfence","cve":"CVE-2010-4825","title":"Peadig's Twitter Feed: Embedded Timeline WordPress Plugin <= 2.2 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2553a858-bbea-4ef2-8d45-e0a665123065?source=api-prod","affected":[{"type":"plugin","slug":"wp-twitter-feed","name":"Peadig's Twitter Feed: Embedded Timeline WordPress Plugin","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2010-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25543955-15b0-4dda-9636-c116db7f2838","source":"wordfence","cve":"CVE-2015-5482","title":"GD bbPress Attachments < 2.3 - Directory Traversal","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25543955-15b0-4dda-9636-c116db7f2838?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-attachments","name":"forumAttachments for bbPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25552fdb-c55b-4390-a614-7c007c5fe7b1","source":"wordfence","cve":"CVE-2025-12074","title":"Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25552fdb-c55b-4390-a614-7c007c5fe7b1?source=api-prod","affected":[{"type":"theme","slug":"context-blog","name":"Context Blog","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-02-17T16:33:21Z","updated":"2026-02-18T04:35:41Z"},{"id":"wordfence:25554434-2330-4c58-8764-109e12065659","source":"wordfence","cve":"CVE-2024-52350","title":"CRM 2go <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25554434-2330-4c58-8764-109e12065659?source=api-prod","affected":[{"type":"plugin","slug":"crm2go","name":"CRM 2go \u2013 Formulario de contacto","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:16:37Z"},{"id":"wordfence:255546b4-4e0e-479a-8414-1f8c7192de51","source":"wordfence","cve":"CVE-2025-31581","title":"WP Video Playlist <= 1.1.2 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/255546b4-4e0e-479a-8414-1f8c7192de51?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-playlist","name":"WP Video Playlist","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-10T13:30:22Z"},{"id":"wordfence:25571e59-c966-4d30-9453-42b63778b9a0","source":"wordfence","cve":"CVE-2026-103915","title":"Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25571e59-c966-4d30-9453-42b63778b9a0?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2026-10-30T20:21:02Z","updated":"2026-10-31T08:30:45Z"},{"id":"wordfence:25595c99-87e2-408d-9931-c864af1cedd8","source":"wordfence","cve":"CVE-2025-23817","title":"MHR-Custom-Anti-Copy <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25595c99-87e2-408d-9931-c864af1cedd8?source=api-prod","affected":[{"type":"plugin","slug":"mhr-custom-anti-copy","name":"MHR-Custom-Anti-Copy","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:26:29Z"},{"id":"wordfence:2559cca2-ae4b-47fb-88ac-811fbd4e2b4b","source":"wordfence","cve":"CVE-2026-123480","title":"Display Eventbrite Events <= 6.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2559cca2-ae4b-47fb-88ac-811fbd4e2b4b?source=api-prod","affected":[{"type":"plugin","slug":"widget-for-eventbrite-api","name":"Display Eventbrite Events","from":"*","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.9.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:12Z"},{"id":"wordfence:255a50f0-0213-4de5-92f1-d71dbb5caeff","source":"wordfence","cve":"CVE-2022-0314","title":"Nimble Page Builder <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/255a50f0-0213-4de5-92f1-d71dbb5caeff?source=api-prod","affected":[{"type":"plugin","slug":"nimble-builder","name":"Nimble Page Builder","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2022-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:255cdf64-93cd-434c-9a3c-3b8e49593ffe","source":"wordfence","cve":"CVE-2015-9538","title":"NextGen Gallery <= 2.1.10 - Local File Inclusion","severity":"medium","cvss":6.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/255cdf64-93cd-434c-9a3c-3b8e49593ffe?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2015-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:255e7322-641a-4b05-ae2d-0ec90d133e8e","source":"wordfence","cve":"CVE-2025-31102","title":"Hostel <= 1.1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/255e7322-641a-4b05-ae2d-0ec90d133e8e?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.5","to_inclusive":true,"patched_in":"1.1.5.6"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T19:54:29Z"},{"id":"wordfence:255f0fc4-5023-4039-9418-2f28363dbfc4","source":"wordfence","cve":"","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.55 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/255f0fc4-5023-4039-9418-2f28363dbfc4?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.55","to_inclusive":true,"patched_in":"0.9.56"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2561ad0f-26b9-4581-8a52-76b69db80d6f","source":"wordfence","cve":"CVE-2025-22268","title":"Uncanny Toolkit for LearnDash <= 3.7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2561ad0f-26b9-4581-8a52-76b69db80d6f?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.7.0.1","to_inclusive":true,"patched_in":"3.7.0.2"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:54:03Z"},{"id":"wordfence:25627b5c-958c-45ad-8450-8dfccdfdac31","source":"wordfence","cve":"","title":"Radykal Fancy Gallery <= 1.2.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25627b5c-958c-45ad-8450-8dfccdfdac31?source=api-prod","affected":[{"type":"plugin","slug":"radykal-fancy-gallery","name":"Fancy Gallery - Wordpress plugin | Galleries","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2012-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2565852f-43df-41b1-949e-6c02a8946407","source":"wordfence","cve":"CVE-2024-25928","title":"Sitepact's Contact Form 7 Extension For Klaviyo <= 1.0.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2565852f-43df-41b1-949e-6c02a8946407?source=api-prod","affected":[{"type":"plugin","slug":"sitepact-klaviyo-contact-form-7","name":"Sitepact's Contact Form 7 Extension For Klaviyo","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-02-15T00:00:00Z","updated":"2024-07-03T14:46:13Z"},{"id":"wordfence:2567ecc4-1346-4092-8c99-ffa5064e6a3f","source":"wordfence","cve":"CVE-2024-2189","title":"Social Icons Widget & Block <= 4.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2567ecc4-1346-4092-8c99-ffa5064e6a3f?source=api-prod","affected":[{"type":"plugin","slug":"social-icons-widget-by-wpzoom","name":"WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat","from":"*","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"4.2.18"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-13T22:00:46Z"},{"id":"wordfence:2568018b-29f3-4261-ae0d-658ca9d96846","source":"wordfence","cve":"CVE-2023-0812","title":"Active Directory Integration / LDAP Integration <= 4.1.0 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2568018b-29f3-4261-ae0d-658ca9d96846?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25687ee6-a899-4089-966b-69578afd3fb6","source":"wordfence","cve":"CVE-2025-12732","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25687ee6-a899-4089-966b-69578afd3fb6?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.33","to_inclusive":true,"patched_in":"7.33.1"}],"published":"2025-11-11T20:07:42Z","updated":"2025-11-12T08:28:06Z"},{"id":"wordfence:2568d209-a89d-495d-adc1-c44aef75d337","source":"wordfence","cve":"CVE-2025-23556","title":"Push Envoy Notifications <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2568d209-a89d-495d-adc1-c44aef75d337?source=api-prod","affected":[{"type":"plugin","slug":"push-envoy","name":"Push Envoy Notifications","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:57:59Z"},{"id":"wordfence:256b4818-290b-4660-8e83-c18b068a8959","source":"wordfence","cve":"CVE-2024-0442","title":"Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/256b4818-290b-4660-8e83-c18b068a8959?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-08T00:00:00Z","updated":"2024-07-29T21:36:01Z"},{"id":"wordfence:256be233-e950-4a93-8153-83a297b0d4ca","source":"wordfence","cve":"CVE-2024-54208","title":"Block Controller <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/256be233-e950-4a93-8153-83a297b0d4ca?source=api-prod","affected":[{"type":"plugin","slug":"block-controller","name":"Block Controller","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2025-04-18T13:39:16Z"},{"id":"wordfence:256c4984-eee8-4ed0-ba34-e022822d6387","source":"wordfence","cve":"CVE-2025-26966","title":"Private Content <= 8.11.5 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/256c4984-eee8-4ed0-ba34-e022822d6387?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"Private Content","from":"*","from_inclusive":true,"to":"8.11.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:27:16Z"},{"id":"wordfence:256fb7f0-174a-4766-afd5-bc61e358da85","source":"wordfence","cve":"CVE-2024-32783","title":"Advanced Testimonial Carousel for Elementor <= 3.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/256fb7f0-174a-4766-afd5-bc61e358da85?source=api-prod","affected":[{"type":"plugin","slug":"advanced-testimonial-carousel-for-elementor","name":"Advanced Testimonial Carousel For Elementor","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:22:07Z"},{"id":"wordfence:25704473-1200-49df-aa16-9a9558bb4844","source":"wordfence","cve":"CVE-2026-15983","title":"Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25704473-1200-49df-aa16-9a9558bb4844?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-09-30T20:15:01Z","updated":"2026-10-01T08:28:41Z"},{"id":"wordfence:257052f4-2b0a-4604-befd-651dc338b3d5","source":"wordfence","cve":"CVE-2022-47138","title":"LOGIN AND REGISTRATION ATTEMPTS LIMIT <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257052f4-2b0a-4604-befd-651dc338b3d5?source=api-prod","affected":[{"type":"plugin","slug":"login-attempts-limit-wp","name":"LOGIN AND REGISTRATION ATTEMPTS LIMIT","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2570b881-fc9c-4f73-981e-2d72351b6688","source":"wordfence","cve":"CVE-2026-62096","title":"Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2570b881-fc9c-4f73-981e-2d72351b6688?source=api-prod","affected":[{"type":"theme","slug":"biolife","name":"Biolife - Organic Food WordPress Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:22:40Z"},{"id":"wordfence:2572dc76-b2fc-45de-b44e-896bf8456fdc","source":"wordfence","cve":"CVE-2026-103354","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.7.11.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2572dc76-b2fc-45de-b44e-896bf8456fdc?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.11.1","to_inclusive":true,"patched_in":"3.7.12"}],"published":"2026-10-02T06:39:03Z","updated":"2026-10-08T23:20:32Z"},{"id":"wordfence:25762427-8d31-4fef-8b93-1065d15cd918","source":"wordfence","cve":"","title":"Slideshow < 2.1.13 - Cross-Site Scripting and Sensitive Information Disclosure","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25762427-8d31-4fef-8b93-1065d15cd918?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-jquery-image-gallery","name":"Slideshow","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2012-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2577102f-6355-4483-bd3d-1948497cb843","source":"wordfence","cve":"CVE-2024-8247","title":"Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2577102f-6355-4483-bd3d-1948497cb843?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.2","to_inclusive":true,"patched_in":"4.9.9.3"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-06T03:30:43Z"},{"id":"wordfence:2578a863-4129-4f56-8b18-65b2d2b972e3","source":"wordfence","cve":"CVE-2024-13739","title":"Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2578a863-4129-4f56-8b18-65b2d2b972e3?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.7","to_inclusive":true,"patched_in":"4.9.9.8"}],"published":"2025-03-21T16:21:50Z","updated":"2025-03-22T04:22:06Z"},{"id":"wordfence:257aba03-bb41-4798-b62c-b51310d70264","source":"wordfence","cve":"CVE-2020-7239","title":"Chatbot with IBM Watson < 0.8.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257aba03-bb41-4798-b62c-b51310d70264?source=api-prod","affected":[{"type":"plugin","slug":"conversation-watson","name":"Chatbot with IBM watsonx Assistant","from":"*","from_inclusive":true,"to":"0.8.21","to_inclusive":false,"patched_in":"0.8.21"}],"published":"2020-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:257c30a3-81b6-4efe-89fd-adbbeb495f48","source":"wordfence","cve":"CVE-2025-54047","title":"Cost Calculator <= 7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257c30a3-81b6-4efe-89fd-adbbeb495f48?source=api-prod","affected":[{"type":"plugin","slug":"ql-cost-calculator","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.5"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:06:57Z"},{"id":"wordfence:257c47d4-811c-49ce-8d56-a595bc2aa26e","source":"wordfence","cve":"CVE-2024-43133","title":"Themify Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257c47d4-811c-49ce-8d56-a595bc2aa26e?source=api-prod","affected":[{"type":"plugin","slug":"themify-shortcodes","name":"Themify Shortcodes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:53:33Z"},{"id":"wordfence:257da138-8a1c-4c4c-a0e1-04eed4541bdb","source":"wordfence","cve":"CVE-2025-58814","title":"Stagtools <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257da138-8a1c-4c4c-a0e1-04eed4541bdb?source=api-prod","affected":[{"type":"plugin","slug":"stagtools","name":"StagTools","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:50:47Z"},{"id":"wordfence:257eb4c5-ca32-42ac-9f04-21adddcc96f0","source":"wordfence","cve":"CVE-2024-3580","title":"Popup4Phone <= 1.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/257eb4c5-ca32-42ac-9f04-21adddcc96f0?source=api-prod","affected":[{"type":"plugin","slug":"popup4phone","name":"Popup4Phone","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-20T21:05:42Z"},{"id":"wordfence:258177c4-d3d4-4465-8b73-0af1b02485b0","source":"wordfence","cve":"CVE-2022-1977","title":"WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery","severity":"medium","cvss":4.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258177c4-d3d4-4465-8b73-0af1b02485b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:258245f9-9c11-4a07-9a8c-38b9104fa026","source":"wordfence","cve":"CVE-2026-94568","title":"Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258245f9-9c11-4a07-9a8c-38b9104fa026?source=api-prod","affected":[{"type":"plugin","slug":"woo-vipps","name":"Pay with Vipps and MobilePay for WooCommerce","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:37:06Z"},{"id":"wordfence:258339a5-c3d5-4777-bd15-7141501f1501","source":"wordfence","cve":"CVE-2026-15796","title":"Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258339a5-c3d5-4777-bd15-7141501f1501?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:36Z","updated":"2026-09-10T03:40:40Z"},{"id":"wordfence:25838724-42b6-41e1-9546-78e6da2e95e1","source":"wordfence","cve":"CVE-2021-24488","title":"Post Grid <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25838724-42b6-41e1-9546-78e6da2e95e1?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2584097a-8955-41c7-b009-c6502fe8b99b","source":"wordfence","cve":"CVE-2026-5425","title":"Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2584097a-8955-41c7-b009-c6502fe8b99b?source=api-prod","affected":[{"type":"plugin","slug":"social-photo-feed-widget","name":"Widgets for Social Photo Feed","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-04-03T19:57:33Z","updated":"2026-04-04T08:25:21Z"},{"id":"wordfence:2586662d-c80b-4b6f-85eb-fb472655ea34","source":"wordfence","cve":"CVE-2024-43131","title":"Docket (WooCommerce Collections / Wishlist / Watchlist) < 1.7.0 - Missing Authorization to Unauthenticated Arbitrary Post/Page Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2586662d-c80b-4b6f-85eb-fb472655ea34?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-collections","name":"Docket (WooCommerce Collections / Wishlist / Watchlist)","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:40:21Z"},{"id":"wordfence:258877a7-670c-4a3c-8107-47dc7ba6a5ed","source":"wordfence","cve":"CVE-2024-12612","title":"School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258877a7-670c-4a3c-8107-47dc7ba6a5ed?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:57:11Z","updated":"2025-08-16T03:38:47Z"},{"id":"wordfence:258a2d5d-a176-4b89-bc4c-089d072982dd","source":"wordfence","cve":"CVE-2025-11801","title":"AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258a2d5d-a176-4b89-bc4c-089d072982dd?source=api-prod","affected":[{"type":"plugin","slug":"audiotube","name":"AudioTube","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:20:12Z","updated":"2025-11-21T07:31:48Z"},{"id":"wordfence:258c0819-3e7f-4c78-938f-885c4d4c5620","source":"wordfence","cve":"CVE-2025-58600","title":"Paid Member Subscriptions <= 2.15.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/258c0819-3e7f-4c78-938f-885c4d4c5620?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.15.9","to_inclusive":true,"patched_in":"2.16.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:56:53Z"},{"id":"wordfence:259010bd-ccb4-4907-bea8-f49e6464eaa1","source":"wordfence","cve":"CVE-2025-10045","title":"onOffice for WP-Websites <= 6.5.1 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259010bd-ccb4-4907-bea8-f49e6464eaa1?source=api-prod","affected":[{"type":"plugin","slug":"onoffice-for-wp-websites","name":"onOffice for WP-Websites","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.10"}],"published":"2025-10-14T19:47:22Z","updated":"2026-02-03T19:05:27Z"},{"id":"wordfence:259158f0-390a-458f-9d8e-262006c4c18d","source":"wordfence","cve":"","title":"Really Simple Guest Post <= 1.0.6 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259158f0-390a-458f-9d8e-262006c4c18d?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-guest-post","name":"Really Simple Guest Post","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2015-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2591af6b-e057-4c17-aeba-5c31efbae622","source":"wordfence","cve":"","title":"DejaVu <= 2.4 - Arbitrary File Download","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2591af6b-e057-4c17-aeba-5c31efbae622?source=api-prod","affected":[{"type":"theme","slug":"dejavu","name":"DejaVu","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2591f473-44ff-4319-8b17-b0f793a29d66","source":"wordfence","cve":"CVE-2025-15260","title":"MyRewards \u2013 Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2591f473-44ff-4319-8b17-b0f793a29d66?source=api-prod","affected":[{"type":"plugin","slug":"woorewards","name":"MyRewards","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-02-03T19:44:15Z","updated":"2026-02-16T21:58:00Z"},{"id":"wordfence:25922abb-7604-4134-92e8-23a1559f57fb","source":"wordfence","cve":"CVE-2025-66121","title":"SiteGround Security <= 1.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25922abb-7604-4134-92e8-23a1559f57fb?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-15T18:20:58Z"},{"id":"wordfence:25940775-2ff9-49cf-ab24-3e87f1ca8e42","source":"wordfence","cve":"CVE-2025-32124","title":"Behance Portfolio Manager <= 1.7.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25940775-2ff9-49cf-ab24-3e87f1ca8e42?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-03-17T21:21:15Z"},{"id":"wordfence:2596f703-7495-4769-8400-d813f63af9c6","source":"wordfence","cve":"CVE-2024-52398","title":"CDI <= 5.5.3 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2596f703-7495-4769-8400-d813f63af9c6?source=api-prod","affected":[{"type":"plugin","slug":"collect-and-deliver-interface-for-woocommerce","name":"CDI \u2013 Collect and Deliver Interface for Woocommerce","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.6"}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:07:50Z"},{"id":"wordfence:25971f3f-4816-416c-9de9-feb6326fe948","source":"wordfence","cve":"","title":"Super Store Finder <= 6.4, Super Interactive Maps <= 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25971f3f-4816-416c-9de9-feb6326fe948?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":false,"patched_in":"6.5"},{"type":"plugin","slug":"super-interactive-maps","name":"Super Interactive Maps","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2021-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2597724a-9a39-4e46-b153-f42366f833ba","source":"wordfence","cve":"CVE-2026-6443","title":"Essentialplugin Plugins (Various Versions) - Injected Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-and-projects","name":"Portfolio and Projects","from":"1.5.6","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.6.1"},{"type":"plugin","slug":"html5-videogallery-plus-player","name":"Video gallery and Player","from":"2.8.7","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.7.1"},{"type":"plugin","slug":"wp-testimonial-with-widget","name":"Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget","from":"3.5.6","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.6.1"},{"type":"plugin","slug":"wp-slick-slider-and-image-carousel","name":"WP Slick Slider and Image Carousel","from":"3.7.8.1","from_inclusive":true,"to":"3.7.8.1","to_inclusive":true,"patched_in":"3.7.8.2"},{"type":"plugin","slug":"accordion-and-accordion-slider","name":"Accordion and Accordion Slider","from":"1.4.6","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.6.1"},{"type":"plugin","slug":"wp-logo-showcase-responsive-slider-slider","name":"WP Logo Showcase Responsive Slider and Carousel","from":"3.8.7","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.7.1"},{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"2.1.8","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.8.1"},{"type":"plugin","slug":"meta-slider-and-carousel-with-lightbox","name":"Meta Slider and Carousel with Lightbox","from":"2.0.8","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.8.1"},{"type":"plugin","slug":"blog-designer-for-post-and-widget","name":"Blog Designer \u2013 Post and Widget","from":"2.7.7","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.7.1"},{"type":"plugin","slug":"sp-news-and-widget","name":"WP News and Scrolling Widgets","from":"5.0.6","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.6.1"},{"type":"plugin","slug":"wp-trending-post-slider-and-widget","name":"Trending/Popular Post Slider and Widget","from":"1.8.6","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.6.1"},{"type":"plugin","slug":"countdown-timer-ultimate","name":"Countdown Timer Ultimate","from":"2.6.9","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"},{"type":"plugin","slug":"wp-featured-content-and-slider","name":"WP Featured Content and Slider","from":"1.7.6","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.6.1"},{"type":"plugin","slug":"ticker-ultimate","name":"Post Ticker Ultimate","from":"1.7.6","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.6.1"},{"type":"plugin","slug":"wp-team-showcase-and-slider","name":"Team Slider and Team Grid Showcase plus Team Carousel","from":"2.8.6","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.6.1"},{"type":"plugin","slug":"post-grid-and-filter-ultimate","name":"Post grid and filter ultimate","from":"1.7.4","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.4.1"},{"type":"plugin","slug":"wp-blog-and-widgets","name":"WP Blog and Widgets","from":"2.6.6","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.6.1"},{"type":"plugin","slug":"featured-post-creative","name":"Featured Post Creative","from":"1.5.7","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.7.1"},{"type":"plugin","slug":"timeline-and-history-slider","name":"Timeline and History slider","from":"2.4.5","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.5.1"},{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"2.9.1","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.1.1"},{"type":"plugin","slug":"sp-faq","name":"WP responsive FAQ with category plugin","from":"3.9.5","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.5.1"},{"type":"plugin","slug":"wp-responsive-recent-post-slider","name":"WP Responsive Recent Post Slider/Carousel","from":"3.7.1","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.1.1"}],"published":"2026-04-09T00:00:00Z","updated":"2026-04-21T15:30:55Z"},{"id":"wordfence:2598076e-85d6-40a7-a975-36c3f7320c4f","source":"wordfence","cve":"CVE-2025-31400","title":"WS Audio Player <= 1.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2598076e-85d6-40a7-a975-36c3f7320c4f?source=api-prod","affected":[{"type":"plugin","slug":"ws-audio-player","name":"WS Audio Player","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:09:05Z"},{"id":"wordfence:2598795e-ea66-4c73-8fcb-6a832f65de52","source":"wordfence","cve":"CVE-2024-30479","title":"IP Blocker Lite <= 11.1.1 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2598795e-ea66-4c73-8fcb-6a832f65de52?source=api-prod","affected":[{"type":"plugin","slug":"ip-address-blocker","name":"LionScripts: IP Blocker Lite","from":"*","from_inclusive":true,"to":"11.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:57:47Z"},{"id":"wordfence:2598ae85-5e91-47e6-b3f5-0d977fe80dd5","source":"wordfence","cve":"CVE-2021-24245","title":"Stop Spammers <= 2021.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2598ae85-5e91-47e6-b3f5-0d977fe80dd5?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2021.9","to_inclusive":false,"patched_in":"2021.9"}],"published":"2021-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25999d1f-9085-4410-b76a-3570f2517bdd","source":"wordfence","cve":"CVE-2024-43132","title":"Docket (WooCommerce Collections / Wishlist / Watchlist) < 1.7.0 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25999d1f-9085-4410-b76a-3570f2517bdd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-collections","name":"Docket (WooCommerce Collections / Wishlist / Watchlist)","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:39:03Z"},{"id":"wordfence:259a4950-9377-4d18-86ad-aadd97dcdbc7","source":"wordfence","cve":"CVE-2026-4068","title":"Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259a4950-9377-4d18-86ad-aadd97dcdbc7?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-fields-to-media","name":"Add Custom Fields to Media","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-03-18T18:16:21Z","updated":"2026-03-19T06:46:13Z"},{"id":"wordfence:259d7b97-23a9-445b-a8dd-a384526bef47","source":"wordfence","cve":"CVE-2025-49420","title":"Markup Markdown <= 3.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259d7b97-23a9-445b-a8dd-a384526bef47?source=api-prod","affected":[{"type":"plugin","slug":"markup-markdown","name":"Markup Markdown","from":"*","from_inclusive":true,"to":"3.20.6","to_inclusive":true,"patched_in":"3.20.7"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:07:56Z"},{"id":"wordfence:259e80a0-21e8-4482-89dc-899a08669e91","source":"wordfence","cve":"CVE-2024-4474","title":"WP Logs Book <= 1.0.1 - Cross-Site Request Forgery to Log Disabling","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259e80a0-21e8-4482-89dc-899a08669e91?source=api-prod","affected":[{"type":"plugin","slug":"wp-logs-book","name":"WP Logs Book","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:18:41Z"},{"id":"wordfence:259ed1a0-1bfa-4d38-845c-e5655c330702","source":"wordfence","cve":"","title":"WordPress Countdown Widget <= 3.1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259ed1a0-1bfa-4d38-845c-e5655c330702?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-countdown-widget","name":"WordPress Countdown Widget","from":"*","from_inclusive":true,"to":"3.1.9.1","to_inclusive":true,"patched_in":"3.1.9.2"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:259f2e45-23df-442a-abb5-d37aadf7f045","source":"wordfence","cve":"CVE-2025-24564","title":"Contact Form With Shortcode <= 4.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259f2e45-23df-442a-abb5-d37aadf7f045?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-shortcode","name":"Contact Form With Shortcode","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-21T14:27:40Z"},{"id":"wordfence:259f9ea3-ac24-4bea-8d0d-c635a68d9c98","source":"wordfence","cve":"CVE-2024-11277","title":"404 Solution <= 2.35.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/259f9ea3-ac24-4bea-8d0d-c635a68d9c98?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.35.19","to_inclusive":true,"patched_in":"2.35.20"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:53Z"},{"id":"wordfence:25a05249-d899-429b-a7d3-c283c03a48a2","source":"wordfence","cve":"CVE-2017-14845","title":"WPCHURCH - Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection","severity":"high","cvss":8.8,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a05249-d899-429b-a7d3-c283c03a48a2?source=api-prod","affected":[{"type":"plugin","slug":"church-management","name":"WPCHURCH - Church Management System for Wordpress","from":"*","from_inclusive":true,"to":"13-07-2019","to_inclusive":false,"patched_in":"13-07-2019"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25a25dae-578b-40d6-95c3-8428ca545ac3","source":"wordfence","cve":"CVE-2015-9465","title":"Yasr \u2013 Yet Another Stars Rating < 0.9.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a25dae-578b-40d6-95c3-8428ca545ac3?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":false,"patched_in":"0.9.1"}],"published":"2015-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25a3bba1-99e4-45ec-b761-fa1282948516","source":"wordfence","cve":"CVE-2024-51599","title":"Simple Business Manager <= 4.6.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a3bba1-99e4-45ec-b761-fa1282948516?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-manager","name":"Simple Business Manager","from":"*","from_inclusive":true,"to":"4.6.7.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:15:15Z"},{"id":"wordfence:25a3ec45-aa45-4ffc-be7e-f47100ac4626","source":"wordfence","cve":"CVE-2025-47608","title":"Recover abandoned cart for WooCommerce <= 2.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a3ec45-aa45-4ffc-be7e-f47100ac4626?source=api-prod","affected":[{"type":"plugin","slug":"recover-wc-abandoned-cart","name":"Recover abandoned cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:38:32Z"},{"id":"wordfence:25a500fe-c048-482c-b0cb-262ae25cedc6","source":"wordfence","cve":"CVE-2025-31525","title":"WP Mobile Bottom Menu <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a500fe-c048-482c-b0cb-262ae25cedc6?source=api-prod","affected":[{"type":"plugin","slug":"mobile-bottom-menu-for-wp","name":"WP Mobile Bottom Menu","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-06-12T18:35:55Z"},{"id":"wordfence:25a55dc6-6bfe-40dc-afae-e91670f6b73c","source":"wordfence","cve":"CVE-2025-57982","title":"Advance Portfolio Grid <= 1.07.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a55dc6-6bfe-40dc-afae-e91670f6b73c?source=api-prod","affected":[{"type":"plugin","slug":"advance-portfolio-grid","name":"Portfolio Grid \u2013 Filterable Gallery, Grid & Slider Showcase","from":"*","from_inclusive":true,"to":"1.07.6","to_inclusive":true,"patched_in":"1.07.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-20T19:54:00Z"},{"id":"wordfence:25a566ed-9ed6-4c72-9728-49a0edfb5ba5","source":"wordfence","cve":"CVE-2023-0605","title":"Auto Rename Media On Upload <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a566ed-9ed6-4c72-9728-49a0edfb5ba5?source=api-prod","affected":[{"type":"plugin","slug":"auto-rename-media-on-upload","name":"Auto Rename Media On Upload","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25a80b0b-2636-45c1-92e5-bd62c8a4ab20","source":"wordfence","cve":"CVE-2022-0825","title":"Appointment and Event Booking Calendar for WordPress \u2013 Amelia < 1.0.49 - Arbitrary Booking Update and Sensitive Data Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a80b0b-2636-45c1-92e5-bd62c8a4ab20?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.49","to_inclusive":false,"patched_in":"1.0.49"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25a8169d-1057-4cf2-9048-fb85f62d6ead","source":"wordfence","cve":"CVE-2023-48779","title":"360 Javascript Viewer <= 1.7.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a8169d-1057-4cf2-9048-fb85f62d6ead?source=api-prod","affected":[{"type":"plugin","slug":"360deg-javascript-viewer","name":"360 Javascript Viewer","from":"*","from_inclusive":true,"to":"1.7.11","to_inclusive":true,"patched_in":"1.7.12"}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-22T15:16:28Z"},{"id":"wordfence:25a8b9c9-da25-48b9-ada1-ca8a5941b2c2","source":"wordfence","cve":"CVE-2022-1801","title":"Very Simple Contact Form <= 11.5 - Captcha Bypass","severity":"high","cvss":7.2,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a8b9c9-da25-48b9-ada1-ca8a5941b2c2?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-contact-form","name":"VS Contact Form","from":"*","from_inclusive":true,"to":"11.5","to_inclusive":true,"patched_in":"11.6"}],"published":"2022-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25a9fd76-15aa-43f9-bb11-9825b847a4e3","source":"wordfence","cve":"CVE-2024-48021","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25a9fd76-15aa-43f9-bb11-9825b847a4e3?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-10-08T00:00:00Z","updated":"2024-10-16T12:35:56Z"},{"id":"wordfence:25abca87-1be2-427e-ab01-377d52917052","source":"wordfence","cve":"CVE-2026-9016","title":"Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-117","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25abca87-1be2-427e-ab01-377d52917052?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-06T04:28:22Z"},{"id":"wordfence:25acd3d9-0c1a-426e-b670-b842f031bdc5","source":"wordfence","cve":"CVE-2024-43350","title":"Propovoice CRM <= 1.7.8 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25acd3d9-0c1a-426e-b670-b842f031bdc5?source=api-prod","affected":[{"type":"plugin","slug":"propovoice","name":"Propovoice: All-in-One Client Management System","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2025-10-21T21:05:36Z"},{"id":"wordfence:25adfac4-acba-4ba9-a824-eb8661b2a557","source":"wordfence","cve":"CVE-2026-22447","title":"Prowess <= 1.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25adfac4-acba-4ba9-a824-eb8661b2a557?source=api-prod","affected":[{"type":"theme","slug":"prowess","name":"Prowess - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-03T00:00:00Z","updated":"2026-01-15T17:30:19Z"},{"id":"wordfence:25ae6c7d-a03c-43f6-9c46-8797a9765d04","source":"wordfence","cve":"CVE-2026-104741","title":"AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ae6c7d-a03c-43f6-9c46-8797a9765d04?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"2.4.89","to_inclusive":true,"patched_in":"2.4.90"}],"published":"2026-10-09T17:11:47Z","updated":"2026-10-10T05:30:57Z"},{"id":"wordfence:25afc28c-2814-4b49-add5-1d0ce5ff3a07","source":"wordfence","cve":"CVE-2025-3748","title":"Taxonomy Chain Menu <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25afc28c-2814-4b49-add5-1d0ce5ff3a07?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-chain-menu","name":"Taxonomy Chain Menu","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-05-01T15:09:31Z","updated":"2025-05-02T03:21:18Z"},{"id":"wordfence:25affa52-13a7-4726-b02a-5af78afa8acf","source":"wordfence","cve":"CVE-2026-39591","title":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress <= 4.0.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25affa52-13a7-4726-b02a-5af78afa8acf?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:50:01Z"},{"id":"wordfence:25b13322-d305-45db-8ac7-20762398dc21","source":"wordfence","cve":"CVE-2023-27455","title":"Update Image Tag Alt Attribute <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b13322-d305-45db-8ac7-20762398dc21?source=api-prod","affected":[{"type":"plugin","slug":"update-alt-attribute","name":"Update Image Tag Alt Attribute","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25b26369-76e3-44f0-8275-03fc6fc9705c","source":"wordfence","cve":"CVE-2020-9372","title":"Appointment Booking Calendar <= 1.3.34 - CSV Injection","severity":"high","cvss":7.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b26369-76e3-44f0-8275-03fc6fc9705c?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.35","to_inclusive":false,"patched_in":"1.3.35"}],"published":"2020-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25b32ad8-db0f-4391-a644-2759e35824ff","source":"wordfence","cve":"CVE-2025-26552","title":"Naver Syndication V2 <= 0.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b32ad8-db0f-4391-a644-2759e35824ff?source=api-prod","affected":[{"type":"plugin","slug":"badr-naver-syndication","name":"Naver Syndication V2","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:32:34Z"},{"id":"wordfence:25b3607c-f99e-4359-8228-0f3452f80aac","source":"wordfence","cve":"CVE-2026-4126","title":"Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b3607c-f99e-4359-8228-0f3452f80aac?source=api-prod","affected":[{"type":"plugin","slug":"table-manager","name":"Table Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-04-21T19:09:00Z","updated":"2026-09-11T18:41:27Z"},{"id":"wordfence:25b93c52-6e91-452c-9cca-f49af97b4e56","source":"wordfence","cve":"CVE-2017-20246","title":"KittyCatfish <= 2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b93c52-6e91-452c-9cca-f49af97b4e56?source=api-prod","affected":[{"type":"plugin","slug":"kittycatfish","name":"kittycatfish","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T17:38:28Z"},{"id":"wordfence:25b94c05-87c5-44fb-90d5-6c65d035dba6","source":"wordfence","cve":"CVE-2021-24163","title":"Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure","severity":"high","cvss":8.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25b94c05-87c5-44fb-90d5-6c65d035dba6?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.34","to_inclusive":false,"patched_in":"3.4.34"}],"published":"2021-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25ba4be3-0bcd-41ff-8a7a-fd6ae848afb8","source":"wordfence","cve":"CVE-2014-4602","title":"XEN Carousel <= 0.12.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ba4be3-0bcd-41ff-8a7a-fd6ae848afb8?source=api-prod","affected":[{"type":"plugin","slug":"xen-carousel","name":"XEN Carousel","from":"*","from_inclusive":true,"to":"0.12.2","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25baf78e-e9bc-421b-8a66-9571ac3625c3","source":"wordfence","cve":"CVE-2022-3247","title":"Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25baf78e-e9bc-421b-8a66-9571ac3625c3?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"6.9.10"}],"published":"2022-10-03T00:00:00Z","updated":"2024-10-24T18:44:14Z"},{"id":"wordfence:25bdb89f-3478-4a1a-8bf0-46e88207eb21","source":"wordfence","cve":"CVE-2026-2019","title":"Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting","severity":"high","cvss":7.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25bdb89f-3478-4a1a-8bf0-46e88207eb21?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-all-in-one","name":"CartSuite \u2013 Cart All In One For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2026-02-17T18:22:15Z","updated":"2026-02-18T06:42:40Z"},{"id":"wordfence:25bdc101-ba13-40fa-97af-75777a2f4bf8","source":"wordfence","cve":"CVE-2026-42641","title":"Share This Image <= 2.14 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25bdc101-ba13-40fa-97af-75777a2f4bf8?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.14","to_inclusive":true,"patched_in":"2.15"}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-12T14:04:46Z"},{"id":"wordfence:25c35a42-9f1a-4f67-a074-c6359e8b1a41","source":"wordfence","cve":"CVE-2024-6889","title":"Secure Copy Content Protection and Content Locking <= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25c35a42-9f1a-4f67-a074-c6359e8b1a41?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2024-08-13T00:00:00Z","updated":"2024-09-12T14:41:35Z"},{"id":"wordfence:25c44a00-da56-41f8-bd4f-c15bede6da58","source":"wordfence","cve":"","title":"Email Users <= 4.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25c44a00-da56-41f8-bd4f-c15bede6da58?source=api-prod","affected":[{"type":"plugin","slug":"email-users","name":"Email Users","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":false,"patched_in":"4.8.3"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25c6768f-ec65-4639-943b-96c9fa11e667","source":"wordfence","cve":"CVE-2026-84773","title":"EWWW Image Optimizer <= 8.7.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25c6768f-ec65-4639-943b-96c9fa11e667?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.6","to_inclusive":true,"patched_in":"8.7.7"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:34:46Z"},{"id":"wordfence:25cb57fb-4af5-4f12-a01c-7ffdd8f84219","source":"wordfence","cve":"","title":"InFocus <= 3.3 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25cb57fb-4af5-4f12-a01c-7ffdd8f84219?source=api-prod","affected":[{"type":"theme","slug":"infocus","name":"InFocus","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25cbaa1d-97ff-436d-8a94-c487c05acef9","source":"wordfence","cve":"CVE-2025-63042","title":"Tutor LMS Elementor Addons <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25cbaa1d-97ff-436d-8a94-c487c05acef9?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-11-30T00:00:00Z","updated":"2026-02-25T14:32:52Z"},{"id":"wordfence:25cde35e-ba76-4651-8828-71ddd4c8a164","source":"wordfence","cve":"CVE-2022-2167","title":"Newspaper <= 11.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25cde35e-ba76-4651-8828-71ddd4c8a164?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"11.5.1","to_inclusive":true,"patched_in":"12"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25cf5cf7-d846-4f0e-aa6b-bbf7dba27b10","source":"wordfence","cve":"CVE-2026-118048","title":"WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25cf5cf7-d846-4f0e-aa6b-bbf7dba27b10?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.89","to_inclusive":true,"patched_in":"5.5.90"}],"published":"2026-11-06T18:23:33Z","updated":"2026-11-07T06:39:35Z"},{"id":"wordfence:25cfa88b-5b13-43d9-823b-c5d2064f5888","source":"wordfence","cve":"CVE-2025-49891","title":"Contact Info Widget <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25cfa88b-5b13-43d9-823b-c5d2064f5888?source=api-prod","affected":[{"type":"plugin","slug":"simple-contact-info-widget","name":"Contact Info Widget","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-25T17:25:04Z"},{"id":"wordfence:25d07a99-d425-4e1a-8adf-d12071552882","source":"wordfence","cve":"CVE-2023-6745","title":"Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d07a99-d425-4e1a-8adf-d12071552882?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-10T00:00:00Z","updated":"2024-07-29T21:36:01Z"},{"id":"wordfence:25d0921b-39b1-4abb-9197-952fc55f80e6","source":"wordfence","cve":"CVE-2025-12652","title":"Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d0921b-39b1-4abb-9197-952fc55f80e6?source=api-prod","affected":[{"type":"plugin","slug":"ungapped-widgets","name":"Ungapped Widgets","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:27:06Z","updated":"2025-11-11T03:30:34Z"},{"id":"wordfence:25d1e9a0-cbfc-41c4-a5a5-238fffb5324d","source":"wordfence","cve":"CVE-2026-14558","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d1e9a0-cbfc-41c4-a5a5-238fffb5324d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":false,"patched_in":"4.3.10"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:55:23Z"},{"id":"wordfence:25d56d0f-2995-4a46-94e7-17a945ec4353","source":"wordfence","cve":"CVE-2025-28872","title":"Block Spam By Math Reloaded <= 2.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d56d0f-2995-4a46-94e7-17a945ec4353?source=api-prod","affected":[{"type":"plugin","slug":"block-spam-by-math-reloaded","name":"Block Spam By Math Reloaded","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:24:02Z"},{"id":"wordfence:25d5735a-8eed-4b4a-9bbe-9e42fb18ddf2","source":"wordfence","cve":"CVE-2023-47823","title":"FormCraft <= 1.2.7 - Missing Authorization via formcraft_nag_update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d5735a-8eed-4b4a-9bbe-9e42fb18ddf2?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25d6ee47-2a7b-486e-856b-336964b387ae","source":"wordfence","cve":"CVE-2024-12496","title":"Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25d6ee47-2a7b-486e-856b-336964b387ae?source=api-prod","affected":[{"type":"plugin","slug":"linear","name":"Linear","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-01-08T22:02:22Z","updated":"2025-11-05T19:07:33Z"},{"id":"wordfence:25dd83c5-2ebe-4976-8e97-650e5eadbe43","source":"wordfence","cve":"","title":"Portfolio Gallery \u2013 Image Gallery Plugin <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25dd83c5-2ebe-4976-8e97-650e5eadbe43?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-filter-gallery","name":"Portfolio Filter Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2020-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25de953d-e8c4-4ac7-ae6c-d8262bb083cd","source":"wordfence","cve":"CVE-2025-69323","title":"Slimstat Analytics <= 5.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25de953d-e8c4-4ac7-ae6c-d8262bb083cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:36:09Z"},{"id":"wordfence:25deb040-1338-40bd-b83e-be3a302e635c","source":"wordfence","cve":"CVE-2024-51635","title":"While Loading <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25deb040-1338-40bd-b83e-be3a302e635c?source=api-prod","affected":[{"type":"plugin","slug":"while-it-is-loading","name":"While Loading","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:27:41Z"},{"id":"wordfence:25dfa483-26c6-43d1-9a24-9ea245b54f4c","source":"wordfence","cve":"CVE-2025-14129","title":"Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25dfa483-26c6-43d1-9a24-9ea245b54f4c?source=api-prod","affected":[{"type":"plugin","slug":"like-dislike-voting","name":"Like DisLike Voting","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:23:07Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:25e0be55-ca6d-40c2-972f-fa37c99966c7","source":"wordfence","cve":"CVE-2024-51683","title":"Custom post type templates for Elementor <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0be55-ca6d-40c2-972f-fa37c99966c7?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-templates-for-elementor","name":"Custom post type templates for Elementor","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":false,"patched_in":"1.1.12"},{"type":"plugin","slug":"custom-post-type-templates-for-elementor","name":"Custom post type templates for Elementor","from":"1.10.0","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-25T15:27:40Z"},{"id":"wordfence:25e0c269-55c2-49f0-96bb-ae2696e2cea8","source":"wordfence","cve":"CVE-2024-12885","title":"Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0c269-55c2-49f0-96bb-ae2696e2cea8?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"10.4.66","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:44:04Z","updated":"2025-01-25T07:24:15Z"},{"id":"wordfence:25e11dbd-f751-4dd1-a609-1a5ae7e333b8","source":"wordfence","cve":"CVE-2025-31451","title":"wBounce <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e11dbd-f751-4dd1-a609-1a5ae7e333b8?source=api-prod","affected":[{"type":"plugin","slug":"wbounce","name":"wBounce","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:52:33Z"},{"id":"wordfence:25e145b5-719b-4b7c-aee2-343e8418bf08","source":"wordfence","cve":"CVE-2026-42663","title":"Simple Membership <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e145b5-719b-4b7c-aee2-343e8418bf08?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2026-05-03T00:00:00Z","updated":"2026-07-10T19:22:59Z"},{"id":"wordfence:25e42bf8-794e-46a5-b7db-f1f8802bba00","source":"wordfence","cve":"CVE-2024-4482","title":"The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e42bf8-794e-46a5-b7db-f1f8802bba00?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2024-07-02T18:45:07Z","updated":"2024-07-03T07:32:38Z"},{"id":"wordfence:25e4abf4-9869-436c-8fd3-9f59b2363ba7","source":"wordfence","cve":"CVE-2014-9397","title":"Twimp WP <= 0.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e4abf4-9869-436c-8fd3-9f59b2363ba7?source=api-prod","affected":[{"type":"plugin","slug":"twimp-wp","name":"Twimp WP","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25e4ed00-a9f2-402f-8a46-3cb911ab5497","source":"wordfence","cve":"CVE-2023-0442","title":"Loan Comparison <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e4ed00-a9f2-402f-8a46-3cb911ab5497?source=api-prod","affected":[{"type":"plugin","slug":"loan-comparison","name":"Loan Comparison","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25e9dbfd-a24e-400c-b926-051c1eb3643a","source":"wordfence","cve":"CVE-2025-27282","title":"Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e9dbfd-a24e-400c-b926-051c1eb3643a?source=api-prod","affected":[{"type":"plugin","slug":"theme-file-duplicator","name":"Theme File Duplicator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:29:12Z"},{"id":"wordfence:25ea860e-c4f8-4660-a8cb-aafc4d02bb19","source":"wordfence","cve":"CVE-2026-5391","title":"LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ea860e-c4f8-4660-a8cb-aafc4d02bb19?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-08-05T22:11:54Z","updated":"2026-08-06T11:29:20Z"},{"id":"wordfence:25eb1c89-0121-4ea5-a29a-43ec98c468ee","source":"wordfence","cve":"CVE-2025-6687","title":"Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25eb1c89-0121-4ea5-a29a-43ec98c468ee?source=api-prod","affected":[{"type":"plugin","slug":"magic-buttons-for-elementor","name":"Magic Buttons for Elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:56:05Z","updated":"2026-09-09T16:32:10Z"},{"id":"wordfence:25edb9e8-65ea-41d1-a95f-09be110ec1d2","source":"wordfence","cve":"CVE-2024-4630","title":"Starter Templates \u2014 Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25edb9e8-65ea-41d1-a95f-09be110ec1d2?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-11T04:30:18Z"},{"id":"wordfence:25f0615b-17a1-4bf8-9f77-4703c39baca5","source":"wordfence","cve":"CVE-2024-56217","title":"Download Manager <= 3.3.03 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f0615b-17a1-4bf8-9f77-4703c39baca5?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.03","to_inclusive":true,"patched_in":"3.3.04"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:03:58Z"},{"id":"wordfence:25f24bdd-0b78-4ec3-821b-6331e5bf65e8","source":"wordfence","cve":"CVE-2024-11750","title":"ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f24bdd-0b78-4ec3-821b-6331e5bf65e8?source=api-prod","affected":[{"type":"plugin","slug":"onlyoffice-docspace","name":"ONLYOFFICE DocSpace","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:10Z"},{"id":"wordfence:25f277f3-8b94-4ea2-ba84-885257690b18","source":"wordfence","cve":"","title":"NextGEN Gallery Voting <= 2.7.5 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f277f3-8b94-4ea2-ba84-885257690b18?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery-voting","name":"NextGEN Gallery Voting","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":false,"patched_in":"2.7.6"}],"published":"2014-12-17T00:00:00Z","updated":"2024-10-23T12:41:06Z"},{"id":"wordfence:25f71a19-85b1-4bc9-b193-d9de2eba81ee","source":"wordfence","cve":"CVE-2023-6743","title":"Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import","severity":"high","cvss":8.8,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f71a19-85b1-4bc9-b193-d9de2eba81ee?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.89","to_inclusive":true,"patched_in":"1.5.91"}],"published":"2024-05-28T00:00:00Z","updated":"2024-07-29T21:36:01Z"},{"id":"wordfence:25f782c4-7ece-47cb-9e64-9c93fd8858e9","source":"wordfence","cve":"","title":"WordPress fancybox <= 1.0.2 - Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f782c4-7ece-47cb-9e64-9c93fd8858e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-fancybox","name":"WP fancybox","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2020-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25f8b0db-eed2-468a-a6b3-ed93daaddcb2","source":"wordfence","cve":"CVE-2014-7181","title":"MaxButtons  < 1.26.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25f8b0db-eed2-468a-a6b3-ed93daaddcb2?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"1.26.1","to_inclusive":false,"patched_in":"1.26.1"}],"published":"2014-09-24T00:00:00Z","updated":"2024-08-09T16:55:29Z"},{"id":"wordfence:25fa3c6b-d680-4c08-a183-4dc31bcb799e","source":"wordfence","cve":"CVE-2025-22328","title":"Elevio <= 4.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25fa3c6b-d680-4c08-a183-4dc31bcb799e?source=api-prod","affected":[{"type":"plugin","slug":"elevio","name":"Elevio","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:06:54Z"},{"id":"wordfence:25fab7b3-59ce-44ca-83fa-bd25b7f31af0","source":"wordfence","cve":"CVE-2022-3240","title":"Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25fab7b3-59ce-44ca-83fa-bd25b7f31af0?source=api-prod","affected":[{"type":"plugin","slug":"follow-me","name":"Follow Me Plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:25fc2600-9b57-405e-9956-b55291161700","source":"wordfence","cve":"CVE-2026-1851","title":"iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25fc2600-9b57-405e-9956-b55291161700?source=api-prod","affected":[{"type":"plugin","slug":"ivysilani-shortcode","name":"iVysilani Shortcode","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:26Z","updated":"2026-03-21T03:26:38Z"},{"id":"wordfence:25ff4093-f8bf-41f8-b9d8-c15ecee71b43","source":"wordfence","cve":"CVE-2025-64245","title":"Import external attachments <= 1.5.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ff4093-f8bf-41f8-b9d8-c15ecee71b43?source=api-prod","affected":[{"type":"plugin","slug":"import-external-attachments","name":"Import external attachments","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T16:48:21Z"},{"id":"wordfence:25ff6cc3-02ed-470a-aa10-4843e1ec01ce","source":"wordfence","cve":"CVE-2024-13501","title":"WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25ff6cc3-02ed-470a-aa10-4843e1ec01ce?source=api-prod","affected":[{"type":"plugin","slug":"formassembly-web-forms","name":"WP-FormAssembly","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-02-17T15:41:39Z","updated":"2025-04-04T12:57:24Z"},{"id":"wordfence:260054fd-7cb2-438f-a5ec-0b72338627bc","source":"wordfence","cve":"CVE-2024-4899","title":"SEOPress <= 7.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/260054fd-7cb2-438f-a5ec-0b72338627bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.7.2","to_inclusive":true,"patched_in":"7.8"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-14T16:29:44Z"},{"id":"wordfence:26005f48-4114-42fe-a0f1-253f033b5876","source":"wordfence","cve":"CVE-2026-100143","title":"FluentCart <= 1.6.4 -  Unauthenticated Unauthorized Customer Account Access","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26005f48-4114-42fe-a0f1-253f033b5876?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T12:47:24Z"},{"id":"wordfence:260119d4-7373-4329-ab31-a3cb3a1500f3","source":"wordfence","cve":"CVE-2025-12696","title":"HelloLeads CRM Form Shortcode <= 1.0 - Missing Authorization to Unauthenticated Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/260119d4-7373-4329-ab31-a3cb3a1500f3?source=api-prod","affected":[{"type":"plugin","slug":"hls-crm-form-shortcode","name":"HelloLeads CRM Form Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-22T00:00:00Z","updated":"2025-12-19T20:27:51Z"},{"id":"wordfence:26050f70-7a10-4df5-acd5-1c9e7613bf2c","source":"wordfence","cve":"CVE-2023-7061","title":"Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26050f70-7a10-4df5-acd5-1c9e7613bf2c?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced-shortcode","name":"Advanced File Manager Shortcodes","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-31T19:40:06Z"},{"id":"wordfence:2608f894-88ed-4f34-a382-8eab7eaab2e7","source":"wordfence","cve":"CVE-2021-24934","title":"Visual CSS Style Editor <= 7.5.3 - Reflected Cross-Site Scripting via wyp_page_type parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2608f894-88ed-4f34-a382-8eab7eaab2e7?source=api-prod","affected":[{"type":"plugin","slug":"yellow-pencil-visual-theme-customizer","name":"Visual CSS Style Editor","from":"*","from_inclusive":true,"to":"7.5.3","to_inclusive":true,"patched_in":"7.5.4"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:260c8ee3-dac5-4ad7-ba77-2312160e9348","source":"wordfence","cve":"CVE-2026-15821","title":"SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/260c8ee3-dac5-4ad7-ba77-2312160e9348?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2026-07-23T19:02:55Z","updated":"2026-07-24T07:53:35Z"},{"id":"wordfence:260d1418-e489-43af-b28a-a44abf6b9f93","source":"wordfence","cve":"CVE-2024-51845","title":"Share Buttons \u2013 Social Media <= 1.0.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/260d1418-e489-43af-b28a-a44abf6b9f93?source=api-prod","affected":[{"type":"plugin","slug":"rich-web-share-button","name":"Share Buttons \u2013 Social Media","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:25:50Z"},{"id":"wordfence:260f805a-8022-40f7-a2f4-1bbbf81c1e8b","source":"wordfence","cve":"CVE-2025-67924","title":"Corpkit <= 2.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/260f805a-8022-40f7-a2f4-1bbbf81c1e8b?source=api-prod","affected":[{"type":"theme","slug":"corpkit","name":"Corpkit - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:20:43Z"},{"id":"wordfence:26100f1f-3224-486c-b4f9-7086d405a883","source":"wordfence","cve":"CVE-2026-11600","title":"Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26100f1f-3224-486c-b4f9-7086d405a883?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.26","to_inclusive":true,"patched_in":"1.4.27"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-02T05:35:01Z"},{"id":"wordfence:2611005b-9d7f-4f43-95e4-eb47d2af611b","source":"wordfence","cve":"CVE-2025-69036","title":"Tech Life CPT <= 16.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2611005b-9d7f-4f43-95e4-eb47d2af611b?source=api-prod","affected":[{"type":"plugin","slug":"techlife-cpt","name":"TechLife - Mobile, Tech & Electronics Repair Shop","from":"*","from_inclusive":true,"to":"16.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:52:43Z"},{"id":"wordfence:26110187-2d74-4c6e-9ca5-618015beaab4","source":"wordfence","cve":"CVE-2026-28159","title":"Service Finder Booking <= 6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26110187-2d74-4c6e-9ca5-618015beaab4?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:50:26Z"},{"id":"wordfence:2611fe3a-3991-4dda-80f5-50f00a216c53","source":"wordfence","cve":"CVE-2025-58946","title":"Vocal <= 1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2611fe3a-3991-4dda-80f5-50f00a216c53?source=api-prod","affected":[{"type":"theme","slug":"vocal","name":"Vocal - Singing & Voice Artist WordPress Theme","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:35:49Z"},{"id":"wordfence:2612dab2-a4fc-4434-a107-f2d28f1a1dc8","source":"wordfence","cve":"CVE-2025-26734","title":"Hester <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2612dab2-a4fc-4434-a107-f2d28f1a1dc8?source=api-prod","affected":[{"type":"theme","slug":"hester","name":"Hester","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T21:00:13Z"},{"id":"wordfence:2612f883-0275-4f68-aacf-f97c1df96230","source":"wordfence","cve":"CVE-2025-66058","title":"Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2612f883-0275-4f68-aacf-f97c1df96230?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.17","to_inclusive":true,"patched_in":"2.3.18"}],"published":"2025-10-04T00:00:00Z","updated":"2025-12-20T19:30:24Z"},{"id":"wordfence:26140315-04c7-4056-a570-865cd4ffe85e","source":"wordfence","cve":"","title":"Quiz and Survey Master <= 7.0.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26140315-04c7-4056-a570-865cd4ffe85e?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2020-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2614ca26-6efc-49f5-8cee-5b078721acc1","source":"wordfence","cve":"CVE-2023-48756","title":"JetBlocks For Elementor <= 1.3.8 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2614ca26-6efc-49f5-8cee-5b078721acc1?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.8.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26153183-45f1-4694-94ec-f547f1b99089","source":"wordfence","cve":"CVE-2024-49218","title":"Recently <= 1.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26153183-45f1-4694-94ec-f547f1b99089?source=api-prod","affected":[{"type":"plugin","slug":"recently-viewed-most-viewed-and-sold-products-for-woocommerce","name":"Recently \u2013 Viewed, Most Viewed and Sold Products for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:16:18Z"},{"id":"wordfence:2618ccde-2bb0-4cd4-b415-68a671507709","source":"wordfence","cve":"CVE-2026-1856","title":"Appointment Booking Calendar <= 1.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2618ccde-2bb0-4cd4-b415-68a671507709?source=api-prod","affected":[{"type":"plugin","slug":"creavi-booking-service","name":"Creavi Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-06-18T16:09:32Z","updated":"2026-06-19T04:31:31Z"},{"id":"wordfence:2618f6b2-bef7-42b8-bfbc-061dbc3e4789","source":"wordfence","cve":"CVE-2026-96897","title":"Optima Express 8.5.0 - 8.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2618f6b2-bef7-42b8-bfbc-061dbc3e4789?source=api-prod","affected":[{"type":"plugin","slug":"optima-express","name":"Optima Express IDX","from":"8.5.0","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":"8.7.6"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T20:11:37Z"},{"id":"wordfence:261a1bf0-a147-48c8-878e-f9b725ac74d8","source":"wordfence","cve":"CVE-2023-0722","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261a1bf0-a147-48c8-878e-f9b725ac74d8?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:261aad1e-43fc-4927-a97d-85a001863023","source":"wordfence","cve":"CVE-2026-1249","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261aad1e-43fc-4927-a97d-85a001863023?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"5.3","from_inclusive":true,"to":"5.10","to_inclusive":true,"patched_in":"5.11"}],"published":"2026-02-13T20:09:32Z","updated":"2026-02-14T08:26:51Z"},{"id":"wordfence:261b21b7-6bed-4df9-bbb6-f395c0fd4f22","source":"wordfence","cve":"CVE-2025-58810","title":"Simple Link List Widget <= 0.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261b21b7-6bed-4df9-bbb6-f395c0fd4f22?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-list-widget","name":"Simple Link List Widget","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:40:57Z"},{"id":"wordfence:261b5905-9194-40d3-99cb-1c7a832218dc","source":"wordfence","cve":"CVE-2022-0150","title":"WP Accessibility Helper  <= 0.6.0.6 - Reflected Cross-Site Scripting via wahi","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261b5905-9194-40d3-99cb-1c7a832218dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.0.7","to_inclusive":false,"patched_in":"0.6.0.7"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:261bf532-48aa-406f-ba28-2ca3ae919522","source":"wordfence","cve":"CVE-2024-11357","title":"Goodlayers Core <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261bf532-48aa-406f-ba28-2ca3ae919522?source=api-prod","affected":[{"type":"plugin","slug":"goodlayers-core","name":"Goodlayers Core","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2025-01-02T00:00:00Z","updated":"2025-01-08T20:11:18Z"},{"id":"wordfence:261d280b-60df-407c-9ad5-8fee77ca3070","source":"wordfence","cve":"CVE-2026-32454","title":"Avada Core < 5.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261d280b-60df-407c-9ad5-8fee77ca3070?source=api-prod","affected":[{"type":"plugin","slug":"fusion-core","name":"Avada Core","from":"*","from_inclusive":true,"to":"5.15.0","to_inclusive":false,"patched_in":"5.15.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:43:08Z"},{"id":"wordfence:261d6d44-8e3b-4715-96c0-1c42d08662fa","source":"wordfence","cve":"CVE-2026-24372","title":"Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261d6d44-8e3b-4715-96c0-1c42d08662fa?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-03-13T00:00:00Z","updated":"2026-03-19T15:37:39Z"},{"id":"wordfence:261f1522-7857-4414-8c4a-8a89bb433af9","source":"wordfence","cve":"CVE-2025-52812","title":"Domnoo <= 1.49 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/261f1522-7857-4414-8c4a-8a89bb433af9?source=api-prod","affected":[{"type":"theme","slug":"domnoo","name":"Domnoo - Pizza & Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.49","to_inclusive":true,"patched_in":"1.52.1"}],"published":"2025-06-25T00:00:00Z","updated":"2026-02-26T15:13:59Z"},{"id":"wordfence:2620da78-3d78-40c5-a125-09d93993cac8","source":"wordfence","cve":"CVE-2024-38727","title":"Seraphinite Post .DOCX Source <= 2.16.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2620da78-3d78-40c5-a125-09d93993cac8?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-post-docx-source","name":"Seraphinite Post .DOCX Source","from":"*","from_inclusive":true,"to":"2.16.9","to_inclusive":true,"patched_in":"2.16.10"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-19T13:52:27Z"},{"id":"wordfence:2621cb32-3753-42e7-8690-88c680bdf808","source":"wordfence","cve":"","title":"Paid Memberships Pro \u2013 Restrict Member Access to Content, Courses, Communities \u2013 Free or Paid Subscriptions <= 2.5.9.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2621cb32-3753-42e7-8690-88c680bdf808?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.5.10","to_inclusive":false,"patched_in":"2.5.10"}],"published":"2021-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2621d2f1-7ce3-4858-9633-080ef916d374","source":"wordfence","cve":"CVE-2024-33547","title":"WZone < 14.1.00 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2621d2f1-7ce3-4858-9633-080ef916d374?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.1.00","to_inclusive":false,"patched_in":"14.1.00"}],"published":"2024-04-25T00:00:00Z","updated":"2026-02-26T14:56:35Z"},{"id":"wordfence:26235bfb-4b06-4da9-88eb-dea16d371f16","source":"wordfence","cve":"CVE-2026-13605","title":"Photo Swipe <= 4.1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26235bfb-4b06-4da9-88eb-dea16d371f16?source=api-prod","affected":[{"type":"plugin","slug":"photo-swipe","name":"PhotoSwipe","from":"*","from_inclusive":true,"to":"4.1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-30T17:13:00Z"},{"id":"wordfence:26237984-d7b5-4a55-91f8-a2816f3d2e94","source":"wordfence","cve":"","title":"Accessibility <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scritping","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26237984-d7b5-4a55-91f8-a2816f3d2e94?source=api-prod","affected":[{"type":"plugin","slug":"accessibility","name":"Accessibility","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26253942-7948-4016-947d-8c98f01525ab","source":"wordfence","cve":"CVE-2024-32793","title":"Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26253942-7948-4016-947d-8c98f01525ab?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.10","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-08-02T18:33:03Z"},{"id":"wordfence:26255cd9-2361-4d17-8d1b-9bdadcc69043","source":"wordfence","cve":"CVE-2025-12979","title":"Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26255cd9-2361-4d17-8d1b-9bdadcc69043?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.24","to_inclusive":true,"patched_in":"2.11.25"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-13T03:27:37Z"},{"id":"wordfence:2626ad96-4346-4564-b6bd-0c226bd8dfd4","source":"wordfence","cve":"CVE-2026-15421","title":"Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2626ad96-4346-4564-b6bd-0c226bd8dfd4?source=api-prod","affected":[{"type":"plugin","slug":"sg-cachepress","name":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":true,"patched_in":"7.8.1"}],"published":"2026-08-18T13:17:17Z","updated":"2026-08-19T01:26:14Z"},{"id":"wordfence:2626db42-0047-4801-bbcb-e236440c1677","source":"wordfence","cve":"CVE-2024-32786","title":"Royal Elementor Addons <= 1.3.93 - Unauthenticated IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2626db42-0047-4801-bbcb-e236440c1677?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.93","to_inclusive":true,"patched_in":"1.3.95"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:59:49Z"},{"id":"wordfence:2627ac2b-25a8-480d-ac83-ee0ca323b3a1","source":"wordfence","cve":"CVE-2023-2604","title":"Team Circle Image Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2627ac2b-25a8-480d-ac83-ee0ca323b3a1?source=api-prod","affected":[{"type":"plugin","slug":"circle-image-slider-with-lightbox","name":"Team Circle Image Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26289a93-063b-469a-9d09-c286d76fce0c","source":"wordfence","cve":"CVE-2025-11564","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-10-24T16:53:49Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:2628b02e-5685-4e25-a786-4542ecbe874a","source":"wordfence","cve":"CVE-2022-1946","title":"Gallery \u2013 Image and Video Gallery with Thumbnails <= 1.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2628b02e-5685-4e25-a786-4542ecbe874a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2628f9dd-a020-49e6-bcea-f839e1d1a8a0","source":"wordfence","cve":"CVE-2021-27349","title":"Advanced Order Export for WooCommerce <= 3.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2628f9dd-a020-49e6-bcea-f839e1d1a8a0?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2021-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:262b5326-a5e6-4063-a345-59dedd14c3c2","source":"wordfence","cve":"CVE-2023-27419","title":"Viable blog <= 1.1.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262b5326-a5e6-4063-a345-59dedd14c3c2?source=api-prod","affected":[{"type":"theme","slug":"viable-blog","name":"Viable Blog","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:262d2ac0-81f7-4f1c-8ebf-7999849c15bc","source":"wordfence","cve":"CVE-2026-112834","title":"Seriously Simple Podcasting <= 3.17.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262d2ac0-81f7-4f1c-8ebf-7999849c15bc?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.17.0","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2026-10-20T14:53:00Z","updated":"2026-10-23T18:37:21Z"},{"id":"wordfence:262db9aa-0db5-48cd-a85b-3e6302e88a42","source":"wordfence","cve":"CVE-2023-5315","title":"Google Maps made Simple <= 0.6 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262db9aa-0db5-48cd-a85b-3e6302e88a42?source=api-prod","affected":[{"type":"plugin","slug":"wp-gmappity-easy-google-maps","name":"Google Maps made Simple","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:262dcea7-3ac4-43ee-90d7-91f200c3496c","source":"wordfence","cve":"CVE-2024-1213","title":"Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262dcea7-3ac4-43ee-90d7-91f200c3496c?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T23:33:50Z"},{"id":"wordfence:262e3bb3-bc83-4d0b-8056-9f94ec141b8f","source":"wordfence","cve":"CVE-2021-4449","title":"ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262e3bb3-bc83-4d0b-8056-9f94ec141b8f?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"5.96","to_inclusive":true,"patched_in":"6.05"}],"published":"2021-06-24T00:00:00Z","updated":"2025-07-09T15:03:34Z"},{"id":"wordfence:262f5d31-1c69-4d0c-a6e6-80acd36de52e","source":"wordfence","cve":"CVE-2025-52724","title":"Amwerk <= 1.2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262f5d31-1c69-4d0c-a6e6-80acd36de52e?source=api-prod","affected":[{"type":"theme","slug":"amwerk","name":"Amwerk - Industry & Corporate Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:44:23Z"},{"id":"wordfence:262f7690-97ce-40ca-a277-6871acbc1546","source":"wordfence","cve":"CVE-2024-32697","title":"HelloAsso <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/262f7690-97ce-40ca-a277-6871acbc1546?source=api-prod","affected":[{"type":"plugin","slug":"helloasso","name":"HelloAsso","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T12:39:44Z"},{"id":"wordfence:263029e3-68ef-416b-97f4-187647b9502d","source":"wordfence","cve":"CVE-2025-55716","title":"WP Statistics <= 14.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263029e3-68ef-416b-97f4-187647b9502d?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.15","to_inclusive":true,"patched_in":"14.15.2"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:41:52Z"},{"id":"wordfence:26305154-8346-42d7-b07d-2d027304edca","source":"wordfence","cve":"CVE-2026-103341","title":"Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26305154-8346-42d7-b07d-2d027304edca?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T12:26:00Z","updated":"2026-10-08T23:18:34Z"},{"id":"wordfence:2630b75d-eb3e-445d-96c9-f2e643b22d53","source":"wordfence","cve":"CVE-2026-94262","title":"Advanced Custom Fields: Extended  0.9.2.7 - Unauthenticated Arbitrary Non-Admin Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2630b75d-eb3e-445d-96c9-f2e643b22d53?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.9.2.7","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"},{"type":"plugin","slug":"acf-extended-pro","name":"Advanced Custom Fields: Extended PRO","from":"0.9.2.7","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:45:48Z"},{"id":"wordfence:2630dbfe-2e11-4671-9a75-377237ac1ea1","source":"wordfence","cve":"CVE-2023-0899","title":"Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2630dbfe-2e11-4671-9a75-377237ac1ea1?source=api-prod","affected":[{"type":"plugin","slug":"wp-shoutbox-live-chat","name":"Steveas WP Live Chat Shoutbox","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:263153c9-61c5-4df4-803b-8d274e2a5e35","source":"wordfence","cve":"CVE-2023-1344","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'uucss_update_rule'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263153c9-61c5-4df4-803b-8d274e2a5e35?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:263324cb-31b7-40ad-ad7d-4582e128cd75","source":"wordfence","cve":"CVE-2023-6327","title":"ShopLentor (formerly WooLentor)  <= 2.8.7 - Missing Authorization via purchased_new_products","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263324cb-31b7-40ad-ad7d-4582e128cd75?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-05-03T00:00:00Z","updated":"2024-07-29T21:36:02Z"},{"id":"wordfence:26337385-646f-4129-99be-7fa020f67f8e","source":"wordfence","cve":"CVE-2024-11937","title":"Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26337385-646f-4129-99be-7fa020f67f8e?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.69","to_inclusive":true,"patched_in":"4.10.70"}],"published":"2025-07-03T18:50:47Z","updated":"2025-07-04T07:22:19Z"},{"id":"wordfence:2636efe7-20c4-4d12-ab2f-45035e8a1ca0","source":"wordfence","cve":"CVE-2021-24763","title":"Perfect Survey <= 1.5.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2636efe7-20c4-4d12-ab2f-45035e8a1ca0?source=api-prod","affected":[{"type":"plugin","slug":"perfect-survey","name":"Perfect Survey","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2637df5d-ec6b-4d8f-9e83-3ff2e47eff6a","source":"wordfence","cve":"CVE-2026-121492","title":"Fiber Admin <= 4.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2637df5d-ec6b-4d8f-9e83-3ff2e47eff6a?source=api-prod","affected":[{"type":"plugin","slug":"fiber-admin","name":"Fiber Admin","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:42:51Z"},{"id":"wordfence:2637e273-a308-4033-be5a-2f778f8df282","source":"wordfence","cve":"","title":"Create Block Theme <= 1.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2637e273-a308-4033-be5a-2f778f8df282?source=api-prod","affected":[{"type":"plugin","slug":"create-block-theme","name":"Create Block Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2638bb80-7066-45c0-ab74-4ba407d50cae","source":"wordfence","cve":"CVE-2023-29197","title":"guzzlehttp/psr7 < 1.9.1 & 2.4.5 - Interpretation Conflict","severity":"medium","cvss":5.3,"cwe":"CWE-436","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2638bb80-7066-45c0-ab74-4ba407d50cae?source=api-prod","affected":[{"type":"plugin","slug":"wp-ses","name":"WP Offload SES Lite","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"},{"type":"plugin","slug":"amazon-s3-and-cloudfront","name":"WP Offload Media Lite for Amazon S3, DigitalOcean Spaces, and Google Cloud Storage","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26399541-a6a7-4c01-b72c-1ebf73f18c84","source":"wordfence","cve":"CVE-2016-10922","title":"Store Toolkit for WooCommerce <= 1.5.6 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26399541-a6a7-4c01-b72c-1ebf73f18c84?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-store-toolkit","name":"Store Toolkit \u2013  WooCommerce Extensions, Quick Enhancements & Handy Tools","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2016-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:263ac05d-f1ca-46e3-a43e-3b45eb8066d4","source":"wordfence","cve":"CVE-2026-15748","title":"Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263ac05d-f1ca-46e3-a43e-3b45eb8066d4?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.56.1","to_inclusive":true,"patched_in":"1.56.2"}],"published":"2026-08-17T16:39:51Z","updated":"2026-08-18T05:31:20Z"},{"id":"wordfence:263dd246-32ed-4efc-b7a6-ee6c9d305f89","source":"wordfence","cve":"CVE-2024-3925","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263dd246-32ed-4efc-b7a6-ee6c9d305f89?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2024-06-11T19:14:31Z","updated":"2024-08-08T15:29:11Z"},{"id":"wordfence:263f7a72-8887-42c3-a1df-3dee904f957e","source":"wordfence","cve":"CVE-2026-7456","title":"Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/263f7a72-8887-42c3-a1df-3dee904f957e?source=api-prod","affected":[{"type":"plugin","slug":"udimi-optin","name":"Udimi Tools","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-08-04T18:30:17Z","updated":"2026-08-05T13:26:41Z"},{"id":"wordfence:26404b5c-a0f2-4223-be61-1f03873666fb","source":"wordfence","cve":"CVE-2025-5692","title":"Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-leads-builder-any-crm","name":"Lead Form Data Collection to CRM","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-07-01T00:00:00Z","updated":"2025-08-27T13:46:54Z"},{"id":"wordfence:2640d1f8-958d-4556-919c-58df5bf15b40","source":"wordfence","cve":"CVE-2026-104915","title":"Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX \u2014 Attacker-Controlled course_id vs. Target comment_id","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2640d1f8-958d-4556-919c-58df5bf15b40?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-09T14:14:57Z","updated":"2026-10-10T02:26:32Z"},{"id":"wordfence:2645899c-2b6b-48bd-8f33-2a837a951c5e","source":"wordfence","cve":"CVE-2021-4387","title":"Opal Estate <= 1.6.11 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2645899c-2b6b-48bd-8f33-2a837a951c5e?source=api-prod","affected":[{"type":"plugin","slug":"opal-estate","name":"Opal Estate","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26481723-52f1-4914-bddd-ea175ce885d6","source":"wordfence","cve":"CVE-2024-3754","title":"Alemha Watermarker <= 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26481723-52f1-4914-bddd-ea175ce885d6?source=api-prod","affected":[{"type":"plugin","slug":"alemha-watermark","name":"Alemha watermarker","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:38:03Z"},{"id":"wordfence:264cb002-bf40-4cc2-9c21-cda9bb24f494","source":"wordfence","cve":"CVE-2025-6574","title":"Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":false,"patched_in":"6.1"}],"published":"2025-10-31T18:15:54Z","updated":"2025-11-01T06:40:37Z"},{"id":"wordfence:26501f4b-2599-4c08-89cb-6e4b4996b974","source":"wordfence","cve":"CVE-2026-73351","title":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26501f4b-2599-4c08-89cb-6e4b4996b974?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:44:47Z"},{"id":"wordfence:26529849-c52c-40e5-8085-6764c22a03e7","source":"wordfence","cve":"CVE-2023-23987","title":"User Registration <= 2.3.0  - Authenticated (Administrator+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26529849-c52c-40e5-8085-6764c22a03e7?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2652a7fc-b610-40f1-8b76-2129f59390ec","source":"wordfence","cve":"CVE-2024-0705","title":"Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2652a7fc-b610-40f1-8b76-2129f59390ec?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2024-01-18T00:00:00Z","updated":"2024-07-29T21:36:02Z"},{"id":"wordfence:2655ec9f-471f-48e7-8e1c-a428ef3b46ee","source":"wordfence","cve":"CVE-2015-5681","title":"Powerplay Gallery <= 3.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2655ec9f-471f-48e7-8e1c-a428ef3b46ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-powerplaygallery","name":"Powerplay Gallery","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2015-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2655f936-8177-4836-a0b0-1c637290a3bc","source":"wordfence","cve":"CVE-2026-3072","title":"Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2655f936-8177-4836-a0b0-1c637290a3bc?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.33","to_inclusive":true,"patched_in":"3.34"}],"published":"2026-03-04T16:31:21Z","updated":"2026-03-05T05:26:34Z"},{"id":"wordfence:2656ae60-0658-4230-99fc-9a754a4f61bf","source":"wordfence","cve":"CVE-2026-96743","title":"Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2656ae60-0658-4230-99fc-9a754a4f61bf?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-table-field","name":"Table Field Add-on for ACF and SCF","from":"*","from_inclusive":true,"to":"1.4.1-RC2","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-10-09T14:55:15Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:2656c2f8-802d-4626-bf79-a14d80bf79bf","source":"wordfence","cve":"CVE-2024-34796","title":"PopupAlly <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2656c2f8-802d-4626-bf79-a14d80bf79bf?source=api-prod","affected":[{"type":"plugin","slug":"popupally","name":"PopupAlly","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:03:28Z"},{"id":"wordfence:2657aa8a-b2de-4cb4-b9f8-e7fb0c887a7a","source":"wordfence","cve":"","title":"WooCommerce Affiliate Plugin \u2013 Coupon Affiliates < 4.11.3.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2657aa8a-b2de-4cb4-b9f8-e7fb0c887a7a?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"4.11.3.4","to_inclusive":false,"patched_in":"4.11.3.4"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2659d22f-3b54-4268-8618-b0c685278f6e","source":"wordfence","cve":"CVE-2022-47183","title":"Extra Block Design, Style, CSS for ANY Gutenberg Blocks <= 0.2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2659d22f-3b54-4268-8618-b0c685278f6e?source=api-prod","affected":[{"type":"plugin","slug":"stylist","name":"Extra Block Design, Style, CSS for ANY Gutenberg Blocks","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":"0.2.7"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:265be0af-66a4-4636-ab81-f8e2c5a1282e","source":"wordfence","cve":"CVE-2026-4484","title":"Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/265be0af-66a4-4636-ab81-f8e2c5a1282e?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-03-25T12:44:04Z","updated":"2026-03-27T10:28:48Z"},{"id":"wordfence:266032a8-a139-4a14-8eda-8be7a66357df","source":"wordfence","cve":"CVE-2024-10910","title":"Grid Plus \u2013 Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/266032a8-a139-4a14-8eda-8be7a66357df?source=api-prod","affected":[{"type":"plugin","slug":"grid-plus","name":"Grid Plus \u2013 Unlimited grid layout","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:38:37Z","updated":"2024-12-12T04:23:12Z"},{"id":"wordfence:2660e516-1b4b-42b9-91fa-46f3de5e6648","source":"wordfence","cve":"CVE-2026-81774","title":"Product Attachment for WooCommerce <= 2.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2660e516-1b4b-42b9-91fa-46f3de5e6648?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-attachment","name":"Product Attachment for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-09-01T00:00:00Z","updated":"2026-10-28T21:14:10Z"},{"id":"wordfence:26613503-40ca-4403-bde5-a155229e2b23","source":"wordfence","cve":"CVE-2026-94065","title":"ColorFolio <= 1.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26613503-40ca-4403-bde5-a155229e2b23?source=api-prod","affected":[{"type":"theme","slug":"colorit","name":"colorit","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:10:00Z"},{"id":"wordfence:26624f19-c943-417a-abb2-c05646b192cf","source":"wordfence","cve":"CVE-2021-39309","title":"Parsian Bank Gateway for Woocommerce <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26624f19-c943-417a-abb2-c05646b192cf?source=api-prod","affected":[{"type":"plugin","slug":"parsian-bank-gateway-for-woocommerce","name":"Parsian Bank Gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:266507cf-f458-47f8-b18a-81860e6cce3e","source":"wordfence","cve":"CVE-2024-30443","title":"GS Testimonial Slider <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/266507cf-f458-47f8-b18a-81860e6cce3e?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:34:33Z"},{"id":"wordfence:26654f89-38ae-480c-9851-08a6bf0f6d84","source":"wordfence","cve":"","title":"Houzez Theme - Functionality <= 4.1.2 - Authenticated (Subscriber+) Arbitrary File Download","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26654f89-38ae-480c-9851-08a6bf0f6d84?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T13:14:04Z"},{"id":"wordfence:2668ad2e-d7ae-47f2-90b1-5f9c31c8fee2","source":"wordfence","cve":"CVE-2025-31013","title":"Multiple Themify Themes <= Various Versions - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2668ad2e-d7ae-47f2-90b1-5f9c31c8fee2?source=api-prod","affected":[{"type":"theme","slug":"rezo","name":"rezo","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"shopo","name":"shopo","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"edmin","name":"edmin","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"folo","name":"Folo","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"newsy","name":"newsy","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"sidepane","name":"sidepane","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"slide","name":"slide","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"photobox","name":"photobox","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:00:35Z"},{"id":"wordfence:266b1004-a374-4770-9659-bac3d167b585","source":"wordfence","cve":"CVE-2022-0633","title":"UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/266b1004-a374-4770-9659-bac3d167b585?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"1.16.7","from_inclusive":true,"to":"1.22.3","to_inclusive":false,"patched_in":"1.22.3"},{"type":"plugin","slug":"updraftplus-pro","name":"UpdraftPlus WordPress Backup Plugin (Premium)","from":"*","from_inclusive":true,"to":"2.22.3","to_inclusive":false,"patched_in":"2.22.3"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:266bbcab-7d41-4c38-b136-24da61728977","source":"wordfence","cve":"CVE-2023-25476","title":"AmpedSense \u2013 AdSense Split Tester <= 4.68 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/266bbcab-7d41-4c38-b136-24da61728977?source=api-prod","affected":[{"type":"plugin","slug":"ampedsense-adsense-split-tester","name":"AmpedSense \u2013 AdSense Split Tester","from":"*","from_inclusive":true,"to":"4.68","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26705757-1d3f-4477-b99a-beb229cf36db","source":"wordfence","cve":"CVE-2024-35739","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26705757-1d3f-4477-b99a-beb229cf36db?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:20:44Z"},{"id":"wordfence:267119ab-4129-4c27-bfaf-0b9916623695","source":"wordfence","cve":"","title":"Feedweb <= 3.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267119ab-4129-4c27-bfaf-0b9916623695?source=api-prod","affected":[{"type":"plugin","slug":"feedweb","name":"Feedweb","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":"3.0.11"}],"published":"2015-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2672ce58-3358-4ae9-a2f9-0652012b6c2e","source":"wordfence","cve":"CVE-2025-49390","title":"Cookie Notice & Consent <= 1.6.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2672ce58-3358-4ae9-a2f9-0652012b6c2e?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-consent","name":"Cookie Notice & Consent","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-08-29T00:00:00Z","updated":"2025-11-11T18:37:46Z"},{"id":"wordfence:26753b92-3ec5-4b65-8fc7-2d6488f12974","source":"wordfence","cve":"CVE-2016-4566","title":"WordPress Core < 4.5.2 - Cross-Site Scripting via plupload.flash.swf","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26753b92-3ec5-4b65-8fc7-2d6488f12974?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.13","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.13","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"3.7.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"3.7.14"}],"published":"2016-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2675fa78-4236-4574-8c81-ff3bce11ff9d","source":"wordfence","cve":"CVE-2025-47448","title":"WP Hotel Booking <= 2.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2675fa78-4236-4574-8c81-ff3bce11ff9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:56:04Z"},{"id":"wordfence:267641fe-7490-4b8f-bb39-9531eefa2c30","source":"wordfence","cve":"CVE-2024-0438","title":"Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267641fe-7490-4b8f-bb39-9531eefa2c30?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2024-02-13T00:00:00Z","updated":"2024-07-29T21:36:02Z"},{"id":"wordfence:26766830-c772-46a3-a045-7bfbb530b50a","source":"wordfence","cve":"CVE-2014-125096","title":"Gallery Manager <= 1.5.12 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26766830-c772-46a3-a045-7bfbb530b50a?source=api-prod","affected":[{"type":"plugin","slug":"fancy-gallery","name":"Gallery Manager","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.5.13"}],"published":"2014-11-20T00:00:00Z","updated":"2024-02-07T14:27:37Z"},{"id":"wordfence:2677128e-6da2-4c5e-a8ee-17c290d72c8a","source":"wordfence","cve":"CVE-2026-33290","title":"WPGraphQL <= 2.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2677128e-6da2-4c5e-a8ee-17c290d72c8a?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.10"}],"published":"2026-03-24T00:00:00Z","updated":"2026-04-09T16:33:24Z"},{"id":"wordfence:2677cea6-d60d-4e10-afd7-e088a5592b19","source":"wordfence","cve":"CVE-2023-6120","title":"Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal","severity":"medium","cvss":4.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2677cea6-d60d-4e10-afd7-e088a5592b19?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"2.9.7"}],"published":"2023-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2678d2c6-055e-462e-99da-bdc81bcc3662","source":"wordfence","cve":"","title":"Affiliate Power \u2013 Sales Tracking for Affiliate Marketers <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2678d2c6-055e-462e-99da-bdc81bcc3662?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-power","name":"Affiliate Power \u2013 Sales Tracking for Affiliate Marketers","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:267acbd7-379c-4930-aa85-3071dfcac5a5","source":"wordfence","cve":"CVE-2026-19125","title":"EthPress <= 2.3.5 - Unauthenticated Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267acbd7-379c-4930-aa85-3071dfcac5a5?source=api-prod","affected":[{"type":"plugin","slug":"ethpress","name":"EthPress \u2013 Web3 Login","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-09-23T09:05:24Z","updated":"2026-09-23T21:27:40Z"},{"id":"wordfence:267c7c4b-3598-45d8-8b32-7266e8bee527","source":"wordfence","cve":"CVE-2025-58818","title":"Developer Tools Blocker <= 3.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267c7c4b-3598-45d8-8b32-7266e8bee527?source=api-prod","affected":[{"type":"plugin","slug":"swiftninjapro-inspect-element-console-blocker","name":"Developer Tools Blocker","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:19:40Z"},{"id":"wordfence:267d2b02-6365-4553-9809-bc3a8b070c7e","source":"wordfence","cve":"CVE-2022-1203","title":"Content Mask <= 1.8.4 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267d2b02-6365-4553-9809-bc3a8b070c7e?source=api-prod","affected":[{"type":"plugin","slug":"content-mask","name":"Content Mask","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.4.1"}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:268148ec-ab8a-4912-8250-1d40062b01a8","source":"wordfence","cve":"CVE-2026-73350","title":"SupportCandy \u2013 AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268148ec-ab8a-4912-8250-1d40062b01a8?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T21:00:10Z"},{"id":"wordfence:2685a2b4-aba3-425b-af0d-06f7693ab3d7","source":"wordfence","cve":"CVE-2025-2941","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2685a2b4-aba3-425b-af0d-06f7693ab3d7?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-04-04T18:15:16Z","updated":"2025-04-05T07:01:11Z"},{"id":"wordfence:2685c3e9-cb68-4d59-b7ef-ebe40419fb59","source":"wordfence","cve":"CVE-2025-28878","title":"Awesome Surveys <= 2.0.10 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2685c3e9-cb68-4d59-b7ef-ebe40419fb59?source=api-prod","affected":[{"type":"plugin","slug":"awesome-surveys","name":"Awesome Surveys","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:37:13Z"},{"id":"wordfence:268828b2-f660-452f-9d71-74bff3afc333","source":"wordfence","cve":"CVE-2024-37476","title":"Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268828b2-f660-452f-9d71-74bff3afc333?source=api-prod","affected":[{"type":"plugin","slug":"newspack-popups","name":"Newspack Campaigns","from":"*","from_inclusive":true,"to":"2.31.1","to_inclusive":true,"patched_in":"2.31.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:12:18Z"},{"id":"wordfence:268b77b9-af1d-41c8-9f24-99b60eb04cc4","source":"wordfence","cve":"","title":"ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268b77b9-af1d-41c8-9f24-99b60eb04cc4?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":false,"patched_in":"3.4.3"}],"published":"2019-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:268c20e4-0c4e-4fc1-867b-0940efe35de1","source":"wordfence","cve":"CVE-2026-15385","title":"RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268c20e4-0c4e-4fc1-867b-0940efe35de1?source=api-prod","affected":[{"type":"plugin","slug":"rt-mega-menu","name":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-15T21:15:49Z"},{"id":"wordfence:268f05d4-5f93-4d89-aa7f-c8731599dbc7","source":"wordfence","cve":"CVE-2026-110004","title":"wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268f05d4-5f93-4d89-aa7f-c8731599dbc7?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-11-06T20:57:52Z","updated":"2026-11-07T09:25:45Z"},{"id":"wordfence:268f2a1f-48f2-45a7-ac64-f1d674881ca3","source":"wordfence","cve":"CVE-2026-110976","title":"AI Engine <= 3.7.8 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268f2a1f-48f2-45a7-ac64-f1d674881ca3?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:40:37Z"},{"id":"wordfence:268f2ae1-5360-4ec5-bcd9-dc3ab11396dc","source":"wordfence","cve":"CVE-2026-9022","title":"Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/268f2ae1-5360-4ec5-bcd9-dc3ab11396dc?source=api-prod","affected":[{"type":"plugin","slug":"splide-carousel","name":"Splide Carousel Block","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-05-26T13:53:27Z","updated":"2026-05-27T02:27:37Z"},{"id":"wordfence:26926973-36b7-4ad2-8267-2de4749159ab","source":"wordfence","cve":"CVE-2021-24772","title":"Stream <= 3.8.1 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26926973-36b7-4ad2-8267-2de4749159ab?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2693ae37-790d-4b18-a9ec-054c8c27b8bc","source":"wordfence","cve":"CVE-2026-3296","title":"Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2026-04-07T11:35:53Z","updated":"2026-04-08T01:24:44Z"},{"id":"wordfence:2694747e-9423-475c-a3a8-d0afed9758ee","source":"wordfence","cve":"CVE-2026-28137","title":"MediCenter - Health Medical Clinic WordPress Theme <= 14.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2694747e-9423-475c-a3a8-d0afed9758ee?source=api-prod","affected":[{"type":"theme","slug":"medicenter","name":"MediCenter - Health Medical Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"14.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:35:25Z"},{"id":"wordfence:26963b32-db2c-430b-99e5-65a2cc7d478d","source":"wordfence","cve":"CVE-2024-37444","title":"Defender Security <= 4.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26963b32-db2c-430b-99e5-65a2cc7d478d?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:23:17Z"},{"id":"wordfence:269736bc-23a4-42f3-93f1-17fb4f732902","source":"wordfence","cve":"CVE-2026-112379","title":"Contact Form Email <= 1.3.68 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/269736bc-23a4-42f3-93f1-17fb4f732902?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.68","to_inclusive":true,"patched_in":"1.3.69"}],"published":"2026-10-20T06:52:49Z","updated":"2026-10-23T18:50:54Z"},{"id":"wordfence:2697a372-dd88-4532-bbcf-ff5f8dc5a73a","source":"wordfence","cve":"CVE-2025-32168","title":"Gutenify <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2697a372-dd88-4532-bbcf-ff5f8dc5a73a?source=api-prod","affected":[{"type":"plugin","slug":"gutenify","name":"Gutenify \u2013 Visual Site Builder Blocks & Starter Templates","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2025-04-04T00:00:00Z","updated":"2025-10-14T19:13:06Z"},{"id":"wordfence:269b0edd-2358-4a71-8fbe-de9a1c939807","source":"wordfence","cve":"CVE-2025-9333","title":"Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/269b0edd-2358-4a71-8fbe-de9a1c939807?source=api-prod","affected":[{"type":"plugin","slug":"smart-docs","name":"Smart Docs","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:34:00Z","updated":"2025-10-03T11:17:08Z"},{"id":"wordfence:269b9b66-c50f-4171-a8a8-ffb53742b527","source":"wordfence","cve":"CVE-2024-52342","title":"OS BXSlider <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/269b9b66-c50f-4171-a8a8-ffb53742b527?source=api-prod","affected":[{"type":"plugin","slug":"os-bxslider","name":"OS BXSlider","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:48:22Z"},{"id":"wordfence:269dd459-c857-49ed-b5d6-8c9e946ac590","source":"wordfence","cve":"CVE-2026-92551","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/269dd459-c857-49ed-b5d6-8c9e946ac590?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.4","to_inclusive":true,"patched_in":"4.17.5"}],"published":"2026-10-02T14:34:46Z","updated":"2026-10-03T03:25:44Z"},{"id":"wordfence:269e3b47-3775-41c1-9ed1-70c4177cbe8b","source":"wordfence","cve":"CVE-2025-24619","title":"WP Log Action <= 0.51 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/269e3b47-3775-41c1-9ed1-70c4177cbe8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-log-action","name":"WP Log Action","from":"*","from_inclusive":true,"to":"0.51","to_inclusive":true,"patched_in":"0.52"}],"published":"2024-12-10T00:00:00Z","updated":"2025-04-22T21:41:14Z"},{"id":"wordfence:26a246c3-cf67-4566-b1e8-dc14c3c5c827","source":"wordfence","cve":"CVE-2020-36740","title":"Radio Buttons for Taxonomies <= 2.0.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a246c3-cf67-4566-b1e8-dc14c3c5c827?source=api-prod","affected":[{"type":"plugin","slug":"radio-buttons-for-taxonomies","name":"Radio Buttons for Taxonomies","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":false,"patched_in":"2.0.6"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26a2a20e-f200-4cb1-aa15-db12c86dd351","source":"wordfence","cve":"CVE-2024-4857","title":"FS Product Inquiry <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a2a20e-f200-4cb1-aa15-db12c86dd351?source=api-prod","affected":[{"type":"plugin","slug":"fs-product-inquiry","name":"FS Product Inquiry","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-30T20:58:34Z"},{"id":"wordfence:26a34fd5-bfa2-4675-9451-ea742bd13fa3","source":"wordfence","cve":"CVE-2026-18884","title":"WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a34fd5-bfa2-4675-9451-ea742bd13fa3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-lottery","name":"WooCommerce Lottery","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T07:42:00Z"},{"id":"wordfence:26a7f3e9-de7b-43bd-8bb8-972b0df75324","source":"wordfence","cve":"CVE-2026-32546","title":"Membership Plugin \u2013 Restrict Content <= 3.2.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a7f3e9-de7b-43bd-8bb8-972b0df75324?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.23"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:44:43Z"},{"id":"wordfence:26a7fb51-f40d-46b8-9f52-495716032a1b","source":"wordfence","cve":"CVE-2024-13757","title":"Master Slider \u2013 Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a7fb51-f40d-46b8-9f52-495716032a1b?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.6","to_inclusive":true,"patched_in":"3.10.7"}],"published":"2025-03-04T21:15:33Z","updated":"2026-06-18T20:58:41Z"},{"id":"wordfence:26a82493-a6a5-4d8e-8322-942925a54cc3","source":"wordfence","cve":"CVE-2025-3780","title":"WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a82493-a6a5-4d8e-8322-942925a54cc3?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.16","to_inclusive":true,"patched_in":"6.7.17"}],"published":"2025-07-08T11:13:57Z","updated":"2025-07-08T23:22:48Z"},{"id":"wordfence:26a9bcc5-4057-4cd5-afde-68a2d467c5a9","source":"wordfence","cve":"CVE-2023-0541","title":"GS Books Showcase <= 1.3.0 - Authenticator (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26a9bcc5-4057-4cd5-afde-68a2d467c5a9?source=api-prod","affected":[{"type":"plugin","slug":"gs-books-showcase","name":"GS Books Showcase \u2013 Book Library, Book Grid & Book Slider for Authors","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26ab8551-ec47-40ab-8beb-2625cc20e735","source":"wordfence","cve":"CVE-2025-31037","title":"Homey <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ab8551-ec47-40ab-8beb-2625cc20e735?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:01:02Z"},{"id":"wordfence:26abf509-f0a9-4849-9028-d6c42832158f","source":"wordfence","cve":"CVE-2025-6379","title":"BeeTeam368 Extensions Pro <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26abf509-f0a9-4849-9028-d6c42832158f?source=api-prod","affected":[{"type":"plugin","slug":"beeteam368-extensions-pro","name":"BeeTeam368 Extensions Pro","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-06-27T14:30:51Z","updated":"2025-06-28T03:21:59Z"},{"id":"wordfence:26ac377f-c04d-4bc2-9238-3ae5c8d5b8ca","source":"wordfence","cve":"CVE-2025-10874","title":"Orbit Fox by ThemeIsle <= 3.0.1 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ac377f-c04d-4bc2-9238-3ae5c8d5b8ca?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-10-03T00:00:00Z","updated":"2025-10-29T15:49:43Z"},{"id":"wordfence:26aca1c0-e9ba-403e-bc07-3ae7ce10a348","source":"wordfence","cve":"CVE-2026-100509","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26aca1c0-e9ba-403e-bc07-3ae7ce10a348?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1225","to_inclusive":true,"patched_in":"4.1227"}],"published":"2026-10-03T17:30:56Z","updated":"2026-10-08T23:08:23Z"},{"id":"wordfence:26adbcdb-cba4-48ba-9160-e8ee97d95dbe","source":"wordfence","cve":"CVE-2026-54868","title":"FV Simpler SEO <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26adbcdb-cba4-48ba-9160-e8ee97d95dbe?source=api-prod","affected":[{"type":"plugin","slug":"fv-all-in-one-seo-pack","name":"FV Simpler SEO","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:33:11Z"},{"id":"wordfence:26add730-5421-45c9-9300-230b3da68e1d","source":"wordfence","cve":"CVE-2025-50043","title":"Code Engine <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26add730-5421-45c9-9300-230b3da68e1d?source=api-prod","affected":[{"type":"plugin","slug":"code-engine","name":"Code Engine \u2013 PHP Snippets, AI Functions & Automation for WordPress","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":"0.3.3"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T15:17:56Z"},{"id":"wordfence:26ae90f9-3efe-4ae4-b309-3af524a27828","source":"wordfence","cve":"CVE-2025-69331","title":"Theater for WordPress <= 0.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ae90f9-3efe-4ae4-b309-3af524a27828?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.19","to_inclusive":true,"patched_in":"0.19.1"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-14T14:42:07Z"},{"id":"wordfence:26b13067-540f-4ac2-904a-5c9e39622280","source":"wordfence","cve":"CVE-2026-61975","title":"JetReviews <= 3.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26b13067-540f-4ac2-904a-5c9e39622280?source=api-prod","affected":[{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-04T19:34:00Z"},{"id":"wordfence:26b1b899-37a2-44fd-b961-5e6175e0417f","source":"wordfence","cve":"CVE-2025-3432","title":"AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26b1b899-37a2-44fd-b961-5e6175e0417f?source=api-prod","affected":[{"type":"plugin","slug":"aawp-obfuscator","name":"AAWP Obfuscator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T08:22:08Z"},{"id":"wordfence:26b5c665-b7f6-4481-b9e9-010f9e451d9b","source":"wordfence","cve":"CVE-2023-23717","title":"Portfolio Slideshow <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26b5c665-b7f6-4481-b9e9-010f9e451d9b?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-slideshow","name":"Portfolio Slideshow","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26b64ae3-5839-47d5-9c65-7c595bb18e6c","source":"wordfence","cve":"CVE-2024-1771","title":"Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26b64ae3-5839-47d5-9c65-7c595bb18e6c?source=api-prod","affected":[{"type":"theme","slug":"total","name":"Total","from":"*","from_inclusive":true,"to":"2.1.59","to_inclusive":true,"patched_in":"2.1.60"}],"published":"2024-03-05T00:00:00Z","updated":"2024-10-24T19:22:23Z"},{"id":"wordfence:26b7438e-438b-41eb-9458-2fba8ab1964d","source":"wordfence","cve":"CVE-2023-1470","title":"eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26bca6c2-0999-4cf6-9c4e-ddaf528ef808","source":"wordfence","cve":"CVE-2026-92885","title":"Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26bca6c2-0999-4cf6-9c4e-ddaf528ef808?source=api-prod","affected":[{"type":"plugin","slug":"qode-membership","name":"Qode Membership","from":"*","from_inclusive":true,"to":"2.0.6.2","to_inclusive":true,"patched_in":"2.0.6.3"}],"published":"2026-10-26T20:13:22Z","updated":"2026-10-27T08:28:44Z"},{"id":"wordfence:26bd4058-ef00-48c8-8ab5-01535f0238a4","source":"wordfence","cve":"CVE-2024-0907","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26bd4058-ef00-48c8-8ab5-01535f0238a4?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-01T04:31:55Z"},{"id":"wordfence:26bfef74-214f-4257-afc7-730e82e80946","source":"wordfence","cve":"CVE-2024-0871","title":"Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26bfef74-214f-4257-afc7-730e82e80946?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.2","to_inclusive":true,"patched_in":"2.7.4.3"}],"published":"2024-02-20T00:00:00Z","updated":"2024-08-28T15:00:58Z"},{"id":"wordfence:26c17858-90b9-48ec-bb0c-7e797822dec5","source":"wordfence","cve":"CVE-2024-56006","title":"Jetpack Debug Tools <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c17858-90b9-48ec-bb0c-7e797822dec5?source=api-prod","affected":[{"type":"plugin","slug":"jetpack-debug-helper","name":"Jetpack Debug Helper","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-15T00:00:00Z","updated":"2025-05-20T19:54:06Z"},{"id":"wordfence:26c19bd3-32ea-4e28-9cde-1a6653acf6f1","source":"wordfence","cve":"CVE-2026-13459","title":"JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c19bd3-32ea-4e28-9cde-1a6653acf6f1?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.3.1"}],"published":"2026-07-01T19:57:13Z","updated":"2026-07-02T08:33:05Z"},{"id":"wordfence:26c4008a-9043-4293-aaf3-8e72de667ad8","source":"wordfence","cve":"CVE-2024-13595","title":"Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c4008a-9043-4293-aaf3-8e72de667ad8?source=api-prod","affected":[{"type":"plugin","slug":"simple-signup-form","name":"Simple Signup Form","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:47:11Z","updated":"2025-02-18T04:21:13Z"},{"id":"wordfence:26c63d73-6ce2-4b3a-b0d9-29f7d9b368d5","source":"wordfence","cve":"CVE-2026-12560","title":"Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c63d73-6ce2-4b3a-b0d9-29f7d9b368d5?source=api-prod","affected":[{"type":"plugin","slug":"editorial-rating","name":"Editorial Rating \u2013 Product Review & Rating System","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-06-29T16:17:48Z","updated":"2026-09-17T20:19:07Z"},{"id":"wordfence:26c75a0a-8590-4ac7-814e-29e0c2d0822e","source":"wordfence","cve":"CVE-2023-0420","title":"Custom Post Type and Taxonomy GUI Manager <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c75a0a-8590-4ac7-814e-29e0c2d0822e?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-cpt-cusom-taxonomy-ct-manager","name":"Custom Post Type and Taxonomy GUI Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26c78a0b-63d4-4971-b8d8-a83c975d261b","source":"wordfence","cve":"CVE-2024-34445","title":"SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Page Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c78a0b-63d4-4971-b8d8-a83c975d261b?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:21:48Z"},{"id":"wordfence:26c7be89-a83d-4912-aef5-4cc046b5d768","source":"wordfence","cve":"CVE-2022-2516","title":"Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26c7be89-a83d-4912-aef5-4cc046b5d768?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.0","to_inclusive":true,"patched_in":"45.0.1"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26cc2edd-c373-45a3-b3f1-cca6f702756c","source":"wordfence","cve":"CVE-2026-86779","title":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator < 4.0.6 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26cc2edd-c373-45a3-b3f1-cca6f702756c?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:36:04Z"},{"id":"wordfence:26ccf502-192b-4018-8876-d415c7fb27cc","source":"wordfence","cve":"CVE-2026-24957","title":"Strong Testimonials <= 3.2.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ccf502-192b-4018-8876-d415c7fb27cc?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.20","to_inclusive":true,"patched_in":"3.2.21"}],"published":"2025-12-28T00:00:00Z","updated":"2026-02-10T19:41:35Z"},{"id":"wordfence:26d12c52-d08f-4a6c-ba59-0e26dfb33ae5","source":"wordfence","cve":"CVE-2025-12032","title":"ZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d12c52-d08f-4a6c-ba59-0e26dfb33ae5?source=api-prod","affected":[{"type":"plugin","slug":"zweb-social-mobile","name":"Zweb Social Mobile \u2013 \u1ee8ng D\u1ee5ng N\u00fat G\u1ecdi Mobile","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:08:07Z","updated":"2025-11-25T07:28:21Z"},{"id":"wordfence:26d25f12-e7dd-4b30-859e-351aaaa9edff","source":"wordfence","cve":"CVE-2025-23569","title":"Shortcode in Comment <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d25f12-e7dd-4b30-859e-351aaaa9edff?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-in-comment","name":"Shortcode in Comment","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:36:50Z"},{"id":"wordfence:26d28cb4-3cbd-4baf-968a-a3d37693306f","source":"wordfence","cve":"CVE-2024-34806","title":"Clearfy Cache <= 2.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d28cb4-3cbd-4baf-968a-a3d37693306f?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2024-05-13T00:00:00Z","updated":"2025-04-10T15:00:28Z"},{"id":"wordfence:26d504fe-38f6-4b50-ae07-c50e35fcb9e0","source":"wordfence","cve":"CVE-2020-13644","title":"Accordion <= 2.2.8 - Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d504fe-38f6-4b50-ae07-c50e35fcb9e0?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2020-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26d70dee-c098-40f1-962a-db56791ae221","source":"wordfence","cve":"CVE-2024-25935","title":"RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d70dee-c098-40f1-962a-db56791ae221?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.5.9","to_inclusive":true,"patched_in":"5.2.6.0"}],"published":"2024-02-20T00:00:00Z","updated":"2024-05-07T20:17:09Z"},{"id":"wordfence:26d83a9d-3e51-450e-b3cb-7c53a4bcba60","source":"wordfence","cve":"CVE-2017-20247","title":"PICA Photo Gallery <= 1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d83a9d-3e51-450e-b3cb-7c53a4bcba60?source=api-prod","affected":[{"type":"plugin","slug":"pica-photo-gallery","name":"PICA Photo Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-09T00:00:00Z","updated":"2026-07-29T16:54:53Z"},{"id":"wordfence:26d8b75b-befa-4c6a-b072-0da44e437174","source":"wordfence","cve":"CVE-2023-4942","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d8b75b-befa-4c6a-b072-0da44e437174?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26d9dfc7-151c-4b32-9ae4-3085d08f137c","source":"wordfence","cve":"CVE-2023-48300","title":"Embed Privacy <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26d9dfc7-151c-4b32-9ae4-3085d08f137c?source=api-prod","affected":[{"type":"plugin","slug":"embed-privacy","name":"Embed Privacy","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26daa367-ef73-4ae0-843e-6d5366cc4ecd","source":"wordfence","cve":"CVE-2007-4893","title":"WordPress Core <= 2.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26daa367-ef73-4ae0-843e-6d5366cc4ecd?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"1.2.5a","to_inclusive":false,"patched_in":"1.2.5a"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26db2d25-01b8-49c5-a4d6-284780ac97bb","source":"wordfence","cve":"CVE-2024-0710","title":"GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26db2d25-01b8-49c5-a4d6-284780ac97bb?source=api-prod","affected":[{"type":"plugin","slug":"gp-unique-id","name":"GP Unique ID","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-04-10T00:00:00Z","updated":"2024-07-29T21:36:03Z"},{"id":"wordfence:26dc1696-6615-4eea-a800-cc4b527e9a59","source":"wordfence","cve":"CVE-2026-113616","title":"LogixFast Auth <= 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26dc1696-6615-4eea-a800-cc4b527e9a59?source=api-prod","affected":[{"type":"plugin","slug":"logixfast-auth","name":"LogixFast Auth","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:31:06Z"},{"id":"wordfence:26dd5972-2289-46dd-9740-e8c2adee90b8","source":"wordfence","cve":"CVE-2026-120837","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26dd5972-2289-46dd-9740-e8c2adee90b8?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-11-07T10:37:00Z","updated":"2026-11-10T19:37:55Z"},{"id":"wordfence:26dea1d5-31aa-47a8-927c-98391fbc9506","source":"wordfence","cve":"CVE-2025-46489","title":"Bulk Assign Linked Products For WooCommerce <= 2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26dea1d5-31aa-47a8-927c-98391fbc9506?source=api-prod","affected":[{"type":"plugin","slug":"wc-bulk-assign-linked-products","name":"Bulk Assign Linked Products For WooCommerce","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:45:47Z"},{"id":"wordfence:26decafa-2329-406a-a48b-f4e6867f60df","source":"wordfence","cve":"CVE-2024-3113","title":"FormFlow <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26decafa-2329-406a-a48b-f4e6867f60df?source=api-prod","affected":[{"type":"plugin","slug":"simple-form","name":"SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T13:38:39Z"},{"id":"wordfence:26df8fba-6185-42d1-b137-91cae2674a3e","source":"wordfence","cve":"CVE-2026-14206","title":"HT Contact Form <= 2.9.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26df8fba-6185-42d1-b137-91cae2674a3e?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-17T16:25:03Z"},{"id":"wordfence:26e07115-efee-4db5-ba24-25a063286e90","source":"wordfence","cve":"CVE-2024-24703","title":"MultiVendorX Marketplace <= 4.0.25 - Missing Authorization","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e07115-efee-4db5-ba24-25a063286e90?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.0.25","to_inclusive":true,"patched_in":"4.0.26"}],"published":"2024-01-31T00:00:00Z","updated":"2024-05-22T13:03:58Z"},{"id":"wordfence:26e16dd3-66bc-4174-acc1-ee22713ae979","source":"wordfence","cve":"CVE-2025-8072","title":"Target Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e16dd3-66bc-4174-acc1-ee22713ae979?source=api-prod","affected":[{"type":"plugin","slug":"brid-video-easy-publish","name":"Target Video Easy Publish","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2026-01-27T17:12:45Z","updated":"2026-01-28T05:30:17Z"},{"id":"wordfence:26e22e63-d2a6-4ee7-b574-e2979bacfb6a","source":"wordfence","cve":"CVE-2026-94264","title":"Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e22e63-d2a6-4ee7-b574-e2979bacfb6a?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.8.9.4","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"},{"type":"plugin","slug":"acf-extended-pro","name":"Advanced Custom Fields: Extended PRO","from":"0.8.9.4","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:51:32Z"},{"id":"wordfence:26e35c4a-79ec-4742-8004-1c799d2c56ff","source":"wordfence","cve":"CVE-2024-39638","title":"Registrations for the Events Calendar \u2013 Event Registration Plugin <= 2.12.2 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e35c4a-79ec-4742-8004-1c799d2c56ff?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2024-07-30T00:00:00Z","updated":"2024-08-28T23:23:10Z"},{"id":"wordfence:26e52072-9465-4b56-9794-f17861b7c70c","source":"wordfence","cve":"CVE-2023-46627","title":"WP Simple HTML Sitemap <= 2.2 - Reflected Cross-Site Scripting via id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e52072-9465-4b56-9794-f17861b7c70c?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26e7c3fa-7ae7-4343-8494-2955cb755c6d","source":"wordfence","cve":"","title":"WPtouch <= 3.7.5.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e7c3fa-7ae7-4343-8494-2955cb755c6d?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":false,"patched_in":"3.7.6"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26e7dd3f-5bdd-47d2-a013-82db72b4eae6","source":"wordfence","cve":"CVE-2024-31237","title":"s2Member <= 240315 - Limited Privilege Escalation","severity":"critical","cvss":9.1,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e7dd3f-5bdd-47d2-a013-82db72b4eae6?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"240315","to_inclusive":true,"patched_in":"240325"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-15T19:03:30Z"},{"id":"wordfence:26e8a66a-c0ea-498f-8713-7edc299daef3","source":"wordfence","cve":"CVE-2026-28008","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 7.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26e8a66a-c0ea-498f-8713-7edc299daef3?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-08-12T00:00:00Z","updated":"2026-09-17T15:44:34Z"},{"id":"wordfence:26ebbefa-01ff-48ca-be17-ca80e0de3b6c","source":"wordfence","cve":"CVE-2025-60182","title":"Support Board < 3.8.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ebbefa-01ff-48ca-be17-ca80e0de3b6c?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":false,"patched_in":"3.8.7"}],"published":"2025-07-31T00:00:00Z","updated":"2025-12-19T16:58:45Z"},{"id":"wordfence:26ed5016-48f7-44cf-af59-0c95a90bd473","source":"wordfence","cve":"CVE-2025-30816","title":"publish post email notification <= 1.0.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26ed5016-48f7-44cf-af59-0c95a90bd473?source=api-prod","affected":[{"type":"plugin","slug":"publish-post-email-notification","name":"wordpress publish post email notification","from":"*","from_inclusive":true,"to":"1.0.2.3","to_inclusive":true,"patched_in":"1.0.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:09:00Z"},{"id":"wordfence:26f2b999-30cd-4427-9275-d6e21efb9630","source":"wordfence","cve":"CVE-2024-54303","title":"Simple Payment <= 2.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f2b999-30cd-4427-9275-d6e21efb9630?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:55:01Z"},{"id":"wordfence:26f34aa0-8584-4156-b084-d34a0ab0a997","source":"wordfence","cve":"CVE-2026-8499","title":"Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-843","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f34aa0-8584-4156-b084-d34a0ab0a997?source=api-prod","affected":[{"type":"plugin","slug":"helpfulcrowd-product-reviews","name":"Helpfulcrowd Product Reviews","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-06-08T15:04:54Z","updated":"2026-07-09T19:35:22Z"},{"id":"wordfence:26f431e9-74e0-4920-8766-bf9703e620ee","source":"wordfence","cve":"CVE-2025-27298","title":"WP Video Posts <= 3.5.1 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f431e9-74e0-4920-8766-bf9703e620ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-posts","name":"WP Video Posts","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:44:53Z"},{"id":"wordfence:26f4e785-724b-41d3-b479-cb0150e70f9e","source":"wordfence","cve":"CVE-2022-45822","title":"Advanced Booking Calendar <= 1.7.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f4e785-724b-41d3-b479-cb0150e70f9e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26f73bfe-f41a-4045-9d72-21181a9a704f","source":"wordfence","cve":"CVE-2024-10533","title":"WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f73bfe-f41a-4045-9d72-21181a9a704f?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2024-11-15T15:25:18Z","updated":"2024-11-16T03:29:16Z"},{"id":"wordfence:26f8a133-c4a0-4c6c-a09e-47b81c65a731","source":"wordfence","cve":"CVE-2021-34656","title":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat <= 5.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26f8a133-c4a0-4c6c-a09e-47b81c65a731?source=api-prod","affected":[{"type":"plugin","slug":"webcam-2way-videochat","name":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:26fa0ed1-9c7f-4c16-b0d4-1d727bd46b0d","source":"wordfence","cve":"CVE-2026-105997","title":"Booking Package < 1.7.33 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26fa0ed1-9c7f-4c16-b0d4-1d727bd46b0d?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.33","to_inclusive":false,"patched_in":"1.7.33"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:19:39Z"},{"id":"wordfence:26fa1781-3919-41a4-9954-325bec856688","source":"wordfence","cve":"CVE-2025-64235","title":"Tuturn < 3.6 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26fa1781-3919-41a4-9954-325bec856688?source=api-prod","affected":[{"type":"plugin","slug":"tuturn","name":"Tuturn - Online Tutors Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2025-10-15T00:00:00Z","updated":"2025-12-20T19:13:41Z"},{"id":"wordfence:26fc1484-3435-4467-a74c-6ba5736be450","source":"wordfence","cve":"CVE-2024-10565","title":"Slider by 10Web <= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26fc1484-3435-4467-a74c-6ba5736be450?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.61","to_inclusive":true,"patched_in":"1.2.62"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-15T15:11:46Z"},{"id":"wordfence:26fe0b7b-dbf8-467f-b5e2-86a858eeaf89","source":"wordfence","cve":"CVE-2026-4076","title":"Slider Bootstrap Carousel <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/26fe0b7b-dbf8-467f-b5e2-86a858eeaf89?source=api-prod","affected":[{"type":"plugin","slug":"slider-bootstrap-carousel","name":"Slider Bootstrap Carousel","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:36Z","updated":"2026-04-22T07:45:32Z"},{"id":"wordfence:27026f0f-c85e-4409-9973-4b9cb8a90da5","source":"wordfence","cve":"CVE-2023-4372","title":"LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27026f0f-c85e-4409-9973-4b9cb8a90da5?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2702c285-b55d-40f0-a0d6-85b2e6f74eb7","source":"wordfence","cve":"CVE-2025-60066","title":"Katelyn <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2702c285-b55d-40f0-a0d6-85b2e6f74eb7?source=api-prod","affected":[{"type":"theme","slug":"katelyn","name":"Katelyn - Modern Blog Template Kit","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-12-20T21:07:38Z"},{"id":"wordfence:27051760-3c28-4e07-8c0f-2d054892da8f","source":"wordfence","cve":"CVE-2025-52751","title":"Slide Puzzle <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27051760-3c28-4e07-8c0f-2d054892da8f?source=api-prod","affected":[{"type":"plugin","slug":"slide-puzzle","name":"Slide Puzzle","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-10-29T21:05:11Z"},{"id":"wordfence:2710b445-4281-4055-be37-56902ae1d1b6","source":"wordfence","cve":"CVE-2025-32289","title":"Yozi <= 2.0.63 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2710b445-4281-4055-be37-56902ae1d1b6?source=api-prod","affected":[{"type":"theme","slug":"yozi","name":"Yozi - Multipurpose Electronics WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.63","to_inclusive":true,"patched_in":"2.0.66.1"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:10:42Z"},{"id":"wordfence:2713cd00-efd0-4a12-bf7b-2633289b3534","source":"wordfence","cve":"CVE-2024-37097","title":"Shortcodes by United Themes < 5.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2713cd00-efd0-4a12-bf7b-2633289b3534?source=api-prod","affected":[{"type":"plugin","slug":"ut-shortcodes","name":"Shortcodes by United Themes","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":false,"patched_in":"5.0.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T17:03:29Z"},{"id":"wordfence:27142a35-99e7-4bac-9cfd-c0ab12886eef","source":"wordfence","cve":"CVE-2025-23445","title":"Easy Tynt <= 0.2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27142a35-99e7-4bac-9cfd-c0ab12886eef?source=api-prod","affected":[{"type":"plugin","slug":"easy-tynt","name":"Easy Tynt","from":"*","from_inclusive":true,"to":"0.2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:56:23Z"},{"id":"wordfence:27153c13-6bdc-4873-8a05-8aab6ba4243d","source":"wordfence","cve":"CVE-2024-12701","title":"WP Smart Import : Import any XML File to WordPress <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27153c13-6bdc-4873-8a05-8aab6ba4243d?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-04T07:24:23Z"},{"id":"wordfence:27161b4b-d11c-487b-b1ce-7e43bf7b2e57","source":"wordfence","cve":"CVE-2022-47422","title":"Accept Stripe Donation \u2013 AidWP <= 3.1.5 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27161b4b-d11c-487b-b1ce-7e43bf7b2e57?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-donation","name":"AidWP \u2013 Donation & Payment Forms (Stripe Powered)","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27180d98-223a-4d86-b8ea-e47da1d61bbf","source":"wordfence","cve":"CVE-2023-25699","title":"Live Streaming - Broadcast Live Video <= 5.5.15 - Missing Authorization to Unauthenticated Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27180d98-223a-4d86-b8ea-e47da1d61bbf?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"5.5.15","to_inclusive":true,"patched_in":"5.5.16"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27186143-846a-4e04-bbd2-095caa898617","source":"wordfence","cve":"CVE-2025-46482","title":"WP Quiz <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27186143-846a-4e04-bbd2-095caa898617?source=api-prod","affected":[{"type":"plugin","slug":"wp-quiz","name":"Best Quiz Plugin for WordPress: WP Quiz","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:05:22Z"},{"id":"wordfence:2719739a-90dc-470b-9270-8578e0cead59","source":"wordfence","cve":"CVE-2025-13766","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2719739a-90dc-470b-9270-8578e0cead59?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":true,"patched_in":"3.7.7"}],"published":"2026-01-05T19:29:47Z","updated":"2026-01-06T08:21:49Z"},{"id":"wordfence:271a35fb-56b7-4d6b-bccc-fea1227d0913","source":"wordfence","cve":"CVE-2026-3596","title":"Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/271a35fb-56b7-4d6b-bccc-fea1227d0913?source=api-prod","affected":[{"type":"plugin","slug":"riaxe-product-customizer","name":"Riaxe Product Customizer","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T16:45:05Z","updated":"2026-04-16T05:29:52Z"},{"id":"wordfence:271a813d-1e20-4a9b-b4d0-6d73cc2866d4","source":"wordfence","cve":"CVE-2025-23924","title":"WP Photo Sphere <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/271a813d-1e20-4a9b-b4d0-6d73cc2866d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-sphere","name":"WP Photo Sphere","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:43:47Z"},{"id":"wordfence:271b151c-5646-4206-a7db-739ac36a9fdd","source":"wordfence","cve":"CVE-2024-50478","title":"1-Click Login: Passwordless Authentication  1.4.5 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/271b151c-5646-4206-a7db-739ac36a9fdd?source=api-prod","affected":[{"type":"plugin","slug":"swoop-password-free-authentication","name":"1-Click Login: Passwordless Authentication","from":"1.4.5","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:06:18Z"},{"id":"wordfence:271eb963-96dd-4bbf-81b9-d63c6ba4932e","source":"wordfence","cve":"CVE-2026-22415","title":"The Mounty | Hiking Campground & Children Camping WordPress Theme <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/271eb963-96dd-4bbf-81b9-d63c6ba4932e?source=api-prod","affected":[{"type":"theme","slug":"the-mounty","name":"The Mounty | Hiking Campground & Children Camping WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:40:52Z"},{"id":"wordfence:27205ad8-991f-4011-b1fd-759829acabd3","source":"wordfence","cve":"","title":"Essential Real Estate <= 3.9.6 - Reflected Cross-Site-Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27205ad8-991f-4011-b1fd-759829acabd3?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2720ab1d-b5ac-4f52-b0bb-3f166877dd52","source":"wordfence","cve":"CVE-2025-0687","title":"Spiritual Gifts Survey <= 0.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2720ab1d-b5ac-4f52-b0bb-3f166877dd52?source=api-prod","affected":[{"type":"plugin","slug":"spiritual-gifts-survey","name":"Spiritual Gifts Survey (and optional S.H.A.P.E survey)","from":"*","from_inclusive":true,"to":"0.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:26:36Z"},{"id":"wordfence:272515e3-18ae-4e7f-8503-722d7964b3c2","source":"wordfence","cve":"CVE-2022-4372","title":"Web Invoice <= 2.1.3 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272515e3-18ae-4e7f-8503-722d7964b3c2?source=api-prod","affected":[{"type":"plugin","slug":"web-invoice","name":"Web Invoice \u2013 Invoicing and billing for WordPress","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27254411-3ae7-4659-b3c1-1c18911e3bfb","source":"wordfence","cve":"CVE-2021-24718","title":"Contact Form, Survey & Popup Form Plugin for WordPress \u2013  ARForms Form Builder < 1.5 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27254411-3ae7-4659-b3c1-1c18911e3bfb?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2021-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2725df85-c24d-4570-95ca-0026e5f2ac90","source":"wordfence","cve":"CVE-2025-53421","title":"Accordion <= 2.3.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2725df85-c24d-4570-95ca-0026e5f2ac90?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2025-09-16T00:00:00Z","updated":"2025-11-04T18:21:22Z"},{"id":"wordfence:272746cd-0817-4dcb-8a4c-f1d84ed960b2","source":"wordfence","cve":"CVE-2024-6910","title":"EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272746cd-0817-4dcb-8a4c-f1d84ed960b2?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2024-08-19T00:00:00Z","updated":"2024-09-12T14:53:00Z"},{"id":"wordfence:27277b3d-b4f9-4d0c-a213-988a9b8fcd34","source":"wordfence","cve":"CVE-2022-2325","title":"Invitation Based Registrations <= 2.2.84 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27277b3d-b4f9-4d0c-a213-988a9b8fcd34?source=api-prod","affected":[{"type":"plugin","slug":"invitation-based-registrations","name":"Invitation Based Registrations","from":"*","from_inclusive":true,"to":"2.2.84","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27288836-e5d3-49fc-b1f6-319ea3b70839","source":"wordfence","cve":"CVE-2024-8066","title":"File Manager Pro \u2013 Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27288836-e5d3-49fc-b1f6-319ea3b70839?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2024-11-27T00:00:00Z","updated":"2025-01-04T01:01:44Z"},{"id":"wordfence:272a8ee4-8689-4935-89c5-e2f502621511","source":"wordfence","cve":"CVE-2026-111255","title":"affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272a8ee4-8689-4935-89c5-e2f502621511?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2026-10-27T14:56:57Z","updated":"2026-10-28T03:42:54Z"},{"id":"wordfence:272c6fbb-bc85-46d9-b139-87534b2a0842","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery via handleSubmitAction function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272c6fbb-bc85-46d9-b139-87534b2a0842?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:272c824a-0883-4c23-a814-bf0db3fec8a6","source":"wordfence","cve":"","title":"Grou Random Image Widget <= 1.18 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272c824a-0883-4c23-a814-bf0db3fec8a6?source=api-prod","affected":[{"type":"plugin","slug":"grou-random-image-widget","name":"Grou Random Image Widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:272fc51d-aadd-4991-a308-3df8b62c35ac","source":"wordfence","cve":"CVE-2025-49239","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272fc51d-aadd-4991-a308-3df8b62c35ac?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:05:52Z"},{"id":"wordfence:272fd463-8e81-4041-9ab8-b2770d698a5f","source":"wordfence","cve":"","title":"Profile & Dashboard fields <= 1.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/272fd463-8e81-4041-9ab8-b2770d698a5f?source=api-prod","affected":[{"type":"plugin","slug":"modify-profile-fields-dashboard-menu-buttons","name":"Profile & Dashboard fields [Modify/Disable/Remove]","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2730a090-e1ae-4fd5-9873-9a15dfc1efd9","source":"wordfence","cve":"CVE-2025-47496","title":"PublishPress Authors <= 4.7.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2730a090-e1ae-4fd5-9873-9a15dfc1efd9?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:45:31Z"},{"id":"wordfence:2731e8ed-27db-4d2b-b76f-8fdccfb2226a","source":"wordfence","cve":"CVE-2024-10017","title":"PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2731e8ed-27db-4d2b-b76f-8fdccfb2226a?source=api-prod","affected":[{"type":"plugin","slug":"pjw-mime-config","name":"PJW Mime Config","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:01:03Z","updated":"2024-11-16T03:20:44Z"},{"id":"wordfence:27332c13-c25f-47ec-980d-035fc35ce553","source":"wordfence","cve":"CVE-2026-1298","title":"Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27332c13-c25f-47ec-980d-035fc35ce553?source=api-prod","affected":[{"type":"plugin","slug":"easy-replace-image","name":"Easy Replace Image","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2026-01-27T17:10:48Z","updated":"2026-03-27T11:00:36Z"},{"id":"wordfence:27337cf2-18a0-4f26-a674-3ab2003b4838","source":"wordfence","cve":"","title":"WooCommerce Anti-Fraud <= 3.2 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27337cf2-18a0-4f26-a674-3ab2003b4838?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-anti-fraud","name":"WooCommerce Anti-Fraud","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2020-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2735f9a5-3f5b-4eac-a19a-59925c1fe1b5","source":"wordfence","cve":"CVE-2012-4327","title":"Image News Slider <= 3.2 - Unspecified Vulnerability","severity":"high","cvss":7.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2735f9a5-3f5b-4eac-a19a-59925c1fe1b5?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-news-slider","name":"Image News Slider","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2737f24e-acba-4d4b-897b-338a69a83d72","source":"wordfence","cve":"CVE-2025-58635","title":"Support Genix <= 1.4.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2737f24e-acba-4d4b-897b-338a69a83d72?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.23","to_inclusive":true,"patched_in":"1.4.24"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T21:36:12Z"},{"id":"wordfence:27384009-2ce4-4644-90b2-5f252a1cf2a5","source":"wordfence","cve":"CVE-2025-60186","title":"Google+ Comments <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27384009-2ce4-4644-90b2-5f252a1cf2a5?source=api-prod","affected":[{"type":"plugin","slug":"google-plus-comments","name":"Google+ Comments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:07:23Z"},{"id":"wordfence:27394b03-3604-4fb0-950f-e1f838cabb05","source":"wordfence","cve":"CVE-2026-7048","title":"Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27394b03-3604-4fb0-950f-e1f838cabb05?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.40","to_inclusive":true,"patched_in":"1.8.41"}],"published":"2026-05-27T19:36:32Z","updated":"2026-05-28T07:43:43Z"},{"id":"wordfence:273e25aa-4c00-4463-afc5-d8b2433af064","source":"wordfence","cve":"CVE-2026-7049","title":"PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/273e25aa-4c00-4463-afc5-d8b2433af064?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"12.5.0.1","to_inclusive":true,"patched_in":"12.5.0.2"}],"published":"2026-05-01T16:53:58Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:2741ec8c-7bd3-42f9-b964-4532216e1cea","source":"wordfence","cve":"CVE-2024-52495","title":"Distance Based Shipping Calculator <= 2.0.23 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2741ec8c-7bd3-42f9-b964-4532216e1cea?source=api-prod","affected":[{"type":"plugin","slug":"distance-based-shipping-calculator","name":"Distance Based Shipping Calculator","from":"*","from_inclusive":true,"to":"2.0.23","to_inclusive":true,"patched_in":"2.0.24"}],"published":"2024-11-20T00:00:00Z","updated":"2025-03-13T19:37:13Z"},{"id":"wordfence:2742cc47-8e3d-4fe4-b653-7310a4156a84","source":"wordfence","cve":"CVE-2024-50420","title":"aDirectory <= 1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2742cc47-8e3d-4fe4-b653-7310a4156a84?source=api-prod","affected":[{"type":"plugin","slug":"adirectory","name":"aDirectory \u2013 WP Business Directory Plugin and Classified Ads Listings Directory","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:14:24Z"},{"id":"wordfence:27439d44-f2ff-4c20-965f-25d12c83781c","source":"wordfence","cve":"CVE-2023-28989","title":"Happy Addons for Elementor <= 3.8.2 - Cross-Site Request Forgery via handle_optin_optout()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27439d44-f2ff-4c20-965f-25d12c83781c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:274429f7-1cd1-49e4-a145-dce36bebb9c2","source":"wordfence","cve":"CVE-2023-0766","title":"Newsletter Popup <= 1.2 - Cross-Site Request Forgery to Record Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/274429f7-1cd1-49e4-a145-dce36bebb9c2?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:274563e0-7480-460b-bd95-daa64ad45d83","source":"wordfence","cve":"CVE-2026-54197","title":"GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking <= 4.4.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/274563e0-7480-460b-bd95-daa64ad45d83?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-25T17:22:17Z"},{"id":"wordfence:2745a40c-b011-4fe5-b2f7-d97ee6972568","source":"wordfence","cve":"CVE-2025-4187","title":"UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read","severity":"medium","cvss":5.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2745a40c-b011-4fe5-b2f7-d97ee6972568?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:48:14Z","updated":"2025-06-14T08:23:23Z"},{"id":"wordfence:27478d23-961d-4a88-adf5-c3cdd79cc10c","source":"wordfence","cve":"CVE-2022-1255","title":"Import and export users and customers <= 1.19.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27478d23-961d-4a88-adf5-c3cdd79cc10c?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.19.2.1","to_inclusive":false,"patched_in":"1.19.2.1"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:274e5568-b600-4085-8406-9f9d5d4fc35a","source":"wordfence","cve":"","title":"Contact Form <= 3.82 - Authorization Bypass","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/274e5568-b600-4085-8406-9f9d5d4fc35a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.82","to_inclusive":true,"patched_in":"3.83"}],"published":"2015-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27506ce5-76ef-4c26-a88d-927d9a1a4d7d","source":"wordfence","cve":"CVE-2026-28045","title":"N7 | Golf Club Sports & Events <= 2.16.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27506ce5-76ef-4c26-a88d-927d9a1a4d7d?source=api-prod","affected":[{"type":"theme","slug":"n7-golf-club","name":"N7","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:04:47Z"},{"id":"wordfence:2750936e-d366-44f2-82d2-74188261466e","source":"wordfence","cve":"CVE-2026-39658","title":"Panda Pods Repeater Field <= 1.5.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2750936e-d366-44f2-82d2-74188261466e?source=api-prod","affected":[{"type":"plugin","slug":"panda-pods-repeater-field","name":"Panda Pods Repeater Field","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.5.13"}],"published":"2026-02-17T00:00:00Z","updated":"2026-06-01T20:21:14Z"},{"id":"wordfence:27517985-374a-40ef-8a90-575dfc9335f3","source":"wordfence","cve":"CVE-2025-66126","title":"Fix Media Library <= 2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27517985-374a-40ef-8a90-575dfc9335f3?source=api-prod","affected":[{"type":"plugin","slug":"wow-media-library-fix","name":"Fix Media Library","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T17:01:47Z"},{"id":"wordfence:275268d6-5b08-441d-9924-3c99682b27d4","source":"wordfence","cve":"CVE-2024-9209","title":"WP Search Analytics <= 1.4.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/275268d6-5b08-441d-9924-3c99682b27d4?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2024-09-30T19:40:09Z","updated":"2024-10-04T12:32:04Z"},{"id":"wordfence:2756dcf4-715f-4a7b-855c-7347455e0323","source":"wordfence","cve":"CVE-2024-34371","title":"Login with phone number <= 1.7.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2756dcf4-715f-4a7b-855c-7347455e0323?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":"1.7.20"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:15:23Z"},{"id":"wordfence:27574497-ca30-48ff-93ec-c430f5bfc689","source":"wordfence","cve":"CVE-2025-23888","title":"Custom Page Extensions <= 0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27574497-ca30-48ff-93ec-c430f5bfc689?source=api-prod","affected":[{"type":"plugin","slug":"custom-page-extensions","name":"Custom Page Extensions","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:27:24Z"},{"id":"wordfence:275812be-c931-4119-b0e4-2c45f71f5afc","source":"wordfence","cve":"CVE-2026-14211","title":"Amelia Pro <= 9.6 - Insecure Direct Object Reference to Authenticated (Provider+) Customer Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/275812be-c931-4119-b0e4-2c45f71f5afc?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":true,"patched_in":"9.7"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-17T16:40:40Z"},{"id":"wordfence:2760587c-78f5-40b1-affd-dfdfb2bc2a68","source":"wordfence","cve":"CVE-2022-27844","title":"Migration, Backup, Staging \u2013 WPvivid  <= 0.9.70 - Authenticated Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2760587c-78f5-40b1-affd-dfdfb2bc2a68?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.70","to_inclusive":true,"patched_in":"0.9.71"}],"published":"2022-04-07T10:08:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2760b183-3c15-4f0e-b72f-7c0333f9d4b6","source":"wordfence","cve":"CVE-2023-4947","title":"WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2760b183-3c15-4f0e-b72f-7c0333f9d4b6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ean-payment-gateway","name":"WooCommerce EAN Payment Gateway","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":false,"patched_in":"6.1.0"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2760ee88-b8fc-4390-a92a-829e3e9401d8","source":"wordfence","cve":"CVE-2025-58009","title":"CP Multi View Event Calendar  <= 1.4.36 - Missing Authorization","severity":"low","cvss":3.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2760ee88-b8fc-4390-a92a-829e3e9401d8?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.36","to_inclusive":true,"patched_in":"1.4.37"}],"published":"2025-09-22T00:00:00Z","updated":"2026-05-05T18:32:22Z"},{"id":"wordfence:27616d9e-c1eb-489f-ace7-76c0e5be2597","source":"wordfence","cve":"","title":"Formidable Form Builder < 2.05.03 - SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27616d9e-c1eb-489f-ace7-76c0e5be2597?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.05.03","to_inclusive":false,"patched_in":"2.05.03"}],"published":"2017-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2761c5e9-7c4c-4257-9b55-587c02d07153","source":"wordfence","cve":"CVE-2011-0701","title":"WordPress Core < 3.0.5 - Improper Authorization to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2761c5e9-7c4c-4257-9b55-587c02d07153?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2011-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27640d44-1474-416a-8efd-e9524f9d3c7f","source":"wordfence","cve":"CVE-2026-101335","title":"Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.1","to_inclusive":true,"patched_in":"1.58.2"}],"published":"2026-10-15T16:02:22Z","updated":"2026-10-16T04:26:59Z"},{"id":"wordfence:2764b360-228d-48c1-8a29-d3764e532799","source":"wordfence","cve":"CVE-2023-0713","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2764b360-228d-48c1-8a29-d3764e532799?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27657d29-e834-4f05-8fe9-7db0ab96f67d","source":"wordfence","cve":"CVE-2026-1821","title":"Microtango <= 0.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27657d29-e834-4f05-8fe9-7db0ab96f67d?source=api-prod","affected":[{"type":"plugin","slug":"microtango","name":"Microtango","from":"*","from_inclusive":true,"to":"0.9.29","to_inclusive":true,"patched_in":"0.9.30"}],"published":"2026-02-10T20:03:34Z","updated":"2026-02-12T16:49:23Z"},{"id":"wordfence:27661d88-9426-4d7e-8b59-98c88cc6120c","source":"wordfence","cve":"CVE-2026-102383","title":"Lookzy LookBook for WooCommerce <= 1.1.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27661d88-9426-4d7e-8b59-98c88cc6120c?source=api-prod","affected":[{"type":"plugin","slug":"woo-lookbook","name":"Lookzy LookBook for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2026-10-03T17:30:19Z","updated":"2026-10-08T23:11:39Z"},{"id":"wordfence:2766e8ee-ce19-40a9-8f53-d50ebe4f0ac9","source":"wordfence","cve":"CVE-2012-6630","title":"Media Library Categories <= 1.1.1 - Unauthenticated Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2766e8ee-ce19-40a9-8f53-d50ebe4f0ac9?source=api-prod","affected":[{"type":"plugin","slug":"media-library-categories","name":"Media Library Categories","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2767fcd9-dfc0-4dfa-83d0-b97c59c2cac2","source":"wordfence","cve":"","title":"CarSpot \u2013 Dealership Wordpress Classified Theme <= 2.2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2767fcd9-dfc0-4dfa-83d0-b97c59c2cac2?source=api-prod","affected":[{"type":"theme","slug":"carspot","name":"CarSpot \u2013 Dealership Wordpress Classified Theme","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2020-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2768f926-16a8-4a7e-a022-a8bd638e1081","source":"wordfence","cve":"CVE-2025-54697","title":"Kadence WooCommerce Email Designer <= 1.5.16 - Authenticated (Shop Manager+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2768f926-16a8-4a7e-a022-a8bd638e1081?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":true,"patched_in":"1.5.17"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:18:43Z"},{"id":"wordfence:27695dd6-b063-43fe-886f-ce76cfd838cb","source":"wordfence","cve":"CVE-2026-57766","title":"WPIDE \u2013 File Manager & Code Editor <= 3.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27695dd6-b063-43fe-886f-ce76cfd838cb?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:18:10Z"},{"id":"wordfence:276d46c7-0d56-4e32-91fd-9f214bde5447","source":"wordfence","cve":"CVE-2024-5199","title":"Spotify Play Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/276d46c7-0d56-4e32-91fd-9f214bde5447?source=api-prod","affected":[{"type":"plugin","slug":"spotify-play-button","name":"Spotify Play Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:51:48Z"},{"id":"wordfence:2771669b-ad17-4948-866d-0c3b63a6e545","source":"wordfence","cve":"CVE-2026-87837","title":"Wava Payment 0.3.1 - 0.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2771669b-ad17-4948-866d-0c3b63a6e545?source=api-prod","affected":[{"type":"plugin","slug":"wava-payment","name":"Wava Payment Plugin","from":"0.3.1","from_inclusive":true,"to":"0.3.9","to_inclusive":true,"patched_in":"0.3.10"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:43:32Z"},{"id":"wordfence:2771f9d4-429f-4691-a65c-073c3a3778fb","source":"wordfence","cve":"CVE-2025-11807","title":"Mixlr Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2771f9d4-429f-4691-a65c-073c3a3778fb?source=api-prod","affected":[{"type":"plugin","slug":"mixlr-shortcode","name":"Mixlr Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:23:59Z","updated":"2025-10-22T08:27:05Z"},{"id":"wordfence:2772cade-c625-437a-b57b-ce8a2e3393bf","source":"wordfence","cve":"CVE-2025-11161","title":"WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2772cade-c625-437a-b57b-ce8a2e3393bf?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.6.1","to_inclusive":true,"patched_in":"8.7"}],"published":"2025-10-14T17:32:20Z","updated":"2025-10-15T06:44:00Z"},{"id":"wordfence:2774e66c-2920-4578-9ab8-20d7dfd6bd6d","source":"wordfence","cve":"CVE-2024-12446","title":"Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2774e66c-2920-4578-9ab8-20d7dfd6bd6d?source=api-prod","affected":[{"type":"plugin","slug":"post-to-pdf","name":"PDF Generator for Posts & Pages \u2013 Export Any Post Type to PDF","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:15Z"},{"id":"wordfence:2777794d-2c0a-4843-bed8-78e607d4e796","source":"wordfence","cve":"CVE-2025-13959","title":"Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2777794d-2c0a-4843-bed8-78e607d4e796?source=api-prod","affected":[{"type":"plugin","slug":"filepicker-media-uploader","name":"Filestack","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T16:17:30Z","updated":"2026-02-18T04:35:42Z"},{"id":"wordfence:277942cb-f4ca-4197-8f61-2e0cb03115a6","source":"wordfence","cve":"","title":"Digital Publications by Supsystic <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277942cb-f4ca-4197-8f61-2e0cb03115a6?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2022-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27799988-cb2b-41c7-ad9a-aade59d31fa3","source":"wordfence","cve":"CVE-2023-45276","title":"Automated Editor <= 1.3 - Cross-Site Request Forgery via admin menu pages","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27799988-cb2b-41c7-ad9a-aade59d31fa3?source=api-prod","affected":[{"type":"plugin","slug":"automated-editor","name":"Automated Editor","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:277b8437-a215-445c-8257-b0ca3f36336d","source":"wordfence","cve":"CVE-2026-66703","title":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277b8437-a215-445c-8257-b0ca3f36336d?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.78.0","to_inclusive":true,"patched_in":"1.2.78.1"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:44:05Z"},{"id":"wordfence:277b9a34-8e0b-496e-b07b-602b25f125d8","source":"wordfence","cve":"CVE-2026-124969","title":"Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename","severity":"high","cvss":7.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277b9a34-8e0b-496e-b07b-602b25f125d8?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"4.2.20"}],"published":"2026-11-13T15:51:12Z","updated":"2026-11-13T15:51:12Z"},{"id":"wordfence:277d09b6-cc2a-41db-8b2d-1bad8e49c0db","source":"wordfence","cve":"CVE-2024-3903","title":"Add Custom CSS and JS <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277d09b6-cc2a-41db-8b2d-1bad8e49c0db?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-css-and-js","name":"Add Custom CSS and JS","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":""}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-16T12:35:15Z"},{"id":"wordfence:277eb517-c949-41e9-becf-af056fd32f35","source":"wordfence","cve":"CVE-2023-23674","title":"WP Original Media Path <= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277eb517-c949-41e9-becf-af056fd32f35?source=api-prod","affected":[{"type":"plugin","slug":"wp-original-media-path","name":"WP Original Media Path","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:277ee4f8-4b13-4a58-a4ea-28f639ecea5e","source":"wordfence","cve":"CVE-2017-18566","title":"User Role <= 1.5.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/277ee4f8-4b13-4a58-a4ea-28f639ecea5e?source=api-prod","affected":[{"type":"plugin","slug":"user-role","name":"User Role by BestWebSoft \u2013 Add and Customize Roles and Capabilities in WordPress","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2782f0f7-625d-4141-8e2c-4bdaa0219007","source":"wordfence","cve":"CVE-2026-109972","title":"s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2782f0f7-625d-4141-8e2c-4bdaa0219007?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"261011","to_inclusive":true,"patched_in":"261017"}],"published":"2026-10-27T17:42:33Z","updated":"2026-10-28T06:45:08Z"},{"id":"wordfence:2783f62a-3b9a-45e1-8e90-121732dc17ec","source":"wordfence","cve":"CVE-2026-48871","title":"MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2783f62a-3b9a-45e1-8e90-121732dc17ec?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:52:46Z"},{"id":"wordfence:27857a17-8cf0-40b3-894f-8dd7cf5108dd","source":"wordfence","cve":"CVE-2025-12413","title":"Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27857a17-8cf0-40b3-894f-8dd7cf5108dd?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-stop-words","name":"WPCF7 Stop words","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:34:39Z","updated":"2025-11-04T04:27:15Z"},{"id":"wordfence:2785a4e1-64f3-4b20-b0b3-7030bd88438c","source":"wordfence","cve":"CVE-2026-118194","title":"Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2785a4e1-64f3-4b20-b0b3-7030bd88438c?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-10-29T17:04:23Z","updated":"2026-10-30T05:35:51Z"},{"id":"wordfence:27885b7f-ef8c-45ea-995c-92cd1939e1c5","source":"wordfence","cve":"CVE-2022-3149","title":"WP Custom Cursors <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27885b7f-ef8c-45ea-995c-92cd1939e1c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:278ae6a0-7a94-48a8-a488-146e0d477dbb","source":"wordfence","cve":"CVE-2026-62101","title":"EduAdmin Booking <= 5.4.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278ae6a0-7a94-48a8-a488-146e0d477dbb?source=api-prod","affected":[{"type":"plugin","slug":"eduadmin-booking","name":"EduAdmin Booking","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:07:09Z"},{"id":"wordfence:278d22b7-fb13-4ee4-a462-ee86a289cbd4","source":"wordfence","cve":"CVE-2025-60172","title":"Flytedesk Digital <= 20181101 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278d22b7-fb13-4ee4-a462-ee86a289cbd4?source=api-prod","affected":[{"type":"plugin","slug":"flytedesk-digital","name":"Flytedesk Digital","from":"*","from_inclusive":true,"to":"20181101","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:09:15Z"},{"id":"wordfence:278d2d44-16e1-4560-9988-02d900443e42","source":"wordfence","cve":"CVE-2021-24595","title":"Wp Cookie Choice <= 1.1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278d2d44-16e1-4560-9988-02d900443e42?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookiechoise","name":"Wp Cookie Choice","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:278d7fa3-4ff5-4919-b9a4-e0149e9cae22","source":"wordfence","cve":"CVE-2025-64363","title":"Kleo < 5.5.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278d7fa3-4ff5-4919-b9a4-e0149e9cae22?source=api-prod","affected":[{"type":"theme","slug":"kleo","name":"kleo","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":false,"patched_in":"5.5.0"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-03T18:08:06Z"},{"id":"wordfence:278da117-fe04-45d6-86d4-e71fe6536032","source":"wordfence","cve":"CVE-2026-64638","title":"WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278da117-fe04-45d6-86d4-e71fe6536032?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:28:38Z"},{"id":"wordfence:278e6ffc-4253-4b8c-999c-5b21717cb229","source":"wordfence","cve":"CVE-2026-115302","title":"Contact Form by Supsystic <= 1.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/278e6ffc-4253-4b8c-999c-5b21717cb229?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T19:26:09Z"},{"id":"wordfence:2791bbd5-9101-4484-a352-0e4d2ce04e5d","source":"wordfence","cve":"CVE-2025-14461","title":"Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2791bbd5-9101-4484-a352-0e4d2ce04e5d?source=api-prod","affected":[{"type":"plugin","slug":"woo-xendit-virtual-accounts","name":"Xendit Payment","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2026-02-03T19:31:38Z","updated":"2026-02-16T21:54:25Z"},{"id":"wordfence:279314a4-2d70-4036-ae9a-27bb694b03db","source":"wordfence","cve":"CVE-2023-45753","title":"which template file <= 4.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279314a4-2d70-4036-ae9a-27bb694b03db?source=api-prod","affected":[{"type":"plugin","slug":"which-template-file","name":"which template file","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27941859-f784-4401-a233-9a58a6e52eb3","source":"wordfence","cve":"CVE-2025-30590","title":"Flickr set slideshows <= 0.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27941859-f784-4401-a233-9a58a6e52eb3?source=api-prod","affected":[{"type":"plugin","slug":"flickr-set-slideshows","name":"Flickr set slideshows","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:50:09Z"},{"id":"wordfence:27941af7-e796-4fa1-ad11-8bf8486ae49d","source":"wordfence","cve":"CVE-2026-88788","title":"Text Styler <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27941af7-e796-4fa1-ad11-8bf8486ae49d?source=api-prod","affected":[{"type":"plugin","slug":"text-styler","name":"Text Styler","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-23T13:55:36Z"},{"id":"wordfence:27945f52-7594-46f6-a760-2ee5dd094914","source":"wordfence","cve":"CVE-2024-2137","title":"All-in-One Addons for Elementor \u2013 WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27945f52-7594-46f6-a760-2ee5dd094914?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-07-01T15:43:57Z"},{"id":"wordfence:2794f688-bea1-462d-815c-4d050025e354","source":"wordfence","cve":"CVE-2026-25328","title":"Product File Upload for WooCommerce <= 2.2.4 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2794f688-bea1-462d-815c-4d050025e354?source=api-prod","affected":[{"type":"plugin","slug":"products-file-upload-for-woocommerce","name":"Product File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:59:25Z"},{"id":"wordfence:2796092a-d677-479a-aaad-74642aa9364e","source":"wordfence","cve":"CVE-2026-85004","title":"Popup Maker WP < 1.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2796092a-d677-479a-aaad-74642aa9364e?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker-wp","name":"Popup Maker \u2013 Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-28T21:14:48Z"},{"id":"wordfence:279877c9-17e1-4caa-98a7-ecd43ff17ca1","source":"wordfence","cve":"CVE-2025-23649","title":"Auphonic Importer <= 1.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279877c9-17e1-4caa-98a7-ecd43ff17ca1?source=api-prod","affected":[{"type":"plugin","slug":"auphonic-importer","name":"Auphonic Importer","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:38:50Z"},{"id":"wordfence:27988774-3f07-4497-a908-7a42d8bc20cc","source":"wordfence","cve":"CVE-2025-39573","title":"WP Posts Carousel <= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27988774-3f07-4497-a908-7a42d8bc20cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-carousel","name":"CCI Posts Carousel All In One","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:26:22Z"},{"id":"wordfence:279984d9-f352-467f-a53d-814466d70326","source":"wordfence","cve":"CVE-2026-4120","title":"Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279984d9-f352-467f-a53d-814466d70326?source=api-prod","affected":[{"type":"plugin","slug":"info-cards","name":"Info Cards \u2013 Add Text and Media in Card Layouts","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-19T06:46:15Z"},{"id":"wordfence:2799c74a-4ebf-4996-b681-08c32bf07114","source":"wordfence","cve":"CVE-2023-5108","title":"Easy Newsletter Signups <= 1.0.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2799c74a-4ebf-4996-b681-08c32bf07114?source=api-prod","affected":[{"type":"plugin","slug":"easy-newsletter-signups","name":"Easy Newsletter Signups","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2799ede9-1905-44b9-b731-ce5398d561b1","source":"wordfence","cve":"CVE-2021-24788","title":"Batch Cat <= 0.3 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2799ede9-1905-44b9-b731-ce5398d561b1?source=api-prod","affected":[{"type":"plugin","slug":"batch-cat","name":"Batch Cat","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:279a02e1-7b61-4edd-ab67-6a7fed4e17c1","source":"wordfence","cve":"CVE-2023-47236","title":"iPages Flipbook < 1.5.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279a02e1-7b61-4edd-ab67-6a7fed4e17c1?source=api-prod","affected":[{"type":"plugin","slug":"ipages-flipbook","name":"iPages \u2013 FlipBook Image & PDF Viewer","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:279a5460-25d1-4f80-8141-4d3af536258e","source":"wordfence","cve":"CVE-2023-3671","title":"MultiParcels Shipping For WooCommerce <= 1.15.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279a5460-25d1-4f80-8141-4d3af536258e?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.15.3","to_inclusive":true,"patched_in":"1.15.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:279cebb5-4be4-485a-92c7-e0bcc961f93e","source":"wordfence","cve":"CVE-2023-35045","title":"Fat Rat Collect <= 2.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279cebb5-4be4-485a-92c7-e0bcc961f93e?source=api-prod","affected":[{"type":"plugin","slug":"fat-rat-collect","name":"\u80d6\u9f20\u91c7\u96c6(Fat Rat Collect)","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:279e6990-3423-437b-b484-34e80240218e","source":"wordfence","cve":"CVE-2024-49671","title":"AI Image Generator for Your Content & Featured Images \u2013 AI Postpix <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279e6990-3423-437b-b484-34e80240218e?source=api-prod","affected":[{"type":"plugin","slug":"ai-postpix","name":"AI Image Generator for Your Content & Featured Images \u2013 AI Postpix","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.8.1"}],"published":"2024-10-21T00:00:00Z","updated":"2025-01-30T22:31:12Z"},{"id":"wordfence:279f2c7f-385d-4ff4-bc10-ce8be7e217f9","source":"wordfence","cve":"CVE-2026-24980","title":"Visionary Core <= 1.4.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/279f2c7f-385d-4ff4-bc10-ce8be7e217f9?source=api-prod","affected":[{"type":"plugin","slug":"noo-visionary-core","name":"Visionary Core","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-03-16T00:00:00Z","updated":"2026-05-05T14:47:20Z"},{"id":"wordfence:27a1f457-6bd9-41eb-83e1-cb9e62950041","source":"wordfence","cve":"CVE-2024-9071","title":"Easy Demo Importer \u2013 A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27a1f457-6bd9-41eb-83e1-cb9e62950041?source=api-prod","affected":[{"type":"plugin","slug":"easy-demo-importer","name":"Easy Demo Importer \u2013 A Modern One-Click Demo Import Solution","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-10-03T21:05:12Z","updated":"2024-10-04T09:30:41Z"},{"id":"wordfence:27a36e90-9678-4832-9f37-b54fe75f5571","source":"wordfence","cve":"CVE-2023-6591","title":"Popup Box Business (7.0.0 - 7.9.0)  and Developer (20.0.0 - 20.9.0)  - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27a36e90-9678-4832-9f37-b54fe75f5571?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box (Developer) \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"20.0.0","from_inclusive":true,"to":"20.9.0","to_inclusive":false,"patched_in":"20.9.0"},{"type":"plugin","slug":"ays-popup-box","name":"Popup Box (Business) \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"7.0.0","from_inclusive":true,"to":"7.9.0","to_inclusive":false,"patched_in":"7.9.0"}],"published":"2024-01-22T00:00:00Z","updated":"2024-08-06T12:49:41Z"},{"id":"wordfence:27a37c36-a2cf-4872-b1c4-f8bf61e3de30","source":"wordfence","cve":"CVE-2026-48972","title":"SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27a37c36-a2cf-4872-b1c4-f8bf61e3de30?source=api-prod","affected":[{"type":"plugin","slug":"seedprod-coming-soon-pro-5","name":"SeedProd Pro","from":"*","from_inclusive":true,"to":"6.19.5","to_inclusive":false,"patched_in":"6.19.5"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:12:15Z"},{"id":"wordfence:27a48196-60c5-45c4-8d60-c563183fab66","source":"wordfence","cve":"CVE-2024-47643","title":"Include Fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27a48196-60c5-45c4-8d60-c563183fab66?source=api-prod","affected":[{"type":"plugin","slug":"include-fussball-de-widgets","name":"Include Fussball.de Widgets","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:46:37Z"},{"id":"wordfence:27ac48a7-52ee-46cb-a6d0-efbd2b516445","source":"wordfence","cve":"CVE-2020-12074","title":"WebToffee Plugins <= (Various Versions) - Arbitrary User Creation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27ac48a7-52ee-46cb-a6d0-efbd2b516445?source=api-prod","affected":[{"type":"plugin","slug":"product-reviews-import-export-for-woocommerce","name":"Product Reviews Import Export for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"},{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":false,"patched_in":"2.1.11"},{"type":"plugin","slug":"order-xml-file-export-import-for-woocommerce","name":"Order XML File Export Import for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"xml-file-export-import-for-stampscom-and-woocommerce","name":"XML File Export Import for Stamps.com and WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"},{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2020-03-11T00:00:00Z","updated":"2024-06-17T17:10:55Z"},{"id":"wordfence:27b14c6e-44fe-4acb-8058-613f65b6baa4","source":"wordfence","cve":"CVE-2023-34015","title":"Advanced Flat rate shipping Woocommerce <= 1.6.4.4 - Cross-Site Request Forgery via enableDisable and deletePost","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b14c6e-44fe-4acb-8058-613f65b6baa4?source=api-prod","affected":[{"type":"plugin","slug":"advanced-free-flat-shipping-woocommerce","name":"PI Advanced Flat rate / Conditional shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.4.4","to_inclusive":true,"patched_in":"1.6.4.6"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27b2aded-87d4-4127-afd1-5573544d6aaa","source":"wordfence","cve":"CVE-2025-57986","title":"WP Subtitle <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b2aded-87d4-4127-afd1-5573544d6aaa?source=api-prod","affected":[{"type":"plugin","slug":"wp-subtitle","name":"WP Subtitle","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:25:40Z"},{"id":"wordfence:27b2d6d5-bd5b-4436-bec5-804cbb48abe1","source":"wordfence","cve":"CVE-2026-49054","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b2d6d5-bd5b-4436-bec5-804cbb48abe1?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":true,"patched_in":"7.9.3"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-08T16:14:40Z"},{"id":"wordfence:27b599af-f1f6-48af-90fe-4fc23b17a4ae","source":"wordfence","cve":"CVE-2023-22676","title":"Advanced Custom Fields: Image Crop Add-on <= 1.4.12 - Improper Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b599af-f1f6-48af-90fe-4fc23b17a4ae?source=api-prod","affected":[{"type":"plugin","slug":"acf-image-crop-add-on","name":"Advanced Custom Fields: Image Crop Add-on","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27b79fe6-11b8-40bf-88e6-2a2b0fc41ed8","source":"wordfence","cve":"CVE-2024-6134","title":"WP eStore <= 8.5.5 - Reflected Cross-Site Scripting via Product Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b79fe6-11b8-40bf-88e6-2a2b0fc41ed8?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2024-07-19T00:00:00Z","updated":"2024-08-12T12:48:35Z"},{"id":"wordfence:27b8e0c0-fb0b-4d36-abc4-3e66ec7b5195","source":"wordfence","cve":"CVE-2024-2868","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +12 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b8e0c0-fb0b-4d36-abc4-3e66ec7b5195?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2024-04-03T00:00:00Z","updated":"2024-05-31T15:30:11Z"},{"id":"wordfence:27b9ff55-f2b4-4713-a39d-6f57ee4c229b","source":"wordfence","cve":"CVE-2015-9474","title":"Simpolio - Fullscreen Portfolio & Blog HTML Theme <= 1.3.2 - Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27b9ff55-f2b4-4713-a39d-6f57ee4c229b?source=api-prod","affected":[{"type":"theme","slug":"simpolio","name":"Simpolio - Fullscreen Portfolio & Blog HTML Theme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2015-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27bb60c1-43fa-4a18-b9ca-059535b0d5b6","source":"wordfence","cve":"CVE-2026-4003","title":"Users manager \u2013 PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27bb60c1-43fa-4a18-b9ca-059535b0d5b6?source=api-prod","affected":[{"type":"plugin","slug":"userspn","name":"Users manager \u2013 PN","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2026-04-07T15:32:12Z","updated":"2026-04-08T03:36:08Z"},{"id":"wordfence:27be8c38-17f5-4a25-ba53-2a2544f5612a","source":"wordfence","cve":"CVE-2025-22824","title":"Live Flight Radar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27be8c38-17f5-4a25-ba53-2a2544f5612a?source=api-prod","affected":[{"type":"plugin","slug":"live-flight-radar","name":"Live Flight Radar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:59:42Z"},{"id":"wordfence:27bf9abc-b715-442e-9353-ec2154f658c1","source":"wordfence","cve":"CVE-2018-1002007","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27bf9abc-b715-442e-9353-ec2154f658c1?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27c3d563-4ed5-47a1-ae2c-ff765fb56cb7","source":"wordfence","cve":"CVE-2023-26011","title":"Read More Excerpt Link <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27c3d563-4ed5-47a1-ae2c-ff765fb56cb7?source=api-prod","affected":[{"type":"plugin","slug":"read-more-excerpt-link","name":"Read More Excerpt Link","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27c511d7-5b0d-4410-98ab-171232913160","source":"wordfence","cve":"CVE-2025-50003","title":"Amuli <= 2.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27c511d7-5b0d-4410-98ab-171232913160?source=api-prod","affected":[{"type":"theme","slug":"amuli","name":"Amuli | Property & Real Estate Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:22:56Z"},{"id":"wordfence:27c728eb-db40-41e1-b73b-243661b15970","source":"wordfence","cve":"CVE-2025-32593","title":"Add Product Frontend for WooCommerce <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27c728eb-db40-41e1-b73b-243661b15970?source=api-prod","affected":[{"type":"plugin","slug":"add-product-frontend-for-woocommerce","name":"Add Product Frontend for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-04-11T00:00:00Z","updated":"2026-09-09T15:51:50Z"},{"id":"wordfence:27ca0d04-9796-415f-a6e6-7c1752a74fea","source":"wordfence","cve":"CVE-2022-2594","title":"Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27ca0d04-9796-415f-a6e6-7c1752a74fea?source=api-prod","affected":[{"type":"plugin","slug":"beebee-mini","name":"Beebee Mini","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27ca93a1-3dfc-4bbd-834a-1c04d9e22ebf","source":"wordfence","cve":"CVE-2025-2568","title":"Vayu Blocks \u2013 Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27ca93a1-3dfc-4bbd-834a-1c04d9e22ebf?source=api-prod","affected":[{"type":"plugin","slug":"vayu-blocks","name":"Vayu Blocks \u2013 Website Builder for the Gutenberg Block Editor","from":"1.0.4","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T11:11:31Z"},{"id":"wordfence:27cc6931-086c-43a5-965b-2a19f15bb356","source":"wordfence","cve":"CVE-2024-11439","title":"ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27cc6931-086c-43a5-965b-2a19f15bb356?source=api-prod","affected":[{"type":"plugin","slug":"scancircle","name":"ScanCircle","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T02:08:58Z"},{"id":"wordfence:27cf5b20-7a08-4d79-a9dc-9cd0072154e8","source":"wordfence","cve":"CVE-2025-32539","title":"WooCommerce \u2013 Store Exporter <= 2.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27cf5b20-7a08-4d79-a9dc-9cd0072154e8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-23T13:40:13Z"},{"id":"wordfence:27cfa62d-ba16-4344-be0c-82cac4d21d1c","source":"wordfence","cve":"CVE-2026-109983","title":"YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27cfa62d-ba16-4344-be0c-82cac4d21d1c?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.12.19","to_inclusive":true,"patched_in":"3.12.20"}],"published":"2026-10-16T19:36:49Z","updated":"2026-10-17T07:51:25Z"},{"id":"wordfence:27cfd3cd-e622-4be7-af47-84324d6f6ea3","source":"wordfence","cve":"","title":"Analytify <= 4.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27cfd3cd-e622-4be7-af47-84324d6f6ea3?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27d0f627-aeee-46de-a319-861af00fdbf4","source":"wordfence","cve":"CVE-2021-25093","title":"Link Library <= 7.2.7 - Missing Authorization Checks","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27d0f627-aeee-46de-a319-861af00fdbf4?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2021-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27d25885-1a85-40a0-9759-3ae0c8d73d11","source":"wordfence","cve":"CVE-2022-3891","title":"WP FullCalendar <= 1.4.1 - Missing Authorization to Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27d25885-1a85-40a0-9759-3ae0c8d73d11?source=api-prod","affected":[{"type":"plugin","slug":"wp-fullcalendar","name":"WP FullCalendar","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27d26d1c-d027-4a22-af49-4d7684d36d40","source":"wordfence","cve":"CVE-2026-2568","title":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27d26d1c-d027-4a22-af49-4d7684d36d40?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zendesk","name":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-03-02T20:39:19Z","updated":"2026-03-03T09:24:12Z"},{"id":"wordfence:27d579d5-a4d2-45f7-a7bb-8f384d851d7a","source":"wordfence","cve":"CVE-2023-28419","title":"Force First and Last Name as Display Name <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27d579d5-a4d2-45f7-a7bb-8f384d851d7a?source=api-prod","affected":[{"type":"plugin","slug":"force-first-last","name":"Force First and Last Name as Display Name","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27d6503c-88c1-43b1-82aa-d14705d6bc17","source":"wordfence","cve":"CVE-2024-34562","title":"Move Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27d6503c-88c1-43b1-82aa-d14705d6bc17?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:59:02Z"},{"id":"wordfence:27da9458-ac19-4b4e-a14b-d1ba62e9e9ea","source":"wordfence","cve":"CVE-2022-4148","title":"WP OAuth Server <= 4.2.5 - Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client)","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27da9458-ac19-4b4e-a14b-d1ba62e9e9ea?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27dc105c-aada-4cbb-99ec-4e59d2dd7bbf","source":"wordfence","cve":"CVE-2025-24675","title":"WP Visitor Statistics (Real Time Traffic) <= 7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27dc105c-aada-4cbb-99ec-4e59d2dd7bbf?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:59:01Z"},{"id":"wordfence:27e0b9e8-b6b7-45fe-8c9e-5e49c4feccac","source":"wordfence","cve":"CVE-2024-30194","title":"Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e0b9e8-b6b7-45fe-8c9e-5e49c4feccac?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:06:25Z"},{"id":"wordfence:27e2848d-6271-4bb9-92e2-0f8c8860745d","source":"wordfence","cve":"CVE-2026-8623","title":"Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e2848d-6271-4bb9-92e2-0f8c8860745d?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.4.30","to_inclusive":true,"patched_in":"2.4.37"}],"published":"2026-09-04T17:15:20Z","updated":"2026-09-05T05:30:53Z"},{"id":"wordfence:27e3dfe3-ad33-4d0c-a999-d0734df2f59b","source":"wordfence","cve":"CVE-2026-4664","title":"Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e3dfe3-ad33-4d0c-a999-d0734df2f59b?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.103.0","to_inclusive":true,"patched_in":"5.104.0"}],"published":"2026-04-09T12:26:12Z","updated":"2026-04-10T01:24:57Z"},{"id":"wordfence:27e40af7-5697-4482-a96d-9216886c363b","source":"wordfence","cve":"CVE-2025-15368","title":"SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.26","to_inclusive":true,"patched_in":"2.7.27"}],"published":"2026-02-03T19:45:14Z","updated":"2026-02-06T17:24:38Z"},{"id":"wordfence:27e4d27f-b943-4cb3-b38a-01192844e9ac","source":"wordfence","cve":"CVE-2024-30464","title":"Social Icons Widget & Block by WPZOOM <= 4.2.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e4d27f-b943-4cb3-b38a-01192844e9ac?source=api-prod","affected":[{"type":"plugin","slug":"social-icons-widget-by-wpzoom","name":"WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat","from":"*","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"4.2.16"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:30:48Z"},{"id":"wordfence:27e4d519-bc98-44d3-a519-72674184e7f2","source":"wordfence","cve":"CVE-2024-2106","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e4d519-bc98-44d3-a519-72674184e7f2?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2024-03-06T00:00:00Z","updated":"2024-07-31T15:47:11Z"},{"id":"wordfence:27e7f9d1-a7c1-459b-996d-8fb02d3807cd","source":"wordfence","cve":"CVE-2025-23613","title":"WP Journal <= 1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e7f9d1-a7c1-459b-996d-8fb02d3807cd?source=api-prod","affected":[{"type":"plugin","slug":"wpjournal","name":"WP Journal","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T20:58:52Z"},{"id":"wordfence:27e85966-0fc7-4a28-bfc2-af62a1a56d0a","source":"wordfence","cve":"CVE-2025-49386","title":"Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e85966-0fc7-4a28-bfc2-af62a1a56d0a?source=api-prod","affected":[{"type":"plugin","slug":"preserve-code-formatting","name":"Preserve Code Formatting","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-08-01T00:00:00Z","updated":"2025-11-11T17:15:58Z"},{"id":"wordfence:27e9449a-637f-4ae3-bf48-587dc2f22397","source":"wordfence","cve":"CVE-2026-32505","title":"Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27e9449a-637f-4ae3-bf48-587dc2f22397?source=api-prod","affected":[{"type":"theme","slug":"kiddy","name":"Kiddy - Children WordPress theme","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-03-27T00:00:00Z","updated":"2026-03-27T18:47:20Z"},{"id":"wordfence:27eb0101-b3d1-458d-b7d7-69d92e3a4bb8","source":"wordfence","cve":"CVE-2023-25051","title":"Comment Reply Notification <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27eb0101-b3d1-458d-b7d7-69d92e3a4bb8?source=api-prod","affected":[{"type":"plugin","slug":"comment-reply-notification","name":"Comment Reply Notification","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27ec8f97-9b34-4737-bb45-37baf59598f1","source":"wordfence","cve":"CVE-2018-0579","title":"Open Graph and Twitter Card Tags < 2.2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27ec8f97-9b34-4737-bb45-37baf59598f1?source=api-prod","affected":[{"type":"plugin","slug":"wonderm00ns-simple-facebook-open-graph-tags","name":"Social Preview and Open Graph Tags","from":"*","from_inclusive":true,"to":"2.2.4.1","to_inclusive":false,"patched_in":"2.2.4.1"}],"published":"2018-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27eea04f-3f5f-4f13-9553-4fdea9be865b","source":"wordfence","cve":"CVE-2018-9118","title":"WP Background Takeover < 4.1.5 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27eea04f-3f5f-4f13-9553-4fdea9be865b?source=api-prod","affected":[{"type":"plugin","slug":"wpsite-background-takeover","name":"WP Background Takeover","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2018-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27f09e0e-ddd0-4440-9a58-a7fc60b49776","source":"wordfence","cve":"CVE-2021-24344","title":"Easy Preloader <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27f09e0e-ddd0-4440-9a58-a7fc60b49776?source=api-prod","affected":[{"type":"plugin","slug":"easy-preloader","name":"Easy Preloader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:27f7bfcc-b4bd-45d0-b75d-9d3264a173c7","source":"wordfence","cve":"CVE-2024-49246","title":"Ajax Rating with Custom Login <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27f7bfcc-b4bd-45d0-b75d-9d3264a173c7?source=api-prod","affected":[{"type":"plugin","slug":"ajax-rating-with-custom-login","name":"Ajax Rating with Custom Login","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:35:02Z"},{"id":"wordfence:27f8d694-52c9-4206-9426-ff27c4d4f5e0","source":"wordfence","cve":"CVE-2026-110377","title":"Bopo \u2013 WooCommerce Product Bundle Builder <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27f8d694-52c9-4206-9426-ff27c4d4f5e0?source=api-prod","affected":[{"type":"plugin","slug":"bopo-woo-product-bundle-builder","name":"Bopo \u2013 WooCommerce Product Bundle Builder","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-10-26T09:59:00Z","updated":"2026-10-28T01:15:10Z"},{"id":"wordfence:27f8ff1c-941e-495d-b26e-7eaf765191ef","source":"wordfence","cve":"CVE-2025-46476","title":"Awesome Wp Image Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27f8ff1c-941e-495d-b26e-7eaf765191ef?source=api-prod","affected":[{"type":"plugin","slug":"awesome-wp-image-gallery","name":"Awesome Wp Image Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:27:04Z"},{"id":"wordfence:27f90d97-c62f-4591-ba26-8d204d567687","source":"wordfence","cve":"CVE-2025-39495","title":"Avantage <= 2.4.9 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27f90d97-c62f-4591-ba26-8d204d567687?source=api-prod","affected":[{"type":"theme","slug":"avantage","name":"Avantage - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-05-20T00:00:00Z","updated":"2025-07-17T17:53:23Z"},{"id":"wordfence:27fc81b0-c03a-4de7-bc38-791401d1685b","source":"wordfence","cve":"CVE-2026-5357","title":"Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27fc81b0-c03a-4de7-bc38-791401d1685b?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.52","to_inclusive":true,"patched_in":"3.3.53"}],"published":"2026-04-08T13:33:28Z","updated":"2026-04-09T02:25:05Z"},{"id":"wordfence:28027f7a-295a-445a-be89-3d9125f2875b","source":"wordfence","cve":"CVE-2026-116410","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28027f7a-295a-445a-be89-3d9125f2875b?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:39:18Z"},{"id":"wordfence:2804c88e-895c-427a-8372-2ef794d9d136","source":"wordfence","cve":"CVE-2026-57756","title":"nicen-localize-image <= 1.4.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2804c88e-895c-427a-8372-2ef794d9d136?source=api-prod","affected":[{"type":"plugin","slug":"nicen-localize-image","name":"nicen-localize-image","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2026-06-27T00:00:00Z","updated":"2026-07-10T19:10:30Z"},{"id":"wordfence:2805267e-fd07-4bb2-b2e5-7c90c667097e","source":"wordfence","cve":"CVE-2021-39313","title":"Simple Image Gallery <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2805267e-fd07-4bb2-b2e5-7c90c667097e?source=api-prod","affected":[{"type":"plugin","slug":"simple-responsive-image-gallery","name":"Simple Image Gallery","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T12:43:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28062e5f-2a4c-419c-b0d1-3d91e72398e1","source":"wordfence","cve":"CVE-2026-13612","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28062e5f-2a4c-419c-b0d1-3d91e72398e1?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":false,"patched_in":"4.5.2"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T18:59:40Z"},{"id":"wordfence:28066511-a1e3-498d-a462-5e868334bfe1","source":"wordfence","cve":"CVE-2022-50960","title":"International Sms For Contact Form 7 Integration <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28066511-a1e3-498d-a462-5e868334bfe1?source=api-prod","affected":[{"type":"plugin","slug":"cf7-international-sms-integration","name":"International Sms For Contact Form 7 Integration","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-10T00:00:00Z","updated":"2026-07-29T21:14:53Z"},{"id":"wordfence:280871a2-f09f-4cd1-93f1-c804cda6b4e7","source":"wordfence","cve":"CVE-2024-32428","title":"MWW Disclaimer Buttons <= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280871a2-f09f-4cd1-93f1-c804cda6b4e7?source=api-prod","affected":[{"type":"plugin","slug":"mww-disclaimer-buttons","name":"MWW Disclaimer Buttons","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:28:04Z"},{"id":"wordfence:2809d55f-14f8-4916-800f-4d4fb9ee88c0","source":"wordfence","cve":"CVE-2021-34655","title":"WP Songbook <= 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2809d55f-14f8-4916-800f-4d4fb9ee88c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-songbook","name":"WP Songbook","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:280a5d6d-192a-43aa-927e-45c50b126463","source":"wordfence","cve":"CVE-2024-6363","title":"Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280a5d6d-192a-43aa-927e-45c50b126463?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.24.4","to_inclusive":true,"patched_in":"3.24.6"}],"published":"2024-06-28T18:15:28Z","updated":"2024-06-29T07:05:37Z"},{"id":"wordfence:280cd088-57eb-4c65-9bcd-682987f3cf8e","source":"wordfence","cve":"CVE-2025-15672","title":"ChamaWP \u2013 Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content < 1.0.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280cd088-57eb-4c65-9bcd-682987f3cf8e?source=api-prod","affected":[{"type":"plugin","slug":"chama","name":"ChamaWP \u2013 Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":false,"patched_in":"1.0.13"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:01:01Z"},{"id":"wordfence:280da91d-f97e-49ad-811d-849943c8a9f1","source":"wordfence","cve":"CVE-2025-68594","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280da91d-f97e-49ad-811d-849943c8a9f1?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.12.0","to_inclusive":true,"patched_in":"19.12.1"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-27T20:35:10Z"},{"id":"wordfence:280e1b4d-08be-4e77-abcb-5f9079111595","source":"wordfence","cve":"CVE-2024-7380","title":"Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280e1b4d-08be-4e77-abcb-5f9079111595?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"8.7.4"}],"published":"2024-09-04T21:33:52Z","updated":"2024-09-24T13:47:10Z"},{"id":"wordfence:280e9ba9-57a9-45ce-820c-c34cac41b350","source":"wordfence","cve":"CVE-2026-14842","title":"Events Made Easy <= 3.1.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280e9ba9-57a9-45ce-820c-c34cac41b350?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-07T00:00:00Z","updated":"2026-08-21T14:24:35Z"},{"id":"wordfence:280fdc81-db53-43b6-9675-887d576c4e0a","source":"wordfence","cve":"CVE-2025-47475","title":"JupiterX Core <= 4.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/280fdc81-db53-43b6-9675-887d576c4e0a?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"4.8.12"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:16:46Z"},{"id":"wordfence:28102544-3a33-4f15-af62-714e7dab42b7","source":"wordfence","cve":"CVE-2026-8702","title":"GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28102544-3a33-4f15-af62-714e7dab42b7?source=api-prod","affected":[{"type":"plugin","slug":"gbi-to-print","name":"GBI To Print","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:31Z","updated":"2026-05-27T05:31:21Z"},{"id":"wordfence:28114ca2-9730-4eb3-8977-a43c5b451e9b","source":"wordfence","cve":"CVE-2026-16576","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy < 5.0.14 - Authenticated (Shop Manager+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28114ca2-9730-4eb3-8977-a43c5b451e9b?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.14","to_inclusive":false,"patched_in":"5.0.14"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:54:07Z"},{"id":"wordfence:28126b4f-1cb6-4e91-b1c0-09f407d1dbf8","source":"wordfence","cve":"CVE-2024-9111","title":"Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28126b4f-1cb6-4e91-b1c0-09f407d1dbf8?source=api-prod","affected":[{"type":"plugin","slug":"product-designer","name":"PickPlugins Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":"1.0.37"}],"published":"2024-11-20T13:35:38Z","updated":"2024-12-13T17:05:36Z"},{"id":"wordfence:2812b31d-11c0-4efe-95e2-ea713293dad1","source":"wordfence","cve":"CVE-2021-24137","title":"Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2812b31d-11c0-4efe-95e2-ea713293dad1?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2020-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28174722-5936-47ea-9d7d-93da269bc26b","source":"wordfence","cve":"CVE-2026-57735","title":"Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28174722-5936-47ea-9d7d-93da269bc26b?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:32:57Z"},{"id":"wordfence:281a1c0e-bbd8-4cf6-94ca-b888c7d7e3af","source":"wordfence","cve":"CVE-2025-14146","title":"Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/281a1c0e-bbd8-4cf6-94ca-b888c7d7e3af?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.10","to_inclusive":true,"patched_in":"10.14.11"}],"published":"2026-01-08T19:08:54Z","updated":"2026-01-09T07:22:30Z"},{"id":"wordfence:281b654a-bb1b-40d6-b912-8cb28e9c35bf","source":"wordfence","cve":"CVE-2025-31562","title":"Uptime Robot Plugin for WordPress <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/281b654a-bb1b-40d6-b912-8cb28e9c35bf?source=api-prod","affected":[{"type":"plugin","slug":"uptime-robot-monitor","name":"Uptime Robot Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:32:33Z"},{"id":"wordfence:281c336e-7a1e-4106-ae79-b3b512b430ca","source":"wordfence","cve":"CVE-2024-56052","title":"WPLMS < 1.9.9.5.2 - Authenticated (Student+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/281c336e-7a1e-4106-ae79-b3b512b430ca?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.2","to_inclusive":false,"patched_in":"1.9.9.5.2"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:49:40Z"},{"id":"wordfence:281c49d3-078a-4fdc-9720-dac6b3a32892","source":"wordfence","cve":"","title":"Shortlink by BestWebSoft < 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/281c49d3-078a-4fdc-9720-dac6b3a32892?source=api-prod","affected":[{"type":"plugin","slug":"google-shortlink","name":"Shortlink by BestWebSoft","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:281ebead-5a30-4bfb-8280-94faf5d4fc14","source":"wordfence","cve":"CVE-2022-1599","title":"Admin Management Xtended <= 2.4.4 - Cross-Site Request Forgery to Post Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/281ebead-5a30-4bfb-8280-94faf5d4fc14?source=api-prod","affected":[{"type":"plugin","slug":"admin-management-xtended","name":"Admin Management Xtended","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":false,"patched_in":"2.4.5"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28206bc1-008f-407e-b1c9-e318abe09438","source":"wordfence","cve":"CVE-2026-25332","title":"Endless Posts Navigation <= 2.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28206bc1-008f-407e-b1c9-e318abe09438?source=api-prod","affected":[{"type":"plugin","slug":"endless-posts-navigation","name":"Endless Posts Navigation","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-02-07T00:00:00Z","updated":"2026-05-04T15:27:46Z"},{"id":"wordfence:28216197-20b4-4d12-a610-661dca6fbbf2","source":"wordfence","cve":"CVE-2024-10179","title":"Slickstream: Engagement and Conversions <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28216197-20b4-4d12-a610-661dca6fbbf2?source=api-prod","affected":[{"type":"plugin","slug":"slick-engagement","name":"Slickstream: Engagement and Conversions","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-11-11T18:17:57Z","updated":"2024-11-12T06:48:14Z"},{"id":"wordfence:2821d32e-386b-4d6a-8079-b6b184d1d266","source":"wordfence","cve":"CVE-2012-5325","title":"Shortcode Redirect <= 1.0.01 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2821d32e-386b-4d6a-8079-b6b184d1d266?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-redirect","name":"Shortcode Redirect","from":"*","from_inclusive":true,"to":"1.0.01","to_inclusive":true,"patched_in":"1.0.02"}],"published":"2012-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2822114a-ffc2-43dd-bbf1-e4504aababfb","source":"wordfence","cve":"CVE-2007-3639","title":"WordPress Core < 2.2.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2822114a-ffc2-43dd-bbf1-e4504aababfb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2007-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28223a8d-fa79-49a1-acfc-4c91b5150a62","source":"wordfence","cve":"CVE-2026-39783","title":"Polylang <= 3.8.7 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28223a8d-fa79-49a1-acfc-4c91b5150a62?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.8"}],"published":"2026-10-05T11:27:00Z","updated":"2026-10-08T23:30:25Z"},{"id":"wordfence:28246279-ecd8-4731-a4cc-64a3a4167323","source":"wordfence","cve":"CVE-2025-11758","title":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=api-prod","affected":[{"type":"plugin","slug":"aio-time-clock-lite","name":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-11-03T16:00:57Z","updated":"2025-11-04T14:21:42Z"},{"id":"wordfence:28252c89-a2db-441a-93e6-f051f3649fea","source":"wordfence","cve":"CVE-2025-12712","title":"Shouty <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28252c89-a2db-441a-93e6-f051f3649fea?source=api-prod","affected":[{"type":"plugin","slug":"shouty","name":"Shouty","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:21:10Z","updated":"2025-11-27T02:26:13Z"},{"id":"wordfence:28267144-a709-4631-8925-69c6e0aca77c","source":"wordfence","cve":"CVE-2024-11814","title":"Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28267144-a709-4631-8925-69c6e0aca77c?source=api-prod","affected":[{"type":"plugin","slug":"order-status-for-woocommerce","name":"Additional Custom Order Status for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-12-03T21:03:42Z","updated":"2024-12-04T09:24:21Z"},{"id":"wordfence:28286b89-0fcd-4616-8246-d8a19d632674","source":"wordfence","cve":"CVE-2013-2695","title":"WP Symposium < 13.04 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28286b89-0fcd-4616-8246-d8a19d632674?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"13.04","to_inclusive":false,"patched_in":"13.04"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2828d393-953a-4354-9032-687efda2df33","source":"wordfence","cve":"CVE-2026-10024","title":"TinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2828d393-953a-4354-9032-687efda2df33?source=api-prod","affected":[{"type":"plugin","slug":"360crest-themeone-tinymce-shortcodes","name":"TinyMCE shortcode Addon","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:07:16Z","updated":"2026-06-09T03:41:18Z"},{"id":"wordfence:282a26e8-4848-4e40-bfe5-fe2ba40f198e","source":"wordfence","cve":"CVE-2013-0735","title":"Mingle Forum <= 1.0.33.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/282a26e8-4848-4e40-bfe5-fe2ba40f198e?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.33.3","to_inclusive":true,"patched_in":"1.0.34"}],"published":"2013-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:282ef0bb-4db5-4b07-9aad-b128e8fdb915","source":"wordfence","cve":"CVE-2023-39162","title":"User Email Verification for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/282ef0bb-4db5-4b07-9aad-b128e8fdb915?source=api-prod","affected":[{"type":"plugin","slug":"woo-confirmation-email","name":"User Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:282fabde-c3a5-49d0-987a-39f106f766cf","source":"wordfence","cve":"CVE-2021-24444","title":"TaxoPress <= 3.0.7.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/282fabde-c3a5-49d0-987a-39f106f766cf?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.0.7.1","to_inclusive":true,"patched_in":"3.0.7.2"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2830c958-13d1-4c69-8dde-7fc091db02eb","source":"wordfence","cve":"CVE-2025-11725","title":"Aruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2830c958-13d1-4c69-8dde-7fc091db02eb?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-02-18T14:59:09Z","updated":"2026-02-19T03:25:11Z"},{"id":"wordfence:28333161-9c76-4108-9256-9ffa91eaf818","source":"wordfence","cve":"CVE-2017-18547","title":"Nelio AB Testing < 4.6.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28333161-9c76-4108-9256-9ffa91eaf818?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":false,"patched_in":"4.6.4"}],"published":"2017-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2837c9b2-419e-453a-b011-5ec1ef050d62","source":"wordfence","cve":"CVE-2024-5419","title":"Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2837c9b2-419e-453a-b011-5ec1ef050d62?source=api-prod","affected":[{"type":"plugin","slug":"cf7-widget-elementor","name":"Void Contact Form 7 Widget For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-07-01T15:08:51Z","updated":"2024-07-02T03:23:43Z"},{"id":"wordfence:283b10e6-61ae-4e1d-be7b-a63aece6ffda","source":"wordfence","cve":"CVE-2017-12199","title":"Ultimate Product Catalog <= 4.2.22 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/283b10e6-61ae-4e1d-be7b-a63aece6ffda?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.2.22","to_inclusive":true,"patched_in":"4.2.23"}],"published":"2017-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:283c2b7b-b231-4a23-96be-776115676443","source":"wordfence","cve":"CVE-2019-15769","title":"HandL UTM Grabber / Tracker <= 2.6.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/283c2b7b-b231-4a23-96be-776115676443?source=api-prod","affected":[{"type":"plugin","slug":"handl-utm-grabber","name":"HandL UTM Grabber / Tracker","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":false,"patched_in":"2.6.5"}],"published":"2019-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:283fb581-8b61-4008-a5c4-2e1490fab33e","source":"wordfence","cve":"CVE-2021-4446","title":"Essential Addons for Elementor <= 4.6.4 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2021-05-05T00:00:00Z","updated":"2024-10-16T06:43:25Z"},{"id":"wordfence:28432a54-5c0f-4a3e-8077-f7edb2e60aea","source":"wordfence","cve":"CVE-2026-85118","title":"AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28432a54-5c0f-4a3e-8077-f7edb2e60aea?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-generator-marketing","name":"AI Content Generator Marketing","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:13:23Z"},{"id":"wordfence:28438010-0801-45c6-bf03-86dc93830a12","source":"wordfence","cve":"CVE-2026-24563","title":"LifePress <= 2.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28438010-0801-45c6-bf03-86dc93830a12?source=api-prod","affected":[{"type":"plugin","slug":"lifepress","name":"LifePress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-01-22T00:00:00Z","updated":"2026-02-24T18:44:30Z"},{"id":"wordfence:28456329-03f3-4c33-92f5-e4076aa15345","source":"wordfence","cve":"CVE-2024-35773","title":"Comment Reply Email <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28456329-03f3-4c33-92f5-e4076aa15345?source=api-prod","affected":[{"type":"plugin","slug":"comment-reply-email","name":"Comment Reply Email","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:31:44Z"},{"id":"wordfence:28477bd5-a55f-4763-b7f2-86b0d9c92fd8","source":"wordfence","cve":"CVE-2025-22700","title":"Traveler Code <= 3.1.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28477bd5-a55f-4763-b7f2-86b0d9c92fd8?source=api-prod","affected":[{"type":"plugin","slug":"traveler-code","name":"Traveler Code","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-03-06T14:07:55Z"},{"id":"wordfence:284b9b04-aa8f-41ff-b944-3488c5da8e20","source":"wordfence","cve":"","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284b9b04-aa8f-41ff-b944-3488c5da8e20?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:284c5646-7728-45bd-9479-483c806ca804","source":"wordfence","cve":"CVE-2024-11865","title":"Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284c5646-7728-45bd-9479-483c806ca804?source=api-prod","affected":[{"type":"plugin","slug":"tabs-maker","name":"Tabs Maker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:53:59Z","updated":"2024-12-14T04:23:39Z"},{"id":"wordfence:284d72cd-8859-4704-9242-e28e592b0475","source":"wordfence","cve":"CVE-2025-30764","title":"Football Pool <= 2.12.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284d72cd-8859-4704-9242-e28e592b0475?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-22T20:10:33Z"},{"id":"wordfence:284daad9-d31e-4d29-ac15-ba293ba9640d","source":"wordfence","cve":"CVE-2024-4887","title":"Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284daad9-d31e-4d29-ac15-ba293ba9640d?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-06-06T15:08:52Z","updated":"2025-09-22T17:16:54Z"},{"id":"wordfence:284ea577-ff67-4681-995b-f7bb5ef0ff3e","source":"wordfence","cve":"CVE-2024-3728","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284ea577-ff67-4681-995b-f7bb5ef0ff3e?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.15","to_inclusive":true,"patched_in":"5.9.16"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:51:53Z"},{"id":"wordfence:284eafb9-94bc-4478-abff-f7dafd510a1d","source":"wordfence","cve":"CVE-2022-2317","title":"Simple Membership <= 4.1.2 -  Membership Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/284eafb9-94bc-4478-abff-f7dafd510a1d?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28509874-1544-41a6-b536-76db130816b7","source":"wordfence","cve":"CVE-2025-69007","title":"Popping Sidebars and Widgets Light <= 1.27 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28509874-1544-41a6-b536-76db130816b7?source=api-prod","affected":[{"type":"plugin","slug":"popping-sidebars-and-widgets-light","name":"Popping Sidebars and Widgets Light","from":"*","from_inclusive":true,"to":"1.27","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:03:18Z"},{"id":"wordfence:28512684-bf2c-44ac-bb90-82669f2375b8","source":"wordfence","cve":"CVE-2025-62904","title":"WP Geo <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28512684-bf2c-44ac-bb90-82669f2375b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-geo","name":"WP Geo","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2025-10-29T15:05:04Z"},{"id":"wordfence:2851ac4b-a50d-45cd-a472-540932b46d06","source":"wordfence","cve":"CVE-2026-81402","title":"DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2851ac4b-a50d-45cd-a472-540932b46d06?source=api-prod","affected":[{"type":"plugin","slug":"ds-adrotator","name":"DS Ad Rotator","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:56:39Z"},{"id":"wordfence:28524702-3428-4fca-afe8-71b3f2dd983d","source":"wordfence","cve":"CVE-2024-2200","title":"Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:39Z"},{"id":"wordfence:28548108-a004-4aeb-a0ad-269a73a71331","source":"wordfence","cve":"CVE-2025-11829","title":"Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28548108-a004-4aeb-a0ad-269a73a71331?source=api-prod","affected":[{"type":"plugin","slug":"five9","name":"Five9 Live Chat","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:25:23Z","updated":"2025-11-11T03:30:34Z"},{"id":"wordfence:2857e6c1-f6c4-46fb-9837-a6a6f5e48369","source":"wordfence","cve":"CVE-2024-3703","title":"Carousel Slider <= 2.2.9 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2857e6c1-f6c4-46fb-9837-a6a6f5e48369?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-12T13:14:40Z"},{"id":"wordfence:28585718-9678-48a0-bd70-338d9f20bee4","source":"wordfence","cve":"CVE-2025-62885","title":"VR <= 8.5.48 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28585718-9678-48a0-bd70-338d9f20bee4?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.48","to_inclusive":true,"patched_in":"8.5.49"}],"published":"2025-06-27T00:00:00Z","updated":"2025-12-12T16:23:06Z"},{"id":"wordfence:28594fe2-e789-4bb3-9085-791a1ebc8d14","source":"wordfence","cve":"CVE-2025-69141","title":"Kelly Young <= 1.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28594fe2-e789-4bb3-9085-791a1ebc8d14?source=api-prod","affected":[{"type":"theme","slug":"kelly-young","name":"Kelly Young","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:14:13Z"},{"id":"wordfence:285cbadb-16cd-4725-a2fb-643bf1b38914","source":"wordfence","cve":"CVE-2026-11794","title":"Advanced Form Integration <= 2.1.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/285cbadb-16cd-4725-a2fb-643bf1b38914?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-06-10T00:00:00Z","updated":"2026-08-21T13:58:19Z"},{"id":"wordfence:285d2b85-cdd0-4447-8cdc-b641751e4a5f","source":"wordfence","cve":"CVE-2024-23515","title":"Post Video Players <= 1.159 - Cross-Site Request Forgery via cincopa_mp_mt_options_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/285d2b85-cdd0-4447-8cdc-b641751e4a5f?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.159","to_inclusive":true,"patched_in":"1.160"}],"published":"2024-01-30T00:00:00Z","updated":"2024-03-25T17:08:59Z"},{"id":"wordfence:285f1b44-37bd-46ec-a386-634a0f9247c0","source":"wordfence","cve":"CVE-2026-105261","title":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1 - 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/285f1b44-37bd-46ec-a386-634a0f9247c0?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"4.10.1","from_inclusive":true,"to":"4.10.5","to_inclusive":true,"patched_in":"4.10.6"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:43:16Z"},{"id":"wordfence:28624634-9161-4da7-89f3-88ce1d38c3ea","source":"wordfence","cve":"","title":"404 to 301 <= 2.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28624634-9161-4da7-89f3-88ce1d38c3ea?source=api-prod","affected":[{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2016-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2862d7d6-4e27-4138-b4aa-789351edeac3","source":"wordfence","cve":"CVE-2025-60086","title":"Voting Contest <= 5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2862d7d6-4e27-4138-b4aa-789351edeac3?source=api-prod","affected":[{"type":"plugin","slug":"wp-voting-contest","name":"WP Voting Contest Lite","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-12-19T16:42:55Z"},{"id":"wordfence:28644121-5473-4af4-9df0-669345f5812d","source":"wordfence","cve":"CVE-2026-19225","title":"Defender Security \u2013 Malware Scanner, Login Security & Firewall < 6.2.0 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28644121-5473-4af4-9df0-669345f5812d?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":false,"patched_in":"6.2.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T21:00:50Z"},{"id":"wordfence:2866122e-158e-4a60-9f80-3d88832bedc0","source":"wordfence","cve":"CVE-2025-49236","title":"Raychat <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2866122e-158e-4a60-9f80-3d88832bedc0?source=api-prod","affected":[{"type":"plugin","slug":"raychat","name":"Raychat","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:11:50Z"},{"id":"wordfence:2869fffb-9211-48e7-b7e9-07fc98d1836a","source":"wordfence","cve":"CVE-2026-28183","title":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2869fffb-9211-48e7-b7e9-07fc98d1836a?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":true,"patched_in":"2.50.0"}],"published":"2026-08-05T11:57:00Z","updated":"2026-09-29T19:46:31Z"},{"id":"wordfence:286b3e24-bd13-4885-a57b-28e2bd71c407","source":"wordfence","cve":"CVE-2026-81762","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/286b3e24-bd13-4885-a57b-28e2bd71c407?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:36:16Z"},{"id":"wordfence:286b4dde-974d-4bb5-8a7e-57c849beaab1","source":"wordfence","cve":"CVE-2026-87741","title":"ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/286b4dde-974d-4bb5-8a7e-57c849beaab1?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-09-28T07:22:54Z","updated":"2026-09-28T19:50:22Z"},{"id":"wordfence:286c3e26-07a8-4fca-9fdc-98e62ae88b67","source":"wordfence","cve":"CVE-2023-7084","title":"Voting Record <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/286c3e26-07a8-4fca-9fdc-98e62ae88b67?source=api-prod","affected":[{"type":"plugin","slug":"voting-record","name":"Voting Record","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:286df83a-d723-4443-b265-f91cf5abb385","source":"wordfence","cve":"CVE-2024-7052","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.38.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/286df83a-d723-4443-b265-f91cf5abb385?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.38.2","to_inclusive":true,"patched_in":"1.38.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-02-21T19:26:37Z"},{"id":"wordfence:286e52b4-2694-4f3b-9d1d-fd1ebf1d1e50","source":"wordfence","cve":"CVE-2023-44474","title":"Tiger Forms <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/286e52b4-2694-4f3b-9d1d-fd1ebf1d1e50?source=api-prod","affected":[{"type":"plugin","slug":"tiger-form","name":"Tiger Forms \u2013 Drag and Drop Form Builder","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28713983-86ef-45d1-9258-d1a4feedcadd","source":"wordfence","cve":"CVE-2026-42758","title":"WebinarIgnition \u2013 Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28713983-86ef-45d1-9258-d1a4feedcadd?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"4.08.253","to_inclusive":false,"patched_in":"4.08.253"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-02T11:31:05Z"},{"id":"wordfence:2873543a-5f81-422e-a0c1-9e2e257c5a6f","source":"wordfence","cve":"CVE-2025-49437","title":"WP LOL Rotation <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2873543a-5f81-422e-a0c1-9e2e257c5a6f?source=api-prod","affected":[{"type":"plugin","slug":"league-of-legends-rotation","name":"WP LOL Rotation","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-29T00:00:00Z","updated":"2025-08-04T21:35:18Z"},{"id":"wordfence:28741ffc-4ff5-4e67-a183-bb5064b6752e","source":"wordfence","cve":"CVE-2024-3554","title":"All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28741ffc-4ff5-4e67-a183-bb5064b6752e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1.1"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-31T15:30:11Z"},{"id":"wordfence:28747e2e-9012-470c-a891-0fe97fd1ddba","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)","severity":"medium","cvss":5.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28747e2e-9012-470c-a891-0fe97fd1ddba?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:50:19Z"},{"id":"wordfence:2876064d-985a-4398-aa08-dd29c8437ae9","source":"wordfence","cve":"CVE-2025-49435","title":"Wp Easy Allopass <= 4.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2876064d-985a-4398-aa08-dd29c8437ae9?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-easy-allopass","name":"Wp Easy Allopass","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:07:29Z"},{"id":"wordfence:2878de45-0123-4e07-bfec-015b36b11d01","source":"wordfence","cve":"CVE-2024-5090","title":"SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2878de45-0123-4e07-bfec-015b36b11d01?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.61.1","to_inclusive":true,"patched_in":"1.62.0"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-11T02:01:55Z"},{"id":"wordfence:287a3f78-ae8c-485a-8a26-77013fe5e9b4","source":"wordfence","cve":"CVE-2025-39520","title":"Checkout Files Upload for WooCommerce <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287a3f78-ae8c-485a-8a26-77013fe5e9b4?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-25T14:58:10Z"},{"id":"wordfence:287abdef-24de-4e1b-a673-59cd37411bf6","source":"wordfence","cve":"CVE-2024-12414","title":"Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287abdef-24de-4e1b-a673-59cd37411bf6?source=api-prod","affected":[{"type":"plugin","slug":"themify-store-locator","name":"Themify Store Locator","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:49Z"},{"id":"wordfence:287bd483-13da-42e9-8fc3-79b800e49582","source":"wordfence","cve":"CVE-2024-35738","title":"Kognetiks Chatbot for WordPress <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287bd483-13da-42e9-8fc3-79b800e49582?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T14:08:50Z"},{"id":"wordfence:287c6cdc-f534-4b87-8a97-ee1e3666cd25","source":"wordfence","cve":"CVE-2022-0211","title":"Shield Security <= 13.0.5 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287c6cdc-f534-4b87-8a97-ee1e3666cd25?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"13.0.5","to_inclusive":true,"patched_in":"13.0.6"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:287d02ba-9cf0-446a-9393-036bd42b7aef","source":"wordfence","cve":"CVE-2025-22520","title":"Tock Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287d02ba-9cf0-446a-9393-036bd42b7aef?source=api-prod","affected":[{"type":"plugin","slug":"tock-widget","name":"Tock Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-15T15:03:03Z"},{"id":"wordfence:287d8e07-35f5-4df6-a764-529860453660","source":"wordfence","cve":"CVE-2026-28116","title":"Progress Planner <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/287d8e07-35f5-4df6-a764-529860453660?source=api-prod","affected":[{"type":"plugin","slug":"progress-planner","name":"Progress Planner","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:35:45Z"},{"id":"wordfence:2880cde0-a278-4a41-97f7-c54c2b3aceb2","source":"wordfence","cve":"CVE-2024-5614","title":"Piotnet Addons For Elementor <= 2.4.29 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2880cde0-a278-4a41-97f7-c54c2b3aceb2?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T11:13:36Z"},{"id":"wordfence:2881e144-a109-4034-afe8-2f72efd70360","source":"wordfence","cve":"CVE-2023-5082","title":"History Log by click5 <= 1.0.12 - Authenticated(Administrator+) Time-Based Blind SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2881e144-a109-4034-afe8-2f72efd70360?source=api-prod","affected":[{"type":"plugin","slug":"history-log-by-click5","name":"History Log by click5","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2023-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2882d9dd-0c73-4c9a-99cb-d10900503103","source":"wordfence","cve":"CVE-2024-4393","title":"Social Connect <= 1.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2882d9dd-0c73-4c9a-99cb-d10900503103?source=api-prod","affected":[{"type":"plugin","slug":"social-connect","name":"Social Connect","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-08T03:02:42Z"},{"id":"wordfence:288419ad-fbb2-4a4a-8a40-89ae024e068d","source":"wordfence","cve":"CVE-2025-13448","title":"CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288419ad-fbb2-4a4a-8a40-89ae024e068d?source=api-prod","affected":[{"type":"plugin","slug":"cssigniter-shortcodes","name":"CSSIgniter Shortcodes","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-12-02T14:20:18Z","updated":"2025-12-03T02:25:29Z"},{"id":"wordfence:288559f0-eab6-4933-a026-8413476af6eb","source":"wordfence","cve":"CVE-2023-2711","title":"Ultimate Product Catalog <= 5.2.5 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288559f0-eab6-4933-a026-8413476af6eb?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28868ab9-ee2a-4489-ad61-1a18caffead5","source":"wordfence","cve":"CVE-2025-60204","title":"WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28868ab9-ee2a-4489-ad61-1a18caffead5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-store-toolkit","name":"Store Toolkit \u2013  WooCommerce Extensions, Quick Enhancements & Handy Tools","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-07-15T00:00:00Z","updated":"2025-11-20T19:48:01Z"},{"id":"wordfence:288853b8-7523-472e-8406-257ffb3bd5ea","source":"wordfence","cve":"","title":"WP-FormAssembly <= 2.0.8 - Limited Server Side Request Forgery  via 'formassembly' shortcode","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288853b8-7523-472e-8406-257ffb3bd5ea?source=api-prod","affected":[{"type":"plugin","slug":"formassembly-web-forms","name":"WP-FormAssembly","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:288946ae-6e58-42e6-89d1-8951539728d3","source":"wordfence","cve":"CVE-2023-41664","title":"Easy Newsletter Signups <= 1.0.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288946ae-6e58-42e6-89d1-8951539728d3?source=api-prod","affected":[{"type":"plugin","slug":"easy-newsletter-signups","name":"Easy Newsletter Signups","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2889ac63-6644-436d-9805-1efc9048d69c","source":"wordfence","cve":"CVE-2025-47574","title":"School Management <= 92.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2889ac63-6644-436d-9805-1efc9048d69c?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T17:50:21Z"},{"id":"wordfence:288cd86b-8d13-46bf-99ef-76698cd62a41","source":"wordfence","cve":"CVE-2026-1319","title":"Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288cd86b-8d13-46bf-99ef-76698cd62a41?source=api-prod","affected":[{"type":"plugin","slug":"robin-image-optimizer","name":"Robin Image Optimizer \u2013 Unlimited Image Optimization, WebP & AVIF","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-02-04T19:32:21Z","updated":"2026-02-05T08:25:46Z"},{"id":"wordfence:288db6ba-5d6c-448d-85c5-f9a19a9391c0","source":"wordfence","cve":"CVE-2023-47182","title":"Login Screen Manager <= 3.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288db6ba-5d6c-448d-85c5-f9a19a9391c0?source=api-prod","affected":[{"type":"plugin","slug":"login-screen-manager","name":"Login Screen Manager","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-31T00:00:00Z","updated":"2024-09-12T14:51:06Z"},{"id":"wordfence:288fdb71-1dae-4897-b5af-95c628fce288","source":"wordfence","cve":"","title":"StoryChief <= 1.0.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/288fdb71-1dae-4897-b5af-95c628fce288?source=api-prod","affected":[{"type":"plugin","slug":"story-chief","name":"StoryChief","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":"1.0.31"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2890a126-2752-4695-9eb6-a360c9bf69bb","source":"wordfence","cve":"CVE-2025-26582","title":"TinyMCE Advanced qTranslate fix editor problems <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2890a126-2752-4695-9eb6-a360c9bf69bb?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-advanced-qtranslate-fix-editor-problems","name":"TinyMCE Advanced qTranslate fix editor problems","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:38:46Z"},{"id":"wordfence:28928a78-24c2-44d2-a9e4-33c2f352d089","source":"wordfence","cve":"CVE-2022-1532","title":"Themify - WooCommerce Product Filter <= 1.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28928a78-24c2-44d2-a9e4-33c2f352d089?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28941027-a812-4d53-b3da-4e715202f88d","source":"wordfence","cve":"CVE-2023-26536","title":"Sp*tify Play Button for WordPress <= 2.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28941027-a812-4d53-b3da-4e715202f88d?source=api-prod","affected":[{"type":"plugin","slug":"spotify-play-button-for-wordpress","name":"Sp*tify Play Button for WordPress","from":"*","from_inclusive":true,"to":"2.05","to_inclusive":true,"patched_in":"2.06"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:289569f5-8a8d-4427-8ad4-e431c955311e","source":"wordfence","cve":"CVE-2013-1408","title":"MailPoet Newsletters <= 2.2 - Multiple SQL Injections","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/289569f5-8a8d-4427-8ad4-e431c955311e?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2013-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2895f0c2-41b6-4b11-9865-3bded4402aa9","source":"wordfence","cve":"CVE-2026-85984","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2895f0c2-41b6-4b11-9865-3bded4402aa9?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":"5.5.6"}],"published":"2026-09-26T04:44:50Z","updated":"2026-09-26T17:28:59Z"},{"id":"wordfence:2896c925-e035-4193-92db-e8a3dd34a0b7","source":"wordfence","cve":"CVE-2024-7862","title":"Blog Introduction <= 0.3.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2896c925-e035-4193-92db-e8a3dd34a0b7?source=api-prod","affected":[{"type":"plugin","slug":"blogintroduction-wordpress-plugin","name":"blogintroduction-wordpress-plugin","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:21:28Z"},{"id":"wordfence:289a4076-974f-4b0c-bfaa-83c1b2cb62ef","source":"wordfence","cve":"CVE-2025-13391","title":"Product Options and Price Calculation Formulas for WooCommerce \u2013 Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/289a4076-974f-4b0c-bfaa-83c1b2cb62ef?source=api-prod","affected":[{"type":"plugin","slug":"uni-woo-custom-product-options-premium","name":"Product Options and Price Calculation Formulas for WooCommerce \u2013 Uni CPO (Premium)","from":"*","from_inclusive":true,"to":"4.9.60","to_inclusive":true,"patched_in":"4.9.61"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-16T14:55:22Z"},{"id":"wordfence:289b270c-a9d1-4fbb-81d6-edbf662f2661","source":"wordfence","cve":"CVE-2026-22471","title":"Secudeal Payments for Ecommerce <= 1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/289b270c-a9d1-4fbb-81d6-edbf662f2661?source=api-prod","affected":[{"type":"plugin","slug":"secudeal-payments-for-ecommerce","name":"Secudeal Payments for Ecommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T18:23:32Z"},{"id":"wordfence:289c9759-f4d3-4b42-9f90-12ea43bbafad","source":"wordfence","cve":"CVE-2024-43984","title":"Podlove Podcast Publisher <= 4.1.13 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/289c9759-f4d3-4b42-9f90-12ea43bbafad?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.14"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:03:11Z"},{"id":"wordfence:28a071ac-37ee-4fb9-b8c6-0a782ee673b4","source":"wordfence","cve":"CVE-2026-4002","title":"Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a071ac-37ee-4fb9-b8c6-0a782ee673b4?source=api-prod","affected":[{"type":"plugin","slug":"petje-af","name":"Petje.af","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:46:31Z","updated":"2026-04-15T08:28:14Z"},{"id":"wordfence:28a181ab-5a80-4c85-8a70-63144068c08b","source":"wordfence","cve":"","title":"WordPress Core 4.9.0 - 7.1.3 - Unauthenticated Sensitive Information Exposure via Customizer Changesets","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a181ab-5a80-4c85-8a70-63144068c08b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.34","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"4.9.35"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T18:10:30Z"},{"id":"wordfence:28a3f382-3801-4e98-9004-56c27a85f0a2","source":"wordfence","cve":"CVE-2024-12712","title":"Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a3f382-3801-4e98-9004-56c27a85f0a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2025-01-07T21:10:58Z","updated":"2025-01-08T09:18:36Z"},{"id":"wordfence:28a4c868-a24d-4fd8-ae0e-d5c0bf3a7436","source":"wordfence","cve":"CVE-2023-35038","title":"WP PDF Generator <= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a4c868-a24d-4fd8-ae0e-d5c0bf3a7436?source=api-prod","affected":[{"type":"plugin","slug":"wp-pdf-generator","name":"WP PDF Generator","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28a7b2c9-5d8d-4b49-a47c-473e3288b563","source":"wordfence","cve":"CVE-2021-4344","title":"Frontend File Manager <= 18.2 - Privilege Escalation","severity":"medium","cvss":6.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a7b2c9-5d8d-4b49-a47c-473e3288b563?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28a7b80c-8282-4f5c-b442-d6bce9fda25d","source":"wordfence","cve":"","title":"Ripe HD FLV <= 1.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a7b80c-8282-4f5c-b442-d6bce9fda25d?source=api-prod","affected":[{"type":"plugin","slug":"ripe-hd-player","name":"Ripe HD FLV","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2013-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28a8b3fe-6f15-4085-a370-a2e867f7018b","source":"wordfence","cve":"CVE-2023-25065","title":"WP Tabs <= 2.1.14 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a8b3fe-6f15-4085-a370-a2e867f7018b?source=api-prod","affected":[{"type":"plugin","slug":"wp-expand-tabs-free","name":"Custom Product Tabs for WooCommerce & WordPress Tabs Builder \u2013 Smart Tabs","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28a8f025-c2ab-4a5f-a99e-a2d19b14a190","source":"wordfence","cve":"CVE-2023-6524","title":"MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a8f025-c2ab-4a5f-a99e-a2d19b14a190?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.88.13","to_inclusive":true,"patched_in":"2.88.14"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:03Z"},{"id":"wordfence:28a9c2ba-7667-4601-8808-7258af69a432","source":"wordfence","cve":"CVE-2025-22733","title":"My auctions allegro <= 3.6.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28a9c2ba-7667-4601-8808-7258af69a432?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.18","to_inclusive":true,"patched_in":"3.6.19"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T20:03:45Z"},{"id":"wordfence:28aae3d4-c4c4-4cda-9f4b-7f2ea58629aa","source":"wordfence","cve":"CVE-2023-47666","title":"Code Snippets <= 3.5.0 - Cross-Site Request Forgery via load","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28aae3d4-c4c4-4cda-9f4b-7f2ea58629aa?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28b5238d-5843-433f-b027-5139cc0a0c19","source":"wordfence","cve":"CVE-2024-54280","title":"WPBookit <= 1.6.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28b5238d-5843-433f-b027-5139cc0a0c19?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-20T21:08:49Z"},{"id":"wordfence:28b70c72-3f09-4bb1-8655-831067f413ca","source":"wordfence","cve":"CVE-2025-53332","title":"Track Everything <=  2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28b70c72-3f09-4bb1-8655-831067f413ca?source=api-prod","affected":[{"type":"plugin","slug":"track-everything","name":"Track Everything","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:26:08Z"},{"id":"wordfence:28b730b3-4260-414f-8a4a-65ba5509449b","source":"wordfence","cve":"CVE-2026-6929","title":"JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28b730b3-4260-414f-8a4a-65ba5509449b?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"5.7.8"}],"published":"2026-05-12T17:13:07Z","updated":"2026-05-13T05:29:39Z"},{"id":"wordfence:28b87050-cd2e-4c9c-992d-892ba571908b","source":"wordfence","cve":"CVE-2025-32636","title":"Local Magic <= 2.6.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28b87050-cd2e-4c9c-992d-892ba571908b?source=api-prod","affected":[{"type":"plugin","slug":"local-magic","name":"Local Magic","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T19:22:22Z"},{"id":"wordfence:28ba6f91-c696-4019-ae87-28ebfbe464cf","source":"wordfence","cve":"CVE-2023-5413","title":"Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ba6f91-c696-4019-ae87-28ebfbe464cf?source=api-prod","affected":[{"type":"plugin","slug":"image-horizontal-reel-scroll-slideshow","name":"Image horizontal reel scroll slideshow","from":"*","from_inclusive":true,"to":"13.3","to_inclusive":true,"patched_in":"13.4"}],"published":"2023-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28bc0672-3469-4f58-860d-9e13da46804e","source":"wordfence","cve":"CVE-2024-32597","title":"WP Smart Import : Import any XML File to WordPress <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28bc0672-3469-4f58-860d-9e13da46804e?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:40:17Z"},{"id":"wordfence:28bcaf28-bb75-4d55-9e9b-afa760fc793e","source":"wordfence","cve":"CVE-2008-6767","title":"WordPress Core < 2.7 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28bcaf28-bb75-4d55-9e9b-afa760fc793e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.7"}],"published":"2008-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28bdad82-f09a-461f-b826-3f458f121fea","source":"wordfence","cve":"","title":"Thanh To\u00e1n Qu\u00e9t M\u00e3 QR Code T\u1ef1 \u0110\u1ed9ng \u2013 MoMo, ViettelPay, VNPay v\u00e0 40 ng\u00e2n h\u00e0ng Vi\u1ec7t Nam <= 2.0.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28bdad82-f09a-461f-b826-3f458f121fea?source=api-prod","affected":[{"type":"plugin","slug":"bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang","name":"Thanh To\u00e1n Qu\u00e9t M\u00e3 QR Code T\u1ef1 \u0110\u1ed9ng \u2013 MoMo, ViettelPay, VNPay v\u00e0 40 ng\u00e2n h\u00e0ng Vi\u1ec7t Nam","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28bdaf44-6f2c-440a-a96f-bdcd71fb7bea","source":"wordfence","cve":"CVE-2024-9455","title":"WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28bdaf44-6f2c-440a-a96f-bdcd71fb7bea?source=api-prod","affected":[{"type":"plugin","slug":"wp-cleanup-and-basic-functions","name":"WP Cleanup and Basic Functions","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-04T12:37:44Z","updated":"2024-10-05T01:59:40Z"},{"id":"wordfence:28bdf97b-86e7-4d4b-a3e4-6624e9858a93","source":"wordfence","cve":"CVE-2021-24708","title":"WP All Export <= 1.3.0 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28bdf97b-86e7-4d4b-a3e4-6624e9858a93?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28c3b377-4cab-4c17-adc3-6ce8b600b20a","source":"wordfence","cve":"","title":"Woo MerchantX <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28c3b377-4cab-4c17-adc3-6ce8b600b20a?source=api-prod","affected":[{"type":"plugin","slug":"woo-merchantx","name":"Woo MerchantX","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28c497ea-1a8c-4bda-a02b-7bc0f346be0c","source":"wordfence","cve":"CVE-2026-52707","title":"Kastell <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28c497ea-1a8c-4bda-a02b-7bc0f346be0c?source=api-prod","affected":[{"type":"theme","slug":"kastell","name":"Kastell - WordPress Theme for Single Properties and Apartments","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:05:28Z"},{"id":"wordfence:28c8abf2-09e2-43a2-8666-ca2a896bdbbe","source":"wordfence","cve":"CVE-2021-24232","title":"Advanced Booking Calendar <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28c8abf2-09e2-43a2-8666-ca2a896bdbbe?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":false,"patched_in":"1.6.8"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28ca150a-443f-4b99-8c15-491bd9f1cee3","source":"wordfence","cve":"CVE-2023-26521","title":"Search in Place <= 1.0.104 - Missing Authorization to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca150a-443f-4b99-8c15-491bd9f1cee3?source=api-prod","affected":[{"type":"plugin","slug":"search-in-place","name":"Search in Place","from":"*","from_inclusive":true,"to":"1.0.104","to_inclusive":true,"patched_in":"1.0.105"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28ca388f-0505-47ae-9408-e3d101101fae","source":"wordfence","cve":"CVE-2023-22721","title":"Oi Yandex.Maps for WordPress <= 3.2.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca388f-0505-47ae-9408-e3d101101fae?source=api-prod","affected":[{"type":"plugin","slug":"oi-yamaps","name":"Oi Yandex.Maps for WordPress","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28ca8dd9-2149-42b3-94fd-4a1fabc3e891","source":"wordfence","cve":"CVE-2026-28158","title":"Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca8dd9-2149-42b3-94fd-4a1fabc3e891?source=api-prod","affected":[{"type":"plugin","slug":"lasso","name":"ToneDen Shortcode","from":"*","from_inclusive":true,"to":"358","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:50:04Z"},{"id":"wordfence:28ca9590-dc0b-40c9-9de6-1480094ea8be","source":"wordfence","cve":"CVE-2025-12894","title":"Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.14.17","to_inclusive":true,"patched_in":"2.14.18"}],"published":"2025-11-20T18:54:56Z","updated":"2025-11-21T07:31:50Z"},{"id":"wordfence:28cb1a04-5129-430a-850e-c410e95d7b87","source":"wordfence","cve":"CVE-2021-24331","title":"Smooth Scroll Page Up/Down Buttons <= 1.3 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28cb1a04-5129-430a-850e-c410e95d7b87?source=api-prod","affected":[{"type":"plugin","slug":"smooth-page-scroll-updown-buttons","name":"Smooth Page Scroll Up/Down Buttons","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2021-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28cb96a9-12bd-4d9c-ac53-72e81d11b0b6","source":"wordfence","cve":"CVE-2014-9735","title":"Slider Revolution < 3.0.96 & Showbiz Pro < 1.7.1 - Missing Authorization to Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28cb96a9-12bd-4d9c-ac53-72e81d11b0b6?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"3.0.96","to_inclusive":false,"patched_in":"3.0.96"},{"type":"plugin","slug":"showbizpro","name":"Showbiz Pro Responsive Teaser WordPress Plugin","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2014-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28ccae6b-c330-4811-9cd8-eeb2c91c2f55","source":"wordfence","cve":"CVE-2025-30527","title":"My Bootstrap Menu <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ccae6b-c330-4811-9cd8-eeb2c91c2f55?source=api-prod","affected":[{"type":"plugin","slug":"my-bootstrap-menu","name":"My Bootstrap Menu","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:37:22Z"},{"id":"wordfence:28ccfa60-10ad-47f5-b694-3b96857f8d22","source":"wordfence","cve":"CVE-2026-56034","title":"Library Management System <= 3.5.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ccfa60-10ad-47f5-b694-3b96857f8d22?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-29T18:51:48Z"},{"id":"wordfence:28cddb4c-32a1-4ea9-936d-5ec7ffd84753","source":"wordfence","cve":"CVE-2023-46642","title":"SAHU TikTok Pixel for E-Commerce <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28cddb4c-32a1-4ea9-936d-5ec7ffd84753?source=api-prod","affected":[{"type":"plugin","slug":"sahu-tiktok-pixel","name":"SAHU TikTok Pixel for E-Commerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28cf0f3f-0048-4da9-aa86-243479f7b974","source":"wordfence","cve":"CVE-2025-5956","title":"WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=api-prod","affected":[{"type":"plugin","slug":"hrm","name":"WP Human Resource Management","from":"2.0.0","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:17:29Z","updated":"2025-07-04T01:44:02Z"},{"id":"wordfence:28d0ecb6-18ee-4c89-bc1d-541e9803c62c","source":"wordfence","cve":"CVE-2026-57419","title":"Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d0ecb6-18ee-4c89-bc1d-541e9803c62c?source=api-prod","affected":[{"type":"plugin","slug":"stock-locations-for-woocommerce","name":"Stock Locations for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:24:26Z"},{"id":"wordfence:28d3388e-0731-46b6-bf66-e7a1d98c321a","source":"wordfence","cve":"CVE-2015-5308","title":"wp-championship < 5.9 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d3388e-0731-46b6-bf66-e7a1d98c321a?source=api-prod","affected":[{"type":"plugin","slug":"wp-championship","name":"wp-championship","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":false,"patched_in":"5.9"}],"published":"2015-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28d35d27-80d8-4fff-a4c3-37e9ed5b2f85","source":"wordfence","cve":"CVE-2026-110016","title":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables < 1.15.8 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d35d27-80d8-4fff-a4c3-37e9ed5b2f85?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.15.8","to_inclusive":false,"patched_in":"1.15.8"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:37Z"},{"id":"wordfence:28d3fe13-20f8-48af-9476-98d2bef467e5","source":"wordfence","cve":"CVE-2021-24419","title":"WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d3fe13-20f8-48af-9476-98d2bef467e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-lyte","name":"WP YouTube Lyte","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":false,"patched_in":"1.7.16"}],"published":"2021-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28d41721-c538-4043-a411-3234ff1074bc","source":"wordfence","cve":"","title":"Send PDF for Contact Form 7 <= 0.9.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d41721-c538-4043-a411-3234ff1074bc?source=api-prod","affected":[{"type":"plugin","slug":"send-pdf-for-contact-form-7","name":"Send PDF for Contact Form 7","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2022-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28d47605-ecb8-42cc-901a-3cf07b946877","source":"wordfence","cve":"CVE-2025-1314","title":"Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d47605-ecb8-42cc-901a-3cf07b946877?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-03-19T16:21:23Z","updated":"2025-03-20T05:23:22Z"},{"id":"wordfence:28d622b3-e8a7-4a3b-9f0b-e344b085284d","source":"wordfence","cve":"CVE-2024-29009","title":"Easy PopUp Show <= 0.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d622b3-e8a7-4a3b-9f0b-e344b085284d?source=api-prod","affected":[{"type":"plugin","slug":"easy-popup-show","name":"Easy PopUp Show","from":"*","from_inclusive":true,"to":"0.12","to_inclusive":true,"patched_in":""}],"published":"2024-03-25T00:00:00Z","updated":"2024-05-07T21:05:19Z"},{"id":"wordfence:28d67772-81cc-4518-a5e3-553153eddd35","source":"wordfence","cve":"CVE-2026-112328","title":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d67772-81cc-4518-a5e3-553153eddd35?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.26.3","to_inclusive":true,"patched_in":"4.26.4"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:35:39Z"},{"id":"wordfence:28d6a36b-ba8b-4c73-9e89-0fb85353b58e","source":"wordfence","cve":"CVE-2024-47332","title":"Sky Addons for Elementor <= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d6a36b-ba8b-4c73-9e89-0fb85353b58e?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.5.11","to_inclusive":true,"patched_in":"2.5.12"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:08:00Z"},{"id":"wordfence:28d6cee1-abae-4f21-81f2-f2adc6d92cd8","source":"wordfence","cve":"CVE-2026-121764","title":"FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d6cee1-abae-4f21-81f2-f2adc6d92cd8?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7212","to_inclusive":true,"patched_in":"7.5.57.7212"}],"published":"2026-11-07T09:42:54Z","updated":"2026-11-10T19:46:58Z"},{"id":"wordfence:28d8ebf9-2841-4a54-8537-959c43ca88e4","source":"wordfence","cve":"CVE-2026-56047","title":"Perfmatters <= 2.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d8ebf9-2841-4a54-8537-959c43ca88e4?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:01:02Z"},{"id":"wordfence:28d9ab98-c1ab-45ee-a371-6598a8347b10","source":"wordfence","cve":"CVE-2024-13231","title":"WordPress Portfolio Builder \u2013 Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28d9ab98-c1ab-45ee-a371-6598a8347b10?source=api-prod","affected":[{"type":"plugin","slug":"uber-grid","name":"WordPress Portfolio Builder \u2013 Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:35:27Z","updated":"2025-02-19T08:21:50Z"},{"id":"wordfence:28dc6608-8835-4a3c-8e28-b30a2887a2a1","source":"wordfence","cve":"CVE-2025-31911","title":"Social Share And Social Locker <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28dc6608-8835-4a3c-8e28-b30a2887a2a1?source=api-prod","affected":[{"type":"plugin","slug":"social-share-and-social-locker-arsocial","name":"Social Share And Social Locker \u2013 ARSocial","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2026-07-16T19:16:34Z"},{"id":"wordfence:28dea1e9-e772-488e-b98f-93a46ab84581","source":"wordfence","cve":"CVE-2021-4389","title":"WP Travel  <= 4.4.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28dea1e9-e772-488e-b98f-93a46ab84581?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28df760b-6b15-41ca-b93f-9d24dbbd9fc4","source":"wordfence","cve":"CVE-2026-9200","title":"Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28df760b-6b15-41ca-b93f-9d24dbbd9fc4?source=api-prod","affected":[{"type":"plugin","slug":"query-shortcode","name":"Query Shortcode","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:25Z","updated":"2026-05-27T05:31:21Z"},{"id":"wordfence:28dfc8c9-478c-48b2-8781-7e0787fd50fd","source":"wordfence","cve":"","title":"WPS Limit Login < 1.4.6.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28dfc8c9-478c-48b2-8781-7e0787fd50fd?source=api-prod","affected":[{"type":"plugin","slug":"wps-limit-login","name":"WPS Limit Login","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":false,"patched_in":"1.4.6.1"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28e16994-a03f-4b3a-9f45-e6b0a1334c98","source":"wordfence","cve":"CVE-2024-1319","title":"Events Tickets Plus <= 5.9.0 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e16994-a03f-4b3a-9f45-e6b0a1334c98?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-plus","name":"Events Tickets Plus","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2024-02-08T00:00:00Z","updated":"2024-03-22T17:58:45Z"},{"id":"wordfence:28e1a11b-5320-41be-bc78-580322e5f407","source":"wordfence","cve":"CVE-2020-13643","title":"Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e1a11b-5320-41be-bc78-580322e5f407?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.10.16","to_inclusive":false,"patched_in":"2.10.16"}],"published":"2020-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28e2a490-aac7-485f-89f6-b8b779625b86","source":"wordfence","cve":"CVE-2025-66167","title":"Lottier <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e2a490-aac7-485f-89f6-b8b779625b86?source=api-prod","affected":[{"type":"plugin","slug":"lottier-gutenberg","name":"Lottier","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-20T20:33:08Z"},{"id":"wordfence:28e45ffc-ea55-42a4-97ea-4638f640b712","source":"wordfence","cve":"CVE-2026-7804","title":"Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e45ffc-ea55-42a4-97ea-4638f640b712?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-09-08T14:38:17Z","updated":"2026-09-09T03:28:46Z"},{"id":"wordfence:28e48604-2aaf-4e02-9b1e-cebf5f0bfcf7","source":"wordfence","cve":"CVE-2026-0684","title":"CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e48604-2aaf-4e02-9b1e-cebf5f0bfcf7?source=api-prod","affected":[{"type":"plugin","slug":"cp-image-store","name":"CP Image Store with Slideshow","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-13T13:49:12Z"},{"id":"wordfence:28e4cc53-53c3-47bf-8ea4-818040d10abd","source":"wordfence","cve":"CVE-2024-43976","title":"Super Store Finder <= 6.9.7 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e4cc53-53c3-47bf-8ea4-818040d10abd?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:12:27Z"},{"id":"wordfence:28e627aa-0d0e-466c-80a6-31c84210ea26","source":"wordfence","cve":"CVE-2026-39773","title":"Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e627aa-0d0e-466c-80a6-31c84210ea26?source=api-prod","affected":[{"type":"plugin","slug":"doctreat_core","name":"Doctreat Core","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:39:35Z","updated":"2026-10-08T23:44:18Z"},{"id":"wordfence:28e723ee-e99a-4ec4-b492-bfba04d27fd0","source":"wordfence","cve":"CVE-2023-41243","title":"WPvivid Backup Plugin <= 0.9.90 - Missing Authorization via 'start_staging' and 'get_staging_progress'","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e723ee-e99a-4ec4-b492-bfba04d27fd0?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.91","to_inclusive":false,"patched_in":"0.9.91"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28e74811-aae8-4276-abb1-cbe4fbcfd08b","source":"wordfence","cve":"CVE-2017-20090","title":"Global Content Blocks <= 2.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e74811-aae8-4276-abb1-cbe4fbcfd08b?source=api-prod","affected":[{"type":"plugin","slug":"global-content-blocks","name":"Global Content Blocks","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28e75881-578b-41c3-946b-ef19edb8f067","source":"wordfence","cve":"CVE-2025-46438","title":"GTDB Guitar Tuners <= 4.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e75881-578b-41c3-946b-ef19edb8f067?source=api-prod","affected":[{"type":"plugin","slug":"guitar-tuner","name":"GTDB Guitar Tuners","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:32:17Z"},{"id":"wordfence:28e9c77c-5c36-4449-ab90-86f2385ba1ae","source":"wordfence","cve":"CVE-2025-6815","title":"LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e9c77c-5c36-4449-ab90-86f2385ba1ae?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.94","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-09-29T16:24:39Z","updated":"2025-09-30T04:27:07Z"},{"id":"wordfence:28e9d339-b304-45c1-95ae-cb4c13703bfc","source":"wordfence","cve":"CVE-2024-54306","title":"AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot <= 1.6.2 - Cross-Site Request Forgery via update_integration_option","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28e9d339-b304-45c1-95ae-cb4c13703bfc?source=api-prod","affected":[{"type":"plugin","slug":"ai-seo-translator","name":"AIKCT Engine Chatbot","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:48:44Z"},{"id":"wordfence:28eb6998-be54-4cf9-8bb1-454c07151748","source":"wordfence","cve":"CVE-2025-13409","title":"Form Vibes \u2013 Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28eb6998-be54-4cf9-8bb1-454c07151748?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-01-05T14:47:34Z","updated":"2026-01-06T03:21:38Z"},{"id":"wordfence:28eb977c-d90a-4222-ac45-09999f5afe2a","source":"wordfence","cve":"CVE-2026-102396","title":"Ultimate Maps by Supsystic <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28eb977c-d90a-4222-ac45-09999f5afe2a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-30T09:59:13Z","updated":"2026-10-08T23:13:30Z"},{"id":"wordfence:28ecf168-c215-4fc3-8dd7-1ab84ae6b4a6","source":"wordfence","cve":"CVE-2024-37424","title":"Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28ecf168-c215-4fc3-8dd7-1ab84ae6b4a6?source=api-prod","affected":[{"type":"plugin","slug":"newspack-blocks","name":"Newspack Blocks","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:31:08Z"},{"id":"wordfence:28f08640-cd63-4f2a-a785-1956dc051991","source":"wordfence","cve":"CVE-2007-4480","title":"Sirius <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28f08640-cd63-4f2a-a785-1956dc051991?source=api-prod","affected":[{"type":"theme","slug":"sirius","name":"Sirius","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2007-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28f0a927-a92e-45ab-8ef3-7a7c9368e1e4","source":"wordfence","cve":"CVE-2022-36425","title":"Beaver Builder <= 2.5.4.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28f0a927-a92e-45ab-8ef3-7a7c9368e1e4?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.5.4.3","to_inclusive":true,"patched_in":"2.5.4.4"}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:28f22a48-7445-4104-9b76-60520e7a290e","source":"wordfence","cve":"CVE-2025-54025","title":"Coupon Affiliates <= 6.4.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28f22a48-7445-4104-9b76-60520e7a290e?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:56:15Z"},{"id":"wordfence:28f454e8-d0ce-4ad2-bcad-5011f75ec862","source":"wordfence","cve":"CVE-2025-32680","title":"Review Stream <= 1.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28f454e8-d0ce-4ad2-bcad-5011f75ec862?source=api-prod","affected":[{"type":"plugin","slug":"review-stream","name":"Review Stream","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T15:01:55Z"},{"id":"wordfence:28f77d5a-fc17-4e17-85b9-4e6f66dbf2c7","source":"wordfence","cve":"CVE-2024-8712","title":"GTM Server Side <= 2.1.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28f77d5a-fc17-4e17-85b9-4e6f66dbf2c7?source=api-prod","affected":[{"type":"plugin","slug":"gtm-server-side","name":"Stape Conversion Tracking","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2024-09-27T00:00:00Z","updated":"2024-09-28T08:36:49Z"},{"id":"wordfence:28fd9f64-4451-46fd-bdeb-cc5a538ea563","source":"wordfence","cve":"CVE-2024-9357","title":"xili-tidy-tags <= 1.12.04 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28fd9f64-4451-46fd-bdeb-cc5a538ea563?source=api-prod","affected":[{"type":"plugin","slug":"xili-tidy-tags","name":"xili-tidy-tags","from":"*","from_inclusive":true,"to":"1.12.04","to_inclusive":true,"patched_in":"1.12.05"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-12T05:31:08Z"},{"id":"wordfence:28fe3ec0-5e62-4a52-890d-e05b7d5bf531","source":"wordfence","cve":"CVE-2021-36891","title":"Photo Gallery by Supsystic <= 1.15.5 - Cross-Site Request Forgery to Plugin Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/28fe3ec0-5e62-4a52-890d-e05b7d5bf531?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.15.5","to_inclusive":true,"patched_in":"1.15.6"}],"published":"2022-06-15T13:58:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:290027c3-6b0a-43b9-9220-b8c641eb73f7","source":"wordfence","cve":"CVE-2024-13556","title":"Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/290027c3-6b0a-43b9-9220-b8c641eb73f7?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-links","name":"Affiliate Links \u2013 Link Cloaking and Management","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T05:22:27Z"},{"id":"wordfence:2901761c-426a-4f06-84db-247c70a3784d","source":"wordfence","cve":"CVE-2024-50502","title":"Cozy Blocks <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2901761c-426a-4f06-84db-247c70a3784d?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":true,"patched_in":"2.0.19"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:32:46Z"},{"id":"wordfence:2901d81f-b29a-481c-9fc5-64a7b71b29c8","source":"wordfence","cve":"CVE-2025-64205","title":"Jannah <= 7.6.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2901d81f-b29a-481c-9fc5-64a7b71b29c8?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-19T16:45:15Z"},{"id":"wordfence:29020b36-63a6-45dd-a4a7-a3a505304ca0","source":"wordfence","cve":"CVE-2026-96817","title":"MakeCommerce for WooCommerce <= 4.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29020b36-63a6-45dd-a4a7-a3a505304ca0?source=api-prod","affected":[{"type":"plugin","slug":"makecommerce","name":"MakeCommerce for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:31:50Z"},{"id":"wordfence:290233f0-a5dd-4c69-8039-7392268daf40","source":"wordfence","cve":"CVE-2023-1473","title":"Slider, Gallery, and Carousel by MetaSlider <= 3.29.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/290233f0-a5dd-4c69-8039-7392268daf40?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2903d15c-4f4d-497c-b6ed-4ae32c047a8a","source":"wordfence","cve":"CVE-2024-13685","title":"Admin and Site Enhancements (ASE) <= 7.6.9 - IP Spoofing to Limit Login Attempt Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2903d15c-4f4d-497c-b6ed-4ae32c047a8a?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.6.9","to_inclusive":true,"patched_in":"7.6.10"}],"published":"2025-02-11T00:00:00Z","updated":"2025-03-14T17:27:34Z"},{"id":"wordfence:2904e3dd-2a5f-49f2-a949-e76c4ccfc54c","source":"wordfence","cve":"CVE-2026-28083","title":"Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2904e3dd-2a5f-49f2-a949-e76c4ccfc54c?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":"3.20.6"}],"published":"2025-10-06T00:00:00Z","updated":"2026-04-25T17:32:51Z"},{"id":"wordfence:290a790f-7d11-4be7-9146-cb07919b1e60","source":"wordfence","cve":"CVE-2025-7652","title":"Easy Plugin Stats <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/290a790f-7d11-4be7-9146-cb07919b1e60?source=api-prod","affected":[{"type":"plugin","slug":"easy-plugin-stats","name":"Easy Plugin Stats","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:29:46Z","updated":"2026-04-01T05:29:04Z"},{"id":"wordfence:290e7b9d-23b6-47bb-9169-d2f9922b6492","source":"wordfence","cve":"CVE-2025-25141","title":"Fami Sales Popup <= 2.0.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/290e7b9d-23b6-47bb-9169-d2f9922b6492?source=api-prod","affected":[{"type":"plugin","slug":"fami-sales-popup","name":"Fami Sales Popup","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:50:37Z"},{"id":"wordfence:290e9d95-0dac-4cc8-8cef-9e7974405f36","source":"wordfence","cve":"CVE-2025-9499","title":"Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-08-29T16:24:26Z","updated":"2025-08-30T04:25:06Z"},{"id":"wordfence:291085c8-a8e5-4401-963e-5268b25859ed","source":"wordfence","cve":"CVE-2025-62914","title":"Effect Maker <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291085c8-a8e5-4401-963e-5268b25859ed?source=api-prod","affected":[{"type":"plugin","slug":"effect-maker","name":"Effect Maker","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:02:37Z"},{"id":"wordfence:291205ac-b161-4694-93af-f3fc96e0ea02","source":"wordfence","cve":"CVE-2025-58887","title":"Course Booking Platform <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291205ac-b161-4694-93af-f3fc96e0ea02?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-platform","name":"Course Booking Platform","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:34:50Z"},{"id":"wordfence:29125de3-eeed-4537-8915-e8100d2e65ca","source":"wordfence","cve":"CVE-2015-9520","title":"Easy Digital Downloads \u2013 Per Product Emails < 1.0.9  - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29125de3-eeed-4537-8915-e8100d2e65ca?source=api-prod","affected":[{"type":"plugin","slug":"edd-per-product-emails","name":"Easy Digital Downloads \u2013 Per Product Emails","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2912f693-c8fd-48f7-8030-5e1f0edd715f","source":"wordfence","cve":"CVE-2024-30242","title":"Contact Form to Any API <= 1.1.8 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2912f693-c8fd-48f7-8030-5e1f0edd715f?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:49:02Z"},{"id":"wordfence:29137748-91b1-4b01-9f05-63da592e941a","source":"wordfence","cve":"CVE-2024-32719","title":"WP Club Manager <= 2.2.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29137748-91b1-4b01-9f05-63da592e941a?source=api-prod","affected":[{"type":"plugin","slug":"wp-club-manager","name":"WP Club Manager \u2013 WordPress Sports Club Plugin","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:41:17Z"},{"id":"wordfence:29143d81-9134-4b0e-8540-5f37e5b08707","source":"wordfence","cve":"CVE-2025-46490","title":"Crossword Compiler Puzzles <= 5.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29143d81-9134-4b0e-8540-5f37e5b08707?source=api-prod","affected":[{"type":"plugin","slug":"crossword-compiler-puzzles","name":"Crossword Compiler Puzzles","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2025-04-25T00:00:00Z","updated":"2025-08-29T13:32:54Z"},{"id":"wordfence:29161530-1ffa-48d0-98a9-fa68a0b1a057","source":"wordfence","cve":"CVE-2016-20067","title":"Polls CP <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29161530-1ffa-48d0-98a9-fa68a0b1a057?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-17T04:04:01Z"},{"id":"wordfence:291629c3-1c28-4abb-af1f-56942fe6f475","source":"wordfence","cve":"CVE-2025-60157","title":"WP Ticket Customer Service Software & Support Ticket System <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291629c3-1c28-4abb-af1f-56942fe6f475?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:27:06Z"},{"id":"wordfence:29169235-03d3-43a7-9afd-ddfc1a486faf","source":"wordfence","cve":"CVE-2025-47461","title":"Subaccounts for WooCommerce <= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29169235-03d3-43a7-9afd-ddfc1a486faf?source=api-prod","affected":[{"type":"plugin","slug":"subaccounts-for-woocommerce","name":"Subaccounts for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-20T16:38:47Z"},{"id":"wordfence:291971aa-68ca-4558-9503-e19c0eb63fe8","source":"wordfence","cve":"CVE-2026-92396","title":"Blocks for ShopEngine <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291971aa-68ca-4558-9503-e19c0eb63fe8?source=api-prod","affected":[{"type":"plugin","slug":"blocks-for-shopengine","name":"ShopEngine Gutenberg WooCommerce Builder Blocks Addon \u2013 All in One WooCommerce Solution","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T20:11:04Z"},{"id":"wordfence:291b44d1-c63c-4278-b344-a361f88e82d1","source":"wordfence","cve":"CVE-2025-64215","title":"MasterStudy LMS Pro < 4.7.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291b44d1-c63c-4278-b344-a361f88e82d1?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.16","to_inclusive":false,"patched_in":"4.7.16"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:53:00Z"},{"id":"wordfence:291c8df8-fd87-4554-b5e5-3d1f510dbfc2","source":"wordfence","cve":"CVE-2025-23640","title":"Rename Author Slug <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291c8df8-fd87-4554-b5e5-3d1f510dbfc2?source=api-prod","affected":[{"type":"plugin","slug":"rename-author-slug","name":"Rename Author Slug","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:32:07Z"},{"id":"wordfence:291f8213-71e4-41d6-8db5-2dab6bfbaeef","source":"wordfence","cve":"CVE-2025-31530","title":"Google SEO Pressor Snippet <= 2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/291f8213-71e4-41d6-8db5-2dab6bfbaeef?source=api-prod","affected":[{"type":"plugin","slug":"google-seo-author-snippets","name":"Google SEO Pressor for Rich snippets","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-06-20T07:21:41Z"},{"id":"wordfence:2921ea67-e88a-489a-8c45-cfe458f29d2b","source":"wordfence","cve":"CVE-2023-50836","title":"HTML Forms <= 1.3.28 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2921ea67-e88a-489a-8c45-cfe458f29d2b?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.3.28","to_inclusive":true,"patched_in":"1.3.30"}],"published":"2023-12-21T00:00:00Z","updated":"2024-03-22T15:20:54Z"},{"id":"wordfence:2923afdd-36b7-4181-aade-d757a70a06c0","source":"wordfence","cve":"CVE-2024-34761","title":"Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Code Injection","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2923afdd-36b7-4181-aade-d757a70a06c0?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"6.2.10"}],"published":"2024-05-15T00:00:00Z","updated":"2024-06-18T15:49:02Z"},{"id":"wordfence:292425a1-8486-453e-8726-b5a859df1db1","source":"wordfence","cve":"CVE-2025-53440","title":"Confidant - Startup & Consulting Services WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/292425a1-8486-453e-8726-b5a859df1db1?source=api-prod","affected":[{"type":"theme","slug":"confidant","name":"Confidant - Startup & Consulting Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:18:31Z"},{"id":"wordfence:2927aa13-b012-41eb-93bd-38a4e5fc5455","source":"wordfence","cve":"CVE-2025-4564","title":"TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2927aa13-b012-41eb-93bd-38a4e5fc5455?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticketbai","name":"TicketBAI Facturas para WooCommerce","from":"*","from_inclusive":true,"to":"3.18","to_inclusive":true,"patched_in":"3.19"}],"published":"2025-05-14T00:00:00Z","updated":"2025-05-15T11:13:16Z"},{"id":"wordfence:29289ca2-ea70-4a42-b83e-43f976b88061","source":"wordfence","cve":"CVE-2026-16561","title":"Sunshine Photo Cart <= 3.6.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29289ca2-ea70-4a42-b83e-43f976b88061?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.6.11","to_inclusive":true,"patched_in":"3.6.12"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:29:22Z"},{"id":"wordfence:29299b88-10fd-4c76-a8d7-34d8d4c7fd14","source":"wordfence","cve":"CVE-2025-22331","title":"Cf7Save Extension <= 1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29299b88-10fd-4c76-a8d7-34d8d4c7fd14?source=api-prod","affected":[{"type":"plugin","slug":"cf7save-extension","name":"Cf7Save Extension","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:48:00Z"},{"id":"wordfence:292be50c-6eab-4462-b46c-c7763e8aa223","source":"wordfence","cve":"CVE-2007-1893","title":"WordPress Core < 2.1.3 -  Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/292be50c-6eab-4462-b46c-c7763e8aa223?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:292dab09-7090-4ca9-bca2-0d3e6db08818","source":"wordfence","cve":"CVE-2026-54822","title":"SALESmanago & Leadoo <= 3.11.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/292dab09-7090-4ca9-bca2-0d3e6db08818?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:40:22Z"},{"id":"wordfence:293070c8-783f-404d-9250-392713703ce4","source":"wordfence","cve":"CVE-2023-3999","title":"Waiting: One-click countdowns <= 0.6.2 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293070c8-783f-404d-9250-392713703ce4?source=api-prod","affected":[{"type":"plugin","slug":"waiting","name":"Waiting: One-click countdowns","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2930757f-42d5-434e-ba4d-443276a00961","source":"wordfence","cve":"CVE-2026-104118","title":"Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2930757f-42d5-434e-ba4d-443276a00961?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"4.8.8"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-08T23:07:00Z"},{"id":"wordfence:2930dda1-604a-454b-b858-6bb6a2bfdcdb","source":"wordfence","cve":"CVE-2026-57353","title":"Link Whisper Premium <= 2.9.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2930dda1-604a-454b-b858-6bb6a2bfdcdb?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper-premium","name":"Link Whisper Premium","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-09T13:26:51Z"},{"id":"wordfence:2931fda2-edc8-44ea-9fff-ae9d94aa01bf","source":"wordfence","cve":"CVE-2023-40200","title":"Multiple WPOnlineSupport Plugins <= (Various Versions) - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2931fda2-edc8-44ea-9fff-ae9d94aa01bf?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-and-projects","name":"Portfolio and Projects","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"plugin","slug":"html5-videogallery-plus-player","name":"Video gallery and Player","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"},{"type":"plugin","slug":"wp-testimonial-with-widget","name":"Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"},{"type":"plugin","slug":"wp-slick-slider-and-image-carousel","name":"WP Slick Slider and Image Carousel","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"},{"type":"plugin","slug":"accordion-and-accordion-slider","name":"Accordion and Accordion Slider","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"},{"type":"plugin","slug":"wp-logo-showcase-responsive-slider-slider","name":"WP Logo Showcase Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"},{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"},{"type":"plugin","slug":"meta-slider-and-carousel-with-lightbox","name":"Meta Slider and Carousel with Lightbox","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"},{"type":"plugin","slug":"blog-designer-for-post-and-widget","name":"Blog Designer \u2013 Post and Widget","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"},{"type":"plugin","slug":"sp-news-and-widget","name":"WP News and Scrolling Widgets","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"},{"type":"plugin","slug":"wp-trending-post-slider-and-widget","name":"Trending/Popular Post Slider and Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"countdown-timer-ultimate","name":"Countdown Timer Ultimate","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"wp-featured-content-and-slider","name":"WP Featured Content and Slider","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"},{"type":"plugin","slug":"ticker-ultimate","name":"Post Ticker Ultimate","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"},{"type":"plugin","slug":"wp-team-showcase-and-slider","name":"Team Slider and Team Grid Showcase plus Team Carousel","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"post-grid-and-filter-ultimate","name":"Post grid and filter ultimate","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"},{"type":"plugin","slug":"wp-blog-and-widgets","name":"WP Blog and Widgets","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"},{"type":"plugin","slug":"featured-post-creative","name":"Featured Post Creative","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"},{"type":"plugin","slug":"timeline-and-history-slider","name":"Timeline and History slider","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"},{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"},{"type":"plugin","slug":"sp-faq","name":"WP responsive FAQ with category plugin","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"},{"type":"plugin","slug":"wp-responsive-recent-post-slider","name":"WP Responsive Recent Post Slider/Carousel","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:293260d1-84a3-4af7-a293-8466624c86cc","source":"wordfence","cve":"CVE-2026-39709","title":"The Tribal <= 1.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293260d1-84a3-4af7-a293-8466624c86cc?source=api-prod","affected":[{"type":"plugin","slug":"the-tech-tribe","name":"The Tribal Plugin","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-05T15:46:22Z"},{"id":"wordfence:29326ec5-edb7-44b7-bca9-21962037ccc8","source":"wordfence","cve":"CVE-2025-24602","title":"WP24 Domain Check <= 1.10.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29326ec5-edb7-44b7-bca9-21962037ccc8?source=api-prod","affected":[{"type":"plugin","slug":"wp24-domain-check","name":"WP24 Domain Check","from":"*","from_inclusive":true,"to":"1.10.14","to_inclusive":true,"patched_in":"1.10.15"}],"published":"2024-12-26T00:00:00Z","updated":"2025-02-26T20:29:31Z"},{"id":"wordfence:29333999-ffe3-4cd0-a537-be98168cb2ee","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'SaveSettings' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29333999-ffe3-4cd0-a537-be98168cb2ee?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:293480b2-3160-4361-98d4-ed6e601d53c4","source":"wordfence","cve":"CVE-2024-53816","title":"Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293480b2-3160-4361-98d4-ed6e601d53c4?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T19:42:52Z"},{"id":"wordfence:29351ece-a71a-4c57-8f10-4d97274dc4eb","source":"wordfence","cve":"CVE-2025-49455","title":"TinySalt < 3.10.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29351ece-a71a-4c57-8f10-4d97274dc4eb?source=api-prod","affected":[{"type":"theme","slug":"tinysalt","name":"TinySalt - Personal Food Blog WordPress Theme","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":false,"patched_in":"3.10.0"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:59:29Z"},{"id":"wordfence:29358ea9-21b7-4294-8fc9-0d38e689cf53","source":"wordfence","cve":"CVE-2023-0684","title":"Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29358ea9-21b7-4294-8fc9-0d38e689cf53?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:293abae5-a7fb-401f-af09-324a81ce8709","source":"wordfence","cve":"CVE-2026-12938","title":"Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293abae5-a7fb-401f-af09-324a81ce8709?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2026-07-28T13:22:01Z","updated":"2026-07-29T01:29:43Z"},{"id":"wordfence:293ac389-cc82-400c-ab50-8e53f00c925a","source":"wordfence","cve":"CVE-2025-47510","title":"Display Eventbrite Events <= 6.2.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293ac389-cc82-400c-ab50-8e53f00c925a?source=api-prod","affected":[{"type":"plugin","slug":"widget-for-eventbrite-api","name":"Display Eventbrite Events","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:48:20Z"},{"id":"wordfence:293ad145-dc93-4d7a-83ba-78f8c730ed6d","source":"wordfence","cve":"CVE-2025-13378","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/293ad145-dc93-4d7a-83ba-78f8c730ed6d?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2025-11-26T21:00:16Z","updated":"2025-11-27T09:27:49Z"},{"id":"wordfence:2942644d-c330-4ec0-ab1d-64b3044d5a87","source":"wordfence","cve":"CVE-2026-27541","title":"Wholesale Suite <= 2.2.6 - Authenticated (Shop Manager) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2942644d-c330-4ec0-ab1d-64b3044d5a87?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2026-02-20T00:00:00Z","updated":"2026-03-06T18:37:22Z"},{"id":"wordfence:2945ab15-e211-4a11-954a-002d0fd2a04d","source":"wordfence","cve":"CVE-2025-31913","title":"Ogami <= 1.53 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2945ab15-e211-4a11-954a-002d0fd2a04d?source=api-prod","affected":[{"type":"theme","slug":"ogami","name":"Ogami - Organic Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.53","to_inclusive":true,"patched_in":"1.61.1"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:10:53Z"},{"id":"wordfence:2947a6e9-e357-4751-adfd-f9043bef75e9","source":"wordfence","cve":"CVE-2025-6221","title":"Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2947a6e9-e357-4751-adfd-f9043bef75e9?source=api-prod","affected":[{"type":"plugin","slug":"embed-bokun","name":"Embed Bokun","from":"*","from_inclusive":true,"to":"0.23","to_inclusive":true,"patched_in":"0.24"}],"published":"2025-08-15T14:47:05Z","updated":"2025-08-22T15:24:18Z"},{"id":"wordfence:29482b70-0ff2-4bb1-9d41-9cffb83b5ad0","source":"wordfence","cve":"CVE-2015-10134","title":"Simple Backup <= 2.7.10 - Arbitrary File Download via Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29482b70-0ff2-4bb1-9d41-9cffb83b5ad0?source=api-prod","affected":[{"type":"plugin","slug":"simple-backup","name":"Simple Backup","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":false,"patched_in":"2.7.11"}],"published":"2015-05-19T00:00:00Z","updated":"2025-07-19T09:23:51Z"},{"id":"wordfence:2948d8f6-4b7b-49c3-a917-4306448416ff","source":"wordfence","cve":"CVE-2023-26009","title":"Houzez Login Register <= 2.6.3 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2948d8f6-4b7b-49c3-a917-4306448416ff?source=api-prod","affected":[{"type":"plugin","slug":"houzez-login-register","name":"Houzez Login Register","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:294b2a7c-8b54-4022-a3af-9a3e3d1d4c11","source":"wordfence","cve":"CVE-2025-12099","title":"Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/294b2a7c-8b54-4022-a3af-9a3e3d1d4c11?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T08:27:42Z"},{"id":"wordfence:294b5bd1-a7c8-4c06-b107-e80bf3b35da8","source":"wordfence","cve":"CVE-2023-50859","title":"WP Crowdfunding <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/294b5bd1-a7c8-4c06-b107-e80bf3b35da8?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:294de862-716c-4e17-a1cf-cade53207013","source":"wordfence","cve":"CVE-2023-0874","title":"Klaviyo <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/294de862-716c-4e17-a1cf-cade53207013?source=api-prod","affected":[{"type":"plugin","slug":"klaviyo","name":"Klaviyo","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:294e1822-b92c-48a4-bfc6-5a89cfbe0bc7","source":"wordfence","cve":"CVE-2026-16586","title":"Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/294e1822-b92c-48a4-bfc6-5a89cfbe0bc7?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.7","to_inclusive":true,"patched_in":"31.0.0"}],"published":"2026-08-14T15:01:25Z","updated":"2026-08-15T03:25:59Z"},{"id":"wordfence:2950465d-a030-4003-8751-c93e3a678eb1","source":"wordfence","cve":"CVE-2026-17023","title":"Salon Booking System \u2013 Free Version < 10.31.3 - Missing Authorization to Unauthenticated Google Calendar Connection Hijack","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2950465d-a030-4003-8751-c93e3a678eb1?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.3","to_inclusive":false,"patched_in":"10.31.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-09-23T14:29:45Z"},{"id":"wordfence:2950a264-b60c-48ad-b8e0-6d0e1a230982","source":"wordfence","cve":"CVE-2023-51485","title":"Pay with Vipps for WooCommerce <= 1.14.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2950a264-b60c-48ad-b8e0-6d0e1a230982?source=api-prod","affected":[{"type":"plugin","slug":"woo-vipps","name":"Pay with Vipps and MobilePay for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.13","to_inclusive":true,"patched_in":"1.14.14"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2950eb91-a232-42c5-8a28-96b770cb7c48","source":"wordfence","cve":"","title":"Real-Time Find and Replace <= 3.8 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2950eb91-a232-42c5-8a28-96b770cb7c48?source=api-prod","affected":[{"type":"plugin","slug":"real-time-find-and-replace","name":"Real-Time Find and Replace","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.9"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2952a7bf-ccbf-46e0-ac7e-54576f413f66","source":"wordfence","cve":"CVE-2024-8157","title":"Alphabetical List <= 1.0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2952a7bf-ccbf-46e0-ac7e-54576f413f66?source=api-prod","affected":[{"type":"plugin","slug":"alphabetical-list","name":"Alphabetical List","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-12-12T18:35:50Z"},{"id":"wordfence:29532f4d-e830-4c99-ad77-076eebbbe98d","source":"wordfence","cve":"CVE-2024-2038","title":"Visual Website Collaboration, Feedback & Project Management \u2013 Atarim <= 3.22.6 - Hardcoded Credentials","severity":"high","cvss":7.5,"cwe":"CWE-259","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.22.6","to_inclusive":true,"patched_in":"3.30"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T06:46:05Z"},{"id":"wordfence:2954583e-4ebe-4658-b132-0085f2b1cf08","source":"wordfence","cve":"CVE-2025-10706","title":"Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=api-prod","affected":[{"type":"theme","slug":"classified-pro","name":"ClassifiedPro - reCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2025-10-15T17:58:17Z","updated":"2025-11-25T05:44:51Z"},{"id":"wordfence:2954a007-37ac-4811-a258-b3fdd738043f","source":"wordfence","cve":"CVE-2022-37599","title":"loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service","severity":"low","cvss":3.7,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2954a007-37ac-4811-a258-b3fdd738043f?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-ordering","name":"Simple Page Ordering","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"},{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"},{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29582084-4179-404e-a895-465525a9d3a1","source":"wordfence","cve":"CVE-2026-102397","title":"Ultimate Maps by Supsystic <= 1.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29582084-4179-404e-a895-465525a9d3a1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-30T13:42:10Z","updated":"2026-10-08T23:13:39Z"},{"id":"wordfence:29590e8b-dd4d-48e8-b374-4dbfb33ebe8c","source":"wordfence","cve":"CVE-2025-48248","title":"Sitewide Discount for WooCommerce: Apply Discount to All Products <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29590e8b-dd4d-48e8-b374-4dbfb33ebe8c?source=api-prod","affected":[{"type":"plugin","slug":"global-shop-discount-for-woocommerce","name":"Sitewide Discount for WooCommerce: Apply Discount to All Products","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:48:09Z"},{"id":"wordfence:2959ae2f-ef16-45d8-920f-56b141ad955e","source":"wordfence","cve":"CVE-2024-2405","title":"Float menu \u2013 awesome floating side menu <= 6.0 - Cross-Site Request Forgery to Menu Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2959ae2f-ef16-45d8-920f-56b141ad955e?source=api-prod","affected":[{"type":"plugin","slug":"float-menu","name":"Float menu \u2013 awesome floating side menu","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:36:07Z"},{"id":"wordfence:2959c04a-70bd-4f5c-a61a-1eab2609f8ef","source":"wordfence","cve":"CVE-2026-2511","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2959c04a-70bd-4f5c-a61a-1eab2609f8ef?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T13:26:09Z"},{"id":"wordfence:295e67ef-0d68-4b76-8dab-54dc916f3569","source":"wordfence","cve":"CVE-2025-59012","title":"Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/295e67ef-0d68-4b76-8dab-54dc916f3569?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2025-09-06T00:00:00Z","updated":"2025-10-15T20:15:52Z"},{"id":"wordfence:295f7b2a-bc41-4a24-bde1-47d53237d6d0","source":"wordfence","cve":"CVE-2025-49858","title":"Arconix Shortcodes <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/295f7b2a-bc41-4a24-bde1-47d53237d6d0?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:55:29Z"},{"id":"wordfence:2961d6ef-f039-45dd-b47e-8b85c409668c","source":"wordfence","cve":"CVE-2025-22743","title":"Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2961d6ef-f039-45dd-b47e-8b85c409668c?source=api-prod","affected":[{"type":"plugin","slug":"twitter-bootstrap-collapse-aka-accordian-shortcode","name":"Twitter Bootstrap Collapse aka Accordian Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:36:11Z"},{"id":"wordfence:29640c6c-cebb-48ec-b7e6-044d0426d015","source":"wordfence","cve":"CVE-2025-67983","title":"Visitor Statistics (Real Time Traffic) <= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29640c6c-cebb-48ec-b7e6-044d0426d015?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.3","to_inclusive":true,"patched_in":"8.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:03:51Z"},{"id":"wordfence:29652f77-032c-4637-9dbf-cfd26b56ff19","source":"wordfence","cve":"CVE-2024-5169","title":"Video Widget <= 1.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29652f77-032c-4637-9dbf-cfd26b56ff19?source=api-prod","affected":[{"type":"plugin","slug":"video-widget","name":"Video Widget","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:56:06Z"},{"id":"wordfence:296f15eb-0782-4351-a2c5-c8ef6f005352","source":"wordfence","cve":"","title":"TrustProfile <= 3.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/296f15eb-0782-4351-a2c5-c8ef6f005352?source=api-prod","affected":[{"type":"plugin","slug":"trustprofile","name":"Trustprofile and reviews for WordPress","from":"*","from_inclusive":true,"to":"3.25","to_inclusive":false,"patched_in":"3.25"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:296f8a23-8223-4d9c-a238-d93fcd5abd87","source":"wordfence","cve":"CVE-2023-6035","title":"EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/296f8a23-8223-4d9c-a238-d93fcd5abd87?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29700844-b41d-4f10-90a7-06c8574d8d2a","source":"wordfence","cve":"CVE-2023-2714","title":"Groundhogg <= 2.7.9.8 - Missing Authorization to Update License","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29700844-b41d-4f10-90a7-06c8574d8d2a?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2970bea4-4641-4885-b996-2bf0b848e1ec","source":"wordfence","cve":"CVE-2024-29814","title":"Exchange Rates Widget <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2970bea4-4641-4885-b996-2bf0b848e1ec?source=api-prod","affected":[{"type":"plugin","slug":"exchange-rates-widget","name":"Exchange Rates Widget","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:05:05Z"},{"id":"wordfence:2970ea7e-bd36-4b43-bc55-bc545efbeb67","source":"wordfence","cve":"CVE-2025-54676","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2970ea7e-bd36-4b43-bc55-bc545efbeb67?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:01:00Z"},{"id":"wordfence:2970f163-4fcd-48d8-b153-82d733b728dd","source":"wordfence","cve":"CVE-2025-53328","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.11.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2970f163-4fcd-48d8-b153-82d733b728dd?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.11.0","to_inclusive":true,"patched_in":"19.11.1"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-05T15:32:00Z"},{"id":"wordfence:2971344c-4162-4d44-90cb-28a922fdb909","source":"wordfence","cve":"CVE-2025-49970","title":"Hello FSE Blog <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2971344c-4162-4d44-90cb-28a922fdb909?source=api-prod","affected":[{"type":"theme","slug":"hello-fse-blog","name":"Hello FSE Blog","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:53:33Z"},{"id":"wordfence:2971547d-39da-46f1-b62c-1918042ae654","source":"wordfence","cve":"","title":"Image News Slider <= 3.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2971547d-39da-46f1-b62c-1918042ae654?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-news-slider","name":"Image News Slider","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2012-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2972cdaf-2d0a-4b55-b4f5-ccf01ff5352c","source":"wordfence","cve":"CVE-2021-4390","title":"Contact Form 7 Style <= 3.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2972cdaf-2d0a-4b55-b4f5-ccf01ff5352c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-style","name":"Contact Form 7 Style","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29778d95-4859-4383-91c7-15e7907b825c","source":"wordfence","cve":"CVE-2018-20148","title":"WordPress Core < 5.0.1 - PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29778d95-4859-4383-91c7-15e7907b825c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:297b9605-602f-458f-8b36-a184cdbd20df","source":"wordfence","cve":"CVE-2024-32559","title":"WP 404 Auto Redirect to Similar Post <= 1.0.4 - Reflected Cross-Site Scripting via Debug Mode URI","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/297b9605-602f-458f-8b36-a184cdbd20df?source=api-prod","affected":[{"type":"plugin","slug":"wp-404-auto-redirect-to-similar-post","name":"WP 404 Auto Redirect to Similar Post","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:36:04Z"},{"id":"wordfence:297c7411-5065-458c-8cad-4f6243610b8a","source":"wordfence","cve":"CVE-2024-34762","title":"Advanced Custom Fields Pro <= 6.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/297c7411-5065-458c-8cad-4f6243610b8a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"6.2.10"}],"published":"2024-05-15T00:00:00Z","updated":"2024-06-18T15:50:49Z"},{"id":"wordfence:29809d5d-3550-4047-8b6a-7ac64da5c75b","source":"wordfence","cve":"CVE-2026-22500","title":"m2 | Construction and Tools Store <= 1.1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29809d5d-3550-4047-8b6a-7ac64da5c75b?source=api-prod","affected":[{"type":"theme","slug":"m2-ce","name":"m2 | Construction and Tools Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:39:44Z"},{"id":"wordfence:2984b9ca-e821-4c23-b792-4d0e54e44a7c","source":"wordfence","cve":"CVE-2021-24178","title":"Business Directory Plugin < 5.11 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2984b9ca-e821-4c23-b792-4d0e54e44a7c?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2021-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2987a5cf-4655-4d37-ae85-6f4775cc6802","source":"wordfence","cve":"","title":"JobSearch WP Job Board < 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2987a5cf-4655-4d37-ae85-6f4775cc6802?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2020-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2988bb1f-0a32-4e9b-8096-46476879317b","source":"wordfence","cve":"CVE-2025-53580","title":"Simple Business Directory Pro < 15.6.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2988bb1f-0a32-4e9b-8096-46476879317b?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-directory-pro","name":"Simple Business Directory Pro","from":"*","from_inclusive":true,"to":"15.6.9","to_inclusive":false,"patched_in":"15.6.9"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:19:46Z"},{"id":"wordfence:298a1927-118c-4dca-a783-9cc7e94d0b07","source":"wordfence","cve":"CVE-2024-35735","title":"WP Time Slots Booking Form <= 1.2.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298a1927-118c-4dca-a783-9cc7e94d0b07?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:22:33Z"},{"id":"wordfence:298af603-43fc-4fde-83b5-ac36f1b35bca","source":"wordfence","cve":"CVE-2024-3644","title":"Newsletter Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298af603-43fc-4fde-83b5-ac36f1b35bca?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-06T13:06:55Z"},{"id":"wordfence:298c6338-167f-499d-b4f2-852db2392b34","source":"wordfence","cve":"CVE-2025-9116","title":"WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298c6338-167f-499d-b4f2-852db2392b34?source=api-prod","affected":[{"type":"plugin","slug":"wps-visitor-counter","name":"WPS Visitor Counter","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-19T17:27:58Z"},{"id":"wordfence:298e6e77-b4bd-4476-ae8b-39fef045fbdb","source":"wordfence","cve":"CVE-2025-31024","title":"RJ Quickcharts <= 0.6.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298e6e77-b4bd-4476-ae8b-39fef045fbdb?source=api-prod","affected":[{"type":"plugin","slug":"rj-quickcharts","name":"RJ Quickcharts","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-10T13:08:58Z"},{"id":"wordfence:298f9c53-7ddc-4f2b-a212-5149c566fb8d","source":"wordfence","cve":"CVE-2026-84835","title":"RentSyst \u2013 CRM solution for fleet management <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298f9c53-7ddc-4f2b-a212-5149c566fb8d?source=api-prod","affected":[{"type":"plugin","slug":"rentsyst","name":"RentSyst \u2013 CRM solution for fleet management","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:17:57Z"},{"id":"wordfence:298fa9e6-9487-4d3d-95de-5820a3761bdd","source":"wordfence","cve":"CVE-2025-32602","title":"WooMS <= 9.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/298fa9e6-9487-4d3d-95de-5820a3761bdd?source=api-prod","affected":[{"type":"plugin","slug":"wooms","name":"WooMS","from":"*","from_inclusive":true,"to":"9.12","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T18:24:15Z"},{"id":"wordfence:2990a3ba-3dad-4204-bccc-ed5c23d9d581","source":"wordfence","cve":"CVE-2026-8870","title":"Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2990a3ba-3dad-4204-bccc-ed5c23d9d581?source=api-prod","affected":[{"type":"plugin","slug":"team-master","name":"Team Master \u2013 A Modern WordPress Team Showcase","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:35Z","updated":"2026-05-27T05:31:21Z"},{"id":"wordfence:2990b307-2b07-4daf-917b-d9587253cbeb","source":"wordfence","cve":"CVE-2023-52208","title":"Constant Contact Forms <= 2.4.2 - Information Disclosure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2990b307-2b07-4daf-917b-d9587253cbeb?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms","name":"Constant Contact Forms","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2990f542-29a8-49d6-aa92-455208b935f1","source":"wordfence","cve":"CVE-2025-52772","title":"Virtual Moderator <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2990f542-29a8-49d6-aa92-455208b935f1?source=api-prod","affected":[{"type":"plugin","slug":"virtual-moderator","name":"Virtual Moderator","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:00:21Z"},{"id":"wordfence:2996c61b-9537-40d1-b652-a4f7a9066966","source":"wordfence","cve":"CVE-2025-66162","title":"Spoter for Elementor <= 1.04 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2996c61b-9537-40d1-b652-a4f7a9066966?source=api-prod","affected":[{"type":"plugin","slug":"spoter-elementor","name":"Spoter for Elementor","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:03:52Z"},{"id":"wordfence:299ae409-42a5-411f-927b-e58d21449263","source":"wordfence","cve":"CVE-2026-32334","title":"JobScout <= 1.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/299ae409-42a5-411f-927b-e58d21449263?source=api-prod","affected":[{"type":"theme","slug":"jobscout","name":"JobScout","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:45:32Z"},{"id":"wordfence:299c4290-dc7e-44fb-887e-e3e53d3c070b","source":"wordfence","cve":"CVE-2023-47695","title":"Shortcodes Finder <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/299c4290-dc7e-44fb-887e-e3e53d3c070b?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-finder","name":"Shortcodes Finder","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:299ed515-ba64-413a-a03a-2db801520ae0","source":"wordfence","cve":"CVE-2024-13686","title":"VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/299ed515-ba64-413a-a03a-2db801520ae0?source=api-prod","affected":[{"type":"theme","slug":"vw-storefront","name":"VW Storefront","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-04T03:37:58Z"},{"id":"wordfence:29a1359b-6075-4ebd-a77e-6052d173b801","source":"wordfence","cve":"CVE-2026-32582","title":"IATO MCP <= 1.12.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a1359b-6075-4ebd-a77e-6052d173b801?source=api-prod","affected":[{"type":"plugin","slug":"iato-mcp","name":"IATO MCP","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T12:51:56Z"},{"id":"wordfence:29a160ea-5582-4028-8621-7988e3a8cabf","source":"wordfence","cve":"CVE-2024-8917","title":"AnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a160ea-5582-4028-8621-7988e3a8cabf?source=api-prod","affected":[{"type":"plugin","slug":"football-leagues-by-anwppro","name":"AnWP Football Leagues","from":"*","from_inclusive":true,"to":"0.16.7","to_inclusive":true,"patched_in":"0.16.8"}],"published":"2024-09-23T18:14:04Z","updated":"2024-09-24T06:40:56Z"},{"id":"wordfence:29a2cb14-bf70-4936-a7c9-bf417a403de8","source":"wordfence","cve":"CVE-2024-30488","title":"Zotpress <= 7.3.7 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a2cb14-bf70-4936-a7c9-bf417a403de8?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.7","to_inclusive":true,"patched_in":"7.3.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:23:05Z"},{"id":"wordfence:29a39cd9-a190-40b3-897d-c7a6ac781605","source":"wordfence","cve":"CVE-2025-23877","title":"Nite Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a39cd9-a190-40b3-897d-c7a6ac781605?source=api-prod","affected":[{"type":"plugin","slug":"nite-shortcodes","name":"Nite Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:06:26Z"},{"id":"wordfence:29a45e1b-f33a-46ff-8a42-b5b0c07d90d6","source":"wordfence","cve":"CVE-2026-78137","title":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a45e1b-f33a-46ff-8a42-b5b0c07d90d6?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:51:25Z"},{"id":"wordfence:29a560fa-03bf-435c-85da-68397deab2a6","source":"wordfence","cve":"CVE-2026-3079","title":"LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a560fa-03bf-435c-85da-68397deab2a6?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.3.1"}],"published":"2026-03-23T12:12:23Z","updated":"2026-03-24T01:25:21Z"},{"id":"wordfence:29a5701f-92f7-4a02-a990-b189a381cff5","source":"wordfence","cve":"CVE-2026-4352","title":"JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a5701f-92f7-4a02-a990-b189a381cff5?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.6.1","to_inclusive":true,"patched_in":"3.8.6.2"}],"published":"2026-04-13T12:57:24Z","updated":"2026-04-14T01:25:01Z"},{"id":"wordfence:29a7aa52-ebbf-4185-a9ed-c24cb7d1f03b","source":"wordfence","cve":"CVE-2024-34794","title":"Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29a7aa52-ebbf-4185-a9ed-c24cb7d1f03b?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.3","to_inclusive":true,"patched_in":"0.21.4"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:08:38Z"},{"id":"wordfence:29abbd93-b353-4cf1-9027-0825e1a2aa3d","source":"wordfence","cve":"CVE-2025-69349","title":"RSS Feed Widget <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29abbd93-b353-4cf1-9027-0825e1a2aa3d?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T14:54:02Z"},{"id":"wordfence:29adf3d2-b3a4-43f3-9aaa-bd2cf6cd115b","source":"wordfence","cve":"CVE-2017-1002019","title":"Eventr <= 1.02.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29adf3d2-b3a4-43f3-9aaa-bd2cf6cd115b?source=api-prod","affected":[{"type":"plugin","slug":"eventr","name":"Eventr","from":"*","from_inclusive":true,"to":"1.02.2","to_inclusive":true,"patched_in":""}],"published":"2017-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29b09367-6a27-4024-a71c-233aaee6c310","source":"wordfence","cve":"CVE-2023-32506","title":"Link Whisper Free <= 0.6.3 - Missing Authorization via init()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b09367-6a27-4024-a71c-233aaee6c310?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":"0.6.4"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29b0fd97-a669-42bb-b01e-bdc0395d697e","source":"wordfence","cve":"CVE-2025-13794","title":"Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-12-15T16:51:43Z","updated":"2026-02-11T15:28:44Z"},{"id":"wordfence:29b1984d-e6da-49d5-8b40-cdf2f1bcc1bb","source":"wordfence","cve":"CVE-2026-5743","title":"Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b1984d-e6da-49d5-8b40-cdf2f1bcc1bb?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.3.3.1","to_inclusive":true,"patched_in":"3.3.3.2"}],"published":"2026-07-10T14:09:00Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:29b1bab8-0620-4d4b-a3c7-dfadd3a156e1","source":"wordfence","cve":"CVE-2025-22725","title":"Virtual Assistant <= 3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b1bab8-0620-4d4b-a3c7-dfadd3a156e1?source=api-prod","affected":[{"type":"plugin","slug":"VirtualAssistant","name":"WP Virtual Assistant","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T17:30:39Z"},{"id":"wordfence:29b471ac-3a08-42da-9907-670c3b3bae92","source":"wordfence","cve":"CVE-2024-1935","title":"Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b471ac-3a08-42da-9907-670c3b3bae92?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.5","to_inclusive":true,"patched_in":"1.12.7"}],"published":"2024-02-29T00:00:00Z","updated":"2024-05-31T15:30:12Z"},{"id":"wordfence:29b4c20b-486c-45d4-904f-561d6624d477","source":"wordfence","cve":"","title":"CRM: Contact Management Simplified \u2013 UkuuPeople <= 1.6.3 - Cross-Site Request Forgery to Favorite Addition/Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b4c20b-486c-45d4-904f-561d6624d477?source=api-prod","affected":[{"type":"plugin","slug":"ukuupeople-the-simple-crm","name":"CRM: Contact Management Simplified \u2013 UkuuPeople","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29b53c80-68d5-4431-a49b-0d139c9403f2","source":"wordfence","cve":"CVE-2023-24404","title":"Marketing Performance <= 2.0.0 - Unauthenticated Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b53c80-68d5-4431-a49b-0d139c9403f2?source=api-prod","affected":[{"type":"plugin","slug":"marketing-performance","name":"Marketing Performance","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29b81e96-d950-405a-abcb-c457e104b86b","source":"wordfence","cve":"CVE-2024-32102","title":"Crony Cronjob Manager <= 0.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b81e96-d950-405a-abcb-c457e104b86b?source=api-prod","affected":[{"type":"plugin","slug":"crony","name":"Crony Cronjob Manager","from":"*","from_inclusive":true,"to":"0.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:21:24Z"},{"id":"wordfence:29b9cb4a-741d-4c38-b458-abd9900a8dce","source":"wordfence","cve":"CVE-2015-2329","title":"WooCommerce <= 2.3.5 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9cb4a-741d-4c38-b458-abd9900a8dce?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":false,"patched_in":"2.3.6"}],"published":"2015-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29b9d978-f8b0-48f9-a10e-7e61a4f4a828","source":"wordfence","cve":"CVE-2026-103999","title":"Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29b9d978-f8b0-48f9-a10e-7e61a4f4a828?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.54","to_inclusive":true,"patched_in":"3.5.55"}],"published":"2026-10-15T17:09:49Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:29c0fb4d-c38c-4c78-9e15-797f3c3a4b30","source":"wordfence","cve":"CVE-2026-1104","title":"FastDup \u2013 Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c0fb4d-c38c-4c78-9e15-797f3c3a4b30?source=api-prod","affected":[{"type":"plugin","slug":"fastdup","name":"FastDup \u2013 Fastest WordPress Migration & Duplicator","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-12T14:25:41Z"},{"id":"wordfence:29c16a8e-35a6-4bc8-b89a-186d89effd77","source":"wordfence","cve":"CVE-2026-28017","title":"Green Thumb <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c16a8e-35a6-4bc8-b89a-186d89effd77?source=api-prod","affected":[{"type":"theme","slug":"greenthumb","name":"Green Thumb | Gardening & Landscaping Services WP","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:23:53Z"},{"id":"wordfence:29c33526-3a60-45ab-95ef-22c78b310f74","source":"wordfence","cve":"CVE-2026-92974","title":"Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c33526-3a60-45ab-95ef-22c78b310f74?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.46","to_inclusive":true,"patched_in":"1.8.47"}],"published":"2026-10-02T18:11:07Z","updated":"2026-10-03T06:38:22Z"},{"id":"wordfence:29c3922d-6c88-43c4-b76d-56bc27827157","source":"wordfence","cve":"CVE-2026-87844","title":"Product Designer <= 1.0.40 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c3922d-6c88-43c4-b76d-56bc27827157?source=api-prod","affected":[{"type":"plugin","slug":"product-designer","name":"PickPlugins Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":""}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:43:53Z"},{"id":"wordfence:29c47391-5d37-4f49-8806-1f378a6306d0","source":"wordfence","cve":"CVE-2023-0876","title":"WP Meta SEO <= 4.5.2 - Missing Authorization in 'startProcess' to Arbitrary Redirect via 'update_link_redirect' task","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c47391-5d37-4f49-8806-1f378a6306d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29c762c7-7bb9-42bc-9e22-0f4da2a5c59b","source":"wordfence","cve":"CVE-2023-7203","title":"Smart Forms <= 2.6.86 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c762c7-7bb9-42bc-9e22-0f4da2a5c59b?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.86","to_inclusive":true,"patched_in":"2.6.87"}],"published":"2024-02-02T00:00:00Z","updated":"2024-03-22T17:30:44Z"},{"id":"wordfence:29c97617-78b1-4798-99a6-488176070e4a","source":"wordfence","cve":"CVE-2022-4374","title":"Bg Bible References <= 3.8.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29c97617-78b1-4798-99a6-488176070e4a?source=api-prod","affected":[{"type":"plugin","slug":"bg-biblie-references","name":"Bg Bible References","from":"*","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":""}],"published":"2022-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29ca151b-ef37-4f68-b0ea-b199ad6a4fce","source":"wordfence","cve":"CVE-2024-38717","title":"Booking Ultra Pro <= 1.1.13 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29ca151b-ef37-4f68-b0ea-b199ad6a4fce?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-27T17:00:34Z"},{"id":"wordfence:29cbcbc9-a2a3-4518-a430-969ca76f9bda","source":"wordfence","cve":"CVE-2024-51888","title":"Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29cbcbc9-a2a3-4518-a430-969ca76f9bda?source=api-prod","affected":[{"type":"plugin","slug":"homey-login-register","name":"Homey Login Register","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:55:06Z"},{"id":"wordfence:29cbde71-772f-473c-9cad-0c5529b1aa97","source":"wordfence","cve":"CVE-2025-39490","title":"Backpack Traveler <= 2.10.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29cbde71-772f-473c-9cad-0c5529b1aa97?source=api-prod","affected":[{"type":"theme","slug":"backpacktraveler","name":"Backpack Traveler - Modern Travel Blog WordPress Theme","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:10:28Z"},{"id":"wordfence:29cc5016-005e-48e8-b929-5064798f24da","source":"wordfence","cve":"CVE-2025-10740","title":"URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation","severity":"medium","cvss":6.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc5016-005e-48e8-b929-5064798f24da?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T20:11:12Z","updated":"2025-10-24T08:23:58Z"},{"id":"wordfence:29cc82cb-f3fd-4de5-9731-7ceb1212b0f9","source":"wordfence","cve":"CVE-2024-3680","title":"Enter Addons \u2013 Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-21T13:29:23Z"},{"id":"wordfence:29d112ca-c793-4459-a5a0-7f1a3de9de71","source":"wordfence","cve":"CVE-2022-27847","title":"Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d112ca-c793-4459-a5a0-7f1a3de9de71?source=api-prod","affected":[{"type":"plugin","slug":"yoo-slider","name":"Yoo Slider \u2013 Image Slider & Video Slider","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-04-11T17:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29d13457-ac60-4e3d-9d8b-0141e6f8f4f6","source":"wordfence","cve":"CVE-2026-1866","title":"Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d13457-ac60-4e3d-9d8b-0141e6f8f4f6?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.32.0","to_inclusive":true,"patched_in":"1.32.1"}],"published":"2026-02-09T20:45:53Z","updated":"2026-02-10T09:26:07Z"},{"id":"wordfence:29d22612-8e0d-4275-b370-9729352c951e","source":"wordfence","cve":"CVE-2024-12634","title":"Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d22612-8e0d-4275-b370-9729352c951e?source=api-prod","affected":[{"type":"plugin","slug":"related-post","name":"Related Posts By PickPlugins","from":"2.0.59","from_inclusive":true,"to":"2.0.59","to_inclusive":true,"patched_in":"2.0.60"}],"published":"2025-03-06T21:30:44Z","updated":"2025-03-07T11:12:56Z"},{"id":"wordfence:29d430a7-e730-412f-b4cf-16505975f856","source":"wordfence","cve":"CVE-2025-28996","title":"GPP Slideshow <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d430a7-e730-412f-b4cf-16505975f856?source=api-prod","affected":[{"type":"plugin","slug":"gpp-slideshow","name":"GPP Slideshow","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:05:36Z"},{"id":"wordfence:29d4e568-5f6c-4bbf-a0db-96039f3ccdf9","source":"wordfence","cve":"CVE-2025-47627","title":"PrivateContent - Mail Actions <= 2.3.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d4e568-5f6c-4bbf-a0db-96039f3ccdf9?source=api-prod","affected":[{"type":"plugin","slug":"private-content-mail-actions","name":"PrivateContent - Mail Actions","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:42:07Z"},{"id":"wordfence:29d6120e-38fe-4b56-ba99-fa95eb1d3ad6","source":"wordfence","cve":"CVE-2025-53432","title":"Echo <= 1.15.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d6120e-38fe-4b56-ba99-fa95eb1d3ad6?source=api-prod","affected":[{"type":"theme","slug":"echo","name":"echo","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:24:53Z"},{"id":"wordfence:29d6df4e-eaf6-42ec-8cd9-7cf86908f4ef","source":"wordfence","cve":"CVE-2023-36523","title":"Email download link <= 3.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d6df4e-eaf6-42ec-8cd9-7cf86908f4ef?source=api-prod","affected":[{"type":"plugin","slug":"email-download-link","name":"Email download link","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29d72347-ba49-45c6-a964-2c75064ac866","source":"wordfence","cve":"CVE-2024-12066","title":"SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d72347-ba49-45c6-a964-2c75064ac866?source=api-prod","affected":[{"type":"plugin","slug":"smsa-shipping-official","name":"SMSA Shipping (official)","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-20T18:45:53Z","updated":"2025-01-30T16:44:51Z"},{"id":"wordfence:29d962c0-31dc-4320-a9ce-3ed71d4f9943","source":"wordfence","cve":"CVE-2021-24327","title":"SEO Redirection <= 6.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29d962c0-31dc-4320-a9ce-3ed71d4f9943?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"7.1"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29da4c49-3608-4bff-8184-01dc08752403","source":"wordfence","cve":"CVE-2022-27855","title":"Fatcat Apps Analytics Cat <= 1.0.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29da4c49-3608-4bff-8184-01dc08752403?source=api-prod","affected":[{"type":"plugin","slug":"analytics-cat","name":"Analytics Cat \u2013 Google Analytics Made Easy","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-03-08T21:49:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29de27d3-e9f5-4e73-8b6d-4491d2151d7f","source":"wordfence","cve":"CVE-2024-50548","title":"Awesome Progress Bar <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29de27d3-e9f5-4e73-8b6d-4491d2151d7f?source=api-prod","affected":[{"type":"plugin","slug":"awesome-progess-bar","name":"Awesome Progress Bar","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-10-31T00:00:00Z","updated":"2025-10-02T22:27:29Z"},{"id":"wordfence:29de766d-5e7e-46b4-acac-feec5b33589e","source":"wordfence","cve":"CVE-2026-10865","title":"Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29de766d-5e7e-46b4-acac-feec5b33589e?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2026-07-10T17:35:16Z","updated":"2026-07-11T05:35:46Z"},{"id":"wordfence:29dff562-e9b0-4cc9-b974-9239fbf0310f","source":"wordfence","cve":"CVE-2026-11426","title":"UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29dff562-e9b0-4cc9-b974-9239fbf0310f?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-page","name":"Under Construction Page (Pro)","from":"*","from_inclusive":true,"to":"5.76","to_inclusive":true,"patched_in":"5.81"}],"published":"2026-07-10T13:21:10Z","updated":"2026-07-11T01:29:22Z"},{"id":"wordfence:29e214fd-327b-45c4-a408-7ff56fd29876","source":"wordfence","cve":"CVE-2024-52376","title":"Boat Rental Plugin for WordPress <= 1.0.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e214fd-327b-45c4-a408-7ff56fd29876?source=api-prod","affected":[{"type":"plugin","slug":"boat-rental-system","name":"Boat Rental Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:38:46Z"},{"id":"wordfence:29e2ff11-053b-45cc-adf1-d276f1ee576e","source":"wordfence","cve":"CVE-2024-0379","title":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e2ff11-053b-45cc-adf1-d276f1ee576e?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-02-06T00:00:00Z","updated":"2024-07-29T21:36:04Z"},{"id":"wordfence:29e3a20b-6b64-4eaf-93de-146a95d340c5","source":"wordfence","cve":"CVE-2026-24948","title":"Reflector <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e3a20b-6b64-4eaf-93de-146a95d340c5?source=api-prod","affected":[{"type":"plugin","slug":"reflector-plugins","name":"Reflector","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:40:54Z"},{"id":"wordfence:29e49f76-9769-41c9-aeed-9e2857ebbd25","source":"wordfence","cve":"CVE-2023-22714","title":"Coming Soon by Supsystic <= 1.7.10 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e49f76-9769-41c9-aeed-9e2857ebbd25?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-by-supsystic","name":"Maintenance Mode by Supsystic","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:29e76d57-217f-4f21-8bc6-a86290783a19","source":"wordfence","cve":"CVE-2026-1426","title":"Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e76d57-217f-4f21-8bc6-a86290783a19?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ajax-filters","name":"Advanced AJAX Product Filters","from":"*","from_inclusive":true,"to":"3.1.9.6","to_inclusive":true,"patched_in":"3.1.9.7"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T14:25:01Z"},{"id":"wordfence:29e81910-1bb2-4102-8542-520dcaffe208","source":"wordfence","cve":"CVE-2026-87891","title":"Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution < 1.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e81910-1bb2-4102-8542-520dcaffe208?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:54:30Z"},{"id":"wordfence:29e9ad80-6a02-494a-9d53-0f14728952aa","source":"wordfence","cve":"CVE-2026-1889","title":"Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e9ad80-6a02-494a-9d53-0f14728952aa?source=api-prod","affected":[{"type":"plugin","slug":"outgrow","name":"Outgrow","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:06Z","updated":"2026-03-21T03:26:38Z"},{"id":"wordfence:29e9cbca-5ed1-4619-a2a7-60b0f001e8d9","source":"wordfence","cve":"CVE-2025-31865","title":"SMS Abandoned Cart Recovery \u2726 CartBoss <= 4.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29e9cbca-5ed1-4619-a2a7-60b0f001e8d9?source=api-prod","affected":[{"type":"plugin","slug":"cartboss","name":"SMS Abandoned Cart Recovery \u2013 CartBoss","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-18T13:42:10Z"},{"id":"wordfence:29ea6ec6-3dc8-4bb6-bdec-bc2a24d2478b","source":"wordfence","cve":"CVE-2025-23911","title":"Solidres \u2013 Hotel booking plugin <= 0.9.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29ea6ec6-3dc8-4bb6-bdec-bc2a24d2478b?source=api-prod","affected":[{"type":"plugin","slug":"solidres","name":"Solidres \u2013 Hotel booking plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T21:00:47Z"},{"id":"wordfence:29eeac86-6b33-49e6-a7e1-c80dee383d6f","source":"wordfence","cve":"CVE-2024-13838","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29eeac86-6b33-49e6-a7e1-c80dee383d6f?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T07:00:22Z"},{"id":"wordfence:29ef1755-f1c4-4251-bd4c-2fe97f291994","source":"wordfence","cve":"CVE-2024-6019","title":"Music Request Manager <= 1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29ef1755-f1c4-4251-bd4c-2fe97f291994?source=api-prod","affected":[{"type":"plugin","slug":"music-request-manager","name":"Music Request Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:17:29Z"},{"id":"wordfence:29ef6956-aeb7-4a72-9f51-b5c5b05c1425","source":"wordfence","cve":"CVE-2024-13589","title":"YouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29ef6956-aeb7-4a72-9f51-b5c5b05c1425?source=api-prod","affected":[{"type":"plugin","slug":"jma-youtube-playlists-with-schema","name":"YouTube Playlists with Schema","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:29:30Z","updated":"2025-02-19T07:32:06Z"},{"id":"wordfence:29f21ad3-f2d9-48bf-99d6-fb80b8f3822f","source":"wordfence","cve":"CVE-2025-24676","title":"Custom WP Store Locator <= 1.4.7 - Reflected Cross-Site SCripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29f21ad3-f2d9-48bf-99d6-fb80b8f3822f?source=api-prod","affected":[{"type":"plugin","slug":"custom-store-locator","name":"Custom WP Store Locator","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-21T14:22:06Z"},{"id":"wordfence:29f3be0b-c91b-4dd3-a37f-ecda8a5d2d90","source":"wordfence","cve":"CVE-2025-48272","title":"WP Job Portal <= 2.3.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29f3be0b-c91b-4dd3-a37f-ecda8a5d2d90?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:56:12Z"},{"id":"wordfence:29f6e37a-1f73-480e-984b-c24e2eaa55f5","source":"wordfence","cve":"CVE-2024-37439","title":"Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Missing Authorization to Arbitrary Page/Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29f6e37a-1f73-480e-984b-c24e2eaa55f5?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-toolkit-pro","name":"Uncanny Toolkit Pro for LearnDash","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.4.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:23:49Z"},{"id":"wordfence:29f835c8-769a-47c0-832f-622860b1c59c","source":"wordfence","cve":"CVE-2025-1039","title":"Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29f835c8-769a-47c0-832f-622860b1c59c?source=api-prod","affected":[{"type":"plugin","slug":"lenix-elementor-leads-addon","name":"Lenix Leads Collector","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T12:41:34Z"},{"id":"wordfence:29fe0bc9-b460-4158-86fc-ad2980cc827a","source":"wordfence","cve":"CVE-2026-120477","title":"Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29fe0bc9-b460-4158-86fc-ad2980cc827a?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2026.6","to_inclusive":true,"patched_in":"2026.7"}],"published":"2026-11-06T15:44:44Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:29fee127-73f5-4cd5-9bfb-799f1c0a9f83","source":"wordfence","cve":"CVE-2021-24398","title":"Responsive 3D Slider <= 1.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/29fee127-73f5-4cd5-9bfb-799f1c0a9f83?source=api-prod","affected":[{"type":"plugin","slug":"morpheus-slider","name":"RESPONSIVE 3D SLIDER","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a001b31-042d-451b-ad9e-df8d41d3c2b0","source":"wordfence","cve":"CVE-2025-3867","title":"Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a001b31-042d-451b-ad9e-df8d41d3c2b0?source=api-prod","affected":[{"type":"plugin","slug":"ajax-comment-form-cst","name":"Ajax Comment Form CST","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T18:32:15Z","updated":"2025-04-25T06:45:27Z"},{"id":"wordfence:2a0381b1-9b63-41cb-8125-d22274b98867","source":"wordfence","cve":"","title":"GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0381b1-9b63-41cb-8125-d22274b98867?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a0671b1-1414-4315-8a2d-bd1aabe091a4","source":"wordfence","cve":"CVE-2024-11281","title":"WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0671b1-1414-4315-8a2d-bd1aabe091a4?source=api-prod","affected":[{"type":"plugin","slug":"woo-point-of-sale","name":"WooCommerce Point of Sale","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T06:42:14Z"},{"id":"wordfence:2a06dc0d-f002-4f82-b380-0e329b022dc9","source":"wordfence","cve":"CVE-2018-20463","title":"JSmol2WP <= 1.07 - Server-Side Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a06dc0d-f002-4f82-b380-0e329b022dc9?source=api-prod","affected":[{"type":"plugin","slug":"jsmol2wp","name":"JSmol2WP","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":""}],"published":"2018-12-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a090167-0ea9-47f9-be8f-fe392da9ec38","source":"wordfence","cve":"CVE-2024-32775","title":"Embed Google Photos album <= 2.1.9 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a090167-0ea9-47f9-be8f-fe392da9ec38?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-photos-album-easily","name":"Embed Google Photos album","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:49:02Z"},{"id":"wordfence:2a0cbfe8-8e17-480f-8bcd-39aa06a16415","source":"wordfence","cve":"CVE-2025-64236","title":"Tuturn < 3.6 - Unauthenticated Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0cbfe8-8e17-480f-8bcd-39aa06a16415?source=api-prod","affected":[{"type":"plugin","slug":"tuturn","name":"Tuturn - Online Tutors Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2025-10-15T00:00:00Z","updated":"2025-12-20T19:14:52Z"},{"id":"wordfence:2a0ce4fa-24d7-4c41-a003-999ff9f45a42","source":"wordfence","cve":"CVE-2009-5158","title":"Google Analyticator <= 5.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0ce4fa-24d7-4c41-a003-999ff9f45a42?source=api-prod","affected":[{"type":"plugin","slug":"google-analyticator","name":"Analyticator","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":false,"patched_in":"5.2.1"}],"published":"2009-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a0d07a1-2548-48f5-b9c1-49838ae74053","source":"wordfence","cve":"CVE-2025-30585","title":"Generate Post Thumbnails <= 0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0d07a1-2548-48f5-b9c1-49838ae74053?source=api-prod","affected":[{"type":"plugin","slug":"generate-post-thumbnails","name":"Generate Post Thumbnails","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T19:59:31Z"},{"id":"wordfence:2a0f2774-4677-45a1-9c86-240a6e35f7af","source":"wordfence","cve":"CVE-2022-4329","title":"Product list Widget for Woocommerce <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0f2774-4677-45a1-9c86-240a6e35f7af?source=api-prod","affected":[{"type":"plugin","slug":"gm-woo-product-list-widget","name":"Product Table, Grid, List Builder For WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a0f539c-5d1d-4e1b-9a4b-719c096ba23c","source":"wordfence","cve":"CVE-2024-43922","title":"NitroPack <= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0f539c-5d1d-4e1b-9a4b-719c096ba23c?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.16.7","to_inclusive":true,"patched_in":"1.16.8"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:42:04Z"},{"id":"wordfence:2a0f9f80-e338-4afd-9a4b-e421865c8b0b","source":"wordfence","cve":"CVE-2023-52206","title":"Page Builder: Live Composer <= 1.5.25 -  Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0f9f80-e338-4afd-9a4b-e421865c8b0b?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.28","to_inclusive":true,"patched_in":"1.5.29"}],"published":"2024-01-03T00:00:00Z","updated":"2024-02-23T15:41:37Z"},{"id":"wordfence:2a10d77f-78f4-403e-a77f-1243d671ece9","source":"wordfence","cve":"CVE-2024-52395","title":"Floating Buttons for WooCommerce <= 2.8.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a10d77f-78f4-403e-a77f-1243d671ece9?source=api-prod","affected":[{"type":"plugin","slug":"shop-assistant-for-woocommerce-jarvis","name":"Floating Buttons for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:51:33Z"},{"id":"wordfence:2a121c1f-49a7-4ce9-a2a9-81c0c4baf3d4","source":"wordfence","cve":"CVE-2025-64638","title":"OnPay.io for WooCommerce <= 1.0.47 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a121c1f-49a7-4ce9-a2a9-81c0c4baf3d4?source=api-prod","affected":[{"type":"plugin","slug":"onpay-io-for-woocommerce","name":"OnPay.io for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.47","to_inclusive":true,"patched_in":"1.0.48"}],"published":"2025-11-29T00:00:00Z","updated":"2026-01-05T14:23:01Z"},{"id":"wordfence:2a132817-d3c1-4460-8852-5ab2f7481532","source":"wordfence","cve":"CVE-2025-63002","title":"Sermon Manager <= 2.30.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a132817-d3c1-4460-8852-5ab2f7481532?source=api-prod","affected":[{"type":"plugin","slug":"sermon-manager-for-wordpress","name":"Sermon Manager","from":"*","from_inclusive":true,"to":"2.30.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-19T16:44:01Z"},{"id":"wordfence:2a13ce09-b312-4186-b0e2-63065c47f15d","source":"wordfence","cve":"CVE-2024-6551","title":"GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a13ce09-b312-4186-b0e2-63065c47f15d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.16.0"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T10:59:40Z"},{"id":"wordfence:2a17f466-bc4b-4668-8ff9-e8b316e3b5b7","source":"wordfence","cve":"CVE-2026-2277","title":"rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a17f466-bc4b-4668-8ff9-e8b316e3b5b7?source=api-prod","affected":[{"type":"plugin","slug":"rexcrawler","name":"rexCrawler","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:17:08Z","updated":"2026-03-21T03:26:38Z"},{"id":"wordfence:2a1b7e37-1e30-473c-aadc-176de729e619","source":"wordfence","cve":"CVE-2023-3601","title":"Simple Author Box <= 2.51 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary User Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a1b7e37-1e30-473c-aadc-176de729e619?source=api-prod","affected":[{"type":"plugin","slug":"simple-author-box","name":"Simple Author Box","from":"*","from_inclusive":true,"to":"2.51","to_inclusive":true,"patched_in":"2.52"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a1ee053-18bc-4fcd-8bb9-d5295c503d20","source":"wordfence","cve":"CVE-2025-60211","title":"WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a1ee053-18bc-4fcd-8bb9-d5295c503d20?source=api-prod","affected":[{"type":"plugin","slug":"extendons-registration-fields","name":"WooCommerce Registration Fields Plugin - Custom Signup Fields","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-11-04T16:23:28Z"},{"id":"wordfence:2a203577-0ced-4e1e-a7db-e4ca53a5bade","source":"wordfence","cve":"CVE-2024-33952","title":"Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a203577-0ced-4e1e-a7db-e4ca53a5bade?source=api-prod","affected":[{"type":"theme","slug":"unique","name":"Unique","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:40:32Z"},{"id":"wordfence:2a2124be-358c-47af-97c2-02afbed91a3b","source":"wordfence","cve":"CVE-2021-24355","title":"Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Wildcard Activation and Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a2124be-358c-47af-97c2-02afbed91a3b?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"2.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a225ccb-a7dc-4437-bd97-b309d6ae6a47","source":"wordfence","cve":"CVE-2024-31111","title":"WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a225ccb-a7dc-4437-bd97-b309d6ae6a47?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"5.9.10"},{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"*","from_inclusive":true,"to":"18.6.0","to_inclusive":true,"patched_in":"18.6.1"}],"published":"2024-06-24T00:00:00Z","updated":"2025-04-25T20:35:55Z"},{"id":"wordfence:2a237492-0eb3-46fb-96dc-1959d8a87d1a","source":"wordfence","cve":"CVE-2024-50527","title":"Stacks Mobile App Builder <= 5.2.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a237492-0eb3-46fb-96dc-1959d8a87d1a?source=api-prod","affected":[{"type":"plugin","slug":"stacks-mobile-app-builder","name":"Stacks Mobile App Builder \u2013 The most powerful Mobile Applications Drag and Drop builder","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T20:44:02Z"},{"id":"wordfence:2a275deb-a0e3-491a-bed6-9f6112918061","source":"wordfence","cve":"CVE-2025-13896","title":"Social Feed Gallery Portfolio <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a275deb-a0e3-491a-bed6-9f6112918061?source=api-prod","affected":[{"type":"plugin","slug":"social-feed-gallery-portfolio","name":"Social Feed Gallery Portfolio","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:48:11Z","updated":"2025-12-06T05:49:23Z"},{"id":"wordfence:2a295969-454a-47fb-bc35-4e84db38c887","source":"wordfence","cve":"CVE-2024-8657","title":"Garden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a295969-454a-47fb-bc35-4e84db38c887?source=api-prod","affected":[{"type":"plugin","slug":"garden-gnome-package","name":"Garden Gnome Package","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-09-23T13:46:35Z","updated":"2024-09-24T01:56:46Z"},{"id":"wordfence:2a296dd3-fbcb-4443-a905-9cbaa87faf7d","source":"wordfence","cve":"CVE-2019-15828","title":"One Click SSL <= 1.4.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a296dd3-fbcb-4443-a905-9cbaa87faf7d?source=api-prod","affected":[{"type":"plugin","slug":"one-click-ssl","name":"One Click SSL","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2019-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a2b2a74-30d9-4e62-ab08-bbb2166e9a6b","source":"wordfence","cve":"CVE-2026-57314","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a2b2a74-30d9-4e62-ab08-bbb2166e9a6b?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:56:45Z"},{"id":"wordfence:2a2f4c83-27a6-4c50-b701-8374f21b3799","source":"wordfence","cve":"CVE-2022-0948","title":"Order Listener for WooCommerce \u2013 Play Sounds Instantly on New Orders <= 3.2.1 - Unauthenticated SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a2f4c83-27a6-4c50-b701-8374f21b3799?source=api-prod","affected":[{"type":"plugin","slug":"woc-order-alert","name":"StackWC Order Notification for WooCommerce \u2013 Get Instant Audio Alert on new Orders","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2022-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a3056d4-5ee9-4b31-9ef8-0e55f470ad23","source":"wordfence","cve":"CVE-2024-11444","title":"CLUEVO LMS, E-Learning Platform <= 1.13.2 - Cross-Site Request Forgery to Module Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a3056d4-5ee9-4b31-9ef8-0e55f470ad23?source=api-prod","affected":[{"type":"plugin","slug":"cluevo-lms","name":"CLUEVO LMS, E-Learning Platform","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2024-12-05T19:35:31Z","updated":"2025-11-05T18:57:57Z"},{"id":"wordfence:2a32f428-fa6e-469b-b004-e80a1029af80","source":"wordfence","cve":"CVE-2026-104012","title":"Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-10-30T19:18:58Z","updated":"2026-10-31T07:46:47Z"},{"id":"wordfence:2a331f44-74d1-4481-98fb-27d3d983d8ea","source":"wordfence","cve":"CVE-2024-3941","title":"reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a331f44-74d1-4481-98fb-27d3d983d8ea?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-jetpack","name":"reCAPTCHA Jetpack","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-16T13:10:44Z"},{"id":"wordfence:2a35d392-0ab0-4be8-8b35-70bd2aa9c6dd","source":"wordfence","cve":"CVE-2025-69382","title":"Themesflat Elementor <= 1.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a35d392-0ab0-4be8-8b35-70bd2aa9c6dd?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-elementor","name":"Themesflat Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:12:02Z"},{"id":"wordfence:2a37a0e5-2db5-49fb-8b00-1b820192f1af","source":"wordfence","cve":"CVE-2022-0388","title":"Interactive Medical Drawing of Human Body < 2.4 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a37a0e5-2db5-49fb-8b00-1b820192f1af?source=api-prod","affected":[{"type":"plugin","slug":"interactive-medical-drawing-of-human-body","name":"Interactive Human Anatomy with Clickable Body Parts","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a3d8793-4b6a-4d57-a4cb-410a0e030a7a","source":"wordfence","cve":"CVE-2025-31636","title":"WP Post Modules for Elementor <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a3d8793-4b6a-4d57-a4cb-410a0e030a7a?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-modules-el","name":"WP Post Modules for Elementor","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T14:54:06Z"},{"id":"wordfence:2a3e8c29-2e97-48f0-bf72-303857b51511","source":"wordfence","cve":"CVE-2026-54833","title":"Enable CORS <= 2.0.3 - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a3e8c29-2e97-48f0-bf72-303857b51511?source=api-prod","affected":[{"type":"plugin","slug":"enable-cors","name":"Enable CORS","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-25T13:37:04Z"},{"id":"wordfence:2a3f8ae7-88bc-4ac3-882a-5343721aaa26","source":"wordfence","cve":"CVE-2026-65581","title":"AI ANN - AI Generator & AI Agency WordPress Theme <= 1.29.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a3f8ae7-88bc-4ac3-882a-5343721aaa26?source=api-prod","affected":[{"type":"theme","slug":"ann","name":"AI ANN - AI Generator & AI Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.29.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:00Z"},{"id":"wordfence:2a427b26-4a0d-4351-8a8b-ec5da1345ebd","source":"wordfence","cve":"CVE-2023-7167","title":"Persian Fonts <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a427b26-4a0d-4351-8a8b-ec5da1345ebd?source=api-prod","affected":[{"type":"plugin","slug":"persian-fonts","name":"Persian Fonts","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-01-30T00:00:00Z","updated":"2024-01-31T00:22:52Z"},{"id":"wordfence:2a4289b1-ca9f-4045-a00f-50eba713b52f","source":"wordfence","cve":"CVE-2026-1900","title":"Link Whisper Free < 0.9.1 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4289b1-ca9f-4045-a00f-50eba713b52f?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":false,"patched_in":"0.9.1"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:38:50Z"},{"id":"wordfence:2a42a360-9b85-4179-ba75-4eab06026b51","source":"wordfence","cve":"CVE-2025-15665","title":"BEAF <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a42a360-9b85-4179-ba75-4eab06026b51?source=api-prod","affected":[{"type":"plugin","slug":"beaf-before-and-after-gallery","name":"Ultimate Before After Image Slider & Gallery \u2013 BEAF","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-29T21:45:15Z"},{"id":"wordfence:2a45fec7-cc69-4df6-98bb-ff70e5b6486c","source":"wordfence","cve":"CVE-2026-27983","title":"LMS Elementor Pro <= 1.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a45fec7-cc69-4df6-98bb-ff70e5b6486c?source=api-prod","affected":[{"type":"plugin","slug":"lms-elementor-pro","name":"LMS Elementor Pro","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:43:48Z"},{"id":"wordfence:2a47e3cc-9435-4e9c-8d9a-9eb5014d229f","source":"wordfence","cve":"CVE-2026-2363","title":"WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a47e3cc-9435-4e9c-8d9a-9eb5014d229f?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.5.1","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2026-03-03T18:17:29Z","updated":"2026-03-04T06:26:53Z"},{"id":"wordfence:2a49db7f-62fc-472d-9edf-de5edbe48219","source":"wordfence","cve":"CVE-2025-11746","title":"XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.5.4","to_inclusive":true,"patched_in":"9.6"}],"published":"2025-10-14T14:24:23Z","updated":"2025-10-15T02:26:27Z"},{"id":"wordfence:2a49eb7f-971e-4039-ab2f-5844bf4f2775","source":"wordfence","cve":"CVE-2024-10105","title":"Job Postings <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49eb7f-971e-4039-ab2f-5844bf4f2775?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.7.11"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:04:21Z"},{"id":"wordfence:2a4af494-ef5a-4bcb-916b-d4184d3df9b5","source":"wordfence","cve":"CVE-2024-6710","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4af494-ef5a-4bcb-916b-d4184d3df9b5?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.44","to_inclusive":true,"patched_in":"3.1.45"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-09T20:43:51Z"},{"id":"wordfence:2a4bd32b-ab84-4668-a53c-960b42142968","source":"wordfence","cve":"CVE-2025-62153","title":"Quick Interest Slider <= 3.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4bd32b-ab84-4668-a53c-960b42142968?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-10T15:53:50Z"},{"id":"wordfence:2a4c1e51-b332-4feb-8875-d43c9541342f","source":"wordfence","cve":"CVE-2026-102394","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets <= 6.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4c1e51-b332-4feb-8875-d43c9541342f?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.4","to_inclusive":true,"patched_in":"6.8.5"}],"published":"2026-10-01T12:35:00Z","updated":"2026-10-08T23:13:06Z"},{"id":"wordfence:2a4caee4-f4fa-45a6-8fe8-d5445bb097bf","source":"wordfence","cve":"CVE-2024-54295","title":"ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4caee4-f4fa-45a6-8fe8-d5445bb097bf?source=api-prod","affected":[{"type":"plugin","slug":"listapp-mobile-manager","name":"ListApp Mobile Manager","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:29:36Z"},{"id":"wordfence:2a4d8b76-8fb0-4239-ac4b-4ef4428be02b","source":"wordfence","cve":"","title":"Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace <= 3.8.11.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4d8b76-8fb0-4239-ac4b-4ef4428be02b?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.8.11.8","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a4e66e0-85a6-4e9f-8ed7-b7ee8e75aae6","source":"wordfence","cve":"CVE-2023-32585","title":"Portfolio Gallery \u2013 Responsive Image Gallery <= 1.4.5 - Missing Authorization to Arbitrary Gallery Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4e66e0-85a6-4e9f-8ed7-b7ee8e75aae6?source=api-prod","affected":[{"type":"plugin","slug":"gallery-portfolio","name":"Portfolio Gallery \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a4e8dbe-9889-43b1-8e15-e96791b13093","source":"wordfence","cve":"CVE-2022-29431","title":"Remove CPT base <= 5.8 - Cross-Site Request Forgery to CPT base deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a4e8dbe-9889-43b1-8e15-e96791b13093?source=api-prod","affected":[{"type":"plugin","slug":"remove-cpt-base","name":"Remove CPT base","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2022-05-06T13:29:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a521be2-b3ce-47de-8a28-aeff94942d85","source":"wordfence","cve":"CVE-2010-4536","title":"WordPress Core <= 3.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a521be2-b3ce-47de-8a28-aeff94942d85?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2010-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a52f6ae-7cb2-493b-aa99-1d0e1e3cf567","source":"wordfence","cve":"CVE-2025-30983","title":"Card flip image slideshow <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a52f6ae-7cb2-493b-aa99-1d0e1e3cf567?source=api-prod","affected":[{"type":"plugin","slug":"card-flip-image-slideshow","name":"Card flip image slideshow","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:52:16Z"},{"id":"wordfence:2a541529-ef53-468c-a7f0-0cd6822bd17b","source":"wordfence","cve":"CVE-2026-42678","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a541529-ef53-468c-a7f0-0cd6822bd17b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.14.5","to_inclusive":true,"patched_in":"4.14.6"}],"published":"2026-05-16T00:00:00Z","updated":"2026-05-19T13:30:40Z"},{"id":"wordfence:2a56b6f1-d3f1-4c6b-9657-a25ebc083b9e","source":"wordfence","cve":"CVE-2024-49311","title":"Edwiser Bridge <= 3.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a56b6f1-d3f1-4c6b-9657-a25ebc083b9e?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-14T16:45:19Z"},{"id":"wordfence:2a56eb63-ba5c-4452-8ab9-f5aeaf53adda","source":"wordfence","cve":"CVE-2024-8512","title":"W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a56eb63-ba5c-4452-8ab9-f5aeaf53adda?source=api-prod","affected":[{"type":"plugin","slug":"w3speedster-wp","name":"W3SPEEDSTER","from":"*","from_inclusive":true,"to":"7.26","to_inclusive":true,"patched_in":"7.27"}],"published":"2024-10-29T00:00:00Z","updated":"2024-10-30T11:01:00Z"},{"id":"wordfence:2a59db6d-82a6-4570-bfa5-674ae4054ea7","source":"wordfence","cve":"CVE-2025-58789","title":"WP Full Stripe Free <= 8.2.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a59db6d-82a6-4570-bfa5-674ae4054ea7?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-19T15:33:26Z"},{"id":"wordfence:2a59e1f6-1ffd-4ff7-83dd-8bf3121bb875","source":"wordfence","cve":"CVE-2025-62961","title":"Sparkle FSE <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a59e1f6-1ffd-4ff7-83dd-8bf3121bb875?source=api-prod","affected":[{"type":"theme","slug":"sparkle-fse","name":"Sparkle FSE","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:44:38Z"},{"id":"wordfence:2a5a7fa2-856e-47e2-9e32-95d5f50d7b2d","source":"wordfence","cve":"CVE-2026-16058","title":"YayCurrency \u2013 WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5a7fa2-856e-47e2-9e32-95d5f50d7b2d?source=api-prod","affected":[{"type":"plugin","slug":"yaycurrency","name":"YayCurrency \u2013 WooCommerce Multi-Currency Switcher","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":false,"patched_in":"3.3.5"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:16:10Z"},{"id":"wordfence:2a5c6b05-6e28-40be-80cb-9f95241a4fc6","source":"wordfence","cve":"CVE-2023-25964","title":"We\u2019re Open! <= 1.46 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5c6b05-6e28-40be-80cb-9f95241a4fc6?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"1.46","to_inclusive":true,"patched_in":"1.47"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a5ccc0b-a80a-41df-991c-5c356eb10512","source":"wordfence","cve":"CVE-2023-23709","title":"WPJAM Basic <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5ccc0b-a80a-41df-991c-5c356eb10512?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.1.1"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a5ea5b6-4c34-4d77-9a3a-af53b914a72a","source":"wordfence","cve":"CVE-2025-57928","title":"AWP Classifieds <= 4.4.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5ea5b6-4c34-4d77-9a3a-af53b914a72a?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:17:14Z"},{"id":"wordfence:2a5eeae6-313a-4244-9d6a-583828521a3b","source":"wordfence","cve":"CVE-2026-8897","title":"Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5eeae6-313a-4244-9d6a-583828521a3b?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-buddy","name":"Shortcode Buddy","from":"*","from_inclusive":true,"to":"0.1.9.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:27:26Z","updated":"2026-05-27T05:31:22Z"},{"id":"wordfence:2a5f4a74-3974-4d08-8238-387e573a5655","source":"wordfence","cve":"CVE-2024-5029","title":"CM Table Of Contents <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5f4a74-3974-4d08-8238-387e573a5655?source=api-prod","affected":[{"type":"plugin","slug":"cm-table-of-content","name":"CM Table Of Contents \u2013 Clear navigation for better content discovery","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-10-31T00:00:00Z","updated":"2024-12-12T18:09:53Z"},{"id":"wordfence:2a60d27b-dfcc-464e-a927-eb6bb35f9932","source":"wordfence","cve":"CVE-2026-5337","title":"Frontend File Manager <= 23.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Download Access","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a60d27b-dfcc-464e-a927-eb6bb35f9932?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-11T00:00:00Z","updated":"2026-05-19T14:55:50Z"},{"id":"wordfence:2a6417bc-3f9a-4271-8ca1-bbc55cdc63c6","source":"wordfence","cve":"CVE-2026-32383","title":"Ridhi <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6417bc-3f9a-4271-8ca1-bbc55cdc63c6?source=api-prod","affected":[{"type":"theme","slug":"ridhi","name":"Ridhi","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:54:54Z"},{"id":"wordfence:2a64b1ff-0d3f-42fa-bab2-4f31bb8f0476","source":"wordfence","cve":"CVE-2023-25800","title":"Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a64b1ff-0d3f-42fa-bab2-4f31bb8f0476?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a677eed-0344-457e-aa5f-3b94a624462c","source":"wordfence","cve":"CVE-2022-3135","title":"SEO Smart Links <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a677eed-0344-457e-aa5f-3b94a624462c?source=api-prod","affected":[{"type":"plugin","slug":"seo-automatic-links","name":"SEO Smart Links","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a681cef-649f-4342-beb6-914674bbf6d6","source":"wordfence","cve":"CVE-2024-25918","title":"InstaWP Connect <= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a681cef-649f-4342-beb6-914674bbf6d6?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.8","to_inclusive":true,"patched_in":"0.1.0.9"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T19:37:48Z"},{"id":"wordfence:2a690565-d401-4c71-8ca2-c9a10468e870","source":"wordfence","cve":"CVE-2024-34799","title":"BookingPress <= 1.0.82 - Missing Authorization to Appointment Time Alteration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a690565-d401-4c71-8ca2-c9a10468e870?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.82","to_inclusive":true,"patched_in":"1.0.83"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T21:17:03Z"},{"id":"wordfence:2a691f92-9eff-4777-8198-b7cc5d9e73c0","source":"wordfence","cve":"CVE-2026-15017","title":"MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a691f92-9eff-4777-8198-b7cc5d9e73c0?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.4","to_inclusive":true,"patched_in":"1.7.8.5"}],"published":"2026-07-22T20:47:53Z","updated":"2026-07-23T09:33:56Z"},{"id":"wordfence:2a695233-01e3-4700-85a2-c4a9680e33db","source":"wordfence","cve":"CVE-2025-30953","title":"WP Gravity Forms Salesforce <= 1.4.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a695233-01e3-4700-85a2-c4a9680e33db?source=api-prod","affected":[{"type":"plugin","slug":"gf-salesforce-crmperks","name":"CRM Perks Integration for Gravity Forms and Salesforce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-17T17:28:23Z"},{"id":"wordfence:2a69576e-4796-421a-b6ee-08a3b40d4805","source":"wordfence","cve":"CVE-2023-23991","title":"Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a69576e-4796-421a-b6ee-08a3b40d4805?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.4.2","to_inclusive":true,"patched_in":"9.4.3.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a6ab858-ae08-4986-94b5-35d6d9c449ed","source":"wordfence","cve":"CVE-2026-22378","title":"Blabber <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6ab858-ae08-4986-94b5-35d6d9c449ed?source=api-prod","affected":[{"type":"theme","slug":"blabber","name":"Blabber | Elementor Blog & News Magazine Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:29:04Z"},{"id":"wordfence:2a6bfc87-6135-4d49-baa2-e8e6291148dc","source":"wordfence","cve":"CVE-2023-6526","title":"Meta Box \u2013 WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6bfc87-6135-4d49-baa2-e8e6291148dc?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"5.9.3"}],"published":"2024-02-05T00:00:00Z","updated":"2024-07-29T21:36:04Z"},{"id":"wordfence:2a6c5610-ed84-4d7d-a28f-d3807230e119","source":"wordfence","cve":"CVE-2024-3552","title":"Web Directory Free <= 1.6.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6c5610-ed84-4d7d-a28f-d3807230e119?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T14:38:50Z"},{"id":"wordfence:2a6d72d0-f262-46a1-91c7-1c34ab995614","source":"wordfence","cve":"","title":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress < 4.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6d72d0-f262-46a1-91c7-1c34ab995614?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":false,"patched_in":"4.5.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a6dfdec-c1c6-4300-ab0a-9fd1c550d09f","source":"wordfence","cve":"CVE-2026-8853","title":"MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6dfdec-c1c6-4300-ab0a-9fd1c550d09f?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2026-06-09T18:48:34Z","updated":"2026-06-10T07:50:56Z"},{"id":"wordfence:2a6e37c1-aaac-4642-bace-234bbc4f6c38","source":"wordfence","cve":"CVE-2026-11370","title":"WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6e37c1-aaac-4642-bace-234bbc4f6c38?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:46:49Z","updated":"2026-06-24T05:33:24Z"},{"id":"wordfence:2a700c1c-2ac2-47b8-95e6-ee1a02f50c12","source":"wordfence","cve":"CVE-2022-4417","title":"WP Cerber Security <= 9.3.2 - User Enumeration Bypass via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a700c1c-2ac2-47b8-95e6-ee1a02f50c12?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"9.3.2","to_inclusive":true,"patched_in":"9.3.3"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a70ae7b-4b10-454b-8b28-b3d23d939cab","source":"wordfence","cve":"CVE-2026-32518","title":"Gaea < 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a70ae7b-4b10-454b-8b28-b3d23d939cab?source=api-prod","affected":[{"type":"theme","slug":"gaea","name":"Gaea - Environmental WordPress Theme","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":false,"patched_in":"3.8"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:39:57Z"},{"id":"wordfence:2a746ec6-c2fa-46ed-baf6-154659655235","source":"wordfence","cve":"CVE-2025-64248","title":"Request a Quote <= 2.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a746ec6-c2fa-46ed-baf6-154659655235?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:12:58Z"},{"id":"wordfence:2a75f4eb-698b-4c92-9829-de6c55e21ecb","source":"wordfence","cve":"CVE-2023-6922","title":"Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a75f4eb-698b-4c92-9829-de6c55e21ecb?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode-from-acurax","name":"Under Construction / Maintenance Mode from Acurax","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:09Z"},{"id":"wordfence:2a78b274-f83f-4168-a8d2-9ee945518b60","source":"wordfence","cve":"CVE-2023-0604","title":"WP Food Manager <= 1.0.3 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a78b274-f83f-4168-a8d2-9ee945518b60?source=api-prod","affected":[{"type":"plugin","slug":"wp-food-manager","name":"WP Food Manager \u2013 Restaurant Menu & Online Food Ordering for WooCommerce \u2013 Food Delivery & Pickup \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a7b4c3c-a8a0-4f16-bfcb-5c2cd479fb9a","source":"wordfence","cve":"CVE-2026-78272","title":"Fluent Support Pro <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7b4c3c-a8a0-4f16-bfcb-5c2cd479fb9a?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support-pro","name":"Fluent Support Pro","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-26T16:42:43Z"},{"id":"wordfence:2a7d6059-4cef-4bd1-a14d-ad544bfaeea3","source":"wordfence","cve":"CVE-2023-47762","title":"BetterDocs <= 2.5.2 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7d6059-4cef-4bd1-a14d-ad544bfaeea3?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a7f070a-b67c-4e65-a928-a6116266c54d","source":"wordfence","cve":"CVE-2025-15064","title":"Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2026-04-03T19:29:29Z","updated":"2026-04-04T07:41:57Z"},{"id":"wordfence:2a7f64e1-c815-426b-99cc-03ab62aaf9de","source":"wordfence","cve":"CVE-2023-25974","title":"wp2syslog <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f64e1-c815-426b-99cc-03ab62aaf9de?source=api-prod","affected":[{"type":"plugin","slug":"wp2syslog","name":"wp2syslog","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a804605-c079-4310-a57f-81c3eb216dee","source":"wordfence","cve":"CVE-2022-38460","title":"NOTICE BOARD <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a804605-c079-4310-a57f-81c3eb216dee?source=api-prod","affected":[{"type":"plugin","slug":"notice-board","name":"NOTICE BOARD","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a82666d-4c35-4aba-9163-834eef6c50ad","source":"wordfence","cve":"","title":"WP Crontrol < 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a82666d-4c35-4aba-9163-834eef6c50ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-crontrol","name":"WP Crontrol","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a83ade5-5e53-4d53-ada0-43d487e5e23f","source":"wordfence","cve":"CVE-2023-51408","title":"WP Optin Wheel <= 1.4.2 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-921","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a83ade5-5e53-4d53-ada0-43d487e5e23f?source=api-prod","affected":[{"type":"plugin","slug":"wp-optin-wheel","name":"WP Optin Wheel \u2013 Gamified Optin Email Marketing Tool for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a8430ed-6aeb-46a3-8c42-59646845706e","source":"wordfence","cve":"CVE-2024-1383","title":"WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8430ed-6aeb-46a3-8c42-59646845706e?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backup-mainwp","name":"WPvivid Backup for MainWP","from":"*","from_inclusive":true,"to":"0.9.32","to_inclusive":true,"patched_in":"0.9.33"}],"published":"2024-02-28T00:00:00Z","updated":"2024-06-11T19:28:48Z"},{"id":"wordfence:2a896f57-e742-4eb6-85dc-c45d3f0747d8","source":"wordfence","cve":"CVE-2011-3841","title":"WP Symposium <= 11.11.26 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a896f57-e742-4eb6-85dc-c45d3f0747d8?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"11.11.26","to_inclusive":true,"patched_in":"11.12.08"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a8c62e6-f459-433a-b0c4-c79285ea7fe9","source":"wordfence","cve":"CVE-2025-11762","title":"HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=api-prod","affected":[{"type":"plugin","slug":"leadin","name":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat","from":"*","from_inclusive":true,"to":"11.3.32","to_inclusive":true,"patched_in":"11.3.33"}],"published":"2026-04-23T19:19:31Z","updated":"2026-04-24T07:45:07Z"},{"id":"wordfence:2a90678a-6f40-4f76-9ffb-576827005ec9","source":"wordfence","cve":"CVE-2025-46228","title":"Event post <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a90678a-6f40-4f76-9ffb-576827005ec9?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"5.10.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:41:57Z"},{"id":"wordfence:2a938325-45f5-455b-b2b7-e19e6e22cd0c","source":"wordfence","cve":"CVE-2023-32588","title":"Post State Tags <= 2.0.6 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a938325-45f5-455b-b2b7-e19e6e22cd0c?source=api-prod","affected":[{"type":"plugin","slug":"post-state-tags","name":"Post State Tags","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a942d71-7172-4e02-9faa-3a2c1c9e7fbd","source":"wordfence","cve":"CVE-2026-100163","title":"Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback","severity":"high","cvss":7.4,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a942d71-7172-4e02-9faa-3a2c1c9e7fbd?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-10-13T19:19:40Z","updated":"2026-10-14T07:43:32Z"},{"id":"wordfence:2a95122f-fe5a-43e4-a68c-8a6b96f0df2b","source":"wordfence","cve":"CVE-2024-12749","title":"Competition Form <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a95122f-fe5a-43e4-a68c-8a6b96f0df2b?source=api-prod","affected":[{"type":"plugin","slug":"competition-form","name":"Competition Form","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T18:41:06Z"},{"id":"wordfence:2a965a23-5594-4925-8104-6f387a60ab49","source":"wordfence","cve":"CVE-2026-13009","title":"AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a965a23-5594-4925-8104-6f387a60ab49?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-07-22T20:39:14Z","updated":"2026-07-23T09:33:57Z"},{"id":"wordfence:2a97f59d-c4b1-4544-8cef-37a01cc6f7ec","source":"wordfence","cve":"CVE-2023-7247","title":"Login as User or Customer <= 3.8 - Unauthenticated Limited Admin Account Compromise","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a97f59d-c4b1-4544-8cef-37a01cc6f7ec?source=api-prod","affected":[{"type":"plugin","slug":"login-as-customer-or-user","name":"Login as User or Customer \u2014 User Switching","from":"3.8","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-27T14:41:24Z"},{"id":"wordfence:2a9810a8-311a-424a-bd64-8d25ee891bb5","source":"wordfence","cve":"CVE-2024-11104","title":"Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9810a8-311a-424a-bd64-8d25ee891bb5?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-11-21T00:00:00Z","updated":"2024-11-22T05:33:41Z"},{"id":"wordfence:2a99a21c-d4f1-4cdb-b1f1-31b3cf666b80","source":"wordfence","cve":"CVE-2024-5551","title":"WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a99a21c-d4f1-4cdb-b1f1-31b3cf666b80?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging-pro","name":"WP STAGING Pro WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-14T05:39:17Z"},{"id":"wordfence:2a9a642f-1ca5-4f08-b404-c11deba100e9","source":"wordfence","cve":"CVE-2017-18495","title":"Clockwork SMS Notfications < 2.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9a642f-1ca5-4f08-b404-c11deba100e9?source=api-prod","affected":[{"type":"plugin","slug":"mediaburst-email-to-sms","name":"Clockwork SMS Notfications","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2017-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a9bf519-bc55-411b-836a-fb394e317396","source":"wordfence","cve":"","title":"Caldera Forms <= 1.5.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9bf519-bc55-411b-836a-fb394e317396?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2017-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2a9ed6f2-3def-420c-b6d5-6343fcd7b147","source":"wordfence","cve":"CVE-2023-32504","title":"Wise Chat <= 3.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9ed6f2-3def-420c-b6d5-6343fcd7b147?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2aa36c08-dda7-422e-812f-e7e6516a23fa","source":"wordfence","cve":"CVE-2026-42419","title":"Swish Migrate and Backup <= 1.4.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aa36c08-dda7-422e-812f-e7e6516a23fa?source=api-prod","affected":[{"type":"plugin","slug":"swish-migrate-and-backup","name":"Swish Migrate and Backup","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:28:46Z"},{"id":"wordfence:2aa5b7e8-3030-47d3-9440-3b1b5c94b5ec","source":"wordfence","cve":"CVE-2024-56237","title":"Contest Gallery <= 24.0.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aa5b7e8-3030-47d3-9440-3b1b5c94b5ec?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"24.0.3","to_inclusive":true,"patched_in":"24.0.4"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:04:56Z"},{"id":"wordfence:2aa84ea5-5e4e-4f1c-8238-c8ea0c70e248","source":"wordfence","cve":"CVE-2024-51761","title":"WPHelpful <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aa84ea5-5e4e-4f1c-8238-c8ea0c70e248?source=api-prod","affected":[{"type":"plugin","slug":"wphelpful","name":"WPHelpful","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:23:04Z"},{"id":"wordfence:2aaa8c34-cf7b-4630-adc8-cbb534deff89","source":"wordfence","cve":"CVE-2025-1705","title":"tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aaa8c34-cf7b-4630-adc8-cbb534deff89?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-03-27T19:53:56Z","updated":"2025-03-28T08:23:46Z"},{"id":"wordfence:2aaca776-03ce-43bb-9553-f455f57124a3","source":"wordfence","cve":"CVE-2024-6930","title":"WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aaca776-03ce-43bb-9553-f455f57124a3?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.2.1","to_inclusive":true,"patched_in":"10.2.2"}],"published":"2024-07-23T18:49:44Z","updated":"2024-07-24T07:31:50Z"},{"id":"wordfence:2ab1a623-5726-45ca-9667-ed926c5d3364","source":"wordfence","cve":"CVE-2021-24530","title":"Alojapro Widget <= 1.1.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab1a623-5726-45ca-9667-ed926c5d3364?source=api-prod","affected":[{"type":"plugin","slug":"alojapro-widget","name":"Alojapro Booking Engine","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2021-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ab3986a-69e0-442f-8e79-35b1bc5376d9","source":"wordfence","cve":"CVE-2026-14378","title":"DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab3986a-69e0-442f-8e79-35b1bc5376d9?source=api-prod","affected":[{"type":"plugin","slug":"devkit","name":"DevKit Pro","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-10-01T14:44:20Z","updated":"2026-10-02T03:38:46Z"},{"id":"wordfence:2ab3ab43-5d20-4cbd-9798-73eab47ed680","source":"wordfence","cve":"CVE-2026-62095","title":"Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab3ab43-5d20-4cbd-9798-73eab47ed680?source=api-prod","affected":[{"type":"theme","slug":"biolife","name":"Biolife - Organic Food WordPress Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:22:51Z"},{"id":"wordfence:2ab4ac58-ea16-4b3b-8646-afe10f331f0c","source":"wordfence","cve":"CVE-2025-62030","title":"tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab4ac58-ea16-4b3b-8646-afe10f331f0c?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:51:10Z"},{"id":"wordfence:2ab4baab-9e91-4ed5-9749-4a14e8180e71","source":"wordfence","cve":"CVE-2026-1932","title":"Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab4baab-9e91-4ed5-9749-4a14e8180e71?source=api-prod","affected":[{"type":"plugin","slug":"bookr","name":"Appointment Booking Calendar Plugin \u2013 Bookr","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T17:29:23Z","updated":"2026-04-15T20:24:01Z"},{"id":"wordfence:2ab5636e-6599-491e-a7e3-ac3ddcfe2638","source":"wordfence","cve":"CVE-2026-112835","title":"VikRentCar Car Rental Management System <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab5636e-6599-491e-a7e3-ac3ddcfe2638?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:12:51Z"},{"id":"wordfence:2ab58add-ab81-4c84-b773-7daf382492b0","source":"wordfence","cve":"CVE-2024-0372","title":"Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab58add-ab81-4c84-b773-7daf382492b0?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T22:42:26Z"},{"id":"wordfence:2ab6e751-dc23-442f-b22e-ee41fd6651f6","source":"wordfence","cve":"CVE-2006-4028","title":"WordPress Core < 2.0.4 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab6e751-dc23-442f-b22e-ee41fd6651f6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2006-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ab6f54d-0358-4f0c-aba5-b4053e1a345d","source":"wordfence","cve":"CVE-2024-22286","title":"BA Plus <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab6f54d-0358-4f0c-aba5-b4053e1a345d?source=api-prod","affected":[{"type":"plugin","slug":"ba-plus-before-after-image-slider-free","name":"BA Plus \u2013 Before & After Image Slider FREE","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ab86a42-2a8f-4cbc-a754-a3e307b1b73f","source":"wordfence","cve":"CVE-2026-6712","title":"Website LLMs.txt <= 8.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab86a42-2a8f-4cbc-a754-a3e307b1b73f?source=api-prod","affected":[{"type":"plugin","slug":"website-llms-txt","name":"Website LLMs.txt","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2026-04-20T18:26:20Z","updated":"2026-04-21T06:44:02Z"},{"id":"wordfence:2ab8f440-2910-41a3-8bbc-afb4cafd33b5","source":"wordfence","cve":"CVE-2025-15041","title":"BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ab8f440-2910-41a3-8bbc-afb4cafd33b5?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"5.0.0","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-20T21:21:38Z"},{"id":"wordfence:2abb66a3-67b9-48cb-acf1-18ee76eb3f70","source":"wordfence","cve":"CVE-2026-24574","title":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export <= 6.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2abb66a3-67b9-48cb-acf1-18ee76eb3f70?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:13:39Z"},{"id":"wordfence:2abd400b-c633-4b38-ad3e-c9ce602ff07f","source":"wordfence","cve":"CVE-2026-13441","title":"EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2abd400b-c633-4b38-ad3e-c9ce602ff07f?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.4.2","to_inclusive":true,"patched_in":"4.3.4.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T09:31:20Z"},{"id":"wordfence:2abe953c-dd50-413c-8424-7cd9dbf92d67","source":"wordfence","cve":"CVE-2025-24702","title":"Xagio SEO <= 7.0.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2abe953c-dd50-413c-8424-7cd9dbf92d67?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.0.0.20","to_inclusive":true,"patched_in":"7.0.0.21"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:00:44Z"},{"id":"wordfence:2ac0694e-6ec7-4e0a-bc7e-573df6a11ea3","source":"wordfence","cve":"CVE-2025-23806","title":"Ultimate Subscribe <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac0694e-6ec7-4e0a-bc7e-573df6a11ea3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-subscribe","name":"Ultimate Subscribe","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:12:19Z"},{"id":"wordfence:2ac09de3-4393-4f56-9240-bf2fdaa6f762","source":"wordfence","cve":"CVE-2026-106596","title":"Visual Composer Website Builder <= 45.16.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac09de3-4393-4f56-9240-bf2fdaa6f762?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.16.3","to_inclusive":true,"patched_in":"45.16.4"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:30:21Z"},{"id":"wordfence:2ac09e78-fea1-478f-a3bc-40742bdc0f6a","source":"wordfence","cve":"CVE-2025-63053","title":"Master Addons for Elementor <= 2.0.9.9.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac09e78-fea1-478f-a3bc-40742bdc0f6a?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.9.9.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-27T20:39:46Z"},{"id":"wordfence:2ac1168e-51a9-43a2-9086-6b75627bedbf","source":"wordfence","cve":"CVE-2025-58242","title":"Bg Church Memos <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac1168e-51a9-43a2-9086-6b75627bedbf?source=api-prod","affected":[{"type":"plugin","slug":"bg-church-memos","name":"Bg Church Memos","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:37:36Z"},{"id":"wordfence:2ac1d65c-5e09-41ca-809b-2ab3ab5f62af","source":"wordfence","cve":"","title":"Shortcodes Ultimate <= 5.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac1d65c-5e09-41ca-809b-2ab3ab5f62af?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.0","to_inclusive":true,"patched_in":"5.12.1"}],"published":"2022-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ac1e3ee-4dcc-4f45-ad07-17af750da3d1","source":"wordfence","cve":"CVE-2024-6332","title":"Booking for Appointments and Events Calendar \u2013 Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac1e3ee-4dcc-4f45-ad07-17af750da3d1?source=api-prod","affected":[{"type":"plugin","slug":"amelia","name":"Booking for Appointments and Events Calendar \u2013 Amelia Pro","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"},{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-09-04T21:24:51Z","updated":"2026-01-27T16:13:24Z"},{"id":"wordfence:2ac3dd6c-6055-4a21-a4d2-e95ba5edc291","source":"wordfence","cve":"CVE-2025-60113","title":"Groovy Menu <= 1.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac3dd6c-6055-4a21-a4d2-e95ba5edc291?source=api-prod","affected":[{"type":"plugin","slug":"groovy-menu-free","name":"Groovy Menu Plugin (Free)","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-09-26T00:00:00Z","updated":"2026-07-08T20:44:45Z"},{"id":"wordfence:2ac3ffcf-50e0-42fc-a88d-cd7a51fbe1a9","source":"wordfence","cve":"CVE-2025-49919","title":"eRoom <= 1.5.6 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac3ffcf-50e0-42fc-a88d-cd7a51fbe1a9?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-19T21:30:13Z"},{"id":"wordfence:2ac7414c-8035-406a-ab1e-94d9f64e52fa","source":"wordfence","cve":"CVE-2023-25487","title":"PixTypes <= 1.4.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac7414c-8035-406a-ab1e-94d9f64e52fa?source=api-prod","affected":[{"type":"plugin","slug":"pixtypes","name":"PixTypes","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ac815c3-db14-4196-9fbd-d5a6c32602f8","source":"wordfence","cve":"CVE-2024-10678","title":"Ultimate Blocks <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ac815c3-db14-4196-9fbd-d5a6c32602f8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-11-22T00:00:00Z","updated":"2024-12-23T18:45:34Z"},{"id":"wordfence:2acd40d5-8a9c-4ca8-9c89-5bf639b1c66c","source":"wordfence","cve":"CVE-2021-4349","title":"Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2acd40d5-8a9c-4ca8-9c89-5bf639b1c66c?source=api-prod","affected":[{"type":"plugin","slug":"process-steps-template-designer","name":"Process Steps Template Designer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad0acd5-b5d8-481d-954e-a629bb0e11a8","source":"wordfence","cve":"CVE-2024-33937","title":"Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad0acd5-b5d8-481d-954e-a629bb0e11a8?source=api-prod","affected":[{"type":"plugin","slug":"progressive-wp","name":"Progressive WordPress (PWA)","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:32:18Z"},{"id":"wordfence:2ad1af69-61e1-4453-866e-1ae71f614f30","source":"wordfence","cve":"CVE-2022-4395","title":"Membership For WooCommerce <= 2.1.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad1af69-61e1-4453-866e-1ae71f614f30?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad47937-8125-405c-9fd3-9b3b210942fa","source":"wordfence","cve":"CVE-2015-9490","title":"GamesTheme  <= 1.0.3 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad47937-8125-405c-9fd3-9b3b210942fa?source=api-prod","affected":[{"type":"theme","slug":"GamesTheme","name":"GamesTheme","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad542c9-2025-4875-bd37-f42095c058bd","source":"wordfence","cve":"CVE-2024-13579","title":"WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad542c9-2025-4875-bd37-f42095c058bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-asambleas","name":"WP-Asambleas","from":"*","from_inclusive":true,"to":"2.85.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:49:07Z","updated":"2025-02-18T04:21:13Z"},{"id":"wordfence:2ad5544a-6694-41e4-940f-fa96daf4b41d","source":"wordfence","cve":"CVE-2023-37969","title":"Checkout with Zelle on Woocommerce <= 3.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad5544a-6694-41e4-940f-fa96daf4b41d?source=api-prod","affected":[{"type":"plugin","slug":"wc-zelle","name":"Checkout with Zelle on Woocommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad674f7-aff6-432d-9c4c-95aebf8fcf6b","source":"wordfence","cve":"CVE-2007-6318","title":"WordPress Core < 2.3.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad674f7-aff6-432d-9c4c-95aebf8fcf6b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2007-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad7fd59-e4a2-46e7-9232-d76255a6b0b4","source":"wordfence","cve":"CVE-2021-39357","title":"Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad7fd59-e4a2-46e7-9232-d76255a6b0b4?source=api-prod","affected":[{"type":"plugin","slug":"leaky-paywall","name":"Leaky Paywall","from":"*","from_inclusive":true,"to":"4.16.5","to_inclusive":true,"patched_in":"4.16.6"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ad85bda-0866-450e-9902-4d01511612f2","source":"wordfence","cve":"CVE-2025-54690","title":"Xinterio <= 4.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad85bda-0866-450e-9902-4d01511612f2?source=api-prod","affected":[{"type":"theme","slug":"xinterio","name":"Xinterio - Interior Design WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.3"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:44:55Z"},{"id":"wordfence:2ae0d83b-a444-4141-89da-b63ce216db17","source":"wordfence","cve":"","title":"Ajax Search Pro <= 3.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae0d83b-a444-4141-89da-b63ce216db17?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-pro","name":"Ajax Search Pro","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"4.0"}],"published":"2015-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ae1c18c-5be3-48db-af31-4c88daa549fc","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae1c18c-5be3-48db-af31-4c88daa549fc?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.1","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"16.1.3"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:43:17Z"},{"id":"wordfence:2ae1d70e-316b-4ee8-bdb8-289f5887476c","source":"wordfence","cve":"CVE-2026-28087","title":"Filmax <= 1.1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae1d70e-316b-4ee8-bdb8-289f5887476c?source=api-prod","affected":[{"type":"theme","slug":"filmax","name":"Filmax | Cinema & Movie News Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:00:41Z"},{"id":"wordfence:2ae3aaf6-457f-4b7f-b3bb-b4028980ef55","source":"wordfence","cve":"CVE-2024-54402","title":"Arabic Webfonts <= 1.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae3aaf6-457f-4b7f-b3bb-b4028980ef55?source=api-prod","affected":[{"type":"plugin","slug":"arabic-webfonts","name":"Arabic Webfonts","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:39:15Z"},{"id":"wordfence:2ae44bcb-6149-4661-8890-23c867e9a918","source":"wordfence","cve":"CVE-2024-5335","title":"Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae44bcb-6149-4661-8890-23c867e9a918?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-20T19:47:05Z","updated":"2024-08-21T08:29:14Z"},{"id":"wordfence:2ae70225-3597-463b-907c-d2a3a7bcecb4","source":"wordfence","cve":"","title":"WooCommerce Stock Manager < 1.0.9 - Authorization Bypass","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae70225-3597-463b-907c-d2a3a7bcecb4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-stock-manager","name":"Stock Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2016-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ae7f5e3-7312-4fee-962b-3aecd8432557","source":"wordfence","cve":"CVE-2025-4593","title":"WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae7f5e3-7312-4fee-962b-3aecd8432557?source=api-prod","affected":[{"type":"plugin","slug":"wp-register-profile-with-shortcode","name":"WP Register Profile With Shortcode","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-11T07:23:00Z"},{"id":"wordfence:2ae8e4ca-f5bc-40ae-ad00-efceac29458e","source":"wordfence","cve":"CVE-2025-31041","title":"AnyTrack Affiliate Link Manager <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae8e4ca-f5bc-40ae-ad00-efceac29458e?source=api-prod","affected":[{"type":"plugin","slug":"anytrack-affiliate-link-manager","name":"AnyTrack Affiliate Link Manager","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-18T16:34:12Z"},{"id":"wordfence:2ae916a0-b0a8-4722-9d8a-3d1f163bc8e5","source":"wordfence","cve":"CVE-2024-30489","title":"WP Cost Estimation & Payment Forms Builder <= 10.1.75 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae916a0-b0a8-4722-9d8a-3d1f163bc8e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"10.1.75","to_inclusive":true,"patched_in":"10.1.76"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:05:51Z"},{"id":"wordfence:2ae939f4-5a90-48ca-ae13-2ccbd6d8d08a","source":"wordfence","cve":"","title":"Simple Telegram <= 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ae939f4-5a90-48ca-ae13-2ccbd6d8d08a?source=api-prod","affected":[{"type":"plugin","slug":"simple-telegram-for-wp","name":"Simple Telegram","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2aeb5f28-00d3-45f3-846f-01ba99c959af","source":"wordfence","cve":"CVE-2026-85569","title":"Tutor LMS 2.7.1  - 4.0.7 - REST API Authentication Confusion","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2aeb5f28-00d3-45f3-846f-01ba99c959af?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:41:31Z"},{"id":"wordfence:2af03168-9344-4db0-9b69-2ad1fdb6d472","source":"wordfence","cve":"CVE-2024-4316","title":"EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af03168-9344-4db0-9b69-2ad1fdb6d472?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.9.17"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-09T20:03:22Z"},{"id":"wordfence:2af44b3e-62b4-4c27-8462-b2a82030a826","source":"wordfence","cve":"CVE-2025-28876","title":"Skrill Official <= 1.0.66 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af44b3e-62b4-4c27-8462-b2a82030a826?source=api-prod","affected":[{"type":"plugin","slug":"official-skrill-woocommerce","name":"Skrill \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.0.66","to_inclusive":true,"patched_in":"1.0.67"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-20T14:17:56Z"},{"id":"wordfence:2af46137-6cdc-4898-8d59-3c603ebe02c4","source":"wordfence","cve":"CVE-2026-110703","title":"GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af46137-6cdc-4898-8d59-3c603ebe02c4?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.191","to_inclusive":true,"patched_in":"2.8.192"}],"published":"2026-10-15T20:54:50Z","updated":"2026-10-16T09:26:37Z"},{"id":"wordfence:2af76ad6-9c78-4b44-b104-d66f0014b5cf","source":"wordfence","cve":"CVE-2022-4788","title":"Embed PDF <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af76ad6-9c78-4b44-b104-d66f0014b5cf?source=api-prod","affected":[{"type":"plugin","slug":"dirtysuds-embed-pdf","name":"Embed PDF","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2af82310-fd9a-41b9-9cac-5acb6bcd20be","source":"wordfence","cve":"CVE-2025-67549","title":"oik <= 4.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af82310-fd9a-41b9-9cac-5acb6bcd20be?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.15.3","to_inclusive":true,"patched_in":"4.15.4"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-10T16:22:53Z"},{"id":"wordfence:2af996d2-7430-4367-8fd9-212df6106fb0","source":"wordfence","cve":"CVE-2023-0234","title":"SiteGround Security <= 1.3.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2af996d2-7430-4367-8fd9-212df6106fb0?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2afa0d46-eead-4eb3-9bf1-81fafd3f0f88","source":"wordfence","cve":"CVE-2014-4579","title":"Appointments Scheduler <= 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2afa0d46-eead-4eb3-9bf1-81fafd3f0f88?source=api-prod","affected":[{"type":"plugin","slug":"wp-appointments-schedules","name":"Appointments Scheduler","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2afbc0a4-32ad-4fc4-9b10-5c06784f72f3","source":"wordfence","cve":"CVE-2023-28934","title":"WP Full Stripe Free <= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2afbc0a4-32ad-4fc4-9b10-5c06784f72f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2023-07-05T00:00:00Z","updated":"2024-03-14T13:12:43Z"},{"id":"wordfence:2afe77cc-88f5-4778-893a-26517bd520cb","source":"wordfence","cve":"CVE-2026-42747","title":"Easy Form Builder by WhiteStudio \u2014 Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2afe77cc-88f5-4778-893a-26517bd520cb?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:05:05Z"},{"id":"wordfence:2affce7c-6c59-4a50-ab26-5da2e18120d7","source":"wordfence","cve":"CVE-2026-32426","title":"Medilazar Core < 1.4.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2affce7c-6c59-4a50-ab26-5da2e18120d7?source=api-prod","affected":[{"type":"plugin","slug":"medilazar-core","name":"Medilazar Core","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2026-02-28T00:00:00Z","updated":"2026-05-05T14:26:21Z"},{"id":"wordfence:2b0198c8-4be8-44e0-9728-d5d2aa376796","source":"wordfence","cve":"","title":"PPOM for WooCommerce <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0198c8-4be8-44e0-9728-d5d2aa376796?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2016-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b045cef-c17c-4e6e-ab84-c0466a5a90ff","source":"wordfence","cve":"","title":"Foliopress WYSIWYG < 2.6.16 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b045cef-c17c-4e6e-ab84-c0466a5a90ff?source=api-prod","affected":[{"type":"plugin","slug":"foliopress-wysiwyg","name":"Foliopress WYSIWYG","from":"*","from_inclusive":true,"to":"2.6.15","to_inclusive":true,"patched_in":"2.6.16"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b060b83-3534-4ddc-8c14-8bca0f451910","source":"wordfence","cve":"CVE-2025-64259","title":"Theater for WordPress <= 0.18.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b060b83-3534-4ddc-8c14-8bca0f451910?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.18.8","to_inclusive":true,"patched_in":"0.19"}],"published":"2025-11-13T00:00:00Z","updated":"2025-11-17T18:28:22Z"},{"id":"wordfence:2b072278-6627-42b2-a532-c8854c9a4921","source":"wordfence","cve":"","title":"Post Comments as bbPress Topics <= 2.2.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b072278-6627-42b2-a532-c8854c9a4921?source=api-prod","affected":[{"type":"plugin","slug":"bbpress-post-topics","name":"Post Comments as bbPress Topics","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b0937fe-3ea6-427a-aef7-539c08687abb","source":"wordfence","cve":"CVE-2023-5614","title":"Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0937fe-3ea6-427a-aef7-539c08687abb?source=api-prod","affected":[{"type":"plugin","slug":"theme-switcha","name":"Theme Switcha \u2013 Easily Switch Themes for Development and Testing","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b0ab984-f38c-483d-ab59-1ecadf485e81","source":"wordfence","cve":"CVE-2026-39683","title":"Garden Gnome Package <= 2.5.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0ab984-f38c-483d-ab59-1ecadf485e81?source=api-prod","affected":[{"type":"plugin","slug":"garden-gnome-package","name":"Garden Gnome Package","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-02-21T00:00:00Z","updated":"2026-05-26T18:18:57Z"},{"id":"wordfence:2b0bb89c-6c56-4037-8a55-487244e8d519","source":"wordfence","cve":"CVE-2024-53758","title":"WP MathJax <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0bb89c-6c56-4037-8a55-487244e8d519?source=api-prod","affected":[{"type":"plugin","slug":"wp-mathjax-plus","name":"WP MathJax","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:30:50Z"},{"id":"wordfence:2b0cd80c-8bad-46c3-9964-cdacfd4144bd","source":"wordfence","cve":"CVE-2025-22517","title":"List Pages at Depth <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0cd80c-8bad-46c3-9964-cdacfd4144bd?source=api-prod","affected":[{"type":"plugin","slug":"list-pages-at-depth","name":"List Pages at Depth","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:40:43Z"},{"id":"wordfence:2b0d0c44-0ee8-400b-a4ea-e5520c2a6710","source":"wordfence","cve":"CVE-2024-1857","title":"Ultimate Gift Cards for WooCommerce \u2013 Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0d0c44-0ee8-400b-a4ea-e5520c2a6710?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T08:37:16Z"},{"id":"wordfence:2b0f887c-b9e5-4d3c-b354-ebf5741dc3ba","source":"wordfence","cve":"CVE-2022-1023","title":"Podcast Importer SecondLine < 1.3.8 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b0f887c-b9e5-4d3c-b354-ebf5741dc3ba?source=api-prod","affected":[{"type":"plugin","slug":"podcast-importer-secondline","name":"Podcast Importer SecondLine","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":false,"patched_in":"1.3.8"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b107861-753e-4e47-98de-22a3e193e0c2","source":"wordfence","cve":"CVE-2025-27004","title":"Famous - Responsive Image And Video Grid Gallery WordPress <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b107861-753e-4e47-98de-22a3e193e0c2?source=api-prod","affected":[{"type":"plugin","slug":"famous_grid_image_and_video_gallery","name":"Famous - Responsive Image And Video Grid Gallery WordPress Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:13:39Z"},{"id":"wordfence:2b11670a-f6e4-4555-ab76-4223f0194517","source":"wordfence","cve":"CVE-2025-10658","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover","severity":"medium","cvss":6.5,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2025-09-19T00:00:00Z","updated":"2025-09-20T06:43:19Z"},{"id":"wordfence:2b1261d9-ab21-4ec2-84d7-f12a2013607a","source":"wordfence","cve":"CVE-2017-18568","title":"My WP Translate <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1261d9-ab21-4ec2-84d7-f12a2013607a?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-translate","name":"My WP Translate","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2017-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b1449a9-6c89-4dec-8107-86cf8a295025","source":"wordfence","cve":"CVE-2023-6993","title":"Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1449a9-6c89-4dec-8107-86cf8a295025?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-types","name":"Custom post types, Custom Fields & more","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-07-29T21:36:05Z"},{"id":"wordfence:2b162b37-c28e-452c-a1e6-0d08341f81ac","source":"wordfence","cve":"CVE-2026-81296","title":"Fluent Forms Pro Add On Pack <= 6.2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b162b37-c28e-452c-a1e6-0d08341f81ac?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.12","to_inclusive":true,"patched_in":"6.2.13"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:00:41Z"},{"id":"wordfence:2b1751f0-d385-43f5-bf90-82479a9c6694","source":"wordfence","cve":"CVE-2026-2278","title":"VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1751f0-d385-43f5-bf90-82479a9c6694?source=api-prod","affected":[{"type":"theme","slug":"vw-writer-blog","name":"VW Writer Blog","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-19T07:43:13Z"},{"id":"wordfence:2b1933a5-48f3-4707-8e3d-824b60ce2635","source":"wordfence","cve":"CVE-2023-0487","title":"My Sticky Elements <= 2.0.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1933a5-48f3-4707-8e3d-824b60ce2635?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"2.0.8","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b1b21f4-2130-4b43-bf0b-cb8217770e72","source":"wordfence","cve":"CVE-2026-65522","title":"Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1b21f4-2130-4b43-bf0b-cb8217770e72?source=api-prod","affected":[{"type":"theme","slug":"manual","name":"Manual - Documentation, Knowledge Base & Education WordPress Theme","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:29:06Z"},{"id":"wordfence:2b1dc849-e306-4c09-a565-14d4e2427c69","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1dc849-e306-4c09-a565-14d4e2427c69?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-26T00:00:00Z","updated":"2026-10-28T21:02:41Z"},{"id":"wordfence:2b1f068f-6473-4875-a990-dd4bf337e7b7","source":"wordfence","cve":"CVE-2024-3919","title":"OpenPGP Form Encryption for WordPress <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1f068f-6473-4875-a990-dd4bf337e7b7?source=api-prod","affected":[{"type":"plugin","slug":"openpgp-form-encryption","name":"OpenPGP Form Encryption for WordPress","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:24:09Z"},{"id":"wordfence:2b1f8594-65fa-409c-b014-7de837ac45bf","source":"wordfence","cve":"CVE-2026-28567","title":"WP Sort Order <= 1.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1f8594-65fa-409c-b014-7de837ac45bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-sort-order","name":"WP Sort Order","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-09-09T16:25:32Z"},{"id":"wordfence:2b229ea2-3a7d-42bd-a235-ffd18e206c8b","source":"wordfence","cve":"CVE-2024-32804","title":"WP GoToWebinar <= 14.46 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b229ea2-3a7d-42bd-a235-ffd18e206c8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-gotowebinar","name":"WP GoToWebinar","from":"*","from_inclusive":true,"to":"14.46","to_inclusive":true,"patched_in":"15.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:44:17Z"},{"id":"wordfence:2b2302d9-426c-415b-a7d3-3a9de95d87d1","source":"wordfence","cve":"CVE-2023-54413","title":"WPML <= 4.6.0 - Reflected Cross-Site Scripting via wp_lang","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2302d9-426c-415b-a7d3-3a9de95d87d1?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2023-04-16T00:00:00Z","updated":"2026-10-28T14:57:48Z"},{"id":"wordfence:2b23b71d-1231-44ce-b992-5e74ddafb4bd","source":"wordfence","cve":"CVE-2018-21005","title":"bbPress Move Topics <= 1.1.4 - PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b23b71d-1231-44ce-b992-5e74ddafb4bd?source=api-prod","affected":[{"type":"plugin","slug":"bbp-move-topics","name":"bbPress Move Topics","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2018-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b24693f-6b69-4dfb-a18c-e929db09d020","source":"wordfence","cve":"","title":"Pagelines Theme < 1.4.6 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24693f-6b69-4dfb-a18c-e929db09d020?source=api-prod","affected":[{"type":"theme","slug":"pagelines","name":"Pagelines","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"}],"published":"2015-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b249842-c480-495a-8eec-6c7d0893ef1c","source":"wordfence","cve":"CVE-2023-51378","title":"Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b249842-c480-495a-8eec-6c7d0893ef1c?source=api-prod","affected":[{"type":"plugin","slug":"rise-blocks","name":"Rise Blocks \u2013 A Complete Gutenberg Page Builder","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b24ae23-d055-4740-bd86-126d503fce1b","source":"wordfence","cve":"CVE-2025-9500","title":"TablePress <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-08-29T16:24:26Z","updated":"2025-08-30T04:25:07Z"},{"id":"wordfence:2b2685ee-dc14-439a-9371-f94585c71a2a","source":"wordfence","cve":"CVE-2026-90888","title":"LeadSnap <= 1.25 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2685ee-dc14-439a-9371-f94585c71a2a?source=api-prod","affected":[{"type":"plugin","slug":"leadsnap","name":"LeadSnap","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2026-10-30T09:05:11Z","updated":"2026-11-03T20:13:41Z"},{"id":"wordfence:2b2714f7-9877-4d3d-a692-70fbf8584728","source":"wordfence","cve":"CVE-2023-27622","title":"GuruWalk Affiliates <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2714f7-9877-4d3d-a692-70fbf8584728?source=api-prod","affected":[{"type":"plugin","slug":"guruwalk-affiliates","name":"GuruWalk Affiliates","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b2769bc-523b-4a8f-9042-1e879db3f8ed","source":"wordfence","cve":"CVE-2014-8802","title":"Pie Register <= 2.0.13 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2769bc-523b-4a8f-9042-1e879db3f8ed?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2015-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b276c7d-598b-4b6d-b9f1-c650a1bef49b","source":"wordfence","cve":"CVE-2026-105973","title":"Visual Form Builder <= 3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b276c7d-598b-4b6d-b9f1-c650a1bef49b?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:04:23Z"},{"id":"wordfence:2b27a7b1-6fee-433f-8102-4a3745a8dfed","source":"wordfence","cve":"CVE-2025-4171","title":"WZ Followed Posts \u2013 Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b27a7b1-6fee-433f-8102-4a3745a8dfed?source=api-prod","affected":[{"type":"plugin","slug":"where-did-they-go-from-here","name":"WZ Followed Posts \u2013 Display what visitors are reading","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-05-06T18:49:05Z","updated":"2025-05-07T07:22:11Z"},{"id":"wordfence:2b28ddeb-44f5-4d19-b866-94fc2088ee6d","source":"wordfence","cve":"CVE-2025-14782","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.49.1","to_inclusive":true,"patched_in":"1.49.2"}],"published":"2026-01-08T17:47:08Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:2b290f4c-293d-41d5-b43e-b9c5c350552b","source":"wordfence","cve":"CVE-2024-2143","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b290f4c-293d-41d5-b43e-b9c5c350552b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T06:44:43Z"},{"id":"wordfence:2b294f01-d99a-4977-aa11-fa698291f02d","source":"wordfence","cve":"CVE-2026-62051","title":"Stargaze <= 1.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b294f01-d99a-4977-aa11-fa698291f02d?source=api-prod","affected":[{"type":"theme","slug":"stargaze","name":"Stargaze","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T07:27:41Z","updated":"2026-10-13T13:59:04Z"},{"id":"wordfence:2b2a10b6-e7dc-47c7-9f59-c4350d58b0d1","source":"wordfence","cve":"CVE-2024-32701","title":"InstaWP Connect <= 0.1.0.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2a10b6-e7dc-47c7-9f59-c4350d58b0d1?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.24","to_inclusive":true,"patched_in":"0.1.0.25"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:51:51Z"},{"id":"wordfence:2b2b812d-b2bd-45d7-b712-482f41356764","source":"wordfence","cve":"CVE-2025-62028","title":"Salient < 17.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2b812d-b2bd-45d7-b712-482f41356764?source=api-prod","affected":[{"type":"theme","slug":"salient","name":"Salient | Creative Multipurpose & WooCommerce Theme","from":"*","from_inclusive":true,"to":"17.4.0","to_inclusive":false,"patched_in":"17.4.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:14:00Z"},{"id":"wordfence:2b2c2d52-7d76-4b7a-98e5-d3843720954a","source":"wordfence","cve":"CVE-2024-33565","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2c2d52-7d76-4b7a-98e5-d3843720954a?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:37:31Z"},{"id":"wordfence:2b2fa832-ed1b-47e9-b9eb-049541530ab6","source":"wordfence","cve":"","title":"Blogroll Fun \u2013 Show Last Post and Last Update Time < 0.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b2fa832-ed1b-47e9-b9eb-049541530ab6?source=api-prod","affected":[{"type":"plugin","slug":"blogroll-fun","name":"Blogroll Fun \u2013 Show  Last Post and Last Update Time","from":"*","from_inclusive":true,"to":"0.8.4","to_inclusive":true,"patched_in":"0.8.5"}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b300f55-f1ee-4345-adc2-32cd3b081a30","source":"wordfence","cve":"CVE-2017-5487","title":"WordPress Core < 4.7.1 - Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b300f55-f1ee-4345-adc2-32cd3b081a30?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b32cc12-c8d5-40b8-9510-42699beec581","source":"wordfence","cve":"CVE-2024-8633","title":"Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b32cc12-c8d5-40b8-9510-42699beec581?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.27","to_inclusive":true,"patched_in":"1.15.28"}],"published":"2024-09-25T23:14:51Z","updated":"2024-09-26T11:32:38Z"},{"id":"wordfence:2b335807-f4d1-43b3-9e1b-2215eb00a3f8","source":"wordfence","cve":"","title":"WP Meteor Page Speed Optimization Topping <= 3.1.4 -Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b335807-f4d1-43b3-9e1b-2215eb00a3f8?source=api-prod","affected":[{"type":"plugin","slug":"wp-meteor","name":"WP Meteor Website Speed Optimization Addon","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b346ae7-e3aa-4728-8dd9-e77fc388576e","source":"wordfence","cve":"CVE-2014-9570","title":"Simple Security <= 1.1.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b346ae7-e3aa-4728-8dd9-e77fc388576e?source=api-prod","affected":[{"type":"plugin","slug":"simple-security","name":"Simple Security","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2015-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b3644fe-6e36-44a2-b72e-c5b6b0900f6d","source":"wordfence","cve":"CVE-2026-39771","title":"BuddyBoss Platform <= 3.1.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b3644fe-6e36-44a2-b72e-c5b6b0900f6d?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:58:27Z"},{"id":"wordfence:2b365fb8-7a93-4306-b2b1-ce47dc19457a","source":"wordfence","cve":"CVE-2023-32747","title":"WooCommerce Bookings <= 1.15.78 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b365fb8-7a93-4306-b2b1-ce47dc19457a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bookings","name":"WooCommerce Bookings","from":"*","from_inclusive":true,"to":"1.15.78","to_inclusive":true,"patched_in":"1.15.79"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b38f102-e3ad-4715-99d0-ef8524e5c455","source":"wordfence","cve":"CVE-2024-52384","title":"Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b38f102-e3ad-4715-99d0-ef8524e5c455?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-generator","name":"Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:34:46Z"},{"id":"wordfence:2b39abc8-9281-4d58-a9ec-877c5bae805a","source":"wordfence","cve":"CVE-2024-2125","title":"Env\u00edaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b39abc8-9281-4d58-a9ec-877c5bae805a?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-16T21:10:51Z"},{"id":"wordfence:2b3b9576-7c7d-4665-92d5-03aa292cdbbe","source":"wordfence","cve":"CVE-2022-47441","title":"Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b3b9576-7c7d-4665-92d5-03aa292cdbbe?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.7.0.10","to_inclusive":true,"patched_in":"1.7.0.11"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b3cc002-5a53-4e20-b3ef-e273e658329d","source":"wordfence","cve":"CVE-2026-88849","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education 3.7.13 - 3.7.54 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b3cc002-5a53-4e20-b3ef-e273e658329d?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"3.7.13","from_inclusive":true,"to":"3.7.54","to_inclusive":true,"patched_in":"3.7.55"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-23T21:09:51Z"},{"id":"wordfence:2b4035c9-1ffa-465e-84cb-1c30bb4fb95c","source":"wordfence","cve":"CVE-2025-32268","title":"QR Code Tag for WC order emails <= 1.9.36 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4035c9-1ffa-465e-84cb-1c30bb4fb95c?source=api-prod","affected":[{"type":"plugin","slug":"qr-code-tag-for-wc-from-goaskle-com","name":"QR Code for WooCommerce order emails, PDF invoices, packing slips","from":"*","from_inclusive":true,"to":"1.9.36","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T20:44:03Z"},{"id":"wordfence:2b409d63-a2e2-4304-90f2-dfa11db54be1","source":"wordfence","cve":"CVE-2026-24968","title":"Xagio SEO \u2013 AI Powered SEO <= 7.1.0.30 - Unauthenticated Privilege Escalation","severity":"medium","cvss":5.3,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b409d63-a2e2-4304-90f2-dfa11db54be1?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.30","to_inclusive":true,"patched_in":"7.1.0.31"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:48:36Z"},{"id":"wordfence:2b418e58-d3f0-4118-b122-cbcae1c39895","source":"wordfence","cve":"CVE-2025-69118","title":"CopyPress <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b418e58-d3f0-4118-b122-cbcae1c39895?source=api-prod","affected":[{"type":"theme","slug":"copypress","name":"CopyPress","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:30:22Z"},{"id":"wordfence:2b45674c-8446-44eb-a45a-15dab02c89cf","source":"wordfence","cve":"CVE-2024-10938","title":"OVRI Payment 1.7.0 - Malicious .htaccess directive","severity":"medium","cvss":6.5,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b45674c-8446-44eb-a45a-15dab02c89cf?source=api-prod","affected":[{"type":"plugin","slug":"moneytigo","name":"OVRI Payment","from":"1.7.0","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-02-27T09:23:42Z"},{"id":"wordfence:2b47c50c-ef86-4ecf-be6e-21ceb41da723","source":"wordfence","cve":"CVE-2025-47580","title":"Front End Users <= 3.2.32 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b47c50c-ef86-4ecf-be6e-21ceb41da723?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.32","to_inclusive":true,"patched_in":""}],"published":"2025-05-15T00:00:00Z","updated":"2025-11-17T16:29:20Z"},{"id":"wordfence:2b4976a1-ef5c-450f-b72e-237cf403e605","source":"wordfence","cve":"CVE-2026-119509","title":"ClickCease Click Fraud Protection <= 3.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4976a1-ef5c-450f-b72e-237cf403e605?source=api-prod","affected":[{"type":"plugin","slug":"clickcease-click-fraud-protection","name":"ClickCease Click Fraud Protection","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:37:53Z"},{"id":"wordfence:2b49897d-ebf5-4ac3-99c0-fa5e90818673","source":"wordfence","cve":"CVE-2025-15658","title":"Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b49897d-ebf5-4ac3-99c0-fa5e90818673?source=api-prod","affected":[{"type":"plugin","slug":"wp-emmet","name":"WP Emmet","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2026-07-10T19:03:30Z"},{"id":"wordfence:2b49add4-a4ae-4527-95bd-c295200eeedd","source":"wordfence","cve":"CVE-2024-47637","title":"LiteSpeed Cache <= 6.4.1 - Authenticated (Author+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b49add4-a4ae-4527-95bd-c295200eeedd?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:12:02Z"},{"id":"wordfence:2b4aa268-a1c9-4ab0-8db4-483adae1d45e","source":"wordfence","cve":"CVE-2025-49911","title":"WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4aa268-a1c9-4ab0-8db4-483adae1d45e?source=api-prod","affected":[{"type":"plugin","slug":"woo-vehicle-parts-finder","name":"WooCommerce Vehicle Parts Finder","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:01:43Z"},{"id":"wordfence:2b4b0640-d61a-4969-a5c0-d2d709fb56d0","source":"wordfence","cve":"CVE-2025-12496","title":"Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4b0640-d61a-4969-a5c0-d2d709fb56d0?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.203","to_inclusive":true,"patched_in":"3.3.204"}],"published":"2025-12-16T18:43:41Z","updated":"2025-12-17T07:21:02Z"},{"id":"wordfence:2b4cc8f5-f95c-4ab7-aee9-cbdc06cc3e9a","source":"wordfence","cve":"CVE-2024-35742","title":"Easy Forms for Mailchimp <= 6.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4cc8f5-f95c-4ab7-aee9-cbdc06cc3e9a?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:24:52Z"},{"id":"wordfence:2b4df2b3-8d85-4e5c-8ead-92ed2259c84a","source":"wordfence","cve":"CVE-2021-24704","title":"Orange Form <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4df2b3-8d85-4e5c-8ead-92ed2259c84a?source=api-prod","affected":[{"type":"plugin","slug":"orange-form","name":"Orange Form","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b4e7c02-48d3-4271-a3bc-e7d3256b7217","source":"wordfence","cve":"CVE-2023-30497","title":"LINE Notify <= 1.4.4 - Reflected Cross-Site Scripting via 'uid'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b4e7c02-48d3-4271-a3bc-e7d3256b7217?source=api-prod","affected":[{"type":"plugin","slug":"wp-line-notify","name":"WP LINE Notify","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b581c4d-a95f-4922-95bb-15f24010ca34","source":"wordfence","cve":"CVE-2024-32140","title":"Libsyn Publisher Hub <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b581c4d-a95f-4922-95bb-15f24010ca34?source=api-prod","affected":[{"type":"plugin","slug":"libsyn-podcasting","name":"Libsyn Publisher Hub","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:03:20Z"},{"id":"wordfence:2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b","source":"wordfence","cve":"CVE-2025-2163","title":"Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b58fb0f-c7ac-4ee6-84f1-ac14617a7c2b?source=api-prod","affected":[{"type":"plugin","slug":"zoorum-comments","name":"Zoorum Comments","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T14:24:07Z","updated":"2025-03-15T03:23:23Z"},{"id":"wordfence:2b59d281-d5c8-455a-8aa8-b03847bdd45f","source":"wordfence","cve":"CVE-2024-6465","title":"WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b59d281-d5c8-455a-8aa8-b03847bdd45f?source=api-prod","affected":[{"type":"plugin","slug":"wp-links-page","name":"WP Links Page","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-13T11:19:02Z"},{"id":"wordfence:2b5a57d2-13bb-43d8-b495-e1d4d933b138","source":"wordfence","cve":"CVE-2024-54239","title":"Eyewear prescription form <= 4.0.18 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5a57d2-13bb-43d8-b495-e1d4d933b138?source=api-prod","affected":[{"type":"plugin","slug":"eyewear-prescription-form","name":"Eyewear prescription form","from":"*","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"4.0.19"}],"published":"2024-12-06T00:00:00Z","updated":"2025-01-17T13:30:46Z"},{"id":"wordfence:2b5ad113-f739-455a-9db6-b4f300b92837","source":"wordfence","cve":"CVE-2024-6339","title":"Phlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5ad113-f739-455a-9db6-b4f300b92837?source=api-prod","affected":[{"type":"theme","slug":"phlox-pro","name":"Phlox PRO","from":"*","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-21T07:33:24Z"},{"id":"wordfence:2b5d0d8f-fee6-4bee-9b01-c23ce1f27dfe","source":"wordfence","cve":"CVE-2025-28909","title":"WP No-Bot Question <= 0.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5d0d8f-fee6-4bee-9b01-c23ce1f27dfe?source=api-prod","affected":[{"type":"plugin","slug":"wp-no-bot-question","name":"WP No-Bot Question","from":"*","from_inclusive":true,"to":"0.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:24:19Z"},{"id":"wordfence:2b5d27cc-c6eb-4c5c-8ee1-30483b91c6fd","source":"wordfence","cve":"CVE-2026-5127","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5d27cc-c6eb-4c5c-8ee1-30483b91c6fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-05-07T19:58:37Z","updated":"2026-05-08T08:26:34Z"},{"id":"wordfence:2b5d64b8-c339-4bbc-b91e-4805428f7296","source":"wordfence","cve":"CVE-2023-0733","title":"Newsletter Popup <= 1.2 - Unauthenticted Stored Cross-Site Scripting via 'nl_data'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5d64b8-c339-4bbc-b91e-4805428f7296?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b5eecb3-b001-4a07-806d-5d4a39622853","source":"wordfence","cve":"CVE-2025-47467","title":"GS Testimonial Slider <= 3.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b5eecb3-b001-4a07-806d-5d4a39622853?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:16:06Z"},{"id":"wordfence:2b60b304-a128-4598-bf5f-b07b5e39cf29","source":"wordfence","cve":"CVE-2026-104393","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b60b304-a128-4598-bf5f-b07b5e39cf29?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.50.0","to_inclusive":true,"patched_in":"3.50.1"}],"published":"2026-10-07T09:15:00Z","updated":"2026-10-08T23:23:32Z"},{"id":"wordfence:2b60e693-472e-48ba-81c7-869c9b255762","source":"wordfence","cve":"CVE-2021-24837","title":"Passster \u2013 Password Protection <= 3.5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b60e693-472e-48ba-81c7-869c9b255762?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"3.5.5.7","to_inclusive":true,"patched_in":"3.5.5.8"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b63e7e0-e6c7-4c76-94f7-c1a8bc87c5fc","source":"wordfence","cve":"CVE-2025-60241","title":"Premmerce <= 1.3.19 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b63e7e0-e6c7-4c76-94f7-c1a8bc87c5fc?source=api-prod","affected":[{"type":"plugin","slug":"premmerce","name":"Premmerce","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2025-07-02T00:00:00Z","updated":"2026-01-06T18:39:12Z"},{"id":"wordfence:2b6489f8-061d-4fbd-81f2-9f508dd0e7f8","source":"wordfence","cve":"CVE-2021-3120","title":"YITH WooCommerce Gift Cards Premium <= 3.3.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b6489f8-061d-4fbd-81f2-9f508dd0e7f8?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-gift-cards-premium","name":"YITH WooCommerce Gift Cards Premium","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":false,"patched_in":"3.3.1"}],"published":"2021-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b654497-ee47-47e9-b88c-7445989896d6","source":"wordfence","cve":"CVE-2025-53280","title":"Football Pool <= 2.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b654497-ee47-47e9-b88c-7445989896d6?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.6"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-08T19:14:24Z"},{"id":"wordfence:2b670550-cf04-4db1-95e7-0330b5793c58","source":"wordfence","cve":"CVE-2023-32501","title":"VikBooking Hotel Booking Engine & PMS <= 1.6.1 - Cross-Site Request Forgery in multiple functions in admin/controller.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b670550-cf04-4db1-95e7-0330b5793c58?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b696e0b-d4e1-4a81-9204-929100ade073","source":"wordfence","cve":"CVE-2023-32738","title":"Eonet Manual User Approve <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b696e0b-d4e1-4a81-9204-929100ade073?source=api-prod","affected":[{"type":"plugin","slug":"eonet-manual-user-approve","name":"Eonet Manual User Approve","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b69f90a-1dd3-4184-aee3-9b0251b981cc","source":"wordfence","cve":"CVE-2024-30225","title":"WP Migrate Pro <= 2.6.10 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b69f90a-1dd3-4184-aee3-9b0251b981cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-migrate-db-pro","name":"WP Migrate Pro","from":"*","from_inclusive":true,"to":"2.6.10","to_inclusive":true,"patched_in":"2.6.11"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-07T21:08:20Z"},{"id":"wordfence:2b6b4953-a264-4668-9cc3-1578109f6592","source":"wordfence","cve":"CVE-2023-1086","title":"Preview Link Generator <= 1.0.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b6b4953-a264-4668-9cc3-1578109f6592?source=api-prod","affected":[{"type":"plugin","slug":"preview-link-generator","name":"Preview Link Generator","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b6ffd9b-9a3a-4730-ab56-66686b24f214","source":"wordfence","cve":"CVE-2025-24626","title":"Music Store \u2013 WordPress eCommerce <= 1.1.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b6ffd9b-9a3a-4730-ab56-66686b24f214?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-12-30T00:00:00Z","updated":"2025-02-20T16:35:51Z"},{"id":"wordfence:2b70032d-cfd5-4415-a5d6-d594ed265a5b","source":"wordfence","cve":"CVE-2025-68514","title":"Paid Member Subscriptions <= 2.16.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b70032d-cfd5-4415-a5d6-d594ed265a5b?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.16.8","to_inclusive":true,"patched_in":"2.16.9"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:36:31Z"},{"id":"wordfence:2b7220a4-7178-42f7-978b-96eae777b134","source":"wordfence","cve":"","title":"FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b7220a4-7178-42f7-978b-96eae777b134?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.15.727","to_inclusive":false,"patched_in":"7.3.15.727"}],"published":"2019-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b72bf37-05c8-424e-98d1-39fe032368ad","source":"wordfence","cve":"CVE-2016-10919","title":"WassUp Real Time Analytics < 1.9.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b72bf37-05c8-424e-98d1-39fe032368ad?source=api-prod","affected":[{"type":"plugin","slug":"wassup","name":"WassUp Real Time Analytics","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":false,"patched_in":"1.9.1"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b732bce-29a5-4b1f-99a2-b3153c0e82ed","source":"wordfence","cve":"CVE-2025-68588","title":"TS Poll <= 2.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b732bce-29a5-4b1f-99a2-b3153c0e82ed?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-12-22T00:00:00Z","updated":"2026-04-15T13:32:23Z"},{"id":"wordfence:2b737a26-e4ae-4c9f-a98a-a22a31ac4f99","source":"wordfence","cve":"CVE-2023-27610","title":"Transbank Webpay REST <= 1.6.6 - Authenticated (Administrator+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b737a26-e4ae-4c9f-a98a-a22a31ac4f99?source=api-prod","affected":[{"type":"plugin","slug":"transbank-webpay-plus-rest","name":"Transbank Webpay","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b73d48a-1f10-4e47-a18f-82a3103b72bd","source":"wordfence","cve":"CVE-2025-11174","title":"Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73d48a-1f10-4e47-a18f-82a3103b72bd?source=api-prod","affected":[{"type":"plugin","slug":"document-library-lite","name":"Document Library Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-10-31T13:31:48Z","updated":"2025-11-01T01:47:41Z"},{"id":"wordfence:2b73e9f0-ba52-4dd2-8b1c-36d9f095a828","source":"wordfence","cve":"CVE-2026-80438","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure","severity":"low","cvss":3.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b73e9f0-ba52-4dd2-8b1c-36d9f095a828?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.14.0","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:04:03Z"},{"id":"wordfence:2b747d61-4528-485e-b746-6dddc64485b5","source":"wordfence","cve":"CVE-2024-11132","title":"Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b747d61-4528-485e-b746-6dddc64485b5?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.9.4","to_inclusive":true,"patched_in":"3.9.9.5"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-21T04:51:36Z"},{"id":"wordfence:2b75dce8-3e31-45e8-b193-5df3e4391e56","source":"wordfence","cve":"CVE-2023-25716","title":"Announce from the Dashboard <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b75dce8-3e31-45e8-b193-5df3e4391e56?source=api-prod","affected":[{"type":"plugin","slug":"announce-from-the-dashboard","name":"Announce from the Dashboard","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b77703e-b3d3-4105-a162-0afe86d5b3eb","source":"wordfence","cve":"CVE-2024-5192","title":"Funnel Builder for WordPress by FunnelKit \u2013 Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b77703e-b3d3-4105-a162-0afe86d5b3eb?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T04:33:30Z"},{"id":"wordfence:2b78e4fc-fbae-49c2-9328-e138c17fca91","source":"wordfence","cve":"CVE-2026-53675","title":"BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b78e4fc-fbae-49c2-9328-e138c17fca91?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-10-13T19:29:29Z"},{"id":"wordfence:2b7ca272-88ac-4002-b4ce-73ad5d0510ef","source":"wordfence","cve":"CVE-2019-15772","title":"Donations < 1.4 - Unauthenticated Arbitrary Options Change","severity":"high","cvss":8.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b7ca272-88ac-4002-b4ce-73ad5d0510ef?source=api-prod","affected":[{"type":"plugin","slug":"nd-donations","name":"Donations","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2019-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b80fb3b-c874-468f-860b-ea0f93bb95bd","source":"wordfence","cve":"CVE-2026-57672","title":"wpDataTables (Premium) <= 6.5.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b80fb3b-c874-468f-860b-ea0f93bb95bd?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"6.5.1.1","to_inclusive":true,"patched_in":"6.5.1.2"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:05:39Z"},{"id":"wordfence:2b818d20-8137-4e12-bc5a-325b6d213ebd","source":"wordfence","cve":"CVE-2024-49672","title":"Google Docs RSVP <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b818d20-8137-4e12-bc5a-325b6d213ebd?source=api-prod","affected":[{"type":"plugin","slug":"google-docs-rsvp-guestlist","name":"Google Docs RSVP, WordPress Plugin","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:42:32Z"},{"id":"wordfence:2b81a643-e04a-4e7f-91dd-9241fdd1a3ac","source":"wordfence","cve":"CVE-2024-47355","title":"Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b81a643-e04a-4e7f-91dd-9241fdd1a3ac?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:33:55Z"},{"id":"wordfence:2b81d7fc-6050-40bb-9416-e8d7d20e8ef8","source":"wordfence","cve":"CVE-2019-14683","title":"Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b81d7fc-6050-40bb-9416-e8d7d20e8ef8?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.14.1.3","to_inclusive":true,"patched_in":"1.14.2.2"}],"published":"2019-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b821728-eb16-4157-906f-96f6420fa850","source":"wordfence","cve":"CVE-2025-66115","title":"Easy Invoice <= 2.1.4 - Authenticated (Administrator+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b821728-eb16-4157-906f-96f6420fa850?source=api-prod","affected":[{"type":"plugin","slug":"easy-invoice","name":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T16:54:04Z"},{"id":"wordfence:2b8306b8-1f4c-48fb-8eb7-bf02a2f77e04","source":"wordfence","cve":"CVE-2011-4646","title":"WP-PostRatings <= 1.61 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8306b8-1f4c-48fb-8eb7-bf02a2f77e04?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings","name":"WP-PostRatings","from":"*","from_inclusive":true,"to":"1.61","to_inclusive":true,"patched_in":"1.62"}],"published":"2011-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b84804d-cb60-4f83-a027-60455c9556c3","source":"wordfence","cve":"CVE-2025-32283","title":"Solar Energy <= 3.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b84804d-cb60-4f83-a027-60455c9556c3?source=api-prod","affected":[{"type":"theme","slug":"solar","name":"Solar Energy - Wind & Power Company WordPress Theme","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:30:55Z"},{"id":"wordfence:2b881c73-2dfc-4b73-99f3-33432b750efd","source":"wordfence","cve":"CVE-2022-40131","title":"Page View Count <= 2.5.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b881c73-2dfc-4b73-99f3-33432b750efd?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2022-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b897790-43f7-4ca4-8abe-9dc736a7c011","source":"wordfence","cve":"CVE-2022-1764","title":"WP-chgFontSize <= 1.8 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b897790-43f7-4ca4-8abe-9dc736a7c011?source=api-prod","affected":[{"type":"plugin","slug":"wp-chgfontsize","name":"WP-chgFontSize","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b8ad348-80b2-47d8-96d5-a0f043ce0297","source":"wordfence","cve":"CVE-2025-30832","title":"Themify Event Post <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8ad348-80b2-47d8-96d5-a0f043ce0297?source=api-prod","affected":[{"type":"plugin","slug":"themify-event-post","name":"Themify Event Post","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:48:43Z"},{"id":"wordfence:2b8b6580-1886-4b50-a782-1bde703b37b0","source":"wordfence","cve":"CVE-2026-28152","title":"Tonda Core < 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8b6580-1886-4b50-a782-1bde703b37b0?source=api-prod","affected":[{"type":"plugin","slug":"tonda-core","name":"Tonda Core","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:03:06Z"},{"id":"wordfence:2b8da4db-65f4-4c94-91c9-186d3abb7d51","source":"wordfence","cve":"CVE-2025-52773","title":"HieCOR Payment Gateway Plugin <= 1.5.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8da4db-65f4-4c94-91c9-186d3abb7d51?source=api-prod","affected":[{"type":"plugin","slug":"hcv4-payment-gateway","name":"HieCOR Payment Gateway Plugin","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-23T00:00:00Z","updated":"2025-10-17T19:29:31Z"},{"id":"wordfence:2b8db99d-95ec-41e6-bdb4-9db598ed80e1","source":"wordfence","cve":"CVE-2026-57724","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8db99d-95ec-41e6-bdb4-9db598ed80e1?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"6.0.13"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:56:44Z"},{"id":"wordfence:2b8fb88d-4311-41ef-893b-ddd4409c2026","source":"wordfence","cve":"CVE-2024-51858","title":"Social Locker <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b8fb88d-4311-41ef-893b-ddd4409c2026?source=api-prod","affected":[{"type":"plugin","slug":"social-locker-content","name":"Social Locker \u2013 Increase Traffic","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:09:20Z"},{"id":"wordfence:2b90c0a2-19b2-4846-9f62-2b02d28cc13b","source":"wordfence","cve":"CVE-2023-4810","title":"Responsive Pricing Table <= 5.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b90c0a2-19b2-4846-9f62-2b02d28cc13b?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b959b65-16ad-45f9-9ad9-dfc97bda571e","source":"wordfence","cve":"CVE-2023-5140","title":"Bonus for Woo <= 5.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b959b65-16ad-45f9-9ad9-dfc97bda571e?source=api-prod","affected":[{"type":"plugin","slug":"bonus-for-woo","name":"Bonus for Woo","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.8.3"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2b95b72e-b986-4492-9537-74fecf5e93a8","source":"wordfence","cve":"CVE-2024-51662","title":"Black Widgets For Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b95b72e-b986-4492-9537-74fecf5e93a8?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:44:30Z"},{"id":"wordfence:2b995c66-f228-427e-b1b1-edcd5cb38041","source":"wordfence","cve":"CVE-2026-118047","title":"Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b995c66-f228-427e-b1b1-edcd5cb38041?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-11-06T23:00:13Z","updated":"2026-11-07T11:26:25Z"},{"id":"wordfence:2b9999f4-6bff-4658-ad58-7707e0d22ccc","source":"wordfence","cve":"CVE-2025-58862","title":"WordPress Events Calendar Plugin \u2013 connectDaily <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9999f4-6bff-4658-ad58-7707e0d22ccc?source=api-prod","affected":[{"type":"plugin","slug":"connect-daily-web-calendar","name":"connectDaily Events Calendar Plugin","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:34:00Z"},{"id":"wordfence:2b99e525-c1d3-463d-8b87-b7d7fdd535d1","source":"wordfence","cve":"CVE-2026-14975","title":"WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b99e525-c1d3-463d-8b87-b7d7fdd535d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download","name":"WP File Download","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2026-09-04T18:31:13Z","updated":"2026-09-09T17:48:48Z"},{"id":"wordfence:2b9b501e-2ce7-43d8-bad2-6c3176eed8e2","source":"wordfence","cve":"CVE-2025-6729","title":"PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-paymaster-gateway-019","name":"PayMaster for WooCommerce","from":"*","from_inclusive":true,"to":"0.4.31","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:22:19Z","updated":"2025-07-04T01:44:03Z"},{"id":"wordfence:2b9c4ca8-e5cd-4c4f-8d81-b06367c89fd7","source":"wordfence","cve":"CVE-2026-6742","title":"Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9c4ca8-e5cd-4c4f-8d81-b06367c89fd7?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2026.1","to_inclusive":true,"patched_in":"2026.2"}],"published":"2026-07-07T23:30:59Z","updated":"2026-07-08T11:35:40Z"},{"id":"wordfence:2b9da491-771a-4100-b41a-7411981dd34b","source":"wordfence","cve":"CVE-2026-1838","title":"Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9da491-771a-4100-b41a-7411981dd34b?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-04-17T11:44:41Z","updated":"2026-04-18T01:26:04Z"},{"id":"wordfence:2b9e27ed-9e7b-4097-a298-ea8bfe487dfc","source":"wordfence","cve":"CVE-2026-110881","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9e27ed-9e7b-4097-a298-ea8bfe487dfc?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-10-29T14:25:00Z","updated":"2026-11-03T19:22:50Z"},{"id":"wordfence:2b9ea2a2-34af-408c-91ee-6d5fd9431529","source":"wordfence","cve":"CVE-2025-14447","title":"AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9ea2a2-34af-408c-91ee-6d5fd9431529?source=api-prod","affected":[{"type":"plugin","slug":"annuncifunebri-onoranza","name":"AnnunciFunebri","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2025-12-12T16:04:52Z","updated":"2026-03-27T11:00:54Z"},{"id":"wordfence:2ba4a8bb-c67c-42c5-8c4e-229756babc5f","source":"wordfence","cve":"","title":"Multi Plugin Installer < 1.2.0 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba4a8bb-c67c-42c5-8c4e-229756babc5f?source=api-prod","affected":[{"type":"plugin","slug":"multi-plugin-installer","name":"multi-plugin-installer","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ba55591-f4f3-4e90-9358-ca9c7ca01b09","source":"wordfence","cve":"","title":"MapifyLite and MapifyPro <= 3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba55591-f4f3-4e90-9358-ca9c7ca01b09?source=api-prod","affected":[{"type":"plugin","slug":"mapifylite","name":"MapifyLite (by MapifyPro)","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2021-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ba556d0-48f9-4953-a5aa-876284e56360","source":"wordfence","cve":"CVE-2021-38312","title":"Gutenberg Template Library & Redux Framework <= 4.2.1 - Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion","severity":"high","cvss":7.1,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba556d0-48f9-4953-a5aa-876284e56360?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"4.2.13"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ba56b4c-0573-4911-97a4-a51e867daa75","source":"wordfence","cve":"CVE-2023-27445","title":"Blog Floating Button <= 1.4.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba56b4c-0573-4911-97a4-a51e867daa75?source=api-prod","affected":[{"type":"plugin","slug":"blog-floating-button","name":"Blog Floating Button","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.4.13"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ba5c8e6-e3ab-4ba5-9f9d-10f54476ccc3","source":"wordfence","cve":"CVE-2024-49249","title":"SMSA Shipping <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba5c8e6-e3ab-4ba5-9f9d-10f54476ccc3?source=api-prod","affected":[{"type":"plugin","slug":"smsa-shipping-official","name":"SMSA Shipping (official)","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-01-06T00:00:00Z","updated":"2026-04-24T19:38:04Z"},{"id":"wordfence:2ba63578-c65e-4050-aa68-1d6351fccd06","source":"wordfence","cve":"CVE-2026-8163","title":"Infility Global < 2.15.19 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba63578-c65e-4050-aa68-1d6351fccd06?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.19","to_inclusive":false,"patched_in":"2.15.19"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:48:12Z"},{"id":"wordfence:2ba73538-fa6b-43d2-8253-759ee962c838","source":"wordfence","cve":"CVE-2025-32489","title":"Wetterwarner <= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ba73538-fa6b-43d2-8253-759ee962c838?source=api-prod","affected":[{"type":"plugin","slug":"wetterwarner","name":"Wetterwarner","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.8"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T13:37:03Z"},{"id":"wordfence:2baab094-5ece-41a2-821a-b594a2c2327e","source":"wordfence","cve":"CVE-2023-47844","title":"Grab & Save <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2baab094-5ece-41a2-821a-b594a2c2327e?source=api-prod","affected":[{"type":"plugin","slug":"save-grab","name":"Grab & Save","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bad2c75-c111-45e9-ad8c-c8f3af0e3154","source":"wordfence","cve":"CVE-2026-65567","title":"Event Tickets and Registration <= 5.29.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bad2c75-c111-45e9-ad8c-c8f3af0e3154?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.0.1","to_inclusive":true,"patched_in":"5.29.1"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:35:39Z"},{"id":"wordfence:2badc91f-78de-4152-8207-699fc5c86935","source":"wordfence","cve":"CVE-2025-30548","title":"Advanced Post Search <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2badc91f-78de-4152-8207-699fc5c86935?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-search","name":"Advanced Post Search","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:25:30Z"},{"id":"wordfence:2baf528d-a24b-4cad-99c9-5fef9df3fe6d","source":"wordfence","cve":"CVE-2017-1002025","title":"Add Edit Delete Listing Module <= 1.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2baf528d-a24b-4cad-99c9-5fef9df3fe6d?source=api-prod","affected":[{"type":"plugin","slug":"add-edit-delete-listing-for-member-module","name":"Add Edit Delete Listing Module","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bafede8-9bd0-4c38-a402-42d419cc03fa","source":"wordfence","cve":"CVE-2024-33946","title":"WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bafede8-9bd0-4c38-a402-42d419cc03fa?source=api-prod","affected":[{"type":"plugin","slug":"wpify-woo","name":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:38:06Z"},{"id":"wordfence:2bb15304-1e46-44c6-b21b-e6768b79240a","source":"wordfence","cve":"CVE-2024-47342","title":"Accordion <= 2.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb15304-1e46-44c6-b21b-e6768b79240a?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.2.99","to_inclusive":true,"patched_in":"2.2.100"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:18:48Z"},{"id":"wordfence:2bb1aadd-5a7d-4a0c-8e5e-9ba7024e9c55","source":"wordfence","cve":"CVE-2025-31534","title":"Shopper <= 3.2.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb1aadd-5a7d-4a0c-8e5e-9ba7024e9c55?source=api-prod","affected":[{"type":"plugin","slug":"shopper","name":"Shopper  \u2013 Affiliate Link Management, 25000+ Brand Partnerships & Creative Product Displays","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-25T15:05:15Z"},{"id":"wordfence:2bb47ffd-1375-444c-8c55-05b59cb03f63","source":"wordfence","cve":"CVE-2026-34885","title":"Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb47ffd-1375-444c-8c55-05b59cb03f63?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.34","to_inclusive":true,"patched_in":"3.35"}],"published":"2026-04-06T00:00:00Z","updated":"2026-04-13T21:13:02Z"},{"id":"wordfence:2bb4ead4-b2ad-42b4-92a0-fb7293f6df06","source":"wordfence","cve":"CVE-2025-2110","title":"WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.30.15","to_inclusive":true,"patched_in":"6.30.16"}],"published":"2025-03-25T21:29:35Z","updated":"2025-03-26T11:22:10Z"},{"id":"wordfence:2bbc1a85-013c-4a61-86a8-54b823ffdfb1","source":"wordfence","cve":"CVE-2026-8293","title":"Really Simple Security <= 9.5.10.0 - Two Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbc1a85-013c-4a61-86a8-54b823ffdfb1?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.5.10.0","to_inclusive":true,"patched_in":"9.5.10.1"}],"published":"2026-06-12T00:00:00Z","updated":"2026-08-21T13:54:12Z"},{"id":"wordfence:2bbe86c8-d568-49e2-bf3f-830c1dd53dec","source":"wordfence","cve":"CVE-2025-39534","title":"Ninja Tables Pro <= 5.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbe86c8-d568-49e2-bf3f-830c1dd53dec?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables-pro","name":"Ninja Tables Pro","from":"*","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"5.0.18"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:08:47Z"},{"id":"wordfence:2bbead5c-b9c7-47b9-aba4-0753b3073ae5","source":"wordfence","cve":"CVE-2026-10522","title":"MemberHero \u2013 Simple User Registration & Login <= 6.9 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbead5c-b9c7-47b9-aba4-0753b3073ae5?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:46:53Z"},{"id":"wordfence:2bbf4e86-308c-43f3-a54c-e1c6ee21260e","source":"wordfence","cve":"CVE-2023-34184","title":"Woocommerce Order address Print <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbf4e86-308c-43f3-a54c-e1c6ee21260e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-order-address-print","name":"Woocommerce Order address Print","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bbf5adc-df9c-4629-909c-932998c50508","source":"wordfence","cve":"CVE-2016-1000151","title":"Tera Charts <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbf5adc-df9c-4629-909c-932998c50508?source=api-prod","affected":[{"type":"plugin","slug":"tera-charts","name":"Tera Charts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-10-17T00:00:00Z","updated":"2024-08-15T18:13:47Z"},{"id":"wordfence:2bbf9526-1a82-496e-b762-6fa114ba8d46","source":"wordfence","cve":"CVE-2023-23704","title":"Comments Ratings <= 1.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbf9526-1a82-496e-b762-6fa114ba8d46?source=api-prod","affected":[{"type":"plugin","slug":"comments-ratings","name":"Comments Ratings","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bbfbbd4-9055-4ede-8a51-d49e000aa4f9","source":"wordfence","cve":"CVE-2026-25436","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bbfbbd4-9055-4ede-8a51-d49e000aa4f9?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1053","to_inclusive":false,"patched_in":"1.7.1053"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:29:37Z"},{"id":"wordfence:2bc07a16-a3c7-4831-a226-355f303f31a7","source":"wordfence","cve":"CVE-2026-48882","title":"WP Time Slots Booking Form <= 1.2.50 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc07a16-a3c7-4831-a226-355f303f31a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.50","to_inclusive":true,"patched_in":"1.2.51"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:50:01Z"},{"id":"wordfence:2bc0b654-5174-41bc-9e8a-40257ceb7ded","source":"wordfence","cve":"CVE-2024-5504","title":"Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc0b654-5174-41bc-9e8a-40257ceb7ded?source=api-prod","affected":[{"type":"plugin","slug":"rife-elementor-extensions","name":"Rife Extensions & Templates for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-07-01T19:26:57Z","updated":"2024-07-02T07:37:03Z"},{"id":"wordfence:2bc11785-6ec3-444f-9d06-0cc634429f9f","source":"wordfence","cve":"CVE-2025-23441","title":"Attach Gallery Posts <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc11785-6ec3-444f-9d06-0cc634429f9f?source=api-prod","affected":[{"type":"plugin","slug":"attach-gallery-posts","name":"Attach Gallery Posts","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:43:46Z"},{"id":"wordfence:2bc2c2f8-fb1c-4c37-83d1-d05abd17fbeb","source":"wordfence","cve":"CVE-2026-12510","title":"AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc2c2f8-fb1c-4c37-83d1-d05abd17fbeb?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T13:06:39Z"},{"id":"wordfence:2bc5451c-c43e-4286-8a72-5bb41cfdc064","source":"wordfence","cve":"CVE-2026-22346","title":"Slider Responsive Slideshow \u2013 Image slider, Gallery slideshow <= 1.5.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc5451c-c43e-4286-8a72-5bb41cfdc064?source=api-prod","affected":[{"type":"plugin","slug":"slider-responsive-slideshow","name":"Responsive Slideshow \u2013 Photo Carousel","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-10-08T09:56:59Z"},{"id":"wordfence:2bc82c22-8fac-409d-9331-b5cc3bd29c43","source":"wordfence","cve":"CVE-2025-48255","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc82c22-8fac-409d-9331-b5cc3bd29c43?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T17:01:24Z"},{"id":"wordfence:2bc8a3fb-176e-4bf0-b96e-6ccb9688254b","source":"wordfence","cve":"CVE-2026-0563","title":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc8a3fb-176e-4bf0-b96e-6ccb9688254b?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-street-view","name":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-01-08T18:02:02Z","updated":"2026-01-09T06:34:56Z"},{"id":"wordfence:2bc8c04f-3764-473e-a216-7c5dc49abfa8","source":"wordfence","cve":"CVE-2013-3532","title":"SpiderVPlayer <= 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bc8c04f-3764-473e-a216-7c5dc49abfa8?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2013-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bcb155d-a544-4315-921b-62a0bd6b1ca9","source":"wordfence","cve":"CVE-2026-49768","title":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bcb155d-a544-4315-921b-62a0bd6b1ca9?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.13","to_inclusive":true,"patched_in":"1.26.14"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:29:29Z"},{"id":"wordfence:2bcc2783-1c47-47e4-ba63-822012aba0a6","source":"wordfence","cve":"CVE-2026-15755","title":"Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bcc2783-1c47-47e4-ba63-822012aba0a6?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.45","to_inclusive":true,"patched_in":"1.4.46"}],"published":"2026-07-23T18:30:30Z","updated":"2026-07-24T06:51:59Z"},{"id":"wordfence:2bd07c8c-4b1e-4cfd-b3e7-de85de672f5d","source":"wordfence","cve":"CVE-2026-96531","title":"Optimole 4.0.0 - 4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd07c8c-4b1e-4cfd-b3e7-de85de672f5d?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"4.0.0","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"4.2.13"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T20:10:40Z"},{"id":"wordfence:2bd2ce54-9ccb-4943-a01a-c9e8c1ff2d0d","source":"wordfence","cve":"CVE-2022-45847","title":"WordPress Countdown Widget <= 3.1.9.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd2ce54-9ccb-4943-a01a-c9e8c1ff2d0d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-countdown-widget","name":"WordPress Countdown Widget","from":"*","from_inclusive":true,"to":"3.1.9.1","to_inclusive":true,"patched_in":"3.1.9.2"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bd53172-ddfa-481a-818d-626b9db6fe41","source":"wordfence","cve":"CVE-2024-2503","title":"Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd53172-ddfa-481a-818d-626b9db6fe41?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.2","to_inclusive":true,"patched_in":"2.6.9.3"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-31T15:30:12Z"},{"id":"wordfence:2bd6b66d-f33e-4287-850b-a199de72f6ad","source":"wordfence","cve":"CVE-2025-3510","title":"tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd6b66d-f33e-4287-850b-a199de72f6ad?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2025-05-01T14:50:00Z","updated":"2025-05-02T03:21:18Z"},{"id":"wordfence:2bd989c7-b7dc-4243-83ae-23621d100052","source":"wordfence","cve":"CVE-2025-64380","title":"Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd989c7-b7dc-4243-83ae-23621d100052?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2025-10-18T00:00:00Z","updated":"2025-11-17T18:15:23Z"},{"id":"wordfence:2bd9e63b-2a73-4fb7-9ff6-fc75f6763cc9","source":"wordfence","cve":"CVE-2026-104694","title":"Thrive Automator < 11.2 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd9e63b-2a73-4fb7-9ff6-fc75f6763cc9?source=api-prod","affected":[{"type":"plugin","slug":"thrive-automator","name":"Thrive Automator","from":"*","from_inclusive":true,"to":"11.2","to_inclusive":false,"patched_in":"11.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:19:50Z"},{"id":"wordfence:2bdb68bc-b773-4537-98dd-c54ffa5309c7","source":"wordfence","cve":"CVE-2018-5285","title":"ImageInject <= 1.15 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bdb68bc-b773-4537-98dd-c54ffa5309c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-inject","name":"ImageInject","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.16"}],"published":"2018-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bde431d-a730-422c-a301-76e09df3d930","source":"wordfence","cve":"CVE-2026-62088","title":"ElasticPress <= 5.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bde431d-a730-422c-a301-76e09df3d930?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:19:35Z"},{"id":"wordfence:2bde5862-1b7c-4e58-b13f-c8f347593c51","source":"wordfence","cve":"","title":"IP2Location Country Blocker < 2.26.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bde5862-1b7c-4e58-b13f-c8f347593c51?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.26.9","to_inclusive":false,"patched_in":"2.26.9"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bdf4442-e119-4a1f-bab2-a363a36281a6","source":"wordfence","cve":"CVE-2026-40760","title":"Behold <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bdf4442-e119-4a1f-bab2-a363a36281a6?source=api-prod","affected":[{"type":"theme","slug":"behold","name":"behold","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:45:50Z"},{"id":"wordfence:2be06087-4616-47bb-8a33-3bba97c47cb2","source":"wordfence","cve":"CVE-2026-32460","title":"Ultra Addons for Contact Form 7 <= 3.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be06087-4616-47bb-8a33-3bba97c47cb2?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.36","to_inclusive":true,"patched_in":"3.5.37"}],"published":"2026-03-14T00:00:00Z","updated":"2026-03-19T15:11:08Z"},{"id":"wordfence:2be089a0-d4d5-4d64-8fb7-8c42286ebbcd","source":"wordfence","cve":"CVE-2019-16217","title":"WordPress Core < 5.2.3 - Cross-Site Scripting via Media Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be089a0-d4d5-4d64-8fb7-8c42286ebbcd?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2be16ee8-6bae-44d9-bde7-8e893293c3f9","source":"wordfence","cve":"CVE-2023-31218","title":"WOLF <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be16ee8-6bae-44d9-bde7-8e893293c3f9?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2be1c75f-393a-4dd7-83cc-3b9df141dd88","source":"wordfence","cve":"CVE-2025-58967","title":"Businext < 2.4.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be1c75f-393a-4dd7-83cc-3b9df141dd88?source=api-prod","affected":[{"type":"theme","slug":"businext","name":"Businext - Business, Finance & Crypto Currency WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2025-09-15T00:00:00Z","updated":"2025-11-04T16:44:18Z"},{"id":"wordfence:2be1fbfc-a809-4a42-9be4-24c8274c1e71","source":"wordfence","cve":"CVE-2025-14449","title":"BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be1fbfc-a809-4a42-9be4-24c8274c1e71?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2025-12-18T18:15:12Z","updated":"2025-12-19T06:48:23Z"},{"id":"wordfence:2be23829-cbee-4e44-945d-14835dbba104","source":"wordfence","cve":"CVE-2026-16065","title":"Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be23829-cbee-4e44-945d-14835dbba104?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.31","to_inclusive":true,"patched_in":"2.11.32"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-15T21:35:30Z"},{"id":"wordfence:2be2e028-81b8-4fd9-8197-eccf391fee65","source":"wordfence","cve":"CVE-2026-2589","title":"Greenshift \u2013 animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be2e028-81b8-4fd9-8197-eccf391fee65?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.3","to_inclusive":true,"patched_in":"12.8.4"}],"published":"2026-03-05T10:58:47Z","updated":"2026-03-05T23:21:30Z"},{"id":"wordfence:2be3638e-3a0d-40e5-914e-9f20971abf9a","source":"wordfence","cve":"CVE-2008-7040","title":"Yellow Swordfish Simple Forum <= 1.11 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be3638e-3a0d-40e5-914e-9f20971abf9a?source=api-prod","affected":[{"type":"plugin","slug":"simple-forum","name":"Yellow Swordfish Simple Forum","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2008-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2be578d9-27c3-4a16-a634-1514ed97a1a2","source":"wordfence","cve":"CVE-2024-13526","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be578d9-27c3-4a16-a634-1514ed97a1a2?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.7.3","to_inclusive":true,"patched_in":"4.0.7.4"}],"published":"2025-03-06T11:33:35Z","updated":"2025-03-07T01:44:54Z"},{"id":"wordfence:2be6c7d8-6dd4-4701-9baa-694496e7388a","source":"wordfence","cve":"CVE-2022-1759","title":"RB Internal Links <= 2.0.16 - Cross-Site Request Forgery to Settings update and Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be6c7d8-6dd4-4701-9baa-694496e7388a?source=api-prod","affected":[{"type":"plugin","slug":"rb-internal-links","name":"RB Internal Links","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2be770c7-7aa2-430b-981d-5d81fe068bef","source":"wordfence","cve":"CVE-2025-11499","title":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.3.33"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T06:40:38Z"},{"id":"wordfence:2be9815d-56c6-4574-9b4c-75fff40a148d","source":"wordfence","cve":"CVE-2019-9881","title":"WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2be9815d-56c6-4574-9b4c-75fff40a148d?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":"0.3.0"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2beaf82f-3709-48de-bcc2-535479c4fafe","source":"wordfence","cve":"CVE-2026-7726","title":"Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2beaf82f-3709-48de-bcc2-535479c4fafe?source=api-prod","affected":[{"type":"plugin","slug":"layouts-for-wpbakery","name":"Layouts for WPBakery","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-08-04T18:01:05Z","updated":"2026-08-05T06:37:54Z"},{"id":"wordfence:2bed4818-70c5-40b7-8d8d-f43f3baa0f3d","source":"wordfence","cve":"CVE-2026-4379","title":"LightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bed4818-70c5-40b7-8d8d-f43f3baa0f3d?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-lightbox","name":"LightPress Lightbox","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-04-07T13:33:34Z","updated":"2026-04-08T02:25:40Z"},{"id":"wordfence:2bed7fc8-a961-4141-80a1-9c23a6504fbd","source":"wordfence","cve":"CVE-2024-13560","title":"Subscriptions & Memberships for PayPal <= 1.1.6 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bed7fc8-a961-4141-80a1-9c23a6504fbd?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-memberships-for-paypal","name":"Subscriptions & Memberships for PayPal","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-02-25T19:40:01Z","updated":"2025-02-26T08:21:58Z"},{"id":"wordfence:2bef9fbc-ada5-475d-b630-923483b8fb7a","source":"wordfence","cve":"CVE-2022-4325","title":"Post Status Notifier Lite <= 1.10.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bef9fbc-ada5-475d-b630-923483b8fb7a?source=api-prod","affected":[{"type":"plugin","slug":"post-status-notifier-lite","name":"Post Status Notifier Lite","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bf0832c-13ed-4e53-9847-d5d2110eb3f8","source":"wordfence","cve":"CVE-2026-9253","title":"WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf0832c-13ed-4e53-9847-d5d2110eb3f8?source=api-prod","affected":[{"type":"plugin","slug":"lfb-premium","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"10.5.97","to_inclusive":true,"patched_in":"10.6.1"},{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"10.5.97","to_inclusive":true,"patched_in":"10.6.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T11:27:25Z"},{"id":"wordfence:2bf114d2-6617-4681-b363-7dafb2308887","source":"wordfence","cve":"CVE-2026-27393","title":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms <= 1.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf114d2-6617-4681-b363-7dafb2308887?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2026-05-21T00:00:00Z","updated":"2026-05-26T19:15:41Z"},{"id":"wordfence:2bf29d3d-98eb-40a7-88af-32b48e437572","source":"wordfence","cve":"CVE-2021-24489","title":"Request a Quote <= 2.3.4 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf29d3d-98eb-40a7-88af-32b48e437572?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bf511b6-1b62-43e0-9df5-674a423f6ae2","source":"wordfence","cve":"CVE-2021-36857","title":"Testimonial Builder <= 1.6.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf511b6-1b62-43e0-9df5-674a423f6ae2?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-builder","name":"Testimonial \u2013 WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2021-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bf70203-61c0-406a-9110-b60761b4a513","source":"wordfence","cve":"CVE-2026-4073","title":"pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf70203-61c0-406a-9110-b60761b4a513?source=api-prod","affected":[{"type":"plugin","slug":"pdfl-io","name":"pdfl.io","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-04-07T20:58:52Z","updated":"2026-04-08T09:25:48Z"},{"id":"wordfence:2bfa42f1-cb0e-4be9-91c8-573bffe332b5","source":"wordfence","cve":"CVE-2025-68538","title":"Craft <= 2.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bfa42f1-cb0e-4be9-91c8-573bffe332b5?source=api-prod","affected":[{"type":"theme","slug":"craftcoffee","name":"Craft | Coffee Shop Cafe Restaurant WordPress","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:44:28Z"},{"id":"wordfence:2bfd952e-3e5e-40f0-9e97-700a7fab415a","source":"wordfence","cve":"CVE-2026-118056","title":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bfd952e-3e5e-40f0-9e97-700a7fab415a?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.12.2","to_inclusive":true,"patched_in":"9.12.3"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-07T11:26:26Z"},{"id":"wordfence:2bfe721b-1614-488c-a467-dd205e93047b","source":"wordfence","cve":"CVE-2025-68550","title":"WPBulky <= 1.1.13 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bfe721b-1614-488c-a467-dd205e93047b?source=api-prod","affected":[{"type":"plugin","slug":"wpbulky-wp-bulk-edit-post-types","name":"WPBulky \u2013 WordPress Bulk Edit Post Types","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T19:05:32Z"},{"id":"wordfence:2bff8dea-6971-47d4-bd2c-0821687033e5","source":"wordfence","cve":"CVE-2023-4248","title":"GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bff8dea-6971-47d4-bd2c-0821687033e5?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.33.3","to_inclusive":true,"patched_in":"2.33.4"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2bffed25-d7f0-40de-a55d-42653aff0673","source":"wordfence","cve":"CVE-2024-47650","title":"WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2bffed25-d7f0-40de-a55d-42653aff0673?source=api-prod","affected":[{"type":"plugin","slug":"wp-webauthn","name":"WP-WebAuthn","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:28:27Z"},{"id":"wordfence:2c0082ff-2a33-44e9-b0d0-8b9a404ab648","source":"wordfence","cve":"CVE-2026-13251","title":"Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0082ff-2a33-44e9-b0d0-8b9a404ab648?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-07-01T21:08:17Z","updated":"2026-07-02T09:32:02Z"},{"id":"wordfence:2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7","source":"wordfence","cve":"CVE-2022-47135","title":"Chronoforms <= 7.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c02b9b2-b41e-4a30-b69a-9cdae86dd7a7?source=api-prod","affected":[{"type":"plugin","slug":"chronoforms","name":"Chronoforms","from":"*","from_inclusive":true,"to":"7.0.9","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c056904-5b2d-4ca6-8dcf-8ab5c1a7645b","source":"wordfence","cve":"CVE-2022-0215","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.1 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c056904-5b2d-4ca6-8dcf-8ab5c1a7645b?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c07b5c8-7fae-499d-9f6c-9392166f74b8","source":"wordfence","cve":"CVE-2024-2079","title":"WPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c07b5c8-7fae-499d-9f6c-9392166f74b8?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-13T21:32:57Z"},{"id":"wordfence:2c08846c-23e2-43c5-9cb2-3c798832e960","source":"wordfence","cve":"CVE-2025-66099","title":"Chat Help <= 3.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c08846c-23e2-43c5-9cb2-3c798832e960?source=api-prod","affected":[{"type":"plugin","slug":"chat-help","name":"ChatHelp \u2013 Click to Chat Button, Chat to Order for WooCommerce & Floating Chat Form","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-11-11T00:00:00Z","updated":"2025-11-25T16:09:46Z"},{"id":"wordfence:2c0bbdf6-afaf-4194-ada2-24d142892c32","source":"wordfence","cve":"CVE-2026-91136","title":"Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32?source=api-prod","affected":[{"type":"plugin","slug":"divi-plus","name":"Divi Plus","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-09T19:42:56Z","updated":"2026-10-10T08:26:40Z"},{"id":"wordfence:2c11f469-b136-4429-87a1-083d7d5e6695","source":"wordfence","cve":"CVE-2025-30879","title":"MC Woocommerce Wishlist <= 1.8.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c11f469-b136-4429-87a1-083d7d5e6695?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:20:04Z"},{"id":"wordfence:2c1292c2-88be-40f8-8c4f-58a212d5d588","source":"wordfence","cve":"CVE-2026-16621","title":"Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1292c2-88be-40f8-8c4f-58a212d5d588?source=api-prod","affected":[{"type":"plugin","slug":"woo-paypal-gateway","name":"Payment Gateway for PayPal on WooCommerce","from":"*","from_inclusive":true,"to":"9.2.1","to_inclusive":false,"patched_in":"9.2.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T15:51:51Z"},{"id":"wordfence:2c148123-9da3-4384-8aec-4ee71cb05e01","source":"wordfence","cve":"","title":"Responsive Image Slider, Photo Gallery And Carousel < 1.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c148123-9da3-4384-8aec-4ee71cb05e01?source=api-prod","affected":[{"type":"plugin","slug":"slider-factory","name":"Slider, Image Slider & Carousel by Slider Factory \u2013 Responsive Slideshow, Video Slider","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2021-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c16048a-6b05-48ef-92c3-6e3a42909adb","source":"wordfence","cve":"CVE-2025-13143","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c16048a-6b05-48ef-92c3-6e3a42909adb?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.12.0","to_inclusive":true,"patched_in":"19.12.1"}],"published":"2025-11-26T17:29:27Z","updated":"2025-11-27T05:31:57Z"},{"id":"wordfence:2c17c0d6-c0ea-4aed-a48e-fba1a1c3b746","source":"wordfence","cve":"CVE-2025-69113","title":"Nexio <= 1.10.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c17c0d6-c0ea-4aed-a48e-fba1a1c3b746?source=api-prod","affected":[{"type":"theme","slug":"nexio","name":"Nexio","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:37:38Z"},{"id":"wordfence:2c1b53b9-e70b-4204-a00e-8745611606bf","source":"wordfence","cve":"CVE-2026-32477","title":"ShopBuilder Pro \u2013 Elementor WooCommerce Builder Addons <= 2.2.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1b53b9-e70b-4204-a00e-8745611606bf?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder-pro","name":"Shopbuilder Pro","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:26:34Z"},{"id":"wordfence:2c1c208e-ae4a-40fb-9495-5268e5e929e5","source":"wordfence","cve":"CVE-2024-30469","title":"Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1c208e-ae4a-40fb-9495-5268e5e929e5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-pricing","name":"Wholesale For WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:34:59Z"},{"id":"wordfence:2c1dbd73-6ea6-4e9d-84e2-055ab9db5f4f","source":"wordfence","cve":"CVE-2011-5193","title":"WHOIS <= 1.4.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dbd73-6ea6-4e9d-84e2-055ab9db5f4f?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-whois-search","name":"WHOIS","from":"*","from_inclusive":true,"to":"1.4.2.4","to_inclusive":true,"patched_in":""}],"published":"2012-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c1dd87c-cc28-43b3-8378-4583dc6de195","source":"wordfence","cve":"CVE-2025-13452","title":"Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1dd87c-cc28-43b3-8378-4583dc6de195?source=api-prod","affected":[{"type":"plugin","slug":"admin-and-client-message-after-order-for-woocommerce","name":"OrderConvo \u2013 Vendor & Customer Messages After Orders","from":"*","from_inclusive":true,"to":"14","to_inclusive":true,"patched_in":"15"}],"published":"2025-11-24T19:17:46Z","updated":"2026-01-15T18:30:29Z"},{"id":"wordfence:2c1e6298-f243-49a5-b1b7-52bd6a6c8858","source":"wordfence","cve":"CVE-2016-15042","title":"Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1e6298-f243-49a5-b1b7-52bd6a6c8858?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-frontend","name":"N-Media Post Front-end Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2016-07-16T00:00:00Z","updated":"2024-10-16T07:31:49Z"},{"id":"wordfence:2c1ecd71-57ed-44ba-a007-3b96b98d3bf7","source":"wordfence","cve":"CVE-2025-10178","title":"CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c1ecd71-57ed-44ba-a007-3b96b98d3bf7?source=api-prod","affected":[{"type":"plugin","slug":"cm-business-directory","name":"CM Business Directory \u2013 Optimise and showcase local business","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-09-25T13:26:06Z","updated":"2025-09-26T01:47:26Z"},{"id":"wordfence:2c230688-1524-4e3a-918b-34dbcc04330f","source":"wordfence","cve":"CVE-2025-32131","title":"Social Intents <= 1.6.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c230688-1524-4e3a-918b-34dbcc04330f?source=api-prod","affected":[{"type":"plugin","slug":"live-chat-support-by-social-intents","name":"Social Intents \u2013 Live Chat","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:39:19Z"},{"id":"wordfence:2c251bf5-f6c0-4d2e-a240-95b0f1fce3f5","source":"wordfence","cve":"CVE-2025-23775","title":"GMAPS for WPBakery Page Builder Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c251bf5-f6c0-4d2e-a240-95b0f1fce3f5?source=api-prod","affected":[{"type":"plugin","slug":"gmaps-for-visual-composer-free","name":"GMAPS for WPBakery Page Builder Free","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:47:37Z"},{"id":"wordfence:2c25a344-4876-4ba8-bbc6-d1a32f4b1d08","source":"wordfence","cve":"","title":"User Login History <= 1.7.0 - SQL Injection via Order By","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c25a344-4876-4ba8-bbc6-d1a32f4b1d08?source=api-prod","affected":[{"type":"plugin","slug":"user-login-history","name":"User Login History","from":"1.7.0","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2019-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c26d6de-5653-4be8-9526-39b30cb61625","source":"wordfence","cve":"CVE-2023-0718","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c26d6de-5653-4be8-9526-39b30cb61625?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c2c8025-6a1b-475d-bc28-9f2ec3ad7bdc","source":"wordfence","cve":"CVE-2022-4198","title":"WP Social Sharing <= 2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2c8025-6a1b-475d-bc28-9f2ec3ad7bdc?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-sharing","name":"WP Social Sharing","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c2d9569-a551-46f5-8581-464b9f35b71c","source":"wordfence","cve":"CVE-2024-1642","title":"MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2d9569-a551-46f5-8581-464b9f35b71c?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"4.6.0.1","to_inclusive":true,"patched_in":"5.0"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-13T15:26:41Z"},{"id":"wordfence:2c2f0e74-cdc0-4da9-bd79-8d09f5459be7","source":"wordfence","cve":"CVE-2021-24553","title":"Timeline Calendar <= 1.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2f0e74-cdc0-4da9-bd79-8d09f5459be7?source=api-prod","affected":[{"type":"plugin","slug":"timeline-calendar","name":"Timeline Calendar","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c30299e-b77f-426b-90d4-33f2dae72a4c","source":"wordfence","cve":"CVE-2025-28990","title":"SNS Vicky <= 3.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c30299e-b77f-426b-90d4-33f2dae72a4c?source=api-prod","affected":[{"type":"theme","slug":"snsvicky","name":"SNS Vicky - Cosmetic WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T19:07:02Z"},{"id":"wordfence:2c314acf-d5bb-433a-8e2d-4ca333944bb6","source":"wordfence","cve":"CVE-2023-3211","title":"WordPress Database Administrator <= 1.0.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c314acf-d5bb-433a-8e2d-4ca333944bb6?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-admin","name":"WordPress Database Administrator","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c325190-a91d-4e80-8b01-edafeacb10a9","source":"wordfence","cve":"CVE-2024-49650","title":"BuddyPress Greeting Message <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c325190-a91d-4e80-8b01-edafeacb10a9?source=api-prod","affected":[{"type":"plugin","slug":"bp-greeting-message","name":"BuddyPress Greeting Message","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:45:55Z"},{"id":"wordfence:2c34c79d-7eb9-4474-8189-26cc4316ba8e","source":"wordfence","cve":"CVE-2026-14561","title":"Authora : Easy login with mobile number < 1.7.7 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c34c79d-7eb9-4474-8189-26cc4316ba8e?source=api-prod","affected":[{"type":"plugin","slug":"authora-easy-login-with-mobile-number","name":"Authora : Easy login with mobile number","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-13T22:23:53Z"},{"id":"wordfence:2c358cbe-7600-43a1-94a3-1530cdb5a9f3","source":"wordfence","cve":"CVE-2026-1565","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c358cbe-7600-43a1-94a3-1530cdb5a9f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2026-02-26T06:37:58Z","updated":"2026-02-26T19:23:09Z"},{"id":"wordfence:2c35a558-3915-4689-ab62-942792a93060","source":"wordfence","cve":"CVE-2025-54724","title":"Golo <= 1.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c35a558-3915-4689-ab62-942792a93060?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:09:57Z"},{"id":"wordfence:2c368677-e436-412a-9a88-89d128d72aa0","source":"wordfence","cve":"CVE-2025-0763","title":"Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c368677-e436-412a-9a88-89d128d72aa0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T00:00:00Z","updated":"2025-11-06T15:14:53Z"},{"id":"wordfence:2c38833c-654e-4fe4-b642-ed880a928062","source":"wordfence","cve":"CVE-2025-48249","title":"EAN for WooCommerce <= 5.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c38833c-654e-4fe4-b642-ed880a928062?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:44:54Z"},{"id":"wordfence:2c399c6a-d5e4-4b88-a0a9-003233d5d59f","source":"wordfence","cve":"CVE-2024-1584","title":"Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c399c6a-d5e4-4b88-a0a9-003233d5d59f?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:51:55Z"},{"id":"wordfence:2c3b1b88-227a-4d0b-bd78-a1088c17a91e","source":"wordfence","cve":"CVE-2025-49981","title":"User Roles and Capabilities <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c3b1b88-227a-4d0b-bd78-a1088c17a91e?source=api-prod","affected":[{"type":"plugin","slug":"user-roles-and-capabilities","name":"User Roles and Capabilities","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:09:43Z"},{"id":"wordfence:2c3d9fa7-8ea2-4213-8b28-2ca9191a8223","source":"wordfence","cve":"CVE-2020-36741","title":"MultiVendorX \u2013 MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c3d9fa7-8ea2-4213-8b28-2ca9191a8223?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":false,"patched_in":"3.5.8"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c45b607-8b62-4482-b152-4a2b467d838f","source":"wordfence","cve":"CVE-2026-97291","title":"Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c45b607-8b62-4482-b152-4a2b467d838f?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.66","to_inclusive":true,"patched_in":"1.67"}],"published":"2026-09-30T12:59:47Z","updated":"2026-10-09T00:01:41Z"},{"id":"wordfence:2c4615d4-92b4-45d3-9fb7-66c9f5d6bdd2","source":"wordfence","cve":"CVE-2024-54362","title":"GetShop ecommerce <= 1.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4615d4-92b4-45d3-9fb7-66c9f5d6bdd2?source=api-prod","affected":[{"type":"plugin","slug":"getshop-ecommerce","name":"GetShop ecommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:10:46Z"},{"id":"wordfence:2c470cb0-5cbc-4ae1-b75a-384668d07215","source":"wordfence","cve":"CVE-2024-2337","title":"Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c470cb0-5cbc-4ae1-b75a-384668d07215?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":""}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T02:37:15Z"},{"id":"wordfence:2c4749b8-cfaf-4a6e-a093-0c2bfd22b809","source":"wordfence","cve":"CVE-2022-30536","title":"WP Maintenance <= 6.0.7 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4749b8-cfaf-4a6e-a093-0c2bfd22b809?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2022-06-28T13:50:00Z","updated":"2024-06-06T16:01:36Z"},{"id":"wordfence:2c4c13c9-6f43-4a4d-b825-e246bf9a1e9c","source":"wordfence","cve":"CVE-2024-30490","title":"ProfileGrid  <= 5.7.8 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4c13c9-6f43-4a4d-b825-e246bf9a1e9c?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:27:56Z"},{"id":"wordfence:2c4c1a16-bbdc-4751-9c5b-ddc0eb586c3f","source":"wordfence","cve":"CVE-2026-16299","title":"Single Sign On For TNG <= 2.1.0 -  Unauthenticated Arbitrary Password Reset to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4c1a16-bbdc-4751-9c5b-ddc0eb586c3f?source=api-prod","affected":[{"type":"plugin","slug":"single-sign-on-for-tng","name":"Single Sign On For TNG","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-17T15:27:57Z"},{"id":"wordfence:2c4e04a5-bcb8-4618-bb6f-c86c3fb13713","source":"wordfence","cve":"CVE-2026-96526","title":"MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4e04a5-bcb8-4618-bb6f-c86c3fb13713?source=api-prod","affected":[{"type":"plugin","slug":"ai-workflow-automation-ai-agent-hub","name":"MCP Server for WordPress \u2013 Connect Claude, ChatGPT & Gemini | AtlasMCP","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:55:29Z"},{"id":"wordfence:2c4faf5b-70bf-4682-89bb-aa3fc19b29e8","source":"wordfence","cve":"CVE-2025-53268","title":"Import external attachments <= 1.5.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4faf5b-70bf-4682-89bb-aa3fc19b29e8?source=api-prod","affected":[{"type":"plugin","slug":"import-external-attachments","name":"Import external attachments","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:20:47Z"},{"id":"wordfence:2c4fc414-1442-43bc-b8d3-c07a0a1d1826","source":"wordfence","cve":"CVE-2026-62049","title":"JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4fc414-1442-43bc-b8d3-c07a0a1d1826?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.5.2.1","to_inclusive":true,"patched_in":"1.5.2.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:27:50Z"},{"id":"wordfence:2c535cea-dad6-440f-b37f-6d196b469214","source":"wordfence","cve":"CVE-2025-10747","title":"WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c535cea-dad6-440f-b37f-6d196b469214?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.11","to_inclusive":true,"patched_in":"1.69"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T05:27:21Z"},{"id":"wordfence:2c557615-148d-43a2-9fed-5f41faa7c64f","source":"wordfence","cve":"CVE-2026-8887","title":"Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c557615-148d-43a2-9fed-5f41faa7c64f?source=api-prod","affected":[{"type":"plugin","slug":"listen-shortcode","name":"Listen Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:26:55Z","updated":"2026-05-27T05:31:22Z"},{"id":"wordfence:2c583ef0-33ee-4395-96e1-596a5acce5c4","source":"wordfence","cve":"CVE-2026-81339","title":"MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c583ef0-33ee-4395-96e1-596a5acce5c4?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:48:22Z"},{"id":"wordfence:2c5891b2-f919-4e86-9aa9-1eb56da14959","source":"wordfence","cve":"CVE-2025-48162","title":"Simple Business Directory Pro <= 15.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5891b2-f919-4e86-9aa9-1eb56da14959?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-directory-pro","name":"Simple Business Directory Pro","from":"*","from_inclusive":true,"to":"15.5.1","to_inclusive":true,"patched_in":"15.5.2"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:40:21Z"},{"id":"wordfence:2c59179e-2baa-4be2-8415-7fec6dabb24e","source":"wordfence","cve":"CVE-2025-31091","title":"CM Header and Footer <= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c59179e-2baa-4be2-8415-7fec6dabb24e?source=api-prod","affected":[{"type":"plugin","slug":"cm-header-footer-script-loader","name":"CM Header and Footer  \u2013 Add custom scripts and styles to your header and footer with ease","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T13:12:07Z"},{"id":"wordfence:2c5ad2d5-3786-4bc0-aba0-f77bb5319ef9","source":"wordfence","cve":"CVE-2025-48348","title":"Site Offline <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5ad2d5-3786-4bc0-aba0-f77bb5319ef9?source=api-prod","affected":[{"type":"plugin","slug":"site-offline","name":"Site Offline Or Coming Soon Or Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T13:40:09Z"},{"id":"wordfence:2c5bb593-59b5-4760-8d54-14d7665c7e7f","source":"wordfence","cve":"","title":"Event Registration <= 6.02.02 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5bb593-59b5-4760-8d54-14d7665c7e7f?source=api-prod","affected":[{"type":"plugin","slug":"event-registration","name":"Event Registration","from":"*","from_inclusive":true,"to":"6.02.02","to_inclusive":true,"patched_in":"6.03.01"}],"published":"2016-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c5cdc3f-eaa6-4d0b-9e75-5483c723e15a","source":"wordfence","cve":"CVE-2024-0823","title":"Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5cdc3f-eaa6-4d0b-9e75-5483c723e15a?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:36:05Z"},{"id":"wordfence:2c5e6dff-1ae2-4707-b214-a7d854ad5f3e","source":"wordfence","cve":"CVE-2026-114742","title":"VR 8.3.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5e6dff-1ae2-4707-b214-a7d854ad5f3e?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"8.3.0","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:22:17Z"},{"id":"wordfence:2c5f2dc8-67f7-4dbf-8631-f434522f1b53","source":"wordfence","cve":"CVE-2026-2732","title":"Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5f2dc8-67f7-4dbf-8631-f434522f1b53?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2026-03-03T18:17:08Z","updated":"2026-03-04T06:26:53Z"},{"id":"wordfence:2c5fd029-aaa7-4d23-b0b6-75069dc1bfd1","source":"wordfence","cve":"CVE-2026-103685","title":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c5fd029-aaa7-4d23-b0b6-75069dc1bfd1?source=api-prod","affected":[{"type":"plugin","slug":"woo-alidropship","name":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-10-10T00:00:00Z","updated":"2026-10-13T13:51:15Z"},{"id":"wordfence:2c609a29-3c72-4921-ab7a-2f2593b2e4b4","source":"wordfence","cve":"CVE-2010-4875","title":"Vodpod Video Gallery <= 3.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c609a29-3c72-4921-ab7a-2f2593b2e4b4?source=api-prod","affected":[{"type":"plugin","slug":"vodpod-video-gallery","name":"vodpod-video-gallery","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":""}],"published":"2010-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c643074-d57e-4878-b61d-2790ce9dadaa","source":"wordfence","cve":"CVE-2022-3632","title":"OAuth Client by DigitialPixies <= 1.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c643074-d57e-4878-b61d-2790ce9dadaa?source=api-prod","affected":[{"type":"plugin","slug":"dpt-oauth-client","name":"OAuth Client by DigitialPixies","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c648ea4-7df6-4a77-9bc5-bd3c18979250","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 2.53 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c648ea4-7df6-4a77-9bc5-bd3c18979250?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.53","to_inclusive":false,"patched_in":"2.53"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c648fca-c36f-41a0-9d29-3f669f3669d9","source":"wordfence","cve":"CVE-2025-8397","title":"Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c648fca-c36f-41a0-9d29-3f669f3669d9?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf","name":"Save as PDF Button","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-12T20:24:03Z","updated":"2025-11-13T08:27:46Z"},{"id":"wordfence:2c657483-204c-4117-ac7c-c0522d9c3816","source":"wordfence","cve":"CVE-2023-4824","title":"WooHoo Newspaper Magazine Theme <= 2.5.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c657483-204c-4117-ac7c-c0522d9c3816?source=api-prod","affected":[{"type":"theme","slug":"woohoo","name":"WooHoo Newspaper Magazine Theme","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c66905d-6e53-4062-b63f-b9a249ebd3e1","source":"wordfence","cve":"CVE-2025-30887","title":"WpEvently <= 4.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c66905d-6e53-4062-b63f-b9a249ebd3e1?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:39:35Z"},{"id":"wordfence:2c66b185-fd4b-452d-890b-0f1850d8a7be","source":"wordfence","cve":"CVE-2024-4319","title":"Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c66b185-fd4b-452d-890b-0f1850d8a7be?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-06-10T17:32:52Z","updated":"2024-07-11T17:45:18Z"},{"id":"wordfence:2c677e0a-473f-4cc9-97f1-f2d57051f739","source":"wordfence","cve":"CVE-2024-54399","title":"CRUDLab Google Plus Button <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c677e0a-473f-4cc9-97f1-f2d57051f739?source=api-prod","affected":[{"type":"plugin","slug":"crudlab-google-plus","name":"CRUDLab Google Plus Button","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:01:38Z"},{"id":"wordfence:2c69dec6-4988-4760-8dc0-a11044dde406","source":"wordfence","cve":"CVE-2025-31524","title":"WP User Profiles <= 2.6.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c69dec6-4988-4760-8dc0-a11044dde406?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profiles","name":"WP User Profiles","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-08T00:00:00Z","updated":"2025-04-16T20:57:06Z"},{"id":"wordfence:2c76b38a-767c-44ab-af4b-ea69b9e37e4a","source":"wordfence","cve":"CVE-2024-51643","title":"Amazon Associate Filter <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c76b38a-767c-44ab-af4b-ea69b9e37e4a?source=api-prod","affected":[{"type":"plugin","slug":"amazon-associate-filter","name":"Amazon Associate Filter","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:34:21Z"},{"id":"wordfence:2c77fde2-0802-4421-93d7-697771d375ec","source":"wordfence","cve":"CVE-2025-60121","title":"WooEvents <= 4.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c77fde2-0802-4421-93d7-697771d375ec?source=api-prod","affected":[{"type":"plugin","slug":"woo-events","name":"WooEvents - Calendar and Event Booking","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:19:40Z"},{"id":"wordfence:2c7868c4-d9ea-4f8f-a4ba-a9e7ca43ab1f","source":"wordfence","cve":"CVE-2026-18063","title":"Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c7868c4-d9ea-4f8f-a4ba-a9e7ca43ab1f?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-09-14T18:50:32Z","updated":"2026-09-15T07:03:06Z"},{"id":"wordfence:2c78ab13-22ed-4f00-b132-c9ff99c51273","source":"wordfence","cve":"CVE-2025-14028","title":"Contact Us Simple Form <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c78ab13-22ed-4f00-b132-c9ff99c51273?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-simple-form","name":"Contact Us Simple Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:30:21Z","updated":"2026-01-07T09:20:53Z"},{"id":"wordfence:2c79caf2-1639-4ae3-b39b-2838db6febb0","source":"wordfence","cve":"CVE-2025-32612","title":"User Session Synchronizer <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c79caf2-1639-4ae3-b39b-2838db6febb0?source=api-prod","affected":[{"type":"plugin","slug":"user-session-synchronizer","name":"User Session Synchronizer","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:00:16Z"},{"id":"wordfence:2c7a0b51-6626-449f-95f5-74c4847909de","source":"wordfence","cve":"CVE-2022-4063","title":"InPost Gallery <= 2.1.4.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c7a0b51-6626-449f-95f5-74c4847909de?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.4.1"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c7a1cb4-a61e-41ac-8ce2-06de5104a368","source":"wordfence","cve":"CVE-2023-26000","title":"Bang tinh vay <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c7a1cb4-a61e-41ac-8ce2-06de5104a368?source=api-prod","affected":[{"type":"plugin","slug":"bang-tinh-lai-suat","name":"Bang tinh vay","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:40:12Z"},{"id":"wordfence:2c7c2b11-750a-48de-b48b-dcc6fbb8e917","source":"wordfence","cve":"CVE-2022-1690","title":"Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via id Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c7c2b11-750a-48de-b48b-dcc6fbb8e917?source=api-prod","affected":[{"type":"plugin","slug":"note-press","name":"Note Press","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c80de83-3996-4048-8aa3-3611b002fc01","source":"wordfence","cve":"CVE-2024-24873","title":"CP Polls <= 1.0.71 - Unauthenticated Poll Limit Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c80de83-3996-4048-8aa3-3611b002fc01?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.71","to_inclusive":true,"patched_in":"1.0.72"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:13:50Z"},{"id":"wordfence:2c84781b-a866-40d3-8803-00cddf07c64a","source":"wordfence","cve":"CVE-2026-27353","title":"Grand News <= 3.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c84781b-a866-40d3-8803-00cddf07c64a?source=api-prod","affected":[{"type":"theme","slug":"grandnews","name":"grandnews","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:44:33Z"},{"id":"wordfence:2c8734f5-4d23-454d-bf00-6e9d36982098","source":"wordfence","cve":"CVE-2026-15302","title":"ARMember <= 4.0.27 - Directory Traversal via X-FILENAME","severity":"medium","cvss":5.3,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8734f5-4d23-454d-bf00-6e9d36982098?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"4.0.28"}],"published":"2024-04-04T00:00:00Z","updated":"2026-07-10T04:31:21Z"},{"id":"wordfence:2c883c96-3d7f-47b9-ba90-d464024b62fc","source":"wordfence","cve":"CVE-2025-22647","title":"AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c883c96-3d7f-47b9-ba90-d464024b62fc?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-performance-accelerator","name":"AIO Performance Profiler, Monitor, Optimize, Compress & Debug","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-07-01T14:04:23Z"},{"id":"wordfence:2c889c8e-7546-45bd-884b-7fb0199e595b","source":"wordfence","cve":"","title":"Hide My WP <= 4.51.1 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c889c8e-7546-45bd-884b-7fb0199e595b?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"4.52","to_inclusive":false,"patched_in":"4.52"}],"published":"2015-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c8a2446-60c1-4641-9b5c-229327724333","source":"wordfence","cve":"CVE-2025-39500","title":"Goodlayers Hostel <= 3.1.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8a2446-60c1-4641-9b5c-229327724333?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hostel","name":"Goodlayers Hostel","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:38:43Z"},{"id":"wordfence:2c8a487c-6bd5-480a-9945-ba465b38243f","source":"wordfence","cve":"CVE-2024-2963","title":"Pocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8a487c-6bd5-480a-9945-ba465b38243f?source=api-prod","affected":[{"type":"plugin","slug":"pocket-news-generator","name":"Pocket News Generator","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:43:56Z"},{"id":"wordfence:2c8a6ff9-6aa8-4e0f-b058-759561a55508","source":"wordfence","cve":"CVE-2024-7622","title":"Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8a6ff9-6aa8-4e0f-b058-759561a55508?source=api-prod","affected":[{"type":"plugin","slug":"revision-manager-tmc","name":"Revision Manager TMC","from":"*","from_inclusive":true,"to":"2.8.19","to_inclusive":true,"patched_in":"2.8.20"}],"published":"2024-09-06T01:25:17Z","updated":"2024-09-06T13:55:14Z"},{"id":"wordfence:2c8b5f32-7c3f-4e1f-b277-ebe982af5a20","source":"wordfence","cve":"CVE-2026-57354","title":"JetReviews <= 3.0.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8b5f32-7c3f-4e1f-b277-ebe982af5a20?source=api-prod","affected":[{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"3.0.0.1","to_inclusive":true,"patched_in":"3.0.0.2"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-10T19:25:00Z"},{"id":"wordfence:2c8ff4ec-9b40-4d59-b3b0-382f91042a4a","source":"wordfence","cve":"CVE-2024-11840","title":"RapidLoad \u2013 Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8ff4ec-9b40-4d59-b3b0-382f91042a4a?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-11T10:57:58Z"},{"id":"wordfence:2c91797c-1e6c-47ab-8a2c-f9aa6120a384","source":"wordfence","cve":"CVE-2025-39578","title":"Responsive Blocks <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c91797c-1e6c-47ab-8a2c-f9aa6120a384?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:43:50Z"},{"id":"wordfence:2c91f611-8529-4053-8faf-d23a213dd569","source":"wordfence","cve":"CVE-2026-84780","title":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet Map <= 10.1.08 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c91f611-8529-4053-8faf-d23a213dd569?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.1.08","to_inclusive":true,"patched_in":"10.1.09"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:35:33Z"},{"id":"wordfence:2c925848-1ba7-4009-93c2-1648dbf808e9","source":"wordfence","cve":"CVE-2024-13748","title":"Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c925848-1ba7-4009-93c2-1648dbf808e9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-02-19T21:10:12Z","updated":"2025-02-21T14:03:03Z"},{"id":"wordfence:2c9313aa-c171-4e9c-98c2-a01a211d22b5","source":"wordfence","cve":"CVE-2026-91046","title":"ElementsReady Addons for Elementor <= 6.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9313aa-c171-4e9c-98c2-a01a211d22b5?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:44:28Z"},{"id":"wordfence:2c931bd2-8c19-4211-9378-f32a1302defd","source":"wordfence","cve":"CVE-2025-13471","title":"User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c931bd2-8c19-4211-9378-f32a1302defd?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T00:00:00Z","updated":"2026-05-04T14:28:56Z"},{"id":"wordfence:2c955905-bf14-4afa-a282-0a8c74cd3b87","source":"wordfence","cve":"CVE-2024-1161","title":"Brizy \u2013 Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c955905-bf14-4afa-a282-0a8c74cd3b87?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.43","to_inclusive":true,"patched_in":"2.4.44"}],"published":"2024-06-04T17:04:25Z","updated":"2024-06-05T05:33:05Z"},{"id":"wordfence:2c95ea3f-7f7a-47c2-9ab0-c1c73aaab16b","source":"wordfence","cve":"CVE-2026-94122","title":"Responsive Slider Gallery \u2013 Responsive Image Photo Slider <= 1.5.5 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c95ea3f-7f7a-47c2-9ab0-c1c73aaab16b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-slider-gallery","name":"Responsive Slider Gallery \u2013 Responsive Image Photo Slider","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-09-29T07:17:08Z","updated":"2026-10-09T00:04:37Z"},{"id":"wordfence:2c96bfb8-290b-4818-a468-e8d5cb1850a3","source":"wordfence","cve":"CVE-2024-13727","title":"MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c96bfb8-290b-4818-a468-e8d5cb1850a3?source=api-prod","affected":[{"type":"plugin","slug":"memberspace","name":"MemberSpace \u2013 Sell community access, content, online courses, memberships and paid subscriptions","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-03T22:14:26Z"},{"id":"wordfence:2c994021-d429-4652-ada5-34ec0517cb19","source":"wordfence","cve":"CVE-2021-24755","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c994021-d429-4652-ada5-34ec0517cb19?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c9cf461-572c-4be8-96e6-659acf3208f3","source":"wordfence","cve":"CVE-2024-1110","title":"Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9cf461-572c-4be8-96e6-659acf3208f3?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T11:02:38Z"},{"id":"wordfence:2c9e5440-9d66-416b-899f-2b453294885d","source":"wordfence","cve":"CVE-2026-97196","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9e5440-9d66-416b-899f-2b453294885d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.9","to_inclusive":true,"patched_in":"4.17.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T18:05:55Z"},{"id":"wordfence:2c9f657b-82a5-40da-9e9a-95ea6f62d895","source":"wordfence","cve":"","title":"Gmedia Photo Gallery <= 1.18.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9f657b-82a5-40da-9e9a-95ea6f62d895?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.18.5","to_inclusive":false,"patched_in":"1.18.5"}],"published":"2020-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2c9fa6f9-a549-4629-862f-f9a47b13aa59","source":"wordfence","cve":"CVE-2024-6695","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9fa6f9-a549-4629-862f-f9a47b13aa59?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.11.8","to_inclusive":true,"patched_in":"3.11.9"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-23T21:00:52Z"},{"id":"wordfence:2ca1672b-0e4e-4bda-a085-79dab98de820","source":"wordfence","cve":"CVE-2025-62744","title":"Page Title Splitter <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca1672b-0e4e-4bda-a085-79dab98de820?source=api-prod","affected":[{"type":"plugin","slug":"page-title-splitter","name":"Page Title Splitter","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:33:15Z"},{"id":"wordfence:2ca17cb9-97c2-421b-8834-157cb8d0211e","source":"wordfence","cve":"CVE-2025-25093","title":"Child Themes Helper <= 2.2.7 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca17cb9-97c2-421b-8834-157cb8d0211e?source=api-prod","affected":[{"type":"plugin","slug":"child-themes-helper","name":"Child Themes Helper","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:13:59Z"},{"id":"wordfence:2ca30fef-a014-4d19-b9f8-c51db512795b","source":"wordfence","cve":"CVE-2019-14365","title":"WP Intercom Slack <= 1.2.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca30fef-a014-4d19-b9f8-c51db512795b?source=api-prod","affected":[{"type":"plugin","slug":"wp-intercom-slack","name":"WP Intercom - Slack for WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2019-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ca6746d-afca-4ade-bd2e-4d37dedd3c5c","source":"wordfence","cve":"CVE-2025-9885","title":"MPWizard \u2013 Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca6746d-afca-4ade-bd2e-4d37dedd3c5c?source=api-prod","affected":[{"type":"plugin","slug":"mpwizard","name":"MPWizard \u2013 Create Mercado Pago Payment Links","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:29:04Z","updated":"2025-10-03T11:17:10Z"},{"id":"wordfence:2ca879be-ac35-4bc6-b3f4-a6e8fdf02875","source":"wordfence","cve":"CVE-2024-35749","title":"Under Construction / Maintenance Mode from Acurax <= 2.6 - Unauthenticated IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca879be-ac35-4bc6-b3f4-a6e8fdf02875?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode-from-acurax","name":"Under Construction / Maintenance Mode from Acurax","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:30:39Z"},{"id":"wordfence:2ca8ab94-45b8-4705-b23b-dbc743572121","source":"wordfence","cve":"CVE-2026-12939","title":"Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca8ab94-45b8-4705-b23b-dbc743572121?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2026-07-28T13:22:31Z","updated":"2026-07-29T01:29:43Z"},{"id":"wordfence:2ca9b3e2-bb3a-44e0-8bff-0c9365449ce4","source":"wordfence","cve":"CVE-2025-49291","title":"Calculated Fields Form <= 5.3.58 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ca9b3e2-bb3a-44e0-8bff-0c9365449ce4?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.3.58","to_inclusive":true,"patched_in":"5.3.59"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:02:24Z"},{"id":"wordfence:2caa5eb7-cde1-4043-bee4-07fa7d76bfd9","source":"wordfence","cve":"CVE-2026-16294","title":"PowerPress Podcasting plugin by Blubrry < 11.17.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2caa5eb7-cde1-4043-bee4-07fa7d76bfd9?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.17.1","to_inclusive":false,"patched_in":"11.17.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:46:20Z"},{"id":"wordfence:2cae1194-2247-44bf-a1a0-0cb0068f56e0","source":"wordfence","cve":"CVE-2016-1000130","title":"E-Search <= 1.0 - Reflected Cross-Site Scripting via title_az parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cae1194-2247-44bf-a1a0-0cb0068f56e0?source=api-prod","affected":[{"type":"plugin","slug":"e-search","name":"E-Search","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2caed42f-fb5b-488a-af15-f5ad3d82a68c","source":"wordfence","cve":"","title":"Profile Builder <= 2.4.0 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2caed42f-fb5b-488a-af15-f5ad3d82a68c?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2016-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2caff643-77a5-4951-80ac-177671c30fba","source":"wordfence","cve":"CVE-2025-49884","title":"Internal Linking of Related Contents <= 1.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2caff643-77a5-4951-80ac-177671c30fba?source=api-prod","affected":[{"type":"plugin","slug":"internal-linking-of-related-contents","name":"Internal Linking of Related Contents","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-16T18:25:23Z"},{"id":"wordfence:2cb1b526-0df6-42a1-9294-90bc61730209","source":"wordfence","cve":"CVE-2025-5393","title":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb1b526-0df6-42a1-9294-90bc61730209?source=api-prod","affected":[{"type":"theme","slug":"alone","name":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.7"}],"published":"2025-07-14T15:24:20Z","updated":"2025-07-17T11:34:00Z"},{"id":"wordfence:2cb252c9-fd84-439a-9e7f-05a6000912eb","source":"wordfence","cve":"CVE-2024-50435","title":"Meta News <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb252c9-fd84-439a-9e7f-05a6000912eb?source=api-prod","affected":[{"type":"theme","slug":"meta-news","name":"Meta News","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:58:25Z"},{"id":"wordfence:2cb275d5-ec4b-419f-84e1-84172d381411","source":"wordfence","cve":"CVE-2025-8145","title":"Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb275d5-ec4b-419f-84e1-84172d381411?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-08-19T12:29:47Z","updated":"2025-08-20T01:44:35Z"},{"id":"wordfence:2cb276a2-131b-4ce2-9968-2007ce9cdc93","source":"wordfence","cve":"CVE-2026-65489","title":"LA-Studio Element Kit for Elementor <= 1.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb276a2-131b-4ce2-9968-2007ce9cdc93?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-13T16:58:56Z"},{"id":"wordfence:2cb2ad5d-aa92-4186-aaae-45dde4a52f30","source":"wordfence","cve":"CVE-2026-89141","title":"AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb2ad5d-aa92-4186-aaae-45dde4a52f30?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-09-14T17:10:00Z","updated":"2026-09-15T06:07:31Z"},{"id":"wordfence:2cb40ada-03db-49ed-9f0d-84177238710b","source":"wordfence","cve":"CVE-2025-69179","title":"Support Ticket Management System <= 1.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb40ada-03db-49ed-9f0d-84177238710b?source=api-prod","affected":[{"type":"plugin","slug":"support_ticket","name":"Support Ticket Management System for WordPress","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:31:31Z"},{"id":"wordfence:2cb5370f-14aa-445d-bda3-62a0dd068fc5","source":"wordfence","cve":"CVE-2023-4975","title":"Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb5370f-14aa-445d-bda3-62a0dd068fc5?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.15.13.1","to_inclusive":true,"patched_in":"6.15.15.3"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cba74f7-7183-4297-8f04-4818c01358ef","source":"wordfence","cve":"CVE-2023-1333","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_page_cache'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cba74f7-7183-4297-8f04-4818c01358ef?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cbac277-a827-4438-869d-5a6f96d137fc","source":"wordfence","cve":"CVE-2026-110506","title":"Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cbac277-a827-4438-869d-5a6f96d137fc?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.38.0","to_inclusive":false,"patched_in":"2.38.0"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:27Z"},{"id":"wordfence:2cbb586e-2438-4483-927d-07a7b63125a9","source":"wordfence","cve":"CVE-2024-5283","title":"WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Lead Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cbb586e-2438-4483-927d-07a7b63125a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-18T13:32:32Z"},{"id":"wordfence:2cbc0b70-c8a4-4924-a67f-cea81ab19cdc","source":"wordfence","cve":"CVE-2023-28536","title":"Branded Social Images <= 1.1.0 - Missing Authorization leading to Unauthenticated Plugin Settings Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cbc0b70-c8a4-4924-a67f-cea81ab19cdc?source=api-prod","affected":[{"type":"plugin","slug":"branded-social-images","name":"Branded Social Images \u2013 Open Graph Images with logo and extra text layer","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cbd3bf0-6b20-41c2-8265-786dbba123d7","source":"wordfence","cve":"CVE-2014-10392","title":"Cforms <= 10.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cbd3bf0-6b20-41c2-8265-786dbba123d7?source=api-prod","affected":[{"type":"plugin","slug":"cforms","name":"cforms","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":"10.2"}],"published":"2014-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cbe04ce-1fe9-4596-b517-1ecd8567ff14","source":"wordfence","cve":"CVE-2026-120520","title":"Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cbe04ce-1fe9-4596-b517-1ecd8567ff14?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.2","to_inclusive":true,"patched_in":"13.2.3"}],"published":"2026-11-06T13:50:37Z","updated":"2026-11-07T02:29:13Z"},{"id":"wordfence:2cc03aa9-ad3d-4abb-9c22-cb40875ece47","source":"wordfence","cve":"CVE-2024-9027","title":"WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc03aa9-ad3d-4abb-9c22-cb40875ece47?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-shortcodes","name":"WPZOOM Shortcodes","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:23:50Z","updated":"2024-09-25T02:05:04Z"},{"id":"wordfence:2cc27239-1464-4dba-99a2-4784e230ca48","source":"wordfence","cve":"CVE-2025-67573","title":"Sailing < 4.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc27239-1464-4dba-99a2-4784e230ca48?source=api-prod","affected":[{"type":"theme","slug":"sailing","name":"Sailing","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":false,"patched_in":"4.4.6"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:17:14Z"},{"id":"wordfence:2cc50690-ef5d-4890-9d20-a90fea712ddf","source":"wordfence","cve":"CVE-2025-53569","title":"Trust Payments Gateway for WooCommerce (JavaScript Library) <= 1.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc50690-ef5d-4890-9d20-a90fea712ddf?source=api-prod","affected":[{"type":"plugin","slug":"trust-payments-gateway-3ds2","name":"Trust Payments Gateway for WooCommerce (JavaScript Library)","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:05:25Z"},{"id":"wordfence:2cc5962f-4d3c-43ea-996b-a5bb3d0dccef","source":"wordfence","cve":"CVE-2013-6837","title":"PrettyPhoto Library (Multiple Plugins and Themes) <= 3.1.4 - DOM Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc5962f-4d3c-43ea-996b-a5bb3d0dccef?source=api-prod","affected":[{"type":"plugin","slug":"random-image-gallery-with-pretty-photo-zoom","name":"Random image gallery with pretty photo zoom","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":false,"patched_in":"7.5"},{"type":"plugin","slug":"mytreasures","name":"mytreasures","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-business-directory","name":"wp-business-directory","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":false,"patched_in":"1.4.12"},{"type":"plugin","slug":"s2member-secure-file-browser","name":"s2member Secure File Browser","from":"*","from_inclusive":true,"to":"0.4.17","to_inclusive":false,"patched_in":"0.4.17"},{"type":"plugin","slug":"tallykit","name":"TallyKit","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":false,"patched_in":"5.5"},{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"},{"type":"plugin","slug":"alpine-photo-tile-for-instagram","name":"Alpine Photo Tile for Instagram","from":"*","from_inclusive":true,"to":"1.2.7.5","to_inclusive":false,"patched_in":"1.2.7.5"},{"type":"plugin","slug":"ehive-account-details","name":"eHive Account Details","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"},{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"},{"type":"plugin","slug":"fancyflickr","name":"fancyflickr","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"3.0.229","to_inclusive":false,"patched_in":"3.0.229"},{"type":"plugin","slug":"reflex-gallery","name":"ReFlex Gallery \u00bb WordPress Photo Gallery","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"},{"type":"plugin","slug":"matrix-image-gallery","name":"matrix-image-gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"izeechat","name":"Apizee Contact \u2013 Live Chat Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"},{"type":"plugin","slug":"dp-maintenance-mode-lite","name":"dp-maintenance-mode-lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-portfolio-gallery","name":"WP Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"ticket-manager","name":"ticket-manager","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"lb-tube-video","name":"lb-tube-video","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ehive-object-details","name":"eHive Object Details","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"},{"type":"plugin","slug":"onclick-show-popup","name":"Onclick show popup","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":false,"patched_in":"6.6"},{"type":"plugin","slug":"jcwp-youtube-channel-embed","name":"jcwp youtube channel embed","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"foxyshop","name":"FoxyShop","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":false,"patched_in":"4.6.1"},{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.227","to_inclusive":false,"patched_in":"2.0.227"},{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"},{"type":"plugin","slug":"images-lazyload-and-slideshow","name":"Images Lazyload and Slideshow","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3"},{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"2.11.8.18","to_inclusive":false,"patched_in":"2.11.8.18"},{"type":"plugin","slug":"responsive-category-slider","name":"responsive-category-slider","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"myblogu","name":"MyBlogU","from":"*","from_inclusive":true,"to":"0.0.8","to_inclusive":false,"patched_in":"0.0.8"},{"type":"plugin","slug":"trexanh-property","name":"TreXanh Property","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"0.2"},{"type":"plugin","slug":"embedplus-for-wordpress","name":"embedplus-for-wordpress","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":false,"patched_in":"5.4"},{"type":"plugin","slug":"webrotate-360-product-viewer","name":"webrotate-360-product-viewer","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"},{"type":"plugin","slug":"wp-instagram-bank","name":"wp-instagram-bank","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mklasens-photobox","name":"mklasens-photobox","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cc737b3-4072-4dd4-8e50-ec94dc2a17d5","source":"wordfence","cve":"CVE-2015-5468","title":"WP eCommerce Shop Styling < 2.6 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc737b3-4072-4dd4-8e50-ec94dc2a17d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-shop-styling","name":"WP eCommerce Shop Styling","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2015-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cc9f75d-f1a6-486b-b924-76ec618c5314","source":"wordfence","cve":"CVE-2023-4027","title":"Radio Player <= 2.0.73 - Missing Authorization to Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc9f75d-f1a6-486b-b924-76ec618c5314?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:20Z"},{"id":"wordfence:2ccadf7c-b628-43b6-a6b0-828ca31ff9cc","source":"wordfence","cve":"CVE-2026-9145","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ccadf7c-b628-43b6-a6b0-828ca31ff9cc?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-07-01T21:05:12Z","updated":"2026-07-02T09:32:02Z"},{"id":"wordfence:2ccba77c-fb90-4906-b0fe-77607ec5df1f","source":"wordfence","cve":"CVE-2024-2772","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ccba77c-fb90-4906-b0fe-77607ec5df1f?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.13","to_inclusive":true,"patched_in":"5.1.14"}],"published":"2024-05-17T19:02:47Z","updated":"2024-05-18T07:38:33Z"},{"id":"wordfence:2cce2a10-3d5f-4249-9085-923a1fa76385","source":"wordfence","cve":"CVE-2023-4017","title":"Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cce2a10-3d5f-4249-9085-923a1fa76385?source=api-prod","affected":[{"type":"theme","slug":"goya","name":"Goya","from":"*","from_inclusive":true,"to":"1.0.8.7","to_inclusive":true,"patched_in":"1.0.8.8"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T11:50:44Z"},{"id":"wordfence:2cd364c5-c053-4c50-8232-bb47ab8e834b","source":"wordfence","cve":"CVE-2026-15021","title":"wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd364c5-c053-4c50-8232-bb47ab8e834b?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-15T19:51:26Z","updated":"2026-07-16T08:26:50Z"},{"id":"wordfence:2cd4ad4d-7f2b-45ab-af31-848eb5763ae2","source":"wordfence","cve":"CVE-2026-86781","title":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects < 4.7.40 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd4ad4d-7f2b-45ab-af31-848eb5763ae2?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.7.40","to_inclusive":false,"patched_in":"4.7.40"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:09:14Z"},{"id":"wordfence:2cd509f7-100a-4f28-8d5a-b6b906456c52","source":"wordfence","cve":"CVE-2024-2969","title":"WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd509f7-100a-4f28-8d5a-b6b906456c52?source=api-prod","affected":[{"type":"plugin","slug":"wp-eggdrop","name":"WP-Eggdrop","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:43:57Z"},{"id":"wordfence:2cd53590-ded1-4e68-a9a3-aa1d2d880b80","source":"wordfence","cve":"CVE-2026-9179","title":"WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd53590-ded1-4e68-a9a3-aa1d2d880b80?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-connector","name":"WP Forms Connector","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:39:17Z","updated":"2026-06-24T05:33:23Z"},{"id":"wordfence:2cd61d23-b9bb-4bbf-8a8a-b989464d4bd2","source":"wordfence","cve":"CVE-2026-90967","title":"Essential Real Estate <= 5.3.4 - Authenticated (Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd61d23-b9bb-4bbf-8a8a-b989464d4bd2?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:33:40Z"},{"id":"wordfence:2cd6e69b-f927-4cea-a838-5c73f52233a2","source":"wordfence","cve":"CVE-2023-47517","title":"SendPress Newsletters <= 1.23.11.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd6e69b-f927-4cea-a838-5c73f52233a2?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.23.11.6","to_inclusive":true,"patched_in":"1.24.8.19"}],"published":"2023-11-07T00:00:00Z","updated":"2026-02-12T19:32:31Z"},{"id":"wordfence:2cd71719-e900-46c8-884e-b485c62fed00","source":"wordfence","cve":"CVE-2026-18052","title":"ManageWP Worker < 4.9.37 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd71719-e900-46c8-884e-b485c62fed00?source=api-prod","affected":[{"type":"plugin","slug":"worker","name":"ManageWP Worker","from":"*","from_inclusive":true,"to":"4.9.37","to_inclusive":false,"patched_in":"4.9.37"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T17:39:04Z"},{"id":"wordfence:2cd7d8ee-5947-4317-b872-0b5ee829ad0d","source":"wordfence","cve":"CVE-2025-26931","title":"Tribulant Gallery Voting <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd7d8ee-5947-4317-b872-0b5ee829ad0d?source=api-prod","affected":[{"type":"plugin","slug":"gallery-voting","name":"Tribulant Gallery Voting","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:35:48Z"},{"id":"wordfence:2cd82b92-9c8a-4636-ad0b-942dfca372fb","source":"wordfence","cve":"CVE-2025-62911","title":"Rock Convert <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd82b92-9c8a-4636-ad0b-942dfca372fb?source=api-prod","affected":[{"type":"plugin","slug":"rock-convert","name":"Rock Convert","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:03:20Z"},{"id":"wordfence:2cd92497-25ac-4560-82ed-e21a117d8c64","source":"wordfence","cve":"CVE-2024-37468","title":"Newsmatic <= 1.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cd92497-25ac-4560-82ed-e21a117d8c64?source=api-prod","affected":[{"type":"theme","slug":"newsmatic","name":"Newsmatic","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:02:38Z"},{"id":"wordfence:2cda7499-2275-4d86-949f-1bc38fcdaee3","source":"wordfence","cve":"CVE-2025-53235","title":"Easy Social <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cda7499-2275-4d86-949f-1bc38fcdaee3?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-media","name":"Easy Social","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2026-01-05T18:19:38Z"},{"id":"wordfence:2cdacd01-0eae-4f38-9ecc-170a1a6e7d56","source":"wordfence","cve":"CVE-2025-69187","title":"Final User <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cdacd01-0eae-4f38-9ecc-170a1a6e7d56?source=api-prod","affected":[{"type":"plugin","slug":"final-user","name":"Final User","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:57:55Z"},{"id":"wordfence:2cdaf6ae-8406-41ff-a80c-9fc9ff3ab6aa","source":"wordfence","cve":"CVE-2025-69174","title":"Etude <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cdaf6ae-8406-41ff-a80c-9fc9ff3ab6aa?source=api-prod","affected":[{"type":"theme","slug":"etude","name":"Etude - Design Agency & Branding Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:35:34Z"},{"id":"wordfence:2cde1f4d-0212-48b1-a0ef-ba923c37ab50","source":"wordfence","cve":"CVE-2021-34639","title":"WordPress Download Manager <= 3.1.24 - Authenticated File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cde1f4d-0212-48b1-a0ef-ba923c37ab50?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":"3.1.25"}],"published":"2021-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ce0e587-0312-4484-8f03-c82db67aba44","source":"wordfence","cve":"CVE-2024-32791","title":"Premium Addons for Elementor  <= 4.10.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce0e587-0312-4484-8f03-c82db67aba44?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.25","to_inclusive":true,"patched_in":"4.10.26"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:42:50Z"},{"id":"wordfence:2ce1a40f-1489-42be-963e-052274a56e47","source":"wordfence","cve":"CVE-2022-38144","title":"wpForo Forum <= 2.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce1a40f-1489-42be-963e-052274a56e47?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ce584a1-95ff-4d88-8f37-eff22ea8d84b","source":"wordfence","cve":"CVE-2026-83562","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce584a1-95ff-4d88-8f37-eff22ea8d84b?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:45:09Z"},{"id":"wordfence:2ce5eefe-af48-45f3-9cc4-4a8961344164","source":"wordfence","cve":"CVE-2026-22449","title":"Don Peppe - Pizza and Fast Food WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce5eefe-af48-45f3-9cc4-4a8961344164?source=api-prod","affected":[{"type":"theme","slug":"donpeppe","name":"Don Peppe - Pizza and Fast Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-05T14:21:08Z"},{"id":"wordfence:2ce60724-3ef8-4222-9034-88edb8a4ce0e","source":"wordfence","cve":"CVE-2015-9312","title":"NewStatPress < 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce60724-3ef8-4222-9034-88edb8a4ce0e?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ce61c74-2754-468b-b40a-5b4446375dfd","source":"wordfence","cve":"CVE-2024-24888","title":"Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce61c74-2754-468b-b40a-5b4446375dfd?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.25","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T01:43:53Z"},{"id":"wordfence:2ce8da99-a150-473f-9136-50e42833bb9a","source":"wordfence","cve":"CVE-2025-69031","title":"Arcane <= 3.6.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ce8da99-a150-473f-9136-50e42833bb9a?source=api-prod","affected":[{"type":"theme","slug":"arcane","name":"Arcane - The Gaming Community Theme","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:48:34Z"},{"id":"wordfence:2ceaa52e-564d-4454-8e3b-dc6899c910dd","source":"wordfence","cve":"CVE-2024-43244","title":"Houzez <= 3.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ceaa52e-564d-4454-8e3b-dc6899c910dd?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:41:18Z"},{"id":"wordfence:2ceba97c-8dfe-4195-87f7-5835efa1cd1f","source":"wordfence","cve":"CVE-2025-39391","title":"Checkout Field Visibility for WooCommerce <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ceba97c-8dfe-4195-87f7-5835efa1cd1f?source=api-prod","affected":[{"type":"plugin","slug":"checkout-field-visibility-for-woocommerce","name":"Checkout Field Visibility for eCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-04-21T00:00:00Z","updated":"2025-10-23T20:18:19Z"},{"id":"wordfence:2cee1253-52e5-4676-8a7a-ac71df0786ed","source":"wordfence","cve":"CVE-2024-31264","title":"Post Views Counter <= 1.4.4 - Cross-Site Request Forgery via save_bulk_post_views()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cee1253-52e5-4676-8a7a-ac71df0786ed?source=api-prod","affected":[{"type":"plugin","slug":"post-views-counter","name":"Post Views Counter","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:52:36Z"},{"id":"wordfence:2cee1d75-278c-45c6-915d-60aae6a4d3a2","source":"wordfence","cve":"CVE-2025-8399","title":"Mmm Unity Loader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cee1d75-278c-45c6-915d-60aae6a4d3a2?source=api-prod","affected":[{"type":"plugin","slug":"mmm-unity-loader","name":"Mmm Unity Loader","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T19:37:38Z","updated":"2025-08-02T08:24:46Z"},{"id":"wordfence:2cef154c-efb8-4455-9be6-e3cf8b95e9d3","source":"wordfence","cve":"CVE-2026-9832","title":"Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-09-18T19:19:07Z","updated":"2026-09-19T07:43:14Z"},{"id":"wordfence:2ceff609-fc65-43aa-9b73-747940e1d6c2","source":"wordfence","cve":"CVE-2025-53578","title":"Kipso <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ceff609-fc65-43aa-9b73-747940e1d6c2?source=api-prod","affected":[{"type":"theme","slug":"kipso","name":"Kipso - Education LMS WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-08-23T00:00:00Z","updated":"2025-08-25T17:19:55Z"},{"id":"wordfence:2cf2201d-6da0-4f66-9135-c6b34ef7c65f","source":"wordfence","cve":"CVE-2018-20156","title":"WP Maintenance Mode <= 2.0.6 - Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cf2201d-6da0-4f66-9135-c6b34ef7c65f?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2018-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cf5879f-82ae-41de-b220-aaec45c96c87","source":"wordfence","cve":"CVE-2022-2532","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cf5879f-82ae-41de-b220-aaec45c96c87?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-07-26T00:00:00Z","updated":"2026-03-27T11:01:18Z"},{"id":"wordfence:2cf71a67-5b09-4aa6-b244-4d32ee7b312a","source":"wordfence","cve":"CVE-2026-86788","title":"HT Mega 3.2.0 - 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cf71a67-5b09-4aa6-b244-4d32ee7b312a?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"3.2.0","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:58:53Z"},{"id":"wordfence:2cfbee75-13ef-49ad-9edd-f3077a033c1b","source":"wordfence","cve":"CVE-2015-1614","title":"Image Metadata Cruncher  < 1.8 - Reflected Cross Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfbee75-13ef-49ad-9edd-f3077a033c1b?source=api-prod","affected":[{"type":"plugin","slug":"image-metadata-cruncher","name":"Image Metadata Cruncher","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2015-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cfd4a2c-750e-45db-9bca-8dae4668be53","source":"wordfence","cve":"CVE-2025-62998","title":"AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfd4a2c-750e-45db-9bca-8dae4668be53?source=api-prod","affected":[{"type":"plugin","slug":"ai-co-pilot-for-wp","name":"WP AI CoPilot \u2013 AI content writer plugin, ChatGPT WordPress, GPT-3/4 , Ai assistance","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-12-08T00:00:00Z","updated":"2026-01-15T18:06:28Z"},{"id":"wordfence:2cfdde5c-f0e3-4597-9789-3ff0347719c6","source":"wordfence","cve":"CVE-2026-1639","title":"Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfdde5c-f0e3-4597-9789-3ff0347719c6?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-02-17T17:19:34Z","updated":"2026-02-18T05:29:16Z"},{"id":"wordfence:2cfe69ae-2d42-484e-9c35-672394219ec2","source":"wordfence","cve":"CVE-2020-11508","title":"WordPress Landing Page \u2013 Squeeze Page \u2013 Responsive Landing Page Builder Free \u2013 WP Lead Plus X <= 0.98 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cfe69ae-2d42-484e-9c35-672394219ec2?source=api-prod","affected":[{"type":"plugin","slug":"free-sales-funnel-squeeze-pages-landing-page-builder-templates-make","name":"WordPress Landing Page \u2013 Squeeze Page \u2013 Responsive Landing Page Builder Free \u2013 WP Lead Plus X","from":"*","from_inclusive":true,"to":"0.99","to_inclusive":false,"patched_in":"0.99"}],"published":"2020-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2cff84a4-9264-4789-997b-bc11a8bac449","source":"wordfence","cve":"","title":"Ultimate Product Catalog <= 3.8.1 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2cff84a4-9264-4789-997b-bc11a8bac449?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2016-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d010e55-d57a-49f7-a991-76b676b88f1e","source":"wordfence","cve":"CVE-2023-51509","title":"RegistrationMagic <= 5.2.4.1 - Reflected Cross-Site Scripting via section_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d010e55-d57a-49f7-a991-76b676b88f1e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.4.2","to_inclusive":false,"patched_in":"5.2.4.2"}],"published":"2023-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d038687-59ba-4183-96ab-fd9fd0dcf26f","source":"wordfence","cve":"CVE-2025-24670","title":"Term Taxonomy Converter <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d038687-59ba-4183-96ab-fd9fd0dcf26f?source=api-prod","affected":[{"type":"plugin","slug":"term-taxonomy-converter","name":"Term Taxonomy Converter","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-01-21T00:00:00Z","updated":"2025-04-22T22:06:29Z"},{"id":"wordfence:2d0401b3-2308-49d5-9e94-23dafb46297e","source":"wordfence","cve":"CVE-2024-54426","title":"LeaderBoard Plugin <= 1.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0401b3-2308-49d5-9e94-23dafb46297e?source=api-prod","affected":[{"type":"plugin","slug":"leaderboard-lite","name":"LeaderBoard Plugin","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:04:15Z"},{"id":"wordfence:2d044e0a-a956-4319-985d-6a9a276daf49","source":"wordfence","cve":"CVE-2024-2019","title":"WP-DB-Table-Editor <= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d044e0a-a956-4319-985d-6a9a276daf49?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-table-editor","name":"WP-DB-Table-Editor","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:10:03Z","updated":"2024-06-04T05:32:14Z"},{"id":"wordfence:2d048878-12ae-442a-921d-c02a4e1e3974","source":"wordfence","cve":"CVE-2013-1400","title":"WordPress Poll < 34.06 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d048878-12ae-442a-921d-c02a4e1e3974?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-wordpress-poll","name":"WordPress Poll","from":"*","from_inclusive":true,"to":"34.05","to_inclusive":true,"patched_in":"34.06"}],"published":"2013-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d0529df-70be-4559-a760-5537e0fd4d1e","source":"wordfence","cve":"CVE-2011-3122","title":"WordPress Core < 3.1.3 - Media Related Security Issue","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0529df-70be-4559-a760-5537e0fd4d1e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d07880b-9af1-4b1e-aa70-b95ef10a6e33","source":"wordfence","cve":"CVE-2025-8218","title":"Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07880b-9af1-4b1e-aa70-b95ef10a6e33?source=api-prod","affected":[{"type":"theme","slug":"real-spaces","name":"Real Spaces - WordPress Properties Directory Theme","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-19T06:45:26Z"},{"id":"wordfence:2d07dc6a-a119-478a-9678-45dc580aa863","source":"wordfence","cve":"CVE-2024-51675","title":"aThemes Addons for Elementor <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07dc6a-a119-478a-9678-45dc580aa863?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:41:43Z"},{"id":"wordfence:2d08e462-8297-477e-89da-47f26bd6beae","source":"wordfence","cve":"CVE-2024-1339","title":"ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d08e462-8297-477e-89da-47f26bd6beae?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:42:44Z"},{"id":"wordfence:2d092b26-6f36-49db-80fb-968f08af8f62","source":"wordfence","cve":"CVE-2025-62058","title":"Houzez Theme - Functionality < 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d092b26-6f36-49db-80fb-968f08af8f62?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:49:35Z"},{"id":"wordfence:2d0a822f-94b2-4875-b4b2-5c866555e3bd","source":"wordfence","cve":"CVE-2021-24971","title":"WP Responsive Menu <= 3.1.7 - Missing Authorization to Settings Update & Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0a822f-94b2-4875-b4b2-5c866555e3bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-menu","name":"WP Responsive Menu","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.7.1"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d0a9410-533a-4d5a-859c-fc9ad839f47a","source":"wordfence","cve":"CVE-2025-64270","title":"Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0a9410-533a-4d5a-859c-fc9ad839f47a?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-11-30T00:00:00Z","updated":"2025-12-20T19:34:43Z"},{"id":"wordfence:2d0e5d24-5d65-4ed5-8086-347969cbd3ec","source":"wordfence","cve":"CVE-2024-3045","title":"PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d0e5d24-5d65-4ed5-8086-347969cbd3ec?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:51:55Z"},{"id":"wordfence:2d1010bf-8c96-4007-bebe-6df38e3c19ba","source":"wordfence","cve":"CVE-2026-14941","title":"Customer Reviews for WooCommerce <= 5.115.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1010bf-8c96-4007-bebe-6df38e3c19ba?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.115.0","to_inclusive":true,"patched_in":"5.116.0"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:24:37Z"},{"id":"wordfence:2d10475f-83dd-4e59-83e4-aeaa72a22b96","source":"wordfence","cve":"CVE-2023-4943","title":"BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d10475f-83dd-4e59-83e4-aeaa72a22b96?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d10f043-df2c-4e81-bd99-e478a2dca0cf","source":"wordfence","cve":"","title":"WordPress Shout Box Widget <= 2.0.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d10f043-df2c-4e81-bd99-e478a2dca0cf?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-shout-box","name":"WordPress Shout Box Widget","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2013-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d113191-b550-4752-b536-644206ab56c1","source":"wordfence","cve":"CVE-2024-2845","title":"BetterDocs \u2013 Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d113191-b550-4752-b536-644206ab56c1?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-05-31T15:30:13Z"},{"id":"wordfence:2d1302c4-7aeb-49f4-aa11-2c0e08bd9c71","source":"wordfence","cve":"CVE-2011-5104","title":"WP eCommerce < 3.8.7.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1302c4-7aeb-49f4-aa11-2c0e08bd9c71?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.8.7.2","to_inclusive":false,"patched_in":"3.8.7.2"}],"published":"2011-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d13aadf-c144-4919-9bbd-54cb26cf2527","source":"wordfence","cve":"CVE-2025-12417","title":"SurveyFunnel \u2013 Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d13aadf-c144-4919-9bbd-54cb26cf2527?source=api-prod","affected":[{"type":"plugin","slug":"surveyfunnel-lite","name":"SurveyFunnel \u2013 Survey Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:27:46Z","updated":"2025-12-05T04:29:10Z"},{"id":"wordfence:2d1414f5-e705-4fd4-847b-b46d2d20943b","source":"wordfence","cve":"CVE-2023-34186","title":"Headless CMS <= 2.0.3 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1414f5-e705-4fd4-847b-b46d2d20943b?source=api-prod","affected":[{"type":"plugin","slug":"headless-cms","name":"Headless CMS","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d1d8f46-68e4-4101-8ae8-1ca01f5145bf","source":"wordfence","cve":"CVE-2026-39508","title":"Advanced Coupons for WooCommerce Coupons <= 4.7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1d8f46-68e4-4101-8ae8-1ca01f5145bf?source=api-prod","affected":[{"type":"plugin","slug":"advanced-coupons-for-woocommerce-free","name":"Advanced Coupons for WooCommerce \u2013 BOGO, Store Credit & WooCommerce Coupons","from":"*","from_inclusive":true,"to":"4.7.1.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-03-28T00:00:00Z","updated":"2026-04-15T21:27:05Z"},{"id":"wordfence:2d1d9bee-4afa-44cc-8e7a-8a73ad018c4a","source":"wordfence","cve":"CVE-2024-11201","title":"myCred \u2013 Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1d9bee-4afa-44cc-8e7a-8a73ad018c4a?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.5.2","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-12-05T17:20:59Z","updated":"2024-12-06T05:29:43Z"},{"id":"wordfence:2d20e8c9-975d-4e8c-8bea-50935853c7d4","source":"wordfence","cve":"CVE-2026-9227","title":"GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d20e8c9-975d-4e8c-8bea-50935853c7d4?source=api-prod","affected":[{"type":"plugin","slug":"gutenbee","name":"GutenBee \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.20.1","to_inclusive":true,"patched_in":"2.20.2"}],"published":"2026-05-27T18:02:02Z","updated":"2026-05-28T06:45:40Z"},{"id":"wordfence:2d21fe88-a273-410a-99c6-5ec576b187b9","source":"wordfence","cve":"CVE-2026-57751","title":"Heateor Social Login WordPress <= 1.1.39 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d21fe88-a273-410a-99c6-5ec576b187b9?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.39","to_inclusive":true,"patched_in":""}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:47:02Z"},{"id":"wordfence:2d22692f-2bc9-4f20-afc0-82085253ddba","source":"wordfence","cve":"CVE-2026-40736","title":"Laurits <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d22692f-2bc9-4f20-afc0-82085253ddba?source=api-prod","affected":[{"type":"theme","slug":"laurits","name":"Laurits - Portfolio and Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:08:49Z"},{"id":"wordfence:2d22f0e0-2f5d-496f-88c1-cdbec0318cfd","source":"wordfence","cve":"CVE-2025-27292","title":"WPYog Documents <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d22f0e0-2f5d-496f-88c1-cdbec0318cfd?source=api-prod","affected":[{"type":"plugin","slug":"wpyog-documents","name":"WPYog Documents","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-02-21T00:00:00Z","updated":"2025-10-02T22:26:30Z"},{"id":"wordfence:2d23541e-bb1c-4fcf-836b-28522a39b018","source":"wordfence","cve":"CVE-2023-4023","title":"All Users Messenger <= 1.24 - Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d23541e-bb1c-4fcf-836b-28522a39b018?source=api-prod","affected":[{"type":"plugin","slug":"all-users-messenger","name":"All Users Messenger","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d2380af-2ba7-4f6b-a055-52f400042be4","source":"wordfence","cve":"CVE-2024-37234","title":"Academy LMS <= 2.0.10 - Open Redirect","severity":"high","cvss":8.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2380af-2ba7-4f6b-a055-52f400042be4?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-06-21T00:00:00Z","updated":"2024-09-04T21:20:13Z"},{"id":"wordfence:2d23a2b9-8476-4564-a5de-5e6cfc38ce68","source":"wordfence","cve":"CVE-2024-10215","title":"WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d23a2b9-8476-4564-a5de-5e6cfc38ce68?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-01-09T00:00:00Z","updated":"2025-01-09T19:21:56Z"},{"id":"wordfence:2d248c0e-9990-4107-996a-a65baab25cb0","source":"wordfence","cve":"CVE-2025-26743","title":"Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d248c0e-9990-4107-996a-a65baab25cb0?source=api-prod","affected":[{"type":"plugin","slug":"advance-wp-query-search-filter","name":"Advance WP Query Search Filter","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T14:11:53Z"},{"id":"wordfence:2d24aa7e-bbf1-4a54-b53b-7a37e613e0e6","source":"wordfence","cve":"CVE-2023-51667","title":"Rate my Post \u2013 WP Rating System <= 3.4.2 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-291","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d24aa7e-bbf1-4a54-b53b-7a37e613e0e6?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d29c30c-bb42-4ed0-a78d-eeea5b256275","source":"wordfence","cve":"CVE-2025-26970","title":"Ark Theme Core <= 1.70.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d29c30c-bb42-4ed0-a78d-eeea5b256275?source=api-prod","affected":[{"type":"plugin","slug":"ark-core","name":"The Ark | WordPress Theme made for Freelancers","from":"*","from_inclusive":true,"to":"1.70.0","to_inclusive":true,"patched_in":"1.71.0"}],"published":"2025-02-24T00:00:00Z","updated":"2025-10-27T13:50:44Z"},{"id":"wordfence:2d29f77c-b86d-4058-b528-27631e8a1f2e","source":"wordfence","cve":"CVE-2026-1750","title":"Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d29f77c-b86d-4058-b528-27631e8a1f2e?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"7.0.8"}],"published":"2026-02-14T14:30:00Z","updated":"2026-02-15T03:24:33Z"},{"id":"wordfence:2d2f0cf5-d41e-4beb-8209-7d9e747a11ec","source":"wordfence","cve":"CVE-2026-39732","title":"Transliterator \u2013 Multilingual and Multi-script Text Conversion <= 2.5.13 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2f0cf5-d41e-4beb-8209-7d9e747a11ec?source=api-prod","affected":[{"type":"plugin","slug":"serbian-transliteration","name":"Transliterator \u2013 Multilingual and Multi-script Text Conversion","from":"*","from_inclusive":true,"to":"2.5.13","to_inclusive":true,"patched_in":"2.5.14"}],"published":"2026-10-30T07:13:27Z","updated":"2026-11-03T19:54:32Z"},{"id":"wordfence:2d2f543b-ade7-4908-ac8a-e46a1d59d481","source":"wordfence","cve":"CVE-2025-60097","title":"TheGem <= 5.10.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2f543b-ade7-4908-ac8a-e46a1d59d481?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.5.1"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:19:48Z"},{"id":"wordfence:2d2fc926-6f9f-4ed9-9598-e39b5e6c6544","source":"wordfence","cve":"CVE-2023-6382","title":"Master Slider - Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2fc926-6f9f-4ed9-9598-e39b5e6c6544?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.10"}],"published":"2024-05-31T00:00:00Z","updated":"2025-10-07T11:18:33Z"},{"id":"wordfence:2d3150b3-fba1-4e89-8f4e-b6c605227395","source":"wordfence","cve":"CVE-2024-30238","title":"Photos and Files Contest Gallery <= 21.3.2 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3150b3-fba1-4e89-8f4e-b6c605227395?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.3.2","to_inclusive":true,"patched_in":"21.3.2.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:38:53Z"},{"id":"wordfence:2d3188c2-e5b0-4d83-8c92-ae6b409c92f9","source":"wordfence","cve":"CVE-2024-8861","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3188c2-e5b0-4d83-8c92-ae6b409c92f9?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.3.2","to_inclusive":true,"patched_in":"5.9.3.3"}],"published":"2024-09-25T19:18:11Z","updated":"2024-09-26T07:34:38Z"},{"id":"wordfence:2d31adfe-9b4b-43df-8077-9420a2643313","source":"wordfence","cve":"CVE-2026-110291","title":"Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d31adfe-9b4b-43df-8077-9420a2643313?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2026-11-05T20:31:53Z","updated":"2026-11-06T08:38:07Z"},{"id":"wordfence:2d32e6d1-67b4-44e1-b82a-78ce08aea1e6","source":"wordfence","cve":"CVE-2026-57319","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d32e6d1-67b4-44e1-b82a-78ce08aea1e6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:57:03Z"},{"id":"wordfence:2d33a880-0238-4d27-a433-6a09844bef3f","source":"wordfence","cve":"CVE-2022-47148","title":"WooCommerce PDF Invoices & Packing Slips <= 3.2.5 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d33a880-0238-4d27-a433-6a09844bef3f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d34b675-ff66-475e-b838-657dd51fc48c","source":"wordfence","cve":"CVE-2024-34386","title":"Auto Affiliate Links <= 6.4.3.1 - Authenticated (Editor+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d34b675-ff66-475e-b838-657dd51fc48c?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.3.1","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T20:22:32Z"},{"id":"wordfence:2d34c665-e99c-408e-b7ab-d08a1a51c6c4","source":"wordfence","cve":"CVE-2023-44479","title":"WP Jump Menu <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d34c665-e99c-408e-b7ab-d08a1a51c6c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-jump-menu","name":"WP Jump Menu","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d34f957-e6e3-4b16-9d59-d481eec429eb","source":"wordfence","cve":"CVE-2024-50462","title":"Interactive World Map <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d34f957-e6e3-4b16-9d59-d481eec429eb?source=api-prod","affected":[{"type":"plugin","slug":"interactive-world-map","name":"Interactive World Map","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:43:15Z"},{"id":"wordfence:2d35279d-299e-4ca2-8f84-165284e058c8","source":"wordfence","cve":"CVE-2026-12073","title":"ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.5","to_inclusive":true,"patched_in":"5.9.9.6"}],"published":"2026-06-29T16:51:48Z","updated":"2026-06-30T05:34:05Z"},{"id":"wordfence:2d36c088-d512-4c9a-a1bc-47a4ee597d63","source":"wordfence","cve":"CVE-2025-69297","title":"Aardvark <= 2.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d36c088-d512-4c9a-a1bc-47a4ee597d63?source=api-prod","affected":[{"type":"plugin","slug":"aardvark-plugin","name":"Aardvark","from":"*","from_inclusive":true,"to":"2.19","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:54:17Z"},{"id":"wordfence:2d36fa25-108b-462b-b84e-2e77943b1871","source":"wordfence","cve":"CVE-2026-4133","title":"TextP2P Texting Widget <= 1.8 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d36fa25-108b-462b-b84e-2e77943b1871?source=api-prod","affected":[{"type":"plugin","slug":"textp2p-texting-widget","name":"TextP2P Texting Widget","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-04-21T19:07:48Z","updated":"2026-07-10T15:30:56Z"},{"id":"wordfence:2d379440-3574-49af-ba56-10cdae65c756","source":"wordfence","cve":"CVE-2026-76556","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d379440-3574-49af-ba56-10cdae65c756?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:27:35Z"},{"id":"wordfence:2d3863ec-0cc7-4128-a19e-fc1e2c31195e","source":"wordfence","cve":"CVE-2025-15000","title":"Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3863ec-0cc7-4128-a19e-fc1e2c31195e?source=api-prod","affected":[{"type":"plugin","slug":"page-keys","name":"Page Keys","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-01-06T19:58:54Z","updated":"2026-01-08T21:50:19Z"},{"id":"wordfence:2d390a7e-f790-4953-b3cb-be31cfec6fb0","source":"wordfence","cve":"CVE-2021-46782","title":"Pricing Table by Supsystic <= 1.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d390a7e-f790-4953-b3cb-be31cfec6fb0?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d3b9cde-e4d8-4217-96b4-f6ad00cd3a2d","source":"wordfence","cve":"CVE-2024-4344","title":"Shield Security \u2013 Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3b9cde-e4d8-4217-96b4-f6ad00cd3a2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"19.1.10","to_inclusive":true,"patched_in":"19.1.11"}],"published":"2024-06-01T16:29:51Z","updated":"2024-06-03T13:51:01Z"},{"id":"wordfence:2d3c2f4b-389e-4dec-bb18-b63cfa053947","source":"wordfence","cve":"CVE-2025-8686","title":"WP Easy FAQs <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3c2f4b-389e-4dec-bb18-b63cfa053947?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-faqs","name":"WP Easy FAQs","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:44:38Z","updated":"2025-09-11T07:24:50Z"},{"id":"wordfence:2d3ca386-0bec-48fb-963f-03b236c94308","source":"wordfence","cve":"CVE-2025-47655","title":"theMarketer <= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3ca386-0bec-48fb-963f-03b236c94308?source=api-prod","affected":[{"type":"plugin","slug":"themarketer","name":"theMarketer \u2013 Email marketing, Newsletters, Automation & Loyalty for Woocommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-09-09T17:29:07Z"},{"id":"wordfence:2d3de38b-1b03-4e77-9ea9-f6a54b1ab506","source":"wordfence","cve":"CVE-2026-22475","title":"Estate <= 1.3.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3de38b-1b03-4e77-9ea9-f6a54b1ab506?source=api-prod","affected":[{"type":"theme","slug":"estate","name":"Estate","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:34:39Z"},{"id":"wordfence:2d3e2880-bb86-4263-9ed4-25a9769890e4","source":"wordfence","cve":"CVE-2025-11887","title":"Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3e2880-bb86-4263-9ed4-25a9769890e4?source=api-prod","affected":[{"type":"plugin","slug":"supervisor","name":"Supervisor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-10-23T19:46:03Z","updated":"2025-10-24T08:23:58Z"},{"id":"wordfence:2d3f78b4-04c7-4978-919f-997b39307c5b","source":"wordfence","cve":"CVE-2026-122059","title":"WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3f78b4-04c7-4978-919f-997b39307c5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-imageviewer","name":"WP ImageViewer","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-11-06T21:45:04Z","updated":"2026-11-07T11:26:26Z"},{"id":"wordfence:2d4225a6-4aae-49a5-93e1-8dcc9a77e089","source":"wordfence","cve":"CVE-2026-0664","title":"Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4225a6-4aae-49a5-93e1-8dcc9a77e089?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1049","to_inclusive":true,"patched_in":"1.7.1050"}],"published":"2026-04-03T19:31:46Z","updated":"2026-04-04T07:41:58Z"},{"id":"wordfence:2d443c70-6537-4c6d-a282-12d392f0f558","source":"wordfence","cve":"CVE-2025-1972","title":"Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d443c70-6537-4c6d-a282-12d392f0f558?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-21T23:18:32Z","updated":"2025-03-22T11:18:42Z"},{"id":"wordfence:2d45afd4-9a1f-402c-86e3-8e3d6d7178d3","source":"wordfence","cve":"CVE-2025-11823","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +21 Modules \u2013 All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d45afd4-9a1f-402c-86e3-8e3d6d7178d3?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-10-24T15:45:09Z","updated":"2025-10-31T13:03:12Z"},{"id":"wordfence:2d4965e5-c207-475e-9673-29b3d0d996f7","source":"wordfence","cve":"CVE-2026-27046","title":"StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages <= 2.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4965e5-c207-475e-9673-29b3d0d996f7?source=api-prod","affected":[{"type":"plugin","slug":"woocustomizer","name":"StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-03-16T00:00:00Z","updated":"2026-04-15T13:42:18Z"},{"id":"wordfence:2d49fa2d-0625-40a4-b3dd-13679b806bc1","source":"wordfence","cve":"","title":"AntiVirus < 1.1 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d49fa2d-0625-40a4-b3dd-13679b806bc1?source=api-prod","affected":[{"type":"plugin","slug":"antivirus","name":"AntiVirus","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2013-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d4a463b-e447-4fd0-a8df-284ecd6cd975","source":"wordfence","cve":"CVE-2024-13712","title":"Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4a463b-e447-4fd0-a8df-284ecd6cd975?source=api-prod","affected":[{"type":"plugin","slug":"pollin","name":"Pollin","from":"*","from_inclusive":true,"to":"1.01.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T07:32:06Z"},{"id":"wordfence:2d4abd91-f241-4a40-b164-e0f8a4f13d1a","source":"wordfence","cve":"CVE-2025-69343","title":"Theater for WordPress <= 0.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4abd91-f241-4a40-b164-e0f8a4f13d1a?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.19","to_inclusive":true,"patched_in":"0.19.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:41:15Z"},{"id":"wordfence:2d4df161-ea68-4041-8db5-ed77ea917280","source":"wordfence","cve":"CVE-2026-80338","title":"CMB2 <= 2.12.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4df161-ea68-4041-8db5-ed77ea917280?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:47:41Z"},{"id":"wordfence:2d4e4f02-3386-4368-81dd-98a2077184c6","source":"wordfence","cve":"CVE-2025-67946","title":"AdForest <= 6.0.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4e4f02-3386-4368-81dd-98a2077184c6?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:32:10Z"},{"id":"wordfence:2d4e9daf-d414-4ace-9efd-4c3e16deeb8f","source":"wordfence","cve":"CVE-2024-6694","title":"WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure","severity":"low","cvss":2.7,"cwe":"CWE-257","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4e9daf-d414-4ace-9efd-4c3e16deeb8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-smtp","name":"WP Mail SMTP by WPForms \u2013 SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T03:30:44Z"},{"id":"wordfence:2d532ffc-c6f1-41e3-9a59-0706802ab8e2","source":"wordfence","cve":"CVE-2026-7638","title":"App Builder <= 5.6.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d532ffc-c6f1-41e3-9a59-0706802ab8e2?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-05-01T15:33:11Z","updated":"2026-09-14T16:58:20Z"},{"id":"wordfence:2d540b53-5c39-43d5-a055-cc5eccfa65b8","source":"wordfence","cve":"CVE-2022-1187","title":"WP YouTube Live <= 1.7.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d540b53-5c39-43d5-a055-cc5eccfa65b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-live","name":"WP YouTube Live","from":"*","from_inclusive":true,"to":"1.7.21","to_inclusive":true,"patched_in":"1.7.22"}],"published":"2022-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d581a38-736a-497f-aaf7-6da0b2421618","source":"wordfence","cve":"CVE-2024-30183","title":"Livemesh Addons for WPBakery Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d581a38-736a-497f-aaf7-6da0b2421618?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:36:20Z"},{"id":"wordfence:2d58322f-e24d-40fd-8dab-20752b386bb9","source":"wordfence","cve":"CVE-2024-49328","title":"WP REST API FNS <= 1.0.0 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d58322f-e24d-40fd-8dab-20752b386bb9?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-fns","name":"WP REST API FNS Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:19:45Z"},{"id":"wordfence:2d59e599-59da-4c03-b71f-d00a078b2442","source":"wordfence","cve":"CVE-2024-9231","title":"WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d59e599-59da-4c03-b71f-d00a078b2442?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.9.5","to_inclusive":true,"patched_in":"3.4.9.6"}],"published":"2024-10-21T20:55:04Z","updated":"2024-10-22T09:32:09Z"},{"id":"wordfence:2d5a9a2d-63d3-411c-af22-2829fd79c72b","source":"wordfence","cve":"CVE-2021-25058","title":"The Buffer Button <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5a9a2d-63d3-411c-af22-2829fd79c72b?source=api-prod","affected":[{"type":"plugin","slug":"the-buffer-button","name":"The Buffer Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d5c6566-a890-4b95-b349-3874eb57b45a","source":"wordfence","cve":"CVE-2023-2718","title":"Contact Form Email <= 1.3.37 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5c6566-a890-4b95-b349-3874eb57b45a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.37","to_inclusive":true,"patched_in":"1.3.38"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d5e247c-ec80-4d25-9fb3-dd17a3724a70","source":"wordfence","cve":"CVE-2025-48081","title":"Printeers Print & Ship <= 1.17.0 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5e247c-ec80-4d25-9fb3-dd17a3724a70?source=api-prod","affected":[{"type":"plugin","slug":"invition-print-ship","name":"Printeers Print & Ship","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:24:40Z"},{"id":"wordfence:2d5fa131-20ae-41f6-b7cd-51c8ddcbb735","source":"wordfence","cve":"CVE-2026-116848","title":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5fa131-20ae-41f6-b7cd-51c8ddcbb735?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2026-10-29T15:04:00Z","updated":"2026-11-03T19:32:51Z"},{"id":"wordfence:2d5fb4ac-f86e-4b5e-ad4b-be19158ab745","source":"wordfence","cve":"CVE-2024-12219","title":"Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5fb4ac-f86e-4b5e-ad4b-be19158ab745?source=api-prod","affected":[{"type":"plugin","slug":"stop-registration-spam","name":"Stop Registration Spam","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.24"}],"published":"2024-12-16T18:59:33Z","updated":"2025-01-17T13:48:09Z"},{"id":"wordfence:2d5fb5c8-3e4d-4268-8b21-b65b7d7b68f2","source":"wordfence","cve":"CVE-2024-8187","title":"Smart Post Show <= 3.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Pagination Color","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5fb5c8-3e4d-4268-8b21-b65b7d7b68f2?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-10-08T00:00:00Z","updated":"2024-10-08T16:37:48Z"},{"id":"wordfence:2d60ea41-c103-4b56-a920-d4b82698d630","source":"wordfence","cve":"","title":"Spam protection, AntiSpam, FireWall by CleanTalk < 5.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d60ea41-c103-4b56-a920-d4b82698d630?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.22","to_inclusive":false,"patched_in":"5.22"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d61a1f1-137e-4856-b5ff-b100143a8b47","source":"wordfence","cve":"CVE-2026-97336","title":"CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d61a1f1-137e-4856-b5ff-b100143a8b47?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2026-10-01T18:39:15Z","updated":"2026-10-02T07:39:22Z"},{"id":"wordfence:2d62c49c-3a33-4865-abcc-22d8e38ac198","source":"wordfence","cve":"CVE-2026-4140","title":"Ni WooCommerce Order Export <= 3.1.6 - Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d62c49c-3a33-4865-abcc-22d8e38ac198?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-order-export","name":"Ni WooCommerce Order Export","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:05:33Z","updated":"2026-04-22T07:45:33Z"},{"id":"wordfence:2d6304e5-7fbf-484d-b147-f2a6c2ee0658","source":"wordfence","cve":"CVE-2026-10092","title":"Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6304e5-7fbf-484d-b147-f2a6c2ee0658?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.163","to_inclusive":true,"patched_in":"1.164"}],"published":"2026-06-23T16:37:07Z","updated":"2026-09-18T19:28:30Z"},{"id":"wordfence:2d643448-f7b7-4ba8-89f3-e2ff489ddf20","source":"wordfence","cve":"CVE-2026-119515","title":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d643448-f7b7-4ba8-89f3-e2ff489ddf20?source=api-prod","affected":[{"type":"plugin","slug":"radius-booking","name":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2026-11-07T10:41:08Z","updated":"2026-11-10T19:33:19Z"},{"id":"wordfence:2d64e1c6-1e25-4438-974d-b7da0979cc40","source":"wordfence","cve":"CVE-2024-4434","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d64e1c6-1e25-4438-974d-b7da0979cc40?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.5","to_inclusive":true,"patched_in":"4.2.6.6"}],"published":"2024-05-09T19:40:23Z","updated":"2024-05-10T08:32:34Z"},{"id":"wordfence:2d66d939-7679-4831-9bce-104b71e997a8","source":"wordfence","cve":"CVE-2026-57690","title":"Werkstatt - Creative Portfolio WordPress Theme <= 4.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d66d939-7679-4831-9bce-104b71e997a8?source=api-prod","affected":[{"type":"theme","slug":"werkstatt","name":"Werkstatt - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-06-29T18:30:33Z"},{"id":"wordfence:2d6a6159-5c8c-4d8f-9592-93b6ce74f082","source":"wordfence","cve":"CVE-2026-66709","title":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6a6159-5c8c-4d8f-9592-93b6ce74f082?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.42","to_inclusive":true,"patched_in":"6.6.43"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:29:40Z"},{"id":"wordfence:2d6cbfc8-1ced-4757-b090-39add17afc77","source":"wordfence","cve":"CVE-2026-13714","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6cbfc8-1ced-4757-b090-39add17afc77?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T16:55:05Z"},{"id":"wordfence:2d6cf33c-ac40-4892-9345-64ebe61e6be6","source":"wordfence","cve":"CVE-2025-3598","title":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6cf33c-ac40-4892-9345-64ebe61e6be6?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2025-04-17T16:23:45Z","updated":"2025-04-18T05:23:00Z"},{"id":"wordfence:2d6e3a66-4c25-485b-ad49-7ab083a59dd2","source":"wordfence","cve":"CVE-2025-48101","title":"Constant Contact for WordPress <= 4.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6e3a66-4c25-485b-ad49-7ab083a59dd2?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-api","name":"Constant Contact for WordPress","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-25T20:26:23Z"},{"id":"wordfence:2d6e9aea-6ccb-4c83-83bb-63c9c9f59005","source":"wordfence","cve":"CVE-2021-24849","title":"WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6e9aea-6ccb-4c83-83bb-63c9c9f59005?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.4.12"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d70b9b6-a1f0-4449-8d1a-ae16dbcc844d","source":"wordfence","cve":"CVE-2022-37405","title":"Better Font Awesome <= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d70b9b6-a1f0-4449-8d1a-ae16dbcc844d?source=api-prod","affected":[{"type":"plugin","slug":"better-font-awesome","name":"Better Font Awesome","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d717f69-cb42-4c8d-8f60-3c00980cd133","source":"wordfence","cve":"CVE-2026-115947","title":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard <= 1.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d717f69-cb42-4c8d-8f60-3c00980cd133?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-10-30T08:37:12Z","updated":"2026-11-03T19:28:25Z"},{"id":"wordfence:2d720466-e470-46a3-8129-3e58e1928f0d","source":"wordfence","cve":"CVE-2025-14048","title":"SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d720466-e470-46a3-8129-3e58e1928f0d?source=api-prod","affected":[{"type":"plugin","slug":"simplyconvert","name":"SimplyConvert","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:21:52Z","updated":"2025-12-12T03:20:42Z"},{"id":"wordfence:2d7264bc-7fa1-4f5f-a8bc-0840374b7a08","source":"wordfence","cve":"","title":"Adaptive Images <= 0.6.68 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7264bc-7fa1-4f5f-a8bc-0840374b7a08?source=api-prod","affected":[{"type":"plugin","slug":"adaptive-images","name":"Adaptive Images for WordPress","from":"*","from_inclusive":true,"to":"0.6.68","to_inclusive":true,"patched_in":"0.6.69"}],"published":"2022-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d7330ac-22c6-48a7-91ab-66e2ec639964","source":"wordfence","cve":"CVE-2026-18049","title":"WP Photo Album Plus < 9.2.07.002 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7330ac-22c6-48a7-91ab-66e2ec639964?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.07.002","to_inclusive":false,"patched_in":"9.2.07.002"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:45:59Z"},{"id":"wordfence:2d754689-0d64-4cb8-9c73-7dd6d4fb0c72","source":"wordfence","cve":"CVE-2026-15309","title":"CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d754689-0d64-4cb8-9c73-7dd6d4fb0c72?source=api-prod","affected":[{"type":"plugin","slug":"coursecure-courses","name":"CourseCure Courses","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-11-11T22:31:15Z","updated":"2026-11-12T11:32:16Z"},{"id":"wordfence:2d776d94-8c81-4e88-bae3-946824a75c09","source":"wordfence","cve":"CVE-2025-1435","title":"bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d776d94-8c81-4e88-bae3-946824a75c09?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":true,"patched_in":"2.6.12"}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T08:21:55Z"},{"id":"wordfence:2d790b52-bb2e-4bfa-bca1-34c0df721571","source":"wordfence","cve":"CVE-2025-32253","title":"Course Booking System <= 6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d790b52-bb2e-4bfa-bca1-34c0df721571?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-system","name":"Course Booking System","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-21T13:57:42Z"},{"id":"wordfence:2d79ad4c-6b7e-4bf9-93af-76b8c3599d47","source":"wordfence","cve":"","title":"Dialogs <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d79ad4c-6b7e-4bf9-93af-76b8c3599d47?source=api-prod","affected":[{"type":"plugin","slug":"dialogs","name":"Dialogs","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d7bc556-cdaf-42a7-8801-ad2e4945a137","source":"wordfence","cve":"CVE-2026-1463","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7bc556-cdaf-42a7-8801-ad2e4945a137?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-18T16:26:29Z"},{"id":"wordfence:2d7be70b-ac33-4fc2-a627-52f238c2011e","source":"wordfence","cve":"CVE-2026-32420","title":"GamiPress <= 7.6.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7be70b-ac33-4fc2-a627-52f238c2011e?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.6.6","to_inclusive":true,"patched_in":"7.6.7"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-15T21:01:32Z"},{"id":"wordfence:2d7d83f6-92d1-43a8-821c-7b9470ead493","source":"wordfence","cve":"CVE-2020-36175","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7d83f6-92d1-43a8-821c-7b9470ead493?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.27","to_inclusive":true,"patched_in":"3.4.27.1"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d7ea482-c45e-4a73-9e64-4d4438e197b4","source":"wordfence","cve":"CVE-2011-3852","title":"Evolve < 1.2.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7ea482-c45e-4a73-9e64-4d4438e197b4?source=api-prod","affected":[{"type":"theme","slug":"evolve","name":"evolve","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d7ee078-e9b1-4583-9b07-03fbf4034859","source":"wordfence","cve":"CVE-2025-48168","title":"Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7ee078-e9b1-4583-9b07-03fbf4034859?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio5-html5-shoutcast-sticky","name":"Apollo - Sticky Full Width HTML5 Audio Player","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-21T21:44:50Z"},{"id":"wordfence:2d7feea5-965f-4a07-90f8-39ccdba7b50f","source":"wordfence","cve":"CVE-2020-35943","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 3.4.7 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7feea5-965f-4a07-90f8-39ccdba7b50f?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d833841-2482-4bc5-9b6b-aaab0bbf87ae","source":"wordfence","cve":"CVE-2026-84024","title":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d833841-2482-4bc5-9b6b-aaab0bbf87ae?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:17:12Z"},{"id":"wordfence:2d853bd5-4caa-4b90-a9a6-929fb18b9337","source":"wordfence","cve":"CVE-2016-7168","title":"WordPress Core < 4.6.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d853bd5-4caa-4b90-a9a6-929fb18b9337?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.15","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.15","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.13","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"3.7.16"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"3.7.16"}],"published":"2016-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d8585df-f933-4bd6-a157-56a51d4f8a4a","source":"wordfence","cve":"CVE-2024-1437","title":"Adsmonetizer <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8585df-f933-4bd6-a157-56a51d4f8a4a?source=api-prod","affected":[{"type":"plugin","slug":"adsensei-b30","name":"Adsmonetizer","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-02-26T00:00:00Z","updated":"2024-05-03T19:04:50Z"},{"id":"wordfence:2d89a534-978e-4fd8-be3a-5137bdc22dc9","source":"wordfence","cve":"CVE-2023-5359","title":"W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d89a534-978e-4fd8-be3a-5137bdc22dc9?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T07:30:46Z"},{"id":"wordfence:2d8a0a87-33c9-4cf7-80d9-8f6b4f817786","source":"wordfence","cve":"CVE-2026-122668","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8a0a87-33c9-4cf7-80d9-8f6b4f817786?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-07T09:14:00Z","updated":"2026-11-10T19:54:46Z"},{"id":"wordfence:2d8a619c-d805-49fe-ad6c-a2fd216be84e","source":"wordfence","cve":"CVE-2025-23671","title":"WP OpenSearch <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8a619c-d805-49fe-ad6c-a2fd216be84e?source=api-prod","affected":[{"type":"plugin","slug":"wp-opensearch","name":"WP OpenSearch","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:46:27Z"},{"id":"wordfence:2d8ae431-04cd-49e4-a5ea-ea7b1263c836","source":"wordfence","cve":"","title":"Caulk (Unknown Versions) - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8ae431-04cd-49e4-a5ea-ea7b1263c836?source=api-prod","affected":[{"type":"theme","slug":"caulk","name":"Caulk Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d8b816f-815a-4109-b34b-06e806c765e8","source":"wordfence","cve":"CVE-2025-10173","title":"ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8b816f-815a-4109-b34b-06e806c765e8?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2025-09-25T14:25:59Z","updated":"2025-09-26T03:25:33Z"},{"id":"wordfence:2d8cbc6e-cb75-4d7b-94a5-876c57cf3329","source":"wordfence","cve":"CVE-2024-13117","title":"Social Share Buttons for WordPress <= 2.7 - Missing Authorization to Unauthenticated Image Upload & Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8cbc6e-cb75-4d7b-94a5-876c57cf3329?source=api-prod","affected":[{"type":"plugin","slug":"share-buttons","name":"Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:39:22Z"},{"id":"wordfence:2d8d7a10-8086-48f7-af6f-6abfe7767fbc","source":"wordfence","cve":"CVE-2026-39575","title":"Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8d7a10-8086-48f7-af6f-6abfe7767fbc?source=api-prod","affected":[{"type":"plugin","slug":"post-type-archive-mapping","name":"Custom Query Blocks","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-02-12T00:00:00Z","updated":"2026-04-15T21:30:27Z"},{"id":"wordfence:2d8e037e-c446-44ae-a5ee-bbba938e5edf","source":"wordfence","cve":"CVE-2026-2834","title":"Age Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8e037e-c446-44ae-a5ee-bbba938e5edf?source=api-prod","affected":[{"type":"plugin","slug":"token-of-trust","name":"Age Verification & Identity Verification by Token of Trust","from":"*","from_inclusive":true,"to":"3.32.3","to_inclusive":true,"patched_in":"3.32.4"}],"published":"2026-04-14T11:34:39Z","updated":"2026-04-15T01:25:17Z"},{"id":"wordfence:2d8fdeee-5970-45bb-b29c-c102d46c17ac","source":"wordfence","cve":"CVE-2025-48359","title":"ATT YouTube Widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8fdeee-5970-45bb-b29c-c102d46c17ac?source=api-prod","affected":[{"type":"plugin","slug":"att-youtube","name":"ATT YouTube Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:46:36Z"},{"id":"wordfence:2d903c78-2c7e-45fb-a8b4-ae060d9a020c","source":"wordfence","cve":"CVE-2025-69411","title":"ionCube Tester Plus <= 1.3 - Unauthenticated Arbitrary File Download","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d903c78-2c7e-45fb-a8b4-ae060d9a020c?source=api-prod","affected":[{"type":"plugin","slug":"ioncube-tester-plus","name":"ionCube Tester Plus","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:21:48Z"},{"id":"wordfence:2d90737b-fc4b-45a3-b970-64468e9eb431","source":"wordfence","cve":"","title":"Support Board <= 1.2.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d90737b-fc4b-45a3-b970-64468e9eb431?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2019-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d954a0b-00cd-4666-bd59-f93d78dc38ef","source":"wordfence","cve":"CVE-2026-95807","title":"FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d954a0b-00cd-4666-bd59-f93d78dc38ef?source=api-prod","affected":[{"type":"plugin","slug":"fv-player","name":"FV Player 8","from":"*","from_inclusive":true,"to":"8.1.7","to_inclusive":true,"patched_in":"8.1.8"}],"published":"2026-10-13T15:12:09Z","updated":"2026-10-14T03:40:00Z"},{"id":"wordfence:2d964e1e-6361-435b-8527-e241f5a28b0e","source":"wordfence","cve":"CVE-2021-36830","title":"Comment Guestbook <= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d964e1e-6361-435b-8527-e241f5a28b0e?source=api-prod","affected":[{"type":"plugin","slug":"comment-guestbook","name":"Comment Guestbook","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d97ca8e-e735-4312-bfb2-5c434cb5b190","source":"wordfence","cve":"CVE-2026-16094","title":"Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d97ca8e-e735-4312-bfb2-5c434cb5b190?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliant-recaptcha-for-all-forms","name":"Invisible Anti-Spam & CAPTCHA \u2014 reCAPTCHA Alternative for All Forms","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-15T03:25:59Z"},{"id":"wordfence:2d980542-bc8e-409a-a19c-0c158df6ee95","source":"wordfence","cve":"CVE-2026-18752","title":"Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d980542-bc8e-409a-a19c-0c158df6ee95?source=api-prod","affected":[{"type":"plugin","slug":"wp-persistent-login","name":"Persistent Login","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-08-31T15:56:18Z","updated":"2026-09-01T04:27:49Z"},{"id":"wordfence:2d98419c-b411-4579-8225-c9695d2099e7","source":"wordfence","cve":"CVE-2026-112311","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d98419c-b411-4579-8225-c9695d2099e7?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:35:19Z"},{"id":"wordfence:2d9bf916-cdbf-410b-95bb-ca7ce6658e1b","source":"wordfence","cve":"","title":"StudioZen <= 1.6 - Multiple Vulnerabilities","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9bf916-cdbf-410b-95bb-ca7ce6658e1b?source=api-prod","affected":[{"type":"theme","slug":"studiozen","name":"Studio Zen | Photography Theme for WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c","source":"wordfence","cve":"CVE-2025-13531","title":"Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=api-prod","affected":[{"type":"plugin","slug":"stylish-order-form-builder","name":"Stylish Order Form Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-01-06T20:08:48Z","updated":"2026-07-23T20:30:33Z"},{"id":"wordfence:2d9d3588-9c71-485a-9183-3d1d4a936e03","source":"wordfence","cve":"CVE-2026-15213","title":"Welcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9d3588-9c71-485a-9183-3d1d4a936e03?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.33","to_inclusive":false,"patched_in":"2.11.33"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T17:14:44Z"},{"id":"wordfence:2d9f9774-e45d-4b69-80e0-dce1e7c0ea78","source":"wordfence","cve":"CVE-2024-47359","title":"Depicter Slider <= 3.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9f9774-e45d-4b69-80e0-dce1e7c0ea78?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:37:24Z"},{"id":"wordfence:2da019d3-4aca-485a-aa0c-73728dc1e7c1","source":"wordfence","cve":"CVE-2024-9192","title":"WP Video Robot <= 1.20.0 -  Authenticated (Subscriber+) Privilege Escalation via User Meta Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da019d3-4aca-485a-aa0c-73728dc1e7c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-robot","name":"WordPress Video Robot - The Ultimate Video Importer","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:08:32Z","updated":"2024-11-16T03:20:44Z"},{"id":"wordfence:2da02a0e-4bc5-4dc6-b46e-7e74e0eb36dd","source":"wordfence","cve":"CVE-2022-3194","title":"Dokan <= 3.6.3 - Authenticated (Vendor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da02a0e-4bc5-4dc6-b46e-7e74e0eb36dd?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2022-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2da2c677-505c-4d7f-aaee-89dd8645be2d","source":"wordfence","cve":"CVE-2025-22812","title":"News Ticker Widget for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da2c677-505c-4d7f-aaee-89dd8645be2d?source=api-prod","affected":[{"type":"plugin","slug":"news-ticker-widget-for-elementor","name":"News Ticker Widget for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:02:22Z"},{"id":"wordfence:2da32063-3763-46b5-86ac-91883f9c809b","source":"wordfence","cve":"CVE-2025-58915","title":"Multiple Plugins by eMarket Design <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da32063-3763-46b5-86ac-91883f9c809b?source=api-prod","affected":[{"type":"plugin","slug":"employee-spotlight","name":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"},{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"},{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"},{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T13:24:34Z"},{"id":"wordfence:2da322ea-0206-4838-8ac4-9dd201bb00bc","source":"wordfence","cve":"CVE-2021-4391","title":"Ultimate Gift Cards for WooCommerce <= 2.1.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da322ea-0206-4838-8ac4-9dd201bb00bc?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2da3b5f4-4524-484a-9a91-32867446574a","source":"wordfence","cve":"CVE-2025-30636","title":"Accessibility Suite <= 4.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da3b5f4-4524-484a-9a91-32867446574a?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.19","to_inclusive":true,"patched_in":"4.20"}],"published":"2025-06-05T00:00:00Z","updated":"2026-02-26T15:11:58Z"},{"id":"wordfence:2da595ea-bdd9-4677-ac21-e6cba6f72b09","source":"wordfence","cve":"CVE-2026-81770","title":"MapGeo \u2013 Interactive Geo Maps <= 1.6.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da595ea-bdd9-4677-ac21-e6cba6f72b09?source=api-prod","affected":[{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.6.30","to_inclusive":true,"patched_in":""}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T13:41:24Z"},{"id":"wordfence:2da76c65-2090-43c2-a7ed-7cbd64684e00","source":"wordfence","cve":"CVE-2026-108064","title":"WP Encryption \u2013 One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security < 7.8.8.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da76c65-2090-43c2-a7ed-7cbd64684e00?source=api-prod","affected":[{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"7.8.8.2","to_inclusive":false,"patched_in":"7.8.8.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:37:18Z"},{"id":"wordfence:2da883bf-5741-4eda-8a93-3b7feb90f4c6","source":"wordfence","cve":"CVE-2024-33919","title":"RomethemeKit For Elementor <= 1.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da883bf-5741-4eda-8a93-3b7feb90f4c6?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:36:21Z"},{"id":"wordfence:2da965b1-1f8d-4905-9711-bb9ad30f444a","source":"wordfence","cve":"CVE-2022-0212","title":"SpiderCalendar <= 1.6.64 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da965b1-1f8d-4905-9711-bb9ad30f444a?source=api-prod","affected":[{"type":"plugin","slug":"spider-event-calendar","name":"SpiderCalendar","from":"*","from_inclusive":true,"to":"1.5.65","to_inclusive":true,"patched_in":"1.6.65"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2da9c3d0-7efb-4c34-bf31-2f17a52c21f9","source":"wordfence","cve":"CVE-2014-4561","title":"Local Weather <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2da9c3d0-7efb-4c34-bf31-2f17a52c21f9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-weather-plugin","name":"Local Weather","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dabb790-4f5e-447a-ad65-3f62ac7f6176","source":"wordfence","cve":"CVE-2023-27453","title":"LWS Tools <= 2.3.1 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dabb790-4f5e-447a-ad65-3f62ac7f6176?source=api-prod","affected":[{"type":"plugin","slug":"lws-tools","name":"LWS Tools","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2daddb7a-0ea7-4d11-8699-1982e336120f","source":"wordfence","cve":"CVE-2026-15334","title":"Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2daddb7a-0ea7-4d11-8699-1982e336120f?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-07-23T18:28:29Z","updated":"2026-07-24T06:51:59Z"},{"id":"wordfence:2dae5d7f-d646-49e3-89fa-99c340f272cb","source":"wordfence","cve":"CVE-2026-119495","title":"Better Search \u2013 Relevant search results for WordPress <= 4.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dae5d7f-d646-49e3-89fa-99c340f272cb?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:40:24Z"},{"id":"wordfence:2dae6b53-11f3-432c-ad27-940c429055a2","source":"wordfence","cve":"CVE-2021-24243","title":"WPBakery Page Builder Clipboard <= 4.5.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dae6b53-11f3-432c-ad27-940c429055a2?source=api-prod","affected":[{"type":"plugin","slug":"vc_clipboard","name":"WPBakery Page Builder Clipboard","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":false,"patched_in":"4.5.6"}],"published":"2021-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dae9e8f-6f07-498d-98dd-487f8df8ada9","source":"wordfence","cve":"CVE-2025-49235","title":"RTMKit Addons for Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dae9e8f-6f07-498d-98dd-487f8df8ada9?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:13:56Z"},{"id":"wordfence:2db0b8c9-7908-484d-9a02-1c50f88efdd0","source":"wordfence","cve":"CVE-2024-13474","title":"LTL Freight Quotes \u2013 Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db0b8c9-7908-484d-9a02-1c50f88efdd0?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-purolator-freight-edition","name":"LTL Freight Quotes \u2013 Purolator Edition","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-02-21T16:07:11Z","updated":"2025-02-22T04:21:15Z"},{"id":"wordfence:2db0f9b6-fa03-4dea-b47d-ea070e6d1c4c","source":"wordfence","cve":"","title":"Superlist - Directory WordPress Theme | Directory & Listings <= 2.9.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db0f9b6-fa03-4dea-b47d-ea070e6d1c4c?source=api-prod","affected":[{"type":"theme","slug":"superlist","name":"Superlist - Directory WordPress Theme | Directory & Listings","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2019-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2db15abf-344c-45f1-927d-61ac2647f6be","source":"wordfence","cve":"CVE-2025-30588","title":"Map Contact <= 3.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db15abf-344c-45f1-927d-61ac2647f6be?source=api-prod","affected":[{"type":"plugin","slug":"map-contact","name":"Map Contact","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:03:14Z"},{"id":"wordfence:2db29c12-bf8a-4d5a-b12a-6c74b816d5f0","source":"wordfence","cve":"CVE-2024-12578","title":"Tickera \u2013 WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db29c12-bf8a-4d5a-b12a-6c74b816d5f0?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.4.8","to_inclusive":true,"patched_in":"3.5.4.9"}],"published":"2024-12-13T00:00:00Z","updated":"2025-01-17T16:26:36Z"},{"id":"wordfence:2db386bd-3edc-48ae-9e32-ac57d472ab5b","source":"wordfence","cve":"CVE-2026-120082","title":"GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db386bd-3edc-48ae-9e32-ac57d472ab5b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.200","to_inclusive":true,"patched_in":"2.8.201"}],"published":"2026-11-06T13:48:47Z","updated":"2026-11-07T02:29:13Z"},{"id":"wordfence:2db39ae2-6c44-4a4c-84de-9b7041bece37","source":"wordfence","cve":"CVE-2024-2733","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db39ae2-6c44-4a4c-84de-9b7041bece37?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T03:31:22Z"},{"id":"wordfence:2db4a67d-0b54-4aa7-8d3a-b72fb3ad7f64","source":"wordfence","cve":"CVE-2024-13891","title":"Schedule <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db4a67d-0b54-4aa7-8d3a-b72fb3ad7f64?source=api-prod","affected":[{"type":"plugin","slug":"schedule","name":"Schedule","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-14T16:03:32Z"},{"id":"wordfence:2db4eb1d-3a82-4f0f-b4ff-a291b0289b7f","source":"wordfence","cve":"CVE-2025-12570","title":"Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db4eb1d-3a82-4f0f-b4ff-a291b0289b7f?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-12-11T18:11:57Z","updated":"2025-12-12T06:32:57Z"},{"id":"wordfence:2db8e79f-e70b-421f-8120-7aa65e704deb","source":"wordfence","cve":"","title":"MiwoFTP < 1.0.5 - Arbitrary File Download","severity":"high","cvss":8.6,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2db8e79f-e70b-421f-8120-7aa65e704deb?source=api-prod","affected":[{"type":"plugin","slug":"miwoftp","name":"miwoftp","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2015-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dbae27d-a7a9-4c5d-8b38-0d4d52cdb579","source":"wordfence","cve":"CVE-2025-62055","title":"Academist < 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dbae27d-a7a9-4c5d-8b38-0d4d52cdb579?source=api-prod","affected":[{"type":"theme","slug":"academist","name":"academist","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:45:05Z"},{"id":"wordfence:2dbaf8a7-e3cc-42c1-9f8b-7eb14363cf8c","source":"wordfence","cve":"CVE-2026-23549","title":"WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dbaf8a7-e3cc-42c1-9f8b-7eb14363cf8c?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-25T15:25:56Z"},{"id":"wordfence:2dbdb9bf-c253-49d6-b527-3dfb480875e2","source":"wordfence","cve":"CVE-2026-111832","title":"WP Mailster <= 1.9.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dbdb9bf-c253-49d6-b527-3dfb480875e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.9.1.0","to_inclusive":true,"patched_in":"1.9.2.0"}],"published":"2026-10-19T13:44:48Z","updated":"2026-10-23T18:29:36Z"},{"id":"wordfence:2dbed00f-d971-4673-95b7-950a25f0ba7b","source":"wordfence","cve":"CVE-2025-63035","title":"WPLMS <= 1.9.9.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dbed00f-d971-4673-95b7-950a25f0ba7b?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-11T16:25:46Z"},{"id":"wordfence:2dc1ee93-7d4a-4e93-90dc-5da36bae186f","source":"wordfence","cve":"CVE-2026-89005","title":"WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dc1ee93-7d4a-4e93-90dc-5da36bae186f?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.25","to_inclusive":true,"patched_in":"2.8.26"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:57:11Z"},{"id":"wordfence:2dc1f0c4-32fb-464e-939b-d565a5e1156c","source":"wordfence","cve":"CVE-2025-54030","title":"WooCommerce Google Sheet Connector <= 1.3.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dc1f0c4-32fb-464e-939b-d565a5e1156c?source=api-prod","affected":[{"type":"plugin","slug":"wc-gsheetconnector","name":"GSheetConnector \u2013 WooCommerce Google Sheets Connector, Export Orders & Products to Google Sheets in Real-Time","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:23:04Z"},{"id":"wordfence:2dc616d6-489a-426b-bb52-a0449f907152","source":"wordfence","cve":"CVE-2025-24775","title":"Forms <= 2.9.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dc616d6-489a-426b-bb52-a0449f907152?source=api-prod","affected":[{"type":"plugin","slug":"forms-by-made-it","name":"Forms","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-08-13T00:00:00Z","updated":"2026-05-26T18:16:14Z"},{"id":"wordfence:2dc9c744-6ffb-4d7a-94ce-ba576d7b6d47","source":"wordfence","cve":"CVE-2024-9588","title":"Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dc9c744-6ffb-4d7a-94ce-ba576d7b6d47?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-taxonomy-meta","name":"Category and Taxonomy Meta Fields","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T07:36:33Z"},{"id":"wordfence:2dca6c29-9f05-4d82-90e3-834f1dd8005a","source":"wordfence","cve":"CVE-2024-5977","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dca6c29-9f05-4d82-90e3-834f1dd8005a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2024-07-18T00:00:00Z","updated":"2024-07-19T11:01:41Z"},{"id":"wordfence:2dccdaa8-5095-42c4-9ca8-90fb444c0ae4","source":"wordfence","cve":"CVE-2017-14721","title":"WordPress Core < 4.8.2 - Stored Cross-Site Scripting via Plugin Names","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dccdaa8-5095-42c4-9ca8-90fb444c0ae4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dce3496-e25b-4139-b6d8-dd77d39ad4ee","source":"wordfence","cve":"CVE-2026-119749","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Payment Processing Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dce3496-e25b-4139-b6d8-dd77d39ad4ee?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.62","to_inclusive":true,"patched_in":"2.8.63"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:56:30Z"},{"id":"wordfence:2dce9e9a-a2f3-49a9-a6bc-00328632c654","source":"wordfence","cve":"","title":"Newsletter <= 6.7.6 - Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dce9e9a-a2f3-49a9-a6bc-00328632c654?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"6.7.6","to_inclusive":true,"patched_in":"6.7.7"}],"published":"2020-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dd5c257-8bf4-44bf-8d76-f3f339ed852c","source":"wordfence","cve":"CVE-2025-48251","title":"Additional Custom Emails &amp; Recipients for WooCommerce <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dd5c257-8bf4-44bf-8d76-f3f339ed852c?source=api-prod","affected":[{"type":"plugin","slug":"custom-emails-for-woocommerce","name":"Additional Custom Emails & Recipients for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:42:55Z"},{"id":"wordfence:2dd9df66-92de-4f25-8fdd-cb3bc0e6d529","source":"wordfence","cve":"CVE-2025-31029","title":"replyMail <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dd9df66-92de-4f25-8fdd-cb3bc0e6d529?source=api-prod","affected":[{"type":"plugin","slug":"replymail","name":"replyMail","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-22T20:42:05Z"},{"id":"wordfence:2ddc39a8-57b7-46be-878a-2e1cf3271bd2","source":"wordfence","cve":"CVE-2023-47226","title":"Post Sliders & Post Grids <= 1.0.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ddc39a8-57b7-46be-878a-2e1cf3271bd2?source=api-prod","affected":[{"type":"plugin","slug":"post-slider-carousel","name":"Post Grid & Post Slider \u2013 Carousel, Filter Tabs & Related Posts","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2023-11-03T00:00:00Z","updated":"2024-04-03T14:31:09Z"},{"id":"wordfence:2ddfb494-1a63-4958-849e-392eec09615d","source":"wordfence","cve":"","title":"Formcraft (Unknown Versions) - Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ddfb494-1a63-4958-849e-392eec09615d?source=api-prod","affected":[{"type":"plugin","slug":"formcraft","name":"FormCraft","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2de22728-4f67-406c-9db5-33cbba4c15eb","source":"wordfence","cve":"CVE-2024-11755","title":"IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2de22728-4f67-406c-9db5-33cbba4c15eb?source=api-prod","affected":[{"type":"plugin","slug":"ims-countdown","name":"IMS Countdown","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-12-13T00:00:00Z","updated":"2025-11-07T16:59:10Z"},{"id":"wordfence:2de2624a-3f39-4060-b41c-95a0c114b55c","source":"wordfence","cve":"CVE-2026-42410","title":"TheGem Theme Elements < 5.12.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2de2624a-3f39-4060-b41c-95a0c114b55c?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.12.1.1","to_inclusive":false,"patched_in":"5.12.1.1"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:35:33Z"},{"id":"wordfence:2de2d2c5-1373-45b6-93a0-575713226669","source":"wordfence","cve":"CVE-2023-5062","title":"WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2de2d2c5-1373-45b6-93a0-575713226669?source=api-prod","affected":[{"type":"plugin","slug":"wp-charts","name":"WordPress Charts","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2de5868b-955f-4dc2-abaa-3fed29018169","source":"wordfence","cve":"CVE-2026-42630","title":"Web Plura Backup & Restore \u2013 Local Backups, Restore & Recovery <= 0.2.25 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2de5868b-955f-4dc2-abaa-3fed29018169?source=api-prod","affected":[{"type":"plugin","slug":"web-plura-backup-restore-manager","name":"Web Plura Backup & Restore \u2013 Local Backups, Restore & Recovery","from":"*","from_inclusive":true,"to":"0.2.25","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:28:57Z"},{"id":"wordfence:2de90107-1a7e-4899-ae1e-cb9eeadfe64d","source":"wordfence","cve":"CVE-2024-4384","title":"CSSable Countdown <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2de90107-1a7e-4899-ae1e-cb9eeadfe64d?source=api-prod","affected":[{"type":"plugin","slug":"cssable-countdown","name":"CSSable Countdown","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T19:31:37Z"},{"id":"wordfence:2dea1bcb-14c2-4ec9-8a4d-087bac2db486","source":"wordfence","cve":"CVE-2024-3678","title":"Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dea1bcb-14c2-4ec9-8a4d-087bac2db486?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T07:28:19Z"},{"id":"wordfence:2dee184f-313e-40f8-9208-db51e6b73764","source":"wordfence","cve":"CVE-2025-47692","title":"ContentStudio <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dee184f-313e-40f8-9208-db51e6b73764?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-12-09T17:12:29Z"},{"id":"wordfence:2dee25f3-cbe2-4c30-97db-6cc90157c1a6","source":"wordfence","cve":"CVE-2025-25127","title":"Contact Us By Lord Linus <= 2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dee25f3-cbe2-4c30-97db-6cc90157c1a6?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-by-lord-linus","name":"Contact Us By Lord Linus","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:15:31Z"},{"id":"wordfence:2df059e6-a875-4e65-8cb4-bc409f450c09","source":"wordfence","cve":"CVE-2026-66429","title":"Visitor Traffic Real Time Statistics pro <= 11.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df059e6-a875-4e65-8cb4-bc409f450c09?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.10","to_inclusive":true,"patched_in":"11.11"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:56:02Z"},{"id":"wordfence:2df2312c-56d7-4899-8342-6f6cf62298e0","source":"wordfence","cve":"CVE-2022-0830","title":"FormBuilder <= 1.08 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df2312c-56d7-4899-8342-6f6cf62298e0?source=api-prod","affected":[{"type":"plugin","slug":"formbuilder","name":"FormBuilder","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":true,"patched_in":""}],"published":"2022-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2df2ccd1-3b63-4079-a3ef-10fd868f80d5","source":"wordfence","cve":"CVE-2026-82883","title":"Login With Ajax \u2013 Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df2ccd1-3b63-4079-a3ef-10fd868f80d5?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.6"}],"published":"2026-09-01T00:00:00Z","updated":"2026-11-10T23:19:51Z"},{"id":"wordfence:2df449b4-3f3b-4afc-b391-8d8d11710c07","source":"wordfence","cve":"CVE-2026-15158","title":"Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df449b4-3f3b-4afc-b391-8d8d11710c07?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.46","to_inclusive":true,"patched_in":"2.1.47"}],"published":"2026-07-01T13:28:35Z","updated":"2026-07-09T16:03:28Z"},{"id":"wordfence:2df53b60-c524-4ebd-9a99-ef8e14c140c7","source":"wordfence","cve":"CVE-2026-7661","title":"Bootstrap Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df53b60-c524-4ebd-9a99-ef8e14c140c7?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcode","name":"Bootstrap Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:03:14Z","updated":"2026-05-12T07:48:18Z"},{"id":"wordfence:2df8570b-c1a2-4a1b-b4d4-fe7a75eb05b6","source":"wordfence","cve":"CVE-2024-30463","title":"BEAR <= 1.1.4.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df8570b-c1a2-4a1b-b4d4-fe7a75eb05b6?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4.3","to_inclusive":true,"patched_in":"1.1.4.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:45:42Z"},{"id":"wordfence:2df89ab9-5cc2-46cb-99b2-bc864e960a35","source":"wordfence","cve":"CVE-2018-17573","title":"Wp-Insert <= 2.4.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df89ab9-5cc2-46cb-99b2-bc864e960a35?source=api-prod","affected":[{"type":"plugin","slug":"wp-insert","name":"Wp-Insert","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2018-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2df8ba02-30b0-49af-82cf-a0d2fd994ea2","source":"wordfence","cve":"CVE-2022-3074","title":"Slider Hero <= 8.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2df8ba02-30b0-49af-82cf-a0d2fd994ea2?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2dfd592b-cbe9-460a-8b9a-148058d1bd58","source":"wordfence","cve":"CVE-2026-65443","title":"BackWPup <= 5.7.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dfd592b-cbe9-460a-8b9a-148058d1bd58?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:08:41Z"},{"id":"wordfence:2dfe5dd0-0dc9-4c64-8972-045325e5a54f","source":"wordfence","cve":"CVE-2024-31424","title":"Login with phone number <= 1.6.93 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dfe5dd0-0dc9-4c64-8972-045325e5a54f?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.6.93","to_inclusive":true,"patched_in":"1.6.94"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:57:53Z"},{"id":"wordfence:2dfeeff5-5fcf-445b-af66-33ec873b7e44","source":"wordfence","cve":"CVE-2024-49305","title":"Email Verification for WooCommerce <= 2.8.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2dfeeff5-5fcf-445b-af66-33ec873b7e44?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-24T17:06:16Z"},{"id":"wordfence:2e001cb1-2c50-40dd-83d8-84ec36631c99","source":"wordfence","cve":"CVE-2025-69396","title":"Splendour <= 1.23 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e001cb1-2c50-40dd-83d8-84ec36631c99?source=api-prod","affected":[{"type":"theme","slug":"splendour","name":"Splendour","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:34:33Z"},{"id":"wordfence:2e08e1b5-d388-46cf-a9e7-4bab2a09667f","source":"wordfence","cve":"CVE-2019-16118","title":"Photo Gallery by 10Web <= 1.5.34 -  Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e08e1b5-d388-46cf-a9e7-4bab2a09667f?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.34","to_inclusive":true,"patched_in":"1.5.35"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e093d1f-9c5a-44f8-bc27-9c320e220358","source":"wordfence","cve":"CVE-2023-51692","title":"Customer Reviews for WooCommerce <= 5.38.1 - Missing Authorization via CR_Manual","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e093d1f-9c5a-44f8-bc27-9c320e220358?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.38.1","to_inclusive":true,"patched_in":"5.38.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e0ca51c-0536-45ff-a5af-41ef4977179d","source":"wordfence","cve":"CVE-2022-3227","title":"SearchWP Live Ajax Search <= 1.6.2 - Directory Traversal and Local File Inclusion","severity":"critical","cvss":9.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e0ca51c-0536-45ff-a5af-41ef4977179d?source=api-prod","affected":[{"type":"plugin","slug":"searchwp-live-ajax-search","name":"SearchWP Live Ajax Search","from":"1.0","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e0cde65-f75c-4602-bffe-97b391a428b4","source":"wordfence","cve":"CVE-2024-4863","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e0cde65-f75c-4602-bffe-97b391a428b4?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.38","to_inclusive":true,"patched_in":"3.2.39"}],"published":"2024-06-13T19:34:30Z","updated":"2024-06-14T08:35:35Z"},{"id":"wordfence:2e10e550-735f-4bef-8e58-bcb79c51a5a6","source":"wordfence","cve":"CVE-2021-24736","title":"Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.56 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e10e550-735f-4bef-8e58-bcb79c51a5a6?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.6.57","to_inclusive":false,"patched_in":"1.6.57"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e11227f-87b0-42b2-98a5-555e49d983ad","source":"wordfence","cve":"CVE-2025-23456","title":"EmailShroud <= 2.2.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e11227f-87b0-42b2-98a5-555e49d983ad?source=api-prod","affected":[{"type":"plugin","slug":"emailshroud","name":"EmailShroud","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:58:09Z"},{"id":"wordfence:2e11fc83-8078-4316-be3e-e4eb23e37f5b","source":"wordfence","cve":"CVE-2026-125846","title":"Mazino <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e11fc83-8078-4316-be3e-e4eb23e37f5b?source=api-prod","affected":[{"type":"theme","slug":"mazino","name":"Mazino","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:39Z"},{"id":"wordfence:2e1775fa-fb29-4ed7-8e39-ec834f0e6292","source":"wordfence","cve":"CVE-2026-24566","title":"iNET Webkit <= 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1775fa-fb29-4ed7-8e39-ec834f0e6292?source=api-prod","affected":[{"type":"plugin","slug":"inet-webkit","name":"iNET Webkit","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:11:10Z"},{"id":"wordfence:2e1922c6-e63b-47aa-97de-1e2382fa25d3","source":"wordfence","cve":"CVE-2026-1906","title":"PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1922c6-e63b-47aa-97de-1e2382fa25d3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-02-17T17:18:34Z","updated":"2026-05-12T14:38:46Z"},{"id":"wordfence:2e1a68fb-51c6-4567-9a50-78ed44ccac21","source":"wordfence","cve":"CVE-2022-0499","title":"Sermon Browser <= 0.45.22 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1a68fb-51c6-4567-9a50-78ed44ccac21?source=api-prod","affected":[{"type":"plugin","slug":"sermon-browser","name":"Sermon Browser","from":"*","from_inclusive":true,"to":"0.45.22","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e1ab5a7-0be8-444d-8680-68b3b0be6edf","source":"wordfence","cve":"CVE-2026-66662","title":"Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1ab5a7-0be8-444d-8680-68b3b0be6edf?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.12","to_inclusive":true,"patched_in":"3.29.13"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-17T23:59:53Z"},{"id":"wordfence:2e1bbaa2-5bb3-442e-b4a8-96db98500e7b","source":"wordfence","cve":"CVE-2026-1242","title":"BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1bbaa2-5bb3-442e-b4a8-96db98500e7b?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-09-18T19:07:44Z","updated":"2026-10-01T18:37:57Z"},{"id":"wordfence:2e1ca3b7-e402-40de-bed9-f443e3a7c952","source":"wordfence","cve":"CVE-2025-23605","title":"Call To Action <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1ca3b7-e402-40de-bed9-f443e3a7c952?source=api-prod","affected":[{"type":"plugin","slug":"call-to-action-popup","name":"Call To Action Popup","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T18:03:24Z"},{"id":"wordfence:2e1d1283-3bd9-458e-81ca-9934b293415a","source":"wordfence","cve":"CVE-2024-9270","title":"Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1d1283-3bd9-458e-81ca-9934b293415a?source=api-prod","affected":[{"type":"plugin","slug":"lenxel-core","name":"Lenxel AI LMS \u2013 Course Lesson Generator","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-11-08T14:02:45Z","updated":"2024-12-05T18:27:11Z"},{"id":"wordfence:2e1eb00e-432e-4e40-a758-2451648a8a80","source":"wordfence","cve":"CVE-2025-67911","title":"Newsletters <= 4.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1eb00e-432e-4e40-a758-2451648a8a80?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.11","to_inclusive":true,"patched_in":"4.12"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T14:10:48Z"},{"id":"wordfence:2e1fbd52-32f8-48a3-9f25-2ab33350ee1f","source":"wordfence","cve":"CVE-2025-67473","title":"CWW Companion <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1fbd52-32f8-48a3-9f25-2ab33350ee1f?source=api-prod","affected":[{"type":"plugin","slug":"cww-companion","name":"CWW Companion","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:12:47Z"},{"id":"wordfence:2e20a9d2-4bff-45ba-bffe-af82a7a4328d","source":"wordfence","cve":"CVE-2025-48115","title":"ValidateCertify <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e20a9d2-4bff-45ba-bffe-af82a7a4328d?source=api-prod","affected":[{"type":"plugin","slug":"validar-certificados-de-cursos","name":"ValidateCertify Free","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-05-16T00:00:00Z","updated":"2026-03-17T21:22:43Z"},{"id":"wordfence:2e215a5c-7a01-4a1d-b051-3abf742bf573","source":"wordfence","cve":"CVE-2023-0503","title":"Free WooCommerce Theme 99fy Extension <= 1.2.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e215a5c-7a01-4a1d-b051-3abf742bf573?source=api-prod","affected":[{"type":"plugin","slug":"99fy-core","name":"Free WooCommerce Theme 99fy Extension","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-02-28T00:00:00Z","updated":"2024-10-23T08:37:26Z"},{"id":"wordfence:2e24844d-df8b-42a8-b7ef-4f4e3a9f1aca","source":"wordfence","cve":"CVE-2025-58930","title":"FitFlex <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e24844d-df8b-42a8-b7ef-4f4e3a9f1aca?source=api-prod","affected":[{"type":"theme","slug":"fitflex","name":"FitFlex - Gym & Sports Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:32:56Z"},{"id":"wordfence:2e249525-ba74-4a4c-89f1-6996711c827f","source":"wordfence","cve":"CVE-2026-101138","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes 4.1.19 - 4.1.20 - Missing Authorization to Unauthenticated Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e249525-ba74-4a4c-89f1-6996711c827f?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"4.1.19","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T16:52:30Z"},{"id":"wordfence:2e24da0c-13d2-4a3d-b918-0d28e3341d88","source":"wordfence","cve":"CVE-2024-5432","title":"Lifeline Donation <= 1.2.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e24da0c-13d2-4a3d-b918-0d28e3341d88?source=api-prod","affected":[{"type":"plugin","slug":"lifeline-donation","name":"Lifeline Donation","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T02:08:21Z"},{"id":"wordfence:2e25557d-577b-4ac6-a006-43079ab4b77d","source":"wordfence","cve":"CVE-2026-16988","title":"GeoDirectory <= 2.8.168 - Unauthenticated Pending/Draft Listing Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e25557d-577b-4ac6-a006-43079ab4b77d?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.168","to_inclusive":true,"patched_in":"2.8.169"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:45:10Z"},{"id":"wordfence:2e268dfa-7761-4e52-9e97-288c58d2e5c3","source":"wordfence","cve":"CVE-2024-27998","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e268dfa-7761-4e52-9e97-288c58d2e5c3?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:51:58Z"},{"id":"wordfence:2e27cfff-6763-4e54-af5d-0f4cf23e72f7","source":"wordfence","cve":"CVE-2014-9038","title":"WordPress Core < 4.0.1 - Server-Side Request Forgery","severity":"high","cvss":7.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e27cfff-6763-4e54-af5d-0f4cf23e72f7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e28daa5-cdbb-464c-99d5-09a924c01b41","source":"wordfence","cve":"CVE-2023-0081","title":"MonsterInsights <= 8.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e28daa5-cdbb-464c-99d5-09a924c01b41?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"8.12.0","to_inclusive":true,"patched_in":"8.12.1"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e29a67b-2b67-4cd5-a5ae-a931900c75cd","source":"wordfence","cve":"CVE-2024-5349","title":"LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e29a67b-2b67-4cd5-a5ae-a931900c75cd?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.8.1","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-07-01T16:23:56Z","updated":"2024-07-02T04:31:35Z"},{"id":"wordfence:2e2ab3b3-0d24-4b3d-8668-cc2bcf08d12f","source":"wordfence","cve":"CVE-2026-5191","title":"Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2ab3b3-0d24-4b3d-8668-cc2bcf08d12f?source=api-prod","affected":[{"type":"plugin","slug":"tiled-gallery-carousel-without-jetpack","name":"Tiled Gallery Carousel Without JetPack","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:48:31Z","updated":"2026-06-02T08:28:35Z"},{"id":"wordfence:2e2d54eb-c176-49c4-a4fc-833e17189cad","source":"wordfence","cve":"CVE-2023-6923","title":"Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=api-prod","affected":[{"type":"plugin","slug":"matomo","name":"Matomo Analytics \u2013 Powerful, Privacy-First Insights for WordPress","from":"*","from_inclusive":true,"to":"4.15.3","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:36:06Z"},{"id":"wordfence:2e3194a7-5b3d-4805-9a35-50ebe65aa6ae","source":"wordfence","cve":"CVE-2014-4726","title":"MailPoet Newsletters <= 2.6.7 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3194a7-5b3d-4805-9a35-50ebe65aa6ae?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2014-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e329432-c404-4312-969b-42cac345637d","source":"wordfence","cve":"","title":"UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e329432-c404-4312-969b-42cac345637d?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"1.22.14","from_inclusive":true,"to":"1.23.2","to_inclusive":true,"patched_in":"1.23.3"},{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"2.22.14","from_inclusive":true,"to":"2.23.2","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e32c51d-2d96-4545-956f-64f65c54b33b","source":"wordfence","cve":"CVE-2023-7069","title":"Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e32c51d-2d96-4545-956f-64f65c54b33b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2023.10","to_inclusive":true,"patched_in":"2024.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-07-29T21:36:06Z"},{"id":"wordfence:2e3358a9-3e73-4ee5-9426-8d8fc01739fe","source":"wordfence","cve":"CVE-2025-54684","title":"Integration for Contact Form 7 and Constant Contact <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3358a9-3e73-4ee5-9426-8d8fc01739fe?source=api-prod","affected":[{"type":"plugin","slug":"cf7-constant-contact","name":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:10:49Z"},{"id":"wordfence:2e33da10-321b-4227-ba3c-15ab38177796","source":"wordfence","cve":"CVE-2026-84099","title":"IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e33da10-321b-4227-ba3c-15ab38177796?source=api-prod","affected":[{"type":"plugin","slug":"wpstorecart","name":"IDB Ecommerce (wpStoreCart 5)","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:55:18Z"},{"id":"wordfence:2e33feec-43f6-46c2-b287-752254822f4f","source":"wordfence","cve":"CVE-2026-48093","title":"Code Embed <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e33feec-43f6-46c2-b287-752254822f4f?source=api-prod","affected":[{"type":"plugin","slug":"simple-embed-code","name":"Code Embed","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-09-16T18:19:43Z"},{"id":"wordfence:2e3897fb-0f40-4111-8a7d-60415e1f9f96","source":"wordfence","cve":"CVE-2025-2104","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3897fb-0f40-4111-8a7d-60415e1f9f96?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T04:21:05Z"},{"id":"wordfence:2e3e3b0d-21cb-4b19-ba14-580b3d2802ab","source":"wordfence","cve":"CVE-2025-60126","title":"Testimonial Slider <= 3.5.8.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3e3b0d-21cb-4b19-ba14-580b3d2802ab?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-add","name":"Testimonial Slider \u2013 Free Testimonials Slider Plugin","from":"*","from_inclusive":true,"to":"3.5.8.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:18:33Z"},{"id":"wordfence:2e3f4e10-b440-4000-97be-6ccab20494b1","source":"wordfence","cve":"CVE-2026-94175","title":"All In One Login <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e3f4e10-b440-4000-97be-6ccab20494b1?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-admin-login","name":"All In One Login","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-10-30T09:05:41Z","updated":"2026-11-03T20:14:00Z"},{"id":"wordfence:2e405c91-e382-45d0-b01f-37774beeaf8b","source":"wordfence","cve":"CVE-2024-6529","title":"Ultimate Classified Listings <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e405c91-e382-45d0-b01f-37774beeaf8b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-15T20:10:24Z"},{"id":"wordfence:2e41eaf6-bb59-41a5-9c19-c119528287e9","source":"wordfence","cve":"CVE-2025-54678","title":"Easy Form Builder <= 3.8.15 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e41eaf6-bb59-41a5-9c19-c119528287e9?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.8.15","to_inclusive":true,"patched_in":"3.8.16"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:52:04Z"},{"id":"wordfence:2e426151-a8cb-48b9-9fa4-170fc3371629","source":"wordfence","cve":"CVE-2026-95817","title":"DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e426151-a8cb-48b9-9fa4-170fc3371629?source=api-prod","affected":[{"type":"plugin","slug":"dofollow-case-by-case","name":"DoFollow Case by Case","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-10-01T18:52:42Z","updated":"2026-10-02T07:39:22Z"},{"id":"wordfence:2e42dd1c-adf7-471a-a14a-9038c56413a2","source":"wordfence","cve":"CVE-2024-2261","title":"Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e42dd1c-adf7-471a-a14a-9038c56413a2?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.8.3"}],"published":"2024-03-26T00:00:00Z","updated":"2024-07-31T15:48:13Z"},{"id":"wordfence:2e43b327-c141-480e-a5b2-bba179b3e0a1","source":"wordfence","cve":"CVE-2021-25091","title":"Link Library <= 7.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e43b327-c141-480e-a5b2-bba179b3e0a1?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.2.8","to_inclusive":true,"patched_in":"7.2.9"}],"published":"2021-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e45ac7f-faab-4004-8c1b-b9b68f9dfe4c","source":"wordfence","cve":"CVE-2021-24257","title":"Premium Addons for Elementor <=4.2.7 Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e45ac7f-faab-4004-8c1b-b9b68f9dfe4c?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":false,"patched_in":"4.2.8"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e470017-c453-435d-8342-66874a794537","source":"wordfence","cve":"CVE-2024-10321","title":"All-in-One Addons for Elementor \u2013 WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e470017-c453-435d-8342-66874a794537?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T00:00:00Z","updated":"2025-07-24T19:00:34Z"},{"id":"wordfence:2e488a0e-2d60-4f16-9829-d014b0893671","source":"wordfence","cve":"CVE-2025-49310","title":"Frontend Dashboard <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e488a0e-2d60-4f16-9829-d014b0893671?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:57:13Z"},{"id":"wordfence:2e4a9e9a-7bdc-4f51-ac3f-d6627b4f62c7","source":"wordfence","cve":"CVE-2026-18405","title":"Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e4a9e9a-7bdc-4f51-ac3f-d6627b4f62c7?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":true,"patched_in":"3.2.17"}],"published":"2026-09-17T20:54:11Z","updated":"2026-09-18T09:28:00Z"},{"id":"wordfence:2e5602b2-c1ed-40a5-8186-3ab1b5e32f7f","source":"wordfence","cve":"CVE-2025-69001","title":"FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e5602b2-c1ed-40a5-8186-3ab1b5e32f7f?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.11","to_inclusive":true,"patched_in":"6.1.12"}],"published":"2026-01-13T00:00:00Z","updated":"2026-02-03T20:57:03Z"},{"id":"wordfence:2e56e810-3884-4d2c-85c5-7d4ec8e27652","source":"wordfence","cve":"CVE-2026-13328","title":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce < 6.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e56e810-3884-4d2c-85c5-7d4ec8e27652?source=api-prod","affected":[{"type":"plugin","slug":"tlp-food-menu","name":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":false,"patched_in":"6.0.2"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:45:09Z"},{"id":"wordfence:2e5b3595-932c-4a42-b340-f162b29f69ee","source":"wordfence","cve":"CVE-2025-30520","title":"Breezing Forms <= 1.2.8.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e5b3595-932c-4a42-b340-f162b29f69ee?source=api-prod","affected":[{"type":"plugin","slug":"breezing-forms","name":"Breezing Forms","from":"*","from_inclusive":true,"to":"1.2.8.11","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:27:53Z"},{"id":"wordfence:2e5eee1d-4e0a-4ec2-93ff-86f0b3942ae2","source":"wordfence","cve":"CVE-2024-47331","title":"Multi Step for Contact Form <= 2.7.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e5eee1d-4e0a-4ec2-93ff-86f0b3942ae2?source=api-prod","affected":[{"type":"plugin","slug":"cf7-multi-step","name":"Multi Step for Contact Form 7","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:11:05Z"},{"id":"wordfence:2e5fdaae-3ef2-477e-b79b-0b6e415edb40","source":"wordfence","cve":"CVE-2023-52195","title":"Posts to Page <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e5fdaae-3ef2-477e-b79b-0b6e415edb40?source=api-prod","affected":[{"type":"plugin","slug":"posts-to-page","name":"Posts to Page","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e602223-8571-42e1-9b3f-e7cc51f8fa58","source":"wordfence","cve":"CVE-2026-3489","title":"DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e602223-8571-42e1-9b3f-e7cc51f8fa58?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.26","to_inclusive":true,"patched_in":"3.6.27"}],"published":"2026-04-15T21:35:44Z","updated":"2026-04-16T11:21:21Z"},{"id":"wordfence:2e61489d-a433-4d44-bb12-8c84204922b9","source":"wordfence","cve":"CVE-2025-14548","title":"Calendar <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e61489d-a433-4d44-bb12-8c84204922b9?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":"1.3.17"}],"published":"2025-12-22T00:00:00Z","updated":"2025-12-23T09:20:02Z"},{"id":"wordfence:2e617d6f-c1cb-4cac-88e2-3142c1ea9fab","source":"wordfence","cve":"CVE-2024-39645","title":"Tutor LMS <= 2.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e617d6f-c1cb-4cac-88e2-3142c1ea9fab?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:31:29Z"},{"id":"wordfence:2e61942e-15ea-468c-b71a-50396d5b2730","source":"wordfence","cve":"CVE-2018-5669","title":"Read and Understood < 2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e61942e-15ea-468c-b71a-50396d5b2730?source=api-prod","affected":[{"type":"plugin","slug":"read-and-understood","name":"Read and Understood","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2018-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e62781e-4e35-479b-ad2f-617a679f180f","source":"wordfence","cve":"CVE-2025-32311","title":"Pressroom - News Magazine WordPress Theme <= 7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e62781e-4e35-479b-ad2f-617a679f180f?source=api-prod","affected":[{"type":"theme","slug":"pressroom","name":"Pressroom - News Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1"}],"published":"2025-06-26T00:00:00Z","updated":"2026-03-17T21:24:39Z"},{"id":"wordfence:2e627cf8-057b-4f1d-b3db-cea8ee63b947","source":"wordfence","cve":"CVE-2024-51875","title":"MDC YouTube Downloader <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e627cf8-057b-4f1d-b3db-cea8ee63b947?source=api-prod","affected":[{"type":"plugin","slug":"mdc-youtube-downloader","name":"MDC YouTube Downloader","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:43:07Z"},{"id":"wordfence:2e63c0fb-7fe7-42f7-8fa9-ec159d3c8117","source":"wordfence","cve":"CVE-2024-10787","title":"LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e63c0fb-7fe7-42f7-8fa9-ec159d3c8117?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T08:22:47Z"},{"id":"wordfence:2e680ed2-36a9-4ca4-8865-4ce58bf8f5d6","source":"wordfence","cve":"","title":"Contact Bank <= 2.0.225 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e680ed2-36a9-4ca4-8865-4ce58bf8f5d6?source=api-prod","affected":[{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.226","to_inclusive":false,"patched_in":"2.0.226"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e69254d-d9e4-4b9e-972e-30bb6de86776","source":"wordfence","cve":"CVE-2017-18577","title":"Mailchimp For WP <= 4.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e69254d-d9e4-4b9e-972e-30bb6de86776?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2017-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e69d666-50de-4c82-9ad4-9ed40fcc7218","source":"wordfence","cve":"CVE-2024-7426","title":"Community by PeepSo \u2013 Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e69d666-50de-4c82-9ad4-9ed40fcc7218?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.4.6.0","to_inclusive":true,"patched_in":"6.4.6.1"}],"published":"2024-09-24T12:05:55Z","updated":"2024-09-30T14:07:44Z"},{"id":"wordfence:2e6a78dc-9b67-4ab5-83f9-be82d05d3a13","source":"wordfence","cve":"CVE-2023-25698","title":"Shoppable Images <= 1.2.3 - Cross Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e6a78dc-9b67-4ab5-83f9-be82d05d3a13?source=api-prod","affected":[{"type":"plugin","slug":"mabel-shoppable-images-lite","name":"Shoppable Images (Lookbook) for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e6bd1d4-25ba-4475-8840-06f3d614d6d7","source":"wordfence","cve":"CVE-2024-22148","title":"WP Smart Editor  <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e6bd1d4-25ba-4475-8840-06f3d614d6d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-editor","name":"WP Smart Editor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-15T00:00:00Z","updated":"2024-02-06T13:36:57Z"},{"id":"wordfence:2e6c60bb-d7c9-4925-afbe-00ea847d1f0b","source":"wordfence","cve":"CVE-2025-60206","title":"Alone <= 7.8.3 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e6c60bb-d7c9-4925-afbe-00ea847d1f0b?source=api-prod","affected":[{"type":"theme","slug":"alone","name":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme","from":"*","from_inclusive":true,"to":"7.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-16T00:00:00Z","updated":"2025-11-04T16:35:22Z"},{"id":"wordfence:2e6d30c9-a759-41b3-8509-f49b89f8d802","source":"wordfence","cve":"CVE-2025-63029","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e6d30c9-a759-41b3-8509-f49b89f8d802?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2026-04-15T00:00:00Z","updated":"2026-06-18T18:26:14Z"},{"id":"wordfence:2e6fe647-d243-43ba-b619-d181560cb230","source":"wordfence","cve":"CVE-2024-32815","title":"All-in-one Like Widget <= 2.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e6fe647-d243-43ba-b619-d181560cb230?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-facebook-like-widget","name":"All-in-one Like Widget","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:57:08Z"},{"id":"wordfence:2e706174-ff6a-4093-af36-bac55097df50","source":"wordfence","cve":"CVE-2026-85017","title":"Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e706174-ff6a-4093-af36-bac55097df50?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:39:51Z"},{"id":"wordfence:2e718554-1096-4a16-968d-f00b65e1361d","source":"wordfence","cve":"CVE-2024-5263","title":"ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e718554-1096-4a16-968d-f00b65e1361d?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-06-14T12:08:02Z","updated":"2024-06-15T02:01:59Z"},{"id":"wordfence:2e78a4dd-af96-4317-aee4-9aae4fd6c066","source":"wordfence","cve":"CVE-2025-57969","title":"Hide WP Toolbar <= 2.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78a4dd-af96-4317-aee4-9aae4fd6c066?source=api-prod","affected":[{"type":"plugin","slug":"hide-wp-toolbar","name":"Hide WP Toolbar","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:07:26Z"},{"id":"wordfence:2e78bcfd-9764-49ae-9cac-cbc5419a0aa5","source":"wordfence","cve":"CVE-2026-48865","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78bcfd-9764-49ae-9cac-cbc5419a0aa5?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-01T16:18:04Z"},{"id":"wordfence:2e78c759-4a54-4ee4-8eff-df91fe9dad46","source":"wordfence","cve":"CVE-2023-3958","title":"WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46?source=api-prod","affected":[{"type":"plugin","slug":"wp-remote-users-sync","name":"WP Remote Users Sync","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2023-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e78cb46-7964-4ba5-b9bf-d47de865dbd2","source":"wordfence","cve":"CVE-2026-59541","title":"WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78cb46-7964-4ba5-b9bf-d47de865dbd2?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:39:31Z"},{"id":"wordfence:2e79835c-9df6-410a-88f5-1cadfada7419","source":"wordfence","cve":"CVE-2026-84221","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e79835c-9df6-410a-88f5-1cadfada7419?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.0.0","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:19:21Z"},{"id":"wordfence:2e798eea-786a-43e2-b535-842ca666ff0f","source":"wordfence","cve":"CVE-2026-24534","title":"Booter <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e798eea-786a-43e2-b535-842ca666ff0f?source=api-prod","affected":[{"type":"plugin","slug":"booter-bots-crawlers-manager","name":"Booter \u2013 Bots & Crawlers Manager","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-25T14:38:38Z"},{"id":"wordfence:2e79b6b2-b227-44a4-85e3-6859c4f6f972","source":"wordfence","cve":"CVE-2025-32600","title":"Tournamatch <= 4.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e79b6b2-b227-44a4-85e3-6859c4f6f972?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-21T13:38:13Z"},{"id":"wordfence:2e7a78e1-8c1a-4fb4-9959-d8fb7f9ee917","source":"wordfence","cve":"CVE-2022-0449","title":"Flexi - Guest Submit  < 4.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7a78e1-8c1a-4fb4-9959-d8fb7f9ee917?source=api-prod","affected":[{"type":"plugin","slug":"flexi","name":"Flexi \u2013 Guest Submit","from":"*","from_inclusive":true,"to":"4.20","to_inclusive":false,"patched_in":"4.20"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e7aed9e-1b56-4ce6-b338-1d9ab80594c3","source":"wordfence","cve":"CVE-2026-8613","title":"aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7aed9e-1b56-4ce6-b338-1d9ab80594c3?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-06-09T18:49:29Z","updated":"2026-06-10T07:50:56Z"},{"id":"wordfence:2e7afe50-6c62-4c86-8633-f14f8e9412e2","source":"wordfence","cve":"CVE-2024-49225","title":"wpPricing Builder <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7afe50-6c62-4c86-8633-f14f8e9412e2?source=api-prod","affected":[{"type":"plugin","slug":"wppricing-builder-lite-responsive-pricing-table-builder","name":"Responsive Pricing Table Builder \u2013 wpPricing Builder","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:11:26Z"},{"id":"wordfence:2e7b6ef6-1238-4987-a7ad-dd19bb055b80","source":"wordfence","cve":"CVE-2025-23475","title":"History timeline <= 0.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7b6ef6-1238-4987-a7ad-dd19bb055b80?source=api-prod","affected":[{"type":"plugin","slug":"history-timeline","name":"History timeline","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-02-14T15:31:58Z"},{"id":"wordfence:2e7d5503-0a6e-4611-bb7c-b2871be828be","source":"wordfence","cve":"CVE-2024-8276","title":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7d5503-0a6e-4611-bb7c-b2871be828be?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-portfolio","name":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-08-30T19:36:29Z","updated":"2024-08-31T07:36:54Z"},{"id":"wordfence:2e7ebc0c-6936-4632-a602-7131c7d8bd6a","source":"wordfence","cve":"CVE-2024-1686","title":"Thank You Page Customizer for WooCommerce \u2013 Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e7ebc0c-6936-4632-a602-7131c7d8bd6a?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-02-26T00:00:00Z","updated":"2024-10-24T18:47:07Z"},{"id":"wordfence:2e806895-40c9-44f5-97f8-becfa52c2559","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'notice' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e806895-40c9-44f5-97f8-becfa52c2559?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e81e1ff-1223-4537-8f0f-494658affffc","source":"wordfence","cve":"CVE-2025-63005","title":"Tooltips <= 10.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e81e1ff-1223-4537-8f0f-494658affffc?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-tooltips","name":"Tooltips for WordPress","from":"*","from_inclusive":true,"to":"10.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:39:06Z"},{"id":"wordfence:2e82081e-17de-4394-9e46-0541090fbd7f","source":"wordfence","cve":"CVE-2024-12874","title":"Top Comments <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e82081e-17de-4394-9e46-0541090fbd7f?source=api-prod","affected":[{"type":"plugin","slug":"top-comments","name":"Top Comments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-02T00:00:00Z","updated":"2025-01-09T14:27:29Z"},{"id":"wordfence:2e82478c-e476-4cdf-ab72-f578331058e2","source":"wordfence","cve":"CVE-2024-4618","title":"Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e82478c-e476-4cdf-ab72-f578331058e2?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.6","to_inclusive":true,"patched_in":"2.6.9.7"}],"published":"2024-05-14T12:34:47Z","updated":"2024-05-15T01:56:54Z"},{"id":"wordfence:2e83e654-f8a6-44a6-a687-92606331309e","source":"wordfence","cve":"CVE-2026-107622","title":"BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e83e654-f8a6-44a6-a687-92606331309e?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.6"}],"published":"2026-11-05T22:00:13Z","updated":"2026-11-06T11:17:36Z"},{"id":"wordfence:2e840f76-1b46-452e-bd63-507cbab779b9","source":"wordfence","cve":"CVE-2025-9018","title":"Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e840f76-1b46-452e-bd63-507cbab779b9?source=api-prod","affected":[{"type":"plugin","slug":"time-tracker","name":"Time Tracker","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-09-10T22:20:07Z","updated":"2025-09-11T11:15:04Z"},{"id":"wordfence:2e842051-3820-4538-a359-ab4e1ed3822d","source":"wordfence","cve":"CVE-2026-61994","title":"WP-Members Membership Plugin <= 3.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e842051-3820-4538-a359-ab4e1ed3822d?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-10-12T17:51:00Z","updated":"2026-10-28T21:20:44Z"},{"id":"wordfence:2e84a1ca-fc82-46bc-a484-89f1235988e8","source":"wordfence","cve":"CVE-2025-5305","title":"Password Reset with Code <= 0.0.16 - Unauthenticated Privilege Escalation via Weak OTP Codes","severity":"high","cvss":8.1,"cwe":"CWE-326","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e84a1ca-fc82-46bc-a484-89f1235988e8?source=api-prod","affected":[{"type":"plugin","slug":"bdvs-password-reset","name":"Password Reset with Code for WordPress REST API","from":"*","from_inclusive":true,"to":"0.0.16","to_inclusive":true,"patched_in":"0.0.17"}],"published":"2025-08-28T00:00:00Z","updated":"2025-09-25T19:50:19Z"},{"id":"wordfence:2e8527c0-a4b0-436d-901a-c07f93c7ec5e","source":"wordfence","cve":"CVE-2024-11369","title":"Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e8527c0-a4b0-436d-901a-c07f93c7ec5e?source=api-prod","affected":[{"type":"plugin","slug":"store-credit-for-woocommerce","name":"Store credit / Gift cards for woocommerce","from":"*","from_inclusive":true,"to":"1.0.49.46","to_inclusive":true,"patched_in":"1.0.49.47"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T05:23:53Z"},{"id":"wordfence:2e87cfc4-8e7c-47d6-80fc-9c293cdd8acb","source":"wordfence","cve":"CVE-2023-4374","title":"WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e87cfc4-8e7c-47d6-80fc-9c293cdd8acb?source=api-prod","affected":[{"type":"plugin","slug":"wp-remote-users-sync","name":"WP Remote Users Sync","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2023-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e889182-f02f-4b6b-bb98-357fadae3dc1","source":"wordfence","cve":"CVE-2022-23979","title":"Ultimate Reviews <= 3.0.15 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e889182-f02f-4b6b-bb98-357fadae3dc1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-reviews","name":"Ultimate Reviews","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":true,"patched_in":"3.0.16"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e88aa9e-6d1d-44ba-8d63-2f4d4161bc9e","source":"wordfence","cve":"","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more < 3.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e88aa9e-6d1d-44ba-8d63-2f4d4161bc9e?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2015-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e895698-30dd-4703-b085-e9e7ad1ec1e1","source":"wordfence","cve":"CVE-2024-51698","title":"Master Bar <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e895698-30dd-4703-b085-e9e7ad1ec1e1?source=api-prod","affected":[{"type":"plugin","slug":"master-bar","name":"Master Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:34:50Z"},{"id":"wordfence:2e8abe63-c11b-48e7-8867-3bc1ab940b1f","source":"wordfence","cve":"CVE-2014-5196","title":"Improved User Search in Backend <= 1.2.5 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e8abe63-c11b-48e7-8867-3bc1ab940b1f?source=api-prod","affected":[{"type":"plugin","slug":"improved-user-search-in-backend","name":"Improved user search in backend","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2014-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e8da71c-bf53-4795-a689-5823d963cb82","source":"wordfence","cve":"CVE-2026-24544","title":"HD Quiz <= 2.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e8da71c-bf53-4795-a689-5823d963cb82?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz","name":"HD Quiz","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2026-01-24T00:00:00Z","updated":"2026-01-30T20:45:07Z"},{"id":"wordfence:2e8f224c-cd22-4926-be24-9da2f22afa50","source":"wordfence","cve":"","title":"WPML String Translation <= 3.2.5 - Authenticated (Administrator+) SQL Injection via 'context'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e8f224c-cd22-4926-be24-9da2f22afa50?source=api-prod","affected":[{"type":"plugin","slug":"wpml-string-translation","name":"WPML String Translation","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2023-07-24T00:00:00Z","updated":"2024-04-12T20:02:00Z"},{"id":"wordfence:2e90f61b-a74b-4f9f-a8ba-ea9ba3fa9987","source":"wordfence","cve":"CVE-2026-22479","title":"Easy Post Submission \u2013 Frontend Posting, Guest Publishing & Submit Content for WordPress <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e90f61b-a74b-4f9f-a8ba-ea9ba3fa9987?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-submission","name":"Easy Post Submission \u2013 Frontend Posting, Guest Publishing & Submit Content for WordPress","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-03-04T00:00:00Z","updated":"2026-04-15T13:55:18Z"},{"id":"wordfence:2e9142b2-2935-4644-8c56-00789948202b","source":"wordfence","cve":"CVE-2024-11689","title":"HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9142b2-2935-4644-8c56-00789948202b?source=api-prod","affected":[{"type":"plugin","slug":"hq-rental-software","name":"HQ Rental Software","from":"*","from_inclusive":true,"to":"1.5.29","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:15:47Z","updated":"2024-12-12T03:23:06Z"},{"id":"wordfence:2e9291e8-b4f5-4fd1-aded-4690f82f6905","source":"wordfence","cve":"CVE-2022-35275","title":"Advanced Order Export For WooCommerce <= 3.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9291e8-b4f5-4fd1-aded-4690f82f6905?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e933356-1faf-4766-9554-aad618052d83","source":"wordfence","cve":"CVE-2025-66072","title":"UsersWP <= 1.2.47 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e933356-1faf-4766-9554-aad618052d83?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.47","to_inclusive":true,"patched_in":"1.2.48"}],"published":"2025-11-25T00:00:00Z","updated":"2025-12-01T17:31:11Z"},{"id":"wordfence:2e936214-ee25-4763-ba7a-b5308cc09a57","source":"wordfence","cve":"CVE-2024-12189","title":"WDesignKit \u2013 Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e936214-ee25-4763-ba7a-b5308cc09a57?source=api-prod","affected":[{"type":"plugin","slug":"wdesignkit","name":"WDesignKit \u2013 AI Website Builder for WordPress with MCP & AI Widget Builder","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-03-31T17:47:28Z","updated":"2025-04-18T17:48:30Z"},{"id":"wordfence:2e93efec-371c-4050-b24b-e5e978059549","source":"wordfence","cve":"CVE-2023-47851","title":"Bootstrap Shortcodes Ultimate <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e93efec-371c-4050-b24b-e5e978059549?source=api-prod","affected":[{"type":"plugin","slug":"bs-shortcode-ultimate","name":"Bootstrap Shortcodes Ultimate","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2e9463de-a9ea-4702-8c46-b2e99b18cef0","source":"wordfence","cve":"CVE-2026-42643","title":"Image Widget <= 4.4.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9463de-a9ea-4702-8c46-b2e99b18cef0?source=api-prod","affected":[{"type":"plugin","slug":"image-widget","name":"Image Widget","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2026-03-17T00:00:00Z","updated":"2026-05-07T13:48:28Z"},{"id":"wordfence:2e9bee86-f491-4f68-b10b-051e0fb1a67b","source":"wordfence","cve":"CVE-2023-7288","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference'","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9bee86-f491-4f68-b10b-051e0fb1a67b?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:26Z"},{"id":"wordfence:2e9d7776-aa96-47c8-9e31-5484ab65bc66","source":"wordfence","cve":"CVE-2023-39161","title":"Discussion Board <= 2.4.8 - Authenticated (Subscriber+) Content Injection","severity":"medium","cvss":5.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2e9d7776-aa96-47c8-9e31-5484ab65bc66?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ea06520-d7a9-49bb-812e-2fa2e50d0ec2","source":"wordfence","cve":"CVE-2025-12560","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea06520-d7a9-49bb-812e-2fa2e50d0ec2?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.6.0","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2025-11-05T17:30:36Z","updated":"2026-03-27T11:01:55Z"},{"id":"wordfence:2ea32997-9fe3-4f31-9c3a-28bc14af3713","source":"wordfence","cve":"CVE-2025-64632","title":"Google XML Sitemaps <= 4.1.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea32997-9fe3-4f31-9c3a-28bc14af3713?source=api-prod","affected":[{"type":"plugin","slug":"google-sitemap-generator","name":"XML Sitemap Generator for Google","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"4.1.23"}],"published":"2025-10-31T00:00:00Z","updated":"2026-02-09T16:03:24Z"},{"id":"wordfence:2ea5c0e4-afee-4fbd-8b2e-9befd16c7935","source":"wordfence","cve":"CVE-2026-42762","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea5c0e4-afee-4fbd-8b2e-9befd16c7935?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:53:16Z"},{"id":"wordfence:2ea71d63-27ce-4f24-b3ef-de38e6f25e0d","source":"wordfence","cve":"CVE-2023-28695","title":"VigilanTor <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea71d63-27ce-4f24-b3ef-de38e6f25e0d?source=api-prod","affected":[{"type":"plugin","slug":"vigilantor","name":"VigilanTor","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ea89c44-8ed0-4ab7-a049-4d1b03a898c7","source":"wordfence","cve":"CVE-2026-1829","title":"Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea89c44-8ed0-4ab7-a049-4d1b03a898c7?source=api-prod","affected":[{"type":"plugin","slug":"content-visibility-for-divi-builder","name":"Content Visibility for Divi Builder","from":"*","from_inclusive":true,"to":"4.02","to_inclusive":true,"patched_in":"5.00"}],"published":"2026-06-02T05:02:06Z","updated":"2026-06-02T17:28:25Z"},{"id":"wordfence:2ea8d38a-f5ce-40dd-a015-f56d60579e05","source":"wordfence","cve":"CVE-2026-1857","title":"Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea8d38a-f5ce-40dd-a015-f56d60579e05?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-02-17T17:38:45Z","updated":"2026-02-18T06:42:40Z"},{"id":"wordfence:2ea91f5d-338e-4924-8c51-3d6fe9293216","source":"wordfence","cve":"CVE-2026-97307","title":"Cost Calculator Builder <= 4.0.17 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea91f5d-338e-4924-8c51-3d6fe9293216?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"4.0.18"}],"published":"2026-10-02T09:02:03Z","updated":"2026-10-09T00:17:56Z"},{"id":"wordfence:2eaa5a5c-c11f-40d0-be69-c3ec8029a819","source":"wordfence","cve":"CVE-2025-12539","title":"TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover","severity":"critical","cvss":10.0,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaa5a5c-c11f-40d0-be69-c3ec8029a819?source=api-prod","affected":[{"type":"plugin","slug":"tnc-toolbox","name":"TNC Toolbox: Web Performance","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-11-10T22:27:47Z","updated":"2025-11-11T11:03:44Z"},{"id":"wordfence:2eac991e-fc34-456c-a9a6-d30fde39fd42","source":"wordfence","cve":"CVE-2023-52207","title":"HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eac991e-fc34-456c-a9a6-d30fde39fd42?source=api-prod","affected":[{"type":"plugin","slug":"html5-mp3-player-with-playlist","name":"HTML5 MP3 Player with Playlist Free","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2eae7c33-2347-4b34-8b5f-7f4a6ee3e9c1","source":"wordfence","cve":"CVE-2023-41796","title":"Sunshine Photo Cart <= 2.9.25 - Insecure Direct Object Reference to Order Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eae7c33-2347-4b34-8b5f-7f4a6ee3e9c1?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.9.25","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2eaebf25-905c-4a57-96d4-5c3ebbd77b98","source":"wordfence","cve":"CVE-2025-10179","title":"My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eaebf25-905c-4a57-96d4-5c3ebbd77b98?source=api-prod","affected":[{"type":"plugin","slug":"my-askai","name":"My AskAI","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:22:03Z","updated":"2025-09-30T03:35:24Z"},{"id":"wordfence:2eafe150-2178-4355-88a8-67687bd446e4","source":"wordfence","cve":"CVE-2026-10737","title":"SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eafe150-2178-4355-88a8-67687bd446e4?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.71","to_inclusive":true,"patched_in":""}],"published":"2026-06-03T13:01:35Z","updated":"2026-06-04T01:26:44Z"},{"id":"wordfence:2eb2adf2-127a-48cc-8908-8413f81ccf14","source":"wordfence","cve":"CVE-2025-47607","title":"Show All Comments <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb2adf2-127a-48cc-8908-8413f81ccf14?source=api-prod","affected":[{"type":"plugin","slug":"show-all-comments-in-one-page","name":"Show All Comments","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:25:34Z"},{"id":"wordfence:2eb3b568-8689-4184-8091-0b84aa6b472d","source":"wordfence","cve":"CVE-2023-44987","title":"Timely Booking Button <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb3b568-8689-4184-8091-0b84aa6b472d?source=api-prod","affected":[{"type":"plugin","slug":"timely-booking-button","name":"Timely Booking Button","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2eb4608f-fa4f-444c-a857-c9059777a70b","source":"wordfence","cve":"CVE-2025-4102","title":"Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb4608f-fa4f-444c-a857-c9059777a70b?source=api-prod","affected":[{"type":"plugin","slug":"bb-plugin","name":"Beaver Builder Plugin (Starter Version)","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.1.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-20T11:16:40Z"},{"id":"wordfence:2eb5683d-a787-47b2-a4fa-f769266bf5ec","source":"wordfence","cve":"CVE-2025-67975","title":"aDirectory <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb5683d-a787-47b2-a4fa-f769266bf5ec?source=api-prod","affected":[{"type":"plugin","slug":"adirectory","name":"aDirectory \u2013 WP Business Directory Plugin and Classified Ads Listings Directory","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:28:57Z"},{"id":"wordfence:2eb5e5a9-9bef-41ec-878e-790bd526f24a","source":"wordfence","cve":"CVE-2026-90987","title":"Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 -  Unauthenticated Arbitrary Payment Amount Reduction","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb5e5a9-9bef-41ec-878e-790bd526f24a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"1.8","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:27:37Z"},{"id":"wordfence:2eb65c25-9400-4c5a-a4b2-b72628725500","source":"wordfence","cve":"CVE-2025-14118","title":"Starred Review <= 1.4.2 - Reflected Cross-Site Scripting via PHP_SELF Variable","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb65c25-9400-4c5a-a4b2-b72628725500?source=api-prod","affected":[{"type":"plugin","slug":"starred-review","name":"Starred Review","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:32:57Z","updated":"2026-01-07T09:20:54Z"},{"id":"wordfence:2eb70d40-b1c1-456e-9207-66b6e91969eb","source":"wordfence","cve":"CVE-2026-1450","title":"rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb70d40-b1c1-456e-9207-66b6e91969eb?source=api-prod","affected":[{"type":"plugin","slug":"rognone","name":"rognone","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:31Z","updated":"2026-06-02T07:48:28Z"},{"id":"wordfence:2eb963dd-41c3-43cd-afb7-1be054829ea3","source":"wordfence","cve":"CVE-2021-4392","title":"eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb963dd-41c3-43cd-afb7-1be054829ea3?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"2.9.44","to_inclusive":false,"patched_in":"2.9.44"}],"published":"2021-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ec012e7-b997-466e-8676-8e9467473eae","source":"wordfence","cve":"CVE-2025-0506","title":"Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec012e7-b997-466e-8676-8e9467473eae?source=api-prod","affected":[{"type":"plugin","slug":"rise-blocks","name":"Rise Blocks \u2013 A Complete Gutenberg Page Builder","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2025-02-11T21:07:48Z","updated":"2025-02-27T20:33:20Z"},{"id":"wordfence:2ec0aeb4-e831-484b-8a9d-82ec0189a1b4","source":"wordfence","cve":"CVE-2025-68057","title":"Hospital Doctor Directory <= 1.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec0aeb4-e831-484b-8a9d-82ec0189a1b4?source=api-prod","affected":[{"type":"plugin","slug":"hospital-doctor-directory","name":"Hospital Doctor Directory","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:02:16Z"},{"id":"wordfence:2ec35484-8561-4a8c-bf67-0a880f915fb1","source":"wordfence","cve":"CVE-2024-8790","title":"Social Share With Floating Bar <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec35484-8561-4a8c-bf67-0a880f915fb1?source=api-prod","affected":[{"type":"plugin","slug":"social-share-with-floating-bar","name":"Social Share With Floating Bar","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:47:19Z","updated":"2024-10-18T04:32:51Z"},{"id":"wordfence:2ec3bd67-6e4b-46b6-8027-feeea149f3a4","source":"wordfence","cve":"CVE-2026-92244","title":"PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec3bd67-6e4b-46b6-8027-feeea149f3a4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":true,"patched_in":"5.16.2"}],"published":"2026-09-30T20:22:53Z","updated":"2026-10-01T08:28:42Z"},{"id":"wordfence:2ec40d89-9caa-44dc-8577-00fa6463348c","source":"wordfence","cve":"","title":"Event Tickets with Ticket Scanner <= 1.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec40d89-9caa-44dc-8577-00fa6463348c?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ec5d29e-43e2-4cd3-8164-94b01fab4d64","source":"wordfence","cve":"CVE-2023-46625","title":"Autolinks Manager <= 1.10.04 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec5d29e-43e2-4cd3-8164-94b01fab4d64?source=api-prod","affected":[{"type":"plugin","slug":"daext-autolinks-manager","name":"Link Manager \u2013 Analyze, Automate, and Monitor Links","from":"*","from_inclusive":true,"to":"1.10.04","to_inclusive":true,"patched_in":"1.10.05"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ec5eaf2-9519-42ef-a8b6-d80307c2a18d","source":"wordfence","cve":"CVE-2025-58192","title":"WP Bulk Delete <= 1.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec5eaf2-9519-42ef-a8b6-d80307c2a18d?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulk-delete","name":"WP Bulk Delete","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:32:48Z"},{"id":"wordfence:2ec6c55d-92c3-4aa0-8baa-746ffdf84ec3","source":"wordfence","cve":"CVE-2024-5444","title":"Bible Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec6c55d-92c3-4aa0-8baa-746ffdf84ec3?source=api-prod","affected":[{"type":"plugin","slug":"bible-text","name":"Bible Text","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T14:25:41Z"},{"id":"wordfence:2ec6cf42-291b-452d-ad14-80ae1cd5ec5c","source":"wordfence","cve":"CVE-2024-6698","title":"FundEngine \u2013 Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec6cf42-291b-452d-ad14-80ae1cd5ec5c?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-07-31T15:16:32Z","updated":"2024-08-01T03:30:00Z"},{"id":"wordfence:2ec96107-ae41-4886-8a46-5a2d6dd62aae","source":"wordfence","cve":"CVE-2024-1752","title":"Font Farsi <= 1.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec96107-ae41-4886-8a46-5a2d6dd62aae?source=api-prod","affected":[{"type":"plugin","slug":"font-farsi","name":"Font Farsi","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2024-03-18T00:00:00Z","updated":"2024-05-07T12:19:25Z"},{"id":"wordfence:2ec9de0f-5af7-4664-b8ef-72a51b1661d7","source":"wordfence","cve":"CVE-2024-35682","title":"Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.11 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec9de0f-5af7-4664-b8ef-72a51b1661d7?source=api-prod","affected":[{"type":"plugin","slug":"otter-pro","name":"Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":true,"patched_in":"2.6.12"}],"published":"2024-06-06T00:00:00Z","updated":"2024-10-24T18:47:43Z"},{"id":"wordfence:2ecec7d7-d1b2-4ccf-ade6-1f78224968c6","source":"wordfence","cve":"CVE-2026-4024","title":"Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ecec7d7-d1b2-4ccf-ade6-1f78224968c6?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-05-01T20:11:49Z","updated":"2026-05-02T08:27:05Z"},{"id":"wordfence:2ecf86ef-6ace-44a8-bfc3-c6ea9def56f8","source":"wordfence","cve":"CVE-2026-22515","title":"VegaDays - Vegetarian Food Festival & Eco Event WordPress Theme <= 1.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ecf86ef-6ace-44a8-bfc3-c6ea9def56f8?source=api-prod","affected":[{"type":"theme","slug":"vegadays","name":"VegaDays - Vegetarian Food Festival & Eco Event WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T00:00:00Z","updated":"2026-03-12T16:12:28Z"},{"id":"wordfence:2ed0fcbc-8cf7-4227-8f78-a10a2df83286","source":"wordfence","cve":"CVE-2025-58884","title":"vipdrv <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed0fcbc-8cf7-4227-8f78-a10a2df83286?source=api-prod","affected":[{"type":"plugin","slug":"vipdrv-vip-test-drive","name":"vipdrv","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T22:07:36Z"},{"id":"wordfence:2ed1f200-5a27-4905-ac88-394b214bb430","source":"wordfence","cve":"","title":"WooCommerce < 6.3.1 - Unauthorized Order Status Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed1f200-5a27-4905-ac88-394b214bb430?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.5","from_inclusive":true,"to":"3.5.10","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.6","from_inclusive":true,"to":"3.6.7","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.9","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.0","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.1","from_inclusive":true,"to":"4.1.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.2","from_inclusive":true,"to":"4.2.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.4","from_inclusive":true,"to":"4.4.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.9","from_inclusive":true,"to":"4.9.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.0","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.4","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.5","from_inclusive":true,"to":"5.5.4","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.6","from_inclusive":true,"to":"5.6.2","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.7","from_inclusive":true,"to":"5.7.2","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.9","from_inclusive":true,"to":"5.9.1","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"6.0","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":false,"patched_in":"3.5.10"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":false,"patched_in":"3.5.10"}],"published":"2022-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ed28379-1fc0-4cf4-a507-7d0bdc9f7f4a","source":"wordfence","cve":"CVE-2026-24984","title":"Visual Link Preview <= 2.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed28379-1fc0-4cf4-a507-7d0bdc9f7f4a?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-01-18T00:00:00Z","updated":"2026-02-10T20:07:52Z"},{"id":"wordfence:2ed83916-3cf7-4fc6-a16f-45b40cedc721","source":"wordfence","cve":"CVE-2025-3861","title":"Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed83916-3cf7-4fc6-a16f-45b40cedc721?source=api-prod","affected":[{"type":"plugin","slug":"prevent-direct-access","name":"Prevent Direct Access \u2013 Protect WordPress Files","from":"2.8.6","from_inclusive":true,"to":"2.8.8.2","to_inclusive":true,"patched_in":"2.8.8.3"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T05:25:07Z"},{"id":"wordfence:2ed8a7f8-1af3-4b41-bfaf-fd1c35baa867","source":"wordfence","cve":"CVE-2024-10881","title":"LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed8a7f8-1af3-4b41-bfaf-fd1c35baa867?source=api-prod","affected":[{"type":"plugin","slug":"lu-radioplayer","name":"LUNA RADIO PLAYER","from":"*","from_inclusive":true,"to":"6.24.11.07","to_inclusive":true,"patched_in":"6.24.11.15"}],"published":"2024-11-15T00:00:00Z","updated":"2024-12-05T03:23:46Z"},{"id":"wordfence:2edabe6d-329f-4b17-b74d-849a0c7c0ef1","source":"wordfence","cve":"CVE-2025-22806","title":"Black Widgets For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edabe6d-329f-4b17-b74d-849a0c7c0ef1?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:56:23Z"},{"id":"wordfence:2edb574d-74b7-4f72-91a1-bb6632709b7a","source":"wordfence","cve":"","title":"WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edb574d-74b7-4f72-91a1-bb6632709b7a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":false,"patched_in":"3.6.5"}],"published":"2019-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2edbcf13-4cf8-46dd-a21e-1e5898ed4e50","source":"wordfence","cve":"CVE-2025-66113","title":"Better Chat Support for Messenger <= 1.2.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edbcf13-4cf8-46dd-a21e-1e5898ed4e50?source=api-prod","affected":[{"type":"plugin","slug":"better-chat-support","name":"Better Chat Support for Messenger","from":"*","from_inclusive":true,"to":"1.2.18","to_inclusive":true,"patched_in":"1.2.19"}],"published":"2025-11-20T00:00:00Z","updated":"2025-11-25T16:12:21Z"},{"id":"wordfence:2edc7c4d-598d-4c9c-9aad-ccc97f6a3ac0","source":"wordfence","cve":"CVE-2021-24262","title":"WooLentor \u2013 WooCommerce Elementor Addons + Builder <= 1.8.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edc7c4d-598d-4c9c-9aad-ccc97f6a3ac0?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2edd9774-753b-49a4-9f7b-281829a1030e","source":"wordfence","cve":"CVE-2024-33680","title":"MainWP Child Reports <= 2.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edd9774-753b-49a4-9f7b-281829a1030e?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child-reports","name":"MainWP Child Reports","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T14:25:47Z"},{"id":"wordfence:2eddfe94-7232-4d3d-9f3a-f53fc476a012","source":"wordfence","cve":"CVE-2023-0890","title":"Shortcodes Ultimate <= 5.12.7 - Authenticated (Subscriber+) Arbitrary Post Access via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eddfe94-7232-4d3d-9f3a-f53fc476a012?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.7","to_inclusive":true,"patched_in":"5.12.8"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2edfceaf-e719-4351-8f5c-2d7dd401c84e","source":"wordfence","cve":"CVE-2024-1426","title":"Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price List Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2edfceaf-e719-4351-8f5c-2d7dd401c84e?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-18T04:33:00Z"},{"id":"wordfence:2ee331d9-32b3-4be4-8f25-d65c1192ff6b","source":"wordfence","cve":"CVE-2024-52397","title":"Convert Docx2post <= 1.4 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ee331d9-32b3-4be4-8f25-d65c1192ff6b?source=api-prod","affected":[{"type":"plugin","slug":"convert-docx2post","name":"Convert Docx2post","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:09:13Z"},{"id":"wordfence:2ee3d536-6d7b-41dc-9d63-52b9b4facf73","source":"wordfence","cve":"CVE-2015-9532","title":"Easy Digital Downloads (EDD) Digital Store < 1.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ee3d536-6d7b-41dc-9d63-52b9b4facf73?source=api-prod","affected":[{"type":"theme","slug":"digital-store","name":"Easy Digital Downloads (EDD) Digital Store","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ee6ffb3-9a4a-4564-bfef-116a12268c3c","source":"wordfence","cve":"CVE-2021-24279","title":"Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ee6ffb3-9a4a-4564-bfef-116a12268c3c?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ee837fd-a41e-44f2-81e8-258a7d8547bd","source":"wordfence","cve":"","title":"TheAgency (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ee837fd-a41e-44f2-81e8-258a7d8547bd?source=api-prod","affected":[{"type":"theme","slug":"theagency","name":"TheAgency","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2eea86a6-0727-427d-8307-446a268bac42","source":"wordfence","cve":"CVE-2026-101301","title":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager < 2.4.0 - Unauthenticated Snippet Safe Mode Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eea86a6-0727-427d-8307-446a268bac42?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers","name":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:19:45Z"},{"id":"wordfence:2eece6bd-e167-4e09-ab42-f768f2af8677","source":"wordfence","cve":"CVE-2026-42413","title":"Snapshotify \u2013 All-in-One Backup & Restore & Migrate <= 1.3.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eece6bd-e167-4e09-ab42-f768f2af8677?source=api-prod","affected":[{"type":"plugin","slug":"snapshotify","name":"Snapshotify \u2013 All-in-One Backup & Restore & Migrate","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2026-10-05T15:27:44Z","updated":"2026-10-28T21:17:00Z"},{"id":"wordfence:2eeeb4b5-972b-471b-8f0f-a198640fc894","source":"wordfence","cve":"CVE-2014-10384","title":"Memphis Documents Library <= 2.6.16 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eeeb4b5-972b-471b-8f0f-a198640fc894?source=api-prod","affected":[{"type":"plugin","slug":"memphis-documents-library","name":"Memphis Documents Library","from":"*","from_inclusive":true,"to":"2.6.16","to_inclusive":true,"patched_in":"3.0"}],"published":"2015-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef0ab24-ec21-4d23-980d-71a23bf20f9e","source":"wordfence","cve":"CVE-2020-12073","title":"Responsive Ready Sites Importer <= 2.2.6 -  Unprotected AJAX Actions","severity":"critical","cvss":9.1,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef0ab24-ec21-4d23-980d-71a23bf20f9e?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2020-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef130d7-18a4-410a-a65a-c33fdbf3133f","source":"wordfence","cve":"CVE-2026-66568","title":"Original <= 1.9.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef130d7-18a4-410a-a65a-c33fdbf3133f?source=api-prod","affected":[{"type":"theme","slug":"original","name":"Original","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:16:53Z"},{"id":"wordfence:2ef15cb1-b320-42d9-a2fd-afff2ec8a93b","source":"wordfence","cve":"","title":"Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef15cb1-b320-42d9-a2fd-afff2ec8a93b?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.22.1","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef21a44-6d03-4197-b49c-d881f9831f46","source":"wordfence","cve":"CVE-2026-16610","title":"Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef21a44-6d03-4197-b49c-d881f9831f46?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements-pro","name":"Admin and Site Enhancements (ASE) Pro","from":"*","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2026-07-29T15:32:22Z","updated":"2026-07-30T04:03:16Z"},{"id":"wordfence:2ef2ded1-dd56-4c33-98dc-d4c69e66568f","source":"wordfence","cve":"CVE-2023-49837","title":"Code Embed <= 2.3.6 - Authenticated(Contributor+) Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef2ded1-dd56-4c33-98dc-d4c69e66568f?source=api-prod","affected":[{"type":"plugin","slug":"simple-embed-code","name":"Code Embed","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef3c7fb-27f5-4829-8cb6-d3a52778a689","source":"wordfence","cve":"CVE-2024-6411","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef3c7fb-27f5-4829-8cb6-d3a52778a689?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.9","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2024-07-09T15:34:42Z","updated":"2024-07-10T04:31:31Z"},{"id":"wordfence:2ef402a9-b194-444c-9af4-5f79ab573beb","source":"wordfence","cve":"CVE-2026-34897","title":"Media Library Assistant <= 3.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef402a9-b194-444c-9af4-5f79ab573beb?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.34","to_inclusive":true,"patched_in":"3.35"}],"published":"2026-04-06T00:00:00Z","updated":"2026-04-13T21:12:50Z"},{"id":"wordfence:2ef43041-9c24-4ca2-bc01-c4ff5ba12e63","source":"wordfence","cve":"CVE-2025-54042","title":"WP Post Hide <= 1.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef43041-9c24-4ca2-bc01-c4ff5ba12e63?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-hide","name":"WP Hide Post \u2014 Hide Posts, Pages, Custom Post Types, and Control Products Visibility for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:27:45Z"},{"id":"wordfence:2ef53c2c-01fb-41b6-b329-d952ce3424e8","source":"wordfence","cve":"CVE-2024-2423","title":"UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef53c2c-01fb-41b6-b329-d952ce3424e8?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-03-14T00:00:00Z","updated":"2024-05-31T15:30:13Z"},{"id":"wordfence:2ef5a8f1-ed3c-48bb-9554-b42e9e8d645d","source":"wordfence","cve":"","title":"Curtain < 1.0.2 - Unauthenticated Maintenance Mode Enabled/Disable","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef5a8f1-ed3c-48bb-9554-b42e9e8d645d?source=api-prod","affected":[{"type":"plugin","slug":"curtain","name":"Curtain","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef5b0de-0b8b-4286-86ea-6dca0dbc1a52","source":"wordfence","cve":"CVE-2022-4954","title":"Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef5b0de-0b8b-4286-86ea-6dca0dbc1a52?source=api-prod","affected":[{"type":"plugin","slug":"waiting","name":"Waiting: One-click countdowns","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef5e73e-a627-4e9c-9784-493ace5c8614","source":"wordfence","cve":"CVE-2015-9271","title":"Webcam Video Conference <= 4.91.8 - Unrestricted File Upload leading to Remote Code Execuction","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef5e73e-a627-4e9c-9784-493ace5c8614?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-video-conference-integration","name":"Webcam Video Conference","from":"*","from_inclusive":true,"to":"4.91.8","to_inclusive":true,"patched_in":"4.91.9"}],"published":"2015-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ef6d5f4-fc29-4b9f-b3cc-834eff37b085","source":"wordfence","cve":"CVE-2025-31021","title":"Mobile Smart <= v1.3.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef6d5f4-fc29-4b9f-b3cc-834eff37b085?source=api-prod","affected":[{"type":"plugin","slug":"mobile-smart","name":"Mobile Smart","from":"*","from_inclusive":true,"to":"v1.3.16","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:14:48Z"},{"id":"wordfence:2efbb0af-fda5-4c1b-a495-24fa7efc689e","source":"wordfence","cve":"CVE-2023-28931","title":"Post Connector <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2efbb0af-fda5-4c1b-a495-24fa7efc689e?source=api-prod","affected":[{"type":"plugin","slug":"post-connector","name":"Post Connector","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2efe885d-7e17-4057-abde-37482047facb","source":"wordfence","cve":"CVE-2024-13356","title":"DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2efe885d-7e17-4057-abde-37482047facb?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-02-03T20:24:36Z","updated":"2025-02-04T09:21:08Z"},{"id":"wordfence:2efeffa2-b21a-4aa1-93b0-51c775758ab1","source":"wordfence","cve":"CVE-2023-3055","title":"Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2efeffa2-b21a-4aa1-93b0-51c775758ab1?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-by-azexo","name":"Page Builder with Image Map by AZEXO","from":"*","from_inclusive":true,"to":"1.27.133","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f025b73-9a1a-4890-90ef-700f73ac018f","source":"wordfence","cve":"CVE-2014-5072","title":"WP Activity Log <= 1.2.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f025b73-9a1a-4890-90ef-700f73ac018f?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f032d32-9e7d-4510-b4ea-4b57c0b80977","source":"wordfence","cve":"CVE-2024-0902","title":"Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via Product Title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f032d32-9e7d-4510-b4ea-4b57c0b80977?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.1.81","to_inclusive":false,"patched_in":"6.1.81"}],"published":"2024-03-25T00:00:00Z","updated":"2024-05-07T12:48:19Z"},{"id":"wordfence:2f060ea1-01e2-4e5b-82ba-b5cdd0d8290a","source":"wordfence","cve":"CVE-2024-2018","title":"WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f060ea1-01e2-4e5b-82ba-b5cdd0d8290a?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log-premium","name":"WP Activity Log Premium","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.4.1"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-09T18:58:42Z"},{"id":"wordfence:2f077817-704f-4595-bfb1-80234dd23f8d","source":"wordfence","cve":"CVE-2025-11162","title":"Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f077817-704f-4595-bfb1-80234dd23f8d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.14","to_inclusive":true,"patched_in":"2.19.15"}],"published":"2025-11-04T16:25:19Z","updated":"2025-11-05T04:37:00Z"},{"id":"wordfence:2f085925-fe08-41a8-85c4-39309acf2a96","source":"wordfence","cve":"CVE-2024-56039","title":"VibeBP < 1.9.9.7.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f085925-fe08-41a8-85c4-39309acf2a96?source=api-prod","affected":[{"type":"plugin","slug":"vibebp","name":"VibeBP","from":"*","from_inclusive":true,"to":"1.9.9.7.7","to_inclusive":false,"patched_in":"1.9.9.7.7"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:24:49Z"},{"id":"wordfence:2f08961b-8da2-40bf-b197-aea76c4e79f9","source":"wordfence","cve":"CVE-2025-47514","title":"ELI's Related Posts Footer Links and Widget <= 1.2.04.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f08961b-8da2-40bf-b197-aea76c4e79f9?source=api-prod","affected":[{"type":"plugin","slug":"spostarbust","name":"EZ Related Posts Footer Links and Widget","from":"*","from_inclusive":true,"to":"1.2.04.20","to_inclusive":true,"patched_in":"1.2.04.25"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:44:27Z"},{"id":"wordfence:2f095368-59e9-4225-9808-96f1be051566","source":"wordfence","cve":"CVE-2025-15678","title":"Nexter Blocks <= 5.0.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f095368-59e9-4225-9808-96f1be051566?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:13:50Z"},{"id":"wordfence:2f0a7d6f-9b95-4052-bab3-85aca01f6ab7","source":"wordfence","cve":"CVE-2026-5229","title":"Receive Notifications After Form Submitting \u2013 Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0a7d6f-9b95-4052-bab3-85aca01f6ab7?source=api-prod","affected":[{"type":"plugin","slug":"form-notify","name":"Receive Notifications After Form Submitting \u2013 Form Notify for Any Forms","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2026-05-14T18:59:36Z","updated":"2026-05-15T07:46:37Z"},{"id":"wordfence:2f0c85f4-07ae-4a2b-bd82-93467e7d9325","source":"wordfence","cve":"CVE-2024-10960","title":"Brizy \u2013 Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0c85f4-07ae-4a2b-bd82-93467e7d9325?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2025-02-11T22:54:59Z","updated":"2025-02-12T11:11:17Z"},{"id":"wordfence:2f0d4f48-a315-4308-a5b6-7d3f045b292f","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak)","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0d4f48-a315-4308-a5b6-7d3f045b292f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f0e19bc-cc1f-4804-ae81-8aa7905ce037","source":"wordfence","cve":"CVE-2021-24441","title":"Sign-up Sheets <= 1.0.13 - Authenticated CSV Injection","severity":"high","cvss":8.0,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0e19bc-cc1f-4804-ae81-8aa7905ce037?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":false,"patched_in":"1.0.14"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f0e7f9f-cc9b-4e90-a768-776c927b6d83","source":"wordfence","cve":"CVE-2025-22567","title":"TRUSTist REVIEWer <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0e7f9f-cc9b-4e90-a768-776c927b6d83?source=api-prod","affected":[{"type":"plugin","slug":"trustist-reviewer","name":"TRUSTist REVIEWer","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:46:54Z"},{"id":"wordfence:2f127fe5-67b8-40e1-a916-c607410b08b3","source":"wordfence","cve":"CVE-2024-3608","title":"Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=api-prod","affected":[{"type":"plugin","slug":"product-designer","name":"PickPlugins Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.34"}],"published":"2024-07-08T19:40:35Z","updated":"2024-08-09T13:35:39Z"},{"id":"wordfence:2f12fa00-6108-4bd4-9310-8558211f4d0f","source":"wordfence","cve":"CVE-2025-12883","title":"Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f12fa00-6108-4bd4-9310-8558211f4d0f?source=api-prod","affected":[{"type":"plugin","slug":"campay-api","name":"Campay Woocommerce Payment Gateway","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-12-11T14:34:19Z","updated":"2025-12-20T14:47:51Z"},{"id":"wordfence:2f13d1ac-d1b4-4802-bee2-3622e84d7482","source":"wordfence","cve":"CVE-2026-103366","title":"Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f13d1ac-d1b4-4802-bee2-3622e84d7482?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2026-10-13T19:19:27Z","updated":"2026-10-14T07:43:32Z"},{"id":"wordfence:2f14b0b9-6ccd-4f53-b015-e8537127b909","source":"wordfence","cve":"CVE-2024-30200","title":"BEAR \u2013 Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f14b0b9-6ccd-4f53-b015-e8537127b909?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4.2","to_inclusive":true,"patched_in":"1.1.4.3"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T19:36:28Z"},{"id":"wordfence:2f1527cb-a44f-4a57-968e-79f06af8bb40","source":"wordfence","cve":"CVE-2026-85576","title":"All in One Files Upload for WooCommerce <= 2.0.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f1527cb-a44f-4a57-968e-79f06af8bb40?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-files-upload-for-woocommerce","name":"All in One Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:10:00Z"},{"id":"wordfence:2f1b0b50-663f-40ff-803e-a20d7c7ea980","source":"wordfence","cve":"CVE-2023-38390","title":"Mobile Address Bar Changer <= 3.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f1b0b50-663f-40ff-803e-a20d7c7ea980?source=api-prod","affected":[{"type":"plugin","slug":"mobile-address-bar-changer","name":"Mobile Address Bar Changer","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f1cb71a-aabb-4ba1-93b4-24070aaa582b","source":"wordfence","cve":"CVE-2024-12460","title":"Years Since \u2013 Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f1cb71a-aabb-4ba1-93b4-24070aaa582b?source=api-prod","affected":[{"type":"plugin","slug":"years-since","name":"Years Since \u2013 Timeless Texts","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T14:15:02Z","updated":"2025-03-08T02:24:02Z"},{"id":"wordfence:2f1eeeb9-fc91-47a5-a1b4-7e25caabbae2","source":"wordfence","cve":"CVE-2026-92438","title":"Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f1eeeb9-fc91-47a5-a1b4-7e25caabbae2?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T20:00:07Z"},{"id":"wordfence:2f1f7414-c399-4f1d-8003-f9899a701c2c","source":"wordfence","cve":"CVE-2024-32593","title":"WPBITS Addons For Elementor Page Builder <= 1.3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f1f7414-c399-4f1d-8003-f9899a701c2c?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.3.4.2","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-08-09T15:47:23Z"},{"id":"wordfence:2f21139b-75ef-4631-b88d-23eebbdefee0","source":"wordfence","cve":"CVE-2021-24820","title":"Cost Calculator <= 1.8 - Authenticated Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f21139b-75ef-4631-b88d-23eebbdefee0?source=api-prod","affected":[{"type":"plugin","slug":"nd-projects","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f226493-4787-4d99-999d-3e3916a8c41d","source":"wordfence","cve":"CVE-2022-0662","title":"AdRotate \u2013 Ad manager & AdSense Ads <= 5.8.22 - Authenticated Stored Cross-Site Scripting via Advert Names","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f226493-4787-4d99-999d-3e3916a8c41d?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.8.23","to_inclusive":false,"patched_in":"5.8.23"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f255871-7be6-4d11-821a-65d52f62b8be","source":"wordfence","cve":"CVE-2026-93508","title":"WC Fields Factory <= 4.1.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f255871-7be6-4d11-821a-65d52f62b8be?source=api-prod","affected":[{"type":"plugin","slug":"wc-fields-factory","name":"WC Fields Factory","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:46:12Z"},{"id":"wordfence:2f257c92-1529-49c8-a140-567ba5c36d04","source":"wordfence","cve":"CVE-2007-6677","title":"Peter\u2019s Random Anti-Spam Image <= 1.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f257c92-1529-49c8-a140-567ba5c36d04?source=api-prod","affected":[{"type":"plugin","slug":"peters-random-anti-spam-image","name":"Peter's Random Anti-Spam Image","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2007-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f262610-35e7-49fe-997b-3c7c5ce6cedf","source":"wordfence","cve":"CVE-2026-16984","title":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages < 3.7.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f262610-35e7-49fe-997b-3c7c5ce6cedf?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:39:38Z"},{"id":"wordfence:2f280d50-196b-43a9-83f8-713d84ea1a00","source":"wordfence","cve":"CVE-2024-38776","title":"WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f280d50-196b-43a9-83f8-713d84ea1a00?source=api-prod","affected":[{"type":"plugin","slug":"wp-gotowebinar","name":"WP GoToWebinar","from":"*","from_inclusive":true,"to":"15.7","to_inclusive":true,"patched_in":"15.8"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:11:33Z"},{"id":"wordfence:2f2ab0ba-6212-4466-835f-763ea01336b9","source":"wordfence","cve":"CVE-2026-11567","title":"SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2ab0ba-6212-4466-835f-763ea01336b9?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-29T21:56:44Z"},{"id":"wordfence:2f2b54a9-323f-40e1-8d0e-8c5b84cb5c81","source":"wordfence","cve":"CVE-2026-97309","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2b54a9-323f-40e1-8d0e-8c5b84cb5c81?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1226","to_inclusive":true,"patched_in":"4.1227"}],"published":"2026-10-03T17:41:53Z","updated":"2026-10-09T00:18:11Z"},{"id":"wordfence:2f2bdf11-401a-48af-b1dc-aeeb40b9a384","source":"wordfence","cve":"CVE-2023-5815","title":"News & Blog Designer Pack \u2013 WordPress Blog Plugin  <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2bdf11-401a-48af-b1dc-aeeb40b9a384?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f2c6349-9444-4cea-90ae-f396ae92f85a","source":"wordfence","cve":"CVE-2024-53785","title":"Chatter <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2c6349-9444-4cea-90ae-f396ae92f85a?source=api-prod","affected":[{"type":"plugin","slug":"chatter","name":"Chatter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:56:52Z"},{"id":"wordfence:2f2d1a67-1d9b-4b73-988e-085eaa7474c6","source":"wordfence","cve":"CVE-2026-2305","title":"AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2d1a67-1d9b-4b73-988e-085eaa7474c6?source=api-prod","affected":[{"type":"plugin","slug":"addfunc-head-footer-code","name":"AddFunc Head & Footer Code","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-04-09T14:51:35Z","updated":"2026-04-10T03:35:35Z"},{"id":"wordfence:2f2d8b21-1c25-4cfc-bf62-2e71d6a90d91","source":"wordfence","cve":"CVE-2026-7046","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2d8b21-1c25-4cfc-bf62-2e71d6a90d91?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.12","to_inclusive":true,"patched_in":"9.1.13"}],"published":"2026-05-14T18:51:33Z","updated":"2026-05-15T07:46:37Z"},{"id":"wordfence:2f2ed813-3bf3-4ee3-a030-778cbd93bba3","source":"wordfence","cve":"CVE-2023-32292","title":"Chat Button <= 1.8.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2ed813-3bf3-4ee3-a030-778cbd93bba3?source=api-prod","affected":[{"type":"plugin","slug":"whatshelp-chat-button","name":"Chat Button & Custom ChatGPT-Powered Bot by GetButton.io","from":"*","from_inclusive":true,"to":"1.8.9.4","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f2fb51b-984c-4b82-98d4-9a681a1855a7","source":"wordfence","cve":"CVE-2023-40671","title":"DX-auto-save-images <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2fb51b-984c-4b82-98d4-9a681a1855a7?source=api-prod","affected":[{"type":"plugin","slug":"dx-auto-save-images","name":"DX-auto-save-images","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f2fcad0-f948-4da5-9bb1-888fc0ced718","source":"wordfence","cve":"CVE-2026-49763","title":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2fcad0-f948-4da5-9bb1-888fc0ced718?source=api-prod","affected":[{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:43:59Z"},{"id":"wordfence:2f317dcd-dc4f-482a-8faa-91cd9c022276","source":"wordfence","cve":"CVE-2026-123769","title":"SureDash <= 1.13.0 - Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f317dcd-dc4f-482a-8faa-91cd9c022276?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2026-11-12T20:55:05Z","updated":"2026-11-13T09:35:11Z"},{"id":"wordfence:2f32bf1e-acc7-4fbc-a448-75227dcced1d","source":"wordfence","cve":"CVE-2025-58795","title":"Payoneer Checkout <= 3.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f32bf1e-acc7-4fbc-a448-75227dcced1d?source=api-prod","affected":[{"type":"plugin","slug":"payoneer-checkout","name":"Payoneer Checkout","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-25T18:33:38Z"},{"id":"wordfence:2f32c361-9bb3-417b-a5a9-02e48bfa33b4","source":"wordfence","cve":"CVE-2026-107770","title":"Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action","severity":"medium","cvss":6.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f32c361-9bb3-417b-a5a9-02e48bfa33b4?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2026-10-15T17:49:22Z","updated":"2026-10-16T06:41:02Z"},{"id":"wordfence:2f3328c2-290f-410b-a6c8-2825d415f511","source":"wordfence","cve":"","title":"Web Instant Messenger <= 1.1.2 and LocalWeb In One <= 1.6.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3328c2-290f-410b-a6c8-2825d415f511?source=api-prod","affected":[{"type":"plugin","slug":"web-instant-messenger","name":"Web Instant Messenger","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"lw-all-in-one","name":"LocalWeb All In One","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2020-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f335839-73bc-4ede-9d86-6d8ff93cbecc","source":"wordfence","cve":"CVE-2024-11875","title":"Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f335839-73bc-4ede-9d86-6d8ff93cbecc?source=api-prod","affected":[{"type":"plugin","slug":"add-infos-to-the-events-calendar","name":"Add infos to The Events Calendar","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:12Z"},{"id":"wordfence:2f340cfe-0829-444a-a67d-867ac8650b21","source":"wordfence","cve":"CVE-2016-10981","title":"Kento Post View Counter <= 2.8 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f340cfe-0829-444a-a67d-867ac8650b21?source=api-prod","affected":[{"type":"plugin","slug":"kento-post-view-counter","name":"Kento Post View Counter","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2016-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f34854a-5ca1-48a3-81d5-80f80f3a85fc","source":"wordfence","cve":"CVE-2023-48278","title":"WP Forms Puzzle Captcha <= 4.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f34854a-5ca1-48a3-81d5-80f80f3a85fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-puzzle-captcha","name":"WP Forms Puzzle Captcha","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f35ab5c-f897-404b-92ea-71bf1c98e0c0","source":"wordfence","cve":"CVE-2026-75927","title":"PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f35ab5c-f897-404b-92ea-71bf1c98e0c0?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.50.0","to_inclusive":true,"patched_in":"2.50.1"}],"published":"2026-09-08T18:41:31Z","updated":"2026-09-09T07:40:56Z"},{"id":"wordfence:2f383a56-21e3-4f06-b4d4-47a269007cdc","source":"wordfence","cve":"CVE-2024-11370","title":"Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f383a56-21e3-4f06-b4d4-47a269007cdc?source=api-prod","affected":[{"type":"plugin","slug":"subaccounts-for-woocommerce","name":"Subaccounts for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-11-20T13:47:48Z","updated":"2024-11-22T16:25:43Z"},{"id":"wordfence:2f38498d-0560-4935-b1f5-1fdb62f49a5b","source":"wordfence","cve":"CVE-2025-9112","title":"Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f38498d-0560-4935-b1f5-1fdb62f49a5b?source=api-prod","affected":[{"type":"theme","slug":"doccure","name":"Doccure","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-08T05:35:13Z","updated":"2025-11-25T06:02:17Z"},{"id":"wordfence:2f3a10b5-b024-4b3f-af67-b7fcb997d368","source":"wordfence","cve":"CVE-2025-4473","title":"Frontend Dashboard 1.5.10 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via ajax_request Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3a10b5-b024-4b3f-af67-b7fcb997d368?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"1.5.10","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-05-12T17:49:56Z","updated":"2025-05-13T06:40:55Z"},{"id":"wordfence:2f3ad1e0-1ae3-44cd-aa2a-dbb3a1b531f9","source":"wordfence","cve":"CVE-2024-6447","title":"FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3ad1e0-1ae3-44cd-aa2a-dbb3a1b531f9?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2024-07-10T11:26:16Z","updated":"2024-07-10T23:32:15Z"},{"id":"wordfence:2f3c706f-fcce-4bcb-9773-ced011bf6407","source":"wordfence","cve":"CVE-2023-27424","title":"Inactive User Deleter <= 1.59 - Cross-Site Request Forgery via Multiple Functions","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3c706f-fcce-4bcb-9773-ced011bf6407?source=api-prod","affected":[{"type":"plugin","slug":"inactive-user-deleter","name":"Inactive User Deleter","from":"*","from_inclusive":true,"to":"1.59","to_inclusive":true,"patched_in":"1.60"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f3fbff7-3212-4542-a34d-0ef66253c810","source":"wordfence","cve":"CVE-2026-96173","title":"Payments for Hubtel <= 1.0.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3fbff7-3212-4542-a34d-0ef66253c810?source=api-prod","affected":[{"type":"plugin","slug":"payments-hubtel","name":"Payments for Hubtel","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:54:01Z"},{"id":"wordfence:2f40b4fb-4e90-4a5a-9667-20e4087abe00","source":"wordfence","cve":"CVE-2026-17013","title":"Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f40b4fb-4e90-4a5a-9667-20e4087abe00?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.07.1","to_inclusive":true,"patched_in":"9.2.07.002"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:51:11Z"},{"id":"wordfence:2f438626-2984-49b8-878a-291887e81375","source":"wordfence","cve":"CVE-2025-30869","title":"Image Wall <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f438626-2984-49b8-878a-291887e81375?source=api-prod","affected":[{"type":"plugin","slug":"image-wall","name":"Image Wall","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:56:56Z"},{"id":"wordfence:2f466add-992b-46c7-a1cc-5c05d59f4bdf","source":"wordfence","cve":"CVE-2026-107748","title":"User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-15T16:37:45Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:2f479424-3b7f-4c5c-b27f-5b1805909bc7","source":"wordfence","cve":"CVE-2025-49405","title":"Houzez <= 4.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f479424-3b7f-4c5c-b27f-5b1805909bc7?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:11:21Z"},{"id":"wordfence:2f47a01d-b259-465e-bec1-9079987dc5a5","source":"wordfence","cve":"","title":"Kiwi Social Share <= 2.0.10 - Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f47a01d-b259-465e-bec1-9079987dc5a5?source=api-prod","affected":[{"type":"plugin","slug":"kiwi-social-share","name":"Social Sharing Plugin \u2013 Kiwi","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2018-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f4888e1-98b3-48d9-a2d8-416eae447a32","source":"wordfence","cve":"CVE-2024-5966","title":"Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f4888e1-98b3-48d9-a2d8-416eae447a32?source=api-prod","affected":[{"type":"theme","slug":"grey-opaque","name":"Grey Opaque","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T15:09:23Z","updated":"2024-06-22T03:30:30Z"},{"id":"wordfence:2f499d5e-eb27-4611-af27-ac9fd6a9f044","source":"wordfence","cve":"CVE-2023-48285","title":"Accept Stripe Payments <= 2.0.79 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f499d5e-eb27-4611-af27-ac9fd6a9f044?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.79","to_inclusive":true,"patched_in":"2.0.80"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f4a0b8d-0f3b-4ab1-929e-071b45781ca7","source":"wordfence","cve":"CVE-2012-2633","title":"WassUp Real Time Analytics < 1.8.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f4a0b8d-0f3b-4ab1-929e-071b45781ca7?source=api-prod","affected":[{"type":"plugin","slug":"wassup","name":"WassUp Real Time Analytics","from":"*","from_inclusive":true,"to":"1.8.3.1","to_inclusive":false,"patched_in":"1.8.3.1"}],"published":"2012-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f4e5f34-c107-44da-9f73-e7b25f83e803","source":"wordfence","cve":"CVE-2021-24833","title":"YOP Poll <= 6.3.0 - Author+ Stored Cross-Site Scripting via Preview Module","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f4e5f34-c107-44da-9f73-e7b25f83e803?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2021-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f50874b-5623-4f4f-be50-9a8090a73c4f","source":"wordfence","cve":"CVE-2026-86833","title":"MetForm <= 4.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Emails","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f50874b-5623-4f4f-be50-9a8090a73c4f?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:25:30Z"},{"id":"wordfence:2f516d1d-530b-4902-82c5-916478669232","source":"wordfence","cve":"CVE-2024-25594","title":"MyWaze <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f516d1d-530b-4902-82c5-916478669232?source=api-prod","affected":[{"type":"plugin","slug":"my-waze","name":"MyWaze","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T18:59:17Z"},{"id":"wordfence:2f51c73c-0eea-43b1-afae-ee8e8708a3d3","source":"wordfence","cve":"CVE-2024-35680","title":"YITH WooCommerce Product Add-Ons <= 4.9.2 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f51c73c-0eea-43b1-afae-ee8e8708a3d3?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:36:27Z"},{"id":"wordfence:2f52298b-344b-4561-b1bf-93bea95a3e53","source":"wordfence","cve":"CVE-2023-51412","title":"Piotnet Forms Plugin <= 1.0.28 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f52298b-344b-4561-b1bf-93bea95a3e53?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-23T15:53:00Z"},{"id":"wordfence:2f526f3c-4e9b-4440-b3c3-8541c1be0ba0","source":"wordfence","cve":"CVE-2024-13358","title":"BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f526f3c-4e9b-4440-b3c3-8541c1be0ba0?source=api-prod","affected":[{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.24","to_inclusive":true,"patched_in":"3.4.25"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T03:22:20Z"},{"id":"wordfence:2f533b3a-6d25-4c74-929f-ee4ee3a62926","source":"wordfence","cve":"CVE-2017-18570","title":"cformsII <= 14.12.3 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f533b3a-6d25-4c74-929f-ee4ee3a62926?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"14.13","to_inclusive":false,"patched_in":"14.13"}],"published":"2017-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f557c6e-2fbd-478d-8dc3-cdc550e523b7","source":"wordfence","cve":"CVE-2024-32515","title":"Mega Addons For Elementor <= 1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f557c6e-2fbd-478d-8dc3-cdc550e523b7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-elementor","name":"Mega Addons For Elementor","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-29T21:09:40Z"},{"id":"wordfence:2f58d7e9-3764-4478-82ab-6d21990cd573","source":"wordfence","cve":"CVE-2025-52741","title":"Post Connector <= 1.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f58d7e9-3764-4478-82ab-6d21990cd573?source=api-prod","affected":[{"type":"plugin","slug":"post-connector","name":"Post Connector","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-08-06T00:00:00Z","updated":"2025-10-29T19:31:55Z"},{"id":"wordfence:2f58df1f-66f7-4e3d-af6d-08174653a2ad","source":"wordfence","cve":"CVE-2024-9224","title":"Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f58df1f-66f7-4e3d-af6d-08174653a2ad?source=api-prod","affected":[{"type":"plugin","slug":"hello-world","name":"Hello World","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-04T12:37:09Z"},{"id":"wordfence:2f5962e5-3dc7-4f93-889c-d5e3530c7dba","source":"wordfence","cve":"CVE-2025-12656","title":"Migration, Backup, Staging \u2013 WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion","severity":"low","cvss":3.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5962e5-3dc7-4f93-889c-d5e3530c7dba?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.128","to_inclusive":true,"patched_in":"0.9.129"}],"published":"2026-06-05T10:43:12Z","updated":"2026-06-05T23:28:25Z"},{"id":"wordfence:2f5a8f5b-d67c-4c08-9f2d-1f743ffdae81","source":"wordfence","cve":"CVE-2024-10223","title":"HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5a8f5b-d67c-4c08-9f2d-1f743ffdae81?source=api-prod","affected":[{"type":"plugin","slug":"ht-team-member","name":"WP Team \u2013 WordPress Team Member Plugin","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-10-29T18:09:30Z","updated":"2024-10-30T06:43:36Z"},{"id":"wordfence:2f5b0e3a-037d-42e1-8369-2a74369ec9fc","source":"wordfence","cve":"CVE-2025-22810","title":"Content Blocks Builder <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5b0e3a-037d-42e1-8369-2a74369ec9fc?source=api-prod","affected":[{"type":"plugin","slug":"content-blocks-builder","name":"Content Blocks Builder \u2013 Create blocks, repeater blocks with carousel, grid, popup layouts","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:58:04Z"},{"id":"wordfence:2f5d874a-d70e-4d3f-a9aa-d24707a3f7f4","source":"wordfence","cve":"CVE-2023-35918","title":"WooCommerce Bulk Stock Management <= 2.2.33 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5d874a-d70e-4d3f-a9aa-d24707a3f7f4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bulk-stock-management","name":"WooCommerce Bulk Stock Management","from":"*","from_inclusive":true,"to":"2.2.33","to_inclusive":true,"patched_in":"2.2.34"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f621cfa-d02e-4414-bb1d-6e23da3c92b9","source":"wordfence","cve":"CVE-2024-2263","title":"Themify \u2013 WooCommerce Product Filter <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f621cfa-d02e-4414-bb1d-6e23da3c92b9?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-03-11T00:00:00Z","updated":"2024-04-24T15:16:51Z"},{"id":"wordfence:2f640ae4-b53b-4644-9c47-0d360057c01a","source":"wordfence","cve":"CVE-2025-26586","title":"Events Planner <= 1.3.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f640ae4-b53b-4644-9c47-0d360057c01a?source=api-prod","affected":[{"type":"plugin","slug":"events-planner","name":"Events Planner","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:02:50Z"},{"id":"wordfence:2f6656e2-35f5-41d8-a330-7904c296ba29","source":"wordfence","cve":"CVE-2023-2899","title":"Google Map Shortcode <= 3.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6656e2-35f5-41d8-a330-7904c296ba29?source=api-prod","affected":[{"type":"plugin","slug":"google-map-shortcode","name":"Google Map Shortcode","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f6669aa-e53c-45bb-88c4-2e1350993423","source":"wordfence","cve":"CVE-2023-26326","title":"BuddyForms <= 2.7.7  - PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6669aa-e53c-45bb-88c4-2e1350993423?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f66afc8-8e8f-4802-b2be-a3a706dbf6cb","source":"wordfence","cve":"CVE-2025-58710","title":"Hotel Listing <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f66afc8-8e8f-4802-b2be-a3a706dbf6cb?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listings","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-19T21:58:36Z"},{"id":"wordfence:2f66f2ae-af54-4dfa-9cd2-c7ff3a3e865e","source":"wordfence","cve":"CVE-2017-18011","title":"Affiliate Ads for Clickbank Products < 1.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f66f2ae-af54-4dfa-9cd2-c7ff3a3e865e?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-ads-builder-for-clickbank-products","name":"Affiliate Ads for Clickbank Products","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2017-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f673be3-04fe-4a42-ae50-9cf4fd5e63d5","source":"wordfence","cve":"CVE-2023-0145","title":"Saan World Clock <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f673be3-04fe-4a42-ae50-9cf4fd5e63d5?source=api-prod","affected":[{"type":"plugin","slug":"saan-world-clock","name":"Saan World Clock","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f67da8c-da60-4c77-a8b8-7dfc027662e9","source":"wordfence","cve":"CVE-2025-13741","title":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f67da8c-da60-4c77-a8b8-7dfc027662e9?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-12-15T22:49:04Z","updated":"2025-12-16T11:15:46Z"},{"id":"wordfence:2f6822a9-94b2-47a8-9faa-5e1498e0dbde","source":"wordfence","cve":"CVE-2024-58348","title":"Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6822a9-94b2-47a8-9faa-5e1498e0dbde?source=api-prod","affected":[{"type":"plugin","slug":"background-image-cropper","name":"Background Image Cropper","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-07T00:00:00Z","updated":"2026-07-29T21:36:08Z"},{"id":"wordfence:2f6b3518-1eb0-4cd9-9d5d-4a5a81c90c7f","source":"wordfence","cve":"CVE-2026-68566","title":"BookingPress Appointment Booking Pro <= 6.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6b3518-1eb0-4cd9-9d5d-4a5a81c90c7f?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking-pro","name":"BookingPress Appointment Booking Pro","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.1"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:24:09Z"},{"id":"wordfence:2f6bfe18-bb9b-4cc2-bdb7-fd9163b61323","source":"wordfence","cve":"CVE-2025-4100","title":"Nautic Pages <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6bfe18-bb9b-4cc2-bdb7-fd9163b61323?source=api-prod","affected":[{"type":"plugin","slug":"nautic-pages","name":"Nautic Pages","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-30T18:12:14Z","updated":"2025-05-01T06:40:15Z"},{"id":"wordfence:2f6d43ad-d1b9-4f66-ba08-d0ffc235f7c8","source":"wordfence","cve":"CVE-2024-10634","title":"Nokaut Offers Box <= 1.4.0 - Cross-Site Request Forgery to Plugin Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6d43ad-d1b9-4f66-ba08-d0ffc235f7c8?source=api-prod","affected":[{"type":"plugin","slug":"nokaut-offers-box","name":"Nokaut Offers Box","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-26T00:00:00Z","updated":"2024-11-25T17:20:41Z"},{"id":"wordfence:2f6eb792-aa01-4118-a7b3-e4ef50d6bcaf","source":"wordfence","cve":"CVE-2026-49072","title":"WooCommerce Anti-Fraud <= 7.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6eb792-aa01-4118-a7b3-e4ef50d6bcaf?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-anti-fraud","name":"WooCommerce Anti-Fraud","from":"*","from_inclusive":true,"to":"7.2.6","to_inclusive":true,"patched_in":"7.2.7"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:34:38Z"},{"id":"wordfence:2f6f2f22-dfb6-4ebb-952c-d72d3ea4232e","source":"wordfence","cve":"CVE-2026-107508","title":"Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform < 2.17.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f6f2f22-dfb6-4ebb-952c-d72d3ea4232e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-multisite","name":"Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":false,"patched_in":"2.17.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:38:09Z"},{"id":"wordfence:2f715a80-ec70-4f1e-8ec9-c6f70173e5d7","source":"wordfence","cve":"CVE-2021-38356","title":"NextScripts: Social Networks Auto-Poster <= 4.3.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f715a80-ec70-4f1e-8ec9-c6f70173e5d7?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"4.3.21"}],"published":"2021-11-28T10:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f715ba3-7f86-42b7-81fc-3bbaa76ae671","source":"wordfence","cve":"CVE-2026-66596","title":"Newsletter \u2013 Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f715ba3-7f86-42b7-81fc-3bbaa76ae671?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.3.3","to_inclusive":true,"patched_in":"9.3.4"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:27:05Z"},{"id":"wordfence:2f72c94f-b0b6-464b-8bc7-df3d75b22edb","source":"wordfence","cve":"","title":"Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f72c94f-b0b6-464b-8bc7-df3d75b22edb?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":false,"patched_in":"4.5"}],"published":"2014-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f72e5bb-e076-4379-8699-e399761c043f","source":"wordfence","cve":"CVE-2023-51525","title":"WP Simple Booking Calendar <= 2.0.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f72e5bb-e076-4379-8699-e399761c043f?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-booking-calendar","name":"WP Simple Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.8.4","to_inclusive":true,"patched_in":"2.0.8.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f760821-98d4-4154-a4ae-861283f991f8","source":"wordfence","cve":"CVE-2023-25463","title":"wp tell a friend popup form <= 7.1 - Cross-Site Request Forgery via 'TellAFriend_admin'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f760821-98d4-4154-a4ae-861283f991f8?source=api-prod","affected":[{"type":"plugin","slug":"wp-tell-a-friend-popup-form","name":"wp tell a friend popup form","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f785211-655d-4997-8f1c-499274bdf59d","source":"wordfence","cve":"CVE-2026-114177","title":"Xpro Addons \u2014 150+ Widgets for Elementor <= 1.7.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f785211-655d-4997-8f1c-499274bdf59d?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2026-10-22T06:49:00Z","updated":"2026-10-23T18:54:16Z"},{"id":"wordfence:2f796373-7116-4fd3-9d53-5f520e6e1a0c","source":"wordfence","cve":"CVE-2026-7566","title":"LearnPress \u2013 Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f796373-7116-4fd3-9d53-5f520e6e1a0c?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2026-06-05T13:35:10Z","updated":"2026-06-06T02:28:35Z"},{"id":"wordfence:2f79778c-c11a-4d98-bc26-8113c3fef630","source":"wordfence","cve":"CVE-2024-12557","title":"Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f79778c-c11a-4d98-bc26-8113c3fef630?source=api-prod","affected":[{"type":"plugin","slug":"transportersio","name":"Transporters.io","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-01-06T15:07:10Z","updated":"2025-01-10T13:59:31Z"},{"id":"wordfence:2f7c1848-d49f-4f34-8869-3ddbdccdc38f","source":"wordfence","cve":"CVE-2022-29425","title":"Checkout Files Upload for WooCommerce <= 2.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7c1848-d49f-4f34-8869-3ddbdccdc38f?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2022-05-04T06:49:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f7d7ceb-b6f0-4b63-93f7-632c13a6b496","source":"wordfence","cve":"CVE-2022-1299","title":"Slideshow <= 2.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7d7ceb-b6f0-4b63-93f7-632c13a6b496?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-jquery-image-gallery","name":"Slideshow","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2026-03-27T11:02:54Z"},{"id":"wordfence:2f7ddb34-cb5b-4089-bd3e-07056f0b6bd5","source":"wordfence","cve":"CVE-2024-9356","title":"Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7ddb34-cb5b-4089-bd3e-07056f0b6bd5?source=api-prod","affected":[{"type":"plugin","slug":"yotpo-social-reviews-for-woocommerce","name":"Yotpo Product Reviews","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.7.10"}],"published":"2024-11-14T16:36:30Z","updated":"2024-11-15T16:22:27Z"},{"id":"wordfence:2f7e7b03-e709-44b6-8ff9-f2f0b3836629","source":"wordfence","cve":"CVE-2025-26927","title":"AI Hub - Startup & Technology WordPress Theme <= 1.3.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7e7b03-e709-44b6-8ff9-f2f0b3836629?source=api-prod","affected":[{"type":"theme","slug":"aihub","name":"AI Hub - Startup & Technology WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-04-10T00:00:00Z","updated":"2026-03-17T21:21:38Z"},{"id":"wordfence:2f7f5dc8-8cf7-493d-b012-89ff36a4dc02","source":"wordfence","cve":"CVE-2026-118066","title":"Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7f5dc8-8cf7-493d-b012-89ff36a4dc02?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2026-11-06T22:55:13Z","updated":"2026-11-07T11:26:26Z"},{"id":"wordfence:2f80c3b9-5148-42eb-9137-9c538184cda3","source":"wordfence","cve":"CVE-2015-10136","title":"GI-Media Library < 3.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f80c3b9-5148-42eb-9137-9c538184cda3?source=api-prod","affected":[{"type":"plugin","slug":"gi-media-library","name":"GI-Media Library","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2015-01-15T00:00:00Z","updated":"2025-07-19T09:23:51Z"},{"id":"wordfence:2f835944-fd27-4f7e-a10d-330fd0fe4ff4","source":"wordfence","cve":"CVE-2022-47602","title":"WP Table Manager <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f835944-fd27-4f7e-a10d-330fd0fe4ff4?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-manager","name":"WP Table Manager","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f8714e2-43eb-441f-81a0-5abdb35c9115","source":"wordfence","cve":"CVE-2026-84045","title":"E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8714e2-43eb-441f-81a0-5abdb35c9115?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:00:19Z"},{"id":"wordfence:2f881298-23f3-471c-b6f1-ebaf72d7180e","source":"wordfence","cve":"CVE-2026-32451","title":"Avada (Fusion) Builder < 3.15.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f881298-23f3-471c-b6f1-ebaf72d7180e?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":false,"patched_in":"3.15.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:44:47Z"},{"id":"wordfence:2f88fb4d-8f19-40cd-80ac-b25339b3364a","source":"wordfence","cve":"CVE-2026-115957","title":"Discussion Board \u2013 WordPress Forum Plugin <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f88fb4d-8f19-40cd-80ac-b25339b3364a?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-10-26T12:13:42Z","updated":"2026-11-03T19:28:34Z"},{"id":"wordfence:2f89bb45-2872-4081-a3b8-a1f11bbdbc55","source":"wordfence","cve":"CVE-2024-3021","title":"Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f89bb45-2872-4081-a3b8-a1f11bbdbc55?source=api-prod","affected":[{"type":"plugin","slug":"mhr-post-ticker","name":"Mhr Post Ticker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:51:55Z"},{"id":"wordfence:2f8b8bfe-8d73-4289-b212-7baf7bceaaf6","source":"wordfence","cve":"CVE-2026-75982","title":"LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8b8bfe-8d73-4289-b212-7baf7bceaaf6?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2026-08-24T13:28:13Z","updated":"2026-08-25T02:26:50Z"},{"id":"wordfence:2f8cb7d7-eb40-403e-85de-c16200ee424d","source":"wordfence","cve":"CVE-2025-13739","title":"CryptX <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8cb7d7-eb40-403e-85de-c16200ee424d?source=api-prod","affected":[{"type":"plugin","slug":"cryptx","name":"CryptX","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2025-12-04T20:35:36Z","updated":"2025-12-11T14:56:56Z"},{"id":"wordfence:2f8dcbd2-af51-4cc9-9962-53fe644985e1","source":"wordfence","cve":"CVE-2023-45647","title":"Constant Contact Forms by MailMunch <= 2.0.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8dcbd2-af51-4cc9-9962-53fe644985e1?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms-by-mailmunch","name":"Constant Contact Forms by MailMunch","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f8f6ade-84a2-4a42-9208-a74f5ebe19b3","source":"wordfence","cve":"CVE-2016-4828","title":"Welcart e-Commerce <= 1.8.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8f6ade-84a2-4a42-9208-a74f5ebe19b3?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2016-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f905c0b-6b70-42bf-bf48-6f4eb785bfb8","source":"wordfence","cve":"CVE-2022-1687","title":"Logo Slider <= 1.4.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f905c0b-6b70-42bf-bf48-6f4eb785bfb8?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider","name":"Logo Slider","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f91a7c3-ee0e-48e9-aa5f-dfc1160bbc09","source":"wordfence","cve":"CVE-2026-12093","title":"Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f91a7c3-ee0e-48e9-aa5f-dfc1160bbc09?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-06-17T16:52:42Z","updated":"2026-06-18T05:34:27Z"},{"id":"wordfence:2f935b4e-31fc-4060-b733-457c4e1b94c8","source":"wordfence","cve":"CVE-2024-51611","title":"WP Feature Box <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f935b4e-31fc-4060-b733-457c4e1b94c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-feature-box","name":"WP Feature Box","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:21:13Z"},{"id":"wordfence:2f9577c6-7694-45d9-a759-e1f67996b608","source":"wordfence","cve":"CVE-2025-62942","title":"WP Mapbox GL JS Maps <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9577c6-7694-45d9-a759-e1f67996b608?source=api-prod","affected":[{"type":"plugin","slug":"wp-mapbox-gl-js","name":"WP Mapbox GL JS Maps","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:52:00Z"},{"id":"wordfence:2f975d32-a008-46a9-bc00-420610464ecb","source":"wordfence","cve":"CVE-2015-9332","title":"WordPress Uninstall <= 1.2.1 - Cross-Site Request Forgery to Site Reset","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f975d32-a008-46a9-bc00-420610464ecb?source=api-prod","affected":[{"type":"plugin","slug":"uninstall","name":"WordPress Uninstall","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2015-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f9853a2-c378-42bf-a12b-392823750942","source":"wordfence","cve":"CVE-2022-32289","title":"Popup Builder <= 4.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9853a2-c378-42bf-a12b-392823750942?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f99da73-1db9-43ee-ac74-b772882baf15","source":"wordfence","cve":"CVE-2025-14142","title":"Electric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f99da73-1db9-43ee-ac74-b772882baf15?source=api-prod","affected":[{"type":"plugin","slug":"electric-enquiries","name":"Electric Enquiries","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T20:48:35Z","updated":"2026-02-27T09:23:43Z"},{"id":"wordfence:2f9a3883-9755-4de8-9d60-113238b3c0ac","source":"wordfence","cve":"CVE-2023-48743","title":"Simply Exclude <= 2.0.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9a3883-9755-4de8-9d60-113238b3c0ac?source=api-prod","affected":[{"type":"plugin","slug":"simply-exclude","name":"Simply Exclude","from":"*","from_inclusive":true,"to":"2.0.6.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2f9a783a-8495-4410-b350-4b8299880a64","source":"wordfence","cve":"CVE-2026-108066","title":"WP 2FA \u2013 Two-factor authentication for WordPress < 4.2.0 - Authenticated (Administrator+) Insecure Direct Object Reference","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9a783a-8495-4410-b350-4b8299880a64?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:41:28Z"},{"id":"wordfence:2f9c190b-a52d-45d1-beed-631bf5704cc9","source":"wordfence","cve":"CVE-2026-24969","title":"Instant VA <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9c190b-a52d-45d1-beed-631bf5704cc9?source=api-prod","affected":[{"type":"theme","slug":"instantva","name":"Instant VA - Virtual Assistant Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:31:17Z"},{"id":"wordfence:2f9eea0d-9676-4ab3-aa78-946ef92af4b8","source":"wordfence","cve":"CVE-2026-94167","title":"Kubio AI Page Builder <= 2.9.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9eea0d-9676-4ab3-aa78-946ef92af4b8?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-13T17:01:27Z"},{"id":"wordfence:2f9faa56-c550-465f-b0b0-8bf58f5e8d7a","source":"wordfence","cve":"CVE-2026-14498","title":"Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9faa56-c550-465f-b0b0-8bf58f5e8d7a?source=api-prod","affected":[{"type":"plugin","slug":"query-wrangler","name":"Query Wrangler","from":"*","from_inclusive":true,"to":"1.5.57","to_inclusive":true,"patched_in":"1.5.58"}],"published":"2026-08-15T16:17:48Z","updated":"2026-08-16T04:24:50Z"},{"id":"wordfence:2fa13ee0-0aee-4929-9bd0-a1375e002d26","source":"wordfence","cve":"CVE-2026-76058","title":"PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa13ee0-0aee-4929-9bd0-a1375e002d26?source=api-prod","affected":[{"type":"plugin","slug":"paypal-brasil-para-woocommerce","name":"PayPal Brasil para WooCommerce","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2026-10-27T18:10:57Z","updated":"2026-10-28T06:45:09Z"},{"id":"wordfence:2fa19840-04a0-4aa8-83c4-d0dca4e72e36","source":"wordfence","cve":"CVE-2025-48164","title":"SureDash <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa19840-04a0-4aa8-83c4-d0dca4e72e36?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T20:25:03Z"},{"id":"wordfence:2fa2fcda-69f4-4095-b23c-6e6f1613adb0","source":"wordfence","cve":"CVE-2023-23802","title":"HT Easy GA4 ( Google Analytics 4 ) <= 1.0.6 - Cross-Site Request Forgery via plugin_activation","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa2fcda-69f4-4095-b23c-6e6f1613adb0?source=api-prod","affected":[{"type":"plugin","slug":"ht-easy-google-analytics","name":"HT Easy GA4 \u2013 Google Analytics WordPress Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fa59f00-49f5-43ff-b3fe-0a62f52b0257","source":"wordfence","cve":"CVE-2026-34901","title":"iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa59f00-49f5-43ff-b3fe-0a62f52b0257?source=api-prod","affected":[{"type":"plugin","slug":"worpit-admin-dashboard-plugin","name":"iControlWP","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:27:50Z"},{"id":"wordfence:2fa5ae9a-532c-40f9-b70a-217f0f9cd473","source":"wordfence","cve":"CVE-2026-4060","title":"Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-05T13:56:02Z"},{"id":"wordfence:2fa62862-5b98-4864-9bf1-4e05deedeb9d","source":"wordfence","cve":"CVE-2022-29422","title":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock <= 2.3.2 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa62862-5b98-4864-9bf1-4e05deedeb9d?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-04-28T11:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fa6d06d-7323-42d1-94ef-9dfda9c166c4","source":"wordfence","cve":"CVE-2026-14300","title":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa6d06d-7323-42d1-94ef-9dfda9c166c4?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":false,"patched_in":"7.8.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-08-07T18:22:18Z"},{"id":"wordfence:2faab64f-49b9-478b-a678-b7812b915d1e","source":"wordfence","cve":"CVE-2026-62000","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.8.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2faab64f-49b9-478b-a678-b7812b915d1e?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:44:00Z"},{"id":"wordfence:2facf62b-33cf-4438-a501-f96730077fa2","source":"wordfence","cve":"CVE-2020-24315","title":"WordPress Poll <= 36 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2facf62b-33cf-4438-a501-f96730077fa2?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-wordpress-poll","name":"WordPress Poll","from":"*","from_inclusive":true,"to":"36","to_inclusive":true,"patched_in":""}],"published":"2020-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fb28dab-1c65-47da-98f7-9eecf5f7466d","source":"wordfence","cve":"CVE-2022-4477","title":"Smash Balloon Social Post Feed <= 4.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb28dab-1c65-47da-98f7-9eecf5f7466d?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fb2b577-417c-4a41-881e-9a6d735f9e75","source":"wordfence","cve":"CVE-2026-111831","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb2b577-417c-4a41-881e-9a6d735f9e75?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.15","to_inclusive":true,"patched_in":"6.2.16"}],"published":"2026-10-19T12:24:00Z","updated":"2026-10-23T18:44:26Z"},{"id":"wordfence:2fb44c6e-520e-4a9f-9987-8b770feb710d","source":"wordfence","cve":"CVE-2025-2294","title":"Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb44c6e-520e-4a9f-9987-8b770feb710d?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-03-27T16:22:14Z","updated":"2025-03-28T04:22:42Z"},{"id":"wordfence:2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7","source":"wordfence","cve":"CVE-2026-92797","title":"Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb6cdd0-cd48-49a5-b998-f1c3fbdc25f7?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":"1.14.2"}],"published":"2026-10-27T00:00:00Z","updated":"2026-10-28T07:48:29Z"},{"id":"wordfence:2fb9dc9f-1ba5-4a2c-bead-3c3a6deb61b1","source":"wordfence","cve":"CVE-2023-2634","title":"Get Your Number <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb9dc9f-1ba5-4a2c-bead-3c3a6deb61b1?source=api-prod","affected":[{"type":"plugin","slug":"get-your-number","name":"Get your number","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fbacaf2-0b3e-4d1e-adc3-c501a6c4c816","source":"wordfence","cve":"CVE-2024-1056","title":"Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fbacaf2-0b3e-4d1e-adc3-c501a6c4c816?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder-pro","name":"FunnelKit Funnel Builder Pro","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-08-28T15:12:23Z","updated":"2024-08-29T13:52:56Z"},{"id":"wordfence:2fbeee6b-cbc0-462e-96ba-2fd4f54786b0","source":"wordfence","cve":"CVE-2023-45007","title":"Fotomoto <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fbeee6b-cbc0-462e-96ba-2fd4f54786b0?source=api-prod","affected":[{"type":"plugin","slug":"fotomoto","name":"Fotomoto","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fc69243-2d28-4224-950e-c2ac36675f49","source":"wordfence","cve":"CVE-2025-53462","title":"SAPO Feed <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fc69243-2d28-4224-950e-c2ac36675f49?source=api-prod","affected":[{"type":"plugin","slug":"sapo-feed","name":"SAPO Feed","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T14:29:05Z"},{"id":"wordfence:2fc806fe-bf12-4e70-84a2-2027102e5b9b","source":"wordfence","cve":"CVE-2023-0070","title":"ResponsiveVoice Text To Speech <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fc806fe-bf12-4e70-84a2-2027102e5b9b?source=api-prod","affected":[{"type":"plugin","slug":"responsivevoice-text-to-speech","name":"ResponsiveVoice Text To Speech","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fca8dba-9fe7-4ce1-8903-589e42e5604d","source":"wordfence","cve":"CVE-2019-9978","title":"Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fca8dba-9fe7-4ce1-8903-589e42e5604d?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2019-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fcbd6c5-dd03-439c-b6b8-54b0c24a1c27","source":"wordfence","cve":"CVE-2013-2008","title":"WP Super Cache Plugin <= 1.3 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fcbd6c5-dd03-439c-b6b8-54b0c24a1c27?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fcef7c3-25a5-44e1-96c1-68e67e59f18b","source":"wordfence","cve":"CVE-2024-51582","title":"WP Hotel Booking <= 2.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fcef7c3-25a5-44e1-96c1-68e67e59f18b?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-10-31T00:00:00Z","updated":"2026-04-14T14:30:52Z"},{"id":"wordfence:2fd0073c-3f75-4783-838d-d01fdea008c1","source":"wordfence","cve":"","title":"PDF File Browser <= 1.3 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd0073c-3f75-4783-838d-d01fdea008c1?source=api-prod","affected":[{"type":"plugin","slug":"pdw-file-browser","name":"PDF File Browser","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2020-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fd2dffd-efc9-47f7-8495-50be2b80331f","source":"wordfence","cve":"CVE-2026-42728","title":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd2dffd-efc9-47f7-8495-50be2b80331f?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:31:15Z"},{"id":"wordfence:2fd58397-7598-4d98-a6b3-c5837cb3b73e","source":"wordfence","cve":"","title":"WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update","severity":"critical","cvss":9.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd58397-7598-4d98-a6b3-c5837cb3b73e?source=api-prod","affected":[{"type":"plugin","slug":"honeypot","name":"WP Armour \u2013 Honeypot Anti Spam","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fd62521-78c9-4728-852c-5781e9e933af","source":"wordfence","cve":"CVE-2026-116388","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd62521-78c9-4728-852c-5781e9e933af?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2026-10-26T16:42:00Z","updated":"2026-10-28T01:26:23Z"},{"id":"wordfence:2fd67fe3-199b-418c-925e-e2c9e6abe97a","source":"wordfence","cve":"CVE-2025-25174","title":"BeeTeam368 Extensions <= 1.9.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd67fe3-199b-418c-925e-e2c9e6abe97a?source=api-prod","affected":[{"type":"plugin","slug":"beeteam368-extensions","name":"BeeTeam368 Extensions","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:21:10Z"},{"id":"wordfence:2fd7d6af-a938-4106-aed2-12b9a5454da9","source":"wordfence","cve":"CVE-2005-10002","title":"secure-files <= 1.1 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd7d6af-a938-4106-aed2-12b9a5454da9?source=api-prod","affected":[{"type":"plugin","slug":"secure-files","name":"secure-files","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2005-10-03T00:00:00Z","updated":"2024-02-07T14:53:53Z"},{"id":"wordfence:2fd8c981-081c-4671-ad1e-3caf004669dd","source":"wordfence","cve":"CVE-2025-12721","title":"g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fd8c981-081c-4671-ad1e-3caf004669dd?source=api-prod","affected":[{"type":"plugin","slug":"g-ffl-cockpit","name":"g-FFL Cockpit","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-12-05T17:38:38Z","updated":"2025-12-09T22:01:20Z"},{"id":"wordfence:2fda47d8-8e8c-4103-aabb-c70935e13450","source":"wordfence","cve":"CVE-2026-15663","title":"Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fda47d8-8e8c-4103-aabb-c70935e13450?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.9","to_inclusive":true,"patched_in":"3.14.10"}],"published":"2026-07-23T21:25:12Z","updated":"2026-07-24T09:31:46Z"},{"id":"wordfence:2fdc32a4-adf8-4174-924b-5d0b763d010c","source":"wordfence","cve":"CVE-2023-6565","title":"InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.9,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdc32a4-adf8-4174-924b-5d0b763d010c?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.3.1"}],"published":"2024-02-08T00:00:00Z","updated":"2024-07-29T21:36:06Z"},{"id":"wordfence:2fdc57ee-7923-4eae-a69d-2a8a53b5f841","source":"wordfence","cve":"CVE-2023-35051","title":"WordPress Contact Forms by Cimatti <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdc57ee-7923-4eae-a69d-2a8a53b5f841?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-06-13T00:00:00Z","updated":"2025-01-17T13:12:42Z"},{"id":"wordfence:2fdd3061-b490-4be2-bc7e-82ca124ee8a3","source":"wordfence","cve":"CVE-2025-47446","title":"Listamester <= 2.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdd3061-b490-4be2-bc7e-82ca124ee8a3?source=api-prod","affected":[{"type":"plugin","slug":"listamester","name":"Listamester","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:36:59Z"},{"id":"wordfence:2fdf2020-ad80-44c3-89b6-fc2ba067cd33","source":"wordfence","cve":"CVE-2024-4865","title":"Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fdf2020-ad80-44c3-89b6-fc2ba067cd33?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2024-05-17T14:41:17Z","updated":"2024-05-18T03:15:57Z"},{"id":"wordfence:2fe0eae5-ee2a-4485-b24e-ba3ed9cdf20d","source":"wordfence","cve":"CVE-2026-96962","title":"Pie Register <= 3.8.4.13 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe0eae5-ee2a-4485-b24e-ba3ed9cdf20d?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.13","to_inclusive":true,"patched_in":"3.8.4.14"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:55:58Z"},{"id":"wordfence:2fe11179-6e18-44ae-a5f9-334e334cff73","source":"wordfence","cve":"CVE-2024-2310","title":"WP Google Review Slider <= 13.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe11179-6e18-44ae-a5f9-334e334cff73?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"13.5","to_inclusive":true,"patched_in":"13.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-22T14:23:12Z"},{"id":"wordfence:2fe166a9-8e80-4bb9-8074-5404289f5685","source":"wordfence","cve":"CVE-2024-11228","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe166a9-8e80-4bb9-8074-5404289f5685?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2024-11-22T23:37:26Z","updated":"2024-11-23T11:39:48Z"},{"id":"wordfence:2fe1f429-f8de-4621-8f33-cfdc5be63bc2","source":"wordfence","cve":"CVE-2026-114181","title":"E-cab Taxi Booking Manager for Woocommerce <= 2.1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe1f429-f8de-4621-8f33-cfdc5be63bc2?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-10-29T14:28:00Z","updated":"2026-11-03T19:24:17Z"},{"id":"wordfence:2fe34989-493c-4883-a1ca-454262919202","source":"wordfence","cve":"","title":"Yoast SEO <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe34989-493c-4883-a1ca-454262919202?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fe44e46-dfbf-4286-889c-606280d62218","source":"wordfence","cve":"CVE-2024-24838","title":"Five Star Restaurant Reviews <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Review URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe44e46-dfbf-4286-889c-606280d62218?source=api-prod","affected":[{"type":"plugin","slug":"good-reviews-wp","name":"Five Star Restaurant Reviews","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T20:48:05Z"},{"id":"wordfence:2fe46309-76a7-4f23-996d-0e5dd8e9926a","source":"wordfence","cve":"CVE-2026-27390","title":"WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authenticated (Subscriber+) Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe46309-76a7-4f23-996d-0e5dd8e9926a?source=api-prod","affected":[{"type":"plugin","slug":"wedesigntech-ultimate-booking-addon","name":"WeDesignTech Ultimate Booking Addon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:00:16Z"},{"id":"wordfence:2fe467fb-f5b2-4e4b-8048-669dce354ace","source":"wordfence","cve":"CVE-2025-30884","title":"Bit Integrations <= 2.4.10 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe467fb-f5b2-4e4b-8048-669dce354ace?source=api-prod","affected":[{"type":"plugin","slug":"bit-integrations","name":"Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:54:21Z"},{"id":"wordfence:2fe8c203-e86f-4dee-8faa-06b0cae86bfc","source":"wordfence","cve":"CVE-2026-66478","title":"Church Admin <= 5.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fe8c203-e86f-4dee-8faa-06b0cae86bfc?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:06:05Z"},{"id":"wordfence:2fea26e3-365d-4f3b-8d38-fc315befbbac","source":"wordfence","cve":"CVE-2025-49898","title":"School Management <= 93.2.0 - Authenticated (Support staff+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fea26e3-365d-4f3b-8d38-fc315befbbac?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:06:39Z"},{"id":"wordfence:2feabc97-0463-4e50-91a8-234445ca2504","source":"wordfence","cve":"CVE-2023-49739","title":"PowerPack Pro for Elementor <= 2.9.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2feabc97-0463-4e50-91a8-234445ca2504?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.23","to_inclusive":true,"patched_in":"2.9.24"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2fef8861-e992-474b-b006-ebb3cb8e4cf4","source":"wordfence","cve":"CVE-2024-49237","title":"Ahmeti Wp Timeline <= 5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fef8861-e992-474b-b006-ebb3cb8e4cf4?source=api-prod","affected":[{"type":"plugin","slug":"ahmeti-wp-timeline","name":"Ahmeti Wp Timeline","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:33:11Z"},{"id":"wordfence:2fefcc8c-3864-4764-86e7-678d8604fd67","source":"wordfence","cve":"","title":"Ricerca smart and advanced search <= 1.0.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2fefcc8c-3864-4764-86e7-678d8604fd67?source=api-prod","affected":[{"type":"plugin","slug":"ricerca-smart-search","name":"Ricerca \u2013 advanced search","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ff01a2b-465d-4304-ae80-79b5e7bc2a00","source":"wordfence","cve":"CVE-2026-88997","title":"JSM Show Post Metadata <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff01a2b-465d-4304-ae80-79b5e7bc2a00?source=api-prod","affected":[{"type":"plugin","slug":"jsm-show-post-meta","name":"JSM Show Post Metadata","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:41:07Z"},{"id":"wordfence:2ff175f1-102a-46f4-86d9-6acfe867f5bf","source":"wordfence","cve":"CVE-2026-39757","title":"Taskbot <= 6.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff175f1-102a-46f4-86d9-6acfe867f5bf?source=api-prod","affected":[{"type":"plugin","slug":"taskbot","name":"Taskbot","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:44:32Z","updated":"2026-10-08T23:26:54Z"},{"id":"wordfence:2ff30e1f-bb02-441c-bda7-af3fe9d4b5d8","source":"wordfence","cve":"CVE-2026-27361","title":"Responsive Posts Carousel WordPress Plugin <= 15.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff30e1f-bb02-441c-bda7-af3fe9d4b5d8?source=api-prod","affected":[{"type":"plugin","slug":"responsive-posts-carousel-pro","name":"Responsive Posts Carousel WordPress Plugin","from":"*","from_inclusive":true,"to":"15.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:45:12Z"},{"id":"wordfence:2ff3d390-ad00-4233-ab25-f1afb679300e","source":"wordfence","cve":"CVE-2026-85235","title":"Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff3d390-ad00-4233-ab25-f1afb679300e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-30T20:25:18Z","updated":"2026-10-01T08:28:42Z"},{"id":"wordfence:2ff43e5d-bffd-4e2b-a6de-938559cd6f02","source":"wordfence","cve":"CVE-2023-0173","title":"WPFunnels <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff43e5d-bffd-4e2b-a6de-938559cd6f02?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ff5094a-8cf2-4c18-921d-7ec31d60c13a","source":"wordfence","cve":"CVE-2024-6665","title":"KBucket: Your Curated Content in WordPress <= 4.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff5094a-8cf2-4c18-921d-7ec31d60c13a?source=api-prod","affected":[{"type":"plugin","slug":"kbucket","name":"KBucket: Your Curated Content in WordPress","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-23T15:39:03Z"},{"id":"wordfence:2ff7ab4f-bb00-4443-a06b-f61c53da9876","source":"wordfence","cve":"CVE-2024-10555","title":"WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Button Width","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff7ab4f-bb00-4443-a06b-f61c53da9876?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2024-11-29T00:00:00Z","updated":"2024-12-23T19:20:36Z"},{"id":"wordfence:2ff83bf5-369f-43b9-b073-daf0de9051c7","source":"wordfence","cve":"","title":"Zephyr Project Manager <= 3.2.42 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff83bf5-369f-43b9-b073-daf0de9051c7?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ff866c0-1b4c-4ad8-bde3-353ed0f44f42","source":"wordfence","cve":"CVE-2016-10938","title":"copy-me <= 1.0.0 - Missing Authorization & Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff866c0-1b4c-4ad8-bde3-353ed0f44f42?source=api-prod","affected":[{"type":"plugin","slug":"copy-me","name":"copy-me","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2016-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:2ff9570f-fca5-4e10-80ae-822608b6dd9d","source":"wordfence","cve":"CVE-2026-57390","title":"Extra Product Options Builder for WooCommerce <= 1.2.167 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff9570f-fca5-4e10-80ae-822608b6dd9d?source=api-prod","affected":[{"type":"plugin","slug":"additional-product-fields-for-woocommerce","name":"Extra Product Options Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.167","to_inclusive":true,"patched_in":"1.2.168"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-29T23:04:42Z"},{"id":"wordfence:2ffd6393-6604-48d9-ba22-7d989305e9ed","source":"wordfence","cve":"CVE-2026-3594","title":"Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2ffd6393-6604-48d9-ba22-7d989305e9ed?source=api-prod","affected":[{"type":"plugin","slug":"riaxe-product-customizer","name":"Riaxe Product Customizer","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:29Z","updated":"2026-04-08T06:43:38Z"},{"id":"wordfence:3000758d-68e0-46a6-aef0-e2407a828168","source":"wordfence","cve":"CVE-2024-9772","title":"Uix Shortcodes \u2013 Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3000758d-68e0-46a6-aef0-e2407a828168?source=api-prod","affected":[{"type":"plugin","slug":"uix-shortcodes","name":"Uix Shortcodes","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-10-25T20:38:38Z","updated":"2024-12-12T18:47:09Z"},{"id":"wordfence:3000b140-2e38-463d-9128-b486293e3cf6","source":"wordfence","cve":"CVE-2023-52119","title":"Icegram <= 3.1.18 - Cross-Site Request Forgery via save_campaign_preview","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3000b140-2e38-463d-9128-b486293e3cf6?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.18","to_inclusive":true,"patched_in":"3.1.19"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3001829b-f63b-4b99-91a0-53d615ac96c1","source":"wordfence","cve":"CVE-2023-47832","title":"SearchIQ <= 4.4 - Missing Authorization via getSIQPluginSettings","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3001829b-f63b-4b99-91a0-53d615ac96c1?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3002e25d-5cd4-4af1-a84a-08cb42aa533c","source":"wordfence","cve":"CVE-2026-87973","title":"If-So Dynamic Content 1.9.9 - 1.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3002e25d-5cd4-4af1-a84a-08cb42aa533c?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"1.9.9","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T13:25:58Z"},{"id":"wordfence:3003bd3b-aee5-4bac-9a62-e747f544d2bd","source":"wordfence","cve":"","title":"Dave's WordPress Live Search <= 4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3003bd3b-aee5-4bac-9a62-e747f544d2bd?source=api-prod","affected":[{"type":"plugin","slug":"daves-wordpress-live-search","name":"Dave&#039;s WordPress Live Search","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":false,"patched_in":"4.6"}],"published":"2017-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3005c53e-eb09-479f-a4e4-b8d40583d80d","source":"wordfence","cve":"CVE-2023-0078","title":"Resume Builder <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3005c53e-eb09-479f-a4e4-b8d40583d80d?source=api-prod","affected":[{"type":"plugin","slug":"resume-builder","name":"Resume Builder","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-02-13T00:00:00Z","updated":"2024-05-30T15:36:09Z"},{"id":"wordfence:3006261b-a09e-4cff-b49f-49e992c6fe0b","source":"wordfence","cve":"CVE-2026-13450","title":"GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3006261b-a09e-4cff-b49f-49e992c6fe0b?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.4","to_inclusive":true,"patched_in":"7.9.5"}],"published":"2026-07-08T19:22:27Z","updated":"2026-07-09T07:55:12Z"},{"id":"wordfence:30079059-be5e-4f1c-a398-b2a0cf5d7669","source":"wordfence","cve":"CVE-2026-22327","title":"Restaurt <= 1.0.4 - Authenticated (subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30079059-be5e-4f1c-a398-b2a0cf5d7669?source=api-prod","affected":[{"type":"theme","slug":"restaurt","name":"Restaurt","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T14:58:35Z"},{"id":"wordfence:300b24af-10a1-45b9-87ec-7c98dc94e76b","source":"wordfence","cve":"CVE-2023-6988","title":"Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/300b24af-10a1-45b9-87ec-7c98dc94e76b?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.239","to_inclusive":true,"patched_in":"1.0.240"}],"published":"2023-12-23T00:00:00Z","updated":"2024-07-29T21:36:07Z"},{"id":"wordfence:300b4de6-e856-4562-8468-58c4317378d8","source":"wordfence","cve":"CVE-2026-77793","title":"RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/300b4de6-e856-4562-8468-58c4317378d8?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.8","to_inclusive":true,"patched_in":"6.0.9.9"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-10T19:29:40Z"},{"id":"wordfence:300c6ea4-4eed-4be5-abfd-ec4ad9b741d3","source":"wordfence","cve":"","title":"WordPress Core < 6.0.2 - Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/300c6ea4-4eed-4be5-abfd-ec4ad9b741d3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.36","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.32","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.28","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.27","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.26","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.19","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.20","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.16","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.13","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.12","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"3.7.39"}],"published":"2022-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:300da4da-a3d4-4a64-80c2-4bb37ea64f5e","source":"wordfence","cve":"CVE-2025-53203","title":"WooCommerce PDF Invoice Builder <= 1.2.148 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/300da4da-a3d4-4a64-80c2-4bb37ea64f5e?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.148","to_inclusive":true,"patched_in":"1.2.149"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:29:44Z"},{"id":"wordfence:3011b783-e4b4-45d2-81af-2f8d166a30ac","source":"wordfence","cve":"CVE-2024-2750","title":"Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3011b783-e4b4-45d2-81af-2f8d166a30ac?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.3","to_inclusive":true,"patched_in":"2.6.9.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:56Z"},{"id":"wordfence:3011befd-c0c6-4800-a370-e592c3ec483f","source":"wordfence","cve":"CVE-2024-8241","title":"Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3011befd-c0c6-4800-a370-e592c3ec483f?source=api-prod","affected":[{"type":"plugin","slug":"nova-blocks","name":"Nova Blocks by Pixelgrade","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-09-09T20:42:04Z","updated":"2024-09-10T09:30:19Z"},{"id":"wordfence:3011f85c-fa30-4ccf-b067-dba45e491acb","source":"wordfence","cve":"CVE-2018-11526","title":"WordPress Comments Import & Export <= 2.0.4 - CSV Injection","severity":"medium","cvss":6.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3011f85c-fa30-4ccf-b067-dba45e491acb?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2018-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30147e39-af94-4620-870b-71a0a46b7509","source":"wordfence","cve":"CVE-2025-10744","title":"File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30147e39-af94-4620-870b-71a0a46b7509?source=api-prod","affected":[{"type":"plugin","slug":"softdiscover-db-file-manager","name":"File Manager, Code Editor, and Backup by Managefy","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-14T16:12:09Z"},{"id":"wordfence:301a67a5-226c-413a-9198-66747d1b1fd3","source":"wordfence","cve":"CVE-2024-6125","title":"Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/301a67a5-226c-413a-9198-66747d1b1fd3?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.34","to_inclusive":true,"patched_in":"1.7.35"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T02:01:21Z"},{"id":"wordfence:301ad19a-f99c-45c8-83a7-d74e1a260556","source":"wordfence","cve":"CVE-2026-15070","title":"Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/301ad19a-f99c-45c8-83a7-d74e1a260556?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.32","to_inclusive":true,"patched_in":"10.30.33"}],"published":"2026-07-09T15:29:46Z","updated":"2026-07-10T03:31:12Z"},{"id":"wordfence:301d273e-5cd2-49b8-b2ce-b30731ab4550","source":"wordfence","cve":"CVE-2022-0706","title":"Easy Digital Downloads <= 2.11.5 - Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/301d273e-5cd2-49b8-b2ce-b30731ab4550?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.11.6","to_inclusive":false,"patched_in":"2.11.6"}],"published":"2022-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:301f455f-1ffe-485a-8473-8a31a0633a5f","source":"wordfence","cve":"","title":"Dimension (Unknown Versions) - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/301f455f-1ffe-485a-8473-8a31a0633a5f?source=api-prod","affected":[{"type":"theme","slug":"dimension","name":"Dimension","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3021057a-324d-481b-b82f-80e18f83cfba","source":"wordfence","cve":"CVE-2025-8945","title":"Edit Password Protected <= 1.3.4 - Unauthenticated Protection Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3021057a-324d-481b-b82f-80e18f83cfba?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-password-protected","name":"WPEPP \u2013 All In One WordPress Security, Firewall, Malware Scanner & Login Protection","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-08-21T00:00:00Z","updated":"2026-09-16T15:06:56Z"},{"id":"wordfence:30215025-58d0-48e4-88bd-7ec2b0460c94","source":"wordfence","cve":"CVE-2026-110001","title":"FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30215025-58d0-48e4-88bd-7ec2b0460c94?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.55.7212","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-10-30T17:04:50Z","updated":"2026-10-30T17:15:25Z"},{"id":"wordfence:302b004c-0443-4f47-8493-8bc7c5a25788","source":"wordfence","cve":"CVE-2026-24616","title":"WP Popups <= 2.2.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/302b004c-0443-4f47-8493-8bc7c5a25788?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.2.0.5","to_inclusive":true,"patched_in":"2.2.0.6"}],"published":"2026-01-11T20:52:33Z","updated":"2026-02-24T18:49:25Z"},{"id":"wordfence:302b872f-b25c-4964-993f-93596d12842d","source":"wordfence","cve":"CVE-2024-49680","title":"WP VR <= 8.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/302b872f-b25c-4964-993f-93596d12842d?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:32:59Z"},{"id":"wordfence:302c4eb3-d30e-4140-b674-e62b886d1618","source":"wordfence","cve":"CVE-2025-58855","title":"AP HoneyPot WordPress Plugin <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/302c4eb3-d30e-4140-b674-e62b886d1618?source=api-prod","affected":[{"type":"plugin","slug":"ap-honeypot","name":"AP HoneyPot WordPress Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:53:34Z"},{"id":"wordfence:302ce1ff-d3ae-4e64-8019-40923275e46b","source":"wordfence","cve":"CVE-2026-22385","title":"Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.9.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/302ce1ff-d3ae-4e64-8019-40923275e46b?source=api-prod","affected":[{"type":"theme","slug":"wolmart","name":"Wolmart | Multi-Vendor Marketplace WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:43:58Z"},{"id":"wordfence:302e80da-8a7e-4883-8e0f-658fff2579bd","source":"wordfence","cve":"CVE-2025-23678","title":"LocalGrid <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/302e80da-8a7e-4883-8e0f-658fff2579bd?source=api-prod","affected":[{"type":"plugin","slug":"localgrid","name":"LocalGrid","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:58:10Z"},{"id":"wordfence:30319b65-f111-4637-97df-ceb831d5fa3c","source":"wordfence","cve":"CVE-2024-56029","title":"Easy Language Switcher <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30319b65-f111-4637-97df-ceb831d5fa3c?source=api-prod","affected":[{"type":"plugin","slug":"easy-language-switcher","name":"Easy Language Switcher","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:51:57Z"},{"id":"wordfence:303380f7-d043-48d5-8edb-9d45f13d0d82","source":"wordfence","cve":"CVE-2012-6634","title":"WordPress Core <= 3.3.2 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/303380f7-d043-48d5-8edb-9d45f13d0d82?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2012-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30339c0d-6632-4073-b4d5-3bb4a5b8a58d","source":"wordfence","cve":"CVE-2026-3907","title":"Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30339c0d-6632-4073-b4d5-3bb4a5b8a58d?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-07-09T19:36:51Z","updated":"2026-07-10T07:48:41Z"},{"id":"wordfence:30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6","source":"wordfence","cve":"CVE-2025-3281","title":"User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-05-05T00:00:00Z","updated":"2025-05-06T07:24:24Z"},{"id":"wordfence:303bdead-96e4-45f4-8b57-f1cb703bbe16","source":"wordfence","cve":"CVE-2020-36504","title":"WP-Pro-Quiz <= 0.37 - Arbitrary Quiz Deletion via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/303bdead-96e4-45f4-8b57-f1cb703bbe16?source=api-prod","affected":[{"type":"plugin","slug":"wp-pro-quiz","name":"Wp-Pro-Quiz","from":"*","from_inclusive":true,"to":"0.37","to_inclusive":true,"patched_in":""}],"published":"2020-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:303c8539-7a61-4b9b-81a1-70323c0be7ff","source":"wordfence","cve":"CVE-2025-68606","title":"PostX <= 5.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/303c8539-7a61-4b9b-81a1-70323c0be7ff?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-06T15:02:39Z"},{"id":"wordfence:303f348b-846c-4aad-9193-36e056a02f71","source":"wordfence","cve":"CVE-2025-23547","title":"LH Login Page <= 2.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/303f348b-846c-4aad-9193-36e056a02f71?source=api-prod","affected":[{"type":"plugin","slug":"lh-login-page","name":"LH Login Page","from":"*","from_inclusive":true,"to":"2.14","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:56:43Z"},{"id":"wordfence:303fc526-ffaf-4266-a606-4d21ac4c295f","source":"wordfence","cve":"CVE-2026-54187","title":"JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/303fc526-ffaf-4266-a606-4d21ac4c295f?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10.1","to_inclusive":true,"patched_in":"3.8.10.2"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:00:48Z"},{"id":"wordfence:3041bb06-504c-4de1-8a1a-12041e09400e","source":"wordfence","cve":"CVE-2024-32541","title":"WP-Cufon <= 1.6.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3041bb06-504c-4de1-8a1a-12041e09400e?source=api-prod","affected":[{"type":"plugin","slug":"wp-cufon","name":"WP-Cufon","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T14:02:09Z"},{"id":"wordfence:3041e28e-d965-4672-ab10-8b1f3d874f19","source":"wordfence","cve":"CVE-2023-5742","title":"EasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3041e28e-d965-4672-ab10-8b1f3d874f19?source=api-prod","affected":[{"type":"plugin","slug":"easyrotator-for-wordpress","name":"EasyRotator for WordPress \u2013 Slider Plugin","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2023-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30430993-b5bc-42fb-9968-7a372b2285c8","source":"wordfence","cve":"CVE-2025-32540","title":"Feedify \u2013 Web Push Notifications <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30430993-b5bc-42fb-9968-7a372b2285c8?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-by-feedify","name":"Feedify \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T20:23:48Z"},{"id":"wordfence:30433ffa-ab1d-4f7c-b7ca-9a5eeafb581f","source":"wordfence","cve":"CVE-2024-11606","title":"Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30433ffa-ab1d-4f7c-b7ca-9a5eeafb581f?source=api-prod","affected":[{"type":"plugin","slug":"tabs-shortcode","name":"Tabs Shortcode","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-19T14:53:16Z"},{"id":"wordfence:30438a21-9361-4797-83f3-f832234a6cb5","source":"wordfence","cve":"CVE-2026-22519","title":"MediaPress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30438a21-9361-4797-83f3-f832234a6cb5?source=api-prod","affected":[{"type":"plugin","slug":"mediapress","name":"MediaPress","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:23:41Z"},{"id":"wordfence:3044bd14-b914-4a2a-8e45-1129ac25a38a","source":"wordfence","cve":"CVE-2024-53717","title":"yPHPlista <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3044bd14-b914-4a2a-8e45-1129ac25a38a?source=api-prod","affected":[{"type":"plugin","slug":"yphplista","name":"yPHPlista","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:33:27Z"},{"id":"wordfence:3044dbfc-e12d-47e0-a297-67ff0510eded","source":"wordfence","cve":"CVE-2023-23720","title":"Verified Reviews (Avis V\u00e9rifi\u00e9s) <= 2.3.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3044dbfc-e12d-47e0-a297-67ff0510eded?source=api-prod","affected":[{"type":"plugin","slug":"netreviews","name":"Verified Reviews (Avis V\u00e9rifi\u00e9s)","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3044e60f-b930-42db-ba5d-656e71b84226","source":"wordfence","cve":"CVE-2026-96573","title":"Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3044e60f-b930-42db-ba5d-656e71b84226?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.97","to_inclusive":true,"patched_in":"1.5.98"}],"published":"2026-09-30T20:09:56Z","updated":"2026-10-01T08:28:43Z"},{"id":"wordfence:3045c9e5-4095-48e5-8d9d-16a091e69d54","source":"wordfence","cve":"CVE-2025-8625","title":"Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3045c9e5-4095-48e5-8d9d-16a091e69d54?source=api-prod","affected":[{"type":"plugin","slug":"copypress-rest-api","name":"Copypress Rest API","from":"1.1","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-09-29T15:26:53Z","updated":"2026-09-17T20:39:26Z"},{"id":"wordfence:304765f9-772c-4d47-b929-08fd708736ab","source":"wordfence","cve":"CVE-2025-58839","title":"eDS Responsive Menu <= 1.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/304765f9-772c-4d47-b929-08fd708736ab?source=api-prod","affected":[{"type":"plugin","slug":"eds-responsive-menu","name":"eDS Responsive Menu","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:19:42Z"},{"id":"wordfence:304b0b69-90bc-416e-9d76-82b176a9de34","source":"wordfence","cve":"CVE-2024-51688","title":"FraudLabs Pro SMS Verification <= 1.10.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/304b0b69-90bc-416e-9d76-82b176a9de34?source=api-prod","affected":[{"type":"plugin","slug":"fraudlabs-pro-sms-verification","name":"FraudLabs Pro SMS Verification","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:47:57Z"},{"id":"wordfence:304ed5df-27a4-4fd3-b572-51017142b510","source":"wordfence","cve":"CVE-2025-57983","title":"BP Disable Activation Reloaded <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/304ed5df-27a4-4fd3-b572-51017142b510?source=api-prod","affected":[{"type":"plugin","slug":"bp-disable-activation-reloaded","name":"BP Disable Activation Reloaded","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:11:50Z"},{"id":"wordfence:30502e0f-cae6-4d48-837c-77127c39731b","source":"wordfence","cve":"CVE-2026-84764","title":"Simply Schedule Appointments <= 1.6.12.23 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30502e0f-cae6-4d48-837c-77127c39731b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.23","to_inclusive":true,"patched_in":"1.6.12.24"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:36:27Z"},{"id":"wordfence:30529c2b-ef05-4b88-8082-09a633e76736","source":"wordfence","cve":"CVE-2026-32523","title":"WPJAM Basic <= 6.9.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30529c2b-ef05-4b88-8082-09a633e76736?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"6.9.2","to_inclusive":true,"patched_in":"6.9.2.1"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:07:06Z"},{"id":"wordfence:30532dc1-5d40-4585-abd2-c08ed0682d72","source":"wordfence","cve":"CVE-2020-7947","title":"Login by Auth0 <= 3.11.3 - CSV Injection","severity":"critical","cvss":9.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30532dc1-5d40-4585-abd2-c08ed0682d72?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3053fa8f-f63e-4f28-a286-9a15e662c645","source":"wordfence","cve":"CVE-2025-31564","title":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.2.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3053fa8f-f63e-4f28-a286-9a15e662c645?source=api-prod","affected":[{"type":"plugin","slug":"ai-auto-tool","name":"Ai Auto Tool Content Writing Assistant All in One","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-03-31T00:00:00Z","updated":"2025-11-17T21:08:33Z"},{"id":"wordfence:30579058-54f4-4496-9275-078faf99823f","source":"wordfence","cve":"CVE-2024-2210","title":"The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing","severity":"medium","cvss":6.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30579058-54f4-4496-9275-078faf99823f?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T01:56:47Z"},{"id":"wordfence:30587c31-1c69-479f-8aa4-05c171abaab8","source":"wordfence","cve":"CVE-2026-40741","title":"Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30587c31-1c69-479f-8aa4-05c171abaab8?source=api-prod","affected":[{"type":"plugin","slug":"woo-redsys-gateway-light","name":"Payment Gateway for Redsys & WooCommerce Lite","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:58:28Z"},{"id":"wordfence:3059a9fa-b566-431f-94ee-3a2f8a2df417","source":"wordfence","cve":"CVE-2026-93339","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3059a9fa-b566-431f-94ee-3a2f8a2df417?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.69","to_inclusive":true,"patched_in":"3.1.70"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-22T20:31:17Z"},{"id":"wordfence:305f2f13-178d-4b49-b59b-abb35d111299","source":"wordfence","cve":"CVE-2024-10726","title":"Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/305f2f13-178d-4b49-b59b-abb35d111299?source=api-prod","affected":[{"type":"plugin","slug":"friendly-functions-for-welcart","name":"Friendly Functions for Welcart","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-11-20T13:37:56Z","updated":"2024-12-09T23:23:57Z"},{"id":"wordfence:305f9e72-3a3f-4b22-8097-f37b1a1ebe1d","source":"wordfence","cve":"","title":"BestWebSoft's Like & Share \u2013 Posts, Pages and Widget Social Extension plugin for WordPress < 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/305f9e72-3a3f-4b22-8097-f37b1a1ebe1d?source=api-prod","affected":[{"type":"plugin","slug":"facebook-button-plugin","name":"BestWebSoft's Like & Share \u2013 Posts, Pages and Widget Social Extension plugin for WordPress","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:305fc4a9-8b22-49ef-84eb-062986dbcf58","source":"wordfence","cve":"CVE-2025-47484","title":"Display Remote Posts Block <= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/305fc4a9-8b22-49ef-84eb-062986dbcf58?source=api-prod","affected":[{"type":"plugin","slug":"display-remote-posts-block","name":"Display Remote Posts Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:29:02Z"},{"id":"wordfence:305ffc3b-5f1c-42fb-9fd5-0dfcbe1c661b","source":"wordfence","cve":"CVE-2017-9064","title":"WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/305ffc3b-5f1c-42fb-9fd5-0dfcbe1c661b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3060dbda-97f3-410c-863e-ea76a6a018fd","source":"wordfence","cve":"CVE-2024-34555","title":"Z-Downloads <= 1.11.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3060dbda-97f3-410c-863e-ea76a6a018fd?source=api-prod","affected":[{"type":"plugin","slug":"z-downloads","name":"Z-Downloads","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T19:40:00Z"},{"id":"wordfence:3061939e-cf44-41fb-a8f6-5166345df43f","source":"wordfence","cve":"CVE-2026-66646","title":"WP Tab Widget <= 1.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3061939e-cf44-41fb-a8f6-5166345df43f?source=api-prod","affected":[{"type":"plugin","slug":"wp-tab-widget","name":"WP Tab Widget","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:23:41Z"},{"id":"wordfence:306638a8-e041-4441-ab96-2586d6373feb","source":"wordfence","cve":"CVE-2026-103343","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306638a8-e041-4441-ab96-2586d6373feb?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"6.2.15"}],"published":"2026-10-01T12:27:00Z","updated":"2026-10-08T23:18:55Z"},{"id":"wordfence:30670489-2db2-4c55-b46f-4818f2608ca9","source":"wordfence","cve":"CVE-2025-49032","title":"Gutenberg Blocks <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30670489-2db2-4c55-b46f-4818f2608ca9?source=api-prod","affected":[{"type":"plugin","slug":"advanced-gutenberg","name":"PublishPress Blocks \u2013 Block Controls, Block Visibility, Block Permissions","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T17:37:31Z"},{"id":"wordfence:306a9960-7139-4142-a249-4de2b3c4b985","source":"wordfence","cve":"","title":"MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306a9960-7139-4142-a249-4de2b3c4b985?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-article-uploader-extension","name":"MainWP Article Uploader Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-favorites-extension","name":"MainWP Favorites Extension","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:306b23ee-7dcb-4281-a218-21168998c4b9","source":"wordfence","cve":"CVE-2024-1446","title":"NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306b23ee-7dcb-4281-a218-21168998c4b9?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2024-05-21T18:36:02Z","updated":"2024-05-22T06:50:33Z"},{"id":"wordfence:306c98ad-0d42-4ad5-b82a-bf4579865aa9","source":"wordfence","cve":"CVE-2023-2492","title":"QueryWall <= 1.1.1 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306c98ad-0d42-4ad5-b82a-bf4579865aa9?source=api-prod","affected":[{"type":"plugin","slug":"querywall","name":"QueryWall: Plug'n Play Firewall","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:306f00e4-9a70-48be-a91e-e396643a8129","source":"wordfence","cve":"CVE-2024-6318","title":"IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=api-prod","affected":[{"type":"plugin","slug":"imgspider","name":"IMGspider \u2013 \u56fe\u7247\u91c7\u96c6\u6293\u53d6\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2024-07-03T00:00:00Z","updated":"2024-07-04T08:32:20Z"},{"id":"wordfence:306fa8e1-b62f-4514-8463-e696d043f6f5","source":"wordfence","cve":"","title":"Simple Photo Gallery <= 1.8.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306fa8e1-b62f-4514-8463-e696d043f6f5?source=api-prod","affected":[{"type":"plugin","slug":"simple-photo-gallery","name":"Simple Photo Gallery","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"}],"published":"2016-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:306facf0-b1e4-4ba7-9462-f94af01d628d","source":"wordfence","cve":"CVE-2021-36920","title":"Download Monitor <= 4.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/306facf0-b1e4-4ba7-9462-f94af01d628d?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2021-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3070de4c-736f-4d65-afe6-37a740ccc3dc","source":"wordfence","cve":"CVE-2026-7862","title":"Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization to Unauthenticated Arbitrary Refund Initiation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3070de4c-736f-4d65-afe6-37a740ccc3dc?source=api-prod","affected":[{"type":"plugin","slug":"eupago-gateway-for-woocommerce","name":"Eupago Gateway For Woocommerce","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-05-07T00:00:00Z","updated":"2026-08-21T13:52:19Z"},{"id":"wordfence:307137e1-6ce0-4e7d-8134-6c938b6809cd","source":"wordfence","cve":"CVE-2025-49996","title":"WP Visitor Statistics (Real Time Traffic) <= 8.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/307137e1-6ce0-4e7d-8134-6c938b6809cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":"8.5"}],"published":"2025-06-19T00:00:00Z","updated":"2026-04-14T14:54:14Z"},{"id":"wordfence:3071b2dc-9673-4e30-bd04-7404eb6a1ed9","source":"wordfence","cve":"CVE-2024-12472","title":"Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3071b2dc-9673-4e30-bd04-7404eb6a1ed9?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"2.36","to_inclusive":true,"patched_in":"2.37"}],"published":"2025-01-10T14:15:46Z","updated":"2025-01-23T01:16:52Z"},{"id":"wordfence:30741601-50b9-4799-a340-11f6ffa59553","source":"wordfence","cve":"CVE-2025-11620","title":"Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=api-prod","affected":[{"type":"plugin","slug":"multiple-roles-per-user","name":"Multiple Roles per User","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:12:39Z","updated":"2025-11-18T08:27:32Z"},{"id":"wordfence:30742fd4-0fdd-4313-afe2-503cbc39c25a","source":"wordfence","cve":"CVE-2025-31074","title":"MDJM Event Management <= 1.7.5.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30742fd4-0fdd-4313-afe2-503cbc39c25a?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.5.2","to_inclusive":true,"patched_in":"1.7.5.3"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T13:59:26Z"},{"id":"wordfence:30747988-83f9-41f9-9bc5-1f533bc4cb94","source":"wordfence","cve":"CVE-2026-1675","title":"Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key","severity":"medium","cvss":5.3,"cwe":"CWE-1188","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30747988-83f9-41f9-9bc5-1f533bc4cb94?source=api-prod","affected":[{"type":"plugin","slug":"advanced-country-blocker","name":"Advanced Country Blocker","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-02-06T20:24:09Z","updated":"2026-02-12T16:48:42Z"},{"id":"wordfence:3077b84e-87af-4307-83c5-0e4b15d07ff1","source":"wordfence","cve":"CVE-2023-6982","title":"Display custom fields in the frontend \u2013 Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3077b84e-87af-4307-83c5-0e4b15d07ff1?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-to-display-post-and-user-data","name":"Display custom fields in the frontend \u2013 Post and User Profile Fields","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-07-29T21:36:07Z"},{"id":"wordfence:3078861b-3a16-4e93-a4f6-5ae885bc0747","source":"wordfence","cve":"CVE-2025-4380","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3078861b-3a16-4e93-a4f6-5ae885bc0747?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:52:56Z","updated":"2025-07-02T03:47:24Z"},{"id":"wordfence:307bbfe6-8a57-461d-aa7d-bce962da4239","source":"wordfence","cve":"CVE-2023-47671","title":"Vertical scroll recent post <= 14.0 - Cross-Site Request Forgery via vsrp_admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/307bbfe6-8a57-461d-aa7d-bce962da4239?source=api-prod","affected":[{"type":"plugin","slug":"vertical-scroll-recent-post","name":"Vertical scroll recent post","from":"*","from_inclusive":true,"to":"14.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:307bfd18-840a-4cb4-86e6-33dc28e5514e","source":"wordfence","cve":"CVE-2023-46820","title":"Image Regenerate & Select Crop <= 7.3.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/307bfd18-840a-4cb4-86e6-33dc28e5514e?source=api-prod","affected":[{"type":"plugin","slug":"image-regenerate-select-crop","name":"Image Regenerate & Select Crop","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:307e3e47-fac8-400d-9b90-b75b39ee14c3","source":"wordfence","cve":"CVE-2024-48039","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.15 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/307e3e47-fac8-400d-9b90-b75b39ee14c3?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:42:52Z"},{"id":"wordfence:30821418-48c0-4bc6-8bf1-f558671bff24","source":"wordfence","cve":"CVE-2026-1300","title":"Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30821418-48c0-4bc6-8bf1-f558671bff24?source=api-prod","affected":[{"type":"plugin","slug":"responsive-header","name":"Responsive Header Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T20:34:05Z","updated":"2026-01-24T09:08:06Z"},{"id":"wordfence:30834541-acc6-461b-8d0d-66716a7dd947","source":"wordfence","cve":"CVE-2025-30830","title":"Cool Author Box <= 2.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30834541-acc6-461b-8d0d-66716a7dd947?source=api-prod","affected":[{"type":"plugin","slug":"hm-cool-author-box-widget","name":"Cool Author Box \u2013 For Widget and Post Content","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:19:12Z"},{"id":"wordfence:30838075-7574-49e0-b8aa-924cb4f0b7ab","source":"wordfence","cve":"CVE-2026-103298","title":"CCAvenue Payment Gateway for WooCommerce <= 3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30838075-7574-49e0-b8aa-924cb4f0b7ab?source=api-prod","affected":[{"type":"plugin","slug":"ccavanue-woocommerce-payment-getway","name":"CCAvenue Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T14:59:23Z"},{"id":"wordfence:3084c9ab-00aa-4b8e-aa46-bd70b335ec77","source":"wordfence","cve":"CVE-2023-5050","title":"Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3084c9ab-00aa-4b8e-aa46-bd70b335ec77?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-map","name":"Leaflet Map","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3087865c-bc32-49e6-9c84-3b82b1668ccc","source":"wordfence","cve":"CVE-2026-97292","title":"YITH WooCommerce Tab Manager <= 2.15.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3087865c-bc32-49e6-9c84-3b82b1668ccc?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-tab-manager","name":"YITH WooCommerce Tab Manager","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:32:32Z"},{"id":"wordfence:30881bed-9a5c-4a7f-9065-f11a1b336892","source":"wordfence","cve":"CVE-2024-31367","title":"Soledad <= 8.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30881bed-9a5c-4a7f-9065-f11a1b336892?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.5","to_inclusive":true,"patched_in":"8.4.6"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-11T14:58:21Z"},{"id":"wordfence:308aac91-daac-4bb7-a330-cc2ca2bedb43","source":"wordfence","cve":"CVE-2026-96341","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/308aac91-daac-4bb7-a330-cc2ca2bedb43?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.3","to_inclusive":true,"patched_in":"1.58.0"}],"published":"2026-10-08T17:53:53Z","updated":"2026-10-13T14:49:10Z"},{"id":"wordfence:308b4cfa-3d4f-46a1-a6a8-eaa2653b4953","source":"wordfence","cve":"CVE-2015-10132","title":"WP SpreadPlugin < 3.8.6.2 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/308b4cfa-3d4f-46a1-a6a8-eaa2653b4953?source=api-prod","affected":[{"type":"plugin","slug":"wp-spreadplugin","name":"WP-Spreadplugin","from":"*","from_inclusive":true,"to":"3.8.6.2","to_inclusive":false,"patched_in":"3.8.6.2"}],"published":"2015-04-21T00:00:00Z","updated":"2024-04-24T13:21:13Z"},{"id":"wordfence:308c9d72-4739-4fcd-8e04-b24edc19ec06","source":"wordfence","cve":"CVE-2024-32549","title":"Related Posts for WordPress <= 4.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/308c9d72-4739-4fcd-8e04-b24edc19ec06?source=api-prod","affected":[{"type":"plugin","slug":"microkids-related-posts","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:40:17Z"},{"id":"wordfence:308cd28a-a477-4bc6-a392-ad5a9eca1cb5","source":"wordfence","cve":"CVE-2026-1830","title":"Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=api-prod","affected":[{"type":"plugin","slug":"quick-playground","name":"Quick Playground","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-04-08T14:35:08Z","updated":"2026-04-09T03:25:57Z"},{"id":"wordfence:308f6887-7c1c-4efd-85e2-b71bb6d26dab","source":"wordfence","cve":"CVE-2023-1840","title":"Sp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/308f6887-7c1c-4efd-85e2-b71bb6d26dab?source=api-prod","affected":[{"type":"plugin","slug":"spotify-play-button-for-wordpress","name":"Sp*tify Play Button for WordPress","from":"*","from_inclusive":true,"to":"2.07","to_inclusive":true,"patched_in":"2.08"}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3091d345-2532-433c-83e0-2e253a4cd8d4","source":"wordfence","cve":"CVE-2026-120547","title":"CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3091d345-2532-433c-83e0-2e253a4cd8d4?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-honeypot","name":"CF7 Apps \u2013 Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-11-12T20:50:08Z","updated":"2026-11-13T09:35:11Z"},{"id":"wordfence:309b33eb-678a-48f5-9793-042cbcda9984","source":"wordfence","cve":"CVE-2026-24631","title":"Rosebud <= 1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/309b33eb-678a-48f5-9793-042cbcda9984?source=api-prod","affected":[{"type":"theme","slug":"rosebud","name":"Rosebud - Flower Shop and Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-09T00:00:00Z","updated":"2026-02-03T21:05:50Z"},{"id":"wordfence:309e0ebe-8873-46a1-ae82-d3bd05e68d00","source":"wordfence","cve":"CVE-2025-58012","title":"Content Mask <= 1.8.5.3 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/309e0ebe-8873-46a1-ae82-d3bd05e68d00?source=api-prod","affected":[{"type":"plugin","slug":"content-mask","name":"Content Mask","from":"*","from_inclusive":true,"to":"1.8.5.3","to_inclusive":true,"patched_in":"1.8.5.4"}],"published":"2025-09-22T00:00:00Z","updated":"2026-06-02T11:10:30Z"},{"id":"wordfence:309ea238-44a7-4640-88a0-501f74db50ac","source":"wordfence","cve":"CVE-2026-24637","title":"PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/309ea238-44a7-4640-88a0-501f74db50ac?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.15.10","to_inclusive":true,"patched_in":"11.15.11"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:31:54Z"},{"id":"wordfence:309eb1df-728f-404d-a20d-a83a0ab8ed0c","source":"wordfence","cve":"CVE-2024-33629","title":"Auto Featured Image (Auto Post Thumbnail) <= 4.1.3 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/309eb1df-728f-404d-a20d-a83a0ab8ed0c?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-04-25T00:00:00Z","updated":"2025-09-25T18:25:26Z"},{"id":"wordfence:30a08f3a-d7d8-4054-9a88-bc44ce3263dd","source":"wordfence","cve":"CVE-2026-118989","title":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter  2.5.1 - 2.6.8 - Authenticated (Shop Manager+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a08f3a-d7d8-4054-9a88-bc44ce3263dd?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"2.5.1","from_inclusive":true,"to":"2.6.8","to_inclusive":false,"patched_in":"2.6.8"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:45:43Z"},{"id":"wordfence:30a1517e-5ea5-47a1-afe8-9543e1ffd199","source":"wordfence","cve":"CVE-2024-8723","title":"012 PS Multi Languages <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a1517e-5ea5-47a1-afe8-9543e1ffd199?source=api-prod","affected":[{"type":"plugin","slug":"012-ps-multi-languages","name":"012 Ps Multi Languages","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T13:28:00Z","updated":"2024-09-26T02:03:23Z"},{"id":"wordfence:30a15a22-d6f3-4829-995d-7fa14d1db7a9","source":"wordfence","cve":"CVE-2024-13507","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a15a22-d6f3-4829-995d-7fa14d1db7a9?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.97","to_inclusive":true,"patched_in":"2.8.98"}],"published":"2025-01-29T22:00:52Z","updated":"2025-07-26T03:38:18Z"},{"id":"wordfence:30a6453b-a31e-4cec-a531-9a3dd3053277","source":"wordfence","cve":"CVE-2025-25133","title":"WP Frontend Submit <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a6453b-a31e-4cec-a531-9a3dd3053277?source=api-prod","affected":[{"type":"plugin","slug":"wp-frontend-submit","name":"WP Frontend Submit","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:45:56Z"},{"id":"wordfence:30a6d334-3838-4ed4-b688-c3887d9091c0","source":"wordfence","cve":"CVE-2026-4871","title":"Sports Club Management <= 1.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a6d334-3838-4ed4-b688-c3887d9091c0?source=api-prod","affected":[{"type":"plugin","slug":"sports-club-management","name":"Sports Club Management","from":"*","from_inclusive":true,"to":"1.12.9","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:38:08Z","updated":"2026-04-08T06:43:38Z"},{"id":"wordfence:30a79974-ee61-4764-8864-89659b1848a4","source":"wordfence","cve":"CVE-2024-7514","title":"WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a79974-ee61-4764-8864-89659b1848a4?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2024-10-10T19:55:26Z","updated":"2024-10-11T08:30:54Z"},{"id":"wordfence:30a89e75-2ab1-4e65-8646-b100efed5dbd","source":"wordfence","cve":"CVE-2024-50442","title":"Royal Elementor Addons <= 1.3.980 - Authenticated (Author+) External Entity Injection","severity":"medium","cvss":5.4,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30a89e75-2ab1-4e65-8646-b100efed5dbd?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.980","to_inclusive":true,"patched_in":"1.3.981"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:07:57Z"},{"id":"wordfence:30aab1af-a78f-4bac-b3c5-30ea854ccef7","source":"wordfence","cve":"CVE-2023-3197","title":"MStore API <= 4.0.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30aab1af-a78f-4bac-b3c5-30ea854ccef7?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30b4371d-54a2-4111-ad2c-b38b6b31884d","source":"wordfence","cve":"CVE-2025-11244","title":"Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing","severity":"low","cvss":3.7,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4371d-54a2-4111-ad2c-b38b6b31884d?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.7.12"}],"published":"2025-10-24T16:54:49Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:30b4b98e-c566-4249-85a4-bfb0b5d5ac5d","source":"wordfence","cve":"","title":"Finalist (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30b4b98e-c566-4249-85a4-bfb0b5d5ac5d?source=api-prod","affected":[{"type":"plugin","slug":"finalist","name":"Finalist","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30b5ea7f-f731-41c8-bb82-fc59637cb12b","source":"wordfence","cve":"CVE-2025-57987","title":"WP Events Manager <= 2.2.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30b5ea7f-f731-41c8-bb82-fc59637cb12b?source=api-prod","affected":[{"type":"plugin","slug":"wp-events-manager","name":"WP Events Manager","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T21:05:45Z"},{"id":"wordfence:30b6b0bf-e632-4e83-89ee-a424382534da","source":"wordfence","cve":"CVE-2021-4444","title":"Product Filter by WooBeWoo <= 1.4.9 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2021-05-07T00:00:00Z","updated":"2024-10-16T06:43:26Z"},{"id":"wordfence:30b9c4ca-1744-4907-930b-28ef5494d29c","source":"wordfence","cve":"CVE-2016-10874","title":"WP Database Backup <= 4.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30b9c4ca-1744-4907-930b-28ef5494d29c?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30badf18-f54f-40a0-b5b0-e8d49f1f1828","source":"wordfence","cve":"CVE-2025-28925","title":"WATI Chat and Notification <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30badf18-f54f-40a0-b5b0-e8d49f1f1828?source=api-prod","affected":[{"type":"plugin","slug":"wati-chat-and-notification","name":"WATI Chat and Notification","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-21T18:31:59Z"},{"id":"wordfence:30bb6746-a11b-4e59-b2ae-b0133580c9db","source":"wordfence","cve":"CVE-2025-39376","title":"Car Park Booking System for WordPress <= 2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30bb6746-a11b-4e59-b2ae-b0133580c9db?source=api-prod","affected":[{"type":"plugin","slug":"car-park-booking-system-for-wordpress","name":"Car Park Booking System for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2026-07-29T17:33:38Z"},{"id":"wordfence:30beb916-764e-48fd-bcd4-f772b9d92133","source":"wordfence","cve":"CVE-2025-31003","title":"Squeeze <= 1.6 - Authenticated (Admin+) Full Path Disclosure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30beb916-764e-48fd-bcd4-f772b9d92133?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:01:39Z"},{"id":"wordfence:30bf7a5f-bc1a-4c3b-a49e-79543271e620","source":"wordfence","cve":"CVE-2024-49620","title":"FERMA.ru.net <= 1.3.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30bf7a5f-bc1a-4c3b-a49e-79543271e620?source=api-prod","affected":[{"type":"plugin","slug":"ferma-ru-net-checkout","name":"FERMA.ru.net","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:49:00Z"},{"id":"wordfence:30bfa616-c7f3-4ff0-85b3-468debc8a73e","source":"wordfence","cve":"CVE-2026-1755","title":"Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30bfa616-c7f3-4ff0-85b3-468debc8a73e?source=api-prod","affected":[{"type":"plugin","slug":"menu-icons","name":"Menu Icons by Themeisle \u2013 Add Icons to Navigation Menus","from":"*","from_inclusive":true,"to":"0.13.20","to_inclusive":true,"patched_in":"0.13.21"}],"published":"2026-02-03T09:50:11Z","updated":"2026-02-03T22:22:47Z"},{"id":"wordfence:30c0118c-3dae-4d76-8e9f-ea747d44a788","source":"wordfence","cve":"CVE-2022-0397","title":"WPC Smart Wishlist for WooCommerce <= 2.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30c0118c-3dae-4d76-8e9f-ea747d44a788?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":false,"patched_in":"2.9.4"}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30c34ea7-3df8-4ba8-bea8-4c785b23a4f4","source":"wordfence","cve":"CVE-2023-26017","title":"Jobs for WordPress <= 2.5.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30c34ea7-3df8-4ba8-bea8-4c785b23a4f4?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.5.10.2","to_inclusive":true,"patched_in":"2.5.11"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30c46b91-e371-480f-943a-3906d8b6bbba","source":"wordfence","cve":"CVE-2024-11292","title":"WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30c46b91-e371-480f-943a-3906d8b6bbba?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2024-12-05T19:31:57Z","updated":"2024-12-20T20:18:23Z"},{"id":"wordfence:30c99510-fd57-4268-8e35-6f7e6f912b7e","source":"wordfence","cve":"CVE-2024-11354","title":"Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30c99510-fd57-4268-8e35-6f7e6f912b7e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-youtube-video-player","name":"Ultimate YouTube Video & Shorts Player With Vimeo","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:45:58Z","updated":"2024-11-21T02:06:28Z"},{"id":"wordfence:30c9c4b9-6905-4d8a-bc55-5cd6f6201d25","source":"wordfence","cve":"CVE-2024-4281","title":"Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30c9c4b9-6905-4d8a-bc55-5cd6f6201d25?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.6.11","to_inclusive":true,"patched_in":"7.7"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-08T09:31:34Z"},{"id":"wordfence:30cb1b8c-84ce-4401-9c30-775efb257fe6","source":"wordfence","cve":"CVE-2023-4795","title":"Testimonial Slider Shortcode <= 1.1.8 - Authenticated (Contributor+) Cross-Site Scripting Vulnerability via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30cb1b8c-84ce-4401-9c30-775efb257fe6?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-shortcode","name":"Testimonial Slider Shortcode","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2023-09-12T00:00:00Z","updated":"2026-10-01T23:20:04Z"},{"id":"wordfence:30cc4552-bd12-4211-bd06-637352ceb5df","source":"wordfence","cve":"CVE-2026-18781","title":"Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30cc4552-bd12-4211-bd06-637352ceb5df?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.9","to_inclusive":false,"patched_in":"1.3.9.9"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:08:23Z"},{"id":"wordfence:30ce93b4-9e2a-4a8c-8590-ffd61d618d31","source":"wordfence","cve":"CVE-2023-44243","title":"Instant CSS <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30ce93b4-9e2a-4a8c-8590-ffd61d618d31?source=api-prod","affected":[{"type":"plugin","slug":"instant-css","name":"Instant CSS","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30cf9783-6422-43f8-b5dc-a613a9513296","source":"wordfence","cve":"CVE-2025-66530","title":"Webba Booking <= 6.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30cf9783-6422-43f8-b5dc-a613a9513296?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:59:13Z"},{"id":"wordfence:30d127b1-3d8d-4e77-90a8-a24e7b93fe16","source":"wordfence","cve":"CVE-2024-2231","title":"Himer - Social Questions and Answers <= 2.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":6.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30d127b1-3d8d-4e77-90a8-a24e7b93fe16?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T18:45:44Z"},{"id":"wordfence:30d39718-945a-43a2-be08-70be1af55965","source":"wordfence","cve":"CVE-2025-4131","title":"GmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30d39718-945a-43a2-be08-70be1af55965?source=api-prod","affected":[{"type":"plugin","slug":"gmapsmania","name":"GmapsMania","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T13:11:10Z","updated":"2025-05-02T01:43:34Z"},{"id":"wordfence:30d592d0-323b-40d8-9f13-22041dbded31","source":"wordfence","cve":"CVE-2015-9450","title":"Plugmatter Optin Feature Box < 2.0.14 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30d592d0-323b-40d8-9f13-22041dbded31?source=api-prod","affected":[{"type":"plugin","slug":"plugmatter-optin-feature-box-lite","name":"Plugmatter Optin Feature Box","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":false,"patched_in":"2.0.14"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30d79f14-b70c-403b-9e55-66e40b18aca7","source":"wordfence","cve":"CVE-2025-11818","title":"WP Responsive Meet The Team <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30d79f14-b70c-403b-9e55-66e40b18aca7?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-meet-the-team","name":"WP Responsive Meet The Team","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:22:18Z","updated":"2025-10-22T08:27:06Z"},{"id":"wordfence:30dbc840-e281-405c-82ed-7f92761db8ae","source":"wordfence","cve":"CVE-2024-37549","title":"Save as PDF plugin by Pdfcrowd <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30dbc840-e281-405c-82ed-7f92761db8ae?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T14:00:25Z"},{"id":"wordfence:30dda650-3262-4d22-bec7-b6de3bc25381","source":"wordfence","cve":"CVE-2014-9460","title":"WP-ViperGB <= 1.3.10 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30dda650-3262-4d22-bec7-b6de3bc25381?source=api-prod","affected":[{"type":"plugin","slug":"wp-vipergb","name":"WP-ViperGB","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30ddd0e6-a9c2-4a71-b5ab-295d5c15cf47","source":"wordfence","cve":"CVE-2025-8889","title":"Compress Then Upload <= 1.0.4 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30ddd0e6-a9c2-4a71-b5ab-295d5c15cf47?source=api-prod","affected":[{"type":"plugin","slug":"compress-then-upload","name":"Compress & Upload","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-08-19T00:00:00Z","updated":"2025-09-25T20:03:51Z"},{"id":"wordfence:30df4fb4-d872-4088-af70-64f4ae99609f","source":"wordfence","cve":"CVE-2026-24997","title":"Wired Impact Volunteer Management <= 2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30df4fb4-d872-4088-af70-64f4ae99609f?source=api-prod","affected":[{"type":"plugin","slug":"wired-impact-volunteer-management","name":"Wired Impact Volunteer Management","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-02T20:43:08Z"},{"id":"wordfence:30e019bb-a970-4769-9587-311c68346d16","source":"wordfence","cve":"CVE-2026-105072","title":"Fluent Booking Pro < 2.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e019bb-a970-4769-9587-311c68346d16?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking-pro","name":"Fluent Booking Pro","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2026-10-05T15:20:54Z","updated":"2026-10-08T23:15:49Z"},{"id":"wordfence:30e0289c-b893-41bd-aad9-d7ec62bf2b23","source":"wordfence","cve":"CVE-2024-31433","title":"The Events Calendar <= 6.3.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e0289c-b893-41bd-aad9-d7ec62bf2b23?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:55:40Z"},{"id":"wordfence:30e0bf40-7f7b-43e6-8439-6dc00a889344","source":"wordfence","cve":"CVE-2026-6275","title":"StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e0bf40-7f7b-43e6-8439-6dc00a889344?source=api-prod","affected":[{"type":"plugin","slug":"official-statcounter-plugin-for-wordpress","name":"StatCounter \u2013 Real Time Visitor Stats, Session Replay & Heatmaps","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-05-28T17:02:14Z","updated":"2026-05-29T05:32:37Z"},{"id":"wordfence:30e32736-6f51-4cae-894e-db792b83afe6","source":"wordfence","cve":"CVE-2025-55711","title":"WP Table Builder <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e32736-6f51-4cae-894e-db792b83afe6?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:05:47Z"},{"id":"wordfence:30e67229-f3b6-43e4-a0c4-2e4392f4bec5","source":"wordfence","cve":"CVE-2025-67587","title":"Gravity Forms FreshDesk <= 1.3.5 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e67229-f3b6-43e4-a0c4-2e4392f4bec5?source=api-prod","affected":[{"type":"plugin","slug":"gf-freshdesk","name":"WP Gravity Forms FreshDesk Plugin","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-11T17:07:54Z"},{"id":"wordfence:30e89955-9f2b-42e4-a7cf-558edd2e736c","source":"wordfence","cve":"CVE-2021-24822","title":"Stylish Cost Calculator <= 7.0.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30e89955-9f2b-42e4-a7cf-558edd2e736c?source=api-prod","affected":[{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.4"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30ea46c1-bb29-49b8-b161-e61f13167ff4","source":"wordfence","cve":"","title":"Gallery From Files <= 1.60 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30ea46c1-bb29-49b8-b161-e61f13167ff4?source=api-prod","affected":[{"type":"plugin","slug":"gallery-from-files","name":"Gallery from files","from":"*","from_inclusive":true,"to":"1.60","to_inclusive":true,"patched_in":""}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30eab93e-0196-4f2e-9e63-a2c293819850","source":"wordfence","cve":"CVE-2024-35754","title":"Ovic Importer <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30eab93e-0196-4f2e-9e63-a2c293819850?source=api-prod","affected":[{"type":"plugin","slug":"ovic-import-demo","name":"Ovic Importer","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-06-06T00:00:00Z","updated":"2025-02-14T19:40:21Z"},{"id":"wordfence:30eda147-f02a-4b3c-a51c-665aa4c75c93","source":"wordfence","cve":"CVE-2015-5533","title":"Count per Day <= 3.4 - Cross-Site Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30eda147-f02a-4b3c-a51c-665aa4c75c93?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2015-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30edc2a1-f3fe-488d-a525-f0ae3482d8a8","source":"wordfence","cve":"CVE-2011-5191","title":"Pretty Link Lite < 1.5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30edc2a1-f3fe-488d-a525-f0ae3482d8a8?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link-lite","name":"Pretty Link Lite","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2011-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30f1ad88-a054-48bc-b362-80264122551b","source":"wordfence","cve":"CVE-2026-39753","title":"Taskbot <= 6.6 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f1ad88-a054-48bc-b362-80264122551b?source=api-prod","affected":[{"type":"plugin","slug":"taskbot","name":"Taskbot","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:45:25Z","updated":"2026-10-08T23:26:10Z"},{"id":"wordfence:30f2a3ee-7f95-478c-b3d7-c254b9472d42","source":"wordfence","cve":"CVE-2024-11730","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2a3ee-7f95-478c-b3d7-c254b9472d42?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T11:09:11Z"},{"id":"wordfence:30f2dd33-228d-4942-88d9-78c7ed0b79a1","source":"wordfence","cve":"CVE-2025-12071","title":"Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2dd33-228d-4942-88d9-78c7ed0b79a1?source=api-prod","affected":[{"type":"plugin","slug":"frontend-user-notes","name":"Frontend User Notes","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-02-17T16:31:54Z","updated":"2026-02-18T04:35:42Z"},{"id":"wordfence:30f3a208-ffe0-4d87-9c76-91451f7a1591","source":"wordfence","cve":"CVE-2024-43964","title":"DSGVO All in one for WP <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f3a208-ffe0-4d87-9c76-91451f7a1591?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2024-08-26T00:00:00Z","updated":"2024-11-27T13:47:08Z"},{"id":"wordfence:30f49721-13d6-4410-9dc5-6be69ada74a4","source":"wordfence","cve":"CVE-2025-23679","title":"FP RSS Category Excluder <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f49721-13d6-4410-9dc5-6be69ada74a4?source=api-prod","affected":[{"type":"plugin","slug":"fp-rss-category-excluder","name":"FP RSS Category Excluder","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:44:57Z"},{"id":"wordfence:30f5eecd-3135-45a1-97d2-05fcbbca9e5f","source":"wordfence","cve":"CVE-2026-6801","title":"Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f5eecd-3135-45a1-97d2-05fcbbca9e5f?source=api-prod","affected":[{"type":"theme","slug":"context-blog","name":"Context Blog","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-07-10T17:12:41Z","updated":"2026-07-11T05:35:46Z"},{"id":"wordfence:30f66c86-5bc6-46bd-b883-3f61bcd6b176","source":"wordfence","cve":"CVE-2025-66094","title":"Yada Wiki <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f66c86-5bc6-46bd-b883-3f61bcd6b176?source=api-prod","affected":[{"type":"plugin","slug":"yada-wiki","name":"Yada Wiki","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T18:41:25Z"},{"id":"wordfence:30f7560e-8713-4214-911a-18157c113d2a","source":"wordfence","cve":"CVE-2024-13482","title":"Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f7560e-8713-4214-911a-18157c113d2a?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-06T13:41:26Z"},{"id":"wordfence:30f770e5-6637-45bb-bc58-66df0f2676de","source":"wordfence","cve":"CVE-2025-60085","title":"Learnify - Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f770e5-6637-45bb-bc58-66df0f2676de?source=api-prod","affected":[{"type":"theme","slug":"learnify","name":"Learnify - Online Courses Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:37:07Z"},{"id":"wordfence:30f791ef-3a97-4f89-b602-b42b726a8f70","source":"wordfence","cve":"CVE-2024-49331","title":"Property Lot Management System <= 1.0 - Authenticated (Salesman+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f791ef-3a97-4f89-b602-b42b726a8f70?source=api-prod","affected":[{"type":"plugin","slug":"plms","name":"Property Lot Management System","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-31T15:28:22Z"},{"id":"wordfence:30f7a858-6caf-44c3-8fc9-476e9fa86543","source":"wordfence","cve":"CVE-2022-3025","title":"Bitcoin / Altcoin Faucet <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f7a858-6caf-44c3-8fc9-476e9fa86543?source=api-prod","affected":[{"type":"plugin","slug":"bitcoin-faucet","name":"Bitcoin / Altcoin Faucet","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30f8419c-c7b9-4c68-a845-26c0308d76f3","source":"wordfence","cve":"CVE-2023-5761","title":"Burst Statistics \u2013 Privacy-Friendly Analytics for WordPress 1.4.0 to 1.4.6.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30f8419c-c7b9-4c68-a845-26c0308d76f3?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"1.4.0","from_inclusive":true,"to":"1.4.6.1","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"burst-pro","name":"Burst Statistics Pro","from":"1.4.0","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:30fd2425-ee48-4777-91c1-03906d63793a","source":"wordfence","cve":"CVE-2023-6788","title":"Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30fd2425-ee48-4777-91c1-03906d63793a?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:36:08Z"},{"id":"wordfence:30ff72bf-2e80-4e91-97a6-a5708394c818","source":"wordfence","cve":"CVE-2026-122664","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/30ff72bf-2e80-4e91-97a6-a5708394c818?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.3.14","to_inclusive":true,"patched_in":"7.3.15"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:17:14Z"},{"id":"wordfence:31052fe6-a0ae-4502-b2d2-dbc3b3bf672f","source":"wordfence","cve":"CVE-2024-11613","title":"WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31052fe6-a0ae-4502-b2d2-dbc3b3bf672f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.15","to_inclusive":true,"patched_in":"4.25.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-03-24T15:03:03Z"},{"id":"wordfence:31058d2e-9c23-4057-89a4-5847b6012330","source":"wordfence","cve":"CVE-2023-23995","title":"TinyMCE Custom Styles <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31058d2e-9c23-4057-89a4-5847b6012330?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-custom-styles","name":"TinyMCE Custom Styles","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31064f51-3765-403d-b07d-dc2bb286b82d","source":"wordfence","cve":"CVE-2024-56256","title":"Embed PDF Viewer <= 2.3.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31064f51-3765-403d-b07d-dc2bb286b82d?source=api-prod","affected":[{"type":"plugin","slug":"embed-pdf-viewer","name":"Embed PDF Viewer","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:52:54Z"},{"id":"wordfence:3107fe1e-f997-4d13-9ecb-7fe9ff5a9c55","source":"wordfence","cve":"CVE-2024-44029","title":"Viala <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3107fe1e-f997-4d13-9ecb-7fe9ff5a9c55?source=api-prod","affected":[{"type":"theme","slug":"viala","name":"Viala","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:26:32Z"},{"id":"wordfence:31093664-c45e-4e87-b72f-5cdf8e8e9f67","source":"wordfence","cve":"CVE-2024-12035","title":"CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31093664-c45e-4e87-b72f-5cdf8e8e9f67?source=api-prod","affected":[{"type":"plugin","slug":"cs-framework","name":"CS Framework","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:22Z"},{"id":"wordfence:310ad533-7f86-4fbc-93de-a742c33a6a51","source":"wordfence","cve":"CVE-2026-74010","title":"bbPress <= 2.6.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310ad533-7f86-4fbc-93de-a742c33a6a51?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.14","to_inclusive":true,"patched_in":"2.6.15"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T16:12:20Z"},{"id":"wordfence:310afe02-3a51-4633-b359-65ae58d0c032","source":"wordfence","cve":"CVE-2024-1687","title":"Thank You Page Customizer for WooCommerce \u2013 Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310afe02-3a51-4633-b359-65ae58d0c032?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-27T05:33:13Z"},{"id":"wordfence:310b09c6-6ab8-459c-8576-2fb9afc43dfd","source":"wordfence","cve":"CVE-2024-13218","title":"Fast Tube <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310b09c6-6ab8-459c-8576-2fb9afc43dfd?source=api-prod","affected":[{"type":"plugin","slug":"fast-tube","name":"Fast Tube","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:57:24Z"},{"id":"wordfence:310b8622-8cc5-4fdb-8f83-b541aad136ee","source":"wordfence","cve":"CVE-2024-43960","title":"Web and WooCommerce Addons for WPBakery Builder <= 1.4.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310b8622-8cc5-4fdb-8f83-b541aad136ee?source=api-prod","affected":[{"type":"plugin","slug":"vc-addons-by-bit14","name":"Web and WooCommerce Addons for WPBakery Builder","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:13:43Z"},{"id":"wordfence:310b9365-2c94-42b2-92ca-ab9a5eab3bfe","source":"wordfence","cve":"CVE-2026-42683","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310b9365-2c94-42b2-92ca-ab9a5eab3bfe?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:30:59Z"},{"id":"wordfence:310d9b83-6511-46be-aead-a0aa067d2c2f","source":"wordfence","cve":"","title":"Prostore < 1.1.3 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310d9b83-6511-46be-aead-a0aa067d2c2f?source=api-prod","affected":[{"type":"theme","slug":"prostore","name":"ProStore - Modern Magazine WordPress Theme | Blog / Magazine","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2014-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:310e2405-b6ff-4f52-9502-09fa7d5fcc62","source":"wordfence","cve":"CVE-2026-56007","title":"Ocean Product Sharing <= 2.2.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310e2405-b6ff-4f52-9502-09fa7d5fcc62?source=api-prod","affected":[{"type":"plugin","slug":"ocean-product-sharing","name":"Ocean Product Sharing","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:52:41Z"},{"id":"wordfence:310ffec4-cdd1-4e2e-a5f6-7e0ed5593dec","source":"wordfence","cve":"CVE-2025-23752","title":"CGD Arrange Terms <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/310ffec4-cdd1-4e2e-a5f6-7e0ed5593dec?source=api-prod","affected":[{"type":"plugin","slug":"shopp-arrange","name":"CGD Arrange Terms","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:45:04Z"},{"id":"wordfence:3110dea0-6ffc-43b4-a1df-36075d401c43","source":"wordfence","cve":"CVE-2026-90963","title":"Essential Real Estate <= 5.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3110dea0-6ffc-43b4-a1df-36075d401c43?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:09:48Z"},{"id":"wordfence:3111d016-e414-44df-925a-84010316c4ff","source":"wordfence","cve":"CVE-2024-47385","title":"Essential Blocks for Gutenberg <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3111d016-e414-44df-925a-84010316c4ff?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:42:29Z"},{"id":"wordfence:3115b835-52f9-4545-9eb5-eec8fd4ab93e","source":"wordfence","cve":"CVE-2026-92996","title":"Verge3D 4.1.0 - 4.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3115b835-52f9-4545-9eb5-eec8fd4ab93e?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"4.1.0","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.13.1"}],"published":"2026-09-25T00:00:00Z","updated":"2026-10-13T17:01:09Z"},{"id":"wordfence:3115e8ad-8e68-41e9-a3a0-5f003d921037","source":"wordfence","cve":"CVE-2024-4564","title":"CoDesigner WooCommerce Builder for Elementor \u2013 Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3115e8ad-8e68-41e9-a3a0-5f003d921037?source=api-prod","affected":[{"type":"plugin","slug":"woolementor","name":"CoDesigner \u2013 All in One Elementor WooCommerce Builder","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5"}],"published":"2024-06-11T15:24:21Z","updated":"2024-06-12T03:33:16Z"},{"id":"wordfence:311636d5-e990-4cdd-af1c-8b9610afa73e","source":"wordfence","cve":"CVE-2024-52439","title":"Team Rosters <= 4.8.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/311636d5-e990-4cdd-af1c-8b9610afa73e?source=api-prod","affected":[{"type":"plugin","slug":"team-rosters","name":"Team Rosters","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2025-08-28T15:50:58Z"},{"id":"wordfence:31173691-28fb-46fd-a7da-28bf9c46e2bc","source":"wordfence","cve":"CVE-2024-44000","title":"LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31173691-28fb-46fd-a7da-28bf9c46e2bc?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.5.0.1"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-05T14:17:53Z"},{"id":"wordfence:31189328-3dba-4bc4-a541-ef53bbf9794f","source":"wordfence","cve":"CVE-2025-58874","title":"StoryMap <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31189328-3dba-4bc4-a541-ef53bbf9794f?source=api-prod","affected":[{"type":"plugin","slug":"wp-storymap","name":"StoryMap Plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-09-05T00:00:00Z","updated":"2026-10-28T21:08:18Z"},{"id":"wordfence:3118b34e-d3e2-4a90-9a0f-e6cf71348dd1","source":"wordfence","cve":"CVE-2025-54050","title":"Responsive Addons for Elementor <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3118b34e-d3e2-4a90-9a0f-e6cf71348dd1?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:40:45Z"},{"id":"wordfence:311960e7-c4b4-4638-980f-1e08ffa621ba","source":"wordfence","cve":"CVE-2026-2433","title":"RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.11 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via postMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/311960e7-c4b4-4638-980f-1e08ffa621ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":"5.0.12"}],"published":"2026-03-06T19:00:27Z","updated":"2026-03-07T07:22:07Z"},{"id":"wordfence:31196bdf-2ddd-49ea-840d-8fd78611629e","source":"wordfence","cve":"CVE-2022-4151","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31196bdf-2ddd-49ea-840d-8fd78611629e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:311cc73c-9f5b-417c-8be9-c09ae70a64b2","source":"wordfence","cve":"CVE-2025-48143","title":"Formulario de contacto SalesUp! <= 1.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/311cc73c-9f5b-417c-8be9-c09ae70a64b2?source=api-prod","affected":[{"type":"plugin","slug":"formularios-de-contacto-salesup","name":"Formulario de contacto SalesUp!","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T10:47:34Z"},{"id":"wordfence:311cfaf3-f158-4936-a6a9-90b89469d75e","source":"wordfence","cve":"CVE-2025-22360","title":"WP Azure offload <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/311cfaf3-f158-4936-a6a9-90b89469d75e?source=api-prod","affected":[{"type":"plugin","slug":"wp-azure-offload","name":"WP Azure offload","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:07:44Z"},{"id":"wordfence:311f3fcd-05b7-43d3-8b2c-aeebee4be3c8","source":"wordfence","cve":"CVE-2025-32549","title":"WPGYM <= 65.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/311f3fcd-05b7-43d3-8b2c-aeebee4be3c8?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"65.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T14:17:58Z"},{"id":"wordfence:3120a964-223c-458d-93ce-1a9322772166","source":"wordfence","cve":"CVE-2025-47515","title":"WP DPE-GES <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3120a964-223c-458d-93ce-1a9322772166?source=api-prod","affected":[{"type":"plugin","slug":"wp-dpe-ges","name":"WP DPE-GES","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:36:07Z"},{"id":"wordfence:3120d169-3ff0-4551-ae2c-0b475ef6aabe","source":"wordfence","cve":"CVE-2026-123751","title":"Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3120d169-3ff0-4551-ae2c-0b475ef6aabe?source=api-prod","affected":[{"type":"plugin","slug":"local-sync","name":"WP Duplicate \u2013 WordPress Migration Plugin","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T20:02:51Z"},{"id":"wordfence:3121821e-676a-444e-8e5c-c0fff58bc6eb","source":"wordfence","cve":"CVE-2025-22299","title":"AI for SEO <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3121821e-676a-444e-8e5c-c0fff58bc6eb?source=api-prod","affected":[{"type":"plugin","slug":"ai-for-seo","name":"SOOZ \u2013 AI for SEO \u2013 Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:17:49Z"},{"id":"wordfence:3121bb03-7bc0-4005-9814-bc46ce9d4a9d","source":"wordfence","cve":"CVE-2026-1901","title":"QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3121bb03-7bc0-4005-9814-bc46ce9d4a9d?source=api-prod","affected":[{"type":"plugin","slug":"questionpro-surveys","name":"QuestionPro Surveys","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:26:37Z","updated":"2026-02-14T06:42:27Z"},{"id":"wordfence:3122b2f6-9ea9-41ca-914d-8a04ea18df6c","source":"wordfence","cve":"CVE-2025-49440","title":"WP Security Master <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3122b2f6-9ea9-41ca-914d-8a04ea18df6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-master","name":"WP Security Master","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:12:35Z"},{"id":"wordfence:31233f4e-4cd5-497f-9e8a-c65635596241","source":"wordfence","cve":"CVE-2026-18346","title":"TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31233f4e-4cd5-497f-9e8a-c65635596241?source=api-prod","affected":[{"type":"plugin","slug":"tiktok-for-business","name":"TikTok","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-09-18T19:51:26Z","updated":"2026-09-19T08:27:22Z"},{"id":"wordfence:312a6601-c914-4661-82ff-6f8bac849442","source":"wordfence","cve":"CVE-2024-7854","title":"Woo Inquiry <= 0.1 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/312a6601-c914-4661-82ff-6f8bac849442?source=api-prod","affected":[{"type":"plugin","slug":"woo-inquiry","name":"Woo Inquiry","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:18:44Z","updated":"2024-08-21T05:30:18Z"},{"id":"wordfence:312bb534-2a40-42f1-9a3e-8b1395e1e199","source":"wordfence","cve":"CVE-2018-1000510","title":"WP Image Zoom <= 1.23 - Cross-Site Request Forgery to Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/312bb534-2a40-42f1-9a3e-8b1395e1e199?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-zoooom","name":"WP Image Zoom","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.24"}],"published":"2018-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:312dabb0-9ae8-41a0-80b3-f4962c8066de","source":"wordfence","cve":"CVE-2025-62758","title":"Funnelforms Free <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/312dabb0-9ae8-41a0-80b3-f4962c8066de?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-10-28T21:09:45Z"},{"id":"wordfence:3130d987-6a54-4208-8591-0bb9626858ae","source":"wordfence","cve":"CVE-2026-10195","title":"FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3130d987-6a54-4208-8591-0bb9626858ae?source=api-prod","affected":[{"type":"plugin","slug":"fs-poster","name":"FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":"8.0.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T15:30:56Z"},{"id":"wordfence:3131eeeb-593d-443e-8641-7470bd1e556b","source":"wordfence","cve":"CVE-2022-29411","title":"Hermit \u97f3\u4e50\u64ad\u653e\u5668 <= 3.1.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3131eeeb-593d-443e-8641-7470bd1e556b?source=api-prod","affected":[{"type":"plugin","slug":"hermit","name":"Hermit \u97f3\u4e50\u64ad\u653e\u5668","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-04-28T12:22:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3133be9d-13d4-4fb4-bbcf-88a68cca1933","source":"wordfence","cve":"CVE-2026-81423","title":"Accept Stripe Payments < 2.1.4 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3133be9d-13d4-4fb4-bbcf-88a68cca1933?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:41:04Z"},{"id":"wordfence:313613ea-18cf-4e7d-aa75-586b80752edb","source":"wordfence","cve":"CVE-2026-13330","title":"Animation Addons for Elementor \u2013 GSAP Motion Elementor Addons & Website Templates < 2.7.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313613ea-18cf-4e7d-aa75-586b80752edb?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:38:09Z"},{"id":"wordfence:3137a85e-82e3-4111-ae60-1bcf1abd0c0b","source":"wordfence","cve":"CVE-2026-3571","title":"Pie Register \u2013 User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3137a85e-82e3-4111-ae60-1bcf1abd0c0b?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.8","to_inclusive":true,"patched_in":"3.8.4.9"}],"published":"2026-04-03T13:05:56Z","updated":"2026-04-04T01:24:07Z"},{"id":"wordfence:3137db18-6032-4ba5-9790-c1a7a95072b4","source":"wordfence","cve":"CVE-2015-9346","title":"Polls CP < 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3137db18-6032-4ba5-9790-c1a7a95072b4?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2015-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:313906d3-3999-4255-b9ac-580d9d3e80e6","source":"wordfence","cve":"CVE-2026-2498","title":"WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313906d3-3999-4255-b9ac-580d9d3e80e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-meta","name":"WP Social Meta","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:49:58Z","updated":"2026-02-26T01:24:14Z"},{"id":"wordfence:313af4a0-f32b-443f-a976-e06499d3c94b","source":"wordfence","cve":"CVE-2022-1202","title":"WP-CRM \u2013 Customer Relations Management for WordPress <= 1.2.1 - CSV injection","severity":"high","cvss":7.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313af4a0-f32b-443f-a976-e06499d3c94b?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm","name":"WP-CRM \u2013 Customer Relations Management for WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:313b3629-3bbb-4d96-a96c-e6fa2ef498a0","source":"wordfence","cve":"CVE-2025-31846","title":"Theater for WordPress <= 0.18.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313b3629-3bbb-4d96-a96c-e6fa2ef498a0?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.18.7","to_inclusive":true,"patched_in":"0.18.8"}],"published":"2025-04-01T00:00:00Z","updated":"2025-11-03T16:14:58Z"},{"id":"wordfence:313b5634-20c6-4666-be96-ce59fa4366ac","source":"wordfence","cve":"CVE-2026-25015","title":"UsersWP <= 1.2.53 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313b5634-20c6-4666-be96-ce59fa4366ac?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.53","to_inclusive":true,"patched_in":"1.2.54"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:16:45Z"},{"id":"wordfence:313d2749-7662-4870-b0f7-19253797f833","source":"wordfence","cve":"CVE-2026-4067","title":"Ad Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313d2749-7662-4870-b0f7-19253797f833?source=api-prod","affected":[{"type":"plugin","slug":"ad-short","name":"Ad Short","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:38Z","updated":"2026-03-21T03:26:39Z"},{"id":"wordfence:313db01b-8ee8-4df1-9a86-0de1bad46921","source":"wordfence","cve":"CVE-2026-49043","title":"WP Migrate Lite \u2013 Migration Made Easy <= 2.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/313db01b-8ee8-4df1-9a86-0de1bad46921?source=api-prod","affected":[{"type":"plugin","slug":"wp-migrate-db","name":"WP Migrate Lite \u2013 Migration Made Easy","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-15T19:21:24Z"},{"id":"wordfence:31418a45-7dae-4cd4-8f85-0498a285ef6d","source":"wordfence","cve":"CVE-2024-21746","title":"Wp Ultimate Review <= 2.3.6 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31418a45-7dae-4cd4-8f85-0498a285ef6d?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2024-01-05T00:00:00Z","updated":"2026-01-06T19:04:58Z"},{"id":"wordfence:3144f190-232c-40c0-9e4b-d1cedfe52b26","source":"wordfence","cve":"CVE-2025-13094","title":"WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3144f190-232c-40c0-9e4b-d1cedfe52b26?source=api-prod","affected":[{"type":"plugin","slug":"wp3d-model-import-block","name":"WP3D Model Import Viewer","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:19:08Z","updated":"2025-12-13T04:31:23Z"},{"id":"wordfence:314520d5-bd9d-46c1-b903-5e5cb3bb3417","source":"wordfence","cve":"CVE-2024-8743","title":"Bit File Manager \u2013 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload","severity":"medium","cvss":6.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/314520d5-bd9d-46c1-b903-5e5cb3bb3417?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T06:44:12Z"},{"id":"wordfence:31496229-bf54-466c-a87b-cc32e65500a4","source":"wordfence","cve":"","title":"WP Database Backup <= 5.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31496229-bf54-466c-a87b-cc32e65500a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:314ae0f5-8a4e-4bf3-9fc9-49f5b036b99e","source":"wordfence","cve":"CVE-2024-12719","title":"WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/314ae0f5-8a4e-4bf3-9fc9-49f5b036b99e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.15","to_inclusive":true,"patched_in":"4.25.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T09:22:16Z"},{"id":"wordfence:314b8638-15e7-461d-a705-3858fe6813e7","source":"wordfence","cve":"CVE-2025-1507","title":"ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/314b8638-15e7-461d-a705-3858fe6813e7?source=api-prod","affected":[{"type":"plugin","slug":"googleanalytics","name":"ShareThis Dashboard for Google Analytics","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T08:23:05Z"},{"id":"wordfence:314d172d-349f-4a2b-ab57-caf73e5c508f","source":"wordfence","cve":"CVE-2026-91017","title":"Robokassa payment gateway for Woocommerce <= 1.8.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/314d172d-349f-4a2b-ab57-caf73e5c508f?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:50:48Z"},{"id":"wordfence:314d3e0c-ba29-4795-a646-40e0acfc3405","source":"wordfence","cve":"","title":"Clone <= 2.3.7 - Cross-Site Request Forgery via wp_ajax_tifm_save_decision","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/314d3e0c-ba29-4795-a646-40e0acfc3405?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31500d35-0303-4715-8e40-5b583f110c0b","source":"wordfence","cve":"CVE-2026-27341","title":"TopScorer - Sports WordPress <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31500d35-0303-4715-8e40-5b583f110c0b?source=api-prod","affected":[{"type":"theme","slug":"topscorer","name":"TopScorer - Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:32:40Z"},{"id":"wordfence:3150785b-911b-44d8-aa85-afffce19c08e","source":"wordfence","cve":"CVE-2025-30957","title":"Activity Plus Reloaded for BuddyPress <= 1.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3150785b-911b-44d8-aa85-afffce19c08e?source=api-prod","affected":[{"type":"plugin","slug":"bp-activity-plus-reloaded","name":"Activity Plus Reloaded for BuddyPress","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:01:06Z"},{"id":"wordfence:3150bdc4-fe5d-47ca-bb52-338853e3e23d","source":"wordfence","cve":"CVE-2026-13609","title":"Frontend Admin by DynamiApps <= 3.29.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3150bdc4-fe5d-47ca-bb52-338853e3e23d?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.8","to_inclusive":true,"patched_in":"3.29.9"}],"published":"2026-07-16T00:00:00Z","updated":"2026-08-15T21:17:13Z"},{"id":"wordfence:31513f9e-6185-425b-9e7e-36f21f72d0a2","source":"wordfence","cve":"CVE-2024-7094","title":"JS Help Desk \u2013 The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31513f9e-6185-425b-9e7e-36f21f72d0a2?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2024-08-12T14:17:56Z","updated":"2024-08-19T19:22:48Z"},{"id":"wordfence:3152208e-e4f7-4f48-b6a1-05a656d9c826","source":"wordfence","cve":"CVE-2024-25922","title":"Peach Payments Gateway <= 3.1.9 - Missing Authorization via peach_core_version_rollback()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3152208e-e4f7-4f48-b6a1-05a656d9c826?source=api-prod","affected":[{"type":"plugin","slug":"wc-peach-payments-gateway","name":"Peach Payments Gateway","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T16:02:06Z"},{"id":"wordfence:31522e54-f260-46d0-8d57-2d46af7d3450","source":"wordfence","cve":"CVE-2023-5577","title":"Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31522e54-f260-46d0-8d57-2d46af7d3450?source=api-prod","affected":[{"type":"plugin","slug":"wp-bitly","name":"Bitly's WordPress Plugin","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-11-06T00:00:00Z","updated":"2024-05-28T21:28:50Z"},{"id":"wordfence:3154f909-6e2b-4254-b062-28fe25839285","source":"wordfence","cve":"CVE-2025-60051","title":"Rare Radio <= 1.0.15.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3154f909-6e2b-4254-b062-28fe25839285?source=api-prod","affected":[{"type":"theme","slug":"rareradio","name":"RareRadio | Music & Streaming Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.0.15.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:39:04Z"},{"id":"wordfence:3155f8ba-b50e-490c-81bd-4a63142f164b","source":"wordfence","cve":"CVE-2018-11709","title":"wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3155f8ba-b50e-490c-81bd-4a63142f164b?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":false,"patched_in":"1.4.12"}],"published":"2018-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:315687d4-9125-440b-9d53-81d71e56d4ef","source":"wordfence","cve":"CVE-2024-9274","title":"Elastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/315687d4-9125-440b-9d53-81d71e56d4ef?source=api-prod","affected":[{"type":"plugin","slug":"elastik-page-builder","name":"Elastik Page Builder","from":"*","from_inclusive":true,"to":"0.27.4","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:24:32Z","updated":"2024-10-01T07:30:10Z"},{"id":"wordfence:31579f6d-9a89-45e3-adfb-d59823a83c07","source":"wordfence","cve":"CVE-2020-9335","title":"Photo Gallery by 10Web <= 1.5.45 - Multiple Cross-Site Scripting Issues","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31579f6d-9a89-45e3-adfb-d59823a83c07?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.45","to_inclusive":true,"patched_in":"1.5.46"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31589d0c-42bc-4657-ac6a-ce236e427211","source":"wordfence","cve":"CVE-2025-62108","title":"Add Custom Codes <= 4.80 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31589d0c-42bc-4657-ac6a-ce236e427211?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-codes","name":"Add Custom Codes \u2013 Insert Header, Footer, Custom PHP Snippets, CSS, Javascript","from":"*","from_inclusive":true,"to":"4.80","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:29:55Z"},{"id":"wordfence:315dbb77-d872-4cc4-bb4c-9d4763a6ff8f","source":"wordfence","cve":"CVE-2023-35774","title":"LWS Tools <= 2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/315dbb77-d872-4cc4-bb4c-9d4763a6ff8f?source=api-prod","affected":[{"type":"plugin","slug":"lws-tools","name":"LWS Tools","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:315fbc93-5af3-4fe9-b97a-a09957e54c97","source":"wordfence","cve":"CVE-2026-3604","title":"WP SEO Structured Data Schema <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/315fbc93-5af3-4fe9-b97a-a09957e54c97?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-structured-data-schema","name":"WP SEO Structured Data Schema","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:10:33Z","updated":"2026-05-12T07:48:19Z"},{"id":"wordfence:31612b4b-a75f-4fa4-831b-43f62a8d5fad","source":"wordfence","cve":"CVE-2023-23997","title":"Database Collation Fix <= 1.2.7 - Cross-Site Request Forgery via admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31612b4b-a75f-4fa4-831b-43f62a8d5fad?source=api-prod","affected":[{"type":"plugin","slug":"database-collation-fix","name":"Database Collation Fix","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3164b96f-d876-4cbc-bddf-51e9d9becee6","source":"wordfence","cve":"CVE-2024-1337","title":"SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3164b96f-d876-4cbc-bddf-51e9d9becee6?source=api-prod","affected":[{"type":"plugin","slug":"skt-builder","name":"SKT Page Builder","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:25Z"},{"id":"wordfence:3166549e-b52e-41e8-8b5c-1a1a0558c858","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.1 -  Insufficient Privilege De-escalation","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3166549e-b52e-41e8-8b5c-1a1a0558c858?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3169d0e6-3e0a-49ca-9e39-c587f88209fa","source":"wordfence","cve":"CVE-2025-58878","title":"Woocommerce Gifts Product <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3169d0e6-3e0a-49ca-9e39-c587f88209fa?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-product","name":"Woocommerce Gifts Product","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:23:09Z"},{"id":"wordfence:316a1ca9-e5fd-463f-ba1e-32589740270a","source":"wordfence","cve":"CVE-2024-30182","title":"HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316a1ca9-e5fd-463f-ba1e-32589740270a?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:02:02Z"},{"id":"wordfence:316b807c-06ca-4448-acb9-80766a07258a","source":"wordfence","cve":"CVE-2025-0796","title":"Mortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316b807c-06ca-4448-acb9-80766a07258a?source=api-prod","affected":[{"type":"plugin","slug":"wprequal","name":"WPrequal","from":"*","from_inclusive":true,"to":"8.2.11","to_inclusive":true,"patched_in":"8.3.1"}],"published":"2025-02-17T15:45:09Z","updated":"2025-03-20T14:40:43Z"},{"id":"wordfence:316cecde-5e1a-4c1e-b4ce-c9f924103e3e","source":"wordfence","cve":"CVE-2026-22456","title":"Askka <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316cecde-5e1a-4c1e-b4ce-c9f924103e3e?source=api-prod","affected":[{"type":"theme","slug":"askka","name":"Askka - Candle Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:11:38Z"},{"id":"wordfence:316e98ba-c497-416e-9286-1d67daeb3fd4","source":"wordfence","cve":"CVE-2026-65454","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316e98ba-c497-416e-9286-1d67daeb3fd4?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.0","to_inclusive":true,"patched_in":"11.2.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:39:41Z"},{"id":"wordfence:316f1771-6c61-4ef9-aa6a-73e61acc43af","source":"wordfence","cve":"CVE-2025-28912","title":"Custom Dashboard Page <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316f1771-6c61-4ef9-aa6a-73e61acc43af?source=api-prod","affected":[{"type":"plugin","slug":"custom-dashboard-page","name":"Custom Dashboard Page","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:50:10Z"},{"id":"wordfence:316ffb37-47fe-47c4-8a81-5794fa12ce33","source":"wordfence","cve":"CVE-2023-48749","title":"Salient Core <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/316ffb37-47fe-47c4-8a81-5794fa12ce33?source=api-prod","affected":[{"type":"plugin","slug":"salient-core","name":"Salient | Creative Multipurpose & WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3172a459-8b3c-415c-97fc-ee5d248032c9","source":"wordfence","cve":"CVE-2025-26578","title":"Simple Documentation <= 1.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3172a459-8b3c-415c-97fc-ee5d248032c9?source=api-prod","affected":[{"type":"plugin","slug":"client-documentation","name":"Simple Documentation","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:33:34Z"},{"id":"wordfence:3173b995-98ba-47f2-afb3-bbd2949f1d8e","source":"wordfence","cve":"CVE-2025-30987","title":"JetBlocks For Elementor <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3173b995-98ba-47f2-afb3-bbd2949f1d8e?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":"1.3.16.1"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T13:35:07Z"},{"id":"wordfence:317b1bac-cd9c-4eac-b42b-d7719ecd135c","source":"wordfence","cve":"CVE-2022-25615","title":"eRoom \u2013 Zoom Meetings & Webinar <= 1.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/317b1bac-cd9c-4eac-b42b-d7719ecd135c?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2022-04-11T18:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:317e155b-5d7b-447b-93db-65b5f242a66d","source":"wordfence","cve":"CVE-2026-15272","title":"Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/317e155b-5d7b-447b-93db-65b5f242a66d?source=api-prod","affected":[{"type":"plugin","slug":"w2dc","name":"Web 2.0 Directory plugin for WordPress","from":"*","from_inclusive":true,"to":"2.10.12","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-10-30T21:33:06Z","updated":"2026-10-31T11:28:43Z"},{"id":"wordfence:317e17ac-74bd-44cd-8bae-aa893c588a46","source":"wordfence","cve":"CVE-2025-10730","title":"Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/317e17ac-74bd-44cd-8bae-aa893c588a46?source=api-prod","affected":[{"type":"plugin","slug":"wp-tabber-widget","name":"Wp tabber widget","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:39:10Z","updated":"2025-10-15T08:25:52Z"},{"id":"wordfence:31801c90-4233-4ecf-837b-61513b65f8c9","source":"wordfence","cve":"CVE-2025-39502","title":"Goodlayers Hostel <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31801c90-4233-4ecf-837b-61513b65f8c9?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hostel","name":"Goodlayers Hostel","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:38:22Z"},{"id":"wordfence:3184c304-52d3-4baa-b3c2-90957e1d8e79","source":"wordfence","cve":"CVE-2021-24915","title":"Contest Gallery \u2013 Photo Contest Plugin for WordPress <= 13.1.0.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3184c304-52d3-4baa-b3c2-90957e1d8e79?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"13.1.0.5","to_inclusive":true,"patched_in":"13.1.0.6"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:318919b1-2e92-4817-82f3-04db1c7f4fcf","source":"wordfence","cve":"CVE-2026-81287","title":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/318919b1-2e92-4817-82f3-04db1c7f4fcf?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.12.1","to_inclusive":true,"patched_in":"1.8.12.2"}],"published":"2026-08-31T11:33:47Z","updated":"2026-09-10T19:32:31Z"},{"id":"wordfence:318c68f9-2d5a-4871-a829-1b3eac306e90","source":"wordfence","cve":"CVE-2025-49348","title":"Hype <= 1.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/318c68f9-2d5a-4871-a829-1b3eac306e90?source=api-prod","affected":[{"type":"plugin","slug":"pico","name":"Hype","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-10T15:51:21Z"},{"id":"wordfence:318c7c3e-3872-4a90-92c6-d93ce2fd4333","source":"wordfence","cve":"CVE-2024-9458","title":"Reservit Hotel <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/318c7c3e-3872-4a90-92c6-d93ce2fd4333?source=api-prod","affected":[{"type":"plugin","slug":"reservit-hotel","name":"Reservit Hotel","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-11-14T00:00:00Z","updated":"2025-03-11T14:05:24Z"},{"id":"wordfence:31931ac8-08f8-4fe7-9318-5a1d8dc89bed","source":"wordfence","cve":"CVE-2026-118192","title":"JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31931ac8-08f8-4fe7-9318-5a1d8dc89bed?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.11","to_inclusive":true,"patched_in":"5.7.14"}],"published":"2026-10-28T20:36:50Z","updated":"2026-10-29T09:25:32Z"},{"id":"wordfence:3199e007-2710-4eb7-acd0-e1645130f0a5","source":"wordfence","cve":"CVE-2025-39416","title":"translit it! <= 1.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3199e007-2710-4eb7-acd0-e1645130f0a5?source=api-prod","affected":[{"type":"plugin","slug":"translit-it","name":"translit it!","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-04-17T00:00:00Z","updated":"2026-10-28T21:07:07Z"},{"id":"wordfence:319cccd5-fe76-4986-af4c-3132a09a2686","source":"wordfence","cve":"CVE-2025-60117","title":"Vehica Core <= 1.0.100 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/319cccd5-fe76-4986-af4c-3132a09a2686?source=api-prod","affected":[{"type":"plugin","slug":"vehica-core","name":"Vehica Core","from":"*","from_inclusive":true,"to":"1.0.100","to_inclusive":true,"patched_in":"1.0.101"}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T12:52:24Z"},{"id":"wordfence:319e9662-e010-469d-bf04-ee5895077db6","source":"wordfence","cve":"CVE-2013-2701","title":"Social Sharing Toolkit <= 2.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/319e9662-e010-469d-bf04-ee5895077db6?source=api-prod","affected":[{"type":"plugin","slug":"social-sharing-toolkit","name":"Social Sharing Toolkit","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2013-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:319ff434-aef3-4791-969f-c5de02ba6ad9","source":"wordfence","cve":"CVE-2025-66071","title":"Custom Order Numbers for WooCommerce <= 1.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/319ff434-aef3-4791-969f-c5de02ba6ad9?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-numbers-for-woocommerce","name":"Custom Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2025-11-22T00:00:00Z","updated":"2025-11-25T15:47:29Z"},{"id":"wordfence:31a04983-a1d9-49b3-9f1f-06fb3480531b","source":"wordfence","cve":"CVE-2024-43950","title":"Brickscore <= 1.4.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a04983-a1d9-49b3-9f1f-06fb3480531b?source=api-prod","affected":[{"type":"plugin","slug":"brickscore","name":"Brickscore","from":"*","from_inclusive":true,"to":"1.4.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:56:25Z"},{"id":"wordfence:31a12180-b51b-4d36-ac4f-f35243c5d770","source":"wordfence","cve":"CVE-2026-116751","title":"Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a12180-b51b-4d36-ac4f-f35243c5d770?source=api-prod","affected":[{"type":"plugin","slug":"amelia","name":"Booking for Appointments and Events Calendar \u2013 Amelia Pro","from":"4.0","from_inclusive":true,"to":"9.9.1","to_inclusive":true,"patched_in":"9.9.2"}],"published":"2026-11-06T21:28:29Z","updated":"2026-11-07T11:26:27Z"},{"id":"wordfence:31a145d5-3c0c-436f-a1ee-afff14ef2140","source":"wordfence","cve":"CVE-2023-37983","title":"Art Direction <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a145d5-3c0c-436f-a1ee-afff14ef2140?source=api-prod","affected":[{"type":"plugin","slug":"art-direction","name":"Art Direction","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31a1616d-a793-4153-bc19-551f39d699ec","source":"wordfence","cve":"CVE-2026-75028","title":"WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":true,"patched_in":"3.0.19"}],"published":"2026-10-02T17:37:33Z","updated":"2026-10-03T06:38:22Z"},{"id":"wordfence:31a3a3c1-be0e-46d5-9fa3-563febc5569b","source":"wordfence","cve":"CVE-2023-48332","title":"Mail Bank - #1 Mail SMTP Plugin for WordPress <= 4.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a3a3c1-be0e-46d5-9fa3-563febc5569b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-bank","name":"Mail Bank \u2013 #1 Mail SMTP Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31a47cbd-c19b-4ac3-87ed-2d4c5c0e9cb7","source":"wordfence","cve":"CVE-2025-7692","title":"Orion Login with SMS <= 1.0.5 - Authentication Bypass via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a47cbd-c19b-4ac3-87ed-2d4c5c0e9cb7?source=api-prod","affected":[{"type":"plugin","slug":"orion-login-with-sms","name":"Orion Login with SMS","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T20:51:51Z","updated":"2026-03-27T11:03:09Z"},{"id":"wordfence:31a54705-99e8-4e41-bf57-9365ab387228","source":"wordfence","cve":"CVE-2023-52185","title":"Everest Backup <= 2.1.9 - Sensitive Information Exposure via Log File","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a54705-99e8-4e41-bf57-9365ab387228?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31a66e30-972b-4a7b-9d47-ad7abd574e36","source":"wordfence","cve":"CVE-2024-1994","title":"Image Watermark <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Watermark Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a66e30-972b-4a7b-9d47-ad7abd574e36?source=api-prod","affected":[{"type":"plugin","slug":"image-watermark","name":"Image Watermark","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T01:54:50Z"},{"id":"wordfence:31a82837-f8da-44bf-81f6-af0d9c9a6e4c","source":"wordfence","cve":"CVE-2024-7414","title":"PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a82837-f8da-44bf-81f6-af0d9c9a6e4c?source=api-prod","affected":[{"type":"plugin","slug":"pdf-builder-for-wpforms","name":"PDF Builder for WPForms","from":"*","from_inclusive":true,"to":"1.2.116","to_inclusive":true,"patched_in":"1.2.117"}],"published":"2024-08-08T00:00:00Z","updated":"2024-08-09T09:30:11Z"},{"id":"wordfence:31aa4f8b-954c-410e-9f18-c1e62dd9850b","source":"wordfence","cve":"CVE-2021-24923","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31aa4f8b-954c-410e-9f18-c1e62dd9850b?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.25","to_inclusive":false,"patched_in":"3.1.25"}],"published":"2021-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31b52500-c53c-4606-b57c-cd14bb66afa9","source":"wordfence","cve":"","title":"JobCareer <= 3.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31b52500-c53c-4606-b57c-cd14bb66afa9?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2020-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31b67763-0542-4c50-9713-434d15c18cb7","source":"wordfence","cve":"CVE-2024-50481","title":"Bstone Demo Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31b67763-0542-4c50-9713-434d15c18cb7?source=api-prod","affected":[{"type":"plugin","slug":"bstone-demo-importer","name":"Bstone Demo Importer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:09:53Z"},{"id":"wordfence:31b80508-11cf-4508-a3ef-95b5da4fb81b","source":"wordfence","cve":"CVE-2025-62137","title":"Shuttle <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31b80508-11cf-4508-a3ef-95b5da4fb81b?source=api-prod","affected":[{"type":"theme","slug":"shuttle","name":"Shuttle","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:29:57Z"},{"id":"wordfence:31bc718c-da6e-4022-9383-1f4a86294e16","source":"wordfence","cve":"CVE-2026-110380","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31bc718c-da6e-4022-9383-1f4a86294e16?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"4.1.27"}],"published":"2026-10-16T12:31:00Z","updated":"2026-10-23T18:35:21Z"},{"id":"wordfence:31bcc1e1-08b6-4bbc-a28c-9c2d8feea819","source":"wordfence","cve":"CVE-2022-1013","title":"Personal Dictionary <= 1.3.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31bcc1e1-08b6-4bbc-a28c-9c2d8feea819?source=api-prod","affected":[{"type":"plugin","slug":"personal-dictionary","name":"Personal Dictionary \u2013 Vocabulary Games, Memory Games","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31c080b8-ba00-4e96-8961-2a1c3a017004","source":"wordfence","cve":"CVE-2023-7063","title":"WPForms Pro 1.8.4 - 1.8.5.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c080b8-ba00-4e96-8961-2a1c3a017004?source=api-prod","affected":[{"type":"plugin","slug":"wpforms","name":"WPForms Pro","from":"1.8.4","from_inclusive":true,"to":"1.8.5.3","to_inclusive":true,"patched_in":"1.8.5.4"}],"published":"2024-01-19T00:00:00Z","updated":"2024-07-29T21:36:08Z"},{"id":"wordfence:31c10c95-fe6a-4e2d-a472-b6e8b8bc7fe7","source":"wordfence","cve":"CVE-2024-54372","title":"Insertify <= 1.1.4 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c10c95-fe6a-4e2d-a472-b6e8b8bc7fe7?source=api-prod","affected":[{"type":"plugin","slug":"insertify","name":"Insertify \u2013 Ad,HTML,CSS,JS,PHP,PDF,Header & Footer","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:16:56Z"},{"id":"wordfence:31c15699-fc01-4765-becb-88cd6e93d797","source":"wordfence","cve":"CVE-2025-54014","title":"MediCenter - Health Medical Clinic <= 15.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c15699-fc01-4765-becb-88cd6e93d797?source=api-prod","affected":[{"type":"theme","slug":"medicenter","name":"MediCenter - Health Medical Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"15.1","to_inclusive":true,"patched_in":"15.2"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T20:06:59Z"},{"id":"wordfence:31c2cd54-f258-43ea-8db2-8d98ad7014d1","source":"wordfence","cve":"CVE-2025-13416","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c2cd54-f258-43ea-8db2-8d98ad7014d1?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.7.2","to_inclusive":true,"patched_in":"5.9.7.3"}],"published":"2026-02-04T20:24:28Z","updated":"2026-02-05T08:25:46Z"},{"id":"wordfence:31c47f9e-a454-4e23-bc4f-93f17a0d18a8","source":"wordfence","cve":"CVE-2026-34895","title":"Softlab Core < 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c47f9e-a454-4e23-bc4f-93f17a0d18a8?source=api-prod","affected":[{"type":"plugin","slug":"softlab-core","name":"Softlab Core","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":false,"patched_in":"1.2.11"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:28:58Z"},{"id":"wordfence:31c54e41-20e5-47bd-a2ce-3d552202bd59","source":"wordfence","cve":"CVE-2026-94171","title":"CURCY \u2013 Multi Currency for WooCommerce  2.2.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c54e41-20e5-47bd-a2ce-3d552202bd59?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"2.2.18","from_inclusive":true,"to":"2.2.18","to_inclusive":true,"patched_in":"2.2.19"}],"published":"2026-09-30T13:33:03Z","updated":"2026-10-28T21:15:07Z"},{"id":"wordfence:31c554cf-eee9-45a8-8fb6-198978620204","source":"wordfence","cve":"CVE-2026-5399","title":"Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c554cf-eee9-45a8-8fb6-198978620204?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.13.1","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2026-09-09T21:20:33Z","updated":"2026-09-10T09:27:08Z"},{"id":"wordfence:31c5e524-ef4d-48c7-baa0-595f8060a167","source":"wordfence","cve":"CVE-2023-4940","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c5e524-ef4d-48c7-baa0-595f8060a167?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31c6a879-0b90-44d7-9932-7a6acb25516d","source":"wordfence","cve":"CVE-2026-28147","title":"Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c6a879-0b90-44d7-9932-7a6acb25516d?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:09:49Z"},{"id":"wordfence:31c6e07a-3a3a-4295-a86d-79b4ca1a331e","source":"wordfence","cve":"","title":"Newspaper < 9.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c6e07a-3a3a-4295-a86d-79b4ca1a331e?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":false,"patched_in":"9.2.2"}],"published":"2019-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31c7b12c-eaab-405e-90da-3c5e8ab47245","source":"wordfence","cve":"CVE-2026-15731","title":"WP Multilang \u2013 Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c7b12c-eaab-405e-90da-3c5e8ab47245?source=api-prod","affected":[{"type":"plugin","slug":"wp-multilang","name":"WP Multilang \u2013 Translation and Multilingual Plugin","from":"*","from_inclusive":true,"to":"2.4.31","to_inclusive":true,"patched_in":"2.4.32"}],"published":"2026-09-23T20:44:55Z","updated":"2026-09-24T09:27:44Z"},{"id":"wordfence:31c9b86b-c971-4a0b-95ef-10bc7781e93f","source":"wordfence","cve":"CVE-2026-101925","title":"bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c9b86b-c971-4a0b-95ef-10bc7781e93f?source=api-prod","affected":[{"type":"plugin","slug":"bbp-style-pack","name":"bbp style pack","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.4.9"}],"published":"2026-09-30T20:12:56Z","updated":"2026-10-01T08:28:43Z"},{"id":"wordfence:31ca2de5-d63c-4ff8-9963-b96213d17cd0","source":"wordfence","cve":"CVE-2019-14348","title":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more < 3.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31ca2de5-d63c-4ff8-9963-b96213d17cd0?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2019-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31cafa29-6040-4fb3-a929-a13b4c087ae0","source":"wordfence","cve":"CVE-2025-49258","title":"Maia <= 1.1.15 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31cafa29-6040-4fb3-a929-a13b4c087ae0?source=api-prod","affected":[{"type":"theme","slug":"maia","name":"Maia - Jewelry Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:29:20Z"},{"id":"wordfence:31cb7a9d-8965-49cd-b1fb-0d141038a0e1","source":"wordfence","cve":"CVE-2024-31118","title":"SP Project & Document Manager  <= 4.70 - Missing Authorization Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31cb7a9d-8965-49cd-b1fb-0d141038a0e1?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.70","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:31:50Z"},{"id":"wordfence:31cc30c7-262d-4582-8976-fc8095bdca5f","source":"wordfence","cve":"CVE-2023-49851","title":"Square Thumbnails <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31cc30c7-262d-4582-8976-fc8095bdca5f?source=api-prod","affected":[{"type":"plugin","slug":"square-thumbnails","name":"Square Thumbnails","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-12-07T00:00:00Z","updated":"2024-07-03T14:57:00Z"},{"id":"wordfence:31cc700f-583e-4e7d-87b2-11998b505fb9","source":"wordfence","cve":"CVE-2026-9833","title":"Tag Groups <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31cc700f-583e-4e7d-87b2-11998b505fb9?source=api-prod","affected":[{"type":"plugin","slug":"tag-groups","name":"PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T23:27:58Z"},{"id":"wordfence:31cedfdf-5abc-4d51-b5b1-960159512c38","source":"wordfence","cve":"CVE-2025-48360","title":"Varnish/Nginx Proxy Caching <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31cedfdf-5abc-4d51-b5b1-960159512c38?source=api-prod","affected":[{"type":"plugin","slug":"vcaching","name":"Varnish/Nginx Proxy Caching","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:08:37Z"},{"id":"wordfence:31d2ccd2-d38b-4bdf-a905-a2b54ca80a58","source":"wordfence","cve":"CVE-2024-5880","title":"Hide My Site <= 2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31d2ccd2-d38b-4bdf-a905-a2b54ca80a58?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-site","name":"Hide My Site","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:27:27Z","updated":"2024-08-21T05:30:19Z"},{"id":"wordfence:31d6288d-87f0-4822-b3f4-541f70cf99fd","source":"wordfence","cve":"CVE-2023-5200","title":"flowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31d6288d-87f0-4822-b3f4-541f70cf99fd?source=api-prod","affected":[{"type":"plugin","slug":"flowpaper-lite-pdf-flipbook","name":"flowpaper","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31d7c673-b625-4862-bc03-378ad663467c","source":"wordfence","cve":"CVE-2017-1002001","title":"Mobile App Builder by WapPress <= 1.05 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31d7c673-b625-4862-bc03-378ad663467c?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-builder-by-wappress","name":"Mobile App Builder by WapPress","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2017-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31d8c5bc-9b16-4d91-bc68-08bdcee612cf","source":"wordfence","cve":"CVE-2025-47541","title":"Mail Mint <= 1.17.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31d8c5bc-9b16-4d91-bc68-08bdcee612cf?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.17.7","to_inclusive":true,"patched_in":"1.17.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:25:58Z"},{"id":"wordfence:31db39a3-1b0b-4fdf-bef1-72308e38c9ff","source":"wordfence","cve":"CVE-2015-9360","title":"UpdraftPlus <= 1.9.63 and UpdraftPlus (paid) <= 2.9.63 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31db39a3-1b0b-4fdf-bef1-72308e38c9ff?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.9.64","to_inclusive":false,"patched_in":"1.9.64"},{"type":"plugin","slug":"updraftplus-pro","name":"UpdraftPlus WordPress Backup Plugin (Premium)","from":"*","from_inclusive":true,"to":"2.9.64","to_inclusive":false,"patched_in":"2.9.64"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31dcf302-9334-476c-a0e2-d8a31bcbbe5d","source":"wordfence","cve":"CVE-2014-7138","title":"Simple Calendar \u2013 Google Calendar Plugin < 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31dcf302-9334-476c-a0e2-d8a31bcbbe5d?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2014-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31de3c9b-068d-47d8-9811-feae07f2e9d0","source":"wordfence","cve":"CVE-2023-47682","title":"WP User Frontend <= 3.6.5 - Authenticated (Author+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31de3c9b-068d-47d8-9811-feae07f2e9d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31dfc46c-a673-41f1-b701-aa832f004ebc","source":"wordfence","cve":"CVE-2024-7836","title":"Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31dfc46c-a673-41f1-b701-aa832f004ebc?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2024-08-21T12:05:35Z","updated":"2024-08-22T02:02:03Z"},{"id":"wordfence:31dfd1d2-9e09-45b3-b018-6ce12a981298","source":"wordfence","cve":"CVE-2025-26952","title":"Business Card Block <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31dfd1d2-9e09-45b3-b018-6ce12a981298?source=api-prod","affected":[{"type":"plugin","slug":"business-card-block","name":"Business Card Block \u2013 present your team and contact info in style","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:51:51Z"},{"id":"wordfence:31dff395-c3ce-4ebe-8d38-5243fc4510d6","source":"wordfence","cve":"CVE-2023-5506","title":"ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31dff395-c3ce-4ebe-8d38-5243fc4510d6?source=api-prod","affected":[{"type":"plugin","slug":"imagemapper","name":"ImageMapper","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31e11aff-056f-47c4-b5d1-c67af350585d","source":"wordfence","cve":"CVE-2024-32540","title":"Fixed HTML Toolbar <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e11aff-056f-47c4-b5d1-c67af350585d?source=api-prod","affected":[{"type":"plugin","slug":"fixed-html-toolbar","name":"Fixed HTML Toolbar","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:18:17Z"},{"id":"wordfence:31e41b8c-f83f-4cd7-a30f-deac6154c7e3","source":"wordfence","cve":"CVE-2026-115497","title":"Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e41b8c-f83f-4cd7-a30f-deac6154c7e3?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-10-09T17:25:08Z","updated":"2026-10-23T04:31:55Z"},{"id":"wordfence:31e518a9-316b-40a4-ada7-317fb2c16766","source":"wordfence","cve":"CVE-2025-4104","title":"Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e518a9-316b-40a4-ada7-317fb2c16766?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"1.0","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-05-06T20:38:49Z","updated":"2025-05-07T09:22:01Z"},{"id":"wordfence:31e5e799-17cf-41a9-aa99-b29dec529579","source":"wordfence","cve":"CVE-2024-43225","title":"Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e5e799-17cf-41a9-aa99-b29dec529579?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-08-09T00:00:00Z","updated":"2024-11-27T13:45:00Z"},{"id":"wordfence:31e7c09e-dc81-410c-bc7a-971190245ff1","source":"wordfence","cve":"CVE-2026-48967","title":"Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e7c09e-dc81-410c-bc7a-971190245ff1?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.19","to_inclusive":true,"patched_in":"1.13.20"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:48:22Z"},{"id":"wordfence:31e8c399-f8d3-461c-98fa-04f8cbb82d12","source":"wordfence","cve":"CVE-2026-5243","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31e8c399-f8d3-461c-98fa-04f8cbb82d12?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.11","to_inclusive":true,"patched_in":"6.4.12"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-14T05:30:30Z"},{"id":"wordfence:31eb7dd4-3bd1-41e8-875a-e40a7f16296d","source":"wordfence","cve":"CVE-2024-22289","title":"Post views Stats <= 1.3 - Reflected Cross-Site Scripting via from and to","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31eb7dd4-3bd1-41e8-875a-e40a7f16296d?source=api-prod","affected":[{"type":"plugin","slug":"post-views-stats","name":"Post views Stats","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-01-16T00:00:00Z","updated":"2024-05-21T19:25:15Z"},{"id":"wordfence:31ecc794-b605-467b-8966-346846dc38de","source":"wordfence","cve":"CVE-2025-28900","title":"TabGarb Pro <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31ecc794-b605-467b-8966-346846dc38de?source=api-prod","affected":[{"type":"plugin","slug":"tabgarb","name":"TabGarb Pro","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:12:11Z"},{"id":"wordfence:31ed0d2a-94bc-4526-9d21-6f2f544696d2","source":"wordfence","cve":"CVE-2024-39647","title":"Message Filter for Contact Form 7 <= 1.6.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31ed0d2a-94bc-4526-9d21-6f2f544696d2?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.1.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:47:41Z"},{"id":"wordfence:31edd562-b015-403a-960b-8c2396e8104a","source":"wordfence","cve":"CVE-2026-49079","title":"JetSearch <= 3.5.17 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31edd562-b015-403a-960b-8c2396e8104a?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.17","to_inclusive":true,"patched_in":"3.5.17.1"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:41:45Z"},{"id":"wordfence:31f000d6-10ab-4dee-97fb-83d1d00595bb","source":"wordfence","cve":"CVE-2025-69154","title":"SpaLab | Beauty Salon WordPress <= 6.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f000d6-10ab-4dee-97fb-83d1d00595bb?source=api-prod","affected":[{"type":"theme","slug":"spalab","name":"SpaLab | Beauty Salon WordPress Theme","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:39:35Z"},{"id":"wordfence:31f05d67-e963-4108-a276-fa024b174101","source":"wordfence","cve":"CVE-2025-64365","title":"Ohio Extra <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f05d67-e963-4108-a276-fa024b174101?source=api-prod","affected":[{"type":"plugin","slug":"ohio-extra","name":"Ohio Extra","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-04T15:17:22Z"},{"id":"wordfence:31f13524-2bd7-4157-b378-455ac4f822a1","source":"wordfence","cve":"CVE-2024-0975","title":"WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-access-control","name":"WordPress Access Control","from":"*","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:06Z"},{"id":"wordfence:31f24e61-4bb1-4159-bfd0-8598fc082801","source":"wordfence","cve":"CVE-2026-27999","title":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f24e61-4bb1-4159-bfd0-8598fc082801?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.23.1","to_inclusive":true,"patched_in":"2.23.2"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:01:45Z"},{"id":"wordfence:31f32e84-773e-492d-8f1a-5250e602f952","source":"wordfence","cve":"CVE-2025-2558","title":"The Wound <= 0.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f32e84-773e-492d-8f1a-5250e602f952?source=api-prod","affected":[{"type":"theme","slug":"the-wound","name":"The Wound","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-30T20:06:26Z"},{"id":"wordfence:31f3ad99-92fe-4c56-83e1-c4f777baa730","source":"wordfence","cve":"CVE-2024-8759","title":"Nested Pages <= 3.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f3ad99-92fe-4c56-83e1-c4f777baa730?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-10-09T00:00:00Z","updated":"2025-05-30T18:45:03Z"},{"id":"wordfence:31f4bad5-3a11-42c6-a336-6bd178ab5113","source":"wordfence","cve":"CVE-2024-5191","title":"Branda \u2013 White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f4bad5-3a11-42c6-a336-6bd178ab5113?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.17","to_inclusive":true,"patched_in":"3.4.18"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T06:58:20Z"},{"id":"wordfence:31f5ddbf-2014-40e7-881d-27148bf133ff","source":"wordfence","cve":"CVE-2024-11464","title":"Easy Code Snippets <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f5ddbf-2014-40e7-881d-27148bf133ff?source=api-prod","affected":[{"type":"plugin","slug":"easy-code-snippets","name":"Easy Code Snippets","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:33:05Z","updated":"2024-12-07T11:09:52Z"},{"id":"wordfence:31f6032a-19f8-463b-9642-cba205069a22","source":"wordfence","cve":"CVE-2020-35749","title":"Simple Job Board <= 2.9.3 - Local File Inclusion","severity":"high","cvss":7.7,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f6032a-19f8-463b-9642-cba205069a22?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2022-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:31f6ee4e-2106-42c8-8d52-0ce8e415c55f","source":"wordfence","cve":"CVE-2024-25931","title":"Heureka <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f6ee4e-2106-42c8-8d52-0ce8e415c55f?source=api-prod","affected":[{"type":"plugin","slug":"heureka","name":"Heureka","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-02-20T00:00:00Z","updated":"2026-02-26T14:54:04Z"},{"id":"wordfence:31f72c5b-a99b-48a1-959b-9718b33139b4","source":"wordfence","cve":"CVE-2024-1292","title":"WPB Show Core <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f72c5b-a99b-48a1-959b-9718b33139b4?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2024-03-18T00:00:00Z","updated":"2024-05-07T12:12:54Z"},{"id":"wordfence:31f7ae51-2fb2-4311-bc78-7198d6e6b623","source":"wordfence","cve":"CVE-2024-2136","title":"WPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f7ae51-2fb2-4311-bc78-7198d6e6b623?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T08:34:52Z"},{"id":"wordfence:31f7dc1e-2008-4672-85ba-56fa35f4f0e1","source":"wordfence","cve":"CVE-2024-24881","title":"WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f7dc1e-2008-4672-85ba-56fa35f4f0e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:42:24Z"},{"id":"wordfence:31f8bd62-32de-468c-9bed-e03374cb595c","source":"wordfence","cve":"CVE-2024-43936","title":"EmbedPress <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31f8bd62-32de-468c-9bed-e03374cb595c?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:01:48Z"},{"id":"wordfence:31ff5e93-ed21-4c7b-a46e-3ca003b1f9d6","source":"wordfence","cve":"CVE-2024-6133","title":"WP eStore <= 8.5.5 - Reflected Cross-Site Scripting via Customer Search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31ff5e93-ed21-4c7b-a46e-3ca003b1f9d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2024-07-19T00:00:00Z","updated":"2024-08-12T12:49:45Z"},{"id":"wordfence:320169b9-b490-474a-83cd-e7831bc4ad36","source":"wordfence","cve":"CVE-2026-22373","title":"Fooddy <= 1.3.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/320169b9-b490-474a-83cd-e7831bc4ad36?source=api-prod","affected":[{"type":"theme","slug":"fooddy","name":"Fooddy 24/7 - Food Delivery Takeout WordPress Theme + Elementor + RTL","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:23:59Z"},{"id":"wordfence:32028952-ccd7-48f6-87ce-0924f40d99ae","source":"wordfence","cve":"CVE-2026-49059","title":"Meta for WooCommerce <= 3.7.0 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32028952-ccd7-48f6-87ce-0924f40d99ae?source=api-prod","affected":[{"type":"plugin","slug":"facebook-for-woocommerce","name":"Meta for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-08T16:14:52Z"},{"id":"wordfence:32052509-2fa6-4317-8861-314e6da0869f","source":"wordfence","cve":"CVE-2026-111069","title":"GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32052509-2fa6-4317-8861-314e6da0869f?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.192","to_inclusive":true,"patched_in":"2.8.193"}],"published":"2026-10-15T17:59:14Z","updated":"2026-10-16T06:41:02Z"},{"id":"wordfence:3205670c-5c3c-48c3-a34a-6f9c25668258","source":"wordfence","cve":"CVE-2026-3459","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3205670c-5c3c-48c3-a34a-6f9c25668258?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.5","to_inclusive":true,"patched_in":"1.3.9.6"}],"published":"2026-03-05T06:23:44Z","updated":"2026-03-06T14:14:19Z"},{"id":"wordfence:3208426a-379d-46b9-a9e7-654604169929","source":"wordfence","cve":"CVE-2024-22290","title":"Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets","severity":"high","cvss":8.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3208426a-379d-46b9-a9e7-654604169929?source=api-prod","affected":[{"type":"plugin","slug":"custom-dashboard-widgets","name":"Custom Dashboard Widgets","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:320bc1c7-a874-4dc2-92b0-fb5620872ff9","source":"wordfence","cve":"CVE-2025-7501","title":"Wonder Slider Lite & Wonder Slider <= 14.4 - Authenticated (Contributor+) Dom-based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/320bc1c7-a874-4dc2-92b0-fb5620872ff9?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-slider","name":"Wonder Slider","from":"*","from_inclusive":true,"to":"14.4","to_inclusive":true,"patched_in":"14.5"},{"type":"plugin","slug":"wonderplugin-slider-lite","name":"Wonder Slider Lite","from":"*","from_inclusive":true,"to":"14.4","to_inclusive":true,"patched_in":"14.5"}],"published":"2025-07-25T00:00:00Z","updated":"2025-07-26T06:43:22Z"},{"id":"wordfence:320c0c1d-9d1b-43d7-aca5-2104b2a63e8f","source":"wordfence","cve":"CVE-2022-38454","title":"Kraken.io Image Optimizer <= 2.6.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/320c0c1d-9d1b-43d7-aca5-2104b2a63e8f?source=api-prod","affected":[{"type":"plugin","slug":"kraken-image-optimizer","name":"Kraken.io Image Optimizer \u2013 Compress, Convert to WebP & AVIF, Resize & Bulk Optimize","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:320f4260-20c2-4f27-91ba-d2488b417f62","source":"wordfence","cve":"CVE-2023-5120","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/320f4260-20c2-4f27-91ba-d2488b417f62?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.89","to_inclusive":true,"patched_in":"0.9.90"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32112d1b-4213-4eea-89d6-4bda41d32c9f","source":"wordfence","cve":"CVE-2025-66151","title":"Countdowner for Elementor <= 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32112d1b-4213-4eea-89d6-4bda41d32c9f?source=api-prod","affected":[{"type":"plugin","slug":"countdowner-elementor","name":"Countdowner \u2013 Countdown Timer for Elementor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:48:15Z"},{"id":"wordfence:32173d38-7f85-4e0c-9b4c-38bee2783d77","source":"wordfence","cve":"","title":"Quiz And Survey Master <= 8.1.15 - Cross-Site Request Forgery via 'display_results'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32173d38-7f85-4e0c-9b4c-38bee2783d77?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.15","to_inclusive":false,"patched_in":"8.1.16"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32179cca-2253-49c7-89f7-aa48bcfad716","source":"wordfence","cve":"CVE-2021-4208","title":"ExportFeed <= 2.0.1.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32179cca-2253-49c7-89f7-aa48bcfad716?source=api-prod","affected":[{"type":"plugin","slug":"exportfeed-list-woocommerce-products-on-ebay-store","name":"ExportFeed: List WooCommerce Products on eBay Store","from":"*","from_inclusive":true,"to":"2.0.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3218716a-cce6-4ce7-a6be-4e146e0a6d53","source":"wordfence","cve":"CVE-2026-1646","title":"Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3218716a-cce6-4ce7-a6be-4e146e0a6d53?source=api-prod","affected":[{"type":"plugin","slug":"advance-block-extend","name":"Advance Block Extend","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:53:05Z","updated":"2026-02-19T04:36:08Z"},{"id":"wordfence:32192878-930a-4947-a38f-ec395c17e515","source":"wordfence","cve":"CVE-2023-0749","title":"Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32192878-930a-4947-a38f-ec395c17e515?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32199349-f7ae-4ed3-ae2b-29e80c08c9d2","source":"wordfence","cve":"CVE-2026-120737","title":"Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter","severity":"medium","cvss":5.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32199349-f7ae-4ed3-ae2b-29e80c08c9d2?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.62.0","to_inclusive":true,"patched_in":"4.63.0"}],"published":"2026-11-06T14:01:19Z","updated":"2026-11-07T02:29:13Z"},{"id":"wordfence:321b2b0d-8169-4e80-b86f-2ae29d9b8b7d","source":"wordfence","cve":"CVE-2023-47223","title":"Basic Interactive World Map <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/321b2b0d-8169-4e80-b86f-2ae29d9b8b7d?source=api-prod","affected":[{"type":"plugin","slug":"basic-interactive-world-map","name":"Basic Interactive World Map","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.7"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:321bfc32-a08d-46ea-98c8-c7be10905307","source":"wordfence","cve":"","title":"Web en Mantenimiento <= 1.0.6 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/321bfc32-a08d-46ea-98c8-c7be10905307?source=api-prod","affected":[{"type":"plugin","slug":"web-en-mantenimiento","name":"Web en Mantenimiento","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:321d0121-5cc9-4736-89b0-228e45b48b48","source":"wordfence","cve":"CVE-2016-4825","title":"Welcart e-Commerce < 1.8.3 - Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/321d0121-5cc9-4736-89b0-228e45b48b48?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2016-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32207aa7-9298-4c92-98d4-5529b259b381","source":"wordfence","cve":"CVE-2025-39457","title":"Booking and Rental Manager <= 2.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32207aa7-9298-4c92-98d4-5529b259b381?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:02:26Z"},{"id":"wordfence:32237c21-2fec-4228-8264-e9f3f1a70060","source":"wordfence","cve":"CVE-2021-24976","title":"Smart SEO Tool <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32237c21-2fec-4228-8264-e9f3f1a70060?source=api-prod","affected":[{"type":"plugin","slug":"smart-seo-tool","name":"Smart SEO Tool \u2013 SEO\u4f18\u5316\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2021-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3223a1c0-e0e3-46e6-ba4c-777db86bdb26","source":"wordfence","cve":"CVE-2025-23919","title":"Slides & Presentations <= 0.0.39 - Missing Authorization to Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3223a1c0-e0e3-46e6-ba4c-777db86bdb26?source=api-prod","affected":[{"type":"plugin","slug":"slide","name":"Slides & Presentations","from":"*","from_inclusive":true,"to":"0.0.39","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:30:04Z"},{"id":"wordfence:32253923-ffec-4312-bcdf-06c5aed77d30","source":"wordfence","cve":"CVE-2023-2813","title":"Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32253923-ffec-4312-bcdf-06c5aed77d30?source=api-prod","affected":[{"type":"theme","slug":"college","name":"College","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"},{"type":"theme","slug":"anfaust","name":"Anfaust","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"brain-power","name":"Brain Power","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bunnypresslite","name":"BunnyPressLite","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"},{"type":"theme","slug":"bazaar-lite","name":"Bazaar Lite","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"},{"type":"theme","slug":"cafe-bistro","name":"Cafe Bistro","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"},{"type":"theme","slug":"arendelle","name":"Arendelle","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"theme","slug":"anand","name":"Anand","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"atlast-business","name":"Atlast Business","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"aapna","name":"Aapna","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3225f23a-845c-486e-bb9d-268dc1cc7361","source":"wordfence","cve":"CVE-2025-48337","title":"QuickCab <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3225f23a-845c-486e-bb9d-268dc1cc7361?source=api-prod","affected":[{"type":"plugin","slug":"quickcab","name":"quickcab","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-02T19:24:26Z"},{"id":"wordfence:32272237-43c1-4b77-b586-9fad4af279e4","source":"wordfence","cve":"CVE-2019-25314","title":"Yoast Duplicate Post <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32272237-43c1-4b77-b586-9fad4af279e4?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post","name":"Yoast Duplicate Post","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"3.2.4"}],"published":"2019-09-26T00:00:00Z","updated":"2026-02-13T16:13:40Z"},{"id":"wordfence:322e0a27-9119-4b46-a043-d3a68c4fcdc4","source":"wordfence","cve":"CVE-2026-0807","title":"Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=api-prod","affected":[{"type":"plugin","slug":"frontis-blocks","name":"Frontis Blocks \u2014 Block Library for the Block Editor","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-01-23T19:20:45Z","updated":"2026-01-24T07:26:41Z"},{"id":"wordfence:323436b5-fbfe-4923-8b08-93c1fcabc016","source":"wordfence","cve":"CVE-2026-2559","title":"Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/323436b5-fbfe-4923-8b08-93c1fcabc016?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-18T15:28:31Z"},{"id":"wordfence:32346090-ef3e-4a42-b7e2-7f3b7a9221e0","source":"wordfence","cve":"CVE-2021-42359","title":"WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32346090-ef3e-4a42-b7e2-7f3b7a9221e0?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.23","to_inclusive":true,"patched_in":"3.1.24"}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32348f79-232f-42e6-bbea-aba6203d9f26","source":"wordfence","cve":"CVE-2024-34369","title":"Webpushr <= 4.35.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32348f79-232f-42e6-bbea-aba6203d9f26?source=api-prod","affected":[{"type":"plugin","slug":"webpushr-web-push-notifications","name":"Web Push Notifications \u2013 Webpushr","from":"*","from_inclusive":true,"to":"4.35.0","to_inclusive":true,"patched_in":"4.36.0"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T12:58:37Z"},{"id":"wordfence:3235ecfb-8aac-4e0c-b11e-77727c362194","source":"wordfence","cve":"CVE-2024-30483","title":"Sponsors <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3235ecfb-8aac-4e0c-b11e-77727c362194?source=api-prod","affected":[{"type":"plugin","slug":"wp-sponsors","name":"Sponsors","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:15:32Z"},{"id":"wordfence:32369351-ddae-452f-b286-6478deab5a97","source":"wordfence","cve":"CVE-2024-53787","title":"Random Banner <= 4.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32369351-ddae-452f-b286-6478deab5a97?source=api-prod","affected":[{"type":"plugin","slug":"random-banner","name":"Random Banner","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2025-04-21T14:47:37Z"},{"id":"wordfence:32385e77-9629-4aa2-8f1e-9804809fcea3","source":"wordfence","cve":"CVE-2015-9293","title":"All In One WP Security & Firewall <= 3.9.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32385e77-9629-4aa2-8f1e-9804809fcea3?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":false,"patched_in":"3.9.8"}],"published":"2015-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:323fde5c-5b63-462d-ae8b-8414ef0f36f3","source":"wordfence","cve":"CVE-2025-23979","title":"flashy <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/323fde5c-5b63-462d-ae8b-8414ef0f36f3?source=api-prod","affected":[{"type":"theme","slug":"flashy","name":"flashy","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T16:42:50Z"},{"id":"wordfence:32419c04-bd10-431a-b87c-1975dacc2e01","source":"wordfence","cve":"CVE-2022-1827","title":"PDF24 Article To PDF <= 4.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32419c04-bd10-431a-b87c-1975dacc2e01?source=api-prod","affected":[{"type":"plugin","slug":"pdf24-post-to-pdf","name":"PDF24 Article To PDF","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:324448a3-759d-462b-bf38-64414d134228","source":"wordfence","cve":"CVE-2026-28101","title":"UberSlider MouseInteraction <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324448a3-759d-462b-bf38-64414d134228?source=api-prod","affected":[{"type":"plugin","slug":"uberSlider_mouseinteraction","name":"UberSlider - Layer Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:10:12Z"},{"id":"wordfence:32483206-7d8f-4b9e-ab44-967a4b7145b4","source":"wordfence","cve":"CVE-2024-43935","title":"Delicious Recipes \u2013 WordPress Recipe Plugin <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32483206-7d8f-4b9e-ab44-967a4b7145b4?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:59:43Z"},{"id":"wordfence:324a51af-587e-4831-a48e-13bbd5038fc7","source":"wordfence","cve":"CVE-2021-24578","title":"SportsPress <= 2.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324a51af-587e-4831-a48e-13bbd5038fc7?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2021-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:324c747e-35b2-4d56-bd00-7591669b24b9","source":"wordfence","cve":"CVE-2025-24651","title":"WebToffee WP Backup and Migration <= 1.5.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324c747e-35b2-4d56-bd00-7591669b24b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-01-13T00:00:00Z","updated":"2025-04-22T21:14:21Z"},{"id":"wordfence:324e3762-a55c-4693-9621-a228f5943837","source":"wordfence","cve":"CVE-2025-67522","title":"Jobmonster <= 4.8.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324e3762-a55c-4693-9621-a228f5943837?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T17:29:08Z"},{"id":"wordfence:324e5681-a76f-4611-adff-02b4735f4efc","source":"wordfence","cve":"CVE-2024-56296","title":"Mang Board WP <= 1.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324e5681-a76f-4611-adff-02b4735f4efc?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:15:19Z"},{"id":"wordfence:324fc401-04ca-4707-8727-b8c3a66f7fd6","source":"wordfence","cve":"CVE-2024-3994","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324fc401-04ca-4707-8727-b8c3a66f7fd6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T09:29:58Z"},{"id":"wordfence:324fcf1b-a811-4750-bf48-87cb6570d51a","source":"wordfence","cve":"CVE-2018-16283","title":"\u5fae\u4fe1\u7fa4\u53d1\u52a9\u624b-Wechat Broadcast <= 1.2.0 - Directory Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324fcf1b-a811-4750-bf48-87cb6570d51a?source=api-prod","affected":[{"type":"plugin","slug":"wechat-broadcast","name":"\u5fae\u4fe1\u7fa4\u53d1\u52a9\u624b-Wechat Broadcast","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2018-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:324fd823-8ec9-4187-8694-6160bad8e093","source":"wordfence","cve":"CVE-2026-0680","title":"Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/324fd823-8ec9-4187-8694-6160bad8e093?source=api-prod","affected":[{"type":"plugin","slug":"real-post-slider-lite","name":"Real Post Slider Lite","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:48:09Z","updated":"2026-01-14T05:28:05Z"},{"id":"wordfence:32506176-6e74-4889-9cbd-111a57980b0c","source":"wordfence","cve":"CVE-2025-63056","title":"Contact Form by BestWebSoft <= 4.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32506176-6e74-4889-9cbd-111a57980b0c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2025-12-07T00:00:00Z","updated":"2026-04-15T13:32:09Z"},{"id":"wordfence:325298a6-954b-4cf7-a96a-9571cdb0b5a5","source":"wordfence","cve":"CVE-2024-30457","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/325298a6-954b-4cf7-a96a-9571cdb0b5a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.1","to_inclusive":true,"patched_in":"1.3.3.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:58:45Z"},{"id":"wordfence:3253e1b3-ac63-4796-ac10-92781d5a76c8","source":"wordfence","cve":"CVE-2023-40196","title":"ImageRecycle pdf & image compression <= 3.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3253e1b3-ac63-4796-ac10-92781d5a76c8?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.12"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3256da87-0d37-4c8f-9bac-95e3017e35d5","source":"wordfence","cve":"CVE-2024-6493","title":"NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3256da87-0d37-4c8f-9bac-95e3017e35d5?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code","name":"NinjaTeam Header Footer Custom Code","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-23T15:34:08Z"},{"id":"wordfence:325813f3-c893-4e98-ad99-452ff63d5e18","source":"wordfence","cve":"CVE-2024-35728","title":"PPOM for WooCommerce <= 32.0.20 - Unauthenticated Content Injection Vulnerability","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/325813f3-c893-4e98-ad99-452ff63d5e18?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"32.0.20","to_inclusive":true,"patched_in":"32.0.21"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:34:50Z"},{"id":"wordfence:32594284-a7ed-4f43-b0cf-dc0e561768c2","source":"wordfence","cve":"CVE-2015-9269","title":"WordPress Mobile Pack \u2013 Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.1.3 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32594284-a7ed-4f43-b0cf-dc0e561768c2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-mobile-pack","name":"WordPress Mobile Pack \u2013 Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"}],"published":"2015-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:325c2350-174b-4117-bacd-ae28bf3b16bc","source":"wordfence","cve":"CVE-2024-12126","title":"SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/325c2350-174b-4117-bacd-ae28bf3b16bc?source=api-prod","affected":[{"type":"plugin","slug":"seo-keywords","name":"SEO Keywords","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:06:56Z","updated":"2025-01-07T04:21:58Z"},{"id":"wordfence:325dd035-db3d-49b4-a422-7c2c734bfd32","source":"wordfence","cve":"CVE-2022-2517","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/325dd035-db3d-49b4-a422-7c2c734bfd32?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.5.5.2","to_inclusive":true,"patched_in":"2.5.5.3"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32647c44-389a-4a6d-a32b-e19a35bc2aeb","source":"wordfence","cve":"CVE-2023-46776","title":"Auto Excerpt everywhere <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32647c44-389a-4a6d-a32b-e19a35bc2aeb?source=api-prod","affected":[{"type":"plugin","slug":"auto-excerpt-everywhere","name":"Auto Excerpt everywhere","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32648d65-88a7-48fa-adeb-3060a1cf5b93","source":"wordfence","cve":"CVE-2022-2219","title":"Unyson <= 2.7.26 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32648d65-88a7-48fa-adeb-3060a1cf5b93?source=api-prod","affected":[{"type":"plugin","slug":"unyson","name":"Unyson","from":"*","from_inclusive":true,"to":"2.7.26","to_inclusive":true,"patched_in":"2.7.27"}],"published":"2022-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32652a9a-00ba-4e86-9947-c7c7ebd21494","source":"wordfence","cve":"CVE-2023-23815","title":"Multi-column Tag Map <= 17.0.24 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32652a9a-00ba-4e86-9947-c7c7ebd21494?source=api-prod","affected":[{"type":"plugin","slug":"multi-column-tag-map","name":"Multi-column Tag Map","from":"*","from_inclusive":true,"to":"17.0.24","to_inclusive":true,"patched_in":"17.0.25"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32658119-82e7-4302-9af9-728e054374ec","source":"wordfence","cve":"CVE-2024-55990","title":"Mollie for Contact Form 7 <= 5.0.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32658119-82e7-4302-9af9-728e054374ec?source=api-prod","affected":[{"type":"plugin","slug":"cf7-mollie","name":"Mollie for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:58:33Z"},{"id":"wordfence:326618eb-186b-44a2-a779-00d5366bfff2","source":"wordfence","cve":"CVE-2023-47771","title":"Essential Grid <= 3.0.18 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/326618eb-186b-44a2-a779-00d5366bfff2?source=api-prod","affected":[{"type":"plugin","slug":"essential-grid","name":"Essential Grid Portfolio \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":true,"patched_in":"3.0.19"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:326707a9-5d37-4d26-a9d4-3b2db84289b9","source":"wordfence","cve":"CVE-2025-22335","title":"Opencart Product in WP <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/326707a9-5d37-4d26-a9d4-3b2db84289b9?source=api-prod","affected":[{"type":"plugin","slug":"opencart-product-in-wp","name":"Opencart Product in WP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:01:30Z"},{"id":"wordfence:3267ca02-341a-4fb6-b7f1-08094bff0eb0","source":"wordfence","cve":"CVE-2025-29005","title":"HR Management Lite <= 3.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3267ca02-341a-4fb6-b7f1-08094bff0eb0?source=api-prod","affected":[{"type":"plugin","slug":"hr-management-lite","name":"HR Management Lite","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-06-05T00:00:00Z","updated":"2026-06-23T17:34:02Z"},{"id":"wordfence:32682598-ad1c-4aa1-bdf2-a7966a4d1dbe","source":"wordfence","cve":"CVE-2024-24834","title":"BEAR <= 1.1.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32682598-ad1c-4aa1-bdf2-a7966a4d1dbe?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.4.1"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:17:00Z"},{"id":"wordfence:326c16af-a2d3-431b-9735-a5dbd9a68ae0","source":"wordfence","cve":"CVE-2024-56295","title":"Poll Maker <= 5.5.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/326c16af-a2d3-431b-9735-a5dbd9a68ae0?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:03:17Z"},{"id":"wordfence:326e168d-c2ae-485f-93ff-ed59d5b6061e","source":"wordfence","cve":"CVE-2024-53819","title":"Client Invoicing by Sprout Invoices <= 20.8.0 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/326e168d-c2ae-485f-93ff-ed59d5b6061e?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.0","to_inclusive":true,"patched_in":"20.8.1"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:27:26Z"},{"id":"wordfence:32701ae6-004c-41e2-bdf0-d78c6c2b3e97","source":"wordfence","cve":"CVE-2026-7624","title":"SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32701ae6-004c-41e2-bdf0-d78c6c2b3e97?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.16","to_inclusive":true,"patched_in":"12.4.17"}],"published":"2026-06-05T14:31:03Z","updated":"2026-06-06T03:28:24Z"},{"id":"wordfence:32713069-ea40-46ef-a789-9646eab2e651","source":"wordfence","cve":"CVE-2023-6741","title":"WP Customer Area <= 8.2.1 - Insecure Direct Object Reference to Address Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32713069-ea40-46ef-a789-9646eab2e651?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:49:44Z"},{"id":"wordfence:32725074-5c62-49e0-83f9-c6cb77fb77a4","source":"wordfence","cve":"CVE-2025-2815","title":"Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32725074-5c62-49e0-83f9-c6cb77fb77a4?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2025.03.24","to_inclusive":true,"patched_in":"2025.03.27"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T18:35:24Z"},{"id":"wordfence:327282b9-8cad-47aa-9c59-4e4b9d134148","source":"wordfence","cve":"CVE-2025-69143","title":"Mission <= 1.22 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327282b9-8cad-47aa-9c59-4e4b9d134148?source=api-prod","affected":[{"type":"theme","slug":"mission","name":"Mission","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:12:37Z"},{"id":"wordfence:3275c47d-caf5-49e6-8aa2-20a6d8106f26","source":"wordfence","cve":"CVE-2024-4329","title":"Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3275c47d-caf5-49e6-8aa2-20a6d8106f26?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.9.1"}],"published":"2024-05-10T18:41:10Z","updated":"2024-05-11T06:43:42Z"},{"id":"wordfence:327a155c-7a7d-494d-94d1-f7e7ee8927f0","source":"wordfence","cve":"CVE-2026-12144","title":"Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327a155c-7a7d-494d-94d1-f7e7ee8927f0?source=api-prod","affected":[{"type":"plugin","slug":"woo-wholesale-pricing","name":"Wholesale for WooCommerce \u2013 Ultimate AI-Powered B2B Ecommerce Solution \u2013 Bulk Order Form, Quotes, & More","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-07-28T13:28:13Z","updated":"2026-07-29T01:29:43Z"},{"id":"wordfence:327b7a35-59fc-4971-9d3f-10665e1725f7","source":"wordfence","cve":"CVE-2025-9861","title":"ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=api-prod","affected":[{"type":"plugin","slug":"themeloom-widgets","name":"ThemeLoom Widgets","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:53:50Z","updated":"2025-09-11T07:24:52Z"},{"id":"wordfence:327deb08-715f-4d54-b95b-18552c07cbc0","source":"wordfence","cve":"CVE-2025-4200","title":"Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327deb08-715f-4d54-b95b-18552c07cbc0?source=api-prod","affected":[{"type":"theme","slug":"bw-zagg","name":"Zagg - Electronics & Accessories WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:48:41Z","updated":"2025-06-14T08:23:23Z"},{"id":"wordfence:327e41a8-1fd4-4cb6-8a90-b3cdc4977b00","source":"wordfence","cve":"CVE-2025-67551","title":"Wappointment <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327e41a8-1fd4-4cb6-8a90-b3cdc4977b00?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-11-17T00:00:00Z","updated":"2025-12-10T16:08:15Z"},{"id":"wordfence:327e706d-2d6c-4204-a531-281f2e2dbcf0","source":"wordfence","cve":"CVE-2023-5000","title":"Horizontal scrolling announcements <= 2.4 -  Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327e706d-2d6c-4204-a531-281f2e2dbcf0?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-scrolling-announcements","name":"Horizontal scrolling announcements","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-06T01:49:58Z"},{"id":"wordfence:327f23f3-ab4a-4bf6-ba0a-4be73f852648","source":"wordfence","cve":"CVE-2025-30800","title":"Gum Elementor Addon <= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327f23f3-ab4a-4bf6-ba0a-4be73f852648?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:53:28Z"},{"id":"wordfence:327f5628-20f8-4e37-9c54-d37d61e939b3","source":"wordfence","cve":"CVE-2025-32568","title":"EmpikPlace for Woocommerce <= 1.4.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327f5628-20f8-4e37-9c54-d37d61e939b3?source=api-prod","affected":[{"type":"plugin","slug":"empik-for-woocommerce","name":"Empik for Woocommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-30T14:47:37Z"},{"id":"wordfence:327f645b-4990-4b5e-b39c-6c55ac4e66f0","source":"wordfence","cve":"","title":"WP Easy Gallery <= 2.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/327f645b-4990-4b5e-b39c-6c55ac4e66f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3280c728-c71d-417a-a188-40dad3cd5996","source":"wordfence","cve":"CVE-2024-13222","title":"User Messages <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3280c728-c71d-417a-a188-40dad3cd5996?source=api-prod","affected":[{"type":"plugin","slug":"user-messages","name":"User Messages","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-19T16:48:08Z"},{"id":"wordfence:3281d6eb-9f14-43d4-a4d4-532993039e53","source":"wordfence","cve":"CVE-2025-11988","title":"Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3281d6eb-9f14-43d4-a4d4-532993039e53?source=api-prod","affected":[{"type":"plugin","slug":"crypto","name":"Crypto","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-11-10T15:07:28Z","updated":"2026-07-29T22:04:14Z"},{"id":"wordfence:3282244f-2b5f-4795-9f3f-461c4fd2e296","source":"wordfence","cve":"CVE-2021-24805","title":"DW Question & Answer Pro <= 1.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3282244f-2b5f-4795-9f3f-461c4fd2e296?source=api-prod","affected":[{"type":"plugin","slug":"dw-question-answer-pro","name":"DW Question Answer Pro","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2022-04-08T00:00:00Z","updated":"2026-02-25T18:35:45Z"},{"id":"wordfence:32832d82-8d23-4825-8d31-71d223eaceed","source":"wordfence","cve":"CVE-2025-52795","title":"WP Front User Submit / Front Editor <= 4.9.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32832d82-8d23-4825-8d31-71d223eaceed?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:41:33Z"},{"id":"wordfence:3283b3ff-1787-466b-9517-84bd715e4165","source":"wordfence","cve":"CVE-2024-13923","title":"Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function","severity":"high","cvss":7.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3283b3ff-1787-466b-9517-84bd715e4165?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-03-19T22:24:30Z","updated":"2025-03-20T11:11:27Z"},{"id":"wordfence:3283f2b7-28a5-4c39-aeef-3237ecc57cf3","source":"wordfence","cve":"CVE-2021-36917","title":"Hide My WP <= 6.2.3 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3283f2b7-28a5-4c39-aeef-3237ecc57cf3?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2021-11-24T14:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:328438ba-128d-4094-83a5-bfd6e1616fa4","source":"wordfence","cve":"CVE-2021-24383","title":"WP Google Maps <= 8.1.11 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328438ba-128d-4094-83a5-bfd6e1616fa4?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"8.1.12","to_inclusive":false,"patched_in":"8.1.12"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3285f4ee-086f-4111-b5d9-d37e269aa2ad","source":"wordfence","cve":"CVE-2025-48093","title":"Password only login <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3285f4ee-086f-4111-b5d9-d37e269aa2ad?source=api-prod","affected":[{"type":"plugin","slug":"password-only-login","name":"Password only login","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:54:39Z"},{"id":"wordfence:3288536d-e0c9-4c9f-8d28-444dfe79d770","source":"wordfence","cve":"CVE-2025-62015","title":"Advanced Coupons for WooCommerce Coupons <= 4.6.8 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3288536d-e0c9-4c9f-8d28-444dfe79d770?source=api-prod","affected":[{"type":"plugin","slug":"advanced-coupons-for-woocommerce-free","name":"Advanced Coupons for WooCommerce \u2013 BOGO, Store Credit & WooCommerce Coupons","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.6.9"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:51:56Z"},{"id":"wordfence:328a4d88-afa2-4305-a8e5-73e626e9f53f","source":"wordfence","cve":"CVE-2026-6964","title":"Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328a4d88-afa2-4305-a8e5-73e626e9f53f?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.6.7","to_inclusive":true,"patched_in":"4.6.8"}],"published":"2026-06-15T14:43:40Z","updated":"2026-06-16T03:30:09Z"},{"id":"wordfence:328b6de6-e003-470d-ae03-28c9bdb617e0","source":"wordfence","cve":"CVE-2025-28960","title":"Evangelische Termine <= 3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328b6de6-e003-470d-ae03-28c9bdb617e0?source=api-prod","affected":[{"type":"plugin","slug":"evangtermine","name":"Evangelische Termine","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T15:45:21Z"},{"id":"wordfence:328bc382-f562-46cc-9d6d-74279f2fa9d3","source":"wordfence","cve":"CVE-2025-60152","title":"Subscribe To Unlock <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328bc382-f562-46cc-9d6d-74279f2fa9d3?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-unlock","name":"Subscribe To Unlock","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:13:10Z"},{"id":"wordfence:328c2df0-e8e9-46e8-a95d-d0b65f9d2f0b","source":"wordfence","cve":"CVE-2024-44002","title":"Team Showcase <= 1.22.25 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328c2df0-e8e9-46e8-a95d-d0b65f9d2f0b?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.25","to_inclusive":true,"patched_in":"1.22.26"}],"published":"2024-09-16T00:00:00Z","updated":"2024-10-10T17:49:47Z"},{"id":"wordfence:328ccf8f-797b-4b1a-b0f1-afd8e44f41e6","source":"wordfence","cve":"CVE-2026-1881","title":"Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328ccf8f-797b-4b1a-b0f1-afd8e44f41e6?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.52.2","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-05-20T13:15:10Z","updated":"2026-05-21T01:26:15Z"},{"id":"wordfence:328d65f4-422c-4c96-ad5d-b02b596aa998","source":"wordfence","cve":"CVE-2025-49077","title":"Dynamic Pricing and Discount Rules <= 2.2.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328d65f4-422c-4c96-ad5d-b02b596aa998?source=api-prod","affected":[{"type":"plugin","slug":"discount-and-dynamic-pricing","name":"Dynamic Pricing and Discount Rules","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:40:19Z"},{"id":"wordfence:328fc7a9-be41-4e30-bb8d-c12ac3fd63f5","source":"wordfence","cve":"CVE-2025-8479","title":"Zoho Flow <= 2.14.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/328fc7a9-be41-4e30-bb8d-c12ac3fd63f5?source=api-prod","affected":[{"type":"plugin","slug":"zoho-flow","name":"Zoho Flow \u2013 No-Code Workflow Automation","from":"*","from_inclusive":true,"to":"2.14.1","to_inclusive":true,"patched_in":"2.14.2"}],"published":"2025-09-10T00:00:00Z","updated":"2025-09-11T06:43:51Z"},{"id":"wordfence:329226bc-7d0e-45e0-8ac0-656517e0e4ca","source":"wordfence","cve":"CVE-2026-111592","title":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329226bc-7d0e-45e0-8ac0-656517e0e4ca?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-30T19:34:54Z","updated":"2026-10-31T07:46:48Z"},{"id":"wordfence:329a140f-94e0-4e2e-8030-c091ad8ac65a","source":"wordfence","cve":"CVE-2024-47373","title":"LiteSpeed Cache <= 6.5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329a140f-94e0-4e2e-8030-c091ad8ac65a?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.5.0.2","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:12:40Z"},{"id":"wordfence:329a7910-fc9e-4786-9f0e-84eeb6e48bf4","source":"wordfence","cve":"CVE-2021-24739","title":"Logo Carousel <= 3.4.1 - Unauthorised Private Post Access","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329a7910-fc9e-4786-9f0e-84eeb6e48bf4?source=api-prod","affected":[{"type":"plugin","slug":"logo-carousel-free","name":"Logo Carousel \u2013 Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:329a886e-35e0-4c31-b9fe-2a82166e948a","source":"wordfence","cve":"CVE-2026-39601","title":"Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329a886e-35e0-4c31-b9fe-2a82166e948a?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.8.4","to_inclusive":true,"patched_in":"11.9"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T13:09:07Z"},{"id":"wordfence:329aae11-a141-4c61-8198-1cd8e4e6bfea","source":"wordfence","cve":"CVE-2025-2317","title":"Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329aae11-a141-4c61-8198-1cd8e4e6bfea?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-04-03T16:22:47Z","updated":"2025-04-04T05:22:45Z"},{"id":"wordfence:329ad5dc-9339-4540-aba3-f21a78a74d4b","source":"wordfence","cve":"CVE-2024-12006","title":"W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329ad5dc-9339-4540-aba3-f21a78a74d4b?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-14T07:05:41Z"},{"id":"wordfence:329f6e9b-f2f4-4c4e-9512-fcf504c2c0ed","source":"wordfence","cve":"CVE-2014-9454","title":"Simple Sticky Footer <= 1.3.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/329f6e9b-f2f4-4c4e-9512-fcf504c2c0ed?source=api-prod","affected":[{"type":"plugin","slug":"simple-sticky-footer","name":"Simple Sticky Footer","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2014-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32a1d281-cc98-4e63-80f5-4f89104f9377","source":"wordfence","cve":"CVE-2025-58007","title":"Hubbub Lite <= 1.35.1 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32a1d281-cc98-4e63-80f5-4f89104f9377?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.35.1","to_inclusive":true,"patched_in":"1.36.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T21:08:29Z"},{"id":"wordfence:32a24a9d-b902-4a66-83d5-c8e3b8dd7923","source":"wordfence","cve":"CVE-2022-0620","title":"Delete Old Order <= 0.2 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32a24a9d-b902-4a66-83d5-c8e3b8dd7923?source=api-prod","affected":[{"type":"plugin","slug":"delete-old-orders","name":"Delete Old Orders","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32a2515d-d4b5-4d44-beb3-6090efc9448a","source":"wordfence","cve":"CVE-2026-87892","title":"Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution < 1.2.0 - Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32a2515d-d4b5-4d44-beb3-6090efc9448a?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:10:43Z"},{"id":"wordfence:32aa1fdc-2fca-4486-b704-eabe4668361e","source":"wordfence","cve":"CVE-2021-25046","title":"Modern Events Calendar Lite <= 6.1.6 - Subscriber+ Category Add Leading to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32aa1fdc-2fca-4486-b704-eabe4668361e?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2021-12-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32ac72f7-6bcc-4b5d-925a-9c5fc0c1f065","source":"wordfence","cve":"","title":"Advanced Ads <= 1.17.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ac72f7-6bcc-4b5d-925a-9c5fc0c1f065?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"1.17.4","to_inclusive":false,"patched_in":"1.17.4"}],"published":"2020-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32ac79f4-ada7-4c14-8675-53f8375912d8","source":"wordfence","cve":"CVE-2024-9017","title":"PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ac79f4-ada7-4c14-8675-53f8375912d8?source=api-prod","affected":[{"type":"plugin","slug":"peepso-groups","name":"PeepSo Core: Groups","from":"*","from_inclusive":true,"to":"6.4.6.0","to_inclusive":true,"patched_in":"6.4.6.1"}],"published":"2025-07-02T18:17:48Z","updated":"2026-03-27T11:04:34Z"},{"id":"wordfence:32ad6b52-1d59-4458-9661-3f1f126163ca","source":"wordfence","cve":"CVE-2026-22350","title":"PDF for Elementor Forms + Drag And Drop Template Builder <= 6.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ad6b52-1d59-4458-9661-3f1f126163ca?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-elementor-forms","name":"PDF for Elementor Forms + Drag And Drop Template Builder","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:39:20Z"},{"id":"wordfence:32add0cc-445e-4039-9dfa-15f154b4d7c6","source":"wordfence","cve":"CVE-2025-26997","title":"Wireless Butler <= 1.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32add0cc-445e-4039-9dfa-15f154b4d7c6?source=api-prod","affected":[{"type":"theme","slug":"wireless-butler","name":"Wireless Butler","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:59:21Z"},{"id":"wordfence:32b2b8e9-aa49-4cc3-97b7-249695969461","source":"wordfence","cve":"CVE-2023-50897","title":"Media File Renamer <= 5.7.7 - Authenticated(Administrator+) Remote Code Execution","severity":"medium","cvss":6.6,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b2b8e9-aa49-4cc3-97b7-249695969461?source=api-prod","affected":[{"type":"plugin","slug":"media-file-renamer","name":"Media File Renamer: Rename Images & Files for SEO (AI-Powered)","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"5.7.8"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32b3552c-5948-444e-9482-056b94387cdc","source":"wordfence","cve":"CVE-2025-69360","title":"TheGem Theme Elements (for WPBakery) <= 5.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b3552c-5948-444e-9482-056b94387cdc?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements","name":"TheGem Theme Elements (for WPBakery)","from":"*","from_inclusive":true,"to":"5.11.0","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-14T14:56:52Z"},{"id":"wordfence:32b3ad84-6adb-44c1-942a-51f27638c8c9","source":"wordfence","cve":"","title":"Multiple Roles < 1.3.7 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b3ad84-6adb-44c1-942a-51f27638c8c9?source=api-prod","affected":[{"type":"plugin","slug":"multiple-roles","name":"Multiple Roles","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32b49654-26f6-4b83-8851-92e04408e8b2","source":"wordfence","cve":"CVE-2024-35685","title":"Radcliffe 2 <= 2.0.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b49654-26f6-4b83-8851-92e04408e8b2?source=api-prod","affected":[{"type":"theme","slug":"radcliffe-2","name":"Radcliffe 2","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:07:54Z"},{"id":"wordfence:32b6938a-0566-46c8-8761-0403b3a0e3e9","source":"wordfence","cve":"CVE-2024-3293","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b6938a-0566-46c8-8761-0403b3a0e3e9?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"4.6.19"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T01:58:06Z"},{"id":"wordfence:32b6ccfe-a659-41e4-9cec-146f4f910071","source":"wordfence","cve":"CVE-2026-7284","title":"Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b6ccfe-a659-41e4-9cec-146f4f910071?source=api-prod","affected":[{"type":"plugin","slug":"easy-elements","name":"Easy Elements for Elementor \u2013 Addons & Website Templates","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-05-19T13:10:24Z","updated":"2026-05-20T01:25:47Z"},{"id":"wordfence:32b70801-d80f-40dc-8321-e12ac0b8c695","source":"wordfence","cve":"CVE-2024-1960","title":"ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32b70801-d80f-40dc-8321-e12ac0b8c695?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2024-03-14T00:00:00Z","updated":"2024-07-31T15:45:06Z"},{"id":"wordfence:32bc88a7-93ed-4d67-9383-b6d935a0df4d","source":"wordfence","cve":"CVE-2023-5707","title":"SEO Slider <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32bc88a7-93ed-4d67-9383-b6d935a0df4d?source=api-prod","affected":[{"type":"plugin","slug":"seo-slider","name":"SEO Slider","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32bcff2d-e322-4c9c-b1c2-f07aa54faff9","source":"wordfence","cve":"CVE-2025-2167","title":"Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32bcff2d-e322-4c9c-b1c2-f07aa54faff9?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"}],"published":"2025-03-25T19:54:47Z","updated":"2025-03-26T08:21:51Z"},{"id":"wordfence:32c2a25d-e660-4700-8df3-b043cf6aa78a","source":"wordfence","cve":"","title":"LiveChat Elementor <= 1.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c2a25d-e660-4700-8df3-b043cf6aa78a?source=api-prod","affected":[{"type":"plugin","slug":"livechat-elementor","name":"Live Chat Plugin for Elementor \u2013 LiveChat","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32c46940-d396-4b2a-9f1c-1ca51b8d16a9","source":"wordfence","cve":"CVE-2024-38683","title":"WooCommerce Report <= 1.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c46940-d396-4b2a-9f1c-1ca51b8d16a9?source=api-prod","affected":[{"type":"plugin","slug":"ithemelandco-woo-report","name":"REPORTiT \u2013 Advanced Reporting for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-07T13:33:05Z"},{"id":"wordfence:32c4cb55-855c-42ed-a9ac-90f92e8583e0","source":"wordfence","cve":"CVE-2024-2102","title":"Salon booking system <= 9.6.2 - Unauthenticated Stored Cross-Site Scripting via 'sms_prefix'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c4cb55-855c-42ed-a9ac-90f92e8583e0?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.6.2","to_inclusive":true,"patched_in":"9.6.3"}],"published":"2024-03-27T00:00:00Z","updated":"2026-03-27T11:06:19Z"},{"id":"wordfence:32c70189-cb0f-4804-8d1f-2bd6915012ab","source":"wordfence","cve":"CVE-2026-76790","title":"Estatik <= 4.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c70189-cb0f-4804-8d1f-2bd6915012ab?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:50:24Z"},{"id":"wordfence:32c7a2fb-8390-4ae0-9a12-113250b1969e","source":"wordfence","cve":"CVE-2025-62090","title":"Gutenverse News \u2013 Advanced News Magazine Blog Gutenberg Blocks Addons <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c7a2fb-8390-4ae0-9a12-113250b1969e?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-news","name":"Gutenverse News \u2013 News Blocks for Blog & Magazine Sites","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-12-03T00:00:00Z","updated":"2026-01-07T14:39:22Z"},{"id":"wordfence:32c805a7-5818-442e-bc49-661b0d3320e8","source":"wordfence","cve":"CVE-2025-46487","title":"EC Authorize.net <=  0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c805a7-5818-442e-bc49-661b0d3320e8?source=api-prod","affected":[{"type":"plugin","slug":"ec-authorizenet","name":"EC Authorize.net","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:18:37Z"},{"id":"wordfence:32c99b96-4e89-41c0-b3d1-9c6d6537b4eb","source":"wordfence","cve":"CVE-2025-48302","title":"FundEngine <= 1.7.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32c99b96-4e89-41c0-b3d1-9c6d6537b4eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-11T14:58:55Z"},{"id":"wordfence:32ca6e56-add9-4024-831f-5dfa5130a7d8","source":"wordfence","cve":"CVE-2018-5311","title":"Easy Custom Auto Excerpt < 2.4.7 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ca6e56-add9-4024-831f-5dfa5130a7d8?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-auto-excerpt","name":"Easy Custom Auto Excerpt","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":false,"patched_in":"2.4.7"}],"published":"2018-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32ccbde2-b6a9-4748-907d-b948937dad09","source":"wordfence","cve":"CVE-2024-33634","title":"Piotnet Addons For Elementor Pro <= 7.1.17 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ccbde2-b6a9-4748-907d-b948937dad09?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:25:25Z"},{"id":"wordfence:32cce973-bc3b-45f1-ad4d-ff395d3a6c8e","source":"wordfence","cve":"CVE-2026-3506","title":"WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32cce973-bc3b-45f1-ad4d-ff395d3a6c8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-chatbot","name":"WP-Chatbot for Messenger","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T14:38:14Z","updated":"2026-03-21T03:26:39Z"},{"id":"wordfence:32ce92b9-8c9c-4a7e-9580-00a564500e30","source":"wordfence","cve":"CVE-2026-27368","title":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.19.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ce92b9-8c9c-4a7e-9580-00a564500e30?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.19.8","to_inclusive":true,"patched_in":"6.19.9"}],"published":"2025-12-24T00:00:00Z","updated":"2026-03-17T21:28:08Z"},{"id":"wordfence:32d0f709-192a-4d9f-bfe9-15c1be4c4b95","source":"wordfence","cve":"","title":"iThemes Security < 5.3.1 - Insecure Backup/Logfile Generation","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d0f709-192a-4d9f-bfe9-15c1be4c4b95?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":false,"patched_in":"5.3.1"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32d341a8-b32f-4e38-8b9c-c483810b1f3a","source":"wordfence","cve":"CVE-2025-22293","title":"Gutentor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d341a8-b32f-4e38-8b9c-c483810b1f3a?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-22T23:00:41Z"},{"id":"wordfence:32d3974e-8a45-48a4-869a-33b886c095e1","source":"wordfence","cve":"CVE-2025-60158","title":"Nota Fiscal Eletr\u00f4nica WooCommerce <= 3.4.0.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d3974e-8a45-48a4-869a-33b886c095e1?source=api-prod","affected":[{"type":"plugin","slug":"nota-fiscal-eletronica-woocommerce","name":"Nota Fiscal Eletr\u00f4nica Webmania","from":"*","from_inclusive":true,"to":"3.4.0.9","to_inclusive":true,"patched_in":"3.4.1.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-01-06T20:23:14Z"},{"id":"wordfence:32d4c259-b56d-4f8f-84b8-7ef451fd02ad","source":"wordfence","cve":"CVE-2024-29137","title":"Tourfic <= 2.11.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d4c259-b56d-4f8f-84b8-7ef451fd02ad?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.11.7","to_inclusive":true,"patched_in":"2.11.8"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:58:19Z"},{"id":"wordfence:32d80824-c420-40e8-8c07-fb17b1b50644","source":"wordfence","cve":"CVE-2013-2709","title":"FourSquare Checkins < 1.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d80824-c420-40e8-8c07-fb17b1b50644?source=api-prod","affected":[{"type":"plugin","slug":"foursquare-checkins","name":"FourSquare Checkins","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2013-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32d81267-f17c-4d53-bbc9-7b52683351e3","source":"wordfence","cve":"CVE-2017-18604","title":"SiteBuilder Dynamic Components <= 1.0 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32d81267-f17c-4d53-bbc9-7b52683351e3?source=api-prod","affected":[{"type":"plugin","slug":"sitebuilder-dynamic-components","name":"SiteBuilder Dynamic Components","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32da04ba-bee3-4fd3-b91b-57e588d5f4e4","source":"wordfence","cve":"CVE-2025-7341","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32da04ba-bee3-4fd3-b91b-57e588d5f4e4?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-07-14T15:58:21Z","updated":"2025-07-22T16:16:31Z"},{"id":"wordfence:32da1015-338f-422f-a777-12b5bee8152d","source":"wordfence","cve":"CVE-2025-26733","title":"Traveler <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32da1015-338f-422f-a777-12b5bee8152d?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-05-23T14:07:33Z"},{"id":"wordfence:32db57ec-47f8-4b33-b22c-6d8c079412a8","source":"wordfence","cve":"CVE-2022-38135","title":"Photospace Gallery <= 2.3.5 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32db57ec-47f8-4b33-b22c-6d8c079412a8?source=api-prod","affected":[{"type":"plugin","slug":"photospace","name":"Photospace Gallery","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":""}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32dc0914-b5a3-49f2-86ed-3bc9de6cc974","source":"wordfence","cve":"CVE-2026-65500","title":"Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32dc0914-b5a3-49f2-86ed-3bc9de6cc974?source=api-prod","affected":[{"type":"theme","slug":"manual","name":"Manual - Documentation, Knowledge Base & Education WordPress Theme","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:11:46Z"},{"id":"wordfence:32dc0986-aedc-4c16-956f-1b4bb7d7b99e","source":"wordfence","cve":"CVE-2026-22493","title":"Gaspard <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32dc0986-aedc-4c16-956f-1b4bb7d7b99e?source=api-prod","affected":[{"type":"theme","slug":"gaspard","name":"Gaspard - Restaurant and Coffee Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:05:19Z"},{"id":"wordfence:32dd7de3-980d-4ade-988d-a483f16a19df","source":"wordfence","cve":"CVE-2024-31346","title":"Gradient Text Widget for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32dd7de3-980d-4ade-988d-a483f16a19df?source=api-prod","affected":[{"type":"plugin","slug":"gradient-text-widget-for-elementor","name":"Gradient Text Widget for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:20:52Z"},{"id":"wordfence:32dd8dd7-d08a-444d-a76d-984ab25cc42c","source":"wordfence","cve":"CVE-2024-51645","title":"ThemeFuse Maintenance Mode <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32dd8dd7-d08a-444d-a76d-984ab25cc42c?source=api-prod","affected":[{"type":"plugin","slug":"themefuse-maintenance-mode","name":"ThemeFuse Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:23:20Z"},{"id":"wordfence:32deb3f1-a2dc-4a75-82be-21b90dc4ec11","source":"wordfence","cve":"CVE-2025-23628","title":"GeoDigs <= 3.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32deb3f1-a2dc-4a75-82be-21b90dc4ec11?source=api-prod","affected":[{"type":"plugin","slug":"geodigs","name":"GeoDigs","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:45:33Z"},{"id":"wordfence:32df7bdb-d99d-4548-8960-3fefdf635753","source":"wordfence","cve":"CVE-2024-6159","title":"Push Notification for Post and BuddyPress <= 1.93 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32df7bdb-d99d-4548-8960-3fefdf635753?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"1.93","to_inclusive":true,"patched_in":"1.94"}],"published":"2024-05-27T00:00:00Z","updated":"2024-08-07T21:46:05Z"},{"id":"wordfence:32e2e584-ddf6-4874-8730-e16e9c6b1293","source":"wordfence","cve":"CVE-2026-103078","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32e2e584-ddf6-4874-8730-e16e9c6b1293?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-05T08:38:00Z","updated":"2026-10-08T23:15:58Z"},{"id":"wordfence:32e50379-4dbc-46ce-8475-2e24d874bc68","source":"wordfence","cve":"CVE-2025-58935","title":"Lunna <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32e50379-4dbc-46ce-8475-2e24d874bc68?source=api-prod","affected":[{"type":"theme","slug":"lunna","name":"Lunna - Photographer Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:33:51Z"},{"id":"wordfence:32e8224d-a653-48d7-a3f4-338fc0c1dc77","source":"wordfence","cve":"CVE-2015-10135","title":"WPshop 2 \u2013 E-Commerce < 1.3.9.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32e8224d-a653-48d7-a3f4-338fc0c1dc77?source=api-prod","affected":[{"type":"plugin","slug":"wpshop","name":"WPshop 2 \u2013 E-Commerce","from":"*","from_inclusive":true,"to":"1.3.9.6","to_inclusive":false,"patched_in":"1.3.9.6"}],"published":"2015-03-09T00:00:00Z","updated":"2025-07-19T09:23:52Z"},{"id":"wordfence:32eb02b8-71cd-4cdb-aa9d-3fd1850fb126","source":"wordfence","cve":"CVE-2025-12064","title":"WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32eb02b8-71cd-4cdb-aa9d-3fd1850fb126?source=api-prod","affected":[{"type":"plugin","slug":"facebook-auto-publish","name":"WP2Social Auto Publish","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:46Z"},{"id":"wordfence:32ec6291-cd65-4244-8990-c536e812673e","source":"wordfence","cve":"CVE-2026-18962","title":"Photo Album Plus <= 9.2.09.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ec6291-cd65-4244-8990-c536e812673e?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.09.1","to_inclusive":true,"patched_in":"9.2.09.002"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:58:35Z"},{"id":"wordfence:32ee3eb8-18b7-47da-b4f9-cb252ffabc71","source":"wordfence","cve":"CVE-2023-36522","title":"Quiz Expert \u2013 Easy Quiz Maker, Exam and Test Manager <= 1.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32ee3eb8-18b7-47da-b4f9-cb252ffabc71?source=api-prod","affected":[{"type":"plugin","slug":"quiz-expert","name":"Quiz Expert \u2013 Easy Quiz Maker, Exam and Test Manager","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32f03892-500f-4925-9b3d-3160243de8a0","source":"wordfence","cve":"CVE-2020-5650","title":"Simple Download Monitor <= 3.8.8 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f03892-500f-4925-9b3d-3160243de8a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2020-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32f2fc21-165c-483f-ab81-48d8f221e4be","source":"wordfence","cve":"","title":"Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f2fc21-165c-483f-ab81-48d8f221e4be?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32f3dfe1-816a-486c-8996-cc340af51638","source":"wordfence","cve":"CVE-2025-39587","title":"Cost Calculator Builder <= 3.2.65 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f3dfe1-816a-486c-8996-cc340af51638?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.65","to_inclusive":true,"patched_in":"3.2.68"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:14:55Z"},{"id":"wordfence:32f47b68-e1ae-4ed1-9513-bba60aab65fb","source":"wordfence","cve":"CVE-2022-3249","title":"WP CSV Exporter <= 1.3.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f47b68-e1ae-4ed1-9513-bba60aab65fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-csv-exporter","name":"WP CSV Exporter","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:32f55a78-b5ed-496b-b173-575b8867e410","source":"wordfence","cve":"CVE-2026-32375","title":"Travel Diaries <= 1.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f55a78-b5ed-496b-b173-575b8867e410?source=api-prod","affected":[{"type":"theme","slug":"travel-diaries","name":"Travel Diaries","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:53:10Z"},{"id":"wordfence:32f5c4f8-2435-4ede-9dc9-e53fd65467f0","source":"wordfence","cve":"CVE-2024-50433","title":"Sky Addons for Elementor <= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f5c4f8-2435-4ede-9dc9-e53fd65467f0?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.5.15","to_inclusive":true,"patched_in":"2.5.16"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:48:22Z"},{"id":"wordfence:32f5fe20-42b5-472b-89fe-25a97e260e4f","source":"wordfence","cve":"CVE-2026-42712","title":"Qode Tours <= 3.1.3.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32f5fe20-42b5-472b-89fe-25a97e260e4f?source=api-prod","affected":[{"type":"plugin","slug":"qode-tours","name":"Qode Tours","from":"*","from_inclusive":true,"to":"3.1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:21:54Z"},{"id":"wordfence:32fa4d64-0cdd-4c47-aaf7-816824b27175","source":"wordfence","cve":"CVE-2026-42649","title":"Favicon Rotator <= 1.2.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fa4d64-0cdd-4c47-aaf7-816824b27175?source=api-prod","affected":[{"type":"plugin","slug":"favicon-rotator","name":"Favicon Rotator","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:42:09Z"},{"id":"wordfence:32fba103-f2d7-4fd2-b420-b9b096ecf5f3","source":"wordfence","cve":"CVE-2026-89006","title":"WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fba103-f2d7-4fd2-b420-b9b096ecf5f3?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.26","to_inclusive":true,"patched_in":"2.8.27"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:57:22Z"},{"id":"wordfence:32fbba37-208c-4e94-8d07-f3fd14ee2ee1","source":"wordfence","cve":"CVE-2026-92977","title":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fbba37-208c-4e94-8d07-f3fd14ee2ee1?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2026-10-02T15:07:38Z","updated":"2026-10-03T03:25:44Z"},{"id":"wordfence:32fe415d-f96d-4023-9faf-b83e7ff6acb1","source":"wordfence","cve":"CVE-2025-23932","title":"Quick Count <= 3.00 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fe415d-f96d-4023-9faf-b83e7ff6acb1?source=api-prod","affected":[{"type":"plugin","slug":"quick-count","name":"Quick Count","from":"*","from_inclusive":true,"to":"3.00","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:50:54Z"},{"id":"wordfence:32fe7659-095f-4256-b456-6d4877a02ea7","source":"wordfence","cve":"CVE-2026-97073","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fe7659-095f-4256-b456-6d4877a02ea7?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-10-29T14:39:00Z","updated":"2026-11-03T20:14:40Z"},{"id":"wordfence:32fe8a09-b08f-42dc-b436-96a6ea50a439","source":"wordfence","cve":"CVE-2022-47448","title":"xili-tidy-tags <= 1.12.03 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/32fe8a09-b08f-42dc-b436-96a6ea50a439?source=api-prod","affected":[{"type":"plugin","slug":"xili-tidy-tags","name":"xili-tidy-tags","from":"*","from_inclusive":true,"to":"1.12.03","to_inclusive":true,"patched_in":"1.12.04"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3301899e-5c38-4ecd-b095-6e00b0f7582e","source":"wordfence","cve":"CVE-2023-32104","title":"MyCurator Content Curation <= 3.74 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3301899e-5c38-4ecd-b095-6e00b0f7582e?source=api-prod","affected":[{"type":"plugin","slug":"mycurator","name":"MyCurator Content Curation","from":"*","from_inclusive":true,"to":"3.74","to_inclusive":true,"patched_in":"3.75"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3302cb58-e5d7-4c15-9f2d-f8951c32451e","source":"wordfence","cve":"CVE-2025-26987","title":"Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3302cb58-e5d7-4c15-9f2d-f8951c32451e?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.25.17","to_inclusive":true,"patched_in":"3.25.18"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:49:30Z"},{"id":"wordfence:33056eeb-31b0-4f17-b892-808fce147068","source":"wordfence","cve":"CVE-2026-53673","title":"BuddyPress <= 14.4.0 - Authenticated (Custom+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33056eeb-31b0-4f17-b892-808fce147068?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-10-13T19:29:11Z"},{"id":"wordfence:33074011-595a-4218-84e8-e28b75c12815","source":"wordfence","cve":"CVE-2025-23464","title":"Twitter News Feed <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33074011-595a-4218-84e8-e28b75c12815?source=api-prod","affected":[{"type":"plugin","slug":"twitter-news-feed","name":"Twitter News Feed","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:46:28Z"},{"id":"wordfence:33086968-359f-46d7-825e-29c4e4449899","source":"wordfence","cve":"CVE-2021-24193","title":"Visitor Traffic Real Time Statistics <= 2.11 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33086968-359f-46d7-825e-29c4e4449899?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:330e236b-410e-43c3-8a9f-216e3f177789","source":"wordfence","cve":"CVE-2025-32279","title":"Contact Form, Drag and Drop Form Builder Plugin <= 4.8.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/330e236b-410e-43c3-8a9f-216e3f177789?source=api-prod","affected":[{"type":"plugin","slug":"liveforms","name":"Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T21:12:26Z"},{"id":"wordfence:330e40d9-56b2-446a-8aa9-22a59e17c122","source":"wordfence","cve":"CVE-2025-48242","title":"Legal Pages <= 1.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/330e40d9-56b2-446a-8aa9-22a59e17c122?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:19:22Z"},{"id":"wordfence:330e90a1-735c-48db-bf0f-95b7dacd1476","source":"wordfence","cve":"CVE-2024-47307","title":"Meta slider and carousel with lightbox <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/330e90a1-735c-48db-bf0f-95b7dacd1476?source=api-prod","affected":[{"type":"plugin","slug":"meta-slider-and-carousel-with-lightbox","name":"Meta Slider and Carousel with Lightbox","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:10:39Z"},{"id":"wordfence:330fb02d-8030-4bf3-9fd7-1af46b9e3f53","source":"wordfence","cve":"CVE-2025-62075","title":"Simple Payment <= 2.4.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/330fb02d-8030-4bf3-9fd7-1af46b9e3f53?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-03T18:23:31Z"},{"id":"wordfence:33126522-ce16-412d-a7f2-27d58ac3a8d4","source":"wordfence","cve":"CVE-2025-52809","title":"National Weather Service Alerts <= 1.3.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33126522-ce16-412d-a7f2-27d58ac3a8d4?source=api-prod","affected":[{"type":"plugin","slug":"national-weather-service-alerts","name":"National Weather Service Alerts","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:56:26Z"},{"id":"wordfence:33129b72-0976-4c09-9cea-b5ba321ae46f","source":"wordfence","cve":"CVE-2020-12104","title":"WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33129b72-0976-4c09-9cea-b5ba321ae46f?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2020-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3313f919-5fa8-4e2f-b676-b5654d088e33","source":"wordfence","cve":"CVE-2025-24699","title":"WP Coder \u2013 Code Snippets + HTML, CSS, JS and PHP Injection <= 3.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3313f919-5fa8-4e2f-b676-b5654d088e33?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-21T14:45:53Z"},{"id":"wordfence:33146b95-d2c7-433d-a104-5762b251f8ec","source":"wordfence","cve":"CVE-2024-10621","title":"Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33146b95-d2c7-433d-a104-5762b251f8ec?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-maps-short-code","name":"Simple Shortcode for Google Maps","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-11-07T17:29:10Z","updated":"2024-11-08T05:31:13Z"},{"id":"wordfence:33153ebe-65fc-4db8-84fe-df22554be3ba","source":"wordfence","cve":"CVE-2016-10934","title":"Check & Log Email <= 0.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33153ebe-65fc-4db8-84fe-df22554be3ba?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":false,"patched_in":"0.5.2"}],"published":"2016-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33166510-41b2-4e9a-8bd7-501235729346","source":"wordfence","cve":"CVE-2023-40206","title":"WP 404 Auto Redirect to Similar Post <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33166510-41b2-4e9a-8bd7-501235729346?source=api-prod","affected":[{"type":"plugin","slug":"wp-404-auto-redirect-to-similar-post","name":"WP 404 Auto Redirect to Similar Post","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-08-11T00:00:00Z","updated":"2026-03-27T11:06:58Z"},{"id":"wordfence:3316ea0d-4311-4363-b443-b4aeedb2ee36","source":"wordfence","cve":"CVE-2024-30556","title":"Mighty Classic Pros And Cons <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3316ea0d-4311-4363-b443-b4aeedb2ee36?source=api-prod","affected":[{"type":"plugin","slug":"joomdev-wp-pros-cons","name":"Mighty Classic Pros And Cons","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:43:19Z"},{"id":"wordfence:331a893c-498d-4ae8-8a04-e7aa25640e80","source":"wordfence","cve":"CVE-2025-31845","title":"Theme Duplicator <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/331a893c-498d-4ae8-8a04-e7aa25640e80?source=api-prod","affected":[{"type":"plugin","slug":"theme-duplicator","name":"Theme Duplicator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:31:21Z"},{"id":"wordfence:331fd693-25be-4163-a415-73d1cbcee5a8","source":"wordfence","cve":"CVE-2025-23490","title":"Browser-Update-Notify <= 0.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/331fd693-25be-4163-a415-73d1cbcee5a8?source=api-prod","affected":[{"type":"plugin","slug":"browser-update-notify","name":"Browser-Update-Notify","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T18:47:43Z"},{"id":"wordfence:3320c182-b1f9-4e06-92ea-0fa670557dd0","source":"wordfence","cve":"CVE-2024-2804","title":"Network Summary <= 2.0.11 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3320c182-b1f9-4e06-92ea-0fa670557dd0?source=api-prod","affected":[{"type":"plugin","slug":"network-summary","name":"Network Summary","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2024-03-21T00:00:00Z","updated":"2024-04-09T18:58:43Z"},{"id":"wordfence:3320fe6a-dafc-4640-8d8b-7f62fc6e7753","source":"wordfence","cve":"CVE-2026-57673","title":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3320fe6a-dafc-4640-8d8b-7f62fc6e7753?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.8"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:06:07Z"},{"id":"wordfence:33210104-68fc-4d88-b681-b30e7abd6e18","source":"wordfence","cve":"CVE-2023-6941","title":"Keap Official Opt-in Forms <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33210104-68fc-4d88-b681-b30e7abd6e18?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-official-opt-in-forms","name":"Keap Official Opt-in Forms","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2023-12-21T00:00:00Z","updated":"2024-07-03T16:39:59Z"},{"id":"wordfence:3323b809-b778-48fb-967c-cedba9010495","source":"wordfence","cve":"CVE-2017-2127","title":"YOP Poll <= 5.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3323b809-b778-48fb-967c-cedba9010495?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"5.8.1"}],"published":"2017-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33275478-59ad-412b-b970-9a39d522bd66","source":"wordfence","cve":"CVE-2024-44005","title":"Greenshift \u2013 animation and page builder blocks <= 9.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33275478-59ad-412b-b970-9a39d522bd66?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"9.3.7","to_inclusive":true,"patched_in":"9.4"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T17:12:21Z"},{"id":"wordfence:33275cdc-21d4-42b7-bd0e-f5154faf2d6c","source":"wordfence","cve":"CVE-2024-25906","title":"Comments Like Dislike <= 1.2.2 - IP Spoofing","severity":"medium","cvss":4.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33275cdc-21d4-42b7-bd0e-f5154faf2d6c?source=api-prod","affected":[{"type":"plugin","slug":"comments-like-dislike","name":"Comments Like Dislike","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-29T20:40:13Z"},{"id":"wordfence:332909d5-e3bf-42a7-af52-c4e50b05f97e","source":"wordfence","cve":"CVE-2024-6494","title":"WordPress File Upload <= 4.24.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/332909d5-e3bf-42a7-af52-c4e50b05f97e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.7","to_inclusive":true,"patched_in":"4.24.8"}],"published":"2024-07-16T00:00:00Z","updated":"2024-08-09T19:23:52Z"},{"id":"wordfence:3329ac94-7736-44af-b64c-db441a5edb4c","source":"wordfence","cve":"CVE-2026-77782","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3329ac94-7736-44af-b64c-db441a5edb4c?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277.1","to_inclusive":false,"patched_in":"1.0.277.1"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:19:42Z"},{"id":"wordfence:332a37fa-a082-4f6b-a81f-9741b121d0a0","source":"wordfence","cve":"CVE-2025-67985","title":"Document Library Lite <= 1.1.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/332a37fa-a082-4f6b-a81f-9741b121d0a0?source=api-prod","affected":[{"type":"plugin","slug":"document-library-lite","name":"Document Library Lite","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:39:20Z"},{"id":"wordfence:332b8d96-89b2-473b-9186-239e49f5b064","source":"wordfence","cve":"","title":"Download Manager <= 3.2.53 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/332b8d96-89b2-473b-9186-239e49f5b064?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.53","to_inclusive":true,"patched_in":"3.2.54"}],"published":"2022-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:332c0829-316d-4037-8c50-02d6c92cdb10","source":"wordfence","cve":"CVE-2021-36906","title":"Quiz And Survey Master <= 7.3.6 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/332c0829-316d-4037-8c50-02d6c92cdb10?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:332f8a7e-2342-4b77-a7d6-17137e432b5b","source":"wordfence","cve":"CVE-2022-2245","title":"Counter Box <= 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/332f8a7e-2342-4b77-a7d6-17137e432b5b?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3334fc78-48c5-4cfa-ac83-5690fdbf590a","source":"wordfence","cve":"CVE-2023-1861","title":"Limit Login Attempts <= 1.7.1 - Authenticated(Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3334fc78-48c5-4cfa-ac83-5690fdbf590a?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts","name":"Limit Login Attempts","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33356b50-9c9c-4719-8321-b391fda69867","source":"wordfence","cve":"CVE-2024-32790","title":"Pricing Table by Supsystic <= 1.9.12 - Authenticated (Admin+) Content Injection","severity":"low","cvss":2.7,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33356b50-9c9c-4719-8321-b391fda69867?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:33:08Z"},{"id":"wordfence:333607d4-ec77-48c2-8f07-14ffbab95fa4","source":"wordfence","cve":"CVE-2025-49243","title":"ShiftNav \u2013 Responsive Mobile Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/333607d4-ec77-48c2-8f07-14ffbab95fa4?source=api-prod","affected":[{"type":"plugin","slug":"shiftnav-responsive-mobile-menu","name":"ShiftNav \u2013 Responsive Mobile Menu","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:17:19Z"},{"id":"wordfence:33386b7b-fae3-42a4-96d3-df3cdc342317","source":"wordfence","cve":"CVE-2024-24880","title":"Apollo13 Framework Extensions <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33386b7b-fae3-42a4-96d3-df3cdc342317?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:27:29Z"},{"id":"wordfence:3338c56e-6fb5-4962-9eea-7bc1b550570d","source":"wordfence","cve":"CVE-2026-24555","title":"ArtPlacer Widget <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3338c56e-6fb5-4962-9eea-7bc1b550570d?source=api-prod","affected":[{"type":"plugin","slug":"artplacer-widget","name":"ArtPlacer Widget","from":"*","from_inclusive":true,"to":"2.23.2","to_inclusive":true,"patched_in":"2.23.3"}],"published":"2026-01-22T00:00:00Z","updated":"2026-04-15T13:35:51Z"},{"id":"wordfence:33398af8-7b7f-47e5-b95b-c9faa33d0c80","source":"wordfence","cve":"CVE-2023-50860","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.0.85 - Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33398af8-7b7f-47e5-b95b-c9faa33d0c80?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.85","to_inclusive":true,"patched_in":"1.0.86"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3340e02a-4280-4422-a666-379725efb902","source":"wordfence","cve":"CVE-2025-31565","title":"WPSmartContracts <= 2.0.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3340e02a-4280-4422-a666-379725efb902?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-contracts","name":"WPSmartContracts","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:45:41Z"},{"id":"wordfence:334570f7-967b-4792-934c-ebe4c4f18490","source":"wordfence","cve":"CVE-2022-47427","title":"My Calendar <= 3.3.24.1 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334570f7-967b-4792-934c-ebe4c4f18490?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.3.24.1","to_inclusive":true,"patched_in":"3.3.25"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3346d686-fc31-4d5f-925b-e059fadb3fe6","source":"wordfence","cve":"CVE-2025-32497","title":"Spoiler Block <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3346d686-fc31-4d5f-925b-e059fadb3fe6?source=api-prod","affected":[{"type":"plugin","slug":"spoiler-block","name":"Spoiler Block","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:58:49Z"},{"id":"wordfence:334704f8-0854-4eef-bd03-f6ba8d54a3e0","source":"wordfence","cve":"CVE-2025-49242","title":"Bellows Accordion Menu <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334704f8-0854-4eef-bd03-f6ba8d54a3e0?source=api-prod","affected":[{"type":"plugin","slug":"bellows-accordion-menu","name":"Bellows Accordion Menu","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:45:01Z"},{"id":"wordfence:334839c2-6844-4531-ab16-26f32ddcaba1","source":"wordfence","cve":"CVE-2024-27197","title":"BeePress <= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334839c2-6844-4531-ab16-26f32ddcaba1?source=api-prod","affected":[{"type":"plugin","slug":"beepress","name":"\u871c\u8702\u91c7\u96c6-BeePress \u5fae\u4fe1\u516c\u4f17\u53f7\u4eca\u65e5\u5934\u6761\u77e5\u4e4e\u4e13\u680f\u7b80\u4e66\u7b49\u5e73\u53f0\u6587\u7ae0\u91c7\u96c6\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"6.9.8","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T16:22:21Z"},{"id":"wordfence:33486414-6878-4b16-ae2d-00ec52fc2213","source":"wordfence","cve":"CVE-2025-13930","title":"Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33486414-6878-4b16-ae2d-00ec52fc2213?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.6"}],"published":"2026-02-18T16:06:35Z","updated":"2026-02-19T04:36:09Z"},{"id":"wordfence:33490873-da99-465e-bfb6-44d2ba84f3ee","source":"wordfence","cve":"CVE-2026-3513","title":"TableOn \u2013 WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33490873-da99-465e-bfb6-44d2ba84f3ee?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.4.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-04-07T15:35:29Z","updated":"2026-04-08T03:36:08Z"},{"id":"wordfence:334be95c-438a-4e03-9ee4-9a6d2c2fa5f7","source":"wordfence","cve":"CVE-2023-4933","title":"WP Job Openings <= 3.4.2 - Information Exposure","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334be95c-438a-4e03-9ee4-9a6d2c2fa5f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-openings","name":"HireZoot \u2013 Job Listings, Career Page & Recruitment Tool","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:334ecb1e-027c-4a0f-88cb-34b02482f097","source":"wordfence","cve":"CVE-2021-24567","title":"Simple Post <= 1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334ecb1e-027c-4a0f-88cb-34b02482f097?source=api-prod","affected":[{"type":"plugin","slug":"simple-post","name":"Simple Post","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-02-06T15:58:36Z"},{"id":"wordfence:334fb374-c84b-4fec-8653-f7ad6af1f631","source":"wordfence","cve":"CVE-2026-8907","title":"WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334fb374-c84b-4fec-8653-f7ad6af1f631?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-map","name":"WP-Ultimate-Map","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:45Z","updated":"2026-06-09T03:41:19Z"},{"id":"wordfence:334ff8d7-1313-4c19-aed3-0c4625b895ab","source":"wordfence","cve":"CVE-2020-7228","title":"Calculated Fields Form <= 1.0.353 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/334ff8d7-1313-4c19-aed3-0c4625b895ab?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.0.353","to_inclusive":true,"patched_in":"1.0.354"}],"published":"2020-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33506598-1eda-4797-855b-db2edd7e3db2","source":"wordfence","cve":"CVE-2026-108291","title":"Affiliates <= 7.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33506598-1eda-4797-855b-db2edd7e3db2?source=api-prod","affected":[{"type":"plugin","slug":"affiliates","name":"Affiliates","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:34:39Z"},{"id":"wordfence:33512495-91d6-4efe-9c76-484ab07874f6","source":"wordfence","cve":"","title":"Easy Testimonials <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33512495-91d6-4efe-9c76-484ab07874f6?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33517dba-78ac-4391-a55e-d1f13801b212","source":"wordfence","cve":"CVE-2024-11725","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33517dba-78ac-4391-a55e-d1f13801b212?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":true,"patched_in":"3.7.7"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:57Z"},{"id":"wordfence:3352b264-eae8-4ce3-86ee-5febcd2e7fcc","source":"wordfence","cve":"CVE-2025-68844","title":"Membee Login <= 2.3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3352b264-eae8-4ce3-86ee-5febcd2e7fcc?source=api-prod","affected":[{"type":"plugin","slug":"membees-member-login-widget","name":"Membee Login","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-10T20:44:47Z"},{"id":"wordfence:335402dd-5c18-4927-aa59-9683003064ca","source":"wordfence","cve":"CVE-2024-4260","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/335402dd-5c18-4927-aa59-9683003064ca?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.12"}],"published":"2024-07-02T00:00:00Z","updated":"2024-07-19T16:37:17Z"},{"id":"wordfence:3354b925-2e4a-4ee5-b436-2c1a502b1725","source":"wordfence","cve":"CVE-2023-48328","title":"NextGEN Gallery <= 3.37 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3354b925-2e4a-4ee5-b436-2c1a502b1725?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.37","to_inclusive":true,"patched_in":"3.39"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3357892e-c047-406b-8914-018ea966e799","source":"wordfence","cve":"CVE-2024-9217","title":"Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3357892e-c047-406b-8914-018ea966e799?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher-woocommerce","name":"Currency Switcher for WooCommerce","from":"*","from_inclusive":true,"to":"2.16.2","to_inclusive":true,"patched_in":"2.16.3"}],"published":"2025-02-28T15:26:51Z","updated":"2025-03-10T14:14:53Z"},{"id":"wordfence:33581898-067b-445c-8ad0-12ff4778a13c","source":"wordfence","cve":"CVE-2024-2924","title":"Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33581898-067b-445c-8ad0-12ff4778a13c?source=api-prod","affected":[{"type":"plugin","slug":"creative-addons-for-elementor","name":"Creative Addons for Elementor","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T05:32:50Z"},{"id":"wordfence:33585791-be40-438c-bebc-8852e7cf8ae5","source":"wordfence","cve":"CVE-2024-9873","title":"Community by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33585791-be40-438c-bebc-8852e7cf8ae5?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.4.6.1","to_inclusive":true,"patched_in":"6.4.6.2"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T05:31:56Z"},{"id":"wordfence:335960e7-a0fa-4f36-9b06-a77b6273b070","source":"wordfence","cve":"CVE-2024-4860","title":"RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/335960e7-a0fa-4f36-9b06-a77b6273b070?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.23.8","to_inclusive":true,"patched_in":"4.23.9"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-16T12:46:56Z"},{"id":"wordfence:3362e70b-1c0e-4faa-9607-88cb805da2c6","source":"wordfence","cve":"CVE-2025-31441","title":"WordPress Galleria <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3362e70b-1c0e-4faa-9607-88cb805da2c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-galleria","name":"WordPress Galleria","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:50:47Z"},{"id":"wordfence:3363149f-a522-49a1-94c8-a3bcd865f911","source":"wordfence","cve":"","title":"Table Rate Shipping Method for WooCommerce by Flexible Shipping <= 4.11.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3363149f-a522-49a1-94c8-a3bcd865f911?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping","name":"Weight Based Shipping Table Rate for WooCommerce \u2013 Flexible Shipping","from":"*","from_inclusive":true,"to":"4.11.8","to_inclusive":true,"patched_in":"4.11.9"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:336675c3-b397-42c5-85b0-5a38e1d7bc92","source":"wordfence","cve":"CVE-2026-14557","title":"SoftMarket <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/336675c3-b397-42c5-85b0-5a38e1d7bc92?source=api-prod","affected":[{"type":"plugin","slug":"softmarket","name":"SoftMarket \u2014 Digital Marketplace","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-09-17T14:41:39Z"},{"id":"wordfence:33680429-8a52-412b-ab61-d261801319a0","source":"wordfence","cve":"CVE-2017-18514","title":"Simple Login Log < 1.1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33680429-8a52-412b-ab61-d261801319a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-login-log","name":"Simple Login Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2017-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3368e4b4-9876-447b-acb4-3648e83ed997","source":"wordfence","cve":"","title":"Acunetix WP Security <= 4.0.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3368e4b4-9876-447b-acb4-3648e83ed997?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-scan","name":"Acunetix WP Security","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"}],"published":"2014-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33699d52-fc94-4485-8db7-f75c65237a3f","source":"wordfence","cve":"CVE-2025-48283","title":"Majestic Support <= 1.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33699d52-fc94-4485-8db7-f75c65237a3f?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:40:50Z"},{"id":"wordfence:336e2429-97ab-4948-9d21-f0121216d2d1","source":"wordfence","cve":"CVE-2024-5427","title":"WPCafe \u2013 Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/336e2429-97ab-4948-9d21-f0121216d2d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.24","to_inclusive":true,"patched_in":"2.2.26"}],"published":"2024-05-30T18:20:55Z","updated":"2024-05-31T06:40:55Z"},{"id":"wordfence:336eb1fb-dc94-417d-b9b6-488c105aab1e","source":"wordfence","cve":"","title":"Find and Replace All <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/336eb1fb-dc94-417d-b9b6-488c105aab1e?source=api-prod","affected":[{"type":"plugin","slug":"find-and-replace-all","name":"Find and Replace All","from":"1.2","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:336f4272-135c-4601-84fe-087390dbf5ef","source":"wordfence","cve":"CVE-2026-39686","title":"BSK PDF Manager <= 3.7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/336f4272-135c-4601-84fe-087390dbf5ef?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.8"}],"published":"2026-02-22T00:00:00Z","updated":"2026-08-14T15:17:14Z"},{"id":"wordfence:33707b80-5cc1-4678-bf87-8c5131634c94","source":"wordfence","cve":"","title":"Video Conferencing with Zoom <= 3.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33707b80-5cc1-4678-bf87-8c5131634c94?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3371df49-aecc-4442-9b8c-58e3c7e26752","source":"wordfence","cve":"CVE-2025-62972","title":"WebinarPress <= 1.33.30 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3371df49-aecc-4442-9b8c-58e3c7e26752?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.30","to_inclusive":true,"patched_in":"1.33.31"}],"published":"2025-10-19T00:00:00Z","updated":"2026-10-13T16:57:03Z"},{"id":"wordfence:33727746-4481-4b7f-8d2a-100027b7d1c3","source":"wordfence","cve":"","title":"Blog Designer <=1.8.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33727746-4481-4b7f-8d2a-100027b7d1c3?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer","name":"Blog Designer","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2019-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33735219-3e12-4a8b-87af-99d7a836e9fa","source":"wordfence","cve":"CVE-2024-8082","title":"Widgets Reset <= 0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33735219-3e12-4a8b-87af-99d7a836e9fa?source=api-prod","affected":[{"type":"plugin","slug":"widgets-reset","name":"Widgets Reset","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2025-05-23T14:59:57Z"},{"id":"wordfence:33770bfd-c481-4e18-838b-89a5fb5b15f0","source":"wordfence","cve":"CVE-2023-32584","title":"eBecas <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33770bfd-c481-4e18-838b-89a5fb5b15f0?source=api-prod","affected":[{"type":"plugin","slug":"ebecas","name":"eBecas","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3379ba15-b834-431d-a1ef-ba811df5da58","source":"wordfence","cve":"CVE-2025-23479","title":"melascrivi-plugin <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3379ba15-b834-431d-a1ef-ba811df5da58?source=api-prod","affected":[{"type":"plugin","slug":"melascrivi","name":"melascrivi-plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:50:11Z"},{"id":"wordfence:3379dde1-d1fb-4ec8-b834-de00fb6a38f2","source":"wordfence","cve":"CVE-2020-11026","title":"WordPress Core < 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3379dde1-d1fb-4ec8-b834-de00fb6a38f2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:337bb11f-dcab-4914-aeb4-68084504b8f9","source":"wordfence","cve":"CVE-2026-57723","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/337bb11f-dcab-4914-aeb4-68084504b8f9?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:58:03Z"},{"id":"wordfence:337cbec1-c8a8-41b5-8c32-779be671120f","source":"wordfence","cve":"CVE-2024-3675","title":"Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/337cbec1-c8a8-41b5-8c32-779be671120f?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.971","to_inclusive":true,"patched_in":"1.3.972"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:56Z"},{"id":"wordfence:337d052c-6ee2-4cd0-8a69-a4b66b25517a","source":"wordfence","cve":"","title":"Announcement & Notification Banner \u2013 Bulletin <= 3.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/337d052c-6ee2-4cd0-8a69-a4b66b25517a?source=api-prod","affected":[{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:338003bb-0569-4b9b-aa98-37153fb7e9c3","source":"wordfence","cve":"CVE-2024-51869","title":"Gutenium Blocks <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338003bb-0569-4b9b-aa98-37153fb7e9c3?source=api-prod","affected":[{"type":"plugin","slug":"gutenium","name":"Gutenium Blocks","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-11T21:04:30Z"},{"id":"wordfence:33800fbb-7660-4704-a978-d5b64ff9f66e","source":"wordfence","cve":"CVE-2025-68029","title":"Wallet System for WooCommerce <= 2.7.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33800fbb-7660-4704-a978-d5b64ff9f66e?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2025-12-29T00:00:00Z","updated":"2026-03-06T14:44:00Z"},{"id":"wordfence:33807090-ea59-4379-88ec-5e3f694bc930","source":"wordfence","cve":"CVE-2026-87907","title":"Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33807090-ea59-4379-88ec-5e3f694bc930?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:46:02Z"},{"id":"wordfence:338158b5-bbda-4cd8-b4ea-97a3926a0989","source":"wordfence","cve":"CVE-2022-47136","title":"Ninja Tables <= 4.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338158b5-bbda-4cd8-b4ea-97a3926a0989?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33823749-e977-4c91-b8c4-d9774ba46dd9","source":"wordfence","cve":"CVE-2015-9413","title":"eshop <= 6.3.13 - Cross-Site Forgery Request and Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33823749-e977-4c91-b8c4-d9774ba46dd9?source=api-prod","affected":[{"type":"plugin","slug":"eshop","name":"eShop","from":"*","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"6.3.14"}],"published":"2015-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3382a52c-9ccd-4158-aeac-63b58eacf87c","source":"wordfence","cve":"CVE-2025-60067","title":"Giardino <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3382a52c-9ccd-4158-aeac-63b58eacf87c?source=api-prod","affected":[{"type":"theme","slug":"giardino","name":"Giardino | Italian Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-12-20T21:07:51Z"},{"id":"wordfence:33836cee-c3f6-4c49-9acb-7c8f00839fdd","source":"wordfence","cve":"CVE-2015-9513","title":"Easy Digital Downloads \u2013 Favorites <= 1.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33836cee-c3f6-4c49-9acb-7c8f00839fdd?source=api-prod","affected":[{"type":"plugin","slug":"edd-favorites","name":"EDD Favorites","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3386e24f-5861-4115-96ea-a47cd65a560f","source":"wordfence","cve":"CVE-2026-24386","title":"Element Invader \u2013 Template Kits for Elementor <= 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3386e24f-5861-4115-96ea-a47cd65a560f?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader","name":"Element Invader \u2013 Template Kits for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-28T18:50:37Z"},{"id":"wordfence:3386ea07-9c61-4b54-a451-1178ca6325cb","source":"wordfence","cve":"CVE-2026-1291","title":"Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3386ea07-9c61-4b54-a451-1178ca6325cb?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2026-06-12T19:54:13Z","updated":"2026-06-13T08:29:41Z"},{"id":"wordfence:33872127-335e-4a1d-992e-fee27537867e","source":"wordfence","cve":"CVE-2026-62136","title":"Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce <= 2.3.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33872127-335e-4a1d-992e-fee27537867e?source=api-prod","affected":[{"type":"plugin","slug":"flexible-quantity-measurement-price-calculator-for-woocommerce","name":"Flexible Quantity & Price Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.21","to_inclusive":true,"patched_in":"2.3.22"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:15:43Z"},{"id":"wordfence:338a4238-900c-4f3e-a724-52c4b3603af2","source":"wordfence","cve":"CVE-2025-24779","title":"Yogi < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338a4238-900c-4f3e-a724-52c4b3603af2?source=api-prod","affected":[{"type":"theme","slug":"yogi","name":"Yogi - Health Beauty & Yoga WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":false,"patched_in":"2.9.3"}],"published":"2025-07-08T00:00:00Z","updated":"2026-02-26T15:15:06Z"},{"id":"wordfence:338be12e-f5d9-4697-a409-428188d222f8","source":"wordfence","cve":"CVE-2025-46514","title":"Milat jQuery Automatic Popup <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338be12e-f5d9-4697-a409-428188d222f8?source=api-prod","affected":[{"type":"plugin","slug":"milat-jquery-automatic-popup","name":"Milat jQuery Automatic Popup","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:10:38Z"},{"id":"wordfence:338d35a8-5733-4ecd-baa7-246dfb24718f","source":"wordfence","cve":"CVE-2024-13325","title":"Glossy <= 2.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338d35a8-5733-4ecd-baa7-246dfb24718f?source=api-prod","affected":[{"type":"plugin","slug":"glossy","name":"Glossy","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:19:41Z"},{"id":"wordfence:338d824c-e99a-48c2-8844-4ca1104b5143","source":"wordfence","cve":"CVE-2026-102772","title":"CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338d824c-e99a-48c2-8844-4ca1104b5143?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.13.2"}],"published":"2026-10-01T18:48:24Z","updated":"2026-10-02T07:39:23Z"},{"id":"wordfence:338d9348-da24-44b9-ac97-a7a8a7376815","source":"wordfence","cve":"CVE-2024-11885","title":"NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338d9348-da24-44b9-ac97-a7a8a7376815?source=api-prod","affected":[{"type":"plugin","slug":"ninjateam-telegram","name":"WP Telegram Chat Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:44Z"},{"id":"wordfence:338edb1d-101a-4b6e-ac25-b59bd3e17f8b","source":"wordfence","cve":"CVE-2024-11727","title":"NotificationX \u2013 Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/338edb1d-101a-4b6e-ac25-b59bd3e17f8b?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:34Z"},{"id":"wordfence:3391740a-c859-47a2-9a55-b8bdc57daec3","source":"wordfence","cve":"CVE-2025-68895","title":"AhaChat Messenger Marketing <= 1.1 - Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3391740a-c859-47a2-9a55-b8bdc57daec3?source=api-prod","affected":[{"type":"plugin","slug":"ahachat-messenger-marketing","name":"AhaChat Messenger Marketing","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:30:42Z"},{"id":"wordfence:3391d3dd-572e-4238-bfa6-f54db0b1fec4","source":"wordfence","cve":"CVE-2026-28080","title":"Rank Math SEO PRO <= 3.0.96 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3391d3dd-572e-4238-bfa6-f54db0b1fec4?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math-pro","name":"Rank Math SEO PRO","from":"*","from_inclusive":true,"to":"3.0.96","to_inclusive":true,"patched_in":"3.0.97"}],"published":"2025-10-08T00:00:00Z","updated":"2026-05-05T15:52:21Z"},{"id":"wordfence:33989611-8640-4c33-a34e-14f10cd7286d","source":"wordfence","cve":"CVE-2025-4828","title":"Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33989611-8640-4c33-a34e-14f10cd7286d?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-07-08T10:43:24Z","updated":"2025-07-08T23:22:49Z"},{"id":"wordfence:339ab2b6-ca5e-41a8-ad32-9d2a271fb320","source":"wordfence","cve":"","title":"amerisale-re (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/339ab2b6-ca5e-41a8-ad32-9d2a271fb320?source=api-prod","affected":[{"type":"plugin","slug":"amerisale-re","name":"amerisale-re","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:339c4eba-fa34-4db6-be4b-bcf0ba98121a","source":"wordfence","cve":"CVE-2024-3546","title":"WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/339c4eba-fa34-4db6-be4b-bcf0ba98121a?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:57Z"},{"id":"wordfence:33a1230f-c1d6-4bc1-b3f4-9c45f47332a4","source":"wordfence","cve":"CVE-2024-51852","title":"Dynamic Post Grid Elementor Addon <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a1230f-c1d6-4bc1-b3f4-9c45f47332a4?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-post-grid-elementor-addon","name":"Dynamic Post Grid \u2013 Gutenberg Blocks, Shortcodes & Elementor Addon","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:18:09Z"},{"id":"wordfence:33a26790-1fb8-4088-87dc-e026a28f205d","source":"wordfence","cve":"","title":"Encrypted Blog <= 0.0.6.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a26790-1fb8-4088-87dc-e026a28f205d?source=api-prod","affected":[{"type":"plugin","slug":"encrypted-blog","name":"Encrypted Blog","from":"*","from_inclusive":true,"to":"0.0.6.2","to_inclusive":true,"patched_in":"0.0.6.6"}],"published":"2013-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33a2cf5c-d71f-45cf-8f8a-0edd47bc1974","source":"wordfence","cve":"CVE-2026-120548","title":"YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"5.10.0","to_inclusive":true,"patched_in":"5.11.0"}],"published":"2026-11-06T21:24:33Z","updated":"2026-11-07T09:25:45Z"},{"id":"wordfence:33a47156-ee93-4b59-9f73-56be5c9e3b00","source":"wordfence","cve":"CVE-2023-30488","title":"Featured Post Creative <= 1.2.7 - Cross-Site Request Forgery via wpfp_update_featured_post","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a47156-ee93-4b59-9f73-56be5c9e3b00?source=api-prod","affected":[{"type":"plugin","slug":"featured-post-creative","name":"Featured Post Creative","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33a54cae-0fa3-4c25-bf81-8423f5e01e84","source":"wordfence","cve":"CVE-2023-6136","title":"Debug Log Manager <= 2.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a54cae-0fa3-4c25-bf81-8423f5e01e84?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-11-23T00:00:00Z","updated":"2026-09-04T00:29:36Z"},{"id":"wordfence:33a5838b-2cec-4b47-ac0c-577f090e8041","source":"wordfence","cve":"CVE-2026-45438","title":"Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a5838b-2cec-4b47-ac0c-577f090e8041?source=api-prod","affected":[{"type":"plugin","slug":"wt-smart-coupons-for-woocommerce","name":"Smart Coupons For WooCommerce Coupons","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2026-05-15T00:00:00Z","updated":"2026-05-19T13:16:29Z"},{"id":"wordfence:33a801ab-b86f-42b3-bb79-dad64617a56a","source":"wordfence","cve":"CVE-2025-24739","title":"FluentSMTP <= 2.2.80 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a801ab-b86f-42b3-bb79-dad64617a56a?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.2.80","to_inclusive":true,"patched_in":"2.2.81"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:04:13Z"},{"id":"wordfence:33a8173e-cb1a-4396-a05b-7404bf899ad9","source":"wordfence","cve":"CVE-2023-23988","title":"My Tickets <= 1.9.11 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a8173e-cb1a-4396-a05b-7404bf899ad9?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33a91dd0-2589-4bb4-886b-1832a216205b","source":"wordfence","cve":"CVE-2024-44032","title":"Restaurant & Cafe Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a91dd0-2589-4bb4-886b-1832a216205b?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:25:18Z"},{"id":"wordfence:33ac910c-9531-45ea-84cf-1d379233f7d3","source":"wordfence","cve":"CVE-2025-4047","title":"Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33ac910c-9531-45ea-84cf-1d379233f7d3?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-06-02T14:22:12Z","updated":"2025-06-03T02:27:36Z"},{"id":"wordfence:33adf97e-c0f9-488b-b9cf-e703578c4d1e","source":"wordfence","cve":"CVE-2023-24403","title":"bbPress Voting <= 2.1.11.0  - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33adf97e-c0f9-488b-b9cf-e703578c4d1e?source=api-prod","affected":[{"type":"plugin","slug":"bbp-voting","name":"bbPress Voting","from":"*","from_inclusive":true,"to":"2.1.11.1","to_inclusive":false,"patched_in":"2.1.11.1"}],"published":"2023-01-27T00:00:00Z","updated":"2026-03-27T11:07:26Z"},{"id":"wordfence:33aed550-5a2d-4a0a-8199-f2dfd212be92","source":"wordfence","cve":"CVE-2022-36798","title":"Mega Addons For WPBakery Page Builder <= 4.3.1 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33aed550-5a2d-4a0a-8199-f2dfd212be92?source=api-prod","affected":[{"type":"plugin","slug":"mega-addons-for-visual-composer","name":"Mega Addons For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2022-09-02T00:00:00Z","updated":"2026-10-28T21:02:17Z"},{"id":"wordfence:33b02537-b9ba-4c50-828a-960e97ba7b59","source":"wordfence","cve":"CVE-2026-78268","title":"Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email \u2013 SiteLeads <= 1.2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33b02537-b9ba-4c50-828a-960e97ba7b59?source=api-prod","affected":[{"type":"plugin","slug":"siteleads","name":"Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email \u2013 SiteLeads","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-08-24T12:50:15Z","updated":"2026-09-10T19:31:00Z"},{"id":"wordfence:33b5e231-1b53-4646-ae9c-48babf1ebbd7","source":"wordfence","cve":"CVE-2024-3308","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33b5e231-1b53-4646-ae9c-48babf1ebbd7?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-31T15:30:14Z"},{"id":"wordfence:33b92a86-bb3e-4307-b2cb-7dfde56505cc","source":"wordfence","cve":"","title":"Thumbnail Slider With Lightbox <= 1.0.17 - Reflected Cross-Site Scripting","severity":"high","cvss":8.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33b92a86-bb3e-4307-b2cb-7dfde56505cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33b98bee-7f33-4d49-96e1-9a1eafc92bb3","source":"wordfence","cve":"CVE-2025-12574","title":"Listar \u2013 Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33b98bee-7f33-4d49-96e1-9a1eafc92bb3?source=api-prod","affected":[{"type":"plugin","slug":"listar-directory-listing","name":"Listar \u2013 Directory Listing & Classifieds WordPress Plugin","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:35:50Z","updated":"2025-12-06T05:49:25Z"},{"id":"wordfence:33bf39f8-6f56-4089-bb46-5d401af72953","source":"wordfence","cve":"CVE-2024-43915","title":"Zephyr Project Manager <= 3.3.102 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33bf39f8-6f56-4089-bb46-5d401af72953?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.102","to_inclusive":true,"patched_in":"3.3.103"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-28T22:58:50Z"},{"id":"wordfence:33c0838a-5f86-4368-8bf9-da0582acbabf","source":"wordfence","cve":"CVE-2025-4857","title":"Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c0838a-5f86-4368-8bf9-da0582acbabf?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.9","to_inclusive":true,"patched_in":"4.10"}],"published":"2025-05-30T00:00:00Z","updated":"2025-05-31T11:18:55Z"},{"id":"wordfence:33c13444-5875-4063-8712-db28dbf78a21","source":"wordfence","cve":"CVE-2026-19056","title":"ProSolution WP Client < 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c13444-5875-4063-8712-db28dbf78a21?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-02T14:28:46Z"},{"id":"wordfence:33c16b47-3202-4f26-bf45-98172b8cac45","source":"wordfence","cve":"CVE-2024-12600","title":"Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c16b47-3202-4f26-bf45-98172b8cac45?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-custom-product-tabs-lite","name":"Custom Product Tabs Lite for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-25T06:40:39Z"},{"id":"wordfence:33c23ad3-7d4f-4e2d-b28e-a402b1355480","source":"wordfence","cve":"CVE-2016-20064","title":"WP Vault <= 0.8.6.6 - Local File Inclusion","severity":"medium","cvss":5.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c23ad3-7d4f-4e2d-b28e-a402b1355480?source=api-prod","affected":[{"type":"plugin","slug":"wp-vault","name":"WP Vault","from":"*","from_inclusive":true,"to":"0.8.6.6","to_inclusive":true,"patched_in":""}],"published":"2016-11-30T00:00:00Z","updated":"2026-07-29T16:02:23Z"},{"id":"wordfence:33c2756d-c300-479f-b3aa-8f22c3a70278","source":"wordfence","cve":"CVE-2023-5774","title":"Animated Counters <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c2756d-c300-479f-b3aa-8f22c3a70278?source=api-prod","affected":[{"type":"plugin","slug":"animated-counters","name":"Animated Counters","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33c666af-b51f-4d9e-9c32-ca0a124cd4b7","source":"wordfence","cve":"CVE-2008-0191","title":"WordPress Core < 2.5 -  Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33c666af-b51f-4d9e-9c32-ca0a124cd4b7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2007-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33cba63c-4629-48fd-850f-f68dad626a67","source":"wordfence","cve":"CVE-2024-1073","title":"SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33cba63c-4629-48fd-850f-f68dad626a67?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-02T16:24:01Z"},{"id":"wordfence:33cdd58b-9e5e-492e-a211-78de592f0663","source":"wordfence","cve":"CVE-2023-6843","title":"easy.jobs <= 2.4.6 - Missing Authorization to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33cdd58b-9e5e-492e-a211-78de592f0663?source=api-prod","affected":[{"type":"plugin","slug":"easyjobs","name":"easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-01-21T00:00:00Z","updated":"2024-02-06T14:53:33Z"},{"id":"wordfence:33cf27ba-a01b-4e34-9584-b1d3fc87af34","source":"wordfence","cve":"CVE-2020-36834","title":"Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33cf27ba-a01b-4e34-9584-b1d3fc87af34?source=api-prod","affected":[{"type":"plugin","slug":"woo-discount-rules","name":"Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2020-08-20T00:00:00Z","updated":"2024-10-16T06:43:27Z"},{"id":"wordfence:33cfdad9-d335-4721-990d-54109d7673a0","source":"wordfence","cve":"CVE-2024-38671","title":"WP GoToWebinar <= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33cfdad9-d335-4721-990d-54109d7673a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-gotowebinar","name":"WP GoToWebinar","from":"*","from_inclusive":true,"to":"15.7","to_inclusive":true,"patched_in":"15.8"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-30T20:19:00Z"},{"id":"wordfence:33cfebae-bbf3-4b0b-9afc-3ef2548045e7","source":"wordfence","cve":"CVE-2025-6055","title":"Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33cfebae-bbf3-4b0b-9afc-3ef2548045e7?source=api-prod","affected":[{"type":"plugin","slug":"zen-social-sticky","name":"Zen Sticky Social","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:44:57Z","updated":"2025-06-14T08:23:24Z"},{"id":"wordfence:33d08b1a-3933-4131-b7b5-3530612d2157","source":"wordfence","cve":"CVE-2025-22280","title":"DefendWP Firewall <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33d08b1a-3933-4131-b7b5-3530612d2157?source=api-prod","affected":[{"type":"plugin","slug":"defend-wp-firewall","name":"DefendWP Firewall","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:17:58Z"},{"id":"wordfence:33d70481-4652-44f4-99cf-67cc1ffab66a","source":"wordfence","cve":"CVE-2026-4401","title":"Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33d70481-4652-44f4-99cf-67cc1ffab66a?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":true,"patched_in":"5.1.11"}],"published":"2026-04-07T11:17:36Z","updated":"2026-04-07T23:25:27Z"},{"id":"wordfence:33d7dc4d-bb41-456a-bd1a-37d8f2aada30","source":"wordfence","cve":"CVE-2024-1392","title":"Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33d7dc4d-bb41-456a-bd1a-37d8f2aada30?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:26:41Z"},{"id":"wordfence:33dcaf9b-4c4b-4c8a-a0b7-fa44b64525a3","source":"wordfence","cve":"CVE-2025-23513","title":"Bible Embed <= 0.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33dcaf9b-4c4b-4c8a-a0b7-fa44b64525a3?source=api-prod","affected":[{"type":"plugin","slug":"bible-embed","name":"Bible Embed","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:41:21Z"},{"id":"wordfence:33df558a-da81-46e0-bef9-ddb2bb90a5c5","source":"wordfence","cve":"CVE-2022-0958","title":"Mark Posts <= 2.0.0 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33df558a-da81-46e0-bef9-ddb2bb90a5c5?source=api-prod","affected":[{"type":"plugin","slug":"mark-posts","name":"Mark Posts","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33df72a5-d2bc-4af5-b5bc-f26d7249d238","source":"wordfence","cve":"","title":"Think Responsive <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33df72a5-d2bc-4af5-b5bc-f26d7249d238?source=api-prod","affected":[{"type":"theme","slug":"thinkresponsive","name":"Think Responsive","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33e010dd-d9b2-410c-8397-638def946fbe","source":"wordfence","cve":"","title":"Human Presence \u2013 Stop Form Spam Without ReCaptcha < 2.0.9 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e010dd-d9b2-410c-8397-638def946fbe?source=api-prod","affected":[{"type":"plugin","slug":"ellipsis-human-presence-technology","name":"Human Presence \u2013 Stop Form Spam Without ReCaptcha","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2019-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33e3c1b6-0344-4ce1-8734-0bc517eae2af","source":"wordfence","cve":"CVE-2026-85568","title":"Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e3c1b6-0344-4ce1-8734-0bc517eae2af?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"1.5.139","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:57:14Z"},{"id":"wordfence:33e5ca87-2e45-4b85-818e-02093bbf66ee","source":"wordfence","cve":"CVE-2024-49334","title":"jLayer Parallax Slider <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e5ca87-2e45-4b85-818e-02093bbf66ee?source=api-prod","affected":[{"type":"plugin","slug":"jlayer-parallax-slider-wp","name":"jLayer Parallax Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-12-12T17:16:33Z"},{"id":"wordfence:33e7006f-3fb9-4493-9ce5-67698c877159","source":"wordfence","cve":"CVE-2023-6692","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e7006f-3fb9-4493-9ce5-67698c877159?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-29T21:36:09Z"},{"id":"wordfence:33e8a48e-0ddb-4278-a023-818aebe92dab","source":"wordfence","cve":"CVE-2008-3747","title":"WordPress Core < 2.6.1 - Cryptographic Weakness","severity":"medium","cvss":5.9,"cwe":"CWE-757","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e8a48e-0ddb-4278-a023-818aebe92dab?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2008-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33e94bb9-71e4-4af8-aa8d-5972b5be1aea","source":"wordfence","cve":"CVE-2026-65435","title":"Thrive Leads Version <= 10.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e94bb9-71e4-4af8-aa8d-5972b5be1aea?source=api-prod","affected":[{"type":"plugin","slug":"thrive-leads","name":"Thrive Leads","from":"*","from_inclusive":true,"to":"10.9.2","to_inclusive":true,"patched_in":"10.9.2.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:35:34Z"},{"id":"wordfence:33e9f3e2-2631-4c8d-b705-6bb592a1f7a3","source":"wordfence","cve":"CVE-2026-109978","title":"Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33e9f3e2-2631-4c8d-b705-6bb592a1f7a3?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2026-10-27T00:00:00Z","updated":"2026-10-28T06:45:09Z"},{"id":"wordfence:33efcbb4-2bb9-4414-bc95-55bedb92c551","source":"wordfence","cve":"CVE-2023-45273","title":"Stout Google Calendar <= 1.2.3 - Cross-Site Request Forgery via sgc_plugin_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33efcbb4-2bb9-4414-bc95-55bedb92c551?source=api-prod","affected":[{"type":"plugin","slug":"stout-google-calendar","name":"Stout Google Calendar","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33f07db9-ff4f-4f81-bf32-18b04d19624d","source":"wordfence","cve":"CVE-2019-15868","title":"Affiliates Manager <= 2.6.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f07db9-ff4f-4f81-bf32-18b04d19624d?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":false,"patched_in":"2.6.6"}],"published":"2019-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33f17152-f273-46d0-ad37-55953adee919","source":"wordfence","cve":"","title":"Greek Multi Tool <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f17152-f273-46d0-ad37-55953adee919?source=api-prod","affected":[{"type":"plugin","slug":"greek-multi-tool","name":"Greek Multi Tool","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-03-05T00:00:00Z","updated":"2025-03-05T20:57:26Z"},{"id":"wordfence:33f1d8b9-3561-4347-8267-8c36d4c9071f","source":"wordfence","cve":"CVE-2026-15452","title":"Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f1d8b9-3561-4347-8267-8c36d4c9071f?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"6.11.3","to_inclusive":true,"patched_in":"6.11.4"}],"published":"2026-08-04T20:42:08Z","updated":"2026-08-05T09:26:25Z"},{"id":"wordfence:33f335ef-7cf5-4056-a8bb-f64b3f54eded","source":"wordfence","cve":"CVE-2025-54671","title":"oik <= 4.15.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f335ef-7cf5-4056-a8bb-f64b3f54eded?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.15.2","to_inclusive":true,"patched_in":"4.15.3"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:04:45Z"},{"id":"wordfence:33f3c466-bdeb-402f-bf34-bc703f35e1e2","source":"wordfence","cve":"CVE-2023-5818","title":"Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f3c466-bdeb-402f-bf34-bc703f35e1e2?source=api-prod","affected":[{"type":"plugin","slug":"amazonify","name":"Amazonify","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33f5a513-bc98-4beb-bec2-72eba8bd783d","source":"wordfence","cve":"CVE-2026-65484","title":"Style Kits <= 2.6.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f5a513-bc98-4beb-bec2-72eba8bd783d?source=api-prod","affected":[{"type":"plugin","slug":"analogwp-templates","name":"Style Kits for Elementor","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2026-07-22T00:00:00Z","updated":"2026-09-09T16:07:36Z"},{"id":"wordfence:33f63bd9-3031-40e8-b72e-1cbbcce5b782","source":"wordfence","cve":"CVE-2024-5946","title":"Squelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f63bd9-3031-40e8-b72e-1cbbcce5b782?source=api-prod","affected":[{"type":"plugin","slug":"squelch-tabs-and-accordions-shortcodes","name":"Squelch Tabs and Accordions Shortcodes","from":"*","from_inclusive":true,"to":"0.4.8","to_inclusive":true,"patched_in":"0.4.9"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T11:02:40Z"},{"id":"wordfence:33f673b5-2bcb-4591-b589-4d7230b5c2e7","source":"wordfence","cve":"CVE-2025-6689","title":"FL3R Accessibility Suite <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f673b5-2bcb-4591-b589-4d7230b5c2e7?source=api-prod","affected":[{"type":"plugin","slug":"fl3r-accessibility-suite","name":"FL3R Accessibility Suite","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T19:05:58Z","updated":"2025-06-27T07:22:21Z"},{"id":"wordfence:33f69ba1-f1f7-469c-9935-8a7db9ec3ea0","source":"wordfence","cve":"CVE-2026-27417","title":"Sweet Date < 4.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f69ba1-f1f7-469c-9935-8a7db9ec3ea0?source=api-prod","affected":[{"type":"theme","slug":"sweetdate","name":"Sweet Date","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:04:43Z"},{"id":"wordfence:33f8f75d-c57e-456c-a48a-82fa668adb1c","source":"wordfence","cve":"CVE-2023-46611","title":"YOP Poll <= 6.5.28 - Reusable Captcha via validateImage","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f8f75d-c57e-456c-a48a-82fa668adb1c?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.5.28","to_inclusive":true,"patched_in":"6.5.29"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33fd01f4-0cba-4130-88b4-2479f446a59a","source":"wordfence","cve":"CVE-2026-117522","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) < 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd01f4-0cba-4130-88b4-2479f446a59a?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:05Z"},{"id":"wordfence:33fd44dc-b4f8-4429-8dcd-5161602bb318","source":"wordfence","cve":"CVE-2025-0990","title":"I Am Gloria <= 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd44dc-b4f8-4429-8dcd-5161602bb318?source=api-prod","affected":[{"type":"plugin","slug":"gloria-assistant-by-webtronic-labs","name":"I Am Gloria","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T19:18:52Z","updated":"2025-03-05T08:21:55Z"},{"id":"wordfence:33fd4542-0a46-4779-be02-d713dcbc8f96","source":"wordfence","cve":"CVE-2023-22703","title":"WCP Contact Form <= 3.1.0 - Reflected Cross-Site Scripting via tab parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd4542-0a46-4779-be02-d713dcbc8f96?source=api-prod","affected":[{"type":"plugin","slug":"wcp-contact-form","name":"WCP Contact Form","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:33fd9697-803f-4cfb-894b-b3ca6a5ffebf","source":"wordfence","cve":"CVE-2025-60201","title":"Customer Area < 8.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd9697-803f-4cfb-894b-b3ca6a5ffebf?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":false,"patched_in":"8.3.4"}],"published":"2025-07-21T00:00:00Z","updated":"2026-07-08T20:59:05Z"},{"id":"wordfence:33fdd325-2a9e-4049-a2b0-c3eddc773c96","source":"wordfence","cve":"CVE-2025-60106","title":"EmailKit <= 1.6.0 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33fdd325-2a9e-4049-a2b0-c3eddc773c96?source=api-prod","affected":[{"type":"plugin","slug":"emailkit","name":"EmailKit \u2013 Email Customizer for WooCommerce & WP","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:02:06Z"},{"id":"wordfence:33ff0508-4acd-427c-a2d3-53b808cc63ee","source":"wordfence","cve":"CVE-2024-54321","title":"Hive Support \u2013 WordPress Help Desk <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33ff0508-4acd-427c-a2d3-53b808cc63ee?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:08:31Z"},{"id":"wordfence:33ff3b63-d634-43b1-9199-5fb6216dca48","source":"wordfence","cve":"CVE-2025-67565","title":"Rehub <= 19.9.9.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33ff3b63-d634-43b1-9199-5fb6216dca48?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.9.9.1","to_inclusive":true,"patched_in":"19.9.9.2"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T16:08:57Z"},{"id":"wordfence:34021007-b5d3-479b-a0d4-50e301f22c9c","source":"wordfence","cve":"CVE-2024-1340","title":"Login Lockdown \u2013 Protect Login Form <= 2.08 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.08","to_inclusive":true,"patched_in":"2.09"}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-20T18:56:25Z"},{"id":"wordfence:34045b62-a4d8-4fa0-ac8b-e1ca8ca72fca","source":"wordfence","cve":"","title":"API info for Plugins & Themes from WP.ORG <= 1.04 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34045b62-a4d8-4fa0-ac8b-e1ca8ca72fca?source=api-prod","affected":[{"type":"plugin","slug":"api-info-themes-plugins-wp-org","name":"API info for Plugins & Themes from WP.ORG","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":"1.05"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3405974d-cf0a-4fef-9693-5d81833f42d6","source":"wordfence","cve":"CVE-2025-12720","title":"g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3405974d-cf0a-4fef-9693-5d81833f42d6?source=api-prod","affected":[{"type":"plugin","slug":"g-ffl-cockpit","name":"g-FFL Cockpit","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-12-05T17:38:56Z","updated":"2025-12-09T22:01:42Z"},{"id":"wordfence:34062e9a-48c2-4676-ab7d-b6334f248e8a","source":"wordfence","cve":"CVE-2026-1934","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to  Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34062e9a-48c2-4676-ab7d-b6334f248e8a?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.103","to_inclusive":true,"patched_in":"1.4.104"}],"published":"2026-05-11T19:56:14Z","updated":"2026-05-12T08:27:45Z"},{"id":"wordfence:3408895e-3418-4f70-8b7c-76f6ba899d11","source":"wordfence","cve":"CVE-2025-6745","title":"WoodMart <= 8.2.5 - Unauthenticated Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3408895e-3418-4f70-8b7c-76f6ba899d11?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-11T07:22:59Z"},{"id":"wordfence:3408bdfd-6337-4c26-b0f2-377375d0e52c","source":"wordfence","cve":"","title":"Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3408bdfd-6337-4c26-b0f2-377375d0e52c?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.15.23","to_inclusive":false,"patched_in":"4.15.23"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3408f728-48e9-4f96-98d4-748f51686e26","source":"wordfence","cve":"CVE-2026-111372","title":"AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3408f728-48e9-4f96-98d4-748f51686e26?source=api-prod","affected":[{"type":"plugin","slug":"woowbot-woocommerce-chatbot","name":"AI ChatBot for WooCommerce \u2013 WoowBot","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-10-27T18:27:48Z","updated":"2026-10-28T06:45:09Z"},{"id":"wordfence:34097a1d-a7cb-4c72-80dd-c84796b6632d","source":"wordfence","cve":"CVE-2025-59574","title":"WP Travel Engine <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34097a1d-a7cb-4c72-80dd-c84796b6632d?source=api-prod","affected":[{"type":"plugin","slug":"wte-elementor-widgets","name":"WP Travel Engine \u2013 Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:09:59Z"},{"id":"wordfence:340980de-d746-4191-9e7b-24630975c535","source":"wordfence","cve":"CVE-2025-49315","title":"Persian Woocommerce SMS <= 7.0.10 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340980de-d746-4191-9e7b-24630975c535?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:39:02Z"},{"id":"wordfence:340a46e5-b15d-4f0c-8b7e-51f7de7741b5","source":"wordfence","cve":"","title":"S3bubble Amazon S3 Media Streaming <= 3.5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340a46e5-b15d-4f0c-8b7e-51f7de7741b5?source=api-prod","affected":[{"type":"plugin","slug":"s3audible-amazon-s3-music-player","name":"S3bubble Amazon S3 Media Streaming","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:340bb7bd-5764-4860-8263-1163786425fc","source":"wordfence","cve":"CVE-2024-12274","title":"BookingPress <= 1.1.22 - Unauthenticated File Export Download","severity":"medium","cvss":5.3,"cwe":"CWE-219","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340bb7bd-5764-4860-8263-1163786425fc?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.22","to_inclusive":true,"patched_in":"1.1.23"}],"published":"2024-12-23T00:00:00Z","updated":"2025-01-20T18:56:30Z"},{"id":"wordfence:340c14ea-70b9-4f60-84b3-97328432f110","source":"wordfence","cve":"CVE-2025-0450","title":"Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340c14ea-70b9-4f60-84b3-97328432f110?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.6.1","to_inclusive":true,"patched_in":"27.6.2"}],"published":"2025-01-20T21:55:18Z","updated":"2025-01-21T11:09:45Z"},{"id":"wordfence:340d6e92-81a0-4659-b60b-922f63476a33","source":"wordfence","cve":"CVE-2018-5368","title":"SrbTransLatin <= 1.46 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340d6e92-81a0-4659-b60b-922f63476a33?source=api-prod","affected":[{"type":"plugin","slug":"srbtranslatin","name":"SrbTransLatin \u2013 Serbian Latinisation","from":"*","from_inclusive":true,"to":"1.46","to_inclusive":true,"patched_in":"1.47"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:340e5bfd-256f-44c3-82db-a6d8179b2c2b","source":"wordfence","cve":"CVE-2025-60055","title":"Fabrica <= 1.8.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340e5bfd-256f-44c3-82db-a6d8179b2c2b?source=api-prod","affected":[{"type":"theme","slug":"fabrica","name":"Fabrica - Industrial & Engineering Factory Theme","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:39:54Z"},{"id":"wordfence:340e98bf-6484-4634-b2f8-e02f14de67de","source":"wordfence","cve":"","title":"Predictive Search <= 1.2.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340e98bf-6484-4634-b2f8-e02f14de67de?source=api-prod","affected":[{"type":"plugin","slug":"predictive-search","name":"Predictive Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:340f3e7b-6af3-4a16-817d-378324fb8cf0","source":"wordfence","cve":"CVE-2025-28897","title":"Domain Theme <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/340f3e7b-6af3-4a16-817d-378324fb8cf0?source=api-prod","affected":[{"type":"plugin","slug":"domain-theme","name":"Domain Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:00:50Z"},{"id":"wordfence:34110479-2581-4710-82ff-1d53535d83e1","source":"wordfence","cve":"CVE-2022-45820","title":"LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34110479-2581-4710-82ff-1d53535d83e1?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.7.3.2","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:341516d3-b785-4daf-98de-76f4f94b8c96","source":"wordfence","cve":"CVE-2024-23508","title":"PDF Poster - PDF Embedder Plugin for WordPress <= 2.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/341516d3-b785-4daf-98de-76f4f94b8c96?source=api-prod","affected":[{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2024-01-24T00:00:00Z","updated":"2024-01-26T15:04:09Z"},{"id":"wordfence:3417ec27-6abf-45c7-945f-6ef456ba1187","source":"wordfence","cve":"CVE-2026-18143","title":"Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-request-a-quote","name":"Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-25T17:47:32Z","updated":"2026-09-26T06:39:44Z"},{"id":"wordfence:341cbd60-33b9-49f8-b8f3-3c44664ce463","source":"wordfence","cve":"CVE-2022-47611","title":"Hover Image <= 1.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/341cbd60-33b9-49f8-b8f3-3c44664ce463?source=api-prod","affected":[{"type":"plugin","slug":"hover-image","name":"Hover Image","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:342049e5-834e-4867-8174-01ca7bb0caa2","source":"wordfence","cve":"CVE-2024-3018","title":"Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"5.9.14"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T11:17:25Z"},{"id":"wordfence:342370a0-9364-40cd-9556-e53312e67548","source":"wordfence","cve":"CVE-2012-4422","title":"WordPress Core < 3.4.2 - Missing Authorization Checks","severity":"low","cvss":3.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342370a0-9364-40cd-9556-e53312e67548?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2012-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3424c187-cf71-41f0-abb8-f0e843750465","source":"wordfence","cve":"CVE-2021-24505","title":"Forms <= 1.12.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3424c187-cf71-41f0-abb8-f0e843750465?source=api-prod","affected":[{"type":"plugin","slug":"forms-by-made-it","name":"Forms","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":false,"patched_in":"1.12.3"}],"published":"2021-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34267e02-4270-4656-a946-e4895f796786","source":"wordfence","cve":"CVE-2025-54015","title":"HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34267e02-4270-4656-a946-e4895f796786?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:05:54Z"},{"id":"wordfence:34270269-c86d-4d23-9c22-47c213578819","source":"wordfence","cve":"CVE-2026-28028","title":"MoneyFlow <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34270269-c86d-4d23-9c22-47c213578819?source=api-prod","affected":[{"type":"theme","slug":"moneyflow","name":"MoneyFlow","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:31:16Z"},{"id":"wordfence:3427387e-30d2-40a5-9bfd-d458039d8e2e","source":"wordfence","cve":"CVE-2025-2105","title":"Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3427387e-30d2-40a5-9bfd-d458039d8e2e?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"4.8.12"}],"published":"2025-04-25T17:04:47Z","updated":"2025-04-26T05:34:22Z"},{"id":"wordfence:3428bc71-64f9-4f8d-85c8-7dda81b2ac18","source":"wordfence","cve":"CVE-2024-8741","title":"Beam me up Scotty \u2013 Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3428bc71-64f9-4f8d-85c8-7dda81b2ac18?source=api-prod","affected":[{"type":"plugin","slug":"beam-me-up-scotty","name":"Beam me up Scotty \u2013 Back to Top Button","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:07Z"},{"id":"wordfence:342a4482-f5d3-4cc9-a998-e3abac7142cf","source":"wordfence","cve":"CVE-2024-2115","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342a4482-f5d3-4cc9-a998-e3abac7142cf?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-05T07:34:36Z"},{"id":"wordfence:342b2e81-fb26-416a-8f3d-4bc221260228","source":"wordfence","cve":"CVE-2016-10949","title":"Relevanssi Premium < 1.14.6.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342b2e81-fb26-416a-8f3d-4bc221260228?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"1.14.6.1","to_inclusive":false,"patched_in":"1.14.6.1"}],"published":"2016-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:342ccae4-2e77-4a4f-963f-689b882eb7f0","source":"wordfence","cve":"CVE-2025-6378","title":"Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342ccae4-2e77-4a4f-963f-689b882eb7f0?source=api-prod","affected":[{"type":"plugin","slug":"responsive-food-and-drink-menu","name":"Responsive Food and Drink Menu","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:45:44Z","updated":"2025-06-26T02:06:33Z"},{"id":"wordfence:342d6941-6987-4756-b554-1699128b9108","source":"wordfence","cve":"CVE-2024-1585","title":"Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342d6941-6987-4756-b554-1699128b9108?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2024-03-07T00:00:00Z","updated":"2024-05-31T15:30:14Z"},{"id":"wordfence:342d90e1-9d2e-4262-9667-013a8506727b","source":"wordfence","cve":"","title":"Helpful <= 4.5.14 - Authorization Bypass to Repeat Voting","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342d90e1-9d2e-4262-9667-013a8506727b?source=api-prod","affected":[{"type":"plugin","slug":"helpful","name":"Helpful","from":"*","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"4.5.15"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:342ece60-faf1-4fee-bf1e-6f6107f32861","source":"wordfence","cve":"CVE-2025-13657","title":"HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/342ece60-faf1-4fee-bf1e-6f6107f32861?source=api-prod","affected":[{"type":"plugin","slug":"helpdesk-contact-form","name":"HelpDesk.com Contact Form","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-01-06T18:33:32Z","updated":"2026-01-15T18:11:16Z"},{"id":"wordfence:3436916c-a7ab-4960-8afe-145b3799392e","source":"wordfence","cve":"CVE-2015-9336","title":"Clean Login <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3436916c-a7ab-4960-8afe-145b3799392e?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2015-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3438426a-c07d-4aeb-8272-2e13b70419a6","source":"wordfence","cve":"CVE-2024-1958","title":"WPB Show Core <= 2.6 - Reflected Cross-Site Scripting via 'file'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3438426a-c07d-4aeb-8272-2e13b70419a6?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-07T12:15:42Z"},{"id":"wordfence:343a6dbd-baf5-4de8-ae3e-6954fd3f1556","source":"wordfence","cve":"CVE-2024-9069","title":"Graphicsly \u2013 The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343a6dbd-baf5-4de8-ae3e-6954fd3f1556?source=api-prod","affected":[{"type":"plugin","slug":"graphicsly","name":"Graphicsly \u2013 The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery )","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:17:23Z","updated":"2024-09-25T02:05:07Z"},{"id":"wordfence:343cbdda-2ec5-437f-b563-96c61663314d","source":"wordfence","cve":"","title":"Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343cbdda-2ec5-437f-b563-96c61663314d?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.22.24","to_inclusive":true,"patched_in":"1.23.1"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:343cf9a7-bc65-4e05-974b-66a94d2298e3","source":"wordfence","cve":"CVE-2025-59006","title":"Easy Woocommerce Customizer <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343cf9a7-bc65-4e05-974b-66a94d2298e3?source=api-prod","affected":[{"type":"plugin","slug":"easy-woocommerce-customizer","name":"Easy Woocommerce Customizer","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-08T00:00:00Z","updated":"2025-10-29T20:59:25Z"},{"id":"wordfence:343e9aa9-b176-4c99-b2b4-04bd4bbf3c9b","source":"wordfence","cve":"CVE-2025-57897","title":"Logtik <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343e9aa9-b176-4c99-b2b4-04bd4bbf3c9b?source=api-prod","affected":[{"type":"theme","slug":"logtik","name":"Logtik | Logistics, Transportation Theme","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-09-12T00:00:00Z","updated":"2025-12-20T21:15:38Z"},{"id":"wordfence:343ed594-482a-4a27-9682-92bb643ee82a","source":"wordfence","cve":"CVE-2026-12924","title":"Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343ed594-482a-4a27-9682-92bb643ee82a?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.16"}],"published":"2026-07-09T19:20:13Z","updated":"2026-07-10T07:48:41Z"},{"id":"wordfence:343ef232-c0a7-4e08-a875-699c84c74ec2","source":"wordfence","cve":"CVE-2024-49638","title":"Risk Warning Bar <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343ef232-c0a7-4e08-a875-699c84c74ec2?source=api-prod","affected":[{"type":"plugin","slug":"risk-warning-bar","name":"Risk Warning Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:05:28Z"},{"id":"wordfence:343f5ad1-0507-48d8-8674-e4f811198daf","source":"wordfence","cve":"CVE-2024-13630","title":"NewsTicker <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/343f5ad1-0507-48d8-8674-e4f811198daf?source=api-prod","affected":[{"type":"plugin","slug":"news-list","name":"NewsTicker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-03-03T21:06:10Z"},{"id":"wordfence:3443950f-1f94-4e0b-8906-1a9b9602a746","source":"wordfence","cve":"CVE-2026-2892","title":"Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3443950f-1f94-4e0b-8906-1a9b9602a746?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-04-29T00:00:00Z","updated":"2026-04-30T13:28:24Z"},{"id":"wordfence:34439db4-1b66-4ccb-bf84-fddef6bc1f88","source":"wordfence","cve":"CVE-2023-52221","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34439db4-1b66-4ccb-bf84-fddef6bc1f88?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3444c4b0-4619-482f-8313-d3006aa1e845","source":"wordfence","cve":"CVE-2020-36742","title":"Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3444c4b0-4619-482f-8313-d3006aa1e845?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3445293d-16d8-4b06-a3df-afc25d9b465f","source":"wordfence","cve":"CVE-2026-90988","title":"Request a Quote <= 2.5.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3445293d-16d8-4b06-a3df-afc25d9b465f?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T00:01:45Z"},{"id":"wordfence:34466168-c03c-430e-9aba-daf718cbc9ad","source":"wordfence","cve":"CVE-2026-103480","title":"Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34466168-c03c-430e-9aba-daf718cbc9ad?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-15T17:08:14Z","updated":"2026-10-16T05:30:20Z"},{"id":"wordfence:3447c0ff-865c-4d94-9f33-a1824bf23794","source":"wordfence","cve":"CVE-2019-9908","title":"Font Organizer <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3447c0ff-865c-4d94-9f33-a1824bf23794?source=api-prod","affected":[{"type":"plugin","slug":"font-organizer","name":"Font Organizer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2019-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:344ad959-038a-46d1-b515-ae3473af8209","source":"wordfence","cve":"CVE-2023-30480","title":"Educenter <= 1.5.7 - Missing Authorization via activate_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/344ad959-038a-46d1-b515-ae3473af8209?source=api-prod","affected":[{"type":"theme","slug":"educenter","name":"Educenter","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-04-14T00:00:00Z","updated":"2025-01-15T18:53:30Z"},{"id":"wordfence:344b2f80-ea86-4bf0-8ee4-4b5c7b94c34b","source":"wordfence","cve":"CVE-2019-15647","title":"WordPress CRM, Email & Marketing Automation for WordPress | Award Winner \u2014 Groundhogg < 1.3.5 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/344b2f80-ea86-4bf0-8ee4-4b5c7b94c34b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"}],"published":"2019-04-08T00:00:00Z","updated":"2024-08-15T18:14:01Z"},{"id":"wordfence:345097c7-8f0e-46ed-9a1d-7c8a4a589e3f","source":"wordfence","cve":"CVE-2023-50904","title":"Poll Maker <= 4.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345097c7-8f0e-46ed-9a1d-7c8a4a589e3f?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34526c98-caf8-42d9-8782-7ea9b3a75e9d","source":"wordfence","cve":"CVE-2015-10111","title":"Watu Quiz <= 2.6.7 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34526c98-caf8-42d9-8782-7ea9b3a75e9d?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2015-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3456e10c-39fc-46a4-8f82-49fbc5a34860","source":"wordfence","cve":"CVE-2025-53292","title":"WP DataTable <= 0.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3456e10c-39fc-46a4-8f82-49fbc5a34860?source=api-prod","affected":[{"type":"plugin","slug":"wp-datatable","name":"WP DataTable","from":"*","from_inclusive":true,"to":"0.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:42:05Z"},{"id":"wordfence:34578df8-661c-4c54-b06c-e1d787ca3c55","source":"wordfence","cve":"CVE-2025-5929","title":"The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34578df8-661c-4c54-b06c-e1d787ca3c55?source=api-prod","affected":[{"type":"plugin","slug":"the-countdown","name":"The Countdown \u2013 Block Countdown Timer","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T14:06:45Z","updated":"2025-06-26T02:22:20Z"},{"id":"wordfence:345834f2-e95e-4ea1-b171-1c3f4aa17e0e","source":"wordfence","cve":"","title":"wp-checkout (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345834f2-e95e-4ea1-b171-1c3f4aa17e0e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-checkout","name":"WordPress Checkout","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:345bf99e-6f6d-477c-855d-f9296da04e3d","source":"wordfence","cve":"CVE-2026-102378","title":"Parallax Section Block \u2013 Add Parallax Scrolling Effects to Sections <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345bf99e-6f6d-477c-855d-f9296da04e3d?source=api-prod","affected":[{"type":"plugin","slug":"parallax-section","name":"Parallax Section Block \u2013 Add Parallax Scrolling Effects to Sections","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-10-01T12:02:25Z","updated":"2026-10-08T23:10:58Z"},{"id":"wordfence:345d0ffd-5cb1-460a-827d-104dde1d94cd","source":"wordfence","cve":"CVE-2026-13402","title":"Royal Elementor Addons <= 1.7.1062 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345d0ffd-5cb1-460a-827d-104dde1d94cd?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1062","to_inclusive":true,"patched_in":"1.7.1063"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T17:06:41Z"},{"id":"wordfence:345e58d2-208e-4e1d-b4e9-682cb5c30e15","source":"wordfence","cve":"CVE-2026-13600","title":"AutoNetTV Relay <= 3.0.13 - Unauthenticated Privilege Escalation","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345e58d2-208e-4e1d-b4e9-682cb5c30e15?source=api-prod","affected":[{"type":"plugin","slug":"autonettv-relay","name":"AutoNetTV Relay","from":"*","from_inclusive":true,"to":"3.0.13","to_inclusive":true,"patched_in":"3.0.14"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-17T16:04:24Z"},{"id":"wordfence:345f3354-d2cb-4b92-a25d-9551a5992919","source":"wordfence","cve":"CVE-2026-18385","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/345f3354-d2cb-4b92-a25d-9551a5992919?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.19","to_inclusive":true,"patched_in":"4.17.0"}],"published":"2026-08-15T16:04:19Z","updated":"2026-08-16T04:24:51Z"},{"id":"wordfence:34603c3f-834f-4a2a-9b9f-5213155d4317","source":"wordfence","cve":"CVE-2024-11844","title":"IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34603c3f-834f-4a2a-9b9f-5213155d4317?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.71","to_inclusive":true,"patched_in":"8.72"}],"published":"2024-12-02T20:21:52Z","updated":"2024-12-03T08:32:28Z"},{"id":"wordfence:346049ca-1bc5-4e02-9f38-d1f64338709d","source":"wordfence","cve":"CVE-2024-1124","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346049ca-1bc5-4e02-9f38-d1f64338709d?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-09T07:01:08Z"},{"id":"wordfence:34612902-1a26-4759-bca6-b5aaffa25af4","source":"wordfence","cve":"CVE-2025-14301","title":"Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34612902-1a26-4759-bca6-b5aaffa25af4?source=api-prod","affected":[{"type":"plugin","slug":"woosa-ai-for-woocommerce","name":"Integration Opvius AI for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:20:42Z","updated":"2026-01-14T05:28:06Z"},{"id":"wordfence:34618970-a4b6-456b-9d01-a09e7a977724","source":"wordfence","cve":"","title":"Exploit Scanner <= 1.3.3 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34618970-a4b6-456b-9d01-a09e7a977724?source=api-prod","affected":[{"type":"plugin","slug":"exploit-scanner","name":"Exploit Scanner","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2013-05-29T00:00:00Z","updated":"2026-02-26T14:50:12Z"},{"id":"wordfence:3462a1b7-74d9-431a-b1c6-9960f1ad0c19","source":"wordfence","cve":"CVE-2015-10115","title":"WooSidebars Sidebar Manager Converter <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3462a1b7-74d9-431a-b1c6-9960f1ad0c19?source=api-prod","affected":[{"type":"plugin","slug":"woosidebars-sbm-converter","name":"WooSidebars Sidebar Manager Converter","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3469ba0d-8ef3-41d0-becb-cf2eb43758f1","source":"wordfence","cve":"CVE-2021-42364","title":"Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3469ba0d-8ef3-41d0-becb-cf2eb43758f1?source=api-prod","affected":[{"type":"plugin","slug":"stetic","name":"Stetic","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:346a49ff-4e61-466b-b1fe-98cf5766accb","source":"wordfence","cve":"","title":"WordPress Calls to Action < 2.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346a49ff-4e61-466b-b1fe-98cf5766accb?source=api-prod","affected":[{"type":"plugin","slug":"cta","name":"WordPress Calls to Action","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":false,"patched_in":"2.2.8"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:346a5b00-fb76-4413-a935-a2df4dc51984","source":"wordfence","cve":"CVE-2025-15043","title":"The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346a5b00-fb76-4413-a935-a2df4dc51984?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.13","to_inclusive":true,"patched_in":"6.15.13.1"}],"published":"2026-01-20T01:45:16Z","updated":"2026-01-20T14:26:33Z"},{"id":"wordfence:346af237-0411-4cc4-9544-eab697385a2f","source":"wordfence","cve":"CVE-2025-14344","title":"Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346af237-0411-4cc4-9544-eab697385a2f?source=api-prod","affected":[{"type":"plugin","slug":"gf-multi-uploader","name":"Multi Uploader for Gravity Forms","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-12-11T15:06:36Z","updated":"2026-01-06T20:49:27Z"},{"id":"wordfence:346c9785-0069-40ec-a255-fe2dae30f7a0","source":"wordfence","cve":"CVE-2025-4671","title":"Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346c9785-0069-40ec-a255-fe2dae30f7a0?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.13.8","to_inclusive":true,"patched_in":"3.13.9"}],"published":"2025-06-02T21:31:42Z","updated":"2025-06-03T11:22:32Z"},{"id":"wordfence:346cc9af-6a1b-444c-9483-94f940cd18ad","source":"wordfence","cve":"","title":"Paramount (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346cc9af-6a1b-444c-9483-94f940cd18ad?source=api-prod","affected":[{"type":"theme","slug":"paramount","name":"Paramount","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:346d9473-8738-4a06-9bb3-0a018a4d4974","source":"wordfence","cve":"CVE-2024-13115","title":"WP Projects Portfolio with Client Testimonials <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/346d9473-8738-4a06-9bb3-0a018a4d4974?source=api-prod","affected":[{"type":"plugin","slug":"wp-projects-portfolio","name":"WP Projects Portfolio with Client Testimonials","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:14:22Z"},{"id":"wordfence:34706986-0181-4e9e-a826-7fe3a9171f98","source":"wordfence","cve":"CVE-2025-60138","title":"SKT Blocks <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34706986-0181-4e9e-a826-7fe3a9171f98?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:15:54Z"},{"id":"wordfence:34719304-3236-449f-8e8e-817d358e5918","source":"wordfence","cve":"CVE-2026-94270","title":"Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34719304-3236-449f-8e8e-817d358e5918?source=api-prod","affected":[{"type":"plugin","slug":"deema-payment-gateway","name":"Deema Payment Gateway","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:50:15Z"},{"id":"wordfence:3472039a-ef08-45eb-9f3b-eb0075c46fdc","source":"wordfence","cve":"CVE-2026-22410","title":"Dolcino - Pastry and Cake Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3472039a-ef08-45eb-9f3b-eb0075c46fdc?source=api-prod","affected":[{"type":"theme","slug":"dolcino","name":"Dolcino - Pastry and Cake Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:41:50Z"},{"id":"wordfence:34728e7a-2242-49fe-a11f-77258e302bab","source":"wordfence","cve":"CVE-2014-9334","title":"Bird Feeder <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34728e7a-2242-49fe-a11f-77258e302bab?source=api-prod","affected":[{"type":"plugin","slug":"bird-feeder","name":"bird-feeder","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:347307eb-b5d3-45d8-962b-08e26b963d82","source":"wordfence","cve":"CVE-2024-52462","title":"WP e-Commerce Style Email <= 0.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/347307eb-b5d3-45d8-962b-08e26b963d82?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce-style-email","name":"WP e-Commerce Style Email","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:23:41Z"},{"id":"wordfence:347573cf-037b-41e1-bebe-42c2a173068e","source":"wordfence","cve":"CVE-2024-51697","title":"Doofinder <= 0.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/347573cf-037b-41e1-bebe-42c2a173068e?source=api-prod","affected":[{"type":"plugin","slug":"doofinder","name":"Doofinder","from":"*","from_inclusive":true,"to":"0.5.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T19:40:52Z"},{"id":"wordfence:3475c8fe-17fa-4d8e-bffd-a33e59f6e03b","source":"wordfence","cve":"CVE-2023-1274","title":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 2.0 - Authenticated (Subscriber+) Local File Inclusion via Shortcode","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3475c8fe-17fa-4d8e-bffd-a33e59f6e03b?source=api-prod","affected":[{"type":"plugin","slug":"pricing-tables-for-wpbakery-page-builder","name":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3477baf1-71ef-44f3-938f-3e7d710e9df6","source":"wordfence","cve":"CVE-2026-12434","title":"List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3477baf1-71ef-44f3-938f-3e7d710e9df6?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.95.0","to_inclusive":true,"patched_in":"0.96.0"}],"published":"2026-07-15T13:46:32Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:3479e7a4-7719-4438-8bf5-bf9b9990f3f4","source":"wordfence","cve":"CVE-2023-27630","title":"Community by PeepSo <= 6.0.9.0 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3479e7a4-7719-4438-8bf5-bf9b9990f3f4?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.0.9.0","to_inclusive":true,"patched_in":"6.1.0.0"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:347b2fac-34ec-455a-97ff-c64781a6ec1a","source":"wordfence","cve":"CVE-2025-62930","title":"MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/347b2fac-34ec-455a-97ff-c64781a6ec1a?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.7.22","to_inclusive":true,"patched_in":"8.7.23"}],"published":"2025-10-06T00:00:00Z","updated":"2025-12-03T16:52:44Z"},{"id":"wordfence:347ba90e-b65f-46ea-bc82-8b5eb5dd5bdd","source":"wordfence","cve":"CVE-2026-39670","title":"Visual Link Preview <= 2.3.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/347ba90e-b65f-46ea-bc82-8b5eb5dd5bdd?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T15:54:15Z"},{"id":"wordfence:347feeaa-2d5c-4818-ab9e-2125a00b8ae8","source":"wordfence","cve":"","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/347feeaa-2d5c-4818-ab9e-2125a00b8ae8?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.11","to_inclusive":true,"patched_in":"6.4.12"}],"published":"2026-05-21T00:00:00Z","updated":"2026-05-26T19:30:29Z"},{"id":"wordfence:348034d7-49e9-4db5-9707-7b55a83ba50d","source":"wordfence","cve":"CVE-2026-19698","title":"GutenKit <= 2.5.0 - Authenticated (Contributor+) Arbitrary CSS Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/348034d7-49e9-4db5-9707-7b55a83ba50d?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-16T15:30:33Z"},{"id":"wordfence:34817e32-d5a3-403a-85f0-1d60af8945de","source":"wordfence","cve":"CVE-2023-1865","title":"YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34817e32-d5a3-403a-85f0-1d60af8945de?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:348419e3-2a4a-4e57-84b0-06e82e3333d4","source":"wordfence","cve":"CVE-2026-19224","title":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/348419e3-2a4a-4e57-84b0-06e82e3333d4?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.21.2","to_inclusive":false,"patched_in":"3.21.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:24:29Z"},{"id":"wordfence:3486ad83-f784-4ffd-bf26-f00c735f3a58","source":"wordfence","cve":"CVE-2026-16290","title":"ProfileGrid <= 5.0.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3486ad83-f784-4ffd-bf26-f00c735f3a58?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.0.0.0","to_inclusive":true,"patched_in":"6.0.0.0"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-15T21:39:58Z"},{"id":"wordfence:3486c8c8-5402-4f94-a03d-bcdff07ad53f","source":"wordfence","cve":"CVE-2025-28942","title":"Trust Payments Gateway for WooCommerce <= 1.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3486c8c8-5402-4f94-a03d-bcdff07ad53f?source=api-prod","affected":[{"type":"plugin","slug":"trust-payments-hosted-payment-pages-integration","name":"Trust Payments Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-20T00:00:00Z","updated":"2025-06-25T14:15:27Z"},{"id":"wordfence:3486dc6f-d40a-426a-9d46-ded10789ec62","source":"wordfence","cve":"CVE-2025-12551","title":"ListingHub  1.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3486dc6f-d40a-426a-9d46-ded10789ec62?source=api-prod","affected":[{"type":"plugin","slug":"listinghub","name":"ListingHub","from":"1.2.6","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:10:16Z"},{"id":"wordfence:3486f114-5625-4751-a25e-2c5ab7b15b38","source":"wordfence","cve":"CVE-2026-6262","title":"Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3486f114-5625-4751-a25e-2c5ab7b15b38?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.4.1"}],"published":"2026-05-04T21:38:53Z","updated":"2026-05-05T11:24:59Z"},{"id":"wordfence:348eb3f1-fa8e-42ae-b8a7-a1de3d196acf","source":"wordfence","cve":"CVE-2026-16039","title":"MStore API <= 4.20.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/348eb3f1-fa8e-42ae-b8a7-a1de3d196acf?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.20.0","to_inclusive":true,"patched_in":"4.21.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:37:28Z"},{"id":"wordfence:348faeed-0e08-4694-a800-891052376686","source":"wordfence","cve":"CVE-2026-24940","title":"Travelfic Toolkit <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/348faeed-0e08-4694-a800-891052376686?source=api-prod","affected":[{"type":"plugin","slug":"travelfic-toolkit","name":"Tourfic Toolkit","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-11-26T00:00:00Z","updated":"2026-02-10T19:25:38Z"},{"id":"wordfence:3497974d-cf58-4b38-a2c9-9bcd119ef43e","source":"wordfence","cve":"CVE-2024-11330","title":"Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3497974d-cf58-4b38-a2c9-9bcd119ef43e?source=api-prod","affected":[{"type":"plugin","slug":"custom-css","name":"Custom CSS, JS & PHP","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-11-22T18:17:30Z","updated":"2024-11-23T06:54:50Z"},{"id":"wordfence:3498c871-9404-4d12-9609-16fecf218b30","source":"wordfence","cve":"CVE-2026-12115","title":"Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3498c871-9404-4d12-9609-16fecf218b30?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-17T09:30:59Z"},{"id":"wordfence:349abf0b-fe0e-4dfb-b78d-811ee000d1e8","source":"wordfence","cve":"CVE-2025-49963","title":"Simple Stripe Checkout <= 1.1.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/349abf0b-fe0e-4dfb-b78d-811ee000d1e8?source=api-prod","affected":[{"type":"plugin","slug":"simple-stripe-checkout","name":"Simple Stripe Checkout","from":"*","from_inclusive":true,"to":"1.1.28","to_inclusive":true,"patched_in":""}],"published":"2025-07-20T00:00:00Z","updated":"2025-10-29T21:02:09Z"},{"id":"wordfence:349ba9de-69b3-42fb-aeba-c3a24280547f","source":"wordfence","cve":"CVE-2026-15284","title":"King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/349ba9de-69b3-42fb-aeba-c3a24280547f?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.62","to_inclusive":true,"patched_in":"51.1.63"}],"published":"2026-06-15T17:09:00Z","updated":"2026-07-10T04:31:21Z"},{"id":"wordfence:349cada2-8154-4429-a47a-1837581da1dc","source":"wordfence","cve":"CVE-2021-34628","title":"Admin Custom Login <= 3.2.7 \u2013 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/349cada2-8154-4429-a47a-1837581da1dc?source=api-prod","affected":[{"type":"plugin","slug":"admin-custom-login","name":"Admin Custom Login","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2021-07-26T06:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:349d960b-cc62-47c6-b0d5-a199e1e679db","source":"wordfence","cve":"CVE-2026-56038","title":"Frisbii Pay <= 1.8.2 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/349d960b-cc62-47c6-b0d5-a199e1e679db?source=api-prod","affected":[{"type":"plugin","slug":"reepay-checkout-gateway","name":"Frisbii Pay","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.2.1"}],"published":"2026-06-24T00:00:00Z","updated":"2026-07-02T13:53:54Z"},{"id":"wordfence:349e3b4a-c46b-48f6-acf7-bcdc86c13db7","source":"wordfence","cve":"CVE-2021-24320","title":"Directory & Listing < 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/349e3b4a-c46b-48f6-acf7-bcdc86c13db7?source=api-prod","affected":[{"type":"theme","slug":"bello","name":"Bello - Directory & Listing","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2021-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34a36da0-a101-4c5a-bacb-9f131bded819","source":"wordfence","cve":"CVE-2024-7416","title":"Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a36da0-a101-4c5a-bacb-9f131bded819?source=api-prod","affected":[{"type":"plugin","slug":"reveal-template","name":"Reveal Template","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2024-08-08T20:35:17Z","updated":"2024-08-09T09:30:12Z"},{"id":"wordfence:34a38049-c512-4fed-8cd5-6efac4e29d20","source":"wordfence","cve":"CVE-2026-91014","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a38049-c512-4fed-8cd5-6efac4e29d20?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:04Z"},{"id":"wordfence:34a42180-9d08-4049-8da8-27ee1f64600a","source":"wordfence","cve":"CVE-2024-1327","title":"Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a42180-9d08-4049-8da8-27ee1f64600a?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-04-02T00:00:00Z","updated":"2024-04-03T02:32:46Z"},{"id":"wordfence:34a46c3a-22f9-4f61-844b-dd03c5208be7","source":"wordfence","cve":"CVE-2015-9524","title":"Easy Digital Downloads \u2013 Recount Earnings < 2.3.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a46c3a-22f9-4f61-844b-dd03c5208be7?source=api-prod","affected":[{"type":"plugin","slug":"edd-recount-earnings","name":"Easy Digital Downloads \u2013 Recount Earnings","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2015-04-20T00:00:00Z","updated":"2026-02-25T18:34:25Z"},{"id":"wordfence:34a5649c-8fb0-43ed-9b63-16c798280b75","source":"wordfence","cve":"CVE-2024-51603","title":"NMR Strava activities <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a5649c-8fb0-43ed-9b63-16c798280b75?source=api-prod","affected":[{"type":"plugin","slug":"nmr-strava-activities","name":"NMR Strava activities","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-10-31T00:00:00Z","updated":"2025-01-14T15:31:53Z"},{"id":"wordfence:34a6c9af-1616-4b5d-8660-4f141bdd25c9","source":"wordfence","cve":"CVE-2014-4533","title":"GEO Redirector <= 1.0.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a6c9af-1616-4b5d-8660-4f141bdd25c9?source=api-prod","affected":[{"type":"plugin","slug":"geo-redirector","name":"GEO Redirector","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34a6d349-dfdc-4301-9380-7fc64c25f043","source":"wordfence","cve":"CVE-2022-0163","title":"Smart Forms < 2.6.71 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a6d349-dfdc-4301-9380-7fc64c25f043?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.71","to_inclusive":false,"patched_in":"2.6.71"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34a8980a-92d6-485b-877c-8339a1cd5fe8","source":"wordfence","cve":"CVE-2025-58630","title":"Simple Matomo Tracking Code <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a8980a-92d6-485b-877c-8339a1cd5fe8?source=api-prod","affected":[{"type":"plugin","slug":"simple-matomo-tracking-code","name":"Simple Matomo Tracking Code","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T20:43:37Z"},{"id":"wordfence:34a94f59-3ff4-473d-9f95-f1f8abfb3985","source":"wordfence","cve":"CVE-2025-48258","title":"Mega Menu Block <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34a94f59-3ff4-473d-9f95-f1f8abfb3985?source=api-prod","affected":[{"type":"plugin","slug":"getwid-megamenu","name":"Navigation Block with Mega Menu","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:47:41Z"},{"id":"wordfence:34ac0d3f-88ba-4b49-91af-e45f6b2ebf3a","source":"wordfence","cve":"CVE-2024-49678","title":"Js paper <= 2.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34ac0d3f-88ba-4b49-91af-e45f6b2ebf3a?source=api-prod","affected":[{"type":"theme","slug":"js-paper","name":"Js Paper","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:59:41Z"},{"id":"wordfence:34adbae5-d615-4f8d-a845-6741d897f06c","source":"wordfence","cve":"CVE-2025-1702","title":"Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34adbae5-d615-4f8d-a845-6741d897f06c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2025-03-04T21:53:45Z","updated":"2025-03-05T11:22:10Z"},{"id":"wordfence:34b11b26-7e8a-48b4-98e9-9a2a3778cbd1","source":"wordfence","cve":"CVE-2024-6668","title":"ProfilePro <= 1.3 - Authenticated (Subscriber+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34b11b26-7e8a-48b4-98e9-9a2a3778cbd1?source=api-prod","affected":[{"type":"plugin","slug":"profilepro","name":"ProfilePro","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-08-01T13:37:36Z"},{"id":"wordfence:34b39462-32c5-4f7d-b54f-d95f40b6ed92","source":"wordfence","cve":"CVE-2024-4204","title":"Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34b39462-32c5-4f7d-b54f-d95f40b6ed92?source=api-prod","affected":[{"type":"plugin","slug":"ithemeland-bulk-posts-editing-lite","name":"WBULKiT \u2013 Bulk Edit Posts & Pages","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2024-05-16T07:33:30Z","updated":"2024-05-16T20:31:06Z"},{"id":"wordfence:34b52ca2-c05f-49b7-846f-a67136d7d379","source":"wordfence","cve":"CVE-2026-1405","title":"Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34b52ca2-c05f-49b7-846f-a67136d7d379?source=api-prod","affected":[{"type":"plugin","slug":"slider-future","name":"Slider Future","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:54:34Z","updated":"2026-02-19T04:36:09Z"},{"id":"wordfence:34b6475c-b5dd-42a1-98d1-9b5ae9ff4ad5","source":"wordfence","cve":"CVE-2024-0452","title":"AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback","severity":"medium","cvss":5.0,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34b6475c-b5dd-42a1-98d1-9b5ae9ff4ad5?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2024-05-21T00:00:00Z","updated":"2024-07-29T21:36:09Z"},{"id":"wordfence:34bae29d-4617-44c9-8f00-bd581cef4ab1","source":"wordfence","cve":"","title":"Appointment Calendar <=  2.7.4 - Multiple Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34bae29d-4617-44c9-8f00-bd581cef4ab1?source=api-prod","affected":[{"type":"plugin","slug":"appointment-calendar","name":"Appointment Calendar","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2016-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34bd0915-e9d1-4c35-9929-b89262908617","source":"wordfence","cve":"CVE-2026-116865","title":"Zippy <= 1.7.0 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34bd0915-e9d1-4c35-9929-b89262908617?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T07:05:58Z","updated":"2026-11-03T19:36:38Z"},{"id":"wordfence:34bd7c32-f4c5-4015-909a-e4730f35494b","source":"wordfence","cve":"CVE-2026-87920","title":"W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34bd7c32-f4c5-4015-909a-e4730f35494b?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2026-10-01T21:12:37Z","updated":"2026-10-02T09:25:56Z"},{"id":"wordfence:34be34be-ef6d-4e66-a135-569e973df851","source":"wordfence","cve":"CVE-2026-32435","title":"VW Pet Shop <= 1.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34be34be-ef6d-4e66-a135-569e973df851?source=api-prod","affected":[{"type":"theme","slug":"vw-pet-shop","name":"VW Pet Shop","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:04:29Z"},{"id":"wordfence:34c0c676-37f9-49f2-ad50-2d70831fda53","source":"wordfence","cve":"CVE-2024-0374","title":"Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c0c676-37f9-49f2-ad50-2d70831fda53?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T22:43:02Z"},{"id":"wordfence:34c13495-23c3-4b07-9bfb-678723daa43f","source":"wordfence","cve":"CVE-2025-11767","title":"Tips Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c13495-23c3-4b07-9bfb-678723daa43f?source=api-prod","affected":[{"type":"plugin","slug":"tips-shortcode","name":"Tips Shortcode","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:18:57Z","updated":"2025-11-21T07:31:49Z"},{"id":"wordfence:34c2c30e-0ea8-4780-827c-14e9c1b1068b","source":"wordfence","cve":"CVE-2026-66615","title":"Podlove Podcast Publisher <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c2c30e-0ea8-4780-827c-14e9c1b1068b?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:23:31Z"},{"id":"wordfence:34c573f4-bc21-4a5f-a44a-779c523c3212","source":"wordfence","cve":"CVE-2026-13770","title":"AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c573f4-bc21-4a5f-a44a-779c523c3212?source=api-prod","affected":[{"type":"plugin","slug":"appmysite","name":"AppMySite \u2013 WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-09-18T18:48:37Z","updated":"2026-09-19T07:43:15Z"},{"id":"wordfence:34c627c1-7838-468e-acb7-eb84ad1b4949","source":"wordfence","cve":"CVE-2024-11976","title":"BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c627c1-7838-468e-acb7-eb84ad1b4949?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.3.3","to_inclusive":true,"patched_in":"14.3.4"}],"published":"2026-01-22T18:30:17Z","updated":"2026-01-23T06:45:13Z"},{"id":"wordfence:34c64a8b-32ad-4349-b593-933fc057d1a6","source":"wordfence","cve":"CVE-2026-4610","title":"ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c64a8b-32ad-4349-b593-933fc057d1a6?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.2","to_inclusive":true,"patched_in":"5.9.9.3"}],"published":"2026-06-22T00:00:00Z","updated":"2026-06-23T12:32:58Z"},{"id":"wordfence:34c98bb0-2e28-4ed4-8848-04edb66eef96","source":"wordfence","cve":"CVE-2020-27356","title":"Debug Meta Data <= 1.1.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34c98bb0-2e28-4ed4-8848-04edb66eef96?source=api-prod","affected":[{"type":"plugin","slug":"debug-meta-data","name":"Debug Meta Data","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2020-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34cddc7b-575c-4494-afa0-cd85c7b313e9","source":"wordfence","cve":"CVE-2023-23978","title":"WP Client Reports <= 1.0.16 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34cddc7b-575c-4494-afa0-cd85c7b313e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-client-reports","name":"WP Client Reports","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34ce7fa9-5f38-49f0-b402-34fdf8ee80dc","source":"wordfence","cve":"CVE-2024-44057","title":"Nirvana <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34ce7fa9-5f38-49f0-b402-34fdf8ee80dc?source=api-prod","affected":[{"type":"theme","slug":"nirvana","name":"Nirvana","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:55:02Z"},{"id":"wordfence:34d01610-0edc-488f-83e8-975206c0a02c","source":"wordfence","cve":"CVE-2024-38669","title":"WooCommerce Predictive Search <= 6.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d01610-0edc-488f-83e8-975206c0a02c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-predictive-search","name":"Predictive Search for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-31T21:08:52Z"},{"id":"wordfence:34d09086-be33-40cf-b5bf-d6c03cf0b68a","source":"wordfence","cve":"CVE-2024-8979","title":"Essential Addons for Elementor \u2013 Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation","severity":"high","cvss":8.0,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d09086-be33-40cf-b5bf-d6c03cf0b68a?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"6.0.10"}],"published":"2024-11-14T00:00:00Z","updated":"2024-11-15T09:29:39Z"},{"id":"wordfence:34d21418-4faf-40bf-a960-79482a592722","source":"wordfence","cve":"CVE-2024-1841","title":"WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d21418-4faf-40bf-a960-79482a592722?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:30:15Z"},{"id":"wordfence:34d396b2-f19f-47b3-bf9e-f2f14dd0b9be","source":"wordfence","cve":"CVE-2023-23896","title":"URL Shortener by MyThemeShop <= 1.0.16 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d396b2-f19f-47b3-bf9e-f2f14dd0b9be?source=api-prod","affected":[{"type":"plugin","slug":"mts-url-shortener","name":"URL Shortener by MyThemeShop","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34d5dbd4-5546-439e-a47a-4f9385116adc","source":"wordfence","cve":"CVE-2018-11244","title":"BBE < 1.53 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d5dbd4-5546-439e-a47a-4f9385116adc?source=api-prod","affected":[{"type":"theme","slug":"bbe","name":"BBE","from":"*","from_inclusive":true,"to":"1.53","to_inclusive":false,"patched_in":"1.53"}],"published":"2018-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34d6ad4a-f27c-4775-a26d-adf2d4755862","source":"wordfence","cve":"CVE-2025-8085","title":"Ditty <= 3.1.57 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d6ad4a-f27c-4775-a26d-adf2d4755862?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.57","to_inclusive":true,"patched_in":"3.1.58"}],"published":"2025-08-18T00:00:00Z","updated":"2026-09-17T00:08:31Z"},{"id":"wordfence:34d8c67a-548f-4498-8b57-33c0e7e5c004","source":"wordfence","cve":"CVE-2025-50035","title":"Fyrebox Quizzes <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d8c67a-548f-4498-8b57-33c0e7e5c004?source=api-prod","affected":[{"type":"plugin","slug":"fyrebox-shortcode","name":"Fyrebox Quizzes","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:07:57Z"},{"id":"wordfence:34d8ecee-ad52-47cd-ac78-4a82aa2ff58a","source":"wordfence","cve":"CVE-2014-9442","title":"Cart66 Lite :: WordPress Ecommerce <= 1.5.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d8ecee-ad52-47cd-ac78-4a82aa2ff58a?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2014-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34d990b6-3021-45d4-9ecd-cfabb7fbc96c","source":"wordfence","cve":"CVE-2024-43254","title":"Smart Online Order for Clover <= 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34d990b6-3021-45d4-9ecd-cfabb7fbc96c?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-31T00:19:51Z"},{"id":"wordfence:34da0e53-70d0-49ea-be7c-c2f610467172","source":"wordfence","cve":"CVE-2025-52824","title":"MDJM Event Management <= 1.7.6 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34da0e53-70d0-49ea-be7c-c2f610467172?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2026-10-20T23:51:34Z"},{"id":"wordfence:34dc3279-1587-49aa-9e08-9afb1a149c35","source":"wordfence","cve":"CVE-2026-95534","title":"Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34dc3279-1587-49aa-9e08-9afb1a149c35?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-10-02T07:21:53Z","updated":"2026-10-09T00:08:53Z"},{"id":"wordfence:34e0862d-55d3-4bc7-ba26-309ef1567e2b","source":"wordfence","cve":"CVE-2026-75016","title":"Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e0862d-55d3-4bc7-ba26-309ef1567e2b?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2026-09-17T18:36:34Z","updated":"2026-09-18T06:38:52Z"},{"id":"wordfence:34e31a0f-27de-4536-9a7e-b8f68e557b3f","source":"wordfence","cve":"CVE-2023-2229","title":"Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e31a0f-27de-4536-9a7e-b8f68e557b3f?source=api-prod","affected":[{"type":"plugin","slug":"rduplicator","name":"Quick Post Duplicator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34e3ef09-9c6c-49c5-ac41-f9dc7662d5aa","source":"wordfence","cve":"","title":"Popup Images (Unknown Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e3ef09-9c6c-49c5-ac41-f9dc7662d5aa?source=api-prod","affected":[{"type":"plugin","slug":"popup-images","name":"Popup Images","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34e56098-490c-4ea1-8acf-e103f1d7f602","source":"wordfence","cve":"CVE-2025-48114","title":"ShayanWeb Admin FontChanger <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e56098-490c-4ea1-8acf-e103f1d7f602?source=api-prod","affected":[{"type":"plugin","slug":"shayanweb-admin-fontchanger","name":"ShayanWeb Admin FontChanger | \u0627\u0641\u0632\u0648\u0646\u0647\u200c\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0648\u0646\u062a \u067e\u06cc\u0634\u062e\u0648\u0627\u0646 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0627\u06cc\u0627\u0646 \u0648\u0628","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.10"}],"published":"2025-05-16T00:00:00Z","updated":"2025-09-09T17:24:55Z"},{"id":"wordfence:34e62362-96cf-4779-8cb7-db5f7ed408d0","source":"wordfence","cve":"CVE-2024-13634","title":"Post Sync <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e62362-96cf-4779-8cb7-db5f7ed408d0?source=api-prod","affected":[{"type":"plugin","slug":"post-sync","name":"Post Sync","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:33:43Z"},{"id":"wordfence:34e7688d-af94-4ba4-96a5-8b1ebbde8214","source":"wordfence","cve":"CVE-2026-57636","title":"wpForo Forum <= 3.0.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e7688d-af94-4ba4-96a5-8b1ebbde8214?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:53:06Z"},{"id":"wordfence:34e89c4d-de55-40bd-8b78-c2ec544c2f60","source":"wordfence","cve":"CVE-2024-39650","title":"WooCommerce PDF Vouchers <= 4.9.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34e89c4d-de55-40bd-8b78-c2ec544c2f60?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:57:33Z"},{"id":"wordfence:34eaee0f-7a5b-4496-a5c8-5f6c69e24417","source":"wordfence","cve":"CVE-2022-40194","title":"Customer Reviews for WooCommerce <= 5.3.5 - Sensitive Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34eaee0f-7a5b-4496-a5c8-5f6c69e24417?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34f0e5a6-0bd3-4734-b7e0-27dc825d193f","source":"wordfence","cve":"CVE-2024-8016","title":"The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f?source=api-prod","affected":[{"type":"plugin","slug":"events-calendar-pro","name":"The Events Calendar Pro","from":"*","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.2.1"}],"published":"2024-08-29T00:00:00Z","updated":"2024-08-30T06:52:16Z"},{"id":"wordfence:34f260bd-8878-41ce-bdad-e4b60415e4f2","source":"wordfence","cve":"CVE-2025-22796","title":"WP-Asambleas <= 2.85.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34f260bd-8878-41ce-bdad-e4b60415e4f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-asambleas","name":"WP-Asambleas","from":"*","from_inclusive":true,"to":"2.85.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-04-22T21:53:29Z"},{"id":"wordfence:34f7ab72-a4e3-4264-b6d3-530dd255dc87","source":"wordfence","cve":"CVE-2023-47509","title":"Edit WooCommerce Templates <= 1.1.1 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34f7ab72-a4e3-4264-b6d3-530dd255dc87?source=api-prod","affected":[{"type":"plugin","slug":"woo-edit-templates","name":"Edit WooCommerce Templates","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-11-07T00:00:00Z","updated":"2024-10-16T20:08:56Z"},{"id":"wordfence:34f8d60e-01c8-40d6-b655-1dce127b607c","source":"wordfence","cve":"CVE-2025-22553","title":"Multiple Carousel <= 2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34f8d60e-01c8-40d6-b655-1dce127b607c?source=api-prod","affected":[{"type":"plugin","slug":"multicarousel","name":"Multiple Carousel","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-02-14T15:23:52Z"},{"id":"wordfence:34fb64d5-e152-4950-9ef4-6d53a97a56fb","source":"wordfence","cve":"CVE-2026-2505","title":"Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34fb64d5-e152-4950-9ef4-6d53a97a56fb?source=api-prod","affected":[{"type":"plugin","slug":"categories-images","name":"Categories Images","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-04-17T21:16:01Z","updated":"2026-04-18T09:26:54Z"},{"id":"wordfence:34fb7647-76e2-4985-816e-c6420c01a048","source":"wordfence","cve":"CVE-2022-46841","title":"Oxygen < 4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34fb7647-76e2-4985-816e-c6420c01a048?source=api-prod","affected":[{"type":"plugin","slug":"oxygen","name":"Oxygen","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":false,"patched_in":"4.4"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:34fcc835-593f-435b-ad00-07ca0cb649fa","source":"wordfence","cve":"CVE-2023-6529","title":"WP VR <= 8.3.14 - Missing Authorization to Plugin Version Downgrade","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34fcc835-593f-435b-ad00-07ca0cb649fa?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.3.14","to_inclusive":true,"patched_in":"8.3.15"}],"published":"2023-12-14T00:00:00Z","updated":"2024-02-06T16:12:23Z"},{"id":"wordfence:34fd42cb-3868-4b1c-bc56-575faf01e8f3","source":"wordfence","cve":"CVE-2026-1729","title":"AdForest <= 6.0.12 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34fd42cb-3868-4b1c-bc56-575faf01e8f3?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"6.0.13"}],"published":"2026-02-11T12:46:01Z","updated":"2026-02-12T01:23:43Z"},{"id":"wordfence:34fd5045-cd38-4eab-9e97-98f1e3d7423a","source":"wordfence","cve":"CVE-2025-3774","title":"Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/34fd5045-cd38-4eab-9e97-98f1e3d7423a?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-06-16T13:03:18Z","updated":"2025-06-17T01:44:10Z"},{"id":"wordfence:35027df9-ae55-453f-bb42-4b2664d66293","source":"wordfence","cve":"","title":"Statify \u2013 Extended Evaluation <= 2.6.3 - Authenticated (Admin+) CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35027df9-ae55-453f-bb42-4b2664d66293?source=api-prod","affected":[{"type":"plugin","slug":"extended-evaluation-for-statify","name":"Statify \u2013 Extended Evaluation","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3503c7bf-5e96-4033-89c1-b7c13c5489d2","source":"wordfence","cve":"CVE-2022-1831","title":"WPlite <= 1.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3503c7bf-5e96-4033-89c1-b7c13c5489d2?source=api-prod","affected":[{"type":"plugin","slug":"wplite","name":"WPlite","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3504a30a-f818-4168-937a-1172f21cb8c6","source":"wordfence","cve":"CVE-2025-46492","title":"Call Now PHT Blog <= 2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3504a30a-f818-4168-937a-1172f21cb8c6?source=api-prod","affected":[{"type":"plugin","slug":"call-now-coccoc-pht-blog","name":"Call Now PHT Blog","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:50:06Z"},{"id":"wordfence:3504b703-b95b-4d22-8883-a575b398c9ea","source":"wordfence","cve":"CVE-2022-2239","title":"Request a Quote <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3504b703-b95b-4d22-8883-a575b398c9ea?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:350719b1-0e88-4f6f-979e-0ac3d17b852b","source":"wordfence","cve":"","title":"Shortcode for Current Date <= 2.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/350719b1-0e88-4f6f-979e-0ac3d17b852b?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-for-current-date","name":"Shortcode for Current Date","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35088ff0-af2f-467d-879f-d60044342e8a","source":"wordfence","cve":"CVE-2026-62057","title":"CF7 Mate \u2013 Contact Form 7 Styler, Multi-Step Forms & Conditional Logic <= 4.1.0 -  Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35088ff0-af2f-467d-879f-d60044342e8a?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler-for-divi","name":"CF7 Mate \u2013 Contact Form 7 Styler, Multi-Step Forms & Conditional Logic","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T22:02:18Z"},{"id":"wordfence:350c23c6-6201-4dd5-9594-edb7d8ad926c","source":"wordfence","cve":"CVE-2025-5085","title":"wp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/350c23c6-6201-4dd5-9594-edb7d8ad926c?source=api-prod","affected":[{"type":"plugin","slug":"wp-nano-ad","name":"WP Nano AD","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:21Z","updated":"2026-06-02T07:48:29Z"},{"id":"wordfence:3511a3d3-1e6e-41ba-a8b9-67f8f7eef157","source":"wordfence","cve":"CVE-2021-25121","title":"Rating by BestWebSoft <= 1.5 - Rating Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3511a3d3-1e6e-41ba-a8b9-67f8f7eef157?source=api-prod","affected":[{"type":"plugin","slug":"rating-bws","name":"Rating by BestWebSoft","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3511ba64-56a3-43d7-8ab8-c6e40e3b686e","source":"wordfence","cve":"CVE-2023-6553","title":"Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2023-12-11T00:00:00Z","updated":"2024-07-29T21:36:09Z"},{"id":"wordfence:3511e110-d091-447d-87c0-25d33900bc30","source":"wordfence","cve":"CVE-2025-13606","title":"Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3511e110-d091-447d-87c0-25d33900bc30?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.19","to_inclusive":true,"patched_in":"2.20"}],"published":"2025-12-01T16:23:28Z","updated":"2025-12-02T04:37:14Z"},{"id":"wordfence:3511f952-d816-4c70-9966-1ee61e281ef6","source":"wordfence","cve":"CVE-2025-22345","title":"TS Comfort DB <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3511f952-d816-4c70-9966-1ee61e281ef6?source=api-prod","affected":[{"type":"plugin","slug":"ts-comfort-database","name":"TS Comfort DB","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:49:54Z"},{"id":"wordfence:3512ce8f-b7a6-4a6f-a141-bca08c183882","source":"wordfence","cve":"CVE-2025-1285","title":"Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3512ce8f-b7a6-4a6f-a141-bca08c183882?source=api-prod","affected":[{"type":"theme","slug":"resido","name":"Resido - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:32Z"},{"id":"wordfence:3513ec24-0b1b-4528-9f89-eee5654e4e98","source":"wordfence","cve":"CVE-2024-12771","title":"eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3513ec24-0b1b-4528-9f89-eee5654e4e98?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.43","to_inclusive":true,"patched_in":"3.3.44"}],"published":"2024-12-20T00:00:00Z","updated":"2024-12-21T07:02:59Z"},{"id":"wordfence:35149a01-94af-4a93-a272-cc850ed62a7f","source":"wordfence","cve":"CVE-2026-116864","title":"WPCargo Track & Trace <= 8.0.5 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35149a01-94af-4a93-a272-cc850ed62a7f?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T07:14:12Z","updated":"2026-11-03T19:36:25Z"},{"id":"wordfence:35151561-6a80-4c2c-b87a-2dfe02aa6158","source":"wordfence","cve":"CVE-2024-2237","title":"Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35151561-6a80-4c2c-b87a-2dfe02aa6158?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:32:38Z"},{"id":"wordfence:3518272e-6f4b-4693-9a0b-bf9e59ebdd06","source":"wordfence","cve":"CVE-2026-48196","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3518272e-6f4b-4693-9a0b-bf9e59ebdd06?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2026-10-29T13:04:00Z","updated":"2026-11-03T19:59:43Z"},{"id":"wordfence:351926d4-a9be-4fbd-bdf2-8bbff41d97ef","source":"wordfence","cve":"CVE-2024-1123","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-09T07:01:10Z"},{"id":"wordfence:351a035a-9768-4efd-9887-e0905e129634","source":"wordfence","cve":"CVE-2026-39519","title":"GeekyBot \u2014 AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/351a035a-9768-4efd-9887-e0905e129634?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:10:13Z"},{"id":"wordfence:351c7d18-6c1b-4a52-98ae-478dee5aaff2","source":"wordfence","cve":"CVE-2017-18010","title":"Smart Marketing SMS and Newsletters Forms < 2.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/351c7d18-6c1b-4a52-98ae-478dee5aaff2?source=api-prod","affected":[{"type":"plugin","slug":"smart-marketing-for-wp","name":"Smart Marketing SMS and Newsletters Forms","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2017-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:351d1553-59a6-4173-97ef-d7ed2cf5f9cb","source":"wordfence","cve":"CVE-2026-27992","title":"Meals & Wheels <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/351d1553-59a6-4173-97ef-d7ed2cf5f9cb?source=api-prod","affected":[{"type":"theme","slug":"meals-wheels","name":"Meals & Wheels","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:22:23Z"},{"id":"wordfence:35219b1e-f716-4be8-926c-62a7c462d2eb","source":"wordfence","cve":"CVE-2025-67519","title":"Ninja Tables <= 5.2.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35219b1e-f716-4be8-926c-62a7c462d2eb?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:13:22Z"},{"id":"wordfence:3522b693-4719-4320-b921-78b9ef682a21","source":"wordfence","cve":"CVE-2025-60185","title":"kontur Admin Style <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3522b693-4719-4320-b921-78b9ef682a21?source=api-prod","affected":[{"type":"plugin","slug":"kontur-admin-style","name":"kontur Admin Style","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T20:54:24Z"},{"id":"wordfence:35246286-c0df-4f82-84b8-ebefe966a4dc","source":"wordfence","cve":"","title":"Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35246286-c0df-4f82-84b8-ebefe966a4dc?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.4.8.1","to_inclusive":false,"patched_in":"1.4.8.1"}],"published":"2018-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35264434-e655-44e3-ab93-b4080c0a000d","source":"wordfence","cve":"CVE-2026-104646","title":"Image Photo Gallery Final Tiles Grid <= 3.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35264434-e655-44e3-ab93-b4080c0a000d?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.13","to_inclusive":true,"patched_in":"3.6.14"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T13:52:47Z"},{"id":"wordfence:3528acaa-0068-4476-82d7-fe7d68a55743","source":"wordfence","cve":"CVE-2026-57791","title":"Brook - Agency Business Creative WordPress Theme <= 2.9.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3528acaa-0068-4476-82d7-fe7d68a55743?source=api-prod","affected":[{"type":"theme","slug":"brook","name":"Brook - Agency Business Creative WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:36:33Z"},{"id":"wordfence:3529044f-c3d8-4370-8ba5-9df0fb71ab3c","source":"wordfence","cve":"CVE-2024-8541","title":"Discount Rules for WooCommerce \u2013 Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3529044f-c3d8-4370-8ba5-9df0fb71ab3c?source=api-prod","affected":[{"type":"plugin","slug":"woo-discount-rules","name":"Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-10-15T12:23:35Z","updated":"2024-10-16T02:05:01Z"},{"id":"wordfence:35293a82-b535-47a2-8a34-e54fe836ca89","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35293a82-b535-47a2-8a34-e54fe836ca89?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:352a0c8a-22a6-44d9-917c-5fb37569d143","source":"wordfence","cve":"","title":"All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/352a0c8a-22a6-44d9-917c-5fb37569d143?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2016-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:352cd9e6-ef1e-4a6b-bedb-6cf8ce9d4270","source":"wordfence","cve":"CVE-2022-45362","title":"Paytm Payment Gateway <= 2.7.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/352cd9e6-ef1e-4a6b-bedb-6cf8ce9d4270?source=api-prod","affected":[{"type":"plugin","slug":"paytm-payments","name":"Paytm Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:352e27ad-4266-4384-be2b-d94d241373a8","source":"wordfence","cve":"CVE-2025-24668","title":"PPOM for WooCommerce <= 33.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/352e27ad-4266-4384-be2b-d94d241373a8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"33.0.8","to_inclusive":true,"patched_in":"33.0.9"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:56:56Z"},{"id":"wordfence:352e705d-0233-40ef-a54e-91d42cdf432a","source":"wordfence","cve":"CVE-2025-48363","title":"Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/352e705d-0233-40ef-a54e-91d42cdf432a?source=api-prod","affected":[{"type":"plugin","slug":"cf7-sweet-alert-popup","name":"Popup for CF7 with Sweet Alert","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:47:50Z"},{"id":"wordfence:3533909d-9c81-4687-9426-187ceae2656e","source":"wordfence","cve":"CVE-2024-9645","title":"Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3533909d-9c81-4687-9426-187ceae2656e?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.92","to_inclusive":true,"patched_in":"2.2.93"}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-21T19:55:26Z"},{"id":"wordfence:3535fad2-9b2d-4721-9e5d-cfe609df00ae","source":"wordfence","cve":"CVE-2024-22301","title":"Albo Pretorio Online <= 4.12.1 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3535fad2-9b2d-4721-9e5d-cfe609df00ae?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.12.1","to_inclusive":true,"patched_in":"4.12.2"}],"published":"2024-01-17T00:00:00Z","updated":"2026-09-17T15:30:54Z"},{"id":"wordfence:3537ea8b-554b-4e41-902c-1d41b46deb1b","source":"wordfence","cve":"CVE-2026-22328","title":"Auto Repair <= 22.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3537ea8b-554b-4e41-902c-1d41b46deb1b?source=api-prod","affected":[{"type":"theme","slug":"auto-repair","name":"Auto Repair","from":"*","from_inclusive":true,"to":"22.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T15:02:12Z"},{"id":"wordfence:353804e8-0d5a-4633-974c-6eb7a3eeba61","source":"wordfence","cve":"","title":"WP Super Cache < 1.4.3 - Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/353804e8-0d5a-4633-974c-6eb7a3eeba61?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2015-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3538f5df-fd70-454d-87b0-08028dcbe449","source":"wordfence","cve":"CVE-2024-52437","title":"Banner System <= 1.0.0 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3538f5df-fd70-454d-87b0-08028dcbe449?source=api-prod","affected":[{"type":"plugin","slug":"banner-system","name":"Banner System","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:09:36Z"},{"id":"wordfence:3539fe09-c158-4146-9850-446bc32e7bec","source":"wordfence","cve":"CVE-2024-49292","title":"Exclusive Addons Elementor <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3539fe09-c158-4146-9850-446bc32e7bec?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:54:46Z"},{"id":"wordfence:353c244f-6d5d-47d6-988e-33da722a02f9","source":"wordfence","cve":"CVE-2024-1645","title":"Mollie Forms <= 2.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/353c244f-6d5d-47d6-988e-33da722a02f9?source=api-prod","affected":[{"type":"plugin","slug":"mollie-forms","name":"Mollie Forms","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-11T21:30:58Z"},{"id":"wordfence:353c3cd9-5ada-466b-b8e5-d40e0ec4e867","source":"wordfence","cve":"CVE-2023-47781","title":"Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/353c3cd9-5ada-466b-b8e5-d40e0ec4e867?source=api-prod","affected":[{"type":"theme","slug":"thrive-theme","name":"Thrive Themes Builder","from":"*","from_inclusive":true,"to":"3.24.2","to_inclusive":false,"patched_in":"3.24.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:353d22c5-dee1-485f-ae66-e9c7afe3ad8e","source":"wordfence","cve":"CVE-2023-23647","title":"Team Member <= 4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via new_style_name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/353d22c5-dee1-485f-ae66-e9c7afe3ad8e?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-supreme","name":"Team Members \u2013 Multi Language Supported Team Plugin","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35411f6a-bb1f-4b20-b9ed-66f21c9f7278","source":"wordfence","cve":"CVE-2026-68565","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35411f6a-bb1f-4b20-b9ed-66f21c9f7278?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.177","to_inclusive":true,"patched_in":"2.8.178"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-28T19:01:29Z"},{"id":"wordfence:3541794b-7c8a-42f8-9688-7f3dbbb08e58","source":"wordfence","cve":"CVE-2025-13534","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3541794b-7c8a-42f8-9688-7f3dbbb08e58?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2025-12-01T00:00:00Z","updated":"2025-12-02T08:25:05Z"},{"id":"wordfence:35421b32-701a-4fc9-bcec-80684d874bab","source":"wordfence","cve":"CVE-2023-44472","title":"Unyson <= 2.7.28 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35421b32-701a-4fc9-bcec-80684d874bab?source=api-prod","affected":[{"type":"plugin","slug":"unyson","name":"Unyson","from":"*","from_inclusive":true,"to":"2.7.28","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3544357f-97c9-49cb-a48d-74b60480111d","source":"wordfence","cve":"CVE-2023-49163","title":"teachPress <= 9.0.5 - Cross-Site Request Forgery via delete_database()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3544357f-97c9-49cb-a48d-74b60480111d?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.5","to_inclusive":true,"patched_in":"9.0.6"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:354631ff-ed01-45d0-b275-cbd96fffff5a","source":"wordfence","cve":"CVE-2024-51913","title":"Mapme <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/354631ff-ed01-45d0-b275-cbd96fffff5a?source=api-prod","affected":[{"type":"plugin","slug":"mapme","name":"Mapme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:42:47Z"},{"id":"wordfence:3548241e-551e-427a-907c-50b4712b5e5b","source":"wordfence","cve":"CVE-2022-4481","title":"Mesmerize Companion <= 1.6.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3548241e-551e-427a-907c-50b4712b5e5b?source=api-prod","affected":[{"type":"plugin","slug":"mesmerize-companion","name":"Mesmerize Companion","from":"*","from_inclusive":true,"to":"1.6.133","to_inclusive":true,"patched_in":"1.6.135"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35499ef6-c36b-4c5b-9cca-e7aaeec3a5e3","source":"wordfence","cve":"CVE-2026-25024","title":"ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35499ef6-c36b-4c5b-9cca-e7aaeec3a5e3?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.11.9","to_inclusive":true,"patched_in":"3.11.10"}],"published":"2026-02-02T00:00:00Z","updated":"2026-02-10T19:58:45Z"},{"id":"wordfence:354a5b89-8845-4486-8cc5-7339a6a107c0","source":"wordfence","cve":"CVE-2008-4106","title":"WordPress Core < 2.6.2 - Arbitrary User Password Reset","severity":"high","cvss":8.1,"cwe":"CWE-197","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/354a5b89-8845-4486-8cc5-7339a6a107c0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2008-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:354bd101-6688-44ab-b365-2caeb289bb6f","source":"wordfence","cve":"CVE-2026-104645","title":"Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/354bd101-6688-44ab-b365-2caeb289bb6f?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.14","to_inclusive":false,"patched_in":"3.6.14"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:35:24Z"},{"id":"wordfence:354c2c6c-5ba1-4bbe-88e4-9d219b66802a","source":"wordfence","cve":"","title":"Modula Image Gallery <= 2.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/354c2c6c-5ba1-4bbe-88e4-9d219b66802a?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35508e64-33a7-4d70-acaa-e9fae6920d95","source":"wordfence","cve":"CVE-2024-10939","title":"Image Widget <= 4.4.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35508e64-33a7-4d70-acaa-e9fae6920d95?source=api-prod","affected":[{"type":"plugin","slug":"image-widget","name":"Image Widget","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2024-11-22T00:00:00Z","updated":"2024-12-23T18:42:13Z"},{"id":"wordfence:3553044e-c109-4e6d-8ba1-f0d5cd1f72ef","source":"wordfence","cve":"CVE-2021-24233","title":"Cooked Pro <= 1.7.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3553044e-c109-4e6d-8ba1-f0d5cd1f72ef?source=api-prod","affected":[{"type":"plugin","slug":"cooked-pro","name":"Cooked Pro","from":"*","from_inclusive":true,"to":"1.7.5.6","to_inclusive":false,"patched_in":"1.7.5.6"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3555d06b-e36a-4ba5-b026-1c957c63f36b","source":"wordfence","cve":"CVE-2026-86802","title":"To Do List Member <= 1.6 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3555d06b-e36a-4ba5-b026-1c957c63f36b?source=api-prod","affected":[{"type":"plugin","slug":"todo-lists-for-membership-sites","name":"To Do List Member","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:48:58Z"},{"id":"wordfence:3557cd1e-cfb4-4f08-af3c-be5211a325c1","source":"wordfence","cve":"CVE-2024-53774","title":"Sparkle Elementor Kit <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3557cd1e-cfb4-4f08-af3c-be5211a325c1?source=api-prod","affected":[{"type":"plugin","slug":"sparkle-elementor-kit","name":"Sparkle Elementor Kit","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:17:00Z"},{"id":"wordfence:355d6e61-a45b-4682-bfad-77df18ae79f4","source":"wordfence","cve":"CVE-2026-57815","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/355d6e61-a45b-4682-bfad-77df18ae79f4?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.55.0.2","to_inclusive":true,"patched_in":"1.55.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T17:54:41Z"},{"id":"wordfence:355d8d4a-2488-4da5-b48f-4f8be6b59170","source":"wordfence","cve":"CVE-2026-13171","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/355d8d4a-2488-4da5-b48f-4f8be6b59170?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":false,"patched_in":"4.1.20"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:49:05Z"},{"id":"wordfence:355decb2-2667-4056-836c-9ac8897f340e","source":"wordfence","cve":"CVE-2023-26010","title":"WPMobile.App \u2014 Android and iOS Mobile Application <= 11.18 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/355decb2-2667-4056-836c-9ac8897f340e?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.18","to_inclusive":true,"patched_in":"11.19"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35609838-3a36-46e5-8c51-23f3177e6449","source":"wordfence","cve":"CVE-2024-13352","title":"Legull <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35609838-3a36-46e5-8c51-23f3177e6449?source=api-prod","affected":[{"type":"plugin","slug":"legull","name":"Legull","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-30T22:13:08Z"},{"id":"wordfence:3560bf50-2190-4469-9d92-b6b59f118324","source":"wordfence","cve":"CVE-2026-5934","title":"WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3560bf50-2190-4469-9d92-b6b59f118324?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"*","from_inclusive":true,"to":"3.21.0.1","to_inclusive":true,"patched_in":"3.21.1"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T11:29:28Z"},{"id":"wordfence:3563f70d-ab0a-48ec-9bb9-294b49026c1c","source":"wordfence","cve":"CVE-2021-38350","title":"spideranalyse <= 0.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3563f70d-ab0a-48ec-9bb9-294b49026c1c?source=api-prod","affected":[{"type":"plugin","slug":"spideranalyse","name":"spideranalyse","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:356549d0-8b74-4dd5-bef0-bf8c22d1f040","source":"wordfence","cve":"CVE-2024-49631","title":"Easy Addons for Elementor <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/356549d0-8b74-4dd5-bef0-bf8c22d1f040?source=api-prod","affected":[{"type":"plugin","slug":"easy-addons-for-elementor","name":"Easy Addons for Elementor","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-10-18T00:00:00Z","updated":"2026-09-16T17:28:25Z"},{"id":"wordfence:3566292a-91c8-4cb9-a1d3-45669d69bfc3","source":"wordfence","cve":"","title":"Q and A <= 1.0.6.2 Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3566292a-91c8-4cb9-a1d3-45669d69bfc3?source=api-prod","affected":[{"type":"plugin","slug":"q-and-a","name":"Q and A","from":"*","from_inclusive":true,"to":"1.0.6.2","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3566b602-c991-488f-9de2-57236c4735b5","source":"wordfence","cve":"CVE-2023-5336","title":"iPanorama 360 \u2013 WordPress Virtual Tour Builder <= 1.8.0 -  Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3566b602-c991-488f-9de2-57236c4735b5?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3566d9fa-faeb-4302-96e2-464a68eff66d","source":"wordfence","cve":"CVE-2015-9454","title":"Smooth Slider < 2.7 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3566d9fa-faeb-4302-96e2-464a68eff66d?source=api-prod","affected":[{"type":"plugin","slug":"smooth-slider","name":"Smooth Slider","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.7"}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35697cf5-4494-40f6-8772-dfa417ae6bcb","source":"wordfence","cve":"CVE-2021-24448","title":"Profile Builder <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35697cf5-4494-40f6-8772-dfa417ae6bcb?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:356cf06e-16e7-438b-83b5-c8a52a21f903","source":"wordfence","cve":"CVE-2023-0689","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/356cf06e-16e7-438b-83b5-c8a52a21f903?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35707e4e-ca67-43fe-b120-79101ef31155","source":"wordfence","cve":"CVE-2024-12220","title":"SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35707e4e-ca67-43fe-b120-79101ef31155?source=api-prod","affected":[{"type":"plugin","slug":"wc-sms","name":"SMS for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.1.1"}],"published":"2024-12-16T19:02:57Z","updated":"2024-12-17T07:23:15Z"},{"id":"wordfence:35724a49-cdd0-445d-8570-ae6a042f2b4b","source":"wordfence","cve":"CVE-2025-69168","title":"Spike <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35724a49-cdd0-445d-8570-ae6a042f2b4b?source=api-prod","affected":[{"type":"theme","slug":"spike","name":"Spike - Volleyball Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:39:09Z"},{"id":"wordfence:357257df-123d-4885-ad48-ff38ce29eeb3","source":"wordfence","cve":"CVE-2018-5373","title":"Smooth Slider < 2.8.7 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357257df-123d-4885-ad48-ff38ce29eeb3?source=api-prod","affected":[{"type":"plugin","slug":"smooth-slider","name":"Smooth Slider","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":false,"patched_in":"2.8.7"}],"published":"2018-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35767133-28d7-47e9-bcda-5d761262cdad","source":"wordfence","cve":"CVE-2023-23666","title":"MainWP Post Plus Extension <= 4.0.3 - Missing Authorization to Arbitrary Page/Post Deletion","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35767133-28d7-47e9-bcda-5d761262cdad?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-post-plus-extension","name":"MainWP Post Plus Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35790e70-6e96-4ffe-9d4e-828dd649e8c0","source":"wordfence","cve":"CVE-2025-12398","title":"Product Table for WooCommerce <= 5.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35790e70-6e96-4ffe-9d4e-828dd649e8c0?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-table","name":"Product Table for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2025-12-20T14:43:26Z","updated":"2025-12-21T03:20:04Z"},{"id":"wordfence:357b848c-65e9-4267-af53-55d133ca47d4","source":"wordfence","cve":"CVE-2024-51609","title":"Emoji Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357b848c-65e9-4267-af53-55d133ca47d4?source=api-prod","affected":[{"type":"plugin","slug":"emoji-shortcode","name":"Emoji Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:39:50Z"},{"id":"wordfence:357bbb87-08f1-402d-a707-b69641099530","source":"wordfence","cve":"CVE-2025-31573","title":"PeproDev CF7 Database <= 2.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357bbb87-08f1-402d-a707-b69641099530?source=api-prod","affected":[{"type":"plugin","slug":"pepro-cf7-database","name":"PeproDev CF7 Database","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-08-26T09:06:12Z"},{"id":"wordfence:357bf5c3-6c9a-4478-b9d0-9f1beaaf5d00","source":"wordfence","cve":"CVE-2025-49872","title":"myCred <= 2.9.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357bf5c3-6c9a-4478-b9d0-9f1beaaf5d00?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.4.2","to_inclusive":true,"patched_in":"2.9.4.3"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:49:34Z"},{"id":"wordfence:357d9d96-afb1-4b62-90cf-8d38a4cede0e","source":"wordfence","cve":"CVE-2026-103875","title":"Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/357d9d96-afb1-4b62-90cf-8d38a4cede0e?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2026-10-28T21:17:01Z","updated":"2026-10-29T09:25:33Z"},{"id":"wordfence:35800696-19b3-4479-a961-5d05aeeb44bb","source":"wordfence","cve":"CVE-2024-5573","title":"Easy Table of Contents <= 2.0.65 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35800696-19b3-4479-a961-5d05aeeb44bb?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.65","to_inclusive":true,"patched_in":"2.0.66"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-26T19:37:55Z"},{"id":"wordfence:35806af6-bb63-41c8-a20b-f5e36d2aa515","source":"wordfence","cve":"CVE-2013-3264","title":"WP Ultimate Email Marketer <= 1.2.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35806af6-bb63-41c8-a20b-f5e36d2aa515?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-email-marketer","name":"WP Ultimate Email Marketer","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2013-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35822026-8db8-458b-a304-6b5363346861","source":"wordfence","cve":"CVE-2025-53438","title":"FitLine <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35822026-8db8-458b-a304-6b5363346861?source=api-prod","affected":[{"type":"theme","slug":"fitline","name":"FitLine \u2014 Personal Coach WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:25:40Z"},{"id":"wordfence:358544e8-8bfc-408f-9dac-922b0a3809f8","source":"wordfence","cve":"CVE-2026-102375","title":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358544e8-8bfc-408f-9dac-922b0a3809f8?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"4.2.15"}],"published":"2026-09-30T12:47:43Z","updated":"2026-10-08T23:10:24Z"},{"id":"wordfence:3586da3d-fec0-4890-8918-bc1c417e44f7","source":"wordfence","cve":"CVE-2025-53270","title":"WordPress CTA <= 1.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3586da3d-fec0-4890-8918-bc1c417e44f7?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-06-27T00:00:00Z","updated":"2025-08-01T19:35:54Z"},{"id":"wordfence:35876ad9-595b-4099-b309-21bb80304baa","source":"wordfence","cve":"CVE-2026-28171","title":"WooCommerce File Approval <= 10.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35876ad9-595b-4099-b309-21bb80304baa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-file-approval","name":"WooCommerce File Approval","from":"*","from_inclusive":true,"to":"10.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:18:43Z"},{"id":"wordfence:35896489-e48c-40f6-8815-9af759e58b44","source":"wordfence","cve":"","title":"Crius (All Known Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35896489-e48c-40f6-8815-9af759e58b44?source=api-prod","affected":[{"type":"theme","slug":"crius","name":"Crius","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3589fd35-df91-48fb-b3be-4954f1e05656","source":"wordfence","cve":"CVE-2021-36845","title":"YITH Maintenance Mode <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3589fd35-df91-48fb-b3be-4954f1e05656?source=api-prod","affected":[{"type":"plugin","slug":"yith-maintenance-mode","name":"YITH Maintenance Mode","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2021-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:358a1a87-a87c-41b9-addc-d4945cd8fb40","source":"wordfence","cve":"CVE-2025-8394","title":"Productive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358a1a87-a87c-41b9-addc-d4945cd8fb40?source=api-prod","affected":[{"type":"plugin","slug":"productive-style","name":"Productive Style \u2013 Optimisations & Content Publishing Support","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T01:49:15Z"},{"id":"wordfence:358a5807-dbe5-4078-aaf3-3edf61c69bba","source":"wordfence","cve":"CVE-2026-42726","title":"AWP Classifieds <= 4.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358a5807-dbe5-4078-aaf3-3edf61c69bba?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T13:18:25Z"},{"id":"wordfence:358b595b-9e4b-4bf9-ac4f-03683c284078","source":"wordfence","cve":"CVE-2025-30610","title":"WP Social Widget <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358b595b-9e4b-4bf9-ac4f-03683c284078?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-widget","name":"WP Social Widget","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-30T14:08:14Z"},{"id":"wordfence:358be91d-cb00-429b-a4ed-69bf81e4d19e","source":"wordfence","cve":"CVE-2024-8920","title":"Fonto \u2013 Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358be91d-cb00-429b-a4ed-69bf81e4d19e?source=api-prod","affected":[{"type":"plugin","slug":"fonto","name":"Fonto \u2013 Custom Web Fonts Manager","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-10-16T20:46:08Z","updated":"2024-10-17T09:32:17Z"},{"id":"wordfence:358c0068-efd5-4bc8-9853-22fefdd9d76b","source":"wordfence","cve":"CVE-2024-49653","title":"Portfolleo <= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358c0068-efd5-4bc8-9853-22fefdd9d76b?source=api-prod","affected":[{"type":"plugin","slug":"portfolleo","name":"Portfolleo","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2026-03-27T11:07:39Z"},{"id":"wordfence:358cc1c6-cd09-4987-9267-a6f25c4a7e4d","source":"wordfence","cve":"CVE-2026-39728","title":"Instapage Plugin <= 3.7.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/358cc1c6-cd09-4987-9267-a6f25c4a7e4d?source=api-prod","affected":[{"type":"plugin","slug":"instapage","name":"Instapage Plugin","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2026-10-05T12:27:12Z","updated":"2026-10-13T17:01:57Z"},{"id":"wordfence:3590277a-3319-4707-b728-d75ea59e8ad9","source":"wordfence","cve":"CVE-2023-3343","title":"User Registration <= 3.0.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3590277a-3319-4707-b728-d75ea59e8ad9?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35906df7-5eaf-494a-8184-48e2ca22301e","source":"wordfence","cve":"CVE-2023-46779","title":"EasyRecipe <= 3.5.3251 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35906df7-5eaf-494a-8184-48e2ca22301e?source=api-prod","affected":[{"type":"plugin","slug":"easyrecipe","name":"EasyRecipe","from":"*","from_inclusive":true,"to":"3.5.3251","to_inclusive":true,"patched_in":""}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35934e53-4ef0-4b05-94a7-d67fbf57f312","source":"wordfence","cve":"CVE-2025-31406","title":"ELEX WooCommerce Request a Quote <= 2.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35934e53-4ef0-4b05-94a7-d67fbf57f312?source=api-prod","affected":[{"type":"plugin","slug":"elex-request-a-quote","name":"ELEX WooCommerce Request a Quote","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-08-14T15:28:35Z"},{"id":"wordfence:359395ff-a162-40f2-9bf7-54fc6f05fc9a","source":"wordfence","cve":"CVE-2026-76553","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion","severity":"medium","cvss":4.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359395ff-a162-40f2-9bf7-54fc6f05fc9a?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:25:59Z"},{"id":"wordfence:35958bea-29f2-4364-b476-fefba51689c6","source":"wordfence","cve":"CVE-2025-48252","title":"Back Button Widget <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35958bea-29f2-4364-b476-fefba51689c6?source=api-prod","affected":[{"type":"plugin","slug":"back-button-widget","name":"Back Button Widget","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T20:56:36Z"},{"id":"wordfence:3595f1c7-22a5-46c6-b81f-fe616a71116f","source":"wordfence","cve":"CVE-2024-8047","title":"Visual Sound (old) <= 1.06 -  Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3595f1c7-22a5-46c6-b81f-fe616a71116f?source=api-prod","affected":[{"type":"plugin","slug":"visual-sound-widget-for-soundcloud-and-artistplugme-visualdreams","name":"Visual Sound (old)","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T21:55:02Z"},{"id":"wordfence:35969379-e668-4045-8de7-696f196ba5b0","source":"wordfence","cve":"CVE-2024-11180","title":"ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35969379-e668-4045-8de7-696f196ba5b0?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2025-03-28T00:00:00Z","updated":"2025-03-29T07:23:45Z"},{"id":"wordfence:359833dd-de3c-48ea-8eef-06588a590da2","source":"wordfence","cve":"CVE-2025-9209","title":"RestroPress \u2013 Online Food Ordering System 3.0.0 - 3.2.1 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359833dd-de3c-48ea-8eef-06588a590da2?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"3.0.0","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-10-02T22:17:09Z","updated":"2025-11-06T15:19:24Z"},{"id":"wordfence:3598445c-1d65-4e84-8db0-717aed66088b","source":"wordfence","cve":"CVE-2025-53325","title":"Beauty Contact Popup Form <= 6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3598445c-1d65-4e84-8db0-717aed66088b?source=api-prod","affected":[{"type":"plugin","slug":"beauty-contact-popup-form","name":"Beauty Contact Popup Form","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:33:43Z"},{"id":"wordfence:35993748-4d11-434d-8192-6bbccc246a41","source":"wordfence","cve":"CVE-2026-107870","title":"JetEngine <= 3.8.16 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35993748-4d11-434d-8192-6bbccc246a41?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.8.16.1"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:48:47Z"},{"id":"wordfence:359aae96-8b6d-4365-b0c1-f0c7220383c9","source":"wordfence","cve":"CVE-2026-40795","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359aae96-8b6d-4365-b0c1-f0c7220383c9?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-04-28T00:00:00Z","updated":"2026-05-04T13:58:22Z"},{"id":"wordfence:359ab91d-5b60-460b-b6f2-90a5afa675ea","source":"wordfence","cve":"CVE-2025-31820","title":"Automatic Featured Images from Videos <= 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359ab91d-5b60-460b-b6f2-90a5afa675ea?source=api-prod","affected":[{"type":"plugin","slug":"automatic-featured-images-from-videos","name":"Automatic Featured Images from Videos","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:10:39Z"},{"id":"wordfence:359b596e-1973-4bf6-a012-84b422c0f2c1","source":"wordfence","cve":"CVE-2022-41135","title":"Customizable WordPress Gallery Plugin \u2013 Modula Image Gallery <= 2.6.9 - Missing Authorization to Plugin Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359b596e-1973-4bf6-a012-84b422c0f2c1?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.91"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:359b8977-6d0d-4856-8d72-17091a420f67","source":"wordfence","cve":"CVE-2023-39926","title":"Under Construction / Maintenance Mode from Acurax <= 2.6 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359b8977-6d0d-4856-8d72-17091a420f67?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode-from-acurax","name":"Under Construction / Maintenance Mode from Acurax","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:359c573f-7031-4f56-b66f-c37339667aca","source":"wordfence","cve":"CVE-2023-46311","title":"wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359c573f-7031-4f56-b66f-c37339667aca?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:359e9b04-40a7-45f3-9d00-6fb3cd3463d9","source":"wordfence","cve":"CVE-2025-39381","title":"KiotViet Sync <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/359e9b04-40a7-45f3-9d00-6fb3cd3463d9?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-05-16T15:17:13Z"},{"id":"wordfence:35a0a0b8-2d62-4675-9bec-d26164271a03","source":"wordfence","cve":"CVE-2022-38058","title":"WP Shamsi <= 4.1.1 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a0a0b8-2d62-4675-9bec-d26164271a03?source=api-prod","affected":[{"type":"plugin","slug":"wp-shamsi","name":"WP Shamsi \u2013 \u0627\u0641\u0632\u0648\u0646\u0647 \u062a\u0627\u0631\u06cc\u062e \u0634\u0645\u0633\u06cc \u0648 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35a0f4dd-7370-48da-a4ef-424c42da60e9","source":"wordfence","cve":"CVE-2015-10104","title":"Icons for Features <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a0f4dd-7370-48da-a4ef-424c42da60e9?source=api-prod","affected":[{"type":"plugin","slug":"icons-for-features","name":"Icons for Features","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35a49ba9-02a6-47cf-98f0-053b06036b08","source":"wordfence","cve":"CVE-2026-15462","title":"Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a49ba9-02a6-47cf-98f0-053b06036b08?source=api-prod","affected":[{"type":"plugin","slug":"sticky-chat-widget","name":"Sticky Chat Widget \u2013 Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-09-10T14:43:08Z","updated":"2026-09-11T03:39:34Z"},{"id":"wordfence:35a5114e-5c5f-4003-8bb3-77243ffbac1a","source":"wordfence","cve":"CVE-2024-5265","title":"WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a5114e-5c5f-4003-8bb3-77243ffbac1a?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.7"}],"published":"2024-06-12T18:40:01Z","updated":"2024-06-13T06:42:52Z"},{"id":"wordfence:35a55336-2cd1-41a8-b9ef-09ab4a8dd632","source":"wordfence","cve":"CVE-2026-4338","title":"ActivityPub < 8.0.2 - Unauthenticated Information Epxosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a55336-2cd1-41a8-b9ef-09ab4a8dd632?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":false,"patched_in":"8.0.2"}],"published":"2026-03-18T00:00:00Z","updated":"2026-04-15T18:59:57Z"},{"id":"wordfence:35a690c5-dc7e-4bb7-be5b-c70bd0ea7d10","source":"wordfence","cve":"CVE-2024-11009","title":"Internal Linking for SEO traffic & Ranking \u2013 Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a690c5-dc7e-4bb7-be5b-c70bd0ea7d10?source=api-prod","affected":[{"type":"plugin","slug":"automatic-internal-links-for-seo","name":"Automatic Internal Links for SEO by Pagup","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-11-26T23:25:28Z","updated":"2024-11-27T11:33:23Z"},{"id":"wordfence:35a75451-f0ae-4630-b415-394c76868e93","source":"wordfence","cve":"CVE-2024-28003","title":"Max Mega Menu <= 3.3. - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a75451-f0ae-4630-b415-394c76868e93?source=api-prod","affected":[{"type":"plugin","slug":"megamenu","name":"Max Mega Menu","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T21:14:17Z"},{"id":"wordfence:35a7b5a1-b052-4390-8e08-f97aa9c16b29","source":"wordfence","cve":"CVE-2025-6222","title":"WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7b5a1-b052-4390-8e08-f97aa9c16b29?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-refund-and-exchange","name":"WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-18T05:23:58Z"},{"id":"wordfence:35a7caac-1171-474a-86c6-7893658c91eb","source":"wordfence","cve":"CVE-2025-62117","title":"EasyIndex <= 1.1.1704 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7caac-1171-474a-86c6-7893658c91eb?source=api-prod","affected":[{"type":"plugin","slug":"easyindex","name":"EasyIndex","from":"*","from_inclusive":true,"to":"1.1.1704","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:26:04Z"},{"id":"wordfence:35a8ca49-6d23-43c1-a14a-0aa9f7214e73","source":"wordfence","cve":"CVE-2026-14185","title":"WPBot AI ChatBot <= 8.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35a8ca49-6d23-43c1-a14a-0aa9f7214e73?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.1.0","to_inclusive":true,"patched_in":"8.2.0"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-29T23:17:06Z"},{"id":"wordfence:35ac7049-6453-4235-82bd-d2bc6ffccabe","source":"wordfence","cve":"CVE-2026-34902","title":"Product Table and List Builder for WooCommerce Lite <= 4.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35ac7049-6453-4235-82bd-d2bc6ffccabe?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-13T21:12:07Z"},{"id":"wordfence:35ac717c-e299-4a56-bead-cb1d050da75c","source":"wordfence","cve":"CVE-2005-2107","title":"WordPress Core <= 1.5.1.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35ac717c-e299-4a56-bead-cb1d050da75c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.2","to_inclusive":true,"patched_in":"1.5.1.3"}],"published":"2005-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35acdb85-e463-46b1-aea7-a6d4c3581499","source":"wordfence","cve":"CVE-2024-13344","title":"Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35acdb85-e463-46b1-aea7-a6d4c3581499?source=api-prod","affected":[{"type":"plugin","slug":"scw-seat-reservation","name":"Advance Seat Reservation Management for WooCommerce","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:18Z"},{"id":"wordfence:35afef52-350c-4b61-b9c0-3ae2572f81fb","source":"wordfence","cve":"","title":"Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35afef52-350c-4b61-b9c0-3ae2572f81fb?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":false,"patched_in":"2.9.3"}],"published":"2023-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b013c1-1574-4d5b-a3cb-e400ef7f2d32","source":"wordfence","cve":"CVE-2021-39318","title":"H5P CSS Editor <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b013c1-1574-4d5b-a3cb-e400ef7f2d32?source=api-prod","affected":[{"type":"plugin","slug":"h5p-css-editor","name":"H5P CSS Editor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b02e79-9d31-482a-92b9-b1e8201d45f1","source":"wordfence","cve":"CVE-2025-7827","title":"Ni WooCommerce Customer Product Report <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b02e79-9d31-482a-92b9-b1e8201d45f1?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-customer-product-report","name":"Ni WooCommerce Customer Product Report","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:50:00Z","updated":"2025-08-23T04:25:46Z"},{"id":"wordfence:35b0d959-2adb-4de4-b51b-1bfead49bc7d","source":"wordfence","cve":"CVE-2025-12710","title":"Pet-Manager \u2013 Petfinder <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b0d959-2adb-4de4-b51b-1bfead49bc7d?source=api-prod","affected":[{"type":"plugin","slug":"tier-management-petfinder","name":"Pet-Manager \u2013 Petfinder","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2025-11-18T00:00:00Z","updated":"2025-11-19T05:45:13Z"},{"id":"wordfence:35b1853f-0c19-4fc8-8878-9e8a9330f76a","source":"wordfence","cve":"CVE-2024-30430","title":"Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b1853f-0c19-4fc8-8878-9e8a9330f76a?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"2.8.44","to_inclusive":true,"patched_in":"2.8.45"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:31:56Z"},{"id":"wordfence:35b1976f-88cb-4457-8d03-bcf7788f1385","source":"wordfence","cve":"CVE-2026-123064","title":"BASE Booking of Appointments, Services and Events <= 6.5.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b1976f-88cb-4457-8d03-bcf7788f1385?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:56:26Z"},{"id":"wordfence:35b1fb1a-a12c-4938-a2d2-74e291db76ef","source":"wordfence","cve":"CVE-2024-43256","title":"Leopard - WordPress offload media <= 2.0.36 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b1fb1a-a12c-4938-a2d2-74e291db76ef?source=api-prod","affected":[{"type":"plugin","slug":"leopard-wordpress-offload-media","name":"Leopard - WordPress Offload Media","from":"*","from_inclusive":true,"to":"2.0.36","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-08-12T00:00:00Z","updated":"2024-11-14T17:04:29Z"},{"id":"wordfence:35b3a82a-4391-41b0-b434-691743c5ff4d","source":"wordfence","cve":"CVE-2023-39310","title":"Fusion Builder <= 3.11.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b3a82a-4391-41b0-b434-691743c5ff4d?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b3a8cd-1fc7-4176-ace6-580dd92c6154","source":"wordfence","cve":"CVE-2025-30991","title":"Premium Packages <= 6.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b3a8cd-1fc7-4176-ace6-580dd92c6154?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-10-08T21:02:51Z"},{"id":"wordfence:35b46587-1c6e-4d3f-a8d0-e7797cee882d","source":"wordfence","cve":"","title":"GTM Server Side <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b46587-1c6e-4d3f-a8d0-e7797cee882d?source=api-prod","affected":[{"type":"plugin","slug":"gtm-server-side","name":"Stape Conversion Tracking","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b5a51d-e617-4f89-b663-36b73db93a59","source":"wordfence","cve":"CVE-2025-46535","title":"Custom Login and Registration <= 1.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b5a51d-e617-4f89-b663-36b73db93a59?source=api-prod","affected":[{"type":"plugin","slug":"ms-registration","name":"Custom Login and Registration","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T21:57:13Z"},{"id":"wordfence:35b5a6ab-8909-49aa-8427-19355e6a7303","source":"wordfence","cve":"CVE-2019-14950","title":"WP Live Chat Support <= 8.0.27 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b5a6ab-8909-49aa-8427-19355e6a7303?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.26","to_inclusive":true,"patched_in":"8.0.27"}],"published":"2019-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b6a26a-d7c1-4538-87f3-fcb1095797a3","source":"wordfence","cve":"CVE-2023-2309","title":"wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b6a26a-d7c1-4538-87f3-fcb1095797a3?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b74f5b-f088-4307-81ba-2c379754c4a2","source":"wordfence","cve":"CVE-2017-1002028","title":"WordPress Gallery Transforation < 0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b74f5b-f088-4307-81ba-2c379754c4a2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gallery-transformation","name":"wordpress-gallery-transformation","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2017-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35b86488-8f68-4738-a9a8-76d0b7976165","source":"wordfence","cve":"CVE-2026-7458","title":"User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b86488-8f68-4738-a9a8-76d0b7976165?source=api-prod","affected":[{"type":"plugin","slug":"user-verification","name":"User Verification by PickPlugins","from":"*","from_inclusive":true,"to":"2.0.46","to_inclusive":true,"patched_in":"2.0.47"}],"published":"2026-05-01T15:46:35Z","updated":"2026-05-02T04:27:46Z"},{"id":"wordfence:35b9f37c-69e1-437a-97dd-3d3e7a8cd86e","source":"wordfence","cve":"","title":"Ivory Search <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35b9f37c-69e1-437a-97dd-3d3e7a8cd86e?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.8"}],"published":"2021-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35bd7462-8dab-43b2-9941-fef6f826cfdc","source":"wordfence","cve":"CVE-2023-2433","title":"YARPP \u2013 Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35bd7462-8dab-43b2-9941-fef6f826cfdc?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.3","to_inclusive":true,"patched_in":"5.30.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35be104a-15bc-489b-9806-9abe4ea2388a","source":"wordfence","cve":"CVE-2022-1732","title":"Rename wp-login.php <= 2.6.0 - Cross-Site Request Forgery & Unauthenticated Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35be104a-15bc-489b-9806-9abe4ea2388a?source=api-prod","affected":[{"type":"plugin","slug":"rename-wp-login","name":"Rename wp-login.php","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35bfa8dc-fbe4-4c02-90d0-c43728b153d1","source":"wordfence","cve":"CVE-2026-107127","title":"Uncanny Toolkit for LearnDash < 3.8.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35bfa8dc-fbe4-4c02-90d0-c43728b153d1?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:22:28Z"},{"id":"wordfence:35c12f80-d069-44ed-b6a5-caa060fbd281","source":"wordfence","cve":"CVE-2015-1365","title":"Pixabay Images <= 2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c12f80-d069-44ed-b6a5-caa060fbd281?source=api-prod","affected":[{"type":"plugin","slug":"pixabay-images","name":"Pixabay Images","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2015-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35c40c81-c7b4-4453-bd2f-7910fcb7f13e","source":"wordfence","cve":"CVE-2023-51404","title":"My Agile Privacy <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c40c81-c7b4-4453-bd2f-7910fcb7f13e?source=api-prod","affected":[{"type":"plugin","slug":"myagileprivacy","name":"My Agile Privacy\u00ae \u2013 CMP, Cookie Consent & Privacy Tools","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35c4a9c5-a8aa-4b05-9968-76060b4fad20","source":"wordfence","cve":"CVE-2025-57893","title":"WP Fast Total Search <= 1.79.270 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c4a9c5-a8aa-4b05-9968-76060b4fad20?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.79.270","to_inclusive":true,"patched_in":"1.79.274"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:52:18Z"},{"id":"wordfence:35c5b1cd-053c-4e1d-994f-003b89d5ff62","source":"wordfence","cve":"CVE-2024-32833","title":"List Custom Taxonomy Widget <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c5b1cd-053c-4e1d-994f-003b89d5ff62?source=api-prod","affected":[{"type":"plugin","slug":"list-custom-taxonomy-widget","name":"List Custom Taxonomy Widget","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:49:39Z"},{"id":"wordfence:35c5c75c-a595-48cd-acec-a83f5c422f18","source":"wordfence","cve":"CVE-2024-50543","title":"amazing neo icon font for elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c5c75c-a595-48cd-acec-a83f5c422f18?source=api-prod","affected":[{"type":"plugin","slug":"amazing-neo-icon-font-for-elementor","name":"amazing neo icon font for elementor","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:40:31Z"},{"id":"wordfence:35c608c3-9c28-4e0d-b0ec-d0a279fccd3b","source":"wordfence","cve":"CVE-2024-12221","title":"Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c608c3-9c28-4e0d-b0ec-d0a279fccd3b?source=api-prod","affected":[{"type":"plugin","slug":"weaver-for-bbpress","name":"Turnkey bbPress by WeaverTheme","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-01-03T21:19:55Z","updated":"2025-01-04T09:22:37Z"},{"id":"wordfence:35c7901a-49da-4df4-a9b2-966326b1310d","source":"wordfence","cve":"CVE-2025-27342","title":"WooCommerce Recargo de Equivalencia <= 1.6.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c7901a-49da-4df4-a9b2-966326b1310d?source=api-prod","affected":[{"type":"plugin","slug":"woo-recargo-de-equivalencia","name":"WooCommerce Recargo de Equivalencia","from":"*","from_inclusive":true,"to":"1.6.24","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:43:10Z"},{"id":"wordfence:35c7c089-6517-419e-8ba3-e6c2692fe1ae","source":"wordfence","cve":"CVE-2024-47648","title":"EventPrime <= 4.0.4.5 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35c7c089-6517-419e-8ba3-e6c2692fe1ae?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.4.5","to_inclusive":true,"patched_in":"4.0.4.6"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:47:49Z"},{"id":"wordfence:35cb9b4e-223a-48ba-af6f-a9d6d2f3db03","source":"wordfence","cve":"CVE-2024-51906","title":"RSV 360 View <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35cb9b4e-223a-48ba-af6f-a9d6d2f3db03?source=api-prod","affected":[{"type":"plugin","slug":"rsv-360-view","name":"RSV 360 View","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:58:05Z"},{"id":"wordfence:35cc980b-9c52-4f0b-aeb2-4afa6efacd8f","source":"wordfence","cve":"","title":"WP ERP <=1.10.5 - Sensitive Data Exposure","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35cc980b-9c52-4f0b-aeb2-4afa6efacd8f?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.10.5","to_inclusive":true,"patched_in":"1.10.6"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35cd1788-1756-4d03-8f6f-e5e4153e3f4f","source":"wordfence","cve":"CVE-2023-41732","title":"CP Blocks <= 1.0.20 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35cd1788-1756-4d03-8f6f-e5e4153e3f4f?source=api-prod","affected":[{"type":"plugin","slug":"cp-blocks","name":"CP Blocks","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35d36566-8f07-436b-88e6-e83c2787d29e","source":"wordfence","cve":"CVE-2026-103070","title":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF <= 6.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d36566-8f07-436b-88e6-e83c2787d29e?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:30:43Z"},{"id":"wordfence:35d64d3e-b48e-4e35-ab1d-0557fcd62263","source":"wordfence","cve":"CVE-2024-8787","title":"Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d64d3e-b48e-4e35-ab1d-0557fcd62263?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:02Z"},{"id":"wordfence:35d69a35-ec19-474a-a09b-0200bfa9e1db","source":"wordfence","cve":"","title":"Social Count Plus <= 5.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d69a35-ec19-474a-a09b-0200bfa9e1db?source=api-prod","affected":[{"type":"plugin","slug":"social-count-plus","name":"Social Count Plus","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35d80441-6cbe-4bd4-a891-a4a1d24c77ec","source":"wordfence","cve":"","title":"Easy Media Gallery Pro <= 1.2.59 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d80441-6cbe-4bd4-a891-a4a1d24c77ec?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-gallery-pro","name":"Easy Media Gallery Pro","from":"*","from_inclusive":true,"to":"1.2.59","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2014-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35d84ccf-e17f-4c31-9a86-f36d082f95c0","source":"wordfence","cve":"CVE-2025-31558","title":"TailPress <= 0.4.4 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d84ccf-e17f-4c31-9a86-f36d082f95c0?source=api-prod","affected":[{"type":"plugin","slug":"tailpress","name":"TailPress \u2013 Tailwind for WordPress","from":"*","from_inclusive":true,"to":"0.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-10T13:22:48Z"},{"id":"wordfence:35d8e0d9-08d5-4e39-a235-06e624f2e764","source":"wordfence","cve":"CVE-2026-16573","title":"Bit Form <= 3.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d8e0d9-08d5-4e39-a235-06e624f2e764?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:45:20Z"},{"id":"wordfence:35d9105d-0b1f-494b-a05c-2b0571599084","source":"wordfence","cve":"CVE-2024-52392","title":"W3SPEEDSTER <= 7.25 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35d9105d-0b1f-494b-a05c-2b0571599084?source=api-prod","affected":[{"type":"plugin","slug":"w3speedster-wp","name":"W3SPEEDSTER","from":"*","from_inclusive":true,"to":"7.25","to_inclusive":true,"patched_in":"7.27"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:54:50Z"},{"id":"wordfence:35dadb9c-f0c6-4b74-bb31-5e9d504b3db5","source":"wordfence","cve":"CVE-2023-43493","title":"Welcart e-Commerce <= 2.8.21 - Authenticated(level_5+) SQL Injection via get_logs","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35dadb9c-f0c6-4b74-bb31-5e9d504b3db5?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.22","to_inclusive":false,"patched_in":"2.8.22"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35db7137-aba0-4299-ad8a-c650d6db5199","source":"wordfence","cve":"CVE-2026-57725","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35db7137-aba0-4299-ad8a-c650d6db5199?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:56:59Z"},{"id":"wordfence:35def866-7460-4cad-8d86-7b9e4905cbe4","source":"wordfence","cve":"CVE-2023-5051","title":"CallRail Phone Call Tracking <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35def866-7460-4cad-8d86-7b9e4905cbe4?source=api-prod","affected":[{"type":"plugin","slug":"callrail-phone-call-tracking","name":"CallRail Phone Call Tracking","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":"0.5.3"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35df1ab9-58c1-4270-96ef-bbb2c7ac7af6","source":"wordfence","cve":"CVE-2015-0890","title":"reCaptcha by BestWebSoft <= 1.12 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35df1ab9-58c1-4270-96ef-bbb2c7ac7af6?source=api-prod","affected":[{"type":"plugin","slug":"google-captcha","name":"reCaptcha by BestWebSoft","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":false,"patched_in":"1.13"}],"published":"2015-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35e0a997-190e-457a-b80c-7b4ecec97095","source":"wordfence","cve":"CVE-2023-49841","title":"Optin Forms <= 1.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35e0a997-190e-457a-b80c-7b4ecec97095?source=api-prod","affected":[{"type":"plugin","slug":"optin-forms","name":"Optin Forms \u2013 Simple List Building Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2023-12-06T00:00:00Z","updated":"2026-02-26T14:53:10Z"},{"id":"wordfence:35e220c0-1e4d-4365-a1be-de66930fa559","source":"wordfence","cve":"CVE-2021-24179","title":"Business Directory Plugin <= 5.10.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35e220c0-1e4d-4365-a1be-de66930fa559?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.11"}],"published":"2021-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35e2f081-41ca-4465-933a-db5c30b058da","source":"wordfence","cve":"","title":"WP Easy Gallery <= 2.7 - SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35e2f081-41ca-4465-933a-db5c30b058da?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2013-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35e33e30-e102-445a-99d0-27adb7fc4638","source":"wordfence","cve":"CVE-2026-3496","title":"JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35e33e30-e102-445a-99d0-27adb7fc4638?source=api-prod","affected":[{"type":"plugin","slug":"jet-booking","name":"JetBooking","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.3.1"}],"published":"2026-03-10T17:33:16Z","updated":"2026-03-11T13:24:39Z"},{"id":"wordfence:35ead2b5-8b50-40e1-9b4a-547d97f34c4e","source":"wordfence","cve":"CVE-2024-4375","title":"Master Slider \u2013 Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35ead2b5-8b50-40e1-9b4a-547d97f34c4e?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2024-06-17T14:11:35Z","updated":"2024-09-30T14:38:16Z"},{"id":"wordfence:35ec9787-81f2-46c9-98d7-29095181a531","source":"wordfence","cve":"CVE-2026-12697","title":"wpForo Forum <= 3.1.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Chat Message Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35ec9787-81f2-46c9-98d7-29095181a531?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-16T00:00:00Z","updated":"2026-08-17T16:04:06Z"},{"id":"wordfence:35ee465c-3958-4fcb-b1a8-e01ebc4a045a","source":"wordfence","cve":"CVE-2025-48315","title":"WordPress HTML <= 0.51 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35ee465c-3958-4fcb-b1a8-e01ebc4a045a?source=api-prod","affected":[{"type":"plugin","slug":"custom-html-bodyhead","name":"WordPress HTML","from":"*","from_inclusive":true,"to":"0.51","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:06:48Z"},{"id":"wordfence:35eebcc8-a6bf-4cbb-9cc6-f49bd1625d6b","source":"wordfence","cve":"CVE-2024-12032","title":"Tourfic \u2013 Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35eebcc8-a6bf-4cbb-9cc6-f49bd1625d6b?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.15.3","to_inclusive":true,"patched_in":"2.15.4"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T03:21:32Z"},{"id":"wordfence:35f2d80a-891a-4616-a3f6-01bbf12f5f10","source":"wordfence","cve":"CVE-2021-39349","title":"Author Bio Box <= 3.3.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f2d80a-891a-4616-a3f6-01bbf12f5f10?source=api-prod","affected":[{"type":"plugin","slug":"author-bio-box","name":"Author Bio Box","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35f49283-00e5-450e-a908-261b0357b36b","source":"wordfence","cve":"CVE-2024-51684","title":"W3P SEO <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f49283-00e5-450e-a908-261b0357b36b?source=api-prod","affected":[{"type":"plugin","slug":"wp-perfect-plugin","name":"W3P SEO \u2013 Lightweight SEO, Schema & AI Search Toolkit","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:31:36Z"},{"id":"wordfence:35f59c05-8d1d-45b1-813f-65435e4aaed3","source":"wordfence","cve":"CVE-2024-55981","title":"Nabz Image Gallery <= v1.00 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f59c05-8d1d-45b1-813f-65435e4aaed3?source=api-prod","affected":[{"type":"plugin","slug":"nabz-image-gallery","name":"Nabz Image Gallery","from":"*","from_inclusive":true,"to":"v1.00","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-23T17:04:20Z"},{"id":"wordfence:35f78106-e75d-4d60-b37a-5d097da9413b","source":"wordfence","cve":"CVE-2025-39420","title":"WP Twitter Button <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f78106-e75d-4d60-b37a-5d097da9413b?source=api-prod","affected":[{"type":"plugin","slug":"wp-twitter-button","name":"WP Twitter Button","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:00:13Z"},{"id":"wordfence:35f82406-f75d-4510-81c0-14af3d944bf0","source":"wordfence","cve":"CVE-2024-32812","title":"Podlove Podcast Publisher <= 4.0.11 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f82406-f75d-4510-81c0-14af3d944bf0?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:54:22Z"},{"id":"wordfence:35f91088-3c52-4b32-abe8-94731d631f25","source":"wordfence","cve":"CVE-2025-49379","title":"Custom Fields Account Registration For Woocommerce <= 1.2 - Authenticated (Author+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f91088-3c52-4b32-abe8-94731d631f25?source=api-prod","affected":[{"type":"plugin","slug":"custom-fields-account-registration-for-woocommerce","name":"Custom Fields Account Registration For Woocommerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-11-10T00:00:00Z","updated":"2025-12-19T20:44:50Z"},{"id":"wordfence:35f9614c-032f-499e-a777-05725be3bd7a","source":"wordfence","cve":"CVE-2026-24600","title":"Penci Review <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f9614c-032f-499e-a777-05725be3bd7a?source=api-prod","affected":[{"type":"plugin","slug":"penci-review","name":"Penci Review","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-14T00:00:00Z","updated":"2026-01-28T18:38:37Z"},{"id":"wordfence:35f9f778-b056-4188-b34f-3c45b91a0138","source":"wordfence","cve":"CVE-2024-37416","title":"WP Photo Album Plus <= 8.8.00.002 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35f9f778-b056-4188-b34f-3c45b91a0138?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.8.00.002","to_inclusive":true,"patched_in":"8.8.00.003"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:12:14Z"},{"id":"wordfence:35fb04aa-5899-4797-9ea1-24e7a98ad8d3","source":"wordfence","cve":"CVE-2021-24878","title":"SupportCandy <= 2.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35fb04aa-5899-4797-9ea1-24e7a98ad8d3?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2022-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35fb658f-6ffa-4df7-bfcd-25307d89fc26","source":"wordfence","cve":"CVE-2023-0717","title":"Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folder","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35fb658f-6ffa-4df7-bfcd-25307d89fc26?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:35fc9a16-3775-48c0-82af-692974f54c33","source":"wordfence","cve":"CVE-2023-32295","title":"Easy!Appointments <= 1.4.0 - Authenticated(Subscriber+) Arbitrary File Deletion via 'disconnect'","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35fc9a16-3775-48c0-82af-692974f54c33?source=api-prod","affected":[{"type":"plugin","slug":"easyappointments","name":"Easy!Appointments","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-08-10T00:00:00Z","updated":"2024-07-11T17:11:06Z"},{"id":"wordfence:35fd77f2-321c-4194-b7e0-7fdd50b50047","source":"wordfence","cve":"CVE-2025-64242","title":"Easy Property Listings <= 3.5.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/35fd77f2-321c-4194-b7e0-7fdd50b50047?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.22","to_inclusive":true,"patched_in":"3.5.23"}],"published":"2025-12-12T00:00:00Z","updated":"2026-04-25T15:35:28Z"},{"id":"wordfence:360010f3-9053-4c69-a4e8-12f0c77ba746","source":"wordfence","cve":"CVE-2024-32078","title":"FV Flowplayer Video Player <= 7.5.44.7212 - Authenticated (Contributor+) Arbitrary Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360010f3-9053-4c69-a4e8-12f0c77ba746?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.44.7212","to_inclusive":true,"patched_in":"7.5.45.7212"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-18T15:06:53Z"},{"id":"wordfence:3602bc88-b966-4eac-98fa-2ab49bb971c0","source":"wordfence","cve":"CVE-2025-30867","title":"SearchIQ <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3602bc88-b966-4eac-98fa-2ab49bb971c0?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:15:31Z"},{"id":"wordfence:3604aece-5e76-4e8e-9caf-f518d6001277","source":"wordfence","cve":"CVE-2025-3740","title":"School Management System for Wordpress <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3604aece-5e76-4e8e-9caf-f518d6001277?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.1.0","to_inclusive":true,"patched_in":"1.93.1 (02-07-2025)"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-18T04:23:00Z"},{"id":"wordfence:3604b314-6b85-4d11-aa71-63f9198dbbdb","source":"wordfence","cve":"CVE-2026-65438","title":"Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3604b314-6b85-4d11-aa71-63f9198dbbdb?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3.9","to_inclusive":true,"patched_in":"1.6.4.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:07:51Z"},{"id":"wordfence:36051ae9-80ae-4abe-8bc7-9a9ec78ee7aa","source":"wordfence","cve":"CVE-2025-31641","title":"UberSlider < 2.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36051ae9-80ae-4abe-8bc7-9a9ec78ee7aa?source=api-prod","affected":[{"type":"plugin","slug":"uber-classic","name":"UberSlider","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:09:25Z"},{"id":"wordfence:3607420e-3f02-425d-a708-f785ce66f2db","source":"wordfence","cve":"CVE-2024-48043","title":"ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3607420e-3f02-425d-a708-f785ce66f2db?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-10-13T00:00:00Z","updated":"2024-10-18T15:59:39Z"},{"id":"wordfence:3608fce3-0869-4516-ae08-68108f733c37","source":"wordfence","cve":"CVE-2024-3238","title":"WordPress Menu Plugin \u2014 Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3608fce3-0869-4516-ae08-68108f733c37?source=api-prod","affected":[{"type":"plugin","slug":"superfly-menu","name":"WordPress Menu Plugin \u2014 Superfly Responsive Menu","from":"*","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"5.0.30"}],"published":"2024-08-01T17:45:27Z","updated":"2024-08-02T06:41:38Z"},{"id":"wordfence:360a022d-8530-48af-be34-77d6b4b5c19d","source":"wordfence","cve":"CVE-2023-2493","title":"All In One Redirection <= 2.1.0 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360a022d-8530-48af-be34-77d6b4b5c19d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-redirection","name":"All In One Redirection","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:360b1927-a863-46be-ad11-3f6251c75a3c","source":"wordfence","cve":"CVE-2023-6109","title":"YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360b1927-a863-46be-ad11-3f6251c75a3c?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.5.26","to_inclusive":true,"patched_in":"6.5.27"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:360cb170-a888-4b7f-8ea2-1d74a404f1df","source":"wordfence","cve":"CVE-2007-4166","title":"Unnamed < 1.2.17.1 and Unnamed SE < 1.0.3  - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360cb170-a888-4b7f-8ea2-1d74a404f1df?source=api-prod","affected":[{"type":"theme","slug":"unnamed","name":"Unnamed","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.17.1"},{"type":"theme","slug":"unnamed-se","name":"Unnamed SE","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2007-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:360cba3a-dfae-4b1c-9b33-f531fb9b12e0","source":"wordfence","cve":"CVE-2022-3469","title":"WP Attachments <= 5.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360cba3a-dfae-4b1c-9b33-f531fb9b12e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachments","name":"WP Attachments \u2013 Smarter File Management & Download Lists","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:360fee18-5b5c-4aef-958b-915691e939bc","source":"wordfence","cve":"CVE-2025-47570","title":"WooCommerce Photo Reviews - Review Reminders - Review for Discounts <= 1.3.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/360fee18-5b5c-4aef-958b-915691e939bc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-photo-reviews","name":"WooCommerce Photo Reviews Premium","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T21:08:10Z"},{"id":"wordfence:3610644e-3481-4fed-a83c-cd9ce09775d2","source":"wordfence","cve":"CVE-2022-41695","title":"Traffic Manager <= 1.4.5 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3610644e-3481-4fed-a83c-cd9ce09775d2?source=api-prod","affected":[{"type":"plugin","slug":"traffic-manager","name":"Traffic Manager","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:361216af-b939-4ac1-ae06-97552d283670","source":"wordfence","cve":"CVE-2023-41668","title":"Leadster <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/361216af-b939-4ac1-ae06-97552d283670?source=api-prod","affected":[{"type":"plugin","slug":"leadster-marketing-conversacional","name":"Leadster","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36123fad-448e-4fdb-a076-5280b53d9671","source":"wordfence","cve":"CVE-2024-32126","title":"Navigation menu as Dropdown Widget <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36123fad-448e-4fdb-a076-5280b53d9671?source=api-prod","affected":[{"type":"plugin","slug":"navigation-menu-as-dropdown-widget","name":"Navigation menu as Dropdown Widget","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T13:06:12Z"},{"id":"wordfence:36129b06-b91d-4468-8566-1be0fb1d34b4","source":"wordfence","cve":"CVE-2025-8942","title":"WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36129b06-b91d-4468-8566-1be0fb1d34b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-08-28T00:00:00Z","updated":"2025-09-25T19:54:40Z"},{"id":"wordfence:361315ff-99ef-4fb2-946f-8ccc307bd3be","source":"wordfence","cve":"CVE-2021-43138","title":"async <= 2.6.3 and 3-3.2.2 - Prototype Pollution","severity":"high","cvss":7.8,"cwe":"CWE-915","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/361315ff-99ef-4fb2-946f-8ccc307bd3be?source=api-prod","affected":[{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3613c0ce-ac77-4fdc-8e3a-830b45ef6390","source":"wordfence","cve":"CVE-2024-37218","title":"Page Builder Sandwich \u2013 Front-End Page Builder <= 5.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3613c0ce-ac77-4fdc-8e3a-830b45ef6390?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-sandwich","name":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:48:17Z"},{"id":"wordfence:361deac0-f675-432c-b7d2-b99f168d476d","source":"wordfence","cve":"CVE-2023-47759","title":"Chaty <= 3.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/361deac0-f675-432c-b7d2-b99f168d476d?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:361e2d5c-4355-4e71-91aa-2c1bc6b6fb78","source":"wordfence","cve":"CVE-2022-3126","title":"Frontend File Manager Plugin <= 21.2 - Cross-Site Request Forgery to File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/361e2d5c-4355-4e71-91aa-2c1bc6b6fb78?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"21.2","to_inclusive":true,"patched_in":"21.3"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:361f3fec-7176-4a25-943b-44a44dd77784","source":"wordfence","cve":"CVE-2015-9333","title":"cformsII < 14.6.10 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/361f3fec-7176-4a25-943b-44a44dd77784?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"14.6.10","to_inclusive":false,"patched_in":"14.6.10"}],"published":"2015-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3621801a-231b-4678-bfb5-fbf18e58a658","source":"wordfence","cve":"","title":"WP External Links < 1.81 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3621801a-231b-4678-bfb5-fbf18e58a658?source=api-prod","affected":[{"type":"plugin","slug":"wp-external-links","name":"External Links \u2013 nofollow, noopener & new window","from":"*","from_inclusive":true,"to":"1.81","to_inclusive":false,"patched_in":"1.81"}],"published":"2016-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3622f58c-6c28-4c47-a5d5-a7274cfa69a9","source":"wordfence","cve":"CVE-2025-32243","title":"Internal Link Optimiser <= 5.1.2 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3622f58c-6c28-4c47-a5d5-a7274cfa69a9?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-finder","name":"Website Internal Link Optimiser","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:50:01Z"},{"id":"wordfence:36231136-58ec-4a6d-8cfc-d3d69c31037d","source":"wordfence","cve":"CVE-2025-10301","title":"FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36231136-58ec-4a6d-8cfc-d3d69c31037d?source=api-prod","affected":[{"type":"plugin","slug":"funkitools","name":"FunKItools","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:45:20Z","updated":"2025-10-15T08:25:52Z"},{"id":"wordfence:3623713f-ad39-429c-890f-cd113efb905a","source":"wordfence","cve":"CVE-2025-9628","title":"The integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3623713f-ad39-429c-890f-cd113efb905a?source=api-prod","affected":[{"type":"plugin","slug":"leads-for-amo-crm","name":"The integration of the AMO.CRM","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T19:04:14Z","updated":"2025-09-11T07:24:51Z"},{"id":"wordfence:3623e004-b33f-4e28-b190-429eb3c2498d","source":"wordfence","cve":"CVE-2025-26772","title":"DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3623e004-b33f-4e28-b190-429eb3c2498d?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:01:52Z"},{"id":"wordfence:3623f84d-bc43-45de-ae4e-490279594143","source":"wordfence","cve":"CVE-2025-31822","title":"WP Simple HTML Sitemap <= 3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3623f84d-bc43-45de-ae4e-490279594143?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2025-04-01T00:00:00Z","updated":"2026-01-19T16:51:40Z"},{"id":"wordfence:3624708c-b0da-4177-a8e8-cf5f5c432f97","source":"wordfence","cve":"","title":"WP Debugging <= 2.11.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3624708c-b0da-4177-a8e8-cf5f5c432f97?source=api-prod","affected":[{"type":"plugin","slug":"wp-debugging","name":"WP Debugging","from":"*","from_inclusive":true,"to":"2.11.7","to_inclusive":true,"patched_in":"2.11.8"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3624f8d7-1dcd-46df-8d9f-b51bb09719f2","source":"wordfence","cve":"CVE-2026-39641","title":"Blackfyre <= 2.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3624f8d7-1dcd-46df-8d9f-b51bb09719f2?source=api-prod","affected":[{"type":"theme","slug":"blackfyre","name":"Blackfyre - Create Your Own Gaming Community","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-05T15:37:09Z"},{"id":"wordfence:3628032a-3121-45a7-8a78-cfcd8ba6af2f","source":"wordfence","cve":"CVE-2026-19598","title":"Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router","severity":"critical","cvss":9.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3628032a-3121-45a7-8a78-cfcd8ba6af2f?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.8","from_inclusive":true,"to":"2.8.23.3","to_inclusive":true,"patched_in":"2.8.23.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.9","from_inclusive":true,"to":"2.9.19.3","to_inclusive":true,"patched_in":"2.8.23.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.0","from_inclusive":true,"to":"3.0.10.3","to_inclusive":true,"patched_in":"2.8.23.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.1","from_inclusive":true,"to":"3.1.4.1","to_inclusive":true,"patched_in":"2.8.23.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.2","from_inclusive":true,"to":"3.2.8.2","to_inclusive":true,"patched_in":"2.8.23.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.3","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"2.8.23.4"}],"published":"2026-08-15T04:54:21Z","updated":"2026-08-17T04:53:46Z"},{"id":"wordfence:362a01c0-8b97-40dc-8af5-0d904da96576","source":"wordfence","cve":"CVE-2025-3457","title":"Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/362a01c0-8b97-40dc-8af5-0d904da96576?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-22T11:12:30Z"},{"id":"wordfence:362fcd02-73c3-413b-8076-694c4d55544d","source":"wordfence","cve":"CVE-2011-3863","title":"RedLine < 1.66 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/362fcd02-73c3-413b-8076-694c4d55544d?source=api-prod","affected":[{"type":"theme","slug":"redline","name":"RedLine","from":"*","from_inclusive":true,"to":"1.66","to_inclusive":false,"patched_in":"1.66"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36304098-fea7-4e67-a138-5670761c6338","source":"wordfence","cve":"CVE-2021-36901","title":"Age Gate <= 2.17.0 - Cross-Site Scripting via Data Import","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36304098-fea7-4e67-a138-5670761c6338?source=api-prod","affected":[{"type":"plugin","slug":"age-gate","name":"Age Gate","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.17.1"}],"published":"2022-06-10T08:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36310ab1-f84e-4154-b782-51254c476d79","source":"wordfence","cve":"CVE-2026-7650","title":"E2Pdf \u2013 Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36310ab1-f84e-4154-b782-51254c476d79?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.17","to_inclusive":true,"patched_in":"1.32.18"}],"published":"2026-05-07T20:45:06Z","updated":"2026-05-08T09:26:53Z"},{"id":"wordfence:3636e6e0-292c-44c6-b2cb-5a333e910b7a","source":"wordfence","cve":"CVE-2025-69128","title":"JobCareer <= 7.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3636e6e0-292c-44c6-b2cb-5a333e910b7a?source=api-prod","affected":[{"type":"theme","slug":"jobcareer","name":"JobCareer","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:20:57Z"},{"id":"wordfence:3639d0a6-6d9f-4f3e-bb25-85d4eb40b547","source":"wordfence","cve":"CVE-2024-24803","title":"Ultra Companion <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3639d0a6-6d9f-4f3e-bb25-85d4eb40b547?source=api-prod","affected":[{"type":"plugin","slug":"ultra-companion","name":"Ultra Companion \u2013 Companion plugin for WPoperation Themes","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-04-16T21:06:49Z"},{"id":"wordfence:363abb15-2169-41c1-87cb-7f3e90cea394","source":"wordfence","cve":"CVE-2025-23836","title":"Custom Coming Soon <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/363abb15-2169-41c1-87cb-7f3e90cea394?source=api-prod","affected":[{"type":"plugin","slug":"custom-coming-soon","name":"Custom Coming Soon","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:15:51Z"},{"id":"wordfence:363ece80-1fa6-4019-84c9-e0a65f02625d","source":"wordfence","cve":"CVE-2023-1806","title":"WP Inventory Manager <= 2.1.0.11 - Reflected Cross-Site Scripting via 'message'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/363ece80-1fa6-4019-84c9-e0a65f02625d?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.1.0.11","to_inclusive":true,"patched_in":"2.1.0.12"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36409b31-be48-455e-b591-cda8bd84214e","source":"wordfence","cve":"CVE-2025-39576","title":"WPAdverts <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36409b31-be48-455e-b591-cda8bd84214e?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:27:07Z"},{"id":"wordfence:3643c741-559b-438b-9a39-518b9a6dfbf4","source":"wordfence","cve":"CVE-2025-5240","title":"CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3643c741-559b-438b-9a39-518b9a6dfbf4?source=api-prod","affected":[{"type":"plugin","slug":"crm-customer-relationship-management-by-vcita","name":"CRM and Lead Management by vcita","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-07-21T11:35:18Z","updated":"2025-07-22T01:44:27Z"},{"id":"wordfence:364804a5-8699-46be-b25e-890a10134a25","source":"wordfence","cve":"","title":"WP Statistics < 9.4.1 - Authenticated Blind SQL Injection","severity":"high","cvss":8.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364804a5-8699-46be-b25e-890a10134a25?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"9.4.1","to_inclusive":false,"patched_in":"9.4.1"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:364946a5-ce1e-4872-895d-e7cf795a04f7","source":"wordfence","cve":"CVE-2023-49766","title":"Ultimate Addons for Contact Form 7 <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364946a5-ce1e-4872-895d-e7cf795a04f7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:364a9a12-d6d4-4461-b45f-cf7d6ea815ac","source":"wordfence","cve":"","title":"Reality | Estate Multipurpose WordPress Theme <= 2.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364a9a12-d6d4-4461-b45f-cf7d6ea815ac?source=api-prod","affected":[{"type":"theme","slug":"reality","name":"Reality | Estate Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2020-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:364b3501-3cfd-4ef1-b3ed-34428174b30d","source":"wordfence","cve":"CVE-2025-27356","title":"Sticky Header On Scroll <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364b3501-3cfd-4ef1-b3ed-34428174b30d?source=api-prod","affected":[{"type":"plugin","slug":"sticky-header-on-scroll","name":"Sticky Header On Scroll","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:23:03Z"},{"id":"wordfence:364c8488-dab2-46bd-84b6-adfa59e2b013","source":"wordfence","cve":"CVE-2024-32563","title":"VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364c8488-dab2-46bd-84b6-adfa59e2b013?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:07:23Z"},{"id":"wordfence:364d6bd8-cdb8-4c99-b610-ba9a3125909e","source":"wordfence","cve":"CVE-2025-12410","title":"SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364d6bd8-cdb8-4c99-b610-ba9a3125909e?source=api-prod","affected":[{"type":"plugin","slug":"sh-contextual-help","name":"SH Contextual Help","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:38:25Z","updated":"2025-11-04T04:27:15Z"},{"id":"wordfence:364f5b87-76c7-421e-80b9-ee0ee0241d17","source":"wordfence","cve":"CVE-2025-50025","title":"CP Polls <= 1.0.81 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364f5b87-76c7-421e-80b9-ee0ee0241d17?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.81","to_inclusive":true,"patched_in":"1.0.82"}],"published":"2025-06-19T00:00:00Z","updated":"2026-01-07T14:48:31Z"},{"id":"wordfence:364fe5b3-561e-4005-a589-c7c2b9e85b99","source":"wordfence","cve":"CVE-2023-1650","title":"ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/364fe5b3-561e-4005-a589-c7c2b9e85b99?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36510335-df4c-473d-8091-ba7e070525bf","source":"wordfence","cve":"CVE-2024-54231","title":"Ni WooCommerce Order Export <= 3.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36510335-df4c-473d-8091-ba7e070525bf?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-order-export","name":"Ni WooCommerce Order Export","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:44:30Z"},{"id":"wordfence:3657384e-025a-44ad-8b7e-1a2fea17dcc3","source":"wordfence","cve":"CVE-2024-3974","title":"BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3657384e-025a-44ad-8b7e-1a2fea17dcc3?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"12.4.0","to_inclusive":true,"patched_in":"12.4.1"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:23Z"},{"id":"wordfence:365808af-5ed1-4265-88bd-ca8a49bdf424","source":"wordfence","cve":"CVE-2024-31103","title":"Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365808af-5ed1-4265-88bd-ca8a49bdf424?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.21","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:44:41Z"},{"id":"wordfence:3658ed5e-d5a9-44bb-99b8-ef86c5527288","source":"wordfence","cve":"CVE-2026-87843","title":"Trust Payments Gateway for WooCommerce < 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3658ed5e-d5a9-44bb-99b8-ef86c5527288?source=api-prod","affected":[{"type":"plugin","slug":"trust-payments-hosted-payment-pages-integration","name":"Trust Payments Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:21:45Z"},{"id":"wordfence:365b90dc-b9a1-4e04-9546-860f057f29f8","source":"wordfence","cve":"CVE-2024-35634","title":"Woocommerce \u2013 Recent Purchases <= 1.0.1 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365b90dc-b9a1-4e04-9546-860f057f29f8?source=api-prod","affected":[{"type":"plugin","slug":"woo-recent-purchases","name":"Woocommerce \u2013 Recent Purchases","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-05T13:40:35Z"},{"id":"wordfence:365d4470-1fad-455f-827b-59c5cab2852a","source":"wordfence","cve":"CVE-2026-24958","title":"JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365d4470-1fad-455f-827b-59c5cab2852a?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.12.2","to_inclusive":true,"patched_in":"2.7.12.3"}],"published":"2025-12-30T05:20:36Z","updated":"2026-02-09T22:17:00Z"},{"id":"wordfence:365ec9c9-7bf4-4e5c-953e-58e3a7150cdb","source":"wordfence","cve":"CVE-2017-20054","title":"Contact Form Manager <= 1.4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365ec9c9-7bf4-4e5c-953e-58e3a7150cdb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-manager","name":"Contact Form Manager","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:365f29d5-600e-42f9-b561-8d9b93dbfd87","source":"wordfence","cve":"CVE-2025-68084","title":"Ultimate Auction <= 4.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365f29d5-600e-42f9-b561-8d9b93dbfd87?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T00:00:00Z","updated":"2026-10-13T12:02:13Z"},{"id":"wordfence:365fce53-223b-48d3-bfb6-151b74218875","source":"wordfence","cve":"CVE-2025-27263","title":"Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/365fce53-223b-48d3-bfb6-151b74218875?source=api-prod","affected":[{"type":"plugin","slug":"doctor-appointment-booking","name":"Doctor Appointment Booking","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:45:43Z"},{"id":"wordfence:36615cae-418f-48b0-ba69-b54515cbe1d7","source":"wordfence","cve":"CVE-2026-4031","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36615cae-418f-48b0-ba69-b54515cbe1d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-14T12:32:10Z"},{"id":"wordfence:366165fe-93e5-49ab-b2e5-1de624f22286","source":"wordfence","cve":"CVE-2023-6882","title":"Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366165fe-93e5-49ab-b2e5-1de624f22286?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"4.3.9"}],"published":"2023-12-18T00:00:00Z","updated":"2024-07-29T21:36:10Z"},{"id":"wordfence:36629099-eb8d-4ddb-ba85-e1506262e245","source":"wordfence","cve":"CVE-2026-22402","title":"Triply <= 2.4.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36629099-eb8d-4ddb-ba85-e1506262e245?source=api-prod","affected":[{"type":"theme","slug":"triply","name":"Triply - Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:22:25Z"},{"id":"wordfence:3663b35d-13ac-4d65-80bd-5800ed74f759","source":"wordfence","cve":"CVE-2023-32575","title":"Product page shipping calculator for WooCommerce <= 1.3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3663b35d-13ac-4d65-80bd-5800ed74f759?source=api-prod","affected":[{"type":"plugin","slug":"product-page-shipping-calculator-for-woocommerce","name":"Product page shipping calculator for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.25","to_inclusive":true,"patched_in":"1.3.26"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3666a841-711d-4ecf-bb77-f2db4d5817ea","source":"wordfence","cve":"CVE-2023-52199","title":"ActivityPub <= 1.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3666a841-711d-4ecf-bb77-f2db4d5817ea?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:366b5051-d042-4425-9aad-b77d93bcd485","source":"wordfence","cve":"CVE-2026-7534","title":"SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366b5051-d042-4425-9aad-b77d93bcd485?source=api-prod","affected":[{"type":"plugin","slug":"rewardsystem","name":"SUMO Reward Points for WooCommerce","from":"*","from_inclusive":true,"to":"32.7.0","to_inclusive":true,"patched_in":"32.8.0"}],"published":"2026-07-22T17:27:19Z","updated":"2026-07-23T05:35:53Z"},{"id":"wordfence:366dfbf1-870c-4ce3-abc4-a2b2f4e72175","source":"wordfence","cve":"CVE-2025-0521","title":"Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366dfbf1-870c-4ce3-abc4-a2b2f4e72175?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-02-17T22:24:21Z","updated":"2025-02-18T11:10:20Z"},{"id":"wordfence:366e20df-4cb2-4ba1-93fd-11552faa1a32","source":"wordfence","cve":"CVE-2026-104010","title":"WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366e20df-4cb2-4ba1-93fd-11552faa1a32?source=api-prod","affected":[{"type":"plugin","slug":"contactsheets-lite","name":"WPSyncSheets For Contact Form 7 \u2013 CF7 Google Sheets Connector & Save to Database","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-11-05T22:08:55Z","updated":"2026-11-06T11:17:36Z"},{"id":"wordfence:366e5302-3edc-4bc8-8d84-9e0ee7abb25a","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Content Spoofing","severity":"critical","cvss":9.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366e5302-3edc-4bc8-8d84-9e0ee7abb25a?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:366ff716-e325-48e2-8fbd-ad4edbdaf9eb","source":"wordfence","cve":"CVE-2026-25392","title":"Update URLs \u2013 Quick and Easy way to search old links and replace them with new links in WordPress <= 1.4.1 - Unauthenticated Open Redirect","severity":"medium","cvss":5.8,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/366ff716-e325-48e2-8fbd-ad4edbdaf9eb?source=api-prod","affected":[{"type":"plugin","slug":"update-urls","name":"Search & Replace Everything \u2013 Quick and Easy Way to Find and Replace Text, Links","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-30T00:00:00Z","updated":"2026-05-04T15:30:39Z"},{"id":"wordfence:3670665c-0ae1-47d6-b463-581eb195666e","source":"wordfence","cve":"CVE-2023-25987","title":"My YouTube Channel <= 3.23.3 - Cross-Site Request Forgery to Cache Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3670665c-0ae1-47d6-b463-581eb195666e?source=api-prod","affected":[{"type":"plugin","slug":"youtube-channel","name":"My YouTube Channel","from":"*","from_inclusive":true,"to":"3.23.3","to_inclusive":true,"patched_in":"3.23.4"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3670e2aa-6d8e-4ba5-ab65-49bd2a3dcacc","source":"wordfence","cve":"CVE-2026-126537","title":"Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3670e2aa-6d8e-4ba5-ab65-49bd2a3dcacc?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.36","to_inclusive":true,"patched_in":"3.3.37"}],"published":"2026-11-11T00:01:15Z","updated":"2026-11-11T12:34:45Z"},{"id":"wordfence:36724ac4-330d-4614-b30c-b1e2e6d6b8a9","source":"wordfence","cve":"CVE-2025-58691","title":"Genesis Club Lite <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36724ac4-330d-4614-b30c-b1e2e6d6b8a9?source=api-prod","affected":[{"type":"plugin","slug":"genesis-club-lite","name":"Genesis Club Lite","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:53:49Z"},{"id":"wordfence:3673560a-6f72-42ea-8b0d-f866dca33638","source":"wordfence","cve":"CVE-2026-104740","title":"If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3673560a-6f72-42ea-8b0d-f866dca33638?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-10-27T17:39:35Z","updated":"2026-10-28T06:45:10Z"},{"id":"wordfence:3673a86c-1e11-45ad-8944-84a38aad53dd","source":"wordfence","cve":"CVE-2023-47181","title":"IdeaPush <= 8.52 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3673a86c-1e11-45ad-8944-84a38aad53dd?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.52","to_inclusive":true,"patched_in":"8.53"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3673e8d6-599b-4d2b-8a5d-9fb14316ce75","source":"wordfence","cve":"CVE-2026-105058","title":"WP User Profiles <= 2.7.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3673e8d6-599b-4d2b-8a5d-9fb14316ce75?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profiles","name":"WP User Profiles","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2026-10-05T10:28:35Z","updated":"2026-10-08T23:14:06Z"},{"id":"wordfence:36741b46-57ac-402e-bfb1-8424c7e70598","source":"wordfence","cve":"CVE-2023-25019","title":"Chaty <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36741b46-57ac-402e-bfb1-8424c7e70598?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36742d6b-3cd5-4e12-86b5-0d3f361372ea","source":"wordfence","cve":"CVE-2025-30989","title":"Libro de Reclamaciones y Quejas <= 0.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36742d6b-3cd5-4e12-86b5-0d3f361372ea?source=api-prod","affected":[{"type":"plugin","slug":"libro-de-reclamaciones-y-quejas","name":"Libro de Reclamaciones y Quejas","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":"1.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:40:02Z"},{"id":"wordfence:3674a90a-9844-40bd-a75d-3fed36dbc7cd","source":"wordfence","cve":"CVE-2024-56210","title":"Userpro <= 5.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3674a90a-9844-40bd-a75d-3fed36dbc7cd?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:11:11Z"},{"id":"wordfence:3674cfb8-6372-4309-a9de-e6ef7c0b3836","source":"wordfence","cve":"CVE-2024-12575","title":"Poll Maker \u2013 Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3674cfb8-6372-4309-a9de-e6ef7c0b3836?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.8.9","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T02:24:35Z"},{"id":"wordfence:36759c8a-351b-448c-a79e-05465e99b4c2","source":"wordfence","cve":"CVE-2022-4478","title":"Font Awesome <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36759c8a-351b-448c-a79e-05465e99b4c2?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome","name":"Font Awesome","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36777e39-be45-41f2-beca-2971e15b77cd","source":"wordfence","cve":"CVE-2024-11582","title":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36777e39-be45-41f2-beca-2971e15b77cd?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.43","to_inclusive":true,"patched_in":"10.44"}],"published":"2025-02-18T15:02:03Z","updated":"2025-02-19T03:21:12Z"},{"id":"wordfence:367a6589-5b71-44bf-9483-7da6e3e82b70","source":"wordfence","cve":"CVE-2026-66481","title":"Presto Player Pro <= 3.0.1 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/367a6589-5b71-44bf-9483-7da6e3e82b70?source=api-prod","affected":[{"type":"plugin","slug":"presto-player-pro","name":"Presto Player Pro","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:23:38Z"},{"id":"wordfence:367a7796-b94b-4239-894f-01bf71cdeed9","source":"wordfence","cve":"CVE-2024-44027","title":"Gum Elementor Addon <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/367a7796-b94b-4239-894f-01bf71cdeed9?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:23:10Z"},{"id":"wordfence:367ae1ab-fac7-4e17-9a00-0ea167291792","source":"wordfence","cve":"CVE-2026-78364","title":"MW WP Form < 5.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/367ae1ab-fac7-4e17-9a00-0ea167291792?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":false,"patched_in":"5.1.6"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:52:13Z"},{"id":"wordfence:367bb24c-ba88-4809-a620-759d3c8dcd38","source":"wordfence","cve":"CVE-2024-56011","title":"Responsive Google Maps | by imbaa <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/367bb24c-ba88-4809-a620-759d3c8dcd38?source=api-prod","affected":[{"type":"plugin","slug":"responsive-google-maps","name":"Responsive Google Maps | by imbaa","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:04:55Z"},{"id":"wordfence:368001e9-3806-41d5-902e-0facf7fb31ff","source":"wordfence","cve":"CVE-2026-102173","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368001e9-3806-41d5-902e-0facf7fb31ff?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-10-06T16:28:09Z","updated":"2026-10-07T05:30:41Z"},{"id":"wordfence:36806418-ae4e-4981-b9c5-dadb5e92e69a","source":"wordfence","cve":"CVE-2023-3372","title":"Lana Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36806418-ae4e-4981-b9c5-dadb5e92e69a?source=api-prod","affected":[{"type":"plugin","slug":"lana-shortcodes","name":"Lana Shortcodes","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3681a51f-89a3-4d6a-a292-25e3f0c4b546","source":"wordfence","cve":"CVE-2026-65568","title":"Visual Composer Website Builder <= 45.15.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3681a51f-89a3-4d6a-a292-25e3f0c4b546?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.15.0","to_inclusive":true,"patched_in":"45.16.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:35:51Z"},{"id":"wordfence:3681eb1a-df1e-4f30-99e0-0ff05664550c","source":"wordfence","cve":"CVE-2025-49431","title":"MF Plus WPML <= 1.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3681eb1a-df1e-4f30-99e0-0ff05664550c?source=api-prod","affected":[{"type":"plugin","slug":"mf-plus-wpml","name":"MF Plus WPML","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:12:39Z"},{"id":"wordfence:3687a5ad-4666-49a5-8273-4159ec15756f","source":"wordfence","cve":"CVE-2025-32562","title":"WP Easy Poll <= 2.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3687a5ad-4666-49a5-8273-4159ec15756f?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-poll-afo","name":"WP Easy Poll","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:07:53Z"},{"id":"wordfence:368a3911-1d29-4378-aa6e-8a6ed54bbe0f","source":"wordfence","cve":"CVE-2024-4606","title":"Ultimate Store Kit Elementor Addons <= 2.0.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368a3911-1d29-4378-aa6e-8a6ed54bbe0f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-05-07T00:00:00Z","updated":"2024-08-29T21:54:49Z"},{"id":"wordfence:368bc607-42b4-49fc-90b1-0ca427cdda4a","source":"wordfence","cve":"CVE-2025-52820","title":"WooCommerce Point Of Sale (POS) <= 1.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368bc607-42b4-49fc-90b1-0ca427cdda4a?source=api-prod","affected":[{"type":"plugin","slug":"woo-point-of-salepos","name":"WooCommerce Point Of Sale (POS)","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-24T00:00:00Z","updated":"2025-07-28T20:36:35Z"},{"id":"wordfence:368bf2b9-3c9e-4da9-8651-bef856981604","source":"wordfence","cve":"CVE-2025-54002","title":"xSmart <= 1.2.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368bf2b9-3c9e-4da9-8651-bef856981604?source=api-prod","affected":[{"type":"theme","slug":"xsmart","name":"xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency","from":"*","from_inclusive":true,"to":"1.2.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:00:01Z"},{"id":"wordfence:368c2c5d-0618-4c32-ad43-71fd742126d0","source":"wordfence","cve":"CVE-2026-39594","title":"Ultra Addons for WPForms <= 1.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368c2c5d-0618-4c32-ad43-71fd742126d0?source=api-prod","affected":[{"type":"plugin","slug":"ultra-addons-for-wpforms","name":"Ultra Addons for WPForms","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:00:20Z"},{"id":"wordfence:368cff00-6a86-443e-aec4-4115a229a3c1","source":"wordfence","cve":"CVE-2026-7641","title":"Import and export users and customers <= 2.0.8 - Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/368cff00-6a86-443e-aec4-4115a229a3c1?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-05-01T16:14:05Z","updated":"2026-05-02T04:27:46Z"},{"id":"wordfence:36928dfa-40d7-41a5-9f7a-90914fe902df","source":"wordfence","cve":"CVE-2026-119032","title":"Schema & Structured Data for WP & AMP < 1.70 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36928dfa-40d7-41a5-9f7a-90914fe902df?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.70","to_inclusive":false,"patched_in":"1.70"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:13Z"},{"id":"wordfence:36933547-2159-43f4-842d-750ff9e7b1dd","source":"wordfence","cve":"CVE-2025-30609","title":"AppExperts <= 1.4.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36933547-2159-43f4-842d-750ff9e7b1dd?source=api-prod","affected":[{"type":"plugin","slug":"appexperts","name":"APPExperts \u2013 Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-30T18:17:24Z"},{"id":"wordfence:3698176e-1b0a-4864-a233-e920b6b326f0","source":"wordfence","cve":"CVE-2025-24692","title":"Bulk Menu Edit <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3698176e-1b0a-4864-a233-e920b6b326f0?source=api-prod","affected":[{"type":"plugin","slug":"bulk-menu-edit","name":"Bulk Menu Edit","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-01-29T00:00:00Z","updated":"2025-02-26T21:30:29Z"},{"id":"wordfence:36986585-7aaa-4c49-b426-fb9078fbb9ae","source":"wordfence","cve":"CVE-2024-10581","title":"DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36986585-7aaa-4c49-b426-fb9078fbb9ae?source=api-prod","affected":[{"type":"plugin","slug":"directorypress-frontend","name":"DirectoryPress Frontend","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-15T11:26:48Z"},{"id":"wordfence:369cd6ca-bb36-479e-b342-36d2ca778ce1","source":"wordfence","cve":"CVE-2026-2290","title":"Post Affiliate Pro <= 1.29.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field","severity":"low","cvss":3.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/369cd6ca-bb36-479e-b342-36d2ca778ce1?source=api-prod","affected":[{"type":"plugin","slug":"postaffiliatepro","name":"Post Affiliate Pro","from":"*","from_inclusive":true,"to":"1.29.0","to_inclusive":true,"patched_in":"1.29.1"}],"published":"2026-03-20T15:20:43Z","updated":"2026-09-18T19:21:37Z"},{"id":"wordfence:36a01fa7-39a6-4d33-9c6e-1c76756f02cf","source":"wordfence","cve":"CVE-2024-51790","title":"HB AUDIO GALLERY <= 3.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36a01fa7-39a6-4d33-9c6e-1c76756f02cf?source=api-prod","affected":[{"type":"plugin","slug":"hb-audio-gallery","name":"HB AUDIO GALLERY","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T19:28:28Z"},{"id":"wordfence:36a434ba-0ae8-4220-9d63-a2e7d1ea3cf9","source":"wordfence","cve":"CVE-2026-110026","title":"Tasty Recipes Lite 1.2 - 1.2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36a434ba-0ae8-4220-9d63-a2e7d1ea3cf9?source=api-prod","affected":[{"type":"plugin","slug":"tasty-recipes-lite","name":"Tasty Recipes Lite \u2013 WordPress Recipe Card Plugin with Built-In Recipe Schema","from":"1.2","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:15:34Z"},{"id":"wordfence:36a43b08-872e-4760-a319-67e30fd004a2","source":"wordfence","cve":"CVE-2023-27607","title":"Points and Rewards for WooCommerce <= 1.5.0 - Cross-Site Request Forgery to Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36a43b08-872e-4760-a319-67e30fd004a2?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36a7b681-6059-46a4-82a8-addfb8f452cc","source":"wordfence","cve":"CVE-2022-0693","title":"Master Elements <= 8.0 - Unauthenticated SQL injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36a7b681-6059-46a4-82a8-addfb8f452cc?source=api-prod","affected":[{"type":"plugin","slug":"master-elements","name":"Master Elements","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36aa7193-0e31-4084-97d0-8c22ebff3f05","source":"wordfence","cve":"CVE-2026-12998","title":"Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36aa7193-0e31-4084-97d0-8c22ebff3f05?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.55.0.2","to_inclusive":true,"patched_in":"1.55.1"}],"published":"2026-08-15T17:34:53Z","updated":"2026-08-16T06:38:07Z"},{"id":"wordfence:36aaae54-5d26-4222-8511-d1eef6d8d0fe","source":"wordfence","cve":"CVE-2024-13329","title":"Solidres <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36aaae54-5d26-4222-8511-d1eef6d8d0fe?source=api-prod","affected":[{"type":"plugin","slug":"solidres","name":"Solidres \u2013 Hotel booking plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:21:12Z"},{"id":"wordfence:36abba4d-9a73-4ef2-a910-6030acddd182","source":"wordfence","cve":"CVE-2022-0165","title":"Page Builder KingComposer <= 2.9.6 - Open Redirect","severity":"high","cvss":8.8,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36abba4d-9a73-4ef2-a910-6030acddd182?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36abd7e9-0ca4-4c22-ab13-08f2632a6797","source":"wordfence","cve":"CVE-2024-1660","title":"Top Bar  <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36abd7e9-0ca4-4c22-ab13-08f2632a6797?source=api-prod","affected":[{"type":"plugin","slug":"top-bar","name":"Top Bar","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-03-25T00:00:00Z","updated":"2026-09-04T17:17:25Z"},{"id":"wordfence:36ad02c5-3272-4ccd-af62-dc267f3b574f","source":"wordfence","cve":"CVE-2026-87842","title":"Zonify \u2013 Amazon Product Importer for WooCommerce < 1.0.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ad02c5-3272-4ccd-af62-dc267f3b574f?source=api-prod","affected":[{"type":"plugin","slug":"zonify","name":"Zonify \u2013 Amazon Product Importer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:56:07Z"},{"id":"wordfence:36ad7fe2-0dc9-427d-811b-8fb1fdb78579","source":"wordfence","cve":"CVE-2023-52182","title":"ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ad7fe2-0dc9-427d-811b-8fb1fdb78579?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36ae359b-7694-4e8b-9fe6-5e9e40345305","source":"wordfence","cve":"","title":"WooCommerce Product Table Lite <= 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ae359b-7694-4e8b-9fe6-5e9e40345305?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36ae4183-5fa7-484c-b858-5df10ae3d3f2","source":"wordfence","cve":"CVE-2020-36838","title":"Facebook Chat Plugin <= 1.5 - Missing Capabilities Check","severity":"high","cvss":7.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ae4183-5fa7-484c-b858-5df10ae3d3f2?source=api-prod","affected":[{"type":"plugin","slug":"facebook-messenger-customer-chat","name":"Facebook Chat Plugin \u2013 Live Chat Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2020-08-04T00:00:00Z","updated":"2024-10-16T06:43:27Z"},{"id":"wordfence:36aecabd-4982-426d-be47-075c23a452a2","source":"wordfence","cve":"CVE-2014-1906","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36aecabd-4982-426d-be47-075c23a452a2?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.29.5","to_inclusive":false,"patched_in":"4.29.5"}],"published":"2014-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36b2992d-4d1b-456d-94a0-54794ba59435","source":"wordfence","cve":"CVE-2023-32499","title":"Radio Station <= 2.4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36b2992d-4d1b-456d-94a0-54794ba59435?source=api-prod","affected":[{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"*","from_inclusive":true,"to":"2.4.0.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36b51282-073a-4c75-a707-62e37cd878da","source":"wordfence","cve":"CVE-2026-66681","title":"Theme My Login <= 7.1.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36b51282-073a-4c75-a707-62e37cd878da?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.1.14","to_inclusive":true,"patched_in":"7.1.15"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:59:48Z"},{"id":"wordfence:36b58a4f-0761-4775-9010-9c77d4019c44","source":"wordfence","cve":"CVE-2024-6750","title":"Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:55Z"},{"id":"wordfence:36b5eb39-4edc-4f17-a764-d07f39114ef0","source":"wordfence","cve":"CVE-2025-23796","title":"Easy Portfolio <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36b5eb39-4edc-4f17-a764-d07f39114ef0?source=api-prod","affected":[{"type":"plugin","slug":"easy-portfolio","name":"Easy Portfolio","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:14:10Z"},{"id":"wordfence:36b71a50-270a-4960-bf31-e888df84e619","source":"wordfence","cve":"CVE-2022-4627","title":"ShiftNav \u2013 Responsive Mobile Menu <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36b71a50-270a-4960-bf31-e888df84e619?source=api-prod","affected":[{"type":"plugin","slug":"shiftnav-responsive-mobile-menu","name":"ShiftNav \u2013 Responsive Mobile Menu","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36ba23ea-7e79-4048-8030-7ed6b2ff45a6","source":"wordfence","cve":"CVE-2023-51375","title":"EmbedPress <= 3.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ba23ea-7e79-4048-8030-7ed6b2ff45a6?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":false,"patched_in":"3.8.4"}],"published":"2023-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36c3107d-f125-4715-999e-8862e4103313","source":"wordfence","cve":"CVE-2022-4761","title":"Post Views Count <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c3107d-f125-4715-999e-8862e4103313?source=api-prod","affected":[{"type":"plugin","slug":"baw-post-views-count","name":"Post Views Count (Support caching plugins!)","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36c32212-0d52-435e-bb6a-39ea07363a86","source":"wordfence","cve":"CVE-2021-24462","title":"Photo Gallery by Ays - Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c32212-0d52-435e-bb6a-39ea07363a86?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":false,"patched_in":"4.4.4"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36c377cc-4169-4f9d-960f-518f7c4191d7","source":"wordfence","cve":"CVE-2026-39603","title":"Grand Photography <= 5.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c377cc-4169-4f9d-960f-518f7c4191d7?source=api-prod","affected":[{"type":"theme","slug":"grandphotography","name":"Grand Photography WordPress","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-01T00:00:00Z","updated":"2026-05-05T15:17:55Z"},{"id":"wordfence:36c6a116-37cc-4ade-b601-5f9d6aaf9217","source":"wordfence","cve":"CVE-2024-1862","title":"WooCommerce Add to Cart Custom Redirect <= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c6a116-37cc-4ade-b601-5f9d6aaf9217?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-add-to-cart-custom-redirect","name":"Add to Cart Custom Redirect for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2024-03-07T00:00:00Z","updated":"2024-07-31T15:34:42Z"},{"id":"wordfence:36c8d20c-c574-4f94-9b1e-6e8096ff8a70","source":"wordfence","cve":"CVE-2026-106468","title":"Code Snippets < 4.1.0 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c8d20c-c574-4f94-9b1e-6e8096ff8a70?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:45Z"},{"id":"wordfence:36c97e15-1935-4390-b742-d21bd7870dee","source":"wordfence","cve":"CVE-2025-67617","title":"Consult Aid <= 1.4.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36c97e15-1935-4390-b742-d21bd7870dee?source=api-prod","affected":[{"type":"theme","slug":"consultaid","name":"Consult Aid: Business Consulting And Finance PSD","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:18:15Z"},{"id":"wordfence:36ca4534-1abe-4f28-8672-f183c7578ab2","source":"wordfence","cve":"CVE-2023-23650","title":"MainWP Code Snippets Extension <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ca4534-1abe-4f28-8672-f183c7578ab2?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-code-snippets-extension","name":"MainWP Code Snippets Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36ccce3e-7d96-4a80-843e-041bc194812c","source":"wordfence","cve":"CVE-2026-56013","title":"License Manager for WooCommerce <= 3.0.15 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ccce3e-7d96-4a80-843e-041bc194812c?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":true,"patched_in":"3.0.16"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-25T13:21:32Z"},{"id":"wordfence:36cec19a-4631-4ada-b37a-f4b2dc264096","source":"wordfence","cve":"CVE-2023-4036","title":"Simple Blog Card <= 1.31 - Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36cec19a-4631-4ada-b37a-f4b2dc264096?source=api-prod","affected":[{"type":"plugin","slug":"simple-blog-card","name":"Simple Blog Card","from":"*","from_inclusive":true,"to":"1.32","to_inclusive":false,"patched_in":"1.32"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36cf102b-bff1-4516-9a76-030ddc98c207","source":"wordfence","cve":"CVE-2023-47655","title":"ANAC XML Bandi di Gara <= 7.5 - Cross-Site Request Forgery via settings.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36cf102b-bff1-4516-9a76-030ddc98c207?source=api-prod","affected":[{"type":"plugin","slug":"avcp","name":"ANAC XML Bandi di Gara","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2023-11-07T00:00:00Z","updated":"2025-05-29T19:29:41Z"},{"id":"wordfence:36d02d5f-d534-4567-9587-1f6e4b21ca90","source":"wordfence","cve":"CVE-2012-4921","title":"DVS Custom Notification <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d02d5f-d534-4567-9587-1f6e4b21ca90?source=api-prod","affected":[{"type":"plugin","slug":"dvs-custom-notification","name":"DVS Custom Notification","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2012-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36d17358-ae57-4c9c-a988-2c18c7c5e1b2","source":"wordfence","cve":"CVE-2026-16061","title":"Rest Routes \u2013 Custom Endpoints for WordPress REST API <= 5.5.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d17358-ae57-4c9c-a988-2c18c7c5e1b2?source=api-prod","affected":[{"type":"plugin","slug":"rest-routes","name":"Rest Routes \u2013 Custom Endpoints for WordPress REST API","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:31:27Z"},{"id":"wordfence:36d2d414-3798-441c-a5bc-4e0560499336","source":"wordfence","cve":"CVE-2024-7082","title":"Easy Table of Contents <= 2.0.67.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d2d414-3798-441c-a5bc-4e0560499336?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.67.1","to_inclusive":true,"patched_in":"2.0.68"}],"published":"2024-07-16T00:00:00Z","updated":"2024-09-10T17:11:01Z"},{"id":"wordfence:36d2fbbf-ea0e-4785-9b83-b642e59c713d","source":"wordfence","cve":"CVE-2024-32129","title":"Freshdesk (official) <= 2.3.6 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d2fbbf-ea0e-4785-9b83-b642e59c713d?source=api-prod","affected":[{"type":"plugin","slug":"freshdesk-support","name":"Freshdesk (official)","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-03T19:09:52Z"},{"id":"wordfence:36d37997-ac50-4d00-bc12-f3904483e15f","source":"wordfence","cve":"CVE-2018-20986","title":"Advanced Custom Fields <= 5.7.7 - Author+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d37997-ac50-4d00-bc12-f3904483e15f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":false,"patched_in":"5.7.8"}],"published":"2018-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36d3dae0-4705-487a-a4a4-c12280e866a3","source":"wordfence","cve":"CVE-2022-2357","title":"WSM Downloader <= 1.4.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d3dae0-4705-487a-a4a4-c12280e866a3?source=api-prod","affected":[{"type":"plugin","slug":"wsm-downloader","name":"WSM Downloader","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36d57b8d-7e62-413b-8ea9-87963b8cd469","source":"wordfence","cve":"CVE-2025-13859","title":"AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d57b8d-7e62-413b-8ea9-87963b8cd469?source=api-prod","affected":[{"type":"plugin","slug":"affiliatex","name":"AffiliateX \u2013 Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking","from":"1.0.0","from_inclusive":true,"to":"1.3.9.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-01-15T00:30:33Z","updated":"2026-01-15T13:23:26Z"},{"id":"wordfence:36d92fc7-8383-4dca-b672-db3b1916c07d","source":"wordfence","cve":"CVE-2025-69132","title":"Corpkit - Business Consulting WordPress Theme <= 1.0.5 - Authenticated (Subscriber+) Sensitive Information Exopsure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d92fc7-8383-4dca-b672-db3b1916c07d?source=api-prod","affected":[{"type":"theme","slug":"corpkit","name":"Corpkit - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:36:26Z"},{"id":"wordfence:36d9e9cd-7885-4127-b62c-ee0b3aad8846","source":"wordfence","cve":"CVE-2023-1377","title":"Solidres <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36d9e9cd-7885-4127-b62c-ee0b3aad8846?source=api-prod","affected":[{"type":"plugin","slug":"solidres","name":"Solidres \u2013 Hotel booking plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36dad8a1-07dc-46ea-84c7-ddfcfa88b9d0","source":"wordfence","cve":"CVE-2026-123467","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.128 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dad8a1-07dc-46ea-84c7-ddfcfa88b9d0?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.128","to_inclusive":true,"patched_in":"1.4.129"}],"published":"2026-11-07T12:40:00Z","updated":"2026-11-10T20:00:04Z"},{"id":"wordfence:36daf2af-1db3-4b35-8849-480212660b2f","source":"wordfence","cve":"CVE-2024-9935","title":"PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36daf2af-1db3-4b35-8849-480212660b2f?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-addon-for-elementor-page-builder","name":"PDF Generator for WordPress Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-11-15T15:00:29Z","updated":"2025-02-25T17:00:02Z"},{"id":"wordfence:36dbe59e-b368-42f1-b72b-54123de43434","source":"wordfence","cve":"CVE-2025-22751","title":"Partners <= 0.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dbe59e-b368-42f1-b72b-54123de43434?source=api-prod","affected":[{"type":"plugin","slug":"partners","name":"Partners","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:07:36Z"},{"id":"wordfence:36dcde20-0af2-4b8b-8637-9a070dffa8a1","source":"wordfence","cve":"CVE-2026-76010","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcde20-0af2-4b8b-8637-9a070dffa8a1?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-10-30T21:10:34Z","updated":"2026-10-31T09:29:25Z"},{"id":"wordfence:36dcf1c4-1e0a-4ab6-a1b3-a9fe3aaddd0b","source":"wordfence","cve":"CVE-2025-1757","title":"WordPress Portfolio Builder \u2013 Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dcf1c4-1e0a-4ab6-a1b3-a9fe3aaddd0b?source=api-prod","affected":[{"type":"plugin","slug":"uber-grid","name":"WordPress Portfolio Builder \u2013 Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:35:20Z","updated":"2025-02-28T04:21:57Z"},{"id":"wordfence:36dd9cbd-dac5-46a4-9593-1dce77ea731a","source":"wordfence","cve":"CVE-2025-58802","title":"TrustMate.io \u2013 WooCommerce integration <= 1.17.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dd9cbd-dac5-46a4-9593-1dce77ea731a?source=api-prod","affected":[{"type":"plugin","slug":"trustmate-io-integration-for-woocommerce","name":"TrustMate.io \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2025-09-05T00:00:00Z","updated":"2026-09-23T14:28:47Z"},{"id":"wordfence:36dea43a-ec72-4425-8ebb-933c79c87290","source":"wordfence","cve":"CVE-2026-97078","title":"Sprout Invoices \u2013 Client Invoicing & Estimates <= 20.8.17 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dea43a-ec72-4425-8ebb-933c79c87290?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.17","to_inclusive":true,"patched_in":"20.8.18"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:55:49Z"},{"id":"wordfence:36dec90a-fead-48f5-a88b-dfbc6d8bffb4","source":"wordfence","cve":"CVE-2022-51021","title":"NotificationX <= 2.3.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36dec90a-fead-48f5-a88b-dfbc6d8bffb4?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2022-02-28T00:00:00Z","updated":"2026-10-28T14:57:22Z"},{"id":"wordfence:36def628-e09e-4da0-ab14-35aefcb67f73","source":"wordfence","cve":"CVE-2024-1478","title":"Maintenance Mode <= 3.0.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36def628-e09e-4da0-ab14-35aefcb67f73?source=api-prod","affected":[{"type":"plugin","slug":"hkdev-maintenance-mode","name":"Maintenance Mode","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-28T23:30:13Z"},{"id":"wordfence:36e070de-bd77-48a4-a9c2-3938b144398a","source":"wordfence","cve":"CVE-2024-10895","title":"Counter Up \u2013 Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e070de-bd77-48a4-a9c2-3938b144398a?source=api-prod","affected":[{"type":"plugin","slug":"wp-counter-up","name":"WP Counter Up \u2013 Animated Number Counter & Milestone Showcase","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-11-26T18:29:11Z","updated":"2025-02-11T20:41:19Z"},{"id":"wordfence:36e098fe-d1f9-4c8f-ae6b-222cbd5976b2","source":"wordfence","cve":"CVE-2020-36743","title":"Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e098fe-d1f9-4c8f-ae6b-222cbd5976b2?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":false,"patched_in":"1.5.13"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36e15052-0e04-4b72-b573-b736109517b8","source":"wordfence","cve":"CVE-2020-28036","title":"WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e15052-0e04-4b72-b573-b736109517b8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36e83a33-63e7-4282-9b3c-282bd21830b7","source":"wordfence","cve":"CVE-2026-54196","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e83a33-63e7-4282-9b3c-282bd21830b7?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.1.1"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:35:34Z"},{"id":"wordfence:36e8a99e-47ae-4102-b056-624eca381161","source":"wordfence","cve":"CVE-2025-68051","title":"Shiprocket <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e8a99e-47ae-4102-b056-624eca381161?source=api-prod","affected":[{"type":"plugin","slug":"shiprocket","name":"Shiprocket","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T19:46:50Z"},{"id":"wordfence:36e9e069-b649-4824-9388-36d8cb9cae49","source":"wordfence","cve":"CVE-2025-23896","title":"Mindmeister Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36e9e069-b649-4824-9388-36d8cb9cae49?source=api-prod","affected":[{"type":"plugin","slug":"mindmeister-shortcode","name":"Mindmeister Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:00:43Z"},{"id":"wordfence:36eaff34-50cd-4399-8314-19ae4f50d017","source":"wordfence","cve":"CVE-2025-5932","title":"Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36eaff34-50cd-4399-8314-19ae4f50d017?source=api-prod","affected":[{"type":"plugin","slug":"homerunner-smartcheckout","name":"Homerunner","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":"1.0.31"}],"published":"2025-06-25T14:07:19Z","updated":"2025-08-22T15:31:29Z"},{"id":"wordfence:36ee4bf3-a4fd-44b1-95c3-0021543a0aa0","source":"wordfence","cve":"CVE-2026-81757","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ee4bf3-a4fd-44b1-95c3-0021543a0aa0?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.276","to_inclusive":true,"patched_in":"1.0.277"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:58:10Z"},{"id":"wordfence:36ef164e-33cc-41b1-8e28-d2af89739f04","source":"wordfence","cve":"CVE-2023-0428","title":"Watu Quiz <= 3.3.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ef164e-33cc-41b1-8e28-d2af89739f04?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.3.8.1","to_inclusive":true,"patched_in":"3.3.8.2"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36f060f4-842e-4d33-acb8-d9d3225140fd","source":"wordfence","cve":"CVE-2026-39779","title":"Asgaros Forum <= 3.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f060f4-842e-4d33-acb8-d9d3225140fd?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:26:43Z"},{"id":"wordfence:36f107cf-4b85-4016-b7af-b73a706cf1a6","source":"wordfence","cve":"CVE-2016-10112","title":"WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f107cf-4b85-4016-b7af-b73a706cf1a6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":false,"patched_in":"2.6.9"}],"published":"2016-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36f37875-69fe-41cb-a68d-ad73d53d1a83","source":"wordfence","cve":"CVE-2024-2889","title":"WP-Lister Lite for Amazon <= 2.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f37875-69fe-41cb-a68d-ad73d53d1a83?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-amazon","name":"WP-Lister Lite for Amazon","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":true,"patched_in":"2.6.12"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-01T16:24:03Z"},{"id":"wordfence:36f3bedb-afac-41a9-83b6-c2895cf13317","source":"wordfence","cve":"CVE-2025-60218","title":"PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f3bedb-afac-41a9-83b6-c2895cf13317?source=api-prod","affected":[{"type":"plugin","slug":"pt-luxa-addons","name":"PT Luxa Addons","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-10T00:00:00Z","updated":"2026-08-21T13:34:14Z"},{"id":"wordfence:36f3e9be-9a4e-458d-92b3-687afc44696a","source":"wordfence","cve":"CVE-2024-12249","title":"GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f3e9be-9a4e-458d-92b3-687afc44696a?source=api-prod","affected":[{"type":"plugin","slug":"gs-instagram-portfolio","name":"GS Insever Portfolio","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T21:59:50Z","updated":"2025-01-09T11:10:55Z"},{"id":"wordfence:36f41de5-50d5-47ca-bbd0-eca3b756a0cd","source":"wordfence","cve":"CVE-2023-35044","title":"Securimage-WP <= 3.6.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f41de5-50d5-47ca-bbd0-eca3b756a0cd?source=api-prod","affected":[{"type":"plugin","slug":"securimage-wp","name":"Securimage-WP","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":""}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36f4e51d-d613-4db6-8d79-d26398c3e5df","source":"wordfence","cve":"CVE-2016-1000153","title":"Tidio Gallery <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f4e51d-d613-4db6-8d79-d26398c3e5df?source=api-prod","affected":[{"type":"plugin","slug":"tidio-gallery","name":"Tidio Gallery","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36f61f62-daa9-4b1a-91fb-7b22a28d0eda","source":"wordfence","cve":"CVE-2024-6023","title":"ContentLock <= 1.0.3 - Cross-Site Request Forgery to Email Adding","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f61f62-daa9-4b1a-91fb-7b22a28d0eda?source=api-prod","affected":[{"type":"plugin","slug":"contentlock","name":"ContentLock","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-19T14:13:05Z"},{"id":"wordfence:36f7eb57-76ac-4130-abb3-6521f9d042ce","source":"wordfence","cve":"CVE-2022-45839","title":"WHA Puzzle <= 1.0.9 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f7eb57-76ac-4130-abb3-6521f9d042ce?source=api-prod","affected":[{"type":"plugin","slug":"wha-puzzle","name":"WHA Puzzle","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-11-24T00:00:00Z","updated":"2026-09-09T15:48:54Z"},{"id":"wordfence:36f84246-6658-407a-88dd-4b99a784e682","source":"wordfence","cve":"CVE-2026-111120","title":"VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36f84246-6658-407a-88dd-4b99a784e682?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-27T18:29:11Z","updated":"2026-10-28T06:45:10Z"},{"id":"wordfence:36fa1b11-911d-4235-b3b0-568b27f251c4","source":"wordfence","cve":"CVE-2025-24629","title":"Import Excel to Gravity Forms <= 1.18 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fa1b11-911d-4235-b3b0-568b27f251c4?source=api-prod","affected":[{"type":"plugin","slug":"gf-excel-import","name":"Import Excel to Gravity Forms","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.18.1"}],"published":"2025-01-20T00:00:00Z","updated":"2025-02-21T14:33:07Z"},{"id":"wordfence:36fa4540-68d9-474f-abfc-ad91af97a238","source":"wordfence","cve":"CVE-2025-28888","title":"GiftXtore <= 1.7.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fa4540-68d9-474f-abfc-ad91af97a238?source=api-prod","affected":[{"type":"theme","slug":"bw-giftxtore","name":"GiftXtore - Luxury Jewelry & Gift Store Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2025-06-09T00:00:00Z","updated":"2026-02-26T15:12:24Z"},{"id":"wordfence:36fa7191-a4a9-40a5-896e-18e16525a5fb","source":"wordfence","cve":"CVE-2026-78291","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1223 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fa7191-a4a9-40a5-896e-18e16525a5fb?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1223","to_inclusive":true,"patched_in":"4.1224"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:10:14Z"},{"id":"wordfence:36fb5b8d-1ea4-45c2-8639-b229efdb57db","source":"wordfence","cve":"CVE-2025-9286","title":"Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=api-prod","affected":[{"type":"plugin","slug":"appy-pie-connect-for-woocommerce","name":"Appy Pie Connect for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-10-02T22:31:47Z","updated":"2025-10-30T14:16:38Z"},{"id":"wordfence:36fb8a16-f078-4583-8519-d9050201c027","source":"wordfence","cve":"CVE-2026-18807","title":"ECS <= 4.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb8a16-f078-4583-8519-d9050201c027?source=api-prod","affected":[{"type":"plugin","slug":"ele-custom-skin","name":"ECS \u2013 Ele Custom Skin for Elementor","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-09-02T21:32:43Z"},{"id":"wordfence:36fd8125-f876-49c2-a0bb-4c7ef95b462c","source":"wordfence","cve":"CVE-2023-25064","title":"WP htpasswd <= 1.7 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36fd8125-f876-49c2-a0bb-4c7ef95b462c?source=api-prod","affected":[{"type":"plugin","slug":"wp-htpasswd","name":"WP htpasswd","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:36ffa22b-43d0-48aa-8147-db0a9c49a7b9","source":"wordfence","cve":"CVE-2026-110023","title":"WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter","severity":"medium","cvss":5.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/36ffa22b-43d0-48aa-8147-db0a9c49a7b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.88","to_inclusive":true,"patched_in":"5.5.89"}],"published":"2026-10-30T19:25:09Z","updated":"2026-10-31T07:46:48Z"},{"id":"wordfence:3702218f-a5ad-4244-874f-53b49cc9491c","source":"wordfence","cve":"CVE-2022-33960","title":"Social Share Buttons by Supsystic <= 2.2.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3702218f-a5ad-4244-874f-53b49cc9491c?source=api-prod","affected":[{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2022-06-09T00:00:00Z","updated":"2026-01-19T14:32:06Z"},{"id":"wordfence:3704b365-cbdf-4c74-9619-59f0a10e3c6a","source":"wordfence","cve":"CVE-2024-10049","title":"Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3704b365-cbdf-4c74-9619-59f0a10e3c6a?source=api-prod","affected":[{"type":"plugin","slug":"woo-edit-templates","name":"Edit WooCommerce Templates","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:41:08Z","updated":"2024-10-18T04:32:51Z"},{"id":"wordfence:37052cb9-8479-4004-9161-65f37028ae10","source":"wordfence","cve":"","title":"Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37052cb9-8479-4004-9161-65f37028ae10?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":false,"patched_in":"4.1.5"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37053b53-8308-4e54-99c2-7616ed8cb379","source":"wordfence","cve":"","title":"Email Newsletter <= 8.0 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37053b53-8308-4e54-99c2-7616ed8cb379?source=api-prod","affected":[{"type":"plugin","slug":"email-newsletter","name":"Email Newsletter","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":"9.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3705f028-9c8d-48b1-8950-160e10038294","source":"wordfence","cve":"CVE-2024-3341","title":"Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3705f028-9c8d-48b1-8950-160e10038294?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:06:07Z"},{"id":"wordfence:3706deed-55f2-4dfb-bfed-7a14872cd15a","source":"wordfence","cve":"CVE-2023-4919","title":"iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3706deed-55f2-4dfb-bfed-7a14872cd15a?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3708ce44-987f-4e73-b1cb-899349c8e0d4","source":"wordfence","cve":"CVE-2025-32551","title":"Connector to CiviCRM with CiviMcRestFace <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3708ce44-987f-4e73-b1cb-899349c8e0d4?source=api-prod","affected":[{"type":"plugin","slug":"connector-civicrm-mcrestface","name":"Connector to CiviCRM with CiviMcRestFace","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-21T13:45:26Z"},{"id":"wordfence:3709465d-6d67-45bd-abb9-4875065b8129","source":"wordfence","cve":"CVE-2020-36831","title":"NextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing Authorization","severity":"medium","cvss":5.0,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3709465d-6d67-45bd-abb9-4875065b8129?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"4.3.18"}],"published":"2020-09-05T00:00:00Z","updated":"2024-10-16T06:43:28Z"},{"id":"wordfence:370a6130-425c-4264-baaf-8989d3b00d14","source":"wordfence","cve":"","title":"MC4WP: Mailchimp for WordPress <= 4.8.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/370a6130-425c-4264-baaf-8989d3b00d14?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:370a96e0-f6be-4d55-b00f-eb4dc374fcb3","source":"wordfence","cve":"CVE-2025-66132","title":"FAPI Member <= 2.2.29 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/370a96e0-f6be-4d55-b00f-eb4dc374fcb3?source=api-prod","affected":[{"type":"plugin","slug":"fapi-member","name":"FAPI Member","from":"*","from_inclusive":true,"to":"2.2.29","to_inclusive":true,"patched_in":""}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:45:52Z"},{"id":"wordfence:370ccbad-4001-4af5-8d32-fd6b04a8fc41","source":"wordfence","cve":"CVE-2023-5799","title":"WP Hotel Booking <= 2.0.8 - Insufficient Authorization to Unauthorized Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/370ccbad-4001-4af5-8d32-fd6b04a8fc41?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:370e816c-920a-4e53-a2f8-afe2806c9df3","source":"wordfence","cve":"","title":"Fast Flow <= 1.2.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/370e816c-920a-4e53-a2f8-afe2806c9df3?source=api-prod","affected":[{"type":"plugin","slug":"fast-flow-dashboard","name":"Fast Flow","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:370fbe22-df48-4f64-ba7f-5ab98b908f58","source":"wordfence","cve":"","title":"Yvora - Premium WordPress Theme | Portfolio (Unspecified Version) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/370fbe22-df48-4f64-ba7f-5ab98b908f58?source=api-prod","affected":[{"type":"theme","slug":"yvora","name":"Yvora - Premium WordPress Theme | Portfolio","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3710f139-0f17-426c-b48c-4c42ae4bab5f","source":"wordfence","cve":"CVE-2025-12563","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3710f139-0f17-426c-b48c-4c42ae4bab5f?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.6.0","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2025-11-05T16:35:38Z","updated":"2025-11-06T04:36:22Z"},{"id":"wordfence:3710f219-545f-421d-a654-f49169ff7808","source":"wordfence","cve":"CVE-2025-10701","title":"Time Clock \u2013 A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3710f219-545f-421d-a654-f49169ff7808?source=api-prod","affected":[{"type":"plugin","slug":"time-clock","name":"Time Clock \u2013 A WordPress Employee & Volunteer Time Clock Plugin","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-10-23T19:44:27Z","updated":"2025-10-24T08:23:58Z"},{"id":"wordfence:37143eaf-a046-4f8e-8136-09a413ff033d","source":"wordfence","cve":"CVE-2026-89234","title":"WP-Partner <= 1.2.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37143eaf-a046-4f8e-8136-09a413ff033d?source=api-prod","affected":[{"type":"plugin","slug":"wp-partner","name":"WP-Partner","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:21:07Z"},{"id":"wordfence:3718690f-68f1-49cd-8193-b30887daabf2","source":"wordfence","cve":"CVE-2025-39476","title":"Revo <= 4.0.26 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3718690f-68f1-49cd-8193-b30887daabf2?source=api-prod","affected":[{"type":"theme","slug":"revo","name":"Revo - Multipurpose Elementor WooCommerce WordPress Theme (25+ Homepages & 5+ Mobile Layouts)","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T14:06:24Z"},{"id":"wordfence:3718c252-2ca3-4f7d-b43a-3c1b2e6b34c0","source":"wordfence","cve":"CVE-2024-10260","title":"Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3718c252-2ca3-4f7d-b43a-3c1b2e6b34c0?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.11","to_inclusive":true,"patched_in":""}],"published":"2024-11-14T16:36:11Z","updated":"2025-11-05T18:51:24Z"},{"id":"wordfence:37198f2f-2b45-40d3-b4ae-aa94213996bd","source":"wordfence","cve":"CVE-2025-0809","title":"Link Fixer <= 3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37198f2f-2b45-40d3-b4ae-aa94213996bd?source=api-prod","affected":[{"type":"plugin","slug":"permalink-finder","name":"Link Fixer","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T16:50:18Z","updated":"2025-01-31T05:22:34Z"},{"id":"wordfence:371dc260-9fde-42da-bcb3-5a73d8f8bca0","source":"wordfence","cve":"CVE-2026-110375","title":"Download Monitor <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/371dc260-9fde-42da-bcb3-5a73d8f8bca0?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2026-10-15T18:16:00Z","updated":"2026-10-23T18:34:48Z"},{"id":"wordfence:371deb9d-707f-47e4-96d7-1a287926b536","source":"wordfence","cve":"CVE-2020-4047","title":"WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/371deb9d-707f-47e4-96d7-1a287926b536?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:371e0f8b-4e2c-4425-a77d-7cbe1adba8e2","source":"wordfence","cve":"CVE-2025-31093","title":"RPS Include Content <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/371e0f8b-4e2c-4425-a77d-7cbe1adba8e2?source=api-prod","affected":[{"type":"plugin","slug":"rps-include-content","name":"RPS Include Content","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:15:07Z"},{"id":"wordfence:371fef9c-1f32-4a21-b4f4-1fc364ade5a4","source":"wordfence","cve":"CVE-2022-1710","title":"Appointment Hour Booking <= 1.3.55 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/371fef9c-1f32-4a21-b4f4-1fc364ade5a4?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.56"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:372149c4-b6b4-43c8-896f-af69712f3a82","source":"wordfence","cve":"CVE-2024-1905","title":"Smart Forms \u2013 when you need more than just a contact form <= 2.9.95 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372149c4-b6b4-43c8-896f-af69712f3a82?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.95","to_inclusive":true,"patched_in":"2.6.96"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-07T12:02:20Z"},{"id":"wordfence:37223d1f-82c8-414f-bf39-63e728541aa3","source":"wordfence","cve":"CVE-2024-9059","title":"Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37223d1f-82c8-414f-bf39-63e728541aa3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1001","to_inclusive":true,"patched_in":"1.7.1002"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T08:29:34Z"},{"id":"wordfence:37236f49-c853-4594-bb33-6dba55ed0a07","source":"wordfence","cve":"CVE-2025-57948","title":"Directory Pro <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37236f49-c853-4594-bb33-6dba55ed0a07?source=api-prod","affected":[{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:58:25Z"},{"id":"wordfence:372632cb-8dfd-4d74-a765-c8fb9d0f1b78","source":"wordfence","cve":"CVE-2008-1304","title":"WordPress Core <= 2.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372632cb-8dfd-4d74-a765-c8fb9d0f1b78?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2008-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37264b0f-b021-41f8-a72d-3ee0d06b19a8","source":"wordfence","cve":"CVE-2023-0501","title":"WP Insurance \u2013 WordPress Insurance Service Plugin <= 2.1.3 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37264b0f-b021-41f8-a72d-3ee0d06b19a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-insurance","name":"WP Insurance \u2013 WordPress Insurance Service Plugin","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37276e9e-2b77-4259-b52f-f49da04f83e2","source":"wordfence","cve":"CVE-2025-54037","title":"News Kit Elementor Addons <= 1.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37276e9e-2b77-4259-b52f-f49da04f83e2?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:57:53Z"},{"id":"wordfence:3728c2bb-ff02-45b1-8bc8-112a68e3fabf","source":"wordfence","cve":"CVE-2025-1362","title":"URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3728c2bb-ff02-45b1-8bc8-112a68e3fabf?source=api-prod","affected":[{"type":"plugin","slug":"easy-broken-link-checker","name":"URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-03T21:55:16Z"},{"id":"wordfence:372a4550-c38e-46d6-b7f2-15e05708d128","source":"wordfence","cve":"CVE-2021-24870","title":"WP Fastest Cache < 0.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372a4550-c38e-46d6-b7f2-15e05708d128?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":false,"patched_in":"0.9.5"}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:372d1ff2-b56f-43ea-b4e6-fa09ddbbb1a9","source":"wordfence","cve":"CVE-2025-23847","title":"Site Launcher <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372d1ff2-b56f-43ea-b4e6-fa09ddbbb1a9?source=api-prod","affected":[{"type":"plugin","slug":"site-launcher","name":"Site Launcher","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:42:45Z"},{"id":"wordfence:372f1cf3-df33-444c-b31e-8f71d128e30b","source":"wordfence","cve":"CVE-2025-5122","title":"Map Block Leaflet <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372f1cf3-df33-444c-b31e-8f71d128e30b?source=api-prod","affected":[{"type":"plugin","slug":"map-block-leaflet","name":"Map Block Leaflet","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-05-28T19:38:31Z","updated":"2025-05-29T08:22:04Z"},{"id":"wordfence:372f4908-8796-4a52-8346-bd0eb1e41adc","source":"wordfence","cve":"CVE-2023-1596","title":"tagDiv Composer < 4.0 - Reflected Cross-Site Scripting via \u2018td_video_url\u2019","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/372f4908-8796-4a52-8346-bd0eb1e41adc?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37326225-60b8-4d80-8db5-22421f0dc427","source":"wordfence","cve":"CVE-2025-62917","title":"Tooltipy <= 5.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37326225-60b8-4d80-8db5-22421f0dc427?source=api-prod","affected":[{"type":"plugin","slug":"bluet-keywords-tooltip-generator","name":"Tooltipy (tooltips for WP)","from":"*","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2025-10-03T00:00:00Z","updated":"2026-09-16T17:30:22Z"},{"id":"wordfence:3732bf4c-e5e4-4947-9044-9a49e7547cf3","source":"wordfence","cve":"CVE-2022-3096","title":"WP Total Hacks <= 4.7.2 - Authenticated (Subscriber+) Plugin Options Update to Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3732bf4c-e5e4-4947-9044-9a49e7547cf3?source=api-prod","affected":[{"type":"plugin","slug":"wp-total-hacks","name":"WP Total Hacks","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":""}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37331460-4585-4946-9256-64fdb8f02a6b","source":"wordfence","cve":"CVE-2024-2970","title":"News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37331460-4585-4946-9256-64fdb8f02a6b?source=api-prod","affected":[{"type":"plugin","slug":"news-wall","name":"News Wall","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:43:57Z"},{"id":"wordfence:37331768-c838-44e0-a22d-4bf4141dd820","source":"wordfence","cve":"CVE-2025-59575","title":"MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37331768-c838-44e0-a22d-4bf4141dd820?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":"3.6.21"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:34:17Z"},{"id":"wordfence:37342a62-97cd-43ef-af27-33092e840e67","source":"wordfence","cve":"CVE-2025-14888","title":"Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37342a62-97cd-43ef-af27-33092e840e67?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-meta-editor","name":"Simple User Meta Editor","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:33:52Z","updated":"2026-01-07T06:36:00Z"},{"id":"wordfence:3737d7a0-76d6-4292-aa31-6ee2cb0e9575","source":"wordfence","cve":"","title":"YITH WooCommerce Wishlist <= 2.1.2 - SQL Injection","severity":"medium","cvss":6.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3737d7a0-76d6-4292-aa31-6ee2cb0e9575?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2018-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:373b51f0-92ad-4c9e-87b9-96b4e57cc05d","source":"wordfence","cve":"","title":"Anthology < 1.4.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/373b51f0-92ad-4c9e-87b9-96b4e57cc05d?source=api-prod","affected":[{"type":"theme","slug":"anthology","name":"Anthology","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2013-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:373c10df-0d9c-4f76-8d1f-cad6bcfed141","source":"wordfence","cve":"CVE-2023-45053","title":"WP Content Pilot \u2013 Autoblogging & Affiliate Marketing Plugin <= 1.3.3 - Authenticated (Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/373c10df-0d9c-4f76-8d1f-cad6bcfed141?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-pilot","name":"Content Pilot \u2013 Autoblogging & Affiliate Marketing Suite","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:373e9a7c-cdc3-43cb-9c8f-2be25f514b61","source":"wordfence","cve":"","title":"Visual Form Builder <= 2.8.2 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/373e9a7c-cdc3-43cb-9c8f-2be25f514b61?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37426991-7778-4dc4-8cae-2725584fb8b8","source":"wordfence","cve":"CVE-2024-24714","title":"Icons Font Loader <= 1.1.4 - Authenticated(Administrator+) Arbitrary File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37426991-7778-4dc4-8cae-2725584fb8b8?source=api-prod","affected":[{"type":"plugin","slug":"icons-font-loader","name":"Icons Font Loader \u2013 use web icons anywhere on your site, fast","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T15:30:50Z"},{"id":"wordfence:3742f2c5-55be-426c-8445-bf58eeebc74b","source":"wordfence","cve":"CVE-2014-3903","title":"Cakifo 1.0 - 1.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3742f2c5-55be-426c-8445-bf58eeebc74b?source=api-prod","affected":[{"type":"theme","slug":"cakifo","name":"Cakifo","from":"1.0","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37441cc0-c43c-40e4-a170-1be59e112272","source":"wordfence","cve":"CVE-2026-2231","title":"Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37441cc0-c43c-40e4-a170-1be59e112272?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"2.0.01","to_inclusive":true,"patched_in":"2.0.05"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T13:26:09Z"},{"id":"wordfence:3745b681-cb09-4a5b-a57b-c7f35b8c5133","source":"wordfence","cve":"CVE-2022-4360","title":"WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3745b681-cb09-4a5b-a57b-c7f35b8c5133?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-by-publishers","name":"WP RSS By Publishers","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37471ecc-ee8f-4246-a126-b7b7013b5ceb","source":"wordfence","cve":"CVE-2026-19794","title":"WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37471ecc-ee8f-4246-a126-b7b7013b5ceb?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats","name":"WP-Stats","from":"*","from_inclusive":true,"to":"2.56","to_inclusive":true,"patched_in":"2.56.1"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-14T07:39:28Z"},{"id":"wordfence:374a26dd-dd62-4583-8aff-90e5ae6b7468","source":"wordfence","cve":"CVE-2025-11863","title":"My Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374a26dd-dd62-4583-8aff-90e5ae6b7468?source=api-prod","affected":[{"type":"plugin","slug":"my-geo-posts-free","name":"My Geo Posts Free","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:05:13Z","updated":"2025-11-11T03:30:35Z"},{"id":"wordfence:374c0b68-4f06-4b81-9bf9-a43a868e1e7b","source":"wordfence","cve":"CVE-2025-31813","title":"WPSHARE247 Elementor Addons <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374c0b68-4f06-4b81-9bf9-a43a868e1e7b?source=api-prod","affected":[{"type":"plugin","slug":"wpshare247-elementor-addons","name":"WPSHARE247 Elementor Addons","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-21T13:52:16Z"},{"id":"wordfence:374c8bc8-83b1-48d3-877a-f6c8fa2f044b","source":"wordfence","cve":"CVE-2026-15823","title":"Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374c8bc8-83b1-48d3-877a-f6c8fa2f044b?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:52Z","updated":"2026-09-10T03:40:40Z"},{"id":"wordfence:374d2c90-64f5-4690-8bff-6ac0296c7d08","source":"wordfence","cve":"CVE-2026-88825","title":"iGMS Direct Booking <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374d2c90-64f5-4690-8bff-6ac0296c7d08?source=api-prod","affected":[{"type":"plugin","slug":"igms-direct-booking","name":"iGMS Direct Booking","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:47:00Z"},{"id":"wordfence:374e91a3-a02a-40b9-b5f0-4bcbd7faa537","source":"wordfence","cve":"CVE-2025-60240","title":"AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374e91a3-a02a-40b9-b5f0-4bcbd7faa537?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-07-12T00:00:00Z","updated":"2025-11-11T18:42:55Z"},{"id":"wordfence:37506a9e-a225-4519-a24e-8678c31cc106","source":"wordfence","cve":"CVE-2024-38767","title":"BSK PDF Manager <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37506a9e-a225-4519-a24e-8678c31cc106?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-02T18:30:52Z"},{"id":"wordfence:3755a06e-2c2e-4c88-95d7-2619bb84efab","source":"wordfence","cve":"CVE-2024-54380","title":"WP Cookies Enabler <= 1.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3755a06e-2c2e-4c88-95d7-2619bb84efab?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookies-enabler","name":"WP Cookies Enabler","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:43:30Z"},{"id":"wordfence:37563f9c-658c-4806-9bd8-a8413e7934fb","source":"wordfence","cve":"","title":"Workio <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37563f9c-658c-4806-9bd8-a8413e7934fb?source=api-prod","affected":[{"type":"theme","slug":"workio","name":"Workio \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2020-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3758db41-a3c5-436a-bb9a-5886f10d1519","source":"wordfence","cve":"CVE-2022-4941","title":"WCFM Membership <= 2.9.10 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3758db41-a3c5-436a-bb9a-5886f10d1519?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:375aab8b-d46b-48b1-874b-0fb7136cb312","source":"wordfence","cve":"CVE-2025-23944","title":"WOOEXIM \u2013 WooCommerce Export Import Plugin <= 5.0.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/375aab8b-d46b-48b1-874b-0fb7136cb312?source=api-prod","affected":[{"type":"plugin","slug":"wooexim","name":"WOOEXIM \u2013 WooCommerce Export Import Plugin","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:22:33Z"},{"id":"wordfence:375ed04b-a3cb-4e60-83c8-18bff583aaf4","source":"wordfence","cve":"CVE-2026-2512","title":"Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/375ed04b-a3cb-4e60-83c8-18bff583aaf4?source=api-prod","affected":[{"type":"plugin","slug":"simple-embed-code","name":"Code Embed","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-18T15:28:28Z"},{"id":"wordfence:3762cd92-604a-4dac-a09e-6b4a08c4d804","source":"wordfence","cve":"","title":"Duplicator <= 0.5.14 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3762cd92-604a-4dac-a09e-6b4a08c4d804?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"0.5.14","to_inclusive":true,"patched_in":"0.5.16"}],"published":"2015-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3763d893-83a0-4b6a-9c21-34a69313d555","source":"wordfence","cve":"CVE-2024-10891","title":"Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3763d893-83a0-4b6a-9c21-34a69313d555?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T09:31:54Z"},{"id":"wordfence:376404a5-176e-4c73-8281-27b138218879","source":"wordfence","cve":"CVE-2023-23728","title":"WP Flipclock <= 1.7.4 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376404a5-176e-4c73-8281-27b138218879?source=api-prod","affected":[{"type":"plugin","slug":"wp-flipclock","name":"WP Flipclock","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37667434-23b0-4094-a602-29f16ece90e4","source":"wordfence","cve":"CVE-2026-66630","title":"Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37667434-23b0-4094-a602-29f16ece90e4?source=api-prod","affected":[{"type":"plugin","slug":"organize-series","name":"Issues and Series for Newspapers, Magazines, Publishers, Writers","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-09-17T08:57:00Z","updated":"2026-09-22T18:48:09Z"},{"id":"wordfence:376741ee-9b6b-4822-8bad-548e212cd563","source":"wordfence","cve":"CVE-2026-14475","title":"Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376741ee-9b6b-4822-8bad-548e212cd563?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-07-09T19:08:58Z","updated":"2026-07-10T07:48:41Z"},{"id":"wordfence:37698746-f825-4e8c-8a72-f483aae898d4","source":"wordfence","cve":"CVE-2026-39558","title":"Malm\u00f6 <= 2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37698746-f825-4e8c-8a72-f483aae898d4?source=api-prod","affected":[{"type":"theme","slug":"malmo","name":"Malm\u00f6 - A Charming Multi-concept WordPress Theme","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:15:28Z"},{"id":"wordfence:376b46c9-f6bb-4f4e-8e53-62ca68d0003a","source":"wordfence","cve":"CVE-2022-40310","title":"Rate my Post \u2013 WP Rating System <= 3.3.4 - Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376b46c9-f6bb-4f4e-8e53-62ca68d0003a?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:376c5091-7921-4470-acbf-44db53db38fc","source":"wordfence","cve":"CVE-2024-32110","title":"Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376c5091-7921-4470-acbf-44db53db38fc?source=api-prod","affected":[{"type":"plugin","slug":"chat-viber","name":"Chat Support for Viber \u2013 Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.42","to_inclusive":true,"patched_in":"10.43"},{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"},{"type":"plugin","slug":"easy-table-rate-shipping-for-woocommerce","name":"Easy Table Rate Shipping for WooCommmerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"dashboard-welcome-for-elementor","name":"Dashboard Welcome for Elementor","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"faq-for-woocommerce","name":"Happy FAQs \u2013 FAQ, Product FAQ & Help Center","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"},{"type":"plugin","slug":"ajax-load-more-anything","name":"Load More Anything","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"click-to-dial","name":"Click To Dial \u2013 Wp Click To Call Support","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"posts-widget","name":"GS Posts Widget","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"},{"type":"plugin","slug":"eventful","name":"Events Slider, Events Carousel, Events Grid, Events Timeline and Events Filter Bar for The Events Calendar \u2013 Eventful","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"current-template-name","name":"Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info \u2013 Pagely","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"},{"type":"plugin","slug":"click-to-mail","name":"Click To Email \u2013 Chat Bubble & Mail Button for WP","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"},{"type":"plugin","slug":"top-table-of-contents","name":"TOP Table Of Contents","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"},{"type":"plugin","slug":"chat-help","name":"ChatHelp \u2013 Click to Chat Button, Chat to Order for WooCommerce & Floating Chat Form","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.6.0"},{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"},{"type":"plugin","slug":"gallery-box","name":"Gallery Box","from":"*","from_inclusive":true,"to":"1.7.33","to_inclusive":true,"patched_in":"1.7.34"},{"type":"plugin","slug":"unlimited-elementor-inner-sections-by-boomdevs","name":"Prime Elementor Addons \u2013 Lightweight Elementor Widgets for Faster Pages","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-04-11T00:00:00Z","updated":"2025-11-19T13:56:11Z"},{"id":"wordfence:376c575c-0d1f-4369-8113-df76ee3cd83d","source":"wordfence","cve":"CVE-2026-94244","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376c575c-0d1f-4369-8113-df76ee3cd83d?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:33:37Z"},{"id":"wordfence:376e2638-a873-4142-ad7d-067ae3333709","source":"wordfence","cve":"CVE-2023-4841","title":"Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376e2638-a873-4142-ad7d-067ae3333709?source=api-prod","affected":[{"type":"plugin","slug":"feeds-for-youtube","name":"Feeds for YouTube (YouTube video, channel, and gallery plugin)","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-09-13T00:00:00Z","updated":"2024-10-24T18:04:43Z"},{"id":"wordfence:376eec5d-a629-4765-8ace-09e21bf3c2e8","source":"wordfence","cve":"CVE-2026-120688","title":"EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"*","from_inclusive":true,"to":"5.25.25","to_inclusive":true,"patched_in":"5.26.45"}],"published":"2026-11-12T21:11:24Z","updated":"2026-11-13T09:35:12Z"},{"id":"wordfence:376f2fbf-98a4-49d9-bd22-40da5d37b62d","source":"wordfence","cve":"CVE-2021-34619","title":"WooCommerce Stock Manager <= 2.5.7 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376f2fbf-98a4-49d9-bd22-40da5d37b62d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-stock-manager","name":"Stock Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3770f3d7-35ab-4f86-acc3-9d2816d50581","source":"wordfence","cve":"CVE-2024-35628","title":"Photo Gallery by 10Web <= 1.8.25 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3770f3d7-35ab-4f86-acc3-9d2816d50581?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.25","to_inclusive":true,"patched_in":"1.8.26"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-27T18:31:38Z"},{"id":"wordfence:37725a72-0478-4f56-b87f-e427b1f5fb58","source":"wordfence","cve":"","title":"Ninja Job Board \u2013 Ultimate WordPress Job Board Plugin <= 1.3.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37725a72-0478-4f56-b87f-e427b1f5fb58?source=api-prod","affected":[{"type":"plugin","slug":"ninja-job-board","name":"Ninja Job Board","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3772ddad-4960-48c8-904e-2457d12bd01c","source":"wordfence","cve":"CVE-2025-0807","title":"CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3772ddad-4960-48c8-904e-2457d12bd01c?source=api-prod","affected":[{"type":"plugin","slug":"cits-support-svg-webp-media-upload","name":"CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T18:04:51Z","updated":"2025-03-22T06:41:10Z"},{"id":"wordfence:37731e51-33ce-4ef3-8a13-976c005dc983","source":"wordfence","cve":"CVE-2024-13323","title":"Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37731e51-33ce-4ef3-8a13-976c005dc983?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.9.2","to_inclusive":true,"patched_in":"10.9.3"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-14T05:24:40Z"},{"id":"wordfence:37734c25-cce3-41fb-babf-714ba7a4bced","source":"wordfence","cve":"CVE-2025-6586","title":"Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37734c25-cce3-41fb-babf-714ba7a4bced?source=api-prod","affected":[{"type":"plugin","slug":"download-plugin","name":"Download Plugin","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-07-03T13:38:05Z","updated":"2025-12-09T19:41:44Z"},{"id":"wordfence:3776c594-5c67-4331-a95b-051fc58b214e","source":"wordfence","cve":"CVE-2025-60084","title":"PDF for Elementor Forms + Drag And Drop Template Builder <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3776c594-5c67-4331-a95b-051fc58b214e?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-elementor-forms","name":"PDF for Elementor Forms + Drag And Drop Template Builder","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-08-22T00:00:00Z","updated":"2026-01-30T20:42:37Z"},{"id":"wordfence:3779826a-90a4-4d6d-8387-2c8253985c64","source":"wordfence","cve":"CVE-2025-25108","title":"SW Plus <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3779826a-90a4-4d6d-8387-2c8253985c64?source=api-prod","affected":[{"type":"plugin","slug":"shalom-world-media-gallery","name":"Shalom World Plus","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-02-02T00:00:00Z","updated":"2026-09-16T17:28:49Z"},{"id":"wordfence:3779cf95-9dfd-492b-b3a2-68dce3bb342d","source":"wordfence","cve":"CVE-2026-27071","title":"WPCafe \u2013 Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3779cf95-9dfd-492b-b3a2-68dce3bb342d?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-03-12T00:00:00Z","updated":"2026-04-14T14:38:17Z"},{"id":"wordfence:377afb95-02d9-46b9-936d-3d58257dd928","source":"wordfence","cve":"CVE-2024-12222","title":"Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/377afb95-02d9-46b9-936d-3d58257dd928?source=api-prod","affected":[{"type":"plugin","slug":"wc-shipos-delivery","name":"Deliver via Shipos for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-01-08T22:09:36Z","updated":"2025-12-01T15:54:27Z"},{"id":"wordfence:377b1964-2b7c-42c4-954e-25b1cc61c074","source":"wordfence","cve":"CVE-2026-39446","title":"Kapee < 1.7.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/377b1964-2b7c-42c4-954e-25b1cc61c074?source=api-prod","affected":[{"type":"theme","slug":"kapee","name":"Kapee - Modern Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:02:14Z"},{"id":"wordfence:377b8532-61b8-45be-ad7c-c9ff60a7100a","source":"wordfence","cve":"","title":"Caldera Forms \u2013 More Than Contact Forms < 1.4.0 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/377b8532-61b8-45be-ad7c-c9ff60a7100a?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2016-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:377e232b-1245-48ff-9f79-26a049e20063","source":"wordfence","cve":"CVE-2025-22346","title":"Course Migration for LearnDash <= 1.0.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/377e232b-1245-48ff-9f79-26a049e20063?source=api-prod","affected":[{"type":"plugin","slug":"course-migration-for-learndash","name":"Course Migration for LearnDash","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:06:49Z"},{"id":"wordfence:3781bf74-541a-4dfb-a058-1a9ea6aa970e","source":"wordfence","cve":"CVE-2026-118057","title":"Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3781bf74-541a-4dfb-a058-1a9ea6aa970e?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"22.3.2","to_inclusive":true,"patched_in":"22.3.4"}],"published":"2026-10-30T18:55:49Z","updated":"2026-10-31T07:46:49Z"},{"id":"wordfence:37820930-4705-41af-9a9d-c99409d7bbe3","source":"wordfence","cve":"CVE-2024-37464","title":"Beaver Builder Addons by WPZOOM <= 1.3.5 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37820930-4705-41af-9a9d-c99409d7bbe3?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T19:06:39Z"},{"id":"wordfence:37836722-eb25-4393-8cdf-91057642ba3f","source":"wordfence","cve":"CVE-2024-6635","title":"WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass","severity":"high","cvss":7.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T07:38:03Z"},{"id":"wordfence:37848512-fbdf-48cd-9d59-5bfb1bdbe73d","source":"wordfence","cve":"CVE-2026-19092","title":"Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37848512-fbdf-48cd-9d59-5bfb1bdbe73d?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-16T15:25:56Z"},{"id":"wordfence:3785938d-d55a-487d-8709-2d3bdd4b8c0f","source":"wordfence","cve":"CVE-2021-24246","title":"WorkScout - Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3785938d-d55a-487d-8709-2d3bdd4b8c0f?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"},{"type":"theme","slug":"workscout","name":"WorkScout - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2021-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3786d672-f181-4d4d-9eb2-a86b70ff2794","source":"wordfence","cve":"CVE-2024-6850","title":"Carousel Slider <= 2.2.13 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3786d672-f181-4d4d-9eb2-a86b70ff2794?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"}],"published":"2024-08-23T00:00:00Z","updated":"2024-10-04T15:55:03Z"},{"id":"wordfence:378bc737-6547-4dc2-8123-3a33d7d2e122","source":"wordfence","cve":"CVE-2025-23851","title":"Coronavirus (COVID-19) Outbreak Data Widgets <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/378bc737-6547-4dc2-8123-3a33d7d2e122?source=api-prod","affected":[{"type":"plugin","slug":"coronavirus-data-widgets","name":"Coronavirus (COVID-19) Outbreak Data Widgets","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:39:52Z"},{"id":"wordfence:379408c3-399d-4aff-9a6b-43913aaa52b7","source":"wordfence","cve":"","title":"WP-Members Membership Plugin <= 2.8.9 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379408c3-399d-4aff-9a6b-43913aaa52b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":false,"patched_in":"2.8.10"}],"published":"2014-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:379547a2-6b22-4ec9-8570-a043dda7ec09","source":"wordfence","cve":"CVE-2025-11632","title":"Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379547a2-6b22-4ec9-8570-a043dda7ec09?source=api-prod","affected":[{"type":"plugin","slug":"call-now-button","name":"Call Now Button \u2013 The Free Click to Call Button for WordPress","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-10-29T00:01:50Z","updated":"2025-10-29T12:32:19Z"},{"id":"wordfence:37963064-77ad-4515-b801-5669ab8a3992","source":"wordfence","cve":"CVE-2025-23969","title":"KI Live Video Conferences <= 5.5.15 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37963064-77ad-4515-b801-5669ab8a3992?source=api-prod","affected":[{"type":"plugin","slug":"ki-live-video-conferences","name":"KI Live Video Conferences","from":"*","from_inclusive":true,"to":"5.5.15","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:29:47Z"},{"id":"wordfence:379825e2-61bf-4d11-8eea-05ad08200e9e","source":"wordfence","cve":"CVE-2024-30193","title":"Church Admin <= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379825e2-61bf-4d11-8eea-05ad08200e9e?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"4.1.18"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T16:28:42Z"},{"id":"wordfence:3798fb5d-f7d6-4a93-8908-c9b1f93bb05a","source":"wordfence","cve":"CVE-2022-0288","title":"Ad Inserter <= 2.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3798fb5d-f7d6-4a93-8908-c9b1f93bb05a?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":false,"patched_in":"2.7.10"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:379a5016-3968-4b28-8d6e-0f517e419016","source":"wordfence","cve":"","title":"Various Plugins <= Various Version - Use of Polyfill.io","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379a5016-3968-4b28-8d6e-0f517e419016?source=api-prod","affected":[{"type":"plugin","slug":"stepbyteservice-openstreetmap","name":"OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.43.3","to_inclusive":true,"patched_in":"1.43.4"},{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.23","to_inclusive":true,"patched_in":"1.6.24"},{"type":"plugin","slug":"eid-easy-qualified-electonic-signature","name":"Qualified Electronic Signatures by eID Easy","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"},{"type":"plugin","slug":"digital-river-global-commerce","name":"Digital River Global Commerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2024-06-25T00:00:00Z","updated":"2024-07-08T20:45:38Z"},{"id":"wordfence:379a7767-bb88-446f-806b-7a8e5c0584a6","source":"wordfence","cve":"CVE-2026-32447","title":"Atarim <= 4.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379a7767-bb88-446f-806b-7a8e5c0584a6?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-03-08T00:00:00Z","updated":"2026-04-15T21:06:35Z"},{"id":"wordfence:379aa658-ebc4-4000-913e-5f95a4783233","source":"wordfence","cve":"CVE-2021-24928","title":"Rearrange Woocommerce Products <= 3.0.7 - Subscriber+ SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379aa658-ebc4-4000-913e-5f95a4783233?source=api-prod","affected":[{"type":"plugin","slug":"rearrange-woocommerce-products","name":"Rearrange Products for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2022-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:379b8a8a-bb6f-435f-a2bd-e3569e7b142e","source":"wordfence","cve":"CVE-2025-39575","title":"WPCasa <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379b8a8a-bb6f-435f-a2bd-e3569e7b142e?source=api-prod","affected":[{"type":"plugin","slug":"wpcasa","name":"WPCasa \u2013 Real Estate for WordPress","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:27:35Z"},{"id":"wordfence:379dcd46-0a13-4c63-a655-c740f9bb460c","source":"wordfence","cve":"CVE-2025-62880","title":"Custom 404 Pro <= 3.12.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/379dcd46-0a13-4c63-a655-c740f9bb460c?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2025-05-13T00:00:00Z","updated":"2026-04-15T13:29:44Z"},{"id":"wordfence:37a25fdf-da5d-42bd-a803-afb3787aabf4","source":"wordfence","cve":"CVE-2021-24190","title":"WooCommerce Conditional Marketing Mailer <= 1.5.1 - Improper Authorization","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a25fdf-da5d-42bd-a803-afb3787aabf4?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode-site-under-construction","name":"WP Maintenance Mode & Site Under Construction","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37a4a181-82ba-43bd-9caf-3a56cacb86a9","source":"wordfence","cve":"CVE-2022-4759","title":"GigPress <= 2.3.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a4a181-82ba-43bd-9caf-3a56cacb86a9?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.27","to_inclusive":true,"patched_in":"2.3.28"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37a72530-35d0-4fe8-82c6-50c87f61e731","source":"wordfence","cve":"CVE-2026-92212","title":"JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a72530-35d0-4fe8-82c6-50c87f61e731?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.3","to_inclusive":true,"patched_in":"3.6.5.4"}],"published":"2026-09-24T18:25:14Z","updated":"2026-09-25T06:39:52Z"},{"id":"wordfence:37a8642d-07f5-4b1b-8419-e30589089162","source":"wordfence","cve":"CVE-2026-1056","title":"Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a8642d-07f5-4b1b-8419-e30589089162?source=api-prod","affected":[{"type":"plugin","slug":"snow-monkey-forms","name":"Snow Monkey Forms","from":"*","from_inclusive":true,"to":"12.0.3","to_inclusive":true,"patched_in":"12.0.4"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T12:28:37Z"},{"id":"wordfence:37a9b2d0-e27d-4a2c-945a-a06a9b9bd2ea","source":"wordfence","cve":"CVE-2021-24770","title":"Stylish Price List <= 6.9.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37a9b2d0-e27d-4a2c-945a-a06a9b9bd2ea?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2021-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37aa3d05-79b6-49ea-b698-afa78615e438","source":"wordfence","cve":"CVE-2023-47184","title":"Admin Bar & Dashboard Control <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37aa3d05-79b6-49ea-b698-afa78615e438?source=api-prod","affected":[{"type":"plugin","slug":"admin-bar-dashboard-control","name":"Admin Bar & Dashboard Access Control","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37aaf109-e04f-40d7-8303-a581b0b09d24","source":"wordfence","cve":"CVE-2022-44578","title":"Owl Carousel <= 0.5.3 - Missing Authorization via save_paramter.php","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37aaf109-e04f-40d7-8303-a581b0b09d24?source=api-prod","affected":[{"type":"plugin","slug":"owl-carousel","name":"Owl Carousel","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37ab838d-7247-40db-8d78-e3f84116b415","source":"wordfence","cve":"CVE-2025-30951","title":"BlockStrap Page Builder - Bootstrap Blocks <= 0.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ab838d-7247-40db-8d78-e3f84116b415?source=api-prod","affected":[{"type":"plugin","slug":"blockstrap-page-builder-blocks","name":"BlockStrap Page Builder \u2013 Bootstrap Blocks","from":"*","from_inclusive":true,"to":"0.1.36","to_inclusive":true,"patched_in":"0.1.37"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-17T17:00:27Z"},{"id":"wordfence:37ac92b5-a080-4e0a-823e-6b9039c99d61","source":"wordfence","cve":"CVE-2026-75965","title":"User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ac92b5-a080-4e0a-823e-6b9039c99d61?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-08-31T16:02:50Z","updated":"2026-09-01T04:27:50Z"},{"id":"wordfence:37aebd9b-d04a-481a-aa84-cafc8ac42f8b","source":"wordfence","cve":"CVE-2026-100109","title":"Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37aebd9b-d04a-481a-aa84-cafc8ac42f8b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"1.0.10","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:07:03Z"},{"id":"wordfence:37aedfb3-bc98-4a8f-bc19-af7778ff1a14","source":"wordfence","cve":"CVE-2018-19043","title":"Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Read","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37aedfb3-bc98-4a8f-bc19-af7778ff1a14?source=api-prod","affected":[{"type":"plugin","slug":"media-file-manager","name":"Media File Manager","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2018-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37afe2eb-0671-4dba-babc-f0b286dcb84f","source":"wordfence","cve":"CVE-2025-24575","title":"HelloAsso <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37afe2eb-0671-4dba-babc-f0b286dcb84f?source=api-prod","affected":[{"type":"plugin","slug":"helloasso","name":"HelloAsso","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:38:46Z"},{"id":"wordfence:37b085f9-3b15-44aa-9ba0-de5321dfbce4","source":"wordfence","cve":"CVE-2025-5524","title":"OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37b085f9-3b15-44aa-9ba0-de5321dfbce4?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-06-18T16:22:13Z","updated":"2025-06-19T04:25:19Z"},{"id":"wordfence:37b5fcfd-654b-4151-9494-551799464c7c","source":"wordfence","cve":"","title":"Contextual Related Posts <= 3.3.1 - Missing Authorization in crp_ajax_clearcache","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37b5fcfd-654b-4151-9494-551799464c7c?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37b9ed0e-5af2-47c1-b2da-8d103e4c31bf","source":"wordfence","cve":"CVE-2023-5201","title":"OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf?source=api-prod","affected":[{"type":"plugin","slug":"thesis-openhook","name":"OpenHook","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37bb8d68-dd87-437a-80e5-e99e93dc55b6","source":"wordfence","cve":"CVE-2026-11801","title":"WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37bb8d68-dd87-437a-80e5-e99e93dc55b6?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-08-17T13:29:15Z","updated":"2026-08-18T02:27:04Z"},{"id":"wordfence:37be9612-fd5c-40dc-9853-c838c3f4b907","source":"wordfence","cve":"CVE-2024-3751","title":"Seriously Simple Podcasting <= 3.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37be9612-fd5c-40dc-9853-c838c3f4b907?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T17:38:08Z"},{"id":"wordfence:37bfb60d-8e2d-4c77-880c-3d17a6a434b8","source":"wordfence","cve":"CVE-2024-3067","title":"WooCommerce Google Feed Manager <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37bfb60d-8e2d-4c77-880c-3d17a6a434b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-16T12:51:44Z"},{"id":"wordfence:37bfc71f-e1f9-4374-ab65-9b1c321ff386","source":"wordfence","cve":"CVE-2021-24966","title":"Error Log Viewer <= 1.1.1 - Arbitrary File Deletion","severity":"medium","cvss":5.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37bfc71f-e1f9-4374-ab65-9b1c321ff386?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer","name":"Error Log Viewer by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2021-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37c18340-d7aa-4410-be17-c61c286838ce","source":"wordfence","cve":"CVE-2024-0820","title":"Jobs for WordPress <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37c18340-d7aa-4410-be17-c61c286838ce?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-02-21T00:00:00Z","updated":"2024-04-17T21:26:40Z"},{"id":"wordfence:37c22521-68ef-4d15-9633-8fe1af493a52","source":"wordfence","cve":"","title":"IP Blacklist Cloud < 3.41 - SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37c22521-68ef-4d15-9633-8fe1af493a52?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"3.41","to_inclusive":false,"patched_in":"3.41"}],"published":"2015-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37c31c26-c4fe-4c98-96de-6f4b0e3a36d4","source":"wordfence","cve":"CVE-2025-67621","title":"Eight Day Week Print Workflow <= 1.2.5 - Authenticated (Custom+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37c31c26-c4fe-4c98-96de-6f4b0e3a36d4?source=api-prod","affected":[{"type":"plugin","slug":"eight-day-week-print-workflow","name":"Eight Day Week Print Workflow","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-05T21:12:57Z"},{"id":"wordfence:37c5b868-37f6-44f1-8938-8a461cfa046b","source":"wordfence","cve":"CVE-2025-59561","title":"Smart Blocks <= 2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37c5b868-37f6-44f1-8938-8a461cfa046b?source=api-prod","affected":[{"type":"plugin","slug":"smart-blocks","name":"Smart Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:21:24Z"},{"id":"wordfence:37ca7081-df1f-4f2e-bb52-7cb87f74fb5d","source":"wordfence","cve":"CVE-2022-3451","title":"Product Stock Manager < 1.0.5 - Missing Authorization and Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ca7081-df1f-4f2e-bb52-7cb87f74fb5d?source=api-prod","affected":[{"type":"plugin","slug":"addify-product-stock-manager","name":"Product Stock Manager","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37cc54a9-a780-42b5-b64d-c47470f17db7","source":"wordfence","cve":"CVE-2015-9501","title":"Artificial Intelligence < 1.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37cc54a9-a780-42b5-b64d-c47470f17db7?source=api-prod","affected":[{"type":"theme","slug":"artificial-intelligence","name":"Artificial Intelligence","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37ce28de-f41d-42f8-8467-0af5e643a739","source":"wordfence","cve":"CVE-2025-5017","title":"Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ce28de-f41d-42f8-8467-0af5e643a739?source=api-prod","affected":[{"type":"plugin","slug":"catalyst-connect-client-portal","name":"Catalyst Connect Zoho CRM Client Portal","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-10T17:13:26Z","updated":"2026-07-11T05:35:47Z"},{"id":"wordfence:37cf179f-9b20-4a3b-9a88-66f3cc6a6e20","source":"wordfence","cve":"CVE-2026-112859","title":"Little Birdies | Multipurpose Children PSD Template <= 1.3.16 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37cf179f-9b20-4a3b-9a88-66f3cc6a6e20?source=api-prod","affected":[{"type":"theme","slug":"little-birdies","name":"Little Birdies | Multipurpose Children PSD Template","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:54Z"},{"id":"wordfence:37cf63e3-9301-441d-9852-b2de83078b51","source":"wordfence","cve":"CVE-2024-4755","title":"Google CSE <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37cf63e3-9301-441d-9852-b2de83078b51?source=api-prod","affected":[{"type":"plugin","slug":"google-cse","name":"Google CSE","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-13T13:32:12Z"},{"id":"wordfence:37d13a43-13f4-460d-b5ea-5def8a379d54","source":"wordfence","cve":"CVE-2019-11807","title":"WooCommerce Checkout Manager <= 4.2.6 - Unauthenticated Arbitrary Media Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37d13a43-13f4-460d-b5ea-5def8a379d54?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.3"}],"published":"2019-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37d204b5-ffdb-4e0d-9f7b-2c2b70b1bab1","source":"wordfence","cve":"CVE-2025-62104","title":"ACF Galerie 4 <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37d204b5-ffdb-4e0d-9f7b-2c2b70b1bab1?source=api-prod","affected":[{"type":"plugin","slug":"acf-galerie-4","name":"ACF Galerie 4","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:38:01Z"},{"id":"wordfence:37d48295-357b-47c3-9adf-ce49dc73f337","source":"wordfence","cve":"CVE-2025-62903","title":"WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37d48295-357b-47c3-9adf-ce49dc73f337?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-messages","name":"WPC Smart Messages for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2025-09-28T00:00:00Z","updated":"2026-04-25T15:50:03Z"},{"id":"wordfence:37d4d038-3f5c-4c4a-b5f1-3dd23a5b345e","source":"wordfence","cve":"CVE-2025-39584","title":"Eventin <= 4.0.25 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37d4d038-3f5c-4c4a-b5f1-3dd23a5b345e?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.25","to_inclusive":true,"patched_in":"4.0.26"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-25T16:32:34Z"},{"id":"wordfence:37d9171d-4722-4ebc-a773-9fd497bc12cf","source":"wordfence","cve":"CVE-2026-11798","title":"Social Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37d9171d-4722-4ebc-a773-9fd497bc12cf?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.14.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T17:03:58Z","updated":"2026-07-08T05:34:07Z"},{"id":"wordfence:37da32e4-48a1-4830-a47c-c454d60c9811","source":"wordfence","cve":"CVE-2025-2205","title":"GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37da32e4-48a1-4830-a47c-c454d60c9811?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.6","to_inclusive":true,"patched_in":"4.15.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-12T03:21:29Z"},{"id":"wordfence:37db075a-c335-4532-86cb-8cfa2897e02e","source":"wordfence","cve":"CVE-2025-31860","title":"WP AdCenter <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37db075a-c335-4532-86cb-8cfa2897e02e?source=api-prod","affected":[{"type":"plugin","slug":"wpadcenter","name":"WP AdCenter \u2013 Ad Manager & Adsense Ads","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-30T14:27:14Z"},{"id":"wordfence:37dc80d0-1834-40a7-9454-a8129d9b4cdd","source":"wordfence","cve":"CVE-2026-39451","title":"WP Google Review Slider <= 18.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37dc80d0-1834-40a7-9454-a8129d9b4cdd?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"18.0","to_inclusive":true,"patched_in":"18.1"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-18T14:18:39Z"},{"id":"wordfence:37de5734-7cf4-4289-ac07-9a40f31e9628","source":"wordfence","cve":"CVE-2024-35165","title":"Gutenify <= 1.4.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37de5734-7cf4-4289-ac07-9a40f31e9628?source=api-prod","affected":[{"type":"plugin","slug":"gutenify","name":"Gutenify \u2013 Visual Site Builder Blocks & Starter Templates","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:32:52Z"},{"id":"wordfence:37e1a755-7c17-4cb4-acca-9f26238230f3","source":"wordfence","cve":"CVE-2026-32488","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37e1a755-7c17-4cb4-acca-9f26238230f3?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:55:24Z"},{"id":"wordfence:37e47649-3e58-475d-93ba-db9862a67f22","source":"wordfence","cve":"CVE-2025-22645","title":"Real Estate Manager \u2013 Property Listing and Agent Management <= 7.3 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37e47649-3e58-475d-93ba-db9862a67f22?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:37e707ef-fe66-4c21-9c37-7b65fb7690db","source":"wordfence","cve":"CVE-2023-23887","title":"Easy Google Analytics for WordPress <= 1.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37e707ef-fe66-4c21-9c37-7b65fb7690db?source=api-prod","affected":[{"type":"plugin","slug":"easy-google-analytics-for-wordpress","name":"Easy Google Analytics for WordPress","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37e84cab-746a-4b64-b9a1-7232584d1f19","source":"wordfence","cve":"CVE-2024-50508","title":"Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37e84cab-746a-4b64-b9a1-7232584d1f19?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-design","name":"Woocommerce Product Design","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T00:00:00Z","updated":"2024-12-12T17:37:35Z"},{"id":"wordfence:37ea39bd-58c5-49f6-9956-8e0089e8192d","source":"wordfence","cve":"CVE-2022-3420","title":"Official Integration for Billingo <= 3.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ea39bd-58c5-49f6-9956-8e0089e8192d?source=api-prod","affected":[{"type":"plugin","slug":"billingo","name":"Billingo Official for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2022-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37eb77ed-0b2e-46ea-806d-8041742eab5d","source":"wordfence","cve":"CVE-2023-36530","title":"SP Project & Document Manager  <= 4.67 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37eb77ed-0b2e-46ea-806d-8041742eab5d?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.67","to_inclusive":true,"patched_in":"4.68"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37eb8847-0440-49c8-91cf-b23f6609ffce","source":"wordfence","cve":"CVE-2024-56215","title":"Member Directory and Contact Form <= 1.7.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37eb8847-0440-49c8-91cf-b23f6609ffce?source=api-prod","affected":[{"type":"plugin","slug":"pta-member-directory","name":"Member Directory and Contact Form","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:12:08Z"},{"id":"wordfence:37eba0f3-d481-49a0-9f80-f42af55a71d2","source":"wordfence","cve":"CVE-2025-47528","title":"Ovation Elements <= 1.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37eba0f3-d481-49a0-9f80-f42af55a71d2?source=api-prod","affected":[{"type":"plugin","slug":"ovation-elements","name":"Ovation Elements","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:07:36Z"},{"id":"wordfence:37ec08b8-1ec6-4c0e-b042-dbfab45b4974","source":"wordfence","cve":"CVE-2026-108481","title":"Patreon WordPress <= 1.10.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ec08b8-1ec6-4c0e-b042-dbfab45b4974?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2026-10-12T17:33:00Z","updated":"2026-10-13T13:50:08Z"},{"id":"wordfence:37ec8e59-7b99-4f17-96d6-d1083dd9302f","source":"wordfence","cve":"CVE-2025-57896","title":"Church Admin <= 5.0.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ec8e59-7b99-4f17-96d6-d1083dd9302f?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.26","to_inclusive":true,"patched_in":"5.0.27"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-25T20:07:24Z"},{"id":"wordfence:37ef6a00-bfa8-4fb8-a2f4-219de3359f85","source":"wordfence","cve":"CVE-2026-105060","title":"Logo Showcase \u2013 Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37ef6a00-bfa8-4fb8-a2f4-219de3359f85?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase","name":"Logo Showcase \u2013 Logo Slider, Logo Carousel & Client Logos Grid","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-10-05T08:48:00Z","updated":"2026-10-08T23:14:28Z"},{"id":"wordfence:37f0bc0c-4c34-43fb-9630-766cb20b2ccf","source":"wordfence","cve":"CVE-2026-11575","title":"PhonePe Payment Solutions <= 3.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f0bc0c-4c34-43fb-9630-766cb20b2ccf?source=api-prod","affected":[{"type":"plugin","slug":"phonepe-payment-solutions","name":"PhonePe Payment Solutions","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-29T22:20:29Z"},{"id":"wordfence:37f0cb8f-80c7-457a-a92f-9cd6ad65c443","source":"wordfence","cve":"CVE-2026-16057","title":"Contest Gallery <= 30.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f0cb8f-80c7-457a-a92f-9cd6ad65c443?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.6","to_inclusive":true,"patched_in":"30.0.7"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-15T21:34:43Z"},{"id":"wordfence:37f3aca7-b728-4a27-9e08-bdc9ca2f8f0c","source":"wordfence","cve":"CVE-2021-39328","title":"Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f3aca7-b728-4a27-9e08-bdc9ca2f8f0c?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2021-10-21T16:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f47ce1-0657-414d-a491-99f2722a44f5","source":"wordfence","cve":"","title":"BA Book Everything Plugin < 1.3.25 - Cross-Site Scripting and Cross-Frame Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f47ce1-0657-414d-a491-99f2722a44f5?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.3.25","to_inclusive":false,"patched_in":"1.3.25"}],"published":"2020-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f60fe5-2ece-48aa-8005-e220541bdd62","source":"wordfence","cve":"CVE-2021-24206","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f60fe5-2ece-48aa-8005-e220541bdd62?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"0.1.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f6993a-2812-4007-b649-833a32163c75","source":"wordfence","cve":"CVE-2025-58243","title":"imEvent <= 3.4.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f6993a-2812-4007-b649-833a32163c75?source=api-prod","affected":[{"type":"theme","slug":"imevent","name":"imevent","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:37:48Z"},{"id":"wordfence:37f6e19c-2e24-4a25-890f-60ebf7fdc2ae","source":"wordfence","cve":"CVE-2026-73995","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f6e19c-2e24-4a25-890f-60ebf7fdc2ae?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T16:53:03Z"},{"id":"wordfence:37f704bf-82bc-44f7-8b3c-cbf117732aaf","source":"wordfence","cve":"","title":"Dailydeal by Templatic < = 3.0.10 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f704bf-82bc-44f7-8b3c-cbf117732aaf?source=api-prod","affected":[{"type":"theme","slug":"dailydeal","name":"Daily Deal by Templatic","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":""}],"published":"2013-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f7edb2-4fc0-4785-a49d-6bae9aa57d42","source":"wordfence","cve":"CVE-2012-5346","title":"WP Live.php <= 1.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f7edb2-4fc0-4785-a49d-6bae9aa57d42?source=api-prod","affected":[{"type":"plugin","slug":"wp-livephp","name":"WP Live.php","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2012-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f7f826-cb60-4e25-9a02-f18a0ace0a75","source":"wordfence","cve":"CVE-2026-65469","title":"AWP Classifieds <= 4.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f7f826-cb60-4e25-9a02-f18a0ace0a75?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:37:46Z"},{"id":"wordfence:37f7f9ef-d57a-41e9-bd2c-2aa04a82b6c4","source":"wordfence","cve":"CVE-2007-0106","title":"WordPress Core <= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f7f9ef-d57a-41e9-bd2c-2aa04a82b6c4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2007-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:37f8eced-905c-4623-b382-055561fd25a0","source":"wordfence","cve":"CVE-2026-8701","title":"GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f8eced-905c-4623-b382-055561fd25a0?source=api-prod","affected":[{"type":"plugin","slug":"gntt-post-title-ticker","name":"GNTT Post Title Ticker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:21Z","updated":"2026-05-27T05:31:23Z"},{"id":"wordfence:37f9c8b4-0307-45f4-a1cb-417c7a922997","source":"wordfence","cve":"CVE-2026-81800","title":"Verified Reviews (Avis V\u00e9rifi\u00e9s) <= 2.4.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37f9c8b4-0307-45f4-a1cb-417c7a922997?source=api-prod","affected":[{"type":"plugin","slug":"netreviews","name":"Verified Reviews (Avis V\u00e9rifi\u00e9s)","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:20:12Z"},{"id":"wordfence:37fd0582-5baf-4ced-a798-dc0970e90a3e","source":"wordfence","cve":"CVE-2024-6265","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37fd0582-5baf-4ced-a798-dc0970e90a3e?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-06-28T16:33:20Z","updated":"2024-06-29T04:33:30Z"},{"id":"wordfence:37fdbbc3-6151-4962-90fa-a621d01a5eb2","source":"wordfence","cve":"CVE-2026-93655","title":"Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37fdbbc3-6151-4962-90fa-a621d01a5eb2?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.8.3","to_inclusive":true,"patched_in":"11.8.4"}],"published":"2026-09-21T16:44:33Z","updated":"2026-09-22T05:30:44Z"},{"id":"wordfence:380024dc-ed2a-4a7b-b5f8-47879ad2d659","source":"wordfence","cve":"CVE-2023-25488","title":"WP Default Feature Image <= 1.0.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/380024dc-ed2a-4a7b-b5f8-47879ad2d659?source=api-prod","affected":[{"type":"plugin","slug":"wp-default-feature-image","name":"WP Default Feature Image","from":"*","from_inclusive":true,"to":"1.0.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38024680-2d99-4af0-b805-6fd718a1d338","source":"wordfence","cve":"CVE-2026-85679","title":"Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38024680-2d99-4af0-b805-6fd718a1d338?source=api-prod","affected":[{"type":"plugin","slug":"extendify","name":"Extendify","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-09-30T16:46:01Z","updated":"2026-10-01T05:30:55Z"},{"id":"wordfence:3802cbf7-6725-4f93-a178-2af02bb022a1","source":"wordfence","cve":"CVE-2019-16221","title":"WordPress Core < 5.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3802cbf7-6725-4f93-a178-2af02bb022a1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38039171-f2cc-47d5-9b7b-d2c4a347a839","source":"wordfence","cve":"CVE-2025-31027","title":"Tiger <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38039171-f2cc-47d5-9b7b-d2c4a347a839?source=api-prod","affected":[{"type":"theme","slug":"tiger","name":"Tiger","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T19:08:06Z"},{"id":"wordfence:3807d162-d62a-4370-b521-fba960a770ca","source":"wordfence","cve":"CVE-2024-54415","title":"WP-HideThat <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3807d162-d62a-4370-b521-fba960a770ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-that","name":"WP-HideThat","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:34:41Z"},{"id":"wordfence:3808ca2a-e78e-4118-890b-c22a71f8e855","source":"wordfence","cve":"CVE-2024-4702","title":"Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3808ca2a-e78e-4118-890b-c22a71f8e855?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T11:33:08Z"},{"id":"wordfence:380c646c-fd95-408a-89eb-3e646768bbc5","source":"wordfence","cve":"CVE-2024-1170","title":"Post Form \u2013 Registration Form \u2013 Profile Form for User Profiles \u2013 Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/380c646c-fd95-408a-89eb-3e646768bbc5?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T11:01:57Z"},{"id":"wordfence:38138775-2069-4878-ae41-06f53c74a0df","source":"wordfence","cve":"CVE-2026-48965","title":"Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38138775-2069-4878-ae41-06f53c74a0df?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-11T13:58:19Z"},{"id":"wordfence:3813c6f3-c385-4811-a126-8607b9097bcc","source":"wordfence","cve":"CVE-2024-2643","title":"My Sticky Bar <= 2.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3813c6f3-c385-4811-a126-8607b9097bcc?source=api-prod","affected":[{"type":"plugin","slug":"UNKNOWN-CVE-2023-5509-1","name":"Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2024-03-26T00:00:00Z","updated":"2026-09-04T17:18:52Z"},{"id":"wordfence:38145ad1-f441-40a4-9e92-6837cfeba656","source":"wordfence","cve":"CVE-2023-47549","title":"EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38145ad1-f441-40a4-9e92-6837cfeba656?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3816a6cf-8157-4ad9-83f6-93c9b6c6275f","source":"wordfence","cve":"","title":"Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3816a6cf-8157-4ad9-83f6-93c9b6c6275f?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:381708ae-3180-4058-a6f4-e925bfc658ec","source":"wordfence","cve":"CVE-2016-0796","title":"mb.miniAudioPlayer <= 1.7.6 - Multiple Vulnerabilities","severity":"high","cvss":7.2,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381708ae-3180-4058-a6f4-e925bfc658ec?source=api-prod","affected":[{"type":"plugin","slug":"wp-miniaudioplayer","name":"mb.miniAudioPlayer \u2013 an HTML5 audio player for your mp3 files","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2016-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38176c68-7932-4858-8cc6-b34128f55abe","source":"wordfence","cve":"CVE-2026-39618","title":"NewsExo <= 7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38176c68-7932-4858-8cc6-b34128f55abe?source=api-prod","affected":[{"type":"theme","slug":"newsexo","name":"NewsExo","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T21:19:00Z"},{"id":"wordfence:38191721-8d5d-4a13-8271-c7ca96c3f6b8","source":"wordfence","cve":"CVE-2022-0601","title":"Countdown & Clock <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38191721-8d5d-4a13-8271-c7ca96c3f6b8?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3819ffc4-8889-4199-9dd6-140490a17ed6","source":"wordfence","cve":"CVE-2023-23492","title":"Login with phone number  <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3819ffc4-8889-4199-9dd6-140490a17ed6?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:381afedf-f7a3-4281-9cac-a2c3e3ccffea","source":"wordfence","cve":"CVE-2026-84903","title":"King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381afedf-f7a3-4281-9cac-a2c3e3ccffea?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.80","to_inclusive":true,"patched_in":"51.1.81"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:38:45Z"},{"id":"wordfence:381ea693-3e59-4ecb-a96b-4b58d47298c0","source":"wordfence","cve":"CVE-2024-30240","title":"Calendarista <= 15.5.7 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381ea693-3e59-4ecb-a96b-4b58d47298c0?source=api-prod","affected":[{"type":"plugin","slug":"calendarista","name":"Calendarista","from":"*","from_inclusive":true,"to":"15.5.7","to_inclusive":true,"patched_in":"15.5.9"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:51:35Z"},{"id":"wordfence:381ec109-ca51-4011-b7e0-aec636540d59","source":"wordfence","cve":"CVE-2026-2022","title":"Smart Forms <= 2.6.100 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381ec109-ca51-4011-b7e0-aec636540d59?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.100","to_inclusive":true,"patched_in":"2.6.101"}],"published":"2026-02-13T18:31:39Z","updated":"2026-05-04T19:24:18Z"},{"id":"wordfence:381ec612-2086-4925-98cd-652a6c2ac081","source":"wordfence","cve":"CVE-2023-51695","title":"Everest Forms <= 2.0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381ec612-2086-4925-98cd-652a6c2ac081?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"2.0.4.1","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:381ecc5f-5961-4756-9685-fda3990bc3a3","source":"wordfence","cve":"CVE-2025-58989","title":"Dynamic Text Field For Contact Form 7 <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/381ecc5f-5961-4756-9685-fda3990bc3a3?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-text-field-for-contact-form-7","name":"Dynamic Text Field For Contact Form 7","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:10:35Z"},{"id":"wordfence:38227a1c-30a7-436c-853f-7205e421bd19","source":"wordfence","cve":"CVE-2026-57349","title":"WPeMatico RSS Feed Fetcher <= 2.8.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38227a1c-30a7-436c-853f-7205e421bd19?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.17","to_inclusive":true,"patched_in":"2.8.18"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T20:01:43Z"},{"id":"wordfence:3823fedd-f5b9-420d-98b5-8b7bfc6b02de","source":"wordfence","cve":"CVE-2024-54243","title":"Echoza <= 0.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3823fedd-f5b9-420d-98b5-8b7bfc6b02de?source=api-prod","affected":[{"type":"plugin","slug":"echoza","name":"Echoza","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-18T16:04:59Z"},{"id":"wordfence:38257dbf-288e-4028-af65-85f5389888ac","source":"wordfence","cve":"CVE-2025-3247","title":"Contact Form 7 <= 6.0.5 - Order Replay Vulnerability","severity":"medium","cvss":5.3,"cwe":"CWE-354","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2025-04-15T16:56:22Z","updated":"2026-05-13T19:46:13Z"},{"id":"wordfence:3825c80c-e4b1-4dd8-be77-38f718920b9a","source":"wordfence","cve":"CVE-2025-2009","title":"Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3825c80c-e4b1-4dd8-be77-38f718920b9a?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.7","to_inclusive":true,"patched_in":"4.9.9.8"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T08:21:51Z"},{"id":"wordfence:3826e2f8-3d91-4e07-84c8-8c88b374764b","source":"wordfence","cve":"CVE-2024-56273","title":"WPvivid Backup and Migration <= 0.9.106 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3826e2f8-3d91-4e07-84c8-8c88b374764b?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.106","to_inclusive":true,"patched_in":"0.9.107"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:58:58Z"},{"id":"wordfence:382837d9-ebc5-4200-bd7c-13e982ac921b","source":"wordfence","cve":"CVE-2026-49078","title":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software <= 6.7.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/382837d9-ebc5-4200-bd7c-13e982ac921b?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.7.11"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:31:39Z"},{"id":"wordfence:382a46c2-9fec-4642-93b0-c06b9ed1c086","source":"wordfence","cve":"CVE-2024-10319","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/382a46c2-9fec-4642-93b0-c06b9ed1c086?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.6.1"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-05T11:00:48Z"},{"id":"wordfence:382dcf3d-1290-4e97-b0d6-a4b34461f8a4","source":"wordfence","cve":"","title":"Plausible Analytics <= 1.2.3 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/382dcf3d-1290-4e97-b0d6-a4b34461f8a4?source=api-prod","affected":[{"type":"plugin","slug":"plausible-analytics","name":"Plausible Analytics","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:382de43a-a714-4538-be12-76e74ad77327","source":"wordfence","cve":"CVE-2025-6673","title":"Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/382de43a-a714-4538-be12-76e74ad77327?source=api-prod","affected":[{"type":"plugin","slug":"easy-pdf-restaurant-menu-upload","name":"Easy restaurant menu manager","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-07-03T19:04:40Z","updated":"2025-07-04T07:22:18Z"},{"id":"wordfence:38307432-399e-4887-867c-9eb2a0d90d70","source":"wordfence","cve":"CVE-2023-45102","title":"Blog Manager Light <= 1.20 - Cross-Site Request Forgery via bml_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38307432-399e-4887-867c-9eb2a0d90d70?source=api-prod","affected":[{"type":"plugin","slug":"blog-manager-light","name":"Blog Manager Light","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3830ae19-cafc-40db-afde-2424cae23031","source":"wordfence","cve":"CVE-2025-13054","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.14.8","to_inclusive":true,"patched_in":"3.14.9"}],"published":"2025-11-18T16:29:27Z","updated":"2025-11-19T05:45:13Z"},{"id":"wordfence:3830c901-be36-4c4b-976b-d388b6af0c67","source":"wordfence","cve":"CVE-2024-1689","title":"WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+)  Plugin Module Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3830c901-be36-4c4b-976b-d388b6af0c67?source=api-prod","affected":[{"type":"plugin","slug":"woo-tools","name":"WooCommerce Tools","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2024-06-06T00:00:00Z","updated":"2024-10-24T18:49:16Z"},{"id":"wordfence:38318605-40f7-4676-b409-f98a6c27cbfe","source":"wordfence","cve":"CVE-2026-11364","title":"Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38318605-40f7-4676-b409-f98a6c27cbfe?source=api-prod","affected":[{"type":"plugin","slug":"product-specifications","name":"Product Specifications for Woocommerce","from":"*","from_inclusive":true,"to":"0.8.9","to_inclusive":true,"patched_in":"0.8.10"}],"published":"2026-06-26T17:56:32Z","updated":"2026-06-27T06:50:56Z"},{"id":"wordfence:383309cc-d890-4ea6-9e77-5297fd631035","source":"wordfence","cve":"CVE-2026-13169","title":"Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/383309cc-d890-4ea6-9e77-5297fd631035?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T19:48:15Z"},{"id":"wordfence:3837a55c-db77-4920-b2f6-c6a5a7faedf1","source":"wordfence","cve":"CVE-2026-16565","title":"Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3837a55c-db77-4920-b2f6-c6a5a7faedf1?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:41:00Z"},{"id":"wordfence:3838bb64-fd85-43a4-97a2-7ca7930697ad","source":"wordfence","cve":"CVE-2026-12113","title":"Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3838bb64-fd85-43a4-97a2-7ca7930697ad?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.02","to_inclusive":true,"patched_in":"1.4.03"}],"published":"2026-06-30T16:22:00Z","updated":"2026-07-01T04:32:26Z"},{"id":"wordfence:38391221-c435-4672-809a-ebabf639c9bb","source":"wordfence","cve":"CVE-2025-10269","title":"Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38391221-c435-4672-809a-ebabf639c9bb?source=api-prod","affected":[{"type":"plugin","slug":"spirit-framework","name":"Spirit Framework","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-12T02:24:32Z"},{"id":"wordfence:3839257c-4ba2-442a-8d47-dd5c1e5561a8","source":"wordfence","cve":"","title":"Automatic Domain Changer <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3839257c-4ba2-442a-8d47-dd5c1e5561a8?source=api-prod","affected":[{"type":"plugin","slug":"automatic-domain-changer","name":"Automatic Domain Changer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38398f29-1bd7-4f15-9d7e-7ad52264f5c7","source":"wordfence","cve":"CVE-2024-37928","title":"Jobmonster < 4.7.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38398f29-1bd7-4f15-9d7e-7ad52264f5c7?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":false,"patched_in":"4.7.5"}],"published":"2024-07-09T00:00:00Z","updated":"2025-01-13T14:40:03Z"},{"id":"wordfence:383a49c2-3239-44ee-b36b-116b73dce9f2","source":"wordfence","cve":"CVE-2024-51668","title":"MyCurator Content Curation <= 3.78 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/383a49c2-3239-44ee-b36b-116b73dce9f2?source=api-prod","affected":[{"type":"plugin","slug":"mycurator","name":"MyCurator Content Curation","from":"*","from_inclusive":true,"to":"3.78","to_inclusive":true,"patched_in":"3.79"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:59:22Z"},{"id":"wordfence:383a9771-1128-4993-bfb8-443ed26804fd","source":"wordfence","cve":"CVE-2026-65524","title":"Avada Custom Branding <= 1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/383a9771-1128-4993-bfb8-443ed26804fd?source=api-prod","affected":[{"type":"plugin","slug":"fusion-white-label-branding","name":"Avada Custom Branding","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:09:31Z"},{"id":"wordfence:383c7837-e7b7-4608-9cdc-91b7dbc7f4e2","source":"wordfence","cve":"CVE-2023-6855","title":"Paid Memberships Pro <= 2.12.5 - Missing Authorization via API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/383c7837-e7b7-4608-9cdc-91b7dbc7f4e2?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.6"}],"published":"2023-12-21T00:00:00Z","updated":"2024-07-29T21:36:10Z"},{"id":"wordfence:383da457-b930-470c-a68a-db3e87af7a80","source":"wordfence","cve":"CVE-2023-52128","title":"White Label <= 2.9.0 - Cross-Site Request Forgery via white_label_reset_wl_admins","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/383da457-b930-470c-a68a-db3e87af7a80?source=api-prod","affected":[{"type":"plugin","slug":"white-label","name":"White Label \u2013 WordPress Custom Admin, Custom Login Page, and Custom Dashboard","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38483c50-52cf-44c5-9bc4-c5dc0baee162","source":"wordfence","cve":"CVE-2024-37100","title":"Elegant Themes Icons <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38483c50-52cf-44c5-9bc4-c5dc0baee162?source=api-prod","affected":[{"type":"plugin","slug":"elegant-themes-icons","name":"Elegant Themes Icons","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T15:13:09Z"},{"id":"wordfence:384b3185-2766-4e31-b751-e46ea26656a2","source":"wordfence","cve":"CVE-2026-39799","title":"WP File Download <= 6.3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/384b3185-2766-4e31-b751-e46ea26656a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download","name":"WP File Download","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-16T08:01:57Z"},{"id":"wordfence:384d690c-a1fd-4b97-9f7b-88b1ef1cee4f","source":"wordfence","cve":"CVE-2024-34559","title":"Ghost <= 1.4.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/384d690c-a1fd-4b97-9f7b-88b1ef1cee4f?source=api-prod","affected":[{"type":"plugin","slug":"ghost","name":"Ghost","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:50:35Z"},{"id":"wordfence:385235e0-be33-49c6-bcde-27f3cd936ddf","source":"wordfence","cve":"CVE-2024-50475","title":"Signup Page <= 1.0 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385235e0-be33-49c6-bcde-27f3cd936ddf?source=api-prod","affected":[{"type":"plugin","slug":"signup-page","name":"Signup Page","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:10:46Z"},{"id":"wordfence:38526b0c-a5d9-4f54-bd6f-30ab34d266f5","source":"wordfence","cve":"CVE-2022-44584","title":"WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38526b0c-a5d9-4f54-bd6f-30ab34d266f5?source=api-prod","affected":[{"type":"plugin","slug":"watchtowerhq","name":"WatchTowerHQ","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":true,"patched_in":"3.6.16"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3852aef6-42e7-4b71-a1ba-dd41284fd07b","source":"wordfence","cve":"CVE-2026-2942","title":"ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3852aef6-42e7-4b71-a1ba-dd41284fd07b?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-04-08T05:07:38Z","updated":"2026-04-08T17:25:51Z"},{"id":"wordfence:3852cdf8-70f7-4eba-9083-def6e5299043","source":"wordfence","cve":"CVE-2025-32565","title":"Neon Product Designer <= 2.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3852cdf8-70f7-4eba-9083-def6e5299043?source=api-prod","affected":[{"type":"plugin","slug":"neon-product-designer-for-woocommerce","name":"Neon Product Designer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T21:00:14Z"},{"id":"wordfence:38537a5e-7e36-4c94-9d27-59a53dada47b","source":"wordfence","cve":"CVE-2024-13390","title":"ADFO \u2013 Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38537a5e-7e36-4c94-9d27-59a53dada47b?source=api-prod","affected":[{"type":"plugin","slug":"admin-form","name":"ADFO \u2013 Custom data in admin dashboard","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:31:04Z","updated":"2025-02-19T07:32:07Z"},{"id":"wordfence:38537f60-52f4-4007-b26f-6948b9263931","source":"wordfence","cve":"CVE-2023-40326","title":"Putler Connector for WooCommerce <= 2.12.0 - Missing Authorization via 'send_resync_request'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38537f60-52f4-4007-b26f-6948b9263931?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-putler-connector","name":"Putler \u2013 Simple WooCommerce Analytics for your Store","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2023-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3853f4b7-dfac-454c-857d-c5929d4adb36","source":"wordfence","cve":"CVE-2025-69044","title":"Vango <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3853f4b7-dfac-454c-857d-c5929d4adb36?source=api-prod","affected":[{"type":"theme","slug":"vango","name":"Vango - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:27:52Z"},{"id":"wordfence:3856289b-6e82-4d05-afa2-ea561a4e5c30","source":"wordfence","cve":"CVE-2024-49608","title":"GERRYWORKS Post by Mail <= 1.0 - Contributor+ Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3856289b-6e82-4d05-afa2-ea561a4e5c30?source=api-prod","affected":[{"type":"plugin","slug":"gerryworks-post-by-mail","name":"GERRYWORKS Post by Mail","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:44:47Z"},{"id":"wordfence:385a82ff-50ad-4787-845b-fb5f639f6466","source":"wordfence","cve":"CVE-2023-40680","title":"Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385a82ff-50ad-4787-845b-fb5f639f6466?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"21.0","to_inclusive":true,"patched_in":"21.1"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:385c01fc-bed8-4c12-b420-9aecf4857434","source":"wordfence","cve":"CVE-2017-1002021","title":"Surveys <= 1.01.8 -  SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385c01fc-bed8-4c12-b420-9aecf4857434?source=api-prod","affected":[{"type":"plugin","slug":"surveys","name":"surveys","from":"*","from_inclusive":true,"to":"1.01.8","to_inclusive":true,"patched_in":""}],"published":"2017-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:385c6324-3d8e-4dc7-b8ca-309b05e7bdcc","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in saveconfig function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385c6324-3d8e-4dc7-b8ca-309b05e7bdcc?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:385ec22b-a692-4ecf-bd5d-c5b5e6d29bc6","source":"wordfence","cve":"CVE-2026-32571","title":"Ohio Extra <= 3.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385ec22b-a692-4ecf-bd5d-c5b5e6d29bc6?source=api-prod","affected":[{"type":"plugin","slug":"ohio-extra","name":"Ohio Extra","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:35:01Z","updated":"2026-10-08T23:19:38Z"},{"id":"wordfence:385f5f37-6be8-4736-91ca-0dd6f1d762a9","source":"wordfence","cve":"CVE-2024-50436","title":"Clean Retina <= 3.0.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/385f5f37-6be8-4736-91ca-0dd6f1d762a9?source=api-prod","affected":[{"type":"theme","slug":"clean-retina","name":"Clean Retina","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:57:36Z"},{"id":"wordfence:3861776a-be47-44e4-84b5-b3c31856e162","source":"wordfence","cve":"CVE-2025-22731","title":"Build Private Store For Woocommerce <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3861776a-be47-44e4-84b5-b3c31856e162?source=api-prod","affected":[{"type":"plugin","slug":"build-private-store-for-woocommerce","name":"Build Private Store For WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:45:32Z"},{"id":"wordfence:3861f675-1a26-4947-91ef-8ab04646704f","source":"wordfence","cve":"CVE-2023-3170","title":"tagDiv Composer <= 4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3861f675-1a26-4947-91ef-8ab04646704f?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3863cc3a-7532-4925-9b59-909cfd45501a","source":"wordfence","cve":"CVE-2026-86803","title":"Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3863cc3a-7532-4925-9b59-909cfd45501a?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-10-14T16:43:48Z","updated":"2026-10-15T05:30:21Z"},{"id":"wordfence:3864a9e4-479a-4487-a48d-4bd013a337d3","source":"wordfence","cve":"CVE-2026-10835","title":"SALESmanago & Leadoo <= 3.11.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3864a9e4-479a-4487-a48d-4bd013a337d3?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2026-06-05T00:00:00Z","updated":"2026-08-21T13:05:32Z"},{"id":"wordfence:38672a45-b7a7-445f-9e77-7050df6920fa","source":"wordfence","cve":"CVE-2024-13409","title":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38672a45-b7a7-445f-9e77-7050df6920fa?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-01-23T21:41:35Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:3867a514-2b02-4bb6-80bc-501dc845a193","source":"wordfence","cve":"CVE-2024-51679","title":"Appointmind <= 4.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3867a514-2b02-4bb6-80bc-501dc845a193?source=api-prod","affected":[{"type":"plugin","slug":"appointmind","name":"Appointmind","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:37:02Z"},{"id":"wordfence:386d907e-bc05-40d7-8a43-c807927e8a9a","source":"wordfence","cve":"CVE-2025-54702","title":"Ebook Store <= 5.8013 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/386d907e-bc05-40d7-8a43-c807927e8a9a?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8013","to_inclusive":true,"patched_in":"5.8014"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:02:02Z"},{"id":"wordfence:386eea84-0b86-46c8-99a2-c73696ae09be","source":"wordfence","cve":"","title":"RokNewsPager <= 1.17 - Denial of Service","severity":"critical","cvss":9.1,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/386eea84-0b86-46c8-99a2-c73696ae09be?source=api-prod","affected":[{"type":"plugin","slug":"wp_roknewspager","name":"RokNewsPager","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38702239-604a-415c-a8f5-2444d937727e","source":"wordfence","cve":"CVE-2025-31892","title":"WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38702239-604a-415c-a8f5-2444d937727e?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-23T13:33:56Z"},{"id":"wordfence:3870fe43-bece-4a3c-99cf-03393beab78a","source":"wordfence","cve":"CVE-2024-35760","title":"WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3870fe43-bece-4a3c-99cf-03393beab78a?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-01T19:30:33Z"},{"id":"wordfence:3871b908-a9a1-4c35-8a8d-d1a609db475a","source":"wordfence","cve":"CVE-2014-4554","title":"SS Downloads <= 1.4.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3871b908-a9a1-4c35-8a8d-d1a609db475a?source=api-prod","affected":[{"type":"plugin","slug":"ss-downloads","name":"SS Downloads","from":"*","from_inclusive":true,"to":"1.4.4.1","to_inclusive":true,"patched_in":"1.5"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3871bae4-f954-4692-8af8-1f96f8fcb778","source":"wordfence","cve":"CVE-2022-4047","title":"Return Refund and Exchange For WooCommerce <= 4.0.8 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3871bae4-f954-4692-8af8-1f96f8fcb778?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3872211b-b7d9-4d71-a371-9099392b4678","source":"wordfence","cve":"CVE-2026-96565","title":"WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3872211b-b7d9-4d71-a371-9099392b4678?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-11-06T22:49:51Z","updated":"2026-11-07T11:26:27Z"},{"id":"wordfence:38743972-a82c-451e-a637-7812222de7a4","source":"wordfence","cve":"CVE-2025-23760","title":"Chatter <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38743972-a82c-451e-a637-7812222de7a4?source=api-prod","affected":[{"type":"plugin","slug":"chatter","name":"Chatter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:47:24Z"},{"id":"wordfence:387515f7-5c03-4902-9671-3ea9f6a1a66b","source":"wordfence","cve":"","title":"Easy PayPal Events <= 1.1.6 - Reflected Cross-Site Scripting via Page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387515f7-5c03-4902-9671-3ea9f6a1a66b?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-events-tickets","name":"Easy PayPal Events & Tickets","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:387845f9-56ca-4581-bb3f-a933fbaa45c4","source":"wordfence","cve":"CVE-2024-37478","title":"Ashe <= 2.233 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387845f9-56ca-4581-bb3f-a933fbaa45c4?source=api-prod","affected":[{"type":"theme","slug":"ashe","name":"Ashe","from":"*","from_inclusive":true,"to":"2.233","to_inclusive":true,"patched_in":"2.234"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:11:26Z"},{"id":"wordfence:387ab7c1-0ca2-41e0-b6a1-ed33e7b02cad","source":"wordfence","cve":"","title":"Love Travel 2.0 - 3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387ab7c1-0ca2-41e0-b6a1-ed33e7b02cad?source=api-prod","affected":[{"type":"theme","slug":"lovetravel","name":"Love Travel","from":"2.0","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2020-09-09T00:00:00Z","updated":"2026-02-25T18:35:15Z"},{"id":"wordfence:387ccc20-1b84-4e7c-b4bc-75ad6dad8376","source":"wordfence","cve":"CVE-2024-34793","title":"WP Next Post Navi <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387ccc20-1b84-4e7c-b4bc-75ad6dad8376?source=api-prod","affected":[{"type":"plugin","slug":"wp-next-post-navi","name":"WP Next Post Navi","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:05:51Z"},{"id":"wordfence:387d28fa-f582-4d68-a781-fc210ef5bd30","source":"wordfence","cve":"CVE-2024-3241","title":"Ultimate Blocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387d28fa-f582-4d68-a781-fc210ef5bd30?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-04-23T00:00:00Z","updated":"2024-05-06T13:58:24Z"},{"id":"wordfence:387e1998-f6b1-4a9f-86a8-cd0b10202df6","source":"wordfence","cve":"CVE-2024-35757","title":"Easy Age Verify <= 1.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387e1998-f6b1-4a9f-86a8-cd0b10202df6?source=api-prod","affected":[{"type":"plugin","slug":"easy-age-verify","name":"Easy Age Verify","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-01T19:23:55Z"},{"id":"wordfence:387e7f52-8e17-4d4d-8479-1ff07ba036d3","source":"wordfence","cve":"CVE-2025-67564","title":"Pixel Manager for WooCommerce <= 1.51.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387e7f52-8e17-4d4d-8479-1ff07ba036d3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.51.1","to_inclusive":true,"patched_in":"1.52.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:29:45Z"},{"id":"wordfence:387f7ee0-6b1e-4862-8270-dbb3aee70a7e","source":"wordfence","cve":"CVE-2026-48886","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/387f7ee0-6b1e-4862-8270-dbb3aee70a7e?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:49:22Z"},{"id":"wordfence:38826657-ee20-4743-baef-de735a01f4d5","source":"wordfence","cve":"CVE-2026-14920","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38826657-ee20-4743-baef-de735a01f4d5?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":false,"patched_in":"10.11.1"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:16:12Z"},{"id":"wordfence:3884cb24-3f46-4feb-a6b9-4445ca8fd0e6","source":"wordfence","cve":"CVE-2021-20840","title":"Booking Package <= 1.5.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3884cb24-3f46-4feb-a6b9-4445ca8fd0e6?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":false,"patched_in":"1.5.11"}],"published":"2021-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38870e14-2e8f-4281-adb6-4be3b1d3d2ce","source":"wordfence","cve":"CVE-2026-104766","title":"Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2026-10-09T17:19:05Z","updated":"2026-10-12T05:36:04Z"},{"id":"wordfence:3887a61f-03ae-4b37-a81f-1ea39a111e3c","source":"wordfence","cve":"","title":"OTP Login Woocommerce & Gravity Forms <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3887a61f-03ae-4b37-a81f-1ea39a111e3c?source=api-prod","affected":[{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3889aa6f-987a-4a2d-80fd-28628a6ed287","source":"wordfence","cve":"CVE-2025-9894","title":"Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3889aa6f-987a-4a2d-80fd-28628a6ed287?source=api-prod","affected":[{"type":"plugin","slug":"sync-feedly","name":"Sync Feedly","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:34:19Z","updated":"2025-09-27T06:47:14Z"},{"id":"wordfence:3889d01d-a961-46b9-a86e-8ab19641cf2d","source":"wordfence","cve":"CVE-2025-27264","title":"Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3889d01d-a961-46b9-a86e-8ab19641cf2d?source=api-prod","affected":[{"type":"plugin","slug":"doctor-appointment-booking","name":"Doctor Appointment Booking","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:46:00Z"},{"id":"wordfence:388ce0d2-47d9-4c45-904c-ed7ef25b3416","source":"wordfence","cve":"CVE-2025-66084","title":"FluentCommunity <= 2.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/388ce0d2-47d9-4c45-904c-ed7ef25b3416?source=api-prod","affected":[{"type":"plugin","slug":"fluent-community","name":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T17:32:23Z"},{"id":"wordfence:3891a807-aace-460a-ad49-6a282af16084","source":"wordfence","cve":"CVE-2024-13728","title":"Accept Donations with PayPal & Stripe <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3891a807-aace-460a-ad49-6a282af16084?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-02-22T16:23:11Z","updated":"2025-02-23T05:22:34Z"},{"id":"wordfence:3892489e-6ff7-4664-bb06-b8edff6dd659","source":"wordfence","cve":"CVE-2026-4019","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3892489e-6ff7-4664-bb06-b8edff6dd659?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.4.5","to_inclusive":true,"patched_in":"7.4.6"}],"published":"2026-04-28T19:52:18Z","updated":"2026-04-29T08:27:45Z"},{"id":"wordfence:3892579a-d7fd-4f11-88fd-7452fa312000","source":"wordfence","cve":"CVE-2025-24620","title":"Best WordPress Shortcode Plugin in 2025 \u2013 AIO Shortcodes <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3892579a-d7fd-4f11-88fd-7452fa312000?source=api-prod","affected":[{"type":"plugin","slug":"aio-shortcodes","name":"Best WordPress Shortcode Plugin in 2025 \u2013 AIO Shortcodes","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-02-21T14:31:57Z"},{"id":"wordfence:389277fd-e47e-42df-9305-61ceedbcfb29","source":"wordfence","cve":"","title":"LearnPress <= 4.2.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389277fd-e47e-42df-9305-61ceedbcfb29?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.3.1","to_inclusive":false,"patched_in":"4.2.3.1"}],"published":"2023-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:389364b7-4ab9-41b2-86f0-d30393e08146","source":"wordfence","cve":"CVE-2026-39711","title":"RT-Theme 18 | Extensions <= 2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389364b7-4ab9-41b2-86f0-d30393e08146?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-05T15:48:01Z"},{"id":"wordfence:38937a73-2723-4328-97fd-b1c2e7dac508","source":"wordfence","cve":"CVE-2025-46234","title":"Control Listings <= 1.0.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38937a73-2723-4328-97fd-b1c2e7dac508?source=api-prod","affected":[{"type":"plugin","slug":"control-listings","name":"Control Listings \u2013 Classifieds Ads Directory Portal Manager","from":"*","from_inclusive":true,"to":"1.0.4.1","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:40:15Z"},{"id":"wordfence:3895df7a-9f24-45a5-b447-16f214cfbfcc","source":"wordfence","cve":"CVE-2025-4584","title":"IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3895df7a-9f24-45a5-b447-16f214cfbfcc?source=api-prod","affected":[{"type":"plugin","slug":"irm-newsroom","name":"IRM Newsroom","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2025-06-12T13:12:15Z","updated":"2025-11-05T21:35:43Z"},{"id":"wordfence:38979e27-2023-4f84-a708-1732b4117066","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38979e27-2023-4f84-a708-1732b4117066?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3897d9fa-1f08-4178-8bb5-681dba1a7863","source":"wordfence","cve":"CVE-2026-110366","title":"Site Reviews <= 8.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3897d9fa-1f08-4178-8bb5-681dba1a7863?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2026-10-16T06:53:00Z","updated":"2026-10-23T18:18:23Z"},{"id":"wordfence:3898ff24-3a9c-4aba-af76-2d2e99fd1693","source":"wordfence","cve":"CVE-2025-53998","title":"JetWooBuilder <= 2.1.20 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3898ff24-3a9c-4aba-af76-2d2e99fd1693?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.1.20.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:15:05Z"},{"id":"wordfence:389a4e32-81c4-4060-b210-b6ca6beeaf48","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389a4e32-81c4-4060-b210-b6ca6beeaf48?source=api-prod","affected":[{"type":"plugin","slug":"mapsmarker","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:389bee79-b59f-484a-86df-f041d6b00051","source":"wordfence","cve":"CVE-2025-14477","title":"404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389bee79-b59f-484a-86df-f041d6b00051?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-12-12T15:01:14Z","updated":"2025-12-13T03:20:24Z"},{"id":"wordfence:389c0b89-e408-4ad5-9723-a16b745771f0","source":"wordfence","cve":"CVE-2026-3300","title":"Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms-pro","name":"Everest Forms Pro","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2026-03-30T12:00:40Z","updated":"2026-03-31T01:24:57Z"},{"id":"wordfence:389d96e9-1fad-49a6-89b6-8f7f108d8117","source":"wordfence","cve":"CVE-2024-5945","title":"WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/389d96e9-1fad-49a6-89b6-8f7f108d8117?source=api-prod","affected":[{"type":"plugin","slug":"wp-svg-images","name":"WP SVG Images","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2024-06-20T00:00:00Z","updated":"2025-01-31T15:29:34Z"},{"id":"wordfence:38a079c8-181c-4bd8-a45d-e132711029ff","source":"wordfence","cve":"CVE-2023-0255","title":"Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a079c8-181c-4bd8-a45d-e132711029ff?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38a1fb65-b0f6-4d3a-9b07-c40f80de4685","source":"wordfence","cve":"CVE-2025-49924","title":"Wholesale Suite <= 2.2.4.2 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a1fb65-b0f6-4d3a-9b07-c40f80de4685?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.2.4.2","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-07-23T00:00:00Z","updated":"2025-11-04T18:19:09Z"},{"id":"wordfence:38a3b3bf-9538-4ae8-9da4-d4b48805763b","source":"wordfence","cve":"CVE-2025-15267","title":"Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a3b3bf-9538-4ae8-9da4-d4b48805763b?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-02-06T17:29:16Z","updated":"2026-09-15T15:06:21Z"},{"id":"wordfence:38a405f2-344c-4ee1-a67e-5f6afad66b84","source":"wordfence","cve":"CVE-2022-1182","title":"Visual Slide Box Builder <= 3.2.9 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a405f2-344c-4ee1-a67e-5f6afad66b84?source=api-prod","affected":[{"type":"plugin","slug":"wp-visual-slidebox-builder","name":"Visual Slide Box Builder","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38a42f44-b953-4c8d-b10f-6b21dd4228d0","source":"wordfence","cve":"CVE-2025-47613","title":"School Management <= 92.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a42f44-b953-4c8d-b10f-6b21dd4228d0?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:43:15Z"},{"id":"wordfence:38a5be0c-f905-4e27-b5c3-8c0606d71a61","source":"wordfence","cve":"CVE-2023-51401","title":"Ultimate Addons for Beaver Builder <= 1.35.13 - Authenticated(Contributor+) Directory Traversal to Arbitrary File Download","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a5be0c-f905-4e27-b5c3-8c0606d71a61?source=api-prod","affected":[{"type":"plugin","slug":"bb-ultimate-addon","name":"Ultimate Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.35.13","to_inclusive":true,"patched_in":"1.35.14"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38a87046-9a46-40c2-b10d-d1a7d5ef8742","source":"wordfence","cve":"CVE-2024-2948","title":"Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a87046-9a46-40c2-b10d-d1a7d5ef8742?source=api-prod","affected":[{"type":"plugin","slug":"favorites","name":"Favorites","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-03-29T00:00:00Z","updated":"2024-10-24T19:09:17Z"},{"id":"wordfence:38a90190-569f-46d8-bef4-fe28caf5e2fc","source":"wordfence","cve":"CVE-2023-52231","title":"Booster Plus for WooCommerce < 7.1.2 - Missing Authorization to Order Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38a90190-569f-46d8-bef4-fe28caf5e2fc?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":false,"patched_in":"7.1.2"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38aa649c-e9d3-458b-b567-e2e751aaca00","source":"wordfence","cve":"CVE-2025-1327","title":"Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38aa649c-e9d3-458b-b567-e2e751aaca00?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:18Z"},{"id":"wordfence:38adede2-73ca-470c-8ace-4f5bbec51d28","source":"wordfence","cve":"","title":"Simple Calendar <= 3.2.4 - Cross-Site Request Forgery via duplicate_feed","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38adede2-73ca-470c-8ace-4f5bbec51d28?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38af4b11-c36a-441e-b49c-c3ad9ddfd210","source":"wordfence","cve":"CVE-2025-32176","title":"Gallery Blocks with Lightbox <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38af4b11-c36a-441e-b49c-c3ad9ddfd210?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-23T17:15:57Z"},{"id":"wordfence:38b27ee7-0e92-47ad-89f8-1a3c8d5c9442","source":"wordfence","cve":"CVE-2008-4769","title":"WordPress Core <= 2.3.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b27ee7-0e92-47ad-89f8-1a3c8d5c9442?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.5.1"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.5","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2008-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38b2b477-5b8a-42c2-b346-57707d9a34a5","source":"wordfence","cve":"CVE-2025-12042","title":"Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b2b477-5b8a-42c2-b346-57707d9a34a5?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-system","name":"Course Booking System","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:48Z"},{"id":"wordfence:38b37788-1c41-4410-a830-1f5fdbb34835","source":"wordfence","cve":"CVE-2026-27082","title":"Love Story <= 1.3.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b37788-1c41-4410-a830-1f5fdbb34835?source=api-prod","affected":[{"type":"theme","slug":"lovestory","name":"Love Story | Wedding and Event Planner WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:41:19Z"},{"id":"wordfence:38b514ea-d25e-45c0-b1bb-beec5cffe7b0","source":"wordfence","cve":"CVE-2025-22513","title":"Simple Locator <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b514ea-d25e-45c0-b1bb-beec5cffe7b0?source=api-prod","affected":[{"type":"plugin","slug":"simple-locator","name":"Simple Locator","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-11-19T16:43:14Z"},{"id":"wordfence:38b63167-e1a6-4279-97cf-900df0651f20","source":"wordfence","cve":"CVE-2023-5561","title":"WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b63167-e1a6-4279-97cf-900df0651f20?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"4.7.27"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38b8151f-4938-4101-9886-783f54984d20","source":"wordfence","cve":"CVE-2022-4905","title":"WP-Stateless \u2013 Google Cloud Storage <= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b8151f-4938-4101-9886-783f54984d20?source=api-prod","affected":[{"type":"plugin","slug":"wp-stateless","name":"WP-Stateless \u2013 Google Cloud Storage","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2022-05-06T00:00:00Z","updated":"2026-03-27T11:09:58Z"},{"id":"wordfence:38b8b563-10a4-4343-b95a-7d09cf6fd729","source":"wordfence","cve":"CVE-2025-15377","title":"Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b8b563-10a4-4343-b95a-7d09cf6fd729?source=api-prod","affected":[{"type":"plugin","slug":"sosh-share-buttons","name":"Sosh Share Buttons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:22:47Z","updated":"2026-01-14T05:28:06Z"},{"id":"wordfence:38b9a64f-a83a-4c0f-88df-383652fde986","source":"wordfence","cve":"CVE-2024-33909","title":"iPages Flipbook <= 1.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38b9a64f-a83a-4c0f-88df-383652fde986?source=api-prod","affected":[{"type":"plugin","slug":"ipages-flipbook","name":"iPages \u2013 FlipBook Image & PDF Viewer","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-15T19:46:41Z"},{"id":"wordfence:38bbfc7f-dd86-486e-a2d3-4f26fd9ee3c0","source":"wordfence","cve":"CVE-2026-62111","title":"Simple Payment <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38bbfc7f-dd86-486e-a2d3-4f26fd9ee3c0?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:26:02Z"},{"id":"wordfence:38bcb908-1e6e-44be-9cf5-72dcfa4c4a4e","source":"wordfence","cve":"CVE-2014-4972","title":"Gravity Upload Ajax <= 1.1 - Unrestricted File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38bcb908-1e6e-44be-9cf5-72dcfa4c4a4e?source=api-prod","affected":[{"type":"plugin","slug":"gravity-file-ajax-upload-free","name":"gravity-file-ajax-upload-free","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38bd6efd-41d5-4bb1-982c-31d20b4c0a1d","source":"wordfence","cve":"CVE-2024-7083","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers < 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38bd6efd-41d5-4bb1-982c-31d20b4c0a1d?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2026-04-21T00:00:00Z","updated":"2026-09-04T17:23:32Z"},{"id":"wordfence:38bf21c4-bf2e-4096-b4e3-9e3a5a60f1ad","source":"wordfence","cve":"CVE-2018-20972","title":"Companion Auto Update <= 3.2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38bf21c4-bf2e-4096-b4e3-9e3a5a60f1ad?source=api-prod","affected":[{"type":"plugin","slug":"companion-auto-update","name":"Companion Auto Update","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2018-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38bf5451-5042-48ad-a189-699e1e7abf07","source":"wordfence","cve":"CVE-2026-24944","title":"Subscribe2 <= 10.44 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38bf5451-5042-48ad-a189-699e1e7abf07?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.44","to_inclusive":true,"patched_in":"10.45"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:41:47Z"},{"id":"wordfence:38c23f59-8332-49ab-a219-1f5fac8a283c","source":"wordfence","cve":"CVE-2025-7640","title":"hiWeb Export Posts <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38c23f59-8332-49ab-a219-1f5fac8a283c?source=api-prod","affected":[{"type":"plugin","slug":"hiweb-export-posts","name":"hiWeb Export Posts","from":"*","from_inclusive":true,"to":"0.9.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:47:08Z","updated":"2025-07-24T09:22:15Z"},{"id":"wordfence:38c4b72f-ec83-400f-8b93-a6dbf1430893","source":"wordfence","cve":"CVE-2026-121575","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38c4b72f-ec83-400f-8b93-a6dbf1430893?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2026-11-07T12:38:00Z","updated":"2026-11-10T19:44:00Z"},{"id":"wordfence:38c6b149-39d7-491a-9f3a-261087a52a03","source":"wordfence","cve":"CVE-2025-3610","title":"Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38c6b149-39d7-491a-9f3a-261087a52a03?source=api-prod","affected":[{"type":"plugin","slug":"short-tax-post","name":"Reales WP STPT","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-05T13:03:24Z","updated":"2025-05-06T01:56:14Z"},{"id":"wordfence:38cb5e43-56d0-40b6-936a-f10f15d2e72f","source":"wordfence","cve":"CVE-2024-12501","title":"Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38cb5e43-56d0-40b6-936a-f10f15d2e72f?source=api-prod","affected":[{"type":"plugin","slug":"simple-locator","name":"Simple Locator","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:13Z"},{"id":"wordfence:38cc5a39-6ec3-4ce9-b9ad-d4ca5dafe9a7","source":"wordfence","cve":"CVE-2023-2757","title":"Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38cc5a39-6ec3-4ce9-b9ad-d4ca5dafe9a7?source=api-prod","affected":[{"type":"plugin","slug":"waiting","name":"Waiting: One-click countdowns","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38ccaa81-77ec-46f2-9bec-d74fa2e093f3","source":"wordfence","cve":"CVE-2023-5424","title":"WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection","severity":"medium","cvss":4.7,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ccaa81-77ec-46f2-9bec-d74fa2e093f3?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.9.217","to_inclusive":true,"patched_in":"1.9.218"},{"type":"plugin","slug":"ws-form-pro","name":"WS Form Pro","from":"*","from_inclusive":true,"to":"1.9.217","to_inclusive":true,"patched_in":"1.9.218"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T09:33:35Z"},{"id":"wordfence:38ce5790-f6b8-43a0-a1a3-290a86eb49cb","source":"wordfence","cve":"CVE-2026-57344","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ce5790-f6b8-43a0-a1a3-290a86eb49cb?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:08:48Z"},{"id":"wordfence:38d01b12-97ac-412b-b9df-c27118ce8f50","source":"wordfence","cve":"CVE-2026-16750","title":"Motors \u2013 Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38d01b12-97ac-412b-b9df-c27118ce8f50?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.120","to_inclusive":true,"patched_in":"1.4.121"}],"published":"2026-09-17T08:50:56Z","updated":"2026-09-17T21:28:49Z"},{"id":"wordfence:38d0c5e3-6928-4b3b-95bd-3977938a4b23","source":"wordfence","cve":"CVE-2025-62036","title":"Togo < 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38d0c5e3-6928-4b3b-95bd-3977938a4b23?source=api-prod","affected":[{"type":"theme","slug":"togo","name":"Togo \u2013 Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T15:20:50Z"},{"id":"wordfence:38d5d951-588f-4808-b691-5105021eb1e8","source":"wordfence","cve":"","title":"10WebSocial <= 1.1.26 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38d5d951-588f-4808-b691-5105021eb1e8?source=api-prod","affected":[{"type":"plugin","slug":"wd-facebook-feed","name":"10Web Social Post Feed","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":false,"patched_in":"1.1.27"}],"published":"2020-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38d6c373-5752-48fb-900d-4adeaf575fe2","source":"wordfence","cve":"CVE-2025-58816","title":"Product Carousel Slider for Elementor <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38d6c373-5752-48fb-900d-4adeaf575fe2?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-carousel-slider-for-elementor","name":"Product Carousel Slider for Elementor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T19:33:44Z"},{"id":"wordfence:38d7c79f-a4a2-447d-88a2-ad75b53ac8bc","source":"wordfence","cve":"CVE-2021-36827","title":"Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38d7c79f-a4a2-447d-88a2-ad75b53ac8bc?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2022-06-07T13:46:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38da66f4-2db8-4e8e-819f-d7dd9533e045","source":"wordfence","cve":"CVE-2024-47301","title":"Bit Form \u2013 Contact Form Plugin <= 2.13.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38da66f4-2db8-4e8e-819f-d7dd9533e045?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.13.10","to_inclusive":true,"patched_in":"2.13.11"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:42:33Z"},{"id":"wordfence:38db0ebd-681c-41a7-b3a9-daf7a9c5eb65","source":"wordfence","cve":"CVE-2025-69158","title":"Granola <= 1.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38db0ebd-681c-41a7-b3a9-daf7a9c5eb65?source=api-prod","affected":[{"type":"theme","slug":"granola","name":"Granola - SEO & Marketing Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:48:39Z"},{"id":"wordfence:38db25f7-e2d4-460a-9305-cf952d4b4991","source":"wordfence","cve":"CVE-2026-25361","title":"Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38db25f7-e2d4-460a-9305-cf952d4b4991?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:50:52Z"},{"id":"wordfence:38db911b-cad5-4c8c-b0a4-70dc543b4591","source":"wordfence","cve":"CVE-2026-9233","title":"Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38db911b-cad5-4c8c-b0a4-70dc543b4591?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.1.4","to_inclusive":true,"patched_in":"11.1.5"}],"published":"2026-06-26T17:57:43Z","updated":"2026-06-27T06:50:57Z"},{"id":"wordfence:38dd95b2-d747-44f3-a3f5-d32221381554","source":"wordfence","cve":"CVE-2022-2430","title":"Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38dd95b2-d747-44f3-a3f5-d32221381554?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.0","to_inclusive":true,"patched_in":"45.0.1"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38de34cd-b985-4552-a260-53da2106a4af","source":"wordfence","cve":"CVE-2018-14430","title":"Multi Step Form <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38de34cd-b985-4552-a260-53da2106a4af?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2018-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38e0591a-beeb-4a0b-b7a2-58594769b7da","source":"wordfence","cve":"CVE-2026-57362","title":"WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e0591a-beeb-4a0b-b7a2-58594769b7da?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"8.3.3"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:59:22Z"},{"id":"wordfence:38e3a2a4-3d35-4de9-9b44-568eab0c44f6","source":"wordfence","cve":"CVE-2026-93654","title":"Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e3a2a4-3d35-4de9-9b44-568eab0c44f6?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2026-09-24T19:07:59Z","updated":"2026-09-25T07:40:26Z"},{"id":"wordfence:38e40a74-c4b7-4960-880d-a14e77fe1904","source":"wordfence","cve":"CVE-2021-25080","title":"Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e40a74-c4b7-4960-880d-a14e77fe1904?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2021-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38e472cf-3a4d-4197-9633-7210c9fa8a0c","source":"wordfence","cve":"CVE-2026-57370","title":"Visitor Traffic Real Time Statistics pro <= 11.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e472cf-3a4d-4197-9633-7210c9fa8a0c?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.9.1","to_inclusive":true,"patched_in":"11.9.2"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T21:54:40Z"},{"id":"wordfence:38e536a5-b538-498c-b19d-adda36f76164","source":"wordfence","cve":"CVE-2023-32496","title":"StopBadBots <= 7.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e536a5-b538-498c-b19d-adda36f76164?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"7.31","to_inclusive":true,"patched_in":"7.32"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38e5dd9e-c017-4b4c-9064-76a07e30fab5","source":"wordfence","cve":"CVE-2026-1569","title":"Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e5dd9e-c017-4b4c-9064-76a07e30fab5?source=api-prod","affected":[{"type":"plugin","slug":"wueen","name":"Wueen","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:40:56Z","updated":"2026-03-07T07:22:04Z"},{"id":"wordfence:38e79548-c055-489e-850a-6fb1c2ab0d8f","source":"wordfence","cve":"CVE-2026-111597","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder < 1.58.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e79548-c055-489e-850a-6fb1c2ab0d8f?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.4","to_inclusive":false,"patched_in":"1.58.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:22Z"},{"id":"wordfence:38e8275f-477e-4d07-85b0-8bca71cd7089","source":"wordfence","cve":"CVE-2024-47321","title":"WP Datepicker <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e8275f-477e-4d07-85b0-8bca71cd7089?source=api-prod","affected":[{"type":"plugin","slug":"wp-datepicker","name":"WP Datepicker","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-09-25T00:00:00Z","updated":"2024-12-12T19:40:54Z"},{"id":"wordfence:38e831b4-8284-4fad-ac24-a2f08053c53e","source":"wordfence","cve":"CVE-2022-4226","title":"Simple Basic Contact Form <= 20220207 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38e831b4-8284-4fad-ac24-a2f08053c53e?source=api-prod","affected":[{"type":"plugin","slug":"simple-basic-contact-form","name":"Simple Basic Contact Form","from":"*","from_inclusive":true,"to":"20220207","to_inclusive":true,"patched_in":"20221201"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38ea001c-6edb-4f36-a7ec-19be1d857b9e","source":"wordfence","cve":"CVE-2026-4314","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ea001c-6edb-4f36-a7ec-19be1d857b9e?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2026-03-21T14:34:53Z","updated":"2026-03-22T03:26:34Z"},{"id":"wordfence:38ea5328-f728-45de-8edd-80fd400f0902","source":"wordfence","cve":"CVE-2026-40761","title":"Valeska <= 1.2.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ea5328-f728-45de-8edd-80fd400f0902?source=api-prod","affected":[{"type":"theme","slug":"valeska","name":"Valeska - Fashion eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:09:50Z"},{"id":"wordfence:38eaf4be-5083-46fe-b586-e4be190dc9cc","source":"wordfence","cve":"CVE-2025-11376","title":"Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38eaf4be-5083-46fe-b586-e4be190dc9cc?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.335","to_inclusive":true,"patched_in":"1.0.342"}],"published":"2025-12-12T15:37:12Z","updated":"2025-12-13T04:31:24Z"},{"id":"wordfence:38ebe1d4-4ac0-4d03-8945-451902263442","source":"wordfence","cve":"CVE-2023-0333","title":"TemplatesNext ToolKit <= 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ebe1d4-4ac0-4d03-8945-451902263442?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-toolkit","name":"TemplatesNext ToolKit","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38ec1a6b-f5ee-446a-9e6c-3485dafb85ac","source":"wordfence","cve":"CVE-2024-1535","title":"ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.2","to_inclusive":true,"patched_in":"4.15.3"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T15:26:43Z"},{"id":"wordfence:38ec647a-3c0c-4d3c-ba34-64c17803867b","source":"wordfence","cve":"CVE-2026-1003","title":"GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec647a-3c0c-4d3c-ba34-64c17803867b?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-16T07:23:11Z"},{"id":"wordfence:38efd6d6-b931-41a7-b55d-b98cdeef4145","source":"wordfence","cve":"CVE-2023-23684","title":"WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38efd6d6-b931-41a7-b55d-b98cdeef4145?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"1.14.5","to_inclusive":true,"patched_in":"1.14.6"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38f09a45-2b11-47c7-af16-c7f9c3a46e0e","source":"wordfence","cve":"CVE-2024-1095","title":"Build & Control Block Patterns \u2013 Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38f09a45-2b11-47c7-af16-c7f9c3a46e0e?source=api-prod","affected":[{"type":"plugin","slug":"control-block-patterns","name":"Build & Control Block Patterns \u2013 Boost up Gutenberg Editor","from":"*","from_inclusive":true,"to":"1.3.5.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:55:59Z"},{"id":"wordfence:38f536ae-70b7-4882-8a61-609d774a68db","source":"wordfence","cve":"","title":"Accept Donations with PayPal <= 1.3 - Reflected Cross-Site Scripting via Page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38f536ae-70b7-4882-8a61-609d774a68db?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:38f84f31-5aeb-4f6f-9e10-33e365f6f2c8","source":"wordfence","cve":"CVE-2025-47600","title":"WoodMart <= 8.3.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38f84f31-5aeb-4f6f-9e10-33e365f6f2c8?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.3.8"}],"published":"2026-01-09T00:00:00Z","updated":"2026-02-03T20:23:59Z"},{"id":"wordfence:38f950b7-e3a0-4e05-a8b0-9cc6b6c66b0c","source":"wordfence","cve":"CVE-2024-45293","title":"PHPSpreadsheet Library < 2.3.0 - XXE Injection","severity":"high","cvss":7.5,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38f950b7-e3a0-4e05-a8b0-9cc6b6c66b0c?source=api-prod","affected":[{"type":"plugin","slug":"products-stock-manager-with-excel","name":"Products Stock Manager with Excel for WooCommerce Inventory","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"4.0.1"},{"type":"plugin","slug":"woo-product-excel-importer","name":"Product Excel Import & Export for WooCommerce","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":true,"patched_in":"6.0"},{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.11.6","to_inclusive":true,"patched_in":"3.11.7"},{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"},{"type":"plugin","slug":"content-excel-importer","name":"Import Content in WordPress & WooCommerce with Excel","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"},{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"webd-woocommerce-product-excel-importer-bulk-edit","name":"Product Excel Import Export & Bulk Edit for WooCommerce","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"},{"type":"plugin","slug":"users-import-export-with-excel-for-wp","name":"Import Users & Customers | Export Users with Excel for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-10-07T00:00:00Z","updated":"2025-04-07T18:19:55Z"},{"id":"wordfence:38f95d40-a6d4-429c-9872-9d2531e942eb","source":"wordfence","cve":"CVE-2026-5718","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38f95d40-a6d4-429c-9872-9d2531e942eb?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.7","to_inclusive":true,"patched_in":"1.3.9.8"}],"published":"2026-04-17T04:37:16Z","updated":"2026-05-27T00:26:05Z"},{"id":"wordfence:38fbdd82-73ed-4be0-874e-1dfced29dc7d","source":"wordfence","cve":"CVE-2024-43320","title":"Livemesh Addons for WPBakery Page Builder <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38fbdd82-73ed-4be0-874e-1dfced29dc7d?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:31:10Z"},{"id":"wordfence:38fd8881-94f6-4330-a519-7582e253e057","source":"wordfence","cve":"CVE-2024-32131","title":"Download Manager <= 3.2.82 - Password Protected File Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38fd8881-94f6-4330-a519-7582e253e057?source=api-prod","affected":[{"type":"plugin","slug":"downloadmanager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.82","to_inclusive":true,"patched_in":"3.2.83"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:55:51Z"},{"id":"wordfence:38ff10d3-d9ce-440b-b956-002803d49f54","source":"wordfence","cve":"","title":"Job Board by BestWebSoft < 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/38ff10d3-d9ce-440b-b956-002803d49f54?source=api-prod","affected":[{"type":"plugin","slug":"job-board","name":"Job Board by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39003835-80df-49c7-982a-346bf328565c","source":"wordfence","cve":"","title":"WPGetAPI 2.1.0 - 2.2.1 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39003835-80df-49c7-982a-346bf328565c?source=api-prod","affected":[{"type":"plugin","slug":"wpgetapi","name":"WPGet API \u2013 Connect to any external REST API","from":"2.1.0","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39005c38-f60d-44fa-9121-a77039dc34de","source":"wordfence","cve":"CVE-2024-22298","title":"Amelia <= 1.0.98 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39005c38-f60d-44fa-9121-a77039dc34de?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.98","to_inclusive":true,"patched_in":"1.0.99"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-14T14:21:26Z"},{"id":"wordfence:3901764a-32c5-4969-809b-c8e7e2aebfdd","source":"wordfence","cve":"CVE-2026-100518","title":"Advanced Google reCAPTCHA <= 5.40 - Unauthenticated Login Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3901764a-32c5-4969-809b-c8e7e2aebfdd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"5.40","to_inclusive":true,"patched_in":"5.41"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:48:07Z"},{"id":"wordfence:39041c15-dc85-49bc-b5d1-5b4bff05397b","source":"wordfence","cve":"CVE-2021-24513","title":"Form Builder <= 1.9.8.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39041c15-dc85-49bc-b5d1-5b4bff05397b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-add","name":"Form Builder | Create Responsive Contact Forms","from":"*","from_inclusive":true,"to":"1.9.8.3","to_inclusive":true,"patched_in":"1.9.8.4"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3906c668-6a0a-4beb-8ed9-08f661ce82cf","source":"wordfence","cve":"CVE-2022-4668","title":"Easy Appointments <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3906c668-6a0a-4beb-8ed9-08f661ce82cf?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.10.7","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39075385-f8b8-4f40-9ec1-8f9f8d2bee0c","source":"wordfence","cve":"CVE-2026-40720","title":"Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39075385-f8b8-4f40-9ec1-8f9f8d2bee0c?source=api-prod","affected":[{"type":"plugin","slug":"wpr-addons-pro","name":"Royal Elementor Addons Pro","from":"*","from_inclusive":true,"to":"1.6.01","to_inclusive":false,"patched_in":"1.6.01"},{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1041","to_inclusive":false,"patched_in":"1.7.1041"}],"published":"2026-04-16T00:00:00Z","updated":"2026-05-21T20:49:38Z"},{"id":"wordfence:3908a923-1174-4cb4-a1e3-51b9d098dc29","source":"wordfence","cve":"CVE-2014-1232","title":"Foliopress WYSIWYG < 2.6.8.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3908a923-1174-4cb4-a1e3-51b9d098dc29?source=api-prod","affected":[{"type":"plugin","slug":"foliopress-wysiwyg","name":"Foliopress WYSIWYG","from":"*","from_inclusive":true,"to":"2.6.8.5","to_inclusive":false,"patched_in":"2.6.8.5"}],"published":"2014-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:390a541e-68dd-43dd-8fe4-5334c534552c","source":"wordfence","cve":"CVE-2026-65548","title":"Betheme <= 28.5.7 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/390a541e-68dd-43dd-8fe4-5334c534552c?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.5.7","to_inclusive":true,"patched_in":"28.5.8"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-29T00:55:24Z"},{"id":"wordfence:390e9c30-e4c0-474d-9915-dd46f5464cea","source":"wordfence","cve":"CVE-2023-0937","title":"VK All in One Expansion Unit <= 9.87.0.1 - Reflected Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/390e9c30-e4c0-474d-9915-dd46f5464cea?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.87.0.1","to_inclusive":true,"patched_in":"9.87.1.0"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:390ee957-f06f-4952-b740-4578c130925f","source":"wordfence","cve":"","title":"WP Email Users <= 1.4.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/390ee957-f06f-4952-b740-4578c130925f?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-users","name":"WP Email Users","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2017-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39192c3f-0021-4094-81c7-e74de1900d4f","source":"wordfence","cve":"CVE-2025-32681","title":"Error Log Viewer <= 1.0.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39192c3f-0021-4094-81c7-e74de1900d4f?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer-wp","name":"Error Log Viewer By WP Guru","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:58:49Z"},{"id":"wordfence:39193ebd-005a-4497-9939-99947323a1a0","source":"wordfence","cve":"CVE-2023-41683","title":"TelSender <= 1.14.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39193ebd-005a-4497-9939-99947323a1a0?source=api-prod","affected":[{"type":"plugin","slug":"telsender","name":"TelSender \u2013 \u0421ontact form 7, Events, Wpforms, ninja forms  and woocommerce to telegram bot","from":"*","from_inclusive":true,"to":"1.14.11","to_inclusive":true,"patched_in":"1.14.12"}],"published":"2023-09-04T00:00:00Z","updated":"2024-02-02T00:06:38Z"},{"id":"wordfence:391b8d9e-c57c-44d8-a060-c1b94a191522","source":"wordfence","cve":"CVE-2026-54835","title":"Five Star Restaurant Menu and Food Ordering <= 2.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391b8d9e-c57c-44d8-a060-c1b94a191522?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:53:09Z"},{"id":"wordfence:391d65a7-1675-4eae-b129-a1208cd95669","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391d65a7-1675-4eae-b129-a1208cd95669?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:391e12f7-9521-4ac6-bd78-ac28df72030b","source":"wordfence","cve":"","title":"BNG Gateway For WooCommerce <= 1.6.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391e12f7-9521-4ac6-bd78-ac28df72030b?source=api-prod","affected":[{"type":"plugin","slug":"bng-gateway-for-woocommerce","name":"BNG Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:391ec941-eb19-4505-b03a-0f4b240e8819","source":"wordfence","cve":"CVE-2021-38327","title":"YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391ec941-eb19-4505-b03a-0f4b240e8819?source=api-prod","affected":[{"type":"plugin","slug":"youtube-video-inserter","name":"YouTube Video Inserter","from":"*","from_inclusive":true,"to":"1.2.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:391ed7a2-64db-4a79-a697-86c70c60d02e","source":"wordfence","cve":"CVE-2019-5973","title":"Online Lesson Booking <= 0.8.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391ed7a2-64db-4a79-a697-86c70c60d02e?source=api-prod","affected":[{"type":"plugin","slug":"online-lesson-booking-system","name":"Online Lesson Booking","from":"*","from_inclusive":true,"to":"0.8.6","to_inclusive":true,"patched_in":"0.8.7"}],"published":"2019-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:391ef7e0-d4e6-4c2e-b15e-65bdba190b69","source":"wordfence","cve":"","title":"Easy Drag And drop All Import : WP Ultimate CSV Importer < 6.4.1 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391ef7e0-d4e6-4c2e-b15e-65bdba190b69?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":false,"patched_in":"6.4.1"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:391f76a1-098b-4b88-be71-4270d9942c66","source":"wordfence","cve":"CVE-2025-57919","title":"Language Translate Widget for WordPress \u2013 ConveyThis <= 269.1 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/391f76a1-098b-4b88-be71-4270d9942c66?source=api-prod","affected":[{"type":"plugin","slug":"conveythis-translate","name":"ConveyThis AI Multilingual Translation","from":"*","from_inclusive":true,"to":"269.1","to_inclusive":true,"patched_in":"269.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-06T17:25:15Z"},{"id":"wordfence:3921f323-a525-46db-9cb7-989fa1375984","source":"wordfence","cve":"CVE-2024-51808","title":"codeSnips <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3921f323-a525-46db-9cb7-989fa1375984?source=api-prod","affected":[{"type":"plugin","slug":"codesnips","name":"codeSnips","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:53:33Z"},{"id":"wordfence:3923c732-80b5-4a04-80dd-b4d5b5e5567d","source":"wordfence","cve":"CVE-2025-2007","title":"Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3923c732-80b5-4a04-80dd-b4d5b5e5567d?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.19","to_inclusive":true,"patched_in":"7.19.1"},{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"7.20","from_inclusive":true,"to":"7.20","to_inclusive":true,"patched_in":"7.19.1"}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-04T16:30:41Z"},{"id":"wordfence:39242dd0-f968-403e-82f8-2f1d1fccce49","source":"wordfence","cve":"CVE-2026-13405","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39242dd0-f968-403e-82f8-2f1d1fccce49?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":false,"patched_in":"1.7.1066"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:12:31Z"},{"id":"wordfence:3924b6f4-75ba-4ee8-b02f-a23fbd24ed67","source":"wordfence","cve":"CVE-2023-23723","title":"WP Email Capture <= 3.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3924b6f4-75ba-4ee8-b02f-a23fbd24ed67?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.10"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3925311f-d40b-4f54-9b98-a709b53ed179","source":"wordfence","cve":"CVE-2024-5450","title":"Bug Library <= 2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3925311f-d40b-4f54-9b98-a709b53ed179?source=api-prod","affected":[{"type":"plugin","slug":"bug-library","name":"Bug Library","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T19:08:11Z"},{"id":"wordfence:39286096-2efa-450b-b491-b3d40de5a4ae","source":"wordfence","cve":"CVE-2026-9729","title":"Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39286096-2efa-450b-b491-b3d40de5a4ae?source=api-prod","affected":[{"type":"plugin","slug":"webpushr-web-push-notifications","name":"Web Push Notifications \u2013 Webpushr","from":"*","from_inclusive":true,"to":"4.39.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T18:44:42Z","updated":"2026-07-29T15:14:07Z"},{"id":"wordfence:39286b31-f74e-4149-a7a0-1d05e48cd253","source":"wordfence","cve":"CVE-2026-11871","title":"Team Showcase Supreme <= 9.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39286b31-f74e-4149-a7a0-1d05e48cd253?source=api-prod","affected":[{"type":"plugin","slug":"tc-team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-29T19:30:46Z"},{"id":"wordfence:392d8286-a5fd-4d5d-9f6a-f13564013edc","source":"wordfence","cve":"CVE-2024-12279","title":"WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/392d8286-a5fd-4d5d-9f6a-f13564013edc?source=api-prod","affected":[{"type":"plugin","slug":"wp-fb-autoconnect","name":"WP Social AutoConnect","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2025-01-03T21:49:54Z","updated":"2025-01-04T11:16:33Z"},{"id":"wordfence:392e7c39-e329-49f6-8b67-a23baa13c711","source":"wordfence","cve":"CVE-2025-48353","title":"Clickbank WordPress Plugin (Niche Storefront) <= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/392e7c39-e329-49f6-8b67-a23baa13c711?source=api-prod","affected":[{"type":"plugin","slug":"clickbank-niche-storefronts","name":"Clickbank WordPress Plugin (Niche Storefront)","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T13:48:21Z"},{"id":"wordfence:3930614d-1b3a-4ca2-9d17-b2e905330fe9","source":"wordfence","cve":"CVE-2026-66427","title":"Google Review Slider <= 18.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3930614d-1b3a-4ca2-9d17-b2e905330fe9?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"18.4","to_inclusive":true,"patched_in":"18.5"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:25:15Z"},{"id":"wordfence:393193b2-25b4-485c-a9c6-fbe075ebd6f9","source":"wordfence","cve":"CVE-2024-37428","title":"WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393193b2-25b4-485c-a9c6-fbe075ebd6f9?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:11:38Z"},{"id":"wordfence:3931b201-037d-4c4f-8e40-098c6c1251b9","source":"wordfence","cve":"CVE-2022-2341","title":"Simple Page Transition <= 1.4.1 - Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3931b201-037d-4c4f-8e40-098c6c1251b9?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-transition","name":"Simple Page Transition","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3931cfe6-13f7-4524-8895-d71918fd3ba3","source":"wordfence","cve":"CVE-2025-31435","title":"Microblog Poster <= 2.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3931cfe6-13f7-4524-8895-d71918fd3ba3?source=api-prod","affected":[{"type":"plugin","slug":"microblog-poster","name":"Microblog Poster \u2013 Auto Publish on Social Media","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:05:48Z"},{"id":"wordfence:39336115-5993-49e1-b810-80a712e8e42b","source":"wordfence","cve":"CVE-2025-2719","title":"Swatchly \u2013 WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39336115-5993-49e1-b810-80a712e8e42b?source=api-prod","affected":[{"type":"plugin","slug":"swatchly","name":"Swatchly \u2013 Product Variation Swatches for WooCommerce","from":"1.2.8","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-04-09T18:09:21Z","updated":"2025-04-11T14:24:07Z"},{"id":"wordfence:3936479e-7503-4bf2-8080-70e95be45f73","source":"wordfence","cve":"CVE-2025-49270","title":"WP-CRM System <= 3.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3936479e-7503-4bf2-8080-70e95be45f73?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:30:53Z"},{"id":"wordfence:3936d7dc-840e-41fc-8af4-db40c0cff660","source":"wordfence","cve":"CVE-2024-7775","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3936d7dc-840e-41fc-8af4-db40c0cff660?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"2.0","from_inclusive":true,"to":"2.13.9","to_inclusive":true,"patched_in":"2.13.10"}],"published":"2024-08-19T15:11:45Z","updated":"2024-08-20T03:21:08Z"},{"id":"wordfence:3936dfb4-4f0f-4f97-bd66-df43dae93b5e","source":"wordfence","cve":"CVE-2026-25319","title":"Zita Site Library for Elementor <= 1.6.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3936dfb4-4f0f-4f97-bd66-df43dae93b5e?source=api-prod","affected":[{"type":"plugin","slug":"zita-site-library","name":"Zita Site Library for Elementor","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-01-28T00:00:00Z","updated":"2026-05-04T15:21:21Z"},{"id":"wordfence:393811e4-71dd-4359-80fa-5a3d146439bb","source":"wordfence","cve":"CVE-2024-13698","title":"Jobify - Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393811e4-71dd-4359-80fa-5a3d146439bb?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.8"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T15:21:44Z"},{"id":"wordfence:393a856e-dc13-4fb6-8ff3-5880631953c4","source":"wordfence","cve":"CVE-2023-47658","title":"Extra Product Options for WooCommerce <= 4.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393a856e-dc13-4fb6-8ff3-5880631953c4?source=api-prod","affected":[{"type":"plugin","slug":"extra-product-options-for-woocommerce","name":"Extra Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-11-07T00:00:00Z","updated":"2025-04-15T12:20:47Z"},{"id":"wordfence:393b4e9e-4b2b-4c3d-baaa-bafc89cda382","source":"wordfence","cve":"CVE-2024-51642","title":"Seo Free <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393b4e9e-4b2b-4c3d-baaa-bafc89cda382?source=api-prod","affected":[{"type":"plugin","slug":"seo-free","name":"Seo Free","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:18:49Z"},{"id":"wordfence:393bf415-f4fb-43c4-86b9-f066457e3526","source":"wordfence","cve":"CVE-2026-24552","title":"Create <= 2.5.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393bf415-f4fb-43c4-86b9-f066457e3526?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:19:46Z"},{"id":"wordfence:393d1b30-19f8-454d-84c0-0b539953e1fe","source":"wordfence","cve":"CVE-2026-6551","title":"Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393d1b30-19f8-454d-84c0-0b539953e1fe?source=api-prod","affected":[{"type":"plugin","slug":"timeline-blocks","name":"Timeline Blocks","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2026-04-27T15:59:19Z","updated":"2026-04-28T04:28:21Z"},{"id":"wordfence:393d6e4a-af05-48ac-8921-f298932245a4","source":"wordfence","cve":"CVE-2025-13848","title":"STM Gallery 1.9 <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/393d6e4a-af05-48ac-8921-f298932245a4?source=api-prod","affected":[{"type":"plugin","slug":"stm-gallery","name":"STM Gallery 1.9","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:34:14Z","updated":"2026-01-07T09:20:54Z"},{"id":"wordfence:3940232c-b3d4-488b-830d-797bdab9cfbe","source":"wordfence","cve":"CVE-2022-4358","title":"WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3940232c-b3d4-488b-830d-797bdab9cfbe?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-by-publishers","name":"WP RSS By Publishers","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39404341-8a27-4770-b6a6-d33e899b6bd8","source":"wordfence","cve":"CVE-2023-2623","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39404341-8a27-4770-b6a6-d33e899b6bd8?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"3.2.0","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39405c07-9576-41f4-bb49-205a0f7abb4c","source":"wordfence","cve":"CVE-2026-19840","title":"Notiqoo \u2013 Order Notification & Customer Chat for WooCommerce < 1.4.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39405c07-9576-41f4-bb49-205a0f7abb4c?source=api-prod","affected":[{"type":"plugin","slug":"wc-messaging","name":"Notiqoo \u2013 Order Notification & Customer Chat for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":false,"patched_in":"1.4.14"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:40:56Z"},{"id":"wordfence:3942bba9-3c3a-47bf-9a53-95376917d6bb","source":"wordfence","cve":"CVE-2023-32238","title":"TheGem < 5.8.1.1 - Improper Authentication","severity":"medium","cvss":6.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3942bba9-3c3a-47bf-9a53-95376917d6bb?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.8.1.1","to_inclusive":false,"patched_in":"5.8.1.1"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39472e87-174c-4abf-bc83-fed0939440af","source":"wordfence","cve":"CVE-2026-96840","title":"Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39472e87-174c-4abf-bc83-fed0939440af?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-10-09T17:44:25Z","updated":"2026-10-10T06:40:09Z"},{"id":"wordfence:394732cc-94b5-4fbf-bd78-da18791724be","source":"wordfence","cve":"CVE-2025-9850","title":"Evenium <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/394732cc-94b5-4fbf-bd78-da18791724be?source=api-prod","affected":[{"type":"plugin","slug":"evenium","name":"Evenium","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2025-09-10T18:45:41Z","updated":"2026-07-08T20:54:11Z"},{"id":"wordfence:3947d20c-7e92-43d6-83cc-59efe1049799","source":"wordfence","cve":"CVE-2024-54266","title":"ImageRecycle pdf & image compression <= 3.1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3947d20c-7e92-43d6-83cc-59efe1049799?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-19T08:07:33Z"},{"id":"wordfence:39487908-5cc5-42ac-8af4-65626694b1e4","source":"wordfence","cve":"CVE-2024-7617","title":"Contact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39487908-5cc5-42ac-8af4-65626694b1e4?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-09-24T12:15:01Z","updated":"2024-10-04T13:12:09Z"},{"id":"wordfence:39493083-e703-4893-b315-4e55df69276c","source":"wordfence","cve":"CVE-2026-34904","title":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone <= 6.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39493083-e703-4893-b315-4e55df69276c?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:49:38Z"},{"id":"wordfence:3949a3a9-b02b-415a-a418-73756f6355a5","source":"wordfence","cve":"CVE-2025-26884","title":"Greenshift <= 10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3949a3a9-b02b-415a-a418-73756f6355a5?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"10.8","to_inclusive":true,"patched_in":"10.9"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T18:09:37Z"},{"id":"wordfence:39543965-fa15-4169-ae99-582c49b629ab","source":"wordfence","cve":"CVE-2026-34891","title":"IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39543965-fa15-4169-ae99-582c49b629ab?source=api-prod","affected":[{"type":"plugin","slug":"woo-idpay-gateway","name":"IDPay Payment Gateway for Woocommerce","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-04-06T00:00:00Z","updated":"2026-04-15T19:37:35Z"},{"id":"wordfence:39560e9e-6583-43d0-9a02-2add8c30291a","source":"wordfence","cve":"CVE-2025-32219","title":"eaSYNC <= 1.3.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39560e9e-6583-43d0-9a02-2add8c30291a?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T14:20:27Z"},{"id":"wordfence:39563589-d585-4fba-9685-7e4b4eaef30e","source":"wordfence","cve":"CVE-2026-93896","title":"WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39563589-d585-4fba-9685-7e4b4eaef30e?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-notification-bar","name":"WPFront Notification Bar","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-10-02T17:45:06Z","updated":"2026-10-03T06:38:22Z"},{"id":"wordfence:39564fad-a8cb-4a95-a893-d61e8ff91a53","source":"wordfence","cve":"","title":"WP-Matomo Integration (WP-Piwik) < 1.0.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39564fad-a8cb-4a95-a893-d61e8ff91a53?source=api-prod","affected":[{"type":"plugin","slug":"wp-piwik","name":"Connect Matomo \u2013 Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2016-09-02T00:00:00Z","updated":"2024-10-23T12:45:33Z"},{"id":"wordfence:395692e0-b165-46a2-a15c-059e9f7d2ac2","source":"wordfence","cve":"CVE-2026-56061","title":"Subscriptions for WooCommerce <= 1.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/395692e0-b165-46a2-a15c-059e9f7d2ac2?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:59:29Z"},{"id":"wordfence:3956cd40-6b46-4013-9d71-a979de2c3687","source":"wordfence","cve":"CVE-2024-8732","title":"Roles & Capabilities <= 1.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3956cd40-6b46-4013-9d71-a979de2c3687?source=api-prod","affected":[{"type":"plugin","slug":"leira-roles","name":"Roles & Capabilities","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2024-09-12T21:14:43Z","updated":"2024-09-23T13:04:05Z"},{"id":"wordfence:395a8ca6-78b8-43f2-8e8c-896702b5da0d","source":"wordfence","cve":"CVE-2023-27605","title":"WP Reroute Email <= 1.4.6 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/395a8ca6-78b8-43f2-8e8c-896702b5da0d?source=api-prod","affected":[{"type":"plugin","slug":"wp-reroute-email","name":"WP Reroute Email","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:395b016f-018c-458d-a585-34f3de3eae5c","source":"wordfence","cve":"CVE-2023-39305","title":"Yet Another Stars Rating <= 3.4.3 - Missing Authorization via init","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/395b016f-018c-458d-a585-34f3de3eae5c?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:395ff912-dad7-4dff-8bc4-bc58ecc96a90","source":"wordfence","cve":"","title":"Esplanade < 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/395ff912-dad7-4dff-8bc4-bc58ecc96a90?source=api-prod","affected":[{"type":"theme","slug":"esplanade","name":"Esplanade","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2015-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3967b5ce-f0f8-4620-8883-0857aeee8f8b","source":"wordfence","cve":"CVE-2025-14581","title":"HAPPY \u2013 Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3967b5ce-f0f8-4620-8883-0857aeee8f8b?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-12-12T14:47:44Z","updated":"2026-03-27T11:10:31Z"},{"id":"wordfence:39695b53-9af7-42f0-8bde-3969398a7186","source":"wordfence","cve":"CVE-2023-47839","title":"eCommerce Product Catalog for WordPress <= 3.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39695b53-9af7-42f0-8bde-3969398a7186?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.26","to_inclusive":true,"patched_in":"3.3.27"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3969e890-76e0-484a-ad16-6e2642e2ae53","source":"wordfence","cve":"CVE-2018-16299","title":"Localize My Post <= 1.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3969e890-76e0-484a-ad16-6e2642e2ae53?source=api-prod","affected":[{"type":"plugin","slug":"localize-my-post","name":"Localize My Post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2018-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:396a58d2-8357-4a8b-88a7-8c4917e27eb6","source":"wordfence","cve":"CVE-2022-4681","title":"Hide My WP < 6.2.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396a58d2-8357-4a8b-88a7-8c4917e27eb6?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":false,"patched_in":"6.2.9"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:396a7101-e6da-49c1-87a3-25792f3a7b76","source":"wordfence","cve":"CVE-2012-5229","title":"Slideshow Gallery <= 1.1.4 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396a7101-e6da-49c1-87a3-25792f3a7b76?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery-2","name":"Slideshow Gallery","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2012-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:396ba24f-e0f7-4374-a9ce-d9abddb87b39","source":"wordfence","cve":"CVE-2026-8441","title":"WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396ba24f-e0f7-4374-a9ce-d9abddb87b39?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.7.2","to_inclusive":true,"patched_in":"12.7.3"}],"published":"2026-07-01T21:02:44Z","updated":"2026-07-02T09:32:03Z"},{"id":"wordfence:396db2fd-d6be-449b-9719-0b4561e5afa8","source":"wordfence","cve":"CVE-2025-68518","title":"Hoteller < 6.8.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396db2fd-d6be-449b-9719-0b4561e5afa8?source=api-prod","affected":[{"type":"theme","slug":"hoteller","name":"Hoteller Booking WordPress","from":"*","from_inclusive":true,"to":"6.8.9","to_inclusive":false,"patched_in":"6.8.9"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:47:10Z"},{"id":"wordfence:396ecd5b-d351-4289-aea4-332af5101f10","source":"wordfence","cve":"CVE-2026-3425","title":"RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396ecd5b-d351-4289-aea4-332af5101f10?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T12:29:54Z"},{"id":"wordfence:396f2426-7bc4-4221-bc48-920bec5af6e5","source":"wordfence","cve":"CVE-2025-12168","title":"Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396f2426-7bc4-4221-bc48-920bec5af6e5?source=api-prod","affected":[{"type":"plugin","slug":"memsource-connector","name":"Phrase TMS Integration for WordPress","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-01-16T15:33:38Z","updated":"2026-01-17T04:34:02Z"},{"id":"wordfence:396f785f-0354-462e-bcaa-69e364c8c4b5","source":"wordfence","cve":"CVE-2014-9399","title":"TweetScribe <= 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/396f785f-0354-462e-bcaa-69e364c8c4b5?source=api-prod","affected":[{"type":"plugin","slug":"tweetscribe","name":"TweetScribe","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39719351-3388-4175-89a0-8ce153a8bf44","source":"wordfence","cve":"CVE-2021-38341","title":"WooCommerce Payment Gateway Per Category <= 2.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39719351-3388-4175-89a0-8ce153a8bf44?source=api-prod","affected":[{"type":"plugin","slug":"wc-payment-gateway-per-category","name":"Woocommerce Payment Gateway per Category","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3971c145-6dca-49af-bbb3-7ef4ce51507f","source":"wordfence","cve":"CVE-2023-29434","title":"Optin Forms <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3971c145-6dca-49af-bbb3-7ef4ce51507f?source=api-prod","affected":[{"type":"plugin","slug":"optin-forms","name":"Optin Forms \u2013 Simple List Building Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39722a07-abfe-4956-b5d0-8ece06913a85","source":"wordfence","cve":"CVE-2024-31229","title":"Really Simple SSL <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39722a07-abfe-4956-b5d0-8ece06913a85?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:29:16Z"},{"id":"wordfence:3974cd46-c55f-4930-abc0-75d36b49ce1e","source":"wordfence","cve":"CVE-2025-23600","title":"Send to a Friend Addon <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3974cd46-c55f-4930-abc0-75d36b49ce1e?source=api-prod","affected":[{"type":"plugin","slug":"send-booking-invites-to-friends","name":"Send to a Friend Addon","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T20:59:42Z"},{"id":"wordfence:397555cf-0b0c-4ce5-97ad-59f135f9d195","source":"wordfence","cve":"CVE-2025-3107","title":"Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/397555cf-0b0c-4ce5-97ad-59f135f9d195?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.8","to_inclusive":true,"patched_in":"4.9.9.9"}],"published":"2025-05-12T17:35:47Z","updated":"2025-05-13T06:40:55Z"},{"id":"wordfence:397dabc3-5dcf-4d1f-9e24-28af889cb76f","source":"wordfence","cve":"CVE-2022-2108","title":"Wbcom Designs \u2013 BuddyPress Group Reviews <= 2.8.3 - Unauthorized AJAX Actions due to Nonce Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=api-prod","affected":[{"type":"plugin","slug":"review-buddypress-groups","name":"Wbcom Designs \u2013 BuddyPress Group Reviews","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:397e9d40-ecd3-4800-9191-c7e4805bcb31","source":"wordfence","cve":"CVE-2025-26561","title":"Elfsight Yottie Lite <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/397e9d40-ecd3-4800-9191-c7e4805bcb31?source=api-prod","affected":[{"type":"plugin","slug":"yottie-lite","name":"YouTube Gallery \u2013 YouTube Channel","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:41:34Z"},{"id":"wordfence:397f20d8-2400-4403-8543-f57141378012","source":"wordfence","cve":"CVE-2023-47757","title":"AWeber <= 7.3.9 - Missing Authorization via AJAX actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/397f20d8-2400-4403-8543-f57141378012?source=api-prod","affected":[{"type":"plugin","slug":"aweber-web-form-widget","name":"AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth","from":"*","from_inclusive":true,"to":"7.3.9","to_inclusive":true,"patched_in":"7.3.10"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:397f9aa1-a40b-4aec-bd50-8fcfed590889","source":"wordfence","cve":"CVE-2024-54396","title":"Bet sport Free <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/397f9aa1-a40b-4aec-bd50-8fcfed590889?source=api-prod","affected":[{"type":"plugin","slug":"bet-sport-free","name":"Bet sport Free","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:02:26Z"},{"id":"wordfence:3980df03-e19e-4b02-9b6a-9af7d8eaf0f3","source":"wordfence","cve":"CVE-2024-52412","title":"Xin <= 1.0.8.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3980df03-e19e-4b02-9b6a-9af7d8eaf0f3?source=api-prod","affected":[{"type":"theme","slug":"xin","name":"Xin","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:28:22Z"},{"id":"wordfence:39843d5b-702d-466d-9e17-ccf1c4444220","source":"wordfence","cve":"CVE-2015-9356","title":"Viper GuestBook <= 1.3.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39843d5b-702d-466d-9e17-ccf1c4444220?source=api-prod","affected":[{"type":"plugin","slug":"wp-vipergb","name":"WP-ViperGB","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39893f56-aa92-4425-8ec4-979c72703e02","source":"wordfence","cve":"CVE-2024-54428","title":"Add image to Post <= 0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39893f56-aa92-4425-8ec4-979c72703e02?source=api-prod","affected":[{"type":"plugin","slug":"add-image-to-post","name":"Add image to Post","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:24:38Z"},{"id":"wordfence:398a75b1-6470-44b3-aaea-d5e8b10db115","source":"wordfence","cve":"CVE-2026-1391","title":"Vzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/398a75b1-6470-44b3-aaea-d5e8b10db115?source=api-prod","affected":[{"type":"plugin","slug":"vzaar-media-management","name":"Vzaar Media Management","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:49:36Z","updated":"2026-01-28T11:23:38Z"},{"id":"wordfence:398ebe7e-b0a7-47d8-b2f2-61973182f520","source":"wordfence","cve":"","title":"FoxyPress <= 0.4.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/398ebe7e-b0a7-47d8-b2f2-61973182f520?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.9","to_inclusive":true,"patched_in":""}],"published":"2012-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:399109be-7efe-428e-a9b8-7a68864b2790","source":"wordfence","cve":"CVE-2023-40007","title":"CT Commerce <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/399109be-7efe-428e-a9b8-7a68864b2790?source=api-prod","affected":[{"type":"plugin","slug":"ct-commerce","name":"CT Commerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:399189a6-271b-4199-a758-e3cc5d6d90aa","source":"wordfence","cve":"CVE-2025-32613","title":"Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/399189a6-271b-4199-a758-e3cc5d6d90aa?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-04-17T00:00:00Z","updated":"2026-04-15T20:40:33Z"},{"id":"wordfence:3991d8d0-57a8-42e7-a53c-97508f7e137f","source":"wordfence","cve":"CVE-2023-5357","title":"Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3991d8d0-57a8-42e7-a53c-97508f7e137f?source=api-prod","affected":[{"type":"plugin","slug":"instagram-for-wordpress","name":"Instagram for WordPress","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39972b06-920f-48b0-aa36-bb5caab87cb6","source":"wordfence","cve":"CVE-2025-12092","title":"CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39972b06-920f-48b0-aa36-bb5caab87cb6?source=api-prod","affected":[{"type":"plugin","slug":"cyan-backup","name":"CYAN Backup","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-11-07T20:49:54Z","updated":"2025-11-08T09:28:10Z"},{"id":"wordfence:399848fd-e9f6-40e4-bfeb-08f53eb511c6","source":"wordfence","cve":"CVE-2023-45637","title":"EventPrime <= 3.1.5 - Reflected Cross-Site Scripting via 'event_id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/399848fd-e9f6-40e4-bfeb-08f53eb511c6?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3999c48f-bae6-48ea-b35f-d8307d9c3898","source":"wordfence","cve":"CVE-2020-36171","title":"Elementor Website Builder <= 3.0.13 - Unrestricted SVG Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3999c48f-bae6-48ea-b35f-d8307d9c3898?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.0.13","to_inclusive":true,"patched_in":"3.0.14"}],"published":"2020-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:399b0bb0-37e1-4207-b3f5-2ded33c3d967","source":"wordfence","cve":"CVE-2025-49314","title":"BRW <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/399b0bb0-37e1-4207-b3f5-2ded33c3d967?source=api-prod","affected":[{"type":"plugin","slug":"ova-brw","name":"BRW - Booking Rental Plugin WooCommerce","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:07:39Z"},{"id":"wordfence:39a3450e-f3c2-4c89-985d-28e23eb433dd","source":"wordfence","cve":"","title":"External Media <= 1.0.36 - Authenticated(Author+) File Upload to Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a3450e-f3c2-4c89-985d-28e23eb433dd?source=api-prod","affected":[{"type":"plugin","slug":"external-media","name":"External Media","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":""}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39a34950-ce5f-43cf-bacd-96f74a70e7fe","source":"wordfence","cve":"CVE-2026-97296","title":"Gravity Forms < 3.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a34950-ce5f-43cf-bacd-96f74a70e7fe?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:58:56Z"},{"id":"wordfence:39a3dabb-4c4a-4423-861c-c26c7365185c","source":"wordfence","cve":"CVE-2025-24722","title":"FAQ Builder AYS <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a3dabb-4c4a-4423-861c-c26c7365185c?source=api-prod","affected":[{"type":"plugin","slug":"faq-builder-ays","name":"FAQ Builder AYS","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:38:15Z"},{"id":"wordfence:39a410a6-ce8b-498c-855c-8cbb7d4b875b","source":"wordfence","cve":"CVE-2026-61943","title":"Premium Packages \u2013 Sell Digital Products Securely <= 6.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a410a6-ce8b-498c-855c-8cbb7d4b875b?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:03:17Z"},{"id":"wordfence:39a50c49-5c24-4ae7-8f77-4f3d98270f8f","source":"wordfence","cve":"CVE-2023-28532","title":"Real Estate Directory <= 1.0.5 - Cross-Site Request Forgery via rdm_activate_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a50c49-5c24-4ae7-8f77-4f3d98270f8f?source=api-prod","affected":[{"type":"theme","slug":"real-estate-directory","name":"Real Estate Directory","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39a74c20-42a2-4099-8e6c-9989a3ba081d","source":"wordfence","cve":"","title":"Salient < 5.5.53 - DOM Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39a74c20-42a2-4099-8e6c-9989a3ba081d?source=api-prod","affected":[{"type":"theme","slug":"salient","name":"Salient | Creative Multipurpose & WooCommerce Theme","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.5.53"}],"published":"2015-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39ab0d8c-0f20-40d5-94ba-f6e95ebde88c","source":"wordfence","cve":"CVE-2024-51660","title":"Easy Accordion Gutenberg Block <= 1.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ab0d8c-0f20-40d5-94ba-f6e95ebde88c?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-block","name":"Easy Accordion Block \u2013 Accordion, FAQ & Collapsible Content for the Block Editor","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:29:19Z"},{"id":"wordfence:39acd470-d65b-415d-9f57-2227d19821df","source":"wordfence","cve":"CVE-2025-23947","title":"WP-Player <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39acd470-d65b-415d-9f57-2227d19821df?source=api-prod","affected":[{"type":"plugin","slug":"wp-player","name":"WP-Player","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:44:08Z"},{"id":"wordfence:39adc110-dd99-4447-9d72-2f78e7ebd2cf","source":"wordfence","cve":"CVE-2025-24552","title":"Paytium <= 4.4.11 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39adc110-dd99-4447-9d72-2f78e7ebd2cf?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:02:10Z"},{"id":"wordfence:39aed7e9-05c6-4251-b489-de7a33ed2c2e","source":"wordfence","cve":"CVE-2023-33931","title":"YouTube Playlist Player <= 4.6.4 - Cross-Site Request Forgery in ytpp_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39aed7e9-05c6-4251-b489-de7a33ed2c2e?source=api-prod","affected":[{"type":"plugin","slug":"youtube-playlist-player","name":"Playlist Player for YouTube \u2013 Fast, Privacy-Friendly Playlists & Channel Feed","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39b0af74-f773-4a56-b169-2ee11e923813","source":"wordfence","cve":"CVE-2024-12851","title":"Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b0af74-f773-4a56-b169-2ee11e923813?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.14","to_inclusive":true,"patched_in":"5.10.15"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T06:41:37Z"},{"id":"wordfence:39b2435f-32a3-4158-a734-c21a0cab15be","source":"wordfence","cve":"CVE-2024-8964","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b2435f-32a3-4158-a734-c21a0cab15be?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.9","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2024-10-07T18:57:08Z","updated":"2024-10-08T07:32:30Z"},{"id":"wordfence:39b6a1c7-2f8a-49e9-8807-a53a25524018","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.27 - CSV Injection","severity":"high","cvss":8.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b6a1c7-2f8a-49e9-8807-a53a25524018?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.27","to_inclusive":true,"patched_in":"2.9.28"}],"published":"2015-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39b728b9-8c9c-4965-8782-3f9b0d5bb8b1","source":"wordfence","cve":"CVE-2025-47454","title":"WP Gravity Forms Dynamics CRM <= 1.1.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b728b9-8c9c-4965-8782-3f9b0d5bb8b1?source=api-prod","affected":[{"type":"plugin","slug":"gf-dynamics-crm","name":"WP Gravity Forms Dynamics CRM","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:56:30Z"},{"id":"wordfence:39b8f6d8-bca2-4bf2-93ab-868270df8752","source":"wordfence","cve":"CVE-2023-45062","title":"Download canvasio3D Light <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b8f6d8-bca2-4bf2-93ab-868270df8752?source=api-prod","affected":[{"type":"plugin","slug":"canvasio3d-light","name":"canvasio3D Light","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-03-25T17:47:35Z"},{"id":"wordfence:39b9e8a0-96bb-4b36-b4e8-ec9e3f137835","source":"wordfence","cve":"CVE-2024-6752","title":"Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39b9e8a0-96bb-4b36-b4e8-ec9e3f137835?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:56Z"},{"id":"wordfence:39ba2725-ecfb-49fd-9f7c-c4d606f48c73","source":"wordfence","cve":"CVE-2025-32591","title":"WP Abstracts <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ba2725-ecfb-49fd-9f7c-c4d606f48c73?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2026-07-18T18:00:17Z"},{"id":"wordfence:39bb69e0-fb18-4737-9eb7-bda2b5bc16a2","source":"wordfence","cve":"CVE-2024-5852","title":"WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.7","to_inclusive":true,"patched_in":"4.24.8"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T08:32:32Z"},{"id":"wordfence:39bbe18a-0212-4bfe-861f-2a213d67baec","source":"wordfence","cve":"CVE-2022-1269","title":"Fast Flow <= 1.2.10 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39bbe18a-0212-4bfe-861f-2a213d67baec?source=api-prod","affected":[{"type":"plugin","slug":"fast-flow-dashboard","name":"Fast Flow","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39bcc1af-0315-44e0-864a-4105cedd216c","source":"wordfence","cve":"CVE-2026-73994","title":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39bcc1af-0315-44e0-864a-4105cedd216c?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.11.3","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:36:50Z"},{"id":"wordfence:39c17935-a853-407f-a99d-3828561919e6","source":"wordfence","cve":"CVE-2026-3985","title":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c17935-a853-407f-a99d-3828561919e6?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:14:03Z","updated":"2026-09-11T14:42:12Z"},{"id":"wordfence:39c4a5ec-ade7-4bfc-9cde-93621e3f255b","source":"wordfence","cve":"CVE-2025-53206","title":"HT Mega \u2013 Absolute Addons for WPBakery Page Builder <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c4a5ec-ade7-4bfc-9cde-93621e3f255b?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-wpbakery","name":"HT Mega \u2013 Absolute Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:35:38Z"},{"id":"wordfence:39c53cd7-3ea3-4971-be51-9544ca9d488f","source":"wordfence","cve":"CVE-2023-49769","title":"Integrate Google Drive <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c53cd7-3ea3-4971-be51-9544ca9d488f?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39c651c3-a478-4f58-af51-fd73d2934bdf","source":"wordfence","cve":"CVE-2025-2906","title":"Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c651c3-a478-4f58-af51-fd73d2934bdf?source=api-prod","affected":[{"type":"plugin","slug":"ct-real-estate-core","name":"Contempo Real Estate Core","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T11:12:28Z"},{"id":"wordfence:39c751c7-0480-4b92-bebb-a69114d79378","source":"wordfence","cve":"CVE-2024-32538","title":"Easy CountDowner <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c751c7-0480-4b92-bebb-a69114d79378?source=api-prod","affected":[{"type":"plugin","slug":"easy-countdowner","name":"Easy CountDowner","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T14:06:27Z"},{"id":"wordfence:39c8e951-8e8c-4a72-9ecf-1dd96392105d","source":"wordfence","cve":"CVE-2024-5341","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c8e951-8e8c-4a72-9ecf-1dd96392105d?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2024-05-29T17:11:29Z","updated":"2024-05-30T05:33:18Z"},{"id":"wordfence:39c9f055-2527-4678-bda1-27a29ab24acd","source":"wordfence","cve":"","title":"Products Quick View for WooCommerce <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39c9f055-2527-4678-bda1-27a29ab24acd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-quick-view","name":"Products Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39ca4256-09c5-4f80-a04c-9429c8fe6b8b","source":"wordfence","cve":"CVE-2025-30978","title":"Slack Notifications by dorzki <= 2.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ca4256-09c5-4f80-a04c-9429c8fe6b8b?source=api-prod","affected":[{"type":"plugin","slug":"dorzki-notifications-to-slack","name":"Slack Notifications by dorzki","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:03:03Z"},{"id":"wordfence:39ced195-63a7-4f50-a4eb-b43d6069f7e1","source":"wordfence","cve":"CVE-2014-8739","title":"Creative Contact Form < 1.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ced195-63a7-4f50-a4eb-b43d6069f7e1?source=api-prod","affected":[{"type":"plugin","slug":"sexy-contact-form","name":"Creative Contact Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":false,"patched_in":"1.0.0"}],"published":"2014-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39d189ca-d9f9-4ed9-bfc0-6c1402a9fd18","source":"wordfence","cve":"CVE-2024-10102","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d189ca-d9f9-4ed9-bfc0-6c1402a9fd18?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-17T12:40:56Z"},{"id":"wordfence:39d19c40-e191-4c2d-bd77-411e571604d2","source":"wordfence","cve":"CVE-2025-30866","title":"Terms & Conditions Per Product <= 1.2.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d19c40-e191-4c2d-bd77-411e571604d2?source=api-prod","affected":[{"type":"plugin","slug":"terms-and-conditions-per-product","name":"Terms and Conditions per Product for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:30:40Z"},{"id":"wordfence:39d325d4-073c-47b6-8ea4-30637417f0d7","source":"wordfence","cve":"CVE-2026-15727","title":"WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d325d4-073c-47b6-8ea4-30637417f0d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulk-delete","name":"WP Bulk Delete","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-07-15T20:02:34Z","updated":"2026-07-16T08:26:50Z"},{"id":"wordfence:39d41772-49f3-4bce-a170-cbe64ba99184","source":"wordfence","cve":"CVE-2025-0554","title":"Podlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d41772-49f3-4bce-a170-cbe64ba99184?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T05:33:49Z"},{"id":"wordfence:39d69a5e-4265-4898-9fd8-736dc2297b91","source":"wordfence","cve":"CVE-2024-29094","title":"HT Easy GA4 ( Google Analytics 4 ) <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d69a5e-4265-4898-9fd8-736dc2297b91?source=api-prod","affected":[{"type":"plugin","slug":"ht-easy-google-analytics","name":"HT Easy GA4 \u2013 Google Analytics WordPress Plugin","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:46:45Z"},{"id":"wordfence:39d8ea75-3cef-4ba9-b0ee-62a58599a350","source":"wordfence","cve":"CVE-2026-57633","title":"WCBoost \u2013 Products Compare <= 1.1.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39d8ea75-3cef-4ba9-b0ee-62a58599a350?source=api-prod","affected":[{"type":"plugin","slug":"wcboost-products-compare","name":"WCBoost \u2013 Products Compare","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:15:40Z"},{"id":"wordfence:39da62be-e630-48cd-b732-80ed3d337638","source":"wordfence","cve":"CVE-2024-1127","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39da62be-e630-48cd-b732-80ed3d337638?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2024-02-14T00:00:00Z","updated":"2024-03-13T15:26:44Z"},{"id":"wordfence:39dc1ba3-5afe-4ab0-86b8-4a651ba73735","source":"wordfence","cve":"CVE-2025-67520","title":"Media Library Tools <= 1.6.15 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39dc1ba3-5afe-4ab0-86b8-4a651ba73735?source=api-prod","affected":[{"type":"plugin","slug":"media-library-tools","name":"Media Library Tools \u2013 AI-Powered Rename, Clean & CSV Import/Export","from":"*","from_inclusive":true,"to":"1.6.15","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T16:58:34Z"},{"id":"wordfence:39dee113-f3a8-4828-975b-376dee46346d","source":"wordfence","cve":"CVE-2026-97190","title":"Advanced Custom Fields 6.2.0 - 6.8.10 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39dee113-f3a8-4828-975b-376dee46346d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"6.2.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"6.8.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T20:12:19Z"},{"id":"wordfence:39e0fd33-4071-4510-a7d5-b499a8a3543c","source":"wordfence","cve":"CVE-2024-2966","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.5.6 - Sensitive Information Exposure via  element_pack_ajax_search","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e0fd33-4071-4510-a7d5-b499a8a3543c?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-11T07:31:38Z"},{"id":"wordfence:39e10442-0a9e-4223-bb50-35b5d5ac8ff4","source":"wordfence","cve":"CVE-2025-68839","title":"Easy Theme Options <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e10442-0a9e-4223-bb50-35b5d5ac8ff4?source=api-prod","affected":[{"type":"plugin","slug":"easy-theme-options","name":"Easy Theme Options","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:18:54Z"},{"id":"wordfence:39e104fa-591a-41e8-af7e-f8b32a199170","source":"wordfence","cve":"CVE-2024-4876","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e104fa-591a-41e8-af7e-f8b32a199170?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-21T11:02:28Z"},{"id":"wordfence:39e1a681-f1ab-4da4-9328-822e1cc92551","source":"wordfence","cve":"CVE-2024-51610","title":"Display Terms Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e1a681-f1ab-4da4-9328-822e1cc92551?source=api-prod","affected":[{"type":"plugin","slug":"display-terms-shortcode","name":"Display Terms Shortcode","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:36:37Z"},{"id":"wordfence:39e1abcf-c3b6-4c53-a3dc-8a5741f24cca","source":"wordfence","cve":"CVE-2026-101921","title":"WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e1abcf-c3b6-4c53-a3dc-8a5741f24cca?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"2.0.2.1","to_inclusive":true,"patched_in":"2.0.2.2"}],"published":"2026-10-09T19:10:54Z","updated":"2026-10-10T07:41:44Z"},{"id":"wordfence:39e35136-a096-40d5-8d6e-2667e7b83aaa","source":"wordfence","cve":"CVE-2026-14221","title":"Easy Appointments < 4.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e35136-a096-40d5-8d6e-2667e7b83aaa?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-07-30T00:00:00Z","updated":"2026-09-09T16:08:37Z"},{"id":"wordfence:39e3fcf3-95f6-4844-b87a-5540041fe6a8","source":"wordfence","cve":"","title":"Very Simple Quiz <= 1.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e3fcf3-95f6-4844-b87a-5540041fe6a8?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-quiz","name":"Very Simple Quiz","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2020-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39e501d8-88a0-4625-aeb0-aa33fc89a8d4","source":"wordfence","cve":"CVE-2025-7205","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e501d8-88a0-4625-aeb0-aa33fc89a8d4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-07-30T19:18:44Z","updated":"2025-07-31T07:25:02Z"},{"id":"wordfence:39e58875-2f6e-453e-b33f-3d7a2a62b7b6","source":"wordfence","cve":"CVE-2024-13387","title":"WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e58875-2f6e-453e-b33f-3d7a2a62b7b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-tabs","name":"WP Responsive Tabs","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T09:39:15Z"},{"id":"wordfence:39e58ba2-9eb7-4e39-b28b-31bb44b2ddc2","source":"wordfence","cve":"CVE-2025-23840","title":"WP-NOTCAPTCHA <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e58ba2-9eb7-4e39-b28b-31bb44b2ddc2?source=api-prod","affected":[{"type":"plugin","slug":"wp-notcaptcha","name":"WP-NOTCAPTCHA","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:33:51Z"},{"id":"wordfence:39e77def-8abe-4e62-ad99-a0c1d467aeb1","source":"wordfence","cve":"","title":"Mona Lisa <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e77def-8abe-4e62-ad99-a0c1d467aeb1?source=api-prod","affected":[{"type":"theme","slug":"monalisa","name":"Mona Lisa","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2020-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39e8c8e1-5bf4-4e4a-91a3-cf884cccf374","source":"wordfence","cve":"CVE-2024-11463","title":"DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e8c8e1-5bf4-4e4a-91a3-cf884cccf374?source=api-prod","affected":[{"type":"plugin","slug":"debounce-io-email-validator","name":"DeBounce Email Validator","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.6.6"}],"published":"2024-11-22T15:20:34Z","updated":"2025-04-22T21:59:05Z"},{"id":"wordfence:39e90b51-c5f2-4a9f-ace8-6fbc6749557b","source":"wordfence","cve":"CVE-2024-10709","title":"YaDisk Files <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e90b51-c5f2-4a9f-ace8-6fbc6749557b?source=api-prod","affected":[{"type":"plugin","slug":"wp-yadisk-files","name":"YaDisk Files","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-07T19:03:26Z"},{"id":"wordfence:39e9f38c-f06e-4b6a-9f09-a23c52b50026","source":"wordfence","cve":"CVE-2026-24588","title":"Smart Product Viewer <= 1.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39e9f38c-f06e-4b6a-9f09-a23c52b50026?source=api-prod","affected":[{"type":"plugin","slug":"smart-product-viewer","name":"Smart Product Viewer","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-18T00:00:00Z","updated":"2026-01-28T18:32:37Z"},{"id":"wordfence:39ea4627-66b2-42a6-913e-04c708491b8d","source":"wordfence","cve":"CVE-2025-0845","title":"DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ea4627-66b2-42a6-913e-04c708491b8d?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-core-features","name":"DesignThemes Core Features","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T05:22:48Z"},{"id":"wordfence:39ec49b4-f0f3-4ec7-b11b-ce808c025577","source":"wordfence","cve":"CVE-2025-13133","title":"Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection","severity":"medium","cvss":6.6,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39ec49b4-f0f3-4ec7-b11b-ce808c025577?source=api-prod","affected":[{"type":"plugin","slug":"a3-user-importer","name":"Simple User Import Export","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-11-17T20:52:10Z","updated":"2026-07-10T15:05:57Z"},{"id":"wordfence:39f12569-ff89-4c6b-afcf-a8c4421749cc","source":"wordfence","cve":"CVE-2017-1002026","title":"Event Expresso Free <= 3.1.37.11.L - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f12569-ff89-4c6b-afcf-a8c4421749cc?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-free","name":"Event Expresso Free","from":"*","from_inclusive":true,"to":"3.1.37.11.L","to_inclusive":true,"patched_in":"3.1.37.12.L"}],"published":"2017-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39f12ff1-63ee-4131-a708-49633f22ccd4","source":"wordfence","cve":"CVE-2026-12240","title":"Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field","severity":"high","cvss":8.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f12ff1-63ee-4131-a708-49633f22ccd4?source=api-prod","affected":[{"type":"plugin","slug":"export-user-data","name":"Export User Data","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T18:15:59Z","updated":"2026-06-30T06:52:41Z"},{"id":"wordfence:39f1ddd0-c26b-4754-a78a-c64fab75f238","source":"wordfence","cve":"CVE-2022-3070","title":"Generate PDF using Contact Form 7 <= 3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f1ddd0-c26b-4754-a78a-c64fab75f238?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39f26d35-a702-49fc-aed1-0a329ac32553","source":"wordfence","cve":"CVE-2026-15787","title":"Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f26d35-a702-49fc-aed1-0a329ac32553?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-07-21T20:13:16Z","updated":"2026-07-22T08:33:30Z"},{"id":"wordfence:39f5777b-38b0-4fc6-909d-61eaa1de6173","source":"wordfence","cve":"CVE-2024-1897","title":"Grid Gallery \u2013 Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f5777b-38b0-4fc6-909d-61eaa1de6173?source=api-prod","affected":[{"type":"plugin","slug":"new-grid-gallery","name":"Grid Gallery \u2013 for Photo Gallery, Image Gallery & Portfolio","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-21T15:14:09Z"},{"id":"wordfence:39f6fb61-25a9-4386-9b61-7343760fd28c","source":"wordfence","cve":"CVE-2024-12624","title":"Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f6fb61-25a9-4386-9b61-7343760fd28c?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.91","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:57Z"},{"id":"wordfence:39f8127b-bb3f-4b1c-a3e5-42a386f985f8","source":"wordfence","cve":"CVE-2026-85681","title":"WP Component <= 2.2.4 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f8127b-bb3f-4b1c-a3e5-42a386f985f8?source=api-prod","affected":[{"type":"plugin","slug":"wpcomponent","name":"WP Component","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:57:59Z"},{"id":"wordfence:39f8c830-9f71-4ca6-8fcc-54769cef878f","source":"wordfence","cve":"CVE-2015-0902","title":"All in One SEO <= 2.2.5.1 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39f8c830-9f71-4ca6-8fcc-54769cef878f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2015-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:39fb0499-9ab4-4a2f-b0db-ece86bcf4d42","source":"wordfence","cve":"CVE-2022-4974","title":"Freemius SDK <= 2.4.2 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"},{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":false,"patched_in":"1.9.8"},{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"},{"type":"plugin","slug":"acf-blocks","name":"Gutenberg Blocks \u2013 ACF Blocks Suite","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":false,"patched_in":"2.6.8"},{"type":"plugin","slug":"ultimeter","name":"Ultimeter \u2013 the Ultimate Progress and Goals Meter","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":false,"patched_in":"2.7.6"},{"type":"plugin","slug":"past-events-extension","name":"Past Events Extension","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pootle-page-builder","name":"Pootle Pagebuilder \u2013 WordPress Page builder","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":false,"patched_in":"5.7.1"},{"type":"plugin","slug":"local-delivery-drivers-for-woocommerce","name":"Local Delivery Drivers for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"},{"type":"plugin","slug":"ultimate-gutenberg","name":"Ultimate Gutenberg \u2013 Custom Block Templates","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"required-taxonomies","name":"WP Required Taxonomies \u2013 Categories and Tags Mandatory","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"},{"type":"plugin","slug":"featured-products-first-for-woocommerce","name":"Featured Products First for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"},{"type":"plugin","slug":"streak-crm-for-gmail-integration-for-contact-form-7","name":"Streak CRM For Gmail For Contact Form 7 \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"},{"type":"plugin","slug":"wp-dev-powers-acf-color-coded-field-types","name":"WordPress Dev Powers \u2013 ACF Color Coded Field Types Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"dancepress-trwa","name":"DancePress (TRWA)","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"},{"type":"plugin","slug":"woo-advanced-product-size-chart","name":"Product Size Charts Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"},{"type":"plugin","slug":"wp-my-admin-bar","name":"Wp My Admin Bar","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"setka-editor","name":"A no-code page builder for beautiful performance-based content","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":false,"patched_in":"2.1.17"},{"type":"plugin","slug":"localseomap-for-elementor","name":"LocalSEOMap","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-prayer","name":"Easy Prayer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"adfoxly","name":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"},{"type":"plugin","slug":"wp-get-personal-lite","name":"WP Get Personal","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"edd-cashapp","name":"Checkout with Cash App on EDD","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"server-info","name":"Server Info \u2013 System Health & Diagnostics Suite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"},{"type":"plugin","slug":"krsp-frontend-file-upload","name":"KRSP Frontend File Uploader","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"panorama","name":"Panorama \u2013 Turn Photos into Immersive Virtual Tours","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"plugin","slug":"bulk-attachment-download","name":"Bulk Attachment Download","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"},{"type":"plugin","slug":"autosave-net","name":"AutoSave Net","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"},{"type":"plugin","slug":"any-popup","name":"Any Popup \u2013 Popup Forms, Optins & Ads","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"edd-venmo","name":"Checkout with Venmo on EDD","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-product-payments","name":"Dreamfoxmedia Payment Gateway per Product for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":false,"patched_in":"3.1.6"},{"type":"plugin","slug":"hqtheme-extra","name":"HQTheme Extra","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"vit-website-reviews","name":"Vit Website Reviews","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-eu-vat-assistant","name":"EU VAT Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.28.220224","to_inclusive":false,"patched_in":"2.0.28.220224"},{"type":"plugin","slug":"gutenslider","name":"Gutenslider \u2013 Image & Video Slider Block","from":"*","from_inclusive":true,"to":"5.7.0","to_inclusive":false,"patched_in":"5.7.0"},{"type":"plugin","slug":"surbma-magyar-woocommerce","name":"HuCommerce | Magyar kieg\u00e9sz\u00edt\u00e9sek WooCommerce web\u00e1ruh\u00e1zakhoz","from":"*","from_inclusive":true,"to":"30.3.0","to_inclusive":false,"patched_in":"30.3.0"},{"type":"plugin","slug":"kvoucher","name":"KVoucher","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"},{"type":"plugin","slug":"error-log-monitor","name":"Error Log Monitor","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"},{"type":"plugin","slug":"slidedeck","name":"SlideDeck: Responsive WordPress Slider Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-multi-currency","name":"Premmerce Multi-currency for Woocommerce","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"},{"type":"plugin","slug":"booking-for-woocommerce","name":"Booking Addon for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"},{"type":"plugin","slug":"wp-event-partners","name":"WP Event Partners \u2013 WordPress Plugin for Event and Conference Management","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"},{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"},{"type":"plugin","slug":"add-expires-headers","name":"AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"},{"type":"plugin","slug":"forcefield","name":"ForceField","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"featured-image-toolkit","name":"FIT: Featured Image Toolkit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"all-in-one-invite-codes","name":"All in One Invite Codes","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":false,"patched_in":"1.0.13"},{"type":"plugin","slug":"woo-conditional-discount-rules-for-checkout","name":"Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"},{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.9.170","to_inclusive":false,"patched_in":"1.9.9.170"},{"type":"plugin","slug":"cf7-grid-and-styler-for-divi","name":"Grid & Styler For Contact Form 7 And Divi","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"plugin","slug":"protect-uploads-with-login-page","name":"Protect Uploads with Login \u2013 Protect Your Uploads","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"atlas-knowledge-base","name":"Atlas \u2013 Knowledge Base","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"simple-sitemap","name":"Simple Sitemap \u2013 Responsive HTML Sitemap for WordPress","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"3.5.5"},{"type":"plugin","slug":"super-video-player","name":"Super Video player \u2013 Fully Customizable Video Player with Playlist","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":false,"patched_in":"1.6.11"},{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"},{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"},{"type":"plugin","slug":"tag-groups","name":"PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms","from":"*","from_inclusive":true,"to":"1.43.10.1","to_inclusive":false,"patched_in":"1.43.10.1"},{"type":"plugin","slug":"wp-free-ssl","name":"WP Free SSL","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"},{"type":"plugin","slug":"clickervolt","name":"ClickerVolt \u2013 Affiliate Links & Click Tracking for Performance Marketers","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"consultpress-lite","name":"ConsultPress Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-styler-for-divi","name":"CF7 Mate \u2013 Contact Form 7 Styler, Multi-Step Forms & Conditional Logic","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"},{"type":"plugin","slug":"mobilook","name":"MOBILOOK \u2014 Mobile View & Mobile\u2011Friendly Test","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"zip-codes-redirect","name":"Zip Code Redirect","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.1"},{"type":"plugin","slug":"guestofy-restaurant-reservations","name":"Guestofy \u2013 Restaurant Reservations Plugin, Room Planer, Reservation Form","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-constant-contact-fields-mapping","name":"CF7 Constant Contact Fields Mapping","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"},{"type":"plugin","slug":"ethereumico","name":"EthereumICO","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":false,"patched_in":"2.3.11"},{"type":"plugin","slug":"rt-easy-builder-advanced-addons-for-elementor","name":"RT Easy Builder \u2013 Advanced addons for Elementor","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"},{"type":"plugin","slug":"wp-contact-slider","name":"WP Contact Slider \u2013 Contact Form Slider Widget","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":false,"patched_in":"2.4.5"},{"type":"plugin","slug":"woocommerce-country-based-payments","name":"Country Based Payments for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"},{"type":"theme","slug":"elasta","name":"Elasta","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"},{"type":"plugin","slug":"animate-everything","name":"WordPress Animation Plugin \u2013 Animated Everything","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-notification-bell","name":"WP Notification Bell","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":false,"patched_in":"1.3.13"},{"type":"plugin","slug":"activity-log-mainwp","name":"Activity Log For MainWP","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"},{"type":"plugin","slug":"connected-sermons","name":"Connected Sermons","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bulk-edit-user-profiles-in-spreadsheet","name":"Bulk Edit and Create User Profiles \u2013 WP Sheet Editor","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":false,"patched_in":"1.5.13"},{"type":"plugin","slug":"yandex-money-button","name":"\u041a\u043d\u043e\u043f\u043a\u0430 \u042eMoney","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bulk-woocommerce-category-creator","name":"Bulk WooCommerce Category Creator","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-easy-math-captcha","name":"Easy Math Captcha for CF7","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-awesome-faq","name":"Master Accordion ( Former WP Awesome FAQ Plugin )","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":false,"patched_in":"4.1.8"},{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"7.1.4","to_inclusive":false,"patched_in":"7.1.4"},{"type":"plugin","slug":"wc-place-order-without-payment","name":"Place Order Without Payment for WooCommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"},{"type":"plugin","slug":"super-transactional-emails-for-woocommerce","name":"STEWoo \u2013 Super Transactional Emails for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"demomentsomtres-address","name":"DeMomentSomTres Address","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"out-of-stock-display-for-woocommerce","name":"Out of stock display for woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":false,"patched_in":"2.4.13"},{"type":"plugin","slug":"bulk-image-title-attribute","name":"Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO)","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"wp-radio","name":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"},{"type":"plugin","slug":"book-press","name":"BookPress \u2013 For Book Authors","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"qyrr-code","name":"Qyrr \u2013 simply and modern QR-Code creation","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":false,"patched_in":"0.8"},{"type":"plugin","slug":"wplocalplus-lite","name":"WordPress Directory Plugin For Business Listings \u2013  WP Local Plus","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"},{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"},{"type":"plugin","slug":"web-disrupt-funnelmentals","name":"Funnelmentals","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"},{"type":"plugin","slug":"forms-to-zapier","name":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"plugin","slug":"woorousell","name":"Product Carousel For WooCommerce \u2013 WoorouSell","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"},{"type":"plugin","slug":"better-robots-txt","name":"Better Robots.txt \u2013 AI-Ready Crawl Control & Bot Governance","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"},{"type":"plugin","slug":"gfirem-fields","name":"GFireM Fields","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"4.16.4","to_inclusive":false,"patched_in":"4.16.4"},{"type":"plugin","slug":"wp-post-block","name":"WP Post Block","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-attest","name":"LMS Plugin \u2013 eLearning, Online Courses by Attest","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.3.33","to_inclusive":false,"patched_in":"3.3.33"},{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.42.1","to_inclusive":false,"patched_in":"2.42.1"},{"type":"plugin","slug":"wptools-masonry-gallery-posts-for-divi","name":"Masonry Gallery & Posts For Divi (WP Tools)","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"},{"type":"plugin","slug":"gfirem-action-after","name":"GFireM Action After","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-ukrposhta","name":"Ukrposhta","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":false,"patched_in":"1.6.18"},{"type":"plugin","slug":"annasta-woocommerce-product-filters","name":"annasta Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"wp-lead-stream","name":"WP Lead Stream","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"5.14.0.4","to_inclusive":false,"patched_in":"5.14.0.4"},{"type":"plugin","slug":"focus-on-reviews-for-woocommerce","name":"Focus on Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"email-tracker","name":"Email Tracker","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"},{"type":"plugin","slug":"block-styler-for-gravity-forms","name":"Block Styler For Gravity Forms","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.2.0"},{"type":"plugin","slug":"custom-page-templates-by-vegacorp","name":"WP Page Templates","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":false,"patched_in":"1.1.13"},{"type":"plugin","slug":"wc-product-customer-list","name":"Product Customer List for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"},{"type":"theme","slug":"wp-moose","name":"WP Moose","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"gs-team-members","name":"Team Members \u2013 Team Showcase, Team Slider, Grid, Table & Staff Directory","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"floating-links","name":"Floating Social Share Icons and Social Share buttons \u2013 Next Previous Post Links \u2013 FL","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"},{"type":"plugin","slug":"south-pole-the-offset-movement","name":"South Pole: Climate action now","from":"*","from_inclusive":true,"to":"1.0.2.0","to_inclusive":false,"patched_in":"1.0.2.0"},{"type":"plugin","slug":"littlebot-invoices","name":"LittleBot Invoices","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"genealogical-tree","name":"Genealogical Tree \u2013 Family Tree & Ancestry for WordPress","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"},{"type":"plugin","slug":"automatic-youtube-gallery","name":"Automatic YouTube Gallery \u2013 Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"},{"type":"plugin","slug":"wc-thanks-redirect","name":"Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"},{"type":"plugin","slug":"easy-marijuana-age-verify","name":"Marijuana Age Verify","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"woocommerce-upcoming-product","name":"WooCommerce upcoming Products","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"frontend-admin","name":"Frontend Admin \u2013 Add and edit posts, pages, users and more all from the frontend","from":"*","from_inclusive":true,"to":"3.3.33","to_inclusive":false,"patched_in":"3.3.33"},{"type":"plugin","slug":"sv-tracking-manager","name":"SV Tracking Manager","from":"*","from_inclusive":true,"to":"1.8.02","to_inclusive":false,"patched_in":"1.8.02"},{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":false,"patched_in":"4.0.2"},{"type":"plugin","slug":"seo-checklist","name":"WordPress SEO Checklist","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wgauge","name":"wGauge \u2013 Free Version","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"},{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"},{"type":"plugin","slug":"wp-tools-divi-product-carousel","name":"Divi Product Carousel","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"},{"type":"plugin","slug":"social-gallery-lite","name":"Social Gallery Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"},{"type":"plugin","slug":"five-star-ratings-shortcode","name":"Five-Star Ratings Shortcode","from":"*","from_inclusive":true,"to":"1.2.39","to_inclusive":false,"patched_in":"1.2.39"},{"type":"plugin","slug":"advanced-nocaptcha-recaptcha","name":"CAPTCHA 4WP \u2013 Antispam CAPTCHA solution for WordPress","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":false,"patched_in":"7.0.5"},{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"},{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":false,"patched_in":"7.6.3"},{"type":"plugin","slug":"surbma-gdpr-proof-google-analytics","name":"Surbma | GDPR Proof Cookie Consent & Notice Bar","from":"*","from_inclusive":true,"to":"17.5.3","to_inclusive":false,"patched_in":"17.5.3"},{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-live-tv","name":"Live TV Player \u2013 Worldwide Live TV Channels Player for WordPress","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"market-exporter","name":"Market Exporter","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"},{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"},{"type":"plugin","slug":"tk-google-fonts","name":"TK Google Fonts","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"},{"type":"plugin","slug":"starfish-reviews","name":"Starfish Review Generation & Marketing for WordPress","from":"*","from_inclusive":true,"to":"3.0.26","to_inclusive":false,"patched_in":"3.0.26"},{"type":"plugin","slug":"wp-emaily","name":"WP Emaily","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"education-addon","name":"Education Addon for Elementor","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"},{"type":"plugin","slug":"sv-provenexpert","name":"SV Proven Expert","from":"*","from_inclusive":true,"to":"1.8.01","to_inclusive":false,"patched_in":"1.8.01"},{"type":"plugin","slug":"surveyfunnel-lite","name":"SurveyFunnel \u2013 Survey Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":false,"patched_in":"1.8.8"},{"type":"plugin","slug":"music-player-for-elementor","name":"Music Player for Elementor \u2013 Audio Player & Podcast Player","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"},{"type":"plugin","slug":"cryptocurrency-product-for-woocommerce","name":"Cryptocurrency Product for WooCommerce","from":"*","from_inclusive":true,"to":"3.14.6","to_inclusive":false,"patched_in":"3.14.6"},{"type":"plugin","slug":"next-order-coupon-woocommerce","name":"WooCommerce Next Order Coupon","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"overlay-image-divi-module","name":"Overlay Image Divi Module","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"},{"type":"plugin","slug":"email-header-footer","name":"Email Header Footer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"embed-office-viewer","name":"Document Viewer \u2013 let visitors view files right in the browser","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"},{"type":"plugin","slug":"price-bands-for-woocommerce","name":"Price Bands for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.11.14","to_inclusive":false,"patched_in":"1.11.14"},{"type":"plugin","slug":"smart-variations-images","name":"Smart Variations Images & Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":false,"patched_in":"5.1.10"},{"type":"plugin","slug":"featured-images-for-rss-feeds","name":"Featured Images in RSS for Mailchimp & More","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"},{"type":"plugin","slug":"simple-sponsorships","name":"Simple Sponsorships","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"},{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"},{"type":"plugin","slug":"sparrow","name":"Sparrow: Product Reviews and Ratings for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"auto-advance-for-gravity-forms","name":"Multi Page Auto Advance for Gravity Forms","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"},{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":false,"patched_in":"3.3.11"},{"type":"plugin","slug":"live-scores-for-sportspress","name":"Live Scores for SportsPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"hide-shipping-method-for-woocommerce","name":"Hide Shipping Method For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"ultimate-carousel-for-divi","name":"Ultimate Carousel For Divi","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"},{"type":"plugin","slug":"wp-meta-and-date-remover","name":"WP Meta and Date Remover","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":false,"patched_in":"1.9.6"},{"type":"plugin","slug":"image-carousel-for-divi","name":"Image Carousel For Divi","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"comments-not-replied-to","name":"Comments Not Replied To","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"},{"type":"plugin","slug":"integration-of-capsule-crm-for-contact-form-7","name":"Contact Form 7 \u2013 Capsule CRM \u2013 Integration","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"},{"type":"plugin","slug":"opensea","name":"Opensea","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"},{"type":"plugin","slug":"tranzly","name":"Tranzly\u2122 \u2013 AI Translation & Multilingual","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"},{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.14.3","to_inclusive":false,"patched_in":"1.14.3"},{"type":"plugin","slug":"modern-addons-elementor","name":"Modern Addons for Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"theme","slug":"viralike","name":"Viralike","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-dev-powers-element-selector-jquery-powers","name":"WordPress Dev Powers \u2013 Element Selector jQuery Powers Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-munich-blocks","name":"WP Munich Blocks \u2013 Gutenberg Blocks for WordPress","from":"*","from_inclusive":true,"to":"0.11.0","to_inclusive":false,"patched_in":"0.11.0"},{"type":"plugin","slug":"date-time-picker-field","name":"Availability Datepicker \u2013 Booking Calendar for Contact Form 7 \u2013 Input WP","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"mrkwp-footer-for-divi","name":"Footer Plugin for Divi","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-stripe-donation","name":"AidWP \u2013 Donation & Payment Forms (Stripe Powered)","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"},{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"},{"type":"plugin","slug":"gfirem-advance-search","name":"GFireM Advance Search","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpmailer","name":"WPMailer \u2013 The best mail builder, No More Core for your emails support Elementor, CF7 forms etc\u2026","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.6.72","to_inclusive":false,"patched_in":"1.6.72"},{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"},{"type":"theme","slug":"speculor","name":"Speculor","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-google-street-view","name":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"},{"type":"plugin","slug":"everse-starter-sites","name":"WordPress Everse Starter Sites \u2013 Elementor Templates","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"},{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"},{"type":"plugin","slug":"choice-payment-gateway-for-woocommerce","name":"Choice Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"},{"type":"plugin","slug":"domain-mapping-system","name":"Domain Mapping System | Create Microsites with Multiple Alias Domains (multisite optional)","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"},{"type":"plugin","slug":"order-and-inventory-manager-for-woocommerce","name":"Order and Inventory Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"},{"type":"plugin","slug":"ninjalibs-ses","name":"Ninja Libs Amazon SES","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"delete-all-comments-of-website","name":"WP Comment Cleaner \u2013 Delete All Comments, Disable Comments, Bulk Delete & Remove Comments","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"},{"type":"plugin","slug":"wp-cron-status-checker","name":"WP-Cron Status Checker","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"custom-codes","name":"CodeKit \u2013 Custom Codes Editor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.1.34","to_inclusive":false,"patched_in":"2.1.34"},{"type":"plugin","slug":"change-wc-price-title","name":"Change Price Title for WooCommerce","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"},{"type":"plugin","slug":"edge-gallery","name":"WordPress Gallery Plugin \u2013 Edge Photo Gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"glorious-services-support","name":"Glorious Services & Support","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-newsletter-signups","name":"Easy Newsletter Signups","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"},{"type":"plugin","slug":"advanced-database-replacer","name":"Advanced Database Replacer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"multisite-robotstxt-manager","name":"Multisite Robots.txt Manager","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"simple-facebook-twitter-widget","name":"Simple Social Page Widget & Shortcode","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-country-restrictions-advanced","name":"Restrict Products by Country & Country Catalogs for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":false,"patched_in":"1.13.0"},{"type":"plugin","slug":"front-end-pm","name":"Front End PM","from":"*","from_inclusive":true,"to":"11.3.4","to_inclusive":false,"patched_in":"11.3.4"},{"type":"plugin","slug":"sumo-divi-modules","name":"Ultimate Divi Modules Suite \u2013 Divi Sumo Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"xt-woo-points-rewards","name":"XT Points & Rewards for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"},{"type":"plugin","slug":"woo-products-widgets-for-elementor","name":"Widgets for WooCommerce Products on Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"},{"type":"plugin","slug":"delivery-woo","name":"Delivery for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-twilio-core","name":"NotifSMS \u2013 SMS Notifications OTP & 2FA for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"},{"type":"plugin","slug":"security-ninja","name":"Security Ninja \u2013 WordPress Security & Firewall","from":"*","from_inclusive":true,"to":"5.135","to_inclusive":false,"patched_in":"5.135"},{"type":"plugin","slug":"tinymce-annotate","name":"TinyMCE Annotate","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"justified-gallery","name":"Justified Gallery","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"},{"type":"plugin","slug":"book-buyback-prices","name":"Book BuyBack Prices","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fuse-social-floating-sidebar","name":"Fuse Social Icons","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":false,"patched_in":"5.4.3"},{"type":"plugin","slug":"wp-hr-manager","name":"WP-HR Manager: The Human Resources Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"},{"type":"plugin","slug":"emails-blacklist-everest-forms","name":"Emails Blacklist for Everest Forms","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"},{"type":"plugin","slug":"woo-admin-product-notes","name":"Woo Admin Product Notes","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"remove-add-to-cart-woocommerce","name":"Remove Add to Cart WooCommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"},{"type":"plugin","slug":"wc-zelle","name":"Checkout with Zelle on Woocommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"plugin","slug":"wp-tools-gravity-forms-divi-module","name":"Divi Gravity Forms (WP Tools)","from":"*","from_inclusive":true,"to":"6.6.3","to_inclusive":false,"patched_in":"6.6.3"},{"type":"theme","slug":"everse","name":"Everse","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"},{"type":"plugin","slug":"run-time-image-resizing","name":"Run time Image resizing","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rest-routes","name":"Rest Routes \u2013 Custom Endpoints for WordPress REST API","from":"*","from_inclusive":true,"to":"4.24.0","to_inclusive":false,"patched_in":"4.24.0"},{"type":"plugin","slug":"widget-for-contact-form-7","name":"Widget for Contact form 7","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-pinterest-conversion-tags","name":"Add Pinterest conversion tags for Pinterest Ads +  Site verification","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":false,"patched_in":"3.6.1"},{"type":"plugin","slug":"wp-bugbot","name":"WP BugBot","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"theme","slug":"nokke","name":"Nokke","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":false,"patched_in":"1.0.11"},{"type":"plugin","slug":"woo-customers-spreadsheet-bulk-edit","name":"Customers Table for WooCommerce: View, Search, Bulk Editor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"plugin","slug":"sync-ecommerce-neo","name":"Sync eCommerce NEO","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"preloader-for-divi","name":"Preloader for Divi","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"more-better-reviews-for-woocommerce","name":"Get Better Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"},{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.15.14","to_inclusive":false,"patched_in":"2.15.14"},{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"4.2.18","to_inclusive":false,"patched_in":"4.2.18"},{"type":"theme","slug":"shuban","name":"Shuban","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-for-woocommerce-product","name":"ACF for WooCommerce Product","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"},{"type":"plugin","slug":"scheduled-notification-bar","name":"Scheduled Notification Bar","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"3d-viewer","name":"3D Viewer \u2013 Turn Product Pages into Interactive 3D Experiences","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"},{"type":"plugin","slug":"animated-fullscreen-menu","name":"Fullscreen Menu","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"},{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"},{"type":"plugin","slug":"demomentsomtres-grid-archive","name":"DeMomentSomTres Grid Archive","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"inbound-brew","name":"Inbound Brew","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-photo-effects","name":"WP Photo Effects","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"},{"type":"plugin","slug":"wpoptin","name":"WPOptin \u2013 AI-Powered Top Bars, PopUps & Lead Generation","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"woo-conditional-product-fees-for-checkout","name":"Extra Fees for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"},{"type":"plugin","slug":"reset-course-progress-for-learndash","name":"Reset Course Progress For LearnDash","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"podcast-box","name":"Podcast Box \u2013 Best Podcasting Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"protected-page","name":"The best plugin for restrict content, support all Custom Post Types and Elementor \u2013 Password Protected","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"turbo-widgets","name":"Turbo Widgets","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"3.5.5.2","to_inclusive":false,"patched_in":"3.5.5.2"},{"type":"plugin","slug":"gift-message-for-woocommerce","name":"Gift Message for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"},{"type":"plugin","slug":"azw-woocommerce-file-uploads","name":"azw woocommerce file uploads","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"},{"type":"theme","slug":"broadcast-lite","name":"Broadcast Lite","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"},{"type":"plugin","slug":"foobar-notifications-lite","name":"Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":false,"patched_in":"2.1.15"},{"type":"plugin","slug":"sexy-author-bio","name":"WP Author Bio","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rw-divi-unite-gallery","name":"RW Divi Unite Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"0.6.7","to_inclusive":false,"patched_in":"0.6.7"},{"type":"plugin","slug":"product-image-watermark-for-woo","name":"Product Image Watermark for Woo","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.49.0","to_inclusive":false,"patched_in":"1.49.0"},{"type":"plugin","slug":"revolution-for-elementor","name":"Revolution for Elementor","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"coneblog-widgets","name":"ConeBlog \u2013 Elementor Blog Widgets","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"},{"type":"plugin","slug":"easy-under-construction","name":"Under Construction","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"},{"type":"plugin","slug":"wp-gratify","name":"WP Gratify","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"automizy-gravity-forms","name":"Automizy Gravity Forms","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-on-pages","name":"Widgets on Pages","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"},{"type":"plugin","slug":"feedback-suite","name":"Get feedback from visitors \u2013 WP Feedback Suite Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buffer-my-post","name":"WordPress Buffer \u2013 HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule","from":"*","from_inclusive":true,"to":"2020.1.0","to_inclusive":false,"patched_in":"2020.1.0"},{"type":"plugin","slug":"content-aware-sidebars","name":"Content Aware Sidebars \u2013 Fastest Widget Area Plugin","from":"*","from_inclusive":true,"to":"3.17.2","to_inclusive":false,"patched_in":"3.17.2"},{"type":"theme","slug":"bani","name":"Bani","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fast-wp","name":"Fast WordPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"skt-templates","name":"SKT Templates \u2013 100% Free Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"},{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"},{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"5.4.4"},{"type":"plugin","slug":"add-twitter-pixel","name":"Add Twitter Pixel for Twitter ads","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"xt-woo-variation-swatches","name":"XT Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"},{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":false,"patched_in":"1.5.11"},{"type":"plugin","slug":"woo-authorize-net-gateway-aim","name":"Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins","from":"*","from_inclusive":true,"to":"5.1.27","to_inclusive":false,"patched_in":"5.1.27"},{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"},{"type":"plugin","slug":"review-engine","name":"Affiliate Link Builder Plugin for Amazon Associates \u2013 Review Engine","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"glossary-by-codeat","name":"Glossary","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"},{"type":"plugin","slug":"wp-seo-keyword-optimizer","name":"BAVOKO SEO Tools \u2013 All-in-One WordPress SEO","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cartoon-url","name":"Cartoon Url","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"display-admin-page-on-frontend","name":"WP Frontend Admin \u2013 Display WP Admin Pages in the Frontend","from":"*","from_inclusive":true,"to":"1.17.0.4","to_inclusive":false,"patched_in":"1.17.0.4"},{"type":"plugin","slug":"bp-toolkit","name":"Block, Suspend, Report for BuddyPress","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"},{"type":"plugin","slug":"menu-image","name":"Menu Image, Icons made easy","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"},{"type":"plugin","slug":"xt-woo-ajax-add-to-cart","name":"XT Ajax Add To Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"one-click-login","name":"One Click Login","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ether-and-erc20-tokens-woocommerce-payment-gateway","name":"Ether and ERC20 tokens WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"4.12.9","to_inclusive":false,"patched_in":"4.12.9"},{"type":"plugin","slug":"order-on-chat-for-woocommerce","name":"Chat Button- Leads and Order over Chat","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"},{"type":"plugin","slug":"woocommerce-shipping-gateway-per-product","name":"Dreamfoxmedia Shipping Methods per Product for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"},{"type":"theme","slug":"purosa","name":"Purosa","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"nichetable","name":"NicheTable \u2013 Responsive Comparison Table Block","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"},{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"},{"type":"theme","slug":"wp-sierra","name":"WP Sierra","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-checkout-for-digital-goods","name":"Digital Goods for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":false,"patched_in":"3.6.4"},{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":false,"patched_in":"3.8.5"},{"type":"plugin","slug":"fullworks-anti-spam","name":"Anti-Spam Protection \u2013 No API Key, GDPR Friendly","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"},{"type":"plugin","slug":"ultimate-widgets-light","name":"Ultimate Widgets Light","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000016","to_inclusive":false,"patched_in":"4.3000000016"},{"type":"plugin","slug":"appexperts","name":"APPExperts \u2013 Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"},{"type":"plugin","slug":"caxton","name":"Caxton \u2013 Create Pro page layouts in Gutenberg","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":false,"patched_in":"1.30.0"},{"type":"plugin","slug":"nitek-carousel-cool-transitions","name":"Nitek Carousel Slider Cool Transitions","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"extend-filter-products-by-price-widget","name":"Extend Filter Products By Price Widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blockmeister","name":"BlockMeister \u2013 Block Pattern Builder","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"},{"type":"plugin","slug":"yatri-tools","name":"Yatri Tools","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"plugin","slug":"restricted-content","name":"Restrict \u2013 membership, site, content and user access restrictions for WordPress","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":false,"patched_in":"2.1.9"},{"type":"plugin","slug":"change-prices-with-time-for-woocommerce","name":"Change Prices with Time for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-extra-flat-rate","name":"Flat Rate Shipping Method for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"responsive-facebook-and-twitter-widget","name":"Responsive Social Slider Widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"menu-item-scheduler","name":"Menu Item Scheduler","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blog-sidebar-widget","name":"Blog Sidebar Widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"multipurpose-block","name":"Multipurpose Gutenberg Block","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"},{"type":"plugin","slug":"full-page-blog-designer","name":"Full Page Blog Designer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-swatches-manager","name":"WooCommerce Variation Swatches for Products","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":false,"patched_in":"4.4.0"},{"type":"plugin","slug":"simple-feature-requests","name":"Simple Feature Requests Free \u2013 User Feedback Board","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":false,"patched_in":"2.2.4"},{"type":"plugin","slug":"bulk-edit-categories-tags","name":"Bulk Edit Categories and Tags \u2013 Create Thousands Quickly on the Editor","from":"*","from_inclusive":true,"to":"1.5.23","to_inclusive":false,"patched_in":"1.5.23"},{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"},{"type":"plugin","slug":"sky-login-redirect","name":"Sky Login Redirect","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"},{"type":"plugin","slug":"ga-for-wp","name":"TrueAna \u2013 True Analytics Dashboard","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"},{"type":"plugin","slug":"collage-for-divi","name":"Divi Collage","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-persistent-login","name":"Persistent Login","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"deal-of-the-day","name":"Deals of the Day WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"lktags-linkedin-insight-tags","name":"Add LinkedIn Insight Tag for LinkedIn Ads","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"easy-settings-for-learndash","name":"Easy Settings for LearnDash","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"1.67","to_inclusive":false,"patched_in":"1.67"},{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":false,"patched_in":"6.3.4"},{"type":"plugin","slug":"nexus","name":"NEXUS","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"meridia","name":"Meridia","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"},{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":false,"patched_in":"2.8.12"},{"type":"plugin","slug":"delete-old-posts-programmatically","name":"Auto Post Cleaner","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"},{"type":"theme","slug":"brand","name":"Brand","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":false,"patched_in":"2.9.2"},{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"},{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"plugin","slug":"content-restrictor-for-divi","name":"Divi Content Restrictor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.1"},{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"},{"type":"plugin","slug":"premmerce-woocommerce-variation-swatches","name":"Premmerce Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"},{"type":"plugin","slug":"portfolio-elementor","name":"PowerFolio \u2013 Portfolio & Image Gallery for Elementor","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"},{"type":"plugin","slug":"ssl-atlas-free-ssl-certificate-https-redirect","name":"SSL Atlas \u2013 Free SSL Certificate & HTTPS Redirect for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"},{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":false,"patched_in":"2.3.6"},{"type":"plugin","slug":"easy-tiktok-feed","name":"Easy TikTok Feed \u2013 TikTok Video, Feed & Gallery Plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"},{"type":"plugin","slug":"pop-over-xyz","name":"PopOverXYZ \u2013 Show Light Weight Beautiful Tool Tips On Any Text","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bulk-image-alt-text-with-yoast","name":"Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)","from":"*","from_inclusive":true,"to":"1.4.5.0","to_inclusive":false,"patched_in":"1.4.5.0"},{"type":"plugin","slug":"number-chat","name":"Number Chat","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rating-widget","name":"Rating-Widget: Star Review System","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"},{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"*","from_inclusive":true,"to":"0.10.2","to_inclusive":false,"patched_in":"0.10.2"},{"type":"plugin","slug":"expire-tags","name":"Expire tags","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"go-viral","name":"Go Viral \u2013 social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"},{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"},{"type":"plugin","slug":"dashylite","name":"Dashy \u2013 Google Analytics advanced dashboard","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":false,"patched_in":"1.0.11"},{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"*","from_inclusive":true,"to":"2.4.0.6","to_inclusive":false,"patched_in":"2.4.0.6"},{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":false,"patched_in":"2.4.3.1"},{"type":"plugin","slug":"seo-site-auditor-agency","name":"SEO Audit \u2013 WP Site Auditor","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"plugin","slug":"reviewpress","name":"WordPress Reviews by ReviewPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":false,"patched_in":"5.3.8"},{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.2.7","to_inclusive":false,"patched_in":"2.8.2.7"},{"type":"plugin","slug":"wp-smart-export","name":"WP Smart Export (Free)","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"},{"type":"plugin","slug":"wp-conference-schedule","name":"WP Conference Schedule","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"woo-fiscalita-italiana","name":"Strumenti Partita IVA per Woocommerce","from":"*","from_inclusive":true,"to":"1.3.23","to_inclusive":false,"patched_in":"1.3.23"},{"type":"plugin","slug":"anfrageformular","name":"Anfrageformular \u2013 Multi Step Drag & Drop Formular Builder \u2013 Leadgenerierung","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-brands","name":"Premmerce Brands for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":false,"patched_in":"1.2.12"},{"type":"plugin","slug":"ethereum-wallet","name":"Ethereum Wallet","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":false,"patched_in":"4.0.9"},{"type":"plugin","slug":"limb-gallery","name":"Limb Gallery | Create Beautiful Image & Video Galleries","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"},{"type":"plugin","slug":"code-manager","name":"Code Manager","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":false,"patched_in":"1.0.14"},{"type":"plugin","slug":"payment-gateway-payfabric","name":"Payment Gateway for PayFabric","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cp-simple-newsletter","name":"CP Simple Newsletter","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ach-for-stripe-plaid","name":"LittleBot ACH for Stripe + Plaid","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"aquarella-lite","name":"Aquarella Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"commerce-coinbase-for-woocommerce","name":"Coinbase Business Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"theme","slug":"villar","name":"Villar","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"plugin","slug":"map-location-picker-at-checkout-for-woocommerce","name":"Kikote \u2013 Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"},{"type":"plugin","slug":"age-verification-screen-for-woocommerce","name":"Age Verification Screen for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"woo-ecommerce-tracking-for-google-and-facebook","name":"Enhanced Ecommerce Google Analytics for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":false,"patched_in":"3.6.3"},{"type":"plugin","slug":"joli-faq-seo","name":"Joli FAQ SEO \u2013 WordPress FAQ Plugin","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"mass-pagesposts-creator","name":"Mass Pages/Posts Creator","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":false,"patched_in":"2.1.5"},{"type":"plugin","slug":"wp-relevant-ads","name":"WP Relevant Ads","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"glorious-sites-installer","name":"GloriousThemes Starter Sites","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-facebook-group","name":"WP Group Promoter","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"airpress","name":"Airpress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-structured-data-schema","name":"Schema Plugin For Divi, Gutenberg & Shortcodes","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"},{"type":"plugin","slug":"giveaways-for-woocommerce","name":"Giveaways for woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"login-customizer","name":"Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"},{"type":"theme","slug":"learnmore","name":"LearnMore","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"demomentsomtres-media-tools-auto","name":"DeMomentSomTres Media Tools Auto","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":false,"patched_in":"1.9.4"},{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.2.9","to_inclusive":false,"patched_in":"5.2.9"},{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"},{"type":"plugin","slug":"faq-manager-with-structured-data","name":"FAQ Manager For Divi, Gutenberg Block & Shortcode","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":false,"patched_in":"5.4.1"},{"type":"plugin","slug":"app-ads-txt","name":"Ads.txt & App-ads.txt Manager for WordPress","from":"*","from_inclusive":true,"to":"1.1.7.0","to_inclusive":false,"patched_in":"1.1.7.0"},{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":false,"patched_in":"8.0.2"},{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"plugin","slug":"svg-flags-lite","name":"SVG Flags \u2013 Country Flag Blocks and Galleries","from":"*","from_inclusive":true,"to":"0.9.6","to_inclusive":false,"patched_in":"0.9.6"},{"type":"plugin","slug":"drip-feed-content-extended-for-learndash","name":"Drip Feed Content Extended for Learndash","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"post-list-designer","name":"Post List Designer \u2013 Category Post, Recent Post, Post List","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"},{"type":"plugin","slug":"conversion-de-moneda","name":"Conversion de moneda Woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"vidseo","name":"VidSEO \u2013 Video transcript embedding for WordPress & LLM","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"before-and-after-product-images-for-woocommerce","name":"Before and After Product Images for WooCommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bo-wc-customer-review-watson","name":"Woocommerce Customer Reviews with Artificial Intelligence analyzis,  with IBM Watson Tone Analyzer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"lawpress","name":"LawPress \u2013 Law Firm Website Management","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-shipping-display-mode","name":"Shipping Method Display Style for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":false,"patched_in":"3.7.5"},{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.33","to_inclusive":false,"patched_in":"1.3.33"},{"type":"plugin","slug":"sql-reporting-services","name":"SQL Reporting Services \u2013 SSRS Plugin for WordPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-sheet-editor-bulk-spreadsheet-editor-for-posts-and-pages","name":"Bulk Edit Posts and Products in Spreadsheet","from":"*","from_inclusive":true,"to":"2.24.13","to_inclusive":false,"patched_in":"2.24.13"},{"type":"plugin","slug":"delete-duplicate-posts","name":"Delete Duplicate Posts","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":false,"patched_in":"4.7.5"},{"type":"plugin","slug":"ws-bootstrap-vc","name":"WS Bootstrap","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"clean-social-icons","name":"Clean Social Icons","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"media-download","name":"Media Library File Download","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"},{"type":"plugin","slug":"wp-link-bio","name":"WP Link Bio","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"},{"type":"plugin","slug":"automatic-internal-links-for-seo","name":"Automatic Internal Links for SEO by Pagup","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":false,"patched_in":"1.13.6"},{"type":"plugin","slug":"woo-product-reviews-shortcode","name":"Builder for WooCommerce product reviews shortcodes \u2013 ReviewShort","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":false,"patched_in":"1.0.17"},{"type":"plugin","slug":"contact-list","name":"Contact List \u2013 Online Staff Directory & Address Book","from":"*","from_inclusive":true,"to":"2.9.50","to_inclusive":false,"patched_in":"2.9.50"},{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":false,"patched_in":"3.1.7"},{"type":"plugin","slug":"socialmark","name":"SocialMark \u2013 Easy Watermark/Logo on Social Media Post Link Share Preview","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"},{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.11.4","to_inclusive":false,"patched_in":"3.11.4"},{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"},{"type":"plugin","slug":"treepress","name":"TreePress \u2013 Easy Family Trees & Ancestor Profiles","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":false,"patched_in":"2.0.21"},{"type":"plugin","slug":"postcode-redirect","name":"Postcode Redirect","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"5.0.0"},{"type":"plugin","slug":"wc-product-author","name":"Product Author for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"},{"type":"plugin","slug":"wp-coupons-and-deals","name":"WP Coupons and Deals \u2013 WordPress Coupon Plugin","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":false,"patched_in":"3.1.12"},{"type":"plugin","slug":"feedpress-generator","name":"Feedpress Generator \u2013 External RSS Frontend Customizer","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"},{"type":"plugin","slug":"wp-automedic","name":"WP AutoMedic","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"banner-management-for-woocommerce","name":"Banner Management For WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"},{"type":"plugin","slug":"duplicate-variations-for-woocommerce","name":"Duplicate Variations for Woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"send-prebuilt-emails","name":"Send Prebuilt Emails","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"helpie-faq","name":"Helpie FAQ \u2014 Accordion, Docs & Knowledge Base","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"},{"type":"plugin","slug":"livemesh-siteorigin-widgets","name":"Livemesh SiteOrigin Widgets","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"},{"type":"plugin","slug":"addons-for-beaver-builder","name":"Livemesh Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.8.4"},{"type":"plugin","slug":"tabs-with-posts","name":"Tabs with Recommended Posts (Widget)","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-es","name":"Connect WooCommerce Shop to ERP/CRM, Verifactu and EU/VAT Compliance","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"},{"type":"plugin","slug":"wp-auto-republish","name":"RevivePress \u2013 Keep your Old Content Evergreen","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"wp-fail2ban","name":"WP fail2ban \u2013 Advanced Security","from":"*","from_inclusive":true,"to":"4.4.0.2","to_inclusive":false,"patched_in":"4.4.0.2"},{"type":"plugin","slug":"ultra-elementor-addons","name":"Ultra Elementor Addons","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"recurwp","name":"RecurWP \u2013 WordPress Recurly Payment Gateway","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buttonizer-multifunctional-button","name":"Buttonizer \u2013 Floating Menus, Sticky Buttons, & Popup Builder","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"},{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.2.17","to_inclusive":false,"patched_in":"9.2.17"},{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"3.5.5"},{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.17","to_inclusive":false,"patched_in":"2.7.17"},{"type":"plugin","slug":"wp-dev-powers-display-screen-dimensions-to-admin","name":"WP Dev Powers \u2013 Display Screen Dimensions to Admin Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-bulk-seo-noindex-nofollow","name":"Ultimate Bulk SEO Noindex Nofollow \u2013 Speed up Penalty Recovery Ultimate SEO Booster","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":false,"patched_in":"5.1.4"},{"type":"plugin","slug":"woocustomizer","name":"StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"},{"type":"plugin","slug":"wp-top-news","name":"WP Top News \u2014 Build a Complete News Portal in WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"plugin","slug":"user-menus","name":"User Menus \u2013 Nav Menu Visibility","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"},{"type":"plugin","slug":"contact-form-7-multi-step-module","name":"Webheadcoder Multi-Step Forms for Contact Form 7","from":"*","from_inclusive":true,"to":"4.1.91","to_inclusive":false,"patched_in":"4.1.91"},{"type":"plugin","slug":"easy-age-verify","name":"Easy Age Verify","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"},{"type":"plugin","slug":"blocked-in-china","name":"Blocked in China | Check if your site is available in the Chinese mainland","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"},{"type":"plugin","slug":"woo-conditional-payment-gateways","name":"Disable Payment Methods based on cart conditions for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.1.1","to_inclusive":false,"patched_in":"1.13.1.1"},{"type":"plugin","slug":"awesome-ssl","name":"Awesome SSL","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"iks-menu","name":"Iks Menu \u2013 WordPress Category Accordion Menu & FAQs","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":false,"patched_in":"1.9.2"},{"type":"theme","slug":"purus","name":"Purus","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"hooked-editable-content","name":"Hooked Editable Content","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"contest-code-checker","name":"Run Contests, Raffles, and Giveaways with ContestsWP","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":false,"patched_in":"1.9.0"},{"type":"plugin","slug":"post-carousel-divi","name":"Post Carousel Divi","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"},{"type":"plugin","slug":"rm-mailchimp-manager","name":"MailChimp Manager","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-permalink-manager","name":"Premmerce Permalink Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"},{"type":"plugin","slug":"secure-ip-logins","name":"Secure IP Logins","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"video-embed-thumbnail-generator","name":"Videopack","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":false,"patched_in":"4.7.4"},{"type":"plugin","slug":"woo-customers-manager","name":"Premmerce WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":false,"patched_in":"1.1.13"},{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"plugin","slug":"addons-for-divi","name":"Divi Torque Lite","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":false,"patched_in":"3.5.0"},{"type":"plugin","slug":"events-calendar-registration-booking-by-events-plus","name":"Events Calendar Registration","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rocket-maintenance-mode","name":"Rocket Maintenance Mode & Coming Soon Page","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"},{"type":"plugin","slug":"wp-woo-commerce-sync-for-g-sheet","name":"WordPress WooCommerce Sync for Google Sheet","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-smooth-scroll-links","name":"Easy Smooth Scroll Links  \u2013 Smooth Scrolling Anchor","from":"*","from_inclusive":true,"to":"2.23.1","to_inclusive":false,"patched_in":"2.23.1"},{"type":"plugin","slug":"kioken-blocks","name":"Page Builder Gutenberg Blocks \u2013 Kioken Blocks","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cryptocurrency","name":"Cryptocurrency Portfolio Tracker","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"go-fetch-jobs-wp-job-manager","name":"Go Fetch Jobs (for WP Job Manager)","from":"*","from_inclusive":true,"to":"1.7.3.2","to_inclusive":true,"patched_in":"1.7.3.2.4"},{"type":"plugin","slug":"quick-affiliate-store","name":"Quick Affiliate Store","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-tools-divi-blog-carousel","name":"Divi Blog Carousel","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"post-to-google-my-business","name":"Post to Google My Business (Google Business Profile)","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":false,"patched_in":"3.0.10"},{"type":"theme","slug":"nichebase","name":"NicheBase","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"plugin","slug":"visitor-info","name":"WPVisitorInfo \u2013 Show Visitor Information & Conditional Data Based On That Information","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce","name":"Premmerce","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"},{"type":"plugin","slug":"cartpops","name":"CartPops \u2013 WooCommerce Side Cart, Cart Drawer & Cart Popup","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":false,"patched_in":"1.4.17"},{"type":"plugin","slug":"scrollsequence","name":"Scrollsequence \u2013 Cinematic Scroll Image Animation Plugin","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"theme","slug":"elation","name":"Elation","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"cuisine-palace","name":"Cuisine Palace","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-product-attachment","name":"Product Attachment for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"},{"type":"plugin","slug":"master-blocks","name":"Master Blocks \u2013 Gutenberg Site Builder","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"uni-woo-custom-product-options","name":"Product Options and Price Calculation Formulas for WooCommerce \u2013 Uni CPO","from":"*","from_inclusive":true,"to":"4.9.14","to_inclusive":false,"patched_in":"4.9.14"},{"type":"plugin","slug":"wp-offers","name":"WordPress Coupon Plugin for Bloggers and Marketers \u2013 WP Offers","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"},{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":false,"patched_in":"5.3.1"},{"type":"plugin","slug":"widgets-on-pages-and-posts","name":"Widgets on Pages and Posts","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"better-messages-wcfm-integration","name":"Better Messages \u2013 WCFM Integration","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sheetpress","name":"SheetPress \u2013 Manage WordPress Meta data with Google Sheets","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-options-importexport","name":"Advanced Custom Fields options import/export","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.22","to_inclusive":false,"patched_in":"5.7.22"},{"type":"plugin","slug":"card-oracle","name":"Tarot Card Oracle","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"},{"type":"plugin","slug":"better-sharing","name":"Better Sharing","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"},{"type":"plugin","slug":"wupo-group-attributes","name":"WUPO Group Attributes for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"},{"type":"plugin","slug":"nugget-by-ingot","name":"Nugget by Ingot: Easy, automated and native A/B testing for everyone","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"feedbackscout","name":"FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback.","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"arendelle","name":"Arendelle","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"plugin","slug":"easy-zillow-reviews","name":"Easy Zillow Reviews","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"plugin","slug":"ds-suit","name":"Battle Suit for Divi","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-store-toolkit","name":"Store Toolkit \u2013  WooCommerce Extensions, Quick Enhancements & Handy Tools","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"},{"type":"plugin","slug":"wcc-seo-keyword-research","name":"WCC SEO Keyword Research","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"elements-for-lifterlms","name":"Elements for LifterLMS","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-registration-and-login-forms-with-new-recaptcha","name":"Custom Registration and Custom Login Forms with New Recaptcha","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-add-to-quote","name":"B2B Request a Quote","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":false,"patched_in":"1.4.9"},{"type":"plugin","slug":"wadi-survey","name":"Wadi Survey","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"performance-kit","name":"Performance Kit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"starterblocks","name":"Page Builder for Gutenberg \u2013 StarterBlocks","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fusionspan-impexium-single-sign-on","name":"Impexium Single Sign On","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"xt-woo-quick-view-lite","name":"XT Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":false,"patched_in":"1.9.6"},{"type":"plugin","slug":"drag-and-drop-form-builder-for-contact-form-7","name":"Live Drag and Drop Builder for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"},{"type":"plugin","slug":"jds-portfolio","name":"JDs Portfolio","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"twentyfourth-wp-scraper","name":"TwentyFourth WP Scraper","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"1.8.20","to_inclusive":false,"patched_in":"1.8.20"},{"type":"plugin","slug":"wpgt-google-translate","name":"WordPress Google Translate","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"},{"type":"theme","slug":"hasium","name":"Hasium","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"},{"type":"plugin","slug":"station-pro","name":"Station Pro \u2013 Advanced Audio Streaming & Player for WordPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.3.0.1","to_inclusive":false,"patched_in":"5.3.0.1"},{"type":"plugin","slug":"woo-paylate","name":"Gateway for PayLate on WooCommerce","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5.2"},{"type":"plugin","slug":"meta-tags-for-seo","name":"Auto SEO META keywords (META tags keywords) optimization + WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"co2ok-for-woocommerce","name":"ClimateClick: Climate Action for all","from":"*","from_inclusive":true,"to":"1.0.9.21","to_inclusive":true,"patched_in":"1.0.9.22"},{"type":"plugin","slug":"woo-seo-addon","name":"Premmerce SEO for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":false,"patched_in":"2.1.5"},{"type":"plugin","slug":"woo-wholesale-pricing","name":"Wholesale for WooCommerce \u2013 Ultimate AI-Powered B2B Ecommerce Solution \u2013 Bulk Order Form, Quotes, & More","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"},{"type":"plugin","slug":"frontend-group-restriction-for-learndash","name":"Frontend group restriction for LearnDash","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"really-simple-featured-video","name":"Really Simple Featured Video for Posts, Pages & WooCommerce Products","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":"0.5.2"},{"type":"plugin","slug":"widget-for-eventbrite-api","name":"Display Eventbrite Events","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":false,"patched_in":"4.4.8"},{"type":"plugin","slug":"woo-floating-cart-lite","name":"XT Floating Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"},{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"},{"type":"plugin","slug":"wp-spid-italia","name":"WP SPID Italia","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"},{"type":"plugin","slug":"tier-pricing-table","name":"Tiered Pricing Table for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"},{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"postmatic","name":"Replyable \u2013 Subscribe to Comments and Reply by Email","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"},{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"},{"type":"plugin","slug":"vo-locator-the-wp-store-locator","name":"VO Store Locator \u2013 WP Store Locator Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"get-directions","name":"Get Directions Map","from":"*","from_inclusive":true,"to":"2.15.8","to_inclusive":false,"patched_in":""},{"type":"plugin","slug":"premmerce-redirect-manager","name":"Premmerce Redirect Manager","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"},{"type":"plugin","slug":"snazzyadmin-wp-admin-theme","name":"SnazzyAdmin WP Admin Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"amela","name":"Amela","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"},{"type":"plugin","slug":"woo-customers-order-history","name":"Woocommerce Customers Order History","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":false,"patched_in":"5.2.1"},{"type":"plugin","slug":"ethpress","name":"EthPress \u2013 Web3 Login","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"},{"type":"plugin","slug":"admin-notices-for-team","name":"Ant Admin Notices for Team","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-coupons-bulk-editor","name":"Bulk Edit Coupons for WooCommerce \u2013 WP Sheet Editor","from":"*","from_inclusive":true,"to":"1.3.28","to_inclusive":false,"patched_in":"1.3.28"},{"type":"plugin","slug":"woocommerce-pay-per-post","name":"Pay For Post with WooCommerce","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"},{"type":"plugin","slug":"bbresolutions","name":"bbResolutions","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"advance-wc-analytics","name":"AWCA \u2013 The Great Analytics Insights for Your eStore","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"},{"type":"plugin","slug":"tk-smugmug-slideshow-shortcode","name":"TK SmugMug Slideshow Shortcode","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"everlightbox","name":"Lightbox \u2013 EverlightBox Gallery","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":false,"patched_in":"1.1.18"},{"type":"theme","slug":"unakit","name":"Unakit","from":"*","from_inclusive":true,"to":"1.2.4.2","to_inclusive":false,"patched_in":"1.2.4.2"},{"type":"plugin","slug":"wp-affiliate-disclosure","name":"WP Affiliate Disclosure","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"ilab-media-tools","name":"Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"},{"type":"plugin","slug":"racar-clear-cart-for-woocommerce","name":"RaCar Clear Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"wp-disable-sitemap","name":"WP Disable Sitemap","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"internal-links","name":"Internal Link Juicer: SEO Auto Linker for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"block-slider","name":"Block Slider \u2013 Responsive Image Slider, Video Slider & Post Slider","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"pinblocks","name":"Pinblocks \u2014 Gutenberg blocks with Pinterest widgets","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"contact-widgets-for-elementor","name":"Contact Widgets For Elementor all the contact links you need in one place","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.4.9.2","to_inclusive":false,"patched_in":"3.4.9.2"},{"type":"plugin","slug":"streamcast","name":"StreamCast \u2013 bring live radio to your site with a sleek player","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"},{"type":"plugin","slug":"sticky-add-to-cart-for-woo","name":"Sticky add to cart for Woo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blockypage","name":"BlockyPage \u2013 Gutenberg Based Page Builder","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pro-links-maintainer-dev","name":"Pro Broken Links Maintainer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-school-calendar-lite","name":"WP School Calendar","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"},{"type":"plugin","slug":"listplus","name":"ListPlus \u2013 Unlimited Listing Directory","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"walker-core","name":"Walker Core","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"},{"type":"plugin","slug":"content-warning-v2","name":"Agy \u2013 Age verification for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"},{"type":"plugin","slug":"modern-designs-for-gravity-forms","name":"Modern Designs for Gravity Forms","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rankbear","name":"RankBear","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"stax","name":"STAX Header Builder","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"},{"type":"plugin","slug":"fast-checkout-for-woocommerce","name":"Fast Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":false,"patched_in":"1.1.17"},{"type":"plugin","slug":"woocommerce-payplug","name":"WooCommerce PayPlug","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-code-snippets","name":"Easy Code Snippets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"w3s-cf7-zoho","name":"W3SCloud Contact Form 7 to Zoho CRM","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"},{"type":"plugin","slug":"widget-detector-elementor","name":"Widget Detector for Elementor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"add-tiktok-advertising-pixel","name":"Add Tiktok Pixel for Tiktok ads (+Woocommerce)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"5.7.10","to_inclusive":false,"patched_in":"5.7.10"},{"type":"plugin","slug":"better-messages-wc-vendors-integration","name":"Better Messages \u2013 Integration for WC Vendors Marketplace","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"},{"type":"plugin","slug":"alley-business-toolkit","name":"Alley Business Toolkit","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"},{"type":"plugin","slug":"premmerce-woocommerce-product-filter","name":"Premmerce Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":false,"patched_in":"3.6.2"},{"type":"plugin","slug":"wp-search-filter","name":"WP Search Filter","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-post-views-count","name":"Easy Post Views Count","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"},{"type":"plugin","slug":"power-ups-for-elementor","name":"Power Ups for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"plugin","slug":"social-kit","name":"Social Kit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"post-slider-and-carousel","name":"Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"},{"type":"plugin","slug":"hm-multiple-roles","name":"HM Multiple Roles","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"},{"type":"plugin","slug":"commenting-feature","name":"Multicollab: Content Team Collaboration and Editorial Workflow","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"},{"type":"plugin","slug":"alt-manager","name":"Image Alt Text Manager \u2013 Bulk & Dynamic Alt Tags For image SEO Optimization + AI","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"},{"type":"plugin","slug":"premmerce-search","name":"Premmerce Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"},{"type":"plugin","slug":"security-safe","name":"Security Safe","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"},{"type":"plugin","slug":"woo-bulk-edit-products","name":"Bulk Edit Products for WooCommerce \u2013 WP Sheet Editor","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":false,"patched_in":"1.7.13"},{"type":"plugin","slug":"da-reactions","name":"Da Reactions","from":"*","from_inclusive":true,"to":"3.20.2","to_inclusive":false,"patched_in":"3.20.2"},{"type":"plugin","slug":"food-store","name":"Food Store \u2013 Online Food Delivery & Pickup","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"},{"type":"plugin","slug":"abeta-punchout","name":"Abeta PunchOut","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":"1.0"},{"type":"plugin","slug":"wootrello","name":"jav\u2019s \u2013 WooCommerce and Trello integration WooTrello","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"},{"type":"plugin","slug":"page-builder-sandwich","name":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":false,"patched_in":"4.5.5"},{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"},{"type":"plugin","slug":"woowgallery","name":"WoowGallery","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"plugin","slug":"upfiv-complete-all-in-one-seo-wizard","name":"WordPress Auto SEO Plugin \u2013 Upfiv SEO Wizard","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"},{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"}],"published":"2022-03-04T00:00:00Z","updated":"2025-08-14T14:43:32Z"},{"id":"wordfence:3a00980c-2d27-4363-acad-ed9d1e7e37b2","source":"wordfence","cve":"CVE-2021-24639","title":"OMGF <= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a00980c-2d27-4363-acad-ed9d1e7e37b2?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a036855-35e0-4efd-aa27-16189b3538e9","source":"wordfence","cve":"CVE-2026-9050","title":"Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a036855-35e0-4efd-aa27-16189b3538e9?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"6.0.0","from_inclusive":true,"to":"6.7.55","to_inclusive":true,"patched_in":"6.7.56"},{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0.0","from_inclusive":true,"to":"7.0.14","to_inclusive":true,"patched_in":"6.7.56"}],"published":"2026-06-01T10:46:38Z","updated":"2026-06-01T23:28:26Z"},{"id":"wordfence:3a03b32f-a5a4-4c1b-ad93-0833af6c302e","source":"wordfence","cve":"CVE-2025-32569","title":"TableOn \u2013 WordPress Posts Table Filterable <= 1.0.4.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a03b32f-a5a4-4c1b-ad93-0833af6c302e?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.4.3","to_inclusive":true,"patched_in":"1.0.4.4"}],"published":"2025-04-10T00:00:00Z","updated":"2026-01-27T20:54:32Z"},{"id":"wordfence:3a044983-1ec7-464b-aa5d-d479be45bb1a","source":"wordfence","cve":"CVE-2024-33940","title":"EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a044983-1ec7-464b-aa5d-d479be45bb1a?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.15"}],"published":"2024-04-30T00:00:00Z","updated":"2024-08-09T17:19:46Z"},{"id":"wordfence:3a066eae-4040-4d76-b730-47d98dc37662","source":"wordfence","cve":"CVE-2024-3338","title":"Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a066eae-4040-4d76-b730-47d98dc37662?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.262","to_inclusive":true,"patched_in":"1.0.264"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:51:59Z"},{"id":"wordfence:3a09414a-9f20-4f88-8d9f-20699a9b7171","source":"wordfence","cve":"CVE-2026-52713","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a09414a-9f20-4f88-8d9f-20699a9b7171?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"4.4.13"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:26:21Z"},{"id":"wordfence:3a096506-b18e-419c-808b-6099baa628ce","source":"wordfence","cve":"CVE-2024-7349","title":"LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a096506-b18e-419c-808b-6099baa628ce?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.7.5","to_inclusive":true,"patched_in":"7.7.6"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-06T06:50:51Z"},{"id":"wordfence:3a0a7a6d-7acd-4a70-b78d-da2ac697e374","source":"wordfence","cve":"CVE-2024-35662","title":"Simple COD Fees for WooCommerce <= 2.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0a7a6d-7acd-4a70-b78d-da2ac697e374?source=api-prod","affected":[{"type":"plugin","slug":"simple-cod-fee-for-woocommerce","name":"Simple COD Fees for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:41:45Z"},{"id":"wordfence:3a0b460d-948c-4ec9-bcd8-f2ca152962d2","source":"wordfence","cve":"CVE-2026-40808","title":"Jetpack VideoPress <= 3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0b460d-948c-4ec9-bcd8-f2ca152962d2?source=api-prod","affected":[{"type":"plugin","slug":"jetpack-videopress","name":"Jetpack VideoPress","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2026-10-08T16:40:43Z","updated":"2026-10-13T14:06:37Z"},{"id":"wordfence:3a0b8c4d-44b4-4e94-a983-4feb73883386","source":"wordfence","cve":"CVE-2026-57429","title":"Slim SEO \u2013 A Fast & Automated SEO Plugin For WordPress <= 4.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0b8c4d-44b4-4e94-a983-4feb73883386?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:03:28Z"},{"id":"wordfence:3a0c8ecc-f0a1-41fa-a5f7-2d65d610efc0","source":"wordfence","cve":"CVE-2023-49196","title":"PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0c8ecc-f0a1-41fa-a5f7-2d65d610efc0?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2023-12-01T00:00:00Z","updated":"2024-12-12T19:10:58Z"},{"id":"wordfence:3a0d85e8-33fa-46eb-b71b-d93715bc373e","source":"wordfence","cve":"","title":"WPtouch <= 4.3.42 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0d85e8-33fa-46eb-b71b-d93715bc373e?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"4.3.42","to_inclusive":true,"patched_in":"4.3.44"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a0d9356-8083-4154-aa04-9008627dd3f5","source":"wordfence","cve":"CVE-2024-9542","title":"Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0d9356-8083-4154-aa04-9008627dd3f5?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T11:02:20Z"},{"id":"wordfence:3a0ef5d4-2bea-4e7f-9c18-9a06d30e18f5","source":"wordfence","cve":"CVE-2026-82224","title":"Affiliate Program Suite \u2014 SliceWP Affiliates <= 1.2.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0ef5d4-2bea-4e7f-9c18-9a06d30e18f5?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:50:41Z"},{"id":"wordfence:3a0faf14-77bf-4776-8685-12a348a4a6c8","source":"wordfence","cve":"CVE-2023-23653","title":"MainWP File Uploader Extension <= 4.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a0faf14-77bf-4776-8685-12a348a4a6c8?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-file-uploader-extension","name":"MainWP File Uploader Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a11216c-868c-4dd9-b6d5-2a772d7d303e","source":"wordfence","cve":"","title":"Comment Press  <=  2.7.1 - Cross-Frame Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a11216c-868c-4dd9-b6d5-2a772d7d303e?source=api-prod","affected":[{"type":"plugin","slug":"comment-press","name":"Comment System Plugin for WordPress & Ajax Comments - Comment Press","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2020-10-15T00:00:00Z","updated":"2024-05-31T15:30:16Z"},{"id":"wordfence:3a12945d-a67c-4a19-a4e7-f65f5f2a21bb","source":"wordfence","cve":"CVE-2023-5434","title":"Superb slideshow gallery <= 13.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a12945d-a67c-4a19-a4e7-f65f5f2a21bb?source=api-prod","affected":[{"type":"plugin","slug":"superb-slideshow-gallery","name":"Superb slideshow gallery","from":"*","from_inclusive":true,"to":"13.1","to_inclusive":true,"patched_in":"13.2"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a12ae49-4e37-4302-8c91-60233e4912f5","source":"wordfence","cve":"CVE-2025-23663","title":"Contexto <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a12ae49-4e37-4302-8c91-60233e4912f5?source=api-prod","affected":[{"type":"plugin","slug":"contexto","name":"Contexto","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T21:06:19Z"},{"id":"wordfence:3a13d1d5-3e40-4b38-bf29-0e589682d0c4","source":"wordfence","cve":"CVE-2025-62865","title":"Post Cloner <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a13d1d5-3e40-4b38-bf29-0e589682d0c4?source=api-prod","affected":[{"type":"plugin","slug":"post-cloner","name":"Post Cloner","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-10T15:55:30Z"},{"id":"wordfence:3a14a537-64e7-415b-be8e-a3a9377fd20d","source":"wordfence","cve":"CVE-2026-120019","title":"W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a14a537-64e7-415b-be8e-a3a9377fd20d?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.7","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2026-10-30T18:05:21Z","updated":"2026-10-31T06:44:16Z"},{"id":"wordfence:3a152cbd-1452-483c-8780-afa8054c3686","source":"wordfence","cve":"CVE-2024-38785","title":"Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a152cbd-1452-483c-8780-afa8054c3686?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:06:10Z"},{"id":"wordfence:3a15516f-5492-4d9a-9cad-a4823a256f8d","source":"wordfence","cve":"CVE-2025-28890","title":"Lightview Plus <= 3.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a15516f-5492-4d9a-9cad-a4823a256f8d?source=api-prod","affected":[{"type":"plugin","slug":"lightview-plus","name":"Lightview Plus","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:36:09Z"},{"id":"wordfence:3a17560b-4fe0-4e1b-b4a2-c411f1123914","source":"wordfence","cve":"CVE-2021-32790","title":"WooCommerce < 5.5 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a17560b-4fe0-4e1b-b4a2-c411f1123914?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.3","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.4","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.5","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.6","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.7","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.8","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"3.9","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.0","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.1","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.2","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.3","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.4","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.8","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.9","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.1","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.3","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.4","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"3.3.6"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.5","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2021-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a1782c3-ae0b-42f1-aa5e-dabfa2a5bbcd","source":"wordfence","cve":"CVE-2025-1488","title":"WPO365 | MICROSOFT 365 GRAPH MAILER <= 3.2 - Open Redirect via 'redirect_to' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1782c3-ae0b-42f1-aa5e-dabfa2a5bbcd?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-msgraphmailer","name":"WPO365 | MICROSOFT 365 GRAPH MAILER","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2025-02-23T22:53:02Z","updated":"2025-02-24T11:10:10Z"},{"id":"wordfence:3a17b6ad-c778-4677-b5bd-6ffc9b425ba1","source":"wordfence","cve":"","title":"Quiz And Survey Master < 4.4.4 - Multiple SQL Injections","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a17b6ad-c778-4677-b5bd-6ffc9b425ba1?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":false,"patched_in":"4.4.4"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a196177-2786-4f6d-8076-f0232e4d5a5d","source":"wordfence","cve":"CVE-2023-28776","title":"Continuous Image Carousel With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a196177-2786-4f6d-8076-f0232e4d5a5d?source=api-prod","affected":[{"type":"plugin","slug":"continuous-image-carousel-with-lightbox","name":"Image Ticker & Logo Slider \u2013 Continuous Auto-Scroll Carousel with Lightbox","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a196eaa-64c7-447b-9384-b58fcba57ec0","source":"wordfence","cve":"CVE-2026-1189","title":"LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a196eaa-64c7-447b-9384-b58fcba57ec0?source=api-prod","affected":[{"type":"plugin","slug":"leadbi","name":"LeadBI Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T20:32:57Z","updated":"2026-01-24T09:08:06Z"},{"id":"wordfence:3a19bd0c-87b3-421b-a7af-c473ac084813","source":"wordfence","cve":"CVE-2024-32798","title":"WP Travel Engine <= 5.8.0 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a19bd0c-87b3-421b-a7af-c473ac084813?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:55:07Z"},{"id":"wordfence:3a1d0432-aff0-477e-aa6e-4de3e4d789cb","source":"wordfence","cve":"CVE-2025-12157","title":"Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1d0432-aff0-477e-aa6e-4de3e4d789cb?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-capabilities","name":"Simple User Capabilities","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:33:17Z","updated":"2025-11-04T04:27:16Z"},{"id":"wordfence:3a1d8adf-c49c-4d88-83c7-4515b0ab1f35","source":"wordfence","cve":"CVE-2023-45646","title":"PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1d8adf-c49c-4d88-83c7-4515b0ab1f35?source=api-prod","affected":[{"type":"plugin","slug":"pdf-block","name":"PDF Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a1f192c-de8d-47e7-8055-bb64394e9a29","source":"wordfence","cve":"CVE-2026-74021","title":"Chaplin <= 2.6.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1f192c-de8d-47e7-8055-bb64394e9a29?source=api-prod","affected":[{"type":"theme","slug":"chaplin","name":"Chaplin","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-09T16:11:59Z"},{"id":"wordfence:3a1f3fdb-a786-4159-9020-648bc0658268","source":"wordfence","cve":"CVE-2015-9424","title":"Multicons [ Multiple Favicons ] <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1f3fdb-a786-4159-9020-648bc0658268?source=api-prod","affected":[{"type":"plugin","slug":"multicons","name":"Multicons","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a2460ab-2f45-4ee2-a3ef-77e769a678d0","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a2460ab-2f45-4ee2-a3ef-77e769a678d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a27bafa-197f-4093-af4f-6fc38749aa1b","source":"wordfence","cve":"CVE-2026-61998","title":"Le Truffe <= 1.1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a27bafa-197f-4093-af4f-6fc38749aa1b?source=api-prod","affected":[{"type":"theme","slug":"letruffe","name":"Le Truffe","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:38:40Z"},{"id":"wordfence:3a28f29e-7831-4a61-b5d1-d34d09b0e830","source":"wordfence","cve":"CVE-2025-53579","title":"Captcha.eu <= 1.0.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a28f29e-7831-4a61-b5d1-d34d09b0e830?source=api-prod","affected":[{"type":"plugin","slug":"captcha-eu","name":"Captcha.eu","from":"*","from_inclusive":true,"to":"1.0.60","to_inclusive":true,"patched_in":"1.0.61"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:06:23Z"},{"id":"wordfence:3a2c62a8-bc00-43b7-a3e8-a45d0cb75854","source":"wordfence","cve":"CVE-2013-2109","title":"WP Cleanfix Plugin < 5.0.0 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a2c62a8-bc00-43b7-a3e8-a45d0cb75854?source=api-prod","affected":[{"type":"plugin","slug":"wp-cleanfix","name":"WP CleanFix","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2013-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a2c96a1-bbab-41ed-aafd-6a6f569242f3","source":"wordfence","cve":"CVE-2021-24508","title":"Smash Balloon Social Post Feed <= 2.19.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a2c96a1-bbab-41ed-aafd-6a6f569242f3?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"2.19.2","to_inclusive":false,"patched_in":"2.19.2"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a31147b-791c-436f-9407-43485ec2ef50","source":"wordfence","cve":"CVE-2024-31361","title":"bunny.net \u2013 WordPress CDN Plugin <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a31147b-791c-436f-9407-43485ec2ef50?source=api-prod","affected":[{"type":"plugin","slug":"bunnycdn","name":"bunny.net \u2013 WordPress CDN Plugin","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T15:48:08Z"},{"id":"wordfence:3a3147b5-0362-4299-8339-655eaade948e","source":"wordfence","cve":"CVE-2026-1093","title":"WPFAQBlock\u2013 FAQ & Accordion Plugin For Gutenberg <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3147b5-0362-4299-8339-655eaade948e?source=api-prod","affected":[{"type":"plugin","slug":"wpfaqblock","name":"FAQ Accordion for WordPress with FAQ Schema & AI Generator \u2013 WPFAQBlock","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-03-20T15:19:54Z","updated":"2026-06-30T15:14:04Z"},{"id":"wordfence:3a325371-e531-4cd9-bc39-d1b8f40a728f","source":"wordfence","cve":"","title":"Sixtees (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a325371-e531-4cd9-bc39-d1b8f40a728f?source=api-prod","affected":[{"type":"theme","slug":"sixtees","name":"Sixtees","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a337765-b6ea-4c2a-9f1a-e408a9444b88","source":"wordfence","cve":"CVE-2019-14800","title":"FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a337765-b6ea-4c2a-9f1a-e408a9444b88?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.14.727","to_inclusive":true,"patched_in":"7.3.15.727"}],"published":"2019-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a34e4ad-cdd6-4663-881a-d6e29cd86043","source":"wordfence","cve":"CVE-2025-47471","title":"Envo Extra <= 1.9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a34e4ad-cdd6-4663-881a-d6e29cd86043?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.10"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:37:11Z"},{"id":"wordfence:3a3597fa-71e2-4753-b226-5d95e576947a","source":"wordfence","cve":"CVE-2024-43258","title":"Store Locator Plus <= 2311.17.01 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3597fa-71e2-4753-b226-5d95e576947a?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-le","name":"Store Locator Plus\u00ae for WordPress","from":"*","from_inclusive":true,"to":"2311.17.01","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:56:26Z"},{"id":"wordfence:3a38c10f-b150-417a-8a00-df33edd9a08a","source":"wordfence","cve":"CVE-2025-31544","title":"Swiss Toolkit For WP <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a38c10f-b150-417a-8a00-df33edd9a08a?source=api-prod","affected":[{"type":"plugin","slug":"swiss-toolkit-for-wp","name":"Swiss Toolkit For WP","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-06-12T18:37:01Z"},{"id":"wordfence:3a3aeefb-7d9c-4d2a-bc32-8fa2030151fa","source":"wordfence","cve":"CVE-2025-49299","title":"WebHotelier <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3aeefb-7d9c-4d2a-bc32-8fa2030151fa?source=api-prod","affected":[{"type":"plugin","slug":"webhotelier","name":"WebHotelier for WordPress","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T21:04:56Z"},{"id":"wordfence:3a3b8f32-f29d-4e67-8fad-202bfc8a9918","source":"wordfence","cve":"CVE-2024-0221","title":"Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3b8f32-f29d-4e67-8fad-202bfc8a9918?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.19","to_inclusive":true,"patched_in":"1.8.20"}],"published":"2024-01-19T00:00:00Z","updated":"2024-07-29T21:36:10Z"},{"id":"wordfence:3a3fa988-6f0b-48d3-a946-0fc587858c9c","source":"wordfence","cve":"","title":"WPSyncSheets Lite For Elementor \u2013 Elementor Pro Form Google Spreadsheet Addon <= 1.4 - Running Vulnerable Dependencies","severity":"low","cvss":3.7,"cwe":"CWE-1395","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3fa988-6f0b-48d3-a946-0fc587858c9c?source=api-prod","affected":[{"type":"plugin","slug":"wpsyncsheets-elementor","name":"Connect Elementor Forms to Google Sheets Addon","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-17T18:38:54Z"},{"id":"wordfence:3a4179ef-c98b-42c9-b7e5-a42bc46eaad1","source":"wordfence","cve":"CVE-2024-5080","title":"Wp EMember <= 10.6.5 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4179ef-c98b-42c9-b7e5-a42bc46eaad1?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T20:05:49Z"},{"id":"wordfence:3a442498-0f80-4373-a90c-155966c04945","source":"wordfence","cve":"CVE-2026-65542","title":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer <= 7.14.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a442498-0f80-4373-a90c-155966c04945?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.14.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-07T18:28:19Z"},{"id":"wordfence:3a468814-ecb7-4414-9472-6c2aaa5f5c2c","source":"wordfence","cve":"CVE-2023-6627","title":"WP Google Maps <= 9.0.27 - Unauthenticated Stored Cross-Site Scripting via REST API","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a468814-ecb7-4414-9472-6c2aaa5f5c2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.27","to_inclusive":true,"patched_in":"9.0.28"}],"published":"2023-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a46cebe-8009-4902-a751-8a4267915380","source":"wordfence","cve":"CVE-2025-30900","title":"Zoho Billing \u2013 Embed Payment Form <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a46cebe-8009-4902-a751-8a4267915380?source=api-prod","affected":[{"type":"plugin","slug":"zoho-subscriptions","name":"Zoho Billing \u2013 Embed Payment Form","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:34:06Z"},{"id":"wordfence:3a47cdeb-bd05-4e7e-99dc-dca67064182a","source":"wordfence","cve":"CVE-2025-10897","title":"WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read","severity":"high","cvss":8.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a47cdeb-bd05-4e7e-99dc-dca67064182a?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.28","to_inclusive":true,"patched_in":"1.9.31"}],"published":"2025-10-30T19:12:08Z","updated":"2025-11-21T07:26:57Z"},{"id":"wordfence:3a48c501-6fa6-4767-b3f0-6b15e56807d9","source":"wordfence","cve":"CVE-2025-23714","title":"AppReview <= 0.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a48c501-6fa6-4767-b3f0-6b15e56807d9?source=api-prod","affected":[{"type":"plugin","slug":"appreview","name":"AppReview","from":"*","from_inclusive":true,"to":"0.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:13:00Z"},{"id":"wordfence:3a49f5f8-eec3-4b43-a007-329a7c1c6840","source":"wordfence","cve":"CVE-2026-42654","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a49f5f8-eec3-4b43-a007-329a7c1c6840?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T14:07:44Z"},{"id":"wordfence:3a4a97f1-f3da-45b4-98c9-f4afd5fa2eb1","source":"wordfence","cve":"CVE-2026-32537","title":"Visual Portfolio, Photo Gallery & Post Grid <= 3.5.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4a97f1-f3da-45b4-98c9-f4afd5fa2eb1?source=api-prod","affected":[{"type":"plugin","slug":"visual-portfolio","name":"Gallery by Visual Portfolio","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:53:26Z"},{"id":"wordfence:3a4c36d4-5d0f-4e73-b356-0b7326fcb524","source":"wordfence","cve":"CVE-2017-15079","title":"Smush \u2013 Lazy Load Images, Optimize & Compress Images <= 2.7.5 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4c36d4-5d0f-4e73-b356-0b7326fcb524?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2017-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a4f0c06-db88-4950-b1f5-b2aab480c974","source":"wordfence","cve":"CVE-2024-9951","title":"Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4f0c06-db88-4950-b1f5-b2aab480c974?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.8.05.003","to_inclusive":true,"patched_in":"8.8.07.004"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T07:34:44Z"},{"id":"wordfence:3a503925-7fbf-42e8-9cee-604858c8ec0c","source":"wordfence","cve":"CVE-2014-4599","title":"WP-Business Directory <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a503925-7fbf-42e8-9cee-604858c8ec0c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ttisbdir","name":"WP-Business Directory","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a556e1e-6b7e-4967-9e13-8549939e964b","source":"wordfence","cve":"CVE-2025-31429","title":"PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a556e1e-6b7e-4967-9e13-8549939e964b?source=api-prod","affected":[{"type":"theme","slug":"press-grid","name":"PressGrid - Frontend Publish Reaction & Multimedia Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-12T13:17:19Z"},{"id":"wordfence:3a57bbf9-bb53-4040-9c38-4798852a6fb4","source":"wordfence","cve":"CVE-2026-16548","title":"Bit Assist <= 1.8.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a57bbf9-bb53-4040-9c38-4798852a6fb4?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:40:12Z"},{"id":"wordfence:3a581d5e-11c3-468a-b4a1-6507f898f5ed","source":"wordfence","cve":"CVE-2022-34148","title":"Backup Guard <= 1.6.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a581d5e-11c3-468a-b4a1-6507f898f5ed?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.9.1"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a58644a-c678-41e7-8020-d2f2c247682f","source":"wordfence","cve":"","title":"G-Lock Double Opt-in Manager <= 2.6.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a58644a-c678-41e7-8020-d2f2c247682f?source=api-prod","affected":[{"type":"plugin","slug":"g-lock-double-opt-in-manager","name":"G-Lock Double Opt-in Manager","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a59b749-1134-42bf-83bd-62202e1e151f","source":"wordfence","cve":"CVE-2024-43987","title":"Sliding Door <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a59b749-1134-42bf-83bd-62202e1e151f?source=api-prod","affected":[{"type":"theme","slug":"sliding-door","name":"Sliding Door","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:31:21Z"},{"id":"wordfence:3a5a421a-3c76-4ea0-aa8a-878bbb7671d7","source":"wordfence","cve":"CVE-2026-9822","title":"WP Hotel Booking < 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a5a421a-3c76-4ea0-aa8a-878bbb7671d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:47:59Z"},{"id":"wordfence:3a5e8af3-fa65-4703-8f34-a48b102ec084","source":"wordfence","cve":"CVE-2024-13225","title":"ECT Home Page Products <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a5e8af3-fa65-4703-8f34-a48b102ec084?source=api-prod","affected":[{"type":"plugin","slug":"ect-homepage-products","name":"ECT Home Page Products","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:54:45Z"},{"id":"wordfence:3a5e9fd1-3499-436a-9b07-6248b08096bf","source":"wordfence","cve":"CVE-2026-96825","title":"All-In-One Security (AIOS) \u2013 Security and Firewall <= 5.4.8 - Authenticated (Subscriber+) Security Control Bypass","severity":"medium","cvss":6.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a5e9fd1-3499-436a-9b07-6248b08096bf?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T18:06:02Z"},{"id":"wordfence:3a61ddbc-9118-4cad-a639-7822606a3181","source":"wordfence","cve":"CVE-2026-14349","title":"TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a61ddbc-9118-4cad-a639-7822606a3181?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-15T15:09:50Z","updated":"2026-09-16T03:28:18Z"},{"id":"wordfence:3a6221e3-e26b-46b2-8e67-b2afe65bc3d9","source":"wordfence","cve":"CVE-2026-56025","title":"Paymob for WooCommerce <= 4.1.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6221e3-e26b-46b2-8e67-b2afe65bc3d9?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2026-06-19T00:00:00Z","updated":"2026-09-16T17:02:15Z"},{"id":"wordfence:3a6242ab-eec1-4e3d-bd02-25381cd363b6","source":"wordfence","cve":"CVE-2026-25347","title":"WP REST Cache <= 2026.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6242ab-eec1-4e3d-bd02-25381cd363b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-cache","name":"WP REST Cache","from":"*","from_inclusive":true,"to":"2026.1.0","to_inclusive":true,"patched_in":"2026.1.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:26:03Z"},{"id":"wordfence:3a6316d8-1d64-4d28-b28a-00ca0b5facee","source":"wordfence","cve":"CVE-2022-38085","title":"Read more By Adam <= 1.1.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6316d8-1d64-4d28-b28a-00ca0b5facee?source=api-prod","affected":[{"type":"plugin","slug":"read-more","name":"Read more By Adam","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a63dd48-d643-41d0-84c3-2f2dbbe577dd","source":"wordfence","cve":"CVE-2022-33969","title":"Flipbox \u2013 Awesomes Flip Boxes Image Overlay <= 2.6.0 - Authenticated (Admin+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a63dd48-d643-41d0-84c3-2f2dbbe577dd?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate-visual-composer","name":"Flipbox \u2013 Awesomes Flip Boxes Image Overlay","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2022-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a657b85-b4e2-4f97-90cf-b170f0184304","source":"wordfence","cve":"CVE-2025-69159","title":"Printo <= 1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a657b85-b4e2-4f97-90cf-b170f0184304?source=api-prod","affected":[{"type":"theme","slug":"printo","name":"Printo","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:45:44Z"},{"id":"wordfence:3a65e2e8-f89f-4678-a850-1c8c6804591b","source":"wordfence","cve":"CVE-2025-58646","title":"Mobi2Go <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a65e2e8-f89f-4678-a850-1c8c6804591b?source=api-prod","affected":[{"type":"plugin","slug":"mobi2go","name":"Mobi2Go","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:50Z"},{"id":"wordfence:3a66d49d-eb3a-4ba3-bf2e-deeb7f5c197b","source":"wordfence","cve":"CVE-2025-24615","title":"Analytics Cat <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a66d49d-eb3a-4ba3-bf2e-deeb7f5c197b?source=api-prod","affected":[{"type":"plugin","slug":"analytics-cat","name":"Analytics Cat \u2013 Google Analytics Made Easy","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-12-29T00:00:00Z","updated":"2026-04-15T20:38:52Z"},{"id":"wordfence:3a68cd5f-3124-42d2-917d-24cb4efa5346","source":"wordfence","cve":"CVE-2024-8851","title":"Polls CP <= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a68cd5f-3124-42d2-917d-24cb4efa5346?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.76","to_inclusive":true,"patched_in":"1.0.77"}],"published":"2024-09-01T00:00:00Z","updated":"2025-05-29T22:30:03Z"},{"id":"wordfence:3a69bb27-dc93-4515-90e1-08a1fa5fdaa0","source":"wordfence","cve":"","title":"Magee Shortcodes < 2.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a69bb27-dc93-4515-90e1-08a1fa5fdaa0?source=api-prod","affected":[{"type":"plugin","slug":"magee-shortcodes","name":"Magee Shortcodes","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a6eac3b-823a-4a26-acb7-339357c10a07","source":"wordfence","cve":"CVE-2017-18496","title":"Htaccess by BestWebSoft \u2013 WordPress Website Access Control Plugin <= 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6eac3b-823a-4a26-acb7-339357c10a07?source=api-prod","affected":[{"type":"plugin","slug":"htaccess","name":"Htaccess by BestWebSoft \u2013 WordPress Website Access Control Plugin","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2017-04-14T00:00:00Z","updated":"2024-08-15T18:14:18Z"},{"id":"wordfence:3a6eb99c-bc5e-4b8d-8e4f-496e0b1f44d4","source":"wordfence","cve":"CVE-2025-53464","title":"WP Mailto Links <= 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6eb99c-bc5e-4b8d-8e4f-496e0b1f44d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailto-links","name":"WP Mailto Links \u2013 Protect Email Addresses","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:00:51Z"},{"id":"wordfence:3a6fb164-d953-4e0e-80cd-1a99b684ab44","source":"wordfence","cve":"CVE-2025-62920","title":"USERCENTRICS CMP <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a6fb164-d953-4e0e-80cd-1a99b684ab44?source=api-prod","affected":[{"type":"plugin","slug":"usercentrics-consent-management-platform","name":"USERCENTRICS CMP","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-04T00:00:00Z","updated":"2025-10-29T15:00:12Z"},{"id":"wordfence:3a703fc4-6c61-442e-a637-515e9f501575","source":"wordfence","cve":"CVE-2024-3927","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-424","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a703fc4-6c61-442e-a637-515e9f501575?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-22T06:50:33Z"},{"id":"wordfence:3a70b64b-a0e8-4b5c-af05-cf8f1d611dec","source":"wordfence","cve":"CVE-2025-10575","title":"WP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a70b64b-a0e8-4b5c-af05-cf8f1d611dec?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-pdf-paged","name":"WP jQuery Pager","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:45:00Z","updated":"2025-10-15T08:25:53Z"},{"id":"wordfence:3a71b8da-73dd-488e-b553-77116731f13f","source":"wordfence","cve":"CVE-2015-5715","title":"WordPress Core < 4.3.1 - Authorization Bypass to Information Disclosure","severity":"medium","cvss":5.4,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a71b8da-73dd-488e-b553-77116731f13f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"3.7.11"}],"published":"2015-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a7440e2-637a-4f24-8452-e269e559aa17","source":"wordfence","cve":"CVE-2026-24585","title":"Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7440e2-637a-4f24-8452-e269e559aa17?source=api-prod","affected":[{"type":"plugin","slug":"woo-poly-integration","name":"Hyyan Integration for WooCommerce and Polylang","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-18T00:00:00Z","updated":"2026-01-27T19:23:05Z"},{"id":"wordfence:3a7524ce-cd8c-45af-b07b-616f63a62bd5","source":"wordfence","cve":"CVE-2026-11571","title":"Everest Forms <= 3.4.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7524ce-cd8c-45af-b07b-616f63a62bd5?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:55:59Z"},{"id":"wordfence:3a75a005-cf56-4841-a11b-318011d80fe6","source":"wordfence","cve":"CVE-2025-64274","title":"WPKoi Templates for Elementor <= 3.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a75a005-cf56-4841-a11b-318011d80fe6?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T16:01:31Z"},{"id":"wordfence:3a75ff86-dc4d-4519-8cc5-183afc00cb65","source":"wordfence","cve":"CVE-2022-1569","title":"WordPress Forms by Pie Forms <= 1.4.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a75ff86-dc4d-4519-8cc5-183afc00cb65?source=api-prod","affected":[{"type":"plugin","slug":"pie-forms-for-wp","name":"Pie Forms \u2014 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.4.9.4","to_inclusive":false,"patched_in":"1.4.9.4"}],"published":"2022-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a7aac7d-225f-45d5-86ac-183c56e76326","source":"wordfence","cve":"CVE-2025-67918","title":"Woffice <= 5.4.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7aac7d-225f-45d5-86ac-183c56e76326?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.30","to_inclusive":true,"patched_in":"5.4.31"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-13T17:47:07Z"},{"id":"wordfence:3a7afe2c-13ca-4df4-89c9-1544db016cdc","source":"wordfence","cve":"CVE-2022-0892","title":"Export All URLs <= 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7afe2c-13ca-4df4-89c9-1544db016cdc?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a7b15ce-ff0e-4693-8ceb-afa341306dc3","source":"wordfence","cve":"","title":"Findus - Directory Listing WordPress Theme < 1.1.15 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7b15ce-ff0e-4693-8ceb-afa341306dc3?source=api-prod","affected":[{"type":"theme","slug":"findus","name":"Findus - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":false,"patched_in":"1.1.15"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a7e8afa-d250-41b1-aa34-555fb458e359","source":"wordfence","cve":"","title":"Jetpackcrm Ext Woo Connect < 2.13 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7e8afa-d250-41b1-aa34-555fb458e359?source=api-prod","affected":[{"type":"plugin","slug":"jetpackcrm-ext-woo-connect","name":"Jetpackcrm Ext Woo Connect","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":false,"patched_in":"2.13"},{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":false,"patched_in":"4.2.4"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T16:57:55Z"},{"id":"wordfence:3a7f6fa5-ea69-4c58-994c-f9d3f3357a33","source":"wordfence","cve":"CVE-2026-61952","title":"Bulk Edit Products for WooCommerce \u2013 WP Sheet Editor <= 1.8.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a7f6fa5-ea69-4c58-994c-f9d3f3357a33?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-edit-products","name":"Bulk Edit Products for WooCommerce \u2013 WP Sheet Editor","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2026-07-12T00:00:00Z","updated":"2026-07-14T19:16:29Z"},{"id":"wordfence:3a845632-fcd3-4663-959d-d786667d0499","source":"wordfence","cve":"CVE-2025-47470","title":"GPT3 AI Content Writer <= 1.9.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a845632-fcd3-4663-959d-d786667d0499?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:28:56Z"},{"id":"wordfence:3a849ef2-ad0a-45ea-8827-9a7233b1ca30","source":"wordfence","cve":"CVE-2024-1484","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.0.98 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a849ef2-ad0a-45ea-8827-9a7233b1ca30?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.98","to_inclusive":true,"patched_in":"1.0.99"}],"published":"2024-02-29T00:00:00Z","updated":"2024-05-31T15:30:16Z"},{"id":"wordfence:3a84a021-5014-4848-a77f-d3f4802c9395","source":"wordfence","cve":"CVE-2021-24603","title":"Site Reviews <= 5.13.0 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a84a021-5014-4848-a77f-d3f4802c9395?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"5.13.1","to_inclusive":false,"patched_in":"5.13.1"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a8998db-ffc2-40b2-a191-09380984adac","source":"wordfence","cve":"CVE-2023-41238","title":"Social Media & Share Icons <= 2.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8998db-ffc2-40b2-a191-09380984adac?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a89d81b-7d4b-4afc-8131-0acdc5298544","source":"wordfence","cve":"CVE-2025-49332","title":"WP Time Slots Booking Form <= 1.2.30 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a89d81b-7d4b-4afc-8131-0acdc5298544?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.30","to_inclusive":true,"patched_in":"1.2.31"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-11T21:03:58Z"},{"id":"wordfence:3a8bd422-112c-43bc-a041-3c6eea27b790","source":"wordfence","cve":"CVE-2026-104000","title":"Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a8bd422-112c-43bc-a041-3c6eea27b790?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.35","to_inclusive":true,"patched_in":"1.6.12.37"}],"published":"2026-10-15T16:43:21Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:3a9045e5-ee8b-45f6-8e08-b1bf6b6f7159","source":"wordfence","cve":"CVE-2024-9450","title":"Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking <= 1.3.14 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9045e5-ee8b-45f6-8e08-b1bf6b6f7159?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2025-03-02T00:00:00Z","updated":"2025-05-30T19:02:13Z"},{"id":"wordfence:3a923f58-f6c7-47ee-87f6-27453b39d1cf","source":"wordfence","cve":"CVE-2023-46612","title":"Mediabay <= 1.6 - Missing Authorization via AJAC actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a923f58-f6c7-47ee-87f6-27453b39d1cf?source=api-prod","affected":[{"type":"plugin","slug":"mediabay-lite","name":"Mediabay \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a92926f-c8d2-49c4-b50e-2544fd66fe01","source":"wordfence","cve":"","title":"Amazon Affiliate Link Localizer <= 1.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a92926f-c8d2-49c4-b50e-2544fd66fe01?source=api-prod","affected":[{"type":"plugin","slug":"amazon-affiliate-link-localizer","name":"Amazon Affiliate Link Localizer","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a9427b6-d5b0-4727-962e-cab829aff230","source":"wordfence","cve":"CVE-2024-51871","title":"Luzuk Team <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9427b6-d5b0-4727-962e-cab829aff230?source=api-prod","affected":[{"type":"plugin","slug":"luzuk-team","name":"Luzuk Team","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:41:19Z"},{"id":"wordfence:3a9715c3-6ce0-46f8-820d-194bd0e8e6fd","source":"wordfence","cve":"CVE-2024-11428","title":"Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9715c3-6ce0-46f8-820d-194bd0e8e6fd?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load-videos-and-sticky-control","name":"Lazy load videos and sticky control","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:38:27Z","updated":"2024-11-21T02:06:29Z"},{"id":"wordfence:3a98ee3b-aac6-4082-aba7-1c7392d501bb","source":"wordfence","cve":"CVE-2026-124421","title":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit <= 2.8.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a98ee3b-aac6-4082-aba7-1c7392d501bb?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:48Z"},{"id":"wordfence:3a998de7-fa46-495c-a4ca-15df4e59457f","source":"wordfence","cve":"CVE-2023-44261","title":"Block Plugin Update <= 3.3.1 - Cross-Site Request Forgery via bspu_plugin_select.php","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a998de7-fa46-495c-a4ca-15df4e59457f?source=api-prod","affected":[{"type":"plugin","slug":"block-specific-plugin-updates","name":"Block Plugin Update","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a9f5602-f798-4beb-a3e7-06338f817ce2","source":"wordfence","cve":"CVE-2026-82842","title":"SAML Single Sign On <= 5.4.7 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9f5602-f798-4beb-a3e7-06338f817ce2?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-10-16T13:01:58Z"},{"id":"wordfence:3a9f775f-4b82-449c-a5c3-d881b983d2c4","source":"wordfence","cve":"CVE-2025-31098","title":"DeBounce Email Validator <= 5.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9f775f-4b82-449c-a5c3-d881b983d2c4?source=api-prod","affected":[{"type":"plugin","slug":"debounce-io-email-validator","name":"DeBounce Email Validator","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"5.71"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-10T12:42:49Z"},{"id":"wordfence:3a9f7a61-535f-45c8-a7e7-e8b095cacaa1","source":"wordfence","cve":"CVE-2015-9394","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9f7a61-535f-45c8-a7e7-e8b095cacaa1?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.63","to_inclusive":false,"patched_in":"1.5.63"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3a9fd0d5-5681-4c54-8d2e-c76ce80e5e55","source":"wordfence","cve":"CVE-2025-69122","title":"SeaFood Company <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9fd0d5-5681-4c54-8d2e-c76ce80e5e55?source=api-prod","affected":[{"type":"theme","slug":"seafood-company","name":"SeaFood Company - Fish Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:22:27Z"},{"id":"wordfence:3a9feacb-ef9c-40d4-abdb-a3fcfd529901","source":"wordfence","cve":"CVE-2019-15650","title":"Stops Core Theme And Plugin Updates <= 8.0.4 - Insufficient Restrictions on Option Changes","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3a9feacb-ef9c-40d4-abdb-a3fcfd529901?source=api-prod","affected":[{"type":"plugin","slug":"stops-core-theme-and-plugin-updates","name":"Easy Updates Manager","from":"*","from_inclusive":true,"to":"8.0.4","to_inclusive":true,"patched_in":"8.0.5"}],"published":"2019-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aa14f56-85b7-4f8d-bc62-a1e99977e510","source":"wordfence","cve":"CVE-2023-5932","title":"Travelpayouts <= 1.1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa14f56-85b7-4f8d-bc62-a1e99977e510?source=api-prod","affected":[{"type":"plugin","slug":"travelpayouts","name":"Travelpayouts: All Travel Brands in One Place","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2024-01-23T00:00:00Z","updated":"2025-05-21T20:55:20Z"},{"id":"wordfence:3aa1964e-97e9-4166-89d5-788b336790b6","source":"wordfence","cve":"CVE-2025-11996","title":"Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa1964e-97e9-4166-89d5-788b336790b6?source=api-prod","affected":[{"type":"plugin","slug":"find-unused-images","name":"Find Unused Images","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:16:36Z","updated":"2025-11-11T03:30:35Z"},{"id":"wordfence:3aa2a693-831b-44e7-b158-99fecf6506be","source":"wordfence","cve":"CVE-2023-40604","title":"Cookies by JM <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa2a693-831b-44e7-b158-99fecf6506be?source=api-prod","affected":[{"type":"plugin","slug":"cookies-by-jm","name":"Cookies by JM","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aa537bc-90fa-4d87-9dd5-e32aef4273c7","source":"wordfence","cve":"","title":"Cart Link for WooCommerce <= 2.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa537bc-90fa-4d87-9dd5-e32aef4273c7?source=api-prod","affected":[{"type":"plugin","slug":"cart-link-for-woocommerce","name":"Custom Cart Link for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aa56fc7-8d48-4149-afa7-8f9885de0674","source":"wordfence","cve":"CVE-2024-12283","title":"WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa56fc7-8d48-4149-afa7-8f9885de0674?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-10T20:19:00Z","updated":"2024-12-11T08:57:59Z"},{"id":"wordfence:3aa6f3c2-0e45-4243-a26d-ba1c702fbe11","source":"wordfence","cve":"CVE-2024-10664","title":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa6f3c2-0e45-4243-a26d-ba1c702fbe11?source=api-prod","affected":[{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.16.3.3","to_inclusive":true,"patched_in":"2.16.3.4"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T07:32:26Z"},{"id":"wordfence:3aa6fd71-337f-4998-a15d-650aa4f6142c","source":"wordfence","cve":"CVE-2026-16099","title":"Podlove Podcast Publisher <= 4.5.3 - Authenticated (Contributor+) PHP Object Injection to Arbitrary File Deletion via 'unfurl_data' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa6fd71-337f-4998-a15d-650aa4f6142c?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-08-15T16:09:09Z","updated":"2026-08-16T04:24:51Z"},{"id":"wordfence:3aa73be6-0836-4540-8a80-e1da34c0ee0d","source":"wordfence","cve":"CVE-2025-13701","title":"Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa73be6-0836-4540-8a80-e1da34c0ee0d?source=api-prod","affected":[{"type":"plugin","slug":"shabat-keeper","name":"Shabat Keeper","from":"*","from_inclusive":true,"to":"0.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:55:43Z","updated":"2026-01-09T11:15:32Z"},{"id":"wordfence:3aaa9c58-87da-4221-b687-f365c6bde167","source":"wordfence","cve":"CVE-2024-32692","title":"Chauffeur Taxi Booking System for WordPress <= 6.9 - Authentication Bypass","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aaa9c58-87da-4221-b687-f365c6bde167?source=api-prod","affected":[{"type":"plugin","slug":"chauffeur-booking-system","name":"Chauffeur Taxi Booking System for WordPress","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2024-05-19T00:00:00Z","updated":"2024-05-30T20:15:48Z"},{"id":"wordfence:3aade1bd-b69d-4134-a4f7-78372a291557","source":"wordfence","cve":"CVE-2025-3851","title":"Download Manager and Payment Form WordPress Plugin \u2013 WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aade1bd-b69d-4134-a4f7-78372a291557?source=api-prod","affected":[{"type":"plugin","slug":"smartpay","name":"WPSmartPay \u2013 Payment Forms, Invoices, Donations & Subscriptions","from":"1.1.0","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-05-06T13:25:42Z","updated":"2025-11-05T21:50:34Z"},{"id":"wordfence:3ab4e9c6-68b0-4113-bff0-c1d3c2d3dea4","source":"wordfence","cve":"CVE-2024-10216","title":"WP User Manager \u2013 User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab4e9c6-68b0-4113-bff0-c1d3c2d3dea4?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2024-11-22T15:18:43Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:3ab6ed55-7067-4318-865b-33dcfc584386","source":"wordfence","cve":"CVE-2025-67979","title":"WPForms Google Sheet Connector <= 4.0.1 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab6ed55-7067-4318-865b-33dcfc584386?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-wpforms","name":"GSheetConnector \u2013 WPForms Google Sheets Connector, Save WPForms Lite & PRO Entries to Database & Sheets","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:37:56Z"},{"id":"wordfence:3ab9af6a-bfe7-4da5-8e60-b20f38cbab36","source":"wordfence","cve":"CVE-2026-109979","title":"Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab9af6a-bfe7-4da5-8e60-b20f38cbab36?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-10-27T17:56:45Z","updated":"2026-10-28T06:45:11Z"},{"id":"wordfence:3abac0a1-a696-48b1-88d9-d0b102c82ac3","source":"wordfence","cve":"CVE-2017-8099","title":"WHIZZ < 1.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3abac0a1-a696-48b1-88d9-d0b102c82ac3?source=api-prod","affected":[{"type":"plugin","slug":"whizz","name":"WHIZZ","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2017-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3abbc407-f660-4b1f-9d48-436320e5fdd7","source":"wordfence","cve":"CVE-2022-4663","title":"Members Import <= 1.4.2 - Self Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3abbc407-f660-4b1f-9d48-436320e5fdd7?source=api-prod","affected":[{"type":"plugin","slug":"members-import","name":"Members Import","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3abde27c-8234-4146-9e55-ea20b275ca48","source":"wordfence","cve":"CVE-2023-50902","title":"New User Approve <= 2.5.1 - Cross-Site Request Forgery via admin_notices","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3abde27c-8234-4146-9e55-ea20b275ca48?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3abe2de8-9127-4ef0-9194-cf331b20868a","source":"wordfence","cve":"CVE-2023-41659","title":"Responsive Gallery Grid <= 2.3.13 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3abe2de8-9127-4ef0-9194-cf331b20868a?source=api-prod","affected":[{"type":"plugin","slug":"responsive-gallery-grid","name":"Responsive Gallery Grid","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.3.14"}],"published":"2023-09-01T00:00:00Z","updated":"2024-05-06T20:53:09Z"},{"id":"wordfence:3ac48cd9-1de5-4840-b3f3-dc24ca52442e","source":"wordfence","cve":"CVE-2023-49856","title":"Smart Forms <= 2.6.84 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac48cd9-1de5-4840-b3f3-dc24ca52442e?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.84","to_inclusive":true,"patched_in":"2.6.85"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ac577f4-2e61-4b72-881e-6fbbfd268f7b","source":"wordfence","cve":"CVE-2023-2324","title":"Elementor Forms Google Sheet Connector <= 1.0.6 - Reflected Cross-Site Scripting via 'code'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac577f4-2e61-4b72-881e-6fbbfd268f7b?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-for-elementor-forms-pro","name":"Elementor Forms Google Sheet Connector Pro","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gsheetconnector-for-elementor-forms","name":"GSheetConnector \u2013 Elementor Forms Google Sheet Connector to Sync Submissions to Google Sheets","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ac72d7a-9540-435f-93cb-fdd4104b18f7","source":"wordfence","cve":"CVE-2025-8422","title":"Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac72d7a-9540-435f-93cb-fdd4104b18f7?source=api-prod","affected":[{"type":"plugin","slug":"propovoice","name":"Propovoice: All-in-One Client Management System","from":"*","from_inclusive":true,"to":"1.7.6.7","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2025-09-10T19:05:09Z","updated":"2025-10-21T21:06:34Z"},{"id":"wordfence:3ac8a509-e54b-40e7-9fd8-4aef03168827","source":"wordfence","cve":"CVE-2026-15047","title":"s2Member <= 260804 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ac8a509-e54b-40e7-9fd8-4aef03168827?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"260804","to_inclusive":true,"patched_in":"260805"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-15T21:10:32Z"},{"id":"wordfence:3aca0d51-6f70-4f35-873a-e23b4d7bae41","source":"wordfence","cve":"CVE-2024-5765","title":"WpStickyBar \u2013 Sticky Bar, Sticky Header <= 2.1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aca0d51-6f70-4f35-873a-e23b4d7bae41?source=api-prod","affected":[{"type":"plugin","slug":"wpstickybar-sticky-bar-sticky-header","name":"WpStickyBar \u2013 Sticky Bar, Sticky Header","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:19:56Z"},{"id":"wordfence:3aca1995-2408-423d-afb6-6cf452fbee37","source":"wordfence","cve":"CVE-2023-23811","title":"Smoothscroller <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aca1995-2408-423d-afb6-6cf452fbee37?source=api-prod","affected":[{"type":"plugin","slug":"smoothscroller","name":"Smoothscroller","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-06-19T00:00:00Z","updated":"2025-07-03T12:15:33Z"},{"id":"wordfence:3acab2e6-c6ce-4e87-aa6d-ce9d027cd774","source":"wordfence","cve":"CVE-2026-40774","title":"Booking Package <= 1.7.06 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3acab2e6-c6ce-4e87-aa6d-ce9d027cd774?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.06","to_inclusive":true,"patched_in":"1.7.07"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:41:21Z"},{"id":"wordfence:3acaedff-f616-4b66-9208-f7e6a4df920d","source":"wordfence","cve":"CVE-2024-8552","title":"Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3acaedff-f616-4b66-9208-f7e6a4df920d?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T02:03:25Z"},{"id":"wordfence:3acbdb2a-e7c6-4062-b48a-7035e464edaf","source":"wordfence","cve":"CVE-2022-3763","title":"Booster for WooCommerce (Free <= 5.6.6, Premium <= 5.6.4) - Cross-Site Request Forgery to File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3acbdb2a-e7c6-4062-b48a-7035e464edaf?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3acc1464-18cf-4085-8cb4-946563d70b16","source":"wordfence","cve":"","title":"WP Page Widget <= 2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3acc1464-18cf-4085-8cb4-946563d70b16?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-widget","name":"WP Page Widget","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":false,"patched_in":"2.8"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ad03e3f-fb3e-4a80-9eea-d24459ed62b8","source":"wordfence","cve":"CVE-2024-12420","title":"WPMobile.App \u2014 Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad03e3f-fb3e-4a80-9eea-d24459ed62b8?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.52","to_inclusive":true,"patched_in":"11.53"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:49Z"},{"id":"wordfence:3ad075f5-189d-42c4-88d5-67aab321dfb6","source":"wordfence","cve":"CVE-2026-25371","title":"Lumise Product Designer < 2.0.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad075f5-189d-42c4-88d5-67aab321dfb6?source=api-prod","affected":[{"type":"plugin","slug":"lumise","name":"Product Designer for WooCommerce WordPress | Lumise","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:12:32Z"},{"id":"wordfence:3ad0edcd-47f0-43a5-95c4-491053778205","source":"wordfence","cve":"CVE-2026-121874","title":"Post Duplicator <= 3.0.17 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad0edcd-47f0-43a5-95c4-491053778205?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.17","to_inclusive":true,"patched_in":"3.0.18"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:51:20Z"},{"id":"wordfence:3ad2651c-5541-4508-9da1-37838a4df901","source":"wordfence","cve":"CVE-2025-49869","title":"Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad2651c-5541-4508-9da1-37838a4df901?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"4.0.32"}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-19T14:01:13Z"},{"id":"wordfence:3ad2e495-5181-44a7-932f-520620146be7","source":"wordfence","cve":"CVE-2024-50534","title":"World Prayer Time <= 2.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad2e495-5181-44a7-932f-520620146be7?source=api-prod","affected":[{"type":"plugin","slug":"world-prayer-time","name":"World Prayer Time","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T14:28:59Z"},{"id":"wordfence:3ad60a11-e307-4ec9-9099-091a87ff1d3b","source":"wordfence","cve":"CVE-2023-0716","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folder","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad60a11-e307-4ec9-9099-091a87ff1d3b?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ad65e10-6f99-421b-abec-ed374769dfcf","source":"wordfence","cve":"CVE-2026-15758","title":"3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad65e10-6f99-421b-abec-ed374769dfcf?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.16.20","to_inclusive":true,"patched_in":"1.16.21"}],"published":"2026-09-14T16:48:11Z","updated":"2026-09-15T05:05:56Z"},{"id":"wordfence:3ad7ac46-e7d2-4d0c-ae20-fe9ddabf41b7","source":"wordfence","cve":"CVE-2025-50024","title":"ATP Call Now <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad7ac46-e7d2-4d0c-ae20-fe9ddabf41b7?source=api-prod","affected":[{"type":"plugin","slug":"atp-call-now","name":"ATP Call Now","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:56:42Z"},{"id":"wordfence:3ad83579-aaf4-4303-8ce4-4790e6d729ef","source":"wordfence","cve":"CVE-2026-82530","title":"IP2Location Country Blocker <= 2.44.0 - IP Soofing","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad83579-aaf4-4303-8ce4-4790e6d729ef?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.44.0","to_inclusive":true,"patched_in":"2.45.0"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T15:58:54Z"},{"id":"wordfence:3ad9fcd1-b3a3-4711-ad23-d27c3e2091f4","source":"wordfence","cve":"CVE-2024-5584","title":"WordPress Online Booking and Scheduling Plugin \u2013 Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad9fcd1-b3a3-4711-ad23-d27c3e2091f4?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"23.2","to_inclusive":true,"patched_in":"23.3"}],"published":"2024-06-10T20:39:42Z","updated":"2024-06-11T09:32:02Z"},{"id":"wordfence:3adea276-6b55-422d-adc9-a767f569181c","source":"wordfence","cve":"CVE-2023-40606","title":"Kanban Boards <= 2.5.21 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3adea276-6b55-422d-adc9-a767f569181c?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.21","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2026-03-27T11:10:50Z"},{"id":"wordfence:3adf6b20-110f-4057-9fab-5248e9c18555","source":"wordfence","cve":"","title":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress <= 4.6.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3adf6b20-110f-4057-9fab-5248e9c18555?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3adfbfcc-5d52-4a01-805d-c3273757aba1","source":"wordfence","cve":"CVE-2025-52796","title":"WP-Recall <= 16.26.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3adfbfcc-5d52-4a01-805d-c3273757aba1?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:15:07Z"},{"id":"wordfence:3ae02595-17f0-472d-bc4f-6169cce7a583","source":"wordfence","cve":"CVE-2026-1930","title":"Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae02595-17f0-472d-bc4f-6169cce7a583?source=api-prod","affected":[{"type":"plugin","slug":"emailchef","name":"Emailchef","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-04-21T20:35:30Z","updated":"2026-04-22T09:27:22Z"},{"id":"wordfence:3ae457da-a276-4bca-ae3f-c2f3e4fc45a0","source":"wordfence","cve":"CVE-2025-32252","title":"WP Genealogy \u2013 Your Family History Website <= 0.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae457da-a276-4bca-ae3f-c2f3e4fc45a0?source=api-prod","affected":[{"type":"plugin","slug":"wpgenealogy","name":"WP Genealogy \u2013 Your Family History Website","from":"*","from_inclusive":true,"to":"0.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T15:38:54Z"},{"id":"wordfence:3ae6bf2e-b39a-4bb3-9203-22ff4c23ddf4","source":"wordfence","cve":"CVE-2022-47432","title":"Shortcode IMDB <= 6.0.8 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae6bf2e-b39a-4bb3-9203-22ff4c23ddf4?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-imdb","name":"Shortcode IMDB","from":"*","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ae77d0e-db36-4d9c-ad12-6bf1186f79e4","source":"wordfence","cve":"CVE-2025-49909","title":"Penci Bookmark & Follow < 2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae77d0e-db36-4d9c-ad12-6bf1186f79e4?source=api-prod","affected":[{"type":"plugin","slug":"penci-bookmark-follow","name":"Penci Bookmark & Follow","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-29T14:46:55Z"},{"id":"wordfence:3ae890e7-a5b6-41c5-bc30-792c0b9272a6","source":"wordfence","cve":"CVE-2026-121519","title":"Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae890e7-a5b6-41c5-bc30-792c0b9272a6?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2026-11-06T13:51:22Z","updated":"2026-11-07T02:29:14Z"},{"id":"wordfence:3ae9392a-591c-4be0-9f90-aa6ec81d3a10","source":"wordfence","cve":"CVE-2022-2190","title":"Gallery Plugin for WordPress \u2013 Envira Photo Gallery <= 1.8.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ae9392a-591c-4be0-9f90-aa6ec81d3a10?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.4.7","to_inclusive":false,"patched_in":"1.8.4.7"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aeb5e01-0993-4628-8165-b27470332e34","source":"wordfence","cve":"CVE-2022-27852","title":"KB Support \u2013 WordPress Help Desk <= 1.5.5 - Multiple Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aeb5e01-0993-4628-8165-b27470332e34?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2022-04-15T13:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aecc02a-fd49-4743-9d7b-894cf657cbc1","source":"wordfence","cve":"CVE-2022-41608","title":"Asgaros Forum <= 2.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aecc02a-fd49-4743-9d7b-894cf657cbc1?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3aecea73-d905-428f-95e5-40f18db09edc","source":"wordfence","cve":"CVE-2026-57664","title":"Bopo \u2013 WooCommerce Product Bundle Builder <= 1.1.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aecea73-d905-428f-95e5-40f18db09edc?source=api-prod","affected":[{"type":"plugin","slug":"bopo-woo-product-bundle-builder","name":"Bopo \u2013 WooCommerce Product Bundle Builder","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:12:03Z"},{"id":"wordfence:3af027b6-19cc-415b-b0e3-bc1abe984265","source":"wordfence","cve":"CVE-2026-119468","title":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation <= 4.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3af027b6-19cc-415b-b0e3-bc1abe984265?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:41:49Z"},{"id":"wordfence:3af18a17-81a0-4720-b222-153ab4ddf7d9","source":"wordfence","cve":"CVE-2025-14379","title":"Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3af18a17-81a0-4720-b222-153ab4ddf7d9?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-creator","name":"Testimonials Creator","from":"1.6","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:43:09Z","updated":"2026-01-14T05:28:07Z"},{"id":"wordfence:3af5f238-9b2f-47d0-89e6-30ac09227041","source":"wordfence","cve":"CVE-2026-15257","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3af5f238-9b2f-47d0-89e6-30ac09227041?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.4","to_inclusive":false,"patched_in":"6.0.9.4"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:38:59Z"},{"id":"wordfence:3af83ec2-9ebb-4cca-8523-8fe9b1517825","source":"wordfence","cve":"CVE-2024-10329","title":"Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3af83ec2-9ebb-4cca-8523-8fe9b1517825?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-05T13:55:29Z"},{"id":"wordfence:3af9ece0-1556-4457-87ee-343daec5e74f","source":"wordfence","cve":"CVE-2025-14356","title":"Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3af9ece0-1556-4457-87ee-343daec5e74f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.33","to_inclusive":true,"patched_in":"3.5.34"}],"published":"2025-12-11T17:40:29Z","updated":"2025-12-12T06:32:59Z"},{"id":"wordfence:3afbfa7c-a87f-4810-9356-374923ff2314","source":"wordfence","cve":"CVE-2023-27450","title":"Leyka <= 3.29.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3afbfa7c-a87f-4810-9356-374923ff2314?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.29.2","to_inclusive":true,"patched_in":"3.30"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3afcc49d-8662-4f63-9e6f-fcf76932effc","source":"wordfence","cve":"CVE-2024-43243","title":"JobBoard Job listing <= 1.2.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3afcc49d-8662-4f63-9e6f-fcf76932effc?source=api-prod","affected":[{"type":"plugin","slug":"job-board-light","name":"JobBoard Job listing plugin","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:38:32Z"},{"id":"wordfence:3afdffa7-23ec-41ea-b05a-152a69b7ce50","source":"wordfence","cve":"CVE-2026-1804","title":"WDES Responsive Popup <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3afdffa7-23ec-41ea-b05a-152a69b7ce50?source=api-prod","affected":[{"type":"plugin","slug":"wdes-responsive-popup","name":"WDES Responsive Popup","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:09:37Z","updated":"2026-02-11T08:26:24Z"},{"id":"wordfence:3aff4d03-55a4-4f5d-9744-2d31f3491510","source":"wordfence","cve":"CVE-2026-94124","title":"Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3aff4d03-55a4-4f5d-9744-2d31f3491510?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-09-23T10:12:00Z","updated":"2026-09-29T20:04:41Z"},{"id":"wordfence:3b007d8a-3096-42f3-a7be-e0e0d3addf0b","source":"wordfence","cve":"CVE-2024-31386","title":"Multiple Themes (Various Versions) - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b007d8a-3096-42f3-a7be-e0e0d3addf0b?source=api-prod","affected":[{"type":"theme","slug":"sliding-door","name":"Sliding Door","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"},{"type":"theme","slug":"decode","name":"Decode","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"citylogic","name":"CityLogic","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":false,"patched_in":"1.1.30"},{"type":"theme","slug":"lightning","name":"Lightning","from":"*","from_inclusive":true,"to":"15.18.0","to_inclusive":true,"patched_in":"15.19.0"},{"type":"theme","slug":"i-max","name":"i-max","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"default-mag","name":"Default Mag","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"},{"type":"theme","slug":"shopstar","name":"Shopstar!","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":false,"patched_in":"1.1.34"},{"type":"theme","slug":"happenstance","name":"HappenStance","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"emmet-lite","name":"Emmet Lite","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":false,"patched_in":"1.7.8"},{"type":"theme","slug":"x-t9","name":"X-T9","from":"*","from_inclusive":true,"to":"1.19.1","to_inclusive":false,"patched_in":"1.19.1"},{"type":"theme","slug":"i-excel","name":"i-excel","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gridsby","name":"Gridsby","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"sensible-wp","name":"Sensible WP","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"namaha","name":"Namaha","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":false,"patched_in":"1.0.41"},{"type":"theme","slug":"panoramic","name":"Panoramic","from":"*","from_inclusive":true,"to":"1.1.57","to_inclusive":false,"patched_in":"1.1.57"}],"published":"2024-04-10T00:00:00Z","updated":"2024-08-02T14:44:32Z"},{"id":"wordfence:3b0336d7-1c85-4379-80db-19b478ba5471","source":"wordfence","cve":"CVE-2015-4557","title":"Nextend Twitter Connect <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b0336d7-1c85-4379-80db-19b478ba5471?source=api-prod","affected":[{"type":"plugin","slug":"nextend-twitter-connect","name":"Nextend Twitter Connect","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2015-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b08f457-0864-41e0-b45e-cbd597d87752","source":"wordfence","cve":"CVE-2024-0973","title":"Widget for Social Page Feeds <= 6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b08f457-0864-41e0-b45e-cbd597d87752?source=api-prod","affected":[{"type":"plugin","slug":"facebook-pagelike-widget","name":"Buttonizer \u2013 Social Media Share Buttons, Social Icons, & Social Feeds","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-14T13:04:12Z"},{"id":"wordfence:3b08f533-9c74-4be3-99ff-70a3d9b90358","source":"wordfence","cve":"CVE-2024-11751","title":"TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b08f533-9c74-4be3-99ff-70a3d9b90358?source=api-prod","affected":[{"type":"plugin","slug":"tcbd-popover","name":"TCBD Popover","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T16:02:20Z","updated":"2024-12-14T04:23:40Z"},{"id":"wordfence:3b0c6d8a-f673-4f04-92dc-88ccbc6ff9c9","source":"wordfence","cve":"CVE-2025-23708","title":"DF Draggable <= 1.13.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b0c6d8a-f673-4f04-92dc-88ccbc6ff9c9?source=api-prod","affected":[{"type":"plugin","slug":"df-draggable","name":"DF Draggable","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:55:50Z"},{"id":"wordfence:3b0d6b1f-5601-4c96-893c-e296511a2996","source":"wordfence","cve":"CVE-2021-24794","title":"Connections Business Directory <= 10.4.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b0d6b1f-5601-4c96-893c-e296511a2996?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"10.4.3","to_inclusive":false,"patched_in":"10.4.3"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b0e83af-5abd-4b6e-b606-850c03b05036","source":"wordfence","cve":"CVE-2026-66707","title":"Meta for WooCommerce <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b0e83af-5abd-4b6e-b606-850c03b05036?source=api-prod","affected":[{"type":"plugin","slug":"facebook-for-woocommerce","name":"Meta for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:20:47Z"},{"id":"wordfence:3b10a096-23fc-4f4d-b777-89b3bbcfe462","source":"wordfence","cve":"CVE-2026-115205","title":"AZEXO Store Locator <= 1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b10a096-23fc-4f4d-b777-89b3bbcfe462?source=api-prod","affected":[{"type":"plugin","slug":"azexo-store-locator","name":"AZEXO Store Locator","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:40:35Z"},{"id":"wordfence:3b1b1a55-7872-456f-a754-023aad354359","source":"wordfence","cve":"CVE-2022-4164","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_multiple_files_for_post","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1b1a55-7872-456f-a754-023aad354359?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b1b60f4-39f7-4981-bd8d-b1c6e63cf082","source":"wordfence","cve":"CVE-2021-4225","title":"SP Project & Document Manager  <= 4.23 - Subscriber+ Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1b60f4-39f7-4981-bd8d-b1c6e63cf082?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.24","to_inclusive":false,"patched_in":"4.24"}],"published":"2021-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b1bfe88-2513-4acc-91e2-50a3bc9d7183","source":"wordfence","cve":"CVE-2021-36851","title":"Testimonials Slider <= 3.5.8.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1bfe88-2513-4acc-91e2-50a3bc9d7183?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-add","name":"Testimonial Slider \u2013 Free Testimonials Slider Plugin","from":"*","from_inclusive":true,"to":"3.5.8.3","to_inclusive":true,"patched_in":"3.5.8.4"}],"published":"2022-04-04T11:06:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b1d8fe4-56a2-4593-94ff-16a793a52f52","source":"wordfence","cve":"CVE-2026-95599","title":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board <= 6.0.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1d8fe4-56a2-4593-94ff-16a793a52f52?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:51:19Z"},{"id":"wordfence:3b1e84a0-10c3-42a9-ab9f-89b5b0a84526","source":"wordfence","cve":"CVE-2024-34801","title":"Praison SEO WordPress <= 4.0.15 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1e84a0-10c3-42a9-ab9f-89b5b0a84526?source=api-prod","affected":[{"type":"plugin","slug":"seo-wordpress","name":"Praison AI SEO","from":"*","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"4.0.16"}],"published":"2024-05-20T00:00:00Z","updated":"2025-10-30T13:55:18Z"},{"id":"wordfence:3b2074d3-f9ea-48c0-82f6-a515e41c6082","source":"wordfence","cve":"CVE-2025-39504","title":"Goodlayers Hotel <= 3.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2074d3-f9ea-48c0-82f6-a515e41c6082?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hotel","name":"Goodlayers Hotel","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:39:02Z"},{"id":"wordfence:3b21b238-f2c2-415d-bd61-191d7721b70d","source":"wordfence","cve":"CVE-2026-73345","title":"License Manager for WooCommerce <= 3.0.18 - Authenticated (Customer+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b21b238-f2c2-415d-bd61-191d7721b70d?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":true,"patched_in":"3.0.19"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:17:49Z"},{"id":"wordfence:3b25fd8e-6aa3-471f-aaf6-114239e9c393","source":"wordfence","cve":"CVE-2026-88994","title":"All Bootstrap Blocks 1.3.20 - 1.3.31 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b25fd8e-6aa3-471f-aaf6-114239e9c393?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"1.3.20","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:01:16Z"},{"id":"wordfence:3b2b5da9-a421-48fb-9e91-8ef495cbdc37","source":"wordfence","cve":"CVE-2007-2484","title":"wp-Table <= 1.43 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2b5da9-a421-48fb-9e91-8ef495cbdc37?source=api-prod","affected":[{"type":"plugin","slug":"wp-table","name":"WP-Table","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":"1.44"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b2ef7c3-4610-4e8b-ab27-2d6cbdbed097","source":"wordfence","cve":"CVE-2024-10322","title":"Brizy \u2013 Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2ef7c3-4610-4e8b-ab27-2d6cbdbed097?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2025-02-12T00:09:28Z","updated":"2025-02-12T12:22:10Z"},{"id":"wordfence:3b2f8726-c4c4-4ed6-aa8d-4412cf5be061","source":"wordfence","cve":"CVE-2024-10580","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b2f8726-c4c4-4ed6-aa8d-4412cf5be061?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.6"}],"published":"2024-11-26T00:00:00Z","updated":"2024-11-27T06:41:29Z"},{"id":"wordfence:3b3170d0-3b9c-41dc-a08e-4d5bbaa7e89f","source":"wordfence","cve":"CVE-2024-35774","title":"DImage 360 <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3170d0-3b9c-41dc-a08e-4d5bbaa7e89f?source=api-prod","affected":[{"type":"plugin","slug":"dimage-360","name":"DImage 360","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-26T14:00:39Z"},{"id":"wordfence:3b32a446-9100-4ce7-ba82-ec5e44b4520e","source":"wordfence","cve":"CVE-2025-23673","title":"Email on Publish <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b32a446-9100-4ce7-ba82-ec5e44b4520e?source=api-prod","affected":[{"type":"plugin","slug":"email-on-publish","name":"Email on Publish","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:57:29Z"},{"id":"wordfence:3b345dfe-3945-405a-9825-c88816b2adee","source":"wordfence","cve":"CVE-2023-47782","title":"Thrive Theme Builder < 3.24.0 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b345dfe-3945-405a-9825-c88816b2adee?source=api-prod","affected":[{"type":"theme","slug":"thrive-theme","name":"Thrive Themes Builder","from":"*","from_inclusive":true,"to":"3.24.0","to_inclusive":false,"patched_in":"3.24.0"}],"published":"2023-11-14T00:00:00Z","updated":"2025-03-04T15:46:41Z"},{"id":"wordfence:3b345f84-97b5-4a55-9c66-0e9ece048a3c","source":"wordfence","cve":"CVE-2026-3002","title":"Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b345f84-97b5-4a55-9c66-0e9ece048a3c?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T06:08:27Z"},{"id":"wordfence:3b34a0c6-3573-48c7-8edb-c9cf9503da06","source":"wordfence","cve":"CVE-2019-16251","title":"YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b34a0c6-3573-48c7-8edb-c9cf9503da06?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-bulk-product-editing","name":"YITH WooCommerce Bulk Product Editing","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"},{"type":"plugin","slug":"yith-woocommerce-zoom-magnifier","name":"YITH WooCommerce Product Gallery & Image Zoom","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"},{"type":"plugin","slug":"yith-woocommerce-badges-management","name":"YITH WooCommerce Badge Management","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"},{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"1.5.21","to_inclusive":true,"patched_in":"1.5.23"},{"type":"plugin","slug":"yith-woocommerce-questions-and-answers","name":"YITH WooCommerce Questions and Answers","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"yith-woocommerce-authorizenet-payment-gateway","name":"YITH WooCommerce Authorize.net Payment Gateway","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"},{"type":"plugin","slug":"yith-woocommerce-order-tracking","name":"YITH WooCommerce Order & Shipment Tracking","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"},{"type":"plugin","slug":"yith-woocommerce-cart-messages","name":"YITH WooCommerce Cart Messages","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.5"},{"type":"plugin","slug":"yith-woocommerce-subscription","name":"YITH WooCommerce Subscription","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.6"},{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"yith-advanced-refund-system-for-woocommerce","name":"YITH Advanced Refund System for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.12"},{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"},{"type":"plugin","slug":"yith-woocommerce-stripe","name":"YITH WooCommerce Stripe","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"},{"type":"plugin","slug":"yith-custom-thank-you-page-for-woocommerce","name":"YITH Custom Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.8"},{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.3.15"},{"type":"plugin","slug":"yith-color-and-label-variations-for-woocommerce","name":"YITH Color and Label Variations for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.13"},{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.1"},{"type":"plugin","slug":"yith-woocommerce-mailchimp","name":"YITH WooCommerce Mailchimp","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"},{"type":"plugin","slug":"yith-product-size-charts-for-woocommerce","name":"YITH Product Size Charts for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.13"},{"type":"plugin","slug":"yith-woocommerce-best-sellers","name":"YITH WooCommerce Best Sellers","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.13"},{"type":"plugin","slug":"yith-woocommerce-product-vendors","name":"YITH WooCommerce Multi Vendor","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"},{"type":"plugin","slug":"yith-pre-order-for-woocommerce","name":"YITH Pre-Order for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"yith-woocommerce-product-bundles","name":"YITH WooCommerce Product Bundles","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.17"},{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.9"},{"type":"plugin","slug":"yith-woocommerce-waiting-list","name":"YITH WooCommerce Waitlist","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.11"},{"type":"plugin","slug":"yith-woocommerce-pdf-invoice","name":"YITH WooCommerce PDF Invoice and Shipping List","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"},{"type":"plugin","slug":"yith-woocommerce-brands-add-on","name":"YITH WooCommerce Brands Add-On","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"plugin","slug":"yith-woocommerce-gift-cards","name":"YITH WooCommerce Gift Cards","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"plugin","slug":"yith-woocommerce-points-and-rewards","name":"YITH WooCommerce Points and Rewards","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.6"},{"type":"plugin","slug":"yith-woocommerce-multi-step-checkout","name":"YITH WooCommerce Multi-step Checkout","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"},{"type":"plugin","slug":"yith-woocommerce-added-to-cart-popup","name":"YITH WooCommerce Added to Cart Popup","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.13"},{"type":"plugin","slug":"yith-desktop-notifications-for-woocommerce","name":"YITH Desktop Notifications for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"yith-woocommerce-affiliates","name":"YITH WooCommerce Affiliates","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"},{"type":"plugin","slug":"yith-woocommerce-quick-view","name":"YITH WooCommerce Quick View","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.15"},{"type":"plugin","slug":"yith-woocommerce-advanced-reviews","name":"YITH WooCommerce Advanced Reviews","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"yith-woocommerce-frequently-bought-together","name":"YITH Frequently Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"},{"type":"plugin","slug":"yith-woocommerce-recover-abandoned-cart","name":"YITH WooCommerce Recover Abandoned Cart","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"yith-woocommerce-social-login","name":"YITH WooCommerce Social Login","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2019-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b378256-2d9b-4aad-abfe-fecfc76f0bb4","source":"wordfence","cve":"CVE-2024-12574","title":"SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b378256-2d9b-4aad-abfe-fecfc76f0bb4?source=api-prod","affected":[{"type":"plugin","slug":"svg-shortcode","name":"SVG Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T04:23:26Z"},{"id":"wordfence:3b39ac65-611b-4bab-acc7-1c656c07a96a","source":"wordfence","cve":"CVE-2026-42691","title":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI <= 4.3.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b39ac65-611b-4bab-acc7-1c656c07a96a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.6.0","to_inclusive":true,"patched_in":"4.3.6.1"}],"published":"2026-10-29T14:40:00Z","updated":"2026-11-03T19:57:51Z"},{"id":"wordfence:3b39e58c-3fb6-40ce-af25-9b1a9c59e97a","source":"wordfence","cve":"CVE-2025-68992","title":"BWL Knowledge Base Manager <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b39e58c-3fb6-40ce-af25-9b1a9c59e97a?source=api-prod","affected":[{"type":"plugin","slug":"bwl-kb-manager","name":"BWL Knowledge Base Manager","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T15:25:55Z"},{"id":"wordfence:3b3a2738-5312-4b34-9bd3-4ff95a91706e","source":"wordfence","cve":"CVE-2014-2297","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.29.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3a2738-5312-4b34-9bd3-4ff95a91706e?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.29.6","to_inclusive":true,"patched_in":"4.29.9"}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b3bb703-fdff-4525-9272-7a3db58b81a0","source":"wordfence","cve":"CVE-2026-8900","title":"Simple SEO Slideshow <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3bb703-fdff-4525-9272-7a3db58b81a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-seo-slideshow","name":"Simple SEO Slideshow","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-06-05T10:52:25Z","updated":"2026-06-05T23:28:25Z"},{"id":"wordfence:3b3c2a72-8a8d-4b9a-98e8-f982e34cebb5","source":"wordfence","cve":"CVE-2025-64264","title":"Popup addon for Ninja Forms <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3c2a72-8a8d-4b9a-98e8-f982e34cebb5?source=api-prod","affected":[{"type":"plugin","slug":"popup-addon-for-ninja-forms","name":"Popup addon for Ninja Forms","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-17T18:14:10Z"},{"id":"wordfence:3b3d2e0d-ce2a-48cd-a36f-92979335fd71","source":"wordfence","cve":"CVE-2026-119183","title":"JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3d2e0d-ce2a-48cd-a36f-92979335fd71?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-06T21:48:52Z","updated":"2026-11-07T11:26:28Z"},{"id":"wordfence:3b3e2629-f50e-4d8f-9a9c-534fbe0ecb3a","source":"wordfence","cve":"CVE-2026-32401","title":"Client Invoicing by Sprout Invoices <= 20.8.9 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3e2629-f50e-4d8f-9a9c-534fbe0ecb3a?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.9","to_inclusive":true,"patched_in":"20.8.10"}],"published":"2026-02-21T00:00:00Z","updated":"2026-04-15T21:12:57Z"},{"id":"wordfence:3b3e793a-4290-4e0e-b5d4-d6acd83e5c3b","source":"wordfence","cve":"CVE-2026-32361","title":"Editorial Calendar <= 3.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3e793a-4290-4e0e-b5d4-d6acd83e5c3b?source=api-prod","affected":[{"type":"plugin","slug":"editorial-calendar","name":"Editorial Calendar","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:05:46Z"},{"id":"wordfence:3b3f0f80-0004-4373-b0a7-92f2d047415d","source":"wordfence","cve":"CVE-2025-11810","title":"Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3f0f80-0004-4373-b0a7-92f2d047415d?source=api-prod","affected":[{"type":"plugin","slug":"print-button-shortcode","name":"Name: Print Button Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:23:18Z","updated":"2025-10-22T08:27:06Z"},{"id":"wordfence:3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e","source":"wordfence","cve":"CVE-2024-9307","title":"mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e?source=api-prod","affected":[{"type":"plugin","slug":"mfolio-lite","name":"mFolio Lite","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-11-05T18:14:05Z","updated":"2024-11-25T20:38:34Z"},{"id":"wordfence:3b4108b7-fa78-4f1f-9eee-0e2383b4988c","source":"wordfence","cve":"CVE-2024-31271","title":"Ultimate Maps by Supsystic <= 1.2.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4108b7-fa78-4f1f-9eee-0e2383b4988c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:03:46Z"},{"id":"wordfence:3b44d23c-4872-491f-8a91-b0feb888ac54","source":"wordfence","cve":"CVE-2024-24805","title":"WP Dummy Content Generator <= 3.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b44d23c-4872-491f-8a91-b0feb888ac54?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:22:31Z"},{"id":"wordfence:3b467d55-db84-488e-8e80-bcdf2b691c76","source":"wordfence","cve":"CVE-2024-49684","title":"Backup and Staging by WP Time Capsule <= 1.22.21 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b467d55-db84-488e-8e80-bcdf2b691c76?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.21","to_inclusive":true,"patched_in":"1.22.22"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:56:52Z"},{"id":"wordfence:3b472eb8-9808-4a50-b2b4-0b0b3256053f","source":"wordfence","cve":"CVE-2024-3549","title":"Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b472eb8-9808-4a50-b2b4-0b0b3256053f?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"7.4.1","to_inclusive":true,"patched_in":"7.4.2"}],"published":"2024-06-10T18:21:36Z","updated":"2024-06-11T06:44:17Z"},{"id":"wordfence:3b497a36-4929-413f-abfc-1d81bfaa7889","source":"wordfence","cve":"CVE-2023-50371","title":"Advanced Page Visit Counter <= 8.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b497a36-4929-413f-abfc-1d81bfaa7889?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b497bc0-bf47-43c7-9d5f-8e130dd0bab2","source":"wordfence","cve":"CVE-2025-8084","title":"AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":6.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b497bc0-bf47-43c7-9d5f-8e130dd0bab2?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-11-18T00:28:40Z","updated":"2025-11-18T12:29:50Z"},{"id":"wordfence:3b4b2f0d-4803-4fcd-91c5-deca95037324","source":"wordfence","cve":"CVE-2025-49957","title":"Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4b2f0d-4803-4fcd-91c5-deca95037324?source=api-prod","affected":[{"type":"plugin","slug":"email-attachment-by-order-status-products","name":"Email Attachment by Order Status & Products","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-07-14T00:00:00Z","updated":"2026-09-30T14:23:00Z"},{"id":"wordfence:3b4e92a1-cac7-445d-a47c-52058e652c09","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b4e92a1-cac7-445d-a47c-52058e652c09?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b50aa30-6af9-48d9-a152-58141326ce4c","source":"wordfence","cve":"CVE-2026-110983","title":"Photo Album Plus <= 9.3.04.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b50aa30-6af9-48d9-a152-58141326ce4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.04.3","to_inclusive":true,"patched_in":"9.3.04.004"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:21:45Z"},{"id":"wordfence:3b515142-4e04-4570-b5cb-18261974c659","source":"wordfence","cve":"CVE-2021-31567","title":"Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":6.8,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b515142-4e04-4570-b5cb-18261974c659?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2021-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b5252ed-7901-4896-a574-46652d0dfc11","source":"wordfence","cve":"CVE-2026-40794","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5252ed-7901-4896-a574-46652d0dfc11?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-04-24T00:00:00Z","updated":"2026-04-30T14:51:05Z"},{"id":"wordfence:3b5253ad-19c1-4f79-9b12-c41ec60fee69","source":"wordfence","cve":"CVE-2025-68079","title":"Salient Shortcodes <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5253ad-19c1-4f79-9b12-c41ec60fee69?source=api-prod","affected":[{"type":"plugin","slug":"salient-shortcodes","name":"Salient Shortcodes","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-10-09T00:00:00Z","updated":"2025-12-20T20:29:01Z"},{"id":"wordfence:3b52dab9-f518-4b66-ba2d-2e5b4aeb2bb3","source":"wordfence","cve":"CVE-2024-31360","title":"Benchmark Email Lite <= 4.1 - Cross-Site Request Forgery via page_settings()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b52dab9-f518-4b66-ba2d-2e5b4aeb2bb3?source=api-prod","affected":[{"type":"plugin","slug":"benchmark-email-lite","name":"Benchmark Email Lite","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T13:51:00Z"},{"id":"wordfence:3b5630bd-5bce-4226-959f-5e81ae69b799","source":"wordfence","cve":"CVE-2026-8206","title":"Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5630bd-5bce-4226-959f-5e81ae69b799?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.0.0","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2026-06-01T15:03:50Z","updated":"2026-06-02T03:28:49Z"},{"id":"wordfence:3b56a793-2a20-4bd7-aefb-a8d012c56527","source":"wordfence","cve":"CVE-2021-25023","title":"Speed Booster Pack <= 4.3.3 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b56a793-2a20-4bd7-aefb-a8d012c56527?source=api-prod","affected":[{"type":"plugin","slug":"speed-booster-pack","name":"Speed Booster Pack \u26a1 PageSpeed Optimization Suite","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.3.1"}],"published":"2021-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b56e9a2-5724-4317-9ce0-9daff4291a1e","source":"wordfence","cve":"CVE-2026-108485","title":"eStore <= 1.6.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b56e9a2-5724-4317-9ce0-9daff4291a1e?source=api-prod","affected":[{"type":"theme","slug":"estore","name":"eStore","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":true,"patched_in":"1.6.14"}],"published":"2026-10-16T10:36:38Z","updated":"2026-10-23T18:09:26Z"},{"id":"wordfence:3b59bf60-eadd-4942-a310-9d9f108820f0","source":"wordfence","cve":"CVE-2026-32540","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 26.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b59bf60-eadd-4942-a310-9d9f108820f0?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"26.7","to_inclusive":true,"patched_in":"26.8"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:35:37Z"},{"id":"wordfence:3b5dc0af-90cf-41dd-a77b-4b99f267c0d9","source":"wordfence","cve":"CVE-2017-15867","title":"User Login History Plugin <= 1.5.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5dc0af-90cf-41dd-a77b-4b99f267c0d9?source=api-prod","affected":[{"type":"plugin","slug":"user-login-history","name":"User Login History","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2017-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b5decc1-cc81-4a5e-b6d8-5120cb37c93b","source":"wordfence","cve":"CVE-2024-23502","title":"Posts List Designer by Category \u2013 List Category Posts Or Recent Posts <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5decc1-cc81-4a5e-b6d8-5120cb37c93b?source=api-prod","affected":[{"type":"plugin","slug":"post-list-designer","name":"Post List Designer \u2013 Category Post, Recent Post, Post List","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-01-19T00:00:00Z","updated":"2024-03-14T12:53:07Z"},{"id":"wordfence:3b5f1a1e-8066-4f20-af36-a778e50a3f64","source":"wordfence","cve":"CVE-2024-3112","title":"Quotes and Tips by BestWebSoft <= 1.44 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5f1a1e-8066-4f20-af36-a778e50a3f64?source=api-prod","affected":[{"type":"plugin","slug":"quotes-and-tips","name":"Quotes and Tips by BestWebSoft","from":"*","from_inclusive":true,"to":"1.44","to_inclusive":true,"patched_in":"1.45"}],"published":"2024-06-21T00:00:00Z","updated":"2024-08-09T17:16:43Z"},{"id":"wordfence:3b5fc0ac-7a33-48da-8b0f-566b9eb0f17f","source":"wordfence","cve":"CVE-2022-41698","title":"If Menu <= 0.16.3 - Missing Authorization to Admin Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b5fc0ac-7a33-48da-8b0f-566b9eb0f17f?source=api-prod","affected":[{"type":"plugin","slug":"if-menu","name":"If Menu \u2013 Visibility control for Menus","from":"*","from_inclusive":true,"to":"0.16.3","to_inclusive":true,"patched_in":"0.17"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b6916d3-3944-43a2-8d5e-424f86c753ad","source":"wordfence","cve":"CVE-2026-4303","title":"WP Visitor Statistics (Real Time Traffic) <= 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6916d3-3944-43a2-8d5e-424f86c753ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":"8.5"}],"published":"2026-04-07T20:50:03Z","updated":"2026-04-08T09:25:53Z"},{"id":"wordfence:3b6ac92f-2ad1-4528-b157-5e49d6f224a5","source":"wordfence","cve":"CVE-2024-6625","title":"WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6ac92f-2ad1-4528-b157-5e49d6f224a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-total-branding","name":"WP Total Branding \u2013 Complete branding solution for WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-07-11T18:51:55Z","updated":"2024-07-12T07:35:10Z"},{"id":"wordfence:3b6ae26e-9262-4241-81d1-d5522bd35345","source":"wordfence","cve":"CVE-2016-20075","title":"Ultimate Product Catalog <= 4.4.48 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6ae26e-9262-4241-81d1-d5522bd35345?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.4.48","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-18T00:55:08Z"},{"id":"wordfence:3b6b1b7e-2ba4-4b72-9e3d-b54c00437cac","source":"wordfence","cve":"CVE-2023-47183","title":"GiveWP <= 2.33.1 - Missing Authorization via handleBeforeGateway","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6b1b7e-2ba4-4b72-9e3d-b54c00437cac?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.33.1","to_inclusive":true,"patched_in":"2.33.2"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b6c114b-00e0-4d3d-ba8b-dc9b294112db","source":"wordfence","cve":"CVE-2024-49674","title":"EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6c114b-00e0-4d3d-ba8b-dc9b294112db?source=api-prod","affected":[{"type":"plugin","slug":"ekc-tournament-manager","name":"EKC Tournament Manager","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-10-21T00:00:00Z","updated":"2024-11-26T20:16:26Z"},{"id":"wordfence:3b6e45ae-650e-45eb-b781-5acec1ba2dde","source":"wordfence","cve":"CVE-2017-18615","title":"Kama Click Counter <= 3.4.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6e45ae-650e-45eb-b781-5acec1ba2dde?source=api-prod","affected":[{"type":"plugin","slug":"kama-clic-counter","name":"Kama Click Counter","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2017-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b705b50-4e8e-4ced-a74f-ef17b5440839","source":"wordfence","cve":"CVE-2025-23468","title":"Essay Wizard (wpCRES) <= 1.0.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b705b50-4e8e-4ced-a74f-ef17b5440839?source=api-prod","affected":[{"type":"plugin","slug":"essay-wizard-wpcres","name":"Essay Wizard (wpCRES)","from":"*","from_inclusive":true,"to":"1.0.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:47:10Z"},{"id":"wordfence:3b70f48f-76a6-459c-8108-3ca008471534","source":"wordfence","cve":"CVE-2025-6757","title":"Recent Posts Widget Extended <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b70f48f-76a6-459c-8108-3ca008471534?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-widget-extended","name":"Recent Posts Widget Extended","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T15:37:54Z","updated":"2025-09-06T04:22:50Z"},{"id":"wordfence:3b7108fc-0eb2-4f9f-b747-3b83c57a1b53","source":"wordfence","cve":"CVE-2019-15837","title":"WebP Express <= 0.14.10 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7108fc-0eb2-4f9f-b747-3b83c57a1b53?source=api-prod","affected":[{"type":"plugin","slug":"webp-express","name":"WebP Express","from":"*","from_inclusive":true,"to":"0.14.11","to_inclusive":false,"patched_in":"0.14.11"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b712d05-3369-41b6-9e68-8f2a8c5b477b","source":"wordfence","cve":"CVE-2026-25340","title":"Noo JobMonster < 4.8.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b712d05-3369-41b6-9e68-8f2a8c5b477b?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:41:57Z"},{"id":"wordfence:3b71805c-15bb-4cde-b91f-4f3e9b7ab520","source":"wordfence","cve":"","title":"Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b71805c-15bb-4cde-b91f-4f3e9b7ab520?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b71c90d-addc-4cbb-9d6c-9d0a3471ac1f","source":"wordfence","cve":"CVE-2025-68869","title":"LazyTasks <= 1.2.37 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b71c90d-addc-4cbb-9d6c-9d0a3471ac1f?source=api-prod","affected":[{"type":"plugin","slug":"lazytasks-project-task-management","name":"LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart","from":"*","from_inclusive":true,"to":"1.2.37","to_inclusive":true,"patched_in":"1.3.01"}],"published":"2026-01-22T00:00:00Z","updated":"2026-03-17T21:32:51Z"},{"id":"wordfence:3b739a4e-7cf2-46a9-8c75-939cdaa2e2c4","source":"wordfence","cve":"CVE-2025-25173","title":"FastBook <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b739a4e-7cf2-46a9-8c75-939cdaa2e2c4?source=api-prod","affected":[{"type":"plugin","slug":"fastbook-responsive-appointment-booking-and-scheduling-system","name":"FastBook \u2013 Responsive Appointment Booking and Scheduling System","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T17:05:36Z"},{"id":"wordfence:3b74ae4d-d353-497a-9364-6fdbee7e0815","source":"wordfence","cve":"CVE-2026-107447","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b74ae4d-d353-497a-9364-6fdbee7e0815?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"34.0.1","to_inclusive":false,"patched_in":"34.0.1"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:12:22Z"},{"id":"wordfence:3b7801b4-8d96-453e-b357-817972b3332b","source":"wordfence","cve":"CVE-2026-12907","title":"RTMKit Addons for Elementor <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7801b4-8d96-453e-b357-817972b3332b?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T23:14:15Z"},{"id":"wordfence:3b791711-4028-4c22-837c-2837d2152d6d","source":"wordfence","cve":"CVE-2024-56065","title":"WP2LEADS <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b791711-4028-4c22-837c-2837d2152d6d?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:58:20Z"},{"id":"wordfence:3b798c64-3434-427d-b578-5abbdac8cd0e","source":"wordfence","cve":"CVE-2022-2933","title":"0mk Shortener <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b798c64-3434-427d-b578-5abbdac8cd0e?source=api-prod","affected":[{"type":"plugin","slug":"0mk-shortener","name":"0mk Shortener","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b7aac1c-6962-49cf-850f-ab7b1d220090","source":"wordfence","cve":"CVE-2023-4161","title":"WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7aac1c-6962-49cf-850f-ab7b1d220090?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.90","to_inclusive":true,"patched_in":"1.2.91"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b7ab552-1ec5-4479-84b9-3e44f6c0354d","source":"wordfence","cve":"CVE-2024-13548","title":"Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7ab552-1ec5-4479-84b9-3e44f6c0354d?source=api-prod","affected":[{"type":"plugin","slug":"power-ups-for-elementor","name":"Power Ups for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:45:04Z","updated":"2025-01-25T07:24:15Z"},{"id":"wordfence:3b7ce442-ad47-4b0d-8b30-b45cae4362ae","source":"wordfence","cve":"CVE-2025-26956","title":"Traveler <= 3.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7ce442-ad47-4b0d-8b30-b45cae4362ae?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-05-23T14:07:35Z"},{"id":"wordfence:3b7f8739-7f40-40a7-952e-002ea3b82ac7","source":"wordfence","cve":"CVE-2023-5430","title":"Jquery news ticker <= 3.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7f8739-7f40-40a7-952e-002ea3b82ac7?source=api-prod","affected":[{"type":"plugin","slug":"jquery-news-ticker","name":"Jquery news ticker","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b806e11-57ad-4976-9ece-419ad6581cc4","source":"wordfence","cve":"CVE-2016-10926","title":"Nelio AB Testing < 4.5.9 - Server Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b806e11-57ad-4976-9ece-419ad6581cc4?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2016-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b819e88-111a-4611-ae23-87ac7a878b4a","source":"wordfence","cve":"CVE-2023-6503","title":"WP Plugin Lister <= 2.1.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b819e88-111a-4611-ae23-87ac7a878b4a?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-lister","name":"WP Plugin Lister","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b8282a2-8265-4fa0-b137-6272b9e44fc3","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Cross-Site Scripting via request_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b8282a2-8265-4fa0-b137-6272b9e44fc3?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b864ff8-83fb-40e2-9264-7c57115d50f2","source":"wordfence","cve":"CVE-2012-2917","title":"Share and Follow <= 1.80.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b864ff8-83fb-40e2-9264-7c57115d50f2?source=api-prod","affected":[{"type":"plugin","slug":"share-and-follow","name":"Share and Follow","from":"*","from_inclusive":true,"to":"1.80.3","to_inclusive":true,"patched_in":"1.80.4"}],"published":"2012-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b874721-6cb9-4ce4-a78e-a457596d15ff","source":"wordfence","cve":"","title":"Live Chat Unlimited <= 2.8.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b874721-6cb9-4ce4-a78e-a457596d15ff?source=api-prod","affected":[{"type":"plugin","slug":"screets-lcx","name":"screets-lcx","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b89319c-53ed-4130-8c67-420a7efef13b","source":"wordfence","cve":"CVE-2025-11237","title":"Make Email Customizer for WooCommerce <= 1.0.6 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b89319c-53ed-4130-8c67-420a7efef13b?source=api-prod","affected":[{"type":"plugin","slug":"make-email-customizer-for-woocommerce","name":"Make Email Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-17T18:21:28Z"},{"id":"wordfence:3b89c9ce-086e-4b90-b469-97baae06b347","source":"wordfence","cve":"CVE-2025-25138","title":"On Page SEO + Whatsapp Chat Button <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b89c9ce-086e-4b90-b469-97baae06b347?source=api-prod","affected":[{"type":"plugin","slug":"ops-robots-txt","name":"On Page SEO + Social Live Chat","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-03-18T18:15:22Z"},{"id":"wordfence:3b8cfb2b-8f08-4d35-a3d9-ced734f7960e","source":"wordfence","cve":"CVE-2025-59578","title":"Free Follow-Up Emails & Marketing Automation for WooCommerce \u2013 ShopMagic <= 4.5.6 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b8cfb2b-8f08-4d35-a3d9-ced734f7960e?source=api-prod","affected":[{"type":"plugin","slug":"shopmagic-for-woocommerce","name":"ShopMagic \u2013 email automation for WordPress","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-23T14:35:04Z"},{"id":"wordfence:3b8ea0b1-5050-43fc-8b80-b6a501a607fe","source":"wordfence","cve":"","title":"Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b8ea0b1-5050-43fc-8b80-b6a501a607fe?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2021-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b93c33c-4ab1-48a2-b84d-3cb38ccea829","source":"wordfence","cve":"CVE-2024-12281","title":"Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b93c33c-4ab1-48a2-b84d-3cb38ccea829?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2025-03-04T21:24:24Z","updated":"2025-05-01T15:05:27Z"},{"id":"wordfence:3b949389-65ca-4c95-ac84-46b5d7087c3d","source":"wordfence","cve":"CVE-2026-25388","title":"Ads Pro <= 5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b949389-65ca-4c95-ac84-46b5d7087c3d?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2026-02-20T00:00:00Z","updated":"2026-02-24T19:19:13Z"},{"id":"wordfence:3b949792-7b04-4174-9b86-b2ad259017fa","source":"wordfence","cve":"CVE-2026-24358","title":"Quiz And Survey Master <= 10.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b949792-7b04-4174-9b86-b2ad259017fa?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.3","to_inclusive":true,"patched_in":"10.3.4"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-03T20:52:13Z"},{"id":"wordfence:3b955662-ce67-4c4c-8703-7460a7bcd4fc","source":"wordfence","cve":"CVE-2025-31413","title":"Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b955662-ce67-4c4c-8703-7460a7bcd4fc?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.3.13","to_inclusive":true,"patched_in":"8.3.14"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-28T18:50:10Z"},{"id":"wordfence:3b98668e-a20f-49a3-a6d6-6da6d1c044d6","source":"wordfence","cve":"CVE-2016-11013","title":"IMPress Listings <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b98668e-a20f-49a3-a6d6-6da6d1c044d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-listings","name":"IMPress Listings","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2016-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3b9891d4-b9c7-49c7-b40c-3d6525a8ba99","source":"wordfence","cve":"CVE-2024-55995","title":"Torod \u2013 The smart shipping and delivery portal for e-shops and retailers <= 1.7 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b9891d4-b9c7-49c7-b40c-3d6525a8ba99?source=api-prod","affected":[{"type":"plugin","slug":"torod","name":"Torod \u2013 WooCommerce Shipping for Saudi Arabia & GCC","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-12-14T00:00:00Z","updated":"2025-02-03T15:06:55Z"},{"id":"wordfence:3b9b38e0-a6f9-4739-af0a-648c0d776281","source":"wordfence","cve":"CVE-2026-62099","title":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3b9b38e0-a6f9-4739-af0a-648c0d776281?source=api-prod","affected":[{"type":"theme","slug":"kute-boutique","name":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:22:29Z"},{"id":"wordfence:3ba1100e-8669-4105-b8d7-27c0b81c0856","source":"wordfence","cve":"CVE-2024-2505","title":"GamiPress <= 6.8.8 - Broken Access Control","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba1100e-8669-4105-b8d7-27c0b81c0856?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.8.9"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-07T12:32:45Z"},{"id":"wordfence:3ba33a18-429f-4a3e-b018-bdfbbe6e8482","source":"wordfence","cve":"CVE-2025-5953","title":"WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba33a18-429f-4a3e-b018-bdfbbe6e8482?source=api-prod","affected":[{"type":"plugin","slug":"hrm","name":"WP Human Resource Management","from":"2.0.0","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:17:43Z","updated":"2025-07-04T01:44:03Z"},{"id":"wordfence:3ba3cf12-facb-479b-8077-fd279c40607e","source":"wordfence","cve":"CVE-2023-5922","title":"Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba3cf12-facb-479b-8077-fd279c40607e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.80","to_inclusive":true,"patched_in":"1.3.81"}],"published":"2023-12-06T00:00:00Z","updated":"2024-02-06T17:26:09Z"},{"id":"wordfence:3ba7f9cb-2615-4c9e-a4d8-648860afd7a4","source":"wordfence","cve":"CVE-2026-40749","title":"Charity Zone <= 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba7f9cb-2615-4c9e-a4d8-648860afd7a4?source=api-prod","affected":[{"type":"theme","slug":"charity-zone","name":"Charity Zone","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:26:16Z"},{"id":"wordfence:3ba84be8-c6dc-4cb7-b93c-38c69ab07154","source":"wordfence","cve":"","title":"WP REST API (WP API) < 1.2.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba84be8-c6dc-4cb7-b93c-38c69ab07154?source=api-prod","affected":[{"type":"plugin","slug":"json-rest-api","name":"WP REST API (WP API)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2015-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ba8a9f5-0633-4cf0-af27-5466d93e9020","source":"wordfence","cve":"CVE-2024-5605","title":"Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba8a9f5-0633-4cf0-af27-5466d93e9020?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.16","to_inclusive":true,"patched_in":"3.17"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T03:37:23Z"},{"id":"wordfence:3ba8bc04-ac35-4799-ac02-556c1cd07293","source":"wordfence","cve":"CVE-2025-69178","title":"Truemag <= 4.3.14.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba8bc04-ac35-4799-ac02-556c1cd07293?source=api-prod","affected":[{"type":"theme","slug":"truemag","name":"Truemag","from":"*","from_inclusive":true,"to":"4.3.14.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:10:18Z"},{"id":"wordfence:3ba98b0b-0772-4871-9892-c6354ceaf614","source":"wordfence","cve":"","title":"Google SEO Pressor for Rich snippets <= 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba98b0b-0772-4871-9892-c6354ceaf614?source=api-prod","affected":[{"type":"plugin","slug":"google-seo-author-snippets","name":"Google SEO Pressor for Rich snippets","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ba995c6-e577-4e26-af6e-d236449a993d","source":"wordfence","cve":"CVE-2024-51617","title":"Clyp <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba995c6-e577-4e26-af6e-d236449a993d?source=api-prod","affected":[{"type":"plugin","slug":"clyp","name":"Clyp","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:32:31Z"},{"id":"wordfence:3ba9f117-c314-47ad-8af1-5294b529d95c","source":"wordfence","cve":"CVE-2025-31593","title":"OpenMenu <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba9f117-c314-47ad-8af1-5294b529d95c?source=api-prod","affected":[{"type":"plugin","slug":"open-menu","name":"OpenMenu \u2013 The official plugin for OpenMenu","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:00:31Z"},{"id":"wordfence:3baa0543-cdfb-4699-97ca-eaa83c2494a1","source":"wordfence","cve":"","title":"Chaty <= 3.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3baa0543-cdfb-4699-97ca-eaa83c2494a1?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3baca79e-1234-4b26-998e-574c4ad33d39","source":"wordfence","cve":"CVE-2025-58820","title":"Carousel Ultimate <= 1.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3baca79e-1234-4b26-998e-574c4ad33d39?source=api-prod","affected":[{"type":"plugin","slug":"carousel","name":"Carousel \u2013 Image Carousel, Post Slider, Product & Video Gallery","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-05T00:00:00Z","updated":"2026-10-13T16:55:53Z"},{"id":"wordfence:3bad1d0d-3817-4c7f-a012-5a85b577781e","source":"wordfence","cve":"CVE-2024-1775","title":"Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bad1d0d-3817-4c7f-a012-5a85b577781e?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-02T07:35:48Z"},{"id":"wordfence:3badf9b8-7558-4a46-9eb2-cd119a77c903","source":"wordfence","cve":"CVE-2023-4970","title":"PubyDoc <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3badf9b8-7558-4a46-9eb2-cd119a77c903?source=api-prod","affected":[{"type":"plugin","slug":"pubydoc-data-tables-and-charts","name":"PubyDoc \u2013 Data Tables and Charts","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bb0d712-5a0f-4526-bb24-2ce96bdd039b","source":"wordfence","cve":"CVE-2025-58851","title":"Boxed Content <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb0d712-5a0f-4526-bb24-2ce96bdd039b?source=api-prod","affected":[{"type":"plugin","slug":"boxed-content","name":"Boxed Content","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:30:37Z"},{"id":"wordfence:3bb15611-85a4-4efb-81e5-7352c348c4a9","source":"wordfence","cve":"CVE-2024-31932","title":"Blocksy Companion <= 2.0.28 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb15611-85a4-4efb-81e5-7352c348c4a9?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.0.28","to_inclusive":true,"patched_in":"2.0.29"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:59:13Z"},{"id":"wordfence:3bb1ac5d-01aa-48d8-85fe-ac6b359b6815","source":"wordfence","cve":"CVE-2025-27288","title":"File Icons <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb1ac5d-01aa-48d8-85fe-ac6b359b6815?source=api-prod","affected":[{"type":"plugin","slug":"file-icons","name":"File Icons","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:33:46Z"},{"id":"wordfence:3bb30dac-e0f3-43dd-a20d-9af6c7af3cb4","source":"wordfence","cve":"CVE-2024-10849","title":"NewsMash <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb30dac-e0f3-43dd-a20d-9af6c7af3cb4?source=api-prod","affected":[{"type":"theme","slug":"newsmash","name":"NewsMash","from":"*","from_inclusive":true,"to":"1.0.71","to_inclusive":true,"patched_in":"1.0.72"}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-08T16:02:27Z"},{"id":"wordfence:3bb47765-f218-4864-8d0d-5880811e0514","source":"wordfence","cve":"CVE-2025-68087","title":"Modalier for Elementor <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb47765-f218-4864-8d0d-5880811e0514?source=api-prod","affected":[{"type":"plugin","slug":"modalier-elementor","name":"Modalier for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:26:35Z"},{"id":"wordfence:3bb4a3f3-495d-4ece-9436-9c317688982c","source":"wordfence","cve":"CVE-2017-1000033","title":"Vospari Forms < 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb4a3f3-495d-4ece-9436-9c317688982c?source=api-prod","affected":[{"type":"plugin","slug":"vospari-forms","name":"Vospari Forms","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2016-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bb4a8ba-33f1-4183-be76-72f6a99fc1fa","source":"wordfence","cve":"CVE-2024-43240","title":"Indeed Membership Pro <= 12.7 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb4a8ba-33f1-4183-be76-72f6a99fc1fa?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":true,"patched_in":"12.8"}],"published":"2024-08-12T00:00:00Z","updated":"2024-11-13T21:41:07Z"},{"id":"wordfence:3bb4d37c-c4c2-4523-9b4e-73ffb7be81ea","source":"wordfence","cve":"CVE-2023-4308","title":"User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb4d37c-c4c2-4523-9b4e-73ffb7be81ea?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20230809","to_inclusive":true,"patched_in":"20230811"}],"published":"2023-08-14T00:00:00Z","updated":"2025-02-11T21:59:49Z"},{"id":"wordfence:3bb6e8f8-690a-49cb-ac00-f572bef8b8f7","source":"wordfence","cve":"CVE-2018-5664","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via social_icon_1 parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb6e8f8-690a-49cb-ac00-f572bef8b8f7?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bb8e6c2-ca38-44a2-99d4-b3df62ed753c","source":"wordfence","cve":"CVE-2024-37426","title":"Elegant Pink <= 1.3.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb8e6c2-ca38-44a2-99d4-b3df62ed753c?source=api-prod","affected":[{"type":"theme","slug":"elegant-pink","name":"Elegant Pink","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:48:03Z"},{"id":"wordfence:3bb93138-f2f9-4a3f-a0a2-d79a315c44f3","source":"wordfence","cve":"CVE-2022-37603","title":"loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service","severity":"low","cvss":3.7,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb93138-f2f9-4a3f-a0a2-d79a315c44f3?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-ordering","name":"Simple Page Ordering","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"},{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"},{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bb9520d-e679-4e8a-ae3c-8207f17d45a2","source":"wordfence","cve":"CVE-2022-2515","title":"Simple Banner <= 2.11.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bb9520d-e679-4e8a-ae3c-8207f17d45a2?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bba2901-55a7-4ef1-ab3c-1415aa99c729","source":"wordfence","cve":"CVE-2024-2513","title":"WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bba2901-55a7-4ef1-ab3c-1415aa99c729?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-09T18:58:43Z"},{"id":"wordfence:3bba8002-8106-493c-aeb2-b7189190fb3d","source":"wordfence","cve":"CVE-2025-63064","title":"EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bba8002-8106-493c-aeb2-b7189190fb3d?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":""}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-11T16:31:47Z"},{"id":"wordfence:3bbbf5be-5c0a-4514-88ac-003083c0bba3","source":"wordfence","cve":"CVE-2024-3229","title":"Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.2","to_inclusive":true,"patched_in":"10.3"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-20T18:50:55Z"},{"id":"wordfence:3bbc5e97-30a1-4774-a819-8a22a24436b6","source":"wordfence","cve":"CVE-2025-64212","title":"MasterStudy LMS Pro < 4.7.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbc5e97-30a1-4774-a819-8a22a24436b6?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.16","to_inclusive":false,"patched_in":"4.7.16"}],"published":"2025-10-12T00:00:00Z","updated":"2025-11-04T15:36:52Z"},{"id":"wordfence:3bbe4570-8aa2-4d95-8822-4e67cf352fdb","source":"wordfence","cve":"CVE-2025-26985","title":"Majestic Support <= 1.0.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbe4570-8aa2-4d95-8822-4e67cf352fdb?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:28:56Z"},{"id":"wordfence:3bbe6b57-9c50-4515-aa62-a9d9a41bf4ce","source":"wordfence","cve":"CVE-2024-10104","title":"Jobs for WordPress <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbe6b57-9c50-4515-aa62-a9d9a41bf4ce?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T18:07:56Z"},{"id":"wordfence:3bc0951e-8ada-4221-b154-101bad33a183","source":"wordfence","cve":"CVE-2022-0161","title":"ARI Fancy Lightbox <= 1.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc0951e-8ada-4221-b154-101bad33a183?source=api-prod","affected":[{"type":"plugin","slug":"ari-fancy-lightbox","name":"ARI Fancy Lightbox \u2013 Popup for WordPress","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bc19aca-15df-40c8-a7c4-10ae7faf0308","source":"wordfence","cve":"CVE-2026-24963","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.2.38 - Authenticated (Employee+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc19aca-15df-40c8-a7c4-10ae7faf0308?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.38","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T18:38:12Z"},{"id":"wordfence:3bc48d4d-eeee-47f7-be5e-0d6a43473aa0","source":"wordfence","cve":"CVE-2025-12880","title":"Progress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc48d4d-eeee-47f7-be5e-0d6a43473aa0?source=api-prod","affected":[{"type":"plugin","slug":"progressmatify-blocks","name":"Progress Bar Blocks for Gutenberg","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:28:03Z","updated":"2025-11-11T03:30:36Z"},{"id":"wordfence:3bc547f7-4f9e-4633-b881-107473dc980e","source":"wordfence","cve":"CVE-2026-65479","title":"Reviewer <= 3.14.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc547f7-4f9e-4633-b881-107473dc980e?source=api-prod","affected":[{"type":"plugin","slug":"reviewer","name":"reviewer","from":"*","from_inclusive":true,"to":"3.14.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:35:26Z"},{"id":"wordfence:3bc8e26f-0a35-4223-b69a-e9f0b4f13cc8","source":"wordfence","cve":"CVE-2025-58815","title":"Aitasi Coming Soon <= 2.0.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc8e26f-0a35-4223-b69a-e9f0b4f13cc8?source=api-prod","affected":[{"type":"plugin","slug":"aitasi-coming-soon","name":"Aitasi Coming Soon","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:05:20Z"},{"id":"wordfence:3bc98896-6ff9-40de-ace2-2ca331c2a44a","source":"wordfence","cve":"CVE-2023-4271","title":"Photospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc98896-6ff9-40de-ace2-2ca331c2a44a?source=api-prod","affected":[{"type":"plugin","slug":"photospace-responsive","name":"Photospace Responsive Gallery","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bc9f344-b605-4257-8d77-e073f85fe344","source":"wordfence","cve":"CVE-2026-9027","title":"CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bc9f344-b605-4257-8d77-e073f85fe344?source=api-prod","affected":[{"type":"plugin","slug":"corvuspay-woocommerce-integration","name":"CorvusPay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-07-08T20:40:59Z","updated":"2026-07-09T09:31:20Z"},{"id":"wordfence:3bcaa6e3-c789-4859-a514-6b86e799c16d","source":"wordfence","cve":"CVE-2026-85081","title":"Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcaa6e3-c789-4859-a514-6b86e799c16d?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"8.0.4","to_inclusive":true,"patched_in":"8.0.5"},{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"},{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-10-01T12:21:02Z"},{"id":"wordfence:3bcb60a8-220f-45a4-a9a9-10f64acf470c","source":"wordfence","cve":"CVE-2024-13322","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcb60a8-220f-45a4-a9a9-10f64acf470c?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.88","to_inclusive":true,"patched_in":"4.89"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:19Z"},{"id":"wordfence:3bcb87df-5cd3-4234-ad17-c40eacabd305","source":"wordfence","cve":"CVE-2026-25310","title":"Extend Link <= 2.0.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcb87df-5cd3-4234-ad17-c40eacabd305?source=api-prod","affected":[{"type":"plugin","slug":"extend-link","name":"Extend Link","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-05-04T15:18:26Z"},{"id":"wordfence:3bcd4675-e930-44d9-8278-c4c9e877656a","source":"wordfence","cve":"CVE-2024-10803","title":"MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcd4675-e930-44d9-8278-c4c9e877656a?source=api-prod","affected":[{"type":"plugin","slug":"fwdmsp","name":"MP3 Sticky Player","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":"8.0"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T07:38:04Z"},{"id":"wordfence:3bcd4da7-db9d-41ee-88d7-1b55e6166ea0","source":"wordfence","cve":"CVE-2025-25097","title":"External Video For Everybody <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcd4da7-db9d-41ee-88d7-1b55e6166ea0?source=api-prod","affected":[{"type":"plugin","slug":"external-video-for-everybody","name":"External \"Video for Everybody\"","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:17:57Z"},{"id":"wordfence:3bcd61d4-4775-4297-b7f5-664991fcd6d2","source":"wordfence","cve":"","title":"GeoDirectory <= 2.3.28 - Authenticated (Administrator+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcd61d4-4775-4297-b7f5-664991fcd6d2?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.28","to_inclusive":true,"patched_in":"2.3.29"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bce40ee-c378-4a44-9c5d-d83151975309","source":"wordfence","cve":"CVE-2023-47870","title":"wpForo Forum <= 2.2.8 - Cross-Site Request Forgery via logout()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce40ee-c378-4a44-9c5d-d83151975309?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2023-11-20T00:00:00Z","updated":"2024-05-30T15:38:48Z"},{"id":"wordfence:3bce6872-34d4-4675-bce9-e1197d801bce","source":"wordfence","cve":"CVE-2024-9824","title":"ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce6872-34d4-4675-bce9-e1197d801bce?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery","name":"ImagePress \u2013 Front-End Photo Uploads & Member Galleries","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T05:39:39Z"},{"id":"wordfence:3bce9b64-29b4-4eb0-a02e-9f751c88f4be","source":"wordfence","cve":"CVE-2025-60194","title":"Premmerce Product Search for WooCommerce <= 2.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bce9b64-29b4-4eb0-a02e-9f751c88f4be?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-search","name":"Premmerce Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-07-28T00:00:00Z","updated":"2026-02-25T12:52:37Z"},{"id":"wordfence:3bcf9640-ef7e-4cff-ada2-5ddc4261befa","source":"wordfence","cve":"CVE-2026-110020","title":"Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcf9640-ef7e-4cff-ada2-5ddc4261befa?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2026-10-27T17:50:03Z","updated":"2026-10-28T06:45:11Z"},{"id":"wordfence:3bd09891-8117-43b1-8744-8f3773971540","source":"wordfence","cve":"CVE-2025-5530","title":"WPC Smart Compare for WooCommerce <= 6.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd09891-8117-43b1-8744-8f3773971540?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-compare","name":"WPC Smart Compare for WooCommerce","from":"*","from_inclusive":true,"to":"6.4.6","to_inclusive":true,"patched_in":"6.4.7"}],"published":"2025-07-10T18:58:43Z","updated":"2025-07-11T07:23:00Z"},{"id":"wordfence:3bd3e797-5e31-4f54-a28f-2525fb5e367e","source":"wordfence","cve":"CVE-2024-1436","title":"WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 -  Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd3e797-5e31-4f54-a28f-2525fb5e367e?source=api-prod","affected":[{"type":"plugin","slug":"myshopkit-popup-smartbar-slidein","name":"WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T19:44:21Z"},{"id":"wordfence:3bd5652e-1c26-4952-9119-1d7f7eff7d55","source":"wordfence","cve":"CVE-2026-39680","title":"Diet Calorie Calculator <= 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd5652e-1c26-4952-9119-1d7f7eff7d55?source=api-prod","affected":[{"type":"plugin","slug":"diet-calorie-calculator","name":"Diet Calorie Calculator","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-21T00:00:00Z","updated":"2026-04-15T21:28:48Z"},{"id":"wordfence:3bd5c774-2c5b-47d5-9eae-614f2a1b8529","source":"wordfence","cve":"CVE-2022-33978","title":"FontMeister <= 1.08 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd5c774-2c5b-47d5-9eae-614f2a1b8529?source=api-prod","affected":[{"type":"plugin","slug":"fontmeister","name":"FontMeister \u2013 The Font Management Plugin","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":true,"patched_in":""}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bdb73f9-d091-4de7-975c-10090ee1f749","source":"wordfence","cve":"CVE-2014-5204","title":"WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bdb73f9-d091-4de7-975c-10090ee1f749?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bdc076c-bc6d-442b-a1bb-9f3201153eb2","source":"wordfence","cve":"CVE-2025-64630","title":"Business Directory <= 6.4.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bdc076c-bc6d-442b-a1bb-9f3201153eb2?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.19","to_inclusive":true,"patched_in":"6.4.20"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:27:48Z"},{"id":"wordfence:3bdd726e-d67b-4fed-bfa4-6002521942a5","source":"wordfence","cve":"CVE-2026-22485","title":"My Album Gallery <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bdd726e-d67b-4fed-bfa4-6002521942a5?source=api-prod","affected":[{"type":"plugin","slug":"my-album-gallery","name":"My Album Gallery","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:06:10Z"},{"id":"wordfence:3bdeb2a1-ab97-45ff-808e-37e631d5e9cf","source":"wordfence","cve":"CVE-2025-12165","title":"Webcake \u2013 Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bdeb2a1-ab97-45ff-808e-37e631d5e9cf?source=api-prod","affected":[{"type":"plugin","slug":"webcake","name":"Webcake \u2013 Landing Page Builder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-12-04T16:38:45Z","updated":"2025-12-09T17:00:11Z"},{"id":"wordfence:3be0e82c-f9a8-42a5-9abb-24cc60e03944","source":"wordfence","cve":"CVE-2023-2495","title":"Greeklish-permalink <= 3.3 - Missing Authorization via cyrtrans_ajax_old AJAX action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be0e82c-f9a8-42a5-9abb-24cc60e03944?source=api-prod","affected":[{"type":"plugin","slug":"greeklish-permalink","name":"Greeklish-permalink","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.5"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3be1a1af-baab-4e57-a2c7-5e6963f986cc","source":"wordfence","cve":"CVE-2022-3393","title":"Post to CSV by BestWebSoft <= 1.3.8 - Authenticated (Author+) CSV Injection","severity":"medium","cvss":6.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be1a1af-baab-4e57-a2c7-5e6963f986cc?source=api-prod","affected":[{"type":"plugin","slug":"post-to-csv","name":"Post to CSV by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3be36cd6-27a3-4b15-9e43-b1f6c25efae6","source":"wordfence","cve":"CVE-2017-18515","title":"WP Statistics <= 12.0.7 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be36cd6-27a3-4b15-9e43-b1f6c25efae6?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.0.7","to_inclusive":true,"patched_in":"12.0.8"}],"published":"2017-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3be5e544-1ea5-46f6-a15b-99b0e3718c91","source":"wordfence","cve":"CVE-2026-15790","title":"Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be5e544-1ea5-46f6-a15b-99b0e3718c91?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-08-15T17:25:12Z","updated":"2026-08-16T05:27:27Z"},{"id":"wordfence:3be71ddf-bb6f-492f-8d89-d0d850b27233","source":"wordfence","cve":"CVE-2025-22741","title":"Felan Framework <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be71ddf-bb6f-492f-8d89-d0d850b27233?source=api-prod","affected":[{"type":"plugin","slug":"felan-framework","name":"Felan Framework","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:16:08Z"},{"id":"wordfence:3be9ffb4-5614-4a5f-bc2a-38ad626f8e3e","source":"wordfence","cve":"CVE-2023-31228","title":"CM On Demand Search And Replace <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3be9ffb4-5614-4a5f-bc2a-38ad626f8e3e?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bea473d-f97b-4646-9221-deb63e0efe98","source":"wordfence","cve":"CVE-2024-50524","title":"Administrator Z <= 2024.10.14 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bea473d-f97b-4646-9221-deb63e0efe98?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2024.10.14","to_inclusive":true,"patched_in":"2024.10.21"}],"published":"2024-10-30T00:00:00Z","updated":"2025-03-13T19:45:18Z"},{"id":"wordfence:3becd450-b0de-466a-9721-b156a2ba1de3","source":"wordfence","cve":"CVE-2023-23886","title":"WP-RecentComments <= 2.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3becd450-b0de-466a-9721-b156a2ba1de3?source=api-prod","affected":[{"type":"plugin","slug":"wp-recentcomments","name":"WP-RecentComments","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bed2531-1a7d-49d9-91c9-d9e7357e5613","source":"wordfence","cve":"","title":"Erident Custom Login & Dashboard <= 3.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bed2531-1a7d-49d9-91c9-d9e7357e5613?source=api-prod","affected":[{"type":"plugin","slug":"erident-custom-login-and-dashboard","name":"Erident Custom Login Page & Dashboard","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.5"}],"published":"2015-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bee82d8-d019-450b-b532-5b3e2e3aff6f","source":"wordfence","cve":"CVE-2019-19109","title":"wpForo Forum <= 1.6.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bee82d8-d019-450b-b532-5b3e2e3aff6f?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2020-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bef108a-2c68-4347-bf53-559b2d877f6b","source":"wordfence","cve":"CVE-2024-9705","title":"Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bef108a-2c68-4347-bf53-559b2d877f6b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-coming-soon","name":"Ultimate Coming Soon Page, Maintenance Mode & Under Construction \u2013 Gutenberg Block Builder & Landing Page","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-12-05T19:35:06Z","updated":"2024-12-16T10:15:03Z"},{"id":"wordfence:3bf273e0-2afd-4338-896a-16bf50208aba","source":"wordfence","cve":"CVE-2026-110367","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf273e0-2afd-4338-896a-16bf50208aba?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-10-15T17:44:00Z","updated":"2026-10-23T18:18:34Z"},{"id":"wordfence:3bf59f44-356c-4d84-add3-72e8905a80f9","source":"wordfence","cve":"CVE-2019-5963","title":"Zoho SalesIQ <= 1.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf59f44-356c-4d84-add3-72e8905a80f9?source=api-prod","affected":[{"type":"plugin","slug":"zoho-salesiq","name":"Zoho SalesIQ \u2013 Live chat, chatbots, and visitor tracking","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bf6671d-f481-4fe5-b966-2591ab76b0b5","source":"wordfence","cve":"CVE-2025-7684","title":"Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf6671d-f481-4fe5-b966-2591ab76b0b5?source=api-prod","affected":[{"type":"plugin","slug":"lastfm-recent-album-artwork","name":"Last.fm Recent Album Artwork","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:46:26Z","updated":"2025-08-16T03:38:48Z"},{"id":"wordfence:3bf669ed-ea31-4144-96b3-b1f29057b86d","source":"wordfence","cve":"CVE-2023-46081","title":"Lava Directory Manager <= 1.1.34 - Unauthenticated Stored Cross-Site Scripting via New Listing","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf669ed-ea31-4144-96b3-b1f29057b86d?source=api-prod","affected":[{"type":"plugin","slug":"lava-directory-manager","name":"Lava Directory Manager","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bf68449-487d-4ef1-86be-c51dc7d79054","source":"wordfence","cve":"CVE-2022-3894","title":"WP OAuth Server <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (wo_ajax_remove_client)","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf68449-487d-4ef1-86be-c51dc7d79054?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bf76527-9a11-4755-992c-02fbc1a79bae","source":"wordfence","cve":"CVE-2021-4448","title":"Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf76527-9a11-4755-992c-02fbc1a79bae?source=api-prod","affected":[{"type":"plugin","slug":"kaswara","name":"Kaswara Modern VC Addons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-03-19T00:00:00Z","updated":"2024-10-16T06:43:31Z"},{"id":"wordfence:3bf77988-370b-437f-83a0-18a147e3e087","source":"wordfence","cve":"CVE-2023-4944","title":"Awesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf77988-370b-437f-83a0-18a147e3e087?source=api-prod","affected":[{"type":"plugin","slug":"awesome-weather","name":"Awesome Weather Widget","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-13T00:00:00Z","updated":"2024-10-24T18:06:27Z"},{"id":"wordfence:3bf91044-41d8-4587-b35e-2a3efd384f57","source":"wordfence","cve":"CVE-2026-32337","title":"Preschool and Kindergarten <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf91044-41d8-4587-b35e-2a3efd384f57?source=api-prod","affected":[{"type":"theme","slug":"preschool-and-kindergarten","name":"Preschool and Kindergarten","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:46:12Z"},{"id":"wordfence:3bfa2e31-90c4-45b0-a5f8-60037eca2cf3","source":"wordfence","cve":"CVE-2026-103345","title":"Pie Register \u2013 User Registration, Profiles & Content Restriction <= 3.8.4.13 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfa2e31-90c4-45b0-a5f8-60037eca2cf3?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.13","to_inclusive":true,"patched_in":"3.8.4.14"}],"published":"2026-10-01T12:33:00Z","updated":"2026-10-08T23:04:16Z"},{"id":"wordfence:3bfab9cf-4ccb-45fc-83ce-b5250f0f6482","source":"wordfence","cve":"CVE-2026-101935","title":"Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfab9cf-4ccb-45fc-83ce-b5250f0f6482?source=api-prod","affected":[{"type":"plugin","slug":"echo-knowledge-base","name":"Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Search","from":"*","from_inclusive":true,"to":"17.214.0","to_inclusive":true,"patched_in":"17.311.0"}],"published":"2026-10-27T18:45:20Z","updated":"2026-10-28T07:48:29Z"},{"id":"wordfence:3bfafa37-b28f-4951-9741-46046fb11a15","source":"wordfence","cve":"CVE-2025-54750","title":"Funnel Builder by FunnelKit <= 3.11.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfafa37-b28f-4951-9741-46046fb11a15?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:11:46Z"},{"id":"wordfence:3bfb9e92-dd4d-40fb-b339-ed0dbfc6b246","source":"wordfence","cve":"CVE-2025-58622","title":"Mobile Contact Line <= 2.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfb9e92-dd4d-40fb-b339-ed0dbfc6b246?source=api-prod","affected":[{"type":"plugin","slug":"mobile-contact-line","name":"Mobile Contact Line","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:40:28Z"},{"id":"wordfence:3bfc18fa-905c-408f-bbb4-ce207c322298","source":"wordfence","cve":"CVE-2021-24946","title":"Modern Events Calendar Lite <= 6.1.4 - Unauthenticated Blind SQL Injection via time Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfc18fa-905c-408f-bbb4-ce207c322298?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":false,"patched_in":"6.1.5"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3bfde56f-298a-4718-aa48-25ff11f538a3","source":"wordfence","cve":"CVE-2025-30779","title":"Doneren met Mollie <= 2.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfde56f-298a-4718-aa48-25ff11f538a3?source=api-prod","affected":[{"type":"plugin","slug":"doneren-met-mollie","name":"Doneren met Mollie","from":"*","from_inclusive":true,"to":"2.10.7","to_inclusive":true,"patched_in":"2.10.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:30:56Z"},{"id":"wordfence:3bfe1d81-9b0a-4998-8702-173795b8f493","source":"wordfence","cve":"CVE-2025-47489","title":"Beds24 Online Booking <= 2.0.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bfe1d81-9b0a-4998-8702-173795b8f493?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.29","to_inclusive":true,"patched_in":"2.0.30"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:00:35Z"},{"id":"wordfence:3bff5508-7483-4c0e-8146-a157244d6ad2","source":"wordfence","cve":"CVE-2024-1745","title":"Testimonial Slider <= 2.3.6 - Missing Authorization to Authenticated (Author+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3bff5508-7483-4c0e-8146-a157244d6ad2?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-and-showcase","name":"Testimonial \u2013 Testimonial Slider and Showcase Plugin","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2024-03-05T00:00:00Z","updated":"2024-03-18T17:36:04Z"},{"id":"wordfence:3c020d80-b386-40f5-915b-f1d59582c31a","source":"wordfence","cve":"CVE-2025-60146","title":"Map Categories to Pages <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c020d80-b386-40f5-915b-f1d59582c31a?source=api-prod","affected":[{"type":"plugin","slug":"map-categories-to-pages","name":"Map Categories to Pages","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:14:19Z"},{"id":"wordfence:3c021686-3c9d-4382-be5c-9d4bf989cdcd","source":"wordfence","cve":"CVE-2021-24892","title":"Advanced Forms for ACF <= 1.6.8 - Insecure Direct Object Reference","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c021686-3c9d-4382-be5c-9d4bf989cdcd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-forms","name":"Advanced Forms for ACF","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":false,"patched_in":"1.6.9"}],"published":"2020-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c054aba-0da6-4884-a653-d8e13762d038","source":"wordfence","cve":"CVE-2026-39714","title":"G5Plus April <= 6.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c054aba-0da6-4884-a653-d8e13762d038?source=api-prod","affected":[{"type":"theme","slug":"g5plus-april","name":"APRIL - Fashion WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-05T15:50:07Z"},{"id":"wordfence:3c065113-8481-4d84-9027-8eb0514ce61a","source":"wordfence","cve":"CVE-2026-78280","title":"Hash Form \u2013 Drag & Drop Form Builder <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c065113-8481-4d84-9027-8eb0514ce61a?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:10:24Z"},{"id":"wordfence:3c070b9c-5bed-4f9f-8d96-70958bf294cf","source":"wordfence","cve":"CVE-2022-45375","title":"iFeature Slider <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c070b9c-5bed-4f9f-8d96-70958bf294cf?source=api-prod","affected":[{"type":"plugin","slug":"ifeature-slider","name":"iFeature Slider","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c07a2fe-97b1-45ec-bbd9-9353d679ed49","source":"wordfence","cve":"CVE-2023-45108","title":"Mailrelay <= 2.1.1 - Cross-Site Request Forgery via render_admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07a2fe-97b1-45ec-bbd9-9353d679ed49?source=api-prod","affected":[{"type":"plugin","slug":"mailrelay","name":"Mailrelay","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c07dec6-ddb7-45df-8bdf-57f562102c4b","source":"wordfence","cve":"CVE-2026-2987","title":"Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c07dec6-ddb7-45df-8bdf-57f562102c4b?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20260217","to_inclusive":true,"patched_in":"20260301"}],"published":"2026-03-12T00:21:55Z","updated":"2026-03-12T12:26:32Z"},{"id":"wordfence:3c088932-943b-4efc-88e6-0e93dc96eaf4","source":"wordfence","cve":"CVE-2025-66134","title":"FileBird Pro <= 6.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c088932-943b-4efc-88e6-0e93dc96eaf4?source=api-prod","affected":[{"type":"plugin","slug":"filebird-pro","name":"FileBird Pro","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2025-10-25T00:00:00Z","updated":"2026-02-23T21:44:22Z"},{"id":"wordfence:3c0b0bf7-55dd-40a1-8f12-f0ec0315c0ec","source":"wordfence","cve":"CVE-2022-0147","title":"Cookie Information | Free GDPR Consent Solution <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c0b0bf7-55dd-40a1-8f12-f0ec0315c0ec?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-compliance","name":"Cookie Information | Free GDPR Consent Solution","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c0bd6ee-da23-4e1e-9dbc-1ee4a111f7f8","source":"wordfence","cve":"CVE-2019-15822","title":"WPS Child Theme Generator < 1.2 - Directory Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c0bd6ee-da23-4e1e-9dbc-1ee4a111f7f8?source=api-prod","affected":[{"type":"plugin","slug":"wps-child-theme-generator","name":"WPS Child Theme Generator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c0fb43c-f576-412e-a144-4725356ed9a0","source":"wordfence","cve":"CVE-2025-14783","title":"Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect","severity":"medium","cvss":4.3,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c0fb43c-f576-412e-a144-4725356ed9a0?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-12-30T17:50:22Z","updated":"2025-12-31T06:24:43Z"},{"id":"wordfence:3c107916-1de8-46e3-80bf-3e1529533907","source":"wordfence","cve":"CVE-2022-47440","title":"My Tickets <= 1.9.10 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c107916-1de8-46e3-80bf-3e1529533907?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.9.11"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c10df7c-4bca-4ed7-b2ba-1a7f046d814e","source":"wordfence","cve":"CVE-2025-31783","title":"Leartes TRY Exchange Rates <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c10df7c-4bca-4ed7-b2ba-1a7f046d814e?source=api-prod","affected":[{"type":"plugin","slug":"leartes-try-exchange-rates","name":"Leartes TRY Exchange Rates","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-11-03T22:43:23Z"},{"id":"wordfence:3c12074f-9a19-49cb-9d74-b759c7391d3c","source":"wordfence","cve":"CVE-2014-4514","title":"WordPress\u652f\u4ed8\u5b9dAlipay|\u8d22\u4ed8\u901aTenpay|\u8d1d\u5b9dPayPal\u96c6\u6210\u63d2\u4ef6 < 3.7.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12074f-9a19-49cb-9d74-b759c7391d3c?source=api-prod","affected":[{"type":"plugin","slug":"alipay","name":"WordPress\u652f\u4ed8\u5b9dAlipay|\u8d22\u4ed8\u901aTenpay|\u8d1d\u5b9dPayPal\u96c6\u6210\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":false,"patched_in":"3.7.0"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c1250cb-7678-4cbc-97ff-3983e076f516","source":"wordfence","cve":"CVE-2024-51629","title":"Header Footer Composer for Elementor <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1250cb-7678-4cbc-97ff-3983e076f516?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-composer","name":"Header Footer Composer for Elementor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:45:50Z"},{"id":"wordfence:3c12e65c-eedf-4fc2-977a-7a07219ee1c2","source":"wordfence","cve":"CVE-2026-97339","title":"Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c12e65c-eedf-4fc2-977a-7a07219ee1c2?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.5.5","to_inclusive":true,"patched_in":"7.5.6"}],"published":"2026-10-15T15:15:17Z","updated":"2026-10-16T03:38:41Z"},{"id":"wordfence:3c14a863-2aed-4f65-a0e3-eb73e485ce85","source":"wordfence","cve":"CVE-2023-40676","title":"Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c14a863-2aed-4f65-a0e3-eb73e485ce85?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c1814c7-1ca0-42e6-a819-7e258f34ecac","source":"wordfence","cve":"","title":"Mingle Forum <= 1.0.33 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1814c7-1ca0-42e6-a819-7e258f34ecac?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.33.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c182d41-edce-473c-9f20-e480072e06d0","source":"wordfence","cve":"CVE-2025-32523","title":"WooCommerce \u2013 Payphone Gateway <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c182d41-edce-473c-9f20-e480072e06d0?source=api-prod","affected":[{"type":"plugin","slug":"wc-payphone-gateway","name":"Payphone \u2013 Payment Gateway Button","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-02T11:44:48Z"},{"id":"wordfence:3c18d155-9c9d-4ffa-8faa-09bb67406266","source":"wordfence","cve":"CVE-2025-64277","title":"ChatBot <= 7.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c18d155-9c9d-4ffa-8faa-09bb67406266?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"7.3.9","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2025-10-12T00:00:00Z","updated":"2025-11-17T19:10:12Z"},{"id":"wordfence:3c192623-eb46-4f1d-b897-433ac80608cb","source":"wordfence","cve":"CVE-2024-4847","title":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c192623-eb46-4f1d-b897-433ac80608cb?source=api-prod","affected":[{"type":"plugin","slug":"alttext-ai","name":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-05-14T11:58:48Z","updated":"2024-05-15T01:56:54Z"},{"id":"wordfence:3c1a773f-6908-48fc-99d9-a718ee120855","source":"wordfence","cve":"CVE-2025-47465","title":"Blocksy <= 2.0.97 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1a773f-6908-48fc-99d9-a718ee120855?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.97","to_inclusive":true,"patched_in":"2.0.98"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-14T19:59:16Z"},{"id":"wordfence:3c1a7bda-29c5-4b4b-bbd8-71187609892e","source":"wordfence","cve":"CVE-2023-6390","title":"WordPress Users <= 1.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1a7bda-29c5-4b4b-bbd8-71187609892e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-users","name":"WordPress Users","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c1ad419-0767-4e2d-908a-83b57cfa8ed5","source":"wordfence","cve":"CVE-2026-22470","title":"FireStorm Professional Real Estate <= 2.7.11 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1ad419-0767-4e2d-908a-83b57cfa8ed5?source=api-prod","affected":[{"type":"plugin","slug":"fs-real-estate-plugin","name":"FireStorm Professional Real Estate Plugin","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T19:26:20Z"},{"id":"wordfence:3c1db6c6-06fa-467d-8c63-24430a81c241","source":"wordfence","cve":"CVE-2025-62067","title":"Savory <= 2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1db6c6-06fa-467d-8c63-24430a81c241?source=api-prod","affected":[{"type":"theme","slug":"savory","name":"Savory - Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-10-18T00:00:00Z","updated":"2025-10-29T15:12:30Z"},{"id":"wordfence:3c1edb5f-905b-4364-9e1e-9035b951512c","source":"wordfence","cve":"CVE-2024-9709","title":"EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Tournament and Team Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1edb5f-905b-4364-9e1e-9035b951512c?source=api-prod","affected":[{"type":"plugin","slug":"ekc-tournament-manager","name":"EKC Tournament Manager","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-11-14T00:00:00Z","updated":"2025-05-23T15:35:20Z"},{"id":"wordfence:3c1f625e-4456-45e4-8a7f-809b22edb66b","source":"wordfence","cve":"CVE-2025-5746","title":"Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c1f625e-4456-45e4-8a7f-809b22edb66b?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-uploads-wc-pro","name":"Drag and Drop Multiple File Upload (Pro) - WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"drag-and-drop-file-uploads-wc-pro","name":"Drag and Drop Multiple File Upload (Pro) - WooCommerce","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-07-01T14:29:54Z","updated":"2025-08-11T18:00:28Z"},{"id":"wordfence:3c22d064-348d-4335-beaf-22dcdcf88518","source":"wordfence","cve":"CVE-2024-13769","title":"Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c22d064-348d-4335-beaf-22dcdcf88518?source=api-prod","affected":[{"type":"theme","slug":"puzzles","name":"Puzzles | WP Magazine / Review with Store WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-14T14:48:44Z"},{"id":"wordfence:3c25b462-cb9e-4250-bb17-9f2a0bd7665e","source":"wordfence","cve":"CVE-2025-14845","title":"NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c25b462-cb9e-4250-bb17-9f2a0bd7665e?source=api-prod","affected":[{"type":"plugin","slug":"ns-ie-compatibility-fixer","name":"NS Ie Compatibility Fixer","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:32:12Z","updated":"2026-01-07T06:36:01Z"},{"id":"wordfence:3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2","source":"wordfence","cve":"CVE-2024-6753","title":"Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:57Z"},{"id":"wordfence:3c298653-7f79-4ee2-89c8-8a6d0e1446b8","source":"wordfence","cve":"CVE-2025-12448","title":"Smartsupp \u2013 live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c298653-7f79-4ee2-89c8-8a6d0e1446b8?source=api-prod","affected":[{"type":"plugin","slug":"smartsupp-live-chat","name":"Smartsupp \u2013 live chat, AI shopping assistant and chatbots","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:12Z"},{"id":"wordfence:3c2bddb3-2b23-4a75-abe2-db787441a1b2","source":"wordfence","cve":"CVE-2024-53775","title":"DancePress (TRWA) <= 3.1.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c2bddb3-2b23-4a75-abe2-db787441a1b2?source=api-prod","affected":[{"type":"plugin","slug":"dancepress-trwa","name":"DancePress (TRWA)","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:16:32Z"},{"id":"wordfence:3c2e41ba-e37d-47c7-bdcb-f9a3801c045a","source":"wordfence","cve":"CVE-2025-47563","title":"CURCY <= 2.3.7 - Missing Authorization to Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c2e41ba-e37d-47c7-bdcb-f9a3801c045a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multi-currency","name":"CURCY - WooCommerce Multi Currency - Currency Switcher","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T20:21:32Z"},{"id":"wordfence:3c2ecb9d-2496-4bbc-b55e-28fb5df1b397","source":"wordfence","cve":"CVE-2024-37539","title":"WP To Do <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c2ecb9d-2496-4bbc-b55e-28fb5df1b397?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-07-06T00:00:00Z","updated":"2025-08-22T15:26:47Z"},{"id":"wordfence:3c3091eb-a2e7-4fc2-9f5c-5d6d582bbb89","source":"wordfence","cve":"CVE-2021-24526","title":"Form Maker <= 1.13.59 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3091eb-a2e7-4fc2-9f5c-5d6d582bbb89?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.13.59","to_inclusive":true,"patched_in":"1.13.60"}],"published":"2021-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c3192ee-f241-47b2-b10f-fc38f394012a","source":"wordfence","cve":"CVE-2014-8336","title":"WP DB Manager < 2.7.2 - Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3192ee-f241-47b2-b10f-fc38f394012a?source=api-prod","affected":[{"type":"plugin","slug":"wp-dbmanager","name":"WP-DBManager","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2014-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c3217f9-67e5-488d-b80a-49a61678fb98","source":"wordfence","cve":"CVE-2026-15285","title":"The Plus Addons for Elementor <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3217f9-67e5-488d-b80a-49a61678fb98?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.11","to_inclusive":true,"patched_in":"6.4.12"}],"published":"2026-05-21T19:17:28Z","updated":"2026-07-10T04:31:21Z"},{"id":"wordfence:3c32eb5b-dc4b-42f6-8454-d2ad57d7051d","source":"wordfence","cve":"CVE-2022-38971","title":"BuddyForms <= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c32eb5b-dc4b-42f6-8454-d2ad57d7051d?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c3ae044-1433-43b3-8185-03c194cefdbb","source":"wordfence","cve":"CVE-2024-8398","title":"Simple Nav Archives <= 2.1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3ae044-1433-43b3-8185-03c194cefdbb?source=api-prod","affected":[{"type":"plugin","slug":"simple-nav-archives","name":"Simple Nav Archives","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-20T00:00:00Z","updated":"2024-09-24T15:58:35Z"},{"id":"wordfence:3c3df9c2-b481-4233-9ad9-495efcdcb73d","source":"wordfence","cve":"CVE-2025-49931","title":"JetSearch <= 3.5.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c3df9c2-b481-4233-9ad9-495efcdcb73d?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.10","to_inclusive":true,"patched_in":"3.5.10.1"}],"published":"2025-07-17T00:00:00Z","updated":"2025-10-29T19:28:49Z"},{"id":"wordfence:3c434637-4bf9-46ee-9a6d-35eab7ef11a1","source":"wordfence","cve":"CVE-2026-7615","title":"Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c434637-4bf9-46ee-9a6d-35eab7ef11a1?source=api-prod","affected":[{"type":"plugin","slug":"widget-context","name":"Widget Context","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-05-21T19:25:43Z","updated":"2026-05-22T07:50:25Z"},{"id":"wordfence:3c43939f-c0c7-4388-80ae-44bdf67675c7","source":"wordfence","cve":"","title":"WP eCommerce < 3.11.4 - SQL Injection","severity":"high","cvss":8.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c43939f-c0c7-4388-80ae-44bdf67675c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.11.4","to_inclusive":false,"patched_in":"3.11.4"}],"published":"2016-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c45283c-0839-4cad-b7b2-5170e65defca","source":"wordfence","cve":"CVE-2026-39669","title":"NitroPack <= 1.19.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c45283c-0839-4cad-b7b2-5170e65defca?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.19.3","to_inclusive":true,"patched_in":"1.19.4"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-25T15:35:49Z"},{"id":"wordfence:3c455509-9cbb-4a77-b28f-921beeeede0e","source":"wordfence","cve":"CVE-2021-25083","title":"Registrations for the Events Calendar <= 2.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c455509-9cbb-4a77-b28f-921beeeede0e?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":false,"patched_in":"2.7.10"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c457b64-37ad-45aa-8ab0-b3f09bf7de15","source":"wordfence","cve":"CVE-2026-28148","title":"Headless SSO Plugin for WP <= 1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c457b64-37ad-45aa-8ab0-b3f09bf7de15?source=api-prod","affected":[{"type":"plugin","slug":"headless-single-sign-on","name":"Headless SSO Plugin for WP","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-12T00:00:00Z","updated":"2026-09-17T15:44:04Z"},{"id":"wordfence:3c476263-72b7-48f1-8ba3-91d69eae7b6a","source":"wordfence","cve":"","title":"WP User Frontend \u2013 Membership, Profile, Registration & Post Submission Plugin for WordPress < 3.5.25 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c476263-72b7-48f1-8ba3-91d69eae7b6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.5.25","to_inclusive":false,"patched_in":"3.5.25"}],"published":"2021-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c48819a-5ca1-4262-b995-1c4621fcfadc","source":"wordfence","cve":"CVE-2015-9362","title":"Post Connector < 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c48819a-5ca1-4262-b995-1c4621fcfadc?source=api-prod","affected":[{"type":"plugin","slug":"post-connector","name":"Post Connector","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c49c7db-50de-4f1d-acfa-d12a84a42d94","source":"wordfence","cve":"CVE-2011-0740","title":"RSS Feed Reader <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c49c7db-50de-4f1d-acfa-d12a84a42d94?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-reader","name":"RSS Feed Reader","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2011-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c49fa36-f572-4e04-8f92-742af0e93f00","source":"wordfence","cve":"CVE-2025-22350","title":"Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c49fa36-f572-4e04-8f92-742af0e93f00?source=api-prod","affected":[{"type":"plugin","slug":"indeed-learning-pro","name":"Ultimate Learning Pro","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:42:20Z"},{"id":"wordfence:3c4a7aef-09ec-4d17-87d6-f507d64e0afa","source":"wordfence","cve":"CVE-2026-16098","title":"ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c4a7aef-09ec-4d17-87d6-f507d64e0afa?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2026-08-15T16:17:11Z","updated":"2026-08-16T04:24:51Z"},{"id":"wordfence:3c4b35f4-13e9-4406-85ce-6c8d4a13cd75","source":"wordfence","cve":"CVE-2025-68082","title":"Semrush Content Toolkit <= 1.1.32 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c4b35f4-13e9-4406-85ce-6c8d4a13cd75?source=api-prod","affected":[{"type":"plugin","slug":"semrush-contentshake","name":"Semrush Content Toolkit","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-15T18:07:23Z"},{"id":"wordfence:3c4c8113-4c46-4179-9c7f-9d5d4337254d","source":"wordfence","cve":"CVE-2024-0370","title":"Views for WPForms <= 3.2.2 - Missing Authorization via save_view","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c4c8113-4c46-4179-9c7f-9d5d4337254d?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:36:11Z"},{"id":"wordfence:3c51dcd7-0ca4-449b-819c-91de1dacad03","source":"wordfence","cve":"CVE-2024-49236","title":"Crazy Call To Action Box <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c51dcd7-0ca4-449b-819c-91de1dacad03?source=api-prod","affected":[{"type":"plugin","slug":"crazy-call-to-action-box","name":"Crazy Call To Action Box","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-24T18:43:20Z"},{"id":"wordfence:3c52ca89-4f13-41da-bc10-80d212c6219c","source":"wordfence","cve":"CVE-2024-12554","title":"Peter\u2019s Custom Anti-Spam <= 3.2.3 - Cross-Site Request Forgery via cas_register_post Function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c52ca89-4f13-41da-bc10-80d212c6219c?source=api-prod","affected":[{"type":"plugin","slug":"peters-custom-anti-spam-image","name":"Peter\u2019s Custom Anti-Spam","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-12-17T20:49:25Z","updated":"2024-12-18T09:22:40Z"},{"id":"wordfence:3c5349da-90bd-44a8-a61e-acd2c67cca32","source":"wordfence","cve":"CVE-2026-24628","title":"Photo Gallery \u2013 Responsive Image Galleries by Supsystic <= 1.16.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c5349da-90bd-44a8-a61e-acd2c67cca32?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.16.3","to_inclusive":true,"patched_in":"1.17.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-17T00:17:21Z"},{"id":"wordfence:3c545c65-19c0-4566-9db4-4fa2fef3d59a","source":"wordfence","cve":"CVE-2024-49322","title":"Job Board Manager for WordPress <= 1.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c545c65-19c0-4566-9db4-4fa2fef3d59a?source=api-prod","affected":[{"type":"plugin","slug":"jemployee","name":"Job Board Manager for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:50:43Z"},{"id":"wordfence:3c547a2b-98fb-4936-88a5-31e5c879a364","source":"wordfence","cve":"CVE-2022-1564","title":"Form Maker <= 1.14.11 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c547a2b-98fb-4936-88a5-31e5c879a364?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.14.11","to_inclusive":true,"patched_in":"1.14.12"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c55e673-93af-403e-a690-2ae02c63541f","source":"wordfence","cve":"CVE-2024-11432","title":"SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c55e673-93af-403e-a690-2ae02c63541f?source=api-prod","affected":[{"type":"plugin","slug":"suevafree-essential-kit","name":"SuevaFree Essential Kit","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-11-20T13:44:26Z","updated":"2024-11-22T16:01:26Z"},{"id":"wordfence:3c5640b6-f59d-407e-a553-c3834390104f","source":"wordfence","cve":"CVE-2024-51920","title":"Map Store Locator <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c5640b6-f59d-407e-a553-c3834390104f?source=api-prod","affected":[{"type":"plugin","slug":"map-store-location","name":"Map Store Locator","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:42:29Z"},{"id":"wordfence:3c584f15-34ab-4577-a94d-d0976cc06f3a","source":"wordfence","cve":"CVE-2024-52485","title":"WP Menu Image <= 2.2 - Missing Authorization to Unauthenticated Menu Image Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c584f15-34ab-4577-a94d-d0976cc06f3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-menu-image","name":"WP Menu Image","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-17T16:49:30Z"},{"id":"wordfence:3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75","source":"wordfence","cve":"CVE-2024-6434","title":"Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service","severity":"low","cvss":3.1,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c59d95a-b7f1-4a04-bbf4-bab2c42d6d75?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.35","to_inclusive":true,"patched_in":"4.10.36"}],"published":"2024-07-03T00:00:00Z","updated":"2024-07-04T08:32:22Z"},{"id":"wordfence:3c5bde0e-3138-4995-92ae-6deaf6b7be5b","source":"wordfence","cve":"CVE-2023-2716","title":"Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c5bde0e-3138-4995-92ae-6deaf6b7be5b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c601919-4026-4452-9034-b4381fe7c960","source":"wordfence","cve":"CVE-2026-57719","title":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c601919-4026-4452-9034-b4381fe7c960?source=api-prod","affected":[{"type":"plugin","slug":"aimogen-pro","name":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.3.1"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:45:48Z"},{"id":"wordfence:3c61eaf9-a4f7-47a8-8385-ef308d4e194d","source":"wordfence","cve":"CVE-2026-107420","title":"Pay With MetaMask For WooCommerce \u2013 Cryptocurrency Payment Gateway <= 1.7.2 - Unauthenticated Arbitrary Order Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c61eaf9-a4f7-47a8-8385-ef308d4e194d?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-payments-using-metamask-for-woocommerce","name":"Pay With MetaMask For WooCommerce \u2013 Cryptocurrency Payment Gateway","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:38:37Z"},{"id":"wordfence:3c63da0f-4be0-4716-8bde-4f2d4250f4af","source":"wordfence","cve":"CVE-2025-64285","title":"Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c63da0f-4be0-4716-8bde-4f2d4250f4af?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-04-22T00:00:00Z","updated":"2026-02-25T13:00:15Z"},{"id":"wordfence:3c64120f-254f-4deb-93bc-d24e366631ed","source":"wordfence","cve":"","title":"1g-music-share <= 1.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c64120f-254f-4deb-93bc-d24e366631ed?source=api-prod","affected":[{"type":"plugin","slug":"1g-music-share","name":"1g-music-share","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c6841e7-fddf-45b1-9d18-00911325b1d3","source":"wordfence","cve":"CVE-2026-25025","title":"VikRestaurants Table Reservations and Take-Away <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6841e7-fddf-45b1-9d18-00911325b1d3?source=api-prod","affected":[{"type":"plugin","slug":"vikrestaurants","name":"VikRestaurants Table Reservations and Take-Away","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:46:21Z"},{"id":"wordfence:3c6949f9-316c-4e48-a77a-ace793d329ac","source":"wordfence","cve":"CVE-2024-53767","title":"Pixobe Cartography <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6949f9-316c-4e48-a77a-ace793d329ac?source=api-prod","affected":[{"type":"plugin","slug":"pixobe-cartography","name":"Pixobe Cartography","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:21:38Z"},{"id":"wordfence:3c6b80a2-783d-4689-9cba-65f89058958f","source":"wordfence","cve":"CVE-2025-47588","title":"Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.9 - Authenticated (Shop Manager+) Arbitrary Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6b80a2-783d-4689-9cba-65f89058958f?source=api-prod","affected":[{"type":"plugin","slug":"aco-woo-dynamic-pricing","name":"Dynamic Pricing With Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"4.5.10"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:11:10Z"},{"id":"wordfence:3c6bbdcd-9b08-4c17-9a87-e06baa4cca1c","source":"wordfence","cve":"CVE-2021-24346","title":"Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6bbdcd-9b08-4c17-9a87-e06baa4cca1c?source=api-prod","affected":[{"type":"plugin","slug":"stock-in","name":"Stock in & out","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2021-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c6eec02-d67c-417d-a6d6-cbf240de0eee","source":"wordfence","cve":"CVE-2025-26939","title":"Counters Block <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6eec02-d67c-417d-a6d6-cbf240de0eee?source=api-prod","affected":[{"type":"plugin","slug":"counters-block","name":"Counters Block \u2013 Animated Number Counters, Stats & Dynamic KPIs","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:56:09Z"},{"id":"wordfence:3c6f30bb-dec0-4776-b255-bb88c9d003c2","source":"wordfence","cve":"CVE-2025-10186","title":"WhyDonate \u2013 FREE Donate button \u2013 Crowdfunding \u2013 Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6f30bb-dec0-4776-b255-bb88c9d003c2?source=api-prod","affected":[{"type":"plugin","slug":"wp-whydonate","name":"WhyDonate \u2013 FREE Donate button \u2013 Crowdfunding \u2013 Fundraising","from":"*","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"4.0.16"}],"published":"2025-10-14T19:46:25Z","updated":"2025-10-17T20:03:16Z"},{"id":"wordfence:3c6f5ed6-9f73-4da8-8fa0-992d818acc47","source":"wordfence","cve":"CVE-2026-40751","title":"Ashtanga <= 1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6f5ed6-9f73-4da8-8fa0-992d818acc47?source=api-prod","affected":[{"type":"theme","slug":"ashtanga","name":"Ashtanga - Yoga Studio WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:22:35Z"},{"id":"wordfence:3c6fd92f-a541-42d1-8093-c3a4a61ab39b","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.3.66 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c6fd92f-a541-42d1-8093-c3a4a61ab39b?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.3.67","to_inclusive":false,"patched_in":"1.3.67"}],"published":"2017-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c730688-16aa-4593-baa7-4a64f83d88eb","source":"wordfence","cve":"CVE-2024-12737","title":"WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c730688-16aa-4593-baa7-4a64f83d88eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-02-05T00:00:00Z","updated":"2025-03-03T21:02:18Z"},{"id":"wordfence:3c730751-0334-4aca-82ab-3988befd6ccf","source":"wordfence","cve":"CVE-2026-39721","title":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c730751-0334-4aca-82ab-3988befd6ccf?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2026-10-05T09:00:00Z","updated":"2026-10-08T23:38:08Z"},{"id":"wordfence:3c730a69-015a-4b36-aa16-eff6916a302f","source":"wordfence","cve":"","title":"Shop as a Customer for WooCommerce <= 1.2.3 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c730a69-015a-4b36-aa16-eff6916a302f?source=api-prod","affected":[{"type":"plugin","slug":"shop-as-a-customer-for-woocommerce","name":"Shop as a Customer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c731e39-998e-44d2-8cf9-4d9c39731c5d","source":"wordfence","cve":"CVE-2024-1308","title":"WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c731e39-998e-44d2-8cf9-4d9c39731c5d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-cloak-affiliate-links","name":"Cloak Affiliate Links for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.34"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:32:57Z"},{"id":"wordfence:3c73fbbf-ac70-413b-b378-1a93b167aeff","source":"wordfence","cve":"CVE-2025-23838","title":"Bauernregeln <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c73fbbf-ac70-413b-b378-1a93b167aeff?source=api-prod","affected":[{"type":"plugin","slug":"bauernregeln","name":"Bauernregeln","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:26:39Z"},{"id":"wordfence:3c74ea5e-e25a-4b78-b04c-ed66992d4d80","source":"wordfence","cve":"CVE-2015-6238","title":"Google Analyticator <= 6.4.9.5 - Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c74ea5e-e25a-4b78-b04c-ed66992d4d80?source=api-prod","affected":[{"type":"plugin","slug":"google-analyticator","name":"Analyticator","from":"*","from_inclusive":true,"to":"6.4.9.6","to_inclusive":false,"patched_in":"6.4.9.6"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c760235-ee53-4906-9e25-19df85b8f8ff","source":"wordfence","cve":"CVE-2026-104734","title":"Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c760235-ee53-4906-9e25-19df85b8f8ff?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-10-16T14:23:56Z","updated":"2026-10-17T02:31:07Z"},{"id":"wordfence:3c7a192b-25cc-4041-a72b-34fbd697045b","source":"wordfence","cve":"CVE-2025-6730","title":"Bonanza \u2013 WooCommerce Free Gifts Lite <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Opt In Success","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=api-prod","affected":[{"type":"plugin","slug":"bonanza-woocommerce-free-gifts-lite","name":"Bonanza \u2013 WooCommerce Free Gifts Lite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T20:26:18Z","updated":"2025-07-29T09:23:45Z"},{"id":"wordfence:3c7c821e-1359-46e4-ba8b-db3a488f5e36","source":"wordfence","cve":"CVE-2026-81737","title":"FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7c821e-1359-46e4-ba8b-db3a488f5e36?source=api-prod","affected":[{"type":"plugin","slug":"faq-builder-ays","name":"FAQ Builder AYS","from":"1.6.3","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:29:22Z"},{"id":"wordfence:3c7cc2d2-8de4-453b-b4dc-48f75b151078","source":"wordfence","cve":"CVE-2025-2262","title":"Logo Slider <= 3.7.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7cc2d2-8de4-453b-b4dc-48f75b151078?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-18T06:36:25Z"},{"id":"wordfence:3c7d63fc-288b-4f2f-85cd-e94add07a536","source":"wordfence","cve":"CVE-2024-13489","title":"LTL Freight Quotes \u2013 Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7d63fc-288b-4f2f-85cd-e94add07a536?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-odfl-edition","name":"LTL Freight Quotes \u2013 ODFL Edition","from":"*","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"4.2.11"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T09:22:00Z"},{"id":"wordfence:3c830ec2-3b09-448b-b535-b17baf35304c","source":"wordfence","cve":"CVE-2026-106598","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c830ec2-3b09-448b-b535-b17baf35304c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:44:33Z"},{"id":"wordfence:3c833223-c8c9-413f-9d72-6fb13101459b","source":"wordfence","cve":"CVE-2026-0910","title":"wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c833223-c8c9-413f-9d72-6fb13101459b?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.14"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-11T13:25:46Z"},{"id":"wordfence:3c835763-a53f-4447-ac9d-39488535b5fd","source":"wordfence","cve":"CVE-2026-39441","title":"Feed KuantoKusta for WooCommerce \u2013 Free <= 5.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c835763-a53f-4447-ac9d-39488535b5fd?source=api-prod","affected":[{"type":"plugin","slug":"feed-kuantokusta-for-woocommerce","name":"Feed KuantoKusta for WooCommerce \u2013 Free","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T14:39:15Z"},{"id":"wordfence:3c8571b2-9260-4970-89f6-f711574e0f7c","source":"wordfence","cve":"CVE-2025-68500","title":"Prime Slider \u2013 Addons For Elementor <= 4.0.10 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8571b2-9260-4970-89f6-f711574e0f7c?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-12-13T00:00:00Z","updated":"2026-01-05T21:44:22Z"},{"id":"wordfence:3c85fa64-4761-4b92-bd4f-7c220cf18288","source":"wordfence","cve":"CVE-2023-45106","title":"Urvanov Syntax Highlighter <= 2.8.33 - Cross-Site Request Forgery via init_ajax","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c85fa64-4761-4b92-bd4f-7c220cf18288?source=api-prod","affected":[{"type":"plugin","slug":"urvanov-syntax-highlighter","name":"Urvanov Syntax Highlighter","from":"*","from_inclusive":true,"to":"2.8.33","to_inclusive":true,"patched_in":"2.8.34"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c8602ed-6c0d-4357-93e6-bab1ab38ffb2","source":"wordfence","cve":"","title":"Donation Platform for WooCommerce: Fundraising & Donation Management <= 1.2.9 - Cross-Site Request Forgery to Survey Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8602ed-6c0d-4357-93e6-bab1ab38ffb2?source=api-prod","affected":[{"type":"plugin","slug":"wc-donation-platform","name":"Donation Platform for WooCommerce: Fundraising & Donation Management","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":false,"patched_in":"1.2.10"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c86a625-9c2f-4e17-938b-82766783384e","source":"wordfence","cve":"CVE-2025-23988","title":"Ghostwriter <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c86a625-9c2f-4e17-938b-82766783384e?source=api-prod","affected":[{"type":"theme","slug":"ghostwriter","name":"Ghostwriter","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T16:46:33Z"},{"id":"wordfence:3c88033f-d2e8-488c-9e19-ff806a346b57","source":"wordfence","cve":"CVE-2025-39414","title":"spam-stopper <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c88033f-d2e8-488c-9e19-ff806a346b57?source=api-prod","affected":[{"type":"plugin","slug":"spam-stopper","name":"spam-stopper","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:52:38Z"},{"id":"wordfence:3c8ba503-db7e-4ac1-898f-a301854db60f","source":"wordfence","cve":"CVE-2024-2661","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:00Z"},{"id":"wordfence:3c8ed388-657c-4f7b-a3a8-9789b0896457","source":"wordfence","cve":"CVE-2026-14321","title":"Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ed388-657c-4f7b-a3a8-9789b0896457?source=api-prod","affected":[{"type":"plugin","slug":"divi-dash","name":"Divi Dash","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T13:42:33Z"},{"id":"wordfence:3c919e7d-295d-4355-9fa6-ee5ce476cc8d","source":"wordfence","cve":"CVE-2026-62020","title":"TouchUp < 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c919e7d-295d-4355-9fa6-ee5ce476cc8d?source=api-prod","affected":[{"type":"theme","slug":"touchup","name":"TouchUp - Cosmetic and Plastic Surgery WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:30:15Z"},{"id":"wordfence:3c926145-f0b5-44cf-bea6-e9bdf6e8e687","source":"wordfence","cve":"CVE-2022-1563","title":"WPGraphQL WooCommerce <= 0.12.3 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c926145-f0b5-44cf-bea6-e9bdf6e8e687?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql-woocommerce","name":"WPGraphQL WooCommerce","from":"*","from_inclusive":true,"to":"0.12.3","to_inclusive":true,"patched_in":"0.12.4"}],"published":"2022-07-26T00:00:00Z","updated":"2026-02-25T18:37:03Z"},{"id":"wordfence:3c9405f6-5e64-457d-9267-afbc9e159f36","source":"wordfence","cve":"CVE-2025-30804","title":"wpShopGermany IT-RECHT KANZLEI <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9405f6-5e64-457d-9267-afbc9e159f36?source=api-prod","affected":[{"type":"plugin","slug":"wpshopgermany-it-recht-kanzlei","name":"wpShopGermany IT-RECHT KANZLEI","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:24:48Z"},{"id":"wordfence:3c957f3f-fb98-49ff-b317-93b1accd0d47","source":"wordfence","cve":"CVE-2023-34378","title":"WP Hide Post <= 2.0.10 - Cross-Site Request Forgery via save_bulk_edit_data","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c957f3f-fb98-49ff-b317-93b1accd0d47?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-post","name":"WP Hide Post","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3c973dd9-cfa3-4f06-a25a-c2786e3dca4d","source":"wordfence","cve":"CVE-2026-1380","title":"Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c973dd9-cfa3-4f06-a25a-c2786e3dca4d?source=api-prod","affected":[{"type":"plugin","slug":"bitcoin-donate-button","name":"Bitcoin Donate Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:49:55Z","updated":"2026-01-28T11:23:40Z"},{"id":"wordfence:3c98bb53-9f7e-4ab3-9676-e3dbfb4a0519","source":"wordfence","cve":"CVE-2024-7626","title":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c98bb53-9f7e-4ab3-9676-e3dbfb4a0519?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-09-10T00:00:00Z","updated":"2024-09-11T07:31:34Z"},{"id":"wordfence:3c9953b3-dd09-4c80-be11-4daf3bbac720","source":"wordfence","cve":"CVE-2025-4691","title":"Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=api-prod","affected":[{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"*","from_inclusive":true,"to":"1.3.21","to_inclusive":true,"patched_in":"1.3.22"}],"published":"2025-05-30T21:32:30Z","updated":"2025-05-31T11:18:55Z"},{"id":"wordfence:3c99aab5-a995-44ae-bc14-09f73e6b22c5","source":"wordfence","cve":"CVE-2023-2414","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Missing Authorization to Settings Update and Arbitrary File Upload","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c99aab5-a995-44ae-bc14-09f73e6b22c5?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-06-02T00:00:00Z","updated":"2024-11-25T16:24:27Z"},{"id":"wordfence:3c9c41af-0211-4a53-9ef4-b9392b2e9463","source":"wordfence","cve":"CVE-2026-111601","title":"Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9c41af-0211-4a53-9ef4-b9392b2e9463?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2026-10-16T14:24:48Z","updated":"2026-10-17T02:31:06Z"},{"id":"wordfence:3c9cc5d4-7ddc-4af7-b433-7d75db739970","source":"wordfence","cve":"CVE-2024-32596","title":"DSGVO Youtube <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9cc5d4-7ddc-4af7-b433-7d75db739970?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-youtube","name":"DSGVO Youtube","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:42:33Z"},{"id":"wordfence:3c9de67e-24f7-4c4a-b187-405597b838c3","source":"wordfence","cve":"CVE-2025-15283","title":"Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9de67e-24f7-4c4a-b187-405597b838c3?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.30.3","to_inclusive":true,"patched_in":"1.31.0"}],"published":"2026-01-13T17:22:07Z","updated":"2026-02-03T11:25:03Z"},{"id":"wordfence:3ca33a74-6deb-4b6e-b326-31a4f48b101f","source":"wordfence","cve":"CVE-2025-31396","title":"FLAP - Business WordPress Theme <= 1.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ca33a74-6deb-4b6e-b326-31a4f48b101f?source=api-prod","affected":[{"type":"theme","slug":"flap","name":"FLAP - Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:56:47Z"},{"id":"wordfence:3ca6605f-7c9c-43c7-ae32-ca1d781c1e86","source":"wordfence","cve":"CVE-2020-7047","title":"WP Database Reset <= 3.1 - Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ca6605f-7c9c-43c7-ae32-ca1d781c1e86?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-database-reset","name":"Database Reset","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.15"}],"published":"2020-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ca760ea-e062-413e-ac92-520922129937","source":"wordfence","cve":"","title":"Form Builder | Create Responsive Contact Forms <= 1.9.8.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ca760ea-e062-413e-ac92-520922129937?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-add","name":"Form Builder | Create Responsive Contact Forms","from":"*","from_inclusive":true,"to":"1.9.8.4","to_inclusive":true,"patched_in":"1.9.8.5"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cad7928-dbbd-4c64-a409-2f1f5302ff1a","source":"wordfence","cve":"CVE-2024-51908","title":"Adventure Bucket List <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cad7928-dbbd-4c64-a409-2f1f5302ff1a?source=api-prod","affected":[{"type":"plugin","slug":"adventure-bucket-list","name":"Adventure Bucket List","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:35:02Z"},{"id":"wordfence:3cb03d81-ac33-487b-bf4d-927e8104866e","source":"wordfence","cve":"CVE-2024-10871","title":"Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb03d81-ac33-487b-bf4d-927e8104866e?source=api-prod","affected":[{"type":"plugin","slug":"category-ajax-filter","name":"Category AJAX Filter \u2013 Posts, Custom Post Types & Product Filter","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T07:35:03Z"},{"id":"wordfence:3cb047d0-0056-432c-bae3-3ab926e39bcd","source":"wordfence","cve":"CVE-2024-11374","title":"TWChat \u2013 Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb047d0-0056-432c-bae3-3ab926e39bcd?source=api-prod","affected":[{"type":"plugin","slug":"twchat","name":"TWChat \u2013 Send or receive messages from users","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:18:43Z","updated":"2024-12-07T09:27:04Z"},{"id":"wordfence:3cb30d2b-84f2-433e-bb9e-713486b759ae","source":"wordfence","cve":"CVE-2015-8353","title":"Role Scoper (Obsolete \u2013 Please install PublishPress Permissions) < 1.3.67 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb30d2b-84f2-433e-bb9e-713486b759ae?source=api-prod","affected":[{"type":"plugin","slug":"role-scoper","name":"Role Scoper (Obsolete \u2013 Please install PublishPress Permissions)","from":"*","from_inclusive":true,"to":"1.3.67","to_inclusive":false,"patched_in":"1.3.67"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cb73d5d-ca4a-4103-866d-f7bb369a8ce4","source":"wordfence","cve":"CVE-2024-0685","title":"Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb73d5d-ca4a-4103-866d-f7bb369a8ce4?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2024-02-01T00:00:00Z","updated":"2024-07-29T21:36:11Z"},{"id":"wordfence:3cb809c9-7167-4333-969f-0141c96342bd","source":"wordfence","cve":"CVE-2024-12413","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb809c9-7167-4333-969f-0141c96342bd?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.0.00","to_inclusive":true,"patched_in":"2.0.25"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T03:21:32Z"},{"id":"wordfence:3cb84ba3-b403-4a9d-b1a7-92aa947310ac","source":"wordfence","cve":"CVE-2026-1666","title":"Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb84ba3-b403-4a9d-b1a7-92aa947310ac?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.46","to_inclusive":true,"patched_in":"3.3.47"}],"published":"2026-02-17T17:51:30Z","updated":"2026-02-18T06:42:41Z"},{"id":"wordfence:3cb869dd-c8cf-4849-a13f-6c8cf1c196b6","source":"wordfence","cve":"CVE-2026-12124","title":"PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb869dd-c8cf-4849-a13f-6c8cf1c196b6?source=api-prod","affected":[{"type":"plugin","slug":"pdfdraft","name":"PDFDraft \u2013 Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-07-27T16:42:46Z","updated":"2026-07-28T05:39:41Z"},{"id":"wordfence:3cb8b08c-a028-48bd-acad-c00313fe06b8","source":"wordfence","cve":"CVE-2024-1091","title":"ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb8b08c-a028-48bd-acad-c00313fe06b8?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:43:17Z"},{"id":"wordfence:3cb95e28-449b-4ed7-9c44-ade171e0ecee","source":"wordfence","cve":"CVE-2013-7479","title":"Events Manager < 5.3.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb95e28-449b-4ed7-9c44-ade171e0ecee?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":false,"patched_in":"5.3.9"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cba908f-c7e3-4b4f-be73-8682fa1f231b","source":"wordfence","cve":"CVE-2026-32395","title":"Xpro Addons For Beaver Builder \u2013 Lite <= 1.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cba908f-c7e3-4b4f-be73-8682fa1f231b?source=api-prod","affected":[{"type":"plugin","slug":"xpro-addons-beaver-builder-elementor","name":"Xpro Addons For Beaver Builder \u2013 Lite","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T21:11:53Z"},{"id":"wordfence:3cbd58da-3d72-4b8c-add9-c38afc6fa3d0","source":"wordfence","cve":"CVE-2026-25320","title":"FormsDB \u2013 Save Elementor Forms to Google Sheets & Post Type <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cbd58da-3d72-4b8c-add9-c38afc6fa3d0?source=api-prod","affected":[{"type":"plugin","slug":"sb-elementor-contact-form-db","name":"FormsDB \u2013 Save Elementor Forms to Google Sheets & Post Type","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-01-28T00:00:00Z","updated":"2026-05-04T15:24:01Z"},{"id":"wordfence:3cbef3f3-d85a-43a2-b208-73381b801649","source":"wordfence","cve":"CVE-2026-28031","title":"Invetex <= 2.18 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cbef3f3-d85a-43a2-b208-73381b801649?source=api-prod","affected":[{"type":"theme","slug":"invetex","name":"Invetex","from":"*","from_inclusive":true,"to":"2.18","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:33:01Z"},{"id":"wordfence:3cbf52b0-4c7f-40fb-aedb-4c70f6510b1b","source":"wordfence","cve":"CVE-2024-7411","title":"Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cbf52b0-4c7f-40fb-aedb-4c70f6510b1b?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"4.9.9.1"}],"published":"2024-08-14T18:55:15Z","updated":"2024-08-15T07:32:36Z"},{"id":"wordfence:3cbf77f4-59f5-49cd-ba2b-dc9de3d031b6","source":"wordfence","cve":"CVE-2026-28143","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cbf77f4-59f5-49cd-ba2b-dc9de3d031b6?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.56.0","to_inclusive":true,"patched_in":"1.56.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:24:31Z"},{"id":"wordfence:3cc07f65-ff24-4fc7-b885-fd4b17643cca","source":"wordfence","cve":"CVE-2026-84261","title":"click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc07f65-ff24-4fc7-b885-fd4b17643cca?source=api-prod","affected":[{"type":"plugin","slug":"cf7-add-on-by-click5","name":"click5 CRM add-on to Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:12:57Z"},{"id":"wordfence:3cc196c8-1f8f-4ddd-9f27-45d318895b91","source":"wordfence","cve":"CVE-2010-4747","title":"WordPress Processing Embed <= 0.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc196c8-1f8f-4ddd-9f27-45d318895b91?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-processing-embed","name":"WordPress Processing Embed","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":""}],"published":"2010-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cc23af6-c7a6-4f10-89ab-34a0b462b325","source":"wordfence","cve":"CVE-2024-13097","title":"WP Finance <= 1.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc23af6-c7a6-4f10-89ab-34a0b462b325?source=api-prod","affected":[{"type":"plugin","slug":"wp-finance","name":"WP Finance","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-20T16:07:00Z"},{"id":"wordfence:3cc4a11a-7562-44e7-ac8e-770c4e39e2c7","source":"wordfence","cve":"CVE-2026-39598","title":"Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc4a11a-7562-44e7-ac8e-770c4e39e2c7?source=api-prod","affected":[{"type":"plugin","slug":"academy-pro","name":"Academy LMS Pro","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":false,"patched_in":"3.5.2"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:27:47Z"},{"id":"wordfence:3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53","source":"wordfence","cve":"CVE-2026-16774","title":"WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.9","to_inclusive":true,"patched_in":"8.6.0"}],"published":"2026-07-27T23:29:21Z","updated":"2026-07-28T11:32:47Z"},{"id":"wordfence:3cccfdcc-643c-4330-b345-aca4025e3327","source":"wordfence","cve":"CVE-2024-31366","title":"Post Type Builder < 2.1.4 - Missing Authorization to Arbitrary Post/Page Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cccfdcc-643c-4330-b345-aca4025e3327?source=api-prod","affected":[{"type":"plugin","slug":"themify-ptb","name":"Post Type Builder","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2024-04-09T00:00:00Z","updated":"2026-02-26T14:55:08Z"},{"id":"wordfence:3ccd3504-5663-48cd-90bc-502c2ce232f7","source":"wordfence","cve":"CVE-2024-11034","title":"Request a Quote for WooCommerce and Elementor \u2013 Get a Quote Button \u2013 Product Enquiry Form Popup \u2013 Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ccd3504-5663-48cd-90bc-502c2ce232f7?source=api-prod","affected":[{"type":"plugin","slug":"get-a-quote-button-for-woocommerce","name":"Request a Quote for WooCommerce \u2013 Get a Quote Button","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-11-22T21:43:43Z","updated":"2024-11-23T11:23:16Z"},{"id":"wordfence:3ccd7144-fde1-4ade-ac66-5ea14cdbc616","source":"wordfence","cve":"CVE-2021-38328","title":"Notices <= 6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ccd7144-fde1-4ade-ac66-5ea14cdbc616?source=api-prod","affected":[{"type":"plugin","slug":"notices","name":"Notices","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ccd7300-f22a-405a-8087-9c750cb187a5","source":"wordfence","cve":"","title":"InBoundio Marketing < 2.0.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ccd7300-f22a-405a-8087-9c750cb187a5?source=api-prod","affected":[{"type":"plugin","slug":"inboundio-marketing","name":"InBoundio Marketing","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2015-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cd02dbc-6725-4626-844b-df12bad9da37","source":"wordfence","cve":"","title":"Relevanssi \u2013 A Better Search < 4.14.6 & Relevanssi \u2013 A Better Search Pro < 2.16.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd02dbc-6725-4626-844b-df12bad9da37?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.16.5","to_inclusive":false,"patched_in":"2.16.5"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.14.6","to_inclusive":false,"patched_in":"4.14.6"}],"published":"2022-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cd2b2ba-c4ec-4799-91b4-b38c462baee4","source":"wordfence","cve":"CVE-2023-48751","title":"Participants Database <= 2.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd2b2ba-c4ec-4799-91b4-b38c462baee4?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cd7be2c-9ba9-4d25-8907-610898df5834","source":"wordfence","cve":"CVE-2026-6728","title":"Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd7be2c-9ba9-4d25-8907-610898df5834?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"6.0","from_inclusive":true,"to":"6.7.54","to_inclusive":true,"patched_in":"6.7.55"},{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0","from_inclusive":true,"to":"7.0.9","to_inclusive":true,"patched_in":"6.7.55"}],"published":"2026-05-19T20:43:07Z","updated":"2026-05-21T15:51:10Z"},{"id":"wordfence:3cd81614-6f09-44ae-937a-694364ae2aba","source":"wordfence","cve":"CVE-2025-32925","title":"SUMO Reward Points <= 30.7.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd81614-6f09-44ae-937a-694364ae2aba?source=api-prod","affected":[{"type":"plugin","slug":"rewardsystem","name":"SUMO Reward Points for WooCommerce","from":"*","from_inclusive":true,"to":"30.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:08:45Z"},{"id":"wordfence:3cd8bed0-fcfe-4927-b393-ddabbe8c3e6b","source":"wordfence","cve":"CVE-2025-8388","title":"PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd8bed0-fcfe-4927-b393-ddabbe8c3e6b?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-10T04:22:38Z"},{"id":"wordfence:3cd9569f-3cda-4482-8ccd-c3f362b4e651","source":"wordfence","cve":"CVE-2024-2508","title":"WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd9569f-3cda-4482-8ccd-c3f362b4e651?source=api-prod","affected":[{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.4.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2024-07-30T00:00:00Z","updated":"2024-07-31T08:30:10Z"},{"id":"wordfence:3cdad887-dafa-4cf8-ac78-87b9b9b989e2","source":"wordfence","cve":"CVE-2024-13432","title":"Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cdad887-dafa-4cf8-ac78-87b9b9b989e2?source=api-prod","affected":[{"type":"plugin","slug":"webcamconsult","name":"Webcamconsult","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-01-17T18:53:04Z","updated":"2025-01-18T07:05:06Z"},{"id":"wordfence:3cde6acf-8ef7-4eae-a10d-5a18fcf29799","source":"wordfence","cve":"CVE-2025-31085","title":"xili-language <= 2.21.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cde6acf-8ef7-4eae-a10d-5a18fcf29799?source=api-prod","affected":[{"type":"plugin","slug":"xili-language","name":"xili-language","from":"*","from_inclusive":true,"to":"2.21.2","to_inclusive":true,"patched_in":"2.21.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:56:41Z"},{"id":"wordfence:3cdf6ba0-2866-4347-8518-bb1d2e40bab3","source":"wordfence","cve":"CVE-2025-13621","title":"dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cdf6ba0-2866-4347-8518-bb1d2e40bab3?source=api-prod","affected":[{"type":"plugin","slug":"dream-gallery","name":"dream gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:28:00Z","updated":"2025-12-05T05:31:22Z"},{"id":"wordfence:3ce0fece-a7e5-4d27-a70a-37ab0973c15f","source":"wordfence","cve":"CVE-2022-1709","title":"Throws SPAM Away <= 3.3 - Cross-Site Request Forgery to Comment Modification","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce0fece-a7e5-4d27-a70a-37ab0973c15f?source=api-prod","affected":[{"type":"plugin","slug":"throws-spam-away","name":"Throws SPAM Away","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":false,"patched_in":"3.3.1"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ce58796-98af-414c-a63e-3cf92ed293bd","source":"wordfence","cve":"CVE-2026-66589","title":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More <= 5.2.30 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce58796-98af-414c-a63e-3cf92ed293bd?source=api-prod","affected":[{"type":"plugin","slug":"b2bking-wholesale-for-woocommerce","name":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More","from":"*","from_inclusive":true,"to":"5.2.30","to_inclusive":true,"patched_in":"5.2.40"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:15:01Z"},{"id":"wordfence:3ce95a04-11bd-488e-ad25-1b661e083eb2","source":"wordfence","cve":"CVE-2025-5821","title":"Case Theme User <= 1.0.3 - Authentication Bypass via Social Login","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce95a04-11bd-488e-ad25-1b661e083eb2?source=api-prod","affected":[{"type":"plugin","slug":"case-theme-user","name":"Case Theme User","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-08-22T18:31:18Z","updated":"2025-09-11T15:15:28Z"},{"id":"wordfence:3ce9752d-da9c-4605-8444-21c9668a8cbd","source":"wordfence","cve":"CVE-2025-69072","title":"Prider <= 1.1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ce9752d-da9c-4605-8444-21c9668a8cbd?source=api-prod","affected":[{"type":"theme","slug":"prider","name":"Prider | LGBT & Gay Rights Festival WordPress Theme + Bar","from":"*","from_inclusive":true,"to":"1.1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:32:11Z"},{"id":"wordfence:3cea044c-3117-4722-a696-5b7368d31d63","source":"wordfence","cve":"CVE-2022-4142","title":"WordPress Filter Gallery Plugin <= 0.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cea044c-3117-4722-a696-5b7368d31d63?source=api-prod","affected":[{"type":"plugin","slug":"filter-gallery","name":"Filter Gallery","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":"0.1.6"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ceae1e5-49d6-4591-b756-594ac8e701ff","source":"wordfence","cve":"CVE-2026-84225","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer 6.0.0 - 6.2.5 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ceae1e5-49d6-4591-b756-594ac8e701ff?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.0.0","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:02Z"},{"id":"wordfence:3cec3799-cf44-412b-8590-b8fc60c58535","source":"wordfence","cve":"CVE-2018-0588","title":"Ultimate Member <= 2.0.39 - Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cec3799-cf44-412b-8590-b8fc60c58535?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.40"}],"published":"2018-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cf00aef-427b-4256-9cbd-83c8e5059ecf","source":"wordfence","cve":"CVE-2012-5868","title":"WordPress Core < 4.0 - Missing Session Cookie Expiration","severity":"medium","cvss":5.4,"cwe":"CWE-613","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf00aef-427b-4256-9cbd-83c8e5059ecf?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2012-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cf1983b-4cb7-4738-9f19-2c530a9939e0","source":"wordfence","cve":"CVE-2025-4970","title":"BSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf1983b-4cb7-4738-9f19-2c530a9939e0?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-12T07:20:35Z"},{"id":"wordfence:3cf2013a-d403-456f-aeb4-46b6e00b057f","source":"wordfence","cve":"CVE-2023-1166","title":"Social Media Share Buttons & Social Sharing Icons <= 2.8.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf2013a-d403-456f-aeb4-46b6e00b057f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cf26716-70b6-4e5e-9ac1-764060be2215","source":"wordfence","cve":"CVE-2025-3429","title":"3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf26716-70b6-4e5e-9ac1-764060be2215?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.1.3.6","to_inclusive":true,"patched_in":"2.1.3.7"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:01:02Z"},{"id":"wordfence:3cf369f9-dfde-4df7-983f-0dfea85e1b99","source":"wordfence","cve":"CVE-2025-43836","title":"Syndicate Out <= 0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf369f9-dfde-4df7-983f-0dfea85e1b99?source=api-prod","affected":[{"type":"plugin","slug":"syndicate-out","name":"Syndicate Out","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-29T00:00:00Z","updated":"2025-05-05T18:13:32Z"},{"id":"wordfence:3cf570e4-7cae-4adc-ac3e-84225d74da39","source":"wordfence","cve":"","title":"Email Log <= 2.2.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf570e4-7cae-4adc-ac3e-84225d74da39?source=api-prod","affected":[{"type":"plugin","slug":"email-log","name":"Email Log","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2017-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cf99153-e278-415d-958e-facfd8583c2f","source":"wordfence","cve":"CVE-2026-94676","title":"Tainacan <= 1.3.0 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf99153-e278-415d-958e-facfd8583c2f?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-10-08T13:04:47Z","updated":"2026-10-13T14:46:35Z"},{"id":"wordfence:3cfd8b2d-cf2a-439d-9f9a-dbe499b1cd48","source":"wordfence","cve":"CVE-2023-47838","title":"Conditional Fields for Contact Form 7 <= 2.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cfd8b2d-cf2a-439d-9f9a-dbe499b1cd48?source=api-prod","affected":[{"type":"plugin","slug":"cf7-conditional-fields","name":"Conditional Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3cfec2b8-1df0-4f3f-b6cc-ed0adecaeb16","source":"wordfence","cve":"CVE-2022-1885","title":"Cimy Header Image Rotator <= 6.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3cfec2b8-1df0-4f3f-b6cc-ed0adecaeb16?source=api-prod","affected":[{"type":"plugin","slug":"cimy-header-image-rotator","name":"Cimy Header Image Rotator","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d0114d9-de95-444b-9820-e775bff32d53","source":"wordfence","cve":"CVE-2025-27361","title":"Photo Express for Google <= 0.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0114d9-de95-444b-9820-e775bff32d53?source=api-prod","affected":[{"type":"plugin","slug":"photo-express-for-google","name":"Photo Express for Google","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:30:29Z"},{"id":"wordfence:3d015c7d-bace-4d00-8ba5-1c85acb08d57","source":"wordfence","cve":"CVE-2016-11003","title":"Bloom Email Opt-In  < 1.1.1 - Sensitive Information Disclosure","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d015c7d-bace-4d00-8ba5-1c85acb08d57?source=api-prod","affected":[{"type":"plugin","slug":"bloom","name":"Bloom Email Opt-In","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2016-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d01a40f-0af4-454c-9148-70804d571365","source":"wordfence","cve":"CVE-2024-1330","title":"Kadence Blocks Pro <= 2.3.7 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d01a40f-0af4-454c-9148-70804d571365?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks-pro","name":"Kadence Blocks Pro","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-06-06T00:00:00Z","updated":"2024-07-01T20:02:10Z"},{"id":"wordfence:3d03cecc-8788-4e81-9b01-42539eba88f7","source":"wordfence","cve":"CVE-2025-48254","title":"Change Add to Cart Button Text for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d03cecc-8788-4e81-9b01-42539eba88f7?source=api-prod","affected":[{"type":"plugin","slug":"add-to-cart-button-labels-for-woocommerce","name":"Change Add to Cart Button Text for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T20:55:42Z"},{"id":"wordfence:3d065c2a-da7d-469a-b57d-f2fd5b760ff4","source":"wordfence","cve":"CVE-2024-11252","title":"Social Sharing Plugin \u2013 Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d065c2a-da7d-469a-b57d-f2fd5b760ff4?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.69","to_inclusive":true,"patched_in":"3.3.70"}],"published":"2024-11-29T16:31:05Z","updated":"2024-11-30T05:41:13Z"},{"id":"wordfence:3d066dea-5a7a-4944-9c6b-a30affd324fa","source":"wordfence","cve":"CVE-2025-68574","title":"WPBakery Visual Composer WHMCS Elements <= 1.0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d066dea-5a7a-4944-9c6b-a30affd324fa?source=api-prod","affected":[{"type":"plugin","slug":"void-visual-whmcs-element","name":"Innovs WPBakery Visual Composer WHMCS Elements","from":"*","from_inclusive":true,"to":"1.0.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-05T18:53:08Z"},{"id":"wordfence:3d0a709e-1514-43dd-8719-e9bdfdc610d2","source":"wordfence","cve":"","title":"NMI Gateway For WooCommerce <= 1.6.11 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0a709e-1514-43dd-8719-e9bdfdc610d2?source=api-prod","affected":[{"type":"plugin","slug":"woo-nmi-three-step","name":"NMI Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d0afaca-e58a-4b20-97ba-0125648a269b","source":"wordfence","cve":"CVE-2025-23664","title":"Real Seguro Viagem <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0afaca-e58a-4b20-97ba-0125648a269b?source=api-prod","affected":[{"type":"plugin","slug":"seguro-viagem","name":"Real Seguro Viagem","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-11T20:43:54Z"},{"id":"wordfence:3d0bf4d1-ba07-4204-bb2b-cdee10e6a275","source":"wordfence","cve":"CVE-2018-5212","title":"Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0bf4d1-ba07-4204-bb2b-cdee10e6a275?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":false,"patched_in":"3.5.4"}],"published":"2018-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d0d2398-4882-4f07-8259-af7a9b724526","source":"wordfence","cve":"CVE-2025-32210","title":"CM Registration and Invitation Codes <= 2.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0d2398-4882-4f07-8259-af7a9b724526?source=api-prod","affected":[{"type":"plugin","slug":"cm-invitation-codes","name":"CM Registration \u2013 Tailored tool for seamless login and invitation-based registrations","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2025-04-07T00:00:00Z","updated":"2025-09-30T13:52:03Z"},{"id":"wordfence:3d0d4680-4e86-42a7-a045-0663d1d9830b","source":"wordfence","cve":"CVE-2025-32240","title":"Site Notify <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0d4680-4e86-42a7-a045-0663d1d9830b?source=api-prod","affected":[{"type":"plugin","slug":"site-notify","name":"Site Notify","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-08T00:00:00Z","updated":"2025-04-15T13:10:30Z"},{"id":"wordfence:3d0da23a-12e6-4e57-8413-dc86a62b1800","source":"wordfence","cve":"CVE-2024-11190","title":"jwp-a11y <= 4.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0da23a-12e6-4e57-8413-dc86a62b1800?source=api-prod","affected":[{"type":"plugin","slug":"jwp-a11y","name":"jwp-a11y","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T00:00:00Z","updated":"2024-12-12T19:15:43Z"},{"id":"wordfence:3d0e1007-396b-4b57-be16-6fa7fe87d92c","source":"wordfence","cve":"CVE-2024-44016","title":"Podiant <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0e1007-396b-4b57-be16-6fa7fe87d92c?source=api-prod","affected":[{"type":"plugin","slug":"podiant","name":"Podiant","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:34:48Z"},{"id":"wordfence:3d0ecffe-8543-4d82-a1cc-f2474499f373","source":"wordfence","cve":"CVE-2024-5600","title":"Happy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0ecffe-8543-4d82-a1cc-f2474499f373?source=api-prod","affected":[{"type":"plugin","slug":"happy-scss-compiler","name":"SCSS Happy Compiler \u2013 Compile SCSS to CSS & Automatic Enqueue","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T08:33:06Z"},{"id":"wordfence:3d0efe1d-69ad-483c-b200-38873f88433b","source":"wordfence","cve":"CVE-2023-25989","title":"Meks Smart Social Widget <= 1.6 - Cross-Site Request Forgery via meks_remove_notification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0efe1d-69ad-483c-b200-38873f88433b?source=api-prod","affected":[{"type":"plugin","slug":"meks-audio-player","name":"Meks Audio Player","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"},{"type":"plugin","slug":"meks-simple-flickr-widget","name":"Meks Simple Flickr Widget","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"},{"type":"plugin","slug":"meks-easy-instagram-widget","name":"Meks Easy Photo Feed Widget","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"meks-easy-ads-widget","name":"Meks Easy Ads Widget","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"},{"type":"plugin","slug":"meks-themeforest-smart-widget","name":"Meks ThemeForest Smart Widget","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"},{"type":"plugin","slug":"meks-easy-maps","name":"Meks Easy Maps","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"},{"type":"plugin","slug":"meks-smart-author-widget","name":"Meks Smart Author Widget","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"meks-time-ago","name":"Meks Time Ago","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"plugin","slug":"meks-video-importer","name":"Meks Video Importer","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"},{"type":"plugin","slug":"meks-smart-social-widget","name":"Meks Smart Social Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d0f5e62-aa81-4a2e-8187-917391548a31","source":"wordfence","cve":"CVE-2014-4526","title":"efence <= 1.3.2 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0f5e62-aa81-4a2e-8187-917391548a31?source=api-prod","affected":[{"type":"plugin","slug":"efence","name":"efence","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d10d7b5-1995-483a-8502-74bc912f6b0e","source":"wordfence","cve":"CVE-2026-32548","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d10d7b5-1995-483a-8502-74bc912f6b0e?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:15:48Z"},{"id":"wordfence:3d12b88b-d58f-4a37-8de4-aec66b5108a1","source":"wordfence","cve":"CVE-2026-97261","title":"Notivo Notification for WooCommerce <= 1.4.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d12b88b-d58f-4a37-8de4-aec66b5108a1?source=api-prod","affected":[{"type":"plugin","slug":"woo-notification","name":"Notivo Notification for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:43:49Z"},{"id":"wordfence:3d12d692-231b-4e15-a119-80fd74566af4","source":"wordfence","cve":"","title":"Webmention <= 4.0.8 - Reflected Cross-Site Scripting via 'replytocom'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d12d692-231b-4e15-a119-80fd74566af4?source=api-prod","affected":[{"type":"plugin","slug":"webmention","name":"Webmention","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d13454c-0c46-4b16-8e0e-bbfcf2338230","source":"wordfence","cve":"CVE-2023-6956","title":"EasyAzon \u2013 Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d13454c-0c46-4b16-8e0e-bbfcf2338230?source=api-prod","affected":[{"type":"plugin","slug":"easyazon","name":"EasyAzon \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-29T21:36:12Z"},{"id":"wordfence:3d1513b5-4c52-4987-a468-c513f4e5d190","source":"wordfence","cve":"CVE-2025-47685","title":"Contribuinte Checkout <= 2.0.03 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1513b5-4c52-4987-a468-c513f4e5d190?source=api-prod","affected":[{"type":"plugin","slug":"contribuinte-checkout","name":"Contribuinte Checkout","from":"*","from_inclusive":true,"to":"2.0.03","to_inclusive":true,"patched_in":"2.0.04"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-21T13:43:39Z"},{"id":"wordfence:3d16e4a9-c8d3-49af-ac1f-1857f4b30d73","source":"wordfence","cve":"CVE-2025-66077","title":"Legal Pages <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d16e4a9-c8d3-49af-ac1f-1857f4b30d73?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-11-21T00:00:00Z","updated":"2025-11-25T16:04:25Z"},{"id":"wordfence:3d18099c-03e6-4a90-88ed-099451a221c0","source":"wordfence","cve":"CVE-2025-68065","title":"Hub Core <= 5.0.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d18099c-03e6-4a90-88ed-099451a221c0?source=api-prod","affected":[{"type":"plugin","slug":"hub-core","name":"Hub Core","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-20T20:26:48Z"},{"id":"wordfence:3d18fa5a-100f-4dcf-8571-d826c94d173a","source":"wordfence","cve":"CVE-2026-39642","title":"Nyla <= 1.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d18fa5a-100f-4dcf-8571-d826c94d173a?source=api-prod","affected":[{"type":"theme","slug":"nyla","name":"Nyla - A Fresh & Modern WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:50:06Z"},{"id":"wordfence:3d191211-d02b-4808-8d92-c9a906117cde","source":"wordfence","cve":"CVE-2026-25403","title":"Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d191211-d02b-4808-8d92-c9a906117cde?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:48:37Z"},{"id":"wordfence:3d1c009c-0c96-473b-821d-e9c0f9708093","source":"wordfence","cve":"CVE-2026-115277","title":"User Frontend <= 4.3.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1c009c-0c96-473b-821d-e9c0f9708093?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:25:37Z"},{"id":"wordfence:3d1c7383-ac3b-48b3-aaea-729a36e77ff5","source":"wordfence","cve":"CVE-2025-14484","title":"Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1c7383-ac3b-48b3-aaea-729a36e77ff5?source=api-prod","affected":[{"type":"plugin","slug":"image-buzz","name":"Image Buzz","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-21T19:38:18Z","updated":"2026-09-22T07:41:10Z"},{"id":"wordfence:3d1cbf17-11ec-4de6-879f-9ca8d53f3e91","source":"wordfence","cve":"CVE-2016-20081","title":"HB Audio Gallery Lite <= 1.0.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1cbf17-11ec-4de6-879f-9ca8d53f3e91?source=api-prod","affected":[{"type":"plugin","slug":"hb-audio-gallery-lite","name":"hb-audio-gallery-lite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T17:36:31Z"},{"id":"wordfence:3d1e49cf-86ac-4368-800a-4e46f72c975d","source":"wordfence","cve":"CVE-2026-15918","title":"VikAppointments \u2013 Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1e49cf-86ac-4368-800a-4e46f72c975d?source=api-prod","affected":[{"type":"plugin","slug":"vikappointments","name":"VikAppointments Services Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2026-08-04T16:06:14Z","updated":"2026-08-05T04:25:25Z"},{"id":"wordfence:3d1f9fb7-fcb8-41ec-8c2f-0864e245f873","source":"wordfence","cve":"CVE-2022-1001","title":"WP Downgrade <= 1.2.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d1f9fb7-fcb8-41ec-8c2f-0864e245f873?source=api-prod","affected":[{"type":"plugin","slug":"wp-downgrade","name":"WP Downgrade | Specific Core Version","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2022-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d2031c4-56ee-4779-84fe-c6679ab1c6f4","source":"wordfence","cve":"CVE-2025-31078","title":"Small Package Quotes \u2013 Worldwide Express Edition <= 5.2.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2031c4-56ee-4779-84fe-c6679ab1c6f4?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-wwe-edition","name":"Small Package Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"5.2.19"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:23:30Z"},{"id":"wordfence:3d2236cd-dfed-42d0-a77f-4573e74a4781","source":"wordfence","cve":"CVE-2021-24565","title":"Contact Form 7 Captcha <= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2236cd-dfed-42d0-a77f-4573e74a4781?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-simple-recaptcha","name":"LukasApps CAPTCHA tools for Contact Form 7","from":"*","from_inclusive":true,"to":"0.0.9","to_inclusive":false,"patched_in":"0.0.9"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d24f5d8-a1dc-4dc6-86ac-296f7df71560","source":"wordfence","cve":"CVE-2025-63046","title":"ListingPro <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d24f5d8-a1dc-4dc6-86ac-296f7df71560?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-12-10T16:00:10Z"},{"id":"wordfence:3d26c5f0-0b74-4c6b-8080-e30a8d1cc6b8","source":"wordfence","cve":"CVE-2026-113488","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d26c5f0-0b74-4c6b-8080-e30a8d1cc6b8?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.196","to_inclusive":false,"patched_in":"2.8.196"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:14Z"},{"id":"wordfence:3d2b4c27-e446-43bf-9d6b-6856222fa3a4","source":"wordfence","cve":"CVE-2025-58205","title":"ElementInvader Addons for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2b4c27-e446-43bf-9d6b-6856222fa3a4?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:07:28Z"},{"id":"wordfence:3d2d22bb-e29e-4d4b-a97d-e128777712b0","source":"wordfence","cve":"CVE-2013-5916","title":"Bradesco Gateway <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2d22bb-e29e-4d4b-a97d-e128777712b0?source=api-prod","affected":[{"type":"plugin","slug":"bradesco-gateway","name":"Bradesco Gateway","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2013-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d2d6d60-27a1-472b-b124-d1a5d5ddeaea","source":"wordfence","cve":"CVE-2024-52421","title":"WP Popup Window Maker <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2d6d60-27a1-472b-b124-d1a5d5ddeaea?source=api-prod","affected":[{"type":"plugin","slug":"easy-popup-lightbox-maker","name":"Easy Popup Lightbox Maker","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-11-13T00:00:00Z","updated":"2026-04-25T14:15:29Z"},{"id":"wordfence:3d2daf20-df96-4514-9ceb-93d86b690734","source":"wordfence","cve":"","title":"Virtue Premium <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2daf20-df96-4514-9ceb-93d86b690734?source=api-prod","affected":[{"type":"theme","slug":"virtue_premium","name":"Virtue Premium","from":"*","from_inclusive":true,"to":"4.10.21","to_inclusive":true,"patched_in":"4.10.22"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T17:35:58Z"},{"id":"wordfence:3d2dde13-2940-478e-8e2b-baf60003754a","source":"wordfence","cve":"CVE-2025-14375","title":"RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2dde13-2940-478e-8e2b-baf60003754a?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-01-15T19:09:57Z","updated":"2026-01-16T07:23:11Z"},{"id":"wordfence:3d2f77cf-bc97-47ba-b3a6-5bdc1452715c","source":"wordfence","cve":"CVE-2024-54414","title":"Geoportail Shortcode <= 2.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2f77cf-bc97-47ba-b3a6-5bdc1452715c?source=api-prod","affected":[{"type":"plugin","slug":"geoportail-shortcode","name":"Geoportail Shortcode","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:36:02Z"},{"id":"wordfence:3d2f79ef-599f-48fc-b198-33c0407ad90d","source":"wordfence","cve":"CVE-2024-3407","title":"WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Arbitrary Prayer Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d2f79ef-599f-48fc-b198-33c0407ad90d?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T12:50:24Z"},{"id":"wordfence:3d300517-8939-431d-b33b-e74806e5887c","source":"wordfence","cve":"CVE-2024-47374","title":"LiteSpeed Cache <= 6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d300517-8939-431d-b33b-e74806e5887c?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.5.0.2","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-02T15:45:56Z"},{"id":"wordfence:3d3336f7-ee20-4f1c-92b4-f1c77aac91f9","source":"wordfence","cve":"CVE-2015-10105","title":"IP Blacklist Cloud <= 3.42 - Authenticated (Admin+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3336f7-ee20-4f1c-92b4-f1c77aac91f9?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2015-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d3516e7-cce4-4def-be38-d16be3110d59","source":"wordfence","cve":"CVE-2024-0513","title":"Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3516e7-cce4-4def-be38-d16be3110d59?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:36:12Z"},{"id":"wordfence:3d365284-73ac-4730-a83d-9202677cf161","source":"wordfence","cve":"CVE-2024-1860","title":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d365284-73ac-4730-a83d-9202677cf161?source=api-prod","affected":[{"type":"plugin","slug":"antihacker","name":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan","from":"*","from_inclusive":true,"to":"4.51","to_inclusive":true,"patched_in":"4.52"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T09:33:34Z"},{"id":"wordfence:3d36cad2-53ff-4515-94e3-25bc9f518070","source":"wordfence","cve":"CVE-2026-6172","title":"Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d36cad2-53ff-4515-94e3-25bc9f518070?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-29T19:32:14Z","updated":"2026-09-30T07:41:04Z"},{"id":"wordfence:3d36d52e-7247-4f06-ae10-7827ae242983","source":"wordfence","cve":"","title":"Google Adsense & Banner Ads by AdsforWP <= 1.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d36d52e-7247-4f06-ae10-7827ae242983?source=api-prod","affected":[{"type":"plugin","slug":"ads-for-wp","name":"Easy Google Adsense and Banner Ads Manager \u2013 AdsforWP","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d39ae72-7d45-4ca9-9de1-8532ec5e043d","source":"wordfence","cve":"CVE-2021-42365","title":"Asgaros Forums <= 1.15.13 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d39ae72-7d45-4ca9-9de1-8532ec5e043d?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"1.15.13","to_inclusive":true,"patched_in":"1.15.14"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d3b090a-71a3-4430-871d-f19ee1033e01","source":"wordfence","cve":"CVE-2005-1688","title":"WordPress Core < 1.5.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3b090a-71a3-4430-871d-f19ee1033e01?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2005-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d3d4fe5-bb87-42e0-b54c-f550ccebf944","source":"wordfence","cve":"CVE-2026-12972","title":"PayPlus Payment Gateway <= 8.2.1 - Unauthenticated Order Payment Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3d4fe5-bb87-42e0-b54c-f550ccebf944?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"8.2.1","to_inclusive":true,"patched_in":"8.2.2"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-30T13:29:09Z"},{"id":"wordfence:3d3fcadf-60bd-4a2e-a30c-e276dd04368c","source":"wordfence","cve":"CVE-2022-4431","title":"WOOCS <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3fcadf-60bd-4a2e-a30c-e276dd04368c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.9.2","to_inclusive":true,"patched_in":"1.3.9.3"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d400eae-7d5f-490b-841e-ffb749016c1d","source":"wordfence","cve":"CVE-2025-26555","title":"Debug-Bar-Extender <= 0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d400eae-7d5f-490b-841e-ffb749016c1d?source=api-prod","affected":[{"type":"plugin","slug":"debug-bar-extender","name":"Debug-Bar-Extender","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:36:07Z"},{"id":"wordfence:3d40498a-b0d4-4304-bab7-e9620ef61db5","source":"wordfence","cve":"CVE-2025-2162","title":"MapPress Maps for WordPress <= 2.94.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d40498a-b0d4-4304-bab7-e9620ef61db5?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.94.9","to_inclusive":true,"patched_in":"2.94.10"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T20:32:55Z"},{"id":"wordfence:3d4321c8-15a4-46f5-9b0e-2098a7fcfb5b","source":"wordfence","cve":"CVE-2026-76581","title":"WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion","severity":"critical","cvss":9.8,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4321c8-15a4-46f5-9b0e-2098a7fcfb5b?source=api-prod","affected":[{"type":"plugin","slug":"wpmudev-updates","name":"WPMU DEV Dashboard","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-08-27T17:38:19Z","updated":"2026-08-28T06:39:49Z"},{"id":"wordfence:3d438d11-df72-431e-8956-6a7b316a6dc3","source":"wordfence","cve":"","title":"sintic_gallery (All Known Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d438d11-df72-431e-8956-6a7b316a6dc3?source=api-prod","affected":[{"type":"plugin","slug":"sintic_gallery","name":"sintic_gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d4838b8-7a9d-43b7-a577-7d7ae8bac5fa","source":"wordfence","cve":"CVE-2024-53778","title":"Essential Breadcrumbs <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4838b8-7a9d-43b7-a577-7d7ae8bac5fa?source=api-prod","affected":[{"type":"plugin","slug":"essential-breadcrumbs","name":"Essential Breadcrumbs","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:13:30Z"},{"id":"wordfence:3d492fcd-5138-44e8-816b-295ec219fd0d","source":"wordfence","cve":"CVE-2026-39616","title":"Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d492fcd-5138-44e8-816b-295ec219fd0d?source=api-prod","affected":[{"type":"plugin","slug":"download-attachments","name":"Download Attachments","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-02-10T00:00:00Z","updated":"2026-08-17T03:44:34Z"},{"id":"wordfence:3d4a938a-044b-4991-bc4c-db9e15210f06","source":"wordfence","cve":"CVE-2025-10137","title":"Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=api-prod","affected":[{"type":"theme","slug":"snow-monkey","name":"Snow Monkey","from":"29.1.5","from_inclusive":true,"to":"29.1.5","to_inclusive":true,"patched_in":"29.1.6"}],"published":"2025-09-25T17:34:57Z","updated":"2025-09-26T06:43:28Z"},{"id":"wordfence:3d4ae328-5aae-435c-af23-b5ffd56bd83a","source":"wordfence","cve":"CVE-2026-81806","title":"Hide My WP Ghost \u2013 Security & Firewall <= 7.0.09 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4ae328-5aae-435c-af23-b5ffd56bd83a?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.09","to_inclusive":true,"patched_in":"7.0.10"}],"published":"2026-09-07T12:22:25Z","updated":"2026-09-10T19:18:58Z"},{"id":"wordfence:3d4b9f07-a4a0-4cbd-a147-281570bc7f4a","source":"wordfence","cve":"CVE-2023-47237","title":"Auto Publish for Google My Business <= 3.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4b9f07-a4a0-4cbd-a147-281570bc7f4a?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-my-business-auto-publish","name":"Auto Publish for Google My Business","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":false,"patched_in":"3.8"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d4bb4b6-9565-4a8a-aae3-ba863ef42ddb","source":"wordfence","cve":"CVE-2025-11706","title":"Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4bb4b6-9565-4a8a-aae3-ba863ef42ddb?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-02-18T14:55:10Z","updated":"2026-02-19T03:25:12Z"},{"id":"wordfence:3d4cf93d-61af-4721-9751-9891e08ce7b8","source":"wordfence","cve":"CVE-2020-26511","title":"WPO365 | LOGIN <= 11.6 - Authentication Bypass","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4cf93d-61af-4721-9751-9891e08ce7b8?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"11.6","to_inclusive":true,"patched_in":"11.7"}],"published":"2020-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d501415-39ab-4c2a-bcd3-fda97b7a3235","source":"wordfence","cve":"CVE-2021-24556","title":"Email Subscriber <= 1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d501415-39ab-4c2a-bcd3-fda97b7a3235?source=api-prod","affected":[{"type":"plugin","slug":"email-subscriber","name":"Email Subscriber","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d5256ea-61ba-4b2d-90d6-714176bc19aa","source":"wordfence","cve":"CVE-2019-13575","title":"Contact Form, Drag and Drop Form Builder for WordPress \u2013 Everest Forms <= 1.4.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5256ea-61ba-4b2d-90d6-714176bc19aa?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2019-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d54e3ac-006c-4a6c-a7d5-974015738620","source":"wordfence","cve":"CVE-2026-81194","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d54e3ac-006c-4a6c-a7d5-974015738620?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:38:18Z"},{"id":"wordfence:3d54f585-0116-4517-84f1-271e89a05539","source":"wordfence","cve":"CVE-2022-4697","title":"ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d54f585-0116-4517-84f1-271e89a05539?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d55bee0-1638-4e64-9f68-3b13384be799","source":"wordfence","cve":"CVE-2025-23788","title":"Easy Filter <= 1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d55bee0-1638-4e64-9f68-3b13384be799?source=api-prod","affected":[{"type":"plugin","slug":"easy-filter","name":"Easy Filter","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:16:56Z"},{"id":"wordfence:3d56fdde-ab7a-4e7c-9f48-48e71e09a681","source":"wordfence","cve":"CVE-2022-47179","title":"OWM Weather <= 5.6.11 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d56fdde-ab7a-4e7c-9f48-48e71e09a681?source=api-prod","affected":[{"type":"plugin","slug":"owm-weather","name":"OWM Weather","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d57d39f-f927-474f-a2e0-c9ac06e284d3","source":"wordfence","cve":"CVE-2026-15939","title":"Simple Restrict < 1.2.9 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d57d39f-f927-474f-a2e0-c9ac06e284d3?source=api-prod","affected":[{"type":"plugin","slug":"simple-restrict","name":"Simple Restrict","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-13T20:25:15Z"},{"id":"wordfence:3d59700b-3540-464c-bd27-23bb71f9b082","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d59700b-3540-464c-bd27-23bb71f9b082?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:47:03Z"},{"id":"wordfence:3d599ed8-ba30-4f12-83f5-be452bc1ae35","source":"wordfence","cve":"CVE-2021-24293","title":"NextGen Gallery Pro <= 3.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d599ed8-ba30-4f12-83f5-be452bc1ae35?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery-pro","name":"NextGen Gallery Pro","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2021-02-24T00:00:00Z","updated":"2024-03-29T18:00:21Z"},{"id":"wordfence:3d5a4097-0777-48c9-8e40-382f1136e29f","source":"wordfence","cve":"CVE-2026-89286","title":"FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5a4097-0777-48c9-8e40-382f1136e29f?source=api-prod","affected":[{"type":"plugin","slug":"formflow-for-gohighlevel","name":"FormFlow for GoHighLevel (GHL) \u2013 Send Form Leads to GHL CRM","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:44:17Z"},{"id":"wordfence:3d5bc7a0-89b8-47fc-a6fa-7eb141d2be31","source":"wordfence","cve":"CVE-2026-8941","title":"CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5bc7a0-89b8-47fc-a6fa-7eb141d2be31?source=api-prod","affected":[{"type":"plugin","slug":"ossdl-cdn-off-linker","name":"CDN Linker lite","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:44Z","updated":"2026-05-27T05:31:23Z"},{"id":"wordfence:3d5c4bf6-36f7-4e6d-a012-95594e3d93f8","source":"wordfence","cve":"CVE-2023-27420","title":"Arya Multipurpose <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5c4bf6-36f7-4e6d-a012-95594e3d93f8?source=api-prod","affected":[{"type":"theme","slug":"arya-multipurpose","name":"Arya Multipurpose","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d5c5511-570e-4048-8c1b-68cfc831f0c6","source":"wordfence","cve":"","title":"Advanced Menu Manager <= 2.9.6 - Cross-Site Request Forgery to Menu Edition","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5c5511-570e-4048-8c1b-68cfc831f0c6?source=api-prod","affected":[{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d5c8946-22d3-4631-a030-e1556b4824d8","source":"wordfence","cve":"CVE-2026-14309","title":"Chat On Desk <= 1.0.8 - Unauthenticated Two-Factor Authentication Bypass to Password Reset","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5c8946-22d3-4631-a030-e1556b4824d8?source=api-prod","affected":[{"type":"plugin","slug":"chat-on-desk","name":"Chat On Desk Order Notifications \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-21T14:03:59Z"},{"id":"wordfence:3d5dfccd-74ab-4de9-8ea6-58908865086d","source":"wordfence","cve":"","title":"Revamp CRM for WooCommerce < 1.0.4 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5dfccd-74ab-4de9-8ea6-58908865086d?source=api-prod","affected":[{"type":"plugin","slug":"revampcrm-woocommerce","name":"Revamp CRM for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2019-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d5ee8f1-8d86-4af0-af01-b31d2ff993d1","source":"wordfence","cve":"CVE-2022-45842","title":"WP ULike <= 4.6.4 - Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d5ee8f1-8d86-4af0-af01-b31d2ff993d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2022-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d604f7a-947c-43f4-bba6-e7e98b2d7844","source":"wordfence","cve":"CVE-2024-3733","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d604f7a-947c-43f4-bba6-e7e98b2d7844?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.15","to_inclusive":true,"patched_in":"5.9.16"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T08:29:02Z"},{"id":"wordfence:3d61758e-39a5-4f6a-8d88-7c44210eb69a","source":"wordfence","cve":"CVE-2025-64362","title":"K Elements < 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d61758e-39a5-4f6a-8d88-7c44210eb69a?source=api-prod","affected":[{"type":"plugin","slug":"k-elements","name":"K Elements","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":false,"patched_in":"5.5.0"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-04T14:54:59Z"},{"id":"wordfence:3d6199e1-c102-45d2-b24b-0eab4edf857b","source":"wordfence","cve":"CVE-2025-32659","title":"FraudLabs Pro for WooCommerce <= 2.22.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6199e1-c102-45d2-b24b-0eab4edf857b?source=api-prod","affected":[{"type":"plugin","slug":"fraudlabs-pro-for-woocommerce","name":"FraudLabs Pro for WooCommerce","from":"*","from_inclusive":true,"to":"2.22.8","to_inclusive":true,"patched_in":"2.22.9"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T14:45:19Z"},{"id":"wordfence:3d63a2c5-e767-4caf-812f-53c0db66d310","source":"wordfence","cve":"CVE-2026-115966","title":"Text Typing \u2013 grab attention with animated typing headlines <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d63a2c5-e767-4caf-812f-53c0db66d310?source=api-prod","affected":[{"type":"plugin","slug":"text-typing","name":"Text Typing \u2013 grab attention with animated typing headlines","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-26T17:27:00Z","updated":"2026-10-28T01:26:12Z"},{"id":"wordfence:3d6488ce-e34a-4b23-806d-fa2fb948ea8f","source":"wordfence","cve":"CVE-2021-24169","title":"Advanced Order Export For WooCommerce <= 3.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6488ce-e34a-4b23-806d-fa2fb948ea8f?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2021-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d650cda-341f-4772-9b67-1bac200e3fb7","source":"wordfence","cve":"CVE-2026-19660","title":"Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d650cda-341f-4772-9b67-1bac200e3fb7?source=api-prod","affected":[{"type":"plugin","slug":"divi-membership","name":"Divi Membership","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-10-01T16:24:08Z","updated":"2026-10-02T04:27:13Z"},{"id":"wordfence:3d6629e9-ab43-4eca-9340-5691421ab19d","source":"wordfence","cve":"","title":"Contact Form by Supsystic <= 1.7.10 - SQL Injections","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6629e9-ab43-4eca-9340-5691421ab19d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d667f97-5072-4119-84d8-7104fd63559c","source":"wordfence","cve":"CVE-2024-11446","title":"Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d667f97-5072-4119-84d8-7104fd63559c?source=api-prod","affected":[{"type":"plugin","slug":"chessgame-shizzle","name":"Chessgame Shizzle","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-11-22T18:30:27Z","updated":"2024-11-23T06:54:53Z"},{"id":"wordfence:3d6763a3-6773-41fe-b7fd-f21c34963bd8","source":"wordfence","cve":"CVE-2026-62140","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6763a3-6773-41fe-b7fd-f21c34963bd8?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.5","to_inclusive":true,"patched_in":"11.2.6"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:17:09Z"},{"id":"wordfence:3d68293a-b98b-41e0-9f79-ccd2c0108e82","source":"wordfence","cve":"CVE-2023-7231","title":"illi Link Party! <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Link Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d68293a-b98b-41e0-9f79-ccd2c0108e82?source=api-prod","affected":[{"type":"plugin","slug":"link-party","name":"illi Link Party!","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:47:48Z"},{"id":"wordfence:3d68d666-a304-49d2-95d7-b3eb780657c3","source":"wordfence","cve":"CVE-2025-64230","title":"Filr <= 1.2.10 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d68d666-a304-49d2-95d7-b3eb780657c3?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2025-08-17T00:00:00Z","updated":"2025-12-20T19:25:23Z"},{"id":"wordfence:3d69a674-c6cf-406f-bc11-175fad8e60c8","source":"wordfence","cve":"CVE-2024-37459","title":"PayPlus Payment Gateway <= 6.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d69a674-c6cf-406f-bc11-175fad8e60c8?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"6.6.8","to_inclusive":true,"patched_in":"6.6.9"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:15:24Z"},{"id":"wordfence:3d6affb6-bbc1-40aa-8633-ba0f06c10fe1","source":"wordfence","cve":"CVE-2015-2807","title":"Navis DocumentCloud < 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6affb6-bbc1-40aa-8633-ba0f06c10fe1?source=api-prod","affected":[{"type":"plugin","slug":"navis-documentcloud","name":"Navis DocumentCloud","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":false,"patched_in":"0.1.1"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d6b95ee-0a0d-49f7-83b1-4716eec3b863","source":"wordfence","cve":"CVE-2024-4037","title":"WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6b95ee-0a0d-49f7-83b1-4716eec3b863?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.7.00.003","to_inclusive":true,"patched_in":"8.7.00.004"}],"published":"2024-05-23T20:04:58Z","updated":"2024-05-24T08:30:31Z"},{"id":"wordfence:3d6cc723-5c58-4c36-af29-da101174293c","source":"wordfence","cve":"CVE-2026-119155","title":"wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d6cc723-5c58-4c36-af29-da101174293c?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-11-06T20:58:02Z","updated":"2026-11-07T09:25:46Z"},{"id":"wordfence:3d71404e-0db8-485b-a626-5e0df2076c05","source":"wordfence","cve":"CVE-2025-12673","title":"Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d71404e-0db8-485b-a626-5e0df2076c05?source=api-prod","affected":[{"type":"plugin","slug":"flex-qr-code-generator","name":"Flex QR Code Generator","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-12-05T16:45:35Z","updated":"2025-12-09T20:10:39Z"},{"id":"wordfence:3d757d89-1079-42d1-94a3-d863bbfa9ad4","source":"wordfence","cve":"CVE-2025-39357","title":"Hospital Management System <= 47.0(20-11-2023) - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d757d89-1079-42d1-94a3-d863bbfa9ad4?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:17:47Z"},{"id":"wordfence:3d768e52-0fd3-4404-8936-6b6069f7e98f","source":"wordfence","cve":"CVE-2025-62894","title":"ACF Recent Posts Widget <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d768e52-0fd3-4404-8936-6b6069f7e98f?source=api-prod","affected":[{"type":"plugin","slug":"acf-recent-posts-widget","name":"ACF Recent Posts Widget","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-10-29T21:03:31Z"},{"id":"wordfence:3d76a21c-bb79-4183-99ea-a07c18dfa180","source":"wordfence","cve":"CVE-2022-40698","title":"Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d76a21c-bb79-4183-99ea-a07c18dfa180?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.10","to_inclusive":true,"patched_in":"7.3.11"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d76a807-d81d-45fc-a571-625a6ecf670b","source":"wordfence","cve":"CVE-2011-3860","title":"Cover WP <= 1.6.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d76a807-d81d-45fc-a571-625a6ecf670b?source=api-prod","affected":[{"type":"theme","slug":"cover-wp","name":"Cover WP","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2011-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d7a4c57-0f3e-4120-a30d-5a2ddb1ec476","source":"wordfence","cve":"CVE-2026-94272","title":"Snap Finance 1.0.8 - 3.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7a4c57-0f3e-4120-a30d-5a2ddb1ec476?source=api-prod","affected":[{"type":"plugin","slug":"snap-finance-checkout","name":"Snap Finance","from":"1.0.8","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:47:27Z"},{"id":"wordfence:3d7a544b-73a1-4883-a2d2-df42de08ff08","source":"wordfence","cve":"CVE-2026-66442","title":"YayPricing <= 3.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7a544b-73a1-4883-a2d2-df42de08ff08?source=api-prod","affected":[{"type":"plugin","slug":"yaypricing","name":"YayPricing \u2013 WooCommerce Dynamic Pricing & Discounts","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:26:14Z"},{"id":"wordfence:3d7af96a-5a3c-4291-a369-f6ed78f72a3f","source":"wordfence","cve":"CVE-2024-8671","title":"WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7af96a-5a3c-4291-a369-f6ed78f72a3f?source=api-prod","affected":[{"type":"plugin","slug":"woo-events","name":"WooEvents - Calendar and Event Booking","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T03:06:37Z"},{"id":"wordfence:3d7b4428-99ac-4f84-8595-941124121eb2","source":"wordfence","cve":"","title":"WP Forum <= 2.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7b4428-99ac-4f84-8595-941124121eb2?source=api-prod","affected":[{"type":"plugin","slug":"wp-forum","name":"wp-forum","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d7b5b50-ea6e-4f9e-bd7b-7682469c63b9","source":"wordfence","cve":"CVE-2025-32209","title":"Nomupay Payment Processing Gateway <= 7.1.5 - Authenticated (Subscriber+) Arbitrary File Download","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7b5b50-ea6e-4f9e-bd7b-7682469c63b9?source=api-prod","affected":[{"type":"plugin","slug":"totalprocessing-card-payments","name":"Total processing card payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.5","to_inclusive":true,"patched_in":"7.1.6"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:35:05Z"},{"id":"wordfence:3d7b73f4-e52f-40bd-9865-de994cd8d610","source":"wordfence","cve":"CVE-2024-8625","title":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll <= 2.3.9 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7b73f4-e52f-40bd-9865-de994cd8d610?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-12-12T17:19:25Z"},{"id":"wordfence:3d7ca3ff-eae4-425f-8340-9d9b4952ce4a","source":"wordfence","cve":"CVE-2023-7196","title":"Ultimate Noindex Nofollow Tool <= 1.1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7ca3ff-eae4-425f-8340-9d9b4952ce4a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-noindex-nofollow-tool","name":"Ultimate Noindex Nofollow Tool","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:46:40Z"},{"id":"wordfence:3d7e4d9c-d088-48db-88b7-09205115636f","source":"wordfence","cve":"CVE-2023-25980","title":"Optimize Database after Deleting Revisions <= 5.1.1 - Cross-Site Request Forgery via 'odb_start_manually'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7e4d9c-d088-48db-88b7-09205115636f?source=api-prod","affected":[{"type":"plugin","slug":"rvg-optimize-database","name":"Optimize Database after Deleting Revisions","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.2"}],"published":"2023-07-26T00:00:00Z","updated":"2024-02-01T22:28:17Z"},{"id":"wordfence:3d7e72a0-6c06-43f1-a269-fbc7f188be52","source":"wordfence","cve":"CVE-2026-86816","title":"WPCafe <= 3.0.20 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d7e72a0-6c06-43f1-a269-fbc7f188be52?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.20","to_inclusive":true,"patched_in":"3.0.21"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:58:05Z"},{"id":"wordfence:3d819b54-f057-4875-8e40-f5c77db2e5fd","source":"wordfence","cve":"CVE-2013-5978","title":"Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d819b54-f057-4875-8e40-f5c77db2e5fd?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.1.15","to_inclusive":false,"patched_in":"1.5.1.15"}],"published":"2013-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d81e41d-e62c-49d7-bba5-6a2a0a586c84","source":"wordfence","cve":"CVE-2026-9107","title":"Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d81e41d-e62c-49d7-bba5-6a2a0a586c84?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.14"}],"published":"2026-06-30T15:03:16Z","updated":"2026-07-01T03:43:35Z"},{"id":"wordfence:3d85d609-781b-4f82-af57-124767f9d333","source":"wordfence","cve":"CVE-2024-11943","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Function","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d85d609-781b-4f82-af57-124767f9d333?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2024-12-06T00:00:00Z","updated":"2025-02-03T23:13:35Z"},{"id":"wordfence:3d8b4bb6-3715-40c1-8140-7fcf874ccec3","source":"wordfence","cve":"CVE-2023-4994","title":"Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b4bb6-3715-40c1-8140-7fcf874ccec3?source=api-prod","affected":[{"type":"plugin","slug":"allow-php-in-posts-and-pages","name":"Allow PHP in Posts and Pages","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d8b8f54-b2af-42dd-af82-c1e8726c87e2","source":"wordfence","cve":"CVE-2022-0737","title":"Text Hover <= 4.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8b8f54-b2af-42dd-af82-c1e8726c87e2?source=api-prod","affected":[{"type":"plugin","slug":"text-hover","name":"Text Hover","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d8f722f-79be-4df2-9f91-e759b8a73277","source":"wordfence","cve":"CVE-2024-54218","title":"AIO Contact <= 2.8.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d8f722f-79be-4df2-9f91-e759b8a73277?source=api-prod","affected":[{"type":"plugin","slug":"aio-contact","name":"AIO Contact","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:13:50Z"},{"id":"wordfence:3d91158c-0b34-460e-9fdb-b99165ebca78","source":"wordfence","cve":"CVE-2026-4005","title":"Coachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d91158c-0b34-460e-9fdb-b99165ebca78?source=api-prod","affected":[{"type":"plugin","slug":"coachific-shortcode","name":"Coachific Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:47:11Z","updated":"2026-04-15T08:28:14Z"},{"id":"wordfence:3d9179d2-2e90-4de7-8178-073a0ce5865b","source":"wordfence","cve":"CVE-2023-50861","title":"HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d9179d2-2e90-4de7-8178-073a0ce5865b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.4.3","to_inclusive":true,"patched_in":"1.3.4.4"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d933256-765b-4e1b-b5a1-39bf767bf860","source":"wordfence","cve":"CVE-2017-14843","title":"Mojoomla School Management System (Unspecified Version) - Authenticated (Student+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d933256-765b-4e1b-b5a1-39bf767bf860?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d9332be-2cf0-46cd-81e4-6436aeec0f83","source":"wordfence","cve":"CVE-2024-1120","title":"NextMove Lite \u2013 Thank You Page for WooCommerce & Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d9332be-2cf0-46cd-81e4-6436aeec0f83?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"},{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.18.0"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-01T09:31:40Z"},{"id":"wordfence:3d94ffdb-d5e1-4125-b499-5e47f9f67069","source":"wordfence","cve":"CVE-2025-60233","title":"Zuut <= 1.4.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d94ffdb-d5e1-4125-b499-5e47f9f67069?source=api-prod","affected":[{"type":"theme","slug":"zuut","name":"Zuut","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2026-05-04T14:47:51Z"},{"id":"wordfence:3d96d38a-7f0e-4e47-ba49-727705eaaac6","source":"wordfence","cve":"CVE-2024-7433","title":"Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d96d38a-7f0e-4e47-ba49-727705eaaac6?source=api-prod","affected":[{"type":"theme","slug":"empowerment","name":"Empowerment","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:10Z"},{"id":"wordfence:3d97eee1-0f72-4dd3-998a-acb454fa5e8a","source":"wordfence","cve":"CVE-2024-6709","title":"Sync Post With Other Site <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Post Creation and Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d97eee1-0f72-4dd3-998a-acb454fa5e8a?source=api-prod","affected":[{"type":"plugin","slug":"sync-post-with-other-site","name":"Sync Post With Other Site","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-03T11:37:37Z"},{"id":"wordfence:3d996df9-3d61-4b2b-8d74-4faa7c5a151a","source":"wordfence","cve":"CVE-2007-2426","title":"MySliderGallery <= 1.2.1 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d996df9-3d61-4b2b-8d74-4faa7c5a151a?source=api-prod","affected":[{"type":"plugin","slug":"mygallery","name":"MySliderGallery","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.4b5"}],"published":"2007-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3d99bc37-4697-400a-bbd4-858543f17d1f","source":"wordfence","cve":"CVE-2026-18402","title":"SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d99bc37-4697-400a-bbd4-858543f17d1f?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.10.4"}],"published":"2026-08-15T17:20:07Z","updated":"2026-08-16T05:27:28Z"},{"id":"wordfence:3d9b3ca6-1f75-41d1-9d78-fc9e1c92b66a","source":"wordfence","cve":"CVE-2026-11579","title":"Kali Forms <= 2.4.16 - Missing Authorization to Unauthenticated Media File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d9b3ca6-1f75-41d1-9d78-fc9e1c92b66a?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"2.4.17"}],"published":"2026-06-24T00:00:00Z","updated":"2026-07-30T12:06:07Z"},{"id":"wordfence:3d9f4fbe-6da6-4620-a071-00b7a462de45","source":"wordfence","cve":"CVE-2015-3438","title":"WordPress Core < 4.1.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3d9f4fbe-6da6-4620-a071-00b7a462de45?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2015-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3da0a44f-d4b4-4330-a2e3-d25a2a7df926","source":"wordfence","cve":"CVE-2023-4823","title":"WP Meta and Date Remover < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da0a44f-d4b4-4330-a2e3-d25a2a7df926?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-and-date-remover","name":"WP Meta and Date Remover","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3da136dd-bd09-468a-879a-dac968ebf942","source":"wordfence","cve":"CVE-2026-113493","title":"GeoDirectory <= 2.8.193 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da136dd-bd09-468a-879a-dac968ebf942?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:18:18Z"},{"id":"wordfence:3da37b4d-3dd7-450f-8169-28141eeb19c7","source":"wordfence","cve":"CVE-2021-24662","title":"Game Server Status <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da37b4d-3dd7-450f-8169-28141eeb19c7?source=api-prod","affected":[{"type":"plugin","slug":"game-server-status","name":"Game Server Status","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3da3a409-6738-4774-bf98-2ebce539c198","source":"wordfence","cve":"CVE-2026-28130","title":"uDesign - Responsive WordPress Theme <= 4.14.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da3a409-6738-4774-bf98-2ebce539c198?source=api-prod","affected":[{"type":"theme","slug":"u-design","name":"uDesign - Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:35:02Z"},{"id":"wordfence:3da5356c-0a16-4e70-84b6-3f828fb3fcc3","source":"wordfence","cve":"CVE-2026-118075","title":"WP Media folders <= 1.1.10 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da5356c-0a16-4e70-84b6-3f828fb3fcc3?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folders","name":"WP Media folders","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T10:12:05Z","updated":"2026-11-03T19:40:20Z"},{"id":"wordfence:3da5ddc2-2004-4abd-87ef-154121e37d57","source":"wordfence","cve":"CVE-2025-67959","title":"WorkScout <= 4.1.07 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3da5ddc2-2004-4abd-87ef-154121e37d57?source=api-prod","affected":[{"type":"theme","slug":"workscout","name":"WorkScout - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.1.07","to_inclusive":true,"patched_in":"4.1.08"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:37:14Z"},{"id":"wordfence:3daa3a7d-bb92-41c7-92ad-71f6ff0bb50a","source":"wordfence","cve":"CVE-2022-4782","title":"ClickFunnels <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3daa3a7d-bb92-41c7-92ad-71f6ff0bb50a?source=api-prod","affected":[{"type":"plugin","slug":"clickfunnels","name":"ClickFunnels","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dacc612-5300-497a-9d6a-0944906e180c","source":"wordfence","cve":"CVE-2026-86461","title":"FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dacc612-5300-497a-9d6a-0944906e180c?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.54.7212","to_inclusive":true,"patched_in":"7.5.55.7212"}],"published":"2026-10-14T04:54:26Z","updated":"2026-10-14T17:29:14Z"},{"id":"wordfence:3dacef70-a881-400e-b9f7-c0a815cf624a","source":"wordfence","cve":"CVE-2023-2271","title":"Tiempo.com <= 0.1.2 - Cross-Site Request Forgery to Shortcode Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dacef70-a881-400e-b9f7-c0a815cf624a?source=api-prod","affected":[{"type":"plugin","slug":"tiempocom","name":"Tiempo.com","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dad7ba6-bac4-4f1a-83f5-fd5769cd4a45","source":"wordfence","cve":"CVE-2018-7280","title":"Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dad7ba6-bac4-4f1a-83f5-fd5769cd4a45?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.2.14","to_inclusive":false,"patched_in":"3.2.14"}],"published":"2018-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dae466b-c81a-4000-b40b-6b9fd0c7a30f","source":"wordfence","cve":"CVE-2026-39593","title":"HAPPY \u2013 Helpdesk Support Ticket System <= 1.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dae466b-c81a-4000-b40b-6b9fd0c7a30f?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:59:50Z"},{"id":"wordfence:3db1375b-169a-450d-86b5-2db99f916034","source":"wordfence","cve":"CVE-2025-9198","title":"Wp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1375b-169a-450d-86b5-2db99f916034?source=api-prod","affected":[{"type":"plugin","slug":"wp-cycle-text-announcement","name":"Wp cycle text announcement","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:31:18Z","updated":"2025-10-03T11:17:10Z"},{"id":"wordfence:3db1d9a0-ea68-4979-a36d-864c649f7aca","source":"wordfence","cve":"CVE-2025-3422","title":"Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1d9a0-ea68-4979-a36d-864c649f7aca?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-11T12:42:25Z"},{"id":"wordfence:3db65e14-50c6-4afe-84e5-0785fe9bf77a","source":"wordfence","cve":"CVE-2017-18516","title":"BestWebSoft's LinkedIn < 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3db65e14-50c6-4afe-84e5-0785fe9bf77a?source=api-prod","affected":[{"type":"plugin","slug":"bws-linkedin","name":"BestWebSoft's LinkedIn","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2017-04-17T00:00:00Z","updated":"2024-08-15T18:14:30Z"},{"id":"wordfence:3db97180-9308-4891-9de9-acefe31d088f","source":"wordfence","cve":"CVE-2023-0585","title":"All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3db97180-9308-4891-9de9-acefe31d088f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dbbb5b5-b322-4645-99b7-af88b8f0c13a","source":"wordfence","cve":"CVE-2026-66580","title":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels <= 7.12.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dbbb5b5-b322-4645-99b7-af88b8f0c13a?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.12.0","to_inclusive":true,"patched_in":"7.12.1"}],"published":"2026-09-17T11:51:00Z","updated":"2026-09-22T18:46:32Z"},{"id":"wordfence:3dbe01a5-a6ab-42d6-a485-ec54a4a62a0f","source":"wordfence","cve":"CVE-2025-30975","title":"Add Custom Codes <= 4.80 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dbe01a5-a6ab-42d6-a485-ec54a4a62a0f?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-codes","name":"Add Custom Codes \u2013 Insert Header, Footer, Custom PHP Snippets, CSS, Javascript","from":"*","from_inclusive":true,"to":"4.80","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-08-14T00:00:00Z","updated":"2026-03-17T21:25:07Z"},{"id":"wordfence:3dbe7a3c-8247-4f1f-aca6-dda4bdcc1daf","source":"wordfence","cve":"CVE-2025-49042","title":"WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dbe7a3c-8247-4f1f-aca6-dda4bdcc1daf?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"10.0.2","to_inclusive":true,"patched_in":"10.0.3"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-03T18:08:45Z"},{"id":"wordfence:3dc0349b-a802-46a0-9d2b-f52b34c93a7f","source":"wordfence","cve":"CVE-2026-16559","title":"YMC Filter <= 3.12.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc0349b-a802-46a0-9d2b-f52b34c93a7f?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.12.8","to_inclusive":true,"patched_in":"3.12.9"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:29:01Z"},{"id":"wordfence:3dc26eaa-2da5-4cd6-b613-4da2faad0f3b","source":"wordfence","cve":"CVE-2022-2260","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 2.21.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc26eaa-2da5-4cd6-b613-4da2faad0f3b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.21.2","to_inclusive":true,"patched_in":"2.21.3"}],"published":"2022-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dc2a4c8-cc29-481e-980a-59b7813ea65d","source":"wordfence","cve":"CVE-2026-122061","title":"Event Tickets and Registration < 5.30.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc2a4c8-cc29-481e-980a-59b7813ea65d?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.3.1","to_inclusive":false,"patched_in":"5.30.3.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:02Z"},{"id":"wordfence:3dc3b715-23eb-4cb9-8f44-1d3134c560ec","source":"wordfence","cve":"CVE-2022-4102","title":"Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc3b715-23eb-4cb9-8f44-1d3134c560ec?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.56"}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dc69bba-39e0-46bd-8cdb-7cf1f7d36282","source":"wordfence","cve":"CVE-2023-40331","title":"Accordion Slider <= 1.9.6 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc69bba-39e0-46bd-8cdb-7cf1f7d36282?source=api-prod","affected":[{"type":"plugin","slug":"accordion-slider","name":"Accordion Slider","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dc7355d-9c14-4633-985e-e0357c6210f7","source":"wordfence","cve":"CVE-2025-0368","title":"Banner Garden Plugin for WordPress <= 0.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc7355d-9c14-4633-985e-e0357c6210f7?source=api-prod","affected":[{"type":"plugin","slug":"banner-garden","name":"Banner Garden Plugin for WordPress","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:25:53Z"},{"id":"wordfence:3dc7bc0a-b209-431f-a9f1-f850b1a1d1b4","source":"wordfence","cve":"CVE-2024-30229","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc7bc0a-b209-431f-a9f1-f850b1a1d1b4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-07T19:34:07Z"},{"id":"wordfence:3dcc974f-6208-4362-bdf3-c5d4b5fc1ef5","source":"wordfence","cve":"CVE-2026-105070","title":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas <= 10.31.7 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcc974f-6208-4362-bdf3-c5d4b5fc1ef5?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.7","to_inclusive":true,"patched_in":"10.31.9"}],"published":"2026-10-05T10:15:18Z","updated":"2026-10-08T23:15:26Z"},{"id":"wordfence:3dcf2f22-4202-4902-9883-eb4479fe1028","source":"wordfence","cve":"CVE-2026-66674","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcf2f22-4202-4902-9883-eb4479fe1028?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.42.1","to_inclusive":true,"patched_in":"1.42.3"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:52:27Z"},{"id":"wordfence:3dcf401a-3b91-4b55-b6b1-a132ec195607","source":"wordfence","cve":"CVE-2025-4587","title":"A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dcf401a-3b91-4b55-b6b1-a132ec195607?source=api-prod","affected":[{"type":"plugin","slug":"ab-testing-for-wp","name":"A/B Testing for WordPress","from":"*","from_inclusive":true,"to":"1.18.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T19:05:32Z","updated":"2025-06-27T07:22:22Z"},{"id":"wordfence:3dd08e56-0425-4711-87f1-39625f0ffae2","source":"wordfence","cve":"","title":"Mobile Assistant Connector <= 2.2.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd08e56-0425-4711-87f1-39625f0ffae2?source=api-prod","affected":[{"type":"plugin","slug":"mobile-assistant-connector","name":"Mobile Assistant Connector","from":"2.2.2","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2022-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dd3dc4b-e936-46a4-8d65-5f4bf05b2374","source":"wordfence","cve":"CVE-2024-9443","title":"Basticom Framework <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd3dc4b-e936-46a4-8d65-5f4bf05b2374?source=api-prod","affected":[{"type":"plugin","slug":"basticom-framework","name":"Basticom Framework","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-11-04T19:36:14Z","updated":"2024-11-05T08:31:36Z"},{"id":"wordfence:3dd66c4f-46f8-46d2-b424-beb6ecc69675","source":"wordfence","cve":"CVE-2024-29766","title":"StreamWeasels Twitch Integration <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd66c4f-46f8-46d2-b424-beb6ecc69675?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:05:30Z"},{"id":"wordfence:3dd6c562-3c1e-46a3-bd02-bb587d8e6c76","source":"wordfence","cve":"CVE-2024-6025","title":"Quiz and Survey Master <= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd6c562-3c1e-46a3-bd02-bb587d8e6c76?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.0.4","to_inclusive":true,"patched_in":"9.0.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-28T13:04:49Z"},{"id":"wordfence:3dd798cd-72a7-4761-8879-9c9a7a233d0a","source":"wordfence","cve":"CVE-2026-84068","title":"Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd798cd-72a7-4761-8879-9c9a7a233d0a?source=api-prod","affected":[{"type":"plugin","slug":"quentn-wp","name":"Quentn WP","from":"1.2.13","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:18:23Z"},{"id":"wordfence:3dd8dac6-b969-498a-a1f8-2a00009ae1d8","source":"wordfence","cve":"CVE-2010-4277","title":"Embedded Video <= 4.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dd8dac6-b969-498a-a1f8-2a00009ae1d8?source=api-prod","affected":[{"type":"plugin","slug":"embedded-video-with-link","name":"Embedded Video","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2010-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ddb9c46-683d-4eb4-a30f-f492d4f3ae2d","source":"wordfence","cve":"CVE-2026-13344","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ddb9c46-683d-4eb4-a30f-f492d4f3ae2d?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.10","to_inclusive":false,"patched_in":"6.6.10"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:37:20Z"},{"id":"wordfence:3ddc7519-3ef0-449c-8190-fe0972c62703","source":"wordfence","cve":"CVE-2026-66434","title":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ddc7519-3ef0-449c-8190-fe0972c62703?source=api-prod","affected":[{"type":"plugin","slug":"photonic","name":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","from":"*","from_inclusive":true,"to":"3.33","to_inclusive":true,"patched_in":"3.34"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:10:43Z"},{"id":"wordfence:3ddde57f-4fb1-42c9-9280-de589320e191","source":"wordfence","cve":"CVE-2026-45444","title":"Gift Cards For WooCommerce Pro <= 4.2.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ddde57f-4fb1-42c9-9280-de589320e191?source=api-prod","affected":[{"type":"plugin","slug":"giftware","name":"Gift Cards For WooCommerce Pro","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:36:41Z"},{"id":"wordfence:3dde3216-e0a9-463f-87e8-b71552d2f3b2","source":"wordfence","cve":"CVE-2025-62989","title":"Cooked <= 1.11.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dde3216-e0a9-463f-87e8-b71552d2f3b2?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-15T17:58:18Z"},{"id":"wordfence:3de1bcd7-24a8-4566-819b-d6653344e132","source":"wordfence","cve":"CVE-2023-45063","title":"AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One <= 1.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de1bcd7-24a8-4566-819b-d6653344e132?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-writing-assistant","name":"AI Content Writing Assistant","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-10-03T00:00:00Z","updated":"2024-03-25T15:05:26Z"},{"id":"wordfence:3de27b2e-2196-4b8e-816c-729462a172d0","source":"wordfence","cve":"CVE-2022-3254","title":"AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de27b2e-2196-4b8e-816c-729462a172d0?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.3"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3de459ce-a4e7-443a-abd6-b8e1c9c1d184","source":"wordfence","cve":"CVE-2025-24608","title":"GD Mail Queue <= 4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de459ce-a4e7-443a-abd6-b8e1c9c1d184?source=api-prod","affected":[{"type":"plugin","slug":"gd-mail-queue","name":"GD Mail Queue","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2024-12-28T00:00:00Z","updated":"2025-05-08T20:43:01Z"},{"id":"wordfence:3de5c591-89ea-4289-a874-239864bcc886","source":"wordfence","cve":"CVE-2025-60065","title":"Pinevale <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de5c591-89ea-4289-a874-239864bcc886?source=api-prod","affected":[{"type":"theme","slug":"pinevale","name":"Pinevale | Addiction Recovery and Rehabilitation Center WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-12-20T21:07:26Z"},{"id":"wordfence:3de5ebda-a935-46fb-b35f-2f3784a63203","source":"wordfence","cve":"CVE-2025-60083","title":"PDF Invoice Builder for WooCommerce <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de5ebda-a935-46fb-b35f-2f3784a63203?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-woocommerce","name":"PDF Invoice for WooCommerce + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-08-23T00:00:00Z","updated":"2026-01-30T20:43:22Z"},{"id":"wordfence:3de82328-e44f-4488-a2ae-1dd2c3b8a502","source":"wordfence","cve":"CVE-2023-44258","title":"Schema App Structured Data <= 1.22.3 - Missing Authorization via page_init","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de82328-e44f-4488-a2ae-1dd2c3b8a502?source=api-prod","affected":[{"type":"plugin","slug":"schema-app-structured-data-for-schemaorg","name":"Schema App Structured Data","from":"*","from_inclusive":true,"to":"1.22.3","to_inclusive":true,"patched_in":"1.22.4"}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3de98970-06a3-4bde-a7cb-42b6456fea6c","source":"wordfence","cve":"CVE-2024-30552","title":"Responsive flipbook <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3de98970-06a3-4bde-a7cb-42b6456fea6c?source=api-prod","affected":[{"type":"plugin","slug":"wppdf","name":"Responsive flipbook wordpress plugin free download","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:16:48Z"},{"id":"wordfence:3debeffa-5cc3-4d13-aed8-72753a62d8fc","source":"wordfence","cve":"CVE-2026-54827","title":"Real Estate 7 WordPress <= 3.5.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3debeffa-5cc3-4d13-aed8-72753a62d8fc?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:39:45Z"},{"id":"wordfence:3ded9f9a-fc89-4618-a762-24c23437734c","source":"wordfence","cve":"CVE-2025-23894","title":"wp-flickr-press <= 2.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ded9f9a-fc89-4618-a762-24c23437734c?source=api-prod","affected":[{"type":"plugin","slug":"wp-flickr-press","name":"wp-flickr-press","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-28T15:22:55Z"},{"id":"wordfence:3dee74dc-32ae-47cd-8797-dbba60387702","source":"wordfence","cve":"CVE-2026-22482","title":"IMGspider <= 2.3.12 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dee74dc-32ae-47cd-8797-dbba60387702?source=api-prod","affected":[{"type":"plugin","slug":"imgspider","name":"IMGspider \u2013 \u56fe\u7247\u91c7\u96c6\u6293\u53d6\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-01-06T00:00:00Z","updated":"2026-09-09T16:05:33Z"},{"id":"wordfence:3dee7f76-bd66-4e54-8ef6-bbf581ebcc11","source":"wordfence","cve":"CVE-2026-104803","title":"WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dee7f76-bd66-4e54-8ef6-bbf581ebcc11?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.27","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-09T19:08:23Z","updated":"2026-10-10T07:41:44Z"},{"id":"wordfence:3deeb8f5-d9a7-43cb-9068-a921ed6db2bc","source":"wordfence","cve":"CVE-2026-77150","title":"Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3deeb8f5-d9a7-43cb-9068-a921ed6db2bc?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2026-09-10T14:50:27Z","updated":"2026-09-11T03:39:34Z"},{"id":"wordfence:3deee9b5-2e36-447d-a492-e22e3dc6a5ab","source":"wordfence","cve":"CVE-2023-6883","title":"Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3deee9b5-2e36-447d-a492-e22e3dc6a5ab?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:12Z"},{"id":"wordfence:3def97d8-4f25-4a67-bdce-7664a5c318bc","source":"wordfence","cve":"CVE-2024-31351","title":"Copymatic \u2013 AI Content Writer & Generator <= 1.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3def97d8-4f25-4a67-bdce-7664a5c318bc?source=api-prod","affected":[{"type":"plugin","slug":"copymatic","name":"Copymatic \u2013 AI Content Writer & Generator","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T15:26:39Z"},{"id":"wordfence:3deffe49-c40e-4231-b9d6-035f6dc5f8b2","source":"wordfence","cve":"CVE-2026-57736","title":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat <= 11.3.55 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3deffe49-c40e-4231-b9d6-035f6dc5f8b2?source=api-prod","affected":[{"type":"plugin","slug":"leadin","name":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat","from":"*","from_inclusive":true,"to":"11.3.55","to_inclusive":true,"patched_in":"11.3.56"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-28T17:47:49Z"},{"id":"wordfence:3df02341-e5f6-46d7-a511-1e6d0772167a","source":"wordfence","cve":"CVE-2024-51842","title":"Image Carousel Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df02341-e5f6-46d7-a511-1e6d0772167a?source=api-prod","affected":[{"type":"plugin","slug":"image-carousel-shortcode","name":"Image Carousel Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:34:10Z"},{"id":"wordfence:3df11929-37be-4c52-ae53-fbbe926659b7","source":"wordfence","cve":"CVE-2015-10001","title":"WP-Stats < 2.52 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df11929-37be-4c52-ae53-fbbe926659b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats","name":"WP-Stats","from":"*","from_inclusive":true,"to":"2.52","to_inclusive":false,"patched_in":"2.52"}],"published":"2015-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3df23ba9-337f-49ac-9d1f-6b993430a1ce","source":"wordfence","cve":"CVE-2024-43941","title":"Propovoice Pro <= 1.7.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df23ba9-337f-49ac-9d1f-6b993430a1ce?source=api-prod","affected":[{"type":"plugin","slug":"propovoice-pro","name":"Propovoice Pro","from":"*","from_inclusive":true,"to":"1.7.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:34:16Z"},{"id":"wordfence:3df651ff-281a-4b39-9e24-f594ba987659","source":"wordfence","cve":"CVE-2025-31439","title":"Browser Caching with .htaccess  1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df651ff-281a-4b39-9e24-f594ba987659?source=api-prod","affected":[{"type":"plugin","slug":"browser-caching-with-htaccess","name":"Browser Caching with .htaccess","from":"1.2.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T14:37:57Z"},{"id":"wordfence:3df8a0a2-e248-4c2e-a9c2-b5afc79cdd2a","source":"wordfence","cve":"CVE-2022-27863","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.3 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df8a0a2-e248-4c2e-a9c2-b5afc79cdd2a?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-04-18T10:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3df9f237-a861-43fc-8623-d42f84d8d5d1","source":"wordfence","cve":"CVE-2021-4394","title":"Locations <= 3.2.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3df9f237-a861-43fc-8623-d42f84d8d5d1?source=api-prod","affected":[{"type":"plugin","slug":"locations","name":"Locations","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3dfba044-42f8-44a2-be62-99af9d9094c3","source":"wordfence","cve":"CVE-2012-10025","title":"Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion","severity":"low","cvss":3.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dfba044-42f8-44a2-be62-99af9d9094c3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-01-03T00:00:00Z","updated":"2025-08-22T18:50:10Z"},{"id":"wordfence:3dff277c-f81f-4dfb-83e4-48dae4c0df64","source":"wordfence","cve":"CVE-2026-15247","title":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress < 2.6.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dff277c-f81f-4dfb-83e4-48dae4c0df64?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.6.24","to_inclusive":false,"patched_in":"2.6.24"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:06:45Z"},{"id":"wordfence:3dffd377-22e5-4fa3-879a-4924d01fd32d","source":"wordfence","cve":"CVE-2025-49038","title":"WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3dffd377-22e5-4fa3-879a-4924d01fd32d?source=api-prod","affected":[{"type":"plugin","slug":"wp-dynamic-links","name":"WP Dynamic Links","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-19T13:48:53Z"},{"id":"wordfence:3e011042-6d90-42e2-a967-b3e00a89be47","source":"wordfence","cve":"CVE-2024-5808","title":"WP Ajax Contact Form <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e011042-6d90-42e2-a967-b3e00a89be47?source=api-prod","affected":[{"type":"plugin","slug":"wp-ajax-contact-form","name":"WP Ajax Contact Form","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:00:53Z"},{"id":"wordfence:3e0231cf-7de7-4fe7-a0fe-20657f727fef","source":"wordfence","cve":"CVE-2020-25380","title":"Recall Products <= 0.8 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0231cf-7de7-4fe7-a0fe-20657f727fef?source=api-prod","affected":[{"type":"plugin","slug":"recall-products","name":"Recall Products","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e037931-870f-45eb-973c-0276911682ad","source":"wordfence","cve":"CVE-2026-5130","title":"Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation","severity":"high","cvss":8.8,"cwe":"CWE-565","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e037931-870f-45eb-973c-0276911682ad?source=api-prod","affected":[{"type":"plugin","slug":"debugger-troubleshooter","name":"Debugger & Troubleshooter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-03-30T09:30:13Z","updated":"2026-03-30T22:24:59Z"},{"id":"wordfence:3e03bc79-b42e-4015-8476-2b0488c71028","source":"wordfence","cve":"CVE-2020-35945","title":"Elegant Themes (Multiple Versions) - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e03bc79-b42e-4015-8476-2b0488c71028?source=api-prod","affected":[{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.5.3"},{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.5.3"},{"type":"theme","slug":"extra","name":"Divi Extra","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e03ecc0-5ca1-4d64-a6d7-257325bcc5cb","source":"wordfence","cve":"CVE-2023-45054","title":"Product Category Tree <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e03ecc0-5ca1-4d64-a6d7-257325bcc5cb?source=api-prod","affected":[{"type":"plugin","slug":"product-category-tree","name":"Product Category Tree","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e047822-5766-4e7f-be89-f4a15f0e6d51","source":"wordfence","cve":"CVE-2026-1244","title":"Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e047822-5766-4e7f-be89-f4a15f0e6d51?source=api-prod","affected":[{"type":"plugin","slug":"forms-bridge","name":"Forms Bridge \u2013 Infinite integrations","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-01-27T17:37:58Z","updated":"2026-01-28T06:43:42Z"},{"id":"wordfence:3e062157-bfde-46f8-92a1-2235dd9822f7","source":"wordfence","cve":"CVE-2025-26544","title":"UTM tags tracking for Contact Form 7 <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e062157-bfde-46f8-92a1-2235dd9822f7?source=api-prod","affected":[{"type":"plugin","slug":"cf7-utm-tracking","name":"UTM tags + Landing page + \"gclid\" tracking for Contact Form 7","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T18:01:18Z"},{"id":"wordfence:3e067b10-aa78-4cef-b3fd-b91595c54a37","source":"wordfence","cve":"CVE-2025-64354","title":"Gutenberg <= 21.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e067b10-aa78-4cef-b3fd-b91595c54a37?source=api-prod","affected":[{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"*","from_inclusive":true,"to":"21.8.2","to_inclusive":true,"patched_in":"21.9.0"}],"published":"2025-10-25T00:00:00Z","updated":"2025-11-03T18:09:56Z"},{"id":"wordfence:3e0b4faf-35cd-4f59-ae77-fb4f4819ad32","source":"wordfence","cve":"","title":"WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0b4faf-35cd-4f59-ae77-fb4f4819ad32?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-10T19:34:38Z"},{"id":"wordfence:3e0b66b9-2e33-41e0-a024-35574716c91d","source":"wordfence","cve":"CVE-2024-13617","title":"Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0b66b9-2e33-41e0-a024-35574716c91d?source=api-prod","affected":[{"type":"plugin","slug":"aoa-downloadable","name":"Downloable by American Osteopathic Association","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-13T14:34:53Z"},{"id":"wordfence:3e0be093-d61a-4634-ba9b-91dd7328e8cd","source":"wordfence","cve":"CVE-2025-1324","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0be093-d61a-4634-ba9b-91dd7328e8cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.10","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T09:22:54Z"},{"id":"wordfence:3e0da463-2ba0-43ca-927c-55c12643ef32","source":"wordfence","cve":"CVE-2026-8351","title":"RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0da463-2ba0-43ca-927c-55c12643ef32?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-07-02T17:43:25Z","updated":"2026-07-03T06:50:10Z"},{"id":"wordfence:3e0e022b-857d-4e7f-99d2-3837014c254e","source":"wordfence","cve":"CVE-2014-4568","title":"Video Posts Webcam Recorder <= 1.55.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0e022b-857d-4e7f-99d2-3837014c254e?source=api-prod","affected":[{"type":"plugin","slug":"video-posts-webcam-recorder","name":"Webcam Microphone Screen Recorder \u2013 Media Capture","from":"*","from_inclusive":true,"to":"1.55.4","to_inclusive":true,"patched_in":"1.55.5"}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e0f0a0c-8ef8-419d-92bf-964166508ebc","source":"wordfence","cve":"CVE-2026-54812","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0f0a0c-8ef8-419d-92bf-964166508ebc?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.109","to_inclusive":true,"patched_in":"1.4.110"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:57:10Z"},{"id":"wordfence:3e0f7fa4-2d0d-4206-a3ff-97bf95c84808","source":"wordfence","cve":"CVE-2025-24666","title":"AI Chatbot for WordPress \u2013 Hyve Lite <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e0f7fa4-2d0d-4206-a3ff-97bf95c84808?source=api-prod","affected":[{"type":"plugin","slug":"hyve-lite","name":"Hyve Lite \u2013 AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:39:42Z"},{"id":"wordfence:3e1008ad-daa9-4785-9dd5-4cdeb10d7e59","source":"wordfence","cve":"CVE-2024-1296","title":"Brizy \u2013 Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1008ad-daa9-4785-9dd5-4cdeb10d7e59?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.40","to_inclusive":true,"patched_in":"2.4.41"}],"published":"2024-02-23T00:00:00Z","updated":"2024-03-13T15:26:45Z"},{"id":"wordfence:3e10e25e-7d92-4374-8c8e-479cc0dabb1c","source":"wordfence","cve":"CVE-2024-29795","title":"Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e10e25e-7d92-4374-8c8e-479cc0dabb1c?source=api-prod","affected":[{"type":"plugin","slug":"ilab-media-tools","name":"Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more","from":"*","from_inclusive":true,"to":"4.5.24","to_inclusive":true,"patched_in":"4.5.25"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:05:43Z"},{"id":"wordfence:3e1425e6-799b-48fb-b04c-36b906297150","source":"wordfence","cve":"","title":"Images Asynchronous Load <= 1.05 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1425e6-799b-48fb-b04c-36b906297150?source=api-prod","affected":[{"type":"plugin","slug":"images-asynchronous-load","name":"Images Asynchronous Load","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":"1.06"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e1497d7-64e8-4c2a-97f7-8dfa3bbc2820","source":"wordfence","cve":"CVE-2024-5713","title":"If-So Dynamic Content Personalization <= 1.8.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1497d7-64e8-4c2a-97f7-8dfa3bbc2820?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.8.0.3","to_inclusive":true,"patched_in":"1.8.0.4"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T19:10:10Z"},{"id":"wordfence:3e152d9f-4fb9-41b9-baa4-b1bebac89641","source":"wordfence","cve":"CVE-2022-0503","title":"Multisite Content Copier/Updater Pro < 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e152d9f-4fb9-41b9-baa4-b1bebac89641?source=api-prod","affected":[{"type":"plugin","slug":"wp-multisite-content-copier-pro","name":"WordPress Multisite Content Copier/Updater Pro","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e15668b-8f05-4f1f-9cca-24f88081bdec","source":"wordfence","cve":"CVE-2025-32506","title":"AT Internet SmartTag <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e15668b-8f05-4f1f-9cca-24f88081bdec?source=api-prod","affected":[{"type":"plugin","slug":"at-internet","name":"AT Internet SmartTag","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:13:05Z"},{"id":"wordfence:3e16da38-709a-4b9a-9f00-efe8459a1318","source":"wordfence","cve":"CVE-2025-14164","title":"Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e16da38-709a-4b9a-9f00-efe8459a1318?source=api-prod","affected":[{"type":"plugin","slug":"quran-gateway","name":"Quran Gateway","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:07:36Z","updated":"2025-12-20T03:20:21Z"},{"id":"wordfence:3e1864e7-bd3b-431f-9a9d-378b376298f9","source":"wordfence","cve":"CVE-2023-6081","title":"Chartjs <= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1864e7-bd3b-431f-9a9d-378b376298f9?source=api-prod","affected":[{"type":"plugin","slug":"enigma-chartjs","name":"enigma-chartjs","from":"*","from_inclusive":true,"to":"2023.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e1a84c6-e28b-42fe-a16a-aeb227cfe956","source":"wordfence","cve":"CVE-2025-5487","title":"AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1a84c6-e28b-42fe-a16a-aeb227cfe956?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2025-06-13T17:44:57Z","updated":"2025-06-14T06:41:29Z"},{"id":"wordfence:3e1e6fb1-af66-460e-9fb1-8d14a8cbbea5","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 1.72 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1e6fb1-af66-460e-9fb1-8d14a8cbbea5?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"1.72","to_inclusive":true,"patched_in":"1.73"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e1f64f5-090a-4961-8490-d34f458a8d44","source":"wordfence","cve":"","title":"JS Job Manager < 1.1.9 - Arbitrary Plugin Installation/Activation","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1f64f5-090a-4961-8490-d34f458a8d44?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2021-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e21b550-e1c5-4e23-9999-16c837353da9","source":"wordfence","cve":"CVE-2026-4030","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e21b550-e1c5-4e23-9999-16c837353da9?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-14T12:32:10Z"},{"id":"wordfence:3e270633-0031-41c1-98ac-ce96cd599a60","source":"wordfence","cve":"CVE-2025-12172","title":"Mailchimp List Subscribe Form <= 2.0.0 - Cross-Site Request Forgery to Mailchimp List Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e270633-0031-41c1-98ac-ce96cd599a60?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp","name":"Mailchimp List Subscribe Form","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-02-18T14:55:46Z","updated":"2026-02-19T03:25:12Z"},{"id":"wordfence:3e27c0b0-c74f-47ad-b9ed-9fd6bd05d040","source":"wordfence","cve":"CVE-2026-7525","title":"My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e27c0b0-c74f-47ad-b9ed-9fd6bd05d040?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-14T03:27:14Z"},{"id":"wordfence:3e282a23-07e8-464a-9d6e-a2eb506064bc","source":"wordfence","cve":"CVE-2021-24432","title":"Advanced AJAX Product Filters <= 1.5.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e282a23-07e8-464a-9d6e-a2eb506064bc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ajax-filters","name":"Advanced AJAX Product Filters","from":"*","from_inclusive":true,"to":"1.5.4.6","to_inclusive":true,"patched_in":"1.5.4.7"}],"published":"2021-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e28e008-0ec1-4262-9ac0-6170cf8b8bdf","source":"wordfence","cve":"CVE-2026-104736","title":"LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-16T14:33:32Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:3e292a1f-d475-4c52-b790-b5215e1870ad","source":"wordfence","cve":"CVE-2019-20212","title":"CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e292a1f-d475-4c52-b790-b5215e1870ad?source=api-prod","affected":[{"type":"theme","slug":"easybook","name":"EasyBook \u2013 Hotel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"theme","slug":"townhub","name":"TownHub - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"citybook","name":"CityBook - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2019-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e2a9d71-21ef-45a1-99ed-477066ce9620","source":"wordfence","cve":"CVE-2020-36668","title":"JetBackup \u2013 WP Backup, Migrate & Restore <= 1.4.0 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2a9d71-21ef-45a1-99ed-477066ce9620?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2020-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e2af005-0bc2-445c-956a-ef6139abfee4","source":"wordfence","cve":"CVE-2022-0969","title":"Image optimization & Lazy Load <= 3.3.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2af005-0bc2-445c-956a-ef6139abfee4?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e2d1a3e-dfb4-423a-9783-98677703abeb","source":"wordfence","cve":"CVE-2026-66479","title":"WPComplete <= 2.9.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2d1a3e-dfb4-423a-9783-98677703abeb?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.6","to_inclusive":true,"patched_in":"2.9.5.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:32:05Z"},{"id":"wordfence:3e2e8dfb-df74-41b7-9b3b-0f5d7b1c545b","source":"wordfence","cve":"","title":"YOP Poll <= 6.1.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2e8dfb-df74-41b7-9b3b-0f5d7b1c545b?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":false,"patched_in":"6.1.5"}],"published":"2020-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e343ea3-996c-47c7-9480-e6264cbded98","source":"wordfence","cve":"CVE-2024-9058","title":"Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e343ea3-996c-47c7-9480-e6264cbded98?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.6"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T06:50:55Z"},{"id":"wordfence:3e348b24-4c49-43ed-b4f3-b31f0f709830","source":"wordfence","cve":"CVE-2024-11759","title":"Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e348b24-4c49-43ed-b4f3-b31f0f709830?source=api-prod","affected":[{"type":"plugin","slug":"bukza","name":"Bukza","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T04:23:41Z"},{"id":"wordfence:3e34e774-30fe-49dc-b1f8-8dd63da65d23","source":"wordfence","cve":"CVE-2024-32450","title":"WpTravelly <= 1.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e34e774-30fe-49dc-b1f8-8dd63da65d23?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T20:53:11Z"},{"id":"wordfence:3e374887-0062-4ca2-8e43-13a6c4207f84","source":"wordfence","cve":"CVE-2023-24002","title":"YouTube Embed <= 2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e374887-0062-4ca2-8e43-13a6c4207f84?source=api-prod","affected":[{"type":"plugin","slug":"youtube-video-player","name":"YouTube Embed, Playlist and Popup by WpDevArt","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e394ee2-13c1-4b04-a8a5-4642f1794d59","source":"wordfence","cve":"CVE-2025-1681","title":"Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e394ee2-13c1-4b04-a8a5-4642f1794d59?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-27T23:22:38Z"},{"id":"wordfence:3e3b5433-e17b-4ece-9e5c-ef4d818068dc","source":"wordfence","cve":"CVE-2025-11770","title":"BrightTALK WordPress Shortcode <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3b5433-e17b-4ece-9e5c-ef4d818068dc?source=api-prod","affected":[{"type":"plugin","slug":"brighttalk-wp-shortcode","name":"BrightTALK WordPress Shortcode","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:22:02Z","updated":"2025-11-21T07:31:49Z"},{"id":"wordfence:3e3c9f08-9e73-4791-b6ca-2c8b9dc3fb81","source":"wordfence","cve":"CVE-2023-5307","title":"Contest Gallery < 21.2.8.1 - Unauthenticated Stored Cross-Site Scripting via headers","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3c9f08-9e73-4791-b6ca-2c8b9dc3fb81?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.2.8.1","to_inclusive":false,"patched_in":"21.2.8.1"}],"published":"2023-10-10T00:00:00Z","updated":"2026-09-04T00:42:34Z"},{"id":"wordfence:3e3d8f45-a0c1-42b3-b179-9a3ca3009651","source":"wordfence","cve":"CVE-2026-110762","title":"bbPress < 2.6.19 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3d8f45-a0c1-42b3-b179-9a3ca3009651?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.19","to_inclusive":false,"patched_in":""}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:34:48Z"},{"id":"wordfence:3e3dc509-73c3-4869-b520-6f5c1d691184","source":"wordfence","cve":"CVE-2023-24380","title":"Simple Wp Sitemap <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3dc509-73c3-4869-b520-6f5c1d691184?source=api-prod","affected":[{"type":"plugin","slug":"simple-wp-sitemap","name":"Simple Wp Sitemap","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e41ab01-836f-4658-ab2e-c56c7cb2feb4","source":"wordfence","cve":"CVE-2026-32347","title":"Restaurant and Cafe <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e41ab01-836f-4658-ab2e-c56c7cb2feb4?source=api-prod","affected":[{"type":"theme","slug":"restaurant-and-cafe","name":"Restaurant and Cafe","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:48:23Z"},{"id":"wordfence:3e44b1e6-7342-4788-af80-aac6319f5246","source":"wordfence","cve":"CVE-2024-35629","title":"Easy Digital Downloads \u2013 Recent Purchases <= 1.0.2 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e44b1e6-7342-4788-af80-aac6319f5246?source=api-prod","affected":[{"type":"plugin","slug":"edd-recent-purchases","name":"Easy Digital Downloads \u2013 Recent Purchases","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-05T13:43:27Z"},{"id":"wordfence:3e44eeb0-c368-4490-9aa2-22c22046e2ec","source":"wordfence","cve":"CVE-2026-27331","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e44eeb0-c368-4490-9aa2-22c22046e2ec?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:13:58Z"},{"id":"wordfence:3e46a552-b0cc-4f46-a19e-1912244b5179","source":"wordfence","cve":"CVE-2025-23785","title":"AI Responsive Gallery Album <= 1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e46a552-b0cc-4f46-a19e-1912244b5179?source=api-prod","affected":[{"type":"plugin","slug":"ai-responsive-gallery-album","name":"AI Responsive Gallery Album","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:06:16Z"},{"id":"wordfence:3e46e6f4-c157-4d7a-8f50-f8c8213460fa","source":"wordfence","cve":"CVE-2025-47566","title":"ZoomSounds <= 6.91 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e46e6f4-c157-4d7a-8f50-f8c8213460fa?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T19:53:39Z"},{"id":"wordfence:3e471ef4-94c1-47d9-98ae-f79f7662e21a","source":"wordfence","cve":"","title":"Woocommerce Open Close \u2013 Best Business Schedules Manager <= 4.3.0  - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e471ef4-94c1-47d9-98ae-f79f7662e21a?source=api-prod","affected":[{"type":"plugin","slug":"woc-open-close","name":"Open Close Store for WooCommerce \u2013 Business Hours & Order Scheduling","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2022-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e477f41-8765-472a-b48b-d381cf7de5c6","source":"wordfence","cve":"","title":"Photolio Theme (All Known Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e477f41-8765-472a-b48b-d381cf7de5c6?source=api-prod","affected":[{"type":"theme","slug":"photolio","name":"photolio","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e4aaf2e-a0c6-47d2-9eb8-d65952a74424","source":"wordfence","cve":"","title":"OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e4aaf2e-a0c6-47d2-9eb8-d65952a74424?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e4da578-aa8d-40b4-98c7-3efef911f850","source":"wordfence","cve":"CVE-2019-15323","title":"Ad Inserter <= 2.4.19 - Authenticated Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e4da578-aa8d-40b4-98c7-3efef911f850?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.4.19","to_inclusive":true,"patched_in":"2.4.20"}],"published":"2019-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e5360e0-606b-400a-8cbe-fbcf96335861","source":"wordfence","cve":"CVE-2026-109695","title":"FluentCart A New Era of eCommerce \u2013 Faster, Lighter, and Simpler <= 1.7.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5360e0-606b-400a-8cbe-fbcf96335861?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-13T10:57:39Z","updated":"2026-10-23T18:26:56Z"},{"id":"wordfence:3e55591e-c1e9-4667-b04f-4956d2f37d51","source":"wordfence","cve":"CVE-2024-5596","title":"ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e55591e-c1e9-4667-b04f-4956d2f37d51?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-22T05:47:58Z"},{"id":"wordfence:3e557a3d-e520-42df-bbfa-26208e8964dd","source":"wordfence","cve":"CVE-2025-62966","title":"GoCache <= 1.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e557a3d-e520-42df-bbfa-26208e8964dd?source=api-prod","affected":[{"type":"plugin","slug":"gocache-cdn","name":"GoCache","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-10-17T00:00:00Z","updated":"2026-09-09T15:53:35Z"},{"id":"wordfence:3e57ba2b-a95c-4410-9ba6-a66c6da36883","source":"wordfence","cve":"CVE-2019-6267","title":"Easy Redirect Manager <= 2.18.18 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e57ba2b-a95c-4410-9ba6-a66c6da36883?source=api-prod","affected":[{"type":"plugin","slug":"easy-redirect-manager","name":"Easy Redirect Manager","from":"*","from_inclusive":true,"to":"2.18.18","to_inclusive":true,"patched_in":""}],"published":"2019-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e5800fa-e0d7-435f-98c2-6d91df26d657","source":"wordfence","cve":"CVE-2022-1092","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin  <= 2.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5800fa-e0d7-435f-98c2-6d91df26d657?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2022-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e5a7741-d8be-400e-ac00-138034580d6e","source":"wordfence","cve":"CVE-2026-22330","title":"Right Way <= 4.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5a7741-d8be-400e-ac00-138034580d6e?source=api-prod","affected":[{"type":"theme","slug":"rightway","name":"Right Way | Election Campaign and Political Candidate WordPress Theme","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:20:14Z"},{"id":"wordfence:3e5ad3a7-03c5-4085-b330-bc77e7e46cea","source":"wordfence","cve":"CVE-2025-13146","title":"Contact Form 7 \u2013 Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5ad3a7-03c5-4085-b330-bc77e7e46cea?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-07-21T23:24:39Z","updated":"2026-10-26T05:36:55Z"},{"id":"wordfence:3e5b00da-4182-4777-aa8e-bc9cd3f3883f","source":"wordfence","cve":"CVE-2026-73398","title":"Piraeus Bank WooCommerce Payment Gateway  3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5b00da-4182-4777-aa8e-bc9cd3f3883f?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-for-piraeus-bank","name":"Piraeus Bank WooCommerce Payment Gateway","from":"3.2.0","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:39:18Z"},{"id":"wordfence:3e5cf0f0-f933-4782-82b9-099b65371c89","source":"wordfence","cve":"CVE-2024-53721","title":"Advanced Event Manager <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5cf0f0-f933-4782-82b9-099b65371c89?source=api-prod","affected":[{"type":"plugin","slug":"advanced-event-manager","name":"Advanced Event Manager","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:41:28Z"},{"id":"wordfence:3e5f3eac-d2da-43ea-9303-731d78102372","source":"wordfence","cve":"CVE-2024-31432","title":"Restrict Content <= 3.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e5f3eac-d2da-43ea-9303-731d78102372?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:39:51Z"},{"id":"wordfence:3e60a315-7f74-4d81-b6d2-ad3d40d489ef","source":"wordfence","cve":"CVE-2026-0694","title":"SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e60a315-7f74-4d81-b6d2-ad3d40d489ef?source=api-prod","affected":[{"type":"plugin","slug":"searchwiz","name":"SearchWiz","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:43:30Z","updated":"2026-01-14T05:28:07Z"},{"id":"wordfence:3e619e8e-e04b-4e42-9cee-65e5dedff3b6","source":"wordfence","cve":"CVE-2008-4733","title":"WP Comment Remix <= 1.4.3 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e619e8e-e04b-4e42-9cee-65e5dedff3b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-remix","name":"WP Comment Remix","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2008-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e61c868-b430-4aa6-8664-ae237db73d66","source":"wordfence","cve":"CVE-2017-10837","title":"BackupGuard <= 1.1.46 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e61c868-b430-4aa6-8664-ae237db73d66?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.1.46","to_inclusive":true,"patched_in":"1.1.47"}],"published":"2017-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e62eba7-1ac9-4420-8692-58a169aa4330","source":"wordfence","cve":"CVE-2024-7134","title":"LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e62eba7-1ac9-4420-8692-58a169aa4330?source=api-prod","affected":[{"type":"plugin","slug":"wp-poll","name":"LiquidPoll \u2013 Polls, Surveys, NPS and Feedback Reviews","from":"*","from_inclusive":true,"to":"3.3.78","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:21:36Z","updated":"2024-08-21T05:30:19Z"},{"id":"wordfence:3e63a70c-924b-4736-a712-80538bfd7ca7","source":"wordfence","cve":"CVE-2016-10969","title":"SupportFlow <= 0.6 - Stored Cross-Site Scripting via discussion ticket title","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e63a70c-924b-4736-a712-80538bfd7ca7?source=api-prod","affected":[{"type":"plugin","slug":"supportflow","name":"SupportFlow","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":"0.7"}],"published":"2016-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e63ce97-40af-493d-9376-231a99d9bd58","source":"wordfence","cve":"CVE-2024-12157","title":"Popup \u2013 MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e63ce97-40af-493d-9376-231a99d9bd58?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-popup-creator","name":"Popup \u2013 MailChimp, GetResponse and ActiveCampaign Intergrations","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:43:50Z","updated":"2025-01-07T04:22:00Z"},{"id":"wordfence:3e650516-49eb-4475-8faa-76ca123d531f","source":"wordfence","cve":"CVE-2018-8711","title":"WOOF - Products Filter for WooCommerce <= 1.1.9 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e650516-49eb-4475-8faa-76ca123d531f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2018-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e66230c-dbe0-43a9-a292-250ccf06931f","source":"wordfence","cve":"CVE-2025-68589","title":"Telegram Widget and Join Link <= 2.2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e66230c-dbe0-43a9-a292-250ccf06931f?source=api-prod","affected":[{"type":"plugin","slug":"wptelegram-widget","name":"WP Telegram Widget and Join Link","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-13T16:54:44Z"},{"id":"wordfence:3e6678db-6933-4a38-b704-214de7197852","source":"wordfence","cve":"CVE-2024-51782","title":"Loginplus <= 1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e6678db-6933-4a38-b704-214de7197852?source=api-prod","affected":[{"type":"plugin","slug":"loginplus","name":"Loginplus","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:32:27Z"},{"id":"wordfence:3e6fb7b2-0d04-410f-84c7-55d20a29b6ab","source":"wordfence","cve":"CVE-2026-24962","title":"Sigmize <= 0.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e6fb7b2-0d04-410f-84c7-55d20a29b6ab?source=api-prod","affected":[{"type":"plugin","slug":"sigmize","name":"Sigmize: A/B Testing, Session Recordings, Heatmaps & Revenue Tracking for WooCommerce, SureCart & EDD","from":"*","from_inclusive":true,"to":"0.0.9","to_inclusive":true,"patched_in":"0.0.10"}],"published":"2026-02-07T00:00:00Z","updated":"2026-02-09T21:05:31Z"},{"id":"wordfence:3e6fbf8b-5df5-4371-9bdf-fab1b242149f","source":"wordfence","cve":"CVE-2026-39485","title":"Youtube Embed Plus <= 14.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e6fbf8b-5df5-4371-9bdf-fab1b242149f?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed-plus","name":"Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades","from":"*","from_inclusive":true,"to":"14.2.4","to_inclusive":true,"patched_in":"14.2.5"}],"published":"2026-03-06T00:00:00Z","updated":"2026-04-15T21:09:34Z"},{"id":"wordfence:3e70126f-8869-4e17-99a1-5d5c8790229e","source":"wordfence","cve":"CVE-2026-77773","title":"Social Contact Form (FormyChat) <= 2.15.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e70126f-8869-4e17-99a1-5d5c8790229e?source=api-prod","affected":[{"type":"plugin","slug":"social-contact-form","name":"Contact Form to Chat Apps | Click to Chat to Order \u2013 FormyChat","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T17:45:55Z"},{"id":"wordfence:3e7105d3-3208-4964-8d21-172059cbbd63","source":"wordfence","cve":"CVE-2025-55713","title":"Blocksy <= 2.1.6 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7105d3-3208-4964-8d21-172059cbbd63?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:48:01Z"},{"id":"wordfence:3e72644c-138d-4733-bcca-a8305273d1a0","source":"wordfence","cve":"CVE-2025-12538","title":"Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e72644c-138d-4733-bcca-a8305273d1a0?source=api-prod","affected":[{"type":"plugin","slug":"fleet","name":"Fleet Manager","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-11-10T14:58:43Z","updated":"2025-12-11T14:20:29Z"},{"id":"wordfence:3e742b21-1097-459c-8c67-46d105e7b6e8","source":"wordfence","cve":"CVE-2021-24611","title":"Keyword Meta <= 3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e742b21-1097-459c-8c67-46d105e7b6e8?source=api-prod","affected":[{"type":"plugin","slug":"keyword-meta","name":"Keyword Meta","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e744c77-efa2-4910-af18-56aa15424412","source":"wordfence","cve":"CVE-2014-10389","title":"WP Support Plus Responsive Ticket System <= 4.1 - Improper Authentication","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e744c77-efa2-4910-af18-56aa15424412?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2014-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e747b4b-3865-4e31-b584-e11e35d4c3c4","source":"wordfence","cve":"CVE-2025-28915","title":"ThemeEgg ToolKit <= 1.2.9 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e747b4b-3865-4e31-b584-e11e35d4c3c4?source=api-prod","affected":[{"type":"plugin","slug":"themeegg-toolkit","name":"ThemeEgg ToolKit","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:14:58Z"},{"id":"wordfence:3e75cdd9-54cb-46de-8647-b92831324774","source":"wordfence","cve":"CVE-2024-37950","title":"Master Popups <= 1.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e75cdd9-54cb-46de-8647-b92831324774?source=api-prod","affected":[{"type":"plugin","slug":"master-popups-lite","name":"Master Popups","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:24:49Z"},{"id":"wordfence:3e765e05-9be1-40fa-97f2-a6e57728cb85","source":"wordfence","cve":"CVE-2026-7547","title":"Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e765e05-9be1-40fa-97f2-a6e57728cb85?source=api-prod","affected":[{"type":"plugin","slug":"integration-marktplaats-for-woocommerce","name":"Woosa \u2013 Marktplaats for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-06-18T16:04:32Z","updated":"2026-06-19T04:31:32Z"},{"id":"wordfence:3e76c4b3-af77-4c02-a923-f04a360fa6e0","source":"wordfence","cve":"CVE-2021-24613","title":"Post Views Counter <= 1.3.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e76c4b3-af77-4c02-a923-f04a360fa6e0?source=api-prod","affected":[{"type":"plugin","slug":"post-views-counter","name":"Post Views Counter","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e772760-f390-417f-82d0-f415a6ef837d","source":"wordfence","cve":"CVE-2022-1579","title":"Login Block IPs <= 1.0.0 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e772760-f390-417f-82d0-f415a6ef837d?source=api-prod","affected":[{"type":"plugin","slug":"login-block-ips","name":"Login Block IPs","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e78369e-976e-4086-bf82-ac7d3604e1c6","source":"wordfence","cve":"CVE-2025-62965","title":"Admin Management Xtended  <= 2.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e78369e-976e-4086-bf82-ac7d3604e1c6?source=api-prod","affected":[{"type":"plugin","slug":"admin-management-xtended","name":"Admin Management Xtended","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-10-17T00:00:00Z","updated":"2026-01-13T16:35:51Z"},{"id":"wordfence:3e7a63d2-fbe2-45e5-a042-ec8eb4edabdd","source":"wordfence","cve":"CVE-2025-25110","title":"Event Kikfyre <= 2.1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7a63d2-fbe2-45e5-a042-ec8eb4edabdd?source=api-prod","affected":[{"type":"plugin","slug":"kikfyre-events-calendar-tickets","name":"Events, Calendars & Tickets \u2013 Event Kikfyre","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:06:46Z"},{"id":"wordfence:3e7bd708-2e82-4fef-85f2-bf4f56f66bc4","source":"wordfence","cve":"CVE-2024-5424","title":"Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7bd708-2e82-4fef-85f2-bf4f56f66bc4?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-06-27T20:19:59Z","updated":"2024-06-28T08:33:29Z"},{"id":"wordfence:3e7d10ab-2525-407b-b814-ef7d884d5287","source":"wordfence","cve":"CVE-2024-24928","title":"Content Cards <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7d10ab-2525-407b-b814-ef7d884d5287?source=api-prod","affected":[{"type":"plugin","slug":"content-cards","name":"Content Cards","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T18:34:07Z"},{"id":"wordfence:3e7d7245-59aa-4dfa-88b8-b8e054fba7bf","source":"wordfence","cve":"CVE-2025-53570","title":"DELUCKS SEO <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7d7245-59aa-4dfa-88b8-b8e054fba7bf?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:02:27Z"},{"id":"wordfence:3e7eed9d-2d44-4951-b66b-7d8995ca617d","source":"wordfence","cve":"CVE-2026-4658","title":"Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e7eed9d-2d44-4951-b66b-7d8995ca617d?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2026-05-01T16:12:21Z","updated":"2026-05-02T04:27:46Z"},{"id":"wordfence:3e815531-f966-44a1-a037-8077a40c83b0","source":"wordfence","cve":"CVE-2024-6312","title":"Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e815531-f966-44a1-a037-8077a40c83b0?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.7.3.2","to_inclusive":true,"patched_in":"3.7.4.1"}],"published":"2024-08-27T00:00:00Z","updated":"2024-12-28T06:55:59Z"},{"id":"wordfence:3e82448a-43d8-4a01-a576-08e289b67442","source":"wordfence","cve":"CVE-2026-56029","title":"CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e82448a-43d8-4a01-a576-08e289b67442?source=api-prod","affected":[{"type":"plugin","slug":"corvuspay-woocommerce-integration","name":"CorvusPay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T14:00:18Z"},{"id":"wordfence:3e85543e-bad3-4415-8b10-cecaac7742ce","source":"wordfence","cve":"CVE-2024-53709","title":"Generic Elements <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e85543e-bad3-4415-8b10-cecaac7742ce?source=api-prod","affected":[{"type":"plugin","slug":"generic-elements-for-elementor","name":"Generic Elements","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-11-22T00:00:00Z","updated":"2025-11-05T21:56:12Z"},{"id":"wordfence:3e85adbd-7e82-4949-916b-20aba1f97bf1","source":"wordfence","cve":"CVE-2021-25106","title":"Privacy Policy Generator, Terms & Conditions Generator - WPLegalPages <= 2.7.0 - Arbitrary Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e85adbd-7e82-4949-916b-20aba1f97bf1?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":false,"patched_in":"2.7.1"}],"published":"2022-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e85ecd6-ed42-4875-9636-e2acbace5d83","source":"wordfence","cve":"CVE-2025-49347","title":"sIFR <= 0.6.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e85ecd6-ed42-4875-9636-e2acbace5d83?source=api-prod","affected":[{"type":"plugin","slug":"wp-sifr","name":"WP sIFR","from":"*","from_inclusive":true,"to":"0.6.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-10T15:51:11Z"},{"id":"wordfence:3e8a25d1-4bd8-4ecf-ac10-a333abaac328","source":"wordfence","cve":"","title":"Image Intense <= 3.2.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8a25d1-4bd8-4ecf-ac10-a333abaac328?source=api-prod","affected":[{"type":"plugin","slug":"image-intense","name":"Image Intense","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2018-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e8a881d-d6d0-4bcc-9894-286ce0468393","source":"wordfence","cve":"CVE-2018-18018","title":"Slideshow Gallery <= 1.6.8 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8a881d-d6d0-4bcc-9894-286ce0468393?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2018-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e8bf22a-a2bf-411a-89b6-ffd576b22c9f","source":"wordfence","cve":"CVE-2025-22779","title":"WP News Sliders <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8bf22a-a2bf-411a-89b6-ffd576b22c9f?source=api-prod","affected":[{"type":"plugin","slug":"wp-news-sliders","name":"WP News Sliders","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:25:01Z"},{"id":"wordfence:3e8d9909-7b98-4d98-8293-0c30eebc6c7b","source":"wordfence","cve":"CVE-2023-49744","title":"Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8d9909-7b98-4d98-8293-0c30eebc6c7b?source=api-prod","affected":[{"type":"plugin","slug":"gift-up","name":"Gift Up Gift Cards for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"2.21.3","to_inclusive":true,"patched_in":"2.22"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e8fe670-5072-43c2-8ff6-e8730d24b9cd","source":"wordfence","cve":"","title":"Qiniu Uploader <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8fe670-5072-43c2-8ff6-e8730d24b9cd?source=api-prod","affected":[{"type":"plugin","slug":"qiniu-uploader","name":"Qiniu Uploader","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e8ff1f4-1217-4bb5-ba2d-6d2ff847072a","source":"wordfence","cve":"CVE-2022-4628","title":"Easy PayPal Buy Now Button <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e8ff1f4-1217-4bb5-ba2d-6d2ff847072a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e900c98-5ab1-4674-b820-553c44df7c02","source":"wordfence","cve":"CVE-2022-40219","title":"FavIcon Switcher <= 1.2.11 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e900c98-5ab1-4674-b820-553c44df7c02?source=api-prod","affected":[{"type":"plugin","slug":"favicon-switcher","name":"FavIcon Switcher","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e90a515-d164-4468-b2be-22c8f1039c4a","source":"wordfence","cve":"CVE-2025-24583","title":"12 Step Meeting List <= 3.16.5 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e90a515-d164-4468-b2be-22c8f1039c4a?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.16.5","to_inclusive":true,"patched_in":"3.16.6"}],"published":"2024-12-18T00:00:00Z","updated":"2025-04-22T21:20:05Z"},{"id":"wordfence:3e91fabe-469f-4743-bb8d-76ef20313b37","source":"wordfence","cve":"CVE-2021-36909","title":"WP Reset \u2013 Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e91fabe-469f-4743-bb8d-76ef20313b37?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset Pro \u2013 Most Advanced WordPress Reset Tool","from":"5.00","from_inclusive":true,"to":"5.98","to_inclusive":true,"patched_in":"5.99"}],"published":"2021-11-10T14:22:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e9672b1-6d00-45bc-91ef-0c5583b5306e","source":"wordfence","cve":"CVE-2022-4160","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9672b1-6d00-45bc-91ef-0c5583b5306e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3e9b6514-e727-42fe-8893-a317b71b2760","source":"wordfence","cve":"CVE-2025-14080","title":"Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9b6514-e727-42fe-8893-a317b71b2760?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission-manager-lite","name":"Frontend Post Submission Manager Lite \u2013 Guest Post and Frontend Submission Forms","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-12-20T14:15:18Z","updated":"2025-12-21T02:20:30Z"},{"id":"wordfence:3e9bcc72-e434-4f6f-9e90-eec8cad31035","source":"wordfence","cve":"CVE-2025-11768","title":"Islamic Phrases <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9bcc72-e434-4f6f-9e90-eec8cad31035?source=api-prod","affected":[{"type":"plugin","slug":"islamic-phrases","name":"Islamic Phrases","from":"*","from_inclusive":true,"to":"2.12.2015","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:17:13Z","updated":"2025-11-21T07:31:50Z"},{"id":"wordfence:3e9bdb9d-bffe-4f6f-bb91-3dc5f7009f68","source":"wordfence","cve":"CVE-2025-52760","title":"MultiSite Clone Duplicator <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9bdb9d-bffe-4f6f-bb91-3dc5f7009f68?source=api-prod","affected":[{"type":"plugin","slug":"multisite-clone-duplicator","name":"MultiSite Clone Duplicator","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T00:00:00Z","updated":"2025-10-29T21:05:43Z"},{"id":"wordfence:3e9da4a7-89ba-426c-943a-e7bc79a04d7c","source":"wordfence","cve":"CVE-2026-120550","title":"WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9da4a7-89ba-426c-943a-e7bc79a04d7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-11-05T20:45:56Z","updated":"2026-11-06T09:38:12Z"},{"id":"wordfence:3ea00ce9-e48f-4641-844c-ced7db60d62d","source":"wordfence","cve":"CVE-2025-10130","title":"Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea00ce9-e48f-4641-844c-ced7db60d62d?source=api-prod","affected":[{"type":"plugin","slug":"layers","name":"Layers","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"1.0"}],"published":"2025-09-29T15:31:17Z","updated":"2025-10-02T22:26:56Z"},{"id":"wordfence:3ea04257-a853-4501-9de7-5a4992c32ae9","source":"wordfence","cve":"CVE-2025-58258","title":"Lazy Blocks <= 4.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea04257-a853-4501-9de7-5a4992c32ae9?source=api-prod","affected":[{"type":"plugin","slug":"lazy-blocks","name":"Custom Block Builder \u2013 Lazy Blocks","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:35:59Z"},{"id":"wordfence:3ea27f09-30fa-411c-9782-15122ac204d9","source":"wordfence","cve":"CVE-2026-16257","title":"Arvow AI SEO Writer <= 1.5.3 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea27f09-30fa-411c-9782-15122ac204d9?source=api-prod","affected":[{"type":"plugin","slug":"journalist-ai","name":"Arvow AI SEO Writer","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-17T15:06:16Z"},{"id":"wordfence:3ea52e59-d81c-4a3f-953e-34f8214c01d8","source":"wordfence","cve":"","title":"Ads Box <= 1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea52e59-d81c-4a3f-953e-34f8214c01d8?source=api-prod","affected":[{"type":"plugin","slug":"ads-box","name":"Ads Box","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ea8046a-b4cf-4122-b6f2-4945bc9c99ac","source":"wordfence","cve":"CVE-2024-5155","title":"Inquiry Cart <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea8046a-b4cf-4122-b6f2-4945bc9c99ac?source=api-prod","affected":[{"type":"plugin","slug":"inquiry-cart","name":"Inquiry cart","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:14:08Z"},{"id":"wordfence:3eab1e93-ecf1-4ac6-95b0-9a58c2de867a","source":"wordfence","cve":"","title":"Cooked <= 1.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eab1e93-ecf1-4ac6-95b0-9a58c2de867a?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.7.9.1"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ead3aee-3d72-4fc0-a613-700ec75fb0bb","source":"wordfence","cve":"CVE-2022-4826","title":"Simple Tooltips <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ead3aee-3d72-4fc0-a613-700ec75fb0bb?source=api-prod","affected":[{"type":"plugin","slug":"simple-tooltips","name":"Simple Tooltips","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3eb1f22d-e729-41c6-9235-47aa19da2fff","source":"wordfence","cve":"CVE-2026-22494","title":"Good Homes <= 1.3.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb1f22d-e729-41c6-9235-47aa19da2fff?source=api-prod","affected":[{"type":"theme","slug":"good-homes","name":"Good Homes - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:04:20Z"},{"id":"wordfence:3eb3533c-e33c-41db-b9cf-e9d71a0a5588","source":"wordfence","cve":"CVE-2025-8417","title":"Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb3533c-e33c-41db-b9cf-e9d71a0a5588?source=api-prod","affected":[{"type":"plugin","slug":"intelligent-importer","name":"Catalog Importer, Scraper & Crawler","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:49:08Z","updated":"2025-09-11T07:24:52Z"},{"id":"wordfence:3eb4b3e7-6aad-4201-b48b-c8d788eb8acf","source":"wordfence","cve":"","title":"Limit Attempts by BestWebSoft < 1.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb4b3e7-6aad-4201-b48b-c8d788eb8acf?source=api-prod","affected":[{"type":"plugin","slug":"limit-attempts","name":"Limit Attempts by BestWebSoft \u2013 WordPress Anti-Bot and Security Plugin for Login and Forms","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3eb67a46-49de-40c2-bbac-87f662f98d16","source":"wordfence","cve":"CVE-2026-22429","title":"Verdure - Organic Tea Shop WordPress Theme <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb67a46-49de-40c2-bbac-87f662f98d16?source=api-prod","affected":[{"type":"theme","slug":"verdure","name":"Verdure - Organic Tea Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:37:47Z"},{"id":"wordfence:3eb74ac2-ac5d-477b-8142-3e42953f859b","source":"wordfence","cve":"CVE-2024-11876","title":"Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb74ac2-ac5d-477b-8142-3e42953f859b?source=api-prod","affected":[{"type":"plugin","slug":"kredeum-nfts","name":"Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.10"}],"published":"2024-12-13T15:48:52Z","updated":"2025-01-06T16:13:47Z"},{"id":"wordfence:3eb84fa6-1e06-4368-9d9e-4b601b9a1b93","source":"wordfence","cve":"CVE-2025-63066","title":"Porto Theme - Functionality < 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb84fa6-1e06-4368-9d9e-4b601b9a1b93?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.7.3"}],"published":"2025-10-11T00:00:00Z","updated":"2026-02-26T15:20:28Z"},{"id":"wordfence:3ebaadf6-5085-4f2d-a377-34e318351449","source":"wordfence","cve":"CVE-2025-12354","title":"Live CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebaadf6-5085-4f2d-a377-34e318351449?source=api-prod","affected":[{"type":"plugin","slug":"live-css-preview","name":"Live CSS Preview","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-12-04T17:36:29Z","updated":"2026-02-03T19:50:43Z"},{"id":"wordfence:3ebac8bc-1dca-4bcd-a033-fb8ed210bf4e","source":"wordfence","cve":"CVE-2026-3178","title":"Name Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebac8bc-1dca-4bcd-a033-fb8ed210bf4e?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.32.1","to_inclusive":true,"patched_in":"1.33.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-11T11:09:14Z"},{"id":"wordfence:3ebc0e28-ced8-4fb0-818d-1452faf9660d","source":"wordfence","cve":"CVE-2024-34390","title":"Post Grid Master <= 3.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebc0e28-ced8-4fb0-818d-1452faf9660d?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.4.12"}],"published":"2024-05-06T00:00:00Z","updated":"2025-09-11T14:41:18Z"},{"id":"wordfence:3ebc324a-4858-4502-b962-a4e26ca7445e","source":"wordfence","cve":"","title":"Make A Statement (All Versions) - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebc324a-4858-4502-b962-a4e26ca7445e?source=api-prod","affected":[{"type":"theme","slug":"make_a_statement","name":"Make A Statement","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ebd05d5-a65d-49df-a865-882e9d17fc0f","source":"wordfence","cve":"CVE-2023-34004","title":"WooCommerce Box Office <= 1.1.50 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebd05d5-a65d-49df-a865-882e9d17fc0f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-box-office","name":"WooCommerce Box Office","from":"*","from_inclusive":true,"to":"1.1.50","to_inclusive":true,"patched_in":"1.1.51"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ebdb591-4fd4-4ea3-a0db-b934c67176de","source":"wordfence","cve":"CVE-2024-31288","title":"RapidLoad Power-Up for Autoptimize <= 2.2.11 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebdb591-4fd4-4ea3-a0db-b934c67176de?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:34:58Z"},{"id":"wordfence:3ebe25a7-fa4d-4e3f-b969-2ff3a8388b06","source":"wordfence","cve":"","title":"WP Fastest Cache <= 0.8.5.7 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebe25a7-fa4d-4e3f-b969-2ff3a8388b06?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.5.7","to_inclusive":true,"patched_in":"0.8.5.8"}],"published":"2016-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ebe7680-a76d-4178-a729-f0d79d861912","source":"wordfence","cve":"CVE-2020-36744","title":"NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebe7680-a76d-4178-a729-f0d79d861912?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ebebe75-155a-4097-95ec-f31c6047f19a","source":"wordfence","cve":"CVE-2024-32545","title":"Canva \u2013 Design beautiful blog graphics <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebebe75-155a-4097-95ec-f31c6047f19a?source=api-prod","affected":[{"type":"plugin","slug":"canva","name":"Canva \u2013 Design beautiful blog graphics","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:51:54Z"},{"id":"wordfence:3ebfc9f5-abb7-47bc-bd38-f60df1cccb5d","source":"wordfence","cve":"CVE-2024-2113","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebfc9f5-abb7-47bc-bd38-f60df1cccb5d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:43:59Z"},{"id":"wordfence:3ebff73e-1108-4049-9f0e-95a91a7f118d","source":"wordfence","cve":"CVE-2026-97227","title":"NextScripts: Social Networks Auto-Poster <= 4.4.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebff73e-1108-4049-9f0e-95a91a7f118d?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:29:59Z"},{"id":"wordfence:3ec00aaa-a236-4b99-8104-5062ed440920","source":"wordfence","cve":"CVE-2025-32245","title":"Apollo <= 3.6.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec00aaa-a236-4b99-8104-5062ed440920?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio7_html5_full_width_sticky_pro","name":"Apollo","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:16:31Z"},{"id":"wordfence:3ec14212-2112-41b5-9361-596df5ad9bb4","source":"wordfence","cve":"CVE-2026-66654","title":"Vehica Core <= 1.0.104 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec14212-2112-41b5-9361-596df5ad9bb4?source=api-prod","affected":[{"type":"plugin","slug":"vehica-core","name":"Vehica Core","from":"*","from_inclusive":true,"to":"1.0.104","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T12:55:42Z"},{"id":"wordfence:3ec2f684-fa04-4201-a826-1eed328821de","source":"wordfence","cve":"CVE-2014-5347","title":"Disqus Comment System < 2.76 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec2f684-fa04-4201-a826-1eed328821de?source=api-prod","affected":[{"type":"plugin","slug":"disqus-comment-system","name":"Disqus Comment System","from":"*","from_inclusive":true,"to":"2.76","to_inclusive":false,"patched_in":"2.76"}],"published":"2014-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ec44487-7529-46a8-b2eb-cc5fe0f8f062","source":"wordfence","cve":"CVE-2022-45352","title":"Betheme <= 26.6.2 - Missing Authorization to Theme Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec44487-7529-46a8-b2eb-cc5fe0f8f062?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.2","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ec48620-4969-43ff-bf42-72188dba001a","source":"wordfence","cve":"CVE-2025-23691","title":"Send to Twitter <= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec48620-4969-43ff-bf42-72188dba001a?source=api-prod","affected":[{"type":"plugin","slug":"send-to-twitter","name":"Send to Twitter","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:35:23Z"},{"id":"wordfence:3ec4e870-dd0f-4ec5-a03c-da47e6c1ef61","source":"wordfence","cve":"","title":"bbPress Login Register Links On Forum Topic Pages <= 2.7.5 -  Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec4e870-dd0f-4ec5-a03c-da47e6c1ef61?source=api-prod","affected":[{"type":"plugin","slug":"bbpress-login-register-links-on-forum-topic-pages","name":"bbPress Login Register Links On Forum Topic Pages","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2019-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ec54ec6-0ff1-4290-85d0-d691a1832627","source":"wordfence","cve":"CVE-2025-12505","title":"weDocs <= 2.1.14 - Missing Authorization to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec54ec6-0ff1-4290-85d0-d691a1832627?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2025-12-05T15:51:21Z","updated":"2025-12-06T04:37:50Z"},{"id":"wordfence:3ec6f678-2538-483b-bb2c-90243b006721","source":"wordfence","cve":"CVE-2025-62931","title":"MSN Partner Hub <= 2.8.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec6f678-2538-483b-bb2c-90243b006721?source=api-prod","affected":[{"type":"plugin","slug":"microsoft-start","name":"MSN Partner Hub","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-06T00:00:00Z","updated":"2025-10-29T14:57:48Z"},{"id":"wordfence:3ec6faa4-d8d3-4c5e-91b2-142164d3b481","source":"wordfence","cve":"CVE-2024-2657","title":"Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec6faa4-d8d3-4c5e-91b2-142164d3b481?source=api-prod","affected":[{"type":"plugin","slug":"font-farsi","name":"Font Farsi","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T19:56:17Z","updated":"2024-05-30T08:30:12Z"},{"id":"wordfence:3ec761eb-6bd9-4c19-a98d-cb4738922a84","source":"wordfence","cve":"CVE-2024-6550","title":"Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec761eb-6bd9-4c19-a98d-cb4738922a84?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-multiple-form-instances","name":"Gravity Forms: Multiple Form Instances","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-07-09T15:25:05Z","updated":"2024-07-10T03:32:35Z"},{"id":"wordfence:3ec77f96-c73a-44f7-afa2-673f68ee3582","source":"wordfence","cve":"CVE-2024-9544","title":"MapSVG - All Kinds of Maps and Store Locator for WordPress <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec77f96-c73a-44f7-afa2-673f68ee3582?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T21:10:21Z","updated":"2025-05-22T09:21:51Z"},{"id":"wordfence:3ec7f51d-5d65-40ff-9fe5-0fa6d5225fba","source":"wordfence","cve":"CVE-2015-9347","title":"Plotly <= 1.0.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec7f51d-5d65-40ff-9fe5-0fa6d5225fba?source=api-prod","affected":[{"type":"plugin","slug":"wp-plotly","name":"Plotly","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ec997c8-3f47-45c8-8fa2-019b01c97c94","source":"wordfence","cve":"CVE-2020-13126","title":"Elementor Pro <= 2.9.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ec997c8-3f47-45c8-8fa2-019b01c97c94?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":false,"patched_in":"2.9.4"}],"published":"2020-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3eca4da3-2d8b-4a68-807b-d9a2cb52fb6b","source":"wordfence","cve":"CVE-2024-6230","title":"Pardakht Delkhah <= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eca4da3-2d8b-4a68-807b-d9a2cb52fb6b?source=api-prod","affected":[{"type":"plugin","slug":"pardakht-delkhah","name":"\u067e\u0644\u0627\u06af\u06cc\u0646 \u067e\u0631\u062f\u0627\u062e\u062a \u062f\u0644\u062e\u0648\u0627\u0647","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T20:18:49Z"},{"id":"wordfence:3ecdd962-7d85-4a60-956d-1e8a49507ab2","source":"wordfence","cve":"CVE-2024-11435","title":"salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ecdd962-7d85-4a60-956d-1e8a49507ab2?source=api-prod","affected":[{"type":"plugin","slug":"salavat-counter","name":"salavat counter Plugin","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2024-11-20T13:44:04Z","updated":"2025-03-07T14:14:16Z"},{"id":"wordfence:3ece0dd2-de62-42eb-9ad3-06a1cfe5e058","source":"wordfence","cve":"CVE-2026-110042","title":"Payment Forms for Paystack <= 4.0.5 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ece0dd2-de62-42eb-9ad3-06a1cfe5e058?source=api-prod","affected":[{"type":"plugin","slug":"payment-forms-for-paystack","name":"Payment Forms for Paystack","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:22:13Z"},{"id":"wordfence:3ed1ab41-d4ad-4447-8914-f375b196d31b","source":"wordfence","cve":"CVE-2025-23624","title":"WpDevTool <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed1ab41-d4ad-4447-8914-f375b196d31b?source=api-prod","affected":[{"type":"plugin","slug":"wpdevtool","name":"WpDevTool","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:43:41Z"},{"id":"wordfence:3ed1c2a2-54ee-4dc8-a54d-01d7a6dbc22e","source":"wordfence","cve":"CVE-2023-3175","title":"AI ChatBot <= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed1c2a2-54ee-4dc8-a54d-01d7a6dbc22e?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ed280ba-d7e5-4637-ab84-93dc82c009d8","source":"wordfence","cve":"","title":"Admin Word Count Column <= 2.2 - Arbitrary File Read","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed280ba-d7e5-4637-ab84-93dc82c009d8?source=api-prod","affected":[{"type":"plugin","slug":"admin-word-count-column","name":"Admin Word Count Column","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2022-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ed30ebb-cb06-428c-a60e-676f36e75fa9","source":"wordfence","cve":"CVE-2023-52218","title":"WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed30ebb-cb06-428c-a60e-676f36e75fa9?source=api-prod","affected":[{"type":"plugin","slug":"woo-tranzila-gateway","name":"Woocommerce Tranzila Payment Gateway","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ed45d70-a528-47ee-84c9-26948dfe91f1","source":"wordfence","cve":"CVE-2013-5918","title":"Platinum SEO <= 1.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed45d70-a528-47ee-84c9-26948dfe91f1?source=api-prod","affected":[{"type":"plugin","slug":"platinum-seo-pack","name":"Platinum SEO","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ed59d5b-0922-44e9-98e8-07b91d1f4840","source":"wordfence","cve":"CVE-2024-12508","title":"Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed59d5b-0922-44e9-98e8-07b91d1f4840?source=api-prod","affected":[{"type":"plugin","slug":"glofox-shortcodes","name":"Glofox Shortcodes","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T18:24:38Z","updated":"2025-01-17T07:01:26Z"},{"id":"wordfence:3ed6d5e6-1094-46ec-afb9-43c142f334ed","source":"wordfence","cve":"CVE-2023-40553","title":"Plausible Analytics <= 1.3.3 - Reflected Cross-Site Scripting via page-url","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed6d5e6-1094-46ec-afb9-43c142f334ed?source=api-prod","affected":[{"type":"plugin","slug":"plausible-analytics","name":"Plausible Analytics","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ed92523-e0e4-4e2a-b727-325e8dff37d9","source":"wordfence","cve":"CVE-2025-64195","title":"Eduma <= 5.7.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed92523-e0e4-4e2a-b727-325e8dff37d9?source=api-prod","affected":[{"type":"theme","slug":"eduma","name":"Eduma","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2025-10-18T00:00:00Z","updated":"2025-11-04T15:48:01Z"},{"id":"wordfence:3ed93c5c-38bb-4e84-8fe8-03dd75b4d9f3","source":"wordfence","cve":"CVE-2023-29239","title":"LuckyWP Scripts Control <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed93c5c-38bb-4e84-8fe8-03dd75b4d9f3?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-scripts-control","name":"LuckyWP Scripts Control","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-08-28T00:00:00Z","updated":"2024-10-18T13:50:15Z"},{"id":"wordfence:3ed93cc1-66dd-414b-9c8c-5e0db44e1cf2","source":"wordfence","cve":"CVE-2025-25170","title":"Migrate Posts <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed93cc1-66dd-414b-9c8c-5e0db44e1cf2?source=api-prod","affected":[{"type":"plugin","slug":"migrate-post","name":"Migrate Posts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:16:52Z"},{"id":"wordfence:3edafcfc-3343-452d-b389-733b21c4a3aa","source":"wordfence","cve":"CVE-2025-31092","title":"Click to Chat \u2013 WP Support All-in-One Floating Widget <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edafcfc-3343-452d-b389-733b21c4a3aa?source=api-prod","affected":[{"type":"plugin","slug":"support-chat","name":"WP Click to Chat \u2013 Email, Live Chat, Call & Book Now Buttons","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-10-17T19:37:38Z"},{"id":"wordfence:3edb95f1-aa82-4b51-957e-2039dd8624e1","source":"wordfence","cve":"CVE-2022-2877","title":"Titan Anti Spam & Security <= 7.3.0 - IP Spoofing to Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edb95f1-aa82-4b51-957e-2039dd8624e1?source=api-prod","affected":[{"type":"plugin","slug":"anti-spam","name":"Titan Anti-spam & Security \u2013 Brute Force Protection, 2FA & Spam Filter","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3edc40b7-5cf6-413b-80c5-b001934bedc3","source":"wordfence","cve":"CVE-2021-38354","title":"GNU-Mailman Integration <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edc40b7-5cf6-413b-80c5-b001934bedc3?source=api-prod","affected":[{"type":"plugin","slug":"gnu-mailman-integration","name":"GNU-Mailman Integration","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3edce64d-13c2-454a-b5da-0454453f69cb","source":"wordfence","cve":"CVE-2022-45065","title":"SEO Plugin by Squirrly SEO <= 12.1.20 - Reflected Cross-Site Scripting via 'page' and 'tab'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edce64d-13c2-454a-b5da-0454453f69cb?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.1.20","to_inclusive":true,"patched_in":"12.1.21"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3edd5694-7ea0-40b3-a5f7-50e8f2c1b89c","source":"wordfence","cve":"CVE-2026-94230","title":"TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edd5694-7ea0-40b3-a5f7-50e8f2c1b89c?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"1.1.9","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:02:06Z"},{"id":"wordfence:3eddc03d-ecff-4b50-a574-7b6b62e53af0","source":"wordfence","cve":"CVE-2024-2477","title":"wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eddc03d-ecff-4b50-a574-7b6b62e53af0?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.15","to_inclusive":true,"patched_in":"7.6.16"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T13:50:40Z"},{"id":"wordfence:3edfc4af-2a28-4bdf-becf-018d9f656947","source":"wordfence","cve":"CVE-2025-13067","title":"Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1049","to_inclusive":true,"patched_in":"1.7.1050"}],"published":"2026-03-10T15:36:21Z","updated":"2026-03-11T04:25:48Z"},{"id":"wordfence:3ee1f412-7555-4dec-ba59-49412471a42f","source":"wordfence","cve":"CVE-2025-0316","title":"WP Directorybox Manager <= 2.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee1f412-7555-4dec-ba59-49412471a42f?source=api-prod","affected":[{"type":"plugin","slug":"wp-directorybox-manager","name":"WP Directorybox Manager","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-08T00:00:00Z","updated":"2025-02-08T21:20:59Z"},{"id":"wordfence:3ee369c0-0d7c-4142-b3ba-a518288647ba","source":"wordfence","cve":"CVE-2026-80099","title":"Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-hostgator","name":"WP Plugin Hostgator","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"},{"type":"plugin","slug":"wp-module-data","name":"WP Module Data","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"},{"type":"plugin","slug":"wp-plugin-crazy-domains","name":"WP Plugin Crazy Domains","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"},{"type":"plugin","slug":"wp-plugin-web","name":"WP Plugin Web","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"},{"type":"plugin","slug":"bluehost-wordpress-plugin","name":"WP Plugin Bluehost","from":"*","from_inclusive":true,"to":"4.19.0","to_inclusive":true,"patched_in":"4.19.1"}],"published":"2026-09-08T20:12:14Z","updated":"2026-09-09T08:28:22Z"},{"id":"wordfence:3ee49082-5255-4ab7-9562-bd786a32382c","source":"wordfence","cve":"CVE-2022-1192","title":"Turn off all comments <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee49082-5255-4ab7-9562-bd786a32382c?source=api-prod","affected":[{"type":"plugin","slug":"turn-off-comments-for-all-posts","name":"Turn off all comments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ee538dd-466b-471d-8055-af32ecfdfc77","source":"wordfence","cve":"CVE-2026-39503","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee538dd-466b-471d-8055-af32ecfdfc77?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:03:51Z"},{"id":"wordfence:3ee59570-85c3-4394-bebb-c3f49c08be67","source":"wordfence","cve":"CVE-2023-41669","title":"Live News <= 1.06 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee59570-85c3-4394-bebb-c3f49c08be67?source=api-prod","affected":[{"type":"plugin","slug":"live-news-lite","name":"Live News \u2013 Responsive News Ticker","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":"1.07"}],"published":"2023-09-04T00:00:00Z","updated":"2024-04-12T19:02:50Z"},{"id":"wordfence:3ee86d33-5a1e-4dc5-b2f6-0beffd8a6b2e","source":"wordfence","cve":"CVE-2026-15786","title":"WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee86d33-5a1e-4dc5-b2f6-0beffd8a6b2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"7.8.6.6","to_inclusive":true,"patched_in":"7.8.6.7"}],"published":"2026-07-22T20:35:43Z","updated":"2026-07-24T13:10:19Z"},{"id":"wordfence:3eec5823-f1ee-464c-8344-eed3ee991602","source":"wordfence","cve":"CVE-2007-3288","title":"stats <= 1.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eec5823-f1ee-464c-8344-eed3ee991602?source=api-prod","affected":[{"type":"plugin","slug":"stats","name":"stats","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2007-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3eece451-65a3-4c9d-a8eb-05f6f3e2d1d5","source":"wordfence","cve":"CVE-2023-48329","title":"Fast Custom Social Share by CodeBard <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eece451-65a3-4c9d-a8eb-05f6f3e2d1d5?source=api-prod","affected":[{"type":"plugin","slug":"fast-custom-social-share-by-codebard","name":"Fast Custom Social Share by CodeBard","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3eedc57b-79cc-4569-b6d6-676a22aa1e06","source":"wordfence","cve":"CVE-2023-2484","title":"Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eedc57b-79cc-4569-b6d6-676a22aa1e06?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ef4f85f-9b8d-4cac-acf6-6b8cd9b63722","source":"wordfence","cve":"CVE-2025-28896","title":"AS English Admin <= 1.0.0 - Open Redirection","severity":"medium","cvss":5.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef4f85f-9b8d-4cac-acf6-6b8cd9b63722?source=api-prod","affected":[{"type":"plugin","slug":"as-english-admin","name":"AS English Admin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:50:11Z"},{"id":"wordfence:3ef57441-8e35-44c4-b566-56e8f1dd18d9","source":"wordfence","cve":"CVE-2024-32821","title":"Total Poll Lite <= 4.9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef57441-8e35-44c4-b566-56e8f1dd18d9?source=api-prod","affected":[{"type":"plugin","slug":"totalpoll-lite","name":"TotalPoll for Polls and Contests","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"4.10.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:16:49Z"},{"id":"wordfence:3ef59cb5-4d6d-4859-bd4c-3fc7dc97c51b","source":"wordfence","cve":"CVE-2025-59129","title":"Appointify <= 1.0.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef59cb5-4d6d-4859-bd4c-3fc7dc97c51b?source=api-prod","affected":[{"type":"plugin","slug":"appointify","name":"Appointify","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T18:19:51Z"},{"id":"wordfence:3ef87ab8-d56b-4d3a-b4fc-6c17c24143ec","source":"wordfence","cve":"CVE-2025-8314","title":"Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef87ab8-d56b-4d3a-b4fc-6c17c24143ec?source=api-prod","affected":[{"type":"plugin","slug":"software-issue-manager","name":"Project Management, Bug and Issue Tracking Plugin \u2013 Software Issue Manager","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2025-08-11T16:24:23Z","updated":"2025-08-12T04:25:42Z"},{"id":"wordfence:3ef8bf84-768f-4ef1-8037-4e51ccc20c83","source":"wordfence","cve":"CVE-2023-51526","title":"Simple Staff List <= 2.2.4 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef8bf84-768f-4ef1-8037-4e51ccc20c83?source=api-prod","affected":[{"type":"plugin","slug":"simple-staff-list","name":"Simple Staff List","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ef94c4b-fba3-4595-b073-7300d1972d6c","source":"wordfence","cve":"CVE-2025-49400","title":"WP Visitor Statistics (Real Time Traffic) <= 8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef94c4b-fba3-4595-b073-7300d1972d6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":true,"patched_in":"8.3"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:10:05Z"},{"id":"wordfence:3ef98c6f-4243-46bf-8231-3c751473fff7","source":"wordfence","cve":"CVE-2025-50004","title":"JupiterX Core <= 4.10.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef98c6f-4243-46bf-8231-3c751473fff7?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.11.0"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:42:39Z"},{"id":"wordfence:3efaf738-1ab8-4a22-9536-157c346e9536","source":"wordfence","cve":"CVE-2026-8943","title":"GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efaf738-1ab8-4a22-9536-157c346e9536?source=api-prod","affected":[{"type":"plugin","slug":"gostats-for-wordpress","name":"GoStats for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:54Z","updated":"2026-05-27T05:31:23Z"},{"id":"wordfence:3efb5f5c-64d2-4819-82bf-45574df94209","source":"wordfence","cve":"CVE-2026-15648","title":"Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efb5f5c-64d2-4819-82bf-45574df94209?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.8.1"}],"published":"2026-07-23T18:26:40Z","updated":"2026-07-24T06:52:00Z"},{"id":"wordfence:3efd3105-675b-4e6b-bcd7-ca8d0e602cf9","source":"wordfence","cve":"CVE-2026-16262","title":"Estatik <= 4.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efd3105-675b-4e6b-bcd7-ca8d0e602cf9?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:37:34Z"},{"id":"wordfence:3efe1af6-16c8-4773-a11a-c09d6fc210f9","source":"wordfence","cve":"CVE-2026-22359","title":"Movies Bulk Importer <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efe1af6-16c8-4773-a11a-c09d6fc210f9?source=api-prod","affected":[{"type":"plugin","slug":"movies-importer","name":"Wordpress Movies Bulk Importer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T21:59:24Z"},{"id":"wordfence:3efe6b81-72db-4419-92a3-26e22ebf46e8","source":"wordfence","cve":"CVE-2025-10487","title":"Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efe6b81-72db-4419-92a3-26e22ebf46e8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T06:40:38Z"},{"id":"wordfence:3efe9a46-2dc6-4e92-bc47-0082cf6815df","source":"wordfence","cve":"CVE-2026-57806","title":"Martfury - Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3efe9a46-2dc6-4e92-bc47-0082cf6815df?source=api-prod","affected":[{"type":"theme","slug":"martfury","name":"Martfury - Marketplace Mobile App Figma Template","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:32:13Z","updated":"2026-10-13T13:53:45Z"},{"id":"wordfence:3eff4992-dbd4-4b9b-872e-1670ce7dab9d","source":"wordfence","cve":"CVE-2024-2036","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eff4992-dbd4-4b9b-872e-1670ce7dab9d?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-05-21T19:49:22Z","updated":"2024-06-05T13:47:14Z"},{"id":"wordfence:3eff6af4-0553-4554-bce2-e355a4a06eec","source":"wordfence","cve":"CVE-2025-27343","title":"WooCommerce HTML5 Video <= 1.7.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eff6af4-0553-4554-bce2-e355a4a06eec?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-html5-video","name":"WooCommerce HTML5 Video","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:41:52Z"},{"id":"wordfence:3eff7a6f-7098-4298-b399-91974b16fda2","source":"wordfence","cve":"CVE-2015-20106","title":"ClickBank Affiliate Ads <= 1.20 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3eff7a6f-7098-4298-b399-91974b16fda2?source=api-prod","affected":[{"type":"plugin","slug":"clickbank-ads-clickbank-widget","name":"Affiliate Ads for cbAds.com","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":"1.35"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f0082c6-c040-4244-be7b-b133fd24d093","source":"wordfence","cve":"CVE-2026-18400","title":"Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0082c6-c040-4244-be7b-b133fd24d093?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.111.0","to_inclusive":true,"patched_in":"3.111.1"}],"published":"2026-08-05T16:40:13Z","updated":"2026-08-06T05:29:25Z"},{"id":"wordfence:3f0188e3-4c81-472d-bd2f-902ccfb694b8","source":"wordfence","cve":"CVE-2026-89008","title":"Bookit <= 2.6.0.4 - Authenticated (Bookit Staff+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0188e3-4c81-472d-bd2f-902ccfb694b8?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.4","to_inclusive":true,"patched_in":"2.6.0.5"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:16:54Z"},{"id":"wordfence:3f0251e5-e575-4662-b81d-72c106e92b50","source":"wordfence","cve":"CVE-2026-87935","title":"Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0251e5-e575-4662-b81d-72c106e92b50?source=api-prod","affected":[{"type":"plugin","slug":"paid-downloads","name":"Paid Downloads","from":"*","from_inclusive":true,"to":"3.15","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T16:20:37Z","updated":"2026-09-17T04:28:14Z"},{"id":"wordfence:3f04a742-56be-42e9-9080-2131c6e98325","source":"wordfence","cve":"CVE-2023-41860","title":"Travel Map <= 1.0.1 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f04a742-56be-42e9-9080-2131c6e98325?source=api-prod","affected":[{"type":"plugin","slug":"travelmap-blog","name":"Travel Map","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f04b52f-8100-4823-b925-ed562f08a91d","source":"wordfence","cve":"CVE-2025-23927","title":"Incredible Font Awesome <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f04b52f-8100-4823-b925-ed562f08a91d?source=api-prod","affected":[{"type":"plugin","slug":"incredible-font-awesome","name":"Incredible Font Awesome","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:53:30Z"},{"id":"wordfence:3f061e7f-6a87-4d4a-9b4e-8234883f2ebc","source":"wordfence","cve":"CVE-2024-11936","title":"Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f061e7f-6a87-4d4a-9b4e-8234883f2ebc?source=api-prod","affected":[{"type":"theme","slug":"zox-news","name":"Zox News","from":"*","from_inclusive":true,"to":"3.16.0","to_inclusive":true,"patched_in":"3.17.0"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T11:09:44Z"},{"id":"wordfence:3f070125-faee-46fe-aa6e-a51772868192","source":"wordfence","cve":"CVE-2025-68007","title":"Event Espresso 4 Decaf <= 5.0.37.decaf - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f070125-faee-46fe-aa6e-a51772868192?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-decaf","name":"Event Espresso \u2013 Event Registration & Ticketing Sales","from":"*","from_inclusive":true,"to":"5.0.37.decaf","to_inclusive":true,"patched_in":"5.0.53.decaf"}],"published":"2026-01-15T00:00:00Z","updated":"2026-02-10T20:56:04Z"},{"id":"wordfence:3f074584-ec8a-4259-b959-fe37c0244acc","source":"wordfence","cve":"CVE-2026-25446","title":"Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f074584-ec8a-4259-b959-fe37c0244acc?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-08-17T04:33:38Z"},{"id":"wordfence:3f0866a4-0edf-4fb7-8628-4b8e18a2b4bb","source":"wordfence","cve":"","title":"Simple Fields <= 1.4.11 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0866a4-0edf-4fb7-8628-4b8e18a2b4bb?source=api-prod","affected":[{"type":"plugin","slug":"simple-fields","name":"Simple Fields","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":""}],"published":"2019-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f08fd6e-4c1b-40e7-92ba-72cdd03ff585","source":"wordfence","cve":"CVE-2021-25112","title":"WHMCS Bridge <= 6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f08fd6e-4c1b-40e7-92ba-72cdd03ff585?source=api-prod","affected":[{"type":"plugin","slug":"whmcs-bridge","name":"WHMCS Bridge","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4b"}],"published":"2022-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f0b212a-969b-4cd3-a31c-40b9ff9dce5f","source":"wordfence","cve":"","title":"Image Gallery \u2013 Responsive Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting via linkbutton","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0b212a-969b-4cd3-a31c-40b9ff9dce5f?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2016-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f0ed355-b5c8-4143-b391-7436d67ba0de","source":"wordfence","cve":"CVE-2023-50849","title":"E2Pdf <= 1.20.23 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f0ed355-b5c8-4143-b391-7436d67ba0de?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.24","to_inclusive":false,"patched_in":"1.20.24"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f104d4f-0235-4bef-87bd-0623baed339e","source":"wordfence","cve":"CVE-2026-84759","title":"Activity Log \u2013 Monitor User and Agent Changes <= 2.13.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f104d4f-0235-4bef-87bd-0623baed339e?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:21:47Z"},{"id":"wordfence:3f11416c-c981-4c85-822c-497ecfaa842d","source":"wordfence","cve":"CVE-2023-5098","title":"Campaign Monitor Forms <= 2.5.5 - Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f11416c-c981-4c85-822c-497ecfaa842d?source=api-prod","affected":[{"type":"plugin","slug":"campaign-monitor-wp","name":"Campaign Monitor Forms by Optin Cat","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f159aac-092b-4655-9d97-a496ac01738c","source":"wordfence","cve":"CVE-2026-3480","title":"WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f159aac-092b-4655-9d97-a496ac01738c?source=api-prod","affected":[{"type":"plugin","slug":"wp-blockade","name":"WP Blockade \u2013 Visual Page Builder","from":"*","from_inclusive":true,"to":"0.9.14","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:39:13Z","updated":"2026-04-08T06:43:38Z"},{"id":"wordfence:3f1770dc-e473-438c-9732-b51cff57c796","source":"wordfence","cve":"CVE-2025-60064","title":"Renewal <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1770dc-e473-438c-9732-b51cff57c796?source=api-prod","affected":[{"type":"theme","slug":"renewal","name":"Renewal | Plastic Surgery Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-12-20T21:07:14Z"},{"id":"wordfence:3f18437c-2258-4f5b-a114-fb099f115f2e","source":"wordfence","cve":"CVE-2013-2704","title":"Dropdown Menu Widget <= 1.9.7 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f18437c-2258-4f5b-a114-fb099f115f2e?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-menu-widget","name":"Dropdown Menu Widget","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f18a07f-c7de-49ac-9a11-f9cbc48b125a","source":"wordfence","cve":"CVE-2021-38329","title":"DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f18a07f-c7de-49ac-9a11-f9cbc48b125a?source=api-prod","affected":[{"type":"plugin","slug":"dj-email-publish","name":"DJ EmailPublish","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f18f658-abce-4e15-ae2f-4879716534af","source":"wordfence","cve":"CVE-2024-37272","title":"Travel Monster <= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f18f658-abce-4e15-ae2f-4879716534af?source=api-prod","affected":[{"type":"theme","slug":"travel-monster","name":"Travel Monster","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:39:17Z"},{"id":"wordfence:3f1a34cc-a961-4bcd-a95c-ae6009f1f274","source":"wordfence","cve":"CVE-2025-47505","title":"Product Time Countdown for WooCommerce <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1a34cc-a961-4bcd-a95c-ae6009f1f274?source=api-prod","affected":[{"type":"plugin","slug":"product-countdown-for-woocommerce","name":"Product Time Countdown for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:20:21Z"},{"id":"wordfence:3f1b63a2-31c7-4c76-8969-fee3f7138cfe","source":"wordfence","cve":"CVE-2024-56008","title":"Spreadr Woocommerce <= 1.0.4 - Missing Authorization to Arbitrary Content Deletion","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1b63a2-31c7-4c76-8969-fee3f7138cfe?source=api-prod","affected":[{"type":"plugin","slug":"spreadr-for-woocomerce","name":"Spreadr Woocommerce Plugin \u2013 Amazon Importer for Dropshipping and Affiliate","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:03:45Z"},{"id":"wordfence:3f1c13f6-150c-4634-a4d8-176a4d7a2296","source":"wordfence","cve":"CVE-2024-10592","title":"Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1c13f6-150c-4634-a4d8-176a4d7a2296?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-11-15T21:33:21Z","updated":"2024-11-16T09:36:35Z"},{"id":"wordfence:3f1cf77a-64b4-405b-adcb-ef16d9e82ab2","source":"wordfence","cve":"CVE-2025-12770","title":"New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1cf77a-64b4-405b-adcb-ef16d9e82ab2?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-11-18T15:26:02Z","updated":"2025-11-19T14:25:58Z"},{"id":"wordfence:3f1df412-86cd-4ebc-913b-674cc3b8d89a","source":"wordfence","cve":"CVE-2024-6094","title":"WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f1df412-86cd-4ebc-913b-674cc3b8d89a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2024-07-03T00:00:00Z","updated":"2024-08-02T21:19:16Z"},{"id":"wordfence:3f202cc3-ab74-4abb-9eed-b4caf9fccb71","source":"wordfence","cve":"CVE-2022-4050","title":"JoomSport <= 5.2.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f202cc3-ab74-4abb-9eed-b4caf9fccb71?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f211911-b8e1-4ee2-ad4a-189c58fdbe8d","source":"wordfence","cve":"CVE-2026-81294","title":"Authorizer <= 3.15.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f211911-b8e1-4ee2-ad4a-189c58fdbe8d?source=api-prod","affected":[{"type":"plugin","slug":"authorizer","name":"Authorizer","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T14:15:29Z"},{"id":"wordfence:3f21a356-193e-4eab-a8be-d88315421d03","source":"wordfence","cve":"CVE-2025-49071","title":"Flozen < 1.5.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f21a356-193e-4eab-a8be-d88315421d03?source=api-prod","affected":[{"type":"theme","slug":"flozen-theme","name":"Flozen - WooCommerce AJAX WordPress RTL Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T14:32:42Z"},{"id":"wordfence:3f244b8e-94ae-4d95-83a7-53b826e98656","source":"wordfence","cve":"CVE-2023-52143","title":"WP Stripe Checkout <= 1.2.2.37 - Sensitive Information Exposure via Debug Log","severity":"high","cvss":7.5,"cwe":"CWE-921","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f244b8e-94ae-4d95-83a7-53b826e98656?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-checkout","name":"WP Stripe Checkout","from":"*","from_inclusive":true,"to":"1.2.2.37","to_inclusive":true,"patched_in":"1.2.2.38"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f2504ba-9432-429f-8476-a994f48836c9","source":"wordfence","cve":"CVE-2024-10545","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2504ba-9432-429f-8476-a994f48836c9?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.8","to_inclusive":true,"patched_in":"3.59.9"}],"published":"2025-02-04T00:00:00Z","updated":"2025-03-03T20:58:04Z"},{"id":"wordfence:3f28b1b2-e751-423e-b4c5-893778eebf3f","source":"wordfence","cve":"CVE-2023-29436","title":"IFrame Shortcode <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f28b1b2-e751-423e-b4c5-893778eebf3f?source=api-prod","affected":[{"type":"plugin","slug":"flynsarmy-iframe-shortcode","name":"IFrame Shortcode","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f2c8c5f-2017-4b22-a864-dc142b3b1afb","source":"wordfence","cve":"CVE-2024-13572","title":"Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2c8c5f-2017-4b22-a864-dc142b3b1afb?source=api-prod","affected":[{"type":"plugin","slug":"precious-metals-chart-and-widgets","name":"Precious Metals Charts and Widgets for WordPress","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:3f2c97f4-0a6e-4693-a6c8-bd81ca76988c","source":"wordfence","cve":"CVE-2023-48758","title":"JetEngine <= 3.2.4 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2c97f4-0a6e-4693-a6c8-bd81ca76988c?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f2d6c42-4baa-4d15-934f-0f8998c7d654","source":"wordfence","cve":"","title":"Post Carousel < 2.3.5 - Missing Capabilities Check","severity":"high","cvss":7.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2d6c42-4baa-4d15-934f-0f8998c7d654?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f2e54e1-bec5-478b-9bb6-09cee967470b","source":"wordfence","cve":"CVE-2024-53802","title":"Futurio Extra <= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2e54e1-bec5-478b-9bb6-09cee967470b?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:47:17Z"},{"id":"wordfence:3f2fb3a6-87dc-4c42-b79a-fcc960f8d5f5","source":"wordfence","cve":"CVE-2026-118698","title":"JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2fb3a6-87dc-4c42-b79a-fcc960f8d5f5?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.14","to_inclusive":true,"patched_in":"5.7.15"}],"published":"2026-10-29T17:00:19Z","updated":"2026-10-30T05:35:51Z"},{"id":"wordfence:3f3448ad-61b3-4eac-a5ba-9bea41c85fd3","source":"wordfence","cve":"CVE-2021-24434","title":"Glass <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f3448ad-61b3-4eac-a5ba-9bea41c85fd3?source=api-prod","affected":[{"type":"plugin","slug":"glass","name":"Glass","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f36839b-850e-4c39-aa61-4fd7a89cd5bc","source":"wordfence","cve":"CVE-2024-12330","title":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure","severity":"high","cvss":7.5,"cwe":"CWE-530","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f36839b-850e-4c39-aa61-4fd7a89cd5bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-09T11:10:56Z"},{"id":"wordfence:3f378797-a7a7-4691-8d37-1caef454bb4f","source":"wordfence","cve":"","title":"Quiz and Survey Master <= 6.4.12 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f378797-a7a7-4691-8d37-1caef454bb4f?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2020-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f37c650-af0d-4474-9c1b-7f8d361b4d81","source":"wordfence","cve":"CVE-2026-4127","title":"Speedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f37c650-af0d-4474-9c1b-7f8d361b4d81?source=api-prod","affected":[{"type":"plugin","slug":"speedup-optimization","name":"Speedup Optimization","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:25Z","updated":"2026-03-27T11:14:54Z"},{"id":"wordfence:3f389cbf-a327-46a1-9fb7-ed393212033a","source":"wordfence","cve":"CVE-2011-3818","title":"WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f389cbf-a327-46a1-9fb7-ed393212033a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"2.9.2","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"3.0"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.0.4","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0"}],"published":"2011-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f39c478-7b64-4afc-8c3f-9409e105954a","source":"wordfence","cve":"CVE-2021-39325","title":"OptinMonster <= 2.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f39c478-7b64-4afc-8c3f-9409e105954a?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2021-09-20T18:03:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f3aec3a-c1d3-4f7f-9f45-7a3ec42ce260","source":"wordfence","cve":"CVE-2022-4197","title":"Sliderby10Web <= 1.2.52 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f3aec3a-c1d3-4f7f-9f45-7a3ec42ce260?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.52","to_inclusive":true,"patched_in":"1.2.53"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f3c556d-8baf-4d75-a331-51b76ee084ee","source":"wordfence","cve":"","title":"Breadcrumb NavXT <= 6.1.0 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f3c556d-8baf-4d75-a331-51b76ee084ee?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumb-navxt","name":"Breadcrumb NavXT","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2018-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f3d6028-37ea-495d-aeb0-8f7cc940d2fd","source":"wordfence","cve":"CVE-2025-68598","title":"Page Builder: Live Composer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f3d6028-37ea-495d-aeb0-8f7cc940d2fd?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-09-18T00:09:23Z"},{"id":"wordfence:3f408f1f-207e-427a-a5d0-d0fadf453d7e","source":"wordfence","cve":"CVE-2023-4024","title":"Radio Player <= 2.0.73 - Missing Authorization to Player Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f408f1f-207e-427a-a5d0-d0fadf453d7e?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:22Z"},{"id":"wordfence:3f417afd-2822-412f-b68a-f09c013d6049","source":"wordfence","cve":"CVE-2026-2387","title":"Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f417afd-2822-412f-b68a-f09c013d6049?source=api-prod","affected":[{"type":"plugin","slug":"event-organiser","name":"Event Organiser","from":"*","from_inclusive":true,"to":"3.12.9","to_inclusive":true,"patched_in":"3.12.10"}],"published":"2026-06-30T15:56:11Z","updated":"2026-07-01T04:32:26Z"},{"id":"wordfence:3f421fcc-f2e4-43d4-b170-2e3383fe0ad7","source":"wordfence","cve":"CVE-2025-68521","title":"WpStream <= 4.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f421fcc-f2e4-43d4-b170-2e3383fe0ad7?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T13:59:02Z"},{"id":"wordfence:3f445e0e-c32d-4c46-85ac-fa21f99d30ec","source":"wordfence","cve":"CVE-2024-37924","title":"WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f445e0e-c32d-4c46-85ac-fa21f99d30ec?source=api-prod","affected":[{"type":"plugin","slug":"wp2speed","name":"WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-14T20:26:55Z"},{"id":"wordfence:3f4806a3-643e-45b0-953f-6c0628359495","source":"wordfence","cve":"","title":"WP Shop < 3.4.3.16 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f4806a3-643e-45b0-953f-6c0628359495?source=api-prod","affected":[{"type":"plugin","slug":"wp-shop-original","name":"WP Shop","from":"*","from_inclusive":true,"to":"3.4.3.16","to_inclusive":false,"patched_in":"3.4.3.16"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f4893b9-e032-45d6-a542-0ead70c61e2f","source":"wordfence","cve":"CVE-2019-15330","title":"WebP Express < 0.14.11 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f4893b9-e032-45d6-a542-0ead70c61e2f?source=api-prod","affected":[{"type":"plugin","slug":"webp-express","name":"WebP Express","from":"*","from_inclusive":true,"to":"0.14.11","to_inclusive":false,"patched_in":"0.14.11"}],"published":"2018-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f4ac2c0-2c22-431c-b892-b4bf6a7319ce","source":"wordfence","cve":"CVE-2021-24678","title":"CM Tooltip Glossary <= 3.9.20 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f4ac2c0-2c22-431c-b892-b4bf6a7319ce?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"3.9.21","to_inclusive":false,"patched_in":"3.9.21"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f507853-8c9f-4308-ad6e-5fbb610158f5","source":"wordfence","cve":"CVE-2025-9875","title":"Event Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f507853-8c9f-4308-ad6e-5fbb610158f5?source=api-prod","affected":[{"type":"plugin","slug":"ticket-spot","name":"Ticket Spot \u2013 Event Tickets, RSVPs & Calendar","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-10-02T22:11:53Z","updated":"2025-10-03T11:17:11Z"},{"id":"wordfence:3f5413be-76b8-457c-9236-3ef760f46d40","source":"wordfence","cve":"","title":"Custom Metas <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5413be-76b8-457c-9236-3ef760f46d40?source=api-prod","affected":[{"type":"plugin","slug":"custom-metas","name":"custom-metas","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2016-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f54f117-0dde-49f9-8014-7650bc1a00ac","source":"wordfence","cve":"CVE-2026-1381","title":"Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f54f117-0dde-49f9-8014-7650bc1a00ac?source=api-prod","affected":[{"type":"plugin","slug":"order-minimum-amount-for-woocommerce","name":"Order Minimum/Maximum Amount Limits for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.6.9"}],"published":"2026-01-27T19:38:12Z","updated":"2026-01-28T08:26:56Z"},{"id":"wordfence:3f56338f-1687-42c3-8fe2-f62fe962eefd","source":"wordfence","cve":"CVE-2024-3977","title":"WordPress Jitsi Shortcode <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f56338f-1687-42c3-8fe2-f62fe962eefd?source=api-prod","affected":[{"type":"plugin","slug":"wp-jitsi-shortcodes","name":"WordPress Jitsi Shortcode","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:27:12Z"},{"id":"wordfence:3f57fbbc-ed5a-4452-bd8a-6fc0a4536d76","source":"wordfence","cve":"CVE-2024-13607","title":"JS Help Desk \u2013 The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f57fbbc-ed5a-4452-bd8a-6fc0a4536d76?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T06:41:54Z"},{"id":"wordfence:3f58ed72-5a0b-4b43-ad76-7730c79741da","source":"wordfence","cve":"CVE-2026-4608","title":"ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f58ed72-5a0b-4b43-ad76-7730c79741da?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.4","to_inclusive":true,"patched_in":"5.9.8.5"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T13:27:58Z"},{"id":"wordfence:3f594989-8db3-41c8-9089-b4e2d995270e","source":"wordfence","cve":"","title":"Order XML File Export Import for WooCommerce < 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f594989-8db3-41c8-9089-b4e2d995270e?source=api-prod","affected":[{"type":"plugin","slug":"order-xml-file-export-import-for-woocommerce","name":"Order XML File Export Import for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2018-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f596af2-ff83-4c67-a8f0-e4df4a0adbd2","source":"wordfence","cve":"CVE-2018-11632","title":"Add Social Share Buttons for Whatsapp and Viber < 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f596af2-ff83-4c67-a8f0-e4df4a0adbd2?source=api-prod","affected":[{"type":"plugin","slug":"add-social-share-buttons","name":"Add Social Share Buttons for Whatsapp and Viber","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2018-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f5d3585-19fe-4e85-87d0-7f4c62944146","source":"wordfence","cve":"CVE-2025-8100","title":"Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5d3585-19fe-4e85-87d0-7f4c62944146?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.1.5","to_inclusive":true,"patched_in":"8.1.6"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-06T03:41:00Z"},{"id":"wordfence:3f5e4431-2789-47c8-81ce-e9f67454accc","source":"wordfence","cve":"CVE-2026-116615","title":"Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5e4431-2789-47c8-81ce-e9f67454accc?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.2.6.1","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2026-11-12T20:59:16Z","updated":"2026-11-13T09:35:12Z"},{"id":"wordfence:3f5eef96-b9db-444b-82b8-86132376e29c","source":"wordfence","cve":"CVE-2022-2983","title":"Salat Times < = 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5eef96-b9db-444b-82b8-86132376e29c?source=api-prod","affected":[{"type":"plugin","slug":"salat-times","name":"Salat Times","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f5fa5c1-311a-4e35-83c8-387f8039e671","source":"wordfence","cve":"CVE-2025-31038","title":"Essential Breadcrumbs <= 1.1.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5fa5c1-311a-4e35-83c8-387f8039e671?source=api-prod","affected":[{"type":"plugin","slug":"essential-breadcrumbs","name":"Essential Breadcrumbs","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:35:09Z"},{"id":"wordfence:3f5ff15d-2436-48d4-a31d-6bfd9704149f","source":"wordfence","cve":"CVE-2014-4603","title":"Yahoo Updates For WordPress <= 1.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5ff15d-2436-48d4-a31d-6bfd9704149f?source=api-prod","affected":[{"type":"plugin","slug":"yahoo-updates-for-wordpress","name":"yahoo-updates-for-wordpress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f6058e2-a5ec-43b2-9cb7-9efcf0853ffc","source":"wordfence","cve":"CVE-2025-3912","title":"WS Form LITE \u2013 Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6058e2-a5ec-43b2-9cb7-9efcf0853ffc?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.10.35","to_inclusive":true,"patched_in":"1.10.36"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T11:12:53Z"},{"id":"wordfence:3f6291ab-99d1-41e2-9928-f31beee0df8b","source":"wordfence","cve":"CVE-2024-13603","title":"Wise Forms <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6291ab-99d1-41e2-9928-f31beee0df8b?source=api-prod","affected":[{"type":"plugin","slug":"wise-forms","name":"Wise Forms","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-30T22:06:03Z"},{"id":"wordfence:3f630773-f65a-44a5-9b84-ea542c78a69a","source":"wordfence","cve":"CVE-2017-8875","title":"Clean Login <= 1.10.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f630773-f65a-44a5-9b84-ea542c78a69a?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.10.4"}],"published":"2020-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f635716-5748-48bf-bbfb-75d302a901e9","source":"wordfence","cve":"CVE-2025-57961","title":"CoDesigner <= 4.30 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f635716-5748-48bf-bbfb-75d302a901e9?source=api-prod","affected":[{"type":"plugin","slug":"woolementor","name":"CoDesigner \u2013 All in One Elementor WooCommerce Builder","from":"*","from_inclusive":true,"to":"4.30","to_inclusive":true,"patched_in":"4.31"}],"published":"2025-09-22T00:00:00Z","updated":"2026-06-08T16:12:47Z"},{"id":"wordfence:3f6412bf-65ec-445f-a1fe-27aeb8330712","source":"wordfence","cve":"CVE-2024-31368","title":"Soledad <= 8.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6412bf-65ec-445f-a1fe-27aeb8330712?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.5","to_inclusive":true,"patched_in":"8.4.6"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-11T14:57:32Z"},{"id":"wordfence:3f6683c7-182a-4cd9-be6e-9832f01c3c71","source":"wordfence","cve":"CVE-2015-9397","title":"GoCodes <= 1.3.5 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6683c7-182a-4cd9-be6e-9832f01c3c71?source=api-prod","affected":[{"type":"plugin","slug":"gocodes","name":"GoCodes","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f6870fa-e11b-4d59-9008-8b156417e93b","source":"wordfence","cve":"CVE-2015-3313","title":"Community Events < 1.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6870fa-e11b-4d59-9008-8b156417e93b?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f6b435b-d8b4-434b-8cac-cc3adbc437eb","source":"wordfence","cve":"CVE-2026-65640","title":"WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6b435b-d8b4-434b-8cac-cc3adbc437eb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.34","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.29","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.30","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.26","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.23","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.25","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.22","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.20","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.19","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.18","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.16","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.14","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.15","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.11","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.10","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.9","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.6","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.6","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.7","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.6","to_inclusive":true,"patched_in":"4.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"4.7.35"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-12T15:55:26Z"},{"id":"wordfence:3f6b48b7-d6dc-46ba-a7e6-03802c540ccd","source":"wordfence","cve":"CVE-2026-28161","title":"Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6b48b7-d6dc-46ba-a7e6-03802c540ccd?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:50:43Z"},{"id":"wordfence:3f6c7142-22e6-4221-bbcf-eaa2795d361e","source":"wordfence","cve":"CVE-2025-59553","title":"Custom iFrame for Elementor <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6c7142-22e6-4221-bbcf-eaa2795d361e?source=api-prod","affected":[{"type":"plugin","slug":"custom-iframe","name":"Custom iFrame \u2013 Embed PDFs, Videos, and External Content in WordPress (Elementor & Gutenberg)","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:01:17Z"},{"id":"wordfence:3f6d9c23-53e9-4393-beff-2f996c279ad8","source":"wordfence","cve":"CVE-2024-9590","title":"Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6d9c23-53e9-4393-beff-2f996c279ad8?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-taxonomy-meta","name":"Category and Taxonomy Meta Fields","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T07:36:33Z"},{"id":"wordfence:3f7088ce-961c-4cf3-ab94-3ef9a626006b","source":"wordfence","cve":"CVE-2025-68596","title":"Bit Assist <= 1.5.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7088ce-961c-4cf3-ab94-3ef9a626006b?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-12-19T00:00:00Z","updated":"2026-01-06T15:00:01Z"},{"id":"wordfence:3f7426bc-63ca-4586-b5a9-cef0572a061f","source":"wordfence","cve":"CVE-2026-118080","title":"Social Snap \u2014 Social Share Buttons & Click to Tweet <= 1.5.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7426bc-63ca-4586-b5a9-cef0572a061f?source=api-prod","affected":[{"type":"plugin","slug":"socialsnap","name":"Social Snap \u2014 Social Share Buttons & Click to Tweet","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:22:58Z","updated":"2026-11-03T19:41:58Z"},{"id":"wordfence:3f749054-7aeb-4d37-ba2a-5f15028b2571","source":"wordfence","cve":"CVE-2025-22648","title":"Blog, Posts and Category Filter for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f749054-7aeb-4d37-ba2a-5f15028b2571?source=api-prod","affected":[{"type":"plugin","slug":"blog-posts-and-category-for-elementor","name":"Blog, Posts and Category Filter for Elementor","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-30T13:44:01Z"},{"id":"wordfence:3f753961-3eeb-402d-876f-4a4dea41a96a","source":"wordfence","cve":"","title":"Duplicator < 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f753961-3eeb-402d-876f-4a4dea41a96a?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f7616d0-7b42-4b2e-8378-18c24c7bf22b","source":"wordfence","cve":"CVE-2025-6537","title":"Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7616d0-7b42-4b2e-8378-18c24c7bf22b?source=api-prod","affected":[{"type":"plugin","slug":"namasha-by-mdesign","name":"Namasha By Mdesign","from":"*","from_inclusive":true,"to":"1.2.00","to_inclusive":true,"patched_in":"1.2.05"}],"published":"2025-06-25T14:07:03Z","updated":"2025-08-11T13:54:38Z"},{"id":"wordfence:3f767b28-9339-4844-a205-a356683edd88","source":"wordfence","cve":"CVE-2026-94064","title":"Neo | Barber Shop WordPress <= 3.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f767b28-9339-4844-a205-a356683edd88?source=api-prod","affected":[{"type":"theme","slug":"neocut","name":"Neo | Barber Shop WordPress Theme","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:14:30Z"},{"id":"wordfence:3f7a5e27-af7e-4e32-be9b-08e1133bb323","source":"wordfence","cve":"CVE-2024-32835","title":"Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7a5e27-af7e-4e32-be9b-08e1133bb323?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-04-22T00:00:00Z","updated":"2025-03-04T20:57:12Z"},{"id":"wordfence:3f7e300f-06b5-4f59-9deb-9771bf86a204","source":"wordfence","cve":"CVE-2024-11915","title":"RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7e300f-06b5-4f59-9deb-9771bf86a204?source=api-prod","affected":[{"type":"plugin","slug":"rrdevs-for-elementor","name":"RRAddons for Elementor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T19:02:59Z","updated":"2025-01-11T07:21:51Z"},{"id":"wordfence:3f7f7cb3-e153-4315-991c-80e8c9be7764","source":"wordfence","cve":"CVE-2026-66430","title":"Visitor Traffic Real Time Statistics pro <= 11.10 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f7f7cb3-e153-4315-991c-80e8c9be7764?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.10","to_inclusive":true,"patched_in":"11.11"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:55:50Z"},{"id":"wordfence:3f80902e-edc8-4cac-a50d-6332fef35356","source":"wordfence","cve":"CVE-2025-52720","title":"Super Store Finder <= 7.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f80902e-edc8-4cac-a50d-6332fef35356?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:18:54Z"},{"id":"wordfence:3f809bde-56a5-4fd1-9cc7-bfc0c91487d6","source":"wordfence","cve":"CVE-2026-112244","title":"Duplicator < 5.1.0 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f809bde-56a5-4fd1-9cc7-bfc0c91487d6?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T15:31:38Z"},{"id":"wordfence:3f80a1ce-dab4-4479-bbe6-2b454d03b17c","source":"wordfence","cve":"CVE-2026-86851","title":"Livees Checkout 6.8 - 7.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f80a1ce-dab4-4479-bbe6-2b454d03b17c?source=api-prod","affected":[{"type":"plugin","slug":"livees-checkout","name":"Livees Checkout","from":"6.8","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-28T21:18:08Z"},{"id":"wordfence:3f81003b-8214-4fa3-960f-81b166623de9","source":"wordfence","cve":"","title":"GS Pins for Pinterest Lite <= 1.8.0 - Missing Authorization via _update_shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f81003b-8214-4fa3-960f-81b166623de9?source=api-prod","affected":[{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f82427e-5731-4694-8d90-4d14c01f19fb","source":"wordfence","cve":"CVE-2025-24567","title":"WP Mailster <= 1.8.16.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f82427e-5731-4694-8d90-4d14c01f19fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-12-07T00:00:00Z","updated":"2025-02-20T16:22:32Z"},{"id":"wordfence:3f8321a7-863c-43ab-a42a-e01d60101c3b","source":"wordfence","cve":"CVE-2022-45365","title":"Stock Ticker <= 3.23.2 - Reflected Cross-Site Scripting in ajax_stockticker_symbol_search_test","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8321a7-863c-43ab-a42a-e01d60101c3b?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.23.2","to_inclusive":true,"patched_in":"3.23.3"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f8397ff-35aa-445f-b370-d9fd0d1847e6","source":"wordfence","cve":"CVE-2025-52718","title":"Alone <= 7.8.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8397ff-35aa-445f-b370-d9fd0d1847e6?source=api-prod","affected":[{"type":"theme","slug":"alone","name":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2025-07-01T00:00:00Z","updated":"2025-08-04T19:27:09Z"},{"id":"wordfence:3f83a514-2b42-4348-9525-438205daeeab","source":"wordfence","cve":"CVE-2024-9068","title":"OneElements \u2013 Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f83a514-2b42-4348-9525-438205daeeab?source=api-prod","affected":[{"type":"plugin","slug":"oneelements-ultimate-addons-for-elementor","name":"OneElements \u2013 Best Elementor Addons","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:20:54Z","updated":"2024-09-25T02:05:11Z"},{"id":"wordfence:3f873f1a-19e6-4490-9067-59ee67538ee1","source":"wordfence","cve":"CVE-2025-48262","title":"Url Rewrite Analyzer <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f873f1a-19e6-4490-9067-59ee67538ee1?source=api-prod","affected":[{"type":"plugin","slug":"url-rewrite-analyzer","name":"Url Rewrite Analyzer","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:33:06Z"},{"id":"wordfence:3f8af7fd-5800-4179-849e-a7ffaf8c3ad4","source":"wordfence","cve":"CVE-2021-24972","title":"Pixel Cat Lite <= 2.6.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8af7fd-5800-4179-849e-a7ffaf8c3ad4?source=api-prod","affected":[{"type":"plugin","slug":"facebook-conversion-pixel","name":"Pixel Cat \u2013 Conversion Pixel Manager","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f8c5c34-e7ea-4034-85d9-104f0e0815cf","source":"wordfence","cve":"CVE-2025-66097","title":"I Order Terms <= 1.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8c5c34-e7ea-4034-85d9-104f0e0815cf?source=api-prod","affected":[{"type":"plugin","slug":"i-order-terms","name":"I Order Terms","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-25T15:52:40Z"},{"id":"wordfence:3f8cbbbb-2089-4966-8fd3-da4f76fb2517","source":"wordfence","cve":"CVE-2026-3090","title":"Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8cbbbb-2089-4966-8fd3-da4f76fb2517?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-18T15:28:32Z"},{"id":"wordfence:3f8dced7-cbe1-4d50-9fa0-1cf441dddefa","source":"wordfence","cve":"CVE-2025-14110","title":"WP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8dced7-cbe1-4d50-9fa0-1cf441dddefa?source=api-prod","affected":[{"type":"plugin","slug":"wp-js-list-pages-shortcodes","name":"WP Js List Pages Shortcodes","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:28:47Z","updated":"2026-01-07T09:20:54Z"},{"id":"wordfence:3f8e363d-60ec-4e86-856c-c4ffc11fe690","source":"wordfence","cve":"CVE-2026-8866","title":"jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8e363d-60ec-4e86-856c-c4ffc11fe690?source=api-prod","affected":[{"type":"plugin","slug":"jquery-googleslides","name":"jQuery googleslides","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:34Z","updated":"2026-05-27T05:31:24Z"},{"id":"wordfence:3f8f083e-0de2-42a5-b289-101ec53aa44c","source":"wordfence","cve":"CVE-2026-3309","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f083e-0de2-42a5-b289-101ec53aa44c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.11","to_inclusive":true,"patched_in":"4.16.12"}],"published":"2026-04-03T22:12:00Z","updated":"2026-04-04T11:16:16Z"},{"id":"wordfence:3f8f3f75-4c31-47df-826c-8fb26239add6","source":"wordfence","cve":"CVE-2025-62938","title":"Reoon Email Verifier <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f3f75-4c31-47df-826c-8fb26239add6?source=api-prod","affected":[{"type":"plugin","slug":"reoon-email-verifier","name":"Reoon Email Verifier","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-10-09T00:00:00Z","updated":"2025-12-11T14:44:46Z"},{"id":"wordfence:3f8f8319-d75f-4e71-90d4-1c60b5a8df90","source":"wordfence","cve":"CVE-2025-47511","title":"Welcart e-Commerce <= 2.11.13 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f8f8319-d75f-4e71-90d4-1c60b5a8df90?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.13","to_inclusive":true,"patched_in":"2.11.14"}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-10T14:50:38Z"},{"id":"wordfence:3f904fd6-c937-4676-8e6e-6e94d3c42b0d","source":"wordfence","cve":"CVE-2024-25905","title":"Multi Step Form <= 1.7.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f904fd6-c937-4676-8e6e-6e94d3c42b0d?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":"1.7.19"}],"published":"2024-02-12T00:00:00Z","updated":"2024-04-03T14:07:19Z"},{"id":"wordfence:3f915fa1-38ca-4090-8f3f-3d8a1b0a2c4c","source":"wordfence","cve":"CVE-2024-44017","title":"MH Board <= 1.3.2.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f915fa1-38ca-4090-8f3f-3d8a1b0a2c4c?source=api-prod","affected":[{"type":"plugin","slug":"mh-board","name":"MH Board","from":"*","from_inclusive":true,"to":"1.3.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:33:55Z"},{"id":"wordfence:3f92c416-8e95-4097-9f16-e1f9389b2334","source":"wordfence","cve":"CVE-2026-22390","title":"Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f92c416-8e95-4097-9f16-e1f9389b2334?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:35:29Z"},{"id":"wordfence:3f937290-fa45-4ce0-84f0-a42c83cd3bdf","source":"wordfence","cve":"","title":"DT Chocolate <= 1.0 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f937290-fa45-4ce0-84f0-a42c83cd3bdf?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-02-03T00:00:00Z","updated":"2024-08-15T18:14:40Z"},{"id":"wordfence:3f9592d1-73a0-422e-b6d2-c31cc79a1a90","source":"wordfence","cve":"CVE-2024-6927","title":"Viral Signup <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9592d1-73a0-422e-b6d2-c31cc79a1a90?source=api-prod","affected":[{"type":"plugin","slug":"viral-signup","name":"Viral Signup \u2013 limited opt-in with viral refferal sharing","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-09T13:49:01Z"},{"id":"wordfence:3f95c288-7710-46aa-898b-a923afa7a4ab","source":"wordfence","cve":"CVE-2023-51527","title":"AI Power: Complete AI Pack \u2013 Powered by GPT-4 <= 1.8.1 - Missing Authorization to Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f95c288-7710-46aa-898b-a923afa7a4ab?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f95f73c-2377-46b7-a96f-6014a5b012c3","source":"wordfence","cve":"CVE-2014-9178","title":"SP Project & Document Manager < 2.4.4 - Multiple SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f95f73c-2377-46b7-a96f-6014a5b012c3?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f9acfe0-7a99-47ed-aceb-4cea6ce4f55e","source":"wordfence","cve":"CVE-2025-60169","title":"W3SCloud Contact Form 7 to Zoho CRM <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9acfe0-7a99-47ed-aceb-4cea6ce4f55e?source=api-prod","affected":[{"type":"plugin","slug":"w3s-cf7-zoho","name":"W3SCloud Contact Form 7 to Zoho CRM","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:09:55Z"},{"id":"wordfence:3f9bf252-dcfb-4142-8301-1a5b565e975a","source":"wordfence","cve":"","title":"FunCaptcha \u2013 Anti-Spam CAPTCHA < 0.3.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9bf252-dcfb-4142-8301-1a5b565e975a?source=api-prod","affected":[{"type":"plugin","slug":"funcaptcha","name":"FunCaptcha \u2013 Anti-Spam CAPTCHA","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":false,"patched_in":"0.3.3"}],"published":"2014-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3f9c3503-9c31-4620-9d82-a7cbb1c3fa33","source":"wordfence","cve":"CVE-2025-22652","title":"Payment Forms for Paystack <= 4.0.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9c3503-9c31-4620-9d82-a7cbb1c3fa33?source=api-prod","affected":[{"type":"plugin","slug":"payment-forms-for-paystack","name":"Payment Forms for Paystack","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-23T17:46:21Z"},{"id":"wordfence:3f9d57ae-b238-43db-8eee-ccab499b1cbc","source":"wordfence","cve":"CVE-2026-4084","title":"fyyd podcast shortcodes <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9d57ae-b238-43db-8eee-ccab499b1cbc?source=api-prod","affected":[{"type":"plugin","slug":"fyyd-podcast-shortcodes","name":"fyyd podcast shortcodes","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:48Z","updated":"2026-03-21T03:26:41Z"},{"id":"wordfence:3fa0dbad-fc00-46f1-bcc4-b41116d1c4ae","source":"wordfence","cve":"CVE-2025-49903","title":"ZoloBlocks <= 2.3.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa0dbad-fc00-46f1-bcc4-b41116d1c4ae?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-04T16:24:32Z"},{"id":"wordfence:3fa1afa6-f9b5-4153-ab0b-8fd5291f63d7","source":"wordfence","cve":"CVE-2025-62151","title":"Virtuaria PagBank / PagSeguro para Woocommerce <= 3.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa1afa6-f9b5-4153-ab0b-8fd5291f63d7?source=api-prod","affected":[{"type":"plugin","slug":"virtuaria-pagseguro","name":"Virtuaria Payments with PagBank for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-19T14:26:10Z"},{"id":"wordfence:3fa41a0a-ee17-4b6a-b973-ab70bcd7622e","source":"wordfence","cve":"CVE-2025-46225","title":"Post in page for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa41a0a-ee17-4b6a-b973-ab70bcd7622e?source=api-prod","affected":[{"type":"plugin","slug":"post-in-page-for-elementor","name":"Post in page for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:16:02Z"},{"id":"wordfence:3fa5ddd8-8166-45eb-9576-8683c1d12cc6","source":"wordfence","cve":"CVE-2026-12094","title":"Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa5ddd8-8166-45eb-9576-8683c1d12cc6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-contact-form-7-compact-db","name":"Advanced Contact Form 7 \u2013 Compact DB","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:41:39Z","updated":"2026-06-24T05:33:24Z"},{"id":"wordfence:3fa62b8f-1c2f-4bc9-9f2a-8b9765c2d30d","source":"wordfence","cve":"","title":"Login/Signup Popup <= 2.3 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa62b8f-1c2f-4bc9-9f2a-8b9765c2d30d?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fa63ac2-b063-40a1-beaf-a27f56688347","source":"wordfence","cve":"CVE-2026-24979","title":"Jobica Core <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa63ac2-b063-40a1-beaf-a27f56688347?source=api-prod","affected":[{"type":"plugin","slug":"jobica-core","name":"Jobica Core","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-05-05T14:47:48Z"},{"id":"wordfence:3fa78f4e-ede2-4863-a2d7-99bd8c7b5912","source":"wordfence","cve":"CVE-2024-7630","title":"Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa78f4e-ede2-4863-a2d7-99bd8c7b5912?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.22.2","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2024-08-15T13:29:09Z","updated":"2025-05-13T07:24:53Z"},{"id":"wordfence:3fa88976-774a-4a85-869b-81d29442525f","source":"wordfence","cve":"CVE-2025-32929","title":"Barcode Generator for WooCommerce <= 2.0.4 - Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa88976-774a-4a85-869b-81d29442525f?source=api-prod","affected":[{"type":"plugin","slug":"embedding-barcodes-into-product-pages-and-orders","name":"Barcode Generator for WooCommerce \u2013 Show barcodes on products, orders, invoices and other pages","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T18:32:23Z"},{"id":"wordfence:3fa9e1cf-a7d5-4373-81ca-87e9275fe413","source":"wordfence","cve":"CVE-2025-23423","title":"SendGrid for WordPress <= 1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa9e1cf-a7d5-4373-81ca-87e9275fe413?source=api-prod","affected":[{"type":"plugin","slug":"wp-sendgrid-mailer","name":"SendGrid for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:26:02Z"},{"id":"wordfence:3facf09f-2e5d-42d0-b0b3-3aea93febe48","source":"wordfence","cve":"CVE-2024-4094","title":"Simple Share Buttons Adder <= 8.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3facf09f-2e5d-42d0-b0b3-3aea93febe48?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2024-05-28T00:00:00Z","updated":"2024-06-13T17:57:07Z"},{"id":"wordfence:3fad525f-8dcb-453c-9e53-2335c6d1c46d","source":"wordfence","cve":"CVE-2022-3139","title":"We\u2019re Open! <= 1.41 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fad525f-8dcb-453c-9e53-2335c6d1c46d?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"1.41","to_inclusive":true,"patched_in":"1.42"}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3faf976d-0763-4e47-9bc3-18c791ec4487","source":"wordfence","cve":"CVE-2024-9104","title":"UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check","severity":"medium","cvss":5.6,"cwe":"CWE-703","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3faf976d-0763-4e47-9bc3-18c791ec4487?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_AI","name":"Ultimate AI","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:03Z"},{"id":"wordfence:3fb25dd5-4191-46ec-8b36-5bb389a7ebfc","source":"wordfence","cve":"CVE-2026-16589","title":"Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb25dd5-4191-46ec-8b36-5bb389a7ebfc?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:46:09Z"},{"id":"wordfence:3fb35366-b09c-4667-8fb9-6f80ba6d09f0","source":"wordfence","cve":"CVE-2023-49844","title":"WPPerformanceTester <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb35366-b09c-4667-8fb9-6f80ba6d09f0?source=api-prod","affected":[{"type":"plugin","slug":"wpperformancetester","name":"WPPerformanceTester","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fb46633-50c5-4adf-8097-50e6aecefb5d","source":"wordfence","cve":"CVE-2025-30972","title":"Woocommerce Line Notify <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb46633-50c5-4adf-8097-50e6aecefb5d?source=api-prod","affected":[{"type":"plugin","slug":"woo-line-notify","name":"Woocommerce Line Notify","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T17:57:18Z"},{"id":"wordfence:3fb59a19-3d04-4605-a98a-bcff51359708","source":"wordfence","cve":"CVE-2026-32433","title":"CP Contact Form with Paypal <= 1.3.61 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb59a19-3d04-4605-a98a-bcff51359708?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.61","to_inclusive":true,"patched_in":"1.3.62"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:19:03Z"},{"id":"wordfence:3fb6123c-2891-4cfd-8d68-a922c30d7600","source":"wordfence","cve":"CVE-2024-3827","title":"Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb6123c-2891-4cfd-8d68-a922c30d7600?source=api-prod","affected":[{"type":"plugin","slug":"spectra-pro","name":"Spectra Pro","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-08-01T17:20:51Z","updated":"2024-08-02T05:30:01Z"},{"id":"wordfence:3fbda86c-188c-4705-a7eb-77b201f91a18","source":"wordfence","cve":"CVE-2025-52804","title":"Nuss <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fbda86c-188c-4705-a7eb-77b201f91a18?source=api-prod","affected":[{"type":"theme","slug":"nuss","name":"Nuss - Hotel Booking WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-16T18:34:46Z"},{"id":"wordfence:3fbdb0df-fc76-496f-aed5-38d4221c730c","source":"wordfence","cve":"CVE-2025-53346","title":"Thim Core <= 2.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fbdb0df-fc76-496f-aed5-38d4221c730c?source=api-prod","affected":[{"type":"plugin","slug":"thim-core","name":"Thim Core","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:37:05Z"},{"id":"wordfence:3fbfb185-d901-4789-9a13-137f72234ed4","source":"wordfence","cve":"CVE-2026-14433","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fbfb185-d901-4789-9a13-137f72234ed4?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2026-08-14T14:02:35Z","updated":"2026-10-14T16:20:26Z"},{"id":"wordfence:3fc04d8a-f551-4e91-b920-f2a8efcf61de","source":"wordfence","cve":"CVE-2025-22624","title":"FooGallery <= 2.4.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc04d8a-f551-4e91-b920-f2a8efcf61de?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2025-02-27T00:00:00Z","updated":"2025-03-06T20:27:18Z"},{"id":"wordfence:3fc2c2df-b590-413f-ba07-5aa645d069b8","source":"wordfence","cve":"CVE-2024-5530","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +12 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc2c2df-b590-413f-ba07-5aa645d069b8?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2024-06-10T16:01:08Z","updated":"2024-06-11T04:32:13Z"},{"id":"wordfence:3fc4793e-cda0-475e-8cab-411f19c46594","source":"wordfence","cve":"CVE-2026-22361","title":"A-Mart <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc4793e-cda0-475e-8cab-411f19c46594?source=api-prod","affected":[{"type":"theme","slug":"a-mart","name":"A-Mart - Organic Products Store Shopify Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:32:30Z"},{"id":"wordfence:3fc5e9b3-a121-40f0-a7e8-32979254f52e","source":"wordfence","cve":"","title":"Register Plus Redux <= 4.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc5e9b3-a121-40f0-a7e8-32979254f52e?source=api-prod","affected":[{"type":"plugin","slug":"register-plus-redux","name":"Register Plus Redux","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2012-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fc683c5-6939-4750-aba2-0e1f3b33ab5a","source":"wordfence","cve":"CVE-2026-28145","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.39 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc683c5-6939-4750-aba2-0e1f3b33ab5a?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:34:29Z"},{"id":"wordfence:3fc752bb-3f1d-4106-9df1-361564905a55","source":"wordfence","cve":"CVE-2024-13366","title":"Sandbox <= 0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc752bb-3f1d-4106-9df1-361564905a55?source=api-prod","affected":[{"type":"plugin","slug":"sandbox","name":"Sandbox","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T07:01:27Z"},{"id":"wordfence:3fc94760-d64b-48e1-b2bd-40cedcf48340","source":"wordfence","cve":"CVE-2024-37540","title":"Leaky Paywall <= 4.21.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc94760-d64b-48e1-b2bd-40cedcf48340?source=api-prod","affected":[{"type":"plugin","slug":"leaky-paywall","name":"Leaky Paywall","from":"*","from_inclusive":true,"to":"4.21.2","to_inclusive":true,"patched_in":"4.21.3"}],"published":"2024-07-06T00:00:00Z","updated":"2024-08-28T16:35:33Z"},{"id":"wordfence:3fc962d7-2301-436e-ac1f-6309cd958ecd","source":"wordfence","cve":"CVE-2026-28109","title":"LambertGroup - AllInOne - Content Slider <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fc962d7-2301-436e-ac1f-6309cd958ecd?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-contentSlider","name":"LambertGroup - AllInOne - Content Slider","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:32:00Z"},{"id":"wordfence:3fcb35f8-ed88-4440-8cdf-95c1f0028253","source":"wordfence","cve":"CVE-2024-9649","title":"WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fcb35f8-ed88-4440-8cdf-95c1f0028253?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2024-10-15T00:00:00Z","updated":"2026-01-21T11:22:41Z"},{"id":"wordfence:3fd42c34-f6bb-46b9-9816-5bdfe673bae7","source":"wordfence","cve":"CVE-2025-30956","title":"Booqable Rental <= 2.4.25 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd42c34-f6bb-46b9-9816-5bdfe673bae7?source=api-prod","affected":[{"type":"plugin","slug":"booqable-rental-reservations","name":"Booqable Rental Plugin","from":"*","from_inclusive":true,"to":"2.4.25","to_inclusive":true,"patched_in":"2.4.26"}],"published":"2025-06-05T00:00:00Z","updated":"2026-06-08T16:12:34Z"},{"id":"wordfence:3fd4f002-86eb-476d-9550-7ab922e7039b","source":"wordfence","cve":"CVE-2026-114270","title":"GeoDirectory <= 2.8.196 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd4f002-86eb-476d-9550-7ab922e7039b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.196","to_inclusive":true,"patched_in":"2.8.197"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:24:35Z"},{"id":"wordfence:3fd58af7-e8ef-4518-bed8-4e20c8e61db7","source":"wordfence","cve":"CVE-2026-15660","title":"SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd58af7-e8ef-4518-bed8-4e20c8e61db7?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"7.4.7","to_inclusive":true,"patched_in":"7.4.8"}],"published":"2026-09-18T14:01:23Z","updated":"2026-09-19T02:27:08Z"},{"id":"wordfence:3fd620a3-5d9e-4bc3-b026-871610df7c2d","source":"wordfence","cve":"CVE-2023-47177","title":"Linker <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd620a3-5d9e-4bc3-b026-871610df7c2d?source=api-prod","affected":[{"type":"plugin","slug":"linker","name":"Linker \u2013 URL shortener & track outbound link clicks","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-10-31T00:00:00Z","updated":"2024-04-18T20:15:25Z"},{"id":"wordfence:3fd6469c-bf36-4a46-a899-8d5163df8935","source":"wordfence","cve":"CVE-2026-14207","title":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes <= 10.0.9 - Authenticated (Custom role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fd6469c-bf36-4a46-a899-8d5163df8935?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"10.0.9","to_inclusive":true,"patched_in":"10.0.10"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:39:28Z"},{"id":"wordfence:3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0","source":"wordfence","cve":"","title":"Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fda31fa-efc9-44b9-99ba-9e3e23aa2ee0?source=api-prod","affected":[{"type":"plugin","slug":"ultimeter","name":"Ultimeter \u2013 the Ultimate Progress and Goals Meter","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":false,"patched_in":"1.9.3"},{"type":"plugin","slug":"past-events-extension","name":"Past Events Extension","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"geo-request","name":"WordPress Cloaking \u2013 Show & Create Geo-Targeted Custom HTML Plugin \u2013 GeoRequest","from":"*","from_inclusive":true,"to":"0.1.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"section-slider","name":"Content Slider for WP Posts (Section Slider)","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"krsp-frontend-file-upload","name":"KRSP Frontend File Uploader","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"resermy","name":"Online Booking for Barbershops and Salons","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"},{"type":"plugin","slug":"any-popup","name":"Any Popup \u2013 Popup Forms, Optins & Ads","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"enhanced-catalog-images-for-woocommerce","name":"enhanced-catalog-images-for-woocommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"error-log-monitor","name":"Error Log Monitor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"},{"type":"plugin","slug":"featured-image-toolkit","name":"FIT: Featured Image Toolkit","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-advance-comment","name":"WP Advanced Comment","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-private-media","name":"WP Private Media","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"devices","name":"Device Frame","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"consultpress-lite","name":"ConsultPress Lite","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"animate-everything","name":"WordPress Animation Plugin \u2013 Animated Everything","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woorocks-magic-content","name":"WooRocks Magic Content","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"},{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"},{"type":"plugin","slug":"demomentsomtres-address","name":"DeMomentSomTres Address","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"web-disrupt-funnelmentals","name":"Funnelmentals","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"},{"type":"plugin","slug":"better-robots-txt","name":"Better Robots.txt \u2013 AI-Ready Crawl Control & Bot Governance","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"},{"type":"plugin","slug":"gfirem-fields","name":"GFireM Fields","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":false,"patched_in":"2.18.0"},{"type":"plugin","slug":"edd-tab-manager","name":"EDD Tab Manager","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"gfirem-action-after","name":"GFireM Action After","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"a-staff","name":"a-staff \u2013 Team member showcase plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wgauge","name":"wGauge \u2013 Free Version","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"},{"type":"plugin","slug":"social-gallery-lite","name":"Social Gallery Lite","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"plugin","slug":"starfish-reviews","name":"Starfish Review Generation & Marketing for WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"},{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"},{"type":"plugin","slug":"next-order-coupon-woocommerce","name":"WooCommerce Next Order Coupon","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"addendio","name":"Addendio LITE \u2013 Find WordPress plugins and themes","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"price-bands-for-woocommerce","name":"Price Bands for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"perelandra-sermons","name":"Perelandra Sermons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-munich-blocks","name":"WP Munich Blocks \u2013 Gutenberg Blocks for WordPress","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":false,"patched_in":"0.7.3"},{"type":"plugin","slug":"go-fetch-jobs-jobengine","name":"go-fetch-jobs-jobengine","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gfirem-advance-search","name":"GFireM Advance Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"speculor","name":"Speculor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"remove-wp-update-nags","name":"Remove WP Update Nags","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"},{"type":"plugin","slug":"content-collector","name":"Content Collector","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"1.6.17","to_inclusive":false,"patched_in":"1.6.17"},{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":false,"patched_in":"1.3.20"},{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"},{"type":"plugin","slug":"tinymce-annotate","name":"TinyMCE Annotate","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-admin-product-notes","name":"Woo Admin Product Notes","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"run-time-image-resizing","name":"Run time Image resizing","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-pinterest-conversion-tags","name":"Add Pinterest conversion tags for Pinterest Ads +  Site verification","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"one-page-blocks","name":"One Page Blocks","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"page-studio-lite","name":"Page Studio Lite Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"shuban","name":"Shuban","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"demomentsomtres-grid-archive","name":"DeMomentSomTres Grid Archive","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"random-sorting-order-for-woocommerce","name":"Random Sorting Order for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"inbound-brew","name":"Inbound Brew","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-photo-effects","name":"WP Photo Effects","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"plugin","slug":"turbo-widgets","name":"Turbo Widgets","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"press-elements","name":"Press Elements \u2013 Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms-easypin","name":"BuddyForms EasyPin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sexy-author-bio","name":"WP Author Bio","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rw-divi-unite-gallery","name":"RW Divi Unite Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"revolution-for-elementor","name":"Revolution for Elementor","from":"*","from_inclusive":true,"to":"0.0.19","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"quick-orders-for-woocommerce","name":"Product Tables for WooCommerce: Quickster","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"feedback-suite","name":"Get feedback from visitors \u2013 WP Feedback Suite Plugin","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"content-aware-sidebars","name":"Content Aware Sidebars \u2013 Fastest Widget Area Plugin","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":false,"patched_in":"3.8.1"},{"type":"theme","slug":"bani","name":"Bani","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fast-wp","name":"Fast WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"import-social-statistics","name":"Import Social Statistics","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.6.1","to_inclusive":false,"patched_in":"3.2.6.1"},{"type":"plugin","slug":"review-engine","name":"Affiliate Link Builder Plugin for Amazon Associates \u2013 Review Engine","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-seo-keyword-optimizer","name":"BAVOKO SEO Tools \u2013 All-in-One WordPress SEO","from":"*","from_inclusive":true,"to":"2.1.9.8","to_inclusive":false,"patched_in":"2.1.9.8"},{"type":"plugin","slug":"ultimate-widgets-light","name":"Ultimate Widgets Light","from":"*","from_inclusive":true,"to":"1.5.9.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.2997","to_inclusive":false,"patched_in":"4.2997"},{"type":"plugin","slug":"nitek-carousel-cool-transitions","name":"Nitek Carousel Slider Cool Transitions","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"3.3.1.2","to_inclusive":false,"patched_in":"3.3.1.2"},{"type":"plugin","slug":"reach-us-contact-form","name":"Contact Form for WordPress- Cybrosys","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-for-siteorigin","name":"Widgets for SiteOrigin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"},{"type":"plugin","slug":"nexus","name":"NEXUS","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpworx-faq","name":"WordPress FAQ Plugin \u2013 WPWorx","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"brand","name":"Brand","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-variation-swatches","name":"Premmerce Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"},{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"},{"type":"plugin","slug":"kanzu-support-desk","name":"Kanzu Support Desk \u2013 WordPress Helpdesk  Plugin","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"expire-tags","name":"Expire tags","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"reviewpress","name":"WordPress Reviews by ReviewPress","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":false,"patched_in":"2.7.3"},{"type":"plugin","slug":"cp-simple-newsletter","name":"CP Simple Newsletter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"demomentsomtres-categories","name":"DeMomentSomTres Categories","from":"*","from_inclusive":true,"to":"201704251008","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-relevant-ads","name":"WP Relevant Ads","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"giveaways-for-woocommerce","name":"Giveaways for woocommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"demomentsomtres-media-tools-auto","name":"DeMomentSomTres Media Tools Auto","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"},{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"},{"type":"plugin","slug":"before-and-after-product-images-for-woocommerce","name":"Before and After Product Images for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"customer-chat-facebook","name":"Customer Chat Facebook","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"delete-duplicate-posts","name":"Delete Duplicate Posts","from":"*","from_inclusive":true,"to":"4.1.9.5","to_inclusive":false,"patched_in":"4.1.9.5"},{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"},{"type":"plugin","slug":"helpie-faq","name":"Helpie FAQ \u2014 Accordion, Docs & Knowledge Base","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":false,"patched_in":"0.7.2"},{"type":"plugin","slug":"livemesh-siteorigin-widgets","name":"Livemesh SiteOrigin Widgets","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"},{"type":"plugin","slug":"gravity-forms-sticky-list","name":"Gravity Forms Sticky List","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-fail2ban","name":"WP fail2ban \u2013 Advanced Security","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"},{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.3.57","to_inclusive":false,"patched_in":"3.3.57"},{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"},{"type":"plugin","slug":"contact-form-7-multi-step-module","name":"Webheadcoder Multi-Step Forms for Contact Form 7","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"},{"type":"plugin","slug":"demomentsomtres-classify-on-publish","name":"DeMomentSomTres Classify on Publish","from":"*","from_inclusive":true,"to":"201703020805","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-buddha-free-adwords","name":"wp-buddha-free-adwords","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"purus","name":"Purus","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rm-mailchimp-manager","name":"MailChimp Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"automatic-post-categories","name":"Automatic Post Categories","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"global-income-stats-from-freemius","name":"Global Income Stats from Freemius","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cryptocurrency","name":"Cryptocurrency Portfolio Tracker","from":"*","from_inclusive":true,"to":"0.0.17","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woorocks-magic-content-for-siteorigins-pagebuilder","name":"Magic Content for Siteorigins Pagebuilder","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"master-blocks","name":"Master Blocks \u2013 Gutenberg Site Builder","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-on-pages-and-posts","name":"Widgets on Pages and Posts","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sheetpress","name":"SheetPress \u2013 Manage WordPress Meta data with Google Sheets","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"typea-ftc-disclosure","name":"FTC Disclosure","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-pro-counter","name":"WP Pro Counter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nugget-by-ingot","name":"Nugget by Ingot: Easy, automated and native A/B testing for everyone","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-to-twitter","name":"XPoster \u2013 Share to Bluesky and Mastodon","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"},{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"2.2.3.1","to_inclusive":false,"patched_in":"2.2.3.1"},{"type":"plugin","slug":"custom-registration-and-login-forms-with-new-recaptcha","name":"Custom Registration and Custom Login Forms with New Recaptcha","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"freemage","name":"freemage","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"co2ok-for-woocommerce","name":"ClimateClick: Climate Action for all","from":"*","from_inclusive":true,"to":"1.0.9.21","to_inclusive":true,"patched_in":"1.0.9.22"},{"type":"plugin","slug":"snazzyadmin-wp-admin-theme","name":"SnazzyAdmin WP Admin Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"admin-notices-for-team","name":"Ant Admin Notices for Team","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"edd-courses","name":"Easy Digital Downloads \u2013 Courses","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":false,"patched_in":"0.1.1"},{"type":"plugin","slug":"wp-affiliate-disclosure","name":"WP Affiliate Disclosure","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"},{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":false,"patched_in":"3.1.7"},{"type":"plugin","slug":"multilist-subscribe-for-sendy","name":"Multilist Subscribe for Sendy","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-code-snippets","name":"Easy Code Snippets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"premmerce-woocommerce-product-filter","name":"Premmerce Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"},{"type":"plugin","slug":"easy-watermark","name":"Easy Watermark","from":"*","from_inclusive":true,"to":"0.7.1","to_inclusive":false,"patched_in":"0.7.1"},{"type":"plugin","slug":"cp-image-gallery","name":"CP Image Gallery","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2019-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fdc6a04-ef39-498a-b739-f40d5d8af47e","source":"wordfence","cve":"CVE-2024-12721","title":"Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fdc6a04-ef39-498a-b739-f40d5d8af47e?source=api-prod","affected":[{"type":"plugin","slug":"wb-custom-product-tabs-for-woocommerce","name":"Custom Product tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-12-20T18:48:17Z","updated":"2025-01-09T21:52:16Z"},{"id":"wordfence:3fddf493-246b-4e39-99a7-503c9fab3652","source":"wordfence","cve":"CVE-2025-26576","title":"WP Simple Slideshow <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf493-246b-4e39-99a7-503c9fab3652?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-slideshow","name":"WP Simple Slideshow","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-17T18:04:35Z"},{"id":"wordfence:3fddf96e-029c-4753-ba82-043ca64b78d3","source":"wordfence","cve":"CVE-2024-2879","title":"LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fddf96e-029c-4753-ba82-043ca64b78d3?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"7.9.11","from_inclusive":true,"to":"7.10.0","to_inclusive":true,"patched_in":"7.10.1"}],"published":"2024-04-02T00:00:00Z","updated":"2024-04-03T03:34:43Z"},{"id":"wordfence:3fdf03a8-ccb6-4c99-942a-3e6d86053b7f","source":"wordfence","cve":"CVE-2026-106469","title":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form < 3.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fdf03a8-ccb6-4c99-942a-3e6d86053b7f?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-form","name":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":false,"patched_in":"3.0.11"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:24Z"},{"id":"wordfence:3fe03c7b-9a98-4479-ba91-ab662dcddf6a","source":"wordfence","cve":"CVE-2024-50437","title":"GeoDirectory <= 2.3.80 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe03c7b-9a98-4479-ba91-ab662dcddf6a?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.80","to_inclusive":true,"patched_in":"2.3.81"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:42:18Z"},{"id":"wordfence:3fe1313c-1368-4bcb-9d11-25b948da5547","source":"wordfence","cve":"CVE-2023-26520","title":"Advanced Text Widget  <= 2.1.2 - Missing Authorization via atw_dismiss_admin_notice","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1313c-1368-4bcb-9d11-25b948da5547?source=api-prod","affected":[{"type":"plugin","slug":"advanced-text-widget","name":"Advanced Text Widget","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fe1bb24-1f60-40f6-9b5e-58e0158bdfd3","source":"wordfence","cve":"CVE-2022-31475","title":"GiveWP <= 2.20.2 - Authenticated Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1bb24-1f60-40f6-9b5e-58e0158bdfd3?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.20.2","to_inclusive":true,"patched_in":"2.21.0"}],"published":"2022-07-12T14:18:00Z","updated":"2024-06-06T16:04:07Z"},{"id":"wordfence:3fe1f3c3-4a81-4aae-9a5e-e5889f4c69ba","source":"wordfence","cve":"CVE-2024-13661","title":"Table Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1f3c3-4a81-4aae-9a5e-e5889f4c69ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-editor","name":"Table Editor","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-01-30T00:27:40Z","updated":"2025-01-30T13:41:56Z"},{"id":"wordfence:3fe2f85d-0d68-49f0-8e0b-8d09c463be79","source":"wordfence","cve":"CVE-2025-57920","title":"Category Featured Images Extended <= 1.52 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe2f85d-0d68-49f0-8e0b-8d09c463be79?source=api-prod","affected":[{"type":"plugin","slug":"category-featured-images-extended","name":"Category Featured Images Extended","from":"*","from_inclusive":true,"to":"1.52","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:22:01Z"},{"id":"wordfence:3fe3fa95-cc1d-469b-8a97-37987b9ae362","source":"wordfence","cve":"CVE-2026-3995","title":"OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe3fa95-cc1d-469b-8a97-37987b9ae362?source=api-prod","affected":[{"type":"plugin","slug":"open-brain","name":"OPEN-BRAIN","from":"*","from_inclusive":true,"to":"0.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T17:42:29Z","updated":"2026-04-16T06:44:51Z"},{"id":"wordfence:3fe91c7e-e4d4-4308-a8ca-22d7985ddb61","source":"wordfence","cve":"CVE-2024-47646","title":"Payflex Payment Gateway <= 2.6.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe91c7e-e4d4-4308-a8ca-22d7985ddb61?source=api-prod","affected":[{"type":"plugin","slug":"payflex-payment-gateway","name":"Payflex Payment Gateway","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-16T14:29:00Z"},{"id":"wordfence:3feb5f46-e861-40ec-84e8-aade0667eec6","source":"wordfence","cve":"CVE-2024-12813","title":"Open Hours \u2013 Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3feb5f46-e861-40ec-84e8-aade0667eec6?source=api-prod","affected":[{"type":"plugin","slug":"open-hours","name":"Open Hours \u2013  Easy Opening Hours","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:44:29Z","updated":"2025-02-18T04:21:14Z"},{"id":"wordfence:3feb84c9-fc98-4f59-a124-b6434e5b8a44","source":"wordfence","cve":"CVE-2022-4619","title":"Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3feb84c9-fc98-4f59-a124-b6434e5b8a44?source=api-prod","affected":[{"type":"plugin","slug":"codelights-shortcodes-and-widgets","name":"Sidebar Widgets by CodeLights","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3fef9990-023a-4d4b-8c52-3b71aac97e7b","source":"wordfence","cve":"CVE-2023-0366","title":"Loan Comparison <= 1.5.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fef9990-023a-4d4b-8c52-3b71aac97e7b?source=api-prod","affected":[{"type":"plugin","slug":"loan-comparison","name":"Loan Comparison","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ff3c560-26b6-4139-97dc-670ea9b8bb33","source":"wordfence","cve":"CVE-2026-25309","title":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.10.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff3c560-26b6-4139-97dc-670ea9b8bb33?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.11.0"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:26:26Z"},{"id":"wordfence:3ff3fe84-c2c2-4251-b05b-00d5524a6563","source":"wordfence","cve":"CVE-2026-81775","title":"Estatik Real Estate Plugin <= 4.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff3fe84-c2c2-4251-b05b-00d5524a6563?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:35:11Z"},{"id":"wordfence:3ff54694-64c4-4112-b126-aabd3e09144b","source":"wordfence","cve":"CVE-2025-10000","title":"Qyrr \u2013 simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff54694-64c4-4112-b126-aabd3e09144b?source=api-prod","affected":[{"type":"plugin","slug":"qyrr-code","name":"Qyrr \u2013 simply and modern QR-Code creation","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2025-09-29T15:22:20Z","updated":"2026-02-06T17:36:54Z"},{"id":"wordfence:3ff59aa5-a2f2-4fe1-a0b6-d9b07b0fdb1a","source":"wordfence","cve":"CVE-2023-2830","title":"WP Testimonials  <= 1.4.2 - Cross-Site Request Forgery to Widget Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff59aa5-a2f2-4fe1-a0b6-d9b07b0fdb1a?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-widgets","name":"WP Testimonials","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:3ff5cff8-ecca-4cde-b3f6-09ee49afea25","source":"wordfence","cve":"CVE-2026-93681","title":"Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff5cff8-ecca-4cde-b3f6-09ee49afea25?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-15T19:54:42Z","updated":"2026-10-16T08:27:41Z"},{"id":"wordfence:3ff73a18-cb00-4e35-afcf-d1a0ae586a4c","source":"wordfence","cve":"CVE-2026-28059","title":"Dermatology Clinic <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff73a18-cb00-4e35-afcf-d1a0ae586a4c?source=api-prod","affected":[{"type":"theme","slug":"dermatology-clinic","name":"Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:19:21Z"},{"id":"wordfence:3ff90774-f5f6-4d9c-9565-1cff31f9bec4","source":"wordfence","cve":"CVE-2025-2840","title":"DAP to Autoresponders Email Syncing <= 1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff90774-f5f6-4d9c-9565-1cff31f9bec4?source=api-prod","affected":[{"type":"plugin","slug":"dap-to-autoresponders-daar","name":"DAP to Autoresponders Email Syncing","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T18:38:02Z","updated":"2025-03-29T07:03:29Z"},{"id":"wordfence:3ff96d74-8f20-49a6-bd02-0bfe3498b599","source":"wordfence","cve":"CVE-2025-4610","title":"WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff96d74-8f20-49a6-bd02-0bfe3498b599?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-05-16T21:04:33Z","updated":"2025-05-17T09:22:56Z"},{"id":"wordfence:3ffb41da-73c1-4e25-89de-d821fb138fd5","source":"wordfence","cve":"CVE-2026-82193","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ffb41da-73c1-4e25-89de-d821fb138fd5?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.134","to_inclusive":false,"patched_in":"0.9.134"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:49:26Z"},{"id":"wordfence:3ffd63ca-5ea4-451c-aa97-092a754ca79f","source":"wordfence","cve":"CVE-2024-3867","title":"Tainacan Interface <= 2.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ffd63ca-5ea4-451c-aa97-092a754ca79f?source=api-prod","affected":[{"type":"theme","slug":"tainacan-interface","name":"Tainacan Interface","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-16T16:35:28Z"},{"id":"wordfence:3ffd6ce0-2536-43a5-9925-438bc653d0e5","source":"wordfence","cve":"CVE-2026-1311","title":"Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3ffd6ce0-2536-43a5-9925-438bc653d0e5?source=api-prod","affected":[{"type":"plugin","slug":"worry-proof-backup","name":"Worry Proof Backup","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T16:01:10Z","updated":"2026-02-26T04:36:17Z"},{"id":"wordfence:3fffdda5-91ed-4b79-bc04-77a1c44e3b67","source":"wordfence","cve":"CVE-2026-1931","title":"Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fffdda5-91ed-4b79-bc04-77a1c44e3b67?source=api-prod","affected":[{"type":"plugin","slug":"rentfetch","name":"Rent Fetch","from":"*","from_inclusive":true,"to":"0.32.6","to_inclusive":true,"patched_in":"0.32.7"}],"published":"2026-02-17T15:35:40Z","updated":"2026-02-18T04:35:43Z"},{"id":"wordfence:3fffe8f2-9241-4a4f-8e8a-647a9e41d769","source":"wordfence","cve":"CVE-2024-49313","title":"VKontakte Wall Post <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3fffe8f2-9241-4a4f-8e8a-647a9e41d769?source=api-prod","affected":[{"type":"plugin","slug":"vkontakte-wall-post","name":"VKontakte Wall Post","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:48:13Z"},{"id":"wordfence:40000879-a5ef-48f2-97e4-77d527259af0","source":"wordfence","cve":"CVE-2025-10041","title":"Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40000879-a5ef-48f2-97e4-77d527259af0?source=api-prod","affected":[{"type":"plugin","slug":"flex-qr-code-generator","name":"Flex QR Code Generator","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-10-14T19:34:48Z","updated":"2025-10-17T20:01:54Z"},{"id":"wordfence:40005aed-07aa-44da-a06e-0187931105ec","source":"wordfence","cve":"CVE-2023-23816","title":"Sitemap Index <= 1.2.3 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40005aed-07aa-44da-a06e-0187931105ec?source=api-prod","affected":[{"type":"plugin","slug":"sitemap-index","name":"Sitemap Index","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4000c0e4-6ffd-4161-b488-429e0e863f68","source":"wordfence","cve":"CVE-2025-64268","title":"Timetics <= 1.0.44 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4000c0e4-6ffd-4161-b488-429e0e863f68?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.44","to_inclusive":true,"patched_in":"1.0.45"}],"published":"2025-11-22T00:00:00Z","updated":"2025-12-20T19:18:46Z"},{"id":"wordfence:40010bbd-049f-44b0-9492-4126c4894656","source":"wordfence","cve":"CVE-2024-49291","title":"Cooked Pro < 1.8.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40010bbd-049f-44b0-9492-4126c4894656?source=api-prod","affected":[{"type":"plugin","slug":"cooked-pro","name":"Cooked Pro","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:38:34Z"},{"id":"wordfence:400564ba-70f8-4566-b2e7-cfa6450b609e","source":"wordfence","cve":"CVE-2025-5533","title":"Knowledge Base <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/400564ba-70f8-4566-b2e7-cfa6450b609e?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-06-05T17:33:16Z","updated":"2025-06-06T06:42:48Z"},{"id":"wordfence:4007814b-7e01-4188-8a42-9564444af95f","source":"wordfence","cve":"CVE-2015-9529","title":"Easy Digital Downloads Stripe Extension <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4007814b-7e01-4188-8a42-9564444af95f?source=api-prod","affected":[{"type":"plugin","slug":"stripe-gateway","name":"Easy Digital Downloads (EDD) Stripe","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40092f13-fee7-4e88-b180-54554b22493f","source":"wordfence","cve":"CVE-2026-95684","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40092f13-fee7-4e88-b180-54554b22493f?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.15","to_inclusive":true,"patched_in":"1.8.16"}],"published":"2026-10-09T17:45:36Z","updated":"2026-10-10T06:40:10Z"},{"id":"wordfence:400d31ba-2cef-4558-8983-6689f7e4b93c","source":"wordfence","cve":"CVE-2021-24342","title":"JNews - WordPress Newspaper Magazine Blog AMP Theme < 8.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/400d31ba-2cef-4558-8983-6689f7e4b93c?source=api-prod","affected":[{"type":"theme","slug":"jnews","name":"JNews - WordPress Newspaper Magazine Blog AMP Theme","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":false,"patched_in":"8.0.6"}],"published":"2021-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:400dde23-eafb-4ace-8b4a-ac88d0b200ac","source":"wordfence","cve":"CVE-2023-46210","title":"WC Captcha <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/400dde23-eafb-4ace-8b4a-ac88d0b200ac?source=api-prod","affected":[{"type":"plugin","slug":"wc-captcha","name":"WC Captcha","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:400fe58b-8203-4fd5-a3d3-d30eb1b8cd85","source":"wordfence","cve":"CVE-2023-5386","title":"Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/400fe58b-8203-4fd5-a3d3-d30eb1b8cd85?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-08-06T13:51:56Z"},{"id":"wordfence:4013a22a-701b-43ef-90fb-f8eddf65acf2","source":"wordfence","cve":"CVE-2013-10028","title":"EELV Newsletter <= 3.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4013a22a-701b-43ef-90fb-f8eddf65acf2?source=api-prod","affected":[{"type":"plugin","slug":"eelv-newsletter","name":"EELV Newsletter","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2013-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40153d8a-b661-40bf-aaf5-90527def9fd7","source":"wordfence","cve":"CVE-2025-49067","title":"Nasa Core < 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40153d8a-b661-40bf-aaf5-90527def9fd7?source=api-prod","affected":[{"type":"plugin","slug":"nasa-core","name":"Nasa Core","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":false,"patched_in":"6.4.1"}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T20:02:53Z"},{"id":"wordfence:40156caa-7b73-4b4d-825c-bd3e58ea3ff3","source":"wordfence","cve":"CVE-2025-30606","title":"Easy Page Transition <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40156caa-7b73-4b4d-825c-bd3e58ea3ff3?source=api-prod","affected":[{"type":"plugin","slug":"easy-page-transition","name":"Easy Page Transition","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:59:25Z"},{"id":"wordfence:40186505-3031-44e7-90ae-f013750c7ea1","source":"wordfence","cve":"CVE-2026-39475","title":"User Feedback <= 1.10.1 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40186505-3031-44e7-90ae-f013750c7ea1?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T21:23:08Z"},{"id":"wordfence:401a08d8-500e-4d23-a02d-2eec09fc29d8","source":"wordfence","cve":"CVE-2025-49973","title":"Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401a08d8-500e-4d23-a02d-2eec09fc29d8?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes-controller","name":"Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-12T04:53:39Z"},{"id":"wordfence:401da94d-6538-478a-bfcd-f9c91f84a3c6","source":"wordfence","cve":"CVE-2025-60246","title":"Simple Finance Calculator <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401da94d-6538-478a-bfcd-f9c91f84a3c6?source=api-prod","affected":[{"type":"plugin","slug":"simple-finance-calculator","name":"Simple Finance Calculator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:54:52Z"},{"id":"wordfence:401e2201-9c82-4f21-aa71-b68dc84c93f4","source":"wordfence","cve":"CVE-2025-23454","title":"Nature FlipBook WordPress Plugin <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401e2201-9c82-4f21-aa71-b68dc84c93f4?source=api-prod","affected":[{"type":"plugin","slug":"vertical-diamond-flipbook-flash","name":"Nature FlipBook WordPress Plugin","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:27:37Z"},{"id":"wordfence:401ea644-bab2-4578-ab1a-7851c2e710ce","source":"wordfence","cve":"CVE-2023-22699","title":"MainWP Wordfence Extension <= 4.0.7 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401ea644-bab2-4578-ab1a-7851c2e710ce?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-wordfence-extension","name":"MainWP Wordfence Extension","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:401eeb23-bf43-49a8-9c39-4fcd0db57cd3","source":"wordfence","cve":"CVE-2023-25962","title":"Accordions <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Several Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401eeb23-bf43-49a8-9c39-4fcd0db57cd3?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:401f5d57-ce3d-46c1-bfa9-c8fab99a7e31","source":"wordfence","cve":"","title":"MailPoet Newsletters (Previous) <= 2.1.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/401f5d57-ce3d-46c1-bfa9-c8fab99a7e31?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2012-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40244a11-e72b-4afe-8613-4c7874635765","source":"wordfence","cve":"CVE-2026-25459","title":"Sober <= 3.5.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40244a11-e72b-4afe-8613-4c7874635765?source=api-prod","affected":[{"type":"theme","slug":"sober","name":"sober","from":"*","from_inclusive":true,"to":"3.5.12","to_inclusive":true,"patched_in":""}],"published":"2026-01-18T00:00:00Z","updated":"2026-02-26T19:57:05Z"},{"id":"wordfence:402582a9-9bb9-499f-b149-e60a733ff866","source":"wordfence","cve":"CVE-2024-37477","title":"Newspack Content Converter <= 0.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402582a9-9bb9-499f-b149-e60a733ff866?source=api-prod","affected":[{"type":"plugin","slug":"newspack-content-converter","name":"Newspack Content Converter","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:04:51Z"},{"id":"wordfence:4026d57c-47e6-456d-abf1-24e82464bf69","source":"wordfence","cve":"CVE-2025-39453","title":"Advanced Dynamic Pricing for WooCommerce <= 4.9.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4026d57c-47e6-456d-abf1-24e82464bf69?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:31:14Z"},{"id":"wordfence:40280168-cbdb-485e-990d-e136ef89ebbc","source":"wordfence","cve":"CVE-2026-110285","title":"Stripe Checkout <= 1.2.2.61 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40280168-cbdb-485e-990d-e136ef89ebbc?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-checkout","name":"WP Stripe Checkout","from":"*","from_inclusive":true,"to":"1.2.2.61","to_inclusive":true,"patched_in":"1.2.2.62"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:14:49Z"},{"id":"wordfence:4028fe14-eca4-4bc5-9374-084377a97461","source":"wordfence","cve":"CVE-2024-51859","title":"Bamboo Enquiries <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4028fe14-eca4-4bc5-9374-084377a97461?source=api-prod","affected":[{"type":"plugin","slug":"bamboo-enquiries","name":"Bamboo Enquiries","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:41:09Z"},{"id":"wordfence:4029d1a9-9640-4676-b38d-9e6af2032660","source":"wordfence","cve":"CVE-2026-12721","title":"Kirki <= 6.0.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4029d1a9-9640-4676-b38d-9e6af2032660?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"6.0.13"}],"published":"2026-07-14T00:00:00Z","updated":"2026-08-15T21:15:15Z"},{"id":"wordfence:402bbe9c-cf4d-457c-97ac-149e14ea6f47","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402bbe9c-cf4d-457c-97ac-149e14ea6f47?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:402d0399-bc48-4740-86a4-8bf3424fb035","source":"wordfence","cve":"CVE-2024-4663","title":"OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402d0399-bc48-4740-86a4-8bf3424fb035?source=api-prod","affected":[{"type":"plugin","slug":"osm-map-elementor","name":"OSM Map Widget for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-06-18T14:27:49Z","updated":"2024-07-03T15:30:27Z"},{"id":"wordfence:402e10b4-84f0-4f93-a85c-037876d26e58","source":"wordfence","cve":"CVE-2026-13458","title":"GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402e10b4-84f0-4f93-a85c-037876d26e58?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-07-31T19:29:04Z","updated":"2026-08-01T07:49:45Z"},{"id":"wordfence:402f1f9f-35c7-4304-891b-a07f3e84c189","source":"wordfence","cve":"CVE-2026-9028","title":"CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402f1f9f-35c7-4304-891b-a07f3e84c189?source=api-prod","affected":[{"type":"plugin","slug":"corvuspay-woocommerce-integration","name":"CorvusPay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-07-08T20:43:04Z","updated":"2026-07-09T09:31:20Z"},{"id":"wordfence:402f32fa-466b-4d9e-948f-3b7dc4507105","source":"wordfence","cve":"CVE-2026-16810","title":"Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402f32fa-466b-4d9e-948f-3b7dc4507105?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-08-13T16:53:57Z","updated":"2026-08-14T05:30:43Z"},{"id":"wordfence:402f63fb-c0c6-49b9-b5a9-382435313406","source":"wordfence","cve":"CVE-2026-88037","title":"Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/402f63fb-c0c6-49b9-b5a9-382435313406?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-29T19:36:01Z","updated":"2026-09-30T07:41:04Z"},{"id":"wordfence:4031f857-9712-4f4a-93e8-0b01f9a9c32d","source":"wordfence","cve":"CVE-2023-51508","title":"Database Cleaner <= 0.9.8 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4031f857-9712-4f4a-93e8-0b01f9a9c32d?source=api-prod","affected":[{"type":"plugin","slug":"database-cleaner","name":"Database Cleaner: Cleanup, Optimization & Repair","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40326389-5418-4ccf-8e92-cda3a9c05bd9","source":"wordfence","cve":"CVE-2026-87761","title":"Adwised Web Push Notification <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40326389-5418-4ccf-8e92-cda3a9c05bd9?source=api-prod","affected":[{"type":"plugin","slug":"adwised","name":"Adwised Web Push Notification","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:15:56Z"},{"id":"wordfence:4033de61-24f7-4c0a-af48-b258e29f9d71","source":"wordfence","cve":"CVE-2026-73993","title":"FundEngine \u2013 Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4033de61-24f7-4c0a-af48-b258e29f9d71?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:22:48Z"},{"id":"wordfence:4036057c-0c43-4d9c-97db-4861d91a4daa","source":"wordfence","cve":"CVE-2026-6404","title":"Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4036057c-0c43-4d9c-97db-4861d91a4daa?source=api-prod","affected":[{"type":"plugin","slug":"anomify","name":"Anomify AI \u2013 Anomaly Detection and Alerting","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:05:03Z","updated":"2026-05-20T01:25:48Z"},{"id":"wordfence:40371178-b04f-4360-8805-268028629755","source":"wordfence","cve":"CVE-2025-68884","title":"Simple Redirect <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40371178-b04f-4360-8805-268028629755?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-redirect","name":"WP Simple Redirect","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T15:54:53Z"},{"id":"wordfence:40390942-3112-40da-9ef4-5e4f950035ae","source":"wordfence","cve":"CVE-2026-17522","title":"Newsletters < 4.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40390942-3112-40da-9ef4-5e4f950035ae?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.17","to_inclusive":false,"patched_in":"4.17"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:49:44Z"},{"id":"wordfence:403b51d5-8752-4109-a2f9-d73061220547","source":"wordfence","cve":"CVE-2026-118438","title":"Firelight Lightbox <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/403b51d5-8752-4109-a2f9-d73061220547?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.24"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:48:30Z"},{"id":"wordfence:403c881c-b687-4e7e-8e77-a55203cfde96","source":"wordfence","cve":"","title":"Chameleon Theme < 3.9 - Arbitrary File Uploads","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/403c881c-b687-4e7e-8e77-a55203cfde96?source=api-prod","affected":[{"type":"theme","slug":"chameleon","name":"chameleon","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":false,"patched_in":"3.9"}],"published":"2013-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:403fde75-fd38-4761-88a1-7c54cbf64b22","source":"wordfence","cve":"CVE-2026-28133","title":"Filr \u2013 Secure document library <= 1.2.13 - Authenticated (Contributor+) Arbitrary File Uploads","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/403fde75-fd38-4761-88a1-7c54cbf64b22?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2026-02-26T00:00:00Z","updated":"2026-06-18T18:23:03Z"},{"id":"wordfence:404117f9-dd26-4b5b-be9a-f994f5b5fd7a","source":"wordfence","cve":"CVE-2026-62035","title":"Upcasted S3 Offload \u2013 AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404117f9-dd26-4b5b-be9a-f994f5b5fd7a?source=api-prod","affected":[{"type":"plugin","slug":"upcasted-s3-offload","name":"Upcasted S3 Offload \u2013 AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T12:51:18Z","updated":"2026-10-13T13:56:48Z"},{"id":"wordfence:4045575a-35f0-46e5-afb7-93eee9be3a97","source":"wordfence","cve":"CVE-2024-10040","title":"Infinite-Scroll <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4045575a-35f0-46e5-afb7-93eee9be3a97?source=api-prod","affected":[{"type":"plugin","slug":"infinite-scroll","name":"Infinite-Scroll","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:41:50Z","updated":"2024-10-18T04:32:52Z"},{"id":"wordfence:4045d49f-fd12-4906-9e60-97fdb082fe84","source":"wordfence","cve":"CVE-2026-75971","title":"ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4045d49f-fd12-4906-9e60-97fdb082fe84?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-08-24T22:24:38Z","updated":"2026-08-25T11:27:11Z"},{"id":"wordfence:40487921-b9eb-4a18-b6f5-194611d2ef82","source":"wordfence","cve":"CVE-2023-40198","title":"Easy Cookie Law <= 3.1 - Cross-Site Request Forgery via 'ecl_options'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40487921-b9eb-4a18-b6f5-194611d2ef82?source=api-prod","affected":[{"type":"plugin","slug":"easy-cookie-law","name":"Easy Cookie Law","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40488ed8-ab4c-4ba6-821e-ed6d7a63e260","source":"wordfence","cve":"","title":"Hotel Listings < 1.3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40488ed8-ab4c-4ba6-821e-ed6d7a63e260?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listings","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2021-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4048ae11-fece-42aa-baf3-c636c4875635","source":"wordfence","cve":"CVE-2026-0825","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4048ae11-fece-42aa-baf3-c636c4875635?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-01-27T17:44:04Z","updated":"2026-01-28T06:43:43Z"},{"id":"wordfence:40494f1e-d5df-4ed0-b107-aa52cb28bc0e","source":"wordfence","cve":"CVE-2021-24407","title":"Jannah <= 5.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40494f1e-d5df-4ed0-b107-aa52cb28bc0e?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":false,"patched_in":"5.4.5"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4049f8fb-ad81-4f09-97b3-39ac6a9275d6","source":"wordfence","cve":"CVE-2023-36518","title":"Post Hit Counter <= 1.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4049f8fb-ad81-4f09-97b3-39ac6a9275d6?source=api-prod","affected":[{"type":"plugin","slug":"post-hit-counter","name":"Post Hit Counter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:404a3124-bff7-4d92-8424-5b21382031f2","source":"wordfence","cve":"CVE-2026-13456","title":"WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404a3124-bff7-4d92-8424-5b21382031f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-09-24T19:05:19Z","updated":"2026-09-25T07:40:26Z"},{"id":"wordfence:404aabc5-1ff4-492d-8cab-4b83eb68157a","source":"wordfence","cve":"","title":"WP All Import Pro < 4.1.1 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404aabc5-1ff4-492d-8cab-4b83eb68157a?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2020-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:404aeb60-28f1-4a91-ba00-89909c943772","source":"wordfence","cve":"CVE-2026-73182","title":"BBQ Pro <= 3.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404aeb60-28f1-4a91-ba00-89909c943772?source=api-prod","affected":[{"type":"plugin","slug":"bbq-pro","name":"BBQ Pro","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:22:26Z"},{"id":"wordfence:404fab1b-45e9-470a-a0ae-73c01386d95e","source":"wordfence","cve":"CVE-2024-35635","title":"Ninja Tables \u2013 Easiest Data Table Builder <= 5.0.9 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404fab1b-45e9-470a-a0ae-73c01386d95e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T15:13:39Z"},{"id":"wordfence:404fc2d1-0c5d-4734-980e-ae3ac293d1f3","source":"wordfence","cve":"CVE-2025-49877","title":"ProfileGrid  <= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/404fc2d1-0c5d-4734-980e-ae3ac293d1f3?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.2","to_inclusive":true,"patched_in":"5.9.5.3"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T15:12:24Z"},{"id":"wordfence:40502842-8505-41fb-9d3a-a5d567040921","source":"wordfence","cve":"CVE-2017-6814","title":"WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40502842-8505-41fb-9d3a-a5d567040921?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40519181-540e-44d4-a9b7-6c8c321b1592","source":"wordfence","cve":"CVE-2025-48289","title":"Kids Planet <= 2.2.14 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40519181-540e-44d4-a9b7-6c8c321b1592?source=api-prod","affected":[{"type":"theme","slug":"kidsplanet","name":"Kids Planet - Children Kindergarten and Playgroup WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.14.1"}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:55:44Z"},{"id":"wordfence:4051a7f1-0564-41eb-8ef4-0ee1c8af57cb","source":"wordfence","cve":"CVE-2025-31777","title":"Clockinator Lite <= 1.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4051a7f1-0564-41eb-8ef4-0ee1c8af57cb?source=api-prod","affected":[{"type":"plugin","slug":"clockify-lite","name":"Clockinator Lite","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-10-13T16:54:01Z"},{"id":"wordfence:4052adde-8d3f-409c-8cd3-a0170206c3fe","source":"wordfence","cve":"CVE-2024-49637","title":"Bet WC 2018 Russia <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4052adde-8d3f-409c-8cd3-a0170206c3fe?source=api-prod","affected":[{"type":"plugin","slug":"bet-wc-2018-russia","name":"Bet WC 2018 Russia","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:45:22Z"},{"id":"wordfence:40535215-9f82-4324-8b02-8f3e2ea82940","source":"wordfence","cve":"CVE-2026-28144","title":"WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40535215-9f82-4324-8b02-8f3e2ea82940?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:34:39Z"},{"id":"wordfence:405378f8-7a93-4672-a2d4-d250ec8adcf3","source":"wordfence","cve":"CVE-2025-63045","title":"Master Slider Pro <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/405378f8-7a93-4672-a2d4-d250ec8adcf3?source=api-prod","affected":[{"type":"plugin","slug":"masterslider","name":"Master Slider Pro","from":"*","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":""}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-11T16:27:57Z"},{"id":"wordfence:405590c7-2ad2-4a04-b1e2-bb1ad6da8dde","source":"wordfence","cve":"CVE-2025-24729","title":"ElementInvader Addons for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/405590c7-2ad2-4a04-b1e2-bb1ad6da8dde?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:36:33Z"},{"id":"wordfence:40560df9-2e54-4613-94c5-c03da0e78409","source":"wordfence","cve":"CVE-2025-68900","title":"Enfold <= 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40560df9-2e54-4613-94c5-c03da0e78409?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"enfold","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"7.1.4"}],"published":"2026-01-20T00:00:00Z","updated":"2026-06-22T15:23:03Z"},{"id":"wordfence:40570bb7-1638-4305-876e-86ad4c336944","source":"wordfence","cve":"CVE-2024-31254","title":"WordPress Backup & Migration <= 1.4.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40570bb7-1638-4305-876e-86ad4c336944?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:33:16Z"},{"id":"wordfence:4057bfcf-eb96-4610-93ed-8ff1cca7506d","source":"wordfence","cve":"","title":"Intelligent WordPress Live Chat Support Plugin | Utilities <= 1.0.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4057bfcf-eb96-4610-93ed-8ff1cca7506d?source=api-prod","affected":[{"type":"plugin","slug":"ilive","name":"Intelligent WordPress Live Chat Support Plugin | Utilities","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2019-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40588454-66f3-4c84-98b4-11b81e019908","source":"wordfence","cve":"CVE-2026-66441","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40588454-66f3-4c84-98b4-11b81e019908?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T19:10:06Z"},{"id":"wordfence:40595943-121d-4492-a0ed-f2de1bd99fda","source":"wordfence","cve":"CVE-2025-2025","title":"Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fda?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.22.0","to_inclusive":true,"patched_in":"3.22.1"}],"published":"2025-03-14T22:39:51Z","updated":"2025-03-15T11:13:30Z"},{"id":"wordfence:405d5ed4-c328-41c9-9ddf-a8128d03d76d","source":"wordfence","cve":"CVE-2026-111850","title":"BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/405d5ed4-c328-41c9-9ddf-a8128d03d76d?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.5.2","to_inclusive":true,"patched_in":"14.5.3"}],"published":"2026-10-26T12:34:26Z","updated":"2026-11-03T19:23:22Z"},{"id":"wordfence:4062f981-a1d2-4e54-8fd9-f8855af0a7db","source":"wordfence","cve":"CVE-2022-0255","title":"Database Backup for WordPress <= 2.5 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4062f981-a1d2-4e54-8fd9-f8855af0a7db?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4063a82c-82e9-4d25-b252-5d617bddd042","source":"wordfence","cve":"CVE-2026-82227","title":"WPBulky \u2013 WordPress Bulk Edit Post Types <= 1.2.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4063a82c-82e9-4d25-b252-5d617bddd042?source=api-prod","affected":[{"type":"plugin","slug":"wpbulky-wp-bulk-edit-post-types","name":"WPBulky \u2013 WordPress Bulk Edit Post Types","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:56:00Z"},{"id":"wordfence:40655278-6915-4a76-ac2d-bb161d3cee92","source":"wordfence","cve":"CVE-2023-6742","title":"Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40655278-6915-4a76-ac2d-bb161d3cee92?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.7.2","to_inclusive":true,"patched_in":"1.8.7.3"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:36:12Z"},{"id":"wordfence:40682959-6cb0-4ffb-9338-519e82eb746e","source":"wordfence","cve":"CVE-2023-7082","title":"Import any XML or CSV File <= 3.7.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40682959-6cb0-4ffb-9338-519e82eb746e?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.7.3"}],"published":"2023-12-29T00:00:00Z","updated":"2024-02-06T13:43:27Z"},{"id":"wordfence:406857f1-6bd6-4888-b5c5-d2c8be1b8ef9","source":"wordfence","cve":"CVE-2020-12076","title":"Data Tables Generator by Supsystic <= 1.9.91 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406857f1-6bd6-4888-b5c5-d2c8be1b8ef9?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.9.91","to_inclusive":true,"patched_in":"1.9.92"}],"published":"2020-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:406951d8-4c61-45b3-a8a2-788921662b6c","source":"wordfence","cve":"CVE-2023-3746","title":"ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406951d8-4c61-45b3-a8a2-788921662b6c?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"0.17.0","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:406b52dc-3d36-4b03-a932-34f456395979","source":"wordfence","cve":"CVE-2025-1912","title":"Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function","severity":"high","cvss":7.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406b52dc-3d36-4b03-a932-34f456395979?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-03-25T23:22:36Z","updated":"2025-03-26T11:55:52Z"},{"id":"wordfence:406c02e0-cebb-400a-b276-dc0b0bd9f1ad","source":"wordfence","cve":"CVE-2025-69101","title":"Workreap Core <= 3.4.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406c02e0-cebb-400a-b276-dc0b0bd9f1ad?source=api-prod","affected":[{"type":"plugin","slug":"workreap_core","name":"Workreap Core","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:53:04Z"},{"id":"wordfence:406ec4be-12de-45fa-861a-83d26d2ac401","source":"wordfence","cve":"CVE-2025-22511","title":"Slides & Presentations <= 0.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406ec4be-12de-45fa-861a-83d26d2ac401?source=api-prod","affected":[{"type":"plugin","slug":"slide","name":"Slides & Presentations","from":"*","from_inclusive":true,"to":"0.0.39","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:44:05Z"},{"id":"wordfence:406f3eaf-44a7-4e32-a620-8799eb74742a","source":"wordfence","cve":"CVE-2024-12581","title":"Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406f3eaf-44a7-4e32-a620-8799eb74742a?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.53","to_inclusive":true,"patched_in":"3.2.54"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-13T05:24:50Z"},{"id":"wordfence:406f6bd7-f57f-4725-a36f-9846ac04f945","source":"wordfence","cve":"CVE-2024-3943","title":"WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406f6bd7-f57f-4725-a36f-9846ac04f945?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-05-29T15:54:21Z","updated":"2025-11-06T15:00:39Z"},{"id":"wordfence:406fe34a-0991-4653-9924-b6586091d7df","source":"wordfence","cve":"CVE-2018-0546","title":"WP All Import <= 3.4.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/406fe34a-0991-4653-9924-b6586091d7df?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2018-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40716c58-1075-492b-9323-13e7b831e206","source":"wordfence","cve":"CVE-2025-47530","title":"WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40716c58-1075-492b-9323-13e7b831e206?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.5.18","to_inclusive":true,"patched_in":"3.5.19"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-20T16:39:38Z"},{"id":"wordfence:4071c361-3a68-49b7-ac50-4b32e2e1c3ff","source":"wordfence","cve":"CVE-2013-2705","title":"WordPress Simple PayPal Shopping Cart < 3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4071c361-3a68-49b7-ac50-4b32e2e1c3ff?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40725a33-353e-443a-b1f1-ac7c3e4a1323","source":"wordfence","cve":"CVE-2026-25336","title":"Coachify <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40725a33-353e-443a-b1f1-ac7c3e4a1323?source=api-prod","affected":[{"type":"theme","slug":"coachify","name":"Coachify","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-02-08T00:00:00Z","updated":"2026-05-04T15:29:02Z"},{"id":"wordfence:4072ba5f-6385-4fa3-85b6-89dac7b60a92","source":"wordfence","cve":"CVE-2023-2446","title":"UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4072ba5f-6385-4fa3-85b6-89dac7b60a92?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40733449-7953-452e-aa11-60306be9bc5d","source":"wordfence","cve":"CVE-2022-4459","title":"WP Show Posts <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40733449-7953-452e-aa11-60306be9bc5d?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-posts","name":"WP Show Posts","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:407351fe-4148-4872-9a18-f05de0d5075b","source":"wordfence","cve":"CVE-2026-54186","title":"JobSearch WP Job Board <= 3.2.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407351fe-4148-4872-9a18-f05de0d5075b?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:59:26Z"},{"id":"wordfence:4075bf0f-d2fe-4f37-b2b3-2fbaad08ea15","source":"wordfence","cve":"CVE-2025-26755","title":"WP Airbnb Review Slider <= 3.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4075bf0f-d2fe-4f37-b2b3-2fbaad08ea15?source=api-prod","affected":[{"type":"plugin","slug":"wp-airbnb-review-slider","name":"WP Airbnb Review Slider","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:13:32Z"},{"id":"wordfence:40760f60-b81a-447b-a2c8-83c7666ce410","source":"wordfence","cve":"CVE-2024-8246","title":"Post Form \u2013 Registration Form \u2013 Profile Form for User Profiles \u2013 Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40760f60-b81a-447b-a2c8-83c7666ce410?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-14T03:29:29Z"},{"id":"wordfence:40765cfe-a60a-44dc-8cdb-f9c8e42654c3","source":"wordfence","cve":"","title":"BuddyPress <= 9.0.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40765cfe-a60a-44dc-8cdb-f9c8e42654c3?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40766e17-8134-44ed-888f-f725848baf00","source":"wordfence","cve":"CVE-2024-56299","title":"Notify Odoo <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40766e17-8134-44ed-888f-f725848baf00?source=api-prod","affected":[{"type":"plugin","slug":"notify-odoo","name":"Notify Odoo","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:11:57Z"},{"id":"wordfence:4077029c-65eb-49f4-91dc-002a7d9cf4c7","source":"wordfence","cve":"CVE-2025-32232","title":"StaffList <= 3.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4077029c-65eb-49f4-91dc-002a7d9cf4c7?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-12-04T20:22:30Z"},{"id":"wordfence:4077dd33-bd3c-4369-b9ed-b6b6b017248d","source":"wordfence","cve":"CVE-2026-16737","title":"Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4077dd33-bd3c-4369-b9ed-b6b6b017248d?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.4","to_inclusive":true,"patched_in":"6.8.5"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:43:19Z"},{"id":"wordfence:4079dc31-2c76-4ad6-a0f2-71b8370f06d8","source":"wordfence","cve":"CVE-2026-107789","title":"SmartyParcel <= 1.23.3 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4079dc31-2c76-4ad6-a0f2-71b8370f06d8?source=api-prod","affected":[{"type":"plugin","slug":"wc-ukr-shipping","name":"SmartyParcel Shipping \u2013 DHL Express, GLS, InPost & Nova Post for WooCommerce","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":"1.23.4"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:08:01Z"},{"id":"wordfence:407a0bc3-2775-4a34-9817-924bf94a4f94","source":"wordfence","cve":"CVE-2025-6439","title":"WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407a0bc3-2775-4a34-9817-924bf94a4f94?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.26","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:34:37Z","updated":"2025-10-11T09:28:38Z"},{"id":"wordfence:407a5c69-cce0-4868-aef0-ffc88981e256","source":"wordfence","cve":"CVE-2024-1559","title":"Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407a5c69-cce0-4868-aef0-ffc88981e256?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T03:28:18Z"},{"id":"wordfence:407b8568-0b47-48d1-a006-2c42e7cfdec3","source":"wordfence","cve":"","title":"Right Now (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407b8568-0b47-48d1-a006-2c42e7cfdec3?source=api-prod","affected":[{"type":"theme","slug":"rightnow","name":"Right Now","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:407d8ebe-f3fc-433a-856f-de2ad4e58b9e","source":"wordfence","cve":"CVE-2022-4161","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407d8ebe-f3fc-433a-856f-de2ad4e58b9e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:407eb7a7-6243-47f8-8091-86832ae64d64","source":"wordfence","cve":"CVE-2026-13329","title":"WC Buckaroo BPE Gateway <= 4.8.0 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Order Refund","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407eb7a7-6243-47f8-8091-86832ae64d64?source=api-prod","affected":[{"type":"plugin","slug":"wc-buckaroo-bpe-gateway","name":"Buckaroo Payments for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-17T15:59:47Z"},{"id":"wordfence:407f7165-242d-462a-88c4-3f3eb062dc27","source":"wordfence","cve":"CVE-2025-23839","title":"Sticky Button \u2013 Click to Chat <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/407f7165-242d-462a-88c4-3f3eb062dc27?source=api-prod","affected":[{"type":"plugin","slug":"sticky-chat-button","name":"Sticky Button \u2013 Click to Chat","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:29:42Z"},{"id":"wordfence:408312d3-9a9e-4b6b-9991-aee6b77745b2","source":"wordfence","cve":"CVE-2025-1310","title":"Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/408312d3-9a9e-4b6b-9991-aee6b77745b2?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.7.12"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T09:21:44Z"},{"id":"wordfence:40873fcd-4161-4862-ac73-8046159f4739","source":"wordfence","cve":"CVE-2022-0450","title":"Menu Image, Icons made easy <= 3.0.7 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40873fcd-4161-4862-ac73-8046159f4739?source=api-prod","affected":[{"type":"plugin","slug":"menu-image","name":"Menu Image, Icons made easy","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40886b66-f6a2-404c-9d0d-5fc3da6a896c","source":"wordfence","cve":"CVE-2025-13408","title":"Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40886b66-f6a2-404c-9d0d-5fc3da6a896c?source=api-prod","affected":[{"type":"plugin","slug":"foxtool","name":"Foxtool All-in-One: Contact chat button, Custom login, Media optimize images","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-12-11T14:26:52Z","updated":"2025-12-12T03:20:43Z"},{"id":"wordfence:408cd4a7-d850-40fb-9b46-9381815c1222","source":"wordfence","cve":"CVE-2015-4339","title":"Gmedia Photo Gallery <= 1.6.4 - Open Proxy","severity":"medium","cvss":5.8,"cwe":"CWE-441","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/408cd4a7-d850-40fb-9b46-9381815c1222?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"}],"published":"2015-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:408d602f-380d-4202-b9fa-9b86c801f892","source":"wordfence","cve":"CVE-2026-84847","title":"Quick Event Manager <= 9.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/408d602f-380d-4202-b9fa-9b86c801f892?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.18","to_inclusive":true,"patched_in":"9.19"}],"published":"2026-09-03T00:00:00Z","updated":"2026-10-28T21:14:22Z"},{"id":"wordfence:408e14e7-5034-4f56-90b1-76f5637938df","source":"wordfence","cve":"CVE-2025-31613","title":"AB Google Map Travel  <= 4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/408e14e7-5034-4f56-90b1-76f5637938df?source=api-prod","affected":[{"type":"plugin","slug":"ab-google-map-travel","name":"AB Google Map Travel (AB-MAP)","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:00:48Z"},{"id":"wordfence:408f0c2a-ef3c-4592-8722-d56afce92e24","source":"wordfence","cve":"CVE-2025-12833","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/408f0c2a-ef3c-4592-8722-d56afce92e24?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.139","to_inclusive":true,"patched_in":"2.8.140"}],"published":"2025-11-11T00:00:00Z","updated":"2025-11-12T04:29:10Z"},{"id":"wordfence:40906dea-6b9e-48ce-9e2b-64d1559cf8e2","source":"wordfence","cve":"CVE-2024-43925","title":"Envira Photo Gallery <= 1.8.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40906dea-6b9e-48ce-9e2b-64d1559cf8e2?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:38:15Z"},{"id":"wordfence:40937e18-3828-4e36-8bc1-5b8eb4838c3b","source":"wordfence","cve":"CVE-2017-14125","title":"Gallery \u2013 Image and Video Gallery with Thumbnails < 1.2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40937e18-3828-4e36-8bc1-5b8eb4838c3b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2017-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40957153-45f1-40c9-91ce-f3491ca7eee5","source":"wordfence","cve":"CVE-2025-8013","title":"Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"low","cvss":3.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=api-prod","affected":[{"type":"plugin","slug":"quttera-web-malware-scanner","name":"Quttera ThreatSign \u2013 Web Malware Scanner for WordPress","from":"*","from_inclusive":true,"to":"3.5.1.41","to_inclusive":true,"patched_in":"3.5.2.1"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-15T06:40:42Z"},{"id":"wordfence:4096367c-3141-4e75-97a8-6f35d15d229d","source":"wordfence","cve":"CVE-2025-31442","title":"Search engine keywords highlighter <= 0.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4096367c-3141-4e75-97a8-6f35d15d229d?source=api-prod","affected":[{"type":"plugin","slug":"keywords-highlight-tool","name":"Search engine keywords highlighter","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T13:36:24Z"},{"id":"wordfence:40975753-e780-423c-bcda-624d60a07da3","source":"wordfence","cve":"CVE-2026-104396","title":"Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40975753-e780-423c-bcda-624d60a07da3?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.34.2","to_inclusive":true,"patched_in":"1.34.3"}],"published":"2026-10-05T08:51:00Z","updated":"2026-10-08T23:24:05Z"},{"id":"wordfence:409bcd8c-6cd3-4022-a67f-57e901c83d66","source":"wordfence","cve":"CVE-2025-7733","title":"WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/409bcd8c-6cd3-4022-a67f-57e901c83d66?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T01:29:38Z","updated":"2025-12-20T13:47:43Z"},{"id":"wordfence:409f3a27-e94a-4298-88f4-69f69fb56ce8","source":"wordfence","cve":"CVE-2025-32653","title":"Cart66 Cloud <= 2.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/409f3a27-e94a-4298-88f4-69f69fb56ce8?source=api-prod","affected":[{"type":"plugin","slug":"cart66-cloud","name":"Cart66 Cloud :: WordPress Ecommerce The Easy Way","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:15:16Z"},{"id":"wordfence:40a04176-cec2-4723-a5c6-23ca2ea6ef97","source":"wordfence","cve":"CVE-2026-89324","title":"Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a04176-cec2-4723-a5c6-23ca2ea6ef97?source=api-prod","affected":[{"type":"plugin","slug":"basel-post-types","name":"Basel Post Types","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.19"}],"published":"2026-11-10T09:21:19Z","updated":"2026-11-10T21:28:25Z"},{"id":"wordfence:40a05a33-9831-4352-9676-35cc1c2c72fb","source":"wordfence","cve":"CVE-2025-62056","title":"News Event <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a05a33-9831-4352-9676-35cc1c2c72fb?source=api-prod","affected":[{"type":"theme","slug":"news-event","name":"News Event","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T15:51:08Z"},{"id":"wordfence:40a08542-5e2e-4689-b26f-99a1350185cc","source":"wordfence","cve":"CVE-2021-38343","title":"Nested Pages <= 3.1.15 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a08542-5e2e-4689-b26f-99a1350185cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40a1d4d3-a51f-4bf4-9e3c-d09ebe5ce55c","source":"wordfence","cve":"CVE-2026-81299","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.9 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a1d4d3-a51f-4bf4-9e3c-d09ebe5ce55c?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:59:18Z"},{"id":"wordfence:40a272dc-cb2a-472f-be42-733efcb2fa61","source":"wordfence","cve":"CVE-2024-2308","title":"ElementInvader Addons for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a272dc-cb2a-472f-be42-733efcb2fa61?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T01:55:44Z"},{"id":"wordfence:40a40525-f9d3-45d1-8b40-05131d11c936","source":"wordfence","cve":"CVE-2026-102388","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a40525-f9d3-45d1-8b40-05131d11c936?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.3","to_inclusive":true,"patched_in":"1.58.0"}],"published":"2026-10-08T13:03:15Z","updated":"2026-10-13T13:49:05Z"},{"id":"wordfence:40a57493-b99b-4e71-8603-e668c6283a5a","source":"wordfence","cve":"CVE-2023-28777","title":"LearnDash LMS <= 4.5.3 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a57493-b99b-4e71-8603-e668c6283a5a?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.3.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40a6a810-1151-49e6-bed4-2b7a572ac015","source":"wordfence","cve":"CVE-2015-1375","title":"Pixabay Images <= 2.0 - Authentication Bypass to Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a6a810-1151-49e6-bed4-2b7a572ac015?source=api-prod","affected":[{"type":"plugin","slug":"pixabay-images","name":"Pixabay Images","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.4"}],"published":"2015-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40a6d10e-5e68-4280-a3e2-0b93095bb4dd","source":"wordfence","cve":"CVE-2025-26986","title":"Pearl - Corporate Business < 3.4.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a6d10e-5e68-4280-a3e2-0b93095bb4dd?source=api-prod","affected":[{"type":"theme","slug":"pearl","name":"pearl","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":false,"patched_in":"3.4.8"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:30:32Z"},{"id":"wordfence:40a883e8-7ce0-4fca-a585-428b67144694","source":"wordfence","cve":"CVE-2024-0826","title":"Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a883e8-7ce0-4fca-a585-428b67144694?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-03-18T00:00:00Z","updated":"2024-07-29T21:36:13Z"},{"id":"wordfence:40a94a1e-da9e-4173-a21d-106d859c7f8c","source":"wordfence","cve":"CVE-2022-4776","title":"CC Child Pages <= 1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a94a1e-da9e-4173-a21d-106d859c7f8c?source=api-prod","affected":[{"type":"plugin","slug":"cc-child-pages","name":"CC Child Pages","from":"*","from_inclusive":true,"to":"1.42","to_inclusive":true,"patched_in":"1.43"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40a99a75-88aa-40f9-9fe9-a65118dd3464","source":"wordfence","cve":"CVE-2025-66116","title":"Ultimate Member Widgets for Elementor <= 2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a99a75-88aa-40f9-9fe9-a65118dd3464?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member-widgets-for-elementor","name":"MemberKits \u2013 Ultimate Member for Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-20T19:57:33Z"},{"id":"wordfence:40abaa5e-7dd5-4a4e-877c-0a56386f5ffe","source":"wordfence","cve":"CVE-2025-67923","title":"JetEngine <= 3.7.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40abaa5e-7dd5-4a4e-877c-0a56386f5ffe?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T19:41:54Z"},{"id":"wordfence:40acd95e-9afd-4c84-b19a-a45117c0fcde","source":"wordfence","cve":"CVE-2024-10785","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40acd95e-9afd-4c84-b19a-a45117c0fcde?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T04:24:25Z"},{"id":"wordfence:40ade684-57a2-43be-9d4a-1c0a653807eb","source":"wordfence","cve":"CVE-2023-49742","title":"Support Genix <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ade684-57a2-43be-9d4a-1c0a653807eb?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T14:57:19Z"},{"id":"wordfence:40aeb258-0c00-4cd3-944c-51c33a7e92c9","source":"wordfence","cve":"CVE-2024-44059","title":"Custom Query Blocks <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40aeb258-0c00-4cd3-944c-51c33a7e92c9?source=api-prod","affected":[{"type":"plugin","slug":"post-type-archive-mapping","name":"Custom Query Blocks","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2024-08-29T00:00:00Z","updated":"2025-12-04T20:25:24Z"},{"id":"wordfence:40b1a60a-53f3-492c-8529-26c396c8f10a","source":"wordfence","cve":"CVE-2024-38768","title":"The Pack Elementor addons (Header Footer & WooCommerce Builder,  Template Library) <= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40b1a60a-53f3-492c-8529-26c396c8f10a?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.0.8.6","to_inclusive":true,"patched_in":"2.0.8.7"}],"published":"2024-07-16T00:00:00Z","updated":"2024-08-09T20:55:26Z"},{"id":"wordfence:40b57370-4fd7-4316-9e99-a3f1d34616e8","source":"wordfence","cve":"CVE-2024-7419","title":"WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields","severity":"high","cvss":8.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40b57370-4fd7-4316-9e99-a3f1d34616e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-02-07T03:20:47Z","updated":"2025-02-07T15:21:05Z"},{"id":"wordfence:40b5a241-3cf4-476c-8fd9-d0b953234d39","source":"wordfence","cve":"CVE-2026-2424","title":"Reward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40b5a241-3cf4-476c-8fd9-d0b953234d39?source=api-prod","affected":[{"type":"plugin","slug":"applixir","name":"Reward Video Ad for WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:19Z","updated":"2026-03-21T03:26:42Z"},{"id":"wordfence:40b5d7e4-97a0-4a1c-8000-f2cfd1e751a3","source":"wordfence","cve":"CVE-2012-4272","title":"2 Click Social Media Buttons <= 0.33 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40b5d7e4-97a0-4a1c-8000-f2cfd1e751a3?source=api-prod","affected":[{"type":"plugin","slug":"2-click-socialmedia-buttons","name":"2 Click Social Media Buttons","from":"*","from_inclusive":true,"to":"0.33","to_inclusive":true,"patched_in":"0.34"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40b6f927-7b05-464e-858a-438b7b9ac81c","source":"wordfence","cve":"CVE-2024-35772","title":"Hueman <= 3.7.24 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40b6f927-7b05-464e-858a-438b7b9ac81c?source=api-prod","affected":[{"type":"theme","slug":"hueman","name":"Hueman","from":"*","from_inclusive":true,"to":"3.7.24","to_inclusive":true,"patched_in":"3.7.25"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-26T13:58:35Z"},{"id":"wordfence:40ba98a0-2193-4201-8370-34fd438dadb3","source":"wordfence","cve":"CVE-2024-12825","title":"Custom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ba98a0-2193-4201-8370-34fd438dadb3?source=api-prod","affected":[{"type":"plugin","slug":"custom-related-posts","name":"Custom Related Posts","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:38Z"},{"id":"wordfence:40bd7bf4-1132-4c13-a422-0741b106b1ea","source":"wordfence","cve":"CVE-2025-46532","title":"Tooltip <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40bd7bf4-1132-4c13-a422-0741b106b1ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-tooltip","name":"WordPress Tooltip","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:45:32Z"},{"id":"wordfence:40bf51bf-efb2-4504-815b-4681d1078f77","source":"wordfence","cve":"CVE-2023-4937","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40bf51bf-efb2-4504-815b-4681d1078f77?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40c134ed-c4b6-46f9-ba2a-9c3436d6accd","source":"wordfence","cve":"CVE-2024-51631","title":"Sticky Social Bar <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c134ed-c4b6-46f9-ba2a-9c3436d6accd?source=api-prod","affected":[{"type":"plugin","slug":"sticky-social-bar","name":"Sticky Social Bar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:22:31Z"},{"id":"wordfence:40c1ff8f-5498-4542-ad3d-e0d44ebc62ce","source":"wordfence","cve":"CVE-2026-32509","title":"Gracey < 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c1ff8f-5498-4542-ad3d-e0d44ebc62ce?source=api-prod","affected":[{"type":"theme","slug":"gracey","name":"Gracey","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:45:03Z"},{"id":"wordfence:40c20b9d-9a7d-46ca-81d1-c58150dae2cf","source":"wordfence","cve":"CVE-2022-2090","title":"Discount Rules for WooCommerce <= 2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c20b9d-9a7d-46ca-81d1-c58150dae2cf?source=api-prod","affected":[{"type":"plugin","slug":"woo-discount-rules","name":"Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40c5dd26-6063-4ab2-a370-464e84d806b7","source":"wordfence","cve":"CVE-2023-27926","title":"VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c5dd26-6063-4ab2-a370-464e84d806b7?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.88.1.0","to_inclusive":true,"patched_in":"9.88.2.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40c7ce1f-3a81-4d49-9202-2d118f30639a","source":"wordfence","cve":"CVE-2024-34430","title":"TT Custom Post Type Creator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c7ce1f-3a81-4d49-9202-2d118f30639a?source=api-prod","affected":[{"type":"plugin","slug":"tt-custom-post-type-creator","name":"TT Custom Post Type Creator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:17:26Z"},{"id":"wordfence:40c977b2-6b06-4b22-973f-15a2b7e39224","source":"wordfence","cve":"CVE-2026-100142","title":"FluentCart <= 2.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40c977b2-6b06-4b22-973f-15a2b7e39224?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:15:53Z"},{"id":"wordfence:40ca3778-95ff-4b2c-ac47-4ae8c86e245a","source":"wordfence","cve":"CVE-2024-2799","title":"Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ca3778-95ff-4b2c-ac47-4ae8c86e245a?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.971","to_inclusive":true,"patched_in":"1.3.972"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T05:35:21Z"},{"id":"wordfence:40cb3214-a11b-4bee-9422-256d12303460","source":"wordfence","cve":"CVE-2024-1718","title":"Claudio Sanches \u2013 Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40cb3214-a11b-4bee-9422-256d12303460?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-cielo","name":"Claudio Sanches \u2013 Checkout Cielo for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:09:26Z","updated":"2024-06-04T05:32:14Z"},{"id":"wordfence:40cb4d77-ee8d-42ff-9c18-0cd76910edb7","source":"wordfence","cve":"CVE-2025-22301","title":"MyBookTable Bookstore <= 3.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40cb4d77-ee8d-42ff-9c18-0cd76910edb7?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:24:33Z"},{"id":"wordfence:40cbd3c8-546d-44c6-857f-96913fa8cef8","source":"wordfence","cve":"CVE-2025-15400","title":"OpenPix <= 2.13.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40cbd3c8-546d-44c6-857f-96913fa8cef8?source=api-prod","affected":[{"type":"plugin","slug":"openpix-for-woocommerce","name":"OpenPix for WooCommerce","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:22:51Z"},{"id":"wordfence:40ce5e2b-e55b-45a7-be1b-0eda39d25127","source":"wordfence","cve":"CVE-2026-95606","title":"The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ce5e2b-e55b-45a7-be1b-0eda39d25127?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.4","to_inclusive":true,"patched_in":"6.17.4.1"}],"published":"2026-10-02T06:36:20Z","updated":"2026-10-09T00:09:04Z"},{"id":"wordfence:40ceea17-ec60-4775-8495-e2f7643d1b7c","source":"wordfence","cve":"CVE-2025-14033","title":"ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ceea17-ec60-4775-8495-e2f7643d1b7c?source=api-prod","affected":[{"type":"plugin","slug":"wc-support-system","name":"ilGhera Support System for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-05-12T17:11:52Z","updated":"2026-05-13T05:29:39Z"},{"id":"wordfence:40d6a34b-cad5-4908-b57e-be1138531172","source":"wordfence","cve":"CVE-2025-58969","title":"Custom Login URL <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40d6a34b-cad5-4908-b57e-be1138531172?source=api-prod","affected":[{"type":"plugin","slug":"custom-login-url","name":"Custom Login URL","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:17:44Z"},{"id":"wordfence:40d6ee3f-43d4-4393-a364-f00b3f3c5d78","source":"wordfence","cve":"CVE-2025-27344","title":"Phee's LinkPreview <= 1.6.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40d6ee3f-43d4-4393-a364-f00b3f3c5d78?source=api-prod","affected":[{"type":"plugin","slug":"linkpreview","name":"Phee&#039;s LinkPreview","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:37:19Z"},{"id":"wordfence:40d76d20-44fb-4cd7-89e1-bd912d6d35e3","source":"wordfence","cve":"CVE-2025-30831","title":"Themify Event Post <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40d76d20-44fb-4cd7-89e1-bd912d6d35e3?source=api-prod","affected":[{"type":"plugin","slug":"themify-event-post","name":"Themify Event Post","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:49:03Z"},{"id":"wordfence:40d80e47-3411-4e70-8a20-2e698daad6e7","source":"wordfence","cve":"","title":"UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40d80e47-3411-4e70-8a20-2e698daad6e7?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.16.56","to_inclusive":true,"patched_in":"1.16.59"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40dc5db4-0907-48bf-a483-0da40589107d","source":"wordfence","cve":"CVE-2024-52468","title":"LeadBoxer <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40dc5db4-0907-48bf-a483-0da40589107d?source=api-prod","affected":[{"type":"plugin","slug":"leadboxer","name":"LeadBoxer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-11-18T00:00:00Z","updated":"2026-02-26T15:02:22Z"},{"id":"wordfence:40e03292-c2dc-4d34-88f4-0d0631e7b981","source":"wordfence","cve":"CVE-2026-97344","title":"Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e03292-c2dc-4d34-88f4-0d0631e7b981?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-10-02T17:23:42Z","updated":"2026-10-03T05:29:14Z"},{"id":"wordfence:40e09aec-48af-4bf9-9254-b34bad7008c3","source":"wordfence","cve":"","title":"Easy Photo Album <= 1.1.5 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e09aec-48af-4bf9-9254-b34bad7008c3?source=api-prod","affected":[{"type":"plugin","slug":"easy-photo-album","name":"Easy Photo Album","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2016-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40e1215c-ac00-4fd6-b428-a57cef95aed1","source":"wordfence","cve":"CVE-2024-2336","title":"Popup Maker \u2013 Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e1215c-ac00-4fd6-b428-a57cef95aed1?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.18.2","to_inclusive":true,"patched_in":"1.18.3"}],"published":"2024-03-20T00:00:00Z","updated":"2024-05-31T15:30:17Z"},{"id":"wordfence:40e2e8fb-ea36-4602-bead-8daf75d6dfb9","source":"wordfence","cve":"CVE-2021-4348","title":"Ultimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e2e8fb-ea36-4602-bead-8daf75d6dfb9?source=api-prod","affected":[{"type":"plugin","slug":"ct-ultimate-gdpr","name":"Ultimate GDPR & CCPA Compliance Toolkit for WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":false,"patched_in":"2.5"}],"published":"2021-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40e4a3d7-36db-4420-a854-6499afa9a9a1","source":"wordfence","cve":"CVE-2026-74932","title":"Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e4a3d7-36db-4420-a854-6499afa9a9a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-16T15:51:16Z"},{"id":"wordfence:40e61b9f-2350-410e-bb3d-59329ac08658","source":"wordfence","cve":"CVE-2022-1029","title":"MiniOrange Limit Login Attempts <= 4.0.72 - Administrator+ Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e61b9f-2350-410e-bb3d-59329ac08658?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-limit-login-attempts","name":"Limit Login Attempts","from":"*","from_inclusive":true,"to":"4.0.71","to_inclusive":true,"patched_in":"4.0.72"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40e69590-0423-4445-9fa0-c3841da793f5","source":"wordfence","cve":"CVE-2026-22488","title":"Dashboard Welcome for Beaver Builder <= 1.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e69590-0423-4445-9fa0-c3841da793f5?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-welcome-for-beaver-builder","name":"Dashboard Welcome for Beaver Builder","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:24:47Z"},{"id":"wordfence:40e7be75-2336-4702-a98d-8058c26aa017","source":"wordfence","cve":"CVE-2025-54712","title":"Easy Elementor Addons <= 2.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e7be75-2336-4702-a98d-8058c26aa017?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:31:29Z"},{"id":"wordfence:40e8dc83-6417-4881-a9a3-15525c5cc6ba","source":"wordfence","cve":"CVE-2025-5534","title":"ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40e8dc83-6417-4881-a9a3-15525c5cc6ba?source=api-prod","affected":[{"type":"plugin","slug":"esv-bible-shortcode-for-wordpress","name":"ESV Bible Shortcode for WordPress","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:47:44Z","updated":"2025-06-06T06:42:48Z"},{"id":"wordfence:40eaea45-6ba2-469d-b74f-561319c09596","source":"wordfence","cve":"CVE-2026-24634","title":"Ultimate Reviews <= 3.2.16 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40eaea45-6ba2-469d-b74f-561319c09596?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-reviews","name":"Ultimate Reviews","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":true,"patched_in":"3.2.17"}],"published":"2026-01-06T00:00:00Z","updated":"2026-02-06T20:22:00Z"},{"id":"wordfence:40eaeb28-c721-4977-951d-582b7dc2bd12","source":"wordfence","cve":"CVE-2026-6701","title":"addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40eaeb28-c721-4977-951d-582b7dc2bd12?source=api-prod","affected":[{"type":"plugin","slug":"addfreespace","name":"addfreespace","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:07:04Z","updated":"2026-05-05T02:26:54Z"},{"id":"wordfence:40ec1b62-5eff-4a93-9730-9a5602b7e00f","source":"wordfence","cve":"CVE-2025-64221","title":"Reservation <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ec1b62-5eff-4a93-9730-9a5602b7e00f?source=api-prod","affected":[{"type":"plugin","slug":"dt-reservation-plugin","name":"Reservation Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-20T19:06:44Z"},{"id":"wordfence:40ec1ec5-9a8a-431b-bf6b-d7f23157403a","source":"wordfence","cve":"CVE-2026-28021","title":"Craftis - Handcraft & Artisan Elementor Template Kit <= 1.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40ec1ec5-9a8a-431b-bf6b-d7f23157403a?source=api-prod","affected":[{"type":"theme","slug":"craftis","name":"Craftis - Handcraft & Artisan Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:25:57Z"},{"id":"wordfence:40f0510a-06e3-40a9-9b93-0296f524f94a","source":"wordfence","cve":"CVE-2025-8603","title":"Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40f0510a-06e3-40a9-9b93-0296f524f94a?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.148","to_inclusive":true,"patched_in":"1.5.149"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T03:42:45Z"},{"id":"wordfence:40f3a0c3-b1b1-4827-b74c-6b2470ae82fb","source":"wordfence","cve":"CVE-2025-68009","title":"Slider Templates <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40f3a0c3-b1b1-4827-b74c-6b2470ae82fb?source=api-prod","affected":[{"type":"plugin","slug":"slider-templates","name":"Slider Templates","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-14T19:38:05Z"},{"id":"wordfence:40f79195-23e7-4091-9dcb-8b787f0606f4","source":"wordfence","cve":"","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40f79195-23e7-4091-9dcb-8b787f0606f4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"0.8.5","to_inclusive":false,"patched_in":"0.8.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:40f7fd0f-4383-44c4-8c49-f1c25e1e3681","source":"wordfence","cve":"CVE-2025-5983","title":"Meta Tag Manager <= 3.2 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40f7fd0f-4383-44c4-8c49-f1c25e1e3681?source=api-prod","affected":[{"type":"plugin","slug":"meta-tag-manager","name":"Meta Tag Manager","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2025-10-01T00:00:00Z","updated":"2025-10-29T15:54:11Z"},{"id":"wordfence:40f909ca-aadd-4a3d-9e25-24265abdee73","source":"wordfence","cve":"CVE-2024-8857","title":"WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40f909ca-aadd-4a3d-9e25-24265abdee73?source=api-prod","affected":[{"type":"plugin","slug":"wp-auctions","name":"WordPress Auction Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-20T16:59:33Z"},{"id":"wordfence:40fa29f5-525a-4986-91f9-0210a7594e46","source":"wordfence","cve":"CVE-2026-3375","title":"LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40fa29f5-525a-4986-91f9-0210a7594e46?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-27T07:45:55Z"},{"id":"wordfence:4101bd5e-94fb-4ec5-9d25-581c3211ffa7","source":"wordfence","cve":"CVE-2022-3909","title":"Add Comments <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4101bd5e-94fb-4ec5-9d25-581c3211ffa7?source=api-prod","affected":[{"type":"plugin","slug":"add-comments","name":"Add Comments","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4101c35e-5af9-4372-9ed1-fb6a15d8500f","source":"wordfence","cve":"CVE-2023-2628","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4101c35e-5af9-4372-9ed1-fb6a15d8500f?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41048058-1662-4ec1-81ac-6e8e42351e7e","source":"wordfence","cve":"CVE-2025-2907","title":"Order Delivery Date for WooCommerce 2.0 - 12.3.1- Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41048058-1662-4ec1-81ac-6e8e42351e7e?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date for WP e-Commerce","from":"2.0","from_inclusive":true,"to":"12.3.1","to_inclusive":false,"patched_in":"12.3.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-01T16:25:29Z"},{"id":"wordfence:4104f69f-b185-498a-aabf-2126ffb94ab3","source":"wordfence","cve":"CVE-2023-0730","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_order","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4104f69f-b185-498a-aabf-2126ffb94ab3?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4107199d-e3c7-4379-b39d-1868de7d777b","source":"wordfence","cve":"CVE-2024-11715","title":"WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation","severity":"medium","cvss":4.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4107199d-e3c7-4379-b39d-1868de7d777b?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:14Z"},{"id":"wordfence:4107362f-ae21-4509-b83a-0bffbde23330","source":"wordfence","cve":"CVE-2025-11754","title":"Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 - Missing Authorization to Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4107362f-ae21-4509-b83a-0bffbde23330?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-02-18T14:54:28Z","updated":"2026-02-19T03:25:13Z"},{"id":"wordfence:41086f84-bb0c-411a-9214-f574e3c736af","source":"wordfence","cve":"CVE-2026-93341","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41086f84-bb0c-411a-9214-f574e3c736af?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.71","to_inclusive":true,"patched_in":"2.1.72"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:04:28Z"},{"id":"wordfence:410ae0f1-a4ed-4631-9f80-86b7a403ce0d","source":"wordfence","cve":"CVE-2022-45084","title":"Loginizer <= 1.7.5 - Reflected Cross-Site Scripting via 'name'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/410ae0f1-a4ed-4631-9f80-86b7a403ce0d?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2022-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:410ae439-dcee-4050-81a9-110a337016e6","source":"wordfence","cve":"CVE-2018-5213","title":"Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/410ae439-dcee-4050-81a9-110a337016e6?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":false,"patched_in":"3.5.4"}],"published":"2018-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:410cc5f0-265a-46c1-a334-115142318d10","source":"wordfence","cve":"","title":"Hot Linked Image Cacher <= 1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/410cc5f0-265a-46c1-a334-115142318d10?source=api-prod","affected":[{"type":"plugin","slug":"hot-linked-image-cacher","name":"Hot Linked Image Cacher","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:410d4ab0-22dd-4993-afbf-ae6193b70977","source":"wordfence","cve":"CVE-2024-8326","title":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"high","cvss":8.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/410d4ab0-22dd-4993-afbf-ae6193b70977?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"241114","to_inclusive":true,"patched_in":"241216"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T09:22:41Z"},{"id":"wordfence:410f232f-610b-4de6-85bf-56f66b5b217e","source":"wordfence","cve":"CVE-2026-14325","title":"Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/410f232f-610b-4de6-85bf-56f66b5b217e?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.9","to_inclusive":false,"patched_in":"1.3.9.9"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:09:41Z"},{"id":"wordfence:41108c2c-99b2-4aff-8c06-bee0b6547a9a","source":"wordfence","cve":"","title":"Smart Manager For WooCommerce < 3.9.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41108c2c-99b2-4aff-8c06-bee0b6547a9a?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":false,"patched_in":"3.9.7"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41114d2a-80a9-4f01-bd1f-0b0c9efd4a6d","source":"wordfence","cve":"CVE-2026-32396","title":"Team <= 5.0.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41114d2a-80a9-4f01-bd1f-0b0c9efd4a6d?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":true,"patched_in":"5.0.14"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T21:12:09Z"},{"id":"wordfence:41116b52-8f94-4d29-8845-a27bdf817b43","source":"wordfence","cve":"CVE-2025-12368","title":"Sermon Manager <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41116b52-8f94-4d29-8845-a27bdf817b43?source=api-prod","affected":[{"type":"plugin","slug":"sermon-manager-for-wordpress","name":"Sermon Manager","from":"*","from_inclusive":true,"to":"2.30.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:25:11Z","updated":"2025-12-05T05:31:23Z"},{"id":"wordfence:4111ba11-ad79-466a-9669-3c35730a331a","source":"wordfence","cve":"CVE-2024-3885","title":"Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4111ba11-ad79-466a-9669-3c35730a331a?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.28","to_inclusive":true,"patched_in":"4.10.29"}],"published":"2024-04-23T00:00:00Z","updated":"2024-05-02T16:52:00Z"},{"id":"wordfence:4111e878-d68e-461f-94b8-fb85ddf33914","source":"wordfence","cve":"CVE-2025-49943","title":"Femme <= 1.3.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4111e878-d68e-461f-94b8-fb85ddf33914?source=api-prod","affected":[{"type":"theme","slug":"femme","name":"Femme - Fashion Blog & Magazine WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:23:48Z"},{"id":"wordfence:4112ca9a-39fa-4fe8-a060-9f8f492eb846","source":"wordfence","cve":"CVE-2023-46092","title":"Webmaster Tools <= 2.0 - Cross-Site Request Forgery vin lionscripts_plg_f","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4112ca9a-39fa-4fe8-a060-9f8f492eb846?source=api-prod","affected":[{"type":"plugin","slug":"webmaster-tools","name":"Webmaster Tools","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4113a88f-5203-4fe6-9fb4-c59a63174418","source":"wordfence","cve":"CVE-2022-41788","title":"Soledad <= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4113a88f-5203-4fe6-9fb4-c59a63174418?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4115a8d8-4651-41a8-94a7-5ebe8d23ee42","source":"wordfence","cve":"CVE-2025-46245","title":"CM Ad Changer <= 2.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4115a8d8-4651-41a8-94a7-5ebe8d23ee42?source=api-prod","affected":[{"type":"plugin","slug":"cm-ad-changer","name":"CM Ad Changer \u2013 A simple tool to control and optimize your site\u2019s banners","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:31:56Z"},{"id":"wordfence:411693fc-9df3-44b1-9a6f-58a6e8ef23b8","source":"wordfence","cve":"CVE-2024-9637","title":"School Management System \u2013 WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/411693fc-9df3-44b1-9a6f-58a6e8ef23b8?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2024-10-25T20:05:13Z","updated":"2024-10-30T17:35:19Z"},{"id":"wordfence:4117683b-5827-406c-aaaf-b01e9fdb1ba7","source":"wordfence","cve":"CVE-2025-9703","title":"Ultimate Addons for Elementor Lite <= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4117683b-5827-406c-aaaf-b01e9fdb1ba7?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-09-15T00:00:00Z","updated":"2025-10-16T14:43:53Z"},{"id":"wordfence:4119178c-9227-4623-a962-e0f103612c75","source":"wordfence","cve":"CVE-2024-11355","title":"Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4119178c-9227-4623-a962-e0f103612c75?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-youtube-video-player","name":"Ultimate YouTube Video & Shorts Player With Vimeo","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-21T17:06:42Z","updated":"2024-11-22T05:33:41Z"},{"id":"wordfence:4119cfa8-99a3-4d66-a18c-d8dff6916bd2","source":"wordfence","cve":"CVE-2025-48318","title":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846 <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4119cfa8-99a3-4d66-a18c-d8dff6916bd2?source=api-prod","affected":[{"type":"plugin","slug":"duoshuo","name":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-08-25T17:17:53Z"},{"id":"wordfence:411b7889-c2c6-48cb-967d-091585705e17","source":"wordfence","cve":"CVE-2024-24835","title":"BEAR <= 1.1.4 - Missing Authorization via Several Functions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/411b7889-c2c6-48cb-967d-091585705e17?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.4.1"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:15:42Z"},{"id":"wordfence:411ca76a-6cab-4829-8e8b-5c54697cf8ee","source":"wordfence","cve":"CVE-2024-9926","title":"Jetpack < 13.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/411ca76a-6cab-4829-8e8b-5c54697cf8ee?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.0","from_inclusive":true,"to":"10.0.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.1","from_inclusive":true,"to":"10.1.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.2","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.3","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.4","from_inclusive":true,"to":"10.4.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.5","from_inclusive":true,"to":"10.5.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.6","from_inclusive":true,"to":"10.6.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.7","from_inclusive":true,"to":"10.7.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.8","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.9","from_inclusive":true,"to":"10.9.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.0","from_inclusive":true,"to":"11.0.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.1","from_inclusive":true,"to":"11.1.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.2","from_inclusive":true,"to":"11.2.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.3","from_inclusive":true,"to":"11.3.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.4","from_inclusive":true,"to":"11.4.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.5","from_inclusive":true,"to":"11.5.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.6","from_inclusive":true,"to":"11.6.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.7","from_inclusive":true,"to":"11.7.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.8","from_inclusive":true,"to":"11.8.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.9","from_inclusive":true,"to":"11.9.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.0","from_inclusive":true,"to":"12.0.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.1","from_inclusive":true,"to":"12.1.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.2","from_inclusive":true,"to":"12.2.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.3","from_inclusive":true,"to":"12.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.4","from_inclusive":true,"to":"12.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.5","from_inclusive":true,"to":"12.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.6","from_inclusive":true,"to":"12.6.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.7","from_inclusive":true,"to":"12.7.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.8","from_inclusive":true,"to":"12.8.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.9","from_inclusive":true,"to":"12.9.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.0","from_inclusive":true,"to":"13.0","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.1","from_inclusive":true,"to":"13.1.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.2","from_inclusive":true,"to":"13.2.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.3","from_inclusive":true,"to":"13.3.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.4","from_inclusive":true,"to":"13.4.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.5","from_inclusive":true,"to":"13.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.6","from_inclusive":true,"to":"13.6","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.7","from_inclusive":true,"to":"13.7","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.8","from_inclusive":true,"to":"13.8.1","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.9","from_inclusive":true,"to":"13.9","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.9","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.1","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.2","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.4","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.7","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.8","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.9","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.0","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.4","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.5","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.6","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.7","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.9","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.0","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.1","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.2","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.3","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.4","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.5","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.6","from_inclusive":true,"to":"6.6.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.7","from_inclusive":true,"to":"6.7.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.8","from_inclusive":true,"to":"6.8.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.9","from_inclusive":true,"to":"6.9.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.1","from_inclusive":true,"to":"7.1.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.2","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.3","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.4","from_inclusive":true,"to":"7.4.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.5","from_inclusive":true,"to":"7.5.6","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.6","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.7","from_inclusive":true,"to":"7.7.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.8","from_inclusive":true,"to":"7.8.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.9","from_inclusive":true,"to":"7.9.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.0","from_inclusive":true,"to":"8.0.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.1","from_inclusive":true,"to":"8.1.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.2","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.3","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.4","from_inclusive":true,"to":"8.4.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.5","from_inclusive":true,"to":"8.5.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.6","from_inclusive":true,"to":"8.6.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.7","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.8","from_inclusive":true,"to":"8.8.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.9","from_inclusive":true,"to":"8.9.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.0","from_inclusive":true,"to":"9.0.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.1","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.2","from_inclusive":true,"to":"9.2.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.3","from_inclusive":true,"to":"9.3.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.4","from_inclusive":true,"to":"9.4.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.5","from_inclusive":true,"to":"9.5.4","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.6","from_inclusive":true,"to":"9.6.3","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.7","from_inclusive":true,"to":"9.7.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.8","from_inclusive":true,"to":"9.8.2","to_inclusive":true,"patched_in":"3.9.10"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.9","from_inclusive":true,"to":"9.9.2","to_inclusive":true,"patched_in":"3.9.10"}],"published":"2024-10-14T00:00:00Z","updated":"2024-11-14T14:29:01Z"},{"id":"wordfence:411d6ca0-933a-4c68-9681-7fce9eb34c9d","source":"wordfence","cve":"CVE-2026-13335","title":"CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/411d6ca0-933a-4c68-9681-7fce9eb34c9d?source=api-prod","affected":[{"type":"plugin","slug":"codepeople-post-map","name":"CodePeople Post Map for Google Maps","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-06-26T12:59:23Z","updated":"2026-06-27T01:27:21Z"},{"id":"wordfence:4120c8e6-e162-4adf-890c-8070e5009748","source":"wordfence","cve":"CVE-2025-6189","title":"Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4120c8e6-e162-4adf-890c-8070e5009748?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-wp-page-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2025-09-09T17:40:39Z","updated":"2026-09-14T17:10:55Z"},{"id":"wordfence:41212533-535e-4a9e-a9b8-1240021a3752","source":"wordfence","cve":"CVE-2025-3889","title":"WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity'","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41212533-535e-4a9e-a9b8-1240021a3752?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-04-30T22:01:29Z","updated":"2025-05-01T11:11:42Z"},{"id":"wordfence:41219c9d-a10d-4006-9edc-1387dfdc8b8d","source":"wordfence","cve":"","title":"yolink Search for WordPress < 2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41219c9d-a10d-4006-9edc-1387dfdc8b8d?source=api-prod","affected":[{"type":"plugin","slug":"yolink-search","name":"yolink Search for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2013-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4122a963-b8e2-448a-b268-3192613fa3df","source":"wordfence","cve":"CVE-2021-24951","title":"LearnPress <= 4.1.3 - Authenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4122a963-b8e2-448a-b268-3192613fa3df?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":false,"patched_in":"4.1.4"}],"published":"2021-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4124003c-4864-48f1-acba-9a613d9c99ae","source":"wordfence","cve":"CVE-2024-13645","title":"TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4124003c-4864-48f1-acba-9a613d9c99ae?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-04-03T16:22:47Z","updated":"2025-04-04T05:22:45Z"},{"id":"wordfence:4125005c-01be-4158-8e00-d9bfd5ed6414","source":"wordfence","cve":"CVE-2026-85116","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4125005c-01be-4158-8e00-d9bfd5ed6414?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.42.1","to_inclusive":true,"patched_in":"1.42.3"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T18:30:37Z"},{"id":"wordfence:4126d452-65a9-48f5-a3f5-5be1b8fff80c","source":"wordfence","cve":"CVE-2026-4406","title":"Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4126d452-65a9-48f5-a3f5-5be1b8fff80c?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.30","to_inclusive":true,"patched_in":"2.9.31"}],"published":"2026-04-07T10:36:04Z","updated":"2026-04-07T23:25:27Z"},{"id":"wordfence:4127aeb5-f077-4040-b6ad-55dbf2643077","source":"wordfence","cve":"CVE-2026-66047","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4127aeb5-f077-4040-b6ad-55dbf2643077?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.1","to_inclusive":true,"patched_in":"4.17.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T15:50:10Z"},{"id":"wordfence:41299927-2ed9-4cbe-b2b0-f306dc0e4a58","source":"wordfence","cve":"CVE-2024-0620","title":"PPWP \u2013 Password Protect Pages <= 1.8.9 -  Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41299927-2ed9-4cbe-b2b0-f306dc0e4a58?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:36:13Z"},{"id":"wordfence:412c39e9-9378-4c2c-817c-8d37f156af6e","source":"wordfence","cve":"CVE-2024-13890","title":"Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/412c39e9-9378-4c2c-817c-8d37f156af6e?source=api-prod","affected":[{"type":"plugin","slug":"allow-php-execute","name":"Allow PHP Execute","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T14:16:16Z","updated":"2025-03-08T02:24:03Z"},{"id":"wordfence:412d555c-9bbd-42f5-8020-ccfc18755a79","source":"wordfence","cve":"CVE-2023-6559","title":"MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/412d555c-9bbd-42f5-8020-ccfc18755a79?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2023-12-15T00:00:00Z","updated":"2024-07-29T21:36:13Z"},{"id":"wordfence:412d5fa7-08fc-402a-bcac-b2dff87de861","source":"wordfence","cve":"CVE-2024-12713","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/412d5fa7-08fc-402a-bcac-b2dff87de861?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T03:18:12Z"},{"id":"wordfence:41307a48-d49d-402f-bd3f-96b99afe6a42","source":"wordfence","cve":"CVE-2019-6112","title":"Sell Media <= 2.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41307a48-d49d-402f-bd3f-96b99afe6a42?source=api-prod","affected":[{"type":"plugin","slug":"sell-media","name":"Sell Media","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2020-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41308ae8-1b3d-4658-808d-630d6e673f3f","source":"wordfence","cve":"CVE-2026-16601","title":"CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41308ae8-1b3d-4658-808d-630d6e673f3f?source=api-prod","affected":[{"type":"plugin","slug":"cm-map-locations","name":"CM Map Locations \u2013 Visualize and share your locations in a few clicks","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2026-08-24T18:43:42Z","updated":"2026-08-25T07:39:49Z"},{"id":"wordfence:41315d40-0e93-480a-b85f-f3e4c8fa299a","source":"wordfence","cve":"CVE-2025-62921","title":"Bulk Auto Image Title Attribute <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41315d40-0e93-480a-b85f-f3e4c8fa299a?source=api-prod","affected":[{"type":"plugin","slug":"bulk-image-title-attribute","name":"Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO)","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-10-04T00:00:00Z","updated":"2026-07-08T20:45:21Z"},{"id":"wordfence:41327dfa-db64-476a-a263-7bd4f69fb857","source":"wordfence","cve":"CVE-2026-18855","title":"Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41327dfa-db64-476a-a263-7bd4f69fb857?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.4","to_inclusive":true,"patched_in":"7.9.5"}],"published":"2026-08-14T20:49:12Z","updated":"2026-08-15T18:25:57Z"},{"id":"wordfence:41348b65-97d7-467f-801f-a168eb366bba","source":"wordfence","cve":"CVE-2026-77188","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41348b65-97d7-467f-801f-a168eb366bba?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-10-27T17:45:20Z","updated":"2026-10-28T06:45:12Z"},{"id":"wordfence:4135e93e-596d-4ada-86ad-4f161e7ed38e","source":"wordfence","cve":"CVE-2025-58228","title":"Quick View for WooCommerce <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4135e93e-596d-4ada-86ad-4f161e7ed38e?source=api-prod","affected":[{"type":"plugin","slug":"woo-quickview","name":"Quick View for WooCommerce \u2013 Reno QuickView","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-29T16:00:05Z"},{"id":"wordfence:4137b8a6-532a-42fb-aa16-7d1de0e2f11f","source":"wordfence","cve":"CVE-2022-1103","title":"Advanced uploader <= 4.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"medium","cvss":5.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4137b8a6-532a-42fb-aa16-7d1de0e2f11f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-uploader","name":"Advanced uploader","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41395c95-230d-441a-a261-cd67b95b76e3","source":"wordfence","cve":"CVE-2024-33568","title":"Element Pack Pro <= 7.19.2 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization","severity":"critical","cvss":9.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41395c95-230d-441a-a261-cd67b95b76e3?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack","name":"Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin","from":"*","from_inclusive":true,"to":"7.19.2","to_inclusive":true,"patched_in":"7.19.3"}],"published":"2024-04-25T00:00:00Z","updated":"2025-02-27T18:21:12Z"},{"id":"wordfence:413962b8-09ac-4b5d-a52d-5ca832bba9f2","source":"wordfence","cve":"CVE-2018-1000508","title":"WP ULike < 3.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413962b8-09ac-4b5d-a52d-5ca832bba9f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"}],"published":"2018-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:413a6508-b94a-4131-bc1a-af278bd9b6f0","source":"wordfence","cve":"CVE-2025-63000","title":"Sermon Manager <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413a6508-b94a-4131-bc1a-af278bd9b6f0?source=api-prod","affected":[{"type":"plugin","slug":"sermon-manager-for-wordpress","name":"Sermon Manager","from":"*","from_inclusive":true,"to":"2.30.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:38:27Z"},{"id":"wordfence:413b2b38-44f2-4756-b66d-b6544c7ecaa2","source":"wordfence","cve":"","title":"Shoppable Images Lite <= 1.2.3 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413b2b38-44f2-4756-b66d-b6544c7ecaa2?source=api-prod","affected":[{"type":"plugin","slug":"mabel-shoppable-images-lite","name":"Shoppable Images (Lookbook) for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:413d1e3d-373f-4275-a8f8-910c33a32f4f","source":"wordfence","cve":"CVE-2024-34819","title":"MC Woocommerce Wishlist <=  1.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413d1e3d-373f-4275-a8f8-910c33a32f4f?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T19:54:32Z"},{"id":"wordfence:413d3ec0-8d04-4bef-9394-f666cfed733e","source":"wordfence","cve":"","title":"UsersWP <= 1.2.3.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413d3ec0-8d04-4bef-9394-f666cfed733e?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.3.23","to_inclusive":false,"patched_in":"1.2.3.23"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:413e3430-2d9b-4b14-90da-99de44b393e3","source":"wordfence","cve":"CVE-2024-34791","title":"WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413e3430-2d9b-4b14-90da-99de44b393e3?source=api-prod","affected":[{"type":"plugin","slug":"wpb-elementor-addons","name":"WPB Addons for Elementor \u2013 News Ticker, Timeline, Team & More Widgets","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-29T21:06:05Z"},{"id":"wordfence:413e5515-6cc9-4fa9-908e-2dc68778f5cb","source":"wordfence","cve":"CVE-2026-12477","title":"Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413e5515-6cc9-4fa9-908e-2dc68778f5cb?source=api-prod","affected":[{"type":"plugin","slug":"styles-and-layouts-for-gravity-forms","name":"Gravity Booster \u2013 Styles & Layouts for Gravity Forms","from":"*","from_inclusive":true,"to":"5.26","to_inclusive":true,"patched_in":"6.0"}],"published":"2026-08-15T15:32:05Z","updated":"2026-08-16T04:24:54Z"},{"id":"wordfence:413e6326-14c6-4734-8adc-114a7842c574","source":"wordfence","cve":"CVE-2024-2047","title":"ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413e6326-14c6-4734-8adc-114a7842c574?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T04:31:10Z"},{"id":"wordfence:413fa88f-1f06-4386-9cc1-53009da939d7","source":"wordfence","cve":"CVE-2021-20749","title":"Fudousan Plugin <= 5.7.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/413fa88f-1f06-4386-9cc1-53009da939d7?source=api-prod","affected":[{"type":"plugin","slug":"fudousan-plugin","name":"Fudousan Plugin","from":"*","from_inclusive":true,"to":"5.7.0","to_inclusive":true,"patched_in":""}],"published":"2021-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:414013e9-5baa-4f4f-bf67-f0e821ece807","source":"wordfence","cve":"","title":"WPJobBoard <= 5.6.4 - Reflected Cross-Site Scripting & Cross-Frame Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414013e9-5baa-4f4f-bf67-f0e821ece807?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2020-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:414165a3-78f8-4254-ac24-2de177cad3dd","source":"wordfence","cve":"CVE-2023-40607","title":"CLUEVO LMS, E-Learning Platform <= 1.10.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414165a3-78f8-4254-ac24-2de177cad3dd?source=api-prod","affected":[{"type":"plugin","slug":"cluevo-lms","name":"CLUEVO LMS, E-Learning Platform","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:414173b9-d23e-4e44-bf8c-77a074bb09e9","source":"wordfence","cve":"CVE-2025-4667","title":"Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414173b9-d23e-4e44-bf8c-77a074bb09e9?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.8.30","to_inclusive":true,"patched_in":"1.6.8.32"}],"published":"2025-06-13T20:36:07Z","updated":"2025-06-14T09:23:34Z"},{"id":"wordfence:41428fa7-455b-44be-8ec1-977e8cf8a303","source":"wordfence","cve":"CVE-2024-29922","title":"Slider Hero <= 8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41428fa7-455b-44be-8ec1-977e8cf8a303?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"8.6.1","to_inclusive":true,"patched_in":"8.7.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:50:40Z"},{"id":"wordfence:4143635d-00f0-4065-8670-5962d87940ee","source":"wordfence","cve":"CVE-2026-24956","title":"Download Manager Addons for Elementor <= 1.3.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4143635d-00f0-4065-8670-5962d87940ee?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-elementor","name":"Download Manager Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:45:57Z"},{"id":"wordfence:41437186-8802-4496-a79c-b01f7c93e486","source":"wordfence","cve":"CVE-2024-51622","title":"WP EASY RECIPE <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41437186-8802-4496-a79c-b01f7c93e486?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-recipe","name":"WP EASY RECIPE","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:20:51Z"},{"id":"wordfence:4143febf-92b3-42e7-9499-9ea83d7727d9","source":"wordfence","cve":"CVE-2024-31115","title":"Chauffeur Taxi Booking System for WordPress <= 7.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4143febf-92b3-42e7-9499-9ea83d7727d9?source=api-prod","affected":[{"type":"plugin","slug":"chauffeur-booking-system","name":"Chauffeur Taxi Booking System for WordPress","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.3"}],"published":"2024-03-29T00:00:00Z","updated":"2026-03-17T21:19:02Z"},{"id":"wordfence:414494d0-9e93-40c9-aee2-81782b22a284","source":"wordfence","cve":"CVE-2026-120846","title":"Uncanny Automator \u2013 Claude & ChatGPT MCP Server with MCP for AI Automation <= 7.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414494d0-9e93-40c9-aee2-81782b22a284?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:40:03Z"},{"id":"wordfence:414534fa-80d0-4885-8c13-c9a8e707665b","source":"wordfence","cve":"CVE-2026-110705","title":"Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414534fa-80d0-4885-8c13-c9a8e707665b?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-11-06T15:32:17Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:414636bc-3fab-41f9-9d4b-17ca1ac8a3df","source":"wordfence","cve":"CVE-2025-32654","title":"Motors <= 1.4.71 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/414636bc-3fab-41f9-9d4b-17ca1ac8a3df?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.71","to_inclusive":true,"patched_in":"1.4.72"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-07T14:09:31Z"},{"id":"wordfence:41479533-592d-4438-8162-48975b8a78a7","source":"wordfence","cve":"CVE-2025-22821","title":"StorePress <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41479533-592d-4438-8162-48975b8a78a7?source=api-prod","affected":[{"type":"theme","slug":"storepress","name":"StorePress","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:04:45Z"},{"id":"wordfence:4147e973-5a17-41d8-b8d9-5e43a23c9bc9","source":"wordfence","cve":"CVE-2023-45639","title":"Sort SearchResult By Title <= 10.0 - Cross-Site Request Forgery via settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4147e973-5a17-41d8-b8d9-5e43a23c9bc9?source=api-prod","affected":[{"type":"plugin","slug":"sort-searchresult-by-title","name":"Sort SearchResult By Title","from":"*","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":"11.0"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4148b37e-c5dd-43a1-aecf-085ce4fb2473","source":"wordfence","cve":"","title":"Portfolio by BestWebSoft < 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4148b37e-c5dd-43a1-aecf-085ce4fb2473?source=api-prod","affected":[{"type":"plugin","slug":"portfolio","name":"Portfolio by BestWebSoft \u2013 Work and Projects Presentation Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4149ee26-86c0-408b-a8e1-976c7fbf6e81","source":"wordfence","cve":"CVE-2026-25000","title":"Wheel of Life <= 1.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4149ee26-86c0-408b-a8e1-976c7fbf6e81?source=api-prod","affected":[{"type":"plugin","slug":"wheel-of-life","name":"Wheel of Life: Coaching and Assessment Tool for Life Coach","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-01-15T00:00:00Z","updated":"2026-05-04T15:19:58Z"},{"id":"wordfence:4154684d-3f9b-418f-b9d1-a5d22d4d84d3","source":"wordfence","cve":"CVE-2025-12529","title":"Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-12-01T11:27:40Z","updated":"2025-12-02T01:51:56Z"},{"id":"wordfence:415469cc-516d-41c4-a2c9-dc5dee061ada","source":"wordfence","cve":"CVE-2025-32122","title":"uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415469cc-516d-41c4-a2c9-dc5dee061ada?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-09-19T17:13:42Z"},{"id":"wordfence:4154aa02-7fa1-4858-bea7-092ec4a508ac","source":"wordfence","cve":"CVE-2023-49861","title":"Social Media Feather <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4154aa02-7fa1-4858-bea7-092ec4a508ac?source=api-prod","affected":[{"type":"plugin","slug":"social-media-feather","name":"Social Media Feather","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4158f6ff-8e0f-4531-8c94-f59220d6fea6","source":"wordfence","cve":"CVE-2024-13540","title":"WooODT Lite \u2013 Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4158f6ff-8e0f-4531-8c94-f59220d6fea6?source=api-prod","affected":[{"type":"plugin","slug":"byconsole-woo-order-delivery-time","name":"Delivery Date Time & Pickup for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-02-17T15:48:42Z","updated":"2025-03-06T20:36:04Z"},{"id":"wordfence:415a7201-bdff-4342-9e06-ce0e500cdc7c","source":"wordfence","cve":"CVE-2024-5347","title":"Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415a7201-bdff-4342-9e06-ce0e500cdc7c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.9","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2024-05-30T21:24:23Z","updated":"2024-05-31T09:31:39Z"},{"id":"wordfence:415ace14-1687-4003-b385-a21a5d5e16a7","source":"wordfence","cve":"CVE-2021-24867","title":"AccessPress Anonymous Post = 2.8.0 - Backdoored","severity":"high","cvss":8.8,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415ace14-1687-4003-b385-a21a5d5e16a7?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-anonymous-post","name":"Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post","from":"2.8.0","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:415bfddb-5223-439f-8a08-535f79631ff0","source":"wordfence","cve":"CVE-2025-5341","title":"Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415bfddb-5223-439f-8a08-535f79631ff0?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.44.1","to_inclusive":true,"patched_in":"1.44.2"}],"published":"2025-06-04T21:58:40Z","updated":"2025-06-05T11:15:07Z"},{"id":"wordfence:415c2648-4fcb-4226-baac-9e75db79bfdf","source":"wordfence","cve":"CVE-2024-30523","title":"Paid Memberships Pro \u2013 Mailchimp Add On <= 2.3.4 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415c2648-4fcb-4226-baac-9e75db79bfdf?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-mailchimp","name":"Paid Memberships Pro \u2013 Mailchimp Add On","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:29:46Z"},{"id":"wordfence:415c9658-bfb2-453b-a697-c63c08b0ca61","source":"wordfence","cve":"CVE-2026-4257","title":"Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415c9658-bfb2-453b-a697-c63c08b0ca61?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.36","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-03-30T09:13:47Z","updated":"2026-03-30T21:26:10Z"},{"id":"wordfence:415d69d9-2afd-41f8-8339-ea32fac3aa48","source":"wordfence","cve":"CVE-2024-33563","title":"XStore <= 9.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/415d69d9-2afd-41f8-8339-ea32fac3aa48?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:48:14Z"},{"id":"wordfence:4165cff7-457d-4790-8678-84c4365a191a","source":"wordfence","cve":"CVE-2023-6695","title":"Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4165cff7-457d-4790-8678-84c4365a191a?source=api-prod","affected":[{"type":"plugin","slug":"beaver-themer","name":"Beaver Themer","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.9.1"}],"published":"2024-04-03T00:00:00Z","updated":"2024-07-29T21:36:13Z"},{"id":"wordfence:4167f0ad-aeef-4525-82c9-336f9f48a55e","source":"wordfence","cve":"CVE-2024-33556","title":"XStore Core <= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4167f0ad-aeef-4525-82c9-336f9f48a55e?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:43:02Z"},{"id":"wordfence:416803bc-7851-4489-85f9-dbff0838d35b","source":"wordfence","cve":"CVE-2014-4847","title":"Random Banner < 2.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416803bc-7851-4489-85f9-dbff0838d35b?source=api-prod","affected":[{"type":"plugin","slug":"random-banner","name":"Random Banner","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2014-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4169ad47-7b66-433e-8184-cef0d0fec476","source":"wordfence","cve":"CVE-2026-13168","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4169ad47-7b66-433e-8184-cef0d0fec476?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":false,"patched_in":"4.1.20"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T19:00:04Z"},{"id":"wordfence:4169b390-0972-4aa9-ae04-f5f67afe15ef","source":"wordfence","cve":"CVE-2026-9843","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4169b390-0972-4aa9-ae04-f5f67afe15ef?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-06-19T11:55:33Z","updated":"2026-06-20T01:27:22Z"},{"id":"wordfence:416ab7d5-9f3b-4ccc-9a0f-bfe5d38b6f97","source":"wordfence","cve":"","title":"KenBurner Slider (All Versions) - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416ab7d5-9f3b-4ccc-9a0f-bfe5d38b6f97?source=api-prod","affected":[{"type":"plugin","slug":"kbslider","name":"kbslider","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:416c13ff-15ae-4ba4-8a95-7c07bec75c22","source":"wordfence","cve":"CVE-2023-41241","title":"SureCart <= 2.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416c13ff-15ae-4ba4-8a95-7c07bec75c22?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:416da317-61dc-42b5-9ade-fa41e844263b","source":"wordfence","cve":"CVE-2023-23748","title":"MainWP White Label Extension <= 4.1.1 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416da317-61dc-42b5-9ade-fa41e844263b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-branding-extension","name":"MainWP White Label Extension","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2023-01-17T00:00:00Z","updated":"2024-06-20T12:32:58Z"},{"id":"wordfence:416da5d4-3d47-443b-a82c-c059c38f5218","source":"wordfence","cve":"CVE-2023-51681","title":"Duplicator <= 1.5.7 - Cross-Site Request Forgery via views/tools/diagnostics/information.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416da5d4-3d47-443b-a82c-c059c38f5218?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.7.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:416e39c1-863a-42a1-8c6c-43ea87f29191","source":"wordfence","cve":"CVE-2025-30773","title":"TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416e39c1-863a-42a1-8c6c-43ea87f29191?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"2.9.7"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:01:20Z"},{"id":"wordfence:416ecce7-e2ca-4b73-90ff-85c6fdd94251","source":"wordfence","cve":"CVE-2024-33592","title":"Radio Player <= 2.0.73 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416ecce7-e2ca-4b73-90ff-85c6fdd94251?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-29T13:46:50Z"},{"id":"wordfence:416fc00d-2e72-41aa-9023-0c098ca32192","source":"wordfence","cve":"CVE-2012-2759","title":"Login With Ajax <= 3.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/416fc00d-2e72-41aa-9023-0c098ca32192?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.4.1"}],"published":"2012-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:417186ba-36ef-4d06-bbcd-e85eb9219689","source":"wordfence","cve":"CVE-2023-5414","title":"Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417186ba-36ef-4d06-bbcd-e85eb9219689?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.6.23","to_inclusive":true,"patched_in":"5.6.24"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4174b47a-75d0-4ada-bd4d-efbaf0b1a049","source":"wordfence","cve":"CVE-2021-4347","title":"Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4174b47a-75d0-4ada-bd4d-efbaf0b1a049?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-shipment-tracking","name":"Advanced Shipment Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:417ae2f2-e245-49bb-8b77-0eabf6095459","source":"wordfence","cve":"CVE-2023-35093","title":"MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417ae2f2-e245-49bb-8b77-0eabf6095459?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:417b9dfe-2571-4816-af55-c7cb7dfa62c6","source":"wordfence","cve":"CVE-2024-12524","title":"Clinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417b9dfe-2571-4816-af55-c7cb7dfa62c6?source=api-prod","affected":[{"type":"plugin","slug":"clinked-client-portal","name":"Clinked Client Portal","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.10"}],"published":"2025-01-29T22:54:49Z","updated":"2025-01-30T11:10:21Z"},{"id":"wordfence:417baa1c-29f0-4fec-8008-5b52359b3328","source":"wordfence","cve":"CVE-2024-0585","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417baa1c-29f0-4fec-8008-5b52359b3328?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:36:13Z"},{"id":"wordfence:417bfb08-1caf-4cb5-b9a5-25baf90b6e65","source":"wordfence","cve":"CVE-2026-89236","title":"SaveTo Wishlist Lite <= 1.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417bfb08-1caf-4cb5-b9a5-25baf90b6e65?source=api-prod","affected":[{"type":"plugin","slug":"saveto-wishlist-lite-for-woocommerce","name":"SaveTo Wishlist Lite \u2013 WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T00:00:36Z"},{"id":"wordfence:417f636d-1b60-413a-949e-89c113e636e6","source":"wordfence","cve":"CVE-2026-57365","title":"reCAPTCHA for Asgaros Forum <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417f636d-1b60-413a-949e-89c113e636e6?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-for-asgaros-forum","name":"reCAPTCHA for Asgaros Forum","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:37:41Z"},{"id":"wordfence:417fb507-a414-4bc2-ab01-d6f2fc554350","source":"wordfence","cve":"CVE-2025-3868","title":"Custom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417fb507-a414-4bc2-ab01-d6f2fc554350?source=api-prod","affected":[{"type":"plugin","slug":"admin-bookmarks","name":"Custom Admin-Bar Favorites","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T18:32:36Z","updated":"2025-04-25T06:45:28Z"},{"id":"wordfence:417ff4fd-e514-4366-b9a6-c04d7434eac1","source":"wordfence","cve":"CVE-2023-5210","title":"AMP+ Plus <= 3.0 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/417ff4fd-e514-4366-b9a6-c04d7434eac1?source=api-prod","affected":[{"type":"plugin","slug":"amp-plus","name":"AMP+ Plus","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41800ea9-1ace-42fc-9e7f-d760a126342b","source":"wordfence","cve":"CVE-2021-4346","title":"uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41800ea9-1ace-42fc-9e7f-d760a126342b?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4181b26e-89c7-4020-a3d4-29bdc88d7438","source":"wordfence","cve":"CVE-2025-1653","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4181b26e-89c7-4020-a3d4-29bdc88d7438?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T14:22:22Z","updated":"2025-04-17T13:07:24Z"},{"id":"wordfence:4181dcad-b5bd-46db-b47c-3cdee427123c","source":"wordfence","cve":"CVE-2024-12335","title":"Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4181dcad-b5bd-46db-b47c-3cdee427123c?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.12","to_inclusive":true,"patched_in":"3.11.13"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T06:42:14Z"},{"id":"wordfence:4182c4bb-fc3e-44d8-95d9-cd96ba898a34","source":"wordfence","cve":"CVE-2026-119089","title":"ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4182c4bb-fc3e-44d8-95d9-cd96ba898a34?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.12.1","to_inclusive":true,"patched_in":"3.12.2"}],"published":"2026-10-30T17:47:42Z","updated":"2026-10-31T06:44:17Z"},{"id":"wordfence:4183c3f7-7794-45f3-8fad-b87ffec3639c","source":"wordfence","cve":"CVE-2024-8514","title":"Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection","severity":"critical","cvss":9.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4183c3f7-7794-45f3-8fad-b87ffec3639c?source=api-prod","affected":[{"type":"plugin","slug":"google-website-translator","name":"Prisna GWT \u2013 Google Website Translator","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T03:37:17Z"},{"id":"wordfence:41859e1c-1ae0-49f1-82d3-5af3c15994ef","source":"wordfence","cve":"CVE-2024-7599","title":"Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41859e1c-1ae0-49f1-82d3-5af3c15994ef?source=api-prod","affected":[{"type":"plugin","slug":"advanced-sermons","name":"Advanced Sermons","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-06T13:55:16Z"},{"id":"wordfence:4186a609-84f1-4852-8ed9-e8ba6263b635","source":"wordfence","cve":"CVE-2024-47395","title":"Robokassa payment gateway for Woocommerce <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4186a609-84f1-4852-8ed9-e8ba6263b635?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:00:33Z"},{"id":"wordfence:4186fe8d-ca09-4b82-9500-7b16bd10b044","source":"wordfence","cve":"","title":"WP MAPS \u2013 Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4186fe8d-ca09-4b82-9500-7b16bd10b044?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2019-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:418747c5-1c18-46e4-b15c-4815e7397cf2","source":"wordfence","cve":"CVE-2025-64227","title":"Client Invoicing by Sprout Invoices <= 20.8.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/418747c5-1c18-46e4-b15c-4815e7397cf2?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.7","to_inclusive":true,"patched_in":"20.8.8"}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-20T19:24:37Z"},{"id":"wordfence:4187f559-87ba-46ab-9b45-7a36dd98d71d","source":"wordfence","cve":"CVE-2012-6692","title":"Yoast SEO <= 2.1.1 - Cross Site Scripting via post_title parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4187f559-87ba-46ab-9b45-7a36dd98d71d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2012-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41896fb5-1b6b-4a35-b3e9-9c4b5215b153","source":"wordfence","cve":"CVE-2021-24981","title":"Directorist <= 7.0.6.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41896fb5-1b6b-4a35-b3e9-9c4b5215b153?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.0.6.1","to_inclusive":true,"patched_in":"7.0.6.2"}],"published":"2021-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:418a6ed7-a19e-4741-a6db-f1016156a468","source":"wordfence","cve":"","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/418a6ed7-a19e-4741-a6db-f1016156a468?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.6.25","to_inclusive":false,"patched_in":"19.6.25"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-27T19:37:23Z"},{"id":"wordfence:418b9138-9ae0-41f1-a75b-69cbcaffbb88","source":"wordfence","cve":"CVE-2023-44988","title":"WP Custom Admin Interface <= 7.32 - Missing Authorization to Transients Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/418b9138-9ae0-41f1-a75b-69cbcaffbb88?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.33","to_inclusive":false,"patched_in":"7.33"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:418e1f3b-ca99-4576-add9-d6134ba3869d","source":"wordfence","cve":"CVE-2021-25072","title":"NextScripts: Social Networks Auto-Poster <= 4.3.24 - Arbitrary Post Deletion via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/418e1f3b-ca99-4576-add9-d6134ba3869d?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.3.25","to_inclusive":false,"patched_in":"4.3.25"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:419270e7-c781-41fe-9893-473074825b36","source":"wordfence","cve":"CVE-2014-4939","title":"ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/419270e7-c781-41fe-9893-473074825b36?source=api-prod","affected":[{"type":"plugin","slug":"enl-newsletter","name":"ENL Newsletter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4192f1eb-e52a-4b79-8795-ef79c687e9ae","source":"wordfence","cve":"CVE-2026-61950","title":"TrueBooker \u2013 Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4192f1eb-e52a-4b79-8795-ef79c687e9ae?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:02:08Z"},{"id":"wordfence:4195dbd4-7b6b-4201-887f-6da9bda618b8","source":"wordfence","cve":"CVE-2024-31928","title":"Top Bar  <= 3.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4195dbd4-7b6b-4201-887f-6da9bda618b8?source=api-prod","affected":[{"type":"plugin","slug":"top-bar","name":"Top Bar","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-04-10T00:00:00Z","updated":"2024-06-19T17:04:52Z"},{"id":"wordfence:41960c28-80f9-4c50-8b4b-b1175695a6f4","source":"wordfence","cve":"CVE-2025-32261","title":"Advanced All in One Admin Search by WP Spotlight <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41960c28-80f9-4c50-8b4b-b1175695a6f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-spotlight-search","name":"Advanced All in One Admin Search by WP Spotlight","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T14:21:30Z"},{"id":"wordfence:4196b8d1-23a7-4b90-8e6b-f51849d44f9c","source":"wordfence","cve":"CVE-2024-51647","title":"Featured Posts Scroll <= 1.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4196b8d1-23a7-4b90-8e6b-f51849d44f9c?source=api-prod","affected":[{"type":"plugin","slug":"featured-posts-scroll","name":"Featured Posts Scroll","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-12-12T18:00:21Z"},{"id":"wordfence:4197dd30-bfd8-4d6c-80f5-b13e3844adf8","source":"wordfence","cve":"CVE-2024-28001","title":"Favicon Rotator <= 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4197dd30-bfd8-4d6c-80f5-b13e3844adf8?source=api-prod","affected":[{"type":"plugin","slug":"favicon-rotator","name":"Favicon Rotator","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:00:32Z"},{"id":"wordfence:41985e86-eda4-4914-a7f8-3758afcc6193","source":"wordfence","cve":"CVE-2024-39643","title":"RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41985e86-eda4-4914-a7f8-3758afcc6193?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.0.1","to_inclusive":true,"patched_in":"6.0.0.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:43:54Z"},{"id":"wordfence:4198bbb2-3aff-492e-a781-b0c9477baf6c","source":"wordfence","cve":"CVE-2024-9578","title":"Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4198bbb2-3aff-492e-a781-b0c9477baf6c?source=api-prod","affected":[{"type":"plugin","slug":"hide-links","name":"Hide Links","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T13:23:05Z","updated":"2024-11-13T02:02:29Z"},{"id":"wordfence:419a42eb-19ed-46a3-9da0-3fcd2c8e2527","source":"wordfence","cve":"CVE-2024-55982","title":"Share Buttons \u2013 Social Media <= 1.0.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/419a42eb-19ed-46a3-9da0-3fcd2c8e2527?source=api-prod","affected":[{"type":"plugin","slug":"rich-web-share-button","name":"Share Buttons \u2013 Social Media","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:09:42Z"},{"id":"wordfence:419b20fa-6fea-41d7-9e3d-45ac25b4131f","source":"wordfence","cve":"CVE-2014-6242","title":"All In One WP Security & Firewall <= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters","severity":"high","cvss":7.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/419b20fa-6fea-41d7-9e3d-45ac25b4131f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":false,"patched_in":"3.8.3"}],"published":"2014-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:419cf912-3187-43d7-90ab-1a20a46d86e4","source":"wordfence","cve":"CVE-2024-13799","title":"User Private Files \u2013 File Upload & Download Manager with Secure File Sharing <= 2.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/419cf912-3187-43d7-90ab-1a20a46d86e4?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T05:27:00Z"},{"id":"wordfence:419df0c4-1e78-47da-b28d-5ab1cb66729a","source":"wordfence","cve":"CVE-2017-18557","title":"Maps by BestWebSoft <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/419df0c4-1e78-47da-b28d-5ab1cb66729a?source=api-prod","affected":[{"type":"plugin","slug":"bws-google-maps","name":"Maps by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41a1ea51-8159-4833-bec9-77b57c74c3e7","source":"wordfence","cve":"CVE-2025-30929","title":"fluXtore <= 1.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41a1ea51-8159-4833-bec9-77b57c74c3e7?source=api-prod","affected":[{"type":"plugin","slug":"fluxtore","name":"fluXtore Funnel Builder","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-07-04T00:00:00Z","updated":"2026-01-06T18:37:03Z"},{"id":"wordfence:41a2d4db-3032-476f-91d0-c4b6dcbc61e7","source":"wordfence","cve":"CVE-2026-66651","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41a2d4db-3032-476f-91d0-c4b6dcbc61e7?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-17T23:44:02Z"},{"id":"wordfence:41a362cf-e27e-436a-85f1-7c48e2e098eb","source":"wordfence","cve":"CVE-2025-7694","title":"Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41a362cf-e27e-436a-85f1-7c48e2e098eb?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.26","to_inclusive":true,"patched_in":"5.4.27"}],"published":"2025-08-01T00:00:00Z","updated":"2025-08-02T03:28:19Z"},{"id":"wordfence:41a38bb5-a474-4a78-b28d-0d730097b4cb","source":"wordfence","cve":"CVE-2025-68862","title":"Woo File Dropzone <= 1.1.7 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41a38bb5-a474-4a78-b28d-0d730097b4cb?source=api-prod","affected":[{"type":"plugin","slug":"woo-file-dropzone","name":"Woo File Dropzone","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:11:26Z"},{"id":"wordfence:41a61c0f-fffb-4810-b44a-74cbc1192ecd","source":"wordfence","cve":"","title":"HTML5 AV Manager <= 0.2.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41a61c0f-fffb-4810-b44a-74cbc1192ecd?source=api-prod","affected":[{"type":"plugin","slug":"html5avmanager","name":"HTML5 AV Manager","from":"*","from_inclusive":true,"to":"0.2.7","to_inclusive":true,"patched_in":""}],"published":"2012-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41aa5b3d-4ffd-4251-965a-a5131e925a54","source":"wordfence","cve":"CVE-2024-38737","title":"ReDi Restaurant Reservation <= 24.0422 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41aa5b3d-4ffd-4251-965a-a5131e925a54?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.0422","to_inclusive":true,"patched_in":"24.0712"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:04:49Z"},{"id":"wordfence:41ac45c7-6741-4b7c-ab74-fd2dfd3c31d1","source":"wordfence","cve":"CVE-2025-58957","title":"VPSUForm <= 3.2.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ac45c7-6741-4b7c-ab74-fd2dfd3c31d1?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.2.20","to_inclusive":true,"patched_in":"3.2.21"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:14:14Z"},{"id":"wordfence:41ad41dc-fdc9-4060-b4b2-c3c17acbd7ee","source":"wordfence","cve":"CVE-2026-19074","title":"Advanced Classifieds & Directory Pro <= 3.4.2 - Unauthenticated Non-Public Listing Custom Field Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ad41dc-fdc9-4060-b4b2-c3c17acbd7ee?source=api-prod","affected":[{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-21T15:44:55Z"},{"id":"wordfence:41adfb58-d79f-40a3-8a7e-f3f08f64659f","source":"wordfence","cve":"CVE-2023-5819","title":"Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41adfb58-d79f-40a3-8a7e-f3f08f64659f?source=api-prod","affected":[{"type":"plugin","slug":"amazonify","name":"Amazonify","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41aeb465-48c2-48db-90ea-186ceeac6753","source":"wordfence","cve":"CVE-2024-33650","title":"Serious Slider <= 1.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41aeb465-48c2-48db-90ea-186ceeac6753?source=api-prod","affected":[{"type":"plugin","slug":"cryout-serious-slider","name":"Serious Slider","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-13T15:24:00Z"},{"id":"wordfence:41af6441-bc1d-4210-92f3-4c765fda6df9","source":"wordfence","cve":"CVE-2013-3684","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 1.9.12 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41af6441-bc1d-4210-92f3-4c765fda6df9?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2013-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41b0b12f-ff52-4913-aa54-3fbaf0839959","source":"wordfence","cve":"CVE-2025-12182","title":"Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41b0b12f-ff52-4913-aa54-3fbaf0839959?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-11-14T15:11:31Z","updated":"2025-11-15T03:27:03Z"},{"id":"wordfence:41b2a4cc-fb23-41eb-b1a4-d793ae924d9a","source":"wordfence","cve":"CVE-2025-2918","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a4cc-fb23-41eb-b1a4-d793ae924d9a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2025-06-09T22:39:02Z","updated":"2025-06-10T11:22:57Z"},{"id":"wordfence:41b2a584-b741-4265-a878-9434140070dc","source":"wordfence","cve":"CVE-2026-94405","title":"Download Manager <= 3.3.70 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a584-b741-4265-a878-9434140070dc?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.70","to_inclusive":true,"patched_in":"3.3.71"}],"published":"2026-10-02T09:30:00Z","updated":"2026-10-09T00:08:07Z"},{"id":"wordfence:41b3a62c-9586-4c87-828a-584dfe386a37","source":"wordfence","cve":"CVE-2022-34658","title":"Download Manager <= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41b3a62c-9586-4c87-828a-584dfe386a37?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.48","to_inclusive":true,"patched_in":"3.2.49"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41b4a0c4-84f6-4c7a-926a-5f436c710759","source":"wordfence","cve":"CVE-2025-2048","title":"Lana Downloads Manager <= 1.9.0 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41b4a0c4-84f6-4c7a-926a-5f436c710759?source=api-prod","affected":[{"type":"plugin","slug":"lana-downloads-manager","name":"Lana Downloads Manager","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2025-03-11T00:00:00Z","updated":"2025-07-10T12:37:30Z"},{"id":"wordfence:41ba3105-4eb3-49b6-893a-d0735e22e1ee","source":"wordfence","cve":"CVE-2025-39452","title":"WPCafe <= 2.2.32 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ba3105-4eb3-49b6-893a-d0735e22e1ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.32","to_inclusive":true,"patched_in":"2.2.33"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:48:50Z"},{"id":"wordfence:41bbb772-9a2c-4c69-bdac-a5ce4f50d3ec","source":"wordfence","cve":"CVE-2024-5003","title":"WP Stacker <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41bbb772-9a2c-4c69-bdac-a5ce4f50d3ec?source=api-prod","affected":[{"type":"plugin","slug":"wp-stacker","name":"WP Stacker","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T19:08:04Z"},{"id":"wordfence:41c0534b-7c28-4079-aabc-628be27a4c99","source":"wordfence","cve":"CVE-2026-62025","title":"Tailored Tools <= 3.0.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c0534b-7c28-4079-aabc-628be27a4c99?source=api-prod","affected":[{"type":"plugin","slug":"tailored-tools","name":"Tailored Tools","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-10-09T13:27:36Z","updated":"2026-10-28T21:20:34Z"},{"id":"wordfence:41c2ec31-360d-4145-b0b4-77d4d1d4b8a1","source":"wordfence","cve":"CVE-2024-10646","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c2ec31-360d-4145-b0b4-77d4d1d4b8a1?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2024-12-13T16:24:44Z","updated":"2024-12-14T05:34:15Z"},{"id":"wordfence:41c2edae-9788-47ad-bf0b-aa944893c4e2","source":"wordfence","cve":"CVE-2026-34900","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c2edae-9788-47ad-bf0b-aa944893c4e2?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.14.2","to_inclusive":true,"patched_in":"4.14.3"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:55:55Z"},{"id":"wordfence:41c54e1b-69b9-4594-8f1e-7ef17f120791","source":"wordfence","cve":"CVE-2025-15522","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c54e1b-69b9-4594-8f1e-7ef17f120791?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.10.0.2","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2026-01-22T16:30:45Z","updated":"2026-01-23T04:34:58Z"},{"id":"wordfence:41c71f86-a2f7-4e0e-9145-ba50830f6dba","source":"wordfence","cve":"CVE-2024-30549","title":"Contact Forms by Cimatti <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c71f86-a2f7-4e0e-9145-ba50830f6dba?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-03-29T00:00:00Z","updated":"2024-05-06T20:49:28Z"},{"id":"wordfence:41c9cce4-bf4e-4210-b24c-126ae8ce53e8","source":"wordfence","cve":"CVE-2025-30782","title":"Subscribe to Download Lite <= 1.2.9 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41c9cce4-bf4e-4210-b24c-126ae8ce53e8?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-download-lite","name":"Subscribe to Download Lite \u2013 Email Before Download Plugin","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-10T12:50:53Z"},{"id":"wordfence:41ce3250-17aa-41d6-835d-b37a498c9a29","source":"wordfence","cve":"CVE-2025-53308","title":"Image Slider With Description <= 9.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ce3250-17aa-41d6-835d-b37a498c9a29?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-with-description","name":"Image slider with description","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:20:15Z"},{"id":"wordfence:41cf57ff-421d-4db2-894f-17f2c4d4b9ed","source":"wordfence","cve":"CVE-2023-28121","title":"WooCommerce Payments 4.8.0 - 5.6.1 Authentication Bypass and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41cf57ff-421d-4db2-894f-17f2c4d4b9ed?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.8.0","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41cfe1d7-2fab-413c-80e5-40d77133d229","source":"wordfence","cve":"CVE-2024-24842","title":"Knowledge Base for Documentation, FAQs with AI Assistance <= 11.30.2 - Unauthenticated PHP Object Injection in is_article_recently_viewed","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41cfe1d7-2fab-413c-80e5-40d77133d229?source=api-prod","affected":[{"type":"plugin","slug":"echo-knowledge-base","name":"Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Search","from":"*","from_inclusive":true,"to":"11.30.2","to_inclusive":true,"patched_in":"11.31.0"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T20:43:44Z"},{"id":"wordfence:41d018a9-cf88-49db-ac86-e838c58c4a2c","source":"wordfence","cve":"CVE-2025-48355","title":"ProveSource Social Proof <= 3.1.2 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d018a9-cf88-49db-ac86-e838c58c4a2c?source=api-prod","affected":[{"type":"plugin","slug":"provesource","name":"ProveSource Social Proof","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-08-21T00:00:00Z","updated":"2025-10-30T14:05:37Z"},{"id":"wordfence:41d03524-7a53-40cd-a3d5-dafea4fc9a33","source":"wordfence","cve":"CVE-2023-45606","title":"Simple URLs <= 120 - Cross-Site Request Forgery via Multiple AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d03524-7a53-40cd-a3d5-dafea4fc9a33?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"120","to_inclusive":true,"patched_in":"121"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d09e93-8503-41e8-85d3-8550dc8f85bd","source":"wordfence","cve":"CVE-2023-25044","title":"Social Share Boost <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d09e93-8503-41e8-85d3-8550dc8f85bd?source=api-prod","affected":[{"type":"plugin","slug":"social-share-boost","name":"Social Share Boost","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d39fe4-b114-4612-92f6-75d6597610f7","source":"wordfence","cve":"CVE-2024-0657","title":"Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d39fe4-b114-4612-92f6-75d6597610f7?source=api-prod","affected":[{"type":"plugin","slug":"internal-links","name":"Internal Link Juicer: SEO Auto Linker for WordPress","from":"*","from_inclusive":true,"to":"2.23.4","to_inclusive":true,"patched_in":"2.23.5"}],"published":"2024-02-08T00:00:00Z","updated":"2024-07-29T21:36:14Z"},{"id":"wordfence:41d41850-d48e-44d5-a1c0-e1b001dabf18","source":"wordfence","cve":"CVE-2025-69189","title":"JobBank <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d41850-d48e-44d5-a1c0-e1b001dabf18?source=api-prod","affected":[{"type":"plugin","slug":"jobbank","name":"JobBank - WordPress Job manager plugin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:08:07Z"},{"id":"wordfence:41d55e84-773d-4ec9-8dca-b93b8dac4f48","source":"wordfence","cve":"CVE-2014-9177","title":"HTML5 MP3 Player with Playlist <= 2.7.0 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d55e84-773d-4ec9-8dca-b93b8dac4f48?source=api-prod","affected":[{"type":"plugin","slug":"html5-mp3-player-with-playlist","name":"HTML5 MP3 Player with Playlist Free","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d73ce6-a256-43ef-8627-c6f6d6635e3e","source":"wordfence","cve":"","title":"JobBoardWP \u2013 Job Board Listings and Submissions <= 1.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d73ce6-a256-43ef-8627-c6f6d6635e3e?source=api-prod","affected":[{"type":"plugin","slug":"jobboardwp","name":"JobBoardWP \u2013 Job Board Listings and Submissions","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d772e5-65a8-4cc5-a504-84473b75f19f","source":"wordfence","cve":"CVE-2012-5327","title":"Mingle Forum <= 1.0.32.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d772e5-65a8-4cc5-a504-84473b75f19f?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.32.1","to_inclusive":true,"patched_in":"1.0.33"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d7b3f1-a133-4678-b2d9-3f9951cbc005","source":"wordfence","cve":"CVE-2024-1895","title":"Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d7b3f1-a133-4678-b2d9-3f9951cbc005?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-04-29T00:00:00Z","updated":"2024-12-24T16:26:05Z"},{"id":"wordfence:41d7b49d-3b3c-499f-8b18-1aed8b230ca7","source":"wordfence","cve":"CVE-2025-47584","title":"Photography <= 7.5.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d7b49d-3b3c-499f-8b18-1aed8b230ca7?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"Photography","from":"*","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-07-08T20:07:38Z"},{"id":"wordfence:41d9786e-4ce3-42d6-a0d6-8eb863103d5c","source":"wordfence","cve":"CVE-2023-47187","title":"Animated Rotating Words <= 5.4 - Missing Authorization via save_admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d9786e-4ce3-42d6-a0d6-8eb863103d5c?source=api-prod","affected":[{"type":"plugin","slug":"css3-rotating-words","name":"SmartText Rotator \u2013 Add Motion to Your Words","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41d9de3f-5f49-413d-bee6-a4f9ebcf2799","source":"wordfence","cve":"CVE-2015-1785","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery < 2.0.77.3 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41d9de3f-5f49-413d-bee6-a4f9ebcf2799?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.0.77.3","to_inclusive":false,"patched_in":"2.0.77.3"}],"published":"2015-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41db1af4-7a49-4d10-8538-151d3bb7af8f","source":"wordfence","cve":"CVE-2026-25462","title":"avalex \u2013 Automatisch sichere Rechtstexte <= 3.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41db1af4-7a49-4d10-8538-151d3bb7af8f?source=api-prod","affected":[{"type":"plugin","slug":"avalex","name":"avalex \u2013 Automatisch sichere Rechtstexte","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:34:59Z"},{"id":"wordfence:41de0cf6-d093-4c33-8123-a097ba3e0add","source":"wordfence","cve":"CVE-2024-32678","title":"TrackShip for WooCommerce <= 1.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41de0cf6-d093-4c33-8123-a097ba3e0add?source=api-prod","affected":[{"type":"plugin","slug":"trackship-for-woocommerce","name":"TrackShip for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T14:50:03Z"},{"id":"wordfence:41dee548-2d01-41a6-ad80-c979cee09e0e","source":"wordfence","cve":"CVE-2025-31048","title":"Shopo <= 1.1.4 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41dee548-2d01-41a6-ad80-c979cee09e0e?source=api-prod","affected":[{"type":"theme","slug":"shopo","name":"Shopo","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-08-11T18:12:01Z"},{"id":"wordfence:41e2c557-e462-4d9e-916c-b8352a6df571","source":"wordfence","cve":"CVE-2024-0420","title":"MapPress Maps for WordPress <= 2.88.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41e2c557-e462-4d9e-916c-b8352a6df571?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.88.14","to_inclusive":true,"patched_in":"2.88.15"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-22T17:23:31Z"},{"id":"wordfence:41e2dd3e-8e50-4f55-aa35-ff9d16e63a05","source":"wordfence","cve":"CVE-2026-56055","title":"RH - Real Estate WordPress Theme <= 4.5.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41e2dd3e-8e50-4f55-aa35-ff9d16e63a05?source=api-prod","affected":[{"type":"theme","slug":"realhomes","name":"RH - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:00:41Z"},{"id":"wordfence:41e5de5d-fea6-4be0-bcf3-b282599317d1","source":"wordfence","cve":"CVE-2019-5993","title":"Category Specific RSS Feed Subscription <= 2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41e5de5d-fea6-4be0-bcf3-b282599317d1?source=api-prod","affected":[{"type":"plugin","slug":"category-specific-rss-feed-menu","name":"Category Specific RSS feed Subscription","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2019-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41e8e5c7-9165-45fb-ab90-ea13d2b28b7d","source":"wordfence","cve":"CVE-2026-17001","title":"Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41e8e5c7-9165-45fb-ab90-ea13d2b28b7d?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-10-14T16:30:30Z","updated":"2026-10-15T05:30:21Z"},{"id":"wordfence:41ecc6fc-5178-40db-84da-665d60816345","source":"wordfence","cve":"CVE-2025-49343","title":"Social Profilr <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ecc6fc-5178-40db-84da-665d60816345?source=api-prod","affected":[{"type":"plugin","slug":"social-profilr-display-social-network-profile","name":"Social Profilr","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:16:30Z"},{"id":"wordfence:41edf49a-18a2-4cf0-b498-738e77287b90","source":"wordfence","cve":"CVE-2023-5750","title":"EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41edf49a-18a2-4cf0-b498-738e77287b90?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2023-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41ef545a-7de1-406c-8686-57216e697a1b","source":"wordfence","cve":"CVE-2025-2804","title":"tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41ef545a-7de1-406c-8686-57216e697a1b?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-03-27T16:33:57Z","updated":"2025-03-28T05:23:46Z"},{"id":"wordfence:41f3045f-94a3-45c4-8baa-7f198b8c24bc","source":"wordfence","cve":"CVE-2024-35704","title":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library\t <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f3045f-94a3-45c4-8baa-7f198b8c24bc?source=api-prod","affected":[{"type":"plugin","slug":"blockart-blocks","name":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:52:38Z"},{"id":"wordfence:41f6939d-d87a-47e5-979f-2cad021c6e81","source":"wordfence","cve":"CVE-2026-95686","title":"Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6939d-d87a-47e5-979f-2cad021c6e81?source=api-prod","affected":[{"type":"plugin","slug":"opti-behavior","name":"Opti-Behavior \u2013 Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights","from":"*","from_inclusive":true,"to":"1.9.2.1","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-15T16:29:45Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:41f6b12e-49bb-4bee-bbde-ce4e5ebd4cad","source":"wordfence","cve":"CVE-2024-10185","title":"StreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6b12e-49bb-4bee-bbde-ce4e5ebd4cad?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-youtube-integration","name":"StreamWeasels YouTube Integration","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-10-28T21:40:06Z","updated":"2024-10-29T11:01:34Z"},{"id":"wordfence:41f6c1da-381d-4dd6-a68f-b5511d3e5a1f","source":"wordfence","cve":"CVE-2026-80311","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions < 8.5.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6c1da-381d-4dd6-a68f-b5511d3e5a1f?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":false,"patched_in":"8.5.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:53:27Z"},{"id":"wordfence:41f6e826-9326-40fa-80d0-4cff1dd72536","source":"wordfence","cve":"","title":"WordPress Button Plugin MaxButtons <= 9.2 - Shortcode-Based Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6e826-9326-40fa-80d0-4cff1dd72536?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2022-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41f8b229-dada-4460-b394-04502f62a75f","source":"wordfence","cve":"CVE-2025-22682","title":"Hesabfa Accounting <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41f8b229-dada-4460-b394-04502f62a75f?source=api-prod","affected":[{"type":"plugin","slug":"hesabfa-accounting","name":"Hesabfa Accounting","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:46:09Z"},{"id":"wordfence:41fada19-c697-4078-825b-0bdf6a827b02","source":"wordfence","cve":"CVE-2023-24421","title":"PHP Compatibility Checker <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fada19-c697-4078-825b-0bdf6a827b02?source=api-prod","affected":[{"type":"plugin","slug":"php-compatibility-checker","name":"PHP Compatibility Checker","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:41fadee9-ced6-4743-898f-d02d0b6f7f39","source":"wordfence","cve":"CVE-2025-39365","title":"wProject < 5.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fadee9-ced6-4743-898f-d02d0b6f7f39?source=api-prod","affected":[{"type":"theme","slug":"wproject","name":"wProject","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":false,"patched_in":"5.8.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:31:30Z"},{"id":"wordfence:41fc7e7e-c9bb-434a-9960-7f0f2292d922","source":"wordfence","cve":"CVE-2025-32179","title":"Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fc7e7e-c9bb-434a-9960-7f0f2292d922?source=api-prod","affected":[{"type":"plugin","slug":"maps-for-wp","name":"Maps for WP","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:43:51Z"},{"id":"wordfence:41fcf001-84da-4baf-9f43-5911ad33af35","source":"wordfence","cve":"CVE-2025-24745","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fcf001-84da-4baf-9f43-5911ad33af35?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-10-27T00:00:00Z","updated":"2025-04-22T22:08:26Z"},{"id":"wordfence:41fd12b8-8269-484e-a137-a2c9341b27fe","source":"wordfence","cve":"CVE-2025-30910","title":"CM Download Manager <= 2.9.6 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fd12b8-8269-484e-a137-a2c9341b27fe?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T13:57:39Z"},{"id":"wordfence:41fdb3ea-1de4-4b90-a387-5932de7a5e7c","source":"wordfence","cve":"CVE-2025-5950","title":"IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/41fdb3ea-1de4-4b90-a387-5932de7a5e7c?source=api-prod","affected":[{"type":"plugin","slug":"indieblocks","name":"IndieBlocks","from":"*","from_inclusive":true,"to":"0.13.2","to_inclusive":true,"patched_in":"0.13.3"}],"published":"2025-06-12T13:09:56Z","updated":"2025-06-18T16:26:13Z"},{"id":"wordfence:42030492-5802-42db-b88b-8a0f1552de12","source":"wordfence","cve":"CVE-2015-7386","title":"Gallery \u2013 Photo Albums Plugin < 1.3.47 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42030492-5802-42db-b88b-8a0f1552de12?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-gallery","name":"Gallery \u2013 Photo Albums Plugin","from":"*","from_inclusive":true,"to":"1.3.50","to_inclusive":false,"patched_in":"1.3.50"}],"published":"2015-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4204209b-054f-4249-87d0-a0837ac172d6","source":"wordfence","cve":"CVE-2024-29816","title":"Woo Viet <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4204209b-054f-4249-87d0-a0837ac172d6?source=api-prod","affected":[{"type":"plugin","slug":"woo-viet","name":"Woo Viet \u2013 WooCommerce for Vietnam","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:16:47Z"},{"id":"wordfence:420580e1-b6cf-4fd7-87fd-e415b097f4c9","source":"wordfence","cve":"CVE-2025-52811","title":"Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/420580e1-b6cf-4fd7-87fd-e415b097f4c9?source=api-prod","affected":[{"type":"plugin","slug":"davenport","name":"Davenport - Versatile Blog and Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:42:50Z"},{"id":"wordfence:4209eddd-47ac-4802-b309-e42e5907a0cd","source":"wordfence","cve":"","title":"Echelon <= 2.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4209eddd-47ac-4802-b309-e42e5907a0cd?source=api-prod","affected":[{"type":"theme","slug":"echelon","name":"Echelon","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:420bcda3-e275-4811-ae37-df69d4d60cee","source":"wordfence","cve":"CVE-2022-2711","title":"Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/420bcda3-e275-4811-ae37-df69d4d60cee?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:420c29d6-e712-4891-a2f6-b18f4718b35d","source":"wordfence","cve":"","title":"CBX Bookmark & Favorite <= 1.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/420c29d6-e712-4891-a2f6-b18f4718b35d?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:420f56de-4c83-4c9f-933c-0422467bbc7a","source":"wordfence","cve":"CVE-2023-4150","title":"User Activity Tracking and Log <= 4.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/420f56de-4c83-4c9f-933c-0422467bbc7a?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-tracking-and-log","name":"User Activity Tracking and Log","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42106dad-c568-4a79-af56-2d714dd8f487","source":"wordfence","cve":"CVE-2025-24606","title":"Client Invoicing by Sprout Invoices \u2013 Easy Estimates and Invoices <= 20.8.1 - Missing Authorization","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42106dad-c568-4a79-af56-2d714dd8f487?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.1","to_inclusive":true,"patched_in":"20.8.2"}],"published":"2024-12-22T00:00:00Z","updated":"2025-02-19T16:30:45Z"},{"id":"wordfence:42156e9f-711a-4592-b92c-d4af845d686a","source":"wordfence","cve":"CVE-2022-37412","title":"Better Delete Revision <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42156e9f-711a-4592-b92c-d4af845d686a?source=api-prod","affected":[{"type":"plugin","slug":"better-delete-revision","name":"Better Delete Revision","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:421ed38f-cf0b-437f-a477-5bae7963e9e6","source":"wordfence","cve":"CVE-2025-62052","title":"One Page Express Companion <= 1.6.43 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/421ed38f-cf0b-437f-a477-5bae7963e9e6?source=api-prod","affected":[{"type":"plugin","slug":"one-page-express-companion","name":"One Page Express Companion","from":"*","from_inclusive":true,"to":"1.6.43","to_inclusive":true,"patched_in":"1.6.44"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:12:41Z"},{"id":"wordfence:421fcee2-a05d-4486-837e-ddee3d73d737","source":"wordfence","cve":"CVE-2025-8091","title":"EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/421fcee2-a05d-4486-837e-ddee3d73d737?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-08-14T20:16:37Z","updated":"2025-11-05T22:19:37Z"},{"id":"wordfence:422190bd-0f65-4e35-a003-25aa13b1dabc","source":"wordfence","cve":"CVE-2024-54353","title":"Hack-Info <= 3.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422190bd-0f65-4e35-a003-25aa13b1dabc?source=api-prod","affected":[{"type":"plugin","slug":"hack-info","name":"Hack-Info","from":"*","from_inclusive":true,"to":"3.17","to_inclusive":true,"patched_in":"3.18"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T17:06:47Z"},{"id":"wordfence:4221b33c-5cfa-48db-92bf-bf25ff3c5a5f","source":"wordfence","cve":"CVE-2024-4345","title":"Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4221b33c-5cfa-48db-92bf-bf25ff3c5a5f?source=api-prod","affected":[{"type":"plugin","slug":"startklar-elmentor-forms-extwidgets","name":"Startklar Elementor Addons","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"1.7.14"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T08:31:05Z"},{"id":"wordfence:42222c64-6492-4774-b5bc-8e62a1a328cf","source":"wordfence","cve":"CVE-2023-2276","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42222c64-6492-4774-b5bc-8e62a1a328cf?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.10.7","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4223cc80-377d-45a5-8c79-c8f0aa52c01e","source":"wordfence","cve":"CVE-2025-53252","title":"Zegen <= 1.1.9 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4223cc80-377d-45a5-8c79-c8f0aa52c01e?source=api-prod","affected":[{"type":"theme","slug":"zegen","name":"Zegen - Church WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-11-11T18:24:35Z"},{"id":"wordfence:4229a61a-df13-4fb8-a745-2ae3edf7fbcf","source":"wordfence","cve":"CVE-2026-96902","title":"Easy Property Listings <= 3.5.27 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4229a61a-df13-4fb8-a745-2ae3edf7fbcf?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.27","to_inclusive":true,"patched_in":"3.5.28"}],"published":"2026-10-17T00:00:00Z","updated":"2026-10-23T19:03:27Z"},{"id":"wordfence:422ae683-dbbe-43ef-b902-ae7570495f21","source":"wordfence","cve":"","title":"HomeSweet - Real Estate WordPress Theme <= 1.4 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422ae683-dbbe-43ef-b902-ae7570495f21?source=api-prod","affected":[{"type":"theme","slug":"homesweet","name":"HomeSweet - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:422b127f-aa52-40ab-a1c0-9d8b70aafe94","source":"wordfence","cve":"CVE-2025-68010","title":"Netgsm <= 2.9.63 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422b127f-aa52-40ab-a1c0-9d8b70aafe94?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.9.63","to_inclusive":true,"patched_in":"2.9.64"}],"published":"2025-12-29T00:00:00Z","updated":"2026-02-06T17:19:34Z"},{"id":"wordfence:422bb9a5-c848-4492-add7-bc65b1111565","source":"wordfence","cve":"CVE-2024-13746","title":"Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422bb9a5-c848-4492-add7-bc65b1111565?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-and-notification","name":"Booking Calendar and Notification","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-28T15:23:38Z","updated":"2025-03-01T04:21:49Z"},{"id":"wordfence:422c634c-5119-40ef-adf7-681c3d8c09a2","source":"wordfence","cve":"CVE-2024-13714","title":"All-Images.ai \u2013 IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422c634c-5119-40ef-adf7-681c3d8c09a2?source=api-prod","affected":[{"type":"plugin","slug":"all-images-ai","name":"All-Images.ai \u2013 IA Image Bank and Custom Image creation","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T05:28:40Z"},{"id":"wordfence:422d2187-e4f4-4a7a-9153-64e67a9192fc","source":"wordfence","cve":"CVE-2026-104667","title":"Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/422d2187-e4f4-4a7a-9153-64e67a9192fc?source=api-prod","affected":[{"type":"plugin","slug":"animated-number-counters","name":"Animated Number Counters","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:26:48Z"},{"id":"wordfence:42303b60-cbb5-4176-94f9-b2ed29f59cc8","source":"wordfence","cve":"CVE-2023-48330","title":"Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42303b60-cbb5-4176-94f9-b2ed29f59cc8?source=api-prod","affected":[{"type":"plugin","slug":"bulk-comment-remove","name":"Bulk Comment Remove","from":"*","from_inclusive":true,"to":"2","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42308a6e-cb04-42dc-90b0-9b40c264ad53","source":"wordfence","cve":"CVE-2025-12632","title":"RandomQuotr <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42308a6e-cb04-42dc-90b0-9b40c264ad53?source=api-prod","affected":[{"type":"plugin","slug":"randomquotr","name":"RandomQuotr","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:55:43Z","updated":"2025-11-11T03:30:37Z"},{"id":"wordfence:4235f279-0975-4814-b156-b45b011e3ce6","source":"wordfence","cve":"CVE-2023-48772","title":"Prevent Landscape Rotation <= 2.0 - Cross-Site Request Forgery via adminpage.php","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4235f279-0975-4814-b156-b45b011e3ce6?source=api-prod","affected":[{"type":"plugin","slug":"prevent-landscape-rotation","name":"Prevent Landscape Rotation","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:423627a6-623d-462c-a767-cf021566d9e1","source":"wordfence","cve":"","title":"TaxoPress <= 3.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/423627a6-623d-462c-a767-cf021566d9e1?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42370e73-03d1-4ac4-afd8-a2f94e1182a9","source":"wordfence","cve":"CVE-2026-97270","title":"CMB2 <= 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42370e73-03d1-4ac4-afd8-a2f94e1182a9?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2026-09-30T09:25:38Z","updated":"2026-10-09T00:14:28Z"},{"id":"wordfence:42378b83-2a39-4e5f-8671-ee4a44ee92a5","source":"wordfence","cve":"CVE-2016-10971","title":"MemberSonic Lite Membership Site Plugin <= 1.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42378b83-2a39-4e5f-8671-ee4a44ee92a5?source=api-prod","affected":[{"type":"plugin","slug":"membership-site","name":"MemberSonic Lite Membership Site Plugin","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.302"}],"published":"2016-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4238ce95-ff9a-492f-b3ef-3b263efdda7b","source":"wordfence","cve":"CVE-2025-62881","title":"WP-Lister Lite for eBay <= 3.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4238ce95-ff9a-492f-b3ef-3b263efdda7b?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.5"}],"published":"2025-05-27T00:00:00Z","updated":"2025-11-25T19:15:25Z"},{"id":"wordfence:423e10b3-5b1d-4162-ade4-3f6d69a9703e","source":"wordfence","cve":"CVE-2026-24629","title":"Web Accessibility with Max Access <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/423e10b3-5b1d-4162-ade4-3f6d69a9703e?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-toolbar","name":"Web Accessibility with Max Access","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-09T15:52:32Z","updated":"2026-02-03T13:48:30Z"},{"id":"wordfence:423e840e-0bc2-4481-afff-61ace85788d3","source":"wordfence","cve":"CVE-2025-1560","title":"WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=api-prod","affected":[{"type":"plugin","slug":"wow-entrance-effects-wee","name":"WOW Entrance Effects (WEE!)","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:10:17Z","updated":"2025-02-28T08:23:14Z"},{"id":"wordfence:42402a14-b192-4ed0-84bf-f0327e48f32b","source":"wordfence","cve":"CVE-2015-7377","title":"Pie Register \u2013 User Registration Forms < 2.0.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42402a14-b192-4ed0-84bf-f0327e48f32b?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":false,"patched_in":"2.0.19"}],"published":"2015-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4240c04b-cad3-496f-b12f-7718bb498fe0","source":"wordfence","cve":"CVE-2017-1002016","title":"flickr-picture-backup <= 0.7 - Arbitrary file upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4240c04b-cad3-496f-b12f-7718bb498fe0?source=api-prod","affected":[{"type":"plugin","slug":"flickr-picture-backup","name":"flickr-picture-backup","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4240cdae-9122-443e-8a7e-3369e74384be","source":"wordfence","cve":"CVE-2025-11924","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2025-12-16T18:41:16Z","updated":"2025-12-17T06:42:32Z"},{"id":"wordfence:4240fcda-c61d-4888-8837-5012e5ba1f26","source":"wordfence","cve":"CVE-2023-4270","title":"Min Max Control <= 4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4240fcda-c61d-4888-8837-5012e5ba1f26?source=api-prod","affected":[{"type":"plugin","slug":"woo-min-max-quantity-step-control-single","name":"Min Max Control \u2013 Min Max Quantity & Step Control for WooCommerce","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4241118f-9bcb-4dec-abd2-7172db2cf445","source":"wordfence","cve":"CVE-2024-12507","title":"Optio Dentistry <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4241118f-9bcb-4dec-abd2-7172db2cf445?source=api-prod","affected":[{"type":"plugin","slug":"optio-dentistry","name":"Optio Dentistry","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-12-23T16:22:09Z","updated":"2024-12-24T04:22:45Z"},{"id":"wordfence:4243bd6d-34f6-4d29-a333-4499a2e2d2e1","source":"wordfence","cve":"CVE-2024-1504","title":"SecuPress Free \u2014 WordPress Security <= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4243bd6d-34f6-4d29-a333-4499a2e2d2e1?source=api-prod","affected":[{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.2.5.1","to_inclusive":true,"patched_in":"2.2.5.2"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T05:32:50Z"},{"id":"wordfence:4248a45c-6fc2-48b3-9a8d-2522f90344b4","source":"wordfence","cve":"CVE-2026-120839","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce <= 2.3.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4248a45c-6fc2-48b3-9a8d-2522f90344b4?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2026-11-07T12:43:00Z","updated":"2026-11-10T19:38:29Z"},{"id":"wordfence:424a30d7-4806-4274-8c5e-75dcc12e9f3c","source":"wordfence","cve":"CVE-2014-4937","title":"BookX <= 1.7 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424a30d7-4806-4274-8c5e-75dcc12e9f3c?source=api-prod","affected":[{"type":"plugin","slug":"bookx","name":"BookX","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:424a3b93-5cf6-4706-acab-0ee89f05c073","source":"wordfence","cve":"CVE-2025-68080","title":"User Avatar - Reloaded <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424a3b93-5cf6-4706-acab-0ee89f05c073?source=api-prod","affected":[{"type":"plugin","slug":"user-avatar-reloaded","name":"User Avatar \u2013 Reloaded","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2025-12-19T17:06:52Z"},{"id":"wordfence:424a5c60-db14-4a45-8c62-7a11ed377f1a","source":"wordfence","cve":"CVE-2023-4151","title":"Store Locator WordPress <= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424a5c60-db14-4a45-8c62-7a11ed377f1a?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.4.13"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:424b0de2-98ac-434f-98be-d2b0eec308ce","source":"wordfence","cve":"CVE-2025-22560","title":"Saoshyant Page Builder <= 3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424b0de2-98ac-434f-98be-d2b0eec308ce?source=api-prod","affected":[{"type":"plugin","slug":"saoshyant-page-builder","name":"Saoshyant Page Builder","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:16:25Z"},{"id":"wordfence:424b2145-2fe2-48b8-bb4f-08fe23a6100f","source":"wordfence","cve":"CVE-2024-37208","title":"WP Scraper <= 5.8 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424b2145-2fe2-48b8-bb4f-08fe23a6100f?source=api-prod","affected":[{"type":"plugin","slug":"wp-scraper","name":"WP Scraper","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-11T17:26:30Z"},{"id":"wordfence:424c23f7-73a4-4b2b-8f52-61cb45523396","source":"wordfence","cve":"CVE-2025-5801","title":"Digital Events Calendar <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424c23f7-73a4-4b2b-8f52-61cb45523396?source=api-prod","affected":[{"type":"plugin","slug":"digital-events-calendar","name":"Digital Events Calendar","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:54:46Z","updated":"2025-09-11T07:24:52Z"},{"id":"wordfence:424cab53-d7dd-4fd6-974a-5432256cfad1","source":"wordfence","cve":"CVE-2026-57670","title":"CodePeople Post Map for Google Maps <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424cab53-d7dd-4fd6-974a-5432256cfad1?source=api-prod","affected":[{"type":"plugin","slug":"codepeople-post-map","name":"CodePeople Post Map for Google Maps","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:02:22Z"},{"id":"wordfence:424cf586-f225-4ce3-9b66-b0bece394f1f","source":"wordfence","cve":"CVE-2026-49767","title":"wpForo Forum <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424cf586-f225-4ce3-9b66-b0bece394f1f?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T18:00:26Z"},{"id":"wordfence:424ebeb4-eb53-4c87-9a86-aff1c784aa3c","source":"wordfence","cve":"CVE-2008-1982","title":"WordPress Spreadsheet <= 0.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/424ebeb4-eb53-4c87-9a86-aff1c784aa3c?source=api-prod","affected":[{"type":"plugin","slug":"wpSS","name":"WordPress Spreadsheet","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2008-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42525101-6196-40b9-90e7-c7f1886ef247","source":"wordfence","cve":"CVE-2025-12352","title":"Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42525101-6196-40b9-90e7-c7f1886ef247?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.20","to_inclusive":true,"patched_in":"2.9.21"}],"published":"2025-11-06T16:28:27Z","updated":"2025-11-07T04:29:00Z"},{"id":"wordfence:4252c092-1276-4f69-88f9-cf78799c725c","source":"wordfence","cve":"CVE-2024-30223","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4252c092-1276-4f69-88f9-cf78799c725c?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"4.0.27"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:14:02Z"},{"id":"wordfence:4252da8a-26c7-41a4-944b-cb41dafa8884","source":"wordfence","cve":"CVE-2021-38317","title":"Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4252da8a-26c7-41a4-944b-cb41dafa8884?source=api-prod","affected":[{"type":"plugin","slug":"konnichiwa","name":"Konnichiwa! Membership","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42561336-e777-4a0a-af1d-dfa0cb634e6d","source":"wordfence","cve":"CVE-2025-54718","title":"Yogi - Health Beauty & Yoga <= 2.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42561336-e777-4a0a-af1d-dfa0cb634e6d?source=api-prod","affected":[{"type":"theme","slug":"noo-yogi","name":"Yogi - Health Beauty & Yoga WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-08-02T00:00:00Z","updated":"2025-11-12T13:56:18Z"},{"id":"wordfence:4256381f-b21c-4f84-b66c-0fe1a52c81f0","source":"wordfence","cve":"CVE-2026-84934","title":"JCH Optimize < 6.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4256381f-b21c-4f84-b66c-0fe1a52c81f0?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"6.0.1"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:01:32Z"},{"id":"wordfence:4257d4ca-0e92-4d2f-b65b-dff9d7d48cb8","source":"wordfence","cve":"CVE-2024-30535","title":"Easy Form Builder <= 3.7.4 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4257d4ca-0e92-4d2f-b65b-dff9d7d48cb8?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:56:41Z"},{"id":"wordfence:425af1b6-3db9-44bc-8bea-29f2912eef87","source":"wordfence","cve":"CVE-2025-32207","title":"Ni WooCommerce Cost Of Goods <= 3.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/425af1b6-3db9-44bc-8bea-29f2912eef87?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-cost-of-goods","name":"Ni Cost of Goods for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-15T12:22:46Z"},{"id":"wordfence:425b4f6d-9f13-4aa7-bc97-d6c221d234ca","source":"wordfence","cve":"CVE-2025-14719","title":"Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/425b4f6d-9f13-4aa7-bc97-d6c221d234ca?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.29.0","to_inclusive":false,"patched_in":"2.29.0"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.26.0","to_inclusive":false,"patched_in":"4.26.0"}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-13T22:03:49Z"},{"id":"wordfence:425cd0be-d17e-4c2b-bf29-3b850905a88e","source":"wordfence","cve":"CVE-2024-11453","title":"WordPress Pinterest Plugin \u2013 Make a Popup, User Profile, Masonry and Gallery Layout <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/425cd0be-d17e-4c2b-bf29-3b850905a88e?source=api-prod","affected":[{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T07:34:57Z"},{"id":"wordfence:425d9583-71cc-4d05-beeb-104030a2b5f5","source":"wordfence","cve":"CVE-2026-105068","title":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/425d9583-71cc-4d05-beeb-104030a2b5f5?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.5","to_inclusive":true,"patched_in":"7.4.6"}],"published":"2026-10-05T08:26:00Z","updated":"2026-10-08T23:30:04Z"},{"id":"wordfence:426021d3-e302-4c2a-8d5c-f2a2fc20e45b","source":"wordfence","cve":"","title":"WordPress Multisite Content Copier/Updater <= 1.4.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426021d3-e302-4c2a-8d5c-f2a2fc20e45b?source=api-prod","affected":[{"type":"plugin","slug":"wp-multisite-content-copier","name":"WP Multisite Content Copier/Updater","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42610230-3635-463f-b97f-212ecb1fe041","source":"wordfence","cve":"CVE-2026-74003","title":"RTMForm Builder <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42610230-3635-463f-b97f-212ecb1fe041?source=api-prod","affected":[{"type":"plugin","slug":"romethemeform","name":"RTMForm \u2013 Contact Form, Multi-Step Forms & Form Templates for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-17T17:17:00Z","updated":"2026-10-28T21:13:34Z"},{"id":"wordfence:4261bc62-a091-408b-8643-e6fa61d62103","source":"wordfence","cve":"CVE-2023-47805","title":"WPCafe <= 2.2.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4261bc62-a091-408b-8643-e6fa61d62103?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.22","to_inclusive":true,"patched_in":"2.2.23"}],"published":"2023-11-15T00:00:00Z","updated":"2024-04-17T12:59:35Z"},{"id":"wordfence:4261c81e-13a2-4022-8048-aeb0ea4e9ee4","source":"wordfence","cve":"CVE-2025-2510","title":"Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4261c81e-13a2-4022-8048-aeb0ea4e9ee4?source=api-prod","affected":[{"type":"plugin","slug":"frndzk-expandable-bottom-bar","name":"Frndzk Expandable Bottom Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T19:33:07Z","updated":"2025-03-25T08:22:12Z"},{"id":"wordfence:426280c1-0ecb-4973-915e-bb63ac240bca","source":"wordfence","cve":"CVE-2024-3939","title":"Ditty <= 3.1.35 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426280c1-0ecb-4973-915e-bb63ac240bca?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.35","to_inclusive":true,"patched_in":"3.1.36"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-13T22:01:10Z"},{"id":"wordfence:42629244-dd2f-4ae1-9b35-e59a71b8005b","source":"wordfence","cve":"CVE-2024-51863","title":"PF Timer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42629244-dd2f-4ae1-9b35-e59a71b8005b?source=api-prod","affected":[{"type":"plugin","slug":"pf-timer","name":"PF Timer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:53:18Z"},{"id":"wordfence:426431d9-6247-40a0-a1df-8d4aa2d65139","source":"wordfence","cve":"CVE-2026-112826","title":"Falcon \u2013 Cache, Performance, Security, Cleanup, and Tweaks <= 2.12.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426431d9-6247-40a0-a1df-8d4aa2d65139?source=api-prod","affected":[{"type":"plugin","slug":"falcon","name":"Falcon \u2013 Cache, Performance, Security, Cleanup, and Tweaks","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-10-22T06:52:00Z","updated":"2026-10-23T18:36:39Z"},{"id":"wordfence:426554d8-e6dc-496f-adce-61a22880a4c2","source":"wordfence","cve":"CVE-2024-31247","title":"FG Drupal to WordPress <= 3.70.3 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426554d8-e6dc-496f-adce-61a22880a4c2?source=api-prod","affected":[{"type":"plugin","slug":"fg-drupal-to-wp","name":"FG Drupal to WordPress","from":"*","from_inclusive":true,"to":"3.70.3","to_inclusive":true,"patched_in":"3.71.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:25:35Z"},{"id":"wordfence:42665ffd-e2fa-4883-9275-5e0b54943d3c","source":"wordfence","cve":"CVE-2024-56297","title":"Highlight <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42665ffd-e2fa-4883-9275-5e0b54943d3c?source=api-prod","affected":[{"type":"plugin","slug":"highlight","name":"Highlight Sitewide Notice, Text, Button Menu","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:14:09Z"},{"id":"wordfence:42690e4e-e0d5-492c-879b-a16383fe7af3","source":"wordfence","cve":"CVE-2025-69308","title":"Nestbyte Core <= 1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42690e4e-e0d5-492c-879b-a16383fe7af3?source=api-prod","affected":[{"type":"plugin","slug":"nestbyte-core","name":"Nestbyte Core","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:15:39Z"},{"id":"wordfence:426ea88f-bdd4-4da6-88c2-db82df9e01e5","source":"wordfence","cve":"CVE-2020-9514","title":"IMPress for IDX Broker <= 2.6.1 - Authenticated Arbitrary Post Creation, Modification, and Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426ea88f-bdd4-4da6-88c2-db82df9e01e5?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":false,"patched_in":"2.6.2"}],"published":"2020-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:426f0993-8b75-4bb1-9368-8927241d7cda","source":"wordfence","cve":"CVE-2025-23999","title":"Breeze <= 2.2.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/426f0993-8b75-4bb1-9368-8927241d7cda?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T14:47:40Z"},{"id":"wordfence:427034cf-81b4-4648-9630-5448b6d2b2f7","source":"wordfence","cve":"CVE-2024-39637","title":"Edubin <= 9.2.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/427034cf-81b4-4648-9630-5448b6d2b2f7?source=api-prod","affected":[{"type":"plugin","slug":"edubin","name":"Edubin","from":"*","from_inclusive":true,"to":"9.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-09T21:00:04Z"},{"id":"wordfence:4270a5c2-abc0-4505-9683-030dc08a462d","source":"wordfence","cve":"","title":"Featured Image from URL <= 2.7.7 - Missing Authorization on REST API routes","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4270a5c2-abc0-4505-9683-030dc08a462d?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2019-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42711f2d-99e4-45cf-bd57-a3e228f3bf25","source":"wordfence","cve":"CVE-2025-39375","title":"Easy Child Theme Creator <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42711f2d-99e4-45cf-bd57-a3e228f3bf25?source=api-prod","affected":[{"type":"plugin","slug":"easy-child-theme-creator","name":"Easy Child Theme Creator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T21:59:37Z"},{"id":"wordfence:4271aa20-e496-44b6-9ca7-990c900afa99","source":"wordfence","cve":"CVE-2026-121379","title":"Tournamatch <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4271aa20-e496-44b6-9ca7-990c900afa99?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:03:51Z"},{"id":"wordfence:42743c2f-053b-4f14-bf11-865f978ec017","source":"wordfence","cve":"CVE-2024-13402","title":"BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42743c2f-053b-4f14-bf11-865f978ec017?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.7.70","to_inclusive":true,"patched_in":"2.8.00"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T12:47:01Z"},{"id":"wordfence:4276e68b-4d0d-4a16-a32c-51b4f6e3c570","source":"wordfence","cve":"CVE-2025-7965","title":"CBX Restaurant Booking <= 1.2.1 - Cross-Site Request Forgery to Plugin Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4276e68b-4d0d-4a16-a32c-51b4f6e3c570?source=api-prod","affected":[{"type":"plugin","slug":"cbx-restaurant-booking","name":"CBX Restaurant Booking","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T00:00:00Z","updated":"2025-08-25T15:52:07Z"},{"id":"wordfence:4278b8f6-ce3e-4b6d-ae69-dee24a2177e7","source":"wordfence","cve":"CVE-2024-6713","title":"PVN Auth Popup <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4278b8f6-ce3e-4b6d-ae69-dee24a2177e7?source=api-prod","affected":[{"type":"plugin","slug":"pvn-auth-popup","name":"PVN Auth Popup","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-08-01T13:40:37Z"},{"id":"wordfence:4278e9d7-aa1e-47a5-b715-09dae5156303","source":"wordfence","cve":"CVE-2023-2452","title":"Advanced Woo Search <= 2.77 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4278e9d7-aa1e-47a5-b715-09dae5156303?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-search","name":"Advanced Woo Search \u2013 Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.77","to_inclusive":true,"patched_in":"2.78"}],"published":"2023-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4279efe9-df57-405a-85a0-6c22e912662c","source":"wordfence","cve":"CVE-2020-29156","title":"WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4279efe9-df57-405a-85a0-6c22e912662c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":false,"patched_in":"4.7.0"}],"published":"2020-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:427a788b-e9d9-422a-ab63-179f12860e4e","source":"wordfence","cve":"CVE-2025-26873","title":"Traveler < 3.2.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/427a788b-e9d9-422a-ab63-179f12860e4e?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-07-18T17:23:25Z"},{"id":"wordfence:427c29e6-9bbe-4094-a2a2-46945525f5b3","source":"wordfence","cve":"","title":"Ad Inserter <= 1.5.5 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/427c29e6-9bbe-4094-a2a2-46945525f5b3?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:427d2649-541b-4534-b1cc-0fde879c4f78","source":"wordfence","cve":"CVE-2025-32142","title":"Motors <= 1.4.71 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/427d2649-541b-4534-b1cc-0fde879c4f78?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.71","to_inclusive":true,"patched_in":"1.4.72"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-07T14:10:10Z"},{"id":"wordfence:4280654a-9eab-4541-8b82-74086d37d928","source":"wordfence","cve":"","title":"CM Registration Pro <= 3.2.0 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4280654a-9eab-4541-8b82-74086d37d928?source=api-prod","affected":[{"type":"plugin","slug":"cm-registration-pro","name":"Registration | User Registration and Invitation Codes Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4280f2db-cabe-4955-af68-d03e299bfcf4","source":"wordfence","cve":"CVE-2025-39424","title":"Simple Maps <= 0.98 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4280f2db-cabe-4955-af68-d03e299bfcf4?source=api-prod","affected":[{"type":"plugin","slug":"interactive-maps","name":"SimpleMaps","from":"*","from_inclusive":true,"to":"0.98","to_inclusive":true,"patched_in":"0.99"}],"published":"2025-04-17T00:00:00Z","updated":"2025-05-21T13:31:04Z"},{"id":"wordfence:42816fa2-98a7-41c6-95d9-d0bac259d741","source":"wordfence","cve":"CVE-2025-39574","title":"Uix Shortcodes <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42816fa2-98a7-41c6-95d9-d0bac259d741?source=api-prod","affected":[{"type":"plugin","slug":"uix-shortcodes","name":"Uix Shortcodes","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:21:59Z"},{"id":"wordfence:4281ad41-d9a4-4503-9238-24990641a9bf","source":"wordfence","cve":"CVE-2026-8898","title":"Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4281ad41-d9a4-4503-9238-24990641a9bf?source=api-prod","affected":[{"type":"plugin","slug":"events-in-city","name":"Events In City","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:25Z","updated":"2026-05-27T05:31:24Z"},{"id":"wordfence:4284c31c-fa58-49fe-89ed-35d7b1bd6ec8","source":"wordfence","cve":"CVE-2022-4154","title":"Contest Gallery Pro <= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4284c31c-fa58-49fe-89ed-35d7b1bd6ec8?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:428b4d6b-a4db-4e60-8c15-24efdfe6aea1","source":"wordfence","cve":"CVE-2024-3513","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/428b4d6b-a4db-4e60-8c15-24efdfe6aea1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-07-01T19:35:28Z","updated":"2024-08-05T12:54:55Z"},{"id":"wordfence:428d44c2-ef30-4d34-8f62-030af9931441","source":"wordfence","cve":"CVE-2025-8588","title":"Gutenberg Blocks \u2013 PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/428d44c2-ef30-4d34-8f62-030af9931441?source=api-prod","affected":[{"type":"plugin","slug":"advanced-gutenberg","name":"PublishPress Blocks \u2013 Block Controls, Block Visibility, Block Permissions","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2025-10-24T17:10:18Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:428feddb-c8c3-49a7-8e01-dc548c184229","source":"wordfence","cve":"CVE-2024-22151","title":"Import and export users and customers <= 1.24.6 - Missing Authorization via fire_cron REST endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/428feddb-c8c3-49a7-8e01-dc548c184229?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.24.6","to_inclusive":true,"patched_in":"1.24.7"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42901dcd-d318-4a37-b70f-bf6c5c58769d","source":"wordfence","cve":"CVE-2021-24922","title":"Pixel Cat \u2013 Conversion Pixel Manager <= 2.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42901dcd-d318-4a37-b70f-bf6c5c58769d?source=api-prod","affected":[{"type":"plugin","slug":"facebook-conversion-pixel","name":"Pixel Cat \u2013 Conversion Pixel Manager","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4290ee15-0362-48c5-a570-4a1b6719a948","source":"wordfence","cve":"CVE-2020-28034","title":"WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4290ee15-0362-48c5-a570-4a1b6719a948?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4291b5c8-cce3-46ae-b9ff-a34a0f5bcdce","source":"wordfence","cve":"CVE-2024-22311","title":"Simply Schedule Appointments <= 1.6.6.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4291b5c8-cce3-46ae-b9ff-a34a0f5bcdce?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.6.20","to_inclusive":true,"patched_in":"1.6.6.24"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-01T14:47:54Z"},{"id":"wordfence:4299e97c-3b91-4870-bafd-557b72b93b44","source":"wordfence","cve":"CVE-2017-7719","title":"SpiderCalendar <= 1.5.51 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4299e97c-3b91-4870-bafd-557b72b93b44?source=api-prod","affected":[{"type":"plugin","slug":"spider-event-calendar","name":"SpiderCalendar","from":"*","from_inclusive":true,"to":"1.5.51","to_inclusive":true,"patched_in":"1.5.52"}],"published":"2017-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:429acb91-4846-45be-8f39-d8584a70c131","source":"wordfence","cve":"CVE-2025-31008","title":"YouTube Embed <= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429acb91-4846-45be-8f39-d8584a70c131?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed","name":"Embeds for YouTube","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-04-09T00:00:00Z","updated":"2026-02-26T15:05:57Z"},{"id":"wordfence:429ce9e6-e51b-4f1e-8e26-f679b08d68d3","source":"wordfence","cve":"CVE-2023-26516","title":"Debug Assistant <= 1.4 - Cross-Site Request Forgery via imlt_create_admin","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429ce9e6-e51b-4f1e-8e26-f679b08d68d3?source=api-prod","affected":[{"type":"plugin","slug":"debug-assistant","name":"Debug Assistant","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:429cf156-620e-4e7d-9acc-04a80b64dd99","source":"wordfence","cve":"CVE-2026-115259","title":"Photo Engine <= 6.5.0 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429cf156-620e-4e7d-9acc-04a80b64dd99?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:25:29Z"},{"id":"wordfence:429d2666-75c8-48cc-a7b6-05ba64ed5995","source":"wordfence","cve":"CVE-2025-26559","title":"Secure Invites <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429d2666-75c8-48cc-a7b6-05ba64ed5995?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-mu-secure-invites","name":"Secure Invites","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T18:02:10Z"},{"id":"wordfence:429f697c-e101-4fc3-ab9f-557c932bded5","source":"wordfence","cve":"CVE-2024-49665","title":"Web Bricks Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429f697c-e101-4fc3-ab9f-557c932bded5?source=api-prod","affected":[{"type":"plugin","slug":"webbricks-addons","name":"Web Bricks Addons for Elementor: Elite-Designed Elementor & eCommerce Widgets","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2024-10-21T00:00:00Z","updated":"2024-12-05T16:40:43Z"},{"id":"wordfence:429fe34a-5fa9-4032-9b21-4de114dbc9d1","source":"wordfence","cve":"CVE-2024-8981","title":"Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/429fe34a-5fa9-4032-9b21-4de114dbc9d1?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T02:33:32Z"},{"id":"wordfence:42a0345a-4ad9-4cad-a7ef-2f5661fa855f","source":"wordfence","cve":"CVE-2025-62044","title":"TheGem Theme Elements (for WPBakery) <= 5.10.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42a0345a-4ad9-4cad-a7ef-2f5661fa855f?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements","name":"TheGem Theme Elements (for WPBakery)","from":"*","from_inclusive":true,"to":"5.10.5.1","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T15:18:02Z"},{"id":"wordfence:42a14820-710d-4149-9a8d-aa84479f0980","source":"wordfence","cve":"CVE-2025-13685","title":"Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42a14820-710d-4149-9a8d-aa84479f0980?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.4.9"}],"published":"2025-12-01T18:38:04Z","updated":"2025-12-02T06:40:25Z"},{"id":"wordfence:42a19238-3af8-4b4f-9e78-96ef79f63c0f","source":"wordfence","cve":"CVE-2025-32120","title":"Easy Query \u2013 WP Query Builder <= 2.0.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42a19238-3af8-4b4f-9e78-96ef79f63c0f?source=api-prod","affected":[{"type":"plugin","slug":"easy-query","name":"Easy Query \u2013 WP Query Builder","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T13:01:25Z"},{"id":"wordfence:42a4ef37-c842-4925-b06a-3e6423337567","source":"wordfence","cve":"CVE-2023-6700","title":"Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42a4ef37-c842-4925-b06a-3e6423337567?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-compliance","name":"Cookie Information | Free GDPR Consent Solution","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2024-01-29T00:00:00Z","updated":"2024-07-29T21:36:14Z"},{"id":"wordfence:42a642a8-fee3-497f-9fcf-7e888838af0b","source":"wordfence","cve":"CVE-2023-23661","title":"MainWP Post Dripper Extension <= 4.0.4 - Missing Authorization to Arbitrary Page/Post Deletion","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42a642a8-fee3-497f-9fcf-7e888838af0b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-post-dripper-extension","name":"MainWP Post Dripper Extension","from":"4.0.4","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42aa17f0-9c97-407f-8fbf-3c25794ac750","source":"wordfence","cve":"CVE-2025-22521","title":"wp Hosting Performance Check <= 2.18.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa17f0-9c97-407f-8fbf-3c25794ac750?source=api-prod","affected":[{"type":"plugin","slug":"wp-hosting-performance-check","name":"wp Hosting Performance Check","from":"*","from_inclusive":true,"to":"2.18.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:51:10Z"},{"id":"wordfence:42aa82ff-0d37-4040-b8fc-84d29534a4b7","source":"wordfence","cve":"CVE-2026-1657","title":"EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa82ff-0d37-4040-b8fc-84d29534a4b7?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.4","to_inclusive":true,"patched_in":"4.2.8.5"}],"published":"2026-02-16T17:29:13Z","updated":"2026-02-17T05:29:54Z"},{"id":"wordfence:42aa9614-3403-422c-a4b7-0f4b2d17b371","source":"wordfence","cve":"CVE-2025-22649","title":"WP Project Manager <= 2.6.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42aa9614-3403-422c-a4b7-0f4b2d17b371?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.22","to_inclusive":true,"patched_in":"2.6.23"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-10T15:02:20Z"},{"id":"wordfence:42aaef3f-4889-4288-a1f1-767cbd437519","source":"wordfence","cve":"CVE-2026-120855","title":"TI WooCommerce Wishlist <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42aaef3f-4889-4288-a1f1-767cbd437519?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.14.1"}],"published":"2026-11-07T10:39:42Z","updated":"2026-11-10T19:41:14Z"},{"id":"wordfence:42ac67c7-8ab3-4314-bd0b-ca15e4fc64c1","source":"wordfence","cve":"CVE-2025-23494","title":"Quizzin <= 1.01.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ac67c7-8ab3-4314-bd0b-ca15e4fc64c1?source=api-prod","affected":[{"type":"plugin","slug":"quizzin","name":"Quizzin","from":"*","from_inclusive":true,"to":"1.01.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-10T18:49:16Z"},{"id":"wordfence:42ac91dc-bcde-4804-bac7-b96597627a27","source":"wordfence","cve":"CVE-2025-66075","title":"Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ac91dc-bcde-4804-bac7-b96597627a27?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2025-11-08T00:00:00Z","updated":"2025-11-25T15:48:55Z"},{"id":"wordfence:42acc6e4-ceee-4551-bca4-4f8d0a958eef","source":"wordfence","cve":"CVE-2026-65508","title":"Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42acc6e4-ceee-4551-bca4-4f8d0a958eef?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.10","to_inclusive":true,"patched_in":"1.6.12.11"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:47:54Z"},{"id":"wordfence:42ad6fef-4280-45db-a3e2-6d7522751fa7","source":"wordfence","cve":"CVE-2023-5252","title":"FareHarbor for WordPress <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ad6fef-4280-45db-a3e2-6d7522751fa7?source=api-prod","affected":[{"type":"plugin","slug":"fareharbor","name":"FareHarbor for WordPress","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42b24b41-c520-4bb8-ba56-6f35500ee90e","source":"wordfence","cve":"","title":"FooGallery <= 1.9.24 - Authenticated Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b24b41-c520-4bb8-ba56-6f35500ee90e?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"1.9.25","to_inclusive":false,"patched_in":"1.9.25"}],"published":"2020-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42b2d840-4e8b-4027-ab3b-78b17c9ed9aa","source":"wordfence","cve":"","title":"Floating Action Button <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b2d840-4e8b-4027-ab3b-78b17c9ed9aa?source=api-prod","affected":[{"type":"plugin","slug":"floating-action-button","name":"Floating Action Button","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42b373da-d5a6-4e3b-90f4-059da3641841","source":"wordfence","cve":"CVE-2025-12028","title":"IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b373da-d5a6-4e3b-90f4-059da3641841?source=api-prod","affected":[{"type":"plugin","slug":"indieauth","name":"IndieAuth","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-10-23T19:57:03Z","updated":"2025-10-30T14:24:24Z"},{"id":"wordfence:42b49a88-c6b7-47ac-89ab-c2e0d7f1c7cc","source":"wordfence","cve":"CVE-2025-23794","title":"wp_amaps <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b49a88-c6b7-47ac-89ab-c2e0d7f1c7cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-amaps","name":"wp_amaps","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:40:33Z"},{"id":"wordfence:42b682be-1a60-449d-8c92-72bd1c3abfd6","source":"wordfence","cve":"CVE-2025-24547","title":"Caching Compatible Cookie Opt-In and JavaScript <= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b682be-1a60-449d-8c92-72bd1c3abfd6?source=api-prod","affected":[{"type":"plugin","slug":"caching-compatible-cookie-optin-and-javascript","name":"Caching Compatible Cookie Opt-In and JavaScript","from":"*","from_inclusive":true,"to":"0.0.10","to_inclusive":true,"patched_in":"0.0.11"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:30:57Z"},{"id":"wordfence:42b77d66-8519-4e7e-b253-fefac581df4b","source":"wordfence","cve":"CVE-2025-6790","title":"Quiz and Survey Master (QSM) <= 10.2.2 - Cross-Site Request Forgery to Template Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b77d66-8519-4e7e-b253-fefac581df4b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":"10.2.3"}],"published":"2025-07-24T00:00:00Z","updated":"2025-08-25T15:50:28Z"},{"id":"wordfence:42b9e16c-8e53-452d-9c0b-34c424d6f508","source":"wordfence","cve":"CVE-2024-12285","title":"SEMA API <= 5.27 - Reflected Cross-Site Scripting via catid Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42b9e16c-8e53-452d-9c0b-34c424d6f508?source=api-prod","affected":[{"type":"plugin","slug":"sema-api","name":"SEMA API","from":"*","from_inclusive":true,"to":"5.27","to_inclusive":true,"patched_in":"5.30"}],"published":"2025-01-08T22:08:32Z","updated":"2025-01-10T19:01:08Z"},{"id":"wordfence:42bbe73f-3465-4e84-8de9-43a85500f316","source":"wordfence","cve":"CVE-2025-47589","title":"Ebook Store <= 5.8009 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42bbe73f-3465-4e84-8de9-43a85500f316?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8009","to_inclusive":true,"patched_in":"5.8010"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-25T13:39:15Z"},{"id":"wordfence:42c1103e-3c1c-4d28-a7e4-d669c8dd7775","source":"wordfence","cve":"CVE-2026-62027","title":"Team Section Block \u2013 Showcase Team Members with Layout Options <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42c1103e-3c1c-4d28-a7e4-d669c8dd7775?source=api-prod","affected":[{"type":"plugin","slug":"team-section","name":"Team Section Block \u2013 Showcase Team Members with Layout Options","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-10-09T12:54:11Z","updated":"2026-10-28T21:20:25Z"},{"id":"wordfence:42c1d2ea-dea6-4cde-8db3-37709da9eb71","source":"wordfence","cve":"CVE-2024-7963","title":"CMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42c1d2ea-dea6-4cde-8db3-37709da9eb71?source=api-prod","affected":[{"type":"plugin","slug":"cmsmasters-content-composer","name":"CMSMasters Content Composer","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-10-08T00:00:00Z","updated":"2024-10-09T02:01:17Z"},{"id":"wordfence:42c38563-ed78-4e65-8d1f-b3aa6444923d","source":"wordfence","cve":"","title":"Related Posts for WordPress <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42c38563-ed78-4e65-8d1f-b3aa6444923d?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42ccf09a-a3ce-4831-b778-4a199c299822","source":"wordfence","cve":"CVE-2026-84166","title":"Hotel Booking <= 3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ccf09a-a3ce-4831-b778-4a199c299822?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:20:00Z"},{"id":"wordfence:42cd1b53-400f-4933-b3cc-2fd9079e241c","source":"wordfence","cve":"CVE-2024-30527","title":"WP Express Checkout (Accept PayPal Payments) <= 2.3.7 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42cd1b53-400f-4933-b3cc-2fd9079e241c?source=api-prod","affected":[{"type":"plugin","slug":"wp-express-checkout","name":"WP Express Checkout (Fast Payments via PayPal & Stripe)","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:37:20Z"},{"id":"wordfence:42cd1d08-4d5a-466b-930c-f4e28ae4d52c","source":"wordfence","cve":"CVE-2026-24572","title":"Nelio Content <= 4.2.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42cd1d08-4d5a-466b-930c-f4e28ae4d52c?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-02-03T19:16:16Z"},{"id":"wordfence:42ce3bc1-ebcc-45e7-ab25-e3e0c60c4eb3","source":"wordfence","cve":"CVE-2026-97287","title":"Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ce3bc1-ebcc-45e7-ab25-e3e0c60c4eb3?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.5","to_inclusive":true,"patched_in":"5.29.5.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:44:43Z"},{"id":"wordfence:42cf84d1-37f5-41c1-838d-67244f17c55d","source":"wordfence","cve":"CVE-2024-11775","title":"Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42cf84d1-37f5-41c1-838d-67244f17c55d?source=api-prod","affected":[{"type":"plugin","slug":"particle-background","name":"Particle Background","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:03:56Z","updated":"2024-12-20T06:59:05Z"},{"id":"wordfence:42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531","source":"wordfence","cve":"CVE-2026-120551","title":"WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.22.01","to_inclusive":true,"patched_in":"7.22.38"}],"published":"2026-09-08T18:03:09Z","updated":"2026-11-03T04:43:06Z"},{"id":"wordfence:42d56d6a-365a-4fa2-977f-a1328e0ec1b3","source":"wordfence","cve":"","title":"Clicky by Yoast <= 1.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42d56d6a-365a-4fa2-977f-a1328e0ec1b3?source=api-prod","affected":[{"type":"plugin","slug":"clicky","name":"Clicky for WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2016-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42d862ef-523f-43ca-a3fb-ac3fbb537c46","source":"wordfence","cve":"CVE-2025-48322","title":"Statify Widget <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42d862ef-523f-43ca-a3fb-ac3fbb537c46?source=api-prod","affected":[{"type":"plugin","slug":"statify-widget","name":"Statify Widget","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-08-22T00:00:00Z","updated":"2025-10-08T21:13:33Z"},{"id":"wordfence:42da00cf-5fda-4ad7-ad74-0328f492abcf","source":"wordfence","cve":"CVE-2024-24800","title":"Product Feed PRO for WooCommerce by AdTribes \u2013 WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42da00cf-5fda-4ad7-ad74-0328f492abcf?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"13.2.5","to_inclusive":true,"patched_in":"13.2.6"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T12:36:47Z"},{"id":"wordfence:42dacd44-f676-4d2d-ad7d-9dc5b4af6d8a","source":"wordfence","cve":"CVE-2025-58595","title":"WordPress All In One Login Plugin <= 2.0.8 - IP Sooofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42dacd44-f676-4d2d-ad7d-9dc5b4af6d8a?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-admin-login","name":"All In One Login","from":"2.0.8","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-15T15:56:20Z"},{"id":"wordfence:42dacf78-1feb-4cbc-9ec3-805e668be931","source":"wordfence","cve":"CVE-2025-25077","title":"Easy Chart Builder for WordPress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42dacf78-1feb-4cbc-9ec3-805e668be931?source=api-prod","affected":[{"type":"plugin","slug":"easy-chart-builder","name":"Easy Chart Builder for WordPress","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:17:15Z"},{"id":"wordfence:42db52ae-f881-4082-b475-8577a28641c6","source":"wordfence","cve":"CVE-2020-36703","title":"Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42db52ae-f881-4082-b475-8577a28641c6?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"}],"published":"2020-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42dcc302-b543-42c7-99fa-605f017beb1a","source":"wordfence","cve":"CVE-2025-5483","title":"LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42dcc302-b543-42c7-99fa-605f017beb1a?source=api-prod","affected":[{"type":"plugin","slug":"ghl-wizard","name":"Connector Wizard (formerly LC Wizard)","from":"1.2.10","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-11-06T14:58:12Z","updated":"2025-11-07T03:27:52Z"},{"id":"wordfence:42dd1eeb-10b4-48f1-b392-dfa3a9d4b9c4","source":"wordfence","cve":"CVE-2019-16222","title":"WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42dd1eeb-10b4-48f1-b392-dfa3a9d4b9c4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42dd84ea-5d34-465b-bc62-6fa57dc85056","source":"wordfence","cve":"CVE-2017-20250","title":"Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42dd84ea-5d34-465b-bc62-6fa57dc85056?source=api-prod","affected":[{"type":"plugin","slug":"mac-photo-gallery","name":"Mac Photo Gallery","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T19:57:43Z"},{"id":"wordfence:42de41f1-cfb2-4413-8841-c63d0e764be3","source":"wordfence","cve":"CVE-2024-32718","title":"The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42de41f1-cfb2-4413-8841-c63d0e764be3?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.0.8.2","to_inclusive":true,"patched_in":"2.0.8.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:16:27Z"},{"id":"wordfence:42de4318-0f10-4236-bd1f-06eea84acc9e","source":"wordfence","cve":"CVE-2026-24381","title":"PhotoMe < 5.7.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42de4318-0f10-4236-bd1f-06eea84acc9e?source=api-prod","affected":[{"type":"theme","slug":"photome","name":"PhotoMe | Photography Portfolio WordPress","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":false,"patched_in":"5.7.2"}],"published":"2026-01-02T00:00:00Z","updated":"2026-02-03T20:58:41Z"},{"id":"wordfence:42e54e09-242f-49ab-9fff-a9ffc62dd4bd","source":"wordfence","cve":"CVE-2022-4577","title":"Easy Testimonials <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42e54e09-242f-49ab-9fff-a9ffc62dd4bd?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42e63318-661e-465d-919f-df0635ea1a6d","source":"wordfence","cve":"CVE-2025-12180","title":"Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42e63318-661e-465d-919f-df0635ea1a6d?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-10-31T16:53:06Z","updated":"2025-11-01T05:40:22Z"},{"id":"wordfence:42e74152-b79d-42f5-87a2-6e9545699483","source":"wordfence","cve":"CVE-2021-24409","title":"Prismatic <= 2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42e74152-b79d-42f5-87a2-6e9545699483?source=api-prod","affected":[{"type":"plugin","slug":"prismatic","name":"Prismatic","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42e8129f-dbbd-4dd3-a7a5-c6242c43dfe8","source":"wordfence","cve":"CVE-2022-2600","title":"Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing","severity":"medium","cvss":5.4,"cwe":"CWE-1022","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42e8129f-dbbd-4dd3-a7a5-c6242c43dfe8?source=api-prod","affected":[{"type":"plugin","slug":"auto-hyperlink-urls","name":"Auto-hyperlink URLs","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42eba5fe-aafa-4cdd-9243-a50df56014fb","source":"wordfence","cve":"CVE-2025-58000","title":"Memberful <= 1.75.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42eba5fe-aafa-4cdd-9243-a50df56014fb?source=api-prod","affected":[{"type":"plugin","slug":"memberful-wp","name":"Memberful \u2013 Membership Plugin","from":"*","from_inclusive":true,"to":"1.75.0","to_inclusive":true,"patched_in":"1.76.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-17T19:36:29Z"},{"id":"wordfence:42ecc4e5-d660-472f-823d-a29b84cdf041","source":"wordfence","cve":"CVE-2023-5816","title":"Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading","severity":"medium","cvss":4.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ecc4e5-d660-472f-823d-a29b84cdf041?source=api-prod","affected":[{"type":"plugin","slug":"code-explorer","name":"Code Explorer","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-10-29T00:00:00Z","updated":"2025-02-11T20:50:08Z"},{"id":"wordfence:42ecfca7-d285-4f14-8389-966b7b6320e7","source":"wordfence","cve":"CVE-2026-54836","title":"YMC Filter <= 3.11.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ecfca7-d285-4f14-8389-966b7b6320e7?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.11.5","to_inclusive":true,"patched_in":"3.11.6"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:37:55Z"},{"id":"wordfence:42f37a41-deff-4b17-94d8-4e0fd1ce22c2","source":"wordfence","cve":"CVE-2026-7537","title":"MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f37a41-deff-4b17-94d8-4e0fd1ce22c2?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.3","to_inclusive":true,"patched_in":"1.7.8.4"}],"published":"2026-06-05T14:20:11Z","updated":"2026-06-06T02:28:35Z"},{"id":"wordfence:42f537db-cb30-4ac6-9cc5-835901a722be","source":"wordfence","cve":"","title":"Clearfy Cache <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f537db-cb30-4ac6-9cc5-835901a722be?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42f54887-ce98-4360-8d07-37b1a48fc3fd","source":"wordfence","cve":"","title":"WP Statistics <= 13.2.5 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f54887-ce98-4360-8d07-37b1a48fc3fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.5","to_inclusive":true,"patched_in":"13.2.6"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42f5d834-d63c-4690-a03b-e573ce91465c","source":"wordfence","cve":"CVE-2025-32587","title":"WooCommerce Pickupp <= 2.4.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f5d834-d63c-4690-a03b-e573ce91465c?source=api-prod","affected":[{"type":"plugin","slug":"wc-pickupp","name":"Pickupp Delivery for eCommerce Shops using WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:36:40Z"},{"id":"wordfence:42f5f29b-2d83-4b15-82aa-0598f8a2317b","source":"wordfence","cve":"CVE-2023-3011","title":"ARMember <= 4.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f5f29b-2d83-4b15-82aa-0598f8a2317b?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42f68a01-ef94-4e7e-abdd-46571973b911","source":"wordfence","cve":"CVE-2024-9230","title":"PowerPress Podcasting <= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f68a01-ef94-4e7e-abdd-46571973b911?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.9.17","to_inclusive":true,"patched_in":"11.9.18"}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-21T20:41:09Z"},{"id":"wordfence:42f8f378-0f84-49ad-b95e-6abb3a94df7e","source":"wordfence","cve":"CVE-2026-13729","title":"Podlove Podcast Publisher < 4.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f8f378-0f84-49ad-b95e-6abb3a94df7e?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":false,"patched_in":"4.5.3"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:28:24Z"},{"id":"wordfence:42f94f80-6157-4778-ad69-184943134fd2","source":"wordfence","cve":"CVE-2026-13430","title":"Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42f94f80-6157-4778-ad69-184943134fd2?source=api-prod","affected":[{"type":"plugin","slug":"post-export-import-with-media","name":"Post Export Import with Media","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2026-07-09T15:21:34Z","updated":"2026-07-10T03:31:16Z"},{"id":"wordfence:42ff1e17-ccc2-478b-a3b5-88e3bea28a5e","source":"wordfence","cve":"CVE-2007-2481","title":"wordTube <= 1.43 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42ff1e17-ccc2-478b-a3b5-88e3bea28a5e?source=api-prod","affected":[{"type":"plugin","slug":"wordtube","name":"wordTube","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":"1.44"}],"published":"2007-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:42fff63c-62ec-466e-9a05-60d76f80039e","source":"wordfence","cve":"CVE-2023-31075","title":"Easy Hide Login <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/42fff63c-62ec-466e-9a05-60d76f80039e?source=api-prod","affected":[{"type":"plugin","slug":"easy-hide-login","name":"Easy Hide Login","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43014ecd-72d9-44cc-be24-c0c9790ddc20","source":"wordfence","cve":"CVE-2024-1236","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43014ecd-72d9-44cc-be24-c0c9790ddc20?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"5.9.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:27Z"},{"id":"wordfence:4301666c-98a5-4028-978f-f50e5b8f4a6a","source":"wordfence","cve":"","title":"FoxyPress <= 0.4.9 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4301666c-98a5-4028-978f-f50e5b8f4a6a?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.9","to_inclusive":true,"patched_in":""}],"published":"2012-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4302ab90-f827-4e25-b72f-d41542d3bad3","source":"wordfence","cve":"CVE-2026-14855","title":"RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4302ab90-f827-4e25-b72f-d41542d3bad3?source=api-prod","affected":[{"type":"plugin","slug":"rt-mega-menu","name":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-09-17T14:08:34Z","updated":"2026-10-14T16:21:15Z"},{"id":"wordfence:43039c47-a34f-4020-9009-473e93468e21","source":"wordfence","cve":"CVE-2010-5294","title":"WordPress Core < 3.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43039c47-a34f-4020-9009-473e93468e21?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2010-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43039f2a-b3f9-4836-8b55-e8a091b1a102","source":"wordfence","cve":"CVE-2025-4103","title":"WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43039f2a-b3f9-4836-8b55-e8a091b1a102?source=api-prod","affected":[{"type":"plugin","slug":"wp-geometa","name":"WP-GeoMeta","from":"0.3.4","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T18:05:19Z","updated":"2025-05-31T06:40:54Z"},{"id":"wordfence:4306b3b2-2834-4445-8c85-afc5c39f4632","source":"wordfence","cve":"CVE-2024-50408","title":"Namaste! LMS <= 2.6.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4306b3b2-2834-4445-8c85-afc5c39f4632?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:40:45Z"},{"id":"wordfence:4308528d-6a7e-462b-a6a3-b8f59c0c16bc","source":"wordfence","cve":"CVE-2024-52341","title":"OS Our Team <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4308528d-6a7e-462b-a6a3-b8f59c0c16bc?source=api-prod","affected":[{"type":"plugin","slug":"os-our-team","name":"OS Our Team","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:48:42Z"},{"id":"wordfence:430a0b93-2cb7-45bf-86ac-4a8b3a0be77a","source":"wordfence","cve":"CVE-2025-6813","title":"aapanel WP Toolkit 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430a0b93-2cb7-45bf-86ac-4a8b3a0be77a?source=api-prod","affected":[{"type":"plugin","slug":"aapanel-wp-toolkit","name":"aapanel WP Toolkit","from":"1.0","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-07-17T16:21:33Z","updated":"2025-11-05T21:40:21Z"},{"id":"wordfence:430a82be-79dd-4819-a608-3a05a6a62018","source":"wordfence","cve":"CVE-2025-69152","title":"Artale | Wedding Photography WordPress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430a82be-79dd-4819-a608-3a05a6a62018?source=api-prod","affected":[{"type":"theme","slug":"artale","name":"Artale | Wedding Photography WordPress","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:37:40Z"},{"id":"wordfence:430a981c-7856-493c-bf66-11506b5963a0","source":"wordfence","cve":"CVE-2022-36390","title":"Event Calendar <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430a981c-7856-493c-bf66-11506b5963a0?source=api-prod","affected":[{"type":"plugin","slug":"calendar-event","name":"Event Calendar \u2013 Calendar","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:430b7e72-72b8-4cf8-99f4-ee1d1d4b4f24","source":"wordfence","cve":"CVE-2025-4315","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430b7e72-72b8-4cf8-99f4-ee1d1d4b4f24?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.24"}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-11T09:22:34Z"},{"id":"wordfence:430c1845-30b8-47b7-8866-dfe7c45479ba","source":"wordfence","cve":"CVE-2026-42717","title":"Leyka <= 3.32.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430c1845-30b8-47b7-8866-dfe7c45479ba?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.32.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:26:31Z"},{"id":"wordfence:430c6f4b-277e-41bf-a638-fd3fea495a31","source":"wordfence","cve":"CVE-2014-4539","title":"Movies <= 0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/430c6f4b-277e-41bf-a638-fd3fea495a31?source=api-prod","affected":[{"type":"plugin","slug":"movies","name":"Movies","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43100062-c6bd-4d08-a88b-fbcf24f7e605","source":"wordfence","cve":"CVE-2022-38470","title":"Customer Reviews for WooCommerce <= 5.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43100062-c6bd-4d08-a88b-fbcf24f7e605?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43110773-0eba-41dd-adbf-0e21cb69058e","source":"wordfence","cve":"CVE-2024-35745","title":"Strategery Migrations <= 1.0 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43110773-0eba-41dd-adbf-0e21cb69058e?source=api-prod","affected":[{"type":"plugin","slug":"strategery-migrations","name":"Strategery Migrations","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:41:22Z"},{"id":"wordfence:431331aa-4d9f-41f2-a522-567bbd9b8831","source":"wordfence","cve":"CVE-2022-41136","title":"Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431331aa-4d9f-41f2-a522-567bbd9b8831?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.0","to_inclusive":true,"patched_in":"5.12.1"}],"published":"2022-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43192613-ce5b-4acc-b284-f40cad7cb8df","source":"wordfence","cve":"CVE-2024-13649","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43192613-ce5b-4acc-b284-f40cad7cb8df?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.6.7","to_inclusive":true,"patched_in":"1.4.6.8"}],"published":"2025-03-07T22:00:31Z","updated":"2025-03-08T11:16:41Z"},{"id":"wordfence:4319988c-1dcd-486e-b8d8-cc58cf36e6c1","source":"wordfence","cve":"CVE-2024-49605","title":"AVChat Video Chat <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4319988c-1dcd-486e-b8d8-cc58cf36e6c1?source=api-prod","affected":[{"type":"plugin","slug":"avchat-3","name":"Community Lite Video Chat","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-22T17:53:47Z"},{"id":"wordfence:4319fa2e-8826-4100-9156-cbe80582367e","source":"wordfence","cve":"CVE-2024-2920","title":"WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4319fa2e-8826-4100-9156-cbe80582367e?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.9.3","to_inclusive":true,"patched_in":"3.4.9.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T07:28:19Z"},{"id":"wordfence:431a83b3-4dc9-4090-ae49-1c283d24fc2e","source":"wordfence","cve":"CVE-2026-23970","title":"Redirection for Contact Form 7 <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431a83b3-4dc9-4090-ae49-1c283d24fc2e?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-19T13:33:44Z"},{"id":"wordfence:431b0f09-6b0a-4f67-bd39-38ee7d90eb07","source":"wordfence","cve":"CVE-2024-54273","title":"Mail Picker <= 1.0.14 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431b0f09-6b0a-4f67-bd39-38ee7d90eb07?source=api-prod","affected":[{"type":"plugin","slug":"mail-picker","name":"PickPlugins Mail Picker \u2014 Email Marketing & Newsletters","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:34:52Z"},{"id":"wordfence:431bcb93-396f-470b-94c9-66a9a2973552","source":"wordfence","cve":"CVE-2024-47649","title":"Iconize <= 1.2.4 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431bcb93-396f-470b-94c9-66a9a2973552?source=api-prod","affected":[{"type":"plugin","slug":"iconize","name":"Iconize","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:13:41Z"},{"id":"wordfence:431cae56-0915-4440-b732-1a738c5f7e38","source":"wordfence","cve":"CVE-2026-111740","title":"Post Duplicator < 3.0.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431cae56-0915-4440-b732-1a738c5f7e38?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.17","to_inclusive":false,"patched_in":"3.0.17"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:36:18Z"},{"id":"wordfence:431d352b-d79b-4a6b-91f9-95962be3049e","source":"wordfence","cve":"CVE-2020-4046","title":"WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/431d352b-d79b-4a6b-91f9-95962be3049e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43229015-690b-4c60-834e-b7604e06f2ad","source":"wordfence","cve":"CVE-2026-93943","title":"Convex - Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43229015-690b-4c60-834e-b7604e06f2ad?source=api-prod","affected":[{"type":"theme","slug":"convex","name":"Convex - Architecture & Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:51:49Z","updated":"2026-10-13T14:29:28Z"},{"id":"wordfence:4322d9d6-13b6-4476-9eb5-fea4aff2e5ce","source":"wordfence","cve":"CVE-2024-4868","title":"Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4322d9d6-13b6-4476-9eb5-fea4aff2e5ce?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor","name":"Extensions for Elementor","from":"*","from_inclusive":true,"to":"2.0.32","to_inclusive":true,"patched_in":"2.0.33"}],"published":"2024-07-08T19:48:37Z","updated":"2024-08-01T17:38:16Z"},{"id":"wordfence:4322fce1-0403-4458-82e3-7d374ab724c9","source":"wordfence","cve":"CVE-2026-100193","title":"Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4322fce1-0403-4458-82e3-7d374ab724c9?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-13T15:13:16Z","updated":"2026-10-14T03:40:01Z"},{"id":"wordfence:4325d9ce-35a2-4ee8-99cc-39c04d624e81","source":"wordfence","cve":"CVE-2025-22276","title":"Related Post Shortcode <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4325d9ce-35a2-4ee8-99cc-39c04d624e81?source=api-prod","affected":[{"type":"plugin","slug":"related-post-shortcode","name":"Related Post Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:12:48Z"},{"id":"wordfence:4327f414-64f4-4193-a5c0-2a5ecdd75e11","source":"wordfence","cve":"CVE-2024-10011","title":"BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4327f414-64f4-4193-a5c0-2a5ecdd75e11?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.1.0","to_inclusive":true,"patched_in":"14.2.1"}],"published":"2024-10-24T17:56:55Z","updated":"2024-10-29T14:15:25Z"},{"id":"wordfence:432807d0-64d8-49b1-a4ab-33aa8fbc5189","source":"wordfence","cve":"CVE-2023-23796","title":"Form Builder <= 1.9.9.0 - Unauthenticated CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432807d0-64d8-49b1-a4ab-33aa8fbc5189?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-add","name":"Form Builder | Create Responsive Contact Forms","from":"*","from_inclusive":true,"to":"1.9.9.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:432ac3b1-8f1d-442f-8e8d-62a1f26ba259","source":"wordfence","cve":"CVE-2025-0968","title":"ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432ac3b1-8f1d-442f-8e8d-62a1f26ba259?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-02-18T22:37:28Z","updated":"2025-02-19T11:10:39Z"},{"id":"wordfence:432b11be-174d-45d6-aa3b-2fbfa85ec17a","source":"wordfence","cve":"CVE-2026-6393","title":"BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432b11be-174d-45d6-aa3b-2fbfa85ec17a?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-04-23T14:45:35Z","updated":"2026-04-24T03:27:05Z"},{"id":"wordfence:432b71ea-dd81-4536-abda-33da8185abb6","source":"wordfence","cve":"CVE-2021-24487","title":"St Daily Tip <= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432b71ea-dd81-4536-abda-33da8185abb6?source=api-prod","affected":[{"type":"plugin","slug":"st-daily-tip","name":"St-Daily-Tip","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:432b72f3-7d21-4b98-a957-b8449dbc5bf0","source":"wordfence","cve":"CVE-2026-89283","title":"Posts Password Batch Manager <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432b72f3-7d21-4b98-a957-b8449dbc5bf0?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-password-batch-manager","name":"WP Posts Password Batch Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:21:47Z"},{"id":"wordfence:432c1241-b264-49b7-9f6d-b9adcc1557b6","source":"wordfence","cve":"CVE-2025-23517","title":"Google Map on Post/Page <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432c1241-b264-49b7-9f6d-b9adcc1557b6?source=api-prod","affected":[{"type":"plugin","slug":"google-map-on-postpage","name":"Google Map on Post/Page","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:28:45Z"},{"id":"wordfence:432df51f-2855-4bf2-8be1-77a893e3aa29","source":"wordfence","cve":"CVE-2023-32581","title":"WP-Chatbot for Messenger <= 4.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432df51f-2855-4bf2-8be1-77a893e3aa29?source=api-prod","affected":[{"type":"plugin","slug":"wp-chatbot","name":"WP-Chatbot for Messenger","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:432effd4-5c94-4ef9-bc19-b4eacd082264","source":"wordfence","cve":"CVE-2024-24705","title":"Accessibility <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/432effd4-5c94-4ef9-bc19-b4eacd082264?source=api-prod","affected":[{"type":"plugin","slug":"accessibility","name":"Accessibility","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-04-25T18:27:22Z"},{"id":"wordfence:4333ba20-e201-4424-b483-4751e86384e2","source":"wordfence","cve":"CVE-2025-50041","title":"Gutenberg Blocks \u2013 ACF Blocks Suite <= 2.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4333ba20-e201-4424-b483-4751e86384e2?source=api-prod","affected":[{"type":"plugin","slug":"acf-blocks","name":"Gutenberg Blocks \u2013 ACF Blocks Suite","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:54:29Z"},{"id":"wordfence:43357daa-4dce-4851-b41b-48d3ffb8a387","source":"wordfence","cve":"CVE-2023-27435","title":"HTTP Auth <= 0.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43357daa-4dce-4851-b41b-48d3ffb8a387?source=api-prod","affected":[{"type":"plugin","slug":"http-auth","name":"HTTP Auth","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4335e598-d48b-4dbe-b6a4-69790acecfdd","source":"wordfence","cve":"CVE-2024-53752","title":"Stripe Donation <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4335e598-d48b-4dbe-b6a4-69790acecfdd?source=api-prod","affected":[{"type":"plugin","slug":"bin-stripe-donation","name":"Stripe Donation","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2025-03-17T13:26:58Z"},{"id":"wordfence:4336d597-7e87-46eb-8abd-9fafd6cd25d9","source":"wordfence","cve":"CVE-2023-3677","title":"WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4336d597-7e87-46eb-8abd-9fafd6cd25d9?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.89","to_inclusive":true,"patched_in":"1.2.90"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4339400c-1f6f-4a3f-85f2-28bd7246b949","source":"wordfence","cve":"CVE-2025-69335","title":"Team Showcase <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4339400c-1f6f-4a3f-85f2-28bd7246b949?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase","name":"Team Showcase \u2013 Responsive Team Members Grid, Slider & Carousel Plugin","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-13T17:38:24Z"},{"id":"wordfence:433a03c2-09fd-4ce6-843b-55ad09f4b4f7","source":"wordfence","cve":"CVE-2024-0859","title":"Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433a03c2-09fd-4ce6-843b-55ad09f4b4f7?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.34","to_inclusive":true,"patched_in":"2.9.35"}],"published":"2024-01-30T00:00:00Z","updated":"2024-07-29T21:36:15Z"},{"id":"wordfence:433a4ecd-1087-439b-952f-ac42e76f4910","source":"wordfence","cve":"CVE-2026-97219","title":"MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433a4ecd-1087-439b-952f-ac42e76f4910?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"4.21.1","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.22.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T00:11:34Z"},{"id":"wordfence:433ab82d-31ce-4386-ab1b-6d3498d7722a","source":"wordfence","cve":"CVE-2026-13170","title":"Eventin <= 4.1.19 - Authenticated (Editor+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433ab82d-31ce-4386-ab1b-6d3498d7722a?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.19","to_inclusive":true,"patched_in":"4.1.20"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:15:54Z"},{"id":"wordfence:433b5d92-5eca-4b60-94b1-e6288470955b","source":"wordfence","cve":"CVE-2025-57938","title":"Easy Hotel Booking <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433b5d92-5eca-4b60-94b1-e6288470955b?source=api-prod","affected":[{"type":"plugin","slug":"easy-hotel","name":"Easy Hotel \u2013 Powerful Hotel Booking","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-09-22T00:00:00Z","updated":"2026-05-26T18:17:13Z"},{"id":"wordfence:433bfb7b-f6ad-4417-8c68-025178c5cc65","source":"wordfence","cve":"CVE-2026-95529","title":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More <= 5.5.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433bfb7b-f6ad-4417-8c68-025178c5cc65?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.5.1.1","to_inclusive":true,"patched_in":"5.5.1.2"}],"published":"2026-09-23T11:16:27Z","updated":"2026-09-29T20:08:33Z"},{"id":"wordfence:433c8908-587e-4086-9d0c-c9b1819b26e8","source":"wordfence","cve":"CVE-2023-52124","title":"WP Tabs <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433c8908-587e-4086-9d0c-c9b1819b26e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-expand-tabs-free","name":"Custom Product Tabs for WooCommerce & WordPress Tabs Builder \u2013 Smart Tabs","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:433cd778-81ae-41e0-856b-40b5f0053ffe","source":"wordfence","cve":"CVE-2023-3360","title":"Weaver Show Posts <= 1.8.0 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433cd778-81ae-41e0-856b-40b5f0053ffe?source=api-prod","affected":[{"type":"plugin","slug":"show-posts","name":"Weaver Show Posts","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-08-08T00:00:00Z","updated":"2026-09-10T19:22:02Z"},{"id":"wordfence:433e5ba3-c07e-48a1-a28b-781121d892ae","source":"wordfence","cve":"CVE-2025-2484","title":"Multi Video Box <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/433e5ba3-c07e-48a1-a28b-781121d892ae?source=api-prod","affected":[{"type":"plugin","slug":"multi-video-box","name":"Multi Video Box","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T17:53:06Z","updated":"2025-03-22T06:41:10Z"},{"id":"wordfence:4340ef32-82d4-4523-ae63-36f0ef853f76","source":"wordfence","cve":"CVE-2026-15230","title":"YayPricing <= 3.5.6 - Missing Authorization to Authenticated (Subscriber+) Pricing Configuration Modification and Coupon Code Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4340ef32-82d4-4523-ae63-36f0ef853f76?source=api-prod","affected":[{"type":"plugin","slug":"yaypricing","name":"YayPricing \u2013 WooCommerce Dynamic Pricing & Discounts","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-21T15:35:29Z"},{"id":"wordfence:43412c79-3612-4e73-ba79-cb8688e776fe","source":"wordfence","cve":"CVE-2021-24798","title":"WP Header Images <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43412c79-3612-4e73-ba79-cb8688e776fe?source=api-prod","affected":[{"type":"plugin","slug":"wp-header-images","name":"WP Header Images","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:434433bc-e93a-435b-9d1c-8174df7970a5","source":"wordfence","cve":"CVE-2025-23541","title":"Download, Downloads \u2013 WordPress Download plugin By Edmon <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/434433bc-e93a-435b-9d1c-8174df7970a5?source=api-prod","affected":[{"type":"plugin","slug":"ydn-download","name":"Download, Downloads \u2013 WordPress Download plugin By Edmon","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:43:03Z"},{"id":"wordfence:43443789-4ebe-49b9-a3fe-ba7e5a8d3a7d","source":"wordfence","cve":"CVE-2025-23682","title":"Preloader Quotes <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43443789-4ebe-49b9-a3fe-ba7e5a8d3a7d?source=api-prod","affected":[{"type":"plugin","slug":"preloader-quotes","name":"Preloader Quotes","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:10:51Z"},{"id":"wordfence:43472813-1d0d-4f25-8ae6-408cda8ce519","source":"wordfence","cve":"CVE-2025-28956","title":"Backwp <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43472813-1d0d-4f25-8ae6-408cda8ce519?source=api-prod","affected":[{"type":"plugin","slug":"backwp","name":"Backwp","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-01T15:42:40Z"},{"id":"wordfence:434755f8-b2af-4f35-9af9-f0b9578718c8","source":"wordfence","cve":"CVE-2023-2490","title":"UserAgent-Spy <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/434755f8-b2af-4f35-9af9-f0b9578718c8?source=api-prod","affected":[{"type":"plugin","slug":"useragent-spy","name":"UserAgent-Spy","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4349f322-41ee-43d2-b0a9-567b89aa5d76","source":"wordfence","cve":"CVE-2022-3882","title":"Memory Usage <= 2.45 - Missing Authorization to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4349f322-41ee-43d2-b0a9-567b89aa5d76?source=api-prod","affected":[{"type":"plugin","slug":"wp-memory","name":"Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions","from":"*","from_inclusive":true,"to":"2.45","to_inclusive":true,"patched_in":"2.46"}],"published":"2022-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:434a724e-0bc6-4218-8ad4-c52e1880a75f","source":"wordfence","cve":"CVE-2022-4824","title":"WP Blog and Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/434a724e-0bc6-4218-8ad4-c52e1880a75f?source=api-prod","affected":[{"type":"plugin","slug":"wp-blog-and-widgets","name":"WP Blog and Widgets","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:434b140a-43b7-41bc-8cc2-ed82787b90c3","source":"wordfence","cve":"CVE-2025-39589","title":"Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/434b140a-43b7-41bc-8cc2-ed82787b90c3?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:30:30Z"},{"id":"wordfence:434f823d-17fb-4ea5-9506-0229d8375437","source":"wordfence","cve":"CVE-2025-46504","title":"Vasaio QR Code <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/434f823d-17fb-4ea5-9506-0229d8375437?source=api-prod","affected":[{"type":"plugin","slug":"vasaio-qr-code","name":"Vasaio QR Code","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:20:34Z"},{"id":"wordfence:435259dc-f141-4f1f-9e5b-3e82fb9890c6","source":"wordfence","cve":"CVE-2026-94457","title":"Captcha Code <= 3.32 - Unauthenticated Login Captcha Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/435259dc-f141-4f1f-9e5b-3e82fb9890c6?source=api-prod","affected":[{"type":"plugin","slug":"captcha-code-authentication","name":"Captcha Code","from":"*","from_inclusive":true,"to":"3.32","to_inclusive":true,"patched_in":"3.33"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:09:36Z"},{"id":"wordfence:4352b2dc-d2a7-4cc9-a44f-1f5be46e2482","source":"wordfence","cve":"CVE-2022-46811","title":"ALD Dropping and Fulfillment for AliExpress and WooCommerce <= 1.0.21 - Cross-Site Request Forgery to Order Information Disclosure","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4352b2dc-d2a7-4cc9-a44f-1f5be46e2482?source=api-prod","affected":[{"type":"plugin","slug":"woo-alidropship","name":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4353192c-e2e0-47c3-a99d-d00c41ffd418","source":"wordfence","cve":"CVE-2026-108492","title":"Quick PayPal Payments: Payment Button & Form <= 6.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4353192c-e2e0-47c3-a99d-d00c41ffd418?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:47:34Z"},{"id":"wordfence:435e1af0-c4f4-42ae-b2b3-2d9ffc41c4b5","source":"wordfence","cve":"CVE-2021-24302","title":"Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/435e1af0-c4f4-42ae-b2b3-2d9ffc41c4b5?source=api-prod","affected":[{"type":"plugin","slug":"hana-flv-player","name":"Hana Flv Player","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2021-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:435e8ca8-cf00-4de9-a454-8cb09b7661ef","source":"wordfence","cve":"CVE-2026-2496","title":"Ed's Font Awesome <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/435e8ca8-cf00-4de9-a454-8cb09b7661ef?source=api-prod","affected":[{"type":"plugin","slug":"eds-font-awesome","name":"Ed's Font Awesome","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-03-20T15:15:40Z","updated":"2026-07-08T20:51:53Z"},{"id":"wordfence:4360a04c-4e94-41a3-9553-aeb67e9682e0","source":"wordfence","cve":"CVE-2026-9060","title":"Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4360a04c-4e94-41a3-9553-aeb67e9682e0?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":false,"patched_in":"1.6.6"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:21:11Z"},{"id":"wordfence:4360f293-201c-40c1-9603-931d72cc79bc","source":"wordfence","cve":"CVE-2025-12579","title":"Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4360f293-201c-40c1-9603-931d72cc79bc?source=api-prod","affected":[{"type":"plugin","slug":"reuters-direct","name":"Reuters Direct","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:20:50Z","updated":"2025-11-27T02:26:13Z"},{"id":"wordfence:4364e713-8463-4088-b198-ed8237e86d42","source":"wordfence","cve":"","title":"Profile Builder < 2.5.8 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4364e713-8463-4088-b198-ed8237e86d42?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":false,"patched_in":"2.5.8"}],"published":"2017-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43699b41-0993-485c-b32d-ebcf28a302b8","source":"wordfence","cve":"CVE-2026-113491","title":"GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Arbitrary Media File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43699b41-0993-485c-b32d-ebcf28a302b8?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T15:06:55Z"},{"id":"wordfence:436ab843-7729-4d57-9c9e-2ede2f101ddb","source":"wordfence","cve":"CVE-2026-4807","title":"Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/436ab843-7729-4d57-9c9e-2ede2f101ddb?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.10.6","to_inclusive":true,"patched_in":"1.6.11"}],"published":"2026-05-06T13:33:55Z","updated":"2026-05-07T02:27:12Z"},{"id":"wordfence:436cd742-c271-4eb7-96a3-cd6af046d26f","source":"wordfence","cve":"CVE-2021-24591","title":"Highlight < 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/436cd742-c271-4eb7-96a3-cd6af046d26f?source=api-prod","affected":[{"type":"plugin","slug":"highlight","name":"Highlight Sitewide Notice, Text, Button Menu","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":false,"patched_in":"0.9.3"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:436d77d9-242a-452b-93d4-707881f59034","source":"wordfence","cve":"","title":"WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/436d77d9-242a-452b-93d4-707881f59034?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":false,"patched_in":"4.1.5"}],"published":"2016-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:436dc261-66b8-4b6c-9932-82513c3e5461","source":"wordfence","cve":"CVE-2014-5389","title":"Content Audit <= 1.6.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/436dc261-66b8-4b6c-9932-82513c3e5461?source=api-prod","affected":[{"type":"plugin","slug":"content-audit","name":"Content Audit","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2014-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:436fc1c8-3141-445d-902e-f759feefe1cc","source":"wordfence","cve":"","title":"Husker Portfolio <= 0.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/436fc1c8-3141-445d-902e-f759feefe1cc?source=api-prod","affected":[{"type":"plugin","slug":"huskerportfolio","name":"Husker Portfolio","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:437275af-42c9-4064-a744-e2108c017d02","source":"wordfence","cve":"CVE-2026-65576","title":"Adrena | Airsoft Club & Paintball WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437275af-42c9-4064-a744-e2108c017d02?source=api-prod","affected":[{"type":"theme","slug":"adrena","name":"Adrena | Airsoft Club & Paintball WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:42Z"},{"id":"wordfence:4372e6a4-3671-4110-bebb-85c1a97c5abb","source":"wordfence","cve":"CVE-2022-47147","title":"ipBlockList <= 1.0 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4372e6a4-3671-4110-bebb-85c1a97c5abb?source=api-prod","affected":[{"type":"plugin","slug":"ipblocklist","name":"ipBlockList","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:437423f0-978f-4c7c-9ec3-40668c630c93","source":"wordfence","cve":"CVE-2023-46207","title":"Motors \u2013 Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437423f0-978f-4c7c-9ec3-40668c630c93?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2023-10-19T00:00:00Z","updated":"2024-05-23T15:46:52Z"},{"id":"wordfence:437712f5-a493-4625-a314-856f0d0d9758","source":"wordfence","cve":"CVE-2024-33541","title":"Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437712f5-a493-4625-a314-856f0d0d9758?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:52:32Z"},{"id":"wordfence:4377b12c-b118-4284-8532-474473658ea5","source":"wordfence","cve":"CVE-2025-26738","title":"Quick Interest Slider  <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4377b12c-b118-4284-8532-474473658ea5?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2025-03-25T00:00:00Z","updated":"2026-04-25T15:33:40Z"},{"id":"wordfence:4377ee4a-7016-42a2-94a2-60338cbe4b12","source":"wordfence","cve":"CVE-2025-58232","title":"Image Editor by Pixo <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4377ee4a-7016-42a2-94a2-60338cbe4b12?source=api-prod","affected":[{"type":"plugin","slug":"image-editor-by-pixo","name":"Image Editor by Pixo","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:35:43Z"},{"id":"wordfence:43790bc7-23ff-48b1-bf49-bf13cf184bd1","source":"wordfence","cve":"CVE-2025-49040","title":"Backup Bolt <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43790bc7-23ff-48b1-bf49-bf13cf184bd1?source=api-prod","affected":[{"type":"plugin","slug":"backup-bolt","name":"Backup Bolt \u2013 Lightweight Backup, Fast WordPress Backup to ZIP","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:03:35Z"},{"id":"wordfence:43799089-3552-4138-b7f8-84fa4478406a","source":"wordfence","cve":"CVE-2024-54410","title":"SOPA Blackout <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43799089-3552-4138-b7f8-84fa4478406a?source=api-prod","affected":[{"type":"plugin","slug":"sopa-blackout","name":"SOPA Blackout","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:35:19Z"},{"id":"wordfence:4379f2c5-3533-45f7-a4ef-0b3320eb5d04","source":"wordfence","cve":"CVE-2025-6686","title":"Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4379f2c5-3533-45f7-a4ef-0b3320eb5d04?source=api-prod","affected":[{"type":"plugin","slug":"magic-buttons-for-elementor","name":"Magic Buttons for Elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-07-01T14:56:14Z","updated":"2025-07-28T20:23:29Z"},{"id":"wordfence:437c88f8-9457-48e5-b10f-aa453720bc5a","source":"wordfence","cve":"CVE-2024-54369","title":"Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437c88f8-9457-48e5-b10f-aa453720bc5a?source=api-prod","affected":[{"type":"plugin","slug":"ai-site-builder","name":"Zita Site Builder \u2013 Elementor, WordPress & Gutenberg Website Builder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:12:28Z"},{"id":"wordfence:437e4f77-6426-411f-985e-35e1a1f30bfb","source":"wordfence","cve":"CVE-2025-57989","title":"WordPress Widgets Shortcode <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437e4f77-6426-411f-985e-35e1a1f30bfb?source=api-prod","affected":[{"type":"plugin","slug":"wp-widgets-shortcode","name":"WordPress Widgets Shortcode","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:25:16Z"},{"id":"wordfence:437e8d95-2ab3-4cb0-94ca-110f742d6eff","source":"wordfence","cve":"CVE-2015-9460","title":"Pinpoint Booking System \u2013 #1 WordPress Booking Plugin < 2.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/437e8d95-2ab3-4cb0-94ca-110f742d6eff?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43810a17-89b4-44f5-887e-1ad0989ea5b4","source":"wordfence","cve":"","title":"WooCommerce < 8.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43810a17-89b4-44f5-887e-1ad0989ea5b4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":false,"patched_in":"8.4.0"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4381d22f-5607-4b54-9762-33ac6611a658","source":"wordfence","cve":"CVE-2025-49284","title":"WP Maintenance Mode & Site Under Construction <= 4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4381d22f-5607-4b54-9762-33ac6611a658?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode-site-under-construction","name":"WP Maintenance Mode & Site Under Construction","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:09:34Z"},{"id":"wordfence:43825586-1a0b-4297-b278-77c1846be9aa","source":"wordfence","cve":"CVE-2025-49984","title":"PowerPress Podcasting <= 11.13.11 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43825586-1a0b-4297-b278-77c1846be9aa?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.13.11","to_inclusive":true,"patched_in":"11.13.12"}],"published":"2025-06-19T00:00:00Z","updated":"2025-10-21T20:39:47Z"},{"id":"wordfence:43841cbd-e78a-4b67-a495-208146cfe108","source":"wordfence","cve":"CVE-2025-31020","title":"Simple Spoiler <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43841cbd-e78a-4b67-a495-208146cfe108?source=api-prod","affected":[{"type":"plugin","slug":"simple-spoiler","name":"Simple Spoiler","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-25T13:38:03Z"},{"id":"wordfence:43854ca5-02ba-4926-9a5e-d9fd5b1af448","source":"wordfence","cve":"CVE-2023-0166","title":"PickPlugins Product Slider for WooCommerce <= 1.13.41 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43854ca5-02ba-4926-9a5e-d9fd5b1af448?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-slider","name":"Product Slider, Product Grid, Product Masonry","from":"*","from_inclusive":true,"to":"1.13.41","to_inclusive":true,"patched_in":"1.13.42"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:438689aa-3b85-4dd7-ac3e-a37906efd79c","source":"wordfence","cve":"CVE-2023-26534","title":"WP Repost <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scritping","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438689aa-3b85-4dd7-ac3e-a37906efd79c?source=api-prod","affected":[{"type":"plugin","slug":"wp-repost","name":"WP Repost","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43886697-bf31-4466-b2bb-b932937eb187","source":"wordfence","cve":"CVE-2025-31902","title":"Social Share And Social Locker <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43886697-bf31-4466-b2bb-b932937eb187?source=api-prod","affected":[{"type":"plugin","slug":"social-share-and-social-locker-arsocial","name":"Social Share And Social Locker \u2013 ARSocial","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2026-07-16T19:17:13Z"},{"id":"wordfence:4389ddc9-de69-4316-9bfa-ff3bd3346c69","source":"wordfence","cve":"CVE-2024-13750","title":"Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4389ddc9-de69-4316-9bfa-ff3bd3346c69?source=api-prod","affected":[{"type":"plugin","slug":"multilevel-referral-plugin-for-woocommerce","name":"Multilevel Referral Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.28","to_inclusive":true,"patched_in":"2.28.1"}],"published":"2025-02-28T15:26:41Z","updated":"2026-01-23T19:56:49Z"},{"id":"wordfence:438a94c4-a7f2-4c08-960b-e18c19196169","source":"wordfence","cve":"CVE-2023-47654","title":"BZScore \u2013 Live Score <= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438a94c4-a7f2-4c08-960b-e18c19196169?source=api-prod","affected":[{"type":"plugin","slug":"bzscore-live-score","name":"BZScore \u2013 Live Score","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-11-07T00:00:00Z","updated":"2026-02-26T14:52:18Z"},{"id":"wordfence:438b9c13-4059-4671-ab4a-07a8cf6f6122","source":"wordfence","cve":"CVE-2023-5565","title":"Shortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438b9c13-4059-4671-ab4a-07a8cf6f6122?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-menu","name":"Shortcode Menu","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:438bbd0f-5204-4a71-9730-efa51d864832","source":"wordfence","cve":"","title":"Faculty Staff and Student Directory Plugin \u2013 Campus Directory <= 1.7.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438bbd0f-5204-4a71-9730-efa51d864832?source=api-prod","affected":[{"type":"plugin","slug":"campus-directory","name":"Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:438d73bb-80f1-460f-8c62-2a40856e4c29","source":"wordfence","cve":"","title":"Auto Affiliate Links < 5.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438d73bb-80f1-460f-8c62-2a40856e4c29?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:438dfea4-21f1-4796-9c1b-81aebd8842f2","source":"wordfence","cve":"CVE-2026-42662","title":"Event Tickets and Registration <= 5.27.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438dfea4-21f1-4796-9c1b-81aebd8842f2?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.27.5","to_inclusive":true,"patched_in":"5.27.6.1"}],"published":"2026-05-02T00:00:00Z","updated":"2026-05-04T14:01:17Z"},{"id":"wordfence:438e2911-7663-44fe-883f-19ad29972aac","source":"wordfence","cve":"CVE-2025-12376","title":"Icon List Block \u2013 Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438e2911-7663-44fe-883f-19ad29972aac?source=api-prod","affected":[{"type":"plugin","slug":"icon-list-block","name":"Icon List Block \u2013 Add Icon-Based Lists with Custom Styles","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-11-18T01:11:17Z","updated":"2025-11-18T13:54:50Z"},{"id":"wordfence:438e36ba-fd0e-4c98-814b-95f3d5f60d2f","source":"wordfence","cve":"CVE-2026-39542","title":"Doofinder for WooCommerce <= 2.10.13 - Unauthenticated Information Exposure","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438e36ba-fd0e-4c98-814b-95f3d5f60d2f?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"2.10.13","to_inclusive":true,"patched_in":"2.10.14"}],"published":"2026-03-13T00:00:00Z","updated":"2026-05-05T15:05:12Z"},{"id":"wordfence:438f98f7-b966-4e07-a62e-a918cce3f6c0","source":"wordfence","cve":"CVE-2015-9519","title":"Easy Digital Downloads \u2013 PDF Stamper <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438f98f7-b966-4e07-a62e-a918cce3f6c0?source=api-prod","affected":[{"type":"plugin","slug":"edd-pdf-stamper","name":"Easy Digital Downloads \u2013 PDF stamper","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:438fbd3f-052b-4a6d-acd2-233a93d56cbb","source":"wordfence","cve":"CVE-2022-43500","title":"WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/438fbd3f-052b-4a6d-acd2-233a93d56cbb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"},{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"*","from_inclusive":true,"to":"14.3.0","to_inclusive":true,"patched_in":"14.3.1"}],"published":"2022-10-18T00:00:00Z","updated":"2025-04-30T20:02:08Z"},{"id":"wordfence:439032cc-41aa-4a4b-bdd6-7febb8696b80","source":"wordfence","cve":"CVE-2025-69100","title":"North <= 5.7.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439032cc-41aa-4a4b-bdd6-7febb8696b80?source=api-prod","affected":[{"type":"theme","slug":"north-wp","name":"North - One Page Parallax WordPress Theme","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:39:13Z"},{"id":"wordfence:4391f67c-245c-40f2-90ba-fdbbc2ed818a","source":"wordfence","cve":"CVE-2026-73186","title":"Enable Media Replace <= 4.2.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4391f67c-245c-40f2-90ba-fdbbc2ed818a?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-10-30T09:31:48Z","updated":"2026-11-03T20:11:00Z"},{"id":"wordfence:4394f96a-ceb5-463f-b454-a6fa4a59fc45","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4394f96a-ceb5-463f-b454-a6fa4a59fc45?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4397c99c-c37d-43da-9285-003ba91d4003","source":"wordfence","cve":"CVE-2024-25598","title":"Livemesh Addons for Elementor <= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via animated_text_class","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4397c99c-c37d-43da-9285-003ba91d4003?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3","to_inclusive":true,"patched_in":"8.3.1"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T17:00:57Z"},{"id":"wordfence:439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a","source":"wordfence","cve":"CVE-2026-6566","title":"Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439809ad-21ea-4a0b-b1fd-5de9f8f5ee7a?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-05-19T17:01:55Z","updated":"2026-05-20T05:31:13Z"},{"id":"wordfence:4399c3b5-9bd6-4334-82fd-6afa735f89e0","source":"wordfence","cve":"CVE-2026-39466","title":"Broken Link Checker <= 2.4.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4399c3b5-9bd6-4334-82fd-6afa735f89e0?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2026-03-26T00:00:00Z","updated":"2026-04-15T21:22:49Z"},{"id":"wordfence:439b498b-9359-40fd-a37e-58ab0bce7f1c","source":"wordfence","cve":"CVE-2026-97253","title":"LayerSlider <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439b498b-9359-40fd-a37e-58ab0bce7f1c?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":"8.4.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T17:36:33Z"},{"id":"wordfence:439ce99c-79d3-4e1c-8f6e-7f68b017ac8c","source":"wordfence","cve":"CVE-2025-52800","title":"The E-Commerce ERP <= 2.1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439ce99c-79d3-4e1c-8f6e-7f68b017ac8c?source=api-prod","affected":[{"type":"plugin","slug":"profitori","name":"The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis","from":"*","from_inclusive":true,"to":"2.1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-28T21:02:06Z"},{"id":"wordfence:439e4c99-8f34-4e66-9d86-c0cbb8cf6da0","source":"wordfence","cve":"CVE-2025-13065","title":"Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439e4c99-8f34-4e66-9d86-c0cbb8cf6da0?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.4.41","to_inclusive":true,"patched_in":"4.4.42"}],"published":"2025-12-05T21:07:03Z","updated":"2025-12-06T09:25:59Z"},{"id":"wordfence:439e7c0d-e45a-44f2-9ecb-3092843f63e0","source":"wordfence","cve":"CVE-2026-54821","title":"Visual Link Preview <= 2.3.1 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439e7c0d-e45a-44f2-9ecb-3092843f63e0?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T14:10:55Z"},{"id":"wordfence:439ef0bb-cfac-4d81-b858-46a9837ad58f","source":"wordfence","cve":"CVE-2024-37553","title":"Testimonials Widget <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/439ef0bb-cfac-4d81-b858-46a9837ad58f?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-widget","name":"Testimonials Widget","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T14:03:04Z"},{"id":"wordfence:43a1e5b7-9361-406e-97b7-776b831acc33","source":"wordfence","cve":"CVE-2022-2116","title":"Contact Form DB - Elementor <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a1e5b7-9361-406e-97b7-776b831acc33?source=api-prod","affected":[{"type":"plugin","slug":"sb-elementor-contact-form-db","name":"FormsDB \u2013 Save Elementor Forms to Google Sheets & Post Type","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43a237fd-5d3a-47fb-bacf-ceb5eeaa8bbb","source":"wordfence","cve":"CVE-2025-13360","title":"Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a237fd-5d3a-47fb-bacf-ceb5eeaa8bbb?source=api-prod","affected":[{"type":"plugin","slug":"tw-image-hover-share","name":"Quantic Social Image Hover","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:30:27Z","updated":"2025-12-05T05:31:23Z"},{"id":"wordfence:43a33302-6b32-43ab-a771-37e07784f56c","source":"wordfence","cve":"CVE-2026-66577","title":"JetSearch <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a33302-6b32-43ab-a771-37e07784f56c?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.3.1"}],"published":"2026-09-17T11:54:00Z","updated":"2026-09-22T18:45:59Z"},{"id":"wordfence:43a60896-3b88-4b36-b6d9-46812b8ba35b","source":"wordfence","cve":"CVE-2020-22275","title":"Easy Registration Forms <= 2.0.6 - CSV Injection","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a60896-3b88-4b36-b6d9-46812b8ba35b?source=api-prod","affected":[{"type":"plugin","slug":"easy-registration-forms","name":"Easy Registration Forms","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2020-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43a64074-ca64-4c34-b467-06d1ad8c5aa0","source":"wordfence","cve":"CVE-2024-10961","title":"Social Login <= 5.9.0 - Authentication Bypass via Disqus OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a64074-ca64-4c34-b467-06d1ad8c5aa0?source=api-prod","affected":[{"type":"plugin","slug":"oa-social-login","name":"Social Login","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.10.0"}],"published":"2024-11-22T15:08:42Z","updated":"2025-02-19T17:40:25Z"},{"id":"wordfence:43a6bc40-fbba-4b6c-80fc-65b619f73414","source":"wordfence","cve":"CVE-2025-53427","title":"SEO Pyramid <= 1.10.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a6bc40-fbba-4b6c-80fc-65b619f73414?source=api-prod","affected":[{"type":"plugin","slug":"seo-pyramid","name":"SEO Pyramid","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-20T00:00:00Z","updated":"2026-08-14T15:15:18Z"},{"id":"wordfence:43a7f1b0-c2c0-4832-9819-22625c8b727e","source":"wordfence","cve":"CVE-2024-5522","title":"HTML5 Video Player <= 2.5.26 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43a7f1b0-c2c0-4832-9819-22625c8b727e?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.26","to_inclusive":true,"patched_in":"2.5.27"}],"published":"2024-05-30T00:00:00Z","updated":"2024-05-30T20:37:41Z"},{"id":"wordfence:43aa28ec-6553-4527-a1d1-eb4a58533c5d","source":"wordfence","cve":"CVE-2024-6480","title":"SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43aa28ec-6553-4527-a1d1-eb4a58533c5d?source=api-prod","affected":[{"type":"plugin","slug":"sip-reviews-shortcode-woocommerce","name":"SIP Reviews Shortcode for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-31T00:00:00Z","updated":"2025-12-09T17:07:16Z"},{"id":"wordfence:43adc9dd-1780-440f-90c2-ff05a22eb084","source":"wordfence","cve":"CVE-2024-7856","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43adc9dd-1780-440f-90c2-ff05a22eb084?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.7.0.1","to_inclusive":true,"patched_in":"5.7.1"}],"published":"2024-08-28T00:00:00Z","updated":"2024-10-24T18:50:53Z"},{"id":"wordfence:43af2d38-72e8-405f-a910-500fb782ded2","source":"wordfence","cve":"CVE-2026-9723","title":"Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43af2d38-72e8-405f-a910-500fb782ded2?source=api-prod","affected":[{"type":"plugin","slug":"google-plus-one-bottom","name":"Google Plus One Bottom","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:43:50Z","updated":"2026-06-02T07:48:29Z"},{"id":"wordfence:43b04825-d1c6-4e2a-9035-1f4fbfe14818","source":"wordfence","cve":"CVE-2025-11920","title":"WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b04825-d1c6-4e2a-9035-1f4fbfe14818?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.14","to_inclusive":true,"patched_in":"1.7.15"}],"published":"2025-10-31T13:35:09Z","updated":"2025-11-01T01:47:42Z"},{"id":"wordfence:43b05697-bc36-4f32-86b4-2feef892fe42","source":"wordfence","cve":"CVE-2025-12361","title":"myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b05697-bc36-4f32-86b4-2feef892fe42?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.7.1","to_inclusive":true,"patched_in":"2.9.7.2"}],"published":"2025-12-18T20:25:10Z","updated":"2025-12-19T09:30:00Z"},{"id":"wordfence:43b0cb21-ba81-4d54-90d1-a2f25297e719","source":"wordfence","cve":"","title":"Profile Extra Fields by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b0cb21-ba81-4d54-90d1-a2f25297e719?source=api-prod","affected":[{"type":"plugin","slug":"profile-extra-fields","name":"Profile Extra Fields by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43b11ab0-c7f2-4a7a-aab7-7f9dd58ec1ab","source":"wordfence","cve":"CVE-2023-39313","title":"Avada <= 7.11.1 - Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b11ab0-c7f2-4a7a-aab7-7f9dd58ec1ab?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.1","to_inclusive":true,"patched_in":"7.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43b43802-f301-4748-98b9-eea78a249355","source":"wordfence","cve":"CVE-2023-0728","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b43802-f301-4748-98b9-eea78a249355?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43b59e94-047e-4bdf-abe1-538f2f043ffe","source":"wordfence","cve":"CVE-2025-1446","title":"Pods \u2013 Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b59e94-047e-4bdf-abe1-538f2f043ffe?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.2.8.1","to_inclusive":true,"patched_in":"3.2.8.2"}],"published":"2025-03-02T00:00:00Z","updated":"2025-04-07T20:25:11Z"},{"id":"wordfence:43b5a321-c82e-4d0b-9def-b74c3cf439d3","source":"wordfence","cve":"CVE-2018-6943","title":"Ultimate Member <= 2.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b5a321-c82e-4d0b-9def-b74c3cf439d3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2018-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43b72542-623f-4ecf-892b-273cb6a8d6cf","source":"wordfence","cve":"CVE-2025-58642","title":"LTL Freight Quotes \u2013 Day & Ross Edition <= 2.1.11 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b72542-623f-4ecf-892b-273cb6a8d6cf?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-day-ross-edition","name":"LTL Freight Quotes \u2013 Day & Ross Edition","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.1.12"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:35:17Z"},{"id":"wordfence:43b7e458-73d7-4a02-8184-081654a9f58e","source":"wordfence","cve":"CVE-2025-23921","title":"Multi Uploader for Gravity Forms <= 1.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43b7e458-73d7-4a02-8184-081654a9f58e?source=api-prod","affected":[{"type":"plugin","slug":"gf-multi-uploader","name":"Multi Uploader for Gravity Forms","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-17T13:22:30Z"},{"id":"wordfence:43bb402e-4c61-4d1c-9992-528642372629","source":"wordfence","cve":"CVE-2024-56287","title":"WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43bb402e-4c61-4d1c-9992-528642372629?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-datatable","name":"WP jQuery DataTable","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:24:28Z"},{"id":"wordfence:43bc48a5-d97c-48ad-a80d-07f327ee859b","source":"wordfence","cve":"CVE-2024-51899","title":"Simple Pricing Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43bc48a5-d97c-48ad-a80d-07f327ee859b?source=api-prod","affected":[{"type":"plugin","slug":"simple-pricing-table","name":"Simple Pricing Table","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-14T00:00:00Z","updated":"2024-11-14T14:07:48Z"},{"id":"wordfence:43bcf3ab-4201-4a61-82c5-2dc60b684989","source":"wordfence","cve":"CVE-2022-4030","title":"Simple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43bcf3ab-4201-4a61-82c5-2dc60b684989?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43c44e1a-3b53-44e9-8233-2a4dbea4fa12","source":"wordfence","cve":"CVE-2026-85680","title":"Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c44e1a-3b53-44e9-8233-2a4dbea4fa12?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:56:33Z"},{"id":"wordfence:43c4ca71-0bf0-4529-97d9-2349f96bbb9e","source":"wordfence","cve":"CVE-2024-1400","title":"Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c4ca71-0bf0-4529-97d9-2349f96bbb9e?source=api-prod","affected":[{"type":"plugin","slug":"mollie-forms","name":"Mollie Forms","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-11T21:30:58Z"},{"id":"wordfence:43c66948-c751-45d5-a413-a606f96dcd09","source":"wordfence","cve":"CVE-2025-39427","title":"WP Post to PDF Enhanced <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c66948-c751-45d5-a413-a606f96dcd09?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-to-pdf-enhanced","name":"WP Post to PDF Enhanced","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:25:56Z"},{"id":"wordfence:43c7056e-39d8-467e-92ec-33a31e5dafc9","source":"wordfence","cve":"CVE-2024-11585","title":"WP Hide & Security Enhancer <= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c7056e-39d8-467e-92ec-33a31e5dafc9?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-security-enhancer","name":"WP Hide & Security Enhancer","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2024-12-05T16:25:18Z","updated":"2024-12-06T05:30:44Z"},{"id":"wordfence:43c781c3-dc3e-4258-b594-689d0035cab0","source":"wordfence","cve":"CVE-2014-9034","title":"WordPress Core < 4.0.1  - Denial of Service via Long Password","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c781c3-dc3e-4258-b594-689d0035cab0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43c9b6f2-2b72-4326-8080-f41606c0880c","source":"wordfence","cve":"CVE-2022-25611","title":"Simple Event Planner <= 1.5.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9b6f2-2b72-4326-8080-f41606c0880c?source=api-prod","affected":[{"type":"plugin","slug":"simple-event-planner","name":"Simple Event Planner","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2022-03-23T10:38:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43c9dcec-f769-4c55-93d0-c2aa45a4fa16","source":"wordfence","cve":"CVE-2022-4698","title":"ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9dcec-f769-4c55-93d0-c2aa45a4fa16?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43ca1393-637d-48e2-84f3-a06a4f0d83d1","source":"wordfence","cve":"CVE-2025-11890","title":"Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ca1393-637d-48e2-84f3-a06a4f0d83d1?source=api-prod","affected":[{"type":"plugin","slug":"crypto-payment-gateway-with-payeer-for-woocommerce","name":"Crypto Payment Gateway with Payeer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:59:31Z","updated":"2025-11-04T04:27:18Z"},{"id":"wordfence:43ca15b7-8cb4-427f-892d-15022da17b2e","source":"wordfence","cve":"CVE-2024-13388","title":"TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ca15b7-8cb4-427f-892d-15022da17b2e?source=api-prod","affected":[{"type":"plugin","slug":"tcbd-tooltip","name":"TCBD Tooltip","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T15:04:02Z","updated":"2025-02-21T03:21:21Z"},{"id":"wordfence:43cb0399-4add-43d5-863c-30e11803bd90","source":"wordfence","cve":"CVE-2024-11024","title":"AppPresser \u2013 Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43cb0399-4add-43d5-863c-30e11803bd90?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T11:04:34Z"},{"id":"wordfence:43cc1dfa-4419-4958-bb26-a554cf2ad06c","source":"wordfence","cve":"CVE-2024-12321","title":"WC Affiliate <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43cc1dfa-4419-4958-bb26-a554cf2ad06c?source=api-prod","affected":[{"type":"plugin","slug":"wc-affiliate","name":"WC Affiliate \u2013 WooCommerce Affiliate Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-30T14:39:56Z"},{"id":"wordfence:43d01824-507d-4d26-af88-9ea5b4c1b108","source":"wordfence","cve":"CVE-2025-24742","title":"WP Go Maps <= 9.0.40 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d01824-507d-4d26-af88-9ea5b4c1b108?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.40","to_inclusive":true,"patched_in":"9.0.41"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:26:59Z"},{"id":"wordfence:43d0fe39-595c-4805-949c-6fa1930f14a7","source":"wordfence","cve":"CVE-2026-57333","title":"Link Whisper Free <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d0fe39-595c-4805-949c-6fa1930f14a7?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:11:06Z"},{"id":"wordfence:43d1264a-2265-4423-a643-7ef6436d3764","source":"wordfence","cve":"CVE-2025-11738","title":"Media Library Assistant <= 3.29 - Unauthenticated Limited File Read","severity":"medium","cvss":5.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d1264a-2265-4423-a643-7ef6436d3764?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.29","to_inclusive":true,"patched_in":"3.30"}],"published":"2025-10-17T17:26:53Z","updated":"2025-10-18T05:41:56Z"},{"id":"wordfence:43d141e3-1e62-4126-b914-bdc98577de3f","source":"wordfence","cve":"CVE-2022-36355","title":"Easy Org Chart <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d141e3-1e62-4126-b914-bdc98577de3f?source=api-prod","affected":[{"type":"plugin","slug":"easy-org-chart","name":"Easy Org Chart","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43d1f708-58bd-4d42-b8dd-0c1247546577","source":"wordfence","cve":"","title":"Floating Social Media Links < 1.4.3 - Remote File Inclusion via fsml-hideshow.js.php wpp parameter","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d1f708-58bd-4d42-b8dd-0c1247546577?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-media-links","name":"Floating Social Media Links","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2012-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43d24ac2-c3b9-4e5e-9b58-c99bacc56495","source":"wordfence","cve":"CVE-2025-64290","title":"Premmerce Product Search for WooCommerce <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d24ac2-c3b9-4e5e-9b58-c99bacc56495?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-search","name":"Premmerce Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-05-10T00:00:00Z","updated":"2026-02-26T15:07:44Z"},{"id":"wordfence:43d31d1e-0f4f-4f51-8274-650151642d03","source":"wordfence","cve":"CVE-2026-5207","title":"LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d31d1e-0f4f-4f51-8274-650151642d03?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"9.2.1","to_inclusive":true,"patched_in":"9.2.2"}],"published":"2026-04-10T12:55:22Z","updated":"2026-04-11T01:24:58Z"},{"id":"wordfence:43d46ada-4cbf-40e4-a0e5-685d8bf1a8a5","source":"wordfence","cve":"CVE-2010-0682","title":"WordPress Core < 2.9.2 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d46ada-4cbf-40e4-a0e5-685d8bf1a8a5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":false,"patched_in":"2.9.2"}],"published":"2010-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43d534f8-fb1c-4170-a66e-2cef72cd40de","source":"wordfence","cve":"CVE-2023-29431","title":"qTranslate X Cleanup and WPML Import <= 3.0.1 - Cross-Site Request Forgery via clean_ajx","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d534f8-fb1c-4170-a66e-2cef72cd40de?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-to-wpml-export","name":"qTranslate X Cleanup and WPML Import","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-04-06T00:00:00Z","updated":"2024-10-15T18:48:10Z"},{"id":"wordfence:43d54cb5-7813-4d30-a081-db84e0d29030","source":"wordfence","cve":"CVE-2026-9738","title":"Print, PDF, Email by PrintFriendly <= 5.5.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'content_position_css' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d54cb5-7813-4d30-a081-db84e0d29030?source=api-prod","affected":[{"type":"plugin","slug":"printfriendly","name":"Print, PDF & Email by PrintFriendly","from":"*","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"5.5.11"}],"published":"2026-07-10T14:46:19Z","updated":"2026-07-11T03:44:22Z"},{"id":"wordfence:43d6a396-87e1-45c9-af99-226f1bb99e8d","source":"wordfence","cve":"CVE-2026-11570","title":"User Submitted Posts <= 20260607 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d6a396-87e1-45c9-af99-226f1bb99e8d?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20260607","to_inclusive":true,"patched_in":"20260608"}],"published":"2026-06-10T00:00:00Z","updated":"2026-09-18T14:55:43Z"},{"id":"wordfence:43d8576b-e6ad-4e0a-b99f-948ba36f53ff","source":"wordfence","cve":"CVE-2025-13629","title":"WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8576b-e6ad-4e0a-b99f-948ba36f53ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-landing-page","name":"WP Landing Page","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:38:17Z","updated":"2025-12-06T05:49:26Z"},{"id":"wordfence:43d8904f-3bc9-4c67-b44b-8d78762b6b30","source":"wordfence","cve":"CVE-2024-0680","title":"WP Private Content Plus <= 3.6 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-02-27T00:00:00Z","updated":"2024-12-05T19:31:30Z"},{"id":"wordfence:43d95d12-8bce-48f7-a999-e883a793f5a2","source":"wordfence","cve":"CVE-2026-89288","title":"Fast Courier \u2013 Shipping & Freight 5.0.0 - 5.2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43d95d12-8bce-48f7-a999-e883a793f5a2?source=api-prod","affected":[{"type":"plugin","slug":"fast-courier-shipping-freight","name":"Fast Courier \u2013 Shipping & Freight","from":"5.0.0","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:22:58Z"},{"id":"wordfence:43daaaf7-8086-448a-be99-ee1959ef0fb4","source":"wordfence","cve":"CVE-2024-37470","title":"Woffice Core <= 5.4.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43daaaf7-8086-448a-be99-ee1959ef0fb4?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:20:38Z"},{"id":"wordfence:43df6d4d-960e-4eb7-809b-684ba0d67f58","source":"wordfence","cve":"CVE-2021-24681","title":"Duplicate Page <= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43df6d4d-960e-4eb7-809b-684ba0d67f58?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-page","name":"Duplicate Page","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2021-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43e50125-1cf6-4039-a385-1f52b62bad33","source":"wordfence","cve":"CVE-2024-8243","title":"WordPress/Plugin Upgrade Time Out Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43e50125-1cf6-4039-a385-1f52b62bad33?source=api-prod","affected":[{"type":"plugin","slug":"wordpressplugin-upgrade-time-out-plugin","name":"WordPress/Plugin Upgrade Time Out Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-04-22T20:26:43Z"},{"id":"wordfence:43e52adf-387c-452d-96b4-aad459fa75b3","source":"wordfence","cve":"CVE-2026-1853","title":"BuddyHolis ListSearch <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43e52adf-387c-452d-96b4-aad459fa75b3?source=api-prod","affected":[{"type":"plugin","slug":"listsearch","name":"BuddyHolis ListSearch","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:10:12Z","updated":"2026-02-11T08:26:25Z"},{"id":"wordfence:43e72eef-4e66-4789-959b-163c9cbea584","source":"wordfence","cve":"CVE-2015-9327","title":"Flickr Justified Gallery < 3.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43e72eef-4e66-4789-959b-163c9cbea584?source=api-prod","affected":[{"type":"plugin","slug":"flickr-justified-gallery","name":"Flickr Justified Gallery","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":false,"patched_in":"3.4.0"}],"published":"2015-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43e7b61e-f97a-4889-aae4-3d35ee0c5241","source":"wordfence","cve":"CVE-2025-64254","title":"Photo Block <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43e7b61e-f97a-4889-aae4-3d35ee0c5241?source=api-prod","affected":[{"type":"plugin","slug":"photo-block","name":"Photo Block \u2013 A Modern Image Block With Lightbox and Caption Support","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:31:51Z"},{"id":"wordfence:43ea0665-2c6e-4c78-8bc5-056f47f190ab","source":"wordfence","cve":"CVE-2023-46075","title":"Contact Form Builder, Contact Widget <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ea0665-2c6e-4c78-8bc5-056f47f190ab?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-builder","name":"Contact Form Builder, Contact Widget","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43ec4320-3b2b-49b8-acd2-833ea999efa0","source":"wordfence","cve":"CVE-2025-32121","title":"Video & Photo Gallery for Ultimate Member <= 1.1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ec4320-3b2b-49b8-acd2-833ea999efa0?source=api-prod","affected":[{"type":"plugin","slug":"gallery-for-ultimate-member","name":"Video & Photo Gallery for Ultimate Member","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-11-09T14:00:13Z"},{"id":"wordfence:43ec70b1-dfb7-4218-93cc-7d491e407e39","source":"wordfence","cve":"CVE-2026-28105","title":"Good Energy <= 1.7.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ec70b1-dfb7-4218-93cc-7d491e407e39?source=api-prod","affected":[{"type":"theme","slug":"goodenergy","name":"Good Energy - Ecology & Renewable Energy WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:12:12Z"},{"id":"wordfence:43ede544-2c83-4ff7-a0d0-78d9cbbd86d3","source":"wordfence","cve":"CVE-2025-46516","title":"Twitter Card Generator <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43ede544-2c83-4ff7-a0d0-78d9cbbd86d3?source=api-prod","affected":[{"type":"plugin","slug":"twitter-card-generator","name":"Twitter Card Generator","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:19:23Z"},{"id":"wordfence:43f1a954-df53-46c6-9ecf-5fd50f490cfb","source":"wordfence","cve":"CVE-2025-48354","title":"Better Post & Filter Widgets for Elementor <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f1a954-df53-46c6-9ecf-5fd50f490cfb?source=api-prod","affected":[{"type":"plugin","slug":"better-post-filter-widgets-for-elementor","name":"Better Post & Filter Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-08-21T00:00:00Z","updated":"2025-10-08T21:04:17Z"},{"id":"wordfence:43f2c020-a531-4e25-948e-372bc7af3bab","source":"wordfence","cve":"CVE-2023-23733","title":"Lazy Social Comments <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f2c020-a531-4e25-948e-372bc7af3bab?source=api-prod","affected":[{"type":"plugin","slug":"lazy-facebook-comments","name":"Lazy Social Comments","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43f2c4e5-c19d-4b7c-849b-47052bb62cb5","source":"wordfence","cve":"CVE-2025-10249","title":"Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f2c4e5-c19d-4b7c-849b-47052bb62cb5?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.37","to_inclusive":true,"patched_in":"6.7.38"}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-09T11:20:57Z"},{"id":"wordfence:43f34d3b-ed55-48d1-9074-b33f166e333e","source":"wordfence","cve":"CVE-2025-24582","title":"12 Step Meeting List <= 3.16.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f34d3b-ed55-48d1-9074-b33f166e333e?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.16.5","to_inclusive":true,"patched_in":"3.16.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:11:25Z"},{"id":"wordfence:43f38a87-ac2c-4b5a-9559-d529c4b2799c","source":"wordfence","cve":"CVE-2021-24695","title":"Simple Download Monitor <= 3.9.5 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f38a87-ac2c-4b5a-9559-d529c4b2799c?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":false,"patched_in":"3.9.6"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43f6a5c2-3de0-4990-89ad-64e5d866345a","source":"wordfence","cve":"CVE-2021-24612","title":"Sociable <= 4.3.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f6a5c2-3de0-4990-89ad-64e5d866345a?source=api-prod","affected":[{"type":"plugin","slug":"sociable","name":"Sociable","from":"*","from_inclusive":true,"to":"4.3.4.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43f976ee-cba7-4f5d-b9c6-a6f66c0011d2","source":"wordfence","cve":"CVE-2023-4724","title":"Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Authenticated (Admin+) Remote Code Execution","severity":"medium","cvss":6.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43f976ee-cba7-4f5d-b9c6-a6f66c0011d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"},{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43fbc5df-dd8c-4a1d-92e9-5f3881cfb2e0","source":"wordfence","cve":"CVE-2026-81648","title":"CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43fbc5df-dd8c-4a1d-92e9-5f3881cfb2e0?source=api-prod","affected":[{"type":"plugin","slug":"cryptopayment-gateway","name":"CryptoPayment Gateway","from":"1.2.1","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:18:03Z"},{"id":"wordfence:43fc4752-7a47-480c-82e2-54821e754f7f","source":"wordfence","cve":"CVE-2024-33643","title":"Advanced Most Recent Posts Mod <= 1.6.5.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43fc4752-7a47-480c-82e2-54821e754f7f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-most-recent-posts-mod","name":"Advanced Most Recent Posts Mod","from":"*","from_inclusive":true,"to":"1.6.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:31:49Z"},{"id":"wordfence:43fc47ca-15ca-4817-b1b8-389245725e73","source":"wordfence","cve":"CVE-2024-1850","title":"AI Post Generator | AutoWriter <= 3.3 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43fc47ca-15ca-4817-b1b8-389245725e73?source=api-prod","affected":[{"type":"plugin","slug":"ai-post-generator","name":"AI Post Generator | AutoWriter","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-03-21T00:00:00Z","updated":"2024-04-29T14:26:55Z"},{"id":"wordfence:43fc71bb-87ba-4cf9-ae4d-1cba7bd84806","source":"wordfence","cve":"CVE-2023-1087","title":"WC Sales Notification <= 1.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43fc71bb-87ba-4cf9-ae4d-1cba7bd84806?source=api-prod","affected":[{"type":"plugin","slug":"wc-sales-notification","name":"WC Sales Notification","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:43fd1949-2682-469b-a129-223ebecc312e","source":"wordfence","cve":"CVE-2024-54311","title":"Mark New Posts <= 7.5.1 - Missing Authorization via save_options","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/43fd1949-2682-469b-a129-223ebecc312e?source=api-prod","affected":[{"type":"plugin","slug":"mark-new-posts","name":"Mark New Posts","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:56:14Z"},{"id":"wordfence:4401cb36-a42f-4dfc-8992-ebb9d3002579","source":"wordfence","cve":"CVE-2025-30902","title":"AEC Kiosque <= 1.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4401cb36-a42f-4dfc-8992-ebb9d3002579?source=api-prod","affected":[{"type":"plugin","slug":"aec-kiosque","name":"AEC Kiosque","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:25:55Z"},{"id":"wordfence:440242e5-832f-4796-9317-b377e1c2fa2a","source":"wordfence","cve":"CVE-2020-35946","title":"All in One SEO Pack <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/440242e5-832f-4796-9317-b377e1c2fa2a?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":false,"patched_in":"3.6.2"}],"published":"2020-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4402fb12-326b-4332-83e6-493a65743c61","source":"wordfence","cve":"CVE-2025-53211","title":"Audio Editor &amp; Recorder <= 2.2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4402fb12-326b-4332-83e6-493a65743c61?source=api-prod","affected":[{"type":"plugin","slug":"audio-editor-recorder","name":"Audio Editor & Recorder","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:49:40Z"},{"id":"wordfence:4403fbe3-965b-4eb9-976f-efbfbf99b2e8","source":"wordfence","cve":"CVE-2025-32152","title":"Slider a SlidersPack <= 2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4403fbe3-965b-4eb9-976f-efbfbf99b2e8?source=api-prod","affected":[{"type":"plugin","slug":"sliderspack-all-in-one-image-sliders","name":"Slider a SlidersPack \u2013 Image Slider, Post Slider, ACF Gallery Slider","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-08T18:15:53Z"},{"id":"wordfence:440664ef-39c6-4b4b-99af-b9e6c9868a99","source":"wordfence","cve":"CVE-2024-43921","title":"Magic Post Thumbnail <= 5.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/440664ef-39c6-4b4b-99af-b9e6c9868a99?source=api-prod","affected":[{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"*","from_inclusive":true,"to":"5.2.9","to_inclusive":true,"patched_in":"5.2.10"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:05:47Z"},{"id":"wordfence:440e2618-5b45-4bad-8a97-2fb1a6e991ea","source":"wordfence","cve":"CVE-2023-7236","title":"Backup Bolt <= 1.3.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/440e2618-5b45-4bad-8a97-2fb1a6e991ea?source=api-prod","affected":[{"type":"plugin","slug":"backup-bolt","name":"Backup Bolt \u2013 Lightweight Backup, Fast WordPress Backup to ZIP","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-02-20T00:00:00Z","updated":"2024-03-11T09:05:52Z"},{"id":"wordfence:440e34a2-0185-4294-b82d-a0249769731e","source":"wordfence","cve":"CVE-2025-26900","title":"Flexmls\u00ae IDX <= 3.14.27 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/440e34a2-0185-4294-b82d-a0249769731e?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.14.27","to_inclusive":true,"patched_in":"3.14.28"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T20:34:14Z"},{"id":"wordfence:440ff558-d304-4c2e-b9e2-988b31dcbcb6","source":"wordfence","cve":"CVE-2026-4069","title":"Alfie \u2013 Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/440ff558-d304-4c2e-b9e2-988b31dcbcb6?source=api-prod","affected":[{"type":"plugin","slug":"alfie-the-productfeedtool-wp-plugin","name":"Alfie \u2013 Feed Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:56Z","updated":"2026-03-21T03:26:43Z"},{"id":"wordfence:44132f7b-31d4-46e9-8441-e27f0f4c5789","source":"wordfence","cve":"CVE-2026-32450","title":"Active Products Tables for WooCommerce. Use constructor to create tables\u00a0 <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44132f7b-31d4-46e9-8441-e27f0f4c5789?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:15:29Z"},{"id":"wordfence:4414cabb-765d-4ba9-be7a-acaf9ea6e45f","source":"wordfence","cve":"CVE-2026-54198","title":"Media Library Assistant <= 3.35 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4414cabb-765d-4ba9-be7a-acaf9ea6e45f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:00:32Z"},{"id":"wordfence:44158748-798e-4b17-9deb-f54520779c62","source":"wordfence","cve":"CVE-2018-16308","title":"Ninja Forms Contact Form <= 3.3.13 - CSV Injection","severity":"high","cvss":8.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44158748-798e-4b17-9deb-f54520779c62?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.13","to_inclusive":true,"patched_in":"3.3.14"}],"published":"2018-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4419a302-4305-44f8-a256-dd276b5cd751","source":"wordfence","cve":"CVE-2020-36702","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization","severity":"medium","cvss":5.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4419a302-4305-44f8-a256-dd276b5cd751?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.14.7","to_inclusive":true,"patched_in":"1.14.8"}],"published":"2020-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4419dc63-24bc-41b1-bea6-6426b6f10577","source":"wordfence","cve":"CVE-2023-37986","title":"YourMembership Single Sign On <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4419dc63-24bc-41b1-bea6-6426b6f10577?source=api-prod","affected":[{"type":"plugin","slug":"login-with-yourmembership","name":"Login with YourMembership \u2013 YM SSO Login","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4419f975-fb8d-4603-9e16-122fbd7cfdae","source":"wordfence","cve":"CVE-2026-57406","title":"FundEngine \u2013 Donation and Crowdfunding Platform <= 1.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4419f975-fb8d-4603-9e16-122fbd7cfdae?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:42:40Z"},{"id":"wordfence:441a2519-9d24-4427-b109-ecd953fdbc93","source":"wordfence","cve":"CVE-2025-68036","title":"CubeWP <= 1.1.27 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/441a2519-9d24-4427-b109-ecd953fdbc93?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T21:36:39Z"},{"id":"wordfence:441a97ff-cf87-44bd-a84a-d6b889c37104","source":"wordfence","cve":"CVE-2025-68849","title":"Quote Master <= 7.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/441a97ff-cf87-44bd-a84a-d6b889c37104?source=api-prod","affected":[{"type":"plugin","slug":"quote-master","name":"Quote Master","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:53:24Z"},{"id":"wordfence:441bc9fe-3dd6-40a6-b7f3-36511115c083","source":"wordfence","cve":"CVE-2023-47786","title":"LayerSlider <= 7.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/441bc9fe-3dd6-40a6-b7f3-36511115c083?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"7.7.9","to_inclusive":true,"patched_in":"7.7.10"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:441d825d-0e6b-448e-8e12-58d5324c48e9","source":"wordfence","cve":"CVE-2026-93774","title":"WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/441d825d-0e6b-448e-8e12-58d5324c48e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.02.002","to_inclusive":true,"patched_in":"9.3.02.003"}],"published":"2026-09-23T11:31:04Z","updated":"2026-09-29T20:03:55Z"},{"id":"wordfence:441f5764-eab6-40fe-80cd-65da327b39b2","source":"wordfence","cve":"","title":"Newspaper <= 10.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/441f5764-eab6-40fe-80cd-65da327b39b2?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"10.3.3","to_inclusive":true,"patched_in":"10.3.4"}],"published":"2020-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44209ff3-bccb-4bf6-b36b-c691404b236d","source":"wordfence","cve":"CVE-2025-23595","title":"Page Health-O-Meter <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44209ff3-bccb-4bf6-b36b-c691404b236d?source=api-prod","affected":[{"type":"plugin","slug":"page-health-o-meter","name":"Page Health-O-Meter","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T20:57:41Z"},{"id":"wordfence:4420c334-1ea4-4549-b391-150702abc2f8","source":"wordfence","cve":"CVE-2024-1044","title":"Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4420c334-1ea4-4549-b391-150702abc2f8?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.38.12","to_inclusive":true,"patched_in":"5.39.0"}],"published":"2024-02-06T00:00:00Z","updated":"2024-07-31T15:39:24Z"},{"id":"wordfence:44210443-26f8-4626-aee2-4a19d87fdd43","source":"wordfence","cve":"CVE-2018-5287","title":"GD Rating System <= 2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44210443-26f8-4626-aee2-4a19d87fdd43?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:442252f8-2896-44ba-a19c-d153b03b268b","source":"wordfence","cve":"CVE-2019-15779","title":"Social Feed Gallery <= 2.4.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442252f8-2896-44ba-a19c-d153b03b268b?source=api-prod","affected":[{"type":"plugin","slug":"insta-gallery","name":"Social Feed Gallery","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":false,"patched_in":"2.4.8"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:442403ae-9011-4373-a363-e98e07ec7e9b","source":"wordfence","cve":"CVE-2026-116522","title":"Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442403ae-9011-4373-a363-e98e07ec7e9b?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.28.5","to_inclusive":true,"patched_in":"4.28.6"}],"published":"2026-10-30T17:40:04Z","updated":"2026-10-31T06:44:17Z"},{"id":"wordfence:4424b889-fade-4ddd-85e9-812752a2552d","source":"wordfence","cve":"CVE-2026-24999","title":"Alma <= 5.16.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4424b889-fade-4ddd-85e9-812752a2552d?source=api-prod","affected":[{"type":"plugin","slug":"alma-gateway-for-woocommerce","name":"Alma \u2013 Pay in installments or later for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":true,"patched_in":"5.16.2"}],"published":"2026-01-14T00:00:00Z","updated":"2026-05-04T15:04:04Z"},{"id":"wordfence:442551ba-409d-4b46-bdba-111a8df00a47","source":"wordfence","cve":"CVE-2022-3605","title":"WP CSV Exporter <= 1.3.6 - CSV Injection","severity":"high","cvss":7.7,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442551ba-409d-4b46-bdba-111a8df00a47?source=api-prod","affected":[{"type":"plugin","slug":"wp-csv-exporter","name":"WP CSV Exporter","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4425f63e-2910-4d1c-9f99-0c24fb3350d2","source":"wordfence","cve":"CVE-2026-18200","title":"FoodBoxBooker <= 1.0.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4425f63e-2910-4d1c-9f99-0c24fb3350d2?source=api-prod","affected":[{"type":"plugin","slug":"foodboxbooker","name":"FoodBoxBooker","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-21T15:33:18Z"},{"id":"wordfence:44276b28-9509-4f59-936c-fff2ae404076","source":"wordfence","cve":"CVE-2026-2479","title":"Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-02-24T20:06:06Z","updated":"2026-02-25T08:25:32Z"},{"id":"wordfence:44287d9f-93db-417c-bf88-6785e4ce3a9c","source":"wordfence","cve":"CVE-2023-23640","title":"MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44287d9f-93db-417c-bf88-6785e4ce3a9c?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-updraftplus-extension","name":"MainWP UpdraftPlus Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:442995ed-bf92-4fa7-a0a2-341cb87d8fbb","source":"wordfence","cve":"CVE-2026-32411","title":"Embed Calendly <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442995ed-bf92-4fa7-a0a2-341cb87d8fbb?source=api-prod","affected":[{"type":"plugin","slug":"embed-calendly-scheduling","name":"EMC \u2013 Embed Calendly Scheduling With Ease","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2026-02-24T00:00:00Z","updated":"2026-04-15T21:00:00Z"},{"id":"wordfence:442a2c92-0af1-4dd8-bc03-9c391309b926","source":"wordfence","cve":"CVE-2024-6498","title":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f <= 2.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442a2c92-0af1-4dd8-bc03-9c391309b926?source=api-prod","affected":[{"type":"plugin","slug":"collectchat","name":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-09T20:50:20Z"},{"id":"wordfence:442a8f8e-319e-4ae5-8c7f-2bcdcf542158","source":"wordfence","cve":"CVE-2025-64213","title":"MasterStudy LMS Pro < 4.7.16 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442a8f8e-319e-4ae5-8c7f-2bcdcf542158?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.16","to_inclusive":false,"patched_in":"4.7.16"}],"published":"2025-10-12T00:00:00Z","updated":"2025-12-20T19:04:21Z"},{"id":"wordfence:442ea621-3af4-4aae-8cde-6078e01edf43","source":"wordfence","cve":"CVE-2019-25779","title":"Diarise <= 1.5.9 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/442ea621-3af4-4aae-8cde-6078e01edf43?source=api-prod","affected":[{"type":"theme","slug":"diarise","name":"diarise","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2019-05-11T00:00:00Z","updated":"2026-10-28T14:56:32Z"},{"id":"wordfence:44362245-a3af-46a5-b35b-eabd5f537fca","source":"wordfence","cve":"CVE-2025-9876","title":"Ird Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44362245-a3af-46a5-b35b-eabd5f537fca?source=api-prod","affected":[{"type":"plugin","slug":"ird-slider","name":"Ird Slider","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:18:39Z","updated":"2025-10-03T11:17:11Z"},{"id":"wordfence:44370988-3c55-490e-b428-da9cb6df1a4b","source":"wordfence","cve":"CVE-2022-4834","title":"CPT Bootstrap Carousel <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44370988-3c55-490e-b428-da9cb6df1a4b?source=api-prod","affected":[{"type":"plugin","slug":"cpt-bootstrap-carousel","name":"CPT Bootstrap Carousel","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44373541-adc5-4aa0-abde-0693f2760afb","source":"wordfence","cve":"CVE-2023-25045","title":"RSVPMaker <= 9.9.3 - Authenticated (Admin+) SQL Injection via $email value","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44373541-adc5-4aa0-abde-0693f2760afb?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"9.9.3","to_inclusive":true,"patched_in":"9.9.4"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:443a4afc-5dfc-499c-8701-249c71215b5a","source":"wordfence","cve":"CVE-2023-0067","title":"Timed Content <= 2.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443a4afc-5dfc-499c-8701-249c71215b5a?source=api-prod","affected":[{"type":"plugin","slug":"timed-content","name":"Timed Content","from":"*","from_inclusive":true,"to":"2.72","to_inclusive":true,"patched_in":"2.73"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:443bae1e-21a0-44b3-bda0-a189f5c69a16","source":"wordfence","cve":"CVE-2015-4039","title":"WP Membership <= 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443bae1e-21a0-44b3-bda0-a189f5c69a16?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2015-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:443c314f-c767-4169-bfdd-5d6c2d61dd39","source":"wordfence","cve":"CVE-2024-50540","title":"(dp) AddThis <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443c314f-c767-4169-bfdd-5d6c2d61dd39?source=api-prod","affected":[{"type":"plugin","slug":"dp-addthis","name":"(dp) AddThis","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:37:46Z"},{"id":"wordfence:443c57bf-2f3d-4b8f-9dae-b11142a74341","source":"wordfence","cve":"CVE-2024-8788","title":"EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443c57bf-2f3d-4b8f-9dae-b11142a74341?source=api-prod","affected":[{"type":"plugin","slug":"eu-vat-for-woocommerce","name":"EU/UK VAT Validation Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.12.12","to_inclusive":true,"patched_in":"2.12.14"}],"published":"2024-09-27T00:00:00Z","updated":"2024-09-28T02:04:25Z"},{"id":"wordfence:443c59b9-275d-4d17-a870-9ae013c1a5c1","source":"wordfence","cve":"CVE-2023-47840","title":"Qode Essential Addons  <= 1.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443c59b9-275d-4d17-a870-9ae013c1a5c1?source=api-prod","affected":[{"type":"plugin","slug":"qode-essential-addons","name":"Qode Essential Addons","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:443ceb13-bc6e-4d8d-a415-1a0d4fecf38e","source":"wordfence","cve":"CVE-2022-4508","title":"ConvertKit <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443ceb13-bc6e-4d8d-a415-1a0d4fecf38e?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:443cfb7b-4566-4a71-ac31-5a5361c58aa2","source":"wordfence","cve":"CVE-2024-11746","title":"Discover the Best Woocommerce Product Brands Plugin for WordPress \u2013 Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443cfb7b-4566-4a71-ac31-5a5361c58aa2?source=api-prod","affected":[{"type":"plugin","slug":"gs-woo-brands","name":"GS Brands for WooCommerce \u2013 Product Brands, Brand Logos & Brand Slider","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:15Z"},{"id":"wordfence:443d2e80-31db-40ac-9c35-88eec841ebba","source":"wordfence","cve":"CVE-2024-8721","title":"Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443d2e80-31db-40ac-9c35-88eec841ebba?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-12-23T00:00:00Z","updated":"2025-02-19T16:32:59Z"},{"id":"wordfence:443f0664-cc9c-4e82-bde3-72cbab285cc7","source":"wordfence","cve":"CVE-2024-34769","title":"Elegant Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/443f0664-cc9c-4e82-bde3-72cbab285cc7?source=api-prod","affected":[{"type":"plugin","slug":"elegant-blocks","name":"Elegant Blocks \u2013 Amazing Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T20:39:36Z"},{"id":"wordfence:44407fad-6ad4-4437-930f-b25a6c6203aa","source":"wordfence","cve":"CVE-2025-13910","title":"WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44407fad-6ad4-4437-930f-b25a6c6203aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-webauthn","name":"WP-WebAuthn","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:20:53Z","updated":"2026-04-15T17:55:29Z"},{"id":"wordfence:44445c44-5ae0-4f2b-8096-aa94ae5ff0b6","source":"wordfence","cve":"CVE-2024-47356","title":"Create <= 2.9.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44445c44-5ae0-4f2b-8096-aa94ae5ff0b6?source=api-prod","affected":[{"type":"theme","slug":"create","name":"Create","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:34:55Z"},{"id":"wordfence:444a25d7-6837-49a2-b21c-d6a00c0bc0bc","source":"wordfence","cve":"CVE-2026-39619","title":"Busiprof <= 2.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444a25d7-6837-49a2-b21c-d6a00c0bc0bc?source=api-prod","affected":[{"type":"theme","slug":"busiprof","name":"Busiprof","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T21:19:13Z"},{"id":"wordfence:444a848d-61bc-4801-815f-d68bea59f5bc","source":"wordfence","cve":"CVE-2014-9400","title":"WP Unique Article Header Image <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444a848d-61bc-4801-815f-d68bea59f5bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-unique-article-header-image","name":"wp-unique-article-header-image","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:444c181d-3ea2-46b6-a154-410b1935541a","source":"wordfence","cve":"CVE-2026-81422","title":"Advanced Appointment Booking & Scheduling <= 2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444c181d-3ea2-46b6-a154-410b1935541a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-appointment-booking-scheduling","name":"Advanced Appointment Booking & Scheduling","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T20:06:32Z"},{"id":"wordfence:444d69f5-8b8d-4e4b-bb6c-ad1ddcc7a867","source":"wordfence","cve":"CVE-2025-23884","title":"Annie <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444d69f5-8b8d-4e4b-bb6c-ad1ddcc7a867?source=api-prod","affected":[{"type":"plugin","slug":"annie","name":"Annie","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:04:31Z"},{"id":"wordfence:444f36c3-6a31-40df-b0f8-a62074d3020f","source":"wordfence","cve":"CVE-2026-122666","title":"Mang Board <= 2.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444f36c3-6a31-40df-b0f8-a62074d3020f?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2026-11-07T10:40:10Z","updated":"2026-11-10T19:54:26Z"},{"id":"wordfence:444f6a49-9d7a-4661-bab7-06d16f5f0317","source":"wordfence","cve":"CVE-2025-22771","title":"The Great Firewords of China <= 1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444f6a49-9d7a-4661-bab7-06d16f5f0317?source=api-prod","affected":[{"type":"plugin","slug":"sensitive-chinese-words-scanner","name":"The Great Firewords of China","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T21:17:32Z"},{"id":"wordfence:444fae52-ffcb-4502-a052-239693bfa326","source":"wordfence","cve":"CVE-2025-60187","title":"Atarim <= 4.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/444fae52-ffcb-4502-a052-239693bfa326?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-07-29T00:00:00Z","updated":"2025-12-12T16:21:16Z"},{"id":"wordfence:4454f002-0d31-4023-9a44-bb8f3050e233","source":"wordfence","cve":"CVE-2024-52420","title":"Disable Admin Notices individually <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4454f002-0d31-4023-9a44-bb8f3050e233?source=api-prod","affected":[{"type":"plugin","slug":"disable-admin-notices","name":"Disable Admin Notices \u2013 Hide Dashboard Notifications","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-11-13T00:00:00Z","updated":"2025-12-19T15:04:49Z"},{"id":"wordfence:44579fe8-4004-4608-b2fd-3531b14e6e69","source":"wordfence","cve":"CVE-2024-32813","title":"Integrate Google Drive <= 1.3.9 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44579fe8-4004-4608-b2fd-3531b14e6e69?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.91"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:58:46Z"},{"id":"wordfence:4457d15e-2c01-498d-b94a-a6e93adcf70c","source":"wordfence","cve":"CVE-2024-4626","title":"JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4457d15e-2c01-498d-b94a-a6e93adcf70c?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2024-06-19T13:41:32Z","updated":"2024-06-20T02:08:22Z"},{"id":"wordfence:44583cb7-bc32-4e62-8431-f5f1f6baeff2","source":"wordfence","cve":"CVE-2023-1917","title":"PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44583cb7-bc32-4e62-8431-f5f1f6baeff2?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":"10.0.2"}],"published":"2023-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:445b191c-b71d-4df0-a76a-d203b808a6f1","source":"wordfence","cve":"CVE-2026-84215","title":"Timetics \u2013 Appointment Booking Calendar & Scheduling <= 1.0.61 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/445b191c-b71d-4df0-a76a-d203b808a6f1?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.61","to_inclusive":true,"patched_in":"1.0.62"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:27:26Z"},{"id":"wordfence:445cee5c-21d5-4597-9efc-84e094476c3e","source":"wordfence","cve":"CVE-2025-32231","title":"Bookingor <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/445cee5c-21d5-4597-9efc-84e094476c3e?source=api-prod","affected":[{"type":"plugin","slug":"bookingor","name":"Bookingor \u2013 Booking System and Appointment Booking Calendar, Meeting Scheduling & WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-04-04T00:00:00Z","updated":"2026-01-23T19:44:48Z"},{"id":"wordfence:445e762c-7e90-4994-8542-31a84bc91388","source":"wordfence","cve":"CVE-2025-9332","title":"Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/445e762c-7e90-4994-8542-31a84bc91388?source=api-prod","affected":[{"type":"plugin","slug":"interactive-medical-drawing-of-human-body","name":"Interactive Human Anatomy with Clickable Body Parts","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T00:00:00Z","updated":"2025-10-03T11:17:11Z"},{"id":"wordfence:446522ea-7cf1-449b-b05c-58eb815142a4","source":"wordfence","cve":"CVE-2024-33911","title":"School Management Pro <= 10.3.4 - Authenticated (School Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446522ea-7cf1-449b-b05c-58eb815142a4?source=api-prod","affected":[{"type":"plugin","slug":"school-management-pro","name":"The School Management Pro","from":"*","from_inclusive":true,"to":"10.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:34:55Z"},{"id":"wordfence:446aa338-b020-431d-a68b-b8239de3150c","source":"wordfence","cve":"CVE-2026-24526","title":"Email Inquiry & Cart Options for WooCommerce <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446aa338-b020-431d-a68b-b8239de3150c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-email-inquiry-cart-options","name":"Email Inquiry & Cart Options for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T16:23:41Z"},{"id":"wordfence:446b160a-299e-4f91-bd49-02a7a16b6e5f","source":"wordfence","cve":"CVE-2013-7319","title":"Download Manager < 2.5.9 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446b160a-299e-4f91-bd49-02a7a16b6e5f?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2013-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:446c7cb2-4050-4414-ba3c-f832ea7d6c5c","source":"wordfence","cve":"CVE-2024-51884","title":"Posts Search <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446c7cb2-4050-4414-ba3c-f832ea7d6c5c?source=api-prod","affected":[{"type":"plugin","slug":"posts-search","name":"Posts Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:55:38Z"},{"id":"wordfence:446d458e-8b42-434e-a190-0af37a7d3afb","source":"wordfence","cve":"CVE-2024-5861","title":"WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446d458e-8b42-434e-a190-0af37a7d3afb?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T03:26:54Z"},{"id":"wordfence:446dbd84-dd4c-49dd-999b-c7a7055d167f","source":"wordfence","cve":"CVE-2026-97331","title":"User Private Files <= 2.1.8 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446dbd84-dd4c-49dd-999b-c7a7055d167f?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T00:18:59Z"},{"id":"wordfence:446fadbc-b927-4245-9095-fd545a906b9a","source":"wordfence","cve":"CVE-2022-37328","title":"History Timeline <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/446fadbc-b927-4245-9095-fd545a906b9a?source=api-prod","affected":[{"type":"plugin","slug":"timeline-awesome","name":"History Timeline for Biography, Company History & Event Timeline","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2022-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44735a35-c99e-445f-a117-2fbe203e9171","source":"wordfence","cve":"CVE-2025-22706","title":"Social Pug: Author Box <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44735a35-c99e-445f-a117-2fbe203e9171?source=api-prod","affected":[{"type":"plugin","slug":"social-pug-author-box","name":"Social Pug: Author Box","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-14T15:24:47Z"},{"id":"wordfence:4473d3f6-e324-40f5-b92b-167f76b17332","source":"wordfence","cve":"CVE-2024-0506","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4473d3f6-e324-40f5-b92b-167f76b17332?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:36:15Z"},{"id":"wordfence:4473de39-a122-4c2e-9f64-50157b589a28","source":"wordfence","cve":"CVE-2025-8103","title":"WPeMatico RSS Feed Fetcher <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4473de39-a122-4c2e-9f64-50157b589a28?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2025-07-25T14:59:17Z","updated":"2025-07-26T03:38:18Z"},{"id":"wordfence:447453ef-f65f-4229-b34d-48c073febd32","source":"wordfence","cve":"CVE-2025-53352","title":"Grid Plus <= 3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447453ef-f65f-4229-b34d-48c073febd32?source=api-prod","affected":[{"type":"plugin","slug":"grid-plus","name":"Grid Plus \u2013 Unlimited grid layout","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-13T00:00:00Z","updated":"2025-10-29T19:14:52Z"},{"id":"wordfence:4474c79b-f93a-4725-8345-ad5c5260913c","source":"wordfence","cve":"CVE-2026-0914","title":"WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4474c79b-f93a-4725-8345-ad5c5260913c?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.36","to_inclusive":true,"patched_in":"3.1.37"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-23T12:27:01Z"},{"id":"wordfence:4475cbd4-07cf-499a-a11a-b63eb9184568","source":"wordfence","cve":"CVE-2024-1384","title":"Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4475cbd4-07cf-499a-a11a-b63eb9184568?source=api-prod","affected":[{"type":"plugin","slug":"auxin-portfolio","name":"Premium Portfolio Features for Phlox theme","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-08-28T23:34:54Z","updated":"2024-12-20T20:24:43Z"},{"id":"wordfence:44777529-660f-4038-bbee-566ca3a8d24e","source":"wordfence","cve":"CVE-2024-31293","title":"Easy Digital Downloads <= 3.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44777529-660f-4038-bbee-566ca3a8d24e?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:35:52Z"},{"id":"wordfence:44780988-cadf-4ff2-9ba9-148b7b6650df","source":"wordfence","cve":"CVE-2024-8713","title":"Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44780988-cadf-4ff2-9ba9-148b7b6650df?source=api-prod","affected":[{"type":"plugin","slug":"kodex-posts-likes","name":"Kodex Posts likes","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:18:24Z","updated":"2024-09-25T02:05:13Z"},{"id":"wordfence:447b95d4-8db4-497a-9c09-de8edb350688","source":"wordfence","cve":"CVE-2024-54393","title":"WP Fiddle <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447b95d4-8db4-497a-9c09-de8edb350688?source=api-prod","affected":[{"type":"plugin","slug":"wp-fiddle","name":"WP Fiddle","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:55:11Z"},{"id":"wordfence:447cef6f-fa2e-4087-946d-6e0214830ea9","source":"wordfence","cve":"CVE-2025-1504","title":"Post Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447cef6f-fa2e-4087-946d-6e0214830ea9?source=api-prod","affected":[{"type":"plugin","slug":"post-lockdown","name":"Post Lockdown","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-13T19:21:53Z"},{"id":"wordfence:447d3aa6-2ed3-4da3-b9e8-fc7792c8c29a","source":"wordfence","cve":"CVE-2025-5143","title":"TableOn \u2013 WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447d3aa6-2ed3-4da3-b9e8-fc7792c8c29a?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.4.1","to_inclusive":true,"patched_in":"1.0.4.2"}],"published":"2025-06-20T18:15:37Z","updated":"2025-06-21T06:42:50Z"},{"id":"wordfence:447dcbd4-2862-42e7-815e-389afc4c42bf","source":"wordfence","cve":"CVE-2025-54733","title":"All Bootstrap Blocks <= 1.3.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447dcbd4-2862-42e7-815e-389afc4c42bf?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.28","to_inclusive":true,"patched_in":"1.3.29"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:27:34Z"},{"id":"wordfence:447f4bfb-2362-48ad-bd49-27872178f616","source":"wordfence","cve":"CVE-2025-69384","title":"Timeline Event History <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/447f4bfb-2362-48ad-bd49-27872178f616?source=api-prod","affected":[{"type":"plugin","slug":"timeline-event-history","name":"Timeline Event History","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:48:23Z"},{"id":"wordfence:4483fb33-3815-4ec9-9df4-a971844f4855","source":"wordfence","cve":"CVE-2023-5325","title":"Woocommerce Vietnam Checkout <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4483fb33-3815-4ec9-9df4-a971844f4855?source=api-prod","affected":[{"type":"plugin","slug":"woo-vietnam-checkout","name":"Vietnam Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4484fa86-5878-426d-92b9-8eb0751075e5","source":"wordfence","cve":"CVE-2024-13518","title":"Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4484fa86-5878-426d-92b9-8eb0751075e5?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.10.12","to_inclusive":true,"patched_in":"6.10.13"}],"published":"2025-02-28T15:24:11Z","updated":"2025-07-03T12:11:53Z"},{"id":"wordfence:4486b797-352d-4cab-9495-9e476bd41526","source":"wordfence","cve":"CVE-2024-56239","title":"Themify Audio Dock <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4486b797-352d-4cab-9495-9e476bd41526?source=api-prod","affected":[{"type":"plugin","slug":"themify-audio-dock","name":"Themify Audio Dock","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:23:23Z"},{"id":"wordfence:4487391e-baa4-4320-a23d-b52a42e2de90","source":"wordfence","cve":"CVE-2023-33319","title":"WooCommerce Follow-Up Emails <= 4.9.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4487391e-baa4-4320-a23d-b52a42e2de90?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-follow-up-emails","name":"Woocommerce Follow-ups","from":"*","from_inclusive":true,"to":"4.9.40","to_inclusive":true,"patched_in":"4.9.50"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4488d982-4e57-4614-b336-f1bba8dfa91d","source":"wordfence","cve":"CVE-2017-1002022","title":"surveys <= 1.01.8 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4488d982-4e57-4614-b336-f1bba8dfa91d?source=api-prod","affected":[{"type":"plugin","slug":"surveys","name":"surveys","from":"*","from_inclusive":true,"to":"1.01.8","to_inclusive":true,"patched_in":""}],"published":"2017-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44895f32-d5be-4dc7-85d2-539ff1720b37","source":"wordfence","cve":"CVE-2026-24520","title":"Feeds for TikTok \u2013 Display Video Feeds in Grid Layouts <= 1.0.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44895f32-d5be-4dc7-85d2-539ff1720b37?source=api-prod","affected":[{"type":"plugin","slug":"b-tiktok-feed","name":"Feeds for TikTok \u2013 Keep Your Site Fresh with Your Latest Videos","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:28:33Z"},{"id":"wordfence:4489d26b-dcdc-475c-b1e1-3626cc75ae75","source":"wordfence","cve":"CVE-2021-24702","title":"LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4489d26b-dcdc-475c-b1e1-3626cc75ae75?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.3.1"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:448a9e55-e976-4988-a0df-57f1f06fe66d","source":"wordfence","cve":"CVE-2025-52775","title":"Project Cost Calculator <= 1.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448a9e55-e976-4988-a0df-57f1f06fe66d?source=api-prod","affected":[{"type":"plugin","slug":"project-cost-calculator","name":"Project Cost Calculator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-18T15:47:49Z"},{"id":"wordfence:448af1c4-4d50-4d2c-9bcf-64bb58301001","source":"wordfence","cve":"CVE-2026-66565","title":"FC United <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448af1c4-4d50-4d2c-9bcf-64bb58301001?source=api-prod","affected":[{"type":"theme","slug":"fcunited","name":"FC United | Football, Soccer & Sports WordPress Theme + Events & Shop","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:12:20Z"},{"id":"wordfence:448ce1c8-ec82-4601-b7de-2c81d6c026b2","source":"wordfence","cve":"CVE-2026-97250","title":"Geo Mashup <= 1.13.21 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448ce1c8-ec82-4601-b7de-2c81d6c026b2?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.21","to_inclusive":true,"patched_in":"1.13.22"}],"published":"2026-09-29T07:24:30Z","updated":"2026-10-09T00:12:38Z"},{"id":"wordfence:448d3e70-a2bf-4f32-a24c-394aaf8488ab","source":"wordfence","cve":"CVE-2026-39758","title":"Midtrans-WooCommerce <= 2.32.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448d3e70-a2bf-4f32-a24c-394aaf8488ab?source=api-prod","affected":[{"type":"plugin","slug":"midtrans-woocommerce","name":"Midtrans-WooCommerce","from":"*","from_inclusive":true,"to":"2.32.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:34:11Z","updated":"2026-10-08T23:27:13Z"},{"id":"wordfence:448df3b0-32a7-4097-a37d-07e253993496","source":"wordfence","cve":"CVE-2026-13471","title":"LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448df3b0-32a7-4097-a37d-07e253993496?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-09-17T19:13:36Z","updated":"2026-09-18T07:40:00Z"},{"id":"wordfence:448ec796-e92f-410e-aa40-aaf296c1afeb","source":"wordfence","cve":"CVE-2024-2858","title":"Simple Buttons Creator <=1.04 - Cross-Site Request Forgery to Arbitrary Button Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/448ec796-e92f-410e-aa40-aaf296c1afeb?source=api-prod","affected":[{"type":"plugin","slug":"simple-buttons-creator","name":"Simple Buttons Creator","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":""}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:22:12Z"},{"id":"wordfence:4490afba-1487-40a4-99c6-c753acb10df3","source":"wordfence","cve":"CVE-2025-14003","title":"Image Gallery \u2013 Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4490afba-1487-40a4-99c6-c753acb10df3?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.13.4"}],"published":"2025-12-15T02:22:13Z","updated":"2025-12-15T14:25:11Z"},{"id":"wordfence:4491f63c-762f-4516-8f4c-3d54969e8fd4","source":"wordfence","cve":"CVE-2026-86789","title":"Connections Business Directory <= 10.4.67 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4491f63c-762f-4516-8f4c-3d54969e8fd4?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"10.4.67","to_inclusive":true,"patched_in":""}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:42:52Z"},{"id":"wordfence:4492aede-b68d-46b8-955f-81ebdc875921","source":"wordfence","cve":"CVE-2025-5290","title":"Borderless \u2013 Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4492aede-b68d-46b8-955f-81ebdc875921?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-05-30T00:00:00Z","updated":"2025-05-31T07:22:12Z"},{"id":"wordfence:4493aba1-d18d-4511-86ec-b10b36d0c0df","source":"wordfence","cve":"CVE-2025-58842","title":"Donation Forms WP by Givecloud <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4493aba1-d18d-4511-86ec-b10b36d0c0df?source=api-prod","affected":[{"type":"plugin","slug":"donation-forms-by-givecloud","name":"Donation Forms WP by Givecloud","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-25T18:38:37Z"},{"id":"wordfence:4494960c-66ed-47d9-b3fc-5a5ec5a07b1f","source":"wordfence","cve":"CVE-2026-103380","title":"Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4494960c-66ed-47d9-b3fc-5a5ec5a07b1f?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2026-10-13T19:18:51Z","updated":"2026-10-14T07:43:32Z"},{"id":"wordfence:4495e352-758b-4331-a617-033ff348c07d","source":"wordfence","cve":"CVE-2026-15453","title":"KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4495e352-758b-4331-a617-033ff348c07d?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-08-14T15:14:00Z","updated":"2026-08-15T03:25:58Z"},{"id":"wordfence:44982138-7ebb-4562-a869-f17bfecd16d2","source":"wordfence","cve":"CVE-2023-36382","title":"Media Library Categories <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44982138-7ebb-4562-a869-f17bfecd16d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-library-categories","name":"Media Library Categories","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44995410-b015-4732-a046-034c3dbdd221","source":"wordfence","cve":"CVE-2026-94632","title":"BlockStrap Page Builder \u2013 Bootstrap Blocks <= 0.1.58 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44995410-b015-4732-a046-034c3dbdd221?source=api-prod","affected":[{"type":"plugin","slug":"blockstrap-page-builder-blocks","name":"BlockStrap Page Builder \u2013 Bootstrap Blocks","from":"*","from_inclusive":true,"to":"0.1.58","to_inclusive":true,"patched_in":"0.1.59"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:49:30Z"},{"id":"wordfence:449dfb1b-cd06-406f-82d5-c615383a0409","source":"wordfence","cve":"CVE-2025-68549","title":"Wiguard < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/449dfb1b-cd06-406f-82d5-c615383a0409?source=api-prod","affected":[{"type":"theme","slug":"wiguard","name":"Wiguard \u2013 CCTV & Security WordPress Theme for Surveillance Companies","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:21:14Z"},{"id":"wordfence:44a05533-63e9-4a34-a29a-2ab8399a4ddb","source":"wordfence","cve":"CVE-2026-104394","title":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a05533-63e9-4a34-a29a-2ab8399a4ddb?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.12.3","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2026-10-05T11:12:46Z","updated":"2026-10-08T23:23:44Z"},{"id":"wordfence:44a2e2f3-1902-43c5-8e3c-4174cb1ffa63","source":"wordfence","cve":"CVE-2023-27623","title":"WP Page Numbers <= 0.5 - Cross-Site Request Forgery via wp_page_numbers_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a2e2f3-1902-43c5-8e3c-4174cb1ffa63?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-numbers","name":"WP Page Numbers","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44a62dd2-539a-4d9a-a32e-f935aa1d0d58","source":"wordfence","cve":"CVE-2024-53748","title":"WP Mermaid <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a62dd2-539a-4d9a-a32e-f935aa1d0d58?source=api-prod","affected":[{"type":"plugin","slug":"wp-mermaid","name":"WP Mermaid","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:40:57Z"},{"id":"wordfence:44a8b7fb-7c91-4a85-bf16-4371fde6945f","source":"wordfence","cve":"CVE-2024-1712","title":"Carousel Slider <= 2.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a8b7fb-7c91-4a85-bf16-4371fde6945f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs","name":"Responsive Tabs","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T20:47:45Z"},{"id":"wordfence:44a921e7-cce3-4347-968d-76dab243fcd6","source":"wordfence","cve":"CVE-2023-6750","title":"WP Clone <= 2.4.2 - Sensitive Information Exposure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a921e7-cce3-4347-968d-76dab243fcd6?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2023-12-18T00:00:00Z","updated":"2026-09-04T00:34:15Z"},{"id":"wordfence:44a98565-7861-4489-9009-43292b6e46df","source":"wordfence","cve":"CVE-2025-8977","title":"Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 \u2013 Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44a98565-7861-4489-9009-43292b6e46df?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.33","to_inclusive":true,"patched_in":"3.9.34"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T04:24:11Z"},{"id":"wordfence:44ac6c67-795e-461b-ab42-af24abab3613","source":"wordfence","cve":"CVE-2024-12807","title":"Social Share Buttons for WordPress <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ac6c67-795e-461b-ab42-af24abab3613?source=api-prod","affected":[{"type":"plugin","slug":"share-buttons","name":"Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:37:47Z"},{"id":"wordfence:44acba71-c1f1-4f10-a817-ca9b7e878bd3","source":"wordfence","cve":"CVE-2025-58257","title":"Verowa Connect <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44acba71-c1f1-4f10-a817-ca9b7e878bd3?source=api-prod","affected":[{"type":"plugin","slug":"verowa-connect","name":"Verowa Connect","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-12-03T16:53:17Z"},{"id":"wordfence:44ace7aa-eacd-4de5-af0b-48b1608c3299","source":"wordfence","cve":"CVE-2026-48964","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ace7aa-eacd-4de5-af0b-48b1608c3299?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:48:54Z"},{"id":"wordfence:44ad056b-8995-4068-8b05-4fefb8d2ff0a","source":"wordfence","cve":"CVE-2025-0515","title":"Buzz Club \u2013 Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ad056b-8995-4068-8b05-4fefb8d2ff0a?source=api-prod","affected":[{"type":"theme","slug":"buzzclub","name":"Buzz Club \u2013 Night Club, DJ and Music Festival Event WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:07Z"},{"id":"wordfence:44ad9dae-f0ee-471a-b023-0c10365b3198","source":"wordfence","cve":"CVE-2024-51655","title":"Custom Author URL <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ad9dae-f0ee-471a-b023-0c10365b3198?source=api-prod","affected":[{"type":"plugin","slug":"author-slug","name":"Custom Author URL","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:40:00Z"},{"id":"wordfence:44af8ced-5ea4-4bdb-a664-c5b58d683d23","source":"wordfence","cve":"","title":"Google +1 by BestWebSoft < 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44af8ced-5ea4-4bdb-a664-c5b58d683d23?source=api-prod","affected":[{"type":"plugin","slug":"google-one","name":"Google +1 by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44b02690-462a-458b-88c9-89acc9c209cb","source":"wordfence","cve":"CVE-2024-5855","title":"Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b02690-462a-458b-88c9-89acc9c209cb?source=api-prod","affected":[{"type":"plugin","slug":"media-hygiene","name":"Media Hygiene: Remove or Delete Unused Images and More!","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T02:03:12Z"},{"id":"wordfence:44b173da-a6b9-424c-95a1-a87a9b8ee4af","source":"wordfence","cve":"CVE-2024-5667","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b173da-a6b9-424c-95a1-a87a9b8ee4af?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"},{"type":"plugin","slug":"wp-featherlight","name":"WP Featherlight \u2013 A Simple jQuery Lightbox","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:48Z"},{"id":"wordfence:44b259c7-ea91-4ab5-a46b-67aec50654c3","source":"wordfence","cve":"CVE-2022-36358","title":"SEO Scout <= 0.9.83 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b259c7-ea91-4ab5-a46b-67aec50654c3?source=api-prod","affected":[{"type":"plugin","slug":"ab-rankings-testing-tool","name":"SEO Scout: Content Optimization, Keyword Research, Rank Tracking + SEO Testing","from":"*","from_inclusive":true,"to":"0.9.83","to_inclusive":true,"patched_in":""}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44b2d11d-e876-433e-9e0d-5e9f2b3c0c80","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.4 - Authenticated (Scubscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b2d11d-e876-433e-9e0d-5e9f2b3c0c80?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44b3b015-2482-4b80-b208-73f1abe21b27","source":"wordfence","cve":"CVE-2026-90981","title":"Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b3b015-2482-4b80-b208-73f1abe21b27?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2026-09-17T18:40:11Z","updated":"2026-09-18T07:40:00Z"},{"id":"wordfence:44b62b99-99eb-424b-a04a-9bbacf5fbbaa","source":"wordfence","cve":"CVE-2024-0433","title":"Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b62b99-99eb-424b-a04a-9bbacf5fbbaa?source=api-prod","affected":[{"type":"plugin","slug":"gestpay-for-woocommerce","name":"Ecommerce Fabrick","from":"*","from_inclusive":true,"to":"20221130","to_inclusive":true,"patched_in":"20240307"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:15Z"},{"id":"wordfence:44b777bc-36fb-46ea-8cc9-3b3b0e681e1f","source":"wordfence","cve":"CVE-2026-13692","title":"PayU CommercePro < 3.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b777bc-36fb-46ea-8cc9-3b3b0e681e1f?source=api-prod","affected":[{"type":"plugin","slug":"payu-india","name":"PayU India","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":false,"patched_in":"3.9.0"}],"published":"2026-07-07T00:00:00Z","updated":"2026-08-14T15:19:16Z"},{"id":"wordfence:44b8659a-c88d-44d3-8eab-71b0a49d97b4","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44b8659a-c88d-44d3-8eab-71b0a49d97b4?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-26T00:00:00Z","updated":"2026-10-28T21:02:52Z"},{"id":"wordfence:44ba3eee-525e-46ba-ae02-6f7a28f80c50","source":"wordfence","cve":"CVE-2018-16613","title":"wpForo < = 1.5.1 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ba3eee-525e-46ba-ae02-6f7a28f80c50?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2018-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44bae6d6-e6ee-441b-b517-4636a8ec99b9","source":"wordfence","cve":"CVE-2024-52422","title":"WP Githuber MD <= 1.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44bae6d6-e6ee-441b-b517-4636a8ec99b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-githuber-md","name":"WP Githuber MD \u2013 WordPress Markdown Editor","from":"*","from_inclusive":true,"to":"1.16.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:25:05Z"},{"id":"wordfence:44bca8c2-1591-484c-ac40-8c968d5d1cad","source":"wordfence","cve":"CVE-2025-11886","title":"CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44bca8c2-1591-484c-ac40-8c968d5d1cad?source=api-prod","affected":[{"type":"plugin","slug":"ctl-arcade-lite","name":"CTL Arcade Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:12:29Z","updated":"2025-11-11T03:30:37Z"},{"id":"wordfence:44be9f20-4800-4d3f-bd0b-e8d0b8eaaadf","source":"wordfence","cve":"CVE-2025-67988","title":"CozyStay < 1.9.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44be9f20-4800-4d3f-bd0b-e8d0b8eaaadf?source=api-prod","affected":[{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":false,"patched_in":"1.9.1"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T20:56:25Z"},{"id":"wordfence:44c0c0a0-94a4-4394-b661-1ce53d63f789","source":"wordfence","cve":"CVE-2026-32566","title":"ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c0c0a0-94a4-4394-b661-1ce53d63f789?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-post-type","name":"ACPT (Premium)","from":"*","from_inclusive":true,"to":"2.0.66","to_inclusive":true,"patched_in":"2.0.67"}],"published":"2026-08-25T00:00:00Z","updated":"2026-10-16T18:50:39Z"},{"id":"wordfence:44c14dca-19df-4f83-80bf-6ea0ea261e28","source":"wordfence","cve":"CVE-2025-64219","title":"Business Directory <= 6.4.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c14dca-19df-4f83-80bf-6ea0ea261e28?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.18","to_inclusive":true,"patched_in":"6.4.19"}],"published":"2025-10-19T00:00:00Z","updated":"2025-11-04T15:46:46Z"},{"id":"wordfence:44c31db3-6dfa-4d42-9c3b-73dde9bc49b9","source":"wordfence","cve":"CVE-2017-18032","title":"WordPress Download Manager <= 2.9.51 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c31db3-6dfa-4d42-9c3b-73dde9bc49b9?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.51","to_inclusive":true,"patched_in":"2.9.52"}],"published":"2017-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44c5a1cd-aac2-4c44-8aaa-9b5fdafad133","source":"wordfence","cve":"CVE-2021-24669","title":"MAZ Loader \u2013 Preloader Builder for WordPress <= 1.3.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c5a1cd-aac2-4c44-8aaa-9b5fdafad133?source=api-prod","affected":[{"type":"plugin","slug":"maz-loader","name":"MAZ Loader \u2013 Preloader Builder for WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44c74d97-47e1-4af7-83d1-7c0e98fdc40c","source":"wordfence","cve":"CVE-2024-34798","title":"Debug Log \u2013 Manger Tool <= 1.4.5 - Unauthenticated Information Exposure via Logs","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c74d97-47e1-4af7-83d1-7c0e98fdc40c?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-config-tool","name":"Debug Log Manager Tool","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:07:01Z"},{"id":"wordfence:44c96df2-530a-4ebe-b722-c606a7b135f9","source":"wordfence","cve":"CVE-2023-2704","title":"BP Social Connect <= 1.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44c96df2-530a-4ebe-b722-c606a7b135f9?source=api-prod","affected":[{"type":"plugin","slug":"bp-social-connect","name":"BP Social Connect","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44cb21f9-467a-4119-99fb-5cd21166a334","source":"wordfence","cve":"CVE-2023-46072","title":"Add Shortcodes Actions And Filters <= 2.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44cb21f9-467a-4119-99fb-5cd21166a334?source=api-prod","affected":[{"type":"plugin","slug":"add-actions-and-filters","name":"Add Shortcodes Actions And Filters","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.10"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44cbaa25-7e91-4b2e-81c4-ba1d7ba02350","source":"wordfence","cve":"","title":"Multiple miniOrange Plugins (Various Version) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44cbaa25-7e91-4b2e-81c4-ba1d7ba02350?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.20.2","to_inclusive":true,"patched_in":"6.20.3"},{"type":"plugin","slug":"login-with-azure","name":"All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"},{"type":"plugin","slug":"login-with-cognito","name":"Login with Cognito","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"miniorange-openid-connect-client","name":"WordPress OpenID Connect Client","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44cd696c-fff3-4942-b2c9-628ba281ba44","source":"wordfence","cve":"CVE-2026-6627","title":"WPFormify <= 1.1.1 - Missing Authorization","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44cd696c-fff3-4942-b2c9-628ba281ba44?source=api-prod","affected":[{"type":"plugin","slug":"wpformify","name":"WPFormify \u2013 Stripe Payments with Form and Checkout","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-08-04T18:19:04Z","updated":"2026-08-05T06:37:55Z"},{"id":"wordfence:44cde2d1-8cb4-4185-a7e6-58a2bec0dae9","source":"wordfence","cve":"CVE-2023-26012","title":"Custom Login Page <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44cde2d1-8cb4-4185-a7e6-58a2bec0dae9?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-login-page","name":"Custom Login Page","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44d041ca-caa6-410d-b2d1-7a63208cc512","source":"wordfence","cve":"CVE-2026-12136","title":"SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d041ca-caa6-410d-b2d1-7a63208cc512?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-06-17T17:37:13Z","updated":"2026-06-18T06:50:05Z"},{"id":"wordfence:44d14692-d90a-45f9-afb4-0666ce4b3397","source":"wordfence","cve":"CVE-2023-48286","title":"Accept Stripe Payments <= 2.0.79 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d14692-d90a-45f9-afb4-0666ce4b3397?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.79","to_inclusive":true,"patched_in":"2.0.80"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44d1628c-e37e-4803-a755-3d5346410c4c","source":"wordfence","cve":"CVE-2026-104674","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.31 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d1628c-e37e-4803-a755-3d5346410c4c?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.32"}],"published":"2026-10-30T18:12:00Z","updated":"2026-11-03T19:20:42Z"},{"id":"wordfence:44d1c85a-9a19-4962-9db3-539fa5702d2f","source":"wordfence","cve":"CVE-2025-22261","title":"WP FullCalendar <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d1c85a-9a19-4962-9db3-539fa5702d2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-fullcalendar","name":"WP FullCalendar","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-25T14:27:29Z"},{"id":"wordfence:44d25846-42ad-4f85-a7c4-be1f5743bab6","source":"wordfence","cve":"CVE-2025-54044","title":"Elite Video Player <= 10.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d25846-42ad-4f85-a7c4-be1f5743bab6?source=api-prod","affected":[{"type":"plugin","slug":"elite-video-player","name":"Elite Video Player","from":"*","from_inclusive":true,"to":"10.0.5","to_inclusive":true,"patched_in":"10.0.7"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:47:31Z"},{"id":"wordfence:44d6167f-0e4a-4fba-9226-da091672cf43","source":"wordfence","cve":"CVE-2026-94461","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d6167f-0e4a-4fba-9226-da091672cf43?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.69","to_inclusive":true,"patched_in":"3.1.70"}],"published":"2026-09-23T16:54:00Z","updated":"2026-09-29T20:05:50Z"},{"id":"wordfence:44d63454-87f0-49e3-ac04-2fa83882500d","source":"wordfence","cve":"CVE-2026-14494","title":"Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44d63454-87f0-49e3-ac04-2fa83882500d?source=api-prod","affected":[{"type":"plugin","slug":"sigmaforms-pro","name":"SigmaForms Pro \u2013 AI Generated Forms","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-08-28T00:00:00Z","updated":"2026-08-29T11:30:17Z"},{"id":"wordfence:44da7989-a40d-4f08-8b7e-5374f77b05da","source":"wordfence","cve":"CVE-2026-118083","title":"WP Crowdfunding <= 2.2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44da7989-a40d-4f08-8b7e-5374f77b05da?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:17:03Z","updated":"2026-11-03T19:42:42Z"},{"id":"wordfence:44dab041-9c61-4830-b4e7-7d80ebc7210d","source":"wordfence","cve":"CVE-2026-62105","title":"ThemeREX Addons < 2.45.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44dab041-9c61-4830-b4e7-7d80ebc7210d?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":false,"patched_in":"2.45.0"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:48:32Z"},{"id":"wordfence:44dba2ac-3e8f-4544-b568-c72705fd3c0a","source":"wordfence","cve":"CVE-2025-30817","title":"Z Companion <= 1.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44dba2ac-3e8f-4544-b568-c72705fd3c0a?source=api-prod","affected":[{"type":"plugin","slug":"z-companion","name":"Z Companion","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:36:11Z"},{"id":"wordfence:44dd79b0-b24f-428d-88ce-240a98cc397f","source":"wordfence","cve":"CVE-2026-24611","title":"MetForm Pro <= 3.9.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44dd79b0-b24f-428d-88ce-240a98cc397f?source=api-prod","affected":[{"type":"plugin","slug":"metform-pro","name":"MetForm Pro","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-03-12T00:00:00Z","updated":"2026-07-16T18:40:41Z"},{"id":"wordfence:44dd7b3f-5892-43e1-acf1-61f66db0b4a3","source":"wordfence","cve":"CVE-2023-45831","title":"AMP WP <= 1.5.15 - Cross-Site Request Forgery via multiple settings pages","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44dd7b3f-5892-43e1-acf1-61f66db0b4a3?source=api-prod","affected":[{"type":"plugin","slug":"amp-wp","name":"AMP WP \u2013 Google AMP For WordPress","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.5.16"}],"published":"2023-10-13T00:00:00Z","updated":"2024-05-17T13:29:30Z"},{"id":"wordfence:44de1ca1-c443-4dc2-be14-6a27711d97f5","source":"wordfence","cve":"CVE-2026-111957","title":"SUMIT Payment Gateway for WooCommerce < 4.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44de1ca1-c443-4dc2-be14-6a27711d97f5?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-officeguy","name":"SUMIT Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:32:16Z"},{"id":"wordfence:44df0f6f-0765-4627-b553-3c51ea95cf59","source":"wordfence","cve":"CVE-2025-46450","title":"occupancyplan <= 1.0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44df0f6f-0765-4627-b553-3c51ea95cf59?source=api-prod","affected":[{"type":"plugin","slug":"occupancyplan","name":"occupancyplan","from":"*","from_inclusive":true,"to":"1.0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:12:02Z"},{"id":"wordfence:44dfc7c7-6479-4e73-bd1c-ee4002f46a65","source":"wordfence","cve":"CVE-2026-95530","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager <= 11.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44dfc7c7-6479-4e73-bd1c-ee4002f46a65?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.4.1","to_inclusive":true,"patched_in":"11.4.2"}],"published":"2026-09-23T10:55:28Z","updated":"2026-09-29T20:08:45Z"},{"id":"wordfence:44e110f4-483d-4e95-88d4-ea8e26351e33","source":"wordfence","cve":"CVE-2026-94160","title":"ThemeStek Extras for LabtechCO Theme <= 8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e110f4-483d-4e95-88d4-ea8e26351e33?source=api-prod","affected":[{"type":"plugin","slug":"themestek-labtechco-extras","name":"ThemeStek Extras for LabtechCO Theme","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:49:16Z"},{"id":"wordfence:44e112a7-8f51-4d2a-a4b3-74a47ef3aec7","source":"wordfence","cve":"CVE-2021-4345","title":"uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e112a7-8f51-4d2a-a4b3-74a47ef3aec7?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e156f8-be5b-40b7-894b-5cb85f6be936","source":"wordfence","cve":"CVE-2025-25161","title":"WP Find Your Nearest <= 0.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e156f8-be5b-40b7-894b-5cb85f6be936?source=api-prod","affected":[{"type":"plugin","slug":"wp-find-your-nearest","name":"WP Find Your Nearest","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:45:00Z"},{"id":"wordfence:44e3158c-6163-4780-a1d5-ca101ba92074","source":"wordfence","cve":"CVE-2008-5752","title":"Page Flip Image Gallery <= 0.2.2 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e3158c-6163-4780-a1d5-ca101ba92074?source=api-prod","affected":[{"type":"plugin","slug":"page-flip-image-gallery","name":"page-flip-image-gallery","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2008-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e4a1a3-71d0-4cad-9807-f6bbc99ccb13","source":"wordfence","cve":"CVE-2024-1475","title":"Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4a1a3-71d0-4cad-9807-f6bbc99ccb13?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode","name":"Coming Soon Maintenance Mode","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:29Z"},{"id":"wordfence:44e4fb1b-eed4-4ef9-9856-7c5095117aa7","source":"wordfence","cve":"CVE-2025-8874","title":"Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4fb1b-eed4-4ef9-9856-7c5095117aa7?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.9.0","to_inclusive":true,"patched_in":"2.0.9.1"}],"published":"2025-08-11T18:42:21Z","updated":"2025-08-12T06:42:41Z"},{"id":"wordfence:44e53c69-e301-4007-b090-c277e9f07905","source":"wordfence","cve":"CVE-2024-53760","title":"Capitalize My Title <= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e53c69-e301-4007-b090-c277e9f07905?source=api-prod","affected":[{"type":"plugin","slug":"capitalize-my-title","name":"Capitalize My Title WordPress Plugin","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:26:14Z"},{"id":"wordfence:44e54ac5-8091-4154-a14c-5cd67647f722","source":"wordfence","cve":"CVE-2015-4133","title":"ReFlex Gallery \u00bb WordPress Photo Gallery < 3.1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e54ac5-8091-4154-a14c-5cd67647f722?source=api-prod","affected":[{"type":"plugin","slug":"reflex-gallery","name":"ReFlex Gallery \u00bb WordPress Photo Gallery","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2015-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e61ac0-f420-4603-a81f-031a22e01927","source":"wordfence","cve":"CVE-2022-29427","title":"Disable Right Click For WP <= 1.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e61ac0-f420-4603-a81f-031a22e01927?source=api-prod","affected":[{"type":"plugin","slug":"disable-right-click-for-wp","name":"Disable Right Click For WP","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-05-04T12:11:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e68e0c-1b21-411b-9ff7-6b6affc5988e","source":"wordfence","cve":"CVE-2025-9126","title":"Smart Table Builder <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e68e0c-1b21-411b-9ff7-6b6affc5988e?source=api-prod","affected":[{"type":"plugin","slug":"smart-table-builder","name":"Smart Table Builder","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-09-05T14:47:03Z","updated":"2025-09-06T03:22:36Z"},{"id":"wordfence:44e70eb9-f411-49da-b169-a5af8a9ace0c","source":"wordfence","cve":"CVE-2021-24250","title":"Business Directory Plugin <= 5.11.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e70eb9-f411-49da-b169-a5af8a9ace0c?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.11.2"}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e71dea-d736-49c2-a630-f42905ac6b4d","source":"wordfence","cve":"CVE-2025-4413","title":"Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e71dea-d736-49c2-a630-f42905ac6b4d?source=api-prod","affected":[{"type":"plugin","slug":"pixabay-images","name":"Pixabay Images","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-17T14:04:37Z","updated":"2025-06-18T02:21:38Z"},{"id":"wordfence:44e84fd9-bc83-4780-ab7a-8898a8c5c78a","source":"wordfence","cve":"CVE-2023-36526","title":"Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e84fd9-bc83-4780-ab7a-8898a8c5c78a?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post-page-menu-custom-post-type","name":"Duplicate Post Page Menu & Custom Post Type","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44e9e7b5-6d60-4c2b-b29b-1a856dc86b41","source":"wordfence","cve":"CVE-2025-67987","title":"Quiz And Survey Master <= 10.3.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44e9e7b5-6d60-4c2b-b29b-1a856dc86b41?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T16:16:27Z"},{"id":"wordfence:44ea3322-10f6-4f52-8fa8-8cc2632b67ce","source":"wordfence","cve":"CVE-2024-43354","title":"myCred <= 2.7.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ea3322-10f6-4f52-8fa8-8cc2632b67ce?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:35:58Z"},{"id":"wordfence:44ed1f52-6c31-477d-ba32-8235d109024d","source":"wordfence","cve":"CVE-2026-65499","title":"PeproDev Ultimate Invoice <= 2.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44ed1f52-6c31-477d-ba32-8235d109024d?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:43:49Z"},{"id":"wordfence:44edf44b-5456-4c4b-86c3-80ad785cfb6a","source":"wordfence","cve":"CVE-2025-32627","title":"JS Job Manager <= 2.0.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44edf44b-5456-4c4b-86c3-80ad785cfb6a?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:27:21Z"},{"id":"wordfence:44f1342a-11b3-4c3f-837f-f68176ded4a9","source":"wordfence","cve":"CVE-2022-45804","title":"Robo Gallery <= 3.2.9 - Cross-Site Request Forgery via getPluginStatus","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f1342a-11b3-4c3f-837f-f68176ded4a9?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44f164fc-d8a6-4e31-9fec-54ae22246c50","source":"wordfence","cve":"CVE-2024-49673","title":"LaTeX2HTML <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f164fc-d8a6-4e31-9fec-54ae22246c50?source=api-prod","affected":[{"type":"plugin","slug":"latex2html","name":"LaTeX2HTML","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:00:12Z"},{"id":"wordfence:44f18ae8-0c4b-44b2-a069-47644432eff6","source":"wordfence","cve":"CVE-2024-56223","title":"Gulri Slider <= 3.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f18ae8-0c4b-44b2-a069-47644432eff6?source=api-prod","affected":[{"type":"plugin","slug":"gulri-slider","name":"Gulri Slider","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:54:58Z"},{"id":"wordfence:44f1f683-9c20-468f-806b-33de0904488c","source":"wordfence","cve":"CVE-2025-54730","title":"Embedder for Google Reviews <=  1.7.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f1f683-9c20-468f-806b-33de0904488c?source=api-prod","affected":[{"type":"plugin","slug":"embedder-for-google-reviews","name":"Embedder for Google Reviews","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:32:30Z"},{"id":"wordfence:44f2a414-245b-4c2d-a7ef-ca33b399f6b6","source":"wordfence","cve":"CVE-2023-36684","title":"Convert Pro <= 1.7.5 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f2a414-245b-4c2d-a7ef-ca33b399f6b6?source=api-prod","affected":[{"type":"plugin","slug":"convertpro","name":"Convert Pro","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44f3b2e4-c537-4369-b2d6-39fbc6cb8e08","source":"wordfence","cve":"CVE-2024-10793","title":"WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f3b2e4-c537-4369-b2d6-39fbc6cb8e08?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2024-11-14T16:30:34Z","updated":"2024-11-15T05:30:56Z"},{"id":"wordfence:44f6048b-7de6-4ec9-af89-cd08c43d0aaa","source":"wordfence","cve":"CVE-2025-8080","title":"Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f6048b-7de6-4ec9-af89-cd08c43d0aaa?source=api-prod","affected":[{"type":"plugin","slug":"alobaidi-captcha","name":"Alobaidi Captcha","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:13:05Z","updated":"2025-08-15T08:25:42Z"},{"id":"wordfence:44f64753-920f-4099-9cb1-018b24f972eb","source":"wordfence","cve":"CVE-2021-38332","title":"On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f64753-920f-4099-9cb1-018b24f972eb?source=api-prod","affected":[{"type":"plugin","slug":"ops-robots-txt","name":"On Page SEO + Social Live Chat","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:44f691f2-b3f4-49b7-8710-015b5b11db18","source":"wordfence","cve":"CVE-2024-1492","title":"WPify Woo Czech <= 4.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f691f2-b3f4-49b7-8710-015b5b11db18?source=api-prod","affected":[{"type":"plugin","slug":"wpify-woo","name":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:29Z"},{"id":"wordfence:44f7c455-7d1f-44c0-b2dc-828b1b740a46","source":"wordfence","cve":"CVE-2026-65532","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44f7c455-7d1f-44c0-b2dc-828b1b740a46?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:25:58Z"},{"id":"wordfence:44fad31c-6bf7-49c1-a03b-5cda0b26b38f","source":"wordfence","cve":"CVE-2024-50479","title":"Woocommerce Quote Calculator <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44fad31c-6bf7-49c1-a03b-5cda0b26b38f?source=api-prod","affected":[{"type":"plugin","slug":"woo-quote-calculator-order","name":"Woocommerce Quote Calculator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:12:23Z"},{"id":"wordfence:44fcc1c1-3a22-4ac8-923e-5c56c14e3dab","source":"wordfence","cve":"CVE-2025-68541","title":"Ippsum <= 1.2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44fcc1c1-3a22-4ac8-923e-5c56c14e3dab?source=api-prod","affected":[{"type":"theme","slug":"ippsum","name":"Ippsum - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-25T15:31:22Z"},{"id":"wordfence:44fd7e13-f48a-43c6-a735-15036aa03005","source":"wordfence","cve":"CVE-2026-4032","title":"CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44fd7e13-f48a-43c6-a735-15036aa03005?source=api-prod","affected":[{"type":"plugin","slug":"codecolorer","name":"CodeColorer","from":"*","from_inclusive":true,"to":"0.10.1","to_inclusive":true,"patched_in":"0.10.2"}],"published":"2026-04-15T15:22:30Z","updated":"2026-04-16T03:36:35Z"},{"id":"wordfence:44fde2c8-8012-4ede-8455-08b8e744ba36","source":"wordfence","cve":"CVE-2026-3220","title":"Multiple Plugins <= Multiple Versions - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/44fde2c8-8012-4ede-8455-08b8e744ba36?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":false,"patched_in":"3.1.15"},{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"},{"type":"plugin","slug":"UNKNOWN-CVE-2024-32532-1","name":"Speed Optimizer","from":"*","from_inclusive":true,"to":"7.7.9","to_inclusive":false,"patched_in":"7.7.9"}],"published":"2026-04-27T00:00:00Z","updated":"2026-07-30T12:39:26Z"},{"id":"wordfence:45029d47-0359-4de2-9d6a-fb2c51edcf75","source":"wordfence","cve":"CVE-2026-80488","title":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45029d47-0359-4de2-9d6a-fb2c51edcf75?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":false,"patched_in":"9.0"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:48:10Z"},{"id":"wordfence:4508d3a9-cf3e-4fc6-8788-a62942100d1a","source":"wordfence","cve":"CVE-2025-58923","title":"Critique <= 1.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4508d3a9-cf3e-4fc6-8788-a62942100d1a?source=api-prod","affected":[{"type":"theme","slug":"critique","name":"Critique - Newspaper & Review Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:31:39Z"},{"id":"wordfence:450d0748-93d6-448a-97a2-06fc2f8065b3","source":"wordfence","cve":"CVE-2024-0449","title":"ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/450d0748-93d6-448a-97a2-06fc2f8065b3?source=api-prod","affected":[{"type":"plugin","slug":"artibot","name":"ArtiBot Free Chat Bot for WebSites","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:16Z"},{"id":"wordfence:450d4c30-b799-44c9-b60e-a1d701e9055e","source":"wordfence","cve":"CVE-2021-24172","title":"VM Backups <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/450d4c30-b799-44c9-b60e-a1d701e9055e?source=api-prod","affected":[{"type":"plugin","slug":"vm-backups","name":"VM Backups","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:450e5cfb-8427-4c50-b1a3-8fceb5c78099","source":"wordfence","cve":"CVE-2025-31799","title":"Publitio <= 2.1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/450e5cfb-8427-4c50-b1a3-8fceb5c78099?source=api-prod","affected":[{"type":"plugin","slug":"publitio","name":"Publitio","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-04-01T00:00:00Z","updated":"2025-09-11T14:45:14Z"},{"id":"wordfence:45104ab0-4a07-4b0f-9d98-04857a5f01a8","source":"wordfence","cve":"CVE-2024-54327","title":"UNIVERSAM < 8.59 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45104ab0-4a07-4b0f-9d98-04857a5f01a8?source=api-prod","affected":[{"type":"plugin","slug":"universam-demo","name":"UNIVERSAM","from":"*","from_inclusive":true,"to":"8.59","to_inclusive":false,"patched_in":"8.59"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:21:55Z"},{"id":"wordfence:45112069-9831-41d5-b868-8007ccfe9839","source":"wordfence","cve":"CVE-2024-34375","title":"Sheets To WP Table Live Sync <= 3.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45112069-9831-41d5-b868-8007ccfe9839?source=api-prod","affected":[{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:00:28Z"},{"id":"wordfence:4513d7f3-e941-4ea6-a64b-bef5b298f188","source":"wordfence","cve":"CVE-2025-48244","title":"Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4513d7f3-e941-4ea6-a64b-bef5b298f188?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.9.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:46:37Z"},{"id":"wordfence:4514bd5d-05bd-4e9d-bd44-9a594d8c4145","source":"wordfence","cve":"CVE-2025-26742","title":"Gallery for Social Photo <= 1.0.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4514bd5d-05bd-4e9d-bd44-9a594d8c4145?source=api-prod","affected":[{"type":"plugin","slug":"feed-instagram-lite","name":"Gallery for Social Photo","from":"*","from_inclusive":true,"to":"1.0.0.36","to_inclusive":true,"patched_in":"1.0.0.37"}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-03T14:50:20Z"},{"id":"wordfence:4515507c-a0a4-4e45-8112-fedd117e425f","source":"wordfence","cve":"CVE-2019-9646","title":"Contact Form Email <= 1.2.65 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4515507c-a0a4-4e45-8112-fedd117e425f?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.2.66","to_inclusive":false,"patched_in":"1.2.66"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45163d7f-59c9-4bce-95a7-5b56e1cc018b","source":"wordfence","cve":"","title":"WP Symposium <= 12.11 - SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45163d7f-59c9-4bce-95a7-5b56e1cc018b?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"12.11","to_inclusive":true,"patched_in":"12.12"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4517bd04-20ce-4686-a933-d34464a5b691","source":"wordfence","cve":"","title":"RokStories <= 1.25 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4517bd04-20ce-4686-a933-d34464a5b691?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokstories","name":"RokStories","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45180c8e-0625-4a21-b3a1-673abe52d78f","source":"wordfence","cve":"CVE-2023-51487","title":"ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45180c8e-0625-4a21-b3a1-673abe52d78f?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45185f25-9a1f-411d-9d2a-295b5ceb5629","source":"wordfence","cve":"CVE-2026-12654","title":"Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45185f25-9a1f-411d-9d2a-295b5ceb5629?source=api-prod","affected":[{"type":"plugin","slug":"woo-stripe-payment","name":"Payment Plugins for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-07-23T18:32:05Z","updated":"2026-07-24T06:52:00Z"},{"id":"wordfence:451ca8a1-9354-462a-a110-c0c813cf0725","source":"wordfence","cve":"CVE-2024-3031","title":"Fluid Notification Bar <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/451ca8a1-9354-462a-a110-c0c813cf0725?source=api-prod","affected":[{"type":"plugin","slug":"fluid-notification-bar","name":"Fluid Notification Bar","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:15:04Z","updated":"2024-06-04T05:32:14Z"},{"id":"wordfence:451d4ecd-f3d7-4029-8d39-85d2a7ed459c","source":"wordfence","cve":"CVE-2024-29791","title":"Bulk NoIndex & NoFollow Toolkit <= 2.01 - Reflected Cross-Site Scripting via tab, order, and orderby","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/451d4ecd-f3d7-4029-8d39-85d2a7ed459c?source=api-prod","affected":[{"type":"plugin","slug":"bulk-noindex-nofollow-toolkit-by-mad-fish","name":"Bulk NoIndex & NoFollow Toolkit","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.10"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T14:24:26Z"},{"id":"wordfence:451db756-9d62-4c8e-b735-e5e5207b81e3","source":"wordfence","cve":"CVE-2024-6027","title":"Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/451db756-9d62-4c8e-b735-e5e5207b81e3?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-06-20T20:56:18Z","updated":"2024-06-21T09:39:38Z"},{"id":"wordfence:4522480a-dfbf-4ff4-93c2-68b8cc15367c","source":"wordfence","cve":"CVE-2015-10101","title":"Google Analytics Top Content Widget <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4522480a-dfbf-4ff4-93c2-68b8cc15367c?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-top-posts-widget","name":"Google Analytics Top Content Widget","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45240c80-44b3-45d6-b23e-0d4c29cca502","source":"wordfence","cve":"CVE-2025-39461","title":"Docket Cache <= 24.07.02 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45240c80-44b3-45d6-b23e-0d4c29cca502?source=api-prod","affected":[{"type":"plugin","slug":"docket-cache","name":"Docket Cache \u2013 Object Cache Accelerator","from":"*","from_inclusive":true,"to":"24.07.02","to_inclusive":true,"patched_in":"24.07.03"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:38:47Z"},{"id":"wordfence:45260858-0a18-48c0-a3a9-2d5c4649ae5a","source":"wordfence","cve":"CVE-2025-13355","title":"URL Shortify <= 1.11.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45260858-0a18-48c0-a3a9-2d5c4649ae5a?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-19T20:30:01Z"},{"id":"wordfence:4526ea6c-f4e7-40bb-836a-5630b9b6b334","source":"wordfence","cve":"CVE-2024-2696","title":"Swift Framework < 2024.04.30 Authenticated (Admin+) Stored Cross-Site Scripting via Auth","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4526ea6c-f4e7-40bb-836a-5630b9b6b334?source=api-prod","affected":[{"type":"plugin","slug":"socialdriver-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2024.04.30","to_inclusive":false,"patched_in":"2024.04.30"}],"published":"2024-06-21T00:00:00Z","updated":"2024-08-02T20:13:13Z"},{"id":"wordfence:4528a772-6758-4a6e-a325-5f9fd9f1b71d","source":"wordfence","cve":"CVE-2021-39308","title":"WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4528a772-6758-4a6e-a325-5f9fd9f1b71d?source=api-prod","affected":[{"type":"plugin","slug":"woo-myghpay-payment-gateway","name":"myghpay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4528f805-bbf3-4a0f-a06f-879c6e607bfa","source":"wordfence","cve":"CVE-2023-47519","title":"WooCommerce Product Table Lite <= 2.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f805-bbf3-4a0f-a06f-879c6e607bfa?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4528f9a1-7027-4aa9-b006-bea84aa19c84","source":"wordfence","cve":"CVE-2023-6635","title":"EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=api-prod","affected":[{"type":"plugin","slug":"block-options","name":"Gutenberg Block Editor Toolkit \u2013 EditorsKit","from":"*","from_inclusive":true,"to":"1.40.3","to_inclusive":true,"patched_in":"1.40.4"}],"published":"2023-12-16T00:00:00Z","updated":"2024-02-05T21:21:43Z"},{"id":"wordfence:4529464e-6830-4c2a-8146-79cf5fc1bc7c","source":"wordfence","cve":"CVE-2024-44001","title":"Royal Elementor Addons <= 1.3.982 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4529464e-6830-4c2a-8146-79cf5fc1bc7c?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.982","to_inclusive":true,"patched_in":"1.3.985"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:59:13Z"},{"id":"wordfence:452e9acc-4029-4f43-9941-c1aa2a413e34","source":"wordfence","cve":"","title":"Lean WP <= 1.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/452e9acc-4029-4f43-9941-c1aa2a413e34?source=api-prod","affected":[{"type":"plugin","slug":"lean-wp","name":"Lean WP","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:452ed03a-2f02-417d-93c9-d883a616a153","source":"wordfence","cve":"CVE-2022-36796","title":"CallRail Phone Call Tracking <= 0.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/452ed03a-2f02-417d-93c9-d883a616a153?source=api-prod","affected":[{"type":"plugin","slug":"callrail-phone-call-tracking","name":"CallRail Phone Call Tracking","from":"*","from_inclusive":true,"to":"0.4.9","to_inclusive":true,"patched_in":"0.4.10"}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45323807-c347-44ac-bf22-11b4feda02e6","source":"wordfence","cve":"","title":"Eunice (All Versions) - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45323807-c347-44ac-bf22-11b4feda02e6?source=api-prod","affected":[{"type":"theme","slug":"eunice","name":"Eunice","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4532547d-9077-47cc-80ba-bf855cd3f22b","source":"wordfence","cve":"CVE-2024-54236","title":"Ni WooCommerce Bulk Product Editor <= 1.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4532547d-9077-47cc-80ba-bf855cd3f22b?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-product-editor","name":"Ni WooCommerce Bulk Product Editor","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:26:33Z"},{"id":"wordfence:4532cb38-453b-460c-879d-6f0e1caacafc","source":"wordfence","cve":"CVE-2025-11204","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4532cb38-453b-460c-879d-6f0e1caacafc?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.6.2","to_inclusive":true,"patched_in":"6.0.6.3"}],"published":"2025-10-07T16:05:36Z","updated":"2025-10-08T04:23:40Z"},{"id":"wordfence:4534efd4-0e6b-4784-8f81-4a643f657c66","source":"wordfence","cve":"CVE-2024-31287","title":"Media Library Folders <= 8.1.8 - Authenticated (Author+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4534efd4-0e6b-4784-8f81-4a643f657c66?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.1.8","to_inclusive":true,"patched_in":"8.1.9"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:37:22Z"},{"id":"wordfence:4536c41c-dc05-4384-80f4-49c3197965b1","source":"wordfence","cve":"CVE-2026-104992","title":"Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4536c41c-dc05-4384-80f4-49c3197965b1?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"9.0","from_inclusive":true,"to":"9.9.1","to_inclusive":true,"patched_in":"9.9.2"}],"published":"2026-11-06T21:20:27Z","updated":"2026-11-07T09:25:46Z"},{"id":"wordfence:45386740-2daf-4bd2-bab9-26e3d3e44438","source":"wordfence","cve":"CVE-2025-15694","title":"Joli Table Of Contents 2.0.0 - 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45386740-2daf-4bd2-bab9-26e3d3e44438?source=api-prod","affected":[{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"2.0.0","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:42:51Z"},{"id":"wordfence:453b246f-7e39-4adb-9506-77d96146ab50","source":"wordfence","cve":"CVE-2025-3869","title":"4stats <= 2.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453b246f-7e39-4adb-9506-77d96146ab50?source=api-prod","affected":[{"type":"plugin","slug":"4stats","name":"4stats","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-05-23T13:53:37Z","updated":"2025-05-24T02:23:03Z"},{"id":"wordfence:453c0267-c69c-4f70-86f7-eda320a3da05","source":"wordfence","cve":"CVE-2025-31898","title":"MediaView <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453c0267-c69c-4f70-86f7-eda320a3da05?source=api-prod","affected":[{"type":"plugin","slug":"mediaview","name":"MediaView","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-04-02T00:00:00Z","updated":"2025-05-21T13:52:00Z"},{"id":"wordfence:453c656a-c26d-44c3-bc7d-7fc502a00b03","source":"wordfence","cve":"CVE-2021-24322","title":"Database Backup for WordPress <= 2.3.3 - Authenticated Stored Cross-Site Scripting via backup_receipient Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453c656a-c26d-44c3-bc7d-7fc502a00b03?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2021-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:453d8918-32dc-43d6-8969-71f719536891","source":"wordfence","cve":"CVE-2025-5275","title":"Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453d8918-32dc-43d6-8969-71f719536891?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.6.1","to_inclusive":true,"patched_in":"1.8.6.2"}],"published":"2025-06-25T14:11:07Z","updated":"2025-06-26T02:22:22Z"},{"id":"wordfence:453dc1f9-0b79-467c-9344-21d3ed06a9d0","source":"wordfence","cve":"CVE-2025-62991","title":"Minamaze <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453dc1f9-0b79-467c-9344-21d3ed06a9d0?source=api-prod","affected":[{"type":"theme","slug":"minamaze","name":"Minamaze","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:37:59Z"},{"id":"wordfence:453f6a60-1acd-4c24-a252-91c7b74ad631","source":"wordfence","cve":"CVE-2026-118100","title":"BuddyForms <= 2.10.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/453f6a60-1acd-4c24-a252-91c7b74ad631?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:46:52Z"},{"id":"wordfence:454091ac-8765-4bda-ac6e-69537b43f9a7","source":"wordfence","cve":"CVE-2022-4717","title":"Strong Testimonials <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/454091ac-8765-4bda-ac6e-69537b43f9a7?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4541a7e1-4e46-4681-83e3-1c2e38396204","source":"wordfence","cve":"CVE-2021-34651","title":"Scribble Maps <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4541a7e1-4e46-4681-83e3-1c2e38396204?source=api-prod","affected":[{"type":"plugin","slug":"scribble-maps","name":"Scribble Maps","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4541ab5d-5c99-46e8-bc78-fa2c5cffd09b","source":"wordfence","cve":"","title":"Re-attacher by BestWebSoft < 1.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4541ab5d-5c99-46e8-bc78-fa2c5cffd09b?source=api-prod","affected":[{"type":"plugin","slug":"re-attacher","name":"Re-attacher by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45426cdd-2721-4959-8f0b-13025f775d62","source":"wordfence","cve":"CVE-2023-41734","title":"Insert Estimated Reading Time <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45426cdd-2721-4959-8f0b-13025f775d62?source=api-prod","affected":[{"type":"plugin","slug":"insert-estimated-reading-time","name":"Insert Estimated Reading Time","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4542b0f8-c9ee-4992-b737-e5f727c7b5b0","source":"wordfence","cve":"CVE-2024-4698","title":"Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4542b0f8-c9ee-4992-b737-e5f727c7b5b0?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-carousel-elementor","name":"Testimonial Carousel For Elementor","from":"*","from_inclusive":true,"to":"10.1.1","to_inclusive":true,"patched_in":"10.2.0"}],"published":"2024-05-17T00:00:00Z","updated":"2024-06-13T14:16:35Z"},{"id":"wordfence:45494716-b9d4-462a-808a-c10f01aa0eb0","source":"wordfence","cve":"CVE-2025-60191","title":"Premmerce Wishlist for WooCommerce <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45494716-b9d4-462a-808a-c10f01aa0eb0?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-07-28T00:00:00Z","updated":"2026-01-06T19:00:59Z"},{"id":"wordfence:454a05eb-fd4e-4125-abd0-7ba90ee2048a","source":"wordfence","cve":"CVE-2026-120552","title":"SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/454a05eb-fd4e-4125-abd0-7ba90ee2048a?source=api-prod","affected":[{"type":"plugin","slug":"seo-engine","name":"SEO Engine \u2013 Smart SEO with AI, Schema & Redirection for WordPress","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2026-10-30T15:47:27Z","updated":"2026-11-03T04:43:08Z"},{"id":"wordfence:454d8cb3-58f3-47e1-9155-75bb9404ee1e","source":"wordfence","cve":"CVE-2026-32558","title":"WordPress & WooCommerce Affiliate Program <= 8.9.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/454d8cb3-58f3-47e1-9155-75bb9404ee1e?source=api-prod","affected":[{"type":"plugin","slug":"wp-wc-affiliate-program","name":"WordPress & WooCommerce Affiliate Program","from":"*","from_inclusive":true,"to":"8.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T07:41:02Z","updated":"2026-09-10T19:11:20Z"},{"id":"wordfence:4550681f-d115-4451-9839-7862b84714fe","source":"wordfence","cve":"CVE-2023-30872","title":"BSK Forms Blacklist <= 3.6.2 - Authenticated (Administrator+) SQL Injection via 'order' and 'orderby'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4550681f-d115-4451-9839-7862b84714fe?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravityforms-blacklist","name":"BSK Forms Blacklist","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4551afe6-905e-489c-83ce-0ad2f632e69f","source":"wordfence","cve":"CVE-2026-59530","title":"Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4551afe6-905e-489c-83ce-0ad2f632e69f?source=api-prod","affected":[{"type":"plugin","slug":"woo-stripe-payment","name":"Payment Plugins for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:24:08Z"},{"id":"wordfence:4552786b-3362-45bf-9012-cd52f69f0462","source":"wordfence","cve":"CVE-2026-2283","title":"User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4552786b-3362-45bf-9012-cd52f69f0462?source=api-prod","affected":[{"type":"plugin","slug":"user-login-history","name":"User Login History","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-08-15T17:24:29Z","updated":"2026-08-16T05:27:28Z"},{"id":"wordfence:45527d6c-6866-44e6-85c2-5be984afbbc9","source":"wordfence","cve":"CVE-2026-3124","title":"Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45527d6c-6866-44e6-85c2-5be984afbbc9?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-03-29T12:42:40Z","updated":"2026-03-30T01:24:44Z"},{"id":"wordfence:45531492-9238-4e2e-ad37-d0e5c457af07","source":"wordfence","cve":"CVE-2024-56046","title":"WPLMS <= 1.9.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45531492-9238-4e2e-ad37-d0e5c457af07?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.9.1"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:57:32Z"},{"id":"wordfence:4553a7e7-6f87-4e23-b96e-2cf845d6ba60","source":"wordfence","cve":"CVE-2024-56037","title":"User Referral <= 8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4553a7e7-6f87-4e23-b96e-2cf845d6ba60?source=api-prod","affected":[{"type":"plugin","slug":"user-referral-free","name":"User Referral ( Free ) \u2013 Points, Rewards, Loyalty, Leader Board & Referrals Plugin","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:06:29Z"},{"id":"wordfence:4554235f-1790-4be7-a575-02fb18c6a4a9","source":"wordfence","cve":"CVE-2022-50949","title":"Videos sync PDF <= 1.7.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4554235f-1790-4be7-a575-02fb18c6a4a9?source=api-prod","affected":[{"type":"plugin","slug":"video-synchro-pdf","name":"Videos sync PDF","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2026-07-29T21:10:01Z"},{"id":"wordfence:4555b16b-dd30-494b-ada9-33006cd729cf","source":"wordfence","cve":"CVE-2024-11183","title":"Simple Side Tab <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4555b16b-dd30-494b-ada9-33006cd729cf?source=api-prod","affected":[{"type":"plugin","slug":"simple-side-tab","name":"Simple Side Tab","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-11-16T00:00:00Z","updated":"2024-12-12T18:39:43Z"},{"id":"wordfence:4559a3e5-e4f3-44b3-826e-acdf3bf5c8ae","source":"wordfence","cve":"CVE-2025-0466","title":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning <= 4.24.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4559a3e5-e4f3-44b3-826e-acdf3bf5c8ae?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.24.3","to_inclusive":true,"patched_in":"4.24.4"}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-26T20:23:52Z"},{"id":"wordfence:455b0b34-1421-46eb-8fcf-3b68c5068249","source":"wordfence","cve":"CVE-2021-25088","title":"XML Sitemaps <= 4.1.1 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/455b0b34-1421-46eb-8fcf-3b68c5068249?source=api-prod","affected":[{"type":"plugin","slug":"google-sitemap-generator","name":"XML Sitemap Generator for Google","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:455b9695-e140-4bdb-b626-5c1695518563","source":"wordfence","cve":"CVE-2024-6317","title":"Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/455b9695-e140-4bdb-b626-5c1695518563?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-09-06T15:04:02Z"},{"id":"wordfence:455d7ee8-9a5a-41f6-b0ae-c55f04b41e52","source":"wordfence","cve":"","title":"AdPush <= 1.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/455d7ee8-9a5a-41f6-b0ae-c55f04b41e52?source=api-prod","affected":[{"type":"plugin","slug":"adsense-plugin","name":"AdPush","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.30"}],"published":"2015-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:455fb4af-47cf-42d5-8232-f00442bca761","source":"wordfence","cve":"CVE-2024-11412","title":"Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/455fb4af-47cf-42d5-8232-f00442bca761?source=api-prod","affected":[{"type":"plugin","slug":"shine-pdf","name":"Shine PDF Embeder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:39:50Z","updated":"2024-11-21T02:06:33Z"},{"id":"wordfence:45608b2a-997e-447b-b3f3-d57a199bf76b","source":"wordfence","cve":"CVE-2026-112865","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45608b2a-997e-447b-b3f3-d57a199bf76b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-26T10:00:00Z","updated":"2026-10-28T01:17:11Z"},{"id":"wordfence:456377ec-1a73-4f9b-9fdf-0b5597e78aa5","source":"wordfence","cve":"CVE-2026-66688","title":"Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/456377ec-1a73-4f9b-9fdf-0b5597e78aa5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.45.2","to_inclusive":true,"patched_in":"1.45.2.1"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-07T18:41:46Z"},{"id":"wordfence:45647fa6-a98d-4eb4-a287-f523e434688b","source":"wordfence","cve":"CVE-2024-9305","title":"AppPresser \u2013 Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:05Z"},{"id":"wordfence:45668368-5846-41bb-b862-dfeb283e83cf","source":"wordfence","cve":"CVE-2023-47683","title":"WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45668368-5846-41bb-b862-dfeb283e83cf?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.6.6","to_inclusive":true,"patched_in":"7.6.7"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45671cab-f719-4ee6-af81-7c19b37b8d91","source":"wordfence","cve":"CVE-2023-47518","title":"Restrict Categories <= 2.6.4 - Reflected Cross-Site Scripting via rc-search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45671cab-f719-4ee6-af81-7c19b37b8d91?source=api-prod","affected":[{"type":"plugin","slug":"restrict-categories","name":"Restrict Categories","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45690747-0b8d-4e2e-8dd0-07c12791c064","source":"wordfence","cve":"CVE-2026-3017","title":"Smart Post Show \u2013 Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45690747-0b8d-4e2e-8dd0-07c12791c064?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.0.13"}],"published":"2026-04-13T16:33:40Z","updated":"2026-04-14T05:30:37Z"},{"id":"wordfence:456bae19-6626-4505-828e-dbf3e576ad10","source":"wordfence","cve":"CVE-2025-22565","title":"vooPlayer v4 <= 4.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/456bae19-6626-4505-828e-dbf3e576ad10?source=api-prod","affected":[{"type":"plugin","slug":"vooplayer","name":"vooPlayer v4","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-04-22T21:43:18Z"},{"id":"wordfence:456c13f5-4a8b-4eea-a2a0-f37f8508551b","source":"wordfence","cve":"CVE-2020-36745","title":"WP Project Manager  <= 2.4.0 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/456c13f5-4a8b-4eea-a2a0-f37f8508551b?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:456e4cda-a797-469e-9b48-62345e9876e6","source":"wordfence","cve":"CVE-2025-59570","title":"Mail Mint <= 1.18.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/456e4cda-a797-469e-9b48-62345e9876e6?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.18.6","to_inclusive":true,"patched_in":"1.18.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:57:40Z"},{"id":"wordfence:456f038c-85a4-426e-b9e0-3acf91f9b93a","source":"wordfence","cve":"CVE-2015-9512","title":"Easy Digital Downloads (Various Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/456f038c-85a4-426e-b9e0-3acf91f9b93a?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"1.8","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"1.9","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.0","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.1","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.2","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.3","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45700ca9-8bda-4148-b19f-86ed39c60117","source":"wordfence","cve":"CVE-2021-36871","title":"WP Google Maps Pro <= 8.1.11 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45700ca9-8bda-4148-b19f-86ed39c60117?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps-pro","name":"WP Google Maps Pro","from":"*","from_inclusive":true,"to":"8.1.11","to_inclusive":true,"patched_in":"8.1.12"}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45726bd2-5b32-4b7b-b990-8ede3aae107e","source":"wordfence","cve":"CVE-2025-46536","title":"Carousel-of-post-images <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45726bd2-5b32-4b7b-b990-8ede3aae107e?source=api-prod","affected":[{"type":"plugin","slug":"carousel-of-post-images","name":"Carousel-of-post-images","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:28:31Z"},{"id":"wordfence:45745704-0e43-4235-8eff-7175ac091a8b","source":"wordfence","cve":"CVE-2025-32257","title":"1 Click WordPress Migration <= 3.1.14 - Unauthenticated Information Disclsoure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45745704-0e43-4235-8eff-7175ac091a8b?source=api-prod","affected":[{"type":"plugin","slug":"1-click-migration","name":"1-Click WordPress Migration Plugin \u2013 Backup, Migrate & Clone","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2025-04-04T00:00:00Z","updated":"2026-09-09T15:51:17Z"},{"id":"wordfence:45754b5b-8f94-4806-a931-bb423450682c","source":"wordfence","cve":"CVE-2023-0891","title":"Stagtools <= 2.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45754b5b-8f94-4806-a931-bb423450682c?source=api-prod","affected":[{"type":"plugin","slug":"stagtools","name":"StagTools","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45760755-472a-4b5f-abdf-373173ef64d3","source":"wordfence","cve":"CVE-2025-47453","title":"WP Smart Import <= 1.1.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45760755-472a-4b5f-abdf-373173ef64d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-import","name":"WP Smart Import : Import any XML File to WordPress","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:26:27Z"},{"id":"wordfence:45785032-2bbf-4398-94a1-f819f8e8a9ca","source":"wordfence","cve":"CVE-2022-1557","title":"ULeak Security & Monitoring Plugin <= 1.2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45785032-2bbf-4398-94a1-f819f8e8a9ca?source=api-prod","affected":[{"type":"plugin","slug":"uleak-security-dashboard","name":"ULeak Security & Monitoring Plugin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2022-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:457865ca-cbf8-42ee-928d-2c894d9d62de","source":"wordfence","cve":"CVE-2021-24721","title":"Loco Translate <= 2.5.3 - Authenticated PHP Code Injection","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/457865ca-cbf8-42ee-928d-2c894d9d62de?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45792c95-8abf-4d0c-85a1-cda6f505949d","source":"wordfence","cve":"CVE-2022-4652","title":"Video Background <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45792c95-8abf-4d0c-85a1-cda6f505949d?source=api-prod","affected":[{"type":"plugin","slug":"video-background","name":"Video Background","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:457b5066-da37-4877-9abe-c912bc201f29","source":"wordfence","cve":"CVE-2024-4637","title":"Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/457b5066-da37-4877-9abe-c912bc201f29?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.7.11"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-04T09:31:47Z"},{"id":"wordfence:457c4e56-c2a0-451f-a4a6-e7fb7bf7b0e0","source":"wordfence","cve":"CVE-2024-0380","title":"WP Recipe Maker <= 9.1.0 - Directory Traversal","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/457c4e56-c2a0-451f-a4a6-e7fb7bf7b0e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:36:16Z"},{"id":"wordfence:4580c687-5cc9-4b04-b272-0c41260d8db9","source":"wordfence","cve":"CVE-2025-49353","title":"Noindex by Path <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4580c687-5cc9-4b04-b272-0c41260d8db9?source=api-prod","affected":[{"type":"plugin","slug":"noindex-by-path","name":"Noindex by Path","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:17:40Z"},{"id":"wordfence:45816c45-42bc-4163-b700-a1e913f32c97","source":"wordfence","cve":"CVE-2026-15988","title":"AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45816c45-42bc-4163-b700-a1e913f32c97?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-07-31T18:40:58Z","updated":"2026-08-01T06:48:48Z"},{"id":"wordfence:45850fe1-017b-4bfa-aeb0-73e495e74c0e","source":"wordfence","cve":"CVE-2024-51895","title":"Minical Hotel Booking Plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45850fe1-017b-4bfa-aeb0-73e495e74c0e?source=api-prod","affected":[{"type":"plugin","slug":"minical","name":"Minical Hotel Booking Plugin","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:43:27Z"},{"id":"wordfence:45851efe-2584-4b5e-8e4c-24f289d3bc32","source":"wordfence","cve":"CVE-2023-1866","title":"YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45851efe-2584-4b5e-8e4c-24f289d3bc32?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45873654-bf0d-4538-b07c-56ed8db3bafb","source":"wordfence","cve":"CVE-2024-30449","title":"Booking Activities <= 1.15.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45873654-bf0d-4538-b07c-56ed8db3bafb?source=api-prod","affected":[{"type":"plugin","slug":"booking-activities","name":"Booking Activities","from":"*","from_inclusive":true,"to":"1.15.19","to_inclusive":true,"patched_in":"1.15.20"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:18:07Z"},{"id":"wordfence:45883d55-cecd-43b3-a4d7-145f664e784f","source":"wordfence","cve":"CVE-2025-39511","title":"Pinterest Automatic Pin <= 4.18.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45883d55-cecd-43b3-a4d7-145f664e784f?source=api-prod","affected":[{"type":"plugin","slug":"wp-pinterest-automatic","name":"Pinterest Automatic","from":"*","from_inclusive":true,"to":"4.18.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-27T15:05:47Z"},{"id":"wordfence:458a7c5b-9354-4a65-a5a1-92800374173d","source":"wordfence","cve":"CVE-2026-96350","title":"Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458a7c5b-9354-4a65-a5a1-92800374173d?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:50:06Z"},{"id":"wordfence:458aeb60-8610-49e8-8f77-2e306bfe7277","source":"wordfence","cve":"CVE-2024-37881","title":"SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458aeb60-8610-49e8-8f77-2e306bfe7277?source=api-prod","affected":[{"type":"plugin","slug":"siteguard","name":"SiteGuard WP Plugin","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-21T16:57:14Z"},{"id":"wordfence:458b58d1-81eb-4934-84ae-55ac66a71df7","source":"wordfence","cve":"CVE-2026-65494","title":"Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458b58d1-81eb-4934-84ae-55ac66a71df7?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:32:30Z"},{"id":"wordfence:458d5744-b2c1-4c3d-9b32-76e8174cbf4d","source":"wordfence","cve":"CVE-2025-31555","title":"ContentMX Content Publisher <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458d5744-b2c1-4c3d-9b32-76e8174cbf4d?source=api-prod","affected":[{"type":"plugin","slug":"contentmx-content-publisher","name":"ContentMX Content Publisher","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-03-31T00:00:00Z","updated":"2025-10-14T19:15:25Z"},{"id":"wordfence:458f6544-88f2-41e9-b6f8-9af9b03d991f","source":"wordfence","cve":"CVE-2024-51918","title":"Pay With Stripe <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458f6544-88f2-41e9-b6f8-9af9b03d991f?source=api-prod","affected":[{"type":"plugin","slug":"payments-stripe-gateway","name":"Pay With Stripe \u2013 Your WordPress Payments Stripe Gateway","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:51:20Z"},{"id":"wordfence:458f8d67-3395-4db1-8653-59550131c4bf","source":"wordfence","cve":"CVE-2026-27097","title":"CasaMia | Property Rental Real Estate WordPress Theme <= 1.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/458f8d67-3395-4db1-8653-59550131c4bf?source=api-prod","affected":[{"type":"theme","slug":"casamia","name":"CasaMia | Property Rental Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T16:16:30Z"},{"id":"wordfence:45906cc2-74ce-4882-950d-733a94547ab6","source":"wordfence","cve":"CVE-2025-69355","title":"Tickera <= 3.5.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45906cc2-74ce-4882-950d-733a94547ab6?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.6.4","to_inclusive":true,"patched_in":"3.5.6.5"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-14T14:56:03Z"},{"id":"wordfence:4591fb15-a280-42d2-91f6-6c33bbe64e22","source":"wordfence","cve":"CVE-2025-23848","title":"Hotspots Analytics <= 4.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4591fb15-a280-42d2-91f6-6c33bbe64e22?source=api-prod","affected":[{"type":"plugin","slug":"hotspots","name":"Hotspots Analytics","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:19:29Z"},{"id":"wordfence:4592fea7-65c4-45f6-8674-ae5f706db413","source":"wordfence","cve":"CVE-2016-20082","title":"A/B Test for WordPress <= 1.0.7 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4592fea7-65c4-45f6-8674-ae5f706db413?source=api-prod","affected":[{"type":"plugin","slug":"abtest","name":"A/B Test for WordPress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2016-03-21T00:00:00Z","updated":"2026-07-29T17:34:20Z"},{"id":"wordfence:459384b6-c73d-4e34-81d3-c0586cf50933","source":"wordfence","cve":"CVE-2026-14205","title":"Events Manager <= 2.2.4 - Authenticated (Subscriber+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459384b6-c73d-4e34-81d3-c0586cf50933?source=api-prod","affected":[{"type":"plugin","slug":"wp-events-manager","name":"WP Events Manager","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-17T16:24:24Z"},{"id":"wordfence:4596378b-90de-4de8-9543-15b45bdee902","source":"wordfence","cve":"CVE-2025-39535","title":"Vitepos <= 3.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4596378b-90de-4de8-9543-15b45bdee902?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:28:53Z"},{"id":"wordfence:459744db-d44a-480d-b05a-27c253bc358c","source":"wordfence","cve":"CVE-2026-106098","title":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps < 5.5.77 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459744db-d44a-480d-b05a-27c253bc358c?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.77","to_inclusive":false,"patched_in":"5.5.77"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:56Z"},{"id":"wordfence:4598202a-f883-44c9-83bf-e8b72e418e3a","source":"wordfence","cve":"CVE-2022-29408","title":"Advanced Contact form 7 DB <= 1.8.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4598202a-f883-44c9-83bf-e8b72e418e3a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2022-04-21T14:19:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4598ec69-98c5-4f98-b071-091958b31429","source":"wordfence","cve":"CVE-2026-106606","title":"YITH WooCommerce Affiliates <= 3.31.0 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4598ec69-98c5-4f98-b071-091958b31429?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-affiliates","name":"YITH WooCommerce Affiliates","from":"*","from_inclusive":true,"to":"3.31.0","to_inclusive":true,"patched_in":"3.31.1"}],"published":"2026-10-08T06:11:45Z","updated":"2026-10-13T13:42:35Z"},{"id":"wordfence:4599b145-cb89-48d4-8581-e1ee7a7bd323","source":"wordfence","cve":"CVE-2025-12023","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4599b145-cb89-48d4-8581-e1ee7a7bd323?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-11-20T17:01:39Z","updated":"2025-11-21T05:32:05Z"},{"id":"wordfence:459a5f66-b64d-48cf-87c1-f069f9f7f205","source":"wordfence","cve":"CVE-2026-107507","title":"Squadeno <= 1.11.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459a5f66-b64d-48cf-87c1-f069f9f7f205?source=api-prod","affected":[{"type":"plugin","slug":"squadeno-club-sports-manager","name":"Squadeno \u2013 Club Sports Manager","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:25:10Z"},{"id":"wordfence:459a64d4-4c51-4fc1-b293-0b662d1f9063","source":"wordfence","cve":"CVE-2025-58658","title":"Proof Factor &#8211; Social Proof Notifications <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459a64d4-4c51-4fc1-b293-0b662d1f9063?source=api-prod","affected":[{"type":"plugin","slug":"proof-factor-social-proof-notifications","name":"Proof Factor \u2013 Social Proof Notifications","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:47:44Z"},{"id":"wordfence:459b7fef-806c-4f5b-bb31-b7197750e941","source":"wordfence","cve":"CVE-2026-6079","title":"Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459b7fef-806c-4f5b-bb31-b7197750e941?source=api-prod","affected":[{"type":"plugin","slug":"material-dashboard","name":"Material Dashboard","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2026-08-04T18:26:27Z","updated":"2026-08-05T06:37:55Z"},{"id":"wordfence:459e405a-b676-4797-bf11-339bb382805b","source":"wordfence","cve":"CVE-2025-62874","title":"AnyComment <= 0.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459e405a-b676-4797-bf11-339bb382805b?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:36:50Z"},{"id":"wordfence:459f6d68-ce52-4e63-8fd9-071ef517a3ce","source":"wordfence","cve":"CVE-2024-0719","title":"Tabs Shortcode and Widget <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/459f6d68-ce52-4e63-8fd9-071ef517a3ce?source=api-prod","affected":[{"type":"plugin","slug":"tabs-shortcode-and-widget","name":"Tabs Shortcode and Widget","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-22T14:13:35Z"},{"id":"wordfence:45a1490f-1cfe-4a88-a5a2-ff01e794d7d3","source":"wordfence","cve":"CVE-2025-32536","title":"HTML5 Video Player with Playlist <= 2.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a1490f-1cfe-4a88-a5a2-ff01e794d7d3?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player-with-playlist","name":"HTML5 Video Player with Playlist","from":"*","from_inclusive":true,"to":"2.50","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:04:47Z"},{"id":"wordfence:45a14fc2-cc58-4d52-aad5-22c4880ccea1","source":"wordfence","cve":"CVE-2024-34815","title":"Import and export users and customers <= 1.26.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a14fc2-cc58-4d52-aad5-22c4880ccea1?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.5","to_inclusive":true,"patched_in":"1.26.6"}],"published":"2024-05-09T00:00:00Z","updated":"2026-04-15T20:49:22Z"},{"id":"wordfence:45a2f30d-9471-4358-b894-eb5a1bc2ff76","source":"wordfence","cve":"CVE-2026-85121","title":"Insurify <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a2f30d-9471-4358-b894-eb5a1bc2ff76?source=api-prod","affected":[{"type":"plugin","slug":"insurify","name":"Insurify \u2013 Order & Shipping Protection","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:13:42Z"},{"id":"wordfence:45a34fef-c2e0-4f2c-895b-ffac4859a501","source":"wordfence","cve":"CVE-2025-68035","title":"Tabby Checkout <= 5.8.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a34fef-c2e0-4f2c-895b-ffac4859a501?source=api-prod","affected":[{"type":"plugin","slug":"tabby-checkout","name":"Tabby Checkout","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:38:46Z"},{"id":"wordfence:45a42f20-a4d7-4c8e-a144-505a6723a2a0","source":"wordfence","cve":"CVE-2024-3895","title":"WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a42f20-a4d7-4c8e-a144-505a6723a2a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-datepicker","name":"WP Datepicker","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-23T00:00:00Z","updated":"2024-05-02T16:52:01Z"},{"id":"wordfence:45a49dca-2ed2-44cf-a0fe-0f1440a78cc2","source":"wordfence","cve":"CVE-2022-37601","title":"loader-utils (JS package) < 2.0.3 - Prototype Pollution","severity":"medium","cvss":5.4,"cwe":"CWE-915","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a49dca-2ed2-44cf-a0fe-0f1440a78cc2?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"},{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45a62dd0-386c-41b3-b8dd-ced443da9f92","source":"wordfence","cve":"CVE-2020-36701","title":"Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a62dd0-386c-41b3-b8dd-ced443da9f92?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2020-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45a778cc-0063-4c07-ae57-bd473976e68c","source":"wordfence","cve":"CVE-2025-49255","title":"Ruza <= 1.0.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a778cc-0063-4c07-ae57-bd473976e68c?source=api-prod","affected":[{"type":"theme","slug":"ruza","name":"Ruza - Beauty Cosmetics Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:33:39Z"},{"id":"wordfence:45a7a49c-4fe4-49f0-9399-400116e6606b","source":"wordfence","cve":"CVE-2026-24540","title":"Integrate Google Drive <= 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a7a49c-4fe4-49f0-9399-400116e6606b?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-26T15:23:45Z"},{"id":"wordfence:45a870f4-7ad1-447b-81ea-5d9e9b67b1bb","source":"wordfence","cve":"CVE-2023-30873","title":"WP Docs <= 1.9.8 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45a870f4-7ad1-447b-81ea-5d9e9b67b1bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45ac52e1-9f0e-499e-9125-2581940f5bdd","source":"wordfence","cve":"CVE-2023-6494","title":"WPC Smart Quick View for WooCommerce <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ac52e1-9f0e-499e-9125-2581940f5bdd?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-quick-view","name":"WPC Smart Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2024-04-12T00:00:00Z","updated":"2024-07-29T21:36:16Z"},{"id":"wordfence:45ada7a4-466b-4e73-8869-e1178e4fc67a","source":"wordfence","cve":"CVE-2024-12611","title":"School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ada7a4-466b-4e73-8869-e1178e4fc67a?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:25Z"},{"id":"wordfence:45adeeba-22b0-4758-bc21-afc019653ce8","source":"wordfence","cve":"CVE-2013-4339","title":"WordPress Core < 3.6.1 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45adeeba-22b0-4758-bc21-afc019653ce8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2013-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45b1584f-bfb4-4a60-b87b-945be980c36f","source":"wordfence","cve":"CVE-2026-113617","title":"Automated Import Products to Cart <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b1584f-bfb4-4a60-b87b-945be980c36f?source=api-prod","affected":[{"type":"plugin","slug":"auto-import-products-cart-dragdropfile","name":"Automated Import Products to Cart","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:24:08Z"},{"id":"wordfence:45b3ae9c-20a8-4b04-a49f-b02865dfd79c","source":"wordfence","cve":"CVE-2026-57330","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b3ae9c-20a8-4b04-a49f-b02865dfd79c?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:11:51Z"},{"id":"wordfence:45b627f9-e7c6-4bf6-b1c7-d607f3e083f8","source":"wordfence","cve":"CVE-2021-4395","title":"Abandoned Cart Recovery for WooCommerce <= 1.0.4 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b627f9-e7c6-4bf6-b1c7-d607f3e083f8?source=api-prod","affected":[{"type":"plugin","slug":"woo-abandoned-cart-recovery","name":"Recarto \u2013 Abandoned Cart Recovery for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.4.1"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45b6a72a-9aa9-4d77-b250-575d55538110","source":"wordfence","cve":"CVE-2011-3981","title":"AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b6a72a-9aa9-4d77-b250-575d55538110?source=api-prod","affected":[{"type":"plugin","slug":"allwebmenus-wordpress-menu-plugin","name":"AllWebMenus WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2011-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45b72c06-5aed-464c-85e9-4c3510ebaee5","source":"wordfence","cve":"CVE-2025-28995","title":"Viral Loops WP Integration <= 3.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b72c06-5aed-464c-85e9-4c3510ebaee5?source=api-prod","affected":[{"type":"plugin","slug":"viral-loops-wp-integration","name":"Viral Loops WP Integration","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:26:00Z"},{"id":"wordfence:45b81d01-1ecc-4881-9e21-48b8fcb732ea","source":"wordfence","cve":"CVE-2026-15382","title":"Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b81d01-1ecc-4881-9e21-48b8fcb732ea?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.4","to_inclusive":false,"patched_in":"3.21.4"}],"published":"2026-07-10T00:00:00Z","updated":"2026-08-04T20:05:22Z"},{"id":"wordfence:45b9f761-1634-4f70-8c25-956d369cb6d8","source":"wordfence","cve":"CVE-2025-12185","title":"StaffList <= 3.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45b9f761-1634-4f70-8c25-956d369cb6d8?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2025-11-26T16:50:37Z","updated":"2025-11-27T05:17:45Z"},{"id":"wordfence:45ba8203-a8a0-4330-a264-c2f555d09ef0","source":"wordfence","cve":"","title":"Import Export All WordPress Images, Users & Post Types <= 3.8.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ba8203-a8a0-4330-a264-c2f555d09ef0?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":false,"patched_in":"3.8.8"}],"published":"2018-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45badd20-1ba8-44be-8a7c-2ce21261e208","source":"wordfence","cve":"CVE-2024-1653","title":"Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45badd20-1ba8-44be-8a7c-2ce21261e208?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:43:30Z"},{"id":"wordfence:45bb4a6f-560f-4dc8-9005-1e4c5727d56f","source":"wordfence","cve":"CVE-2025-49333","title":"Simple Membership <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45bb4a6f-560f-4dc8-9005-1e4c5727d56f?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:18:52Z"},{"id":"wordfence:45bc4b00-1b5e-4c2e-96c7-77e03b86be5c","source":"wordfence","cve":"CVE-2026-116546","title":"WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45bc4b00-1b5e-4c2e-96c7-77e03b86be5c?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-10-30T18:33:46Z","updated":"2026-10-31T06:44:18Z"},{"id":"wordfence:45bd23c5-3894-4483-aa41-851b06c82e98","source":"wordfence","cve":"CVE-2026-25426","title":"E-cab Taxi Booking Manager for Woocommerce <= 2.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45bd23c5-3894-4483-aa41-851b06c82e98?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:28:20Z"},{"id":"wordfence:45bfa9fb-f35b-4fd4-8553-cf87bf69df6b","source":"wordfence","cve":"CVE-2024-2020","title":"Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45bfa9fb-f35b-4fd4-8553-cf87bf69df6b?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.1.56","to_inclusive":true,"patched_in":"5.1.57"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-13T15:26:46Z"},{"id":"wordfence:45c08d51-ed01-4f92-9290-1964c4f3657c","source":"wordfence","cve":"CVE-2015-9504","title":"Weekly News < 2.2.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c08d51-ed01-4f92-9290-1964c4f3657c?source=api-prod","affected":[{"type":"theme","slug":"weeklynews","name":"WeeklyNews","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2015-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45c1888e-ea46-43b9-bfab-069a972fa9a2","source":"wordfence","cve":"CVE-2025-23886","title":"Annie <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c1888e-ea46-43b9-bfab-069a972fa9a2?source=api-prod","affected":[{"type":"plugin","slug":"annie","name":"Annie","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:04:01Z"},{"id":"wordfence:45c2ad78-6cae-4d32-b595-54a466ff2469","source":"wordfence","cve":"CVE-2026-24523","title":"FullCalendar <= 1.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c2ad78-6cae-4d32-b595-54a466ff2469?source=api-prod","affected":[{"type":"plugin","slug":"wp-fullcalendar","name":"WP FullCalendar","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-01-26T00:00:00Z","updated":"2026-09-23T14:29:08Z"},{"id":"wordfence:45c6c041-91b0-4abe-ba72-ec1251651fdb","source":"wordfence","cve":"CVE-2024-12205","title":"Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c6c041-91b0-4abe-ba72-ec1251651fdb?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T04:17:59Z"},{"id":"wordfence:45c7f8fb-3fd0-425f-89a1-8971f67d5755","source":"wordfence","cve":"CVE-2023-46640","title":"Medialist <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c7f8fb-3fd0-425f-89a1-8971f67d5755?source=api-prod","affected":[{"type":"plugin","slug":"media-list","name":"Medialist","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45c8d883-1f97-4c9d-b406-c61e33a0959e","source":"wordfence","cve":"CVE-2026-15802","title":"WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action","severity":"high","cvss":8.1,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45c8d883-1f97-4c9d-b406-c61e33a0959e?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-21T15:42:00Z","updated":"2026-07-22T03:44:59Z"},{"id":"wordfence:45ca753b-a530-4394-8cec-ec8cd66e93b8","source":"wordfence","cve":"CVE-2025-0627","title":"WordPress Tag, Category, and Taxonomy Manager \u2013 AI Autotagger <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ca753b-a530-4394-8cec-ec8cd66e93b8?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-30T19:49:07Z"},{"id":"wordfence:45ccc116-866e-467f-8ebb-8a3b6589c069","source":"wordfence","cve":"CVE-2026-7626","title":"Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ccc116-866e-467f-8ebb-8a3b6589c069?source=api-prod","affected":[{"type":"plugin","slug":"slek-gateway-for-woocommerce","name":"Slek Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:06:11Z","updated":"2026-05-12T07:48:19Z"},{"id":"wordfence:45ccf71d-3853-43f3-afe9-61984eed73b0","source":"wordfence","cve":"CVE-2016-20079","title":"Dharma Booking <= 2.28.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ccf71d-3853-43f3-afe9-61984eed73b0?source=api-prod","affected":[{"type":"plugin","slug":"dharma-booking","name":"dharma-booking","from":"*","from_inclusive":true,"to":"2.28.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:45:14Z"},{"id":"wordfence:45cd04bb-d3a0-48af-97ac-c5d668d665df","source":"wordfence","cve":"CVE-2025-27280","title":"Archive Page <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45cd04bb-d3a0-48af-97ac-c5d668d665df?source=api-prod","affected":[{"type":"plugin","slug":"archive-page","name":"Archive Page","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-17T13:11:54Z"},{"id":"wordfence:45cf9e0e-3a8a-400a-b766-7b352e739b7c","source":"wordfence","cve":"CVE-2024-11378","title":"Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45cf9e0e-3a8a-400a-b766-7b352e739b7c?source=api-prod","affected":[{"type":"plugin","slug":"bizapp-for-woocommerce","name":"Bizapp for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:42:24Z","updated":"2025-01-07T04:21:58Z"},{"id":"wordfence:45d04643-e43a-4732-91bf-e4af7b622e33","source":"wordfence","cve":"CVE-2024-4279","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d04643-e43a-4732-91bf-e4af7b622e33?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T05:33:28Z"},{"id":"wordfence:45d3cff1-3a86-4b79-bf43-1623d41ac821","source":"wordfence","cve":"CVE-2016-10898","title":"Total Security <= 3.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d3cff1-3a86-4b79-bf43-1623d41ac821?source=api-prod","affected":[{"type":"plugin","slug":"total-security","name":"Total Security","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2016-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45d3f82b-9e19-4678-8995-7fe265606fd2","source":"wordfence","cve":"CVE-2023-23993","title":"IP Blocker Lite <= 11.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d3f82b-9e19-4678-8995-7fe265606fd2?source=api-prod","affected":[{"type":"plugin","slug":"ip-address-blocker","name":"LionScripts: IP Blocker Lite","from":"*","from_inclusive":true,"to":"11.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45d5a677-9b8b-4258-9cfb-101b0f0e6f6f","source":"wordfence","cve":"CVE-2024-2387","title":"Advanced Form Integration \u2013 Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_id","severity":"medium","cvss":6.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d5a677-9b8b-4258-9cfb-101b0f0e6f6f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.82.0","to_inclusive":true,"patched_in":"1.82.6"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T01:57:55Z"},{"id":"wordfence:45d66743-300e-480d-98b8-99dc30b6e786","source":"wordfence","cve":"CVE-2024-10284","title":"CE21 Suite <= 2.2.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d66743-300e-480d-98b8-99dc30b6e786?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-10T15:21:12Z"},{"id":"wordfence:45d7732f-cdcd-4cef-a01e-22e06566e8a1","source":"wordfence","cve":"CVE-2024-55983","title":"PowerFormBuilder <= 1.0.6 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d7732f-cdcd-4cef-a01e-22e06566e8a1?source=api-prod","affected":[{"type":"plugin","slug":"power-forms-builder","name":"PowerFormBuilder \u2013 Contact Form Database Manager for WordPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:08:48Z"},{"id":"wordfence:45d7fe64-c51b-4801-a190-92396e5db27d","source":"wordfence","cve":"CVE-2025-12090","title":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45d7fe64-c51b-4801-a190-92396e5db27d?source=api-prod","affected":[{"type":"plugin","slug":"employee-spotlight","name":"Employee Spotlight \u2013 Team Member Showcase & Meet the Team Plugin","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2025-10-31T16:31:09Z","updated":"2025-11-01T05:40:22Z"},{"id":"wordfence:45dbcc5e-2746-4a55-a1d1-a7c67fa2950e","source":"wordfence","cve":"CVE-2026-13468","title":"Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45dbcc5e-2746-4a55-a1d1-a7c67fa2950e?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-06-30T15:03:18Z","updated":"2026-07-01T03:43:35Z"},{"id":"wordfence:45dd22d4-9a51-4569-a756-1f1a5f8626c1","source":"wordfence","cve":"CVE-2024-8714","title":"WordPress Affiliates Plugin \u2014 SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45dd22d4-9a51-4569-a756-1f1a5f8626c1?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T15:10:39Z"},{"id":"wordfence:45ddf224-b359-45ec-97a0-5a3257f56420","source":"wordfence","cve":"CVE-2024-2603","title":"Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ddf224-b359-45ec-97a0-5a3257f56420?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.6.5","to_inclusive":true,"patched_in":"9.6.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-05-01T13:54:54Z"},{"id":"wordfence:45e0664a-385d-4879-acf6-46e837aaa03f","source":"wordfence","cve":"","title":"Kernel - Premium WordPress Blog & Magazine Theme | News / Editorial (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45e0664a-385d-4879-acf6-46e837aaa03f?source=api-prod","affected":[{"type":"theme","slug":"kernel-theme","name":"Kernel - Premium WordPress Blog & Magazine Theme | News / Editorial","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45e61d76-085d-48ba-b5ae-cc75f91d1250","source":"wordfence","cve":"","title":"Rencontre \u2013 Dating Site <= 3.1.3  - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45e61d76-085d-48ba-b5ae-cc75f91d1250?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.2"}],"published":"2019-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45e77c74-ba6b-4018-9f97-db393bad6783","source":"wordfence","cve":"CVE-2025-32272","title":"Wishlist <= 1.0.44 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45e77c74-ba6b-4018-9f97-db393bad6783?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.44","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-04-30T03:17:42Z"},{"id":"wordfence:45e96aa3-97bb-4774-a1b5-5f0a7b18293e","source":"wordfence","cve":"CVE-2024-10342","title":"League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45e96aa3-97bb-4774-a1b5-5f0a7b18293e?source=api-prod","affected":[{"type":"plugin","slug":"league-of-legends-shortcodes","name":"League of Legends Shortcodes","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T07:37:58Z"},{"id":"wordfence:45eac3e1-db31-4d3d-844f-ae106b9eee7a","source":"wordfence","cve":"CVE-2025-48140","title":"MetalpriceAPI <= 1.1.4 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45eac3e1-db31-4d3d-844f-ae106b9eee7a?source=api-prod","affected":[{"type":"plugin","slug":"metalpriceapi","name":"MetalpriceAPI","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-05-22T00:00:00Z","updated":"2025-06-05T17:22:20Z"},{"id":"wordfence:45eda79d-f999-413e-88ce-b7d06f09f191","source":"wordfence","cve":"CVE-2024-13933","title":"FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45eda79d-f999-413e-88ce-b7d06f09f191?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2026-04-24T15:26:33Z"},{"id":"wordfence:45ee8b10-6758-45c8-835e-197ad6a9284a","source":"wordfence","cve":"CVE-2025-22750","title":"Post Carousel & Slider <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ee8b10-6758-45c8-835e-197ad6a9284a?source=api-prod","affected":[{"type":"plugin","slug":"post-types-carousel-slider","name":"Post Carousel & Slider","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:10:35Z"},{"id":"wordfence:45ef20aa-18e3-4ad8-a94e-76e29de5b562","source":"wordfence","cve":"CVE-2024-8961","title":"Essential Addons for Elementor \u2013 Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ef20aa-18e3-4ad8-a94e-76e29de5b562?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2024-11-14T18:35:38Z","updated":"2024-11-15T06:48:03Z"},{"id":"wordfence:45ef9293-dd94-490a-8cb8-df6bccf4739a","source":"wordfence","cve":"CVE-2026-13725","title":"Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45ef9293-dd94-490a-8cb8-df6bccf4739a?source=api-prod","affected":[{"type":"plugin","slug":"aco-woo-dynamic-pricing","name":"Dynamic Pricing With Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:04:18Z"},{"id":"wordfence:45f1e4b9-5ffb-4dca-aa79-09c664b46f00","source":"wordfence","cve":"CVE-2025-47457","title":"LocateAndFilter <= 1.6.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f1e4b9-5ffb-4dca-aa79-09c664b46f00?source=api-prod","affected":[{"type":"plugin","slug":"locateandfilter","name":"LocateAndFilter","from":"*","from_inclusive":true,"to":"1.6.16","to_inclusive":true,"patched_in":"1.6.17"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:43:56Z"},{"id":"wordfence:45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a","source":"wordfence","cve":"","title":"Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"2.4.0","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45f3568c-b6d9-4d00-a8cd-571443d80fd3","source":"wordfence","cve":"","title":"Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin <= 2.43 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f3568c-b6d9-4d00-a8cd-571443d80fd3?source=api-prod","affected":[{"type":"plugin","slug":"wp-memory","name":"Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions","from":"*","from_inclusive":true,"to":"2.43","to_inclusive":true,"patched_in":"2.44"}],"published":"2022-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45f581dc-d424-4cda-aa03-016e9b5ee1e5","source":"wordfence","cve":"CVE-2021-38351","title":"OSD Subscribe <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f581dc-d424-4cda-aa03-016e9b5ee1e5?source=api-prod","affected":[{"type":"plugin","slug":"osd-subscribe","name":"OSD Subscribe","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45f644d0-ec27-4090-9fb7-725df8cdd877","source":"wordfence","cve":"CVE-2026-124258","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f644d0-ec27-4090-9fb7-725df8cdd877?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2026-11-07T17:22:00Z","updated":"2026-11-10T20:03:19Z"},{"id":"wordfence:45f81b33-ced8-4ada-978f-f15c68ef4eef","source":"wordfence","cve":"CVE-2025-47506","title":"Contextual Related Posts <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f81b33-ced8-4ada-978f-f15c68ef4eef?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:11:48Z"},{"id":"wordfence:45f98a96-8f32-49f9-bfc8-9beb316ce0bc","source":"wordfence","cve":"CVE-2025-5589","title":"StreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f98a96-8f32-49f9-bfc8-9beb316ce0bc?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-kick-integration","name":"StreamWeasels Kick Integration","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-06-13T20:21:41Z","updated":"2025-06-14T08:23:24Z"},{"id":"wordfence:45f98c00-0bfd-405e-a6b3-581841d803de","source":"wordfence","cve":"CVE-2023-2401","title":"QuBotChat <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45f98c00-0bfd-405e-a6b3-581841d803de?source=api-prod","affected":[{"type":"plugin","slug":"qubotchat","name":"QuBot \u2013 Chatbot Builder with Templates","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:45fcd17e-10d5-4357-84cc-2527b07b584e","source":"wordfence","cve":"CVE-2026-109234","title":"Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45fcd17e-10d5-4357-84cc-2527b07b584e?source=api-prod","affected":[{"type":"plugin","slug":"meow-lightbox","name":"Meow Lightbox","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2026-10-30T17:16:06Z","updated":"2026-10-31T05:33:07Z"},{"id":"wordfence:45fe9092-ebf4-43ed-ab49-4b492b2a0a73","source":"wordfence","cve":"CVE-2025-47524","title":"Quran multilanguage Text & Audio <= 2.3.23 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/45fe9092-ebf4-43ed-ab49-4b492b2a0a73?source=api-prod","affected":[{"type":"plugin","slug":"quran-text-multilanguage","name":"Quran multilanguage Text & Audio","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.24"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:23:13Z"},{"id":"wordfence:46030034-9731-4b6d-a3c9-c2dd9a206c46","source":"wordfence","cve":"CVE-2024-37202","title":"Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter <= 1.222.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46030034-9731-4b6d-a3c9-c2dd9a206c46?source=api-prod","affected":[{"type":"plugin","slug":"custom-add-to-cart-button-for-woocommerce","name":"Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter","from":"*","from_inclusive":true,"to":"1.222.17","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-12-05T19:57:20Z"},{"id":"wordfence:46030da6-6d9f-4934-a93c-4cd564510f36","source":"wordfence","cve":"CVE-2024-27950","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46030da6-6d9f-4934-a93c-4cd564510f36?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-04T13:17:06Z"},{"id":"wordfence:46039930-377e-4adb-8d96-09ebf220b4a6","source":"wordfence","cve":"CVE-2014-9437","title":"Sliding Social Icons <= 1.61 - Cross-Site Request Forgery and Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46039930-377e-4adb-8d96-09ebf220b4a6?source=api-prod","affected":[{"type":"plugin","slug":"sliding-social-icons","name":"Sliding Social Icons","from":"*","from_inclusive":true,"to":"1.61","to_inclusive":true,"patched_in":""}],"published":"2014-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4607dca0-d3b7-4fca-8f89-a0a739bd7551","source":"wordfence","cve":"CVE-2025-6082","title":"Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4607dca0-d3b7-4fca-8f89-a0a739bd7551?source=api-prod","affected":[{"type":"plugin","slug":"birth-chart-compatibility","name":"Birth Chart Compatibility","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T20:51:01Z","updated":"2025-07-22T09:22:43Z"},{"id":"wordfence:46093b88-2f3c-4e06-833c-6a073cafda0f","source":"wordfence","cve":"CVE-2026-59555","title":"Participants Database <= 2.7.8.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46093b88-2f3c-4e06-833c-6a073cafda0f?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.3","to_inclusive":true,"patched_in":"2.7.8.4"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:01:23Z"},{"id":"wordfence:4609e1a8-c766-4054-a5d0-eabff1089300","source":"wordfence","cve":"CVE-2026-25425","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4609e1a8-c766-4054-a5d0-eabff1089300?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:20:28Z"},{"id":"wordfence:460b5388-4862-475d-9557-f8da2d5a84f7","source":"wordfence","cve":"CVE-2021-25110","title":"Futurio Extra <= 1.6.2 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/460b5388-4862-475d-9557-f8da2d5a84f7?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:461211c9-951e-4ccd-abf5-84941290a6a5","source":"wordfence","cve":"CVE-2023-49749","title":"SureTriggers <= 1.0.23 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461211c9-951e-4ccd-abf5-84941290a6a5?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46122be7-5e88-4656-8944-a747f5cdc69e","source":"wordfence","cve":"CVE-2024-32784","title":"CookieHub <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46122be7-5e88-4656-8944-a747f5cdc69e?source=api-prod","affected":[{"type":"plugin","slug":"cookiehub","name":"CookieHub \u2013 Cookie Consent Banner (DSGVO, CCPA, RGPD and GDPR compliance)","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:33:34Z"},{"id":"wordfence:46126f88-416a-4430-8596-12f72cd2c1e7","source":"wordfence","cve":"CVE-2024-8913","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46126f88-416a-4430-8596-12f72cd2c1e7?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T08:30:54Z"},{"id":"wordfence:4613f4d5-8c13-4007-8be0-40568d94fffe","source":"wordfence","cve":"CVE-2025-27296","title":"Auto Ad Inserter \u2013 Increase Google Adsense and Ad Manager Revenue <= 1.5 - Missing Authorization to Authenticated (Editor+) Settings Update","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4613f4d5-8c13-4007-8be0-40568d94fffe?source=api-prod","affected":[{"type":"plugin","slug":"revenueflex-easy-ads","name":"Auto Ad Inserter \u2013 Increase Google Adsense and Ad Manager Revenue","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:44:44Z"},{"id":"wordfence:46150f65-e662-4539-ae99-eaee297a2608","source":"wordfence","cve":"CVE-2023-45001","title":"Seriously Simple Stats <= 1.5.0 - Authenticated (Podcast manager+) SQL Injection via order_by","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46150f65-e662-4539-ae99-eaee297a2608?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-stats","name":"Seriously Simple Stats","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4616b609-e8dc-4004-a5b7-2de3e83719be","source":"wordfence","cve":"CVE-2025-3284","title":"User Registration & Membership PRO \u2013 Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4616b609-e8dc-4004-a5b7-2de3e83719be?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-pro","name":"User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T02:22:33Z"},{"id":"wordfence:46186f8d-e50c-476a-9480-b6121412474a","source":"wordfence","cve":"CVE-2024-13719","title":"PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46186f8d-e50c-476a-9480-b6121412474a?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-18T19:27:32Z","updated":"2025-07-24T19:18:49Z"},{"id":"wordfence:4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0","source":"wordfence","cve":"CVE-2025-3295","title":"WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.9.1","to_inclusive":true,"patched_in":"1.2.9.2"}],"published":"2025-04-16T17:11:50Z","updated":"2025-04-17T05:23:21Z"},{"id":"wordfence:4618c39d-219e-4fc3-be98-15303bc8483f","source":"wordfence","cve":"CVE-2024-5809","title":"WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c39d-219e-4fc3-be98-15303bc8483f?source=api-prod","affected":[{"type":"plugin","slug":"wp-ajax-contact-form","name":"WP Ajax Contact Form","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T18:43:13Z"},{"id":"wordfence:461993a3-8d47-4c9e-8f5f-78058d96ab2a","source":"wordfence","cve":"CVE-2024-37430","title":"Patreon WordPress <= 1.9.0 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461993a3-8d47-4c9e-8f5f-78058d96ab2a?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:39:59Z"},{"id":"wordfence:461ab75a-3ced-4296-9dc1-b8eee17a8299","source":"wordfence","cve":"CVE-2024-12522","title":"Yay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461ab75a-3ced-4296-9dc1-b8eee17a8299?source=api-prod","affected":[{"type":"plugin","slug":"yayforms","name":"Yay! Forms","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-02-18T19:30:41Z","updated":"2025-02-20T15:00:07Z"},{"id":"wordfence:461ae519-413f-4ccd-82bb-5e50e6bfbaf3","source":"wordfence","cve":"CVE-2025-69123","title":"Snow Club <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461ae519-413f-4ccd-82bb-5e50e6bfbaf3?source=api-prod","affected":[{"type":"theme","slug":"snow-club","name":"Snow Club | Ski Resort and Snowboard Classes WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:33:51Z"},{"id":"wordfence:461be8a5-bf72-4028-88e6-bf6544120ac6","source":"wordfence","cve":"CVE-2026-18335","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-09-23T21:24:39Z","updated":"2026-09-24T09:27:45Z"},{"id":"wordfence:461cec8c-77e4-4f20-8dff-c4f675dc235f","source":"wordfence","cve":"CVE-2022-36424","title":"Easy Appointments <= 3.11.9 - Cross-Site Request Forgery via multiple AJAX actions","severity":"medium","cvss":6.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461cec8c-77e4-4f20-8dff-c4f675dc235f?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.11.9","to_inclusive":true,"patched_in":"3.11.10"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:461cf8ba-a0d1-4de8-983d-170305e14f97","source":"wordfence","cve":"CVE-2024-32725","title":"5 Stars Rating Funnel <= 1.2.67 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461cf8ba-a0d1-4de8-983d-170305e14f97?source=api-prod","affected":[{"type":"plugin","slug":"5-stars-rating-funnel","name":"Build 5 Star Reviews on Google Reviews, Yelp, Facebook\u2026 easily and risk-free | RRatingg","from":"*","from_inclusive":true,"to":"1.2.67","to_inclusive":true,"patched_in":"1.3.02"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:15:46Z"},{"id":"wordfence:461d5d5a-7bc2-4855-bc40-0edb9c538c33","source":"wordfence","cve":"","title":"Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461d5d5a-7bc2-4855-bc40-0edb9c538c33?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"1.2.98","from_inclusive":true,"to":"1.2.997","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2015-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:461fedd6-8138-46ee-9c76-dc71061242bf","source":"wordfence","cve":"CVE-2024-32575","title":"Mega Elements <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461fedd6-8138-46ee-9c76-dc71061242bf?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T16:02:10Z"},{"id":"wordfence:46202ea3-9825-4492-b188-0ddc934e81e8","source":"wordfence","cve":"CVE-2025-67544","title":"Shopkeeper Extender < 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46202ea3-9825-4492-b188-0ddc934e81e8?source=api-prod","affected":[{"type":"plugin","slug":"shopkeeper-extender","name":"Shopkeeper Extender","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":false,"patched_in":"7.0"}],"published":"2025-11-13T00:00:00Z","updated":"2025-12-10T16:07:17Z"},{"id":"wordfence:462060ec-1661-4807-8e64-fa624ba2cc98","source":"wordfence","cve":"CVE-2025-22365","title":"EMC2 Alert Boxes <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462060ec-1661-4807-8e64-fa624ba2cc98?source=api-prod","affected":[{"type":"plugin","slug":"emc2-alert-boxes","name":"EMC2 Alert Boxes","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:07:32Z"},{"id":"wordfence:462125cd-c91a-44b1-9004-4a62f2aed52c","source":"wordfence","cve":"CVE-2024-50482","title":"Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462125cd-c91a-44b1-9004-4a62f2aed52c?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-design","name":"Woocommerce Product Design","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:56:37Z"},{"id":"wordfence:46217022-f16a-46c9-abca-680b7e35948c","source":"wordfence","cve":"CVE-2026-104670","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46217022-f16a-46c9-abca-680b7e35948c?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.4.9.1"}],"published":"2026-10-05T10:11:40Z","updated":"2026-10-08T23:27:00Z"},{"id":"wordfence:46226921-a445-4fb7-9c90-bd2d6841dec7","source":"wordfence","cve":"CVE-2022-1618","title":"Coru LFMember <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46226921-a445-4fb7-9c90-bd2d6841dec7?source=api-prod","affected":[{"type":"plugin","slug":"coru-lfmember","name":"Coru LFMember","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:462372ab-8f83-4b75-b3dd-674199e1eeee","source":"wordfence","cve":"","title":"Mailjet Email Marketing <= 5.3 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462372ab-8f83-4b75-b3dd-674199e1eeee?source=api-prod","affected":[{"type":"plugin","slug":"mailjet-for-wordpress","name":"Mailjet Email Marketing","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4624c43b-6c5f-48c5-bfe4-26ec6d7de418","source":"wordfence","cve":"CVE-2014-5184","title":"stripShow Plugin <= 2.5.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4624c43b-6c5f-48c5-bfe4-26ec6d7de418?source=api-prod","affected":[{"type":"plugin","slug":"stripshow","name":"stripshow","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4624d197-db90-41ee-a3d5-a83a0dbf6b7c","source":"wordfence","cve":"","title":"Global Flash Gallery  <= 0.15.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4624d197-db90-41ee-a3d5-a83a0dbf6b7c?source=api-prod","affected":[{"type":"plugin","slug":"global-flash-galleries","name":"Global Flash Gallery","from":"*","from_inclusive":true,"to":"0.15.1","to_inclusive":true,"patched_in":"0.15.2"}],"published":"2011-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4625072b-815d-41d2-bf8f-ac290efde369","source":"wordfence","cve":"CVE-2024-10584","title":"DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4625072b-815d-41d2-bf8f-ac290efde369?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"3.6.17"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T11:09:52Z"},{"id":"wordfence:46258dc2-3e05-4050-baad-3b3ded912bfe","source":"wordfence","cve":"","title":"Shopping Cart & eCommerce Store <= 5.2.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46258dc2-3e05-4050-baad-3b3ded912bfe?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2022-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4625d217-99d4-47d8-b093-fe55a3018348","source":"wordfence","cve":"","title":"Sticky Menu & Sticky Header <= 2.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4625d217-99d4-47d8-b093-fe55a3018348?source=api-prod","affected":[{"type":"plugin","slug":"sticky-menu-or-anything-on-scroll","name":"Sticky Menu & Sticky Header","from":"*","from_inclusive":true,"to":"2.21","to_inclusive":false,"patched_in":"2.21"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:462606da-34a5-400c-93e8-84c16f71d7e4","source":"wordfence","cve":"CVE-2026-24993","title":"Advanced Reporting & Statistics for WooCommerce \u2013 Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462606da-34a5-400c-93e8-84c16f71d7e4?source=api-prod","affected":[{"type":"plugin","slug":"webd-woocommerce-advanced-reporting-statistics","name":"Advanced Reporting and Statistics for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-26T20:55:48Z"},{"id":"wordfence:46271ab0-5f24-4cdb-9e1f-12db7bcbea6c","source":"wordfence","cve":"CVE-2021-24933","title":"Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46271ab0-5f24-4cdb-9e1f-12db7bcbea6c?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":true,"patched_in":"1.6"}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4629d12c-8ddc-48f2-8ff1-956cd37f177d","source":"wordfence","cve":"CVE-2026-62067","title":"Kaven <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4629d12c-8ddc-48f2-8ff1-956cd37f177d?source=api-prod","affected":[{"type":"theme","slug":"kaven-wp","name":"Kaven - Business One Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:37:30Z"},{"id":"wordfence:462d6d01-ce4c-4c76-932a-6466f9a8d807","source":"wordfence","cve":"CVE-2025-60200","title":"LearnPress Export Import <= 4.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462d6d01-ce4c-4c76-932a-6466f9a8d807?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2025-07-21T00:00:00Z","updated":"2026-04-14T14:31:22Z"},{"id":"wordfence:462da6ba-c558-4ce8-b26c-df69d086d592","source":"wordfence","cve":"CVE-2026-16080","title":"Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462da6ba-c558-4ce8-b26c-df69d086d592?source=api-prod","affected":[{"type":"plugin","slug":"image-uploader-for-welcart","name":"Image Uploader for Welcart","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:06:02Z","updated":"2026-08-15T02:26:15Z"},{"id":"wordfence:462ea9c3-ed33-46f2-8d60-ba024f369561","source":"wordfence","cve":"CVE-2024-53727","title":"LinkLaunder SEO <= 0.92.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462ea9c3-ed33-46f2-8d60-ba024f369561?source=api-prod","affected":[{"type":"plugin","slug":"linklaunder-seo-plugin","name":"LinkLaunder SEO","from":"*","from_inclusive":true,"to":"0.92.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:28:51Z"},{"id":"wordfence:462fcf4d-3ece-48d7-b06f-9a5de9372f5c","source":"wordfence","cve":"CVE-2024-39681","title":"Cooked \u2013 Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Template Apply","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/462fcf4d-3ece-48d7-b06f-9a5de9372f5c?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-05T12:49:46Z"},{"id":"wordfence:463181ae-1355-4aaf-bd8d-3194d72e0dfc","source":"wordfence","cve":"CVE-2025-58865","title":"Compact Admin <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463181ae-1355-4aaf-bd8d-3194d72e0dfc?source=api-prod","affected":[{"type":"plugin","slug":"compact-admin","name":"Compact Admin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:08:01Z"},{"id":"wordfence:4633c5b1-a6e3-4ee8-94ca-8afa8ff16a35","source":"wordfence","cve":"CVE-2023-30492","title":"Minimum Purchase for WooCommerce <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4633c5b1-a6e3-4ee8-94ca-8afa8ff16a35?source=api-prod","affected":[{"type":"plugin","slug":"minimum-purchase-for-woocommerce","name":"Minimum Purchase for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:463441f9-1a32-4df3-a8d1-324ed9faa5ea","source":"wordfence","cve":"CVE-2024-12739","title":"Mobile Contact Bar <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463441f9-1a32-4df3-a8d1-324ed9faa5ea?source=api-prod","affected":[{"type":"plugin","slug":"mobile-contact-bar","name":"Mobile Contact Bar","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:03:42Z"},{"id":"wordfence:4635f5c1-c326-4f53-bc54-a402cf5dae00","source":"wordfence","cve":"CVE-2024-13738","title":"Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4635f5c1-c326-4f53-bc54-a402cf5dae00?source=api-prod","affected":[{"type":"theme","slug":"motors","name":"Motors - Car Dealer, Rental & Listing WordPress theme","from":"*","from_inclusive":true,"to":"5.6.65","to_inclusive":true,"patched_in":"5.6.66"}],"published":"2025-05-02T14:13:54Z","updated":"2025-05-03T02:21:55Z"},{"id":"wordfence:4638516e-d36f-4f31-9ed5-f733aeae03e2","source":"wordfence","cve":"CVE-2024-56236","title":"Hestia Nginx Cache <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4638516e-d36f-4f31-9ed5-f733aeae03e2?source=api-prod","affected":[{"type":"plugin","slug":"hestia-nginx-cache","name":"Hestia Nginx Cache","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:48:10Z"},{"id":"wordfence:463c11ba-f307-4ab5-8de7-09f3a113cddd","source":"wordfence","cve":"CVE-2025-22763","title":"Brizy Pro <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463c11ba-f307-4ab5-8de7-09f3a113cddd?source=api-prod","affected":[{"type":"plugin","slug":"brizy-pro","name":"Brizy Pro","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-01-14T00:00:00Z","updated":"2026-04-15T13:27:34Z"},{"id":"wordfence:463d0ecd-408c-4ccf-9f2c-8bff3deca213","source":"wordfence","cve":"CVE-2025-39557","title":"Kadence WooCommerce Email Designer <= 1.5.14 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463d0ecd-408c-4ccf-9f2c-8bff3deca213?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":"1.5.15"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T18:52:44Z"},{"id":"wordfence:463da3d5-f2ec-4cf5-a545-c4ea7b8e7fb3","source":"wordfence","cve":"CVE-2026-39494","title":"Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463da3d5-f2ec-4cf5-a545-c4ea7b8e7fb3?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:05:14Z"},{"id":"wordfence:463de4fc-c5c2-43f9-86e9-686004447561","source":"wordfence","cve":"CVE-2026-119616","title":"Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name","severity":"medium","cvss":5.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463de4fc-c5c2-43f9-86e9-686004447561?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-11-06T14:17:34Z","updated":"2026-11-07T02:29:14Z"},{"id":"wordfence:463fd745-92ea-4e55-b470-a5f08884169f","source":"wordfence","cve":"CVE-2017-18488","title":"Backup Guard <= 1.1.46 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463fd745-92ea-4e55-b470-a5f08884169f?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.1.47","to_inclusive":false,"patched_in":"1.1.47"}],"published":"2017-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:463fdbde-1d98-4f52-b835-cba1ae567f4f","source":"wordfence","cve":"CVE-2023-23711","title":"A2 Optimized WP <= 3.0.4 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463fdbde-1d98-4f52-b835-cba1ae567f4f?source=api-prod","affected":[{"type":"plugin","slug":"a2-optimized-wp","name":"A2 Optimized WP \u2013 Turbocharge and secure your WordPress site","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:463fea25-c793-42fc-a8a8-28d001978133","source":"wordfence","cve":"CVE-2026-14318","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/463fea25-c793-42fc-a8a8-28d001978133?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":false,"patched_in":"4.16.3"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:39:56Z"},{"id":"wordfence:46438bd3-7c4a-4939-ab46-05dc8bbe461f","source":"wordfence","cve":"CVE-2020-24312","title":"WP File Manager <= 6.4 - Unauthenticated Resource Access to Site Backups","severity":"high","cvss":7.5,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46438bd3-7c4a-4939-ab46-05dc8bbe461f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2020-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46474bf6-0906-4b94-8032-270991c5128d","source":"wordfence","cve":"CVE-2026-73389","title":"Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46474bf6-0906-4b94-8032-270991c5128d?source=api-prod","affected":[{"type":"plugin","slug":"kalles-addons","name":"Kalles Addons","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-01T13:23:33Z"},{"id":"wordfence:4648a390-bd89-4493-8daa-cd069b5dafff","source":"wordfence","cve":"CVE-2025-30806","title":"Vimeotheque <= 2.3.4.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4648a390-bd89-4493-8daa-cd069b5dafff?source=api-prod","affected":[{"type":"plugin","slug":"codeflavors-vimeo-video-post-lite","name":"Vimeotheque \u2013 Vimeo WordPress Plugin & Video Gallery","from":"*","from_inclusive":true,"to":"2.3.4.2","to_inclusive":true,"patched_in":"2.3.4.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:12:30Z"},{"id":"wordfence:4648c4f2-47e3-4a95-9e93-fd8246863425","source":"wordfence","cve":"CVE-2023-23659","title":"MainWP Matomo Extension <= 4.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4648c4f2-47e3-4a95-9e93-fd8246863425?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-piwik-extension","name":"MainWP Matomo Extension","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:464a41f6-5569-4306-be99-566e2354c73b","source":"wordfence","cve":"CVE-2018-20853","title":"MailPoet Newsletters <= 2.8.1 - Spam Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/464a41f6-5569-4306-be99-566e2354c73b?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2018-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:464b35bb-d782-477a-8059-c52418c78f22","source":"wordfence","cve":"CVE-2026-12376","title":"Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/464b35bb-d782-477a-8059-c52418c78f22?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-17T04:34:05Z"},{"id":"wordfence:464d7191-4afd-48c4-8d2e-655ee7375ff1","source":"wordfence","cve":"CVE-2026-111407","title":"Tutor LMS \u2013 eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/464d7191-4afd-48c4-8d2e-655ee7375ff1?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-10-17T08:21:59Z","updated":"2026-10-23T18:42:35Z"},{"id":"wordfence:464e64f8-de64-4a49-afd3-43142793c24d","source":"wordfence","cve":"CVE-2024-47645","title":"Top Bar \u2013 PopUps \u2013 by WPOptin <= 2.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/464e64f8-de64-4a49-afd3-43142793c24d?source=api-prod","affected":[{"type":"plugin","slug":"wpoptin","name":"WPOptin \u2013 AI-Powered Top Bars, PopUps & Lead Generation","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:46:18Z"},{"id":"wordfence:464fda21-5efe-4565-9b21-85d6c458a6a1","source":"wordfence","cve":"CVE-2025-68871","title":"Dooodl <= 2.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/464fda21-5efe-4565-9b21-85d6c458a6a1?source=api-prod","affected":[{"type":"plugin","slug":"dooodl","name":"Dooodl","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:52:59Z"},{"id":"wordfence:46525a06-f3a4-4c78-ba32-4b937e1dbac6","source":"wordfence","cve":"CVE-2023-48290","title":"Form Maker <= 1.15.20 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46525a06-f3a4-4c78-ba32-4b937e1dbac6?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.21","to_inclusive":false,"patched_in":"1.15.21"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46528bf2-43f5-45bc-aab5-da447a016470","source":"wordfence","cve":"CVE-2024-34426","title":"Brozzme Scroll Top <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46528bf2-43f5-45bc-aab5-da447a016470?source=api-prod","affected":[{"type":"plugin","slug":"brozzme-scroll-top","name":"Brozzme Scroll Top","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:32:05Z"},{"id":"wordfence:4653f0fd-5369-4e3c-9bce-3f4200c0bddb","source":"wordfence","cve":"CVE-2024-30538","title":"DELUCKS SEO <= 2.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4653f0fd-5369-4e3c-9bce-3f4200c0bddb?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T15:06:08Z"},{"id":"wordfence:46545227-3c04-40a4-a25c-8f43845e90d3","source":"wordfence","cve":"CVE-2022-25148","title":"WP Statistics <= 13.1.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46545227-3c04-40a4-a25c-8f43845e90d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4654609e-ed3e-4268-a9a4-80bc563e0a64","source":"wordfence","cve":"CVE-2022-36288","title":"Download Manager <= 3.2.48 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4654609e-ed3e-4268-a9a4-80bc563e0a64?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.48","to_inclusive":true,"patched_in":"3.2.49"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4658109d-295c-4a1b-b219-ca1f4664ff1d","source":"wordfence","cve":"CVE-2023-5576","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.91 - Google Drive Client Secret Exposure","severity":"high","cvss":8.0,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4658109d-295c-4a1b-b219-ca1f4664ff1d?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.91","to_inclusive":true,"patched_in":"0.9.92"}],"published":"2023-10-13T00:00:00Z","updated":"2024-07-15T15:24:11Z"},{"id":"wordfence:465af9c6-9687-4417-96fb-b7df3d221a1a","source":"wordfence","cve":"CVE-2018-10310","title":"Catapult UK Cookie Consent <= 2.3.9 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/465af9c6-9687-4417-96fb-b7df3d221a1a?source=api-prod","affected":[{"type":"plugin","slug":"uk-cookie-consent","name":"Termly \u2013 GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2018-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:465f29c0-99b9-4f7d-9817-3d3a49a2d943","source":"wordfence","cve":"","title":"Live Chat with Messenger Customer Chat <= 1.4.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/465f29c0-99b9-4f7d-9817-3d3a49a2d943?source=api-prod","affected":[{"type":"plugin","slug":"fb-messenger-live-chat","name":"Live Chat with Messenger Customer Chat","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2019-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:465f2fd1-9eb3-43ca-8acc-74acf6bcde1a","source":"wordfence","cve":"CVE-2025-10051","title":"Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=api-prod","affected":[{"type":"plugin","slug":"demo-import-kit","name":"Demo Import Kit","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:38:50Z","updated":"2025-10-15T08:25:55Z"},{"id":"wordfence:465fb289-48f7-4a67-a5df-f8994b9333af","source":"wordfence","cve":"CVE-2025-22496","title":"Notif Bell <= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/465fb289-48f7-4a67-a5df-f8994b9333af?source=api-prod","affected":[{"type":"plugin","slug":"notif-bell","name":"Notif Bell","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-18T20:27:08Z"},{"id":"wordfence:4661566b-0729-4489-9a47-8e3e0ac73573","source":"wordfence","cve":"CVE-2025-68025","title":"Addonify Floating Cart For WooCommerce <= 1.2.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4661566b-0729-4489-9a47-8e3e0ac73573?source=api-prod","affected":[{"type":"plugin","slug":"addonify-floating-cart","name":"Addonify Floating Cart For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T20:58:21Z"},{"id":"wordfence:466171e7-575d-4fc1-8005-8704904b7725","source":"wordfence","cve":"CVE-2025-2929","title":"Order Delivery Date for WP e-Commerce Pro <= 12.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466171e7-575d-4fc1-8005-8704904b7725?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date for WP e-Commerce","from":"*","from_inclusive":true,"to":"12.4.0","to_inclusive":false,"patched_in":"12.4.0"}],"published":"2025-04-29T00:00:00Z","updated":"2025-05-29T10:51:53Z"},{"id":"wordfence:4662a842-88ba-4f01-8009-7248792d485b","source":"wordfence","cve":"CVE-2026-57779","title":"Fascinate <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4662a842-88ba-4f01-8009-7248792d485b?source=api-prod","affected":[{"type":"theme","slug":"fascinate","name":"Fascinate","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:38:03Z"},{"id":"wordfence:4663b6b9-144d-4769-9444-64ad46fc1f44","source":"wordfence","cve":"CVE-2026-107418","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4663b6b9-144d-4769-9444-64ad46fc1f44?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2026-10-12T17:12:00Z","updated":"2026-10-13T13:59:30Z"},{"id":"wordfence:466568c5-33a9-4891-b4ad-9bc6052603cb","source":"wordfence","cve":"CVE-2025-9048","title":"Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466568c5-33a9-4891-b4ad-9bc6052603cb?source=api-prod","affected":[{"type":"plugin","slug":"wptobe-memberships","name":"Wptobe-memberships","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:47:57Z","updated":"2025-08-23T04:25:46Z"},{"id":"wordfence:4666afa0-619c-489c-b165-9dd11365aa8d","source":"wordfence","cve":"CVE-2026-94256","title":"SMS Alert <= 4.0.0 - Unauthenticated Arbitrary Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4666afa0-619c-489c-b165-9dd11365aa8d?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T16:04:50Z"},{"id":"wordfence:46693edf-bcc6-4af8-9f26-5ede865f4694","source":"wordfence","cve":"CVE-2024-4277","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46693edf-bcc6-4af8-9f26-5ede865f4694?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.5","to_inclusive":true,"patched_in":"4.2.6.6"}],"published":"2024-05-09T21:13:13Z","updated":"2024-05-10T09:32:08Z"},{"id":"wordfence:4669b08a-acaf-4a24-b71e-e3a6c8fcf557","source":"wordfence","cve":"CVE-2025-47625","title":"DoFollow Case by Case <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4669b08a-acaf-4a24-b71e-e3a6c8fcf557?source=api-prod","affected":[{"type":"plugin","slug":"dofollow-case-by-case","name":"DoFollow Case by Case","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-03T19:17:29Z"},{"id":"wordfence:466a5315-fc05-4b96-9dfd-17862fc406c5","source":"wordfence","cve":"CVE-2025-14450","title":"Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466a5315-fc05-4b96-9dfd-17862fc406c5?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-01-16T14:05:30Z","updated":"2026-01-17T02:22:31Z"},{"id":"wordfence:466d6087-1e4d-4010-b3c7-87e9e2d64f06","source":"wordfence","cve":"CVE-2024-2116","title":"Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466d6087-1e4d-4010-b3c7-87e9e2d64f06?source=api-prod","affected":[{"type":"plugin","slug":"christmas-greetings","name":"Christmas Greetings","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-03-28T00:00:00Z","updated":"2024-05-29T21:07:54Z"},{"id":"wordfence:466eec4a-8aac-4b0d-ba18-9667aa70de5a","source":"wordfence","cve":"CVE-2024-32127","title":"Find Duplicates <= 1.4.6 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466eec4a-8aac-4b0d-ba18-9667aa70de5a?source=api-prod","affected":[{"type":"plugin","slug":"find-duplicates","name":"Find Duplicates","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:51:44Z"},{"id":"wordfence:466fc6f3-7b2d-4975-a838-16e27bc9f9b5","source":"wordfence","cve":"CVE-2024-3888","title":"tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466fc6f3-7b2d-4975-a838-16e27bc9f9b5?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-04T04:30:32Z"},{"id":"wordfence:466ff226-a47e-46f1-a46c-6260208ffd42","source":"wordfence","cve":"CVE-2024-11293","title":"Registration Forms \u2013 User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/466ff226-a47e-46f1-a46c-6260208ffd42?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-social-site","name":"Pie Register - Social Sites Login (Add on)","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-12-03T00:00:00Z","updated":"2025-02-19T17:40:55Z"},{"id":"wordfence:46706adb-fc2e-47d4-b1ff-748b89b1decf","source":"wordfence","cve":"CVE-2008-0616","title":"DMSGuestbook <= 1.7.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46706adb-fc2e-47d4-b1ff-748b89b1decf?source=api-prod","affected":[{"type":"plugin","slug":"dmsguestbook","name":"DMSGuestbook","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4671556c-d902-4294-9e25-47e3d0e2ca98","source":"wordfence","cve":"CVE-2016-10897","title":"Sermon Browser <= 0.45.15 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4671556c-d902-4294-9e25-47e3d0e2ca98?source=api-prod","affected":[{"type":"plugin","slug":"sermon-browser","name":"Sermon Browser","from":"*","from_inclusive":true,"to":"0.45.15","to_inclusive":true,"patched_in":"0.45.16"}],"published":"2016-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4671b103-1240-4508-81ce-6b8573658021","source":"wordfence","cve":"CVE-2025-58238","title":"PilotPress <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4671b103-1240-4508-81ce-6b8573658021?source=api-prod","affected":[{"type":"plugin","slug":"pilotpress","name":"PilotPress","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.41"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-13T16:56:17Z"},{"id":"wordfence:4671d360-407d-49ed-8e49-c317f1693ec6","source":"wordfence","cve":"CVE-2025-49328","title":"Store Locator WordPress <= 1.5.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4671d360-407d-49ed-8e49-c317f1693ec6?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T14:54:20Z"},{"id":"wordfence:467261ba-f41f-4e94-8941-e5b3d8392fdb","source":"wordfence","cve":"CVE-2025-12644","title":"Nonaki \u2013 Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467261ba-f41f-4e94-8941-e5b3d8392fdb?source=api-prod","affected":[{"type":"plugin","slug":"nonaki-email-template-customizer","name":"Nonaki \u2013 Drag and Drop Email Template builder and Newsletter plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:23:59Z","updated":"2025-11-11T03:30:37Z"},{"id":"wordfence:46731877-03e1-4552-8993-3b121b457b1b","source":"wordfence","cve":"CVE-2026-2437","title":"WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46731877-03e1-4552-8993-3b121b457b1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"6.7.6"}],"published":"2026-04-03T19:44:38Z","updated":"2026-04-04T08:25:21Z"},{"id":"wordfence:4677042d-ff0a-4340-ada7-c82d2da0c01c","source":"wordfence","cve":"CVE-2024-30477","title":"Klarna Payments for WooCommerce <= 3.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4677042d-ff0a-4340-ada7-c82d2da0c01c?source=api-prod","affected":[{"type":"plugin","slug":"klarna-payments-for-woocommerce","name":"Klarna for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:20:03Z"},{"id":"wordfence:46776cd5-5262-46ea-b56c-0cbf2b9ae43d","source":"wordfence","cve":"CVE-2025-10143","title":"Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46776cd5-5262-46ea-b56c-0cbf2b9ae43d?source=api-prod","affected":[{"type":"plugin","slug":"catch-dark-mode","name":"Catch Dark Mode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T01:49:15Z"},{"id":"wordfence:4678d2a3-8f8d-488a-8d2b-6c321b96eb36","source":"wordfence","cve":"CVE-2024-52429","title":"WP Quick Setup <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4678d2a3-8f8d-488a-8d2b-6c321b96eb36?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-setup","name":"WP Quick Setup","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:31:11Z"},{"id":"wordfence:467a9b16-b57c-417c-b4e1-9f3edc80b5df","source":"wordfence","cve":"CVE-2023-25060","title":"Album and Image Gallery plus Lightbox <= 1.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467a9b16-b57c-417c-b4e1-9f3edc80b5df?source=api-prod","affected":[{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"*","from_inclusive":true,"to":"1.6.2.","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:467b2aeb-e116-4266-9f05-1e3322b84229","source":"wordfence","cve":"CVE-2025-32282","title":"ShareThis Dashboard for Google Analytics <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467b2aeb-e116-4266-9f05-1e3322b84229?source=api-prod","affected":[{"type":"plugin","slug":"googleanalytics","name":"ShareThis Dashboard for Google Analytics","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-04-04T00:00:00Z","updated":"2026-04-25T15:33:52Z"},{"id":"wordfence:467d5c09-2425-4050-98ca-a7c5d533af77","source":"wordfence","cve":"CVE-2024-2872","title":"Swift Framework < 2024.04.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467d5c09-2425-4050-98ca-a7c5d533af77?source=api-prod","affected":[{"type":"plugin","slug":"socialdriver-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2024.04.30","to_inclusive":false,"patched_in":"2024.04.30"}],"published":"2024-06-21T00:00:00Z","updated":"2024-08-02T20:13:25Z"},{"id":"wordfence:467dd833-2f47-43cd-8d13-dffdad394b3c","source":"wordfence","cve":"CVE-2026-1360","title":"BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467dd833-2f47-43cd-8d13-dffdad394b3c?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-29T15:16:33Z","updated":"2026-09-09T16:38:05Z"},{"id":"wordfence:467e0946-cfbb-4ea3-b2d9-db21d0f182cd","source":"wordfence","cve":"CVE-2020-36383","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via font-size","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467e0946-cfbb-4ea3-b2d9-db21d0f182cd?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"}],"published":"2020-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:467ede83-1ce3-41f2-bc2d-3b0e7a10442f","source":"wordfence","cve":"CVE-2025-47526","title":"GS Variation Swatches for WooCommerce <= 3.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467ede83-1ce3-41f2-bc2d-3b0e7a10442f?source=api-prod","affected":[{"type":"plugin","slug":"gs-woo-variation-swatches","name":"GS Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:40:17Z"},{"id":"wordfence:467f369f-1c7a-4b05-8901-d2850db86a33","source":"wordfence","cve":"CVE-2024-5570","title":"Simple Photoswipe <= 0.1 - Missing Authorization (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/467f369f-1c7a-4b05-8901-d2850db86a33?source=api-prod","affected":[{"type":"plugin","slug":"simple-photoswipe","name":"Simple Photoswipe","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-07-01T19:37:07Z"},{"id":"wordfence:4680ff56-43b9-47d1-8e28-1f6ad9038417","source":"wordfence","cve":"CVE-2025-53987","title":"JetMenu <= 2.4.11.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4680ff56-43b9-47d1-8e28-1f6ad9038417?source=api-prod","affected":[{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"2.4.11.1","to_inclusive":true,"patched_in":"2.4.11.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:13:34Z"},{"id":"wordfence:4681e56f-1dad-46a7-8ac7-1f543a383433","source":"wordfence","cve":"CVE-2025-7327","title":"Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4681e56f-1dad-46a7-8ac7-1f543a383433?source=api-prod","affected":[{"type":"plugin","slug":"business-reviews-wp","name":"Widget for Google Reviews","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-07-07T16:50:01Z","updated":"2025-07-08T05:23:36Z"},{"id":"wordfence:46825646-f611-4e9d-bee8-36656a1d54ff","source":"wordfence","cve":"CVE-2019-15110","title":"WP Front End Profile <= 0.2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46825646-f611-4e9d-bee8-36656a1d54ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":"0.2.2"}],"published":"2016-09-14T00:00:00Z","updated":"2025-06-10T13:05:07Z"},{"id":"wordfence:46828b2a-ed76-4074-9fb4-c36bf0fd012c","source":"wordfence","cve":"CVE-2021-24738","title":"Logo Carousel <= 3.4.1 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46828b2a-ed76-4074-9fb4-c36bf0fd012c?source=api-prod","affected":[{"type":"plugin","slug":"logo-carousel-free","name":"Logo Carousel \u2013 Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:468451f8-699d-4bb9-9e34-f35a537ac522","source":"wordfence","cve":"CVE-2026-97470","title":"Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/468451f8-699d-4bb9-9e34-f35a537ac522?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-15T17:09:10Z","updated":"2026-10-16T13:28:15Z"},{"id":"wordfence:46868a11-0c82-4bd3-82b5-9a19a5a0cef1","source":"wordfence","cve":"CVE-2024-3819","title":"Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46868a11-0c82-4bd3-82b5-9a19a5a0cef1?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:01Z"},{"id":"wordfence:4688c1ee-335c-4adb-bd68-894ff34d001d","source":"wordfence","cve":"CVE-2024-2786","title":"Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4688c1ee-335c-4adb-bd68-894ff34d001d?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-06-19T17:05:32Z"},{"id":"wordfence:468be776-8804-4d2f-8eaf-841bbf598ef9","source":"wordfence","cve":"CVE-2024-12627","title":"Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization to Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/468be776-8804-4d2f-8eaf-841bbf598ef9?source=api-prod","affected":[{"type":"plugin","slug":"coupon-x-discount-pop-up","name":"Coupon X \u2013 Discount Popups, Promo Codes Pop Ups for WooCommerce & Announcement Popups","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-01-10T14:13:54Z","updated":"2025-01-11T02:20:54Z"},{"id":"wordfence:468cd064-bb6a-43cf-bb8b-0058142111e8","source":"wordfence","cve":"CVE-2026-96819","title":"oik <= 4.15.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/468cd064-bb6a-43cf-bb8b-0058142111e8?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.15.4","to_inclusive":true,"patched_in":"4.16.0"}],"published":"2026-09-29T07:10:32Z","updated":"2026-10-09T00:10:27Z"},{"id":"wordfence:468fc0c3-288d-4d9c-a27a-68470f220c39","source":"wordfence","cve":"CVE-2025-23938","title":"Image Gallery Box by CRUDLab <= 1.0.3 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/468fc0c3-288d-4d9c-a27a-68470f220c39?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-box-by-crudlab","name":"Image Gallery Box by CRUDLab","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:50:34Z"},{"id":"wordfence:46901f22-3a43-42a0-8207-cb2280311335","source":"wordfence","cve":"CVE-2026-25411","title":"Revision Manager TMC <= 2.8.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46901f22-3a43-42a0-8207-cb2280311335?source=api-prod","affected":[{"type":"plugin","slug":"revision-manager-tmc","name":"Revision Manager TMC","from":"*","from_inclusive":true,"to":"2.8.22","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-26T19:54:55Z"},{"id":"wordfence:46903b3f-4041-4d1d-bf49-fb8bd2165c66","source":"wordfence","cve":"CVE-2025-50034","title":"Enhanced Blocks &#8211; Page Builder Blocks for Gutenberg <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46903b3f-4041-4d1d-bf49-fb8bd2165c66?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-blocks","name":"Enhanced Blocks \u2013 Page Builder Blocks for Gutenberg","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:52:52Z"},{"id":"wordfence:4694c218-fe90-4b5a-9874-267a240e551f","source":"wordfence","cve":"CVE-2026-120841","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce <= 2.3.8 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4694c218-fe90-4b5a-9874-267a240e551f?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2026-11-07T12:42:00Z","updated":"2026-11-10T19:39:04Z"},{"id":"wordfence:4694db04-5d00-4844-a5dd-7b64122c6e82","source":"wordfence","cve":"CVE-2026-32476","title":"Brave Conversion Engine (PRO) <= 0.8.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4694db04-5d00-4844-a5dd-7b64122c6e82?source=api-prod","affected":[{"type":"plugin","slug":"bravepopup-pro","name":"Brave Conversion Engine (PRO)","from":"*","from_inclusive":true,"to":"0.8.6","to_inclusive":true,"patched_in":"0.8.7"}],"published":"2026-08-24T08:01:49Z","updated":"2026-09-10T19:25:19Z"},{"id":"wordfence:46951d8d-f8f1-4fb5-b02a-1a19edd154e6","source":"wordfence","cve":"CVE-2024-13439","title":"Team \u2013 Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46951d8d-f8f1-4fb5-b02a-1a19edd154e6?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-15T11:26:48Z"},{"id":"wordfence:4695a394-66e3-4ce6-98cd-e169c6495e6a","source":"wordfence","cve":"CVE-2025-32248","title":"SwiftXR (3D/AR/VR) Viewer <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4695a394-66e3-4ce6-98cd-e169c6495e6a?source=api-prod","affected":[{"type":"plugin","slug":"swiftxr-3darvr-viewer","name":"SwiftXR (3D/AR/VR) Viewer","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-04-04T00:00:00Z","updated":"2026-06-18T14:57:58Z"},{"id":"wordfence:4696e474-07b6-4362-afe1-2847e24c08b8","source":"wordfence","cve":"CVE-2026-104722","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4696e474-07b6-4362-afe1-2847e24c08b8?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-10-09T19:43:23Z","updated":"2026-10-10T08:26:40Z"},{"id":"wordfence:46978e1d-7adb-49f6-8e41-093f177c9a4d","source":"wordfence","cve":"CVE-2023-6805","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46978e1d-7adb-49f6-8e41-093f177c9a4d?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:36:17Z"},{"id":"wordfence:4699a9d7-4b72-4266-90be-1407e7d5b1eb","source":"wordfence","cve":"CVE-2026-7047","title":"Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4699a9d7-4b72-4266-90be-1407e7d5b1eb?source=api-prod","affected":[{"type":"plugin","slug":"frontend-user-notes","name":"Frontend User Notes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-06-05T10:36:02Z","updated":"2026-06-05T23:28:25Z"},{"id":"wordfence:469a702f-033a-40de-b725-b0ad4f8e92e8","source":"wordfence","cve":"","title":"Ship To eCourier <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/469a702f-033a-40de-b725-b0ad4f8e92e8?source=api-prod","affected":[{"type":"plugin","slug":"ship-to-ecourier","name":"Ship To eCourier","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2021-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:469a9c8a-0708-4c93-99d8-e9157a1f91f5","source":"wordfence","cve":"CVE-2025-4392","title":"Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/469a9c8a-0708-4c93-99d8-e9157a1f91f5?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.48","to_inclusive":true,"patched_in":"1.7.49"}],"published":"2025-06-02T21:07:01Z","updated":"2025-06-03T09:22:05Z"},{"id":"wordfence:469bf5c9-984e-4107-a8a2-da744a78b8b2","source":"wordfence","cve":"","title":"Cimy User Manager < 1.4.4 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/469bf5c9-984e-4107-a8a2-da744a78b8b2?source=api-prod","affected":[{"type":"plugin","slug":"cimy-user-manager","name":"Cimy User Manager","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2012-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46a022ff-7ec8-48bc-b0ae-8e925ea3f361","source":"wordfence","cve":"CVE-2021-39315","title":"Magic Post Voice <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46a022ff-7ec8-48bc-b0ae-8e925ea3f361?source=api-prod","affected":[{"type":"plugin","slug":"magic-post-voice","name":"Magic Post Voice","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46a16b7b-6de4-49a6-83e3-309f8ab43505","source":"wordfence","cve":"CVE-2020-17362","title":"Nova Lite < 1.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46a16b7b-6de4-49a6-83e3-309f8ab43505?source=api-prod","affected":[{"type":"theme","slug":"nova-lite","name":"Nova Lite","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2020-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46a36f2b-c352-4d76-b4c4-8a73ec5dd910","source":"wordfence","cve":"CVE-2026-6798","title":"2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46a36f2b-c352-4d76-b4c4-8a73ec5dd910?source=api-prod","affected":[{"type":"plugin","slug":"2download-connector","name":"2Download Connector for 2DL Hosted Checkout","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":"0.1.6"}],"published":"2026-06-18T17:37:00Z","updated":"2026-06-19T06:51:07Z"},{"id":"wordfence:46a9475b-f738-47d5-b6fa-daf331e0edf4","source":"wordfence","cve":"CVE-2025-31046","title":"AnyWhere Elementor Pro <= 2.29 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46a9475b-f738-47d5-b6fa-daf331e0edf4?source=api-prod","affected":[{"type":"theme","slug":"anywhere-elementor-pro","name":"AnyWhere Elementor Pro","from":"*","from_inclusive":true,"to":"2.29","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:43:20Z"},{"id":"wordfence:46aa3df1-d6ef-4614-b1cc-a4c9baa8d1c0","source":"wordfence","cve":"CVE-2024-3476","title":"Side Menu Lite \u2013 add sticky fixed buttons <= 4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46aa3df1-d6ef-4614-b1cc-a4c9baa8d1c0?source=api-prod","affected":[{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:06:08Z"},{"id":"wordfence:46ab2615-a1eb-4740-836c-781e961252e7","source":"wordfence","cve":"CVE-2024-32087","title":"Product Feed on WooCommerce for Google <= 3.5.7 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46ab2615-a1eb-4740-836c-781e961252e7?source=api-prod","affected":[{"type":"plugin","slug":"purple-xmls-google-product-feed-for-woocommerce","name":"Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-18T14:53:47Z"},{"id":"wordfence:46abb44e-bfa8-4b36-bd5d-b27e18fbb0f3","source":"wordfence","cve":"CVE-2025-13153","title":"Logo Slider <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46abb44e-bfa8-4b36-bd5d-b27e18fbb0f3?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2025-12-12T00:00:00Z","updated":"2026-01-06T16:00:20Z"},{"id":"wordfence:46abc856-3138-4079-8415-6bb295f33b1b","source":"wordfence","cve":"CVE-2026-57786","title":"WorkScout-Core <= 1.7.08 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46abc856-3138-4079-8415-6bb295f33b1b?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.7.08","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-29T23:05:31Z"},{"id":"wordfence:46b3b01c-8739-4b51-be34-1dd3c50d772e","source":"wordfence","cve":"CVE-2009-2852","title":"WP Syntax < 0.9.10 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b3b01c-8739-4b51-be34-1dd3c50d772e?source=api-prod","affected":[{"type":"plugin","slug":"wp-syntax","name":"WP-Syntax","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":"0.9.10"}],"published":"2009-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46b3f3fb-5bd5-4af4-a281-647ad0b8e992","source":"wordfence","cve":"","title":"Google Map <= 2.2.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b3f3fb-5bd5-4af4-a281-647ad0b8e992?source=api-prod","affected":[{"type":"plugin","slug":"google-map-wp","name":"Google Map","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46b6dd7d-cbf7-4e8b-8ff5-347b966d8689","source":"wordfence","cve":"CVE-2025-62147","title":"Realbig <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b6dd7d-cbf7-4e8b-8ff5-347b966d8689?source=api-prod","affected":[{"type":"plugin","slug":"realbig-media","name":"Realbig For WordPress","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:31:40Z"},{"id":"wordfence:46b7820c-f36d-4c7d-b326-07259786fc6a","source":"wordfence","cve":"CVE-2025-11893","title":"Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b7820c-f36d-4c7d-b326-07259786fc6a?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.8.4","to_inclusive":true,"patched_in":"1.8.8.5"}],"published":"2025-10-24T17:36:30Z","updated":"2025-10-31T14:32:55Z"},{"id":"wordfence:46b8fac7-fb18-40c8-ab23-d2c14fcf3ac5","source":"wordfence","cve":"CVE-2026-42761","title":"Active Products Tables for WooCommerce. Use constructor to create tables\u00a0 <= 1.0.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b8fac7-fb18-40c8-ab23-d2c14fcf3ac5?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:53:59Z"},{"id":"wordfence:46b9ca33-e140-48de-88bc-3dc1dc338c70","source":"wordfence","cve":"CVE-2025-23586","title":"WP Post Category Notifications <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46b9ca33-e140-48de-88bc-3dc1dc338c70?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-category-notifications","name":"WP Post Category Notifications","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:16:36Z"},{"id":"wordfence:46ba9993-4504-4c14-93ce-0ae49f31955f","source":"wordfence","cve":"CVE-2026-22466","title":"MapIt <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46ba9993-4504-4c14-93ce-0ae49f31955f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mapit","name":"WP MapIt","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-04T00:00:00Z","updated":"2026-01-14T19:27:43Z"},{"id":"wordfence:46bc15d6-dc1b-40ec-8bb9-5342a4f84372","source":"wordfence","cve":"CVE-2024-33555","title":"XStore Core <= 5.3.8 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46bc15d6-dc1b-40ec-8bb9-5342a4f84372?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:43:26Z"},{"id":"wordfence:46bff42e-d2f6-4221-9920-0fc993a9e939","source":"wordfence","cve":"CVE-2025-30823","title":"Anthologize <= 0.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46bff42e-d2f6-4221-9920-0fc993a9e939?source=api-prod","affected":[{"type":"plugin","slug":"anthologize","name":"Anthologize","from":"*","from_inclusive":true,"to":"0.8.2","to_inclusive":true,"patched_in":"0.8.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:37:21Z"},{"id":"wordfence:46c0fa1e-f400-435c-b781-23919a192e89","source":"wordfence","cve":"CVE-2024-56051","title":"WPLMS < 1.9.9.5 - Authenticated (Student+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c0fa1e-f400-435c-b781-23919a192e89?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5","to_inclusive":false,"patched_in":"1.9.9.5"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:48:25Z"},{"id":"wordfence:46c40aed-1df9-4c20-9058-1ae62864fc9d","source":"wordfence","cve":"CVE-2022-45824","title":"Advanced Booking Calendar <= 1.7.1 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c40aed-1df9-4c20-9058-1ae62864fc9d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46c4b7f7-e3e6-46b8-b959-07775db8bb6c","source":"wordfence","cve":"CVE-2023-41876","title":"WP Gallery Metabox <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c4b7f7-e3e6-46b8-b959-07775db8bb6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-gallery-metabox","name":"WP Gallery Metabox","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46c5d4ba-8c88-4b63-bafa-9d5afc37a7e0","source":"wordfence","cve":"CVE-2025-58941","title":"Fabric <= 1.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c5d4ba-8c88-4b63-bafa-9d5afc37a7e0?source=api-prod","affected":[{"type":"theme","slug":"fabric","name":"Fabric - Fashion & Textile Manufacturing Theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:34:46Z"},{"id":"wordfence:46c61f38-553e-43b2-a666-b160db40e66d","source":"wordfence","cve":"CVE-2023-6733","title":"WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c61f38-553e-43b2-a666-b160db40e66d?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:36:17Z"},{"id":"wordfence:46c988ff-9cc5-4f2b-a3dd-06eaef5a7919","source":"wordfence","cve":"CVE-2025-14937","title":"Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c988ff-9cc5-4f2b-a3dd-06eaef5a7919?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.23","to_inclusive":true,"patched_in":"3.28.24"}],"published":"2026-01-08T18:46:31Z","updated":"2026-01-09T07:22:30Z"},{"id":"wordfence:46c9dae7-d811-4b59-94c1-71a83652a14d","source":"wordfence","cve":"CVE-2025-1773","title":"Traveler <= 3.1.8  - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46c9dae7-d811-4b59-94c1-71a83652a14d?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-03-14T00:00:00Z","updated":"2025-03-15T04:22:07Z"},{"id":"wordfence:46ca2967-5b75-49f5-8b0c-1e9274423c93","source":"wordfence","cve":"CVE-2021-36844","title":"WP Subscribe <= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46ca2967-5b75-49f5-8b0c-1e9274423c93?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscribe","name":"WP Subscribe","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2022-05-02T14:11:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46cc1643-fc65-483c-923d-a458786f8e23","source":"wordfence","cve":"CVE-2024-49299","title":"Surfer <= 1.5.0.502 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46cc1643-fc65-483c-923d-a458786f8e23?source=api-prod","affected":[{"type":"plugin","slug":"surferseo","name":"Surfer \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.5.0.502","to_inclusive":true,"patched_in":"1.6.0.523"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-15T16:42:31Z"},{"id":"wordfence:46d3693b-61b5-4d93-a584-76b207c76806","source":"wordfence","cve":"CVE-2025-23791","title":"Horizontal Line Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46d3693b-61b5-4d93-a584-76b207c76806?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-line-shortcode","name":"Horizontal Line Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:49:11Z"},{"id":"wordfence:46d4d573-3845-4d20-8a48-a2f28850383c","source":"wordfence","cve":"CVE-2024-1570","title":"ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46d4d573-3845-4d20-8a48-a2f28850383c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2024-02-19T00:00:00Z","updated":"2024-05-31T15:30:18Z"},{"id":"wordfence:46d537b7-7d07-4d2b-83d7-484c240b6e72","source":"wordfence","cve":"CVE-2026-66594","title":"Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46d537b7-7d07-4d2b-83d7-484c240b6e72?source=api-prod","affected":[{"type":"plugin","slug":"wp-persistent-login","name":"Persistent Login","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:09:23Z"},{"id":"wordfence:46d65fed-cb21-46e1-bafe-eda11c25a467","source":"wordfence","cve":"CVE-2023-26016","title":"Simple Portfolio Gallery <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46d65fed-cb21-46e1-bafe-eda11c25a467?source=api-prod","affected":[{"type":"plugin","slug":"simple-portfolio-gallery","name":"Simple Portfolio Gallery","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46d83cc9-0094-4f08-a8f2-270d5dbd66ac","source":"wordfence","cve":"CVE-2025-32614","title":"EventON <= 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46d83cc9-0094-4f08-a8f2-270d5dbd66ac?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-05T18:28:23Z"},{"id":"wordfence:46db2123-d33a-4093-8254-32ff8ff347a3","source":"wordfence","cve":"CVE-2026-25016","title":"Nelio Popups <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46db2123-d33a-4093-8254-32ff8ff347a3?source=api-prod","affected":[{"type":"plugin","slug":"nelio-popups","name":"Nelio Popups","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T19:59:09Z"},{"id":"wordfence:46db2d07-66a6-4d9e-b0fd-ddf6119ba5be","source":"wordfence","cve":"CVE-2023-25049","title":"Vulnerability: eCommerce Product Catalog plugin for WordPress <= 3.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46db2d07-66a6-4d9e-b0fd-ddf6119ba5be?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46dd24c7-8967-41f0-9c3d-985bc6db6423","source":"wordfence","cve":"CVE-2026-121724","title":"Contextual Related Posts <= 4.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46dd24c7-8967-41f0-9c3d-985bc6db6423?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-11-07T10:33:00Z","updated":"2026-11-10T19:45:22Z"},{"id":"wordfence:46df438c-abff-4cf3-a732-02e0b3196bac","source":"wordfence","cve":"CVE-2024-3071","title":"ACF On-The-Go <= 1.0.1 -  Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46df438c-abff-4cf3-a732-02e0b3196bac?source=api-prod","affected":[{"type":"plugin","slug":"acf-on-the-go","name":"ACF On-The-Go","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-04-29T00:00:00Z","updated":"2026-08-15T18:22:08Z"},{"id":"wordfence:46e15cc0-0a1c-4268-a431-e943526b12f7","source":"wordfence","cve":"CVE-2025-31894","title":"Ebook Downloader <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e15cc0-0a1c-4268-a431-e943526b12f7?source=api-prod","affected":[{"type":"plugin","slug":"ebook-downloader","name":"Ebook Downloader","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:11:35Z"},{"id":"wordfence:46e2693a-809f-43f9-b189-35a0c73bf34e","source":"wordfence","cve":"CVE-2021-24316","title":"Mediumish <= 1.0.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e2693a-809f-43f9-b189-35a0c73bf34e?source=api-prod","affected":[{"type":"theme","slug":"mediumishh","name":"Mediumish","from":"*","from_inclusive":true,"to":"1.0.60","to_inclusive":true,"patched_in":""}],"published":"2021-05-16T00:00:00Z","updated":"2024-07-25T20:54:31Z"},{"id":"wordfence:46e47284-2757-40d0-ac76-292a690cfcbb","source":"wordfence","cve":"CVE-2024-37918","title":"ConeBlog \u2013 WordPress Blog Widgets <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e47284-2757-40d0-ac76-292a690cfcbb?source=api-prod","affected":[{"type":"plugin","slug":"coneblog-widgets","name":"ConeBlog \u2013 Elementor Blog Widgets","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:25:14Z"},{"id":"wordfence:46e49743-7609-46bb-ba5b-d2751dd77021","source":"wordfence","cve":"CVE-2026-22512","title":"Roisin <= 1.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e49743-7609-46bb-ba5b-d2751dd77021?source=api-prod","affected":[{"type":"theme","slug":"roisin","name":"Roisin - Flower Shop and Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-03-06T00:00:00Z","updated":"2026-04-15T13:41:03Z"},{"id":"wordfence:46e4b441-651b-4755-a440-1a4496f5c79e","source":"wordfence","cve":"CVE-2026-28060","title":"S.King <= 1.5.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e4b441-651b-4755-a440-1a4496f5c79e?source=api-prod","affected":[{"type":"theme","slug":"stephanie-king","name":"S.King | Personal Stylist and Fashion Blogger WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-05-05T15:55:04Z"},{"id":"wordfence:46e53bf4-49af-45d8-b672-1f9b2f2dd91f","source":"wordfence","cve":"CVE-2024-30179","title":"Bold Page Builder <= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e53bf4-49af-45d8-b672-1f9b2f2dd91f?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":true,"patched_in":"4.7.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T17:11:22Z"},{"id":"wordfence:46e64a82-4d3f-4887-9c03-3285a6ddefb7","source":"wordfence","cve":"CVE-2025-15441","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e64a82-4d3f-4887-9c03-3285a6ddefb7?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.38","to_inclusive":false,"patched_in":"1.15.38"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-04T14:29:36Z"},{"id":"wordfence:46e66230-06d6-452e-a7aa-862b2bb8c27d","source":"wordfence","cve":"CVE-2024-2165","title":"SEOPress \u2013 On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e66230-06d6-452e-a7aa-862b2bb8c27d?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.5.2.1","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-03-22T00:00:00Z","updated":"2024-04-09T18:58:47Z"},{"id":"wordfence:46e7ca97-6dd9-4e27-8e69-2e73f9490ea7","source":"wordfence","cve":"CVE-2023-44232","title":"WP Hide Pages <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46e7ca97-6dd9-4e27-8e69-2e73f9490ea7?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-pages","name":"WP Hide Pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46edd7fd-1a28-4cd3-89df-d5cb0ba16540","source":"wordfence","cve":"CVE-2025-62053","title":"Houzez < 4.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46edd7fd-1a28-4cd3-89df-d5cb0ba16540?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T15:12:59Z"},{"id":"wordfence:46ee11ee-79ef-4a64-8e04-43915fb4774e","source":"wordfence","cve":"CVE-2026-84774","title":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46ee11ee-79ef-4a64-8e04-43915fb4774e?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.11","to_inclusive":true,"patched_in":"14.16.12"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:34:24Z"},{"id":"wordfence:46f144c9-2cd3-4320-b987-119b672e7e30","source":"wordfence","cve":"CVE-2018-18373","title":"Support Board for WordPress <= 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f144c9-2cd3-4320-b987-119b672e7e30?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2018-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46f1c52b-8b82-4ea7-8c24-37c27b3e0a27","source":"wordfence","cve":"CVE-2026-77007","title":"HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f1c52b-8b82-4ea7-8c24-37c27b3e0a27?source=api-prod","affected":[{"type":"plugin","slug":"hel-online-classroom","name":"HEL Online Classroom: AI-powered Online Classrooms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:34:06Z"},{"id":"wordfence:46f31a60-0a0e-449d-a10a-3cafd0492a9c","source":"wordfence","cve":"CVE-2023-34027","title":"Recently Viewed Products <= 1.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f31a60-0a0e-449d-a10a-3cafd0492a9c?source=api-prod","affected":[{"type":"plugin","slug":"recently-viewed-products","name":"Recently Viewed Products","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46f33846-d70e-41bd-b5e1-7c065a2c201f","source":"wordfence","cve":"CVE-2025-68049","title":"bunny.net \u2013 WordPress CDN Plugin <= 2.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f33846-d70e-41bd-b5e1-7c065a2c201f?source=api-prod","affected":[{"type":"plugin","slug":"bunnycdn","name":"bunny.net \u2013 WordPress CDN Plugin","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:12:48Z"},{"id":"wordfence:46f3cc62-c2d8-45af-bb92-c2040789cbc0","source":"wordfence","cve":"CVE-2023-37999","title":"HT Mega \u2013 Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f3cc62-c2d8-45af-bb92-c2040789cbc0?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46f5d1fa-dba7-4882-be29-39dc281d7278","source":"wordfence","cve":"CVE-2023-30491","title":"CodeBard's Patron Button and Widgets for Patreon <= 2.1.8 - Reflected Cross-Site Scripting via 'site_account'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f5d1fa-dba7-4882-be29-39dc281d7278?source=api-prod","affected":[{"type":"plugin","slug":"patron-button-and-widgets-by-codebard","name":"CodeBard\u2019s Patron Button and Widgets for Patreon","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46f69f7b-6d9b-494d-b123-63fc5ebcb6f3","source":"wordfence","cve":"CVE-2026-103889","title":"3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f69f7b-6d9b-494d-b123-63fc5ebcb6f3?source=api-prod","affected":[{"type":"plugin","slug":"expivi","name":"3D Product configurator for WooCommerce","from":"*","from_inclusive":true,"to":"2.16.2","to_inclusive":true,"patched_in":"2.16.3"}],"published":"2026-10-09T15:36:50Z","updated":"2026-10-10T04:26:44Z"},{"id":"wordfence:46f71f7b-7326-47b6-a23a-68a40f5bb56b","source":"wordfence","cve":"CVE-2025-13628","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f71f7b-7326-47b6-a23a-68a40f5bb56b?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-01-08T19:03:12Z","updated":"2026-01-09T07:22:31Z"},{"id":"wordfence:46f7dc18-fc07-400a-bb79-0d9821299023","source":"wordfence","cve":"CVE-2023-23785","title":"Exquisite PayPal Donation <= v2.0.0 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46f7dc18-fc07-400a-bb79-0d9821299023?source=api-prod","affected":[{"type":"plugin","slug":"exquisite-paypal-donation","name":"Exquisite PayPal Donation","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:46fa99f1-9152-4130-a5b1-2ea10032069b","source":"wordfence","cve":"CVE-2026-13191","title":"Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46fa99f1-9152-4130-a5b1-2ea10032069b?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-09-18T19:11:05Z","updated":"2026-09-19T07:43:15Z"},{"id":"wordfence:46fccb4e-8dd9-414d-bd65-e62acffee18d","source":"wordfence","cve":"CVE-2024-33682","title":"WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46fccb4e-8dd9-414d-bd65-e62acffee18d?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-compliance","name":"Cookie Information | Free GDPR Consent Solution","from":"*","from_inclusive":true,"to":"2.0.23","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T13:55:49Z"},{"id":"wordfence:46fd4e5d-e1d7-4de6-ae24-66e260a1b288","source":"wordfence","cve":"CVE-2025-69316","title":"TableOn <= 1.0.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46fd4e5d-e1d7-4de6-ae24-66e260a1b288?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.4.2","to_inclusive":true,"patched_in":"1.0.4.3"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:33:25Z"},{"id":"wordfence:46fdd494-8073-4a68-a4ab-1f5767011f67","source":"wordfence","cve":"CVE-2022-25860","title":"simple-git < 3.16.0 - Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46fdd494-8073-4a68-a4ab-1f5767011f67?source=api-prod","affected":[{"type":"plugin","slug":"insecure-content-warning","name":"Insecure Content Warning","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"retro-winamp-block","name":"Retro Winamp Block","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"plugin","slug":"simple-podcasting","name":"Simple Podcasting","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"ads-txt","name":"Ads.txt Manager","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2023-02-23T00:00:00Z","updated":"2025-07-18T23:41:21Z"},{"id":"wordfence:46ff3005-49aa-4dc8-82cc-f10dc91d252d","source":"wordfence","cve":"CVE-2026-57393","title":"PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/46ff3005-49aa-4dc8-82cc-f10dc91d252d?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:06:33Z"},{"id":"wordfence:4701d3b2-1bf4-430d-b8c8-95da5d699a89","source":"wordfence","cve":"CVE-2026-11767","title":"CRT Addons for Elementor <= 1.6.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4701d3b2-1bf4-430d-b8c8-95da5d699a89?source=api-prod","affected":[{"type":"plugin","slug":"crt-manage","name":"CRT Addons Builder and Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-29T22:20:45Z"},{"id":"wordfence:4701efb1-4208-4178-90c0-bfc006d1a72a","source":"wordfence","cve":"CVE-2022-30533","title":"Modern Events Calendar Lite <= 6.2.9 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4701efb1-4208-4178-90c0-bfc006d1a72a?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:470285d6-b309-409c-b2c3-8766a0cf9e98","source":"wordfence","cve":"CVE-2024-23512","title":"ProductX \u2013 WooCommerce Builder & Gutenberg WooCommerce Blocks <= 3.1.4 - PHP Object Injection via wopb_wishlist and wopb_compare","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/470285d6-b309-409c-b2c3-8766a0cf9e98?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-01T18:44:04Z"},{"id":"wordfence:47060d4c-00c5-4df9-9c0f-65ec4569cf2c","source":"wordfence","cve":"CVE-2025-30534","title":"Image Captcha <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47060d4c-00c5-4df9-9c0f-65ec4569cf2c?source=api-prod","affected":[{"type":"plugin","slug":"image-captcha","name":"Image Captcha","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:00:48Z"},{"id":"wordfence:4707fcf6-ad11-4ffc-ba56-30f6571e3d9e","source":"wordfence","cve":"CVE-2022-4027","title":"Simple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Replies","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4707fcf6-ad11-4ffc-ba56-30f6571e3d9e?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:470d64e6-9dd5-4069-8b16-ea26a3b9f0e1","source":"wordfence","cve":"CVE-2025-60140","title":"The Tribal <= 1.3.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/470d64e6-9dd5-4069-8b16-ea26a3b9f0e1?source=api-prod","affected":[{"type":"plugin","slug":"the-tech-tribe","name":"The Tribal Plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T20:59:04Z"},{"id":"wordfence:470d91c1-bcde-4497-a558-35bc0156ddca","source":"wordfence","cve":"CVE-2021-24130","title":"WP Google Map Plugin <= 4.1.4 - Authenticated SQL Injection via Orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/470d91c1-bcde-4497-a558-35bc0156ddca?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2020-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:470fb8d4-3d60-4a8e-a89b-2d64203c1f0b","source":"wordfence","cve":"CVE-2025-62895","title":"Atarim <= 4.2.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/470fb8d4-3d60-4a8e-a89b-2d64203c1f0b?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-09-15T00:00:00Z","updated":"2025-12-12T16:21:42Z"},{"id":"wordfence:470fbac6-45bf-400e-b415-32e7989abbad","source":"wordfence","cve":"CVE-2020-9006","title":"Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/470fbac6-45bf-400e-b415-32e7989abbad?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"2.2.8","from_inclusive":true,"to":"2.6.7.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2020-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4711e3d5-b70c-413e-97e7-6d2e93e8217e","source":"wordfence","cve":"CVE-2025-11197","title":"Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4711e3d5-b70c-413e-97e7-6d2e93e8217e?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2025-10-10T19:04:54Z","updated":"2025-10-11T07:25:56Z"},{"id":"wordfence:47122866-8e40-42bc-84ed-60fc81247320","source":"wordfence","cve":"CVE-2024-0249","title":"Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47122866-8e40-42bc-84ed-60fc81247320?source=api-prod","affected":[{"type":"plugin","slug":"advanced-schedule-posts","name":"Advanced Schedule Posts","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:50:11Z"},{"id":"wordfence:4712b12f-097b-4106-b2ba-e4c6cb7c32c2","source":"wordfence","cve":"CVE-2023-51700","title":"WP-Mobile-BankID-Integration <= 1.0.0 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4712b12f-097b-4106-b2ba-e4c6cb7c32c2?source=api-prod","affected":[{"type":"plugin","slug":"WP-Mobile-BankID-Integration","name":"WP-Mobile-BankID-Integration","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-02-07T13:37:25Z"},{"id":"wordfence:471527e8-8a72-49dd-9dff-27fb8300ce6a","source":"wordfence","cve":"CVE-2026-39576","title":"SingleMalt <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/471527e8-8a72-49dd-9dff-27fb8300ce6a?source=api-prod","affected":[{"type":"theme","slug":"singlemalt","name":"SingleMalt - Drink Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:52:54Z"},{"id":"wordfence:471957f6-54c1-4268-b2e1-8efa391dcaec","source":"wordfence","cve":"CVE-2022-2436","title":"Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/471957f6-54c1-4268-b2e1-8efa391dcaec?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.49","to_inclusive":true,"patched_in":"3.2.50"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:471e1080-e9bc-4241-ae71-8bfeac94b0b4","source":"wordfence","cve":"CVE-2025-31862","title":"Job Board Manager <= 2.1.60 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/471e1080-e9bc-4241-ae71-8bfeac94b0b4?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:25:47Z"},{"id":"wordfence:47243ee1-42da-480c-94b8-bdebd8f9eac6","source":"wordfence","cve":"CVE-2025-22716","title":"Taskbuilder <= 3.0.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47243ee1-42da-480c-94b8-bdebd8f9eac6?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T21:01:12Z"},{"id":"wordfence:472551ce-d6a9-4c58-b228-1a7c51ffdc63","source":"wordfence","cve":"CVE-2026-119482","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/472551ce-d6a9-4c58-b228-1a7c51ffdc63?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.7.1","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-10-30T15:01:00Z","updated":"2026-11-03T19:51:36Z"},{"id":"wordfence:4727154c-c48f-4958-9520-cc5204927ee4","source":"wordfence","cve":"CVE-2024-0632","title":"Automatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4727154c-c48f-4958-9520-cc5204927ee4?source=api-prod","affected":[{"type":"plugin","slug":"auto-translate","name":"Automatic Translator with Google Translate","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T00:00:00Z","updated":"2024-07-29T21:36:17Z"},{"id":"wordfence:47295f41-45d8-4ee3-8cf5-6b34f670bca4","source":"wordfence","cve":"CVE-2026-112821","title":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47295f41-45d8-4ee3-8cf5-6b34f670bca4?source=api-prod","affected":[{"type":"plugin","slug":"knit-pay","name":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more","from":"*","from_inclusive":true,"to":"9.6.3.0","to_inclusive":true,"patched_in":"9.6.3.1"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:26Z"},{"id":"wordfence:4729ed37-96b2-4717-8a72-89b9a21ec058","source":"wordfence","cve":"CVE-2024-10957","title":"UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4729ed37-96b2-4717-8a72-89b9a21ec058?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"1.23.8","from_inclusive":true,"to":"1.24.11","to_inclusive":true,"patched_in":"1.24.12"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-06T16:36:45Z"},{"id":"wordfence:472a98fe-9cce-4e9f-b353-ccc1389506fd","source":"wordfence","cve":"CVE-2014-3123","title":"NextCellent Gallery  < 1.9.18 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/472a98fe-9cce-4e9f-b353-ccc1389506fd?source=api-prod","affected":[{"type":"plugin","slug":"nextcellent-gallery-nextgen-legacy","name":"NextCellent Gallery \u2013 NextGEN Legacy","from":"*","from_inclusive":true,"to":"1.9.18","to_inclusive":false,"patched_in":"1.9.18"}],"published":"2014-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:472b523f-b987-4da0-8533-54ae076d7a6b","source":"wordfence","cve":"","title":"Email Artillery (MASS EMAIL) <= 4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/472b523f-b987-4da0-8533-54ae076d7a6b?source=api-prod","affected":[{"type":"plugin","slug":"email-artillery","name":"Email Artillery (MASS EMAIL)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:472cdbc4-3bfa-4254-b35a-be7ae10782e6","source":"wordfence","cve":"CVE-2023-4689","title":"Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/472cdbc4-3bfa-4254-b35a-be7ae10782e6?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.7","to_inclusive":true,"patched_in":"1.12.8"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:472dc1aa-d6b6-4f9d-99c2-ac5b1b417a3e","source":"wordfence","cve":"CVE-2026-14817","title":"Element Pack Addons for Elementor \u2013 Elementor Widgets, Elementor Templates, Elementor Addons < 8.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/472dc1aa-d6b6-4f9d-99c2-ac5b1b417a3e?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.7.13","to_inclusive":false,"patched_in":"8.7.13"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:26:30Z"},{"id":"wordfence:47304b6e-6fea-4acd-bd5b-a4a65e15db9b","source":"wordfence","cve":"CVE-2025-39397","title":"Anything Popup <= 7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47304b6e-6fea-4acd-bd5b-a4a65e15db9b?source=api-prod","affected":[{"type":"plugin","slug":"anything-popup","name":"Anything Popup","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:05:21Z"},{"id":"wordfence:4731eb39-8c01-4a2b-80f7-15d8c13a19b5","source":"wordfence","cve":"CVE-2023-6624","title":"Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4731eb39-8c01-4a2b-80f7-15d8c13a19b5?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.24.3","to_inclusive":true,"patched_in":"1.24.4"}],"published":"2023-12-11T00:00:00Z","updated":"2024-07-29T21:36:18Z"},{"id":"wordfence:47337214-9cc3-4b12-bb71-9acbab3649b7","source":"wordfence","cve":"CVE-2023-3459","title":"Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change","severity":"high","cvss":7.2,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47337214-9cc3-4b12-bb71-9acbab3649b7?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47337bc1-fa3d-470c-9524-859295261017","source":"wordfence","cve":"CVE-2026-87796","title":"Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47337bc1-fa3d-470c-9524-859295261017?source=api-prod","affected":[{"type":"plugin","slug":"gf-multi-uploader","name":"Multi Uploader for Gravity Forms","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T16:20:28Z","updated":"2026-09-17T04:28:15Z"},{"id":"wordfence:4734243a-aa67-4626-b2cf-a1e746f61dc1","source":"wordfence","cve":"CVE-2026-39617","title":"Bluestreet <= 1.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4734243a-aa67-4626-b2cf-a1e746f61dc1?source=api-prod","affected":[{"type":"theme","slug":"bluestreet","name":"Bluestreet","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T21:18:49Z"},{"id":"wordfence:4735c491-9595-42b8-bb1c-1b18c89fcf7a","source":"wordfence","cve":"CVE-2021-39327","title":"BulletProof Security <= 5.1 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4735c491-9595-42b8-bb1c-1b18c89fcf7a?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.2"}],"published":"2021-09-16T15:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4735dfe7-ad24-4427-8760-64ff4acd95ed","source":"wordfence","cve":"CVE-2025-52792","title":"WP User Stylesheet Switcher <= v2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4735dfe7-ad24-4427-8760-64ff4acd95ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-stylesheet-switcher","name":"WP User Stylesheet Switcher","from":"*","from_inclusive":true,"to":"v2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:03:53Z"},{"id":"wordfence:4736d139-814e-4eeb-91e8-5ee41fc35a8f","source":"wordfence","cve":"CVE-2025-13642","title":"ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4736d139-814e-4eeb-91e8-5ee41fc35a8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.7","to_inclusive":true,"patched_in":"4.16.8"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-09T15:23:49Z"},{"id":"wordfence:4739ec47-9434-4342-a25f-43b8ef568fec","source":"wordfence","cve":"CVE-2024-52457","title":"Youneeq Recommendations <= 3.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4739ec47-9434-4342-a25f-43b8ef568fec?source=api-prod","affected":[{"type":"plugin","slug":"youneeq-panel","name":"Youneeq Recommendations","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:24:53Z"},{"id":"wordfence:473ba791-af99-4aae-99cb-ccf220e443e7","source":"wordfence","cve":"CVE-2023-3713","title":"ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/473ba791-af99-4aae-99cb-ccf220e443e7?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:473bef81-b2c9-429c-aa23-c2dba0908cc3","source":"wordfence","cve":"CVE-2024-50555","title":"Elementor Website Builder <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/473bef81-b2c9-429c-aa23-c2dba0908cc3?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.29.1"},{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:04:36Z"},{"id":"wordfence:473eab06-67c8-4143-9d00-eb2866f101c7","source":"wordfence","cve":"CVE-2024-30493","title":"Church Admin <= 4.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/473eab06-67c8-4143-9d00-eb2866f101c7?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:04:05Z"},{"id":"wordfence:473ff00e-e045-4b66-b0af-89d666de4de8","source":"wordfence","cve":"","title":"Crelly Slider <= 1.1.1 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/473ff00e-e045-4b66-b0af-89d666de4de8?source=api-prod","affected":[{"type":"plugin","slug":"crelly-slider","name":"Crelly Slider","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2017-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:474494ad-6713-4167-b40d-c29c533f169e","source":"wordfence","cve":"CVE-2023-25975","title":"Etsy Shop <= 3.0.3 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/474494ad-6713-4167-b40d-c29c533f169e?source=api-prod","affected":[{"type":"plugin","slug":"etsy-shop","name":"Etsy Shop","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4744edff-d130-4f45-93a0-a67ec91dbe10","source":"wordfence","cve":"CVE-2019-14792","title":"WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4744edff-d130-4f45-93a0-a67ec91dbe10?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"7.11.35","to_inclusive":false,"patched_in":"7.11.35"}],"published":"2019-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47461b7b-e986-4048-88aa-175242305795","source":"wordfence","cve":"CVE-2023-47528","title":"WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47461b7b-e986-4048-88aa-175242305795?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-username","name":"WP Edit Username","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-22T15:36:46Z"},{"id":"wordfence:474ad5a5-6384-41cb-a60b-e25477d48ad7","source":"wordfence","cve":"CVE-2015-5682","title":"Powerplay Gallery <= 3.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/474ad5a5-6384-41cb-a60b-e25477d48ad7?source=api-prod","affected":[{"type":"plugin","slug":"wp-powerplaygallery","name":"Powerplay Gallery","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2015-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:474fdbcb-fe3c-4a79-a847-363f81b300c2","source":"wordfence","cve":"CVE-2024-4617","title":"Rank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/474fdbcb-fe3c-4a79-a847-363f81b300c2?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.218","to_inclusive":true,"patched_in":"1.0.219-beta"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T11:05:27Z"},{"id":"wordfence:47504481-6116-453a-82c7-617015b1e178","source":"wordfence","cve":"CVE-2025-53273","title":"Slickstream <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47504481-6116-453a-82c7-617015b1e178?source=api-prod","affected":[{"type":"plugin","slug":"slick-engagement","name":"Slickstream: Engagement and Conversions","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-06-27T00:00:00Z","updated":"2025-09-19T18:35:28Z"},{"id":"wordfence:4750b57e-7d8d-49d7-bbbf-46483eb97bd9","source":"wordfence","cve":"CVE-2025-13675","title":"Tiger <= 101.2.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4750b57e-7d8d-49d7-bbbf-46483eb97bd9?source=api-prod","affected":[{"type":"theme","slug":"tiger","name":"Tiger","from":"*","from_inclusive":true,"to":"101.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T16:19:43Z","updated":"2025-11-27T04:36:44Z"},{"id":"wordfence:4752b3a7-dbb0-4326-bfff-b94dd55b4bf1","source":"wordfence","cve":"","title":"Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace <= 3.8.11.8 - Local File Inclusion","severity":"high","cvss":8.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4752b3a7-dbb0-4326-bfff-b94dd55b4bf1?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.8.11.8","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4756312e-2e34-4524-b978-fa37e3cafd1f","source":"wordfence","cve":"CVE-2025-24697","title":"Image Gallery \u2013 Responsive Photo Gallery <= 1.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4756312e-2e34-4524-b978-fa37e3cafd1f?source=api-prod","affected":[{"type":"plugin","slug":"awesome-responsive-photo-gallery","name":"Awesome Responsive Photo Gallery \u2013 Image & Video Lightbox Gallery","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-30T00:00:00Z","updated":"2025-02-24T15:52:50Z"},{"id":"wordfence:4757590a-f5dc-48d6-aef1-80158f728b6e","source":"wordfence","cve":"CVE-2017-12947","title":"Easy Modal < 2.1.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4757590a-f5dc-48d6-aef1-80158f728b6e?source=api-prod","affected":[{"type":"plugin","slug":"easy-modal","name":"Easy Modal","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4759a9a9-0e1d-41e2-b04d-a0578e925208","source":"wordfence","cve":"CVE-2025-28987","title":"PressForward <= 5.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4759a9a9-0e1d-41e2-b04d-a0578e925208?source=api-prod","affected":[{"type":"plugin","slug":"pressforward","name":"PressForward","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:21:06Z"},{"id":"wordfence:475be252-261a-4ca4-a395-2b8c5d5330d5","source":"wordfence","cve":"CVE-2026-109894","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/475be252-261a-4ca4-a395-2b8c5d5330d5?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2026-10-16T10:37:59Z","updated":"2026-10-23T18:28:09Z"},{"id":"wordfence:475c9bec-0fd5-4de7-a8a3-8aea5dd4c68d","source":"wordfence","cve":"CVE-2025-24559","title":"WP Mailster <= 1.8.15.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/475c9bec-0fd5-4de7-a8a3-8aea5dd4c68d?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.15.0","to_inclusive":true,"patched_in":"1.8.16.0"}],"published":"2024-11-23T00:00:00Z","updated":"2025-02-20T16:16:39Z"},{"id":"wordfence:475ca301-32f2-4913-925c-369a9a4c83c1","source":"wordfence","cve":"","title":"Table Generator <= 1.3.0 - Missing Authorization to Table Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/475ca301-32f2-4913-925c-369a9a4c83c1?source=api-prod","affected":[{"type":"plugin","slug":"table-generator","name":"Table Generator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:475f2758-27a5-4a36-8085-576ee341938b","source":"wordfence","cve":"CVE-2024-11411","title":"Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/475f2758-27a5-4a36-8085-576ee341938b?source=api-prod","affected":[{"type":"plugin","slug":"spotlightr","name":"Spotlightr \u2013 Secure Video Hosting for WordPress, Courses & LearnDash","from":"*","from_inclusive":true,"to":"0.1.11","to_inclusive":true,"patched_in":"0.1.12"}],"published":"2024-12-19T18:02:44Z","updated":"2025-01-30T22:26:50Z"},{"id":"wordfence:47681954-37ed-493b-b4da-9e9032e561b3","source":"wordfence","cve":"CVE-2022-33987","title":"got (JS Package) <= 11.8.4 and 12.0-<12.1.0 - Open Redirect","severity":"medium","cvss":5.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47681954-37ed-493b-b4da-9e9032e561b3?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-ordering","name":"Simple Page Ordering","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"},{"type":"plugin","slug":"simple-podcasting","name":"Simple Podcasting","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.3.0"},{"type":"plugin","slug":"safe-redirect-manager","name":"Safe Redirect Manager","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47687614-bd79-44fd-bc82-eaa801c1387d","source":"wordfence","cve":"CVE-2018-5291","title":"GD Rating System <= 2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47687614-bd79-44fd-bc82-eaa801c1387d?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:476883a8-c258-477b-99d3-f35423d7a312","source":"wordfence","cve":"CVE-2024-13832","title":"Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/476883a8-c258-477b-99d3-f35423d7a312?source=api-prod","affected":[{"type":"plugin","slug":"ut-elementor-addons-lite","name":"Ultra Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-02-27T19:54:27Z","updated":"2025-03-21T18:30:52Z"},{"id":"wordfence:476bc092-c623-4caf-9676-3036d27c4840","source":"wordfence","cve":"CVE-2024-11134","title":"Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/476bc092-c623-4caf-9676-3036d27c4840?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.9.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-17T19:03:04Z"},{"id":"wordfence:476c4eb3-db28-4f6a-9502-969e7f1c5ec1","source":"wordfence","cve":"CVE-2024-9172","title":"Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/476c4eb3-db28-4f6a-9502-969e7f1c5ec1?source=api-prod","affected":[{"type":"plugin","slug":"demo-importer-plus","name":"Demo Importer Plus","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-10-01T19:35:03Z","updated":"2024-10-02T07:35:27Z"},{"id":"wordfence:476df648-5024-42af-9bbd-a5a98e79453f","source":"wordfence","cve":"CVE-2025-32510","title":"Ovatheme Events Manager <= 1.8.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/476df648-5024-42af-9bbd-a5a98e79453f?source=api-prod","affected":[{"type":"plugin","slug":"ova-events-manager","name":"Ovatheme Events Manager","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-06-11T00:00:00Z","updated":"2025-08-05T13:44:12Z"},{"id":"wordfence:4770441f-5d8b-4edb-93e3-d2d73f145d26","source":"wordfence","cve":"CVE-2008-2034","title":"Download Monitor <= 2.0.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4770441f-5d8b-4edb-93e3-d2d73f145d26?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2008-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47716128-949c-4215-9fd7-bccb51c532c8","source":"wordfence","cve":"CVE-2026-57684","title":"TheFox <= 3.9.70 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47716128-949c-4215-9fd7-bccb51c532c8?source=api-prod","affected":[{"type":"theme","slug":"thefox","name":"TheFox | Responsive Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.70","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-02T11:34:50Z"},{"id":"wordfence:477281fb-00ba-4ba0-a2fa-9f0e9379db26","source":"wordfence","cve":"CVE-2025-57999","title":"WPKoi Templates for Elementor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/477281fb-00ba-4ba0-a2fa-9f0e9379db26?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-30T13:39:09Z"},{"id":"wordfence:4772b482-f5e5-4707-b012-aca70fc89e49","source":"wordfence","cve":"CVE-2026-4280","title":"Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4772b482-f5e5-4707-b012-aca70fc89e49?source=api-prod","affected":[{"type":"plugin","slug":"breaking-news-wp","name":"Breaking News WP","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:05:09Z","updated":"2026-04-22T07:45:34Z"},{"id":"wordfence:47751ff1-2f22-4335-8e75-7ff1b6214426","source":"wordfence","cve":"CVE-2026-97641","title":"Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47751ff1-2f22-4335-8e75-7ff1b6214426?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.28.3","to_inclusive":true,"patched_in":"4.28.4"}],"published":"2026-10-01T19:22:45Z","updated":"2026-10-02T07:39:23Z"},{"id":"wordfence:4775d8f0-ae3b-41aa-a0d2-4284840f66f1","source":"wordfence","cve":"CVE-2026-61985","title":"Car Rental Manager \u2013 Online Vehicle Booking System <= 1.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4775d8f0-ae3b-41aa-a0d2-4284840f66f1?source=api-prod","affected":[{"type":"plugin","slug":"car-rental-manager","name":"Car Rental Manager \u2013 Online Vehicle Booking System","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-12T00:08:00Z"},{"id":"wordfence:4775ef21-01d6-4c5a-9e3e-f9b6e093fc7f","source":"wordfence","cve":"CVE-2024-24711","title":"WooCommerce Conversion Tracking <= 2.0.11 - Missing Authorization via wcct_install_happy_addons","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4775ef21-01d6-4c5a-9e3e-f9b6e093fc7f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-conversion-tracking","name":"Conversion Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T16:14:44Z"},{"id":"wordfence:47765ab9-1df6-4457-8d94-6e2092e6a5a4","source":"wordfence","cve":"CVE-2024-56301","title":"Distance Based Shipping Calculator <= 2.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47765ab9-1df6-4457-8d94-6e2092e6a5a4?source=api-prod","affected":[{"type":"plugin","slug":"distance-based-shipping-calculator","name":"Distance Based Shipping Calculator","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:59:43Z"},{"id":"wordfence:477a0d78-08d9-4e12-9ea2-1e5382b852c7","source":"wordfence","cve":"CVE-2026-17031","title":"Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/477a0d78-08d9-4e12-9ea2-1e5382b852c7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.9.6","to_inclusive":true,"patched_in":"7.9.7"}],"published":"2026-10-14T16:29:25Z","updated":"2026-10-15T05:30:21Z"},{"id":"wordfence:477b41a5-b2ff-4b94-9622-824146a0e2ed","source":"wordfence","cve":"CVE-2024-4386","title":"Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/477b41a5-b2ff-4b94-9622-824146a0e2ed?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:23Z"},{"id":"wordfence:477c6fa2-16a8-4461-b4d4-d087e13e3ca7","source":"wordfence","cve":"CVE-2023-2496","title":"Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload","severity":"high","cvss":7.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/477c6fa2-16a8-4461-b4d4-d087e13e3ca7?source=api-prod","affected":[{"type":"plugin","slug":"go_pricing","name":"Go Pricing - WordPress Responsive Pricing Tables","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:477d3d7a-6028-4dd3-b713-6098bfe32832","source":"wordfence","cve":"CVE-2023-50848","title":"404 Solution <= 2.34.0 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/477d3d7a-6028-4dd3-b713-6098bfe32832?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.35.0","to_inclusive":false,"patched_in":"2.35.0"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4782a5cd-bc20-4348-b902-23e5e380b3b8","source":"wordfence","cve":"CVE-2025-53305","title":"WP Forum  Server <= 1.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4782a5cd-bc20-4348-b902-23e5e380b3b8?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:46:32Z"},{"id":"wordfence:4782d4ea-3d79-40d2-850d-1a7583267616","source":"wordfence","cve":"CVE-2023-45644","title":"CPT Shortcode Generator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4782d4ea-3d79-40d2-850d-1a7583267616?source=api-prod","affected":[{"type":"plugin","slug":"cpt-shortcode","name":"CPT Shortcode Generator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4783eff5-b7cf-4342-b762-85f745c38ec8","source":"wordfence","cve":"","title":"Font Awesome 4.0.0-rc15 and 4.0.0-rc16 - API Token Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4783eff5-b7cf-4342-b762-85f745c38ec8?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome","name":"Font Awesome","from":"4.0.0-rc15","from_inclusive":true,"to":"4.0.0-rc15","to_inclusive":true,"patched_in":"4.0.0-rc17"},{"type":"plugin","slug":"font-awesome","name":"Font Awesome","from":"4.0.0-rc16","from_inclusive":true,"to":"4.0.0-rc16","to_inclusive":true,"patched_in":"4.0.0-rc17"}],"published":"2020-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47853750-0bf1-4df3-9c56-c6852543cfad","source":"wordfence","cve":"CVE-2024-0367","title":"Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47853750-0bf1-4df3-9c56-c6852543cfad?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.96","to_inclusive":true,"patched_in":"1.5.97"}],"published":"2024-03-29T00:00:00Z","updated":"2024-07-29T21:36:18Z"},{"id":"wordfence:478723c4-cc45-4241-af45-21ee537f1dfa","source":"wordfence","cve":"","title":"Better WordPress reCAPTCHA <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/478723c4-cc45-4241-af45-21ee537f1dfa?source=api-prod","affected":[{"type":"plugin","slug":"bwp-recaptcha","name":"Better WordPress reCAPTCHA (with no CAPTCHA reCAPTCHA)","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2018-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:478b67e3-bd66-4f38-8a37-e677e5db875d","source":"wordfence","cve":"","title":"Resim Ara <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/478b67e3-bd66-4f38-8a37-e677e5db875d?source=api-prod","affected":[{"type":"plugin","slug":"resim-ara","name":"Resim Ara","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2020-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:478d7c1e-35b9-4796-8ccd-eb02591a3a17","source":"wordfence","cve":"CVE-2026-42682","title":"wpForo Forum <= 3.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/478d7c1e-35b9-4796-8ccd-eb02591a3a17?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-05-18T00:00:00Z","updated":"2026-05-26T19:33:11Z"},{"id":"wordfence:478e3383-2e5c-48e2-85f4-10503bda40ab","source":"wordfence","cve":"CVE-2025-46485","title":"WP Customize Login Page <= 1.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/478e3383-2e5c-48e2-85f4-10503bda40ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-customize-login-page","name":"WP Customize Login Page","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:47:42Z"},{"id":"wordfence:47906575-b88a-4e12-b134-accf47a264a0","source":"wordfence","cve":"CVE-2017-18581","title":"Time Sheets < 1.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47906575-b88a-4e12-b134-accf47a264a0?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2017-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47906d5e-b77f-4b40-b89e-0bd0ed82b2e5","source":"wordfence","cve":"CVE-2025-22319","title":"Social Media Share Buttons | MashShare <= 4.0.47 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47906d5e-b77f-4b40-b89e-0bd0ed82b2e5?source=api-prod","affected":[{"type":"plugin","slug":"mashsharer","name":"MashShare \u2013 Social Media Share Buttons, Social Share Icons","from":"*","from_inclusive":true,"to":"4.0.47","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:48:50Z"},{"id":"wordfence:47938357-7d51-4d62-a08c-4b2bf3f3a062","source":"wordfence","cve":"","title":"Wordfence Security <= 5.2.3 - Stored Cross-Site Scripting via HTTP_HOST","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47938357-7d51-4d62-a08c-4b2bf3f3a062?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2014-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47940179-1a34-48d3-a6fc-81f2d3cd2670","source":"wordfence","cve":"CVE-2025-69082","title":"Arlo <= 6.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47940179-1a34-48d3-a6fc-81f2d3cd2670?source=api-prod","affected":[{"type":"theme","slug":"arlo","name":"Arlo | Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:30:59Z"},{"id":"wordfence:47941722-acaf-4f72-a64d-d01dc5e84adf","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz <= 6.4.4 (Premium <= 6.4.6.1)  - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47941722-acaf-4f72-a64d-d01dc5e84adf?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr-premium","name":"Complianz Premium \u2013 GDPR/CCPA Cookie Consent","from":"*","from_inclusive":true,"to":"6.4.6.1","to_inclusive":true,"patched_in":"6.4.7"},{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4794858f-ebaf-4adf-ab08-309964c18c00","source":"wordfence","cve":"CVE-2019-20360","title":"GiveWP <= 2.5.4 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4794858f-ebaf-4adf-ab08-309964c18c00?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2019-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4799bb1f-4e5d-4b39-9f99-ffb46de4c232","source":"wordfence","cve":"CVE-2026-75823","title":"User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4799bb1f-4e5d-4b39-9f99-ffb46de4c232?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"3.5.29","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:53:49Z"},{"id":"wordfence:479f0c7e-f80b-4782-9467-541a83161d40","source":"wordfence","cve":"CVE-2026-87919","title":"Product XML Feed Manager for WooCommerce \u2013 Google Shopping, Social Sites, Skroutz & More < 3.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/479f0c7e-f80b-4782-9467-541a83161d40?source=api-prod","affected":[{"type":"plugin","slug":"product-xml-feeds-for-woocommerce","name":"Product XML Feed Manager for WooCommerce \u2013 Google Shopping, Social Sites, Skroutz & More","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:15:25Z"},{"id":"wordfence:479f7e9c-8918-4b87-b33d-a396276fb637","source":"wordfence","cve":"CVE-2023-35913","title":"OOPSpam Anti-Spam <= 1.1.44 - Cross-Site Request Forgery via empty_ham_entries and empty_spam_entries","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/479f7e9c-8918-4b87-b33d-a396276fb637?source=api-prod","affected":[{"type":"plugin","slug":"oopspam-anti-spam","name":"oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)","from":"*","from_inclusive":true,"to":"1.1.45","to_inclusive":false,"patched_in":"1.1.45"}],"published":"2023-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47a00c6f-958f-41c7-a213-c858d8fac2ed","source":"wordfence","cve":"CVE-2021-24893","title":"Stars Rating <= 3.5.0 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a00c6f-958f-41c7-a213-c858d8fac2ed?source=api-prod","affected":[{"type":"plugin","slug":"stars-rating","name":"Stars Rating","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":false,"patched_in":"3.5.1"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47a04186-8eec-4ef6-9fce-9b891a04ed9f","source":"wordfence","cve":"CVE-2025-11813","title":"Responsive iframe GoogleMap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a04186-8eec-4ef6-9fce-9b891a04ed9f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-iframe-googlemap","name":"Responsive iframe GoogleMap","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:21:10Z","updated":"2025-10-22T08:27:07Z"},{"id":"wordfence:47a10dd4-515c-42d9-82ea-c84f8f7574c5","source":"wordfence","cve":"CVE-2026-1216","title":"RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a10dd4-515c-42d9-82ea-c84f8f7574c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-02-16T20:31:00Z","updated":"2026-02-17T09:26:23Z"},{"id":"wordfence:47a51676-fd99-4b78-8a19-6291ff2e7f82","source":"wordfence","cve":"CVE-2026-108493","title":"Pay for Payment for WooCommerce \u2013 Payment Gateway Fees & Discounts <= 3.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a51676-fd99-4b78-8a19-6291ff2e7f82?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pay-for-payment","name":"Pay for Payment for WooCommerce \u2013 Payment Gateway Fees & Discounts","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:32:09Z"},{"id":"wordfence:47a67db6-cc0d-47d2-a2c2-11b8c410f2fb","source":"wordfence","cve":"CVE-2024-54225","title":"Designer <= 1.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a67db6-cc0d-47d2-a2c2-11b8c410f2fb?source=api-prod","affected":[{"type":"plugin","slug":"designer","name":"Designer \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-06T15:23:07Z"},{"id":"wordfence:47a99115-3e7b-4666-a00e-2b94d7d62e1a","source":"wordfence","cve":"CVE-2022-3836","title":"Seed Social <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47a99115-3e7b-4666-a00e-2b94d7d62e1a?source=api-prod","affected":[{"type":"plugin","slug":"seed-social","name":"Seed Social","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47aa1a74-4189-4521-ba6e-e91a06b8f5a6","source":"wordfence","cve":"CVE-2026-118784","title":"WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47aa1a74-4189-4521-ba6e-e91a06b8f5a6?source=api-prod","affected":[{"type":"plugin","slug":"wpspeed","name":"WPSpeed \u2013 WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100)","from":"*","from_inclusive":true,"to":"2.6.10","to_inclusive":true,"patched_in":"2.6.11"}],"published":"2026-11-06T21:25:42Z","updated":"2026-11-07T09:25:46Z"},{"id":"wordfence:47ab93d2-0e1d-42b0-a6ea-05300eae8da7","source":"wordfence","cve":"CVE-2024-35695","title":"WP Docs <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ab93d2-0e1d-42b0-a6ea-05300eae8da7?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:27:19Z"},{"id":"wordfence:47acd9a1-7cc7-40d4-b928-98a220033e31","source":"wordfence","cve":"CVE-2026-96342","title":"WPMobile.App \u2013 Android and iOS App Builder <= 11.83 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47acd9a1-7cc7-40d4-b928-98a220033e31?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.83","to_inclusive":true,"patched_in":"11.84"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:46:30Z"},{"id":"wordfence:47adb5fe-534f-48a9-81a3-883e1d2cda7f","source":"wordfence","cve":"CVE-2025-1528","title":"Search and filter pro <= 2.5.19 - Missing Authorization to Authenticated (Subscriber+) Post Meta Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47adb5fe-534f-48a9-81a3-883e1d2cda7f?source=api-prod","affected":[{"type":"plugin","slug":"search-filter-pro","name":"Search & Filter Pro","from":"*","from_inclusive":true,"to":"2.5.19","to_inclusive":true,"patched_in":"2.5.20"}],"published":"2025-03-13T16:21:36Z","updated":"2025-03-14T04:22:33Z"},{"id":"wordfence:47aed582-efb6-4caf-a65b-57995907ecaa","source":"wordfence","cve":"CVE-2023-50844","title":"Mail logging \u2013 WP Mail Catcher <= 2.1.3 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47aed582-efb6-4caf-a65b-57995907ecaa?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47b0a994-0460-44fb-bebd-d09efc69a8f3","source":"wordfence","cve":"CVE-2026-25019","title":"Atarim <= 4.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47b0a994-0460-44fb-bebd-d09efc69a8f3?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-10T19:56:36Z"},{"id":"wordfence:47b0be04-c4ff-4a20-8880-ab40fa7a11c3","source":"wordfence","cve":"CVE-2025-67940","title":"Powerlift < 3.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47b0be04-c4ff-4a20-8880-ab40fa7a11c3?source=api-prod","affected":[{"type":"theme","slug":"powerlift","name":"Powerlift - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:52:21Z"},{"id":"wordfence:47b687f4-8798-4cd9-b0d0-11c54df8ff46","source":"wordfence","cve":"CVE-2024-13099","title":"Widget4Call <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47b687f4-8798-4cd9-b0d0-11c54df8ff46?source=api-prod","affected":[{"type":"plugin","slug":"widget4call","name":"Widget4Call","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-25T16:43:26Z"},{"id":"wordfence:47b6c561-bb09-4aa4-b891-0068ee4cc225","source":"wordfence","cve":"CVE-2026-110376","title":"DEPART \u2013 Deposit and Part payment for Woo <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47b6c561-bb09-4aa4-b891-0068ee4cc225?source=api-prod","affected":[{"type":"plugin","slug":"depart-deposit-and-part-payment-for-woo","name":"DEPART \u2013 Deposit and Part payment for Woo","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-10-26T08:46:00Z","updated":"2026-10-28T01:15:00Z"},{"id":"wordfence:47b75e7f-87d3-40d5-b3c4-998d3164d48a","source":"wordfence","cve":"","title":"SP Project & Document Manager <= 2.5.9.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47b75e7f-87d3-40d5-b3c4-998d3164d48a?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"2.5.9.5","to_inclusive":true,"patched_in":"2.6.0.0"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47baeaee-de6b-4459-a211-177859427e70","source":"wordfence","cve":"CVE-2022-2305","title":"Popups <= 1.9.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47baeaee-de6b-4459-a211-177859427e70?source=api-prod","affected":[{"type":"plugin","slug":"popups","name":"Popups \u2013 WordPress Popup","from":"*","from_inclusive":true,"to":"1.9.3.8","to_inclusive":true,"patched_in":""}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47bb46df-3ed6-4331-8c05-c76331aa6995","source":"wordfence","cve":"CVE-2023-40608","title":"Paid Memberships Pro CCBill Gateway <= 0.3 - Insufficient Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47bb46df-3ed6-4331-8c05-c76331aa6995?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-ccbill","name":"Paid Memberships Pro CCBill Gateway","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47bc6797-bb18-4555-9561-846d8efaa842","source":"wordfence","cve":"CVE-2025-60095","title":"Stackable <= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47bc6797-bb18-4555-9561-846d8efaa842?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.18.1","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-02T22:19:47Z"},{"id":"wordfence:47bcd04b-a479-49f2-94d0-df2a7684210c","source":"wordfence","cve":"CVE-2026-6439","title":"VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47bcd04b-a479-49f2-94d0-df2a7684210c?source=api-prod","affected":[{"type":"plugin","slug":"videozen","name":"VideoZen","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-16T20:19:00Z","updated":"2026-04-17T08:28:26Z"},{"id":"wordfence:47bf51eb-829d-433e-82c2-71dc09a9cb4d","source":"wordfence","cve":"CVE-2026-91008","title":"Event Booking Manager for WooCommerce <= 5.3.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47bf51eb-829d-433e-82c2-71dc09a9cb4d?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:03Z"},{"id":"wordfence:47c2bf75-fba1-4c37-b33a-f5e0e093fb78","source":"wordfence","cve":"","title":"SpiderVPlayer< 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47c2bf75-fba1-4c37-b33a-f5e0e093fb78?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47c4adb7-6583-4059-85bb-bc79d917a817","source":"wordfence","cve":"CVE-2025-30536","title":"Beautiful Link Preview <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47c4adb7-6583-4059-85bb-bc79d917a817?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-link-preview","name":"Beautiful Link Preview","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:42:16Z"},{"id":"wordfence:47c666b1-1ac2-4764-bbee-385ec321a580","source":"wordfence","cve":"CVE-2024-5769","title":"MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47c666b1-1ac2-4764-bbee-385ec321a580?source=api-prod","affected":[{"type":"plugin","slug":"mimo-woocommerce-order-tracking","name":"MIMO Woocommerce Order Tracking","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-09T11:10:56Z"},{"id":"wordfence:47c7e74e-91cb-4bfa-8c21-c60ca0b8cb47","source":"wordfence","cve":"CVE-2026-110707","title":"RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47c7e74e-91cb-4bfa-8c21-c60ca0b8cb47?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.12","to_inclusive":true,"patched_in":"5.2.13"}],"published":"2026-10-28T20:46:33Z","updated":"2026-10-29T09:25:33Z"},{"id":"wordfence:47cb48aa-b556-4f25-ac68-ff0a812972c1","source":"wordfence","cve":"CVE-2023-6369","title":"Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47cb48aa-b556-4f25-ac68-ff0a812972c1?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47cc9978-6074-4e8a-a471-d8483890d161","source":"wordfence","cve":"","title":"StoryChief <= 1.0.30 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47cc9978-6074-4e8a-a471-d8483890d161?source=api-prod","affected":[{"type":"plugin","slug":"story-chief","name":"StoryChief","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":"1.0.31"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47ccda70-8c89-4e0f-a7fa-5b80515e60dc","source":"wordfence","cve":"","title":"WOWRestro \u2013 Online Ordering System For WooCommerce < 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ccda70-8c89-4e0f-a7fa-5b80515e60dc?source=api-prod","affected":[{"type":"plugin","slug":"wowrestro","name":"WowRestro \u2013 Restaurant Ordering & Operations for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47cd99ef-d9b0-4be3-8dc4-d7dd56f37c1c","source":"wordfence","cve":"CVE-2025-13612","title":"Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47cd99ef-d9b0-4be3-8dc4-d7dd56f37c1c?source=api-prod","affected":[{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:10Z"},{"id":"wordfence:47cf9b2c-6857-4dbc-b321-1a84c3e5d11f","source":"wordfence","cve":"CVE-2025-49415","title":"FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47cf9b2c-6857-4dbc-b321-1a84c3e5d11f?source=api-prod","affected":[{"type":"plugin","slug":"fw-gallery","name":"FW Gallery \u2013 Photo, video, audio media presentation and management system with players and slideshow","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-17T14:24:38Z"},{"id":"wordfence:47d158a2-2440-4800-b7e7-b4c171bd218c","source":"wordfence","cve":"CVE-2025-69385","title":"Cartify - WooCommerce Gutenberg WordPress <= 1.3 - Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47d158a2-2440-4800-b7e7-b4c171bd218c?source=api-prod","affected":[{"type":"theme","slug":"cartify","name":"Cartify - WooCommerce Gutenberg WordPress","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:06:22Z"},{"id":"wordfence:47d4cf6a-400f-4001-95de-f93e574bb2ef","source":"wordfence","cve":"CVE-2021-20746","title":"WordPress Popular Posts <= 5.3.2 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47d4cf6a-400f-4001-95de-f93e574bb2ef?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":false,"patched_in":"5.3.3"}],"published":"2021-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47d78b7b-0109-4296-b111-6ca747d7d5e0","source":"wordfence","cve":"CVE-2026-109987","title":"PixelYourSite (Pro + Free) \u2013 Your smart PIXEL (TAG) Manager (plugin) < 11.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47d78b7b-0109-4296-b111-6ca747d7d5e0?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"12.6.8","to_inclusive":false,"patched_in":"12.6.8"},{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.4.3","to_inclusive":false,"patched_in":"11.4.3"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:25:38Z"},{"id":"wordfence:47dac5bb-45c8-4d10-93e3-938df3e920f9","source":"wordfence","cve":"CVE-2025-66131","title":"Yaad Sarig Payment Gateway For WC <= 2.2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47dac5bb-45c8-4d10-93e3-938df3e920f9?source=api-prod","affected":[{"type":"plugin","slug":"yaad-sarig-payment-gateway-for-wc","name":"Yaad Sarig Payment Gateway For WC","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2025-12-15T00:00:00Z","updated":"2026-09-09T15:53:59Z"},{"id":"wordfence:47db93d6-3181-4b83-afa3-1d3a45df24c7","source":"wordfence","cve":"CVE-2024-50464","title":"Kodex Posts likes <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47db93d6-3181-4b83-afa3-1d3a45df24c7?source=api-prod","affected":[{"type":"plugin","slug":"kodex-posts-likes","name":"Kodex Posts likes","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:43:43Z"},{"id":"wordfence:47dccf26-6c8d-4418-a874-c29749bee537","source":"wordfence","cve":"CVE-2023-4626","title":"LadiApp <= 4.4 - Missing Authorization via ladiflow_save_hook()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47dccf26-6c8d-4418-a874-c29749bee537?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"4.3","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:55Z"},{"id":"wordfence:47e25cfa-fedf-413a-bfe7-18a1de429bc3","source":"wordfence","cve":"CVE-2023-0233","title":"ActiveCampaign \u2013 Forms, Site Tracking, Live Chat <= 8.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e25cfa-fedf-413a-bfe7-18a1de429bc3?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-subscription-forms","name":"ActiveCampaign \u2013 The autonomous marketing platform","from":"*","from_inclusive":true,"to":"8.1.11","to_inclusive":true,"patched_in":"8.1.12"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47e402c3-e06c-4ac9-8c60-5666cb1101ce","source":"wordfence","cve":"CVE-2023-6842","title":"Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e402c3-e06c-4ac9-8c60-5666cb1101ce?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:36:18Z"},{"id":"wordfence:47e53fd3-4e3f-433a-8e70-3a58c864184a","source":"wordfence","cve":"CVE-2026-4297","title":"Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e53fd3-4e3f-433a-8e70-3a58c864184a?source=api-prod","affected":[{"type":"plugin","slug":"newscred-publishing","name":"Welcome Software Publishing","from":"*","from_inclusive":true,"to":"0.0.31","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:42:18Z","updated":"2026-06-24T05:33:24Z"},{"id":"wordfence:47e6840e-9f6c-44eb-a6bd-e25e4c5c0bf7","source":"wordfence","cve":"CVE-2024-2836","title":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer <= 7.13.63 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e6840e-9f6c-44eb-a6bd-e25e4c5c0bf7?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.63","to_inclusive":true,"patched_in":"7.13.64"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-24T16:16:47Z"},{"id":"wordfence:47e6b084-206b-42d5-9ab0-94ae41edbd20","source":"wordfence","cve":"CVE-2026-24387","title":"WP Quick Post Duplicator <= 2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e6b084-206b-42d5-9ab0-94ae41edbd20?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-post-duplicator","name":"WP Quick Post Duplicator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-03T21:00:52Z"},{"id":"wordfence:47e8a897-331b-49d4-bb01-4a69c40306f3","source":"wordfence","cve":"CVE-2026-39750","title":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47e8a897-331b-49d4-bb01-4a69c40306f3?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-10-05T15:06:17Z","updated":"2026-10-08T23:40:45Z"},{"id":"wordfence:47eb0b74-66b0-4d7a-a57f-503de1b02abd","source":"wordfence","cve":"CVE-2026-110305","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47eb0b74-66b0-4d7a-a57f-503de1b02abd?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-30T13:47:49Z","updated":"2026-10-30T17:15:26Z"},{"id":"wordfence:47eb6ca7-049c-41b8-9210-391d4d1b8b2f","source":"wordfence","cve":"CVE-2023-44265","title":"Popup contact form <= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47eb6ca7-049c-41b8-9210-391d4d1b8b2f?source=api-prod","affected":[{"type":"plugin","slug":"popup-contact-form","name":"Popup contact form","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47ed52b3-4bfe-46ce-aabc-7a4647ab7db5","source":"wordfence","cve":"CVE-2026-8789","title":"Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion","severity":"high","cvss":8.1,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ed52b3-4bfe-46ce-aabc-7a4647ab7db5?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.27","to_inclusive":true,"patched_in":"3.12.28"}],"published":"2026-07-23T16:53:31Z","updated":"2026-07-24T14:34:50Z"},{"id":"wordfence:47ee441a-4285-4bed-ac9d-b146fd502e46","source":"wordfence","cve":"CVE-2024-11141","title":"Sailthru Triggermail <= 1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ee441a-4285-4bed-ac9d-b146fd502e46?source=api-prod","affected":[{"type":"plugin","slug":"sailthru-triggermail","name":"Sailthru Triggermail","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T00:00:00Z","updated":"2025-05-27T15:10:09Z"},{"id":"wordfence:47ef0e19-8b67-42ad-b8e9-72b0dbe5e3a5","source":"wordfence","cve":"CVE-2026-83591","title":"AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ef0e19-8b67-42ad-b8e9-72b0dbe5e3a5?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2026-09-24T18:04:31Z","updated":"2026-09-25T06:39:52Z"},{"id":"wordfence:47f04985-dd9b-449f-8b4c-9811fe7e4a96","source":"wordfence","cve":"CVE-2024-0691","title":"FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f04985-dd9b-449f-8b4c-9811fe7e4a96?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2024-01-19T00:00:00Z","updated":"2024-07-29T21:36:18Z"},{"id":"wordfence:47f051dd-138c-4c71-8a92-150c9ffd3601","source":"wordfence","cve":"CVE-2023-50822","title":"Currency Converter Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f051dd-138c-4c71-8a92-150c9ffd3601?source=api-prod","affected":[{"type":"plugin","slug":"currency-converter-widget","name":"Currency Converter Widget","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47f05812-b873-4092-9014-20ca1d0e484a","source":"wordfence","cve":"CVE-2024-33590","title":"Knowledge Base documentation & wiki plugin \u2013 BasePress <= 2.16.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f05812-b873-4092-9014-20ca1d0e484a?source=api-prod","affected":[{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.16.1","to_inclusive":true,"patched_in":"2.16.2.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:00:31Z"},{"id":"wordfence:47f0795c-5a79-47e8-b118-f4f0e95ac53b","source":"wordfence","cve":"CVE-2017-1000227","title":"Salutation Responsive WordPress Theme < 3.0.16 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f0795c-5a79-47e8-b118-f4f0e95ac53b?source=api-prod","affected":[{"type":"theme","slug":"parallelus-salutation","name":"Salutation Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.16","to_inclusive":false,"patched_in":"3.0.16"}],"published":"2017-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47f57e90-94c9-4c9c-8700-bf591f6539ec","source":"wordfence","cve":"CVE-2025-12521","title":"Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f57e90-94c9-4c9c-8700-bf591f6539ec?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify-pro","name":"Analytify Pro","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.4"}],"published":"2025-10-30T00:00:00Z","updated":"2025-10-31T13:48:35Z"},{"id":"wordfence:47f668b0-8165-4ce8-97cc-b674e708c2eb","source":"wordfence","cve":"CVE-2024-8758","title":"Quiz and Survey Master (QSM)  <= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f668b0-8165-4ce8-97cc-b674e708c2eb?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2024-09-02T00:00:00Z","updated":"2026-09-16T23:42:23Z"},{"id":"wordfence:47f9a466-2826-4835-b06e-14cf4ceb7567","source":"wordfence","cve":"CVE-2025-13696","title":"Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47f9a466-2826-4835-b06e-14cf4ceb7567?source=api-prod","affected":[{"type":"plugin","slug":"zigaform-calculator-cost-estimation-form-builder-lite","name":"Zigaform \u2013 Price Calculator & Cost Estimation Form Builder Lite","from":"*","from_inclusive":true,"to":"7.6.5","to_inclusive":true,"patched_in":"7.6.7"}],"published":"2025-12-01T18:40:50Z","updated":"2025-12-02T07:24:31Z"},{"id":"wordfence:47fb0513-bebe-4e09-9402-d7e174ee92ce","source":"wordfence","cve":"","title":"NextGen Gallery <= 2.0.65 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47fb0513-bebe-4e09-9402-d7e174ee92ce?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.0.65","to_inclusive":true,"patched_in":"2.0.66"}],"published":"2014-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:47fe3de6-6c7b-4af3-8604-06f4522a36f2","source":"wordfence","cve":"CVE-2026-42646","title":"TaxoPress <= 3.44.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47fe3de6-6c7b-4af3-8604-06f4522a36f2?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.44.0","to_inclusive":true,"patched_in":"3.45.0"}],"published":"2026-03-22T00:00:00Z","updated":"2026-05-07T14:03:57Z"},{"id":"wordfence:47feeeef-07ff-42a1-a94d-b90c25cce2e6","source":"wordfence","cve":"CVE-2024-29116","title":"WooThumbs for WooCommerce by Iconic <= 5.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47feeeef-07ff-42a1-a94d-b90c25cce2e6?source=api-prod","affected":[{"type":"plugin","slug":"iconic-woothumbs","name":"WooThumbs for WooCommerce by Iconic","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:48:13Z"},{"id":"wordfence:48069ad5-0779-444b-8215-d1f08b493108","source":"wordfence","cve":"CVE-2022-40695","title":"SEO Redirection Plugin <= 8.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48069ad5-0779-444b-8215-d1f08b493108?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"8.9","to_inclusive":true,"patched_in":"9.1"}],"published":"2022-10-25T13:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4806b44b-b3f5-4bc2-897f-786df8459bd3","source":"wordfence","cve":"CVE-2024-53801","title":"Bold Page Builder <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4806b44b-b3f5-4bc2-897f-786df8459bd3?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:42:45Z"},{"id":"wordfence:48075ef0-b3c5-487b-93c2-d3e630742fe4","source":"wordfence","cve":"CVE-2017-6098","title":"Mail Masta <= 1.0 - SQL Injection via list_id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48075ef0-b3c5-487b-93c2-d3e630742fe4?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48086577-09fc-4406-b13f-2091b50d1719","source":"wordfence","cve":"CVE-2024-53791","title":"Lenxel Core  <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48086577-09fc-4406-b13f-2091b50d1719?source=api-prod","affected":[{"type":"plugin","slug":"lenxel-core","name":"Lenxel AI LMS \u2013 Course Lesson Generator","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-29T00:00:00Z","updated":"2025-04-21T14:39:07Z"},{"id":"wordfence:4809d513-69e8-4572-9549-9dba9f40cb80","source":"wordfence","cve":"CVE-2022-47175","title":"Royal Elementor Addons <= 1.3.75 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4809d513-69e8-4572-9549-9dba9f40cb80?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.75","to_inclusive":true,"patched_in":"1.3.76"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:480ab377-b979-4e1c-9c7a-cf63d69ad697","source":"wordfence","cve":"CVE-2025-9988","title":"Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/480ab377-b979-4e1c-9c7a-cf63d69ad697?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.53.1","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-05-12T15:43:29Z","updated":"2026-05-13T04:26:43Z"},{"id":"wordfence:480ba214-2669-478a-a5fc-2bf563d99f7c","source":"wordfence","cve":"CVE-2024-51929","title":"Icon Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/480ba214-2669-478a-a5fc-2bf563d99f7c?source=api-prod","affected":[{"type":"plugin","slug":"icon-widget-with-links","name":"Icon Widget","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:33:42Z"},{"id":"wordfence:4810251f-7d87-4fed-8673-ff3519c7b0af","source":"wordfence","cve":"CVE-2026-65557","title":"Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4810251f-7d87-4fed-8673-ff3519c7b0af?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:21:59Z"},{"id":"wordfence:481057b7-f146-4965-97ee-4a2e26c92ea7","source":"wordfence","cve":"CVE-2025-15703","title":"Job Openings <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481057b7-f146-4965-97ee-4a2e26c92ea7?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-openings","name":"HireZoot \u2013 Job Listings, Career Page & Recruitment Tool","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-10-10T00:00:00Z","updated":"2026-10-13T19:24:02Z"},{"id":"wordfence:481121b2-4ea9-489e-b582-ec8bbf87c902","source":"wordfence","cve":"CVE-2023-41129","title":"Patreon WordPress <= 1.8.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481121b2-4ea9-489e-b582-ec8bbf87c902?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48164d31-f868-48bd-aa52-46cd829297a2","source":"wordfence","cve":"CVE-2026-87968","title":"Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant < 5.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48164d31-f868-48bd-aa52-46cd829297a2?source=api-prod","affected":[{"type":"plugin","slug":"shopping-feed-for-google","name":"Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"5.3.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:25:43Z"},{"id":"wordfence:4816d767-89fe-403f-ac67-70235d78ce24","source":"wordfence","cve":"CVE-2026-116552","title":"Like Button Rating \u2665 LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4816d767-89fe-403f-ac67-70235d78ce24?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.64","to_inclusive":true,"patched_in":"2.6.65"}],"published":"2026-10-30T17:09:08Z","updated":"2026-10-30T17:15:26Z"},{"id":"wordfence:48173a09-302c-49a1-8c6c-ac4ecacea080","source":"wordfence","cve":"CVE-2025-53223","title":"Theme Switcher Reloaded <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48173a09-302c-49a1-8c6c-ac4ecacea080?source=api-prod","affected":[{"type":"plugin","slug":"theme-switcher-reloaded","name":"Theme Switcher Reloaded","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:15:45Z"},{"id":"wordfence:481bbdd6-9546-4c1f-a4ec-023ad7b37217","source":"wordfence","cve":"CVE-2013-2744","title":"BackupBuddy <= 2.2.28 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481bbdd6-9546-4c1f-a4ec-023ad7b37217?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2013-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:481be4ab-f8df-4080-b87b-24e4d40f83b1","source":"wordfence","cve":"CVE-2025-62020","title":"VOD Infomaniak <= 1.5.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481be4ab-f8df-4080-b87b-24e4d40f83b1?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.5.12"}],"published":"2025-09-23T00:00:00Z","updated":"2025-10-29T20:21:29Z"},{"id":"wordfence:481c18c1-8394-4d5d-89a1-8cfbbbc40bd4","source":"wordfence","cve":"CVE-2024-6798","title":"DL Verification <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481c18c1-8394-4d5d-89a1-8cfbbbc40bd4?source=api-prod","affected":[{"type":"plugin","slug":"dl-verification","name":"DL Verification","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-14T18:00:50Z"},{"id":"wordfence:481c738e-d544-4587-8632-e85a7ddd8b14","source":"wordfence","cve":"CVE-2023-25701","title":"WatchTowerHQ <= 3.6.16 - Type Juggling to Authentication Bypass in check_ota","severity":"critical","cvss":9.8,"cwe":"CWE-697","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481c738e-d544-4587-8632-e85a7ddd8b14?source=api-prod","affected":[{"type":"plugin","slug":"watchtowerhq","name":"WatchTowerHQ","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"3.6.17"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:481dc27b-0d64-49cc-8d67-50fa53636398","source":"wordfence","cve":"CVE-2026-8911","title":"WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/481dc27b-0d64-49cc-8d67-50fa53636398?source=api-prod","affected":[{"type":"plugin","slug":"wp-autobuzz","name":"WP AutoBuzz","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:14Z","updated":"2026-05-27T05:31:25Z"},{"id":"wordfence:4822f1c7-3f83-416c-8957-17e4b53d7e69","source":"wordfence","cve":"CVE-2024-4194","title":"Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=api-prod","affected":[{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-06T12:32:22Z"},{"id":"wordfence:4824be4c-eec0-4979-85e1-6c692b3a8243","source":"wordfence","cve":"CVE-2025-24677","title":"Post/Page Copying Tool  to Export and Import post/page for Cross site Migration <= 2.0.3 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4824be4c-eec0-4979-85e1-6c692b3a8243?source=api-prod","affected":[{"type":"plugin","slug":"postpage-import-export-with-custom-fields-taxonomies","name":"Post/Page Import Export \u2013 Migrate Content with Custom Fields & Taxonomies","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-01-20T00:00:00Z","updated":"2025-02-26T20:28:08Z"},{"id":"wordfence:48285f43-3ee2-4b6b-a12d-ac96618da7b8","source":"wordfence","cve":"CVE-2026-25017","title":"NaturaLife Extensions <= 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48285f43-3ee2-4b6b-a12d-ac96618da7b8?source=api-prod","affected":[{"type":"plugin","slug":"naturalife-extensions","name":"NaturaLife Extensions","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:16:11Z"},{"id":"wordfence:482bae65-5493-4de5-9d5f-479d0968cd4a","source":"wordfence","cve":"CVE-2022-46854","title":"Launchpad <= 1.0.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/482bae65-5493-4de5-9d5f-479d0968cd4a?source=api-prod","affected":[{"type":"plugin","slug":"launchpad-by-obox","name":"Launchpad \u2013 Coming Soon & Maintenance Mode Plugin","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:482bf861-e556-40af-b522-c22ef6c9938b","source":"wordfence","cve":"CVE-2024-3239","title":"Post Grid Gutenberg Blocks and WordPress Blog Plugin \u2013 PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/482bf861-e556-40af-b522-c22ef6c9938b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-26T11:15:05Z"},{"id":"wordfence:482c4986-3677-4754-992b-ea9be7573d2e","source":"wordfence","cve":"CVE-2025-14274","title":"Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/482c4986-3677-4754-992b-ea9be7573d2e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-02-02T17:17:14Z","updated":"2026-02-03T05:30:13Z"},{"id":"wordfence:4830fb09-c138-4316-bdde-c233d58b0d91","source":"wordfence","cve":"CVE-2024-35700","title":"UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4830fb09-c138-4316-bdde-c233d58b0d91?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"5.1.8","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-29T21:25:58Z"},{"id":"wordfence:483564f8-6308-4913-82e2-78d69aebb6dd","source":"wordfence","cve":"CVE-2021-24471","title":"YouTube Embed <= 5.2.1 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/483564f8-6308-4913-82e2-78d69aebb6dd?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed","name":"Embeds for YouTube","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48363f1f-dae8-4efa-824f-098550245ca3","source":"wordfence","cve":"CVE-2026-7421","title":"Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48363f1f-dae8-4efa-824f-098550245ca3?source=api-prod","affected":[{"type":"plugin","slug":"passeum-ticketing","name":"Passeum Ticketing","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-02T10:57:01Z","updated":"2026-09-09T16:36:50Z"},{"id":"wordfence:4836b2c8-c552-425e-8c4d-fdcdf795e14a","source":"wordfence","cve":"CVE-2026-32335","title":"The Conference <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4836b2c8-c552-425e-8c4d-fdcdf795e14a?source=api-prod","affected":[{"type":"theme","slug":"the-conference","name":"The Conference","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:45:46Z"},{"id":"wordfence:4838c2ad-87e0-4140-81bb-7d39d7a704dc","source":"wordfence","cve":"","title":"eShop < 6.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4838c2ad-87e0-4140-81bb-7d39d7a704dc?source=api-prod","affected":[{"type":"plugin","slug":"eshop","name":"eShop","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":false,"patched_in":"6.2.9"}],"published":"2011-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:483dad33-bde9-4008-b79c-6a66d3514652","source":"wordfence","cve":"CVE-2026-52703","title":"FastDup \u2013 Fastest WordPress Migration & Duplicator <= 2.7.2 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/483dad33-bde9-4008-b79c-6a66d3514652?source=api-prod","affected":[{"type":"plugin","slug":"fastdup","name":"FastDup \u2013 Fastest WordPress Migration & Duplicator","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:21:12Z"},{"id":"wordfence:483fa12f-cdd1-4d11-8cec-f3ffc4fdcc88","source":"wordfence","cve":"CVE-2026-32453","title":"Avada Core < 5.15.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/483fa12f-cdd1-4d11-8cec-f3ffc4fdcc88?source=api-prod","affected":[{"type":"plugin","slug":"fusion-core","name":"Avada Core","from":"*","from_inclusive":true,"to":"5.15.0","to_inclusive":false,"patched_in":"5.15.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:43:59Z"},{"id":"wordfence:48400e64-40b4-4f96-8346-1a104ae89761","source":"wordfence","cve":"CVE-2025-62054","title":"Houzez Theme - Functionality <= 4.1.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48400e64-40b4-4f96-8346-1a104ae89761?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:49:48Z"},{"id":"wordfence:48421787-9dc1-48ea-892b-bb43b2a6c4da","source":"wordfence","cve":"CVE-2024-32431","title":"Import Users from CSV <= 1.2 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48421787-9dc1-48ea-892b-bb43b2a6c4da?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv","name":"Import Users from CSV","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:45:24Z"},{"id":"wordfence:4848292a-0378-4e0c-a95f-3232c5ce9b9f","source":"wordfence","cve":"CVE-2025-31430","title":"The Business <= 1.6.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4848292a-0378-4e0c-a95f-3232c5ce9b9f?source=api-prod","affected":[{"type":"theme","slug":"nrgbusiness","name":"The Business - Powerful One Page Biz Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T15:48:21Z"},{"id":"wordfence:4849dc51-766d-43b8-ae3a-876798969177","source":"wordfence","cve":"CVE-2026-49104","title":"Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4849dc51-766d-43b8-ae3a-876798969177?source=api-prod","affected":[{"type":"plugin","slug":"cf7-infusionsoft","name":"Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:42:55Z"},{"id":"wordfence:484ad4ef-9d0d-4dc5-8bb4-d81d0311ebf8","source":"wordfence","cve":"CVE-2021-24711","title":"Software License Manager <= 4.5.0 - Cross-Site Request Forgery leading to Arbitrary Domain Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/484ad4ef-9d0d-4dc5-8bb4-d81d0311ebf8?source=api-prod","affected":[{"type":"plugin","slug":"software-license-manager","name":"Software License Manager","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":false,"patched_in":"4.5.1"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:484d364d-cf33-4575-a10b-6b0815f12a69","source":"wordfence","cve":"CVE-2026-49065","title":"Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/484d364d-cf33-4575-a10b-6b0815f12a69?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:38:20Z"},{"id":"wordfence:484d8d14-049d-4fd5-adb8-ad9942bba794","source":"wordfence","cve":"CVE-2024-24846","title":"Mighty Addons for Elementor <= 1.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/484d8d14-049d-4fd5-adb8-ad9942bba794?source=api-prod","affected":[{"type":"plugin","slug":"mighty-addons","name":"Mighty Addons for Elementor","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T20:50:17Z"},{"id":"wordfence:484dded3-dbe7-4a11-877a-a19504d30206","source":"wordfence","cve":"CVE-2025-10187","title":"GSpeech TTS \u2013 WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/484dded3-dbe7-4a11-877a-a19504d30206?source=api-prod","affected":[{"type":"plugin","slug":"gspeech","name":"GSpeech TTS \u2013 WordPress Text To Speech Plugin","from":"*","from_inclusive":true,"to":"3.17.3","to_inclusive":true,"patched_in":"3.18.0"}],"published":"2025-10-17T00:00:00Z","updated":"2025-10-18T06:42:45Z"},{"id":"wordfence:484ffb38-584e-4239-a9db-2d6d9dfb250a","source":"wordfence","cve":"CVE-2025-60159","title":"Nota Fiscal Eletr\u00f4nica WooCommerce <= 3.4.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/484ffb38-584e-4239-a9db-2d6d9dfb250a?source=api-prod","affected":[{"type":"plugin","slug":"nota-fiscal-eletronica-woocommerce","name":"Nota Fiscal Eletr\u00f4nica Webmania","from":"*","from_inclusive":true,"to":"3.4.0.9","to_inclusive":true,"patched_in":"3.4.1.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-01-06T20:23:32Z"},{"id":"wordfence:48509d43-57bb-452c-b39b-905354a273f3","source":"wordfence","cve":"CVE-2025-5816","title":"Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48509d43-57bb-452c-b39b-905354a273f3?source=api-prod","affected":[{"type":"plugin","slug":"biteship","name":"Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:22:18Z","updated":"2025-07-18T04:23:02Z"},{"id":"wordfence:48511d1a-2fd5-4be4-8409-e99d4aadcdfe","source":"wordfence","cve":"CVE-2024-1802","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48511d1a-2fd5-4be4-8409-e99d4aadcdfe?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.9.11"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-07T20:33:28Z"},{"id":"wordfence:48514fdb-20c6-4a7f-8f60-e532ddd8853e","source":"wordfence","cve":"CVE-2025-13854","title":"Curved Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48514fdb-20c6-4a7f-8f60-e532ddd8853e?source=api-prod","affected":[{"type":"plugin","slug":"curved-text","name":"Curved Text","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:22:18Z","updated":"2026-01-09T11:15:32Z"},{"id":"wordfence:4852bd93-032f-4e11-ac30-7268684f08e2","source":"wordfence","cve":"CVE-2024-31106","title":"Yoo Slider <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4852bd93-032f-4e11-ac30-7268684f08e2?source=api-prod","affected":[{"type":"plugin","slug":"yoo-slider","name":"Yoo Slider \u2013 Image Slider & Video Slider","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-03-29T00:00:00Z","updated":"2026-03-17T21:19:27Z"},{"id":"wordfence:4855627a-de56-49ee-b0b0-01b9735d8557","source":"wordfence","cve":"CVE-2023-2299","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4855627a-de56-49ee-b0b0-01b9735d8557?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2023-06-02T00:00:00Z","updated":"2024-11-25T16:22:34Z"},{"id":"wordfence:48583297-59db-48ec-8551-d6b37ac02197","source":"wordfence","cve":"CVE-2023-38394","title":"JupiterX Core  3.0.0 - 3.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48583297-59db-48ec-8551-d6b37ac02197?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"3.0.0","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:485a716a-4541-44e0-98b1-1a607439c66c","source":"wordfence","cve":"CVE-2025-26918","title":"Small Package Quotes \u2013 Unishippers Edition <= 2.4.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/485a716a-4541-44e0-98b1-1a607439c66c?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-unishippers-edition","name":"Small Package Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:17:35Z"},{"id":"wordfence:485b0f47-fb3c-49f5-8e27-c250879cb75f","source":"wordfence","cve":"CVE-2024-30519","title":"Lordicon Animated Icons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/485b0f47-fb3c-49f5-8e27-c250879cb75f?source=api-prod","affected":[{"type":"plugin","slug":"lordicon-interactive-icons","name":"Lordicon Animated Icons","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:45:51Z"},{"id":"wordfence:485c9ee6-9cb5-45ca-86af-ee5d10ee6734","source":"wordfence","cve":"CVE-2024-9502","title":"Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/485c9ee6-9cb5-45ca-86af-ee5d10ee6734?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.7","to_inclusive":true,"patched_in":"2.0.6.8"}],"published":"2025-01-06T17:32:47Z","updated":"2025-01-07T06:40:57Z"},{"id":"wordfence:485cf8c9-493b-441f-a741-fccb09250052","source":"wordfence","cve":"CVE-2026-22329","title":"Skillate <= 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/485cf8c9-493b-441f-a741-fccb09250052?source=api-prod","affected":[{"type":"theme","slug":"skillate","name":"Skillate","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:47:41Z"},{"id":"wordfence:485ec722-b6d2-44f9-924e-dcea17dca03e","source":"wordfence","cve":"CVE-2026-25432","title":"Omnipress <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/485ec722-b6d2-44f9-924e-dcea17dca03e?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-25T00:00:00Z","updated":"2026-05-22T05:17:51Z"},{"id":"wordfence:48658b33-ae53-4919-8180-1188f72553f7","source":"wordfence","cve":"CVE-2025-6754","title":"SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48658b33-ae53-4919-8180-1188f72553f7?source=api-prod","affected":[{"type":"plugin","slug":"seo-metrics-helper","name":"SEO Metrics","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-08-01T18:49:47Z","updated":"2025-09-05T15:34:36Z"},{"id":"wordfence:48660afe-1e03-4bf5-b821-6538a4daf201","source":"wordfence","cve":"CVE-2026-14359","title":"YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48660afe-1e03-4bf5-b821-6538a4daf201?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-waiting-list-premium","name":"YITH WooCommerce Waitlist Premium","from":"*","from_inclusive":true,"to":"3.35.0","to_inclusive":true,"patched_in":"3.36.0"}],"published":"2026-09-08T20:01:42Z","updated":"2026-09-09T08:28:22Z"},{"id":"wordfence:4869dcd8-9b21-4751-8682-10f1aede14a3","source":"wordfence","cve":"CVE-2025-46481","title":"Flickr Shortcode Importer <= 2.2.3 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4869dcd8-9b21-4751-8682-10f1aede14a3?source=api-prod","affected":[{"type":"plugin","slug":"flickr-shortcode-importer","name":"Flickr Shortcode Importer","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:47:07Z"},{"id":"wordfence:486b6a75-d101-4f3a-8436-6c23dd0ff200","source":"wordfence","cve":"CVE-2023-0447","title":"My YouTube Channel <= 3.0.12.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486b6a75-d101-4f3a-8436-6c23dd0ff200?source=api-prod","affected":[{"type":"plugin","slug":"youtube-channel","name":"My YouTube Channel","from":"*","from_inclusive":true,"to":"3.0.12.1","to_inclusive":true,"patched_in":"3.23.0"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:486c1c7c-5a66-42d3-85b0-13ce52a16ed1","source":"wordfence","cve":"CVE-2026-12227","title":"Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.16.0","to_inclusive":true,"patched_in":"45.16.1"}],"published":"2026-09-23T20:34:48Z","updated":"2026-09-24T09:27:45Z"},{"id":"wordfence:486d1974-e068-45ad-98be-691c1bc9a841","source":"wordfence","cve":"CVE-2025-9373","title":"PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486d1974-e068-45ad-98be-691c1bc9a841?source=api-prod","affected":[{"type":"plugin","slug":"pepro-mapify","name":"PeproDev Branches Map (Mapify)","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-13T19:37:03Z","updated":"2026-10-14T07:43:32Z"},{"id":"wordfence:486f43cc-cc3f-4a63-b00f-86f29a391269","source":"wordfence","cve":"CVE-2024-9125","title":"king_IE <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486f43cc-cc3f-4a63-b00f-86f29a391269?source=api-prod","affected":[{"type":"plugin","slug":"king-ie","name":"king_IE","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T21:22:18Z","updated":"2024-09-26T09:29:40Z"},{"id":"wordfence:486fa1a6-aa47-4bf9-b1da-582e316f6bcb","source":"wordfence","cve":"","title":"Woocommerce Customers Manager <= 26.4 - Authenticated Account Creation and Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486fa1a6-aa47-4bf9-b1da-582e316f6bcb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"26.5","to_inclusive":false,"patched_in":"26.5"}],"published":"2021-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:486ffdc9-a3e7-4f4c-89b1-b668a5d41aa5","source":"wordfence","cve":"CVE-2024-1041","title":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486ffdc9-a3e7-4f4c-89b1-b668a5d41aa5?source=api-prod","affected":[{"type":"plugin","slug":"wp-radio","name":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:21Z"},{"id":"wordfence:48715526-f423-40ce-8c7f-d7713c57ce36","source":"wordfence","cve":"CVE-2026-24385","title":"Podlove Web Player <= 5.9.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48715526-f423-40ce-8c7f-d7713c57ce36?source=api-prod","affected":[{"type":"plugin","slug":"podlove-web-player","name":"Podlove Web Player","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:02:00Z"},{"id":"wordfence:487185ed-d5ff-4658-9210-958e3ba2fe91","source":"wordfence","cve":"CVE-2026-6382","title":"Multiple Plugins <= Multiple Versions - Authenticated Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487185ed-d5ff-4658-9210-958e3ba2fe91?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"8.0.4","to_inclusive":false,"patched_in":"8.0.4"},{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.4.12","to_inclusive":false,"patched_in":"5.4.12"},{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"},{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-03T18:04:18Z"},{"id":"wordfence:48758ada-4c7f-4a7f-8b43-535f820e6b3c","source":"wordfence","cve":"","title":"Accordion <= 2.2.43 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48758ada-4c7f-4a7f-8b43-535f820e6b3c?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.2.40","to_inclusive":true,"patched_in":"2.2.43"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4876e05e-efa6-46c6-832b-9ecc42934998","source":"wordfence","cve":"CVE-2024-5317","title":"Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4876e05e-efa6-46c6-832b-9ecc42934998?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2024-06-04T00:00:00Z","updated":"2024-06-05T01:56:31Z"},{"id":"wordfence:487731cd-da5a-45b6-8f39-4ae6420dd252","source":"wordfence","cve":"CVE-2024-2861","title":"ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487731cd-da5a-45b6-8f39-4ae6420dd252?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.8","to_inclusive":true,"patched_in":"4.15.9"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T09:32:32Z"},{"id":"wordfence:4877dbe2-8c29-48db-b2aa-ad91015184c9","source":"wordfence","cve":"CVE-2026-103340","title":"Site Reviews <= 8.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4877dbe2-8c29-48db-b2aa-ad91015184c9?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"8.3.3"}],"published":"2026-10-01T12:25:00Z","updated":"2026-10-08T23:03:22Z"},{"id":"wordfence:48784892-443f-452c-9fe9-12e73af1cf7f","source":"wordfence","cve":"","title":"Booster for WooCommerce (Free <= 5.6.2 and Premium <= 5.6.0) - Authenticated (Subscriber+) Order Modification","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48784892-443f-452c-9fe9-12e73af1cf7f?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:487a131e-4911-42d6-bfd7-fc697c89552d","source":"wordfence","cve":"","title":"BizPrint <= 4.5.1 - Cross-Site Request Forgery in Printer Management","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487a131e-4911-42d6-bfd7-fc697c89552d?source=api-prod","affected":[{"type":"plugin","slug":"print-google-cloud-print-gcp-woocommerce","name":"Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-06T18:16:47Z"},{"id":"wordfence:487a6c5e-226b-4b30-a402-bd5132d17ea8","source":"wordfence","cve":"CVE-2022-1906","title":"Copyright Proof <= 4.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487a6c5e-226b-4b30-a402-bd5132d17ea8?source=api-prod","affected":[{"type":"plugin","slug":"digiproveblog","name":"Copyright Proof","from":"*","from_inclusive":true,"to":"4.16","to_inclusive":true,"patched_in":""}],"published":"2022-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:487d4175-97bf-4c65-9d7d-b83974e9fda9","source":"wordfence","cve":"CVE-2013-2107","title":"Mail On Update < 5.3.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487d4175-97bf-4c65-9d7d-b83974e9fda9?source=api-prod","affected":[{"type":"plugin","slug":"mail-on-update","name":"Mail On Update","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:487d94e8-e4f1-4da8-914c-96157f8ae14d","source":"wordfence","cve":"CVE-2021-24852","title":"MouseWheel Smooth Scroll <= 5.6 - Plugin's Setting Update via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487d94e8-e4f1-4da8-914c-96157f8ae14d?source=api-prod","affected":[{"type":"plugin","slug":"mousewheel-smooth-scroll","name":"MouseWheel Smooth Scroll","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:487e23c9-9100-4240-8992-c4c85930c4a6","source":"wordfence","cve":"","title":"WP Courses LMS <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487e23c9-9100-4240-8992-c4c85930c4a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:487e5add-726c-4cfc-b86e-bb4eeec168a3","source":"wordfence","cve":"CVE-2024-9346","title":"Embed videos and respect privacy <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/487e5add-726c-4cfc-b86e-bb4eeec168a3?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-privacy","name":"Embed videos and respect privacy","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:16Z"},{"id":"wordfence:4881f21c-a8ab-4a20-aaab-4b44804d3709","source":"wordfence","cve":"CVE-2025-68878","title":"Advanced Custom CSS <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4881f21c-a8ab-4a20-aaab-4b44804d3709?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-css","name":"Advanced Custom CSS","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:00:13Z"},{"id":"wordfence:488567cd-b296-402f-9056-667b061950da","source":"wordfence","cve":"CVE-2024-4475","title":"WP Logs Book <= 1.0.1 - Cross-Site Request Forgery to Log Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488567cd-b296-402f-9056-667b061950da?source=api-prod","affected":[{"type":"plugin","slug":"wp-logs-book","name":"WP Logs Book","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:17:26Z"},{"id":"wordfence:48871c87-1997-4d15-b0d7-2fdc61190f3b","source":"wordfence","cve":"CVE-2025-66130","title":"Views Counter <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48871c87-1997-4d15-b0d7-2fdc61190f3b?source=api-prod","affected":[{"type":"plugin","slug":"wpecounter","name":"WP Views Counter","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-12-14T00:00:00Z","updated":"2026-01-07T14:25:49Z"},{"id":"wordfence:4888a1dc-ed12-41c0-910b-6c9740a54ef0","source":"wordfence","cve":"CVE-2021-38322","title":"Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4888a1dc-ed12-41c0-910b-6c9740a54ef0?source=api-prod","affected":[{"type":"plugin","slug":"twitter-friends-widget","name":"Twitter Friends Widget","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T20:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:488970f0-3120-4f4a-9915-2ae1708bd86a","source":"wordfence","cve":"","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488970f0-3120-4f4a-9915-2ae1708bd86a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:488ac848-786e-4100-a387-5a40e8fc4175","source":"wordfence","cve":"CVE-2024-4452","title":"ElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488ac848-786e-4100-a387-5a40e8fc4175?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-21T13:51:50Z"},{"id":"wordfence:488bafe4-746a-4531-95ac-30d17ace2239","source":"wordfence","cve":"CVE-2022-2846","title":"Calendar Event Multi View <= 1.4.06 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488bafe4-746a-4531-95ac-30d17ace2239?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.06","to_inclusive":true,"patched_in":"1.4.07"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:488bba29-5586-4969-9816-ddef5eee034a","source":"wordfence","cve":"CVE-2026-57422","title":"Bopo \u2013 WooCommerce Product Bundle Builder <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488bba29-5586-4969-9816-ddef5eee034a?source=api-prod","affected":[{"type":"plugin","slug":"bopo-woo-product-bundle-builder","name":"Bopo \u2013 WooCommerce Product Bundle Builder","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:39:01Z"},{"id":"wordfence:488e26e2-d4d7-4036-a672-53c2d4c9d39b","source":"wordfence","cve":"CVE-2023-1340","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_uucss_logs'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488e26e2-d4d7-4036-a672-53c2d4c9d39b?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:488f1a2f-01c8-40cf-b52f-d707271105f5","source":"wordfence","cve":"CVE-2025-11177","title":"External Login <= 1.11.2 - Unauthenticated SQL Injection via log","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/488f1a2f-01c8-40cf-b52f-d707271105f5?source=api-prod","affected":[{"type":"plugin","slug":"external-login","name":"External Login","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:58:40Z","updated":"2025-10-15T08:25:54Z"},{"id":"wordfence:4890cd48-a448-4af1-ae1e-6456300434e5","source":"wordfence","cve":"CVE-2024-4485","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4890cd48-a448-4af1-ae1e-6456300434e5?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T06:42:16Z"},{"id":"wordfence:4890ec6f-ba73-48bd-8dd7-f896d6b4a140","source":"wordfence","cve":"","title":"Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4890ec6f-ba73-48bd-8dd7-f896d6b4a140?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.46","to_inclusive":false,"patched_in":"2.0.46"}],"published":"2019-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4891055a-04b2-453d-a2ea-2fb793705ff8","source":"wordfence","cve":"CVE-2021-25104","title":"Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4891055a-04b2-453d-a2ea-2fb793705ff8?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":false,"patched_in":"1.9.5"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4891fd3f-563b-497a-a5d9-617f4862298b","source":"wordfence","cve":"CVE-2021-24905","title":"Advanced Contact form 7 DB <= 1.8.6 - Authenticated Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4891fd3f-563b-497a-a5d9-617f4862298b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":false,"patched_in":"1.8.7"}],"published":"2022-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:489256a8-e28f-4d7c-895a-928e9463bb1b","source":"wordfence","cve":"CVE-2024-30508","title":"WP Hotel Booking <= 2.0.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/489256a8-e28f-4d7c-895a-928e9463bb1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.9.2","to_inclusive":true,"patched_in":"2.0.9.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:48:29Z"},{"id":"wordfence:4893d7a7-6e37-4b58-b7ae-53feb0c85ff5","source":"wordfence","cve":"CVE-2011-10041","title":"Uploadify <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4893d7a7-6e37-4b58-b7ae-53feb0c85ff5?source=api-prod","affected":[{"type":"plugin","slug":"uploadify","name":"Uploadify","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2011-02-21T00:00:00Z","updated":"2026-02-02T20:58:37Z"},{"id":"wordfence:48949329-8918-4d37-9f3a-1005e99d7e4d","source":"wordfence","cve":"CVE-2022-0694","title":"Advanced Booking Calendar <= 1.6.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48949329-8918-4d37-9f3a-1005e99d7e4d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4894a24b-aaa4-4d03-a897-9074a194c07f","source":"wordfence","cve":"CVE-2025-67628","title":"Review Disclaimer <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4894a24b-aaa4-4d03-a897-9074a194c07f?source=api-prod","affected":[{"type":"plugin","slug":"review-disclaimer","name":"Review Disclaimer","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-05T18:43:39Z"},{"id":"wordfence:48950965-f7da-42af-9f9a-4bf7fd33be45","source":"wordfence","cve":"CVE-2024-50510","title":"AR For Woocommerce <= 6.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48950965-f7da-42af-9f9a-4bf7fd33be45?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-woocommerce","name":"AR for WooCommerce","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"7.0"}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:44:50Z"},{"id":"wordfence:4895155b-1b09-4f4e-b5d4-f960b95a4258","source":"wordfence","cve":"CVE-2026-107787","title":"CatFolders <= 2.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4895155b-1b09-4f4e-b5d4-f960b95a4258?source=api-prod","affected":[{"type":"plugin","slug":"catfolders","name":"CatFolders \u2013 WordPress Media Library Folders & Categories","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:11:26Z"},{"id":"wordfence:4898d7c1-a784-45b6-87bf-c1949fc1414f","source":"wordfence","cve":"CVE-2025-30937","title":"Responsify WP <= 1.9.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4898d7c1-a784-45b6-87bf-c1949fc1414f?source=api-prod","affected":[{"type":"plugin","slug":"responsify-wp","name":"Responsify WP","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:12:28Z"},{"id":"wordfence:489931ef-bac3-4de8-84ec-6f226d96f778","source":"wordfence","cve":"CVE-2026-0927","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated  Limited Arbitrary File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/489931ef-bac3-4de8-84ec-6f226d96f778?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":true,"patched_in":"3.6.16"}],"published":"2026-01-22T17:11:21Z","updated":"2026-01-23T05:29:50Z"},{"id":"wordfence:489b9a43-cb9a-4dab-baf0-dfb13fc04a6b","source":"wordfence","cve":"CVE-2026-113487","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory < 2.8.196 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/489b9a43-cb9a-4dab-baf0-dfb13fc04a6b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.196","to_inclusive":false,"patched_in":"2.8.196"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:24Z"},{"id":"wordfence:489dc156-b8cb-4e08-a847-73a891398d5c","source":"wordfence","cve":"CVE-2023-41948","title":"Cookie Notice & Consent 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/489dc156-b8cb-4e08-a847-73a891398d5c?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-consent","name":"Cookie Notice & Consent","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:489fe6ac-5437-44a2-93dc-00e75eefbc45","source":"wordfence","cve":"CVE-2023-46609","title":"FeedFocal <= 1.2.2 - Missing Authorization via feedfocal_api_setup REST function","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/489fe6ac-5437-44a2-93dc-00e75eefbc45?source=api-prod","affected":[{"type":"plugin","slug":"feedfocal","name":"FeedFocal","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-10-24T00:00:00Z","updated":"2024-03-25T17:11:42Z"},{"id":"wordfence:48a13fb7-bf1a-4bf2-ac3b-3b5a75fec616","source":"wordfence","cve":"CVE-2024-3161","title":"Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48a13fb7-bf1a-4bf2-ac3b-3b5a75fec616?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:02Z"},{"id":"wordfence:48a572f1-a583-4f77-8719-b553654f021e","source":"wordfence","cve":"CVE-2026-22524","title":"Legacy Admin <= 9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48a572f1-a583-4f77-8719-b553654f021e?source=api-prod","affected":[{"type":"plugin","slug":"legacy-admin","name":"Legacy Admin","from":"*","from_inclusive":true,"to":"9.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:57:27Z"},{"id":"wordfence:48a59d72-16f2-498e-b042-ce79b55605dc","source":"wordfence","cve":"CVE-2025-58685","title":"Cecabank WooCommerce Plugin <= 0.3.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48a59d72-16f2-498e-b042-ce79b55605dc?source=api-prod","affected":[{"type":"plugin","slug":"cecabank-woocommerce","name":"Cecabank WooCommerce Plugin","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":"0.3.5"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T18:29:24Z"},{"id":"wordfence:48a6fe41-675a-4033-877b-77e6cd906f73","source":"wordfence","cve":"CVE-2026-25023","title":"Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48a6fe41-675a-4033-877b-77e6cd906f73?source=api-prod","affected":[{"type":"plugin","slug":"contest-code-checker","name":"Run Contests, Raffles, and Giveaways with ContestsWP","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-02-02T00:00:00Z","updated":"2026-02-10T19:58:15Z"},{"id":"wordfence:48aa5be8-a5d9-4f5e-ba30-d6afb3f0fee0","source":"wordfence","cve":"CVE-2023-28990","title":"Viral Mag <= 1.0.9 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48aa5be8-a5d9-4f5e-ba30-d6afb3f0fee0?source=api-prod","affected":[{"type":"theme","slug":"viral-mag","name":"Viral Mag","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48ab8363-bc1c-47b4-8eb4-6093cd7591c9","source":"wordfence","cve":"CVE-2024-32521","title":"Zero Spam <= 5.5.6 - Spam Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ab8363-bc1c-47b4-8eb4-6093cd7591c9?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2024-04-15T00:00:00Z","updated":"2026-01-08T21:53:37Z"},{"id":"wordfence:48add930-a350-4828-84a0-e1207a9b239b","source":"wordfence","cve":"CVE-2025-49926","title":"Kalium <= 3.25 - Unauthenticated Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48add930-a350-4828-84a0-e1207a9b239b?source=api-prod","affected":[{"type":"theme","slug":"kalium","name":"Kalium 3 | Creative WordPress & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.25","to_inclusive":true,"patched_in":"3.26"}],"published":"2025-06-19T00:00:00Z","updated":"2025-11-04T16:51:26Z"},{"id":"wordfence:48ae6e52-4a66-4676-9528-6f997ef54c7a","source":"wordfence","cve":"CVE-2026-12561","title":"tagDiv Composer <= 5.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ae6e52-4a66-4676-9528-6f997ef54c7a?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"5.4.8"}],"published":"2026-08-24T15:27:36Z","updated":"2026-09-21T18:49:38Z"},{"id":"wordfence:48b0d7ad-f4d6-45b5-8694-e41551728e83","source":"wordfence","cve":"CVE-2024-35697","title":"Eduma <= 5.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b0d7ad-f4d6-45b5-8694-e41551728e83?source=api-prod","affected":[{"type":"theme","slug":"eduma","name":"Eduma","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"5.4.8"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T14:10:28Z"},{"id":"wordfence:48b1c1e6-a3bc-469b-aadc-fe15ce877c67","source":"wordfence","cve":"CVE-2024-13226","title":"A5 Custom Login Page <= 2.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b1c1e6-a3bc-469b-aadc-fe15ce877c67?source=api-prod","affected":[{"type":"plugin","slug":"custom-login-page","name":"A5 Custom Login Page","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:53:57Z"},{"id":"wordfence:48b31324-c6a3-4550-939e-06f7b3c7067a","source":"wordfence","cve":"CVE-2019-16525","title":"Checklist <= 1.1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b31324-c6a3-4550-939e-06f7b3c7067a?source=api-prod","affected":[{"type":"plugin","slug":"checklist","name":"Checklist","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48b4214f-b722-405e-9bb7-a1faa68f0429","source":"wordfence","cve":"","title":"Cardinity Payment Gateway for WooCommerce <= 3.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b4214f-b722-405e-9bb7-a1faa68f0429?source=api-prod","affected":[{"type":"plugin","slug":"cardinity-free-payment-gateway-for-woocommerce","name":"Cardinity Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48b47968-e853-4f32-b66e-8a25e1d7009d","source":"wordfence","cve":"CVE-2026-66467","title":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.7.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b47968-e853-4f32-b66e-8a25e1d7009d?source=api-prod","affected":[{"type":"plugin","slug":"fluent-community","name":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:07:16Z"},{"id":"wordfence:48b66fb1-2b3e-499d-bf1f-3c445f4b5e3a","source":"wordfence","cve":"CVE-2024-51878","title":"AchillesTheme-shortcodes <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b66fb1-2b3e-499d-bf1f-3c445f4b5e3a?source=api-prod","affected":[{"type":"plugin","slug":"achilles-shortcodes","name":"AchillesTheme-shortcodes","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:27:33Z"},{"id":"wordfence:48b6b9a3-c80d-4fde-9e8c-1f60781b7484","source":"wordfence","cve":"CVE-2016-10868","title":"All In One WP Security & Firewall <= 4.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b6b9a3-c80d-4fde-9e8c-1f60781b7484?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"}],"published":"2016-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92","source":"wordfence","cve":"CVE-2023-23894","title":"Surbma | GDPR Proof Cookie Consent & Notice Bar <= 17.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48b9f3e3-b7fd-4d7c-8f8b-b11ed977aa92?source=api-prod","affected":[{"type":"plugin","slug":"surbma-gdpr-proof-google-analytics","name":"Surbma | GDPR Proof Cookie Consent & Notice Bar","from":"*","from_inclusive":true,"to":"17.5.3","to_inclusive":true,"patched_in":"17.6.0"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48ba0558-41ad-46f5-971d-3da9311b262b","source":"wordfence","cve":"CVE-2025-39486","title":"Rankie - Wordpress Rank Tracker Plugin < 1.8.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ba0558-41ad-46f5-971d-3da9311b262b?source=api-prod","affected":[{"type":"plugin","slug":"valvepress-rankie","name":"Rankie - Wordpress Rank Tracker Plugin","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2025-06-17T00:00:00Z","updated":"2025-07-09T15:12:05Z"},{"id":"wordfence:48ba51f0-5ae6-4aa0-a7fc-40264ada7998","source":"wordfence","cve":"CVE-2025-4414","title":"CMSMasters Content Composer < 2.5.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ba51f0-5ae6-4aa0-a7fc-40264ada7998?source=api-prod","affected":[{"type":"plugin","slug":"cmsmasters-content-composer","name":"CMSMasters Content Composer","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":false,"patched_in":"2.5.7"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:37:04Z"},{"id":"wordfence:48be0157-5eb9-4e06-b406-0af659de034b","source":"wordfence","cve":"CVE-2023-32625","title":"TS Webfonts for SAKURA <= 3.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48be0157-5eb9-4e06-b406-0af659de034b?source=api-prod","affected":[{"type":"plugin","slug":"ts-webfonts-for-sakura","name":"TS Webfonts for \u3055\u304f\u3089\u306e\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48bf876f-b817-454d-a802-db52f3900e18","source":"wordfence","cve":"CVE-2024-13608","title":"Track Logins <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48bf876f-b817-454d-a802-db52f3900e18?source=api-prod","affected":[{"type":"plugin","slug":"track-logins","name":"Track Logins","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-30T22:07:08Z"},{"id":"wordfence:48bf9bf4-1b8a-41cc-adc9-a618d075c7f2","source":"wordfence","cve":"CVE-2022-0364","title":"Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48bf9bf4-1b8a-41cc-adc9-a618d075c7f2?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48c114d7-3d53-4157-a335-19cf4b47eed5","source":"wordfence","cve":"CVE-2026-1891","title":"Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c114d7-3d53-4157-a335-19cf4b47eed5?source=api-prod","affected":[{"type":"plugin","slug":"simple-football-score-board","name":"Simple Football Scoreboard","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:54Z","updated":"2026-03-21T03:26:44Z"},{"id":"wordfence:48c2f64e-6d95-4cf8-af61-8030e291d22b","source":"wordfence","cve":"CVE-2026-62131","title":"Zoho Flow \u2013 No-Code Workflow Automation <= 2.14.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c2f64e-6d95-4cf8-af61-8030e291d22b?source=api-prod","affected":[{"type":"plugin","slug":"zoho-flow","name":"Zoho Flow \u2013 No-Code Workflow Automation","from":"*","from_inclusive":true,"to":"2.14.5","to_inclusive":true,"patched_in":"2.14.6"}],"published":"2026-10-26T12:50:08Z","updated":"2026-11-03T20:09:30Z"},{"id":"wordfence:48c40f60-d919-41d9-a2d9-8dad1f03db5c","source":"wordfence","cve":"","title":"InJob | Multi features for recruitment WordPress Theme <= 3.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c40f60-d919-41d9-a2d9-8dad1f03db5c?source=api-prod","affected":[{"type":"theme","slug":"injob","name":"InJob | Multi features for recruitment WordPress Theme","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2020-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48c4372c-1c27-4261-b0ae-85b9117c5dde","source":"wordfence","cve":"CVE-2025-32554","title":"Raptive Ads <= 3.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c4372c-1c27-4261-b0ae-85b9117c5dde?source=api-prod","affected":[{"type":"plugin","slug":"adthrive-ads","name":"Raptive Ads","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-23T17:50:46Z"},{"id":"wordfence:48c6efc9-6c53-4ac9-8f99-62fbab0599ce","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin <= 3.0.229 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c6efc9-6c53-4ac9-8f99-62fbab0599ce?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"3.0.330","to_inclusive":false,"patched_in":"3.0.330"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48c9f263-29d8-4db4-879d-1b8bd59191f7","source":"wordfence","cve":"CVE-2025-47554","title":"CSS3 Compare Pricing Tables for WordPress <= 11.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48c9f263-29d8-4db4-879d-1b8bd59191f7?source=api-prod","affected":[{"type":"plugin","slug":"css3_web_pricing_tables_grids","name":"CSS3 Compare Pricing Tables for WordPress","from":"*","from_inclusive":true,"to":"11.6","to_inclusive":true,"patched_in":"11.7"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:42:41Z"},{"id":"wordfence:48cb5d7b-afbc-4387-ad32-13d2fcb19061","source":"wordfence","cve":"CVE-2024-33915","title":"Debug Log Manager <= 2.3.1 - Missing Authorization via toggle_debugging","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48cb5d7b-afbc-4387-ad32-13d2fcb19061?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:10:59Z"},{"id":"wordfence:48cc0c28-77e2-49e7-aba3-fea2e66f7bb8","source":"wordfence","cve":"CVE-2026-13390","title":"The Events Calendar <= 6.16.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48cc0c28-77e2-49e7-aba3-fea2e66f7bb8?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.16.5.0","to_inclusive":true,"patched_in":"6.16.5.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:15:58Z"},{"id":"wordfence:48cd7580-e52f-4a11-8242-0a9647f5012a","source":"wordfence","cve":"CVE-2026-57777","title":"WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48cd7580-e52f-4a11-8242-0a9647f5012a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"10.9.4","to_inclusive":true,"patched_in":"11.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:23:09Z"},{"id":"wordfence:48cda7b8-edc8-4c2d-bef9-3ee12dc0ea32","source":"wordfence","cve":"CVE-2025-63074","title":"The7 < 12.8.1.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48cda7b8-edc8-4c2d-bef9-3ee12dc0ea32?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"12.8.1.1","to_inclusive":false,"patched_in":"12.8.1.1"}],"published":"2025-10-04T00:00:00Z","updated":"2025-12-19T15:55:01Z"},{"id":"wordfence:48cfe124-34dd-4183-abe1-e345c5a9c31f","source":"wordfence","cve":"CVE-2026-66578","title":"Property Hive <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48cfe124-34dd-4183-abe1-e345c5a9c31f?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-09-17T11:53:00Z","updated":"2026-09-22T18:46:08Z"},{"id":"wordfence:48d0e0e0-81db-46ef-ba64-daa2a4079b79","source":"wordfence","cve":"","title":"Yoast SEO <= 3.2.5 - Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d0e0e0-81db-46ef-ba64-daa2a4079b79?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2016-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48d29e8d-4084-401e-82ff-e4750d739c7c","source":"wordfence","cve":"CVE-2026-12843","title":"LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d29e8d-4084-401e-82ff-e4750d739c7c?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"4.25.0","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.6.1"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T11:28:47Z"},{"id":"wordfence:48d359b6-6930-48cf-a4b4-bc527341c0eb","source":"wordfence","cve":"CVE-2026-101148","title":"BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d359b6-6930-48cf-a4b4-bc527341c0eb?source=api-prod","affected":[{"type":"plugin","slug":"backupsheep","name":"BackupSheep WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T12:33:51Z"},{"id":"wordfence:48d6cd72-6a38-403b-9a8f-960e99d8801f","source":"wordfence","cve":"CVE-2026-16079","title":"Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d6cd72-6a38-403b-9a8f-960e99d8801f?source=api-prod","affected":[{"type":"plugin","slug":"fullscreen-galleria","name":"Fullscreen Galleria","from":"*","from_inclusive":true,"to":"1.6.12","to_inclusive":true,"patched_in":"1.6.13"}],"published":"2026-08-15T15:31:15Z","updated":"2026-08-16T04:24:54Z"},{"id":"wordfence:48d6d4c1-cc87-4c2c-9fbb-90af62f576aa","source":"wordfence","cve":"CVE-2024-7859","title":"Visual Sound <= 1.03 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d6d4c1-cc87-4c2c-9fbb-90af62f576aa?source=api-prod","affected":[{"type":"plugin","slug":"visual-sound","name":"Visual Sound","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-04T15:42:43Z"},{"id":"wordfence:48d9f8a1-fa25-4026-97bc-43ccb9413bd0","source":"wordfence","cve":"CVE-2026-28065","title":"Eject <= 2.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48d9f8a1-fa25-4026-97bc-43ccb9413bd0?source=api-prod","affected":[{"type":"theme","slug":"eject","name":"Eject","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:43:49Z"},{"id":"wordfence:48db0c79-8570-4bb6-b1ae-210a22f2f705","source":"wordfence","cve":"CVE-2026-65459","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48db0c79-8570-4bb6-b1ae-210a22f2f705?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.3","to_inclusive":true,"patched_in":"1.58.0"}],"published":"2026-10-08T13:15:21Z","updated":"2026-10-13T14:19:20Z"},{"id":"wordfence:48db673c-f978-45f4-9d7b-eddd81cee62e","source":"wordfence","cve":"CVE-2024-11279","title":"Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48db673c-f978-45f4-9d7b-eddd81cee62e?source=api-prod","affected":[{"type":"plugin","slug":"schema-app-structured-data-for-schemaorg","name":"Schema App Structured Data","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-12-11T15:13:07Z","updated":"2024-12-21T16:05:56Z"},{"id":"wordfence:48dc10a9-7bb9-401f-befd-1bf620858825","source":"wordfence","cve":"CVE-2024-1473","title":"Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48dc10a9-7bb9-401f-befd-1bf620858825?source=api-prod","affected":[{"type":"plugin","slug":"colorlib-coming-soon-maintenance","name":"Coming Soon & Maintenance Mode by Colorlib","from":"*","from_inclusive":true,"to":"1.0.99","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-03-19T00:00:00Z","updated":"2025-11-05T19:15:09Z"},{"id":"wordfence:48dd4beb-73c3-476b-b06c-cfa2e078fd8d","source":"wordfence","cve":"CVE-2024-54406","title":"Comments On Feed <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48dd4beb-73c3-476b-b06c-cfa2e078fd8d?source=api-prod","affected":[{"type":"plugin","slug":"comments-on-feed","name":"Comments On Feed","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:39:58Z"},{"id":"wordfence:48dd9098-38e6-49da-8d22-27e12fddef51","source":"wordfence","cve":"CVE-2026-3629","title":"Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48dd9098-38e6-49da-8d22-27e12fddef51?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.29.7","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-03-21T10:03:40Z","updated":"2026-03-21T22:24:17Z"},{"id":"wordfence:48df36b8-be32-4fe0-8a5d-d750ee499d62","source":"wordfence","cve":"CVE-2025-22673","title":"EAN for WooCommerce <= 5.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48df36b8-be32-4fe0-8a5d-d750ee499d62?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:04:46Z"},{"id":"wordfence:48dfb893-a2a6-4425-b710-db31a41333fd","source":"wordfence","cve":"CVE-2026-116858","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.58.3 - Authenticated (Subscriber+) Arbitrary Shortcode Injection","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48dfb893-a2a6-4425-b710-db31a41333fd?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.3","to_inclusive":true,"patched_in":"1.58.4"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T15:32:08Z"},{"id":"wordfence:48e2129f-6a2c-45e4-a0cf-7d8d5f563a7f","source":"wordfence","cve":"CVE-2023-5161","title":"Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e2129f-6a2c-45e4-a0cf-7d8d5f563a7f?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48e30af6-d28c-4547-aef9-d216064c9829","source":"wordfence","cve":"CVE-2011-3853","title":"Hybrid < 0.10 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e30af6-d28c-4547-aef9-d216064c9829?source=api-prod","affected":[{"type":"theme","slug":"hybrid","name":"Hybrid","from":"*","from_inclusive":true,"to":"0.10","to_inclusive":false,"patched_in":"0.10"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48e3976a-5dfc-44f5-8d01-0bd1b68575be","source":"wordfence","cve":"CVE-2021-24393","title":"Comment Highlighter <= 0.13 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e3976a-5dfc-44f5-8d01-0bd1b68575be?source=api-prod","affected":[{"type":"plugin","slug":"comment-highlighter","name":"Comment Highlighter","from":"*","from_inclusive":true,"to":"0.13","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48e3b90c-5af3-4538-95c6-fc8864b51db2","source":"wordfence","cve":"CVE-2025-62737","title":"Image Cleanup <= 1.9.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e3b90c-5af3-4538-95c6-fc8864b51db2?source=api-prod","affected":[{"type":"plugin","slug":"image-cleanup","name":"Image Cleanup","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T15:40:21Z"},{"id":"wordfence:48e62d66-d058-419c-93cf-0cb890177751","source":"wordfence","cve":"CVE-2025-11805","title":"Skip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e62d66-d058-419c-93cf-0cb890177751?source=api-prod","affected":[{"type":"plugin","slug":"skip-to-timestamp","name":"Skip to Timestamp","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:16:59Z","updated":"2025-11-11T03:30:38Z"},{"id":"wordfence:48e7acf2-61d4-4762-8657-0701910ce69b","source":"wordfence","cve":"CVE-2023-3956","title":"InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48e7acf2-61d4-4762-8657-0701910ce69b?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.0.9.18","to_inclusive":true,"patched_in":"0.0.9.19"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48ebb9d6-05d5-4197-8fa4-cc7154c00669","source":"wordfence","cve":"CVE-2026-57794","title":"Golo Framework <= 1.7.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ebb9d6-05d5-4197-8fa4-cc7154c00669?source=api-prod","affected":[{"type":"plugin","slug":"golo-framework","name":"Golo Framework","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:57:17Z"},{"id":"wordfence:48ebeb6a-c585-4ddc-92ab-144f66193991","source":"wordfence","cve":"CVE-2021-46781","title":"Coming Soon by Supsystic <= 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ebeb6a-c585-4ddc-92ab-144f66193991?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-by-supsystic","name":"Maintenance Mode by Supsystic","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48edae16-5e89-4eec-8953-08cbebdd27a7","source":"wordfence","cve":"CVE-2026-83532","title":"Custom Menu Wizard Widget <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48edae16-5e89-4eec-8953-08cbebdd27a7?source=api-prod","affected":[{"type":"plugin","slug":"custom-menu-wizard","name":"Custom Menu Wizard Widget","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:03:52Z"},{"id":"wordfence:48ee0d97-40c1-451f-8a5f-b32ff032e8b0","source":"wordfence","cve":"CVE-2022-0201","title":"Permalink Manager Lite  <= 2.2.14 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ee0d97-40c1-451f-8a5f-b32ff032e8b0?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.2.15","to_inclusive":false,"patched_in":"2.2.15"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48ee5ef5-0fac-496d-b770-91aa846ed5a9","source":"wordfence","cve":"CVE-2025-53566","title":"WP Visitor Statistics (Real Time Traffic) <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ee5ef5-0fac-496d-b770-91aa846ed5a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":"7.9"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:06:28Z"},{"id":"wordfence:48f148ee-800d-4c8f-bf43-893ec7961f3a","source":"wordfence","cve":"","title":"WordCamp Talks < 1.0.0 Beta3 - CSV Injection","severity":"high","cvss":8.0,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f148ee-800d-4c8f-bf43-893ec7961f3a?source=api-prod","affected":[{"type":"plugin","slug":"wordcamp-talks","name":"wordcamp-talks","from":"*","from_inclusive":true,"to":"1.0.0-beta3","to_inclusive":false,"patched_in":"1.0.0-beta3"}],"published":"2017-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48f39d6c-621b-4c78-9459-68bb67a94f57","source":"wordfence","cve":"CVE-2015-9418","title":"WatuPRO < 4.9.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f39d6c-621b-4c78-9459-68bb67a94f57?source=api-prod","affected":[{"type":"plugin","slug":"watupro","name":"WatuPRO","from":"*","from_inclusive":true,"to":"4.9.0.8","to_inclusive":false,"patched_in":"4.9.0.8"}],"published":"2015-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48f42d27-18eb-4606-beb5-c3bfe9f72647","source":"wordfence","cve":"CVE-2025-31740","title":"News, Magazine and Blog Elements <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f42d27-18eb-4606-beb5-c3bfe9f72647?source=api-prod","affected":[{"type":"plugin","slug":"news-magazine-and-blog-elements","name":"News, Magazine and Blog Elements","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-12T14:47:54Z"},{"id":"wordfence:48f5a44d-d01f-4c41-98da-7c1f6c65c254","source":"wordfence","cve":"CVE-2025-14441","title":"Popupkit <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f5a44d-d01f-4c41-98da-7c1f6c65c254?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-01-05T16:05:07Z","updated":"2026-03-27T11:15:36Z"},{"id":"wordfence:48f5aba0-42a0-4b63-8195-29103576a794","source":"wordfence","cve":"CVE-2024-49219","title":"RS-Members <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f5aba0-42a0-4b63-8195-29103576a794?source=api-prod","affected":[{"type":"plugin","slug":"rs-members","name":"RS-Members","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:19:57Z"},{"id":"wordfence:48f69a86-1007-4565-8311-9e542bd4d66b","source":"wordfence","cve":"CVE-2024-29928","title":"Advanced Sermons <= 3.1 - Reflected Cross-Site Scripting via s","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f69a86-1007-4565-8311-9e542bd4d66b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-sermons","name":"Advanced Sermons","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:38:03Z"},{"id":"wordfence:48f7ad3b-608b-4802-b7ab-fad4c449cc62","source":"wordfence","cve":"","title":"SP Projects & Document Manager <= 2.6.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f7ad3b-608b-4802-b7ab-fad4c449cc62?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"2.6.1.3","to_inclusive":true,"patched_in":"2.6.1.4"}],"published":"2016-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:48f9cbcb-b565-4de7-a5df-8dac7a4b7e63","source":"wordfence","cve":"CVE-2026-57665","title":"GravityView <= 3.0.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48f9cbcb-b565-4de7-a5df-8dac7a4b7e63?source=api-prod","affected":[{"type":"plugin","slug":"gravityview","name":"GravityView","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T11:56:24Z"},{"id":"wordfence:48fa5f3b-000b-406e-b7ee-51af5720cf72","source":"wordfence","cve":"CVE-2024-1996","title":"Premium Addons for Elementor PRO <= 2.9.12 -  Authenticated(Contributor+) Stored Cross-Site Scripting via widget link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48fa5f3b-000b-406e-b7ee-51af5720cf72?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-06T00:00:00Z","updated":"2024-05-31T15:30:19Z"},{"id":"wordfence:48fdece5-2996-426f-b77c-ae0b35bcd0ce","source":"wordfence","cve":"CVE-2024-3647","title":"Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48fdece5-2996-426f-b77c-ae0b35bcd0ce?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.28","to_inclusive":true,"patched_in":"4.10.29"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:03Z"},{"id":"wordfence:48fefbd5-d872-4f47-8696-d73fbc9133ed","source":"wordfence","cve":"CVE-2025-13142","title":"Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48fefbd5-d872-4f47-8696-d73fbc9133ed?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type","name":"Custom Post Type","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:22:49Z","updated":"2025-11-21T07:31:53Z"},{"id":"wordfence:48ff572a-f18f-4b8d-ac58-78063919ff35","source":"wordfence","cve":"CVE-2025-12451","title":"Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ff572a-f18f-4b8d-ac58-78063919ff35?source=api-prod","affected":[{"type":"plugin","slug":"easy-svg","name":"Easy SVG Support","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2026-02-18T15:01:37Z","updated":"2026-03-27T11:18:31Z"},{"id":"wordfence:48ffd408-ef7b-4b78-90c3-e1645d7354b1","source":"wordfence","cve":"CVE-2023-5209","title":"WordPress Online Booking and Scheduling Plugin \u2013 Bookly <= 22.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/48ffd408-ef7b-4b78-90c3-e1645d7354b1?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"22.4.1","to_inclusive":true,"patched_in":"22.5"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49005688-fa40-458d-9c96-5ec2ca7adcd3","source":"wordfence","cve":"CVE-2024-11095","title":"Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49005688-fa40-458d-9c96-5ec2ca7adcd3?source=api-prod","affected":[{"type":"plugin","slug":"visualmodo-elements","name":"Visualmodo Elements","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:54:51Z","updated":"2024-12-14T04:23:42Z"},{"id":"wordfence:490061dc-11f7-48f2-bc9a-974bedf16621","source":"wordfence","cve":"CVE-2023-30479","title":"Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490061dc-11f7-48f2-bc9a-974bedf16621?source=api-prod","affected":[{"type":"plugin","slug":"stampedio-product-reviews","name":"Stamped.io Product Reviews & UGC for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49008e63-d369-49b8-9dd7-3dff6dbea17c","source":"wordfence","cve":"CVE-2019-19984","title":"Email Subscribers & Newsletters <= 4.2.2 -  Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49008e63-d369-49b8-9dd7-3dff6dbea17c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49018b4b-2833-4ced-b36a-ebe69c5cb096","source":"wordfence","cve":"CVE-2023-46095","title":"Smooth Scroll Links <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49018b4b-2833-4ced-b36a-ebe69c5cb096?source=api-prod","affected":[{"type":"plugin","slug":"smooth-scrolling-links-ssl","name":"Smooth Scroll Links [SSL]","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49023c6b-a236-42c1-ab24-072fa4a72967","source":"wordfence","cve":"CVE-2025-24701","title":"Chained Quiz <= 1.3.2.9 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49023c6b-a236-42c1-ab24-072fa4a72967?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.9","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:17:32Z"},{"id":"wordfence:4902d71e-77b2-460e-b994-4d07dabf9fff","source":"wordfence","cve":"CVE-2025-69398","title":"Plank <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4902d71e-77b2-460e-b994-4d07dabf9fff?source=api-prod","affected":[{"type":"theme","slug":"plank","name":"Plank - Carpenter, Flooring & Woodworker WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-19T15:42:32Z"},{"id":"wordfence:49053035-5c39-430f-8b4c-b6fae3dcc502","source":"wordfence","cve":"CVE-2026-66645","title":"Table Of Contents Block <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49053035-5c39-430f-8b4c-b6fae3dcc502?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-block","name":"Table Of Contents Block","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-09T16:11:41Z"},{"id":"wordfence:490604c2-9bb5-497c-8c49-ed5ecc8b8cad","source":"wordfence","cve":"CVE-2026-120553","title":"Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490604c2-9bb5-497c-8c49-ed5ecc8b8cad?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.126.0","to_inclusive":true,"patched_in":"5.127.0"}],"published":"2026-11-04T16:08:05Z","updated":"2026-11-05T04:48:06Z"},{"id":"wordfence:490944a6-96e8-4416-a63b-c7a7ba9172ae","source":"wordfence","cve":"CVE-2022-4838","title":"Clean Login <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490944a6-96e8-4416-a63b-c7a7ba9172ae?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":true,"patched_in":"1.13.7"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:490b48e8-bdfa-4843-89df-1f50c05a05b8","source":"wordfence","cve":"CVE-2024-6165","title":"WANotifier \u2013 Send Message Notifications Using WhatsApp API <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490b48e8-bdfa-4843-89df-1f50c05a05b8?source=api-prod","affected":[{"type":"plugin","slug":"notifier","name":"WANotifier for Forms and Actions","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-02T18:37:28Z"},{"id":"wordfence:490b4ee5-dd99-42af-94af-b45cea27b287","source":"wordfence","cve":"CVE-2024-1755","title":"NPS computy <= 2.7.5 - Cross-Site Request Forgery to Results Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490b4ee5-dd99-42af-94af-b45cea27b287?source=api-prod","affected":[{"type":"plugin","slug":"nps-computy","name":"NPS computy","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:35:18Z"},{"id":"wordfence:490dd84f-7c03-43c7-b4e1-167fa2b15c03","source":"wordfence","cve":"CVE-2025-12787","title":"Hydra Booking \u2013 All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation","severity":"medium","cvss":5.3,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490dd84f-7c03-43c7-b4e1-167fa2b15c03?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2025-11-10T22:27:05Z","updated":"2025-11-11T11:03:45Z"},{"id":"wordfence:490f5939-a990-4fb7-9515-f8dcee53d75a","source":"wordfence","cve":"CVE-2015-2792","title":"WPML < 3.1.8 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/490f5939-a990-4fb7-9515-f8dcee53d75a?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":false,"patched_in":"3.1.9.1"}],"published":"2015-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:491240c5-2045-4e0b-9916-4337946d2653","source":"wordfence","cve":"CVE-2021-24684","title":"PDF Light Viewer <= 1.4.11 - Authenticated Command Injection","severity":"critical","cvss":9.9,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/491240c5-2045-4e0b-9916-4337946d2653?source=api-prod","affected":[{"type":"plugin","slug":"pdf-light-viewer","name":"WordPress PDF Light Viewer Plugin","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4913a764-8fe5-4ca1-ba03-27243b1822fe","source":"wordfence","cve":"CVE-2025-64370","title":"YOP Poll <= 6.5.38 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4913a764-8fe5-4ca1-ba03-27243b1822fe?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.5.38","to_inclusive":true,"patched_in":"6.5.39"}],"published":"2025-11-02T00:00:00Z","updated":"2025-11-17T19:13:07Z"},{"id":"wordfence:49150180-9de0-4318-b21b-779daaeb7a52","source":"wordfence","cve":"CVE-2021-4350","title":"Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4915b769-9499-40ac-835e-279e3a910558","source":"wordfence","cve":"CVE-2024-24934","title":"Elementor <= 3.19.0 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4915b769-9499-40ac-835e-279e3a910558?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.19.0","to_inclusive":true,"patched_in":"3.19.1"}],"published":"2024-02-07T00:00:00Z","updated":"2025-04-25T20:35:06Z"},{"id":"wordfence:4917652a-1c83-4570-98c5-1a34e637814e","source":"wordfence","cve":"CVE-2025-8451","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4917652a-1c83-4570-98c5-1a34e637814e?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"6.2.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-15T06:40:42Z"},{"id":"wordfence:4919eb4d-fed8-42b3-8283-7dbf6c1abf12","source":"wordfence","cve":"CVE-2026-24975","title":"Organici Library <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4919eb4d-fed8-42b3-8283-7dbf6c1abf12?source=api-prod","affected":[{"type":"plugin","slug":"noo-organici-library","name":"Organici Library","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:10:16Z"},{"id":"wordfence:491c7680-d270-41ed-a756-9397a0bd86bc","source":"wordfence","cve":"CVE-2026-4730","title":"Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/491c7680-d270-41ed-a756-9397a0bd86bc?source=api-prod","affected":[{"type":"plugin","slug":"charts-ninja-graphs-and-charts","name":"Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:07:54Z","updated":"2026-05-05T02:26:54Z"},{"id":"wordfence:491f44fc-712c-4f67-b5c2-a7396941afc1","source":"wordfence","cve":"CVE-2025-11833","title":"Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/491f44fc-712c-4f67-b5c2-a7396941afc1?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-10-31T14:46:56Z","updated":"2025-11-01T03:34:36Z"},{"id":"wordfence:49209249-11c7-4839-9fa4-423f09008bdc","source":"wordfence","cve":"CVE-2025-47452","title":"WP VR <= 8.5.26 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49209249-11c7-4839-9fa4-423f09008bdc?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.26","to_inclusive":true,"patched_in":"8.5.27"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:42:41Z"},{"id":"wordfence:4921f41a-a9b1-4ae2-a903-c14ed22dcc15","source":"wordfence","cve":"CVE-2024-10516","title":"Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4921f41a-a9b1-4ae2-a903-c14ed22dcc15?source=api-prod","affected":[{"type":"plugin","slug":"swift-performance-lite","name":"Swift Performance Lite","from":"*","from_inclusive":true,"to":"2.3.7.1","to_inclusive":true,"patched_in":"2.3.7.2"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T13:45:21Z"},{"id":"wordfence:4922c989-efb9-4148-8621-69c3755ea8d5","source":"wordfence","cve":"CVE-2026-57666","title":"WP Customer Area <= 8.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4922c989-efb9-4148-8621-69c3755ea8d5?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:21Z"},{"id":"wordfence:49275353-4f8a-4110-aaa1-1c7612fa3ce5","source":"wordfence","cve":"CVE-2026-65456","title":"Product Slider, Product Grid, Product Masonry <= 1.13.62 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49275353-4f8a-4110-aaa1-1c7612fa3ce5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-slider","name":"Product Slider, Product Grid, Product Masonry","from":"*","from_inclusive":true,"to":"1.13.62","to_inclusive":true,"patched_in":"1.13.63"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:24:22Z"},{"id":"wordfence:4927c060-f2b2-4916-b049-1442bba63e98","source":"wordfence","cve":"CVE-2026-0942","title":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=api-prod","affected":[{"type":"plugin","slug":"woo-rede","name":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2026-01-15T18:31:18Z","updated":"2026-01-29T16:33:47Z"},{"id":"wordfence:492a2a6f-78e9-4401-a0a7-b7c1c8349efa","source":"wordfence","cve":"CVE-2025-68573","title":"Simple Keyword to Link <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/492a2a6f-78e9-4401-a0a7-b7c1c8349efa?source=api-prod","affected":[{"type":"plugin","slug":"simple-keyword-to-link","name":"Simple Keyword to Link","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-05T18:52:55Z"},{"id":"wordfence:492ce5d0-02b5-4b11-a4a0-ca1a6438faad","source":"wordfence","cve":"CVE-2025-47603","title":"belingoGeo <= 1.12.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/492ce5d0-02b5-4b11-a4a0-ca1a6438faad?source=api-prod","affected":[{"type":"plugin","slug":"belingogeo","name":"belingoGeo","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2025-05-09T00:00:00Z","updated":"2025-07-24T19:06:31Z"},{"id":"wordfence:492daa1b-e508-40a0-ad4f-1f1d6469d68f","source":"wordfence","cve":"CVE-2026-73396","title":"MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/492daa1b-e508-40a0-ad4f-1f1d6469d68f?source=api-prod","affected":[{"type":"plugin","slug":"makewebbetter-hubspot-for-woocommerce","name":"MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-09T16:11:50Z"},{"id":"wordfence:49333c6b-58f6-4d5a-a605-46484160175a","source":"wordfence","cve":"CVE-2022-4218","title":"Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49333c6b-58f6-4d5a-a605-46484160175a?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.4","to_inclusive":true,"patched_in":"1.3.2.5"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:493634c1-3b55-42bd-94ed-91d5d576bf36","source":"wordfence","cve":"CVE-2026-119365","title":"Media Player Addons for Elementor \u2013 Audio and Video Widgets for Elementor <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/493634c1-3b55-42bd-94ed-91d5d576bf36?source=api-prod","affected":[{"type":"plugin","slug":"media-player-addons-for-elementor","name":"Media Player Addons for Elementor \u2013 Audio and Video Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2026-10-30T16:10:00Z","updated":"2026-11-03T19:49:37Z"},{"id":"wordfence:49364a21-775a-4de0-84f8-e62aa1a5fefd","source":"wordfence","cve":"CVE-2025-14462","title":"Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49364a21-775a-4de0-84f8-e62aa1a5fefd?source=api-prod","affected":[{"type":"plugin","slug":"lucky-draw","name":"Lucky Draw Contests","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:09:25Z","updated":"2025-12-13T04:31:24Z"},{"id":"wordfence:4938206e-2ea4-47ed-a307-87cf67dd74a4","source":"wordfence","cve":"CVE-2023-2735","title":"Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4938206e-2ea4-47ed-a307-87cf67dd74a4?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4938c1be-2356-4a9c-9795-108a2d5a6cc7","source":"wordfence","cve":"CVE-2023-46629","title":"Remove Add to Cart WooCommerce <= 1.4.4 - Cross-Site Request Forgery to Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4938c1be-2356-4a9c-9795-108a2d5a6cc7?source=api-prod","affected":[{"type":"plugin","slug":"remove-add-to-cart-woocommerce","name":"Remove Add to Cart WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-10-25T00:00:00Z","updated":"2024-03-14T14:52:15Z"},{"id":"wordfence:4939b053-2d62-428e-84ff-0de3416466ef","source":"wordfence","cve":"CVE-2022-1010","title":"Login using WordPress Users (WP as SAML IDP) <= 1.13.2 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4939b053-2d62-428e-84ff-0de3416466ef?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-wp-as-saml-idp","name":"SAML IDP (Identity Provider) \u2013 Login with Website Users","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:493ac933-f2b3-487b-8fc7-af2df9b0d460","source":"wordfence","cve":"CVE-2026-87111","title":"User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/493ac933-f2b3-487b-8fc7-af2df9b0d460?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-pro","name":"User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-10-15T19:40:05Z","updated":"2026-10-16T07:44:02Z"},{"id":"wordfence:49405ba1-b0fd-429b-a30a-95c8d3f26545","source":"wordfence","cve":"CVE-2026-1946","title":"GW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49405ba1-b0fd-429b-a30a-95c8d3f26545?source=api-prod","affected":[{"type":"plugin","slug":"gw-ai-website-builder","name":"GW AI Website Builder","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-07-09T19:33:32Z","updated":"2026-07-10T07:48:42Z"},{"id":"wordfence:494168ab-83d1-4a26-a61d-a02509147890","source":"wordfence","cve":"CVE-2026-57395","title":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494168ab-83d1-4a26-a61d-a02509147890?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.22.5","to_inclusive":true,"patched_in":"2.22.6"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:45:05Z"},{"id":"wordfence:4941a0ce-67f1-430d-bbad-3c97a4ed449e","source":"wordfence","cve":"CVE-2025-12528","title":"Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4941a0ce-67f1-430d-bbad-3c97a4ed449e?source=api-prod","affected":[{"type":"plugin","slug":"pie-forms-for-wp","name":"Pie Forms \u2014 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:08:34Z","updated":"2026-09-09T16:33:27Z"},{"id":"wordfence:4942de17-d141-4a6c-885e-75f540fe21b6","source":"wordfence","cve":"CVE-2023-44475","title":"Add Shortcodes Actions And Filters <= 2.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4942de17-d141-4a6c-885e-75f540fe21b6?source=api-prod","affected":[{"type":"plugin","slug":"add-actions-and-filters","name":"Add Shortcodes Actions And Filters","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.10"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49438dc5-3728-4aa0-a7b0-ed6dd26fa094","source":"wordfence","cve":"CVE-2025-68911","title":"Solace <= 2.1.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49438dc5-3728-4aa0-a7b0-ed6dd26fa094?source=api-prod","affected":[{"type":"theme","slug":"solace","name":"Solace","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.1.17"}],"published":"2026-01-13T00:00:00Z","updated":"2026-05-11T19:41:10Z"},{"id":"wordfence:4945931f-764d-45cf-9157-5dddfb264086","source":"wordfence","cve":"CVE-2024-31385","title":"ReDi Restaurant Reservation <= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4945931f-764d-45cf-9157-5dddfb264086?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.0128","to_inclusive":true,"patched_in":"24.0303"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:16:06Z"},{"id":"wordfence:49460db5-a0cd-4b29-85f2-8ededabf5599","source":"wordfence","cve":"CVE-2024-8985","title":"Social Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49460db5-a0cd-4b29-85f2-8ededabf5599?source=api-prod","affected":[{"type":"plugin","slug":"social-proof-testimonials-slider","name":"Social Proof (Testimonial) Slider","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T13:21:23Z","updated":"2024-11-13T02:02:30Z"},{"id":"wordfence:49462bd9-ca61-4f43-9f29-4fa8773d14ef","source":"wordfence","cve":"CVE-2026-84935","title":"HT Menu \u2013 WordPress Mega Menu Builder for Elementor < 1.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49462bd9-ca61-4f43-9f29-4fa8773d14ef?source=api-prod","affected":[{"type":"plugin","slug":"ht-menu-lite","name":"HT Menu \u2013 WordPress Mega Menu Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:16:22Z"},{"id":"wordfence:494c2abb-e675-4e3d-9784-8f70004a97f7","source":"wordfence","cve":"CVE-2026-59535","title":"Thrive Themes \u2013 Product Manager <= 10.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494c2abb-e675-4e3d-9784-8f70004a97f7?source=api-prod","affected":[{"type":"plugin","slug":"thrive-product-manager","name":"Thrive Themes \u2013 Product Manager","from":"*","from_inclusive":true,"to":"10.9.2","to_inclusive":true,"patched_in":"10.9.2.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:38:26Z"},{"id":"wordfence:494c780d-5441-407d-8947-e56d7cac32d6","source":"wordfence","cve":"CVE-2022-47614","title":"MStore API <= 3.9.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494c780d-5441-407d-8947-e56d7cac32d6?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:494c8d80-61e0-4396-93ed-5f9b4d0bf66d","source":"wordfence","cve":"CVE-2026-24565","title":"B Accordion <= 2.0.2 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494c8d80-61e0-4396-93ed-5f9b4d0bf66d?source=api-prod","affected":[{"type":"plugin","slug":"b-accordion","name":"Accordion \u2013 Organize Content into Clean Collapsible Sections","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-01-21T00:00:00Z","updated":"2026-04-14T14:15:05Z"},{"id":"wordfence:494d2e69-0759-419a-a603-e8870c157e49","source":"wordfence","cve":"CVE-2024-7888","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494d2e69-0759-419a-a603-e8870c157e49?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2024-09-12T18:35:01Z","updated":"2024-09-13T06:47:28Z"},{"id":"wordfence:494dc869-6f4d-428b-99a8-87212f3007be","source":"wordfence","cve":"CVE-2024-8629","title":"WooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494dc869-6f4d-428b-99a8-87212f3007be?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T09:33:13Z"},{"id":"wordfence:494ef738-c900-4d00-8739-3b261586d4ff","source":"wordfence","cve":"CVE-2024-9931","title":"Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494ef738-c900-4d00-8739-3b261586d4ff?source=api-prod","affected":[{"type":"plugin","slug":"wux-blog-editor","name":"Wux Blog Editor","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T01:58:34Z"},{"id":"wordfence:494f5c9f-ef5b-48d8-8f3a-27e5ed4bea5e","source":"wordfence","cve":"CVE-2024-13512","title":"Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/494f5c9f-ef5b-48d8-8f3a-27e5ed4bea5e?source=api-prod","affected":[{"type":"plugin","slug":"wonder-fontawesome","name":"Wonder FontAwesome","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:45:54Z","updated":"2025-01-30T13:41:56Z"},{"id":"wordfence:4950cee1-bdf4-44f6-9ca4-94454c781678","source":"wordfence","cve":"CVE-2026-95594","title":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4950cee1-bdf4-44f6-9ca4-94454c781678?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-05T11:21:35Z","updated":"2026-10-09T00:08:59Z"},{"id":"wordfence:495183b6-dc7c-4ff7-bc99-fc05a10d1269","source":"wordfence","cve":"CVE-2024-13758","title":"CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/495183b6-dc7c-4ff7-bc99-fc05a10d1269?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.52","to_inclusive":true,"patched_in":"1.3.53"}],"published":"2025-01-29T19:50:11Z","updated":"2025-01-30T08:21:27Z"},{"id":"wordfence:4953e1b6-6ad1-41f5-b50b-43de078008ac","source":"wordfence","cve":"CVE-2023-1323","title":"Easy Forms for Mailchimp <= 6.8.8 - Authenticated (Administrator+) Cross-Site Scripting via Form Name","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4953e1b6-6ad1-41f5-b50b-43de078008ac?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.8.9"}],"published":"2023-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4956eb18-92b8-4ba3-89a8-71edf08dc502","source":"wordfence","cve":"CVE-2025-47507","title":"Better Search <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4956eb18-92b8-4ba3-89a8-71edf08dc502?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:02:12Z"},{"id":"wordfence:495804c2-1870-4d64-9a5a-166b01ed7b0e","source":"wordfence","cve":"CVE-2026-57708","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/495804c2-1870-4d64-9a5a-166b01ed7b0e?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:33:42Z"},{"id":"wordfence:49581614-14a8-4450-8f83-d8d22a3feee9","source":"wordfence","cve":"CVE-2024-8267","title":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49581614-14a8-4450-8f83-d8d22a3feee9?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.78","to_inclusive":true,"patched_in":"2.0.79"}],"published":"2024-09-23T18:28:51Z","updated":"2024-09-24T06:40:57Z"},{"id":"wordfence:49589caf-232b-4067-a607-2902e932553e","source":"wordfence","cve":"CVE-2024-54245","title":"Clients <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49589caf-232b-4067-a607-2902e932553e?source=api-prod","affected":[{"type":"plugin","slug":"clients","name":"Clients","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-18T16:02:51Z"},{"id":"wordfence:495df695-864e-4a77-bcd1-d1845c55a6c9","source":"wordfence","cve":"CVE-2023-29385","title":"WP Abstracts <= 2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/495df695-864e-4a77-bcd1-d1845c55a6c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:496119d8-6908-44ce-951e-ece45500113b","source":"wordfence","cve":"CVE-2025-64239","title":"RTL Tester <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/496119d8-6908-44ce-951e-ece45500113b?source=api-prod","affected":[{"type":"plugin","slug":"rtl-tester","name":"RTL Tester","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T16:47:14Z"},{"id":"wordfence:49618d9f-e6d8-40d5-b19f-7ce987939172","source":"wordfence","cve":"CVE-2024-8799","title":"Custom Banners <= 3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49618d9f-e6d8-40d5-b19f-7ce987939172?source=api-prod","affected":[{"type":"plugin","slug":"custom-banners","name":"Custom Banners","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:41:04Z","updated":"2024-10-01T08:30:14Z"},{"id":"wordfence:496249cf-f75e-42e6-a189-332dd73d14bd","source":"wordfence","cve":"CVE-2021-24801","title":"WP Survey Plus <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/496249cf-f75e-42e6-a189-332dd73d14bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-plus","name":"WP Survey Plus","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4963053a-e63a-4e7b-bb72-f3defd0f16a6","source":"wordfence","cve":"CVE-2025-67615","title":"Myour <= 1.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4963053a-e63a-4e7b-bb72-f3defd0f16a6?source=api-prod","affected":[{"type":"theme","slug":"myour","name":"Myour - Personal Portfolio Resume WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:35:31Z"},{"id":"wordfence:49664262-ad86-426e-8f66-9ada61a25bd7","source":"wordfence","cve":"CVE-2026-84219","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49664262-ad86-426e-8f66-9ada61a25bd7?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.2.1","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-09T13:16:05Z"},{"id":"wordfence:49690143-93c9-4d54-b98c-6f874f818175","source":"wordfence","cve":"CVE-2026-28131","title":"Elementor Addon Elements <= 1.14.4 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49690143-93c9-4d54-b98c-6f874f818175?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.14.4","to_inclusive":true,"patched_in":"1.14.5"}],"published":"2025-08-28T00:00:00Z","updated":"2026-05-05T13:47:57Z"},{"id":"wordfence:496b1c3a-7fbb-4088-9936-6b023718946d","source":"wordfence","cve":"CVE-2023-6360","title":"My Calendar <= 3.4.21 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/496b1c3a-7fbb-4088-9936-6b023718946d?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.4.21","to_inclusive":true,"patched_in":"3.4.22"}],"published":"2023-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4970be62-9aad-4a5f-9dd3-4bf48bded022","source":"wordfence","cve":"CVE-2023-2111","title":"HollerBox <= 2.1.3 - Authenticated (edit_popups+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4970be62-9aad-4a5f-9dd3-4bf48bded022?source=api-prod","affected":[{"type":"plugin","slug":"holler-box","name":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49711408-5d04-4fdd-a6c4-b224959ba1bc","source":"wordfence","cve":"CVE-2025-14475","title":"Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bc?source=api-prod","affected":[{"type":"plugin","slug":"extensive-vc-addon","name":"Extensive VC Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:05:09Z","updated":"2025-12-13T04:31:25Z"},{"id":"wordfence:4973cef3-dddf-4eb5-99f4-c23a0e162fd6","source":"wordfence","cve":"CVE-2026-0845","title":"WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4973cef3-dddf-4eb5-99f4-c23a0e162fd6?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.24","to_inclusive":true,"patched_in":"6.7.25"}],"published":"2026-02-09T11:20:25Z","updated":"2026-02-09T23:23:27Z"},{"id":"wordfence:49754f41-b809-4a97-ab8f-233f51dc058f","source":"wordfence","cve":"CVE-2015-9395","title":"Users Ultra Membership Plugin <= 1.5.63 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49754f41-b809-4a97-ab8f-233f51dc058f?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.64","to_inclusive":false,"patched_in":"1.5.64"}],"published":"2015-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:497760a8-7d4a-45a0-91e4-a8ee27bcdb02","source":"wordfence","cve":"CVE-2024-10520","title":"WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.14","to_inclusive":true,"patched_in":"2.6.15"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T11:33:10Z"},{"id":"wordfence:4978261d-0ec8-42de-af50-f02032689595","source":"wordfence","cve":"CVE-2026-19430","title":"Catfolders Document Gallery Pro < 2.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4978261d-0ec8-42de-af50-f02032689595?source=api-prod","affected":[{"type":"plugin","slug":"catfolders-document-gallery-pro","name":"Catfolders Document Gallery Pro","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-02T13:42:57Z"},{"id":"wordfence:497960b4-48f3-4a5d-8b69-586da61761f0","source":"wordfence","cve":"CVE-2024-37412","title":"Blossom Shop <= 1.1.7 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497960b4-48f3-4a5d-8b69-586da61761f0?source=api-prod","affected":[{"type":"theme","slug":"blossom-shop","name":"Blossom Shop","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:45:41Z"},{"id":"wordfence:497b51f5-fb0a-4fd4-a545-cece9ec80a94","source":"wordfence","cve":"CVE-2025-52819","title":"Pakke Env\u00edos <= 1.0.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497b51f5-fb0a-4fd4-a545-cece9ec80a94?source=api-prod","affected":[{"type":"plugin","slug":"pakke","name":"Pakke Env\u00edos","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:50:01Z"},{"id":"wordfence:497c2f5f-ed7d-486e-baf2-aefbe3dc412f","source":"wordfence","cve":"CVE-2026-3369","title":"Better Find and Replace \u2013 AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497c2f5f-ed7d-486e-baf2-aefbe3dc412f?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-04-15T22:04:39Z","updated":"2026-04-16T11:21:23Z"},{"id":"wordfence:497cfc87-85ac-41d0-aeea-63c5fc64db0d","source":"wordfence","cve":"CVE-2022-2557","title":"Team - WordPress Team Member Showcase Plugin <= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497cfc87-85ac-41d0-aeea-63c5fc64db0d?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2022-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:497e0784-8953-4726-929a-7d5ef129e98e","source":"wordfence","cve":"CVE-2024-22310","title":"Formzu WP <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497e0784-8953-4726-929a-7d5ef129e98e?source=api-prod","affected":[{"type":"plugin","slug":"formzu-wp","name":"Formzu WP","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:55:04Z"},{"id":"wordfence:497fc688-19a0-4522-a268-2bba12a4fa08","source":"wordfence","cve":"CVE-2026-103305","title":"Prenotazioni <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/497fc688-19a0-4522-a268-2bba12a4fa08?source=api-prod","affected":[{"type":"plugin","slug":"prenotazioni","name":"Prenotazioni","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:34:47Z"},{"id":"wordfence:498087da-3887-475a-9796-676ee1d1fb99","source":"wordfence","cve":"CVE-2021-24524","title":"GiveWP <= 2.11.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/498087da-3887-475a-9796-676ee1d1fb99?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49816cc8-fc97-4ba2-88b6-3fe6f7bf562e","source":"wordfence","cve":"CVE-2026-57629","title":"StatCounter \u2013 Free Real Time Visitor Stats <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49816cc8-fc97-4ba2-88b6-3fe6f7bf562e?source=api-prod","affected":[{"type":"plugin","slug":"official-statcounter-plugin-for-wordpress","name":"StatCounter \u2013 Real Time Visitor Stats, Session Replay & Heatmaps","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:39:53Z"},{"id":"wordfence:4985680e-f7ba-40c7-bca9-f347f1c1cb3b","source":"wordfence","cve":"CVE-2024-9156","title":"TI WooCommerce Wishlist <= 2.9.0 - Unauthenticated SQL Injection via 'lang'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4985680e-f7ba-40c7-bca9-f347f1c1cb3b?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2024-09-19T00:00:00Z","updated":"2024-10-24T16:37:16Z"},{"id":"wordfence:4985f24e-b80f-4b11-94bf-e59311a3d8eb","source":"wordfence","cve":"CVE-2026-109899","title":"Melapress Role Editor <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4985f24e-b80f-4b11-94bf-e59311a3d8eb?source=api-prod","affected":[{"type":"plugin","slug":"melapress-role-editor","name":"Melapress Role Editor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-11-06T15:26:07Z","updated":"2026-11-10T19:12:32Z"},{"id":"wordfence:49873fe6-9458-439b-9b7d-e69be07c7e10","source":"wordfence","cve":"CVE-2026-118097","title":"HTML5 Video Player \u2013 embed fast, responsive videos with ease <= 2.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49873fe6-9458-439b-9b7d-e69be07c7e10?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.14.1"}],"published":"2026-10-29T14:38:00Z","updated":"2026-11-03T19:46:33Z"},{"id":"wordfence:4987b1b1-0356-4bc0-a4d5-b9a07830c0d4","source":"wordfence","cve":"CVE-2026-66474","title":"Insert Headers and Footers Code \u2013 HT Script <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4987b1b1-0356-4bc0-a4d5-b9a07830c0d4?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers-script","name":"Insert Headers and Footers Code \u2013 HT Script","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-17T03:39:29Z"},{"id":"wordfence:4989a3b1-eb76-42b1-b84e-6c4553aedb89","source":"wordfence","cve":"CVE-2025-31436","title":"Blubrry PowerPress Podcasting plugin MultiSite add-on <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4989a3b1-eb76-42b1-b84e-6c4553aedb89?source=api-prod","affected":[{"type":"plugin","slug":"powerpress-multisite","name":"Blubrry PowerPress Podcasting plugin MultiSite add-on","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T14:08:40Z"},{"id":"wordfence:498a10a1-8da6-4309-833f-950f6442d5ae","source":"wordfence","cve":"CVE-2023-41661","title":"Smarty for WordPress <= 3.1.35 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/498a10a1-8da6-4309-833f-950f6442d5ae?source=api-prod","affected":[{"type":"plugin","slug":"smarty-for-wordpress","name":"Smarty for WordPress","from":"*","from_inclusive":true,"to":"3.1.35","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:498c0080-ae5e-492b-b75f-6ce3227f3ca0","source":"wordfence","cve":"","title":"Paytium <= 3.1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/498c0080-ae5e-492b-b75f-6ce3227f3ca0?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2020-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:498f539a-f824-42fb-9df8-c1f82c4b3947","source":"wordfence","cve":"CVE-2017-15811","title":"pootle button <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/498f539a-f824-42fb-9df8-c1f82c4b3947?source=api-prod","affected":[{"type":"plugin","slug":"pootle-button","name":"pootle button","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2017-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:498f7ece-e33a-4489-aeb9-1660abe0b4a5","source":"wordfence","cve":"","title":"Awake <= 3.3 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/498f7ece-e33a-4489-aeb9-1660abe0b4a5?source=api-prod","affected":[{"type":"theme","slug":"awake","name":"Awake","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:499059b9-44c0-40da-bc45-5280ea84f016","source":"wordfence","cve":"CVE-2025-49308","title":"WP Travel Engine <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/499059b9-44c0-40da-bc45-5280ea84f016?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T14:10:07Z"},{"id":"wordfence:4990bb50-f9b4-46a4-adb5-a60502cece29","source":"wordfence","cve":"CVE-2025-58206","title":"MaxCoach <= 3.2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4990bb50-f9b4-46a4-adb5-a60502cece29?source=api-prod","affected":[{"type":"theme","slug":"maxcoach","name":"MaxCoach","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-08-14T00:00:00Z","updated":"2025-09-25T20:46:47Z"},{"id":"wordfence:4990cff5-e0fc-4550-8e0a-347f2c275f8d","source":"wordfence","cve":"CVE-2026-48194","title":"Duka Market - Multipurpose eCommerce Template <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4990cff5-e0fc-4550-8e0a-347f2c275f8d?source=api-prod","affected":[{"type":"theme","slug":"dukamarket","name":"Duka Market - Multipurpose eCommerce Template","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T13:35:33Z","updated":"2026-10-13T13:53:12Z"},{"id":"wordfence:49945253-b631-47b2-9cbd-42c9effc60f4","source":"wordfence","cve":"CVE-2025-67550","title":"Donation Thermometer <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49945253-b631-47b2-9cbd-42c9effc60f4?source=api-prod","affected":[{"type":"plugin","slug":"donation-thermometer","name":"Donation Thermometer","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-10T16:08:03Z"},{"id":"wordfence:499483a0-957b-459e-b2f5-fc39c4f86c9e","source":"wordfence","cve":"CVE-2021-24961","title":"WordPress File Upload <= 4.16.2 - Authenticated Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/499483a0-957b-459e-b2f5-fc39c4f86c9e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":false,"patched_in":"4.16.3"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49954c72-df0d-46ec-a252-8af84dea41bf","source":"wordfence","cve":"CVE-2026-11981","title":"GiveWP <= 4.15.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49954c72-df0d-46ec-a252-8af84dea41bf?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.15.3","to_inclusive":true,"patched_in":"4.15.4"}],"published":"2026-06-30T16:29:51Z","updated":"2026-07-01T04:32:26Z"},{"id":"wordfence:49958e9e-7f9b-48fb-bfe2-5b1b437171d6","source":"wordfence","cve":"CVE-2024-11866","title":"BMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49958e9e-7f9b-48fb-bfe2-5b1b437171d6?source=api-prod","affected":[{"type":"plugin","slug":"bmlt-tabbed-map","name":"BMLT Tabbed Map","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T08:32:28Z"},{"id":"wordfence:4999bbf3-3dbd-4c9a-b648-744192c9586c","source":"wordfence","cve":"CVE-2024-7100","title":"Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4999bbf3-3dbd-4c9a-b648-744192c9586c?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2024-07-29T17:49:56Z","updated":"2024-07-30T06:48:47Z"},{"id":"wordfence:499a1892-12b7-49d5-b65f-4f53a968a23a","source":"wordfence","cve":"CVE-2024-1596","title":"Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/499a1892-12b7-49d5-b65f-4f53a968a23a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.16","to_inclusive":true,"patched_in":"3.3.18"}],"published":"2024-09-06T00:00:00Z","updated":"2024-09-07T11:17:04Z"},{"id":"wordfence:499a43c3-d76e-454a-b882-8e0ff7eaf72d","source":"wordfence","cve":"CVE-2026-18231","title":"WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/499a43c3-d76e-454a-b882-8e0ff7eaf72d?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:14:53Z"},{"id":"wordfence:499e88e9-d915-46a7-84c9-b4099c091105","source":"wordfence","cve":"CVE-2024-8701","title":"Event Calendar <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/499e88e9-d915-46a7-84c9-b4099c091105?source=api-prod","affected":[{"type":"plugin","slug":"event-calendars","name":"Event Calendar","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-10T00:00:00Z","updated":"2025-05-30T18:37:29Z"},{"id":"wordfence:49a04155-9fa8-45e0-b80b-3836d5271fa7","source":"wordfence","cve":"CVE-2020-36746","title":"Menu Swapper <= 1.1.0.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a04155-9fa8-45e0-b80b-3836d5271fa7?source=api-prod","affected":[{"type":"plugin","slug":"menu-swapper","name":"Menu Swapper","from":"*","from_inclusive":true,"to":"1.1.0.2","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49a0c45e-781e-4d2e-a9e8-a54ff8ef6131","source":"wordfence","cve":"CVE-2021-36912","title":"Andrea Pernici News Sitemap for Google <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a0c45e-781e-4d2e-a9e8-a54ff8ef6131?source=api-prod","affected":[{"type":"plugin","slug":"google-news-sitemap","name":"Andrea Pernici News Sitemap for Google","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2022-05-04T10:07:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49a0e79c-b8cd-4ad4-8e59-615ffab5d355","source":"wordfence","cve":"CVE-2025-23446","title":"WP SpaceContent <= 0.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a0e79c-b8cd-4ad4-8e59-615ffab5d355?source=api-prod","affected":[{"type":"plugin","slug":"wp-spacecontent","name":"WP SpaceContent","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:41:22Z"},{"id":"wordfence:49a265c1-8760-48b3-8c91-2d822b2e97ce","source":"wordfence","cve":"CVE-2026-73364","title":"Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a265c1-8760-48b3-8c91-2d822b2e97ce?source=api-prod","affected":[{"type":"plugin","slug":"flexible-subscriptions","name":"Flexible Subscriptions","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:13:25Z"},{"id":"wordfence:49a33b67-4872-4406-be1c-7c60ea79698b","source":"wordfence","cve":"CVE-2025-28950","title":"Post Author <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a33b67-4872-4406-be1c-7c60ea79698b?source=api-prod","affected":[{"type":"plugin","slug":"post-author","name":"Post Author","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:21:09Z"},{"id":"wordfence:49a34919-94bc-4369-a0c1-e34d7563116d","source":"wordfence","cve":"CVE-2026-74001","title":"User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 5.4.5 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a34919-94bc-4369-a0c1-e34d7563116d?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-pro","name":"User Registration PRO \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:20:17Z"},{"id":"wordfence:49a935cc-7b95-4abd-9a4d-c7e14c765863","source":"wordfence","cve":"CVE-2025-9990","title":"WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=api-prod","affected":[{"type":"plugin","slug":"wp-helpdesk-integration","name":"WordPress Helpdesk Integration","from":"*","from_inclusive":true,"to":"5.8.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T14:13:08Z","updated":"2026-03-13T05:45:02Z"},{"id":"wordfence:49a9ade1-fca7-48c1-bb87-75fc3528e234","source":"wordfence","cve":"CVE-2024-9708","title":"Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49a9ade1-fca7-48c1-bb87-75fc3528e234?source=api-prod","affected":[{"type":"plugin","slug":"easy-svg-upload","name":"Easy SVG Upload","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-10-30T14:05:35Z","updated":"2025-10-10T20:47:24Z"},{"id":"wordfence:49ac9c7c-d457-4709-bc10-c3de8b4f097a","source":"wordfence","cve":"CVE-2015-9439","title":"AddThis Sharing Buttons <= 5.0.12 - Authenticated Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ac9c7c-d457-4709-bc10-c3de8b4f097a?source=api-prod","affected":[{"type":"plugin","slug":"addthis","name":"WordPress Share Buttons Plugin \u2013 AddThis","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":false,"patched_in":"5.0.13"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49ad558f-57a5-4055-a0fc-3a991dbe2b8c","source":"wordfence","cve":"CVE-2025-23473","title":"Killer Theme Options <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ad558f-57a5-4055-a0fc-3a991dbe2b8c?source=api-prod","affected":[{"type":"plugin","slug":"killer-theme-options","name":"Killer Theme Options","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:47:59Z"},{"id":"wordfence:49ae7971-7bdf-4369-b04b-fb48ea5b9518","source":"wordfence","cve":"CVE-2024-6220","title":"\u7b80\u6570\u91c7\u96c6\u5668 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ae7971-7bdf-4369-b04b-fb48ea5b9518?source=api-prod","affected":[{"type":"plugin","slug":"keydatas","name":"\u7b80\u6570\u91c7\u96c6\u5668","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-07-16T19:27:17Z","updated":"2024-07-30T16:07:07Z"},{"id":"wordfence:49afa739-83f0-4ad7-9e5e-d600f293b938","source":"wordfence","cve":"CVE-2026-9239","title":"Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49afa739-83f0-4ad7-9e5e-d600f293b938?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-10-30T17:09:57Z","updated":"2026-10-30T17:15:26Z"},{"id":"wordfence:49afcc74-2d30-4023-a98a-e7c7c5be228d","source":"wordfence","cve":"CVE-2021-47983","title":"Accept Stripe Payments <= 2.0.39 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49afcc74-2d30-4023-a98a-e7c7c5be228d?source=api-prod","affected":[{"type":"plugin","slug":"Accept-Stripe-Payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.40"}],"published":"2026-06-07T00:00:00Z","updated":"2026-08-28T18:28:43Z"},{"id":"wordfence:49b296a5-8721-4835-b2c1-ab45045be595","source":"wordfence","cve":"CVE-2019-17386","title":"Animate It <= 2.3.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b296a5-8721-4835-b2c1-ab45045be595?source=api-prod","affected":[{"type":"plugin","slug":"animate-it","name":"Animate It!","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49b2e332-4359-4dac-8a9e-1d71f39d509c","source":"wordfence","cve":"CVE-2024-4616","title":"Widget Bundle <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b2e332-4359-4dac-8a9e-1d71f39d509c?source=api-prod","affected":[{"type":"plugin","slug":"wp-widget-bundle","name":"Widget Bundle","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T15:58:34Z"},{"id":"wordfence:49b36cde-39d8-4a69-8d7c-7b850b76a7cd","source":"wordfence","cve":"CVE-2025-2011","title":"Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b36cde-39d8-4a69-8d7c-7b850b76a7cd?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2025-05-05T20:26:33Z","updated":"2025-05-06T09:21:50Z"},{"id":"wordfence:49b464ae-538e-4d12-a125-23e75e075b32","source":"wordfence","cve":"CVE-2025-58899","title":"Frame <= 2.4.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b464ae-538e-4d12-a125-23e75e075b32?source=api-prod","affected":[{"type":"theme","slug":"frame","name":"frame","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:31:00Z"},{"id":"wordfence:49b466a2-9f6d-431f-8118-7522394d2eed","source":"wordfence","cve":"","title":"GroupDocs.Comparison for Cloud < 1.0.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b466a2-9f6d-431f-8118-7522394d2eed?source=api-prod","affected":[{"type":"plugin","slug":"groupdocs-comparison","name":"GroupDocs.Comparison for Cloud","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2013-12-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49b76f5f-03f7-48bc-b848-9ab55d875639","source":"wordfence","cve":"CVE-2025-0839","title":"ZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b76f5f-03f7-48bc-b848-9ab55d875639?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-05T05:32:15Z"},{"id":"wordfence:49b88ea8-90da-40a7-8bf0-8346b136bb9f","source":"wordfence","cve":"CVE-2026-108695","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49b88ea8-90da-40a7-8bf0-8346b136bb9f?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":""}],"published":"2026-10-10T00:00:00Z","updated":"2026-10-14T05:04:08Z"},{"id":"wordfence:49ba5cfa-c2cc-49ac-b22d-7e36ccca6ac5","source":"wordfence","cve":"CVE-2023-1923","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ba5cfa-c2cc-49ac-b22d-7e36ccca6ac5?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49bd0848-afc0-4aa2-86a4-1b697206b925","source":"wordfence","cve":"CVE-2024-12772","title":"Ninja Tables \u2013 Easy Data Table <= 5.0.16 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49bd0848-afc0-4aa2-86a4-1b697206b925?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.16","to_inclusive":true,"patched_in":"5.0.17"}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:42:51Z"},{"id":"wordfence:49bdd84a-05c0-4c7c-9d12-8a8eec91908d","source":"wordfence","cve":"","title":"Network Publisher <= 5.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49bdd84a-05c0-4c7c-9d12-8a8eec91908d?source=api-prod","affected":[{"type":"plugin","slug":"network-publisher","name":"Network Publisher","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.1"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49c237aa-a407-4824-b550-0b109868b332","source":"wordfence","cve":"CVE-2026-97243","title":"AllAble Connector <= 0.13.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c237aa-a407-4824-b550-0b109868b332?source=api-prod","affected":[{"type":"plugin","slug":"allable-connector","name":"AllAble Connector","from":"*","from_inclusive":true,"to":"0.13.4","to_inclusive":true,"patched_in":"0.13.6"}],"published":"2026-09-29T10:50:00Z","updated":"2026-10-08T23:57:17Z"},{"id":"wordfence:49c3be3f-60b3-4b83-9683-a08e8e1cf9e9","source":"wordfence","cve":"CVE-2026-82222","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.7.1 - Unauthenticated PHP Object Injection to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c3be3f-60b3-4b83-9683-a08e8e1cf9e9?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.7.1","to_inclusive":true,"patched_in":"4.16.7.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-08-28T16:55:47Z"},{"id":"wordfence:49c65776-130d-4c22-b4f8-ababac8cf341","source":"wordfence","cve":"CVE-2023-25023","title":"WebinarIgnition <= 2.14.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c65776-130d-4c22-b4f8-ababac8cf341?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"2.14.2","to_inclusive":true,"patched_in":"2.14.3"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49c66f9e-e58c-435b-9bb0-d6b66261e789","source":"wordfence","cve":"CVE-2026-9230","title":"Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c66f9e-e58c-435b-9bb0-d6b66261e789?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.1.4","to_inclusive":true,"patched_in":"11.1.5"}],"published":"2026-07-02T18:30:42Z","updated":"2026-07-03T06:50:11Z"},{"id":"wordfence:49c6e8bb-4470-4602-a884-ac61c4e64976","source":"wordfence","cve":"CVE-2012-10014","title":"Backend Localization <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c6e8bb-4470-4602-a884-ac61c4e64976?source=api-prod","affected":[{"type":"plugin","slug":"kau-boys-backend-localization","name":"Backend Localization","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2012-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49c717eb-3320-41aa-8dfe-eb23ac7544d6","source":"wordfence","cve":"CVE-2025-23883","title":"Stray Random Quotes <= 1.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49c717eb-3320-41aa-8dfe-eb23ac7544d6?source=api-prod","affected":[{"type":"plugin","slug":"stray-quotes","name":"Stray Random Quotes","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:48:04Z"},{"id":"wordfence:49ca1e15-b015-4e9e-bb79-be3968689609","source":"wordfence","cve":"CVE-2024-56214","title":"Userpro <= 5.1.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ca1e15-b015-4e9e-bb79-be3968689609?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:10:26Z"},{"id":"wordfence:49cac6e5-c224-49f3-9f3d-07b07fc5e4cc","source":"wordfence","cve":"CVE-2025-15030","title":"User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49cac6e5-c224-49f3-9f3d-07b07fc5e4cc?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-01-12T00:00:00Z","updated":"2026-02-11T18:47:20Z"},{"id":"wordfence:49cb8324-2245-4f7d-b289-d2313af4642e","source":"wordfence","cve":"CVE-2026-16063","title":"Event Booking Manager for WooCommerce <= 5.3.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49cb8324-2245-4f7d-b289-d2313af4642e?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.3.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-15T21:35:10Z"},{"id":"wordfence:49cba28f-43dc-4947-b4bb-8556cc0409ee","source":"wordfence","cve":"CVE-2024-29110","title":"Table & Contact Form 7 Database \u2013 Tablesome <= 1.0.27 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49cba28f-43dc-4947-b4bb-8556cc0409ee?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.0.28"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T20:50:58Z"},{"id":"wordfence:49ce8ca1-c1ae-4dda-909e-70c3b6d2b561","source":"wordfence","cve":"CVE-2024-13716","title":"Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ce8ca1-c1ae-4dda-909e-70c3b6d2b561?source=api-prod","affected":[{"type":"plugin","slug":"fx-calculators","name":"Forex Calculators","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-02-27T20:09:39Z","updated":"2025-03-03T15:36:49Z"},{"id":"wordfence:49ce9dfe-3ff0-4bcb-b85b-ef0daf3e7846","source":"wordfence","cve":"CVE-2026-14927","title":"FluentCart <= 1.5.2 - Insecure Direct Object Reference to Unauthenticated Order PII Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ce9dfe-3ff0-4bcb-b85b-ef0daf3e7846?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:32:05Z"},{"id":"wordfence:49cf047f-4e8c-4f37-b8c0-d931c02fda7c","source":"wordfence","cve":"CVE-2020-36704","title":"Fruitful < 3.8.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49cf047f-4e8c-4f37-b8c0-d931c02fda7c?source=api-prod","affected":[{"type":"theme","slug":"fruitful","name":"Fruitful","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2020-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49d0315e-fcb2-4232-8797-0421cf5d3cd8","source":"wordfence","cve":"CVE-2023-47526","title":"Chartify <= 2.0.6 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d0315e-fcb2-4232-8797-0421cf5d3cd8?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T18:08:23Z"},{"id":"wordfence:49d03254-7399-4a5d-9ce9-7d4736b8b2ee","source":"wordfence","cve":"CVE-2023-41854","title":"wpCentral <= 1.5.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d03254-7399-4a5d-9ce9-7d4736b8b2ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-central","name":"wpCentral","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49d31bb7-da1b-4c75-997b-4aa7f80de016","source":"wordfence","cve":"CVE-2025-47681","title":"Web Accessibility with Max Access <= 2.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d31bb7-da1b-4c75-997b-4aa7f80de016?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-toolbar","name":"Web Accessibility with Max Access","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-08-29T13:35:40Z"},{"id":"wordfence:49d3d11d-76b1-4242-921f-631e2e270ebe","source":"wordfence","cve":"CVE-2024-8699","title":"Z-Downloads <= 1.11.4 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d3d11d-76b1-4242-921f-631e2e270ebe?source=api-prod","affected":[{"type":"plugin","slug":"z-downloads","name":"Z-Downloads","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2024-08-06T00:00:00Z","updated":"2025-05-23T14:55:05Z"},{"id":"wordfence:49d54d19-632b-479f-80dd-d66d4285520e","source":"wordfence","cve":"CVE-2024-37227","title":"Newsletters <= 4.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d54d19-632b-479f-80dd-d66d4285520e?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:36:05Z"},{"id":"wordfence:49d6f917-b33f-40a3-83fa-29f0e38794e6","source":"wordfence","cve":"CVE-2026-110886","title":"WPBot \u2013 ChatBot Conversational Forms <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49d6f917-b33f-40a3-83fa-29f0e38794e6?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-10-16T10:41:05Z","updated":"2026-10-23T18:22:35Z"},{"id":"wordfence:49dbfaf2-c0b0-4852-a97c-001c040ec770","source":"wordfence","cve":"CVE-2025-53219","title":"WP-Database-Optimizer-Tools <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49dbfaf2-c0b0-4852-a97c-001c040ec770?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-optimizer-tools","name":"WP-Database-Optimizer-Tools","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:37:32Z"},{"id":"wordfence:49dc267a-48cf-487f-bedc-fd892666e9a0","source":"wordfence","cve":"CVE-2026-13040","title":"NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49dc267a-48cf-487f-bedc-fd892666e9a0?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-07-02T15:30:17Z","updated":"2026-07-03T04:30:20Z"},{"id":"wordfence:49df1ed8-1c2b-4a04-b33a-1fe95fe12172","source":"wordfence","cve":"CVE-2026-66449","title":"Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49df1ed8-1c2b-4a04-b33a-1fe95fe12172?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T19:09:35Z"},{"id":"wordfence:49e133c9-5d3b-4a2a-8385-e2db44baa217","source":"wordfence","cve":"CVE-2025-8900","title":"Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e133c9-5d3b-4a2a-8385-e2db44baa217?source=api-prod","affected":[{"type":"plugin","slug":"doccure","name":"Doccure Core","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2025-10-31T18:22:55Z","updated":"2025-11-03T14:26:38Z"},{"id":"wordfence:49e4dc41-dd5a-4689-9818-e742d1def2f0","source":"wordfence","cve":"","title":"WordPress HTTPS (SSL) <= 3.4.0 - Missing Authorization to Settings Change","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e4dc41-dd5a-4689-9818-e742d1def2f0?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-https","name":"WordPress HTTPS (SSL)","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49e6bfc0-8b71-467e-bb2b-b28041a01a11","source":"wordfence","cve":"CVE-2026-78260","title":"ePayco plugin for WooCommerce <= 8.4.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e6bfc0-8b71-467e-bb2b-b28041a01a11?source=api-prod","affected":[{"type":"plugin","slug":"epayco-gateway","name":"ePayco plugin for WooCommerce","from":"*","from_inclusive":true,"to":"8.4.6","to_inclusive":true,"patched_in":"8.4.7"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:52:53Z"},{"id":"wordfence:49e741c9-0cc7-4a62-a920-4fd997bee280","source":"wordfence","cve":"CVE-2024-10683","title":"Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e741c9-0cc7-4a62-a920-4fd997bee280?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T06:41:25Z"},{"id":"wordfence:49e7b85d-3bd4-4cbf-92b9-cd338a470c89","source":"wordfence","cve":"CVE-2025-53433","title":"EasyEat <= 1.9.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e7b85d-3bd4-4cbf-92b9-cd338a470c89?source=api-prod","affected":[{"type":"theme","slug":"easyeat","name":"EasyEat - Fast Food Theme","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:25:05Z"},{"id":"wordfence:49e82146-e8ad-4bc5-94a7-a4ae694b7039","source":"wordfence","cve":"CVE-2023-33997","title":"bbp style pack <= 5.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e82146-e8ad-4bc5-94a7-a4ae694b7039?source=api-prod","affected":[{"type":"plugin","slug":"bbp-style-pack","name":"bbp style pack","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":false,"patched_in":"5.5.6"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49e9436b-c5b1-4373-bca5-60f718abba26","source":"wordfence","cve":"CVE-2025-57910","title":"AnyClip Luminous Studio <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49e9436b-c5b1-4373-bca5-60f718abba26?source=api-prod","affected":[{"type":"plugin","slug":"anyclip-media","name":"AnyClip Luminous Studio","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:15:30Z"},{"id":"wordfence:49ea8af1-7171-4498-bfb0-bb3cbd72e6f3","source":"wordfence","cve":"CVE-2022-0787","title":"Limit Login Attempts (Spam Protection) <= 4.9.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ea8af1-7171-4498-bfb0-bb3cbd72e6f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-failed-login-attempts","name":"Limit Login Attempts (Spam Protection)","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"5.1"}],"published":"2022-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49eaee21-15c0-4c43-857d-05f0993509ea","source":"wordfence","cve":"CVE-2024-56280","title":"WPGuppy <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49eaee21-15c0-4c43-857d-05f0993509ea?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:32:35Z"},{"id":"wordfence:49ebff14-ce09-4607-8246-50ae028957f6","source":"wordfence","cve":"CVE-2023-28492","title":"CP Multi View Event Calendar  <= 1.4.10 - Missing Authentication leading to Authenticated (Subscriber+) Private Form Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ebff14-ce09-4607-8246-50ae028957f6?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49ed7d6a-4a65-4efc-90e5-ffa5470d4011","source":"wordfence","cve":"CVE-2024-1640","title":"Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ed7d6a-4a65-4efc-90e5-ffa5470d4011?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-13T15:26:47Z"},{"id":"wordfence:49ef0bfe-9bdf-4117-81f7-1ec73b5247ae","source":"wordfence","cve":"CVE-2026-42688","title":"Modula Image Gallery \u2013 Photo Grid & Video Gallery <= 2.14.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ef0bfe-9bdf-4117-81f7-1ec73b5247ae?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.14.23","to_inclusive":true,"patched_in":"2.14.24"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:29:51Z"},{"id":"wordfence:49f01cc7-6e64-45cc-bc54-b263e47fe1a3","source":"wordfence","cve":"CVE-2025-63037","title":"Ronneby Theme Core <= 1.5.68 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f01cc7-6e64-45cc-bc54-b263e47fe1a3?source=api-prod","affected":[{"type":"plugin","slug":"ronneby-core","name":"Ronneby Theme Core","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":true,"patched_in":""}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-11T16:26:47Z"},{"id":"wordfence:49f1f47d-8fa4-4989-9e89-75c392755f8c","source":"wordfence","cve":"CVE-2025-64243","title":"Directory Pro <= 2.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f1f47d-8fa4-4989-9e89-75c392755f8c?source=api-prod","affected":[{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T16:57:10Z"},{"id":"wordfence:49f572ab-befe-44a3-b4bd-01b39d4209ca","source":"wordfence","cve":"","title":"WP-Banners-Lite 1.29, 1.31, 1.40 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f572ab-befe-44a3-b4bd-01b39d4209ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-banners-lite","name":"WP-Banners-Lite","from":"1.29","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-banners-lite","name":"WP-Banners-Lite","from":"1.31","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-banners-lite","name":"WP-Banners-Lite","from":"1.40","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49f5bb21-d18f-453b-bef4-e3b234d162c8","source":"wordfence","cve":"CVE-2024-13594","title":"Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f5bb21-d18f-453b-bef4-e3b234d162c8?source=api-prod","affected":[{"type":"plugin","slug":"simple-downloads-list","name":"Simple Downloads List","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:49f67bbb-cbd0-40ae-ae00-9cb72b041e22","source":"wordfence","cve":"CVE-2026-14484","title":"RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f67bbb-cbd0-40ae-ae00-9cb72b041e22?source=api-prod","affected":[{"type":"plugin","slug":"rapisafe-multi-file-cf7","name":"RapiSafe \u2013 Secure Multi File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:01:53Z","updated":"2026-08-15T02:26:15Z"},{"id":"wordfence:49f7e35d-e453-4e60-8f73-12891def267a","source":"wordfence","cve":"CVE-2023-44260","title":"Woocommerce ESTO <= 2.23.1 - Cross-Site Request Forgery via saveSetting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49f7e35d-e453-4e60-8f73-12891def267a?source=api-prod","affected":[{"type":"plugin","slug":"woo-esto","name":"Woocommerce ESTO","from":"*","from_inclusive":true,"to":"2.23.1","to_inclusive":true,"patched_in":"2.23.2"}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49fc7174-9263-4158-8cdc-cd249179eb3b","source":"wordfence","cve":"CVE-2021-24621","title":"WP Courses LMS < 2.0.44 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fc7174-9263-4158-8cdc-cd249179eb3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"2.0.44","to_inclusive":false,"patched_in":"2.0.44"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:49fcd2cb-d880-4152-a736-33fd90f07083","source":"wordfence","cve":"CVE-2023-47873","title":"WP Child Theme Generator <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fcd2cb-d880-4152-a736-33fd90f07083?source=api-prod","affected":[{"type":"plugin","slug":"wp-child-theme-generator","name":"WP Child Theme Generator","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-20T00:00:00Z","updated":"2024-09-13T13:22:18Z"},{"id":"wordfence:49fdaa21-bbf7-4c0f-ab68-4ef9ac7b2c0a","source":"wordfence","cve":"CVE-2026-93514","title":"Notification for Telegram <= 3.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fdaa21-bbf7-4c0f-ab68-4ef9ac7b2c0a?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:32:00Z"},{"id":"wordfence:49fe478e-b553-4eb5-851b-69319eb4dbc3","source":"wordfence","cve":"CVE-2025-23503","title":"Customizable Captcha and Contact Us <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fe478e-b553-4eb5-851b-69319eb4dbc3?source=api-prod","affected":[{"type":"plugin","slug":"customizable-captcha-and-contact-us-form","name":"Customizable Captcha and Contact us","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:11:51Z"},{"id":"wordfence:49fe6b97-2c5d-4829-a72f-2bcbc10550b5","source":"wordfence","cve":"CVE-2025-23703","title":"Free MailClient FMC <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fe6b97-2c5d-4829-a72f-2bcbc10550b5?source=api-prod","affected":[{"type":"plugin","slug":"mailclient","name":"Free MailClient FMC","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:22:35Z"},{"id":"wordfence:49fe8e8b-95fa-4c25-89cf-49566543206c","source":"wordfence","cve":"CVE-2026-9011","title":"Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49fe8e8b-95fa-4c25-89cf-49566543206c?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.65","to_inclusive":true,"patched_in":"3.1.66"}],"published":"2026-05-21T19:07:00Z","updated":"2026-05-22T07:50:25Z"},{"id":"wordfence:49ff8aca-7f95-4cab-b031-3fda6d80a23b","source":"wordfence","cve":"CVE-2026-65472","title":"Kit (formerly ConvertKit) \u2013 Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/49ff8aca-7f95-4cab-b031-3fda6d80a23b?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:37:24Z"},{"id":"wordfence:4a018a58-2184-4031-99a8-4aad55bcc815","source":"wordfence","cve":"CVE-2026-11905","title":"Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a018a58-2184-4031-99a8-4aad55bcc815?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-10-14T18:17:50Z","updated":"2026-10-15T15:26:39Z"},{"id":"wordfence:4a0c04fe-7a9f-4a3f-ba2c-3bdcb5dec060","source":"wordfence","cve":"CVE-2026-13333","title":"Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0c04fe-7a9f-4a3f-ba2c-3bdcb5dec060?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-06-26T12:59:49Z","updated":"2026-06-27T01:27:21Z"},{"id":"wordfence:4a0c744a-d4b0-45f4-9434-06ce3dec4d75","source":"wordfence","cve":"CVE-2025-9879","title":"Spotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0c744a-d4b0-45f4-9434-06ce3dec4d75?source=api-prod","affected":[{"type":"plugin","slug":"spotify-embed-creator","name":"Spotify Embed Creator","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T14:49:13Z","updated":"2025-09-12T03:22:43Z"},{"id":"wordfence:4a0cffca-94d8-46b8-8b84-57e76a5bfd94","source":"wordfence","cve":"CVE-2022-46846","title":"Trending/Popular Post Slider and Widget <= 1.5.7 - Cross-Site Request Forgery via wtpsw_post_view_count","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0cffca-94d8-46b8-8b84-57e76a5bfd94?source=api-prod","affected":[{"type":"plugin","slug":"wp-trending-post-slider-and-widget","name":"Trending/Popular Post Slider and Widget","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a0d7c79-43d1-42e3-b62b-f7c1dce42810","source":"wordfence","cve":"CVE-2025-39371","title":"Author Box Plugin With Different Description <= 1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0d7c79-43d1-42e3-b62b-f7c1dce42810?source=api-prod","affected":[{"type":"plugin","slug":"author-box-with-different-description","name":"Author Box Plugin With Different Description","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T21:57:48Z"},{"id":"wordfence:4a0e962b-b6a0-4179-91d0-5ede508a9895","source":"wordfence","cve":"CVE-2023-3168","title":"WP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0e962b-b6a0-4179-91d0-5ede508a9895?source=api-prod","affected":[{"type":"plugin","slug":"wp-reroute-email","name":"WP Reroute Email","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a0f77ca-2fb5-4e73-a0fa-dfbeb39fbd84","source":"wordfence","cve":"CVE-2021-24649","title":"WP User Frontend <= 3.5.28 - Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a0f77ca-2fb5-4e73-a0fa-dfbeb39fbd84?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.5.28","to_inclusive":true,"patched_in":"3.5.29"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a1127af-74f6-4748-9aee-5a8c6c2766a4","source":"wordfence","cve":"CVE-2026-13447","title":"MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.20.0","to_inclusive":true,"patched_in":"4.21.1"}],"published":"2026-09-04T17:19:59Z","updated":"2026-09-05T05:30:54Z"},{"id":"wordfence:4a134509-8dc0-41ac-9b5c-5b173a1e3c68","source":"wordfence","cve":"","title":"Product Catalog Simple <= 1.7.5 - Cross-Site Request Forgery via ic_system_status","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a134509-8dc0-41ac-9b5c-5b173a1e3c68?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a13b13e-72d3-43c9-b5ec-d499f3b22091","source":"wordfence","cve":"CVE-2024-10168","title":"Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a13b13e-72d3-43c9-b5ec-d499f3b22091?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.4","to_inclusive":true,"patched_in":"1.0.6.5"}],"published":"2024-11-05T23:27:31Z","updated":"2024-11-06T11:32:01Z"},{"id":"wordfence:4a13c7a1-f904-41b1-ab7f-2df95c9b2880","source":"wordfence","cve":"CVE-2023-50889","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a13c7a1-f904-41b1-ab7f-2df95c9b2880?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.2.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-10-24T19:10:55Z"},{"id":"wordfence:4a154c3f-e2c4-454d-94f9-539d8b289e4e","source":"wordfence","cve":"CVE-2024-50473","title":"Ajar in5 Embed <= 3.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a154c3f-e2c4-454d-94f9-539d8b289e4e?source=api-prod","affected":[{"type":"plugin","slug":"ajar-productions-in5-embed","name":"Ajar in5 Embed","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-10-25T00:00:00Z","updated":"2024-11-27T13:39:06Z"},{"id":"wordfence:4a18cb4a-8458-4337-843e-c3278028230f","source":"wordfence","cve":"CVE-2026-32532","title":"Lead Form Builder & Contact Form <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a18cb4a-8458-4337-843e-c3278028230f?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:28:08Z"},{"id":"wordfence:4a19496b-7b81-4127-aa57-8d1f41e7e9f0","source":"wordfence","cve":"CVE-2026-91009","title":"Active Products Tables for WooCommerce <= 2.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a19496b-7b81-4127-aa57-8d1f41e7e9f0?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:03Z"},{"id":"wordfence:4a198600-9c47-46bc-97b6-d7f90493d43e","source":"wordfence","cve":"CVE-2025-23529","title":"Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a198600-9c47-46bc-97b6-d7f90493d43e?source=api-prod","affected":[{"type":"plugin","slug":"minterpress","name":"Minterpress","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:39:55Z"},{"id":"wordfence:4a1a4186-216e-4ed1-860c-fe345ac6e62a","source":"wordfence","cve":"CVE-2019-17234","title":"IgniteUp \u2013 Coming Soon and Maintenance Mode <= 3.4 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1a4186-216e-4ed1-860c-fe345ac6e62a?source=api-prod","affected":[{"type":"plugin","slug":"igniteup","name":"IgniteUp \u2013 Coming Soon and Maintenance Mode","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2019-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a1ae83c-d062-4392-a1ad-3afa0c0efe18","source":"wordfence","cve":"CVE-2026-82849","title":"Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1ae83c-d062-4392-a1ad-3afa0c0efe18?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:48:52Z"},{"id":"wordfence:4a1d6657-d8bc-4145-96b0-f85e752060f4","source":"wordfence","cve":"CVE-2025-23793","title":"Auto FTP <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1d6657-d8bc-4145-96b0-f85e752060f4?source=api-prod","affected":[{"type":"plugin","slug":"auto-ftp","name":"Auto FTP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:39:23Z"},{"id":"wordfence:4a1e77de-0207-412d-857d-ab6947116669","source":"wordfence","cve":"CVE-2008-2068","title":"WordPress Core <= 2.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1e77de-0207-412d-857d-ab6947116669?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2008-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a1fe36b-75d2-48c3-bfac-af965eb9363f","source":"wordfence","cve":"CVE-2023-46309","title":"wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1fe36b-75d2-48c3-bfac-af965eb9363f?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.10","to_inclusive":true,"patched_in":"7.6.11"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a215460-64ab-466e-a148-e510233cdcd6","source":"wordfence","cve":"CVE-2024-0757","title":"Insert or Embed Articulate Content into WordPress < 4.3000000025 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a215460-64ab-466e-a148-e510233cdcd6?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000025","to_inclusive":false,"patched_in":"4.3000000027"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:17:52Z"},{"id":"wordfence:4a249c93-c029-44c1-8563-8adf1e2e3062","source":"wordfence","cve":"CVE-2025-58637","title":"immonex Kickstart <= 1.11.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a249c93-c029-44c1-8563-8adf1e2e3062?source=api-prod","affected":[{"type":"plugin","slug":"immonex-kickstart","name":"immonex Kickstart","from":"*","from_inclusive":true,"to":"1.11.6","to_inclusive":true,"patched_in":"1.11.13"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:07:16Z"},{"id":"wordfence:4a263b74-e9ae-4fd2-be9b-9b8e9eee5982","source":"wordfence","cve":"CVE-2020-36705","title":"Adning Advertising <= 1.5.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982?source=api-prod","affected":[{"type":"plugin","slug":"angwp","name":"Adning Advertising","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2020-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a2c11bb-88cb-43ae-b9b7-5b6262a315e0","source":"wordfence","cve":"CVE-2018-10301","title":"WD Instagram Feed Premium <= 1.3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2c11bb-88cb-43ae-b9b7-5b6262a315e0?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-instagram-feed","name":"WD Instagram Feed Premium","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2018-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a2ca2f0-1d4a-4614-86ba-a46e765f4a9f","source":"wordfence","cve":"CVE-2022-3568","title":"ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2ca2f0-1d4a-4614-86ba-a46e765f4a9f?source=api-prod","affected":[{"type":"plugin","slug":"imagemagick-engine","name":"ImageMagick Engine","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a2e636d-e602-4ab0-80f2-525a8a1f8388","source":"wordfence","cve":"CVE-2024-1732","title":"Sharkdropship for AliExpress Dropshipping and Affiliate <= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2e636d-e602-4ab0-80f2-525a8a1f8388?source=api-prod","affected":[{"type":"plugin","slug":"wooshark-aliexpress-importer","name":"Sharkdropship & affiliate for AliExpress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T09:32:09Z"},{"id":"wordfence:4a2ef416-4354-4e09-b9be-e36c1f655110","source":"wordfence","cve":"CVE-2026-4341","title":"Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2ef416-4354-4e09-b9be-e36c1f655110?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2026-04-07T15:20:50Z","updated":"2026-04-08T03:36:08Z"},{"id":"wordfence:4a308056-aadc-4fc3-8133-2b05f3d9aabe","source":"wordfence","cve":"CVE-2024-31936","title":"UsersWP <= 1.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a308056-aadc-4fc3-8133-2b05f3d9aabe?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:32:08Z"},{"id":"wordfence:4a32ae77-3d4e-4fd4-a43a-7d1a52dcfa77","source":"wordfence","cve":"CVE-2023-52210","title":"Product Delivery Date for WooCommerce \u2013 Lite <= 2.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a32ae77-3d4e-4fd4-a43a-7d1a52dcfa77?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a330416-f867-4a1a-a692-6003e231ed54","source":"wordfence","cve":"CVE-2020-28977","title":"Canto <= 1.9.0 - Blind Server-Side Request Forgery via get.php","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a330416-f867-4a1a-a692-6003e231ed54?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2020-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a3a7097-e184-40d0-9c26-7c5638c937a5","source":"wordfence","cve":"CVE-2026-103895","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-10-15T16:18:20Z","updated":"2026-10-16T04:26:59Z"},{"id":"wordfence:4a3cae01-620d-405e-baf6-2d66a5b429b3","source":"wordfence","cve":"CVE-2024-9130","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3cae01-620d-405e-baf6-2d66a5b429b3?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2024-09-26T17:03:51Z","updated":"2024-09-27T05:31:03Z"},{"id":"wordfence:4a3e3e6e-9c17-4ac5-9f83-1e01365436e9","source":"wordfence","cve":"","title":"WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3e3e6e-9c17-4ac5-9f83-1e01365436e9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-06T23:24:35Z"},{"id":"wordfence:4a3f1e3d-8b34-4e6a-90f3-da50201fe896","source":"wordfence","cve":"CVE-2025-23852","title":"First Comment Redirect <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3f1e3d-8b34-4e6a-90f3-da50201fe896?source=api-prod","affected":[{"type":"plugin","slug":"first-comment-redirect","name":"First Comment Redirect","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:47:14Z"},{"id":"wordfence:4a3f835e-0aa9-4581-9150-fe5041e0f293","source":"wordfence","cve":"CVE-2023-1024","title":"WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3f835e-0aa9-4581-9150-fe5041e0f293?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a40ddbc-0b9a-40bd-bf68-9e63723acb1c","source":"wordfence","cve":"CVE-2025-47531","title":"XT Event Widget for Social Events <= 1.1.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a40ddbc-0b9a-40bd-bf68-9e63723acb1c?source=api-prod","affected":[{"type":"plugin","slug":"xt-facebook-events","name":"XT Event Widget for Social Events","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:55:33Z"},{"id":"wordfence:4a42efc2-b8ec-4a69-94b2-afbe3d584e55","source":"wordfence","cve":"CVE-2026-66597","title":"wpDataTables (Premium) <= 6.5.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a42efc2-b8ec-4a69-94b2-afbe3d584e55?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"6.5.1.4","to_inclusive":true,"patched_in":"6.5.1.5"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:43Z"},{"id":"wordfence:4a433565-0896-4ba9-a718-9507c6c4ba58","source":"wordfence","cve":"CVE-2025-9442","title":"StreamWeasels Kick Integration <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a433565-0896-4ba9-a718-9507c6c4ba58?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-kick-integration","name":"StreamWeasels Kick Integration","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-09-05T14:45:37Z","updated":"2025-09-06T03:22:37Z"},{"id":"wordfence:4a47660e-67a6-42d4-a7ec-911dcf3e6e47","source":"wordfence","cve":"CVE-2026-82970","title":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a47660e-67a6-42d4-a7ec-911dcf3e6e47?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:30:37Z"},{"id":"wordfence:4a4c085a-1601-4c1a-ac17-0f2cf5d02489","source":"wordfence","cve":"CVE-2024-11640","title":"VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4c085a-1601-4c1a-ac17-0f2cf5d02489?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T11:16:41Z"},{"id":"wordfence:4a4c745b-f489-417c-8004-ead131a7a6c6","source":"wordfence","cve":"CVE-2026-57328","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 6.4.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4c745b-f489-417c-8004-ead131a7a6c6?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.22","to_inclusive":true,"patched_in":"6.4.23"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:57:17Z"},{"id":"wordfence:4a4d58f3-fbd6-4237-a226-c14439546c58","source":"wordfence","cve":"CVE-2025-59560","title":"Sonaar <= 4.27.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4d58f3-fbd6-4237-a226-c14439546c58?source=api-prod","affected":[{"type":"theme","slug":"sonaar","name":"Sonaar","from":"*","from_inclusive":true,"to":"4.27.4","to_inclusive":true,"patched_in":"4.27.5"}],"published":"2025-10-06T00:00:00Z","updated":"2025-10-29T15:26:31Z"},{"id":"wordfence:4a4e01b5-8164-46e2-ae3e-9ffd39434eb5","source":"wordfence","cve":"CVE-2026-92431","title":"Patreon WordPress <= 1.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4e01b5-8164-46e2-ae3e-9ffd39434eb5?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:45:32Z"},{"id":"wordfence:4a4e1d08-a61d-40b8-bfbb-c112c77dd412","source":"wordfence","cve":"CVE-2024-51851","title":"best bootstrap widgets for elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4e1d08-a61d-40b8-bfbb-c112c77dd412?source=api-prod","affected":[{"type":"plugin","slug":"best-bootstrap-widgets-for-elementor","name":"best bootstrap widgets for elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:45:36Z"},{"id":"wordfence:4a4f0909-76f6-4d27-87b1-f6cd5f5cbbb7","source":"wordfence","cve":"CVE-2024-9522","title":"WP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4f0909-76f6-4d27-87b1-f6cd5f5cbbb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-users-masquerade","name":"WP Users Masquerade","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-22T10:56:18Z"},{"id":"wordfence:4a515dc9-e6d6-4083-a3e8-c22307b120a8","source":"wordfence","cve":"CVE-2021-24701","title":"Quiz Tool Lite <= 2.3.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a515dc9-e6d6-4083-a3e8-c22307b120a8?source=api-prod","affected":[{"type":"plugin","slug":"quiz-tool-lite","name":"Quiz Tool Lite","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":""}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a5262d8-d9cd-4bd9-a95e-f60782095173","source":"wordfence","cve":"CVE-2022-1750","title":"Sticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5262d8-d9cd-4bd9-a95e-f60782095173?source=api-prod","affected":[{"type":"plugin","slug":"sticky-popup","name":"Sticky Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a56a838-5dfa-477a-92b2-fdac3d1ab2af","source":"wordfence","cve":"CVE-2021-20780","title":"Currency Switcher <= 1.1.6 - Cross-site request forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a56a838-5dfa-477a-92b2-fdac3d1ab2af?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2021-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a5787f3-6a16-491a-aa01-6222f275cf0f","source":"wordfence","cve":"CVE-2026-1785","title":"Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5787f3-6a16-491a-aa01-6222f275cf0f?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-02-05T19:33:02Z","updated":"2026-02-06T08:25:27Z"},{"id":"wordfence:4a5a118d-54a2-4e15-a629-4759c34f62b4","source":"wordfence","cve":"CVE-2024-37277","title":"Paid Memberships Pro <= 3.0.4 - Unauthenticated Insecure Direct Object Reference to Order Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5a118d-54a2-4e15-a629-4759c34f62b4?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:15:08Z"},{"id":"wordfence:4a5a8507-4c45-429b-b013-fe9a14a94ffc","source":"wordfence","cve":"CVE-2026-73386","title":"Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5a8507-4c45-429b-b013-fe9a14a94ffc?source=api-prod","affected":[{"type":"plugin","slug":"track-geolocation-of-users-using-contact-form-7","name":"Track Geolocation Of Users Using Contact Form 7","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-08-19T00:00:00Z","updated":"2026-10-13T16:59:42Z"},{"id":"wordfence:4a5c4bef-f871-4e6b-9b6e-85079f1233a2","source":"wordfence","cve":"","title":"Injection Guard <= 1.2.1 - Cross-Site Request Forgery via ig_update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5c4bef-f871-4e6b-9b6e-85079f1233a2?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a5d59da-dcac-44b4-a697-38eef650c6de","source":"wordfence","cve":"CVE-2024-31422","title":"Favicon <= 1.3.29 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a5d59da-dcac-44b4-a697-38eef650c6de?source=api-prod","affected":[{"type":"plugin","slug":"favicon-by-realfavicongenerator","name":"Favicon by RealFaviconGenerator","from":"*","from_inclusive":true,"to":"1.3.29","to_inclusive":true,"patched_in":"1.3.30"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:56:19Z"},{"id":"wordfence:4a6492c8-19f0-4a97-bc17-f8ece14b7cba","source":"wordfence","cve":"CVE-2025-68510","title":"Photography < 7.7.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a6492c8-19f0-4a97-bc17-f8ece14b7cba?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.7.5","to_inclusive":false,"patched_in":"7.7.5"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T19:27:15Z"},{"id":"wordfence:4a64f840-8570-4f98-8b72-27bee1607fc2","source":"wordfence","cve":"CVE-2026-16236","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a64f840-8570-4f98-8b72-27bee1607fc2?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-07-30T16:55:32Z","updated":"2026-08-14T13:24:15Z"},{"id":"wordfence:4a66498d-7cf0-4480-b946-94e38f8fd350","source":"wordfence","cve":"CVE-2026-93389","title":"LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching","severity":"high","cvss":8.2,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66498d-7cf0-4480-b946-94e38f8fd350?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.1","to_inclusive":true,"patched_in":"7.9.2"}],"published":"2026-11-04T16:09:05Z","updated":"2026-11-05T04:48:07Z"},{"id":"wordfence:4a66b704-2f85-47df-83e7-12058b85d86b","source":"wordfence","cve":"CVE-2026-28042","title":"Listify <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66b704-2f85-47df-83e7-12058b85d86b?source=api-prod","affected":[{"type":"theme","slug":"listify","name":"Listify","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:23:05Z"},{"id":"wordfence:4a689b45-b29e-4807-9146-c900332f5946","source":"wordfence","cve":"CVE-2026-25380","title":"Feedy < 2.1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a689b45-b29e-4807-9146-c900332f5946?source=api-prod","affected":[{"type":"theme","slug":"feedy","name":"Feedy - Healthy Fast Food Delivery & Diet Nutrition WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":false,"patched_in":"2.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:49:27Z"},{"id":"wordfence:4a6e5f89-ebc0-413a-a76e-3cf4339430ba","source":"wordfence","cve":"CVE-2023-51474","title":"TerraClassifieds <= 2.0.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a6e5f89-ebc0-413a-a76e-3cf4339430ba?source=api-prod","affected":[{"type":"plugin","slug":"terraclassifieds","name":"TerraClassifieds \u2013 Simple Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a6efab8-04a0-459f-a791-9360c83e5dbe","source":"wordfence","cve":"CVE-2025-12582","title":"Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a6efab8-04a0-459f-a791-9360c83e5dbe?source=api-prod","affected":[{"type":"plugin","slug":"features","name":"Features","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T14:25:42Z","updated":"2025-11-05T02:25:52Z"},{"id":"wordfence:4a71fda4-3c67-4053-ac1e-9cf3f5feb8c8","source":"wordfence","cve":"CVE-2019-18834","title":"WooCommerce Subscriptions < 2.6.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a71fda4-3c67-4053-ac1e-9cf3f5feb8c8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"}],"published":"2019-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a7345a1-ceb5-4f93-a6ba-13e8b8fb6c7d","source":"wordfence","cve":"CVE-2023-23642","title":"MainWP Clone Extension <= 4.0.2 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7345a1-ceb5-4f93-a6ba-13e8b8fb6c7d?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-clone-extension","name":"MainWP Clone Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a748589-51e5-4e3c-930c-d073d5cc94bf","source":"wordfence","cve":"CVE-2023-23895","title":"WP Time Slots Booking Form <= 1.1.82 - Improper Authorization Checks","severity":"medium","cvss":4.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a748589-51e5-4e3c-930c-d073d5cc94bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.1.82","to_inclusive":true,"patched_in":"1.1.83"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a75444e-b1e4-41e0-9209-07ded65c1498","source":"wordfence","cve":"CVE-2026-1886","title":"Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a75444e-b1e4-41e0-9209-07ded65c1498?source=api-prod","affected":[{"type":"plugin","slug":"go-night-pro","name":"Go Night Pro | WordPress Dark Mode Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:52Z","updated":"2026-03-21T03:26:44Z"},{"id":"wordfence:4a76f851-3f4e-4457-a33c-eede51c4b4d1","source":"wordfence","cve":"CVE-2025-2303","title":"Block Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a76f851-3f4e-4457-a33c-eede51c4b4d1?source=api-prod","affected":[{"type":"plugin","slug":"block-logic","name":"Block Logic \u2013 Full Block Display Control","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-21T17:53:40Z","updated":"2026-01-06T19:52:55Z"},{"id":"wordfence:4a77675b-5a31-4bc1-b4bd-36dd9a612b7c","source":"wordfence","cve":"CVE-2023-47227","title":"Social Feed | All social media in one place <= 1.5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting]","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a77675b-5a31-4bc1-b4bd-36dd9a612b7c?source=api-prod","affected":[{"type":"plugin","slug":"add-facebook","name":"Social Feed | All social media in one place","from":"*","from_inclusive":true,"to":"1.5.4.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a7a15ab-4f13-4eb1-aeb5-143230308871","source":"wordfence","cve":"CVE-2023-35047","title":"All Bootstrap Blocks <= 1.3.6 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7a15ab-4f13-4eb1-aeb5-143230308871?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a7b6fa4-13a5-410a-979e-fbced2a3373b","source":"wordfence","cve":"CVE-2025-64276","title":"Survey Maker <= 5.1.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7b6fa4-13a5-410a-979e-fbced2a3373b?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.9.4","to_inclusive":true,"patched_in":"5.1.9.5"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-17T19:24:35Z"},{"id":"wordfence:4a7be578-5883-4cd3-963d-bf81c3af2003","source":"wordfence","cve":"CVE-2024-11740","title":"Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7be578-5883-4cd3-963d-bf81c3af2003?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.03","to_inclusive":true,"patched_in":"3.3.04"}],"published":"2024-12-18T16:22:49Z","updated":"2024-12-19T05:24:58Z"},{"id":"wordfence:4a7bfa47-1c83-4af7-8ddd-0b90a117b9c7","source":"wordfence","cve":"CVE-2024-5172","title":"Expert Invoice <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7bfa47-1c83-4af7-8ddd-0b90a117b9c7?source=api-prod","affected":[{"type":"plugin","slug":"expert-invoice","name":"Expert Invoice","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-30T20:41:28Z"},{"id":"wordfence:4a7c9797-918b-4cde-9815-9d796fb09d45","source":"wordfence","cve":"CVE-2024-51625","title":"Quran Shortcode <= 1.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7c9797-918b-4cde-9815-9d796fb09d45?source=api-prod","affected":[{"type":"plugin","slug":"quran-shortcode","name":"Quran Shortcode","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:37:00Z"},{"id":"wordfence:4a7df25c-00a7-40ec-a851-374543fc549d","source":"wordfence","cve":"CVE-2025-67593","title":"UsersWP <= 1.2.48 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7df25c-00a7-40ec-a851-374543fc549d?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.48","to_inclusive":true,"patched_in":"1.2.49"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:36:58Z"},{"id":"wordfence:4a7ef5a0-f6c8-41e1-bb3b-119a682be69f","source":"wordfence","cve":"CVE-2024-10798","title":"Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a7ef5a0-f6c8-41e1-bb3b-119a682be69f?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1003","to_inclusive":true,"patched_in":"1.7.1004"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:47:13Z"},{"id":"wordfence:4a82a3b7-eb05-4f52-84b7-f1a97dddedf9","source":"wordfence","cve":"CVE-2024-34387","title":"WP Post Author \u2013 Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.6.4 - Missing Authorization to Rating Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a82a3b7-eb05-4f52-84b7-f1a97dddedf9?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-28T16:56:54Z"},{"id":"wordfence:4a82c911-71aa-4f6c-8088-7b839e027a6a","source":"wordfence","cve":"CVE-2026-49771","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a82c911-71aa-4f6c-8088-7b839e027a6a?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.41","to_inclusive":true,"patched_in":"1.8.42"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:46:28Z"},{"id":"wordfence:4a85de70-7cb1-45d1-b872-0677ef8134be","source":"wordfence","cve":"","title":"Interactive Medical Drawing of Human Body <= 2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a85de70-7cb1-45d1-b872-0677ef8134be?source=api-prod","affected":[{"type":"plugin","slug":"interactive-medical-drawing-of-human-body","name":"Interactive Human Anatomy with Clickable Body Parts","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.6"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a86d15a-0abf-464c-a998-c1fc96edc964","source":"wordfence","cve":"CVE-2024-51882","title":"Gboy Custom Google Map <= 1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a86d15a-0abf-464c-a998-c1fc96edc964?source=api-prod","affected":[{"type":"plugin","slug":"gboy-custom-google-map","name":"Gboy Custom Google Map","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:25:14Z"},{"id":"wordfence:4a87c261-5452-48c9-ab4a-2cf6af0fef56","source":"wordfence","cve":"CVE-2024-32438","title":"SEO Booster <= 3.8.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a87c261-5452-48c9-ab4a-2cf6af0fef56?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:19:02Z"},{"id":"wordfence:4a88566d-29c8-43f0-8816-80cbe93f5604","source":"wordfence","cve":"CVE-2026-103309","title":"GPTranslate \u2013 Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a88566d-29c8-43f0-8816-80cbe93f5604?source=api-prod","affected":[{"type":"plugin","slug":"gptranslate","name":"GPTranslate \u2013 Multilingual AI Translation Agent for WordPress: Translate Your Site with AI","from":"*","from_inclusive":true,"to":"2.34.14","to_inclusive":false,"patched_in":"2.34.14"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:30:55Z"},{"id":"wordfence:4a89c812-a643-47c0-bd33-cfb2389a7646","source":"wordfence","cve":"CVE-2026-15099","title":"WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a89c812-a643-47c0-bd33-cfb2389a7646?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-07-15T19:42:19Z","updated":"2026-07-16T07:51:00Z"},{"id":"wordfence:4a8ac027-f376-4f02-a085-f05f1fa749f0","source":"wordfence","cve":"CVE-2024-9373","title":"Elemenda <= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a8ac027-f376-4f02-a085-f05f1fa749f0?source=api-prod","affected":[{"type":"plugin","slug":"elemenda","name":"Elemenda","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:43:03Z","updated":"2024-10-18T04:32:52Z"},{"id":"wordfence:4a9021b4-54f8-4ba3-bc81-49271dde1b44","source":"wordfence","cve":"CVE-2024-11886","title":"Contact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a9021b4-54f8-4ba3-bc81-49271dde1b44?source=api-prod","affected":[{"type":"plugin","slug":"lead-capturing-call-to-actions-by-vcita","name":"Contact Form and Calls To Action by vcita","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T16:51:10Z","updated":"2025-01-31T05:22:33Z"},{"id":"wordfence:4a920dd5-e4a0-4bc3-8eb8-58069d0ae336","source":"wordfence","cve":"CVE-2025-26567","title":"Font Awesome WP <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a920dd5-e4a0-4bc3-8eb8-58069d0ae336?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome-wp","name":"Font Awesome WP","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:40:42Z"},{"id":"wordfence:4a984bd8-ca43-4676-9985-b111111c17ab","source":"wordfence","cve":"CVE-2014-2315","title":"Thank You Counter Button <= 1.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a984bd8-ca43-4676-9985-b111111c17ab?source=api-prod","affected":[{"type":"plugin","slug":"thanks-you-counter-button","name":"Thank You Counter Button","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2014-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a992bb2-67b9-48db-a536-c3af79e93af4","source":"wordfence","cve":"CVE-2023-31234","title":"Tilda Publishing <= 0.3.23 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a992bb2-67b9-48db-a536-c3af79e93af4?source=api-prod","affected":[{"type":"plugin","slug":"tilda-publishing","name":"Tilda-publishing","from":"*","from_inclusive":true,"to":"0.3.23","to_inclusive":true,"patched_in":"0.3.24"}],"published":"2023-09-04T00:00:00Z","updated":"2024-04-01T20:40:57Z"},{"id":"wordfence:4a9df582-0ead-45ff-aeaa-1bee9d470b41","source":"wordfence","cve":"CVE-2023-1780","title":"Companion Sitemap Generator <= 4.5.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a9df582-0ead-45ff-aeaa-1bee9d470b41?source=api-prod","affected":[{"type":"plugin","slug":"companion-sitemap-generator","name":"Companion Sitemap Generator \u2013 Simple, Smart, and SEO-Ready","from":"*","from_inclusive":true,"to":"4.5.1.1","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4a9fce6d-d5c2-4ab7-87ea-8dd6e4d92e07","source":"wordfence","cve":"CVE-2023-47673","title":"Post Pay Counter <= 2.789 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a9fce6d-d5c2-4ab7-87ea-8dd6e4d92e07?source=api-prod","affected":[{"type":"plugin","slug":"post-pay-counter","name":"Post Pay Counter","from":"*","from_inclusive":true,"to":"2.789","to_inclusive":true,"patched_in":"2.790"}],"published":"2023-11-08T00:00:00Z","updated":"2024-02-08T15:49:28Z"},{"id":"wordfence:4aa04db0-8878-42b7-a923-03257230a7c1","source":"wordfence","cve":"CVE-2025-31766","title":"PhotoShelter for Photographers Blog Feed Plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa04db0-8878-42b7-a923-03257230a7c1?source=api-prod","affected":[{"type":"plugin","slug":"photoshelter-official-plugin","name":"PhotoShelter for Photographers Blog Feed Plugin","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:06:13Z"},{"id":"wordfence:4aa09e5b-fc3d-4409-bf2c-dd8aae69eeda","source":"wordfence","cve":"CVE-2024-13386","title":"quote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa09e5b-fc3d-4409-bf2c-dd8aae69eeda?source=api-prod","affected":[{"type":"plugin","slug":"quote-post-type-plugin","name":"quote-posttype-plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T18:23:39Z","updated":"2025-01-17T07:01:27Z"},{"id":"wordfence:4aa0e496-3dcd-49ac-a519-16b1648c5871","source":"wordfence","cve":"CVE-2025-48245","title":"Quick Contact Form <= 8.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa0e496-3dcd-49ac-a519-16b1648c5871?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.2.1","to_inclusive":true,"patched_in":"8.2.2"}],"published":"2025-05-29T00:00:00Z","updated":"2025-05-30T20:20:05Z"},{"id":"wordfence:4aa0fa80-05dd-4fe1-b7b5-7ed0cf13053c","source":"wordfence","cve":"CVE-2026-4853","title":"JetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa0fa80-05dd-4fe1-b7b5-7ed0cf13053c?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"3.1.19.8","to_inclusive":true,"patched_in":"3.1.20.3"}],"published":"2026-04-16T15:21:18Z","updated":"2026-04-17T03:36:43Z"},{"id":"wordfence:4aa247ff-fbc3-48e3-8e90-e3f8cdf5d97f","source":"wordfence","cve":"CVE-2026-109224","title":"SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa247ff-fbc3-48e3-8e90-e3f8cdf5d97f?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-10-15T20:08:30Z","updated":"2026-10-16T08:27:43Z"},{"id":"wordfence:4aa4cb93-7af3-4427-a17f-160b27fcebb8","source":"wordfence","cve":"CVE-2025-9625","title":"Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa4cb93-7af3-4427-a17f-160b27fcebb8?source=api-prod","affected":[{"type":"plugin","slug":"coil-web-monetization","name":"Coil Web Monetization","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:18:18Z","updated":"2025-11-18T08:27:31Z"},{"id":"wordfence:4aa589b3-2ad9-4498-8578-1d00736a3b7e","source":"wordfence","cve":"CVE-2025-69030","title":"Backpack Traveler <= 2.10.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa589b3-2ad9-4498-8578-1d00736a3b7e?source=api-prod","affected":[{"type":"theme","slug":"backpacktraveler","name":"Backpack Traveler - Modern Travel Blog WordPress Theme","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:47:11Z"},{"id":"wordfence:4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb","source":"wordfence","cve":"CVE-2026-12753","title":"Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb?source=api-prod","affected":[{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-07-15T13:37:14Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:4aa89fab-b6fe-423a-a7f5-dbe6c92d1b56","source":"wordfence","cve":"CVE-2012-5310","title":"WP eCommerce < 3.8.7.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa89fab-b6fe-423a-a7f5-dbe6c92d1b56?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.8.7.6","to_inclusive":false,"patched_in":"3.8.7.6"}],"published":"2014-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4aa9387d-5a6b-4016-98c7-025feab3d45b","source":"wordfence","cve":"CVE-2024-12726","title":"ClipArt <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa9387d-5a6b-4016-98c7-025feab3d45b?source=api-prod","affected":[{"type":"plugin","slug":"clipart","name":"ClipArt","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-05-29T17:59:12Z"},{"id":"wordfence:4aab594d-1901-4f88-874c-204578eebda0","source":"wordfence","cve":"CVE-2023-6845","title":"CommentTweets <= 0.6 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aab594d-1901-4f88-874c-204578eebda0?source=api-prod","affected":[{"type":"plugin","slug":"commenttweets","name":"CommentTweets","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2023-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4aad3bc3-6b8e-41c4-b362-77834ae98bfa","source":"wordfence","cve":"CVE-2025-24557","title":"PlainInventory \u2013 Inventory Management Plugin <= 3.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aad3bc3-6b8e-41c4-b362-77834ae98bfa?source=api-prod","affected":[{"type":"plugin","slug":"z-inventory-manager","name":"Zintory \u2013 Inventory Manager","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2024-11-10T00:00:00Z","updated":"2025-02-21T14:19:44Z"},{"id":"wordfence:4aae4571-671a-46d7-b490-6cd0feced0af","source":"wordfence","cve":"","title":"WP Private Messages <= 1.0.1 - Authenticated SQL Injection","severity":"medium","cvss":6.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aae4571-671a-46d7-b490-6cd0feced0af?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-messages","name":"WP Private Messages","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2016-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ab53ebb-c18e-4791-b4dc-84b84aea65c6","source":"wordfence","cve":"CVE-2025-26950","title":"Nepali Date Converter <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab53ebb-c18e-4791-b4dc-84b84aea65c6?source=api-prod","affected":[{"type":"plugin","slug":"nepali-date-converter","name":"Nepali Date Converter","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:16:13Z"},{"id":"wordfence:4ab71d24-0409-421b-8abf-f4d5390a32a1","source":"wordfence","cve":"CVE-2024-2382","title":"Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab71d24-0409-421b-8abf-f4d5390a32a1?source=api-prod","affected":[{"type":"plugin","slug":"authorizenet-payment-gateway-for-woocommerce","name":"Authorize.net Payment Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:05:32Z","updated":"2024-06-04T05:32:15Z"},{"id":"wordfence:4ab78b31-fce5-44e6-8613-b53f16077a95","source":"wordfence","cve":"CVE-2025-23845","title":"ImageMeta <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab78b31-fce5-44e6-8613-b53f16077a95?source=api-prod","affected":[{"type":"plugin","slug":"imagemeta","name":"ImageMeta","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:53:36Z"},{"id":"wordfence:4ab9d7e9-9a81-48f8-bc37-ad6de43a566f","source":"wordfence","cve":"CVE-2025-14977","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ab9d7e9-9a81-48f8-bc37-ad6de43a566f?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2026-01-19T15:32:29Z","updated":"2026-01-20T04:35:46Z"},{"id":"wordfence:4abba5ab-523c-4b4f-8d3e-bb7ee57cd280","source":"wordfence","cve":"CVE-2026-11895","title":"HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4abba5ab-523c-4b4f-8d3e-bb7ee57cd280?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-09-29T19:36:43Z","updated":"2026-09-30T07:41:05Z"},{"id":"wordfence:4abbf148-4648-440c-8a82-cf68bf051fbe","source":"wordfence","cve":"CVE-2026-92553","title":"YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4abbf148-4648-440c-8a82-cf68bf051fbe?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2026-10-15T17:49:54Z","updated":"2026-10-16T06:41:03Z"},{"id":"wordfence:4abcfc2c-88e2-46df-b160-05e3c005ec2b","source":"wordfence","cve":"CVE-2026-107866","title":"JetElements <= 2.9.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4abcfc2c-88e2-46df-b160-05e3c005ec2b?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.3","to_inclusive":true,"patched_in":"2.9.2.4"}],"published":"2026-10-12T08:59:00Z","updated":"2026-10-13T14:02:48Z"},{"id":"wordfence:4abf68bc-b3d6-4622-b26b-9484e2334579","source":"wordfence","cve":"CVE-2026-116852","title":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4abf68bc-b3d6-4622-b26b-9484e2334579?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2026-10-30T09:19:20Z","updated":"2026-11-03T19:34:08Z"},{"id":"wordfence:4ac18db7-324f-41f0-b03a-59635dd97d22","source":"wordfence","cve":"CVE-2025-68062","title":"MinimogWP <= 3.9.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac18db7-324f-41f0-b03a-59635dd97d22?source=api-prod","affected":[{"type":"theme","slug":"minimog","name":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-13T00:00:00Z","updated":"2025-12-19T17:05:26Z"},{"id":"wordfence:4ac1ddf0-9164-45a8-b1dc-e684b1b4b447","source":"wordfence","cve":"CVE-2026-109208","title":"LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac1ddf0-9164-45a8-b1dc-e684b1b4b447?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-16T14:28:58Z","updated":"2026-10-17T02:31:07Z"},{"id":"wordfence:4ac22e56-5d52-48f0-8bd1-8584c2b40bb7","source":"wordfence","cve":"CVE-2024-32951","title":"Max Addons Pro for Bricks <= 1.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac22e56-5d52-48f0-8bd1-8584c2b40bb7?source=api-prod","affected":[{"type":"plugin","slug":"max-addons-pro-bricks","name":"Max Addons Pro for Bricks","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:48:05Z"},{"id":"wordfence:4ac29d1c-0aae-4355-90df-24c99d23c411","source":"wordfence","cve":"CVE-2011-4956","title":"WordPress Core <= 3.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac29d1c-0aae-4355-90df-24c99d23c411?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2011-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac3dae6-1890-44ba-9671-84f77807ffe5","source":"wordfence","cve":"","title":"OneLogin SAML SSO <= 2.8.0 - Distributed Denial-of-Service","severity":"high","cvss":7.5,"cwe":"CWE-776","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac3dae6-1890-44ba-9671-84f77807ffe5?source=api-prod","affected":[{"type":"plugin","slug":"onelogin-saml-sso","name":"OneLogin SAML SSO","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2019-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac4472c-ad23-4d05-ad3e-7acbe9a9735c","source":"wordfence","cve":"CVE-2026-112868","title":"Interactive Content \u2013 H5P <= 1.17.9 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac4472c-ad23-4d05-ad3e-7acbe9a9735c?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.17.9","to_inclusive":true,"patched_in":"1.17.10"}],"published":"2026-10-21T18:00:00Z","updated":"2026-10-23T18:38:46Z"},{"id":"wordfence:4ac44e4f-7052-465c-82ab-c3f23a62c898","source":"wordfence","cve":"CVE-2022-1054","title":"RSVP and Event Management <= 2.7.7 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac44e4f-7052-465c-82ab-c3f23a62c898?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac45e56-606a-445f-84ec-349b68109065","source":"wordfence","cve":"CVE-2026-118189","title":"Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac45e56-606a-445f-84ec-349b68109065?source=api-prod","affected":[{"type":"plugin","slug":"posts-data-table","name":"Posts Table with Search & Sort","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2026-11-05T20:29:25Z","updated":"2026-11-06T08:38:07Z"},{"id":"wordfence:4ac57705-24ce-44b5-95d9-972bf58e4cd1","source":"wordfence","cve":"","title":"Page Builder: KingComposer < 2.8.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac57705-24ce-44b5-95d9-972bf58e4cd1?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":false,"patched_in":"2.8.2"}],"published":"2019-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac68b80-31ce-4e61-b3ab-0f43cda64125","source":"wordfence","cve":"CVE-2019-15833","title":"Simple Mail Address Encoder < 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac68b80-31ce-4e61-b3ab-0f43cda64125?source=api-prod","affected":[{"type":"plugin","slug":"simple-mail-address-encoder","name":"Simple Mail Address Encoder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac71fdb-4f1e-4177-a9a2-3776f22e4400","source":"wordfence","cve":"CVE-2025-32651","title":"SERPed.net <= 4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac71fdb-4f1e-4177-a9a2-3776f22e4400?source=api-prod","affected":[{"type":"plugin","slug":"serped-net","name":"SERPed.net","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-04-10T00:00:00Z","updated":"2025-07-03T12:16:53Z"},{"id":"wordfence:4ac7c825-aa5e-42fb-b1df-8be72945941c","source":"wordfence","cve":"CVE-2024-11427","title":"Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac7c825-aa5e-42fb-b1df-8be72945941c?source=api-prod","affected":[{"type":"plugin","slug":"catch-popup","name":"Catch Popup","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:12:40Z","updated":"2024-12-12T03:23:06Z"},{"id":"wordfence:4ac9262a-96a6-439a-a2b0-a05f24654d06","source":"wordfence","cve":"CVE-2023-27452","title":"Button Generator \u2013 easily Button Builder <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac9262a-96a6-439a-a2b0-a05f24654d06?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ac93cae-8c45-4627-a295-10bd3fc7150a","source":"wordfence","cve":"CVE-2026-11361","title":"Formidable Forms <= 6.32.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac93cae-8c45-4627-a295-10bd3fc7150a?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.32.0","to_inclusive":true,"patched_in":"6.32.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-08-17T15:53:58Z"},{"id":"wordfence:4acb4fda-0217-44b9-a85e-64807eb4a011","source":"wordfence","cve":"CVE-2024-10437","title":"WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4acb4fda-0217-44b9-a85e-64807eb4a011?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-messages","name":"WPC Smart Messages for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-10-28T20:36:27Z","updated":"2024-10-29T09:31:30Z"},{"id":"wordfence:4acc1fd2-0024-4c35-b8c6-94203b91e985","source":"wordfence","cve":"CVE-2024-33542","title":"Crelly Slider <= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4acc1fd2-0024-4c35-b8c6-94203b91e985?source=api-prod","affected":[{"type":"plugin","slug":"crelly-slider","name":"Crelly Slider","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-31T18:49:20Z"},{"id":"wordfence:4acdf17a-c249-4317-bd4a-1f4b6c66ce15","source":"wordfence","cve":"CVE-2026-19052","title":"ProSolution WP Client <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4acdf17a-c249-4317-bd4a-1f4b6c66ce15?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:44:20Z"},{"id":"wordfence:4ad02efa-4edb-485c-8fc4-79a030597d70","source":"wordfence","cve":"CVE-2025-39566","title":"Hostel <= 1.1.5.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad02efa-4edb-485c-8fc4-79a030597d70?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.6","to_inclusive":true,"patched_in":"1.1.5.7"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:15:32Z"},{"id":"wordfence:4ad16964-3d0a-4769-a167-5ec62486bfe9","source":"wordfence","cve":"","title":"Educare <= 1.4.6 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad16964-3d0a-4769-a167-5ec62486bfe9?source=api-prod","affected":[{"type":"plugin","slug":"educare","name":"Educare \u2013 Students & Result Management System","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2023-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ad32ff7-0557-439d-aa0f-49c5ea4271ab","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetmplfile function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad32ff7-0557-439d-aa0f-49c5ea4271ab?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ad379ad-8733-4015-a892-375604339695","source":"wordfence","cve":"CVE-2015-6522","title":"WP Symposium <= 15.8 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad379ad-8733-4015-a892-375604339695?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"15.8","to_inclusive":false,"patched_in":"15.8"}],"published":"2015-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ad3ed6b-19d4-47c7-a56c-54092c767fe9","source":"wordfence","cve":"CVE-2026-16636","title":"FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad3ed6b-19d4-47c7-a56c-54092c767fe9?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.2.95","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-08-05T15:10:22Z","updated":"2026-08-06T03:26:11Z"},{"id":"wordfence:4ad45c7b-63d2-42ae-a7cf-2d60c6c4ae1d","source":"wordfence","cve":"CVE-2016-10891","title":"Activity Log < 2.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad45c7b-63d2-42ae-a7cf-2d60c6c4ae1d?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2016-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ad5ca1c-b8c3-42c0-8170-821ada826cbb","source":"wordfence","cve":"CVE-2026-15992","title":"WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad5ca1c-b8c3-42c0-8170-821ada826cbb?source=api-prod","affected":[{"type":"plugin","slug":"password-requirements","name":"Teydea Login Security \u2013 Password Policy, Complexity Rules & Expiration","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-07-27T19:12:43Z","updated":"2026-07-28T18:35:51Z"},{"id":"wordfence:4ada2055-3c4a-4b6f-8803-2eac8ede5ec7","source":"wordfence","cve":"CVE-2026-2002","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ada2055-3c4a-4b6f-8803-2eac8ede5ec7?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.50.2","to_inclusive":true,"patched_in":"1.50.3"}],"published":"2026-02-16T16:02:17Z","updated":"2026-02-17T04:35:45Z"},{"id":"wordfence:4ada476b-6978-4c38-a5d3-67266a709a3e","source":"wordfence","cve":"CVE-2026-0678","title":"Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ada476b-6978-4c38-a5d3-67266a709a3e?source=api-prod","affected":[{"type":"plugin","slug":"flat-shipping-rate-by-city-for-woocommerce","name":"Shipping Rates by City for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:50:20Z","updated":"2026-01-14T05:28:08Z"},{"id":"wordfence:4adb7436-11e6-4512-b6c9-551402909bf0","source":"wordfence","cve":"CVE-2024-13643","title":"Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4adb7436-11e6-4512-b6c9-551402909bf0?source=api-prod","affected":[{"type":"theme","slug":"zox-news","name":"Zox News","from":"*","from_inclusive":true,"to":"3.17.0","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2025-02-10T19:17:49Z","updated":"2026-04-24T15:29:04Z"},{"id":"wordfence:4ae3ad65-54d7-4ee0-894f-8ffd9fa8ac35","source":"wordfence","cve":"CVE-2013-3476","title":"Related Posts < 2.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ae3ad65-54d7-4ee0-894f-8ffd9fa8ac35?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-23-related-posts-plugin","name":"WordPress Related Posts","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ae41106-c61f-45de-88d8-6dfa2347495c","source":"wordfence","cve":"CVE-2024-43119","title":"Aruba HiSpeed Cache <= 2.0.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ae41106-c61f-45de-88d8-6dfa2347495c?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:31:38Z"},{"id":"wordfence:4aebd497-d3c7-4a85-bde4-07e8eade836f","source":"wordfence","cve":"CVE-2024-38728","title":"Seraphinite Post .DOCX Source <= 2.16.9 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aebd497-d3c7-4a85-bde4-07e8eade836f?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-post-docx-source","name":"Seraphinite Post .DOCX Source","from":"*","from_inclusive":true,"to":"2.16.9","to_inclusive":true,"patched_in":"2.16.10"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-19T13:52:31Z"},{"id":"wordfence:4aec0bf3-82d7-4479-8bd6-941404b6bd03","source":"wordfence","cve":"CVE-2024-31354","title":"Slideshow Gallery <= 1.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aec0bf3-82d7-4479-8bd6-941404b6bd03?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-04-07T00:00:00Z","updated":"2024-05-15T17:32:42Z"},{"id":"wordfence:4aec9958-78ee-40d3-b78e-3515836459ef","source":"wordfence","cve":"CVE-2026-81804","title":"ZHBackup \u2013 Backup, Restore & Migration <= 2.4.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aec9958-78ee-40d3-b78e-3515836459ef?source=api-prod","affected":[{"type":"plugin","slug":"zhbackup","name":"ZHBackup \u2013 Backup, Restore & Migration","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:19:13Z"},{"id":"wordfence:4aedc055-34f7-48aa-90d4-0c16f219f599","source":"wordfence","cve":"CVE-2024-10566","title":"Slider by 10Web <= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aedc055-34f7-48aa-90d4-0c16f219f599?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.61","to_inclusive":true,"patched_in":"1.2.62"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-15T15:10:28Z"},{"id":"wordfence:4af00f03-200f-4980-82c7-a12d99b51c4f","source":"wordfence","cve":"CVE-2026-90950","title":"Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af00f03-200f-4980-82c7-a12d99b51c4f?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:18:13Z"},{"id":"wordfence:4af04219-26c5-401d-94ef-11d2321f98bf","source":"wordfence","cve":"CVE-2023-5662","title":"Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af04219-26c5-401d-94ef-11d2321f98bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-sponsors","name":"Sponsors","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2023-11-10T00:00:00Z","updated":"2024-05-21T19:09:39Z"},{"id":"wordfence:4af0e984-896d-4938-a870-8a50644d4823","source":"wordfence","cve":"CVE-2025-22510","title":"WC Price History for Omnibus <= 2.1.4 - Authenticated (Shop manager+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af0e984-896d-4938-a870-8a50644d4823?source=api-prod","affected":[{"type":"plugin","slug":"wc-price-history","name":"WC Price History","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:52:45Z"},{"id":"wordfence:4af2b01b-2dcb-44ae-a764-8ecc5f8caa81","source":"wordfence","cve":"CVE-2024-32111","title":"WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2b01b-2dcb-44ae-a764-8ecc5f8caa81?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.40","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.37","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.33","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.32","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.31","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.28","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.28","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.24","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.25","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.21","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.18","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.20","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.17","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.15","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.14","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.13","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.11","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.9","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"4.1.41"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"4.1.41"}],"published":"2024-06-24T00:00:00Z","updated":"2024-06-25T17:01:09Z"},{"id":"wordfence:4af2f136-5806-4d5e-a72d-486c4839a695","source":"wordfence","cve":"CVE-2025-6550","title":"The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2f136-5806-4d5e-a72d-486c4839a695?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-06-26T19:07:13Z","updated":"2025-07-08T21:56:23Z"},{"id":"wordfence:4af41f69-1335-4199-bf29-c9699de50a16","source":"wordfence","cve":"CVE-2024-13720","title":"WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af41f69-1335-4199-bf29-c9699de50a16?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-uploader","name":"WP Image Uploader","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:41:57Z"},{"id":"wordfence:4af4b971-7304-47c9-8d01-eae36e40c45c","source":"wordfence","cve":"CVE-2019-19542","title":"ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af4b971-7304-47c9-8d01-eae36e40c45c?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.0.14.4","to_inclusive":true,"patched_in":"2.0.14.5"}],"published":"2019-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4af66bb2-febe-4022-9526-39b1ecd8b01d","source":"wordfence","cve":"CVE-2024-11780","title":"Site Search 360 <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af66bb2-febe-4022-9526-39b1ecd8b01d?source=api-prod","affected":[{"type":"plugin","slug":"site-search-360","name":"Site Search 360","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:12Z"},{"id":"wordfence:4af762d6-bc93-4724-b27d-4873a8bb4f38","source":"wordfence","cve":"CVE-2026-65561","title":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af762d6-bc93-4724-b27d-4873a8bb4f38?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":true,"patched_in":"7.8.1"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-29T11:58:46Z"},{"id":"wordfence:4af801db-44a6-4cd3-bd1a-3125490c8c48","source":"wordfence","cve":"CVE-2023-6979","title":"Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af801db-44a6-4cd3-bd1a-3125490c8c48?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.38.9","to_inclusive":true,"patched_in":"5.38.10"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:36:19Z"},{"id":"wordfence:4af83d4b-2eae-481f-b3fd-d5bcacc1d709","source":"wordfence","cve":"CVE-2022-2542","title":"uContext for Clickbank <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af83d4b-2eae-481f-b3fd-d5bcacc1d709?source=api-prod","affected":[{"type":"plugin","slug":"ucontext","name":"uContext for Clickbank","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4af920a9-15fb-44c9-be31-7c9ed5bc2031","source":"wordfence","cve":"CVE-2025-2076","title":"binlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af920a9-15fb-44c9-be31-7c9ed5bc2031?source=api-prod","affected":[{"type":"plugin","slug":"binlayerpress","name":"binlayerpress","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T14:22:31Z","updated":"2025-03-12T03:21:27Z"},{"id":"wordfence:4af9895f-2cd2-48b9-820a-3a5e0e28e046","source":"wordfence","cve":"CVE-2025-63028","title":"Traveler <= 3.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af9895f-2cd2-48b9-820a-3a5e0e28e046?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-11-07T00:00:00Z","updated":"2025-12-10T16:13:44Z"},{"id":"wordfence:4af9c623-1539-4afc-9dcd-3f97d29aa4f3","source":"wordfence","cve":"CVE-2024-5219","title":"Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4af9c623-1539-4afc-9dcd-3f97d29aa4f3?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.11.15","to_inclusive":true,"patched_in":"1.11.16"}],"published":"2024-07-01T17:56:24Z","updated":"2024-07-02T06:49:44Z"},{"id":"wordfence:4afa0148-ad08-493d-9642-0edbde5e8349","source":"wordfence","cve":"CVE-2024-11431","title":"Ragic Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afa0148-ad08-493d-9642-0edbde5e8349?source=api-prod","affected":[{"type":"plugin","slug":"ragic-shortcode","name":"Ragic Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T08:47:31Z"},{"id":"wordfence:4afb151c-4e6b-4441-a190-becd4fe78019","source":"wordfence","cve":"CVE-2024-47337","title":"Joy Of Text Lite <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afb151c-4e6b-4441-a190-becd4fe78019?source=api-prod","affected":[{"type":"plugin","slug":"joy-of-text","name":"Joy Of Text Lite \u2013 SMS messaging for WordPress.","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:05:34Z"},{"id":"wordfence:4afb25d5-dce1-4a7a-8afe-0fc2a384b945","source":"wordfence","cve":"CVE-2023-23900","title":"Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting via 'sql_error'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afb25d5-dce1-4a7a-8afe-0fc2a384b945?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.8.9"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4afbe34b-121e-41d2-ab12-c3d70a0d80d5","source":"wordfence","cve":"CVE-2024-2404","title":"Better Comments <= 1.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afbe34b-121e-41d2-ab12-c3d70a0d80d5?source=api-prod","affected":[{"type":"plugin","slug":"better-comments","name":"Better Comments","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-04-03T00:00:00Z","updated":"2024-05-01T13:36:40Z"},{"id":"wordfence:4afc8de7-0d7e-4dee-972e-3eb707cd7b2b","source":"wordfence","cve":"CVE-2024-10343","title":"Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afc8de7-0d7e-4dee-972e-3eb707cd7b2b?source=api-prod","affected":[{"type":"plugin","slug":"beek-widget-extention","name":"Beek Widget Extention","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T08:34:40Z"},{"id":"wordfence:4afea729-a7d9-4b38-a0f5-5af2c31bfbb9","source":"wordfence","cve":"CVE-2024-0855","title":"Spiffy Calendar <= 4.9.8 - Insufficient Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4afea729-a7d9-4b38-a0f5-5af2c31bfbb9?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"4.9.9"}],"published":"2024-01-12T00:00:00Z","updated":"2024-03-22T17:08:37Z"},{"id":"wordfence:4aff8870-4222-454a-90cd-044784cb4224","source":"wordfence","cve":"CVE-2022-3768","title":"WPSmartContracts <= 1.3.11 - Authenticated (Author+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4aff8870-4222-454a-90cd-044784cb4224?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-contracts","name":"WPSmartContracts","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b002e40-712d-4c3f-b168-9132e7b77e60","source":"wordfence","cve":"CVE-2024-0698","title":"Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b002e40-712d-4c3f-b168-9132e7b77e60?source=api-prod","affected":[{"type":"plugin","slug":"easyappointments","name":"Easy!Appointments","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-03-04T00:00:00Z","updated":"2024-07-29T21:36:19Z"},{"id":"wordfence:4b02d76b-9c9d-4ed7-964f-657ad59ba4b1","source":"wordfence","cve":"CVE-2026-66612","title":"Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b02d76b-9c9d-4ed7-964f-657ad59ba4b1?source=api-prod","affected":[{"type":"theme","slug":"aora","name":"Aora - Home & Lifestyle Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:06:43Z"},{"id":"wordfence:4b03f888-eb12-4ddf-b955-c5b0ee45ab33","source":"wordfence","cve":"CVE-2026-109925","title":"Productive Commerce <= 1.1.53 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b03f888-eb12-4ddf-b955-c5b0ee45ab33?source=api-prod","affected":[{"type":"plugin","slug":"productive-commerce","name":"Productive Commerce \u2013 Wishlist, Compare & MiniCart","from":"*","from_inclusive":true,"to":"1.1.53","to_inclusive":true,"patched_in":"1.1.54"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:13:13Z"},{"id":"wordfence:4b0445ce-614b-4948-a48c-c1b95cc7f043","source":"wordfence","cve":"CVE-2026-17032","title":"Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0445ce-614b-4948-a48c-c1b95cc7f043?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy-pro","name":"Google Maps Easy Pro","from":"1.6.0","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"},{"type":"plugin","slug":"supsystic-gallery-pro","name":"Supsystic Gallery Pro","from":"2.10.9","from_inclusive":true,"to":"2.10.9","to_inclusive":true,"patched_in":"2.10.11"},{"type":"plugin","slug":"tables-generator-pro","name":"Tables Generator Pro","from":"1.9.20","from_inclusive":true,"to":"1.9.20","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2026-07-24T00:00:00Z","updated":"2026-09-03T16:47:56Z"},{"id":"wordfence:4b06792e-0b4e-4c1e-b7e9-8cbbae343298","source":"wordfence","cve":"","title":"wpCentral <= 1.4.7 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b06792e-0b4e-4c1e-b7e9-8cbbae343298?source=api-prod","affected":[{"type":"plugin","slug":"wp-central","name":"wpCentral","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2020-01-24T00:00:00Z","updated":"2024-06-17T18:31:18Z"},{"id":"wordfence:4b07ed75-6ee3-4a1a-b165-439a9135b059","source":"wordfence","cve":"CVE-2025-13666","title":"Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b07ed75-6ee3-4a1a-b165-439a9135b059?source=api-prod","affected":[{"type":"plugin","slug":"helloprint","name":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:34:37Z","updated":"2025-12-06T05:49:27Z"},{"id":"wordfence:4b096abd-b2ae-4f00-9991-f5e02f548e29","source":"wordfence","cve":"CVE-2024-54235","title":"Shiptimize for WooCommerce <= 3.1.86 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b096abd-b2ae-4f00-9991-f5e02f548e29?source=api-prod","affected":[{"type":"plugin","slug":"shiptimize-for-woocommerce","name":"Shiptimize for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.86","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:25:49Z"},{"id":"wordfence:4b098711-ed01-4a71-b0df-30ff4fffa930","source":"wordfence","cve":"CVE-2025-11427","title":"WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b098711-ed01-4a71-b0df-30ff4fffa930?source=api-prod","affected":[{"type":"plugin","slug":"wp-migrate-db","name":"WP Migrate Lite \u2013 Migration Made Easy","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-11-17T22:17:25Z","updated":"2026-01-13T15:11:30Z"},{"id":"wordfence:4b0aa44f-abe3-44c0-a43a-aacdaaa378cd","source":"wordfence","cve":"","title":"WP Email Delivery <= 1.20.11.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0aa44f-abe3-44c0-a43a-aacdaaa378cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-delivery","name":"WP Email Delivery","from":"*","from_inclusive":true,"to":"1.20.11.23","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:08:58Z"},{"id":"wordfence:4b0b13b4-b604-4514-845e-05a3b8858c66","source":"wordfence","cve":"CVE-2025-10308","title":"Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery  to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0b13b4-b604-4514-845e-05a3b8858c66?source=api-prod","affected":[{"type":"plugin","slug":"astro-booking-engine","name":"Astro Booking Engine","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-14T04:26:20Z"},{"id":"wordfence:4b0d7ee7-a358-4487-a0cc-31ed810ae8bc","source":"wordfence","cve":"CVE-2024-8682","title":"JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0d7ee7-a358-4487-a0cc-31ed810ae8bc?source=api-prod","affected":[{"type":"theme","slug":"jnews","name":"JNews - WordPress Newspaper Magazine Blog AMP Theme","from":"*","from_inclusive":true,"to":"11.6.6","to_inclusive":true,"patched_in":"11.6.7"}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T08:21:55Z"},{"id":"wordfence:4b0e763e-f03e-41fb-8c6c-4de5d3acae00","source":"wordfence","cve":"CVE-2023-3460","title":"Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0e763e-f03e-41fb-8c6c-4de5d3acae00?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2023-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b0edbf1-bbd2-4e63-86f3-898ad6666d7b","source":"wordfence","cve":"CVE-2025-47631","title":"Hospital Management System <= 47.0(20-11-2023) - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0edbf1-bbd2-4e63-86f3-898ad6666d7b?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:05:34Z"},{"id":"wordfence:4b0f0db2-13bc-48fd-b78c-9e0eb644aec1","source":"wordfence","cve":"CVE-2025-23893","title":"GMap Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0f0db2-13bc-48fd-b78c-9e0eb644aec1?source=api-prod","affected":[{"type":"plugin","slug":"gmap-shortcode","name":"GMap Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:47:15Z"},{"id":"wordfence:4b0f5c2c-f01a-4a09-99c2-2b7dfe3bcd05","source":"wordfence","cve":"CVE-2021-24615","title":"Wechat Reward <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0f5c2c-f01a-4a09-99c2-2b7dfe3bcd05?source=api-prod","affected":[{"type":"plugin","slug":"wechat-reward","name":"\u5fae\u4fe1\u6253\u8d4f\uff08Wechat Reward\uff09","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b13388b-19f9-4f5c-9599-efd6ccf978c8","source":"wordfence","cve":"CVE-2023-48744","title":"Availability Calendar <= 1.2.6 - Cross-Site Request Forgery via add_availability_calendar_create_admin_page()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b13388b-19f9-4f5c-9599-efd6ccf978c8?source=api-prod","affected":[{"type":"plugin","slug":"availability-calendar","name":"Availability Calendar","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b1568d6-4fea-4ed3-9931-f293932eaa3a","source":"wordfence","cve":"","title":"Power's WHOIS Domain Check <= 0.9.31 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1568d6-4fea-4ed3-9931-f293932eaa3a?source=api-prod","affected":[{"type":"plugin","slug":"powies-whois","name":"Powie\u2019s WHOIS Domain Check","from":"*","from_inclusive":true,"to":"0.9.31","to_inclusive":true,"patched_in":"0.9.32"}],"published":"2020-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b157be6-bb8e-4be2-8414-f40772dec5f1","source":"wordfence","cve":"CVE-2026-125046","title":"Create <= 3.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b157be6-bb8e-4be2-8414-f40772dec5f1?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:25Z"},{"id":"wordfence:4b159d4f-494e-4ab4-8ed7-3421b437597e","source":"wordfence","cve":"CVE-2021-24857","title":"ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b159d4f-494e-4ab4-8ed7-3421b437597e?source=api-prod","affected":[{"type":"plugin","slug":"totop-link","name":"ToTop Link","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b15c991-5256-405c-8382-85dba6f032ba","source":"wordfence","cve":"CVE-2025-14071","title":"Live Composer \u2013 Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b15c991-5256-405c-8382-85dba6f032ba?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-12-20T14:10:30Z","updated":"2025-12-21T02:20:31Z"},{"id":"wordfence:4b170ed1-72ee-40b6-9882-e978d630f6bb","source":"wordfence","cve":"CVE-2025-14507","title":"EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b170ed1-72ee-40b6-9882-e978d630f6bb?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.7.0","to_inclusive":true,"patched_in":"4.2.8.0"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-13T13:49:14Z"},{"id":"wordfence:4b1944a9-4bc4-4ac2-83c3-55d6d61f405c","source":"wordfence","cve":"CVE-2024-13542","title":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1944a9-4bc4-4ac2-83c3-55d6d61f405c?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-street-view","name":"WP Google Street View (with 360\u00b0 virtual tour) & Google maps + Local SEO","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:4b19657c-3e95-42cf-8d1a-64fa50b3b82b","source":"wordfence","cve":"CVE-2023-48274","title":"WCMultiShipping <= 2.3.5 - Missing Authorization to Log Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b19657c-3e95-42cf-8d1a-64fa50b3b82b?source=api-prod","affected":[{"type":"plugin","slug":"wc-multishipping","name":"WCMultiShipping \u2014 Mondial Relay, Inpost & Chronopost for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b1c0ee5-5329-411c-8030-14bec586d74d","source":"wordfence","cve":"CVE-2023-27633","title":"Customify <=  2.10.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1c0ee5-5329-411c-8030-14bec586d74d?source=api-prod","affected":[{"type":"plugin","slug":"customify","name":"Customify","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b1e4e4c-379f-41d7-a63a-868830c95af9","source":"wordfence","cve":"CVE-2025-22592","title":"1003 Mortgage Application <= 1.87 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b1e4e4c-379f-41d7-a63a-868830c95af9?source=api-prod","affected":[{"type":"plugin","slug":"1003-mortgage-application","name":"1003 Mortgage Application","from":"*","from_inclusive":true,"to":"1.87","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:14:05Z"},{"id":"wordfence:4b225e5e-7207-4af4-b023-ad23fd540d56","source":"wordfence","cve":"CVE-2023-23825","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Cross-Site Request Forgery to WPForm/Blocks Import","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b225e5e-7207-4af4-b023-ad23fd540d56?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b24b3d2-589f-47b2-bcdd-bebc87cafeda","source":"wordfence","cve":"CVE-2025-1971","title":"Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b24b3d2-589f-47b2-bcdd-bebc87cafeda?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-21T23:17:34Z","updated":"2025-03-22T11:18:42Z"},{"id":"wordfence:4b2684ce-980e-449e-8003-d1b34af33f17","source":"wordfence","cve":"CVE-2026-119494","title":"Site Reviews <= 8.3.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2684ce-980e-449e-8003-d1b34af33f17?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.3.6","to_inclusive":true,"patched_in":"8.3.7"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:52:03Z"},{"id":"wordfence:4b26cf2f-61dc-4fdd-921b-21654f94eac0","source":"wordfence","cve":"CVE-2022-47429","title":"Coming Soon Landing Page and Maintenance Mode WordPress Plugin <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b26cf2f-61dc-4fdd-921b-21654f94eac0?source=api-prod","affected":[{"type":"plugin","slug":"8-degree-coming-soon-page","name":"Coming Soon Landing Page and Maintenance Mode WordPress Plugin","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2025-01-17T13:10:28Z"},{"id":"wordfence:4b27a6e6-bdd2-4022-91a1-7ef5fe8109f7","source":"wordfence","cve":"CVE-2024-54416","title":"Wp Login with Ajax <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b27a6e6-bdd2-4022-91a1-7ef5fe8109f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-with-ajax","name":"Wp Login with Ajax","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:34:05Z"},{"id":"wordfence:4b28ac94-fc84-4560-bffd-273566cc0f91","source":"wordfence","cve":"CVE-2026-101324","title":"Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b28ac94-fc84-4560-bffd-273566cc0f91?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"6.2.15"}],"published":"2026-10-09T15:42:51Z","updated":"2026-10-10T04:26:44Z"},{"id":"wordfence:4b2bd577-a4a8-4999-b751-a6f52a12d019","source":"wordfence","cve":"CVE-2025-66140","title":"Uper for Elementor <= 1.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2bd577-a4a8-4999-b751-a6f52a12d019?source=api-prod","affected":[{"type":"plugin","slug":"uper-elementor","name":"Uper \u2013 Back to Top Button for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-15T16:50:14Z"},{"id":"wordfence:4b2c3987-fe7e-426d-8398-acdd6fa3a3dd","source":"wordfence","cve":"CVE-2025-14476","title":"Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2c3987-fe7e-426d-8398-acdd6fa3a3dd?source=api-prod","affected":[{"type":"plugin","slug":"doubly","name":"Doubly \u2013 Cross Domain Copy Paste for WordPress","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.47"}],"published":"2025-12-12T16:08:49Z","updated":"2026-01-06T20:56:21Z"},{"id":"wordfence:4b2d685f-0426-4837-bf96-07ebda499bed","source":"wordfence","cve":"CVE-2025-47696","title":"Blog Designer PRO for WordPress <= 3.4.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2d685f-0426-4837-bf96-07ebda499bed?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pro","name":"Blog Designer PRO for WordPress","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:10:41Z"},{"id":"wordfence:4b2eb0e8-98b6-4a97-9825-0be4032b5d4e","source":"wordfence","cve":"CVE-2021-24235","title":"Goto - Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2eb0e8-98b6-4a97-9825-0be4032b5d4e?source=api-prod","affected":[{"type":"theme","slug":"goto","name":"Goto - Tour & Travel WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701","source":"wordfence","cve":"CVE-2026-15425","title":"Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"28.0","to_inclusive":true,"patched_in":"28.1"}],"published":"2026-07-24T17:58:17Z","updated":"2026-11-13T16:46:39Z"},{"id":"wordfence:4b2fa6c3-8a5d-47ad-9b6b-3ed0ba322a49","source":"wordfence","cve":"CVE-2025-22764","title":"WP Post Corrector <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa6c3-8a5d-47ad-9b6b-3ed0ba322a49?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-corrector","name":"WP Post Corrector","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:44:36Z"},{"id":"wordfence:4b2fc891-f3c6-4f4f-ad52-0a1a949eed25","source":"wordfence","cve":"CVE-2026-0912","title":"Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fc891-f3c6-4f4f-ad52-0a1a949eed25?source=api-prod","affected":[{"type":"plugin","slug":"toret-manager","name":"Toret Manager","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-18T15:52:51Z","updated":"2026-02-26T06:42:04Z"},{"id":"wordfence:4b32cfa8-6e10-4f09-859e-216c94a6560c","source":"wordfence","cve":"CVE-2026-7437","title":"AzonPost <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b32cfa8-6e10-4f09-859e-216c94a6560c?source=api-prod","affected":[{"type":"plugin","slug":"azonpost","name":"AzonPost","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:06:23Z","updated":"2026-05-12T07:48:20Z"},{"id":"wordfence:4b32e8b6-0365-411c-b262-12fe46521b73","source":"wordfence","cve":"CVE-2025-30898","title":"persian-woocommerce-shipping <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b32e8b6-0365-411c-b262-12fe46521b73?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-shipping","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u062d\u0645\u0644 \u0648 \u0646\u0642\u0644 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | \u067e\u0633\u062a \u067e\u06cc\u0634\u062a\u0627\u0632\u060c \u062a\u06cc\u067e\u0627\u06a9\u0633 \u0648 \u067e\u06cc\u06a9 \u0645\u0648\u062a\u0648\u0631\u06cc","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:12:48Z"},{"id":"wordfence:4b334ebe-6988-4caf-aad4-b599dc6be969","source":"wordfence","cve":"CVE-2024-12800","title":"IP Based Login <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b334ebe-6988-4caf-aad4-b599dc6be969?source=api-prod","affected":[{"type":"plugin","slug":"ip-based-login","name":"IP Based Login","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-13T14:40:23Z"},{"id":"wordfence:4b3380a1-ef0f-471f-b016-16f3431fb619","source":"wordfence","cve":"CVE-2025-58868","title":"SimaCookie <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b3380a1-ef0f-471f-b016-16f3431fb619?source=api-prod","affected":[{"type":"plugin","slug":"simasicher-dsgvo-cookie","name":"SimaCookie","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:19:08Z"},{"id":"wordfence:4b34ad23-246e-42ba-89de-5985043848be","source":"wordfence","cve":"CVE-2026-12936","title":"Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b34ad23-246e-42ba-89de-5985043848be?source=api-prod","affected":[{"type":"plugin","slug":"recurio","name":"Recurio \u2013 Ultimate Subscription for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-07-07T22:42:43Z","updated":"2026-07-13T20:11:49Z"},{"id":"wordfence:4b34dd60-359c-44a0-9e47-dc8c4e66b50e","source":"wordfence","cve":"CVE-2019-6715","title":"W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b34dd60-359c-44a0-9e47-dc8c4e66b50e?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"0.9.2.6","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":"0.9.4"}],"published":"2020-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b3786d2-b1b5-4d96-9ef7-957909061186","source":"wordfence","cve":"CVE-2021-4222","title":"WP Paginate <= 2.1.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b3786d2-b1b5-4d96-9ef7-957909061186?source=api-prod","affected":[{"type":"plugin","slug":"wp-paginate","name":"WP-Paginate","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2021-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b37b57c-4a11-4971-b38f-12c70d71b76b","source":"wordfence","cve":"CVE-2023-51543","title":"RegistrationMagic <= 5.2.5.0 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b37b57c-4a11-4971-b38f-12c70d71b76b?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.5.0","to_inclusive":true,"patched_in":"5.2.5.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b389604-a999-45a1-a32f-7f8c951cb94c","source":"wordfence","cve":"CVE-2014-5265","title":"WordPress Core < 3.9.2 - Denial of Service via XML","severity":"low","cvss":2.7,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b389604-a999-45a1-a32f-7f8c951cb94c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b39c8e1-f2b7-436d-97d1-2d503d7ac835","source":"wordfence","cve":"CVE-2015-9330","title":"Import any XML or CSV File to WordPress < 3.2.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b39c8e1-f2b7-436d-97d1-2d503d7ac835?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2015-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b40e33b-4aa8-4378-b044-a8a636d34f73","source":"wordfence","cve":"","title":"Referrer Detector <= 4.2.1.0 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b40e33b-4aa8-4378-b044-a8a636d34f73?source=api-prod","affected":[{"type":"plugin","slug":"referrer-detector","name":"Referrer Detector","from":"*","from_inclusive":true,"to":"4.2.1.0","to_inclusive":true,"patched_in":""}],"published":"2017-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b41a736-5851-4dc6-8597-48e6782f23a2","source":"wordfence","cve":"CVE-2025-32490","title":"wp secure <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41a736-5851-4dc6-8597-48e6782f23a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-secure-by-sitesecuritymonitorcom","name":"wp secure","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:10:57Z"},{"id":"wordfence:4b41d134-be9e-469f-b26b-ac30d95db0a3","source":"wordfence","cve":"CVE-2025-6184","title":"Tutor LMS Pro \u2013 eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-08-12T18:27:44Z","updated":"2025-08-13T06:39:50Z"},{"id":"wordfence:4b42ba6a-b618-4633-9372-879c3253a956","source":"wordfence","cve":"CVE-2024-30433","title":"WC Marketplace <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b42ba6a-b618-4633-9372-879c3253a956?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:29:42Z"},{"id":"wordfence:4b430f98-255b-454f-97f5-2d2c9a572225","source":"wordfence","cve":"","title":"Germanized for WooCommerce <= 3.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b430f98-255b-454f-97f5-2d2c9a572225?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-germanized","name":"Germanized for WooCommerce","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b4369f8-d3d2-4018-a262-3294b5865086","source":"wordfence","cve":"CVE-2024-30427","title":"Spiffy Calendar <= 4.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4369f8-d3d2-4018-a262-3294b5865086?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.10"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:35:18Z"},{"id":"wordfence:4b468c0b-88ac-4ea8-97a9-08e206faf0fb","source":"wordfence","cve":"","title":"Quiz And Survey Master <= 7.1.18 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b468c0b-88ac-4ea8-97a9-08e206faf0fb?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.1.19","to_inclusive":false,"patched_in":"7.1.19"}],"published":"2021-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b47478f-3bd5-4eda-897f-4570aea4530a","source":"wordfence","cve":"CVE-2022-4649","title":"WP Extended Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b47478f-3bd5-4eda-897f-4570aea4530a?source=api-prod","affected":[{"type":"plugin","slug":"wp-extended-search","name":"WP Extended Search","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b475ada-3b31-40a3-9a81-5a7b1a1e190a","source":"wordfence","cve":"CVE-2023-31212","title":"Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b475ada-3b31-40a3-9a81-5a7b1a1e190a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b4830f3-2d8d-46ab-b317-a0b45a0d3501","source":"wordfence","cve":"CVE-2024-12768","title":"Responsive iframe <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4830f3-2d8d-46ab-b317-a0b45a0d3501?source=api-prod","affected":[{"type":"plugin","slug":"responsive-iframe","name":"Responsive iframe","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-25T16:45:34Z"},{"id":"wordfence:4b4a7f4f-3461-41cc-930b-dfce9590f671","source":"wordfence","cve":"CVE-2025-24576","title":"Landing Page Cat \u2013 Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4a7f4f-3461-41cc-930b-dfce9590f671?source=api-prod","affected":[{"type":"plugin","slug":"landing-page-cat","name":"Landing Page Cat \u2013 Coming Soon & Maintenance Pages","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-12-17T00:00:00Z","updated":"2025-02-21T14:20:51Z"},{"id":"wordfence:4b4d3454-c83f-4a13-9764-163c53ede744","source":"wordfence","cve":"CVE-2026-28094","title":"RexCoin <= 1.2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4d3454-c83f-4a13-9764-163c53ede744?source=api-prod","affected":[{"type":"theme","slug":"rexcoin","name":"RexCoin - Cryptocurrency & Coin ICO WordPress","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:03:39Z"},{"id":"wordfence:4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250","source":"wordfence","cve":"CVE-2026-119977","title":"WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-367","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.38","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.33","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.34","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"4.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"4.7.39"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-31T05:33:07Z"},{"id":"wordfence:4b4de145-bff1-4265-97bf-4085b4112a66","source":"wordfence","cve":"CVE-2024-53772","title":"Mail Picker <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4de145-bff1-4265-97bf-4085b4112a66?source=api-prod","affected":[{"type":"plugin","slug":"mail-picker","name":"PickPlugins Mail Picker \u2014 Email Marketing & Newsletters","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2024-11-28T00:00:00Z","updated":"2026-01-13T17:00:04Z"},{"id":"wordfence:4b5078ca-dec9-4252-8dd9-42bbb9ddef55","source":"wordfence","cve":"CVE-2025-57956","title":"WooMS <= 9.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5078ca-dec9-4252-8dd9-42bbb9ddef55?source=api-prod","affected":[{"type":"plugin","slug":"wooms","name":"WooMS","from":"*","from_inclusive":true,"to":"9.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:00:57Z"},{"id":"wordfence:4b51d69d-2026-4e2c-b031-93046c24b2dd","source":"wordfence","cve":"CVE-2024-44045","title":"WP Abstracts <= 2.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b51d69d-2026-4e2c-b031-93046c24b2dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T20:01:09Z"},{"id":"wordfence:4b585243-943d-48d4-bee3-407ff3ae8078","source":"wordfence","cve":"CVE-2024-56040","title":"VibeBP <= 1.9.9.4.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b585243-943d-48d4-bee3-407ff3ae8078?source=api-prod","affected":[{"type":"plugin","slug":"vibebp","name":"VibeBP","from":"*","from_inclusive":true,"to":"1.9.9.4.1","to_inclusive":true,"patched_in":"1.9.9.5"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:24:21Z"},{"id":"wordfence:4b5a3655-067f-4ef1-baf5-2bbc9719a8cd","source":"wordfence","cve":"CVE-2024-33538","title":"Assistant \u2013 Every Day Productivity Apps <= 1.4.9.1 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5a3655-067f-4ef1-baf5-2bbc9719a8cd?source=api-prod","affected":[{"type":"plugin","slug":"assistant","name":"Assistant \u2013 Every Day Productivity Apps","from":"*","from_inclusive":true,"to":"1.4.9.1","to_inclusive":true,"patched_in":"1.4.9.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:12:56Z"},{"id":"wordfence:4b5ba815-ce92-4d7b-aa80-29d6fddd7f63","source":"wordfence","cve":"CVE-2024-13814","title":"Global Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=api-prod","affected":[{"type":"plugin","slug":"global-gallery","name":"Global Gallery - WordPress Responsive Gallery","from":"*","from_inclusive":true,"to":"9.1.5","to_inclusive":true,"patched_in":"9.1.6"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T08:25:45Z"},{"id":"wordfence:4b5d1190-3c1e-4cb8-b64b-894ffb1b1f38","source":"wordfence","cve":"CVE-2024-39636","title":"Better Find and Replace <= 1.6.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.3,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5d1190-3c1e-4cb8-b64b-894ffb1b1f38?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-09T20:48:38Z"},{"id":"wordfence:4b5fbf2c-1231-482f-b5a5-819f31da3524","source":"wordfence","cve":"CVE-2026-6396","title":"Fast & Fancy Filter \u2013 3F <= 1.2.2 - Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5fbf2c-1231-482f-b5a5-819f31da3524?source=api-prod","affected":[{"type":"plugin","slug":"fast-fancy-filter-3f","name":"Fast & Fancy Filter \u2013 3F","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:03:01Z","updated":"2026-04-22T07:45:34Z"},{"id":"wordfence:4b6021d2-cbfd-42d9-84d8-6db0f28828ff","source":"wordfence","cve":"","title":"Post Gallery <= 1.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6021d2-cbfd-42d9-84d8-6db0f28828ff?source=api-prod","affected":[{"type":"plugin","slug":"post-gallery","name":"Post Gallery","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2013-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b60c1e2-5a4b-4a7a-8224-f1afd3888e08","source":"wordfence","cve":"CVE-2023-49174","title":"Responsive Lightbox <= 2.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b60c1e2-5a4b-4a7a-8224-f1afd3888e08?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b651f40-f61b-4312-8e9b-ad8d4becdf43","source":"wordfence","cve":"CVE-2025-46502","title":"LSD Custom taxonomy and category meta <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b651f40-f61b-4312-8e9b-ad8d4becdf43?source=api-prod","affected":[{"type":"plugin","slug":"custom-taxonomy-category-and-term-fields","name":"LSD Custom taxonomy and category meta","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:54:03Z"},{"id":"wordfence:4b67c54d-8c84-4e19-beb1-a7148c4a65be","source":"wordfence","cve":"CVE-2025-32525","title":"Interactive Geo Maps <= 1.6.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b67c54d-8c84-4e19-beb1-a7148c4a65be?source=api-prod","affected":[{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.6.24","to_inclusive":true,"patched_in":"1.6.25"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-23T17:43:31Z"},{"id":"wordfence:4b68e8d4-58d4-4753-bda3-60c0d874f822","source":"wordfence","cve":"CVE-2022-2370","title":"YaySMTP \u2013 Simple WP SMTP Mail <= 2.2 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b68e8d4-58d4-4753-bda3-60c0d874f822?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b68eed4-0d2f-441b-88be-f0e4f5d35cff","source":"wordfence","cve":"CVE-2024-37465","title":"GPT3 AI Content Writer <= 1.8.66 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b68eed4-0d2f-441b-88be-f0e4f5d35cff?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.66","to_inclusive":true,"patched_in":"1.8.67"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:59:24Z"},{"id":"wordfence:4b6acdeb-8cdf-4526-9772-7dc782726d23","source":"wordfence","cve":"CVE-2025-28938","title":"WP Performance Pack <= 2.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6acdeb-8cdf-4526-9772-7dc782726d23?source=api-prod","affected":[{"type":"plugin","slug":"wp-performance-pack","name":"WP Performance Pack","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-31T16:24:05Z"},{"id":"wordfence:4b6b8b89-13a4-4158-9471-8af86aec0454","source":"wordfence","cve":"CVE-2026-24356","title":"GetGenie <= 4.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6b8b89-13a4-4158-9471-8af86aec0454?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-01-05T00:00:00Z","updated":"2026-02-03T21:00:30Z"},{"id":"wordfence:4b6dc4c5-d2ab-4154-9c54-fc534631f177","source":"wordfence","cve":"CVE-2025-60231","title":"The Hospital <= 1.8.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6dc4c5-d2ab-4154-9c54-fc534631f177?source=api-prod","affected":[{"type":"theme","slug":"nrghospital","name":"nrghospital","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2026-09-18T14:37:40Z"},{"id":"wordfence:4b6e1c70-a112-4564-9e18-bdc2a8028482","source":"wordfence","cve":"CVE-2024-33907","title":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin <= 3.26.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6e1c70-a112-4564-9e18-bdc2a8028482?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.26.2","to_inclusive":true,"patched_in":"3.26.3"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T20:25:50Z"},{"id":"wordfence:4b6f9700-eb29-4391-845c-58e1a2327b0b","source":"wordfence","cve":"CVE-2019-16220","title":"WordPress Core < 5.2.3 - Open Redirect","severity":"medium","cvss":4.6,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b6f9700-eb29-4391-845c-58e1a2327b0b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b704c42-181b-47cb-9df8-3b82f7b830e1","source":"wordfence","cve":"CVE-2016-10916","title":"Appointment Booking Calendar <= 1.1.23 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b704c42-181b-47cb-9df8-3b82f7b830e1?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":false,"patched_in":"1.1.24"}],"published":"2016-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b71a48c-f041-47be-b2e7-6e8b2951e526","source":"wordfence","cve":"CVE-2025-31071","title":"HotStar \u2013 Multi-Purpose Business Theme <= 1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b71a48c-f041-47be-b2e7-6e8b2951e526?source=api-prod","affected":[{"type":"theme","slug":"hotstar","name":"HotStar \u2013 MultiPurpose Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:51:12Z"},{"id":"wordfence:4b71b187-2e05-4bea-9177-cbf66fe08a44","source":"wordfence","cve":"CVE-2020-8435","title":"RegistrationMagic - Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b71b187-2e05-4bea-9177-cbf66fe08a44?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.3","to_inclusive":false,"patched_in":"4.6.0.3"}],"published":"2020-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b78e38b-d16a-4891-96ae-6f6f7138dcc5","source":"wordfence","cve":"CVE-2025-58866","title":"Site Info <= 1.1 - Authenticated (Editor+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b78e38b-d16a-4891-96ae-6f6f7138dcc5?source=api-prod","affected":[{"type":"plugin","slug":"site-info-dashboard-widget","name":"Site Info","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:30:42Z"},{"id":"wordfence:4b796697-5f4b-435f-a63f-1f20afc4182b","source":"wordfence","cve":"CVE-2024-54304","title":"Hive Support \u2013 WordPress Help Desk <= 1.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b796697-5f4b-435f-a63f-1f20afc4182b?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:57:16Z"},{"id":"wordfence:4b7bfc64-dda5-4acd-b00e-ad5f5dc270b5","source":"wordfence","cve":"CVE-2025-23609","title":"Tagesteller / Mittagsmen\u00fc <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b7bfc64-dda5-4acd-b00e-ad5f5dc270b5?source=api-prod","affected":[{"type":"plugin","slug":"tagesteller","name":"Tagesteller / Mittagsmen\u00fc Plugin","from":"*","from_inclusive":true,"to":"v.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T18:13:17Z"},{"id":"wordfence:4b7c7416-16fb-4daf-8cc2-96571e1e24b2","source":"wordfence","cve":"","title":"Task Manager Pro <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b7c7416-16fb-4daf-8cc2-96571e1e24b2?source=api-prod","affected":[{"type":"plugin","slug":"task-manager-pro","name":"Task Manager Pro - Task Management Plugin For Wordpress","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2017-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b7ddf44-a1d2-4042-9219-591ebc8e4250","source":"wordfence","cve":"CVE-2024-11934","title":"Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b7ddf44-a1d2-4042-9219-591ebc8e4250?source=api-prod","affected":[{"type":"plugin","slug":"formaloo-form-builder","name":"Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:04:45Z","updated":"2025-01-21T14:47:37Z"},{"id":"wordfence:4b800842-f757-4e1c-8c93-ef21f90a11c7","source":"wordfence","cve":"CVE-2024-56284","title":"SSL Wireless SMS Notification <= 3.5.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b800842-f757-4e1c-8c93-ef21f90a11c7?source=api-prod","affected":[{"type":"plugin","slug":"ssl-wireless-sms-notification","name":"SSL Wireless SMS Notification","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-16T21:36:10Z"},{"id":"wordfence:4b8462ed-6228-42e8-be92-8e02ecd55ae5","source":"wordfence","cve":"CVE-2026-57416","title":"SiteGround Email Marketing <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8462ed-6228-42e8-be92-8e02ecd55ae5?source=api-prod","affected":[{"type":"plugin","slug":"siteground-email-marketing","name":"SiteGround Email Marketing","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:25:09Z"},{"id":"wordfence:4b8500cb-5390-47a7-8150-f3847d0b1e21","source":"wordfence","cve":"CVE-2025-26543","title":"Simple Responsive Menu <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8500cb-5390-47a7-8150-f3847d0b1e21?source=api-prod","affected":[{"type":"plugin","slug":"simple-responsive-menu","name":"Simple Responsive Menu","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:38:19Z"},{"id":"wordfence:4b85e583-7028-4de4-8634-a331ef38a22e","source":"wordfence","cve":"CVE-2011-0641","title":"StatPressCN <= 1.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b85e583-7028-4de4-8634-a331ef38a22e?source=api-prod","affected":[{"type":"plugin","slug":"statpresscn","name":"StatPressCN","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2011-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b86374a-8bae-4c97-8df5-e19a3a848a8b","source":"wordfence","cve":"CVE-2026-97065","title":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b86374a-8bae-4c97-8df5-e19a3a848a8b?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.15","to_inclusive":true,"patched_in":"1.26.16"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:35:27Z"},{"id":"wordfence:4b864aa4-f7e0-4910-b950-ef8b1190c5ba","source":"wordfence","cve":"CVE-2020-29304","title":"DirectoriesPro by SabaiApps <= 1.3.45 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b864aa4-f7e0-4910-b950-ef8b1190c5ba?source=api-prod","affected":[{"type":"plugin","slug":"directories","name":"directories","from":"*","from_inclusive":true,"to":"1.3.46","to_inclusive":false,"patched_in":"1.3.46"}],"published":"2020-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b881509-572b-4e2d-9e75-defaa2cc32dc","source":"wordfence","cve":"CVE-2025-6743","title":"WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b881509-572b-4e2d-9e75-defaa2cc32dc?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.2.3","to_inclusive":true,"patched_in":"8.2.4"}],"published":"2025-07-07T17:26:26Z","updated":"2025-07-08T06:41:58Z"},{"id":"wordfence:4b88a8a9-d3e1-4c21-a4e8-d9afa34d7a2e","source":"wordfence","cve":"CVE-2023-34026","title":"This Day In History <= 3.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b88a8a9-d3e1-4c21-a4e8-d9afa34d7a2e?source=api-prod","affected":[{"type":"plugin","slug":"this-day-in-history","name":"This Day In History","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b8a3e10-bdd9-4d5f-8632-bd7f0247b8f1","source":"wordfence","cve":"CVE-2025-2560","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8a3e10-bdd9-4d5f-8632-bd7f0247b8f1?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2025-04-28T00:00:00Z","updated":"2025-06-13T17:27:18Z"},{"id":"wordfence:4b8adf59-3bd3-497a-8afd-3df4f7660863","source":"wordfence","cve":"CVE-2025-59563","title":"Sonaar <= 4.27.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8adf59-3bd3-497a-8afd-3df4f7660863?source=api-prod","affected":[{"type":"theme","slug":"sonaar","name":"Sonaar","from":"*","from_inclusive":true,"to":"4.27.4","to_inclusive":true,"patched_in":"4.27.5"}],"published":"2025-10-06T00:00:00Z","updated":"2025-10-29T16:15:43Z"},{"id":"wordfence:4b8ce6c8-c563-405e-8e67-1bec27150a64","source":"wordfence","cve":"CVE-2025-32688","title":"Target Video Easy Publish <= 3.8.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8ce6c8-c563-405e-8e67-1bec27150a64?source=api-prod","affected":[{"type":"plugin","slug":"brid-video-easy-publish","name":"Target Video Easy Publish","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2026-01-27T20:49:18Z"},{"id":"wordfence:4b8d057b-1909-46d4-8e0a-d5c7c9f7001c","source":"wordfence","cve":"","title":"Relevanssi <= 3.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8d057b-1909-46d4-8e0a-d5c7c9f7001c?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2014-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b8f4114-ff16-400a-8e0f-aeb89cd8bf9b","source":"wordfence","cve":"CVE-2026-105993","title":"DT Directory Lite Addon <= 1.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b8f4114-ff16-400a-8e0f-aeb89cd8bf9b?source=api-prod","affected":[{"type":"plugin","slug":"dt-directory-lite-addon","name":"DT Directory Lite Addon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-31T00:00:00Z","updated":"2026-11-05T15:57:04Z"},{"id":"wordfence:4b94f7ca-9848-4fd5-848b-e341258f9c47","source":"wordfence","cve":"CVE-2017-7723","title":"Easy WP SMTP <= 1.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b94f7ca-9848-4fd5-848b-e341258f9c47?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b955a0f-d064-436f-8648-0e84fac752d2","source":"wordfence","cve":"CVE-2024-9354","title":"Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b955a0f-d064-436f-8648-0e84fac752d2?source=api-prod","affected":[{"type":"plugin","slug":"estatik-mortgage-calculator","name":"Estatik Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:58Z"},{"id":"wordfence:4b9741c6-4038-45ad-a7b4-fa8f65664f4a","source":"wordfence","cve":"CVE-2018-5672","title":"Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9741c6-4038-45ad-a7b4-fa8f65664f4a?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4b99cbef-2d36-4cd7-9996-e6c9ae2da6d0","source":"wordfence","cve":"CVE-2026-85002","title":"EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b99cbef-2d36-4cd7-9996-e6c9ae2da6d0?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.7"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:51:54Z"},{"id":"wordfence:4b9a325d-1291-458a-aa6c-f2ee55b3b6cd","source":"wordfence","cve":"CVE-2025-47533","title":"Graphina <= 3.0.4 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9a325d-1291-458a-aa6c-f2ee55b3b6cd?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:31:54Z"},{"id":"wordfence:4b9aa41e-34bf-4bfb-a341-e101e3771f7a","source":"wordfence","cve":"CVE-2024-23505","title":"PDF Viewer & 3D PDF Flipbook \u2013 DearPDF <= 2.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9aa41e-34bf-4bfb-a341-e101e3771f7a?source=api-prod","affected":[{"type":"plugin","slug":"dearpdf-lite","name":"PDF Viewer & 3D PDF Flipbook \u2013 DearPDF","from":"*","from_inclusive":true,"to":"2.0.38","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:50:48Z"},{"id":"wordfence:4b9abbf1-d9f5-4406-9d0c-bc2f9891d0e8","source":"wordfence","cve":"CVE-2024-3599","title":"WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9abbf1-d9f5-4406-9d0c-bc2f9891d0e8?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:03Z"},{"id":"wordfence:4b9d0ef9-ec09-4c72-9090-0f676976ff82","source":"wordfence","cve":"CVE-2026-111980","title":"GiveWP <= 4.19.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9d0ef9-ec09-4c72-9090-0f676976ff82?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:06:10Z"},{"id":"wordfence:4b9e8a0f-5866-4969-bf55-51c4b0168de3","source":"wordfence","cve":"CVE-2026-62125","title":"Asia Garden <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9e8a0f-5866-4969-bf55-51c4b0168de3?source=api-prod","affected":[{"type":"theme","slug":"asia-garden","name":"asia-garden","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T16:39:14Z","updated":"2026-10-13T14:03:24Z"},{"id":"wordfence:4b9fe250-3791-4808-918b-c1febbebf51b","source":"wordfence","cve":"CVE-2026-65562","title":"BetterDocs \u2013  AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9fe250-3791-4808-918b-c1febbebf51b?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:36:42Z"},{"id":"wordfence:4ba28184-b5c3-4a5c-a376-29b3c6a2aa20","source":"wordfence","cve":"CVE-2024-1422","title":"Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba28184-b5c3-4a5c-a376-29b3c6a2aa20?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:26:47Z"},{"id":"wordfence:4ba3b414-82a0-4793-9702-cec64d92271e","source":"wordfence","cve":"CVE-2023-22715","title":"WP-CommentNavi <= 1.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba3b414-82a0-4793-9702-cec64d92271e?source=api-prod","affected":[{"type":"plugin","slug":"wp-commentnavi","name":"WP-CommentNavi","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ba3c70a-967f-4dc9-aaac-d13b11eb4711","source":"wordfence","cve":"CVE-2024-37496","title":"themedropbox Themes <= Various Versions - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba3c70a-967f-4dc9-aaac-d13b11eb4711?source=api-prod","affected":[{"type":"theme","slug":"construction-landing-page","name":"Construction Landing Page","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"metro-magazine","name":"Metro Magazine","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"theme","slug":"bakes-and-cakes","name":"Bakes And Cakes","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:02:05Z"},{"id":"wordfence:4ba416c5-47d6-4b05-8a31-af9137e04d2b","source":"wordfence","cve":"","title":"Codup WooCommerce Dynamic Pricing Table View <= 1.2.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba416c5-47d6-4b05-8a31-af9137e04d2b?source=api-prod","affected":[{"type":"plugin","slug":"codup-woocommerce-dynamic-pricing-table-view","name":"Codup WooCommerce Dynamic Pricing Table View","from":"*","from_inclusive":true,"to":"1.2.1.4","to_inclusive":true,"patched_in":"1.2.1.5"}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ba46475-bf54-49a8-9b0e-fae3fb4e1df9","source":"wordfence","cve":"CVE-2026-3362","title":"Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9?source=api-prod","affected":[{"type":"plugin","slug":"short-comment-filter","name":"Short Comment Filter","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:16:14Z","updated":"2026-04-22T07:45:34Z"},{"id":"wordfence:4baa79da-ae4d-4e45-855f-8c7d713fb2f9","source":"wordfence","cve":"CVE-2024-31119","title":"Special Box for Content <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4baa79da-ae4d-4e45-855f-8c7d713fb2f9?source=api-prod","affected":[{"type":"plugin","slug":"special-box-for-content","name":"Special Box for Content","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T21:04:33Z"},{"id":"wordfence:4babd5e9-dfd6-4e6a-a517-6ce4f4d146f6","source":"wordfence","cve":"CVE-2024-37443","title":"WP Job Manager - Resume Manager <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4babd5e9-dfd6-4e6a-a517-6ce4f4d146f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager-resumes","name":"WP Job Manager - Resume Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:38:04Z"},{"id":"wordfence:4bae687b-5b54-4151-871e-7a9b6e56986e","source":"wordfence","cve":"CVE-2026-13362","title":"SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bae687b-5b54-4151-871e-7a9b6e56986e?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-email-marketing-newsletter","name":"SendPulse Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-07-31T12:12:44Z","updated":"2026-08-15T16:22:22Z"},{"id":"wordfence:4baf39fd-4191-47eb-9b37-cdf290d6345b","source":"wordfence","cve":"CVE-2023-45836","title":"XYDAC Ultimate Taxonomy Manager <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4baf39fd-4191-47eb-9b37-cdf290d6345b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-taxonomy-manager","name":"Ultimate Taxonomy Manager","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4baf9b27-a06e-412f-8227-6b418e709ff1","source":"wordfence","cve":"CVE-2022-2100","title":"Page Generator <= 1.6.4 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4baf9b27-a06e-412f-8227-6b418e709ff1?source=api-prod","affected":[{"type":"plugin","slug":"page-generator","name":"Bulk Page Generator and Mass Page Builder \u2013 Page Generator","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bb046c1-a0dd-4d2f-952f-953c5be0a7a2","source":"wordfence","cve":"CVE-2026-40767","title":"wpForo Forum < 3.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb046c1-a0dd-4d2f-952f-953c5be0a7a2?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:58:06Z"},{"id":"wordfence:4bb08412-1107-49cb-8e0a-81baa436df06","source":"wordfence","cve":"CVE-2024-50407","title":"Namaste! LMS <= 2.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb08412-1107-49cb-8e0a-81baa436df06?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:41:40Z"},{"id":"wordfence:4bb10817-50e6-493a-82e9-92b122ddce06","source":"wordfence","cve":"CVE-2026-25390","title":"New User Approve <= 3.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb10817-50e6-493a-82e9-92b122ddce06?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:22:38Z"},{"id":"wordfence:4bb43aad-e3ac-4b32-a3c3-e3b6fce209fe","source":"wordfence","cve":"CVE-2026-65486","title":"Event Post <= 6.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb43aad-e3ac-4b32-a3c3-e3b6fce209fe?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:20:02Z"},{"id":"wordfence:4bb9f98e-c223-4ee4-a2da-b1a62d995410","source":"wordfence","cve":"CVE-2025-31618","title":"Connector to CiviCRM with CiviMcRestFace <= 1.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bb9f98e-c223-4ee4-a2da-b1a62d995410?source=api-prod","affected":[{"type":"plugin","slug":"connector-civicrm-mcrestface","name":"Connector to CiviCRM with CiviMcRestFace","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2025-03-31T00:00:00Z","updated":"2025-06-18T16:28:31Z"},{"id":"wordfence:4bbb0146-436f-42fa-802b-cdcf39ae97db","source":"wordfence","cve":"CVE-2025-47539","title":"Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbb0146-436f-42fa-802b-cdcf39ae97db?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"4.0.27"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-15T12:04:17Z"},{"id":"wordfence:4bbb9f63-b572-464f-b317-73808953a04d","source":"wordfence","cve":"CVE-2025-23715","title":"Post & Page Notes <= 0.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbb9f63-b572-464f-b317-73808953a04d?source=api-prod","affected":[{"type":"plugin","slug":"post-page-notes","name":"Post & Page Notes","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:31:38Z"},{"id":"wordfence:4bbcc1a6-25f6-4868-bc73-0dda433a2b94","source":"wordfence","cve":"CVE-2026-7877","title":"WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbcc1a6-25f6-4868-bc73-0dda433a2b94?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker-premium","name":"WP Recipe Maker Premium","from":"*","from_inclusive":true,"to":"10.5.0","to_inclusive":true,"patched_in":"10.6.0"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T12:31:17Z"},{"id":"wordfence:4bbf55eb-7738-4c52-ac9d-a67d159e56cf","source":"wordfence","cve":"CVE-2026-1072","title":"Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbf55eb-7738-4c52-ac9d-a67d159e56cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-keybase-verification","name":"Keybase.io Verification","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-02-17T17:15:50Z","updated":"2026-02-18T05:29:17Z"},{"id":"wordfence:4bbff678-db55-4058-9f54-9220321616b0","source":"wordfence","cve":"CVE-2025-31827","title":"Fonto <= 1.2.2 - Authenticated (Author+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bbff678-db55-4058-9f54-9220321616b0?source=api-prod","affected":[{"type":"plugin","slug":"fonto","name":"Fonto \u2013 Custom Web Fonts Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-04-03T00:00:00Z","updated":"2026-05-19T12:41:35Z"},{"id":"wordfence:4bc10693-6d7c-4293-8848-02181ceb0d25","source":"wordfence","cve":"CVE-2026-1674","title":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc10693-6d7c-4293-8848-02181ceb0d25?source=api-prod","affected":[{"type":"plugin","slug":"gutena-forms","name":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-03-03T21:42:04Z","updated":"2026-03-04T11:22:36Z"},{"id":"wordfence:4bc15539-d816-4873-9684-862c7c9fcda7","source":"wordfence","cve":"CVE-2026-32484","title":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.26 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc15539-d816-4873-9684-862c7c9fcda7?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.27"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:15:56Z"},{"id":"wordfence:4bc23291-1b73-4e92-83ba-0c7f455ac126","source":"wordfence","cve":"CVE-2025-14907","title":"Moderate Selected Posts <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc23291-1b73-4e92-83ba-0c7f455ac126?source=api-prod","affected":[{"type":"plugin","slug":"moderate-selected-posts","name":"Moderate Selected Posts","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:31:04Z","updated":"2026-01-24T08:26:33Z"},{"id":"wordfence:4bc38197-3827-4c0e-a0a8-42d55f50605f","source":"wordfence","cve":"CVE-2022-36285","title":"Uploading SVG, WEBP and ICO files <= 1.0.1 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc38197-3827-4c0e-a0a8-42d55f50605f?source=api-prod","affected":[{"type":"plugin","slug":"uploading-svgwebp-and-ico-files","name":"Uploading SVG, WEBP and ICO files","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bc3da9e-4b5f-4200-9df9-0ae953571377","source":"wordfence","cve":"CVE-2024-3807","title":"Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc3da9e-4b5f-4200-9df9-0ae953571377?source=api-prod","affected":[{"type":"theme","slug":"porto","name":"Porto","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:24Z"},{"id":"wordfence:4bc4a765-719e-4e99-b7f3-d255e4c019f5","source":"wordfence","cve":"CVE-2024-12606","title":"AI Scribe \u2013 SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4a765-719e-4e99-b7f3-d255e4c019f5?source=api-prod","affected":[{"type":"plugin","slug":"ai-scribe-the-chatgpt-powered-seo-content-creation-wizard","name":"Opace AI Scribe: SEO Content Creator & Humanizer for OpenAI, Anthropic & Gemini","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-01-09T14:59:58Z","updated":"2025-11-05T19:12:08Z"},{"id":"wordfence:4bc4ba2c-32eb-46c5-bb40-7c0150fc1ca4","source":"wordfence","cve":"CVE-2023-0402","title":"Social Warfare <= 4.3.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4ba2c-32eb-46c5-bb40-7c0150fc1ca4?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bc4e54e-6520-48d1-b39e-9493c20d4142","source":"wordfence","cve":"CVE-2025-31779","title":"Query Wrangler <= 1.5.54 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4e54e-6520-48d1-b39e-9493c20d4142?source=api-prod","affected":[{"type":"plugin","slug":"query-wrangler","name":"Query Wrangler","from":"*","from_inclusive":true,"to":"1.5.54","to_inclusive":true,"patched_in":"1.5.55"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-23T17:45:35Z"},{"id":"wordfence:4bc58312-ef3d-487b-87fb-9a15a8c6559f","source":"wordfence","cve":"","title":"CformsII <= 14.10.1 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc58312-ef3d-487b-87fb-9a15a8c6559f?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"14.10.1","to_inclusive":true,"patched_in":"14.11"}],"published":"2010-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bca364b-c8dc-4c32-a640-0e9f3155a40f","source":"wordfence","cve":"CVE-2021-24548","title":"Mimetic Books <= 0.2.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bca364b-c8dc-4c32-a640-0e9f3155a40f?source=api-prod","affected":[{"type":"plugin","slug":"mimetic-books","name":"Mimetic Books","from":"*","from_inclusive":true,"to":"0.2.13","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bce4f04-e622-468a-ac7e-5903ad50cc13","source":"wordfence","cve":"CVE-2023-5775","title":"BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password","severity":"low","cvss":2.2,"cwe":"CWE-256","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bce4f04-e622-468a-ac7e-5903ad50cc13?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2024-02-23T00:00:00Z","updated":"2024-02-24T08:38:15Z"},{"id":"wordfence:4bcf82bb-3606-4fdc-9dc0-cdba93d650b1","source":"wordfence","cve":"CVE-2025-69081","title":"Hope <= 3.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bcf82bb-3606-4fdc-9dc0-cdba93d650b1?source=api-prod","affected":[{"type":"theme","slug":"charity-is-hope","name":"Hope | Non-Profit, Charity & Donations WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T19:45:30Z"},{"id":"wordfence:4bd16698-2c44-4031-b8e0-f9d6e8feaff0","source":"wordfence","cve":"CVE-2025-53457","title":"SEO Backlink Monitor <= 1.6.0 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd16698-2c44-4031-b8e0-f9d6e8feaff0?source=api-prod","affected":[{"type":"plugin","slug":"seo-backlink-monitor","name":"SEO Backlink Monitor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:24Z"},{"id":"wordfence:4bd169bc-1538-400f-b2cd-0bbcf1fea7ee","source":"wordfence","cve":"","title":"BuddyPress <= 6.3.0 - Insufficient Input Validation","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd169bc-1538-400f-b2cd-0bbcf1fea7ee?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":false,"patched_in":"6.4.0"}],"published":"2020-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bd344ad-2259-408f-9867-a004b1f960ea","source":"wordfence","cve":"CVE-2025-64372","title":"Traveler < 3.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd344ad-2259-408f-9867-a004b1f960ea?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2025-11-07T00:00:00Z","updated":"2025-12-19T17:05:46Z"},{"id":"wordfence:4bd464b8-b64e-4e42-a32f-57f4d512468b","source":"wordfence","cve":"CVE-2025-69022","title":"HR Management Lite <= 3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd464b8-b64e-4e42-a32f-57f4d512468b?source=api-prod","affected":[{"type":"plugin","slug":"hr-management-lite","name":"HR Management Lite","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-12-28T00:00:00Z","updated":"2026-06-23T17:34:15Z"},{"id":"wordfence:4bd4b379-6d7d-4cfe-bb16-a931c5d68d02","source":"wordfence","cve":"CVE-2026-12215","title":"OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force","severity":"medium","cvss":5.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd4b379-6d7d-4cfe-bb16-a931c5d68d02?source=api-prod","affected":[{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-09-10T14:39:11Z","updated":"2026-09-11T03:39:34Z"},{"id":"wordfence:4bd811be-6d38-4ba7-8a51-38fcb368731b","source":"wordfence","cve":"CVE-2026-62001","title":"Marcell - Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd811be-6d38-4ba7-8a51-38fcb368731b?source=api-prod","affected":[{"type":"theme","slug":"marcell","name":"Marcell - Personal Blog & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:38:50Z"},{"id":"wordfence:4bd90ca2-85ae-42e3-b2a0-fae6ec28d6b3","source":"wordfence","cve":"CVE-2013-3254","title":"WP Photo Album Plus < 5.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd90ca2-85ae-42e3-b2a0-fae6ec28d6b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"5.0.3"}],"published":"2013-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bd91c8a-f851-4810-b99e-aadae460091f","source":"wordfence","cve":"CVE-2025-48342","title":"Dynamic Pricing &amp; Discounts Lite for WooCommerce <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd91c8a-f851-4810-b99e-aadae460091f?source=api-prod","affected":[{"type":"plugin","slug":"woo-dynamic-pricing-discounts-lite","name":"Dynamic Pricing & Discounts Lite","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T17:01:54Z"},{"id":"wordfence:4bd9dfe6-a88c-4fe5-bf4c-91c4d950f5ab","source":"wordfence","cve":"CVE-2024-35651","title":"WP Flow Plus <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bd9dfe6-a88c-4fe5-bf4c-91c4d950f5ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-imageflow2","name":"WP Flow Plus","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-11T19:27:39Z"},{"id":"wordfence:4bdac6c7-ae50-44e8-aab6-5d8597111d71","source":"wordfence","cve":"CVE-2025-63008","title":"ERP <= 1.16.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bdac6c7-ae50-44e8-aab6-5d8597111d71?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.16.7","to_inclusive":true,"patched_in":"1.16.8"}],"published":"2025-12-04T00:00:00Z","updated":"2026-01-07T14:37:12Z"},{"id":"wordfence:4bdbcc71-491f-4932-a996-af4c6f9fb917","source":"wordfence","cve":"CVE-2026-104246","title":"Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bdbcc71-491f-4932-a996-af4c6f9fb917?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-signature-addon","name":"Contact Form 7 Signature Addon","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:02:50Z"},{"id":"wordfence:4bddaefc-9ddc-4798-acb6-7b87f7c924a1","source":"wordfence","cve":"CVE-2025-15347","title":"Creator LMS \u2013 The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bddaefc-9ddc-4798-acb6-7b87f7c924a1?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2026-01-20T01:48:16Z","updated":"2026-01-20T14:26:33Z"},{"id":"wordfence:4bde3103-76c1-42f0-87b7-cb6b4f6d3204","source":"wordfence","cve":"CVE-2024-53728","title":"Protect Your Content <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bde3103-76c1-42f0-87b7-cb6b4f6d3204?source=api-prod","affected":[{"type":"plugin","slug":"protect-your-content","name":"Protect Your Content","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:29:59Z"},{"id":"wordfence:4be512bd-190a-415a-bd20-a49373f63fbb","source":"wordfence","cve":"CVE-2025-13610","title":"RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4be512bd-190a-415a-bd20-a49373f63fbb?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.6.7","to_inclusive":true,"patched_in":"6.0.6.8"}],"published":"2025-12-15T02:16:59Z","updated":"2025-12-15T14:25:11Z"},{"id":"wordfence:4be58bfa-d489-45f5-9169-db8bab718175","source":"wordfence","cve":"CVE-2024-4849","title":"WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4be58bfa-d489-45f5-9169-db8bab718175?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.94.0","to_inclusive":true,"patched_in":"3.95.0"}],"published":"2024-05-17T17:27:27Z","updated":"2024-05-18T05:40:02Z"},{"id":"wordfence:4be5c7d7-47dd-42ee-9cde-9e9ad6276e41","source":"wordfence","cve":"","title":"LayerSlider <= 4.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4be5c7d7-47dd-42ee-9cde-9e9ad6276e41?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4be623dd-1298-4223-9eb5-d709e1e0e7d9","source":"wordfence","cve":"CVE-2024-54444","title":"Elementor Website Builder <= 3.25.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4be623dd-1298-4223-9eb5-d709e1e0e7d9?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.25.10","to_inclusive":true,"patched_in":"3.25.11"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:59:30Z"},{"id":"wordfence:4be6b66b-1868-467b-a48e-1721b753e9fe","source":"wordfence","cve":"CVE-2025-69127","title":"Plumbing <= 1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4be6b66b-1868-467b-a48e-1721b753e9fe?source=api-prod","affected":[{"type":"theme","slug":"plumbing-parts","name":"Plumbing -  Plumber and Handyman WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:21:54Z"},{"id":"wordfence:4beaa824-d3f1-499e-b4ef-3885f59e42c7","source":"wordfence","cve":"CVE-2026-1805","title":"DA Media GigList <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4beaa824-d3f1-499e-b4ef-3885f59e42c7?source=api-prod","affected":[{"type":"plugin","slug":"damedia-giglist","name":"DA Media GigList","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:46:11Z","updated":"2026-10-26T05:36:55Z"},{"id":"wordfence:4beafd91-1b89-484b-8053-b1bffdaf163a","source":"wordfence","cve":"","title":"Aspose.Words \u2013 Import and Export word documents < 2.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4beafd91-1b89-484b-8053-b1bffdaf163a?source=api-prod","affected":[{"type":"plugin","slug":"aspose-doc-exporter","name":"Aspose.Words \u2013 Import and Export word documents","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2015-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4beb01c1-2144-4b1f-9d32-cf2725a8d4ae","source":"wordfence","cve":"CVE-2024-13711","title":"Pollin <= 1.01.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4beb01c1-2144-4b1f-9d32-cf2725a8d4ae?source=api-prod","affected":[{"type":"plugin","slug":"pollin","name":"Pollin","from":"*","from_inclusive":true,"to":"1.01.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:28:34Z","updated":"2025-02-19T07:32:08Z"},{"id":"wordfence:4bec5e51-70ff-421f-bfba-9d44cbd8b381","source":"wordfence","cve":"CVE-2026-110374","title":"OTP Login With Phone Number, OTP Verification <= 1.8.77 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bec5e51-70ff-421f-bfba-9d44cbd8b381?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.8.77","to_inclusive":true,"patched_in":"1.8.78"}],"published":"2026-10-15T18:18:00Z","updated":"2026-10-23T18:34:37Z"},{"id":"wordfence:4bede27c-0bc2-4ca6-ad90-89667e4560a6","source":"wordfence","cve":"CVE-2026-19256","title":"All In One Login 2.4.0 - 2.4.1 - Unauthenticated Privilege Escalation via OTP Brute Force","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bede27c-0bc2-4ca6-ad90-89667e4560a6?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-admin-login","name":"All In One Login","from":"2.4.0","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:25:23Z"},{"id":"wordfence:4bf26cbb-42f0-4fb6-827e-98fcc58d3c70","source":"wordfence","cve":"CVE-2026-80494","title":"Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf26cbb-42f0-4fb6-827e-98fcc58d3c70?source=api-prod","affected":[{"type":"plugin","slug":"yogeta-wp-cloud","name":"Yogeta WP Cloud","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:56:55Z"},{"id":"wordfence:4bf3248a-f235-472c-b751-96ac9838b27f","source":"wordfence","cve":"CVE-2025-14886","title":"Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf3248a-f235-472c-b751-96ac9838b27f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.17","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-01-08T16:20:49Z","updated":"2026-01-09T04:31:05Z"},{"id":"wordfence:4bf4101e-af05-4a26-b479-51d08240024d","source":"wordfence","cve":"CVE-2026-16590","title":"Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf4101e-af05-4a26-b479-51d08240024d?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:41:33Z"},{"id":"wordfence:4bf43620-34ee-4e4f-b6ee-d24fbdbc894e","source":"wordfence","cve":"CVE-2025-9516","title":"atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf43620-34ee-4e4f-b6ee-d24fbdbc894e?source=api-prod","affected":[{"type":"plugin","slug":"atec-debug","name":"atec Debug","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":"1.2.23"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-04T04:23:48Z"},{"id":"wordfence:4bf45235-4ab6-4558-a7b0-cef86eca42f6","source":"wordfence","cve":"CVE-2025-31077","title":"Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf45235-4ab6-4558-a7b0-cef86eca42f6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:50:11Z"},{"id":"wordfence:4bf456a3-3d42-42e8-b89b-dcdd8cbc7d9a","source":"wordfence","cve":"CVE-2025-30539","title":"BMo Expo <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf456a3-3d42-42e8-b89b-dcdd8cbc7d9a?source=api-prod","affected":[{"type":"plugin","slug":"bmo-expo","name":"BMo Expo \u2013 a  WordPress and NextGEN Gallery plugin","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:43:45Z"},{"id":"wordfence:4bf80767-4b11-49cd-acf5-7437aa89cc0f","source":"wordfence","cve":"CVE-2026-1382","title":"fresh Podcaster <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'freshpodcaster' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf80767-4b11-49cd-acf5-7437aa89cc0f?source=api-prod","affected":[{"type":"plugin","slug":"fresh-podcaster","name":"fresh Podcaster","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-07-10T17:21:08Z","updated":"2026-10-20T05:39:19Z"},{"id":"wordfence:4bfa2246-41a8-4d06-8dc9-57fc4be8e1c4","source":"wordfence","cve":"CVE-2016-10991","title":"IMDB Profile Widget < 1.0.9 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bfa2246-41a8-4d06-8dc9-57fc4be8e1c4?source=api-prod","affected":[{"type":"plugin","slug":"imdb-widget","name":"IMDB Profile Widget","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2016-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4bfde95b-70bf-4445-a8b0-53dbdc5d2334","source":"wordfence","cve":"CVE-2024-47622","title":"Advanced Woo Labels <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bfde95b-70bf-4445-a8b0-53dbdc5d2334?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.02"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:23:44Z"},{"id":"wordfence:4bfeff72-27de-46a9-b947-f60255b5d062","source":"wordfence","cve":"CVE-2026-1634","title":"Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4bfeff72-27de-46a9-b947-f60255b5d062?source=api-prod","affected":[{"type":"plugin","slug":"subitem-al-slider","name":"Subitem AL Slider","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:24:49Z","updated":"2026-02-07T08:26:37Z"},{"id":"wordfence:4c046e0c-32d2-47d1-9890-d05d69217161","source":"wordfence","cve":"CVE-2024-4541","title":"Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c046e0c-32d2-47d1-9890-d05d69217161?source=api-prod","affected":[{"type":"plugin","slug":"custom-product-list-table","name":"Custom Product List Table","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T03:12:29Z"},{"id":"wordfence:4c0af593-2674-484a-a6a5-715f6fb488cf","source":"wordfence","cve":"CVE-2024-13577","title":"CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c0af593-2674-484a-a6a5-715f6fb488cf?source=api-prod","affected":[{"type":"plugin","slug":"cats-job-listings","name":"CATS Job Listings","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:45:22Z","updated":"2025-02-18T04:21:15Z"},{"id":"wordfence:4c0cbf44-f6b4-408d-9a96-98f45d890822","source":"wordfence","cve":"","title":"Laposta Signup Embed <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c0cbf44-f6b4-408d-9a96-98f45d890822?source=api-prod","affected":[{"type":"plugin","slug":"laposta-signup-embed","name":"Laposta Signup Embed","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c10d6cb-e0a7-4b8d-b50f-e23885355872","source":"wordfence","cve":"CVE-2024-11938","title":"One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c10d6cb-e0a7-4b8d-b50f-e23885355872?source=api-prod","affected":[{"type":"plugin","slug":"woo-one-click-upsell-funnel","name":"One Click Upsell Funnel for Woocommerce","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2024-12-20T18:47:40Z","updated":"2024-12-24T16:03:08Z"},{"id":"wordfence:4c1203ce-7582-447f-b011-905b274e1e20","source":"wordfence","cve":"CVE-2022-0182","title":"Quiz And Survey Master <= 7.3.6 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1203ce-7582-447f-b011-905b274e1e20?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c16841d-8878-4328-a5dc-113d213cca33","source":"wordfence","cve":"CVE-2026-6809","title":"Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c16841d-8878-4328-a5dc-113d213cca33?source=api-prod","affected":[{"type":"plugin","slug":"social-post-embed","name":"Social Post Embed","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-04-27T15:57:20Z","updated":"2026-05-07T20:55:17Z"},{"id":"wordfence:4c1691f4-5659-41c0-9035-93556a78f07b","source":"wordfence","cve":"CVE-2026-103914","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1691f4-5659-41c0-9035-93556a78f07b?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-06T22:46:55Z","updated":"2026-11-07T11:26:28Z"},{"id":"wordfence:4c1a07ba-bccd-46e4-bf3b-982692217efb","source":"wordfence","cve":"CVE-2026-80067","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.49 - Authenticated (Custom+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1a07ba-bccd-46e4-bf3b-982692217efb?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T22:18:24Z"},{"id":"wordfence:4c1adf5b-5377-40a3-a53d-e93cf38d949d","source":"wordfence","cve":"CVE-2025-47617","title":"WP Front User Submit / Front Editor <= 4.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1adf5b-5377-40a3-a53d-e93cf38d949d?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:15:24Z"},{"id":"wordfence:4c1d49d0-c9aa-401c-80b9-d4df7fe97691","source":"wordfence","cve":"CVE-2024-3734","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1d49d0-c9aa-401c-80b9-d4df7fe97691?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1.8","to_inclusive":true,"patched_in":"1.4.1.9"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:03Z"},{"id":"wordfence:4c1de8e5-e66b-40ff-a73f-334067146d11","source":"wordfence","cve":"CVE-2025-66142","title":"Comparimager for Elementor <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1de8e5-e66b-40ff-a73f-334067146d11?source=api-prod","affected":[{"type":"plugin","slug":"comparimager-elementor","name":"Comparimager \u2013 Before and After Image Compare for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:48:13Z"},{"id":"wordfence:4c1e994a-aa05-46c2-a875-570052bd2fca","source":"wordfence","cve":"CVE-2026-92995","title":"Verge3D <= 4.13.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1e994a-aa05-46c2-a875-570052bd2fca?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.13.1"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:45:16Z"},{"id":"wordfence:4c1f4487-c684-4602-9b93-e547e2d38a64","source":"wordfence","cve":"CVE-2015-5714","title":"WordPress Core < 4.3.1 - Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c1f4487-c684-4602-9b93-e547e2d38a64?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"3.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"3.7.11"}],"published":"2015-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c20791e-924f-48d9-befc-98c995168bbf","source":"wordfence","cve":"CVE-2026-28014","title":"Translogic <= 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c20791e-924f-48d9-befc-98c995168bbf?source=api-prod","affected":[{"type":"theme","slug":"translogic","name":"Translogic | Logistics & Shipment Transportation","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:59:09Z"},{"id":"wordfence:4c20db2d-f73d-4e52-a275-ab1975ae4b17","source":"wordfence","cve":"CVE-2023-1867","title":"YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c20db2d-f73d-4e52-a275-ab1975ae4b17?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c221909-bc1b-47e3-bfec-71b419f48ae3","source":"wordfence","cve":"CVE-2026-19089","title":"Product Input Fields for WooCommerce <= 2.0.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c221909-bc1b-47e3-bfec-71b419f48ae3?source=api-prod","affected":[{"type":"plugin","slug":"product-input-fields-for-woocommerce","name":"Product Input Fields for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-21T15:35:50Z"},{"id":"wordfence:4c26c559-ab41-49b6-895e-c2d3b2f474f9","source":"wordfence","cve":"CVE-2026-62120","title":"Law Office <= 3.20 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c26c559-ab41-49b6-895e-c2d3b2f474f9?source=api-prod","affected":[{"type":"theme","slug":"law-office","name":"Law Office","from":"*","from_inclusive":true,"to":"3.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:31:55Z","updated":"2026-10-13T14:02:27Z"},{"id":"wordfence:4c293c3a-383d-4e3c-bf1b-4d64e9cd3eb5","source":"wordfence","cve":"CVE-2024-31927","title":"WP Login and Logout Redirect <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c293c3a-383d-4e3c-bf1b-4d64e9cd3eb5?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-and-logout-redirect","name":"Entryway \u2013 WP Login & Logout Redirect","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T16:10:28Z"},{"id":"wordfence:4c298a24-b68b-450e-b823-f91841046783","source":"wordfence","cve":"","title":"3CX Live Chat <= 9.4.2 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c298a24-b68b-450e-b823-f91841046783?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"9.4.2","to_inclusive":true,"patched_in":"9.4.3"}],"published":"2022-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c2a88c3-5c11-4b42-b8f8-aafecf6c4c74","source":"wordfence","cve":"CVE-2024-3814","title":"tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c2a88c3-5c11-4b42-b8f8-aafecf6c4c74?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2024-04-18T00:00:00Z","updated":"2024-06-15T02:01:59Z"},{"id":"wordfence:4c2ce19e-17b2-4638-9a59-6a6de0370ef8","source":"wordfence","cve":"CVE-2025-30828","title":"Timetics <= 1.0.29 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c2ce19e-17b2-4638-9a59-6a6de0370ef8?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:32:25Z"},{"id":"wordfence:4c2ce765-018a-4292-b150-7905723d1335","source":"wordfence","cve":"CVE-2023-25715","title":"GamiPress <= 2.5.6 - Missing Authorization to User Points Updates","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c2ce765-018a-4292-b150-7905723d1335?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c305546-1548-4b77-a484-d7c51d829792","source":"wordfence","cve":"CVE-2025-4390","title":"WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c305546-1548-4b77-a484-d7c51d829792?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T13:49:51Z","updated":"2025-09-03T18:20:34Z"},{"id":"wordfence:4c306428-8880-483f-be3a-6f6b87e55eef","source":"wordfence","cve":"CVE-2023-26533","title":"Zippy <= 1.6.1 - Authenticated (Contributor+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c306428-8880-483f-be3a-6f6b87e55eef?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c30b925-47ca-4e14-a418-d9524648db2a","source":"wordfence","cve":"CVE-2023-2287","title":"Orbit Fox by ThemeIsle <= 2.10.23 - Authenticated (Author+) Server-Side Request Forgery via URL","severity":"high","cvss":7.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c30b925-47ca-4e14-a418-d9524648db2a?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.24","to_inclusive":false,"patched_in":"2.10.24"}],"published":"2023-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c32a5f5-65f1-44d0-b133-0a304131b1f7","source":"wordfence","cve":"CVE-2026-40728","title":"Magazine Blocks <= 1.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c32a5f5-65f1-44d0-b133-0a304131b1f7?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2026-02-26T00:00:00Z","updated":"2026-05-07T13:45:44Z"},{"id":"wordfence:4c332ba8-282e-484e-9ee2-a91c9255bad0","source":"wordfence","cve":"CVE-2022-41692","title":"Appointment Hour Booking <= 1.3.71 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c332ba8-282e-484e-9ee2-a91c9255bad0?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.71","to_inclusive":true,"patched_in":"1.3.72"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c33c640-0876-4b07-829e-35cae445b420","source":"wordfence","cve":"CVE-2026-2600","title":"ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c33c640-0876-4b07-829e-35cae445b420?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-04-03T19:37:48Z","updated":"2026-04-04T07:41:58Z"},{"id":"wordfence:4c367565-75f7-4dd7-a2f1-111df581bd7a","source":"wordfence","cve":"CVE-2024-7350","title":"Appointment Booking Calendar Plugin and Online Scheduling Plugin \u2013 BookingPress 1.1.6  - 1.1.7 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c367565-75f7-4dd7-a2f1-111df581bd7a?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"1.1.6","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T02:32:08Z"},{"id":"wordfence:4c3789d0-6872-4691-94d9-58e1ac303c31","source":"wordfence","cve":"CVE-2023-35049","title":"WooCommerce Stripe Payment Gateway <= 7.4.0 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3789d0-6872-4691-94d9-58e1ac303c31?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c38ca9a-895b-4d59-94c9-c7d5ba3b1b7d","source":"wordfence","cve":"CVE-2025-12754","title":"Geopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c38ca9a-895b-4d59-94c9-c7d5ba3b1b7d?source=api-prod","affected":[{"type":"plugin","slug":"geopost","name":"Geopost","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:18:55Z","updated":"2025-11-11T03:30:38Z"},{"id":"wordfence:4c3936aa-58d6-4ac0-a077-2faaed48828f","source":"wordfence","cve":"CVE-2026-84925","title":"Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3936aa-58d6-4ac0-a077-2faaed48828f?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.16.1","to_inclusive":true,"patched_in":"7.16.2"}],"published":"2026-10-01T16:39:02Z","updated":"2026-10-02T05:30:15Z"},{"id":"wordfence:4c3aa6e7-9aac-4815-b441-3dbabac9d47d","source":"wordfence","cve":"CVE-2026-40726","title":"User Registration Stripe <= 1.3.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3aa6e7-9aac-4815-b441-3dbabac9d47d?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-stripe","name":"User Registration Stripe","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:17:40Z"},{"id":"wordfence:4c3ee9fa-5d66-4f84-818f-ceec2f0c0b96","source":"wordfence","cve":"CVE-2021-24914","title":"Tawk.To Live Chat <= 0.5.4 - Missing Authorization to Visitor Monitoring & Chat Removal","severity":"high","cvss":8.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c3ee9fa-5d66-4f84-818f-ceec2f0c0b96?source=api-prod","affected":[{"type":"plugin","slug":"tawkto-live-chat","name":"Tawk.To Live Chat","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":false,"patched_in":"0.6.0"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c402590-46de-45f3-add7-7e7932b037d4","source":"wordfence","cve":"CVE-2026-84754","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.12.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c402590-46de-45f3-add7-7e7932b037d4?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.12.13","to_inclusive":true,"patched_in":"3.13.0"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:28:08Z"},{"id":"wordfence:4c425635-b1a1-4085-a68c-2c159a38623f","source":"wordfence","cve":"","title":"Track That Stat < 1.1.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c425635-b1a1-4085-a68c-2c159a38623f?source=api-prod","affected":[{"type":"plugin","slug":"track-that-stat","name":"track-that-stat","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c42cc4e-34e7-4f14-b850-7ba5dd2ae099","source":"wordfence","cve":"CVE-2025-11160","title":"WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c42cc4e-34e7-4f14-b850-7ba5dd2ae099?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.6.1","to_inclusive":true,"patched_in":"8.7"}],"published":"2025-10-14T17:29:05Z","updated":"2025-10-15T06:44:00Z"},{"id":"wordfence:4c437d0f-521a-431f-8c31-a73ff6e9367d","source":"wordfence","cve":"CVE-2026-7448","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c437d0f-521a-431f-8c31-a73ff6e9367d?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2026-05-06T00:00:00Z","updated":"2026-05-11T20:30:17Z"},{"id":"wordfence:4c447dbb-f8fb-4b46-9c47-20ab7330bbaa","source":"wordfence","cve":"CVE-2026-1581","title":"wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c447dbb-f8fb-4b46-9c47-20ab7330bbaa?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T16:24:55Z"},{"id":"wordfence:4c44c36a-c4c7-49c2-b750-1589e7840dde","source":"wordfence","cve":"CVE-2023-4214","title":"AppPresser <= 4.2.5 - Insecure Password Reset Mechanism","severity":"high","cvss":8.1,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c44c36a-c4c7-49c2-b750-1589e7840dde?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c44e858-7028-495e-b6c7-8b7712e00eaf","source":"wordfence","cve":"CVE-2026-32483","title":"Contact Form Email <= 1.3.63 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c44e858-7028-495e-b6c7-8b7712e00eaf?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.63","to_inclusive":true,"patched_in":"1.3.64"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:57:27Z"},{"id":"wordfence:4c478d96-7735-4fbb-968b-4bd1d1268cd9","source":"wordfence","cve":"CVE-2024-5282","title":"WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Registration Form","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c478d96-7735-4fbb-968b-4bd1d1268cd9?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-18T13:30:48Z"},{"id":"wordfence:4c498789-79f4-4b79-8e55-57eab1c51d4e","source":"wordfence","cve":"CVE-2026-12525","title":"Redux Framework <= 4.5.12 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c498789-79f4-4b79-8e55-57eab1c51d4e?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"4.5.13"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T13:29:14Z"},{"id":"wordfence:4c4cf43f-ea9a-419d-8f62-a7cbec4310da","source":"wordfence","cve":"CVE-2025-39373","title":"JNews <= 11.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4cf43f-ea9a-419d-8f62-a7cbec4310da?source=api-prod","affected":[{"type":"theme","slug":"jnews","name":"JNews - WordPress Newspaper Magazine Blog AMP Theme","from":"*","from_inclusive":true,"to":"11.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:27:03Z"},{"id":"wordfence:4c4d2fd2-84e1-4da8-b969-7715315c2eb9","source":"wordfence","cve":"CVE-2026-79713","title":"Breeze Cache <= 2.5.14 - Unauthenticated Cache Poisoning","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4d2fd2-84e1-4da8-b969-7715315c2eb9?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.5.14","to_inclusive":true,"patched_in":"2.5.15"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:14:38Z"},{"id":"wordfence:4c4d5902-2d01-4e8f-8d98-65e7be32f5c0","source":"wordfence","cve":"CVE-2025-24759","title":"WP-BusinessDirectory <= 3.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4d5902-2d01-4e8f-8d98-65e7be32f5c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-07-11T00:00:00Z","updated":"2026-02-25T14:29:31Z"},{"id":"wordfence:4c4e1d2c-bb20-40b7-90a3-96df68d083b8","source":"wordfence","cve":"CVE-2023-35875","title":"Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4e1d2c-bb20-40b7-90a3-96df68d083b8?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c4f2d9d-d34c-45dd-aff8-ca9bbe808b5a","source":"wordfence","cve":"CVE-2026-1841","title":"PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c4f2d9d-d34c-45dd-aff8-ca9bbe808b5a?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.2.0","to_inclusive":true,"patched_in":"11.2.0.1"}],"published":"2026-02-13T08:43:23Z","updated":"2026-02-24T20:00:23Z"},{"id":"wordfence:4c51613d-8856-4988-85f0-6405b08bc1e0","source":"wordfence","cve":"CVE-2025-24546","title":"Ultimate Coming Soon & Maintenance <=  1.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c51613d-8856-4988-85f0-6405b08bc1e0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-coming-soon","name":"Ultimate Coming Soon Page, Maintenance Mode & Under Construction \u2013 Gutenberg Block Builder & Landing Page","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:25:25Z"},{"id":"wordfence:4c568f8c-86f6-4acb-ad20-784f380c16e6","source":"wordfence","cve":"CVE-2026-39780","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c568f8c-86f6-4acb-ad20-784f380c16e6?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:42:28Z","updated":"2026-10-08T23:45:06Z"},{"id":"wordfence:4c570533-1a67-46ad-9d29-35f70ae3bb6a","source":"wordfence","cve":"CVE-2025-5535","title":"e.nigma buttons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c570533-1a67-46ad-9d29-35f70ae3bb6a?source=api-prod","affected":[{"type":"plugin","slug":"enigma-buttons","name":"e.nigma buttons","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:43:19Z","updated":"2025-06-26T01:44:38Z"},{"id":"wordfence:4c5a6436-1a08-4b3d-ab85-e5f75f216ab8","source":"wordfence","cve":"CVE-2024-13705","title":"StageShow <= 9.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5a6436-1a08-4b3d-ab85-e5f75f216ab8?source=api-prod","affected":[{"type":"plugin","slug":"stageshow","name":"StageShow","from":"*","from_inclusive":true,"to":"9.8.6","to_inclusive":true,"patched_in":"10.0"}],"published":"2025-01-30T00:41:27Z","updated":"2025-03-25T19:06:17Z"},{"id":"wordfence:4c5b2ce5-d3bf-4412-b329-470a1115260b","source":"wordfence","cve":"CVE-2023-47190","title":"Apollo13 Framework Extensions <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5b2ce5-d3bf-4412-b329-470a1115260b?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c5b3685-881f-49e8-b551-c29cbd73c4c8","source":"wordfence","cve":"CVE-2026-27369","title":"Celeste <= 1.3.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5b3685-881f-49e8-b551-c29cbd73c4c8?source=api-prod","affected":[{"type":"theme","slug":"celeste","name":"Celeste - Life Coach & Therapist WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T17:49:20Z"},{"id":"wordfence:4c5c757f-8546-4a95-a9f4-92d59106aa83","source":"wordfence","cve":"CVE-2026-2446","title":"Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5c757f-8546-4a95-a9f4-92d59106aa83?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-for-learndash","name":"PowerPack for LearnDash","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-04T14:53:11Z"},{"id":"wordfence:4c5d56ba-8f4f-4596-80e6-0f9194749117","source":"wordfence","cve":"CVE-2025-54005","title":"SKT Page Builder <= 4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5d56ba-8f4f-4596-80e6-0f9194749117?source=api-prod","affected":[{"type":"plugin","slug":"skt-builder","name":"SKT Page Builder","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-05-28T00:00:00Z","updated":"2026-02-25T13:23:49Z"},{"id":"wordfence:4c5dc3d9-cb4c-4ae1-b048-c7eea59cb229","source":"wordfence","cve":"CVE-2024-35770","title":"Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5dc3d9-cb4c-4ae1-b048-c7eea59cb229?source=api-prod","affected":[{"type":"plugin","slug":"vimeography","name":"Vimeography: Vimeo Video Gallery WordPress Plugin","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-26T14:00:03Z"},{"id":"wordfence:4c5dc867-c169-4adb-8d75-9617e6813af4","source":"wordfence","cve":"CVE-2025-66118","title":"Sprout Clients <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5dc867-c169-4adb-8d75-9617e6813af4?source=api-prod","affected":[{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-10-23T00:00:00Z","updated":"2025-12-19T16:54:24Z"},{"id":"wordfence:4c5dd7a4-0e9c-4e1e-8385-2e76b7b9b02e","source":"wordfence","cve":"","title":"Chocolate WP \u2013 Responsive Photography Theme (All Versions) - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5dd7a4-0e9c-4e1e-8385-2e76b7b9b02e?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c611fa0-28ef-4425-8614-fb61e250e625","source":"wordfence","cve":"CVE-2026-2488","title":"ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c611fa0-28ef-4425-8614-fb61e250e625?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.1","to_inclusive":true,"patched_in":"5.9.8.2"}],"published":"2026-03-06T11:44:27Z","updated":"2026-03-07T01:21:21Z"},{"id":"wordfence:4c63154e-9413-47ea-a740-441618266adf","source":"wordfence","cve":"CVE-2025-11271","title":"Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-807","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c63154e-9413-47ea-a740-441618266adf?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-11-05T16:27:52Z","updated":"2025-11-06T04:36:22Z"},{"id":"wordfence:4c635405-997e-44ea-8851-7d09051307ad","source":"wordfence","cve":"CVE-2026-1935","title":"Company Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c635405-997e-44ea-8851-7d09051307ad?source=api-prod","affected":[{"type":"plugin","slug":"company-posts-for-linkedin","name":"Company Posts for LinkedIn","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:17:57Z","updated":"2026-03-21T03:26:45Z"},{"id":"wordfence:4c64089a-929c-4a36-8aa8-61a5c9e8562b","source":"wordfence","cve":"CVE-2024-43234","title":"Woffice <= 5.4.14 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c64089a-929c-4a36-8aa8-61a5c9e8562b?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.14","to_inclusive":true,"patched_in":"5.4.15"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-18T16:14:16Z"},{"id":"wordfence:4c64ec9f-c9ca-49c1-9126-b31defb826dd","source":"wordfence","cve":"CVE-2024-56293","title":"Advanced Form Integration <= 1.95.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c64ec9f-c9ca-49c1-9126-b31defb826dd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.95.0","to_inclusive":true,"patched_in":"1.97.0"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:54:52Z"},{"id":"wordfence:4c65519c-06f6-4303-9d22-980dbe36f0b6","source":"wordfence","cve":"CVE-2024-30532","title":"Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c65519c-06f6-4303-9d22-980dbe36f0b6?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T01:39:43Z"},{"id":"wordfence:4c659f6d-e02b-42ab-ba02-eb9b00602ad4","source":"wordfence","cve":"CVE-2023-2285","title":"WP Activity Log Premium <= 4.5.0 - Cross-Site Request Forgery via ajax_switch_db","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c659f6d-e02b-42ab-ba02-eb9b00602ad4?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log-premium","name":"WP Activity Log Premium","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c65a595-b7c6-461f-b08c-d3793c3d84de","source":"wordfence","cve":"CVE-2026-11882","title":"Builderall for WordPress <= 3.0.1 - Missing Authorization to Unauthenticated OAuth Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c65a595-b7c6-461f-b08c-d3793c3d84de?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-17T15:40:43Z"},{"id":"wordfence:4c686ce2-6e57-4cb5-9278-86dd9c8f39b7","source":"wordfence","cve":"CVE-2026-52709","title":"Video Gallery Block \u2013 showcase your videos in a filterable gallery <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c686ce2-6e57-4cb5-9278-86dd9c8f39b7?source=api-prod","affected":[{"type":"plugin","slug":"video-gallery-block","name":"Video Gallery Block \u2013 showcase your videos in a filterable gallery","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-10-29T13:03:00Z","updated":"2026-11-03T20:01:24Z"},{"id":"wordfence:4c6e444a-3737-46ab-b5e8-b0c1f215050a","source":"wordfence","cve":"CVE-2021-25038","title":"WordPress Multisite User Sync/Unsync (Premium) <= 2.1.1 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c6e444a-3737-46ab-b5e8-b0c1f215050a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-multisite-user-sync","name":"WordPress Multisite User Sync/Unsync (Premium)","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c6e6335-7f18-425a-bb86-7e4fc09dae86","source":"wordfence","cve":"CVE-2024-31384","title":"Spa and Salon <= 1.2.7 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c6e6335-7f18-425a-bb86-7e4fc09dae86?source=api-prod","affected":[{"type":"theme","slug":"spa-and-salon","name":"Spa and Salon","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:56:29Z"},{"id":"wordfence:4c716fd3-6297-4b3a-a796-65f68f2986cf","source":"wordfence","cve":"CVE-2026-3456","title":"GeekyBot \u2014 Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c716fd3-6297-4b3a-a796-65f68f2986cf?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-05-04T15:06:44Z","updated":"2026-05-05T03:37:36Z"},{"id":"wordfence:4c72abf9-f63d-4460-8c9b-10e3f65b71ba","source":"wordfence","cve":"CVE-2025-9975","title":"WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":6.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c72abf9-f63d-4460-8c9b-10e3f65b71ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-scraper","name":"WP Scraper","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.8.2"}],"published":"2025-10-10T20:39:34Z","updated":"2025-11-20T19:09:17Z"},{"id":"wordfence:4c732084-0ece-4af3-8b38-b0f88cadf0de","source":"wordfence","cve":"CVE-2026-121848","title":"Magic Link <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c732084-0ece-4af3-8b38-b0f88cadf0de?source=api-prod","affected":[{"type":"plugin","slug":"magic-link","name":"Magic Link \u2013 Secure one click passwordless login","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:12:51Z"},{"id":"wordfence:4c73fe0b-59d7-4393-bc93-f4a3a3fa7b75","source":"wordfence","cve":"CVE-2025-31076","title":"WP Compress for MainWP <= 6.30.03 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c73fe0b-59d7-4393-bc93-f4a3a3fa7b75?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-mainwp","name":"WP Compress for MainWP","from":"*","from_inclusive":true,"to":"6.30.03","to_inclusive":true,"patched_in":"6.30.06"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:28:40Z"},{"id":"wordfence:4c747e6f-31fc-41b0-ba62-f009b5483696","source":"wordfence","cve":"CVE-2022-25912","title":"simple-git < 3.15.0 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c747e6f-31fc-41b0-ba62-f009b5483696?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"},{"type":"plugin","slug":"simple-podcasting","name":"Simple Podcasting","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"autoshare-for-twitter","name":"Autopost for X (formerly Autoshare for Twitter)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c7b3a63-2ab4-4a69-8f93-ef36fa5fa762","source":"wordfence","cve":"CVE-2026-28160","title":"VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7b3a63-2ab4-4a69-8f93-ef36fa5fa762?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2026-10-30T07:28:22Z","updated":"2026-11-03T19:54:13Z"},{"id":"wordfence:4c7b4361-75ac-4f09-9f69-afb5898cff0c","source":"wordfence","cve":"CVE-2026-11965","title":"User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7b4361-75ac-4f09-9f69-afb5898cff0c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2026-06-11T00:00:00Z","updated":"2026-08-21T14:02:13Z"},{"id":"wordfence:4c7fa6ca-a573-4c84-af44-d9d799741728","source":"wordfence","cve":"","title":"Easy Pie Coming Soon < 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7fa6ca-a573-4c84-af44-d9d799741728?source=api-prod","affected":[{"type":"plugin","slug":"easy-pie-coming-soon","name":"EZP Coming Soon Page","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c7faa73-2d6b-4bf6-9ba3-f511450d6e6e","source":"wordfence","cve":"CVE-2025-66109","title":"Cart Weight for WooCommerce <= 1.9.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7faa73-2d6b-4bf6-9ba3-f511450d6e6e?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-weight","name":"Cart Weight for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2025-11-30T00:00:00Z","updated":"2025-12-11T16:37:13Z"},{"id":"wordfence:4c7fe6e7-f776-4fd5-8341-b95237a63d4e","source":"wordfence","cve":"CVE-2024-37451","title":"Travel Agency <= 1.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c7fe6e7-f776-4fd5-8341-b95237a63d4e?source=api-prod","affected":[{"type":"theme","slug":"travel-agency","name":"Travel Agency","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-06-29T00:00:00Z","updated":"2025-01-20T16:44:24Z"},{"id":"wordfence:4c82f6fe-1d6a-4d19-8234-6e27d70f9749","source":"wordfence","cve":"CVE-2025-23820","title":"Content Security Policy Pro <= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c82f6fe-1d6a-4d19-8234-6e27d70f9749?source=api-prod","affected":[{"type":"plugin","slug":"content-security-policy-pro","name":"Content Security Policy Pro","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:50:22Z"},{"id":"wordfence:4c836671-f488-40d9-81b6-e4cd32d0606c","source":"wordfence","cve":"CVE-2024-37203","title":"Laybuy Payment Extension for WooCommerce <= 5.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c836671-f488-40d9-81b6-e4cd32d0606c?source=api-prod","affected":[{"type":"plugin","slug":"laybuy-gateway-for-woocommerce","name":"Laybuy Payment Extension for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:25:34Z"},{"id":"wordfence:4c842ece-f4d4-4ba5-8676-da99994609d5","source":"wordfence","cve":"CVE-2025-48089","title":"HiStudy - Online Courses & Education Template < 3.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c842ece-f4d4-4ba5-8676-da99994609d5?source=api-prod","affected":[{"type":"theme","slug":"histudy","name":"HiStudy - Online Courses & Education Template","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-23T14:39:49Z"},{"id":"wordfence:4c878e15-8139-48bc-93db-9b3c5cbf0185","source":"wordfence","cve":"CVE-2025-53349","title":"Kalium <= 3.18.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c878e15-8139-48bc-93db-9b3c5cbf0185?source=api-prod","affected":[{"type":"theme","slug":"kalium","name":"Kalium 3 | Creative WordPress & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.19"}],"published":"2025-01-04T00:00:00Z","updated":"2025-11-11T18:41:22Z"},{"id":"wordfence:4c8850df-e835-4068-8114-11966014e6eb","source":"wordfence","cve":"CVE-2024-12679","title":"Prisna GWT \u2013 Google Website Translator <= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8850df-e835-4068-8114-11966014e6eb?source=api-prod","affected":[{"type":"plugin","slug":"google-website-translator","name":"Prisna GWT \u2013 Google Website Translator","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-23T15:11:47Z"},{"id":"wordfence:4c8971e0-befd-47ac-8cb5-064f9cd757d7","source":"wordfence","cve":"CVE-2024-5254","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8971e0-befd-47ac-8cb5-064f9cd757d7?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.20","to_inclusive":true,"patched_in":"3.19.20.1"}],"published":"2024-07-16T18:33:47Z","updated":"2024-07-17T06:45:08Z"},{"id":"wordfence:4c8f1c29-b99d-4af0-9cc4-5d6179529ab4","source":"wordfence","cve":"CVE-2024-5858","title":"Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f1c29-b99d-4af0-9cc4-5d6179529ab4?source=api-prod","affected":[{"type":"plugin","slug":"infographic-and-list-builder-ilist","name":"AI Infographic Maker","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2024-06-14T00:00:00Z","updated":"2024-06-15T08:42:16Z"},{"id":"wordfence:4c8f2872-06ff-41a2-b601-77a47470de0c","source":"wordfence","cve":"CVE-2026-14900","title":"Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2872-06ff-41a2-b601-77a47470de0c?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-07-28T20:41:34Z","updated":"2026-07-29T09:31:13Z"},{"id":"wordfence:4c8f2c6f-c231-477c-895b-df892569ef95","source":"wordfence","cve":"CVE-2025-2636","title":"InstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2c6f-c231-477c-895b-df892569ef95?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.85","to_inclusive":true,"patched_in":"0.1.0.86"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-02T15:28:41Z"},{"id":"wordfence:4c90fd3e-24f1-493e-a306-d083086070d4","source":"wordfence","cve":"CVE-2025-31890","title":"Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c90fd3e-24f1-493e-a306-d083086070d4?source=api-prod","affected":[{"type":"plugin","slug":"simple-map-no-api","name":"Simple Map No Api","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:15:43Z"},{"id":"wordfence:4c91caaa-9bdd-4170-98f1-0d686d3ffcba","source":"wordfence","cve":"CVE-2024-21745","title":"Laybuy Payment Extension for WooCommerce <= 5.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c91caaa-9bdd-4170-98f1-0d686d3ffcba?source=api-prod","affected":[{"type":"plugin","slug":"laybuy-gateway-for-woocommerce","name":"Laybuy Payment Extension for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c929ac5-bd12-4aa3-8797-96ad140daf3e","source":"wordfence","cve":"CVE-2024-37206","title":"Demo Awesome <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c929ac5-bd12-4aa3-8797-96ad140daf3e?source=api-prod","affected":[{"type":"plugin","slug":"demo-awesome","name":"Demo Awesome","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-01T15:03:53Z"},{"id":"wordfence:4c953a46-d2ae-41f7-a940-d23b011d9eca","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'SaveSettings' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c953a46-d2ae-41f7-a940-d23b011d9eca?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c956651-4f5e-4e2d-a0f2-b02d4f25bd68","source":"wordfence","cve":"CVE-2023-39996","title":"Accordion and Accordion Slider <= 1.2.4 - Missing Authorization via 'wp_aas_get_attachment_edit_form' and 'wp_aas_save_attachment_data'","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c956651-4f5e-4e2d-a0f2-b02d4f25bd68?source=api-prod","affected":[{"type":"plugin","slug":"accordion-and-accordion-slider","name":"Accordion and Accordion Slider","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c9aabb6-d17c-4845-ae1b-6ee3d8b9bfb1","source":"wordfence","cve":"","title":"SB Uploader <= 4.8 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9aabb6-d17c-4845-ae1b-6ee3d8b9bfb1?source=api-prod","affected":[{"type":"plugin","slug":"sb-uploader","name":"SB Uploader","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":""}],"published":"2012-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c9b61e4-1fa8-4908-a218-7402a7e47f31","source":"wordfence","cve":"CVE-2024-52460","title":"AtaraPay WooCommerce Payment Gateway <= 2.0.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9b61e4-1fa8-4908-a218-7402a7e47f31?source=api-prod","affected":[{"type":"plugin","slug":"atarapay-woocommerce","name":"AtaraPay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:58:28Z"},{"id":"wordfence:4c9b9ae4-67eb-4d3a-9436-566ccd39182a","source":"wordfence","cve":"CVE-2026-39765","title":"PDF Invoices & Packing Slips for WooCommerce \u2013 Challan <= 3.7.88 - Authenticated (Shop Manager+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9b9ae4-67eb-4d3a-9436-566ccd39182a?source=api-prod","affected":[{"type":"plugin","slug":"webappick-pdf-invoice-for-woocommerce","name":"PDF Invoices & Packing Slips for WooCommerce \u2013 Challan Invoice Plugin","from":"*","from_inclusive":true,"to":"3.7.88","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:24:16Z","updated":"2026-10-08T23:28:22Z"},{"id":"wordfence:4c9c110b-8e30-48ca-8439-59818ecbe80f","source":"wordfence","cve":"CVE-2025-26538","title":"Prezi Embedder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9c110b-8e30-48ca-8439-59818ecbe80f?source=api-prod","affected":[{"type":"plugin","slug":"prezi-embedder","name":"Prezi Embedder","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:41:12Z"},{"id":"wordfence:4c9cbe99-699a-4812-a8ae-aefd2b1e2c00","source":"wordfence","cve":"CVE-2022-0236","title":"WP Import Export Lite & WP Import Export <= 3.9.15 - Unauthenticated Sensitive Data Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9cbe99-699a-4812-a8ae-aefd2b1e2c00?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.9.16"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4c9e5fff-c204-41bf-a675-13f39e34e0c5","source":"wordfence","cve":"CVE-2025-31910","title":"BookingPress <= 1.1.28 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c9e5fff-c204-41bf-a675-13f39e34e0c5?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.28","to_inclusive":true,"patched_in":"1.1.38"}],"published":"2025-04-01T00:00:00Z","updated":"2025-08-05T13:09:08Z"},{"id":"wordfence:4ca15d79-86eb-4425-a2e0-22735305c12f","source":"wordfence","cve":"CVE-2025-49054","title":"Time Sheets <= 2.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ca15d79-86eb-4425-a2e0-22735305c12f?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-09-22T21:24:22Z"},{"id":"wordfence:4ca43066-fcfb-4e6d-83c4-b6f0108d26ec","source":"wordfence","cve":"CVE-2025-58978","title":"PDF Generator for WordPress <= 1.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ca43066-fcfb-4e6d-83c4-b6f0108d26ec?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-for-wp","name":"PDF Generator for WordPress","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:20:00Z"},{"id":"wordfence:4ca4fa28-53b0-4bc4-99f8-fa6dfa14d500","source":"wordfence","cve":"CVE-2021-24758","title":"Email Log <= 2.4.6 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ca4fa28-53b0-4bc4-99f8-fa6dfa14d500?source=api-prod","affected":[{"type":"plugin","slug":"email-log","name":"Email Log","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cab3c9c-39c6-4279-9573-858b0592c3fa","source":"wordfence","cve":"CVE-2023-36692","title":"WP-Cirrus <= 0.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cab3c9c-39c6-4279-9573-858b0592c3fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-cirrus","name":"WP-Cirrus","from":"*","from_inclusive":true,"to":"0.6.11","to_inclusive":true,"patched_in":""}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cad38bf-99b9-4bca-b1c0-d90bd2c60a28","source":"wordfence","cve":"CVE-2025-24694","title":"CM E-Mail Blacklist \u2013 Simple email filtering for safer registration <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cad38bf-99b9-4bca-b1c0-d90bd2c60a28?source=api-prod","affected":[{"type":"plugin","slug":"cm-email-blacklist","name":"CM E-Mail Blacklist \u2013 Simple email filtering for safer registration","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-02-03T00:00:00Z","updated":"2025-03-14T17:00:44Z"},{"id":"wordfence:4cad9170-0121-45b0-a1a5-7519be0a381e","source":"wordfence","cve":"CVE-2026-13407","title":"Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cad9170-0121-45b0-a1a5-7519be0a381e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":true,"patched_in":"1.7.1067"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:21:04Z"},{"id":"wordfence:4cada002-1fae-43fa-b1e0-e71afb223c53","source":"wordfence","cve":"CVE-2025-48106","title":"Clanora < 1.3.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cada002-1fae-43fa-b1e0-e71afb223c53?source=api-prod","affected":[{"type":"theme","slug":"clanora","name":"Clanora - Cleaning Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2025-09-01T00:00:00Z","updated":"2025-11-04T16:02:19Z"},{"id":"wordfence:4cafec05-c275-475d-91cf-ed65cd191b0e","source":"wordfence","cve":"CVE-2025-4589","title":"Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cafec05-c275-475d-91cf-ed65cd191b0e?source=api-prod","affected":[{"type":"plugin","slug":"bon-toolkit","name":"Bon Toolkit","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T14:24:29Z","updated":"2025-05-15T03:21:38Z"},{"id":"wordfence:4cb02d7c-5014-46e9-9d4c-c207e58a1b0b","source":"wordfence","cve":"CVE-2022-0248","title":"Contact Form Submissions <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb02d7c-5014-46e9-9d4c-c207e58a1b0b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-submissions","name":"Contact Form Submissions","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":false,"patched_in":"1.7.3"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cb1c945-230c-4d53-b69d-c0cb5c2816c0","source":"wordfence","cve":"CVE-2025-24760","title":"Sofass <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb1c945-230c-4d53-b69d-c0cb5c2816c0?source=api-prod","affected":[{"type":"theme","slug":"sofass","name":"Sofass - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:08:44Z"},{"id":"wordfence:4cb3d2d4-256c-4128-9397-8b9c7be1b9c8","source":"wordfence","cve":"CVE-2024-4100","title":"Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb3d2d4-256c-4128-9397-8b9c7be1b9c8?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-pricing-table","name":"Pricing Table","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T20:07:09Z","updated":"2024-07-09T08:33:05Z"},{"id":"wordfence:4cb3f111-4ac3-4c57-aa62-569b71143fec","source":"wordfence","cve":"CVE-2022-4718","title":"Landing Page Builder <= 1.4.9.8.9  - Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb3f111-4ac3-4c57-aa62-569b71143fec?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.4.9.8.9","to_inclusive":true,"patched_in":"1.4.9.9"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cb410aa-3941-4e19-8de4-622a94766ee8","source":"wordfence","cve":"CVE-2025-12375","title":"Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb410aa-3941-4e19-8de4-622a94766ee8?source=api-prod","affected":[{"type":"plugin","slug":"printful-shipping-for-woocommerce","name":"Printful Integration for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-02-18T14:59:59Z","updated":"2026-02-19T03:25:14Z"},{"id":"wordfence:4cb4b5ca-0abc-4b41-bc48-de9740bb13ff","source":"wordfence","cve":"CVE-2025-22667","title":"Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets <= 1.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb4b5ca-0abc-4b41-bc48-de9740bb13ff?source=api-prod","affected":[{"type":"plugin","slug":"wpsyncsheets-woocommerce","name":"WPSyncSheets For WooCommerce \u2013 Import & Export Orders, Products, Customers & Coupons to Google Sheets in Real-Time","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:11:31Z"},{"id":"wordfence:4cb5837a-665d-4edb-ac8c-a6499b510817","source":"wordfence","cve":"CVE-2025-69318","title":"JobWP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb5837a-665d-4edb-ac8c-a6499b510817?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:12:36Z"},{"id":"wordfence:4cb5d487-0f22-4a34-8558-fe06c19a375b","source":"wordfence","cve":"CVE-2024-6244","title":"PZ Frontend Manager <= 1.0.5 - Cross-Site Request Forgery to Profile Picture Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb5d487-0f22-4a34-8558-fe06c19a375b?source=api-prod","affected":[{"type":"plugin","slug":"pz-frontend-manager","name":"PZ Frontend Manager","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-03T16:38:27Z"},{"id":"wordfence:4cb77a63-360b-4917-8a3c-263f5282742c","source":"wordfence","cve":"CVE-2022-1057","title":"Pricing Deals for WooCommerce <= 2.0.2.02 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb77a63-360b-4917-8a3c-263f5282742c?source=api-prod","affected":[{"type":"plugin","slug":"pricing-deals-for-woocommerce","name":"Pricing Deals for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2.02","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cbbedcb-52dd-44b9-a629-1da0a2552f13","source":"wordfence","cve":"CVE-2023-5235","title":"Ovic Responsive WPBakery <= 1.2.8 - Authenticated (Subscriber+) Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cbbedcb-52dd-44b9-a629-1da0a2552f13?source=api-prod","affected":[{"type":"plugin","slug":"ovic-vc-addon","name":"Ovic Responsive WPBakery","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cbc0dd4-4dea-4890-95d0-9531a669b95d","source":"wordfence","cve":"CVE-2026-0829","title":"Frontend File Manager <= 23.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cbc0dd4-4dea-4890-95d0-9531a669b95d?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-05-19T14:55:50Z"},{"id":"wordfence:4cc038af-c4c8-4141-bbe3-81bcf0a2bace","source":"wordfence","cve":"CVE-2024-11770","title":"Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc038af-c4c8-4141-bbe3-81bcf0a2bace?source=api-prod","affected":[{"type":"plugin","slug":"post-types-carousel-slider","name":"Post Carousel & Slider","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-12-13T16:02:08Z","updated":"2024-12-23T16:59:20Z"},{"id":"wordfence:4cc27a99-747f-4a80-85f5-b26b6a57d9db","source":"wordfence","cve":"CVE-2026-18046","title":"Cookie Consent \u2013 GDPR & CCPA Cookie Banner & Consent Manager < 0.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc27a99-747f-4a80-85f5-b26b6a57d9db?source=api-prod","affected":[{"type":"plugin","slug":"cookiez","name":"Cookiez \u2013 GDPR & CCPA Cookie Banner & Consent Manager","from":"*","from_inclusive":true,"to":"0.0.10","to_inclusive":false,"patched_in":"0.0.10"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:31:09Z"},{"id":"wordfence:4cc29d32-2727-42df-bd42-2caf0f182c0e","source":"wordfence","cve":"CVE-2026-4949","title":"ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc29d32-2727-42df-bd42-2caf0f182c0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.12","to_inclusive":true,"patched_in":"4.16.13"}],"published":"2026-04-15T09:44:30Z","updated":"2026-04-15T22:26:05Z"},{"id":"wordfence:4cc41075-1679-49f4-8328-230c1c4dc201","source":"wordfence","cve":"CVE-2026-48197","title":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc41075-1679-49f4-8328-230c1c4dc201?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":true,"patched_in":"2.50.0"}],"published":"2026-08-05T11:57:00Z","updated":"2026-10-08T23:52:01Z"},{"id":"wordfence:4cc568b3-cb1c-4d17-87ad-b8b2fdf45391","source":"wordfence","cve":"CVE-2026-39514","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.17.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc568b3-cb1c-4d17-87ad-b8b2fdf45391?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:00:33Z"},{"id":"wordfence:4cc5c663-d1e3-4656-ac69-0d610eeaf774","source":"wordfence","cve":"CVE-2024-30540","title":"VS Contact Form <= 14.7 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc5c663-d1e3-4656-ac69-0d610eeaf774?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-contact-form","name":"VS Contact Form","from":"*","from_inclusive":true,"to":"14.7","to_inclusive":true,"patched_in":"14.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T17:01:00Z"},{"id":"wordfence:4cc62b7b-9603-4f12-9cb0-9183365822a7","source":"wordfence","cve":"CVE-2025-23422","title":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales <= 3.98.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc62b7b-9603-4f12-9cb0-9183365822a7?source=api-prod","affected":[{"type":"plugin","slug":"store-locator","name":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales","from":"*","from_inclusive":true,"to":"3.98.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:17:28Z"},{"id":"wordfence:4cc8ec2b-f203-4c7c-8720-043f8634a447","source":"wordfence","cve":"CVE-2026-13354","title":"Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc8ec2b-f203-4c7c-8720-043f8634a447?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.4.0.5","to_inclusive":true,"patched_in":"1.4.0.6"}],"published":"2026-09-18T14:19:23Z","updated":"2026-09-19T02:27:09Z"},{"id":"wordfence:4cca872a-7215-4bc0-b4f9-550a020d5071","source":"wordfence","cve":"CVE-2025-46478","title":"Dropdown Content <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cca872a-7215-4bc0-b4f9-550a020d5071?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-content","name":"Dropdown Content","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:30:08Z"},{"id":"wordfence:4ccc2f0c-07d5-45a5-86ec-1e6b6c5a316d","source":"wordfence","cve":"CVE-2025-49935","title":"WoodMart < 8.3.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccc2f0c-07d5-45a5-86ec-1e6b6c5a316d?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":false,"patched_in":"8.3.2"}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-29T15:14:56Z"},{"id":"wordfence:4ccc8f3b-9028-45db-8db2-574736fe3ccb","source":"wordfence","cve":"","title":"WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccc8f3b-9028-45db-8db2-574736fe3ccb?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.22","to_inclusive":false,"patched_in":"3.1.22"}],"published":"2021-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ccd1314-b9b9-4f63-820c-2817a4932ee8","source":"wordfence","cve":"CVE-2026-15601","title":"Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccd1314-b9b9-4f63-820c-2817a4932ee8?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2026-07-31T19:48:11Z","updated":"2026-08-01T07:49:46Z"},{"id":"wordfence:4cce2842-bd8e-4a83-b83c-66aefe4df4b8","source":"wordfence","cve":"CVE-2026-11359","title":"Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cce2842-bd8e-4a83-b83c-66aefe4df4b8?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-user-profiles-by-profilegrid","name":"Memberships and User Profiles for WooCommerce \u2013 ProfileGrid WooCommerce Integration","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T07:55:13Z"},{"id":"wordfence:4ccf0e70-7e0e-4efc-879a-cda883c6394e","source":"wordfence","cve":"CVE-2025-22724","title":"Product Carousel For WooCommerce \u2013 WoorouSell <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ccf0e70-7e0e-4efc-879a-cda883c6394e?source=api-prod","affected":[{"type":"plugin","slug":"woorousell","name":"Product Carousel For WooCommerce \u2013 WoorouSell","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-30T15:32:46Z"},{"id":"wordfence:4cd27ece-2554-4363-9f3f-161486bfb3ac","source":"wordfence","cve":"CVE-2026-54817","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cd27ece-2554-4363-9f3f-161486bfb3ac?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.18.4","to_inclusive":true,"patched_in":"4.19.0"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T14:13:59Z"},{"id":"wordfence:4cd2a38a-3cd6-40e6-9134-8b9f02d761be","source":"wordfence","cve":"CVE-2025-69322","title":"PeakShops < 1.5.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cd2a38a-3cd6-40e6-9134-8b9f02d761be?source=api-prod","affected":[{"type":"theme","slug":"peakshops","name":"PeakShops - Modern & Multi-Concept WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-28T13:47:04Z"},{"id":"wordfence:4cd69b73-4892-4ae3-9e22-5ec8d756e0cd","source":"wordfence","cve":"CVE-2025-49932","title":"JetBlog <= 2.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cd69b73-4892-4ae3-9e22-5ec8d756e0cd?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.4.1","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-08-03T00:00:00Z","updated":"2025-11-04T18:39:29Z"},{"id":"wordfence:4cd82b65-eadd-4a81-a8e4-72ce58dd360d","source":"wordfence","cve":"CVE-2022-4394","title":"iPages Flipbook <= 1.4.6 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cd82b65-eadd-4a81-a8e4-72ce58dd360d?source=api-prod","affected":[{"type":"plugin","slug":"ipages-flipbook","name":"iPages \u2013 FlipBook Image & PDF Viewer","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cd8ef87-5c7c-432c-af72-14876086dd18","source":"wordfence","cve":"CVE-2025-31452","title":"WP Ultimate Search <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cd8ef87-5c7c-432c-af72-14876086dd18?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-search","name":"WP Ultimate Search","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T13:29:45Z"},{"id":"wordfence:4cdd4bae-b9ee-4d87-acca-38886f499dcf","source":"wordfence","cve":"CVE-2024-38790","title":"Smartsupp \u2013 live chat, chatbots, AI and lead generation <= 3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cdd4bae-b9ee-4d87-acca-38886f499dcf?source=api-prod","affected":[{"type":"plugin","slug":"smartsupp-live-chat","name":"Smartsupp \u2013 live chat, AI shopping assistant and chatbots","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2024-07-20T00:00:00Z","updated":"2024-08-15T14:07:54Z"},{"id":"wordfence:4ce039cd-2662-4cc3-9d38-932be7b7726d","source":"wordfence","cve":"CVE-2025-31022","title":"PayU CommercePro Plugin <= 3.8.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce039cd-2662-4cc3-9d38-932be7b7726d?source=api-prod","affected":[{"type":"plugin","slug":"payu-india","name":"PayU India","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.8"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-07T13:06:54Z"},{"id":"wordfence:4ce32dcb-3b7b-433e-9add-512dc2f9f2d8","source":"wordfence","cve":"CVE-2024-34756","title":"Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce32dcb-3b7b-433e-9add-512dc2f9f2d8?source=api-prod","affected":[{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:01:20Z"},{"id":"wordfence:4ce64a1f-0af9-475b-80a4-87d35a947c2e","source":"wordfence","cve":"CVE-2026-42702","title":"Tutor LMS \u2013 eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce64a1f-0af9-475b-80a4-87d35a947c2e?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:44:48Z"},{"id":"wordfence:4ce8258f-64f7-4d5e-870a-973500eed0eb","source":"wordfence","cve":"CVE-2015-9511","title":"Easy Digital Downloads \u2013 Conditional Success Redirects < 1.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce8258f-64f7-4d5e-870a-973500eed0eb?source=api-prod","affected":[{"type":"plugin","slug":"edd-conditional-success-redirects","name":"Easy Digital Downloads \u2013 Conditional Success Redirects","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ce8e0f1-5a7b-41a3-81d0-7fd12c9da6d9","source":"wordfence","cve":"CVE-2024-12202","title":"Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce8e0f1-5a7b-41a3-81d0-7fd12c9da6d9?source=api-prod","affected":[{"type":"plugin","slug":"croma-music","name":"Croma Music","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T07:22:35Z"},{"id":"wordfence:4cebd997-4bfb-46f2-9670-0ab8e40f632b","source":"wordfence","cve":"CVE-2026-27403","title":"Hubbub Lite <= 1.36.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cebd997-4bfb-46f2-9670-0ab8e40f632b?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.36.3","to_inclusive":true,"patched_in":"1.36.3.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T23:19:16Z"},{"id":"wordfence:4ced42ce-2009-45f6-81c0-ad9e5a05b381","source":"wordfence","cve":"CVE-2024-32146","title":"Aspose.Words Exporter <= 6.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ced42ce-2009-45f6-81c0-ad9e5a05b381?source=api-prod","affected":[{"type":"plugin","slug":"aspose-doc-exporter","name":"Aspose.Words \u2013 Import and Export word documents","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:36:05Z"},{"id":"wordfence:4cee3426-63f4-47c3-9668-64217994752c","source":"wordfence","cve":"CVE-2026-5335","title":"Magic Export & Import <= 1.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cee3426-63f4-47c3-9668-64217994752c?source=api-prod","affected":[{"type":"plugin","slug":"magic-export-import","name":"Magic Export & Import","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-04-13T00:00:00Z","updated":"2026-05-12T13:51:16Z"},{"id":"wordfence:4cf2af62-2b5a-4c0a-9e82-f80dde204a9d","source":"wordfence","cve":"CVE-2024-13940","title":"Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf2af62-2b5a-4c0a-9e82-f80dde204a9d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-webhooks","name":"Ninja Forms Webhooks","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2025-05-13T00:00:00Z","updated":"2025-05-14T08:22:08Z"},{"id":"wordfence:4cf4e22b-423c-49e6-ac00-99adf997aebe","source":"wordfence","cve":"CVE-2025-49411","title":"iFrame Block <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf4e22b-423c-49e6-ac00-99adf997aebe?source=api-prod","affected":[{"type":"plugin","slug":"iframe-block","name":"iFrame Block","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:05:51Z"},{"id":"wordfence:4cf68644-d144-462f-adc7-687fac3ec412","source":"wordfence","cve":"CVE-2022-4670","title":"PDF.js Viewer <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf68644-d144-462f-adc7-687fac3ec412?source=api-prod","affected":[{"type":"plugin","slug":"pdfjs-viewer-shortcode","name":"PDF.js Viewer","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cf7befb-2b55-44f2-8401-f9823ead3f56","source":"wordfence","cve":"CVE-2025-52787","title":"Tennis Court Bookings <= 1.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf7befb-2b55-44f2-8401-f9823ead3f56?source=api-prod","affected":[{"type":"plugin","slug":"tennis-court-bookings","name":"Tennis Court Bookings","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T12:58:23Z"},{"id":"wordfence:4cf894fd-37c7-4006-b868-d5d33f66cc5a","source":"wordfence","cve":"CVE-2024-0951","title":"Advanced Social Feeds Widget & Shortcode <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf894fd-37c7-4006-b868-d5d33f66cc5a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-facebook-twitter-widget","name":"Advanced Social Feeds Widget & Shortcode","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-03-04T14:08:58Z"},{"id":"wordfence:4cf89f94-587a-4fed-a6e4-3876b7dbc9ba","source":"wordfence","cve":"CVE-2022-4537","title":"Hide My WP Ghost \u2013 Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf89f94-587a-4fed-a6e4-3876b7dbc9ba?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.0.18","to_inclusive":true,"patched_in":"5.0.20"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cfb2dd0-d8f8-48ce-bcf4-be4763cabb02","source":"wordfence","cve":"CVE-2025-23823","title":"CNZZ&51LA for WordPress <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cfb2dd0-d8f8-48ce-bcf4-be4763cabb02?source=api-prod","affected":[{"type":"plugin","slug":"cnzz51la-for-wordpress","name":"CNZZ&51LA for WordPress","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:48:46Z"},{"id":"wordfence:4cfdbf80-3733-4d5c-9bc6-01e543ee08b1","source":"wordfence","cve":"CVE-2023-51521","title":"Quiz And Survey Master <= 8.1.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cfdbf80-3733-4d5c-9bc6-01e543ee08b1?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.18","to_inclusive":true,"patched_in":"8.1.19"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4cfee2e2-3486-4be8-954f-6d7f9b6d54ec","source":"wordfence","cve":"CVE-2022-2654","title":"Classima < 2.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4cfee2e2-3486-4be8-954f-6d7f9b6d54ec?source=api-prod","affected":[{"type":"plugin","slug":"classified-core","name":"Classified Core","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":false,"patched_in":"1.10"},{"type":"theme","slug":"classima","name":"Classima","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":false,"patched_in":"2.1.11"},{"type":"plugin","slug":"classified-listing-pro","name":"Classified Listing Pro - Classified ads & Business Directory Plugin","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":false,"patched_in":"2.0.20"},{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":false,"patched_in":"2.2.14"},{"type":"plugin","slug":"classified-listing-store","name":"Classified Listing Store","from":"*","from_inclusive":true,"to":"1.4.20","to_inclusive":false,"patched_in":"1.4.20"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d00b9b4-3822-465b-84e4-1721e2cb387c","source":"wordfence","cve":"CVE-2024-13884","title":"Limit Bio <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d00b9b4-3822-465b-84e4-1721e2cb387c?source=api-prod","affected":[{"type":"plugin","slug":"limit-bio","name":"Limit Bio","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T21:59:43Z"},{"id":"wordfence:4d052f3e-8554-43f0-a5ae-1de09c198d7b","source":"wordfence","cve":"CVE-2023-3162","title":"Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d052f3e-8554-43f0-a5ae-1de09c198d7b?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2023-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d0973e2-394f-435b-821b-54ab3384b383","source":"wordfence","cve":"CVE-2025-47488","title":"Bold Page Builder <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d0973e2-394f-435b-821b-54ab3384b383?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:05:46Z"},{"id":"wordfence:4d09e2fd-ccbb-49a8-9d34-8ede87429428","source":"wordfence","cve":"CVE-2025-62057","title":"Houzez Theme - Functionality < 4.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d09e2fd-ccbb-49a8-9d34-8ede87429428?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T15:11:54Z"},{"id":"wordfence:4d0a0aa7-7bd9-4883-85b6-b7abf338aa75","source":"wordfence","cve":"CVE-2024-9430","title":"Get Quote For Woocommerce \u2013 Request A Quote For Woocommerce <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d0a0aa7-7bd9-4883-85b6-b7abf338aa75?source=api-prod","affected":[{"type":"plugin","slug":"get-a-quote-for-woocommerce","name":"Get Quote For Woocommerce \u2013 Request A Quote For Woocommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T18:08:23Z","updated":"2024-10-31T06:48:54Z"},{"id":"wordfence:4d0a1a39-6421-4af1-9636-33604abd4861","source":"wordfence","cve":"CVE-2026-87797","title":"Sprout Invoices \u2013 Client Invoicing & Estimates < 20.8.16 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d0a1a39-6421-4af1-9636-33604abd4861?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.16","to_inclusive":false,"patched_in":"20.8.16"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:15:47Z"},{"id":"wordfence:4d0a3cad-baa6-4de3-9420-c2d575dfd868","source":"wordfence","cve":"CVE-2025-8047","title":"Multiple Plugins by itayamar - Backdoored Software","severity":"critical","cvss":9.8,"cwe":"CWE-829","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d0a3cad-baa6-4de3-9420-c2d575dfd868?source=api-prod","affected":[{"type":"plugin","slug":"pixter-image-digital-license","name":"Image License and Protection","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"disable-right-click-powered-by-pixterme","name":"Pixter Right Click Protect Images for WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2025-08-25T15:32:00Z"},{"id":"wordfence:4d0afd4c-b525-48de-a411-c0d974c76fc2","source":"wordfence","cve":"CVE-2026-11883","title":"WebAuthn Provider for Two Factor <= 2.5.5 - Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d0afd4c-b525-48de-a411-c0d974c76fc2?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-provider-webauthn","name":"WebAuthn Provider for Two Factor","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-06-10T00:00:00Z","updated":"2026-08-21T13:45:53Z"},{"id":"wordfence:4d10d609-eb0f-492a-be87-2ac7db9c63b4","source":"wordfence","cve":"CVE-2023-38476","title":"Client Portal : SuiteDash Direct Login <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d10d609-eb0f-492a-be87-2ac7db9c63b4?source=api-prod","affected":[{"type":"plugin","slug":"client-portal-suitedash-login","name":"Client Portal : SuiteDash Direct Login","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d114ce7-30af-49a3-a6f7-8445c15a2820","source":"wordfence","cve":"CVE-2025-28913","title":"WP Add Active Class To Menu Item <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d114ce7-30af-49a3-a6f7-8445c15a2820?source=api-prod","affected":[{"type":"plugin","slug":"wp-add-active-class-to-menu-item","name":"WP Add Active Class To Menu Item","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:16:09Z"},{"id":"wordfence:4d13ae87-f632-4eb0-bc71-5132ba6a9b13","source":"wordfence","cve":"CVE-2023-30754","title":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt <= 1.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d13ae87-f632-4eb0-bc71-5132ba6a9b13?source=api-prod","affected":[{"type":"plugin","slug":"adfoxly","name":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d1512c2-75c1-405b-8bb4-f42ec69159a7","source":"wordfence","cve":"CVE-2024-6054","title":"Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1512c2-75c1-405b-8bb4-f42ec69159a7?source=api-prod","affected":[{"type":"plugin","slug":"auto-featured-image","name":"Auto Featured Image","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-26T00:00:00Z","updated":"2024-06-27T02:03:02Z"},{"id":"wordfence:4d153095-9f72-438e-84bb-07a5ad7bdb48","source":"wordfence","cve":"","title":"Careerfy <= 4.3.0 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d153095-9f72-438e-84bb-07a5ad7bdb48?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":false,"patched_in":"4.4.0"}],"published":"2020-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d154587-e396-45ba-80ad-b532b612823a","source":"wordfence","cve":"CVE-2024-25932","title":"Change Table Prefix <= 2.0 - Cross-Site Request Forgery via change_prefix_form","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d154587-e396-45ba-80ad-b532b612823a?source=api-prod","affected":[{"type":"plugin","slug":"change-table-prefix","name":"Change Table Prefix","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-02-20T00:00:00Z","updated":"2026-03-17T21:18:29Z"},{"id":"wordfence:4d162450-32e2-4366-b442-95f4f7b8f828","source":"wordfence","cve":"CVE-2025-53238","title":"Toast Mobile Menu <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d162450-32e2-4366-b442-95f4f7b8f828?source=api-prod","affected":[{"type":"plugin","slug":"toast-responsive-menu","name":"Toast Mobile Menu \u2013 PageSpeed Insights Friendly","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-09-07T00:00:00Z","updated":"2025-11-03T15:40:06Z"},{"id":"wordfence:4d16e945-1576-4d9b-8e1b-995ec457215b","source":"wordfence","cve":"CVE-2026-11591","title":"Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d16e945-1576-4d9b-8e1b-995ec457215b?source=api-prod","affected":[{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"13.3","to_inclusive":true,"patched_in":"13.3.1"}],"published":"2026-07-10T16:53:22Z","updated":"2026-07-11T05:35:47Z"},{"id":"wordfence:4d1974af-9fdd-485d-a424-a7e56892f257","source":"wordfence","cve":"CVE-2026-81792","title":"CatalogX \u2013 Catalog Mode, Enquiry & Quotes for WooCommerce <= 6.1.5 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1974af-9fdd-485d-a424-a7e56892f257?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2026-09-07T13:47:27Z","updated":"2026-10-13T17:00:09Z"},{"id":"wordfence:4d19c023-4aa1-40ec-a87b-dcde945e7a2c","source":"wordfence","cve":"CVE-2026-39533","title":"AWP Classifieds <= 4.4.4 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d19c023-4aa1-40ec-a87b-dcde945e7a2c?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:51:30Z"},{"id":"wordfence:4d1a9b0d-f2be-4e60-a86f-aa5150403796","source":"wordfence","cve":"CVE-2025-62754","title":"Payment Gateway bKash for WC <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1a9b0d-f2be-4e60-a86f-aa5150403796?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-bkash","name":"Payment Gateway bKash for WC","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T05:24:13Z","updated":"2026-02-03T13:42:35Z"},{"id":"wordfence:4d1c6daf-1799-4f8a-81e3-ef3968f41b8e","source":"wordfence","cve":"CVE-2024-8718","title":"Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1c6daf-1799-4f8a-81e3-ef3968f41b8e?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-toolbar","name":"Gravity Forms Toolbar","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:11Z"},{"id":"wordfence:4d1d9959-e303-4903-877a-0cccb346583a","source":"wordfence","cve":"CVE-2026-110369","title":"Team Members \u2013 A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More <= 2.8.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1d9959-e303-4903-877a-0cccb346583a?source=api-prod","affected":[{"type":"plugin","slug":"gs-team-members","name":"Team Members \u2013 Team Showcase, Team Slider, Grid, Table & Staff Directory","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-10-19T08:12:21Z","updated":"2026-10-23T18:18:44Z"},{"id":"wordfence:4d1e1b68-5c70-465b-ab54-069cc6b492a8","source":"wordfence","cve":"CVE-2024-56035","title":"Upload Scanner <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1e1b68-5c70-465b-ab54-069cc6b492a8?source=api-prod","affected":[{"type":"plugin","slug":"upload-scanner","name":"Upload Scanner","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:06:09Z"},{"id":"wordfence:4d1e9de3-da94-4f90-b72a-b38d5d131246","source":"wordfence","cve":"CVE-2015-3299","title":"Floating Social Bar <= 1.1.6 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1e9de3-da94-4f90-b72a-b38d5d131246?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-bar","name":"Floating Social Bar","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d1ef6e3-c502-4099-9099-55058b6ba430","source":"wordfence","cve":"CVE-2025-47472","title":"Music Player for WooCommerce <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1ef6e3-c502-4099-9099-55058b6ba430?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-woocommerce","name":"Music Player for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:06:23Z"},{"id":"wordfence:4d2034a0-f0d8-418f-8fd9-04e50e5e804e","source":"wordfence","cve":"CVE-2025-60224","title":"Subscribe to Download <= 2.0.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2034a0-f0d8-418f-8fd9-04e50e5e804e?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-download","name":"Subscribe to Download","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-07-04T00:00:00Z","updated":"2026-02-26T15:14:52Z"},{"id":"wordfence:4d218a19-6f8c-468d-aad2-90b0f73687b4","source":"wordfence","cve":"CVE-2025-69142","title":"Abelle <= 1.22 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d218a19-6f8c-468d-aad2-90b0f73687b4?source=api-prod","affected":[{"type":"theme","slug":"abelle","name":"Abelle","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:13:17Z"},{"id":"wordfence:4d21febd-e206-4f7c-a6a2-0fa65150ed29","source":"wordfence","cve":"CVE-2022-4765","title":"Portfolio for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d21febd-e206-4f7c-a6a2-0fa65150ed29?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-elementor","name":"PowerFolio \u2013 Portfolio & Image Gallery for Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d23132e-b82e-4129-ab4a-8f0f3721d270","source":"wordfence","cve":"CVE-2025-49967","title":"Live Sports Streamthunder <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d23132e-b82e-4129-ab4a-8f0f3721d270?source=api-prod","affected":[{"type":"plugin","slug":"live-sports-streamthunder","name":"Live Sports Streamthunder","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:43:46Z"},{"id":"wordfence:4d246a99-fd92-4132-9576-efa065a58f59","source":"wordfence","cve":"CVE-2023-26543","title":"WP Meteor Page Speed Optimization Topping <= 3.1.4 - Cross-Site Request Forgery via processAjaxNoticeDismiss","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d246a99-fd92-4132-9576-efa065a58f59?source=api-prod","affected":[{"type":"plugin","slug":"wp-meteor","name":"WP Meteor Website Speed Optimization Addon","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-04-17T13:02:50Z"},{"id":"wordfence:4d2518f6-3647-4bee-a98c-ce7f30375a62","source":"wordfence","cve":"CVE-2024-10585","title":"InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2518f6-3647-4bee-a98c-ce7f30375a62?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T05:19:23Z"},{"id":"wordfence:4d252639-8cbe-4c62-9218-ebdcbaf98393","source":"wordfence","cve":"CVE-2014-2559","title":"Twitget < 3.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d252639-8cbe-4c62-9218-ebdcbaf98393?source=api-prod","affected":[{"type":"plugin","slug":"twitget","name":"Twitget","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2014-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d25e292-b62b-493e-976c-a5eb95505065","source":"wordfence","cve":"CVE-2024-13590","title":"Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d25e292-b62b-493e-976c-a5eb95505065?source=api-prod","affected":[{"type":"plugin","slug":"ketchup-shortcodes-pack","name":"Ketchup Shortcodes","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":"0.2.1"}],"published":"2025-01-21T14:55:31Z","updated":"2025-01-22T03:21:33Z"},{"id":"wordfence:4d260dd3-0006-4a2d-b7ca-c484e4c9ebb5","source":"wordfence","cve":"CVE-2026-56027","title":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d260dd3-0006-4a2d-b7ca-c484e4c9ebb5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":"8.0.2"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T14:17:51Z"},{"id":"wordfence:4d265120-992b-4138-b77a-1cf529e4d742","source":"wordfence","cve":"","title":"Haxcan <= 1.0.0 - Authenticated (Admin+) Path Traversal to Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d265120-992b-4138-b77a-1cf529e4d742?source=api-prod","affected":[{"type":"plugin","slug":"haxcan","name":"Haxcan","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d2676fa-76ff-4df7-83ab-2931d887553c","source":"wordfence","cve":"CVE-2026-118043","title":"Bulk Media Register <= 2.0 - Authenticated (Author+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2676fa-76ff-4df7-83ab-2931d887553c?source=api-prod","affected":[{"type":"plugin","slug":"bulk-media-register","name":"Bulk Media Register","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.01"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:38:49Z"},{"id":"wordfence:4d2b8bc2-68c2-40aa-b8b0-a0584549f303","source":"wordfence","cve":"","title":"Secure HTML5 Video Player < 3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2b8bc2-68c2-40aa-b8b0-a0584549f303?source=api-prod","affected":[{"type":"plugin","slug":"secure-html5-video-player","name":"Secure HTML5 Video Player","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d2d435f-d6ce-41bd-8a45-e252fb4ba419","source":"wordfence","cve":"CVE-2026-6663","title":"GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent","severity":"medium","cvss":4.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2d435f-d6ce-41bd-8a45-e252fb4ba419?source=api-prod","affected":[{"type":"plugin","slug":"graphic-web-design-inc","name":"GWD Conex","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:06:49Z","updated":"2026-05-12T07:48:20Z"},{"id":"wordfence:4d3191b0-829f-4d35-b8f6-323e7ea6f80b","source":"wordfence","cve":"CVE-2015-5622","title":"WordPress Core < 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3191b0-829f-4d35-b8f6-323e7ea6f80b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2015-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d32eae6-f49f-403b-b295-c72b1486c71c","source":"wordfence","cve":"","title":"Greenmart <= 2.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d32eae6-f49f-403b-b295-c72b1486c71c?source=api-prod","affected":[{"type":"theme","slug":"greenmart","name":"GreenMart \u2013 Organic & Food WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d357096-25da-4cbf-9c6c-261bf1b29a9f","source":"wordfence","cve":"CVE-2024-6556","title":"SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d357096-25da-4cbf-9c6c-261bf1b29a9f?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2024-07-09T19:53:14Z","updated":"2024-07-10T08:32:18Z"},{"id":"wordfence:4d358e43-f193-42fd-b49a-1b2a943183f2","source":"wordfence","cve":"CVE-2026-104368","title":"Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field","severity":"high","cvss":8.8,"cwe":"CWE-116","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d358e43-f193-42fd-b49a-1b2a943183f2?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-10-29T16:03:50Z","updated":"2026-10-30T04:32:43Z"},{"id":"wordfence:4d38167c-47f8-473c-94de-91d9b439ddde","source":"wordfence","cve":"","title":"Indeed Membership Pro <= 7.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d38167c-47f8-473c-94de-91d9b439ddde?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2019-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d3858f5-3f13-400c-acf4-eb3dc3a43308","source":"wordfence","cve":"CVE-2023-1927","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3858f5-3f13-400c-acf4-eb3dc3a43308?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d3b1a76-febc-4037-b31e-5987f8a23e92","source":"wordfence","cve":"CVE-2022-0765","title":"Loco Translate <= 2.6.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3b1a76-febc-4037-b31e-5987f8a23e92?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2022-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d3d76b3-9aca-46ac-acb7-353261dbec79","source":"wordfence","cve":"CVE-2025-28926","title":"Post Read Time <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3d76b3-9aca-46ac-acb7-353261dbec79?source=api-prod","affected":[{"type":"plugin","slug":"post-read-time","name":"Post Read Time","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:24:27Z"},{"id":"wordfence:4d3e6c49-e686-463c-bc50-b0ce94702075","source":"wordfence","cve":"CVE-2015-9365","title":"Authorize.net Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3e6c49-e686-463c-bc50-b0ce94702075?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-authorize-net","name":"Authorize.net Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d3efd3a-5f66-4264-a4cd-9dfae641d93f","source":"wordfence","cve":"CVE-2026-39796","title":"Advanced Posts Listing \u2013 Show Post List Easily <= 1.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3efd3a-5f66-4264-a4cd-9dfae641d93f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-posts-listing","name":"Advanced Posts Listing \u2013 Show Post List Easily","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:51:48Z","updated":"2026-10-08T23:47:14Z"},{"id":"wordfence:4d3fd9b8-b9b7-4884-9188-6bf255058323","source":"wordfence","cve":"","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.3.58 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d3fd9b8-b9b7-4884-9188-6bf255058323?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.3.58","to_inclusive":true,"patched_in":"1.3.59"}],"published":"2014-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d419d9e-73c5-4d14-8da0-27a90924e0b5","source":"wordfence","cve":"CVE-2024-1399","title":"Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d419d9e-73c5-4d14-8da0-27a90924e0b5?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-06-14T17:29:31Z","updated":"2024-06-15T05:45:30Z"},{"id":"wordfence:4d425843-a68e-40fd-93de-04c1c46af88f","source":"wordfence","cve":"CVE-2024-31253","title":"OAuth Server <= 4.3.3 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d425843-a68e-40fd-93de-04c1c46af88f?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:57:31Z"},{"id":"wordfence:4d4301ca-081b-4fa3-ac4f-aa8f0b37d32c","source":"wordfence","cve":"","title":"WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4301ca-081b-4fa3-ac4f-aa8f0b37d32c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-10T20:40:50Z"},{"id":"wordfence:4d438635-db41-4b7a-a57f-eb2f746ad2e1","source":"wordfence","cve":"CVE-2026-16618","title":"ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d438635-db41-4b7a-a57f-eb2f746ad2e1?source=api-prod","affected":[{"type":"plugin","slug":"improveseo","name":"Improve SEO","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:27:28Z"},{"id":"wordfence:4d4568c8-f58c-4c37-94b9-6154e5c46928","source":"wordfence","cve":"CVE-2024-1425","title":"EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4568c8-f58c-4c37-94b9-6154e5c46928?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2024-02-14T00:00:00Z","updated":"2024-05-31T15:30:20Z"},{"id":"wordfence:4d476336-e997-4379-a8f6-963ae22b2417","source":"wordfence","cve":"CVE-2024-10245","title":"Relais 2FA <= 1.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d476336-e997-4379-a8f6-963ae22b2417?source=api-prod","affected":[{"type":"plugin","slug":"relais-2fa","name":"Relais 2FA","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-12T09:30:17Z"},{"id":"wordfence:4d4991ff-903a-410a-b472-1a5f76a32940","source":"wordfence","cve":"CVE-2026-93656","title":"User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4991ff-903a-410a-b472-1a5f76a32940?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-09-24T18:53:31Z","updated":"2026-09-25T07:40:26Z"},{"id":"wordfence:4d4ce8ce-2630-4f8b-9438-38c6b7b0caa9","source":"wordfence","cve":"CVE-2024-47624","title":"BSK Forms Blacklist <= 3.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4ce8ce-2630-4f8b-9438-38c6b7b0caa9?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravityforms-blacklist","name":"BSK Forms Blacklist","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.9"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:32:27Z"},{"id":"wordfence:4d4cf942-e4b2-4499-9d8c-71cddd561ade","source":"wordfence","cve":"CVE-2026-54867","title":"Responsive Slider <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4cf942-e4b2-4499-9d8c-71cddd561ade?source=api-prod","affected":[{"type":"plugin","slug":"responsive-slider","name":"Responsive Slider","from":"*","from_inclusive":true,"to":"0.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:33:01Z"},{"id":"wordfence:4d4d0176-3b7d-4de5-95ec-365873e6f13b","source":"wordfence","cve":"CVE-2024-2298","title":"affiliate-toolkit \u2013 WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4d0176-3b7d-4de5-95ec-365873e6f13b?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2024-03-07T00:00:00Z","updated":"2026-08-04T14:36:27Z"},{"id":"wordfence:4d4ecc01-7969-4ff6-8210-530835a43dbc","source":"wordfence","cve":"CVE-2025-7059","title":"Simple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4ecc01-7969-4ff6-8210-530835a43dbc?source=api-prod","affected":[{"type":"plugin","slug":"simple-featured-image","name":"Simple Featured Image","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T14:48:31Z","updated":"2025-07-09T03:22:04Z"},{"id":"wordfence:4d565196-592d-415c-b37c-e54456aa9ed8","source":"wordfence","cve":"CVE-2024-4342","title":"Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d565196-592d-415c-b37c-e54456aa9ed8?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.975","to_inclusive":true,"patched_in":"1.3.976"}],"published":"2024-05-31T17:22:35Z","updated":"2024-06-01T05:38:10Z"},{"id":"wordfence:4d59932d-8f22-430b-a2be-792ffb2947ee","source":"wordfence","cve":"CVE-2026-73376","title":"Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59932d-8f22-430b-a2be-792ffb2947ee?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:35:01Z"},{"id":"wordfence:4d59eedb-550f-44c1-a0cd-609c5661134d","source":"wordfence","cve":"CVE-2025-10649","title":"Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.21","to_inclusive":true,"patched_in":"2.11.22"}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-08T11:16:56Z"},{"id":"wordfence:4d5a7f60-0850-4322-a7d8-8e5c144efe51","source":"wordfence","cve":"CVE-2014-8814","title":"WP Photo Album Plus <= 5.4.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5a7f60-0850-4322-a7d8-8e5c144efe51?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"5.4.17","to_inclusive":true,"patched_in":"5.4.18"}],"published":"2014-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d5b1a3d-ce7f-4d5d-b72b-61024d5c5378","source":"wordfence","cve":"CVE-2023-51531","title":"Thrive Automator <= 1.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5b1a3d-ce7f-4d5d-b72b-61024d5c5378?source=api-prod","affected":[{"type":"plugin","slug":"thrive-automator","name":"Thrive Automator","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.17.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d5d7c62-e420-4ef7-b6ac-4139536c222a","source":"wordfence","cve":"CVE-2026-42664","title":"AI Product Search for WooCommerce \u2013 Motive Commerce Search <= 1.38.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5d7c62-e420-4ef7-b6ac-4139536c222a?source=api-prod","affected":[{"type":"plugin","slug":"motive-commerce-search","name":"AI Product Search for WooCommerce \u2013 Motive Commerce Search","from":"*","from_inclusive":true,"to":"1.38.2","to_inclusive":true,"patched_in":"1.38.3"}],"published":"2026-05-09T00:00:00Z","updated":"2026-05-11T20:12:20Z"},{"id":"wordfence:4d5dcec8-fa36-43ab-9a35-0b391fe1d88e","source":"wordfence","cve":"CVE-2024-6848","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5dcec8-fa36-43ab-9a35-0b391fe1d88e?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.26.6","to_inclusive":true,"patched_in":"1.26.7"}],"published":"2024-07-19T22:34:05Z","updated":"2024-07-20T11:18:27Z"},{"id":"wordfence:4d5ed607-4ab4-4e98-975b-e3043014d847","source":"wordfence","cve":"CVE-2025-22576","title":"Site PIN <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5ed607-4ab4-4e98-975b-e3043014d847?source=api-prod","affected":[{"type":"plugin","slug":"site-pin","name":"Site PIN","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:43:41Z"},{"id":"wordfence:4d5fe67d-1ac3-44f0-a1dc-45ec4bd2de74","source":"wordfence","cve":"CVE-2025-32160","title":"EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5fe67d-1ac3-44f0-a1dc-45ec4bd2de74?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-05T18:28:35Z"},{"id":"wordfence:4d62b087-b0ca-4fa8-921b-5eeb3fa76596","source":"wordfence","cve":"CVE-2025-3100","title":"WP Project Manager \u2013 Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d62b087-b0ca-4fa8-921b-5eeb3fa76596?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.22","to_inclusive":true,"patched_in":"2.6.23"}],"published":"2025-04-08T15:42:30Z","updated":"2025-04-11T15:14:04Z"},{"id":"wordfence:4d63c11c-edf8-4b37-9701-e21d5f7b5a9b","source":"wordfence","cve":"CVE-2025-23594","title":"Google Map With Fancybox <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d63c11c-edf8-4b37-9701-e21d5f7b5a9b?source=api-prod","affected":[{"type":"plugin","slug":"location-piker","name":"Google Map With Fancybox","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:51:12Z"},{"id":"wordfence:4d64253b-5803-470d-81ba-d5629406b019","source":"wordfence","cve":"CVE-2024-8628","title":"Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber \u2013 MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d64253b-5803-470d-81ba-d5629406b019?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.70.3","to_inclusive":true,"patched_in":"1.2.70.4"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T03:17:21Z"},{"id":"wordfence:4d64a157-8d9c-4c57-b7e2-2d253319da57","source":"wordfence","cve":"CVE-2024-35716","title":"Copymatic \u2013 AI Content Writer & Generator <= 1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d64a157-8d9c-4c57-b7e2-2d253319da57?source=api-prod","affected":[{"type":"plugin","slug":"copymatic","name":"Copymatic \u2013 AI Content Writer & Generator","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:50:26Z"},{"id":"wordfence:4d67675a-b77b-41c6-a94f-d9385e609b37","source":"wordfence","cve":"CVE-2024-11713","title":"WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d67675a-b77b-41c6-a94f-d9385e609b37?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:15Z"},{"id":"wordfence:4d678e97-f466-4640-83ee-a3a24550e8d8","source":"wordfence","cve":"CVE-2026-4089","title":"Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d678e97-f466-4640-83ee-a3a24550e8d8?source=api-prod","affected":[{"type":"plugin","slug":"twittee-text-tweet","name":"Twittee Text Tweet","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:07:17Z","updated":"2026-04-22T07:45:35Z"},{"id":"wordfence:4d6c37ec-4a17-41b8-a29e-2a9adb382cea","source":"wordfence","cve":"CVE-2023-5243","title":"Login Screen Manager <= 3.5.2 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6c37ec-4a17-41b8-a29e-2a9adb382cea?source=api-prod","affected":[{"type":"plugin","slug":"login-screen-manager","name":"Login Screen Manager","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d6d394e-a8e7-4b12-b2ed-7d1495643106","source":"wordfence","cve":"","title":"Toolset Types < 1.8.8 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6d394e-a8e7-4b12-b2ed-7d1495643106?source=api-prod","affected":[{"type":"plugin","slug":"types","name":"Toolset Types \u2013 Custom Post Types, Custom Fields and Taxonomies","from":"*","from_inclusive":true,"to":"1.8.7.2","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2015-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d6d8879-3a78-4c99-aea5-754ac80f9c68","source":"wordfence","cve":"CVE-2025-23579","title":"DZS Ajaxer Lite \u2013 Ajaxify Your WordPress Site and Comment <= 1.04 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6d8879-3a78-4c99-aea5-754ac80f9c68?source=api-prod","affected":[{"type":"plugin","slug":"dzs-ajaxer-lite-dynamic-page-load","name":"DZS Ajaxer Lite \u2013 Ajaxify Your WordPress Site and Comments","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:12:42Z"},{"id":"wordfence:4d6ddee9-d9c3-4cea-85f1-a1ddd101aac1","source":"wordfence","cve":"CVE-2022-2958","title":"BadgeOS <= 3.7.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6ddee9-d9c3-4cea-85f1-a1ddd101aac1?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.2","to_inclusive":true,"patched_in":"3.7.1.3"}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d6e9cb0-6b90-4a5b-8626-0b3f378fbc92","source":"wordfence","cve":"CVE-2023-46641","title":"12 Step Meeting List <= 3.14.24 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6e9cb0-6b90-4a5b-8626-0b3f378fbc92?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.14.24","to_inclusive":true,"patched_in":"3.14.25"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d6ea02d-df63-476c-b205-fa64ada18db5","source":"wordfence","cve":"","title":"WP Helper Premium <= 4.2.0 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6ea02d-df63-476c-b205-fa64ada18db5?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d6f76d3-b156-49d9-8dd3-814711840469","source":"wordfence","cve":"CVE-2026-104387","title":"PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6f76d3-b156-49d9-8dd3-814711840469?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.17.9","to_inclusive":true,"patched_in":"11.17.11"}],"published":"2026-10-05T10:25:33Z","updated":"2026-10-08T23:22:38Z"},{"id":"wordfence:4d6f9c80-ef86-4910-a88e-98f2b444ee30","source":"wordfence","cve":"CVE-2024-0845","title":"PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d6f9c80-ef86-4910-a88e-98f2b444ee30?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-for-elementor","name":"PDF Viewer for Elementor","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-17T14:20:46Z","updated":"2024-06-18T02:37:12Z"},{"id":"wordfence:4d70cd0a-5c30-4a9b-81e8-e465d1e8f2b0","source":"wordfence","cve":"CVE-2022-46861","title":"Login Page Styler <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d70cd0a-5c30-4a9b-81e8-e465d1e8f2b0?source=api-prod","affected":[{"type":"plugin","slug":"login-page-styler","name":"Login Page Styler \u2013 Custom WordPress Login Page Customizer & Security","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d722bf7-1caa-4637-b512-af6e09c2b21e","source":"wordfence","cve":"CVE-2026-39656","title":"Razorpay for WooCommerce <= 4.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d722bf7-1caa-4637-b512-af6e09c2b21e?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2026-02-16T00:00:00Z","updated":"2026-06-08T16:13:33Z"},{"id":"wordfence:4d72a57f-9acc-43e4-af81-024bc6e0d3fd","source":"wordfence","cve":"CVE-2024-1166","title":"Image Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d72a57f-9acc-43e4-af81-024bc6e0d3fd?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-addon-for-elementor","name":"Image Hover Effects \u2013 Elementor Addon","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:24Z"},{"id":"wordfence:4d739821-569d-42d7-a4c5-70e32d5d41a1","source":"wordfence","cve":"CVE-2023-47178","title":"The Plus Addons for Elementor Pro <= 5.2.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d739821-569d-42d7-a4c5-70e32d5d41a1?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.2.9"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d73cc31-f65d-4df3-a14e-8ec2839d5bf2","source":"wordfence","cve":"CVE-2025-31532","title":"AtomChat <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d73cc31-f65d-4df3-a14e-8ec2839d5bf2?source=api-prod","affected":[{"type":"plugin","slug":"atomchat","name":"Group Chat & Video Chat by AtomChat","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T14:09:32Z"},{"id":"wordfence:4d740ba8-4877-4b27-a1cb-26095f851ea6","source":"wordfence","cve":"CVE-2025-13085","title":"SiteSEO \u2013 SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=api-prod","affected":[{"type":"plugin","slug":"siteseo","name":"SiteSEO \u2013 SEO Simplified","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-11-18T18:07:44Z","updated":"2025-11-19T06:45:25Z"},{"id":"wordfence:4d79df74-bb28-412b-bba1-9f8a40ae981d","source":"wordfence","cve":"","title":"Appointment Booking Calendar <= 1.2.24 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d79df74-bb28-412b-bba1-9f8a40ae981d?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.24","to_inclusive":true,"patched_in":"1.2.25"}],"published":"2016-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d7b12e5-0de7-45f4-84e0-083818912623","source":"wordfence","cve":"CVE-2025-10006","title":"WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b12e5-0de7-45f4-84e0-083818912623?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"8.7"}],"published":"2025-10-17T18:22:34Z","updated":"2025-10-18T06:42:46Z"},{"id":"wordfence:4d7b2a7f-3c67-4df1-bb15-e7f4f0035953","source":"wordfence","cve":"CVE-2024-13230","title":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b2a7f-3c67-4df1-bb15-e7f4f0035953?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.14","to_inclusive":true,"patched_in":"7.14.1"}],"published":"2025-01-20T22:38:24Z","updated":"2025-01-21T11:09:47Z"},{"id":"wordfence:4d7b8570-96d2-46dc-983c-3933c3fd74cb","source":"wordfence","cve":"","title":"BP Group Documents <= 1.2.1 - Path Traversal","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b8570-96d2-46dc-983c-3933c3fd74cb?source=api-prod","affected":[{"type":"plugin","slug":"bp-group-documents","name":"BP Group Documents","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2013-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d7b8c5f-3e3d-4ccc-8598-fcb4503c25ea","source":"wordfence","cve":"CVE-2025-69354","title":"Better Business Reviews <= 0.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7b8c5f-3e3d-4ccc-8598-fcb4503c25ea?source=api-prod","affected":[{"type":"plugin","slug":"better-business-reviews","name":"Better Business Reviews","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":"0.1.2"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-14T14:55:35Z"},{"id":"wordfence:4d7cb243-a57b-42cc-bee4-ca66a2e1614b","source":"wordfence","cve":"CVE-2026-82848","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates 1.3.1 - 2.3.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7cb243-a57b-42cc-bee4-ca66a2e1614b?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"1.3.1","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:38:36Z"},{"id":"wordfence:4d7f2cea-f132-4881-9632-ee07a7b9d6b8","source":"wordfence","cve":"CVE-2025-64255","title":"Admin and Site Enhancements (ASE) <= 8.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7f2cea-f132-4881-9632-ee07a7b9d6b8?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":true,"patched_in":"8.1.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:17:13Z"},{"id":"wordfence:4d7f4d17-8318-4ab3-b4a2-81d7a017c397","source":"wordfence","cve":"CVE-2024-0976","title":"WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7f4d17-8318-4ab3-b4a2-81d7a017c397?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.41","to_inclusive":true,"patched_in":"3.1.42"}],"published":"2024-02-23T00:00:00Z","updated":"2024-03-13T15:26:48Z"},{"id":"wordfence:4d7f94b4-8d8a-496a-bc59-aa0619175fa2","source":"wordfence","cve":"CVE-2025-57887","title":"Jobmonster <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d7f94b4-8d8a-496a-bc59-aa0619175fa2?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:36:24Z"},{"id":"wordfence:4d8056cb-58e5-468b-9316-c862c6d8c930","source":"wordfence","cve":"CVE-2015-10113","title":"WooFramework Tweaks <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8056cb-58e5-468b-9316-c862c6d8c930?source=api-prod","affected":[{"type":"plugin","slug":"wooframework-tweaks","name":"WooFramework Tweaks","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d805963-a36c-41a1-aa03-0dc29b9216ff","source":"wordfence","cve":"CVE-2024-49330","title":"Nice Backgrounds <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d805963-a36c-41a1-aa03-0dc29b9216ff?source=api-prod","affected":[{"type":"plugin","slug":"nicebackgrounds","name":"Nice Backgrounds","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T15:23:05Z"},{"id":"wordfence:4d86382a-09b9-492a-bdf0-67a199c37d3a","source":"wordfence","cve":"CVE-2026-66572","title":"JetBlog <= 2.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d86382a-09b9-492a-bdf0-67a199c37d3a?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.10.1"}],"published":"2026-09-17T12:05:00Z","updated":"2026-09-22T18:44:59Z"},{"id":"wordfence:4d89a4ca-c867-43bf-aace-295de8533fcd","source":"wordfence","cve":"CVE-2026-2569","title":"Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d89a4ca-c867-43bf-aace-295de8533fcd?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.4.20","to_inclusive":true,"patched_in":"2.4.27"}],"published":"2026-03-10T10:33:18Z","updated":"2026-03-10T23:21:12Z"},{"id":"wordfence:4d8aee12-84c2-4efe-b505-c014029ca0e9","source":"wordfence","cve":"CVE-2025-28856","title":"W3Counter Free Real-Time Web Stats <= 4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8aee12-84c2-4efe-b505-c014029ca0e9?source=api-prod","affected":[{"type":"plugin","slug":"blog-stats-by-w3counter","name":"W3Counter Free Real-Time Web Stats","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:46:20Z"},{"id":"wordfence:4d8bd9bc-5062-4966-bc44-bfe033d5fc9b","source":"wordfence","cve":"CVE-2024-30444","title":"WordPress Page Builder \u2013 Zion Builder <= 3.6.9 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8bd9bc-5062-4966-bc44-bfe033d5fc9b?source=api-prod","affected":[{"type":"plugin","slug":"zionbuilder","name":"Zion Builder \u2013 Website Builder for Speed & Creativity","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:20:43Z"},{"id":"wordfence:4d8cfcdc-6258-4629-a3b4-d65e44ac82f1","source":"wordfence","cve":"CVE-2024-22306","title":"Mang Board WP <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8cfcdc-6258-4629-a3b4-d65e44ac82f1?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-01-26T00:00:00Z","updated":"2024-03-11T09:06:37Z"},{"id":"wordfence:4d8d15be-6a7b-485e-a338-ccf1a6eb226c","source":"wordfence","cve":"CVE-2026-0745","title":"User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a338-ccf1a6eb226c?source=api-prod","affected":[{"type":"plugin","slug":"user-language-switch","name":"User Language Switch","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:30:57Z","updated":"2026-03-27T11:19:48Z"},{"id":"wordfence:4d8d581c-8198-4431-a534-aac8f05750cb","source":"wordfence","cve":"CVE-2023-4687","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d581c-8198-4431-a534-aac8f05750cb?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d8fb548-0737-4b69-bf64-838bfc6d409a","source":"wordfence","cve":"CVE-2022-4787","title":"Themify Shortcodes <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8fb548-0737-4b69-bf64-838bfc6d409a?source=api-prod","affected":[{"type":"plugin","slug":"themify-shortcodes","name":"Themify Shortcodes","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d902dfe-f16d-4795-9fcf-ee454b3d8c56","source":"wordfence","cve":"CVE-2021-25031","title":"Image Hover Effects Ultimate <= 9.7.0 - Reflected Cross-Site Scripting via effects","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d902dfe-f16d-4795-9fcf-ee454b3d8c56?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.0","to_inclusive":true,"patched_in":"9.7.1"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4d936a48-b300-4a41-8d28-ba34cb3c5cb7","source":"wordfence","cve":"CVE-2023-6226","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d936a48-b300-4a41-8d28-ba34cb3c5cb7?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.13.3","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2023-11-27T00:00:00Z","updated":"2024-07-29T21:36:19Z"},{"id":"wordfence:4d982416-ac4b-4d14-bf2b-d43fc92550b1","source":"wordfence","cve":"CVE-2024-56235","title":"Coupon <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d982416-ac4b-4d14-bf2b-d43fc92550b1?source=api-prod","affected":[{"type":"plugin","slug":"coupon-lite","name":"Coupon Plugin Lite","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-12-19T00:00:00Z","updated":"2026-07-08T20:42:09Z"},{"id":"wordfence:4d9b36b5-80e3-47c3-ba94-3b724fdee095","source":"wordfence","cve":"CVE-2026-82221","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9b36b5-80e3-47c3-ba94-3b724fdee095?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.8","to_inclusive":true,"patched_in":"6.0.9.9"}],"published":"2026-08-31T11:32:53Z","updated":"2026-09-10T19:34:38Z"},{"id":"wordfence:4d9b6efa-b82e-4fe5-bf56-4ca49e9ebe71","source":"wordfence","cve":"CVE-2026-1247","title":"Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9b6efa-b82e-4fe5-bf56-4ca49e9ebe71?source=api-prod","affected":[{"type":"plugin","slug":"survey","name":"Survey","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:20:33Z","updated":"2026-03-21T03:26:45Z"},{"id":"wordfence:4d9ef3ab-fdba-4f9c-9323-0731a8d9db54","source":"wordfence","cve":"CVE-2025-59573","title":"Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9ef3ab-fdba-4f9c-9323-0731a8d9db54?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.1.29","to_inclusive":true,"patched_in":"2.1.30"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:56:12Z"},{"id":"wordfence:4d9f2f77-c3e5-49ae-b091-698312056b9d","source":"wordfence","cve":"CVE-2026-39682","title":"linkPizza-Manager <= 5.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9f2f77-c3e5-49ae-b091-698312056b9d?source=api-prod","affected":[{"type":"plugin","slug":"linkpizza-manager","name":"linkPizza-Manager","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-02-21T00:00:00Z","updated":"2026-06-08T16:13:55Z"},{"id":"wordfence:4d9f7832-3dff-4cb8-a6be-a16449164363","source":"wordfence","cve":"CVE-2025-24573","title":"PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4d9f7832-3dff-4cb8-a6be-a16449164363?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:44:32Z"},{"id":"wordfence:4da012dc-7e58-479a-813e-762eb28297bf","source":"wordfence","cve":"CVE-2025-8595","title":"Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da012dc-7e58-479a-813e-762eb28297bf?source=api-prod","affected":[{"type":"theme","slug":"zakra","name":"Zakra","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2025-08-05T13:58:24Z","updated":"2025-08-06T02:24:11Z"},{"id":"wordfence:4da14dd1-1dbe-4f2e-980f-3f38a0a33564","source":"wordfence","cve":"CVE-2025-48099","title":"Search & Filter <= 1.2.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da14dd1-1dbe-4f2e-980f-3f38a0a33564?source=api-prod","affected":[{"type":"plugin","slug":"search-filter","name":"Search & Filter","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-15T15:49:31Z"},{"id":"wordfence:4da167e0-c1cf-496f-9b14-35fc70386be1","source":"wordfence","cve":"CVE-2025-15378","title":"AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da167e0-c1cf-496f-9b14-35fc70386be1?source=api-prod","affected":[{"type":"plugin","slug":"ajs-footnotes","name":"AJS Footnotes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:23:06Z","updated":"2026-01-14T05:28:08Z"},{"id":"wordfence:4da18aad-3c82-4bc6-8dad-523643c12d5b","source":"wordfence","cve":"CVE-2024-25924","title":"WP Testimonials <= 1.4.3 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da18aad-3c82-4bc6-8dad-523643c12d5b?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-widgets","name":"WP Testimonials","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-01-12T00:00:00Z","updated":"2024-02-20T19:42:30Z"},{"id":"wordfence:4da302ab-8a5d-481b-8b28-a798e0982893","source":"wordfence","cve":"CVE-2026-6295","title":"WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da302ab-8a5d-481b-8b28-a798e0982893?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimizer","name":"WP Optimizer \u2013 PageSpeed, Cache, Minify & Core Web Vitals","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-09-18T19:42:56Z","updated":"2026-09-19T07:43:15Z"},{"id":"wordfence:4da52b6a-38dd-4a66-bcaf-8a77f96377fe","source":"wordfence","cve":"CVE-2026-32455","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da52b6a-38dd-4a66-bcaf-8a77f96377fe?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T15:14:43Z"},{"id":"wordfence:4da88abe-7b2f-4244-9216-027fce81f55a","source":"wordfence","cve":"CVE-2026-93529","title":"WSP MCP \u2013 WordPress MCP \u2013 Connect Claude, codex, antigravity or any other AI Agent <= 2.7.0 - Missing Authorization to Authenticated (Contributor+) Unauthorized Post and Media Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4da88abe-7b2f-4244-9216-027fce81f55a?source=api-prod","affected":[{"type":"plugin","slug":"wsp-mcp-ai-agents-connector","name":"WSP MCP \u2013 Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:08:38Z"},{"id":"wordfence:4dac404d-369c-4036-9c64-4afab021cbe8","source":"wordfence","cve":"CVE-2024-53790","title":"Lenxel Core <= 1.2.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dac404d-369c-4036-9c64-4afab021cbe8?source=api-prod","affected":[{"type":"plugin","slug":"lenxel-core","name":"Lenxel AI LMS \u2013 Course Lesson Generator","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-29T00:00:00Z","updated":"2025-04-21T14:39:15Z"},{"id":"wordfence:4db0991f-fc89-411b-b0df-1a11c9ddec1f","source":"wordfence","cve":"CVE-2026-120554","title":"Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db0991f-fc89-411b-b0df-1a11c9ddec1f?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.11","to_inclusive":true,"patched_in":"2.5.12"}],"published":"2026-11-03T21:19:42Z","updated":"2026-11-04T09:26:07Z"},{"id":"wordfence:4db1ee2b-d8ed-4f2a-8de5-81abeafa2f9d","source":"wordfence","cve":"","title":"Rich Widget <= 0.2.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db1ee2b-d8ed-4f2a-8de5-81abeafa2f9d?source=api-prod","affected":[{"type":"plugin","slug":"rich-widget","name":"Rich Widget","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2012-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4db4a201-a7fa-4764-87cb-c54b64adf560","source":"wordfence","cve":"CVE-2026-110290","title":"WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db4a201-a7fa-4764-87cb-c54b64adf560?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-10-15T17:52:40Z","updated":"2026-10-16T06:41:04Z"},{"id":"wordfence:4db55163-3037-4a3a-97a0-2a3109a8245d","source":"wordfence","cve":"CVE-2025-26915","title":"Wishlist <= 1.0.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db55163-3037-4a3a-97a0-2a3109a8245d?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":true,"patched_in":"1.0.42"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:41:09Z"},{"id":"wordfence:4db5d4ec-0f49-40fb-97b3-f0146cbbbe52","source":"wordfence","cve":"CVE-2017-2222","title":"WP-Members < 3.1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db5d4ec-0f49-40fb-97b3-f0146cbbbe52?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":false,"patched_in":"3.1.8"}],"published":"2017-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4db88c63-4665-436e-84bd-f77bad651b66","source":"wordfence","cve":"CVE-2026-123460","title":"Iptanus File Upload <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db88c63-4665-436e-84bd-f77bad651b66?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-11-07T10:46:42Z","updated":"2026-11-10T19:58:02Z"},{"id":"wordfence:4dbaeabb-2610-4b24-8c47-a04b073bd290","source":"wordfence","cve":"CVE-2021-24323","title":"WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbaeabb-2610-4b24-8c47-a04b073bd290?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":false,"patched_in":"5.2.0"}],"published":"2021-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4dbb0ca4-169a-4f51-a196-5f138744c54d","source":"wordfence","cve":"CVE-2024-2888","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor Plugin <= 1.26.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbb0ca4-169a-4f51-a196-5f138744c54d?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.26.2","to_inclusive":true,"patched_in":"1.26.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:40:27Z"},{"id":"wordfence:4dbba653-e23e-43e6-9dc5-83a6c99f8dc6","source":"wordfence","cve":"CVE-2023-25442","title":"Zeno Font Resizer <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbba653-e23e-43e6-9dc5-83a6c99f8dc6?source=api-prod","affected":[{"type":"plugin","slug":"zeno-font-resizer","name":"Zeno Font Resizer","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4dbd8cac-9e4b-4353-9c62-9cabb60b927c","source":"wordfence","cve":"CVE-2025-12324","title":"TablePress \u2013 Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbd8cac-9e4b-4353-9c62-9cabb60b927c?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-11-03T14:02:33Z","updated":"2025-11-04T02:26:55Z"},{"id":"wordfence:4dc39c47-3b99-4e43-b25d-a025f3d228b5","source":"wordfence","cve":"CVE-2024-1229","title":"SimpleShop <= 2.10.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dc39c47-3b99-4e43-b25d-a025f3d228b5?source=api-prod","affected":[{"type":"plugin","slug":"simpleshop-cz","name":"SimpleShop","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:25Z"},{"id":"wordfence:4dc6e879-4ccf-485e-b02d-2b291e67df40","source":"wordfence","cve":"CVE-2024-1773","title":"PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dc6e879-4ccf-485e-b02d-2b291e67df40?source=api-prod","affected":[{"type":"plugin","slug":"pdf-invoices-and-packing-slips-for-woocommerce","name":"PDF Invoices and Packing Slips For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T18:49:17Z"},{"id":"wordfence:4dc83aca-f533-4a8c-b12c-e21156ce6088","source":"wordfence","cve":"CVE-2023-47697","title":"WP Event Manager <= 3.1.42 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dc83aca-f533-4a8c-b12c-e21156ce6088?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.42","to_inclusive":true,"patched_in":"3.1.43"}],"published":"2023-11-09T00:00:00Z","updated":"2024-02-27T00:33:03Z"},{"id":"wordfence:4dca441a-5955-4624-bc9a-102b628725f4","source":"wordfence","cve":"CVE-2026-122220","title":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.1 - Authentication Bypass via SAML Relay","severity":"medium","cvss":6.3,"cwe":"CWE-294","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dca441a-5955-4624-bc9a-102b628725f4?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"45.1","to_inclusive":true,"patched_in":"45.2"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T13:16:49Z"},{"id":"wordfence:4dcb4afc-14e1-43ce-87c4-8f24f1a0d682","source":"wordfence","cve":"CVE-2024-43231","title":"Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dcb4afc-14e1-43ce-87c4-8f24f1a0d682?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:24:04Z"},{"id":"wordfence:4dcc3f47-8504-4aa6-af60-03edeaa39fd7","source":"wordfence","cve":"CVE-2024-4305","title":"Post Grid Gutenberg Blocks and WordPress Blog Plugin \u2013 PostX <= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dcc3f47-8504-4aa6-af60-03edeaa39fd7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-13T20:46:09Z"},{"id":"wordfence:4dcc6225-b47a-4184-a2f3-1292e5abe1bd","source":"wordfence","cve":"CVE-2022-1990","title":"Nested Pages <= 3.1.20 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dcc6225-b47a-4184-a2f3-1292e5abe1bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.1.21","to_inclusive":false,"patched_in":"3.1.21"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4dcf1133-d437-4f0a-b2cf-c91e0f6b6ca9","source":"wordfence","cve":"CVE-2024-9866","title":"Event Tickets with Ticket Scanner <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dcf1133-d437-4f0a-b2cf-c91e0f6b6ca9?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:52Z"},{"id":"wordfence:4dd3c146-534f-41be-b805-7eef2483614e","source":"wordfence","cve":"CVE-2024-31245","title":"ConvertKit <= 2.4.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dd3c146-534f-41be-b805-7eef2483614e?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:20:44Z"},{"id":"wordfence:4dd62de7-76c6-40aa-ba0b-e227109a9fcb","source":"wordfence","cve":"CVE-2026-32512","title":"Pelicula < 1.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dd62de7-76c6-40aa-ba0b-e227109a9fcb?source=api-prod","affected":[{"type":"theme","slug":"pelicula-video-production-and-movie-theme","name":"Pelicula - Video Production and Movie WordPress Theme","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":false,"patched_in":"1.10"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:41:49Z"},{"id":"wordfence:4dd63ea6-7821-42b8-9b52-e721a8b2382d","source":"wordfence","cve":"CVE-2024-24849","title":"Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dd63ea6-7821-42b8-9b52-e721a8b2382d?source=api-prod","affected":[{"type":"plugin","slug":"quicksand-jquery-post-filter","name":"Quicksand Post Filter jQuery Plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:23:25Z"},{"id":"wordfence:4dd7d751-961a-4167-bb4a-2bcd66fc3c46","source":"wordfence","cve":"CVE-2026-42386","title":"Order Delivery Date for WooCommerce <= 4.5.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dd7d751-961a-4167-bb4a-2bcd66fc3c46?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:34:54Z"},{"id":"wordfence:4ddcb9e7-506d-408d-812b-b95610b636f1","source":"wordfence","cve":"CVE-2025-8445","title":"Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddcb9e7-506d-408d-812b-b95610b636f1?source=api-prod","affected":[{"type":"plugin","slug":"countdown-timer-for-elementor","name":"Countdown Timer for Elementor","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:56:11Z","updated":"2025-09-11T07:24:53Z"},{"id":"wordfence:4ddd9cab-f381-4343-a2e6-ef8a1be2ed4e","source":"wordfence","cve":"CVE-2024-8627","title":"Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ddd9cab-f381-4343-a2e6-ef8a1be2ed4e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-tinymce","name":"Ultimate TinyMCE","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T14:04:38Z","updated":"2024-10-30T02:32:18Z"},{"id":"wordfence:4de0339b-8e04-4434-aa51-9c95f8562a7a","source":"wordfence","cve":"CVE-2025-46488","title":"Visual Builder <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4de0339b-8e04-4434-aa51-9c95f8562a7a?source=api-prod","affected":[{"type":"plugin","slug":"visual-builder","name":"Visual Builder","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-16T15:13:06Z"},{"id":"wordfence:4de0d05f-2f51-4fea-9520-ff07a882d95e","source":"wordfence","cve":"CVE-2024-12206","title":"Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4de0d05f-2f51-4fea-9520-ff07a882d95e?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-09T11:10:57Z"},{"id":"wordfence:4de3b2bc-b1fc-4865-83e9-5f3c76669097","source":"wordfence","cve":"CVE-2026-120555","title":"Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4de3b2bc-b1fc-4865-83e9-5f3c76669097?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.62.0","to_inclusive":true,"patched_in":"4.63.0"}],"published":"2026-11-06T14:07:36Z","updated":"2026-11-07T02:29:15Z"},{"id":"wordfence:4dea175f-3728-4aee-9296-1bb595c83925","source":"wordfence","cve":"CVE-2011-4955","title":"bSuite <= 5 alpha 2 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dea175f-3728-4aee-9296-1bb595c83925?source=api-prod","affected":[{"type":"plugin","slug":"bsuite","name":"bSuite","from":"*","from_inclusive":true,"to":"5 alpha 2","to_inclusive":true,"patched_in":"5 alpha 3"}],"published":"2014-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4deae680-4829-4e24-b67b-4066ec9ce4da","source":"wordfence","cve":"CVE-2006-6808","title":"WordPress Core <= 2.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4deae680-4829-4e24-b67b-4066ec9ce4da?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2007-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4deb128d-0163-4a8e-9591-87352f74c3ef","source":"wordfence","cve":"CVE-2024-7777","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion","severity":"critical","cvss":9.0,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4deb128d-0163-4a8e-9591-87352f74c3ef?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"2.0","from_inclusive":true,"to":"2.13.9","to_inclusive":true,"patched_in":"2.13.10"}],"published":"2024-08-19T15:09:32Z","updated":"2024-08-20T03:21:09Z"},{"id":"wordfence:4deb1527-0637-44f2-b336-d0cf2a48fa52","source":"wordfence","cve":"CVE-2024-1572","title":"WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4deb1527-0637-44f2-b336-d0cf2a48fa52?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:04Z"},{"id":"wordfence:4dec91d7-19cf-480d-871c-427cd1e691a6","source":"wordfence","cve":"CVE-2023-48324","title":"Awesome Support <= 6.1.4 - Missing Authorization via wpas_edit_reply_ajax()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dec91d7-19cf-480d-871c-427cd1e691a6?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4deca6fe-561e-41a9-aaf6-308fde0b0d1b","source":"wordfence","cve":"CVE-2025-31536","title":"CF7 Spreadsheets <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4deca6fe-561e-41a9-aaf6-308fde0b0d1b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-spreadsheets","name":"CF7 Spreadsheets","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T18:47:56Z"},{"id":"wordfence:4decc923-dda8-4aed-b431-1718ad39c376","source":"wordfence","cve":"CVE-2026-57402","title":"Flexible Refund for WooCommerce \u2013 EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4decc923-dda8-4aed-b431-1718ad39c376?source=api-prod","affected":[{"type":"plugin","slug":"flexible-refund-and-return-order-for-woocommerce","name":"Flexible Refund for WooCommerce \u2013 EU One Click Return","from":"*","from_inclusive":true,"to":"1.0.51","to_inclusive":true,"patched_in":"1.0.52"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:43:37Z"},{"id":"wordfence:4dece711-f603-4133-aa15-5bb2bec381b6","source":"wordfence","cve":"CVE-2026-86813","title":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 - Unauthenticated Email Header Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dece711-f603-4133-aa15-5bb2bec381b6?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":false,"patched_in":"4.1.9"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:47:16Z"},{"id":"wordfence:4decf597-1819-402f-ab28-2446a3e6215f","source":"wordfence","cve":"CVE-2025-14938","title":"Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media Upload","severity":"medium","cvss":5.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4decf597-1819-402f-ab28-2446a3e6215f?source=api-prod","affected":[{"type":"plugin","slug":"listeo-core","name":"Listeo-Core - Directory Plugin by Purethemes","from":"*","from_inclusive":true,"to":"2.0.27","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2026-04-03T22:09:52Z","updated":"2026-04-04T11:16:15Z"},{"id":"wordfence:4dee07a1-9f48-4e8f-89dc-99270f55f17c","source":"wordfence","cve":"CVE-2024-32587","title":"Env\u00edaloSimple: Email Marketing y Newsletters <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dee07a1-9f48-4e8f-89dc-99270f55f17c?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:58:57Z"},{"id":"wordfence:4df46cb5-11a9-4c44-8329-4fc8086bc367","source":"wordfence","cve":"CVE-2025-22713","title":"WooCommerce Orders & Customers Exporter <= 5.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df46cb5-11a9-4c44-8329-4fc8086bc367?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-orders-ei","name":"WooCommerce Orders & Customers Exporter","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:01:32Z"},{"id":"wordfence:4df5bd44-3f72-4ca3-981e-9c11c9e6ab42","source":"wordfence","cve":"CVE-2025-58253","title":"Real Estate Manager <= 7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df5bd44-3f72-4ca3-981e-9c11c9e6ab42?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:4df60fbe-4475-4cbf-b497-a9c5251bc91f","source":"wordfence","cve":"CVE-2025-1769","title":"Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df60fbe-4475-4cbf-b497-a9c5251bc91f?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-03-25T23:20:01Z","updated":"2025-03-26T11:22:10Z"},{"id":"wordfence:4df635b8-4c56-4b24-8446-8e39e6fe7441","source":"wordfence","cve":"CVE-2018-20149","title":"WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df635b8-4c56-4b24-8446-8e39e6fe7441?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4df72b72-1188-4a02-9a53-7c69f7e31ddd","source":"wordfence","cve":"CVE-2024-12735","title":"Advance Post Prefix <= 1.1.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df72b72-1188-4a02-9a53-7c69f7e31ddd?source=api-prod","affected":[{"type":"plugin","slug":"advance-post-prefix","name":"Advance Post Prefix","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-05-27T15:50:28Z"},{"id":"wordfence:4df9918b-7201-4cd7-978d-4a1fa207a97c","source":"wordfence","cve":"CVE-2025-68033","title":"Custom Related Posts <= 1.8.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4df9918b-7201-4cd7-978d-4a1fa207a97c?source=api-prod","affected":[{"type":"plugin","slug":"custom-related-posts","name":"Custom Related Posts","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-27T20:51:02Z"},{"id":"wordfence:4dfa825c-b0f7-4588-9bf8-cd186a5fc0ff","source":"wordfence","cve":"CVE-2022-41990","title":"3D Tag Cloud <= 3.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfa825c-b0f7-4588-9bf8-cd186a5fc0ff?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-3d-tag-cloud","name":"3D Tag Cloud","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-06T13:56:42Z"},{"id":"wordfence:4dfc237a-9157-4da9-ba8f-9daf2ba4f20b","source":"wordfence","cve":"CVE-2023-2302","title":"Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc237a-9157-4da9-ba8f-9daf2ba4f20b?source=api-prod","affected":[{"type":"plugin","slug":"lead-capturing-call-to-actions-by-vcita","name":"Contact Form and Calls To Action by vcita","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4dfc28ec-1411-43c3-833e-a6c85a3ed767","source":"wordfence","cve":"CVE-2025-3775","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) <= 3.1.2 - Unauthenticated Server-Side Request Forgery via URL Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc28ec-1411-43c3-833e-a6c85a3ed767?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-04-24T16:21:41Z","updated":"2025-04-25T04:23:05Z"},{"id":"wordfence:4e018ce5-ec78-42a9-ab70-4fb3eaa347b9","source":"wordfence","cve":"CVE-2024-13629","title":"pushBIZ \u2013 Push Notification <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e018ce5-ec78-42a9-ab70-4fb3eaa347b9?source=api-prod","affected":[{"type":"plugin","slug":"pushbiz","name":"pushBIZ \u2013 Push Notification","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:34:30Z"},{"id":"wordfence:4e03b0b9-861d-4909-8608-6378cd0b9176","source":"wordfence","cve":"CVE-2024-43117","title":"Hummingbird <= 3.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e03b0b9-861d-4909-8608-6378cd0b9176?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:44:27Z"},{"id":"wordfence:4e0424f8-f60f-49c3-9969-a88c830dc0e2","source":"wordfence","cve":"CVE-2023-27620","title":"Robo Gallery <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0424f8-f60f-49c3-9969-a88c830dc0e2?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e04b161-3cd0-454d-869c-56f42bd8afb0","source":"wordfence","cve":"CVE-2024-4041","title":"Yoast SEO <= 22.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e04b161-3cd0-454d-869c-56f42bd8afb0?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"22.5","to_inclusive":true,"patched_in":"22.6"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:25Z"},{"id":"wordfence:4e054485-71cc-47c2-9bd6-4f060dc76738","source":"wordfence","cve":"CVE-2022-3484","title":"WPB Show Core <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e054485-71cc-47c2-9bd6-4f060dc76738?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2022-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e076c10-7b83-4016-ae31-ee486178a988","source":"wordfence","cve":"CVE-2025-4580","title":"File Provider <= 1.2.3 - Cross-Site Request Forgery to Item Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e076c10-7b83-4016-ae31-ee486178a988?source=api-prod","affected":[{"type":"plugin","slug":"file-provider","name":"File Provider","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T00:00:00Z","updated":"2025-06-06T14:02:22Z"},{"id":"wordfence:4e0ad29a-b7a0-407e-8fb0-0917b8671afb","source":"wordfence","cve":"CVE-2023-47554","title":"Actueel Financieel Nieuws \u2013 Denk Internet Solutions <= 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0ad29a-b7a0-407e-8fb0-0917b8671afb?source=api-prod","affected":[{"type":"plugin","slug":"denk-internet-solutions","name":"Actueel Financieel Nieuws \u2013 Denk Internet Solutions","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-06-13T16:33:01Z"},{"id":"wordfence:4e0baa10-f576-48f5-ad7f-2cbae9d0abd0","source":"wordfence","cve":"CVE-2025-67984","title":"NPS computy <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0baa10-f576-48f5-ad7f-2cbae9d0abd0?source=api-prod","affected":[{"type":"plugin","slug":"nps-computy","name":"NPS computy","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T20:59:25Z"},{"id":"wordfence:4e0d21e6-d8a2-44ab-87f3-9e5a16562020","source":"wordfence","cve":"CVE-2022-35730","title":"Oceanwp sticky header <= 1.0.8 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0d21e6-d8a2-44ab-87f3-9e5a16562020?source=api-prod","affected":[{"type":"plugin","slug":"sticky-header-oceanwp","name":"Oceanwp sticky header","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e0f38db-84bb-4ba9-9068-40937e78010d","source":"wordfence","cve":"CVE-2024-12067","title":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0f38db-84bb-4ba9-9068-40937e78010d?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"10.0.0","to_inclusive":true,"patched_in":"10.0.1"}],"published":"2025-01-08T22:00:30Z","updated":"2025-11-05T19:18:23Z"},{"id":"wordfence:4e0f666b-0549-4728-b056-4d59cf262c4b","source":"wordfence","cve":"CVE-2025-53242","title":"Seil <= 1.7.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0f666b-0549-4728-b056-4d59cf262c4b?source=api-prod","affected":[{"type":"theme","slug":"seil","name":"Seil - A Responsive WordPress Blog Theme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-08T00:00:00Z","updated":"2025-11-12T13:55:54Z"},{"id":"wordfence:4e0fd492-19ee-430e-a495-99ad28043bf9","source":"wordfence","cve":"CVE-2025-12836","title":"VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e0fd492-19ee-430e-a495-99ad28043bf9?source=api-prod","affected":[{"type":"plugin","slug":"vk-google-job-posting-manager","name":"VK Google Job Posting Manager","from":"*","from_inclusive":true,"to":"1.2.23","to_inclusive":true,"patched_in":"1.2.24"}],"published":"2026-01-23T19:16:27Z","updated":"2026-02-03T19:00:36Z"},{"id":"wordfence:4e1299dc-75a6-4c77-bb92-cb31eea3ab05","source":"wordfence","cve":"CVE-2023-26002","title":"6Storage Rentals <= 2.19.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e1299dc-75a6-4c77-bb92-cb31eea3ab05?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.19.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T14:55:18Z"},{"id":"wordfence:4e190cf2-f968-4e81-af31-bfc67815772c","source":"wordfence","cve":"CVE-2026-57784","title":"Ninja Forms File Uploads Extension <= 3.3.26 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e190cf2-f968-4e81-af31-bfc67815772c?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.26","to_inclusive":true,"patched_in":""}],"published":"2026-04-08T00:00:00Z","updated":"2026-08-17T04:26:57Z"},{"id":"wordfence:4e190fe3-5947-4da3-95ef-aa4973419696","source":"wordfence","cve":"CVE-2024-12568","title":"Email Subscribers by Icegram Express \u2013 Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e190fe3-5947-4da3-95ef-aa4973419696?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.44","to_inclusive":true,"patched_in":"5.7.45"}],"published":"2024-12-23T00:00:00Z","updated":"2025-01-17T12:34:09Z"},{"id":"wordfence:4e1a40cc-0b20-4713-b713-5766619d38cb","source":"wordfence","cve":"CVE-2025-46486","title":"Nomupay Payment Processing Gateway <= 7.1.7 - Authenticated (Shop Manager+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e1a40cc-0b20-4713-b713-5766619d38cb?source=api-prod","affected":[{"type":"plugin","slug":"totalprocessing-card-payments","name":"Total processing card payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-14T14:20:27Z"},{"id":"wordfence:4e1c2d20-013e-4cad-865d-287924c18673","source":"wordfence","cve":"CVE-2025-58196","title":"UiCore Elements <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e1c2d20-013e-4cad-865d-287924c18673?source=api-prod","affected":[{"type":"plugin","slug":"uicore-elements","name":"UiCore Elements \u2013 Free widgets and templates for Elementor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:34:02Z"},{"id":"wordfence:4e1cd584-ffb8-43d6-a7b6-141c59ac463d","source":"wordfence","cve":"CVE-2025-13838","title":"WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e1cd584-ffb8-43d6-a7b6-141c59ac463d?source=api-prod","affected":[{"type":"plugin","slug":"wishsuite","name":"WishSuite \u2013 Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-12-20T14:14:40Z","updated":"2025-12-21T02:20:31Z"},{"id":"wordfence:4e215e56-1c2c-4da8-8dbe-e769759b76d7","source":"wordfence","cve":"CVE-2026-107429","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e215e56-1c2c-4da8-8dbe-e769759b76d7?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.5.12","to_inclusive":true,"patched_in":"7.5.13"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-13T19:39:10Z"},{"id":"wordfence:4e219891-7342-4dd9-ac4f-636a5058ecad","source":"wordfence","cve":"CVE-2023-54359","title":"Travel & Tours Meta Search <= 2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e219891-7342-4dd9-ac4f-636a5058ecad?source=api-prod","affected":[{"type":"plugin","slug":"adiaha-hotel","name":"Travel & Tours Meta Search","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-09T00:00:00Z","updated":"2026-07-29T21:35:09Z"},{"id":"wordfence:4e240c06-cc35-4f26-ae55-4dce60e5bec3","source":"wordfence","cve":"CVE-2024-38789","title":"Telegram Bot & Channel <= 3.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e240c06-cc35-4f26-ae55-4dce60e5bec3?source=api-prod","affected":[{"type":"plugin","slug":"telegram-bot","name":"Telegram Bot & Channel","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"4.0"}],"published":"2024-07-20T00:00:00Z","updated":"2025-05-29T20:01:08Z"},{"id":"wordfence:4e2527d4-750d-4e36-ae27-920105958c21","source":"wordfence","cve":"CVE-2022-2926","title":"Download Manager <= 3.2.54 - Authenticated (Admin+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e2527d4-750d-4e36-ae27-920105958c21?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.55","to_inclusive":false,"patched_in":"3.2.55"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e2603e2-a89c-4fb1-b219-6cf5a7560bea","source":"wordfence","cve":"CVE-2025-48250","title":"Coupons &amp; Add to Cart by URL Links for WooCommerce <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e2603e2-a89c-4fb1-b219-6cf5a7560bea?source=api-prod","affected":[{"type":"plugin","slug":"url-coupons-for-woocommerce-by-algoritmika","name":"Coupons & Add to Cart by URL Links for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:51:45Z"},{"id":"wordfence:4e261b0e-5ca3-4f5c-acc0-41abee31b148","source":"wordfence","cve":"CVE-2024-8794","title":"BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset","severity":"medium","cvss":5.3,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e261b0e-5ca3-4f5c-acc0-41abee31b148?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T02:31:03Z"},{"id":"wordfence:4e262772-06b7-4490-a342-5b1abc421b67","source":"wordfence","cve":"CVE-2022-1267","title":"BMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e262772-06b7-4490-a342-5b1abc421b67?source=api-prod","affected":[{"type":"plugin","slug":"bmi-bmr-calculator","name":"BMI BMR Calculator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e26f5a0-dd6b-461e-9541-4ae504398544","source":"wordfence","cve":"CVE-2025-39455","title":"IP2Location Variables <= 2.9.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e26f5a0-dd6b-461e-9541-4ae504398544?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-variables","name":"IP2Location Variables","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:44:26Z"},{"id":"wordfence:4e27137d-1120-4ca5-8560-bbd5a382222e","source":"wordfence","cve":"CVE-2025-62139","title":"Terms descriptions <= 3.4.9 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e27137d-1120-4ca5-8560-bbd5a382222e?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:36:33Z"},{"id":"wordfence:4e285ce1-0896-4eef-aa83-59fb6641960b","source":"wordfence","cve":"CVE-2023-23985","title":"Quiz Maker <= 6.3.9.4 - Content Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-451","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e285ce1-0896-4eef-aa83-59fb6641960b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.3.9.4","to_inclusive":true,"patched_in":"6.3.9.5"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e30c4fd-91fd-4f05-85fa-73e445de3c6e","source":"wordfence","cve":"","title":"Link Library <= 5.9.12.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e30c4fd-91fd-4f05-85fa-73e445de3c6e?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"5.9.12.30","to_inclusive":false,"patched_in":"5.9.12.30"}],"published":"2016-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e337281-f05e-486c-9491-161365af252a","source":"wordfence","cve":"CVE-2025-1682","title":"Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e337281-f05e-486c-9491-161365af252a?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-27T23:22:39Z"},{"id":"wordfence:4e343489-4969-4a16-9741-34de93c8b06e","source":"wordfence","cve":"CVE-2022-45851","title":"ShareThis Dashboard for Google Analytics <= 3.1.4 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e343489-4969-4a16-9741-34de93c8b06e?source=api-prod","affected":[{"type":"plugin","slug":"googleanalytics","name":"ShareThis Dashboard for Google Analytics","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2022-11-23T00:00:00Z","updated":"2024-05-03T19:34:17Z"},{"id":"wordfence:4e361a98-94c5-4775-a306-b343997e1cde","source":"wordfence","cve":"CVE-2022-0634","title":"ThirstyAffiliates Affiliate Link Manager <= 3.10.4 - Authorization Bypass and Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e361a98-94c5-4775-a306-b343997e1cde?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2022-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e376c96-47a8-419f-ab45-f7c46510c767","source":"wordfence","cve":"CVE-2025-12353","title":"WPFunnels <= 3.6.2 - Unauthorized User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-11-07T15:06:12Z","updated":"2025-11-08T03:27:49Z"},{"id":"wordfence:4e376fce-48a7-4b33-8a5a-9402625d24c0","source":"wordfence","cve":"CVE-2024-6712","title":"MapFig Studio <= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376fce-48a7-4b33-8a5a-9402625d24c0?source=api-prod","affected":[{"type":"plugin","slug":"mapfig-studio","name":"MapFig Studio","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-08-01T13:39:06Z"},{"id":"wordfence:4e381ad7-efe6-48c4-af3a-22d01d73a065","source":"wordfence","cve":"CVE-2023-25448","title":"Archivist \u2013 Custom Archive Templates <= 1.7.4 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e381ad7-efe6-48c4-af3a-22d01d73a065?source=api-prod","affected":[{"type":"plugin","slug":"archivist-custom-archive-templates","name":"Archivist \u2013 Custom Archive Templates","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e383235-8f61-46f2-bd54-cc41e3ec189e","source":"wordfence","cve":"CVE-2022-1604","title":"MailerLite - Signup forms <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e383235-8f61-46f2-bd54-cc41e3ec189e?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e3931c2-c9b4-412e-941d-840c5bb9be89","source":"wordfence","cve":"CVE-2018-6891","title":"WordPress Online Booking and Scheduling Plugin \u2013 Bookly <= 14.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3931c2-c9b4-412e-941d-840c5bb9be89?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"14.5","to_inclusive":true,"patched_in":"14.6"}],"published":"2018-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e3a6fe2-6292-44ff-8925-a4aeb77c2a7f","source":"wordfence","cve":"","title":"WordPress Core < 6.2.2 - Shortcode Execution in User Generated Content","severity":"medium","cvss":6.5,"cwe":"CWE-349","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3a6fe2-6292-44ff-8925-a4aeb77c2a7f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":false,"patched_in":"5.9.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":false,"patched_in":"5.9.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":false,"patched_in":"5.9.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":false,"patched_in":"5.9.7"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e3cb44c-ed14-42d5-9e26-0904978bd2a4","source":"wordfence","cve":"CVE-2025-22344","title":"Media Category Library <= 2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3cb44c-ed14-42d5-9e26-0904978bd2a4?source=api-prod","affected":[{"type":"plugin","slug":"media-category-library","name":"Media Category Library","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:01:33Z"},{"id":"wordfence:4e3d0ffd-209b-4e29-bc1d-91f2498b4632","source":"wordfence","cve":"CVE-2024-13650","title":"Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3d0ffd-209b-4e29-bc1d-91f2498b4632?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.36","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T13:10:41Z","updated":"2025-07-24T19:10:34Z"},{"id":"wordfence:4e3da1d3-5ec3-4f94-a834-3f3a6fc23f0a","source":"wordfence","cve":"CVE-2018-20974","title":"JS Job Manager <= 1.0.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3da1d3-5ec3-4f94-a834-3f3a6fc23f0a?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2018-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e3e0795-35d3-438f-953f-794118425339","source":"wordfence","cve":"CVE-2026-107343","title":"Kali Forms <= 2.4.29 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3e0795-35d3-438f-953f-794118425339?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-03T19:21:10Z"},{"id":"wordfence:4e3e3bf4-7b95-4c0b-b660-d29796b643ed","source":"wordfence","cve":"CVE-2026-24360","title":"Seriously Simple Podcasting <= 3.14.1 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3e3bf4-7b95-4c0b-b660-d29796b643ed?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2026-01-13T00:00:00Z","updated":"2026-02-03T20:53:26Z"},{"id":"wordfence:4e3f4e4f-6781-4134-b0ba-3625d7009d0c","source":"wordfence","cve":"CVE-2022-0385","title":"Crazy Bone <= 0.6.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3f4e4f-6781-4134-b0ba-3625d7009d0c?source=api-prod","affected":[{"type":"plugin","slug":"crazy-bone","name":"Crazy Bone","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e3fa273-383a-46ac-8525-5508aaf33424","source":"wordfence","cve":"CVE-2025-27012","title":"A1POST.BG Shipping for WooCommerce <= 1.5 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e3fa273-383a-46ac-8525-5508aaf33424?source=api-prod","affected":[{"type":"plugin","slug":"a1post-bg-shipping-for-woocommerce","name":"A1POST.BG Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-20T13:56:19Z"},{"id":"wordfence:4e413262-b28e-4650-a200-67285a45670f","source":"wordfence","cve":"CVE-2025-68006","title":"Booking Ultra Pro <= 1.1.23 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e413262-b28e-4650-a200-67285a45670f?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-15T16:05:20Z"},{"id":"wordfence:4e41a12d-44a6-4851-b72a-ffa65bbbeb0b","source":"wordfence","cve":"CVE-2022-42884","title":"WIP Custom Login <= 1.2.7 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e41a12d-44a6-4851-b72a-ffa65bbbeb0b?source=api-prod","affected":[{"type":"plugin","slug":"wip-custom-login","name":"WIP Custom Login","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e427c4e-3e27-49e3-ba64-6241b430d5d8","source":"wordfence","cve":"CVE-2026-18316","title":"Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e427c4e-3e27-49e3-ba64-6241b430d5d8?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T05:27:28Z"},{"id":"wordfence:4e444a30-11c5-4219-b4fe-635084cbac3a","source":"wordfence","cve":"CVE-2024-13553","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e444a30-11c5-4219-b4fe-635084cbac3a?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T11:12:31Z"},{"id":"wordfence:4e47238a-8386-4a41-a1b5-786c125046a8","source":"wordfence","cve":"CVE-2026-107506","title":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website < 3.3.3 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e47238a-8386-4a41-a1b5-786c125046a8?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:55:07Z"},{"id":"wordfence:4e479a3f-ef1a-4476-89e1-86d0f388f2c3","source":"wordfence","cve":"CVE-2025-6718","title":"B1.lt for WooCommerce <= 2.2.57 -  Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e479a3f-ef1a-4476-89e1-86d0f388f2c3?source=api-prod","affected":[{"type":"plugin","slug":"b1-accounting","name":"Site.pro for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.57","to_inclusive":true,"patched_in":"2.2.58"}],"published":"2025-07-17T16:35:21Z","updated":"2025-11-05T21:45:03Z"},{"id":"wordfence:4e481e81-f581-48f7-b699-0be85e099c84","source":"wordfence","cve":"CVE-2024-49233","title":"MAS Elementor <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e481e81-f581-48f7-b699-0be85e099c84?source=api-prod","affected":[{"type":"plugin","slug":"mas-addons-for-elementor","name":"MAS Elementor","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:02:23Z"},{"id":"wordfence:4e498706-3dbe-4c48-9c0d-0d90677aba0d","source":"wordfence","cve":"CVE-2023-5703","title":"Gift Up Gift Cards for WordPress and WooCommerce <= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e498706-3dbe-4c48-9c0d-0d90677aba0d?source=api-prod","affected":[{"type":"plugin","slug":"gift-up","name":"Gift Up Gift Cards for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"2.20.1","to_inclusive":true,"patched_in":"2.20.2"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e4a605e-542b-4001-84d8-0a0aad044798","source":"wordfence","cve":"CVE-2023-25982","title":"Simple YouTube Responsive <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4a605e-542b-4001-84d8-0a0aad044798?source=api-prod","affected":[{"type":"plugin","slug":"simple-youtube-responsive","name":"Simple YouTube Responsive","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e4dab1c-357f-440f-b3c7-598834a16599","source":"wordfence","cve":"CVE-2025-5034","title":"WP File Download <= 6.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4dab1c-357f-440f-b3c7-598834a16599?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download","name":"WP File Download","from":"*","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.2.6"}],"published":"2025-05-31T00:00:00Z","updated":"2025-07-09T15:12:18Z"},{"id":"wordfence:4e4df9a6-8f7d-428b-a596-0751ca047169","source":"wordfence","cve":"CVE-2026-1461","title":"Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values","severity":"medium","cvss":6.5,"cwe":"CWE-230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4df9a6-8f7d-428b-a596-0751ca047169?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T09:27:06Z"},{"id":"wordfence:4e4ee98d-695a-4c47-864b-0d60e1691b8a","source":"wordfence","cve":"CVE-2025-58943","title":"Agricola <= 1.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4ee98d-695a-4c47-864b-0d60e1691b8a?source=api-prod","affected":[{"type":"theme","slug":"agricola","name":"Agricola - Agriculture & Organic Farm Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:35:11Z"},{"id":"wordfence:4e4f0275-7689-4b72-9761-45534f9c706d","source":"wordfence","cve":"CVE-2025-57917","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.13.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4f0275-7689-4b72-9761-45534f9c706d?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-30T17:16:32Z"},{"id":"wordfence:4e4f2725-6c93-40df-93ee-51997a4ad189","source":"wordfence","cve":"CVE-2022-3136","title":"Social Rocket <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4f2725-6c93-40df-93ee-51997a4ad189?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e4fb2ab-0403-4d6c-98d3-4286bf51b671","source":"wordfence","cve":"CVE-2026-96328","title":"JNews - Pay Writer <= 12.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4fb2ab-0403-4d6c-98d3-4286bf51b671?source=api-prod","affected":[{"type":"plugin","slug":"jnews-pay-writer","name":"JNews - Pay Writer","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":true,"patched_in":"12.0.2"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:35:56Z"},{"id":"wordfence:4e4fe4b6-cc1e-40be-bd2e-bf2745244892","source":"wordfence","cve":"CVE-2025-14054","title":"WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e4fe4b6-cc1e-40be-bd2e-bf2745244892?source=api-prod","affected":[{"type":"plugin","slug":"wc-builder","name":"WC Builder \u2013 WooCommerce Page Builder for WPBakery","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-12-20T14:13:49Z","updated":"2025-12-21T02:20:32Z"},{"id":"wordfence:4e507019-b65f-48f0-8b8d-62ec57258404","source":"wordfence","cve":"CVE-2026-14326","title":"Timetics < 1.0.62 - Authenticated (Staff+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e507019-b65f-48f0-8b8d-62ec57258404?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.62","to_inclusive":false,"patched_in":"1.0.62"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-23T14:30:12Z"},{"id":"wordfence:4e51eb56-e2f7-433c-8db7-bcf7539aee29","source":"wordfence","cve":"CVE-2022-1156","title":"Books & Papers <= 0.20210223 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e51eb56-e2f7-433c-8db7-bcf7539aee29?source=api-prod","affected":[{"type":"plugin","slug":"books-papers","name":"Books & Papers","from":"*","from_inclusive":true,"to":"0.20210223","to_inclusive":true,"patched_in":"0.20220219"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e534021-1c63-4db9-914b-7f9b3b613087","source":"wordfence","cve":"CVE-2022-3489","title":"WP Hide <= 0.0.2 - Missing Authorization to Settings Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e534021-1c63-4db9-914b-7f9b3b613087?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide","name":"Wp-Hide","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e54613a-24c7-4e2d-a14b-07912acfb69a","source":"wordfence","cve":"CVE-2014-4582","title":"WP Consultant <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e54613a-24c7-4e2d-a14b-07912acfb69a?source=api-prod","affected":[{"type":"plugin","slug":"wp-consultant","name":"WP Consultant","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e575468-6f39-478c-972f-e73bef76dad5","source":"wordfence","cve":"CVE-2025-15643","title":"Adsmonetizer <= 3.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e575468-6f39-478c-972f-e73bef76dad5?source=api-prod","affected":[{"type":"plugin","slug":"adsensei-b30","name":"Adsmonetizer","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2026-10-09T12:31:45Z"},{"id":"wordfence:4e576c6e-6a9b-439d-bde3-8657435596f6","source":"wordfence","cve":"CVE-2024-31102","title":"Prenotazioni <= 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e576c6e-6a9b-439d-bde3-8657435596f6?source=api-prod","affected":[{"type":"plugin","slug":"prenotazioni","name":"Prenotazioni","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:59:01Z"},{"id":"wordfence:4e57e1c8-0b4c-4e94-a6ac-b8972389510f","source":"wordfence","cve":"CVE-2025-49058","title":"SoundSt SEO Search <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e57e1c8-0b4c-4e94-a6ac-b8972389510f?source=api-prod","affected":[{"type":"plugin","slug":"soundst-seo-search","name":"SoundSt SEO Search","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-19T13:42:08Z"},{"id":"wordfence:4e591cb4-058d-4d8e-948e-d65ab01db618","source":"wordfence","cve":"CVE-2026-19883","title":"WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e591cb4-058d-4d8e-948e-d65ab01db618?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.24","to_inclusive":true,"patched_in":"2.8.25"}],"published":"2026-08-21T14:22:49Z","updated":"2026-08-25T16:34:38Z"},{"id":"wordfence:4e5d7d04-f73a-48ea-81e3-36a514c76cc6","source":"wordfence","cve":"CVE-2025-10748","title":"RapidResult <= 1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e5d7d04-f73a-48ea-81e3-36a514c76cc6?source=api-prod","affected":[{"type":"plugin","slug":"rapidresult","name":"RapidResult","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-10-23T20:08:55Z","updated":"2025-11-03T15:22:49Z"},{"id":"wordfence:4e5f792b-feb3-442a-ad23-d09c618a4677","source":"wordfence","cve":"CVE-2026-19715","title":"WP OAuth Server ( Login with WordPress ) < 6.3.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e5f792b-feb3-442a-ad23-d09c618a4677?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-20-server","name":"WP OAuth Server ( Login with WordPress )","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":false,"patched_in":"6.3.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:54:48Z"},{"id":"wordfence:4e620ae8-03fc-43b5-8e8f-5b0884e8eefb","source":"wordfence","cve":"CVE-2024-8720","title":"RumbleTalk Live Group Chat \u2013 HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e620ae8-03fc-43b5-8e8f-5b0884e8eefb?source=api-prod","affected":[{"type":"plugin","slug":"rumbletalk-chat-a-chat-with-themes","name":"RumbleTalk Group Chat  for Communities & Live Events","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-04T12:35:32Z"},{"id":"wordfence:4e62f27b-c6b0-48ed-bfd7-a1893552eb3e","source":"wordfence","cve":"CVE-2024-21743","title":"Quiz Maker <= 6.5.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e62f27b-c6b0-48ed-bfd7-a1893552eb3e?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.1.1","to_inclusive":true,"patched_in":"6.5.1.2"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e63a30d-a071-40f4-b603-f4fea73a51c4","source":"wordfence","cve":"CVE-2025-23538","title":"WP Contest <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e63a30d-a071-40f4-b603-f4fea73a51c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-contest","name":"WP Contest","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:53:04Z"},{"id":"wordfence:4e648f65-3eeb-405d-b243-26354f3843c8","source":"wordfence","cve":"CVE-2024-9225","title":"SEOPress \u2013 On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e648f65-3eeb-405d-b243-26354f3843c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T07:35:27Z"},{"id":"wordfence:4e6654b6-90ae-4a5e-bff3-82848813872a","source":"wordfence","cve":"CVE-2022-32587","title":"WP Page Widget <= 3.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6654b6-90ae-4a5e-bff3-82848813872a?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-widget","name":"WP Page Widget","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e68b2f2-12e4-4ff2-919d-26d6b21acd03","source":"wordfence","cve":"CVE-2026-18438","title":"Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e68b2f2-12e4-4ff2-919d-26d6b21acd03?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-08-14T20:45:28Z","updated":"2026-08-15T09:25:18Z"},{"id":"wordfence:4e6a896c-9cca-4e4d-b26d-0103a8b39bf7","source":"wordfence","cve":"CVE-2024-1307","title":"Smart Forms <= 2.6.93 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6a896c-9cca-4e4d-b26d-0103a8b39bf7?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.93","to_inclusive":true,"patched_in":"2.6.94"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-23T14:38:21Z"},{"id":"wordfence:4e6b39da-26d4-4615-b6c7-68909bdf0a61","source":"wordfence","cve":"CVE-2023-31091","title":"Dynamically Register Sidebars <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6b39da-26d4-4615-b6c7-68909bdf0a61?source=api-prod","affected":[{"type":"plugin","slug":"dynamically-register-sidebars","name":"Dynamically Register Sidebars","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e6b9ced-b303-43fe-8622-a32685f0a4ea","source":"wordfence","cve":"CVE-2026-48866","title":"Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6b9ced-b303-43fe-8622-a32685f0a4ea?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.0.1","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-02T11:27:07Z"},{"id":"wordfence:4e6c63de-a1cc-4b43-903e-b0a78c614184","source":"wordfence","cve":"CVE-2025-23658","title":"Advanced Angular Contact Form <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6c63de-a1cc-4b43-903e-b0a78c614184?source=api-prod","affected":[{"type":"plugin","slug":"advanced-angular-contact-form","name":"Advanced Angular Contact Form","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:38:26Z"},{"id":"wordfence:4e6d4ad1-0fcc-43d9-b997-126782718c28","source":"wordfence","cve":"CVE-2024-32138","title":"Short URL <= 1.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6d4ad1-0fcc-43d9-b997-126782718c28?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:31:47Z"},{"id":"wordfence:4e6e8f68-6977-478a-b62e-0ec9385eb2af","source":"wordfence","cve":"CVE-2024-12018","title":"Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6e8f68-6977-478a-b62e-0ec9385eb2af?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-variables","name":"Snippet Shortcodes","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:23Z"},{"id":"wordfence:4e6ef932-975c-423b-b780-b38449eec577","source":"wordfence","cve":"CVE-2023-2296","title":"Loginizer <= 1.7.8 - Reflected Cross-Site Scripting via 'limit_session[count]'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e6ef932-975c-423b-b780-b38449eec577?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e704333-ad88-42c9-b632-babc9d54cb13","source":"wordfence","cve":"CVE-2023-35046","title":"Dynamic Visibility for Elementor <= 5.0.5 - Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e704333-ad88-42c9-b632-babc9d54cb13?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-visibility-for-elementor","name":"Dynamic Visibility for Elementor","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":false,"patched_in":"5.0.6"}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e725c3c-3c12-4aa8-a0f8-80b4fbbf0b24","source":"wordfence","cve":"CVE-2026-39582","title":"Hitek < 1.8.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e725c3c-3c12-4aa8-a0f8-80b4fbbf0b24?source=api-prod","affected":[{"type":"theme","slug":"xts-hitek","name":"Hitek - Electronics WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:09:03Z"},{"id":"wordfence:4e72828e-a6f6-43fc-8a10-d9908004c0fc","source":"wordfence","cve":"CVE-2024-13473","title":"LTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e72828e-a6f6-43fc-8a10-d9908004c0fc?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-worldwide-express-edition","name":"LTL Freight Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.0.20","to_inclusive":true,"patched_in":"5.0.21"}],"published":"2025-02-11T20:34:47Z","updated":"2025-02-12T09:22:48Z"},{"id":"wordfence:4e731110-473b-4f0c-8eb1-7b964a0f9aed","source":"wordfence","cve":"CVE-2025-57908","title":"Product Time Countdown for WooCommerce <= 1.6.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e731110-473b-4f0c-8eb1-7b964a0f9aed?source=api-prod","affected":[{"type":"plugin","slug":"product-countdown-for-woocommerce","name":"Product Time Countdown for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:15:08Z"},{"id":"wordfence:4e77168e-079e-4c48-9c3a-cb8bfb3d3e53","source":"wordfence","cve":"CVE-2026-16563","title":"Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e77168e-079e-4c48-9c3a-cb8bfb3d3e53?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:40:36Z"},{"id":"wordfence:4e780461-3fda-491d-ac77-dee52f8197b3","source":"wordfence","cve":"CVE-2021-24850","title":"Insert Pages <= 3.6.1 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e780461-3fda-491d-ac77-dee52f8197b3?source=api-prod","affected":[{"type":"plugin","slug":"insert-pages","name":"Insert Pages","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e79461b-871c-4ce3-bb85-bfbc2af4f639","source":"wordfence","cve":"CVE-2024-51719","title":"Simplistic SEO <= 2.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e79461b-871c-4ce3-bb85-bfbc2af4f639?source=api-prod","affected":[{"type":"plugin","slug":"simplistic-seo","name":"Simplistic SEO","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:53:37Z"},{"id":"wordfence:4e79c2a3-1b35-48cf-b19c-41f9f96cdf88","source":"wordfence","cve":"CVE-2026-16036","title":"miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e79c2a3-1b35-48cf-b19c-41f9f96cdf88?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.2.7"}],"published":"2026-07-29T00:00:00Z","updated":"2026-09-17T15:18:26Z"},{"id":"wordfence:4e7dc9f0-de37-4480-ac39-4013f92ab465","source":"wordfence","cve":"CVE-2026-42415","title":"Porto Theme - Functionality <= 3.9.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e7dc9f0-de37-4480-ac39-4013f92ab465?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:03:55Z"},{"id":"wordfence:4e7de990-4a6b-4bae-89a2-4a417071fe20","source":"wordfence","cve":"CVE-2024-37550","title":"Template Kit \u2013 Export <= 1.0.21 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e7de990-4a6b-4bae-89a2-4a417071fe20?source=api-prod","affected":[{"type":"plugin","slug":"template-kit-export","name":"Template Kit \u2013 Export","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-18T14:24:09Z"},{"id":"wordfence:4e7e4601-337f-4e4e-b265-63f68f8f8d73","source":"wordfence","cve":"CVE-2026-56006","title":"Interactive Content \u2013 H5P <= 1.17.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e7e4601-337f-4e4e-b265-63f68f8f8d73?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.17.6","to_inclusive":true,"patched_in":"1.17.7"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:34:54Z"},{"id":"wordfence:4e7f310e-1e10-44dd-9928-23e63af21fef","source":"wordfence","cve":"CVE-2022-40216","title":"Better Messages <= 1.9.10.68 - Authorization Bypass to Blocking Control Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e7f310e-1e10-44dd-9928-23e63af21fef?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.10.68","to_inclusive":true,"patched_in":"1.9.10.69"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e7f72d8-beef-4304-8d05-4741fb6165b1","source":"wordfence","cve":"CVE-2025-58996","title":"Advanced Settings <= 3.1.1 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e7f72d8-beef-4304-8d05-4741fb6165b1?source=api-prod","affected":[{"type":"plugin","slug":"advanced-settings","name":"Advanced Settings 3","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-09-24T00:00:00Z","updated":"2025-09-30T12:38:07Z"},{"id":"wordfence:4e81e947-4892-4028-8a09-6a048bf6a572","source":"wordfence","cve":"CVE-2023-32091","title":"POEditor <= 0.9.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e81e947-4892-4028-8a09-6a048bf6a572?source=api-prod","affected":[{"type":"plugin","slug":"poeditor","name":"POEditor","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e835b97-c066-4e8f-b99f-1a930105af0c","source":"wordfence","cve":"CVE-2023-6600","title":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e835b97-c066-4e8f-b99f-1a930105af0c?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.7.10"}],"published":"2024-01-02T00:00:00Z","updated":"2026-06-24T05:32:32Z"},{"id":"wordfence:4e84d1bb-bc6a-4e58-9012-69e6ab91ed51","source":"wordfence","cve":"CVE-2026-124257","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e84d1bb-bc6a-4e58-9012-69e6ab91ed51?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:35Z"},{"id":"wordfence:4e860293-0dfb-444f-a103-33942d9ff75c","source":"wordfence","cve":"CVE-2023-3366","title":"MultiParcels Shipping For WooCommerce <= 1.15.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e860293-0dfb-444f-a103-33942d9ff75c?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.15.2","to_inclusive":false,"patched_in":"1.15.2"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e8822cd-5ced-42d5-907e-72066d8fb835","source":"wordfence","cve":"CVE-2020-13864","title":"Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8822cd-5ced-42d5-907e-72066d8fb835?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2020-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1","source":"wordfence","cve":"CVE-2026-18352","title":"User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2026-08-01T11:07:06Z","updated":"2026-08-01T23:29:35Z"},{"id":"wordfence:4e89329d-5eef-4128-a871-544dc0498aba","source":"wordfence","cve":"CVE-2024-13052","title":"Dental Optimizer Patient Generator App <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e89329d-5eef-4128-a871-544dc0498aba?source=api-prod","affected":[{"type":"plugin","slug":"dental-optimizer-patient-generator-app","name":"Dental Optimizer Patient Generator App","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:28:42Z"},{"id":"wordfence:4e8ad3c1-549b-4401-8cf4-a8b7f81fbc11","source":"wordfence","cve":"CVE-2023-45760","title":"wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8ad3c1-549b-4401-8cf4-a8b7f81fbc11?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e8b8689-ab6a-426b-9aba-4fa14c455ff1","source":"wordfence","cve":"CVE-2024-32957","title":"Page Builder: Live Composer <= 1.5.38 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8b8689-ab6a-426b-9aba-4fa14c455ff1?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.38","to_inclusive":true,"patched_in":"1.5.39"}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T15:00:49Z"},{"id":"wordfence:4e8c311e-7cf2-4aaf-8059-30f872475ee5","source":"wordfence","cve":"CVE-2023-46605","title":"Convertful \u2013 Your Ultimate On-Site Conversion Tool <= 2.5 - Missing Authorization via add_woo_coupon","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8c311e-7cf2-4aaf-8059-30f872475ee5?source=api-prod","affected":[{"type":"plugin","slug":"convertful","name":"Convertful \u2013 Your Ultimate On-Site Conversion Tool","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e8ca12e-b7a7-416a-b37d-c1672375a52d","source":"wordfence","cve":"CVE-2024-38739","title":"OnePress <= 2.3.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8ca12e-b7a7-416a-b37d-c1672375a52d?source=api-prod","affected":[{"type":"theme","slug":"onepress","name":"OnePress","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2024-07-11T00:00:00Z","updated":"2026-07-09T16:59:28Z"},{"id":"wordfence:4e8e52a7-1f5a-4cc0-81db-9b97b5ea7491","source":"wordfence","cve":"CVE-2026-28047","title":"Victo <= 1.4.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8e52a7-1f5a-4cc0-81db-9b97b5ea7491?source=api-prod","affected":[{"type":"theme","slug":"victo","name":"Victo - Ultimate Responsive Magento 2 Theme","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:03:44Z"},{"id":"wordfence:4e8f03f4-f7a6-408c-a79e-f9cd03d77a76","source":"wordfence","cve":"CVE-2024-53278","title":"WP Admin UI Customize <= 1.5.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e8f03f4-f7a6-408c-a79e-f9cd03d77a76?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-ui-customize","name":"WP Admin UI Customize","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":true,"patched_in":"1.5.14"}],"published":"2024-11-26T00:00:00Z","updated":"2024-12-12T18:51:09Z"},{"id":"wordfence:4e907100-156d-4228-a2da-572af6d818e0","source":"wordfence","cve":"CVE-2026-97294","title":"Media Library Assistant <= 3.41 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e907100-156d-4228-a2da-572af6d818e0?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.41","to_inclusive":true,"patched_in":"3.42"}],"published":"2026-10-07T09:10:00Z","updated":"2026-10-09T00:16:53Z"},{"id":"wordfence:4e931a9f-fc17-4f45-bb1c-93257d515085","source":"wordfence","cve":"CVE-2026-18469","title":"Login & Register Forms <= 4.0.1 - Unauthenticated Account Takeover via Brute Force Password Reset Code","severity":"high","cvss":8.1,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e931a9f-fc17-4f45-bb1c-93257d515085?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-17T15:36:55Z"},{"id":"wordfence:4e93f1b0-3aa6-4328-aeb4-bfe561c5a113","source":"wordfence","cve":"CVE-2025-68505","title":"H5P <= 1.16.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e93f1b0-3aa6-4328-aeb4-bfe561c5a113?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-05T21:36:11Z"},{"id":"wordfence:4e944a08-b6c1-456f-921a-501ab4b59f31","source":"wordfence","cve":"CVE-2023-26542","title":"phpinfo() WP <= 4.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e944a08-b6c1-456f-921a-501ab4b59f31?source=api-prod","affected":[{"type":"plugin","slug":"phpinfo-wp","name":"phpinfo() WP \u2013 Site Health, PHP Compatibility & Server Audit","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"5.0"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e94683d-2cf3-4e43-8ab0-f797bfaaeee4","source":"wordfence","cve":"CVE-2022-3690","title":"Popup Maker <= 1.16.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e94683d-2cf3-4e43-8ab0-f797bfaaeee4?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.16.10","to_inclusive":true,"patched_in":"1.16.11"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e9563b8-7e1b-4e87-8b56-17b75adb66c3","source":"wordfence","cve":"CVE-2025-10180","title":"Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9563b8-7e1b-4e87-8b56-17b75adb66c3?source=api-prod","affected":[{"type":"plugin","slug":"markdown-shortcode","name":"Markdown Shortcode","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":"0.2.3"}],"published":"2025-09-25T17:54:41Z","updated":"2025-09-26T06:43:29Z"},{"id":"wordfence:4e95b32b-c050-41eb-8fce-461257420eb6","source":"wordfence","cve":"CVE-2026-1375","title":"Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e95b32b-c050-41eb-8fce-461257420eb6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-02-02T18:41:05Z","updated":"2026-02-03T07:31:25Z"},{"id":"wordfence:4e9698f0-b228-4f4e-838b-c0c0a193d675","source":"wordfence","cve":"CVE-2026-14524","title":"ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9698f0-b228-4f4e-838b-c0c0a193d675?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-08-15T16:16:20Z","updated":"2026-08-16T04:24:52Z"},{"id":"wordfence:4e97e603-b864-41ef-98c8-b0304a72ec44","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e97e603-b864-41ef-98c8-b0304a72ec44?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e9c5e89-9ead-477b-980b-9e48969ad0cf","source":"wordfence","cve":"CVE-2018-9206","title":"Tajer <= 1.0.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9c5e89-9ead-477b-980b-9e48969ad0cf?source=api-prod","affected":[{"type":"plugin","slug":"tajer","name":"Tajer","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2018-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4e9e9afc-89a0-444d-ad5b-975e0f3c19d5","source":"wordfence","cve":"CVE-2024-12495","title":"Bootstrap Blocks for WP Editor v2 <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9e9afc-89a0-444d-ad5b-975e0f3c19d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor-bootstrap-blocks","name":"Bootstrap Blocks for WP Editor v2","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-01-06T18:13:00Z","updated":"2025-01-07T06:40:58Z"},{"id":"wordfence:4e9f16e1-9748-4f5d-84f0-19da68d4f862","source":"wordfence","cve":"CVE-2026-1806","title":"Tour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9f16e1-9748-4f5d-84f0-19da68d4f862?source=api-prod","affected":[{"type":"plugin","slug":"tour-operator-plugin","name":"Tour & Activity Operator Plugin for TourCMS","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:06Z","updated":"2026-03-21T03:26:46Z"},{"id":"wordfence:4ea19d9e-c327-4d4d-bd6e-6cd05ccfc508","source":"wordfence","cve":"CVE-2025-0522","title":"LikeBot \u2013 Decentralized like-system <= 0.85 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea19d9e-c327-4d4d-bd6e-6cd05ccfc508?source=api-prod","affected":[{"type":"plugin","slug":"likebot","name":"LikeBot \u2013 Decentralized like-system","from":"*","from_inclusive":true,"to":"0.85","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-12T19:14:12Z"},{"id":"wordfence:4ea2ed8b-b24a-4da2-9ee7-5a3a4a7a4280","source":"wordfence","cve":"CVE-2021-39333","title":"HashThemes Demo Importer <= 1.1.1 - Missing Authorization to Database Wipe","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea2ed8b-b24a-4da2-9ee7-5a3a4a7a4280?source=api-prod","affected":[{"type":"plugin","slug":"hashthemes-demo-importer","name":"HashThemes Demo Importer","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2021-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ea357cf-1619-42ab-929f-b2dd5deed555","source":"wordfence","cve":"CVE-2025-31883","title":"WebinarPress <= 1.33.30 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea357cf-1619-42ab-929f-b2dd5deed555?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.30","to_inclusive":true,"patched_in":"1.33.31"}],"published":"2025-04-01T00:00:00Z","updated":"2026-10-13T16:54:16Z"},{"id":"wordfence:4ea4ca00-185b-4f5d-9c5c-f81ba4edad05","source":"wordfence","cve":"CVE-2023-2526","title":"Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery via AJAX action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea4ca00-185b-4f5d-9c5c-f81ba4edad05?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.11.7","to_inclusive":true,"patched_in":"1.11.8"}],"published":"2023-05-24T00:00:00Z","updated":"2024-04-11T14:38:32Z"},{"id":"wordfence:4ea634b5-72db-428c-96b4-15ef6025ab1d","source":"wordfence","cve":"CVE-2024-3952","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea634b5-72db-428c-96b4-15ef6025ab1d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"1.52.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:26Z"},{"id":"wordfence:4ea69d47-9d86-4b2d-b3b3-e90b66c0f199","source":"wordfence","cve":"CVE-2026-116391","title":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos <= 3.8.9 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea69d47-9d86-4b2d-b3b3-e90b66c0f199?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-10-26T12:56:02Z","updated":"2026-11-03T19:29:56Z"},{"id":"wordfence:4ea8331e-b521-42d6-a40a-e213c96f1912","source":"wordfence","cve":"CVE-2026-103348","title":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export <= 3.0 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea8331e-b521-42d6-a40a-e213c96f1912?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-10-03T18:39:08Z","updated":"2026-10-08T23:19:43Z"},{"id":"wordfence:4ea89a6e-e089-4e8d-afd8-2a217f6910a6","source":"wordfence","cve":"CVE-2024-12571","title":"Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea89a6e-e089-4e8d-afd8-2a217f6910a6?source=api-prod","affected":[{"type":"plugin","slug":"store-locator","name":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales","from":"3.98.9","from_inclusive":true,"to":"3.98.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2024-12-20T06:59:06Z"},{"id":"wordfence:4ea939f5-8b56-44be-bd20-b69e9ded5970","source":"wordfence","cve":"CVE-2025-14865","title":"Passster \u2013 Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea939f5-8b56-44be-bd20-b69e9ded5970?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"4.2.25"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T12:28:37Z"},{"id":"wordfence:4eab9a5e-ca51-4952-9fd4-3d0046402e29","source":"wordfence","cve":"CVE-2021-24925","title":"Modern Events Calendar Lite <= 6.1.0 - Reflected Cross-Site Scripting via current_month_divider parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eab9a5e-ca51-4952-9fd4-3d0046402e29?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4eacf7b7-100b-423d-920f-14f3e33f5f60","source":"wordfence","cve":"CVE-2026-2489","title":"TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eacf7b7-100b-423d-920f-14f3e33f5f60?source=api-prod","affected":[{"type":"plugin","slug":"tp2wp-importer","name":"TP2WP Importer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:51:03Z","updated":"2026-02-26T01:24:14Z"},{"id":"wordfence:4eaefe2d-b7f8-49ed-8ba1-833e888857b8","source":"wordfence","cve":"CVE-2014-4553","title":"WP-RSS-Spreadshirt-3DCube-Gallery <= 1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eaefe2d-b7f8-49ed-8ba1-833e888857b8?source=api-prod","affected":[{"type":"plugin","slug":"spreadshirt-rss-3d-cube-flash-gallery","name":"WP-RSS-Spreadshirt-3DCube-Gallery","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4eaf4c05-9393-4e44-abd1-8f529b7848b5","source":"wordfence","cve":"CVE-2024-5763","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eaf4c05-9393-4e44-abd1-8f529b7848b5?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2024-08-19T15:13:47Z","updated":"2024-08-20T03:21:09Z"},{"id":"wordfence:4eb2437f-9827-4900-9e23-d223403ec9bb","source":"wordfence","cve":"CVE-2025-28907","title":"WP Last Modified <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb2437f-9827-4900-9e23-d223403ec9bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified","name":"WP Last Modified","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:27:51Z"},{"id":"wordfence:4eb296af-547a-44aa-b804-833204b75256","source":"wordfence","cve":"CVE-2024-2867","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb296af-547a-44aa-b804-833204b75256?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.4","to_inclusive":true,"patched_in":"4.15.5"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-02T16:52:04Z"},{"id":"wordfence:4eb2ae42-584d-4da8-9184-461b5a37b7b6","source":"wordfence","cve":"CVE-2026-1036","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb2ae42-584d-4da8-9184-461b5a37b7b6?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.36","to_inclusive":true,"patched_in":"1.8.37"}],"published":"2026-01-21T10:40:15Z","updated":"2026-01-21T23:23:27Z"},{"id":"wordfence:4eb4400d-d629-4c88-9ec5-06da9089f6d1","source":"wordfence","cve":"CVE-2023-51535","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb4400d-d629-4c88-9ec5-06da9089f6d1?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.20","to_inclusive":true,"patched_in":"6.21"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4eb8f85f-656a-4e5a-a57d-7289da2cd951","source":"wordfence","cve":"CVE-2024-13922","title":"Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb8f85f-656a-4e5a-a57d-7289da2cd951?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-03-19T22:27:37Z","updated":"2025-03-20T11:11:27Z"},{"id":"wordfence:4ebb766a-44e9-460c-be84-356b7403e593","source":"wordfence","cve":"CVE-2024-11350","title":"AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2024-12-20T00:00:00Z","updated":"2025-01-08T08:18:16Z"},{"id":"wordfence:4ebbe9a4-3769-4e05-9377-907b43e3fe10","source":"wordfence","cve":"","title":"WP-EMail <= 2.67.2 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebbe9a4-3769-4e05-9377-907b43e3fe10?source=api-prod","affected":[{"type":"plugin","slug":"wp-email","name":"WP-EMail","from":"*","from_inclusive":true,"to":"2.67.2","to_inclusive":true,"patched_in":"2.67.3"}],"published":"2016-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ebc8d0d-04b6-49a0-96c1-7c6d930009d8","source":"wordfence","cve":"CVE-2024-9187","title":"Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebc8d0d-04b6-49a0-96c1-7c6d930009d8?source=api-prod","affected":[{"type":"plugin","slug":"read-more","name":"Read more By Adam","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-11T16:35:39Z","updated":"2024-10-12T05:39:40Z"},{"id":"wordfence:4ebe8b63-ea43-4e39-9fdf-e28fb4638433","source":"wordfence","cve":"CVE-2026-1797","title":"Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebe8b63-ea43-4e39-9fdf-e28fb4638433?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-03-30T16:18:30Z","updated":"2026-03-31T04:25:31Z"},{"id":"wordfence:4ec0fc39-1e26-44f1-827e-aabeb0347d0a","source":"wordfence","cve":"CVE-2026-57400","title":"Event Tickets Manager for WooCommerce <= 1.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec0fc39-1e26-44f1-827e-aabeb0347d0a?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-manager-for-woocommerce","name":"Event Tickets Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:43:58Z"},{"id":"wordfence:4ec1efc4-418c-4734-a9a0-aff2e7a8bdeb","source":"wordfence","cve":"CVE-2026-114195","title":"ShopMagic \u2013 email automation for WordPress <= 4.9.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec1efc4-418c-4734-a9a0-aff2e7a8bdeb?source=api-prod","affected":[{"type":"plugin","slug":"shopmagic-for-woocommerce","name":"ShopMagic \u2013 email automation for WordPress","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2026-10-22T08:48:00Z","updated":"2026-10-23T18:54:58Z"},{"id":"wordfence:4ec30511-40cb-433e-977c-df5be8c3d8f2","source":"wordfence","cve":"","title":"Photo Gallery by Ays \u2013 Responsive Image Gallery <= 4.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec30511-40cb-433e-977c-df5be8c3d8f2?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ec576db-37f2-4e00-bed6-3598dc283c05","source":"wordfence","cve":"CVE-2026-104079","title":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.16.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec576db-37f2-4e00-bed6-3598dc283c05?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:26:46Z"},{"id":"wordfence:4ec73a61-9ae2-4e6f-b1fa-2d61f27d6809","source":"wordfence","cve":"CVE-2025-3275","title":"Themesflat Addons For Elementor <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec73a61-9ae2-4e6f-b1fa-2d61f27d6809?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T03:21:25Z"},{"id":"wordfence:4eca64cc-75c2-46ba-a086-15a952a20026","source":"wordfence","cve":"CVE-2026-92714","title":"Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64cc-75c2-46ba-a086-15a952a20026?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.68","to_inclusive":true,"patched_in":"3.3.69"}],"published":"2026-09-17T18:30:10Z","updated":"2026-09-18T13:03:18Z"},{"id":"wordfence:4eca64d7-6e33-4b8e-af37-a3e8bbf2b76f","source":"wordfence","cve":"CVE-2023-2353","title":"CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64d7-6e33-4b8e-af37-a3e8bbf2b76f?source=api-prod","affected":[{"type":"plugin","slug":"chp-ads-block-detector","name":"CHP Ads Block Detector","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ece169e-4741-48c5-a7ea-33549e483a4f","source":"wordfence","cve":"CVE-2025-25103","title":"Indeed API <= 0.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ece169e-4741-48c5-a7ea-33549e483a4f?source=api-prod","affected":[{"type":"plugin","slug":"indeed-api","name":"Indeed API","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:19:44Z"},{"id":"wordfence:4ecf04a7-1f3c-41d6-a86b-282f020de088","source":"wordfence","cve":"CVE-2012-3414","title":"NextGen Gallery <= 1.9.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ecf04a7-1f3c-41d6-a86b-282f020de088?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2012-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ed0ea4a-9cbf-4033-a31f-6cb954e8ce01","source":"wordfence","cve":"CVE-2025-2253","title":"IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed0ea4a-9cbf-4033-a31f-6cb954e8ce01?source=api-prod","affected":[{"type":"plugin","slug":"imithemes-listing","name":"IMITHEMES Listing","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2025-05-08T17:58:04Z","updated":"2025-05-09T06:42:35Z"},{"id":"wordfence:4ed23318-3b47-4336-a3aa-6b09f3911926","source":"wordfence","cve":"CVE-2026-0627","title":"AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed23318-3b47-4336-a3aa-6b09f3911926?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2026-01-08T19:34:15Z","updated":"2026-01-09T08:20:48Z"},{"id":"wordfence:4ed4dfee-5f14-47ce-abed-cd226c110665","source":"wordfence","cve":"CVE-2024-9528","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed4dfee-5f14-47ce-abed-cd226c110665?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T02:34:53Z"},{"id":"wordfence:4ed506e1-9e77-4a0d-a33f-b783c0de410f","source":"wordfence","cve":"CVE-2024-51849","title":"My Restaurant Menu <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed506e1-9e77-4a0d-a33f-b783c0de410f?source=api-prod","affected":[{"type":"plugin","slug":"my-restaurant-menu","name":"My Restaurant Menu","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:45:46Z"},{"id":"wordfence:4ed50ad7-a31b-488e-85fc-ff521488f62a","source":"wordfence","cve":"","title":"Real Estate 7 WordPress Theme < 2.9.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed50ad7-a31b-488e-85fc-ff521488f62a?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2019-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ed63724-c21f-4b0e-b595-e824d3519b21","source":"wordfence","cve":"CVE-2023-0497","title":"HT Portfolio <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed63724-c21f-4b0e-b595-e824d3519b21?source=api-prod","affected":[{"type":"plugin","slug":"ht-portfolio","name":"HT Portfolio \u2013 WordPress Portfolio Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ed64493-e41a-4369-a1b1-2d3425941d9e","source":"wordfence","cve":"CVE-2026-87068","title":"Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed64493-e41a-4369-a1b1-2d3425941d9e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:11:09Z"},{"id":"wordfence:4ed7b13a-eec3-4035-8815-15228fb05af1","source":"wordfence","cve":"CVE-2024-7381","title":"Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed7b13a-eec3-4035-8815-15228fb05af1?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.6.9","to_inclusive":true,"patched_in":"8.7.0"}],"published":"2024-09-04T21:33:38Z","updated":"2024-09-24T13:58:13Z"},{"id":"wordfence:4ed81348-7604-4858-bc8e-b4504d77ee45","source":"wordfence","cve":"CVE-2024-9262","title":"User Meta \u2013 User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed81348-7604-4858-bc8e-b4504d77ee45?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-11-08T14:02:02Z","updated":"2025-07-25T19:43:35Z"},{"id":"wordfence:4ed8866c-d8f1-4c5e-aba0-b3a0677c8efc","source":"wordfence","cve":"CVE-2021-24890","title":"Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed8866c-d8f1-4c5e-aba0-b3a0677c8efc?source=api-prod","affected":[{"type":"plugin","slug":"scripts-organizer","name":"Scripts Organizer","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4edbfeee-b668-4a85-a030-c15d6583dc82","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_preview_emails","severity":"low","cvss":3.7,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4edbfeee-b668-4a85-a030-c15d6583dc82?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":false,"patched_in":"5.16.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4edc7ef9-33db-4433-8ef2-cd06089ee8d5","source":"wordfence","cve":"CVE-2024-13335","title":"Sastra Essential Addons for Elementor \u2013 Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4edc7ef9-33db-4433-8ef2-cd06089ee8d5?source=api-prod","affected":[{"type":"plugin","slug":"sastra-essential-addons-for-elementor","name":"Spexo Addons for Elementor \u2013 Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:4edd7624-aa1e-49a5-a8c4-c15baea7bc3c","source":"wordfence","cve":"CVE-2026-25352","title":"MyDecor < 1.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4edd7624-aa1e-49a5-a8c4-c15baea7bc3c?source=api-prod","affected":[{"type":"theme","slug":"mydecor","name":"mydecor","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:41:12Z"},{"id":"wordfence:4ede558d-272d-4f18-b2e0-97f5c2cb958b","source":"wordfence","cve":"CVE-2024-49280","title":"Lightbox slider \u2013 Responsive Lightbox Gallery <= 1.10.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ede558d-272d-4f18-b2e0-97f5c2cb958b?source=api-prod","affected":[{"type":"plugin","slug":"simple-lightbox-gallery","name":"Lightbox slider \u2013 Responsive Lightbox Gallery","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2025-03-06T20:40:33Z"},{"id":"wordfence:4ede9023-732d-43e4-9c19-7cf704c95c29","source":"wordfence","cve":"CVE-2020-8596","title":"Participants Database <= 1.9.5.5 - SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ede9023-732d-43e4-9c19-7cf704c95c29?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"1.9.5.6","to_inclusive":false,"patched_in":"1.9.5.6"}],"published":"2020-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4edf2487-00e3-422b-ae9d-21a790b69133","source":"wordfence","cve":"CVE-2025-57997","title":"Trustpilot Reviews <= 2.5.925 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4edf2487-00e3-422b-ae9d-21a790b69133?source=api-prod","affected":[{"type":"plugin","slug":"trustpilot-reviews","name":"Trustpilot Reviews","from":"*","from_inclusive":true,"to":"2.5.925","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-07T17:06:03Z"},{"id":"wordfence:4ee149bf-ffa3-4906-8be2-9c3c40b28287","source":"wordfence","cve":"CVE-2025-0318","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee149bf-ffa3-4906-8be2-9c3c40b28287?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-17T16:40:14Z","updated":"2025-01-18T05:33:50Z"},{"id":"wordfence:4ee2051a-1c89-44e1-be6a-c63ec7090db8","source":"wordfence","cve":"CVE-2025-46479","title":"BBCode Deluxe <= 2020.08.01.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee2051a-1c89-44e1-be6a-c63ec7090db8?source=api-prod","affected":[{"type":"plugin","slug":"bbcode-deluxe","name":"BBCode Deluxe","from":"*","from_inclusive":true,"to":"2020.08.01.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:27:21Z"},{"id":"wordfence:4ee86acb-21eb-4b49-a1b8-6f8420ea2153","source":"wordfence","cve":"CVE-2026-65444","title":"Blocksy Companion <= 2.1.60 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee86acb-21eb-4b49-a1b8-6f8420ea2153?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":"2.1.61"}],"published":"2026-10-30T14:40:00Z","updated":"2026-11-03T20:10:11Z"},{"id":"wordfence:4ee9f9c6-5725-41aa-85ad-9a7f43aa3a1b","source":"wordfence","cve":"CVE-2025-28889","title":"Custom Product Stickers for Woocommerce <= 1.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee9f9c6-5725-41aa-85ad-9a7f43aa3a1b?source=api-prod","affected":[{"type":"plugin","slug":"custom-product-stickers-for-woocommerce","name":"Custom Product Stickers for Woocommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:58:39Z"},{"id":"wordfence:4eea120e-839e-4b01-a5a8-af21f5ab99f5","source":"wordfence","cve":"","title":"CarSpot \u2013 Dealership Wordpress Classified Theme <= 2.2.3 - Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eea120e-839e-4b01-a5a8-af21f5ab99f5?source=api-prod","affected":[{"type":"theme","slug":"carspot","name":"CarSpot \u2013 Dealership Wordpress Classified Theme","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2020-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4eeae6dd-a41f-4878-aa92-064ec78367d7","source":"wordfence","cve":"CVE-2025-10042","title":"Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eeae6dd-a41f-4878-aa92-064ec78367d7?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.56","to_inclusive":true,"patched_in":"6.7.0.57"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T05:18:46Z"},{"id":"wordfence:4eedc291-7fa3-4c47-8edb-3a3edade96d6","source":"wordfence","cve":"CVE-2026-49109","title":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eedc291-7fa3-4c47-8edb-3a3edade96d6?source=api-prod","affected":[{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:43:47Z"},{"id":"wordfence:4eeed189-3c57-4f23-bb6c-3e84603a83fb","source":"wordfence","cve":"CVE-2022-43453","title":"WP Tools <= 3.41 - Missing Authorization leading to Authenticated (Subscriber+) Authorization Bypass","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eeed189-3c57-4f23-bb6c-3e84603a83fb?source=api-prod","affected":[{"type":"plugin","slug":"wptools","name":"WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log","from":"*","from_inclusive":true,"to":"3.41","to_inclusive":true,"patched_in":"3.43"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ef11b08-534b-47eb-989c-7cc1c8853fb8","source":"wordfence","cve":"CVE-2025-26775","title":"BEAR <= 1.1.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ef11b08-534b-47eb-989c-7cc1c8853fb8?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.4.4","to_inclusive":true,"patched_in":"1.1.4.5"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:13:01Z"},{"id":"wordfence:4ef1a097-955c-4a0e-a1a2-b34ae2903d0e","source":"wordfence","cve":"CVE-2021-39317","title":"AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ef1a097-955c-4a0e-a1a2-b34ae2903d0e?source=api-prod","affected":[{"type":"theme","slug":"the-monday","name":"The Monday","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"doko","name":"Doko","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.1.0"},{"type":"theme","slug":"eight-sec","name":"Eight Sec","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"revolve","name":"Revolve","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bingle","name":"Bingle","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"parallaxsome","name":"ParallaxSome","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"theme","slug":"uncode-lite","name":"Uncode Lite","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightlaw-lite","name":"EightLaw Lite","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"},{"type":"theme","slug":"accesspress-lite","name":"AccessPress Lite","from":"*","from_inclusive":true,"to":"2.92","to_inclusive":true,"patched_in":"2.93"},{"type":"theme","slug":"fotography","name":"FotoGraphy","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"},{"type":"theme","slug":"arrival","name":"Arrival","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"theme","slug":"vmag","name":"VMag","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"theme","slug":"accesspress-mag","name":"AccessPress Mag","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"},{"type":"theme","slug":"sakala","name":"Sakala","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"vmagazine-lite","name":"VMagazine Lite","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"digital-agency-lite","name":"Digital Agency Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"theme","slug":"the-launcher","name":"The Launcher","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"theme","slug":"zigcy-lite","name":"Zigcy Lite","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"},{"type":"theme","slug":"brovy","name":"Brovy","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightmedi-lite","name":"Eightmedi Lite","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"},{"type":"theme","slug":"wpparallax","name":"WPparallax","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"enlighten","name":"Enlighten","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"eightstore-lite","name":"EightStore Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"accesspress-store","name":"AccessPress Store","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"},{"type":"theme","slug":"swing-lite","name":"Swing Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"ripple","name":"Ripple","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"access-demo-importer","name":"Access Demo Importer","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"punte","name":"Punte","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"theme","slug":"accesspress-basic","name":"Accesspress Basic","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"},{"type":"theme","slug":"zigcy-baby","name":"Zigcy Baby","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"scrollme","name":"ScrollMe","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"zigcy-cosmetics","name":"Zigcy Cosmetics","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"construction-lite","name":"Construction Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"vmagazine-news","name":"Vmagazine News","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"accesspress-parallax-new","name":"AccessPress Parallax","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"},{"type":"theme","slug":"accesspress-root","name":"AccessPress Root","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6.0"},{"type":"theme","slug":"accesspress-staple","name":"AccessPress Staple","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"storevilla","name":"StoreVilla","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"theme","slug":"ultra-seven","name":"Ultra Seven","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"the100","name":"The100","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"edict-lite","name":"Edict Lite","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wp-store","name":"WP Store","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"opstore","name":"Opstore","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"theme","slug":"bloger","name":"Bloger","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2021-10-06T19:17:00Z","updated":"2024-03-19T15:55:35Z"},{"id":"wordfence:4ef3cc5f-c4f9-489b-8fd7-5823ba5ec951","source":"wordfence","cve":"CVE-2025-66141","title":"Scroller <= 2.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ef3cc5f-c4f9-489b-8fd7-5823ba5ec951?source=api-prod","affected":[{"type":"plugin","slug":"scroller","name":"Scroller - Photography One Page / Multi-page WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:49:24Z"},{"id":"wordfence:4ef3d4d1-95ce-4180-bb83-afd402094f04","source":"wordfence","cve":"CVE-2022-38974","title":"WPML <= 4.5.10 - Missing Authorization to Translation Job Status Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ef3d4d1-95ce-4180-bb83-afd402094f04?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.5.10","to_inclusive":true,"patched_in":"4.5.11"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4efc2b96-4810-4e25-b150-c6c96246d7c5","source":"wordfence","cve":"CVE-2025-32478","title":"WP SexyLightBox <= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4efc2b96-4810-4e25-b150-c6c96246d7c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-sexylightbox","name":"WP SexyLightBox","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:06:23Z"},{"id":"wordfence:4efc9c47-321a-4635-943f-785ffc34d851","source":"wordfence","cve":"CVE-2024-8899","title":"Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4efc9c47-321a-4635-943f-785ffc34d851?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T11:04:34Z"},{"id":"wordfence:4eff0dfd-f7e6-4f5f-b1c8-00f69fa0df78","source":"wordfence","cve":"CVE-2024-32688","title":"MyRewards <= 5.3.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eff0dfd-f7e6-4f5f-b1c8-00f69fa0df78?source=api-prod","affected":[{"type":"plugin","slug":"woorewards","name":"MyRewards","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:18:42Z"},{"id":"wordfence:4eff91bd-efc2-4e54-b871-df567ca99bca","source":"wordfence","cve":"CVE-2014-9098","title":"WORDPRESS VIDEO GALLERY <= 2.5 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4eff91bd-efc2-4e54-b871-df567ca99bca?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2014-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f0025dc-a072-4e01-bea8-6e93948f00d8","source":"wordfence","cve":"CVE-2019-17599","title":"Quiz And Survey Master <= 6.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0025dc-a072-4e01-bea8-6e93948f00d8?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"6.3.5"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f0032b3-090b-4763-a9f8-4e4fd55e46ae","source":"wordfence","cve":"CVE-2026-89300","title":"Verify API <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0032b3-090b-4763-a9f8-4e4fd55e46ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-verify-api","name":"WP Verify API","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:42:43Z"},{"id":"wordfence:4f00e0fa-19ab-49c8-9342-2050b01d9a6f","source":"wordfence","cve":"CVE-2026-96227","title":"Piotnet Forms <= 1.0.30 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f00e0fa-19ab-49c8-9342-2050b01d9a6f?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:32:46Z"},{"id":"wordfence:4f018e22-bf07-4371-afc1-3e664ea1c5a3","source":"wordfence","cve":"","title":"All in One SEO \u2013 Best WordPress SEO Plugin \u2013 Easily Improve SEO Rankings & Increase Traffic <= 2.3.6 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f018e22-bf07-4371-afc1-3e664ea1c5a3?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2016-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f01eb23-af49-4f1e-a5c7-1932a4119e6b","source":"wordfence","cve":"CVE-2024-52347","title":"Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f01eb23-af49-4f1e-a5c7-1932a4119e6b?source=api-prod","affected":[{"type":"plugin","slug":"wp-website-creator","name":"Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:23:45Z"},{"id":"wordfence:4f02ee56-40bd-4132-92e1-e2897ff2a4c4","source":"wordfence","cve":"CVE-2025-14002","title":"WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f02ee56-40bd-4132-92e1-e2897ff2a4c4?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-16T09:20:18Z"},{"id":"wordfence:4f031293-2bc6-4459-95cb-22d216c57381","source":"wordfence","cve":"CVE-2025-39585","title":"Travelfic Toolkit <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f031293-2bc6-4459-95cb-22d216c57381?source=api-prod","affected":[{"type":"plugin","slug":"travelfic-toolkit","name":"Tourfic Toolkit","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:21:26Z"},{"id":"wordfence:4f033d5d-d76b-4c63-80bc-32fdd0e7987e","source":"wordfence","cve":"CVE-2015-7806","title":"Form Manager <= 1.7.2 - Authenticated Remote Command Execution","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f033d5d-d76b-4c63-80bc-32fdd0e7987e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-form-manager","name":"Form Manager","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":false,"patched_in":"1.7.3"}],"published":"2021-06-08T00:00:00Z","updated":"2026-03-27T11:23:06Z"},{"id":"wordfence:4f040075-83a0-4c9a-8d93-99aa36606b31","source":"wordfence","cve":"CVE-2023-33208","title":"Cookie Monster <= 1.51 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f040075-83a0-4c9a-8d93-99aa36606b31?source=api-prod","affected":[{"type":"plugin","slug":"cookiemonster","name":"Cookie Monster","from":"*","from_inclusive":true,"to":"1.51","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f0499db-009a-4c45-86c7-9bbb34d6373e","source":"wordfence","cve":"CVE-2025-62756","title":"The Moneytizer <= 10.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0499db-009a-4c45-86c7-9bbb34d6373e?source=api-prod","affected":[{"type":"plugin","slug":"the-moneytizer","name":"The Moneytizer","from":"*","from_inclusive":true,"to":"10.0.9","to_inclusive":true,"patched_in":"10.0.10"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:29:08Z"},{"id":"wordfence:4f060807-cd59-4558-a30b-00b4b947f3f7","source":"wordfence","cve":"CVE-2026-27070","title":"Everest Forms Pro <= 1.9.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f060807-cd59-4558-a30b-00b4b947f3f7?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms-pro","name":"Everest Forms Pro","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2026-03-12T00:00:00Z","updated":"2026-04-14T14:35:06Z"},{"id":"wordfence:4f062ef2-ef94-47c2-8eba-dc7ff6c2537d","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery via migrateProductOnlyToCommon function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f062ef2-ef94-47c2-8eba-dc7ff6c2537d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f063c6a-e009-4f7c-b3bf-bb757b1cff57","source":"wordfence","cve":"CVE-2026-54866","title":"Razorpay Payment Button Elementor Plugin <= 1.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f063c6a-e009-4f7c-b3bf-bb757b1cff57?source=api-prod","affected":[{"type":"plugin","slug":"razorpay-payment-button-elementor","name":"Razorpay Payment Button Elementor Plugin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T06:37:46Z","updated":"2026-11-03T20:05:01Z"},{"id":"wordfence:4f088ac6-b39a-4666-822e-26ab767b14cf","source":"wordfence","cve":"CVE-2026-96533","title":"Testimonials Widget <= 4.0.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f088ac6-b39a-4666-822e-26ab767b14cf?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-widget","name":"Testimonials Widget","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:56:02Z"},{"id":"wordfence:4f092b77-0bb3-40c6-b333-1c4fda6305c0","source":"wordfence","cve":"CVE-2026-39775","title":"JobZilla - Job Board WordPress Theme <= 2.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f092b77-0bb3-40c6-b333-1c4fda6305c0?source=api-prod","affected":[{"type":"theme","slug":"jobzilla","name":"JobZilla - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:39:13Z","updated":"2026-10-08T23:29:31Z"},{"id":"wordfence:4f0d1e8d-bb7f-44ce-a865-8ef15476351e","source":"wordfence","cve":"CVE-2024-47317","title":"Ads by WPQuads \u2013 Adsense Ads, Banner Ads, Popup Ads <= 2.0.84 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0d1e8d-bb7f-44ce-a865-8ef15476351e?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"2.0.84","to_inclusive":true,"patched_in":"2.0.85"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T20:53:40Z"},{"id":"wordfence:4f0deb68-3caf-4ad6-977e-0e954d29e6b7","source":"wordfence","cve":"CVE-2024-2386","title":"WordPress Plugin for Google Maps \u2013 WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0deb68-3caf-4ad6-977e-0e954d29e6b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T13:00:05Z"},{"id":"wordfence:4f0ea05c-b170-438e-a767-aa57b5a34df8","source":"wordfence","cve":"CVE-2025-67916","title":"Jobify <= 4.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f0ea05c-b170-438e-a767-aa57b5a34df8?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-13T17:31:47Z"},{"id":"wordfence:4f111dc5-b8fa-4da9-b6f2-c6dd1d40a338","source":"wordfence","cve":"CVE-2026-24589","title":"Cargus <= 1.5.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f111dc5-b8fa-4da9-b6f2-c6dd1d40a338?source=api-prod","affected":[{"type":"plugin","slug":"cargus","name":"Cargus","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-01-17T00:00:00Z","updated":"2026-03-17T21:31:58Z"},{"id":"wordfence:4f145c85-f3c6-46a7-b8ae-d486dd23087d","source":"wordfence","cve":"CVE-2024-1763","title":"Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f145c85-f3c6-46a7-b8ae-d486dd23087d?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:26:48Z"},{"id":"wordfence:4f14e464-cf48-4f8a-a1db-a8adced8321f","source":"wordfence","cve":"CVE-2021-38331","title":"WP-T-Wap <= 1.13.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f14e464-cf48-4f8a-a1db-a8adced8321f?source=api-prod","affected":[{"type":"plugin","slug":"wp-t-wap","name":"WP-T-Wap","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f169b22-8bfd-490b-9e2c-49c2a045f35b","source":"wordfence","cve":"CVE-2025-68019","title":"SEO Booster <= 7.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f169b22-8bfd-490b-9e2c-49c2a045f35b?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2026-01-19T00:00:00Z","updated":"2026-08-14T15:31:55Z"},{"id":"wordfence:4f17976e-d6b9-40fb-b2fb-d60bcfd68d12","source":"wordfence","cve":"CVE-2024-1982","title":"WPvivid Backup and Migration <= 0.9.68 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f17976e-d6b9-40fb-b2fb-d60bcfd68d12?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.68","to_inclusive":true,"patched_in":"0.9.69"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T06:47:57Z"},{"id":"wordfence:4f1932d9-35d3-4d3e-bdbb-c238efda430f","source":"wordfence","cve":"CVE-2025-24696","title":"Attire Blocks <= 1.9.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1932d9-35d3-4d3e-bdbb-c238efda430f?source=api-prod","affected":[{"type":"plugin","slug":"attire-blocks","name":"Gutenberg Blocks and Page Layouts \u2013 Attire Blocks","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:00:03Z"},{"id":"wordfence:4f1a1171-3d7b-46a4-982e-fe318e3017b7","source":"wordfence","cve":"CVE-2024-13472","title":"WooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1a1171-3d7b-46a4-982e-fe318e3017b7?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2025-01-30T20:38:32Z","updated":"2025-01-31T09:21:24Z"},{"id":"wordfence:4f1cf0f3-faf2-43f7-a641-95bfa5d73ca8","source":"wordfence","cve":"","title":"Infinite Scroll \u2013 Ajax Load More <= 5.5.4 - Authenticated (Admin+) Arbitrary File Read via Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1cf0f3-faf2-43f7-a641-95bfa5d73ca8?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.4.1"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f1d0a07-254c-4df9-90a4-966dff014df0","source":"wordfence","cve":"CVE-2026-12097","title":"User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1d0a07-254c-4df9-90a4-966dff014df0?source=api-prod","affected":[{"type":"plugin","slug":"user-management","name":"User Management","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-07-07T16:31:36Z","updated":"2026-07-31T19:52:58Z"},{"id":"wordfence:4f1ed4a2-eb0d-42cd-9273-10d7d127cdf9","source":"wordfence","cve":"CVE-2023-6499","title":"lasTunes <= 3.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1ed4a2-eb0d-42cd-9273-10d7d127cdf9?source=api-prod","affected":[{"type":"plugin","slug":"lastunes","name":"lasTunes","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f2040a1-1b17-4279-bc19-61dfad0a7a76","source":"wordfence","cve":"CVE-2025-1289","title":"Plugin Oficial \u2013 Getnet para WooCommerce <= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2040a1-1b17-4279-bc19-61dfad0a7a76?source=api-prod","affected":[{"type":"plugin","slug":"wc-checkout-getnet","name":"CoffeeCode \u2013 Checkout for Getnet and WooCommerce","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-03-07T00:00:00Z","updated":"2025-07-08T15:16:26Z"},{"id":"wordfence:4f23bec2-6079-41f6-99c1-80b0b47797ce","source":"wordfence","cve":"","title":"Facebook Page Photo Gallery <= 2.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f23bec2-6079-41f6-99c1-80b0b47797ce?source=api-prod","affected":[{"type":"plugin","slug":"facebook-page-photo-gallery","name":"Facebook Page Photo Gallery","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2014-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f289527-3a89-4db9-887d-fb0980848734","source":"wordfence","cve":"CVE-2023-51682","title":"MC4WP <= 4.9.9 - Missing Authorization via listen","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f289527-3a89-4db9-887d-fb0980848734?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"4.9.10"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f29d476-0730-437c-8065-309523278efa","source":"wordfence","cve":"CVE-2025-4654","title":"Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion","severity":"low","cvss":3.7,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f29d476-0730-437c-8065-309523278efa?source=api-prod","affected":[{"type":"plugin","slug":"soumettre-fr","name":"Soumettre.fr","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-07-01T15:00:59Z","updated":"2025-07-18T08:20:07Z"},{"id":"wordfence:4f2c3819-2247-4ef7-b177-cc98cbf5eae3","source":"wordfence","cve":"CVE-2024-31299","title":"ReDi Restaurant Reservation <= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2c3819-2247-4ef7-b177-cc98cbf5eae3?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.0128","to_inclusive":true,"patched_in":"24.0303"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:55:10Z"},{"id":"wordfence:4f2dc3e7-1e10-4547-8469-726c6747465d","source":"wordfence","cve":"CVE-2024-5856","title":"Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2dc3e7-1e10-4547-8469-726c6747465d?source=api-prod","affected":[{"type":"plugin","slug":"comment-images-reloaded","name":"Comment Images Reloaded","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T20:06:25Z","updated":"2024-07-09T08:33:06Z"},{"id":"wordfence:4f2eccc6-8e66-4235-aec3-9948b8753bf6","source":"wordfence","cve":"","title":"TNIT Filter Gallery Plugin <= 0.0.6 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2eccc6-8e66-4235-aec3-9948b8753bf6?source=api-prod","affected":[{"type":"plugin","slug":"tnit-filter-gallery-for-beaver-builder","name":"TNIT Filter Gallery Plugin","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":"0.0.7"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f2fd4a2-4a99-479e-aa9d-3d847ba8f00c","source":"wordfence","cve":"CVE-2025-23910","title":"Menus Plus+ <= 1.9.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2fd4a2-4a99-479e-aa9d-3d847ba8f00c?source=api-prod","affected":[{"type":"plugin","slug":"menus-plus","name":"Menus Plus+","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:59:12Z"},{"id":"wordfence:4f2fdc9d-891e-49c6-9427-620772336854","source":"wordfence","cve":"CVE-2024-43970","title":"SureCart <= 2.29.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2fdc9d-891e-49c6-9427-620772336854?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"2.29.3","to_inclusive":true,"patched_in":"2.29.4"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:08:27Z"},{"id":"wordfence:4f32d1fe-17ea-48c0-b276-36c8fcaad4a6","source":"wordfence","cve":"","title":"Related Posts for WordPress < 1.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f32d1fe-17ea-48c0-b276-36c8fcaad4a6?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f35acf2-91e0-4df8-9b4e-bf2310bc479a","source":"wordfence","cve":"CVE-2026-12277","title":"Frontend File Manager <= 23.6 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f35acf2-91e0-4df8-9b4e-bf2310bc479a?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-16T00:00:00Z","updated":"2026-08-21T14:04:13Z"},{"id":"wordfence:4f36e9b9-ef90-4169-ba71-e3b3b29a6a42","source":"wordfence","cve":"CVE-2025-60145","title":"Lenix scss compiler <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f36e9b9-ef90-4169-ba71-e3b3b29a6a42?source=api-prod","affected":[{"type":"plugin","slug":"lenix-scss-compiler","name":"Lenix scss compiler","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:14:32Z"},{"id":"wordfence:4f3900c7-2acb-4031-9854-b0b13e172e1f","source":"wordfence","cve":"CVE-2025-7721","title":"JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3900c7-2acb-4031-9854-b0b13e172e1f?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2025-10-02T22:17:24Z","updated":"2026-04-24T09:01:02Z"},{"id":"wordfence:4f3a01fe-8c84-4219-98fe-14e4ac74b7f7","source":"wordfence","cve":"CVE-2025-47652","title":"Infility Global <= 2.13.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3a01fe-8c84-4219-98fe-14e4ac74b7f7?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-18T14:13:23Z"},{"id":"wordfence:4f3a57ce-eead-4631-93da-ba1a0a33ec2d","source":"wordfence","cve":"CVE-2023-1614","title":"WP Custom Author URL <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3a57ce-eead-4631-93da-ba1a0a33ec2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-author-url","name":"WP Custom Author URL","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f3e3311-11d8-4e4f-9d99-36533fe44d56","source":"wordfence","cve":"CVE-2023-29102","title":"Olive One Click Demo Import <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3e3311-11d8-4e4f-9d99-36533fe44d56?source=api-prod","affected":[{"type":"plugin","slug":"olive-one-click-demo-import","name":"Olive One Click Demo Import","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-04-05T13:33:28Z"},{"id":"wordfence:4f3ee9f6-6465-4caf-9aef-72dd37c61a2c","source":"wordfence","cve":"CVE-2026-12597","title":"LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3ee9f6-6465-4caf-9aef-72dd37c61a2c?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-07-09T11:14:15Z","updated":"2026-07-09T23:30:11Z"},{"id":"wordfence:4f3f0ef8-8a13-4110-a402-e1bcf493560a","source":"wordfence","cve":"","title":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer <= 2.12.23 - Unauthenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f3f0ef8-8a13-4110-a402-e1bcf493560a?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.12.22","to_inclusive":true,"patched_in":"2.12.23"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f406c82-14e7-468b-8bba-400aefe687b5","source":"wordfence","cve":"CVE-2024-53781","title":"SpatialMatch IDX <= 3.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f406c82-14e7-468b-8bba-400aefe687b5?source=api-prod","affected":[{"type":"plugin","slug":"spatialmatch-free-lifestyle-search","name":"SpatialMatch IDX","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:11:11Z"},{"id":"wordfence:4f4099b3-6c79-42c2-be41-4ad8d73cc2b8","source":"wordfence","cve":"CVE-2023-51687","title":"Product Catalog Simple <= 1.7.6 - Sensitive Information Exposure via Product CSV","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4099b3-6c79-42c2-be41-4ad8d73cc2b8?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f417d54-5aa6-4ef4-870a-12a9fa73050d","source":"wordfence","cve":"CVE-2024-50542","title":"RLM Elementor Widgets Pack <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f417d54-5aa6-4ef4-870a-12a9fa73050d?source=api-prod","affected":[{"type":"plugin","slug":"rlm-elementor-widgets-pack","name":"RLM Elementor Widgets Pack","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:12:53Z"},{"id":"wordfence:4f42b59e-42a3-4c1d-805d-dfe8c692223e","source":"wordfence","cve":"CVE-2024-0559","title":"Enhanced Text Widget <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f42b59e-42a3-4c1d-805d-dfe8c692223e?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-21T15:53:35Z"},{"id":"wordfence:4f459c38-6362-4131-890c-ad2cbd3e5903","source":"wordfence","cve":"CVE-2025-58784","title":"ARI Fancy Lightbox <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f459c38-6362-4131-890c-ad2cbd3e5903?source=api-prod","affected":[{"type":"plugin","slug":"ari-fancy-lightbox","name":"ARI Fancy Lightbox \u2013 Popup for WordPress","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-25T18:39:35Z"},{"id":"wordfence:4f4626eb-7923-4ee2-b221-02eefdd2e072","source":"wordfence","cve":"CVE-2026-88797","title":"Vayu X <= 1.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4626eb-7923-4ee2-b221-02eefdd2e072?source=api-prod","affected":[{"type":"theme","slug":"vayu-x","name":"Vayu X","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:45:04Z"},{"id":"wordfence:4f4635ac-2ce6-4135-8d2b-d03b42860f05","source":"wordfence","cve":"CVE-2025-11497","title":"Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4635ac-2ce6-4135-8d2b-d03b42860f05?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2025-10-24T00:00:00Z","updated":"2025-11-04T14:29:49Z"},{"id":"wordfence:4f481478-5dc9-4b11-ba3e-1942882a9f43","source":"wordfence","cve":"CVE-2023-32123","title":"The7 <= 11.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f481478-5dc9-4b11-ba3e-1942882a9f43?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"11.7.3","to_inclusive":true,"patched_in":"11.7.3.1"}],"published":"2023-06-28T00:00:00Z","updated":"2024-06-25T14:08:51Z"},{"id":"wordfence:4f4934be-db95-4b4d-92df-f0d493f56f25","source":"wordfence","cve":"CVE-2025-23428","title":"QMean \u2013 WordPress Did You Mean and Search Suggestion Like Google <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4934be-db95-4b4d-92df-f0d493f56f25?source=api-prod","affected":[{"type":"plugin","slug":"qmean","name":"QMean \u2013 WordPress Did You Mean and Search Suggestion Like Google","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:41:32Z"},{"id":"wordfence:4f49eaf0-1273-41e8-9087-4d4ed978fce4","source":"wordfence","cve":"CVE-2012-6718","title":"Sharebar <= 1.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f49eaf0-1273-41e8-9087-4d4ed978fce4?source=api-prod","affected":[{"type":"plugin","slug":"sharebar","name":"Sharebar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f4a7933-7e93-4d8e-a51a-57ab63e26644","source":"wordfence","cve":"CVE-2025-68061","title":"EduMall <= 4.4.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4a7933-7e93-4d8e-a51a-57ab63e26644?source=api-prod","affected":[{"type":"theme","slug":"edumall","name":"EduMall - Professional LMS Education Center WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T17:05:13Z"},{"id":"wordfence:4f4ebf09-b089-4118-a0ee-399243253f9c","source":"wordfence","cve":"CVE-2026-19632","title":"TranslatePress \u2013 Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4ebf09-b089-4118-a0ee-399243253f9c?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-08-25T14:56:52Z","updated":"2026-08-26T03:39:24Z"},{"id":"wordfence:4f4fd9e1-1e7f-422f-91f0-8f662b6c26ed","source":"wordfence","cve":"CVE-2026-66569","title":"Kicker - Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4fd9e1-1e7f-422f-91f0-8f662b6c26ed?source=api-prod","affected":[{"type":"theme","slug":"kicker","name":"Kicker - Blog Magazine Theme","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:54:53Z","updated":"2026-10-13T14:06:12Z"},{"id":"wordfence:4f504434-2de9-4d2e-848d-6c7fc0880672","source":"wordfence","cve":"CVE-2023-3328","title":"Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f504434-2de9-4d2e-848d-6c7fc0880672?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-for-wp-job-manager","name":"Custom Field For WP Job Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f50a3b7-4110-4f24-ba9a-2c3114392295","source":"wordfence","cve":"CVE-2026-87775","title":"Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f50a3b7-4110-4f24-ba9a-2c3114392295?source=api-prod","affected":[{"type":"plugin","slug":"tz-wrs-core","name":"Tz Weekly Radio Schedule","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:44:28Z"},{"id":"wordfence:4f510772-d1f6-4751-bfff-addb51bf27c6","source":"wordfence","cve":"CVE-2023-3620","title":"WP tarteaucitron.js Self Hosted <= 1.2.4 - Running a Vulnerable Dependency","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f510772-d1f6-4751-bfff-addb51bf27c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-tarteaucitron-js-self-hosted","name":"WP tarteaucitron.js Self Hosted","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-24T22:49:09Z"},{"id":"wordfence:4f530fa1-439f-49c8-850b-96454b9ba7a7","source":"wordfence","cve":"CVE-2025-31588","title":"Elfsight Testimonials Slider <= 1.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f530fa1-439f-49c8-850b-96454b9ba7a7?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-testimonials-slider","name":"Elfsight Testimonials Slider","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:12:16Z"},{"id":"wordfence:4f537db6-52d1-4606-af19-e72930a6ece4","source":"wordfence","cve":"CVE-2026-90887","title":"WP Inventory Manager <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f537db6-52d1-4606-af19-e72930a6ece4?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-09-14T17:34:14Z","updated":"2026-09-30T14:24:14Z"},{"id":"wordfence:4f549272-4112-4cfe-a61e-6982f87e5cb0","source":"wordfence","cve":"CVE-2025-60154","title":"MWW Disclaimer Buttons <= 3.41 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f549272-4112-4cfe-a61e-6982f87e5cb0?source=api-prod","affected":[{"type":"plugin","slug":"mww-disclaimer-buttons","name":"MWW Disclaimer Buttons","from":"3.41","from_inclusive":true,"to":"3.41","to_inclusive":true,"patched_in":"3.5"}],"published":"2025-09-26T00:00:00Z","updated":"2025-11-24T20:08:23Z"},{"id":"wordfence:4f555084-2dd5-4c48-ac0e-4e0bb562ac70","source":"wordfence","cve":"CVE-2026-24998","title":"Hustle <= 7.8.9.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f555084-2dd5-4c48-ac0e-4e0bb562ac70?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.9.2","to_inclusive":true,"patched_in":"7.8.9.3"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-02T20:57:37Z"},{"id":"wordfence:4f57cac9-5610-454b-affb-86384ea00881","source":"wordfence","cve":"CVE-2026-7542","title":"Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f57cac9-5610-454b-affb-86384ea00881?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-06-08T19:07:40Z","updated":"2026-10-16T19:17:00Z"},{"id":"wordfence:4f589e21-7417-4b43-b580-4f1d3c2041f4","source":"wordfence","cve":"CVE-2023-1027","title":"WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f589e21-7417-4b43-b580-4f1d3c2041f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f5919eb-ac74-4926-9ede-e651bb4463b2","source":"wordfence","cve":"CVE-2023-47544","title":"Atarim <= 3.12 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5919eb-ac74-4926-9ede-e651bb4463b2?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.12","to_inclusive":true,"patched_in":"3.13"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f5985b0-0e6c-4dd8-b5f8-53be62adc8dd","source":"wordfence","cve":"CVE-2026-102401","title":"Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5985b0-0e6c-4dd8-b5f8-53be62adc8dd?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.71","to_inclusive":true,"patched_in":"3.3.72"}],"published":"2026-10-09T15:29:40Z","updated":"2026-10-10T04:26:44Z"},{"id":"wordfence:4f5b048d-3a00-4337-8a85-97740449f1a5","source":"wordfence","cve":"CVE-2025-23709","title":"Formatted post <= 1.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5b048d-3a00-4337-8a85-97740449f1a5?source=api-prod","affected":[{"type":"plugin","slug":"formatted-post","name":"Formatted post","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:11:44Z"},{"id":"wordfence:4f5bff23-61ff-4c38-8334-a16a24a0a8aa","source":"wordfence","cve":"CVE-2025-68548","title":"Responsive Posts Carousel Pro <= 15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5bff23-61ff-4c38-8334-a16a24a0a8aa?source=api-prod","affected":[{"type":"plugin","slug":"responsive-posts-carousel-pro","name":"Responsive Posts Carousel WordPress Plugin","from":"*","from_inclusive":true,"to":"15.2","to_inclusive":true,"patched_in":"15.3"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T18:50:17Z"},{"id":"wordfence:4f5db0fb-50f4-4ef0-8331-2389341f40c7","source":"wordfence","cve":"CVE-2026-86826","title":"BackWPup \u2013 WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5db0fb-50f4-4ef0-8331-2389341f40c7?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":false,"patched_in":"5.7.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:18:01Z"},{"id":"wordfence:4f5e0d47-ad38-4081-8dfc-d782aef4bf0c","source":"wordfence","cve":"CVE-2025-32215","title":"Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5e0d47-ad38-4081-8dfc-d782aef4bf0c?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.18","to_inclusive":true,"patched_in":"4.19"}],"published":"2025-04-07T00:00:00Z","updated":"2025-05-16T14:16:02Z"},{"id":"wordfence:4f5ff7bc-9443-4b34-abd3-dac800f162a1","source":"wordfence","cve":"CVE-2026-15073","title":"KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f5ff7bc-9443-4b34-abd3-dac800f162a1?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-07-10T14:02:15Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:4f60a6aa-8420-4f7e-9863-5b69774201ef","source":"wordfence","cve":"CVE-2025-46459","title":"Confirm User Registration <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f60a6aa-8420-4f7e-9863-5b69774201ef?source=api-prod","affected":[{"type":"plugin","slug":"confirm-user-registration","name":"Confirm User Registration","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:28:50Z"},{"id":"wordfence:4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0","source":"wordfence","cve":"CVE-2025-2290","title":"LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":"8.0.2"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T04:21:07Z"},{"id":"wordfence:4f65a7df-acb5-4b5b-8867-986ce9930e3f","source":"wordfence","cve":"CVE-2024-4432","title":"Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f65a7df-acb5-4b5b-8867-986ce9930e3f?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.26","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2024-05-17T21:35:40Z","updated":"2024-05-18T09:39:37Z"},{"id":"wordfence:4f665145-6556-4f3b-bcfd-28daeec7d496","source":"wordfence","cve":"CVE-2026-18945","title":"WP Helper Premium < 4.7.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f665145-6556-4f3b-bcfd-28daeec7d496?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":false,"patched_in":"4.7.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:29:58Z"},{"id":"wordfence:4f687775-89fe-4ca6-bc83-c4f1649fa794","source":"wordfence","cve":"CVE-2024-50409","title":"Namaste! LMS <= 2.6.2 - Authenticated (Student+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f687775-89fe-4ca6-bc83-c4f1649fa794?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:40:04Z"},{"id":"wordfence:4f69c239-d429-4970-bc1b-b2a7d96f4b7a","source":"wordfence","cve":"CVE-2025-69356","title":"TheGem Theme Elements (for Elementor) <= 5.11.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f69c239-d429-4970-bc1b-b2a7d96f4b7a?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.11.0","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-13T17:39:45Z"},{"id":"wordfence:4f6c69ca-eb1e-445a-af72-5f03dfa07f9b","source":"wordfence","cve":"CVE-2024-53746","title":"Elementor Button Plus <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f6c69ca-eb1e-445a-af72-5f03dfa07f9b?source=api-prod","affected":[{"type":"plugin","slug":"fd-elementor-button-plus","name":"Button Plus for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2025-03-13T19:45:35Z"},{"id":"wordfence:4f6d0e20-9a30-4628-a090-feb1f0adc8af","source":"wordfence","cve":"CVE-2025-58881","title":"New Simple Gallery <= 8.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f6d0e20-9a30-4628-a090-feb1f0adc8af?source=api-prod","affected":[{"type":"plugin","slug":"new-simple-gallery","name":"New Simple Gallery","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:26:59Z"},{"id":"wordfence:4f6d5bff-2395-4706-9d0b-c4a10dab0477","source":"wordfence","cve":"CVE-2026-81153","title":"Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f6d5bff-2395-4706-9d0b-c4a10dab0477?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:22:54Z"},{"id":"wordfence:4f6f2a8c-ecd9-482c-a32e-0c3d7a7e4ec4","source":"wordfence","cve":"CVE-2024-13546","title":"GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f6f2a8c-ecd9-482c-a32e-0c3d7a7e4ec4?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T09:22:55Z"},{"id":"wordfence:4f726479-c170-4e84-a5a7-2a82d0f62ad0","source":"wordfence","cve":"CVE-2025-7366","title":"Rehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f726479-c170-4e84-a5a7-2a82d0f62ad0?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.9.7","to_inclusive":true,"patched_in":"19.9.8"}],"published":"2025-09-05T13:04:49Z","updated":"2025-09-06T01:45:16Z"},{"id":"wordfence:4f730cec-c086-441f-bebb-643aceb1e668","source":"wordfence","cve":"CVE-2025-27001","title":"Shipmondo \u2013 A complete shipping solution for WooCommerce <= 5.0.3 - Missing Authorization to Authenticated (Customer+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f730cec-c086-441f-bebb-643aceb1e668?source=api-prod","affected":[{"type":"plugin","slug":"pakkelabels-for-woocommerce","name":"DEPRECATED \u2013 Shipmondo \u2013 A complete shipping solution for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:26:12Z"},{"id":"wordfence:4f73ef2a-8e78-4091-bc78-f6b35444e677","source":"wordfence","cve":"CVE-2025-30785","title":"Subscribe to Download Lite <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f73ef2a-8e78-4091-bc78-f6b35444e677?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-download-lite","name":"Subscribe to Download Lite \u2013 Email Before Download Plugin","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:40:56Z"},{"id":"wordfence:4f74991b-8b24-40c0-a550-0f7971e148fb","source":"wordfence","cve":"CVE-2025-67980","title":"Hara <= 1.2.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f74991b-8b24-40c0-a550-0f7971e148fb?source=api-prod","affected":[{"type":"theme","slug":"hara","name":"Hara - Beauty and Cosmetics Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:00:49Z"},{"id":"wordfence:4f76181a-8fb4-4f0e-b84c-0dabc482261d","source":"wordfence","cve":"CVE-2024-38783","title":"Arconix FAQ <= 1.9.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f76181a-8fb4-4f0e-b84c-0dabc482261d?source=api-prod","affected":[{"type":"plugin","slug":"arconix-faq","name":"Arconix FAQ","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T13:38:02Z"},{"id":"wordfence:4f76d908-91e7-4933-afab-9a7bfe18e088","source":"wordfence","cve":"CVE-2026-42743","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f76d908-91e7-4933-afab-9a7bfe18e088?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:47:38Z"},{"id":"wordfence:4f77f4cd-f4b3-42bc-a1a9-e5df5daa42b7","source":"wordfence","cve":"CVE-2025-12975","title":"CTX Feed \u2013 WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f77f4cd-f4b3-42bc-a1a9-e5df5daa42b7?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.11","to_inclusive":true,"patched_in":"6.6.12"}],"published":"2026-02-18T15:27:51Z","updated":"2026-02-19T04:36:10Z"},{"id":"wordfence:4f792f34-a755-441b-90a8-4f2df3332ccb","source":"wordfence","cve":"CVE-2024-6271","title":"Community Events <= 1.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f792f34-a755-441b-90a8-4f2df3332ccb?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-07-01T00:00:00Z","updated":"2024-08-09T19:27:31Z"},{"id":"wordfence:4f7bc717-8b6a-41f2-9587-33b44d51996a","source":"wordfence","cve":"CVE-2025-28924","title":"ZenphotoPress <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f7bc717-8b6a-41f2-9587-33b44d51996a?source=api-prod","affected":[{"type":"plugin","slug":"zenphotopress","name":"ZenphotoPress","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-22T00:00:00Z","updated":"2025-03-25T17:47:32Z"},{"id":"wordfence:4f7cca0c-6055-491d-be5e-b2c0abf26f7b","source":"wordfence","cve":"CVE-2025-48270","title":"SKT Blocks <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f7cca0c-6055-491d-be5e-b2c0abf26f7b?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:56:20Z"},{"id":"wordfence:4f7fa392-e192-40db-9275-6da668d5a493","source":"wordfence","cve":"CVE-2025-31905","title":"Team Rosters <= 4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f7fa392-e192-40db-9275-6da668d5a493?source=api-prod","affected":[{"type":"plugin","slug":"team-rosters","name":"Team Rosters","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-04-02T00:00:00Z","updated":"2025-08-28T15:51:39Z"},{"id":"wordfence:4f7fa5a4-07d7-4815-b393-871568777b0f","source":"wordfence","cve":"","title":"Download Monitor <= 4.7.2 - Authenticated Directory Traversal to Sensitive Information Exposure","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f7fa5a4-07d7-4815-b393-871568777b0f?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f83e20b-b763-4ef7-b703-4b37f679838b","source":"wordfence","cve":"CVE-2025-26896","title":"PiwigoPress <= 2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f83e20b-b763-4ef7-b703-4b37f679838b?source=api-prod","affected":[{"type":"plugin","slug":"piwigopress","name":"PiwigoPress","from":"*","from_inclusive":true,"to":"2.33","to_inclusive":true,"patched_in":"2.34"}],"published":"2025-02-24T00:00:00Z","updated":"2026-06-01T20:20:01Z"},{"id":"wordfence:4f8430e8-c349-4425-be4a-0e9d4d80c438","source":"wordfence","cve":"CVE-2024-47351","title":"MaxSlider <= 1.2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f8430e8-c349-4425-be4a-0e9d4d80c438?source=api-prod","affected":[{"type":"plugin","slug":"maxslider","name":"MaxSlider","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:45:16Z"},{"id":"wordfence:4f856b92-a090-4974-a256-d1022b10014a","source":"wordfence","cve":"CVE-2025-32521","title":"Cool Flipbox \u2013 Shortcode & Gutenberg Block <= 1.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f856b92-a090-4974-a256-d1022b10014a?source=api-prod","affected":[{"type":"plugin","slug":"flip-boxes","name":"Cool Flipbox \u2013 Shortcode & Gutenberg Block","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-21T14:22:04Z"},{"id":"wordfence:4f86d75b-f75e-4d5b-b0b8-a17a68e17048","source":"wordfence","cve":"CVE-2025-11811","title":"Simple Youtube Shortcode <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f86d75b-f75e-4d5b-b0b8-a17a68e17048?source=api-prod","affected":[{"type":"plugin","slug":"simple-youtube-shortcode","name":"Simple Youtube Shortcode","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:20:31Z","updated":"2025-10-22T08:27:07Z"},{"id":"wordfence:4f88cbad-9b45-4fd9-a268-c4ad42b3547f","source":"wordfence","cve":"CVE-2025-62926","title":"TempTool  [Show Current Template Info] <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f88cbad-9b45-4fd9-a268-c4ad42b3547f?source=api-prod","affected":[{"type":"plugin","slug":"current-template-name","name":"Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info \u2013 Pagely","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-05T00:00:00Z","updated":"2025-10-29T14:59:05Z"},{"id":"wordfence:4f89e8ef-1fcb-470d-9fa2-bbe92b406cd6","source":"wordfence","cve":"CVE-2026-18789","title":"Ezoic <= 2.23.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f89e8ef-1fcb-470d-9fa2-bbe92b406cd6?source=api-prod","affected":[{"type":"plugin","slug":"ezoic-integration","name":"Ezoic","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.23.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:42:56Z"},{"id":"wordfence:4f8a7933-cc26-47f2-9142-df748add0745","source":"wordfence","cve":"CVE-2022-42880","title":"Auto Upload Images <= 3.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f8a7933-cc26-47f2-9142-df748add0745?source=api-prod","affected":[{"type":"plugin","slug":"auto-upload-images","name":"Auto Upload Images","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f8fc864-8e09-4dfc-9414-f8d38b393a50","source":"wordfence","cve":"CVE-2024-13826","title":"Email Keep <= 1.1 - Cross-Site Request Forgery to Email Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f8fc864-8e09-4dfc-9414-f8d38b393a50?source=api-prod","affected":[{"type":"plugin","slug":"email-keep","name":"Email Keep","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-03-10T15:57:40Z"},{"id":"wordfence:4f93fb48-3963-4a98-9c70-eef667b254df","source":"wordfence","cve":"CVE-2022-2411","title":"Auto More Tag <= 4.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f93fb48-3963-4a98-9c70-eef667b254df?source=api-prod","affected":[{"type":"plugin","slug":"auto-more-tag","name":"Auto More Tag","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f954362-9da5-4b40-a7fa-c0c4c5e10efa","source":"wordfence","cve":"CVE-2025-30815","title":"Hesabfa Accounting <= 2.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f954362-9da5-4b40-a7fa-c0c4c5e10efa?source=api-prod","affected":[{"type":"plugin","slug":"hesabfa-accounting","name":"Hesabfa Accounting","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:54:05Z"},{"id":"wordfence:4f954b02-b636-438b-a4b1-9b74df153c47","source":"wordfence","cve":"CVE-2025-12681","title":"Comment Edit Core \u2013 Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f954b02-b636-438b-a4b1-9b74df153c47?source=api-prod","affected":[{"type":"plugin","slug":"simple-comment-editing","name":"Simple Comment Editing","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-13T07:27:53Z"},{"id":"wordfence:4f95bcc3-354e-4016-9a17-945569b076b6","source":"wordfence","cve":"CVE-2024-3962","title":"Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f95bcc3-354e-4016-9a17-945569b076b6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"32.0.18","to_inclusive":true,"patched_in":"32.0.19"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T08:29:21Z"},{"id":"wordfence:4f9612b5-e487-4051-b49f-a6ca43a42fc9","source":"wordfence","cve":"CVE-2026-120847","title":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9612b5-e487-4051-b49f-a6ca43a42fc9?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-11-07T09:09:00Z","updated":"2026-11-10T19:39:48Z"},{"id":"wordfence:4f96b87a-1405-4cf6-b903-ad0c7c8e2826","source":"wordfence","cve":"CVE-2026-15941","title":"Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f96b87a-1405-4cf6-b903-ad0c7c8e2826?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.27.1","to_inclusive":true,"patched_in":"4.27.2"},{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium \u2013 A Better Search","from":"*","from_inclusive":true,"to":"2.30.2","to_inclusive":true,"patched_in":"2.30.3"}],"published":"2026-08-04T16:34:02Z","updated":"2026-08-05T05:27:37Z"},{"id":"wordfence:4f97bbd7-289a-4d13-b49e-563c17714015","source":"wordfence","cve":"CVE-2025-68498","title":"JetTabs <= 2.2.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f97bbd7-289a-4d13-b49e-563c17714015?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.12.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-06T16:42:23Z"},{"id":"wordfence:4f98d50a-51cb-479b-be4c-566a72f0f221","source":"wordfence","cve":"CVE-2016-10970","title":"SupportFlow <= 0.6 - Cross-Site Scripting via a ticket excerpt.","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f98d50a-51cb-479b-be4c-566a72f0f221?source=api-prod","affected":[{"type":"plugin","slug":"supportflow","name":"SupportFlow","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":false,"patched_in":"0.7"}],"published":"2016-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f997c20-38f6-4968-b7de-8f28f825c7fd","source":"wordfence","cve":"","title":"Social Media Share Buttons <= 3.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f997c20-38f6-4968-b7de-8f28f825c7fd?source=api-prod","affected":[{"type":"plugin","slug":"mashsharer","name":"MashShare \u2013 Social Media Share Buttons, Social Share Icons","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2022-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4f99d8b5-e71d-4b40-8223-f0e53b9dd84f","source":"wordfence","cve":"CVE-2024-31262","title":"WooCommerce Checkout Field Editor (Checkout Manager) <= 2.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f99d8b5-e71d-4b40-8223-f0e53b9dd84f?source=api-prod","affected":[{"type":"plugin","slug":"woo-checkout-regsiter-field-editor","name":"Checkout Field Editor for WooCommerce \u2013 Block & Classic Checkout Fields","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:05:40Z"},{"id":"wordfence:4f9a0341-5479-4b83-8ce8-eb838a34a448","source":"wordfence","cve":"CVE-2024-11760","title":"Currency Converter Widget \u26a1 PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9a0341-5479-4b83-8ce8-eb838a34a448?source=api-prod","affected":[{"type":"plugin","slug":"currency-converter-widget-pro","name":"Currency Converter Widget \u26a1 PRO","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T08:22:34Z"},{"id":"wordfence:4f9a1cfc-5e52-40da-bb9d-8f2b46d37c8c","source":"wordfence","cve":"CVE-2025-11176","title":"Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9a1cfc-5e52-40da-bb9d-8f2b46d37c8c?source=api-prod","affected":[{"type":"plugin","slug":"quick-featured-images","name":"Quick Featured Images","from":"*","from_inclusive":true,"to":"13.7.2","to_inclusive":true,"patched_in":"13.7.3"}],"published":"2025-10-14T17:12:31Z","updated":"2025-10-15T05:23:50Z"},{"id":"wordfence:4f9bd960-01ef-41dd-ab05-0a5f734484a2","source":"wordfence","cve":"CVE-2023-6046","title":"EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection","severity":"low","cvss":3.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9bd960-01ef-41dd-ab05-0a5f734484a2?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-11-09T00:00:00Z","updated":"2024-02-06T14:13:03Z"},{"id":"wordfence:4f9e0328-6d38-4512-a233-82e37950eb80","source":"wordfence","cve":"CVE-2025-32649","title":"GB Gallery Slideshow <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9e0328-6d38-4512-a233-82e37950eb80?source=api-prod","affected":[{"type":"plugin","slug":"gb-gallery-slideshow","name":"GB Gallery Slideshow","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T18:54:09Z"},{"id":"wordfence:4f9fb3a5-b669-4f3b-981d-face13a9a7c8","source":"wordfence","cve":"CVE-2024-51665","title":"Magical Addons For Elementor <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9fb3a5-b669-4f3b-981d-face13a9a7c8?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:45:35Z"},{"id":"wordfence:4fa00dae-c51d-4586-81da-b568cd6d8124","source":"wordfence","cve":"CVE-2023-2359","title":"Slider Revolution <= 6.6.12 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa00dae-c51d-4586-81da-b568cd6d8124?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.12","to_inclusive":true,"patched_in":"6.6.13"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fa04a97-0be1-4710-ae97-5820ccbddc1e","source":"wordfence","cve":"CVE-2019-15896","title":"LMS by LifterLMS <= 3.35.0 - Stored Cross-Site Scripting via Import","severity":"critical","cvss":9.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa04a97-0be1-4710-ae97-5820ccbddc1e?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"3.35.0","to_inclusive":false,"patched_in":"3.35.0"}],"published":"2019-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0","source":"wordfence","cve":"CVE-2025-13620","title":"Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa205d7-61ce-4ab9-b532-fd0b46b0f6a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-12-04T21:44:40Z","updated":"2026-02-04T20:01:56Z"},{"id":"wordfence:4fa3de8b-3d51-46b4-92ef-fbebadd4e708","source":"wordfence","cve":"CVE-2025-30603","title":"CopyLink <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa3de8b-3d51-46b4-92ef-fbebadd4e708?source=api-prod","affected":[{"type":"plugin","slug":"copy-link","name":"CopyLink","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:17:22Z"},{"id":"wordfence:4fa4167a-686f-4fd0-a53d-eb61d57228a1","source":"wordfence","cve":"CVE-2024-4575","title":"LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa4167a-686f-4fd0-a53d-eb61d57228a1?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"7.11.0","from_inclusive":true,"to":"7.11.0","to_inclusive":true,"patched_in":"7.11.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T11:02:37Z"},{"id":"wordfence:4fa453f3-d361-452c-940a-108252c9f302","source":"wordfence","cve":"CVE-2008-2392","title":"WordPress Core <= 2.5.1 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa453f3-d361-452c-940a-108252c9f302?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2008-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fa5b8a9-1683-4806-987d-527834f45d34","source":"wordfence","cve":"CVE-2026-6690","title":"LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa5b8a9-1683-4806-987d-527834f45d34?source=api-prod","affected":[{"type":"plugin","slug":"lifepress","name":"LifePress","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:02:48Z","updated":"2026-05-12T07:48:21Z"},{"id":"wordfence:4fa5ba38-0b6f-4eec-aac1-1c3806f0d040","source":"wordfence","cve":"CVE-2022-34487","title":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension <= 3.0.2 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa5ba38-0b6f-4eec-aac1-1c3806f0d040?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-addons","name":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fa5f0a2-30e9-4e89-a509-25a7fe8a643b","source":"wordfence","cve":"CVE-2022-50959","title":"Contact Form Builder, Contact Widget <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa5f0a2-30e9-4e89-a509-25a7fe8a643b?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-builder","name":"Contact Form Builder, Contact Widget","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-10T00:00:00Z","updated":"2026-07-29T21:14:24Z"},{"id":"wordfence:4fa84388-3597-4a54-9ae8-d6e04afe9061","source":"wordfence","cve":"CVE-2023-0832","title":"Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa84388-3597-4a54-9ae8-d6e04afe9061?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-page","name":"Under Construction","from":"*","from_inclusive":true,"to":"3.96","to_inclusive":true,"patched_in":"3.97"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fa979e8-2569-4d6c-9eee-344972000aab","source":"wordfence","cve":"CVE-2025-69153","title":"Trendy Travel <= 6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa979e8-2569-4d6c-9eee-344972000aab?source=api-prod","affected":[{"type":"theme","slug":"trendytravel","name":"Trendy Travel WordPress","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:38:59Z"},{"id":"wordfence:4faf5d1f-604d-4174-8b83-8779cc83ac4c","source":"wordfence","cve":"CVE-2025-23977","title":"Post Carousel Slider <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4faf5d1f-604d-4174-8b83-8779cc83ac4c?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel-slider","name":"Post Carousel Slider","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:32:32Z"},{"id":"wordfence:4fb0195a-077e-4f43-9294-1e5ecad7eb82","source":"wordfence","cve":"CVE-2024-25925","title":"WooCommerce Easy Checkout Field Editor, Fees & Discounts <= 3.5.12 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb0195a-077e-4f43-9294-1e5ecad7eb82?source=api-prod","affected":[{"type":"plugin","slug":"phppoet-checkout-fields","name":"SysBasics Easy Checkout Field Editor, Fees & Discounts","from":"*","from_inclusive":true,"to":"3.5.12","to_inclusive":true,"patched_in":"3.5.13"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T15:59:06Z"},{"id":"wordfence:4fb06315-30ad-4d98-af75-b04933583be7","source":"wordfence","cve":"CVE-2023-49839","title":"Multiple Plugins by KlbTheme <= (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb06315-30ad-4d98-af75-b04933583be7?source=api-prod","affected":[{"type":"plugin","slug":"cosmetsy-core","name":"Cosmetsy Core","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"partdo-core","name":"Parto Core","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"medibazar-core","name":"Medibazar Core","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bacola-core","name":"Bacola Core","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"clotya-core","name":"Clotya Core","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"furnob-core","name":"Furnob Core","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fb0c069-ea6d-4eff-851e-b41c34b41152","source":"wordfence","cve":"CVE-2015-6523","title":"Portfolio Plugin < 1.05 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb0c069-ea6d-4eff-851e-b41c34b41152?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-by-lisa-westlund","name":"Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":false,"patched_in":"1.05"}],"published":"2015-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fb5b208-0443-4d75-902b-8687217e26fd","source":"wordfence","cve":"CVE-2025-28979","title":"WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb5b208-0443-4d75-902b-8687217e26fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2026-02-04T03:25:32Z"},{"id":"wordfence:4fb5bd77-2841-4d41-aaa7-387bdb1f50b1","source":"wordfence","cve":"CVE-2025-47622","title":"Email Notification on Login <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb5bd77-2841-4d41-aaa7-387bdb1f50b1?source=api-prod","affected":[{"type":"plugin","slug":"email-notification-on-login","name":"Email Notification on Login","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:14:58Z"},{"id":"wordfence:4fb97672-9ff7-49c8-bc36-c1b9b2c1ba3e","source":"wordfence","cve":"CVE-2026-94082","title":"Quiz Cat \u2013 WordPress Quiz Plugin <= 3.1.1 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fb97672-9ff7-49c8-bc36-c1b9b2c1ba3e?source=api-prod","affected":[{"type":"plugin","slug":"quiz-cat","name":"Quiz Cat \u2013 WordPress Quiz Plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:30:13Z"},{"id":"wordfence:4fbcd194-67e2-4a56-a366-fdc0834c8150","source":"wordfence","cve":"CVE-2026-91828","title":"OMGF <= 6.3.10 - Denial of Service to Unauthenticated Site Availability Exhaustion","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fbcd194-67e2-4a56-a366-fdc0834c8150?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"6.3.10","to_inclusive":true,"patched_in":"6.3.11"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T13:33:34Z"},{"id":"wordfence:4fbcd1a5-1518-431a-88af-bf9aebafc0df","source":"wordfence","cve":"CVE-2026-14287","title":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer <= 2.33.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fbcd1a5-1518-431a-88af-bf9aebafc0df?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.33.4","to_inclusive":true,"patched_in":"2.33.5"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-22T13:46:25Z"},{"id":"wordfence:4fbeee29-751a-48c9-a875-393441f62dde","source":"wordfence","cve":"","title":"Lingotek Translation <= 1.1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fbeee29-751a-48c9-a875-393441f62dde?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2016-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fbfec7f-2e96-432c-ade4-c9b96adcaf88","source":"wordfence","cve":"CVE-2025-39415","title":"Social Media Links <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fbfec7f-2e96-432c-ade4-c9b96adcaf88?source=api-prod","affected":[{"type":"plugin","slug":"social-media-links","name":"Social Media Links","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:52:07Z"},{"id":"wordfence:4fc00e00-5015-4dd7-8b26-56f3925bdbc6","source":"wordfence","cve":"CVE-2025-48165","title":"DELUCKS SEO <= 2.6.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc00e00-5015-4dd7-8b26-56f3925bdbc6?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:17:10Z"},{"id":"wordfence:4fc3e24a-8b51-4b6f-bacf-665ceb03bc05","source":"wordfence","cve":"CVE-2026-2386","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc3e24a-8b51-4b6f-bacf-665ceb03bc05?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.7","to_inclusive":true,"patched_in":"6.4.8"}],"published":"2026-02-18T00:04:23Z","updated":"2026-05-12T14:39:17Z"},{"id":"wordfence:4fc76e1c-546f-4ecd-bd3b-a6f21b2c65bf","source":"wordfence","cve":"","title":"BizPrint <= 4.5.1 - Missing Authorization in showTemplatePreview","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc76e1c-546f-4ecd-bd3b-a6f21b2c65bf?source=api-prod","affected":[{"type":"plugin","slug":"print-google-cloud-print-gcp-woocommerce","name":"Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-06T18:02:47Z"},{"id":"wordfence:4fc81a70-f43d-4a92-b376-7ed85481e00f","source":"wordfence","cve":"CVE-2026-73346","title":"Mailchimp for WooCommerce < 6.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc81a70-f43d-4a92-b376-7ed85481e00f?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":false,"patched_in":"6.2"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-13T18:46:09Z"},{"id":"wordfence:4fc82778-0493-456f-bc73-3d70e3a2b1bf","source":"wordfence","cve":"CVE-2024-9353","title":"Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc82778-0493-456f-bc73-3d70e3a2b1bf?source=api-prod","affected":[{"type":"plugin","slug":"popularis-extra","name":"Popularis Extra","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:04:52Z"},{"id":"wordfence:4fc8deda-9fb3-41e5-850b-5109d4018027","source":"wordfence","cve":"CVE-2017-18487","title":"AdPush <= 1.43 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc8deda-9fb3-41e5-850b-5109d4018027?source=api-prod","affected":[{"type":"plugin","slug":"adsense-plugin","name":"AdPush","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":"1.44"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fcaab95-7940-45f9-a3c2-c3b0dc540b61","source":"wordfence","cve":"CVE-2023-49167","title":"Database for CF7 <= 1.2.4 - Missing Authorization via wpcf7db_delete AJAX action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fcaab95-7940-45f9-a3c2-c3b0dc540b61?source=api-prod","affected":[{"type":"plugin","slug":"database-for-cf7","name":"Database for CF7","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-11-29T00:00:00Z","updated":"2024-03-08T19:30:03Z"},{"id":"wordfence:4fcd03cd-87c9-4378-ae42-3715ca3a1cb8","source":"wordfence","cve":"CVE-2025-23461","title":"Social2Blog <= 0.2.990 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fcd03cd-87c9-4378-ae42-3715ca3a1cb8?source=api-prod","affected":[{"type":"plugin","slug":"social2blog","name":"Social2Blog","from":"*","from_inclusive":true,"to":"0.2.990","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:28:41Z"},{"id":"wordfence:4fcd2eb4-6cec-4fe8-b506-9a3970ed284a","source":"wordfence","cve":"CVE-2024-54210","title":"Advanced Element Bucket Addons for Elementor <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fcd2eb4-6cec-4fe8-b506-9a3970ed284a?source=api-prod","affected":[{"type":"plugin","slug":"cs-element-bucket","name":"Advanced Element Bucket Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T22:39:56Z"},{"id":"wordfence:4fce3965-3b91-4d19-ac58-2b5475d59c35","source":"wordfence","cve":"CVE-2025-26974","title":"WP Multistore Locator <= 2.5.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fce3965-3b91-4d19-ac58-2b5475d59c35?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:41:44Z"},{"id":"wordfence:4fd4d30b-f37f-4083-acfe-8e85c075da10","source":"wordfence","cve":"CVE-2021-24987","title":"Social Share, Social Login and Social Comments < 7.13.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd4d30b-f37f-4083-acfe-8e85c075da10?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.30","to_inclusive":false,"patched_in":"7.13.30"}],"published":"2022-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fd67a02-b0fb-4c4f-9564-c3ee0180e79c","source":"wordfence","cve":"CVE-2023-49750","title":"Couponis Demo < 2.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd67a02-b0fb-4c4f-9564-c3ee0180e79c?source=api-prod","affected":[{"type":"theme","slug":"couponis-demo","name":"Couponis Demo","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fd6df9d-2963-44b1-bc4e-e53eda97a2a9","source":"wordfence","cve":"CVE-2025-13439","title":"Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6df9d-2963-44b1-bc4e-e53eda97a2a9?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-22T01:31:21Z"},{"id":"wordfence:4fd6fa4f-8f4d-4d2f-ac67-98124cfa9592","source":"wordfence","cve":"CVE-2023-47783","title":"Thrive Theme Builder < 3.24.0 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd6fa4f-8f4d-4d2f-ac67-98124cfa9592?source=api-prod","affected":[{"type":"theme","slug":"thrive-theme","name":"Thrive Themes Builder","from":"*","from_inclusive":true,"to":"3.24.0","to_inclusive":false,"patched_in":"3.24.0"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fd76fbc-22df-4071-a2ae-9c9ac9cdbc57","source":"wordfence","cve":"CVE-2026-12170","title":"AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd76fbc-22df-4071-a2ae-9c9ac9cdbc57?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.10.2","to_inclusive":true,"patched_in":"10.11.0"}],"published":"2026-07-08T18:04:06Z","updated":"2026-07-09T06:52:45Z"},{"id":"wordfence:4fd78299-f71f-473d-9c62-77be9495393f","source":"wordfence","cve":"CVE-2026-27987","title":"The Qlean <= 2.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd78299-f71f-473d-9c62-77be9495393f?source=api-prod","affected":[{"type":"theme","slug":"the-qlean","name":"The Qlean","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:55:06Z"},{"id":"wordfence:4fd7af43-5b49-4c4c-a51c-0cce5529ea1b","source":"wordfence","cve":"CVE-2025-10567","title":"FunnelKit <= 3.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd7af43-5b49-4c4c-a51c-0cce5529ea1b?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.0.1"}],"published":"2025-10-15T00:00:00Z","updated":"2025-11-11T19:51:44Z"},{"id":"wordfence:4fd88ad7-e983-4419-8951-30c50969946a","source":"wordfence","cve":"CVE-2025-69062","title":"Weedles <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd88ad7-e983-4419-8951-30c50969946a?source=api-prod","affected":[{"type":"theme","slug":"weedles","name":"Weedles | Virtual Reality Landing Page & Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:33:31Z"},{"id":"wordfence:4fd929e7-8f28-43de-92ce-4f52ece24f7c","source":"wordfence","cve":"CVE-2024-56278","title":"WP Ultimate Exporter <= 2.9.1 - Authenticated (Admin+) Remote Code Execution","severity":"medium","cvss":4.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fd929e7-8f28-43de-92ce-4f52ece24f7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:35:58Z"},{"id":"wordfence:4fdefb32-8fab-4f22-bc61-a53f92a06a12","source":"wordfence","cve":"CVE-2025-32690","title":"PowerPress Podcasting <= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdefb32-8fab-4f22-bc61-a53f92a06a12?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.12.5","to_inclusive":true,"patched_in":"11.12.6"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-05T15:57:27Z"},{"id":"wordfence:4fdf49e7-c89e-4b05-9236-ca28e715bc4a","source":"wordfence","cve":"CVE-2012-2404","title":"WordPress Core <= 3.3.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdf49e7-c89e-4b05-9236-ca28e715bc4a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2012-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fdfbc46-3e8e-4db1-8778-d46121168d93","source":"wordfence","cve":"CVE-2025-22535","title":"WPListCal <= 1.3.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdfbc46-3e8e-4db1-8778-d46121168d93?source=api-prod","affected":[{"type":"plugin","slug":"wplistcal","name":"WPListCal","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:56:36Z"},{"id":"wordfence:4fdfdcbe-014b-4b68-9ac5-976d384106c3","source":"wordfence","cve":"CVE-2025-8146","title":"Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fdfdcbe-014b-4b68-9ac5-976d384106c3?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-08-01T16:22:45Z","updated":"2025-08-02T04:24:12Z"},{"id":"wordfence:4fe0a08e-eee2-4d48-bb38-dd58bff79118","source":"wordfence","cve":"CVE-2025-14352","title":"Awesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modification","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe0a08e-eee2-4d48-bb38-dd58bff79118?source=api-prod","affected":[{"type":"plugin","slug":"awesome-hotel-booking","name":"Awesome Hotel Booking","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-01-06T20:40:51Z","updated":"2026-01-13T17:13:12Z"},{"id":"wordfence:4fe0df91-21f0-4eef-8064-2b283f38b181","source":"wordfence","cve":"","title":"World Travel Information <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe0df91-21f0-4eef-8064-2b283f38b181?source=api-prod","affected":[{"type":"plugin","slug":"world-travel-information","name":"World Travel Information","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fe1aa29-9f50-4503-9539-c9859e50e753","source":"wordfence","cve":"CVE-2026-66450","title":"Geo Mashup <= 1.13.18 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe1aa29-9f50-4503-9539-c9859e50e753?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T19:09:25Z"},{"id":"wordfence:4fe1c440-f988-4020-9f80-77683ff652b2","source":"wordfence","cve":"CVE-2025-8944","title":"OceanWP <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe1c440-f988-4020-9f80-77683ff652b2?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-08-15T00:00:00Z","updated":"2025-09-25T19:43:54Z"},{"id":"wordfence:4fe758c4-027f-4667-a22a-9e859894a40f","source":"wordfence","cve":"CVE-2019-19915","title":"301 Redirects - Easy Redirect Manager <= 2.40 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe758c4-027f-4667-a22a-9e859894a40f?source=api-prod","affected":[{"type":"plugin","slug":"eps-301-redirects","name":"301 Redirects \u2013 Redirect Manager","from":"*","from_inclusive":true,"to":"2.40","to_inclusive":true,"patched_in":"2.45"}],"published":"2019-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4fe784a0-d466-4124-b712-18c19f9de53a","source":"wordfence","cve":"CVE-2025-24540","title":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe784a0-d466-4124-b712-18c19f9de53a?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.18.9","to_inclusive":true,"patched_in":"6.18.10"}],"published":"2024-11-09T00:00:00Z","updated":"2025-02-19T16:21:41Z"},{"id":"wordfence:4fe81113-6ed1-48f2-a6d0-db4c19f6df10","source":"wordfence","cve":"CVE-2022-0140","title":"Visual Form Builder <= 3.0.5 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fe81113-6ed1-48f2-a6d0-db4c19f6df10?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4feaad82-f94e-49f5-8e8b-67ba220b1c71","source":"wordfence","cve":"CVE-2026-9019","title":"Easy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4feaad82-f94e-49f5-8e8b-67ba220b1c71?source=api-prod","affected":[{"type":"plugin","slug":"easy-image-collage","name":"Easy Image Collage","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-06-09T18:47:44Z","updated":"2026-06-10T06:48:30Z"},{"id":"wordfence:4feacb75-0533-4f53-8ce9-3e45ee8336e2","source":"wordfence","cve":"CVE-2024-13215","title":"Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup","severity":"medium","cvss":4.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4feacb75-0533-4f53-8ce9-3e45ee8336e2?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.10","to_inclusive":true,"patched_in":"1.14"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T12:44:27Z"},{"id":"wordfence:4feccf0a-983d-4435-9cd6-5f7cb23f41a9","source":"wordfence","cve":"CVE-2025-69043","title":"Rashy <= 1.1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4feccf0a-983d-4435-9cd6-5f7cb23f41a9?source=api-prod","affected":[{"type":"theme","slug":"rashy","name":"Rashy - Sport Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:28:41Z"},{"id":"wordfence:4fed59bf-885b-4a06-aff2-8e5ab5f83ba7","source":"wordfence","cve":"CVE-2025-3874","title":"WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fed59bf-885b-4a06-aff2-8e5ab5f83ba7?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-04-30T22:01:16Z","updated":"2025-05-01T11:11:42Z"},{"id":"wordfence:4fee56b5-dfd8-486c-ae93-91fdbc4687c9","source":"wordfence","cve":"CVE-2025-15609","title":"Fortis for WooCommerce < 1.3.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fee56b5-dfd8-486c-ae93-91fdbc4687c9?source=api-prod","affected":[{"type":"plugin","slug":"fortis-for-woocommerce","name":"Fortis for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-18T13:13:13Z"},{"id":"wordfence:4fee61cd-7359-4193-8cf2-86e0527a8ef1","source":"wordfence","cve":"CVE-2023-33316","title":"WooCommerce Follow-Up Emails <= 4.9.40 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4fee61cd-7359-4193-8cf2-86e0527a8ef1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-follow-up-emails","name":"Woocommerce Follow-ups","from":"*","from_inclusive":true,"to":"4.9.40","to_inclusive":true,"patched_in":"4.9.50"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4feed0da-f5b1-47eb-9454-8539f62335fa","source":"wordfence","cve":"CVE-2021-24201","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4feed0da-f5b1-47eb-9454-8539f62335fa?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"0.1.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:4ff1d12e-1129-40d3-8c29-3a46ffc77872","source":"wordfence","cve":"CVE-2024-2395","title":"Bulgarisation for WooCommerce <= 3.0.14 - Cross-Site Request Forgery","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff1d12e-1129-40d3-8c29-3a46ffc77872?source=api-prod","affected":[{"type":"plugin","slug":"bulgarisation-for-woocommerce","name":"Bulgarisation for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:36:20Z"},{"id":"wordfence:4ff2088e-c7f8-47e8-8858-f6bf6a801812","source":"wordfence","cve":"CVE-2025-58892","title":"Tourimo <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff2088e-c7f8-47e8-8858-f6bf6a801812?source=api-prod","affected":[{"type":"theme","slug":"tourimo","name":"Tourimo - Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-20T21:06:13Z"},{"id":"wordfence:4ff21c04-b615-417a-a640-e17c3211f449","source":"wordfence","cve":"CVE-2024-52492","title":"Image horizontal reel scroll slideshow <= 13.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff21c04-b615-417a-a640-e17c3211f449?source=api-prod","affected":[{"type":"plugin","slug":"image-horizontal-reel-scroll-slideshow","name":"Image horizontal reel scroll slideshow","from":"*","from_inclusive":true,"to":"13.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:09:26Z"},{"id":"wordfence:4ff3b4f1-dd36-43d0-b472-55a940907437","source":"wordfence","cve":"CVE-2024-12857","title":"AdForest <= 5.1.8 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff3b4f1-dd36-43d0-b472-55a940907437?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:03:52Z"},{"id":"wordfence:4ff558bb-7c5a-4e17-a3f5-bc9aa2332af1","source":"wordfence","cve":"CVE-2024-3594","title":"IDonate \u2013 blood request management system <= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff558bb-7c5a-4e17-a3f5-bc9aa2332af1?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-05-01T00:00:00Z","updated":"2024-09-09T20:25:44Z"},{"id":"wordfence:4ff75bf6-c8c3-43f5-bc71-0e54e892e664","source":"wordfence","cve":"CVE-2026-93767","title":"Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff75bf6-c8c3-43f5-bc71-0e54e892e664?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-10-15T17:03:29Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:4ff9abb4-2b25-4bbb-86b4-fb1ba37e122f","source":"wordfence","cve":"CVE-2025-12960","title":"Simple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff9abb4-2b25-4bbb-86b4-fb1ba37e122f?source=api-prod","affected":[{"type":"plugin","slug":"simple-csv-table","name":"Simple CSV Table","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-12-11T19:26:53Z","updated":"2025-12-12T08:20:04Z"},{"id":"wordfence:4ffc741e-9506-40a2-b3d3-48ed5d06bc62","source":"wordfence","cve":"CVE-2026-73384","title":"Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffc741e-9506-40a2-b3d3-48ed5d06bc62?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-contact-form-7","name":"Pay with Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:13:18Z"},{"id":"wordfence:4ffd74de-6629-4088-ba5c-ac9dd5c6322c","source":"wordfence","cve":"CVE-2024-1519","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffd74de-6629-4088-ba5c-ac9dd5c6322c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:31Z"},{"id":"wordfence:4ffd76a2-6700-4c2a-858d-4c7339a8d09a","source":"wordfence","cve":"CVE-2024-5205","title":"Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffd76a2-6700-4c2a-858d-4c7339a8d09a?source=api-prod","affected":[{"type":"plugin","slug":"videojs-html5-player","name":"Videojs HTML5 Player","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2024-05-23T14:45:13Z","updated":"2024-05-24T03:15:44Z"},{"id":"wordfence:4ffeec7b-cd4d-4555-acc0-22b44f237da6","source":"wordfence","cve":"CVE-2021-25079","title":"Contact Form Entries <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ffeec7b-cd4d-4555-acc0-22b44f237da6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2021-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50003b49-2c44-4f49-aaf9-8811bd4dda4f","source":"wordfence","cve":"CVE-2025-49246","title":"Testimonials Showcase <= 1.9.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50003b49-2c44-4f49-aaf9-8811bd4dda4f?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-showcase","name":"Testimonials Showcase","from":"*","from_inclusive":true,"to":"1.9.16","to_inclusive":true,"patched_in":"1.9.18"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:17:15Z"},{"id":"wordfence:5000c86b-b535-48de-b3e0-0dd0d2fd9b1e","source":"wordfence","cve":"CVE-2026-6916","title":"Jeg Kit for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5000c86b-b535-48de-b3e0-0dd0d2fd9b1e?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-05-01T16:52:54Z","updated":"2026-05-02T05:29:30Z"},{"id":"wordfence:5004d789-6e59-403b-8df9-2030a976fc52","source":"wordfence","cve":"CVE-2024-5167","title":"CM Email Registration Blacklist and Whitelist <= 1.4.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5004d789-6e59-403b-8df9-2030a976fc52?source=api-prod","affected":[{"type":"plugin","slug":"cm-email-blacklist","name":"CM E-Mail Blacklist \u2013 Simple email filtering for safer registration","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:07:44Z"},{"id":"wordfence:5006f242-0dcc-462a-b8a4-b316d811dc0b","source":"wordfence","cve":"CVE-2026-39631","title":"WPSchoolPress <= 2.2.36 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5006f242-0dcc-462a-b8a4-b316d811dc0b?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:35:31Z"},{"id":"wordfence:50070f1f-c639-44a7-bada-577bf88c85db","source":"wordfence","cve":"CVE-2026-32468","title":"Duitku Payment Gateway <= 2.11.14 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50070f1f-c639-44a7-bada-577bf88c85db?source=api-prod","affected":[{"type":"plugin","slug":"duitku-social-payment-gateway","name":"Duitku Payment Gateway","from":"*","from_inclusive":true,"to":"2.11.14","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:16:13Z"},{"id":"wordfence:5007a9a9-faf6-493c-8adb-7260c8089bb2","source":"wordfence","cve":"CVE-2026-57703","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers <= 3.6.10.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5007a9a9-faf6-493c-8adb-7260c8089bb2?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.6.10.1","to_inclusive":true,"patched_in":"3.6.11"}],"published":"2026-07-20T00:00:00Z","updated":"2026-07-27T15:42:31Z"},{"id":"wordfence:5008b56f-5cd4-42e5-8d7e-7b1e01b2cbf8","source":"wordfence","cve":"CVE-2024-6289","title":"WPS Hide Login <= 1.9.16.3 - Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5008b56f-5cd4-42e5-8d7e-7b1e01b2cbf8?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.9.16.3","to_inclusive":true,"patched_in":"1.9.16.4"}],"published":"2024-06-24T00:00:00Z","updated":"2024-08-09T20:39:18Z"},{"id":"wordfence:500ce6fe-0528-4b15-89a7-0e1f92e97364","source":"wordfence","cve":"CVE-2025-30921","title":"Newsletters <= 4.9.9.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/500ce6fe-0528-4b15-89a7-0e1f92e97364?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.7","to_inclusive":true,"patched_in":"4.9.9.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:19:11Z"},{"id":"wordfence:500d2a59-c017-460a-bf25-c9e75b458da6","source":"wordfence","cve":"CVE-2026-22347","title":"Carousel Horizontal Posts Content Slider <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/500d2a59-c017-460a-bf25-c9e75b458da6?source=api-prod","affected":[{"type":"plugin","slug":"carousel-horizontal-posts-content-slider","name":"Carousel Horizontal Posts Content Slider","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T19:37:27Z"},{"id":"wordfence:500f18e6-14ca-4632-9317-5886fa2bb763","source":"wordfence","cve":"CVE-2026-97348","title":"SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/500f18e6-14ca-4632-9317-5886fa2bb763?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.74.3","to_inclusive":true,"patched_in":"1.75.0"}],"published":"2026-10-09T17:42:09Z","updated":"2026-10-10T06:40:10Z"},{"id":"wordfence:500fd8aa-9ad1-41ee-bbeb-cda9c80c4fcb","source":"wordfence","cve":"CVE-2023-6776","title":"3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/500fd8aa-9ad1-41ee-bbeb-cda9c80c4fcb?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.15.2","to_inclusive":true,"patched_in":"1.15.3"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:20Z"},{"id":"wordfence:50137e58-ec3b-4b7e-a981-86e099f98e1e","source":"wordfence","cve":"CVE-2026-109687","title":"Link Whisper Free <= 0.9.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50137e58-ec3b-4b7e-a981-86e099f98e1e?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:44:43Z"},{"id":"wordfence:5015cfe7-9e5c-4745-b6c3-60e4aa99672d","source":"wordfence","cve":"CVE-2018-20368","title":"Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5015cfe7-9e5c-4745-b6c3-60e4aa99672d?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2018-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50167c70-40f3-4beb-9171-ece066d2c3de","source":"wordfence","cve":"CVE-2024-54226","title":"Country Blocker <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50167c70-40f3-4beb-9171-ece066d2c3de?source=api-prod","affected":[{"type":"plugin","slug":"country-blocker","name":"Country Blocker","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:45:43Z"},{"id":"wordfence:5016ecf2-6016-4a46-8e16-30e9f79344e4","source":"wordfence","cve":"CVE-2026-82187","title":"WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5016ecf2-6016-4a46-8e16-30e9f79344e4?source=api-prod","affected":[{"type":"plugin","slug":"web-to-print-online-designer","name":"Web to Print Online Designer","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2026-09-19T00:00:00Z","updated":"2026-09-22T18:37:34Z"},{"id":"wordfence:5017c81f-91ee-421b-96db-c96eae56d032","source":"wordfence","cve":"CVE-2026-54816","title":"Advanced Ads \u2013\u00a0Ad Manager & AdSense <= 2.0.21 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5017c81f-91ee-421b-96db-c96eae56d032?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T14:15:06Z"},{"id":"wordfence:5018cc57-71e1-433c-94ab-da5c129f3071","source":"wordfence","cve":"CVE-2025-58670","title":"WP Content Protection <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5018cc57-71e1-433c-94ab-da5c129f3071?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-protection","name":"WP Content Protection","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:49:45Z"},{"id":"wordfence:50192909-9351-4cf5-b578-f34be72aeda6","source":"wordfence","cve":"CVE-2024-54215","title":"Revy <= 1.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50192909-9351-4cf5-b578-f34be72aeda6?source=api-prod","affected":[{"type":"plugin","slug":"revy","name":"Revy","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:41:02Z"},{"id":"wordfence:501a610a-7f11-4a03-b718-01c37cebe897","source":"wordfence","cve":"CVE-2025-30854","title":"Serial Codes Generator and Validator with WooCommerce Support <= 2.7.7 - Cross-Site Request Forgery via [placeholder]","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501a610a-7f11-4a03-b718-01c37cebe897?source=api-prod","affected":[{"type":"plugin","slug":"serial-codes-generator-and-validator","name":"Serial Codes Generator and Validator with WooCommerce Support","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:09:59Z"},{"id":"wordfence:501aed34-537b-4d35-a04f-a984297adb39","source":"wordfence","cve":"","title":"Job Manager <= 0.7.24 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501aed34-537b-4d35-a04f-a984297adb39?source=api-prod","affected":[{"type":"plugin","slug":"job-manager","name":"Job Manager","from":"*","from_inclusive":true,"to":"0.7.25","to_inclusive":false,"patched_in":"0.7.25"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:501be94e-c01a-43bd-b079-c11e60969def","source":"wordfence","cve":"CVE-2026-23972","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501be94e-c01a-43bd-b079-c11e60969def?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:03:00Z"},{"id":"wordfence:501e3c8a-350e-4431-b6a2-012e837320bc","source":"wordfence","cve":"CVE-2011-3125","title":"WordPress Core < 3.1.3 - Security Hardening","severity":"medium","cvss":6.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501e3c8a-350e-4431-b6a2-012e837320bc?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:501e9cd1-1187-4d01-a3cc-5edba64c391f","source":"wordfence","cve":"","title":"Image Compressor & Optimizer - iLoveIMG <= 1.0.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501e9cd1-1187-4d01-a3cc-5edba64c391f?source=api-prod","affected":[{"type":"plugin","slug":"iloveimg","name":"iLoveIMG","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:501fb05a-c8ec-43c6-b462-2a83c4f8b6b7","source":"wordfence","cve":"CVE-2022-1712","title":"LiveSync for WordPress <= 1.0 - Cross-Site Request Forgery to Arbitrary Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/501fb05a-c8ec-43c6-b462-2a83c4f8b6b7?source=api-prod","affected":[{"type":"plugin","slug":"livesync","name":"LiveSync for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50212e01-4055-4e63-8cf2-6ee434f46604","source":"wordfence","cve":"CVE-2024-30482","title":"Simple Revisions Delete <= 1.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50212e01-4055-4e63-8cf2-6ee434f46604?source=api-prod","affected":[{"type":"plugin","slug":"simple-revisions-delete","name":"Simple Revisions Delete","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:45:54Z"},{"id":"wordfence:5022e15e-6c1d-4e9d-a27a-961516f392f8","source":"wordfence","cve":"CVE-2025-47665","title":"N360 | Splash Screen <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5022e15e-6c1d-4e9d-a27a-961516f392f8?source=api-prod","affected":[{"type":"plugin","slug":"n360-splash-screen","name":"N360 | Splash Screen","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-25T13:51:18Z"},{"id":"wordfence:50251b17-58d7-4870-b825-a194312fb3e7","source":"wordfence","cve":"CVE-2025-11627","title":"Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning","severity":"medium","cvss":6.5,"cwe":"CWE-117","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=api-prod","affected":[{"type":"plugin","slug":"site-checkup","name":"Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue","from":"*","from_inclusive":true,"to":"1.47","to_inclusive":true,"patched_in":"1.48"}],"published":"2025-10-29T00:00:00Z","updated":"2025-10-30T05:28:27Z"},{"id":"wordfence:502577dd-49e3-419d-8b37-591be69ad131","source":"wordfence","cve":"CVE-2026-13262","title":"Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/502577dd-49e3-419d-8b37-591be69ad131?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-07-10T14:20:24Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:50259040-a984-42a8-8d58-cc94e349ca45","source":"wordfence","cve":"CVE-2024-10535","title":"Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50259040-a984-42a8-8d58-cc94e349ca45?source=api-prod","affected":[{"type":"plugin","slug":"video-wc-gallery","name":"Video Gallery for WooCommerce \u2013 Add Product Video & Featured Video","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":"1.32"}],"published":"2024-11-05T00:00:00Z","updated":"2024-11-06T06:43:30Z"},{"id":"wordfence:502724d9-ccc4-42db-bc1e-c521f7c80e70","source":"wordfence","cve":"","title":"Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/502724d9-ccc4-42db-bc1e-c521f7c80e70?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"},{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2020-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50272c8a-2e23-490d-8865-68ae49228895","source":"wordfence","cve":"CVE-2026-18386","title":"WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50272c8a-2e23-490d-8865-68ae49228895?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T15:19:03Z","updated":"2026-09-10T03:40:40Z"},{"id":"wordfence:5027a662-f27c-4a76-88ac-7b9c2e7401e9","source":"wordfence","cve":"CVE-2025-22717","title":"My Tickets <= 2.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5027a662-f27c-4a76-88ac-7b9c2e7401e9?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-21T16:16:49Z"},{"id":"wordfence:50283a4f-ea59-488a-bab0-dd6bc5718556","source":"wordfence","cve":"CVE-2023-5164","title":"Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50283a4f-ea59-488a-bab0-dd6bc5718556?source=api-prod","affected":[{"type":"plugin","slug":"bellows-accordion-menu","name":"Bellows Accordion Menu","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50298ef3-352d-4fd2-bbb9-a55cfd329837","source":"wordfence","cve":"","title":"Ultimate Affiliate Pro <= 3.9 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50298ef3-352d-4fd2-bbb9-a55cfd329837?source=api-prod","affected":[{"type":"plugin","slug":"indeed-affiliate-pro","name":"Ultimate Affiliate Pro WordPress Plugin","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2017-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:502bc68d-778a-47df-a5c2-6bd0b4f130cc","source":"wordfence","cve":"CVE-2023-45650","title":"HTML5 Maps <= 1.7.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/502bc68d-778a-47df-a5c2-6bd0b4f130cc?source=api-prod","affected":[{"type":"plugin","slug":"html5-maps","name":"HTML5 Maps","from":"*","from_inclusive":true,"to":"1.7.1.4","to_inclusive":true,"patched_in":"1.7.1.5"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:502cf45c-1350-4534-a806-6e248912ef6d","source":"wordfence","cve":"","title":"Floating Tweets <= 1.0.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/502cf45c-1350-4534-a806-6e248912ef6d?source=api-prod","affected":[{"type":"plugin","slug":"floating-tweets","name":"Floating Tweets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2013-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:502e71ab-9974-45dc-b777-b43bf1c56297","source":"wordfence","cve":"CVE-2025-60060","title":"Pubzinne <= 1.0.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/502e71ab-9974-45dc-b777-b43bf1c56297?source=api-prod","affected":[{"type":"theme","slug":"pubzinne","name":"Pubzinne - Sports Bar & Pub WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:40:59Z"},{"id":"wordfence:503089b0-fb9b-43b2-acfd-1a8953453706","source":"wordfence","cve":"CVE-2026-78282","title":"Accept Stripe Payments <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/503089b0-fb9b-43b2-acfd-1a8953453706?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-08-24T12:37:55Z","updated":"2026-09-10T19:16:24Z"},{"id":"wordfence:50349086-e7b0-4f73-8722-1367cc05180e","source":"wordfence","cve":"CVE-2024-9933","title":"WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50349086-e7b0-4f73-8722-1367cc05180e?source=api-prod","affected":[{"type":"plugin","slug":"watchtowerhq","name":"WatchTowerHQ","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-28T16:19:21Z"},{"id":"wordfence:5035d412-861a-4a31-b5e5-378fc4962d90","source":"wordfence","cve":"CVE-2026-1574","title":"MyQtip \u2013 easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5035d412-861a-4a31-b5e5-378fc4962d90?source=api-prod","affected":[{"type":"plugin","slug":"myqtip-easy-qtip2","name":"MyQtip \u2013 easy qTip2","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:41:15Z","updated":"2026-03-07T07:22:05Z"},{"id":"wordfence:5038d12a-e119-4ab7-aadc-69b765ae7027","source":"wordfence","cve":"CVE-2026-3576","title":"Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=api-prod","affected":[{"type":"plugin","slug":"planyo-online-reservation-system","name":"Planyo online reservation system","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-07-10T14:43:19Z","updated":"2026-07-11T03:44:22Z"},{"id":"wordfence:5039d63b-377d-435a-be31-4ae81ea30dd3","source":"wordfence","cve":"CVE-2025-3487","title":"Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5039d63b-377d-435a-be31-4ae81ea30dd3?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.42.0","to_inclusive":true,"patched_in":"1.42.1"}],"published":"2025-04-16T22:33:14Z","updated":"2025-04-17T11:13:07Z"},{"id":"wordfence:503a44ed-25c2-4178-aeec-756c5b533e04","source":"wordfence","cve":"CVE-2023-26517","title":"Dashboard Widgets Suite <= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/503a44ed-25c2-4178-aeec-756c5b533e04?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-widgets-suite","name":"Dashboard Widgets Suite","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:503aafef-2496-46dd-9370-90a09f70a5d3","source":"wordfence","cve":"CVE-2025-68503","title":"JetBlog <= 2.4.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/503aafef-2496-46dd-9370-90a09f70a5d3?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.7.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T21:49:41Z"},{"id":"wordfence:503c00f5-59e5-4ca2-ac3d-a3f38a993f0d","source":"wordfence","cve":"CVE-2024-13317","title":"ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/503c00f5-59e5-4ca2-ac3d-a3f38a993f0d?source=api-prod","affected":[{"type":"plugin","slug":"shipworks-e-commerce-bridge","name":"ShipWorks Connector for Woocommerce","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:08Z"},{"id":"wordfence:503dcefe-1147-4b8e-96e2-c21f49a7bc5b","source":"wordfence","cve":"CVE-2022-4751","title":"Word Balloon <= 4.19.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/503dcefe-1147-4b8e-96e2-c21f49a7bc5b?source=api-prod","affected":[{"type":"plugin","slug":"word-balloon","name":"Word Balloon","from":"*","from_inclusive":true,"to":"4.19.2","to_inclusive":true,"patched_in":"4.19.3"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50417068-339a-4ae5-9c90-8f08f54ce0af","source":"wordfence","cve":"CVE-2026-5217","title":"Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50417068-339a-4ae5-9c90-8f08f54ce0af?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-04-10T11:56:50Z","updated":"2026-04-11T01:24:58Z"},{"id":"wordfence:50421e90-ccd6-4896-8041-b99279314301","source":"wordfence","cve":"CVE-2022-4532","title":"LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50421e90-ccd6-4896-8041-b99279314301?source=api-prod","affected":[{"type":"plugin","slug":"login-attempts-limit-wp","name":"LOGIN AND REGISTRATION ATTEMPTS LIMIT","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:21Z"},{"id":"wordfence:504476f8-3583-448b-80fd-ed03b672a4e8","source":"wordfence","cve":"CVE-2024-32555","title":"Easy Real Estate <= 2.2.9- Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/504476f8-3583-448b-80fd-ed03b672a4e8?source=api-prod","affected":[{"type":"plugin","slug":"easy-real-estate","name":"Easy Real Estate","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-01-20T00:00:00Z","updated":"2026-01-23T15:10:06Z"},{"id":"wordfence:50459285-f76a-458e-9929-85914cc16923","source":"wordfence","cve":"CVE-2026-119526","title":"Royal Event <= 2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50459285-f76a-458e-9929-85914cc16923?source=api-prod","affected":[{"type":"theme","slug":"royal-event","name":"Royal Event | Catering & Wedding Chef Wordpress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:51:23Z"},{"id":"wordfence:50469119-fc94-4d51-94bc-cd19076c33a0","source":"wordfence","cve":"CVE-2025-62997","title":"EasyCart <= 5.8.11 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50469119-fc94-4d51-94bc-cd19076c33a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.8.11","to_inclusive":true,"patched_in":"5.8.12"}],"published":"2025-12-08T00:00:00Z","updated":"2026-01-06T17:03:53Z"},{"id":"wordfence:50499cd6-0e27-494a-892c-5ca827d4433b","source":"wordfence","cve":"CVE-2023-7202","title":"Fatal Error Notify <= 1.5.2 - Missing Authorization to Test Error Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50499cd6-0e27-494a-892c-5ca827d4433b?source=api-prod","affected":[{"type":"plugin","slug":"fatal-error-notify","name":"Fatal Error Notify","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-01-30T00:00:00Z","updated":"2024-04-17T17:36:50Z"},{"id":"wordfence:504aff5b-5951-4d07-9ff0-e6f7cfe5dc32","source":"wordfence","cve":"CVE-2026-56071","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/504aff5b-5951-4d07-9ff0-e6f7cfe5dc32?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.53.1","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:06:07Z"},{"id":"wordfence:504c0132-530b-4184-b19a-97e68df79b48","source":"wordfence","cve":"CVE-2023-48275","title":"Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/504c0132-530b-4184-b19a-97e68df79b48?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-collector-for-woocommerce","name":"Customer Reviews Collector for WooCommerce","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"},{"type":"plugin","slug":"widgets-for-alibaba-reviews","name":"Widgets for Alibaba Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"reviews-widgets-for-yelp","name":"Widgets for Yelp Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-arukereso","name":"Widgets for \u00c1rukeres\u0151 Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"widgets-for-thumbtack-reviews","name":"Widgets for Thumbtack Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"widgets-for-ebay-reviews","name":"Widgets for Ebay Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"widgets-for-zillow-reviews","name":"Widgets for Zillow Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"widgets-for-aliexpress-reviews","name":"Widgets for AliExpress Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-foursquare","name":"Widgets for Foursquare Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"free-facebook-reviews-and-recommendations-widgets","name":"Widgets for Reviews & Recommendations","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-capterra","name":"Widgets for Capterra Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-booking-com","name":"Widgets for Booking.com Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-hotels-com","name":"Widgets for Hotels.com Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"reviews-widgets","name":"Widgets for WordPress Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-tripadvisor","name":"WP Tripadvisor Review Widgets","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-opentable","name":"Widgets for Opentable Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-amazon","name":"Widgets for Amazon Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-szallas-hu","name":"Review Widgets for Szallas.hu","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"review-widgets-for-airbnb","name":"Widgets for Airbnb Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"},{"type":"plugin","slug":"widgets-for-sourceforge-reviews","name":"Widgets for SourceForge Reviews","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":"11.1"}],"published":"2023-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:504deb5a-cd51-4fad-8544-14b84f9f2ff9","source":"wordfence","cve":"CVE-2025-68593","title":"Adminify <= 4.0.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/504deb5a-cd51-4fad-8544-14b84f9f2ff9?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"4.0.6.1","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-07T14:45:23Z"},{"id":"wordfence:504fca80-7e81-412b-891f-2679451ff6e6","source":"wordfence","cve":"CVE-2019-17214","title":"WebARX <= 1.3.0 - Firewall Bypass","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/504fca80-7e81-412b-891f-2679451ff6e6?source=api-prod","affected":[{"type":"plugin","slug":"webarx","name":"WebARX","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2018-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:505043c9-1373-4bb0-8b52-1614b0cf1f8a","source":"wordfence","cve":"CVE-2026-66453","title":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas <= 10.30.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505043c9-1373-4bb0-8b52-1614b0cf1f8a?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.26","to_inclusive":true,"patched_in":"10.30.27"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T19:35:53Z"},{"id":"wordfence:5050454a-d705-4af6-a1a3-cde00e72cf35","source":"wordfence","cve":"CVE-2025-30920","title":"WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5050454a-d705-4af6-a1a3-cde00e72cf35?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-carousel","name":"CCI Posts Carousel All In One","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:29:21Z"},{"id":"wordfence:50518a54-16d8-4467-beca-a6b8196ed9b9","source":"wordfence","cve":"CVE-2025-26990","title":"Royal Elementor Addons <= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50518a54-16d8-4467-beca-a6b8196ed9b9?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1006","to_inclusive":true,"patched_in":"1.7.1007"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-17T12:49:59Z"},{"id":"wordfence:50537e01-834e-4247-a80f-daa114eedcf1","source":"wordfence","cve":"","title":"Resume Submissions & Job Postings < 2.5.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50537e01-834e-4247-a80f-daa114eedcf1?source=api-prod","affected":[{"type":"plugin","slug":"resume-submissions-job-postings","name":"Resume Submissions & Job Postings","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2012-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50542e5e-da66-4223-a6bf-dc9381687ddd","source":"wordfence","cve":"CVE-2025-5019","title":"Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50542e5e-da66-4223-a6bf-dc9381687ddd?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-06-05T17:48:44Z","updated":"2025-07-25T19:18:14Z"},{"id":"wordfence:5055cf24-14c7-4533-8900-a5f4c1435201","source":"wordfence","cve":"CVE-2025-5817","title":"Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5055cf24-14c7-4533-8900-a5f4c1435201?source=api-prod","affected":[{"type":"plugin","slug":"import-products-to-wc","name":"Amazon Products to WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:56:35Z","updated":"2025-07-02T03:47:25Z"},{"id":"wordfence:505858dc-c420-484c-a067-6962836eea6a","source":"wordfence","cve":"CVE-2024-11714","title":"WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505858dc-c420-484c-a067-6962836eea6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:15Z"},{"id":"wordfence:50589b41-cc2b-4ffa-ab63-509fb9d61be2","source":"wordfence","cve":"","title":"NextGen Gallery <= 2.1.7 - Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50589b41-cc2b-4ffa-ab63-509fb9d61be2?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2015-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:505b1f87-52c6-439c-a108-e2003971dc07","source":"wordfence","cve":"CVE-2021-24215","title":"Controlled Admin Access <= 1.5.1 - Improper Access Control & Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505b1f87-52c6-439c-a108-e2003971dc07?source=api-prod","affected":[{"type":"plugin","slug":"controlled-admin-access","name":"Controlled Admin Access","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2021-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:505b797f-f812-4da3-91c3-44f27a240ec2","source":"wordfence","cve":"CVE-2025-52836","title":"The E-Commerce ERP <= 2.1.1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505b797f-f812-4da3-91c3-44f27a240ec2?source=api-prod","affected":[{"type":"plugin","slug":"profitori","name":"The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis","from":"*","from_inclusive":true,"to":"2.1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T18:00:39Z"},{"id":"wordfence:505d7072-8fca-4b86-9b9c-3f39bc4dcfaf","source":"wordfence","cve":"CVE-2025-10736","title":"ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505d7072-8fca-4b86-9b9c-3f39bc4dcfaf?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-03-22T16:23:54Z","updated":"2026-03-23T04:26:51Z"},{"id":"wordfence:505e9ba4-a19c-4d51-8ba7-4891bbac603e","source":"wordfence","cve":"CVE-2021-24842","title":"Bulk Datetime Change <= 1.11 - Missing Authorisation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505e9ba4-a19c-4d51-8ba7-4891bbac603e?source=api-prod","affected":[{"type":"plugin","slug":"bulk-datetime-change","name":"Bulk Datetime Change","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":false,"patched_in":"1.12"}],"published":"2021-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:505edcf7-7015-453e-abd2-e2cd68a3a9f6","source":"wordfence","cve":"","title":"WP Super Cache <= 1.8 - Unauthenticated Cache Poisoning","severity":"medium","cvss":6.5,"cwe":"CWE-349","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/505edcf7-7015-453e-abd2-e2cd68a3a9f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:506006ce-7b1c-4f9d-93f3-abc87abea2bb","source":"wordfence","cve":"CVE-2026-8095","title":"Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506006ce-7b1c-4f9d-93f3-abc87abea2bb?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-27T11:08:06Z","updated":"2026-10-20T05:39:19Z"},{"id":"wordfence:5061e0be-1785-476a-9528-d6f95656bd61","source":"wordfence","cve":"CVE-2024-13519","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 1.9.80 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5061e0be-1785-476a-9528-d6f95656bd61?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"1.9.80","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-20T19:25:10Z"},{"id":"wordfence:50631f6c-de8b-408e-ab1f-ef74d3180e7f","source":"wordfence","cve":"CVE-2024-3611","title":"Toolbar Extras for Elementor & More \u2013 WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50631f6c-de8b-408e-ab1f-ef74d3180e7f?source=api-prod","affected":[{"type":"plugin","slug":"toolbar-extras","name":"Toolbar Extras for Elementor & More \u2013 WordPress Admin Bar Enhanced","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T16:45:13Z","updated":"2024-05-22T05:32:50Z"},{"id":"wordfence:5063c9e3-cc3e-4ea3-b588-f9273579ac0c","source":"wordfence","cve":"CVE-2024-38760","title":"Send Users Email <= 1.5.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5063c9e3-cc3e-4ea3-b588-f9273579ac0c?source=api-prod","affected":[{"type":"plugin","slug":"send-users-email","name":"Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-15T18:16:42Z"},{"id":"wordfence:5064873b-e70a-4fe6-8c5c-ced6025aaa5f","source":"wordfence","cve":"CVE-2025-11576","title":"AI Chatbot Free Models \u2013 Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection","severity":"medium","cvss":4.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5064873b-e70a-4fe6-8c5c-ced6025aaa5f?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-ai-free-models","name":"AI Chatbot Free Models \u2013 Customer Support, Live Chat, Virtual Assistant","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-24T12:29:58Z"},{"id":"wordfence:5064d52b-0f3a-41f1-9e22-9ca5f9d6fb3a","source":"wordfence","cve":"CVE-2025-69023","title":"Discussion Board <= 2.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5064d52b-0f3a-41f1-9e22-9ca5f9d6fb3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-27T20:41:28Z"},{"id":"wordfence:50659c21-4925-45ee-bf9d-b12116a5cf9b","source":"wordfence","cve":"CVE-2026-39778","title":"Ansar Import \u2013 One Click Starter Sites \u2013 for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50659c21-4925-45ee-bf9d-b12116a5cf9b?source=api-prod","affected":[{"type":"plugin","slug":"ansar-import","name":"Ansar Import \u2013 Starter Sites & Template Library","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-10-05T16:42:46Z","updated":"2026-11-03T22:47:22Z"},{"id":"wordfence:5069fbc4-b3c4-4c0b-892c-2c83f35dc2fe","source":"wordfence","cve":"CVE-2024-0796","title":"Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5069fbc4-b3c4-4c0b-892c-2c83f35dc2fe?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.1","to_inclusive":true,"patched_in":"1.0.6.2"}],"published":"2024-01-31T00:00:00Z","updated":"2024-07-29T21:36:20Z"},{"id":"wordfence:506a7351-07b9-4c0f-86c3-edfe04bac64c","source":"wordfence","cve":"CVE-2026-2282","title":"Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506a7351-07b9-4c0f-86c3-edfe04bac64c?source=api-prod","affected":[{"type":"plugin","slug":"slidorion","name":"Slidorion","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:53:42Z","updated":"2026-02-19T04:36:11Z"},{"id":"wordfence:506d1518-658f-4deb-9c30-d0bce5ef9df4","source":"wordfence","cve":"CVE-2019-8942","title":"WordPress Core < 5.0.1 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506d1518-658f-4deb-9c30-d0bce5ef9df4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2019-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:506da7ee-cf95-4fcb-90da-6363409917ab","source":"wordfence","cve":"CVE-2024-50428","title":"Multi Step Form <= 1.7.21 - Missing Authorization via fw_delete_files","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506da7ee-cf95-4fcb-90da-6363409917ab?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.21","to_inclusive":true,"patched_in":"1.7.22"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:35:36Z"},{"id":"wordfence:506e4f47-e292-4d19-a7bb-b87d752f4007","source":"wordfence","cve":"CVE-2022-27858","title":"Activity Log <= 2.8.3 - CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506e4f47-e292-4d19-a7bb-b87d752f4007?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:506f101c-ffec-415d-92dc-99cb7384af95","source":"wordfence","cve":"CVE-2024-12288","title":"Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/506f101c-ffec-415d-92dc-99cb7384af95?source=api-prod","affected":[{"type":"plugin","slug":"simple-add-pages-or-posts","name":"Simple add pages or posts","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:45:23Z","updated":"2025-01-07T04:22:00Z"},{"id":"wordfence:50721265-dbbf-4032-a8d6-9cf42a986c0d","source":"wordfence","cve":"CVE-2024-11779","title":"WIP WooCarousel Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50721265-dbbf-4032-a8d6-9cf42a986c0d?source=api-prod","affected":[{"type":"plugin","slug":"wip-woocarousel-lite","name":"WIP WooCarousel Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-12-04T20:52:52Z","updated":"2024-12-05T09:23:07Z"},{"id":"wordfence:50726c57-8d42-4143-9e75-d30513d8d0e2","source":"wordfence","cve":"CVE-2023-36695","title":"Sublanguage <= 2.9 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50726c57-8d42-4143-9e75-d30513d8d0e2?source=api-prod","affected":[{"type":"plugin","slug":"sublanguage","name":"Sublanguage","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.10"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:507464cf-43a3-49bd-b8d8-9bc8030670e0","source":"wordfence","cve":"CVE-2014-4572","title":"Votecount For Balatarin <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507464cf-43a3-49bd-b8d8-9bc8030670e0?source=api-prod","affected":[{"type":"plugin","slug":"votecount-for-balatarin","name":"Votecount For Balatarin","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:507513c4-e80c-4d9d-85ab-32a5e84cbafa","source":"wordfence","cve":"CVE-2025-31796","title":"ElementsCSS Addons for Elementor <= 1.0.8.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507513c4-e80c-4d9d-85ab-32a5e84cbafa?source=api-prod","affected":[{"type":"plugin","slug":"css-for-elementor","name":"ElementsCSS Addons for Elementor (Elementor Widgets Extender & Addons)","from":"*","from_inclusive":true,"to":"1.0.8.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T13:25:09Z"},{"id":"wordfence:50782dc3-1206-42ea-90c0-ab1b37b64e48","source":"wordfence","cve":"CVE-2024-56211","title":"Userpro <= 5.1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50782dc3-1206-42ea-90c0-ab1b37b64e48?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:12:23Z"},{"id":"wordfence:50798706-ad0d-431e-ac5f-57a0606c6f94","source":"wordfence","cve":"CVE-2024-8119","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50798706-ad0d-431e-ac5f-57a0606c6f94?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T06:49:04Z"},{"id":"wordfence:5079ea37-3b5f-47ab-8a85-80f5fb393964","source":"wordfence","cve":"CVE-2026-100512","title":"Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5079ea37-3b5f-47ab-8a85-80f5fb393964?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-09-30T13:10:58Z","updated":"2026-10-08T23:08:54Z"},{"id":"wordfence:507a4d4e-145c-47fb-a0b7-2344a749184e","source":"wordfence","cve":"CVE-2025-28974","title":"Free WP Mail SMTP <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507a4d4e-145c-47fb-a0b7-2344a749184e?source=api-prod","affected":[{"type":"plugin","slug":"free-wp-mail-smtp","name":"Free WP Mail SMTP (Official \u2013 2019)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:24:42Z"},{"id":"wordfence:507b03d5-336a-4371-abc9-45b5e04d097b","source":"wordfence","cve":"CVE-2026-27357","title":"Search Analytics for WP < 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507b03d5-336a-4371-abc9-45b5e04d097b?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:26:31Z"},{"id":"wordfence:507b2e65-987b-4d4a-8a99-5366048d925e","source":"wordfence","cve":"CVE-2024-4869","title":"WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507b2e65-987b-4d4a-8a99-5366048d925e?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-06-25T11:22:29Z","updated":"2024-06-25T23:35:08Z"},{"id":"wordfence:507bc365-b47d-4011-b554-ceab71a9d31d","source":"wordfence","cve":"CVE-2025-58850","title":"Showpass WordPress Extension <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507bc365-b47d-4011-b554-ceab71a9d31d?source=api-prod","affected":[{"type":"plugin","slug":"showpass","name":"Showpass WordPress Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-19T18:34:55Z"},{"id":"wordfence:507c2abd-47d3-4a28-a9b7-a1ad9b026e7d","source":"wordfence","cve":"CVE-2025-1313","title":"Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507c2abd-47d3-4a28-a9b7-a1ad9b026e7d?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-07-11T16:27:22Z","updated":"2025-07-12T05:30:12Z"},{"id":"wordfence:507d308e-7df7-4bcb-b63c-f438b482c36b","source":"wordfence","cve":"CVE-2021-34637","title":"Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507d308e-7df7-4bcb-b63c-f438b482c36b?source=api-prod","affected":[{"type":"plugin","slug":"post-index","name":"Post Index","from":"*","from_inclusive":true,"to":"0.7.5","to_inclusive":true,"patched_in":""}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:507e9a3a-6e69-4c16-abbb-fb3f3096e03a","source":"wordfence","cve":"CVE-2025-32114","title":"5sterrenspecialist <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507e9a3a-6e69-4c16-abbb-fb3f3096e03a?source=api-prod","affected":[{"type":"plugin","slug":"5-sterrenspecialist","name":"5sterrenspecialist","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-04-07T00:00:00Z","updated":"2025-08-15T14:15:48Z"},{"id":"wordfence:507f3071-3274-4d25-8ae2-53d909bd9daa","source":"wordfence","cve":"CVE-2026-42685","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507f3071-3274-4d25-8ae2-53d909bd9daa?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-05-23T00:00:00Z","updated":"2026-05-26T19:29:52Z"},{"id":"wordfence:507fe5f4-3ac3-4e48-835e-66bad8bffc88","source":"wordfence","cve":"","title":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection < 6.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/507fe5f4-3ac3-4e48-835e-66bad8bffc88?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.67","to_inclusive":false,"patched_in":"6.67"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5080c13a-19f9-4260-abba-1c579a6d305b","source":"wordfence","cve":"CVE-2024-43151","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5080c13a-19f9-4260-abba-1c579a6d305b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:54:54Z"},{"id":"wordfence:50812a8b-7d49-41fa-ba50-47d07a4b6caa","source":"wordfence","cve":"CVE-2024-24796","title":"Event Manager and Tickets Selling Plugin for WooCommerce \u2013 WpEvently <= 4.1.1 - Authenticated (Contributor+) PHP Object Injection in mep_event_meta_save","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50812a8b-7d49-41fa-ba50-47d07a4b6caa?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-09T14:07:59Z"},{"id":"wordfence:50814285-86c8-4b1f-bafe-275e7126f139","source":"wordfence","cve":"CVE-2025-49987","title":"CRM ERP Business Solution <= 1.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50814285-86c8-4b1f-bafe-275e7126f139?source=api-prod","affected":[{"type":"plugin","slug":"crm-erp-business-solution","name":"CRM ERP Business Solution | freelancers & SME | for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:50:05Z"},{"id":"wordfence:508225ab-beb7-40eb-a80b-de123650fcff","source":"wordfence","cve":"CVE-2014-9453","title":"Simple visitor stat <= 1.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/508225ab-beb7-40eb-a80b-de123650fcff?source=api-prod","affected":[{"type":"plugin","slug":"simple-visitor-stat","name":"Simple visitor stat","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5083509e-84e4-4bd3-9023-b458312b1886","source":"wordfence","cve":"","title":"Jetpack < 7.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5083509e-84e4-4bd3-9023-b458312b1886?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2019-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5084afcc-b6fc-4d89-9ad7-c4ea3e4dae82","source":"wordfence","cve":"CVE-2023-34018","title":"SoundCloud Shortcode <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5084afcc-b6fc-4d89-9ad7-c4ea3e4dae82?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-shortcode","name":"SoundCloud Shortcode","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-26T13:58:20Z"},{"id":"wordfence:508b6466-2786-4d6b-9ab2-772050af4803","source":"wordfence","cve":"CVE-2023-23489","title":"Easy Digital Downloads < 3.1.0.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/508b6466-2786-4d6b-9ab2-772050af4803?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.1.0.3","to_inclusive":true,"patched_in":"3.1.0.4"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:508e97a0-9757-426c-bf0f-cdce6b489ce7","source":"wordfence","cve":"CVE-2025-9353","title":"Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/508e97a0-9757-426c-bf0f-cdce6b489ce7?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.9","to_inclusive":true,"patched_in":"7.7.0"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-24T12:27:29Z"},{"id":"wordfence:508ff025-d1ab-4c8d-ac39-078023c4b5ce","source":"wordfence","cve":"CVE-2024-50523","title":"All Post Contact Form <= 1.6.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/508ff025-d1ab-4c8d-ac39-078023c4b5ce?source=api-prod","affected":[{"type":"plugin","slug":"allpost-contactform","name":"All Post Contact Form","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-10-30T00:00:00Z","updated":"2026-09-16T17:28:39Z"},{"id":"wordfence:509097ae-5b20-4e91-9d82-cc6e3b64e518","source":"wordfence","cve":"CVE-2014-8949","title":"iMember360 3.8.012 - 3.9.001 - Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509097ae-5b20-4e91-9d82-cc6e3b64e518?source=api-prod","affected":[{"type":"plugin","slug":"imember360","name":"iMember360is","from":"3.8.012","from_inclusive":true,"to":"3.9.001","to_inclusive":true,"patched_in":"3.9.002"}],"published":"2014-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5090f734-71f4-44e3-8733-430ab61aca08","source":"wordfence","cve":"CVE-2026-28023","title":"Nuts <= 1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5090f734-71f4-44e3-8733-430ab61aca08?source=api-prod","affected":[{"type":"theme","slug":"nuts","name":"Nuts","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:26:52Z"},{"id":"wordfence:50910e14-6c6e-4f22-9028-3c644a8f8723","source":"wordfence","cve":"CVE-2026-62009","title":"Filmax | Cinema & Movie News Magazine WordPress Theme <= 1.1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50910e14-6c6e-4f22-9028-3c644a8f8723?source=api-prod","affected":[{"type":"theme","slug":"filmax","name":"Filmax | Cinema & Movie News Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:21Z"},{"id":"wordfence:50912c68-1bc8-4792-b624-4edda17ae43f","source":"wordfence","cve":"","title":"Garee's Flickr Feed <= 0.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50912c68-1bc8-4792-b624-4edda17ae43f?source=api-prod","affected":[{"type":"plugin","slug":"garees-flickr-feed","name":"Garee's Flickr Feed","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50932c88-994d-4904-b075-e48d2cb5bc24","source":"wordfence","cve":"CVE-2022-45080","title":"Add Multiple Marker <= 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50932c88-994d-4904-b075-e48d2cb5bc24?source=api-prod","affected":[{"type":"plugin","slug":"add-multiple-marker","name":"Multi Location Marker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2022-11-11T00:00:00Z","updated":"2026-02-03T19:51:07Z"},{"id":"wordfence:5093d787-0357-4c28-9d27-8335b10fc499","source":"wordfence","cve":"CVE-2022-0657","title":"5 Stars Rating Funnel <= 1.2.53 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5093d787-0357-4c28-9d27-8335b10fc499?source=api-prod","affected":[{"type":"plugin","slug":"5-stars-rating-funnel","name":"Build 5 Star Reviews on Google Reviews, Yelp, Facebook\u2026 easily and risk-free | RRatingg","from":"*","from_inclusive":true,"to":"1.2.53","to_inclusive":true,"patched_in":"1.2.54"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50946bc7-8d31-4376-bdcc-de7aad700503","source":"wordfence","cve":"CVE-2025-10299","title":"WPBifr\u00f6st \u2013 Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50946bc7-8d31-4376-bdcc-de7aad700503?source=api-prod","affected":[{"type":"plugin","slug":"create-temporary-login","name":"Bifr\u00f6st \u2013 Instant Passwordless Temporary Login Links","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-10-14T19:59:32Z","updated":"2025-10-17T20:00:42Z"},{"id":"wordfence:50959c4e-b7b9-45a1-9323-a1289ec1424f","source":"wordfence","cve":"CVE-2024-43338","title":"Crowdsignal Dashboard \u2013 Polls, Surveys & more <= 3.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50959c4e-b7b9-45a1-9323-a1289ec1424f?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-09-24T00:00:00Z","updated":"2025-10-17T19:31:27Z"},{"id":"wordfence:50970977-79c7-4014-8f90-a1e6ff47b6f3","source":"wordfence","cve":"CVE-2025-69164","title":"Skyward <= 1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50970977-79c7-4014-8f90-a1e6ff47b6f3?source=api-prod","affected":[{"type":"theme","slug":"skyward","name":"Skyward","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:41:36Z"},{"id":"wordfence:5097da41-b5e9-4e07-a135-83a7d889fe9b","source":"wordfence","cve":"","title":"bbPress < 2.5.13 - Unauthenticated Blind SQL Injection","severity":"high","cvss":8.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5097da41-b5e9-4e07-a135-83a7d889fe9b?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.5.13","to_inclusive":false,"patched_in":"2.5.13"}],"published":"2017-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5098e74a-9a99-48b3-9f44-b780bfdeb24e","source":"wordfence","cve":"CVE-2023-52151","title":"Uncanny Automator <= 5.1.0.2 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-215","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5098e74a-9a99-48b3-9f44-b780bfdeb24e?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"5.1.0.2","to_inclusive":true,"patched_in":"5.1.0.3"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:509a24ef-160a-4e54-bd83-ac1704a32766","source":"wordfence","cve":"CVE-2025-22551","title":"Boot-Modal <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509a24ef-160a-4e54-bd83-ac1704a32766?source=api-prod","affected":[{"type":"plugin","slug":"boot-modal","name":"Boot-Modal","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.10"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:31:50Z"},{"id":"wordfence:509a40d2-a33a-49ba-b858-fa8805127a1b","source":"wordfence","cve":"CVE-2026-11912","title":"Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509a40d2-a33a-49ba-b858-fa8805127a1b?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2026-06-19T20:27:11Z","updated":"2026-06-20T08:29:52Z"},{"id":"wordfence:509c881d-22bc-473f-b57b-4ec3ddf6abaf","source":"wordfence","cve":"CVE-2009-0968","title":"fMoblog <= 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509c881d-22bc-473f-b57b-4ec3ddf6abaf?source=api-prod","affected":[{"type":"plugin","slug":"fmoblog","name":"fmoblog","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2009-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:509cccbd-3aa0-45f1-84a0-387d678ebf65","source":"wordfence","cve":"CVE-2023-6777","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.34","to_inclusive":true,"patched_in":"9.0.35"}],"published":"2024-03-18T00:00:00Z","updated":"2024-07-29T21:36:21Z"},{"id":"wordfence:509f29f5-d1a6-4bbb-b5f4-95ebfc2b306a","source":"wordfence","cve":"CVE-2025-26920","title":"Customify <= 0.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509f29f5-d1a6-4bbb-b5f4-95ebfc2b306a?source=api-prod","affected":[{"type":"theme","slug":"customify-theme","name":"customify-theme","from":"*","from_inclusive":true,"to":"0.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T13:06:32Z"},{"id":"wordfence:509f7ea5-6b69-492d-a4e6-77b4e1f4de4a","source":"wordfence","cve":"CVE-2025-48139","title":"StyleAI <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/509f7ea5-6b69-492d-a4e6-77b4e1f4de4a?source=api-prod","affected":[{"type":"plugin","slug":"relentlosoftware","name":"StyleAI","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-28T15:30:33Z"},{"id":"wordfence:50a451e5-f96c-477f-b0af-162522278247","source":"wordfence","cve":"CVE-2026-109699","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50a451e5-f96c-477f-b0af-162522278247?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:44:11Z"},{"id":"wordfence:50a89ad1-a3d0-49e3-8d2e-4cb81ac115ba","source":"wordfence","cve":"CVE-2023-6488","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50a89ad1-a3d0-49e3-8d2e-4cb81ac115ba?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2023-12-18T00:00:00Z","updated":"2024-07-29T21:36:21Z"},{"id":"wordfence:50aa4bff-60dd-469c-a8f0-be6dd2dfa91e","source":"wordfence","cve":"CVE-2026-10026","title":"CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50aa4bff-60dd-469c-a8f0-be6dd2dfa91e?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce-pro","name":"CTX Feed Pro","from":"*","from_inclusive":true,"to":"7.6.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-01T15:53:07Z","updated":"2026-10-02T04:27:11Z"},{"id":"wordfence:50ab312c-da30-4255-8aa3-ef05dc0d50a4","source":"wordfence","cve":"CVE-2026-115204","title":"AZEXO Store Locator <= 1.4 - Authenticated (Subscriber+) Arbitrary File Write","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ab312c-da30-4255-8aa3-ef05dc0d50a4?source=api-prod","affected":[{"type":"plugin","slug":"azexo-store-locator","name":"AZEXO Store Locator","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:41:53Z"},{"id":"wordfence:50ac32ed-f83c-4afc-aac2-a79c69497091","source":"wordfence","cve":"CVE-2022-3558","title":"Import and export users and customers <= 1.20.4 - Authenticated (Subscriber+) CSV Injection","severity":"high","cvss":8.0,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ac32ed-f83c-4afc-aac2-a79c69497091?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.20.4","to_inclusive":true,"patched_in":"1.20.5"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50ac89bd-43fc-4b21-8d29-b320d7aa587b","source":"wordfence","cve":"CVE-2026-61971","title":"User Profile Picture <= 2.6.3 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ac89bd-43fc-4b21-8d29-b320d7aa587b?source=api-prod","affected":[{"type":"plugin","slug":"metronet-profile-picture","name":"User Profile Picture","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:19:20Z"},{"id":"wordfence:50ad2e66-7708-44cd-945e-9833138520ac","source":"wordfence","cve":"CVE-2026-12427","title":"ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ad2e66-7708-44cd-945e-9833138520ac?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.3"}],"published":"2026-11-10T19:03:56Z","updated":"2026-11-11T07:26:41Z"},{"id":"wordfence:50adbe1d-9d79-4015-9e09-2166f97efc47","source":"wordfence","cve":"CVE-2024-13852","title":"Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50adbe1d-9d79-4015-9e09-2166f97efc47?source=api-prod","affected":[{"type":"plugin","slug":"option-editor","name":"Option Editor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:48:15Z","updated":"2025-02-18T04:21:15Z"},{"id":"wordfence:50affe4f-d27e-4ead-a14b-abf792d5f0f0","source":"wordfence","cve":"CVE-2024-34546","title":"Sticky Social Link <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50affe4f-d27e-4ead-a14b-abf792d5f0f0?source=api-prod","affected":[{"type":"plugin","slug":"sticky-social-link","name":"Sticky Social Link","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-07-18T14:26:12Z"},{"id":"wordfence:50b080aa-b9fe-48ac-922c-3f702fed1066","source":"wordfence","cve":"CVE-2022-41638","title":"Pop-Up Chop Chop <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b080aa-b9fe-48ac-922c-3f702fed1066?source=api-prod","affected":[{"type":"plugin","slug":"pop-up","name":"Pop-Up Chop Chop","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50b0eb50-fe25-487f-b5bc-13659be58ae4","source":"wordfence","cve":"CVE-2022-0700","title":"Simple Tracking <= 1.6 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b0eb50-fe25-487f-b5bc-13659be58ae4?source=api-prod","affected":[{"type":"plugin","slug":"simple-theme-options","name":"Simple Tracking","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50b19d49-15d6-4285-af3b-00ff96bcb349","source":"wordfence","cve":"CVE-2026-24362","title":"Ultimate Post Kit Addons for Elementor <= 4.0.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b19d49-15d6-4285-af3b-00ff96bcb349?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"4.0.21","to_inclusive":true,"patched_in":"4.0.22"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:46:41Z"},{"id":"wordfence:50b26952-bf59-4236-93b4-6b4928609c15","source":"wordfence","cve":"","title":"WPFunnels <= 2.7.15 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b26952-bf59-4236-93b4-6b4928609c15?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":false,"patched_in":"2.7.16"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50b4e000-3fd3-4c5e-abd7-543f933d3cf7","source":"wordfence","cve":"CVE-2025-46467","title":"RAphicon <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b4e000-3fd3-4c5e-abd7-543f933d3cf7?source=api-prod","affected":[{"type":"plugin","slug":"raphicon","name":"RAphicon","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:37:00Z"},{"id":"wordfence:50b7a6e0-3c25-4eda-acbd-43643a291bca","source":"wordfence","cve":"CVE-2026-116621","title":"Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b7a6e0-3c25-4eda-acbd-43643a291bca?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.14.1","to_inclusive":true,"patched_in":"2.14.2"}],"published":"2026-11-06T18:19:24Z","updated":"2026-11-07T06:39:36Z"},{"id":"wordfence:50b811e0-c1f4-4970-a340-8c1619456e29","source":"wordfence","cve":"CVE-2022-2215","title":"GiveWP <= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50b811e0-c1f4-4970-a340-8c1619456e29?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.21.2","to_inclusive":true,"patched_in":"2.21.3"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50bbcfcb-7001-42e7-926c-ec4bf4ea35f6","source":"wordfence","cve":"CVE-2024-24700","title":"WP Editor <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bbcfcb-7001-42e7-926c-ec4bf4ea35f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T19:43:18Z"},{"id":"wordfence:50bbda9c-e41e-48f5-9127-e938c9219a14","source":"wordfence","cve":"CVE-2026-74013","title":"eShipper Commerce <= 2.16.13 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bbda9c-e41e-48f5-9127-e938c9219a14?source=api-prod","affected":[{"type":"plugin","slug":"eshipper-commerce","name":"eShipper Commerce","from":"*","from_inclusive":true,"to":"2.16.13","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:04:49Z"},{"id":"wordfence:50bc789a-be96-4e65-9a1d-0314c0247613","source":"wordfence","cve":"CVE-2025-23918","title":"Smallerik File Browser <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bc789a-be96-4e65-9a1d-0314c0247613?source=api-prod","affected":[{"type":"plugin","slug":"smallerik-file-browser","name":"Smallerik File Browser","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:04:07Z"},{"id":"wordfence:50bcea94-b12a-4b31-b0c1-bba834ea9bd0","source":"wordfence","cve":"CVE-2022-2437","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bcea94-b12a-4b31-b0c1-bba834ea9bd0?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.8.5","to_inclusive":true,"patched_in":"2.9.8.6"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50bdca4a-23c0-46aa-8c08-5987a2e28604","source":"wordfence","cve":"CVE-2026-57692","title":"Private Content <= 9.9.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bdca4a-23c0-46aa-8c08-5987a2e28604?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"Private Content","from":"*","from_inclusive":true,"to":"9.9.2","to_inclusive":true,"patched_in":"9.10.0"}],"published":"2026-07-01T00:00:00Z","updated":"2026-08-28T18:35:12Z"},{"id":"wordfence:50bfbde2-2ccc-483a-95f5-a2ad284fda23","source":"wordfence","cve":"CVE-2025-6255","title":"Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50bfbde2-2ccc-483a-95f5-a2ad284fda23?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-ajax-product-filters-for-woocommerce","name":"Dynamic AJAX Product Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-08-27T17:44:32Z","updated":"2025-08-28T06:42:36Z"},{"id":"wordfence:50c2184f-c97b-4bf7-a1e4-52f9b4a42ed0","source":"wordfence","cve":"CVE-2026-104401","title":"Memberful \u2013 Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50c2184f-c97b-4bf7-a1e4-52f9b4a42ed0?source=api-prod","affected":[{"type":"plugin","slug":"memberful-wp","name":"Memberful \u2013 Membership Plugin","from":"*","from_inclusive":true,"to":"1.81.2","to_inclusive":true,"patched_in":"1.82.0"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:40:26Z"},{"id":"wordfence:50c33c8d-4488-4f9e-bc58-21cb8cd679e6","source":"wordfence","cve":"CVE-2018-18019","title":"Slideshow Gallery <= 1.6.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50c33c8d-4488-4f9e-bc58-21cb8cd679e6?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2018-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50c5154c-1573-4c2b-85a1-a89bdb22dc7d","source":"wordfence","cve":"CVE-2023-2351","title":"WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50c5154c-1573-4c2b-85a1-a89bdb22dc7d?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50c8a20a-66b4-445e-9167-e6fc0e6a1000","source":"wordfence","cve":"","title":"BuddyForms Moderation <= 1.4.16 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50c8a20a-66b4-445e-9167-e6fc0e6a1000?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms-review","name":"BuddyForms Moderation ( Former: Review Logic )","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.4.17"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50c8e549-f8ad-48ed-94db-abebe4bceeb4","source":"wordfence","cve":"CVE-2025-39517","title":"Basic Interactive World Map <= 2.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50c8e549-f8ad-48ed-94db-abebe4bceeb4?source=api-prod","affected":[{"type":"plugin","slug":"basic-interactive-world-map","name":"Basic Interactive World Map","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:33:59Z"},{"id":"wordfence:50ca7cf8-bb47-42ea-badc-8bfe0328cbb0","source":"wordfence","cve":"CVE-2022-38062","title":"Download Theme <= 1.0.9 - Cross-Site Request Forgery via dtwap_download()","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ca7cf8-bb47-42ea-badc-8bfe0328cbb0?source=api-prod","affected":[{"type":"plugin","slug":"download-theme","name":"Download Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50cb130d-2e9c-429c-a56c-4546e705981a","source":"wordfence","cve":"CVE-2015-5484","title":"Plotly < 1.0.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50cb130d-2e9c-429c-a56c-4546e705981a?source=api-prod","affected":[{"type":"plugin","slug":"wp-plotly","name":"Plotly","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50cc1a15-bb73-4c60-b610-e0c3bf1ef841","source":"wordfence","cve":"CVE-2023-23715","title":"JobBoardWP <= 1.2.2 - Missing Authorization to Job Posting Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50cc1a15-bb73-4c60-b610-e0c3bf1ef841?source=api-prod","affected":[{"type":"plugin","slug":"jobboardwp","name":"JobBoardWP \u2013 Job Board Listings and Submissions","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50ce2a61-9a56-4994-b270-3c79be832411","source":"wordfence","cve":"CVE-2025-67996","title":"Nestin < 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ce2a61-9a56-4994-b270-3c79be832411?source=api-prod","affected":[{"type":"theme","slug":"nestin","name":"Nestin","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-19T15:42:04Z"},{"id":"wordfence:50d190cb-f2c8-4cd9-844b-98b298a292a0","source":"wordfence","cve":"CVE-2025-39562","title":"Payment Form for PayPal Pro <= 1.1.72 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d190cb-f2c8-4cd9-844b-98b298a292a0?source=api-prod","affected":[{"type":"plugin","slug":"payment-form-for-paypal-pro","name":"Payment Form for PayPal Pro","from":"*","from_inclusive":true,"to":"1.1.72","to_inclusive":true,"patched_in":"1.1.73"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:36:37Z"},{"id":"wordfence:50d1b8f6-8b60-4c49-a41c-4d5e0df2e7e2","source":"wordfence","cve":"CVE-2025-64193","title":"XStore < 9.6.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d1b8f6-8b60-4c49-a41c-4d5e0df2e7e2?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6.1","to_inclusive":false,"patched_in":"9.6.1"}],"published":"2025-09-10T00:00:00Z","updated":"2025-12-20T19:02:47Z"},{"id":"wordfence:50d60e4f-7680-4ec0-9183-bdc8439679db","source":"wordfence","cve":"CVE-2024-13811","title":"Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d60e4f-7680-4ec0-9183-bdc8439679db?source=api-prod","affected":[{"type":"theme","slug":"lafka","name":"Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme","from":"*","from_inclusive":true,"to":"4.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:09:06Z","updated":"2025-03-05T09:21:46Z"},{"id":"wordfence:50d724a0-8fd3-415f-89f3-8e720802327c","source":"wordfence","cve":"CVE-2025-47614","title":"LessButtons Social Sharing and Statistics <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d724a0-8fd3-415f-89f3-8e720802327c?source=api-prod","affected":[{"type":"plugin","slug":"lessbuttons","name":"LessButtons Social Sharing and Statistics","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:35:53Z"},{"id":"wordfence:50d7edfe-3b87-428b-b774-f414a684c8e9","source":"wordfence","cve":"CVE-2025-12628","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.9.3 - 2-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d7edfe-3b87-428b-b774-f414a684c8e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-01T17:29:34Z"},{"id":"wordfence:50d8dc95-4a60-4a1a-bb9f-ba48b58d868e","source":"wordfence","cve":"CVE-2024-37122","title":"Accordions <= 2.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d8dc95-4a60-4a1a-bb9f-ba48b58d868e?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:51:19Z"},{"id":"wordfence:50d8f1e0-2022-4fe1-b384-ca762a032d3c","source":"wordfence","cve":"CVE-2026-1941","title":"WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50d8f1e0-2022-4fe1-b384-ca762a032d3c?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-aggregator","name":"WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-02-17T20:12:40Z","updated":"2026-02-18T08:26:05Z"},{"id":"wordfence:50e373bd-4408-4406-a411-3284fa71e7ef","source":"wordfence","cve":"CVE-2021-24514","title":"Visual Form Builder <= 3.0.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50e373bd-4408-4406-a411-3284fa71e7ef?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50e4e070-8f68-4bac-8011-ac9d3b99a24f","source":"wordfence","cve":"CVE-2024-5488","title":"SEOPress <= 7.8 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50e4e070-8f68-4bac-8011-ac9d3b99a24f?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":"7.9"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-23T20:42:09Z"},{"id":"wordfence:50e6cfc9-840d-4447-a505-49a1a3bb42d2","source":"wordfence","cve":"CVE-2026-32503","title":"Trendustry <= 1.1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50e6cfc9-840d-4447-a505-49a1a3bb42d2?source=api-prod","affected":[{"type":"theme","slug":"trendustry","name":"Trendustry - Industrial & Manufacturing WordPress","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:46:37Z"},{"id":"wordfence:50e85f2c-3e3a-40b0-af82-7278656533d3","source":"wordfence","cve":"CVE-2022-4785","title":"Video Sidebar Widgets <= 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50e85f2c-3e3a-40b0-af82-7278656533d3?source=api-prod","affected":[{"type":"plugin","slug":"video-sidebar-widgets","name":"Video Sidebar Widgets","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50e8811c-07b1-4325-92a4-dc1c91afbe9e","source":"wordfence","cve":"CVE-2024-13854","title":"Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50e8811c-07b1-4325-92a4-dc1c91afbe9e?source=api-prod","affected":[{"type":"plugin","slug":"education-addon","name":"Education Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:29:18Z","updated":"2025-02-19T07:32:09Z"},{"id":"wordfence:50ea2a0f-4ebe-4add-9f13-895790c92001","source":"wordfence","cve":"CVE-2025-3583","title":"Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ea2a0f-4ebe-4add-9f13-895790c92001?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.7.0","to_inclusive":true,"patched_in":"8.7.1"}],"published":"2025-04-14T00:00:00Z","updated":"2025-05-06T13:44:24Z"},{"id":"wordfence:50ebe03e-9425-41ef-801e-97e42670652f","source":"wordfence","cve":"CVE-2025-26556","title":"WP AntiDDOS <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50ebe03e-9425-41ef-801e-97e42670652f?source=api-prod","affected":[{"type":"plugin","slug":"wpantiddos","name":"WP AntiDDOS","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:39:52Z"},{"id":"wordfence:50eef578-9094-47ac-a451-04ebd9e6e2f8","source":"wordfence","cve":"CVE-2026-15662","title":"Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50eef578-9094-47ac-a451-04ebd9e6e2f8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.48","to_inclusive":true,"patched_in":"2.49"}],"published":"2026-07-31T19:36:02Z","updated":"2026-08-01T07:49:46Z"},{"id":"wordfence:50f0f0d9-973d-4903-84aa-a1a68a5c19e2","source":"wordfence","cve":"CVE-2025-24533","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider  <= 3.92.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f0f0d9-973d-4903-84aa-a1a68a5c19e2?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.92.0","to_inclusive":true,"patched_in":"3.92.1"}],"published":"2024-11-09T00:00:00Z","updated":"2025-02-19T16:20:20Z"},{"id":"wordfence:50f2cc05-b1f8-4f87-8ede-0df475d81a02","source":"wordfence","cve":"CVE-2025-49956","title":"Fade Slider <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f2cc05-b1f8-4f87-8ede-0df475d81a02?source=api-prod","affected":[{"type":"plugin","slug":"fade-slider","name":"Fade Slider","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-07-14T00:00:00Z","updated":"2026-03-06T18:51:53Z"},{"id":"wordfence:50f3e469-f788-45da-95e7-aa6da1e87fd1","source":"wordfence","cve":"CVE-2025-6831","title":"User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f3e469-f788-45da-95e7-aa6da1e87fd1?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-07-21T12:46:27Z","updated":"2025-07-22T01:44:28Z"},{"id":"wordfence:50f58944-1a12-4bac-9f90-8b0e1d109d11","source":"wordfence","cve":"CVE-2009-2334","title":"WordPress Core <= 2.8 - Sensitive Information Disclosure","severity":"medium","cvss":6.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f58944-1a12-4bac-9f90-8b0e1d109d11?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2009-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50f69182-66c0-4d3a-aabe-015b72937f3e","source":"wordfence","cve":"","title":"WP Social AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f69182-66c0-4d3a-aabe-015b72937f3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-fb-autoconnect","name":"WP Social AutoConnect","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":false,"patched_in":"4.6.2"}],"published":"2023-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50f6d0aa-059d-48d9-873b-6404f288f002","source":"wordfence","cve":"CVE-2023-5128","title":"TCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f6d0aa-059d-48d9-873b-6404f288f002?source=api-prod","affected":[{"type":"plugin","slug":"tcd-google-maps","name":"TCD Google Maps","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:50f88c71-e57b-4792-b579-0e33f2d637d0","source":"wordfence","cve":"CVE-2025-26910","title":"WPBookit <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50f88c71-e57b-4792-b579-0e33f2d637d0?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-03-09T00:00:00Z","updated":"2025-03-14T17:31:22Z"},{"id":"wordfence:5102d03b-368f-410e-9c0f-a90caa7d28ec","source":"wordfence","cve":"","title":"HTML5 Lyrics Karaoke Player <= 2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5102d03b-368f-410e-9c0f-a90caa7d28ec?source=api-prod","affected":[{"type":"plugin","slug":"html5-lyrics-karaoke-player","name":"HTML5 Lyrics Karaoke Player","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5106ce6b-70c6-437a-9576-ca537c213a74","source":"wordfence","cve":"CVE-2025-31811","title":"Planyo online reservation system <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5106ce6b-70c6-437a-9576-ca537c213a74?source=api-prod","affected":[{"type":"plugin","slug":"planyo-online-reservation-system","name":"Planyo online reservation system","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:07:37Z"},{"id":"wordfence:510b1390-b8e6-41b5-8691-3043fa3fb47d","source":"wordfence","cve":"CVE-2022-1435","title":"WPCargo Track & Trace <= 6.9.4 - Admin+ Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/510b1390-b8e6-41b5-8691-3043fa3fb47d?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"6.9.4","to_inclusive":true,"patched_in":"6.9.5"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:510bef96-583d-4c0c-a6d4-355666efc1da","source":"wordfence","cve":"CVE-2025-54004","title":"WCFM \u2013 Frontend Manager for WooCommerce <= 6.7.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/510bef96-583d-4c0c-a6d4-355666efc1da?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.24","to_inclusive":true,"patched_in":"6.7.25"}],"published":"2025-12-15T00:00:00Z","updated":"2026-02-26T15:08:59Z"},{"id":"wordfence:510c26b8-01d6-4d3c-91fd-15963152fdf1","source":"wordfence","cve":"CVE-2022-25607","title":"FV Flowplayer Video Player <= 7.5.15.727 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/510c26b8-01d6-4d3c-91fd-15963152fdf1?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.15.727","to_inclusive":true,"patched_in":"7.5.18.727"}],"published":"2022-03-18T16:21:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:510ef568-fe5e-427e-a5ab-76c65250ade3","source":"wordfence","cve":"CVE-2007-3240","title":"Vistered Little (Unspecified Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/510ef568-fe5e-427e-a5ab-76c65250ade3?source=api-prod","affected":[{"type":"theme","slug":"Vistered-Little","name":"Vistered Little","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2007-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51102802-a348-40d6-b1d4-3ff44e1b4e9e","source":"wordfence","cve":"CVE-2026-97316","title":"Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51102802-a348-40d6-b1d4-3ff44e1b4e9e?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-notifier","name":"Broken Link Notifier","from":"1.3.1","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.0.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:18:23Z"},{"id":"wordfence:51103e02-f487-4ee3-a090-6670d4688381","source":"wordfence","cve":"CVE-2026-105260","title":"Database Addon For WPForms ( wpforms entries ) \u2013 WPFormsDB < 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51103e02-f487-4ee3-a090-6670d4688381?source=api-prod","affected":[{"type":"plugin","slug":"database-for-wpforms","name":"Database Addon For WPForms ( wpforms entries ) \u2013 WPFormsDB","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:19:07Z"},{"id":"wordfence:51118777-bdac-4a6b-a154-5a74a988a2e0","source":"wordfence","cve":"CVE-2025-49857","title":"myCred <= 2.9.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51118777-bdac-4a6b-a154-5a74a988a2e0?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.4.2","to_inclusive":true,"patched_in":"2.9.4.3"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:50:32Z"},{"id":"wordfence:5113170a-5a53-4e53-84e6-56d9ba0740ed","source":"wordfence","cve":"CVE-2024-2249","title":"LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5113170a-5a53-4e53-84e6-56d9ba0740ed?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.7.4","to_inclusive":true,"patched_in":"1.3.7.5"}],"published":"2024-03-14T00:00:00Z","updated":"2024-03-14T21:33:41Z"},{"id":"wordfence:5113b58b-7d2e-40cd-8669-a5597321106f","source":"wordfence","cve":"CVE-2021-36864","title":"Quiz And Survey Master <= 7.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5113b58b-7d2e-40cd-8669-a5597321106f?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51156188-83f2-48ef-89cb-0caa488c6366","source":"wordfence","cve":"CVE-2024-3062","title":"Save as PDF by Pdfcrowd <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51156188-83f2-48ef-89cb-0caa488c6366?source=api-prod","affected":[{"type":"plugin","slug":"save-as-image-by-pdfcrowd","name":"Save as Image Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-04-02T00:00:00Z","updated":"2025-05-29T22:04:51Z"},{"id":"wordfence:51178e18-ae8b-4a7f-974d-23346a8dbc52","source":"wordfence","cve":"CVE-2024-45429","title":"Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51178e18-ae8b-4a7f-974d-23346a8dbc52?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2024-09-04T00:00:00Z","updated":"2025-05-08T20:42:13Z"},{"id":"wordfence:5118ed50-d7be-4606-af9d-18b63359956c","source":"wordfence","cve":"CVE-2021-24506","title":"Slider Hero with Animation, Video Background & Intro Maker <= 8.2.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5118ed50-d7be-4606-af9d-18b63359956c?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"8.2.7","to_inclusive":false,"patched_in":"8.2.7"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:511957c0-e4c3-4a50-b604-3b604d52d32f","source":"wordfence","cve":"CVE-2024-24801","title":"OWL Carousel <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/511957c0-e4c3-4a50-b604-3b604d52d32f?source=api-prod","affected":[{"type":"plugin","slug":"lgx-owl-carousel","name":"OWL Carousel \u2013 WordPress Owl Carousel Slider","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T20:49:13Z"},{"id":"wordfence:511c66d2-29df-4675-8969-4ccd5c9caba8","source":"wordfence","cve":"CVE-2026-82884","title":"All in One SEO <= 5.0.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/511c66d2-29df-4675-8969-4ccd5c9caba8?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"5.0.0.0","to_inclusive":true,"patched_in":"5.0.0.1"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-10T19:35:05Z"},{"id":"wordfence:511ce6f6-aea3-4c37-8312-d6e5ff2fdf6f","source":"wordfence","cve":"CVE-2024-10909","title":"Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/511ce6f6-aea3-4c37-8312-d6e5ff2fdf6f?source=api-prod","affected":[{"type":"plugin","slug":"pojo-forms","name":"Pojo Forms","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-12-05T20:38:35Z","updated":"2024-12-06T09:22:59Z"},{"id":"wordfence:511f64df-4389-4ad7-b2a4-12dc57714631","source":"wordfence","cve":"CVE-2024-32098","title":"Advanced Page Visit Counter <= 8.0.6 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/511f64df-4389-4ad7-b2a4-12dc57714631?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-18T14:46:20Z"},{"id":"wordfence:51212d87-8723-4ba7-8fa4-78912a56385f","source":"wordfence","cve":"CVE-2022-3991","title":"Photospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51212d87-8723-4ba7-8fa4-78912a56385f?source=api-prod","affected":[{"type":"plugin","slug":"photospace","name":"Photospace Gallery","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51214710-3fd4-426c-95fa-f29735822c54","source":"wordfence","cve":"CVE-2025-22548","title":"ldap_login_password_and_role_manager <= 1.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51214710-3fd4-426c-95fa-f29735822c54?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-password-and-role-manager","name":"Plugin Name: ldap_login_password_and_role_manager","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:21:15Z"},{"id":"wordfence:51214cd0-23a6-48ba-a3d8-4d9a0a9e52df","source":"wordfence","cve":"CVE-2025-5587","title":"Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51214cd0-23a6-48ba-a3d8-4d9a0a9e52df?source=api-prod","affected":[{"type":"theme","slug":"appzend","name":"Appzend","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-07-28T22:43:42Z","updated":"2025-07-29T11:19:02Z"},{"id":"wordfence:5122800d-f274-4129-84d4-02380269502c","source":"wordfence","cve":"CVE-2024-3887","title":"Royal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5122800d-f274-4129-84d4-02380269502c?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.974","to_inclusive":true,"patched_in":"1.3.975"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T08:32:48Z"},{"id":"wordfence:5123c672-e769-4d44-9912-e159d3e186c1","source":"wordfence","cve":"CVE-2025-13625","title":"WP-SOS-Donate Donation Sidebar Plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5123c672-e769-4d44-9912-e159d3e186c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-sos-donate","name":"WP-SOS-Donate Donation Sidebar Plugin","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:29:05Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:5124be64-6679-4dc5-8117-55c73ae91489","source":"wordfence","cve":"","title":"EventPrime \u2013 Modern Events Calendar, Bookings and Tickets <= 3.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5124be64-6679-4dc5-8117-55c73ae91489?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51262d25-f7cf-4069-84fb-f283a3f07410","source":"wordfence","cve":"CVE-2026-9830","title":"BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51262d25-f7cf-4069-84fb-f283a3f07410?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking-pro","name":"BookingPress Appointment Booking Pro","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T12:58:14Z"},{"id":"wordfence:51296ab5-da96-4461-89f7-9e93f8032b03","source":"wordfence","cve":"CVE-2025-54054","title":"12 Step Meeting List <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51296ab5-da96-4461-89f7-9e93f8032b03?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.18.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:45:15Z"},{"id":"wordfence:512c9a2f-b023-4e28-8dd8-35795e68a8b3","source":"wordfence","cve":"CVE-2026-1266","title":"Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/512c9a2f-b023-4e28-8dd8-35795e68a8b3?source=api-prod","affected":[{"type":"plugin","slug":"postalicious","name":"Postalicious","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T20:03:54Z","updated":"2026-01-24T08:26:34Z"},{"id":"wordfence:512e042e-c280-4966-b41c-ce589ca035af","source":"wordfence","cve":"CVE-2026-1368","title":"Video Conferencing with Zoom < 4.6.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/512e042e-c280-4966-b41c-ce589ca035af?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":false,"patched_in":"4.6.6"}],"published":"2026-02-19T00:00:00Z","updated":"2026-02-24T19:20:31Z"},{"id":"wordfence:512f68c0-3041-44b0-86de-b3e640cf5055","source":"wordfence","cve":"CVE-2026-52706","title":"JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/512f68c0-3041-44b0-86de-b3e640cf5055?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.8.10.1"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-15T19:33:19Z"},{"id":"wordfence:513124f6-ea14-46ca-94c5-f9fa15b19d8c","source":"wordfence","cve":"CVE-2023-49189","title":"Social Share Buttons & Analytics Plugin \u2013 GetSocial.io <= 4.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513124f6-ea14-46ca-94c5-f9fa15b19d8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-share-buttons-analytics-by-getsocial","name":"Social Share Buttons & Analytics Plugin \u2013 GetSocial.io","from":"*","from_inclusive":true,"to":"4.3.12","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:513274bc-3016-4adb-be78-b13c5fae9c03","source":"wordfence","cve":"CVE-2025-7780","title":"AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513274bc-3016-4adb-be78-b13c5fae9c03?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-07-23T20:32:50Z","updated":"2025-08-20T20:12:56Z"},{"id":"wordfence:51336329-9c4d-45f3-bd16-1b1ef2e68513","source":"wordfence","cve":"CVE-2024-51881","title":"Be Shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51336329-9c4d-45f3-bd16-1b1ef2e68513?source=api-prod","affected":[{"type":"plugin","slug":"be-shortcodes","name":"Be Shortcodes","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:43:43Z"},{"id":"wordfence:51350be0-8c20-4d53-9dc8-be8a13f319cb","source":"wordfence","cve":"CVE-2024-52461","title":"Infinite Slider <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51350be0-8c20-4d53-9dc8-be8a13f319cb?source=api-prod","affected":[{"type":"plugin","slug":"infinite-slider","name":"Infinite Slider","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:15:46Z"},{"id":"wordfence:5137244c-584f-4b48-869a-b6669c84eaac","source":"wordfence","cve":"CVE-2015-9233","title":"CP Contact Form with PayPal < 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5137244c-584f-4b48-869a-b6669c84eaac?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51381ef9-7fac-4a1a-8c39-6a32f87ea5d5","source":"wordfence","cve":"CVE-2025-64360","title":"Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51381ef9-7fac-4a1a-8c39-6a32f87ea5d5?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-04T14:41:44Z"},{"id":"wordfence:51384a40-d239-44a4-b7c7-300f29b83b57","source":"wordfence","cve":"CVE-2025-30922","title":"Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51384a40-d239-44a4-b7c7-300f29b83b57?source=api-prod","affected":[{"type":"plugin","slug":"simplebooklet","name":"Simplebooklet PDF Viewer and Embedder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:18:27Z"},{"id":"wordfence:5138ed4c-3e9c-45da-917e-e8d8396a62f1","source":"wordfence","cve":"CVE-2024-12239","title":"PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5138ed4c-3e9c-45da-917e-e8d8396a62f1?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.0.5","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-12-16T11:57:49Z","updated":"2024-12-17T01:45:16Z"},{"id":"wordfence:513ae331-1461-44ad-928d-64daa6001b6f","source":"wordfence","cve":"CVE-2026-115252","title":"Confection 0.4.0 - 0.4.7 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513ae331-1461-44ad-928d-64daa6001b6f?source=api-prod","affected":[{"type":"plugin","slug":"confection","name":"Confection WordPress Cable","from":"0.4.0","from_inclusive":true,"to":"0.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:18:08Z"},{"id":"wordfence:513f116b-84d3-4848-b608-f2a2ee57a9a2","source":"wordfence","cve":"CVE-2025-9077","title":"Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=api-prod","affected":[{"type":"plugin","slug":"ut-elementor-addons-lite","name":"Ultra Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-10-02T22:15:40Z","updated":"2025-11-12T18:33:35Z"},{"id":"wordfence:513f407d-e90f-4fd1-82dd-c28bab9f76d0","source":"wordfence","cve":"CVE-2026-11777","title":"Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513f407d-e90f-4fd1-82dd-c28bab9f76d0?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.43","to_inclusive":true,"patched_in":"1.15.44"}],"published":"2026-06-17T16:12:22Z","updated":"2026-06-18T04:31:09Z"},{"id":"wordfence:513f4a39-afba-4819-abf2-6ed168d11dfe","source":"wordfence","cve":"CVE-2021-20734","title":"Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/513f4a39-afba-4819-abf2-6ed168d11dfe?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2021-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:514184b0-aa54-41d1-9aa0-86d120ae79c7","source":"wordfence","cve":"CVE-2022-0599","title":"Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/514184b0-aa54-41d1-9aa0-86d120ae79c7?source=api-prod","affected":[{"type":"plugin","slug":"mapping-multiple-urls-redirect-same-page","name":"Mapping multiple URLs redirect same page","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51421320-858a-4d7e-81bb-06fd601ded9e","source":"wordfence","cve":"CVE-2025-22646","title":"aThemes Addons for Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51421320-858a-4d7e-81bb-06fd601ded9e?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:14:38Z"},{"id":"wordfence:51424768-27c7-40b2-8d1c-838c419add8a","source":"wordfence","cve":"CVE-2014-8621","title":"Store Locator 2.3 - 3.11 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51424768-27c7-40b2-8d1c-838c419add8a?source=api-prod","affected":[{"type":"plugin","slug":"store-locator","name":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales","from":"*","from_inclusive":true,"to":"3.12","to_inclusive":false,"patched_in":"3.12"}],"published":"2014-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:514295e7-bde6-46e7-952b-68ff74744bcb","source":"wordfence","cve":"CVE-2026-95592","title":"Team \u2013 Team Members Showcase Plugin <= 6.0.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/514295e7-bde6-46e7-952b-68ff74744bcb?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2026-09-23T16:59:00Z","updated":"2026-09-29T20:09:06Z"},{"id":"wordfence:5143a2d2-504a-46b8-b82b-19beba4da64d","source":"wordfence","cve":"","title":"Ultimate Member <= 2.0.21 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5143a2d2-504a-46b8-b82b-19beba4da64d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":false,"patched_in":"2.0.22"}],"published":"2018-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5145b6bf-a726-4ef8-964f-63504bf7107e","source":"wordfence","cve":"CVE-2026-12349","title":"Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5145b6bf-a726-4ef8-964f-63504bf7107e?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-kingcomposer","name":"Premium Addons for KingComposer","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T16:17:38Z","updated":"2026-06-30T04:30:18Z"},{"id":"wordfence:51467cef-9624-4dd9-a368-d3b5fac7bb3d","source":"wordfence","cve":"CVE-2026-5767","title":"SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51467cef-9624-4dd9-a368-d3b5fac7bb3d?source=api-prod","affected":[{"type":"plugin","slug":"slideshowpro-shortcode","name":"SlideShowPro SC","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:02:18Z","updated":"2026-04-22T07:45:35Z"},{"id":"wordfence:514a393e-840e-4afb-90fc-a66927624a00","source":"wordfence","cve":"CVE-2025-22742","title":"WP ViewSTL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/514a393e-840e-4afb-90fc-a66927624a00?source=api-prod","affected":[{"type":"plugin","slug":"wp-viewstl","name":"WP ViewSTL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:46:54Z"},{"id":"wordfence:514aa001-24c8-4624-8e25-f17b8454354c","source":"wordfence","cve":"CVE-2023-47657","title":"Direct Checkout \u2013 Quick View \u2013 Buy Now For WooCommerce <= 1.5.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Custom CSS Code","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/514aa001-24c8-4624-8e25-f17b8454354c?source=api-prod","affected":[{"type":"plugin","slug":"quick-view-and-buy-now-for-woocommerce","name":"Direct Checkout \u2013 Quick View \u2013 Buy Now For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5151f429-b1f3-43d4-94cf-3ff382b80190","source":"wordfence","cve":"CVE-2024-5542","title":"Master Addons \u2013 Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5151f429-b1f3-43d4-94cf-3ff382b80190?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.1","to_inclusive":true,"patched_in":"2.0.6.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T12:33:43Z"},{"id":"wordfence:515339da-c4dc-4bda-99b7-49f326ef2ab0","source":"wordfence","cve":"CVE-2026-18934","title":"RSS Aggregator by Feedzy <= 5.2.5 - Missing Authorization to Authenticated (Author+) Cross-User Import Job Manipulation and Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515339da-c4dc-4bda-99b7-49f326ef2ab0?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:49:30Z"},{"id":"wordfence:515502b5-c344-4855-aff1-57833233c5d2","source":"wordfence","cve":"CVE-2023-5439","title":"Wp photo text slider 50 <= 8.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515502b5-c344-4855-aff1-57833233c5d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-text-slider-50","name":"Wp photo text slider 50","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":"8.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51550d42-2c75-4cb1-9bf9-da27ebf83ac0","source":"wordfence","cve":"CVE-2024-52464","title":"amr shortcodes <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51550d42-2c75-4cb1-9bf9-da27ebf83ac0?source=api-prod","affected":[{"type":"plugin","slug":"amr-shortcodes","name":"amr shortcodes","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:57:34Z"},{"id":"wordfence:515557bf-da71-4076-89bb-ce970ea7befa","source":"wordfence","cve":"CVE-2025-7651","title":"Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515557bf-da71-4076-89bb-ce970ea7befa?source=api-prod","affected":[{"type":"plugin","slug":"earnware-connect","name":"Earnware Connect","from":"*","from_inclusive":true,"to":"1.0.74","to_inclusive":true,"patched_in":"1.0.75"}],"published":"2025-08-15T14:47:56Z","updated":"2025-10-17T19:46:04Z"},{"id":"wordfence:51560b6e-e926-4c3e-aa43-d604e7239a91","source":"wordfence","cve":"CVE-2026-14183","title":"Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51560b6e-e926-4c3e-aa43-d604e7239a91?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-30T17:11:45Z"},{"id":"wordfence:51564b26-0d7c-4499-9f5a-84f76c5a5e8a","source":"wordfence","cve":"CVE-2026-3651","title":"Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51564b26-0d7c-4499-9f5a-84f76c5a5e8a?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:32Z","updated":"2026-03-21T03:26:47Z"},{"id":"wordfence:515a5dfd-c064-47d2-b347-e4f417bb260a","source":"wordfence","cve":"CVE-2025-32310","title":"QuickCal <= 1.0.15 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515a5dfd-c064-47d2-b347-e4f417bb260a?source=api-prod","affected":[{"type":"plugin","slug":"quickcal","name":"QuickCal","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:08:25Z"},{"id":"wordfence:515a6a42-f353-47ae-9e74-4f9b2000bcb8","source":"wordfence","cve":"CVE-2018-1000511","title":"WP ULike < 3.2 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515a6a42-f353-47ae-9e74-4f9b2000bcb8?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"}],"published":"2018-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:515c5d34-19d8-4518-a127-35eb334be82c","source":"wordfence","cve":"CVE-2026-87828","title":"Seraphinite Accelerator <= 2.29.23 - Authenticated (Subscriber+) Full Admin Area Denial of Service","severity":"medium","cvss":4.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515c5d34-19d8-4518-a127-35eb334be82c?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.29.23","to_inclusive":true,"patched_in":"2.29.24"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T20:11:27Z"},{"id":"wordfence:515d6e6c-e20d-4fc4-9c56-80020196f2f0","source":"wordfence","cve":"CVE-2011-4342","title":"BackWPup <= 1.7.1 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515d6e6c-e20d-4fc4-9c56-80020196f2f0?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2011-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:515e62ba-c3b8-42d0-95e3-be347b8851a5","source":"wordfence","cve":"CVE-2023-47647","title":"BadgeOS <= 3.7.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/515e62ba-c3b8-42d0-95e3-be347b8851a5?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:516261b5-4356-40e1-9418-3243086bc1b4","source":"wordfence","cve":"CVE-2020-5530","title":"Easy Property Listings < 3.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/516261b5-4356-40e1-9418-3243086bc1b4?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2020-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51634a0c-f979-403b-80b0-8e3a65e7ad35","source":"wordfence","cve":"","title":"FAQs Manager <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51634a0c-f979-403b-80b0-8e3a65e7ad35?source=api-prod","affected":[{"type":"plugin","slug":"faqs-manager","name":"FAQs Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5165a4db-9668-485c-83ec-92743ae1725b","source":"wordfence","cve":"CVE-2025-39425","title":"Style Manager < 2.3.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5165a4db-9668-485c-83ec-92743ae1725b?source=api-prod","affected":[{"type":"plugin","slug":"style-manager","name":"Style Manager","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2025-04-17T00:00:00Z","updated":"2026-07-08T20:43:24Z"},{"id":"wordfence:516d40c7-fc27-45df-bb08-fbafcd1c81a4","source":"wordfence","cve":"CVE-2025-22557","title":"News Publisher Autopilot <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/516d40c7-fc27-45df-bb08-fbafcd1c81a4?source=api-prod","affected":[{"type":"plugin","slug":"wpm-news-api","name":"News Publisher Autopilot","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:28:29Z"},{"id":"wordfence:516f8076-dc35-424e-b11b-bd29b9d523d7","source":"wordfence","cve":"CVE-2026-109702","title":"Social Share Buttons <= 1.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/516f8076-dc35-424e-b11b-bd29b9d523d7?source=api-prod","affected":[{"type":"plugin","slug":"share-button","name":"Social Share Buttons","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T12:36:57Z","updated":"2026-10-24T09:59:51Z"},{"id":"wordfence:5172cf1e-9ebd-40cd-846c-82d80211ca32","source":"wordfence","cve":"CVE-2024-51759","title":"SVT Simple <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5172cf1e-9ebd-40cd-846c-82d80211ca32?source=api-prod","affected":[{"type":"plugin","slug":"svt-simple","name":"SVT Simple","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:55:54Z"},{"id":"wordfence:517531ec-4160-4287-8499-6266e08223dc","source":"wordfence","cve":"CVE-2025-52715","title":"Classified Listing <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/517531ec-4160-4287-8499-6266e08223dc?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T18:08:27Z"},{"id":"wordfence:5175573f-1ba8-4d15-8419-7c65f1db4490","source":"wordfence","cve":"CVE-2025-64225","title":"Stockie Extra <= 1.2.11 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5175573f-1ba8-4d15-8419-7c65f1db4490?source=api-prod","affected":[{"type":"plugin","slug":"stockie-extra","name":"Stockie Extra","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-20T19:09:19Z"},{"id":"wordfence:517653e5-fdad-4360-82a5-32b16a6cd631","source":"wordfence","cve":"","title":"OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) <= 3.0.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/517653e5-fdad-4360-82a5-32b16a6cd631?source=api-prod","affected":[{"type":"plugin","slug":"oauth-client-for-user-authentication","name":"OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO )","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5176d862-577b-4a37-9da3-9ba106f77d6e","source":"wordfence","cve":"","title":"Email Users <= 4.7.5 - Reflected Cross Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5176d862-577b-4a37-9da3-9ba106f77d6e?source=api-prod","affected":[{"type":"plugin","slug":"email-users","name":"Email Users","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":false,"patched_in":"4.7.6"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5177bde6-4922-48ee-9155-577c392809a0","source":"wordfence","cve":"CVE-2024-13900","title":"Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments","severity":"medium","cvss":4.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5177bde6-4922-48ee-9155-577c392809a0?source=api-prod","affected":[{"type":"plugin","slug":"header-footer","name":"Head, Footer and Post Injections","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-02-20T22:46:06Z","updated":"2025-02-21T11:09:34Z"},{"id":"wordfence:517880ba-9634-400c-8b75-2dd5d0aba5c0","source":"wordfence","cve":"CVE-2026-66585","title":"WP Cafe Pro < 3.0.15 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/517880ba-9634-400c-8b75-2dd5d0aba5c0?source=api-prod","affected":[{"type":"plugin","slug":"wpcafe-pro","name":"WP Cafe Pro","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":false,"patched_in":"3.0.15"}],"published":"2026-08-20T12:48:24Z","updated":"2026-09-10T19:12:18Z"},{"id":"wordfence:5178f7ee-d7e3-4cd1-8cc2-121d217e66fa","source":"wordfence","cve":"CVE-2014-9174","title":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.1.2 - Cross-Site Scripting","severity":"low","cvss":3.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5178f7ee-d7e3-4cd1-8cc2-121d217e66fa?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:517d344d-546b-4418-8955-e468b7a62f6e","source":"wordfence","cve":"CVE-2026-42714","title":"Pix por Piggly (para Woocommerce) <= 2.1.2 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/517d344d-546b-4418-8955-e468b7a62f6e?source=api-prod","affected":[{"type":"plugin","slug":"pix-por-piggly","name":"Pix por Piggly (para Woocommerce)","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T10:54:00Z","updated":"2026-10-08T23:36:26Z"},{"id":"wordfence:517f0c5e-7a73-475c-8676-9cd031ca6d9a","source":"wordfence","cve":"CVE-2025-63078","title":"Restaurant Menu and Food Ordering <= 2.4.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/517f0c5e-7a73-475c-8676-9cd031ca6d9a?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":"2.4.12"}],"published":"2026-06-26T00:00:00Z","updated":"2026-09-09T16:06:51Z"},{"id":"wordfence:51810981-5d2b-471b-b602-35809e281a0b","source":"wordfence","cve":"CVE-2025-10188","title":"The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51810981-5d2b-471b-b602-35809e281a0b?source=api-prod","affected":[{"type":"plugin","slug":"hackrepair-plugin-archiver","name":"The Hack Repair Guy\u2019s Plugin Archiver","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T04:01:16Z"},{"id":"wordfence:518174ec-44f5-4b5c-a326-0fb2aa661c86","source":"wordfence","cve":"CVE-2024-31257","title":"Formsite | Embed online forms to collect orders, registrations, leads, and surveys <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518174ec-44f5-4b5c-a326-0fb2aa661c86?source=api-prod","affected":[{"type":"plugin","slug":"formsite","name":"Formsite | Embed online forms to collect orders, registrations, leads, and surveys","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:20:23Z"},{"id":"wordfence:5182843b-03d0-4b0b-ba97-8e9602916c5f","source":"wordfence","cve":"CVE-2021-25075","title":"Duplicate Page or Post <= 1.5.0 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5182843b-03d0-4b0b-ba97-8e9602916c5f?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-page-or-post","name":"Duplicate Page or Post","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5182ac01-1d60-4bf6-ba70-cb364bfde519","source":"wordfence","cve":"CVE-2026-92410","title":"Sign-up Sheets <= 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5182ac01-1d60-4bf6-ba70-cb364bfde519?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:12:05Z"},{"id":"wordfence:5183d676-eb91-4c03-8d12-c15c68839f02","source":"wordfence","cve":"CVE-2022-0836","title":"SEMA API <= 3.64 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5183d676-eb91-4c03-8d12-c15c68839f02?source=api-prod","affected":[{"type":"plugin","slug":"sema-api","name":"SEMA API","from":"*","from_inclusive":true,"to":"3.64","to_inclusive":true,"patched_in":"4.02"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5184740a-c747-4217-bb13-6568465672df","source":"wordfence","cve":"CVE-2024-37462","title":"Ultimate Bootstrap Elements for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5184740a-c747-4217-bb13-6568465672df?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T19:03:38Z"},{"id":"wordfence:51867e4f-75be-4451-a585-87398881adf5","source":"wordfence","cve":"CVE-2025-10133","title":"URLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51867e4f-75be-4451-a585-87398881adf5?source=api-prod","affected":[{"type":"plugin","slug":"urlyar","name":"URLYar URL Shortner","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:47:40Z","updated":"2025-10-15T08:25:55Z"},{"id":"wordfence:518771c1-b52b-47b7-99f1-4f40115ba4cf","source":"wordfence","cve":"","title":"Pie Register < 2.0.15 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518771c1-b52b-47b7-99f1-4f40115ba4cf?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":false,"patched_in":"2.0.15"}],"published":"2015-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51880262-78ad-4791-8e3d-f6718de9f2a2","source":"wordfence","cve":"CVE-2013-5714","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.25.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51880262-78ad-4791-8e3d-f6718de9f2a2?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.25.3","to_inclusive":true,"patched_in":"4.27"}],"published":"2013-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51887d22-2cfa-46b8-822c-9e6e183de4ad","source":"wordfence","cve":"CVE-2021-24205","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51887d22-2cfa-46b8-822c-9e6e183de4ad?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51889961-e4da-44f3-b422-2c8337278b33","source":"wordfence","cve":"CVE-2024-51814","title":"\u6d3b\u52a8\u94fe\u63a5\u63a8\u5e7f\u63d2\u4ef6 <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51889961-e4da-44f3-b422-2c8337278b33?source=api-prod","affected":[{"type":"plugin","slug":"yr-activity-link","name":"\u6d3b\u52a8\u94fe\u63a5\u63a8\u5e7f\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-12T15:46:40Z"},{"id":"wordfence:5188dc72-a00d-4a07-b178-3f3ef26d7fc1","source":"wordfence","cve":"CVE-2023-52127","title":"WPC Product Bundles for WooCommerce <= 7.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5188dc72-a00d-4a07-b178-3f3ef26d7fc1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-bundle","name":"WPC Product Bundles for WooCommerce","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5189c1c0-2d4c-47f5-b8d9-3192a670e586","source":"wordfence","cve":"CVE-2025-12010","title":"Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5189c1c0-2d4c-47f5-b8d9-3192a670e586?source=api-prod","affected":[{"type":"plugin","slug":"authors-list","name":"Authors List","from":"*","from_inclusive":true,"to":"2.0.6.1","to_inclusive":true,"patched_in":"2.0.6.2"}],"published":"2025-11-10T15:24:36Z","updated":"2025-11-25T19:14:18Z"},{"id":"wordfence:518abad2-d3cc-4d15-83d2-8fd99d30500c","source":"wordfence","cve":"CVE-2025-12497","title":"Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=api-prod","affected":[{"type":"plugin","slug":"auxin-portfolio","name":"Premium Portfolio Features for Phlox theme","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-11-04T21:46:49Z","updated":"2025-11-05T11:24:41Z"},{"id":"wordfence:518b005d-5a5d-4fec-bb3a-1657af354ec9","source":"wordfence","cve":"CVE-2023-25791","title":"Fontiran <= 2.1 - Missing Authorization via fi_add_rule and fi_delete_webfont_php","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518b005d-5a5d-4fec-bb3a-1657af354ec9?source=api-prod","affected":[{"type":"plugin","slug":"fontiran","name":"Fontiran","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:518be2c6-36ca-4015-8b7f-451a806c7b1d","source":"wordfence","cve":"CVE-2022-4237","title":"Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization","severity":"medium","cvss":6.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518be2c6-36ca-4015-8b7f-451a806c7b1d?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:518f23c3-f3e3-4cff-bd30-a8211f74c3ce","source":"wordfence","cve":"CVE-2022-4489","title":"HUSKY \u2013 Products Filter for WooCommerce Professional <= 1.3.1 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/518f23c3-f3e3-4cff-bd30-a8211f74c3ce?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5190b5ac-a12c-45ea-97fd-2d86bc2b090c","source":"wordfence","cve":"CVE-2024-47384","title":"WP Compress \u2013 Image Optimizer [All-In-One] <= 6.20.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5190b5ac-a12c-45ea-97fd-2d86bc2b090c?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.20.13","to_inclusive":true,"patched_in":"6.21.01"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:22:05Z"},{"id":"wordfence:51925441-8849-4304-91fa-682a7624fd58","source":"wordfence","cve":"CVE-2025-4956","title":"Pro Bulk Watermark Plugin for WordPress <= 2.0 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51925441-8849-4304-91fa-682a7624fd58?source=api-prod","affected":[{"type":"plugin","slug":"pro-watermark","name":"Pro Bulk Watermark Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:52:14Z"},{"id":"wordfence:5193d1c0-5111-4e97-a433-a41a76acbde9","source":"wordfence","cve":"","title":"WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5193d1c0-5111-4e97-a433-a41a76acbde9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2018-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51957ee1-a423-485b-8cfd-8eafaf6744e4","source":"wordfence","cve":"CVE-2017-16562","title":"UserPro <= 4.9.17 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51957ee1-a423-485b-8cfd-8eafaf6744e4?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"4.9.17.1","to_inclusive":false,"patched_in":"4.9.17.1"}],"published":"2017-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5196a9f2-177d-48e1-b0dc-72e0727132d6","source":"wordfence","cve":"CVE-2022-45370","title":"WordPress Comments Import & Export <= 2.3.1 - CSV Injection","severity":"medium","cvss":6.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5196a9f2-177d-48e1-b0dc-72e0727132d6?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51982774-5999-4f98-a635-3f099f779efb","source":"wordfence","cve":"CVE-2026-19782","title":"WPS Bidouille < 1.33.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51982774-5999-4f98-a635-3f099f779efb?source=api-prod","affected":[{"type":"plugin","slug":"wps-bidouille","name":"WPS Bidouille","from":"*","from_inclusive":true,"to":"1.33.5","to_inclusive":false,"patched_in":"1.33.5"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T15:57:53Z"},{"id":"wordfence:51986a76-933b-4c25-af79-d0c3f9e1d513","source":"wordfence","cve":"CVE-2023-33311","title":"Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51986a76-933b-4c25-af79-d0c3f9e1d513?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51a1c2de-56be-4487-874a-a916e8a6992a","source":"wordfence","cve":"CVE-2023-2402","title":"Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51a1c2de-56be-4487-874a-a916e8a6992a?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-photo-gallery","name":"Photo Gallery Slideshow & Masonry Tiled Gallery","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51a4886b-2e15-4d91-b853-4a675120a9e9","source":"wordfence","cve":"CVE-2024-43342","title":"Ultimate Store Kit Elementor Addons <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51a4886b-2e15-4d91-b853-4a675120a9e9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:14:27Z"},{"id":"wordfence:51a49b5b-c0a3-4aac-84cc-6e1ebf3a442e","source":"wordfence","cve":"CVE-2015-20019","title":"Content text slider on post < 6.9 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51a49b5b-c0a3-4aac-84cc-6e1ebf3a442e?source=api-prod","affected":[{"type":"plugin","slug":"content-text-slider-on-post","name":"Content text slider on post","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":false,"patched_in":"6.9"}],"published":"2015-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51a69fd3-a26d-477d-8945-728f369db826","source":"wordfence","cve":"CVE-2026-109884","title":"Elementor Website Builder \u2013 more than just a page builder <= 4.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51a69fd3-a26d-477d-8945-728f369db826?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-11-04T11:52:22Z","updated":"2026-11-10T19:12:11Z"},{"id":"wordfence:51aa0d86-e623-46d1-9d37-a36b4825c071","source":"wordfence","cve":"CVE-2026-3600","title":"Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa0d86-e623-46d1-9d37-a36b4825c071?source=api-prod","affected":[{"type":"plugin","slug":"investi","name":"Investi","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2026-04-07T16:02:59Z","updated":"2026-04-08T04:27:16Z"},{"id":"wordfence:51aa5531-e5b3-4c47-8d06-58eac6dd92fb","source":"wordfence","cve":"CVE-2025-6003","title":"WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa5531-e5b3-4c47-8d06-58eac6dd92fb?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Single Site Standard","from":"*","from_inclusive":true,"to":"18.5.3","to_inclusive":true,"patched_in":"18.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Multisite Enterprise","from":"*","from_inclusive":true,"to":"40.5.3","to_inclusive":true,"patched_in":"40.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Single Site Premium","from":"*","from_inclusive":true,"to":"28.5.3","to_inclusive":true,"patched_in":"28.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Single Site All-Inclusive","from":"*","from_inclusive":true,"to":"48.5.3","to_inclusive":true,"patched_in":"48.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Multisite Premium","from":"*","from_inclusive":true,"to":"30.5.3","to_inclusive":true,"patched_in":"30.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Single Site Enterprise","from":"*","from_inclusive":true,"to":"38.5.3","to_inclusive":true,"patched_in":"38.5.4"},{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Multisite All-Inclusive","from":"*","from_inclusive":true,"to":"50.5.3","to_inclusive":true,"patched_in":"50.5.4"}],"published":"2025-06-11T19:22:27Z","updated":"2025-06-12T08:22:47Z"},{"id":"wordfence:51abaca6-d882-40b8-86b1-e21835566e3b","source":"wordfence","cve":"CVE-2026-18594","title":"Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51abaca6-d882-40b8-86b1-e21835566e3b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T15:19:19Z","updated":"2026-09-10T03:40:41Z"},{"id":"wordfence:51ac25ef-e5b9-4f5c-a792-fff4ceba96e1","source":"wordfence","cve":"CVE-2024-29126","title":"Specific Content For Mobile \u2013 Customize the mobile version without redirections <= 0.1.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ac25ef-e5b9-4f5c-a792-fff4ceba96e1?source=api-prod","affected":[{"type":"plugin","slug":"specific-content-for-mobile","name":"Specific Content For Mobile \u2013 Customize the mobile version without redirections","from":"*","from_inclusive":true,"to":"0.1.9.5","to_inclusive":true,"patched_in":"0.1.9.6"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T20:47:28Z"},{"id":"wordfence:51aec830-1ef7-43e6-af85-ef5b7d3efd31","source":"wordfence","cve":"CVE-2026-96900","title":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails < 2.1.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51aec830-1ef7-43e6-af85-ef5b7d3efd31?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-abandonment-recovery","name":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:39:15Z"},{"id":"wordfence:51b0c1e5-08f7-44b3-8518-6b0902b84758","source":"wordfence","cve":"CVE-2024-13435","title":"Ebook Downloader <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b0c1e5-08f7-44b3-8518-6b0902b84758?source=api-prod","affected":[{"type":"plugin","slug":"ebook-downloader","name":"Ebook Downloader","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-11T21:08:04Z","updated":"2025-02-12T09:22:49Z"},{"id":"wordfence:51b0c452-481e-409d-81cd-f1498ed6a331","source":"wordfence","cve":"CVE-2025-60072","title":"Anchor smooth scroll <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b0c452-481e-409d-81cd-f1498ed6a331?source=api-prod","affected":[{"type":"plugin","slug":"anchor-smooth-scroll","name":"Anchor smooth scroll","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-29T00:00:00Z","updated":"2025-12-19T16:41:44Z"},{"id":"wordfence:51b42108-5b6d-4d41-b663-cccab8b552be","source":"wordfence","cve":"CVE-2024-6231","title":"Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b42108-5b6d-4d41-b663-cccab8b552be?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-07-02T00:00:00Z","updated":"2024-08-09T20:29:13Z"},{"id":"wordfence:51b56dc5-0d2d-4fa9-872c-4193f61c165f","source":"wordfence","cve":"CVE-2025-14049","title":"VikRentItems Flexible Rental Management System <= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b56dc5-0d2d-4fa9-872c-4193f61c165f?source=api-prod","affected":[{"type":"plugin","slug":"vikrentitems","name":"VikRentItems Flexible Rental Management System","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-12-11T19:11:46Z","updated":"2025-12-12T07:20:35Z"},{"id":"wordfence:51b60e28-fb43-434a-88ca-3c73a8e89d40","source":"wordfence","cve":"CVE-2015-9357","title":"Akismet <= 3.1.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b60e28-fb43-434a-88ca-3c73a8e89d40?source=api-prod","affected":[{"type":"plugin","slug":"akismet","name":"Akismet Anti-spam: Spam Protection","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2015-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51b626e1-89c0-49b9-bfeb-32005e8e78d6","source":"wordfence","cve":"CVE-2024-12738","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b626e1-89c0-49b9-bfeb-32005e8e78d6?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.12.9","to_inclusive":true,"patched_in":"3.13.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T12:43:40Z"},{"id":"wordfence:51b6c73d-fd4f-4469-9859-fbae61b5924c","source":"wordfence","cve":"","title":"WP Super Cache <= 1.4.4 - Authenticated File Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b6c73d-fd4f-4469-9859-fbae61b5924c?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2015-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51b725e4-b088-4f6b-8810-87a39ca952ff","source":"wordfence","cve":"CVE-2019-17070","title":"LIQUID SPEECH BALLOON < 1.0.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b725e4-b088-4f6b-8810-87a39ca952ff?source=api-prod","affected":[{"type":"plugin","slug":"liquid-speech-balloon","name":"LIQUID SPEECH BALLOON","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"}],"published":"2019-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51b7c8f3-3d55-44c9-896c-c3ae19f15a34","source":"wordfence","cve":"CVE-2025-23994","title":"Estatebud \u2013 Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b7c8f3-3d55-44c9-896c-c3ae19f15a34?source=api-prod","affected":[{"type":"plugin","slug":"estatebud-properties-listings","name":"Estatebud \u2013 Properties & Listings","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-28T16:07:18Z"},{"id":"wordfence:51b88442-3961-42e2-8ff4-7726819a7f0f","source":"wordfence","cve":"CVE-2023-0726","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folder","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51b88442-3961-42e2-8ff4-7726819a7f0f?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51c1c4ee-c17f-4565-b800-f306569fc502","source":"wordfence","cve":"CVE-2015-9401","title":"Websimon Tables <= 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51c1c4ee-c17f-4565-b800-f306569fc502?source=api-prod","affected":[{"type":"plugin","slug":"websimon-tables","name":"Websimon Tables","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51c42ca2-cdba-49f5-bea2-83c9b8cf0db7","source":"wordfence","cve":"CVE-2023-47778","title":"LuckyWP Scripts Control <= 1.2.1  - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51c42ca2-cdba-49f5-bea2-83c9b8cf0db7?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-scripts-control","name":"LuckyWP Scripts Control","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-10-18T13:49:06Z"},{"id":"wordfence:51c95763-fd42-4b97-8dca-1ed11615709a","source":"wordfence","cve":"CVE-2024-51659","title":"Twitter @Anywhere Plus <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51c95763-fd42-4b97-8dca-1ed11615709a?source=api-prod","affected":[{"type":"plugin","slug":"twitter-anywhere-plus","name":"Twitter @Anywhere Plus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:23:59Z"},{"id":"wordfence:51c98a2c-639e-410b-8665-95ba057167bc","source":"wordfence","cve":"CVE-2024-55973","title":"TSB Occasion Editor <= 1.2.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51c98a2c-639e-410b-8665-95ba057167bc?source=api-prod","affected":[{"type":"plugin","slug":"tsb-occasion-editor","name":"TSB Occasion Editor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T17:00:53Z"},{"id":"wordfence:51ca3ed9-6c3e-44c6-b746-8415e27abed0","source":"wordfence","cve":"CVE-2026-39482","title":"Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ca3ed9-6c3e-44c6-b746-8415e27abed0?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.10.0"}],"published":"2026-03-22T00:00:00Z","updated":"2026-04-15T21:24:03Z"},{"id":"wordfence:51ca835f-97cd-4711-b2a5-6090bd844b10","source":"wordfence","cve":"CVE-2026-24972","title":"Elated Listing <= 1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ca835f-97cd-4711-b2a5-6090bd844b10?source=api-prod","affected":[{"type":"plugin","slug":"eltd-listing","name":"Elated Listing","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-16T00:00:00Z","updated":"2026-05-05T15:54:06Z"},{"id":"wordfence:51cbe19d-2af9-44e2-802e-243779b23ed3","source":"wordfence","cve":"CVE-2026-5306","title":"Check & Log Email \u2013 Easy Email Testing & Mail logging < 2.0.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cbe19d-2af9-44e2-802e-243779b23ed3?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":false,"patched_in":"2.0.13"}],"published":"2026-04-28T00:00:00Z","updated":"2026-04-30T14:34:28Z"},{"id":"wordfence:51cc6247-1948-4de1-b347-c7d818400777","source":"wordfence","cve":"CVE-2024-12528","title":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cc6247-1948-4de1-b347-c7d818400777?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-poll","name":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:05:36Z","updated":"2025-01-07T03:21:56Z"},{"id":"wordfence:51cd2cb8-ac77-4962-9156-da0195ce1003","source":"wordfence","cve":"CVE-2025-32151","title":"BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cd2cb8-ac77-4962-9156-da0195ce1003?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.17","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-10-16T18:10:17Z"},{"id":"wordfence:51cd51a3-0b8b-4dbb-b384-20076d18cca9","source":"wordfence","cve":"CVE-2025-30856","title":"Custom Field For WP Job Manager <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cd51a3-0b8b-4dbb-b384-20076d18cca9?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-for-wp-job-manager","name":"Custom Field For WP Job Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:40:05Z"},{"id":"wordfence:51cd834e-1b18-4702-9c6c-db7f34f2c687","source":"wordfence","cve":"CVE-2020-8203","title":"WordPress Core < 5.8.1 - LoDash Update","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cd834e-1b18-4702-9c6c-db7f34f2c687?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.7","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.6","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.5","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"5.4.7"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51ce7b71-0a19-48ef-8748-3848742c542b","source":"wordfence","cve":"CVE-2023-0761","title":"Clock In Portal <= 2.1 - Cross-Site Request Forgery To Staff Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ce7b71-0a19-48ef-8748-3848742c542b?source=api-prod","affected":[{"type":"plugin","slug":"clock-in-portal","name":"Clock In Portal- Staff & Attendance Management","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2025-10-14T18:46:02Z"},{"id":"wordfence:51cf2f40-7be8-4302-a766-88ec2f0501f5","source":"wordfence","cve":"CVE-2019-17237","title":"IgniteUp \u2013 Coming Soon and Maintenance Mode <= 3.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cf2f40-7be8-4302-a766-88ec2f0501f5?source=api-prod","affected":[{"type":"plugin","slug":"igniteup","name":"IgniteUp \u2013 Coming Soon and Maintenance Mode","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2019-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51cfe955-f854-4f88-a009-93f92ae13d86","source":"wordfence","cve":"CVE-2023-41671","title":"Abandoned Cart Lite for WooCommerce <= 5.16.1 - Missing Authorization via multiple AJAX functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51cfe955-f854-4f88-a009-93f92ae13d86?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":true,"patched_in":"5.16.2"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51d00335-f577-4db4-9110-024fae0a3916","source":"wordfence","cve":"CVE-2014-125130","title":"Google MP3 Player <= 1.0.11 - Unauthenticated Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d00335-f577-4db4-9110-024fae0a3916?source=api-prod","affected":[{"type":"plugin","slug":"google-mp3-audio-player","name":"google-mp3-audio-player","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2014-12-03T00:00:00Z","updated":"2026-10-09T12:31:33Z"},{"id":"wordfence:51d07d2a-74e6-499e-8d66-90893faedeaf","source":"wordfence","cve":"CVE-2023-47670","title":"Korea SNS <= 1.6.4 - Cross-Site Request Forgery via kon_tergos_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d07d2a-74e6-499e-8d66-90893faedeaf?source=api-prod","affected":[{"type":"plugin","slug":"korea-sns","name":"Korea SNS","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-11-08T00:00:00Z","updated":"2024-03-25T16:25:13Z"},{"id":"wordfence:51d0ab38-fa5b-4c96-a849-06d6ab3caf2b","source":"wordfence","cve":"CVE-2026-18031","title":"TabaPay Gateway < 1.4.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d0ab38-fa5b-4c96-a849-06d6ab3caf2b?source=api-prod","affected":[{"type":"plugin","slug":"tabapay-gateway","name":"TabaPay \u2013 \u062f\u0631\u06af\u0627\u0647 \u067e\u0631\u062f\u0627\u062e\u062a \u062a\u0627\u0628\u0627\u067e\u06cc","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2026-08-21T00:00:00Z","updated":"2026-10-28T21:13:57Z"},{"id":"wordfence:51d0ba58-614e-4284-ae0b-b0b76fc5c46d","source":"wordfence","cve":"CVE-2026-15212","title":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d0ba58-614e-4284-ae0b-b0b76fc5c46d?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"43.2","to_inclusive":true,"patched_in":"43.3"}],"published":"2026-07-23T07:23:25Z","updated":"2026-07-23T19:45:53Z"},{"id":"wordfence:51d14f45-4c30-4225-998d-f4f829e09bc0","source":"wordfence","cve":"CVE-2024-8740","title":"GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d14f45-4c30-4225-998d-f4f829e09bc0?source=api-prod","affected":[{"type":"plugin","slug":"getresponse","name":"GetResponse Forms by Optin Cat","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-10-17T15:46:36Z","updated":"2024-12-03T22:13:07Z"},{"id":"wordfence:51d3c250-301c-4f91-9fe5-56879a65fde7","source":"wordfence","cve":"CVE-2015-4455","title":"Aviary Image Editor Add-on For Gravity Forms <= 3.0 (Beta r7) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d3c250-301c-4f91-9fe5-56879a65fde7?source=api-prod","affected":[{"type":"plugin","slug":"aviary-image-editor-add-on-for-gravity-forms","name":"Aviary Image Editor Add-on For Gravity Forms","from":"*","from_inclusive":true,"to":"3.0 (Beta r7)","to_inclusive":true,"patched_in":""}],"published":"2015-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51d3d738-5c82-4f6b-b8f3-d5af5391b6f6","source":"wordfence","cve":"CVE-2025-7498","title":"Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d3d738-5c82-4f6b-b8f3-d5af5391b6f6?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.4","to_inclusive":true,"patched_in":"2.7.9.5"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-06T03:41:00Z"},{"id":"wordfence:51d4b7f6-183b-4a8d-a94d-83c66950a872","source":"wordfence","cve":"CVE-2025-4521","title":"IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d4b7f6-183b-4a8d-a94d-83c66950a872?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"2.1.5","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-02-18T16:32:50Z","updated":"2026-02-19T04:36:11Z"},{"id":"wordfence:51d79701-8580-4130-8f84-e739aa2f7f5f","source":"wordfence","cve":"CVE-2026-10039","title":"Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d79701-8580-4130-8f84-e739aa2f7f5f?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.8","to_inclusive":true,"patched_in":"3.28.29"}],"published":"2026-05-28T19:36:05Z","updated":"2026-05-29T07:46:49Z"},{"id":"wordfence:51d8db66-0735-4a9d-a60b-b23a9fb35384","source":"wordfence","cve":"CVE-2026-116398","title":"Content Slider Block \u2013 Bring your content to life with slides <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d8db66-0735-4a9d-a60b-b23a9fb35384?source=api-prod","affected":[{"type":"plugin","slug":"content-slider-block","name":"Content Slider Block \u2013 Bring your content to life with slides","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-10-26T17:26:00Z","updated":"2026-10-28T01:26:57Z"},{"id":"wordfence:51d98277-a1d7-4708-8daf-88948a235375","source":"wordfence","cve":"","title":"WP Super Cache <= 1.4.8 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51d98277-a1d7-4708-8daf-88948a235375?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2017-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51dd2908-d639-437d-b1e3-d463cc813240","source":"wordfence","cve":"CVE-2026-93370","title":"Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51dd2908-d639-437d-b1e3-d463cc813240?source=api-prod","affected":[{"type":"plugin","slug":"woo-paystack","name":"Paystack WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"5.8.6"}],"published":"2026-11-06T18:25:01Z","updated":"2026-11-07T06:39:36Z"},{"id":"wordfence:51de575f-d458-4a7d-bc57-4a11e5124377","source":"wordfence","cve":"CVE-2025-10735","title":"Block For Mailchimp \u2013 Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":4.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=api-prod","affected":[{"type":"plugin","slug":"block-for-mailchimp","name":"Block for Mailchimp \u2013 grow your email list with signup forms","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-01T03:25:24Z"},{"id":"wordfence:51df33a7-d04d-4c47-aba8-d174e2a40170","source":"wordfence","cve":"CVE-2026-73385","title":"Outranking Plugin Options <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51df33a7-d04d-4c47-aba8-d174e2a40170?source=api-prod","affected":[{"type":"plugin","slug":"outranking","name":"Outranking Plugin Options","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:13:03Z"},{"id":"wordfence:51e1a30e-774e-4478-be34-486ed4142a7d","source":"wordfence","cve":"CVE-2021-24135","title":"WP Customer Reviews <= 3.4.2 - Multiple Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e1a30e-774e-4478-be34-486ed4142a7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2020-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51e1ac7f-d1d2-42b1-9c38-ca19865e2a97","source":"wordfence","cve":"CVE-2026-62013","title":"Edge Decor <= 2.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e1ac7f-d1d2-42b1-9c38-ca19865e2a97?source=api-prod","affected":[{"type":"theme","slug":"edge-decor","name":"Edge Decor","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:36:46Z"},{"id":"wordfence:51e1bf48-a801-4eec-aebd-f4824f36a623","source":"wordfence","cve":"CVE-2024-30424","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e1bf48-a801-4eec-aebd-f4824f36a623?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-28T00:00:00Z","updated":"2026-04-15T20:33:14Z"},{"id":"wordfence:51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb","source":"wordfence","cve":"CVE-2026-4812","title":"Advanced Custom Fields (ACF\u00ae) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e3a976-a1a3-411a-b88c-f1cb2aa8d5eb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.7.0","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2026-04-14T12:58:08Z","updated":"2026-04-15T01:25:17Z"},{"id":"wordfence:51e4f7ac-efc5-492c-b7a4-eea6d5f69e0d","source":"wordfence","cve":"CVE-2021-24516","title":"PlanSo Forms <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e4f7ac-efc5-492c-b7a4-eea6d5f69e0d?source=api-prod","affected":[{"type":"plugin","slug":"planso-forms","name":"PlanSo Forms","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51e90226-48e4-493d-9e2c-a9d0dbb36286","source":"wordfence","cve":"CVE-2025-66157","title":"Sliper for Elementor <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51e90226-48e4-493d-9e2c-a9d0dbb36286?source=api-prod","affected":[{"type":"plugin","slug":"sliper-elementor","name":"Sliper \u2013 Full-screen Slider for Elementor","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:58:06Z"},{"id":"wordfence:51ea4966-6763-4808-831a-79160a3d0581","source":"wordfence","cve":"CVE-2026-78263","title":"Event Tickets and Registration <= 5.29.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ea4966-6763-4808-831a-79160a3d0581?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.2.1","to_inclusive":true,"patched_in":"5.29.3"}],"published":"2026-08-24T12:33:18Z","updated":"2026-09-10T19:30:14Z"},{"id":"wordfence:51eb2e13-3f4e-4b27-bc71-85d4eced3cde","source":"wordfence","cve":"CVE-2025-25095","title":"ReverbNation Widgets <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51eb2e13-3f4e-4b27-bc71-85d4eced3cde?source=api-prod","affected":[{"type":"plugin","slug":"reverbnation-widgets","name":"ReverbNation Widgets","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:29:08Z"},{"id":"wordfence:51ee45f8-9978-48ec-8f87-229dc82938a8","source":"wordfence","cve":"CVE-2025-8009","title":"Security Ninja \u2013 Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ee45f8-9978-48ec-8f87-229dc82938a8?source=api-prod","affected":[{"type":"plugin","slug":"security-ninja","name":"Security Ninja \u2013 WordPress Security & Firewall","from":"5.201","from_inclusive":true,"to":"5.242","to_inclusive":true,"patched_in":"5.243"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-24T07:22:14Z"},{"id":"wordfence:51f3497f-c599-4d47-bd5a-94e1679a0025","source":"wordfence","cve":"CVE-2024-13563","title":"Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f3497f-c599-4d47-bd5a-94e1679a0025?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.30","to_inclusive":true,"patched_in":"3.2.31"}],"published":"2025-02-14T20:08:17Z","updated":"2025-02-15T08:25:05Z"},{"id":"wordfence:51f39839-0d9b-4b4e-883e-f2e9603bd8d2","source":"wordfence","cve":"CVE-2025-31808","title":"SCSS WP Editor <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f39839-0d9b-4b4e-883e-f2e9603bd8d2?source=api-prod","affected":[{"type":"plugin","slug":"scss-wp-editor","name":"SCSS WP Editor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-01T00:00:00Z","updated":"2026-05-26T19:16:18Z"},{"id":"wordfence:51f3acc5-ae9d-4b90-b011-cffd4e219e04","source":"wordfence","cve":"CVE-2026-54853","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f3acc5-ae9d-4b90-b011-cffd4e219e04?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-10-29T14:30:00Z","updated":"2026-11-03T20:02:20Z"},{"id":"wordfence:51f42876-8aaf-49cc-9c6d-29b1c75462d2","source":"wordfence","cve":"CVE-2026-39745","title":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress <= 1.7.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f42876-8aaf-49cc-9c6d-29b1c75462d2?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:25:39Z","updated":"2026-10-14T10:41:49Z"},{"id":"wordfence:51f73041-927d-42da-92cc-14242a397356","source":"wordfence","cve":"CVE-2022-46818","title":"Email posts to subscribers <= 6.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f73041-927d-42da-92cc-14242a397356?source=api-prod","affected":[{"type":"plugin","slug":"email-posts-to-subscribers","name":"Email posts to subscribers","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:51f94ce3-a11a-491e-b7d4-174cd17e2c8a","source":"wordfence","cve":"CVE-2024-53715","title":"Simple Travel Map <= 0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51f94ce3-a11a-491e-b7d4-174cd17e2c8a?source=api-prod","affected":[{"type":"plugin","slug":"simple-travel-map","name":"Simple Travel Map","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:25:30Z"},{"id":"wordfence:51fab95e-336d-4544-8b8e-c4e9002321ec","source":"wordfence","cve":"CVE-2024-4203","title":"Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51fab95e-336d-4544-8b8e-c4e9002321ec?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.30","to_inclusive":true,"patched_in":"4.10.31"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:05Z"},{"id":"wordfence:51fc7d47-2a0f-4713-9859-120321aa32dc","source":"wordfence","cve":"CVE-2024-12827","title":"DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51fc7d47-2a0f-4713-9859-120321aa32dc?source=api-prod","affected":[{"type":"theme","slug":"dwt-listing","name":"DWT - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2025-06-26T00:00:00Z","updated":"2025-06-27T08:23:58Z"},{"id":"wordfence:51fd6124-4954-4827-a665-c2d94d74a512","source":"wordfence","cve":"CVE-2024-39653","title":"VikRentCar <= 1.4.0 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51fd6124-4954-4827-a665-c2d94d74a512?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:11:04Z"},{"id":"wordfence:51fe2379-e5c6-4cd0-b7d1-b03105403b97","source":"wordfence","cve":"CVE-2024-52415","title":"SK WP Settings Backup <= 1.0 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51fe2379-e5c6-4cd0-b7d1-b03105403b97?source=api-prod","affected":[{"type":"plugin","slug":"sk-wp-settings-backup","name":"SK WP Settings Backup","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:17:59Z"},{"id":"wordfence:51ff10f2-4a5b-42ab-9ee2-95b036ac1c9a","source":"wordfence","cve":"CVE-2024-2368","title":"Mollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ff10f2-4a5b-42ab-9ee2-95b036ac1c9a?source=api-prod","affected":[{"type":"plugin","slug":"mollie-forms","name":"Mollie Forms","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.14"}],"published":"2024-06-04T00:00:00Z","updated":"2024-07-29T21:36:21Z"},{"id":"wordfence:51ff2654-fa38-4807-87f5-53a9996839c1","source":"wordfence","cve":"CVE-2014-4565","title":"Verification Code for Comments <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/51ff2654-fa38-4807-87f5-53a9996839c1?source=api-prod","affected":[{"type":"plugin","slug":"verification-code-for-comments","name":"Verification Code for Comments","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:520018db-d33b-4f2c-aaa5-611de792e11f","source":"wordfence","cve":"CVE-2026-3226","title":"LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520018db-d33b-4f2c-aaa5-611de792e11f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2.8","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-03-11T13:32:56Z","updated":"2026-03-12T02:22:37Z"},{"id":"wordfence:52001a06-e2e0-4d76-aa2d-0e9012357511","source":"wordfence","cve":"CVE-2025-27315","title":"All-In-One Cufon <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52001a06-e2e0-4d76-aa2d-0e9012357511?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-cufon","name":"All-In-One Cufon","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:28:48Z"},{"id":"wordfence:5200ed9c-83dd-4f07-804c-2519932e5546","source":"wordfence","cve":"CVE-2022-0377","title":"LearnPress <= 4.1.4.1 - Arbitrary Image Renaming","severity":"medium","cvss":4.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5200ed9c-83dd-4f07-804c-2519932e5546?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.4.1","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5201963b-3b30-4e7a-9ad1-d9fa7bf629e5","source":"wordfence","cve":"CVE-2023-23820","title":"ProfilePress <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5201963b-3b30-4e7a-9ad1-d9fa7bf629e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5204d111-3dd5-4dd0-bf1a-79ec2900b4d8","source":"wordfence","cve":"CVE-2024-35718","title":"Newsletters <= 4.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5204d111-3dd5-4dd0-bf1a-79ec2900b4d8?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:50:37Z"},{"id":"wordfence:520555b4-35e8-4ec1-85b8-3a43b5209661","source":"wordfence","cve":"CVE-2024-13564","title":"Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520555b4-35e8-4ec1-85b8-3a43b5209661?source=api-prod","affected":[{"type":"plugin","slug":"rife-elementor-extensions","name":"Rife Extensions & Templates for Elementor","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-02-21T19:51:18Z","updated":"2025-02-22T08:22:06Z"},{"id":"wordfence:52056177-8604-48b9-ab50-d0dc1e13a3d5","source":"wordfence","cve":"CVE-2023-40668","title":"Save as PDF plugin by Pdfcrowd <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52056177-8604-48b9-ab50-d0dc1e13a3d5?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:520598d7-863f-4bf3-ba74-fa9b2cc32767","source":"wordfence","cve":"CVE-2024-1758","title":"SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520598d7-863f-4bf3-ba74-fa9b2cc32767?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-superfaktura","name":"SuperFaktura WooCommerce","from":"*","from_inclusive":true,"to":"1.40.3","to_inclusive":true,"patched_in":"1.40.4"}],"published":"2024-02-23T00:00:00Z","updated":"2024-04-30T15:04:09Z"},{"id":"wordfence:5205cc95-06d1-4bc6-a9ea-082df9566935","source":"wordfence","cve":"CVE-2024-5503","title":"WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5205cc95-06d1-4bc6-a9ea-082df9566935?source=api-prod","affected":[{"type":"plugin","slug":"wp-blog-post-layouts","name":"WP Blog Post Layouts","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-06-20T12:56:54Z","updated":"2024-07-01T17:13:26Z"},{"id":"wordfence:5205fcde-2e6c-49de-b132-1ebefcd1ba59","source":"wordfence","cve":"CVE-2008-0520","title":"WassUp Real Time Analytics 1.4 - 1.4.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5205fcde-2e6c-49de-b132-1ebefcd1ba59?source=api-prod","affected":[{"type":"plugin","slug":"wassup","name":"WassUp Real Time Analytics","from":"1.4","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2008-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:520730e0-e085-4bbf-a1c7-497b9ae2da3c","source":"wordfence","cve":"CVE-2025-49453","title":"BP Profile as Homepage <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520730e0-e085-4bbf-a1c7-497b9ae2da3c?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-as-homepage","name":"BP Profile as Homepage","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:01:47Z"},{"id":"wordfence:5208529c-4ac3-42a4-82d0-7f4d2e486236","source":"wordfence","cve":"CVE-2024-4487","title":"Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5208529c-4ac3-42a4-82d0-7f4d2e486236?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.0.45","to_inclusive":true,"patched_in":"2.0.46"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-11T07:40:52Z"},{"id":"wordfence:520c1e8b-d0c1-4201-90bf-0cefab9af7e0","source":"wordfence","cve":"CVE-2025-5954","title":"Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=api-prod","affected":[{"type":"plugin","slug":"aone-sms","name":"Service Finder SMS System","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-31T13:51:29Z","updated":"2025-09-18T15:54:05Z"},{"id":"wordfence:520df463-1ac9-4dbe-b490-8d962757cde7","source":"wordfence","cve":"CVE-2025-32159","title":"Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/520df463-1ac9-4dbe-b490-8d962757cde7?source=api-prod","affected":[{"type":"plugin","slug":"radius-blocks","name":"Radius Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:49:15Z"},{"id":"wordfence:52105225-1b22-42b9-97b4-a521ced36b01","source":"wordfence","cve":"CVE-2024-37423","title":"Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary Directory Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52105225-1b22-42b9-97b4-a521ced36b01?source=api-prod","affected":[{"type":"plugin","slug":"newspack-blocks","name":"Newspack Blocks","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:33:04Z"},{"id":"wordfence:521168c2-dcbb-44fc-9ca1-d3358185b32d","source":"wordfence","cve":"CVE-2025-22265","title":"EMI Calculator <= 1.1 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/521168c2-dcbb-44fc-9ca1-d3358185b32d?source=api-prod","affected":[{"type":"plugin","slug":"emi-calculator","name":"EMI Calculator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-02-20T15:56:35Z"},{"id":"wordfence:52116a6f-506f-4eeb-9bcc-19900ef38101","source":"wordfence","cve":"CVE-2024-2202","title":"Page Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52116a6f-506f-4eeb-9bcc-19900ef38101?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.29.6","to_inclusive":true,"patched_in":"2.29.7"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T02:32:56Z"},{"id":"wordfence:5212567c-6134-4151-9fc6-eb4797ed0450","source":"wordfence","cve":"CVE-2025-62869","title":"Gravitec.net \u2013 Web Push Notifications <= 2.9.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5212567c-6134-4151-9fc6-eb4797ed0450?source=api-prod","affected":[{"type":"plugin","slug":"gravitec-net-web-push-notifications","name":"Gravitec.net \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"2.9.17","to_inclusive":true,"patched_in":"2.9.18"}],"published":"2025-12-06T00:00:00Z","updated":"2026-01-06T18:21:32Z"},{"id":"wordfence:52144ff6-0617-496c-8159-ec5d7bc86f60","source":"wordfence","cve":"CVE-2024-9066","title":"Marketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52144ff6-0617-496c-8159-ec5d7bc86f60?source=api-prod","affected":[{"type":"plugin","slug":"marketing-and-seo-booster","name":"Marketing and SEO Booster","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:28:53Z","updated":"2024-10-10T02:06:07Z"},{"id":"wordfence:5214a399-21a4-4573-9840-1d5043781bc0","source":"wordfence","cve":"CVE-2025-12166","title":"Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5214a399-21a4-4573-9840-1d5043781bc0?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.9","to_inclusive":true,"patched_in":"1.6.9.13"}],"published":"2026-01-14T10:13:21Z","updated":"2026-01-14T22:23:50Z"},{"id":"wordfence:52158d56-acc2-41f0-a5d0-7ce31c41617e","source":"wordfence","cve":"CVE-2026-108498","title":"BSK PDF Manager <= 3.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52158d56-acc2-41f0-a5d0-7ce31c41617e?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T10:51:30Z","updated":"2026-10-23T18:24:59Z"},{"id":"wordfence:5215d2aa-60e8-4872-b518-039e6e0d9eed","source":"wordfence","cve":"CVE-2026-22474","title":"Equestrian Centre <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5215d2aa-60e8-4872-b518-039e6e0d9eed?source=api-prod","affected":[{"type":"theme","slug":"equestrian-centre","name":"Equestrian Centre - Horse-riding School Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:38:53Z"},{"id":"wordfence:5217c992-4d0d-4774-a404-367e6b6bc47e","source":"wordfence","cve":"CVE-2025-32657","title":"Testimonial Slider And Showcase Pro <= 2.1.7 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5217c992-4d0d-4774-a404-367e6b6bc47e?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-showcase-pro","name":"Testimonial Slider And Showcase Pro","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:47:30Z"},{"id":"wordfence:52198053-206c-4002-8e26-dd5b4850e151","source":"wordfence","cve":"CVE-2024-22157","title":"SalesKing <= 1.6.15 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52198053-206c-4002-8e26-dd5b4850e151?source=api-prod","affected":[{"type":"plugin","slug":"salesking","name":"SalesKing","from":"*","from_inclusive":true,"to":"1.6.15","to_inclusive":true,"patched_in":"1.6.30"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5219ef67-7a99-49da-810b-bbfe7b649145","source":"wordfence","cve":"CVE-2026-40732","title":"Notification for Telegram <= 3.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5219ef67-7a99-49da-810b-bbfe7b649145?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:47:43Z"},{"id":"wordfence:521af15c-983c-49dc-a90b-b090281db78a","source":"wordfence","cve":"CVE-2024-6617","title":"NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via CSS Styles","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/521af15c-983c-49dc-a90b-b090281db78a?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code","name":"NinjaTeam Header Footer Custom Code","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-23T15:35:01Z"},{"id":"wordfence:521b1786-3527-4b4e-b1c4-ff4fbfed8107","source":"wordfence","cve":"CVE-2024-49318","title":"My Reading Library <= 1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/521b1786-3527-4b4e-b1c4-ff4fbfed8107?source=api-prod","affected":[{"type":"plugin","slug":"my-reading-library","name":"My Reading Library","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:47:58Z"},{"id":"wordfence:521bb5a3-0a0c-4693-a87d-fabb64f1ad4f","source":"wordfence","cve":"CVE-2024-3494","title":"Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/521bb5a3-0a0c-4693-a87d-fabb64f1ad4f?source=api-prod","affected":[{"type":"plugin","slug":"mesmerize-companion","name":"Mesmerize Companion","from":"*","from_inclusive":true,"to":"1.6.148","to_inclusive":true,"patched_in":"1.6.149"}],"published":"2024-05-07T00:00:00Z","updated":"2026-01-28T16:37:44Z"},{"id":"wordfence:521bcfd5-7bb2-4748-8440-9902181cbf7e","source":"wordfence","cve":"CVE-2022-1688","title":"Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via ids Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/521bcfd5-7bb2-4748-8440-9902181cbf7e?source=api-prod","affected":[{"type":"plugin","slug":"note-press","name":"Note Press","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52203b9c-7629-4969-8d2d-eb1ef33d160c","source":"wordfence","cve":"CVE-2021-24728","title":"Membership & Content Restriction \u2013 Paid Member Subscriptions <= 2.4.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52203b9c-7629-4969-8d2d-eb1ef33d160c?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52223cd1-ee0d-484c-a2af-179b54bfc115","source":"wordfence","cve":"CVE-2026-27372","title":"PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52223cd1-ee0d-484c-a2af-179b54bfc115?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:28:23Z"},{"id":"wordfence:52229c9e-d13c-454a-a280-aa6b41981acf","source":"wordfence","cve":"CVE-2026-118403","title":"Premium Packages \u2013 Sell Digital Products Securely < 7.3.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52229c9e-d13c-454a-a280-aa6b41981acf?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":false,"patched_in":"7.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:34:40Z"},{"id":"wordfence:5222ce69-ac9f-4bb0-9832-8cdff1f8b078","source":"wordfence","cve":"CVE-2023-46205","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.14 - Authenticated(Contributor+) Local File Inclusion","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5222ce69-ac9f-4bb0-9832-8cdff1f8b078?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.14","to_inclusive":true,"patched_in":"3.19.15"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5223d6c3-9fe0-4ac5-bd69-990a13b17826","source":"wordfence","cve":"CVE-2022-50945","title":"3dady real-time web stats <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5223d6c3-9fe0-4ac5-bd69-990a13b17826?source=api-prod","affected":[{"type":"plugin","slug":"3dady-real-time-web-stats","name":"3dady real-time web stats","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-24T00:00:00Z","updated":"2026-07-29T21:09:27Z"},{"id":"wordfence:5224233f-6cb4-4fd9-b25b-e32db612cb7f","source":"wordfence","cve":"CVE-2014-4571","title":"VN Calendar <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5224233f-6cb4-4fd9-b25b-e32db612cb7f?source=api-prod","affected":[{"type":"plugin","slug":"vn-calendar","name":"vn-calendar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:522707e5-dadb-476f-9402-2ccb4f4681f4","source":"wordfence","cve":"CVE-2026-66472","title":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/522707e5-dadb-476f-9402-2ccb4f4681f4?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.3.13"}],"published":"2026-08-10T00:00:00Z","updated":"2026-09-09T16:10:13Z"},{"id":"wordfence:5228221f-b0b4-4faf-bde6-07666a96a278","source":"wordfence","cve":"CVE-2025-15484","title":"Order Notification for WooCommerce \u2013 Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5228221f-b0b4-4faf-bde6-07666a96a278?source=api-prod","affected":[{"type":"plugin","slug":"woc-order-alert","name":"StackWC Order Notification for WooCommerce \u2013 Get Instant Audio Alert on new Orders","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":false,"patched_in":"3.6.3"}],"published":"2026-04-02T00:00:00Z","updated":"2026-04-09T16:06:15Z"},{"id":"wordfence:52293a10-4240-4a6b-a05b-33675a4ed6b6","source":"wordfence","cve":"CVE-2024-11375","title":"WC1C <= 0.23.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52293a10-4240-4a6b-a05b-33675a4ed6b6?source=api-prod","affected":[{"type":"plugin","slug":"wc1c-main","name":"WC1C","from":"*","from_inclusive":true,"to":"0.23.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:38:36Z","updated":"2025-01-07T04:21:59Z"},{"id":"wordfence:522b477f-9df9-4d30-aa03-d4946acab21a","source":"wordfence","cve":"CVE-2024-37560","title":"WP User Switch <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/522b477f-9df9-4d30-aa03-d4946acab21a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-switch","name":"WP User Switch","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:30:23Z"},{"id":"wordfence:522bdd65-8077-4cd4-800a-e6ef9a982d33","source":"wordfence","cve":"CVE-2026-75586","title":"Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/522bdd65-8077-4cd4-800a-e6ef9a982d33?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2026-09-04T18:40:02Z","updated":"2026-09-05T07:38:13Z"},{"id":"wordfence:522ecc1c-5834-4325-9234-79cf712213f3","source":"wordfence","cve":"CVE-2023-4404","title":"Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/522ecc1c-5834-4325-9234-79cf712213f3?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.7.0.12","to_inclusive":true,"patched_in":"1.7.0.13"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:523069b9-4449-416f-974d-40af842e5ebe","source":"wordfence","cve":"CVE-2025-62084","title":"iNext Woo Pincode Checker <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523069b9-4449-416f-974d-40af842e5ebe?source=api-prod","affected":[{"type":"plugin","slug":"inext-woo-pincode-checker","name":"iNext Woo Pincode Checker","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-12-31T00:00:00Z","updated":"2026-08-14T15:16:15Z"},{"id":"wordfence:5231b741-4d02-45b5-b2aa-0d9d3536a416","source":"wordfence","cve":"CVE-2025-7499","title":"BetterDocs  <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5231b741-4d02-45b5-b2aa-0d9d3536a416?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-08-15T19:18:06Z","updated":"2025-08-16T07:25:29Z"},{"id":"wordfence:5231e229-ba82-40ea-b3c1-9ce159a9d128","source":"wordfence","cve":"CVE-2026-66659","title":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5231e229-ba82-40ea-b3c1-9ce159a9d128?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2026-08-11T00:00:00Z","updated":"2026-10-30T17:15:21Z"},{"id":"wordfence:52343971-65a8-4efd-ad6d-521936730b27","source":"wordfence","cve":"CVE-2024-49664","title":"chatplusjp <= 1.02 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52343971-65a8-4efd-ad6d-521936730b27?source=api-prod","affected":[{"type":"plugin","slug":"chatplusjp","name":"chatplusjp","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:48:16Z"},{"id":"wordfence:5235a235-911e-4462-90c5-05b0c7cb45a3","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5235a235-911e-4462-90c5-05b0c7cb45a3?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:04Z"},{"id":"wordfence:52368b7d-5fe2-444c-bd7f-e4385dffa8a9","source":"wordfence","cve":"CVE-2025-14145","title":"Niche Hero | Beautifully-designed blocks in seconds <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52368b7d-5fe2-444c-bd7f-e4385dffa8a9?source=api-prod","affected":[{"type":"plugin","slug":"niche-hero","name":"Niche Hero | Beautifully-designed blocks in seconds","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:35:28Z","updated":"2026-01-07T09:20:55Z"},{"id":"wordfence:52383075-2d39-4fd9-8319-15a5354ff25f","source":"wordfence","cve":"","title":"MP3-jPlayer < 1.8.8 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52383075-2d39-4fd9-8319-15a5354ff25f?source=api-prod","affected":[{"type":"plugin","slug":"mp3-jplayer","name":"MP3-jPlayer","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":false,"patched_in":"1.8.8"}],"published":"2014-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5238c344-d685-4eab-822c-d3c1050cc982","source":"wordfence","cve":"CVE-2026-12435","title":"Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5238c344-d685-4eab-822c-d3c1050cc982?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.111","to_inclusive":true,"patched_in":"1.4.112"}],"published":"2026-06-30T19:04:55Z","updated":"2026-07-01T07:53:36Z"},{"id":"wordfence:5239c414-cd1d-4257-9f8e-e7a92c2119f9","source":"wordfence","cve":"CVE-2024-13469","title":"Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5239c414-cd1d-4257-9f8e-e7a92c2119f9?source=api-prod","affected":[{"type":"plugin","slug":"pricingtable","name":"PickPlugins Pricing Table","from":"*","from_inclusive":true,"to":"1.12.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:10:05Z","updated":"2025-02-28T08:23:17Z"},{"id":"wordfence:523b5dd3-eb73-4156-ad2b-4d532e8d40f3","source":"wordfence","cve":"CVE-2026-2631","title":"Datalogics Ecommerce Delivery \u2013 Datalogics < 2.6.60 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523b5dd3-eb73-4156-ad2b-4d532e8d40f3?source=api-prod","affected":[{"type":"plugin","slug":"datalogics","name":"Datalogics Ecommerce Delivery \u2013 Datalogics","from":"*","from_inclusive":true,"to":"2.6.60","to_inclusive":false,"patched_in":"2.6.60"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T13:34:36Z"},{"id":"wordfence:523c6436-6185-47cf-943e-d2f81c3f94b3","source":"wordfence","cve":"CVE-2024-13146","title":"Booknetic 4.0 - 4.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523c6436-6185-47cf-943e-d2f81c3f94b3?source=api-prod","affected":[{"type":"plugin","slug":"booknetic","name":"Booknetic","from":"4.0","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2025-03-05T00:00:00Z","updated":"2026-06-18T20:22:36Z"},{"id":"wordfence:523cfed4-0422-40f3-8d81-d7862bcb1792","source":"wordfence","cve":"CVE-2023-48767","title":"MyTube PlayList <= 2.0.3 - Reflected Cross-Site Scripting via addplaylistid","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523cfed4-0422-40f3-8d81-d7862bcb1792?source=api-prod","affected":[{"type":"plugin","slug":"mytube","name":"MyTube PlayList","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:523e80a5-dffa-4eb6-8f7a-e179e0dc4d28","source":"wordfence","cve":"CVE-2024-3674","title":"Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523e80a5-dffa-4eb6-8f7a-e179e0dc4d28?source=api-prod","affected":[{"type":"plugin","slug":"inline-google-spreadsheet-viewer","name":"Inline Google Spreadsheet Viewer","from":"*","from_inclusive":true,"to":"0.13.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:05Z"},{"id":"wordfence:523f7a8a-d06d-4778-be14-d0b7ca32dab3","source":"wordfence","cve":"CVE-2023-50884","title":"LA-Studio Element Kit for Elementor <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/523f7a8a-d06d-4778-be14-d0b7ca32dab3?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52417477-7318-4d7d-8143-765c843abc31","source":"wordfence","cve":"CVE-2025-49395","title":"Themify Icons <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52417477-7318-4d7d-8143-765c843abc31?source=api-prod","affected":[{"type":"plugin","slug":"themify-icons","name":"Themify Icons","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:07:49Z"},{"id":"wordfence:5242f5e4-a436-4e8b-87eb-f012d65712d9","source":"wordfence","cve":"CVE-2026-57427","title":"Download Monitor - WPForms Lock <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5242f5e4-a436-4e8b-87eb-f012d65712d9?source=api-prod","affected":[{"type":"plugin","slug":"dlm-wpforms-lock","name":"Download Monitor - WPForms Lock","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-23T15:32:44Z"},{"id":"wordfence:52432f35-c98c-4459-899b-beddf3352834","source":"wordfence","cve":"CVE-2026-66605","title":"Swatchly \u2013 Product Variation Swatches for WooCommerce <= 1.4.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52432f35-c98c-4459-899b-beddf3352834?source=api-prod","affected":[{"type":"plugin","slug":"swatchly","name":"Swatchly \u2013 Product Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:09:14Z"},{"id":"wordfence:524387e3-466d-4f37-9790-6f96bd2aa6b8","source":"wordfence","cve":"CVE-2026-111574","title":"Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524387e3-466d-4f37-9790-6f96bd2aa6b8?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"2.2.7","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:43:41Z"},{"id":"wordfence:524452b9-e617-4434-a23f-6026b6f55eeb","source":"wordfence","cve":"CVE-2021-24415","title":"Polo Video Gallery \u2013 Best wordpress video gallery plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524452b9-e617-4434-a23f-6026b6f55eeb?source=api-prod","affected":[{"type":"plugin","slug":"polo-video-gallery","name":"Polo Video Gallery \u2013 Best wordpress video gallery plugin","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52454f57-0b23-4c5f-b100-9b1fcdf00c21","source":"wordfence","cve":"CVE-2025-30639","title":"IDonatePro <= 2.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52454f57-0b23-4c5f-b100-9b1fcdf00c21?source=api-prod","affected":[{"type":"plugin","slug":"idonate-pro","name":"IDonatePro - Blood Donation, Request And Donor Management WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-11T14:36:07Z"},{"id":"wordfence:5246efbb-93cc-4951-900e-d13d08840f03","source":"wordfence","cve":"CVE-2026-6427","title":"a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5246efbb-93cc-4951-900e-d13d08840f03?source=api-prod","affected":[{"type":"plugin","slug":"a3-lazy-load","name":"a3 Lazy Load","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-05-27T18:25:51Z","updated":"2026-05-28T06:45:40Z"},{"id":"wordfence:524715f3-0016-4008-ba41-4ba60899ab88","source":"wordfence","cve":"CVE-2025-47485","title":"Cozy Blocks <= 2.1.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524715f3-0016-4008-ba41-4ba60899ab88?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.1.22","to_inclusive":true,"patched_in":"2.1.23"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:35:50Z"},{"id":"wordfence:5247b658-c655-4855-ad98-695071b0ede6","source":"wordfence","cve":"CVE-2026-28099","title":"UberSlider Ultra <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5247b658-c655-4855-ad98-695071b0ede6?source=api-prod","affected":[{"type":"plugin","slug":"uberSlider_ultra","name":"UberSlider - Layer Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:08:09Z"},{"id":"wordfence:5247bf43-ae02-47cb-825e-23821b78eba9","source":"wordfence","cve":"CVE-2024-12269","title":"Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5247bf43-ae02-47cb-825e-23821b78eba9?source=api-prod","affected":[{"type":"plugin","slug":"safe-ai-malware-protection-for-wp","name":"Safe Ai Malware Protection for WP","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2025-01-30T00:29:51Z","updated":"2025-02-14T22:40:46Z"},{"id":"wordfence:524a2143-b15f-4edc-98de-dafef4c5bc00","source":"wordfence","cve":"CVE-2024-12238","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524a2143-b15f-4edc-98de-dafef4c5bc00?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.22","to_inclusive":true,"patched_in":"3.8.23"}],"published":"2024-12-28T16:21:38Z","updated":"2024-12-29T05:22:55Z"},{"id":"wordfence:524ac3c0-d343-494f-8820-7a6bf290adbf","source":"wordfence","cve":"CVE-2025-47661","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 <= 5.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524ac3c0-d343-494f-8820-7a6bf290adbf?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.2.11","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-23T13:37:13Z"},{"id":"wordfence:524db694-1548-43c8-b453-55576c117ad6","source":"wordfence","cve":"CVE-2026-39789","title":"Fluent Affiliate Pro <= 1.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524db694-1548-43c8-b453-55576c117ad6?source=api-prod","affected":[{"type":"plugin","slug":"fluent-affiliate-pro","name":"Fluent Affiliate Pro","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:00:31Z"},{"id":"wordfence:524e9ec1-9c7c-4b06-915c-8122ea6c3601","source":"wordfence","cve":"CVE-2023-44986","title":"Abandoned Cart Lite for WooCommerce <= 5.15.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/524e9ec1-9c7c-4b06-915c-8122ea6c3601?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.15.2","to_inclusive":true,"patched_in":"5.16.0"}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52527a50-8912-4040-a937-1eb771e245d4","source":"wordfence","cve":"CVE-2025-46500","title":"Wordpress Auto Spinner <= 3.25.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52527a50-8912-4040-a937-1eb771e245d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-spinner","name":"Wordpress Auto Spinner","from":"*","from_inclusive":true,"to":"3.25.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T13:13:45Z"},{"id":"wordfence:52538617-a1d1-40ed-8321-e39d06869398","source":"wordfence","cve":"CVE-2023-3248","title":"All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52538617-a1d1-40ed-8321-e39d06869398?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5253fe2b-040b-417c-b257-0cb59ee5aa6e","source":"wordfence","cve":"CVE-2023-33999","title":"Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"1.4.4","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"},{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"1.8.4","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"},{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"1.8","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.4.1"},{"type":"plugin","slug":"reader-mode","name":"Reader Mode \u2013 Distraction-Free Content Reader","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"awesome-social-icons","name":"Awesome Social Icons","from":"2.0","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-blocks","name":"Gutenberg Blocks \u2013 ACF Blocks Suite","from":"1.0.0","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"},{"type":"plugin","slug":"ultimeter","name":"Ultimeter \u2013 the Ultimate Progress and Goals Meter","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"},{"type":"plugin","slug":"past-events-extension","name":"Past Events Extension","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-order-view","name":"Easy Order View","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pootle-page-builder","name":"Pootle Pagebuilder \u2013 WordPress Page builder","from":"2.0.0","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-call-now-button","name":"WordPress Easy Call Now Button by elixirs.io","from":"1.0.5","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bootstrap-fitness","name":"Bootstrap Fitness","from":"1.0.5","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"guest-author-affiliate","name":"Guest Author Affiliate","from":"1.1.4","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.6"},{"type":"plugin","slug":"local-delivery-drivers-for-woocommerce","name":"Local Delivery Drivers for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"},{"type":"plugin","slug":"ultimate-gutenberg","name":"Ultimate Gutenberg \u2013 Custom Block Templates","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sv-media-library","name":"SV Media Library","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"required-taxonomies","name":"WP Required Taxonomies \u2013 Categories and Tags Mandatory","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"},{"type":"plugin","slug":"featured-products-first-for-woocommerce","name":"Featured Products First for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"},{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"},{"type":"plugin","slug":"check-zipcode","name":"Check Zipcode","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nova-poshta-ttn","name":"Shipping for Nova Poshta","from":"*","from_inclusive":true,"to":"1.7.46","to_inclusive":true,"patched_in":"1.7.47"},{"type":"plugin","slug":"streak-crm-for-gmail-integration-for-contact-form-7","name":"Streak CRM For Gmail For Contact Form 7 \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"5-stars-rating-funnel","name":"Build 5 Star Reviews on Google Reviews, Yelp, Facebook\u2026 easily and risk-free | RRatingg","from":"*","from_inclusive":true,"to":"1.2.62","to_inclusive":true,"patched_in":"1.2.63"},{"type":"plugin","slug":"simple-author-box","name":"Simple Author Box","from":"*","from_inclusive":true,"to":"2.3.22","to_inclusive":true,"patched_in":"2.4"},{"type":"plugin","slug":"kenta-blocks","name":"Kenta Blocks \u2013 Responsive Blocks and block templates library","from":"1.0.0","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"dancepress-trwa","name":"DancePress (TRWA)","from":"1.181106","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6.2"},{"type":"plugin","slug":"embed-docs","name":"Embed Docs \u2013 Elementor Files Addon,Elementor Docs Addon,Embed PDF, Word, PowerPoint and Excel Files in Gutenberg & Elementor","from":"2.0.1","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"},{"type":"plugin","slug":"woo-advanced-product-size-chart","name":"Product Size Charts Plugin for WooCommerce","from":"2.0.1","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.3.1"},{"type":"plugin","slug":"section-slider","name":"Content Slider for WP Posts (Section Slider)","from":"0.0.0","from_inclusive":true,"to":"0.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-my-admin-bar","name":"Wp My Admin Bar","from":"3.0.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"patch-lite","name":"Patch Lite","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"setka-editor","name":"A no-code page builder for beautiful performance-based content","from":"1.9.1","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"olivewp-companion","name":"OliveWP Companion","from":"1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-prayer","name":"Easy Prayer","from":"1.0","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"contact-form-7-skins","name":"CF7 Skins for Contact Form 7","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"},{"type":"plugin","slug":"exportfeed-for-woocommerce-product-to-etsy","name":"Etsy Integration For WooCommerce","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.2.0"},{"type":"plugin","slug":"auto-terms-of-service-and-privacy-policy","name":"TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"raise-prices-with-sales-for-woocommerce","name":"Raise Prices with Sales for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"server-info","name":"Server Info \u2013 System Health & Diagnostics Suite","from":"2.5.1","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ai-image-generator","name":"AI Image Generator \u2013 Easy image creation with AI","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"11.2","from_inclusive":true,"to":"12.5","to_inclusive":true,"patched_in":"12.6"},{"type":"plugin","slug":"pagemanager","name":"PageManager","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"simple-cart-solution","name":"Simple Cart","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"page-visit-counter","name":"Page Visit Counter","from":"6.0","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"1.2.7","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"},{"type":"plugin","slug":"dracula-dark-mode","name":"Dracula Dark Mode \u2013  Accessibility, Reading Mode & Dark Mode for WordPress","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"},{"type":"plugin","slug":"tori-ajax","name":"Tori Ajax","from":"2.0.0","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"search-console","name":"Search Console","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"scrollbar-customizer","name":"Scrollbar Customizer","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"julia-lite","name":"Julia Lite","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"wp-rest-filter","name":"WP REST Filter","from":"1.4.0","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"panorama","name":"Panorama \u2013 Turn Photos into Immersive Virtual Tours","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"bulk-attachment-download","name":"Bulk Attachment Download","from":"1.2.1","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"plugin","slug":"autosave-net","name":"AutoSave Net","from":"1.3.0","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"resermy","name":"Online Booking for Barbershops and Salons","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"},{"type":"plugin","slug":"wep-demo-import","name":"WPEventPartners Demo Import","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"},{"type":"plugin","slug":"content-hubs","name":"Content Hubs","from":"1.0.6","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"better-captcha-gravity-forms","name":"GravityCaptcha","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-product-payments","name":"Dreamfoxmedia Payment Gateway per Product for WooCommerce","from":"3.0.0","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"},{"type":"plugin","slug":"hqtheme-extra","name":"HQTheme Extra","from":"1.0.6","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mobile-pages","name":"Mobile Blocks","from":"1.0.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-eu-vat-assistant","name":"EU VAT Assistant for WooCommerce","from":"2.0.19.210629","from_inclusive":true,"to":"2.0.42.230503","to_inclusive":true,"patched_in":"2.1.2.230718"},{"type":"plugin","slug":"gutenslider","name":"Gutenslider \u2013 Image & Video Slider Block","from":"2.6.3","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"},{"type":"plugin","slug":"moose-elementor-kit","name":"Moose Elementor Kit","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"child-support-calculator","name":"Child Support Calculator","from":"1.0.1","from_inclusive":true,"to":"2.0.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gs-behance-portfolio","name":"GS Behance Portfolio \u2013 Display Projects, Gallery & Slider","from":"3.0.0","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"},{"type":"plugin","slug":"multilevel-referral-plugin-for-woocommerce","name":"Multilevel Referral Plugin for WooCommerce","from":"2.22","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"2.23"},{"type":"plugin","slug":"mega-forms","name":"Mega Forms \u2013 Drag & Drop Form Builder with Multi-Step & Conditional Logic","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"plugin","slug":"surbma-magyar-woocommerce","name":"HuCommerce | Magyar kieg\u00e9sz\u00edt\u00e9sek WooCommerce web\u00e1ruh\u00e1zakhoz","from":"*","from_inclusive":true,"to":"30.3.0","to_inclusive":true,"patched_in":"2022.0.3"},{"type":"plugin","slug":"checkbox","name":"morkva Checkbox Integration","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":"0.8.5"},{"type":"plugin","slug":"kvoucher","name":"KVoucher","from":"1.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pramadillo-activecampaign-email-preference-center","name":"ActiveCampaign Email Preference Center","from":"1.0.0","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"},{"type":"plugin","slug":"custom-welcome-guide","name":"Custom Welcome Guide","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"},{"type":"plugin","slug":"product-layouts","name":"Product Layouts for WooCommerce","from":"1.0.2","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"staggs","name":"STAGGS \u2013 Product Configurator Toolkit","from":"1.1.0","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"wpmm-memory-meter","name":"Memory Meter","from":"1.0.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"plugin","slug":"wp-signals","name":"WP Signals","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"enhanced-catalog-images-for-woocommerce","name":"enhanced-catalog-images-for-woocommerce","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"flexible-faqs","name":"Flexible FAQs \u2013 WordPress FAQ Plugin","from":"0.5.5","from_inclusive":true,"to":"0.5.11","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"videoblog","name":"Videoblog","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"plugin","slug":"error-log-monitor","name":"Error Log Monitor","from":"1.6","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"},{"type":"plugin","slug":"premmerce-woocommerce-multi-currency","name":"Premmerce Multi-currency for Woocommerce","from":"2.0","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"},{"type":"plugin","slug":"where-did-they-go-from-here","name":"WZ Followed Posts \u2013 Display what visitors are reading","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"},{"type":"plugin","slug":"booking-for-woocommerce","name":"Booking Addon for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-event-partners","name":"WP Event Partners \u2013 WordPress Plugin for Event and Conference Management","from":"1.0.0","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"1.5","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"},{"type":"plugin","slug":"unlimited-theme-addons","name":"Unlimited Theme Addon For Elementor","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms-remote","name":"BuddyForms Remote","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"startend-subscription-add-on-for-gravityforms","name":"STARTEND Subscription Add-On for GravityForms","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"},{"type":"theme","slug":"corporate-event","name":"Corporate Event","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"},{"type":"plugin","slug":"add-expires-headers","name":"AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization","from":"2.0","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"forcefield","name":"ForceField","from":"1.0.1","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"featured-image-toolkit","name":"FIT: Featured Image Toolkit","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-conditional-discount-rules-for-checkout","name":"Dynamic Pricing and Discount Rules for WooCommerce","from":"2.0.0","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.3.1"},{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"1.9.10.72","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"},{"type":"plugin","slug":"ajax-add-to-cart-for-woocommerce","name":"StickyWooCart \u2013 Ajax Add to Cart for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-grid-and-styler-for-divi","name":"Grid & Styler For Contact Form 7 And Divi","from":"1.0.2","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.2"},{"type":"plugin","slug":"prime-affiliate-links","name":"Prime Affiliate Links \u2013 Super-Powered Affiliate Links Manager","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"audio-text","name":"WP Sales Pitch","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yummy-recipes","name":"Yummy Recipes","from":"1.1.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"protect-uploads-with-login-page","name":"Protect Uploads with Login \u2013 Protect Your Uploads","from":"1.4","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"atlas-knowledge-base","name":"Atlas \u2013 Knowledge Base","from":"1.0.0","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-advance-comment","name":"WP Advanced Comment","from":"0.3","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"remove-duplicate-posts","name":"Remove Duplicate Posts","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"},{"type":"plugin","slug":"simple-sitemap","name":"Simple Sitemap \u2013 Responsive HTML Sitemap for WordPress","from":"3.2","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.5.10"},{"type":"plugin","slug":"menukaart","name":"Menukaart \u2013 Restaurant Menu & Online Ordering with WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"},{"type":"plugin","slug":"wp-private-media","name":"WP Private Media","from":"1.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"},{"type":"plugin","slug":"super-video-player","name":"Super Video player \u2013 Fully Customizable Video Player with Playlist","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":true,"patched_in":"2.6.13"},{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"},{"type":"plugin","slug":"1-click-close-store","name":"1 click close store","from":"1.1.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"free-shipping-label","name":"Free Shipping Label and Progress Bar for WooCommerce","from":"2.5.0","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.11"},{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"1.1.7","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":"1.25.0"},{"type":"plugin","slug":"tag-groups","name":"PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms","from":"1.18.3","from_inclusive":true,"to":"1.44.3.1","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"devices","name":"Device Frame","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms-ultimate-member","name":"BuddyForms Ultimate Member","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"plugin","slug":"delivery-drivers-manager","name":"Delivery Drivers Manager","from":"1.0.3","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"},{"type":"theme","slug":"consultpress-lite","name":"ConsultPress Lite","from":"1.2.0","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-styler-for-divi","name":"CF7 Mate \u2013 Contact Form 7 Styler, Multi-Step Forms & Conditional Logic","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"plugin","slug":"moceansms-order-sms-notification-for-woocommerce","name":"MoceanAPI Order SMS Notification for WooCommerce","from":"1.3.12","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"zip-codes-redirect","name":"Zip Code Redirect","from":"1.0.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"},{"type":"plugin","slug":"guestofy-restaurant-reservations","name":"Guestofy \u2013 Restaurant Reservations Plugin, Room Planer, Reservation Form","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"flight-search-widget-blocks","name":"Flight Search Widget and Blocks","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-constant-contact-fields-mapping","name":"CF7 Constant Contact Fields Mapping","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"free-product-sample","name":"Free Product Samples for WooCommerce \u2013 Try Before You Buy, Request Samples by Mail","from":"1.0.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"},{"type":"plugin","slug":"redirect-404-error-page-to-homepage-or-custom-page","name":"Redirect 404 Error Page to Homepage or Custom Page with Logs","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"},{"type":"plugin","slug":"ethereumico","name":"EthereumICO","from":"2.0.0","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"tec-subscriber-addons","name":"Subscriber Addons for The Events Calendar","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rt-easy-builder-advanced-addons-for-elementor","name":"RT Easy Builder \u2013 Advanced addons for Elementor","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"},{"type":"plugin","slug":"wp-contact-slider","name":"WP Contact Slider \u2013 Contact Form Slider Widget","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"},{"type":"plugin","slug":"purple-xmls-google-product-feed-for-woocommerce","name":"Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More","from":"*","from_inclusive":true,"to":"3.2.3.4","to_inclusive":true,"patched_in":"3.2.3.5"},{"type":"plugin","slug":"woocommerce-country-based-payments","name":"Country Based Payments for WooCommerce","from":"1.2.0","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"fast-index","name":"Fast Index for Google Indexing API","from":"1.0","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.2.9","to_inclusive":true,"patched_in":"1.2.3"},{"type":"theme","slug":"elasta","name":"Elasta","from":"1.0.4","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"1.0.5","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"animate-everything","name":"WordPress Animation Plugin \u2013 Animated Everything","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"2mb-autocode","name":"2MB Autocode","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"publishpress","name":"PublishPress Planner \u2013 Editorial Calendar, Marketing Content, Kanban Board","from":"1.3.0","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"},{"type":"plugin","slug":"activity-log-mainwp","name":"Activity Log For MainWP","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"connected-sermons","name":"Connected Sermons","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bulk-edit-user-profiles-in-spreadsheet","name":"Bulk Edit and Create User Profiles \u2013 WP Sheet Editor","from":"1.0.1","from_inclusive":true,"to":"1.5.23","to_inclusive":true,"patched_in":"1.5.25"},{"type":"plugin","slug":"responsive-accordion-tabs","name":"Responsive Accordion Tabs","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yandex-money-button","name":"\u041a\u043d\u043e\u043f\u043a\u0430 \u042eMoney","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fb-account-kit-login","name":"Passwordless Login with OTP / SMS & Email \u2013 Facebook Account Kit","from":"1.1.4","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"affiliate-advantage","name":"Affiliate Advantage \u2013 Sky Rocket Your Affiliate Marketing Business","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"moceanapi-abandoned-carts","name":"MoceanAPI Abandoned Carts for WooCommerce","from":"1.2.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bulk-woocommerce-category-creator","name":"Bulk WooCommerce Category Creator","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-cloud-server","name":"WP Cloud Server","from":"1.3.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"pickup-and-delivery-from-customer-locations-for-woocommerce","name":"Pickup & Delivery from Customer Locations for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"spice-post-slider","name":"Carousel, Recent Post Slider and Banner Slider","from":"1.1","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-awesome-faq","name":"Master Accordion ( Former WP Awesome FAQ Plugin )","from":"4.1.5","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rss-chimp","name":"RSS Chimp \u2013 Featured Images for RSS Feeds","from":"1.0","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.5"},{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"2.0.1","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.9.1"},{"type":"plugin","slug":"premmerce-woocommerce-pinterest","name":"Premmerce Pinterest for WooCommerce","from":"1.1","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wc-place-order-without-payment","name":"Place Order Without Payment for WooCommerce","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"},{"type":"plugin","slug":"super-transactional-emails-for-woocommerce","name":"STEWoo \u2013 Super Transactional Emails for WooCommerce","from":"1.2.3","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms-attach-posts-to-groups-extension","name":"BuddyForms Attach Post with Group","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"},{"type":"plugin","slug":"my-instagram-feed","name":"Easy Social Photos Gallery \u2013 MIF","from":"1.0.0","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"},{"type":"plugin","slug":"disable-dashboard-for-woocommerce","name":"Disable Bloat for WordPress & WooCommerce \u2013 Speed Up & Clean Up Admin","from":"3.0.0","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"},{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"},{"type":"plugin","slug":"wp-radio","name":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress","from":"2.0.7","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"bng-gateway-for-woocommerce","name":"BNG Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"business-profile-reviews","name":"Business Profile Reviews","from":"1.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"book-press","name":"BookPress \u2013 For Book Authors","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"qyrr-code","name":"Qyrr \u2013 simply and modern QR-Code creation","from":"1.2","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"},{"type":"plugin","slug":"website-testimonials","name":"Divi Testimonial Plus","from":"6.1.0","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"},{"type":"plugin","slug":"salt-shaker","name":"Salt Shaker","from":"1.4.1","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"phraseanet-client","name":"Phraseanet WordPress Client","from":"1.2.0","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"3.2.9","from_inclusive":true,"to":"3.3.8.4","to_inclusive":true,"patched_in":"3.3.8.5"},{"type":"plugin","slug":"web-disrupt-funnelmentals","name":"Funnelmentals","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"},{"type":"plugin","slug":"forms-to-zapier","name":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"},{"type":"plugin","slug":"buddyforms-hierarchical-posts","name":"BuddyForms Hierarchical Posts","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":"3.0.0"},{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.7.0"},{"type":"theme","slug":"bingopress","name":"BingoPress","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"},{"type":"plugin","slug":"gfirem-fields","name":"GFireM Fields","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"yuki","name":"Yuki","from":"1.0.0","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.1.2","to_inclusive":true,"patched_in":"5.5.1.3"},{"type":"plugin","slug":"wp-conditional-post-restrictions","name":"Restrict Posts based on Conditions \u2013 Conditional Post Restrictions","from":"1.0.0","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"wp-attest","name":"LMS Plugin \u2013 eLearning, Online Courses by Attest","from":"1.0","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.7.11","to_inclusive":true,"patched_in":"3.8.0"},{"type":"plugin","slug":"different-home-for-logged-in-logged-out","name":"Different Home for Logged IN & Logged OUT","from":"1.1.0","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.46.0","to_inclusive":true,"patched_in":"2.46.1"},{"type":"plugin","slug":"enjoy-instagram-instagram-responsive-images-gallery-and-carousel","name":"Enjoy Social Feed plugin for WordPress website","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"},{"type":"plugin","slug":"wptools-masonry-gallery-posts-for-divi","name":"Masonry Gallery & Posts For Divi (WP Tools)","from":"3.0.0","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"},{"type":"plugin","slug":"tk-event-weather","name":"TK Event Weather","from":"1.0","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"one-page-conference","name":"One Page Conference","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"edd-tab-manager","name":"EDD Tab Manager","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"animated-svg","name":"ASVG \u2013 Lottie icon library for Elementor","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-ukrposhta","name":"Ukrposhta","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"download-magnet","name":"Download Magnet","from":"1.1.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"annasta-woocommerce-product-filters","name":"annasta Filters for WooCommerce","from":"1.0.5","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.5"},{"type":"plugin","slug":"wp-lead-stream","name":"WP Lead Stream","from":"1.1","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-product-type-for-woocommerce","name":"Custom Product Type for WooCommerce \u2013 Add-Ons, Data, Options, Layouts, Booking & Appointments","from":"1.0.0","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"},{"type":"theme","slug":"lifestyle-magazine","name":"Lifestyle Magazine","from":"10.2.0","from_inclusive":true,"to":"10.2.0","to_inclusive":true,"patched_in":"10.2.1"},{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"4.9.0","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.4.1"},{"type":"plugin","slug":"email-tracker","name":"Email Tracker","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"},{"type":"plugin","slug":"block-styler-for-gravity-forms","name":"Block Styler For Gravity Forms","from":"5.0.0","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.3.0"},{"type":"plugin","slug":"custom-page-templates-by-vegacorp","name":"WP Page Templates","from":"1.0.0","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"},{"type":"plugin","slug":"wc-product-customer-list","name":"Product Customer List for WooCommerce","from":"2.6.7","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"},{"type":"theme","slug":"wp-moose","name":"WP Moose","from":"0.0.1","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gs-team-members","name":"Team Members \u2013 Team Showcase, Team Slider, Grid, Table & Staff Directory","from":"1.8","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"},{"type":"plugin","slug":"demomentsomtres-mailchimp-immediate-send","name":"MailChimp Immediate Send","from":"2.9","from_inclusive":true,"to":"3.201704251244","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"floating-links","name":"Floating Social Share Icons and Social Share buttons \u2013 Next Previous Post Links \u2013 FL","from":"3.4.0","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"theme","slug":"travel-tour","name":"Travel Tour","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"south-pole-the-offset-movement","name":"South Pole: Climate action now","from":"1.0.0","from_inclusive":true,"to":"1.0.3.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"demomentsomtres-mailchimp-subscribe","name":"DeMomentSomTres Subscribe","from":"2.0","from_inclusive":true,"to":"3.201706150908","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"hire-me-widget","name":"Hire Me Widget","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"a-staff","name":"a-staff \u2013 Team member showcase plugin for WordPress","from":"1.2","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"littlebot-invoices","name":"LittleBot Invoices","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"genealogical-tree","name":"Genealogical Tree \u2013 Family Tree & Ancestry for WordPress","from":"*","from_inclusive":true,"to":"2.2.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"new-order-popup","name":"New Order Notification","from":"1.0.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"automatic-youtube-gallery","name":"Automatic YouTube Gallery \u2013 Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"},{"type":"plugin","slug":"wc-thanks-redirect","name":"Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"4.0.0"},{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"2.0","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"},{"type":"plugin","slug":"easy-marijuana-age-verify","name":"Marijuana Age Verify","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"},{"type":"plugin","slug":"woocommerce-upcoming-product","name":"WooCommerce upcoming Products","from":"*","from_inclusive":true,"to":"1.5.9.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"simple-blueprint-installer","name":"Simple blueprint installer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"frontend-admin","name":"Frontend Admin \u2013 Add and edit posts, pages, users and more all from the frontend","from":"*","from_inclusive":true,"to":"3.7.11","to_inclusive":true,"patched_in":"3.8.0"},{"type":"plugin","slug":"fullworks-directory","name":"Fullworks Directory","from":"1.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sv-tracking-manager","name":"SV Tracking Manager","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"},{"type":"theme","slug":"chained","name":"Chained","from":"1.1","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"seo-checklist","name":"WordPress SEO Checklist","from":"1.0.1","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"},{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"},{"type":"plugin","slug":"wp-tools-divi-product-carousel","name":"Divi Product Carousel","from":"1.0.0","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"},{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"3.0.0","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.4"},{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"0.1","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"},{"type":"theme","slug":"travel-agency-booking","name":"Travel Agency Booking","from":"1.0.6","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"spice-blocks","name":"Spice Blocks","from":"0.3","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"},{"type":"plugin","slug":"slp-gravity-forms-locations","name":"Store Locator Plus\u00ae | Gravity Forms Locations","from":"5.5.1","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"five-star-ratings-shortcode","name":"Five-Star Ratings Shortcode","from":"1.0.0","from_inclusive":true,"to":"1.2.47","to_inclusive":true,"patched_in":"1.2.48"},{"type":"plugin","slug":"advanced-nocaptcha-recaptcha","name":"CAPTCHA 4WP \u2013 Antispam CAPTCHA solution for WordPress","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"},{"type":"plugin","slug":"demomentsomtres-wp-export","name":"DeMomentSomTres WordPress Export Posts With Images","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"20200610"},{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"},{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"8.4.8","to_inclusive":true,"patched_in":"8.4.9"},{"type":"plugin","slug":"delivery-and-pickup-scheduling-for-woocommerce","name":"Chwazi \u2013 Delivery & Pickup Scheduling for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.12"},{"type":"plugin","slug":"surbma-gdpr-proof-google-analytics","name":"Surbma | GDPR Proof Cookie Consent & Notice Bar","from":"3.0","from_inclusive":true,"to":"17.7.0","to_inclusive":true,"patched_in":"17.8.2"},{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"3.0.1","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"},{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.0.98","to_inclusive":true,"patched_in":"0.0.99"},{"type":"plugin","slug":"wp-live-tv","name":"Live TV Player \u2013 Worldwide Live TV Channels Player for WordPress","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"market-exporter","name":"Market Exporter","from":"1.0.5","from_inclusive":true,"to":"2.0.18","to_inclusive":true,"patched_in":"2.0.19"},{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"1.0.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.5"},{"type":"plugin","slug":"sv-columns-manager","name":"SV Columns Manager","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"nofollow-jquery-links","name":"NoFollow jQuery Links","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-hr-gdpr","name":"WP-HR GDPR: GDPR Tools for Human Resources on WordPress","from":"0.1","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"acf-vc-integrator","name":"ACF-VC Integrator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"plugin","slug":"studiocart","name":"WordPress eCommerce Plugin \u2013 Studiocart","from":"1.0.2","from_inclusive":true,"to":"2.5.11","to_inclusive":true,"patched_in":"2.5.20"},{"type":"plugin","slug":"tk-google-fonts","name":"TK Google Fonts","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"},{"type":"plugin","slug":"starfish-reviews","name":"Starfish Review Generation & Marketing for WordPress","from":"2.1.0","from_inclusive":true,"to":"3.0.36","to_inclusive":true,"patched_in":"3.1.0"},{"type":"plugin","slug":"education-addon","name":"Education Addon for Elementor","from":"1.0","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"pixigo","name":"PixiGo","from":"1.0.7","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sv-provenexpert","name":"SV Proven Expert","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.2.11"},{"type":"plugin","slug":"conditional-payments","name":"Conditional Payment Methods for WooCommerce","from":"1.1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"plugin","slug":"geounit-maps","name":"GDPR & DSGVO Compliant Maps | GeoUNIT Maps","from":"0.0.6","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":"0.0.8"},{"type":"plugin","slug":"spicebox","name":"SpiceBox","from":"2.1.2","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"bulk-edit-events","name":"Bulk Edit Events \u2013 Create Events in a Bulk Editor","from":"1.0.0","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"},{"type":"plugin","slug":"music-player-for-elementor","name":"Music Player for Elementor \u2013 Audio Player & Podcast Player","from":"1.5","from_inclusive":true,"to":"1.5.9.8","to_inclusive":true,"patched_in":"1.5.9.9"},{"type":"plugin","slug":"cryptocurrency-product-for-woocommerce","name":"Cryptocurrency Product for WooCommerce","from":"*","from_inclusive":true,"to":"3.16.9","to_inclusive":true,"patched_in":"3.16.10"},{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"},{"type":"plugin","slug":"next-order-coupon-woocommerce","name":"WooCommerce Next Order Coupon","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"overlay-image-divi-module","name":"Overlay Image Divi Module","from":"1.2","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.5"},{"type":"plugin","slug":"email-header-footer","name":"Email Header Footer","from":"1.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-custom-field-for-gutenberg-editor","name":"WP Custom field for Gutenberg Editor","from":"1.3","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-phone-message","name":"WP Phone Message","from":"1.1.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"embed-office-viewer","name":"Document Viewer \u2013 let visitors view files right in the browser","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"},{"type":"plugin","slug":"price-bands-for-woocommerce","name":"Price Bands for WooCommerce","from":"1.0.2","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"block-options","name":"Gutenberg Block Editor Toolkit \u2013 EditorsKit","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":"1.17"},{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.11.16","to_inclusive":true,"patched_in":"1.12"},{"type":"plugin","slug":"perelandra-sermons","name":"Perelandra Sermons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"smart-variations-images","name":"Smart Variations Images & Swatches for WooCommerce","from":"4.0.1","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"},{"type":"theme","slug":"brasserie","name":"Brasserie","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"featured-images-for-rss-feeds","name":"Featured Images in RSS for Mailchimp & More","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"},{"type":"plugin","slug":"simple-sponsorships","name":"Simple Sponsorships","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mobile-app-editor","name":"Mobile App Editor \u2013 WordPress to Android App Builder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.74","to_inclusive":true,"patched_in":"1.5.75"},{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"1.0.0","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"},{"type":"plugin","slug":"youram-youtube-embed","name":"YouTube Embed \u2013 YouTube Gallery, Vimeo Gallery \u2013 WordPress Plugin","from":"8.0","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"backup-bolt","name":"Backup Bolt \u2013 Lightweight Backup, Fast WordPress Backup to ZIP","from":"1.1.0","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"wp-store-locator-extenders","name":"WP Store Locator \u2013 Extenders","from":"1.1.0","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sparrow","name":"Sparrow: Product Reviews and Ratings for WooCommerce","from":"2.0.2","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"auto-advance-for-gravity-forms","name":"Multi Page Auto Advance for Gravity Forms","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"},{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"2.4.3","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"4.1.13"},{"type":"plugin","slug":"live-scores-for-sportspress","name":"Live Scores for SportsPress","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"internallink-audit","name":"InternalLink Audit","from":"0.1.0","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"hide-shipping-method-for-woocommerce","name":"Hide Shipping Method For WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"plugin","slug":"ultimate-carousel-for-divi","name":"Ultimate Carousel For Divi","from":"4.0.0","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"},{"type":"plugin","slug":"blocks-bakery","name":"Blocks Bakery \u2013 Gutenberg Blocks","from":"1.0.0","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"seo-optimized-images","name":"SEO Optimized Images","from":"2.0","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"image-carousel-for-divi","name":"Image Carousel For Divi","from":"1.0.0","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"comments-not-replied-to","name":"Comments Not Replied To","from":"1.5.0","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"},{"type":"plugin","slug":"integration-of-capsule-crm-for-contact-form-7","name":"Contact Form 7 \u2013 Capsule CRM \u2013 Integration","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"},{"type":"plugin","slug":"opensea","name":"Opensea","from":"1.0","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tranzly","name":"Tranzly\u2122 \u2013 AI Translation & Multilingual","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"1.6.17","from_inclusive":true,"to":"1.32.2","to_inclusive":true,"patched_in":"1.32.3"},{"type":"plugin","slug":"modern-addons-elementor","name":"Modern Addons for Elementor Page Builder","from":"1.0.1","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"slp-extended-data-manager","name":"Store Locator Plus\u00ae | Extended Data Manager","from":"5.5.1","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"viralike","name":"Viralike","from":"1.0.4","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"medicpress-lite","name":"MedicPress Lite","from":"*","from_inclusive":true,"to":"0.8.4","to_inclusive":true,"patched_in":"0.9.0"},{"type":"plugin","slug":"wp-munich-blocks","name":"WP Munich Blocks \u2013 Gutenberg Blocks for WordPress","from":"*","from_inclusive":true,"to":"0.10.1","to_inclusive":true,"patched_in":"0.11.0"},{"type":"plugin","slug":"date-time-picker-field","name":"Availability Datepicker \u2013 Booking Calendar for Contact Form 7 \u2013 Input WP","from":"1.9","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"faq-for-woocommerce","name":"Happy FAQs \u2013 FAQ, Product FAQ & Help Center","from":"*","from_inclusive":true,"to":"1.3.35","to_inclusive":true,"patched_in":"1.4.0"},{"type":"theme","slug":"eighteen-tags","name":"Eighteen tags","from":"2.5.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"},{"type":"plugin","slug":"kenta-companion","name":"Kenta Companion","from":"1.0.0","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"},{"type":"theme","slug":"cyclone-blog","name":"Cyclone Blog","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"issues-tracker","name":"Issues Tracker","from":"1.0.3","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mrkwp-footer-for-divi","name":"Footer Plugin for Divi","from":"3.3.2","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-stripe-donation","name":"AidWP \u2013 Donation & Payment Forms (Stripe Powered)","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"},{"type":"plugin","slug":"wp-native-articles","name":"WP Native Articles \u2013 Facebook Instant Articles Plugin for WordPress","from":"1.1.6","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"},{"type":"plugin","slug":"gfirem-advance-search","name":"GFireM Advance Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"1.6.23","from_inclusive":true,"to":"1.6.99","to_inclusive":true,"patched_in":"1.7.3"},{"type":"plugin","slug":"smart-phone-field-for-gravity-forms","name":"Smart phone field for Gravity Forms","from":"2.0","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"},{"type":"theme","slug":"speculor","name":"Speculor","from":"1.2.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"remove-wp-update-nags","name":"Remove WP Update Nags","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"send-users-email","name":"Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter","from":"1.2.0","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"},{"type":"plugin","slug":"auto-keyword-backlink","name":"Fast Index","from":"1.0","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"everse-starter-sites","name":"WordPress Everse Starter Sites \u2013 Elementor Templates","from":"1.0.0","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"delivery-drivers-for-vendors","name":"Delivery Drivers for Vendors","from":"1.0.1","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"1.0.6","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"},{"type":"plugin","slug":"choice-payment-gateway-for-woocommerce","name":"Choice Payment Gateway for WooCommerce","from":"1.0.3","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"domain-mapping-system","name":"Domain Mapping System | Create Microsites with Multiple Alias Domains (multisite optional)","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"},{"type":"plugin","slug":"order-and-inventory-manager-for-woocommerce","name":"Order and Inventory Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-cron-status-checker","name":"WP-Cron Status Checker","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"},{"type":"plugin","slug":"customizely","name":"Customizer custom controls with Drag and Drop builder \u2013 Customizely","from":"1.0.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"1.3.29","from_inclusive":true,"to":"2.2.41","to_inclusive":true,"patched_in":"2.2.44"},{"type":"plugin","slug":"shortcodehub","name":"ShortcodeHub \u2013 MultiPurpose Shortcode Builder","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"payment-gateway-groups-for-woocommerce","name":"Payment Gateway Groups for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"forms-for-divi","name":"Divi Form Builder With Material Design","from":"8.1.2","from_inclusive":true,"to":"8.1.2","to_inclusive":true,"patched_in":"8.1.3"},{"type":"plugin","slug":"expandable-paywall","name":"Expandable Paywall","from":"1.1.1","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"},{"type":"plugin","slug":"tiny-bar","name":"TinyBar \u2013 Display notification bar, banner, announcement at the top or bottom of your website","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"change-wc-price-title","name":"Change Price Title for WooCommerce","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"},{"type":"plugin","slug":"edge-gallery","name":"WordPress Gallery Plugin \u2013 Edge Photo Gallery","from":"1.1","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"automail","name":"AutoMail \u2013 Event-driven Email Automation. Easy email Notification and Auto-reply.","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"glorious-services-support","name":"Glorious Services & Support","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"product-delivery-date","name":"Product Delivery Date","from":"1.1.0","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"},{"type":"plugin","slug":"sv100-companion","name":"SV100 Companion","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"1.0.1","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.8.0"},{"type":"plugin","slug":"advanced-database-replacer","name":"Advanced Database Replacer","from":"1.0.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"multisite-robotstxt-manager","name":"Multisite Robots.txt Manager","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"temp-mail","name":"Temp Mail","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"},{"type":"plugin","slug":"simple-facebook-twitter-widget","name":"Simple Social Page Widget & Shortcode","from":"1.5.0","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"},{"type":"theme","slug":"fortune","name":"Fortune","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"},{"type":"plugin","slug":"woo-country-restrictions-advanced","name":"Restrict Products by Country & Country Catalogs for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":"1.14.3"},{"type":"plugin","slug":"front-end-pm","name":"Front End PM","from":"11.2.3","from_inclusive":true,"to":"11.3.7","to_inclusive":true,"patched_in":"11.3.8"},{"type":"plugin","slug":"wc-cashapp","name":"Checkout with Cash App on WooCommerce","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sumo-divi-modules","name":"Ultimate Divi Modules Suite \u2013 Divi Sumo Lite","from":"1.0.1","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"},{"type":"plugin","slug":"xt-woo-points-rewards","name":"XT Points & Rewards for WooCommerce","from":"1.3.5","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.6"},{"type":"theme","slug":"rovenstart","name":"Rovenstart","from":"1.0.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"woo-products-widgets-for-elementor","name":"Widgets for WooCommerce Products on Elementor","from":"1.0.8","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"device-wrapper","name":"Device Wrapper","from":"1.1","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"delivery-woo","name":"Delivery for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-twilio-core","name":"NotifSMS \u2013 SMS Notifications OTP & 2FA for WordPress & WooCommerce","from":"1.2.1","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"},{"type":"theme","slug":"start","name":"start","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"},{"type":"plugin","slug":"security-ninja","name":"Security Ninja \u2013 WordPress Security & Firewall","from":"5.50","from_inclusive":true,"to":"5.158","to_inclusive":true,"patched_in":"5.159"},{"type":"plugin","slug":"goal-tracker-ga","name":"Goal Tracker \u2013 Custom Event Tracking for GA4","from":"1.0.1","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"},{"type":"plugin","slug":"internal-link-flow-topical-authority-topical-map","name":"Internal Link Flow & Topical Authority & Topical Map","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gym-express","name":"Gym Express","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"},{"type":"plugin","slug":"justified-gallery","name":"Justified Gallery","from":"1.2.1","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.8.1"},{"type":"plugin","slug":"book-buyback-prices","name":"Book BuyBack Prices","from":"1.0.2","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fuse-social-floating-sidebar","name":"Fuse Social Icons","from":"3.1","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"},{"type":"plugin","slug":"wp-hr-manager","name":"WP-HR Manager: The Human Resources Plugin for WordPress","from":"0.1.1","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-customizer","name":"WordPress Form Customizer | CF7 Customizer","from":"1.1.0","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"static-html-output-plugin","name":"WP2Static","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"6"},{"type":"plugin","slug":"emails-blacklist-everest-forms","name":"Emails Blacklist for Everest Forms","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"},{"type":"plugin","slug":"easy-schema-structured-data-rich-snippets","name":"Easy Schema \u2013  Structured Data & Rich Snippets","from":"2.0","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"1.5.7","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.3"},{"type":"plugin","slug":"woo-admin-product-notes","name":"Woo Admin Product Notes","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"variable-inspector","name":"Variable Inspector","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"},{"type":"plugin","slug":"search-field-for-gravity-forms","name":"Search Field for Gravity Forms","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.6"},{"type":"plugin","slug":"wc-zelle","name":"Checkout with Zelle on Woocommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"},{"type":"plugin","slug":"buddyforms-anonymous-author","name":"BuddyForms Anonymous Author","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"sv-forms","name":"SV Forms","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"wp-tools-gravity-forms-divi-module","name":"Divi Gravity Forms (WP Tools)","from":"5.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.1.0"},{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.9.1"},{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"4.0.19"},{"type":"plugin","slug":"contact-form-7-designer","name":"Contact Form 7 Designer","from":"2.0","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"everse","name":"Everse","from":"0.1","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.8.10"},{"type":"plugin","slug":"wpdtol-database-table-overview-logs","name":"Database Table Overview and Logs","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"rest-routes","name":"Rest Routes \u2013 Custom Endpoints for WordPress REST API","from":"2.0.2","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.4"},{"type":"theme","slug":"simplifii","name":"Simplifii","from":"1.5.2","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"super-social-content-locker-lite","name":"Super Social Content Locker Lite","from":"1.2.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-bugbot","name":"WP BugBot","from":"1.7.3","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"1.0.0","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"missing-widgets-for-elementor","name":"Missing Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"},{"type":"theme","slug":"nokke","name":"Nokke","from":"1.0.1","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"},{"type":"plugin","slug":"woo-customers-spreadsheet-bulk-edit","name":"Customers Table for WooCommerce: View, Search, Bulk Editor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"linked-orders-for-woocommerce","name":"Linked Orders for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"},{"type":"plugin","slug":"one-page-blocks","name":"One Page Blocks","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sync-ecommerce-neo","name":"Sync eCommerce NEO","from":"1.1","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"totalpress","name":"TotalPress","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.3.1"},{"type":"plugin","slug":"seo-for-local","name":"Local SEO For Divi & Gutenberg Blocks","from":"9.0.0","from_inclusive":true,"to":"9.2.0","to_inclusive":true,"patched_in":"9.2.1"},{"type":"plugin","slug":"fullworks-firewall","name":"Fullworks Firewall","from":"1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pay-addons-for-elementor","name":"Payment Plugins for Stripe Elementor \u2013 by Pay Addons","from":"1.0.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"3.0","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"},{"type":"plugin","slug":"spice-starter-sites","name":"Spice Starter Sites","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"preloader-for-divi","name":"Preloader for Divi","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"role-based-bulk-quantity-pricing","name":"Role Based Bulk Quantity Pricing","from":"1.1.4","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"plugin","slug":"more-better-reviews-for-woocommerce","name":"Get Better Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"krste","name":"Krste","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sales-page-addon","name":"Sales Page Addon \u2013 Elementor & Beaver Builder","from":"1.0","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"},{"type":"plugin","slug":"quote-press","name":"QuotePress \u2013 Quote Estimate","from":"1.1.3","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"startup-blog","name":"Startup Blog","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"},{"type":"plugin","slug":"fullworks-slack","name":"Fullworks Slack","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-remove-cart-and-query-button","name":"remove-cart-and-query-button","from":"1.0.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"4.5.28","to_inclusive":true,"patched_in":"4.5.32"},{"type":"theme","slug":"shuban","name":"Shuban","from":"1.1.2","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"joli-clear-lightbox","name":"Joli CLEAR Lightbox","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"otp-easy-login-with-mocean","name":"SMS OTP Easy Login with Mocean","from":"1.1.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"1.4.10","from_inclusive":true,"to":"1.7.37","to_inclusive":true,"patched_in":"1.7.38"},{"type":"plugin","slug":"ecommerce-addon","name":"eCommerce Addon","from":"1.0","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"},{"type":"plugin","slug":"acf-for-woocommerce-product","name":"ACF for WooCommerce Product","from":"0.1","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"moceanapi-sendsms","name":"MoceanAPI SendSMS","from":"1.3.4","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"shipping-manager-for-woocommerce","name":"Shipping Manager For WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"3d-viewer","name":"3D Viewer \u2013 Turn Product Pages into Interactive 3D Experiences","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"1.0.0","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.3.0"},{"type":"plugin","slug":"gyta-buyback","name":"Gyta Buyback | WooCommerce Product Trade-In and Buy Back System","from":"1.0.11","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"2.3.7","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"},{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"2.1.2-beta.1","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.9-beta.1"},{"type":"plugin","slug":"custom-product-builder-for-woocommerce","name":"Custom Product Builder for WooCommerce \u2013 Product Designer & Customizer","from":"1.0.1","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"compare-affiliated-products","name":"Compare Affiliated Products","from":"2.0.1","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"livemesh-table-rate-shipping","name":"Table Rate Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2"},{"type":"plugin","slug":"random-sorting-order-for-woocommerce","name":"Random Sorting Order for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-scrive","name":"WP Scrive by Webbstart","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"theme","slug":"edupress","name":"EduPress","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"plugin","slug":"universal-email-preference-center","name":"Universal email preference center","from":"1.0.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"inbound-brew","name":"Inbound Brew","from":"1.6.0","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-photo-effects","name":"WP Photo Effects","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"},{"type":"plugin","slug":"wpoptin","name":"WPOptin \u2013 AI-Powered Top Bars, PopUps & Lead Generation","from":"1.0.0","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"},{"type":"plugin","slug":"woo-conditional-product-fees-for-checkout","name":"Extra Fees for WooCommerce","from":"3.1","from_inclusive":true,"to":"3.9.3.1","to_inclusive":true,"patched_in":"3.9.3.2"},{"type":"plugin","slug":"livemesh-weight-based-shipping","name":"Weight Based Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4"},{"type":"plugin","slug":"reset-course-progress-for-learndash","name":"Reset Course Progress For LearnDash","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gsheetconnector-ninja-forms","name":"GSheetConnector \u2013 Ninja Forms Google Sheets Connector, Export Form Submissions Instant Sync to Sheets","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"cart-weight-for-woocommerce","name":"Cart Weight for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"podcast-box","name":"Podcast Box \u2013 Best Podcasting Plugin for WordPress","from":"1.0.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"protected-page","name":"The best plugin for restrict content, support all Custom Post Types and Elementor \u2013 Password Protected","from":"1.0.0","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddyforms-members","name":"BuddyPress & BuddyBoss Member Profile Forms","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.12"},{"type":"plugin","slug":"turbo-widgets","name":"Turbo Widgets","from":"2.0.0","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-quick-cart-for-multiple-variations","name":"Quick Bulk Variations Checkout for WooCommerce","from":"1.1.6","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"},{"type":"plugin","slug":"product-table","name":"Product Table for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"gift-message-for-woocommerce","name":"Gift Message for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"},{"type":"plugin","slug":"blocks-product-editor-for-woocommerce","name":"Blocks Product Editor for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"layouts-importer","name":"WPGutenBlog Demo Import","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"},{"type":"plugin","slug":"press-elements","name":"Press Elements \u2013 Widgets for Elementor","from":"1.0.0","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"food-recipes","name":"Food Recipes","from":"2.0.0","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"azw-woocommerce-file-uploads","name":"azw woocommerce file uploads","from":"1.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"},{"type":"theme","slug":"broadcast-lite","name":"Broadcast Lite","from":"2.0.1","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"},{"type":"plugin","slug":"writersblok-ai","name":"WritersBlok AI Content Generator for WordPress","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"foobar-notifications-lite","name":"Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar","from":"2.0.3","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.32"},{"type":"theme","slug":"bootstrap-photography","name":"Bootstrap Photography","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"buddyforms-easypin","name":"BuddyForms EasyPin","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"web3-coin-gate","name":"Web3 Coin Gate","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpcasa-mail-alert","name":"WPCasa Mail Alert","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.3.0"},{"type":"plugin","slug":"bnfw","name":"Customize WordPress Emails and Alerts \u2013 Better Notifications for WP","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"1.7"},{"type":"plugin","slug":"rw-divi-unite-gallery","name":"RW Divi Unite Gallery","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fullworks-pricing-tables","name":"Easy Responsive Pricing Tables","from":"1.0","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mobile-booster","name":"Mobile Booster","from":"1.0","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"},{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.69.0","to_inclusive":true,"patched_in":"1.69.1"},{"type":"plugin","slug":"product-filter-widget-for-elementor","name":"Product Filter Widget for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"terms-and-conditions-per-product","name":"Terms and Conditions per Product for WooCommerce","from":"1.2.0","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"fullworks-ice-ide-integration","name":"ICEcoder integration","from":"1.4","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"event-feed-for-eventbrite","name":"Show Eventbrite Events \u2013 Event Feed for Eventbrite","from":"1.0.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"coneblog-widgets","name":"ConeBlog \u2013 Elementor Blog Widgets","from":"1.4.3","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-under-construction","name":"Under Construction","from":"3.0","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wadi-addons-for-elementor","name":"Wadi Addons for Elementor","from":"1.0.0","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"wp-sheet-editor-edd-downloads","name":"Bulk Edit Easy Digital Downloads \u2013 Fast Bulk Creator","from":"1.0.1","from_inclusive":true,"to":"1.0.60","to_inclusive":true,"patched_in":"1.0.61"},{"type":"plugin","slug":"wow-carousel-for-divi-lite","name":"Divi Carousel Lite \u2013 Make Carousels for Divi 5","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"},{"type":"theme","slug":"wellness","name":"Wellness","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"},{"type":"plugin","slug":"automizy-gravity-forms","name":"Automizy Gravity Forms","from":"1.0.1","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-on-pages","name":"Widgets on Pages","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"},{"type":"plugin","slug":"wc-sms","name":"SMS for WooCommerce","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"},{"type":"plugin","slug":"feedback-suite","name":"Get feedback from visitors \u2013 WP Feedback Suite Plugin","from":"1.0.1","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buffer-my-post","name":"WordPress Buffer \u2013 HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule","from":"*","from_inclusive":true,"to":"2020.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"content-aware-sidebars","name":"Content Aware Sidebars \u2013 Fastest Widget Area Plugin","from":"*","from_inclusive":true,"to":"3.19","to_inclusive":true,"patched_in":"3.19.1"},{"type":"theme","slug":"bani","name":"Bani","from":"1.0.7","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"fast-wp","name":"Fast WordPress","from":"1.0.2","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"import-social-statistics","name":"Import Social Statistics","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"codepile","name":"CodePile","from":"1.0.0","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"4.0","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"},{"type":"plugin","slug":"themereps-helper","name":"Themereps Helper","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nowpayments-for-woocommerce","name":"NOWPayments for WooCommerce \u2013 Crypto Payment Gateway","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"xt-woo-variation-swatches","name":"XT Variation Swatches for WooCommerce","from":"1.7.2","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"},{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"1.0.1","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"},{"type":"plugin","slug":"adblock-notify-by-bweb","name":"Ad Blocker Notify Lite","from":"2.0.8","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-authorize-net-gateway-aim","name":"Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins","from":"5.0.0","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"},{"type":"plugin","slug":"video-analytics-for-cloudflare-stream","name":"Video Analytics for Cloudflare Stream","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"},{"type":"plugin","slug":"auto-featured-image-auto-generated","name":"Auto Featured Image (Auto Generated)","from":"1.3.7","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"},{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"3.0","from_inclusive":true,"to":"3.4.15","to_inclusive":true,"patched_in":"3.4.16"},{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"review-engine","name":"Affiliate Link Builder Plugin for Amazon Associates \u2013 Review Engine","from":"1.0.3","from_inclusive":true,"to":"1.0.41","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"independent-analytics","name":"Independent Analytics \u2013 WordPress Analytics Plugin","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":true,"patched_in":"1.25.1"},{"type":"plugin","slug":"glossary-by-codeat","name":"Glossary","from":"1.2.0","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"},{"type":"plugin","slug":"chatpressai","name":"ChatPressAI \u2013 AI Supported Blogging and Reasearch","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-toolkit","name":"Premmerce WooCommerce Toolkit","from":"1.1","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-seo-keyword-optimizer","name":"BAVOKO SEO Tools \u2013 All-in-One WordPress SEO","from":"2.0.0","from_inclusive":true,"to":"2.1.9.12","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"affieasy","name":"AffiEasy","from":"0.9.22","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"ona","name":"Ona","from":"1.1","from_inclusive":true,"to":"1.18.1","to_inclusive":true,"patched_in":"1.18.3"},{"type":"plugin","slug":"convert-classic-editor-to-blocks","name":"Convert Classic Editor to Gutenberg Blocks","from":"1.0.2","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wpcake","name":"WPCake","from":"1.1.1","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"carousels-slider-for-divi","name":"Divi Carousel Lite \u2013 Responsive Carousel & Slider Modules for Divi Builder","from":"1.5.0","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"display-admin-page-on-frontend","name":"WP Frontend Admin \u2013 Display WP Admin Pages in the Frontend","from":"1.0.0","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"bp-toolkit","name":"Block, Suspend, Report for BuddyPress","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"menu-image","name":"Menu Image, Icons made easy","from":"2.9.2","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.10"},{"type":"theme","slug":"temp-mail-x","name":"Temp Mail X","from":"1.0.0","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-advanced-extra-fees-lite","name":"WooCommerce Extra Fees Lite \u2013 Use for Extra charge + Conditional Fee + Extra Cost for WooCommerce","from":"1.2.0","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-openagenda","name":"OpenAgenda for WordPress","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.9.0"},{"type":"plugin","slug":"momo-venmo","name":"Receive customer payments on Woocommerce","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"},{"type":"plugin","slug":"xt-woo-ajax-add-to-cart","name":"XT Ajax Add To Cart for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"meta-tag-manager","name":"Meta Tag Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"woo-quick-reports","name":"Quick Reports for Woocommerce","from":"2.6","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"integrate-automate","name":"integrate automate","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"avectra-netforum-single-sign-on","name":"netFORUM Single Sign On","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"hive-lite","name":"Hive Lite","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"external-media-upload","name":"External Media Upload","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"},{"type":"plugin","slug":"ether-and-erc20-tokens-woocommerce-payment-gateway","name":"Ether and ERC20 tokens WooCommerce Payment Gateway","from":"3.0.0","from_inclusive":true,"to":"4.12.12","to_inclusive":true,"patched_in":"4.12.13"},{"type":"plugin","slug":"pretty-simple-popup-builder","name":"Pretty Simple Popup Builder","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"order-on-chat-for-woocommerce","name":"Chat Button- Leads and Order over Chat","from":"1.3.0","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"attribute-stock-for-woocommerce","name":"Attribute Stock for WooCommerce \u2013 Shared Stock & Variable Quantities (Lite Version)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"},{"type":"plugin","slug":"woocommerce-shipping-gateway-per-product","name":"Dreamfoxmedia Shipping Methods per Product for WooCommerce","from":"2.0.0","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"},{"type":"theme","slug":"purosa","name":"Purosa","from":"1.0.2","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"},{"type":"plugin","slug":"nichetable","name":"NicheTable \u2013 Responsive Comparison Table Block","from":"1.5.0","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"},{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"3.0","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"},{"type":"theme","slug":"wp-sierra","name":"WP Sierra","from":"1.0.3","from_inclusive":true,"to":"1.0.49","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"saleszone","name":"SalesZone","from":"2.0.5","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"10.4","from_inclusive":true,"to":"11.2","to_inclusive":true,"patched_in":"11.3"},{"type":"plugin","slug":"woo-checkout-for-digital-goods","name":"Digital Goods for WooCommerce Checkout","from":"2.8","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"},{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"3.3.30","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"},{"type":"plugin","slug":"fullworks-anti-spam","name":"Anti-Spam Protection \u2013 No API Key, GDPR Friendly","from":"0.0.1","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"},{"type":"theme","slug":"gema-lite","name":"Gema Lite","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"order-picking-for-woocommerce","name":"Order Picking For WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"ultimate-widgets-light","name":"Ultimate Widgets Light","from":"1.5.9.4","from_inclusive":true,"to":"1.5.9.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ua-marketplace","name":"UA Marketplaces \u2013 Rozetka & Prom.ua XML Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"printus-cloud-printing-for-woocommerce","name":"Printus \u2013 Automatic Cloud Order Printing for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000020","to_inclusive":true,"patched_in":"4.3000000021"},{"type":"plugin","slug":"remove-add-to-cart-button-for-woocommerce","name":"Remove Add to Cart Button for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"appexperts","name":"APPExperts \u2013 Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"},{"type":"plugin","slug":"caxton","name":"Caxton \u2013 Create Pro page layouts in Gutenberg","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":true,"patched_in":"1.30.1"},{"type":"plugin","slug":"nitek-carousel-cool-transitions","name":"Nitek Carousel Slider Cool Transitions","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"upcasted-s3-offload","name":"Upcasted S3 Offload \u2013 AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration","from":"2.0.0","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"netforum-directory-with-importer","name":"Netforum Member Directory","from":"1.11","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"smart-protect","name":"Smart Protect","from":"1.1","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"blockons","name":"Blockons \u2013 Gutenberg blocks for WordPress and WooCommerce websites","from":"1.0.2","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"lpagery","name":"Bulk Page Generator \u2013 LPagery","from":"1.0","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"blockmeister","name":"BlockMeister \u2013 Block Pattern Builder","from":"3.0.0","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"},{"type":"plugin","slug":"yatri-tools","name":"Yatri Tools","from":"1.0.5","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"change-prices-with-time-for-woocommerce","name":"Change Prices with Time for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-extra-flat-rate","name":"Flat Rate Shipping Method for WooCommerce","from":"3.6.1","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.2.0"},{"type":"plugin","slug":"wpgenealogy","name":"WP Genealogy \u2013 Your Family History Website","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"auto-date-year-month","name":"AADMY \u2013 Add Auto Date Month Year Into Posts","from":"1.0.1","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"agendapress","name":"AgendaPress \u2013 Easily Publish Meeting Agendas and Programs on WordPress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gutenbook","name":"GutenBook","from":"1.0.8","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sp-news-and-widget","name":"WP News and Scrolling Widgets","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"},{"type":"plugin","slug":"blog-sidebar-widget","name":"Blog Sidebar Widget","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"doko-box-builder","name":"Doko Bundle Builder : The Ultimate dynamic bundle builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"},{"type":"plugin","slug":"contact-form-db-divi","name":"Contact Form DB Divi","from":"1.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.2"},{"type":"plugin","slug":"multipurpose-block","name":"Multipurpose Gutenberg Block","from":"1.3","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"},{"type":"plugin","slug":"advanced-usps-shipping-method","name":"USPS Shipping for WooCommerce \u2013 Live Rates","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"forms-gutenberg","name":"Gutenberg Forms \u2013 WordPress Form Builder Plugin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"artificial-intelligence-auto-content-generator","name":"AI Tools \u2013 Chatbot, ChatGPT, Content Generator, Image Generator, Artificial Intelligence GPT","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"3.0.0"},{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"3.0.0","from_inclusive":true,"to":"4.4.2.1","to_inclusive":true,"patched_in":"4.4.3"},{"type":"plugin","slug":"simple-feature-requests","name":"Simple Feature Requests Free \u2013 User Feedback Board","from":"1.0.0","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5.1"},{"type":"plugin","slug":"bulk-edit-categories-tags","name":"Bulk Edit Categories and Tags \u2013 Create Thousands Quickly on the Editor","from":"1.0.0","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"},{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"2.2.5","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3-beta.1"},{"type":"plugin","slug":"embed-video-thumbnail","name":"Embed Video Thumbnail","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"plugin","slug":"preloader-plus","name":"Preloader Plus \u2013 WordPress Loading Screen Plugin","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"sky-login-redirect","name":"Sky Login Redirect","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"},{"type":"plugin","slug":"convoworks-wp","name":"Convoworks WP","from":"*","from_inclusive":true,"to":"0.22.14","to_inclusive":true,"patched_in":"0.22.15"},{"type":"plugin","slug":"graphcomment-comment-system","name":"Comments \u2013 GraphComment | AI-Moderated Comment System","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"},{"type":"plugin","slug":"ga-for-wp","name":"TrueAna \u2013 True Analytics Dashboard","from":"1.1","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.0"},{"type":"plugin","slug":"reach-us-contact-form","name":"Contact Form for WordPress- Cybrosys","from":"3.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"collage-for-divi","name":"Divi Collage","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-persistent-login","name":"Persistent Login","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"},{"type":"plugin","slug":"sonawp-simple-payment-block","name":"SonaWP \u2013 Stripe Payment \u2013 PayPal Payment (Blocks + Shortcode) \u2013 Donations Block \u2013 Sell Digital Work","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"},{"type":"plugin","slug":"table-genie","name":"WordPress Table Builder \u2013 TableGenie","from":"1.0.4","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-custom-scrollbar","name":"Ultimate Custom ScrollBar","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"},{"type":"plugin","slug":"booking-weir","name":"Booking Weir","from":"1.0.0","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"widgets-for-siteorigin","name":"Widgets for SiteOrigin","from":"1.2.3","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sv-posts","name":"SV Posts","from":"*","from_inclusive":true,"to":"1.9.00","to_inclusive":true,"patched_in":"2.0.00"},{"type":"plugin","slug":"tecslider","name":"Slider Addons for The Events Calendar","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"conditional-logic-for-woo-product-add-ons","name":"Conditional Logic for Woo Product Add-ons","from":"1.0.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"easy-settings-for-learndash","name":"Easy Settings for LearnDash","from":"1.1.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"1.47","from_inclusive":true,"to":"1.80","to_inclusive":true,"patched_in":"1.81"},{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"4.3.1","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"6.5.0"},{"type":"plugin","slug":"nexus","name":"NEXUS","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"meridia","name":"Meridia","from":"1.0.0","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"3.01.2","from_inclusive":true,"to":"3.01.2","to_inclusive":true,"patched_in":"3.01.3"},{"type":"plugin","slug":"delete-old-posts-programmatically","name":"Auto Post Cleaner","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"},{"type":"plugin","slug":"set-admin-colour-on-staging-and-dev","name":"Auto Set Admin Colour on Staging and Dev","from":"2.2","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"simple-tour-guide","name":"Simple Tour Guide","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"brand","name":"Brand","from":"1.8.9","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"2.2.1","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"},{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"1.2.4","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"},{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"1.0.2","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"},{"type":"plugin","slug":"content-restrictor-for-divi","name":"Divi Content Restrictor","from":"1.0.1","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"},{"type":"plugin","slug":"premmerce-woocommerce-variation-swatches","name":"Premmerce Variation Swatches for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"hm-testimonial","name":"HM Testimonial","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddydrive","name":"BuddyDrive","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"3.1","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"},{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"1.8.4","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"},{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.5.4","to_inclusive":true,"patched_in":"1.3.5.5"},{"type":"plugin","slug":"kanzu-support-desk","name":"Kanzu Support Desk \u2013 WordPress Helpdesk  Plugin","from":"2.3.3","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-tiktok-feed","name":"Easy TikTok Feed \u2013 TikTok Video, Feed & Gallery Plugin","from":"1.0.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pop-over-xyz","name":"PopOverXYZ \u2013 Show Light Weight Beautiful Tool Tips On Any Text","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"coinbase-commerce-for-contact-form-7","name":"Coinbase Business for Contact Form 7","from":"1.1.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"current-template-name","name":"Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info \u2013 Pagely","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"},{"type":"plugin","slug":"number-chat","name":"Number Chat","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"rating-widget","name":"Rating-Widget: Star Review System","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"},{"type":"plugin","slug":"recurring-bookings-for-woocommerce","name":"Recurring Bookings for WooCommerce","from":"1.0","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"0.2","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"go-viral","name":"Go Viral \u2013 social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters","from":"1.0.0","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"the-authority","name":"The Authority","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"cheetaho-image-optimizer","name":"WordPress Image Compression and Optimizer Plugin \u2013 CheetahO","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.3.1"},{"type":"plugin","slug":"custom-user-guide","name":"Custom User Guide","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"},{"type":"plugin","slug":"dashylite","name":"Dashy \u2013 Google Analytics advanced dashboard","from":"2.0.1","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"1.0","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"},{"type":"plugin","slug":"hm-cool-author-box-widget","name":"Cool Author Box \u2013 For Widget and Post Content","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"},{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"2.3.0","from_inclusive":true,"to":"2.4.0.9","to_inclusive":true,"patched_in":"2.5.0"},{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"},{"type":"plugin","slug":"buddyforms-acf","name":"BuddyForms Advanced Custom Fields","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"},{"type":"plugin","slug":"pets","name":"Pets","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"seo-site-auditor-agency","name":"SEO Audit \u2013 WP Site Auditor","from":"1.0.0","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"login-designer","name":"Custom Login Page Customizer \u2013 Login Designer","from":"1.6","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"},{"type":"plugin","slug":"wp-transactions","name":"GeoTargeting WP","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"reviewpress","name":"WordPress Reviews by ReviewPress","from":"1.0.1","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"},{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"2.4","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"},{"type":"plugin","slug":"web3-token-gate","name":"Web3 Token Gate","from":"1.0.0","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"plugin","slug":"slp-extenders","name":"Store Locator Plus\u00ae | Extenders","from":"5.6.0","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"5.12.5","from_inclusive":true,"to":"5.13.0","to_inclusive":true,"patched_in":"5.13.1"},{"type":"theme","slug":"hotelica","name":"Hotelica","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"},{"type":"plugin","slug":"wp-smart-export","name":"WP Smart Export (Free)","from":"1.4.2","from_inclusive":true,"to":"1.4.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easync-booking","name":"eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals","from":"1.1.5","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"plugin","slug":"woo-fiscalita-italiana","name":"Strumenti Partita IVA per Woocommerce","from":"1.0.0","from_inclusive":true,"to":"1.3.34","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-brands","name":"Premmerce Brands for WooCommerce","from":"1.1","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"},{"type":"plugin","slug":"ethereum-wallet","name":"Ethereum Wallet","from":"*","from_inclusive":true,"to":"4.10.5","to_inclusive":true,"patched_in":"4.10.6"},{"type":"plugin","slug":"limb-gallery","name":"Limb Gallery | Create Beautiful Image & Video Galleries","from":"1.4.9","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"},{"type":"plugin","slug":"code-manager","name":"Code Manager","from":"1.0.0","from_inclusive":true,"to":"1.0.25","to_inclusive":true,"patched_in":"1.0.26"},{"type":"plugin","slug":"payment-gateway-payfabric","name":"Payment Gateway for PayFabric","from":"1.0.4","from_inclusive":true,"to":"1.0.12.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tedwp","name":"Ted \u2013 WordPress Classic Block Editor Plugin","from":"0.0.1","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wc-gsheetconnector","name":"GSheetConnector \u2013 WooCommerce Google Sheets Connector, Export Orders & Products to Google Sheets in Real-Time","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"},{"type":"plugin","slug":"update-urls","name":"Search & Replace Everything \u2013 Quick and Easy Way to Find and Replace Text, Links","from":"1.2.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"woo-product-finder","name":"Product Recommendation Quiz For WooCommerce","from":"1.4.0","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"theme","slug":"aquarella-lite","name":"Aquarella Lite","from":"*","from_inclusive":true,"to":"1.0.4.2","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"commerce-coinbase-for-woocommerce","name":"Coinbase Business Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.5.0"},{"type":"theme","slug":"bootstrap-coach","name":"Bootstrap Coach","from":"1.1.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"theme","slug":"villar","name":"Villar","from":"1.0.0","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"map-location-picker-at-checkout-for-woocommerce","name":"Kikote \u2013 Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce","from":"1.2.2","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"},{"type":"plugin","slug":"demomentsomtres-categories","name":"DeMomentSomTres Categories","from":"2.5.5","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"freshing","name":"Freshing","from":"1.1.1","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"age-verification-screen-for-woocommerce","name":"Age Verification Screen for WooCommerce","from":"1.0.1","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-ecommerce-tracking-for-google-and-facebook","name":"Enhanced Ecommerce Google Analytics for WooCommerce","from":"3.0","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"},{"type":"plugin","slug":"joli-faq-seo","name":"Joli FAQ SEO \u2013 WordPress FAQ Plugin","from":"1.0.0","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"plugin","slug":"mass-pagesposts-creator","name":"Mass Pages/Posts Creator","from":"2.0.0","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"},{"type":"plugin","slug":"wp-relevant-ads","name":"WP Relevant Ads","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"glorious-sites-installer","name":"GloriousThemes Starter Sites","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-facebook-group","name":"WP Group Promoter","from":"1.0.0","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"airpress","name":"Airpress","from":"1.1.51","from_inclusive":true,"to":"1.1.62","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-structured-data-schema","name":"Schema Plugin For Divi, Gutenberg & Shortcodes","from":"3.5.0","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"photography-portfolio","name":"Easy Photography Portfolio","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"},{"type":"plugin","slug":"login-customizer","name":"Custom Login Page Customizer","from":"2.1.5","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"},{"type":"plugin","slug":"mmt-eventon-exim-lite","name":"Eventbrite EventON","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"theme","slug":"learnmore","name":"LearnMore","from":"1.0.4","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"1.5.12","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.8"},{"type":"plugin","slug":"min-and-max-quantity-for-woocommerce","name":"Minimum and Maximum Quantity for WooCommerce","from":"1.1.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"puredevs-customer-history-for-woocommerce","name":"PureDevs Customer History for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"3.0.0","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"},{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"1.5.8","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.12"},{"type":"theme","slug":"topcat-lite","name":"Topcat Lite","from":"2.0.2","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"fire-blog","name":"Fire Blog","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"wordapp-mobile-app","name":"WordApp Mobile App Plugin \u2013 Convert your WordPress Site to a Mobile App","from":"1.17.1","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"faq-manager-with-structured-data","name":"FAQ Manager For Divi, Gutenberg Block & Shortcode","from":"4.0.0","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"},{"type":"plugin","slug":"wps-team","name":"Team Members Showcase","from":"2.0.0","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"},{"type":"plugin","slug":"quote-requests-for-woocommerce","name":"Quote Requests for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"7.0.0","from_inclusive":true,"to":"8.0.6.6","to_inclusive":true,"patched_in":"8.0.6.8"},{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"1.2.1","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wc-rest-payment","name":"WC REST Payment","from":"1.2.0","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"advanced-visual-elements","name":"AVE \u2013 Elementor & Gutenberg Addons","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"svg-flags-lite","name":"SVG Flags \u2013 Country Flag Blocks and Galleries","from":"0.5","from_inclusive":true,"to":"0.9.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"post-list-designer","name":"Post List Designer \u2013 Category Post, Recent Post, Post List","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"},{"type":"plugin","slug":"files-download-delay","name":"Files Download Delay","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"smart-tools-for-woocommerce","name":"Constellation: Smart Tools for WooCommerce","from":"1.0.8","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"premmerce-woocommerce-product-bundles","name":"Premmerce Frequently Bought Together for WooCommerce","from":"1.0","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"},{"type":"plugin","slug":"before-and-after-product-images-for-woocommerce","name":"Before and After Product Images for WooCommerce","from":"1.0.2","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"},{"type":"plugin","slug":"stop-wp-emails-going-to-spam","name":"Stop WP Emails Going to Spam","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"},{"type":"plugin","slug":"f4-tree","name":"F4 Post Tree","from":"1.1.0","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"},{"type":"theme","slug":"suffice","name":"Suffice","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"},{"type":"plugin","slug":"premium-blog-addons","name":"PremiumBlogAddons \u2013  Premium Blog Addons \u2013 Amazing Blog Layouts","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"customer-chat-facebook","name":"Customer Chat Facebook","from":"1.1.0","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ultimate-sms-notifications","name":"Ultimate SMS Notifications for WooCommerce","from":"1.2","from_inclusive":true,"to":"1.9.9.5","to_inclusive":true,"patched_in":"1.9.9.6"},{"type":"plugin","slug":"mail-control","name":"Mail Control \u2013 Email Customizer, SMTP Deliverability, logging, open and click Tracking","from":"0.2","from_inclusive":true,"to":"0.2.8","to_inclusive":true,"patched_in":"0.3.2"},{"type":"plugin","slug":"locations-and-areas","name":"Locations and Areas \u2013 Leaflet Map with Region Tabs","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"lawpress","name":"LawPress \u2013 Law Firm Website Management","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"agncy","name":"Agncy","from":"1.0.0","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-shipping-display-mode","name":"Shipping Method Display Style for WooCommerce","from":"3.4","from_inclusive":true,"to":"3.7.6","to_inclusive":true,"patched_in":"3.7.7"},{"type":"plugin","slug":"blockington","name":"WordPress Gutenberg Blocks, Bootstrap Blocks, WPForms Styler \u2013 Blockington","from":"1.0.2","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.3","from_inclusive":true,"to":"1.3.70","to_inclusive":true,"patched_in":"1.3.71"},{"type":"plugin","slug":"sql-reporting-services","name":"SQL Reporting Services \u2013 SSRS Plugin for WordPress","from":"1.0.0","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-sheet-editor-bulk-spreadsheet-editor-for-posts-and-pages","name":"Bulk Edit Posts and Products in Spreadsheet","from":"1.4.3","from_inclusive":true,"to":"2.25.2","to_inclusive":true,"patched_in":"2.25.3"},{"type":"plugin","slug":"preprocess-dezrez","name":"Process Dezrezone XML for upload","from":"1.1","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"delete-duplicate-posts","name":"Delete Duplicate Posts","from":"4.1.9","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"},{"type":"plugin","slug":"rss-control","name":"RSS Control","from":"2.0.2","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.8"},{"type":"plugin","slug":"cleanup-action-scheduler","name":"Cleanup Action Scheduler","from":"1.0.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"media-download","name":"Media Library File Download","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-link-bio","name":"WP Link Bio","from":"1.2.0","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"1.9.1","from_inclusive":true,"to":"1.13.11","to_inclusive":true,"patched_in":"1.13.12"},{"type":"plugin","slug":"woo-product-reviews-shortcode","name":"Builder for WooCommerce product reviews shortcodes \u2013 ReviewShort","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"},{"type":"plugin","slug":"cpa-offerwall","name":"CPA OFFERWALL","from":"1.0.1","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sites-monitor","name":"Sites Monitor","from":"0.0.7","from_inclusive":true,"to":"0.0.8","to_inclusive":true,"patched_in":"0.0.9"},{"type":"plugin","slug":"contact-list","name":"Contact List \u2013 Online Staff Directory & Address Book","from":"2.9.24","from_inclusive":true,"to":"2.9.69","to_inclusive":true,"patched_in":"2.9.72"},{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"3.0.0","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"},{"type":"plugin","slug":"how-to-wp","name":"WP How to \u2013 WordPress Tutorial Videos","from":"1.0.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wp-forge","name":"WP-Forge","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.3.1"},{"type":"plugin","slug":"socialmark","name":"SocialMark \u2013 Easy Watermark/Logo on Social Media Post Link Share Preview","from":"1.0.0","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"3.3.0","from_inclusive":true,"to":"3.25.1","to_inclusive":true,"patched_in":"3.25.3"},{"type":"plugin","slug":"role-and-customer-based-pricing-for-woocommerce","name":"Role Based Pricing for Woo by Meow Crew","from":"1.0.0","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"},{"type":"plugin","slug":"notification","name":"Notification \u2013 Custom Notifications and Alerts for WordPress","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"},{"type":"theme","slug":"chic-lifestyle","name":"Chic Lifestyle","from":"1.1.3","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"10.0.8"},{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"},{"type":"plugin","slug":"treepress","name":"TreePress \u2013 Easy Family Trees & Ancestor Profiles","from":"1.0","from_inclusive":true,"to":"3.0.0.1","to_inclusive":true,"patched_in":"3.0.1"},{"type":"plugin","slug":"noted-pro","name":"Noted PRO","from":"1.0","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"postcode-redirect","name":"Postcode Redirect","from":"2.1.1","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"5.0.0"},{"type":"plugin","slug":"wc-product-author","name":"Product Author for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"},{"type":"plugin","slug":"autocomplete-address-and-location-picker-for-woocommerce","name":"Autocomplete Address and Location Picker for WooCommerce","from":"1.0.0","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.7"},{"type":"plugin","slug":"wp-coupons-and-deals","name":"WP Coupons and Deals \u2013 WordPress Coupon Plugin","from":"2.1.3","from_inclusive":true,"to":"3.1.18","to_inclusive":true,"patched_in":"3.1.19"},{"type":"plugin","slug":"copy-the-code","name":"Copy Anything to Clipboard for WordPress \u2013 Copy Button, Copy Text & Copy Code","from":"1.3.0","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"},{"type":"plugin","slug":"feedpress-generator","name":"Feedpress Generator \u2013 External RSS Frontend Customizer","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"information-for-help","name":"Information for help","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":"0.0.3"},{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"},{"type":"plugin","slug":"wp-automedic","name":"WP AutoMedic","from":"1.4.0","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-18T00:00:00Z","updated":"2024-10-21T20:41:24Z"},{"id":"wordfence:525626be-fe1d-4543-91a1-ae5ea3658862","source":"wordfence","cve":"CVE-2023-5239","title":"Security & Malware scan by CleanTalk <= 2.120 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525626be-fe1d-4543-91a1-ae5ea3658862?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.120","to_inclusive":true,"patched_in":"2.121"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52569aac-1e9e-40fb-9ff4-5eeb7940375d","source":"wordfence","cve":"CVE-2024-1791","title":"CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52569aac-1e9e-40fb-9ff4-5eeb7940375d?source=api-prod","affected":[{"type":"plugin","slug":"wp-codemirror-block","name":"CodeMirror Blocks","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-02-27T00:00:00Z","updated":"2024-04-01T17:07:07Z"},{"id":"wordfence:5256a249-b355-480d-a532-5931e4dea481","source":"wordfence","cve":"CVE-2023-0548","title":"Namaste! LMS <= 2.5.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5256a249-b355-480d-a532-5931e4dea481?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.5.9.3","to_inclusive":true,"patched_in":"2.5.9.4"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5256ef2b-e1fc-4746-b35e-07a265f47f95","source":"wordfence","cve":"","title":"Events Addon for Elementor <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5256ef2b-e1fc-4746-b35e-07a265f47f95?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52574d99-1ffe-4152-bf13-9cdd11d7300a","source":"wordfence","cve":"CVE-2023-2169","title":"TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52574d99-1ffe-4152-bf13-9cdd11d7300a?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5258480a-3954-4620-84bf-8a711ba62d0a","source":"wordfence","cve":"CVE-2026-66443","title":"REST API Log <= 1.7.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5258480a-3954-4620-84bf-8a711ba62d0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-log","name":"REST API Log","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:54:56Z"},{"id":"wordfence:525923b5-4dda-4942-aaab-63d38cde31b6","source":"wordfence","cve":"CVE-2025-68085","title":"Buttoner for Elementor <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525923b5-4dda-4942-aaab-63d38cde31b6?source=api-prod","affected":[{"type":"plugin","slug":"buttoner-elementor","name":"Buttoner for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:25:49Z"},{"id":"wordfence:525a2180-3643-4f78-aafd-99a546bac363","source":"wordfence","cve":"CVE-2024-43250","title":"Bit Form Pro <= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525a2180-3643-4f78-aafd-99a546bac363?source=api-prod","affected":[{"type":"plugin","slug":"bitformpro","name":"Bit Form Pro","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-12T14:42:43Z"},{"id":"wordfence:525b466d-137a-467b-8b49-e51393a73866","source":"wordfence","cve":"CVE-2016-15040","title":"Kento Post View Counter <= 2.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525b466d-137a-467b-8b49-e51393a73866?source=api-prod","affected":[{"type":"plugin","slug":"kento-post-view-counter","name":"Kento Post View Counter","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2016-05-26T00:00:00Z","updated":"2024-10-16T06:43:31Z"},{"id":"wordfence:525cb51c-23f1-446f-a247-0f69ec5029d8","source":"wordfence","cve":"CVE-2023-33922","title":"Elementor <= 3.13.2 Authenticated(Contributor+) Arbitrary Post Type Creation via save_item","severity":"medium","cvss":5.4,"cwe":"CWE-1229","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525cb51c-23f1-446f-a247-0f69ec5029d8?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.13.3","to_inclusive":false,"patched_in":"3.13.3"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:525d2bc5-b0f5-46d9-bb05-1ed0bf640af9","source":"wordfence","cve":"CVE-2025-22644","title":"Vayu Blocks \u2013 Gutenberg Blocks for WordPress & WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525d2bc5-b0f5-46d9-bb05-1ed0bf640af9?source=api-prod","affected":[{"type":"plugin","slug":"vayu-blocks","name":"Vayu Blocks \u2013 Website Builder for the Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-07-24T19:04:37Z"},{"id":"wordfence:525dec5b-b457-483c-ab2d-09dd320edcaa","source":"wordfence","cve":"CVE-2023-47777","title":"WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/525dec5b-b457-483c-ab2d-09dd320edcaa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.2.0"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"*","from_inclusive":true,"to":"11.1.1","to_inclusive":true,"patched_in":"11.1.2"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52632b50-9755-4ebd-a1a8-587cc633debb","source":"wordfence","cve":"CVE-2026-2371","title":"Greenshift <= 12.8.3 - Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52632b50-9755-4ebd-a1a8-587cc633debb?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.3","to_inclusive":true,"patched_in":"12.8.4"}],"published":"2026-03-06T11:20:33Z","updated":"2026-03-06T23:22:58Z"},{"id":"wordfence:5263349f-e85f-4d36-a949-d68d31a02e0e","source":"wordfence","cve":"CVE-2025-27016","title":"Drivr Lite \u2013 Google Drive Plugin plugin for WordPress <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5263349f-e85f-4d36-a949-d68d31a02e0e?source=api-prod","affected":[{"type":"plugin","slug":"drivr-google-drive-file-picker","name":"Drivr Lite \u2013 Google Drive Plugin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-24T16:00:27Z"},{"id":"wordfence:5263fa58-18d2-49a2-bc5b-3d3fd3cd1377","source":"wordfence","cve":"CVE-2014-3849","title":"iMember360 3.8.012 - 3.9.001 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5263fa58-18d2-49a2-bc5b-3d3fd3cd1377?source=api-prod","affected":[{"type":"plugin","slug":"imember360","name":"iMember360is","from":"3.8.012","from_inclusive":true,"to":"3.9.001","to_inclusive":false,"patched_in":"3.9.001"}],"published":"2014-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52659f1c-642e-4c88-b3d0-d5c5a206b11c","source":"wordfence","cve":"CVE-2023-5613","title":"Super Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52659f1c-642e-4c88-b3d0-d5c5a206b11c?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52666087-3ecc-4901-8902-042179ae97fc","source":"wordfence","cve":"CVE-2025-11377","title":"List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52666087-3ecc-4901-8902-042179ae97fc?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.92.0","to_inclusive":true,"patched_in":"0.93.0"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T04:27:40Z"},{"id":"wordfence:526837cc-ed1d-4d3d-8f75-a2098445dd1d","source":"wordfence","cve":"CVE-2025-15285","title":"SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526837cc-ed1d-4d3d-8f75-a2098445dd1d?source=api-prod","affected":[{"type":"plugin","slug":"lupsonline-link-netwerk","name":"SEO Flow by LupsOnline","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-02-03T19:31:09Z","updated":"2026-02-25T14:27:02Z"},{"id":"wordfence:5268485f-d912-4c2d-a0ad-aabb69f9c98c","source":"wordfence","cve":"CVE-2023-6444","title":"Seriously Simple Podcasting <= 2.25.3 - Unauthenticated Email Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5268485f-d912-4c2d-a0ad-aabb69f9c98c?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"2.25.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-02-17T00:00:00Z","updated":"2024-04-24T14:16:35Z"},{"id":"wordfence:52696d42-b522-47d3-9a59-92078145c2be","source":"wordfence","cve":"CVE-2017-9419","title":"WP Custom Fields Search <= 0.3.28 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52696d42-b522-47d3-9a59-92078145c2be?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-fields-search","name":"WP Custom Fields Search","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":false,"patched_in":"1.0"}],"published":"2017-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5269ea0a-b0e9-433a-a166-28d23bfb6b4e","source":"wordfence","cve":"CVE-2021-24277","title":"RSS for Yandex Turbo <= 1.29 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5269ea0a-b0e9-433a-a166-28d23bfb6b4e?source=api-prod","affected":[{"type":"plugin","slug":"rss-for-yandex-turbo","name":"RSS for Yandex Turbo","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.30"}],"published":"2021-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:526a1b9c-953b-4ad7-91e1-d2e480b967ac","source":"wordfence","cve":"CVE-2021-24446","title":"Remove Footer Credit <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526a1b9c-953b-4ad7-91e1-d2e480b967ac?source=api-prod","affected":[{"type":"plugin","slug":"remove-footer-credit","name":"Remove Footer Credit","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:526aa14e-42b8-4db4-96a8-6ecc2475ad7f","source":"wordfence","cve":"CVE-2025-60150","title":"Subscribe to Download <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526aa14e-42b8-4db4-96a8-6ecc2475ad7f?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-download","name":"Subscribe to Download","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:19:27Z"},{"id":"wordfence:526aa2e5-06bd-4b4c-a331-315f8ab37858","source":"wordfence","cve":"CVE-2023-45048","title":"Social proof testimonials and reviews by Repuso <= 5.01 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526aa2e5-06bd-4b4c-a331-315f8ab37858?source=api-prod","affected":[{"type":"plugin","slug":"social-testimonials-and-reviews-widget","name":"Reviews Widgets for Google & 45+ platforms by Repuso","from":"*","from_inclusive":true,"to":"5.01","to_inclusive":true,"patched_in":"5.02"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:526add70-4fcf-44d1-b4d8-4cc35652b1f0","source":"wordfence","cve":"CVE-2024-4097","title":"Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526add70-4fcf-44d1-b4d8-4cc35652b1f0?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"3.1.67","to_inclusive":true,"patched_in":"3.1.68"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-31T15:30:20Z"},{"id":"wordfence:526c45c8-7543-4384-af80-b3798857f79d","source":"wordfence","cve":"CVE-2024-34376","title":"Edge <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526c45c8-7543-4384-af80-b3798857f79d?source=api-prod","affected":[{"type":"theme","slug":"edge","name":"Edge","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:04:02Z"},{"id":"wordfence:526dcd62-5e40-4870-b6cf-4f3d8bf9f8d0","source":"wordfence","cve":"CVE-2024-3478","title":"Herd Effects \u2013 fake notifications and social proof plugin <= 5.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/526dcd62-5e40-4870-b6cf-4f3d8bf9f8d0?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:44:21Z"},{"id":"wordfence:52707459-8d6f-4f89-b6e4-115cc4f3413c","source":"wordfence","cve":"CVE-2026-81155","title":"Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52707459-8d6f-4f89-b6e4-115cc4f3413c?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:25Z"},{"id":"wordfence:52719839-9e92-4de6-8f0d-8ee3f3fe00b0","source":"wordfence","cve":"CVE-2026-57749","title":"SportsPress Pro <= 2.7.29 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52719839-9e92-4de6-8f0d-8ee3f3fe00b0?source=api-prod","affected":[{"type":"plugin","slug":"sportspress-pro","name":"SportsPress Pro","from":"*","from_inclusive":true,"to":"2.7.29","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:05:15Z"},{"id":"wordfence:52759823-6c04-4f2f-a1a7-a23e44d45d29","source":"wordfence","cve":"CVE-2025-68889","title":"Pinpoll <= 4.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52759823-6c04-4f2f-a1a7-a23e44d45d29?source=api-prod","affected":[{"type":"plugin","slug":"pinpoll","name":"Pinpoll","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-13T17:36:32Z"},{"id":"wordfence:527630bf-d034-4fcd-8fbe-01b388701049","source":"wordfence","cve":"CVE-2026-19914","title":"Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527630bf-d034-4fcd-8fbe-01b388701049?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2026-08-31T20:54:53Z","updated":"2026-09-01T09:28:20Z"},{"id":"wordfence:52784505-a408-414f-a793-262d24f36546","source":"wordfence","cve":"CVE-2026-65517","title":"Easy PayPal & Stripe Buy Now Button <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52784505-a408-414f-a793-262d24f36546?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:47:01Z"},{"id":"wordfence:5278e8d4-d23e-47ce-b920-dfb7ec56387c","source":"wordfence","cve":"","title":"Health Check & Troubleshooting <= 1.2.3 - Missing Authorization Checks","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5278e8d4-d23e-47ce-b920-dfb7ec56387c?source=api-prod","affected":[{"type":"plugin","slug":"health-check","name":"Health Check & Troubleshooting","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2018-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:527c344e-870e-4bd9-b111-86cc2821367d","source":"wordfence","cve":"CVE-2023-23990","title":"Redirection for Contact Form 7 <= 2.7.0 - Authenticated(Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527c344e-870e-4bd9-b111-86cc2821367d?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:527dd2c7-5bbb-4c79-aa3c-7d70ddd26163","source":"wordfence","cve":"CVE-2025-3749","title":"Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd2c7-5bbb-4c79-aa3c-7d70ddd26163?source=api-prod","affected":[{"type":"plugin","slug":"wt-display-breeze","name":"Breeze Display","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-04-24T09:50:49Z","updated":"2025-04-24T22:22:14Z"},{"id":"wordfence:527dd711-4eb6-4432-92a1-6d458885ec9e","source":"wordfence","cve":"CVE-2025-32502","title":"ePaper Lister for Yumpu <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527dd711-4eb6-4432-92a1-6d458885ec9e?source=api-prod","affected":[{"type":"plugin","slug":"magazine-lister-for-yumpu","name":"ePaper Lister for Yumpu","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:42:12Z"},{"id":"wordfence:527f499f-4212-4d5e-9f5d-69666630e647","source":"wordfence","cve":"CVE-2026-105969","title":"CodeAtoZ B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527f499f-4212-4d5e-9f5d-69666630e647?source=api-prod","affected":[{"type":"plugin","slug":"codeatoz-b2b-suite-for-woocommerce","name":"CodeAtoZ B2B Suite for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:28:05Z"},{"id":"wordfence:527f75f1-6361-4e16-8ae4-d38ca4589811","source":"wordfence","cve":"CVE-2023-4893","title":"Crayon Syntax Highlighter <= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527f75f1-6361-4e16-8ae4-d38ca4589811?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:527f8f08-bab3-4319-99bf-845c8b378c19","source":"wordfence","cve":"CVE-2025-12824","title":"Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/527f8f08-bab3-4319-99bf-845c8b378c19?source=api-prod","affected":[{"type":"plugin","slug":"player-leaderboard","name":"Player Leaderboard","from":"1.0.0","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-12-11T14:27:12Z","updated":"2025-12-18T15:39:35Z"},{"id":"wordfence:52842812-d7c5-4244-b1ee-cf6197a75c4e","source":"wordfence","cve":"CVE-2025-22499","title":"F4 Post Tree <= 1.1.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52842812-d7c5-4244-b1ee-cf6197a75c4e?source=api-prod","affected":[{"type":"plugin","slug":"f4-tree","name":"F4 Post Tree","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:33:08Z"},{"id":"wordfence:5284aef6-8fcd-4a75-a189-b2223bb83b60","source":"wordfence","cve":"CVE-2025-31612","title":"CBX Poll <= 1.2.7 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5284aef6-8fcd-4a75-a189-b2223bb83b60?source=api-prod","affected":[{"type":"plugin","slug":"cbxpoll","name":"CBX Poll","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-12-12T22:20:23Z"},{"id":"wordfence:5284cbe4-1550-4f3c-be54-e2de8a089512","source":"wordfence","cve":"CVE-2024-13673","title":"Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5284cbe4-1550-4f3c-be54-e2de8a089512?source=api-prod","affected":[{"type":"plugin","slug":"big-boom-directory","name":"Big Boom Directory","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-04-02T19:01:28Z","updated":"2025-04-03T07:21:23Z"},{"id":"wordfence:52876909-3d2a-480d-9c47-39e96d088ff3","source":"wordfence","cve":"CVE-2023-25482","title":"WP Tiles <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52876909-3d2a-480d-9c47-39e96d088ff3?source=api-prod","affected":[{"type":"plugin","slug":"wp-tiles","name":"WP Tiles","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5287cf42-6d0a-4fd2-943d-e8e44fc08576","source":"wordfence","cve":"","title":"Jetpack <= 7.9 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5287cf42-6d0a-4fd2-943d-e8e44fc08576?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.3","from_inclusive":true,"to":"5.3.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.4","from_inclusive":true,"to":"5.4.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.5","from_inclusive":true,"to":"5.5.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.6","from_inclusive":true,"to":"5.6.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.7","from_inclusive":true,"to":"5.7.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.9","from_inclusive":true,"to":"5.9.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.0","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.3","from_inclusive":true,"to":"6.3.4","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.4","from_inclusive":true,"to":"6.4.3","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.5","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.6","from_inclusive":true,"to":"6.6.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.7","from_inclusive":true,"to":"6.7.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.8","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.0","from_inclusive":true,"to":"7.0.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.1","from_inclusive":true,"to":"7.1.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.2","from_inclusive":true,"to":"7.2.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.3","from_inclusive":true,"to":"7.3.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.4","from_inclusive":true,"to":"7.4.2","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.5","from_inclusive":true,"to":"7.5.4","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.6","from_inclusive":true,"to":"7.6.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.7","from_inclusive":true,"to":"7.7.3","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.8","from_inclusive":true,"to":"7.8.1","to_inclusive":false,"patched_in":"5.1.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.9","from_inclusive":true,"to":"7.9.1","to_inclusive":false,"patched_in":"5.1.1"}],"published":"2019-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5289f7a5-7b7b-4627-a313-b8480f88b158","source":"wordfence","cve":"CVE-2016-10988","title":"leenk.me < 2.6.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5289f7a5-7b7b-4627-a313-b8480f88b158?source=api-prod","affected":[{"type":"plugin","slug":"leenkme","name":"leenk.me","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":false,"patched_in":"2.6.0"}],"published":"2016-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:528a00f3-13dd-499d-9814-b772f535a07c","source":"wordfence","cve":"CVE-2025-52788","title":"CaptionPix <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/528a00f3-13dd-499d-9814-b772f535a07c?source=api-prod","affected":[{"type":"plugin","slug":"captionpix","name":"CaptionPix","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:37:08Z"},{"id":"wordfence:528a28e7-cdf9-4dfa-b710-8b934863de91","source":"wordfence","cve":"CVE-2026-25413","title":"WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/528a28e7-cdf9-4dfa-b710-8b934863de91?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit-pro","name":"WPBookit Pro - Appointment Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":""}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:41:10Z"},{"id":"wordfence:528e1227-e6f5-4676-ad99-93259fd334de","source":"wordfence","cve":"CVE-2025-62984","title":"WP AdCenter <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/528e1227-e6f5-4676-ad99-93259fd334de?source=api-prod","affected":[{"type":"plugin","slug":"wpadcenter","name":"WP AdCenter \u2013 Ad Manager & Adsense Ads","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-29T14:37:30Z"},{"id":"wordfence:5292fcb2-4084-42e6-b78b-62e36123829a","source":"wordfence","cve":"CVE-2023-25971","title":"Educare \u2013 Students & Result Management System <= 1.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5292fcb2-4084-42e6-b78b-62e36123829a?source=api-prod","affected":[{"type":"plugin","slug":"educare","name":"Educare \u2013 Students & Result Management System","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52935b60-3ec5-45e6-9d12-200bf107c9df","source":"wordfence","cve":"CVE-2025-6944","title":"Uncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52935b60-3ec5-45e6-9d12-200bf107c9df?source=api-prod","affected":[{"type":"plugin","slug":"uncode-core","name":"Uncode Core","from":"*","from_inclusive":true,"to":"2.9.4.2","to_inclusive":true,"patched_in":"2.9.4.3"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-04T05:23:37Z"},{"id":"wordfence:52943f74-d0a6-43d2-a8e6-d9fd90925b3e","source":"wordfence","cve":"CVE-2024-49315","title":"FREE DOWNLOAD MANAGER <= 1.0.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52943f74-d0a6-43d2-a8e6-d9fd90925b3e?source=api-prod","affected":[{"type":"plugin","slug":"free-download-manager","name":"FREE DOWNLOAD MANAGER","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:41:43Z"},{"id":"wordfence:52944aa6-a6ee-46ce-bd0c-18c69fe1ada7","source":"wordfence","cve":"CVE-2022-2093","title":"WP Duplicate Page <= 1.2 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52944aa6-a6ee-46ce-bd0c-18c69fe1ada7?source=api-prod","affected":[{"type":"plugin","slug":"wp-duplicate-page","name":"WP Duplicate Page","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5294af95-e85f-4425-9c4b-0a92dfac4bd1","source":"wordfence","cve":"","title":"Digital Climate Strike WP <= 1.0.0 - Malicious Redirect","severity":"high","cvss":7.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5294af95-e85f-4425-9c4b-0a92dfac4bd1?source=api-prod","affected":[{"type":"plugin","slug":"digital-climate-strike-wp","name":"Digital Climate Strike WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5294f427-738c-444e-acf6-abc452629f64","source":"wordfence","cve":"","title":"Abundance (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5294f427-738c-444e-acf6-abc452629f64?source=api-prod","affected":[{"type":"theme","slug":"abundance","name":"Abundance","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52983bf6-908a-4287-b89e-cd09b4c48efe","source":"wordfence","cve":"CVE-2023-25984","title":"Dovetail <= 1.2.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52983bf6-908a-4287-b89e-cd09b4c48efe?source=api-prod","affected":[{"type":"plugin","slug":"dovetail","name":"Dovetail","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:529c5785-214e-41e7-8cf3-4ff3d256e27c","source":"wordfence","cve":"CVE-2013-5917","title":"NOSpamPTI <= 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/529c5785-214e-41e7-8cf3-4ff3d256e27c?source=api-prod","affected":[{"type":"plugin","slug":"nospampti","name":"NOSpamPTI","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2013-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:529e6d96-84d6-4a41-960d-4d201abb8de4","source":"wordfence","cve":"CVE-2026-22467","title":"DeepDigital \u2013 Web Design Agency WordPress Theme <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/529e6d96-84d6-4a41-960d-4d201abb8de4?source=api-prod","affected":[{"type":"theme","slug":"deepdigital","name":"DeepDigital \u2013 Web Design Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T16:16:52Z"},{"id":"wordfence:529f411a-8b3c-4cb9-b067-4755972d6c07","source":"wordfence","cve":"CVE-2025-30833","title":"Verge3D <= 4.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/529f411a-8b3c-4cb9-b067-4755972d6c07?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:18:35Z"},{"id":"wordfence:52a03c45-1d65-43aa-b30f-13698019e05f","source":"wordfence","cve":"","title":"miniOrange's Google Authenticator  <= 5.5.82 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52a03c45-1d65-43aa-b30f-13698019e05f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.5.82","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2022-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52a094b0-acee-412a-ad15-38c9f4510c48","source":"wordfence","cve":"CVE-2024-53744","title":"Elementor Image Gallery Plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52a094b0-acee-412a-ad15-38c9f4510c48?source=api-prod","affected":[{"type":"plugin","slug":"skyboot-portfolio-gallery","name":"Skyboot Portfolio Gallery for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-11-28T00:00:00Z","updated":"2025-10-02T22:39:12Z"},{"id":"wordfence:52a106f6-8d6a-4769-81c0-f8d1bdc72feb","source":"wordfence","cve":"CVE-2025-31096","title":"PostX <= 4.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52a106f6-8d6a-4769-81c0-f8d1bdc72feb?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.1.26"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:50:39Z"},{"id":"wordfence:52a8718f-2c4d-4da1-a81f-e93dff3fa43b","source":"wordfence","cve":"CVE-2024-12605","title":"AI Scribe \u2013 SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52a8718f-2c4d-4da1-a81f-e93dff3fa43b?source=api-prod","affected":[{"type":"plugin","slug":"ai-scribe-the-chatgpt-powered-seo-content-creation-wizard","name":"Opace AI Scribe: SEO Content Creator & Humanizer for OpenAI, Anthropic & Gemini","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-01-08T21:59:15Z","updated":"2025-11-05T19:13:01Z"},{"id":"wordfence:52a92e3c-cb64-4fc5-9248-6f4fc2a6a3cc","source":"wordfence","cve":"CVE-2026-92622","title":"Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52a92e3c-cb64-4fc5-9248-6f4fc2a6a3cc?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-09-17T18:44:51Z","updated":"2026-09-18T07:40:01Z"},{"id":"wordfence:52aade31-7f27-49e3-9d29-5650a1c87bba","source":"wordfence","cve":"CVE-2026-28016","title":"Luxury Wine <= 1.1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52aade31-7f27-49e3-9d29-5650a1c87bba?source=api-prod","affected":[{"type":"theme","slug":"luxury-wine","name":"Luxury Wine | Liquor Store & Vineyard WP Theme","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:59:58Z"},{"id":"wordfence:52ab644a-aed8-4690-8cea-a4993bf51ba0","source":"wordfence","cve":"CVE-2025-24724","title":"Side Menu Lite <= 5.3.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ab644a-aed8-4690-8cea-a4993bf51ba0?source=api-prod","affected":[{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:19:26Z"},{"id":"wordfence:52ac7ccf-89fd-47d3-ba61-7bcf84908a57","source":"wordfence","cve":"CVE-2018-20963","title":"Contact Form Email <= 1.2.65 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ac7ccf-89fd-47d3-ba61-7bcf84908a57?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.2.65","to_inclusive":true,"patched_in":"1.2.66"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52ac7e85-0a01-41f0-b753-7858a859705f","source":"wordfence","cve":"","title":"Email Encoder < 1.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ac7e85-0a01-41f0-b753-7858a859705f?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52aee4b8-f494-4eeb-8357-71ce8d5bc656","source":"wordfence","cve":"CVE-2023-4597","title":"Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52aee4b8-f494-4eeb-8357-71ce8d5bc656?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52af7568-061d-4352-b85c-11f9829bc8a5","source":"wordfence","cve":"CVE-2018-5651","title":"WP Markdown Editor (Formerly Dark Mode) < 1.7 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52af7568-061d-4352-b85c-11f9829bc8a5?source=api-prod","affected":[{"type":"plugin","slug":"dark-mode","name":"Markdown Editor (Formerly Dark Mode)","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52afc761-9050-4aea-97f6-62a9a2e1d65a","source":"wordfence","cve":"CVE-2026-32343","title":"Easy Table of Contents <= 2.0.80 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52afc761-9050-4aea-97f6-62a9a2e1d65a?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.80","to_inclusive":true,"patched_in":"2.0.81"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:47:32Z"},{"id":"wordfence:52b04517-f0be-4bbf-818c-70a12d76bfec","source":"wordfence","cve":"CVE-2025-10380","title":"Advanced Views \u2013 Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI","severity":"high","cvss":8.8,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=api-prod","affected":[{"type":"plugin","slug":"acf-views","name":"Advanced Views \u2013 Display Framework \u2013 Gutenberg/Elementor/Shortcode","from":"*","from_inclusive":true,"to":"3.7.19","to_inclusive":true,"patched_in":"3.7.20"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-23T03:34:35Z"},{"id":"wordfence:52b13188-5630-4ae9-9b2b-bd4dcadd240a","source":"wordfence","cve":"CVE-2023-7201","title":"Everest Backup <= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52b13188-5630-4ae9-9b2b-bd4dcadd240a?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:49:00Z"},{"id":"wordfence:52b1d515-4965-4ab9-80dd-526b4ebeb3a9","source":"wordfence","cve":"CVE-2021-24659","title":"PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52b1d515-4965-4ab9-80dd-526b4ebeb3a9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":false,"patched_in":"2.4.10"}],"published":"2021-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52b7b38a-6851-4c8d-8a53-08bf8934c089","source":"wordfence","cve":"CVE-2025-31753","title":"Advanced Speed Increaser <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52b7b38a-6851-4c8d-8a53-08bf8934c089?source=api-prod","affected":[{"type":"plugin","slug":"advanced-speed-increaser","name":"Advanced Speed Increaser","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:01:50Z"},{"id":"wordfence:52b7fd90-244e-4764-9aa0-407ffd6aa328","source":"wordfence","cve":"CVE-2026-18465","title":"Maps Pro <= 6.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52b7fd90-244e-4764-9aa0-407ffd6aa328?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-gold","name":"WP Maps Pro","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:40:55Z"},{"id":"wordfence:52ba3bd8-f9d4-49fb-b786-3dd8b2350ae9","source":"wordfence","cve":"CVE-2026-113492","title":"GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ba3bd8-f9d4-49fb-b786-3dd8b2350ae9?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:18:07Z"},{"id":"wordfence:52ba91f1-21a2-4d7c-8801-b5e72a00c37d","source":"wordfence","cve":"CVE-2024-2790","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ba91f1-21a2-4d7c-8801-b5e72a00c37d?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:06Z"},{"id":"wordfence:52bb3328-956c-4379-879a-d321d68c39ee","source":"wordfence","cve":"CVE-2020-35937","title":"Team Showcase <= 1.22.15 - Stored Cross-Site Scripting","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52bb3328-956c-4379-879a-d321d68c39ee?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.16","to_inclusive":false,"patched_in":"1.22.16"}],"published":"2020-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52bd0d4d-4a08-417c-a426-6bd981f43120","source":"wordfence","cve":"CVE-2024-33931","title":"JW Player for WordPress <= 2.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd0d4d-4a08-417c-a426-6bd981f43120?source=api-prod","affected":[{"type":"plugin","slug":"jw-player-7-for-wp","name":"JW Player for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-04-29T00:00:00Z","updated":"2024-07-01T14:58:40Z"},{"id":"wordfence:52bd9946-dccc-427a-9abd-0b7153e7484f","source":"wordfence","cve":"CVE-2025-2806","title":"tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52bd9946-dccc-427a-9abd-0b7153e7484f?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-08T11:23:41Z"},{"id":"wordfence:52c19707-df18-4239-af46-12ea5ee86a4b","source":"wordfence","cve":"CVE-2025-6441","title":"Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c19707-df18-4239-af46-12ea5ee86a4b?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"4.03.32","to_inclusive":true,"patched_in":"4.03.33"}],"published":"2025-07-23T20:41:54Z","updated":"2025-07-24T19:13:01Z"},{"id":"wordfence:52c19956-89ff-4909-8fed-470fdedcf994","source":"wordfence","cve":"CVE-2026-88784","title":"Weglot <= 6.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c19956-89ff-4909-8fed-470fdedcf994?source=api-prod","affected":[{"type":"plugin","slug":"weglot","name":"Translate WordPress with Weglot 2.0 \u2013 Multilingual AI Translation","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:59:05Z"},{"id":"wordfence:52c24f18-832b-4416-a148-a23e38b257e0","source":"wordfence","cve":"","title":"WP-DBManager <= 2.79.1 - Directory Traversal Allowing Arbitrary File Deletion","severity":"high","cvss":8.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c24f18-832b-4416-a148-a23e38b257e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-dbmanager","name":"WP-DBManager","from":"*","from_inclusive":true,"to":"2.79.2","to_inclusive":false,"patched_in":"2.79.2"}],"published":"2018-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52c2837e-8947-4ce9-bda5-e0c2f831fb36","source":"wordfence","cve":"CVE-2023-30472","title":"URL Shortener by MyThemeShop <= 1.0.17 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c2837e-8947-4ce9-bda5-e0c2f831fb36?source=api-prod","affected":[{"type":"plugin","slug":"mts-url-shortener","name":"URL Shortener by MyThemeShop","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52c2aae5-17c2-45eb-b55f-bb27555fb1f7","source":"wordfence","cve":"CVE-2023-44982","title":"WP Retina 2x <= 6.4.5 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c2aae5-17c2-45eb-b55f-bb27555fb1f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-retina-2x","name":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","from":"*","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52c4c16f-2e6e-4cbd-b061-4324a6002eab","source":"wordfence","cve":"CVE-2023-5348","title":"Product Catalog Mode For WooCommerce <= 5.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c4c16f-2e6e-4cbd-b061-4324a6002eab?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52c7edcc-d8dd-401a-9d36-e395fa7189bf","source":"wordfence","cve":"","title":"WP Symposium Pro < 16.01 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c7edcc-d8dd-401a-9d36-e395fa7189bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium-pro","name":"WP Symposium Pro","from":"*","from_inclusive":true,"to":"16.01","to_inclusive":false,"patched_in":"16.01"}],"published":"2016-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52c94317-862f-45e5-8cf8-0fa82aa43d49","source":"wordfence","cve":"CVE-2026-2343","title":"PeproDev Ultimate Invoice < 2.2.6 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52c94317-862f-45e5-8cf8-0fa82aa43d49?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2026-03-27T00:00:00Z","updated":"2026-04-09T16:47:43Z"},{"id":"wordfence:52ca2269-a7f4-477c-bacd-0321ad09e679","source":"wordfence","cve":"CVE-2026-109384","title":"The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ca2269-a7f4-477c-bacd-0321ad09e679?source=api-prod","affected":[{"type":"plugin","slug":"ivyforms","name":"The Innovative Form Builder \u2013 IvyForms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-10-27T18:14:34Z","updated":"2026-10-28T06:45:12Z"},{"id":"wordfence:52cbc6a4-9825-4b26-8653-0c75cf5247c5","source":"wordfence","cve":"CVE-2026-3892","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52cbc6a4-9825-4b26-8653-0c75cf5247c5?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.107","to_inclusive":true,"patched_in":"1.4.108"}],"published":"2026-05-13T18:03:27Z","updated":"2026-05-14T06:44:10Z"},{"id":"wordfence:52cce49b-49b3-49b0-9f18-4829f07a420f","source":"wordfence","cve":"CVE-2024-6316","title":"Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52cce49b-49b3-49b0-9f18-4829f07a420f?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-09-06T15:04:24Z"},{"id":"wordfence:52cd845d-9c63-4f96-8ce6-fdaa6f535447","source":"wordfence","cve":"CVE-2025-46469","title":"Send From <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52cd845d-9c63-4f96-8ce6-fdaa6f535447?source=api-prod","affected":[{"type":"plugin","slug":"send-from","name":"Send From","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-04-24T00:00:00Z","updated":"2025-10-14T19:16:40Z"},{"id":"wordfence:52cdd3fe-9b53-4c7c-9538-e0c475d06ed3","source":"wordfence","cve":"CVE-2025-32277","title":"CRM WordPress Plugin \u2013 RepairBuddy <= 3.8213 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52cdd3fe-9b53-4c7c-9538-e0c475d06ed3?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.8213","to_inclusive":true,"patched_in":"3.8214"}],"published":"2025-04-04T00:00:00Z","updated":"2025-06-10T14:39:25Z"},{"id":"wordfence:52ce7a69-7b65-4150-ad33-1a73ace63d93","source":"wordfence","cve":"CVE-2025-22659","title":"Orbit Fox by ThemeIsle <= 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ce7a69-7b65-4150-ad33-1a73ace63d93?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.44","to_inclusive":true,"patched_in":"2.10.45"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:39:33Z"},{"id":"wordfence:52d05693-469f-4fd9-800a-d8b9b94760fb","source":"wordfence","cve":"CVE-2025-60219","title":"WooCommerce Designer Pro <= 1.9.24 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d05693-469f-4fd9-800a-d8b9b94760fb?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.24","to_inclusive":true,"patched_in":""}],"published":"2025-06-10T00:00:00Z","updated":"2025-10-15T17:54:03Z"},{"id":"wordfence:52d1cf26-bfd2-402b-b51a-59ccadd19091","source":"wordfence","cve":"CVE-2026-45437","title":"Product Filter Widget for Elementor <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d1cf26-bfd2-402b-b51a-59ccadd19091?source=api-prod","affected":[{"type":"plugin","slug":"product-filter-widget-for-elementor","name":"Product Filter Widget for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:38:30Z"},{"id":"wordfence:52d1f9a3-243e-4e2c-a752-f40b6d275121","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_delete_expired_used_coupon_code","severity":"low","cvss":3.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d1f9a3-243e-4e2c-a752-f40b6d275121?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.1","to_inclusive":false,"patched_in":"5.16.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52d390e0-95ca-4570-8d4c-f679ee86ffea","source":"wordfence","cve":"","title":"Import any XML or CSV File to WordPress <= 3.2.4 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d390e0-95ca-4570-8d4c-f679ee86ffea?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2020-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52d4909b-2e21-4067-bee1-e9839fcb7dc8","source":"wordfence","cve":"CVE-2025-31873","title":"SheetDB <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d4909b-2e21-4067-bee1-e9839fcb7dc8?source=api-prod","affected":[{"type":"plugin","slug":"sheetdb","name":"SheetDB \u2013 get your Google Spreadsheet data","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-11-04T18:47:44Z"},{"id":"wordfence:52d5b042-0be4-4f43-8ba7-e83c6a3f7f9a","source":"wordfence","cve":"CVE-2026-40800","title":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) <= 1.5.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d5b042-0be4-4f43-8ba7-e83c6a3f7f9a?source=api-prod","affected":[{"type":"plugin","slug":"elex-bulk-edit-products-prices-attributes-for-woocommerce-basic","name":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-28T21:18:18Z"},{"id":"wordfence:52d5b3d0-7871-4675-b11f-ba5924abd37b","source":"wordfence","cve":"CVE-2025-66534","title":"The Aisle <= 2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d5b3d0-7871-4675-b11f-ba5924abd37b?source=api-prod","affected":[{"type":"theme","slug":"theaisle","name":"The Aisle - Elegant Wedding WordPress Theme","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-11T16:41:49Z"},{"id":"wordfence:52d6f0c3-2e2e-44cb-a5ea-85c19424ddac","source":"wordfence","cve":"CVE-2024-39641","title":"LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d6f0c3-2e2e-44cb-a5ea-85c19424ddac?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8.2","to_inclusive":true,"patched_in":"4.2.6.9"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:22:05Z"},{"id":"wordfence:52d79cdd-739f-4ae9-9214-bc64ca7d8ecb","source":"wordfence","cve":"CVE-2024-2539","title":"Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d79cdd-739f-4ae9-9214-bc64ca7d8ecb?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.6","to_inclusive":true,"patched_in":"8.3.7"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T05:32:22Z"},{"id":"wordfence:52d8a57c-c99b-4d10-b249-5ec2764a0e2d","source":"wordfence","cve":"CVE-2023-22675","title":"Fast Cache <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52d8a57c-c99b-4d10-b249-5ec2764a0e2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-fast-cache","name":"WP Fast Cache","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2025-12-10T15:50:13Z"},{"id":"wordfence:52daa230-1600-4ace-9adf-3f4e9be51e9f","source":"wordfence","cve":"","title":"Jupiter X Core <= 2.0.9 - Missing Authorization Checks","severity":"high","cvss":7.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52daa230-1600-4ace-9adf-3f4e9be51e9f?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52db8d41-859a-4d68-8b83-3d3af8f1bf64","source":"wordfence","cve":"CVE-2023-0556","title":"ContentStudio <= 1.2.5 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52db8d41-859a-4d68-8b83-3d3af8f1bf64?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52dc69e7-d4c0-492e-a334-54464fc963fd","source":"wordfence","cve":"","title":"Email Before Download <= 3.6 - SMTP Header Injection","severity":"medium","cvss":5.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52dc69e7-d4c0-492e-a334-54464fc963fd?source=api-prod","affected":[{"type":"plugin","slug":"email-before-download","name":"Email Before Download","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"4.0"}],"published":"2017-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52dd12eb-5f50-4048-a0e1-23d181400dad","source":"wordfence","cve":"CVE-2025-23587","title":"all-in-one-box-login <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52dd12eb-5f50-4048-a0e1-23d181400dad?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-login","name":"all-in-one-box-login","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:15:50Z"},{"id":"wordfence:52dd9f90-5654-42f4-a2b7-350d90d91e2d","source":"wordfence","cve":"CVE-2025-32555","title":"SEO, Nutrition and Print for Recipes by Edamam <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52dd9f90-5654-42f4-a2b7-350d90d91e2d?source=api-prod","affected":[{"type":"plugin","slug":"seo-nutrition-and-print-for-recipes-by-edamam","name":"SEO, Nutrition and Print for Recipes by Edamam","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:54:25Z"},{"id":"wordfence:52ddc55b-e853-4ca5-aa1c-4daec20dbb0a","source":"wordfence","cve":"CVE-2025-31776","title":"Uptime Robot Plugin for WordPress <= 2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ddc55b-e853-4ca5-aa1c-4daec20dbb0a?source=api-prod","affected":[{"type":"plugin","slug":"uptime-robot-monitor","name":"Uptime Robot Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:32:11Z"},{"id":"wordfence:52e04362-2e14-4d50-867d-df9263fa1ac9","source":"wordfence","cve":"CVE-2025-23425","title":"Marekkis Watermark-Plugin <= 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52e04362-2e14-4d50-867d-df9263fa1ac9?source=api-prod","affected":[{"type":"plugin","slug":"marekkis-watermark","name":"Marekkis Watermark-Plugin","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-10T15:36:39Z"},{"id":"wordfence:52e2f1b9-d240-4813-9124-51bd6b047553","source":"wordfence","cve":"CVE-2025-13861","title":"HTML Forms \u2013 Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52e2f1b9-d240-4813-9124-51bd6b047553?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-12-16T16:01:44Z","updated":"2025-12-17T04:31:31Z"},{"id":"wordfence:52e3c4c0-1690-4982-86c3-0e90ce11d835","source":"wordfence","cve":"CVE-2026-27406","title":"My Tickets \u2013 Accessible Event Ticketing <= 2.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52e3c4c0-1690-4982-86c3-0e90ce11d835?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:17:54Z"},{"id":"wordfence:52e452d4-31ae-4909-a653-4f69b7e1c32a","source":"wordfence","cve":"CVE-2025-47615","title":"Amazon Product in a Post <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52e452d4-31ae-4909-a653-4f69b7e1c32a?source=api-prod","affected":[{"type":"plugin","slug":"amazon-product-in-a-post-plugin","name":"Amazon Product in a Post Plugin","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:57:56Z"},{"id":"wordfence:52e4f79f-1148-4530-8d78-377a7365978a","source":"wordfence","cve":"CVE-2024-1779","title":"Admin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52e4f79f-1148-4530-8d78-377a7365978a?source=api-prod","affected":[{"type":"plugin","slug":"admin-side-data-storage-for-contact-form-7","name":"Admin side data storage for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T06:48:17Z"},{"id":"wordfence:52eaab58-1e94-4f71-9896-dc2154b00e8e","source":"wordfence","cve":"CVE-2026-107630","title":"Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52eaab58-1e94-4f71-9896-dc2154b00e8e?source=api-prod","affected":[{"type":"plugin","slug":"email-templates","name":"Email Templates Customizer and Designer for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":"1.5.15"}],"published":"2026-10-30T16:21:29Z","updated":"2026-10-30T17:15:27Z"},{"id":"wordfence:52eddb68-7b72-4c47-a365-0676970b5207","source":"wordfence","cve":"CVE-2026-25463","title":"Wpresidence Core <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52eddb68-7b72-4c47-a365-0676970b5207?source=api-prod","affected":[{"type":"plugin","slug":"wpresidence-core","name":"Wpresidence Core","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-17T00:00:00Z","updated":"2026-05-04T15:34:20Z"},{"id":"wordfence:52ee1a7d-33c6-48aa-a2ac-62a1246439a9","source":"wordfence","cve":"CVE-2024-6076","title":"WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Category Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ee1a7d-33c6-48aa-a2ac-62a1246439a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-06-24T00:00:00Z","updated":"2024-07-01T14:42:54Z"},{"id":"wordfence:52efc168-fed9-45c6-9a2c-1e3a198f71f9","source":"wordfence","cve":"CVE-2022-0420","title":"RegistrationMagic <= 5.0.2.1 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52efc168-fed9-45c6-9a2c-1e3a198f71f9?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.0.2.2","to_inclusive":false,"patched_in":"5.0.2.2"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52f1f545-d2bf-4692-a1f2-10847348e862","source":"wordfence","cve":"CVE-2025-1454","title":"Ninja Pages <= 1.4.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52f1f545-d2bf-4692-a1f2-10847348e862?source=api-prod","affected":[{"type":"plugin","slug":"ninja-page-categories-and-tags","name":"Ninja Pages","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:05:39Z"},{"id":"wordfence:52f5c90a-e4ba-4212-83e0-281b8624dda0","source":"wordfence","cve":"CVE-2024-37258","title":"Social Rocket <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52f5c90a-e4ba-4212-83e0-281b8624dda0?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:53:51Z"},{"id":"wordfence:52f820c5-d4ce-4925-a055-a7c75a320971","source":"wordfence","cve":"CVE-2022-4108","title":"Wholesale Market for WooCommerce <= 1.0.7 - Authenticated (Administrator+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52f820c5-d4ce-4925-a055-a7c75a320971?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market-for-woocommerce","name":"Wholesale Market for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52f98de0-ad91-4b5a-91ef-6fe705f2bf60","source":"wordfence","cve":"CVE-2024-3920","title":"Flattr <= 1.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52f98de0-ad91-4b5a-91ef-6fe705f2bf60?source=api-prod","affected":[{"type":"plugin","slug":"flattr","name":"Flattr","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-09T15:08:46Z"},{"id":"wordfence:52f9db86-7fed-4b32-8384-3ceb300f9249","source":"wordfence","cve":"CVE-2024-7489","title":"Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52f9db86-7fed-4b32-8384-3ceb300f9249?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-wp","name":"Forms for Mailchimp by Optin Cat \u2013 Grow Your MailChimp List","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-10-11T00:00:00Z","updated":"2024-12-02T21:27:16Z"},{"id":"wordfence:52fb128f-d846-478e-bf9a-cbc3fe8ce89d","source":"wordfence","cve":"CVE-2021-24894","title":"Reviews Plus < 1.2.14 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52fb128f-d846-478e-bf9a-cbc3fe8ce89d?source=api-prod","affected":[{"type":"plugin","slug":"reviews-plus","name":"Reviews Plus","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":false,"patched_in":"1.2.15"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52fc484a-973f-44e6-a767-7e27f51c5a0f","source":"wordfence","cve":"CVE-2025-48091","title":"AnyComment <= 0.3.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52fc484a-973f-44e6-a767-7e27f51c5a0f?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:55:37Z"},{"id":"wordfence:52fde632-f3a4-48d5-8c2c-c42b9d20dcb7","source":"wordfence","cve":"CVE-2023-0520","title":"RapidExpCart <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52fde632-f3a4-48d5-8c2c-c42b9d20dcb7?source=api-prod","affected":[{"type":"plugin","slug":"rapidexpcart","name":"RapidExpCart","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:52ff0d94-82cc-4ebd-9481-6d29f00fcc02","source":"wordfence","cve":"CVE-2026-57358","title":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer <= 4.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/52ff0d94-82cc-4ebd-9481-6d29f00fcc02?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":"4.3.10"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T20:00:31Z"},{"id":"wordfence:5300f1dc-d110-45d0-9e08-6339b12c2bdd","source":"wordfence","cve":"CVE-2026-56052","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.15.0.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5300f1dc-d110-45d0-9e08-6339b12c2bdd?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.5","to_inclusive":true,"patched_in":"3.15.0.6"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:06:19Z"},{"id":"wordfence:5304da48-5d42-47ce-b1b1-dc04b8fa9dff","source":"wordfence","cve":"CVE-2022-47149","title":"Shortlinks by Pretty Links <= 3.4.0 - Cross-Site Request Forgery via route","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5304da48-5d42-47ce-b1b1-dc04b8fa9dff?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53071503-0edd-458f-a24d-107d576695ed","source":"wordfence","cve":"CVE-2015-9391","title":"YAWPP (Yet Another WordPress Petition Plugin) <= 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53071503-0edd-458f-a24d-107d576695ed?source=api-prod","affected":[{"type":"plugin","slug":"yawpp","name":"YAWPP (Yet Another WordPress Petition Plugin)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2015-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5309e891-ced1-496f-8ee5-c089a91a7666","source":"wordfence","cve":"CVE-2025-12113","title":"Alt Text Generator AI \u2013 Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5309e891-ced1-496f-8ee5-c089a91a7666?source=api-prod","affected":[{"type":"plugin","slug":"alt-text-generator","name":"Alt Text Generator AI \u2013 Auto Generate & Bulk Update Alt Texts For Images","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2025-11-11T19:11:21Z","updated":"2025-11-12T07:27:41Z"},{"id":"wordfence:530ccf41-f596-4783-b177-36fc9a3a6e81","source":"wordfence","cve":"CVE-2024-34374","title":"ElementsReady Addons for Elementor <= 5.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/530ccf41-f596-4783-b177-36fc9a3a6e81?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:02:50Z"},{"id":"wordfence:530ee998-de16-407f-8e84-b0d7c31c6f5f","source":"wordfence","cve":"CVE-2023-24396","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/530ee998-de16-407f-8e84-b0d7c31c6f5f?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":false,"patched_in":"1.5.12"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5311b43c-14dd-4bdd-b6d0-d6468b831968","source":"wordfence","cve":"CVE-2025-5482","title":"Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5311b43c-14dd-4bdd-b6d0-d6468b831968?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.4.12"}],"published":"2025-06-03T19:10:16Z","updated":"2025-06-04T15:30:36Z"},{"id":"wordfence:53124575-ca94-47d6-b0dd-033ac17c24ae","source":"wordfence","cve":"CVE-2021-24625","title":"SpiderCatalog <= 1.7.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53124575-ca94-47d6-b0dd-033ac17c24ae?source=api-prod","affected":[{"type":"plugin","slug":"catalog","name":"SpiderCatalog","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:531360c6-e78a-4344-be06-95735337a2d6","source":"wordfence","cve":"CVE-2025-11703","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning","severity":"medium","cvss":5.3,"cwe":"CWE-349","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531360c6-e78a-4344-be06-95735337a2d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.48","to_inclusive":true,"patched_in":"9.0.49"}],"published":"2025-10-17T17:52:24Z","updated":"2025-10-18T06:42:46Z"},{"id":"wordfence:53157142-f14b-4e95-bea2-77de9b657274","source":"wordfence","cve":"CVE-2024-11269","title":"AHAthat Plugin <= 1.6 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53157142-f14b-4e95-bea2-77de9b657274?source=api-prod","affected":[{"type":"plugin","slug":"ahathat","name":"AHAthat Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-27T00:00:00Z","updated":"2025-05-27T15:14:29Z"},{"id":"wordfence:531662ac-26bd-41a5-8eeb-03bfafad2b7c","source":"wordfence","cve":"CVE-2025-53447","title":"Assembly <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531662ac-26bd-41a5-8eeb-03bfafad2b7c?source=api-prod","affected":[{"type":"theme","slug":"assembly","name":"Assembly - Conference Event & Concert WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:27:07Z"},{"id":"wordfence:53171e83-0ab2-490d-ab61-511dd18b111b","source":"wordfence","cve":"CVE-2026-84259","title":"click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53171e83-0ab2-490d-ab61-511dd18b111b?source=api-prod","affected":[{"type":"plugin","slug":"wpf-add-on-by-click5","name":"click5 CRM add-on to WPForms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:12:16Z"},{"id":"wordfence:53192f38-ab76-4843-a652-37c266b527e7","source":"wordfence","cve":"CVE-2024-44040","title":"ShiftController Employee Shift Scheduling <= 4.9.64 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53192f38-ab76-4843-a652-37c266b527e7?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.64","to_inclusive":true,"patched_in":"4.9.65"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T19:59:32Z"},{"id":"wordfence:531954dd-ed3f-4626-adab-c1bba8407c89","source":"wordfence","cve":"CVE-2024-1364","title":"Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531954dd-ed3f-4626-adab-c1bba8407c89?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T06:40:49Z"},{"id":"wordfence:53199f3c-80d1-4c4e-93ef-8a234ba8ba85","source":"wordfence","cve":"CVE-2023-23975","title":"Quick Event Manager <= 9.7.4 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53199f3c-80d1-4c4e-93ef-8a234ba8ba85?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.7.4","to_inclusive":true,"patched_in":"9.7.5"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:531d57c4-404a-475e-842a-08425959e150","source":"wordfence","cve":"CVE-2024-54297","title":"vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531d57c4-404a-475e-842a-08425959e150?source=api-prod","affected":[{"type":"plugin","slug":"vbsso-lite","name":"vBSSO-lite","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:40:01Z"},{"id":"wordfence:531d88eb-36a8-46be-a837-b385fcd42b00","source":"wordfence","cve":"CVE-2026-8151","title":"Simple Membership MailChimp Integration <= 1.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531d88eb-36a8-46be-a837-b385fcd42b00?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership-mailchimp-integration","name":"Simple Membership MailChimp Integration","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2026-05-14T00:00:00Z","updated":"2026-09-16T15:53:10Z"},{"id":"wordfence:531e6da9-a24c-4b75-b909-ec4614075044","source":"wordfence","cve":"CVE-2025-31398","title":"PIMP - Creative MultiPurpose <= 1.7 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/531e6da9-a24c-4b75-b909-ec4614075044?source=api-prod","affected":[{"type":"theme","slug":"pimp","name":"PIMP - Creative MultiPurpose Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:15:50Z"},{"id":"wordfence:53234e29-5213-4acd-abfe-5c4ea5dbf829","source":"wordfence","cve":"CVE-2025-10691","title":"Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53234e29-5213-4acd-abfe-5c4ea5dbf829?source=api-prod","affected":[{"type":"plugin","slug":"email-subscription-with-secure-captcha","name":"Easy Email Subscription","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-11-05T15:20:07Z","updated":"2025-11-06T03:27:02Z"},{"id":"wordfence:5323dbb7-3893-4b43-838b-6326505b2fb7","source":"wordfence","cve":"CVE-2025-4336","title":"eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_file()","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7?source=api-prod","affected":[{"type":"plugin","slug":"store-manager-connector","name":"eMagicOne Store Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-05-23T14:33:08Z","updated":"2025-11-05T21:27:41Z"},{"id":"wordfence:5324ca6d-37cb-41e4-8355-80ca113f855e","source":"wordfence","cve":"CVE-2026-1268","title":"Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5324ca6d-37cb-41e4-8355-80ca113f855e?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widget-content","name":"Dynamic Widget Content","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2026-02-04T18:42:46Z","updated":"2026-02-05T06:47:42Z"},{"id":"wordfence:53279e06-8561-47cf-8786-fed21f090530","source":"wordfence","cve":"CVE-2025-69049","title":"T\u00f6bel <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53279e06-8561-47cf-8786-fed21f090530?source=api-prod","affected":[{"type":"theme","slug":"tobel","name":"T\u00f6bel - Modern Furniture Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T22:05:11Z"},{"id":"wordfence:53282bec-cd47-4db4-8ffe-6647521c0d49","source":"wordfence","cve":"CVE-2025-5925","title":"Bunny\u2019s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53282bec-cd47-4db4-8ffe-6647521c0d49?source=api-prod","affected":[{"type":"plugin","slug":"bunnys-print-css","name":"Bunny\u2019s Print CSS","from":"*","from_inclusive":true,"to":"0.95","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T14:29:40Z","updated":"2025-06-10T03:41:37Z"},{"id":"wordfence:532b58eb-6d8b-4bb7-b5c5-604ad24dba98","source":"wordfence","cve":"CVE-2024-38730","title":"Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/532b58eb-6d8b-4bb7-b5c5-604ad24dba98?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.1.41","to_inclusive":true,"patched_in":"1.1.42"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-18T14:30:56Z"},{"id":"wordfence:532ce349-0f4c-4197-bbbd-1e3dcbd0c9d3","source":"wordfence","cve":"CVE-2021-20779","title":"WordPress Email Template Designer < 3.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/532ce349-0f4c-4197-bbbd-1e3dcbd0c9d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-mail","name":"Email Template Designer \u2013 WP HTML Mail","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2021-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:532cffdb-16e8-4ced-9477-483c96db343c","source":"wordfence","cve":"CVE-2023-47818","title":"LWS Hide Login <= 2.1.8 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/532cffdb-16e8-4ced-9477-483c96db343c?source=api-prod","affected":[{"type":"plugin","slug":"lws-hide-login","name":"LWS Hide Login","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:532d185c-4384-4b15-a104-42f8d2a1ca23","source":"wordfence","cve":"CVE-2023-50833","title":"Colibri Page Builder <= 1.0.240 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/532d185c-4384-4b15-a104-42f8d2a1ca23?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.240","to_inclusive":true,"patched_in":"1.0.241"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53307cb0-5016-4991-829d-7299061adf29","source":"wordfence","cve":"CVE-2026-16041","title":"MStore API <= 4.20.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53307cb0-5016-4991-829d-7299061adf29?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.20.0","to_inclusive":true,"patched_in":"4.21.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:34:00Z"},{"id":"wordfence:5331c7cc-3854-4975-9f28-e9b0d6407227","source":"wordfence","cve":"CVE-2014-8803","title":"Smart Forms \u2013 when you need more than just a contact form <= 2.1.0 - Missing Authorization","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5331c7cc-3854-4975-9f28-e9b0d6407227?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2014-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53356d15-8db0-4015-addf-9bf66446e81f","source":"wordfence","cve":"CVE-2023-49740","title":"Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via rt","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53356d15-8db0-4015-addf-9bf66446e81f?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.28","to_inclusive":true,"patched_in":"2.20.29"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53366256-66a8-4c91-91f9-100c7a397b7b","source":"wordfence","cve":"CVE-2026-77005","title":"CODE MONKEYS PROPOSALS \u2013 Easily create client proposals from your WordPress admin dashboard <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53366256-66a8-4c91-91f9-100c7a397b7b?source=api-prod","affected":[{"type":"plugin","slug":"code-monkeys-proposals","name":"CODE MONKEYS PROPOSALS \u2013 Easily create client proposals from your WordPress admin dashboard","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:15:14Z"},{"id":"wordfence:5338cb06-ec30-4552-8939-b3135e53d65a","source":"wordfence","cve":"CVE-2026-25393","title":"Hello FSE <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5338cb06-ec30-4552-8939-b3135e53d65a?source=api-prod","affected":[{"type":"theme","slug":"hello-fse","name":"Hello FSE","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-26T19:53:07Z"},{"id":"wordfence:5339024c-afcc-4fdc-a14b-056068ff2f5b","source":"wordfence","cve":"CVE-2026-8071","title":"CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5339024c-afcc-4fdc-a14b-056068ff2f5b?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.79","to_inclusive":false,"patched_in":"6.79"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:35:57Z"},{"id":"wordfence:533bf4ba-5929-475e-ac98-43d97288cdfe","source":"wordfence","cve":"CVE-2022-2267","title":"Mailchimp for WooCommerce <= 2.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/533bf4ba-5929-475e-ac98-43d97288cdfe?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2022-08-03T00:00:00Z","updated":"2024-10-24T18:52:16Z"},{"id":"wordfence:533c1063-f9de-41c2-90c4-e5f777cbf686","source":"wordfence","cve":"CVE-2026-96461","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/533c1063-f9de-41c2-90c4-e5f777cbf686?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2026-10-02T07:49:35Z","updated":"2026-10-13T14:49:30Z"},{"id":"wordfence:533ce011-0a14-4d06-bcf4-094c08d404f4","source":"wordfence","cve":"CVE-2026-24990","title":"WP Docs <= 2.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/533ce011-0a14-4d06-bcf4-094c08d404f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2026-01-21T00:00:00Z","updated":"2026-02-10T19:56:02Z"},{"id":"wordfence:533f6552-38aa-4251-89fa-e5f79ccb3df0","source":"wordfence","cve":"CVE-2024-4655","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/533f6552-38aa-4251-89fa-e5f79ccb3df0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-01T14:05:24Z"},{"id":"wordfence:533f71d5-823d-45eb-8ecf-76afafd2a5d3","source":"wordfence","cve":"","title":"Popup Maker <= 1.18.0 - Cross-Site Request Forgery via init","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/533f71d5-823d-45eb-8ecf-76afafd2a5d3?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5340204a-8a4f-4e23-82a1-c228b884c34a","source":"wordfence","cve":"CVE-2021-24889","title":"Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5340204a-8a4f-4e23-82a1-c228b884c34a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":false,"patched_in":"3.6.4"}],"published":"2021-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53409aeb-67a6-4a44-993a-fb23f8fb1344","source":"wordfence","cve":"","title":"WooCommerce Extra Cost <= 2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53409aeb-67a6-4a44-993a-fb23f8fb1344?source=api-prod","affected":[{"type":"plugin","slug":"woo-extra-cost","name":"WooCommerce Extra Cost","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53419b7c-e1a5-46ef-9110-c88f43b7df1d","source":"wordfence","cve":"CVE-2025-11880","title":"SM CountDown Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53419b7c-e1a5-46ef-9110-c88f43b7df1d?source=api-prod","affected":[{"type":"plugin","slug":"smcountdown","name":"SM CountDown Widget","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:23:39Z","updated":"2025-10-22T08:27:07Z"},{"id":"wordfence:5341f18f-9d28-4e7d-8348-c9452ea1b5a6","source":"wordfence","cve":"CVE-2025-69148","title":"Quirky <= 1.23 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5341f18f-9d28-4e7d-8348-c9452ea1b5a6?source=api-prod","affected":[{"type":"theme","slug":"quirky","name":"Quirky - NFT, Token & Artist Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T11:56:49Z"},{"id":"wordfence:5344499d-c183-4164-a52c-0dca7873f63d","source":"wordfence","cve":"","title":"Woocommerce Vietnam Checkout <= 2.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5344499d-c183-4164-a52c-0dca7873f63d?source=api-prod","affected":[{"type":"plugin","slug":"woo-vietnam-checkout","name":"Vietnam Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:534557b0-16d2-4a77-a118-b66fc7474ecf","source":"wordfence","cve":"CVE-2025-12809","title":"dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/534557b0-16d2-4a77-a118-b66fc7474ecf?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-12-15T16:39:50Z","updated":"2025-12-16T05:25:21Z"},{"id":"wordfence:53459a4d-6ffd-46bf-926a-761db4cfb50c","source":"wordfence","cve":"CVE-2021-24826","title":"Custom Content Shortcode <= 4.0.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53459a4d-6ffd-46bf-926a-761db4cfb50c?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-shortcode","name":"Custom Content Shortcode","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5347f988-6ee3-4e9b-ab55-4debe074aa12","source":"wordfence","cve":"CVE-2025-22302","title":"WP Wand <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5347f988-6ee3-4e9b-ab55-4debe074aa12?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-generation","name":"WP Wand \u2013 AI Content Writer for OpenAI, Claude, Gemini, OpenRouter and Deepseek","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:17:16Z"},{"id":"wordfence:5349096b-4897-4019-9eba-a959a42f03f0","source":"wordfence","cve":"CVE-2024-13812","title":"Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5349096b-4897-4019-9eba-a959a42f03f0?source=api-prod","affected":[{"type":"plugin","slug":"anps_theme_plugin","name":"Anps Theme plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-26T08:23:30Z"},{"id":"wordfence:5349815d-a9e4-431a-8da7-0d7d68b7d427","source":"wordfence","cve":"CVE-2026-97341","title":"Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5349815d-a9e4-431a-8da7-0d7d68b7d427?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"8.16","to_inclusive":true,"patched_in":"8.17"}],"published":"2026-10-02T17:15:23Z","updated":"2026-10-03T05:29:14Z"},{"id":"wordfence:534a5d1d-cc34-4d84-b3a3-bf2282718656","source":"wordfence","cve":"CVE-2024-6591","title":"Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/534a5d1d-cc34-4d84-b3a3-bf2282718656?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.8"}],"published":"2024-07-26T13:11:32Z","updated":"2024-08-08T20:49:48Z"},{"id":"wordfence:534e6f80-b162-4a4b-a979-72ed63a8b0dc","source":"wordfence","cve":"CVE-2023-28535","title":"Paytm Payment Donation <= 2.2.0 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/534e6f80-b162-4a4b-a979-72ed63a8b0dc?source=api-prod","affected":[{"type":"plugin","slug":"paytm-donation","name":"Paytm Payment Donation","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:534fd39e-bc32-4534-b7cd-ee50161c0b13","source":"wordfence","cve":"CVE-2024-43143","title":"Registrations for the Events Calendar <= 2.12.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/534fd39e-bc32-4534-b7cd-ee50161c0b13?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:53:12Z"},{"id":"wordfence:5350e519-3fa5-4463-b7b4-12bbe6fd5591","source":"wordfence","cve":"CVE-2012-4263","title":"iThemes Security < 3.2.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5350e519-3fa5-4463-b7b4-12bbe6fd5591?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5351212d-122e-4356-b6d1-86bd0cd2cc68","source":"wordfence","cve":"CVE-2026-57374","title":"FunnelKit Funnel Builder Pro <= 3.15.0.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5351212d-122e-4356-b6d1-86bd0cd2cc68?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder-pro","name":"FunnelKit Funnel Builder Pro","from":"*","from_inclusive":true,"to":"3.15.0.7","to_inclusive":true,"patched_in":"3.15.0.8"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:26:19Z"},{"id":"wordfence:53577cf4-af87-41a2-9424-56a584b78cf3","source":"wordfence","cve":"CVE-2023-23831","title":"Rating Widget <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53577cf4-af87-41a2-9424-56a584b78cf3?source=api-prod","affected":[{"type":"plugin","slug":"rating-widget","name":"Rating-Widget: Star Review System","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53580b24-c0a7-4578-bb11-5952ebcacc42","source":"wordfence","cve":"","title":"UltimateWoo \u2013 The Ultimate WooCommerce Plugin with Unlimited Usage <= 0.1.10 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53580b24-c0a7-4578-bb11-5952ebcacc42?source=api-prod","affected":[{"type":"plugin","slug":"ultimatewoo","name":"UltimateWoo \u2013 The Ultimate WooCommerce Plugin with Unlimited Usage","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":""}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53591a3b-8a99-40e2-8145-1d7785bcbab4","source":"wordfence","cve":"CVE-2024-11323","title":"AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53591a3b-8a99-40e2-8145-1d7785bcbab4?source=api-prod","affected":[{"type":"plugin","slug":"ai-quiz","name":"AI Quiz | Quiz Maker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:32:25Z","updated":"2024-12-06T08:24:53Z"},{"id":"wordfence:53592fea-573c-49ce-b4a7-d8e9e97d8ba6","source":"wordfence","cve":"CVE-2026-23541","title":"Mail Mint <= 1.19.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53592fea-573c-49ce-b4a7-d8e9e97d8ba6?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.19.4","to_inclusive":true,"patched_in":"1.19.5"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-24T19:22:09Z"},{"id":"wordfence:535aa061-479f-415e-bee6-3151c42b917e","source":"wordfence","cve":"CVE-2025-3101","title":"Configurator Theme Core <= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535aa061-479f-415e-bee6-3151c42b917e?source=api-prod","affected":[{"type":"plugin","slug":"amz-configurator-core","name":"Configurator Theme Core","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:36:21Z","updated":"2025-04-24T08:23:49Z"},{"id":"wordfence:535af5fa-891b-4d21-ab13-c4ef68dd339b","source":"wordfence","cve":"CVE-2012-2912","title":"LeagueManager <= 3.7 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535af5fa-891b-4d21-ab13-c4ef68dd339b?source=api-prod","affected":[{"type":"plugin","slug":"leaguemanager","name":"LeagueManager","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:535c4796-d1aa-4cd1-922e-f9dcf216f76d","source":"wordfence","cve":"CVE-2026-100159","title":"Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers","severity":"medium","cvss":4.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535c4796-d1aa-4cd1-922e-f9dcf216f76d?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"6.4.1","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2026-10-15T13:57:16Z","updated":"2026-10-16T02:26:11Z"},{"id":"wordfence:535d3934-6117-46ee-87b8-fbefb58ba272","source":"wordfence","cve":"CVE-2025-54726","title":"JS Archive List <= 6.1.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535d3934-6117-46ee-87b8-fbefb58ba272?source=api-prod","affected":[{"type":"plugin","slug":"jquery-archive-list-widget","name":"JS Archive List","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T21:11:41Z"},{"id":"wordfence:535e3a09-ee34-4623-ad40-0eb8aaed26b8","source":"wordfence","cve":"CVE-2026-122673","title":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets <= 4.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535e3a09-ee34-4623-ad40-0eb8aaed26b8?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"4.9.9"}],"published":"2026-11-07T12:35:00Z","updated":"2026-11-10T19:55:45Z"},{"id":"wordfence:535e754e-f851-4809-a148-d9ba808b9d8a","source":"wordfence","cve":"CVE-2023-5466","title":"Wp anything slider <= 9.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535e754e-f851-4809-a148-d9ba808b9d8a?source=api-prod","affected":[{"type":"plugin","slug":"wp-anything-slider","name":"Wp anything slider","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:535f1d8a-8266-4f90-82fa-9c32181bf277","source":"wordfence","cve":"CVE-2025-12586","title":"Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535f1d8a-8266-4f90-82fa-9c32181bf277?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-mode-based-on-user-roles","name":"Conditionnal Maintenance Mode for WordPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-11-24T19:14:18Z","updated":"2025-12-02T14:21:53Z"},{"id":"wordfence:535f9f16-a7fc-40fe-8be1-90c542675cc4","source":"wordfence","cve":"CVE-2024-54375","title":"Woolook <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/535f9f16-a7fc-40fe-8be1-90c542675cc4?source=api-prod","affected":[{"type":"plugin","slug":"woolook","name":"Woocommerce Blocks \u2013 Woolook","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:44:02Z"},{"id":"wordfence:5361df27-493c-4731-9502-071af4894bbb","source":"wordfence","cve":"CVE-2021-24403","title":"WordPress Page Contact <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5361df27-493c-4731-9502-071af4894bbb?source=api-prod","affected":[{"type":"plugin","slug":"wpagecontact","name":"WordPress Page Contact","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53667fd6-0d12-400d-b3a1-7cee305a2bc2","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'bulkDelete' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53667fd6-0d12-400d-b3a1-7cee305a2bc2?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5367ca36-e3e0-4bb3-8148-4e7623d35315","source":"wordfence","cve":"CVE-2026-27343","title":"Airtifact <= 1.2.91 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5367ca36-e3e0-4bb3-8148-4e7623d35315?source=api-prod","affected":[{"type":"theme","slug":"airtifact","name":"Airtifact - Portfolio Creative WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.91","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-05-04T15:38:07Z"},{"id":"wordfence:53686d01-b60c-4324-895e-2fae3ccfa3c9","source":"wordfence","cve":"","title":"MP3-jPlayer <= 1.8.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53686d01-b60c-4324-895e-2fae3ccfa3c9?source=api-prod","affected":[{"type":"plugin","slug":"mp3-jplayer","name":"MP3-jPlayer","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2015-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:536a7b48-abb4-47b8-8665-e06363e2e867","source":"wordfence","cve":"CVE-2024-37249","title":"Advanced Custom Fields PRO < 6.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/536a7b48-abb4-47b8-8665-e06363e2e867?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":false,"patched_in":"6.3.2"}],"published":"2024-06-26T00:00:00Z","updated":"2026-05-11T21:16:01Z"},{"id":"wordfence:536b3d61-d0a3-4613-9a9e-e994806d90f5","source":"wordfence","cve":"CVE-2024-50447","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/536b3d61-d0a3-4613-9a9e-e994806d90f5?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.19","to_inclusive":true,"patched_in":"1.4.20"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:40:46Z"},{"id":"wordfence:536b924b-44ec-4346-9578-74a7e3836f1b","source":"wordfence","cve":"CVE-2026-25467","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/536b924b-44ec-4346-9578-74a7e3836f1b?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:55:16Z"},{"id":"wordfence:53704fa2-9607-4e5c-8249-699a4db1a2c0","source":"wordfence","cve":"CVE-2025-30963","title":"JetSmartFilters <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53704fa2-9607-4e5c-8249-699a4db1a2c0?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T13:35:48Z"},{"id":"wordfence:53706deb-d49c-4397-98f9-dc37f1d35031","source":"wordfence","cve":"CVE-2026-8378","title":"Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53706deb-d49c-4397-98f9-dc37f1d35031?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:02:14Z"},{"id":"wordfence:53709d2c-6522-40f0-9dc4-82517d3ee7b2","source":"wordfence","cve":"CVE-2025-14906","title":"WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53709d2c-6522-40f0-9dc4-82517d3ee7b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-video-gallery","name":"WP Youtube Video Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:18:54Z","updated":"2026-01-24T07:26:42Z"},{"id":"wordfence:53712fb2-17bd-4c04-96ac-3d892ff32fce","source":"wordfence","cve":"CVE-2026-87784","title":"Cool Media Filter <= 1.0.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53712fb2-17bd-4c04-96ac-3d892ff32fce?source=api-prod","affected":[{"type":"plugin","slug":"cool-media-filter","name":"Cool Media Filter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T20:08:54Z"},{"id":"wordfence:53757567-5024-46cc-b2ae-04b5fc55a35c","source":"wordfence","cve":"CVE-2022-1912","title":"Button Widget Smartsoft <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53757567-5024-46cc-b2ae-04b5fc55a35c?source=api-prod","affected":[{"type":"plugin","slug":"smartsoftbutton-widget-de-botones-de-chat","name":"Button Widget Smartsoft","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:537594d6-9412-4ff1-bf14-bc1164e5358d","source":"wordfence","cve":"CVE-2025-58001","title":"Compact Archives <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537594d6-9412-4ff1-bf14-bc1164e5358d?source=api-prod","affected":[{"type":"plugin","slug":"compact-archives","name":"Compact Archives","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:26:11Z"},{"id":"wordfence:53760acf-e8b2-4e35-8c01-768472fc0996","source":"wordfence","cve":"CVE-2023-4858","title":"Simple Table Manager <= 1.5.6 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53760acf-e8b2-4e35-8c01-768472fc0996?source=api-prod","affected":[{"type":"plugin","slug":"simple-table-manager","name":"Simple Table Manager","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-10-16T00:00:00Z","updated":"2025-01-30T14:48:24Z"},{"id":"wordfence:537a0016-b42d-41b9-bfd2-c34c60f8fa60","source":"wordfence","cve":"CVE-2026-85345","title":"FV Flowplayer Video Player 7.5.44.7212 - 7.5.55.7211 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537a0016-b42d-41b9-bfd2-c34c60f8fa60?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"7.5.44.7212","from_inclusive":true,"to":"7.5.55.7211","to_inclusive":true,"patched_in":"7.5.55.7212"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:41:05Z"},{"id":"wordfence:537acaf7-8d44-484d-9516-774a3de5573f","source":"wordfence","cve":"CVE-2018-19564","title":"Easy Testimonials <= 3.5.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537acaf7-8d44-484d-9516-774a3de5573f?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2018-11-26T00:00:00Z","updated":"2024-08-15T18:15:44Z"},{"id":"wordfence:537b44d4-c227-4241-9ffe-b83177b4225b","source":"wordfence","cve":"CVE-2026-77754","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer < 6.0.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537b44d4-c227-4241-9ffe-b83177b4225b?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.14","to_inclusive":false,"patched_in":"6.0.14"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:04:08Z"},{"id":"wordfence:537b6f36-ae45-465a-b139-6753d50d8e10","source":"wordfence","cve":"CVE-2007-4481","title":"Blix 0.9.1 and Blix 0.9.1 Rus - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537b6f36-ae45-465a-b139-6753d50d8e10?source=api-prod","affected":[{"type":"theme","slug":"blix","name":"Blix","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":""}],"published":"2007-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:537bdd21-7ebd-4c17-a681-18703ac973a5","source":"wordfence","cve":"","title":"Image Zoom <= 1.8.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537bdd21-7ebd-4c17-a681-18703ac973a5?source=api-prod","affected":[{"type":"plugin","slug":"image-zoom","name":"Image Zoom","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":""}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:537be894-d9a2-414a-9b8b-004c73cecbf5","source":"wordfence","cve":"CVE-2025-3702","title":"Melapress File Monitor < 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/537be894-d9a2-414a-9b8b-004c73cecbf5?source=api-prod","affected":[{"type":"plugin","slug":"website-file-changes-monitor","name":"Melapress File Monitor","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:15:33Z"},{"id":"wordfence:538172a3-a153-4f44-87f5-be4008552e6b","source":"wordfence","cve":"CVE-2024-12722","title":"Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538172a3-a153-4f44-87f5-be4008552e6b?source=api-prod","affected":[{"type":"plugin","slug":"twitter-bootstrap-collapse-aka-accordian-shortcode","name":"Twitter Bootstrap Collapse aka Accordian Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T19:03:32Z"},{"id":"wordfence:5381b629-59f0-4b06-b23e-c38638afea0b","source":"wordfence","cve":"CVE-2025-31463","title":"TGG WP Optimizer <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5381b629-59f0-4b06-b23e-c38638afea0b?source=api-prod","affected":[{"type":"plugin","slug":"tgg-wp-optimizer","name":"TGG \u2013 WP Optimizer","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2025-03-28T00:00:00Z","updated":"2026-06-08T16:12:18Z"},{"id":"wordfence:538439d3-b801-4efe-996c-d4c1b083d192","source":"wordfence","cve":"CVE-2026-123472","title":"Meta Box \u2013 A Framework for Dynamic Websites <= 5.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538439d3-b801-4efe-996c-d4c1b083d192?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.15.3","to_inclusive":true,"patched_in":"5.15.4"}],"published":"2026-11-07T17:26:00Z","updated":"2026-11-10T20:00:59Z"},{"id":"wordfence:5385ffa7-045b-4ed8-b1d1-eed8924eeb9b","source":"wordfence","cve":"CVE-2025-9073","title":"All in one Minifier <= 3.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-minifier","name":"All in one Minifier","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2025-09-10T18:49:52Z","updated":"2026-09-11T18:46:02Z"},{"id":"wordfence:538616b8-0c23-42b7-a694-dde69af9e3b9","source":"wordfence","cve":"CVE-2025-22687","title":"Tuaug4 <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538616b8-0c23-42b7-a694-dde69af9e3b9?source=api-prod","affected":[{"type":"theme","slug":"tuaug4","name":"Tuaug4","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:35:28Z"},{"id":"wordfence:5386452a-02f9-465e-b992-c36e4d6dd63d","source":"wordfence","cve":"CVE-2025-66122","title":"Stylish Price List <= 7.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5386452a-02f9-465e-b992-c36e4d6dd63d?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":"7.2.3"}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-06T18:27:38Z"},{"id":"wordfence:538669c7-3237-4059-85dc-4f4af1ff5a19","source":"wordfence","cve":"CVE-2025-5815","title":"Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538669c7-3237-4059-85dc-4f4af1ff5a19?source=api-prod","affected":[{"type":"plugin","slug":"traffic-monitor","name":"Traffic Monitor","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-06-12T14:33:50Z","updated":"2025-06-13T03:41:46Z"},{"id":"wordfence:53871750-6437-459f-97e1-5cf524160f09","source":"wordfence","cve":"CVE-2024-10695","title":"Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53871750-6437-459f-97e1-5cf524160f09?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-12T03:24:57Z"},{"id":"wordfence:53880f49-a2f0-4864-ba85-8fbf06ea7833","source":"wordfence","cve":"CVE-2026-65534","title":"Custom links in Elementor Image Carousel <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53880f49-a2f0-4864-ba85-8fbf06ea7833?source=api-prod","affected":[{"type":"plugin","slug":"custom-links-in-elementor-image-carousel","name":"Custom links in Elementor Image Carousel","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:25:34Z"},{"id":"wordfence:53889ac8-a101-4aae-a1d2-f25cbf6f58e2","source":"wordfence","cve":"CVE-2022-0826","title":"WP Video Gallery <= 1.7.1 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53889ac8-a101-4aae-a1d2-f25cbf6f58e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-gallery-free","name":"WP Video Gallery","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:538b4d4b-f8c6-44db-89d2-d345bfbfecb2","source":"wordfence","cve":"CVE-2025-4099","title":"List Children <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538b4d4b-f8c6-44db-89d2-d345bfbfecb2?source=api-prod","affected":[{"type":"plugin","slug":"list-children","name":"List Children","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-01T04:22:58Z"},{"id":"wordfence:538e9ce3-2d48-44ad-bd08-8eead3ef15c3","source":"wordfence","cve":"CVE-2023-7014","title":"Author Box, Guest Author and Co-Authors for Your Posts \u2013 Molongui <= 4.7.4 - Information Exposure via ma_debug","severity":"medium","cvss":5.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/538e9ce3-2d48-44ad-bd08-8eead3ef15c3?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2024-01-16T00:00:00Z","updated":"2024-07-29T21:36:21Z"},{"id":"wordfence:5391ad0a-a5c7-4fd8-b94e-9236cca41568","source":"wordfence","cve":"CVE-2025-32660","title":"JS Job Manager <= 2.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5391ad0a-a5c7-4fd8-b94e-9236cca41568?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T19:16:46Z"},{"id":"wordfence:539300b9-3e8e-4c20-93a6-b6eb1588cc6c","source":"wordfence","cve":"CVE-2024-51711","title":"Saragna <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/539300b9-3e8e-4c20-93a6-b6eb1588cc6c?source=api-prod","affected":[{"type":"plugin","slug":"saragna-social-stream","name":"Saragna \u2013 Social Stream WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:31:57Z"},{"id":"wordfence:5394623b-e9ee-4047-bfe3-d7f6374993cd","source":"wordfence","cve":"","title":"Google Forms < 0.85 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5394623b-e9ee-4047-bfe3-d7f6374993cd?source=api-prod","affected":[{"type":"plugin","slug":"wpgform","name":"Google Forms","from":"*","from_inclusive":true,"to":"0.85","to_inclusive":false,"patched_in":"0.85"}],"published":"2016-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5394abc6-836f-4b22-a7b6-79d092b93a7e","source":"wordfence","cve":"CVE-2024-10804","title":"Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5394abc6-836f-4b22-a7b6-79d092b93a7e?source=api-prod","affected":[{"type":"plugin","slug":"fwduvp","name":"Ultimate Video Player WordPress & WooCommerce Plugin","from":"*","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":"10.1"}],"published":"2025-03-06T20:02:23Z","updated":"2025-06-05T20:50:31Z"},{"id":"wordfence:539b8433-e896-4e4d-a536-cfe055bb91e4","source":"wordfence","cve":"CVE-2025-69017","title":"RestroPress <= 3.2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/539b8433-e896-4e4d-a536-cfe055bb91e4?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.2.8.6","to_inclusive":true,"patched_in":"3.2.8.6.1"}],"published":"2025-12-27T00:00:00Z","updated":"2026-04-15T13:37:46Z"},{"id":"wordfence:539cd606-1884-48df-beae-f5686a4e2400","source":"wordfence","cve":"CVE-2022-4370","title":"multimedial images <= 1.0b - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/539cd606-1884-48df-beae-f5686a4e2400?source=api-prod","affected":[{"type":"plugin","slug":"multimedial-images","name":"multimedial images","from":"*","from_inclusive":true,"to":"1.0b","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:539cdee3-78bc-42a2-9c34-0f7d46f95d16","source":"wordfence","cve":"CVE-2026-95687","title":"WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/539cdee3-78bc-42a2-9c34-0f7d46f95d16?source=api-prod","affected":[{"type":"plugin","slug":"wpc-shop-as-customer","name":"WPC Shop as a Customer for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-09-30T19:45:46Z","updated":"2026-10-01T08:28:44Z"},{"id":"wordfence:53a0749f-86e9-4f62-9de2-a6759c78ba2f","source":"wordfence","cve":"CVE-2026-4128","title":"TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a0749f-86e9-4f62-9de2-a6759c78ba2f?source=api-prod","affected":[{"type":"plugin","slug":"tp-restore-categories-and-taxonomies","name":"TP Restore Categories And Taxonomies","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:08:29Z","updated":"2026-04-22T07:45:35Z"},{"id":"wordfence:53a08b59-b7e0-419a-bfc3-528bcddb1ac2","source":"wordfence","cve":"CVE-2026-4065","title":"Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a08b59-b7e0-419a-bfc3-528bcddb1ac2?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.33","to_inclusive":true,"patched_in":"3.5.1.34"}],"published":"2026-04-07T08:51:34Z","updated":"2026-04-07T21:26:20Z"},{"id":"wordfence:53a265b8-e34c-4683-a653-4b4b2410e9de","source":"wordfence","cve":"CVE-2023-25033","title":"Social Share Boost <= 4.5 - Cross-Site Request Forgery via 'syntatical_settings_content'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a265b8-e34c-4683-a653-4b4b2410e9de?source=api-prod","affected":[{"type":"plugin","slug":"social-share-boost","name":"Social Share Boost","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53a28cee-fda0-43eb-8012-5059bb061694","source":"wordfence","cve":"CVE-2015-9399","title":"WP-Stats-Dashboard <= 2.9.4 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a28cee-fda0-43eb-8012-5059bb061694?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-dashboard","name":"WP-Stats-Dashboard","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":""}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53a36f33-0202-4f6f-8a0a-c986e5e49827","source":"wordfence","cve":"CVE-2026-114740","title":"VR 8.5.55 - 9.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a36f33-0202-4f6f-8a0a-c986e5e49827?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"8.5.55","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:21:56Z"},{"id":"wordfence:53a51408-e5d8-4727-9dec-8321c062c31e","source":"wordfence","cve":"CVE-2024-0255","title":"WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a51408-e5d8-4727-9dec-8321c062c31e?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:36:22Z"},{"id":"wordfence:53a58c45-b7fd-469e-8c67-4f20707f2363","source":"wordfence","cve":"CVE-2012-2579","title":"WP SimpleMail <= 1.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a58c45-b7fd-469e-8c67-4f20707f2363?source=api-prod","affected":[{"type":"plugin","slug":"wp-simplemail","name":"WP SimpleMail","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2012-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53a70698-f2ee-4694-b21c-8b8ccb0b2a5c","source":"wordfence","cve":"CVE-2026-84281","title":"Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53a70698-f2ee-4694-b21c-8b8ccb0b2a5c?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2026-09-24T18:17:25Z","updated":"2026-09-25T06:39:53Z"},{"id":"wordfence:53ab1f5f-7331-4587-8c37-e9bd86a83ae6","source":"wordfence","cve":"CVE-2022-2071","title":"Name Directory <= 1.25.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ab1f5f-7331-4587-8c37-e9bd86a83ae6?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.25.3","to_inclusive":true,"patched_in":"1.25.4"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53ac7001-e381-4bfb-8749-6f9df10dcab5","source":"wordfence","cve":"CVE-2024-13668","title":"WordPress Activity-o-meter <= 1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ac7001-e381-4bfb-8749-6f9df10dcab5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-activity-o-meter","name":"WordPress Activity-o-meter","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:31:06Z"},{"id":"wordfence:53ad0496-a484-48e4-aa17-29d63e1a47e1","source":"wordfence","cve":"CVE-2025-22758","title":"Elementor AI Addons <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ad0496-a484-48e4-aa17-29d63e1a47e1?source=api-prod","affected":[{"type":"plugin","slug":"ai-addons-for-elementor","name":"Elementor Addons AI Addons \u2013 70 Widgets, Premium Templates, Ultimate Elements","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T15:01:10Z"},{"id":"wordfence:53adbab6-953a-4a6f-bbfc-89efdbdd28e0","source":"wordfence","cve":"CVE-2025-14741","title":"Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53adbab6-953a-4a6f-bbfc-89efdbdd28e0?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.25","to_inclusive":true,"patched_in":"3.28.26"}],"published":"2026-01-08T18:45:51Z","updated":"2026-01-09T07:22:30Z"},{"id":"wordfence:53af9dfd-eb2d-4f6f-b02f-daf790b95f1f","source":"wordfence","cve":"CVE-2023-47775","title":"wpDiscuz <= 7.6.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53af9dfd-eb2d-4f6f-b02f-daf790b95f1f?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.11","to_inclusive":true,"patched_in":"7.6.12"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53b24f9a-f225-40b5-9937-f7449d4832df","source":"wordfence","cve":"CVE-2024-11929","title":"Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53b24f9a-f225-40b5-9937-f7449d4832df?source=api-prod","affected":[{"type":"plugin","slug":"responsive-flipbook","name":"Responsive FlipBook Plugin Wordpress","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:07:27Z","updated":"2025-01-09T11:10:58Z"},{"id":"wordfence:53b3ac83-847d-4bd0-a79b-531af266e1b4","source":"wordfence","cve":"CVE-2023-5714","title":"System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_db_specs)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53b3ac83-847d-4bd0-a79b-531af266e1b4?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53b3d441-4938-435f-85c3-707477f0293d","source":"wordfence","cve":"CVE-2026-1336","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53b3d441-4938-435f-85c3-707477f0293d?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-03-02T11:22:35Z","updated":"2026-03-02T23:22:55Z"},{"id":"wordfence:53b5a052-6e84-4eb5-a7f4-4e32f757f4d6","source":"wordfence","cve":"","title":"Smush \u2013 Lazy Load Images, Optimize & Compress Images <= 2.9.1 - Cross-Site Scripting","severity":"critical","cvss":9.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53b5a052-6e84-4eb5-a7f4-4e32f757f4d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2018-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53b97b06-5852-43ca-9585-61814247d3c9","source":"wordfence","cve":"CVE-2025-48284","title":"Japanized For WooCommerce <= 2.6.40 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53b97b06-5852-43ca-9585-61814247d3c9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.40","to_inclusive":true,"patched_in":"2.6.41"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T17:03:07Z"},{"id":"wordfence:53bb0871-343a-4299-9902-682c422152d1","source":"wordfence","cve":"CVE-2024-10958","title":"WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53bb0871-343a-4299-9902-682c422152d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.8.08.007","to_inclusive":true,"patched_in":"8.9.01.001"}],"published":"2024-11-10T00:18:49Z","updated":"2024-11-10T12:30:34Z"},{"id":"wordfence:53bbed98-7874-44dd-9ded-4012250f8aae","source":"wordfence","cve":"CVE-2026-18586","title":"Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53bbed98-7874-44dd-9ded-4012250f8aae?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2026-10-14T16:34:50Z","updated":"2026-10-15T05:30:22Z"},{"id":"wordfence:53bffb82-b9df-40a0-947b-ecae512f363a","source":"wordfence","cve":"CVE-2020-22276","title":"WeForms <= 1.4.7 - CSV injection via form entry","severity":"high","cvss":8.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53bffb82-b9df-40a0-947b-ecae512f363a?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2020-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53c18834-3026-4d4d-888b-add314a0e56e","source":"wordfence","cve":"CVE-2024-11728","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c18834-3026-4d4d-888b-add314a0e56e?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T09:23:00Z"},{"id":"wordfence:53c25e24-fac6-404c-be6c-678a383b48a1","source":"wordfence","cve":"CVE-2025-10588","title":"PixelYourSite <= 11.1.2 \u2013 Cross-Site Request Forgery to GDPR Options Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c25e24-fac6-404c-be6c-678a383b48a1?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"11.1.3"}],"published":"2025-10-21T17:47:54Z","updated":"2025-12-18T17:53:55Z"},{"id":"wordfence:53c4851a-3e87-4b3a-9ca3-42ffe4bbf2bb","source":"wordfence","cve":"CVE-2026-89285","title":"Datalist it <= 0.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c4851a-3e87-4b3a-9ca3-42ffe4bbf2bb?source=api-prod","affected":[{"type":"plugin","slug":"datalistit","name":"Datalist it","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:22:07Z"},{"id":"wordfence:53c548be-b8aa-4949-93f8-7b4d73688540","source":"wordfence","cve":"CVE-2026-89079","title":"Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2026-10-15T17:03:51Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:53c59793-27db-44fa-92c8-2184d6914d8f","source":"wordfence","cve":"CVE-2025-12823","title":"CSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c59793-27db-44fa-92c8-2184d6914d8f?source=api-prod","affected":[{"type":"plugin","slug":"csv-to-sorttable","name":"CSV to SortTable","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:11:17Z","updated":"2025-11-18T08:27:32Z"},{"id":"wordfence:53c9d3d0-5fea-4e36-b356-8d3c0e672cac","source":"wordfence","cve":"CVE-2021-24158","title":"Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c9d3d0-5fea-4e36-b356-8d3c0e672cac?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":false,"patched_in":"2.10.3"}],"published":"2020-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53cc91fa-51fd-4d16-b740-a48f8d446b5d","source":"wordfence","cve":"CVE-2026-15982","title":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53cc91fa-51fd-4d16-b740-a48f8d446b5d?source=api-prod","affected":[{"type":"plugin","slug":"aimogen-pro","name":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2026-07-13T00:00:00Z","updated":"2026-07-17T05:35:58Z"},{"id":"wordfence:53d12736-56d3-454f-9593-74f758d0605d","source":"wordfence","cve":"CVE-2025-69015","title":"Crowdsignal Forms <= 1.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d12736-56d3-454f-9593-74f758d0605d?source=api-prod","affected":[{"type":"plugin","slug":"crowdsignal-forms","name":"Crowdsignal Forms","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-12-27T00:00:00Z","updated":"2026-03-17T21:28:29Z"},{"id":"wordfence:53d2f416-4b0f-49b7-af14-fbb225aac34d","source":"wordfence","cve":"CVE-2024-43348","title":"Purity Of Soul <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d2f416-4b0f-49b7-af14-fbb225aac34d?source=api-prod","affected":[{"type":"theme","slug":"purity-of-soul","name":"Purity Of Soul","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:11:15Z"},{"id":"wordfence:53d39276-5d92-4a5b-848d-33aefb18a970","source":"wordfence","cve":"CVE-2023-1089","title":"Coupon Zen <= 1.0.5 - Cross-Site Request Forgery to Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d39276-5d92-4a5b-848d-33aefb18a970?source=api-prod","affected":[{"type":"plugin","slug":"coupon-zen","name":"Coupon Zen","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53d5fbcf-7af7-4345-b207-0a3277f78065","source":"wordfence","cve":"CVE-2023-48773","title":"WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d5fbcf-7af7-4345-b207-0a3277f78065?source=api-prod","affected":[{"type":"plugin","slug":"woo-login-redirect","name":"WooCommerce Login Redirect","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53d65d4c-4bd6-4e18-b7ba-ee64328faf32","source":"wordfence","cve":"CVE-2025-9061","title":"Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=api-prod","affected":[{"type":"plugin","slug":"wilmer-core","name":"Wilmer Core","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-09-08T17:14:35Z","updated":"2025-09-09T05:25:45Z"},{"id":"wordfence:53d9b351-ba17-431a-b371-7dc1a87bd757","source":"wordfence","cve":"CVE-2026-16482","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53d9b351-ba17-431a-b371-7dc1a87bd757?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"4.7.12"}],"published":"2026-09-11T18:44:17Z","updated":"2026-09-17T18:26:07Z"},{"id":"wordfence:53db0f72-3353-42bb-ad75-4c5aa32d7939","source":"wordfence","cve":"CVE-2024-1129","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53db0f72-3353-42bb-ad75-4c5aa32d7939?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-01T04:31:55Z"},{"id":"wordfence:53ddfd2d-7af1-4561-ab76-5cb3238e8f8b","source":"wordfence","cve":"CVE-2022-28700","title":"GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation","severity":"medium","cvss":5.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ddfd2d-7af1-4561-ab76-5cb3238e8f8b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.20.2","to_inclusive":true,"patched_in":"2.21.0"}],"published":"2022-07-12T13:57:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53de68ad-76a6-4043-8369-7679c1c5c1cd","source":"wordfence","cve":"CVE-2023-24376","title":"WP Simple Events <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53de68ad-76a6-4043-8369-7679c1c5c1cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-events","name":"WP Simple Events","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53df8dac-a446-425b-bdde-939ab38e5a29","source":"wordfence","cve":"CVE-2026-39501","title":"FOX <= 1.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53df8dac-a446-425b-bdde-939ab38e5a29?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-03-27T00:00:00Z","updated":"2026-04-15T21:26:21Z"},{"id":"wordfence:53dfe8e5-5f13-4c8c-a62e-9da57379da7a","source":"wordfence","cve":"CVE-2023-6383","title":"Debug Log Manager <= 2.2.2 - Directory Listing to Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53dfe8e5-5f13-4c8c-a62e-9da57379da7a?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-12-13T00:00:00Z","updated":"2024-02-06T16:23:43Z"},{"id":"wordfence:53e01cb5-f8c2-4151-b0d6-13422382fd13","source":"wordfence","cve":"CVE-2025-39547","title":"Internal Link Optimiser <= 5.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e01cb5-f8c2-4151-b0d6-13422382fd13?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-finder","name":"Website Internal Link Optimiser","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:43:29Z"},{"id":"wordfence:53e16bca-7c85-4d56-8233-b3b53f793b39","source":"wordfence","cve":"CVE-2024-1409","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e16bca-7c85-4d56-8233-b3b53f793b39?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.15.1"}],"published":"2024-02-22T00:00:00Z","updated":"2024-03-13T15:26:49Z"},{"id":"wordfence:53e2f7d5-ceb3-4c15-a761-a9f7c7585358","source":"wordfence","cve":"CVE-2022-46815","title":"Conditional Shipping for WooCommerce <= 2.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e2f7d5-ceb3-4c15-a761-a9f7c7585358?source=api-prod","affected":[{"type":"plugin","slug":"conditional-shipping-for-woocommerce","name":"Conditional Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53e75c5e-0583-48e4-8440-c6e184247c5a","source":"wordfence","cve":"","title":"Virtue Premium <= 4.10.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e75c5e-0583-48e4-8440-c6e184247c5a?source=api-prod","affected":[{"type":"theme","slug":"virtue_premium","name":"Virtue Premium","from":"*","from_inclusive":true,"to":"4.10.22","to_inclusive":true,"patched_in":"4.10.23"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T17:35:44Z"},{"id":"wordfence:53e83037-2cc5-4dc9-b55d-03829df12a65","source":"wordfence","cve":"CVE-2026-8457","title":"WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT","severity":"critical","cvss":9.8,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e83037-2cc5-4dc9-b55d-03829df12a65?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2026-08-01T11:09:08Z","updated":"2026-08-01T23:29:35Z"},{"id":"wordfence:53e8a98d-4c74-4440-8a3c-f03317a1cb7f","source":"wordfence","cve":"CVE-2026-107773","title":"Dokan <= 5.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53e8a98d-4c74-4440-8a3c-f03317a1cb7f?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:10:23Z"},{"id":"wordfence:53eba5b4-7cc0-48e1-bb9c-6ed3207151ab","source":"wordfence","cve":"CVE-2020-36706","title":"Simple:Press \u2013 WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53eba5b4-7cc0-48e1-bb9c-6ed3207151ab?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":false,"patched_in":"6.6.1"}],"published":"2020-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:53ee7062-85f9-4d12-a432-f373fc25bab6","source":"wordfence","cve":"CVE-2026-42665","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ee7062-85f9-4d12-a432-f373fc25bab6?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.70","to_inclusive":true,"patched_in":"5.5.71"}],"published":"2026-05-09T00:00:00Z","updated":"2026-05-11T20:27:09Z"},{"id":"wordfence:53ef1383-55a7-40ea-b382-6804e10efa84","source":"wordfence","cve":"CVE-2025-60075","title":"hpb seo plugin for WordPress <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ef1383-55a7-40ea-b382-6804e10efa84?source=api-prod","affected":[{"type":"plugin","slug":"hpbseo","name":"hpb seo plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-15T00:00:00Z","updated":"2025-11-04T15:18:23Z"},{"id":"wordfence:53ef2e77-e1b5-4421-a8e4-55302a4551b3","source":"wordfence","cve":"CVE-2026-81275","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53ef2e77-e1b5-4421-a8e4-55302a4551b3?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:41:44Z"},{"id":"wordfence:53f12e61-fdb0-4838-b733-fc4d7a4ff016","source":"wordfence","cve":"CVE-2025-7663","title":"Ovatheme Events Manager <= 1.8.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53f12e61-fdb0-4838-b733-fc4d7a4ff016?source=api-prod","affected":[{"type":"plugin","slug":"ova-events-manager","name":"Ovatheme Events Manager","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-11-07T15:22:40Z","updated":"2025-11-08T03:27:49Z"},{"id":"wordfence:53f608df-2150-46fd-a361-b3d312d26cf9","source":"wordfence","cve":"CVE-2026-97301","title":"Cool FormKit Lite \u2013 Advanced Form Builder for Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53f608df-2150-46fd-a361-b3d312d26cf9?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor-form","name":"Cool FormKit Lite \u2013 Advanced Form Builder for Elementor","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:42:54Z"},{"id":"wordfence:53fa9be4-a2b3-458c-af6e-d3ada639a622","source":"wordfence","cve":"CVE-2024-24876","title":"Admin Menu Editor <= 1.12 - Cross-Site Request Forgery via ajax_hide_hint()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53fa9be4-a2b3-458c-af6e-d3ada639a622?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-editor","name":"Admin Menu Editor","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2024-02-05T00:00:00Z","updated":"2024-04-17T13:05:14Z"},{"id":"wordfence:53fb54bc-6eaa-4e99-a41c-e59a9bae81e5","source":"wordfence","cve":"CVE-2025-4803","title":"Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53fb54bc-6eaa-4e99-a41c-e59a9bae81e5?source=api-prod","affected":[{"type":"plugin","slug":"wppedia","name":"Glossary by WPPedia \u2013 Best Glossary plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T20:30:20Z","updated":"2025-05-21T09:21:49Z"},{"id":"wordfence:53fc946c-285a-4d48-8430-777e94df07c5","source":"wordfence","cve":"CVE-2026-57650","title":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53fc946c-285a-4d48-8430-777e94df07c5?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:35:57Z"},{"id":"wordfence:53fffd10-17a2-4b60-a19c-a89229e27872","source":"wordfence","cve":"CVE-2024-37475","title":"Newspack Newsletters <= 2.13.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53fffd10-17a2-4b60-a19c-a89229e27872?source=api-prod","affected":[{"type":"plugin","slug":"newspack-newsletters","name":"Newspack Newsletters","from":"*","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:08:03Z"},{"id":"wordfence:5401221c-68cb-477d-b422-d5d65fc8286b","source":"wordfence","cve":"CVE-2026-39602","title":"Order Tracking <= 3.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5401221c-68cb-477d-b422-d5d65fc8286b?source=api-prod","affected":[{"type":"plugin","slug":"order-tracking","name":"Order Tracking \u2013 WordPress Status Tracking Plugin","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-31T00:00:00Z","updated":"2026-05-07T14:00:07Z"},{"id":"wordfence:54019f42-488d-484f-b34e-2b5bd5b0a1dd","source":"wordfence","cve":"CVE-2023-46824","title":"Slick Popup: Contact Form 7 Popup Plugin <= 1.7.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54019f42-488d-484f-b34e-2b5bd5b0a1dd?source=api-prod","affected":[{"type":"plugin","slug":"slick-popup","name":"Slick Popup: Contact Form 7 Popup Plugin","from":"*","from_inclusive":true,"to":"1.7.15","to_inclusive":false,"patched_in":"1.7.15"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540236b8-ff7a-4171-812b-29d3c88a881a","source":"wordfence","cve":"CVE-2015-4582","title":"Boot Store <= 1.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540236b8-ff7a-4171-812b-29d3c88a881a?source=api-prod","affected":[{"type":"theme","slug":"boot-store","name":"Boot Store","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-28T00:00:00Z","updated":"2025-04-30T20:11:37Z"},{"id":"wordfence:5402c009-f3c0-4286-9162-6e60322c5544","source":"wordfence","cve":"CVE-2022-40213","title":"GS Testimonial Slider <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5402c009-f3c0-4286-9162-6e60322c5544?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5402f206-0375-4c47-8a5c-e8ea5742493d","source":"wordfence","cve":"CVE-2024-6987","title":"Orchid Store <= 1.5.6 -  Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5402f206-0375-4c47-8a5c-e8ea5742493d?source=api-prod","affected":[{"type":"theme","slug":"orchid-store","name":"Orchid Store","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T04:11:37Z"},{"id":"wordfence:54041d74-6d2e-4a70-aa35-46619afb9d8c","source":"wordfence","cve":"CVE-2025-26889","title":"hockeydata LOS <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54041d74-6d2e-4a70-aa35-46619afb9d8c?source=api-prod","affected":[{"type":"plugin","slug":"hockeydata-los","name":"hockeydata LOS","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T18:42:18Z"},{"id":"wordfence:54043c6a-48a1-48e8-ba61-a7e8a1773036","source":"wordfence","cve":"CVE-2023-6214","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54043c6a-48a1-48e8-ba61-a7e8a1773036?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:36:22Z"},{"id":"wordfence:54044b8c-52f2-4887-b67c-ed78023da3ff","source":"wordfence","cve":"CVE-2026-57357","title":"Search Atlas SEO \u2013 Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54044b8c-52f2-4887-b67c-ed78023da3ff?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:45:44Z"},{"id":"wordfence:54044fd7-facf-4ac2-8c87-e30db78eba40","source":"wordfence","cve":"","title":"Travel Booking WordPress Theme < 2.7.8.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54044fd7-facf-4ac2-8c87-e30db78eba40?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.7.8.4","to_inclusive":false,"patched_in":"2.7.8.4"}],"published":"2019-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54087ddd-5c13-40ff-be80-3d713603f566","source":"wordfence","cve":"CVE-2025-39497","title":"Dokan Pro <= 5.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54087ddd-5c13-40ff-be80-3d713603f566?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2025-05-16T00:00:00Z","updated":"2026-07-16T19:07:23Z"},{"id":"wordfence:5409a9c0-df17-4663-96c7-aced7b0f8c70","source":"wordfence","cve":"CVE-2025-54056","title":"Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5409a9c0-df17-4663-96c7-aced7b0f8c70?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio2-html5","name":"Responsive HTML5 Audio Player PRO With Playlist","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:38:25Z"},{"id":"wordfence:540ac650-6bfd-4ee2-b3c8-b6444a209b6a","source":"wordfence","cve":"CVE-2015-7517","title":"Double Opt-In for Download <= 2.0.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540ac650-6bfd-4ee2-b3c8-b6444a209b6a?source=api-prod","affected":[{"type":"plugin","slug":"double-opt-in-for-download","name":"Double Opt-In for Download","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540b1b4e-474d-48a8-ac8c-b7cd589ddc4c","source":"wordfence","cve":"CVE-2025-22310","title":"TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540b1b4e-474d-48a8-ac8c-b7cd589ddc4c?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-toolkit","name":"TemplatesNext ToolKit","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:48:56Z"},{"id":"wordfence:540b2888-16fe-4791-8d08-f7772f71d511","source":"wordfence","cve":"CVE-2024-1858","title":"Lightbox slider \u2013 Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection","severity":"medium","cvss":5.4,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540b2888-16fe-4791-8d08-f7772f71d511?source=api-prod","affected":[{"type":"plugin","slug":"simple-lightbox-gallery","name":"Lightbox slider \u2013 Responsive Lightbox Gallery","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-05-29T14:22:19Z"},{"id":"wordfence:540d1c86-c648-42e1-a360-cc188d1a5635","source":"wordfence","cve":"CVE-2022-36292","title":"Gallery PhotoBlocks <= 1.2.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540d1c86-c648-42e1-a360-cc188d1a5635?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540d2495-7ad4-428c-b86e-9af73d0ebe51","source":"wordfence","cve":"","title":"Ad Invalid Click Protector (AICP) <= 1.2.5.2 - Reflected Cross-Site Scripting and Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540d2495-7ad4-428c-b86e-9af73d0ebe51?source=api-prod","affected":[{"type":"plugin","slug":"ad-invalid-click-protector","name":"Ad Invalid Click Protector (AICP)","from":"*","from_inclusive":true,"to":"1.2.5.2","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540d444f-7a6c-4c14-a9c7-52209ad59a11","source":"wordfence","cve":"CVE-2020-9043","title":"wpCentral <= 1.5.0 - Improper Access Control to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540d444f-7a6c-4c14-a9c7-52209ad59a11?source=api-prod","affected":[{"type":"plugin","slug":"wp-central","name":"wpCentral","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2020-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540de1b8-eb1f-4f9d-b45c-d3d5f11b642d","source":"wordfence","cve":"CVE-2023-32745","title":"AutomateWoo <= 5.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540de1b8-eb1f-4f9d-b45c-d3d5f11b642d?source=api-prod","affected":[{"type":"plugin","slug":"automatewoo","name":"AutomateWoo","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:540fef7f-8952-4525-9d07-fe3b3d777359","source":"wordfence","cve":"CVE-2023-24402","title":"WP Booking System <= 2.0.18 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/540fef7f-8952-4525-9d07-fe3b3d777359?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":true,"patched_in":"2.0.18.1"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:541012b2-5d52-452b-85ec-62d3c56d2bc4","source":"wordfence","cve":"CVE-2025-67932","title":"Listeo Core < 2.0.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541012b2-5d52-452b-85ec-62d3c56d2bc4?source=api-prod","affected":[{"type":"plugin","slug":"listeo-core","name":"Listeo-Core - Directory Plugin by Purethemes","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":false,"patched_in":"2.0.19"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-13T17:33:46Z"},{"id":"wordfence:54115a9a-dadd-4f18-a139-02ec89f0a571","source":"wordfence","cve":"CVE-2026-7636","title":"Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54115a9a-dadd-4f18-a139-02ec89f0a571?source=api-prod","affected":[{"type":"plugin","slug":"soliloquy-lite","name":"Slider by Soliloquy \u2013 Responsive Image Slider for WordPress","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-05-21T19:23:24Z","updated":"2026-05-22T07:50:26Z"},{"id":"wordfence:5411725e-b670-4097-8517-1092935a7b22","source":"wordfence","cve":"CVE-2025-31433","title":"Magic Embeds <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5411725e-b670-4097-8517-1092935a7b22?source=api-prod","affected":[{"type":"plugin","slug":"wp-embed-facebook","name":"Magic Embeds","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:56:39Z"},{"id":"wordfence:5412fd87-49bc-445c-8d16-443e38933d1e","source":"wordfence","cve":"CVE-2023-5843","title":"Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution","severity":"critical","cvss":9.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5412fd87-49bc-445c-8d16-443e38933d1e?source=api-prod","affected":[{"type":"plugin","slug":"ads-by-datafeedrcom","name":"Ads by datafeedr.com","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5413ae2a-9afa-4ff6-b241-73b446881185","source":"wordfence","cve":"CVE-2015-1000012","title":"MyPixs <= 0.3 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5413ae2a-9afa-4ff6-b241-73b446881185?source=api-prod","affected":[{"type":"plugin","slug":"mypixs","name":"mypixs","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2015-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54140e73-0eb0-4ef3-a8e2-8e7a0d321ca5","source":"wordfence","cve":"CVE-2024-52466","title":"Explara Events <= 0.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54140e73-0eb0-4ef3-a8e2-8e7a0d321ca5?source=api-prod","affected":[{"type":"plugin","slug":"explara-events","name":"Explara Events","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:10:53Z"},{"id":"wordfence:5414259c-339d-41fe-a0dc-4d4e4d966e15","source":"wordfence","cve":"","title":"Debug Bar ElasticPress <= 2.1.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5414259c-339d-41fe-a0dc-4d4e4d966e15?source=api-prod","affected":[{"type":"plugin","slug":"debug-bar-elasticpress","name":"ElasticPress Debugging Add-On","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54154f34-96be-4b67-bca8-8efc4ab8543e","source":"wordfence","cve":"CVE-2023-23719","title":"Premmerce <= 1.3.18 - Cross-Site Request Forgery via runAction","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54154f34-96be-4b67-bca8-8efc4ab8543e?source=api-prod","affected":[{"type":"plugin","slug":"premmerce","name":"Premmerce","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2023-04-02T00:00:00Z","updated":"2024-04-12T19:01:20Z"},{"id":"wordfence:541551d8-5510-43ff-b685-783d0d94c4bb","source":"wordfence","cve":"CVE-2024-25913","title":"MoveTo <= 6.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541551d8-5510-43ff-b685-783d0d94c4bb?source=api-prod","affected":[{"type":"plugin","slug":"moveto","name":"Moveto - Movers quotation and booking management tool","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T14:50:27Z"},{"id":"wordfence:541cb2b1-1657-4f26-932f-c32bd51ad970","source":"wordfence","cve":"CVE-2024-51825","title":"Alert Me! <= 0.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541cb2b1-1657-4f26-932f-c32bd51ad970?source=api-prod","affected":[{"type":"plugin","slug":"alert-me","name":"Alert Me!","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:36:20Z"},{"id":"wordfence:541d202b-f3ed-44d8-93a6-e158209db885","source":"wordfence","cve":"CVE-2023-1868","title":"YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541d202b-f3ed-44d8-93a6-e158209db885?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:541dae6d-209b-4216-ab7a-ddcd71a322cb","source":"wordfence","cve":"CVE-2025-68081","title":"WP-Polls <= 2.77.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541dae6d-209b-4216-ab7a-ddcd71a322cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.77.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:20:11Z"},{"id":"wordfence:541f227f-2e17-4209-b440-fb94892e572f","source":"wordfence","cve":"CVE-2026-22487","title":"Speed Kit <= 2.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541f227f-2e17-4209-b440-fb94892e572f?source=api-prod","affected":[{"type":"plugin","slug":"baqend","name":"Speed Kit","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:25:00Z"},{"id":"wordfence:541fbcd6-353f-4ef7-88f1-fc81a6b73e04","source":"wordfence","cve":"CVE-2026-32412","title":"Gift Up Gift Cards for WordPress and WooCommerce <= 3.1.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541fbcd6-353f-4ef7-88f1-fc81a6b73e04?source=api-prod","affected":[{"type":"plugin","slug":"gift-up","name":"Gift Up Gift Cards for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2026-02-25T00:00:00Z","updated":"2026-05-05T14:22:49Z"},{"id":"wordfence:541fcb71-ad8b-49bd-95e4-17fc70bf9180","source":"wordfence","cve":"CVE-2026-14547","title":"Estatik Real Estate <= 4.3.2 - Unauthenticated Mail Relay","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/541fcb71-ad8b-49bd-95e4-17fc70bf9180?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-07-30T00:00:00Z","updated":"2026-09-16T17:37:50Z"},{"id":"wordfence:54212d4d-5ff7-4ca4-82f5-10ade4c4a1c0","source":"wordfence","cve":"CVE-2024-43933","title":"WPMobile.App <= 11.48 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54212d4d-5ff7-4ca4-82f5-10ade4c4a1c0?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.48","to_inclusive":true,"patched_in":"11.49"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-05T14:13:21Z"},{"id":"wordfence:54245c83-a0ae-454f-af80-25383b90948d","source":"wordfence","cve":"","title":"Terms Dictionary <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54245c83-a0ae-454f-af80-25383b90948d?source=api-prod","affected":[{"type":"plugin","slug":"terms-dictionary","name":"Terms Dictionary","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:39:50Z"},{"id":"wordfence:5424b3ec-37e3-409b-bddc-66b517ecfe7c","source":"wordfence","cve":"CVE-2025-66100","title":"RestroPress <= 3.2.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5424b3ec-37e3-409b-bddc-66b517ecfe7c?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.2.3.5","to_inclusive":true,"patched_in":"3.2.3.6"}],"published":"2025-11-17T00:00:00Z","updated":"2025-12-20T19:40:49Z"},{"id":"wordfence:54255e66-2bc0-4ec4-b482-c27675a84ca1","source":"wordfence","cve":"CVE-2024-51590","title":"Hoo Addons for Elementor <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54255e66-2bc0-4ec4-b482-c27675a84ca1?source=api-prod","affected":[{"type":"plugin","slug":"hoo-addons-for-elementor","name":"Hoo Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:47:55Z"},{"id":"wordfence:5427b971-8799-43a4-a60b-717c96e4ee47","source":"wordfence","cve":"CVE-2025-49394","title":"Image Gallery block \u2013 Create and display photo gallery/photo album. <= 1.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5427b971-8799-43a4-a60b-717c96e4ee47?source=api-prod","affected":[{"type":"plugin","slug":"3d-image-gallery","name":"Image Gallery Block \u2013 Showcase Photos in Stunning Responsive Grids","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-26T00:00:00Z","updated":"2025-11-11T17:32:35Z"},{"id":"wordfence:542831f3-1e32-4761-b3a6-a5fd90213bbc","source":"wordfence","cve":"CVE-2025-31610","title":"Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542831f3-1e32-4761-b3a6-a5fd90213bbc?source=api-prod","affected":[{"type":"plugin","slug":"gp-notification-bar","name":"Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:28:23Z"},{"id":"wordfence:54285c08-c9c8-4576-b1e8-e3b1c584c4bb","source":"wordfence","cve":"CVE-2007-5105","title":"WordPress Core < 2.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54285c08-c9c8-4576-b1e8-e3b1c584c4bb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2006-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54297bce-e5b7-469e-9c28-1d88e78aacc7","source":"wordfence","cve":"CVE-2023-5884","title":"Word Balloon <= 4.20.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54297bce-e5b7-469e-9c28-1d88e78aacc7?source=api-prod","affected":[{"type":"plugin","slug":"word-balloon","name":"Word Balloon","from":"*","from_inclusive":true,"to":"4.20.2","to_inclusive":true,"patched_in":"4.20.3"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:542a18f6-9d17-4e54-85e1-e01630ca371e","source":"wordfence","cve":"CVE-2025-12968","title":"Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.14.42","to_inclusive":true,"patched_in":"2.14.43"}],"published":"2025-12-11T15:11:30Z","updated":"2026-01-06T20:55:18Z"},{"id":"wordfence:542a4079-b1a2-49bc-9ddd-ba7978c9992e","source":"wordfence","cve":"CVE-2023-3388","title":"Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542a4079-b1a2-49bc-9ddd-ba7978c9992e?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-and-responsive-cookie-consent","name":"Beautiful Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:542b6312-b264-49d5-882a-454427c60c8a","source":"wordfence","cve":"CVE-2025-1926","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542b6312-b264-49d5-882a-454427c60c8a?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2025-03-09T16:20:57Z","updated":"2025-03-10T04:21:11Z"},{"id":"wordfence:542b7919-2d59-4f1a-b69e-59977ac8353e","source":"wordfence","cve":"CVE-2025-39471","title":"Modal Survey <= 2.0.2.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542b7919-2d59-4f1a-b69e-59977ac8353e?source=api-prod","affected":[{"type":"plugin","slug":"modal-survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:33:45Z"},{"id":"wordfence:542c08f8-a278-4d1c-a6c3-9533bd3a0f6c","source":"wordfence","cve":"CVE-2026-92403","title":"Secure Custom Fields <= 6.9.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/542c08f8-a278-4d1c-a6c3-9533bd3a0f6c?source=api-prod","affected":[{"type":"plugin","slug":"secure-custom-fields","name":"Secure Custom Fields","from":"*","from_inclusive":true,"to":"6.9.3","to_inclusive":true,"patched_in":"6.9.4"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:51:42Z"},{"id":"wordfence:54315b76-d943-4fcc-9fd3-59e03b5bb9c7","source":"wordfence","cve":"CVE-2026-118045","title":"Ever Accounting <= 2.3.2 - Authenticated (Accounting Manager+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54315b76-d943-4fcc-9fd3-59e03b5bb9c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-ever-accounting","name":"Ever Accounting \u2013 Accounting & Invoicing Solution for Small Businesses","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:45:40Z"},{"id":"wordfence:5432bdd1-9b56-4f74-a468-011f942bdd89","source":"wordfence","cve":"","title":"Slash WP (All Versions) - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5432bdd1-9b56-4f74-a468-011f942bdd89?source=api-prod","affected":[{"type":"theme","slug":"slash-wp","name":"Slash WP","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5433c1d4-f914-419e-add2-2719a7ec9e0b","source":"wordfence","cve":"CVE-2026-82123","title":"Loops & Logic <= 4.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5433c1d4-f914-419e-add2-2719a7ec9e0b?source=api-prod","affected":[{"type":"plugin","slug":"tangible-loops-and-logic","name":"Tangible: Loops & Logic","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-28T00:00:00Z","updated":"2026-10-29T17:21:18Z"},{"id":"wordfence:54344300-6288-40bc-b539-3dc9b555ed00","source":"wordfence","cve":"CVE-2024-0378","title":"AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54344300-6288-40bc-b539-3dc9b555ed00?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-03-01T00:00:00Z","updated":"2024-07-29T21:36:22Z"},{"id":"wordfence:543507a1-02de-417f-a742-7764465987b2","source":"wordfence","cve":"CVE-2024-10150","title":"Bamazoo \u2013 Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/543507a1-02de-417f-a742-7764465987b2?source=api-prod","affected":[{"type":"plugin","slug":"bamazoo-button-generator","name":"Bamazoo \u2013 Button Generator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T19:26:29Z","updated":"2024-10-25T07:37:59Z"},{"id":"wordfence:5435a8f8-deb7-48c9-9b86-64265e97d602","source":"wordfence","cve":"CVE-2026-54815","title":"Cargo Shipping Location for WooCommerce <= 5.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5435a8f8-deb7-48c9-9b86-64265e97d602?source=api-prod","affected":[{"type":"plugin","slug":"cargo-shipping-location-for-woocommerce","name":"Cargo Shipping Location for WooCommerce","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:41:43Z"},{"id":"wordfence:5437d812-c08f-4465-841e-47dbdf61b5cf","source":"wordfence","cve":"CVE-2025-32214","title":"Hive Support <= 1.2.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5437d812-c08f-4465-841e-47dbdf61b5cf?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2025-04-08T00:00:00Z","updated":"2026-06-01T20:20:26Z"},{"id":"wordfence:5438a03c-9081-4e1a-ad81-2e7a0f180e84","source":"wordfence","cve":"","title":"WP Mail SMTP by WPForms <= 1.3.3 - Unspecified Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5438a03c-9081-4e1a-ad81-2e7a0f180e84?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-smtp","name":"WP Mail SMTP by WPForms \u2013 SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2018-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5439651e-5557-4b13-813a-4fc0ad876104","source":"wordfence","cve":"CVE-2024-1315","title":"Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5439651e-5557-4b13-813a-4fc0ad876104?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:58:48Z"},{"id":"wordfence:54396942-551f-49e2-9ee7-40b760e6f0a2","source":"wordfence","cve":"CVE-2024-49692","title":"AffiliateX <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54396942-551f-49e2-9ee7-40b760e6f0a2?source=api-prod","affected":[{"type":"plugin","slug":"affiliatex","name":"AffiliateX \u2013 Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.9.1"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:43:41Z"},{"id":"wordfence:543b0d06-2f3e-402e-ac37-1d57353e25a8","source":"wordfence","cve":"CVE-2026-119522","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/543b0d06-2f3e-402e-ac37-1d57353e25a8?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:55:08Z"},{"id":"wordfence:543c4d52-0e47-4bbb-b53e-dbe3f104734f","source":"wordfence","cve":"CVE-2024-1428","title":"Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/543c4d52-0e47-4bbb-b53e-dbe3f104734f?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T07:34:55Z"},{"id":"wordfence:5443aa7f-e290-4b7f-9be0-23daf1624935","source":"wordfence","cve":"CVE-2025-8692","title":"Coupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5443aa7f-e290-4b7f-9be0-23daf1624935?source=api-prod","affected":[{"type":"plugin","slug":"couponapi","name":"Coupon API","from":"*","from_inclusive":true,"to":"6.2.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:49:37Z","updated":"2026-04-15T16:12:20Z"},{"id":"wordfence:544b09a2-dfd4-4dee-8687-fe86cdc65f30","source":"wordfence","cve":"CVE-2025-31095","title":"Material Dashboard <= 1.4.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/544b09a2-dfd4-4dee-8687-fe86cdc65f30?source=api-prod","affected":[{"type":"plugin","slug":"material-dashboard","name":"Material Dashboard","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:06:16Z"},{"id":"wordfence:544b28b9-0624-4ee0-bd0a-18a5a14427d1","source":"wordfence","cve":"CVE-2026-123462","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/544b28b9-0624-4ee0-bd0a-18a5a14427d1?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-07T12:33:00Z","updated":"2026-11-10T19:58:37Z"},{"id":"wordfence:544d7572-651f-45bb-b2ce-d768553c251a","source":"wordfence","cve":"CVE-2024-4866","title":"UltraAddons \u2013 Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/544d7572-651f-45bb-b2ce-d768553c251a?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-07-09T13:23:50Z","updated":"2024-08-01T19:50:09Z"},{"id":"wordfence:544db0d5-1760-4229-8429-d2391e328304","source":"wordfence","cve":"CVE-2024-3005","title":"LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/544db0d5-1760-4229-8429-d2391e328304?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.7.5","to_inclusive":true,"patched_in":"1.3.7.6"}],"published":"2024-05-01T00:00:00Z","updated":"2025-10-02T14:39:05Z"},{"id":"wordfence:544f71f5-1798-40fd-9f55-c25dae4f557a","source":"wordfence","cve":"CVE-2024-10816","title":"LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/544f71f5-1798-40fd-9f55-c25dae4f557a?source=api-prod","affected":[{"type":"plugin","slug":"lu-radioplayer","name":"LUNA RADIO PLAYER","from":"*","from_inclusive":true,"to":"6.24.01.24","to_inclusive":true,"patched_in":"6.24.11.07"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T03:30:10Z"},{"id":"wordfence:54516240-7f2e-4bb8-a252-bb4259b724d7","source":"wordfence","cve":"CVE-2025-30602","title":"Related Posts via Categories <= 2.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54516240-7f2e-4bb8-a252-bb4259b724d7?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-via-categories","name":"Related Posts via Categories","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:05:15Z"},{"id":"wordfence:54535bef-23c3-4045-bb37-ba28ae5461b1","source":"wordfence","cve":"CVE-2025-12367","title":"SiteSEO \u2013 SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54535bef-23c3-4045-bb37-ba28ae5461b1?source=api-prod","affected":[{"type":"plugin","slug":"siteseo","name":"SiteSEO \u2013 SEO Simplified","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-10-31T15:02:30Z","updated":"2025-11-01T03:34:37Z"},{"id":"wordfence:54553005-1869-4334-92ec-e37e8935d769","source":"wordfence","cve":"CVE-2013-3478","title":"WordPress Video Gallery < 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54553005-1869-4334-92ec-e37e8935d769?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2013-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54560426-a9c9-4a60-9690-8e797e0e7e8d","source":"wordfence","cve":"CVE-2014-4587","title":"WP Guestmap <= 1.8 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54560426-a9c9-4a60-9690-8e797e0e7e8d?source=api-prod","affected":[{"type":"plugin","slug":"wp-guestmap","name":"wp-guestmap","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2014-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5458e3bf-fd91-4201-8157-572eb1126aaf","source":"wordfence","cve":"CVE-2024-1277","title":"Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5458e3bf-fd91-4201-8157-572eb1126aaf?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-02-16T00:00:00Z","updated":"2024-02-20T18:56:31Z"},{"id":"wordfence:545d5a0f-2f7d-4d2e-9584-cea6449fe045","source":"wordfence","cve":"CVE-2025-26547","title":"My Login Logout Plugin <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/545d5a0f-2f7d-4d2e-9584-cea6449fe045?source=api-prod","affected":[{"type":"plugin","slug":"my-loginlogout","name":"My Login Logout Plugin","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:35:45Z"},{"id":"wordfence:545dae6b-7983-4f02-a9a0-0be8cf935a78","source":"wordfence","cve":"CVE-2024-2436","title":"Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/545dae6b-7983-4f02-a9a0-0be8cf935a78?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-accordion","name":"Lightweight Accordion","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":true,"patched_in":"1.5.17"}],"published":"2024-03-22T00:00:00Z","updated":"2024-05-31T15:30:20Z"},{"id":"wordfence:545e8941-9980-4911-b7f9-8061acddec3c","source":"wordfence","cve":"CVE-2026-110505","title":"Enable SVG, WebP, and ICO Upload <= 1.1.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/545e8941-9980-4911-b7f9-8061acddec3c?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:22:30Z"},{"id":"wordfence:545f10df-e473-48df-87ab-87f5e1088e93","source":"wordfence","cve":"CVE-2024-49282","title":"Responsive Lightbox <= 2.4.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/545f10df-e473-48df-87ab-87f5e1088e93?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-23T18:06:12Z"},{"id":"wordfence:5463548c-22bd-4645-a94d-ee8c6a236337","source":"wordfence","cve":"CVE-2026-16773","title":"WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5463548c-22bd-4645-a94d-ee8c6a236337?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.9","to_inclusive":true,"patched_in":"8.6.0"}],"published":"2026-07-27T23:30:04Z","updated":"2026-07-28T11:32:48Z"},{"id":"wordfence:5463a730-a8cf-40c9-83fc-3e451e4db1c9","source":"wordfence","cve":"","title":"CM Tooltip Glossary \u2013 Better SEO and UEX for your WP site <= 3.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5463a730-a8cf-40c9-83fc-3e451e4db1c9?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5465eaab-03c0-438a-8553-c1f8b06b82bc","source":"wordfence","cve":"CVE-2023-41848","title":"Carousel Slider <= 2.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5465eaab-03c0-438a-8553-c1f8b06b82bc?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:546649fd-d85f-4983-b36b-62ed4a987664","source":"wordfence","cve":"CVE-2025-48346","title":"Embed and Integrate Etsy Shop <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546649fd-d85f-4983-b36b-62ed4a987664?source=api-prod","affected":[{"type":"plugin","slug":"embed-and-integrate-etsy-shop","name":"Embed and Integrate Etsy Shop","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:18:06Z"},{"id":"wordfence:546976ff-eabe-4d24-b106-b8e66b7c2c5a","source":"wordfence","cve":"CVE-2019-14467","title":"Social Photo Gallery <= 1.0 - Remote Code Execution","severity":"high","cvss":7.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546976ff-eabe-4d24-b106-b8e66b7c2c5a?source=api-prod","affected":[{"type":"plugin","slug":"social-photo-gallery","name":"Social Photo Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54697909-c9f8-4395-806a-c288c79ac339","source":"wordfence","cve":"CVE-2024-37113","title":"WishList Member X < 3.26.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54697909-c9f8-4395-806a-c288c79ac339?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T14:58:29Z"},{"id":"wordfence:546aee7b-60a6-44bc-8664-0e917974cb6d","source":"wordfence","cve":"CVE-2024-1396","title":"Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546aee7b-60a6-44bc-8664-0e917974cb6d?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:07:38Z"},{"id":"wordfence:546bd215-61aa-48bd-915e-7ced0128f53d","source":"wordfence","cve":"CVE-2021-24199","title":"wpDataTables (Premium) <= 3.4.1 - Blind SQL Injection via start Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546bd215-61aa-48bd-915e-7ced0128f53d?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:546c6222-6ffa-41cb-8fff-d2c3cd37ed1f","source":"wordfence","cve":"CVE-2025-23800","title":"OrangeBox <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546c6222-6ffa-41cb-8fff-d2c3cd37ed1f?source=api-prod","affected":[{"type":"plugin","slug":"orangebox","name":"OrangeBox","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:30:10Z"},{"id":"wordfence:546cd218-3f6d-4e8f-83d5-e9aceb6f33ed","source":"wordfence","cve":"CVE-2023-51396","title":"Brizy <= 2.4.29 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546cd218-3f6d-4e8f-83d5-e9aceb6f33ed?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:546d4f19-0e6f-447b-95c9-d86291477c80","source":"wordfence","cve":"","title":"Database Browser <= 1.4.4 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546d4f19-0e6f-447b-95c9-d86291477c80?source=api-prod","affected":[{"type":"plugin","slug":"database-browser","name":"Database Browser","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2022-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:546f388e-16e2-4c0b-acb0-a462bff4ef77","source":"wordfence","cve":"CVE-2022-3538","title":"Webmaster Tools Verification <= 1.2 - Missing Authorization to Arbitrary Plugin Deactivation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546f388e-16e2-4c0b-acb0-a462bff4ef77?source=api-prod","affected":[{"type":"plugin","slug":"webmaster-tools-verification","name":"Webmaster Tools Verification","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:546f5b08-d4e9-4a19-97d6-2022a0c5c64f","source":"wordfence","cve":"CVE-2024-43136","title":"Sunshine Photo Cart <= 3.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/546f5b08-d4e9-4a19-97d6-2022a0c5c64f?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:58:01Z"},{"id":"wordfence:547008fe-2585-4089-a710-71a83ae3d829","source":"wordfence","cve":"CVE-2026-17571","title":"Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547008fe-2585-4089-a710-71a83ae3d829?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.8","to_inclusive":true,"patched_in":"6.2.9"}],"published":"2026-07-31T19:54:23Z","updated":"2026-08-01T08:32:27Z"},{"id":"wordfence:547325ad-0b01-42d5-b47c-362044587395","source":"wordfence","cve":"CVE-2024-13157","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547325ad-0b01-42d5-b47c-362044587395?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2025-01-30T19:24:55Z","updated":"2025-01-31T08:21:26Z"},{"id":"wordfence:54734884-f3b6-4dbc-a9ae-db9164925372","source":"wordfence","cve":"CVE-2026-97304","title":"Timetics \u2013 Appointment Booking Calendar & Scheduling <= 1.0.63 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54734884-f3b6-4dbc-a9ae-db9164925372?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.63","to_inclusive":true,"patched_in":"1.0.64"}],"published":"2026-10-03T17:38:04Z","updated":"2026-10-09T00:17:34Z"},{"id":"wordfence:5473ffb2-f9f3-4036-a863-7d1712f5a755","source":"wordfence","cve":"CVE-2025-57960","title":"Travel Map <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5473ffb2-f9f3-4036-a863-7d1712f5a755?source=api-prod","affected":[{"type":"plugin","slug":"travelmap-blog","name":"Travel Map","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T17:01:28Z"},{"id":"wordfence:54756a32-de66-43e4-9596-c55aaf77fd4e","source":"wordfence","cve":"CVE-2026-39679","title":"Freeio <= 1.3.21 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54756a32-de66-43e4-9596-c55aaf77fd4e?source=api-prod","affected":[{"type":"theme","slug":"freeio","name":"Freeio - Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.21","to_inclusive":true,"patched_in":""}],"published":"2026-02-21T00:00:00Z","updated":"2026-05-05T15:41:38Z"},{"id":"wordfence:547830df-eb90-471b-87be-5c5f2fc52b36","source":"wordfence","cve":"CVE-2024-49616","title":"Rate Own Post <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547830df-eb90-471b-87be-5c5f2fc52b36?source=api-prod","affected":[{"type":"plugin","slug":"rate-own-post","name":"Rate Own Post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:01:45Z"},{"id":"wordfence:547a0c73-044e-49ba-9bec-4f80b41b8ea2","source":"wordfence","cve":"CVE-2025-13526","title":"OneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547a0c73-044e-49ba-9bec-4f80b41b8ea2?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-11-21T22:24:39Z","updated":"2025-11-22T11:08:44Z"},{"id":"wordfence:547c425d-8b0f-4e65-8b8a-c3a3059301fe","source":"wordfence","cve":"CVE-2023-5621","title":"Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547c425d-8b0f-4e65-8b8a-c3a3059301fe?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:547d30cd-3b30-44ce-93b5-07ce7a56d0ab","source":"wordfence","cve":"CVE-2024-38746","title":"MakeStories (for Google Web Stories) <= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547d30cd-3b30-44ce-93b5-07ce7a56d0ab?source=api-prod","affected":[{"type":"plugin","slug":"makestories-helper","name":"MakeStories (for Google Web Stories)","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-16T18:45:19Z"},{"id":"wordfence:547e5814-0201-4dbf-9d2d-8028ca055402","source":"wordfence","cve":"CVE-2021-24648","title":"Registration Magic <= 5.0.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/547e5814-0201-4dbf-9d2d-8028ca055402?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.0.1.8","to_inclusive":true,"patched_in":"5.0.1.9"}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5480a151-3e3a-46ba-9712-6c61fba06812","source":"wordfence","cve":"CVE-2025-14978","title":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5480a151-3e3a-46ba-9712-6c61fba06812?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"*","from_inclusive":true,"to":"1.119.8","to_inclusive":true,"patched_in":"1.119.9"}],"published":"2026-01-19T13:14:59Z","updated":"2026-01-20T01:22:45Z"},{"id":"wordfence:5483980a-3478-4bfa-9571-67b8bd6f3f4d","source":"wordfence","cve":"CVE-2026-11867","title":"Frontend Admin by DynamiApps < 3.29.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5483980a-3478-4bfa-9571-67b8bd6f3f4d?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.7","to_inclusive":false,"patched_in":"3.29.7"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:18:31Z"},{"id":"wordfence:5483b895-2019-408f-8af1-4a5c9af6c388","source":"wordfence","cve":"CVE-2026-110031","title":"Salon Booking System 10.17 - 10.31.10 - Authenticated (Salon Staff+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5483b895-2019-408f-8af1-4a5c9af6c388?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"10.17","from_inclusive":true,"to":"10.31.10","to_inclusive":true,"patched_in":"10.31.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:30:42Z"},{"id":"wordfence:54852b3d-9830-491d-aa41-bc2bf763a55d","source":"wordfence","cve":"CVE-2021-20782","title":"Software License Manager < 4.4.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54852b3d-9830-491d-aa41-bc2bf763a55d?source=api-prod","affected":[{"type":"plugin","slug":"software-license-manager","name":"Software License Manager","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":false,"patched_in":"4.4.6"}],"published":"2021-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5486d50c-8544-4368-b58b-66024a8ae86d","source":"wordfence","cve":"CVE-2023-49813","title":"WP Photo Album Plus <= 8.5.02.005 -  Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5486d50c-8544-4368-b58b-66024a8ae86d?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.5.02.005","to_inclusive":true,"patched_in":"8.6.01.005"}],"published":"2023-12-05T00:00:00Z","updated":"2024-02-05T17:31:46Z"},{"id":"wordfence:548731d5-078b-45a5-bcc5-9789b41ead44","source":"wordfence","cve":"CVE-2024-47330","title":"Slider by Supsystic <= 1.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/548731d5-078b-45a5-bcc5-9789b41ead44?source=api-prod","affected":[{"type":"plugin","slug":"slider-by-supsystic","name":"Slider by Supsystic","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"},{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":""}],"published":"2024-01-17T00:00:00Z","updated":"2024-10-04T17:58:03Z"},{"id":"wordfence:54897968-55fe-4542-bac8-190b29f68b0d","source":"wordfence","cve":"CVE-2025-69324","title":"NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54897968-55fe-4542-bac8-190b29f68b0d?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.7","to_inclusive":true,"patched_in":"9.1.8"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:14:39Z"},{"id":"wordfence:548b2c50-251a-431c-a23f-95bbd50dbad5","source":"wordfence","cve":"CVE-2026-27053","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/548b2c50-251a-431c-a23f-95bbd50dbad5?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":false,"patched_in":"7.1.3"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:20:42Z"},{"id":"wordfence:548c3145-eafd-40b0-ada9-eec4406c4169","source":"wordfence","cve":"CVE-2024-51887","title":"NV Slider <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/548c3145-eafd-40b0-ada9-eec4406c4169?source=api-prod","affected":[{"type":"plugin","slug":"nv-slider","name":"NV Slider","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:47:07Z"},{"id":"wordfence:54901d01-241a-4027-ba72-2b983608f9c6","source":"wordfence","cve":"","title":"Advanced Post Manager <= 4.5.1 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54901d01-241a-4027-ba72-2b983608f9c6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-manager","name":"Advanced Post Manager","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54904fb0-4737-414c-bc9a-f5b040b59286","source":"wordfence","cve":"CVE-2026-27426","title":"Automotive Car Dealership Business WordPress Theme <= 13.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54904fb0-4737-414c-bc9a-f5b040b59286?source=api-prod","affected":[{"type":"theme","slug":"automotive","name":"Automotive Car Dealership Business WordPress Theme","from":"*","from_inclusive":true,"to":"13.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:49:38Z"},{"id":"wordfence:5490773f-8b04-4a4c-a9aa-3c10c5b2360d","source":"wordfence","cve":"CVE-2024-54286","title":"Smaily for WP <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5490773f-8b04-4a4c-a9aa-3c10c5b2360d?source=api-prod","affected":[{"type":"plugin","slug":"smaily-for-wp","name":"Smaily for WP","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2024-12-11T00:00:00Z","updated":"2025-04-04T13:12:29Z"},{"id":"wordfence:5491ff65-9060-4b0b-a31d-7b95ea581310","source":"wordfence","cve":"CVE-2024-6804","title":"Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5491ff65-9060-4b0b-a31d-7b95ea581310?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2024-08-26T18:00:37Z","updated":"2024-08-27T06:48:04Z"},{"id":"wordfence:5494cac6-1b52-43a3-995d-fc2a150edfdb","source":"wordfence","cve":"CVE-2023-23986","title":"Reviews and Rating \u2013 Google My Business <= 4.14 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5494cac6-1b52-43a3-995d-fc2a150edfdb?source=api-prod","affected":[{"type":"plugin","slug":"g-business-reviews-rating","name":"Reviews and Rating \u2013 Google Reviews","from":"4.14","from_inclusive":true,"to":"4.14","to_inclusive":true,"patched_in":"4.15"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54970085-5206-45b6-adcf-11e6dd4cd633","source":"wordfence","cve":"CVE-2024-2781","title":"Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54970085-5206-45b6-adcf-11e6dd4cd633?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T06:40:49Z"},{"id":"wordfence:549788e3-e31a-46a6-a2de-361747c98514","source":"wordfence","cve":"CVE-2023-51498","title":"WooCommerce Canada Post Shipping <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549788e3-e31a-46a6-a2de-361747c98514?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-canada-post","name":"Woocommerce Shipping Canada Post","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54998b69-7dc5-49a4-8b8b-3419de73ed47","source":"wordfence","cve":"CVE-2024-9127","title":"Super Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54998b69-7dc5-49a4-8b8b-3419de73ed47?source=api-prod","affected":[{"type":"plugin","slug":"sola-testimonials","name":"Super Testimonials","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T21:21:48Z","updated":"2024-09-26T09:29:41Z"},{"id":"wordfence:549acf7a-9e0a-404d-960a-f615ed60cac8","source":"wordfence","cve":"CVE-2025-39509","title":"TNC FlipBook <= 12.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549acf7a-9e0a-404d-960a-f615ed60cac8?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-for-wordpress","name":"TNC FlipBook","from":"*","from_inclusive":true,"to":"12.1.0","to_inclusive":true,"patched_in":"12.3.2"}],"published":"2025-05-16T00:00:00Z","updated":"2025-07-03T11:34:51Z"},{"id":"wordfence:549ca9cf-0183-4c19-9bd5-b6d55a69df31","source":"wordfence","cve":"CVE-2025-3527","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549ca9cf-0183-4c19-9bd5-b6d55a69df31?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T11:17:17Z"},{"id":"wordfence:549cd23f-3b3a-41b7-baa2-cc5c6b826a2e","source":"wordfence","cve":"CVE-2021-34647","title":"Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549cd23f-3b3a-41b7-baa2-cc5c6b826a2e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2021-09-22T15:21:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:549d4aa4-9f34-4453-93ec-1561278f7959","source":"wordfence","cve":"CVE-2025-49066","title":"Accordion Slider PRO <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549d4aa4-9f34-4453-93ec-1561278f7959?source=api-prod","affected":[{"type":"plugin","slug":"accordion_slider_pro","name":"Accordion Slider PRO","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:00:53Z"},{"id":"wordfence:549ddee9-9f38-40e2-ac50-bff5366c0b94","source":"wordfence","cve":"CVE-2025-30889","title":"Testimonial Slider <= 2.0.13 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549ddee9-9f38-40e2-ac50-bff5366c0b94?source=api-prod","affected":[{"type":"plugin","slug":"testimonial","name":"Testimonial \u2013 Testimonial Slider, Reviews Slider, Testimonial By AI","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-10T12:53:25Z"},{"id":"wordfence:549f5da2-fc42-4eab-89f5-9ba6bc2cb57b","source":"wordfence","cve":"CVE-2026-94673","title":"Simply Schedule Appointments <= 1.6.12.31 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/549f5da2-fc42-4eab-89f5-9ba6bc2cb57b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.31","to_inclusive":true,"patched_in":"1.6.12.33"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:55:16Z"},{"id":"wordfence:54a08b73-0c8f-4266-90b8-04954b51fe61","source":"wordfence","cve":"CVE-2025-64631","title":"WCFM Marketplace <= 3.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a08b73-0c8f-4266-90b8-04954b51fe61?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-12-15T00:00:00Z","updated":"2026-07-16T19:13:07Z"},{"id":"wordfence:54a0cdbd-4c3d-4bdd-98fa-f99715fd80bb","source":"wordfence","cve":"CVE-2026-89307","title":"Design Scuole Italia <= 2.17.3 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a0cdbd-4c3d-4bdd-98fa-f99715fd80bb?source=api-prod","affected":[{"type":"plugin","slug":"design-scuole-wordpress-theme","name":"design-scuole-wordpress-theme","from":"1.0","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-16T17:56:28Z"},{"id":"wordfence:54a19a37-77c4-4589-8924-3a67bfc254d2","source":"wordfence","cve":"CVE-2026-92965","title":"TikTok 1.2.0 - 1.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a19a37-77c4-4589-8924-3a67bfc254d2?source=api-prod","affected":[{"type":"plugin","slug":"tiktok-for-business","name":"TikTok","from":"1.2.0","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:15:49Z"},{"id":"wordfence:54a26e12-22b1-4690-ac66-4a6a7997e8df","source":"wordfence","cve":"CVE-2026-10530","title":"Pie Register \u2013 User Registration, Profiles & Content Restriction < 3.8.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a26e12-22b1-4690-ac66-4a6a7997e8df?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.10","to_inclusive":false,"patched_in":"3.8.4.10"}],"published":"2026-06-22T00:00:00Z","updated":"2026-06-25T13:20:40Z"},{"id":"wordfence:54a37c4a-44c7-47fd-8f2d-486372fb643c","source":"wordfence","cve":"CVE-2024-6926","title":"Viral Signup <= 2.1 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a37c4a-44c7-47fd-8f2d-486372fb643c?source=api-prod","affected":[{"type":"plugin","slug":"viral-signup","name":"Viral Signup \u2013 limited opt-in with viral refferal sharing","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-09T13:50:20Z"},{"id":"wordfence:54a425b0-592a-433d-b9e7-776760536668","source":"wordfence","cve":"CVE-2019-16932","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.3.0 - Server-Side Request Forgery","severity":"critical","cvss":9.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a425b0-592a-433d-b9e7-776760536668?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2019-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54a5146e-53f8-455e-a80a-b9c60cb46984","source":"wordfence","cve":"CVE-2025-23874","title":"Block Collection for You \u2013 WP Block Pack <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a5146e-53f8-455e-a80a-b9c60cb46984?source=api-prod","affected":[{"type":"plugin","slug":"wp-block-pack","name":"Block Collection for You \u2013 WP Block Pack","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:18:57Z"},{"id":"wordfence:54a610c6-2615-4900-bf63-8ae93aeabb8e","source":"wordfence","cve":"CVE-2021-33849","title":"Zoho CRM Lead Magnet <= 1.7.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54a610c6-2615-4900-bf63-8ae93aeabb8e?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.7.2.4","to_inclusive":true,"patched_in":"1.7.2.9"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54aa406f-0b43-4be9-9c80-aad51f818310","source":"wordfence","cve":"CVE-2025-62097","title":"SEO Slider <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54aa406f-0b43-4be9-9c80-aad51f818310?source=api-prod","affected":[{"type":"plugin","slug":"seo-slider","name":"SEO Slider","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:23:54Z"},{"id":"wordfence:54ac4a5a-b0f4-458e-b2c7-9884c7a2138d","source":"wordfence","cve":"CVE-2025-46456","title":"Theme Blvd Sliders <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54ac4a5a-b0f4-458e-b2c7-9884c7a2138d?source=api-prod","affected":[{"type":"plugin","slug":"theme-blvd-sliders","name":"Theme Blvd Sliders","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:22:18Z"},{"id":"wordfence:54ac57d8-847f-44a7-a21d-4bb35d74996e","source":"wordfence","cve":"CVE-2026-94273","title":"Snap Finance <= 3.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54ac57d8-847f-44a7-a21d-4bb35d74996e?source=api-prod","affected":[{"type":"plugin","slug":"snap-finance-checkout","name":"Snap Finance","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:41:50Z"},{"id":"wordfence:54acaeeb-bc39-441a-b0bc-6005dc452d27","source":"wordfence","cve":"CVE-2018-20714","title":"WooCommerce <= 3.4.5 - WooCommerce File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54acaeeb-bc39-441a-b0bc-6005dc452d27?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2018-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54b02454-43fc-4f20-815b-7a95ff2bc23c","source":"wordfence","cve":"CVE-2026-109933","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b02454-43fc-4f20-815b-7a95ff2bc23c?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:09:24Z"},{"id":"wordfence:54b079b5-35e4-4d65-97ce-6d0d2053886d","source":"wordfence","cve":"CVE-2024-56066","title":"Agency Toolkit <= 1.0.23 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b079b5-35e4-4d65-97ce-6d0d2053886d?source=api-prod","affected":[{"type":"plugin","slug":"agency-toolkit","name":"Agency Toolkit","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2025-12-18T00:00:00Z","updated":"2026-05-04T14:27:37Z"},{"id":"wordfence:54b149f0-1b9a-40e7-93bb-66cc28e8620e","source":"wordfence","cve":"CVE-2026-118529","title":"Directorist <= 8.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b149f0-1b9a-40e7-93bb-66cc28e8620e?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:23:11Z"},{"id":"wordfence:54b15b0e-2d85-4ea9-ac71-fb56c8f05f3b","source":"wordfence","cve":"CVE-2025-3513","title":"SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b15b0e-2d85-4ea9-ac71-fb56c8f05f3b?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-04-11T00:00:00Z","updated":"2026-09-17T00:03:14Z"},{"id":"wordfence:54b2ae17-204f-44cf-bbd3-d012158a4e38","source":"wordfence","cve":"CVE-2024-52399","title":"Writer Helper <= 3.1.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b2ae17-204f-44cf-bbd3-d012158a4e38?source=api-prod","affected":[{"type":"plugin","slug":"writer-helper","name":"Writer Helper","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:14:11Z"},{"id":"wordfence:54b3eaf4-5f45-4b94-8a7b-03da76d6ea83","source":"wordfence","cve":"CVE-2016-10959","title":"Estatik <= 2.3.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b3eaf4-5f45-4b94-8a7b-03da76d6ea83?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54b495e8-f641-444d-a3d4-a54bb0836c40","source":"wordfence","cve":"CVE-2023-1414","title":"WP VR <= 8.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b495e8-f641-444d-a3d4-a54bb0836c40?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.9","to_inclusive":true,"patched_in":"8.3.0"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54b65d91-be44-4596-be23-5a9e1d4d66dd","source":"wordfence","cve":"CVE-2024-11503","title":"WP Tabs <= 2.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b65d91-be44-4596-be23-5a9e1d4d66dd?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-tabs","name":"WP Tabs","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:49:37Z"},{"id":"wordfence:54b662a9-8003-48f6-ace9-fb0d74a05b3b","source":"wordfence","cve":"CVE-2024-33935","title":"PB MailCrypt <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b662a9-8003-48f6-ace9-fb0d74a05b3b?source=api-prod","affected":[{"type":"plugin","slug":"pb-mailcrypt-antispam-email-encryption","name":"PB MailCrypt \u2013 AntiSpam Email Encryption","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:49:55Z"},{"id":"wordfence:54b6a141-eb4c-4cf0-a078-5b3aeda25466","source":"wordfence","cve":"CVE-2026-1076","title":"Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b6a141-eb4c-4cf0-a078-5b3aeda25466?source=api-prod","affected":[{"type":"plugin","slug":"star-review-manager","name":"Star Review Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:21:36Z","updated":"2026-01-24T07:26:42Z"},{"id":"wordfence:54b88702-ec41-414b-87f1-1859b130a713","source":"wordfence","cve":"CVE-2023-46643","title":"Download CloudNet360 <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54b88702-ec41-414b-87f1-1859b130a713?source=api-prod","affected":[{"type":"plugin","slug":"cloudnet-sync","name":"CloudNet360","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54ba2c67-3855-40ce-8880-698bcb2a63f7","source":"wordfence","cve":"CVE-2025-58917","title":"Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54ba2c67-3855-40ce-8880-698bcb2a63f7?source=api-prod","affected":[{"type":"plugin","slug":"quantities-and-units-for-woocommerce","name":"Quantities and Units for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-17T00:00:00Z","updated":"2025-09-22T14:10:44Z"},{"id":"wordfence:54ba7d45-475b-41eb-8272-1453eb7f7e03","source":"wordfence","cve":"CVE-2025-60147","title":"HT Feed <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54ba7d45-475b-41eb-8272-1453eb7f7e03?source=api-prod","affected":[{"type":"plugin","slug":"ht-instagram","name":"HT Feed","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:10:57Z"},{"id":"wordfence:54bc98e8-5cde-4310-9d61-ebea828b5093","source":"wordfence","cve":"CVE-2024-34754","title":"Contact Form Widget <= 1.3.9 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54bc98e8-5cde-4310-9d61-ebea828b5093?source=api-prod","affected":[{"type":"plugin","slug":"new-contact-form-widget","name":"Contact Form Widget \u2013 Responsive Contact Form, Query Form & Form Builder","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T17:11:17Z"},{"id":"wordfence:54bcd95e-52a8-49fb-9526-eb39549b5182","source":"wordfence","cve":"CVE-2026-59529","title":"Ebook Store <= 6.19 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54bcd95e-52a8-49fb-9526-eb39549b5182?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"6.19","to_inclusive":true,"patched_in":"6.20"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:20:26Z"},{"id":"wordfence:54bdacd9-49e4-4f45-99bb-baa9eba97ecf","source":"wordfence","cve":"CVE-2014-2558","title":"File Gallery < 1.7.9.2 - Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54bdacd9-49e4-4f45-99bb-baa9eba97ecf?source=api-prod","affected":[{"type":"plugin","slug":"file-gallery","name":"File Gallery","from":"*","from_inclusive":true,"to":"1.7.9.2","to_inclusive":false,"patched_in":"1.7.9.2"}],"published":"2014-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54bdcae1-28af-4d30-9204-e67b27271042","source":"wordfence","cve":"CVE-2024-31434","title":"Newsletter <= 8.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54bdcae1-28af-4d30-9204-e67b27271042?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":"8.0.7"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:04:59Z"},{"id":"wordfence:54be8293-97a1-441d-8b7f-0e7983ce9f7f","source":"wordfence","cve":"CVE-2026-115590","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.3.1 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54be8293-97a1-441d-8b7f-0e7983ce9f7f?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2026-10-26T13:02:17Z","updated":"2026-11-03T19:26:20Z"},{"id":"wordfence:54bee415-b1f4-4176-a317-3e2a651298fb","source":"wordfence","cve":"CVE-2026-16032","title":"LWS Optimize <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54bee415-b1f4-4176-a317-3e2a651298fb?source=api-prod","affected":[{"type":"plugin","slug":"lws-optimize","name":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-15T21:17:46Z"},{"id":"wordfence:54c0146d-3193-4fde-9082-600ab97160e6","source":"wordfence","cve":"CVE-2025-32601","title":"Twispay Credit Card Payments <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c0146d-3193-4fde-9082-600ab97160e6?source=api-prod","affected":[{"type":"plugin","slug":"twispay","name":"Twispay Credit Card Payments","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:53:44Z"},{"id":"wordfence:54c14f04-32ec-4d05-b47b-3ff5e70c4daf","source":"wordfence","cve":"CVE-2023-36529","title":"Houzez CRM <= 1.3.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c14f04-32ec-4d05-b47b-3ff5e70c4daf?source=api-prod","affected":[{"type":"plugin","slug":"houzez-crm","name":"Houzez CRM","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54c154a9-e751-4e8f-a26e-7eb208fa7ffe","source":"wordfence","cve":"CVE-2011-5254","title":"Connections Business Directory < 0.7.1.6 - Authorization Bypass","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c154a9-e751-4e8f-a26e-7eb208fa7ffe?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"0.7.1.5","to_inclusive":true,"patched_in":"0.7.1.6"}],"published":"2011-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54c1809d-cff3-4800-8945-bffad7f03d33","source":"wordfence","cve":"CVE-2025-31908","title":"JSON Structuring Markup <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c1809d-cff3-4800-8945-bffad7f03d33?source=api-prod","affected":[{"type":"plugin","slug":"json-structuring-markup","name":"JSON Structuring Markup","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:17:31Z"},{"id":"wordfence:54c1b0e9-6fab-4452-b232-953e671f4d8d","source":"wordfence","cve":"CVE-2025-10037","title":"Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c1b0e9-6fab-4452-b232-953e671f4d8d?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T04:25:18Z"},{"id":"wordfence:54c1eb7b-c3fe-4975-9f51-df3aba53fe46","source":"wordfence","cve":"CVE-2024-44013","title":"VR Calendar <= 2.4.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c1eb7b-c3fe-4975-9f51-df3aba53fe46?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-18T13:41:36Z"},{"id":"wordfence:54c38be0-ffe7-4fa4-b5c9-cb717c11aed5","source":"wordfence","cve":"CVE-2023-40667","title":"Simple URLs <= 117 - Reflected Cross-Site Scripting via 'post_id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c38be0-ffe7-4fa4-b5c9-cb717c11aed5?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"117","to_inclusive":true,"patched_in":"118"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54c563fb-efc2-44f2-9b1d-7c4a377a2565","source":"wordfence","cve":"CVE-2025-27350","title":"Vice Versa <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c563fb-efc2-44f2-9b1d-7c4a377a2565?source=api-prod","affected":[{"type":"plugin","slug":"vice-versa","name":"Vice Versa","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:54:45Z"},{"id":"wordfence:54c63e3d-4588-45e9-ad39-57611aa46aed","source":"wordfence","cve":"CVE-2025-66146","title":"Logger for Elementor <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c63e3d-4588-45e9-ad39-57611aa46aed?source=api-prod","affected":[{"type":"plugin","slug":"logger-elementor","name":"Changelog & Custom List for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:37:07Z"},{"id":"wordfence:54c79532-588d-4afd-ad01-199b5c4ce4d0","source":"wordfence","cve":"CVE-2025-31081","title":"Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c79532-588d-4afd-ad01-199b5c4ce4d0?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:21:23Z"},{"id":"wordfence:54c90c31-945b-4099-97fe-8c148ded3703","source":"wordfence","cve":"CVE-2025-31835","title":"WP Plugin Info Card <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c90c31-945b-4099-97fe-8c148ded3703?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-info-card","name":"WP Plugin Info Card \u2013 Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-23T17:19:16Z"},{"id":"wordfence:54c94de4-59b4-4f0b-85db-2074a41d04f8","source":"wordfence","cve":"CVE-2023-47558","title":"Who Hit The Page \u2013 Hit Counter <= 1.4.14.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54c94de4-59b4-4f0b-85db-2074a41d04f8?source=api-prod","affected":[{"type":"plugin","slug":"who-hit-the-page-hit-counter","name":"Who Hit The Page \u2013 Hit Counter","from":"*","from_inclusive":true,"to":"1.4.14.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54cccd61-35d0-432c-8832-28e7928c464d","source":"wordfence","cve":"CVE-2022-45081","title":"Add Multiple Marker <= 1.2 - Missing Authorization Checks to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54cccd61-35d0-432c-8832-28e7928c464d?source=api-prod","affected":[{"type":"plugin","slug":"add-multiple-marker","name":"Multi Location Marker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2022-11-11T00:00:00Z","updated":"2026-02-03T19:51:22Z"},{"id":"wordfence:54d6effe-f1f6-4692-88c1-ca408190aa7b","source":"wordfence","cve":"CVE-2026-66603","title":"Draft List <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54d6effe-f1f6-4692-88c1-ca408190aa7b?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:30:27Z"},{"id":"wordfence:54da4deb-e50c-478d-ab99-222c5573a036","source":"wordfence","cve":"CVE-2026-109997","title":"Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54da4deb-e50c-478d-ab99-222c5573a036?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-10-30T17:25:04Z","updated":"2026-10-31T05:33:07Z"},{"id":"wordfence:54db1807-69ff-445c-9e02-9abce9fd3940","source":"wordfence","cve":"CVE-2025-11227","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54db1807-69ff-445c-9e02-9abce9fd3940?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2025-10-03T14:14:48Z","updated":"2025-10-04T02:24:35Z"},{"id":"wordfence:54db4d53-7c4f-47d9-811d-8282eaf2d074","source":"wordfence","cve":"CVE-2024-32729","title":"Conversational Forms for ChatBot <= 1.1.8 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54db4d53-7c4f-47d9-811d-8282eaf2d074?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T13:55:53Z"},{"id":"wordfence:54db4fef-f834-4026-a7ad-1fffaa3266b5","source":"wordfence","cve":"CVE-2025-48233","title":"Affiliates Manager Google reCAPTCHA Integration <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54db4fef-f834-4026-a7ad-1fffaa3266b5?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager-google-recaptcha-integration","name":"Affiliates Manager Google reCAPTCHA Integration","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:47:37Z"},{"id":"wordfence:54dbd2f4-717c-4e01-afe4-c8cceca52650","source":"wordfence","cve":"CVE-2023-27417","title":"Affiliate Super Assistent <= 1.5.1 - Cross-Site Request Forgery to Settings Update and Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54dbd2f4-717c-4e01-afe4-c8cceca52650?source=api-prod","affected":[{"type":"plugin","slug":"amazonsimpleadmin","name":"Affiliate Super Assistent","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54def910-b934-4a48-b7fe-7165917b01ca","source":"wordfence","cve":"CVE-2024-14015","title":"Studiocart <= 2.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54def910-b934-4a48-b7fe-7165917b01ca?source=api-prod","affected":[{"type":"plugin","slug":"studiocart","name":"WordPress eCommerce Plugin \u2013 Studiocart","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-01T17:06:38Z"},{"id":"wordfence:54e022df-0dc7-4f60-811d-48a92b723d55","source":"wordfence","cve":"CVE-2025-5940","title":"Osom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e022df-0dc7-4f60-811d-48a92b723d55?source=api-prod","affected":[{"type":"plugin","slug":"osomblocks","name":"Osom Blocks","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-06-26T19:06:29Z","updated":"2025-07-03T12:13:50Z"},{"id":"wordfence:54e065bf-170d-4f15-879a-fd5fbcb87f79","source":"wordfence","cve":"CVE-2024-32806","title":"Headline Analyzer <= 1.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e065bf-170d-4f15-879a-fd5fbcb87f79?source=api-prod","affected":[{"type":"plugin","slug":"headline-analyzer","name":"Headline Analyzer","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:47:37Z"},{"id":"wordfence:54e330e7-d305-4254-a9e9-4d7f2c54c51c","source":"wordfence","cve":"CVE-2023-27613","title":"Forms Ada <= 1.0 - Reflected Cross-Site Scripting via 'p' parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e330e7-d305-4254-a9e9-4d7f2c54c51c?source=api-prod","affected":[{"type":"plugin","slug":"forms-ada-form-builder","name":"Forms Ada \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54e53420-aa89-49d6-9632-cba066c46a51","source":"wordfence","cve":"CVE-2026-12272","title":"Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant","severity":"medium","cvss":5.3,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-cookie-notice-free","name":"Lightweight Cookie Notice \u2013 Cookie Banner for Cookie Consent","from":"*","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":"1.20"}],"published":"2026-10-15T16:55:31Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:54e5989f-3d2c-4ed3-b4c4-f2589b885637","source":"wordfence","cve":"CVE-2024-11452","title":"Chamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e5989f-3d2c-4ed3-b4c4-f2589b885637?source=api-prod","affected":[{"type":"plugin","slug":"chamber-dashboard-business-directory","name":"Chamber Dashboard Business Directory","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.10"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T03:27:24Z"},{"id":"wordfence:54e7ccaf-2b16-4e36-a8ec-8f1f61193ffd","source":"wordfence","cve":"CVE-2015-4127","title":"Church Admin < 0.810 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54e7ccaf-2b16-4e36-a8ec-8f1f61193ffd?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"0.810","to_inclusive":false,"patched_in":"0.810"}],"published":"2015-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54ee0f45-6b92-4fa7-80dd-faab4e555e54","source":"wordfence","cve":"CVE-2025-52810","title":"Katerio - Magazine <= 1.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54ee0f45-6b92-4fa7-80dd-faab4e555e54?source=api-prod","affected":[{"type":"theme","slug":"katerio","name":"Katerio - Magazine & Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:53:11Z"},{"id":"wordfence:54f1ebfb-67f1-461d-91f1-269b0a2c0653","source":"wordfence","cve":"CVE-2025-3810","title":"WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T01:42:34Z"},{"id":"wordfence:54f449f4-0a22-45c7-8a3b-9121d70b5fe4","source":"wordfence","cve":"CVE-2026-103913","title":"GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f449f4-0a22-45c7-8a3b-9121d70b5fe4?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.186","to_inclusive":true,"patched_in":"2.8.187"}],"published":"2026-10-02T16:38:45Z","updated":"2026-10-03T05:29:15Z"},{"id":"wordfence:54f5a845-440a-4bee-a2cd-53ddd4a16994","source":"wordfence","cve":"CVE-2026-111844","title":"Brizy \u2013 Page Builder  2.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f5a845-440a-4bee-a2cd-53ddd4a16994?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"2.8.23","from_inclusive":true,"to":"2.8.23","to_inclusive":true,"patched_in":"2.8.24"}],"published":"2026-10-20T09:46:00Z","updated":"2026-10-23T18:46:26Z"},{"id":"wordfence:54f6a790-7cff-4910-a481-48ae13ba57c8","source":"wordfence","cve":"CVE-2022-45069","title":"Crowdsignal Dashboard <= 3.0.9 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f6a790-7cff-4910-a481-48ae13ba57c8?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:54f6e6b4-ecf6-485b-a4f7-5878b8cace50","source":"wordfence","cve":"CVE-2024-37450","title":"Benevolent <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f6e6b4-ecf6-485b-a4f7-5878b8cace50?source=api-prod","affected":[{"type":"theme","slug":"benevolent","name":"Benevolent","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-08-16T18:22:07Z"},{"id":"wordfence:54f7cdb7-4e92-4793-86bb-cbd612e7ec13","source":"wordfence","cve":"CVE-2026-32421","title":"Post Timeline <= 2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f7cdb7-4e92-4793-86bb-cbd612e7ec13?source=api-prod","affected":[{"type":"plugin","slug":"post-timeline","name":"Post Timeline","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-15T21:01:44Z"},{"id":"wordfence:54f939f9-2853-401a-adc0-5b727da5179b","source":"wordfence","cve":"CVE-2026-12120","title":"FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f939f9-2853-401a-adc0-5b727da5179b?source=api-prod","affected":[{"type":"plugin","slug":"firebox","name":"FireBox \u2013 WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-18T04:31:09Z"},{"id":"wordfence:54fac673-2d83-4d06-a4c0-8bffc269a90c","source":"wordfence","cve":"CVE-2024-6431","title":"Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54fac673-2d83-4d06-a4c0-8bffc269a90c?source=api-prod","affected":[{"type":"plugin","slug":"media-net-ads-manager","name":"Media.net Ads Manager","from":"*","from_inclusive":true,"to":"2.10.13","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T01:51:03Z"},{"id":"wordfence:54fff686-3c5a-4e75-af04-05700db4f3f0","source":"wordfence","cve":"CVE-2026-22455","title":"Thebe <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54fff686-3c5a-4e75-af04-05700db4f3f0?source=api-prod","affected":[{"type":"theme","slug":"thebe","name":"Thebe - Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:04:04Z"},{"id":"wordfence:550872c8-3663-48fa-ab3f-f90351f3e169","source":"wordfence","cve":"","title":"Relevanssi Pro < 2.25 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550872c8-3663-48fa-ab3f-f90351f3e169?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25","to_inclusive":false,"patched_in":"2.25"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T19:27:39Z"},{"id":"wordfence:550a8107-f639-4edc-9aad-1943d032cc26","source":"wordfence","cve":"CVE-2021-38347","title":"Custom Website Data <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550a8107-f639-4edc-9aad-1943d032cc26?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-website-data","name":"Custom Website Data","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:550ae348-254e-49f5-8046-38629c774802","source":"wordfence","cve":"CVE-2026-4083","title":"Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550ae348-254e-49f5-8046-38629c774802?source=api-prod","affected":[{"type":"plugin","slug":"scoreboard-for-html5-game-lite","name":"Scoreboard for HTML5 Games Lite","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-03-20T11:20:53Z","updated":"2026-03-20T23:25:11Z"},{"id":"wordfence:550ae92f-6250-4cbd-85d0-a9054aee3916","source":"wordfence","cve":"","title":"WP Live Chat Support <= 4.3.5 - Stored Cross-site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550ae92f-6250-4cbd-85d0-a9054aee3916?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2015-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:550c3f56-d188-4be1-82cd-db076c09cf61","source":"wordfence","cve":"CVE-2023-2684","title":"File Renaming on Upload <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550c3f56-d188-4be1-82cd-db076c09cf61?source=api-prod","affected":[{"type":"plugin","slug":"file-renaming-on-upload","name":"Rename Media Files: Improve Your SEO","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:550fcbbd-254d-4b3c-a240-8afcf9f6937e","source":"wordfence","cve":"CVE-2022-44628","title":"4ECPS Web Forms <= 0.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/550fcbbd-254d-4b3c-a240-8afcf9f6937e?source=api-prod","affected":[{"type":"plugin","slug":"4ecps-webforms","name":"4ECPS Web Forms","from":"*","from_inclusive":true,"to":"0.2.17","to_inclusive":true,"patched_in":"0.2.18"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5511c5f4-b71c-484b-ab6f-2389a29809cd","source":"wordfence","cve":"CVE-2023-51528","title":"GPT3 AI Content Writer <= 1.8.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5511c5f4-b71c-484b-ab6f-2389a29809cd?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:551272a2-6c2b-45b8-b2e5-330396c5680a","source":"wordfence","cve":"CVE-2026-16291","title":"ProfileGrid \u2013 User Profiles, Groups and Communities < 5.9.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/551272a2-6c2b-45b8-b2e5-330396c5680a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.8","to_inclusive":false,"patched_in":"5.9.9.8"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:25:38Z"},{"id":"wordfence:551d4ad8-9074-45dc-9404-3cbee9fdcd44","source":"wordfence","cve":"CVE-2025-28929","title":"Tabbed Login Widget <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/551d4ad8-9074-45dc-9404-3cbee9fdcd44?source=api-prod","affected":[{"type":"plugin","slug":"tabbed-login","name":"Tabbed Login Widget","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:25:36Z"},{"id":"wordfence:55203d91-ae6b-4ec0-8bbe-be7f65b4f34b","source":"wordfence","cve":"CVE-2024-51797","title":"Ultimate Accordion <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55203d91-ae6b-4ec0-8bbe-be7f65b4f34b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-accordion","name":"Ultimate Accordion","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:19:10Z"},{"id":"wordfence:55234307-9d51-4fe8-bc22-78d32a5fed11","source":"wordfence","cve":"","title":"Solid Central <= 3.0.0 - Stored Cross-Site Scripting via packages","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55234307-9d51-4fe8-bc22-78d32a5fed11?source=api-prod","affected":[{"type":"plugin","slug":"ithemes-sync","name":"Kadence Central \u2013 Site Management, Backups, Security, and Reporting","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55278cc8-338e-4583-9334-f91f94f22e13","source":"wordfence","cve":"CVE-2025-54049","title":"Custom API for WP <= 4.2.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55278cc8-338e-4583-9334-f91f94f22e13?source=api-prod","affected":[{"type":"plugin","slug":"custom-api-for-wp","name":"Custom API for WP","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T20:08:38Z"},{"id":"wordfence:552a5d94-8727-4840-8be1-ab165ddf4eae","source":"wordfence","cve":"CVE-2022-42485","title":"Gallery with thumbnail slider <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/552a5d94-8727-4840-8be1-ab165ddf4eae?source=api-prod","affected":[{"type":"plugin","slug":"gallery-with-thumbnail-slider","name":"Gallery with thumbnail slider","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:552bc1cc-df98-4608-a50e-db1381ca8e0a","source":"wordfence","cve":"CVE-2023-51542","title":"Branda <= 3.4.14 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/552bc1cc-df98-4608-a50e-db1381ca8e0a?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.14","to_inclusive":true,"patched_in":"3.4.15"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:552c0810-9687-4a66-91a4-e34228552a15","source":"wordfence","cve":"CVE-2024-2144","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/552c0810-9687-4a66-91a4-e34228552a15?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T06:44:45Z"},{"id":"wordfence:552d2d0d-1f4a-4557-ba8e-9f63acbfffba","source":"wordfence","cve":"CVE-2022-1164","title":"Wyzi - Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/552d2d0d-1f4a-4557-ba8e-9f63acbfffba?source=api-prod","affected":[{"type":"theme","slug":"wyzi-business-finder","name":"Wyzi - Social Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2021-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:552ec9fc-5bff-4bee-be04-39892c89cd59","source":"wordfence","cve":"CVE-2025-5304","title":"PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/552ec9fc-5bff-4bee-be04-39892c89cd59?source=api-prod","affected":[{"type":"plugin","slug":"project-notebooks","name":"PT Project Notebooks","from":"1.0.0","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-06-27T17:17:51Z","updated":"2025-12-03T17:01:19Z"},{"id":"wordfence:55315ba1-cbb8-4ce1-96c6-30a02611ba47","source":"wordfence","cve":"CVE-2025-11722","title":"Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55315ba1-cbb8-4ce1-96c6-30a02611ba47?source=api-prod","affected":[{"type":"plugin","slug":"accordion-panel-for-category-and-products","name":"Woocommerce Category and Products Accordion Panel","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T20:02:02Z","updated":"2025-10-15T08:25:56Z"},{"id":"wordfence:553224f0-0c09-42bb-bfec-e257ef26c914","source":"wordfence","cve":"CVE-2025-49276","title":"Blogmine <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/553224f0-0c09-42bb-bfec-e257ef26c914?source=api-prod","affected":[{"type":"theme","slug":"blogmine","name":"Blogmine","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:35:50Z"},{"id":"wordfence:553255fb-2bec-48e8-bb16-1e7f66674282","source":"wordfence","cve":"CVE-2022-3618","title":"Spacer <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/553255fb-2bec-48e8-bb16-1e7f66674282?source=api-prod","affected":[{"type":"plugin","slug":"spacer","name":"Spacer","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55367b9b-8ae1-4282-bf9f-8fb3848eb579","source":"wordfence","cve":"CVE-2023-4507","title":"Admission AppManager <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55367b9b-8ae1-4282-bf9f-8fb3848eb579?source=api-prod","affected":[{"type":"plugin","slug":"admission-appmanager","name":"Admission AppManager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:22Z"},{"id":"wordfence:5536905a-8036-4d9a-a28b-fbd7ae689751","source":"wordfence","cve":"CVE-2026-24608","title":"Laurent Core <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5536905a-8036-4d9a-a28b-fbd7ae689751?source=api-prod","affected":[{"type":"plugin","slug":"laurent-core","name":"Laurent Core","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-02-03T21:02:02Z"},{"id":"wordfence:5536a6fd-3df0-4595-b71d-b8bcdbb64a9f","source":"wordfence","cve":"CVE-2012-2583","title":"Mini Mail Dashboard Widget < 1.43 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5536a6fd-3df0-4595-b71d-b8bcdbb64a9f?source=api-prod","affected":[{"type":"plugin","slug":"mini-mail-dashboard-widget","name":"mini-mail-dashboard-widget","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":false,"patched_in":"1.43"}],"published":"2012-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5537c46d-1df3-4d24-b1c0-851c22c6ae79","source":"wordfence","cve":"CVE-2025-22522","title":"SingSong <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5537c46d-1df3-4d24-b1c0-851c22c6ae79?source=api-prod","affected":[{"type":"plugin","slug":"singsong","name":"SingSong","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:24:35Z"},{"id":"wordfence:5538f3e6-b17f-4dd0-aa5a-d190c128d977","source":"wordfence","cve":"CVE-2024-35699","title":"HT Feed <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5538f3e6-b17f-4dd0-aa5a-d190c128d977?source=api-prod","affected":[{"type":"plugin","slug":"ht-instagram","name":"HT Feed","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:36:42Z"},{"id":"wordfence:5539aa79-66ad-43fa-967c-2bec877061e0","source":"wordfence","cve":"CVE-2021-4351","title":"Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5539aa79-66ad-43fa-967c-2bec877061e0?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:553a9a16-97e0-4443-9d4b-dd901b86141b","source":"wordfence","cve":"CVE-2026-93899","title":"Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/553a9a16-97e0-4443-9d4b-dd901b86141b?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-09-24T18:12:46Z","updated":"2026-09-25T06:39:53Z"},{"id":"wordfence:553f2cd8-9868-4190-91ea-88e03b9ddc3d","source":"wordfence","cve":"CVE-2026-25414","title":"WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":4.3,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/553f2cd8-9868-4190-91ea-88e03b9ddc3d?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit-pro","name":"WPBookit Pro - Appointment Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":""}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:11:43Z"},{"id":"wordfence:5542fd84-bb92-4aa9-b161-fa86b45e0a1e","source":"wordfence","cve":"CVE-2026-39551","title":"T\u00f6bel - Modern Furniture Store WordPress Theme <= 1.8.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5542fd84-bb92-4aa9-b161-fa86b45e0a1e?source=api-prod","affected":[{"type":"theme","slug":"tobel","name":"T\u00f6bel - Modern Furniture Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:02:12Z"},{"id":"wordfence:55430010-f18f-4d8d-bbfa-cc02344369e0","source":"wordfence","cve":"CVE-2025-31895","title":"ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55430010-f18f-4d8d-bbfa-cc02344369e0?source=api-prod","affected":[{"type":"plugin","slug":"abc-notation","name":"ABC Notation","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:36:25Z"},{"id":"wordfence:5545aab7-da77-4404-90e8-7b3e413769b5","source":"wordfence","cve":"CVE-2026-66433","title":"Location Weather <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5545aab7-da77-4404-90e8-7b3e413769b5?source=api-prod","affected":[{"type":"plugin","slug":"location-weather","name":"Location Weather \u2013 WordPress Weather Forecast, Air Quality & Weather Widget","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:10:33Z"},{"id":"wordfence:5548b97d-14f0-4f50-b213-a19c02c240be","source":"wordfence","cve":"CVE-2025-7402","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.95 - Unauthenticated SQL Injection via site_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5548b97d-14f0-4f50-b213-a19c02c240be?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.95","to_inclusive":true,"patched_in":""}],"published":"2025-11-23T16:21:27Z","updated":"2025-11-24T04:36:41Z"},{"id":"wordfence:55491c64-e4b5-4919-bdcb-7285f2a3c3cd","source":"wordfence","cve":"CVE-2022-1463","title":"Booking Calendar <= 9.1 - PHP Object Injection via Shortcode","severity":"high","cvss":8.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55491c64-e4b5-4919-bdcb-7285f2a3c3cd?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:554a314c-9e8e-4691-9792-d086790ef40f","source":"wordfence","cve":"CVE-2024-9047","title":"WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.11","to_inclusive":true,"patched_in":"4.24.12"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T06:51:13Z"},{"id":"wordfence:554bea9d-903f-4e6f-8013-9816aa375f70","source":"wordfence","cve":"CVE-2025-30916","title":"Residential Address Detection <= 2.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/554bea9d-903f-4e6f-8013-9816aa375f70?source=api-prod","affected":[{"type":"plugin","slug":"residential-address-detection","name":"Residential Address Detection","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T15:11:39Z"},{"id":"wordfence:554eaea1-d222-4d6d-9351-0aad07a87a80","source":"wordfence","cve":"","title":"WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Prototype Pollution","severity":"medium","cvss":6.4,"cwe":"CWE-1321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/554eaea1-d222-4d6d-9351-0aad07a87a80?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.4.14"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T17:35:56Z"},{"id":"wordfence:554fb91b-35eb-43c4-b949-4f07143e013f","source":"wordfence","cve":"CVE-2025-26752","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.1.10 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/554fb91b-35eb-43c4-b949-4f07143e013f?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-03-03T21:10:52Z"},{"id":"wordfence:555a69e2-7ff2-48ea-a4de-04d8a47d02e3","source":"wordfence","cve":"CVE-2025-57937","title":"WPeMatico RSS Feed Fetcher <= 2.8.10 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/555a69e2-7ff2-48ea-a4de-04d8a47d02e3?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":true,"patched_in":"2.8.11"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:38:51Z"},{"id":"wordfence:555be499-b57b-4ded-840a-a5cc7b864e98","source":"wordfence","cve":"CVE-2026-32550","title":"Kadence Shop Kit <= 3.0.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/555be499-b57b-4ded-840a-a5cc7b864e98?source=api-prod","affected":[{"type":"plugin","slug":"kadence-shop-kit","name":"Kadence Shop Kit","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.6.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T20:22:03Z"},{"id":"wordfence:555dce5e-9868-464a-9cb4-67644cc6a61c","source":"wordfence","cve":"CVE-2023-52132","title":"WP Adminify <= 3.1.6 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/555dce5e-9868-464a-9cb4-67644cc6a61c?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":false,"patched_in":"3.1.7"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:555f9bf9-5b76-4cbe-852b-5fffb1fc1b35","source":"wordfence","cve":"CVE-2025-53265","title":"Virusdie <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/555f9bf9-5b76-4cbe-852b-5fffb1fc1b35?source=api-prod","affected":[{"type":"plugin","slug":"virusdie","name":"Virusdie | One-click website security","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-16T15:20:41Z"},{"id":"wordfence:55604ee9-7343-472c-9a29-035d18b266ab","source":"wordfence","cve":"CVE-2023-28689","title":"JS Job Manager <= 2.0.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55604ee9-7343-472c-9a29-035d18b266ab?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55636e09-3edb-4cb7-b390-78d45a6cbf99","source":"wordfence","cve":"CVE-2026-103695","title":"Mobile Builder <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55636e09-3edb-4cb7-b390-78d45a6cbf99?source=api-prod","affected":[{"type":"plugin","slug":"mobile-builder","name":"Mobile builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:36:41Z"},{"id":"wordfence:55666498-be5c-45e8-9230-b5d79d720a1e","source":"wordfence","cve":"CVE-2026-22364","title":"SevenTrees <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55666498-be5c-45e8-9230-b5d79d720a1e?source=api-prod","affected":[{"type":"theme","slug":"seventrees","name":"SevenTrees | Real Estate Property WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:24:26Z"},{"id":"wordfence:5566a55e-81bb-4e14-98e1-1a548541e243","source":"wordfence","cve":"CVE-2025-54693","title":"Form Block <= 1.5.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5566a55e-81bb-4e14-98e1-1a548541e243?source=api-prod","affected":[{"type":"plugin","slug":"form-block","name":"Form Block","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:35:00Z"},{"id":"wordfence:5569e2fa-ce20-4ad0-8089-7c9ec792cc44","source":"wordfence","cve":"CVE-2025-14149","title":"Xpro Addons \u2014 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5569e2fa-ce20-4ad0-8089-7c9ec792cc44?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.24","to_inclusive":true,"patched_in":"1.4.25"}],"published":"2026-02-26T18:19:01Z","updated":"2026-02-27T06:43:50Z"},{"id":"wordfence:5569ec0f-eeb6-433f-bb49-336abae2a29a","source":"wordfence","cve":"","title":"Velvet Theme (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5569ec0f-eeb6-433f-bb49-336abae2a29a?source=api-prod","affected":[{"type":"theme","slug":"velvet","name":"Velvet","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:556e41d1-2c98-4175-87ba-29689704c2f0","source":"wordfence","cve":"CVE-2026-2383","title":"Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/556e41d1-2c98-4175-87ba-29689704c2f0?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-02-26T19:24:24Z","updated":"2026-02-27T08:24:23Z"},{"id":"wordfence:556e54d4-9e3a-4d9a-9e6e-0021f119c98b","source":"wordfence","cve":"CVE-2024-44020","title":"WP Free SSL \u2013 Free SSL Certificate for WordPress and force HTTPS <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/556e54d4-9e3a-4d9a-9e6e-0021f119c98b?source=api-prod","affected":[{"type":"plugin","slug":"wp-free-ssl","name":"WP Free SSL","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-09-24T00:00:00Z","updated":"2025-07-28T20:24:24Z"},{"id":"wordfence:556f6e7d-dbb4-4030-b6f9-8709135ae660","source":"wordfence","cve":"CVE-2025-23670","title":"4 author cheer up donate <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/556f6e7d-dbb4-4030-b6f9-8709135ae660?source=api-prod","affected":[{"type":"plugin","slug":"4-author-cheer-up-donate","name":"4 author cheer up donate","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-12T21:07:04Z"},{"id":"wordfence:5570b8ef-6fb9-4f9e-be39-d8c615d1abab","source":"wordfence","cve":"","title":"SendPress Newsletters < 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5570b8ef-6fb9-4f9e-be39-d8c615d1abab?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.1.7.21","to_inclusive":true,"patched_in":"1.2"}],"published":"2015-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:557172d0-33ad-427a-b575-df529e2aaab0","source":"wordfence","cve":"CVE-2014-3907","title":"MailPoet Newsletters (Previous) <= 2.6.10 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/557172d0-33ad-427a-b575-df529e2aaab0?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.6.11","to_inclusive":false,"patched_in":"2.6.11"}],"published":"2014-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5572fea7-a8d5-457d-88fc-57051b35aa11","source":"wordfence","cve":"CVE-2021-24303","title":"JiangQie Official Website Mini Program < 1.1.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5572fea7-a8d5-457d-88fc-57051b35aa11?source=api-prod","affected":[{"type":"plugin","slug":"jiangqie-official-website-mini-program","name":"ZhuiGe Official Website Mini Program","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2021-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:557306b7-7b66-465e-8d4d-ebae5b1577c9","source":"wordfence","cve":"CVE-2026-97644","title":"Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/557306b7-7b66-465e-8d4d-ebae5b1577c9?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2026-10-02T14:47:56Z","updated":"2026-10-03T03:25:44Z"},{"id":"wordfence:5574a52f-cec8-4f79-a3a7-5c13272e5e17","source":"wordfence","cve":"CVE-2026-75903","title":"Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5574a52f-cec8-4f79-a3a7-5c13272e5e17?source=api-prod","affected":[{"type":"plugin","slug":"vulnity","name":"Vulnity Security","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-10-15T19:09:57Z","updated":"2026-10-16T07:44:02Z"},{"id":"wordfence:5574f8ab-74b7-4f6c-b8db-901cb6e45cfb","source":"wordfence","cve":"CVE-2020-14063","title":"TC Custom JavaScript <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5574f8ab-74b7-4f6c-b8db-901cb6e45cfb?source=api-prod","affected":[{"type":"plugin","slug":"tc-custom-javascript","name":"TC Custom JavaScript","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2020-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55750dcf-c6ec-4be6-967f-60bf940fa30e","source":"wordfence","cve":"CVE-2025-13749","title":"Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55750dcf-c6ec-4be6-967f-60bf940fa30e?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-01-08T17:24:32Z","updated":"2026-01-09T05:25:21Z"},{"id":"wordfence:55773c6c-85e8-4023-8dd6-4feb0f6254b2","source":"wordfence","cve":"CVE-2011-4624","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 1.57 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55773c6c-85e8-4023-8dd6-4feb0f6254b2?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"1.57","to_inclusive":false,"patched_in":"1.57"}],"published":"2011-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55780902-6ac1-40e4-b3a3-230b801f4103","source":"wordfence","cve":"CVE-2026-74004","title":"Gravity Booster \u2013 Styles & Layouts for Gravity Forms <= 6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55780902-6ac1-40e4-b3a3-230b801f4103?source=api-prod","affected":[{"type":"plugin","slug":"styles-and-layouts-for-gravity-forms","name":"Gravity Booster \u2013 Styles & Layouts for Gravity Forms","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T17:17:00Z","updated":"2026-09-10T19:13:15Z"},{"id":"wordfence:55797931-e2eb-4cd7-8de6-ded7e1a382a0","source":"wordfence","cve":"CVE-2024-29111","title":"Sitekit <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55797931-e2eb-4cd7-8de6-ded7e1a382a0?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T20:46:24Z"},{"id":"wordfence:5579957a-ad45-4518-ad3c-16b3841a301d","source":"wordfence","cve":"CVE-2026-22491","title":"My auctions allegro <= 4.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5579957a-ad45-4518-ad3c-16b3841a301d?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-03-05T00:00:00Z","updated":"2026-10-28T21:11:02Z"},{"id":"wordfence:557bdd07-c846-41f1-b780-52537f47b15a","source":"wordfence","cve":"CVE-2024-37500","title":"Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/557bdd07-c846-41f1-b780-52537f47b15a?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.2.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:29:51Z"},{"id":"wordfence:55801141-9b3d-4dc3-84b5-2a85dfbcde74","source":"wordfence","cve":"CVE-2025-67575","title":"Sitewide Notice WP <= 2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55801141-9b3d-4dc3-84b5-2a85dfbcde74?source=api-prod","affected":[{"type":"plugin","slug":"sitewide-notice-wp","name":"Sitewide Notice WP","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:17:56Z"},{"id":"wordfence:5580ad05-af50-4899-9cbf-39ad8000eb6a","source":"wordfence","cve":"CVE-2026-78438","title":"W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5580ad05-af50-4899-9cbf-39ad8000eb6a?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.6"}],"published":"2026-09-04T17:50:03Z","updated":"2026-09-05T06:37:57Z"},{"id":"wordfence:5580e3b7-31fd-4895-9af6-94129224abab","source":"wordfence","cve":"CVE-2024-56027","title":"Leads CRM <= 2.0.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5580e3b7-31fd-4895-9af6-94129224abab?source=api-prod","affected":[{"type":"plugin","slug":"leads-crm","name":"Leads CRM for WordPress WooCommerce","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:00:00Z"},{"id":"wordfence:55827029-479e-4c4c-ba33-203075e1bbbc","source":"wordfence","cve":"CVE-2023-52224","title":"Revolut Gateway for WooCommerce <= 4.9.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55827029-479e-4c4c-ba33-203075e1bbbc?source=api-prod","affected":[{"type":"plugin","slug":"revolut-gateway-for-woocommerce","name":"Revolut Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2024-01-08T00:00:00Z","updated":"2024-03-12T09:47:50Z"},{"id":"wordfence:5582b625-9db1-42fd-b1b4-a1cc3e1b60bd","source":"wordfence","cve":"CVE-2026-102376","title":"Branda \u2013 White Label & Branding, Free Login Page Customizer <= 3.4.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5582b625-9db1-42fd-b1b4-a1cc3e1b60bd?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.32","to_inclusive":true,"patched_in":"3.4.33"}],"published":"2026-09-30T13:28:53Z","updated":"2026-10-08T23:10:36Z"},{"id":"wordfence:55838de5-0795-429b-be87-a0d57b29e471","source":"wordfence","cve":"CVE-2024-11445","title":"Image Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55838de5-0795-429b-be87-a0d57b29e471?source=api-prod","affected":[{"type":"plugin","slug":"image-magnify","name":"Image Magnify","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:17:28Z","updated":"2025-01-07T04:21:59Z"},{"id":"wordfence:55852490-7087-41b8-9848-758e443ae04b","source":"wordfence","cve":"CVE-2019-11591","title":"Contact Form by WD <= 1.13.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55852490-7087-41b8-9848-758e443ae04b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-maker","name":"Contact Form by WD \u2013 responsive drag & drop contact form builder tool","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":false,"patched_in":"1.13.5"}],"published":"2019-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:558668a8-85aa-4477-8663-1a6e5f4938d2","source":"wordfence","cve":"CVE-2026-107423","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/558668a8-85aa-4477-8663-1a6e5f4938d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.22","to_inclusive":true,"patched_in":"2.9.23"}],"published":"2026-10-12T08:25:00Z","updated":"2026-10-13T13:59:54Z"},{"id":"wordfence:558679ea-a8ee-4329-8ad7-34b708476b53","source":"wordfence","cve":"CVE-2023-35882","title":"Super Socializer <= 7.13.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/558679ea-a8ee-4329-8ad7-34b708476b53?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.52","to_inclusive":true,"patched_in":"7.13.53"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55893639-3b47-4ddc-b896-4b66341a4eba","source":"wordfence","cve":"","title":"Cart66 Lite :: WordPress Ecommerce <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55893639-3b47-4ddc-b896-4b66341a4eba?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2015-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55895508-d0ef-4855-8d15-b8a45ba0dcb2","source":"wordfence","cve":"CVE-2025-9294","title":"Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2026-01-05T20:13:08Z","updated":"2026-03-06T13:25:19Z"},{"id":"wordfence:5589754a-2234-457e-bfa4-59fb4161d736","source":"wordfence","cve":"CVE-2026-15258","title":"Product Feed Manager for WooCommerce <= 7.6.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5589754a-2234-457e-bfa4-59fb4161d736?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-15T21:28:53Z"},{"id":"wordfence:558b27a3-548b-4df3-84aa-24331394f2fe","source":"wordfence","cve":"CVE-2026-25378","title":"Nelio AB Testing <= 8.2.4 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/558b27a3-548b-4df3-84aa-24331394f2fe?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"8.2.4","to_inclusive":true,"patched_in":"8.2.5"}],"published":"2026-02-19T00:00:00Z","updated":"2026-02-24T19:20:46Z"},{"id":"wordfence:558b4b31-fd4f-4265-bddc-baf484d48fc5","source":"wordfence","cve":"CVE-2023-32587","title":"WP Reactions Lite <= 1.3.8 - Cross-Site Request Forgery via AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/558b4b31-fd4f-4265-bddc-baf484d48fc5?source=api-prod","affected":[{"type":"plugin","slug":"wp-reactions-lite","name":"WP Reactions Lite","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:558e36f6-4678-46a2-8154-42770fbb5574","source":"wordfence","cve":"CVE-2023-6225","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/558e36f6-4678-46a2-8154-42770fbb5574?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.13.3","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2023-11-27T00:00:00Z","updated":"2024-07-29T21:36:23Z"},{"id":"wordfence:559165ed-f7f6-4f5a-ad37-8a2d53924888","source":"wordfence","cve":"CVE-2024-53763","title":"Best Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559165ed-f7f6-4f5a-ad37-8a2d53924888?source=api-prod","affected":[{"type":"plugin","slug":"best-addons-for-elementor","name":"Best Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:23:42Z"},{"id":"wordfence:55924ea3-373c-4297-a958-5670def1f6c0","source":"wordfence","cve":"CVE-2026-6965","title":"Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55924ea3-373c-4297-a958-5670def1f6c0?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.10"}],"published":"2026-05-12T17:18:06Z","updated":"2026-05-13T05:29:38Z"},{"id":"wordfence:5596197e-149d-4072-9fa4-424c9ffd6059","source":"wordfence","cve":"CVE-2024-4440","title":"140+ Widgets | Best Addons For Elementor \u2013 FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5596197e-149d-4072-9fa4-424c9ffd6059?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.3.1"}],"published":"2024-05-13T21:01:53Z","updated":"2024-05-21T17:23:09Z"},{"id":"wordfence:5596a0f0-6bfe-4c6e-a0d6-117e13117098","source":"wordfence","cve":"CVE-2025-14043","title":"Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5596a0f0-6bfe-4c6e-a0d6-117e13117098?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-12-20T14:07:06Z","updated":"2025-12-21T02:20:32Z"},{"id":"wordfence:55981e72-8d1a-4075-a372-6bddc95e99d8","source":"wordfence","cve":"CVE-2024-5583","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55981e72-8d1a-4075-a372-6bddc95e99d8?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2024-08-21T12:38:51Z","updated":"2024-08-22T02:02:03Z"},{"id":"wordfence:559a92e0-609e-415f-aab3-649a185eb431","source":"wordfence","cve":"CVE-2023-2333","title":"Ninja Forms Google Sheet Connector <= 1.2.6 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559a92e0-609e-415f-aab3-649a185eb431?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-ninja-forms","name":"GSheetConnector \u2013 Ninja Forms Google Sheets Connector, Export Form Submissions Instant Sync to Sheets","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"},{"type":"plugin","slug":"gsheetconnector-ninja-forms-pro","name":"Ninja Forms Google Sheet Connector Pro","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:559a94d8-527d-48b3-a917-461ebfa012bc","source":"wordfence","cve":"CVE-2024-11462","title":"Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559a94d8-527d-48b3-a917-461ebfa012bc?source=api-prod","affected":[{"type":"plugin","slug":"filestack-upload","name":"Filestack WP Upload","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-12-13T15:59:52Z","updated":"2025-02-11T20:52:55Z"},{"id":"wordfence:559ade81-73cd-4820-a6db-9323d1d82f8f","source":"wordfence","cve":"CVE-2025-31876","title":"Payday <= 3.3.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559ade81-73cd-4820-a6db-9323d1d82f8f?source=api-prod","affected":[{"type":"plugin","slug":"payday","name":"Payday","from":"*","from_inclusive":true,"to":"3.3.13","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-30T14:32:04Z"},{"id":"wordfence:559b7250-5b10-4a01-925e-73ed4fa7ca3d","source":"wordfence","cve":"","title":"Essence < 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559b7250-5b10-4a01-925e-73ed4fa7ca3d?source=api-prod","affected":[{"type":"theme","slug":"essence","name":"Essence","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:559bf74a-1c34-4e77-b395-005150ab5e6e","source":"wordfence","cve":"CVE-2025-8281","title":"WP Talroo <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559bf74a-1c34-4e77-b395-005150ab5e6e?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobs2careers","name":"WP Talroo","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T00:00:00Z","updated":"2025-08-25T15:42:32Z"},{"id":"wordfence:559c83e9-8c85-4d2a-b835-d6b314ba7eab","source":"wordfence","cve":"CVE-2023-23729","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559c83e9-8c85-4d2a-b835-d6b314ba7eab?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:559cbc69-85b6-4bad-9bb2-26d64195ba7e","source":"wordfence","cve":"CVE-2025-2876","title":"MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559cbc69-85b6-4bad-9bb2-26d64195ba7e?source=api-prod","affected":[{"type":"plugin","slug":"melapress-login-security-premium","name":"MelaPress Login Security Premium","from":"2.1.0","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"},{"type":"plugin","slug":"melapress-login-security","name":"Melapress Login Security","from":"2.1.0","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T11:11:33Z"},{"id":"wordfence:559f88bc-30cb-4096-a7e5-d9bda64fdf8b","source":"wordfence","cve":"CVE-2026-103353","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/559f88bc-30cb-4096-a7e5-d9bda64fdf8b?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"6.2.15"}],"published":"2026-10-01T10:48:00Z","updated":"2026-10-08T23:20:19Z"},{"id":"wordfence:55a0b4ad-de5e-4203-a702-d498bf566165","source":"wordfence","cve":"CVE-2015-1055","title":"Photo Gallery by 10Web <= 1.2.7 - Unauthenticated Blind SQL Injection via order_by Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a0b4ad-de5e-4203-a702-d498bf566165?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2015-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55a103a7-c5d8-4b52-8291-e4ae4f848cbe","source":"wordfence","cve":"CVE-2012-0898","title":"myEASYbackup < 1.0.9 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a103a7-c5d8-4b52-8291-e4ae4f848cbe?source=api-prod","affected":[{"type":"plugin","slug":"myeasybackup","name":"myEASYbackup","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2012-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55a57b5f-2f87-4060-b1c2-77086f695dda","source":"wordfence","cve":"CVE-2022-4029","title":"Simple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a57b5f-2f87-4060-b1c2-77086f695dda?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55a64d00-a750-47b0-bc0b-95ad043ccb85","source":"wordfence","cve":"CVE-2025-23825","title":"Easy Shortcode Buttons <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a64d00-a750-47b0-bc0b-95ad043ccb85?source=api-prod","affected":[{"type":"plugin","slug":"easy-shortcode-buttons","name":"Easy Shortcode Buttons","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:15:01Z"},{"id":"wordfence:55a70835-55cc-4056-b584-e1b56ba83f91","source":"wordfence","cve":"CVE-2025-46231","title":"affiliate-toolkit <= 3.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a70835-55cc-4056-b584-e1b56ba83f91?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:29:19Z"},{"id":"wordfence:55a942b7-5d3e-4ddf-8bc3-61ff90a7fdbd","source":"wordfence","cve":"","title":"All in One SEO  <= 2.1.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55a942b7-5d3e-4ddf-8bc3-61ff90a7fdbd?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2014-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55aa8929-7075-4fd3-a602-87faf0255862","source":"wordfence","cve":"CVE-2026-81291","title":"Uncode <= 2.12.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55aa8929-7075-4fd3-a602-87faf0255862?source=api-prod","affected":[{"type":"theme","slug":"uncode","name":"Uncode","from":"*","from_inclusive":true,"to":"2.12.7","to_inclusive":true,"patched_in":"2.12.8"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:42:21Z"},{"id":"wordfence:55abf798-f336-4262-9f52-4526a4bae15a","source":"wordfence","cve":"CVE-2023-49772","title":"Genesis Simple Love <= 2.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55abf798-f336-4262-9f52-4526a4bae15a?source=api-prod","affected":[{"type":"plugin","slug":"genesis-simple-love","name":"Genesis Simple Love","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55ae710e-469e-4b36-b443-39228ad2a584","source":"wordfence","cve":"CVE-2024-56268","title":"Post Grid Elementor Addon <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55ae710e-469e-4b36-b443-39228ad2a584?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-elementor-addon","name":"Post Grid Addon for Elementor","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":true,"patched_in":"2.0.19"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:18:20Z"},{"id":"wordfence:55b08fca-65af-4535-aa94-a9bfaef67b4c","source":"wordfence","cve":"CVE-2022-1904","title":"Easy Pricing Tables <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55b08fca-65af-4535-aa94-a9bfaef67b4c?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2022-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55b39859-b8a0-418b-ae7a-cd42d6e0bf00","source":"wordfence","cve":"CVE-2023-23657","title":"Mail Subscribe List <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via smlsubform shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55b39859-b8a0-418b-ae7a-cd42d6e0bf00?source=api-prod","affected":[{"type":"plugin","slug":"mail-subscribe-list","name":"Mail Subscribe List","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55b3e2dc-dc4f-408b-bbc6-da72ed5ad245","source":"wordfence","cve":"CVE-2023-6558","title":"Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55b3e2dc-dc4f-408b-bbc6-da72ed5ad245?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2023-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55b73f5c-97cb-4f62-9155-dad8e1059894","source":"wordfence","cve":"CVE-2026-82925","title":"Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55b73f5c-97cb-4f62-9155-dad8e1059894?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"7.2.2","from_inclusive":true,"to":"8.2.2","to_inclusive":true,"patched_in":"8.3.0"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:09:36Z"},{"id":"wordfence:55b75c83-2b1d-4870-b5df-74ba50102d2e","source":"wordfence","cve":"CVE-2026-25027","title":"Unicamp <= 2.7.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55b75c83-2b1d-4870-b5df-74ba50102d2e?source=api-prod","affected":[{"type":"theme","slug":"unicamp","name":"Unicamp - University and College WordPress Theme","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:01:38Z"},{"id":"wordfence:55ba8d6a-df38-4e24-afa4-6f82cb318c6b","source":"wordfence","cve":"CVE-2026-11598","title":"Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute","severity":"medium","cvss":5.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55ba8d6a-df38-4e24-afa4-6f82cb318c6b?source=api-prod","affected":[{"type":"plugin","slug":"shortcodify","name":"Shortcodify","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-27T21:29:41Z","updated":"2026-07-28T09:30:17Z"},{"id":"wordfence:55bb3620-c182-46c4-bc22-8526cf410cdb","source":"wordfence","cve":"","title":"KB Support <= 1.5.88 - Missing Authorization to Authenticated (Subscriber+) User Data Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55bb3620-c182-46c4-bc22-8526cf410cdb?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.5.89","to_inclusive":false,"patched_in":"1.5.89"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55bd9bb4-6a81-4e9d-b0a9-76725aba6635","source":"wordfence","cve":"CVE-2021-24832","title":"WP SEO Redirect 301 <= 2.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55bd9bb4-6a81-4e9d-b0a9-76725aba6635?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-redirect-301","name":"WP SEO Redirect 301","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55c568b1-4f9e-4a1f-bad1-0a373c9d33ae","source":"wordfence","cve":"CVE-2024-37207","title":"Demo Awesome <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55c568b1-4f9e-4a1f-bad1-0a373c9d33ae?source=api-prod","affected":[{"type":"plugin","slug":"demo-awesome","name":"Demo Awesome","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-01T15:04:49Z"},{"id":"wordfence:55c586a0-bb91-4702-a9f2-d7503f247da3","source":"wordfence","cve":"","title":"Magic Post Thumbnail <= 3.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55c586a0-bb91-4702-a9f2-d7503f247da3?source=api-prod","affected":[{"type":"plugin","slug":"magic-post-thumbnail","name":"Generate Images (AI) \u2013 Magic Post Thumbnail","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55c5c094-69c0-4e2a-be0c-fab6f1039309","source":"wordfence","cve":"CVE-2026-4785","title":"LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55c5c094-69c0-4e2a-be0c-fab6f1039309?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-04-07T15:17:40Z","updated":"2026-04-08T03:36:09Z"},{"id":"wordfence:55c631c6-4e7c-488c-968d-2e1afd11a75d","source":"wordfence","cve":"CVE-2024-51835","title":"OpenCart Product Display <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55c631c6-4e7c-488c-968d-2e1afd11a75d?source=api-prod","affected":[{"type":"plugin","slug":"opencart-product-display","name":"OpenCart Product Display","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:48:04Z"},{"id":"wordfence:55c9bc15-0e1a-450a-a6cd-8459ea37ffff","source":"wordfence","cve":"CVE-2025-46259","title":"The Plus Addons for Elementor Pro <= 6.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55c9bc15-0e1a-450a-a6cd-8459ea37ffff?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"6.3.7"}],"published":"2025-05-20T00:00:00Z","updated":"2025-07-07T15:00:58Z"},{"id":"wordfence:55cb2323-587c-449c-8c97-e5bfee4890bc","source":"wordfence","cve":"CVE-2026-62093","title":"TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55cb2323-587c-449c-8c97-e5bfee4890bc?source=api-prod","affected":[{"type":"theme","slug":"techone","name":"TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:23:12Z"},{"id":"wordfence:55cd02d1-7b06-427b-840b-3ced73ad4a74","source":"wordfence","cve":"CVE-2023-47854","title":"Parallax Image <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55cd02d1-7b06-427b-840b-3ced73ad4a74?source=api-prod","affected":[{"type":"plugin","slug":"parallax-image","name":"Parallax Image","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-11-20T00:00:00Z","updated":"2024-02-19T21:47:48Z"},{"id":"wordfence:55cfb2c6-ca3f-45b7-8cd9-a5a1c3783ae0","source":"wordfence","cve":"CVE-2026-0635","title":"Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55cfb2c6-ca3f-45b7-8cd9-a5a1c3783ae0?source=api-prod","affected":[{"type":"plugin","slug":"responsive-accordion-slider","name":"Responsive Accordion Slider","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:44:33Z","updated":"2026-01-14T05:28:09Z"},{"id":"wordfence:55d07502-ad2d-493d-acff-968d15c2810d","source":"wordfence","cve":"CVE-2025-66139","title":"Audier For Elementor <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55d07502-ad2d-493d-acff-968d15c2810d?source=api-prod","affected":[{"type":"plugin","slug":"audier-elementor","name":"Audio Player with Controls Builder for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:51:17Z"},{"id":"wordfence:55d842fc-a750-4b59-a1d6-b3bd427dfe79","source":"wordfence","cve":"CVE-2026-2021","title":"Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alwaysauto' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55d842fc-a750-4b59-a1d6-b3bd427dfe79?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2026-06-17T20:00:45Z","updated":"2026-06-18T08:31:47Z"},{"id":"wordfence:55db5fce-0deb-4d1b-a103-b312fb83fac9","source":"wordfence","cve":"CVE-2025-63022","title":"Simple Like Page <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55db5fce-0deb-4d1b-a103-b312fb83fac9?source=api-prod","affected":[{"type":"plugin","slug":"simple-facebook-plugin","name":"Simple Like Page \u2013 Fast & Privacy-Friendly Page Embeds","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:29:20Z"},{"id":"wordfence:55db7d81-7ffb-49da-b64e-23e892bddc57","source":"wordfence","cve":"CVE-2022-4707","title":"Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55db7d81-7ffb-49da-b64e-23e892bddc57?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55dfd822-9034-4982-bfe7-eb86119e1f07","source":"wordfence","cve":"CVE-2023-46628","title":"WP Word Count <= 3.2.4 - Missing Authorization via calculate_statistics","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55dfd822-9034-4982-bfe7-eb86119e1f07?source=api-prod","affected":[{"type":"plugin","slug":"wp-word-count","name":"WP Word Count","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55e0f0df-7be2-4e18-988c-2cc558768eff","source":"wordfence","cve":"CVE-2019-25213","title":"Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e0f0df-7be2-4e18-988c-2cc558768eff?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":false,"patched_in":"5.9.9"}],"published":"2019-09-09T00:00:00Z","updated":"2024-10-16T06:43:32Z"},{"id":"wordfence:55e43187-035f-4acc-932b-97577765ef6a","source":"wordfence","cve":"CVE-2026-39787","title":"10WebSocial <= 1.4.35 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e43187-035f-4acc-932b-97577765ef6a?source=api-prod","affected":[{"type":"plugin","slug":"wd-instagram-feed","name":"10WebSocial","from":"*","from_inclusive":true,"to":"1.4.35","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:50:04Z","updated":"2026-10-08T23:46:00Z"},{"id":"wordfence:55e4f798-85d6-4777-acdc-ac224c8f368d","source":"wordfence","cve":"CVE-2026-105258","title":"LatePoint <= 5.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e4f798-85d6-4777-acdc-ac224c8f368d?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.7.6"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:13:11Z"},{"id":"wordfence:55e4fa4e-46f7-4459-a232-c99e09a3f119","source":"wordfence","cve":"CVE-2026-110525","title":"MCB Stats <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e4fa4e-46f7-4459-a232-c99e09a3f119?source=api-prod","affected":[{"type":"plugin","slug":"mcb-stats","name":"MCB \u2013 Stats","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:13:45Z"},{"id":"wordfence:55e5b3e2-0a8c-4628-835e-249c9362a238","source":"wordfence","cve":"CVE-2026-57628","title":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e5b3e2-0a8c-4628-835e-249c9362a238?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:55:07Z"},{"id":"wordfence:55e6291d-4431-4eba-ad7d-fe96060ebcde","source":"wordfence","cve":"CVE-2026-96334","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e6291d-4431-4eba-ad7d-fe96060ebcde?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:47:03Z"},{"id":"wordfence:55e6a968-153e-4d4c-a7be-65650a0c9bc1","source":"wordfence","cve":"CVE-2023-27457","title":"Add Expires Headers & Optimized Minify <= 2.7 - Cross-Site Request Forgery via [placeholder]","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e6a968-153e-4d4c-a7be-65650a0c9bc1?source=api-prod","affected":[{"type":"plugin","slug":"add-expires-headers","name":"AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55e6eb58-79e2-4404-887a-0392ce7914aa","source":"wordfence","cve":"CVE-2024-4042","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55e6eb58-79e2-4404-887a-0392ce7914aa?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.80","to_inclusive":true,"patched_in":"2.2.81"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T05:33:46Z"},{"id":"wordfence:55ec5101-6494-4180-9492-03863e839ad2","source":"wordfence","cve":"CVE-2026-19952","title":"Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55ec5101-6494-4180-9492-03863e839ad2?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.12","to_inclusive":true,"patched_in":"3.29.13"}],"published":"2026-08-31T15:49:59Z","updated":"2026-09-01T04:27:50Z"},{"id":"wordfence:55ed6e73-4e9a-4201-91c2-0f7153ec1cb7","source":"wordfence","cve":"CVE-2022-3848","title":"WP User Merger <= 1.5.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55ed6e73-4e9a-4201-91c2-0f7153ec1cb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-merger","name":"WP User Merger","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55eeeb28-262e-49c5-a2b3-944345a9142d","source":"wordfence","cve":"CVE-2024-43952","title":"Esotera <= 1.2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55eeeb28-262e-49c5-a2b3-944345a9142d?source=api-prod","affected":[{"type":"theme","slug":"esotera","name":"Esotera","from":"*","from_inclusive":true,"to":"1.2.5.1","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-23T18:39:23Z"},{"id":"wordfence:55f25d72-c0aa-4dbf-bb3f-ba010f7f7e69","source":"wordfence","cve":"CVE-2026-24951","title":"myCred <= 2.9.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f25d72-c0aa-4dbf-bb3f-ba010f7f7e69?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.7.3","to_inclusive":true,"patched_in":"2.9.7.4"}],"published":"2026-02-06T00:00:00Z","updated":"2026-02-10T19:39:52Z"},{"id":"wordfence:55f4a1b5-2ff1-4abd-b89d-6a3aa921a24b","source":"wordfence","cve":"CVE-2025-0692","title":"Simple Video Management System <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f4a1b5-2ff1-4abd-b89d-6a3aa921a24b?source=api-prod","affected":[{"type":"plugin","slug":"simple-video-management-system","name":"Simple Video Management System","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T00:00:00Z","updated":"2025-02-26T20:33:21Z"},{"id":"wordfence:55f507c4-8589-4fdb-92c2-935d38054817","source":"wordfence","cve":"CVE-2017-13137","title":"FormCraft Basic 1.0.5 - SQL Injection via id Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f507c4-8589-4fdb-92c2-935d38054817?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"1.0.5","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2017-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55f6ad7b-279c-40b7-aae7-15c2b61042f4","source":"wordfence","cve":"CVE-2025-47612","title":"ClickWhale <= 2.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f6ad7b-279c-40b7-aae7-15c2b61042f4?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-21T13:39:16Z"},{"id":"wordfence:55f76629-1b59-415c-96c1-60c138070167","source":"wordfence","cve":"CVE-2026-84047","title":"Album Cover Finder <= 0.7.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f76629-1b59-415c-96c1-60c138070167?source=api-prod","affected":[{"type":"plugin","slug":"album-cover-finder","name":"Album Cover Finder","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:55:04Z"},{"id":"wordfence:55f7914f-9731-4b43-b2c0-b3474508e40a","source":"wordfence","cve":"CVE-2022-3831","title":"reCAPTCHA <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7914f-9731-4b43-b2c0-b3474508e40a?source=api-prod","affected":[{"type":"plugin","slug":"login-form-recaptcha","name":"reCAPTCHA","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55f7e39b-e7a5-462b-b1e4-c3d92038f17e","source":"wordfence","cve":"CVE-2022-4701","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55f866b3-2d33-4d92-ab4f-0cc0bee75b9b","source":"wordfence","cve":"CVE-2025-67919","title":"Woffice Core <= 5.4.30 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f866b3-2d33-4d92-ab4f-0cc0bee75b9b?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.30","to_inclusive":true,"patched_in":"5.4.31"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:32:35Z"},{"id":"wordfence:55f8d7e6-7bcd-4556-932b-7bf422db0b39","source":"wordfence","cve":"CVE-2024-0662","title":"FancyBox for WordPress 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f8d7e6-7bcd-4556-932b-7bf422db0b39?source=api-prod","affected":[{"type":"plugin","slug":"fancybox-for-wordpress","name":"FancyBox for WordPress","from":"3.0.2","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-07-29T21:36:23Z"},{"id":"wordfence:55f9bfd7-e77c-4072-a1de-36f3ac1ffb81","source":"wordfence","cve":"CVE-2026-84293","title":"Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55f9bfd7-e77c-4072-a1de-36f3ac1ffb81?source=api-prod","affected":[{"type":"plugin","slug":"repeater-for-gravity-forms","name":"Repeater Fields for Gravity Forms","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-09T03:28:47Z"},{"id":"wordfence:55fa8423-9a41-4afe-9401-03d232caa656","source":"wordfence","cve":"CVE-2024-13495","title":"GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55fa8423-9a41-4afe-9401-03d232caa656?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2025-01-21T22:27:55Z","updated":"2025-01-22T11:07:58Z"},{"id":"wordfence:55fac183-bd8d-4e16-b25a-784861897deb","source":"wordfence","cve":"","title":"Paid Memberships Pro - Courses for Membership Add On <= 1.2.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55fac183-bd8d-4e16-b25a-784861897deb?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-courses","name":"Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55fd13aa-aa30-4d5b-b344-6b5d065b64ce","source":"wordfence","cve":"CVE-2022-44590","title":"Simple Video Embedder <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55fd13aa-aa30-4d5b-b344-6b5d065b64ce?source=api-prod","affected":[{"type":"plugin","slug":"simple-video-embedder","name":"Simple Video Embedder","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:55fd9199-66ab-4a43-ba2e-bea1467bf744","source":"wordfence","cve":"CVE-2025-53283","title":"Drop Uploader for CF7 - Drag&Drop File Uploader Addon <= 2.4.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55fd9199-66ab-4a43-ba2e-bea1467bf744?source=api-prod","affected":[{"type":"plugin","slug":"drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon","name":"Drop Uploader for CF7 - Drag&Drop File Uploader Addon","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-11-12T13:35:37Z"},{"id":"wordfence:55fd9ca6-fe57-490d-bfde-492957035311","source":"wordfence","cve":"CVE-2024-43284","title":"WP Travel Gutenberg Blocks <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55fd9ca6-fe57-490d-bfde-492957035311?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-blocks","name":"WP Travel Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:20:27Z"},{"id":"wordfence:55ff923e-9d04-4ce7-b6d6-165fa4fc5433","source":"wordfence","cve":"CVE-2024-5663","title":"Cards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/55ff923e-9d04-4ce7-b6d6-165fa4fc5433?source=api-prod","affected":[{"type":"plugin","slug":"bb-bootstrap-cards","name":"Cards for Beaver Builder","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-06-07T14:01:49Z","updated":"2024-06-08T02:35:21Z"},{"id":"wordfence:56036bb2-3af3-4f69-ab79-78c5bb266231","source":"wordfence","cve":"CVE-2022-1425","title":"WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Private Message Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56036bb2-3af3-4f69-ab79-78c5bb266231?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:560548c7-8007-4e2c-bd34-78fcb7b43eb1","source":"wordfence","cve":"CVE-2025-22571","title":"Instabot <= 1.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/560548c7-8007-4e2c-bd34-78fcb7b43eb1?source=api-prod","affected":[{"type":"plugin","slug":"instabot","name":"Instabot: Chatbot to Increase Conversions on WordPress. Try for Free","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.11"}],"published":"2025-01-07T00:00:00Z","updated":"2026-02-06T17:33:00Z"},{"id":"wordfence:5607882d-9112-45f9-bee0-a0c077419187","source":"wordfence","cve":"CVE-2020-8498","title":"GistPress < 3.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5607882d-9112-45f9-bee0-a0c077419187?source=api-prod","affected":[{"type":"plugin","slug":"gistpress","name":"gistpress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2020-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5607a60e-a04a-4d28-bb04-bdacf8e97c56","source":"wordfence","cve":"CVE-2023-47872","title":"wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5607a60e-a04a-4d28-bb04-bdacf8e97c56?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5607cc07-5104-45d0-8279-ba0ef3ebcbe9","source":"wordfence","cve":"CVE-2023-45267","title":"IRivYou <= 2.2.1 - Cross-Site Request Forgery via saveOptionsReviewsPlugin","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5607cc07-5104-45d0-8279-ba0ef3ebcbe9?source=api-prod","affected":[{"type":"plugin","slug":"wooreviews-importer","name":"IRivYou \u2013 Import reviews from AliExpress and Amazon to woocommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5607fffa-341f-4237-b064-00fe2e6c9c9f","source":"wordfence","cve":"CVE-2015-4038","title":"WP Membership <= 1.2.3 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5607fffa-341f-4237-b064-00fe2e6c9c9f?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2015-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:560a3102-c274-450f-9119-ea47ee2e7c65","source":"wordfence","cve":"CVE-2026-11821","title":"Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/560a3102-c274-450f-9119-ea47ee2e7c65?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"4.1.18"}],"published":"2026-09-08T16:23:30Z","updated":"2026-09-09T04:28:34Z"},{"id":"wordfence:560b0c48-c509-4000-b187-9d5dbdb2299d","source":"wordfence","cve":"CVE-2026-9676","title":"f4 Post Tree <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Parent/Menu Order Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/560b0c48-c509-4000-b187-9d5dbdb2299d?source=api-prod","affected":[{"type":"plugin","slug":"f4-tree","name":"F4 Post Tree","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-21T14:00:47Z"},{"id":"wordfence:560b175b-ce2a-4161-aa6b-cd11d1377314","source":"wordfence","cve":"","title":"Satoshi <= 2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/560b175b-ce2a-4161-aa6b-cd11d1377314?source=api-prod","affected":[{"type":"theme","slug":"satoshi","name":"satoshi","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:560cd314-e442-4284-948f-e654445e0765","source":"wordfence","cve":"CVE-2024-32679","title":"Shared Files <= 1.7.16 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/560cd314-e442-4284-948f-e654445e0765?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T14:33:34Z"},{"id":"wordfence:56104b40-2d8a-40c9-8e80-01a093e54424","source":"wordfence","cve":"CVE-2025-50046","title":"WPComplete <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56104b40-2d8a-40c9-8e80-01a093e54424?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.5.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-27T17:24:26Z"},{"id":"wordfence:561361da-ea4b-44d0-be77-c622af11f5b4","source":"wordfence","cve":"CVE-2018-5310","title":"Media from FTP Plugin < 9.85 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561361da-ea4b-44d0-be77-c622af11f5b4?source=api-prod","affected":[{"type":"plugin","slug":"media-from-ftp","name":"Media from FTP","from":"*","from_inclusive":true,"to":"9.85","to_inclusive":false,"patched_in":"9.85"}],"published":"2018-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:561479ed-2402-4511-9344-d6b9e28f2f33","source":"wordfence","cve":"CVE-2026-6225","title":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561479ed-2402-4511-9344-d6b9e28f2f33?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2026-05-13T18:19:27Z","updated":"2026-05-14T06:44:11Z"},{"id":"wordfence:56161d67-7378-4349-8fe5-da73da36afa0","source":"wordfence","cve":"CVE-2024-5677","title":"Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56161d67-7378-4349-8fe5-da73da36afa0?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-generator","name":"Featured Image Generator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-07-09T13:52:47Z","updated":"2024-07-10T02:02:46Z"},{"id":"wordfence:5617f917-ecb5-4c64-b421-e4af14c17eb7","source":"wordfence","cve":"CVE-2024-53738","title":"Asset CleanUp: Page Speed Booster <= 1.3.9.8 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5617f917-ecb5-4c64-b421-e4af14c17eb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.9.8","to_inclusive":true,"patched_in":"1.3.9.9"}],"published":"2024-11-27T00:00:00Z","updated":"2024-12-12T19:07:36Z"},{"id":"wordfence:5618db77-fe74-4982-92b3-cec554640bde","source":"wordfence","cve":"CVE-2023-34001","title":"Hide My WP Ghost <= 5.0.25 - CAPTCHA Bypass in brute_math_authenticate","severity":"medium","cvss":5.3,"cwe":"CWE-807","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5618db77-fe74-4982-92b3-cec554640bde?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"5.0.26"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5618fdfc-636f-452b-80e1-5182b068d1c6","source":"wordfence","cve":"CVE-2024-5327","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5618fdfc-636f-452b-80e1-5182b068d1c6?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.19","to_inclusive":true,"patched_in":"2.7.20"}],"published":"2024-05-29T00:00:00Z","updated":"2024-05-30T06:48:09Z"},{"id":"wordfence:561a54ac-d827-4bf0-a458-9199c4e9c182","source":"wordfence","cve":"CVE-2026-16588","title":"WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561a54ac-d827-4bf0-a458-9199c4e9c182?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-09-15T15:22:00Z","updated":"2026-09-16T03:28:18Z"},{"id":"wordfence:561b2487-0d6a-4cc7-b41c-0e88f45d3038","source":"wordfence","cve":"CVE-2021-24935","title":"WP Google Fonts <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561b2487-0d6a-4cc7-b41c-0e88f45d3038?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-fonts","name":"WP Google Fonts","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:561c6906-1db0-49de-b291-b0eef4a62b98","source":"wordfence","cve":"CVE-2025-31736","title":"Rich Text Editor <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561c6906-1db0-49de-b291-b0eef4a62b98?source=api-prod","affected":[{"type":"plugin","slug":"richtexteditor","name":"Rich Text Editor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T15:15:13Z"},{"id":"wordfence:561c8bcf-30b0-4ee6-b507-4cacf22c1e58","source":"wordfence","cve":"CVE-2018-13136","title":"Ultimate Member <= 2.0.17 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561c8bcf-30b0-4ee6-b507-4cacf22c1e58?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2018-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:561ec1b2-ee26-4e0c-b437-d70b04be5b4c","source":"wordfence","cve":"CVE-2022-4534","title":"Limit Login Attempts (Spam Protection) <= 5.3 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561ec1b2-ee26-4e0c-b437-d70b04be5b4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-failed-login-attempts","name":"Limit Login Attempts (Spam Protection)","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T08:33:18Z"},{"id":"wordfence:561f171e-f13e-408b-a63e-bf6a512d4463","source":"wordfence","cve":"CVE-2025-11504","title":"Quickcreator \u2013 AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561f171e-f13e-408b-a63e-bf6a512d4463?source=api-prod","affected":[{"type":"plugin","slug":"quickcreator","name":"Quickcreator \u2013 AI Blog Writer","from":"0.0.9","from_inclusive":true,"to":"0.1.17","to_inclusive":true,"patched_in":"0.1.18"}],"published":"2025-10-23T19:38:35Z","updated":"2025-11-03T15:21:44Z"},{"id":"wordfence:561f4e7a-93ae-480a-accf-d80d6ec105ab","source":"wordfence","cve":"CVE-2026-105079","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561f4e7a-93ae-480a-accf-d80d6ec105ab?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.52","to_inclusive":true,"patched_in":"3.7.53"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:15Z"},{"id":"wordfence:561f9561-0aa2-490c-b0fa-8731dfb6a145","source":"wordfence","cve":"CVE-2025-69060","title":"uReach <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/561f9561-0aa2-490c-b0fa-8731dfb6a145?source=api-prod","affected":[{"type":"theme","slug":"ureach","name":"uReach | Immigration & Relocation Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:33:56Z"},{"id":"wordfence:56233337-ddde-4630-99b7-46a8e2be70af","source":"wordfence","cve":"CVE-2025-28953","title":"smart SEO <= 4.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56233337-ddde-4630-99b7-46a8e2be70af?source=api-prod","affected":[{"type":"theme","slug":"smartseo","name":"SmartSEO | SEO & Marketing HTML Theme","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2026-04-24T15:24:43Z"},{"id":"wordfence:562456ac-a113-4b3d-bc5d-6dedde635d5e","source":"wordfence","cve":"CVE-2025-12079","title":"WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562456ac-a113-4b3d-bc5d-6dedde635d5e?source=api-prod","affected":[{"type":"plugin","slug":"twitter-auto-publish","name":"WP Twitter Auto Publish","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-11-17T20:51:53Z","updated":"2025-12-09T17:11:17Z"},{"id":"wordfence:56259eda-db70-4a26-a08e-e4d998dbe50d","source":"wordfence","cve":"CVE-2011-3850","title":"Atahualpa < 3.6.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56259eda-db70-4a26-a08e-e4d998dbe50d?source=api-prod","affected":[{"type":"theme","slug":"atahualpa","name":"Atahualpa","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":false,"patched_in":"3.6.8"}],"published":"2011-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:562712a8-a42e-4b36-9985-3c71698efdda","source":"wordfence","cve":"CVE-2026-85200","title":"GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562712a8-a42e-4b36-9985-3c71698efdda?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5.3","to_inclusive":true,"patched_in":"4.5.5.4"}],"published":"2026-09-11T18:52:40Z","updated":"2026-09-12T07:39:14Z"},{"id":"wordfence:5628fb28-03fd-407d-874e-7801b17098f7","source":"wordfence","cve":"CVE-2022-1717","title":"Custom Share Buttons with Floating Sidebar <= 4.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5628fb28-03fd-407d-874e-7801b17098f7?source=api-prod","affected":[{"type":"plugin","slug":"custom-share-buttons-with-floating-sidebar","name":"Custom Share Buttons with Floating Sidebar","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5629d479-143d-4a03-ac64-cb304954a5ca","source":"wordfence","cve":"CVE-2022-0656","title":"Web To Print Shop : uDraw <= 3.3.3 - Unauthenticated Arbitrary File Access","severity":"high","cvss":7.4,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5629d479-143d-4a03-ac64-cb304954a5ca?source=api-prod","affected":[{"type":"plugin","slug":"udraw","name":"Web To Print Shop : uDraw","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:562d0052-7f1a-441b-9ff7-1c8bcb4b74b4","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.8.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562d0052-7f1a-441b-9ff7-1c8bcb4b74b4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.8.3"}],"published":"2020-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:562f058a-d4dc-4b59-b11e-d942f4c8de52","source":"wordfence","cve":"CVE-2025-23566","title":"Custom Post <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562f058a-d4dc-4b59-b11e-d942f4c8de52?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-gui","name":"Custom Post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:53:12Z"},{"id":"wordfence:562f194f-1f32-4de4-8074-84580f653bdb","source":"wordfence","cve":"CVE-2026-1899","title":"Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562f194f-1f32-4de4-8074-84580f653bdb?source=api-prod","affected":[{"type":"plugin","slug":"any-post-slider","name":"Any Post Slider","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-03-20T15:13:13Z","updated":"2026-07-08T17:47:06Z"},{"id":"wordfence:562fe11f-36a0-4f23-9eed-50ada7ab2961","source":"wordfence","cve":"CVE-2023-5134","title":"Easy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/562fe11f-36a0-4f23-9eed-50ada7ab2961?source=api-prod","affected":[{"type":"plugin","slug":"easy-registration-forms","name":"Easy Registration Forms","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56340319-c436-4ee0-9931-1b56b84bcbfc","source":"wordfence","cve":"CVE-2026-102384","title":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder <= 2.5.63 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56340319-c436-4ee0-9931-1b56b84bcbfc?source=api-prod","affected":[{"type":"plugin","slug":"supreme-modules-for-divi","name":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder","from":"*","from_inclusive":true,"to":"2.5.63","to_inclusive":true,"patched_in":"2.5.64"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:42:02Z"},{"id":"wordfence:56382dd8-7f02-4544-a530-31c012407ab7","source":"wordfence","cve":"CVE-2014-8491","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 4.25 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56382dd8-7f02-4544-a530-31c012407ab7?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"4.25","to_inclusive":false,"patched_in":"4.25"}],"published":"2014-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56399c7b-7bf7-455a-8e11-77b4e3e104a3","source":"wordfence","cve":"CVE-2024-51889","title":"Fancy User List <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56399c7b-7bf7-455a-8e11-77b4e3e104a3?source=api-prod","affected":[{"type":"plugin","slug":"fancy-user-listing","name":"Fancy User List","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:24:30Z"},{"id":"wordfence:563b1b9e-260d-4cbc-9479-ad42bcef5012","source":"wordfence","cve":"CVE-2025-68987","title":"Cinerama - A WordPress Theme for Movie Studios and Filmmakers <= 2.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/563b1b9e-260d-4cbc-9479-ad42bcef5012?source=api-prod","affected":[{"type":"theme","slug":"cinerama","name":"Cinerama - A WordPress Theme for Movie Studios and Filmmakers","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-06T15:19:52Z"},{"id":"wordfence:563d01c1-dead-4d1a-9f4a-39351b8e94cb","source":"wordfence","cve":"CVE-2024-32509","title":"WP Cost Estimation & Payment Forms Builder <= 10.1.76 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/563d01c1-dead-4d1a-9f4a-39351b8e94cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"10.1.76","to_inclusive":true,"patched_in":"10.1.77"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T12:54:27Z"},{"id":"wordfence:563d44cd-5f5a-4914-8312-c554085b0821","source":"wordfence","cve":"CVE-2024-3991","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +12 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/563d44cd-5f5a-4914-8312-c554085b0821?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-02T16:52:08Z"},{"id":"wordfence:563f559e-528a-4d6b-98be-a3c2f45fee53","source":"wordfence","cve":"CVE-2024-10482","title":"Media Library Tools <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/563f559e-528a-4d6b-98be-a3c2f45fee53?source=api-prod","affected":[{"type":"plugin","slug":"media-library-tools","name":"Media Library Tools \u2013 AI-Powered Rename, Clean & CSV Import/Export","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-04T22:02:45Z"},{"id":"wordfence:563f7d55-1df0-4bdc-b9be-5e564241bcf6","source":"wordfence","cve":"CVE-2022-36418","title":"HREFLANG Tags Lite <= 2.0.0 - Missing Authorization to Data Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/563f7d55-1df0-4bdc-b9be-5e564241bcf6?source=api-prod","affected":[{"type":"plugin","slug":"hreflang-tags-by-dcgws","name":"HREFLANG Tags Lite","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56405a91-259c-4700-bbc1-ffe0d77f3974","source":"wordfence","cve":"CVE-2015-9477","title":"Vernissage <= 1.2.9 - Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56405a91-259c-4700-bbc1-ffe0d77f3974?source=api-prod","affected":[{"type":"theme","slug":"vernissage","name":"Vernissage - Photography WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3"}],"published":"2015-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5641ad8f-3c33-4699-8c2b-7fa4451703a6","source":"wordfence","cve":"CVE-2026-85133","title":"WPLP Cookie Consent <= 4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5641ad8f-3c33-4699-8c2b-7fa4451703a6?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:21:52Z"},{"id":"wordfence:56439ae3-bdbc-4c57-abf4-8c94dea8c6f5","source":"wordfence","cve":"CVE-2022-33970","title":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension <= 3.1.2 - Authenticated Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56439ae3-bdbc-4c57-abf4-8c94dea8c6f5?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-addons","name":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2022-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56465338-f9be-49c5-8125-c6729287d590","source":"wordfence","cve":"CVE-2024-43160","title":"BerqWP <= 1.7.6 - Unauthenticated Arbitrary File Uplaod","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56465338-f9be-49c5-8125-c6729287d590?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:27:13Z"},{"id":"wordfence:5646eb5b-caf0-413c-a1a8-f0c6a5fa5114","source":"wordfence","cve":"CVE-2017-18525","title":"Max Mega Menu <= 2.3.8 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5646eb5b-caf0-413c-a1a8-f0c6a5fa5114?source=api-prod","affected":[{"type":"plugin","slug":"megamenu","name":"Max Mega Menu","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.4"}],"published":"2017-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5648fc33-3284-4f71-bc2b-6e72237b2ca1","source":"wordfence","cve":"CVE-2024-52355","title":"OSM \u2013 OpenStreetMap <= 6.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5648fc33-3284-4f71-bc2b-6e72237b2ca1?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:50:13Z"},{"id":"wordfence:564a1631-fe33-40f6-a0eb-37868be07171","source":"wordfence","cve":"CVE-2017-18498","title":"Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/564a1631-fe33-40f6-a0eb-37868be07171?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2017-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:564b8271-ba1a-4bf1-b072-7dadadb02ccf","source":"wordfence","cve":"CVE-2026-28168","title":"CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/564b8271-ba1a-4bf1-b072-7dadadb02ccf?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:05:52Z"},{"id":"wordfence:564ec4a6-20d3-4b46-8637-fc1de586e19a","source":"wordfence","cve":"CVE-2026-7648","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/564ec4a6-20d3-4b46-8637-fc1de586e19a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-05-13T15:21:13Z","updated":"2026-05-14T03:27:14Z"},{"id":"wordfence:564eeb3a-13e6-426d-a346-e2d85e88846c","source":"wordfence","cve":"CVE-2026-121536","title":"WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/564eeb3a-13e6-426d-a346-e2d85e88846c?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.90","to_inclusive":true,"patched_in":"5.5.91"}],"published":"2026-11-06T18:26:48Z","updated":"2026-11-07T06:39:37Z"},{"id":"wordfence:5652224e-348f-4e71-b2b1-0bca9846f949","source":"wordfence","cve":"CVE-2026-32379","title":"Rara Academic <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5652224e-348f-4e71-b2b1-0bca9846f949?source=api-prod","affected":[{"type":"theme","slug":"rara-academic","name":"Rara Academic","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:54:02Z"},{"id":"wordfence:5652587e-280b-4bdf-b096-e09fe0194658","source":"wordfence","cve":"CVE-2022-4661","title":"Woo Products Widgets For Elementor <= 1.0.7 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5652587e-280b-4bdf-b096-e09fe0194658?source=api-prod","affected":[{"type":"plugin","slug":"woo-products-widgets-for-elementor","name":"Widgets for WooCommerce Products on Elementor","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56527389-37f9-485f-876d-b31ae3b45f75","source":"wordfence","cve":"CVE-2025-27352","title":"\u65e0\u89c5\u76f8\u5173\u6587\u7ae0\u63d2\u4ef6 <= 1.0.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56527389-37f9-485f-876d-b31ae3b45f75?source=api-prod","affected":[{"type":"plugin","slug":"wumii-related-posts","name":"\u65e0\u89c5\u76f8\u5173\u6587\u7ae0\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.0.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:45:47Z"},{"id":"wordfence:5652f148-5247-4b15-bd86-653267d95fbf","source":"wordfence","cve":"CVE-2024-43347","title":"Button contact VR <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5652f148-5247-4b15-bd86-653267d95fbf?source=api-prod","affected":[{"type":"plugin","slug":"button-contact-vr","name":"Buttonizer \u2013 Live Chat, AI Chatbot, Call, Chat, Contact Button","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-04T21:30:47Z"},{"id":"wordfence:5652f9c3-3cc9-4541-8209-40117b4d25d9","source":"wordfence","cve":"CVE-2024-2112","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure","severity":"medium","cvss":5.9,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5652f9c3-3cc9-4541-8209-40117b4d25d9?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.22","to_inclusive":true,"patched_in":"1.15.23"}],"published":"2024-03-22T00:00:00Z","updated":"2024-07-31T15:47:38Z"},{"id":"wordfence:5653a87e-bcbb-4516-b936-7e659a396a56","source":"wordfence","cve":"CVE-2024-43325","title":"Dark Mode for WP Dashboard <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5653a87e-bcbb-4516-b936-7e659a396a56?source=api-prod","affected":[{"type":"plugin","slug":"dark-mode-for-wp-dashboard","name":"Dark Mode for WP Dashboard","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:18:09Z"},{"id":"wordfence:5653f1aa-06da-4208-afa2-19ef31b8be2f","source":"wordfence","cve":"","title":"Google Language Translator <= 6.0.9 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5653f1aa-06da-4208-afa2-19ef31b8be2f?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.10","to_inclusive":false,"patched_in":"6.0.10"}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56551a19-b89b-402d-bb77-994198b6f03e","source":"wordfence","cve":"CVE-2026-57621","title":"Booktics <= 1.0.21 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56551a19-b89b-402d-bb77-994198b6f03e?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-10T19:25:13Z"},{"id":"wordfence:5655b657-fa77-44ab-843d-972c834d8a77","source":"wordfence","cve":"CVE-2026-40807","title":"CF7 Views \u2013 Complete Entry Management for Contact Form 7 <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5655b657-fa77-44ab-843d-972c834d8a77?source=api-prod","affected":[{"type":"plugin","slug":"cf7-views","name":"CF7 Views \u2013 Complete Entry Management for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:31:16Z","updated":"2026-10-08T23:32:49Z"},{"id":"wordfence:5655d60b-cfd6-40b3-ad64-81db4c54ab3f","source":"wordfence","cve":"CVE-2026-8981","title":"Custom Block Builder \u2013 Lazy Blocks < 4.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5655d60b-cfd6-40b3-ad64-81db4c54ab3f?source=api-prod","affected":[{"type":"plugin","slug":"lazy-blocks","name":"Custom Block Builder \u2013 Lazy Blocks","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:35:39Z"},{"id":"wordfence:5657ffe2-7d04-4834-bcec-ab6afaeda7df","source":"wordfence","cve":"CVE-2023-41649","title":"Ovic Product Bundle <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5657ffe2-7d04-4834-bcec-ab6afaeda7df?source=api-prod","affected":[{"type":"plugin","slug":"ovic-product-bundle","name":"Ovic Product Bundle","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56583dca-bd63-466d-a16a-be7b19b2487e","source":"wordfence","cve":"CVE-2025-24754","title":"Houzez <= 3.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56583dca-bd63-466d-a16a-be7b19b2487e?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:30:25Z"},{"id":"wordfence:5658c9a8-55a0-4e18-8231-e3c5dfb01be4","source":"wordfence","cve":"CVE-2025-48288","title":"ElementInvader Addons for Elementor <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5658c9a8-55a0-4e18-8231-e3c5dfb01be4?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:46:09Z"},{"id":"wordfence:5658f62b-2f4a-46f7-b229-8e239c7ef148","source":"wordfence","cve":"","title":"Tree Sitemap (Pages, Posts & Categories list) <= 2.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5658f62b-2f4a-46f7-b229-8e239c7ef148?source=api-prod","affected":[{"type":"plugin","slug":"tree-website-map","name":"Tree Sitemap (Pages, Posts & Categories list)","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.1"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:565980d7-8dc9-42a4-90c5-2f75af52fb8e","source":"wordfence","cve":"CVE-2026-17567","title":"Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/565980d7-8dc9-42a4-90c5-2f75af52fb8e?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.8","to_inclusive":true,"patched_in":"6.2.9"}],"published":"2026-07-30T21:02:53Z","updated":"2026-07-31T09:32:01Z"},{"id":"wordfence:5659af1d-f248-46ff-b282-ef5397222d8d","source":"wordfence","cve":"CVE-2025-13887","title":"AI BotKit <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5659af1d-f248-46ff-b282-ef5397222d8d?source=api-prod","affected":[{"type":"plugin","slug":"ai-botkit-for-lead-generation","name":"AI ChatBot for WordPress by AI BotKit \u2013 Live in 2 Minutes, No Code","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-01-06T20:31:21Z","updated":"2026-01-13T17:13:47Z"},{"id":"wordfence:565b4026-0807-449d-a78e-798da53c3f52","source":"wordfence","cve":"CVE-2022-3357","title":"Smart Slider 3 <= 3.5.1.9 - PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/565b4026-0807-449d-a78e-798da53c3f52?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.9","to_inclusive":true,"patched_in":"3.5.1.11"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:565d3b4c-d810-41d5-b1ac-ec3363bcd6f3","source":"wordfence","cve":"CVE-2025-58193","title":"Uncanny Automator <= 6.7.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/565d3b4c-d810-41d5-b1ac-ec3363bcd6f3?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.7.0.1","to_inclusive":true,"patched_in":"6.8.0"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:32:08Z"},{"id":"wordfence:5666da4a-ffb6-47ed-8b48-a80f09dd2501","source":"wordfence","cve":"CVE-2024-3929","title":"Content Views \u2013 Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5666da4a-ffb6-47ed-8b48-a80f09dd2501?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T07:33:59Z"},{"id":"wordfence:5666e2b7-acb3-4abb-ac2a-1575206435cf","source":"wordfence","cve":"CVE-2025-1455","title":"Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5666e2b7-acb3-4abb-ac2a-1575206435cf?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1012","to_inclusive":true,"patched_in":"1.7.1013"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T08:22:40Z"},{"id":"wordfence:566935a5-b296-49cc-8df0-1850f8680caa","source":"wordfence","cve":"CVE-2025-68890","title":"e-shops <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/566935a5-b296-49cc-8df0-1850f8680caa?source=api-prod","affected":[{"type":"plugin","slug":"e-shops-cart2","name":"e-shops\u30ab\u30fc\u30c82","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-13T17:36:45Z"},{"id":"wordfence:566b8fd0-4034-4eb5-b344-a4f45aa08ba4","source":"wordfence","cve":"CVE-2026-11568","title":"Product Configurator for WooCommerce <= 1.7.2 - Unauthenticated Private/Draft Product Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/566b8fd0-4034-4eb5-b344-a4f45aa08ba4?source=api-prod","affected":[{"type":"plugin","slug":"product-configurator-for-woocommerce","name":"MKL Product Configurator for WooCommerce \u2013 2D & 3D Live Preview","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-06-10T00:00:00Z","updated":"2026-08-21T13:40:03Z"},{"id":"wordfence:566be246-1722-44c0-aa18-bcf9d2a7ddc6","source":"wordfence","cve":"CVE-2026-6237","title":"Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/566be246-1722-44c0-aa18-bcf9d2a7ddc6?source=api-prod","affected":[{"type":"plugin","slug":"quick-table","name":"Quick Table","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:02:10Z","updated":"2026-05-12T07:48:21Z"},{"id":"wordfence:566f19d0-f0b6-47f4-b09a-3c9613ea8057","source":"wordfence","cve":"CVE-2025-23859","title":"Daily Proverb <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/566f19d0-f0b6-47f4-b09a-3c9613ea8057?source=api-prod","affected":[{"type":"plugin","slug":"daily-proverb","name":"Daily Proverb","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:12:15Z"},{"id":"wordfence:566f542e-b15d-421f-a004-814f8c8cc846","source":"wordfence","cve":"CVE-2026-14565","title":"Advanced Customized Prompts <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/566f542e-b15d-421f-a004-814f8c8cc846?source=api-prod","affected":[{"type":"plugin","slug":"advanced-customized-prompts","name":"Advanced Customized Prompts","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:20:28Z"},{"id":"wordfence:5671d318-ca8c-4882-a522-f327e65a24f0","source":"wordfence","cve":"CVE-2024-49628","title":"Most And Least Read Posts Widget <= 2.5.18 - Cross-Site Request Forgery via most_and_least_read_posts_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5671d318-ca8c-4882-a522-f327e65a24f0?source=api-prod","affected":[{"type":"plugin","slug":"most-and-least-read-posts-widget","name":"Most And Least Read Posts Widget","from":"*","from_inclusive":true,"to":"2.5.18","to_inclusive":true,"patched_in":"2.5.19"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T14:54:59Z"},{"id":"wordfence:56730afc-aa1e-4e97-b74e-9b5d3f78c677","source":"wordfence","cve":"CVE-2025-27341","title":"Reactive Mortgage Calculator <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56730afc-aa1e-4e97-b74e-9b5d3f78c677?source=api-prod","affected":[{"type":"plugin","slug":"reactive-mortgage-calculator","name":"Reactive Mortgage Calculator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:15:15Z"},{"id":"wordfence:5673f2b9-1c30-4ce0-8a8c-7580d0346cb9","source":"wordfence","cve":"CVE-2026-96270","title":"Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5673f2b9-1c30-4ce0-8a8c-7580d0346cb9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-02T13:35:33Z","updated":"2026-10-03T02:25:35Z"},{"id":"wordfence:56758c67-5df2-4e28-8095-a73151f9cb8c","source":"wordfence","cve":"CVE-2025-49259","title":"Hara <= 1.2.10 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56758c67-5df2-4e28-8095-a73151f9cb8c?source=api-prod","affected":[{"type":"theme","slug":"hara","name":"Hara - Beauty and Cosmetics Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:20:47Z"},{"id":"wordfence:567782f9-a050-4e68-9491-e038d7e383f5","source":"wordfence","cve":"CVE-2014-9260","title":"WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/567782f9-a050-4e68-9491-e038d7e383f5?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":false,"patched_in":"2.7.3"}],"published":"2014-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5678794d-244f-45d1-9049-fea01ba45989","source":"wordfence","cve":"CVE-2024-38765","title":"Oceanic <= 1.0.53 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5678794d-244f-45d1-9049-fea01ba45989?source=api-prod","affected":[{"type":"theme","slug":"oceanic","name":"Oceanic","from":"*","from_inclusive":true,"to":"1.0.53","to_inclusive":true,"patched_in":""}],"published":"2024-07-12T00:00:00Z","updated":"2024-11-15T15:26:35Z"},{"id":"wordfence:567ae087-ee60-4530-92f2-4b90340717f9","source":"wordfence","cve":"CVE-2025-54686","title":"Exertio <= 1.3.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/567ae087-ee60-4530-92f2-4b90340717f9?source=api-prod","affected":[{"type":"theme","slug":"exertio","name":"Exertio - Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:25:16Z"},{"id":"wordfence:567c4487-32e3-4afd-aec7-2f8171a49ebc","source":"wordfence","cve":"CVE-2022-47442","title":"UsersWP <= 1.2.3.9 - Authenticated (Administrator+) CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/567c4487-32e3-4afd-aec7-2f8171a49ebc?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.3.9","to_inclusive":true,"patched_in":"1.2.3.10"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:567d62ec-e868-45e2-b07a-8cc661d7c5e1","source":"wordfence","cve":"CVE-2024-0665","title":"WP Customer Area <= 8.2.2 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/567d62ec-e868-45e2-b07a-8cc661d7c5e1?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.2.2","to_inclusive":true,"patched_in":"8.2.3"}],"published":"2024-01-23T00:00:00Z","updated":"2024-07-29T21:36:23Z"},{"id":"wordfence:567fc4d3-622a-4b6a-b17a-3de91798b590","source":"wordfence","cve":"CVE-2025-39398","title":"Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue <= 4.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/567fc4d3-622a-4b6a-b17a-3de91798b590?source=api-prod","affected":[{"type":"theme","slug":"bellevuex","name":"bellevuex","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:25:27Z"},{"id":"wordfence:56808590-0226-4968-ba64-0965793a3511","source":"wordfence","cve":"CVE-2024-39624","title":"ListingPro <= 2.9.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56808590-0226-4968-ba64-0965793a3511?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2026-02-26T15:16:19Z"},{"id":"wordfence:5681101f-13c3-4fde-bbde-554810bcbe4e","source":"wordfence","cve":"","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5681101f-13c3-4fde-bbde-554810bcbe4e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2022-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56822fe5-352c-4269-9fab-d8c796362b74","source":"wordfence","cve":"CVE-2025-5144","title":"The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56822fe5-352c-4269-9fab-d8c796362b74?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.13.2","to_inclusive":true,"patched_in":"6.13.2.1"}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-11T12:22:55Z"},{"id":"wordfence:568254a4-400d-45ea-8a96-1669b0694d70","source":"wordfence","cve":"CVE-2025-11451","title":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/568254a4-400d-45ea-8a96-1669b0694d70?source=api-prod","affected":[{"type":"plugin","slug":"amazon-auto-links","name":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:23:41Z","updated":"2025-11-11T03:30:39Z"},{"id":"wordfence:5683f121-a670-4b16-ac0f-c2cc569c05d4","source":"wordfence","cve":"CVE-2025-60068","title":"Javo Core <= 3.0.0.266 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5683f121-a670-4b16-ac0f-c2cc569c05d4?source=api-prod","affected":[{"type":"plugin","slug":"javo-core","name":"Javo Core","from":"*","from_inclusive":true,"to":"3.0.0.266","to_inclusive":true,"patched_in":""}],"published":"2025-08-03T00:00:00Z","updated":"2025-12-20T21:16:58Z"},{"id":"wordfence:5684366b-f09c-4710-a43e-ff451d88b0e1","source":"wordfence","cve":"CVE-2017-20056","title":"User Login Log <= 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5684366b-f09c-4710-a43e-ff451d88b0e1?source=api-prod","affected":[{"type":"plugin","slug":"user-login-log","name":"User Login Log","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5684d4b7-8a3e-47ee-9d7b-195cb5db9a66","source":"wordfence","cve":"CVE-2023-48780","title":"WP Catalogue <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5684d4b7-8a3e-47ee-9d7b-195cb5db9a66?source=api-prod","affected":[{"type":"plugin","slug":"wp-catalogue","name":"WP Catalogue","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:568545a4-7f73-4050-9724-d47279c340c9","source":"wordfence","cve":"CVE-2022-46851","title":"Starter Templates \u2014 Elementor, WordPress & Beaver Builder Templates <= 3.1.20 - Cross-Site Request Forgery in add_to_favorite","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/568545a4-7f73-4050-9724-d47279c340c9?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"3.1.20","to_inclusive":true,"patched_in":"3.2.21"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5686bc0f-efe7-4268-a6e1-bec939504ab4","source":"wordfence","cve":"CVE-2019-12345","title":"Hostel <= 1.1.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5686bc0f-efe7-4268-a6e1-bec939504ab4?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2019-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56887118-33e2-4eef-9364-930ca81bd59f","source":"wordfence","cve":"CVE-2025-49971","title":"eDS Responsive Menu <= 1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56887118-33e2-4eef-9364-930ca81bd59f?source=api-prod","affected":[{"type":"plugin","slug":"eds-responsive-menu","name":"eDS Responsive Menu","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:51:54Z"},{"id":"wordfence:5689bd2b-1518-4b3b-81a3-cc92575f6c1f","source":"wordfence","cve":"CVE-2026-1215","title":"MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5689bd2b-1518-4b3b-81a3-cc92575f6c1f?source=api-prod","affected":[{"type":"plugin","slug":"mma-call-tracking","name":"MMA Call Tracking","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:08:57Z","updated":"2026-02-11T08:26:27Z"},{"id":"wordfence:568aa6d6-10a1-4653-ab95-845faf005b8e","source":"wordfence","cve":"CVE-2024-13835","title":"Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/568aa6d6-10a1-4653-ab95-845faf005b8e?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T14:16:01Z","updated":"2026-02-25T14:28:49Z"},{"id":"wordfence:568d9b75-3ac9-47eb-b958-4f1781a6edc4","source":"wordfence","cve":"CVE-2015-10095","title":"woo-popup <= 1.2.2 - Reflecte Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/568d9b75-3ac9-47eb-b958-4f1781a6edc4?source=api-prod","affected":[{"type":"plugin","slug":"woo-popup","name":"woo-popup","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2015-05-21T00:00:00Z","updated":"2024-02-07T14:15:26Z"},{"id":"wordfence:568faf41-72ac-4334-a960-a2ce790407ff","source":"wordfence","cve":"CVE-2024-10563","title":"WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/568faf41-72ac-4334-a960-a2ce790407ff?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-count-shortcode","name":"WooCommerce Cart Count Shortcode","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-02-05T00:00:00Z","updated":"2025-02-12T20:43:14Z"},{"id":"wordfence:56953c6f-7ff9-45bf-9265-01240938e395","source":"wordfence","cve":"","title":"WooCommerce < 2.4.9 - Cross-site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56953c6f-7ff9-45bf-9265-01240938e395?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":false,"patched_in":"2.4.9"}],"published":"2015-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56963053-211a-43a4-ba2b-2f4d18416435","source":"wordfence","cve":"CVE-2025-62106","title":"WP-CRM System <= 3.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56963053-211a-43a4-ba2b-2f4d18416435?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2025-11-04T00:00:00Z","updated":"2026-04-15T20:56:38Z"},{"id":"wordfence:56976e5f-13e9-45e3-8cd1-7ac5f34f4248","source":"wordfence","cve":"CVE-2023-25038","title":"For the visually impaired <= 0.58 - Cross-Site Request Forgery to Plugin Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56976e5f-13e9-45e3-8cd1-7ac5f34f4248?source=api-prod","affected":[{"type":"plugin","slug":"for-the-visually-impaired","name":"For the visually impaired","from":"*","from_inclusive":true,"to":"0.58","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:569816e6-c561-4de1-a5bc-3d020aab88ee","source":"wordfence","cve":"CVE-2025-2279","title":"Maps \u2013 Google Maps <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569816e6-c561-4de1-a5bc-3d020aab88ee?source=api-prod","affected":[{"type":"plugin","slug":"robo-maps","name":"Maps \u2013 Google Maps","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T00:00:00Z","updated":"2025-04-21T15:42:59Z"},{"id":"wordfence:569a19dd-9d56-4518-b271-123346506348","source":"wordfence","cve":"CVE-2024-54425","title":"LionScripts: Site Maintenance & Noindex Nofollow Plugin <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569a19dd-9d56-4518-b271-123346506348?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-and-noindex-nofollow","name":"LionScripts: Site Maintenance & Noindex Nofollow Plugin","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:01:54Z"},{"id":"wordfence:569b5522-8f38-454b-a8b5-12e3959c3348","source":"wordfence","cve":"CVE-2024-30467","title":"Essential Blocks for Gutenberg <= 4.4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569b5522-8f38-454b-a8b5-12e3959c3348?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.4.10"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:07:57Z"},{"id":"wordfence:569c8faf-bd2a-4c61-a8c7-d4cab36e5727","source":"wordfence","cve":"","title":"Ready! Coming Soon <= 0.5.0 Stored Cross-Site Scripting and Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569c8faf-bd2a-4c61-a8c7-d4cab36e5727?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode-ready","name":"Ready! Coming Soon","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":false,"patched_in":"0.5.1"}],"published":"2014-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:569d6496-0ad5-4e09-9f3d-b8d3a3121cdf","source":"wordfence","cve":"CVE-2026-16068","title":"Brizy - Page Builder <= 2.8.18 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569d6496-0ad5-4e09-9f3d-b8d3a3121cdf?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:36:16Z"},{"id":"wordfence:569f1cd4-195b-41d4-85cb-f529a1eb18d4","source":"wordfence","cve":"CVE-2024-13671","title":"Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569f1cd4-195b-41d4-85cb-f529a1eb18d4?source=api-prod","affected":[{"type":"plugin","slug":"music-sheet-viewer","name":"Music Sheet Viewer","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:43:27Z","updated":"2025-02-12T15:00:28Z"},{"id":"wordfence:569f2250-971a-4000-9114-67e609ec907d","source":"wordfence","cve":"CVE-2024-11841","title":"Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/569f2250-971a-4000-9114-67e609ec907d?source=api-prod","affected":[{"type":"plugin","slug":"wp-tithely","name":"Tithe.ly Giving Button","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-09T00:00:00Z","updated":"2024-12-12T14:05:07Z"},{"id":"wordfence:56a06949-be02-439d-90ba-77803e7b76ae","source":"wordfence","cve":"CVE-2025-24645","title":"Eazy Under Construction <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a06949-be02-439d-90ba-77803e7b76ae?source=api-prod","affected":[{"type":"plugin","slug":"eazy-under-construction","name":"Eazy Under Construction","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-01-14T00:00:00Z","updated":"2025-04-22T21:51:42Z"},{"id":"wordfence:56a070d9-64bb-49d3-bb8f-071719ae8d10","source":"wordfence","cve":"CVE-2026-87974","title":"Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a070d9-64bb-49d3-bb8f-071719ae8d10?source=api-prod","affected":[{"type":"plugin","slug":"woo-asaas","name":"Asaas Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:03:21Z"},{"id":"wordfence:56a1219c-1163-4867-b426-7ffe9ca5dcb5","source":"wordfence","cve":"CVE-2026-76124","title":"BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a1219c-1163-4867-b426-7ffe9ca5dcb5?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-app","name":"BuddyBoss App","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-03T12:31:54Z"},{"id":"wordfence:56a2084c-5120-4115-a027-625900d23ebc","source":"wordfence","cve":"CVE-2022-47166","title":"Void Contact Form 7 Widget For Elementor Page Builder <= 2.1.1 - Cross-Site Request Forgery in void_cf7_opt_in_user_data_track","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a2084c-5120-4115-a027-625900d23ebc?source=api-prod","affected":[{"type":"plugin","slug":"cf7-widget-elementor","name":"Void Contact Form 7 Widget For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56a362f3-dc4e-454d-9d94-9f4cb540d4b5","source":"wordfence","cve":"CVE-2021-39354","title":"Easy Digital Downloads <= 2.11.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a362f3-dc4e-454d-9d94-9f4cb540d4b5?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":true,"patched_in":"2.11.2.1"}],"published":"2021-10-21T16:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56a68cad-2abf-4b22-ae05-243e8901a9d8","source":"wordfence","cve":"CVE-2026-32541","title":"Premmerce Redirect Manager <= 1.0.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a68cad-2abf-4b22-ae05-243e8901a9d8?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-redirect-manager","name":"Premmerce Redirect Manager","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:24:58Z"},{"id":"wordfence:56a7d55a-e581-4e36-b795-084e26f3e766","source":"wordfence","cve":"CVE-2025-58790","title":"Kiwi <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a7d55a-e581-4e36-b795-084e26f3e766?source=api-prod","affected":[{"type":"plugin","slug":"kiwi-social-share","name":"Social Sharing Plugin \u2013 Kiwi","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:24:51Z"},{"id":"wordfence:56a90042-a6c0-4487-811b-ced23c97f9f4","source":"wordfence","cve":"CVE-2023-1928","title":"WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a90042-a6c0-4487-811b-ced23c97f9f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56a93247-f0b5-4801-a759-ef9af11273d7","source":"wordfence","cve":"CVE-2026-49781","title":"OttoKit: All-in-One Automation Platform <= 1.1.27 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56a93247-f0b5-4801-a759-ef9af11273d7?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:46:15Z"},{"id":"wordfence:56ab6429-4b1b-461a-9fcd-b4be84985118","source":"wordfence","cve":"CVE-2025-6626","title":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2025-08-01T00:00:00Z","updated":"2025-08-02T07:24:21Z"},{"id":"wordfence:56abcad2-5be0-422c-a33f-91bc123364e5","source":"wordfence","cve":"","title":"eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56abcad2-5be0-422c-a33f-91bc123364e5?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.71","to_inclusive":true,"patched_in":"3.0.72"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56ac720a-db1e-4aca-b12c-5289fa7b8b9e","source":"wordfence","cve":"CVE-2024-13644","title":"DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ac720a-db1e-4aca-b12c-5289fa7b8b9e?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T01:44:53Z"},{"id":"wordfence:56acae44-6f22-440c-bee1-4cd3831a99ec","source":"wordfence","cve":"CVE-2017-18520","title":"Democracy Poll < 5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56acae44-6f22-440c-bee1-4cd3831a99ec?source=api-prod","affected":[{"type":"plugin","slug":"democracy-poll","name":"Democracy Poll","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":false,"patched_in":"5.4"}],"published":"2017-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56b16f10-2f48-49db-85f6-f934bc267110","source":"wordfence","cve":"CVE-2017-18569","title":"My WP Translate <= 1.0.3 - Unprotected AJAX Actions","severity":"high","cvss":8.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b16f10-2f48-49db-85f6-f934bc267110?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-translate","name":"My WP Translate","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2017-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56b3d629-014c-47b3-9726-4086e544011b","source":"wordfence","cve":"CVE-2023-45835","title":"Libsyn Publisher Hub <= 1.4.4 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b3d629-014c-47b3-9726-4086e544011b?source=api-prod","affected":[{"type":"plugin","slug":"libsyn-podcasting","name":"Libsyn Publisher Hub","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56b4b819-55d9-4523-96ef-e2a4ac7ecec9","source":"wordfence","cve":"CVE-2026-32587","title":"WP Easy Pay \u2013 Payment and Donation form Builder for Square <= 4.2.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b4b819-55d9-4523-96ef-e2a4ac7ecec9?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"4.2.12"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:37:49Z"},{"id":"wordfence:56b4d715-7ec4-4d5b-ae2c-ec19310e72ab","source":"wordfence","cve":"CVE-2024-51819","title":"Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b4d715-7ec4-4d5b-ae2c-ec19310e72ab?source=api-prod","affected":[{"type":"plugin","slug":"tigris-flexplatform","name":"Tigris Flexplatform","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:17:59Z"},{"id":"wordfence:56b4d824-96b8-40e6-97b5-17748d13574a","source":"wordfence","cve":"CVE-2022-2834","title":"Helpful <= 4.5.25 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b4d824-96b8-40e6-97b5-17748d13574a?source=api-prod","affected":[{"type":"plugin","slug":"helpful","name":"Helpful","from":"*","from_inclusive":true,"to":"4.5.25","to_inclusive":true,"patched_in":"4.5.26"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56b637dc-4382-438f-ae36-e5075580a7d6","source":"wordfence","cve":"CVE-2025-5754","title":"Useful Tab Block \u2013 Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b637dc-4382-438f-ae36-e5075580a7d6?source=api-prod","affected":[{"type":"plugin","slug":"useful-tab-block-responsive-amp-compatible","name":"Useful Tab Block \u2013 Responsive & AMP-Compatible","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:34:54Z","updated":"2025-07-18T05:23:57Z"},{"id":"wordfence:56b6b56d-7ff4-40b5-a34b-703088387ab1","source":"wordfence","cve":"CVE-2026-14861","title":"User Verification < 2.0.48 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56b6b56d-7ff4-40b5-a34b-703088387ab1?source=api-prod","affected":[{"type":"plugin","slug":"user-verification","name":"User Verification by PickPlugins","from":"*","from_inclusive":true,"to":"2.0.48","to_inclusive":false,"patched_in":"2.0.48"}],"published":"2026-08-17T00:00:00Z","updated":"2026-11-10T23:19:20Z"},{"id":"wordfence:56ba7d1b-7afd-4069-8b18-1158911fce3f","source":"wordfence","cve":"CVE-2025-69092","title":"Essential Addons for Elementor <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ba7d1b-7afd-4069-8b18-1158911fce3f?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-13T17:52:35Z"},{"id":"wordfence:56bb9034-879a-4788-8b8f-758dfcf0ecaf","source":"wordfence","cve":"CVE-2025-66076","title":"Woostify Sites Library <= 1.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56bb9034-879a-4788-8b8f-758dfcf0ecaf?source=api-prod","affected":[{"type":"plugin","slug":"woostify-sites-library","name":"Woostify Sites Library","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:54:29Z"},{"id":"wordfence:56bbf263-149b-4419-9745-39dc147026a6","source":"wordfence","cve":"CVE-2023-25066","title":"FV Flowplayer Video Player <= 7.5.30.7210 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56bbf263-149b-4419-9745-39dc147026a6?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.30.7210","to_inclusive":true,"patched_in":"7.5.31.7212"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56bdf884-425c-40f9-88b5-66ed4c0f0501","source":"wordfence","cve":"CVE-2024-11223","title":"WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56bdf884-425c-40f9-88b5-66ed4c0f0501?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.2.2","to_inclusive":true,"patched_in":"1.9.2.3"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-24T16:43:34Z"},{"id":"wordfence:56be227d-1273-4833-a94e-67abf89f00ba","source":"wordfence","cve":"CVE-2025-13617","title":"Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56be227d-1273-4833-a94e-67abf89f00ba?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2026-02-18T15:32:44Z","updated":"2026-02-19T04:36:12Z"},{"id":"wordfence:56c1a28e-c37b-431d-bb0d-7d9cf4f85606","source":"wordfence","cve":"CVE-2019-7411","title":"Launcher: Coming Soon & Maintenance Mode < 1.0.11 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56c1a28e-c37b-431d-bb0d-7d9cf4f85606?source=api-prod","affected":[{"type":"plugin","slug":"launcher","name":"Launcher: Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":false,"patched_in":"1.0.11"}],"published":"2019-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56c4f6d4-9837-4632-a847-19a54ceb74eb","source":"wordfence","cve":"CVE-2026-62123","title":"Invetex <= 2.18 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56c4f6d4-9837-4632-a847-19a54ceb74eb?source=api-prod","affected":[{"type":"theme","slug":"invetex","name":"Invetex","from":"*","from_inclusive":true,"to":"2.18","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:32:09Z","updated":"2026-10-13T14:02:46Z"},{"id":"wordfence:56c5e045-e91c-4517-8164-a21c3e99623b","source":"wordfence","cve":"CVE-2026-12626","title":"Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99623b?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-10-09T17:51:40Z","updated":"2026-10-10T06:40:10Z"},{"id":"wordfence:56c719dc-b97a-4eb1-ae7a-e435c2f5a69e","source":"wordfence","cve":"","title":"WordPress Google reCAPTCHA <= 3.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56c719dc-b97a-4eb1-ae7a-e435c2f5a69e?source=api-prod","affected":[{"type":"plugin","slug":"wp-recaptcha","name":"WP-reCAPTCHA","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56c9fe56-8b15-409f-815b-10ee93f5153a","source":"wordfence","cve":"CVE-2026-103367","title":"ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56c9fe56-8b15-409f-815b-10ee93f5153a?source=api-prod","affected":[{"type":"plugin","slug":"shopmagic-for-woocommerce","name":"ShopMagic \u2013 email automation for WordPress","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2026-10-13T19:40:10Z","updated":"2026-10-14T07:43:33Z"},{"id":"wordfence:56cbe0b8-4bf9-40b2-a839-730c1997f6e7","source":"wordfence","cve":"CVE-2025-48293","title":"Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56cbe0b8-4bf9-40b2-a839-730c1997f6e7?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.16","to_inclusive":true,"patched_in":"1.13.17"}],"published":"2025-07-25T00:00:00Z","updated":"2025-09-25T20:38:30Z"},{"id":"wordfence:56cd4317-46e1-4e6c-a586-b3aacb189dd8","source":"wordfence","cve":"CVE-2014-9336","title":"iTwitter <= 0.04 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56cd4317-46e1-4e6c-a586-b3aacb189dd8?source=api-prod","affected":[{"type":"plugin","slug":"itwitter","name":"iTwitter","from":"*","from_inclusive":true,"to":"0.04","to_inclusive":true,"patched_in":""}],"published":"2014-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56cdced2-74c5-4b90-a26f-0ad0977a912c","source":"wordfence","cve":"CVE-2026-85123","title":"Easy Form Builder 4.0.0 - 4.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56cdced2-74c5-4b90-a26f-0ad0977a912c?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"4.0.0","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:37:01Z"},{"id":"wordfence:56ce85d3-89f3-461a-8268-7d549e9c2baf","source":"wordfence","cve":"CVE-2021-24899","title":"Media-Tags <= 3.2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ce85d3-89f3-461a-8268-7d549e9c2baf?source=api-prod","affected":[{"type":"plugin","slug":"media-tags","name":"Media Tags","from":"*","from_inclusive":true,"to":"3.2.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56d0658c-b6b5-4e01-9f5b-a53dd4e380d8","source":"wordfence","cve":"CVE-2023-45000","title":"LiteSpeed Cache <= 5.7 - Missing Authorization via update_cdn_status","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d0658c-b6b5-4e01-9f5b-a53dd4e380d8?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"5.7.0.1"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T16:06:21Z"},{"id":"wordfence:56d1d152-946f-47c9-b0d5-76513370677f","source":"wordfence","cve":"CVE-2024-1049","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d1d152-946f-47c9-b0d5-76513370677f?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T03:33:44Z"},{"id":"wordfence:56d24bc8-4a1a-4e60-aec5-960703a6058a","source":"wordfence","cve":"CVE-2024-6297","title":"Several WordPress.org Plugins <= Various Versions  - Injected Backdoor","severity":"critical","cvss":10.0,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d24bc8-4a1a-4e60-aec5-960703a6058a?source=api-prod","affected":[{"type":"plugin","slug":"twenty20","name":"Twenty20 Image Before-After","from":"1.5.4","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"twenty20","name":"Twenty20 Image Before-After","from":"1.6.2","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"twenty20","name":"Twenty20 Image Before-After","from":"1.6.3","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"seo-optimized-images","name":"SEO Optimized Images","from":"2.1.2","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.4"},{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"11.9.3","from_inclusive":true,"to":"11.9.4","to_inclusive":true,"patched_in":"11.9.6"},{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"1.3.15","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.14"},{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"1.3.16","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":"1.3.14"},{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"4.4.6.4","from_inclusive":true,"to":"4.4.7.1","to_inclusive":true,"patched_in":"4.4.7.3"},{"type":"plugin","slug":"contact-form-7-multi-step-addon","name":"Contact Form Multi-Step Addon","from":"1.0.4","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"simply-show-hooks","name":"Simply Show Hooks","from":"1.2.1","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"britetechs-companion","name":"Britetechs Companion","from":"2.2.7","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"wrapper-link-elementor","name":"Wrapper Link Elementor","from":"1.0.2","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"ad-invalid-click-protector","name":"Ad Invalid Click Protector (AICP)","from":"1.2.9","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.11"},{"type":"plugin","slug":"blaze-widget","name":"BLAZE Retail Widget","from":"2.2.5","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.4"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.2.3","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"},{"type":"plugin","slug":"wp-server-stats","name":"WP Server Health Stats","from":"1.7.6","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-06-24T00:00:00Z","updated":"2024-10-08T17:17:24Z"},{"id":"wordfence:56d839b0-b29d-4299-af77-1ce97a5925f6","source":"wordfence","cve":"CVE-2026-15946","title":"Search Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d839b0-b29d-4299-af77-1ce97a5925f6?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.6.23","to_inclusive":true,"patched_in":"2.6.24"}],"published":"2026-09-18T19:16:13Z","updated":"2026-09-19T07:43:16Z"},{"id":"wordfence:56d8516d-f2e6-4648-b8e6-75d6fb357ba8","source":"wordfence","cve":"CVE-2024-54337","title":"DX Dark Site <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d8516d-f2e6-4648-b8e6-75d6fb357ba8?source=api-prod","affected":[{"type":"plugin","slug":"devrix-dark-site","name":"DX Dark Site","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:28:36Z"},{"id":"wordfence:56d882a6-91eb-49bc-ae4d-86f3ea4b8813","source":"wordfence","cve":"CVE-2024-53724","title":"IceStats <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d882a6-91eb-49bc-ae4d-86f3ea4b8813?source=api-prod","affected":[{"type":"plugin","slug":"icestats","name":"IceStats","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:19:31Z"},{"id":"wordfence:56d8af3b-6c00-49ed-872a-64f7bebb470b","source":"wordfence","cve":"CVE-2024-3559","title":"Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56d8af3b-6c00-49ed-872a-64f7bebb470b?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-11T16:19:14Z","updated":"2024-06-12T04:32:16Z"},{"id":"wordfence:56dc5138-c864-4e36-8b7d-38ac49589c06","source":"wordfence","cve":"CVE-2024-1534","title":"Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56dc5138-c864-4e36-8b7d-38ac49589c06?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T09:33:52Z"},{"id":"wordfence:56e0565d-0720-4d85-b23e-49e807e8cf03","source":"wordfence","cve":"CVE-2025-28951","title":"Bulk Featured Image <= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e0565d-0720-4d85-b23e-49e807e8cf03?source=api-prod","affected":[{"type":"plugin","slug":"bulk-featured-image","name":"Bulk Featured Image","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:24:36Z"},{"id":"wordfence:56e0efba-4913-4772-8a5b-5cb5c84b5d48","source":"wordfence","cve":"CVE-2025-12620","title":"Poll Maker \u2013 Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e0efba-4913-4772-8a5b-5cb5c84b5d48?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2025-11-12T16:46:52Z","updated":"2025-11-13T05:30:40Z"},{"id":"wordfence:56e249ad-672d-4f8c-b8a1-7c1f03eed931","source":"wordfence","cve":"CVE-2026-106003","title":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e249ad-672d-4f8c-b8a1-7c1f03eed931?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":false,"patched_in":"1.12.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:19:19Z"},{"id":"wordfence:56e28bff-4869-43c0-9900-e3b999033554","source":"wordfence","cve":"CVE-2026-96836","title":"\u067e\u0627\u0631\u0633\u06cc \u062f\u06cc\u062a \u2013 Parsi Date <= 6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e28bff-4869-43c0-9900-e3b999033554?source=api-prod","affected":[{"type":"plugin","slug":"wp-parsidate","name":"Parsi Date | \u0628\u0633\u062a\u0647 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u067e\u0627\u0631\u0633\u06cc \u062f\u06cc\u062a","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:37:47Z"},{"id":"wordfence:56e2b16e-68fa-421a-a69f-e22987580a47","source":"wordfence","cve":"CVE-2024-34753","title":"Radio Player <= 2.0.73 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e2b16e-68fa-421a-a69f-e22987580a47?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T15:32:59Z"},{"id":"wordfence:56e3779e-c1e5-46f3-9110-d39587a2f8b8","source":"wordfence","cve":"CVE-2025-67928","title":"Automotive Listings <= 18.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e3779e-c1e5-46f3-9110-d39587a2f8b8?source=api-prod","affected":[{"type":"theme","slug":"automotive","name":"Automotive Car Dealership Business WordPress Theme","from":"*","from_inclusive":true,"to":"18.6","to_inclusive":true,"patched_in":"18.7"}],"published":"2026-01-05T00:00:00Z","updated":"2026-04-24T14:11:48Z"},{"id":"wordfence:56e3ca66-53c7-4b0c-9a08-0d013c399cb4","source":"wordfence","cve":"CVE-2025-23931","title":"WordPress Local SEO <= 2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e3ca66-53c7-4b0c-9a08-0d013c399cb4?source=api-prod","affected":[{"type":"plugin","slug":"dh-local-seo","name":"WordPress Local SEO","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-02-28T15:22:36Z"},{"id":"wordfence:56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3","source":"wordfence","cve":"CVE-2024-11224","title":"Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e5f7c9-ad22-43b3-9bfe-0eea1f8040d3?source=api-prod","affected":[{"type":"plugin","slug":"parallax-image","name":"Parallax Image","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-11-18T23:53:42Z","updated":"2024-11-19T12:45:28Z"},{"id":"wordfence:56e60322-2934-4074-a484-854ba2c53a54","source":"wordfence","cve":"CVE-2025-31761","title":"Hypotext <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e60322-2934-4074-a484-854ba2c53a54?source=api-prod","affected":[{"type":"plugin","slug":"hypotext","name":"Hypotext","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:31:57Z"},{"id":"wordfence:56e6c5c3-fa8b-4ec6-b1aa-88a0f63c5eab","source":"wordfence","cve":"CVE-2026-25341","title":"RSFirewall! <= 1.1.45 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e6c5c3-fa8b-4ec6-b1aa-88a0f63c5eab?source=api-prod","affected":[{"type":"plugin","slug":"rsfirewall","name":"RSFirewall!","from":"*","from_inclusive":true,"to":"1.1.45","to_inclusive":true,"patched_in":"1.1.46"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:30:50Z"},{"id":"wordfence:56e842c8-61ac-4281-8c4a-9cb1f8ecc062","source":"wordfence","cve":"CVE-2024-9019","title":"SecuPress Free \u2014 WordPress Security <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e842c8-61ac-4281-8c4a-9cb1f8ecc062?source=api-prod","affected":[{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.2.5.3","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-02-27T20:22:12Z","updated":"2025-03-07T03:14:51Z"},{"id":"wordfence:56e8c682-f19e-4e2c-91a3-e866d44a98fb","source":"wordfence","cve":"CVE-2026-57361","title":"Survey Maker by AYS <= 5.2.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56e8c682-f19e-4e2c-91a3-e866d44a98fb?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.2.2.5","to_inclusive":true,"patched_in":"5.2.2.6"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T20:00:04Z"},{"id":"wordfence:56ec086e-01a7-42f8-be17-b2bdf59cdfb8","source":"wordfence","cve":"CVE-2023-0365","title":"React Webcam <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ec086e-01a7-42f8-be17-b2bdf59cdfb8?source=api-prod","affected":[{"type":"plugin","slug":"react-webcam","name":"React Webcam","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56ecffec-06f3-4852-be36-5ed6f5db133b","source":"wordfence","cve":"CVE-2025-32644","title":"IP2Location World Clock <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ecffec-06f3-4852-be36-5ed6f5db133b?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-world-clock","name":"IP2Location World Clock","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:39:21Z"},{"id":"wordfence:56ef374e-db03-4f46-8902-243943131629","source":"wordfence","cve":"CVE-2025-30765","title":"FlexStock <= 3.13.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56ef374e-db03-4f46-8902-243943131629?source=api-prod","affected":[{"type":"plugin","slug":"stock-sync-with-google-sheet-for-woocommerce","name":"FlexStock \u2013 Product Stock Sync with Google Sheets for WooCommerce","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-03T14:20:55Z"},{"id":"wordfence:56f13af3-71b6-42d4-9fda-a75778f32091","source":"wordfence","cve":"CVE-2026-11551","title":"Branda \u2013 White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f13af3-71b6-42d4-9fda-a75778f32091?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.29","to_inclusive":true,"patched_in":"3.4.31"}],"published":"2026-06-19T11:05:45Z","updated":"2026-06-19T23:29:22Z"},{"id":"wordfence:56f146e8-ec70-45c4-9ff2-94cb44fef5c2","source":"wordfence","cve":"CVE-2024-31373","title":"e2pdf <= 1.20.27 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f146e8-ec70-45c4-9ff2-94cb44fef5c2?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.27","to_inclusive":true,"patched_in":"1.23.00"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:23:30Z"},{"id":"wordfence:56f365dd-9b6b-402a-8a09-35a26684cebf","source":"wordfence","cve":"CVE-2025-58638","title":"Institutions Directory <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f365dd-9b6b-402a-8a09-35a26684cebf?source=api-prod","affected":[{"type":"plugin","slug":"institutions-directory","name":"Institutions Directory","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-08-30T00:00:00Z","updated":"2025-11-11T17:15:30Z"},{"id":"wordfence:56f39e64-ff29-4b9f-acd1-a45d3ce5cb18","source":"wordfence","cve":"CVE-2024-54409","title":"XPD Reduce Image Filesize <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f39e64-ff29-4b9f-acd1-a45d3ce5cb18?source=api-prod","affected":[{"type":"plugin","slug":"xpd-reduce-image-filesize","name":"XPD Reduce Image Filesize","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:32:49Z"},{"id":"wordfence:56f3aa7a-a6f2-42c7-b855-b083fe58f466","source":"wordfence","cve":"CVE-2025-13705","title":"Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f3aa7a-a6f2-42c7-b855-b083fe58f466?source=api-prod","affected":[{"type":"plugin","slug":"custom-frames","name":"Custom Frames","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:11:35Z","updated":"2025-12-13T04:31:25Z"},{"id":"wordfence:56f3cb34-0452-4e3d-9442-0decc77f5e63","source":"wordfence","cve":"CVE-2023-49822","title":"Ultimate Dashboard <= 3.7.10 - Login Page Disclosure on Multi-site","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f3cb34-0452-4e3d-9442-0decc77f5e63?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.7.10","to_inclusive":true,"patched_in":"3.7.11"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56f44550-da65-4733-b4a2-a6db069db866","source":"wordfence","cve":"CVE-2025-53338","title":"re.place <= 0.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f44550-da65-4733-b4a2-a6db069db866?source=api-prod","affected":[{"type":"plugin","slug":"replace","name":"re.place","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:23:50Z"},{"id":"wordfence:56f46330-20d2-48f2-8e23-cc8f968db4b8","source":"wordfence","cve":"CVE-2022-0625","title":"Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f46330-20d2-48f2-8e23-cc8f968db4b8?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-restriction","name":"Admin Menu Editor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56f59303-cf82-4239-9e04-80a32f20d87c","source":"wordfence","cve":"CVE-2017-2195","title":"Multi Feed Reader <= 2.2.3 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f59303-cf82-4239-9e04-80a32f20d87c?source=api-prod","affected":[{"type":"plugin","slug":"multi-feed-reader","name":"Multi Feed Reader","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2017-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56f9d46f-5c21-4e8e-8e77-c96c4a0562d1","source":"wordfence","cve":"CVE-2020-12075","title":"Data Tables Generator by Supsystic <= 1.9.91 - Missing Authorization on AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56f9d46f-5c21-4e8e-8e77-c96c4a0562d1?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.9.91","to_inclusive":true,"patched_in":"1.9.92"}],"published":"2020-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56fa7885-dc36-420b-a6cc-4fc2192112eb","source":"wordfence","cve":"CVE-2025-22822","title":"wp custom countdown <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fa7885-dc36-420b-a6cc-4fc2192112eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-countdown","name":"wp custom countdown","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:06:49Z"},{"id":"wordfence:56fab3af-370d-4dba-bf21-775dabc7823d","source":"wordfence","cve":"CVE-2025-31743","title":"Lightweight and Responsive Youtube Embed <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fab3af-370d-4dba-bf21-775dabc7823d?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-and-responsive-youtube-embed","name":"Lightweight and Responsive Youtube Embed","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:38:44Z"},{"id":"wordfence:56fad8de-6646-4305-83a9-0ed443c3aa7d","source":"wordfence","cve":"CVE-2023-1011","title":"ChatBot <= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fad8de-6646-4305-83a9-0ed443c3aa7d?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56fce928-108d-4e59-8746-3699a9db427e","source":"wordfence","cve":"","title":"User Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fce928-108d-4e59-8746-3699a9db427e?source=api-prod","affected":[{"type":"plugin","slug":"woo-confirmation-email","name":"User Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2019-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:56fd8166-da22-4a0b-a23f-41817acba6df","source":"wordfence","cve":"CVE-2024-9272","title":"R Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fd8166-da22-4a0b-a23f-41817acba6df?source=api-prod","affected":[{"type":"plugin","slug":"r-animated-icon","name":"R Animated Icon Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:22:48Z","updated":"2024-10-01T07:30:12Z"},{"id":"wordfence:56fdbf80-8ea2-412a-b166-b7c27de88e70","source":"wordfence","cve":"CVE-2024-4383","title":"Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fdbf80-8ea2-412a-b166-b7c27de88e70?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:26Z"},{"id":"wordfence:56fe9c56-db60-4af5-b206-6afe5be970cf","source":"wordfence","cve":"CVE-2026-22360","title":"SearchAzon <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/56fe9c56-db60-4af5-b206-6afe5be970cf?source=api-prod","affected":[{"type":"plugin","slug":"searchazon","name":"SearchAzon - WooCommerce Amazon Affiliates Auto Search Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T21:54:43Z"},{"id":"wordfence:570474f2-c118-45e1-a237-c70b849b2d3c","source":"wordfence","cve":"CVE-2023-3124","title":"Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570474f2-c118-45e1-a237-c70b849b2d3c?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.11.6","to_inclusive":true,"patched_in":"3.11.7"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57051491-a56b-4a3a-9383-ba63585550be","source":"wordfence","cve":"CVE-2021-24283","title":"Accordion <= 2.2.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57051491-a56b-4a3a-9383-ba63585550be?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.2.30","to_inclusive":false,"patched_in":"2.2.30"}],"published":"2021-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5705c3bd-fb1f-407b-b7ab-5e3dbf909a7f","source":"wordfence","cve":"CVE-2025-53563","title":"Youtube Vimeo Video Player and Slider <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5705c3bd-fb1f-407b-b7ab-5e3dbf909a7f?source=api-prod","affected":[{"type":"plugin","slug":"video_player_youtube_vimeo","name":"Youtube Vimeo Video Player and Slider WP Plugin","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:44:07Z"},{"id":"wordfence:57065e04-d61b-49aa-9c2e-4dd911f893a7","source":"wordfence","cve":"CVE-2026-28096","title":"WealthCo <= 2.18 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57065e04-d61b-49aa-9c2e-4dd911f893a7?source=api-prod","affected":[{"type":"theme","slug":"wealthco","name":"WealthCo","from":"*","from_inclusive":true,"to":"2.18","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:05:59Z"},{"id":"wordfence:5708a414-7cd8-4926-8871-3248ebf4c39d","source":"wordfence","cve":"CVE-2024-0828","title":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5708a414-7cd8-4926-8871-3248ebf4c39d?source=api-prod","affected":[{"type":"plugin","slug":"play-ht","name":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-07-29T21:36:23Z"},{"id":"wordfence:570942bf-49b1-4217-abc6-5e83f27d9824","source":"wordfence","cve":"CVE-2022-1570","title":"Files Download Delay <= 1.0.6 - Missing Authorization to Settings Reset","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570942bf-49b1-4217-abc6-5e83f27d9824?source=api-prod","affected":[{"type":"plugin","slug":"files-download-delay","name":"Files Download Delay","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"}],"published":"2022-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:570a9fc7-ad0d-4aa3-8c31-4d2f534cdbae","source":"wordfence","cve":"CVE-2025-69388","title":"Cliengo \u2013 Chatbot <= 3.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570a9fc7-ad0d-4aa3-8c31-4d2f534cdbae?source=api-prod","affected":[{"type":"plugin","slug":"cliengo","name":"Cliengo \u2013 Chatbot","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T13:37:03Z"},{"id":"wordfence:570bca1e-78d0-49e8-8919-eba19f9457b9","source":"wordfence","cve":"CVE-2019-17228","title":"Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated Settings Import/Export","severity":"medium","cvss":6.5,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570bca1e-78d0-49e8-8919-eba19f9457b9?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2019-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:570e72de-1f6a-4bbe-9df1-f0d1ca290a0b","source":"wordfence","cve":"CVE-2024-31920","title":"Currency per Product for WooCommerce <= 1.6.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570e72de-1f6a-4bbe-9df1-f0d1ca290a0b?source=api-prod","affected":[{"type":"plugin","slug":"currency-per-product-for-woocommerce","name":"Currency per Product for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:56:55Z"},{"id":"wordfence:570f680b-b688-49ad-9eed-0bc966a4cdf7","source":"wordfence","cve":"","title":"Faction <= 1.1.1 - Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/570f680b-b688-49ad-9eed-0bc966a4cdf7?source=api-prod","affected":[{"type":"theme","slug":"fraction-theme","name":"Faction","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57103f8e-0874-4e56-8571-254607ada21c","source":"wordfence","cve":"CVE-2024-3916","title":"Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57103f8e-0874-4e56-8571-254607ada21c?source=api-prod","affected":[{"type":"plugin","slug":"swift-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2.7.31","to_inclusive":true,"patched_in":""}],"published":"2024-05-03T00:00:00Z","updated":"2024-10-24T19:12:08Z"},{"id":"wordfence:57156ebc-2858-4295-ba08-57bcab6db229","source":"wordfence","cve":"","title":"WooCommerce Shipping & Tax <= 2.2.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57156ebc-2858-4295-ba08-57bcab6db229?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-services","name":"WooCommerce Tax (formerly WooCommerce Shipping & Tax)","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5715f3d3-8b88-45bc-a858-3911eeaaf045","source":"wordfence","cve":"CVE-2021-38326","title":"Post Title Counter <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5715f3d3-8b88-45bc-a858-3911eeaaf045?source=api-prod","affected":[{"type":"plugin","slug":"post-title-counter","name":"Post Title Counter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57162a5e-5f5d-4b22-bb7f-0ff65332910b","source":"wordfence","cve":"CVE-2020-28707","title":"Stockdio Historical Chart < 2.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57162a5e-5f5d-4b22-bb7f-0ff65332910b?source=api-prod","affected":[{"type":"plugin","slug":"stockdio-historical-chart","name":"Stockdio Historical Chart","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":false,"patched_in":"2.8.1"}],"published":"2020-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5716c4e1-a6d3-42e8-b90c-d16f204c8503","source":"wordfence","cve":"CVE-2025-13069","title":"Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5716c4e1-a6d3-42e8-b90c-d16f204c8503?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-11-17T20:54:40Z","updated":"2025-12-12T17:01:04Z"},{"id":"wordfence:5717b835-7feb-4bb8-8f1b-1f44d4630cd3","source":"wordfence","cve":"CVE-2024-37212","title":"Ali2Woo Lite <= 3.4.4 - Cross-Site Request Forgery to PHP Object Injection","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5717b835-7feb-4bb8-8f1b-1f44d4630cd3?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-10-07T17:44:05Z"},{"id":"wordfence:571937a3-46f8-4cbf-a750-4c2fbb1f944b","source":"wordfence","cve":"CVE-2026-28066","title":"Legrand <= 2.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/571937a3-46f8-4cbf-a750-4c2fbb1f944b?source=api-prod","affected":[{"type":"theme","slug":"legrand","name":"LeGrand | Modern Business WordPress Theme","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:44:22Z"},{"id":"wordfence:571b391d-c839-43c3-bdf0-a9ad2222cb48","source":"wordfence","cve":"CVE-2024-38691","title":"Metorik \u2013 Reports & Email Automation for WooCommerce <= 1.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/571b391d-c839-43c3-bdf0-a9ad2222cb48?source=api-prod","affected":[{"type":"plugin","slug":"metorik-helper","name":"Metorik \u2013 Reports & Email Automation for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:11:21Z"},{"id":"wordfence:571f35bf-d45b-49d5-b44a-8620e954928e","source":"wordfence","cve":"CVE-2026-119098","title":"LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/571f35bf-d45b-49d5-b44a-8620e954928e?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"10.3.2","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-11-06T14:09:03Z","updated":"2026-11-07T02:29:15Z"},{"id":"wordfence:571fd575-ff03-465f-9e3c-574e93586396","source":"wordfence","cve":"CVE-2024-34827","title":"Translate Multilingual sites \u2013 TranslatePress <= 2.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/571fd575-ff03-465f-9e3c-574e93586396?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:13:34Z"},{"id":"wordfence:572689c6-d7d6-46c3-9e96-b9185337e8ce","source":"wordfence","cve":"CVE-2023-4971","title":"Weaver Xtreme Theme Support <= 6.3.0 - Authenticated (Administrator+) PHP Object Injection via Imported File","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572689c6-d7d6-46c3-9e96-b9185337e8ce?source=api-prod","affected":[{"type":"plugin","slug":"weaverx-theme-support","name":"Weaver Xtreme Theme Support","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5726db0a-2132-43d7-a0c9-6919e9e51bf6","source":"wordfence","cve":"CVE-2026-81791","title":"EventON \u2013 Events Calendar <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5726db0a-2132-43d7-a0c9-6919e9e51bf6?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:42:55Z"},{"id":"wordfence:5727bc4e-ee92-4913-bc8f-3d002488b383","source":"wordfence","cve":"CVE-2026-6802","title":"Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5727bc4e-ee92-4913-bc8f-3d002488b383?source=api-prod","affected":[{"type":"plugin","slug":"easy-upload-files-during-checkout","name":"Easy Upload Files During Checkout","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-07-09T19:11:17Z","updated":"2026-07-10T07:48:42Z"},{"id":"wordfence:57280079-9843-4e9e-9060-492f72c9ca44","source":"wordfence","cve":"CVE-2026-107629","title":"Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57280079-9843-4e9e-9060-492f72c9ca44?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.1","to_inclusive":true,"patched_in":"13.2.2"}],"published":"2026-10-28T21:03:32Z","updated":"2026-10-29T09:25:34Z"},{"id":"wordfence:572b584e-b580-4d90-88b6-ee5b25678d9b","source":"wordfence","cve":"CVE-2025-11830","title":"WP Restaurant Listings <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572b584e-b580-4d90-88b6-ee5b25678d9b?source=api-prod","affected":[{"type":"plugin","slug":"wp-restaurant-listings","name":"WP Restaurant Listings","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:18:34Z","updated":"2025-10-22T08:27:08Z"},{"id":"wordfence:572bfa82-92f5-4801-8710-0626ca563a6c","source":"wordfence","cve":"CVE-2026-12920","title":"Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572bfa82-92f5-4801-8710-0626ca563a6c?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-07-02T12:57:04Z","updated":"2026-07-03T01:28:22Z"},{"id":"wordfence:572c8294-f8d2-4600-9539-354e31be78f3","source":"wordfence","cve":"CVE-2026-124753","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572c8294-f8d2-4600-9539-354e31be78f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:59Z"},{"id":"wordfence:572e290e-9324-4c17-8c3b-fa67233b15c4","source":"wordfence","cve":"CVE-2025-3104","title":"WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572e290e-9324-4c17-8c3b-fa67233b15c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging-pro","name":"WP STAGING Pro WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2025-04-15T19:52:04Z","updated":"2025-04-16T08:22:19Z"},{"id":"wordfence:572f55af-bef6-4cb9-9c6b-741262710c91","source":"wordfence","cve":"CVE-2016-20076","title":"Simple-Backup <= 2.7.11 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572f55af-bef6-4cb9-9c6b-741262710c91?source=api-prod","affected":[{"type":"plugin","slug":"simple-backup","name":"Simple Backup","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:44:06Z"},{"id":"wordfence:572fe891-5845-4a1c-ad3e-ddf5c54af5ba","source":"wordfence","cve":"","title":"WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/572fe891-5845-4a1c-ad3e-ddf5c54af5ba?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-10T21:07:04Z"},{"id":"wordfence:5731b971-4408-4c64-809c-e95fba33009e","source":"wordfence","cve":"CVE-2025-7643","title":"Attachment Manager <= 2.1.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5731b971-4408-4c64-809c-e95fba33009e?source=api-prod","affected":[{"type":"plugin","slug":"attachment-manager","name":"Attachment Manager","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T17:03:23Z","updated":"2025-07-18T05:23:58Z"},{"id":"wordfence:5734bd3b-b1cd-4376-b481-a9ad120016f6","source":"wordfence","cve":"","title":"mywebcounter <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5734bd3b-b1cd-4376-b481-a9ad120016f6?source=api-prod","affected":[{"type":"plugin","slug":"mywebcounter","name":"mywebcounter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57377380-0435-4747-abba-50063978d8e1","source":"wordfence","cve":"CVE-2023-27447","title":"WP SMS <= 6.0.4 - Information Disclosure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57377380-0435-4747-abba-50063978d8e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.4.1"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:573968ec-b4c6-40ec-b75d-f6c92b29763b","source":"wordfence","cve":"CVE-2026-57683","title":"WP Fast Total Search \u2013 The Power of Indexed Search <= 1.80.280 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/573968ec-b4c6-40ec-b75d-f6c92b29763b?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.80.280","to_inclusive":true,"patched_in":"1.81.282"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:06:56Z"},{"id":"wordfence:573b503e-7388-4e0d-a620-b87016028d79","source":"wordfence","cve":"CVE-2025-31903","title":"XV Random Quotes <= 1.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/573b503e-7388-4e0d-a620-b87016028d79?source=api-prod","affected":[{"type":"plugin","slug":"xv-random-quotes","name":"XV Random Quotes","from":"*","from_inclusive":true,"to":"1.41","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-04-03T00:00:00Z","updated":"2026-01-06T19:29:35Z"},{"id":"wordfence:573c07f0-1ce5-456d-9094-47cb7d8ba9f0","source":"wordfence","cve":"CVE-2024-35701","title":"PropertyHive <= 2.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/573c07f0-1ce5-456d-9094-47cb7d8ba9f0?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:55:42Z"},{"id":"wordfence:573dd1ea-1f2c-4a0b-9496-82d7b65c8db2","source":"wordfence","cve":"CVE-2022-0901","title":"Ad Inserter Free and Pro <= 2.7.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/573dd1ea-1f2c-4a0b-9496-82d7b65c8db2?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":false,"patched_in":"2.7.12"},{"type":"plugin","slug":"ad-inserter-pro","name":"Ad Inserter Pro","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":false,"patched_in":"2.7.12"}],"published":"2022-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57450aba-ba77-46f2-95b8-b886f4cc14fe","source":"wordfence","cve":"CVE-2024-49324","title":"Sovratec Case Management <= 1.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57450aba-ba77-46f2-95b8-b886f4cc14fe?source=api-prod","affected":[{"type":"plugin","slug":"sovratec-case-management","name":"Plugin Name:  Sovratec Case Management","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:35:59Z"},{"id":"wordfence:57465411-2da9-4deb-88e8-63f7e2176b7e","source":"wordfence","cve":"CVE-2026-93512","title":"JW Player for WordPress <= 2.3.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57465411-2da9-4deb-88e8-63f7e2176b7e?source=api-prod","affected":[{"type":"plugin","slug":"jw-player-7-for-wp","name":"JW Player for WordPress","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2026-09-29T07:27:17Z","updated":"2026-10-09T00:03:39Z"},{"id":"wordfence:57465fce-e8ad-41ac-9dd6-e340ec314913","source":"wordfence","cve":"","title":"WooCommerce Products Vendor <= 2.1.65 - Insecure Direct Object Reference to Note Creation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57465fce-e8ad-41ac-9dd6-e340ec314913?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.65","to_inclusive":true,"patched_in":"2.1.66"}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:574686c7-3ae3-48b4-8bea-4f96c7a6827f","source":"wordfence","cve":"CVE-2025-68851","title":"Okay Toolkit <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/574686c7-3ae3-48b4-8bea-4f96c7a6827f?source=api-prod","affected":[{"type":"plugin","slug":"okay-toolkit","name":"Okay Toolkit","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T20:57:07Z"},{"id":"wordfence:57473f14-0ed0-498b-a6d2-034e9646b049","source":"wordfence","cve":"CVE-2026-16990","title":"Payment Button for PayPal < 1.2.3.45 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57473f14-0ed0-498b-a6d2-034e9646b049?source=api-prod","affected":[{"type":"plugin","slug":"wp-paypal","name":"Payment Button for PayPal","from":"*","from_inclusive":true,"to":"1.2.3.45","to_inclusive":false,"patched_in":"1.2.3.45"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-09T16:09:17Z"},{"id":"wordfence:5748d40a-e790-4a61-ab6a-a8750535c5bd","source":"wordfence","cve":"CVE-2025-53224","title":"NextGEN Gallery Search <= 2.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5748d40a-e790-4a61-ab6a-a8750535c5bd?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery-search-galleries","name":"NextGEN Gallery Search","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:12:35Z"},{"id":"wordfence:5749a496-930a-4e31-968e-0c2a72e03555","source":"wordfence","cve":"CVE-2020-36176","title":"iThemes Security <= 7.6.1 - Broken Password Mechanism","severity":"high","cvss":7.5,"cwe":"CWE-286","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5749a496-930a-4e31-968e-0c2a72e03555?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.7.0"}],"published":"2021-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5749a4e1-e7f3-4887-bf8c-49ffc095d0ee","source":"wordfence","cve":"CVE-2025-49951","title":"gAppointments <= 1.14.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5749a4e1-e7f3-4887-bf8c-49ffc095d0ee?source=api-prod","affected":[{"type":"plugin","slug":"gAppointments","name":"gAppointments - Appointment booking addon for Gravity Forms","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-10-29T18:52:07Z"},{"id":"wordfence:574dd6d8-14df-47b8-bf03-28a3c02b73ec","source":"wordfence","cve":"","title":"BookingPress \u2013 Appointments Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.13 - SQL Injection","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/574dd6d8-14df-47b8-bf03-28a3c02b73ec?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2022-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57531d89-1f54-43f4-a19d-9fda5e69f2ad","source":"wordfence","cve":"CVE-2021-34623","title":"User Registration, User Profiles, Login & Membership \u2013 ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57531d89-1f54-43f4-a19d-9fda5e69f2ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"3.0.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5754d2eb-dd31-4056-8a02-8b71b78f774b","source":"wordfence","cve":"CVE-2024-12027","title":"Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5754d2eb-dd31-4056-8a02-8b71b78f774b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.3.1"}],"published":"2024-12-05T19:52:04Z","updated":"2024-12-10T14:26:02Z"},{"id":"wordfence:5754dce7-6b47-4490-a04a-7eabfded0720","source":"wordfence","cve":"CVE-2025-11467","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5754dce7-6b47-4490-a04a-7eabfded0720?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2025-12-10T12:23:54Z","updated":"2025-12-11T01:55:32Z"},{"id":"wordfence:5754ffd6-81bb-491b-9272-627e8c52a22c","source":"wordfence","cve":"CVE-2012-1011","title":"AllWebMenus WordPress Menu Plugin <= 1.1.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5754ffd6-81bb-491b-9272-627e8c52a22c?source=api-prod","affected":[{"type":"plugin","slug":"allwebmenus-wordpress-menu-plugin","name":"AllWebMenus WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2012-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:575743cc-6399-4f1d-893c-3fb9d4a98738","source":"wordfence","cve":"CVE-2024-35643","title":"WP Back Button <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575743cc-6399-4f1d-893c-3fb9d4a98738?source=api-prod","affected":[{"type":"plugin","slug":"wp-back-button","name":"WP Back Button","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:26:44Z"},{"id":"wordfence:57580c2c-c3de-44a3-b586-f7092c06dc6b","source":"wordfence","cve":"CVE-2023-31093","title":"Chronosly Events Calendar <= 2.6.2 - Cross-Site Request Forgery via plugin_settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57580c2c-c3de-44a3-b586-f7092c06dc6b?source=api-prod","affected":[{"type":"plugin","slug":"chronosly-events-calendar","name":"Chronosly Events Calendar","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:575870b0-269e-4651-9e0f-0a178266a02e","source":"wordfence","cve":"CVE-2025-54715","title":"Barcode Scanner with Inventory & Order Manager <= 1.9.0 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575870b0-269e-4651-9e0f-0a178266a02e?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:18:49Z"},{"id":"wordfence:57599ae1-2a6a-4011-9e6f-824b23891a91","source":"wordfence","cve":"CVE-2025-60056","title":"Winger <= 1.0.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57599ae1-2a6a-4011-9e6f-824b23891a91?source=api-prod","affected":[{"type":"theme","slug":"winger","name":"Winger - Aviation & Flight School WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:40:07Z"},{"id":"wordfence:575a648a-6bf0-42d9-964e-59800e856bd0","source":"wordfence","cve":"CVE-2024-56225","title":"Premium Addons for Elementor <= 4.10.56 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575a648a-6bf0-42d9-964e-59800e856bd0?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.56","to_inclusive":true,"patched_in":"4.10.57"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:10:42Z"},{"id":"wordfence:575b11a3-9fa4-4ee0-8f19-7d53e6c1785f","source":"wordfence","cve":"CVE-2025-8726","title":"WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575b11a3-9fa4-4ee0-8f19-7d53e6c1785f?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.0.11.006","to_inclusive":true,"patched_in":"9.0.11.007"}],"published":"2025-10-03T14:09:22Z","updated":"2025-10-04T02:24:35Z"},{"id":"wordfence:575b51f4-fed4-4057-9e8b-762fda275ef3","source":"wordfence","cve":"CVE-2023-51539","title":"Apollo13 Framework Extensions <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575b51f4-fed4-4057-9e8b-762fda275ef3?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:575c3329-8dbb-4d15-8e11-a86a01b96f50","source":"wordfence","cve":"CVE-2026-0681","title":"Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575c3329-8dbb-4d15-8e11-a86a01b96f50?source=api-prod","affected":[{"type":"plugin","slug":"extended-random-number-generator","name":"Extended Random Number Generator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:30:24Z","updated":"2026-02-04T08:25:31Z"},{"id":"wordfence:575d1353-70af-4200-9088-662f7a052b76","source":"wordfence","cve":"","title":"Super Forms \u2013 Drag & Drop Form Builder <= 4.9.700 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575d1353-70af-4200-9088-662f7a052b76?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"4.9.700","to_inclusive":true,"patched_in":"4.9.800"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:575d1e24-d23d-4589-bb71-f52efec1ac58","source":"wordfence","cve":"CVE-2024-12152","title":"MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575d1e24-d23d-4589-bb71-f52efec1ac58?source=api-prod","affected":[{"type":"plugin","slug":"mipl-wc-multisite-sync","name":"MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders.","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T09:22:16Z"},{"id":"wordfence:575e1255-14f5-449e-a6ee-64d203800853","source":"wordfence","cve":"CVE-2025-23834","title":"Links/Problem Reporter <= 2.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575e1255-14f5-449e-a6ee-64d203800853?source=api-prod","affected":[{"type":"plugin","slug":"report-broken-links","name":"Links/Problem Reporter","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:56:25Z"},{"id":"wordfence:575ec3a9-26f7-415b-9df6-d0401557a578","source":"wordfence","cve":"CVE-2024-32814","title":"Advanced Local Pickup for WooCommerce <= 1.6.1 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575ec3a9-26f7-415b-9df6-d0401557a578?source=api-prod","affected":[{"type":"plugin","slug":"advanced-local-pickup-for-woocommerce","name":"Advanced Local Pickup for WooCommerce \u2013 Click & Collect, In-Store Pickup","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:21:24Z"},{"id":"wordfence:575edf4e-235d-4ad7-a6dd-3ffdbf4c71b5","source":"wordfence","cve":"CVE-2026-56069","title":"Toolset Forms <= 2.6.24 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575edf4e-235d-4ad7-a6dd-3ffdbf4c71b5?source=api-prod","affected":[{"type":"plugin","slug":"cred-frontend-editor","name":"Toolset Forms","from":"*","from_inclusive":true,"to":"2.6.24","to_inclusive":true,"patched_in":"2.6.25"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:41:41Z"},{"id":"wordfence:575f103e-cfc7-4efd-a592-658a3e919671","source":"wordfence","cve":"CVE-2024-10000","title":"Masteriyo LMS \u2013 eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/575f103e-cfc7-4efd-a592-658a3e919671?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2024-10-28T16:31:52Z","updated":"2024-10-29T05:32:39Z"},{"id":"wordfence:5760933b-30e6-465b-9b94-c913b21f07fd","source":"wordfence","cve":"CVE-2024-9591","title":"Category and Taxonomy Image <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5760933b-30e6-465b-9b94-c913b21f07fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-taxonomy-image","name":"Category and Taxonomy Image","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T07:36:34Z"},{"id":"wordfence:57641366-85d3-4375-8cde-041227c9f811","source":"wordfence","cve":"CVE-2024-9898","title":"Parallax Image <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57641366-85d3-4375-8cde-041227c9f811?source=api-prod","affected":[{"type":"plugin","slug":"parallax-image","name":"Parallax Image","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-10-16T21:47:32Z","updated":"2024-10-17T11:03:54Z"},{"id":"wordfence:57666105-81e4-4ef4-8889-9ce9995d2629","source":"wordfence","cve":"CVE-2015-3429","title":"Twenty Fifteen Theme <= 1.1 & WordPress Core < 4.2.2 - Cross-Site Scripting via example.html","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57666105-81e4-4ef4-8889-9ce9995d2629?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"3.7.8"},{"type":"theme","slug":"twentyfifteen","name":"Twenty Fifteen","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2015-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:576aba7a-9f8c-4c03-8310-7edd29bf0d2a","source":"wordfence","cve":"CVE-2025-57964","title":"Library Bookshelves <= 5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/576aba7a-9f8c-4c03-8310-7edd29bf0d2a?source=api-prod","affected":[{"type":"plugin","slug":"library-bookshelves","name":"Library Bookshelves","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:05:54Z"},{"id":"wordfence:576ad141-e6c7-42f8-b069-936be24e57a0","source":"wordfence","cve":"CVE-2025-32545","title":"WooCommerce Products without featured images <= 0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/576ad141-e6c7-42f8-b069-936be24e57a0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-without-featured-images","name":"WooCommerce Products without featured images","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T19:56:21Z"},{"id":"wordfence:576ca901-45e2-4e6d-9bc4-370bf1f68077","source":"wordfence","cve":"CVE-2024-3211","title":"Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/576ca901-45e2-4e6d-9bc4-370bf1f68077?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-12T19:25:22Z"},{"id":"wordfence:57704203-ed74-4100-900c-3f35c726e51e","source":"wordfence","cve":"CVE-2017-1002009","title":"Membership Simplified <= 1.58 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57704203-ed74-4100-900c-3f35c726e51e?source=api-prod","affected":[{"type":"plugin","slug":"membership-simplified-for-oap-members-only","name":"Membership Simplified","from":"*","from_inclusive":true,"to":"1.58","to_inclusive":true,"patched_in":""}],"published":"2017-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:577095f7-955f-46ab-ae5e-635fb4c65cbe","source":"wordfence","cve":"CVE-2024-37297","title":"WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577095f7-955f-46ab-ae5e-635fb4c65cbe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.8.0","from_inclusive":true,"to":"8.8.4","to_inclusive":true,"patched_in":"8.8.5"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"8.9.0","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"8.8.5"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-18T13:46:28Z"},{"id":"wordfence:5770cb94-8603-44d9-8cda-925175851b51","source":"wordfence","cve":"CVE-2025-13136","title":"GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5770cb94-8603-44d9-8cda-925175851b51?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-ninja-forms","name":"GSheetConnector \u2013 Ninja Forms Google Sheets Connector, Export Form Submissions Instant Sync to Sheets","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-11-21T19:31:21Z","updated":"2025-11-22T08:30:29Z"},{"id":"wordfence:57734f6a-b592-4b01-b6a1-5636d48c0840","source":"wordfence","cve":"CVE-2025-69346","title":"AffiliateX <= 1.3.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57734f6a-b592-4b01-b6a1-5636d48c0840?source=api-prod","affected":[{"type":"plugin","slug":"affiliatex","name":"AffiliateX \u2013 Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking","from":"*","from_inclusive":true,"to":"1.3.9.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T15:05:52Z"},{"id":"wordfence:5776ae23-3846-41bf-92dd-948230c334bf","source":"wordfence","cve":"CVE-2021-24988","title":"WP RSS Aggregator <= 4.19.2 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5776ae23-3846-41bf-92dd-948230c334bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.19.3","to_inclusive":false,"patched_in":"4.19.3"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5776f689-56dd-413d-b02d-5551b97dd5eb","source":"wordfence","cve":"CVE-2024-13229","title":"Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5776f689-56dd-413d-b02d-5551b97dd5eb?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.235","to_inclusive":true,"patched_in":"1.0.236"}],"published":"2025-02-12T16:21:30Z","updated":"2025-02-13T04:21:49Z"},{"id":"wordfence:57774f93-e6c0-46e6-8019-eab00b2b48ff","source":"wordfence","cve":"CVE-2023-45107","title":"GoodBarber <= 1.0.23 - Cross-Site Request Forgery via admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57774f93-e6c0-46e6-8019-eab00b2b48ff?source=api-prod","affected":[{"type":"plugin","slug":"goodbarber","name":"GoodBarber","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57789905-1e08-41c5-bfda-b1d6d33de4c0","source":"wordfence","cve":"CVE-2024-11336","title":"Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57789905-1e08-41c5-bfda-b1d6d33de4c0?source=api-prod","affected":[{"type":"plugin","slug":"clickbank-storefront","name":"Clickbank WordPress Plugin (Storefront)","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:53Z"},{"id":"wordfence:5778ba3d-6670-47ad-ae65-50b6fb8e5db0","source":"wordfence","cve":"","title":"Real Estate 7 Theme <= 3.3.4 - Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5778ba3d-6670-47ad-ae65-50b6fb8e5db0?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2023-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5779914a-a168-4835-8aea-e0ab2b3be4f6","source":"wordfence","cve":"CVE-2023-2494","title":"Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting","severity":"medium","cvss":4.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5779914a-a168-4835-8aea-e0ab2b3be4f6?source=api-prod","affected":[{"type":"plugin","slug":"go_pricing","name":"Go Pricing - WordPress Responsive Pricing Tables","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:577a2783-244b-4449-a0f2-39d4be521acf","source":"wordfence","cve":"CVE-2026-0674","title":"Campaign Monitor for WordPress <= 2.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577a2783-244b-4449-a0f2-39d4be521acf?source=api-prod","affected":[{"type":"plugin","slug":"forms-for-campaign-monitor","name":"Campaign Monitor for WordPress","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-01-08T00:00:00Z","updated":"2026-05-11T19:40:46Z"},{"id":"wordfence:577b4738-fa58-44b2-a8e7-ef59925f26a1","source":"wordfence","cve":"CVE-2020-29395","title":"EventON <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577b4738-fa58-44b2-a8e7-ef59925f26a1?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2020-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:577cf51e-3fcb-456c-9068-17fff4a71e94","source":"wordfence","cve":"CVE-2022-47591","title":"Map Multi Marker <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577cf51e-3fcb-456c-9068-17fff4a71e94?source=api-prod","affected":[{"type":"plugin","slug":"map-multi-marker","name":"Map Multi Marker","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:577d8986-edc5-445f-80cf-7a7f2cca9749","source":"wordfence","cve":"CVE-2023-34183","title":"Unite Gallery Lite <= 1.7.61 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577d8986-edc5-445f-80cf-7a7f2cca9749?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.7.61","to_inclusive":true,"patched_in":"1.7.62"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:577de987-b526-4d7a-8163-683ec3b77bec","source":"wordfence","cve":"CVE-2024-38795","title":"ListingPro Plugin <= 2.9.4 - Unauthenticated SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/577de987-b526-4d7a-8163-683ec3b77bec?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2025-03-24T15:25:31Z"},{"id":"wordfence:578001b0-2253-4265-b808-de92dfddc6af","source":"wordfence","cve":"CVE-2026-28030","title":"Bonbon <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578001b0-2253-4265-b808-de92dfddc6af?source=api-prod","affected":[{"type":"theme","slug":"bonbon","name":"Bonbon","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:32:27Z"},{"id":"wordfence:5780d762-2313-4c81-be02-99543359d824","source":"wordfence","cve":"CVE-2026-11773","title":"Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5780d762-2313-4c81-be02-99543359d824?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-06-26T17:55:05Z","updated":"2026-06-27T06:50:57Z"},{"id":"wordfence:5781420d-b1e0-435f-8bf2-193cc7b095ed","source":"wordfence","cve":"CVE-2020-28976","title":"Canto <= 1.9.0 - Blind Server-Side Request Forgery via detail.php","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5781420d-b1e0-435f-8bf2-193cc7b095ed?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2020-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5782439f-a546-45f6-aec7-e600442d3c41","source":"wordfence","cve":"CVE-2023-0443","title":"AnyWhere Elementor <= 1.2.7 - Sensitive Information Exposure","severity":"high","cvss":8.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5782439f-a546-45f6-aec7-e600442d3c41?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5782c338-1474-48e1-8b1d-015e3bb1c23d","source":"wordfence","cve":"CVE-2026-32449","title":"Themify Event Post <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5782c338-1474-48e1-8b1d-015e3bb1c23d?source=api-prod","affected":[{"type":"plugin","slug":"themify-event-post","name":"Themify Event Post","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-03-08T00:00:00Z","updated":"2026-04-15T21:07:02Z"},{"id":"wordfence:57837060-433f-471c-9413-6d9b95b69f2a","source":"wordfence","cve":"","title":"Image Slider < 1.1.90 - Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57837060-433f-471c-9413-6d9b95b69f2a?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.90","to_inclusive":false,"patched_in":"1.1.90"}],"published":"2016-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5783824c-af02-4606-87c6-b58127445230","source":"wordfence","cve":"CVE-2025-60212","title":"VEDA <= 4.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5783824c-af02-4606-87c6-b58127445230?source=api-prod","affected":[{"type":"theme","slug":"veda","name":"VEDA - MultiPurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-11-04T18:25:21Z"},{"id":"wordfence:57865837-470e-4afd-bb90-d203a78a210b","source":"wordfence","cve":"CVE-2025-7960","title":"King Addons for Elementor <= 51.1.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57865837-470e-4afd-bb90-d203a78a210b?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.53","to_inclusive":true,"patched_in":"51.1.54"}],"published":"2025-12-12T00:00:00Z","updated":"2026-09-18T19:37:57Z"},{"id":"wordfence:5786b859-3ee9-45ab-8926-f4a09e323e3b","source":"wordfence","cve":"CVE-2023-23702","title":"Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5786b859-3ee9-45ab-8926-f4a09e323e3b?source=api-prod","affected":[{"type":"plugin","slug":"comments-ratings","name":"Comments Ratings","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-11-03T00:00:00Z","updated":"2026-11-03T22:42:42Z"},{"id":"wordfence:57888e36-3a61-4452-b4ea-9db9e422dc2d","source":"wordfence","cve":"CVE-2024-12849","title":"Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57888e36-3a61-4452-b4ea-9db9e422dc2d?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer-wp","name":"Error Log Viewer By WP Guru","from":"*","from_inclusive":true,"to":"1.0.1.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-01-06T16:47:09Z","updated":"2025-01-07T05:23:53Z"},{"id":"wordfence:578892f2-9841-4493-8445-61b79feb4764","source":"wordfence","cve":"CVE-2024-6555","title":"WP Popups \u2013 WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578892f2-9841-4493-8445-61b79feb4764?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.2.0.1","to_inclusive":true,"patched_in":"2.2.0.2"}],"published":"2024-07-11T17:15:36Z","updated":"2024-07-12T05:32:38Z"},{"id":"wordfence:57896fa8-9360-41e8-a60e-8b95d01c25ac","source":"wordfence","cve":"CVE-2023-48775","title":"WP Cleanfix <= 5.6.2 - Missing Authorization via register","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57896fa8-9360-41e8-a60e-8b95d01c25ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-cleanfix","name":"WP CleanFix","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-25T18:57:28Z"},{"id":"wordfence:578a908a-d447-4b3e-b5d1-be86363c982a","source":"wordfence","cve":"CVE-2017-6819","title":"WordPress Core < 4.7.3 - Cross-Site Request Forgery via Press This","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578a908a-d447-4b3e-b5d1-be86363c982a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:578b17d4-16cf-449a-9d99-cd9a0f7a8418","source":"wordfence","cve":"","title":"Database Sync < 0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578b17d4-16cf-449a-9d99-cd9a0f7a8418?source=api-prod","affected":[{"type":"plugin","slug":"database-sync","name":"Database Sync","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":false,"patched_in":"0.5"}],"published":"2015-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:578cf704-e84d-469f-bf26-e60268506a78","source":"wordfence","cve":"CVE-2024-23507","title":"InstaWP Connect <= 0.1.0.9 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578cf704-e84d-469f-bf26-e60268506a78?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.9","to_inclusive":true,"patched_in":"0.1.0.10"}],"published":"2024-01-24T00:00:00Z","updated":"2024-01-26T15:07:01Z"},{"id":"wordfence:578d8ca7-7042-493d-92b4-63241b4bdfca","source":"wordfence","cve":"CVE-2024-22142","title":"Profile Builder Pro <= 3.10.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578d8ca7-7042-493d-92b4-63241b4bdfca?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:578ed437-98b7-495b-91fd-45b882f39d95","source":"wordfence","cve":"CVE-2024-33693","title":"Meks Smart Social Widget <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/578ed437-98b7-495b-91fd-45b882f39d95?source=api-prod","affected":[{"type":"plugin","slug":"meks-smart-social-widget","name":"Meks Smart Social Widget","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-04-26T00:00:00Z","updated":"2024-06-19T12:24:41Z"},{"id":"wordfence:57953bab-7430-4841-b073-7db7964e6a65","source":"wordfence","cve":"CVE-2023-35779","title":"Seed Fonts 2.3.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57953bab-7430-4841-b073-7db7964e6a65?source=api-prod","affected":[{"type":"plugin","slug":"seed-fonts","name":"Seed Fonts","from":"2.3.1","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57969f04-4758-4e62-8fbb-7b14629321d6","source":"wordfence","cve":"CVE-2022-0254","title":"Zero Spam <= 5.2.10 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57969f04-4758-4e62-8fbb-7b14629321d6?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":true,"patched_in":"5.2.11"}],"published":"2022-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5797e529-5109-49bf-a687-e5bf8f350c8f","source":"wordfence","cve":"CVE-2026-4935","title":"OttoKit: All-in-One Automation Platform < 1.1.23 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5797e529-5109-49bf-a687-e5bf8f350c8f?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":false,"patched_in":"1.1.23"}],"published":"2026-05-11T00:00:00Z","updated":"2026-05-11T20:26:56Z"},{"id":"wordfence:5798de72-b589-4474-82b2-df6ef26325a3","source":"wordfence","cve":"CVE-2023-25449","title":"cformsII <= 15.0.4 - Cross-Site Request Forgery leading to Settings Updates","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5798de72-b589-4474-82b2-df6ef26325a3?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.0.4","to_inclusive":true,"patched_in":"15.0.5"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:579b6eb0-dbb7-4586-aecc-f295889a2b2b","source":"wordfence","cve":"CVE-2025-12646","title":"Community Events <= 1.5.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/579b6eb0-dbb7-4586-aecc-f295889a2b2b?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-11-18T17:29:03Z","updated":"2025-11-19T05:45:13Z"},{"id":"wordfence:579b887a-4140-4e12-9a9a-ba52d212b8a2","source":"wordfence","cve":"CVE-2023-48323","title":"Awesome Support <= 6.1.4 - Cross-Site Request Forgery via wpas_edit_reply_ajax()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/579b887a-4140-4e12-9a9a-ba52d212b8a2?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a12c21-4a5d-4fbd-8720-93e78164f216","source":"wordfence","cve":"CVE-2021-24244","title":"WPBakery Page Builder Clipboard < 4.5.8 - Arbitrary License Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a12c21-4a5d-4fbd-8720-93e78164f216?source=api-prod","affected":[{"type":"plugin","slug":"vc_clipboard","name":"WPBakery Page Builder Clipboard","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":false,"patched_in":"4.5.8"}],"published":"2021-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a39691-8fff-4e62-a03a-70b428025d77","source":"wordfence","cve":"CVE-2022-1694","title":"Useful Banner Manager <= 1.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a39691-8fff-4e62-a03a-70b428025d77?source=api-prod","affected":[{"type":"plugin","slug":"useful-banner-manager","name":"Useful Banner Manager","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a5b6d9-92dc-488a-a3f2-b3c09361aefe","source":"wordfence","cve":"CVE-2019-20203","title":"Postie <= 1.9.40 - Post Submission Spoofing & Stored Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a5b6d9-92dc-488a-a3f2-b3c09361aefe?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.9.41","to_inclusive":false,"patched_in":"1.9.41"}],"published":"2020-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a68d4a-4857-4631-8863-6ff847490ef5","source":"wordfence","cve":"CVE-2014-4597","title":"WordPress Social Invitations \u2013 Lite <= 1.4.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a68d4a-4857-4631-8863-6ff847490ef5?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-invitations","name":"WordPress Social Invitations \u2013 Lite","from":"*","from_inclusive":true,"to":"1.4.4.2","to_inclusive":true,"patched_in":"1.4.4.3"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a6eaad-920a-487c-9e22-99caf0262b05","source":"wordfence","cve":"CVE-2025-22772","title":"Mapbox for WP Advanced <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a6eaad-920a-487c-9e22-99caf0262b05?source=api-prod","affected":[{"type":"plugin","slug":"mapbox-for-wp-advanced","name":"Mapbox for WP Advanced","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-14T15:35:50Z"},{"id":"wordfence:57a78696-5892-4621-992f-5e4a7d8fa965","source":"wordfence","cve":"CVE-2024-11707","title":"My auctions allegro <= 3.6.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a78696-5892-4621-992f-5e4a7d8fa965?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.17","to_inclusive":true,"patched_in":"3.6.18"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T07:34:58Z"},{"id":"wordfence:57a7a8cc-6a59-4e92-8e14-36e2550b0f51","source":"wordfence","cve":"CVE-2025-32640","title":"One Click Accessibility <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a7a8cc-6a59-4e92-8e14-36e2550b0f51?source=api-prod","affected":[{"type":"plugin","slug":"pojo-accessibility","name":"Web Accessibility (formally known as Ally) \u2013 WCAG Scanning, Guided Fixes, Usability Widget","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-21T14:28:19Z"},{"id":"wordfence:57a81776-643d-4057-9d81-b79ad396cced","source":"wordfence","cve":"","title":"RokNewsPager <= 1.17 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a81776-643d-4057-9d81-b79ad396cced?source=api-prod","affected":[{"type":"plugin","slug":"wp_roknewspager","name":"RokNewsPager","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57a962c9-f909-4410-a244-82e557ef1695","source":"wordfence","cve":"CVE-2025-58964","title":"Enzy < 1.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57a962c9-f909-4410-a244-82e557ef1695?source=api-prod","affected":[{"type":"theme","slug":"enzy","name":"Enzy - Multipurpose WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T15:19:30Z"},{"id":"wordfence:57aacffa-0f49-4a33-ae40-d1c151363284","source":"wordfence","cve":"CVE-2024-0626","title":"WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57aacffa-0f49-4a33-ae40-d1c151363284?source=api-prod","affected":[{"type":"plugin","slug":"woo-clover-gateway-by-zaytech","name":"Clover Payment Gateway by Zaytech for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-03-22T00:00:00Z","updated":"2024-07-29T21:36:23Z"},{"id":"wordfence:57ad3525-3257-4727-ba07-468bf13a94e2","source":"wordfence","cve":"CVE-2025-6721","title":"Vchasno Kasa <= 1.0.3 - Missing Authorization to Unauthenticated Invoice Generation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ad3525-3257-4727-ba07-468bf13a94e2?source=api-prod","affected":[{"type":"plugin","slug":"mrkv-vchasno-kasa","name":"MORKVA Vchasno Kasa Integration","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-07-18T00:00:00Z","updated":"2025-07-19T05:32:09Z"},{"id":"wordfence:57aea77c-fa81-4c5a-ade1-cc2eb511fcb2","source":"wordfence","cve":"CVE-2025-27347","title":"Direct Checkout Button for WooCommerce <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57aea77c-fa81-4c5a-ade1-cc2eb511fcb2?source=api-prod","affected":[{"type":"plugin","slug":"woo-direct-checkout-button","name":"Direct Checkout Button for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:17:14Z"},{"id":"wordfence:57b3eef3-e165-45ac-89d7-2a2a6529b310","source":"wordfence","cve":"CVE-2023-4645","title":"Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57b3eef3-e165-45ac-89d7-2a2a6529b310?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.30","to_inclusive":true,"patched_in":"2.7.31"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57b7b171-cd25-4bcd-aa75-3ccbfbb1452a","source":"wordfence","cve":"CVE-2026-2593","title":"Greenshift \u2013 animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57b7b171-cd25-4bcd-aa75-3ccbfbb1452a?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.5","to_inclusive":true,"patched_in":"12.8.6"}],"published":"2026-03-05T08:57:22Z","updated":"2026-03-05T21:24:06Z"},{"id":"wordfence:57b97d58-28b6-4d50-81b5-a35c0b8cb180","source":"wordfence","cve":"CVE-2025-31070","title":"HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57b97d58-28b6-4d50-81b5-a35c0b8cb180?source=api-prod","affected":[{"type":"plugin","slug":"lbg-cleverbakery","name":"HTML5 Radio Player - WPBakery Page Builder Addon","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T15:59:36Z"},{"id":"wordfence:57bbc2f3-8d31-4e73-a7f8-569109311b94","source":"wordfence","cve":"CVE-2025-31419","title":"Churel <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57bbc2f3-8d31-4e73-a7f8-569109311b94?source=api-prod","affected":[{"type":"theme","slug":"churel","name":"Churel","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:29:03Z"},{"id":"wordfence:57bbf56a-805d-4081-901a-4a0594c84336","source":"wordfence","cve":"","title":"WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Event Handler Bindings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57bbf56a-805d-4081-901a-4a0594c84336?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T17:51:12Z"},{"id":"wordfence:57be3e10-6920-4ad8-b9cf-cf5a703ca373","source":"wordfence","cve":"CVE-2022-4488","title":"Widgets on Pages <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57be3e10-6920-4ad8-b9cf-cf5a703ca373?source=api-prod","affected":[{"type":"plugin","slug":"widgets-on-pages","name":"Widgets on Pages","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57be47e2-9aac-42bd-af6a-5060d2f86449","source":"wordfence","cve":"","title":"User Activity Log <= 1.4.6 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57be47e2-9aac-42bd-af6a-5060d2f86449?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57be67fd-8485-495f-b5e9-6eb52af945b7","source":"wordfence","cve":"CVE-2025-5395","title":"WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57be67fd-8485-495f-b5e9-6eb52af945b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.115.0","to_inclusive":true,"patched_in":"3.116.0"}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-11T06:39:47Z"},{"id":"wordfence:57be90d8-dab7-49c8-bcdf-32e967ee1716","source":"wordfence","cve":"CVE-2020-13693","title":"bbPress <= 2.6.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57be90d8-dab7-49c8-bcdf-32e967ee1716?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57becd55-808e-49e6-93f3-2e380c494c5f","source":"wordfence","cve":"CVE-2025-31094","title":"WP Posts Carousel <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57becd55-808e-49e6-93f3-2e380c494c5f?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-carousel","name":"CCI Posts Carousel All In One","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T21:00:17Z"},{"id":"wordfence:57bf222b-5f49-46e2-be84-3e6444807096","source":"wordfence","cve":"CVE-2024-4489","title":"Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57bf222b-5f49-46e2-be84-3e6444807096?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.976","to_inclusive":true,"patched_in":"1.3.977"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T06:52:23Z"},{"id":"wordfence:57c0f95c-6d5c-4c78-8eff-cbfd9857b62a","source":"wordfence","cve":"CVE-2026-28032","title":"Tuning <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57c0f95c-6d5c-4c78-8eff-cbfd9857b62a?source=api-prod","affected":[{"type":"theme","slug":"tuning","name":"Tuning","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:07:27Z"},{"id":"wordfence:57c14da1-b57c-4425-bacc-f864d237ce10","source":"wordfence","cve":"CVE-2024-37116","title":"Sinatra <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57c14da1-b57c-4425-bacc-f864d237ce10?source=api-prod","affected":[{"type":"theme","slug":"sinatra","name":"Sinatra","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-06-20T00:00:00Z","updated":"2026-05-19T17:43:26Z"},{"id":"wordfence:57c48d67-b936-4a62-ae6a-7b57b9dbf7c3","source":"wordfence","cve":"CVE-2026-124752","title":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57c48d67-b936-4a62-ae6a-7b57b9dbf7c3?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"10.0.3","to_inclusive":true,"patched_in":"10.0.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:27Z"},{"id":"wordfence:57c64bb5-4849-4166-9792-c079b9cbbc17","source":"wordfence","cve":"CVE-2026-89100","title":"Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57c64bb5-4849-4166-9792-c079b9cbbc17?source=api-prod","affected":[{"type":"plugin","slug":"woo-stripe-payment","name":"Payment Plugins for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"4.0.18"}],"published":"2026-10-09T17:46:29Z","updated":"2026-10-10T06:40:11Z"},{"id":"wordfence:57c9bdaa-ae79-4cd8-a491-b9126d460f0f","source":"wordfence","cve":"CVE-2026-115593","title":"Unlimited Elements for Elementor <= 2.0.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57c9bdaa-ae79-4cd8-a491-b9126d460f0f?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.24","to_inclusive":true,"patched_in":"2.0.25"}],"published":"2026-10-26T12:29:27Z","updated":"2026-11-03T19:26:46Z"},{"id":"wordfence:57caddaa-c548-4f07-ab34-327df62951b5","source":"wordfence","cve":"CVE-2022-41978","title":"Zoho CRM Lead Magnet  <= 1.7.5.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57caddaa-c548-4f07-ab34-327df62951b5?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.7.5.8","to_inclusive":true,"patched_in":"1.7.5.9"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57cc15a6-2cf5-481f-bb81-ada48aa74009","source":"wordfence","cve":"CVE-2024-1538","title":"File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57cc15a6-2cf5-481f-bb81-ada48aa74009?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2024-03-20T00:00:00Z","updated":"2024-03-21T03:32:43Z"},{"id":"wordfence:57ccea1b-d579-444e-a7e6-ae1ed218ea59","source":"wordfence","cve":"CVE-2026-109995","title":"Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ccea1b-d579-444e-a7e6-ae1ed218ea59?source=api-prod","affected":[{"type":"plugin","slug":"acf-views","name":"Advanced Views \u2013 Display Framework \u2013 Gutenberg/Elementor/Shortcode","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-10-26T21:41:35Z","updated":"2026-10-27T11:32:03Z"},{"id":"wordfence:57cef1ed-f225-41b6-8cd2-d40175a48838","source":"wordfence","cve":"CVE-2024-51891","title":"Official SalesWizard CRM Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57cef1ed-f225-41b6-8cd2-d40175a48838?source=api-prod","affected":[{"type":"plugin","slug":"official-saleswizard-crm","name":"Official SalesWizard CRM","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-10T17:41:05Z"},{"id":"wordfence:57cf8128-abac-4d5e-bec1-0bd4b6d1bdc6","source":"wordfence","cve":"CVE-2026-108475","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57cf8128-abac-4d5e-bec1-0bd4b6d1bdc6?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2026-10-12T17:09:00Z","updated":"2026-10-13T14:03:43Z"},{"id":"wordfence:57cfe4d4-e49f-483a-9d8a-de31d14b6c0e","source":"wordfence","cve":"CVE-2026-13700","title":"WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57cfe4d4-e49f-483a-9d8a-de31d14b6c0e?source=api-prod","affected":[{"type":"plugin","slug":"wooms","name":"WooMS","from":"*","from_inclusive":true,"to":"9.14","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T21:00:03Z"},{"id":"wordfence:57d0991b-f10e-4ab8-a8a2-55bf708eefee","source":"wordfence","cve":"CVE-2019-11872","title":"Hustle <= 6.0.7 - Unauthenticated CSV Injection","severity":"high","cvss":7.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d0991b-f10e-4ab8-a8a2-55bf708eefee?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8.1"}],"published":"2019-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57d2ac19-812a-4a64-815b-bc3fffe8af26","source":"wordfence","cve":"CVE-2021-38330","title":"Yet Another bol.com - <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d2ac19-812a-4a64-815b-bc3fffe8af26?source=api-prod","affected":[{"type":"plugin","slug":"yabp","name":"Yet Another bol.com Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57d3506c-8db8-4e1b-9587-7f2bdb632890","source":"wordfence","cve":"CVE-2023-2654","title":"Conditional Menus <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d3506c-8db8-4e1b-9587-7f2bdb632890?source=api-prod","affected":[{"type":"plugin","slug":"conditional-menus","name":"Conditional Menus","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57d863b9-d544-4af5-afbe-268635a8dd98","source":"wordfence","cve":"CVE-2013-6992","title":"AskApache Firefox Adsense <= 3.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d863b9-d544-4af5-afbe-268635a8dd98?source=api-prod","affected":[{"type":"plugin","slug":"askapache-firefox-adsense","name":"AskApache Firefox Adsense","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2013-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57d90ba7-b655-4655-981c-548ff96c3bb7","source":"wordfence","cve":"CVE-2024-4135","title":"WP Latest Posts <= 5.0.7  - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d90ba7-b655-4655-981c-548ff96c3bb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-latest-posts","name":"WP Latest Posts","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-08T09:31:35Z"},{"id":"wordfence:57d9b98d-34c3-4bbf-af9a-e93835857e2d","source":"wordfence","cve":"CVE-2024-49267","title":"Unlimited Addon For Elementor <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57d9b98d-34c3-4bbf-af9a-e93835857e2d?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-addon-for-elementor","name":"Unlimited Addon For Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:10:09Z"},{"id":"wordfence:57dac6de-545f-49e5-9f45-d90a48d6b05f","source":"wordfence","cve":"CVE-2024-1293","title":"Brizy \u2013 Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57dac6de-545f-49e5-9f45-d90a48d6b05f?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.40","to_inclusive":true,"patched_in":"2.4.41"}],"published":"2024-02-23T00:00:00Z","updated":"2024-05-31T15:30:21Z"},{"id":"wordfence:57dbafe8-dcb3-4ac9-ad5e-76baf1963850","source":"wordfence","cve":"CVE-2025-5936","title":"VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57dbafe8-dcb3-4ac9-ad5e-76baf1963850?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T19:04:46Z","updated":"2025-06-27T07:22:23Z"},{"id":"wordfence:57dc62f4-745b-4189-8469-baf98a24134c","source":"wordfence","cve":"CVE-2026-104119","title":"Simple Shopping Cart <= 5.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57dc62f4-745b-4189-8469-baf98a24134c?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T12:40:09Z"},{"id":"wordfence:57dc6ca5-6e6b-4364-9b82-31fe108fece8","source":"wordfence","cve":"CVE-2024-49248","title":"Ad Inserter <= 2.7.37 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57dc6ca5-6e6b-4364-9b82-31fe108fece8?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.37","to_inclusive":true,"patched_in":"2.7.38"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:50:51Z"},{"id":"wordfence:57dda8e6-54d1-41db-a54d-4a5d635e23b7","source":"wordfence","cve":"CVE-2023-28169","title":"Easy Event calendar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57dda8e6-54d1-41db-a54d-4a5d635e23b7?source=api-prod","affected":[{"type":"plugin","slug":"easy-event-calendar","name":"Easy Event calendar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57e37b16-230c-4cb5-96f7-4d5c20535e06","source":"wordfence","cve":"CVE-2025-49901","title":"Simple Link Directory < 14.8.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e37b16-230c-4cb5-96f7-4d5c20535e06?source=api-prod","affected":[{"type":"plugin","slug":"qc-simple-link-directory","name":"Simple Link Directory Pro","from":"*","from_inclusive":true,"to":"14.8.1","to_inclusive":false,"patched_in":"14.8.1"}],"published":"2025-07-11T00:00:00Z","updated":"2025-11-04T15:57:20Z"},{"id":"wordfence:57e6a355-9bde-4a85-9556-6885530306dc","source":"wordfence","cve":"CVE-2026-75793","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.0 - Unauthorized WordPress Account Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e6a355-9bde-4a85-9556-6885530306dc?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":false,"patched_in":"4.7.0"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-09T13:46:38Z"},{"id":"wordfence:57e6c1e1-efc4-4fef-b6c0-7657d21d61a4","source":"wordfence","cve":"CVE-2024-10631","title":"Countdown Timer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e6c1e1-efc4-4fef-b6c0-7657d21d61a4?source=api-prod","affected":[{"type":"plugin","slug":"countdown-timer-block","name":"Countdown Timer for WordPress Block Editor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2025-05-27T15:06:38Z"},{"id":"wordfence:57e724ac-8e7d-45ec-9f41-4303ea6c5d30","source":"wordfence","cve":"CVE-2019-12517","title":"SlickQuiz <= 1.3.7.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e724ac-8e7d-45ec-9f41-4303ea6c5d30?source=api-prod","affected":[{"type":"plugin","slug":"slickquiz","name":"SlickQuiz","from":"*","from_inclusive":true,"to":"1.3.7.1","to_inclusive":true,"patched_in":""}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57e84624-98ab-495b-b985-908302527b3a","source":"wordfence","cve":"CVE-2024-4312","title":"Soccer Engine \u2013 Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e84624-98ab-495b-b985-908302527b3a?source=api-prod","affected":[{"type":"plugin","slug":"soccer-engine-lite","name":"Soccer Engine \u2013 Soccer Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:27Z"},{"id":"wordfence:57e9b09c-adfb-4fc2-8d2b-41cfc1f73e22","source":"wordfence","cve":"CVE-2023-50891","title":"Zoho Forms <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57e9b09c-adfb-4fc2-8d2b-41cfc1f73e22?source=api-prod","affected":[{"type":"plugin","slug":"zoho-forms","name":"Zoho Forms \u2013 Drag & Drop Form Builder for Websites \u2013 Contact Forms, Payment Forms, Order Forms & More","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57ea02c2-4399-46d7-b17e-9dcefb7576e8","source":"wordfence","cve":"CVE-2025-31551","title":"Salesmate Add-On for Gravity Forms <= 2.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ea02c2-4399-46d7-b17e-9dcefb7576e8?source=api-prod","affected":[{"type":"plugin","slug":"gf-salesmate-add-on","name":"Salesmate Add-On for Gravity Forms","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-03-31T00:00:00Z","updated":"2025-05-21T13:58:53Z"},{"id":"wordfence:57ebde8e-dd1f-4a33-9c7b-6c9e2060d1ef","source":"wordfence","cve":"CVE-2022-1684","title":"CUBE SLIDER <= 1.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ebde8e-dd1f-4a33-9c7b-6c9e2060d1ef?source=api-prod","affected":[{"type":"plugin","slug":"cube-slider","name":"CUBE SLIDER","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57ed6c7e-ca8d-476d-adce-905b2cd2eda8","source":"wordfence","cve":"CVE-2024-4449","title":"Essential Addons for Elementor  <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ed6c7e-ca8d-476d-adce-905b2cd2eda8?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.9.20"}],"published":"2024-05-09T19:27:26Z","updated":"2024-05-10T07:33:38Z"},{"id":"wordfence:57ed9593-787c-41c0-abad-c70459e1d128","source":"wordfence","cve":"CVE-2016-11007","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ed9593-787c-41c0-abad-c70459e1d128?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57ef2e79-08b7-4e2a-ae63-957d197e24ac","source":"wordfence","cve":"CVE-2024-0780","title":"Enjoy Social Feed plugin for WordPress website <= 6.2.2 - Missing Authorization to Database Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ef2e79-08b7-4e2a-ae63-957d197e24ac?source=api-prod","affected":[{"type":"plugin","slug":"enjoy-instagram-instagram-responsive-images-gallery-and-carousel","name":"Enjoy Social Feed plugin for WordPress website","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-04-24T14:25:08Z"},{"id":"wordfence:57ef5302-3cf3-4253-8b25-54c09ad872ed","source":"wordfence","cve":"CVE-2025-27323","title":"WP About Author <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ef5302-3cf3-4253-8b25-54c09ad872ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-about-author","name":"WP About Author","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-02-24T00:00:00Z","updated":"2025-05-23T13:34:26Z"},{"id":"wordfence:57f09da9-0d2c-45db-b3ed-19a7c9f5a001","source":"wordfence","cve":"CVE-2025-14045","title":"URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57f09da9-0d2c-45db-b3ed-19a7c9f5a001?source=api-prod","affected":[{"type":"plugin","slug":"url-media-uploader","name":"URL Media Uploader","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:28:59Z","updated":"2025-12-12T03:20:44Z"},{"id":"wordfence:57f413f2-8fca-4472-9658-7aac4657033c","source":"wordfence","cve":"CVE-2025-57979","title":"AuthorSure <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57f413f2-8fca-4472-9658-7aac4657033c?source=api-prod","affected":[{"type":"plugin","slug":"authorsure","name":"AuthorSure","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:10:35Z"},{"id":"wordfence:57f56362-da35-44ae-b1f5-4f5a6c21930e","source":"wordfence","cve":"CVE-2021-24491","title":"Fileviewer <= 2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57f56362-da35-44ae-b1f5-4f5a6c21930e?source=api-prod","affected":[{"type":"plugin","slug":"fileviewer","name":"Fileviewer","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2021-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:57f70dac-9439-4f70-8a73-6ffefcaefa22","source":"wordfence","cve":"CVE-2024-54412","title":"ECT Product Carousel <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57f70dac-9439-4f70-8a73-6ffefcaefa22?source=api-prod","affected":[{"type":"plugin","slug":"ect-product-carousel","name":"ECT Product Carousel","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:37:11Z"},{"id":"wordfence:57f77795-57bc-4448-baf1-b9da6b0c61b7","source":"wordfence","cve":"CVE-2025-23869","title":"CJ Custom Content <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57f77795-57bc-4448-baf1-b9da6b0c61b7?source=api-prod","affected":[{"type":"plugin","slug":"cj-custom-content","name":"CJ Custom Content","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:48:13Z"},{"id":"wordfence:57ff8e0b-92cd-49e1-9db7-91c970282e21","source":"wordfence","cve":"CVE-2025-9880","title":"Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/57ff8e0b-92cd-49e1-9db7-91c970282e21?source=api-prod","affected":[{"type":"plugin","slug":"side-slide-responsive-menu","name":"Side Slide Responsive Menu","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T14:48:27Z","updated":"2025-09-12T03:22:44Z"},{"id":"wordfence:5802226f-95f0-4c79-b434-0f74c1f47f1a","source":"wordfence","cve":"CVE-2024-53806","title":"Maspik \u2013 Spam blacklist <= 2.2.7 - Cross-Site Request Forgery to Plugin Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5802226f-95f0-4c79-b434-0f74c1f47f1a?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T20:16:17Z"},{"id":"wordfence:5804b9da-11cd-4cb4-aa92-2c9e90aa527f","source":"wordfence","cve":"CVE-2010-4257","title":"WordPress Core <= 3.0.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5804b9da-11cd-4cb4-aa92-2c9e90aa527f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2010-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5804da94-1dee-47f8-930b-c5413d5506b9","source":"wordfence","cve":"","title":"Direct Download for Woocommerce < 1.16 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5804da94-1dee-47f8-930b-c5413d5506b9?source=api-prod","affected":[{"type":"plugin","slug":"directdownload","name":"Direct Download for Woocommerce","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":false,"patched_in":"1.16"}],"published":"2017-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:580571ec-d186-47f7-b01e-fc64107a81e6","source":"wordfence","cve":"CVE-2026-96530","title":"Optimole 4.0.0 - 4.2.14 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/580571ec-d186-47f7-b01e-fc64107a81e6?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"4.0.0","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"4.2.15"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T00:10:06Z"},{"id":"wordfence:5805b1f1-34e7-49d5-93dd-748113b6093b","source":"wordfence","cve":"CVE-2026-13245","title":"MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5805b1f1-34e7-49d5-93dd-748113b6093b?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.8.5","to_inclusive":true,"patched_in":"9.8.6"}],"published":"2026-06-26T00:00:00Z","updated":"2026-09-22T18:43:24Z"},{"id":"wordfence:58063939-5d44-4369-a0f6-c7f1b0271c44","source":"wordfence","cve":"CVE-2026-59550","title":"AWP Classifieds <= 4.4.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58063939-5d44-4369-a0f6-c7f1b0271c44?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:22:23Z"},{"id":"wordfence:5808b671-7795-4a1a-8c8c-b64a3d0db378","source":"wordfence","cve":"CVE-2024-51602","title":"Simple Job Manager <= 1.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5808b671-7795-4a1a-8c8c-b64a3d0db378?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-manager","name":"Simple Job Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:40:53Z"},{"id":"wordfence:580ae2da-76f2-42b3-a26c-62ad8d6d1686","source":"wordfence","cve":"CVE-2024-13800","title":"Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/580ae2da-76f2-42b3-a26c-62ad8d6d1686?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.5.30","to_inclusive":true,"patched_in":"3.5.31"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:16Z"},{"id":"wordfence:580f5cd1-2cda-4e8e-81b5-36ce39ebd907","source":"wordfence","cve":"","title":"Zarzadzanie Kontem (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/580f5cd1-2cda-4e8e-81b5-36ce39ebd907?source=api-prod","affected":[{"type":"plugin","slug":"zarzadzanie_kontem","name":"Zarzadzanie Kontem","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5811e36d-9457-4460-af92-046ddef41114","source":"wordfence","cve":"CVE-2024-29806","title":"ReDi Restaurant Reservation <= 24.0128 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5811e36d-9457-4460-af92-046ddef41114?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.0128","to_inclusive":true,"patched_in":"24.0303"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:44:49Z"},{"id":"wordfence:5811fc63-da34-43cb-ae33-a34a8795bb72","source":"wordfence","cve":"CVE-2023-48774","title":"IdeaPush <= 8.57 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5811fc63-da34-43cb-ae33-a34a8795bb72?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.57","to_inclusive":true,"patched_in":"8.58"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5817384f-1626-4393-a879-931fe7e551f1","source":"wordfence","cve":"CVE-2026-2425","title":"hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5817384f-1626-4393-a879-931fe7e551f1?source=api-prod","affected":[{"type":"plugin","slug":"hiweb-migration-simple","name":"hiWeb Migration Simple","from":"*","from_inclusive":true,"to":"2.0.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:52Z","updated":"2026-06-02T07:48:30Z"},{"id":"wordfence:581792f3-7b57-418c-802b-2ff04f5b83bf","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/581792f3-7b57-418c-802b-2ff04f5b83bf?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:581e1d70-0280-443b-b319-7047325866e4","source":"wordfence","cve":"CVE-2025-23514","title":"Loginplus <= 1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/581e1d70-0280-443b-b319-7047325866e4?source=api-prod","affected":[{"type":"plugin","slug":"loginplus","name":"Loginplus","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:15:09Z"},{"id":"wordfence:581e6686-a103-43f6-aa99-6a9862d98837","source":"wordfence","cve":"CVE-2024-3610","title":"WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/581e6686-a103-43f6-aa99-6a9862d98837?source=api-prod","affected":[{"type":"plugin","slug":"wp-child-theme-generator","name":"WP Child Theme Generator","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T02:05:43Z"},{"id":"wordfence:58209530-9e68-4d2c-a723-e6a164db7f46","source":"wordfence","cve":"CVE-2024-12170","title":"ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58209530-9e68-4d2c-a723-e6a164db7f46?source=api-prod","affected":[{"type":"plugin","slug":"viewmedica","name":"ViewMedica 9","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":"1.4.18"}],"published":"2025-01-06T15:39:41Z","updated":"2025-11-05T19:04:20Z"},{"id":"wordfence:5825deef-3bfa-4249-a3df-f05d00ef4a7e","source":"wordfence","cve":"CVE-2026-16605","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions < 5.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5825deef-3bfa-4249-a3df-f05d00ef4a7e?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":false,"patched_in":"5.0.11"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:20:41Z"},{"id":"wordfence:5827a095-4cf9-409e-8bbd-b414982836b6","source":"wordfence","cve":"CVE-2026-39653","title":"Video Conferencing with Zoom <= 4.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5827a095-4cf9-409e-8bbd-b414982836b6?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.7"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-25T15:35:42Z"},{"id":"wordfence:582a536c-950e-424b-80a7-83608d220b87","source":"wordfence","cve":"CVE-2013-3261","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 2.72 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/582a536c-950e-424b-80a7-83608d220b87?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.71","to_inclusive":true,"patched_in":"2.72"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:582e15cb-b924-4c24-818e-dfc2900f82c3","source":"wordfence","cve":"CVE-2026-10628","title":"Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/582e15cb-b924-4c24-818e-dfc2900f82c3?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2026-07-10T14:00:22Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:582e2896-d800-4d73-8cef-8af76cba1ba8","source":"wordfence","cve":"","title":"DZS Video Gallery < 7.95 - Limited Local File Inclusion","severity":"medium","cvss":5.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/582e2896-d800-4d73-8cef-8af76cba1ba8?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"7.95","to_inclusive":false,"patched_in":"7.95"}],"published":"2014-09-27T00:00:00Z","updated":"2026-02-25T18:33:38Z"},{"id":"wordfence:582fa92d-8e52-49a9-94ce-f1b49229f591","source":"wordfence","cve":"CVE-2026-6251","title":"Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/582fa92d-8e52-49a9-94ce-f1b49229f591?source=api-prod","affected":[{"type":"plugin","slug":"chaty-pro","name":"Chaty Pro","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2026-07-27T16:37:23Z","updated":"2026-07-28T05:39:42Z"},{"id":"wordfence:58300545-3e53-49be-bf55-eaf3e4cd82e9","source":"wordfence","cve":"CVE-2020-28032","title":"WordPress Core < 5.5.2 - Deserialization Gadget","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58300545-3e53-49be-bf55-eaf3e4cd82e9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58337bbc-ba10-4876-b91c-78657afc67d1","source":"wordfence","cve":"CVE-2026-3155","title":"OneSignal \u2013 Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58337bbc-ba10-4876-b91c-78657afc67d1?source=api-prod","affected":[{"type":"plugin","slug":"onesignal-free-web-push-notifications","name":"OneSignal \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-04-15T21:51:29Z","updated":"2026-04-16T18:25:41Z"},{"id":"wordfence:58354ce0-e166-431a-9fac-6c6d81e39e88","source":"wordfence","cve":"CVE-2023-2529","title":"Enable SVG Uploads <= 2.1.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58354ce0-e166-431a-9fac-6c6d81e39e88?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-uploads","name":"Enable SVG Uploads","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5835aed6-510c-4241-b957-462a400e3fa9","source":"wordfence","cve":"CVE-2026-103329","title":"Super Payments <= 1.43.0 - Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5835aed6-510c-4241-b957-462a400e3fa9?source=api-prod","affected":[{"type":"plugin","slug":"super-payments","name":"Super Payments \u2013 WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"1.43.0","to_inclusive":true,"patched_in":"1.43.1"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T19:09:59Z"},{"id":"wordfence:5835fed0-5b9d-47b5-82ae-f0f19830ae2a","source":"wordfence","cve":"CVE-2023-27459","title":"User Registration <= 2.3.2.1 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5835fed0-5b9d-47b5-82ae-f0f19830ae2a?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"2.3.2.1","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58386353-93f5-4b87-8c72-c1b1341b884c","source":"wordfence","cve":"CVE-2025-27318","title":"Simple Google Sitemap <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58386353-93f5-4b87-8c72-c1b1341b884c?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-sitemap","name":"Simple Google Sitemap","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:42:07Z"},{"id":"wordfence:58387a60-ef68-4911-9349-97b0f7e7726f","source":"wordfence","cve":"CVE-2024-9601","title":"Qubely \u2013 Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58387a60-ef68-4911-9349-97b0f7e7726f?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2025-02-13T18:36:16Z","updated":"2025-02-18T21:07:53Z"},{"id":"wordfence:583b5cd7-a33e-41d0-a389-ac36679d5f22","source":"wordfence","cve":"CVE-2026-2716","title":"Client Testimonial Slider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/583b5cd7-a33e-41d0-a389-ac36679d5f22?source=api-prod","affected":[{"type":"plugin","slug":"wp-client-testimonial","name":"Client Testimonial Slider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T20:59:42Z","updated":"2026-02-19T09:26:35Z"},{"id":"wordfence:5840255d-5454-445b-b876-94747d981338","source":"wordfence","cve":"CVE-2026-84829","title":"Optimole <= 4.2.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5840255d-5454-445b-b876-94747d981338?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"4.2.12"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:53:24Z"},{"id":"wordfence:58410382-8820-49e2-8dfd-87937287b8d1","source":"wordfence","cve":"CVE-2016-1000148","title":"S3 Video <= 0.983 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58410382-8820-49e2-8dfd-87937287b8d1?source=api-prod","affected":[{"type":"plugin","slug":"s3-video","name":"S3 Video Plugin","from":"*","from_inclusive":true,"to":"0.983","to_inclusive":true,"patched_in":""}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5846b5d9-5b69-47b0-b787-6a3416a5076e","source":"wordfence","cve":"CVE-2025-32607","title":"WpBookingly <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5846b5d9-5b69-47b0-b787-6a3416a5076e?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-04-10T00:00:00Z","updated":"2026-07-28T18:42:01Z"},{"id":"wordfence:58492dbb-b9e0-4477-b85d-ace06dba954c","source":"wordfence","cve":"CVE-2024-2662","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58492dbb-b9e0-4477-b85d-ace06dba954c?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.102","to_inclusive":true,"patched_in":"1.5.103"}],"published":"2024-05-09T19:02:36Z","updated":"2024-05-10T07:33:39Z"},{"id":"wordfence:5849a9f6-715e-4ac8-a0f7-1cd0814fff58","source":"wordfence","cve":"CVE-2025-47555","title":"Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5849a9f6-715e-4ac8-a0f7-1cd0814fff58?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-01-02T00:00:00Z","updated":"2026-02-03T20:22:44Z"},{"id":"wordfence:584c65d0-b9c0-4ebc-b68d-36c348bdbd0a","source":"wordfence","cve":"CVE-2025-49365","title":"Jack Well <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/584c65d0-b9c0-4ebc-b68d-36c348bdbd0a?source=api-prod","affected":[{"type":"theme","slug":"jack-well","name":"Jack Well | Elections Campaign & Political WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:21:43Z"},{"id":"wordfence:584d4517-1152-42fa-9ea9-a9e9ed8996fa","source":"wordfence","cve":"CVE-2024-9616","title":"BlockMeister \u2013 Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/584d4517-1152-42fa-9ea9-a9e9ed8996fa?source=api-prod","affected":[{"type":"plugin","slug":"blockmeister","name":"BlockMeister \u2013 Block Pattern Builder","from":"*","from_inclusive":true,"to":"3.1.10","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2024-10-10T17:59:02Z","updated":"2024-10-11T06:50:18Z"},{"id":"wordfence:58502e48-c1cf-4b94-954c-71046256c917","source":"wordfence","cve":"CVE-2023-48276","title":"WP Forms Puzzle Captcha <= 4.1 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58502e48-c1cf-4b94-954c-71046256c917?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-puzzle-captcha","name":"WP Forms Puzzle Captcha","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5850cd12-0a50-4a69-a6bb-8d2d62a28699","source":"wordfence","cve":"CVE-2025-53450","title":"Easy Pricing Table WP <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5850cd12-0a50-4a69-a6bb-8d2d62a28699?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-table-wp","name":"Easy Pricing Table WP","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:40:38Z"},{"id":"wordfence:5851b3b0-c9da-4bab-8b15-c22563063f86","source":"wordfence","cve":"CVE-2025-49438","title":"Simple Login Log <= 1.1.3 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5851b3b0-c9da-4bab-8b15-c22563063f86?source=api-prod","affected":[{"type":"plugin","slug":"simple-login-log","name":"Simple Login Log","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-17T00:00:00Z","updated":"2026-01-06T19:53:19Z"},{"id":"wordfence:5852f08d-0506-464e-afd1-c625e4034e1d","source":"wordfence","cve":"CVE-2024-10222","title":"SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5852f08d-0506-464e-afd1-c625e4034e1d?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.5.10","to_inclusive":true,"patched_in":"2.5.11"}],"published":"2025-02-21T00:37:00Z","updated":"2025-02-21T13:41:31Z"},{"id":"wordfence:5853aa0c-09cf-4af8-b75a-4ec95dfe94c3","source":"wordfence","cve":"CVE-2024-37434","title":"Atarim <= 3.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5853aa0c-09cf-4af8-b75a-4ec95dfe94c3?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.31","to_inclusive":true,"patched_in":"3.32"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:00:53Z"},{"id":"wordfence:5856ff11-7c9a-4f0f-99f1-b839c2f847e1","source":"wordfence","cve":"CVE-2026-42633","title":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more! <= 7.4.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5856ff11-7c9a-4f0f-99f1-b839c2f847e1?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.6","to_inclusive":true,"patched_in":"7.4.7"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:44:25Z"},{"id":"wordfence:585a7332-b063-463c-8077-68a860e14df2","source":"wordfence","cve":"CVE-2021-24703","title":"Download Plugin < 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/585a7332-b063-463c-8077-68a860e14df2?source=api-prod","affected":[{"type":"plugin","slug":"download-plugin","name":"Download Plugin","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:585a9eb4-f394-4cb2-9050-659171a994d9","source":"wordfence","cve":"CVE-2026-1165","title":"Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/585a9eb4-f394-4cb2-9050-659171a994d9?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-01-30T00:00:00Z","updated":"2026-01-31T14:22:30Z"},{"id":"wordfence:585aeaab-7036-4584-98b2-785a3c801cf6","source":"wordfence","cve":"CVE-2026-115956","title":"Panorama \u2013 Turn Photos into Immersive Virtual Tours <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/585aeaab-7036-4584-98b2-785a3c801cf6?source=api-prod","affected":[{"type":"plugin","slug":"panorama","name":"Panorama \u2013 Turn Photos into Immersive Virtual Tours","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2026-10-26T10:34:00Z","updated":"2026-10-28T01:25:19Z"},{"id":"wordfence:585d0368-7557-46aa-9ea3-26cd6d7df51b","source":"wordfence","cve":"","title":"SP Project & Document Manager <= 4.56 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/585d0368-7557-46aa-9ea3-26cd6d7df51b?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.56","to_inclusive":true,"patched_in":"4.57"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:585fc053-b54f-428e-9abc-9501508aef69","source":"wordfence","cve":"CVE-2017-18546","title":"Jayj Quicktag < 1.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/585fc053-b54f-428e-9abc-9501508aef69?source=api-prod","affected":[{"type":"plugin","slug":"jayj-quicktag","name":"Jayj Quicktag","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2017-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58600bea-b7c1-4235-b051-13395ebab048","source":"wordfence","cve":"CVE-2026-11366","title":"MonsterInsights <= 11.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58600bea-b7c1-4235-b051-13395ebab048?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-17T15:54:48Z"},{"id":"wordfence:5860d456-a992-4816-8c93-7311c33734e4","source":"wordfence","cve":"CVE-2025-9075","title":"ZoloBlocks \u2013 Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5860d456-a992-4816-8c93-7311c33734e4?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-01T03:25:24Z"},{"id":"wordfence:5860fe2a-edb4-4542-9a87-d0ab6819dd77","source":"wordfence","cve":"CVE-2017-2224","title":"EventCalendar < 1.0.94 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5860fe2a-edb4-4542-9a87-d0ab6819dd77?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.0.94","to_inclusive":false,"patched_in":"1.0.94"}],"published":"2017-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:586137a5-8758-400e-a66a-2382f8633578","source":"wordfence","cve":"CVE-2021-39346","title":"Google Maps Easy <= 1.9.33 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586137a5-8758-400e-a66a-2382f8633578?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.9.33","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2021-11-01T10:32:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5861584d-9bb4-4d99-9ea4-443978035dbc","source":"wordfence","cve":"CVE-2026-123666","title":"Photo Engine (Media Organizer & Lightroom) < 6.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5861584d-9bb4-4d99-9ea4-443978035dbc?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":false,"patched_in":"6.6.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:20Z"},{"id":"wordfence:586250e9-bc35-4c9d-b558-7346efd4dce9","source":"wordfence","cve":"CVE-2025-13407","title":"Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586250e9-bc35-4c9d-b558-7346efd4dce9?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.23.0","to_inclusive":true,"patched_in":"2.9.23.1"}],"published":"2025-12-03T00:00:00Z","updated":"2026-01-06T16:16:54Z"},{"id":"wordfence:5862dcc6-8daf-4046-9dff-d87cf3b3f83e","source":"wordfence","cve":"CVE-2024-50541","title":"Advanced Control Manager for WordPress by ItalyStrap <= 2.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5862dcc6-8daf-4046-9dff-d87cf3b3f83e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-control-manager","name":"Advanced Control Manager for WordPress by ItalyStrap","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:39:51Z"},{"id":"wordfence:58695d72-d78e-4e5a-8179-a5d12a80b370","source":"wordfence","cve":"CVE-2026-39581","title":"WP Sessions Time Monitoring Full Automatic <= 1.1.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58695d72-d78e-4e5a-8179-a5d12a80b370?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:03:24Z"},{"id":"wordfence:586a4d73-7d3e-4c1d-b369-76f804e555fd","source":"wordfence","cve":"CVE-2024-39623","title":"ListingPro <= 2.9.4 - Cross-Site Request Forgery to Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586a4d73-7d3e-4c1d-b369-76f804e555fd?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2026-02-26T15:16:32Z"},{"id":"wordfence:586c8952-a427-47f8-8d2d-117e527b0f74","source":"wordfence","cve":"CVE-2021-38353","title":"Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586c8952-a427-47f8-8d2d-117e527b0f74?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-and-scrollable-text","name":"Dropdown and scrollable Text","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:586fd95e-88c7-4eb8-826c-ae46a11ac21f","source":"wordfence","cve":"CVE-2026-104797","title":"Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/586fd95e-88c7-4eb8-826c-ae46a11ac21f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-10-09T15:05:51Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:5872a69d-3314-4900-8f7b-bcbd8787a9fe","source":"wordfence","cve":"","title":"Fancy Cats <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5872a69d-3314-4900-8f7b-bcbd8787a9fe?source=api-prod","affected":[{"type":"plugin","slug":"fancy-cats","name":"Fancy Cats","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58733c7a-d1fc-4864-bfac-6c29baba4c82","source":"wordfence","cve":"CVE-2026-97303","title":"Scratch & Win \u2013 Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58733c7a-d1fc-4864-bfac-6c29baba4c82?source=api-prod","affected":[{"type":"plugin","slug":"scratch-win-giveaways-for-website-facebook","name":"Scratch & Win \u2013 Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-10-03T17:46:33Z","updated":"2026-10-09T00:02:23Z"},{"id":"wordfence:5873ad24-a105-4ad0-b809-5bf13e61b0fa","source":"wordfence","cve":"CVE-2024-45457","title":"Spiffy Calendar <= 4.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5873ad24-a105-4ad0-b809-5bf13e61b0fa?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"4.9.14"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T15:56:26Z"},{"id":"wordfence:58754a10-1914-48ce-87b1-3ca566f4e894","source":"wordfence","cve":"CVE-2026-57707","title":"Simple Business Directory Pro <= 15.9.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58754a10-1914-48ce-87b1-3ca566f4e894?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-directory-pro","name":"Simple Business Directory Pro","from":"*","from_inclusive":true,"to":"15.9.4","to_inclusive":true,"patched_in":"15.9.5"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:22:58Z"},{"id":"wordfence:58756479-72f0-4c5e-8ed5-dfdbffed6026","source":"wordfence","cve":"CVE-2025-52813","title":"MobiLoud <= 4.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58756479-72f0-4c5e-8ed5-dfdbffed6026?source=api-prod","affected":[{"type":"plugin","slug":"mobiloud-mobile-app-plugin","name":"MobiLoud \u2013 WordPress Mobile Apps \u2013 Convert your WordPress Website to Native Mobile Apps","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.6.1"}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-17T17:02:45Z"},{"id":"wordfence:5875a4c2-a309-41fb-8845-2935511ec6c0","source":"wordfence","cve":"","title":"UnGallery < 2.1.6 - Command Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5875a4c2-a309-41fb-8845-2935511ec6c0?source=api-prod","affected":[{"type":"plugin","slug":"ungallery","name":"UnGallery","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2012-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5875b5ea-6a8c-41a2-b926-0b36097fc2ae","source":"wordfence","cve":"CVE-2026-66567","title":"Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5875b5ea-6a8c-41a2-b926-0b36097fc2ae?source=api-prod","affected":[{"type":"theme","slug":"anesta","name":"Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:53:16Z","updated":"2026-10-13T14:05:55Z"},{"id":"wordfence:58799fc9-6e68-470e-be33-515c4c6b42e7","source":"wordfence","cve":"CVE-2026-114443","title":"Security by CleanTalk <= 2.190 - Unauthenticated Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58799fc9-6e68-470e-be33-515c4c6b42e7?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.190","to_inclusive":true,"patched_in":"2.191"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-04T21:32:16Z"},{"id":"wordfence:5879d001-1878-41ea-af00-6b3f608e30be","source":"wordfence","cve":"CVE-2026-54861","title":"WP Customer Area <= 8.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5879d001-1878-41ea-af00-6b3f608e30be?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:43:03Z"},{"id":"wordfence:587a2f1a-7f24-4ab2-b15f-0a022af3861e","source":"wordfence","cve":"CVE-2025-53420","title":"WPLMS <= 1.9.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587a2f1a-7f24-4ab2-b15f-0a022af3861e?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-14T00:00:00Z","updated":"2025-10-29T21:05:59Z"},{"id":"wordfence:587b53aa-2369-4433-b0f1-7f054f5a0653","source":"wordfence","cve":"CVE-2025-47648","title":"Pays \u2013 WooCommerce Payment Gateway <= 2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587b53aa-2369-4433-b0f1-7f054f5a0653?source=api-prod","affected":[{"type":"plugin","slug":"axima-payment-gateway","name":"Pays \u2013 WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-07-08T15:12:47Z"},{"id":"wordfence:587e28ea-b3f4-4e40-a7d2-c6a01ac905bf","source":"wordfence","cve":"CVE-2025-3098","title":"Video Url <= 1.0.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587e28ea-b3f4-4e40-a7d2-c6a01ac905bf?source=api-prod","affected":[{"type":"plugin","slug":"video-sidebar-widget","name":"Video Url","from":"*","from_inclusive":true,"to":"1.0.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:30:02Z","updated":"2025-04-02T09:21:43Z"},{"id":"wordfence:587e5928-9251-455b-902c-f07a4ee1d3e1","source":"wordfence","cve":"CVE-2026-15229","title":"Pinpoint Booking System <= 2.9.9.7.1 - Missing Authorization to Unauthenticated Arbitrary Booking Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587e5928-9251-455b-902c-f07a4ee1d3e1?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.7.1","to_inclusive":true,"patched_in":"2.9.9.7.2"}],"published":"2026-08-06T00:00:00Z","updated":"2026-11-05T21:08:42Z"},{"id":"wordfence:587e8fb5-6f89-45ee-959c-78f323b157b5","source":"wordfence","cve":"CVE-2026-13414","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587e8fb5-6f89-45ee-959c-78f323b157b5?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.18","to_inclusive":false,"patched_in":"4.1.18"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T15:13:22Z"},{"id":"wordfence:587eff5c-e551-4660-a1d4-11b9f1788f7d","source":"wordfence","cve":"CVE-2025-32637","title":"WP Donate <= 2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/587eff5c-e551-4660-a1d4-11b9f1788f7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-donate","name":"WP Donate","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T18:25:10Z"},{"id":"wordfence:58804f7a-51af-4199-85c9-b75b91b5c59b","source":"wordfence","cve":"CVE-2025-60143","title":"Netgsm <= 2.9.71 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58804f7a-51af-4199-85c9-b75b91b5c59b?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.9.71","to_inclusive":true,"patched_in":"2.9.72"}],"published":"2025-09-26T00:00:00Z","updated":"2026-05-26T18:17:41Z"},{"id":"wordfence:5881a375-39a1-4911-812e-1f968ad427f9","source":"wordfence","cve":"CVE-2025-31417","title":"WP Docs <= 2.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5881a375-39a1-4911-812e-1f968ad427f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-08T15:36:43Z"},{"id":"wordfence:5881d16c-84e8-4610-8233-cfa5a94fe3f9","source":"wordfence","cve":"CVE-2023-2734","title":"MStore API <= 3.9.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5881d16c-84e8-4610-8233-cfa5a94fe3f9?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58854b23-e679-4349-aa7c-4edf4008c92a","source":"wordfence","cve":"CVE-2025-8196","title":"Magical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58854b23-e679-4349-aa7c-4edf4008c92a?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-07-28T20:43:41Z","updated":"2025-07-29T09:23:47Z"},{"id":"wordfence:5886128e-e72f-4d84-8c17-1ed4a0fcc17e","source":"wordfence","cve":"CVE-2023-36679","title":"Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5886128e-e72f-4d84-8c17-1ed4a0fcc17e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5886e18b-d920-4605-8ebe-8774858789db","source":"wordfence","cve":"CVE-2026-19055","title":"ProSolution WP Client < 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5886e18b-d920-4605-8ebe-8774858789db?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-02T14:29:20Z"},{"id":"wordfence:5887cf20-dc15-45be-8573-e893d5367995","source":"wordfence","cve":"CVE-2024-37942","title":"BerqWP <= 1.7.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5887cf20-dc15-45be-8573-e893d5367995?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T14:08:02Z"},{"id":"wordfence:58884dcb-dad3-4856-aa54-c5b769d4f9e1","source":"wordfence","cve":"","title":"Use Any Font | Custom Font Uploader <= 6.2.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58884dcb-dad3-4856-aa54-c5b769d4f9e1?source=api-prod","affected":[{"type":"plugin","slug":"use-any-font","name":"Use Any Font | Custom Font Uploader","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58898db3-e3fb-4903-8121-3a438a09122a","source":"wordfence","cve":"CVE-2025-58914","title":"Di Themes Demo Site Importer <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58898db3-e3fb-4903-8121-3a438a09122a?source=api-prod","affected":[{"type":"plugin","slug":"di-themes-demo-site-importer","name":"Di Themes Demo Site Importer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-24T00:00:00Z","updated":"2025-09-29T21:01:03Z"},{"id":"wordfence:588afcb3-9bba-4514-ac58-a53bcc3521c3","source":"wordfence","cve":"CVE-2025-23507","title":"Blrt WP Embed <= 1.6.9 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/588afcb3-9bba-4514-ac58-a53bcc3521c3?source=api-prod","affected":[{"type":"plugin","slug":"blrt-wp-embed","name":"Blrt WP Embed","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:42:16Z"},{"id":"wordfence:588becbc-19a8-40bb-938a-b33b9c6d0513","source":"wordfence","cve":"CVE-2025-68843","title":"FeedWordPress Advanced Filters <= 0.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/588becbc-19a8-40bb-938a-b33b9c6d0513?source=api-prod","affected":[{"type":"plugin","slug":"faf","name":"FeedWordPress Advanced Filters","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:19:08Z"},{"id":"wordfence:588e12c4-7d68-40ac-82bc-aacc5d389dee","source":"wordfence","cve":"CVE-2026-7436","title":"WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/588e12c4-7d68-40ac-82bc-aacc5d389dee?source=api-prod","affected":[{"type":"plugin","slug":"wpc-badge-management","name":"WPC Badge Management for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-07-28T21:22:53Z","updated":"2026-07-29T09:31:14Z"},{"id":"wordfence:588ece40-a848-4b2c-9db5-e63e0d11dda0","source":"wordfence","cve":"","title":"WP e-Commerce \u2013 Store Toolkit <= 2.0.1 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/588ece40-a848-4b2c-9db5-e63e0d11dda0?source=api-prod","affected":[{"type":"plugin","slug":"store-toolkit-for-wp-e-commerce","name":"WP e-Commerce \u2013 Store Toolkit","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2016-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5890360b-e0ef-4ec2-8117-1b4004573e93","source":"wordfence","cve":"CVE-2026-65540","title":"Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5890360b-e0ef-4ec2-8117-1b4004573e93?source=api-prod","affected":[{"type":"plugin","slug":"cf7-sweet-alert-popup","name":"Popup for CF7 with Sweet Alert","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:24:42Z"},{"id":"wordfence:5890c0f1-f549-4076-9d57-74f5eaffdcb3","source":"wordfence","cve":"CVE-2026-5113","title":"Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5890c0f1-f549-4076-9d57-74f5eaffdcb3?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.30","to_inclusive":true,"patched_in":"2.9.31"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-21T20:23:26Z"},{"id":"wordfence:58967ac0-d6f7-4cc7-a2e3-4594aa4b2be2","source":"wordfence","cve":"CVE-2026-104742","title":"AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58967ac0-d6f7-4cc7-a2e3-4594aa4b2be2?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"2.4.89","to_inclusive":true,"patched_in":"2.4.90"}],"published":"2026-10-09T17:12:20Z","updated":"2026-10-10T05:30:59Z"},{"id":"wordfence:5898944f-565c-4950-83e8-ad0de0f948d1","source":"wordfence","cve":"CVE-2023-49853","title":"PayTR Taksit Tablosu <= 1.3.3 - Improper Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5898944f-565c-4950-83e8-ad0de0f948d1?source=api-prod","affected":[{"type":"plugin","slug":"paytr-taksit-tablosu-woocommerce","name":"PayTR Taksit Tablosu \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2025-05-23T14:13:48Z"},{"id":"wordfence:5898d8fb-a1b3-45a3-9e90-9cc51e42a96d","source":"wordfence","cve":"CVE-2026-19223","title":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN < 4.3.2 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5898d8fb-a1b3-45a3-9e90-9cc51e42a96d?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":false,"patched_in":"4.3.2"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T21:00:38Z"},{"id":"wordfence:589f5456-1d72-4eac-bd9b-2bedf4109daa","source":"wordfence","cve":"CVE-2025-22683","title":"NotificationX <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/589f5456-1d72-4eac-bd9b-2bedf4109daa?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:46:33Z"},{"id":"wordfence:589fa6f2-fa60-4bdc-9692-50d5591ceb93","source":"wordfence","cve":"","title":"FlipBook <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/589fa6f2-fa60-4bdc-9692-50d5591ceb93?source=api-prod","affected":[{"type":"plugin","slug":"flipbook","name":"FlipBook","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58a0ccf5-8b2b-47d8-abe6-6f60fcb41e7a","source":"wordfence","cve":"CVE-2026-7850","title":"Magnific Popup <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58a0ccf5-8b2b-47d8-abe6-6f60fcb41e7a?source=api-prod","affected":[{"type":"plugin","slug":"wp-magnific-popup","name":"WP Magnific Popup","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-09-18T14:48:22Z"},{"id":"wordfence:58a1f3a1-e00c-4b63-83ad-73205c67c0ac","source":"wordfence","cve":"","title":"eBay Dropshipping and Affiliate by Wooshark <= 1.5.6 - Unprotected AJAX Actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58a1f3a1-e00c-4b63-83ad-73205c67c0ac?source=api-prod","affected":[{"type":"plugin","slug":"woo-reviews-manager","name":"eBay Dropshipping and Affiliate by Wooshark","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58a4cb88-033e-48f4-b6fa-2a9754ab6a7f","source":"wordfence","cve":"CVE-2017-2245","title":"WordPress Shortcodes Plugin \u2014 Shortcodes Ultimate < 4.10.0 - Directory Traversal","severity":"medium","cvss":5.0,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58a4cb88-033e-48f4-b6fa-2a9754ab6a7f?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":false,"patched_in":"4.10.0"}],"published":"2017-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58a83ec8-e294-4fb6-9f1a-19562b2e499d","source":"wordfence","cve":"","title":"School Management System \u2013 WPSchoolPress < 2.1.10 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58a83ec8-e294-4fb6-9f1a-19562b2e499d?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":false,"patched_in":"2.1.10"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58ab78f2-199b-44e8-9213-8c46025b55fb","source":"wordfence","cve":"CVE-2025-68864","title":"Infility Global <= 2.15.36 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58ab78f2-199b-44e8-9213-8c46025b55fb?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.36","to_inclusive":true,"patched_in":"2.15.37"}],"published":"2026-01-15T00:00:00Z","updated":"2026-09-09T16:05:45Z"},{"id":"wordfence:58ae3a89-200b-475c-8d32-a24502eb95c6","source":"wordfence","cve":"CVE-2023-0178","title":"Annual Archive <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58ae3a89-200b-475c-8d32-a24502eb95c6?source=api-prod","affected":[{"type":"plugin","slug":"anual-archive","name":"Annual Archive","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58aea6df-679d-4dd9-adfe-f73128d29187","source":"wordfence","cve":"CVE-2025-52782","title":"Scroll UP <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58aea6df-679d-4dd9-adfe-f73128d29187?source=api-prod","affected":[{"type":"plugin","slug":"scroll-to-up","name":"Scroll UP","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:51:19Z"},{"id":"wordfence:58afd7cf-1d17-41e7-9bd3-9485bd733c6b","source":"wordfence","cve":"CVE-2026-25356","title":"Yobazar < 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58afd7cf-1d17-41e7-9bd3-9485bd733c6b?source=api-prod","affected":[{"type":"theme","slug":"yobazar","name":"Yobazar - Elementor Fashion WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"}],"published":"2026-03-20T00:00:00Z","updated":"2026-05-05T14:45:29Z"},{"id":"wordfence:58b026c8-ad67-4c77-8770-2b3b87bb2dfd","source":"wordfence","cve":"CVE-2024-49615","title":"SafetyForms <= 1.0.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b026c8-ad67-4c77-8770-2b3b87bb2dfd?source=api-prod","affected":[{"type":"plugin","slug":"safetymails-forms","name":"SafetyForms \u2013 Create forms with Real-time Email Validation","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T14:59:36Z"},{"id":"wordfence:58b29729-e9c3-4d57-affd-6142dfa8cc6f","source":"wordfence","cve":"CVE-2024-1909","title":"Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b29729-e9c3-4d57-affd-6142dfa8cc6f?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:43:48Z"},{"id":"wordfence:58b48d86-9b88-468b-878d-1fabd3c3d778","source":"wordfence","cve":"CVE-2025-30874","title":"Specific Content For Mobile <= 0.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b48d86-9b88-468b-878d-1fabd3c3d778?source=api-prod","affected":[{"type":"plugin","slug":"specific-content-for-mobile","name":"Specific Content For Mobile \u2013 Customize the mobile version without redirections","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":"0.5.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:29:46Z"},{"id":"wordfence:58b54c95-7c5a-4efd-bca4-cbb6341aa5c9","source":"wordfence","cve":"CVE-2025-60180","title":"Gravity Forms Salesforce <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b54c95-7c5a-4efd-bca4-cbb6341aa5c9?source=api-prod","affected":[{"type":"plugin","slug":"gf-salesforce-crmperks","name":"CRM Perks Integration for Gravity Forms and Salesforce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-08-08T00:00:00Z","updated":"2025-12-20T15:49:15Z"},{"id":"wordfence:58b59e65-420c-45f5-a34c-2d2003f4e3ae","source":"wordfence","cve":"CVE-2019-17207","title":"Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b59e65-420c-45f5-a34c-2d2003f4e3ae?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.11.9","to_inclusive":false,"patched_in":"1.11.9"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58b7736a-e3e0-4ecd-9adf-284568b02ef7","source":"wordfence","cve":"CVE-2024-3722","title":"Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b7736a-e3e0-4ecd-9adf-284568b02ef7?source=api-prod","affected":[{"type":"plugin","slug":"swift-performance-lite","name":"Swift Performance Lite","from":"*","from_inclusive":true,"to":"2.3.6.18","to_inclusive":true,"patched_in":"2.3.6.19"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-17T13:41:44Z"},{"id":"wordfence:58b8e6f5-5cf8-4dbb-89e9-69266bdc1a30","source":"wordfence","cve":"","title":"WP Customize Login <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b8e6f5-5cf8-4dbb-89e9-69266bdc1a30?source=api-prod","affected":[{"type":"plugin","slug":"customize-login","name":"WP Customize Login","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58b9dab8-8539-4b53-b08d-f6ee3e1e744c","source":"wordfence","cve":"CVE-2026-4350","title":"Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58b9dab8-8539-4b53-b08d-f6ee3e1e744c?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.5.9.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-04-02T19:02:03Z","updated":"2026-04-03T07:41:57Z"},{"id":"wordfence:58bd4a75-8e24-4810-8b9d-c9ffad1c2208","source":"wordfence","cve":"CVE-2015-10122","title":"WP Donate <= 1.4 - Unauthenticated SQL Injection in donate-display.php","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58bd4a75-8e24-4810-8b9d-c9ffad1c2208?source=api-prod","affected":[{"type":"plugin","slug":"wp-donate","name":"WP Donate","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-07-16T00:00:00Z","updated":"2024-06-06T16:04:49Z"},{"id":"wordfence:58bdd837-adae-4fa9-9ca3-00633a6a1ede","source":"wordfence","cve":"CVE-2021-24518","title":"WPFront Notification Bar <= 1.9.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58bdd837-adae-4fa9-9ca3-00633a6a1ede?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-notification-bar","name":"WPFront Notification Bar","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2021-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58c30b06-3d31-4489-a068-d447042eea58","source":"wordfence","cve":"CVE-2019-25742","title":"Zoner - Real Estate WordPress Theme < 4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58c30b06-3d31-4489-a068-d447042eea58?source=api-prod","affected":[{"type":"theme","slug":"zoner","name":"Zoner - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2019-09-24T00:00:00Z","updated":"2026-07-29T20:20:02Z"},{"id":"wordfence:58c35a21-1416-4926-a4ea-9c4fa3363114","source":"wordfence","cve":"CVE-2025-63034","title":"Page View Count <= 2.9.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58c35a21-1416-4926-a4ea-9c4fa3363114?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-12-08T00:00:00Z","updated":"2026-08-14T15:15:48Z"},{"id":"wordfence:58c63799-7d6a-417d-9992-4ab425ae1f1e","source":"wordfence","cve":"CVE-2021-25089","title":"UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58c63799-7d6a-417d-9992-4ab425ae1f1e?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"0.7.4","from_inclusive":true,"to":"1.16.68","to_inclusive":true,"patched_in":"1.16.69"}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58c77ea6-2ead-4d5c-bd74-b9df1db9ce24","source":"wordfence","cve":"CVE-2026-122675","title":"Wp Social Login and Register Social Counter <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58c77ea6-2ead-4d5c-bd74-b9df1db9ce24?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2026-11-07T08:49:00Z","updated":"2026-11-10T19:56:06Z"},{"id":"wordfence:58c79117-3a36-4a23-9f3d-067094d13edf","source":"wordfence","cve":"CVE-2014-4664","title":"Wordfence Security \u2013 Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58c79117-3a36-4a23-9f3d-067094d13edf?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2014-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58cc0a13-cda1-499b-b29a-e0b358a2e8e5","source":"wordfence","cve":"CVE-2026-32567","title":"YML for Yandex Market < 5.3.0 - Authenticated (Shop Manager+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58cc0a13-cda1-499b-b29a-e0b358a2e8e5?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:44:35Z"},{"id":"wordfence:58cf6e80-63dd-42dc-9c4a-7b5c092bc4cb","source":"wordfence","cve":"CVE-2023-0940","title":"ProfileGrid <= 5.3.0 - Missing Authorization to Arbitrary Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58cf6e80-63dd-42dc-9c4a-7b5c092bc4cb?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2023-02-27T00:00:00Z","updated":"2024-06-17T19:10:37Z"},{"id":"wordfence:58cfb328-40d0-4bea-a707-d5d6c1ce364a","source":"wordfence","cve":"CVE-2023-40672","title":"Sticky Social Media Icons <= 2.0 - Missing Authorization via ajax_request_handle","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58cfb328-40d0-4bea-a707-d5d6c1ce364a?source=api-prod","affected":[{"type":"plugin","slug":"sticky-social-media-icons","name":"Sticky Social Media Icons","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58d25eeb-b12c-4850-8308-eaa30982b5a8","source":"wordfence","cve":"CVE-2023-4920","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58d25eeb-b12c-4850-8308-eaa30982b5a8?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58d55ee8-ecd9-4444-a67b-4a62d235e9d3","source":"wordfence","cve":"CVE-2025-46506","title":"WpZon \u2013 Amazon Affiliate Plugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58d55ee8-ecd9-4444-a67b-4a62d235e9d3?source=api-prod","affected":[{"type":"plugin","slug":"wpzon","name":"WpZon \u2013 Amazon Affiliate Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:23:23Z"},{"id":"wordfence:58d56f30-6897-4132-aea8-de2cb11170ed","source":"wordfence","cve":"CVE-2026-103339","title":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58d56f30-6897-4132-aea8-de2cb11170ed?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-10-01T12:34:00Z","updated":"2026-10-08T23:18:13Z"},{"id":"wordfence:58da5adc-bb2e-409d-a623-12b19e6da138","source":"wordfence","cve":"CVE-2021-45729","title":"WP Google Map <= 1.8.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58da5adc-bb2e-409d-a623-12b19e6da138?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2021-12-08T12:44:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58db489e-5194-4e67-9235-6baed9b6714f","source":"wordfence","cve":"CVE-2026-97278","title":"Polylang <= 3.8.9 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58db489e-5194-4e67-9235-6baed9b6714f?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:35:59Z"},{"id":"wordfence:58df5dc1-c56a-43ba-ad5a-b700351b42dc","source":"wordfence","cve":"","title":"Nuss <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58df5dc1-c56a-43ba-ad5a-b700351b42dc?source=api-prod","affected":[{"type":"theme","slug":"nuss","name":"Nuss - Hotel Booking WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:32:32Z"},{"id":"wordfence:58dfc436-7ef9-4e1e-9cf2-e5da264f7959","source":"wordfence","cve":"CVE-2026-65549","title":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58dfc436-7ef9-4e1e-9cf2-e5da264f7959?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:50:07Z"},{"id":"wordfence:58dfd766-7156-4aec-b8db-76908b775ba0","source":"wordfence","cve":"CVE-2024-3638","title":"Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58dfd766-7156-4aec-b8db-76908b775ba0?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2024-07-03T14:51:37Z","updated":"2024-07-19T15:42:49Z"},{"id":"wordfence:58e1a5a1-800f-45e8-a356-759ba568d7c5","source":"wordfence","cve":"CVE-2021-25004","title":"SEUR Oficial < 1.7.2 - Authenticated Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e1a5a1-800f-45e8-a356-759ba568d7c5?source=api-prod","affected":[{"type":"plugin","slug":"seur","name":"SEUR Oficial","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58e3b7f1-26f4-453a-ae1f-a1e6eed0348c","source":"wordfence","cve":"CVE-2019-8943","title":"WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion","severity":"medium","cvss":6.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e3b7f1-26f4-453a-ae1f-a1e6eed0348c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2019-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58e3cf2c-aaca-40f2-b4d4-adcab550ba56","source":"wordfence","cve":"CVE-2025-27014","title":"Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e3cf2c-aaca-40f2-b4d4-adcab550ba56?source=api-prod","affected":[{"type":"theme","slug":"hostiko","name":"Hostiko - Hosting WordPress & WHMCS Theme","from":"*","from_inclusive":true,"to":"30.1","to_inclusive":false,"patched_in":"30.1"}],"published":"2025-02-18T00:00:00Z","updated":"2025-04-21T15:59:19Z"},{"id":"wordfence:58e67f1f-1139-406a-80fb-95aeccac9436","source":"wordfence","cve":"CVE-2026-111190","title":"ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e67f1f-1139-406a-80fb-95aeccac9436?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.3"}],"published":"2026-11-10T19:06:38Z","updated":"2026-11-11T07:26:41Z"},{"id":"wordfence:58e84d8f-a091-493f-8e5d-52c1ad5afcdb","source":"wordfence","cve":"","title":"Elegance <= 2.4 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e84d8f-a091-493f-8e5d-52c1ad5afcdb?source=api-prod","affected":[{"type":"theme","slug":"elegance","name":"Elegance","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58e8befa-bc8d-4731-be2c-ccf613b39fdd","source":"wordfence","cve":"CVE-2024-29805","title":"Shipping with Venipak for WooCommerce <= 1.19.5 - Reflected Cross-Site Scripting via 'venipak_labels_link'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e8befa-bc8d-4731-be2c-ccf613b39fdd?source=api-prod","affected":[{"type":"plugin","slug":"wc-venipak-shipping","name":"Shipping with Venipak for WooCommerce","from":"*","from_inclusive":true,"to":"1.19.5","to_inclusive":true,"patched_in":"1.19.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:14:49Z"},{"id":"wordfence:58e9c535-1b36-4795-b8f6-b38f3fc3d164","source":"wordfence","cve":"CVE-2025-7649","title":"Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58e9c535-1b36-4795-b8f6-b38f3fc3d164?source=api-prod","affected":[{"type":"plugin","slug":"surbma-recent-comments-shortcode","name":"Surbma | Recent Comments Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-08-15T14:46:44Z","updated":"2026-05-12T17:16:11Z"},{"id":"wordfence:58ea0c9c-f63d-4c31-b02e-a86d5fe732aa","source":"wordfence","cve":"","title":"Flash News (All Versions) - Multiple Vulnerabilities","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58ea0c9c-f63d-4c31-b02e-a86d5fe732aa?source=api-prod","affected":[{"type":"theme","slug":"flashnews","name":"Flash News","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58ee5f31-7d10-4772-929c-98249a351342","source":"wordfence","cve":"CVE-2023-32116","title":"Custom post types <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58ee5f31-7d10-4772-929c-98249a351342?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-types","name":"Custom post types, Custom Fields & more","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2023-10-16T00:00:00Z","updated":"2024-03-29T16:36:23Z"},{"id":"wordfence:58f041ec-179d-41d7-9fb9-73045f0c2107","source":"wordfence","cve":"CVE-2025-32477","title":"WP-Easy Menu <= 0.41 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f041ec-179d-41d7-9fb9-73045f0c2107?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-menu","name":"WP-Easy Menu","from":"*","from_inclusive":true,"to":"0.41","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:04:22Z"},{"id":"wordfence:58f048e5-f4be-4452-8fed-16871f4020b6","source":"wordfence","cve":"CVE-2024-9223","title":"WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f048e5-f4be-4452-8fed-16871f4020b6?source=api-prod","affected":[{"type":"plugin","slug":"wpdash-notes","name":"WPDash Notes","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T15:10:33Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:58f33730-fb21-43f6-8044-d01855f9d88c","source":"wordfence","cve":"CVE-2026-105876","title":"Modula Image Gallery \u2013 Photo Grid & Video Gallery <= 3.0.11 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f33730-fb21-43f6-8044-d01855f9d88c?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-10-07T09:16:00Z","updated":"2026-10-08T23:32:22Z"},{"id":"wordfence:58f35c9f-7df6-4439-9c92-cf9a11d609e2","source":"wordfence","cve":"CVE-2025-22568","title":"Post And Page Reactions <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f35c9f-7df6-4439-9c92-cf9a11d609e2?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-reactions","name":"Post And Page Reactions","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:42:17Z"},{"id":"wordfence:58f4bd87-0050-4b61-842d-52d037840bb0","source":"wordfence","cve":"CVE-2025-58702","title":"MarketKing <= 2.0.92 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f4bd87-0050-4b61-842d-52d037840bb0?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.0.92","to_inclusive":true,"patched_in":"2.1.00"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T20:52:28Z"},{"id":"wordfence:58f52ad6-02d0-4f34-af04-11c00fdcdae7","source":"wordfence","cve":"CVE-2026-40779","title":"Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f52ad6-02d0-4f34-af04-11c00fdcdae7?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.8.8","to_inclusive":true,"patched_in":"7.8.9"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:16:08Z"},{"id":"wordfence:58f86bdb-2332-4972-bf00-f7370ffd0c57","source":"wordfence","cve":"CVE-2024-2640","title":"Watu Quiz <= 3.4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f86bdb-2332-4972-bf00-f7370ffd0c57?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.1.1","to_inclusive":true,"patched_in":"3.4.1.2"}],"published":"2024-06-21T00:00:00Z","updated":"2024-08-09T17:11:27Z"},{"id":"wordfence:58f8bba4-1be5-4111-aa41-d076a6f06948","source":"wordfence","cve":"CVE-2020-27615","title":"Loginizer <= 1.6.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f8bba4-1be5-4111-aa41-d076a6f06948?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2020-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58f9ba6c-1754-4da2-8bfd-b473c7928805","source":"wordfence","cve":"CVE-2013-10023","title":"Editorial Calendar <= 2.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f9ba6c-1754-4da2-8bfd-b473c7928805?source=api-prod","affected":[{"type":"plugin","slug":"editorial-calendar","name":"Editorial Calendar","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2013-02-13T00:00:00Z","updated":"2024-02-07T14:45:37Z"},{"id":"wordfence:58f9bef5-6596-40b2-bcb6-d686e87d8d8f","source":"wordfence","cve":"CVE-2026-1793","title":"Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58f9bef5-6596-40b2-bcb6-d686e87d8d8f?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.3.17","to_inclusive":true,"patched_in":"8.3.18"}],"published":"2026-02-14T14:34:00Z","updated":"2026-02-15T03:24:34Z"},{"id":"wordfence:58fa1235-846f-4bd4-ba0d-be6b039f411e","source":"wordfence","cve":"CVE-2017-1002027","title":"RK Responsive Contact Form <= 1.0.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58fa1235-846f-4bd4-ba0d-be6b039f411e?source=api-prod","affected":[{"type":"plugin","slug":"rk-responsive-contact-form","name":"RK Responsive Contact Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2017-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:58fcab5e-c82e-4072-9a86-94a7f18a6e56","source":"wordfence","cve":"CVE-2025-7646","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58fcab5e-c82e-4072-9a86-94a7f18a6e56?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.3.10","to_inclusive":true,"patched_in":"6.3.11"}],"published":"2025-07-31T17:40:35Z","updated":"2025-08-01T06:44:32Z"},{"id":"wordfence:58fe6f67-1139-4d3e-864d-3966cede5077","source":"wordfence","cve":"CVE-2025-4205","title":"Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/58fe6f67-1139-4d3e-864d-3966cede5077?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.20.4","to_inclusive":true,"patched_in":"1.20.5"}],"published":"2025-06-02T22:17:53Z","updated":"2025-06-03T11:22:32Z"},{"id":"wordfence:5900d571-dc97-4c81-8ff3-7d7350b4c89f","source":"wordfence","cve":"","title":"RokIntroScroller <= 1.8 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5900d571-dc97-4c81-8ff3-7d7350b4c89f?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokintroscroller","name":"RokIntroScroller","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2013-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:590720a3-1881-4a5d-b004-ad92d386afe6","source":"wordfence","cve":"CVE-2025-11980","title":"Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/590720a3-1881-4a5d-b004-ad92d386afe6?source=api-prod","affected":[{"type":"plugin","slug":"quick-featured-images","name":"Quick Featured Images","from":"*","from_inclusive":true,"to":"13.7.3","to_inclusive":true,"patched_in":"13.7.4"}],"published":"2025-11-07T21:03:51Z","updated":"2025-11-08T09:28:10Z"},{"id":"wordfence:5909513d-8877-40ff-bee9-d565141b7ed2","source":"wordfence","cve":"CVE-2023-3965","title":"nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5909513d-8877-40ff-bee9-d565141b7ed2?source=api-prod","affected":[{"type":"theme","slug":"nsc","name":"NSC WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:590bdf82-8006-4729-96e5-42b0d1552d19","source":"wordfence","cve":"CVE-2025-13849","title":"Cool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/590bdf82-8006-4729-96e5-42b0d1552d19?source=api-prod","affected":[{"type":"plugin","slug":"cool-yt-player","name":"Cool YT Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:40:04Z","updated":"2026-01-07T09:20:56Z"},{"id":"wordfence:590e7782-ac7a-469f-a893-05627404a1b3","source":"wordfence","cve":"CVE-2026-104760","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/590e7782-ac7a-469f-a893-05627404a1b3?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-11-06T23:09:34Z","updated":"2026-11-07T11:26:28Z"},{"id":"wordfence:5913ad4d-ef24-44e5-8e4a-f740efadeeb4","source":"wordfence","cve":"CVE-2025-15688","title":"Capella | Restaurant WordPress <= 2.5.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5913ad4d-ef24-44e5-8e4a-f740efadeeb4?source=api-prod","affected":[{"type":"theme","slug":"capella","name":"Capella | Restaurant WordPress","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:07:09Z"},{"id":"wordfence:5916ad5d-1b8d-4cd6-af4a-620405f832a0","source":"wordfence","cve":"CVE-2026-85310","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.7.1 - Authenticated (Import_contacts+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5916ad5d-1b8d-4cd6-af4a-620405f832a0?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:37:00Z"},{"id":"wordfence:59170f0a-975e-487c-bdb0-585c802b3127","source":"wordfence","cve":"CVE-2021-4352","title":"JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59170f0a-975e-487c-bdb0-585c802b3127?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59178e0f-1bf3-4208-a14e-d0cac0de8dbd","source":"wordfence","cve":"CVE-2025-46247","title":"Appointment Booking Calendar <= 1.3.92 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59178e0f-1bf3-4208-a14e-d0cac0de8dbd?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.92","to_inclusive":true,"patched_in":"1.3.93"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:23:08Z"},{"id":"wordfence:591c0c56-ea71-4b55-bc89-bf95cc8b4a08","source":"wordfence","cve":"CVE-2026-115602","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/591c0c56-ea71-4b55-bc89-bf95cc8b4a08?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.8.0.1","to_inclusive":true,"patched_in":"3.8.0.2"}],"published":"2026-10-26T09:55:00Z","updated":"2026-10-28T01:23:29Z"},{"id":"wordfence:591ddcd7-9ed1-47b5-89c5-fd477bc9f9a9","source":"wordfence","cve":"CVE-2024-34432","title":"Better Elementor Addons <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/591ddcd7-9ed1-47b5-89c5-fd477bc9f9a9?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:29:37Z"},{"id":"wordfence:5921b859-79de-48f9-a664-f2bc3ccec201","source":"wordfence","cve":"CVE-2025-32683","title":"MapSVG Lite <= 8.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5921b859-79de-48f9-a664-f2bc3ccec201?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.6.6","to_inclusive":true,"patched_in":"8.6.7"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-12T18:27:06Z"},{"id":"wordfence:592440ab-60ac-419f-b615-e5617460aea9","source":"wordfence","cve":"CVE-2024-0913","title":"WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592440ab-60ac-419f-b615-e5617460aea9?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2024-03-28T00:00:00Z","updated":"2025-11-05T18:43:42Z"},{"id":"wordfence:59256cf6-76a0-44fe-84fb-8873884e71ac","source":"wordfence","cve":"CVE-2024-52346","title":"SimpleGMaps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59256cf6-76a0-44fe-84fb-8873884e71ac?source=api-prod","affected":[{"type":"plugin","slug":"simplegmaps","name":"SimpleGMaps","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:08:26Z"},{"id":"wordfence:59278214-b0ce-44bf-8d8f-265c5c50006a","source":"wordfence","cve":"CVE-2020-36707","title":"Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59278214-b0ce-44bf-8d8f-265c5c50006a?source=api-prod","affected":[{"type":"plugin","slug":"nifty-coming-soon-and-under-construction-page","name":"Coming Soon & Maintenance Mode Page & Under Construction","from":"*","from_inclusive":true,"to":"1.57","to_inclusive":true,"patched_in":"1.58"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:592867de-17b5-4461-a479-ecfbbef55a0b","source":"wordfence","cve":"CVE-2018-9034","title":"Relevanssi <= 4.0.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592867de-17b5-4461-a479-ecfbbef55a0b?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2018-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:592b1df5-74d5-4414-aacb-7497f0f307f1","source":"wordfence","cve":"","title":"Digital Publications by Supsystic <= 1.6.12 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592b1df5-74d5-4414-aacb-7497f0f307f1?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.6.12","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:592b61a1-9ac9-4817-b154-1e39e50d8010","source":"wordfence","cve":"CVE-2026-119096","title":"Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592b61a1-9ac9-4817-b154-1e39e50d8010?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-10-30T19:20:23Z","updated":"2026-10-31T07:46:49Z"},{"id":"wordfence:592d42eb-4025-44af-a519-672656ad8b0e","source":"wordfence","cve":"CVE-2026-2306","title":"Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592d42eb-4025-44af-a519-672656ad8b0e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-05-05T15:30:47Z","updated":"2026-05-06T04:26:50Z"},{"id":"wordfence:592ee7b9-7016-4df3-9218-6f7aebf80503","source":"wordfence","cve":"CVE-2024-10890","title":"WPAdverts \u2013 Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/592ee7b9-7016-4df3-9218-6f7aebf80503?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-20T19:06:24Z","updated":"2024-11-21T07:35:36Z"},{"id":"wordfence:5931ad4e-7de3-41ac-b783-f7e58aaef569","source":"wordfence","cve":"CVE-2024-3605","title":"WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5931ad4e-7de3-41ac-b783-f7e58aaef569?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-19T12:20:30Z","updated":"2024-07-11T17:19:53Z"},{"id":"wordfence:593202db-9900-4ffc-9062-24f1906c1a57","source":"wordfence","cve":"CVE-2025-24730","title":"WP VR <= 8.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593202db-9900-4ffc-9062-24f1906c1a57?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.14","to_inclusive":true,"patched_in":"8.5.15"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:59:26Z"},{"id":"wordfence:593299e5-d9eb-4240-8413-c0fe5ab79d82","source":"wordfence","cve":"CVE-2024-35686","title":"Sensei LMS <= 4.23.1 & Sensei Pro (WC Paid Courses) <= 4.24.0.1.24.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593299e5-d9eb-4240-8413-c0fe5ab79d82?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.23.1","to_inclusive":true,"patched_in":"4.24.0"},{"type":"plugin","slug":"woothemes-sensei","name":"Sensei Pro (WC Paid Courses)","from":"*","from_inclusive":true,"to":"4.23.1.1.23.1","to_inclusive":true,"patched_in":"4.24.0.1.24.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T15:10:26Z"},{"id":"wordfence:5933fc11-8f06-4d58-9483-d06997e5d731","source":"wordfence","cve":"","title":"WP-Filebase Download Manager <= 0.3.0.03 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5933fc11-8f06-4d58-9483-d06997e5d731?source=api-prod","affected":[{"type":"plugin","slug":"wp-filebase","name":"WP-Filebase","from":"*","from_inclusive":true,"to":"0.3.0.03","to_inclusive":true,"patched_in":"0.3.0.04"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5934d1c8-1553-4908-aaab-89d2189eb4cd","source":"wordfence","cve":"CVE-2025-7369","title":"Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2025-07-20T19:03:54Z","updated":"2025-08-07T17:39:04Z"},{"id":"wordfence:59390594-494d-47ed-8550-8fe33dd53a18","source":"wordfence","cve":"CVE-2025-49031","title":"SMu Manual DoFollow <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59390594-494d-47ed-8550-8fe33dd53a18?source=api-prod","affected":[{"type":"plugin","slug":"manuall-dofollow","name":"SMu Manual DoFollow","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T12:51:40Z"},{"id":"wordfence:59391c74-0287-4375-8215-388cc918ea3c","source":"wordfence","cve":"CVE-2025-58920","title":"Cerato <= 2.2.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59391c74-0287-4375-8215-388cc918ea3c?source=api-prod","affected":[{"type":"theme","slug":"cerato","name":"Cerato - Multipurpose Shopify Theme","from":"*","from_inclusive":true,"to":"2.2.18","to_inclusive":true,"patched_in":""}],"published":"2025-09-16T00:00:00Z","updated":"2026-05-04T14:46:31Z"},{"id":"wordfence:593b2ea2-0627-45ce-b672-cc815bff338b","source":"wordfence","cve":"CVE-2024-6570","title":"Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593b2ea2-0627-45ce-b672-cc815bff338b?source=api-prod","affected":[{"type":"plugin","slug":"glossary-by-codeat","name":"Glossary","from":"*","from_inclusive":true,"to":"2.2.26","to_inclusive":true,"patched_in":"2.2.27"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T08:32:32Z"},{"id":"wordfence:593cf634-edf2-4c8d-8f24-35bb6e6ff7e4","source":"wordfence","cve":"CVE-2025-60118","title":"PGS Core <= 5.9.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593cf634-edf2-4c8d-8f24-35bb6e6ff7e4?source=api-prod","affected":[{"type":"plugin","slug":"pgs-core","name":"PGS Core","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:20:00Z"},{"id":"wordfence:593eb5bc-59f9-4944-b147-4ba66d49abe6","source":"wordfence","cve":"CVE-2024-8106","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593eb5bc-59f9-4944-b147-4ba66d49abe6?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-06T21:20:33Z"},{"id":"wordfence:593fefe1-8813-440b-b8c7-fbfd5b71a737","source":"wordfence","cve":"CVE-2025-13904","title":"WPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/593fefe1-8813-440b-b8c7-fbfd5b71a737?source=api-prod","affected":[{"type":"plugin","slug":"wpgancio","name":"WPGancio","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:37:35Z","updated":"2025-12-12T03:20:45Z"},{"id":"wordfence:59415c36-e48a-4c05-ad22-8d55a9e13bcd","source":"wordfence","cve":"CVE-2024-10873","title":"LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59415c36-e48a-4c05-ad22-8d55a9e13bcd?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:20Z"},{"id":"wordfence:594431b7-9bc7-4e86-bc20-311fdab657b6","source":"wordfence","cve":"CVE-2025-68495","title":"JetEngine <= 3.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594431b7-9bc7-4e86-bc20-311fdab657b6?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:57:29Z"},{"id":"wordfence:594753c7-56fd-42fe-9ccd-a614e4f71cee","source":"wordfence","cve":"CVE-2026-42746","title":"Smart Online Order for Clover <= 1.6.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594753c7-56fd-42fe-9ccd-a614e4f71cee?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:22:25Z"},{"id":"wordfence:5947596b-12c6-492c-bebe-a935a24f4c3e","source":"wordfence","cve":"CVE-2025-23833","title":"Links/Problem Reporter <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5947596b-12c6-492c-bebe-a935a24f4c3e?source=api-prod","affected":[{"type":"plugin","slug":"report-broken-links","name":"Links/Problem Reporter","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:13:06Z"},{"id":"wordfence:5947f7cb-de84-4a62-bef7-cbeb1f20bb72","source":"wordfence","cve":"CVE-2023-49817","title":"Flexible Woocommerce Checkout Field Editor <= 2.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5947f7cb-de84-4a62-bef7-cbeb1f20bb72?source=api-prod","affected":[{"type":"plugin","slug":"flexible-woocommerce-checkout-field-editor","name":"Flexible Woocommerce Checkout Field Editor","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5949980f-2506-49be-9105-40ec2d2a4f77","source":"wordfence","cve":"CVE-2026-12595","title":"LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5949980f-2506-49be-9105-40ec2d2a4f77?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-07-09T11:14:06Z","updated":"2026-07-09T23:30:11Z"},{"id":"wordfence:5949c36f-d54c-48ab-8d49-a1aef5c730d0","source":"wordfence","cve":"CVE-2026-92429","title":"Rede Ita\u00fa for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Arbitrary Order Status Modification","severity":"high","cvss":7.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5949c36f-d54c-48ab-8d49-a1aef5c730d0?source=api-prod","affected":[{"type":"plugin","slug":"woo-rede","name":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit","from":"3.7.1","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:56:03Z"},{"id":"wordfence:594c9b09-6abc-4028-889d-46b5394b368a","source":"wordfence","cve":"CVE-2025-49879","title":"Litho <= 3.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594c9b09-6abc-4028-889d-46b5394b368a?source=api-prod","affected":[{"type":"theme","slug":"Litho - Multipurpose Elementor WordPress Theme","name":"Litho","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-09T15:00:49Z"},{"id":"wordfence:594de3b2-471e-4db4-a139-22ef3291f101","source":"wordfence","cve":"CVE-2026-113490","title":"GeoDirectory <= 2.8.193 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594de3b2-471e-4db4-a139-22ef3291f101?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:17:53Z"},{"id":"wordfence:594eb248-7aa3-4af9-b96c-6003a1899ae0","source":"wordfence","cve":"CVE-2025-68004","title":"My Post Order <= 1.2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594eb248-7aa3-4af9-b96c-6003a1899ae0?source=api-prod","affected":[{"type":"plugin","slug":"my-posts-order","name":"My Post Order","from":"*","from_inclusive":true,"to":"1.2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-27T19:21:22Z"},{"id":"wordfence:594fc4c4-6215-4cbc-b33b-1eb2ca7b4bc5","source":"wordfence","cve":"CVE-2026-39689","title":"eShipper Commerce <= 2.16.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/594fc4c4-6215-4cbc-b33b-1eb2ca7b4bc5?source=api-prod","affected":[{"type":"plugin","slug":"eshipper-commerce","name":"eShipper Commerce","from":"*","from_inclusive":true,"to":"2.16.12","to_inclusive":true,"patched_in":"2.16.13"}],"published":"2026-02-23T00:00:00Z","updated":"2026-05-11T19:42:27Z"},{"id":"wordfence:59532447-1d74-4d34-85f5-d89b65a001d8","source":"wordfence","cve":"CVE-2020-36667","title":"JetBackup \u2013 WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59532447-1d74-4d34-85f5-d89b65a001d8?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2020-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5954369b-ff1b-40ff-a20d-1b2b237a6f42","source":"wordfence","cve":"","title":"WP-SpamFree Anti-Spam <= 2.1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5954369b-ff1b-40ff-a20d-1b2b237a6f42?source=api-prod","affected":[{"type":"plugin","slug":"wp-spamfree","name":"wp-spamfree","from":"*","from_inclusive":true,"to":"2.1.1.6","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5954bdc0-09e9-4691-95ff-02f7304514c9","source":"wordfence","cve":"CVE-2023-7286","title":"ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5954bdc0-09e9-4691-95ff-02f7304514c9?source=api-prod","affected":[{"type":"plugin","slug":"acf-quickedit-fields","name":"ACF Quick Edit Fields","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2022-12-05T00:00:00Z","updated":"2024-10-16T06:43:32Z"},{"id":"wordfence:5954c35a-7d0a-4bc5-9cad-3223e7be56eb","source":"wordfence","cve":"","title":"InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5954c35a-7d0a-4bc5-9cad-3223e7be56eb?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.8","to_inclusive":true,"patched_in":"0.1.0.9"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5954c682-c772-420a-a764-342418c1e71c","source":"wordfence","cve":"CVE-2026-1945","title":"WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5954c682-c772-420a-a764-342418c1e71c?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-03-03T12:30:48Z","updated":"2026-03-04T01:21:58Z"},{"id":"wordfence:5958f5ba-523e-496b-b696-2887880203a4","source":"wordfence","cve":"CVE-2026-17520","title":"Newsletters < 4.17 - Insufficient Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-340","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5958f5ba-523e-496b-b696-2887880203a4?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.17","to_inclusive":false,"patched_in":"4.17"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T14:00:20Z"},{"id":"wordfence:59592b27-d431-499a-b3c3-3d43a5513c36","source":"wordfence","cve":"CVE-2025-12900","title":"FileBird \u2013 WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59592b27-d431-499a-b3c3-3d43a5513c36?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2025-12-15T02:12:47Z","updated":"2025-12-15T14:25:12Z"},{"id":"wordfence:595a6ab3-0731-4ef4-a385-5dfebbd917f4","source":"wordfence","cve":"CVE-2024-13494","title":"WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/595a6ab3-0731-4ef4-a385-5dfebbd917f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.25.2","to_inclusive":true,"patched_in":"4.25.3"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T07:30:31Z"},{"id":"wordfence:595d0401-55b9-418e-8b99-48b23e9a2662","source":"wordfence","cve":"CVE-2021-4396","title":"Rucy <= 0.4.4 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/595d0401-55b9-418e-8b99-48b23e9a2662?source=api-prod","affected":[{"type":"plugin","slug":"rucy","name":"Rucy","from":"*","from_inclusive":true,"to":"0.4.4","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:595d6cdb-8a42-480e-8b04-52998156488c","source":"wordfence","cve":"CVE-2024-32827","title":"Giveaways and Contests by RafflePress <= 1.12.7 - Unauthenticated IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/595d6cdb-8a42-480e-8b04-52998156488c?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.7","to_inclusive":true,"patched_in":"1.12.11"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:35:49Z"},{"id":"wordfence:595ed3f5-f70b-4173-b3a1-bfa0577f8206","source":"wordfence","cve":"CVE-2026-19053","title":"ProSolution WP Client <= 2.0.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/595ed3f5-f70b-4173-b3a1-bfa0577f8206?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:44:41Z"},{"id":"wordfence:595fac73-c583-4712-ad37-fbd0fa3eb147","source":"wordfence","cve":"CVE-2017-12650","title":"Loginizer <= 1.3.5 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/595fac73-c583-4712-ad37-fbd0fa3eb147?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2017-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59622166-3316-42e5-bf28-69eb38231755","source":"wordfence","cve":"CVE-2025-7040","title":"Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59622166-3316-42e5-bf28-69eb38231755?source=api-prod","affected":[{"type":"plugin","slug":"cloud-sso-single-sign-on","name":"Cloud SAML SSO \u2013 Single Sign On Login","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T03:22:37Z"},{"id":"wordfence:5964dd2a-e388-4454-89f6-aa71e1734d35","source":"wordfence","cve":"CVE-2022-45803","title":"Gutenberg Forms <= 2.2.8.3 - Authenticated(Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5964dd2a-e388-4454-89f6-aa71e1734d35?source=api-prod","affected":[{"type":"plugin","slug":"forms-gutenberg","name":"Gutenberg Forms \u2013 WordPress Form Builder Plugin","from":"*","from_inclusive":true,"to":"2.2.8.3","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59650bce-1b7c-4d3f-b4b0-594108510453","source":"wordfence","cve":"CVE-2026-15889","title":"Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59650bce-1b7c-4d3f-b4b0-594108510453?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2026-09-09T20:49:42Z","updated":"2026-09-10T09:27:09Z"},{"id":"wordfence:5965a8b6-116e-4029-9a76-b64c03c25ece","source":"wordfence","cve":"CVE-2018-17584","title":"WP Fastest Cache <= 0.8.8.5 - Cross-Site Request Forgery via page to wpfastestcacheoptions","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5965a8b6-116e-4029-9a76-b64c03c25ece?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.8.5","to_inclusive":true,"patched_in":"0.8.8.6"}],"published":"2018-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5966a86c-f1e6-4d53-b32a-fa1440d65819","source":"wordfence","cve":"CVE-2019-15092","title":"Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection","severity":"high","cvss":7.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5966a86c-f1e6-4d53-b32a-fa1440d65819?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2018-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5968f3f8-132f-487b-8b60-1a7d9e775587","source":"wordfence","cve":"CVE-2026-121767","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5968f3f8-132f-487b-8b60-1a7d9e775587?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:08:22Z"},{"id":"wordfence:596aef67-582a-4506-bae9-c7be1899e47a","source":"wordfence","cve":"CVE-2025-4519","title":"IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596aef67-582a-4506-bae9-c7be1899e47a?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"2.1.5","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2025-11-06T15:38:30Z","updated":"2025-11-07T04:28:54Z"},{"id":"wordfence:596ccda4-1baf-4391-a894-9312e2c06767","source":"wordfence","cve":"CVE-2025-31847","title":"mFolio Lite <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596ccda4-1baf-4391-a894-9312e2c06767?source=api-prod","affected":[{"type":"plugin","slug":"mfolio-lite","name":"mFolio Lite","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:46:22Z"},{"id":"wordfence:596d1083-2030-41f0-92d4-82e98bf07331","source":"wordfence","cve":"CVE-2011-5179","title":"Skysa App Bar Integration < 1.04 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596d1083-2030-41f0-92d4-82e98bf07331?source=api-prod","affected":[{"type":"plugin","slug":"skysa-official","name":"Skysa App Bar Integration","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2011-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:596d3b55-e35b-4d77-9915-1091eafbb3ff","source":"wordfence","cve":"CVE-2026-8869","title":"Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596d3b55-e35b-4d77-9915-1091eafbb3ff?source=api-prod","affected":[{"type":"plugin","slug":"mutual-funds-data","name":"Mutual Funds Data","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:15Z","updated":"2026-05-27T05:31:25Z"},{"id":"wordfence:596e970b-5a40-46cd-aa32-ac6ace39c21b","source":"wordfence","cve":"CVE-2023-24399","title":"Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596e970b-5a40-46cd-aa32-ac6ace39c21b?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:596f70da-6dd6-4c2b-8d34-bff87d53faeb","source":"wordfence","cve":"CVE-2026-39648","title":"Cream Blog <= 2.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/596f70da-6dd6-4c2b-8d34-bff87d53faeb?source=api-prod","affected":[{"type":"theme","slug":"cream-blog","name":"Cream Blog","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:22:45Z"},{"id":"wordfence:59707c64-a34c-45bc-bbbe-d447fe2ca6ab","source":"wordfence","cve":"CVE-2024-9228","title":"Loggedin \u2013 Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59707c64-a34c-45bc-bbbe-d447fe2ca6ab?source=api-prod","affected":[{"type":"plugin","slug":"loggedin","name":"Loggedin \u2013 Session Manager: Limit Concurrent Logins & Auto Logout","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-30T19:43:37Z","updated":"2024-10-04T12:43:52Z"},{"id":"wordfence:5970b8d6-0041-4c30-a6ce-fe67ebf415f5","source":"wordfence","cve":"CVE-2026-3045","title":"Appointment Booking Calendar <= 1.6.9.29 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5970b8d6-0041-4c30-a6ce-fe67ebf415f5?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.29","to_inclusive":true,"patched_in":"1.6.10.0"}],"published":"2026-03-12T19:14:03Z","updated":"2026-03-13T07:23:48Z"},{"id":"wordfence:5971447d-0634-49a5-91d0-c4f0c0825a86","source":"wordfence","cve":"CVE-2021-4397","title":"Staff Directory Plugin <= 3.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5971447d-0634-49a5-91d0-c4f0c0825a86?source=api-prod","affected":[{"type":"plugin","slug":"staff-directory-pro","name":"Staff Directory Plugin: Company Directory","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"4.0"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5973afaa-5a64-4db1-8e32-3b39d1367eb8","source":"wordfence","cve":"CVE-2023-41684","title":"SIS Handball <= 1.0.45 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5973afaa-5a64-4db1-8e32-3b39d1367eb8?source=api-prod","affected":[{"type":"plugin","slug":"sis-handball","name":"SIS Handball","from":"*","from_inclusive":true,"to":"1.0.45","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5974443a-48aa-4d5e-958a-40b99f68a1ae","source":"wordfence","cve":"CVE-2024-37243","title":"Vandana Lite <= 1.1.9 - Cross Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5974443a-48aa-4d5e-958a-40b99f68a1ae?source=api-prod","affected":[{"type":"theme","slug":"vandana-lite","name":"Vandana Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-06-21T00:00:00Z","updated":"2025-01-20T16:42:01Z"},{"id":"wordfence:5975a107-8083-4f9e-b2b2-8c6ae1ac8f39","source":"wordfence","cve":"CVE-2023-23819","title":"itemprop WP for SERP/SEO Rich snippets <= 3.5.201706131 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5975a107-8083-4f9e-b2b2-8c6ae1ac8f39?source=api-prod","affected":[{"type":"plugin","slug":"itempropwp","name":"itemprop WP for SERP/SEO Rich snippets","from":"*","from_inclusive":true,"to":"3.5.201706131","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:597660c5-8c99-40b1-8780-5a2ab9c07656","source":"wordfence","cve":"CVE-2024-25915","title":"Pexels: Free Stock Photos  <= 1.2.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597660c5-8c99-40b1-8780-5a2ab9c07656?source=api-prod","affected":[{"type":"plugin","slug":"wp-pexels-free-stock-photos","name":"Pexels: Free Stock Photos","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-06-18T16:33:50Z"},{"id":"wordfence:597786ce-58eb-4e96-a80e-bad3e75787fa","source":"wordfence","cve":"CVE-2023-44144","title":"Payment gateway per Product for WooCommerce <= 3.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597786ce-58eb-4e96-a80e-bad3e75787fa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-payments","name":"Dreamfoxmedia Payment Gateway per Product for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5979f2eb-2ca8-4b06-814c-c4236bb81af0","source":"wordfence","cve":"CVE-2023-6187","title":"Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5979f2eb-2ca8-4b06-814c-c4236bb81af0?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.3","to_inclusive":true,"patched_in":"2.12.4"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:597b48f5-d91f-4427-985e-c1e6e7c57337","source":"wordfence","cve":"CVE-2025-26945","title":"Info Cards \u2013 Gutenberg block for creating Beautiful Cards <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597b48f5-d91f-4427-985e-c1e6e7c57337?source=api-prod","affected":[{"type":"plugin","slug":"info-cards","name":"Info Cards \u2013 Add Text and Media in Card Layouts","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:11:10Z"},{"id":"wordfence:597d6d6b-80d5-45d8-b013-2804fce12c85","source":"wordfence","cve":"CVE-2025-28941","title":"Spam Byebye <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597d6d6b-80d5-45d8-b013-2804fce12c85?source=api-prod","affected":[{"type":"plugin","slug":"spam-byebye","name":"spam-byebye","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:10:44Z"},{"id":"wordfence:597dc29a-3a5c-412c-849b-9c5640181d0c","source":"wordfence","cve":"CVE-2026-18233","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597dc29a-3a5c-412c-849b-9c5640181d0c?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.21.1","to_inclusive":false,"patched_in":"4.21.1"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T14:02:02Z"},{"id":"wordfence:597f06ac-f9c7-4dcb-bb72-15ed7e9d8ac6","source":"wordfence","cve":"CVE-2023-32960","title":"UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597f06ac-f9c7-4dcb-bb72-15ed7e9d8ac6?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":"1.23.4"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:597f3f31-a03d-4fd8-9b10-e4eddf5dd54c","source":"wordfence","cve":"CVE-2026-32557","title":"WooCommerce Appointments <= 5.3.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597f3f31-a03d-4fd8-9b10-e4eddf5dd54c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-appointments","name":"WooCommerce Appointments","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:49:45Z"},{"id":"wordfence:597fe53e-769e-4edd-b0b9-2bd2cff50da6","source":"wordfence","cve":"CVE-2022-45823","title":"Video Contest WordPress Plugin <= 3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/597fe53e-769e-4edd-b0b9-2bd2cff50da6?source=api-prod","affected":[{"type":"plugin","slug":"video-contest","name":"Video Contest WordPress Plugin","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5981209b-5dc7-4823-bd90-2f9514beb616","source":"wordfence","cve":"CVE-2024-31261","title":"Announcer \u2013 Notification & message bars <= 6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5981209b-5dc7-4823-bd90-2f9514beb616?source=api-prod","affected":[{"type":"plugin","slug":"announcer","name":"Announcer \u2013 Sticky Message Banner & Notification Bar","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:28:31Z"},{"id":"wordfence:5981b937-189f-4dc3-baf0-ee0d194229eb","source":"wordfence","cve":"CVE-2026-73348","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5981b937-189f-4dc3-baf0-ee0d194229eb?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.6","to_inclusive":false,"patched_in":"4.16.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:43:59Z"},{"id":"wordfence:5983142d-550f-488f-a2d9-ee552ae8818f","source":"wordfence","cve":"CVE-2024-56050","title":"WPLMS < 1.9.9.5.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5983142d-550f-488f-a2d9-ee552ae8818f?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.3","to_inclusive":false,"patched_in":"1.9.9.5.3"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:52:19Z"},{"id":"wordfence:59833e1f-abb5-453d-ac8d-352ebe0f11df","source":"wordfence","cve":"CVE-2026-73378","title":"Contact Form by Supsystic < 1.10.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59833e1f-abb5-453d-ac8d-352ebe0f11df?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":false,"patched_in":"1.10.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:32:39Z"},{"id":"wordfence:598529d2-16c7-4bbd-9321-aa338c94eb36","source":"wordfence","cve":"CVE-2025-14130","title":"Post Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598529d2-16c7-4bbd-9321-aa338c94eb36?source=api-prod","affected":[{"type":"plugin","slug":"post-like-dislike","name":"Post Like Dislike","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:32:25Z","updated":"2026-01-07T09:20:56Z"},{"id":"wordfence:59859583-49e5-4a80-8659-b9ca7ddc089d","source":"wordfence","cve":"CVE-2024-4351","title":"Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59859583-49e5-4a80-8659-b9ca7ddc089d?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T09:32:11Z"},{"id":"wordfence:598768fe-e36d-48d8-925e-64513f36b18b","source":"wordfence","cve":"CVE-2022-47589","title":"CTT Expresso para WooCommerce <= 3.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598768fe-e36d-48d8-925e-64513f36b18b?source=api-prod","affected":[{"type":"plugin","slug":"ctt-expresso-para-woocommerce","name":"CTT Expresso para WooCommerce","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5987ef13-15d6-4ecf-894c-f22c8726402b","source":"wordfence","cve":"CVE-2025-0969","title":"Brizy \u2013 Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function","severity":"medium","cvss":6.5,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5987ef13-15d6-4ecf-894c-f22c8726402b?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":true,"patched_in":"2.7.17"}],"published":"2025-12-12T19:57:22Z","updated":"2025-12-13T08:21:14Z"},{"id":"wordfence:59880d92-5d75-432f-9fb5-d74b13d101ff","source":"wordfence","cve":"CVE-2024-13367","title":"Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59880d92-5d75-432f-9fb5-d74b13d101ff?source=api-prod","affected":[{"type":"plugin","slug":"sandbox","name":"Sandbox","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T18:24:58Z","updated":"2025-01-17T07:01:27Z"},{"id":"wordfence:598875c5-65f4-4512-bf76-a9c02fc16992","source":"wordfence","cve":"CVE-2024-37269","title":"Masterstudy Elementor Widgets <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598875c5-65f4-4512-bf76-a9c02fc16992?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-elementor-widgets","name":"Masterstudy Elementor Widgets","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:12:55Z"},{"id":"wordfence:5988fb74-01d1-426f-9a38-62336a59211b","source":"wordfence","cve":"CVE-2022-45811","title":"Post Teaser <= 4.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5988fb74-01d1-426f-9a38-62336a59211b?source=api-prod","affected":[{"type":"plugin","slug":"post-teaser","name":"Post Teaser","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":""}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:598c6005-055d-4dbb-8b68-2f523a3f5691","source":"wordfence","cve":"CVE-2026-16067","title":"Event Booking Manager for WooCommerce (Pro) <= 5.0.2 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598c6005-055d-4dbb-8b68-2f523a3f5691?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress-pro","name":"Event Booking Manager for WooCommerce Pro","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-07-27T00:00:00Z","updated":"2026-09-17T15:08:50Z"},{"id":"wordfence:598e2c2e-7dd5-435e-a366-6c7569243f2a","source":"wordfence","cve":"CVE-2024-3597","title":"Export WP Page to Static HTML/CSS <= 2.2.2 - Open Redirect","severity":"high","cvss":7.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598e2c2e-7dd5-435e-a366-6c7569243f2a?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-06-19T12:17:06Z","updated":"2024-07-01T13:52:21Z"},{"id":"wordfence:598e38d7-b5a9-43c1-b908-dab8bbe24115","source":"wordfence","cve":"CVE-2023-35092","title":"breadcrumb simple <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598e38d7-b5a9-43c1-b908-dab8bbe24115?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumb-simple","name":"breadcrumb simple","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:598fffcd-0318-4e41-8837-f65761390c19","source":"wordfence","cve":"CVE-2015-9435","title":"WP OAuth Server (OAuth Authentication) < 3.1.5 - Pseudorandom Number Generation","severity":"critical","cvss":9.8,"cwe":"CWE-338","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/598fffcd-0318-4e41-8837-f65761390c19?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2015-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59901afe-b439-4169-bdeb-eb59df890cad","source":"wordfence","cve":"CVE-2024-49281","title":"Click to Chat \u2013 WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59901afe-b439-4169-bdeb-eb59df890cad?source=api-prod","affected":[{"type":"plugin","slug":"support-chat","name":"WP Click to Chat \u2013 Email, Live Chat, Call & Book Now Buttons","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-10-15T00:00:00Z","updated":"2026-04-15T20:37:00Z"},{"id":"wordfence:5990fee6-8972-460e-ad65-76e2a5ea57c1","source":"wordfence","cve":"CVE-2026-19615","title":"Admin and Site Enhancements (ASE) < 9.0.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5990fee6-8972-460e-ad65-76e2a5ea57c1?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":false,"patched_in":"9.0.1"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T15:57:10Z"},{"id":"wordfence:5991c86b-6785-41a6-a5df-c65e8a28201c","source":"wordfence","cve":"CVE-2024-13558","title":"NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5991c86b-6785-41a6-a5df-c65e8a28201c?source=api-prod","affected":[{"type":"plugin","slug":"woo-rfq-for-woocommerce","name":"NP Quote Request for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.179","to_inclusive":true,"patched_in":"1.9.180"}],"published":"2025-03-19T22:42:46Z","updated":"2025-03-20T11:11:27Z"},{"id":"wordfence:5992161c-65ad-4601-8ebc-b53470f49c1c","source":"wordfence","cve":"CVE-2024-56228","title":"Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5992161c-65ad-4601-8ebc-b53470f49c1c?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce","name":"Wishlist for WooCommerce: Multiple Wishlists per Customer","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:07:03Z"},{"id":"wordfence:59926d18-215e-4de3-acf2-19870026a13f","source":"wordfence","cve":"CVE-2021-42549","title":"Lets-Box < 1.15.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59926d18-215e-4de3-acf2-19870026a13f?source=api-prod","affected":[{"type":"plugin","slug":"lets-box","name":"Lets-Box","from":"*","from_inclusive":true,"to":"1.15.3","to_inclusive":false,"patched_in":"1.15.3"}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59931266-766f-42d2-bcde-04d694a444b0","source":"wordfence","cve":"CVE-2023-30783","title":"Smart WooCommerce Search <= 2.5.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59931266-766f-42d2-bcde-04d694a444b0?source=api-prod","affected":[{"type":"plugin","slug":"smart-woocommerce-search","name":"Sokol: Smart WooCommerce Search","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59971f3d-2f98-44fd-a105-621a315721ae","source":"wordfence","cve":"CVE-2015-9414","title":"WP Symposium <= 15.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59971f3d-2f98-44fd-a105-621a315721ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"15.8.1","to_inclusive":true,"patched_in":"15.9"}],"published":"2015-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5998520b-62fd-4b3d-9b78-6363b72b406d","source":"wordfence","cve":"CVE-2025-6366","title":"Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5998520b-62fd-4b3d-9b78-6363b72b406d?source=api-prod","affected":[{"type":"plugin","slug":"eventlist","name":"Event List","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-08-25T19:03:03Z","updated":"2025-08-26T14:26:54Z"},{"id":"wordfence:599c6984-5d52-4d0f-86a1-b88f6c9797ed","source":"wordfence","cve":"CVE-2018-21003","title":"Post, Registration and Profile Form Builder \u2013 FrontEnd Editor BuddyForms \u2013 Easy WordPress Forms <= 2.2.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/599c6984-5d52-4d0f-86a1-b88f6c9797ed?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2018-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:599da697-6b24-47b0-aa12-8a8397213316","source":"wordfence","cve":"CVE-2024-53813","title":"WP Travel <= 9.6.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/599da697-6b24-47b0-aa12-8a8397213316?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"9.6.0","to_inclusive":true,"patched_in":"9.7.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T20:13:37Z"},{"id":"wordfence:599e46ed-a71c-41d1-839f-6bb76808a58f","source":"wordfence","cve":"CVE-2026-120040","title":"Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/599e46ed-a71c-41d1-839f-6bb76808a58f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-10-30T18:37:02Z","updated":"2026-10-31T06:44:18Z"},{"id":"wordfence:59a05868-7457-4fb1-845e-bf7044d5cb81","source":"wordfence","cve":"CVE-2021-24499","title":"Workreap - Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a05868-7457-4fb1-845e-bf7044d5cb81?source=api-prod","affected":[{"type":"theme","slug":"workreap","name":"Workreap - Freelance Marketplace and Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2021-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59a238fc-6385-4389-898a-c044177e1e81","source":"wordfence","cve":"CVE-2026-94238","title":"Loco Translate <= 2.8.8 - Authenticated (Translator+) Limited File Read","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a238fc-6385-4389-898a-c044177e1e81?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:22:49Z"},{"id":"wordfence:59a349f2-048d-49a5-92ea-c19f1d1cd45e","source":"wordfence","cve":"CVE-2024-5259","title":"MultiVendorX Marketplace \u2013 WooCommerce MultiVendor Marketplace Solution <= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a349f2-048d-49a5-92ea-c19f1d1cd45e?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"4.1.12"}],"published":"2024-06-05T20:34:43Z","updated":"2024-06-06T09:34:01Z"},{"id":"wordfence:59a5b35c-8910-401f-9829-e9257e3f231d","source":"wordfence","cve":"CVE-2025-27360","title":"Quick Event Calendar <= 1.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a5b35c-8910-401f-9829-e9257e3f231d?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-calendar","name":"Quick Event Calendar","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:02:37Z"},{"id":"wordfence:59a63cd8-9d33-4a2c-a499-5b1ee38c07d6","source":"wordfence","cve":"CVE-2025-3292","title":"User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a63cd8-9d33-4a2c-a499-5b1ee38c07d6?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-04-11T17:44:06Z","updated":"2025-04-12T06:37:17Z"},{"id":"wordfence:59a645e4-2a23-4440-a463-fa197dfa20b2","source":"wordfence","cve":"","title":"WA Form Builder <= 1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a645e4-2a23-4440-a463-fa197dfa20b2?source=api-prod","affected":[{"type":"plugin","slug":"wa-form-builder","name":"WA Form Builder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2016-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59a78686-cc77-435a-b3fc-ab7e8a14173a","source":"wordfence","cve":"CVE-2026-66617","title":"Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59a78686-cc77-435a-b3fc-ab7e8a14173a?source=api-prod","affected":[{"type":"plugin","slug":"organize-series","name":"Issues and Series for Newspapers, Magazines, Publishers, Writers","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-09-17T11:48:00Z","updated":"2026-09-22T18:46:53Z"},{"id":"wordfence:59ada382-5559-49a5-84ea-69201d185829","source":"wordfence","cve":"CVE-2021-24297","title":"Goto - Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ada382-5559-49a5-84ea-69201d185829?source=api-prod","affected":[{"type":"theme","slug":"goto","name":"Goto - Tour & Travel WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2021-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59aebe74-cf53-49f4-8f20-ebb5503d7dbd","source":"wordfence","cve":"CVE-2026-57697","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-521","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59aebe74-cf53-49f4-8f20-ebb5503d7dbd?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.6","to_inclusive":true,"patched_in":"5.9.9.7"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:09:14Z"},{"id":"wordfence:59b09f36-79e8-4f14-b970-a7994d193782","source":"wordfence","cve":"CVE-2023-37870","title":"WooCommerce Warranty Requests <= 2.1.9 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b09f36-79e8-4f14-b970-a7994d193782?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-warranty","name":"WooCommerce Warranty Requests","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59b63a01-fd8b-4742-a52f-c0a7b59e9e04","source":"wordfence","cve":"","title":"Frontend File Manager <= 21.3 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b63a01-fd8b-4742-a52f-c0a7b59e9e04?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"21.3","to_inclusive":true,"patched_in":"21.4"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59b70fce-1327-469e-9df5-3e51c1043a63","source":"wordfence","cve":"CVE-2024-51911","title":"Featured product by category name <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b70fce-1327-469e-9df5-3e51c1043a63?source=api-prod","affected":[{"type":"plugin","slug":"featured-product-by-category-name","name":"Featured product by category name","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:25:09Z"},{"id":"wordfence:59b90bf9-c053-4c70-ab30-e1565a65cbce","source":"wordfence","cve":"CVE-2022-25618","title":"wpDataTables \u2013 WordPress Tables & Table Charts Plugin <= 2.1.27 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b90bf9-c053-4c70-ab30-e1565a65cbce?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.28"}],"published":"2022-04-04T07:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59b949ef-6ab2-4381-abf9-aa0c72b654c3","source":"wordfence","cve":"CVE-2025-60215","title":"Kriya <= 3.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b949ef-6ab2-4381-abf9-aa0c72b654c3?source=api-prod","affected":[{"type":"theme","slug":"kriya","name":"Kriya - Yoga WordPress Theme","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-11-04T18:26:30Z"},{"id":"wordfence:59b9c2f8-f84a-49f9-98c5-6ef90475d686","source":"wordfence","cve":"CVE-2025-31750","title":"Breaking News WP <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59b9c2f8-f84a-49f9-98c5-6ef90475d686?source=api-prod","affected":[{"type":"plugin","slug":"breaking-news-wp","name":"Breaking News WP","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:05:05Z"},{"id":"wordfence:59bb2fc8-b054-4fa2-92c9-4793473bffdb","source":"wordfence","cve":"CVE-2026-96329","title":"tagDiv Opt-In Builder <= 1.7.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59bb2fc8-b054-4fa2-92c9-4793473bffdb?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:56:49Z"},{"id":"wordfence:59bc1c34-15f4-473b-a988-a1c80997e438","source":"wordfence","cve":"CVE-2022-1628","title":"Simple SEO <= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59bc1c34-15f4-473b-a988-a1c80997e438?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"1.7.91","to_inclusive":true,"patched_in":"1.7.92"}],"published":"2022-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59bcd246-ca2f-4336-9a6e-89afe873ed25","source":"wordfence","cve":"CVE-2024-4984","title":"Yoast SEO <= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59bcd246-ca2f-4336-9a6e-89afe873ed25?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"22.6","to_inclusive":true,"patched_in":"22.7"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-16T02:02:35Z"},{"id":"wordfence:59be1fc7-2854-404d-8e9d-dd9bd26e6a2c","source":"wordfence","cve":"CVE-2023-51468","title":"Rencontre \u2013 Dating Site <= 3.10.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59be1fc7-2854-404d-8e9d-dd9bd26e6a2c?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59be2283-1356-48aa-bbda-f796fd799330","source":"wordfence","cve":"CVE-2014-4520","title":"DMCA WaterMarker < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59be2283-1356-48aa-bbda-f796fd799330?source=api-prod","affected":[{"type":"plugin","slug":"dmca-watermarker","name":"DMCA WaterMarker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59bf14a9-5abe-4b83-9364-d318eedaba83","source":"wordfence","cve":"","title":"AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59bf14a9-5abe-4b83-9364-d318eedaba83?source=api-prod","affected":[{"type":"theme","slug":"the-monday","name":"The Monday","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"doko","name":"Doko","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.1.0"},{"type":"theme","slug":"eight-sec","name":"Eight Sec","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"revolve","name":"Revolve","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bingle","name":"Bingle","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"parallaxsome","name":"ParallaxSome","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"theme","slug":"uncode-lite","name":"Uncode Lite","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightlaw-lite","name":"EightLaw Lite","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"},{"type":"theme","slug":"accesspress-lite","name":"AccessPress Lite","from":"*","from_inclusive":true,"to":"2.92","to_inclusive":true,"patched_in":"2.93"},{"type":"theme","slug":"fotography","name":"FotoGraphy","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"},{"type":"theme","slug":"arrival","name":"Arrival","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"theme","slug":"vmag","name":"VMag","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"theme","slug":"accesspress-mag","name":"AccessPress Mag","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"},{"type":"theme","slug":"sakala","name":"Sakala","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"vmagazine-lite","name":"VMagazine Lite","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"digital-agency-lite","name":"Digital Agency Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"theme","slug":"the-launcher","name":"The Launcher","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"theme","slug":"zigcy-lite","name":"Zigcy Lite","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"},{"type":"theme","slug":"brovy","name":"Brovy","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightmedi-lite","name":"Eightmedi Lite","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"},{"type":"theme","slug":"wpparallax","name":"WPparallax","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"enlighten","name":"Enlighten","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"eightstore-lite","name":"EightStore Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"accesspress-store","name":"AccessPress Store","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"},{"type":"theme","slug":"swing-lite","name":"Swing Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"ripple","name":"Ripple","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"access-demo-importer","name":"Access Demo Importer","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"punte","name":"Punte","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"theme","slug":"accesspress-basic","name":"Accesspress Basic","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"},{"type":"theme","slug":"zigcy-baby","name":"Zigcy Baby","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"scrollme","name":"ScrollMe","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"zigcy-cosmetics","name":"Zigcy Cosmetics","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"construction-lite","name":"Construction Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"vmagazine-news","name":"Vmagazine News","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"accesspress-parallax-new","name":"AccessPress Parallax","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"},{"type":"theme","slug":"accesspress-root","name":"AccessPress Root","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6.0"},{"type":"theme","slug":"accesspress-staple","name":"AccessPress Staple","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"storevilla","name":"StoreVilla","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"theme","slug":"ultra-seven","name":"Ultra Seven","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"the100","name":"The100","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"edict-lite","name":"Edict Lite","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wp-store","name":"WP Store","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"opstore","name":"Opstore","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"theme","slug":"bloger","name":"Bloger","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-01-11T00:00:00Z","updated":"2024-03-19T15:56:18Z"},{"id":"wordfence:59c0caa2-d0c2-472e-83c3-d11ad313720d","source":"wordfence","cve":"CVE-2025-14348","title":"weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-01-19T15:57:34Z","updated":"2026-01-20T04:35:46Z"},{"id":"wordfence:59c1b745-7559-4b80-9118-152ee2340c47","source":"wordfence","cve":"CVE-2019-11590","title":"Form Maker by 10Web <= 1.13.4 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c1b745-7559-4b80-9118-152ee2340c47?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.13.4","to_inclusive":true,"patched_in":"1.13.5"}],"published":"2019-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59c29b29-fc4d-4ecd-a678-3ddeb39d2baf","source":"wordfence","cve":"CVE-2025-64367","title":"Groundhogg <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c29b29-fc4d-4ecd-a678-3ddeb39d2baf?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.6.1"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-04T15:19:05Z"},{"id":"wordfence:59c3b1df-7f8d-47a7-af20-d85116644ccf","source":"wordfence","cve":"CVE-2024-49642","title":"Todo Custom Field <= 3.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c3b1df-7f8d-47a7-af20-d85116644ccf?source=api-prod","affected":[{"type":"plugin","slug":"todo-custom-field","name":"Todo Custom Field","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:11:37Z"},{"id":"wordfence:59c40a86-ea1c-4015-ac47-2b7b91cc3519","source":"wordfence","cve":"CVE-2023-24413","title":"wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c40a86-ea1c-4015-ac47-2b7b91cc3519?source=api-prod","affected":[{"type":"plugin","slug":"wp-vertical-image-slider","name":"Vertical Image Slider \u2013 Responsive Thumbnail Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59c41620-c6f3-4728-a849-156c5f0ca1a7","source":"wordfence","cve":"CVE-2024-31240","title":"WP Poll Maker <= 3.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c41620-c6f3-4728-a849-156c5f0ca1a7?source=api-prod","affected":[{"type":"plugin","slug":"epoll-wp-voting","name":"ePoll \u2013 Contest Poll Survey & Voting","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:06:23Z"},{"id":"wordfence:59c5b6e7-74b0-430d-8b4a-5a42220f3ec9","source":"wordfence","cve":"CVE-2024-8269","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration","severity":"high","cvss":7.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59c5b6e7-74b0-430d-8b4a-5a42220f3ec9?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.15.3","to_inclusive":true,"patched_in":"4.15.4"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T15:10:40Z"},{"id":"wordfence:59cba7f0-cb06-4408-abba-49552dddd04c","source":"wordfence","cve":"CVE-2024-13235","title":"Pinpoint Booking System \u2013 #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59cba7f0-cb06-4408-abba-49552dddd04c?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.5.4","to_inclusive":true,"patched_in":"2.9.9.6.0"}],"published":"2025-02-20T15:05:35Z","updated":"2026-10-17T08:32:36Z"},{"id":"wordfence:59cbc7fc-793b-47b9-80e4-605ac8c2ae86","source":"wordfence","cve":"CVE-2025-22573","title":"Icons Enricher <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59cbc7fc-793b-47b9-80e4-605ac8c2ae86?source=api-prod","affected":[{"type":"plugin","slug":"icons-enricher","name":"Icons Enricher","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:37:02Z"},{"id":"wordfence:59cdb3e3-06ca-4325-9dae-73ad3cdfd910","source":"wordfence","cve":"CVE-2021-24787","title":"Client Invoicing by Sprout Invoices <= 19.9.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59cdb3e3-06ca-4325-9dae-73ad3cdfd910?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"19.9.7","to_inclusive":false,"patched_in":"19.9.7"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59cdc681-ab73-4701-ba87-e0773242ace7","source":"wordfence","cve":"CVE-2025-62941","title":"Events Maker by dFactory <= 1.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59cdc681-ab73-4701-ba87-e0773242ace7?source=api-prod","affected":[{"type":"plugin","slug":"events-maker","name":"Events Maker by dFactory","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:52:10Z"},{"id":"wordfence:59cefa5d-f270-48e1-bb3e-98f710a055d8","source":"wordfence","cve":"","title":"Contact Form 7 Dynamic Text Extension < 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59cefa5d-f270-48e1-bb3e-98f710a055d8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2019-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59d14f6c-6286-454c-8629-96a0c2de943c","source":"wordfence","cve":"CVE-2026-1389","title":"Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59d14f6c-6286-454c-8629-96a0c2de943c?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-01-27T19:18:50Z","updated":"2026-03-27T11:26:12Z"},{"id":"wordfence:59d4c073-af86-4e60-87f5-94cc46f407a2","source":"wordfence","cve":"CVE-2026-100182","title":"Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59d4c073-af86-4e60-87f5-94cc46f407a2?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":true,"patched_in":"5.2.11"}],"published":"2026-10-01T18:54:22Z","updated":"2026-10-02T07:39:23Z"},{"id":"wordfence:59d5e083-ab0d-4046-bcfe-b725e9d0e7c1","source":"wordfence","cve":"CVE-2025-32616","title":"Nimbata Call Tracking <= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59d5e083-ab0d-4046-bcfe-b725e9d0e7c1?source=api-prod","affected":[{"type":"plugin","slug":"nimbata-call-tracking","name":"Nimbata Call Tracking","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:48:14Z"},{"id":"wordfence:59d93b2e-e36d-4cf5-959c-3142cbf506fc","source":"wordfence","cve":"CVE-2026-119259","title":"All-in-One Video Gallery <= 5.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59d93b2e-e36d-4cf5-959c-3142cbf506fc?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:24:56Z"},{"id":"wordfence:59d9ff2e-4b0b-4096-91ca-1a029f31796b","source":"wordfence","cve":"CVE-2024-13588","title":"Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59d9ff2e-4b0b-4096-91ca-1a029f31796b?source=api-prod","affected":[{"type":"plugin","slug":"simplebooklet","name":"Simplebooklet PDF Viewer and Embedder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-02-17T15:47:24Z","updated":"2025-02-20T14:47:31Z"},{"id":"wordfence:59da86c4-1a68-4077-8b56-9c6c8afe26ad","source":"wordfence","cve":"CVE-2016-10930","title":"Support Plus Responsive Ticket System < 7.1.0 - Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59da86c4-1a68-4077-8b56-9c6c8afe26ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":false,"patched_in":"7.1.0"}],"published":"2016-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59da92e2-9ea0-4566-ae4d-3d5d91d0e42e","source":"wordfence","cve":"CVE-2026-3595","title":"Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59da92e2-9ea0-4566-ae4d-3d5d91d0e42e?source=api-prod","affected":[{"type":"plugin","slug":"riaxe-product-customizer","name":"Riaxe Product Customizer","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T16:45:25Z","updated":"2026-04-16T05:29:52Z"},{"id":"wordfence:59dc2448-491c-478f-a784-c727057b126b","source":"wordfence","cve":"CVE-2026-7430","title":"Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59dc2448-491c-478f-a784-c727057b126b?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.0.19","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-05-28T13:41:27Z","updated":"2026-05-29T02:27:45Z"},{"id":"wordfence:59e138f8-c043-4b15-a6a5-347c8e72cc99","source":"wordfence","cve":"CVE-2025-10686","title":"Creta Testimonial Showcase <= 1.2.3 - Authenticated (Editor+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59e138f8-c043-4b15-a6a5-347c8e72cc99?source=api-prod","affected":[{"type":"plugin","slug":"creta-testimonial-showcase","name":"Creta Testimonial Showcase","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-10-24T00:00:00Z","updated":"2025-11-17T18:20:16Z"},{"id":"wordfence:59e3f965-6f0b-4118-b321-afbd88905719","source":"wordfence","cve":"CVE-2025-63073","title":"The7 < 12.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59e3f965-6f0b-4118-b321-afbd88905719?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"12.9.0","to_inclusive":false,"patched_in":"12.9.0"}],"published":"2025-10-05T00:00:00Z","updated":"2025-12-19T15:54:51Z"},{"id":"wordfence:59e4fe52-98b3-4f14-9d72-964210d7c03e","source":"wordfence","cve":"CVE-2026-103357","title":"GIFT4U \u2013 Gift Cards All in One for Woo <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59e4fe52-98b3-4f14-9d72-964210d7c03e?source=api-prod","affected":[{"type":"plugin","slug":"gift4u-gift-cards-all-in-one-for-woo","name":"GIFT4U \u2013 Gift Cards All in One for Woo","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-10-08T16:52:09Z","updated":"2026-10-13T13:50:34Z"},{"id":"wordfence:59e60d00-985e-4152-a3d8-d2ba8075fab8","source":"wordfence","cve":"CVE-2024-47381","title":"Depicter Slider <= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59e60d00-985e-4152-a3d8-d2ba8075fab8?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:36:19Z"},{"id":"wordfence:59ea7390-3587-4fce-b267-bf525dbe3e27","source":"wordfence","cve":"CVE-2025-2537","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ea7390-3587-4fce-b267-bf525dbe3e27?source=api-prod","affected":[{"type":"plugin","slug":"auto-thickbox","name":"Auto Thickbox","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"youtube-video-player","name":"YouTube Embed, Playlist and Popup by WpDevArt","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.11","to_inclusive":true,"patched_in":"3.59.12"}],"published":"2025-07-03T00:20:54Z","updated":"2025-08-19T05:27:14Z"},{"id":"wordfence:59ec4bbd-5192-45f8-8cfc-d43858b46901","source":"wordfence","cve":"CVE-2023-47530","title":"Redirect 404 Error Page to Homepage or Custom Page with Logs <= 1.8.7 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ec4bbd-5192-45f8-8cfc-d43858b46901?source=api-prod","affected":[{"type":"plugin","slug":"redirect-404-error-page-to-homepage-or-custom-page","name":"Redirect 404 Error Page to Homepage or Custom Page with Logs","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59edf88d-a16d-48ec-981a-0002730f4091","source":"wordfence","cve":"CVE-2025-69300","title":"Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59edf88d-a16d-48ec-981a-0002730f4091?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.63","to_inclusive":true,"patched_in":"4.11.64"}],"published":"2026-01-17T00:00:00Z","updated":"2026-01-28T18:34:42Z"},{"id":"wordfence:59ee0b56-c11f-4951-aac0-8344200e4484","source":"wordfence","cve":"CVE-2023-5127","title":"WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ee0b56-c11f-4951-aac0-8344200e4484?source=api-prod","affected":[{"type":"plugin","slug":"wp-font-awesome","name":"WP Font Awesome","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2023-10-23T00:00:00Z","updated":"2024-07-11T18:45:01Z"},{"id":"wordfence:59ee0ca2-846d-4ae8-ad19-7c3826861aeb","source":"wordfence","cve":"CVE-2025-13646","title":"Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ee0ca2-846d-4ae8-ad19-7c3826861aeb?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"2.13.1","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2025-12-02T14:05:26Z","updated":"2025-12-03T02:25:30Z"},{"id":"wordfence:59f30135-6dd9-4367-90a9-a10ad491357d","source":"wordfence","cve":"CVE-2026-7635","title":"coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f30135-6dd9-4367-90a9-a10ad491357d?source=api-prod","affected":[{"type":"plugin","slug":"coreactivity","name":"coreActivity: Activity Logging for WordPress","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T04:26:43Z"},{"id":"wordfence:59f622ee-eccf-4b5b-8fa0-93a4405eb1e9","source":"wordfence","cve":"CVE-2026-15445","title":"SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f622ee-eccf-4b5b-8fa0-93a4405eb1e9?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-07-15T15:19:08Z","updated":"2026-07-16T03:44:31Z"},{"id":"wordfence:59f68dee-586c-4729-833e-0665954081ff","source":"wordfence","cve":"CVE-2025-69090","title":"Remons <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f68dee-586c-4729-833e-0665954081ff?source=api-prod","affected":[{"type":"theme","slug":"remons","name":"Remons - Car Rental Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:13:19Z"},{"id":"wordfence:59f6de7c-b154-4007-bb4b-ea25e6a261ad","source":"wordfence","cve":"CVE-2025-46437","title":"Tayori Form <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f6de7c-b154-4007-bb4b-ea25e6a261ad?source=api-prod","affected":[{"type":"plugin","slug":"tayori","name":"Tayori Form Plugin","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:04:42Z"},{"id":"wordfence:59f7a1b2-f718-40e7-8030-b9212edf71b7","source":"wordfence","cve":"","title":"Formilla Edge <= 1.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaPluginID'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f7a1b2-f718-40e7-8030-b9212edf71b7?source=api-prod","affected":[{"type":"plugin","slug":"formilla-edge","name":"Formilla Edge Targeted Messaging Platform for Sales and Marketing","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59f914e2-a671-46cc-a2b8-664816639f3e","source":"wordfence","cve":"CVE-2026-10095","title":"WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59f914e2-a671-46cc-a2b8-664816639f3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.1.13.005","to_inclusive":true,"patched_in":"9.2.01.001"}],"published":"2026-06-30T21:28:39Z","updated":"2026-07-01T09:32:27Z"},{"id":"wordfence:59fa2539-c1df-4c01-b57f-b7b4bde8537f","source":"wordfence","cve":"CVE-2024-9662","title":"CYAN Backup <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59fa2539-c1df-4c01-b57f-b7b4bde8537f?source=api-prod","affected":[{"type":"plugin","slug":"cyan-backup","name":"CYAN Backup","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T22:25:00Z"},{"id":"wordfence:59fdde50-8bab-41ea-9736-95e327646547","source":"wordfence","cve":"CVE-2026-117524","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) < 1.3.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59fdde50-8bab-41ea-9736-95e327646547?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:56Z"},{"id":"wordfence:59fdfdf3-e9fe-44d2-82f4-7a612a51d376","source":"wordfence","cve":"CVE-2025-13308","title":"Application Passwords <= 0.1.3 - Reflected Cross-Site Scripting via reject_url","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59fdfdf3-e9fe-44d2-82f4-7a612a51d376?source=api-prod","affected":[{"type":"plugin","slug":"application-passwords","name":"Application Passwords","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:41:42Z","updated":"2025-12-06T05:49:28Z"},{"id":"wordfence:59fe7630-ab94-419f-aca5-39b74d86ae4e","source":"wordfence","cve":"CVE-2024-13694","title":"WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59fe7630-ab94-419f-aca5-39b74d86ae4e?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-01-29T20:16:25Z","updated":"2025-01-30T08:21:27Z"},{"id":"wordfence:59ff3445-0dfd-4a1a-9ac8-d088b8f4dbf3","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization in migrateProductOnlyToCommon function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ff3445-0dfd-4a1a-9ac8-d088b8f4dbf3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:59ff476d-466f-4b2e-b867-342127a67901","source":"wordfence","cve":"CVE-2026-24633","title":"Add Expires Headers & Optimized Minify <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/59ff476d-466f-4b2e-b867-342127a67901?source=api-prod","affected":[{"type":"plugin","slug":"add-expires-headers","name":"AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-01-09T10:51:54Z","updated":"2026-04-25T14:55:13Z"},{"id":"wordfence:5a0211d1-45e8-4b20-beb7-0a74d21aa0b5","source":"wordfence","cve":"CVE-2026-54813","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a0211d1-45e8-4b20-beb7-0a74d21aa0b5?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:56:30Z"},{"id":"wordfence:5a03e1c3-618c-41b3-b803-ceab9d428d12","source":"wordfence","cve":"CVE-2025-24631","title":"BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a03e1c3-618c-41b3-b803-ceab9d428d12?source=api-prod","affected":[{"type":"plugin","slug":"bp-email-assign-templates","name":"BP Email Assign Templates","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-01-20T00:00:00Z","updated":"2026-04-15T20:39:06Z"},{"id":"wordfence:5a0612de-0f85-44d3-9b81-1a6a7720a03a","source":"wordfence","cve":"CVE-2026-73343","title":"WP Compress \u2013 Instant Performance & Speed Optimization < 7.20.01 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a0612de-0f85-44d3-9b81-1a6a7720a03a?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.20.01","to_inclusive":false,"patched_in":"7.20.01"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:37:16Z"},{"id":"wordfence:5a081cbd-5cd9-4740-a720-0e4d8904fc4b","source":"wordfence","cve":"CVE-2026-57695","title":"Document Gallery <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a081cbd-5cd9-4740-a720-0e4d8904fc4b?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:16:59Z"},{"id":"wordfence:5a08f75d-bd32-44cb-9d02-ccb3ffb12f60","source":"wordfence","cve":"CVE-2026-25433","title":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a08f75d-bd32-44cb-9d02-ccb3ffb12f60?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:06:39Z","updated":"2026-10-26T10:59:33Z"},{"id":"wordfence:5a093bd0-f8c5-47f2-943a-d4ce2aa8e402","source":"wordfence","cve":"CVE-2025-52798","title":"JobSearch < 3.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a093bd0-f8c5-47f2-943a-d4ce2aa8e402?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2025-06-26T00:00:00Z","updated":"2025-09-30T13:42:54Z"},{"id":"wordfence:5a0974a5-cfed-4d4d-ae91-f74d9cd531e7","source":"wordfence","cve":"CVE-2014-9444","title":"Frontend Uploader < 0.9.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a0974a5-cfed-4d4d-ae91-f74d9cd531e7?source=api-prod","affected":[{"type":"plugin","slug":"frontend-uploader","name":"Frontend Uploader","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":false,"patched_in":"0.9.4"}],"published":"2014-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a0aded4-b891-47d9-950e-180103b90a1c","source":"wordfence","cve":"CVE-2026-24995","title":"Latest Post Shortcode <= 14.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a0aded4-b891-47d9-950e-180103b90a1c?source=api-prod","affected":[{"type":"plugin","slug":"latest-post-shortcode","name":"Latest Post Shortcode","from":"*","from_inclusive":true,"to":"14.2.0","to_inclusive":true,"patched_in":"14.2.1"}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-02T20:45:39Z"},{"id":"wordfence:5a109434-4e52-4823-8c5b-d755cb7cbdf9","source":"wordfence","cve":"CVE-2025-22519","title":"eDoc Easy Tables <= 1.29 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a109434-4e52-4823-8c5b-d755cb7cbdf9?source=api-prod","affected":[{"type":"plugin","slug":"edoc-easy-tables","name":"eDoc Easy Tables \u2013 Best WordPress Table Maker","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:53:18Z"},{"id":"wordfence:5a1391b1-b0c3-4cf4-8850-d9367d90ec9e","source":"wordfence","cve":"CVE-2026-49775","title":"Welcart e-Commerce <= 2.11.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1391b1-b0c3-4cf4-8850-d9367d90ec9e?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.28","to_inclusive":true,"patched_in":"2.11.29"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:45:30Z"},{"id":"wordfence:5a17ded3-340d-494f-be7e-2550dab360bc","source":"wordfence","cve":"CVE-2026-1937","title":"YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a17ded3-340d-494f-be7e-2550dab360bc?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-02-17T18:41:54Z","updated":"2026-03-27T11:26:35Z"},{"id":"wordfence:5a1a727e-3b06-41ca-b684-f31d48f685c0","source":"wordfence","cve":"CVE-2013-7472","title":"Count per Day < 3.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1a727e-3b06-41ca-b684-f31d48f685c0?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2013-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a1b31f4-5594-4179-a88d-11167b58d96c","source":"wordfence","cve":"CVE-2026-32428","title":"Popup Like box <= 3.7.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1b31f4-5594-4179-a88d-11167b58d96c?source=api-prod","affected":[{"type":"plugin","slug":"ays-facebook-popup-likebox","name":"Popup Like box \u2013 Page Plugin","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:02:55Z"},{"id":"wordfence:5a1c6377-c2a7-4344-86bd-d2797db19469","source":"wordfence","cve":"CVE-2025-11917","title":"WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1c6377-c2a7-4344-86bd-d2797db19469?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2025-11-04T17:38:04Z","updated":"2025-11-05T06:35:00Z"},{"id":"wordfence:5a1d5fd1-80b6-4d62-9837-59ee1e020373","source":"wordfence","cve":"CVE-2024-5188","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1d5fd1-80b6-4d62-9837-59ee1e020373?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.22","to_inclusive":true,"patched_in":"5.9.23"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-06T11:03:03Z"},{"id":"wordfence:5a1dc947-f117-4bb0-bf39-f49ba0874d51","source":"wordfence","cve":"CVE-2025-26730","title":"Macro Calculator with Admin Email Optin & Data <= 1.0 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1dc947-f117-4bb0-bf39-f49ba0874d51?source=api-prod","affected":[{"type":"plugin","slug":"macro-admin-email-data-optin-calculator","name":"Macro Calculator with Admin Email Optin & Data","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T19:32:47Z"},{"id":"wordfence:5a1ed919-2346-4061-8d89-70bc2688f1ab","source":"wordfence","cve":"CVE-2026-27063","title":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership <= 3.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1ed919-2346-4061-8d89-70bc2688f1ab?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2026-10-29T14:30:00Z","updated":"2026-11-03T19:53:33Z"},{"id":"wordfence:5a2043a8-4a77-4db8-b468-229271d61785","source":"wordfence","cve":"CVE-2026-111397","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.16.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a2043a8-4a77-4db8-b468-229271d61785?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.1","to_inclusive":true,"patched_in":"8.16.2"}],"published":"2026-10-16T12:29:00Z","updated":"2026-10-23T18:41:29Z"},{"id":"wordfence:5a20d2fb-c022-4a34-9379-8dd31fda102c","source":"wordfence","cve":"CVE-2025-69027","title":"Product Delivery Date for WooCommerce \u2013 Lite <= 3.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a20d2fb-c022-4a34-9379-8dd31fda102c?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:08:42Z"},{"id":"wordfence:5a23a284-e781-4e42-8941-1a59f30c86d5","source":"wordfence","cve":"CVE-2026-125444","title":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.87 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a23a284-e781-4e42-8941-1a59f30c86d5?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.87","to_inclusive":true,"patched_in":"51.1.90"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:11Z"},{"id":"wordfence:5a24d442-56f9-4f6d-bff6-0eb354249895","source":"wordfence","cve":"CVE-2026-84908","title":"WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a24d442-56f9-4f6d-bff6-0eb354249895?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.12.13","to_inclusive":true,"patched_in":"3.13.0"}],"published":"2026-09-08T17:13:51Z","updated":"2026-09-09T05:31:04Z"},{"id":"wordfence:5a25728c-3d98-414b-bad0-2c05eb1f4ca2","source":"wordfence","cve":"CVE-2025-7966","title":"Get Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a25728c-3d98-414b-bad0-2c05eb1f4ca2?source=api-prod","affected":[{"type":"plugin","slug":"get-youtube-subs","name":"Get Youtube Subs","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:40:25Z","updated":"2025-07-24T09:22:18Z"},{"id":"wordfence:5a26367b-e194-42fc-9085-c9d52c416db0","source":"wordfence","cve":"CVE-2025-60112","title":"aThemes Addons for Elementor <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a26367b-e194-42fc-9085-c9d52c416db0?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-23T20:18:59Z"},{"id":"wordfence:5a2b7aac-b11d-4c52-b3d8-7b3f4b3eecd5","source":"wordfence","cve":"CVE-2023-46191","title":"Open Graph Metabox <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a2b7aac-b11d-4c52-b3d8-7b3f4b3eecd5?source=api-prod","affected":[{"type":"plugin","slug":"open-graph-metabox","name":"Open Graph Metabox","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a2e8746-9bd7-47a9-96e3-1aba4502ef1e","source":"wordfence","cve":"CVE-2026-114179","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a2e8746-9bd7-47a9-96e3-1aba4502ef1e?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T15:07:04Z"},{"id":"wordfence:5a2eb266-a050-48b9-a0bb-5d48b2c0f970","source":"wordfence","cve":"CVE-2020-25375","title":"WP smart CRM & Invoices FREE <= 1.8.7 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a2eb266-a050-48b9-a0bb-5d48b2c0f970?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-crm-invoices-free","name":"WP smart CRM & Invoices FREE","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":""}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a30e5dc-1f15-40ce-9703-1e1add1df6da","source":"wordfence","cve":"CVE-2026-11778","title":"CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a30e5dc-1f15-40ce-9703-1e1add1df6da?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.15"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-03T07:53:08Z"},{"id":"wordfence:5a316c0a-452a-4205-b79b-8bd911016ab2","source":"wordfence","cve":"CVE-2022-4208","title":"Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a316c0a-452a-4205-b79b-8bd911016ab2?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.2.1"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a334947-296d-4f26-95e1-594487e8b6c8","source":"wordfence","cve":"CVE-2015-10098","title":"Broken Link Checker < 1.10.6 - Reflected Cross Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a334947-296d-4f26-95e1-594487e8b6c8?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.10.6","to_inclusive":false,"patched_in":"1.10.6"}],"published":"2015-04-20T00:00:00Z","updated":"2024-02-07T14:13:19Z"},{"id":"wordfence:5a339443-97bd-440b-a00b-90bb29d574ae","source":"wordfence","cve":"CVE-2026-93929","title":"Travesia | Travel Agency and Tour Booking WordPress Theme <= 1.1.16 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a339443-97bd-440b-a00b-90bb29d574ae?source=api-prod","affected":[{"type":"theme","slug":"travesia","name":"Travesia | Travel Agency and Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:45:48Z","updated":"2026-10-13T14:25:45Z"},{"id":"wordfence:5a349c4f-d2e7-47af-9013-3cfa496b3b8c","source":"wordfence","cve":"CVE-2026-14249","title":"Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a349c4f-d2e7-47af-9013-3cfa496b3b8c?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-07-01T16:53:09Z","updated":"2026-07-02T05:35:06Z"},{"id":"wordfence:5a34d459-7a20-4546-bcef-e320acabee84","source":"wordfence","cve":"CVE-2025-53431","title":"Emberlyn <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a34d459-7a20-4546-bcef-e320acabee84?source=api-prod","affected":[{"type":"theme","slug":"emberlyn","name":"Emberlyn | Personal Stylist & Fashion Clothing WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:24:41Z"},{"id":"wordfence:5a34fc7b-66e7-4a6b-b351-09deb36bc876","source":"wordfence","cve":"CVE-2026-28117","title":"smart SEO <= 2.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a34fc7b-66e7-4a6b-b351-09deb36bc876?source=api-prod","affected":[{"type":"theme","slug":"smartseo","name":"SmartSEO | SEO & Marketing HTML Theme","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:33:22Z"},{"id":"wordfence:5a355a83-fece-4303-af37-8c01d159776a","source":"wordfence","cve":"CVE-2018-12636","title":"iThemes Security <= 7.0.2 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a355a83-fece-4303-af37-8c01d159776a?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":false,"patched_in":"7.0.3"}],"published":"2018-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a37c3d8-6496-4ca9-b145-920386deb812","source":"wordfence","cve":"CVE-2026-16535","title":"Link Library <= 7.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a37c3d8-6496-4ca9-b145-920386deb812?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.3","to_inclusive":true,"patched_in":"7.9.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:42:02Z"},{"id":"wordfence:5a38a72a-7336-4aa5-8491-6879dfa4d0ea","source":"wordfence","cve":"CVE-2022-4550","title":"User Activity <= 1.0.1 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a38a72a-7336-4aa5-8491-6879dfa4d0ea?source=api-prod","affected":[{"type":"plugin","slug":"user-activity","name":"User Activity","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a3a5dd8-1608-4a73-a571-25da811e4605","source":"wordfence","cve":"CVE-2022-25608","title":"Yoo Slider \u2013 Image Slider & Video Slider <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a3a5dd8-1608-4a73-a571-25da811e4605?source=api-prod","affected":[{"type":"plugin","slug":"yoo-slider","name":"Yoo Slider \u2013 Image Slider & Video Slider","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2022-03-21T21:17:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a3c16a5-65e5-4fe9-b7f0-2e021534c054","source":"wordfence","cve":"CVE-2025-13864","title":"Breeze \u2013 WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a3c16a5-65e5-4fe9-b7f0-2e021534c054?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.2.21","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2026-02-18T15:43:14Z","updated":"2026-02-19T04:36:13Z"},{"id":"wordfence:5a3e2d1c-8879-4def-8861-3d6d8b683b7e","source":"wordfence","cve":"","title":"BuddyPress 2.0 - 2.7.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":10.0,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a3e2d1c-8879-4def-8861-3d6d8b683b7e?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"2.0","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2016-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a40bac7-d3b8-486d-938a-30591ff3016c","source":"wordfence","cve":"CVE-2023-5874","title":"Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a40bac7-d3b8-486d-938a-30591ff3016c?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":false,"patched_in":"3.8.7"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a40ee36-da01-4cc7-8a9a-4dc53869acd1","source":"wordfence","cve":"CVE-2026-91827","title":"Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a40ee36-da01-4cc7-8a9a-4dc53869acd1?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:59:34Z"},{"id":"wordfence:5a418687-7359-4ebf-8912-2c9f511fe46d","source":"wordfence","cve":"","title":"Weberino Timed Quiz <= 0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a418687-7359-4ebf-8912-2c9f511fe46d?source=api-prod","affected":[{"type":"plugin","slug":"weberino-timed-quiz-creator","name":"Weberino Timed Quiz","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a425bf5-de09-4f8c-8766-c9912d337512","source":"wordfence","cve":"CVE-2022-4373","title":"Quote-O-Matic <= 1.0.5 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a425bf5-de09-4f8c-8766-c9912d337512?source=api-prod","affected":[{"type":"plugin","slug":"quote-o-matic","name":"Quote-O-Matic","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a425e1c-9b18-468f-975a-57239ce24601","source":"wordfence","cve":"CVE-2022-40128","title":"Advanced Order Export For WooCommerce <= 3.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a425e1c-9b18-468f-975a-57239ce24601?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a45bdc8-a181-43b2-ad82-abaf3ded1ef8","source":"wordfence","cve":"CVE-2026-66655","title":"MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a45bdc8-a181-43b2-ad82-abaf3ded1ef8?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.30.36","to_inclusive":true,"patched_in":"1.30.37"}],"published":"2026-08-11T00:00:00Z","updated":"2026-09-09T16:10:23Z"},{"id":"wordfence:5a46d9b0-06fa-4bb3-a687-13baeb5fb1f0","source":"wordfence","cve":"CVE-2025-28918","title":"Featured Image Thumbnail Grid <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a46d9b0-06fa-4bb3-a687-13baeb5fb1f0?source=api-prod","affected":[{"type":"plugin","slug":"thumbnail-grid","name":"Featured Image Thumbnail Grid","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.9"}],"published":"2025-03-11T00:00:00Z","updated":"2025-05-21T13:50:29Z"},{"id":"wordfence:5a4833de-d530-4bbf-ac28-e5d4b5f68f1e","source":"wordfence","cve":"CVE-2025-14158","title":"Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4833de-d530-4bbf-ac28-e5d4b5f68f1e?source=api-prod","affected":[{"type":"plugin","slug":"coding-blocks","name":"Coding Blocks","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:26:08Z","updated":"2025-12-12T03:20:45Z"},{"id":"wordfence:5a495893-d148-42b7-b029-bc7234e60bc6","source":"wordfence","cve":"CVE-2026-57386","title":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder < 2.9.1 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a495893-d148-42b7-b029-bc7234e60bc6?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:24:07Z"},{"id":"wordfence:5a4d7d40-8e0e-4251-8e25-3fd4ebd3a93e","source":"wordfence","cve":"CVE-2025-1970","title":"Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function","severity":"high","cvss":7.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4d7d40-8e0e-4251-8e25-3fd4ebd3a93e?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-21T23:15:51Z","updated":"2025-03-22T11:18:42Z"},{"id":"wordfence:5a4e144a-3c84-4da3-8fa6-e5fe9c897efe","source":"wordfence","cve":"CVE-2026-10513","title":"Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4e144a-3c84-4da3-8fa6-e5fe9c897efe?source=api-prod","affected":[{"type":"plugin","slug":"webmention","name":"Webmention","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2026-06-30T06:04:21Z","updated":"2026-06-30T18:32:32Z"},{"id":"wordfence:5a4eeb77-7a8b-489f-8ded-bbe09e881758","source":"wordfence","cve":"CVE-2023-27609","title":"WP Roles at Registration <= 0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4eeb77-7a8b-489f-8ded-bbe09e881758?source=api-prod","affected":[{"type":"plugin","slug":"wp-roles-at-registration","name":"WP Roles at Registration","from":"*","from_inclusive":true,"to":"0.23","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a52af45-30a6-4dea-b6ce-7d2e8af1910c","source":"wordfence","cve":"CVE-2024-5079","title":"Wp EMember <= 10.6.6 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a52af45-30a6-4dea-b6ce-7d2e8af1910c?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.6","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T19:56:03Z"},{"id":"wordfence:5a563439-c1c2-4a19-b5f7-22ed7be87ad7","source":"wordfence","cve":"CVE-2021-24418","title":"Smooth Scroll Page Up/Down Buttons <= 1.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a563439-c1c2-4a19-b5f7-22ed7be87ad7?source=api-prod","affected":[{"type":"plugin","slug":"smooth-page-scroll-updown-buttons","name":"Smooth Page Scroll Up/Down Buttons","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2021-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a56e621-2508-4500-b865-4d5e4463b91a","source":"wordfence","cve":"CVE-2024-3626","title":"Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a56e621-2508-4500-b865-4d5e4463b91a?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.17","to_inclusive":true,"patched_in":"5.7.18"}],"published":"2024-05-22T16:40:42Z","updated":"2024-05-23T05:32:16Z"},{"id":"wordfence:5a580a7a-d477-47ba-a7c1-21d7312c53ba","source":"wordfence","cve":"CVE-2021-24668","title":"MAZ Loader \u2013 Preloader Builder for WordPress <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a580a7a-d477-47ba-a7c1-21d7312c53ba?source=api-prod","affected":[{"type":"plugin","slug":"maz-loader","name":"MAZ Loader \u2013 Preloader Builder for WordPress","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a58f809-d051-4841-a1da-7bc1cf59e1a2","source":"wordfence","cve":"CVE-2026-8903","title":"Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a58f809-d051-4841-a1da-7bc1cf59e1a2?source=api-prod","affected":[{"type":"plugin","slug":"ip-vault-wp-firewall","name":"Two-factor authentication (formerly IP Vault)","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:43Z","updated":"2026-05-27T05:31:25Z"},{"id":"wordfence:5a595e05-c017-4f6a-995d-a6226c5a19b1","source":"wordfence","cve":"CVE-2024-53765","title":"Mins To Read <= 1.2.2 - Cross-Site Request Forgery  to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a595e05-c017-4f6a-995d-a6226c5a19b1?source=api-prod","affected":[{"type":"plugin","slug":"mins-to-read","name":"Mins To Read","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:22:44Z"},{"id":"wordfence:5a5d3a62-f7e5-4776-bed9-7ff3f81da452","source":"wordfence","cve":"CVE-2024-4873","title":"Replace Image <= 1.1.10 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d3a62-f7e5-4776-bed9-7ff3f81da452?source=api-prod","affected":[{"type":"plugin","slug":"replace-image","name":"Replace Image","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2024-06-18T14:34:48Z","updated":"2024-07-19T13:56:30Z"},{"id":"wordfence:5a5d5dbd-36f0-4886-adf8-045ec9c2e306","source":"wordfence","cve":"CVE-2016-15043","title":"WP Mobile Detector <= 3.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d5dbd-36f0-4886-adf8-045ec9c2e306?source=api-prod","affected":[{"type":"plugin","slug":"wp-mobile-detector","name":"WP Mobile Detector","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2016-06-03T00:00:00Z","updated":"2025-07-19T09:23:52Z"},{"id":"wordfence:5a5d7609-4d6a-4870-9e79-1f42ca22114d","source":"wordfence","cve":"CVE-2025-26981","title":"Web Accessibility By accessiBe <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5d7609-4d6a-4870-9e79-1f42ca22114d?source=api-prod","affected":[{"type":"plugin","slug":"accessibe","name":"Web Accessibility by accessiBe","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:46:16Z"},{"id":"wordfence:5a5f31ad-75f9-4534-a8a6-e76f9aefbd80","source":"wordfence","cve":"CVE-2025-39380","title":"Hospital Management System <= 47.0(20-11-2023) - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a5f31ad-75f9-4534-a8a6-e76f9aefbd80?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:19:21Z"},{"id":"wordfence:5a604c8d-1e4a-42c2-b7cf-ee6cae54730c","source":"wordfence","cve":"CVE-2024-31937","title":"TWIPLA (Visitor Analytics IO) <= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a604c8d-1e4a-42c2-b7cf-ee6cae54730c?source=api-prod","affected":[{"type":"plugin","slug":"visitor-analytics-io","name":"TWIPLA \u2013 Website Intelligence","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T16:06:52Z"},{"id":"wordfence:5a614ce5-faa4-4b27-84bd-f15f8652d477","source":"wordfence","cve":"CVE-2026-3512","title":"Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a614ce5-faa4-4b27-84bd-f15f8652d477?source=api-prod","affected":[{"type":"plugin","slug":"writeprint-stylometry","name":"Writeprint Stylometry","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T18:39:10Z","updated":"2026-03-18T06:48:47Z"},{"id":"wordfence:5a616de7-ab81-4da9-8da6-7660b0b4c7cd","source":"wordfence","cve":"CVE-2025-24624","title":"HT Event <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a616de7-ab81-4da9-8da6-7660b0b4c7cd?source=api-prod","affected":[{"type":"plugin","slug":"ht-event","name":"HT Event \u2013 WordPress Event Manager Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2024-12-30T00:00:00Z","updated":"2025-04-22T21:58:23Z"},{"id":"wordfence:5a628eef-937c-4391-afac-22128ec5b51c","source":"wordfence","cve":"CVE-2023-41656","title":"Better Elementor Addons <= 1.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a628eef-937c-4391-afac-22128ec5b51c?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-09-01T00:00:00Z","updated":"2024-03-28T23:25:20Z"},{"id":"wordfence:5a62aba1-ec3c-426b-8d4e-30dbe7509bbd","source":"wordfence","cve":"CVE-2026-95587","title":"Hostinger Migrator <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a62aba1-ec3c-426b-8d4e-30dbe7509bbd?source=api-prod","affected":[{"type":"plugin","slug":"migrator-plugin","name":"Hostinger Migrator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T13:23:53Z"},{"id":"wordfence:5a62e8b2-7606-4842-8be5-dff8634539d0","source":"wordfence","cve":"CVE-2023-4216","title":"Orders Tracking for WooCommerce <= 1.2.5 - Authenticated (Administrator+) Directory Traversal via 'file_url'","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a62e8b2-7606-4842-8be5-dff8634539d0?source=api-prod","affected":[{"type":"plugin","slug":"woo-orders-tracking","name":"Trakoo \u2013 Orders Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a64e522-781e-4112-a319-3eea9a4a45d3","source":"wordfence","cve":"CVE-2024-37263","title":"Enter Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a64e522-781e-4112-a319-3eea9a4a45d3?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:42:39Z"},{"id":"wordfence:5a679863-3c22-4d34-9994-1f8ec121ad86","source":"wordfence","cve":"CVE-2024-0591","title":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a679863-3c22-4d34-9994-1f8ec121ad86?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"3.4.2.4","to_inclusive":true,"patched_in":"3.4.2.5"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-29T21:36:24Z"},{"id":"wordfence:5a67e002-f5ef-4edf-9b21-5ea4e0f0d9d7","source":"wordfence","cve":"CVE-2026-22452","title":"Hoverex | Cryptocurrency & ICO Elementor Template Kit <= 1.5.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a67e002-f5ef-4edf-9b21-5ea4e0f0d9d7?source=api-prod","affected":[{"type":"theme","slug":"hoverex","name":"Hoverex | Cryptocurrency & ICO Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-05T14:20:54Z"},{"id":"wordfence:5a680db1-3db2-4884-b2fe-c6d29457df4f","source":"wordfence","cve":"CVE-2021-24273","title":"Clever Addons for Elementor <=2.0.15 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a680db1-3db2-4884-b2fe-c6d29457df4f?source=api-prod","affected":[{"type":"plugin","slug":"cafe-lite","name":"Clever Addons for Elementor","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2021-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a6980de-29b1-42cd-8b86-2ebe392afb72","source":"wordfence","cve":"CVE-2025-48090","title":"Blanka - One Page WordPress < 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a6980de-29b1-42cd-8b86-2ebe392afb72?source=api-prod","affected":[{"type":"theme","slug":"blanka-wp","name":"Blanka - One Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2025-08-26T00:00:00Z","updated":"2025-11-12T13:39:28Z"},{"id":"wordfence:5a69f51e-0bac-4b2e-8ad4-597c6fbbff83","source":"wordfence","cve":"CVE-2025-26762","title":"WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a69f51e-0bac-4b2e-8ad4-597c6fbbff83?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"9.7.0","to_inclusive":true,"patched_in":"9.7.1"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-25T19:33:17Z"},{"id":"wordfence:5a6bcfa6-7a40-4566-b4d2-62b696ded2d6","source":"wordfence","cve":"CVE-2025-10058","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a6bcfa6-7a40-4566-b4d2-62b696ded2d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.27","to_inclusive":true,"patched_in":"7.28"}],"published":"2025-09-16T17:09:00Z","updated":"2025-09-17T05:18:46Z"},{"id":"wordfence:5a6cda1f-8af9-44b1-98e2-619d29c28a88","source":"wordfence","cve":"CVE-2021-25020","title":"CAOS <= 4.1.8 - Admin+ Arbitrary Folder Deletion via Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a6cda1f-8af9-44b1-98e2-619d29c28a88?source=api-prod","affected":[{"type":"plugin","slug":"host-analyticsjs-local","name":"CAOS | Host Google Analytics Locally","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a7358cd-fec8-4a16-ae6b-14194bb63396","source":"wordfence","cve":"CVE-2024-7112","title":"Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7358cd-fec8-4a16-ae6b-14194bb63396?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.5.0","to_inclusive":true,"patched_in":"2.9.9.5.1"}],"published":"2024-09-06T23:03:58Z","updated":"2024-09-07T11:17:04Z"},{"id":"wordfence:5a7609bf-5b20-440c-9984-eeb26962ada8","source":"wordfence","cve":"CVE-2023-26526","title":"Bookly <= 21.7.1 - Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7609bf-5b20-440c-9984-eeb26962ada8?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"21.7.1","to_inclusive":true,"patched_in":"21.8"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a7bb428-dd65-47f7-aaf6-ecdad4ae3049","source":"wordfence","cve":"CVE-2024-31935","title":"Simple Post Notes <= 1.7.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7bb428-dd65-47f7-aaf6-ecdad4ae3049?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-notes","name":"Simple Post Notes","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:20:20Z"},{"id":"wordfence:5a7de576-5809-432f-a6fd-364a3a49967f","source":"wordfence","cve":"CVE-2021-24231","title":"Patreon WordPress <= 1.6.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7de576-5809-432f-a6fd-364a3a49967f?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a7e8284-d70f-4448-8f0d-99c23b8eda79","source":"wordfence","cve":"CVE-2024-9874","title":"WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7e8284-d70f-4448-8f0d-99c23b8eda79?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2024-11-08T18:27:39Z","updated":"2025-06-07T06:40:13Z"},{"id":"wordfence:5a7e9889-6b3e-41c6-a09e-5fcc5351b7cb","source":"wordfence","cve":"CVE-2025-1622","title":"GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7e9889-6b3e-41c6-a09e-5fcc5351b7cb?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.6","to_inclusive":true,"patched_in":"4.15.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-24T20:01:57Z"},{"id":"wordfence:5a7f869d-e915-4048-b0e1-36cf25e732f9","source":"wordfence","cve":"CVE-2024-51792","title":"Audio Record <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a7f869d-e915-4048-b0e1-36cf25e732f9?source=api-prod","affected":[{"type":"plugin","slug":"audio-record","name":"Audio Record","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2019-01-07T00:00:00Z","updated":"2024-12-12T19:38:53Z"},{"id":"wordfence:5a801bb0-a7fc-42c3-b26f-3f7cdb592bea","source":"wordfence","cve":"CVE-2025-9562","title":"Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2025-10-17T17:48:32Z","updated":"2025-10-18T06:42:47Z"},{"id":"wordfence:5a801ea0-725f-4da4-bed2-6798f403c0ae","source":"wordfence","cve":"CVE-2025-39449","title":"JetWooBuilder <= 2.1.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801ea0-725f-4da4-bed2-6798f403c0ae?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.1.18.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:13:54Z"},{"id":"wordfence:5a806bc8-cff4-47ff-a295-82520c9079e9","source":"wordfence","cve":"CVE-2017-18585","title":"Posts in Page <= 1.2.4 - Authenticated Directory Traversal leading to Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a806bc8-cff4-47ff-a295-82520c9079e9?source=api-prod","affected":[{"type":"plugin","slug":"posts-in-page","name":"Posts in Page","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2017-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a85c367-99f5-4a46-94bc-ed6e6626514b","source":"wordfence","cve":"CVE-2026-25313","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a85c367-99f5-4a46-94bc-ed6e6626514b?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"6.1.15"}],"published":"2026-01-25T00:00:00Z","updated":"2026-05-04T15:34:17Z"},{"id":"wordfence:5a85e1e9-ef40-40f6-a652-17acf0a2d33d","source":"wordfence","cve":"CVE-2024-30431","title":"Mang Board WP <= 1.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a85e1e9-ef40-40f6-a652-17acf0a2d33d?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:49:32Z"},{"id":"wordfence:5a86958f-b68d-4436-bcc7-d8dc2fc86f47","source":"wordfence","cve":"CVE-2024-51682","title":"HT Builder \u2013 WordPress Theme Builder for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a86958f-b68d-4436-bcc7-d8dc2fc86f47?source=api-prod","affected":[{"type":"plugin","slug":"ht-builder","name":"HT Builder \u2013 WordPress Theme Builder for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:48:50Z"},{"id":"wordfence:5a8737b1-fb68-4609-8474-9395f30c1089","source":"wordfence","cve":"CVE-2026-89064","title":"All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header","severity":"medium","cvss":5.3,"cwe":"CWE-522","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a8737b1-fb68-4609-8474-9395f30c1089?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.110","to_inclusive":true,"patched_in":"7.111"}],"published":"2026-09-16T14:04:05Z","updated":"2026-09-17T02:28:00Z"},{"id":"wordfence:5a88a6fd-cd49-46c4-8b8e-dd8499d3208c","source":"wordfence","cve":"CVE-2026-17542","title":"Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a88a6fd-cd49-46c4-8b8e-dd8499d3208c?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-21T15:47:29Z"},{"id":"wordfence:5a8f4ec8-d66e-4892-9770-67450aaa83d9","source":"wordfence","cve":"CVE-2024-32556","title":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a8f4ec8-d66e-4892-9770-67450aaa83d9?source=api-prod","affected":[{"type":"plugin","slug":"hurrytimer","name":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:12:57Z"},{"id":"wordfence:5a9000e3-a313-48f7-88cd-3041c8da8288","source":"wordfence","cve":"CVE-2016-15027","title":"Post Duplicator <= 2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9000e3-a313-48f7-88cd-3041c8da8288?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"2.16","to_inclusive":true,"patched_in":"2.17"}],"published":"2016-04-06T00:00:00Z","updated":"2024-08-09T16:26:30Z"},{"id":"wordfence:5a91e786-f570-4c6c-b1c7-0110774cb808","source":"wordfence","cve":"CVE-2024-3732","title":"GeoDirectory \u2013 WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a91e786-f570-4c6c-b1c7-0110774cb808?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.48","to_inclusive":true,"patched_in":"2.3.49"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T09:32:54Z"},{"id":"wordfence:5a922aa8-1625-44a9-b283-245e27e6db66","source":"wordfence","cve":"CVE-2024-51806","title":"Awesome Fitness Testimonials <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a922aa8-1625-44a9-b283-245e27e6db66?source=api-prod","affected":[{"type":"plugin","slug":"awesome-fitness-testimonials","name":"Awesome Fitness Testimonials","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:39:25Z"},{"id":"wordfence:5a925c74-9f12-41e1-9443-d533b645c3f5","source":"wordfence","cve":"CVE-2012-4283","title":"Login With Ajax < 3.0.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a925c74-9f12-41e1-9443-d533b645c3f5?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"3.0.4.1","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2012-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a92916c-42d4-44a6-a9b7-ff0338042b2a","source":"wordfence","cve":"CVE-2024-29762","title":"Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a92916c-42d4-44a6-a9b7-ff0338042b2a?source=api-prod","affected":[{"type":"plugin","slug":"off-canvas-sidebars","name":"Off-Canvas Sidebars & Menus (Slidebars)","from":"*","from_inclusive":true,"to":"0.5.8.1","to_inclusive":true,"patched_in":"0.5.8.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:22:06Z"},{"id":"wordfence:5a92945b-79ce-4bea-a1fc-0f03024f5f48","source":"wordfence","cve":"","title":"Optinferex Plugin (All Known Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a92945b-79ce-4bea-a1fc-0f03024f5f48?source=api-prod","affected":[{"type":"plugin","slug":"optinfirex","name":"optinfirex","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a92bc9b-1cc5-49b7-983c-a245b96d4167","source":"wordfence","cve":"CVE-2025-32923","title":"Tourmaster < 5.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a92bc9b-1cc5-49b7-983c-a245b96d4167?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":false,"patched_in":"5.4.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T18:20:25Z"},{"id":"wordfence:5a94c5e7-a3d6-435b-9d10-0c325a13124f","source":"wordfence","cve":"CVE-2022-3511","title":"Awesome Support <= 6.1.1 - Insecure Direct Object Reference to (Subscriber+) Ticket Export","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a94c5e7-a3d6-435b-9d10-0c325a13124f?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a9665e5-5aea-491b-a5e7-29723347aaad","source":"wordfence","cve":"CVE-2025-62073","title":"MeetingHub <= 1.23.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9665e5-5aea-491b-a5e7-29723347aaad?source=api-prod","affected":[{"type":"plugin","slug":"meetinghub","name":"Booking for Appointments and Events Calendar with Zoom, Google Meet, Microsoft Teams, Webex, Jitsi \u2013 MeetingHub","from":"*","from_inclusive":true,"to":"1.23.9","to_inclusive":true,"patched_in":"1.23.10"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:07:50Z"},{"id":"wordfence:5a9746d0-6a0b-47cf-b9fa-246af6b54323","source":"wordfence","cve":"CVE-2024-37121","title":"Shortcode Addons <= 3.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9746d0-6a0b-47cf-b9fa-246af6b54323?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-addons","name":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T16:54:51Z"},{"id":"wordfence:5a97877b-fb4d-4e87-bcff-56be65fee6ce","source":"wordfence","cve":"CVE-2019-25138","title":"User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a97877b-fb4d-4e87-bcff-56be65fee6ce?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20190426","to_inclusive":false,"patched_in":"20190426"}],"published":"2019-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a98483c-d75e-45a4-bc67-a2fe330cd1c9","source":"wordfence","cve":"CVE-2026-66465","title":"Cartify <= 1.3.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a98483c-d75e-45a4-bc67-a2fe330cd1c9?source=api-prod","affected":[{"type":"theme","slug":"cartify-multipurpose-woocommerce-wordpress-theme","name":"Cartify - WooCommerce Gutenberg WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-14T13:07:36Z"},{"id":"wordfence:5a98fb59-6bb2-46a4-b56c-6033640af9fa","source":"wordfence","cve":"CVE-2025-62014","title":"ITok <= 1.1.42 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a98fb59-6bb2-46a4-b56c-6033640af9fa?source=api-prod","affected":[{"type":"theme","slug":"itok","name":"ITok - ICO and Cryptocurrency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.42","to_inclusive":true,"patched_in":"1.1.43.1"}],"published":"2025-09-04T00:00:00Z","updated":"2025-11-12T13:38:30Z"},{"id":"wordfence:5a9943b5-0f6d-4fbd-97eb-df61acd0c297","source":"wordfence","cve":"CVE-2026-15350","title":"The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9943b5-0f6d-4fbd-97eb-df61acd0c297?source=api-prod","affected":[{"type":"plugin","slug":"the-cache-purger","name":"The Cache Purger","from":"*","from_inclusive":true,"to":"2.3.20","to_inclusive":true,"patched_in":"2.3.21"}],"published":"2026-07-15T19:25:38Z","updated":"2026-07-16T07:51:01Z"},{"id":"wordfence:5a9a496a-7806-426a-a39b-0b236b1d56b5","source":"wordfence","cve":"CVE-2024-38772","title":"JetWidgets for Elementor and WooCommerce <= 1.1.7 - Authenticated (Contributor+) Limited Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9a496a-7806-426a-a39b-0b236b1d56b5?source=api-prod","affected":[{"type":"plugin","slug":"jetwoo-widgets-for-elementor","name":"JetWidgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:13:08Z"},{"id":"wordfence:5a9b284a-2af9-4d20-9663-a40b9330da35","source":"wordfence","cve":"CVE-2024-4426","title":"Comparison Slider <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9b284a-2af9-4d20-9663-a40b9330da35?source=api-prod","affected":[{"type":"plugin","slug":"comparison-slider","name":"Comparison Slider","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T19:51:50Z","updated":"2024-05-30T08:30:12Z"},{"id":"wordfence:5a9bbe79-a4c3-42eb-8d4d-47d26dbe9f43","source":"wordfence","cve":"CVE-2024-5793","title":"Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9bbe79-a4c3-42eb-8d4d-47d26dbe9f43?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T02:03:14Z"},{"id":"wordfence:5a9c5f98-3457-443c-a87d-64f9c26b4f79","source":"wordfence","cve":"","title":"SoundPress Plugin <= 2.2.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9c5f98-3457-443c-a87d-64f9c26b4f79?source=api-prod","affected":[{"type":"plugin","slug":"soundpress","name":"SoundPress Plugin","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2019-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5a9db562-6810-4da1-9e5f-6f6eadca76ac","source":"wordfence","cve":"CVE-2025-10190","title":"WP Easy Toggles <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9db562-6810-4da1-9e5f-6f6eadca76ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-toggles","name":"WP Easy Toggles","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:38:38Z","updated":"2025-10-11T09:28:38Z"},{"id":"wordfence:5a9e62de-3e70-424f-b8e5-2a5f07ca182d","source":"wordfence","cve":"CVE-2023-0404","title":"Events Made Easy <= 2.3.16 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":true,"patched_in":"2.3.17"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aa2ff1f-c018-4c35-859e-f7e42134b937","source":"wordfence","cve":"CVE-2015-10090","title":"WordPress Landing Pages <= 1.8.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aa2ff1f-c018-4c35-859e-f7e42134b937?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2015-06-15T00:00:00Z","updated":"2024-02-07T14:23:16Z"},{"id":"wordfence:5aa41416-c945-489b-81a3-1222a5e24469","source":"wordfence","cve":"CVE-2018-0577","title":"WP MAPS \u2013 Easiest & Most Advanced WordPress Plugin for Google Maps < 4.0.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aa41416-c945-489b-81a3-1222a5e24469?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2018-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aa613cb-a90b-4444-8066-5781cefda1be","source":"wordfence","cve":"CVE-2026-121765","title":"TranslatePress \u2013 Translate Multilingual sites with AI Translation <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aa613cb-a90b-4444-8066-5781cefda1be?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-11-07T11:29:45Z","updated":"2026-11-10T19:47:11Z"},{"id":"wordfence:5aa934c4-f432-43ab-a542-21579a4a41f5","source":"wordfence","cve":"CVE-2025-30625","title":"AppBanners <= 1.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aa934c4-f432-43ab-a542-21579a4a41f5?source=api-prod","affected":[{"type":"plugin","slug":"appbanners","name":"AppBanners","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:38:51Z"},{"id":"wordfence:5aa9d6cb-18c8-42e4-a466-cc35c1dc5010","source":"wordfence","cve":"CVE-2017-18611","title":"Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aa9d6cb-18c8-42e4-a466-cc35c1dc5010?source=api-prod","affected":[{"type":"plugin","slug":"magic-fields","name":"Magic Fields","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aaa178d-f942-4f41-bd8e-5b3bff8aca6c","source":"wordfence","cve":"CVE-2025-22591","title":"1003 Mortgage Application <= 1.87 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aaa178d-f942-4f41-bd8e-5b3bff8aca6c?source=api-prod","affected":[{"type":"plugin","slug":"1003-mortgage-application","name":"1003 Mortgage Application","from":"*","from_inclusive":true,"to":"1.87","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:13:27Z"},{"id":"wordfence:5aaa97cc-4deb-43b6-957d-587834eca125","source":"wordfence","cve":"CVE-2025-13519","title":"SVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aaa97cc-4deb-43b6-957d-587834eca125?source=api-prod","affected":[{"type":"plugin","slug":"svg-map-by-saedi","name":"SVG Map by Smjrifle","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-01-06T19:40:29Z","updated":"2026-09-18T19:26:41Z"},{"id":"wordfence:5aab3dea-5d14-4316-9a4c-97b0d30762bf","source":"wordfence","cve":"CVE-2024-9064","title":"Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aab3dea-5d14-4316-9a4c-97b0d30762bf?source=api-prod","affected":[{"type":"plugin","slug":"inline-svg-elementor","name":"Elementor Inline SVG","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:29:50Z","updated":"2024-10-10T02:06:08Z"},{"id":"wordfence:5aacabb5-94af-485a-af24-e84db3e3726f","source":"wordfence","cve":"CVE-2012-10018","title":"Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aacabb5-94af-485a-af24-e84db3e3726f?source=api-prod","affected":[{"type":"plugin","slug":"mapplic-lite","name":"Mapplic Lite","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"mapplic","name":"Mapplic - Custom Interactive Map WordPress Plugin","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":false,"patched_in":"6.2"}],"published":"2012-03-23T00:00:00Z","updated":"2024-10-16T06:43:33Z"},{"id":"wordfence:5aae14bb-855f-406a-a6a2-f784a0ae0166","source":"wordfence","cve":"CVE-2026-66593","title":"Security Plugin, Firewall & Malware Scanner with Auto Removal <= 2.184 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aae14bb-855f-406a-a6a2-f784a0ae0166?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.184","to_inclusive":true,"patched_in":"2.185"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:25:25Z"},{"id":"wordfence:5aaf9bb4-bafe-415f-923d-041ef80cabac","source":"wordfence","cve":"CVE-2016-10882","title":"Google Doc Embedder <= 2.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aaf9bb4-bafe-415f-923d-041ef80cabac?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2016-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ab0d9a2-ca77-439b-bced-8ab5d7b0518a","source":"wordfence","cve":"CVE-2022-34654","title":"Manage Notification E-mails <= 1.8.2 - Cross-Site Request Forgery to Plugin Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab0d9a2-ca77-439b-bced-8ab5d7b0518a?source=api-prod","affected":[{"type":"plugin","slug":"manage-notification-emails","name":"Manage Notification E-mails","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ab2c74d-b83b-40ea-951c-83aeb76a7515","source":"wordfence","cve":"CVE-2024-13771","title":"Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab2c74d-b83b-40ea-951c-83aeb76a7515?source=api-prod","affected":[{"type":"theme","slug":"civi","name":"Civi - Job Board & Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-05-21T14:19:57Z"},{"id":"wordfence:5ab2e2ae-6f46-4815-a2d2-407767bfaba8","source":"wordfence","cve":"CVE-2023-3992","title":"PostX - Gutenberg Post Grid Blocks <= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab2e2ae-6f46-4815-a2d2-407767bfaba8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ab508fa-298c-48c1-8510-f2e0a881675a","source":"wordfence","cve":"CVE-2025-12030","title":"ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab508fa-298c-48c1-8510-f2e0a881675a?source=api-prod","affected":[{"type":"plugin","slug":"acf-to-rest-api","name":"ACF to REST API","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:59:52Z","updated":"2026-01-07T08:21:52Z"},{"id":"wordfence:5ab513d4-4cb9-4761-92af-a2224cb6a306","source":"wordfence","cve":"CVE-2014-10380","title":"Profile Builder \u2013 User Profile & User Registration Forms < 1.1.66 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab513d4-4cb9-4761-92af-a2224cb6a306?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"1.1.66","to_inclusive":false,"patched_in":"1.1.66"}],"published":"2014-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ab989ea-f498-4c74-b761-416d73059108","source":"wordfence","cve":"CVE-2021-24781","title":"Image Source Control Lite < 2.3.1 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab989ea-f498-4c74-b761-416d73059108?source=api-prod","affected":[{"type":"plugin","slug":"image-source-control-isc","name":"Image Source Control Lite \u2013 Show Image Credits and Captions","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ab9c383-14da-479d-9709-1ae154dae398","source":"wordfence","cve":"CVE-2024-1106","title":"Shariff Wrapper <= 4.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab9c383-14da-479d-9709-1ae154dae398?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.6.10"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T14:06:09Z"},{"id":"wordfence:5abae31f-2e1b-42c1-a8b0-6847aa853fb4","source":"wordfence","cve":"CVE-2025-31629","title":"Infusionsoft Web Form JavaScript <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abae31f-2e1b-42c1-a8b0-6847aa853fb4?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-web-form-javascript","name":"Infusionsoft Web Form JavaScript","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:32:57Z"},{"id":"wordfence:5abc012f-b728-43e1-b6f4-2fc2bb753548","source":"wordfence","cve":"CVE-2026-39534","title":"WP Directory Kit <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc012f-b728-43e1-b6f4-2fc2bb753548?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:01:46Z"},{"id":"wordfence:5abc0853-5888-4538-a6f3-78acef88ff63","source":"wordfence","cve":"CVE-2024-37415","title":"E2Pdf \u2013 Export To Pdf Tool for WordPress <= 1.20.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc0853-5888-4538-a6f3-78acef88ff63?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.27","to_inclusive":true,"patched_in":"1.23.00"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:24:44Z"},{"id":"wordfence:5abc282d-68c9-423c-a15c-d4d3f7035661","source":"wordfence","cve":"CVE-2023-7068","title":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc282d-68c9-423c-a15c-d4d3f7035661?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:24Z"},{"id":"wordfence:5abc627d-2d8e-44e6-8e8e-ad9f55cbb0d8","source":"wordfence","cve":"CVE-2023-45052","title":"WP Bing Map Pro <= 4.1.4 - Cross-Site Request Forgery via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abc627d-2d8e-44e6-8e8e-ad9f55cbb0d8?source=api-prod","affected":[{"type":"plugin","slug":"api-bing-map-2018","name":"Tuskcode Map Pro for Bing Maps","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5abf4742-c9db-449c-a814-c9a0abb19efc","source":"wordfence","cve":"CVE-2024-52340","title":"Photographer Connections <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5abf4742-c9db-449c-a814-c9a0abb19efc?source=api-prod","affected":[{"type":"plugin","slug":"photographer-connections","name":"Photographer Connections","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:53:40Z"},{"id":"wordfence:5ac1145b-5ab1-47a9-9117-4870c52a70fc","source":"wordfence","cve":"CVE-2025-1439","title":"Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac1145b-5ab1-47a9-9117-4870c52a70fc?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2024.5","to_inclusive":true,"patched_in":"2025.0"}],"published":"2025-03-25T21:14:57Z","updated":"2025-03-26T09:21:44Z"},{"id":"wordfence:5ac30f59-45d0-4c28-ad90-e04452ee60dd","source":"wordfence","cve":"CVE-2025-39478","title":"Smart Notification <= 10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac30f59-45d0-4c28-ad90-e04452ee60dd?source=api-prod","affected":[{"type":"plugin","slug":"smio-push-notification","name":"Smart Notification Wordpress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter.","from":"*","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T17:53:33Z"},{"id":"wordfence:5ac3ac02-d496-46cb-9aff-ffeeb8fd80fa","source":"wordfence","cve":"CVE-2026-4336","title":"Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac3ac02-d496-46cb-9aff-ffeeb8fd80fa?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2026-04-08T14:25:15Z","updated":"2026-04-09T03:25:57Z"},{"id":"wordfence:5ac47137-eecf-4f85-a29d-88a86b2a9c48","source":"wordfence","cve":"CVE-2021-24161","title":"Responsive Menu <= 4.0.3 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac47137-eecf-4f85-a29d-88a86b2a9c48?source=api-prod","affected":[{"type":"plugin","slug":"responsive-menu","name":"Responsive Menu \u2013 Mobile Menu & Hamburger Menu Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ac49a00-dabc-4cd9-9032-c038ede3fd8f","source":"wordfence","cve":"CVE-2025-6495","title":"Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac49a00-dabc-4cd9-9032-c038ede3fd8f?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-07-28T16:22:12Z","updated":"2025-07-29T04:23:44Z"},{"id":"wordfence:5ac7408d-8ec7-415b-bf52-024182888cb4","source":"wordfence","cve":"CVE-2023-1371","title":"W4 Post List <= 2.4.5 - Information Disclosure via post_excerpt","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac7408d-8ec7-415b-bf52-024182888cb4?source=api-prod","affected":[{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4","source":"wordfence","cve":"CVE-2025-11997","title":"Document Pro Elementor \u2013 Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4?source=api-prod","affected":[{"type":"plugin","slug":"document-pro-elementor","name":"Document Pro Elementor \u2013 Documentation & Knowledge Base","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:50:40Z","updated":"2025-11-11T03:30:39Z"},{"id":"wordfence:5ac8a125-121c-4392-846e-625726043972","source":"wordfence","cve":"CVE-2024-13342","title":"Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac8a125-121c-4392-846e-625726043972?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-08-28T00:00:00Z","updated":"2025-08-29T10:54:03Z"},{"id":"wordfence:5ac8e551-7995-4201-b711-87773da1be9e","source":"wordfence","cve":"CVE-2022-0914","title":"Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac8e551-7995-4201-b711-87773da1be9e?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ac98bf7-0773-4a91-9022-105968481a47","source":"wordfence","cve":"CVE-2026-22427","title":"GoTravel <= 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac98bf7-0773-4a91-9022-105968481a47?source=api-prod","affected":[{"type":"theme","slug":"gotravel","name":"GoTravel - Travel Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:27:23Z"},{"id":"wordfence:5aca31f5-310f-441b-8d8c-51b7bf2b0b7d","source":"wordfence","cve":"CVE-2024-4419","title":"Fetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aca31f5-310f-441b-8d8c-51b7bf2b0b7d?source=api-prod","affected":[{"type":"plugin","slug":"fetch-jft","name":"Fetch JFT","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2024-05-28T16:54:09Z","updated":"2024-05-29T05:31:25Z"},{"id":"wordfence:5ad0354a-4a45-4933-9e04-58f6051ae551","source":"wordfence","cve":"CVE-2025-48159","title":"Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad0354a-4a45-4933-9e04-58f6051ae551?source=api-prod","affected":[{"type":"plugin","slug":"video-player-youtube-vimeo","name":"video-player-youtube-vimeo","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:42:25Z"},{"id":"wordfence:5ad12146-200b-48e5-82de-7572541edcc4","source":"wordfence","cve":"CVE-2023-5204","title":"AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad12146-200b-48e5-82de-7572541edcc4?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ad275a2-c559-4a2f-8f82-646cb75285a7","source":"wordfence","cve":"CVE-2025-22773","title":"Htaccess File Editor <= 1.0.19 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad275a2-c559-4a2f-8f82-646cb75285a7?source=api-prod","affected":[{"type":"plugin","slug":"htaccess-file-editor","name":"Htaccess File Editor \u2013 Easily Edit, Backup, Restore .htaccess file","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:29:03Z"},{"id":"wordfence:5ad31a9a-d8be-4a68-bbdb-05e4f2c8ad38","source":"wordfence","cve":"CVE-2026-110509","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.8.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad31a9a-d8be-4a68-bbdb-05e4f2c8ad38?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":false,"patched_in":"6.8.7"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:06Z"},{"id":"wordfence:5ada82fe-79a5-4763-a22f-13d010d0be39","source":"wordfence","cve":"CVE-2026-28156","title":"Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ada82fe-79a5-4763-a22f-13d010d0be39?source=api-prod","affected":[{"type":"plugin","slug":"lasso","name":"ToneDen Shortcode","from":"*","from_inclusive":true,"to":"358","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:49:40Z"},{"id":"wordfence:5adb9573-eb90-47a1-85c3-c2f60f69f545","source":"wordfence","cve":"CVE-2026-23973","title":"Golo - City Travel Guide WordPress Theme < 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5adb9573-eb90-47a1-85c3-c2f60f69f545?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:43:24Z"},{"id":"wordfence:5adc88e9-3fcd-4ad6-8eb9-1a111bf9cdc7","source":"wordfence","cve":"CVE-2018-19287","title":"Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5adc88e9-3fcd-4ad6-8eb9-1a111bf9cdc7?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.18","to_inclusive":false,"patched_in":"3.3.18"}],"published":"2018-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5adf03ff-5b87-4ed3-b7ec-b89bc814aba6","source":"wordfence","cve":"CVE-2023-32122","title":"Spiffy Calendar <= 4.9.3 - Reflected Cross-Site Scripting via page parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5adf03ff-5b87-4ed3-b7ec-b89bc814aba6?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":false,"patched_in":"4.9.4"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ae08e0b-ea17-46c1-aad3-4ecea69c1bdc","source":"wordfence","cve":"CVE-2024-13652","title":"ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae08e0b-ea17-46c1-aad3-4ecea69c1bdc?source=api-prod","affected":[{"type":"plugin","slug":"ecpay-ecommerce-for-woocommerce","name":"ECPay Ecommerce for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2411060","to_inclusive":true,"patched_in":"1.1.2502030"}],"published":"2025-01-30T00:51:38Z","updated":"2025-02-14T22:41:36Z"},{"id":"wordfence:5ae2d931-e188-4ab1-8e15-47fdee09e997","source":"wordfence","cve":"CVE-2025-62134","title":"Contact Form Widget <= 1.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae2d931-e188-4ab1-8e15-47fdee09e997?source=api-prod","affected":[{"type":"plugin","slug":"new-contact-form-widget","name":"Contact Form Widget \u2013 Responsive Contact Form, Query Form & Form Builder","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-12-31T00:00:00Z","updated":"2026-10-13T17:12:48Z"},{"id":"wordfence:5ae32a38-5be3-47d0-9c56-2fcda7662c71","source":"wordfence","cve":"CVE-2025-8877","title":"AffiliateWP <= 2.28.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae32a38-5be3-47d0-9c56-2fcda7662c71?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-wp","name":"AffiliateWP","from":"*","from_inclusive":true,"to":"2.28.2","to_inclusive":true,"patched_in":"2.29.0"}],"published":"2025-09-29T20:00:48Z","updated":"2025-09-30T08:25:34Z"},{"id":"wordfence:5ae4d19a-26f1-491e-b0ac-0bb2c6cdd318","source":"wordfence","cve":"CVE-2025-49351","title":"Create Posts & Terms <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae4d19a-26f1-491e-b0ac-0bb2c6cdd318?source=api-prod","affected":[{"type":"plugin","slug":"create-posts-terms","name":"Create Posts & Terms","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-27T00:00:00Z","updated":"2025-12-10T15:51:42Z"},{"id":"wordfence:5aea4f76-053d-4ce4-ae8c-7c01d7727718","source":"wordfence","cve":"CVE-2026-119213","title":"Fluent Support <= 2.4.7 \u2014 Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed","severity":"low","cvss":3.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aea4f76-053d-4ce4-ae8c-7c01d7727718?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-11-06T13:47:32Z","updated":"2026-11-07T02:29:16Z"},{"id":"wordfence:5aea8574-d90f-4359-a0c2-631019a22917","source":"wordfence","cve":"CVE-2024-49230","title":"Ajax Custom CSS/JS <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aea8574-d90f-4359-a0c2-631019a22917?source=api-prod","affected":[{"type":"plugin","slug":"ajax-awesome-css","name":"Ajax Custom CSS/JS","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:52:03Z"},{"id":"wordfence:5aeb5f26-32a4-4eba-829d-759e4c92a034","source":"wordfence","cve":"CVE-2013-3529","title":"WP FuneralPress <= 1.1.6 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aeb5f26-32a4-4eba-829d-759e4c92a034?source=api-prod","affected":[{"type":"plugin","slug":"wp-funeral-press","name":"WP FuneralPress","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2013-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aeca3b6-6b1b-40b5-8824-de4a90c7ddc3","source":"wordfence","cve":"","title":"Gantry 4 Framework <= 4.1.3 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aeca3b6-6b1b-40b5-8824-de4a90c7ddc3?source=api-prod","affected":[{"type":"plugin","slug":"gantry","name":"Gantry 4 Framework","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2015-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aeea62b-bd6c-4fe2-8c0f-8c9919688e87","source":"wordfence","cve":"CVE-2026-17532","title":"Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aeea62b-bd6c-4fe2-8c0f-8c9919688e87?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.29.18","to_inclusive":true,"patched_in":"2.29.19"}],"published":"2026-08-04T18:25:00Z","updated":"2026-08-05T06:37:56Z"},{"id":"wordfence:5aef1bc6-b155-4a70-9d08-75951e0725ad","source":"wordfence","cve":"CVE-2021-25054","title":"WPcalc \u2013 Create any online calculators <= 2.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aef1bc6-b155-4a70-9d08-75951e0725ad?source=api-prod","affected":[{"type":"plugin","slug":"wpcalc","name":"WPcalc \u2013 create any online calculators","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5aef5113-6b80-4fe8-ac98-59c1a10a146f","source":"wordfence","cve":"CVE-2024-4750","title":"Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Link on Private Post","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aef5113-6b80-4fe8-ac98-59c1a10a146f?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.5.91","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-08-09T18:41:35Z"},{"id":"wordfence:5af0e81b-9789-4f0f-8106-fb061efd445e","source":"wordfence","cve":"CVE-2026-94675","title":"Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af0e81b-9789-4f0f-8106-fb061efd445e?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"6.2.14"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:38:41Z"},{"id":"wordfence:5af1063c-615e-4196-9fa6-960c008544c4","source":"wordfence","cve":"CVE-2024-9531","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af1063c-615e-4196-9fa6-960c008544c4?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2024-10-23T19:23:30Z","updated":"2024-10-24T07:35:55Z"},{"id":"wordfence:5af11ba6-4ebe-4641-9d2d-d572f3d0cb3e","source":"wordfence","cve":"CVE-2026-80513","title":"wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af11ba6-4ebe-4641-9d2d-d572f3d0cb3e?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:48:04Z"},{"id":"wordfence:5af2f2a8-ab10-4623-abcd-234017424ab9","source":"wordfence","cve":"CVE-2022-1220","title":"FoxyShop <= 4.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af2f2a8-ab10-4623-abcd-234017424ab9?source=api-prod","affected":[{"type":"plugin","slug":"foxyshop","name":"FoxyShop","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5af3acba-9620-4038-bc0c-4be1596573ff","source":"wordfence","cve":"CVE-2025-23672","title":"Instant Appointment <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af3acba-9620-4038-bc0c-4be1596573ff?source=api-prod","affected":[{"type":"plugin","slug":"instant-appointment","name":"Instant Appointment","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:53:46Z"},{"id":"wordfence:5af467b9-6974-4123-a3e3-67f1fcec01cf","source":"wordfence","cve":"CVE-2025-31607","title":"Simple-Audioplayer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af467b9-6974-4123-a3e3-67f1fcec01cf?source=api-prod","affected":[{"type":"plugin","slug":"simple-audioplayer","name":"Simple-Audioplayer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:15:25Z"},{"id":"wordfence:5af46aef-9c1d-46f2-987d-62c2d668bdad","source":"wordfence","cve":"CVE-2026-39712","title":"tagDiv Composer <= 5.4.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af46aef-9c1d-46f2-987d-62c2d668bdad?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-21T20:29:52Z"},{"id":"wordfence:5af7055d-832e-430c-b9d9-bcfc9cf1d10f","source":"wordfence","cve":"CVE-2025-32301","title":"CountDown Pro WP Plugin <= 2.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af7055d-832e-430c-b9d9-bcfc9cf1d10f?source=api-prod","affected":[{"type":"plugin","slug":"circular_countdown","name":"CountDown Pro WP Plugin","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-29T16:49:01Z"},{"id":"wordfence:5af799a4-0aee-4601-943e-82cbc860ede5","source":"wordfence","cve":"CVE-2022-46813","title":"Advanced Database Cleaner <= 3.1.1 - Cross-Site Request Forgery via aDBc_save_settings_callback","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5af799a4-0aee-4601-943e-82cbc860ede5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5afb3c3a-17d1-4cfb-9058-ae6a58e04c6b","source":"wordfence","cve":"CVE-2024-30436","title":"collectchat <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5afb3c3a-17d1-4cfb-9058-ae6a58e04c6b?source=api-prod","affected":[{"type":"plugin","slug":"collectchat","name":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:23:12Z"},{"id":"wordfence:5aff79ef-6c96-4386-abf1-b4e6931ef0d2","source":"wordfence","cve":"CVE-2022-2563","title":"Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5aff79ef-6c96-4386-abf1-b4e6931ef0d2?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b00cf9b-60c3-44a4-98a7-ee0f3e763c87","source":"wordfence","cve":"CVE-2025-31084","title":"Sunshine Photo Cart <= 3.4.10 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b00cf9b-60c3-44a4-98a7-ee0f3e763c87?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":"3.4.11"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:00:45Z"},{"id":"wordfence:5b01fa6b-c830-4e73-b9bd-edeec278afae","source":"wordfence","cve":"CVE-2026-95513","title":"Online Booking & Scheduling Calendar by vcita <= 4.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b01fa6b-c830-4e73-b9bd-edeec278afae?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2026-09-23T12:38:04Z","updated":"2026-09-29T19:52:26Z"},{"id":"wordfence:5b050546-fe37-4c3b-a9e4-46a65f19e64d","source":"wordfence","cve":"CVE-2025-49070","title":"Elessi < 6.4.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b050546-fe37-4c3b-a9e4-46a65f19e64d?source=api-prod","affected":[{"type":"theme","slug":"elessi-theme","name":"Elessi - WooCommerce AJAX WordPress Theme - RTL support","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":false,"patched_in":"6.4.1"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:37:58Z"},{"id":"wordfence:5b05e973-c0ab-492f-8b51-e7c2f33475ad","source":"wordfence","cve":"","title":"leads5050-visitor-insights < 1.0.4 - Unauthenticated Arbitrary License Change","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b05e973-c0ab-492f-8b51-e7c2f33475ad?source=api-prod","affected":[{"type":"plugin","slug":"leads-5050-visitor-insights","name":"Leads5050 Visitor Insights","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b07ea6a-511d-44ab-b0b7-5124702ad47d","source":"wordfence","cve":"CVE-2023-51484","title":"Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b07ea6a-511d-44ab-b0b7-5124702ad47d?source=api-prod","affected":[{"type":"plugin","slug":"login-as-customer-or-user","name":"Login as User or Customer \u2014 User Switching","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2023-12-27T00:00:00Z","updated":"2026-05-11T19:38:18Z"},{"id":"wordfence:5b096b49-a7a9-4223-8ec7-beea39e3568d","source":"wordfence","cve":"CVE-2026-74930","title":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b096b49-a7a9-4223-8ec7-beea39e3568d?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"2.2.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:04:30Z"},{"id":"wordfence:5b09bfff-4d6e-4de0-b6ab-6ac27c4f2be6","source":"wordfence","cve":"CVE-2024-12331","title":"File Manager Pro \u2013 Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b09bfff-4d6e-4de0-b6ab-6ac27c4f2be6?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2024-12-18T00:00:00Z","updated":"2024-12-19T11:14:15Z"},{"id":"wordfence:5b0c8edd-b392-4d23-bde3-0521eeedc5a0","source":"wordfence","cve":"CVE-2026-12476","title":"Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0c8edd-b392-4d23-bde3-0521eeedc5a0?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.9.1"}],"published":"2026-07-28T13:30:14Z","updated":"2026-07-29T02:31:39Z"},{"id":"wordfence:5b0f3444-4c10-45ce-a00b-4ed6038b8846","source":"wordfence","cve":"CVE-2026-86583","title":"Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0f3444-4c10-45ce-a00b-4ed6038b8846?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.17","to_inclusive":true,"patched_in":"2.4.18"}],"published":"2026-09-23T09:27:14Z","updated":"2026-09-23T21:27:40Z"},{"id":"wordfence:5b127a47-d22f-47b5-92a8-440a5892a181","source":"wordfence","cve":"CVE-2023-0504","title":"HT Politic <= 2.3.7 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b127a47-d22f-47b5-92a8-440a5892a181?source=api-prod","affected":[{"type":"plugin","slug":"wp-politic","name":"HT Politic \u2013 For Political WordPress Themes / Website","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b12f597-c34c-4b3b-80a6-8fd25f60b862","source":"wordfence","cve":"CVE-2024-44042","title":"WP Datepicker <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b12f597-c34c-4b3b-80a6-8fd25f60b862?source=api-prod","affected":[{"type":"plugin","slug":"wp-datepicker","name":"WP Datepicker","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T20:01:59Z"},{"id":"wordfence:5b13d437-acd7-462f-8bb3-4fd5ee669d64","source":"wordfence","cve":"CVE-2026-110955","title":"Wurdey <= 1.0.0 - Unauthenticated Administrator Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b13d437-acd7-462f-8bb3-4fd5ee669d64?source=api-prod","affected":[{"type":"plugin","slug":"wurdey","name":"Wurdey","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:40:41Z"},{"id":"wordfence:5b15575f-0638-40ec-b152-20ba2225a725","source":"wordfence","cve":"CVE-2026-2481","title":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b15575f-0638-40ec-b152-20ba2225a725?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.10.1.1","to_inclusive":true,"patched_in":"2.10.1.2"}],"published":"2026-04-07T22:31:55Z","updated":"2026-04-08T11:17:26Z"},{"id":"wordfence:5b168045-9b68-43a7-89ce-d00a88bf8acd","source":"wordfence","cve":"CVE-2023-2123","title":"WP Inventory Manager <= 2.1.0.12 - Reflected Cross-Site Scripting via 'message'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b168045-9b68-43a7-89ce-d00a88bf8acd?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.1.0.12","to_inclusive":true,"patched_in":"2.1.0.13"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b16df88-7d9f-4ee2-90ab-6da50c69148e","source":"wordfence","cve":"CVE-2023-45628","title":"QR Twitter Widget <= 0.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b16df88-7d9f-4ee2-90ab-6da50c69148e?source=api-prod","affected":[{"type":"plugin","slug":"qr-twitter-widget","name":"QR Twitter Widget","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b17e416-7ca5-4447-ad7e-d3da2fddab86","source":"wordfence","cve":"CVE-2021-24745","title":"About Author Box < 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b17e416-7ca5-4447-ad7e-d3da2fddab86?source=api-prod","affected":[{"type":"plugin","slug":"about-author-box","name":"About Author Box","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2021-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b187817-bcd7-4690-a9ab-329ae790e1ba","source":"wordfence","cve":"CVE-2026-104682","title":"Envira Gallery <= 1.16.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b187817-bcd7-4690-a9ab-329ae790e1ba?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:56:10Z"},{"id":"wordfence:5b1a2126-978c-48fa-b260-abfd26d0ec97","source":"wordfence","cve":"CVE-2019-14797","title":"Photo Gallery by 10Web <= 1.5.22 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b1a2126-978c-48fa-b260-abfd26d0ec97?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.22","to_inclusive":true,"patched_in":"1.5.23"}],"published":"2019-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b1aa13e-7efa-4dd8-afd5-28a8346bf114","source":"wordfence","cve":"CVE-2026-89023","title":"Domain For Sale \u2013 Landing Page Per Domain, Domain Mapping, Offers & Listings <= 3.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b1aa13e-7efa-4dd8-afd5-28a8346bf114?source=api-prod","affected":[{"type":"plugin","slug":"domain-for-sale","name":"Domain For Sale \u2013 Landing Page Per Domain, Domain Mapping, Offers & Listings","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-09-13T00:00:00Z","updated":"2026-09-16T19:07:01Z"},{"id":"wordfence:5b1aa615-f72b-4ccc-9df9-1175cd7f2dab","source":"wordfence","cve":"CVE-2026-102385","title":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b1aa615-f72b-4ccc-9df9-1175cd7f2dab?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-09-30T11:39:13Z","updated":"2026-10-08T23:11:50Z"},{"id":"wordfence:5b1b0dbd-084a-44e5-b711-1d5bafb0a300","source":"wordfence","cve":"CVE-2011-1669","title":"WP Custom Pages <= 0.5.0.1 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b1b0dbd-084a-44e5-b711-1d5bafb0a300?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-pages","name":"WP Custom Pages","from":"*","from_inclusive":true,"to":"0.5.0.1","to_inclusive":true,"patched_in":""}],"published":"2011-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b1e6e52-6d4f-4901-859d-05cdec9beb52","source":"wordfence","cve":"CVE-2025-39583","title":"BERTHA AI <= 1.12.10.2 - Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b1e6e52-6d4f-4901-859d-05cdec9beb52?source=api-prod","affected":[{"type":"plugin","slug":"bertha-ai-free","name":"BERTHA AI. Your AI co-pilot for WordPress and Chrome","from":"*","from_inclusive":true,"to":"1.12.10.2","to_inclusive":true,"patched_in":"1.12.11"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:31:10Z"},{"id":"wordfence:5b23bd5c-db27-4d63-8461-1f36958a2ff6","source":"wordfence","cve":"CVE-2025-2539","title":"File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-327","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b23bd5c-db27-4d63-8461-1f36958a2ff6?source=api-prod","affected":[{"type":"plugin","slug":"file-away","name":"File Away","from":"*","from_inclusive":true,"to":"3.9.9.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T22:11:18Z","updated":"2025-03-24T19:49:42Z"},{"id":"wordfence:5b253378-beba-4e31-bf1f-0352fdf98ab5","source":"wordfence","cve":"CVE-2024-53777","title":"Simple Header and Footer <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b253378-beba-4e31-bf1f-0352fdf98ab5?source=api-prod","affected":[{"type":"plugin","slug":"simple-header-and-footer","name":"Simple Header and Footer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-11-28T00:00:00Z","updated":"2026-09-30T14:22:24Z"},{"id":"wordfence:5b2553b9-775a-48f4-a7fd-1b885511bfa9","source":"wordfence","cve":"CVE-2026-73395","title":"Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2553b9-775a-48f4-a7fd-1b885511bfa9?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:17:18Z"},{"id":"wordfence:5b25908a-d394-4ce8-b853-4bdf643b9b5b","source":"wordfence","cve":"CVE-2024-35732","title":"YITH Custom Login <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b25908a-d394-4ce8-b853-4bdf643b9b5b?source=api-prod","affected":[{"type":"plugin","slug":"yith-custom-login","name":"YITH Custom Login","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:32:34Z"},{"id":"wordfence:5b266a09-22f3-4ac3-a2ba-8321503200e7","source":"wordfence","cve":"","title":"JVM WooCommerce Wishlist <= 1.2.6 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b266a09-22f3-4ac3-a2ba-8321503200e7?source=api-prod","affected":[{"type":"plugin","slug":"jvm-woocommerce-wishlist","name":"Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b2813d6-6ef5-4629-b079-bec3ad25d661","source":"wordfence","cve":"CVE-2024-53720","title":"WP-ISPConfig 3 <= 1.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2813d6-6ef5-4629-b079-bec3ad25d661?source=api-prod","affected":[{"type":"plugin","slug":"wp-ispconfig3","name":"WP-ISPConfig 3","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:29:43Z"},{"id":"wordfence:5b2840ee-3b48-415e-9bed-d34d0b6e36d7","source":"wordfence","cve":"CVE-2023-41954","title":"ProfilePress <= 4.13.1 - Limited Privilege Escalation via 'acceptable_defined_roles'","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2840ee-3b48-415e-9bed-d34d0b6e36d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.13.2","to_inclusive":false,"patched_in":"4.13.2"}],"published":"2023-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b28a733-2459-46f0-87c3-1a573a8cd55e","source":"wordfence","cve":"CVE-2024-38689","title":"Simple Popup <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b28a733-2459-46f0-87c3-1a573a8cd55e?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-plugin","name":"Simple Popup Plugin","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:41:09Z"},{"id":"wordfence:5b2bcb7e-7248-4b65-9149-b9877de133ce","source":"wordfence","cve":"CVE-2025-53429","title":"Exit Game <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2bcb7e-7248-4b65-9149-b9877de133ce?source=api-prod","affected":[{"type":"theme","slug":"exit-game","name":"Exit Game | Real-Life Secret Escape Room WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:24:16Z"},{"id":"wordfence:5b2bef63-c871-45e4-bb05-12bbba20ca5e","source":"wordfence","cve":"CVE-2023-1403","title":"Weaver Xtreme Theme <= 5.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2bef63-c871-45e4-bb05-12bbba20ca5e?source=api-prod","affected":[{"type":"theme","slug":"weaver-xtreme","name":"Weaver Xtreme","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"6.2"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b2c6eb3-6042-402d-88e1-8d9fc2291a81","source":"wordfence","cve":"CVE-2025-53230","title":"Page Manager for Elementor <= 2.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2c6eb3-6042-402d-88e1-8d9fc2291a81?source=api-prod","affected":[{"type":"plugin","slug":"page-manager-for-elementor","name":"Page Manager for Elementor","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T17:31:16Z"},{"id":"wordfence:5b2db550-c1cf-4c5b-91b1-349da3fd859d","source":"wordfence","cve":"","title":"MSMC Redirect After Comment <= 2.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2db550-c1cf-4c5b-91b1-349da3fd859d?source=api-prod","affected":[{"type":"plugin","slug":"msmc-redirect-after-comment","name":"MSMC \u2013 Redirect After Comment","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2017-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b2e599c-48de-4d3a-94a3-b98badfb7a98","source":"wordfence","cve":"CVE-2025-14626","title":"QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b2e599c-48de-4d3a-94a3-b98badfb7a98?source=api-prod","affected":[{"type":"plugin","slug":"qr-code-tag-for-wc-from-goaskle-com","name":"QR Code for WooCommerce order emails, PDF invoices, packing slips","from":"*","from_inclusive":true,"to":"1.9.42","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:35:11Z","updated":"2026-01-07T09:20:58Z"},{"id":"wordfence:5b3029c6-3a0f-4c83-8faf-f74d03852278","source":"wordfence","cve":"CVE-2023-3292","title":"Grid Kit Premium < 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3029c6-3a0f-4c83-8faf-f74d03852278?source=api-prod","affected":[{"type":"plugin","slug":"grid-kit-premium","name":"Grid Kit Premium","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b3081ff-9898-46a2-8e02-30cd83f4fbe4","source":"wordfence","cve":"CVE-2022-0360","title":"WP Ultimate CSV Importer <= 6.4.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3081ff-9898-46a2-8e02-30cd83f4fbe4?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":false,"patched_in":"6.4.3"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b313e3d-61e0-496e-af3b-155666fae059","source":"wordfence","cve":"CVE-2026-6895","title":"Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b313e3d-61e0-496e-af3b-155666fae059?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.31.0"}],"published":"2026-05-22T16:24:19Z","updated":"2026-05-23T04:27:17Z"},{"id":"wordfence:5b315119-8fd8-4709-8907-b584877c0cfe","source":"wordfence","cve":"CVE-2025-22503","title":"Admin debug wordpress \u2013 enable debug <= 1.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b315119-8fd8-4709-8907-b584877c0cfe?source=api-prod","affected":[{"type":"plugin","slug":"dzs-enable-debug","name":"Admin debug wordpress \u2013 enable debug","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:18:50Z"},{"id":"wordfence:5b3214a5-7044-4005-a200-c969d4487be2","source":"wordfence","cve":"CVE-2026-6459","title":"Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3214a5-7044-4005-a200-c969d4487be2?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":true,"patched_in":"6.6.3"}],"published":"2026-07-07T23:38:58Z","updated":"2026-07-08T12:33:16Z"},{"id":"wordfence:5b3268c2-7cdd-4839-9859-42218d4d632b","source":"wordfence","cve":"","title":"User Access Manager <= 1.2.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3268c2-7cdd-4839-9859-42218d4d632b?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2017-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b333a3d-e416-42aa-9722-5406df0a64b3","source":"wordfence","cve":"CVE-2026-4100","title":"Paid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b333a3d-e416-42aa-9722-5406df0a64b3?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T11:16:11Z"},{"id":"wordfence:5b33aa60-ac20-42c3-a3ab-b29ddfe2284a","source":"wordfence","cve":"CVE-2026-15645","title":"Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b33aa60-ac20-42c3-a3ab-b29ddfe2284a?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-01T07:49:47Z"},{"id":"wordfence:5b35a3af-acd4-40e3-9fdd-25e2f046af7b","source":"wordfence","cve":"CVE-2026-32565","title":"Contextual Related Posts < 4.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b35a3af-acd4-40e3-9fdd-25e2f046af7b?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":false,"patched_in":"4.2.2"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T20:02:45Z"},{"id":"wordfence:5b37bb5f-7a5f-42bc-bd3b-a5213db29beb","source":"wordfence","cve":"CVE-2025-30825","title":"WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce <= 1.3.5 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b37bb5f-7a5f-42bc-bd3b-a5213db29beb?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-linked-products","name":"WPC Smart Linked Products \u2013 Upsells & Cross-sells for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:56:32Z"},{"id":"wordfence:5b39933a-d38e-421b-9fe4-70350e2f3da8","source":"wordfence","cve":"CVE-2025-58217","title":"Instant Breaking News <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b39933a-d38e-421b-9fe4-70350e2f3da8?source=api-prod","affected":[{"type":"plugin","slug":"instant-breaking-news","name":"Instant Breaking News","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:38:37Z"},{"id":"wordfence:5b39be2a-0769-4f3e-885f-a534682670ad","source":"wordfence","cve":"CVE-2025-32304","title":"WPCHURCH <= 2.7.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b39be2a-0769-4f3e-885f-a534682670ad?source=api-prod","affected":[{"type":"plugin","slug":"church-management","name":"WPCHURCH - Church Management System for Wordpress","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:58:00Z"},{"id":"wordfence:5b3aca44-0d47-4285-93e5-5cf147b5800e","source":"wordfence","cve":"CVE-2024-38769","title":"Arconix Shortcodes <= 2.1.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3aca44-0d47-4285-93e5-5cf147b5800e?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.1.12"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T13:38:55Z"},{"id":"wordfence:5b3c1602-07da-41ba-8717-2d928b754e1a","source":"wordfence","cve":"CVE-2026-78151","title":"FormLayer < 1.0.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3c1602-07da-41ba-8717-2d928b754e1a?source=api-prod","affected":[{"type":"plugin","slug":"formlayer","name":"FormLayer","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:23:54Z"},{"id":"wordfence:5b3f4ccb-fcc6-42ec-8e9e-03d69ae7acf2","source":"wordfence","cve":"CVE-2023-5212","title":"AI ChatBot <= 4.8.9  and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file","severity":"critical","cvss":9.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3f4ccb-fcc6-42ec-8e9e-03d69ae7acf2?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"},{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"4.9.2","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b4228df-f335-40bb-beeb-c7271789c4eb","source":"wordfence","cve":"CVE-2026-104751","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.280 - Missing Authorization to Unauthenticated SEO Data Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4228df-f335-40bb-beeb-c7271789c4eb?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.280","to_inclusive":false,"patched_in":"1.0.280"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:19:24Z"},{"id":"wordfence:5b42bca7-6556-46d9-807a-dbae82d96636","source":"wordfence","cve":"CVE-2025-53565","title":"Widget for Google Reviews <= 1.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b42bca7-6556-46d9-807a-dbae82d96636?source=api-prod","affected":[{"type":"plugin","slug":"business-reviews-wp","name":"Widget for Google Reviews","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:48:56Z"},{"id":"wordfence:5b48e0cc-5691-4df0-81ef-72f47d29ce30","source":"wordfence","cve":"CVE-2021-24276","title":"Contact Form by Supsystic <= 1.7.14 - Reflected Cross-Site scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b48e0cc-5691-4df0-81ef-72f47d29ce30?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.14","to_inclusive":true,"patched_in":"1.7.15"}],"published":"2021-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b494334-6feb-4a10-9636-3f1b1d0d5c66","source":"wordfence","cve":"CVE-2025-46233","title":"Sirv <= 7.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b494334-6feb-4a10-9636-3f1b1d0d5c66?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.5.3","to_inclusive":true,"patched_in":"7.5.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:19:04Z"},{"id":"wordfence:5b49f379-7ae1-4da9-8e1b-cbe5a561b803","source":"wordfence","cve":"CVE-2015-1394","title":"Photo Gallery by 10Web <= 1.2.10 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b49f379-7ae1-4da9-8e1b-cbe5a561b803?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":false,"patched_in":"1.2.11"}],"published":"2015-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b4a2291-cf86-4d3f-8d6e-670b1b6ab124","source":"wordfence","cve":"CVE-2024-33633","title":"Piotnet Addons For Elementor Pro <= 7.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4a2291-cf86-4d3f-8d6e-670b1b6ab124?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:24:59Z"},{"id":"wordfence:5b4db6bb-af81-496c-bd23-b777fc16c3e4","source":"wordfence","cve":"CVE-2025-24598","title":"WP Mailster <= 1.8.17.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4db6bb-af81-496c-bd23-b777fc16c3e4?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.17.0","to_inclusive":true,"patched_in":"1.8.18.0"}],"published":"2024-12-22T00:00:00Z","updated":"2025-02-20T16:18:47Z"},{"id":"wordfence:5b4dc917-0d59-4163-a613-49afc1dc4d33","source":"wordfence","cve":"CVE-2024-10583","title":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4dc917-0d59-4163-a613-49afc1dc4d33?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.20.2","to_inclusive":true,"patched_in":"1.20.3"}],"published":"2024-12-11T00:00:00Z","updated":"2026-05-23T06:01:37Z"},{"id":"wordfence:5b4e8413-2df6-432c-89b4-d675206e2afb","source":"wordfence","cve":"CVE-2025-69341","title":"WeDesignTech Ultimate Booking Addon <= 1.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4e8413-2df6-432c-89b4-d675206e2afb?source=api-prod","affected":[{"type":"plugin","slug":"wedesigntech-ultimate-booking-addon","name":"WeDesignTech Ultimate Booking Addon","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T14:44:31Z"},{"id":"wordfence:5b4f2862-c340-4637-accb-8f1ae6e432ea","source":"wordfence","cve":"CVE-2026-57423","title":"Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4f2862-c340-4637-accb-8f1ae6e432ea?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3.8","to_inclusive":true,"patched_in":"1.6.3.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:23:46Z"},{"id":"wordfence:5b4f563c-a17b-4d69-9e94-7287da976e85","source":"wordfence","cve":"CVE-2022-4746","title":"FluentAuth <= 1.0.1 -  IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b4f563c-a17b-4d69-9e94-7287da976e85?source=api-prod","affected":[{"type":"plugin","slug":"fluent-security","name":"FluentAuth \u2013 Login Security, Two-Factor Authentication, Passkeys & Social Login","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b5296ad-73c9-4a21-913a-47b3dc170a47","source":"wordfence","cve":"CVE-2026-115948","title":"Media Library Assistant <= 3.42 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5296ad-73c9-4a21-913a-47b3dc170a47?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2026-10-26T10:08:00Z","updated":"2026-10-28T01:24:13Z"},{"id":"wordfence:5b53fa6f-7fb8-4643-a365-7630102e7e46","source":"wordfence","cve":"","title":"BigContact Contact Page < 1.4.7 - Authenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b53fa6f-7fb8-4643-a365-7630102e7e46?source=api-prod","affected":[{"type":"plugin","slug":"bigcontact","name":"BigContact Contact Page","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b546d24-82c1-4598-8926-6e73a4784b38","source":"wordfence","cve":"CVE-2024-7772","title":"Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b546d24-82c1-4598-8926-6e73a4784b38?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"4.6.6"}],"published":"2024-08-23T00:00:00Z","updated":"2024-09-26T04:29:59Z"},{"id":"wordfence:5b559a48-3c8b-4f8a-9627-c4f838d20af3","source":"wordfence","cve":"CVE-2023-45060","title":"Interactive World Map <= 3.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b559a48-3c8b-4f8a-9627-c4f838d20af3?source=api-prod","affected":[{"type":"plugin","slug":"interactive-world-map","name":"Interactive World Map","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2023-10-03T00:00:00Z","updated":"2024-03-14T12:51:44Z"},{"id":"wordfence:5b562e02-60cb-4ae6-96f0-6804cec7e02c","source":"wordfence","cve":"CVE-2026-15148","title":"Events Manager <= 2.2.4 - Insecure Direct Object Reference to Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b562e02-60cb-4ae6-96f0-6804cec7e02c?source=api-prod","affected":[{"type":"plugin","slug":"wp-events-manager","name":"WP Events Manager","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-17T15:13:13Z"},{"id":"wordfence:5b5ae0ae-1272-4bac-867f-4ff84155799e","source":"wordfence","cve":"CVE-2025-49372","title":"HAPPY <= 1.0.7 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5ae0ae-1272-4bac-867f-4ff84155799e?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-10-25T00:00:00Z","updated":"2025-10-29T15:46:49Z"},{"id":"wordfence:5b5c2a74-c1e8-4381-8d0d-66a2ed3b937e","source":"wordfence","cve":"CVE-2021-38314","title":"Gutenberg Template Library & Redux Framework <= 4.2.11 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5c2a74-c1e8-4381-8d0d-66a2ed3b937e?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"4.2.13"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b5c8733-7396-4ae5-862d-15db370dbdd7","source":"wordfence","cve":"CVE-2024-48034","title":"Creates 3D Flipbook, PDF Flipbook <= 1.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5c8733-7396-4ae5-862d-15db370dbdd7?source=api-prod","affected":[{"type":"plugin","slug":"create-flipbook-from-pdf","name":"Creates 3D Flipbook, PDF Flipbook in WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:40:08Z"},{"id":"wordfence:5b5e0204-4a05-45c1-833a-c2e4016d9830","source":"wordfence","cve":"CVE-2022-2518","title":"Stockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5e0204-4a05-45c1-833a-c2e4016d9830?source=api-prod","affected":[{"type":"plugin","slug":"stockists-manager","name":"Stockists Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.2.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b5fb356-df9a-45c1-a663-b762ca1b65c5","source":"wordfence","cve":"CVE-2022-1597","title":"WPQA - Builder forms Addon For WordPress  <= 5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5fb356-df9a-45c1-a663-b762ca1b65c5?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":false,"patched_in":"5.4"}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b611abb-460c-44d4-9f77-052a208f8d85","source":"wordfence","cve":"CVE-2024-30516","title":"Booking Package <= 1.6.27 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b611abb-460c-44d4-9f77-052a208f8d85?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.6.27","to_inclusive":true,"patched_in":"1.6.29"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:35:14Z"},{"id":"wordfence:5b62219a-c054-4ae6-ad00-b411995c2b9a","source":"wordfence","cve":"CVE-2025-47597","title":"WP Podcasts Manager <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b62219a-c054-4ae6-ad00-b411995c2b9a?source=api-prod","affected":[{"type":"plugin","slug":"wp-podcasts-manager","name":"WP Podcasts Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-05-07T00:00:00Z","updated":"2026-01-06T19:50:59Z"},{"id":"wordfence:5b624e9b-d21e-43d2-83ad-7760ed63a75c","source":"wordfence","cve":"CVE-2024-47390","title":"Jeg Elementor Kit <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b624e9b-d21e-43d2-83ad-7760ed63a75c?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:47:50Z"},{"id":"wordfence:5b62aa7d-740f-447f-9086-5bc8286bc030","source":"wordfence","cve":"CVE-2025-31563","title":"AI Search Bar <= 2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b62aa7d-740f-447f-9086-5bc8286bc030?source=api-prod","affected":[{"type":"plugin","slug":"open-ai-search-bar","name":"Open AI Search Bar","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-04-01T00:00:00Z","updated":"2026-06-23T17:33:32Z"},{"id":"wordfence:5b6349c5-a5da-4b8b-b60a-c1176a06e645","source":"wordfence","cve":"CVE-2025-59567","title":"Coupon Affiliates <= 6.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b6349c5-a5da-4b8b-b60a-c1176a06e645?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:00:57Z"},{"id":"wordfence:5b645b88-85e0-4e89-bd95-444ab1db6df8","source":"wordfence","cve":"CVE-2026-3499","title":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b645b88-85e0-4e89-bd95-444ab1db6df8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"13.4.6","from_inclusive":true,"to":"13.5.2.1","to_inclusive":true,"patched_in":"13.5.2.2"}],"published":"2026-04-07T12:49:34Z","updated":"2026-04-08T01:24:44Z"},{"id":"wordfence:5b655b04-1f2f-4745-8237-7ef3f8e31ace","source":"wordfence","cve":"CVE-2024-3998","title":"Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b655b04-1f2f-4745-8237-7ef3f8e31ace?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.5.6","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T16:16:40Z","updated":"2024-08-30T04:29:56Z"},{"id":"wordfence:5b6739b5-0df4-49b2-a655-4f0cff5886b7","source":"wordfence","cve":"CVE-2023-3225","title":"Float menu <= 5.0.2 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b6739b5-0df4-49b2-a655-4f0cff5886b7?source=api-prod","affected":[{"type":"plugin","slug":"float-menu","name":"Float menu \u2013 awesome floating side menu","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b67a9ce-44ad-4438-a545-84ca69e2ef47","source":"wordfence","cve":"CVE-2025-46468","title":"Fable Extra <= 1.0.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b67a9ce-44ad-4438-a545-84ca69e2ef47?source=api-prod","affected":[{"type":"plugin","slug":"fable-extra","name":"Fable Extra","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:06:28Z"},{"id":"wordfence:5b680158-0752-46bd-a5bb-343b65c0aeb4","source":"wordfence","cve":"CVE-2024-37498","title":"Table & Contact Form 7 Database \u2013 Tablesome <= 1.0.33 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b680158-0752-46bd-a5bb-343b65c0aeb4?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.34"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:36:50Z"},{"id":"wordfence:5b68e26d-1680-42ed-9b8e-23c80c19b1be","source":"wordfence","cve":"CVE-2013-4954","title":"Pie Register <= 1.30 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b68e26d-1680-42ed-9b8e-23c80c19b1be?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b6d0a38-ac28-41c9-9da1-b30b3657b463","source":"wordfence","cve":"CVE-2023-48777","title":"Elementor <= 3.18.1 - Authenticated(Contributor+) Arbitrary File Upload to Remote Code Execution via Template Import","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b6d0a38-ac28-41c9-9da1-b30b3657b463?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.18.1","to_inclusive":true,"patched_in":"3.18.2"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b720612-f3ec-4cc0-9cc8-b9e01421ca87","source":"wordfence","cve":"CVE-2023-37997","title":"Post List With Featured Image <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b720612-f3ec-4cc0-9cc8-b9e01421ca87?source=api-prod","affected":[{"type":"plugin","slug":"post-list-with-featured-image","name":"Post List With Featured Image","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b722643-33c1-495e-b116-b7886cb4bd79","source":"wordfence","cve":"CVE-2026-39797","title":"The GDPR Framework By Data443 <= 2.5.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b722643-33c1-495e-b116-b7886cb4bd79?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-framework","name":"The GDPR Framework By Data443","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-10-05T16:54:43Z","updated":"2026-10-28T21:17:49Z"},{"id":"wordfence:5b74d6aa-ad59-42be-b454-9c27428cab01","source":"wordfence","cve":"CVE-2025-1005","title":"ElementsKit Elementor addons <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b74d6aa-ad59-42be-b454-9c27428cab01?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-02-14T21:06:53Z","updated":"2025-02-15T09:24:22Z"},{"id":"wordfence:5b75c322-539d-44e9-8f26-5ff929874b67","source":"wordfence","cve":"CVE-2020-36708","title":"Epsilon Framework Themes (Various Versions) - Function Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b75c322-539d-44e9-8f26-5ff929874b67?source=api-prod","affected":[{"type":"theme","slug":"allegiant","name":"Allegiant","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"naturemag-lite","name":"NatureMag Lite","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"newsmag","name":"NewsMag","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"},{"type":"theme","slug":"shapely","name":"Shapely","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.9"},{"type":"theme","slug":"bonkers","name":"Bonkers","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"regina-lite","name":"Regina Lite","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.6"},{"type":"theme","slug":"transcend","name":"Transcend","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"sparkling","name":"Sparkling","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"},{"type":"theme","slug":"newspaper-x","name":"Newspaper X","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"},{"type":"theme","slug":"antreas","name":"Antreas","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"affluent","name":"Affluent","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.2"},{"type":"theme","slug":"brilliance","name":"Brilliance","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.3.0"},{"type":"theme","slug":"activello","name":"Activello","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.2"},{"type":"theme","slug":"illdy","name":"Illdy","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.7"},{"type":"theme","slug":"medzone-lite","name":"MedZone Lite","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"pixova-lite","name":"Pixova Lite","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2020-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b768300-08c7-43cb-b6b2-579172dfc88e","source":"wordfence","cve":"CVE-2025-22735","title":"Tag Groups is the Advanced Way to Display Your Taxonomy Terms <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b768300-08c7-43cb-b6b2-579172dfc88e?source=api-prod","affected":[{"type":"plugin","slug":"tag-groups","name":"PublishPress Tag Groups is the Advanced Way to Display Your Taxonomy Terms","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-14T15:26:23Z"},{"id":"wordfence:5b77982e-15ab-4376-89d3-7a2609b118eb","source":"wordfence","cve":"CVE-2024-10493","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b77982e-15ab-4376-89d3-7a2609b118eb?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":true,"patched_in":"5.10.3"}],"published":"2024-11-07T00:00:00Z","updated":"2024-12-12T16:03:54Z"},{"id":"wordfence:5b783cc6-d79d-43ef-948a-a1953d383ca3","source":"wordfence","cve":"CVE-2024-8704","title":"Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b783cc6-d79d-43ef-948a-a1953d383ca3?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.2.9"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T10:59:33Z"},{"id":"wordfence:5b792892-25dc-4df0-883d-afd0b47292e0","source":"wordfence","cve":"CVE-2025-12672","title":"Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b792892-25dc-4df0-883d-afd0b47292e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-flickrshow","name":"Flickr Show","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:26:26Z","updated":"2025-11-11T03:30:40Z"},{"id":"wordfence:5b79b5ae-7ce5-4065-8d7c-487df6752bc7","source":"wordfence","cve":"CVE-2024-12218","title":"Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b79b5ae-7ce5-4065-8d7c-487df6752bc7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-check-pincode-zipcode-for-shipping","name":"Woocommerce check pincode/zipcode for shipping","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:09:22Z","updated":"2025-01-09T11:10:59Z"},{"id":"wordfence:5b7b3286-b36d-42c6-94e8-e8c24047c472","source":"wordfence","cve":"CVE-2026-57688","title":"POS Entegrat\u00f6r \u2013 Gurmehub \u00d6deme Eklentisi <= 3.7.103 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7b3286-b36d-42c6-94e8-e8c24047c472?source=api-prod","affected":[{"type":"plugin","slug":"pos-entegrator","name":"POS Entegrat\u00f6r \u2013 Gurmehub \u00d6deme Eklentisi","from":"*","from_inclusive":true,"to":"3.7.103","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:52:09Z"},{"id":"wordfence:5b7c8a73-92da-4d2f-a37c-2ac380e56c5f","source":"wordfence","cve":"CVE-2025-50002","title":"Energia <= 1.1.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7c8a73-92da-4d2f-a37c-2ac380e56c5f?source=api-prod","affected":[{"type":"theme","slug":"energia","name":"Energia - Renewable Energy WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:51:02Z"},{"id":"wordfence:5b7cc660-b430-4b0f-b2d1-68ba458de8a9","source":"wordfence","cve":"CVE-2023-0983","title":"Stylish Cost Calculator < 7.9.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7cc660-b430-4b0f-b2d1-68ba458de8a9?source=api-prod","affected":[{"type":"plugin","slug":"stylish-cost-calculator-premium","name":"Stylish Cost Calculator","from":"*","from_inclusive":true,"to":"7.9.0","to_inclusive":false,"patched_in":"7.9.0"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b7d5d53-51a0-4d45-a180-0bde9edd8f4c","source":"wordfence","cve":"CVE-2026-100175","title":"Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7d5d53-51a0-4d45-a180-0bde9edd8f4c?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.9.87","to_inclusive":true,"patched_in":"1.9.88"}],"published":"2026-10-27T18:36:05Z","updated":"2026-10-28T06:45:12Z"},{"id":"wordfence:5b7e4c3c-a12e-4b11-9673-79a7060052a8","source":"wordfence","cve":"CVE-2026-3875","title":"BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7e4c3c-a12e-4b11-9673-79a7060052a8?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"4.3.9"}],"published":"2026-04-15T18:25:01Z","updated":"2026-04-16T06:44:52Z"},{"id":"wordfence:5b7e7fc7-25cb-4751-91da-477e1e4be7c0","source":"wordfence","cve":"CVE-2026-62026","title":"Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7e7fc7-25cb-4751-91da-477e1e4be7c0?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-notes","name":"Dashboard Notes","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:10:56Z"},{"id":"wordfence:5b7f3f0f-5f02-41d7-ac37-ecdde74fc532","source":"wordfence","cve":"CVE-2024-11898","title":"Scratch & Win \u2013 Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7f3f0f-5f02-41d7-ac37-ecdde74fc532?source=api-prod","affected":[{"type":"plugin","slug":"scratch-win-giveaways-for-website-facebook","name":"Scratch & Win \u2013 Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T07:34:58Z"},{"id":"wordfence:5b7f4912-affd-41e0-b407-150bfa8125d5","source":"wordfence","cve":"CVE-2026-62019","title":"Bookit \u2014 Booking & Appointment Calendar <= 2.6.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7f4912-affd-41e0-b407-150bfa8125d5?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.6","to_inclusive":true,"patched_in":"2.6.0.7"}],"published":"2026-10-30T18:13:00Z","updated":"2026-11-03T20:07:04Z"},{"id":"wordfence:5b80638b-4dd1-47f5-9a70-6bd626ac6986","source":"wordfence","cve":"CVE-2024-1678","title":"Subway \u2013 Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b80638b-4dd1-47f5-9a70-6bd626ac6986?source=api-prod","affected":[{"type":"plugin","slug":"subway","name":"Subway \u2013 Private Site Option","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:08Z"},{"id":"wordfence:5b80fc93-212e-481d-907c-275139782e77","source":"wordfence","cve":"CVE-2024-8919","title":"Confetti Fall Animation <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b80fc93-212e-481d-907c-275139782e77?source=api-prod","affected":[{"type":"plugin","slug":"confetti-fall-animation","name":"Confetti Fall Animation","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-23T18:36:24Z","updated":"2026-01-23T19:14:11Z"},{"id":"wordfence:5b815665-8e2c-4cda-8a77-e8a3e4cb7815","source":"wordfence","cve":"CVE-2025-54052","title":"Realtyna Organic IDX plugin <= 5.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b815665-8e2c-4cda-8a77-e8a3e4cb7815?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:08:07Z"},{"id":"wordfence:5b823a9d-40b2-4308-b732-4a02a06e03e9","source":"wordfence","cve":"CVE-2026-15238","title":"Hotel Booking Lite <= 6.2.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b823a9d-40b2-4308-b732-4a02a06e03e9?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"6.2.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:36:04Z"},{"id":"wordfence:5b826595-c977-4550-aa52-93bcd4a365fe","source":"wordfence","cve":"CVE-2014-10397","title":"Antioch <= 1.3 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b826595-c977-4550-aa52-93bcd4a365fe?source=api-prod","affected":[{"type":"theme","slug":"antioch","name":"Antioch","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b82994c-c0bd-4e44-95a7-7480ffbb1aad","source":"wordfence","cve":"CVE-2026-39569","title":"12 Step Meeting List <= 3.19.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b82994c-c0bd-4e44-95a7-7480ffbb1aad?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.19.9","to_inclusive":true,"patched_in":"3.19.10"}],"published":"2026-03-22T00:00:00Z","updated":"2026-04-15T21:15:01Z"},{"id":"wordfence:5b839658-c472-40f0-855f-7201baeb790f","source":"wordfence","cve":"CVE-2025-6756","title":"Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b839658-c472-40f0-855f-7201baeb790f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.21","to_inclusive":true,"patched_in":"3.5.22"}],"published":"2025-06-30T20:53:07Z","updated":"2025-07-01T09:25:06Z"},{"id":"wordfence:5b8e052a-6e60-4455-96c9-b2a3e86773da","source":"wordfence","cve":"CVE-2026-9281","title":"Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8e052a-6e60-4455-96c9-b2a3e86773da?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-06-05T12:04:46Z","updated":"2026-06-06T01:26:09Z"},{"id":"wordfence:5b8fb306-cb48-4667-b2b5-e5014ef485e2","source":"wordfence","cve":"CVE-2025-32671","title":"Print Science Designer <= 1.3.155 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b8fb306-cb48-4667-b2b5-e5014ef485e2?source=api-prod","affected":[{"type":"plugin","slug":"print-science-designer","name":"Print Science Designer","from":"*","from_inclusive":true,"to":"1.3.155","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T12:56:09Z"},{"id":"wordfence:5b909e12-8ed0-4348-adff-320d782abe75","source":"wordfence","cve":"CVE-2025-22322","title":"Private Messages for UserPro <= 4.10.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b909e12-8ed0-4348-adff-320d782abe75?source=api-prod","affected":[{"type":"plugin","slug":"userpro-messaging","name":"Private Messages for UserPro","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-14T15:22:53Z"},{"id":"wordfence:5b91ad8b-79ec-4ef7-bb39-edb06309da5e","source":"wordfence","cve":"CVE-2023-41655","title":"authLdap <= 2.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b91ad8b-79ec-4ef7-bb39-edb06309da5e?source=api-prod","affected":[{"type":"plugin","slug":"authldap","name":"authLdap","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2023-09-01T00:00:00Z","updated":"2024-05-20T19:20:21Z"},{"id":"wordfence:5b91bb81-b5e4-4a50-833b-e2e98ccc09ff","source":"wordfence","cve":"CVE-2026-77820","title":"WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b91bb81-b5e4-4a50-833b-e2e98ccc09ff?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.9.0","to_inclusive":true,"patched_in":"2.9.9.1"}],"published":"2026-09-18T12:58:31Z","updated":"2026-09-19T01:26:20Z"},{"id":"wordfence:5b92b0a4-7ebf-43b3-837b-ad710e5e35ff","source":"wordfence","cve":"CVE-2025-12181","title":"ContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b92b0a4-7ebf-43b3-837b-ad710e5e35ff?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-12-04T17:24:52Z","updated":"2026-01-14T14:10:23Z"},{"id":"wordfence:5b930316-7a2f-4539-8599-360751d49cde","source":"wordfence","cve":"CVE-2021-34642","title":"Smart Email Alerts <= 1.0.10 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b930316-7a2f-4539-8599-360751d49cde?source=api-prod","affected":[{"type":"plugin","slug":"smart-email-alerts","name":"Smart Email Alerts","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b9326a5-6373-4fc1-a510-f793c75cf2a2","source":"wordfence","cve":"CVE-2026-40758","title":"L\u00e9onie <= 1.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9326a5-6373-4fc1-a510-f793c75cf2a2?source=api-prod","affected":[{"type":"theme","slug":"lonie","name":"L\u00e9onie - Nail and Beauty Salon WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:16:02Z"},{"id":"wordfence:5b937d17-dbb3-4b81-8770-4e8cffa6620e","source":"wordfence","cve":"CVE-2026-85308","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b937d17-dbb3-4b81-8770-4e8cffa6620e?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.6"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:25:14Z"},{"id":"wordfence:5b951fd9-0fbf-4576-80a9-dbb053c3da92","source":"wordfence","cve":"CVE-2024-11601","title":"Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b951fd9-0fbf-4576-80a9-dbb053c3da92?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-11-21T00:00:00Z","updated":"2024-11-22T05:33:42Z"},{"id":"wordfence:5b957f8a-6720-484f-bfb0-b1bf7b0e03da","source":"wordfence","cve":"CVE-2025-48261","title":"MultiVendorX <= 4.2.22 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b957f8a-6720-484f-bfb0-b1bf7b0e03da?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.22","to_inclusive":true,"patched_in":"4.2.23"}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-12T13:32:30Z"},{"id":"wordfence:5b962739-8308-4cbd-b14b-1aae440a677b","source":"wordfence","cve":"CVE-2025-24776","title":"Responsive Flipbooks <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b962739-8308-4cbd-b14b-1aae440a677b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-flipbooks","name":"Responsive Flipbooks","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:12:24Z"},{"id":"wordfence:5b96e5ff-804c-41b6-ae34-5184a704b38e","source":"wordfence","cve":"CVE-2022-3896","title":"WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b96e5ff-804c-41b6-ae34-5184a704b38e?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b974e9e-9897-400c-b145-dc8a2d54b553","source":"wordfence","cve":"CVE-2023-37994","title":"Art Decoration Shortcode <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b974e9e-9897-400c-b145-dc8a2d54b553?source=api-prod","affected":[{"type":"plugin","slug":"art-decoration-shortcode","name":"Art Decoration Shortcode","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b97a2f7-b730-4fb7-a41e-dd37f5f87f27","source":"wordfence","cve":"CVE-2025-3435","title":"MangBoard WP <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b97a2f7-b730-4fb7-a41e-dd37f5f87f27?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-04-23T14:33:27Z","updated":"2025-04-24T03:21:31Z"},{"id":"wordfence:5b97cb49-abcd-4e54-b78c-0009212ffe38","source":"wordfence","cve":"CVE-2026-39695","title":"Podigee <= 1.4.0 - Unauthenticated Sever-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b97cb49-abcd-4e54-b78c-0009212ffe38?source=api-prod","affected":[{"type":"plugin","slug":"podigee","name":"Podigee for WordPress: Podcast Episodes to Blog Posts","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-02-26T00:00:00Z","updated":"2026-10-28T21:10:52Z"},{"id":"wordfence:5b98173e-0b89-44f9-a238-34a36ed422ac","source":"wordfence","cve":"CVE-2025-58251","title":"Sticky Header Effects for Elementor <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b98173e-0b89-44f9-a238-34a36ed422ac?source=api-prod","affected":[{"type":"plugin","slug":"sticky-header-effects-for-elementor","name":"Sticky Header Effects for Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T15:02:30Z"},{"id":"wordfence:5b989ad5-6c1d-4968-87e9-1af590140aa1","source":"wordfence","cve":"CVE-2026-95609","title":"Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b989ad5-6c1d-4968-87e9-1af590140aa1?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.41","to_inclusive":true,"patched_in":"3.42"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:51:07Z"},{"id":"wordfence:5b989e3e-bfa7-47f5-83ba-24f47034e143","source":"wordfence","cve":"CVE-2025-32300","title":"DZS Video Gallery <= 12.39 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b989e3e-bfa7-47f5-83ba-24f47034e143?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"12.39","to_inclusive":true,"patched_in":"12.40"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-26T15:11:18Z"},{"id":"wordfence:5b9919d4-a947-4494-a316-5e2655a4a16f","source":"wordfence","cve":"CVE-2025-39563","title":"Conditional Payments for WooCommerce <= 3.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9919d4-a947-4494-a316-5e2655a4a16f?source=api-prod","affected":[{"type":"plugin","slug":"conditional-payments-for-woocommerce","name":"Conditional Payments for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:36:54Z"},{"id":"wordfence:5b9a0751-934f-4830-80c9-39260ec1cb4f","source":"wordfence","cve":"CVE-2019-17574","title":"Popup-Maker <= 1.8.12 - Unauthenticated information disclosure","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9a0751-934f-4830-80c9-39260ec1cb4f?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b9d61cd-1955-40d0-99b4-c75f480733f8","source":"wordfence","cve":"CVE-2024-11226","title":"FireCask Like & Share Button <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9d61cd-1955-40d0-99b4-c75f480733f8?source=api-prod","affected":[{"type":"plugin","slug":"facebook-like-send-button","name":"FireCask Like & Share Button","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-01-20T22:58:31Z","updated":"2025-01-21T11:09:48Z"},{"id":"wordfence:5b9e037d-30bd-479b-9c4f-4c9082a04e08","source":"wordfence","cve":"","title":"Construct <= 1.4 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9e037d-30bd-479b-9c4f-4c9082a04e08?source=api-prod","affected":[{"type":"theme","slug":"construct","name":"Construct","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5b9e92ea-49fc-420d-9d0e-29bcf78843bd","source":"wordfence","cve":"CVE-2026-6672","title":"Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b9e92ea-49fc-420d-9d0e-29bcf78843bd?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-05-05T17:50:49Z","updated":"2026-05-06T06:47:21Z"},{"id":"wordfence:5ba0ecd6-de5a-441c-a4f6-cdfa0ae0edee","source":"wordfence","cve":"CVE-2025-53310","title":"HidePost <= 2.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba0ecd6-de5a-441c-a4f6-cdfa0ae0edee?source=api-prod","affected":[{"type":"plugin","slug":"hidepost","name":"HidePost","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:30:43Z"},{"id":"wordfence:5ba0f9c6-4d26-446c-8320-72f2df0c6d35","source":"wordfence","cve":"CVE-2026-121573","title":"WP Activity Log <= 5.6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba0f9c6-4d26-446c-8320-72f2df0c6d35?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"5.6.8"}],"published":"2026-11-07T17:12:22Z","updated":"2026-11-10T19:43:38Z"},{"id":"wordfence:5ba22ed2-4cc2-4e1e-a475-a697a8bb697d","source":"wordfence","cve":"CVE-2021-24521","title":"Side Menu Lite <= 2.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba22ed2-4cc2-4e1e-a475-a697a8bb697d?source=api-prod","affected":[{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ba48e88-6e32-428f-9592-bd955e176765","source":"wordfence","cve":"CVE-2017-6570","title":"Mail Masta <= 1.0 - SQL Injection via id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba48e88-6e32-428f-9592-bd955e176765?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ba5ddf2-8ae2-4bfa-9f15-16425baea6e1","source":"wordfence","cve":"CVE-2022-1818","title":"Multi-page Toolkit <= 2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba5ddf2-8ae2-4bfa-9f15-16425baea6e1?source=api-prod","affected":[{"type":"plugin","slug":"multi-page-toolkit","name":"Multi-page Toolkit","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ba7a54d-3497-4788-aa73-081d2c1015fc","source":"wordfence","cve":"CVE-2024-11118","title":"404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ba7a54d-3497-4788-aa73-081d2c1015fc?source=api-prod","affected":[{"type":"plugin","slug":"404-error-monitor","name":"404 Error Monitor","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:03:31Z","updated":"2024-11-16T03:20:47Z"},{"id":"wordfence:5baa15a6-c2c5-412d-a065-f13d431df4a5","source":"wordfence","cve":"CVE-2025-69310","title":"Woodly Core <= 1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5baa15a6-c2c5-412d-a065-f13d431df4a5?source=api-prod","affected":[{"type":"plugin","slug":"woodly-core","name":"Woodly Core","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:52:46Z"},{"id":"wordfence:5badcfc6-aaff-4c8e-8649-98d71d7a47ec","source":"wordfence","cve":"CVE-2024-6018","title":"Music Request Manager <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5badcfc6-aaff-4c8e-8649-98d71d7a47ec?source=api-prod","affected":[{"type":"plugin","slug":"music-request-manager","name":"Music Request Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:19:33Z"},{"id":"wordfence:5bae7516-e9dd-4c0c-b687-9cbe09b4c8bc","source":"wordfence","cve":"CVE-2014-5465","title":"Download Shortcode <= 0.2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bae7516-e9dd-4c0c-b687-9cbe09b4c8bc?source=api-prod","affected":[{"type":"plugin","slug":"download-shortcode","name":"Download Shortcode","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":"1.0"}],"published":"2013-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5baea929-0c46-4a43-b2af-367c0b5037bb","source":"wordfence","cve":"CVE-2023-6447","title":"EventPrime <= 3.3.5 - Missing Authorization to Private Event Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5baea929-0c46-4a43-b2af-367c0b5037bb?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2023-12-29T00:00:00Z","updated":"2024-02-06T13:46:32Z"},{"id":"wordfence:5baec449-59f9-47f3-af80-eb31adeacb7a","source":"wordfence","cve":"CVE-2024-32809","title":"ActiveDEMAND <= 0.2.41 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5baec449-59f9-47f3-af80-eb31adeacb7a?source=api-prod","affected":[{"type":"plugin","slug":"activedemand","name":"ActiveDEMAND","from":"*","from_inclusive":true,"to":"0.2.41","to_inclusive":true,"patched_in":"0.2.42"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:00:26Z"},{"id":"wordfence:5bb2a893-d254-42bc-8b50-2a88306dbbd7","source":"wordfence","cve":"CVE-2026-103897","title":"Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb2a893-d254-42bc-8b50-2a88306dbbd7?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2026-10-09T17:33:45Z","updated":"2026-10-10T06:40:11Z"},{"id":"wordfence:5bb45de4-2c83-4c77-aec0-f28ade966468","source":"wordfence","cve":"CVE-2021-24670","title":"CoolClock <= 4.3.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb45de4-2c83-4c77-aec0-f28ade966468?source=api-prod","affected":[{"type":"plugin","slug":"coolclock","name":"CoolClock","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":false,"patched_in":"4.3.5"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bb78074-e612-4c3f-bbae-052474dc2051","source":"wordfence","cve":"CVE-2026-33559","title":"OSM \u2013 OpenStreetMap < 6.1.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb78074-e612-4c3f-bbae-052474dc2051?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.15","to_inclusive":false,"patched_in":"6.1.15"}],"published":"2026-03-27T00:00:00Z","updated":"2026-09-16T18:15:44Z"},{"id":"wordfence:5bb962bd-9b23-4820-885e-d8095250c3c7","source":"wordfence","cve":"CVE-2026-9725","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bb962bd-9b23-4820-885e-d8095250c3c7?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-07-02T15:52:30Z","updated":"2026-07-03T04:30:17Z"},{"id":"wordfence:5bbccacf-0c34-4656-834b-b3b4c0a84abe","source":"wordfence","cve":"CVE-2023-44242","title":"Slideshow, Image Slider by 2J <= 1.3.54 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bbccacf-0c34-4656-834b-b3b4c0a84abe?source=api-prod","affected":[{"type":"plugin","slug":"2j-slideshow","name":"Slideshow, Image Slider by 2J","from":"*","from_inclusive":true,"to":"1.3.54","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bbd8851-09ae-40a1-ba88-0a2c439f102d","source":"wordfence","cve":"","title":"Ultimate Auction <= 4.0.5 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bbd8851-09ae-40a1-ba88-0a2c439f102d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2019-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bc03b4a-f7ec-4827-b914-0560b9268b6f","source":"wordfence","cve":"","title":"Front User Submit | Front Editor <= 3.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bc03b4a-f7ec-4827-b914-0560b9268b6f?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":false,"patched_in":"3.8.5"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bc4f997-fda9-4214-ab4f-16d60626d700","source":"wordfence","cve":"CVE-2026-107868","title":"YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Non-Public Product Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bc4f997-fda9-4214-ab4f-16d60626d700?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.34.0","to_inclusive":true,"patched_in":"4.34.1"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:14:17Z"},{"id":"wordfence:5bc531a3-e246-4f2e-8657-bbdfb91dbf39","source":"wordfence","cve":"CVE-2024-0566","title":"Smart Manager - WooCommerce Advanced Bulk Edit, Inventory Management & more... <= 8.27.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bc531a3-e246-4f2e-8657-bbdfb91dbf39?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.27.0","to_inclusive":true,"patched_in":"8.28.0"}],"published":"2024-01-18T00:00:00Z","updated":"2024-03-12T09:43:58Z"},{"id":"wordfence:5bc6d354-65f5-4c1e-8a43-a6ddd1280a2f","source":"wordfence","cve":"CVE-2023-23665","title":"MainWP Rocket Extension <= 4.0.3 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bc6d354-65f5-4c1e-8a43-a6ddd1280a2f?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-rocket-extension","name":"MainWP Rocket Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bc8da1b-8095-46b5-8268-63bdddb4e629","source":"wordfence","cve":"CVE-2026-2831","title":"MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bc8da1b-8095-46b5-8268-63bdddb4e629?source=api-prod","affected":[{"type":"plugin","slug":"mailarchiver","name":"MailArchiver","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-02-26T21:48:01Z","updated":"2026-02-27T11:22:51Z"},{"id":"wordfence:5bcd9404-ff96-409f-a69d-3d744dfc940e","source":"wordfence","cve":"CVE-2025-25071","title":"Vignette Ads <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcd9404-ff96-409f-a69d-3d744dfc940e?source=api-prod","affected":[{"type":"plugin","slug":"vignete-ads","name":"Vignette Ads","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:07:14Z"},{"id":"wordfence:5bcdeeff-19cb-403a-8b69-420198a44f25","source":"wordfence","cve":"CVE-2025-47490","title":"Ultimate WP Mail <= 1.3.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcdeeff-19cb-403a-8b69-420198a44f25?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:22:33Z"},{"id":"wordfence:5bcdfac0-6bca-40da-899c-44bcaa71af13","source":"wordfence","cve":"CVE-2026-57340","title":"Japanized for WooCommerce <= 2.9.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcdfac0-6bca-40da-899c-44bcaa71af13?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:09:42Z"},{"id":"wordfence:5bcf1f02-0946-4e96-a81b-00c7c48d64b3","source":"wordfence","cve":"CVE-2026-9842","title":"Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcf1f02-0946-4e96-a81b-00c7c48d64b3?source=api-prod","affected":[{"type":"plugin","slug":"backstage","name":"Backstage \u2013 Customizer Demo Access","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:30:36Z","updated":"2026-07-08T04:30:49Z"},{"id":"wordfence:5bcfe315-2db1-4f6c-9635-a7fdf5404adf","source":"wordfence","cve":"CVE-2024-11328","title":"CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcfe315-2db1-4f6c-9635-a7fdf5404adf?source=api-prod","affected":[{"type":"plugin","slug":"cluevo-lms","name":"CLUEVO LMS, E-Learning Platform","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2025-01-08T22:05:33Z","updated":"2025-11-05T18:59:18Z"},{"id":"wordfence:5bd03cd0-34f0-491c-8247-79656eba32a8","source":"wordfence","cve":"CVE-2023-2304","title":"Favorites <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd03cd0-34f0-491c-8247-79656eba32a8?source=api-prod","affected":[{"type":"plugin","slug":"favorites","name":"Favorites","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bd06e1e-505d-491e-a92b-61d390c97ea8","source":"wordfence","cve":"CVE-2022-30998","title":"Homepage Product Organizer for WooCommerce <= 1.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd06e1e-505d-491e-a92b-61d390c97ea8?source=api-prod","affected":[{"type":"plugin","slug":"homepage-product-organizer-for-woocommerce","name":"Homepage Product Organizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bd58f59-09c2-417c-89ea-5906d413288c","source":"wordfence","cve":"CVE-2021-24221","title":"Quiz And Survey Master <= 7.1.11 - Authenticated SQL injection via shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd58f59-09c2-417c-89ea-5906d413288c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.1.11","to_inclusive":true,"patched_in":"7.1.12"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bd6d250-b1c2-4c14-906d-6507ce39520f","source":"wordfence","cve":"CVE-2026-39507","title":"Social Slider Feed <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd6d250-b1c2-4c14-906d-6507ce39520f?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:59:34Z"},{"id":"wordfence:5bd7e805-53e8-4462-9219-57f196ade494","source":"wordfence","cve":"CVE-2026-94261","title":"Sifalo Pay \u2013 Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd7e805-53e8-4462-9219-57f196ade494?source=api-prod","affected":[{"type":"plugin","slug":"sifalo-pay","name":"Sifalo Pay","from":"2.0","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:24:27Z"},{"id":"wordfence:5bd803c7-c120-4967-84e3-5f97fc35a79e","source":"wordfence","cve":"CVE-2022-2384","title":"Digital Publications by Supsystic <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd803c7-c120-4967-84e3-5f97fc35a79e?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2022-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bd95df9-4355-4d57-ba44-59280463e284","source":"wordfence","cve":"CVE-2025-13681","title":"BFG Tools \u2013 Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd95df9-4355-4d57-ba44-59280463e284?source=api-prod","affected":[{"type":"plugin","slug":"bfg-tools-extension-zipper","name":"BFG Tools \u2013 Extension Zipper","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-02-13T14:25:30Z","updated":"2026-02-14T03:25:27Z"},{"id":"wordfence:5bd9ae0d-aa3a-4fb3-93b8-0e25bd01e162","source":"wordfence","cve":"CVE-2026-49782","title":"Elementor Website Builder \u2013 more than just a page builder <= 4.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9ae0d-aa3a-4fb3-93b8-0e25bd01e162?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:50:20Z"},{"id":"wordfence:5bd9f312-99e1-4dc2-855d-90339c2e24da","source":"wordfence","cve":"CVE-2025-12887","title":"Post SMTP \u2013 Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bd9f312-99e1-4dc2-855d-90339c2e24da?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2025-12-03T00:22:23Z","updated":"2025-12-11T15:52:42Z"},{"id":"wordfence:5bda56c3-56ad-40d7-b743-0b69512ec460","source":"wordfence","cve":"CVE-2025-8423","title":"My WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bda56c3-56ad-40d7-b743-0b69512ec460?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-translate","name":"My WP Translate","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T19:03:38Z","updated":"2025-09-11T07:24:56Z"},{"id":"wordfence:5bdba43c-0156-4a6b-b7b9-3f74b506e8f8","source":"wordfence","cve":"CVE-2023-44231","title":"Contact Form <= 2.0.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bdba43c-0156-4a6b-b7b9-3f74b506e8f8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-ready","name":"Contact Form","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2023-09-29T00:00:00Z","updated":"2024-03-25T17:47:01Z"},{"id":"wordfence:5bdd515c-6b52-467c-9446-6ae9b3b75e50","source":"wordfence","cve":"CVE-2026-6696","title":"Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bdd515c-6b52-467c-9446-6ae9b3b75e50?source=api-prod","affected":[{"type":"plugin","slug":"zingaya-click-to-call","name":"Zingaya Click-to-Call","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:07:29Z","updated":"2026-05-05T02:26:54Z"},{"id":"wordfence:5bde2c99-9ef9-4303-9d02-dd7305674bf0","source":"wordfence","cve":"CVE-2024-6393","title":"NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bde2c99-9ef9-4303-9d02-dd7305674bf0?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.39.4","to_inclusive":true,"patched_in":"3.39.5"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-15T19:43:52Z"},{"id":"wordfence:5bde312b-abbb-4e8e-91c6-a42dadbaedb5","source":"wordfence","cve":"CVE-2025-48148","title":"StoreKeeper for WooCommerce <= 14.4.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bde312b-abbb-4e8e-91c6-a42dadbaedb5?source=api-prod","affected":[{"type":"plugin","slug":"storekeeper-for-woocommerce","name":"StoreKeeper for WooCommerce","from":"*","from_inclusive":true,"to":"14.4.4","to_inclusive":true,"patched_in":"14.4.5"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T20:16:33Z"},{"id":"wordfence:5bdf04e6-6d9d-41a3-ac54-1a95f4617ea4","source":"wordfence","cve":"CVE-2024-13778","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bdf04e6-6d9d-41a3-ac54-1a95f4617ea4?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:46Z"},{"id":"wordfence:5be01bba-e4f4-4818-9612-fc37b648a349","source":"wordfence","cve":"CVE-2025-2841","title":"Cart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be01bba-e4f4-4818-9612-fc37b648a349?source=api-prod","affected":[{"type":"plugin","slug":"cart66-cloud","name":"Cart66 Cloud :: WordPress Ecommerce The Easy Way","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T14:19:41Z","updated":"2025-04-12T02:23:15Z"},{"id":"wordfence:5be1b4b2-4b33-45d7-82fd-b4d51e16535c","source":"wordfence","cve":"CVE-2018-21011","title":"Charitable <= 1.5.13 - Unauthorized Access to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be1b4b2-4b33-45d7-82fd-b4d51e16535c?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":false,"patched_in":"1.5.14"}],"published":"2018-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5be1cfcf-26f1-47d8-a48c-d9f385eb031a","source":"wordfence","cve":"CVE-2024-11368","title":"Splash Sync <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be1cfcf-26f1-47d8-a48c-d9f385eb031a?source=api-prod","affected":[{"type":"plugin","slug":"splash-connector","name":"Splash Sync","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-12-05T19:43:22Z","updated":"2025-02-28T15:26:06Z"},{"id":"wordfence:5be2c2e7-f982-410d-a5dc-f3ef976dff02","source":"wordfence","cve":"CVE-2022-29414","title":"Subscribe To Comments Reloaded <= 211130 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be2c2e7-f982-410d-a5dc-f3ef976dff02?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments-reloaded","name":"Subscribe To Comments Reloaded","from":"*","from_inclusive":true,"to":"211130","to_inclusive":true,"patched_in":"220502"}],"published":"2022-04-29T12:07:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5be3389e-f5cd-4462-b982-76e66203515b","source":"wordfence","cve":"CVE-2025-32575","title":"WP w3all phpBB <= 2.9.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be3389e-f5cd-4462-b982-76e66203515b?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-07-10T14:15:52Z"},{"id":"wordfence:5be69f3a-1639-4572-9873-4715b2946346","source":"wordfence","cve":"CVE-2026-108124","title":"WP Post Author <= 4.0.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be69f3a-1639-4572-9873-4715b2946346?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T15:11:16Z"},{"id":"wordfence:5be80195-192a-4b53-9d10-4d877fa0afbe","source":"wordfence","cve":"CVE-2025-5586","title":"WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be80195-192a-4b53-9d10-4d877fa0afbe?source=api-prod","affected":[{"type":"plugin","slug":"cpt-ajax-load-more","name":"WordPress Ajax Load More and Infinite Scroll","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:49:13Z","updated":"2025-06-06T06:42:51Z"},{"id":"wordfence:5be80212-dfbf-4e89-b1f6-44489c2f5048","source":"wordfence","cve":"CVE-2025-67556","title":"Advanced FAQ Manager <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be80212-dfbf-4e89-b1f6-44489c2f5048?source=api-prod","affected":[{"type":"plugin","slug":"advanced-faq-manager","name":"Advanced FAQ Manager","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-10T16:09:02Z"},{"id":"wordfence:5be89866-f60d-4cc6-ac00-80ad15a07fe3","source":"wordfence","cve":"CVE-2022-4260","title":"WP-Ban <= 1.69 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be89866-f60d-4cc6-ac00-80ad15a07fe3?source=api-prod","affected":[{"type":"plugin","slug":"wp-ban","name":"WP-Ban","from":"*","from_inclusive":true,"to":"1.69","to_inclusive":true,"patched_in":"1.69.1"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5be9a2f4-f3de-40e4-80ce-b8588e6318bf","source":"wordfence","cve":"CVE-2026-77705","title":"Booking for Appointments and Events Calendar \u2013 Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be9a2f4-f3de-40e4-80ce-b8588e6318bf?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":false,"patched_in":"2.4.10"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T20:06:33Z"},{"id":"wordfence:5be9d0ff-5d9c-4e80-a4d7-66ef4859a959","source":"wordfence","cve":"CVE-2024-25933","title":"PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5be9d0ff-5d9c-4e80-a4d7-66ef4859a959?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-02-20T00:00:00Z","updated":"2024-04-03T14:12:48Z"},{"id":"wordfence:5bea454e-bd1a-4cdf-acec-7bf15f6a6cda","source":"wordfence","cve":"CVE-2024-39668","title":"Extensions for Elementor <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bea454e-bd1a-4cdf-acec-7bf15f6a6cda?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor","name":"Extensions for Elementor","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:40:10Z"},{"id":"wordfence:5beb0f93-baa7-4400-ab40-d63f3430169e","source":"wordfence","cve":"CVE-2023-44478","title":"Events Rich Snippets for Google <= 1.8 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5beb0f93-baa7-4400-ab40-d63f3430169e?source=api-prod","affected":[{"type":"plugin","slug":"rich-snippets-vevents","name":"Events Rich Snippets for Google","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bedca60-cf63-4954-a880-7a9e4dc267c2","source":"wordfence","cve":"CVE-2025-69014","title":"Youzify <= 1.3.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bedca60-cf63-4954-a880-7a9e4dc267c2?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-27T00:00:00Z","updated":"2026-05-19T12:43:39Z"},{"id":"wordfence:5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390","source":"wordfence","cve":"CVE-2026-18431","title":"Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bef5bd3-8ec9-4a5b-bcdd-98952c7ef390?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.16","to_inclusive":true,"patched_in":"3.16.1"},{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.16","to_inclusive":true,"patched_in":"7.16.1"}],"published":"2026-08-25T17:44:47Z","updated":"2026-08-26T06:08:28Z"},{"id":"wordfence:5bf0267d-b84f-4ad2-8bb3-cc2aa4996af1","source":"wordfence","cve":"","title":"PostmagThemes Demo Import <= 1.0.6 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf0267d-b84f-4ad2-8bb3-cc2aa4996af1?source=api-prod","affected":[{"type":"plugin","slug":"postmagthemes-demo-import","name":"PostmagThemes One click Demo Import for WordPress Site","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bf12608-4e02-4b3a-9363-991dca5ee11b","source":"wordfence","cve":"CVE-2025-13897","title":"Client Testimonial Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf12608-4e02-4b3a-9363-991dca5ee11b?source=api-prod","affected":[{"type":"plugin","slug":"wp-client-testimonial","name":"Client Testimonial Slider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:37:12Z","updated":"2026-01-09T11:15:33Z"},{"id":"wordfence:5bf209b8-7c12-4fc3-af7f-4fd25777caab","source":"wordfence","cve":"CVE-2023-34024","title":"WP Full Auto Tags Manager <= 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf209b8-7c12-4fc3-af7f-4fd25777caab?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-auto-tags-manager","name":"WP Full Auto Tags Manager","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bf4ffaa-5192-4fb6-95d0-d19c4fe45b93","source":"wordfence","cve":"CVE-2023-26538","title":"Chat Bee <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf4ffaa-5192-4fb6-95d0-d19c4fe45b93?source=api-prod","affected":[{"type":"plugin","slug":"chat-bee","name":"Chat Bee","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bf50fe7-ca09-45ee-bd25-057e0a7f6dd2","source":"wordfence","cve":"CVE-2026-27069","title":"Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf50fe7-ca09-45ee-bd25-057e0a7f6dd2?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T00:00:00Z","updated":"2026-02-26T20:13:45Z"},{"id":"wordfence:5bf6d60f-57ac-4cbc-895f-a7db548cbf67","source":"wordfence","cve":"CVE-2022-42698","title":"Api2Cart Bridge Connector <= 1.1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf6d60f-57ac-4cbc-895f-a7db548cbf67?source=api-prod","affected":[{"type":"plugin","slug":"api2cart-bridge-connector","name":"Api2Cart Bridge Connector","from":"1.1.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bf95020-ac4f-4fb2-8fb4-a9998005991c","source":"wordfence","cve":"CVE-2026-12079","title":"Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bf95020-ac4f-4fb2-8fb4-a9998005991c?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-24T15:13:43Z","updated":"2026-06-25T03:42:21Z"},{"id":"wordfence:5bfc718a-408b-4389-b03b-bfe152ed7b28","source":"wordfence","cve":"CVE-2026-0738","title":"Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.8","to_inclusive":true,"patched_in":"7.4.9"}],"published":"2026-04-03T19:34:03Z","updated":"2026-04-04T07:41:58Z"},{"id":"wordfence:5bfd1650-0cc1-4b1c-9fc2-c940d841a147","source":"wordfence","cve":"CVE-2005-4463","title":"WordPress Core < 1.5.2 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfd1650-0cc1-4b1c-9fc2-c940d841a147?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2006-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5bfe0a05-6bf9-4acc-bf9d-05079c3b3664","source":"wordfence","cve":"CVE-2024-6627","title":"Happy Addons for Elementor <= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfe0a05-6bf9-4acc-bf9d-05079c3b3664?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2024-07-26T22:45:55Z","updated":"2024-07-27T11:13:37Z"},{"id":"wordfence:5bfedb93-76e6-4d3f-bf44-1e6d8947c7d1","source":"wordfence","cve":"CVE-2018-5695","title":"WP Job Board <= 4.4.4 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfedb93-76e6-4d3f-bf44-1e6d8947c7d1?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":false,"patched_in":"4.5"}],"published":"2018-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c024c77-31a8-45b8-9fcb-7ba729bec32c","source":"wordfence","cve":"CVE-2019-9618","title":"GraceMedia Media Player <= 1.0 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c024c77-31a8-45b8-9fcb-7ba729bec32c?source=api-prod","affected":[{"type":"plugin","slug":"gracemedia-media-player","name":"GraceMedia Media Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2019-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c03c07f-8f41-47c2-bc95-d92a623f5f7c","source":"wordfence","cve":"CVE-2026-12997","title":"Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c03c07f-8f41-47c2-bc95-d92a623f5f7c?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2026-07-15T06:20:27Z","updated":"2026-07-15T18:34:14Z"},{"id":"wordfence:5c068079-0857-4116-8edb-1bc2fea3c6b7","source":"wordfence","cve":"CVE-2022-47172","title":"WooLentor <= 2.6.2 - Cross-Site Request Forgery via process_data","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c068079-0857-4116-8edb-1bc2fea3c6b7?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c0963b2-210b-4dca-96a8-d048e4c53b5b","source":"wordfence","cve":"CVE-2024-4759","title":"Mime Types Extended <= 0.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0963b2-210b-4dca-96a8-d048e4c53b5b?source=api-prod","affected":[{"type":"plugin","slug":"mime-types-extended","name":"Mime Types Extended","from":"0.11","from_inclusive":true,"to":"0.11","to_inclusive":true,"patched_in":""}],"published":"2024-06-04T00:00:00Z","updated":"2026-03-27T11:28:48Z"},{"id":"wordfence:5c0e8e63-2603-4ee4-88f5-e132f9bc7fae","source":"wordfence","cve":"CVE-2024-10851","title":"Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0e8e63-2603-4ee4-88f5-e132f9bc7fae?source=api-prod","affected":[{"type":"plugin","slug":"razorpay-payment-button","name":"Razorpay Payment Button Plugin","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-11-12T13:23:53Z","updated":"2024-11-14T16:23:40Z"},{"id":"wordfence:5c0f02ad-f5f1-42b1-8116-e391aaa85430","source":"wordfence","cve":"CVE-2026-4348","title":"BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0f02ad-f5f1-42b1-8116-e391aaa85430?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs-pro","name":"BetterDocs Pro","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-05-06T15:27:14Z","updated":"2026-05-07T04:27:34Z"},{"id":"wordfence:5c0f3248-fef6-48a5-b2e1-f2778528fba1","source":"wordfence","cve":"CVE-2025-5061","title":"WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c0f3248-fef6-48a5-b2e1-f2778528fba1?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.9.30"}],"published":"2025-08-04T18:52:03Z","updated":"2026-01-19T16:28:06Z"},{"id":"wordfence:5c1464ab-217e-4c66-94f8-49376755dba7","source":"wordfence","cve":"CVE-2023-37977","title":"WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1464ab-217e-4c66-94f8-49376755dba7?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":true,"patched_in":"2.7.17"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c164adc-7652-4076-b702-2dba38506fb3","source":"wordfence","cve":"CVE-2025-31467","title":"Flickr Photostream <= 3.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c164adc-7652-4076-b702-2dba38506fb3?source=api-prod","affected":[{"type":"plugin","slug":"flickr-photostream","name":"Flickr Photostream","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T13:24:56Z"},{"id":"wordfence:5c17678e-6598-4e80-b121-beae822b9f81","source":"wordfence","cve":"CVE-2023-41653","title":"Sermon'e \u2013 Sermons Online <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c17678e-6598-4e80-b121-beae822b9f81?source=api-prod","affected":[{"type":"plugin","slug":"sermone-online-sermons-management","name":"Sermon&#039;e \u2013 Sermons Online","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c17b388-1f9a-473f-a71b-a3f72bdf301b","source":"wordfence","cve":"CVE-2014-4596","title":"WP Snap App <= 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c17b388-1f9a-473f-a71b-a3f72bdf301b?source=api-prod","affected":[{"type":"plugin","slug":"wpsnapapp","name":"WP Snap App","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c18a9b8-5041-4451-a3cc-91952c234d9c","source":"wordfence","cve":"CVE-2024-32570","title":"Cornerstone <= 0.8.0 - Reflected Cross-Site Scripting via PHP_SELF","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c18a9b8-5041-4451-a3cc-91952c234d9c?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":"0.8.1"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T16:00:19Z"},{"id":"wordfence:5c1d671c-017e-454b-8aa3-86f6d396b437","source":"wordfence","cve":"CVE-2024-25926","title":"Widgets Controller <= 1.1 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1d671c-017e-454b-8aa3-86f6d396b437?source=api-prod","affected":[{"type":"plugin","slug":"widgets-controller","name":"Widgets Controller","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-15T00:00:00Z","updated":"2024-02-20T16:12:29Z"},{"id":"wordfence:5c1dbf60-ef4b-49f3-badd-5e2260eb45ca","source":"wordfence","cve":"CVE-2025-24612","title":"Shipping for Nova Poshta plugin for WordPress <= 1.19.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1dbf60-ef4b-49f3-badd-5e2260eb45ca?source=api-prod","affected":[{"type":"plugin","slug":"nova-poshta-ttn","name":"Shipping for Nova Poshta","from":"*","from_inclusive":true,"to":"1.19.6","to_inclusive":true,"patched_in":"1.19.7"}],"published":"2024-12-29T00:00:00Z","updated":"2025-02-24T16:13:35Z"},{"id":"wordfence:5c1e6685-44a7-452e-89ab-b9fffb65a12b","source":"wordfence","cve":"CVE-2021-4353","title":"WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export","severity":"medium","cvss":5.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1e6685-44a7-452e-89ab-b9fffb65a12b?source=api-prod","affected":[{"type":"plugin","slug":"wc-dynamic-pricing-and-discounts","name":"WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c1fd517-32ee-429d-9026-512afe117dc5","source":"wordfence","cve":"CVE-2025-4101","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1fd517-32ee-429d-9026-512afe117dc5?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.22","to_inclusive":true,"patched_in":"4.2.23"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T12:22:43Z"},{"id":"wordfence:5c22eef8-b9c5-425b-91db-d2b4ff7b57d1","source":"wordfence","cve":"CVE-2025-15490","title":"Passster <= 4.2.25 - Unauthenticated Global Content Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c22eef8-b9c5-425b-91db-d2b4ff7b57d1?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"4.2.26"}],"published":"2026-02-17T00:00:00Z","updated":"2026-09-16T15:12:45Z"},{"id":"wordfence:5c24ee66-7b57-4e4c-bbb5-0451fc24ce4b","source":"wordfence","cve":"","title":"Newsletter <= 8.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c24ee66-7b57-4e4c-bbb5-0451fc24ce4b?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":"8.0.7"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c275b40-1155-4a86-8854-b0660e117fcb","source":"wordfence","cve":"CVE-2023-23686","title":"Simple Staff List <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c275b40-1155-4a86-8854-b0660e117fcb?source=api-prod","affected":[{"type":"plugin","slug":"simple-staff-list","name":"Simple Staff List","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c28577f-d405-4120-808e-62d0bd9398ac","source":"wordfence","cve":"CVE-2026-12687","title":"ProfileGrid \u2013 User Profiles, Groups and Communities < 5.9.9.8 - Unauthenticated Group Registration Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c28577f-d405-4120-808e-62d0bd9398ac?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.8","to_inclusive":false,"patched_in":"5.9.9.8"}],"published":"2026-07-10T00:00:00Z","updated":"2026-08-04T20:09:49Z"},{"id":"wordfence:5c2980c3-0038-42ab-8751-72c40921477a","source":"wordfence","cve":"CVE-2026-1253","title":"Group Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2980c3-0038-42ab-8751-72c40921477a?source=api-prod","affected":[{"type":"plugin","slug":"atomchat","name":"Group Chat & Video Chat by AtomChat","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-03-20T15:17:47Z","updated":"2026-04-27T17:40:02Z"},{"id":"wordfence:5c2988e9-85c2-44ab-847d-014206774824","source":"wordfence","cve":"CVE-2024-50446","title":"Futurio Extra <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2988e9-85c2-44ab-847d-014206774824?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:41:43Z"},{"id":"wordfence:5c2cc9a3-cd20-4c9e-baa4-1aea69f84331","source":"wordfence","cve":"CVE-2022-4936","title":"WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2cc9a3-cd20-4c9e-baa4-1aea69f84331?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.12","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c2d029a-5c66-4bae-bf5d-f164f07d5d63","source":"wordfence","cve":"CVE-2026-19860","title":"JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c2d029a-5c66-4bae-bf5d-f164f07d5d63?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.2","to_inclusive":true,"patched_in":"3.6.5.3"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:21:22Z"},{"id":"wordfence:5c30aff0-f8ee-408b-a144-0a8d12beda4c","source":"wordfence","cve":"CVE-2026-16069","title":"Brizy - Page Builder <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c30aff0-f8ee-408b-a144-0a8d12beda4c?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:36:39Z"},{"id":"wordfence:5c31072d-9921-4bef-809c-b97a1020a2cf","source":"wordfence","cve":"CVE-2023-1525","title":"Site Reviews <= 6.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c31072d-9921-4bef-809c-b97a1020a2cf?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.7.0","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c3862db-d04b-40e2-8b5e-99cd3153d654","source":"wordfence","cve":"CVE-2026-77786","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3862db-d04b-40e2-8b5e-99cd3153d654?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:48:56Z"},{"id":"wordfence:5c38f080-59c7-4201-9e87-87ee9ab6b97b","source":"wordfence","cve":"CVE-2026-1807","title":"InteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c38f080-59c7-4201-9e87-87ee9ab6b97b?source=api-prod","affected":[{"type":"plugin","slug":"interactivecalculator","name":"InteractiveCalculator for WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-02-17T18:27:00Z","updated":"2026-02-18T06:42:41Z"},{"id":"wordfence:5c394739-14c9-4e62-985b-3791f48dca65","source":"wordfence","cve":"CVE-2025-58201","title":"AfterShip Tracking <= 1.17.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c394739-14c9-4e62-985b-3791f48dca65?source=api-prod","affected":[{"type":"plugin","slug":"aftership-woocommerce-tracking","name":"AfterShip Tracking \u2013 All-In-One WooCommerce Order Tracking (Free plan available)","from":"*","from_inclusive":true,"to":"1.17.17","to_inclusive":true,"patched_in":"1.17.18"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:24:51Z"},{"id":"wordfence:5c39fded-8b32-463f-9d22-adb371ca217e","source":"wordfence","cve":"CVE-2015-9482","title":"Car Dealer Automotive WordPress Theme < 1.1.9 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c39fded-8b32-463f-9d22-adb371ca217e?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c3ae3c5-831c-4fc3-8d8f-55ac74159b96","source":"wordfence","cve":"CVE-2026-66607","title":"Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ae3c5-831c-4fc3-8d8f-55ac74159b96?source=api-prod","affected":[{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:09:44Z"},{"id":"wordfence:5c3ba9e1-52ac-473f-900a-83ff4df374d0","source":"wordfence","cve":"CVE-2026-92433","title":"Patreon WordPress <= 1.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ba9e1-52ac-473f-900a-83ff4df374d0?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:41:34Z"},{"id":"wordfence:5c3c20b8-12cf-4ce6-a1d4-99204df33fcd","source":"wordfence","cve":"CVE-2024-10590","title":"Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3c20b8-12cf-4ce6-a1d4-99204df33fcd?source=api-prod","affected":[{"type":"plugin","slug":"halfdata-optin-downloads","name":"Opt-In Downloads","from":"*","from_inclusive":true,"to":"4.07","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:37:51Z","updated":"2024-12-12T04:23:11Z"},{"id":"wordfence:5c3ca2d7-7af9-401f-bc5a-1796c6253cb0","source":"wordfence","cve":"CVE-2026-7798","title":"FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3ca2d7-7af9-401f-bc5a-1796c6253cb0?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"2.9.87","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-05-21T19:20:33Z","updated":"2026-05-22T07:50:26Z"},{"id":"wordfence:5c3cefd0-9cbb-4d7a-9fa2-e7a0007fc8b5","source":"wordfence","cve":"CVE-2025-32155","title":"Beds24 Online Booking <= 2.0.28 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3cefd0-9cbb-4d7a-9fa2-e7a0007fc8b5?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.28","to_inclusive":true,"patched_in":"2.0.29"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-15T12:23:37Z"},{"id":"wordfence:5c402fcf-0c02-4a5e-89a9-8a1ddaa630d0","source":"wordfence","cve":"CVE-2016-10736","title":"Grow Social <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c402fcf-0c02-4a5e-89a9-8a1ddaa630d0?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2016-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c408a27-7ed9-4106-8b65-9169ecc0e6f5","source":"wordfence","cve":"","title":"NextGen Cu3er Gallery <= 0.1 - Multiple Full Path Disclosures","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c408a27-7ed9-4106-8b65-9169ecc0e6f5?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-cu3er-gallery","name":"NextGen Cu3er Gallery","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c42a966-0035-4c12-8aa1-226a0157d98f","source":"wordfence","cve":"","title":"WP eCommerce <= 3.8.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c42a966-0035-4c12-8aa1-226a0157d98f?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.9.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c43c6f7-afc5-4b7a-96cc-cebfd875a47b","source":"wordfence","cve":"CVE-2025-32487","title":"Waymark <= 1.5.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c43c6f7-afc5-4b7a-96cc-cebfd875a47b?source=api-prod","affected":[{"type":"plugin","slug":"waymark","name":"Waymark","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-21T14:17:06Z"},{"id":"wordfence:5c440ae0-311d-4d0a-a216-7641c2a80669","source":"wordfence","cve":"CVE-2025-14119","title":"App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c440ae0-311d-4d0a-a216-7641c2a80669?source=api-prod","affected":[{"type":"plugin","slug":"app-template-blocks-for-wpbakery-page-builder","name":"App Landing Template Blocks for WPBakery (Visual Composer) Page Builder","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:23:24Z","updated":"2025-12-12T03:20:46Z"},{"id":"wordfence:5c482b6e-ce1e-46e2-8847-10c485594448","source":"wordfence","cve":"CVE-2023-47834","title":"Quiz And Survey Master <= 8.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c482b6e-ce1e-46e2-8847-10c485594448?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.13","to_inclusive":true,"patched_in":"8.1.14"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c4d28e3-60b6-4014-a226-7bd474ad4c46","source":"wordfence","cve":"CVE-2025-58837","title":"SS Font Awesome Icon <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4d28e3-60b6-4014-a226-7bd474ad4c46?source=api-prod","affected":[{"type":"plugin","slug":"ss-font-awesome-icon","name":"SS Font Awesome Icon","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:50:24Z"},{"id":"wordfence:5c4d337c-1ecd-4314-9698-51165e6afb7c","source":"wordfence","cve":"CVE-2026-86827","title":"BackWPup \u2013 WordPress Backup & Restore Plugin 3.3 - 5.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4d337c-1ecd-4314-9698-51165e6afb7c?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"3.3","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:18:56Z"},{"id":"wordfence:5c4e8106-6e0b-4b0b-a693-f30bfe87ff92","source":"wordfence","cve":"CVE-2024-49265","title":"Booking.com Banner Creator <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4e8106-6e0b-4b0b-a693-f30bfe87ff92?source=api-prod","affected":[{"type":"plugin","slug":"bookingcom-banner-creator","name":"Booking.com Banner Creator","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:52:55Z"},{"id":"wordfence:5c4f381f-aa03-46f9-aa27-daac4eed58c8","source":"wordfence","cve":"CVE-2025-68880","title":"Simple Archive Generator <= 5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4f381f-aa03-46f9-aa27-daac4eed58c8?source=api-prod","affected":[{"type":"plugin","slug":"simple-archive-generator","name":"Simple Archive Generator","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:18:10Z"},{"id":"wordfence:5c4fb14c-de6d-4247-8f83-050f1350f6a2","source":"wordfence","cve":"CVE-2022-2941","title":"WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c4fb14c-de6d-4247-8f83-050f1350f6a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-useronline","name":"WP-UserOnline","from":"*","from_inclusive":true,"to":"2.88.0","to_inclusive":true,"patched_in":"2.88.1"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c50b451-519c-4da8-93ce-b84e594e6775","source":"wordfence","cve":"CVE-2023-50881","title":"Advanced Access Manager <= 6.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c50b451-519c-4da8-93ce-b84e594e6775?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.9.15","to_inclusive":true,"patched_in":"6.9.16"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c517278-9d2a-4ef6-bf0e-a62f6b00dd20","source":"wordfence","cve":"CVE-2024-4471","title":"140+ Widgets | Best Addons For Elementor \u2013 FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c517278-9d2a-4ef6-bf0e-a62f6b00dd20?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.3.1","to_inclusive":true,"patched_in":"1.4.3.2"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T12:43:37Z"},{"id":"wordfence:5c51f55f-6e8c-467c-999b-4e6a1a6f7bbc","source":"wordfence","cve":"","title":"WC Fields Factory <= 4.1.5 - Authenticated(Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c51f55f-6e8c-467c-999b-4e6a1a6f7bbc?source=api-prod","affected":[{"type":"plugin","slug":"wc-fields-factory","name":"WC Fields Factory","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c55abc7-b09d-4fea-bc2f-b903d3da119f","source":"wordfence","cve":"CVE-2026-14516","title":"Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c55abc7-b09d-4fea-bc2f-b903d3da119f?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.7","to_inclusive":true,"patched_in":"27.8"}],"published":"2026-07-27T20:16:18Z","updated":"2026-08-17T13:50:23Z"},{"id":"wordfence:5c578284-006a-4bb5-a00b-295c67915f5f","source":"wordfence","cve":"CVE-2026-110363","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c578284-006a-4bb5-a00b-295c67915f5f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-19T12:21:00Z","updated":"2026-10-23T18:32:51Z"},{"id":"wordfence:5c5822b9-7fd0-4c39-a298-70d0debcc136","source":"wordfence","cve":"CVE-2025-4943","title":"LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5822b9-7fd0-4c39-a298-70d0debcc136?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-05-29T18:09:19Z","updated":"2025-05-30T06:42:52Z"},{"id":"wordfence:5c59cfc2-2a2c-4b0b-88f7-f6a96caa25c4","source":"wordfence","cve":"","title":"Admin Pack by SITE CASEIRO <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c59cfc2-2a2c-4b0b-88f7-f6a96caa25c4?source=api-prod","affected":[{"type":"plugin","slug":"admin-pack-by-site-caseiro","name":"Admin Pack by SITE CASEIRO","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2015-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c5b6501-23c5-401b-815d-1729594e6a59","source":"wordfence","cve":"CVE-2019-15781","title":"Social LikeBox & Feed <= 2.8.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5b6501-23c5-401b-815d-1729594e6a59?source=api-prod","affected":[{"type":"plugin","slug":"facebook-by-weblizar","name":"Social LikeBox & Feed","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2019-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c5d94dc-2ee0-4f04-99f0-8794e759c9e3","source":"wordfence","cve":"CVE-2025-46257","title":"Element Pack Pro <= 7.21.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5d94dc-2ee0-4f04-99f0-8794e759c9e3?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack","name":"Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin","from":"*","from_inclusive":true,"to":"7.21.0","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-05T18:07:14Z"},{"id":"wordfence:5c5e7ed1-7eb8-4ce7-9dd6-0f7937b6f671","source":"wordfence","cve":"CVE-2024-5431","title":"WPCafe \u2013 Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c5e7ed1-7eb8-4ce7-9dd6-0f7937b6f671?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.25","to_inclusive":true,"patched_in":"2.2.26"}],"published":"2024-06-24T16:59:17Z","updated":"2024-06-25T05:41:48Z"},{"id":"wordfence:5c601f75-3ee2-47ed-8d67-67fac4403a5d","source":"wordfence","cve":"CVE-2026-75860","title":"JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c601f75-3ee2-47ed-8d67-67fac4403a5d?source=api-prod","affected":[{"type":"plugin","slug":"json-options","name":"JSON Options","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T15:56:26Z"},{"id":"wordfence:5c637882-1854-4502-9907-88053d141cfc","source":"wordfence","cve":"CVE-2009-4169","title":"WP Cumulus < 1.22 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c637882-1854-4502-9907-88053d141cfc?source=api-prod","affected":[{"type":"plugin","slug":"wp-cumulus","name":"WP Cumulus","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":false,"patched_in":"1.22"}],"published":"2009-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c6455ca-2053-43db-b8dd-722a8a262ebd","source":"wordfence","cve":"CVE-2026-115959","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6455ca-2053-43db-b8dd-722a8a262ebd?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-10-26T10:35:00Z","updated":"2026-10-28T01:25:40Z"},{"id":"wordfence:5c6a6422-8255-4a3c-9ddf-b5986e1d393f","source":"wordfence","cve":"CVE-2024-12499","title":"WP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a6422-8255-4a3c-9ddf-b5986e1d393f?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-datatable","name":"WP jQuery DataTable","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:58Z"},{"id":"wordfence:5c6a819d-d9f6-4b25-979d-6ff2cf21c72c","source":"wordfence","cve":"CVE-2026-54856","title":"RexCoin - Cryptocurrency & Coin ICO WordPress <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a819d-d9f6-4b25-979d-6ff2cf21c72c?source=api-prod","affected":[{"type":"theme","slug":"rexcoin","name":"RexCoin - Cryptocurrency & Coin ICO WordPress","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T13:04:56Z","updated":"2026-11-03T20:03:06Z"},{"id":"wordfence:5c6a88c3-18b7-470f-8014-373ead66dcfa","source":"wordfence","cve":"CVE-2023-2436","title":"Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a88c3-18b7-470f-8014-373ead66dcfa?source=api-prod","affected":[{"type":"plugin","slug":"blog-in-blog","name":"Blog-in-Blog","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-05-30T00:00:00Z","updated":"2026-02-03T19:09:24Z"},{"id":"wordfence:5c6a9cfc-0b30-456e-bac5-4ad79cd08dce","source":"wordfence","cve":"CVE-2023-32574","title":"Injection Guard <= 1.2.1 - Missing Authorization via ig_update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a9cfc-0b30-456e-bac5-4ad79cd08dce?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c6ac166-d8ad-4ee0-b637-91816cb41eca","source":"wordfence","cve":"CVE-2024-37260","title":"Foxiz <= 2.3.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6ac166-d8ad-4ee0-b637-91816cb41eca?source=api-prod","affected":[{"type":"theme","slug":"foxiz","name":"Foxiz","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:15:50Z"},{"id":"wordfence:5c6b9cb0-99db-414d-be9c-8722e37bb473","source":"wordfence","cve":"CVE-2026-78138","title":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce < 2.21.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6b9cb0-99db-414d-be9c-8722e37bb473?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.21.0","to_inclusive":false,"patched_in":"2.21.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T15:24:44Z"},{"id":"wordfence:5c6dc1c5-569c-4b6f-a61f-67902e56e0e6","source":"wordfence","cve":"CVE-2026-81156","title":"Robo Gallery <= 5.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6dc1c5-569c-4b6f-a61f-67902e56e0e6?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:40Z"},{"id":"wordfence:5c6f4890-8bc9-4ead-8d69-478fa51c2176","source":"wordfence","cve":"CVE-2022-2340","title":"W-DALIL <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6f4890-8bc9-4ead-8d69-478fa51c2176?source=api-prod","affected":[{"type":"plugin","slug":"w-dalil","name":"W-DALIL","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c71dc22-0b1b-4628-bbab-4154714e8804","source":"wordfence","cve":"CVE-2024-30512","title":"weForms <= 1.6.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c71dc22-0b1b-4628-bbab-4154714e8804?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-23T15:25:45Z"},{"id":"wordfence:5c75c156-225c-465a-8d03-35a6669e9c04","source":"wordfence","cve":"","title":"Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75c156-225c-465a-8d03-35a6669e9c04?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2015-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c75cb7b-1ebe-411c-8664-848d741e40d4","source":"wordfence","cve":"CVE-2026-83526","title":"FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c75cb7b-1ebe-411c-8664-848d741e40d4?source=api-prod","affected":[{"type":"plugin","slug":"fv-player","name":"FV Player 8","from":"*","from_inclusive":true,"to":"8.1.7","to_inclusive":true,"patched_in":"8.1.8"}],"published":"2026-10-09T17:08:42Z","updated":"2026-10-28T16:56:39Z"},{"id":"wordfence:5c76871e-b774-4284-ad00-f8ef7f6df389","source":"wordfence","cve":"CVE-2023-41657","title":"HollerBox <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c76871e-b774-4284-ad00-f8ef7f6df389?source=api-prod","affected":[{"type":"plugin","slug":"holler-box","name":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c7973be-cf39-4452-9e41-19d2e6aa5e97","source":"wordfence","cve":"CVE-2024-11914","title":"Gutenberg Blocks and Page Layouts \u2013 Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7973be-cf39-4452-9e41-19d2e6aa5e97?source=api-prod","affected":[{"type":"plugin","slug":"attire-blocks","name":"Gutenberg Blocks and Page Layouts \u2013 Attire Blocks","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2024-12-11T15:19:30Z","updated":"2025-07-25T19:45:41Z"},{"id":"wordfence:5c79cbc1-4d8f-4330-b063-e5987238fca1","source":"wordfence","cve":"CVE-2022-2944","title":"WordPress Countdown Widget <= 3.1.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c79cbc1-4d8f-4330-b063-e5987238fca1?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-countdown-widget","name":"WordPress Countdown Widget","from":"*","from_inclusive":true,"to":"3.1.9.2","to_inclusive":true,"patched_in":"3.1.9.3"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c79d861-e2e8-4fca-883f-79401544b0b1","source":"wordfence","cve":"","title":"RLSWordPressSearch (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c79d861-e2e8-4fca-883f-79401544b0b1?source=api-prod","affected":[{"type":"plugin","slug":"RLSWordPressSearch","name":"RLSWordPressSearch","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c7ad369-f1ed-476b-8ffc-682315f87906","source":"wordfence","cve":"CVE-2026-28001","title":"Directory Kit <= 1.5.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7ad369-f1ed-476b-8ffc-682315f87906?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T22:01:42Z"},{"id":"wordfence:5c7b9827-59a7-4a8f-88d5-0b27c3ea2925","source":"wordfence","cve":"CVE-2025-12151","title":"Simple Folio <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7b9827-59a7-4a8f-88d5-0b27c3ea2925?source=api-prod","affected":[{"type":"plugin","slug":"simple-folio","name":"Simple Folio","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-11-26T16:28:19Z","updated":"2025-11-27T04:36:45Z"},{"id":"wordfence:5c7d4401-33aa-43c4-8659-a5664b3cf1da","source":"wordfence","cve":"CVE-2019-15836","title":"WP Ultimate Recipe < 3.12.7 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7d4401-33aa-43c4-8659-a5664b3cf1da?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-recipe","name":"WP Ultimate Recipe","from":"*","from_inclusive":true,"to":"3.12.7","to_inclusive":false,"patched_in":"3.12.7"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c7ed7c5-1a6d-41aa-a13c-c95b14573de8","source":"wordfence","cve":"CVE-2025-47675","title":"Woobox <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7ed7c5-1a6d-41aa-a13c-c95b14573de8?source=api-prod","affected":[{"type":"plugin","slug":"woobox","name":"Woobox","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-27T19:47:57Z"},{"id":"wordfence:5c7edfad-b45b-4297-876d-a063e02af0bf","source":"wordfence","cve":"","title":"Top 10 \u2013 Popular posts plugin for WordPress <= 3.2.3 - Cross-Site Request Forgery via tptn_ajax_clearcache","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7edfad-b45b-4297-876d-a063e02af0bf?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c830689-70bd-42cc-a385-fe8552f342a0","source":"wordfence","cve":"","title":"Community Lite Video Chat < 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c830689-70bd-42cc-a385-fe8552f342a0?source=api-prod","affected":[{"type":"plugin","slug":"avchat-3","name":"Community Lite Video Chat","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c83457d-ba06-43c5-acdd-77dbfb0d4af4","source":"wordfence","cve":"CVE-2025-2891","title":"WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c83457d-ba06-43c5-acdd-77dbfb0d4af4?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2025-03-31T19:22:57Z","updated":"2025-04-01T07:29:13Z"},{"id":"wordfence:5c8404d2-7b37-40df-b756-328f827f273d","source":"wordfence","cve":"CVE-2023-47779","title":"Integration for Contact Form 7 and Constant Contact <= 1.1.4 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8404d2-7b37-40df-b756-328f827f273d?source=api-prod","affected":[{"type":"plugin","slug":"cf7-constant-contact","name":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c8409c8-8917-4343-a6e6-c6b6be04a236","source":"wordfence","cve":"CVE-2025-26932","title":"ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8409c8-8917-4343-a6e6-c6b6be04a236?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:26:26Z"},{"id":"wordfence:5c852fa1-698b-4e72-b781-095e2a98df81","source":"wordfence","cve":"CVE-2023-0763","title":"Clock In Portal <= 2.1 - Cross-Site Request Forgery to Holidays Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c852fa1-698b-4e72-b781-095e2a98df81?source=api-prod","affected":[{"type":"plugin","slug":"clock-in-portal","name":"Clock In Portal- Staff & Attendance Management","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c86269a-7d04-4a5a-9d0f-3dcc79fd7d25","source":"wordfence","cve":"CVE-2025-30990","title":"ThemeHunk <= 1.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c86269a-7d04-4a5a-9d0f-3dcc79fd7d25?source=api-prod","affected":[{"type":"plugin","slug":"themehunk-megamenu-plus","name":"Easy Mega Menu for WordPress \u2013 ThemeHunk","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-06-05T00:00:00Z","updated":"2026-04-15T16:42:22Z"},{"id":"wordfence:5c8a4708-eb74-45e1-ba47-e245491a8c2f","source":"wordfence","cve":"","title":"WP Mail Logging <= 1.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8a4708-eb74-45e1-ba47-e245491a8c2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2017-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c8aa2c9-d925-460c-ad91-6fd417be3fb1","source":"wordfence","cve":"CVE-2025-49374","title":"Captcha.eu <= 1.0.61 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8aa2c9-d925-460c-ad91-6fd417be3fb1?source=api-prod","affected":[{"type":"plugin","slug":"captcha-eu","name":"Captcha.eu","from":"*","from_inclusive":true,"to":"1.0.61","to_inclusive":true,"patched_in":"1.0.62"}],"published":"2025-08-19T00:00:00Z","updated":"2025-11-04T16:08:23Z"},{"id":"wordfence:5c8b91c7-c5e9-4d39-a9ea-ed16d26031a4","source":"wordfence","cve":"CVE-2024-37954","title":"Simple Responsive Slider <= 0.2.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8b91c7-c5e9-4d39-a9ea-ed16d26031a4?source=api-prod","affected":[{"type":"plugin","slug":"simple-responsive-slider","name":"Simple Responsive Slider","from":"*","from_inclusive":true,"to":"0.2.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:45:06Z"},{"id":"wordfence:5c8caf17-7844-4f26-b989-d29593b3ffda","source":"wordfence","cve":"","title":"Fluid Checkout for WooCommerce \u2013 Lite <= 2.3.1 - Cross-Site Request Forgery via dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8caf17-7844-4f26-b989-d29593b3ffda?source=api-prod","affected":[{"type":"plugin","slug":"fluid-checkout","name":"Fluid Checkout for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-03-13T00:00:00Z","updated":"2024-04-17T13:02:12Z"},{"id":"wordfence:5c921300-88ef-43b8-959e-2bc490cf303f","source":"wordfence","cve":"CVE-2025-9884","title":"Mobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c921300-88ef-43b8-959e-2bc490cf303f?source=api-prod","affected":[{"type":"plugin","slug":"mobile-site-redirect","name":"Mobile Site Redirect","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:18:25Z","updated":"2025-10-03T11:17:12Z"},{"id":"wordfence:5c92beb0-1fcf-4352-bd34-00e31b265c04","source":"wordfence","cve":"CVE-2023-6077","title":"Ultimate Responsive Image Slider <= 3.5.11 - Missing Authorization via AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c92beb0-1fcf-4352-bd34-00e31b265c04?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-responsive-image-slider","name":"Ultimate Responsive Image Slider","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":"3.5.12"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c9320f9-2e1a-4d76-850b-fa6fb68cd09f","source":"wordfence","cve":"CVE-2024-50489","title":"Realty Workstation <= 1.0.45 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9320f9-2e1a-4d76-850b-fa6fb68cd09f?source=api-prod","affected":[{"type":"plugin","slug":"realty-workstation","name":"Realty Workstation","from":"*","from_inclusive":true,"to":"1.0.45","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:29:11Z"},{"id":"wordfence:5c9a23a3-5eb5-4f5b-bf32-c9d163426f29","source":"wordfence","cve":"CVE-2024-8911","title":"LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9a23a3-5eb5-4f5b-bf32-c9d163426f29?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"LatePoint Plugin","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":"5.0.12"}],"published":"2024-09-20T00:00:00Z","updated":"2024-10-08T08:33:19Z"},{"id":"wordfence:5c9a5613-770f-4294-997e-17fd5194ab70","source":"wordfence","cve":"","title":"Custom Permalinks <= 1.1 - Authenticated SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9a5613-770f-4294-997e-17fd5194ab70?source=api-prod","affected":[{"type":"plugin","slug":"custom-permalinks","name":"Custom Permalinks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2018-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5c9d08f5-7c94-40e7-979f-023456aeb54e","source":"wordfence","cve":"CVE-2024-1316","title":"Event Tickets and Registration  <= 5.8.0  Events Tickets Plus <= 5.9.0 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9d08f5-7c94-40e7-979f-023456aeb54e?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-plus","name":"Events Tickets Plus","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.9.1"},{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2024-02-08T00:00:00Z","updated":"2024-03-22T16:41:52Z"},{"id":"wordfence:5ca0e369-45a1-4601-bd9b-33a0bb5ca062","source":"wordfence","cve":"CVE-2026-119167","title":"TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca0e369-45a1-4601-bd9b-33a0bb5ca062?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-11-06T15:54:58Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:5ca1c55a-cd4e-429a-ab74-dd1bad1a65f5","source":"wordfence","cve":"CVE-2023-1730","title":"SupportCandy <= 3.1.4 - Unauthenticated SQL Injection via parse_user_filters","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca1c55a-cd4e-429a-ab74-dd1bad1a65f5?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ca21247-c443-4808-8397-790669453bfc","source":"wordfence","cve":"CVE-2024-22146","title":"Schema & Structured Data for WP & AMP <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca21247-c443-4808-8397-790669453bfc?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ca35c9d-a7e0-4442-82d5-5040a3443c2b","source":"wordfence","cve":"CVE-2026-56008","title":"Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca35c9d-a7e0-4442-82d5-5040a3443c2b?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.4","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-25T13:39:47Z"},{"id":"wordfence:5ca55c87-6548-43b8-a23f-d31a51df9533","source":"wordfence","cve":"CVE-2024-13883","title":"WPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca55c87-6548-43b8-a23f-d31a51df9533?source=api-prod","affected":[{"type":"plugin","slug":"wpupper-share-buttons","name":"WPUpper Share Buttons","from":"*","from_inclusive":true,"to":"3.51","to_inclusive":true,"patched_in":"3.52"}],"published":"2025-02-20T15:01:31Z","updated":"2025-03-28T18:35:15Z"},{"id":"wordfence:5ca7b7c0-a94e-47ff-996d-4c7bbd62f0de","source":"wordfence","cve":"CVE-2024-31269","title":"Easy Google Maps <= 1.11.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca7b7c0-a94e-47ff-996d-4c7bbd62f0de?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.11.11","to_inclusive":true,"patched_in":"1.11.12"}],"published":"2024-04-05T00:00:00Z","updated":"2024-05-07T20:44:22Z"},{"id":"wordfence:5caa9c7c-07b3-4288-803f-f60e5b428953","source":"wordfence","cve":"","title":"Contact Form by WPForms \u2013 Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5caa9c7c-07b3-4288-803f-f60e5b428953?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cafbb4f-ea50-440b-a7e9-64ab34fbc651","source":"wordfence","cve":"CVE-2026-96255","title":"Payments for Hubtel <= 1.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cafbb4f-ea50-440b-a7e9-64ab34fbc651?source=api-prod","affected":[{"type":"plugin","slug":"payments-hubtel","name":"Payments for Hubtel","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:54:22Z"},{"id":"wordfence:5cb00caf-6ca2-4970-8d09-14188806ba06","source":"wordfence","cve":"CVE-2025-47551","title":"Wiki Embed <= 1.4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb00caf-6ca2-4970-8d09-14188806ba06?source=api-prod","affected":[{"type":"plugin","slug":"wiki-embed","name":"Wiki Embed","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:49:11Z"},{"id":"wordfence:5cb5368f-99b1-43e3-a2e4-67e90c8edfcf","source":"wordfence","cve":"CVE-2024-8108","title":"Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb5368f-99b1-43e3-a2e4-67e90c8edfcf?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.02"}],"published":"2024-08-30T20:12:12Z","updated":"2024-08-31T08:35:17Z"},{"id":"wordfence:5cb79fbc-705a-4fb4-b441-7fe7ab6dea10","source":"wordfence","cve":"CVE-2023-41688","title":"Bulk NoIndex & NoFollow Toolkit <= 1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb79fbc-705a-4fb4-b441-7fe7ab6dea10?source=api-prod","affected":[{"type":"plugin","slug":"bulk-noindex-nofollow-toolkit-by-mad-fish","name":"Bulk NoIndex & NoFollow Toolkit","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.51"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cb80db2-753c-40fa-aee4-7d8c1749d037","source":"wordfence","cve":"CVE-2026-12089","title":"WS Optimize \u2013 All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cb80db2-753c-40fa-aee4-7d8c1749d037?source=api-prod","affected":[{"type":"plugin","slug":"lws-optimize","name":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.3.20"}],"published":"2026-06-12T14:06:04Z","updated":"2026-06-13T02:29:02Z"},{"id":"wordfence:5cba7026-04e4-4ace-9298-0177902b7529","source":"wordfence","cve":"","title":"Newsletters <= 4.6.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cba7026-04e4-4ace-9298-0177902b7529?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.6.5.2","to_inclusive":true,"patched_in":"4.6.5.3"}],"published":"2017-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cba9501-2eb1-4702-889c-d0f4777e72e9","source":"wordfence","cve":"CVE-2024-43975","title":"Super Store Finder <= 6.9.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cba9501-2eb1-4702-889c-d0f4777e72e9?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:13:15Z"},{"id":"wordfence:5cbb28e2-a7a1-4e33-93e5-872d6f2e00ec","source":"wordfence","cve":"CVE-2025-11857","title":"XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb28e2-a7a1-4e33-93e5-872d6f2e00ec?source=api-prod","affected":[{"type":"plugin","slug":"fb2wp-integration-tools","name":"XX2WP Integration Tools","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-10-17T00:00:00Z","updated":"2025-10-18T05:41:56Z"},{"id":"wordfence:5cbb7db4-bef7-4799-9b65-ebe77976e21c","source":"wordfence","cve":"CVE-2025-12800","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb7db4-bef7-4799-9b65-ebe77976e21c?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.5","to_inclusive":true,"patched_in":"7.4.6"}],"published":"2025-11-23T10:11:05Z","updated":"2025-11-23T22:26:39Z"},{"id":"wordfence:5cbb8495-70e0-48cc-84d9-6d3cf3ec5355","source":"wordfence","cve":"CVE-2019-15834","title":"WebP Converter for Media \u2013 Convert WebP and AVIF & Optimize Images <= 1.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb8495-70e0-48cc-84d9-6d3cf3ec5355?source=api-prod","affected":[{"type":"plugin","slug":"webp-converter-for-media","name":"Converter for Media \u2013 Optimize images | Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2019-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cbbcc3f-b51b-4336-ab92-c6dca4c1510a","source":"wordfence","cve":"CVE-2025-23677","title":"HTTP to HTTPS link changer by Eyga.net <= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbbcc3f-b51b-4336-ab92-c6dca4c1510a?source=api-prod","affected":[{"type":"plugin","slug":"https-links-in-content","name":"HTTP to HTTPS link changer by Eyga.net","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:19:54Z"},{"id":"wordfence:5cbbce9e-bfb5-49b3-9829-1f90e0d8f517","source":"wordfence","cve":"","title":"WP User Groups <= 2.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbbce9e-bfb5-49b3-9829-1f90e0d8f517?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-groups","name":"WP User Groups","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2018-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cbbe2c5-2a5d-4d87-a0b5-07c3583311ec","source":"wordfence","cve":"CVE-2025-26993","title":"Atarim <= 4.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbbe2c5-2a5d-4d87-a0b5-07c3583311ec?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:49:56Z"},{"id":"wordfence:5cbbfe66-09fe-48c9-9af1-0b7b90ac222a","source":"wordfence","cve":"CVE-2024-12635","title":"WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbbfe66-09fe-48c9-9af1-0b7b90ac222a?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-12-20T00:00:00Z","updated":"2024-12-21T07:03:01Z"},{"id":"wordfence:5cbcb659-6732-4893-b6a0-52a558cea351","source":"wordfence","cve":"CVE-2022-4431","title":"WOOCS <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbcb659-6732-4893-b6a0-52a558cea351?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.9.3","to_inclusive":true,"patched_in":"1.3.9.4"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cbd6040-0446-41fe-8fef-c9065beeaa3a","source":"wordfence","cve":"CVE-2024-5220","title":"ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbd6040-0446-41fe-8fef-c9065beeaa3a?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-05-24T11:33:21Z","updated":"2024-05-31T15:30:21Z"},{"id":"wordfence:5cbdcfd4-8bab-4b2a-aaae-59e50c7e02a8","source":"wordfence","cve":"CVE-2026-66640","title":"Login With Ajax \u2013 Fast Logins, 2FA, Redirects <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbdcfd4-8bab-4b2a-aaae-59e50c7e02a8?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.6"}],"published":"2026-08-18T00:00:00Z","updated":"2026-11-10T23:19:42Z"},{"id":"wordfence:5cbf597e-7a2f-416c-8969-3679b487f57a","source":"wordfence","cve":"","title":"WooCommerce <= 6.2.0 - Path Traversal via Tax Importer","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbf597e-7a2f-416c-8969-3679b487f57a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2022-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cc00331-4c4d-44c9-9068-bd7320f9d4a5","source":"wordfence","cve":"CVE-2026-2294","title":"UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cc00331-4c4d-44c9-9068-bd7320f9d4a5?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.09","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:22Z","updated":"2026-09-09T16:35:13Z"},{"id":"wordfence:5cc5662e-a9c3-4a15-bf68-0ec5835d3f3b","source":"wordfence","cve":"CVE-2026-25384","title":"WP-Lister Lite for eBay <= 3.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cc5662e-a9c3-4a15-bf68-0ec5835d3f3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-02-19T00:00:00Z","updated":"2026-02-24T19:20:17Z"},{"id":"wordfence:5cc590fe-94c8-47cc-bd5b-eef70da138b1","source":"wordfence","cve":"","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.7 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cc590fe-94c8-47cc-bd5b-eef70da138b1?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2022-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cc92354-55f4-4799-a974-14fa6fb584b9","source":"wordfence","cve":"CVE-2025-30777","title":"Support Genix <= 1.4.11 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cc92354-55f4-4799-a974-14fa6fb584b9?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:35:24Z"},{"id":"wordfence:5cccd266-48a8-481e-8fbd-db5a9a72f55a","source":"wordfence","cve":"CVE-2024-13674","title":"Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cccd266-48a8-481e-8fbd-db5a9a72f55a?source=api-prod","affected":[{"type":"plugin","slug":"cosmic-blocks","name":"Cosmic Blocks (40+) Content Editor Blocks Collection","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:22:29Z","updated":"2025-02-19T07:32:09Z"},{"id":"wordfence:5ccd7f4e-46c6-4783-9a3f-30c72bbc981e","source":"wordfence","cve":"CVE-2022-2271","title":"WP Database Backup <= 5.8.3 -  Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccd7f4e-46c6-4783-9a3f-30c72bbc981e?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"5.9"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ccece54-18fa-42e4-ba1a-d0879b73d66d","source":"wordfence","cve":"CVE-2024-8482","title":"Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccece54-18fa-42e4-ba1a-d0879b73d66d?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.986","to_inclusive":true,"patched_in":"1.3.987"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T11:34:17Z"},{"id":"wordfence:5ccfafaf-902f-4142-90b3-9f70800eb377","source":"wordfence","cve":"","title":"Front End Users <= 3.2.24 - Missing Authorization to Unauthenticated Registered User Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccfafaf-902f-4142-90b3-9f70800eb377?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.24","to_inclusive":true,"patched_in":"3.2.25"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cd0e015-abf2-4905-8b42-46b685be2c74","source":"wordfence","cve":"CVE-2024-5857","title":"Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor \u2013 Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cd0e015-abf2-4905-8b42-46b685be2c74?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.7.3.2","to_inclusive":true,"patched_in":"3.7.4.1"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T03:30:46Z"},{"id":"wordfence:5cd5d6f9-3011-4da8-a914-1e3e8075fdff","source":"wordfence","cve":"CVE-2025-47571","title":"Super Store Finder < 6.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cd5d6f9-3011-4da8-a914-1e3e8075fdff?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":false,"patched_in":"7.8"}],"published":"2025-07-07T00:00:00Z","updated":"2025-10-31T14:24:22Z"},{"id":"wordfence:5cd5e6f3-b791-48a8-b7eb-42cdd8975530","source":"wordfence","cve":"CVE-2021-36861","title":"Rich Reviews by Starfish <= 1.9.14 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cd5e6f3-b791-48a8-b7eb-42cdd8975530?source=api-prod","affected":[{"type":"plugin","slug":"rich-reviews","name":"Rich Reviews by Starfish","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cd706cd-bca4-4269-831f-7314f9a1797c","source":"wordfence","cve":"CVE-2025-31426","title":"Sticky Radio Player <= 3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cd706cd-bca4-4269-831f-7314f9a1797c?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio5-html5-shoutcast_sticky","name":"Sticky Radio Player","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T20:01:17Z"},{"id":"wordfence:5cd8c464-1402-4301-ac66-4e6fc0328de2","source":"wordfence","cve":"CVE-2025-26965","title":"Amelia <= 1.2.16 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cd8c464-1402-4301-ac66-4e6fc0328de2?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:23:20Z"},{"id":"wordfence:5cdbd5fd-bb12-4202-b6c7-f314ad8987f5","source":"wordfence","cve":"","title":"Client Invoicing by Sprout Invoices \u2013 Easy Estimates and Invoices for WordPress <= 9.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cdbd5fd-bb12-4202-b6c7-f314ad8987f5?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"9.3","to_inclusive":true,"patched_in":"9.4"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cdc0e86-c1dc-4069-a9c0-08bbf1a9c17c","source":"wordfence","cve":"CVE-2024-11924","title":"Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cdc0e86-c1dc-4069-a9c0-08bbf1a9c17c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.51","to_inclusive":true,"patched_in":"5.7.52"}],"published":"2025-03-27T00:00:00Z","updated":"2026-09-04T17:29:11Z"},{"id":"wordfence:5cdd64a4-040b-4dc9-a8df-dbecfeb928c8","source":"wordfence","cve":"CVE-2023-6954","title":"Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cdd64a4-040b-4dc9-a8df-dbecfeb928c8?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.85","to_inclusive":true,"patched_in":"3.2.86"}],"published":"2024-02-28T00:00:00Z","updated":"2024-07-29T21:36:25Z"},{"id":"wordfence:5cde239c-20bf-41fa-b7d6-e21b14dcbc22","source":"wordfence","cve":"CVE-2024-24709","title":"Shareaholic <= 9.7.11 - Missing Authorization via accept_terms_of_service","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cde239c-20bf-41fa-b7d6-e21b14dcbc22?source=api-prod","affected":[{"type":"plugin","slug":"shareaholic","name":"Professional Social Sharing Buttons, Icons & Related Posts \u2013 Shareaholic","from":"*","from_inclusive":true,"to":"9.7.11","to_inclusive":true,"patched_in":"9.7.12"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T16:08:45Z"},{"id":"wordfence:5ce039db-b597-4bbf-8067-933a262ae1b6","source":"wordfence","cve":"CVE-2022-41786","title":"WP Job Portal <= 2.0.1 - Missing Authorization to Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce039db-b597-4bbf-8067-933a262ae1b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ce22e5b-7f5c-41be-a50e-dc8100348122","source":"wordfence","cve":"CVE-2023-0168","title":"Olevmedia Shortcodes <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce22e5b-7f5c-41be-a50e-dc8100348122?source=api-prod","affected":[{"type":"plugin","slug":"olevmedia-shortcodes","name":"Olevmedia Shortcodes","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ce4b3cf-1c36-4596-b113-055945fceeb6","source":"wordfence","cve":"CVE-2025-48287","title":"Pix 4x sem juros - Pagaleve <= 1.6.9 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce4b3cf-1c36-4596-b113-055945fceeb6?source=api-prod","affected":[{"type":"plugin","slug":"wc-pagaleve","name":"Pix 4x sem juros \u2013 Pagaleve","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.10"}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:43:00Z"},{"id":"wordfence:5ce70e87-6dee-4d4a-b2fc-93fd4d50957d","source":"wordfence","cve":"CVE-2024-4014","title":"hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce70e87-6dee-4d4a-b2fc-93fd4d50957d?source=api-prod","affected":[{"type":"plugin","slug":"hcaptcha-for-forms-and-more","name":"hCaptcha for WP","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-20T09:38:16Z"},{"id":"wordfence:5ce718b9-87ba-479d-a81c-aab2bc77750e","source":"wordfence","cve":"CVE-2026-110516","title":"All in One Addons For WPBakery Page Builder  (formerly Visual Composer) <= 1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce718b9-87ba-479d-a81c-aab2bc77750e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-visual-composer-addons","name":"All in One Addons For WPBakery Page Builder  (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T00:00:00Z","updated":"2026-11-11T16:08:43Z"},{"id":"wordfence:5ce729a2-a106-45ab-b96c-cfe75246def7","source":"wordfence","cve":"CVE-2021-4388","title":"Opal Estate <= 1.6.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=api-prod","affected":[{"type":"plugin","slug":"opal-estate","name":"Opal Estate","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ce8f128-78c6-4118-a178-0c163c55b07d","source":"wordfence","cve":"CVE-2026-82228","title":"Security Optimizer \u2013 The All-In-One Protection Plugin <= 1.6.6 - 2-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce8f128-78c6-4118-a178-0c163c55b07d?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:52:47Z"},{"id":"wordfence:5ce9dd21-3c89-4ddd-9022-f1edf1224e2d","source":"wordfence","cve":"CVE-2023-28490","title":"WordPress Mortgage Calculator Estatik <= 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce9dd21-3c89-4ddd-9022-f1edf1224e2d?source=api-prod","affected":[{"type":"plugin","slug":"estatik-mortgage-calculator","name":"Estatik Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2026-03-23T15:44:42Z"},{"id":"wordfence:5ceb8f67-0c7a-4028-81b9-f2cdbcba1a80","source":"wordfence","cve":"CVE-2024-2119","title":"LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ceb8f67-0c7a-4028-81b9-f2cdbcba1a80?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-table-of-contents","name":"LuckyWP Table of Contents","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-05-21T19:04:11Z","updated":"2024-10-04T12:53:57Z"},{"id":"wordfence:5ceba1b2-2d39-4561-838b-b46e758517a3","source":"wordfence","cve":"CVE-2019-20043","title":"WordPress Core < 5.3.1 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ceba1b2-2d39-4561-838b-b46e758517a3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.20","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.19","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.16","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.15","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2019-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cec2c52-d780-4d94-a5b2-d3b405bce49c","source":"wordfence","cve":"CVE-2026-1883","title":"Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cec2c52-d780-4d94-a5b2-d3b405bce49c?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-03-14T13:11:53Z","updated":"2026-03-15T01:19:05Z"},{"id":"wordfence:5cec4c17-24c1-4ed3-a3d3-9404ad7af420","source":"wordfence","cve":"CVE-2026-1671","title":"Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cec4c17-24c1-4ed3-a3d3-9404ad7af420?source=api-prod","affected":[{"type":"plugin","slug":"winterlock","name":"Activity Log for WordPress","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-02-11T23:45:46Z","updated":"2026-02-12T12:31:50Z"},{"id":"wordfence:5cefecf8-46dc-4ae1-9e94-b724beb7136f","source":"wordfence","cve":"CVE-2024-10860","title":"NextMove Lite \u2013 Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cefecf8-46dc-4ae1-9e94-b724beb7136f?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.19.0","to_inclusive":true,"patched_in":"2.20.0"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T09:22:58Z"},{"id":"wordfence:5cf17465-59a9-475d-bd1a-9e3623190926","source":"wordfence","cve":"CVE-2023-46148","title":"Themify Ultra <= 7.3.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf17465-59a9-475d-bd1a-9e3623190926?source=api-prod","affected":[{"type":"theme","slug":"themify-ultra","name":"Themify Ultra","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-04-22T14:16:00Z"},{"id":"wordfence:5cf62f45-a142-497e-9838-ce0b1b1bb3d3","source":"wordfence","cve":"CVE-2024-9891","title":"Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf62f45-a142-497e-9838-ce0b1b1bb3d3?source=api-prod","affected":[{"type":"plugin","slug":"multiline-files-for-contact-form-7","name":"MultiLine Files for Contact Form 7","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.9"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:05Z"},{"id":"wordfence:5cf6a9fb-3c3b-48ad-a39b-77a529b89901","source":"wordfence","cve":"CVE-2024-10002","title":"Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf6a9fb-3c3b-48ad-a39b-77a529b89901?source=api-prod","affected":[{"type":"plugin","slug":"rover-idx","name":"Rover IDX","from":"*","from_inclusive":true,"to":"3.0.0.2905","to_inclusive":true,"patched_in":"3.0.0.2906"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T04:31:58Z"},{"id":"wordfence:5cf6cbba-0e0c-4d2c-90d0-d7e0a5222df2","source":"wordfence","cve":"CVE-2024-13360","title":"AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf6cbba-0e0c-4d2c-90d0-d7e0a5222df2?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.96","to_inclusive":true,"patched_in":"1.8.97"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:29:39Z"},{"id":"wordfence:5cf7075f-7209-49e6-acf9-6739b178d4dc","source":"wordfence","cve":"CVE-2017-18506","title":"WooCommerce PDF Invoices & Packing Slips <= 2.0.12 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf7075f-7209-49e6-acf9-6739b178d4dc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":false,"patched_in":"2.0.13"}],"published":"2017-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cf85717-179a-4539-b57d-fccd8d9dda58","source":"wordfence","cve":"CVE-2013-4117","title":"Category Grid View Gallery <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf85717-179a-4539-b57d-fccd8d9dda58?source=api-prod","affected":[{"type":"plugin","slug":"category-grid-view-gallery","name":"Category Grid View Gallery","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2013-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cf9a42d-4df7-4a48-9af5-a216e345e2ec","source":"wordfence","cve":"CVE-2026-118074","title":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce <= 2.21.0 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf9a42d-4df7-4a48-9af5-a216e345e2ec?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.21.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T10:12:20Z","updated":"2026-11-03T19:39:59Z"},{"id":"wordfence:5cfc38c0-f940-4c4d-ba7b-0d772146ea2d","source":"wordfence","cve":"CVE-2023-48273","title":"Preloader for Website <= 1.2.2 - Missing Authorization via plwao_register_settings()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cfc38c0-f940-4c4d-ba7b-0d772146ea2d?source=api-prod","affected":[{"type":"plugin","slug":"preloader-for-website","name":"Preloader for Website","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cfe9ab3-45b8-4ee5-9de1-45182a4fc46f","source":"wordfence","cve":"CVE-2021-20831","title":"OG Tags <= 2.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cfe9ab3-45b8-4ee5-9de1-45182a4fc46f?source=api-prod","affected":[{"type":"plugin","slug":"og-tags","name":"OG Tags","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5cfede31-66c3-4d2c-a79d-0e0ea54da50c","source":"wordfence","cve":"CVE-2024-6708","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5cfede31-66c3-4d2c-a79d-0e0ea54da50c?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.12.1","to_inclusive":true,"patched_in":"3.12.2"}],"published":"2024-08-13T00:00:00Z","updated":"2025-05-30T18:22:06Z"},{"id":"wordfence:5d01548e-91bf-44db-83dc-10c7d5962f9b","source":"wordfence","cve":"","title":"Optimize Database after Deleting Revisions <= 5.0.110 - Cross-Site Request Forgery via 'odb_csv_download'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d01548e-91bf-44db-83dc-10c7d5962f9b?source=api-prod","affected":[{"type":"plugin","slug":"rvg-optimize-database","name":"Optimize Database after Deleting Revisions","from":"*","from_inclusive":true,"to":"5.0.110","to_inclusive":true,"patched_in":"5.1"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d03c798-dc77-407c-8674-d0bd2f1ada8c","source":"wordfence","cve":"CVE-2024-3595","title":"Pure Chat \u2013 Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d03c798-dc77-407c-8674-d0bd2f1ada8c?source=api-prod","affected":[{"type":"plugin","slug":"pure-chat","name":"Pure Chat \u2013 Live Chat & More!","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"2.23"}],"published":"2024-05-08T00:00:00Z","updated":"2024-06-05T20:02:52Z"},{"id":"wordfence:5d07d5e9-be7c-4c16-b931-d909ed8be361","source":"wordfence","cve":"","title":"Login with WHMCS <= 1.11.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d07d5e9-be7c-4c16-b931-d909ed8be361?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-whmcs","name":"Login with WHMCS","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2022-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d080f5b-6646-47ef-8ae7-8b94270f9f59","source":"wordfence","cve":"CVE-2022-4163","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d080f5b-6646-47ef-8ae7-8b94270f9f59?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d081285-09c6-4cf2-bd28-a1e642df9460","source":"wordfence","cve":"CVE-2026-122669","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d081285-09c6-4cf2-bd28-a1e642df9460?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-11-07T12:32:00Z","updated":"2026-11-10T19:55:07Z"},{"id":"wordfence:5d096d29-6fdb-4f89-91d3-9ebfc1169f0d","source":"wordfence","cve":"CVE-2021-25082","title":"Popup Builder <= 4.0.6 - Local File Inclusion and PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d096d29-6fdb-4f89-91d3-9ebfc1169f0d?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d0b26b6-61e3-4fa2-9cde-6e49bb7e1d7f","source":"wordfence","cve":"CVE-2026-65450","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d0b26b6-61e3-4fa2-9cde-6e49bb7e1d7f?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:55:17Z"},{"id":"wordfence:5d0d44bb-a6b9-44cc-ba38-0e28ad318594","source":"wordfence","cve":"","title":"Trade Runner <= 3.9 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d0d44bb-a6b9-44cc-ba38-0e28ad318594?source=api-prod","affected":[{"type":"plugin","slug":"traderunner","name":"Trade Runner","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.10"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d106394-0dad-4d96-9063-6824fce65bdd","source":"wordfence","cve":"CVE-2019-15825","title":"WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=rp'","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d106394-0dad-4d96-9063-6824fce65bdd?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.5.2.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d128197-802c-48fb-8782-eb4e10126e55","source":"wordfence","cve":"CVE-2022-4827","title":"WP Tiles <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d128197-802c-48fb-8782-eb4e10126e55?source=api-prod","affected":[{"type":"plugin","slug":"wp-tiles","name":"WP Tiles","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d132ef1-a538-4be6-9031-2271d421f5bd","source":"wordfence","cve":"CVE-2026-75961","title":"NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d132ef1-a538-4be6-9031-2271d421f5bd?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.3.0","to_inclusive":true,"patched_in":"9.3.1"}],"published":"2026-09-17T19:04:27Z","updated":"2026-09-18T07:40:01Z"},{"id":"wordfence:5d14dfc0-13e2-41bb-b8f1-9a4919491cd2","source":"wordfence","cve":"CVE-2025-28899","title":"WP Event Ticketing <= 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d14dfc0-13e2-41bb-b8f1-9a4919491cd2?source=api-prod","affected":[{"type":"plugin","slug":"wpeventticketing","name":"WP Event Ticketing","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:48:56Z"},{"id":"wordfence:5d166a77-d57b-4827-96ca-b8eb423861f0","source":"wordfence","cve":"CVE-2022-34155","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.23.3 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d166a77-d57b-4827-96ca-b8eb423861f0?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.23.3","to_inclusive":true,"patched_in":"6.23.4"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d173077-06c4-4a23-a664-0be8516053ec","source":"wordfence","cve":"CVE-2023-41729","title":"SendPress Newsletters <= 1.23.11.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d173077-06c4-4a23-a664-0be8516053ec?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.23.11.6","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-05-07T12:17:28Z"},{"id":"wordfence:5d178852-53bc-440b-8217-67ae68749349","source":"wordfence","cve":"CVE-2023-23678","title":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 2.2.5 - Authenticated(Administrator+) CSV Injection","severity":"medium","cvss":6.4,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d178852-53bc-440b-8217-67ae68749349?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d18f911-a766-4b13-a00e-8cdeee788d7a","source":"wordfence","cve":"CVE-2025-66079","title":"Gutenverse Form <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d18f911-a766-4b13-a00e-8cdeee788d7a?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-form","name":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T17:16:56Z"},{"id":"wordfence:5d1937ae-d350-452c-b20e-d85bc88dbe48","source":"wordfence","cve":"CVE-2026-109388","title":"HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1937ae-d350-452c-b20e-d85bc88dbe48?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-15T17:55:17Z","updated":"2026-10-16T06:41:04Z"},{"id":"wordfence:5d194bca-0373-4c50-aee6-966e1692f3bc","source":"wordfence","cve":"CVE-2024-54392","title":"WP\u5fae\u4fe1\u673a\u5668\u4eba <= 5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d194bca-0373-4c50-aee6-966e1692f3bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-weixin-robot","name":"WP\u5fae\u4fe1\u673a\u5668\u4eba","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:54:30Z"},{"id":"wordfence:5d1b419c-2276-415d-8c54-15da9125c442","source":"wordfence","cve":"CVE-2024-10056","title":"Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1b419c-2276-415d-8c54-15da9125c442?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-a-meeting-scheduler-by-vcita","name":"Contact Form Builder by vcita","from":"*","from_inclusive":true,"to":"4.10.4","to_inclusive":true,"patched_in":"4.10.5"}],"published":"2024-12-04T21:16:14Z","updated":"2024-12-05T09:23:08Z"},{"id":"wordfence:5d1d012a-46cd-4c86-ac6f-993736a91acb","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'statusBulkEdit' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1d012a-46cd-4c86-ac6f-993736a91acb?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d1dc9b4-9018-4e23-933b-5c03fa60d56a","source":"wordfence","cve":"CVE-2025-26593","title":"FastBook <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1dc9b4-9018-4e23-933b-5c03fa60d56a?source=api-prod","affected":[{"type":"plugin","slug":"fastbook-responsive-appointment-booking-and-scheduling-system","name":"FastBook \u2013 Responsive Appointment Booking and Scheduling System","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:24:02Z"},{"id":"wordfence:5d1e5030-fb78-47da-b571-048b97c9ff9e","source":"wordfence","cve":"CVE-2024-53826","title":"WPCasa <= 1.2.13 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1e5030-fb78-47da-b571-048b97c9ff9e?source=api-prod","affected":[{"type":"plugin","slug":"wpcasa","name":"WPCasa \u2013 Real Estate for WordPress","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:33:54Z"},{"id":"wordfence:5d1fa835-1888-4758-97bf-f582e8ff3a04","source":"wordfence","cve":"CVE-2024-13544","title":"Zarinpal Paid Downloads <= 2.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1fa835-1888-4758-97bf-f582e8ff3a04?source=api-prod","affected":[{"type":"plugin","slug":"zarinpal-paid-downloads","name":"Zarinpal Paid Download","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-21T00:00:00Z","updated":"2025-02-12T15:24:08Z"},{"id":"wordfence:5d1ff79e-5246-422a-ae75-20763e7acd17","source":"wordfence","cve":"CVE-2026-8995","title":"Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1ff79e-5246-422a-ae75-20763e7acd17?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2026-05-28T13:39:45Z","updated":"2026-05-29T02:27:46Z"},{"id":"wordfence:5d208a43-dd4f-4625-9584-5ce585c7c1ce","source":"wordfence","cve":"CVE-2026-39528","title":"Delicious <= 1.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d208a43-dd4f-4625-9584-5ce585c7c1ce?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:12:58Z"},{"id":"wordfence:5d20eb50-3b54-475f-8a67-8ca61c0474cc","source":"wordfence","cve":"","title":"Selio - Real Estate Directory <= 1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d20eb50-3b54-475f-8a67-8ca61c0474cc?source=api-prod","affected":[{"type":"theme","slug":"selio","name":"Selio","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d21aad7-dbee-4204-afbd-0a5fdeaca50e","source":"wordfence","cve":"CVE-2024-0592","title":"Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d21aad7-dbee-4204-afbd-0a5fdeaca50e?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-03-13T00:00:00Z","updated":"2024-07-29T21:36:25Z"},{"id":"wordfence:5d22435f-f0e3-42c3-935b-d26bb1ea846a","source":"wordfence","cve":"CVE-2022-1281","title":"Photo Gallery by 10Web <= 1.6.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d22435f-f0e3-42c3-935b-d26bb1ea846a?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d255ca7-37a5-4c1b-84be-356ae3900f7e","source":"wordfence","cve":"CVE-2023-49751","title":"Block for Font Awesome <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d255ca7-37a5-4c1b-84be-356ae3900f7e?source=api-prod","affected":[{"type":"plugin","slug":"block-for-font-awesome","name":"Block for Font Awesome Icons \u2013 Searchable Icon Picker, SVG, FA 7","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-24T01:40:12Z"},{"id":"wordfence:5d266060-2491-4b0f-8961-955ed6ee2451","source":"wordfence","cve":"CVE-2026-57337","title":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages <= 1.5.3.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d266060-2491-4b0f-8961-955ed6ee2451?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.3.5","to_inclusive":true,"patched_in":"1.5.3.6"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:55:40Z"},{"id":"wordfence:5d276502-6154-468e-b028-eadf29debe56","source":"wordfence","cve":"CVE-2022-3391","title":"Retain Live Chat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d276502-6154-468e-b028-eadf29debe56?source=api-prod","affected":[{"type":"plugin","slug":"retain","name":"Retain Live Chat","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d27cead-d234-4bea-ad2b-a748840aa31d","source":"wordfence","cve":"CVE-2025-30775","title":"WPGuppy <= 1.1.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d27cead-d234-4bea-ad2b-a748840aa31d?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:24:14Z"},{"id":"wordfence:5d281333-d9af-4eb7-bc5c-ea7ceeddac03","source":"wordfence","cve":"CVE-2022-1565","title":"Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d281333-d9af-4eb7-bc5c-ea7ceeddac03?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d28fd23-fa86-4353-b1b4-af61192f8482","source":"wordfence","cve":"CVE-2025-13418","title":"Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d28fd23-fa86-4353-b1b4-af61192f8482?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.12","to_inclusive":true,"patched_in":"5.1.13"}],"published":"2026-01-06T20:36:46Z","updated":"2026-01-13T16:38:23Z"},{"id":"wordfence:5d2baf5d-a8a6-41db-8364-3a4b166b81cb","source":"wordfence","cve":"CVE-2026-97396","title":"Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2baf5d-a8a6-41db-8364-3a4b166b81cb?source=api-prod","affected":[{"type":"plugin","slug":"retainful","name":"Email Marketing for WordPress and WooCommerce \u2013 Retainful","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-10-09T19:23:34Z","updated":"2026-10-10T07:41:45Z"},{"id":"wordfence:5d2c4204-90ee-4703-ae46-c6a0e260451c","source":"wordfence","cve":"CVE-2026-83545","title":"CoolClock < 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2c4204-90ee-4703-ae46-c6a0e260451c?source=api-prod","affected":[{"type":"plugin","slug":"coolclock","name":"CoolClock","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":false,"patched_in":"4.3.8"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:29:25Z"},{"id":"wordfence:5d2d8ba7-269b-4830-8551-c2291199fb67","source":"wordfence","cve":"CVE-2023-23892","title":"M Chart <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2d8ba7-269b-4830-8551-c2291199fb67?source=api-prod","affected":[{"type":"plugin","slug":"m-chart","name":"M Chart","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.10"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d2e0fc0-072b-4640-b538-61356fefa0d8","source":"wordfence","cve":"CVE-2026-4259","title":"Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2e0fc0-072b-4640-b538-61356fefa0d8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-woocommerce-auction-pro","name":"Ultimate Auction Pro","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-13T00:00:00Z","updated":"2026-07-16T17:05:58Z"},{"id":"wordfence:5d2f07bb-89b3-41d4-b606-9722deecf816","source":"wordfence","cve":"CVE-2025-4387","title":"Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2f07bb-89b3-41d4-b606-9722deecf816?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"9.16.0","to_inclusive":true,"patched_in":"9.17.0"}],"published":"2025-06-09T15:30:01Z","updated":"2025-06-10T03:41:37Z"},{"id":"wordfence:5d2fff42-19a7-47a3-9f88-76e81d485199","source":"wordfence","cve":"CVE-2025-30578","title":"AdSense Privacy Policy <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d2fff42-19a7-47a3-9f88-76e81d485199?source=api-prod","affected":[{"type":"plugin","slug":"adsense-privacy-policy","name":"AdSense Privacy Policy","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:12:17Z"},{"id":"wordfence:5d3029bb-74d0-4594-80c9-b7cb6c049216","source":"wordfence","cve":"CVE-2026-1792","title":"Geo Widet <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d3029bb-74d0-4594-80c9-b7cb6c049216?source=api-prod","affected":[{"type":"plugin","slug":"geowidget","name":"Geo Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:32:34Z","updated":"2026-02-14T06:42:28Z"},{"id":"wordfence:5d3251b8-4759-42c5-8fec-8b7f87e10b1a","source":"wordfence","cve":"CVE-2025-57892","title":"Simple Statistics for Feeds <= 20250322 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d3251b8-4759-42c5-8fec-8b7f87e10b1a?source=api-prod","affected":[{"type":"plugin","slug":"simple-feed-stats","name":"Simple Statistics for Feeds","from":"*","from_inclusive":true,"to":"20250322","to_inclusive":true,"patched_in":"20250820"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:57:11Z"},{"id":"wordfence:5d350095-125a-4445-89c1-bce437e4098c","source":"wordfence","cve":"CVE-2023-6090","title":"Mollie Payments for WooCommerce <= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d350095-125a-4445-89c1-bce437e4098c?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.3.11","to_inclusive":true,"patched_in":"7.3.12"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d371a8e-2997-4be3-afd9-60f752a6721c","source":"wordfence","cve":"CVE-2026-57700","title":"OMGF Pro <= 5.2.6 - Unauthenticated Arbitrary File Upload via @import URL Reflection","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d371a8e-2997-4be3-afd9-60f752a6721c?source=api-prod","affected":[{"type":"plugin","slug":"host-google-fonts-pro","name":"OMGF Pro","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T15:13:58Z"},{"id":"wordfence:5d380b66-675e-451d-a7e3-4efe1fbd08b2","source":"wordfence","cve":"CVE-2026-5371","title":"MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d380b66-675e-451d-a7e3-4efe1fbd08b2?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"10.1.2","to_inclusive":true,"patched_in":"10.1.3"}],"published":"2026-05-12T09:45:13Z","updated":"2026-05-18T14:21:32Z"},{"id":"wordfence:5d386d25-d228-4491-b58d-6adbb3b863a5","source":"wordfence","cve":"CVE-2026-65543","title":"Vimeo <= 1.2.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d386d25-d228-4491-b58d-6adbb3b863a5?source=api-prod","affected":[{"type":"plugin","slug":"vimeo","name":"Vimeo","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:30:45Z"},{"id":"wordfence:5d3bcd2c-4cdd-4a11-83a5-b727a2b2b6a6","source":"wordfence","cve":"CVE-2023-24007","title":"Admin Block Country <= 7.1.4 - Cross-Site Request Forgery via admin_block_country_initial_page","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d3bcd2c-4cdd-4a11-83a5-b727a2b2b6a6?source=api-prod","affected":[{"type":"plugin","slug":"admin-block-country","name":"Admin Block Country","from":"*","from_inclusive":true,"to":"7.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d3fa174-93c6-4086-b247-099d448a494f","source":"wordfence","cve":"CVE-2025-28985","title":"Elastic Email Subscribe Form <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d3fa174-93c6-4086-b247-099d448a494f?source=api-prod","affected":[{"type":"plugin","slug":"elastic-email-subscribe-form","name":"Elastic Email Subscribe Form","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:03:43Z"},{"id":"wordfence:5d432ea5-9ffd-43da-8988-6dd77b907655","source":"wordfence","cve":"CVE-2021-24425","title":"myStickymenu <= 2.5.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d432ea5-9ffd-43da-8988-6dd77b907655?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d44255b-0615-439d-b166-8f1100f53e3a","source":"wordfence","cve":"CVE-2026-8880","title":"RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d44255b-0615-439d-b166-8f1100f53e3a?source=api-prod","affected":[{"type":"plugin","slug":"romancart-ecommerce","name":"RomanCart Ecommerce","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:06:45Z","updated":"2026-10-13T16:04:06Z"},{"id":"wordfence:5d45d870-dd00-40aa-9e98-4be4d06b3a0a","source":"wordfence","cve":"CVE-2022-4196","title":"Multi Step Form <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d45d870-dd00-40aa-9e98-4be4d06b3a0a?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2022-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d463709-8afd-4db6-bd0a-524d7b27f4ea","source":"wordfence","cve":"CVE-2022-27854","title":"Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d463709-8afd-4db6-bd0a-524d7b27f4ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-testing","name":"Psychological tests & quizzes","from":"*","from_inclusive":true,"to":"0.21.19","to_inclusive":true,"patched_in":""}],"published":"2022-04-26T13:33:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d479a7a-52a6-48bd-8216-935e22ddb3ed","source":"wordfence","cve":"CVE-2026-42385","title":"Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d479a7a-52a6-48bd-8216-935e22ddb3ed?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":true,"patched_in":"3.15.1"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:44:23Z"},{"id":"wordfence:5d48239d-c44b-43fe-b9d9-32221f962d06","source":"wordfence","cve":"CVE-2025-60048","title":"Tripster <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d48239d-c44b-43fe-b9d9-32221f962d06?source=api-prod","affected":[{"type":"theme","slug":"tripster","name":"Tripster - Travel & Lifestyle WordPress Blog","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:38:25Z"},{"id":"wordfence:5d4a08e9-6487-4c4f-93da-d88022bcef2c","source":"wordfence","cve":"CVE-2025-49380","title":"WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4a08e9-6487-4c4f-93da-d88022bcef2c?source=api-prod","affected":[{"type":"plugin","slug":"woo-vehicle-parts-finder","name":"WooCommerce Vehicle Parts Finder","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-10-01T00:00:00Z","updated":"2025-10-29T16:21:06Z"},{"id":"wordfence:5d4ab9fd-47ef-4668-91df-c3d715da5574","source":"wordfence","cve":"CVE-2025-23904","title":"Rebrand Fluent Forms <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4ab9fd-47ef-4668-91df-c3d715da5574?source=api-prod","affected":[{"type":"plugin","slug":"rebrand-fluent-forms","name":"Rebrand Fluent Forms","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:52:40Z"},{"id":"wordfence:5d4ad020-0b40-456b-8f8c-597c7c4ef698","source":"wordfence","cve":"CVE-2024-43333","title":"Admin and Site Enhancements (ASE) Pro <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":7.5,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4ad020-0b40-456b-8f8c-597c7c4ef698?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.6.2.1","to_inclusive":true,"patched_in":"7.6.3"},{"type":"plugin","slug":"admin-site-enhancements-pro","name":"Admin and Site Enhancements (ASE) Pro","from":"*","from_inclusive":true,"to":"7.6.2.1","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T19:00:35Z"},{"id":"wordfence:5d4b22d2-597d-4b34-ac96-83fcc0ff8049","source":"wordfence","cve":"CVE-2026-120683","title":"Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4b22d2-597d-4b34-ac96-83fcc0ff8049?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-11-06T21:36:33Z","updated":"2026-11-07T11:26:29Z"},{"id":"wordfence:5d4b8d86-929b-4a35-b438-1f2957a5f11d","source":"wordfence","cve":"CVE-2025-27279","title":"Flashfader <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4b8d86-929b-4a35-b438-1f2957a5f11d?source=api-prod","affected":[{"type":"plugin","slug":"flashfader","name":"Flashfader","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:34:18Z"},{"id":"wordfence:5d4ba14d-167a-477f-845b-6c654f027bfe","source":"wordfence","cve":"CVE-2026-62048","title":"Bookit \u2014 Booking & Appointment Calendar <= 2.6.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4ba14d-167a-477f-845b-6c654f027bfe?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.6","to_inclusive":true,"patched_in":"2.6.0.7"}],"published":"2026-10-30T15:09:05Z","updated":"2026-11-03T20:08:01Z"},{"id":"wordfence:5d4bd61c-858d-457f-a482-77939fe0caf9","source":"wordfence","cve":"CVE-2007-2828","title":"AdSense-Deluxe <= 0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4bd61c-858d-457f-a482-77939fe0caf9?source=api-prod","affected":[{"type":"plugin","slug":"adsense-deluxe","name":"AdSense-Deluxe","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2007-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d4c92dd-a605-42b5-af10-0a0e25461dde","source":"wordfence","cve":"CVE-2025-22288","title":"Smush Image Compression and Optimization <= 3.17.0 - Authenticated (Admin+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4c92dd-a605-42b5-af10-0a0e25461dde?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"3.17.0","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T20:59:03Z"},{"id":"wordfence:5d4da592-3e8a-401d-b461-1770db9de654","source":"wordfence","cve":"CVE-2026-85492","title":"All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d4da592-3e8a-401d-b461-1770db9de654?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"5.0.1.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-10-01T20:40:52Z","updated":"2026-10-02T09:25:56Z"},{"id":"wordfence:5d50e9bb-e357-42d3-b131-468511b8e98a","source":"wordfence","cve":"CVE-2023-52126","title":"Send Users Email <= 1.4.3 - Sensitive Information Exposure via Error Logs","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d50e9bb-e357-42d3-b131-468511b8e98a?source=api-prod","affected":[{"type":"plugin","slug":"send-users-email","name":"Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d5219cc-f23b-42da-b430-e773148299a3","source":"wordfence","cve":"CVE-2026-109700","title":"Meta Box \u2013 A Framework for Dynamic Websites <= 5.15.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d5219cc-f23b-42da-b430-e773148299a3?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.15.2","to_inclusive":true,"patched_in":"5.15.3"}],"published":"2026-10-20T15:06:00Z","updated":"2026-10-23T18:27:17Z"},{"id":"wordfence:5d54788a-ebfd-4291-94f2-d220fbf9050a","source":"wordfence","cve":"","title":"Contact Form 7 Connector <= 1.1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d54788a-ebfd-4291-94f2-d220fbf9050a?source=api-prod","affected":[{"type":"plugin","slug":"ari-cf7-connector","name":"Contact Form 7 Connector","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d572cac-b8e3-4c52-9b35-80fe5ee9e900","source":"wordfence","cve":"CVE-2023-6810","title":"ClickCease Click Fraud Protection <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d572cac-b8e3-4c52-9b35-80fe5ee9e900?source=api-prod","affected":[{"type":"plugin","slug":"clickcease-click-fraud-protection","name":"ClickCease Click Fraud Protection","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2024-05-06T00:00:00Z","updated":"2024-07-29T21:36:25Z"},{"id":"wordfence:5d58a6a4-de2c-485f-a8b0-7a7d144fbf3c","source":"wordfence","cve":"CVE-2023-2547","title":"Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Non-Arbitrary User Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d58a6a4-de2c-485f-a8b0-7a7d144fbf3c?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"1.0.7","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d5c553f-247d-4feb-8027-822cfaca4adf","source":"wordfence","cve":"CVE-2024-56064","title":"WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d5c553f-247d-4feb-8027-822cfaca4adf?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:09:53Z"},{"id":"wordfence:5d5d9ef7-3832-495c-b61b-7e24c2e60893","source":"wordfence","cve":"CVE-2009-4140","title":"Various Affected Software (Various Versions) - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d5d9ef7-3832-495c-b61b-7e24c2e60893?source=api-prod","affected":[{"type":"plugin","slug":"piwik-pro","name":"Piwik PRO","from":"0.2.35","from_inclusive":true,"to":"0.4.3","to_inclusive":true,"patched_in":"0.4.4"},{"type":"plugin","slug":"woopra","name":"Woopra Analytics Plugin","from":"*","from_inclusive":true,"to":"1.4.3.1","to_inclusive":true,"patched_in":"1.4.3.2"}],"published":"2009-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d60007c-8957-4c46-8c5c-47b7f626f0bb","source":"wordfence","cve":"CVE-2026-120739","title":"Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d60007c-8957-4c46-8c5c-47b7f626f0bb?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"4.2.19"}],"published":"2026-11-06T14:33:50Z","updated":"2026-11-07T03:28:06Z"},{"id":"wordfence:5d615acb-2960-4296-b212-0feaed2af8e2","source":"wordfence","cve":"CVE-2024-52453","title":"Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d615acb-2960-4296-b212-0feaed2af8e2?source=api-prod","affected":[{"type":"plugin","slug":"library-bookshelves","name":"Library Bookshelves","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2024-11-18T00:00:00Z","updated":"2024-12-10T18:50:15Z"},{"id":"wordfence:5d62879a-1a5b-4956-a45f-379faf745237","source":"wordfence","cve":"CVE-2026-105322","title":"Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d62879a-1a5b-4956-a45f-379faf745237?source=api-prod","affected":[{"type":"plugin","slug":"magee-shortcodes","name":"Magee Shortcodes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:43:04Z"},{"id":"wordfence:5d632cce-40a9-4969-b213-8370ae75287e","source":"wordfence","cve":"CVE-2026-19902","title":"Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d632cce-40a9-4969-b213-8370ae75287e?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-09-30T19:33:23Z","updated":"2026-10-01T07:40:23Z"},{"id":"wordfence:5d635669-ee85-4fb5-8238-3edb3bbb8fb4","source":"wordfence","cve":"CVE-2023-46616","title":"Draw Attention <= 2.0.15 - Improper Access Control via register_cpt","severity":"medium","cvss":6.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d635669-ee85-4fb5-8238-3edb3bbb8fb4?source=api-prod","affected":[{"type":"plugin","slug":"draw-attention","name":"Interactive Image Map Plugin \u2013 Draw Attention","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d652b50-9c9c-4418-bd6b-ae862a1c8786","source":"wordfence","cve":"CVE-2021-39348","title":"LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d652b50-9c9c-4418-bd6b-ae862a1c8786?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.3.1","to_inclusive":true,"patched_in":"4.1.3.2"}],"published":"2021-10-18T17:16:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d696d5c-e113-4d41-b077-4eb6b2c93669","source":"wordfence","cve":"CVE-2024-56240","title":"Pronamic Google Maps <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d696d5c-e113-4d41-b077-4eb6b2c93669?source=api-prod","affected":[{"type":"plugin","slug":"pronamic-google-maps","name":"Pronamic Google Maps","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:20:44Z"},{"id":"wordfence:5d6b5a4c-1dc9-4d86-ac41-61880637fcbb","source":"wordfence","cve":"CVE-2023-23809","title":"Stock market charts from finviz <= 1.0.1 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6b5a4c-1dc9-4d86-ac41-61880637fcbb?source=api-prod","affected":[{"type":"plugin","slug":"stock-market-charts-from-finviz","name":"Stock market charts from finviz","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d6bebb7-375c-45b8-9b54-58c6dbc0bb70","source":"wordfence","cve":"CVE-2021-24325","title":"404 SEO Redirection <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6bebb7-375c-45b8-9b54-58c6dbc0bb70?source=api-prod","affected":[{"type":"plugin","slug":"404-redirection-manager","name":"404 SEO Redirection","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d6d9852-424a-4d98-9926-e849bef99c2d","source":"wordfence","cve":"CVE-2024-8288","title":"Guten Post Layout \u2013 An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6d9852-424a-4d98-9926-e849bef99c2d?source=api-prod","affected":[{"type":"plugin","slug":"guten-post-layout","name":"Guten Post Layout \u2013 An Advanced Post Grid Collection","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-23T16:51:47Z"},{"id":"wordfence:5d6ee190-c2ff-46dc-99fa-ba9f0fb6b0a1","source":"wordfence","cve":"CVE-2025-52814","title":"BRW <= 1.8.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6ee190-c2ff-46dc-99fa-ba9f0fb6b0a1?source=api-prod","affected":[{"type":"plugin","slug":"ova-brw","name":"BRW - Booking Rental Plugin WooCommerce","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:57:23Z"},{"id":"wordfence:5d6f38d7-a769-422d-ae3f-565cb1cc8a73","source":"wordfence","cve":"CVE-2025-14795","title":"Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d6f38d7-a769-422d-ae3f-565cb1cc8a73?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2026.1","to_inclusive":true,"patched_in":"2026.2"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T13:26:16Z"},{"id":"wordfence:5d70b447-4f7f-4196-a37b-167679cef229","source":"wordfence","cve":"CVE-2013-5738","title":"WordPress Core < 3.6.1 - HTML File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d70b447-4f7f-4196-a37b-167679cef229?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2013-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d716a6c-72b7-439f-8a99-56cd588515e3","source":"wordfence","cve":"CVE-2025-68587","title":"Watu Quiz <= 3.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d716a6c-72b7-439f-8a99-56cd588515e3?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.5.1"}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-06T14:59:28Z"},{"id":"wordfence:5d74ca27-7be9-4ab3-a6be-0c23b195a3cb","source":"wordfence","cve":"","title":"Smart Slider 2 <= 2.3.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d74ca27-7be9-4ab3-a6be-0c23b195a3cb?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-2","name":"smart-slider-2","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":false,"patched_in":"2.3.12"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d74e494-b5a0-4e44-8efe-9f904de6b878","source":"wordfence","cve":"CVE-2025-6437","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d74e494-b5a0-4e44-8efe-9f904de6b878?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:54:05Z","updated":"2025-07-02T03:47:25Z"},{"id":"wordfence:5d762b22-5563-454f-8c1c-485a2a3a0d0f","source":"wordfence","cve":"","title":"Tracked Tweets <= 0.2.9 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d762b22-5563-454f-8c1c-485a2a3a0d0f?source=api-prod","affected":[{"type":"plugin","slug":"tracked-tweets","name":"Tracked Tweets","from":"*","from_inclusive":true,"to":"0.2.9","to_inclusive":true,"patched_in":""}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d782c54-f4f4-4ffe-a261-7cc6a900f9ea","source":"wordfence","cve":"CVE-2026-93661","title":"Events Manager <= 7.4.4 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d782c54-f4f4-4ffe-a261-7cc6a900f9ea?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.4","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T20:03:10Z"},{"id":"wordfence:5d78ea71-5886-488e-a660-0dc25129a8b6","source":"wordfence","cve":"CVE-2024-12419","title":"Design for Contact Form 7 Style WordPress Plugin \u2013 CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d78ea71-5886-488e-a660-0dc25129a8b6?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:08:11Z","updated":"2025-03-13T20:04:41Z"},{"id":"wordfence:5d795754-3d42-49b5-99ab-c52eeca518f5","source":"wordfence","cve":"CVE-2026-84848","title":"Quick Event Manager <= 9.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d795754-3d42-49b5-99ab-c52eeca518f5?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.18","to_inclusive":true,"patched_in":"9.19"}],"published":"2026-09-03T00:00:00Z","updated":"2026-10-28T21:14:35Z"},{"id":"wordfence:5d7b33c5-ced5-4ce5-acc1-4c3d935f8749","source":"wordfence","cve":"CVE-2011-5107","title":"Alert Before Your Post <= 0.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7b33c5-ced5-4ce5-acc1-4c3d935f8749?source=api-prod","affected":[{"type":"plugin","slug":"alert-before-your-post","name":"Alert Before Your Post","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2011-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d7b75a4-67b4-4347-91a6-dbf98da5ceaf","source":"wordfence","cve":"CVE-2025-6934","title":"Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7b75a4-67b4-4347-91a6-dbf98da5ceaf?source=api-prod","affected":[{"type":"plugin","slug":"opal-estate-pro","name":"Opal Estate Pro \u2013 Property Management and Submission","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-30T18:39:19Z","updated":"2025-07-01T06:43:03Z"},{"id":"wordfence:5d7bcd71-e299-47fe-a749-e72c49b8129e","source":"wordfence","cve":"","title":"BuddyPress - 7.0.0 - 7.2.0 - Insufficient Privilege De-escalation","severity":"medium","cvss":4.6,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7bcd71-e299-47fe-a749-e72c49b8129e?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"7.0.0","from_inclusive":true,"to":"7.2.1","to_inclusive":false,"patched_in":"7.2.1"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d7dc644-ab83-4f03-998a-ec8eda695161","source":"wordfence","cve":"CVE-2025-7443","title":"BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7dc644-ab83-4f03-998a-ec8eda695161?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"2.2.42","to_inclusive":true,"patched_in":"2.2.44"}],"published":"2025-07-31T15:28:22Z","updated":"2025-08-01T04:24:29Z"},{"id":"wordfence:5d7fb020-6acb-445e-a46b-bdb5aaf8f2b6","source":"wordfence","cve":"CVE-2023-6449","title":"Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fb020-6acb-445e-a46b-bdb5aaf8f2b6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"5.8.4"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d7fb9fd-5551-43aa-8bab-e99430a08124","source":"wordfence","cve":"CVE-2015-2199","title":"WonderPlugin Audio Player <= 2.0 - Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fb9fd-5551-43aa-8bab-e99430a08124?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-audio","name":"WonderPlugin Audio Player","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2015-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d7fd79f-8113-4143-b630-46531e574fc9","source":"wordfence","cve":"CVE-2026-8872","title":"Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7fd79f-8113-4143-b630-46531e574fc9?source=api-prod","affected":[{"type":"plugin","slug":"animate-your-content","name":"Animate Your Content","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:55Z","updated":"2026-05-27T05:31:26Z"},{"id":"wordfence:5d82e9e2-c572-4911-a6a5-1384844214b0","source":"wordfence","cve":"CVE-2026-14158","title":"Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d82e9e2-c572-4911-a6a5-1384844214b0?source=api-prod","affected":[{"type":"plugin","slug":"widget-logic-visual","name":"Widget Logic Visual","from":"*","from_inclusive":true,"to":"1.52","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:29:55Z","updated":"2026-07-08T04:30:49Z"},{"id":"wordfence:5d84d749-0ab5-49dd-8e4f-45681f197742","source":"wordfence","cve":"CVE-2026-14345","title":"WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d84d749-0ab5-49dd-8e4f-45681f197742?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.12.7","to_inclusive":true,"patched_in":"3.12.8"}],"published":"2026-07-06T16:35:34Z","updated":"2026-07-07T05:34:19Z"},{"id":"wordfence:5d858f96-7363-4098-af2d-f6f96fc80071","source":"wordfence","cve":"CVE-2023-28693","title":"Advanced Youtube Channel Pagination <= 1.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d858f96-7363-4098-af2d-f6f96fc80071?source=api-prod","affected":[{"type":"plugin","slug":"advanced-youtube-channel-pagination","name":"Advanced Youtube Channel Pagination","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d875004-a589-4657-953c-ca175e3157c2","source":"wordfence","cve":"","title":"Travel Booking WordPress Theme < 2.8.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d875004-a589-4657-953c-ca175e3157c2?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.8.4"}],"published":"2020-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d882db3-b92e-4b3b-a07e-fa30fed85364","source":"wordfence","cve":"CVE-2026-14876","title":"Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d882db3-b92e-4b3b-a07e-fa30fed85364?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.38","to_inclusive":true,"patched_in":"3.5.1.39"}],"published":"2026-09-29T19:38:10Z","updated":"2026-09-30T07:41:05Z"},{"id":"wordfence:5d8961fd-68ac-4a10-ab26-cfcda27c18e8","source":"wordfence","cve":"CVE-2024-11711","title":"WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d8961fd-68ac-4a10-ab26-cfcda27c18e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:16Z"},{"id":"wordfence:5d896366-a85d-49c9-9509-3f7454712474","source":"wordfence","cve":"CVE-2023-0421","title":"Cloud Manager <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d896366-a85d-49c9-9509-3f7454712474?source=api-prod","affected":[{"type":"plugin","slug":"cloud-manager","name":"Cloud Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d8cec6f-833b-4bb9-954e-a985a3c5067c","source":"wordfence","cve":"CVE-2026-28110","title":"LambertGroup - AllInOne - Banner with Playlist <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d8cec6f-833b-4bb9-954e-a985a3c5067c?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-bannerWithPlaylist","name":"LambertGroup - AllInOne - Banner with Playlist","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:32:13Z"},{"id":"wordfence:5d8e3832-b3ed-4687-94d8-8ba2c832584c","source":"wordfence","cve":"CVE-2024-32551","title":"SP Project & Document Manager <= 4.71 - Authenticated (Author+) SQL Injeciton","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d8e3832-b3ed-4687-94d8-8ba2c832584c?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.71","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:37:02Z"},{"id":"wordfence:5d92687e-cdf2-4dd2-b984-eaf9f0a56625","source":"wordfence","cve":"CVE-2022-4623","title":"ND Shortcodes <= 6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d92687e-cdf2-4dd2-b984-eaf9f0a56625?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d94f38f-4b52-4b0d-800c-a6fca40bda3c","source":"wordfence","cve":"CVE-2023-4274","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal","severity":"high","cvss":8.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"0.9.89","from_inclusive":true,"to":"0.9.89","to_inclusive":true,"patched_in":"0.9.90"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d9689ed-2be0-4573-a794-2c5bfadafdf5","source":"wordfence","cve":"CVE-2022-33191","title":"Testimonials <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9689ed-2be0-4573-a794-2c5bfadafdf5?source=api-prod","affected":[{"type":"plugin","slug":"testimonials","name":"Testimonials","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d96ea1b-1763-4a54-bd67-ac29175e9e01","source":"wordfence","cve":"CVE-2025-13140","title":"SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d96ea1b-1763-4a54-bd67-ac29175e9e01?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.12.20","to_inclusive":true,"patched_in":"1.20.27"}],"published":"2025-12-01T18:33:12Z","updated":"2025-12-02T06:40:25Z"},{"id":"wordfence:5d9736e0-1a10-4ea0-a514-62ff49e36c43","source":"wordfence","cve":"CVE-2014-9461","title":"Cart66 Lite - WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9736e0-1a10-4ea0-a514-62ff49e36c43?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2015-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d9aaf0f-b5e1-4d2d-9e0f-4b5a4430fa96","source":"wordfence","cve":"CVE-2025-69390","title":"Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9aaf0f-b5e1-4d2d-9e0f-4b5a4430fa96?source=api-prod","affected":[{"type":"plugin","slug":"templates-and-addons-for-wpbakery-page-builder","name":"Business Template Blocks for WPBakery (Visual Composer) Page Builder","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-16T21:46:48Z"},{"id":"wordfence:5d9ab83f-6d0b-4fe4-a121-87b09dcc0953","source":"wordfence","cve":"CVE-2023-34379","title":"Cart2Cart: Magento to WooCommerce Migration <= 2.0.0 - Missing Authorization via setToken","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9ab83f-6d0b-4fe4-a121-87b09dcc0953?source=api-prod","affected":[{"type":"plugin","slug":"cart2cart-magento-to-woocommerce-migration","name":"Cart2Cart: Magento to WooCommerce Migration","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d9b819e-7c5f-46f5-a9c7-8ef124537f99","source":"wordfence","cve":"CVE-2025-26588","title":"TTT Crop <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9b819e-7c5f-46f5-a9c7-8ef124537f99?source=api-prod","affected":[{"type":"plugin","slug":"ttt-crop","name":"TTT Crop","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:10:31Z"},{"id":"wordfence:5d9c1c3d-6882-4425-8d32-bdb57b4f133d","source":"wordfence","cve":"CVE-2026-2996","title":"Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9c1c3d-6882-4425-8d32-bdb57b4f133d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-fields-for-woocommerce","name":"Advanced Product Fields (Product Addons) for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.21","to_inclusive":true,"patched_in":"1.6.22"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T13:27:14Z"},{"id":"wordfence:5d9e0147-74ae-481a-bdc2-16bb3cdc10d7","source":"wordfence","cve":"CVE-2015-9417","title":"Testimonial Slider <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9e0147-74ae-481a-bdc2-16bb3cdc10d7?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider","name":"Testimonial Slider","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2015-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5d9e20f7-813c-4691-bce4-d0ff4774ae48","source":"wordfence","cve":"CVE-2024-8200","title":"Reviews Feed \u2013 Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5d9e20f7-813c-4691-bce4-d0ff4774ae48?source=api-prod","affected":[{"type":"plugin","slug":"reviews-feed","name":"Reviews Feed \u2013 Google Reviews, Yelp, Trustpilot & Tripadvisor Reviews Widget","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-08-26T00:00:00Z","updated":"2025-07-29T06:39:26Z"},{"id":"wordfence:5da295f3-ac54-4330-ac39-65225adeb93a","source":"wordfence","cve":"CVE-2025-7726","title":"The7 <= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da295f3-ac54-4330-ac39-65225adeb93a?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"12.6.0","to_inclusive":true,"patched_in":"12.7.0"}],"published":"2025-08-09T01:09:26Z","updated":"2025-08-09T13:45:05Z"},{"id":"wordfence:5da29ff7-0e9d-487b-8f12-cd9912198cba","source":"wordfence","cve":"CVE-2025-58711","title":"Blog Designer PRO <= 3.4.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da29ff7-0e9d-487b-8f12-cd9912198cba?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pro","name":"Blog Designer PRO for WordPress","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T00:00:00Z","updated":"2025-11-04T15:18:12Z"},{"id":"wordfence:5da2dac6-940c-419e-853f-6cfd5d53d427","source":"wordfence","cve":"CVE-2023-5085","title":"Advanced Menu Widget <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da2dac6-940c-419e-853f-6cfd5d53d427?source=api-prod","affected":[{"type":"plugin","slug":"advanced-menu-widget","name":"Advanced Menu Widget","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5da7875f-a429-41f3-a05d-81200991585f","source":"wordfence","cve":"CVE-2025-58645","title":"Gravitate Automated Tester <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da7875f-a429-41f3-a05d-81200991585f?source=api-prod","affected":[{"type":"plugin","slug":"gravitate-automated-tester","name":"Gravitate Automated Tester","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:38Z"},{"id":"wordfence:5da82149-c827-4574-8269-b2b798edca59","source":"wordfence","cve":"CVE-2024-11254","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da82149-c827-4574-8269-b2b798edca59?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-17T14:47:52Z","updated":"2024-12-18T03:22:05Z"},{"id":"wordfence:5da8a4d4-9c98-4ee1-affd-105c88528c56","source":"wordfence","cve":"CVE-2026-39506","title":"AI Engine (Pro) < 3.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5da8a4d4-9c98-4ee1-affd-105c88528c56?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine-pro","name":"AI Engine (Pro)","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2026-03-28T00:00:00Z","updated":"2026-05-05T14:57:09Z"},{"id":"wordfence:5dabf766-b288-48c1-8e89-f910d7ecf8a8","source":"wordfence","cve":"CVE-2025-22314","title":"Food Store \u2013 Online Food Delivery & Pickup <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dabf766-b288-48c1-8e89-f910d7ecf8a8?source=api-prod","affected":[{"type":"plugin","slug":"food-store","name":"Food Store \u2013 Online Food Delivery & Pickup","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-30T14:33:40Z"},{"id":"wordfence:5dabfdab-2c7a-4c9b-9c8f-a93639da1a35","source":"wordfence","cve":"CVE-2024-32592","title":"Void Elementor WHMCS Elements For Elementor Page Builder <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dabfdab-2c7a-4c9b-9c8f-a93639da1a35?source=api-prod","affected":[{"type":"plugin","slug":"void-elementor-whmcs-elements","name":"Elementor WHMCS Elements For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:49:34Z"},{"id":"wordfence:5dad7348-39ba-4163-a5eb-939601645edb","source":"wordfence","cve":"CVE-2023-25050","title":"Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Arbitrary File Read via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dad7348-39ba-4163-a5eb-939601645edb?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.6","to_inclusive":true,"patched_in":"5.12.7"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dadd49c-33b2-43d8-a6a9-64a3c37c4b52","source":"wordfence","cve":"CVE-2025-11926","title":"Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dadd49c-33b2-43d8-a6a9-64a3c37c4b52?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-lite","name":"Related Posts Lite","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-10-17T00:00:00Z","updated":"2026-10-23T05:34:57Z"},{"id":"wordfence:5dae8e82-e252-48d9-ae1f-62acfcd17e2b","source":"wordfence","cve":"CVE-2023-2172","title":"BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dae8e82-e252-48d9-ae1f-62acfcd17e2b?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5daf48bb-881c-40f7-bb48-6084f7f2631a","source":"wordfence","cve":"CVE-2026-114184","title":"Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5daf48bb-881c-40f7-bb48-6084f7f2631a?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.14.4","to_inclusive":true,"patched_in":"1.14.5"}],"published":"2026-10-22T06:45:00Z","updated":"2026-10-23T18:54:49Z"},{"id":"wordfence:5db00b22-d766-4fde-86fe-98d90936028c","source":"wordfence","cve":"CVE-2024-10097","title":"Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db00b22-d766-4fde-86fe-98d90936028c?source=api-prod","affected":[{"type":"plugin","slug":"loginizer-security","name":"Loginizer Security","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"},{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-11-04T00:00:00Z","updated":"2025-02-19T17:41:19Z"},{"id":"wordfence:5db00eb6-3e05-42fa-bb84-2df4bcae3955","source":"wordfence","cve":"CVE-2023-1843","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db00eb6-3e05-42fa-bb84-2df4bcae3955?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5db195c1-8917-4465-a5ca-21089afb0bc7","source":"wordfence","cve":"CVE-2024-12316","title":"Jupiter X Core <= 4.8.5 - Missing Authorization to Unauthenticated Popup Template Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db195c1-8917-4465-a5ca-21089afb0bc7?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"4.8.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T11:11:13Z"},{"id":"wordfence:5db3c66f-0a9c-4233-923c-0965dec68c60","source":"wordfence","cve":"CVE-2026-4650","title":"FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db3c66f-0a9c-4233-923c-0965dec68c60?source=api-prod","affected":[{"type":"plugin","slug":"fundpress","name":"FundPress \u2013 WordPress Donation Plugin","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-05-01T19:18:29Z","updated":"2026-05-02T07:46:40Z"},{"id":"wordfence:5db3d87c-2b5b-40bf-a0d3-64d66af062c6","source":"wordfence","cve":"CVE-2016-20078","title":"IMDB Profile Widget <= 1.0.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db3d87c-2b5b-40bf-a0d3-64d66af062c6?source=api-prod","affected":[{"type":"plugin","slug":"imdb-widget","name":"IMDB Profile Widget","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:44:54Z"},{"id":"wordfence:5db3fd96-28c5-431e-9e0d-2aaa57d9dce3","source":"wordfence","cve":"CVE-2025-31080","title":"HTML Forms <= 1.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db3fd96-28c5-431e-9e0d-2aaa57d9dce3?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:31:28Z"},{"id":"wordfence:5db41cdb-0795-43e7-bd36-9a85a882a760","source":"wordfence","cve":"CVE-2022-0659","title":"Sync QCloud COS Plugin < 2.0.1 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db41cdb-0795-43e7-bd36-9a85a882a760?source=api-prod","affected":[{"type":"plugin","slug":"sync-qcloud-cos","name":"Sync QCloud COS","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5db42c7e-49bc-48ee-8129-b8a0df0c8d98","source":"wordfence","cve":"CVE-2022-43459","title":"Forms by CaptainForm <= 2.5.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db42c7e-49bc-48ee-8129-b8a0df0c8d98?source=api-prod","affected":[{"type":"plugin","slug":"captainform","name":"Forms by CaptainForm \u2013 Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2022-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5db431b1-6601-490b-960f-4dda6c25c872","source":"wordfence","cve":"CVE-2024-53711","title":"Hotlink2Watermark <= 0.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db431b1-6601-490b-960f-4dda6c25c872?source=api-prod","affected":[{"type":"plugin","slug":"hotlink2watermark","name":"Hotlink2Watermark","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:02:19Z"},{"id":"wordfence:5db4709d-0121-4b37-b0d2-79aa7943b442","source":"wordfence","cve":"CVE-2024-38747","title":"HitPay Payment Gateway for WooCommerce <= 4.1.3 - Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db4709d-0121-4b37-b0d2-79aa7943b442?source=api-prod","affected":[{"type":"plugin","slug":"hitpay-payment-gateway","name":"HitPay Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-19T13:54:56Z"},{"id":"wordfence:5db58070-fb0f-4d91-aac4-3c951af66b74","source":"wordfence","cve":"CVE-2024-51922","title":"VP Sitemap <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db58070-fb0f-4d91-aac4-3c951af66b74?source=api-prod","affected":[{"type":"plugin","slug":"vp-sitemap","name":"VP Sitemap","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:20:23Z"},{"id":"wordfence:5db5c5e0-f2ba-4082-b3eb-33cc0ce418e8","source":"wordfence","cve":"CVE-2023-30495","title":"Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db5c5e0-f2ba-4082-b3eb-33cc0ce418e8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.1.23","to_inclusive":true,"patched_in":"3.1.24"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5db5ea76-f0b6-4e30-aebf-c3769d0b3480","source":"wordfence","cve":"CVE-2016-10915","title":"Popup by Supsystic < 1.7.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5db5ea76-f0b6-4e30-aebf-c3769d0b3480?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":false,"patched_in":"1.7.9"}],"published":"2016-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dbb177e-3cf8-48fe-9660-999c177cbeb5","source":"wordfence","cve":"CVE-2026-107765","title":"Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbb177e-3cf8-48fe-9660-999c177cbeb5?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-10-30T18:35:57Z","updated":"2026-10-31T06:44:19Z"},{"id":"wordfence:5dbb3c7a-5d2e-4b8a-bf20-af78730c4b02","source":"wordfence","cve":"CVE-2025-57925","title":"immonex Kickstart Team <= 1.6.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbb3c7a-5d2e-4b8a-bf20-af78730c4b02?source=api-prod","affected":[{"type":"plugin","slug":"immonex-kickstart-team","name":"immonex Kickstart Team","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:21:46Z"},{"id":"wordfence:5dbba038-da5f-44d9-b72a-44cbff01596e","source":"wordfence","cve":"CVE-2024-3999","title":"EazyDocs \u2013 Most Powerful Knowledge base, wiki, Documentation Builder Plugin <= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbba038-da5f-44d9-b72a-44cbff01596e?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-06-11T00:00:00Z","updated":"2024-07-03T18:29:55Z"},{"id":"wordfence:5dbbd1a0-de05-4510-b06b-8bc396b65a97","source":"wordfence","cve":"CVE-2024-3664","title":"Quick Featured Images <= 13.7.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Thumbnail Deletion/Setting","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbbd1a0-de05-4510-b06b-8bc396b65a97?source=api-prod","affected":[{"type":"plugin","slug":"quick-featured-images","name":"Quick Featured Images","from":"*","from_inclusive":true,"to":"13.7.0","to_inclusive":true,"patched_in":"13.7.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T07:36:28Z"},{"id":"wordfence:5dbd29ba-c4e8-4a43-b17c-332807570309","source":"wordfence","cve":"","title":"Highlight Searched Terms in Results <= 1.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbd29ba-c4e8-4a43-b17c-332807570309?source=api-prod","affected":[{"type":"plugin","slug":"highlight-search-terms-results","name":"Highlight Searched Terms in Results","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dbe5094-d255-46b1-9e8e-9c48cd74e8a2","source":"wordfence","cve":"CVE-2026-13358","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbe5094-d255-46b1-9e8e-9c48cd74e8a2?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.10","to_inclusive":true,"patched_in":"1.6.12.11"}],"published":"2026-08-15T15:27:24Z","updated":"2026-08-16T04:24:54Z"},{"id":"wordfence:5dbebce4-599b-4241-aa9a-3d2486a57d52","source":"wordfence","cve":"CVE-2014-4575","title":"WikiPop <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbebce4-599b-4241-aa9a-3d2486a57d52?source=api-prod","affected":[{"type":"plugin","slug":"wikipop","name":"WikiPop","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dc14681-b537-4ce2-af79-fc9ff1083e20","source":"wordfence","cve":"CVE-2025-67630","title":"WH Tweaks <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc14681-b537-4ce2-af79-fc9ff1083e20?source=api-prod","affected":[{"type":"plugin","slug":"wh-tweaks","name":"WH Tweaks","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-08T21:41:13Z"},{"id":"wordfence:5dc278a9-79bd-4494-a34c-a5e92cde7062","source":"wordfence","cve":"CVE-2026-40789","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc278a9-79bd-4494-a34c-a5e92cde7062?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-04-23T00:00:00Z","updated":"2026-06-10T18:04:26Z"},{"id":"wordfence:5dc36acb-94f9-46e0-a7ae-2ae99158425f","source":"wordfence","cve":"CVE-2026-81277","title":"Suggestion Engine for WooCommerce <= 2.0.11 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc36acb-94f9-46e0-a7ae-2ae99158425f?source=api-prod","affected":[{"type":"plugin","slug":"woo-suggestion-engine","name":"Suggestion Engine for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:01:29Z"},{"id":"wordfence:5dc3fc87-0d16-4cc3-a6f0-5cc17a66a1db","source":"wordfence","cve":"CVE-2026-107160","title":"LTL Freight Quotes \u2013 ODFL Edition < 4.2.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc3fc87-0d16-4cc3-a6f0-5cc17a66a1db?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-odfl-edition","name":"LTL Freight Quotes \u2013 ODFL Edition","from":"*","from_inclusive":true,"to":"4.2.19","to_inclusive":false,"patched_in":"4.2.19"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:10Z"},{"id":"wordfence:5dc72d78-d47c-4b36-8d69-8672e15ddf8c","source":"wordfence","cve":"CVE-2026-6279","title":"Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler","severity":"critical","cvss":9.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc72d78-d47c-4b36-8d69-8672e15ddf8c?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.2","to_inclusive":true,"patched_in":"3.15.3"}],"published":"2026-05-20T15:45:14Z","updated":"2026-05-21T04:28:01Z"},{"id":"wordfence:5dc8feae-fc89-4152-b9b2-2b70e6ccb30b","source":"wordfence","cve":"CVE-2025-13374","title":"Kalrav AI Agent <= 2.3.8 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dc8feae-fc89-4152-b9b2-2b70e6ccb30b?source=api-prod","affected":[{"type":"plugin","slug":"kalrav-ai-agent","name":"KalravAI Agent","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-01-23T19:03:14Z","updated":"2026-09-21T19:25:42Z"},{"id":"wordfence:5dce15ea-70cf-4b4c-959a-8adf2cdcdca4","source":"wordfence","cve":"CVE-2011-5286","title":"Social Slider < 7.4.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dce15ea-70cf-4b4c-959a-8adf2cdcdca4?source=api-prod","affected":[{"type":"plugin","slug":"social-slider","name":"Social Slider","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":false,"patched_in":"7.4.2"}],"published":"2011-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dd270c6-31e5-4005-9c5f-d29e1f2f5faa","source":"wordfence","cve":"CVE-2024-10676","title":"Conversion Helper <= 1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd270c6-31e5-4005-9c5f-d29e1f2f5faa?source=api-prod","affected":[{"type":"plugin","slug":"conversion-helper","name":"Conversion Helper","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:53:50Z"},{"id":"wordfence:5dd2a4cb-dd74-4b00-82f5-3bf1452e71a3","source":"wordfence","cve":"CVE-2023-47807","title":"10WebAnalytics <= 1.2.12 - Missing Authorization via gawd_wd_bp_install_notice_status","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd2a4cb-dd74-4b00-82f5-3bf1452e71a3?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-analytics","name":"10WebAnalytics","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dd2f81c-8e7c-47e6-93ff-8d6ae2f23304","source":"wordfence","cve":"CVE-2025-63004","title":"All in One Accessibility <= 1.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd2f81c-8e7c-47e6-93ff-8d6ae2f23304?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-accessibility","name":"All in One Accessibility","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.16"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-20T15:10:06Z"},{"id":"wordfence:5dd34def-ee16-4f85-91e4-037ed8190146","source":"wordfence","cve":"CVE-2026-94118","title":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates <= 2.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd34def-ee16-4f85-91e4-037ed8190146?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.3.17","to_inclusive":true,"patched_in":"2.3.18"}],"published":"2026-09-23T09:45:00Z","updated":"2026-09-29T20:04:30Z"},{"id":"wordfence:5dd6a90e-03da-43e5-b975-be8f5aa5fc60","source":"wordfence","cve":"CVE-2024-10887","title":"NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd6a90e-03da-43e5-b975-be8f5aa5fc60?source=api-prod","affected":[{"type":"plugin","slug":"nicejob","name":"NiceJob","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2024-11-12T13:19:59Z","updated":"2024-11-22T15:32:22Z"},{"id":"wordfence:5dd7eb74-20ec-4949-9ba2-34081849d7f7","source":"wordfence","cve":"CVE-2022-45817","title":"GC Testimonials <= 1.3.2 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd7eb74-20ec-4949-9ba2-34081849d7f7?source=api-prod","affected":[{"type":"plugin","slug":"gc-testimonials","name":"GC Testimonials","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dd962a5-ec0e-415f-8efa-91e78bb80d16","source":"wordfence","cve":"CVE-2024-24926","title":"Brooklyn <= 4.9.9.2 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd962a5-ec0e-415f-8efa-91e78bb80d16?source=api-prod","affected":[{"type":"theme","slug":"brooklyn","name":"Brooklyn | Creative Multipurpose Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"4.9.9.2","to_inclusive":true,"patched_in":"4.9.9.3"}],"published":"2024-02-09T00:00:00Z","updated":"2025-02-24T22:13:09Z"},{"id":"wordfence:5dde4850-347f-40e6-9cea-87284aa655e7","source":"wordfence","cve":"","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.75 - Authenticated (Admin+) Directory Traversal","severity":"medium","cvss":6.0,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dde4850-347f-40e6-9cea-87284aa655e7?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.75","to_inclusive":true,"patched_in":"0.9.76"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ddeefef-13c0-4c26-9a8a-141ebc7846ee","source":"wordfence","cve":"CVE-2025-3582","title":"Newsletter  <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ddeefef-13c0-4c26-9a8a-141ebc7846ee?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.8.4","to_inclusive":true,"patched_in":"8.8.5"}],"published":"2025-05-19T00:00:00Z","updated":"2025-07-09T14:42:46Z"},{"id":"wordfence:5ddfa2a1-39e1-4ead-85c5-1624749bd353","source":"wordfence","cve":"CVE-2022-2936","title":"Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ddfa2a1-39e1-4ead-85c5-1624749bd353?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.3","to_inclusive":true,"patched_in":"9.8.0"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ddfea92-b790-4cf3-8b98-39c2374c7c31","source":"wordfence","cve":"CVE-2024-6022","title":"ContentLock <= 1.0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ddfea92-b790-4cf3-8b98-39c2374c7c31?source=api-prod","affected":[{"type":"plugin","slug":"contentlock","name":"ContentLock","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-19T14:13:15Z"},{"id":"wordfence:5de1b6e2-59a3-41ae-a73c-66a79fbd2316","source":"wordfence","cve":"CVE-2026-24355","title":"Houzez Theme - Functionality <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de1b6e2-59a3-41ae-a73c-66a79fbd2316?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2026-01-17T00:00:00Z","updated":"2026-01-28T18:33:01Z"},{"id":"wordfence:5de212c9-5c2e-4713-b1ce-022dd84520c3","source":"wordfence","cve":"CVE-2025-13934","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de212c9-5c2e-4713-b1ce-022dd84520c3?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-01-08T18:43:50Z","updated":"2026-01-09T07:22:31Z"},{"id":"wordfence:5de24a9e-0af3-44d7-af0b-06689a3e3bc5","source":"wordfence","cve":"CVE-2025-49904","title":"Booking and Rental Manager <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de24a9e-0af3-44d7-af0b-06689a3e3bc5?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-11-01T00:00:00Z","updated":"2025-11-03T18:07:15Z"},{"id":"wordfence:5de488a2-72d6-4eeb-9b92-7f5bea1ee4ff","source":"wordfence","cve":"CVE-2021-24667","title":"Gallery Blocks with Lightbox <= 2.2.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de488a2-72d6-4eeb-9b92-7f5bea1ee4ff?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5de4f912-1dc2-48e8-a413-04b06a1b61f5","source":"wordfence","cve":"CVE-2025-32922","title":"WP2LEADS <= 3.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de4f912-1dc2-48e8-a413-04b06a1b61f5?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2025-05-15T00:00:00Z","updated":"2025-07-18T14:16:43Z"},{"id":"wordfence:5de56a2e-f8e2-47d9-8a2b-989de640f018","source":"wordfence","cve":"CVE-2008-4732","title":"WP Comment Remix < 1.4.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de56a2e-f8e2-47d9-8a2b-989de640f018?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-remix","name":"WP Comment Remix","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2008-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5de8b93a-d7b1-4679-8c3c-2ac099a1f58f","source":"wordfence","cve":"CVE-2024-33628","title":"XforWooCommerce <= 2.0.2 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de8b93a-d7b1-4679-8c3c-2ac099a1f58f?source=api-prod","affected":[{"type":"plugin","slug":"xforwoocommerce","name":"XforWooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:50:17Z"},{"id":"wordfence:5de8bc53-612f-4cee-b10c-bc24fc67bcf0","source":"wordfence","cve":"CVE-2024-54364","title":"Feedpress Generator <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de8bc53-612f-4cee-b10c-bc24fc67bcf0?source=api-prod","affected":[{"type":"plugin","slug":"feedpress-generator","name":"Feedpress Generator \u2013 External RSS Frontend Customizer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:21:51Z"},{"id":"wordfence:5de937cc-da05-4b95-807d-dc19a8b7d6b0","source":"wordfence","cve":"","title":"Child Theme Generator <= 2.2.7 Cross-Site Request Forgery to Arbitrary Folder Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de937cc-da05-4b95-807d-dc19a8b7d6b0?source=api-prod","affected":[{"type":"plugin","slug":"child-theme-generator","name":"Child Theme Generator","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2021-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5de953ee-8a01-4372-a376-74a4cff674ce","source":"wordfence","cve":"CVE-2023-27444","title":"DecaLog <= 3.7.0 - Cross-Site Request Forgery via get_settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5de953ee-8a01-4372-a376-74a4cff674ce?source=api-prod","affected":[{"type":"plugin","slug":"decalog","name":"DecaLog","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2023-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dea4293-0496-4cee-9d8a-c15beaa51b14","source":"wordfence","cve":"CVE-2024-43246","title":"WHMpress <= 6.2-revision-5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dea4293-0496-4cee-9d8a-c15beaa51b14?source=api-prod","affected":[{"type":"plugin","slug":"whmpress","name":"WHMpress - WHMCS WordPress Integration Plugin","from":"*","from_inclusive":true,"to":"6.2-revision-5","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:53:53Z"},{"id":"wordfence:5dea49fb-2703-4754-9abd-5f4e526d5570","source":"wordfence","cve":"CVE-2024-11977","title":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dea49fb-2703-4754-9abd-5f4e526d5570?source=api-prod","affected":[{"type":"plugin","slug":"kk-star-ratings","name":"kk Star Ratings \u2013 Rate Post & Collect User Feedbacks","from":"*","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"5.4.10.2"}],"published":"2024-12-20T16:25:44Z","updated":"2025-01-15T10:03:23Z"},{"id":"wordfence:5debe121-6373-4b56-8441-f0d4a5920089","source":"wordfence","cve":"CVE-2024-10690","title":"Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5debe121-6373-4b56-8441-f0d4a5920089?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-elementor","name":"Shortcodes for Elementor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:15Z"},{"id":"wordfence:5dec045a-b87c-4db5-960e-8888e410a950","source":"wordfence","cve":"CVE-2013-2707","title":"Login With Ajax < 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dec045a-b87c-4db5-960e-8888e410a950?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2013-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dee21da-dd92-41e7-8547-fb49eecec03c","source":"wordfence","cve":"CVE-2012-2403","title":"WordPress Core < 3.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dee21da-dd92-41e7-8547-fb49eecec03c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2012-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5def019a-e9df-4c86-ad1a-155b27c10c45","source":"wordfence","cve":"CVE-2026-62087","title":"Equadio <= 1.1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5def019a-e9df-4c86-ad1a-155b27c10c45?source=api-prod","affected":[{"type":"theme","slug":"equadio","name":"Equadio","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:36:45Z","updated":"2026-10-13T14:01:46Z"},{"id":"wordfence:5def46b8-2b2b-4397-980e-76cb27ae42fe","source":"wordfence","cve":"CVE-2025-28863","title":"Delete Original Image <= 0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5def46b8-2b2b-4397-980e-76cb27ae42fe?source=api-prod","affected":[{"type":"plugin","slug":"delete-original-image","name":"Delete Original Image","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:55:43Z"},{"id":"wordfence:5df238dd-6269-4ee0-a0f4-12bdb74f74e8","source":"wordfence","cve":"CVE-2021-24454","title":"YOP Poll <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df238dd-6269-4ee0-a0f4-12bdb74f74e8?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2021-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5df2dfcd-2fda-4f09-bd77-f437422d20bb","source":"wordfence","cve":"CVE-2022-0347","title":"LoginPress <= 1.5.11 - Reflected Cross-Site Scripting via redirect-page Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df2dfcd-2fda-4f09-bd77-f437422d20bb?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":false,"patched_in":"1.5.12"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5df2f3cc-affc-4549-b59e-d145cce10c79","source":"wordfence","cve":"CVE-2024-13427","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df2f3cc-affc-4549-b59e-d145cce10c79?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-23T00:00:00Z","updated":"2025-05-24T01:55:38Z"},{"id":"wordfence:5df32365-5381-48e0-9313-7e83c4c6c440","source":"wordfence","cve":"CVE-2024-12370","title":"WP Hotel Booking <= 2.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df32365-5381-48e0-9313-7e83c4c6c440?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-01-16T20:12:23Z","updated":"2025-01-17T08:25:39Z"},{"id":"wordfence:5df3736f-4aef-4899-bc32-3cd5e3ed15bd","source":"wordfence","cve":"CVE-2026-14849","title":"Paid Member Subscriptions <= 3.0.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df3736f-4aef-4899-bc32-3cd5e3ed15bd?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-13T00:00:00Z","updated":"2026-09-17T14:58:34Z"},{"id":"wordfence:5df4b4ed-14ec-4895-9d84-9edb5311b78c","source":"wordfence","cve":"CVE-2026-12973","title":"PayPlus Payment Gateway <= 8.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df4b4ed-14ec-4895-9d84-9edb5311b78c?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"8.2.1","to_inclusive":true,"patched_in":"8.2.2"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T22:59:46Z"},{"id":"wordfence:5df83f52-b976-4f60-b48d-d76b1ce2af9f","source":"wordfence","cve":"CVE-2026-118164","title":"If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df83f52-b976-4f60-b48d-d76b1ce2af9f?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-10-27T17:39:20Z","updated":"2026-10-28T06:45:13Z"},{"id":"wordfence:5df84ae1-7953-4ed8-ae22-67be144a439c","source":"wordfence","cve":"CVE-2026-86832","title":"MetForm <= 4.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df84ae1-7953-4ed8-ae22-67be144a439c?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:58:26Z"},{"id":"wordfence:5df8983e-16c9-4a23-9bf4-331d70384e74","source":"wordfence","cve":"CVE-2013-3258","title":"Digg Digg < 5.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df8983e-16c9-4a23-9bf4-331d70384e74?source=api-prod","affected":[{"type":"plugin","slug":"digg-digg","name":"digg-digg","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":false,"patched_in":"5.3.5"}],"published":"2013-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5df9019a-e87a-42c6-a71a-d71a1c415d6c","source":"wordfence","cve":"CVE-2026-39649","title":"Royale News <= 2.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5df9019a-e87a-42c6-a71a-d71a1c415d6c?source=api-prod","affected":[{"type":"theme","slug":"royale-news","name":"Royale News","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:22:58Z"},{"id":"wordfence:5dfa4ddf-bbe7-49b1-8b0d-c030ae81d0e8","source":"wordfence","cve":"CVE-2015-9325","title":"Visitors Online by BestWebSoft <= 0.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfa4ddf-bbe7-49b1-8b0d-c030ae81d0e8?source=api-prod","affected":[{"type":"plugin","slug":"visitors-online","name":"Visitors Online by BestWebSoft","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"}],"published":"2015-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dfaa23f-05df-423c-a5f6-02f2b714b5b6","source":"wordfence","cve":"CVE-2024-5567","title":"Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfaa23f-05df-423c-a5f6-02f2b714b5b6?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.5.5","to_inclusive":true,"patched_in":"27.5.6"}],"published":"2024-09-12T17:35:48Z","updated":"2024-09-13T06:47:27Z"},{"id":"wordfence:5dfb8937-848d-4ce6-a90c-03b75f7951a1","source":"wordfence","cve":"CVE-2024-54391","title":"WordPress Filter <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfb8937-848d-4ce6-a90c-03b75f7951a1?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-filter","name":"WordPress Filter","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:56:00Z"},{"id":"wordfence:5dfc145e-d2d4-4137-a5c6-dec2ebb41876","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc145e-d2d4-4137-a5c6-dec2ebb41876?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.15","to_inclusive":false,"patched_in":"4.6.15"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5dfc2249-3761-49c6-966e-73c33be74c0e","source":"wordfence","cve":"CVE-2025-0855","title":"PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=api-prod","affected":[{"type":"plugin","slug":"pgs-core","name":"PGS Core","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2025-05-06T00:00:00Z","updated":"2025-05-06T22:22:31Z"},{"id":"wordfence:5dfcc6dc-db8a-4a03-9c1d-edf0513b43df","source":"wordfence","cve":"CVE-2026-110070","title":"Modern Events Calendar Lite <= 7.36.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfcc6dc-db8a-4a03-9c1d-edf0513b43df?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.36.3","to_inclusive":true,"patched_in":"7.36.4"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:31:47Z"},{"id":"wordfence:5e0116d6-91c3-4212-9c68-6b706ab09768","source":"wordfence","cve":"CVE-2024-13784","title":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms <= 1.8.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0116d6-91c3-4212-9c68-6b706ab09768?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2026-08-15T20:14:59Z","updated":"2026-08-16T08:31:05Z"},{"id":"wordfence:5e043348-c0aa-418f-9120-dcf470f92123","source":"wordfence","cve":"CVE-2024-53779","title":"Yahoo! WebPlayer <= 2.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e043348-c0aa-418f-9120-dcf470f92123?source=api-prod","affected":[{"type":"plugin","slug":"yahoo-media-player","name":"Yahoo! WebPlayer","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:12:34Z"},{"id":"wordfence:5e04edb6-ef37-4ea8-a734-dbdcf689ba9b","source":"wordfence","cve":"CVE-2024-8488","title":"Survey Maker \u2013 Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms <= 4.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e04edb6-ef37-4ea8-a734-dbdcf689ba9b?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T11:04:22Z"},{"id":"wordfence:5e0767a8-9e82-4ce4-9df9-19b458dc5ce0","source":"wordfence","cve":"CVE-2022-43472","title":"eRoom \u2013 Zoom Meetings & Webinar <= 1.4.6 - Missing Authorization via stm_wpcfto_get_settings_callback","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0767a8-9e82-4ce4-9df9-19b458dc5ce0?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e0a0cd9-45ce-43aa-897a-78dc54886326","source":"wordfence","cve":"CVE-2026-102390","title":"AFFI \u2013 Affiliate Marketing for WooCommerce <= 1.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a0cd9-45ce-43aa-897a-78dc54886326?source=api-prod","affected":[{"type":"plugin","slug":"affi-affiliate-marketing-for-woo","name":"AFFI \u2013 Affiliate Marketing for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2026-10-01T12:31:00Z","updated":"2026-10-08T23:12:25Z"},{"id":"wordfence:5e0a7108-15ef-42d0-adce-fd5b0e6faf3c","source":"wordfence","cve":"CVE-2023-6326","title":"Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0a7108-15ef-42d0-adce-fd5b0e6faf3c?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2024-03-01T00:00:00Z","updated":"2024-09-30T14:39:23Z"},{"id":"wordfence:5e0b3012-dc29-4a15-811b-190b16a0c86e","source":"wordfence","cve":"CVE-2026-10531","title":"AI Share & Summarize < 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0b3012-dc29-4a15-811b-190b16a0c86e?source=api-prod","affected":[{"type":"plugin","slug":"ai-share-summarize","name":"Share Buttons & AI-powered Summaries","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:49:13Z"},{"id":"wordfence:5e0b5709-70cd-482c-8ffe-3e40e3d35465","source":"wordfence","cve":"CVE-2024-8286","title":"GDPR Cookie Consent <= 2.6.0 - Cross-Site Request Forgery to Bulk Delete","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0b5709-70cd-482c-8ffe-3e40e3d35465?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-gdpr-cookie-consent","name":"GDPR Cookie Consent","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T15:44:26Z"},{"id":"wordfence:5e0bcf70-2ffc-45c8-b63e-a8376b6cd22b","source":"wordfence","cve":"CVE-2024-13789","title":"Ravpage <= 2.31 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0bcf70-2ffc-45c8-b63e-a8376b6cd22b?source=api-prod","affected":[{"type":"plugin","slug":"ravpage","name":"ravpage","from":"*","from_inclusive":true,"to":"2.31","to_inclusive":true,"patched_in":"2.33"}],"published":"2025-02-19T21:08:30Z","updated":"2025-03-25T19:22:59Z"},{"id":"wordfence:5e0ce0dc-34eb-4577-82a5-8ed822847ff4","source":"wordfence","cve":"","title":"WPS Limit Login < 1.4.6.1 - Authorization Bypass via IP Spoofing","severity":"critical","cvss":9.8,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e0ce0dc-34eb-4577-82a5-8ed822847ff4?source=api-prod","affected":[{"type":"plugin","slug":"wps-limit-login","name":"WPS Limit Login","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":false,"patched_in":"1.4.6.1"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e15e36e-55f9-4095-a0ba-48ef9434606a","source":"wordfence","cve":"CVE-2026-2628","title":"All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=api-prod","affected":[{"type":"plugin","slug":"login-with-azure","name":"All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-03-02T13:04:58Z","updated":"2026-03-03T01:21:50Z"},{"id":"wordfence:5e16a3e2-79db-4647-9712-03ae666feac4","source":"wordfence","cve":"CVE-2023-26003","title":"WP Post Corrector <= 1.0.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e16a3e2-79db-4647-9712-03ae666feac4?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-corrector","name":"WP Post Corrector","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:34:51Z"},{"id":"wordfence:5e18c3b9-0a3a-4f6a-bc22-8022947dd7cb","source":"wordfence","cve":"CVE-2025-60105","title":"Ditty <= 3.1.58 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e18c3b9-0a3a-4f6a-bc22-8022947dd7cb?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.58","to_inclusive":true,"patched_in":"3.1.59"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:06:10Z"},{"id":"wordfence:5e1950c7-cc7c-48cf-974e-f691ef61d6be","source":"wordfence","cve":"CVE-2024-13539","title":"AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e1950c7-cc7c-48cf-974e-f691ef61d6be?source=api-prod","affected":[{"type":"plugin","slug":"aforms-eats","name":"AForms Eats","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T03:21:37Z"},{"id":"wordfence:5e1a11fc-16d3-4a63-907f-af64c770e3bc","source":"wordfence","cve":"CVE-2025-46529","title":"Business Contact Widget <= 2.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e1a11fc-16d3-4a63-907f-af64c770e3bc?source=api-prod","affected":[{"type":"plugin","slug":"business-contact-widget","name":"Business Contact Widget","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:28:12Z"},{"id":"wordfence:5e21524e-2470-49e1-983a-a62a0ae478f6","source":"wordfence","cve":"CVE-2015-9539","title":"Fast Secure Contact Form <= 4.0.37 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e21524e-2470-49e1-983a-a62a0ae478f6?source=api-prod","affected":[{"type":"plugin","slug":"si-contact-form","name":"Fast Secure Contact Form","from":"*","from_inclusive":true,"to":"4.0.37","to_inclusive":true,"patched_in":"4.0.38"}],"published":"2015-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e24be91-6a58-42c3-84dd-4090da55b720","source":"wordfence","cve":"CVE-2023-4502","title":"GTranslate <= 3.0.3 - Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e24be91-6a58-42c3-84dd-4090da55b720?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"}],"published":"2023-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e24e99a-2981-4f3e-a672-10f57cf96675","source":"wordfence","cve":"CVE-2025-58998","title":"s2Member <= 250701 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e24e99a-2981-4f3e-a672-10f57cf96675?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"250701","to_inclusive":true,"patched_in":"250905"}],"published":"2025-08-21T00:00:00Z","updated":"2025-11-12T13:36:07Z"},{"id":"wordfence:5e24feac-1812-45d7-b3c3-27787eed1cf1","source":"wordfence","cve":"CVE-2025-11007","title":"CE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings Update","severity":"critical","cvss":9.8,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e24feac-1812-45d7-b3c3-27787eed1cf1?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"2.2.1","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:23:39Z","updated":"2026-09-09T16:33:09Z"},{"id":"wordfence:5e274781-1c20-4224-bc10-26dadb9b1e07","source":"wordfence","cve":"CVE-2026-9189","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e274781-1c20-4224-bc10-26dadb9b1e07?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2026-05-28T19:54:04Z","updated":"2026-05-29T08:28:26Z"},{"id":"wordfence:5e29b10e-81d5-4247-bfe8-2400bcd9aef9","source":"wordfence","cve":"CVE-2020-6009","title":"LearnDash <= 3.1.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e29b10e-81d5-4247-bfe8-2400bcd9aef9?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e2bf4a8-1dca-47fb-8164-acca0b2cf4f2","source":"wordfence","cve":"CVE-2026-27540","title":"Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2bf4a8-1dca-47fb-8164-acca0b2cf4f2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-lead-capture","name":"Wholesale Lead Capture Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3.1","to_inclusive":true,"patched_in":"2.0.3.2"}],"published":"2026-02-20T00:00:00Z","updated":"2026-02-27T16:16:22Z"},{"id":"wordfence:5e2c83b6-3444-4cd1-82ec-567937c563b9","source":"wordfence","cve":"CVE-2023-30786","title":"Captcha Them All <= 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2c83b6-3444-4cd1-82ec-567937c563b9?source=api-prod","affected":[{"type":"plugin","slug":"captcha-them-all","name":"Captcha Them All","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e2e6775-219d-472c-8ebb-794bbff3e5ec","source":"wordfence","cve":"CVE-2024-43356","title":"oik <= 4.12.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2e6775-219d-472c-8ebb-794bbff3e5ec?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":"4.12.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:21:37Z"},{"id":"wordfence:5e2f3abd-0a15-4bc1-966a-22d606f3e333","source":"wordfence","cve":"CVE-2024-10874","title":"Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2f3abd-0a15-4bc1-966a-22d606f3e333?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-11-22T15:10:01Z","updated":"2024-12-05T15:16:24Z"},{"id":"wordfence:5e314a57-149e-40be-93ec-6df5e5f46897","source":"wordfence","cve":"CVE-2026-122659","title":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e314a57-149e-40be-93ec-6df5e5f46897?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:17:02Z"},{"id":"wordfence:5e31eda3-06f8-44c5-8b05-74283d4d20bb","source":"wordfence","cve":"CVE-2026-24377","title":"Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e31eda3-06f8-44c5-8b05-74283d4d20bb?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T20:52:46Z"},{"id":"wordfence:5e3593e8-3840-4db0-8269-61bbcb50d569","source":"wordfence","cve":"CVE-2024-8622","title":"amCharts: Charts and Maps <= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3593e8-3840-4db0-8269-61bbcb50d569?source=api-prod","affected":[{"type":"plugin","slug":"amcharts-charts-and-maps","name":"amCharts: Charts and Maps","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-09-11T00:00:00Z","updated":"2024-09-12T08:30:47Z"},{"id":"wordfence:5e364f0c-17ea-4962-92d3-35bf5eb666ad","source":"wordfence","cve":"CVE-2018-6465","title":"PropertyHive < 1.4.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e364f0c-17ea-4962-92d3-35bf5eb666ad?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":false,"patched_in":"1.4.15"}],"published":"2018-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e36b6bd-20d9-433f-beb7-82077b09beee","source":"wordfence","cve":"CVE-2025-31384","title":"Videos <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e36b6bd-20d9-433f-beb7-82077b09beee?source=api-prod","affected":[{"type":"plugin","slug":"videos","name":"Videos","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T19:16:09Z"},{"id":"wordfence:5e383b8a-27e5-4b35-8d11-6e4102255d44","source":"wordfence","cve":"CVE-2026-3330","title":"Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e383b8a-27e5-4b35-8d11-6e4102255d44?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.40","to_inclusive":true,"patched_in":"1.15.41"}],"published":"2026-04-16T15:04:04Z","updated":"2026-04-17T03:36:43Z"},{"id":"wordfence:5e38ee27-30a4-45be-bab6-a3e65ada215f","source":"wordfence","cve":"CVE-2023-52178","title":"WP Affiliate Disclosure <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via $id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e38ee27-30a4-45be-bab6-a3e65ada215f?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-disclosure","name":"WP Affiliate Disclosure","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e392d3c-4a3d-4b5b-a149-70c9b58dca1a","source":"wordfence","cve":"CVE-2026-15463","title":"SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e392d3c-4a3d-4b5b-a149-70c9b58dca1a?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.7.42","to_inclusive":true,"patched_in":"4.7.43"}],"published":"2026-09-18T19:26:09Z","updated":"2026-09-19T07:43:16Z"},{"id":"wordfence:5e397c7a-2aef-4c23-a224-e324ea4bb4b1","source":"wordfence","cve":"CVE-2026-4125","title":"WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e397c7a-2aef-4c23-a224-e324ea4bb4b1?source=api-prod","affected":[{"type":"plugin","slug":"wpmk-block","name":"WPMK Block","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:05:22Z","updated":"2026-04-22T07:45:36Z"},{"id":"wordfence:5e3b0a3a-ce4b-40fd-9519-a81e315cee42","source":"wordfence","cve":"CVE-2026-9700","title":"Eventer <= 4.4.3 - Unauthenticated SQL Injection via 'code' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3b0a3a-ce4b-40fd-9519-a81e315cee42?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-07-07T16:30:56Z","updated":"2026-08-18T20:36:50Z"},{"id":"wordfence:5e3bcd70-d19c-4c0f-80d0-a69e2ab947d2","source":"wordfence","cve":"CVE-2022-25305","title":"WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3bcd70-d19c-4c0f-80d0-a69e2ab947d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e3dd131-dbd8-431c-96f4-4ab2c3be4dbd","source":"wordfence","cve":"CVE-2024-1338","title":"ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3dd131-dbd8-431c-96f4-4ab2c3be4dbd?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:44:03Z"},{"id":"wordfence:5e3de1a4-a534-475b-9138-2337755b0288","source":"wordfence","cve":"CVE-2026-0814","title":"Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3de1a4-a534-475b-9138-2337755b0288?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-04-08T05:13:06Z","updated":"2026-04-08T17:25:52Z"},{"id":"wordfence:5e3e6ca7-83fb-4558-aa90-0a10432af2d8","source":"wordfence","cve":"CVE-2025-23701","title":"Lime Developer Login <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3e6ca7-83fb-4558-aa90-0a10432af2d8?source=api-prod","affected":[{"type":"plugin","slug":"lime-developer-login","name":"Lime Developer Login","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:10:54Z"},{"id":"wordfence:5e3e7c1a-a9c0-4e92-868c-5785d891cf8f","source":"wordfence","cve":"CVE-2026-11496","title":"Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3e7c1a-a9c0-4e92-868c-5785d891cf8f?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-09-10T14:38:41Z","updated":"2026-09-11T03:39:35Z"},{"id":"wordfence:5e3e9421-809c-423a-afcf-28c061c00fad","source":"wordfence","cve":"CVE-2026-9724","title":"MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e3e9421-809c-423a-afcf-28c061c00fad?source=api-prod","affected":[{"type":"plugin","slug":"motordesk","name":"MotorDesk","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-06-23T16:41:08Z","updated":"2026-07-10T14:09:56Z"},{"id":"wordfence:5e408c1b-6789-4e9c-95c2-89e0a033e6b8","source":"wordfence","cve":"CVE-2025-22348","title":"DynamicTags <= 1.4.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e408c1b-6789-4e9c-95c2-89e0a033e6b8?source=api-prod","affected":[{"type":"plugin","slug":"dynamictags","name":"DynamicTags","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-11T21:49:29Z"},{"id":"wordfence:5e40af29-ecbc-48b0-a4ea-f263a4342a20","source":"wordfence","cve":"CVE-2025-67468","title":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e40af29-ecbc-48b0-a4ea-f263a4342a20?source=api-prod","affected":[{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-12T21:15:07Z"},{"id":"wordfence:5e441699-4c78-4277-8ac1-f33b810e78cb","source":"wordfence","cve":"CVE-2025-13145","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e441699-4c78-4277-8ac1-f33b810e78cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.33.1","to_inclusive":true,"patched_in":"7.34"}],"published":"2025-11-18T17:44:17Z","updated":"2025-11-19T05:45:13Z"},{"id":"wordfence:5e45b5d3-0f55-45b2-a289-42d37af266c1","source":"wordfence","cve":"CVE-2025-23526","title":"Swift Calendar Online Appointment Scheduling <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e45b5d3-0f55-45b2-a289-42d37af266c1?source=api-prod","affected":[{"type":"plugin","slug":"online-appointment-scheduling-software","name":"Swift Calendar Online Appointment Scheduling","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:50:31Z"},{"id":"wordfence:5e46beca-e33b-4ed9-a0ab-612a6987174e","source":"wordfence","cve":"CVE-2026-4123","title":"RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e46beca-e33b-4ed9-a0ab-612a6987174e?source=api-prod","affected":[{"type":"plugin","slug":"rw-elephant-rental-inventory","name":"RW Elephant Rental Inventory","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-09-21T18:48:08Z","updated":"2026-09-22T07:41:11Z"},{"id":"wordfence:5e491592-a17f-4789-8faa-d2a60b8ced70","source":"wordfence","cve":"","title":"WordPress Download Manager <= 2.7.4 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e491592-a17f-4789-8faa-d2a60b8ced70?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":false,"patched_in":"2.7.5"}],"published":"2014-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e493f01-95db-48ba-8daf-d7ff69df29bf","source":"wordfence","cve":"CVE-2025-14855","title":"SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e493f01-95db-48ba-8daf-d7ff69df29bf?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-12-20T18:46:37Z","updated":"2025-12-21T07:31:11Z"},{"id":"wordfence:5e49afbd-9038-4d1d-b545-4dc86bb1be61","source":"wordfence","cve":"","title":"Video Metabox <= 1.1 - Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e49afbd-9038-4d1d-b545-4dc86bb1be61?source=api-prod","affected":[{"type":"plugin","slug":"video-metabox","name":"Video Metabox","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2013-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e4ab6c3-fa9a-4643-aaf5-eabbdf909f9f","source":"wordfence","cve":"CVE-2025-24587","title":"Email Subscription Popup <= 1.2.23 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e4ab6c3-fa9a-4643-aaf5-eabbdf909f9f?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.23","to_inclusive":true,"patched_in":"1.2.24"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:07:19Z"},{"id":"wordfence:5e4b0fa4-51b7-4892-9087-30618900e069","source":"wordfence","cve":"CVE-2026-16776","title":"MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e4b0fa4-51b7-4892-9087-30618900e069?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.14.2","to_inclusive":true,"patched_in":"5.15"}],"published":"2026-10-09T17:22:11Z","updated":"2026-10-10T05:30:59Z"},{"id":"wordfence:5e5143f2-6641-4ae3-baa1-e5b83d784799","source":"wordfence","cve":"CVE-2021-24128","title":"Team Members <= 5.0.3 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e5143f2-6641-4ae3-baa1-e5b83d784799?source=api-prod","affected":[{"type":"plugin","slug":"tc-team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":false,"patched_in":"5.0.4"}],"published":"2020-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e51b9cd-0e96-40e3-944e-e562ac7ae0b3","source":"wordfence","cve":"CVE-2026-115243","title":"WPvivid \u2014 Backup, Migration & Staging 0.9.117 - 0.9.136 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e51b9cd-0e96-40e3-944e-e562ac7ae0b3?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"0.9.117","from_inclusive":true,"to":"0.9.136","to_inclusive":true,"patched_in":"0.9.137"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:35:27Z"},{"id":"wordfence:5e51f301-026d-4ed7-82f8-96c1623bf95c","source":"wordfence","cve":"CVE-2024-9939","title":"WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e51f301-026d-4ed7-82f8-96c1623bf95c?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.13","to_inclusive":true,"patched_in":"4.24.14"}],"published":"2025-01-07T00:00:00Z","updated":"2025-03-24T15:03:18Z"},{"id":"wordfence:5e528d16-4a5d-4ef9-baac-e235fa3b4be3","source":"wordfence","cve":"CVE-2025-8318","title":"Jobify <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e528d16-4a5d-4ef9-baac-e235fa3b4be3?source=api-prod","affected":[{"type":"plugin","slug":"jobify","name":"Jobify","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:46:27Z","updated":"2025-09-11T07:24:56Z"},{"id":"wordfence:5e54dbf9-a5d1-413d-96ac-93dd499c21a4","source":"wordfence","cve":"CVE-2024-2107","title":"Blossom Spa <= 1.3.3 - Sensitive Information Exposure","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e54dbf9-a5d1-413d-96ac-93dd499c21a4?source=api-prod","affected":[{"type":"theme","slug":"blossom-spa","name":"Blossom Spa","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-20T16:55:42Z"},{"id":"wordfence:5e57d859-cb71-47a7-9b5b-5a9360b8e2d1","source":"wordfence","cve":"CVE-2026-22409","title":"Justicia <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e57d859-cb71-47a7-9b5b-5a9360b8e2d1?source=api-prod","affected":[{"type":"theme","slug":"justicia","name":"Justicia - Lawyer WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:26:30Z"},{"id":"wordfence:5e584e2e-0625-4777-b44c-2d682c9a4c34","source":"wordfence","cve":"CVE-2022-0389","title":"WP Time Slots Booking Form <= 1.1.62 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e584e2e-0625-4777-b44c-2d682c9a4c34?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.1.62","to_inclusive":true,"patched_in":"1.1.63"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e5a29d8-f40e-4711-aaae-1aa01ebd11fe","source":"wordfence","cve":"CVE-2024-9428","title":"Popup Builder <= 4.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e5a29d8-f40e-4711-aaae-1aa01ebd11fe?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-12T16:53:48Z"},{"id":"wordfence:5e5a7c37-3a21-45e5-ba0e-23318116c811","source":"wordfence","cve":"CVE-2026-93510","title":"Points and Rewards for WooCommerce <= 2.10.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e5a7c37-3a21-45e5-ba0e-23318116c811?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T20:01:23Z"},{"id":"wordfence:5e5bdc92-e682-4121-9ba5-167742f61138","source":"wordfence","cve":"CVE-2023-2023","title":"Custom 404 Pro <= 3.7.2 - Reflected Cross-Site Scripting via 's'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e5bdc92-e682-4121-9ba5-167742f61138?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e600744-7f5a-483a-9df9-cf90b22b3a9e","source":"wordfence","cve":"CVE-2025-28883","title":"WP Compare Tables <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e600744-7f5a-483a-9df9-cf90b22b3a9e?source=api-prod","affected":[{"type":"plugin","slug":"wp-compare-tables","name":"WP Compare Tables","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:18:01Z"},{"id":"wordfence:5e604ad1-c06e-4ec6-9eba-332a3c0b1ed1","source":"wordfence","cve":"CVE-2025-39445","title":"Super Store Finder <= 7.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e604ad1-c06e-4ec6-9eba-332a3c0b1ed1?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:27:30Z"},{"id":"wordfence:5e618864-e862-4d4f-aa28-3e2fb78882fc","source":"wordfence","cve":"","title":"iPanorama 360 WordPress Virtual Tour Builder < 1.6.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e618864-e862-4d4f-aa28-3e2fb78882fc?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.6.22","to_inclusive":false,"patched_in":"1.6.22"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e6218e5-84d9-4180-8275-7da24c554c72","source":"wordfence","cve":"","title":"Unify <= 3.2.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6218e5-84d9-4180-8275-7da24c554c72?source=api-prod","affected":[{"type":"plugin","slug":"unify","name":"Unify","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2022-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e640767-7998-4404-a894-0b1794464c66","source":"wordfence","cve":"CVE-2025-0866","title":"Legoeso PDF Manager <= 1.2.2 - Authenticated (Author+) SQL Injection via checkedVals Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e640767-7998-4404-a894-0b1794464c66?source=api-prod","affected":[{"type":"plugin","slug":"legoeso-pdf-manager","name":"Legoeso PDF Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-19T21:08:48Z","updated":"2025-02-20T09:21:38Z"},{"id":"wordfence:5e65bafd-471a-498a-a6ac-1bc87d25de67","source":"wordfence","cve":"CVE-2024-32519","title":"GG Woo Feed for WooCommerce Shopping Feed <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e65bafd-471a-498a-a6ac-1bc87d25de67?source=api-prod","affected":[{"type":"plugin","slug":"gg-woo-feed","name":"GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T13:50:50Z"},{"id":"wordfence:5e6797a4-9b2d-44a2-bfe5-354e8885a47b","source":"wordfence","cve":"CVE-2025-52801","title":"TheBooking <= 1.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6797a4-9b2d-44a2-bfe5-354e8885a47b?source=api-prod","affected":[{"type":"plugin","slug":"thebooking","name":"WordPress Booking Plugin \u2013 TheBooking","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:25:58Z"},{"id":"wordfence:5e68356c-39f5-477c-87c7-65e751218a13","source":"wordfence","cve":"CVE-2026-66626","title":"SKT Addons for Elementor <= 4.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e68356c-39f5-477c-87c7-65e751218a13?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2026-09-17T09:03:00Z","updated":"2026-09-22T18:47:47Z"},{"id":"wordfence:5e69c365-65fd-4001-93c3-5df023e8e05b","source":"wordfence","cve":"CVE-2025-23590","title":"Dezdy <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e69c365-65fd-4001-93c3-5df023e8e05b?source=api-prod","affected":[{"type":"plugin","slug":"dezdy-mcommerce","name":"Dezdy","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:50:22Z"},{"id":"wordfence:5e6a7f09-2166-426e-a548-daafb23363a6","source":"wordfence","cve":"CVE-2023-5137","title":"Simply Excerpts <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6a7f09-2166-426e-a548-daafb23363a6?source=api-prod","affected":[{"type":"plugin","slug":"simply-excerpts","name":"Simply Excerpts","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e6bcaf4-c1ae-4bd7-a145-386b3fd756ed","source":"wordfence","cve":"CVE-2025-60183","title":"Silencesoft RSS Reader <= 0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6bcaf4-c1ae-4bd7-a145-386b3fd756ed?source=api-prod","affected":[{"type":"plugin","slug":"external-rss-reader","name":"Silencesoft RSS Reader","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:08:02Z"},{"id":"wordfence:5e6d0690-d437-4fc9-bac3-e36a8e286166","source":"wordfence","cve":"CVE-2026-108068","title":"FV Flowplayer Video Player 7.4.44.727 - 7.5.56.7211 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6d0690-d437-4fc9-bac3-e36a8e286166?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"7.4.44.727","from_inclusive":true,"to":"7.5.56.7211","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:36:29Z"},{"id":"wordfence:5e6de586-5621-4eb2-8150-cb42562d289f","source":"wordfence","cve":"CVE-2020-35935","title":"Advanced Access Manager <= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation","severity":"high","cvss":7.5,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6de586-5621-4eb2-8150-cb42562d289f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":true,"patched_in":"6.6.2"}],"published":"2020-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e6f4edf-c414-4a7c-a8d3-edee9f13d34b","source":"wordfence","cve":"CVE-2024-37508","title":"Construction Landing Page <= 1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e6f4edf-c414-4a7c-a8d3-edee9f13d34b?source=api-prod","affected":[{"type":"theme","slug":"construction-landing-page","name":"Construction Landing Page","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-07-04T00:00:00Z","updated":"2026-04-15T20:35:10Z"},{"id":"wordfence:5e701eb7-ed9e-464c-bcaa-635710736f7c","source":"wordfence","cve":"CVE-2024-52357","title":"LIQUID BLOCKS <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e701eb7-ed9e-464c-bcaa-635710736f7c?source=api-prod","affected":[{"type":"plugin","slug":"liquid-blocks","name":"LIQUID BLOCKS \u2013 Slider, Carousel, Accordion","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:35:56Z"},{"id":"wordfence:5e70d862-ac97-4827-896d-26be5872efde","source":"wordfence","cve":"CVE-2026-111041","title":"AI Engine <= 3.7.8 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e70d862-ac97-4827-896d-26be5872efde?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:41:08Z"},{"id":"wordfence:5e71bf15-aee0-4efc-a1c6-faad9f6e4f38","source":"wordfence","cve":"CVE-2025-14482","title":"Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e71bf15-aee0-4efc-a1c6-faad9f6e4f38?source=api-prod","affected":[{"type":"plugin","slug":"crush-pics","name":"Crush.pics Image Optimizer \u2013 Image Compression and Optimization","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:49:40Z","updated":"2026-01-14T05:28:09Z"},{"id":"wordfence:5e722b30-f136-4f57-a248-cf9cdd499552","source":"wordfence","cve":"CVE-2024-30487","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e722b30-f136-4f57-a248-cf9cdd499552?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:51:20Z"},{"id":"wordfence:5e74c5d4-c2f6-4877-8863-afda5b22868e","source":"wordfence","cve":"CVE-2026-91073","title":"Subscribe Forms 1.4.1 - 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e74c5d4-c2f6-4877-8863-afda5b22868e?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscribe-form","name":"Subscribe Forms \u2013 Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form","from":"1.4.1","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:44:12Z"},{"id":"wordfence:5e74ee0d-f03d-4139-a192-2a45d5f619dc","source":"wordfence","cve":"CVE-2023-34011","title":"ShopConstruct \u2013 Product Catalog, Shopping Cart and eCommerce solution for Store <= 1.1.2 - Reflected Cross-Site Scripting via multiple parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e74ee0d-f03d-4139-a192-2a45d5f619dc?source=api-prod","affected":[{"type":"plugin","slug":"shopconstruct","name":"ShopConstruct \u2013 Product Catalog, Shopping Cart and eCommerce solution for Store","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e75e877-14e6-4e51-b435-d78f8ab95d12","source":"wordfence","cve":"CVE-2018-0587","title":"Ultimate Member <= 2.0.3 - Unauthorized Image File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e75e877-14e6-4e51-b435-d78f8ab95d12?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e78ec78-61e0-4c99-9e73-89fc6606fb97","source":"wordfence","cve":"CVE-2015-9380","title":"Photo Gallery by 10Web <= 1.2.41 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e78ec78-61e0-4c99-9e73-89fc6606fb97?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.42","to_inclusive":false,"patched_in":"1.2.42"}],"published":"2014-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e79b62b-1d60-4c4c-bd0b-4207b20fa3cd","source":"wordfence","cve":"CVE-2023-4022","title":"Herd Effects <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e79b62b-1d60-4c4c-bd0b-4207b20fa3cd?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":false,"patched_in":"5.2.3"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e79bdfe-5b91-4459-9e0f-f25859e4d0ce","source":"wordfence","cve":"CVE-2024-35761","title":"vCita Online Booking & Scheduling Calendar <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e79bdfe-5b91-4459-9e0f-f25859e4d0ce?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2024-07-17T00:00:00Z","updated":"2024-07-02T12:50:03Z"},{"id":"wordfence:5e7b29aa-9dff-420b-8f3e-2beca0b19593","source":"wordfence","cve":"CVE-2021-24416","title":"StreamCast \u2013 Radio Player for WordPress <= 2.1.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e7b29aa-9dff-420b-8f3e-2beca0b19593?source=api-prod","affected":[{"type":"plugin","slug":"streamcast","name":"StreamCast \u2013 bring live radio to your site with a sleek player","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e7b5a09-212c-4006-84a7-d87671da6ebc","source":"wordfence","cve":"CVE-2025-60192","title":"Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e7b5a09-212c-4006-84a7-d87671da6ebc?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wholesale-pricing","name":"Premmerce Wholesale Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-07-28T00:00:00Z","updated":"2026-02-25T13:00:30Z"},{"id":"wordfence:5e7ccf1e-2da7-463f-a3a6-0e0f07c8f22b","source":"wordfence","cve":"CVE-2026-39529","title":"Elementra - 100% Elementor WordPress Theme <= 1.0.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e7ccf1e-2da7-463f-a3a6-0e0f07c8f22b?source=api-prod","affected":[{"type":"theme","slug":"elementra","name":"Elementra - 100% Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:48:11Z"},{"id":"wordfence:5e7cde2e-28e6-417a-900a-38d0a77800d3","source":"wordfence","cve":"CVE-2019-16522","title":"EU Cookie Law <= 3.1.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e7cde2e-28e6-417a-900a-38d0a77800d3?source=api-prod","affected":[{"type":"plugin","slug":"eu-cookie-law","name":"EU Cookie Law for GDPR/CCPA","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e7fa38f-26ef-4011-af18-c18883159425","source":"wordfence","cve":"CVE-2025-12096","title":"Simple Excel Pricelist for WooCommerce <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e7fa38f-26ef-4011-af18-c18883159425?source=api-prod","affected":[{"type":"plugin","slug":"simple-excel-pricelist-for-woocommerce","name":"Simple Excel Pricelist for WooCommerce","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T19:42:19Z","updated":"2025-10-24T08:23:59Z"},{"id":"wordfence:5e822372-4f38-4b2a-b1d6-5a095ecb716f","source":"wordfence","cve":"CVE-2025-49864","title":"AFS Analytics <= 4.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e822372-4f38-4b2a-b1d6-5a095ecb716f?source=api-prod","affected":[{"type":"plugin","slug":"addfreestats","name":"AFS Analytics","from":"*","from_inclusive":true,"to":"4.21","to_inclusive":true,"patched_in":"4.22"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:45:20Z"},{"id":"wordfence:5e8311ea-5f38-4c15-be79-f1e913ac3d6e","source":"wordfence","cve":"CVE-2025-32547","title":"All push notification for WP <= 1.5.3 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8311ea-5f38-4c15-be79-f1e913ac3d6e?source=api-prod","affected":[{"type":"plugin","slug":"all-push-notification","name":"All push notification for WP","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:18:25Z"},{"id":"wordfence:5e83b0ff-3628-47d7-92d0-429af92067bd","source":"wordfence","cve":"CVE-2026-57691","title":"Anti-Malware Security and Brute-Force Firewall <= 4.23.89 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e83b0ff-3628-47d7-92d0-429af92067bd?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.23.89","to_inclusive":true,"patched_in":"4.23.90"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:21:09Z"},{"id":"wordfence:5e87a9ac-e7c6-4622-b3e5-6e17e7664317","source":"wordfence","cve":"CVE-2026-12956","title":"Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"4.1.23"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-09T02:27:36Z"},{"id":"wordfence:5e8933b8-1e09-4cd7-8206-711cc0716dba","source":"wordfence","cve":"CVE-2023-3345","title":"Masteriyo - LMS for WordPress <= 1.6.7 - Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8933b8-1e09-4cd7-8206-711cc0716dba?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":false,"patched_in":"1.6.8"}],"published":"2023-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e8a16ea-2a0e-43be-8ca3-066bcb457866","source":"wordfence","cve":"CVE-2026-87069","title":"Forminator Forms <= 1.57.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8a16ea-2a0e-43be-8ca3-066bcb457866?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:54:18Z"},{"id":"wordfence:5e8a182e-036d-4be0-a5c3-fb29009fc17b","source":"wordfence","cve":"CVE-2026-74005","title":"Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8a182e-036d-4be0-a5c3-fb29009fc17b?source=api-prod","affected":[{"type":"plugin","slug":"organize-series","name":"Issues and Series for Newspapers, Magazines, Publishers, Writers","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-09-16T18:13:00Z","updated":"2026-09-22T18:49:12Z"},{"id":"wordfence:5e8a8e0e-6dc0-4d9f-aee3-1fd940c49d3d","source":"wordfence","cve":"CVE-2023-46199","title":"Triberr <= 4.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8a8e0e-6dc0-4d9f-aee3-1fd940c49d3d?source=api-prod","affected":[{"type":"plugin","slug":"triberr-wordpress-plugin","name":"Triberr","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2023-10-18T00:00:00Z","updated":"2024-03-22T15:29:35Z"},{"id":"wordfence:5e8b7b1d-66de-4707-9db1-b9aa87e88f98","source":"wordfence","cve":"CVE-2026-92579","title":"AVideo <= 29.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8b7b1d-66de-4707-9db1-b9aa87e88f98?source=api-prod","affected":[{"type":"plugin","slug":"avideo","name":"aVideo","from":"*","from_inclusive":true,"to":"29.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:15:14Z"},{"id":"wordfence:5e8c06c7-dbe0-4b2b-99bc-89f18277e540","source":"wordfence","cve":"CVE-2018-20968","title":"Export WordPress Data with Advanced Filters <= 1.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8c06c7-dbe0-4b2b-99bc-89f18277e540?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2018-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e8e2cbf-0cb6-42d1-b653-d6f70eba1357","source":"wordfence","cve":"CVE-2026-57796","title":"Leedo <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8e2cbf-0cb6-42d1-b653-d6f70eba1357?source=api-prod","affected":[{"type":"theme","slug":"leedo","name":"Leedo \u2013 Modern, Colorful & Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:54:15Z"},{"id":"wordfence:5e8e7199-f5f1-4036-b2cd-88b7e806873d","source":"wordfence","cve":"CVE-2024-34811","title":"WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8e7199-f5f1-4036-b2cd-88b7e806873d?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-15T20:24:24Z"},{"id":"wordfence:5e90704e-1a0c-448c-9139-542927cfa4f8","source":"wordfence","cve":"CVE-2008-1059","title":"Sniplets < 1.2.3 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e90704e-1a0c-448c-9139-542927cfa4f8?source=api-prod","affected":[{"type":"plugin","slug":"sniplets","name":"Sniplets","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2008-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e911b0a-a236-4df3-b997-3631412a1b55","source":"wordfence","cve":"CVE-2026-2365","title":"Fluent Forms Pro <= 6.1.17 - Unauthenticated Stored Cross-Site Scripting via Draft Form Submission","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e911b0a-a236-4df3-b997-3631412a1b55?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.1.17","to_inclusive":true,"patched_in":"6.1.18"}],"published":"2026-03-04T14:28:36Z","updated":"2026-03-05T03:23:40Z"},{"id":"wordfence:5e91a6bd-05ae-4088-8c1f-bc5598545606","source":"wordfence","cve":"CVE-2023-23812","title":"Enhanced WP Contact Form <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e91a6bd-05ae-4088-8c1f-bc5598545606?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-wordpress-contactform","name":"Enhanced WP Contact Form","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e91f4af-7ac6-4c85-bbf4-ac06d516a570","source":"wordfence","cve":"CVE-2022-0220","title":"WordPress GDPR & CCPA <= 1.9.26 Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e91f4af-7ac6-4c85-bbf4-ac06d516a570?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gdpr","name":"WordPress GDPR","from":"*","from_inclusive":true,"to":"1.9.27","to_inclusive":false,"patched_in":"1.9.27"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e934524-0294-4c43-a14d-817ef7d5bec6","source":"wordfence","cve":"CVE-2025-64210","title":"Masterstudy Elementor Widgets <= 1.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e934524-0294-4c43-a14d-817ef7d5bec6?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-elementor-widgets","name":"Masterstudy Elementor Widgets","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-10-12T00:00:00Z","updated":"2025-11-04T15:41:45Z"},{"id":"wordfence:5e959ac0-e5ac-4d28-8161-311d952b993c","source":"wordfence","cve":"CVE-2022-3933","title":"Essential Real Estate <= 3.9.5 - Reflected Cross-Site-Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e959ac0-e5ac-4d28-8161-311d952b993c?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e95ded5-ebf7-4ed3-a194-7e7e494d0c40","source":"wordfence","cve":"CVE-2017-18598","title":"Qards (Unspecified Version) - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e95ded5-ebf7-4ed3-a194-7e7e494d0c40?source=api-prod","affected":[{"type":"plugin","slug":"qards","name":"Quards","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e96740c-a890-4c38-9d50-e82843490f69","source":"wordfence","cve":"CVE-2026-84146","title":"Xpro Addons \u2014 140+ Widgets for Elementor < 1.7.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e96740c-a890-4c38-9d50-e82843490f69?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":false,"patched_in":"1.7.8"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:01:05Z"},{"id":"wordfence:5e9733d3-4097-4785-947c-db90a38795b3","source":"wordfence","cve":"CVE-2026-107768","title":"TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9733d3-4097-4785-947c-db90a38795b3?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2026-10-15T17:58:28Z","updated":"2026-10-16T06:41:04Z"},{"id":"wordfence:5e999e0f-463c-4676-ad18-f4b467bc4bfc","source":"wordfence","cve":"CVE-2019-13569","title":"Email Subscribers & Newsletters <= 4.1.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e999e0f-463c-4676-ad18-f4b467bc4bfc?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2019-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e9a8c60-f781-428b-8847-88b671010daf","source":"wordfence","cve":"CVE-2025-67555","title":"UseStrict's Calendly Embedder <= 1.1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9a8c60-f781-428b-8847-88b671010daf?source=api-prod","affected":[{"type":"plugin","slug":"cal-embedder-lite","name":"UseStrict\u2019s Calendly Embedder","from":"*","from_inclusive":true,"to":"1.1.7.2","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:01:12Z"},{"id":"wordfence:5e9ba1cb-62f5-4d6a-9727-ae62bb0edb98","source":"wordfence","cve":"CVE-2021-36885","title":"Contact Form 7 Database Addon \u2013 CFDB7 <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9ba1cb-62f5-4d6a-9727-ae62bb0edb98?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.6.1","to_inclusive":true,"patched_in":"1.2.6.2"}],"published":"2021-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5e9c90ff-f052-49e1-8b28-222539a39065","source":"wordfence","cve":"CVE-2026-81813","title":"Elementor <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9c90ff-f052-49e1-8b28-222539a39065?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:58:02Z"},{"id":"wordfence:5e9d5c93-dcd7-450e-8c52-5c95fc5473d2","source":"wordfence","cve":"CVE-2024-10586","title":"Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9d5c93-dcd7-450e-8c52-5c95fc5473d2?source=api-prod","affected":[{"type":"plugin","slug":"debug-tool","name":"Debug Tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T14:06:42Z","updated":"2024-11-21T14:29:12Z"},{"id":"wordfence:5ea02dd5-d837-471c-aa6a-264ffcedd55d","source":"wordfence","cve":"","title":"GiveWP <= 2.25.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea02dd5-d837-471c-aa6a-264ffcedd55d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.2","to_inclusive":true,"patched_in":"2.25.3"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ea26b4c-598b-486e-a19b-0bb83774239d","source":"wordfence","cve":"CVE-2026-12492","title":"Happy Coders OTP Login for WooCommerce <= 2.7 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea26b4c-598b-486e-a19b-0bb83774239d?source=api-prod","affected":[{"type":"plugin","slug":"happy-coders-otp-login","name":"Happy Coders OTP Login for WooCommerce","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T12:47:46Z"},{"id":"wordfence:5ea53fb7-9bf8-445b-ad33-f3b6e6ed1665","source":"wordfence","cve":"CVE-2022-3494","title":"Complianz Free <= 6.3.3 & Premium <= 6.3.5  - SQL Injection via Translations","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea53fb7-9bf8-445b-ad33-f3b6e6ed1665?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr-premium","name":"Complianz Premium \u2013 GDPR/CCPA Cookie Consent","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"},{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.3.3","to_inclusive":true,"patched_in":"6.3.4"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ea93a49-0e1a-4a24-8f6b-03e624f517d4","source":"wordfence","cve":"CVE-2024-10374","title":"WP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea93a49-0e1a-4a24-8f6b-03e624f517d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.9.5","to_inclusive":true,"patched_in":"3.4.9.6"}],"published":"2024-10-24T23:18:08Z","updated":"2025-07-11T16:22:44Z"},{"id":"wordfence:5ea976ab-ecb5-4a7b-a784-afb39b895ab8","source":"wordfence","cve":"CVE-2026-22363","title":"Rhodos <= 1.3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea976ab-ecb5-4a7b-a784-afb39b895ab8?source=api-prod","affected":[{"type":"theme","slug":"rhodos","name":"Rhodos - Business Portfolio Elementor Blocks & Template Kit","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:32:04Z"},{"id":"wordfence:5eaac50c-c585-4587-91b7-9d0613345ef2","source":"wordfence","cve":"CVE-2022-1251","title":"Ask Me <= 6.8.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eaac50c-c585-4587-91b7-9d0613345ef2?source=api-prod","affected":[{"type":"theme","slug":"ask-me","name":"Ask Me - Responsive Questions & Answers WordPress","from":"*","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eab077f-0aeb-4dec-9ed2-8a09c4450d06","source":"wordfence","cve":"CVE-2025-23533","title":"WP Lyrics <= 0.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab077f-0aeb-4dec-9ed2-8a09c4450d06?source=api-prod","affected":[{"type":"plugin","slug":"wplyrics","name":"WP Lyrics","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:00:05Z"},{"id":"wordfence:5eab79e6-cb47-4fe7-993a-e833bd6689f8","source":"wordfence","cve":"CVE-2026-17585","title":"Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab79e6-cb47-4fe7-993a-e833bd6689f8?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":true,"patched_in":"1.7.1067"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-12T07:39:14Z"},{"id":"wordfence:5eab8a5d-8eb8-495f-a953-b468360cc5d5","source":"wordfence","cve":"","title":"Advanced Custom Fields <= 5.7.11 - PHP Object Injection","severity":"medium","cvss":5.4,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab8a5d-8eb8-495f-a953-b468360cc5d5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.7.11","to_inclusive":true,"patched_in":"5.7.12"}],"published":"2019-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eacd62e-844e-44a8-a197-fcaab9fb8ffa","source":"wordfence","cve":"CVE-2026-121781","title":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eacd62e-844e-44a8-a197-fcaab9fb8ffa?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-11-07T08:56:00Z","updated":"2026-11-10T19:49:34Z"},{"id":"wordfence:5eafb620-f5dd-4e60-b9a6-859832ae706c","source":"wordfence","cve":"CVE-2022-41685","title":"Integration for Szamlazz.hu & WooCommerce <= 5.6.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eafb620-f5dd-4e60-b9a6-859832ae706c?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-szamlazzhu-woocommerce","name":"Integration for Szamlazz.hu and WooCommerce","from":"*","from_inclusive":true,"to":"5.6.3.2","to_inclusive":true,"patched_in":"5.6.3.3"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eb21153-4c7f-4acc-b1da-6c0a61871db5","source":"wordfence","cve":"CVE-2024-13726","title":"Themes Coder <= 1.3.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eb21153-4c7f-4acc-b1da-6c0a61871db5?source=api-prod","affected":[{"type":"plugin","slug":"tc-ecommerce","name":"TC Ecommerce \u2013 Create Android & iOS Apps for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-01-27T00:00:00Z","updated":"2025-06-27T19:51:35Z"},{"id":"wordfence:5eb4f996-b74c-495e-958e-7c6fb4eba62e","source":"wordfence","cve":"CVE-2025-23939","title":"Image Switcher <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eb4f996-b74c-495e-958e-7c6fb4eba62e?source=api-prod","affected":[{"type":"plugin","slug":"image-switcher","name":"Image Switcher","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:50:43Z"},{"id":"wordfence:5eb66ca3-768e-4d8c-a0fa-74e78250aee3","source":"wordfence","cve":"CVE-2024-2198","title":"Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eb66ca3-768e-4d8c-a0fa-74e78250aee3?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:50Z"},{"id":"wordfence:5eb85bc1-cffd-4363-ba53-30e3f6f6fc56","source":"wordfence","cve":"CVE-2021-24836","title":"Temporary Login Without Password <= 1.7.0 - Subscriber+ Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eb85bc1-cffd-4363-ba53-30e3f6f6fc56?source=api-prod","affected":[{"type":"plugin","slug":"temporary-login-without-password","name":"Temporary Login Without Password","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eba6825-9a3a-4af5-8d8a-9439ab374cc7","source":"wordfence","cve":"CVE-2021-24875","title":"eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eba6825-9a3a-4af5-8d8a-9439ab374cc7?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.39","to_inclusive":false,"patched_in":"3.0.39"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ebda2ba-c24f-4f40-8f67-341dacaf907a","source":"wordfence","cve":"CVE-2026-32419","title":"List category posts <= 0.93.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebda2ba-c24f-4f40-8f67-341dacaf907a?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.93.1","to_inclusive":true,"patched_in":"0.94.0"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-15T21:01:19Z"},{"id":"wordfence:5ebdf903-828e-4a22-953a-17d85984b576","source":"wordfence","cve":"","title":"AutomatorWP <= 2.5.8 - Cross Site Request Forgery via bulk_delete","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebdf903-828e-4a22-953a-17d85984b576?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ebe34fd-6860-4074-ae86-37f979f54dc9","source":"wordfence","cve":"CVE-2022-2398","title":"WordPress Comments Fields <= 4.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebe34fd-6860-4074-ae86-37f979f54dc9?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-fields","name":"Comments Extra Fields For Post,Pages and CPT","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2022-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ebe8caf-6963-4ed0-8552-62513bb0e947","source":"wordfence","cve":"CVE-2025-67572","title":"PenNews < 6.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebe8caf-6963-4ed0-8552-62513bb0e947?source=api-prod","affected":[{"type":"theme","slug":"pennews","name":"PenNews - Multi-Purpose AMP WordPress Theme","from":"*","from_inclusive":true,"to":"6.7.4","to_inclusive":false,"patched_in":"6.7.4"}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T17:20:31Z"},{"id":"wordfence:5ebf1e83-50b8-4f56-ba76-10100375edda","source":"wordfence","cve":"CVE-2023-2584","title":"PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ebf1e83-50b8-4f56-ba76-10100375edda?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"9.6.1","to_inclusive":true,"patched_in":"9.6.2"},{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"9.3.6","to_inclusive":true,"patched_in":"9.3.7"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ec1ce79-bc10-4b04-8e49-15e16e6730a8","source":"wordfence","cve":"CVE-2022-0250","title":"Redirection for Contact Form 7 <= 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec1ce79-bc10-4b04-8e49-15e16e6730a8?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ec1fd03-f865-4f58-b63b-e70c0c7e701d","source":"wordfence","cve":"CVE-2023-6637","title":"CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec1fd03-f865-4f58-b63b-e70c0c7e701d?source=api-prod","affected":[{"type":"plugin","slug":"host-analyticsjs-local","name":"CAOS | Host Google Analytics Locally","from":"*","from_inclusive":true,"to":"4.7.14","to_inclusive":true,"patched_in":"4.7.15"}],"published":"2023-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ec2111a-0f23-48ed-a7a3-54a33e3f4bd9","source":"wordfence","cve":"CVE-2025-63026","title":"Grand Restaurant Theme Elements for Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec2111a-0f23-48ed-a7a3-54a33e3f4bd9?source=api-prod","affected":[{"type":"plugin","slug":"grandrestaurant-elementor","name":"Grand Restaurant Theme Elements for Elementor","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-18T00:00:00Z","updated":"2026-02-03T20:40:45Z"},{"id":"wordfence:5ec23f29-baa3-4bfc-a7b7-d664a81637c1","source":"wordfence","cve":"CVE-2026-73349","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec23f29-baa3-4bfc-a7b7-d664a81637c1?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.6","to_inclusive":false,"patched_in":"4.16.6"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-13T19:00:59Z"},{"id":"wordfence:5ec2743d-0d96-4056-8fdf-dc81d4e9b76f","source":"wordfence","cve":"CVE-2024-2476","title":"OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec2743d-0d96-4056-8fdf-dc81d4e9b76f?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:44:00Z"},{"id":"wordfence:5ec401d8-bbdf-4be6-bcc5-51f8c8ec7cfd","source":"wordfence","cve":"CVE-2023-5229","title":"e2pdf < 1.20.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec401d8-bbdf-4be6-bcc5-51f8c8ec7cfd?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.20","to_inclusive":false,"patched_in":"1.20.20"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ec6211b-783b-4375-972b-adcaf9f9f526","source":"wordfence","cve":"","title":"Easy Author Image <= 1.5 - Email Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec6211b-783b-4375-972b-adcaf9f9f526?source=api-prod","affected":[{"type":"plugin","slug":"easy-author-image","name":"Easy Author Image","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2015-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ecc0811-916d-4c60-9047-a09242de36bd","source":"wordfence","cve":"CVE-2016-10947","title":"Post Indexer <= 3.0.6.1 - Authenticated (Super Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ecc0811-916d-4c60-9047-a09242de36bd?source=api-prod","affected":[{"type":"plugin","slug":"post-indexer","name":"Post Indexer","from":"*","from_inclusive":true,"to":"3.0.6.2","to_inclusive":false,"patched_in":"3.0.6.2"}],"published":"2016-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eccad40-263b-42de-933f-b10f2322668c","source":"wordfence","cve":"CVE-2026-39577","title":"Playroom <= 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eccad40-263b-42de-933f-b10f2322668c?source=api-prod","affected":[{"type":"theme","slug":"playroom","name":"Playroom - Kids & Kindergarten WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:59:42Z"},{"id":"wordfence:5ed1978e-1dd7-45d3-829a-1a75c1789827","source":"wordfence","cve":"CVE-2024-12036","title":"CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed1978e-1dd7-45d3-829a-1a75c1789827?source=api-prod","affected":[{"type":"plugin","slug":"cs-framework","name":"CS Framework","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:25Z"},{"id":"wordfence:5ed6956b-47ef-4f03-9559-960268bdcaca","source":"wordfence","cve":"CVE-2026-89002","title":"WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed6956b-47ef-4f03-9559-960268bdcaca?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.25","to_inclusive":true,"patched_in":"2.8.26"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:56:39Z"},{"id":"wordfence:5ed89df4-c536-462d-a24c-29c9db9a13c5","source":"wordfence","cve":"CVE-2026-74923","title":"Document Gallery <= 5.1.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed89df4-c536-462d-a24c-29c9db9a13c5?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-06T15:19:57Z"},{"id":"wordfence:5ed9f7a1-54ef-4f88-b89c-756b8b646254","source":"wordfence","cve":"CVE-2025-12589","title":"WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=api-prod","affected":[{"type":"plugin","slug":"wp-walla","name":"WP-Walla","from":"*","from_inclusive":true,"to":"0.5.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:07:10Z","updated":"2025-11-11T03:30:40Z"},{"id":"wordfence:5edaf310-c410-47dd-89cf-9aa15ab97acd","source":"wordfence","cve":"","title":"Gerencianet Oficial <= 1.4.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5edaf310-c410-47dd-89cf-9aa15ab97acd?source=api-prod","affected":[{"type":"plugin","slug":"woo-gerencianet-official","name":"Ef\u00ed Bank","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5edd72d9-3086-4f4f-ae5b-830c8621b83a","source":"wordfence","cve":"CVE-2024-5543","title":"Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5edd72d9-3086-4f4f-ae5b-830c8621b83a?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-06-11T12:10:36Z","updated":"2024-06-12T01:55:24Z"},{"id":"wordfence:5edd7fba-77d1-4a13-ad31-0135ec83c2a1","source":"wordfence","cve":"CVE-2025-25116","title":"Link to URL / Post <= 1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5edd7fba-77d1-4a13-ad31-0135ec83c2a1?source=api-prod","affected":[{"type":"plugin","slug":"link-to-url-post","name":"Link to URL / Post","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T19:00:35Z"},{"id":"wordfence:5ee0dd57-6256-4a56-907e-89336f052b6d","source":"wordfence","cve":"CVE-2026-10093","title":"File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee0dd57-6256-4a56-907e-89336f052b6d?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-06-15T18:58:43Z","updated":"2026-06-16T07:46:37Z"},{"id":"wordfence:5ee19031-1e48-43b6-b492-980f2610f6cc","source":"wordfence","cve":"","title":"ProductX \u2013 Gutenberg WooCommerce Blocks \u2013 WooCommerce Builder, Wishlist for WooCommerce, Products Comparison, Quick View, Online Store \u2013 All in One Solution <= 2.2.5 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee19031-1e48-43b6-b492-980f2610f6cc?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2022-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ee1bc43-1d9f-4bf7-b5cb-848c6d53938e","source":"wordfence","cve":"CVE-2025-32682","title":"MapSVG Lite <= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee1bc43-1d9f-4bf7-b5cb-848c6d53938e?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":"8.6.5"}],"published":"2025-04-15T00:00:00Z","updated":"2025-06-12T18:27:28Z"},{"id":"wordfence:5ee28fac-d969-4890-ae78-15587e986413","source":"wordfence","cve":"CVE-2026-62037","title":"Document Embedder \u2013 let visitors read files without downloading <= 2.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee28fac-d969-4890-ae78-15587e986413?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-10-09T12:53:36Z","updated":"2026-11-10T23:21:22Z"},{"id":"wordfence:5ee333a6-6b4b-4abb-9fc9-1afd9598b321","source":"wordfence","cve":"CVE-2019-14327","title":"Custom Simple RSS < 2.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee333a6-6b4b-4abb-9fc9-1afd9598b321?source=api-prod","affected":[{"type":"plugin","slug":"custom-simple-rss","name":"Custom Simple Rss","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ee3416b-d6df-4f8b-834b-4e78516c00ba","source":"wordfence","cve":"CVE-2023-35775","title":"WP Backup Manager <= 1.13.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee3416b-d6df-4f8b-834b-4e78516c00ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-backup-manager","name":"WP Backup Manager","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ee5e650-5a52-4921-92c3-3ea1a43fc238","source":"wordfence","cve":"CVE-2025-31101","title":"VaultRE Contact Form 7 <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee5e650-5a52-4921-92c3-3ea1a43fc238?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-contact-form-7","name":"VaultRE Contact Form 7","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:58:32Z"},{"id":"wordfence:5ee7b4d8-c397-41f6-981f-9a010e4ab2f1","source":"wordfence","cve":"CVE-2024-12120","title":"Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee7b4d8-c397-41f6-981f-9a010e4ab2f1?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1017","to_inclusive":true,"patched_in":"1.7.1018"}],"published":"2025-05-06T00:00:00Z","updated":"2025-05-07T07:22:11Z"},{"id":"wordfence:5ee7f904-d150-4da1-a79c-502fe2ca3b37","source":"wordfence","cve":"CVE-2020-24149","title":"Podcast Importer SecondLine <= 1.1.4 - Server-Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee7f904-d150-4da1-a79c-502fe2ca3b37?source=api-prod","affected":[{"type":"plugin","slug":"podcast-importer-secondline","name":"Podcast Importer SecondLine","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ee9183c-be0c-4b1f-9cf5-25866c16ef40","source":"wordfence","cve":"CVE-2025-68876","title":"Invelity SPS connect <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ee9183c-be0c-4b1f-9cf5-25866c16ef40?source=api-prod","affected":[{"type":"plugin","slug":"invelity-sps-connect","name":"Invelity SPS connect","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T18:59:46Z"},{"id":"wordfence:5eeae0eb-bc24-4a34-b393-e84831edaba6","source":"wordfence","cve":"CVE-2023-30494","title":"ImageRecycle pdf & image compression <= 3.1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeae0eb-bc24-4a34-b393-e84831edaba6?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":false,"patched_in":"3.1.11"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5eeafbf1-b4b8-4d1d-9932-7a6d23f1cc6f","source":"wordfence","cve":"CVE-2026-112844","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeafbf1-b4b8-4d1d-9932-7a6d23f1cc6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"4.1.27"}],"published":"2026-10-22T07:09:36Z","updated":"2026-10-28T01:17:00Z"},{"id":"wordfence:5eeb40a0-7b18-4676-af71-ed0bf9b21e4f","source":"wordfence","cve":"CVE-2026-39722","title":"WPLMS Learning Management System for WordPress, WordPress LMS <= 4.972 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeb40a0-7b18-4676-af71-ed0bf9b21e4f?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"4.972","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:54:53Z"},{"id":"wordfence:5eed65c6-f06e-49ee-a87c-5dcc442cb21f","source":"wordfence","cve":"CVE-2025-60168","title":"HotelRunner Booking Widget <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eed65c6-f06e-49ee-a87c-5dcc442cb21f?source=api-prod","affected":[{"type":"plugin","slug":"hotelrunner","name":"HotelRunner Booking Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-09-26T00:00:00Z","updated":"2026-07-08T20:44:55Z"},{"id":"wordfence:5eedbf96-e05e-4f33-8f5d-682033f7a90d","source":"wordfence","cve":"CVE-2026-114693","title":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eedbf96-e05e-4f33-8f5d-682033f7a90d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-22T07:44:44Z","updated":"2026-10-28T01:20:07Z"},{"id":"wordfence:5eee90ab-8a54-43da-afff-72ab0e687f45","source":"wordfence","cve":"CVE-2026-114175","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eee90ab-8a54-43da-afff-72ab0e687f45?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T16:37:39Z"},{"id":"wordfence:5eeebd5f-6062-4ddd-a7bf-6afbeeed568e","source":"wordfence","cve":"CVE-2024-47326","title":"Share This Image <= 2.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeebd5f-6062-4ddd-a7bf-6afbeeed568e?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.02"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:16:17Z"},{"id":"wordfence:5eeff1c0-2c64-4229-b68a-6865fccf92a2","source":"wordfence","cve":"CVE-2025-30553","title":"GMO Font Agent <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5eeff1c0-2c64-4229-b68a-6865fccf92a2?source=api-prod","affected":[{"type":"plugin","slug":"gmo-font-agent","name":"Plugin Name: GMO Font Agent","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:54:45Z"},{"id":"wordfence:5ef104ae-b67c-4669-adeb-e5397561c0ae","source":"wordfence","cve":"CVE-2023-45747","title":"WP Lightbox 2 <= 3.0.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef104ae-b67c-4669-adeb-e5397561c0ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-lightbox-2","name":"WP Lightbox 2","from":"*","from_inclusive":true,"to":"3.0.6.5","to_inclusive":true,"patched_in":"3.0.6.6"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-11T08:55:05Z"},{"id":"wordfence:5ef2196d-3617-44ba-a8c5-dc1b45408293","source":"wordfence","cve":"CVE-2024-29117","title":"Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef2196d-3617-44ba-a8c5-dc1b45408293?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:17:54Z"},{"id":"wordfence:5ef65205-6477-482c-8f7c-380709744691","source":"wordfence","cve":"CVE-2026-14870","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef65205-6477-482c-8f7c-380709744691?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T23:18:45Z"},{"id":"wordfence:5ef842ad-3d23-4206-af3b-b3f55486766f","source":"wordfence","cve":"CVE-2026-3572","title":"iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef842ad-3d23-4206-af3b-b3f55486766f?source=api-prod","affected":[{"type":"plugin","slug":"itracker360","name":"iTracker360","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-20T23:25:12Z"},{"id":"wordfence:5efb2fbe-d839-4fb1-80bb-91adf0d39a2b","source":"wordfence","cve":"CVE-2024-11812","title":"Wtyczka SeoPilot dla WP <= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5efb2fbe-d839-4fb1-80bb-91adf0d39a2b?source=api-prod","affected":[{"type":"plugin","slug":"wtyczka-seopilot-dla-wp","name":"Wtyczka SeoPilot dla WP","from":"*","from_inclusive":true,"to":"3.3.091","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:02:57Z","updated":"2024-12-20T06:59:06Z"},{"id":"wordfence:5efbac99-561c-4abf-9e07-b5fdcfeb188b","source":"wordfence","cve":"CVE-2024-34439","title":"DS Site Message <= 1.14.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5efbac99-561c-4abf-9e07-b5fdcfeb188b?source=api-prod","affected":[{"type":"plugin","slug":"ds-site-message","name":"DS Site Message","from":"*","from_inclusive":true,"to":"1.14.4","to_inclusive":true,"patched_in":"1.14.5"}],"published":"2024-05-07T00:00:00Z","updated":"2025-02-25T14:56:45Z"},{"id":"wordfence:5efd3125-8ba7-4d36-9e6c-cac101de7d5b","source":"wordfence","cve":"CVE-2024-54357","title":"Avada <= 7.11.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5efd3125-8ba7-4d36-9e6c-cac101de7d5b?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.10","to_inclusive":true,"patched_in":"7.11.11"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:29:19Z"},{"id":"wordfence:5efe6f9b-6b92-44a7-8728-fa91d2341136","source":"wordfence","cve":"CVE-2026-17014","title":"Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5efe6f9b-6b92-44a7-8728-fa91d2341136?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.07.1","to_inclusive":true,"patched_in":"9.2.07.002"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:45:56Z"},{"id":"wordfence:5f0406ad-8f4e-49a2-87dd-a6e319904652","source":"wordfence","cve":"CVE-2024-53808","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.7.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f0406ad-8f4e-49a2-87dd-a6e319904652?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.7.8","to_inclusive":true,"patched_in":"8.7.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:39:32Z"},{"id":"wordfence:5f06140d-c28f-4dfb-be61-cc8f59884766","source":"wordfence","cve":"CVE-2026-93430","title":"GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f06140d-c28f-4dfb-be61-cc8f59884766?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-03T05:29:15Z"},{"id":"wordfence:5f07558d-6e40-4afb-82a1-c9482534d6dd","source":"wordfence","cve":"CVE-2026-13399","title":"Payment Plugins for PayPal WooCommerce <= 2.0.19 - Uanuthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f07558d-6e40-4afb-82a1-c9482534d6dd?source=api-prod","affected":[{"type":"plugin","slug":"pymntpl-paypal-woocommerce","name":"Payment Plugins for PayPal WooCommerce","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-07-06T00:00:00Z","updated":"2026-08-17T16:03:00Z"},{"id":"wordfence:5f0795f7-6eba-4ff0-b0da-5d2b544adf14","source":"wordfence","cve":"CVE-2024-13889","title":"WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f0795f7-6eba-4ff0-b0da-5d2b544adf14?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-importer","name":"WordPress Importer","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":"0.8.4"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T11:22:10Z"},{"id":"wordfence:5f094fff-04eb-4ea9-b847-4e2e589a96e1","source":"wordfence","cve":"CVE-2025-64364","title":"Masterstudy < 4.8.126 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f094fff-04eb-4ea9-b847-4e2e589a96e1?source=api-prod","affected":[{"type":"theme","slug":"masterstudy","name":"Masterstudy - Education WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.126","to_inclusive":false,"patched_in":"4.8.126"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-04T14:54:51Z"},{"id":"wordfence:5f0d1434-d29c-434c-97f9-ef949d23e680","source":"wordfence","cve":"CVE-2026-22388","title":"Owl Carousel WP <= 2.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f0d1434-d29c-434c-97f9-ef949d23e680?source=api-prod","affected":[{"type":"plugin","slug":"owl-carousel-wp","name":"Owl Carousel WP","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T19:30:08Z"},{"id":"wordfence:5f126296-0a6e-4d47-8f1a-ce2aa097f21d","source":"wordfence","cve":"CVE-2025-7685","title":"Like & Share My Site <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f126296-0a6e-4d47-8f1a-ce2aa097f21d?source=api-prod","affected":[{"type":"plugin","slug":"like-share-my-site","name":"Like & Share My Site","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T20:53:00Z","updated":"2025-07-22T09:22:43Z"},{"id":"wordfence:5f15ffca-bd59-4d07-8d79-2b41c7f6187c","source":"wordfence","cve":"CVE-2025-9541","title":"Markup Markdown <= 3.20.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f15ffca-bd59-4d07-8d79-2b41c7f6187c?source=api-prod","affected":[{"type":"plugin","slug":"markup-markdown","name":"Markup Markdown","from":"*","from_inclusive":true,"to":"3.20.9","to_inclusive":true,"patched_in":"3.20.10"}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-25T19:13:21Z"},{"id":"wordfence:5f1700c2-9c1f-4882-9f11-13b4ee8477a9","source":"wordfence","cve":"CVE-2022-36793","title":"WP Shop <= 3.9.6 - Missing Authentication to Settings Change and Order Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f1700c2-9c1f-4882-9f11-13b4ee8477a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-shop-original","name":"WP Shop","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f1a861b-43d6-4315-9ec4-802dbae32f43","source":"wordfence","cve":"CVE-2024-34813","title":"MC Woocommerce Wishlist <= 1.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f1a861b-43d6-4315-9ec4-802dbae32f43?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T19:51:39Z"},{"id":"wordfence:5f1ba1c7-de88-4070-a4ec-fbe4a0c30920","source":"wordfence","cve":"CVE-2025-11879","title":"GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f1ba1c7-de88-4070-a4ec-fbe4a0c30920?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:5f1e0dfa-f99a-43d1-bdc9-6fc7a4ea381d","source":"wordfence","cve":"CVE-2023-46312","title":"Smart Online Order for Clover <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f1e0dfa-f99a-43d1-bdc9-6fc7a4ea381d?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f1f3562-f869-4442-b77f-c06c5683c1b2","source":"wordfence","cve":"CVE-2023-22673","title":"Website Monetization by MageNet <= 1.0.29.1 - Cross-Site Request Forgery via admin_magenet_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f1f3562-f869-4442-b77f-c06c5683c1b2?source=api-prod","affected":[{"type":"plugin","slug":"website-monetization-by-magenet","name":"Website Monetization by MageNet","from":"*","from_inclusive":true,"to":"1.0.29.1","to_inclusive":true,"patched_in":"1.0.29.2"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f21a86b-52f4-4563-afce-32f1949ce5a1","source":"wordfence","cve":"CVE-2024-11276","title":"PDF Builder for WooCommerce. Create invoices,packing slips and more <= 1.2.136 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f21a86b-52f4-4563-afce-32f1949ce5a1?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.136","to_inclusive":true,"patched_in":"1.2.137"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:53Z"},{"id":"wordfence:5f22d77e-e7c3-4239-bec7-668d7483bdb9","source":"wordfence","cve":"CVE-2026-22345","title":"Image Gallery \u2013 Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f22d77e-e7c3-4239-bec7-668d7483bdb9?source=api-prod","affected":[{"type":"plugin","slug":"new-image-gallery","name":"Image Gallery","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-03-06T18:27:26Z"},{"id":"wordfence:5f24313e-c246-44f8-b144-d95c55e71456","source":"wordfence","cve":"CVE-2025-7368","title":"Rehub <= 19.9.7 - Unauthenticated Password Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f24313e-c246-44f8-b144-d95c55e71456?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.9.7","to_inclusive":true,"patched_in":"19.9.8"}],"published":"2025-09-05T13:04:32Z","updated":"2025-09-06T01:45:17Z"},{"id":"wordfence:5f2435fd-ccd5-4e51-89d7-98cddafac3fd","source":"wordfence","cve":"CVE-2025-22354","title":"Digi Store <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f2435fd-ccd5-4e51-89d7-98cddafac3fd?source=api-prod","affected":[{"type":"theme","slug":"digi-store","name":"Digi Store","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:06:19Z"},{"id":"wordfence:5f24baee-7003-449b-9072-d95fa1e26c8f","source":"wordfence","cve":"CVE-2025-1770","title":"Event Manager, Events Calendar, Tickets, Registrations \u2013 Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f24baee-7003-449b-9072-d95fa1e26c8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"4.0.25"}],"published":"2025-03-19T17:03:49Z","updated":"2025-03-20T05:23:22Z"},{"id":"wordfence:5f29d895-ff0a-4ff9-9998-e7ab1a95d797","source":"wordfence","cve":"CVE-2025-22669","title":"Awesome Event Booking <= 2.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29d895-ff0a-4ff9-9998-e7ab1a95d797?source=api-prod","affected":[{"type":"plugin","slug":"awesome-event-booking","name":"Awesome Event Booking","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:03:26Z"},{"id":"wordfence:5f29de7a-3f15-4b6d-aad7-6a08151e2113","source":"wordfence","cve":"CVE-2024-7627","title":"Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29de7a-3f15-4b6d-aad7-6a08151e2113?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"6.0","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2024-09-04T00:00:00Z","updated":"2024-09-05T02:04:24Z"},{"id":"wordfence:5f2c157b-cd5a-459d-8e26-859e686148dc","source":"wordfence","cve":"CVE-2022-38456","title":"Ajax Search Lite <= 4.10.3 - Missing Authorization leading to Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f2c157b-cd5a-459d-8e26-859e686148dc?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.10.3","to_inclusive":true,"patched_in":"4.11"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f2f34e1-3b08-4e23-a29b-21e61e6a6063","source":"wordfence","cve":"","title":"Admin Custom Login <= 2.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f2f34e1-3b08-4e23-a29b-21e61e6a6063?source=api-prod","affected":[{"type":"plugin","slug":"admin-custom-login","name":"Admin Custom Login","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":false,"patched_in":"2.4.8"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f2fa602-79db-4bb3-a55c-75da59116f06","source":"wordfence","cve":"CVE-2019-19979","title":"WP Maintenance <= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f2fa602-79db-4bb3-a55c-75da59116f06?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2019-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f319613-2709-449c-9e13-b0f95ee0b88b","source":"wordfence","cve":"CVE-2013-7240","title":"Advanced Dewplayer < 1.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f319613-2709-449c-9e13-b0f95ee0b88b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dewplayer","name":"Advanced Dewplayer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2013-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f346cc7-92ad-4f76-a71c-864c22ed56b5","source":"wordfence","cve":"CVE-2026-18435","title":"Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f346cc7-92ad-4f76-a71c-864c22ed56b5?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.8.1"}],"published":"2026-07-31T19:39:02Z","updated":"2026-08-01T07:49:47Z"},{"id":"wordfence:5f35b133-3199-4318-a2d9-93f9e7cb2aa6","source":"wordfence","cve":"CVE-2026-122665","title":"Mang Board <= 2.4.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f35b133-3199-4318-a2d9-93f9e7cb2aa6?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2026-11-07T10:40:28Z","updated":"2026-11-10T19:54:05Z"},{"id":"wordfence:5f380b48-9939-4066-a563-eea66b252cae","source":"wordfence","cve":"CVE-2026-78472","title":"Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f380b48-9939-4066-a563-eea66b252cae?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-sales-report","name":"Ni WooCommerce Sales Report \u2013 Orders, Revenue & Sales Analytics Dashboard","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:36:11Z"},{"id":"wordfence:5f388049-b453-406c-abdf-2a51c7abed2d","source":"wordfence","cve":"CVE-2022-1762","title":"iQ Block Country <= 1.2.13 - Protection Bypass due to IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f388049-b453-406c-abdf-2a51c7abed2d?source=api-prod","affected":[{"type":"plugin","slug":"iq-block-country","name":"iQ Block Country","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f38f9f0-7c15-4c07-b501-b523ea58432a","source":"wordfence","cve":"CVE-2026-4607","title":"ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f38f9f0-7c15-4c07-b501-b523ea58432a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.4","to_inclusive":true,"patched_in":"5.9.8.5"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T13:27:58Z"},{"id":"wordfence:5f3b0e75-d2f0-48b7-ba33-75c4e998030e","source":"wordfence","cve":"CVE-2024-9193","title":"WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3b0e75-d2f0-48b7-ba33-75c4e998030e?source=api-prod","affected":[{"type":"plugin","slug":"whmpress","name":"WHMpress - WHMCS WordPress Integration Plugin","from":"*","from_inclusive":true,"to":"6.3-revision-0","to_inclusive":true,"patched_in":"6.3-revision-1"}],"published":"2025-02-27T19:59:20Z","updated":"2025-02-28T08:23:16Z"},{"id":"wordfence:5f3c6d98-6f30-4a98-91c9-e77c1f960527","source":"wordfence","cve":"CVE-2024-9065","title":"WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3c6d98-6f30-4a98-91c9-e77c1f960527?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2024-10-09T13:29:15Z","updated":"2025-04-22T21:32:39Z"},{"id":"wordfence:5f3cd194-3fb8-4dd9-905e-051d5de68b66","source":"wordfence","cve":"CVE-2025-8071","title":"Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3cd194-3fb8-4dd9-905e-051d5de68b66?source=api-prod","affected":[{"type":"plugin","slug":"mine-cloudvod","name":"Mine CloudVod","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-07-23T20:37:57Z","updated":"2025-09-05T15:35:33Z"},{"id":"wordfence:5f3d8928-1257-4e65-9fcf-24d303acdb9e","source":"wordfence","cve":"CVE-2026-14602","title":"Remote API <= 0.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3d8928-1257-4e65-9fcf-24d303acdb9e?source=api-prod","affected":[{"type":"plugin","slug":"remote-api","name":"Remote API","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-04T19:18:12Z"},{"id":"wordfence:5f3f9891-710e-49e4-b388-aa6d99c01840","source":"wordfence","cve":"CVE-2026-2352","title":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-20T23:25:12Z"},{"id":"wordfence:5f42c8a0-2dbc-4902-83e4-d9d9ea441e1a","source":"wordfence","cve":"CVE-2022-2657","title":"Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace <= 3.8.11.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f42c8a0-2dbc-4902-83e4-d9d9ea441e1a?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.8.11.8","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2022-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f43e35e-55cd-45f1-b8a5-e47398d97cc2","source":"wordfence","cve":"CVE-2026-17166","title":"Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f43e35e-55cd-45f1-b8a5-e47398d97cc2?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2026-07-28T13:23:18Z","updated":"2026-07-29T01:29:43Z"},{"id":"wordfence:5f457450-6503-4ba2-a693-12c8310ef6ae","source":"wordfence","cve":"CVE-2026-85015","title":"Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Admin+) Arbitrary File Write","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f457450-6503-4ba2-a693-12c8310ef6ae?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:23:18Z"},{"id":"wordfence:5f459033-1c95-4781-93f4-1ee5e310933a","source":"wordfence","cve":"CVE-2024-4862","title":"WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f459033-1c95-4781-93f4-1ee5e310933a?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-07-08T22:00:42Z","updated":"2024-07-18T14:01:52Z"},{"id":"wordfence:5f466658-1fea-4d6b-935b-087c9d9020c6","source":"wordfence","cve":"CVE-2026-94180","title":"Advanced Ads \u2013\u00a0Ad Manager & AdSense <= 2.0.26 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f466658-1fea-4d6b-935b-087c9d9020c6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2026-10-02T09:37:00Z","updated":"2026-10-28T21:15:40Z"},{"id":"wordfence:5f4767b5-5dd6-4a2a-b44a-5297432286b1","source":"wordfence","cve":"CVE-2025-10861","title":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-24T11:25:47Z"},{"id":"wordfence:5f48d58f-8797-46a9-97fa-7db13db31cca","source":"wordfence","cve":"CVE-2026-40754","title":"Roisin - Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f48d58f-8797-46a9-97fa-7db13db31cca?source=api-prod","affected":[{"type":"theme","slug":"roisin","name":"Roisin - Flower Shop and Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:46:21Z"},{"id":"wordfence:5f4d57e4-1b82-45bb-9824-b7b2eaa73b6d","source":"wordfence","cve":"CVE-2022-0148","title":"All-in-one Floating Contact Form <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4d57e4-1b82-45bb-9824-b7b2eaa73b6d?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f4d613d-f040-4b92-8192-483e66fac5fd","source":"wordfence","cve":"CVE-2025-32294","title":"Oxpitan <= 1.3.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4d613d-f040-4b92-8192-483e66fac5fd?source=api-prod","affected":[{"type":"theme","slug":"oxpitan","name":"Oxpitan - Nonprofit Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:39:57Z"},{"id":"wordfence:5f4e6daf-9f89-4f34-ad07-82f63fd730da","source":"wordfence","cve":"CVE-2024-51672","title":"BetterLinks <= 2.1.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4e6daf-9f89-4f34-ad07-82f63fd730da?source=api-prod","affected":[{"type":"plugin","slug":"betterlinks","name":"BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:34:02Z"},{"id":"wordfence:5f4f07bf-192c-442f-ad68-fea1a84c5e87","source":"wordfence","cve":"CVE-2025-53246","title":"Backup and Move <= 0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4f07bf-192c-442f-ad68-fea1a84c5e87?source=api-prod","affected":[{"type":"plugin","slug":"backup-and-move","name":"Backup and Move Plugin","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-07T00:00:00Z","updated":"2025-11-11T18:22:29Z"},{"id":"wordfence:5f50e293-aebd-44dd-a692-64dea8f6622f","source":"wordfence","cve":"CVE-2024-13858","title":"BuddyBoss Platform and BuddyBoss Theme <= Multiple Versions - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f50e293-aebd-44dd-a692-64dea8f6622f?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.8.50","to_inclusive":true,"patched_in":"2.8.51"},{"type":"theme","slug":"buddyboss-theme","name":"BuddyBoss Theme","from":"*","from_inclusive":true,"to":"2.8.41","to_inclusive":true,"patched_in":"2.8.50"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-20T22:29:33Z"},{"id":"wordfence:5f52d193-ca17-41c0-8356-b1fcf0dbcf80","source":"wordfence","cve":"CVE-2026-111967","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar 5.9 - 5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f52d193-ca17-41c0-8356-b1fcf0dbcf80?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"5.9","from_inclusive":true,"to":"5.15","to_inclusive":true,"patched_in":"5.16"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:48Z"},{"id":"wordfence:5f550bac-b047-4276-bde5-c15bfd4ceb49","source":"wordfence","cve":"CVE-2024-3615","title":"Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f550bac-b047-4276-bde5-c15bfd4ceb49?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T02:34:44Z"},{"id":"wordfence:5f59d905-0b43-4a63-b5da-273b051f201b","source":"wordfence","cve":"CVE-2015-9440","title":"Monetize <= 1.03 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f59d905-0b43-4a63-b5da-273b051f201b?source=api-prod","affected":[{"type":"plugin","slug":"monetize","name":"Monetize","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":""}],"published":"2015-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f5a1eb3-3fda-49de-aefb-2205c9ca3520","source":"wordfence","cve":"CVE-2025-7638","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f5a1eb3-3fda-49de-aefb-2205c9ca3520?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.45.0","to_inclusive":true,"patched_in":"1.45.1"}],"published":"2025-07-17T16:22:47Z","updated":"2025-07-18T04:23:02Z"},{"id":"wordfence:5f5abf33-644d-4969-86e2-3026b1305d96","source":"wordfence","cve":"CVE-2026-16940","title":"Custom Fields for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f5abf33-644d-4969-86e2-3026b1305d96?source=api-prod","affected":[{"type":"plugin","slug":"addify-custom-fields-for-woocommerce","name":"Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-09-17T15:18:32Z"},{"id":"wordfence:5f62045b-4fb7-4dde-8d3c-d04b4e5e4810","source":"wordfence","cve":"CVE-2017-15812","title":"Easy Appointments < 1.12.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f62045b-4fb7-4dde-8d3c-d04b4e5e4810?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"}],"published":"2017-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f66ebef-b6ea-4f8c-a15d-11b15a77cb80","source":"wordfence","cve":"CVE-2025-66061","title":"Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f66ebef-b6ea-4f8c-a15d-11b15a77cb80?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2025-11-11T00:00:00Z","updated":"2025-11-25T15:38:17Z"},{"id":"wordfence:5f6b88fb-1070-427b-a51f-23fbede3dd59","source":"wordfence","cve":"","title":"Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6b88fb-1070-427b-a51f-23fbede3dd59?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-maintenance-mode","name":"Under Construction, Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2021-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f6c0e18-6a6b-40c5-95be-87fc7d49ae92","source":"wordfence","cve":"CVE-2026-42675","title":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6c0e18-6a6b-40c5-95be-87fc7d49ae92?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.41","to_inclusive":true,"patched_in":"1.1.42"}],"published":"2026-05-15T00:00:00Z","updated":"2026-05-19T13:31:21Z"},{"id":"wordfence:5f6c53b5-e09c-48e1-9b5f-4871d566fc42","source":"wordfence","cve":"CVE-2025-30558","title":"ANAC XML Render <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6c53b5-e09c-48e1-9b5f-4871d566fc42?source=api-prod","affected":[{"type":"plugin","slug":"anac-xml-render","name":"ANAC XML Render","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T13:19:03Z"},{"id":"wordfence:5f6da693-4610-4875-aa14-102809309b8d","source":"wordfence","cve":"CVE-2024-8731","title":"Cron Jobs <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6da693-4610-4875-aa14-102809309b8d?source=api-prod","affected":[{"type":"plugin","slug":"leira-cron-jobs","name":"Cron Jobs","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-23T18:19:50Z"},{"id":"wordfence:5f6eba90-3e9d-48d0-aae2-81ff216315da","source":"wordfence","cve":"CVE-2024-43995","title":"Posterity <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6eba90-3e9d-48d0-aae2-81ff216315da?source=api-prod","affected":[{"type":"theme","slug":"posterity","name":"Posterity","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2025-01-06T20:58:18Z"},{"id":"wordfence:5f6ee92e-4ccb-41b3-855f-adbfae4888ee","source":"wordfence","cve":"CVE-2021-24903","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 6.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6ee92e-4ccb-41b3-855f-adbfae4888ee?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":""}],"published":"2021-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f7014fc-a502-4f72-899f-c21d3ca5e5b3","source":"wordfence","cve":"","title":"iThemes Security < 3.6.4 - Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7014fc-a502-4f72-899f-c21d3ca5e5b3?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":false,"patched_in":"3.6.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f70a523-dbb0-4c32-95b5-aee1f5aada21","source":"wordfence","cve":"CVE-2025-29000","title":"Multi-language Responsive Contact Form <= 2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f70a523-dbb0-4c32-95b5-aee1f5aada21?source=api-prod","affected":[{"type":"plugin","slug":"responsive-contact-form","name":"Multi-language Responsive Contact Form","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:38:58Z"},{"id":"wordfence:5f7143d7-22a5-4c0e-8ad0-8f3572c2d205","source":"wordfence","cve":"CVE-2026-86442","title":"Event Manager 3.4.0 - 3.4.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7143d7-22a5-4c0e-8ad0-8f3572c2d205?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"3.4.0","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:08:14Z"},{"id":"wordfence:5f71c834-15ee-48ea-8f8d-6ea4b72a14d8","source":"wordfence","cve":"CVE-2026-9619","title":"Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f71c834-15ee-48ea-8f8d-6ea4b72a14d8?source=api-prod","affected":[{"type":"plugin","slug":"reviews-and-rating-docplanner","name":"Reviews and Rating \u2013 Docplanner","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:40:28Z","updated":"2026-06-24T05:33:26Z"},{"id":"wordfence:5f732a77-fa34-402f-8ab4-a4273b7e0b13","source":"wordfence","cve":"","title":"GEO my WP <= 4.5.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f732a77-fa34-402f-8ab4-a4273b7e0b13?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:22:03Z"},{"id":"wordfence:5f75dfef-b30f-45a5-ba3e-cb82c1443800","source":"wordfence","cve":"CVE-2024-28002","title":"Cornerstone <= 0.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f75dfef-b30f-45a5-ba3e-cb82c1443800?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":"0.8.1"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-24T16:01:13Z"},{"id":"wordfence:5f75e37d-a94e-4103-b706-5fead24f1f73","source":"wordfence","cve":"CVE-2024-29813","title":"Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f75e37d-a94e-4103-b706-5fead24f1f73?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T14:29:48Z"},{"id":"wordfence:5f7660ba-c3be-44f0-91cb-809d0021759a","source":"wordfence","cve":"CVE-2026-10779","title":"Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7660ba-c3be-44f0-91cb-809d0021759a?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2026-06-18T15:38:00Z","updated":"2026-06-19T03:41:59Z"},{"id":"wordfence:5f788303-6bf1-4b41-b0f7-e0a2d03bba6e","source":"wordfence","cve":"CVE-2026-13395","title":"Online Scheduling and Appointment Booking System \u2013 Bookly < 27.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f788303-6bf1-4b41-b0f7-e0a2d03bba6e?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.8","to_inclusive":false,"patched_in":"27.8"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-04T19:32:53Z"},{"id":"wordfence:5f78dd75-d853-4b16-843e-e0c9c55a103c","source":"wordfence","cve":"CVE-2023-0431","title":"File Away <= 3.9.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f78dd75-d853-4b16-843e-e0c9c55a103c?source=api-prod","affected":[{"type":"plugin","slug":"file-away","name":"File Away","from":"*","from_inclusive":true,"to":"3.9.9.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f7a5d4b-8ba2-45d8-92d4-3c66a81fb4f8","source":"wordfence","cve":"CVE-2023-51680","title":"Quotes for WooCommerce <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7a5d4b-8ba2-45d8-92d4-3c66a81fb4f8?source=api-prod","affected":[{"type":"plugin","slug":"quotes-for-woocommerce","name":"Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f7b15ba-5d7b-448d-ae95-b7d3ae7ff1c0","source":"wordfence","cve":"CVE-2024-42404","title":"Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7b15ba-5d7b-448d-ae95-b7d3ae7ff1c0?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2024-09-18T00:00:00Z","updated":"2024-10-04T16:45:00Z"},{"id":"wordfence:5f7b1e2d-e210-47f6-8dca-d7abb75edf35","source":"wordfence","cve":"CVE-2025-58833","title":"Invelity MyGLS connect <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7b1e2d-e210-47f6-8dca-d7abb75edf35?source=api-prod","affected":[{"type":"plugin","slug":"invelity-mygls-connect","name":"Invelity MyGLS connect","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:13:08Z"},{"id":"wordfence:5f7b9673-e1a3-4e51-9fcb-3ba86d7656b5","source":"wordfence","cve":"CVE-2025-32258","title":"Simple Website Logo <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7b9673-e1a3-4e51-9fcb-3ba86d7656b5?source=api-prod","affected":[{"type":"plugin","slug":"simple-website-logo","name":"Simple Website Logo","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T15:20:15Z"},{"id":"wordfence:5f7c4c26-ff77-4be0-946c-5480b4a28017","source":"wordfence","cve":"","title":"Home Villas | Real Estate WordPress Theme <= 2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7c4c26-ff77-4be0-946c-5480b4a28017?source=api-prod","affected":[{"type":"theme","slug":"homevillas-real-estate","name":"Home Villas | Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2020-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f7dc2c7-1a23-4677-b331-951960e76d43","source":"wordfence","cve":"CVE-2024-7354","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f7dc2c7-1a23-4677-b331-951960e76d43?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.8.6","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.8.11"}],"published":"2024-08-12T00:00:00Z","updated":"2024-09-12T14:36:59Z"},{"id":"wordfence:5f800156-1ccc-431f-9b2b-3b2ba3428bbc","source":"wordfence","cve":"CVE-2024-32128","title":"Realtyna Organic IDX plugin <= 4.14.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f800156-1ccc-431f-9b2b-3b2ba3428bbc?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.14.8"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-17T13:47:31Z"},{"id":"wordfence:5f829d21-5347-46ec-9218-2b3cbe7d7b95","source":"wordfence","cve":"CVE-2023-7296","title":"BigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f829d21-5347-46ec-9218-2b3cbe7d7b95?source=api-prod","affected":[{"type":"plugin","slug":"bigbluebutton","name":"BigBlueButton","from":"*","from_inclusive":true,"to":"3.0.0-beta.4","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2024-10-16T07:31:50Z"},{"id":"wordfence:5f82de4f-eff2-49b9-86ad-c75d709e9f10","source":"wordfence","cve":"CVE-2025-32615","title":"Clinked Client Portal <= 1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f82de4f-eff2-49b9-86ad-c75d709e9f10?source=api-prod","affected":[{"type":"plugin","slug":"clinked-client-portal","name":"Clinked Client Portal","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:17:55Z"},{"id":"wordfence:5f837ba2-64a2-4d8e-8212-b646cb94b0d7","source":"wordfence","cve":"CVE-2025-5322","title":"VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f837ba2-64a2-4d8e-8212-b646cb94b0d7?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-07-03T09:03:35Z","updated":"2025-07-03T21:24:34Z"},{"id":"wordfence:5f83c19e-1b75-4fea-b4de-f7f844a449c0","source":"wordfence","cve":"CVE-2024-1855","title":"WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f83c19e-1b75-4fea-b4de-f7f844a449c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2024-05-22T13:15:58Z","updated":"2024-05-23T01:56:20Z"},{"id":"wordfence:5f84140f-2572-4ffb-9b38-22eed5b0f80d","source":"wordfence","cve":"CVE-2026-24379","title":"Job Portal <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84140f-2572-4ffb-9b38-22eed5b0f80d?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-01-24T00:00:00Z","updated":"2026-01-28T13:44:03Z"},{"id":"wordfence:5f843d64-09eb-4e75-9e45-cd0cec580e60","source":"wordfence","cve":"CVE-2025-28920","title":"Responsive Google Map <= 3.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f843d64-09eb-4e75-9e45-cd0cec580e60?source=api-prod","affected":[{"type":"plugin","slug":"responsive-google-map","name":"Responsive Google Map","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:31:54Z"},{"id":"wordfence:5f84814e-f7b7-4228-b331-63027a0770af","source":"wordfence","cve":"CVE-2023-6527","title":"Email Subscription Popup <= 1.2.18 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84814e-f7b7-4228-b331-63027a0770af?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.18","to_inclusive":true,"patched_in":"1.2.19"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f84f59a-6030-44e7-b51c-b51ef3631672","source":"wordfence","cve":"CVE-2026-16035","title":"miniOrange 2FA <= 6.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84f59a-6030-44e7-b51c-b51ef3631672?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.2.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:33:08Z"},{"id":"wordfence:5f86dd96-fc87-4dc8-8435-f279a8def021","source":"wordfence","cve":"CVE-2024-31382","title":"Blocksy <= 2.0.22 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f86dd96-fc87-4dc8-8435-f279a8def021?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2024-04-10T00:00:00Z","updated":"2024-07-09T14:14:05Z"},{"id":"wordfence:5f884516-85c8-4ef5-8d49-caa707433c4f","source":"wordfence","cve":"CVE-2025-48077","title":"Block Country <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f884516-85c8-4ef5-8d49-caa707433c4f?source=api-prod","affected":[{"type":"plugin","slug":"block-country","name":"Block Country","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-22T20:42:17Z"},{"id":"wordfence:5f88a21d-28a9-4c91-9bf9-6b69f6a420e8","source":"wordfence","cve":"CVE-2024-13641","title":"Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2025-02-13T17:19:37Z","updated":"2025-02-14T05:22:44Z"},{"id":"wordfence:5f88cafb-58aa-4a04-9988-7e51f6feccfc","source":"wordfence","cve":"CVE-2025-49053","title":"WP Airdrop Manager <= 1.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88cafb-58aa-4a04-9988-7e51f6feccfc?source=api-prod","affected":[{"type":"plugin","slug":"airdrop","name":"WP Airdrop Manager","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T20:45:48Z"},{"id":"wordfence:5f8a0704-1c06-4342-b05a-7bd815a87833","source":"wordfence","cve":"CVE-2026-18324","title":"Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8a0704-1c06-4342-b05a-7bd815a87833?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0.1","to_inclusive":true,"patched_in":"1.57.0.2"}],"published":"2026-08-27T15:06:29Z","updated":"2026-08-28T06:53:03Z"},{"id":"wordfence:5f8a13e3-f6f5-4673-b223-95eb11465756","source":"wordfence","cve":"CVE-2024-12262","title":"Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8a13e3-f6f5-4673-b223-95eb11465756?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8001","to_inclusive":true,"patched_in":"5.8002"}],"published":"2024-12-20T18:47:07Z","updated":"2025-03-19T18:08:22Z"},{"id":"wordfence:5f8e0021-f305-45c1-b658-405ad22334ac","source":"wordfence","cve":"CVE-2018-16206","title":"spam-byebye <= 2.2.1 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8e0021-f305-45c1-b658-405ad22334ac?source=api-prod","affected":[{"type":"plugin","slug":"spam-byebye","name":"spam-byebye","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2019-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f8f8d46-d7e7-4b07-9b10-15e579973474","source":"wordfence","cve":"CVE-2024-1731","title":"Auto Refresh Single Page <= 1.1 -  Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8f8d46-d7e7-4b07-9b10-15e579973474?source=api-prod","affected":[{"type":"plugin","slug":"auto-refresh-single-page","name":"Auto Refresh Single Page","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:56:00Z"},{"id":"wordfence:5f900cd9-90f8-46e3-942e-de20a288a1a6","source":"wordfence","cve":"CVE-2026-87964","title":"Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f900cd9-90f8-46e3-942e-de20a288a1a6?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"8.0.26","to_inclusive":true,"patched_in":"8.0.27"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-06T09:38:13Z"},{"id":"wordfence:5f902f32-342e-4d5c-9c2c-4ee682248b8a","source":"wordfence","cve":"CVE-2025-63065","title":"Media Library Assistant <= 3.29 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f902f32-342e-4d5c-9c2c-4ee682248b8a?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.29","to_inclusive":true,"patched_in":"3.30"}],"published":"2025-10-09T00:00:00Z","updated":"2026-01-27T20:34:27Z"},{"id":"wordfence:5f91df7e-5d9d-4a3a-9afc-d771106a0be6","source":"wordfence","cve":"CVE-2026-2826","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f91df7e-5d9d-4a3a-9afc-d771106a0be6?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-04-03T19:45:52Z","updated":"2026-04-04T08:25:21Z"},{"id":"wordfence:5f9301dc-87c5-400c-8832-c50124cc748a","source":"wordfence","cve":"CVE-2025-12841","title":"Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9301dc-87c5-400c-8832-c50124cc748a?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-11-15T00:00:00Z","updated":"2025-12-19T20:52:31Z"},{"id":"wordfence:5f958a43-1753-4605-9e98-ba1468f75ab0","source":"wordfence","cve":"CVE-2024-47375","title":"XLTab \u2013 Accordions and Tabs for Elementor Page Builder <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f958a43-1753-4605-9e98-ba1468f75ab0?source=api-prod","affected":[{"type":"plugin","slug":"xl-tab","name":"XLTab \u2013 Accordions and Tabs for Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:41:23Z"},{"id":"wordfence:5f959cd1-e0a7-46f4-8668-f077bc33861f","source":"wordfence","cve":"CVE-2026-105892","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f959cd1-e0a7-46f4-8668-f077bc33861f?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"4.7.14"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:31:39Z"},{"id":"wordfence:5f963abe-d99e-48af-82c2-fba242b68608","source":"wordfence","cve":"CVE-2024-51809","title":"Keymaster Chord Notation Free <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f963abe-d99e-48af-82c2-fba242b68608?source=api-prod","affected":[{"type":"plugin","slug":"keymaster-chord-notation-free","name":"Keymaster Chord Notation Free","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:35:05Z"},{"id":"wordfence:5f977890-4bd7-4a12-822d-33e364677c6d","source":"wordfence","cve":"CVE-2025-57904","title":"Sales Count Manager for WooCommerce <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f977890-4bd7-4a12-822d-33e364677c6d?source=api-prod","affected":[{"type":"plugin","slug":"wc-sales-count-manager","name":"Sales Count Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:10:17Z"},{"id":"wordfence:5f97b842-d5ce-4428-ab74-9d15ebbcf341","source":"wordfence","cve":"CVE-2026-94487","title":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f97b842-d5ce-4428-ab74-9d15ebbcf341?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.50.1","to_inclusive":true,"patched_in":"2.51.0"}],"published":"2026-09-23T16:07:00Z","updated":"2026-09-29T20:06:00Z"},{"id":"wordfence:5f98f4b3-8cce-45dd-a138-5f2c8031fab5","source":"wordfence","cve":"CVE-2021-24212","title":"WooCommerce Help Scout <= 2.9.1 - Arbitrary File Upload to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f98f4b3-8cce-45dd-a138-5f2c8031fab5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-help-scout","name":"WooCommerce Help Scout","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2021-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f994141-f361-4a0e-99dc-1e1951e1e76e","source":"wordfence","cve":"CVE-2022-23976","title":"Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f994141-f361-4a0e-99dc-1e1951e1e76e?source=api-prod","affected":[{"type":"plugin","slug":"access-demo-importer","name":"Access Demo Importer","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-01-24T12:01:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f9ae6d4-c0c3-4ef0-948b-4055befbcda2","source":"wordfence","cve":"CVE-2025-60209","title":"Connector for Gravity Forms and Google Sheets <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9ae6d4-c0c3-4ef0-948b-4055befbcda2?source=api-prod","affected":[{"type":"plugin","slug":"wp-gravity-forms-spreadsheets","name":"Connector for Gravity Forms and Google Sheets","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-08-08T00:00:00Z","updated":"2025-11-07T17:32:32Z"},{"id":"wordfence:5f9cece7-a158-41ae-816b-1054da830724","source":"wordfence","cve":"CVE-2023-6421","title":"Download Manager <= 3.2.82 - Unauthenticated Password Leak","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9cece7-a158-41ae-816b-1054da830724?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.82","to_inclusive":true,"patched_in":"3.2.83"}],"published":"2023-11-29T00:00:00Z","updated":"2024-02-06T16:20:59Z"},{"id":"wordfence:5f9cf9c5-d836-4414-a53f-adee2784bd96","source":"wordfence","cve":"","title":"Media from FTP <= 11.15 - Improper Privilege Management","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9cf9c5-d836-4414-a53f-adee2784bd96?source=api-prod","affected":[{"type":"plugin","slug":"media-from-ftp","name":"Media from FTP","from":"*","from_inclusive":true,"to":"11.16","to_inclusive":false,"patched_in":"11.16"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5f9d237c-110e-4e71-9d2c-db99358468e6","source":"wordfence","cve":"CVE-2022-4057","title":"Autoptimize <= 3.0.4 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5f9d237c-110e-4e71-9d2c-db99358468e6?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fa2ec9e-2859-4a96-9e33-9e22d37e544f","source":"wordfence","cve":"CVE-2023-4282","title":"EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa2ec9e-2859-4a96-9e33-9e22d37e544f?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fa37909-932c-4879-bbf0-8b44cc995cc0","source":"wordfence","cve":"CVE-2025-6254","title":"Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa37909-932c-4879-bbf0-8b44cc995cc0?source=api-prod","affected":[{"type":"plugin","slug":"doctreat_core","name":"Doctreat Core","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-06-09T20:15:24Z","updated":"2026-06-10T08:28:20Z"},{"id":"wordfence:5fa75f3a-3582-4851-a67c-6c4981fb9abb","source":"wordfence","cve":"CVE-2024-47308","title":"Templately <= 3.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa75f3a-3582-4851-a67c-6c4981fb9abb?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T20:59:01Z"},{"id":"wordfence:5fa88355-cb24-4dca-a730-08b185a6b9ea","source":"wordfence","cve":"CVE-2025-32641","title":"Anant Addons for Elementor <= 1.1.8 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa88355-cb24-4dca-a730-08b185a6b9ea?source=api-prod","affected":[{"type":"plugin","slug":"anant-addons-for-elementor","name":"Anant Addons for Elementor \u2013 Widgets, Templates & WooCommerce Builder","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-23T13:41:59Z"},{"id":"wordfence:5faa397f-5bc4-4d53-bf27-b9dfdd1e9071","source":"wordfence","cve":"CVE-2026-81348","title":"My Private Site \u2013 Make Your Whole Site Private, Force Login & Block Registration Spam < 4.2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5faa397f-5bc4-4d53-bf27-b9dfdd1e9071?source=api-prod","affected":[{"type":"plugin","slug":"jonradio-private-site","name":"My Private Site \u2013 Make Your Whole Site Private, Force Login & Block Registration Spam","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:06:10Z"},{"id":"wordfence:5faaf7d1-2012-42d5-affa-a5ff3388d25a","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5faaf7d1-2012-42d5-affa-a5ff3388d25a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:33:13Z"},{"id":"wordfence:5fab1ae8-2aa4-452a-a594-64088c92b5c3","source":"wordfence","cve":"CVE-2022-45821","title":"NOO Timetable <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fab1ae8-2aa4-452a-a594-64088c92b5c3?source=api-prod","affected":[{"type":"plugin","slug":"noo-timetable","name":"NOO Timetable","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fb089ba-d66b-4cf4-a0cc-22cb76358b5e","source":"wordfence","cve":"CVE-2025-66093","title":"Extensions for Leaflet Map <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb089ba-d66b-4cf4-a0cc-22cb76358b5e?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2025-11-23T00:00:00Z","updated":"2025-12-01T16:58:19Z"},{"id":"wordfence:5fb176f2-d966-4d78-9915-e6903d8f226a","source":"wordfence","cve":"CVE-2026-32330","title":"Photo Gallery by 10Web <= 1.8.37 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb176f2-d966-4d78-9915-e6903d8f226a?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.37","to_inclusive":true,"patched_in":"1.8.38"}],"published":"2026-02-08T00:00:00Z","updated":"2026-04-15T20:59:53Z"},{"id":"wordfence:5fb338c2-f458-42bc-b147-d5024875e977","source":"wordfence","cve":"CVE-2024-44038","title":"Sunshine Photo Cart <= 3.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb338c2-f458-42bc-b147-d5024875e977?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T19:52:44Z"},{"id":"wordfence:5fb3a347-e124-484b-9eff-281a10c25a5c","source":"wordfence","cve":"CVE-2025-62031","title":"tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb3a347-e124-484b-9eff-281a10c25a5c?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T14:52:50Z"},{"id":"wordfence:5fb4f619-7fc8-482d-862f-ebb02c3870f8","source":"wordfence","cve":"CVE-2026-57381","title":"Property Hive <= 2.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb4f619-7fc8-482d-862f-ebb02c3870f8?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:47:58Z"},{"id":"wordfence:5fb52c19-6816-423d-ab3a-6b5b2ff21e03","source":"wordfence","cve":"CVE-2025-14112","title":"Snillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb52c19-6816-423d-ab3a-6b5b2ff21e03?source=api-prod","affected":[{"type":"plugin","slug":"snillrik-restaurant-menu","name":"Snillrik Restaurant Menu","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-01-06T20:40:34Z","updated":"2026-01-23T18:58:14Z"},{"id":"wordfence:5fb90b3b-08bd-4887-a6bf-054b42d3e403","source":"wordfence","cve":"CVE-2024-8548","title":"KB Support \u2013 WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fb90b3b-08bd-4887-a6bf-054b42d3e403?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-17T16:09:30Z"},{"id":"wordfence:5fbb2dcf-38b8-4ef1-bfea-bf5872cc7e37","source":"wordfence","cve":"CVE-2024-11002","title":"InPost Gallery <= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbb2dcf-38b8-4ef1-bfea-bf5872cc7e37?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4.2","to_inclusive":true,"patched_in":"2.1.4.3"}],"published":"2024-11-25T17:51:29Z","updated":"2024-11-26T06:43:46Z"},{"id":"wordfence:5fbb41db-5369-465e-80a7-3490df46e07e","source":"wordfence","cve":"CVE-2025-32263","title":"Sequential Order Numbers for WooCommerce <= 3.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbb41db-5369-465e-80a7-3490df46e07e?source=api-prod","affected":[{"type":"plugin","slug":"sequential-order-numbers-for-woocommerce","name":"Sequential Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T14:05:39Z"},{"id":"wordfence:5fbb8506-da9a-4176-824d-9d93135a1d74","source":"wordfence","cve":"CVE-2025-48160","title":"Caliris <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbb8506-da9a-4176-824d-9d93135a1d74?source=api-prod","affected":[{"type":"theme","slug":"caliris-wp","name":"Caliris - Responsive One Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:49:00Z"},{"id":"wordfence:5fbc0866-1e9d-457a-8ef3-fb046c89c1dd","source":"wordfence","cve":"CVE-2024-10269","title":"Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbc0866-1e9d-457a-8ef3-fb046c89c1dd?source=api-prod","affected":[{"type":"plugin","slug":"easy-svg","name":"Easy SVG Support","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2024-11-07T18:37:40Z","updated":"2024-11-08T06:39:59Z"},{"id":"wordfence:5fbd1c5c-d23a-4f89-9225-514552d6ea70","source":"wordfence","cve":"CVE-2026-8909","title":"WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbd1c5c-d23a-4f89-9225-514552d6ea70?source=api-prod","affected":[{"type":"plugin","slug":"wp-mobi","name":"WpMobi","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:55Z","updated":"2026-06-09T03:41:20Z"},{"id":"wordfence:5fc5fb44-8264-46b7-9486-f145d6cbfde2","source":"wordfence","cve":"CVE-2024-43144","title":"Cost Calculator Builder <= 3.2.15 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fc5fb44-8264-46b7-9486-f145d6cbfde2?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:35:34Z"},{"id":"wordfence:5fc9ecf7-2802-433e-832b-731505c5cb9b","source":"wordfence","cve":"CVE-2026-39532","title":"Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fc9ecf7-2802-433e-832b-731505c5cb9b?source=api-prod","affected":[{"type":"plugin","slug":"events-for-geodirectory","name":"Events Calendar for GeoDirectory","from":"*","from_inclusive":true,"to":"2.3.25","to_inclusive":true,"patched_in":"2.3.26"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:00:32Z"},{"id":"wordfence:5fca3dae-43a9-4130-ad04-8624aeb0c26b","source":"wordfence","cve":"CVE-2018-20971","title":"Church Admin < 1.2550 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fca3dae-43a9-4130-ad04-8624aeb0c26b?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"1.2550","to_inclusive":false,"patched_in":"1.2550"}],"published":"2018-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fcbdd9e-90c0-4883-9dac-07410b9c9a3f","source":"wordfence","cve":"CVE-2026-57318","title":"Site Reviews <= 8.0.11 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fcbdd9e-90c0-4883-9dac-07410b9c9a3f?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.0.11","to_inclusive":true,"patched_in":"8.0.12"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:36:38Z"},{"id":"wordfence:5fcf692f-dbcc-486e-8102-121920ee65c1","source":"wordfence","cve":"CVE-2025-62136","title":"Melos <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fcf692f-dbcc-486e-8102-121920ee65c1?source=api-prod","affected":[{"type":"theme","slug":"melos","name":"Melos","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:29:44Z"},{"id":"wordfence:5fcf9a7f-e48c-40a7-9af8-6a2e631ef6e3","source":"wordfence","cve":"CVE-2025-69063","title":"New User Approve <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fcf9a7f-e48c-40a7-9af8-6a2e631ef6e3?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T15:03:00Z"},{"id":"wordfence:5fd000dd-f75a-4ff0-bc71-20db878caca7","source":"wordfence","cve":"","title":"OneTone Companion <= 1.1.1 - Open Mailer","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd000dd-f75a-4ff0-bc71-20db878caca7?source=api-prod","affected":[{"type":"plugin","slug":"onetone-companion","name":"OneTone Companion","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fd0971e-7749-4970-ad39-d0d64a9f1d90","source":"wordfence","cve":"CVE-2025-39601","title":"Custom CSS, JS & PHP <= 2.4.1 - Cross-Site Request Forgery to Remote Code Exectuiron","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd0971e-7749-4970-ad39-d0d64a9f1d90?source=api-prod","affected":[{"type":"plugin","slug":"custom-css","name":"Custom CSS, JS & PHP","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:38:54Z"},{"id":"wordfence:5fd16add-bdcc-4573-a60a-4f45d87eba5a","source":"wordfence","cve":"CVE-2026-115214","title":"Datawiza Proxy Auth <= 1.1.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd16add-bdcc-4573-a60a-4f45d87eba5a?source=api-prod","affected":[{"type":"plugin","slug":"reverse-proxy-auth-widget","name":"Datawiza Proxy Auth Plugin \u2013 SSO","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:22:34Z"},{"id":"wordfence:5fd449d7-d14e-46d6-851c-828207c3c302","source":"wordfence","cve":"CVE-2026-57428","title":"Sprout Clients \u2013 CRM and Lead Management <= 3.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd449d7-d14e-46d6-851c-828207c3c302?source=api-prod","affected":[{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:01:40Z"},{"id":"wordfence:5fd470bb-d791-45dc-a743-6f03fc75f00c","source":"wordfence","cve":"CVE-2023-32129","title":"Editorialmag <= 1.2.0 - Missing Authorization to Authenticated Plugin Activation","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd470bb-d791-45dc-a743-6f03fc75f00c?source=api-prod","affected":[{"type":"theme","slug":"editorialmag","name":"Editorialmag","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-05-04T00:00:00Z","updated":"2024-03-25T16:24:15Z"},{"id":"wordfence:5fd495e8-d7e8-4949-b7aa-43ef40063ca1","source":"wordfence","cve":"CVE-2023-44244","title":"FooGallery <= 2.2.44 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fd495e8-d7e8-4949-b7aa-43ef40063ca1?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fdac697-e2b5-4cde-a15e-72beea578f9e","source":"wordfence","cve":"CVE-2026-105061","title":"WP Mailster <= 1.9.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdac697-e2b5-4cde-a15e-72beea578f9e?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.9.0.0","to_inclusive":true,"patched_in":"1.9.1.0"}],"published":"2026-10-05T10:13:41Z","updated":"2026-10-08T23:14:39Z"},{"id":"wordfence:5fdb8e77-1323-43a0-a012-04d983390de1","source":"wordfence","cve":"CVE-2024-22288","title":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdb8e77-1323-43a0-a012-04d983390de1?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-01T14:42:32Z"},{"id":"wordfence:5fdba3c5-382e-4d2b-83d8-0e0cebf2e63c","source":"wordfence","cve":"CVE-2024-13873","title":"WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdba3c5-382e-4d2b-83d8-0e0cebf2e63c?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-02-21T00:00:00Z","updated":"2025-02-22T03:21:01Z"},{"id":"wordfence:5fdba41f-daa5-44e8-bc47-aa8b7bd31054","source":"wordfence","cve":"CVE-2023-4140","title":"WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation","severity":"medium","cvss":6.6,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdba41f-daa5-44e8-bc47-aa8b7bd31054?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.9.8","to_inclusive":true,"patched_in":"7.9.9"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fdbc9bc-70cf-4440-b12d-dd98844d33bc","source":"wordfence","cve":"CVE-2024-10775","title":"Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdbc9bc-70cf-4440-b12d-dd98844d33bc?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.32","to_inclusive":true,"patched_in":"2.4.33"}],"published":"2025-01-14T21:05:55Z","updated":"2025-01-15T09:25:54Z"},{"id":"wordfence:5fdce73f-b221-4c4e-a341-ce82d0fd8836","source":"wordfence","cve":"CVE-2024-54355","title":"WP Mailster <= 1.8.17.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdce73f-b221-4c4e-a341-ce82d0fd8836?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.17.0","to_inclusive":true,"patched_in":"1.8.18.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:18:15Z"},{"id":"wordfence:5fdd2919-396b-41ff-ae92-1b6fee5c6f5e","source":"wordfence","cve":"CVE-2022-0541","title":"FloLaunch <= 2.4 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdd2919-396b-41ff-ae92-1b6fee5c6f5e?source=api-prod","affected":[{"type":"plugin","slug":"flo-launch","name":"FloLaunch","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2022-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fdf6407-388c-4fb4-b00d-7ed389a9067d","source":"wordfence","cve":"","title":"Subscriptions & Memberships for PayPal <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdf6407-388c-4fb4-b00d-7ed389a9067d?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-memberships-for-paypal","name":"Subscriptions & Memberships for PayPal","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fe317a6-a391-441a-aac8-c8fa57e73169","source":"wordfence","cve":"CVE-2024-4709","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe317a6-a391-441a-aac8-c8fa57e73169?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"5.1.17"}],"published":"2024-05-17T00:00:00Z","updated":"2024-10-24T20:18:36Z"},{"id":"wordfence:5fe374ff-85eb-4285-8d51-71e9275613cc","source":"wordfence","cve":"CVE-2023-35883","title":"Core Web Vitals & PageSpeed Booster <= 1.0.12 - Open Redirect via _wp_http_referer","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe374ff-85eb-4285-8d51-71e9275613cc?source=api-prod","affected":[{"type":"plugin","slug":"core-web-vitals-pagespeed-booster","name":"Core Web Vitals & PageSpeed Booster","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fe46da6-add5-42d4-a2db-7a8bada2968c","source":"wordfence","cve":"CVE-2023-4808","title":"WP Post Popup <= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe46da6-add5-42d4-a2db-7a8bada2968c?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-modal","name":"WP Post Popup","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5fe56ffe-14f8-42c7-852e-41351aae9a4a","source":"wordfence","cve":"CVE-2026-22395","title":"Fiorello - Florist and Flower Shop WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe56ffe-14f8-42c7-852e-41351aae9a4a?source=api-prod","affected":[{"type":"theme","slug":"fiorello","name":"Fiorello - Florist and Flower Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:43:07Z"},{"id":"wordfence:5fe7668b-9d70-44b7-a347-3922c0b8684c","source":"wordfence","cve":"CVE-2025-4523","title":"IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe7668b-9d70-44b7-a347-3922c0b8684c?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"2.0.0","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2025-07-31T16:22:44Z","updated":"2025-08-01T04:24:29Z"},{"id":"wordfence:5fe86ce8-932c-4085-a4e2-023b7d26b718","source":"wordfence","cve":"CVE-2025-26943","title":"Easy Quotes <= 1.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe86ce8-932c-4085-a4e2-023b7d26b718?source=api-prod","affected":[{"type":"plugin","slug":"easy-quotes","name":"Easy Quotes","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:39:25Z"},{"id":"wordfence:5fe983d6-ad48-460f-ba5d-f6de19f06be4","source":"wordfence","cve":"CVE-2015-9311","title":"NewStatPress <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe983d6-ad48-460f-ba5d-f6de19f06be4?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2015-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5feb08ff-3e1a-4a5c-88d9-1c07409d0c8c","source":"wordfence","cve":"CVE-2025-22663","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams  <= 7.2.16 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5feb08ff-3e1a-4a5c-88d9-1c07409d0c8c?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.2.16","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T22:09:40Z"},{"id":"wordfence:5fec449b-76ab-441c-9683-35620e4ebce9","source":"wordfence","cve":"CVE-2025-25126","title":"ZMSEO <= 1.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fec449b-76ab-441c-9683-35620e4ebce9?source=api-prod","affected":[{"type":"plugin","slug":"zmseo","name":"ZMSEO","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:11:38Z"},{"id":"wordfence:5ff589ec-756d-4183-8bb8-61dae9be7c5d","source":"wordfence","cve":"CVE-2023-39993","title":"Elements kit Elementor addons <= 2.9.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ff589ec-756d-4183-8bb8-61dae9be7c5d?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2023-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ff7ccb7-08fc-43de-8579-2a30d28e2de7","source":"wordfence","cve":"CVE-2024-5286","title":"WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Banner Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ff7ccb7-08fc-43de-8579-2a30d28e2de7?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-18T13:29:53Z"},{"id":"wordfence:5ffb31a5-a692-4817-ad46-cf804b97d480","source":"wordfence","cve":"CVE-2018-17946","title":"Slideshow Gallery <= 1.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ffb31a5-a692-4817-ad46-cf804b97d480?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2017-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:5ffbd0d8-c70a-4385-a990-7b558a147935","source":"wordfence","cve":"CVE-2025-22263","title":"Global Gallery <= 8.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5ffbd0d8-c70a-4385-a990-7b558a147935?source=api-prod","affected":[{"type":"plugin","slug":"global-gallery","name":"Global Gallery - WordPress Responsive Gallery","from":"*","from_inclusive":true,"to":"8.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:45:42Z"},{"id":"wordfence:5fff40e4-6bab-46b4-a6b6-34f89d1aa12c","source":"wordfence","cve":"CVE-2026-39546","title":"MultiLoca <= 4.2.15 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5fff40e4-6bab-46b4-a6b6-34f89d1aa12c?source=api-prod","affected":[{"type":"plugin","slug":"WooCommerce-Multi-Locations-Inventory-Management","name":"MultiLoca - WooCommerce Multi Locations Inventory Management","from":"*","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"4.2.16"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:03:31Z"},{"id":"wordfence:60013752-d7cf-46e8-84e1-1b614f737b46","source":"wordfence","cve":"CVE-2026-7465","title":"Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60013752-d7cf-46e8-84e1-1b614f737b46?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.25","to_inclusive":true,"patched_in":"2.19.26"}],"published":"2026-05-29T20:27:40Z","updated":"2026-05-30T09:29:01Z"},{"id":"wordfence:6001660c-4b18-473d-a07d-30e0f7af29d1","source":"wordfence","cve":"CVE-2025-23528","title":"DD Roles <= 4.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6001660c-4b18-473d-a07d-30e0f7af29d1?source=api-prod","affected":[{"type":"plugin","slug":"dd-roles","name":"DD Roles","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:52:00Z"},{"id":"wordfence:6002fd39-b25b-4e15-837e-5430757d8cb1","source":"wordfence","cve":"CVE-2025-30522","title":"Contact Form 7 Material Design <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6002fd39-b25b-4e15-837e-5430757d8cb1?source=api-prod","affected":[{"type":"plugin","slug":"cf7-material-design","name":"Contact Form 7 Material Design","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:16:28Z"},{"id":"wordfence:60030ee9-ad5d-4d84-a019-1906b20ebbc1","source":"wordfence","cve":"CVE-2014-4591","title":"WP-Picasa-Image <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60030ee9-ad5d-4d84-a019-1906b20ebbc1?source=api-prod","affected":[{"type":"plugin","slug":"wp-picasa-image","name":"WP-Picasa-Image","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6003ad4e-f4ad-49bf-8d83-3da4945456a4","source":"wordfence","cve":"CVE-2024-52448","title":"Ultimate Classified Listings <= 1.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6003ad4e-f4ad-49bf-8d83-3da4945456a4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-11-18T00:00:00Z","updated":"2026-07-08T20:41:41Z"},{"id":"wordfence:6003b1bf-b176-4ca9-9de2-58133259e0f6","source":"wordfence","cve":"CVE-2023-30873","title":"WP Docs <= 1.9.8 - Cross-Site Request Forgery to folder management","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6003b1bf-b176-4ca9-9de2-58133259e0f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60083262-198d-4a7d-bb0a-717a744e20f9","source":"wordfence","cve":"CVE-2023-41875","title":"WP Directory Kit <= 1.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60083262-198d-4a7d-bb0a-717a744e20f9?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:600aef49-b918-4d58-a460-f9cdbeaa17dd","source":"wordfence","cve":"CVE-2024-50507","title":"DS.DownloadList <= 1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/600aef49-b918-4d58-a460-f9cdbeaa17dd?source=api-prod","affected":[{"type":"plugin","slug":"dsdownloadlist","name":"DS.DownloadList","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:31:33Z"},{"id":"wordfence:600f38eb-3c13-4792-8079-944ea0238ad2","source":"wordfence","cve":"CVE-2024-52447","title":"Contact Page With Google Map <= 1.6.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/600f38eb-3c13-4792-8079-944ea0238ad2?source=api-prod","affected":[{"type":"plugin","slug":"contact-page-with-google-map","name":"Contact Page With Google Map","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:48:54Z"},{"id":"wordfence:600f4293-444c-43b6-88b0-dacf3843cd08","source":"wordfence","cve":"CVE-2025-69175","title":"Line Agency <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/600f4293-444c-43b6-88b0-dacf3843cd08?source=api-prod","affected":[{"type":"theme","slug":"lineagency","name":"Line Agency | Interior Design & Architecture WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:34:48Z"},{"id":"wordfence:60116e60-ebf3-4f32-b536-52ce2a9672df","source":"wordfence","cve":"CVE-2024-30195","title":"RoyalSlider <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60116e60-ebf3-4f32-b536-52ce2a9672df?source=api-prod","affected":[{"type":"plugin","slug":"new-royalslider","name":"RoyalSlider","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:21:02Z"},{"id":"wordfence:6013f592-4cff-4b94-968d-6f66e84368d0","source":"wordfence","cve":"CVE-2026-9732","title":"EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6013f592-4cff-4b94-968d-6f66e84368d0?source=api-prod","affected":[{"type":"plugin","slug":"emergencywp","name":"EmergencyWP \u2013 Dead Man's switch & legacy deliverance","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-02T11:00:51Z","updated":"2026-06-02T23:27:49Z"},{"id":"wordfence:6015e204-1e07-4c75-ad22-969045934468","source":"wordfence","cve":"CVE-2023-52190","title":"Coupon Referral Program <= 1.8.4 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6015e204-1e07-4c75-ad22-969045934468?source=api-prod","affected":[{"type":"plugin","slug":"coupon-referral-program","name":"Coupon Referral Program","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2024-01-03T00:00:00Z","updated":"2025-12-19T15:42:37Z"},{"id":"wordfence:601974c3-65d0-422d-ba59-7ff65fe2a976","source":"wordfence","cve":"CVE-2024-51823","title":"Add Ribbon Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601974c3-65d0-422d-ba59-7ff65fe2a976?source=api-prod","affected":[{"type":"plugin","slug":"add-ribbon","name":"Add Ribbon Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:33:41Z"},{"id":"wordfence:601aa2b5-aeac-49bc-960d-4b4ff83e9229","source":"wordfence","cve":"CVE-2025-8420","title":"Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=api-prod","affected":[{"type":"plugin","slug":"software-issue-manager","name":"Project Management, Bug and Issue Tracking Plugin \u2013 Software Issue Manager","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"},{"type":"plugin","slug":"campus-directory","name":"Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"},{"type":"plugin","slug":"employee-staff-directory","name":"Employee Directory \u2013 Staff Directory and Listing","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"},{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"},{"type":"plugin","slug":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"},{"type":"plugin","slug":"wp-easy-events","name":"Event RSVP and Simple Event Management Plugin","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"},{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-08-05T13:47:52Z","updated":"2025-09-25T13:37:05Z"},{"id":"wordfence:601ac722-a2d4-4dce-9cde-dd3f4c15416a","source":"wordfence","cve":"CVE-2026-57694","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601ac722-a2d4-4dce-9cde-dd3f4c15416a?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.13","to_inclusive":true,"patched_in":"3.9.14"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-16T18:52:07Z"},{"id":"wordfence:601ad4f3-2160-4af6-b3d5-c2af52746aab","source":"wordfence","cve":"CVE-2018-11633","title":"Digital Goods < 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601ad4f3-2160-4af6-b3d5-c2af52746aab?source=api-prod","affected":[{"type":"plugin","slug":"woo-checkout-for-digital-goods","name":"Digital Goods for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2018-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:601d70ff-2e0e-403b-9c58-130d378a8240","source":"wordfence","cve":"CVE-2023-5601","title":"WooCommerce Ninja Forms Product Add-ons <= 1.7.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601d70ff-2e0e-403b-9c58-130d378a8240?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ninjaforms-product-addons","name":"WooCommerce Ninja Forms Product Add-ons","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:601e52b6-36eb-4739-9b04-db779befa899","source":"wordfence","cve":"CVE-2022-0782","title":"Donations <= 1.8 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601e52b6-36eb-4739-9b04-db779befa899?source=api-prod","affected":[{"type":"plugin","slug":"nd-donations","name":"Donations","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2022-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60242725-200e-4794-acdc-2ab4a1e8e4fc","source":"wordfence","cve":"CVE-2008-4625","title":"ShiftThis Newsletter <= 2.3.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60242725-200e-4794-acdc-2ab4a1e8e4fc?source=api-prod","affected":[{"type":"plugin","slug":"st_newsletter","name":"ShiftThis","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2008-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:602a8030-087b-459f-b649-b4116404cf3e","source":"wordfence","cve":"CVE-2024-4706","title":"WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602a8030-087b-459f-b649-b4116404cf3e?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"27.2","to_inclusive":true,"patched_in":"28.0"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T07:31:26Z"},{"id":"wordfence:602ae805-a6a6-48bd-bd2a-00fafadfdce4","source":"wordfence","cve":"CVE-2024-12439","title":"Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602ae805-a6a6-48bd-bd2a-00fafadfdce4?source=api-prod","affected":[{"type":"plugin","slug":"marketplace-items","name":"Marketplace Items","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:31:39Z","updated":"2025-01-07T05:23:57Z"},{"id":"wordfence:602b24b1-d450-4d30-8030-120420882ea0","source":"wordfence","cve":"CVE-2025-64282","title":"Radius Blocks <= 2.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602b24b1-d450-4d30-8030-120420882ea0?source=api-prod","affected":[{"type":"plugin","slug":"radius-blocks","name":"Radius Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-12-20T19:25:07Z"},{"id":"wordfence:602b3b9c-76a7-4b0b-8aad-e554c2fd6910","source":"wordfence","cve":"CVE-2023-5295","title":"Comments by Startbit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602b3b9c-76a7-4b0b-8aad-e554c2fd6910?source=api-prod","affected":[{"type":"plugin","slug":"facebook-comment-by-vivacity","name":"Comments by Startbit","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:602bf9b1-17a9-441a-b12d-15412df2deb4","source":"wordfence","cve":"CVE-2025-2250","title":"WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins <= 2.32 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602bf9b1-17a9-441a-b12d-15412df2deb4?source=api-prod","affected":[{"type":"plugin","slug":"reportattacks","name":"ReportAttacks \u2014 Brute Force & Login Protection","from":"*","from_inclusive":true,"to":"2.32","to_inclusive":true,"patched_in":"2.33"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T03:21:02Z"},{"id":"wordfence:602c8145-dcf7-4844-8e54-bc50efa307f4","source":"wordfence","cve":"","title":"Contact Form Clean and Simple <= 4.7.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602c8145-dcf7-4844-8e54-bc50efa307f4?source=api-prod","affected":[{"type":"plugin","slug":"clean-and-simple-contact-form-by-meg-nicholas","name":"Contact Form Clean and Simple","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":false,"patched_in":"4.7.1"}],"published":"2020-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:602d1302-138f-4ee4-a36c-179f24a2bf0b","source":"wordfence","cve":"CVE-2024-3048","title":"Bannerlid <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602d1302-138f-4ee4-a36c-179f24a2bf0b?source=api-prod","affected":[{"type":"plugin","slug":"bannerlid","name":"Bannerlid","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T17:46:35Z"},{"id":"wordfence:602d337e-0778-4182-8e77-0eb3b37d5a7a","source":"wordfence","cve":"CVE-2024-8476","title":"Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602d337e-0778-4182-8e77-0eb3b37d5a7a?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-events-tickets","name":"Easy PayPal Events & Tickets","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:14Z"},{"id":"wordfence:602df370-cd5b-46dc-a653-6522aef0c62f","source":"wordfence","cve":"CVE-2024-1079","title":"Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602df370-cd5b-46dc-a653-6522aef0c62f?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.2.4","to_inclusive":true,"patched_in":"6.5.2.5"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T07:32:21Z"},{"id":"wordfence:602e088e-57af-4b30-96c3-a44b2a8e4edb","source":"wordfence","cve":"CVE-2024-49624","title":"Advanced Advertising System <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/602e088e-57af-4b30-96c3-a44b2a8e4edb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-advertising-system","name":"Advanced Advertising System","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:15:05Z"},{"id":"wordfence:603087d1-49cb-4080-b0ef-14f04dce3fed","source":"wordfence","cve":"CVE-2024-30545","title":"Social Author Bio <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603087d1-49cb-4080-b0ef-14f04dce3fed?source=api-prod","affected":[{"type":"plugin","slug":"social-autho-bio","name":"Social Author Bio","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T21:04:08Z"},{"id":"wordfence:6030f7e5-cb2d-465b-b58b-7339b35055a9","source":"wordfence","cve":"CVE-2025-31469","title":"Clear Sucuri Cache <= 1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6030f7e5-cb2d-465b-b58b-7339b35055a9?source=api-prod","affected":[{"type":"plugin","slug":"clear-sucuri-cache","name":"Clear Sucuri Cache","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T13:59:12Z"},{"id":"wordfence:6031edec-4274-4e42-9e3a-ce0c94958b17","source":"wordfence","cve":"CVE-2022-1453","title":"RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6031edec-4274-4e42-9e3a-ce0c94958b17?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"9.2.5","to_inclusive":true,"patched_in":"9.2.6"}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:603210ca-7231-4c91-8258-fe3cd6e37425","source":"wordfence","cve":"CVE-2025-11755","title":"Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-10-31T18:07:03Z","updated":"2025-11-01T06:40:39Z"},{"id":"wordfence:6036876a-764d-4f08-96dd-b9b31dbd78b9","source":"wordfence","cve":"CVE-2025-10723","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6036876a-764d-4f08-96dd-b9b31dbd78b9?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":false,"patched_in":"11.1.2"}],"published":"2025-10-24T00:00:00Z","updated":"2026-09-16T23:44:01Z"},{"id":"wordfence:603734a3-f471-4a40-9253-92e0d1ef5ac2","source":"wordfence","cve":"CVE-2025-47650","title":"Infility Global <= 2.15.34 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603734a3-f471-4a40-9253-92e0d1ef5ac2?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.34","to_inclusive":true,"patched_in":"2.15.35"}],"published":"2025-08-14T00:00:00Z","updated":"2026-09-09T15:53:02Z"},{"id":"wordfence:60379757-fe43-4a76-a65a-ee09163dab0a","source":"wordfence","cve":"CVE-2024-25914","title":"SMTP Mail Plugin <= 1.3.20 - Cross Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60379757-fe43-4a76-a65a-ee09163dab0a?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mail","name":"SMTP Mail","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2024-02-12T00:00:00Z","updated":"2024-03-07T17:58:19Z"},{"id":"wordfence:603813a4-73e1-47fd-8a6c-9416d21b6c88","source":"wordfence","cve":"CVE-2024-34385","title":"YITH WooCommerce Wishlist <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603813a4-73e1-47fd-8a6c-9416d21b6c88?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:28:38Z"},{"id":"wordfence:603846de-5d3b-498f-844b-306d80df80da","source":"wordfence","cve":"","title":"Two Factor Authentication (2FA , MFA, OTP SMS and Email) <= 1.0.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603846de-5d3b-498f-844b-306d80df80da?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-security","name":"Two Factor Authentication (2FA , MFA, OTP SMS and Email)","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6038accc-98ac-496c-9c53-ec06b2045324","source":"wordfence","cve":"CVE-2025-10743","title":"Outdoor <= 1.3.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6038accc-98ac-496c-9c53-ec06b2045324?source=api-prod","affected":[{"type":"plugin","slug":"outdoor","name":"Outdoor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:44:47Z","updated":"2025-10-15T08:25:56Z"},{"id":"wordfence:603b1f0e-185c-4a0a-a6a2-c63105b2c9f3","source":"wordfence","cve":"","title":"Finale WooCommerce Sale Countdown <= 2.9.0 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603b1f0e-185c-4a0a-a6a2-c63105b2c9f3?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2019-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:603b6c52-48eb-4e8c-a2c1-77b12a2b1a2c","source":"wordfence","cve":"CVE-2024-0835","title":"Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603b6c52-48eb-4e8c-a2c1-77b12a2b1a2c?source=api-prod","affected":[{"type":"theme","slug":"royal-elementor-kit","name":"Royal Elementor Kit","from":"*","from_inclusive":true,"to":"1.0.116","to_inclusive":true,"patched_in":"1.0.117"}],"published":"2024-02-05T00:00:00Z","updated":"2024-07-29T21:36:26Z"},{"id":"wordfence:603f0c9d-6964-4911-b4a5-bdad24a1a8dd","source":"wordfence","cve":"CVE-2023-2180","title":"Kiwiz - Certification de facturation - Woocommerce <= 2.1.3 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/603f0c9d-6964-4911-b4a5-bdad24a1a8dd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz","name":"Kiwiz - Certification de facturation - Woocommerce","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60405e54-e869-4623-892c-0821014f887b","source":"wordfence","cve":"CVE-2025-1638","title":"Alloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60405e54-e869-4623-892c-0821014f887b?source=api-prod","affected":[{"type":"plugin","slug":"alloggio-membership","name":"Alloggio Membership","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:04Z"},{"id":"wordfence:604123f4-9247-489a-8fc8-478bfc697c7f","source":"wordfence","cve":"CVE-2025-2083","title":"Logo Carousel Gutenberg Block <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604123f4-9247-489a-8fc8-478bfc697c7f?source=api-prod","affected":[{"type":"plugin","slug":"awesome-logo-carousel-block","name":"Awesome Logo Carousel Block","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-04-14T20:36:52Z","updated":"2025-04-15T09:22:17Z"},{"id":"wordfence:60413b3b-f9b0-40ca-af0a-f7cf87ab793a","source":"wordfence","cve":"CVE-2024-13336","title":"Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60413b3b-f9b0-40ca-af0a-f7cf87ab793a?source=api-prod","affected":[{"type":"plugin","slug":"disable-auto-updates","name":"Disable Auto Updates","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:33:55Z","updated":"2025-02-19T08:21:50Z"},{"id":"wordfence:60416ec4-41db-4326-b4c2-e85b09037864","source":"wordfence","cve":"CVE-2026-62083","title":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60416ec4-41db-4326-b4c2-e85b09037864?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T17:48:16Z"},{"id":"wordfence:6041b564-62d1-49bf-a3f7-f4b01d1b5a89","source":"wordfence","cve":"CVE-2025-63024","title":"Order Delivery Date for WooCommerce <= 4.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6041b564-62d1-49bf-a3f7-f4b01d1b5a89?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-12-03T00:00:00Z","updated":"2026-01-06T16:54:54Z"},{"id":"wordfence:604249c6-b23a-40e9-984d-2014f5c97249","source":"wordfence","cve":"CVE-2025-7710","title":"Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604249c6-b23a-40e9-984d-2014f5c97249?source=api-prod","affected":[{"type":"plugin","slug":"bravepopup-pro","name":"Brave Conversion Engine (PRO)","from":"*","from_inclusive":true,"to":"0.7.7","to_inclusive":true,"patched_in":"0.8.0"}],"published":"2025-08-01T21:30:13Z","updated":"2025-08-02T11:23:55Z"},{"id":"wordfence:6042e3d9-cced-43b8-8b3c-eaca9855b842","source":"wordfence","cve":"CVE-2021-24924","title":"Email Log <= 2.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6042e3d9-cced-43b8-8b3c-eaca9855b842?source=api-prod","affected":[{"type":"plugin","slug":"email-log","name":"Email Log","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60440b26-1c0b-4fd0-a74a-ff5900d0e9b8","source":"wordfence","cve":"CVE-2026-7795","title":"Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60440b26-1c0b-4fd0-a74a-ff5900d0e9b8?source=api-prod","affected":[{"type":"plugin","slug":"click-to-chat-for-whatsapp","name":"Click to Chat \u2013 HoliThemes","from":"*","from_inclusive":true,"to":"4.39","to_inclusive":true,"patched_in":"4.40"}],"published":"2026-06-05T13:37:20Z","updated":"2026-06-06T02:28:35Z"},{"id":"wordfence:6045475f-f95a-4618-82ed-e42637d1c1d8","source":"wordfence","cve":"","title":"Easy PayPal Shopping Cart <= 1.1.9 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6045475f-f95a-4618-82ed-e42637d1c1d8?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-shopping-cart","name":"Easy PayPal Shopping Cart","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6045c4fd-60ed-4771-93f4-d4df41ef888b","source":"wordfence","cve":"CVE-2026-14989","title":"Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6045c4fd-60ed-4771-93f4-d4df41ef888b?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-08T19:57:34Z","updated":"2026-09-11T18:46:40Z"},{"id":"wordfence:60470d54-2105-4dc1-8e0c-670e8e22977a","source":"wordfence","cve":"CVE-2025-30580","title":"DigiWidgets Image Editor <= 1.10 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60470d54-2105-4dc1-8e0c-670e8e22977a?source=api-prod","affected":[{"type":"plugin","slug":"digiwidgets-image-editor","name":"DigiWidgets Image Editor","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:59:48Z"},{"id":"wordfence:6047c648-1999-4333-9be9-abe0c17328fb","source":"wordfence","cve":"CVE-2025-49324","title":"Job Board Manager <= 2.1.60 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6047c648-1999-4333-9be9-abe0c17328fb?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":"2.1.61"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:15:34Z"},{"id":"wordfence:604862d9-e032-4806-8a14-3e4ad0ae1ee2","source":"wordfence","cve":"CVE-2024-43319","title":"Flash & HTML5 Video <= 2.5.31 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604862d9-e032-4806-8a14-3e4ad0ae1ee2?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.31","to_inclusive":true,"patched_in":"2.5.32"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:44:37Z"},{"id":"wordfence:60493635-b1b0-4e76-8f73-16c223d7b4d7","source":"wordfence","cve":"CVE-2023-39989","title":"Header Footer Code Manager <= 1.1.34 - Cross-Site Request Forgery via process_bulk_action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60493635-b1b0-4e76-8f73-16c223d7b4d7?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code-manager","name":"Header Footer Code Manager","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":false,"patched_in":"1.1.35"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60496696-7cb9-44b1-a622-7ee427530c9d","source":"wordfence","cve":"CVE-2026-39486","title":"Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60496696-7cb9-44b1-a622-7ee427530c9d?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2026-03-25T00:00:00Z","updated":"2026-04-15T21:24:47Z"},{"id":"wordfence:604975b9-fe2f-4d8f-af13-995f08d72e8f","source":"wordfence","cve":"CVE-2024-1466","title":"Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604975b9-fe2f-4d8f-af13-995f08d72e8f?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:51Z"},{"id":"wordfence:6049996a-514a-44f7-9878-4aa43598842a","source":"wordfence","cve":"CVE-2025-14166","title":"WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6049996a-514a-44f7-9878-4aa43598842a?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2025-12-11T14:32:15Z","updated":"2025-12-12T03:20:46Z"},{"id":"wordfence:604bc8a2-d1e8-477a-b66e-571c4334dff0","source":"wordfence","cve":"CVE-2026-81288","title":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604bc8a2-d1e8-477a-b66e-571c4334dff0?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T13:41:49Z"},{"id":"wordfence:604e81a2-62ba-49c6-81f4-bab2ad8419c2","source":"wordfence","cve":"CVE-2025-26886","title":"PublishPress Authors <= 4.7.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/604e81a2-62ba-49c6-81f4-bab2ad8419c2?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-10T14:41:13Z"},{"id":"wordfence:6054a885-e67a-4731-93ea-64d7f90d9ea8","source":"wordfence","cve":"CVE-2024-4980","title":"WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6054a885-e67a-4731-93ea-64d7f90d9ea8?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.11"}],"published":"2024-05-21T15:42:52Z","updated":"2024-05-22T04:30:33Z"},{"id":"wordfence:6054e4fe-b10e-4c63-877d-05d6662a9251","source":"wordfence","cve":"CVE-2026-65502","title":"Element Pack Addons for Elementor \u2013 Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6054e4fe-b10e-4c63-877d-05d6662a9251?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.7.13","to_inclusive":true,"patched_in":"8.7.14"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-07T18:47:19Z"},{"id":"wordfence:60564e6b-9eea-4bba-b9b9-391a0f37cc95","source":"wordfence","cve":"CVE-2024-47391","title":"Bold Page Builder <= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60564e6b-9eea-4bba-b9b9-391a0f37cc95?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:30:17Z"},{"id":"wordfence:60584089-723c-40de-9719-e8434969308a","source":"wordfence","cve":"CVE-2025-32504","title":"Silvasoft boekhouden <= 3.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60584089-723c-40de-9719-e8434969308a?source=api-prod","affected":[{"type":"plugin","slug":"silvasoft-boekhouden","name":"Silvasoft boekhouden","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-04-10T00:00:00Z","updated":"2026-04-15T13:29:20Z"},{"id":"wordfence:6058da9e-8ca3-4966-bb10-e5da526e8c7e","source":"wordfence","cve":"CVE-2022-38356","title":"Pearl <= 1.3.4 - Cross-Site Request Forgery via stm_save_hb_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6058da9e-8ca3-4966-bb10-e5da526e8c7e?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:605b49a9-caa2-4bcd-8849-eb777b03ab01","source":"wordfence","cve":"CVE-2024-47393","title":"Quill Forms <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605b49a9-caa2-4bcd-8849-eb777b03ab01?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:58:13Z"},{"id":"wordfence:605c6c53-6920-42ba-8784-b3a186bbf821","source":"wordfence","cve":"CVE-2026-8627","title":"Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605c6c53-6920-42ba-8784-b3a186bbf821?source=api-prod","affected":[{"type":"plugin","slug":"correct-prices","name":"Correct Prices","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:08:29Z","updated":"2026-05-20T01:25:48Z"},{"id":"wordfence:605c9d35-886a-4abe-82ce-fee4a2dda611","source":"wordfence","cve":"CVE-2025-69303","title":"ModelTheme Framework < 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605c9d35-886a-4abe-82ce-fee4a2dda611?source=api-prod","affected":[{"type":"plugin","slug":"modeltheme-framework","name":"ModelTheme Framework","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2026-01-28T00:00:00Z","updated":"2026-04-15T13:36:29Z"},{"id":"wordfence:605dae3b-534d-45f3-98bd-150713c34bb7","source":"wordfence","cve":"CVE-2025-22279","title":"JetCompareWishlist <= 1.5.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605dae3b-534d-45f3-98bd-150713c34bb7?source=api-prod","affected":[{"type":"plugin","slug":"jet-compare-wishlist","name":"JetCompareWishlist","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:27:03Z"},{"id":"wordfence:605dc24c-5b6e-479b-98dd-ad80c547824c","source":"wordfence","cve":"CVE-2026-7552","title":"Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605dc24c-5b6e-479b-98dd-ad80c547824c?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.19","to_inclusive":true,"patched_in":"1.13.20"}],"published":"2026-05-27T18:02:30Z","updated":"2026-05-28T06:45:41Z"},{"id":"wordfence:605f53af-42d6-472f-bd5f-d144298d0225","source":"wordfence","cve":"CVE-2026-56065","title":"DOOFINDER Search and Discovery for WP & WooCommerce <= 2.17.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605f53af-42d6-472f-bd5f-d144298d0225?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":true,"patched_in":"2.17.3"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:43:38Z"},{"id":"wordfence:605fac87-e1e8-4354-a9d3-4440e54bc161","source":"wordfence","cve":"CVE-2024-5997","title":"Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605fac87-e1e8-4354-a9d3-4440e54bc161?source=api-prod","affected":[{"type":"plugin","slug":"duplica","name":"Duplica \u2013 Duplicate Posts, Pages, Custom Posts or Users","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":"0.7"}],"published":"2024-07-18T08:55:46Z","updated":"2024-07-18T21:32:39Z"},{"id":"wordfence:605fbfb9-85d8-43ff-a738-ad1a8a9584c3","source":"wordfence","cve":"CVE-2022-46865","title":"Bulk Resize Media <= 1.1 - Cross-Site Request Forgery via bulk_resize_resize_image","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/605fbfb9-85d8-43ff-a738-ad1a8a9584c3?source=api-prod","affected":[{"type":"plugin","slug":"bulk-resize-media","name":"Bulk Resize Media","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6061e628-4616-4002-950c-62d4a69c5918","source":"wordfence","cve":"CVE-2024-51894","title":"Topbar ID for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6061e628-4616-4002-950c-62d4a69c5918?source=api-prod","affected":[{"type":"plugin","slug":"topbar-id-for-elementor","name":"Topbar ID for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:18:36Z"},{"id":"wordfence:60656c97-02ce-4783-bd7d-8be842db3b99","source":"wordfence","cve":"CVE-2025-66154","title":"Couponer for Elementor <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60656c97-02ce-4783-bd7d-8be842db3b99?source=api-prod","affected":[{"type":"plugin","slug":"couponer-elementor","name":"Couponer \u2013 Discount Coupons for Elementor","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:54:34Z"},{"id":"wordfence:60656eff-7851-4b6e-97f4-840c299b1e4e","source":"wordfence","cve":"CVE-2025-12057","title":"WavePlayer <= 3.7.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60656eff-7851-4b6e-97f4-840c299b1e4e?source=api-prod","affected":[{"type":"plugin","slug":"waveplayer","name":"WavePlayer","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-24T21:08:57Z"},{"id":"wordfence:6065ad75-1685-4f1d-9ba9-d4c8ec840521","source":"wordfence","cve":"CVE-2022-4120","title":"Stop Spammers Security <= 2022.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6065ad75-1685-4f1d-9ba9-d4c8ec840521?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2022.5","to_inclusive":true,"patched_in":"2022.6"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6065d77d-33ca-4f54-b485-ff1ce71b5e2b","source":"wordfence","cve":"CVE-2022-4491","title":"WP-Table Reloaded <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6065d77d-33ca-4f54-b485-ff1ce71b5e2b?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-reloaded","name":"WP-Table Reloaded","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60679026-13a3-4702-91a3-876636f3c5bc","source":"wordfence","cve":"CVE-2022-3763","title":"Booster Elite for WooCommerce < 1.1.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60679026-13a3-4702-91a3-876636f3c5bc?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60693832-ff40-4173-95d9-822630e3403e","source":"wordfence","cve":"CVE-2026-39515","title":"Motors \u2013 Car Dealership & Classified Listings Plugin < 1.4.107 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60693832-ff40-4173-95d9-822630e3403e?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.107","to_inclusive":false,"patched_in":"1.4.107"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:57:53Z"},{"id":"wordfence:606a5fe1-d755-4ec0-843b-da3a033b73cf","source":"wordfence","cve":"CVE-2026-16583","title":"Orbit Fox by ThemeIsle <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/606a5fe1-d755-4ec0-843b-da3a033b73cf?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:45:47Z"},{"id":"wordfence:606b9002-5f3a-49ef-9714-49eeac86f800","source":"wordfence","cve":"CVE-2021-24895","title":"Cybersoldier < 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/606b9002-5f3a-49ef-9714-49eeac86f800?source=api-prod","affected":[{"type":"plugin","slug":"cybersoldier","name":"Cybersoldier","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:606f25d9-f8c7-416a-8bb8-0cc57901ff5a","source":"wordfence","cve":"CVE-2026-96256","title":"Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/606f25d9-f8c7-416a-8bb8-0cc57901ff5a?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2026-09-30T20:30:35Z","updated":"2026-10-01T09:26:57Z"},{"id":"wordfence:607073ad-3a4a-4a21-af0f-3ade81382605","source":"wordfence","cve":"CVE-2025-12139","title":"File Manager for Google Drive \u2013 Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607073ad-3a4a-4a21-af0f-3ade81382605?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-11-04T17:38:36Z","updated":"2025-11-05T06:35:00Z"},{"id":"wordfence:60725f12-6219-4c5e-8b5c-e925f0837ddb","source":"wordfence","cve":"CVE-2026-96669","title":"Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60725f12-6219-4c5e-8b5c-e925f0837ddb?source=api-prod","affected":[{"type":"plugin","slug":"food-store","name":"Food Store \u2013 Online Food Delivery & Pickup","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:45:01Z","updated":"2026-10-29T03:39:14Z"},{"id":"wordfence:6074ebd7-d44b-442f-bdef-532ddd865856","source":"wordfence","cve":"CVE-2026-89029","title":"Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6074ebd7-d44b-442f-bdef-532ddd865856?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:18:08Z"},{"id":"wordfence:6077096a-297c-4f15-b52c-ae0532bfece3","source":"wordfence","cve":"CVE-2025-22781","title":"Nativery <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6077096a-297c-4f15-b52c-ae0532bfece3?source=api-prod","affected":[{"type":"plugin","slug":"nativery","name":"Nativery Plugin","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:05:44Z"},{"id":"wordfence:6077a093-b2ec-4491-a4a7-d70b2858d772","source":"wordfence","cve":"CVE-2016-10927","title":"Nelio AB Testing < 4.5.11 - Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6077a093-b2ec-4491-a4a7-d70b2858d772?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":false,"patched_in":"4.5.11"}],"published":"2016-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60782340-8913-4114-8544-109337795f45","source":"wordfence","cve":"CVE-2025-58601","title":"Classified Listing <= 5.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60782340-8913-4114-8544-109337795f45?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:30:11Z"},{"id":"wordfence:607a5846-4112-4f0d-b353-68903b2a4cb8","source":"wordfence","cve":"CVE-2008-0617","title":"DMSGuestbook < 1.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607a5846-4112-4f0d-b353-68903b2a4cb8?source=api-prod","affected":[{"type":"plugin","slug":"dmsguestbook","name":"DMSGuestbook","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":false,"patched_in":"1.9.0"}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:607c20b1-f8da-4f3f-a070-abdae64c8fc8","source":"wordfence","cve":"","title":"Image Slider <= 1.1.95 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607c20b1-f8da-4f3f-a070-abdae64c8fc8?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.95","to_inclusive":true,"patched_in":"1.1.97"}],"published":"2018-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:607d1a6e-2277-4960-a5bd-95e94c510856","source":"wordfence","cve":"","title":"FoodBakery <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607d1a6e-2277-4960-a5bd-95e94c510856?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2020-07-24T00:00:00Z","updated":"2026-04-24T15:28:14Z"},{"id":"wordfence:607d85a5-afad-49ac-9982-d3da0becc052","source":"wordfence","cve":"CVE-2026-16954","title":"AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607d85a5-afad-49ac-9982-d3da0becc052?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-21T15:43:59Z"},{"id":"wordfence:607ea767-8a9f-414a-b6ed-af8335256e60","source":"wordfence","cve":"CVE-2025-69391","title":"Diamond <= 2.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607ea767-8a9f-414a-b6ed-af8335256e60?source=api-prod","affected":[{"type":"theme","slug":"diamond","name":"Diamond","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:46:23Z"},{"id":"wordfence:607ef9eb-3eb7-4eef-98d7-50823a1f7243","source":"wordfence","cve":"CVE-2026-74927","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.13 - 5.0.14 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607ef9eb-3eb7-4eef-98d7-50823a1f7243?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"5.0.13","from_inclusive":true,"to":"5.0.14","to_inclusive":true,"patched_in":"5.0.15"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:20:25Z"},{"id":"wordfence:607f07d8-033f-467c-90bf-834ea2753eaf","source":"wordfence","cve":"CVE-2024-11266","title":"Geocache Stat Bar Widget <= 0.911 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/607f07d8-033f-467c-90bf-834ea2753eaf?source=api-prod","affected":[{"type":"plugin","slug":"geocache-stat-bar-widget","name":"Geocache Stat Bar Widget","from":"*","from_inclusive":true,"to":"0.911","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T00:00:00Z","updated":"2025-05-27T15:13:29Z"},{"id":"wordfence:6082791e-feac-41f7-b565-9d98624ddf50","source":"wordfence","cve":"CVE-2021-4354","title":"PWA for WP & AMP <= 1.7.32 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6082791e-feac-41f7-b565-9d98624ddf50?source=api-prod","affected":[{"type":"plugin","slug":"pwa-for-wp","name":"PWA for WP \u2013 Progressive Web Apps Made Simple","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.7.33"}],"published":"2021-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6082f25f-b060-431b-a18c-65899851bf3b","source":"wordfence","cve":"CVE-2025-12520","title":"WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6082f25f-b060-431b-a18c-65899851bf3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-airbnb-review-slider","name":"WP Airbnb Review Slider","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.4"}],"published":"2025-11-06T00:00:00Z","updated":"2025-11-07T05:29:57Z"},{"id":"wordfence:60830ed8-3ab8-44e8-899c-7032a187da8b","source":"wordfence","cve":"CVE-2025-14001","title":"WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60830ed8-3ab8-44e8-899c-7032a187da8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-duplicate-page","name":"WP Duplicate Page","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-13T11:21:20Z"},{"id":"wordfence:6083232b-7987-467e-8f9c-2b28536e6b5d","source":"wordfence","cve":"CVE-2026-106601","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6083232b-7987-467e-8f9c-2b28536e6b5d?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"16.2","to_inclusive":true,"patched_in":"16.3"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:38:27Z"},{"id":"wordfence:6083c255-48df-498c-ad28-fa8a2e20c67a","source":"wordfence","cve":"CVE-2025-23530","title":"Custom Post Type Lockdown <= 1.11 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6083c255-48df-498c-ad28-fa8a2e20c67a?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-lockdown","name":"Custom Post Type Lockdown WordPress","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:54:12Z"},{"id":"wordfence:60864891-3a26-47da-a3e6-131fed607916","source":"wordfence","cve":"CVE-2025-26926","title":"Booknetic <= 4.0.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60864891-3a26-47da-a3e6-131fed607916?source=api-prod","affected":[{"type":"plugin","slug":"booknetic","name":"Booknetic","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2026-07-14T15:01:42Z"},{"id":"wordfence:60878165-d4cc-4ea1-acf7-9bb6fd48795b","source":"wordfence","cve":"CVE-2026-66695","title":"W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60878165-d4cc-4ea1-acf7-9bb6fd48795b?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T20:18:57Z"},{"id":"wordfence:608b0506-074b-4df3-8c30-57cfb090f553","source":"wordfence","cve":"CVE-2025-6380","title":"ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/608b0506-074b-4df3-8c30-57cfb090f553?source=api-prod","affected":[{"type":"plugin","slug":"onlyoffice","name":"ONLYOFFICE Docs","from":"1.1.0","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-07-23T20:42:24Z","updated":"2025-11-05T21:41:45Z"},{"id":"wordfence:608d46e3-ef56-48b1-b965-b324e68e8a8b","source":"wordfence","cve":"CVE-2026-25443","title":"Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/608d46e3-ef56-48b1-b965-b324e68e8a8b?source=api-prod","affected":[{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T20:01:33Z"},{"id":"wordfence:6091e396-8cd8-4c56-89cb-7699adb3d798","source":"wordfence","cve":"CVE-2025-12123","title":"Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6091e396-8cd8-4c56-89cb-7699adb3d798?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-collector-for-woocommerce","name":"Customer Reviews Collector for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-11-26T16:39:48Z","updated":"2025-11-27T05:17:45Z"},{"id":"wordfence:6091faeb-f8a0-40f3-963c-6c5814219832","source":"wordfence","cve":"CVE-2024-35776","title":"phpinfo() WP <= 5.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6091faeb-f8a0-40f3-963c-6c5814219832?source=api-prod","affected":[{"type":"plugin","slug":"phpinfo-wp","name":"phpinfo() WP \u2013 Site Health, PHP Compatibility & Server Audit","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"6.0"}],"published":"2024-06-19T00:00:00Z","updated":"2024-08-27T14:46:27Z"},{"id":"wordfence:60922f97-0155-43b5-921c-0ffb288a1d2f","source":"wordfence","cve":"CVE-2024-35708","title":"Rife Free <= 2.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60922f97-0155-43b5-921c-0ffb288a1d2f?source=api-prod","affected":[{"type":"theme","slug":"rife-free","name":"Rife Free","from":"*","from_inclusive":true,"to":"2.4.19","to_inclusive":true,"patched_in":"2.4.20"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:01:14Z"},{"id":"wordfence:609424cf-8bba-4dbd-992f-c48b7283e9f4","source":"wordfence","cve":"CVE-2025-31023","title":"Seo Meta Tags <= 1.4 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/609424cf-8bba-4dbd-992f-c48b7283e9f4?source=api-prod","affected":[{"type":"plugin","slug":"seo-meta-tags","name":"Seo Meta Tags","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:53:56Z"},{"id":"wordfence:609a49f3-2af6-4200-8915-4742a504242c","source":"wordfence","cve":"CVE-2026-119488","title":"Pie Register \u2013 User Registration, Profiles & Content Restriction <= 3.8.4.15 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/609a49f3-2af6-4200-8915-4742a504242c?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.15","to_inclusive":true,"patched_in":"3.8.4.16"}],"published":"2026-11-04T07:17:57Z","updated":"2026-11-10T19:27:29Z"},{"id":"wordfence:609d9ecf-4f91-4a78-ad8c-22e436c000ed","source":"wordfence","cve":"CVE-2021-24263","title":"PowerPack Addons for Elementor <= 2.3.1 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/609d9ecf-4f91-4a78-ad8c-22e436c000ed?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:609e1177-15aa-476b-b56b-299495055850","source":"wordfence","cve":"CVE-2026-27419","title":"Zegen - Church WordPress Theme <= 1.1.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/609e1177-15aa-476b-b56b-299495055850?source=api-prod","affected":[{"type":"theme","slug":"zegen","name":"Zegen - Church WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:18:29Z"},{"id":"wordfence:60a35848-1fdd-44c0-a5d4-92abf637e15c","source":"wordfence","cve":"CVE-2024-37949","title":"Responsive Mobile <= 1.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60a35848-1fdd-44c0-a5d4-92abf637e15c?source=api-prod","affected":[{"type":"theme","slug":"responsive-mobile","name":"Responsive Mobile","from":"*","from_inclusive":true,"to":"1.15.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:39:58Z"},{"id":"wordfence:60a574c7-47de-4427-8d38-d510ea996f75","source":"wordfence","cve":"CVE-2023-25041","title":"Monolit <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60a574c7-47de-4427-8d38-d510ea996f75?source=api-prod","affected":[{"type":"theme","slug":"monolit","name":"Monolit","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60a5a6f3-6519-46d0-9197-6c8b3532fa64","source":"wordfence","cve":"CVE-2026-104678","title":"CP Media Player <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60a5a6f3-6519-46d0-9197-6c8b3532fa64?source=api-prod","affected":[{"type":"plugin","slug":"audio-and-video-player","name":"CP Media Player \u2013 Audio Player and Video Player","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:27:54Z"},{"id":"wordfence:60a7cce0-637f-49bd-aa4a-fd7023d99a64","source":"wordfence","cve":"CVE-2024-12824","title":"Nokri \u2013 Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60a7cce0-637f-49bd-aa4a-fd7023d99a64?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-02-28T18:07:17Z","updated":"2025-03-01T06:39:26Z"},{"id":"wordfence:60a8b4b4-a54a-41d2-adff-5bf9d1934b96","source":"wordfence","cve":"CVE-2025-25112","title":"Social Links <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60a8b4b4-a54a-41d2-adff-5bf9d1934b96?source=api-prod","affected":[{"type":"plugin","slug":"social-links","name":"Social Links","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T15:32:01Z"},{"id":"wordfence:60ab0311-888c-46ae-98fe-9e7d4dfe13bf","source":"wordfence","cve":"CVE-2025-14288","title":"Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ab0311-888c-46ae-98fe-9e7d4dfe13bf?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-12-12T15:46:53Z","updated":"2025-12-13T04:31:26Z"},{"id":"wordfence:60ad515a-3c0b-47f5-919b-0d17f693c049","source":"wordfence","cve":"CVE-2026-92294","title":"Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ad515a-3c0b-47f5-919b-0d17f693c049?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.20.4","to_inclusive":true,"patched_in":"2.20.5"}],"published":"2026-10-30T00:00:00Z","updated":"2026-10-31T05:33:08Z"},{"id":"wordfence:60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5","source":"wordfence","cve":"CVE-2023-1282","title":"Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard <= 5.0.6.3 and <= 2.11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ae8b8f-bc65-40df-b6ae-4ec8e328dbe5?source=api-prod","affected":[{"type":"plugin","slug":"drag-n-drop-upload-cf7-pro","name":"Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard","from":"2.0","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"},{"type":"plugin","slug":"drag-n-drop-upload-cf7-pro","name":"Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard","from":"5.0","from_inclusive":true,"to":"5.0.6.3","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60af0a7c-014b-4f71-9918-7ddc1186bee4","source":"wordfence","cve":"CVE-2023-50370","title":"Livemesh Addons for WPBakery Page Builder <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60af0a7c-014b-4f71-9918-7ddc1186bee4?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60b05809-c70d-4670-9d49-d56164961074","source":"wordfence","cve":"CVE-2024-3749","title":"SP Project & Document Manager <= 4.71 - Insecure Direct Object Reference to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60b05809-c70d-4670-9d49-d56164961074?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.71","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:31:18Z"},{"id":"wordfence:60b16755-ac0e-4069-b21a-cca003fecbdc","source":"wordfence","cve":"CVE-2021-24336","title":"FlightLog <= 3.0.2 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60b16755-ac0e-4069-b21a-cca003fecbdc?source=api-prod","affected":[{"type":"plugin","slug":"flightlog","name":"FlightLog","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60b1abeb-b11a-4de7-b747-53b166276a28","source":"wordfence","cve":"CVE-2022-29410","title":"Hermit \u97f3\u4e50\u64ad\u653e\u5668 <= 3.1.6 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60b1abeb-b11a-4de7-b747-53b166276a28?source=api-prod","affected":[{"type":"plugin","slug":"hermit","name":"Hermit \u97f3\u4e50\u64ad\u653e\u5668","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-04-28T12:01:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60ba7f68-1fe1-4349-a3eb-11a63ae11e38","source":"wordfence","cve":"CVE-2023-46613","title":"Add to Calendar Button <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ba7f68-1fe1-4349-a3eb-11a63ae11e38?source=api-prod","affected":[{"type":"plugin","slug":"add-to-calendar-button","name":"Add to Calendar Button","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60bfe2cd-13a7-4739-a7d5-5ce7ed0d9ca8","source":"wordfence","cve":"CVE-2025-32278","title":"Table Block by RioVizual <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60bfe2cd-13a7-4739-a7d5-5ce7ed0d9ca8?source=api-prod","affected":[{"type":"plugin","slug":"riovizual","name":"RioVizual \u2014 Table Blocks for Comparison, Pricing and Pros & Cons","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-08-11T14:21:38Z"},{"id":"wordfence:60c077fa-ac85-4761-838c-b1789b546103","source":"wordfence","cve":"CVE-2026-103079","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c077fa-ac85-4761-838c-b1789b546103?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-05T08:52:00Z","updated":"2026-10-08T23:16:07Z"},{"id":"wordfence:60c0db19-deda-4b95-a341-cf33883dc9b4","source":"wordfence","cve":"CVE-2024-12621","title":"Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c0db19-deda-4b95-a341-cf33883dc9b4?source=api-prod","affected":[{"type":"plugin","slug":"yumpu-epaper-publishing","name":"Yumpu E-Paper publishing","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2025-01-08T21:59:32Z","updated":"2025-02-11T20:49:12Z"},{"id":"wordfence:60c2e8eb-d01b-44f2-8e0d-009ff00887fd","source":"wordfence","cve":"CVE-2022-0720","title":"Appointment and Event Booking Calendar for WordPress - Amelia < 1.0.47 - Arbitrary Booking Update and Sensitive Data Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c2e8eb-d01b-44f2-8e0d-009ff00887fd?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.47","to_inclusive":false,"patched_in":"1.0.47"}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60c57b6c-4dc1-4fa6-bf14-7c5c74c704db","source":"wordfence","cve":"CVE-2026-65434","title":"\u042eKassa \u0434\u043b\u044f WooCommerce <= 2.16.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c57b6c-4dc1-4fa6-bf14-7c5c74c704db?source=api-prod","affected":[{"type":"plugin","slug":"yookassa","name":"\u042eKassa \u0434\u043b\u044f WooCommerce","from":"*","from_inclusive":true,"to":"2.16.1","to_inclusive":true,"patched_in":"2.16.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:07:25Z"},{"id":"wordfence:60c63be2-dd17-4224-ba96-ba30ed0b25ce","source":"wordfence","cve":"CVE-2023-49197","title":"DoFollow Case by Case <= 3.4.2 Cross-Site Request Forgery via getEmail and getUrl","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c63be2-dd17-4224-ba96-ba30ed0b25ce?source=api-prod","affected":[{"type":"plugin","slug":"dofollow-case-by-case","name":"DoFollow Case by Case","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":false,"patched_in":"3.5.0"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60c6c9a8-e04d-49e2-96e8-16d7580a3e2c","source":"wordfence","cve":"CVE-2024-32088","title":"Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.15.20 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c6c9a8-e04d-49e2-96e8-16d7580a3e2c?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.15.20","to_inclusive":true,"patched_in":"6.15.21"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:19:44Z"},{"id":"wordfence:60c8159f-0641-4b75-9d56-34bd13105caf","source":"wordfence","cve":"CVE-2024-11083","title":"ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c8159f-0641-4b75-9d56-34bd13105caf?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.18","to_inclusive":true,"patched_in":"4.15.19"}],"published":"2024-11-26T00:00:00Z","updated":"2024-11-27T05:31:54Z"},{"id":"wordfence:60c96210-d6ed-4838-b2fc-419e6a68f689","source":"wordfence","cve":"CVE-2022-4673","title":"Rate my Post \u2013 WP Rating System <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60c96210-d6ed-4838-b2fc-419e6a68f689?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60cae255-29ca-455f-a8ce-2079251884e4","source":"wordfence","cve":"CVE-2026-22348","title":"Civic Cookie Control <= 1.53 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60cae255-29ca-455f-a8ce-2079251884e4?source=api-prod","affected":[{"type":"plugin","slug":"civic-cookie-control-8","name":"Civic Cookie Control","from":"*","from_inclusive":true,"to":"1.53","to_inclusive":true,"patched_in":"1.54"}],"published":"2025-12-30T00:00:00Z","updated":"2026-02-16T22:12:48Z"},{"id":"wordfence:60cd2178-858e-4e24-8967-13b04f675d2d","source":"wordfence","cve":"CVE-2025-2106","title":"Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60cd2178-858e-4e24-8967-13b04f675d2d?source=api-prod","affected":[{"type":"plugin","slug":"arielbrailovsky-viralad","name":"ArielBrailovsky-ViralAd","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T01:45:26Z"},{"id":"wordfence:60d59753-5b6b-4f3e-8faf-8053750ae05d","source":"wordfence","cve":"CVE-2023-2636","title":"AN_GradeBook <= 5.0.1 - Authenticated (Subscriber+) SQL Injection via 'id'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60d59753-5b6b-4f3e-8faf-8053750ae05d?source=api-prod","affected":[{"type":"plugin","slug":"an-gradebook","name":"GradeBook","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60d65c7e-5533-4ac0-b2f0-339342224581","source":"wordfence","cve":"CVE-2025-11742","title":"WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60d65c7e-5533-4ac0-b2f0-339342224581?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2025-10-17T00:00:00Z","updated":"2025-10-18T05:41:57Z"},{"id":"wordfence:60d7a5c1-7006-412d-897f-16c3105c20c4","source":"wordfence","cve":"CVE-2025-22502","title":"MindValley Super PageMash <= 1.1 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60d7a5c1-7006-412d-897f-16c3105c20c4?source=api-prod","affected":[{"type":"plugin","slug":"mindvalley-pagemash","name":"MindValley Super PageMash","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:54:17Z"},{"id":"wordfence:60d98a7c-b95b-4c56-8356-306e53de4d5a","source":"wordfence","cve":"CVE-2026-28068","title":"Rhythmo <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60d98a7c-b95b-4c56-8356-306e53de4d5a?source=api-prod","affected":[{"type":"theme","slug":"rhythmo","name":"Rythmo","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:45:28Z"},{"id":"wordfence:60dacb8d-0de6-4755-8857-6b05083a23b8","source":"wordfence","cve":"CVE-2026-81780","title":"Hash Form \u2013 Drag & Drop Form Builder <= 1.4.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60dacb8d-0de6-4755-8857-6b05083a23b8?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:52:11Z"},{"id":"wordfence:60db100b-7a09-4ac1-81ec-9b400c9cce47","source":"wordfence","cve":"CVE-2023-49768","title":"WP-FormAssembly <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60db100b-7a09-4ac1-81ec-9b400c9cce47?source=api-prod","affected":[{"type":"plugin","slug":"formassembly-web-forms","name":"WP-FormAssembly","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T13:16:52Z"},{"id":"wordfence:60de55c6-e4fa-453e-84bd-309f2887e3cb","source":"wordfence","cve":"CVE-2023-5110","title":"BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60de55c6-e4fa-453e-84bd-309f2887e3cb?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60dedbdb-1411-4b71-91ef-b2a98cdbb53c","source":"wordfence","cve":"CVE-2025-67620","title":"Anon <= 2.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60dedbdb-1411-4b71-91ef-b2a98cdbb53c?source=api-prod","affected":[{"type":"theme","slug":"anon2x","name":"Anon - Multipurpose Elementor WooCommerce Themes","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T14:13:52Z"},{"id":"wordfence:60e0fd59-a69c-4ddf-80cd-4312d2689397","source":"wordfence","cve":"CVE-2024-3275","title":"eRoom \u2013 Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e0fd59-a69c-4ddf-80cd-4312d2689397?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.4.18","to_inclusive":true,"patched_in":"1.4.19"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-02T16:52:09Z"},{"id":"wordfence:60e2f3d3-c9f0-4d06-960a-6d796a280433","source":"wordfence","cve":"CVE-2024-54234","title":"Limit Login Attempts <= 5.5 - Unauthenticated SQL Injeciton","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e2f3d3-c9f0-4d06-960a-6d796a280433?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-failed-login-attempts","name":"Limit Login Attempts (Spam Protection)","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.6"}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:24:49Z"},{"id":"wordfence:60e3a506-8811-4e7d-a16c-02f91c757705","source":"wordfence","cve":"CVE-2025-14351","title":"Custom Fonts \u2013 Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e3a506-8811-4e7d-a16c-02f91c757705?source=api-prod","affected":[{"type":"plugin","slug":"custom-fonts","name":"Custom Fonts \u2013 Host Your Fonts Locally","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.1.17"}],"published":"2026-01-19T15:16:44Z","updated":"2026-01-20T03:25:17Z"},{"id":"wordfence:60e4c186-5239-464d-be83-1b873f821b3e","source":"wordfence","cve":"","title":"All in One SEO <= 2.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e4c186-5239-464d-be83-1b873f821b3e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2014-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60e642f9-74ff-47f1-a49d-99c8fdb26f4a","source":"wordfence","cve":"CVE-2024-1634","title":"Scheduling Plugin \u2013 Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e642f9-74ff-47f1-a49d-99c8fdb26f4a?source=api-prod","affected":[{"type":"plugin","slug":"calendar-booking","name":"Scheduling Plugin \u2013 Online Booking for WordPress","from":"*","from_inclusive":true,"to":"3.5.10","to_inclusive":true,"patched_in":""}],"published":"2024-06-17T14:10:37Z","updated":"2024-06-18T02:37:13Z"},{"id":"wordfence:60e6b9e0-6e2f-4a2d-b967-cc410ebd3d7d","source":"wordfence","cve":"CVE-2024-5472","title":"WP QuickLaTeX <= 3.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e6b9e0-6e2f-4a2d-b967-cc410ebd3d7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-quicklatex","name":"WP QuickLaTeX","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:04:57Z"},{"id":"wordfence:60e8b120-b9ba-4f56-b47b-b06cf188febc","source":"wordfence","cve":"CVE-2026-81805","title":"SiteSkite MCP AI \u2013 Connector for Claude, ChatGPT, Cursor & WordPress WebOps <= 2.1.5 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e8b120-b9ba-4f56-b47b-b06cf188febc?source=api-prod","affected":[{"type":"plugin","slug":"siteskite","name":"SiteSkite \u2013 Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:41:11Z"},{"id":"wordfence:60e9351a-302b-4a31-8a9c-c0a0b6ee3fcd","source":"wordfence","cve":"CVE-2023-45009","title":"Captcha/Honeypot for Contact Form 7 <= 1.11.3 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60e9351a-302b-4a31-8a9c-c0a0b6ee3fcd?source=api-prod","affected":[{"type":"plugin","slug":"captcha-for-contact-form-7","name":"SilentShield \u2013 Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60ea00e2-e33d-452d-969b-4022d6a00417","source":"wordfence","cve":"CVE-2021-25049","title":"Mobile Events Manager < 1.4.4 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ea00e2-e33d-452d-969b-4022d6a00417?source=api-prod","affected":[{"type":"plugin","slug":"mobile-events-manager","name":"Mobile Events Manager","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2021-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60ed3820-0ef3-415c-a742-d4f9f42418a3","source":"wordfence","cve":"CVE-2026-111408","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ed3820-0ef3-415c-a742-d4f9f42418a3?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.7","to_inclusive":true,"patched_in":"11.2.8"}],"published":"2026-10-17T08:21:45Z","updated":"2026-10-23T18:27:45Z"},{"id":"wordfence:60ed7738-5cba-4fc0-9178-265773555369","source":"wordfence","cve":"CVE-2025-11510","title":"FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ed7738-5cba-4fc0-9178-265773555369?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-10-17T18:24:12Z","updated":"2025-10-18T06:42:47Z"},{"id":"wordfence:60eda1f3-b54c-419d-8813-be60a35dfa1b","source":"wordfence","cve":"CVE-2024-51827","title":"Boombox Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60eda1f3-b54c-419d-8813-be60a35dfa1b?source=api-prod","affected":[{"type":"plugin","slug":"boombox-shortcode","name":"Boombox Shortcode Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:48:20Z"},{"id":"wordfence:60eda41d-7590-4e08-ba6b-6ae3505cfd34","source":"wordfence","cve":"CVE-2025-48128","title":"Sharespine Woocommerce Connector <= 4.7.55 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60eda41d-7590-4e08-ba6b-6ae3505cfd34?source=api-prod","affected":[{"type":"plugin","slug":"sharespine-woocommerce-connector","name":"Sharespine Woocommerce Connector","from":"*","from_inclusive":true,"to":"4.7.55","to_inclusive":true,"patched_in":"4.8.56"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-23T14:16:21Z"},{"id":"wordfence:60ee9cfc-016d-45ee-b3f4-da999d093776","source":"wordfence","cve":"CVE-2023-38480","title":"Booster Elementor Addons <= 1.4.9 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ee9cfc-016d-45ee-b3f4-da999d093776?source=api-prod","affected":[{"type":"plugin","slug":"booster-for-elementor","name":"Booster Elementor Addons","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60ef9840-12c3-408a-b304-3eff2fe33bb4","source":"wordfence","cve":"CVE-2026-89097","title":"Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ef9840-12c3-408a-b304-3eff2fe33bb4?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-12T19:02:58Z","updated":"2026-10-13T07:46:23Z"},{"id":"wordfence:60f043e9-7947-4fff-a9a8-94a1f421db7c","source":"wordfence","cve":"CVE-2023-32244","title":"Woodmart Core <= 1.0.36 - Authentication Bypass to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f043e9-7947-4fff-a9a8-94a1f421db7c?source=api-prod","affected":[{"type":"plugin","slug":"woodmart-core","name":"Woodmart Core","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":"1.0.37"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60f14d59-ab55-45e0-b017-f39bc001eca1","source":"wordfence","cve":"CVE-2026-110885","title":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin <= 1.7.32 - Authenticated (Subscriber+) Arbitrary CSS Injection","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f14d59-ab55-45e0-b017-f39bc001eca1?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:51:06Z"},{"id":"wordfence:60f16abd-951b-48a0-a363-0221f7e0957d","source":"wordfence","cve":"CVE-2024-4473","title":"Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f16abd-951b-48a0-a363-0221f7e0957d?source=api-prod","affected":[{"type":"plugin","slug":"sydney-toolbox","name":"Sydney Toolbox","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":"1.32"}],"published":"2024-05-13T23:40:54Z","updated":"2024-05-14T12:49:59Z"},{"id":"wordfence:60f5f64a-5347-47f5-afff-b103a8ebd750","source":"wordfence","cve":"","title":"Breakdance <= 2.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f5f64a-5347-47f5-afff-b103a8ebd750?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:45:24Z"},{"id":"wordfence:60f63cdc-9c19-4f6c-a555-519bdb61ce6d","source":"wordfence","cve":"","title":"RokMicroNews <= 1.5 - Multiple Vulnerabilities","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f63cdc-9c19-4f6c-a555-519bdb61ce6d?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokmicronews","name":"RokMicroNews","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2013-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:60f7df44-22f9-4a9e-a20c-4b8628674079","source":"wordfence","cve":"CVE-2026-2230","title":"Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60f7df44-22f9-4a9e-a20c-4b8628674079?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.14","to_inclusive":true,"patched_in":"10.14.15"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T16:28:14Z"},{"id":"wordfence:60fb1081-6f1f-40ac-a320-67f53fa7ffe5","source":"wordfence","cve":"CVE-2025-67936","title":"Curly < 3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb1081-6f1f-40ac-a320-67f53fa7ffe5?source=api-prod","affected":[{"type":"theme","slug":"curly","name":"Curly - A Stylish WordPress Theme for Hairdressers and Hair Salons","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T14:27:10Z"},{"id":"wordfence:60fb6928-96fb-4c1f-989c-cc07965b5266","source":"wordfence","cve":"CVE-2025-14044","title":"Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=api-prod","affected":[{"type":"plugin","slug":"logic-pro","name":"Visitor Logic Lite","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:22:32Z","updated":"2025-12-12T03:20:46Z"},{"id":"wordfence:60fd38f8-e864-4011-b9f9-b3fef6551175","source":"wordfence","cve":"CVE-2026-66711","title":"WPML Multilingual & Multicurrency for WooCommerce <= 5.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60fd38f8-e864-4011-b9f9-b3fef6551175?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:35:00Z"},{"id":"wordfence:60fd52f1-9a31-440f-b6ec-d11cc9d0feed","source":"wordfence","cve":"CVE-2025-22582","title":"Uptime Robot <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60fd52f1-9a31-440f-b6ec-d11cc9d0feed?source=api-prod","affected":[{"type":"plugin","slug":"uptime-robot","name":"Uptime Robot","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:26:55Z"},{"id":"wordfence:60fe13d1-704a-4935-af38-03f2c69a9cbe","source":"wordfence","cve":"CVE-2026-27990","title":"ConFix <= 1.013 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60fe13d1-704a-4935-af38-03f2c69a9cbe?source=api-prod","affected":[{"type":"theme","slug":"confix","name":"ConFix - Expo & Events WordPress Theme","from":"*","from_inclusive":true,"to":"1.013","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:58:55Z"},{"id":"wordfence:60feea0c-046e-469f-a964-98c9b83652c2","source":"wordfence","cve":"CVE-2025-68885","title":"Custom Post Status <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60feea0c-046e-469f-a964-98c9b83652c2?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-status","name":"Custom Post Status","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T19:00:39Z"},{"id":"wordfence:60ffe162-5bcd-4ffc-af45-81240751bc62","source":"wordfence","cve":"CVE-2023-2482","title":"Responsive CSS EDITOR <= 1.0 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/60ffe162-5bcd-4ffc-af45-81240751bc62?source=api-prod","affected":[{"type":"plugin","slug":"responsive-css-editor","name":"Responsive CSS EDITOR","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6101c3a2-4284-4b14-995d-06855a8e551d","source":"wordfence","cve":"CVE-2024-11267","title":"JSP Store Locator <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6101c3a2-4284-4b14-995d-06855a8e551d?source=api-prod","affected":[{"type":"plugin","slug":"jsp-store-locator","name":"JSP Store Locator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-27T00:00:00Z","updated":"2025-01-09T14:30:20Z"},{"id":"wordfence:61022086-608d-4980-ad8e-185bb59a707c","source":"wordfence","cve":"CVE-2025-53255","title":"HurryTimer <= 2.13.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61022086-608d-4980-ad8e-185bb59a707c?source=api-prod","affected":[{"type":"plugin","slug":"hurrytimer","name":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-03T12:33:23Z"},{"id":"wordfence:61023d27-3d8d-482b-9193-8b265ac18e41","source":"wordfence","cve":"CVE-2025-22330","title":"MG Parallax Slider <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61023d27-3d8d-482b-9193-8b265ac18e41?source=api-prod","affected":[{"type":"plugin","slug":"mg-parallax-slider","name":"MG Parallax Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:08:18Z"},{"id":"wordfence:61055b07-8dec-4fd7-a7a8-2642fa347d9d","source":"wordfence","cve":"CVE-2025-26867","title":"Bulk <= 1.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61055b07-8dec-4fd7-a7a8-2642fa347d9d?source=api-prod","affected":[{"type":"theme","slug":"bulk","name":"Bulk","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T13:05:35Z"},{"id":"wordfence:61068993-46e2-4ac6-96a4-52c6dcc56b0d","source":"wordfence","cve":"CVE-2024-9663","title":"CYAN Backup <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61068993-46e2-4ac6-96a4-52c6dcc56b0d?source=api-prod","affected":[{"type":"plugin","slug":"cyan-backup","name":"CYAN Backup","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T22:25:22Z"},{"id":"wordfence:6106c972-5475-4c19-8630-3a01edc616ad","source":"wordfence","cve":"CVE-2024-3134","title":"Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6106c972-5475-4c19-8630-3a01edc616ad?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.0","to_inclusive":true,"patched_in":"2.0.6.1"}],"published":"2024-05-16T08:37:20Z","updated":"2024-06-13T13:47:34Z"},{"id":"wordfence:61080df6-836f-4365-964a-fa2517e8be5a","source":"wordfence","cve":"CVE-2024-13410","title":"CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61080df6-836f-4365-964a-fa2517e8be5a?source=api-prod","affected":[{"type":"theme","slug":"tinysalt","name":"TinySalt - Personal Food Blog WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.10.0"},{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T06:57:41Z"},{"id":"wordfence:61084da5-fa8d-4fa9-a6a6-6155e9e25fbc","source":"wordfence","cve":"CVE-2025-1281","title":"BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61084da5-fa8d-4fa9-a6a6-6155e9e25fbc?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.17.1","to_inclusive":false,"patched_in":"3.17.1"}],"published":"2026-09-21T19:37:37Z","updated":"2026-09-22T07:41:12Z"},{"id":"wordfence:61105f6a-1bd7-415d-9481-a1c2c310f778","source":"wordfence","cve":"CVE-2025-12481","title":"WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61105f6a-1bd7-415d-9481-a1c2c310f778?source=api-prod","affected":[{"type":"plugin","slug":"wp-duplicate-page","name":"WP Duplicate Page","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-11-17T21:24:11Z","updated":"2025-11-18T09:27:38Z"},{"id":"wordfence:611074eb-873a-4346-886a-3db61249eafb","source":"wordfence","cve":"CVE-2026-81298","title":"LeadConnector <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611074eb-873a-4346-886a-3db61249eafb?source=api-prod","affected":[{"type":"plugin","slug":"leadconnector","name":"LeadConnector","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:35:29Z"},{"id":"wordfence:6110a3a8-d8f8-41b3-9955-d424d2e8df37","source":"wordfence","cve":"CVE-2026-125782","title":"PowerPress Podcasting plugin by Blubrry <= 11.18.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6110a3a8-d8f8-41b3-9955-d424d2e8df37?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.18.2","to_inclusive":true,"patched_in":"11.18.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:02Z"},{"id":"wordfence:6113e51e-d842-433a-ab0a-92ea108917a3","source":"wordfence","cve":"CVE-2026-65520","title":"WP OAuth Server ( Login with WordPress ) <= 6.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6113e51e-d842-433a-ab0a-92ea108917a3?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-20-server","name":"WP OAuth Server ( Login with WordPress )","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:46:40Z"},{"id":"wordfence:611871cc-737f-44e3-baf5-dbaa8bd8eb81","source":"wordfence","cve":"CVE-2023-6994","title":"List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611871cc-737f-44e3-baf5-dbaa8bd8eb81?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.89.3","to_inclusive":true,"patched_in":"0.89.4"}],"published":"2024-01-09T00:00:00Z","updated":"2024-10-24T19:15:29Z"},{"id":"wordfence:611a2adc-2b0b-460e-b988-d9bcb3f92807","source":"wordfence","cve":"CVE-2025-67986","title":"Document Library Lite <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611a2adc-2b0b-460e-b988-d9bcb3f92807?source=api-prod","affected":[{"type":"plugin","slug":"document-library-lite","name":"Document Library Lite","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:19:10Z"},{"id":"wordfence:611af50f-7f60-4c09-be64-3f2705e06206","source":"wordfence","cve":"CVE-2023-25973","title":"Auto Affiliate Links <= 6.3.0.2 - Cross-Site Request Forgery via aalChangeOptions function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611af50f-7f60-4c09-be64-3f2705e06206?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.3.0.2","to_inclusive":true,"patched_in":"6.3.0.3"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:611b08ee-ffa4-46c2-8d15-06ed949a448c","source":"wordfence","cve":"CVE-2026-96336","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611b08ee-ffa4-46c2-8d15-06ed949a448c?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-10-02T06:42:38Z","updated":"2026-10-13T14:48:29Z"},{"id":"wordfence:611b369d-3ef0-4f03-a9c0-9ef4f4ffae43","source":"wordfence","cve":"CVE-2025-49340","title":"Direct Payments WP <= 1.3.0 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611b369d-3ef0-4f03-a9c0-9ef4f4ffae43?source=api-prod","affected":[{"type":"plugin","slug":"direct-payments-wp","name":"Direct Payments WP \u2013 Receive Payments with Forms","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T19:58:56Z"},{"id":"wordfence:611b88f4-96ae-47e4-8642-e09bee333468","source":"wordfence","cve":"","title":"Royal Custom CSS for Page and Post <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/611b88f4-96ae-47e4-8642-e09bee333468?source=api-prod","affected":[{"type":"plugin","slug":"rt-custom-css-page-and-post","name":"Royal Custom CSS for Page and Post","from":"1.2","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61206bfb-1669-4c67-a9bd-ba3a20ceb810","source":"wordfence","cve":"CVE-2024-32819","title":"Culqi <= 3.0.14 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61206bfb-1669-4c67-a9bd-ba3a20ceb810?source=api-prod","affected":[{"type":"plugin","slug":"culqi-checkout","name":"Culqi","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:46:24Z"},{"id":"wordfence:6122682d-6725-422c-9be8-339e4fb039a7","source":"wordfence","cve":"CVE-2025-52740","title":"Boldermail <= 2.4.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6122682d-6725-422c-9be8-339e4fb039a7?source=api-prod","affected":[{"type":"plugin","slug":"boldermail","name":"Boldermail \u2013 Email Marketing and Newsletters for WordPress","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-05T00:00:00Z","updated":"2025-11-04T18:20:38Z"},{"id":"wordfence:6122c27b-0fed-4112-bc28-4bd4795502e8","source":"wordfence","cve":"CVE-2025-24592","title":"SysBasics Customize My Account for WooCommerce  <= 2.8.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6122c27b-0fed-4112-bc28-4bd4795502e8?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"2.8.22","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-12-21T00:00:00Z","updated":"2025-02-25T14:39:53Z"},{"id":"wordfence:6125a734-c185-4a97-a4fe-a739aa20de13","source":"wordfence","cve":"CVE-2024-53784","title":"Smart Marketing SMS and Newsletters Forms <= 5.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6125a734-c185-4a97-a4fe-a739aa20de13?source=api-prod","affected":[{"type":"plugin","slug":"smart-marketing-for-wp","name":"Smart Marketing SMS and Newsletters Forms","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-11T20:47:11Z"},{"id":"wordfence:6125a8e6-4c87-4136-ba39-c3a089948733","source":"wordfence","cve":"CVE-2023-45643","title":"CPT Shortcode Generator <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6125a8e6-4c87-4136-ba39-c3a089948733?source=api-prod","affected":[{"type":"plugin","slug":"cpt-shortcode","name":"CPT Shortcode Generator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6126ec74-d522-45ff-aa03-07aad5fb75b9","source":"wordfence","cve":"CVE-2025-5720","title":"Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6126ec74-d522-45ff-aa03-07aad5fb75b9?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.80.2","to_inclusive":true,"patched_in":"5.81.0"}],"published":"2025-07-30T16:23:45Z","updated":"2025-07-31T04:26:20Z"},{"id":"wordfence:6127576b-5ce2-4a3e-95de-8a2b3d90d3a0","source":"wordfence","cve":"CVE-2024-12290","title":"Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6127576b-5ce2-4a3e-95de-8a2b3d90d3a0?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2025-01-06T16:09:03Z","updated":"2025-02-24T16:15:30Z"},{"id":"wordfence:612769c3-33e9-47ed-889d-a32017228ef4","source":"wordfence","cve":"CVE-2026-54870","title":"Weaver Xtreme Theme Support <= 7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/612769c3-33e9-47ed-889d-a32017228ef4?source=api-prod","affected":[{"type":"plugin","slug":"weaverx-theme-support","name":"Weaver Xtreme Theme Support","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:33:32Z"},{"id":"wordfence:61279ddc-92cc-4181-ba23-7de1464a9dec","source":"wordfence","cve":"CVE-2026-40775","title":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61279ddc-92cc-4181-ba23-7de1464a9dec?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:41:08Z"},{"id":"wordfence:61293c20-cabe-412d-94d1-1d0326d35a46","source":"wordfence","cve":"CVE-2026-7617","title":"Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61293c20-cabe-412d-94d1-1d0326d35a46?source=api-prod","affected":[{"type":"plugin","slug":"wpoauth","name":"Secufor_OAuth","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:37:57Z","updated":"2026-06-24T05:33:25Z"},{"id":"wordfence:612fb73f-e488-453f-a2a4-32969f91122b","source":"wordfence","cve":"CVE-2023-47876","title":"Perfmatters <= 2.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/612fb73f-e488-453f-a2a4-32969f91122b?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6130d49f-61b7-4b70-b1a5-036346f82650","source":"wordfence","cve":"CVE-2018-25436","title":"Baggage Freight Shipping Australia <= 0.1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6130d49f-61b7-4b70-b1a5-036346f82650?source=api-prod","affected":[{"type":"plugin","slug":"baggage-freight","name":"Baggage Freight Shipping Australia","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2019-01-08T00:00:00Z","updated":"2026-07-29T17:34:41Z"},{"id":"wordfence:6131f5d7-cc67-493f-81d0-12b822d27a0e","source":"wordfence","cve":"CVE-2026-12951","title":"MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6131f5d7-cc67-493f-81d0-12b822d27a0e?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.18","to_inclusive":true,"patched_in":"5.0.19"}],"published":"2026-10-01T18:51:40Z","updated":"2026-10-02T07:39:24Z"},{"id":"wordfence:61322037-ecd0-4db2-997f-9ef943116396","source":"wordfence","cve":"CVE-2026-96568","title":"Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61322037-ecd0-4db2-997f-9ef943116396?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2026-09-24T18:52:09Z","updated":"2026-09-25T07:40:27Z"},{"id":"wordfence:61337d2d-d15a-45f2-b730-fc034eb3cd31","source":"wordfence","cve":"CVE-2025-12492","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61337d2d-d15a-45f2-b730-fc034eb3cd31?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2025-12-19T19:56:17Z","updated":"2025-12-20T08:22:10Z"},{"id":"wordfence:613531ba-0dbb-4c2d-9c40-e11f31cf4575","source":"wordfence","cve":"CVE-2026-118635","title":"GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613531ba-0dbb-4c2d-9c40-e11f31cf4575?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.198","to_inclusive":true,"patched_in":"2.8.199"}],"published":"2026-10-30T16:11:24Z","updated":"2026-10-30T17:15:27Z"},{"id":"wordfence:61365b95-da97-425d-a314-648b3d00236f","source":"wordfence","cve":"CVE-2024-13753","title":"Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61365b95-da97-425d-a314-648b3d00236f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-02-19T21:09:50Z","updated":"2025-04-21T14:44:07Z"},{"id":"wordfence:61374202-2973-48c2-b3d4-3fd23c32996b","source":"wordfence","cve":"CVE-2026-94260","title":"Sifalo Pay \u2013 Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61374202-2973-48c2-b3d4-3fd23c32996b?source=api-prod","affected":[{"type":"plugin","slug":"sifalo-pay","name":"Sifalo Pay","from":"2.0","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:24:37Z"},{"id":"wordfence:6138f184-4475-4288-835f-9bf8c21f9147","source":"wordfence","cve":"CVE-2026-104768","title":"AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6138f184-4475-4288-835f-9bf8c21f9147?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2026-11-06T23:15:57Z","updated":"2026-11-07T11:26:29Z"},{"id":"wordfence:613b2ef8-6749-42a2-a978-c96464ef7470","source":"wordfence","cve":"CVE-2024-56272","title":"Hide Category by User Role for WooCommerce <= 2.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613b2ef8-6749-42a2-a978-c96464ef7470?source=api-prod","affected":[{"type":"plugin","slug":"hide-category-by-user-role-for-woocommerce","name":"Hide Category by User Role for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-23T19:30:16Z"},{"id":"wordfence:613b4ad3-9aea-4c1c-9d73-1fb51da26477","source":"wordfence","cve":"CVE-2024-32573","title":"WP-Lister Lite for eBay <= 3.5.11 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613b4ad3-9aea-4c1c-9d73-1fb51da26477?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:58:00Z"},{"id":"wordfence:613da6f3-3bc1-43f6-a565-bff1d6bc9b74","source":"wordfence","cve":"CVE-2026-25026","title":"Team \u2013 Team Members Showcase Plugin <= 5.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613da6f3-3bc1-43f6-a565-bff1d6bc9b74?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":"5.0.12"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T14:59:12Z"},{"id":"wordfence:613e1862-e0b7-4012-a77d-b5fb56cbbb9c","source":"wordfence","cve":"","title":"360 Product Rotation <= 1.2.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613e1862-e0b7-4012-a77d-b5fb56cbbb9c?source=api-prod","affected":[{"type":"plugin","slug":"360-product-rotation","name":"360 Product Rotation","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2016-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:613e496b-9770-4c7c-adfd-956542816a0a","source":"wordfence","cve":"CVE-2025-69185","title":"Hotel Listing <= 1.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613e496b-9770-4c7c-adfd-956542816a0a?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listings","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:03:34Z"},{"id":"wordfence:613ef6e4-242a-4dae-aad5-123e750a3bc1","source":"wordfence","cve":"CVE-2025-69111","title":"Reisen <= 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613ef6e4-242a-4dae-aad5-123e750a3bc1?source=api-prod","affected":[{"type":"theme","slug":"reisen","name":"Reisen | Auto Store & Car Repair WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:23:12Z"},{"id":"wordfence:613f2035-3061-429b-b218-83805287e4f3","source":"wordfence","cve":"CVE-2025-13342","title":"Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613f2035-3061-429b-b218-83805287e4f3?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.20","to_inclusive":true,"patched_in":"3.28.21"}],"published":"2025-12-03T00:27:58Z","updated":"2025-12-03T12:29:58Z"},{"id":"wordfence:613f22f2-2f84-4d01-a1ea-c14a25843700","source":"wordfence","cve":"CVE-2021-36879","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.5 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613f22f2-2f84-4d01-a1ea-c14a25843700?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T05:17:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:613f4bd1-e29a-4853-84a2-3e1437f06d33","source":"wordfence","cve":"CVE-2022-1905","title":"Events Made Easy <= 2.2.80 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613f4bd1-e29a-4853-84a2-3e1437f06d33?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"2.2.80","to_inclusive":true,"patched_in":"2.2.81"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:613fc64a-1206-4a11-b945-216068b9339a","source":"wordfence","cve":"CVE-2026-9015","title":"Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/613fc64a-1206-4a11-b945-216068b9339a?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.42.0","to_inclusive":true,"patched_in":"1.42.1"}],"published":"2026-05-27T18:52:56Z","updated":"2026-05-28T07:43:43Z"},{"id":"wordfence:6145e2d7-c917-4814-a13e-6d34088cb784","source":"wordfence","cve":"CVE-2025-3418","title":"WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6145e2d7-c917-4814-a13e-6d34088cb784?source=api-prod","affected":[{"type":"plugin","slug":"wpc-admin-columns","name":"WPC Admin Columns","from":"2.0.6","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T06:37:17Z"},{"id":"wordfence:6147582f-578a-47ad-b16c-65c37896783d","source":"wordfence","cve":"CVE-2024-1047","title":"ThemeIsle SDK  <= Various Versions - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"32.0.9","to_inclusive":true,"patched_in":"32.0.10"},{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"},{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.10.6","to_inclusive":true,"patched_in":"3.10.7"},{"type":"plugin","slug":"wp-cloudflare-page-cache","name":"Super Page Cache \u2013 Cloudflare Cache, Page Speed & Core Web Vitals","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"},{"type":"plugin","slug":"tweet-old-post","name":"Revive Social \u2013 Social Media Auto Post and Scheduling Automation Plugin","from":"*","from_inclusive":true,"to":"9.0.25","to_inclusive":true,"patched_in":"9.0.26"},{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"3.12.4","to_inclusive":true,"patched_in":"3.12.5"},{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"},{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"},{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"},{"type":"plugin","slug":"menu-icons","name":"Menu Icons by Themeisle \u2013 Add Icons to Navigation Menus","from":"*","from_inclusive":true,"to":"0.13.8","to_inclusive":true,"patched_in":"0.13.9"},{"type":"plugin","slug":"templates-patterns-collection","name":"Starter Sites & Templates by Neve","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"},{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.28","to_inclusive":true,"patched_in":"2.10.29"}],"published":"2024-02-01T00:00:00Z","updated":"2024-03-01T20:04:42Z"},{"id":"wordfence:61488a15-b49f-4381-9a35-746c39f25967","source":"wordfence","cve":"CVE-2025-14113","title":"Viitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61488a15-b49f-4381-9a35-746c39f25967?source=api-prod","affected":[{"type":"plugin","slug":"viitor-shortcodes","name":"Viitor Button Shortcodes","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:34:48Z","updated":"2026-01-07T09:20:58Z"},{"id":"wordfence:61499424-0002-4e17-81cf-468350e13e20","source":"wordfence","cve":"CVE-2026-85641","title":"Formidable Forms <= 6.34 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61499424-0002-4e17-81cf-468350e13e20?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.34","to_inclusive":true,"patched_in":"6.35"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:43:09Z"},{"id":"wordfence:614bdce2-bd87-4516-b1a5-028ffc08b238","source":"wordfence","cve":"CVE-2025-4775","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/614bdce2-bd87-4516-b1a5-028ffc08b238?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.4.0.1","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2025-06-16T12:28:44Z","updated":"2025-06-17T01:44:10Z"},{"id":"wordfence:614c664b-c95e-49ed-b241-579c32a00bf4","source":"wordfence","cve":"CVE-2025-23783","title":"Greek Namedays Widget From Eortologio.Net <= 20191113 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/614c664b-c95e-49ed-b241-579c32a00bf4?source=api-prod","affected":[{"type":"plugin","slug":"greek-namedays-widget","name":"Greek Namedays Widget From Eortologio.Net","from":"*","from_inclusive":true,"to":"20191113","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:48:26Z"},{"id":"wordfence:614fa053-5e86-4079-8a19-154f30266fe2","source":"wordfence","cve":"CVE-2025-53239","title":"User Registration Aide <= 1.5.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/614fa053-5e86-4079-8a19-154f30266fe2?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-aide","name":"User Registration Aide","from":"*","from_inclusive":true,"to":"1.5.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-08T00:00:00Z","updated":"2025-11-11T17:12:45Z"},{"id":"wordfence:614faf35-9f67-4fda-bb94-356c7b4285b8","source":"wordfence","cve":"CVE-2026-6268","title":"EventPress < 22.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/614faf35-9f67-4fda-bb94-356c7b4285b8?source=api-prod","affected":[{"type":"theme","slug":"eventpress","name":"EventPress","from":"*","from_inclusive":true,"to":"22.2","to_inclusive":false,"patched_in":"22.2"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:19:26Z"},{"id":"wordfence:6150c355-1046-483e-aa8b-463c3752021d","source":"wordfence","cve":"CVE-2023-40679","title":"Master Addons for Elementor <= 2.0.5.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6150c355-1046-483e-aa8b-463c3752021d?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.3","to_inclusive":true,"patched_in":"2.0.5.4.1"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6150fd60-069f-4ba6-8f0c-773039eaaec6","source":"wordfence","cve":"CVE-2023-45642","title":"Snap Pixel <= 1.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6150fd60-069f-4ba6-8f0c-773039eaaec6?source=api-prod","affected":[{"type":"plugin","slug":"snap-pixel","name":"Pixel Integration for Snapchat","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-10-12T00:00:00Z","updated":"2025-08-01T13:57:24Z"},{"id":"wordfence:61516b71-3346-4033-b55b-a35c5b4ca3dc","source":"wordfence","cve":"","title":"Unlimited Pop-Ups < 1.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61516b71-3346-4033-b55b-a35c5b4ca3dc?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-popups","name":"Unlimited PopUps","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6153489c-9e18-4446-8bd8-47745eb56cdf","source":"wordfence","cve":"CVE-2025-62129","title":"RestroPress <= 3.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6153489c-9e18-4446-8bd8-47745eb56cdf?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:29:33Z"},{"id":"wordfence:6153d71e-66c8-49d1-80d8-6a121883172d","source":"wordfence","cve":"CVE-2017-12068","title":"Event List <= 0.7.9 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6153d71e-66c8-49d1-80d8-6a121883172d?source=api-prod","affected":[{"type":"plugin","slug":"event-list","name":"Event List","from":"*","from_inclusive":true,"to":"0.7.9","to_inclusive":true,"patched_in":"0.7.10"}],"published":"2017-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6156a351-d681-4661-9131-62251b715a94","source":"wordfence","cve":"","title":"Role Scoper <= 1.3.64 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6156a351-d681-4661-9131-62251b715a94?source=api-prod","affected":[{"type":"plugin","slug":"role-scoper","name":"Role Scoper (Obsolete \u2013 Please install PublishPress Permissions)","from":"*","from_inclusive":true,"to":"1.3.64","to_inclusive":true,"patched_in":"1.3.65"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61584724-fa1d-4823-af3d-d44501dc1f60","source":"wordfence","cve":"CVE-2022-3415","title":"Chat Bubble <= 2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61584724-fa1d-4823-af3d-d44501dc1f60?source=api-prod","affected":[{"type":"plugin","slug":"chat-bubble","name":"Chat Bubble \u2013 Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61585a02-fe7b-4a54-959f-346e4e0d6658","source":"wordfence","cve":"CVE-2023-30488","title":"Featured Post Creative <= 1.2.7 - Missing Authorization via wpfp_update_featured_post","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61585a02-fe7b-4a54-959f-346e4e0d6658?source=api-prod","affected":[{"type":"plugin","slug":"featured-post-creative","name":"Featured Post Creative","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61589c29-3f81-49e2-b001-c51892141c76","source":"wordfence","cve":"CVE-2024-33539","title":"WPZOOM Addons for Elementor (Templates, Widgets) <= <=1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61589c29-3f81-49e2-b001-c51892141c76?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:01:32Z"},{"id":"wordfence:6158ec37-a6fb-42f9-bab6-bf547ea28ea0","source":"wordfence","cve":"CVE-2024-3499","title":"ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6158ec37-a6fb-42f9-bab6-bf547ea28ea0?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:52:09Z"},{"id":"wordfence:615b4eff-cf92-4d98-857d-c58aa7bd84da","source":"wordfence","cve":"CVE-2025-31450","title":"Toggle Box <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615b4eff-cf92-4d98-857d-c58aa7bd84da?source=api-prod","affected":[{"type":"plugin","slug":"toggle-box","name":"Toggle Box","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:49:42Z"},{"id":"wordfence:615beb4d-c2df-4e1a-8e6b-a393c0fe4834","source":"wordfence","cve":"CVE-2026-23802","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615beb4d-c2df-4e1a-8e6b-a393c0fe4834?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:55:37Z"},{"id":"wordfence:615d35dd-a92e-4910-b0fc-ac0a7d03741a","source":"wordfence","cve":"CVE-2019-15777","title":"WP DSGVO Tools (GDPR) <= 2.2.18 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615d35dd-a92e-4910-b0fc-ac0a7d03741a?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"2.2.19","to_inclusive":false,"patched_in":"2.2.19"}],"published":"2019-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:615d8b8f-037e-4741-bdb4-639daf690aff","source":"wordfence","cve":"CVE-2024-51788","title":"The Novel Design Store Directory <= 4.3.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615d8b8f-037e-4741-bdb4-639daf690aff?source=api-prod","affected":[{"type":"plugin","slug":"noveldesign-store-directory","name":"The Novel Design Store Directory","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:21:23Z"},{"id":"wordfence:615eb349-c5ed-4b6e-bd60-b92b8790427f","source":"wordfence","cve":"CVE-2024-11907","title":"Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615eb349-c5ed-4b6e-bd60-b92b8790427f?source=api-prod","affected":[{"type":"plugin","slug":"skyword-plugin","name":"Skyword XMLRPC publishing","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-01-08T22:00:12Z","updated":"2025-01-24T18:52:39Z"},{"id":"wordfence:615efe27-3f3f-4d99-ba8d-a575608121c8","source":"wordfence","cve":"CVE-2012-5913","title":"WordPress Integrator <= 1.32 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615efe27-3f3f-4d99-ba8d-a575608121c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-integrator","name":"WordPress Integrator","from":"*","from_inclusive":true,"to":"1.32","to_inclusive":true,"patched_in":""}],"published":"2012-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:615f9068-2a42-40c2-aff9-4807b2bd7550","source":"wordfence","cve":"CVE-2026-61966","title":"WPJAM Basic <= 7.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/615f9068-2a42-40c2-aff9-4807b2bd7550?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:50:48Z"},{"id":"wordfence:6164b272-aa12-4ee3-a73a-64882ff5a899","source":"wordfence","cve":"CVE-2025-12132","title":"WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6164b272-aa12-4ee3-a73a-64882ff5a899?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-login-page-logo","name":"WP Custom Admin Login Page Logo","from":"*","from_inclusive":true,"to":"1.4.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:13:26Z","updated":"2025-11-11T03:30:40Z"},{"id":"wordfence:6164bb46-2fb9-49ae-aa5c-9a8b75efc0a6","source":"wordfence","cve":"CVE-2025-60059","title":"smart SEO <= 2.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6164bb46-2fb9-49ae-aa5c-9a8b75efc0a6?source=api-prod","affected":[{"type":"theme","slug":"smartseo","name":"SmartSEO | SEO & Marketing HTML Theme","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:40:46Z"},{"id":"wordfence:6164c161-f764-4064-8139-609caad82204","source":"wordfence","cve":"CVE-2017-1002014","title":"Image Gallery with Slideshow <= 1.5.2 - SQL Injection via gallery_name","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6164c161-f764-4064-8139-609caad82204?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-with-slideshow","name":"Image Gallery with Slideshow Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61684e5a-9ee1-4ae9-b26a-4552af957017","source":"wordfence","cve":"CVE-2017-18541","title":"XO Security < 1.5.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61684e5a-9ee1-4ae9-b26a-4552af957017?source=api-prod","affected":[{"type":"plugin","slug":"xo-security","name":"XO Security","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2017-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:616b00f7-83d6-46e6-93b7-5320095f70a3","source":"wordfence","cve":"CVE-2026-57368","title":"Noo JobMonster <= 4.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/616b00f7-83d6-46e6-93b7-5320095f70a3?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"4.8.5.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T22:09:57Z"},{"id":"wordfence:616b34e8-d853-4176-9fda-427fc9900b97","source":"wordfence","cve":"CVE-2024-22299","title":"FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/616b34e8-d853-4176-9fda-427fc9900b97?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.41.7212","to_inclusive":true,"patched_in":"7.5.44.7212"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-02T20:03:37Z"},{"id":"wordfence:616c65e7-8d0c-4be8-bd6f-f98187ff1539","source":"wordfence","cve":"","title":"User Meta Manager Plugin < 3.4.7 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/616c65e7-8d0c-4be8-bd6f-f98187ff1539?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-manager","name":"User Meta Manager","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":false,"patched_in":"3.4.7"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:616c8ab8-3200-41fb-9d31-5d36873742cb","source":"wordfence","cve":"CVE-2022-1589","title":"Change WP Admin Login <= 1.0.9 - Missing Authorization Checks","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/616c8ab8-3200-41fb-9d31-5d36873742cb?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-admin-login","name":"All In One Login","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:616de170-6645-4a06-a393-51bec1d8bd8c","source":"wordfence","cve":"CVE-2023-46206","title":"MW WP Form <= 4.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/616de170-6645-4a06-a393-51bec1d8bd8c?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61705163-54c6-44c6-8a5f-fe16477d9468","source":"wordfence","cve":"CVE-2025-58610","title":"Gallery PhotoBlocks <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61705163-54c6-44c6-8a5f-fe16477d9468?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:35:33Z"},{"id":"wordfence:61737fea-cf91-4a08-bfec-363aeaca21f7","source":"wordfence","cve":"CVE-2016-10910","title":"FormBuilder <= 1.05 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61737fea-cf91-4a08-bfec-363aeaca21f7?source=api-prod","affected":[{"type":"plugin","slug":"formbuilder","name":"FormBuilder","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":"1.06"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6173d307-9917-4d76-b6bf-d5646b9e33d6","source":"wordfence","cve":"","title":"WP Activity Log 1.5 - 2.4.3 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6173d307-9917-4d76-b6bf-d5646b9e33d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"1.5","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2016-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61771b13-4554-49b8-8829-6345174c4a69","source":"wordfence","cve":"CVE-2024-43137","title":"WappPress <= 6.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61771b13-4554-49b8-8829-6345174c4a69?source=api-prod","affected":[{"type":"plugin","slug":"wapppress-builds-android-app-for-website","name":"WappPress \u2013 Convert Site to App Fast \u2013 WordPress to Mobile App Builder","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:56:19Z"},{"id":"wordfence:617785d7-90b1-482c-bfff-9b5a63741415","source":"wordfence","cve":"CVE-2026-2718","title":"Dealia <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617785d7-90b1-482c-bfff-9b5a63741415?source=api-prod","affected":[{"type":"plugin","slug":"dealia-request-a-quote","name":"Dealia \u2013 Request a quote","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T21:07:11Z","updated":"2026-09-18T19:08:13Z"},{"id":"wordfence:61799fbc-05dc-4de9-90f9-8712ba554607","source":"wordfence","cve":"CVE-2024-32144","title":"Welcart e-Commerce <= 2.9.14 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61799fbc-05dc-4de9-90f9-8712ba554607?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.14","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:52:44Z"},{"id":"wordfence:617afd4e-107a-48ad-9e3e-1771874796ff","source":"wordfence","cve":"CVE-2026-96268","title":"Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617afd4e-107a-48ad-9e3e-1771874796ff?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2026-09-30T20:12:07Z","updated":"2026-10-01T08:28:44Z"},{"id":"wordfence:617b2ef0-dc7b-4032-a145-5eaffb8194c3","source":"wordfence","cve":"CVE-2023-23891","title":"Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617b2ef0-dc7b-4032-a145-5eaffb8194c3?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:617c850f-8d7b-42d4-ac40-2381c4c6bde6","source":"wordfence","cve":"CVE-2022-3392","title":"WP Humans.txt <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617c850f-8d7b-42d4-ac40-2381c4c6bde6?source=api-prod","affected":[{"type":"plugin","slug":"wp-humanstxt","name":"WP Humans.txt","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:617cf3ce-7848-4b87-9801-7733bc5e3da6","source":"wordfence","cve":"CVE-2025-23846","title":"Flexible Blogtitle <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617cf3ce-7848-4b87-9801-7733bc5e3da6?source=api-prod","affected":[{"type":"plugin","slug":"flexible-blogtitle","name":"Flexible Blogtitle","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:16:14Z"},{"id":"wordfence:617dcc0e-e212-4da0-8918-e55e6b3895fa","source":"wordfence","cve":"CVE-2023-32961","title":"Zotpress <= 7.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617dcc0e-e212-4da0-8918-e55e6b3895fa?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.3","to_inclusive":true,"patched_in":"7.3.4"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:617f3062-2848-4c23-89e4-17a0f0d44977","source":"wordfence","cve":"CVE-2019-15328","title":"Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/617f3062-2848-4c23-89e4-17a0f0d44977?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.14.0.3","to_inclusive":false,"patched_in":"1.14.0.3"}],"published":"2019-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61808624-b2c7-4e86-b5a1-56f32fca9eaa","source":"wordfence","cve":"CVE-2023-41667","title":"WP-dTree <= 4.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61808624-b2c7-4e86-b5a1-56f32fca9eaa?source=api-prod","affected":[{"type":"plugin","slug":"wp-dtree-30","name":"WP-dTree","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2023-09-04T00:00:00Z","updated":"2026-10-28T21:05:10Z"},{"id":"wordfence:61820ca5-5548-4155-b350-df3db1bc1661","source":"wordfence","cve":"CVE-2025-4322","title":"Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61820ca5-5548-4155-b350-df3db1bc1661?source=api-prod","affected":[{"type":"theme","slug":"motors","name":"Motors - Car Dealer, Rental & Listing WordPress theme","from":"*","from_inclusive":true,"to":"5.6.67","to_inclusive":true,"patched_in":"5.6.68"}],"published":"2025-05-19T16:51:02Z","updated":"2025-05-20T05:30:48Z"},{"id":"wordfence:61831b3e-4b2a-4fce-8fa2-818aa9991bb2","source":"wordfence","cve":"CVE-2026-15760","title":"Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61831b3e-4b2a-4fce-8fa2-818aa9991bb2?source=api-prod","affected":[{"type":"plugin","slug":"divi-essential","name":"Divi Essentials","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-09-18T13:53:53Z","updated":"2026-09-19T02:27:10Z"},{"id":"wordfence:6186fe48-fc5c-44e3-b998-7d84acb1869e","source":"wordfence","cve":"CVE-2025-28972","title":"WP Employee Attendance System <= 3.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6186fe48-fc5c-44e3-b998-7d84acb1869e?source=api-prod","affected":[{"type":"plugin","slug":"wp-employee-attendance-system","name":"WP Employee Attendance System","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T15:06:06Z"},{"id":"wordfence:618838c1-4fdf-4cf2-b00d-82b50e595692","source":"wordfence","cve":"CVE-2026-111027","title":"Welcart e-Commerce < 2.12.6 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618838c1-4fdf-4cf2-b00d-82b50e595692?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":false,"patched_in":"2.12.6"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:17:45Z"},{"id":"wordfence:618854b9-fa85-4302-9a38-ae5cbd7c7b9f","source":"wordfence","cve":"CVE-2021-24973","title":"Site Reviews <= 5.17.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618854b9-fa85-4302-9a38-ae5cbd7c7b9f?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"5.17.2","to_inclusive":true,"patched_in":"5.17.3"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6189368d-5925-4c84-9f0f-694b9ebcd45e","source":"wordfence","cve":"CVE-2024-2128","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6189368d-5925-4c84-9f0f-694b9ebcd45e?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.9.11"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-07T19:32:59Z"},{"id":"wordfence:618a9ad7-3a13-43e6-84f4-35287f07e1c0","source":"wordfence","cve":"CVE-2024-10285","title":"CE21 Suite <= 2.2.0 - JWT Token Disclosure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618a9ad7-3a13-43e6-84f4-35287f07e1c0?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T02:32:01Z"},{"id":"wordfence:618c72b1-363b-41ad-939d-ab2a3b4d579c","source":"wordfence","cve":"CVE-2024-9388","title":"Black Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618c72b1-363b-41ad-939d-ab2a3b4d579c?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-10-29T22:56:13Z","updated":"2024-10-30T11:01:03Z"},{"id":"wordfence:618e7cb5-82ce-4794-967f-1dbb1ef36bcc","source":"wordfence","cve":"CVE-2025-22765","title":"WP Order By <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618e7cb5-82ce-4794-967f-1dbb1ef36bcc?source=api-prod","affected":[{"type":"plugin","slug":"wp-order-by","name":"WP Order By","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:43:04Z"},{"id":"wordfence:618e92af-a669-42d6-9d95-78c3e8e18f11","source":"wordfence","cve":"CVE-2026-27068","title":"Website LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618e92af-a669-42d6-9d95-78c3e8e18f11?source=api-prod","affected":[{"type":"plugin","slug":"website-llms-txt","name":"Website LLMs.txt","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T14:57:23Z"},{"id":"wordfence:618f5577-4214-45f2-aaa6-e34fbe68aff2","source":"wordfence","cve":"CVE-2025-25084","title":"UniTimetable <= 1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618f5577-4214-45f2-aaa6-e34fbe68aff2?source=api-prod","affected":[{"type":"plugin","slug":"unitimetable","name":"UniTimetable","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:04:17Z"},{"id":"wordfence:618f644b-a92c-4f7f-aaea-c03ee7d6e0f9","source":"wordfence","cve":"","title":"Ultimate Member \u2013 User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read","severity":"critical","cvss":9.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/618f644b-a92c-4f7f-aaea-c03ee7d6e0f9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.45","to_inclusive":true,"patched_in":"2.0.46"}],"published":"2019-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61901d83-0d05-4be8-a318-43bea086293a","source":"wordfence","cve":"CVE-2024-1957","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61901d83-0d05-4be8-a318-43bea086293a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-13T01:57:49Z"},{"id":"wordfence:6193139b-52bf-425c-b1d3-c6fbd9185f06","source":"wordfence","cve":"CVE-2025-67956","title":"User Registration <= 4.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6193139b-52bf-425c-b1d3-c6fbd9185f06?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:53:09Z"},{"id":"wordfence:6197c194-5a17-41da-be79-58a6f5c68a0b","source":"wordfence","cve":"CVE-2024-6553","title":"WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6197c194-5a17-41da-be79-58a6f5c68a0b?source=api-prod","affected":[{"type":"plugin","slug":"wp-meteor","name":"WP Meteor Website Speed Optimization Addon","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T06:42:23Z"},{"id":"wordfence:61989052-ab2c-4874-b27e-3edf8a8b16e1","source":"wordfence","cve":"CVE-2025-27275","title":"WOO Codice Fiscale <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61989052-ab2c-4874-b27e-3edf8a8b16e1?source=api-prod","affected":[{"type":"plugin","slug":"woo-codice-fiscale","name":"WOO Codice Fiscale","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:41:33Z"},{"id":"wordfence:61992821-a053-4bc6-853a-1a826d096746","source":"wordfence","cve":"","title":"Uncanny Toolkit for LearnDash <= 3.6.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61992821-a053-4bc6-853a-1a826d096746?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2022-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6199b852-3270-4456-934b-68c3ef11b9e5","source":"wordfence","cve":"CVE-2026-12536","title":"Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6199b852-3270-4456-934b-68c3ef11b9e5?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-07-13T06:13:13Z","updated":"2026-07-13T19:33:56Z"},{"id":"wordfence:619ca4b6-95bb-4c87-b8db-78e6d6b79384","source":"wordfence","cve":"CVE-2024-9704","title":"Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/619ca4b6-95bb-4c87-b8db-78e6d6b79384?source=api-prod","affected":[{"type":"plugin","slug":"dvk-social-sharing","name":"Social Sharing (by Danny)","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T06:51:13Z"},{"id":"wordfence:61a04c77-28ef-4a3f-8e6c-95a98fcc994d","source":"wordfence","cve":"CVE-2025-31471","title":"Duplicate Page and Post <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a04c77-28ef-4a3f-8e6c-95a98fcc994d?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post-and-page","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:17:43Z"},{"id":"wordfence:61a050bd-deaa-4115-baa5-f63790816450","source":"wordfence","cve":"CVE-2024-43268","title":"Backup and Restore WordPress <= 1.50 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a050bd-deaa-4115-baa5-f63790816450?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.50","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-22T15:37:01Z"},{"id":"wordfence:61a196b5-bad9-481b-8bec-9e902dc52bae","source":"wordfence","cve":"CVE-2025-49942","title":"Gardis <= 1.2.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a196b5-bad9-481b-8bec-9e902dc52bae?source=api-prod","affected":[{"type":"theme","slug":"gardis","name":"Gardis | Blinds and Curtains WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:23:36Z"},{"id":"wordfence:61a3c83f-1910-4c25-9b79-293c75d06e5a","source":"wordfence","cve":"CVE-2021-24631","title":"Unlimited PopUps <= 4.5.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a3c83f-1910-4c25-9b79-293c75d06e5a?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-popups","name":"Unlimited PopUps","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61a4aea3-88a0-428c-8eba-78c9c3397ac9","source":"wordfence","cve":"CVE-2026-65492","title":"Dokan Pro <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a4aea3-88a0-428c-8eba-78c9c3397ac9?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:35:15Z"},{"id":"wordfence:61a63ba6-129a-4ce2-be40-89c2fa44a670","source":"wordfence","cve":"CVE-2024-6770","title":"Lifetime free Drag & Drop Contact Form Builder for WordPress VForm <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a63ba6-129a-4ce2-be40-89c2fa44a670?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-07-30T17:00:44Z","updated":"2024-07-31T05:31:04Z"},{"id":"wordfence:61a643d6-30db-4b9c-98b3-514b616fbd35","source":"wordfence","cve":"CVE-2025-23965","title":"Kopa Nictitate Toolkit <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a643d6-30db-4b9c-98b3-514b616fbd35?source=api-prod","affected":[{"type":"plugin","slug":"kopa-nictitate-toolkit","name":"Kopa Nictitate Toolkit","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:55:58Z"},{"id":"wordfence:61a7be80-8e66-4743-a0bc-e986351fc54d","source":"wordfence","cve":"CVE-2025-26572","title":"WP PHPList <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a7be80-8e66-4743-a0bc-e986351fc54d?source=api-prod","affected":[{"type":"plugin","slug":"phplist-form-integration","name":"WP PHPList","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:36:41Z"},{"id":"wordfence:61a93e58-09e2-4a84-b6ad-853f5c8b5a79","source":"wordfence","cve":"CVE-2026-57379","title":"Contact Form to Chat Apps | Click to Chat to Order \u2013 FormyChat <= 2.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a93e58-09e2-4a84-b6ad-853f5c8b5a79?source=api-prod","affected":[{"type":"plugin","slug":"social-contact-form","name":"Contact Form to Chat Apps | Click to Chat to Order \u2013 FormyChat","from":"*","from_inclusive":true,"to":"2.15.3","to_inclusive":true,"patched_in":"2.15.4"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:34:16Z"},{"id":"wordfence:61a9ad18-28d4-488c-b3a7-e35745f9c83e","source":"wordfence","cve":"CVE-2024-13693","title":"Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61a9ad18-28d4-488c-b3a7-e35745f9c83e?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T09:21:33Z"},{"id":"wordfence:61aaeca4-6b5c-4b00-ab71-bba976d9e1b5","source":"wordfence","cve":"","title":"Lucky Wheel for WooCommerce \u2013 Spin a Sale <= 1.0.10 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61aaeca4-6b5c-4b00-ab71-bba976d9e1b5?source=api-prod","affected":[{"type":"plugin","slug":"woo-lucky-wheel","name":"Lucky Wheel for WooCommerce \u2013 Spin a Sale","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61ab7a28-bcca-41ff-89d1-c083c6b0d39f","source":"wordfence","cve":"CVE-2026-2480","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ab7a28-bcca-41ff-89d1-c083c6b0d39f?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.10","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2026-03-31T10:25:05Z","updated":"2026-03-31T22:26:03Z"},{"id":"wordfence:61ae1dfc-0491-4cf4-b791-2b0cd1426a14","source":"wordfence","cve":"CVE-2026-84224","title":"Kirki <= 6.3.1 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ae1dfc-0491-4cf4-b791-2b0cd1426a14?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:25:29Z"},{"id":"wordfence:61b07604-b206-4f13-b25f-7a6d54236eb1","source":"wordfence","cve":"CVE-2023-28491","title":"Slideshow Gallery LITE <= 1.7.6 - Authenticated(Admin+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b07604-b206-4f13-b25f-7a6d54236eb1?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61b28b8c-4588-4b4e-85e8-d3d37b791f3d","source":"wordfence","cve":"CVE-2020-5768","title":"Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b28b8c-4588-4b4e-85e8-d3d37b791f3d?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":false,"patched_in":"4.5.1"}],"published":"2020-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61b29b61-0a0b-4a6a-b62d-635b43c6906d","source":"wordfence","cve":"CVE-2026-103381","title":"Mintpay <= 2.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b29b61-0a0b-4a6a-b62d-635b43c6906d?source=api-prod","affected":[{"type":"plugin","slug":"mintpay","name":"Mintpay for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:14:07Z"},{"id":"wordfence:61b477c3-88b7-45a4-9fc4-6bca6f7c3604","source":"wordfence","cve":"CVE-2024-9947","title":"ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b477c3-88b7-45a4-9fc4-6bca6f7c3604?source=api-prod","affected":[{"type":"plugin","slug":"profilepress-pro","name":"ProfilePress Pro","from":"*","from_inclusive":true,"to":"4.11.1","to_inclusive":true,"patched_in":"4.11.2"}],"published":"2024-10-22T00:00:00Z","updated":"2025-02-19T17:41:41Z"},{"id":"wordfence:61b4d6a9-ae6f-4ace-a423-d63489b7e698","source":"wordfence","cve":"CVE-2025-69046","title":"iRecco Core <= 1.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b4d6a9-ae6f-4ace-a423-d63489b7e698?source=api-prod","affected":[{"type":"plugin","slug":"irecco-core","name":"iRecco Core","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:26:50Z"},{"id":"wordfence:61b590f5-7854-42f7-b5e2-e6feaaf03a73","source":"wordfence","cve":"CVE-2025-13558","title":"Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b590f5-7854-42f7-b5e2-e6feaaf03a73?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.7.0","to_inclusive":true,"patched_in":"8.7.1"}],"published":"2025-11-24T15:38:42Z","updated":"2026-01-16T13:14:17Z"},{"id":"wordfence:61b9f259-644e-4172-bd99-704b59ec5493","source":"wordfence","cve":"CVE-2026-6417","title":"GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61b9f259-644e-4172-bd99-704b59ec5493?source=api-prod","affected":[{"type":"plugin","slug":"gls-shipping-for-woocommerce","name":"GLS Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-05-13T17:16:15Z","updated":"2026-05-14T05:30:30Z"},{"id":"wordfence:61bac919-90be-4fb5-859a-d135e87fe0bb","source":"wordfence","cve":"CVE-2024-0326","title":"Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via onClick Events","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bac919-90be-4fb5-859a-d135e87fe0bb?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.18","to_inclusive":true,"patched_in":"4.10.19"}],"published":"2024-02-14T00:00:00Z","updated":"2024-07-29T22:45:25Z"},{"id":"wordfence:61bbd7fe-cacf-4390-b976-3b931fc84af3","source":"wordfence","cve":"CVE-2018-21006","title":"bbPress Move Topics <= 1.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bbd7fe-cacf-4390-b976-3b931fc84af3?source=api-prod","affected":[{"type":"plugin","slug":"bbp-move-topics","name":"bbPress Move Topics","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2018-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61bbf0a0-7ba7-450c-9270-1000a8f46eca","source":"wordfence","cve":"CVE-2026-13153","title":"Essential Blocks <= 6.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bbf0a0-7ba7-450c-9270-1000a8f46eca?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-17T16:12:23Z"},{"id":"wordfence:61bc71cf-aeaf-4f33-8367-68d5e8ea442c","source":"wordfence","cve":"CVE-2024-54376","title":"EazyDocs <= 2.8.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bc71cf-aeaf-4f33-8367-68d5e8ea442c?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-12-11T00:00:00Z","updated":"2026-01-06T20:27:28Z"},{"id":"wordfence:61bd2f32-23a2-4dfe-90f3-81d597b97592","source":"wordfence","cve":"CVE-2022-2657","title":"Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace <= 3.8.11.8 - Multiple Unprotected AJAX Actions","severity":"high","cvss":7.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bd2f32-23a2-4dfe-90f3-81d597b97592?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.8.11.8","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61bfd639-7472-4d86-a0f5-c18e3cbe65bd","source":"wordfence","cve":"CVE-2026-80439","title":"Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61bfd639-7472-4d86-a0f5-c18e3cbe65bd?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"2.2.7","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:50:36Z"},{"id":"wordfence:61c37908-8851-4576-90f3-b582fabe5b63","source":"wordfence","cve":"CVE-2026-19723","title":"Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c37908-8851-4576-90f3-b582fabe5b63?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:15:09Z"},{"id":"wordfence:61c39f5f-3b17-4e4d-824e-241159a73400","source":"wordfence","cve":"CVE-2023-2301","title":"Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c39f5f-3b17-4e4d-824e-241159a73400?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-a-meeting-scheduler-by-vcita","name":"Contact Form Builder by vcita","from":"*","from_inclusive":true,"to":"4.10.3","to_inclusive":true,"patched_in":"4.10.5"}],"published":"2023-06-02T00:00:00Z","updated":"2025-03-18T20:00:59Z"},{"id":"wordfence:61c3a517-70c8-4fc2-b8d6-1dcb2ad811d8","source":"wordfence","cve":"CVE-2024-2141","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c3a517-70c8-4fc2-b8d6-1dcb2ad811d8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T06:44:45Z"},{"id":"wordfence:61c3dfdd-6fb1-4939-9aa0-ff32336fd6c8","source":"wordfence","cve":"CVE-2025-30955","title":"ListingEasy <= 1.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c3dfdd-6fb1-4939-9aa0-ff32336fd6c8?source=api-prod","affected":[{"type":"theme","slug":"listingeasy","name":"ListingEasy - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T19:26:18Z"},{"id":"wordfence:61c5253c-0c0c-4026-bf04-ea5bb2985358","source":"wordfence","cve":"CVE-2026-14196","title":"WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c5253c-0c0c-4026-bf04-ea5bb2985358?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T21:05:35Z"},{"id":"wordfence:61c71bbf-ddae-4f35-ac8d-9753fb3fb67f","source":"wordfence","cve":"CVE-2023-49169","title":"Ads by datafeedr.com <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c71bbf-ddae-4f35-ac8d-9753fb3fb67f?source=api-prod","affected":[{"type":"plugin","slug":"ads-by-datafeedrcom","name":"Ads by datafeedr.com","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61c815c2-a5ea-431c-bfde-c08a4eb5fda6","source":"wordfence","cve":"CVE-2023-40560","title":"Schedule Posts Calendar <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c815c2-a5ea-431c-bfde-c08a4eb5fda6?source=api-prod","affected":[{"type":"plugin","slug":"schedule-posts-calendar","name":"Schedule Posts Calendar","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61c8874b-006d-4d84-aa69-7286f11d215a","source":"wordfence","cve":"CVE-2025-27271","title":"DB Tables Import/Export <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61c8874b-006d-4d84-aa69-7286f11d215a?source=api-prod","affected":[{"type":"plugin","slug":"db-tables-importexport","name":"DB Tables Import/Export","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:33:13Z"},{"id":"wordfence:61ca5ab6-5fe9-4313-9b0d-8736663d0e89","source":"wordfence","cve":"CVE-2024-1210","title":"LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ca5ab6-5fe9-4313-9b0d-8736663d0e89?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.10.2"}],"published":"2024-02-02T00:00:00Z","updated":"2026-03-10T16:30:07Z"},{"id":"wordfence:61ccba6d-ac82-4ee1-8463-02e2ad5681ab","source":"wordfence","cve":"CVE-2025-46470","title":"Smart Hashtags [#hashtagger] <= 7.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ccba6d-ac82-4ee1-8463-02e2ad5681ab?source=api-prod","affected":[{"type":"plugin","slug":"hashtagger","name":"Smart Hashtags [#hashtagger]","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:43:41Z"},{"id":"wordfence:61ce76cc-4895-46f7-b6c9-5bc652b1c73c","source":"wordfence","cve":"CVE-2026-28003","title":"Maspik \u2013 Spam blacklist <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ce76cc-4895-46f7-b6c9-5bc652b1c73c?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T22:02:26Z"},{"id":"wordfence:61d065d0-d61e-4e65-99ae-eded211681ac","source":"wordfence","cve":"CVE-2026-97638","title":"Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.3.1","to_inclusive":true,"patched_in":"1.58.0"}],"published":"2026-10-30T16:39:05Z","updated":"2026-10-30T17:15:27Z"},{"id":"wordfence:61d18897-8ebd-454b-9642-7f43a0603490","source":"wordfence","cve":"CVE-2026-15958","title":"Easy Dropbox Integration <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d18897-8ebd-454b-9642-7f43a0603490?source=api-prod","affected":[{"type":"plugin","slug":"easy-dropbox-integration","name":"Easy Integration for Dropbox \u2013 File Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:32:24Z"},{"id":"wordfence:61d1bc0e-f66f-4bc3-9dfe-2fa19f07999f","source":"wordfence","cve":"CVE-2026-73357","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d1bc0e-f66f-4bc3-9dfe-2fa19f07999f?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.6","to_inclusive":false,"patched_in":"4.16.6"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-13T19:00:40Z"},{"id":"wordfence:61d23b9f-7e84-4a24-acaf-e96a87e1ea7f","source":"wordfence","cve":"CVE-2026-25451","title":"Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d23b9f-7e84-4a24-acaf-e96a87e1ea7f?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-01-20T00:00:00Z","updated":"2026-04-15T13:35:00Z"},{"id":"wordfence:61d26907-32bc-4dbf-9bbe-d1c72dfab3bc","source":"wordfence","cve":"CVE-2025-31058","title":"Revolution Video Player <= 2.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d26907-32bc-4dbf-9bbe-d1c72dfab3bc?source=api-prod","affected":[{"type":"plugin","slug":"revolution_video_player","name":"Revolution Video Player With Bottom Playlist WordPress Plugin - YouTube/Vimeo/Self-Hosted Support","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T20:13:30Z"},{"id":"wordfence:61d32d2e-1ca0-4a45-8c4d-b6584c2e7c9e","source":"wordfence","cve":"CVE-2026-57758","title":"Permalink Manager for WooCommerce <= 1.0.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d32d2e-1ca0-4a45-8c4d-b6584c2e7c9e?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager-for-woocommerce","name":"Permalink Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8.3","to_inclusive":true,"patched_in":"1.0.8.4"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:18:22Z"},{"id":"wordfence:61d3cb97-f12b-4480-88fc-2bdcbf4cdae3","source":"wordfence","cve":"CVE-2024-12541","title":"Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d3cb97-f12b-4480-88fc-2bdcbf4cdae3?source=api-prod","affected":[{"type":"plugin","slug":"chative-live-chat-and-chatbot","name":"Chative Live chat and Chatbot","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-06T15:09:12Z","updated":"2025-01-09T14:45:03Z"},{"id":"wordfence:61d3f1f4-4cb9-4dd2-bda7-d08b2ccdbcba","source":"wordfence","cve":"CVE-2020-6168","title":"Minimal Coming Soon & Maintenance Mode <= 2.10 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d3f1f4-4cb9-4dd2-bda7-d08b2ccdbcba?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.15","to_inclusive":false,"patched_in":"2.15"}],"published":"2019-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61d56713-59af-4ad9-8744-6c6a5e5fe213","source":"wordfence","cve":"CVE-2025-4592","title":"AI Image Lab \u2013 Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d56713-59af-4ad9-8744-6c6a5e5fe213?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-generator-lab","name":"AI Image Lab \u2013 Free AI Image Generator","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:41:34Z","updated":"2025-06-14T08:23:26Z"},{"id":"wordfence:61d63c5a-6ca6-42d8-ab0a-152d9c95945c","source":"wordfence","cve":"CVE-2026-4911","title":"Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d63c5a-6ca6-42d8-ab0a-152d9c95945c?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.06","to_inclusive":true,"patched_in":"1.7.07"}],"published":"2026-04-27T18:18:55Z","updated":"2026-04-28T06:45:49Z"},{"id":"wordfence:61d6b2b8-dcaa-4419-b61d-4def743def95","source":"wordfence","cve":"CVE-2021-24478","title":"Bookshelf <= 2.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d6b2b8-dcaa-4419-b61d-4def743def95?source=api-prod","affected":[{"type":"plugin","slug":"bookshelf","name":"Bookshelf","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61d731cb-2c1b-4835-b8ea-4d1b330fdad9","source":"wordfence","cve":"CVE-2015-10119","title":"View All Post's Pages <= 0.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d731cb-2c1b-4835-b8ea-4d1b330fdad9?source=api-prod","affected":[{"type":"plugin","slug":"view-all-posts-pages","name":"View All Post's Pages","from":"*","from_inclusive":true,"to":"0.9.0","to_inclusive":true,"patched_in":"0.9.1"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61d820ce-73e5-4db0-b3dd-b327edb0a5ad","source":"wordfence","cve":"CVE-2026-119152","title":"Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d820ce-73e5-4db0-b3dd-b327edb0a5ad?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2026-11-06T14:08:11Z","updated":"2026-11-07T02:29:16Z"},{"id":"wordfence:61d8cbab-c83a-46d9-a730-084f4a2d68df","source":"wordfence","cve":"CVE-2025-39413","title":"Simple Sitemap \u2013 Create a Responsive HTML Sitemap <= 3.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d8cbab-c83a-46d9-a730-084f4a2d68df?source=api-prod","affected":[{"type":"plugin","slug":"simple-sitemap","name":"Simple Sitemap \u2013 Responsive HTML Sitemap for WordPress","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-05-21T13:58:18Z"},{"id":"wordfence:61df94e9-0fda-4c0f-941b-090a6f4562e8","source":"wordfence","cve":"CVE-2025-53216","title":"Glamer <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61df94e9-0fda-4c0f-941b-090a6f4562e8?source=api-prod","affected":[{"type":"theme","slug":"glamer","name":"Glamer","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:14:59Z"},{"id":"wordfence:61e107e8-405a-4f14-b0ff-b9a66b7ccf8b","source":"wordfence","cve":"CVE-2025-58222","title":"Team Manager <= 2.3.16 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61e107e8-405a-4f14-b0ff-b9a66b7ccf8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-team-manager","name":"Dynamic Team Manager \u2013 Team Member Showcase with grid, slider, table  Elementor widget & shortcode","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:34:04Z"},{"id":"wordfence:61e375e9-0d68-4a16-9a93-4277d51b6b90","source":"wordfence","cve":"CVE-2024-56302","title":"ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61e375e9-0d68-4a16-9a93-4277d51b6b90?source=api-prod","affected":[{"type":"plugin","slug":"convertcalculator","name":"ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:05:27Z"},{"id":"wordfence:61e6a0db-0af5-4b26-9d16-5e5663500f56","source":"wordfence","cve":"CVE-2025-58829","title":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.3.9 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61e6a0db-0af5-4b26-9d16-5e5663500f56?source=api-prod","affected":[{"type":"plugin","slug":"ai-auto-tool","name":"Ai Auto Tool Content Writing Assistant All in One","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-09-05T00:00:00Z","updated":"2026-08-14T15:15:06Z"},{"id":"wordfence:61e6db2f-5dfd-44ef-9500-9f0cb5cd67ba","source":"wordfence","cve":"","title":"WP Job Manager <= 1.29.2 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61e6db2f-5dfd-44ef-9500-9f0cb5cd67ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"1.29.2","to_inclusive":true,"patched_in":"1.29.3"}],"published":"2018-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61ec0772-8b3a-41de-b484-f0cd56db47c6","source":"wordfence","cve":"CVE-2024-13729","title":"Podlove Podcast Publisher <= 4.1.23 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ec0772-8b3a-41de-b484-f0cd56db47c6?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-23T15:13:56Z"},{"id":"wordfence:61ec0e78-b367-438f-929d-94e055c83477","source":"wordfence","cve":"CVE-2023-47646","title":"Recently viewed and most viewed products <= 1.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ec0e78-b367-438f-929d-94e055c83477?source=api-prod","affected":[{"type":"plugin","slug":"recently-viewed-and-most-viewed-products","name":"Recently viewed and most viewed products","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61ec7f34-d18d-4ee8-adbf-ec1219772e67","source":"wordfence","cve":"CVE-2026-32529","title":"Molla - eCommerce HTML5 Template < 1.5.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ec7f34-d18d-4ee8-adbf-ec1219772e67?source=api-prod","affected":[{"type":"theme","slug":"molla","name":"Molla - eCommerce HTML5 Template","from":"*","from_inclusive":true,"to":"1.5.19","to_inclusive":false,"patched_in":"1.5.19"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:37:55Z"},{"id":"wordfence:61ee1857-aa85-4d37-a347-a1f59c95cbff","source":"wordfence","cve":"CVE-2026-15012","title":"Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61ee1857-aa85-4d37-a347-a1f59c95cbff?source=api-prod","affected":[{"type":"plugin","slug":"demi-backup-migration","name":"Demi \u2013 One Click Demo Import, Backup & Site Migration","from":"*","from_inclusive":true,"to":"0.0.8","to_inclusive":true,"patched_in":"0.0.9"}],"published":"2026-07-27T16:40:06Z","updated":"2026-07-28T05:39:42Z"},{"id":"wordfence:61f27c69-a044-4749-b553-899580c9f06a","source":"wordfence","cve":"CVE-2026-28178","title":"Powerkit \u2013 Supercharge your WordPress Site <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61f27c69-a044-4749-b553-899580c9f06a?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:19:50Z"},{"id":"wordfence:61f63fc3-90c1-42de-8db0-c99abc90369f","source":"wordfence","cve":"CVE-2025-49422","title":"iframe Wrapper <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61f63fc3-90c1-42de-8db0-c99abc90369f?source=api-prod","affected":[{"type":"plugin","slug":"iframe-wrapper","name":"iframe Wrapper","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-25T17:23:34Z"},{"id":"wordfence:61f7e01e-c9ce-47f6-96d0-de908ce7e90c","source":"wordfence","cve":"CVE-2023-2487","title":"WP Ultimate Exporter <= 2.4.1 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61f7e01e-c9ce-47f6-96d0-de908ce7e90c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61fbc1dd-06c9-409b-8cad-3f350b38dfc3","source":"wordfence","cve":"CVE-2026-110653","title":"Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-10-16T14:24:52Z","updated":"2026-10-29T18:25:42Z"},{"id":"wordfence:61fce18a-44ec-442f-879e-f4ceab93d972","source":"wordfence","cve":"CVE-2024-9118","title":"QS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61fce18a-44ec-442f-879e-f4ceab93d972?source=api-prod","affected":[{"type":"plugin","slug":"qs-dark-mode","name":"QS Dark Mode Plugin","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-09-30T21:09:08Z","updated":"2024-10-01T09:30:31Z"},{"id":"wordfence:61fdc6e9-75ea-4226-9527-a5fd02efde70","source":"wordfence","cve":"CVE-2019-25139","title":"Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61fdc6e9-75ea-4226-9527-a5fd02efde70?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon","name":"Coming Soon Page & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2019-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:61fe349c-a66c-466f-b1a0-efa443f2548c","source":"wordfence","cve":"CVE-2026-123473","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61fe349c-a66c-466f-b1a0-efa443f2548c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.51.0","to_inclusive":true,"patched_in":"3.51.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:11Z"},{"id":"wordfence:61fe8efe-b51c-4cf4-8a5e-12fa2c0b48df","source":"wordfence","cve":"CVE-2025-50017","title":"WP Voting Contest <= 5.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61fe8efe-b51c-4cf4-8a5e-12fa2c0b48df?source=api-prod","affected":[{"type":"plugin","slug":"wp-voting-contest","name":"WP Voting Contest Lite","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T18:00:33Z"},{"id":"wordfence:62005d06-7d3e-4c4d-b1e0-03ba253e0169","source":"wordfence","cve":"","title":"WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API URL Bindings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62005d06-7d3e-4c4d-b1e0-03ba253e0169?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.4.14"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T19:11:17Z"},{"id":"wordfence:6200d57b-a62c-434f-a194-9199a1e39304","source":"wordfence","cve":"CVE-2025-60123","title":"HivePress Claim Listings <= 1.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6200d57b-a62c-434f-a194-9199a1e39304?source=api-prod","affected":[{"type":"plugin","slug":"hivepress-claim-listings","name":"HivePress Claim Listings","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:20:00Z"},{"id":"wordfence:62022a7d-26b5-4278-81d4-44526dce47fe","source":"wordfence","cve":"CVE-2026-88926","title":"VikRentItems Flexible Rental Management System <= 1.2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62022a7d-26b5-4278-81d4-44526dce47fe?source=api-prod","affected":[{"type":"plugin","slug":"vikrentitems","name":"VikRentItems Flexible Rental Management System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:02:37Z"},{"id":"wordfence:62029ce5-ab97-4594-93e6-469ef5692320","source":"wordfence","cve":"CVE-2023-41861","title":"Restrict <= 2.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62029ce5-ab97-4594-93e6-469ef5692320?source=api-prod","affected":[{"type":"plugin","slug":"restricted-content","name":"Restrict \u2013 membership, site, content and user access restrictions for WordPress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6203a15d-f90f-4147-8e43-afc424bbb750","source":"wordfence","cve":"CVE-2024-2334","title":"Template Kit \u2013 Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6203a15d-f90f-4147-8e43-afc424bbb750?source=api-prod","affected":[{"type":"plugin","slug":"template-kit-import","name":"Template Kit \u2013 Import","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2024-04-01T00:00:00Z","updated":"2024-07-31T15:55:38Z"},{"id":"wordfence:6203ffaf-5efd-4c66-85f0-cc3a05a03084","source":"wordfence","cve":"CVE-2026-3535","title":"DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-google-web-fonts-gdpr","name":"DSGVO Google Web Fonts GDPR","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:40:04Z","updated":"2026-04-08T06:43:39Z"},{"id":"wordfence:6205b0fe-6c68-4550-b9aa-87c3fbc88ddf","source":"wordfence","cve":"","title":"Simple Slideshow Manager <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":7.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6205b0fe-6c68-4550-b9aa-87c3fbc88ddf?source=api-prod","affected":[{"type":"plugin","slug":"simple-slideshow-manager","name":"Simple Slideshow Manager","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62061cf9-cdbf-4cb2-9890-36bdcbc65c21","source":"wordfence","cve":"CVE-2022-1663","title":"Stop Spam Comments <= 0.2.1.2 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62061cf9-cdbf-4cb2-9890-36bdcbc65c21?source=api-prod","affected":[{"type":"plugin","slug":"stop-spam-comments","name":"Stop Spam Comments","from":"*","from_inclusive":true,"to":"0.2.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6206a2f8-2de4-4c9f-b439-3c733a5a0a62","source":"wordfence","cve":"CVE-2025-32927","title":"WP FoodBakery <= 3.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6206a2f8-2de4-4c9f-b439-3c733a5a0a62?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:15:16Z"},{"id":"wordfence:6208afdb-502c-44e8-b50a-22fa87ee80df","source":"wordfence","cve":"CVE-2018-16967","title":"File Manager <= 3.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6208afdb-502c-44e8-b50a-22fa87ee80df?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2018-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6208b87a-496c-404c-ac2e-0cc709cc5a5c","source":"wordfence","cve":"CVE-2016-20084","title":"Booking Calendar Contact Form <= 1.1.24 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6208b87a-496c-404c-ac2e-0cc709cc5a5c?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-18T00:52:01Z"},{"id":"wordfence:620bd934-327e-4509-a5e0-b910654af29b","source":"wordfence","cve":"CVE-2026-18062","title":"Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/620bd934-327e-4509-a5e0-b910654af29b?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.8.1","to_inclusive":true,"patched_in":"3.7.8.2"}],"published":"2026-07-31T19:39:46Z","updated":"2026-08-01T07:49:47Z"},{"id":"wordfence:620e8931-64f0-4d9c-9a4c-1f5a703845ff","source":"wordfence","cve":"CVE-2024-27954","title":"Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/620e8931-64f0-4d9c-9a4c-1f5a703845ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.92.0","to_inclusive":true,"patched_in":"3.92.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:44:20Z"},{"id":"wordfence:620f251e-1e14-4ec7-a47e-27a5e9101f73","source":"wordfence","cve":"CVE-2025-49881","title":"Responsive Blocks <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/620f251e-1e14-4ec7-a47e-27a5e9101f73?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:10:25Z"},{"id":"wordfence:62128061-1ecc-484c-a054-4925f9ac6105","source":"wordfence","cve":"CVE-2014-100018","title":"Unconfirmed < 1.2.5 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62128061-1ecc-484c-a054-4925f9ac6105?source=api-prod","affected":[{"type":"plugin","slug":"unconfirmed","name":"Unconfirmed","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2014-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:621412c6-83fc-4770-ac8d-d76cb9b7f6e4","source":"wordfence","cve":"CVE-2026-16281","title":"Classified Listing <= 6.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621412c6-83fc-4770-ac8d-d76cb9b7f6e4?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-10T19:23:32Z"},{"id":"wordfence:6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d","source":"wordfence","cve":"CVE-2024-2472","title":"LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR","severity":"critical","cvss":9.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"LatePoint Plugin","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"4.9.9.1"}],"published":"2024-06-13T21:00:45Z","updated":"2024-06-14T12:07:41Z"},{"id":"wordfence:62193886-0455-408c-93a2-efd6f679fe95","source":"wordfence","cve":"CVE-2026-114183","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62193886-0455-408c-93a2-efd6f679fe95?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:39:28Z"},{"id":"wordfence:621a86c7-ec42-473f-b3d0-29c8e821482a","source":"wordfence","cve":"CVE-2026-111405","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621a86c7-ec42-473f-b3d0-29c8e821482a?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.1","to_inclusive":true,"patched_in":"8.16.2"}],"published":"2026-10-16T12:30:00Z","updated":"2026-10-23T18:42:14Z"},{"id":"wordfence:621ac54b-b73e-41e4-94b1-10f18c77a09d","source":"wordfence","cve":"CVE-2025-39561","title":"LoginWP - Pro <= 4.0.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621ac54b-b73e-41e4-94b1-10f18c77a09d?source=api-prod","affected":[{"type":"plugin","slug":"loginwp-pro","name":"LoginWP - Pro","from":"*","from_inclusive":true,"to":"4.0.8.5","to_inclusive":true,"patched_in":"4.0.8.6"}],"published":"2025-07-07T00:00:00Z","updated":"2025-12-12T22:34:25Z"},{"id":"wordfence:621e3b3f-9647-41ec-aa06-e961e3525fea","source":"wordfence","cve":"CVE-2022-3879","title":"Car Dealer <= 3.04 - Missing Authorization to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621e3b3f-9647-41ec-aa06-e961e3525fea?source=api-prod","affected":[{"type":"plugin","slug":"cardealer","name":"Car Dealer (Dealership) and Vehicle sales","from":"*","from_inclusive":true,"to":"3.04","to_inclusive":true,"patched_in":"3.05"}],"published":"2022-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:621ef583-bf99-4b81-ae9c-b4f1c86b86aa","source":"wordfence","cve":"CVE-2024-3593","title":"UberMenu <= 3.8.3 - Cross-Site Request Forgery to Settings Reset","severity":"high","cvss":7.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=api-prod","affected":[{"type":"plugin","slug":"ubermenu","name":"UberMenu","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2024-06-21T16:39:04Z","updated":"2024-06-22T05:47:58Z"},{"id":"wordfence:621f85da-8688-46ab-ac32-56036bddf674","source":"wordfence","cve":"CVE-2026-25395","title":"Business Roy <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/621f85da-8688-46ab-ac32-56036bddf674?source=api-prod","affected":[{"type":"theme","slug":"business-roy","name":"Business Roy","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-26T19:53:32Z"},{"id":"wordfence:6222d255-47cc-469a-850d-fc11d7860d75","source":"wordfence","cve":"CVE-2025-49034","title":"Funnel Builder by FunnelKit <= 3.10.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6222d255-47cc-469a-850d-fc11d7860d75?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:49:06Z"},{"id":"wordfence:62233370-3b54-4d89-93e7-07afdae4a413","source":"wordfence","cve":"CVE-2023-51685","title":"WP Review Slider <= 12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62233370-3b54-4d89-93e7-07afdae4a413?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":true,"patched_in":"12.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:622676ee-7cdc-414e-9dcc-e4b74b512430","source":"wordfence","cve":"CVE-2025-66529","title":"Chartify <= 3.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/622676ee-7cdc-414e-9dcc-e4b74b512430?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-12-03T00:00:00Z","updated":"2025-12-11T16:04:03Z"},{"id":"wordfence:622b9b46-774d-4251-9a79-73e5b398de57","source":"wordfence","cve":"CVE-2023-6880","title":"Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/622b9b46-774d-4251-9a79-73e5b398de57?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.6.0","to_inclusive":true,"patched_in":"45.7.0"}],"published":"2024-02-29T00:00:00Z","updated":"2024-07-29T21:36:28Z"},{"id":"wordfence:622ee6c8-7739-44ae-b88f-63a93c0a9b20","source":"wordfence","cve":"CVE-2026-4139","title":"mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/622ee6c8-7739-44ae-b88f-63a93c0a9b20?source=api-prod","affected":[{"type":"plugin","slug":"mcatfilter","name":"mCatFilter","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:04Z","updated":"2026-04-22T07:45:36Z"},{"id":"wordfence:6230275e-8742-40f4-869f-a0e0984d85ba","source":"wordfence","cve":"CVE-2024-3937","title":"Playlist for Youtube <= 1.32 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6230275e-8742-40f4-869f-a0e0984d85ba?source=api-prod","affected":[{"type":"plugin","slug":"playlist-for-youtube","name":"Playlist for Youtube","from":"*","from_inclusive":true,"to":"1.32","to_inclusive":true,"patched_in":"1.40"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-30T18:32:14Z"},{"id":"wordfence:6231e47e-2120-4746-97c1-2aa80aa18f4e","source":"wordfence","cve":"CVE-2024-32693","title":"WordPress Automatic Plugin <= 3.92.1 Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6231e47e-2120-4746-97c1-2aa80aa18f4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.92.1","to_inclusive":true,"patched_in":"3.93.0"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T12:50:39Z"},{"id":"wordfence:62388f45-2f13-45c8-b2a0-dbeb6ec76244","source":"wordfence","cve":"CVE-2025-39528","title":"Rescue Shortcodes <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62388f45-2f13-45c8-b2a0-dbeb6ec76244?source=api-prod","affected":[{"type":"plugin","slug":"rescue-shortcodes","name":"Rescue Shortcodes","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-10-10T20:50:09Z"},{"id":"wordfence:623acb6d-9cab-483c-ad51-88adff8847a4","source":"wordfence","cve":"CVE-2016-10917","title":"Search Everything <= 8.1.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/623acb6d-9cab-483c-ad51-88adff8847a4?source=api-prod","affected":[{"type":"plugin","slug":"search-everything","name":"Search Everything","from":"*","from_inclusive":true,"to":"8.1.6","to_inclusive":false,"patched_in":"8.1.6"}],"published":"2016-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:623b139e-c5a1-4d2e-b05c-72707f421ef8","source":"wordfence","cve":"CVE-2024-31379","title":"Smash Balloon Social Post Feed <= 4.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/623b139e-c5a1-4d2e-b05c-72707f421ef8?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:20:52Z"},{"id":"wordfence:623c2cd3-bd19-41f3-9633-956cdf141850","source":"wordfence","cve":"CVE-2025-31073","title":"Unlimited <= 1.45 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/623c2cd3-bd19-41f3-9633-956cdf141850?source=api-prod","affected":[{"type":"theme","slug":"unlimited","name":"Unlimited","from":"*","from_inclusive":true,"to":"1.45","to_inclusive":true,"patched_in":"1.46"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:51:26Z"},{"id":"wordfence:623decc5-bdb7-42c9-8531-8004ddc16682","source":"wordfence","cve":"CVE-2023-1088","title":"WP Plugin Manager <= 1.1.7 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/623decc5-bdb7-42c9-8531-8004ddc16682?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-manager","name":"WP Plugin Manager \u2013 Deactivate plugins per page","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62402e53-ff46-410e-9cc1-a87b677e6526","source":"wordfence","cve":"CVE-2022-3537","title":"Role Based Pricing for WooCommerce <= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62402e53-ff46-410e-9cc1-a87b677e6526?source=api-prod","affected":[{"type":"plugin","slug":"role-based-pricing-for-woocommerce","name":"Role Based Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:624054bd-e4c9-4bff-83a1-abc58687f194","source":"wordfence","cve":"CVE-2026-92423","title":"Meow Gallery <= 5.5.4 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624054bd-e4c9-4bff-83a1-abc58687f194?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:08:11Z"},{"id":"wordfence:6244104e-3ac1-4984-b1cf-52514ceafa6f","source":"wordfence","cve":"CVE-2026-32444","title":"Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6244104e-3ac1-4984-b1cf-52514ceafa6f?source=api-prod","affected":[{"type":"plugin","slug":"cwicly","name":"Cwicly","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-03T16:25:29Z"},{"id":"wordfence:62456419-4814-4130-ae3b-302e82f0d91d","source":"wordfence","cve":"CVE-2025-54732","title":"WPDM \u2013 Premium Packages <= 6.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62456419-4814-4130-ae3b-302e82f0d91d?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:44:50Z"},{"id":"wordfence:6245d74b-89ad-4229-8c99-dbfeaa048400","source":"wordfence","cve":"CVE-2022-4576","title":"Easy Bootstrap Shortcode <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6245d74b-89ad-4229-8c99-dbfeaa048400?source=api-prod","affected":[{"type":"plugin","slug":"easy-bootstrap-shortcodes","name":"Easy Bootstrap Shortcode","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62475d8f-a0f6-45ab-abd0-ad24e1887c91","source":"wordfence","cve":"CVE-2024-3230","title":"Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62475d8f-a0f6-45ab-abd0-ad24e1887c91?source=api-prod","affected":[{"type":"plugin","slug":"download-attachments","name":"Download Attachments","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-03T16:38:52Z","updated":"2024-07-01T14:58:04Z"},{"id":"wordfence:624a3174-03fa-4a8e-9c02-5e24add92392","source":"wordfence","cve":"CVE-2023-44473","title":"Table of Contents Plus <= 2302 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624a3174-03fa-4a8e-9c02-5e24add92392?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-plus","name":"Table of Contents Plus \u2013 Automatic Table of Contents for Posts & Pages","from":"*","from_inclusive":true,"to":"2302","to_inclusive":true,"patched_in":"2309"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:624a87c7-d43e-48d5-8489-d4f7b3ea10da","source":"wordfence","cve":"CVE-2017-1000038","title":"Relevanssi \u2013 A Better Search <= 3.5.7.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624a87c7-d43e-48d5-8489-d4f7b3ea10da?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":false,"patched_in":"3.5.8"}],"published":"2017-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:624af5e1-dc40-4d33-bfac-1a409b81a096","source":"wordfence","cve":"","title":"SpeakOut! Email Petitions <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624af5e1-dc40-4d33-bfac-1a409b81a096?source=api-prod","affected":[{"type":"plugin","slug":"speakout","name":"SpeakOut! Email Petitions","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2022-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:624bdb9e-6c50-4a00-9a04-1a32c938d48b","source":"wordfence","cve":"CVE-2024-7656","title":"Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624bdb9e-6c50-4a00-9a04-1a32c938d48b?source=api-prod","affected":[{"type":"plugin","slug":"devvn-image-hotspot","name":"Image Hotspot by DevVN","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-24T11:36:25Z"},{"id":"wordfence:624c98c2-3fce-4f6b-a049-da3bce2a8c6a","source":"wordfence","cve":"CVE-2025-46474","title":"SEUR Oficial <= 2.2.23 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624c98c2-3fce-4f6b-a049-da3bce2a8c6a?source=api-prod","affected":[{"type":"plugin","slug":"seur","name":"SEUR Oficial","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2025-04-25T00:00:00Z","updated":"2025-05-07T13:53:45Z"},{"id":"wordfence:624d9627-0ffc-409f-beb7-60e80177aa9b","source":"wordfence","cve":"CVE-2023-29430","title":"TheRoof <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624d9627-0ffc-409f-beb7-60e80177aa9b?source=api-prod","affected":[{"type":"theme","slug":"theroof","name":"TheRoof","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:624f1107-6bcb-485a-8474-012ae63cb14a","source":"wordfence","cve":"CVE-2026-14840","title":"YOP Poll  7.0.0-7.0.5 - IP Spoofing to Vote Restriction Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/624f1107-6bcb-485a-8474-012ae63cb14a?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"7.0.0","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:14:21Z"},{"id":"wordfence:6251d0f6-b536-4122-8fdf-bb77665a4f41","source":"wordfence","cve":"CVE-2024-9350","title":"DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6251d0f6-b536-4122-8fdf-bb77665a4f41?source=api-prod","affected":[{"type":"plugin","slug":"woo-shipping-dpd-baltic","name":"DPD Baltic Shipping","from":"*","from_inclusive":true,"to":"1.2.83","to_inclusive":true,"patched_in":"1.2.84"}],"published":"2024-10-17T15:44:41Z","updated":"2024-10-23T16:13:59Z"},{"id":"wordfence:6252f038-f3ae-41f1-8a5b-0557d3e1252f","source":"wordfence","cve":"CVE-2024-47396","title":"Move Addons for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6252f038-f3ae-41f1-8a5b-0557d3e1252f?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:11:26Z"},{"id":"wordfence:62559fd6-a338-4f0f-ab1a-33fffbdc687e","source":"wordfence","cve":"","title":"WordPress RSS Feed Retriever <= 1.6.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62559fd6-a338-4f0f-ab1a-33fffbdc687e?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-retriever","name":"RSS Feed Retriever","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6257739a-cd7c-4797-882a-016a01fe84b4","source":"wordfence","cve":"CVE-2023-2779","title":"Social Share, Social Login and Social Comments <= 7.13.51 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6257739a-cd7c-4797-882a-016a01fe84b4?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.52","to_inclusive":false,"patched_in":"7.13.52"}],"published":"2023-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:625c1df5-6655-4319-8833-5519b464e53e","source":"wordfence","cve":"CVE-2023-44234","title":"WP GPX Map <= 1.7.05 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/625c1df5-6655-4319-8833-5519b464e53e?source=api-prod","affected":[{"type":"plugin","slug":"wp-gpx-maps","name":"WP GPX Maps \u2013 GPX, FIT & KML maps with elevation profile","from":"*","from_inclusive":true,"to":"1.7.05","to_inclusive":true,"patched_in":"1.7.06"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:625d2b09-a6b9-4c0c-8c36-3c565e688aac","source":"wordfence","cve":"CVE-2025-13693","title":"Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/625d2b09-a6b9-4c0c-8c36-3c565e688aac?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2025-12-20T14:53:25Z","updated":"2025-12-21T03:20:05Z"},{"id":"wordfence:625ff95c-932c-42df-84fc-e1d9b430d3b6","source":"wordfence","cve":"CVE-2026-66584","title":"12 Step Meeting List <= 3.19.16 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/625ff95c-932c-42df-84fc-e1d9b430d3b6?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.19.16","to_inclusive":true,"patched_in":"3.19.17"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:02:06Z"},{"id":"wordfence:6260eb1c-41c0-453d-aee2-be129e566146","source":"wordfence","cve":"CVE-2024-56267","title":"Interactive UK Map <= 3.4.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6260eb1c-41c0-453d-aee2-be129e566146?source=api-prod","affected":[{"type":"plugin","slug":"interactive-uk-map","name":"Interactive UK Map","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T19:09:36Z"},{"id":"wordfence:6260ecfd-6109-4061-af70-9f170e030c76","source":"wordfence","cve":"CVE-2025-60043","title":"Wanderic <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6260ecfd-6109-4061-af70-9f170e030c76?source=api-prod","affected":[{"type":"theme","slug":"wanderic","name":"Wanderic - Travel Blog & Lifestyle WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:37:21Z"},{"id":"wordfence:62623042-8d31-44df-b31a-874a9aa9dcb3","source":"wordfence","cve":"CVE-2025-30875","title":"WP Weixin <= 1.3.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62623042-8d31-44df-b31a-874a9aa9dcb3?source=api-prod","affected":[{"type":"theme","slug":"wp-weixin","name":"wp-weixin","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":"1.3.17"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:31:14Z"},{"id":"wordfence:6263e0cd-5843-444d-8d12-61a898a77724","source":"wordfence","cve":"CVE-2021-25073","title":"WP125 <= 1.5.4 -  Cross-Site Request Forgery to Arbitrary Ad Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6263e0cd-5843-444d-8d12-61a898a77724?source=api-prod","affected":[{"type":"plugin","slug":"wp125","name":"WP125","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2021-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62654952-830d-430c-b852-11ba8652716d","source":"wordfence","cve":"CVE-2025-67515","title":"Wilm\u00ebr < 3.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62654952-830d-430c-b852-11ba8652716d?source=api-prod","affected":[{"type":"theme","slug":"wilmer","name":"Wilm\u00ebr - Construction WordPress Theme","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":false,"patched_in":"3.5"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:12:50Z"},{"id":"wordfence:6266a45a-dfc2-43f8-9699-0f695a183cdd","source":"wordfence","cve":"CVE-2026-81769","title":"Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6266a45a-dfc2-43f8-9699-0f695a183cdd?source=api-prod","affected":[{"type":"plugin","slug":"booking-hub","name":"Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T14:02:08Z"},{"id":"wordfence:62687f24-4be2-49de-9a7d-265325b0f72b","source":"wordfence","cve":"","title":"Dewplayer <= 1.2 and Advanced Dewplayer < 1.5 - Content Spoofing/Injection","severity":"high","cvss":8.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62687f24-4be2-49de-9a7d-265325b0f72b?source=api-prod","affected":[{"type":"plugin","slug":"dewplayer-flash-mp3-player","name":"Dewplayer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"advanced-dewplayer","name":"Advanced Dewplayer","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2013-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:626c82a1-4157-4294-9563-08accccf2a10","source":"wordfence","cve":"CVE-2024-11433","title":"Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/626c82a1-4157-4294-9563-08accccf2a10?source=api-prod","affected":[{"type":"plugin","slug":"surbma-salesautopilot-shortcode","name":"Surbma | SalesAutopilot Shortcode","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:16:08Z","updated":"2025-07-25T19:39:47Z"},{"id":"wordfence:626dac34-6b25-42c9-8f7d-9899e4bcc039","source":"wordfence","cve":"CVE-2024-6767","title":"WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/626dac34-6b25-42c9-8f7d-9899e4bcc039?source=api-prod","affected":[{"type":"plugin","slug":"wordsurvey","name":"WordSurvey","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:26:14Z","updated":"2024-08-21T05:30:20Z"},{"id":"wordfence:626ea1f2-df66-4903-9cbe-7186cf62291b","source":"wordfence","cve":"CVE-2021-24679","title":"Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/626ea1f2-df66-4903-9cbe-7186cf62291b?source=api-prod","affected":[{"type":"plugin","slug":"woo-altcoin-payment-gateway","name":"Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62731e0e-8843-4f79-b887-c595fbefae26","source":"wordfence","cve":"CVE-2024-5545","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62731e0e-8843-4f79-b887-c595fbefae26?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2024-07-01T18:52:36Z","updated":"2024-07-02T07:37:06Z"},{"id":"wordfence:6274adb0-5785-4f8e-b3d2-5d79f08329ec","source":"wordfence","cve":"CVE-2025-26574","title":"Google Drive WP Media <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6274adb0-5785-4f8e-b3d2-5d79f08329ec?source=api-prod","affected":[{"type":"plugin","slug":"google-drive-wp-media","name":"Google Drive WP Media","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:40:58Z"},{"id":"wordfence:6276a405-4879-4429-8fc1-2d567ded5112","source":"wordfence","cve":"CVE-2024-1204","title":"Meta Box \u2013 WordPress Custom Fields Framework <= 5.9.3 - Authenticated (Contributor+) Information Exposure via Post Meta","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6276a405-4879-4429-8fc1-2d567ded5112?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-23T14:21:22Z"},{"id":"wordfence:6277495a-f3a6-4f5a-9cec-2c0b293015b6","source":"wordfence","cve":"CVE-2025-28977","title":"WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6277495a-f3a6-4f5a-9cec-2c0b293015b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2026-02-04T03:25:32Z"},{"id":"wordfence:6278c70a-7b25-45f0-bc64-ecb231e1bf55","source":"wordfence","cve":"","title":"Contact Bank \u2013 Contact Form Builder for WordPress < 2.1.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6278c70a-7b25-45f0-bc64-ecb231e1bf55?source=api-prod","affected":[{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.1.23","to_inclusive":false,"patched_in":"2.1.23"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:627c5dbc-2196-487c-82b0-756468bb9ec4","source":"wordfence","cve":"CVE-2026-16602","title":"Content Protector (Passster) <= 4.3.5 - Unauthenticated Non-Public Post Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/627c5dbc-2196-487c-82b0-756468bb9ec4?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:42:06Z"},{"id":"wordfence:627cb8f8-3684-48ab-953e-555f84cfb32d","source":"wordfence","cve":"CVE-2024-37224","title":"SP Project & Document Manager  <= 4.71 - Authenticated (Subscriber+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/627cb8f8-3684-48ab-953e-555f84cfb32d?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.71","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:50:13Z"},{"id":"wordfence:627eb000-086e-408a-8123-063fed6364be","source":"wordfence","cve":"CVE-2025-12075","title":"Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/627eb000-086e-408a-8123-063fed6364be?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-splitter","name":"Order Splitter for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2026-02-17T16:30:12Z","updated":"2026-02-18T04:35:43Z"},{"id":"wordfence:62801fc2-76ea-46a3-8af9-3a249325cc07","source":"wordfence","cve":"CVE-2026-96821","title":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.0.12 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62801fc2-76ea-46a3-8af9-3a249325cc07?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:48:15Z"},{"id":"wordfence:62805bc2-16e6-4252-bea1-5c2b69cf9bc8","source":"wordfence","cve":"CVE-2024-29093","title":"Builder for WooCommerce reviews shortcodes \u2013 ReviewShort <= 1.01.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62805bc2-16e6-4252-bea1-5c2b69cf9bc8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-reviews-shortcode","name":"Builder for WooCommerce product reviews shortcodes \u2013 ReviewShort","from":"*","from_inclusive":true,"to":"1.01.3","to_inclusive":true,"patched_in":"1.01.4"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:38:04Z"},{"id":"wordfence:6280f40e-2998-43d4-a78f-b393e4f36df5","source":"wordfence","cve":"CVE-2026-17153","title":"AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6280f40e-2998-43d4-a78f-b393e4f36df5?source=api-prod","affected":[{"type":"plugin","slug":"sg-ai-studio","name":"AI Agent by SiteGround","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-08-19T17:11:18Z","updated":"2026-08-20T05:30:45Z"},{"id":"wordfence:62813e66-5b1c-4aae-b6e4-37d71515c54c","source":"wordfence","cve":"CVE-2025-47686","title":"DELUCKS SEO <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62813e66-5b1c-4aae-b6e4-37d71515c54c?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-07-08T15:20:43Z"},{"id":"wordfence:62831b8a-2c6c-44cd-9ed1-f188893bed35","source":"wordfence","cve":"CVE-2022-41615","title":"Store Locator WordPress <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62831b8a-2c6c-44cd-9ed1-f188893bed35?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6283a020-3b2a-4327-811f-957a1af16662","source":"wordfence","cve":"CVE-2026-17016","title":"Restore PayPal Standard for WooCommerce < 3.1.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6283a020-3b2a-4327-811f-957a1af16662?source=api-prod","affected":[{"type":"plugin","slug":"restore-paypal-standard-for-woocommerce","name":"Accept PayPal & Stripe with Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-23T14:29:31Z"},{"id":"wordfence:62876268-b019-4717-bb8e-36dc4a5ad489","source":"wordfence","cve":"CVE-2025-24706","title":"WC Marketplace <= 4.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62876268-b019-4717-bb8e-36dc4a5ad489?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.13","to_inclusive":true,"patched_in":"4.2.14"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:34:35Z"},{"id":"wordfence:6288e6a8-d65f-48e0-bd71-fa3bab46f4a8","source":"wordfence","cve":"CVE-2025-49326","title":"GamiPress <= 7.4.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6288e6a8-d65f-48e0-bd71-fa3bab46f4a8?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.4.5","to_inclusive":true,"patched_in":"7.4.6"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:47:28Z"},{"id":"wordfence:6288fddf-926f-4506-94de-696e0a23766d","source":"wordfence","cve":"CVE-2024-0614","title":"Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6288fddf-926f-4506-94de-696e0a23766d?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.6.4","to_inclusive":true,"patched_in":"6.4.7"}],"published":"2024-02-28T00:00:00Z","updated":"2024-07-29T21:36:28Z"},{"id":"wordfence:628b3f53-decd-47ac-a2d1-339ade1e6944","source":"wordfence","cve":"CVE-2026-7457","title":"LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/628b3f53-decd-47ac-a2d1-339ade1e6944?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2026-05-05T18:29:59Z","updated":"2026-05-06T06:47:21Z"},{"id":"wordfence:628bfa19-2ffa-426b-8b88-22a0c4d0ba92","source":"wordfence","cve":"CVE-2025-10690","title":"Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=api-prod","affected":[{"type":"theme","slug":"goza-theme","name":"Goza - Nonprofit Charity WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-09-08T19:58:15Z","updated":"2025-09-19T02:27:00Z"},{"id":"wordfence:628c44f1-2458-4b43-bcb1-8e077c32bdbc","source":"wordfence","cve":"CVE-2025-31575","title":"Flag Icons <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/628c44f1-2458-4b43-bcb1-8e077c32bdbc?source=api-prod","affected":[{"type":"plugin","slug":"language-icons-flags-switcher","name":"Flag Icons","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:36:47Z"},{"id":"wordfence:628eef73-1725-4290-bb30-07792d1d5b6c","source":"wordfence","cve":"CVE-2022-3125","title":"Frontend File Manager <= 21.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/628eef73-1725-4290-bb30-07792d1d5b6c?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"21.2","to_inclusive":true,"patched_in":"21.3"}],"published":"2022-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6290559d-5902-455c-bc33-7aa3c820162b","source":"wordfence","cve":"CVE-2026-1903","title":"Ravelry Designs Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6290559d-5902-455c-bc33-7aa3c820162b?source=api-prod","affected":[{"type":"plugin","slug":"ravelry-designs-widget","name":"Ravelry Designs Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:33:36Z","updated":"2026-02-14T06:42:28Z"},{"id":"wordfence:6290c671-c8e5-4cc3-a233-9fed584ca02f","source":"wordfence","cve":"CVE-2022-1168","title":"WP JobSearch < 1.5.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6290c671-c8e5-4cc3-a233-9fed584ca02f?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2020-06-03T00:00:00Z","updated":"2025-06-30T13:39:20Z"},{"id":"wordfence:6294acc4-e28a-4817-be3e-430086c05e13","source":"wordfence","cve":"CVE-2025-0671","title":"Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6294acc4-e28a-4817-be3e-430086c05e13?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.49","to_inclusive":true,"patched_in":"5.7.50"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-30T19:56:42Z"},{"id":"wordfence:62961a07-69df-4586-861d-5fc4fde8aec5","source":"wordfence","cve":"CVE-2025-58020","title":"Theater for WordPress <= 0.18.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62961a07-69df-4586-861d-5fc4fde8aec5?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.18.8","to_inclusive":true,"patched_in":"0.19"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-04T18:31:18Z"},{"id":"wordfence:6297753c-72c0-4926-9365-d0c760ddfd2a","source":"wordfence","cve":"CVE-2022-2555","title":"Yotpo Reviews for WooCommerce (Unofficial) <= 2.0.4 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6297753c-72c0-4926-9365-d0c760ddfd2a?source=api-prod","affected":[{"type":"plugin","slug":"yotpo-reviews-for-woocommerce","name":"Yotpo Reviews for WooCommerce (Unofficial)","from":"2.0.4","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:629868b2-d4c7-4bfa-968f-480e4450c164","source":"wordfence","cve":"CVE-2025-27273","title":"Affiliate Links Manager <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629868b2-d4c7-4bfa-968f-480e4450c164?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-links-manager","name":"Affiliate Links Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:31:53Z"},{"id":"wordfence:62988723-4e58-4eb3-a483-127b23574a40","source":"wordfence","cve":"CVE-2021-24802","title":"Colorful Categories < 2.0.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62988723-4e58-4eb3-a483-127b23574a40?source=api-prod","affected":[{"type":"plugin","slug":"colorful-categories","name":"Colorful Categories","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":false,"patched_in":"2.0.15"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:629893b3-b5a9-44a1-89f0-a6ed35259b81","source":"wordfence","cve":"CVE-2025-53263","title":"Address Autocomplete via Google for Gravity Forms <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629893b3-b5a9-44a1-89f0-a6ed35259b81?source=api-prod","affected":[{"type":"plugin","slug":"gf-google-address-autocomplete","name":"Address Autocomplete via Google for Gravity Forms","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-18T14:14:04Z"},{"id":"wordfence:6299876c-9db4-4f8d-897d-9a013a67238c","source":"wordfence","cve":"","title":"Register IPs <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6299876c-9db4-4f8d-897d-9a013a67238c?source=api-prod","affected":[{"type":"plugin","slug":"register-ip-multisite","name":"Register IPs","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"}],"published":"2019-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62998f65-5c99-490d-829f-4d63a9a20287","source":"wordfence","cve":"CVE-2024-31281","title":"Church Admin <= 4.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62998f65-5c99-490d-829f-4d63a9a20287?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:30:47Z"},{"id":"wordfence:629c00fe-aaf3-493c-ac1b-9cbcf74b32cf","source":"wordfence","cve":"CVE-2025-52742","title":"Pets <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629c00fe-aaf3-493c-ac1b-9cbcf74b32cf?source=api-prod","affected":[{"type":"plugin","slug":"pets","name":"Pets","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-06T00:00:00Z","updated":"2025-10-29T19:32:08Z"},{"id":"wordfence:629d4809-1dd2-4b67-8d8d-9c55f5240f94","source":"wordfence","cve":"CVE-2020-36666","title":"Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629d4809-1dd2-4b67-8d8d-9c55f5240f94?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listing","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"},{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":false,"patched_in":"1.9.5"},{"type":"plugin","slug":"photographer-directory","name":"Photographer Directory","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"},{"type":"plugin","slug":"lawyer-directory","name":"Lawyer Directory","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"},{"type":"plugin","slug":"real-estate-pro","name":"Real Estate Pro - WordPress Plugin","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"},{"type":"plugin","slug":"institutions-directory","name":"Institutions Directory","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"fitness-trainer","name":"Fitness Trainer- Training Membership Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"plugin","slug":"doctor-listing","name":"Hospital & Doctor Directory","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"},{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"},{"type":"plugin","slug":"producer-retailer","name":"producer-retailer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"final-user-wp-frontend-user-profiles","name":"Final User - WP Front-end User Profiles","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:629df2b3-1312-475c-8064-8b61bdef135a","source":"wordfence","cve":"CVE-2025-43839","title":"BP Messages Tool <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629df2b3-1312-475c-8064-8b61bdef135a?source=api-prod","affected":[{"type":"plugin","slug":"bp-messages-tool","name":"BP Messages Tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-04-29T00:00:00Z","updated":"2025-05-05T18:13:56Z"},{"id":"wordfence:629f36e3-f4a4-43a6-a98b-960088c8dd77","source":"wordfence","cve":"CVE-2025-7822","title":"WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629f36e3-f4a4-43a6-a98b-960088c8dd77?source=api-prod","affected":[{"type":"plugin","slug":"wp-wallcreeper","name":"WP Wallcreeper","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:39:34Z","updated":"2025-07-24T09:22:18Z"},{"id":"wordfence:629fafeb-5b69-4269-bd98-aaf170d98094","source":"wordfence","cve":"CVE-2024-51846","title":"Community Yard Sale <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629fafeb-5b69-4269-bd98-aaf170d98094?source=api-prod","affected":[{"type":"plugin","slug":"community-yard-sale","name":"Community Yard Sale","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:54:47Z"},{"id":"wordfence:629fdcb5-83fc-4a01-ba20-eea8ef5df24f","source":"wordfence","cve":"CVE-2024-51932","title":"Kings Tab Slider <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629fdcb5-83fc-4a01-ba20-eea8ef5df24f?source=api-prod","affected":[{"type":"plugin","slug":"kings-tab-slider","name":"Kings Tab Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:35:24Z"},{"id":"wordfence:629fe670-f48b-4eb6-86f9-e1bac3771530","source":"wordfence","cve":"CVE-2015-4139","title":"WP Smiley <= 1.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629fe670-f48b-4eb6-86f9-e1bac3771530?source=api-prod","affected":[{"type":"plugin","slug":"wp-smiley","name":"wp-smiley","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2015-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:629fee36-1fea-4a4d-acc2-9ba18d0b6487","source":"wordfence","cve":"CVE-2026-5920","title":"Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/629fee36-1fea-4a4d-acc2-9ba18d0b6487?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.6","to_inclusive":true,"patched_in":"5.9.7"}],"published":"2026-09-15T15:39:37Z","updated":"2026-09-16T04:28:03Z"},{"id":"wordfence:62a37eab-a278-4c6f-bc61-b9157c840cf0","source":"wordfence","cve":"CVE-2026-59545","title":"miniOrange Discord Integration <= 2.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a37eab-a278-4c6f-bc61-b9157c840cf0?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-discord-integration","name":"miniOrange Discord Integration","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:49:24Z"},{"id":"wordfence:62a4dd6a-f970-483e-b1a8-d57f604b7b66","source":"wordfence","cve":"CVE-2024-3831","title":"Enter Addons \u2013 Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a4dd6a-f970-483e-b1a8-d57f604b7b66?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-31T15:30:23Z"},{"id":"wordfence:62a5c796-1c14-4cb1-9f21-340b40e418df","source":"wordfence","cve":"CVE-2022-4703","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a5c796-1c14-4cb1-9f21-340b40e418df?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62a5ea05-a0d2-4b07-ad57-e8ca88798b71","source":"wordfence","cve":"CVE-2024-51822","title":"Creative Blocks <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a5ea05-a0d2-4b07-ad57-e8ca88798b71?source=api-prod","affected":[{"type":"plugin","slug":"creative-blocks","name":"Creative Blocks \u2013 Ultimate Blocks for Gutenberg","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:16:17Z"},{"id":"wordfence:62a6fc85-db3c-4696-8102-d0247daae56c","source":"wordfence","cve":"","title":"StaffList <= 3.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a6fc85-db3c-4696-8102-d0247daae56c?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62a79a8e-905c-4bed-b24d-84e56d7bb850","source":"wordfence","cve":"CVE-2024-33596","title":"Five Star Restaurant Reservations <= 2.6.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a79a8e-905c-4bed-b24d-84e56d7bb850?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.6.16","to_inclusive":true,"patched_in":"2.6.17"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:03:50Z"},{"id":"wordfence:62a831ac-3bec-43b0-915e-b6858757cb1c","source":"wordfence","cve":"CVE-2026-57680","title":"Kirki <= 6.0.11 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a831ac-3bec-43b0-915e-b6858757cb1c?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-06-30T00:00:00Z","updated":"2026-08-21T14:07:01Z"},{"id":"wordfence:62a9b569-bef8-4454-9779-39aec6e715fc","source":"wordfence","cve":"CVE-2026-22420","title":"Horizon <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a9b569-bef8-4454-9779-39aec6e715fc?source=api-prod","affected":[{"type":"theme","slug":"horizon","name":"horizon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:38:59Z"},{"id":"wordfence:62a9c9f4-ace4-4029-a720-5ea077e98be4","source":"wordfence","cve":"CVE-2026-0737","title":"Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62a9c9f4-ace4-4029-a720-5ea077e98be4?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.7","to_inclusive":true,"patched_in":"7.4.8"}],"published":"2026-04-03T19:32:59Z","updated":"2026-04-04T07:41:59Z"},{"id":"wordfence:62aa0cc4-ef8e-4727-ac07-3481c0464b05","source":"wordfence","cve":"CVE-2024-30507","title":"Molongui <= 4.7.7 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62aa0cc4-ef8e-4727-ac07-3481c0464b05?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:23:37Z"},{"id":"wordfence:62abc1e8-155d-4726-81d3-ed2cc7dd7373","source":"wordfence","cve":"CVE-2023-0212","title":"Advanced Recent Posts <= 0.6.14 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62abc1e8-155d-4726-81d3-ed2cc7dd7373?source=api-prod","affected":[{"type":"plugin","slug":"advanced-recent-posts","name":"Advanced Recent Posts","from":"*","from_inclusive":true,"to":"0.6.14","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62ac2725-0071-4a7d-8561-256e6a232de3","source":"wordfence","cve":"CVE-2023-0058","title":"Tiempo.com <= 0.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ac2725-0071-4a7d-8561-256e6a232de3?source=api-prod","affected":[{"type":"plugin","slug":"tiempocom","name":"Tiempo.com","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62ac66d8-fc10-4ec2-a567-7b95eb6f2c76","source":"wordfence","cve":"CVE-2022-0537","title":"MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution","severity":"medium","cvss":6.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ac66d8-fc10-4ec2-a567-7b95eb6f2c76?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.73.13","to_inclusive":false,"patched_in":"2.73.13"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62ace939-3c14-4e68-897b-ec845182ca50","source":"wordfence","cve":"CVE-2024-3670","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ace939-3c14-4e68-897b-ec845182ca50?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"3.12.8","to_inclusive":true,"patched_in":"3.12.9"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-02T16:52:10Z"},{"id":"wordfence:62ae0ad0-fc66-4c89-b1eb-36b815f5d0a9","source":"wordfence","cve":"CVE-2025-26942","title":"JetTricks <= 1.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ae0ad0-fc66-4c89-b1eb-36b815f5d0a9?source=api-prod","affected":[{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.1.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:13:23Z"},{"id":"wordfence:62aff7c5-78d8-4ec3-8081-b1ab9985d881","source":"wordfence","cve":"CVE-2025-69119","title":"Corbesier <= 1.15.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62aff7c5-78d8-4ec3-8081-b1ab9985d881?source=api-prod","affected":[{"type":"theme","slug":"corbesier","name":"Corbesier","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:31:10Z"},{"id":"wordfence:62b2113a-70a2-4223-8c6c-6cd15057d72d","source":"wordfence","cve":"CVE-2023-50830","title":"Seos Contact Form <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b2113a-70a2-4223-8c6c-6cd15057d72d?source=api-prod","affected":[{"type":"plugin","slug":"seos-contact-form","name":"Seos Contact Form","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62b29721-0580-4e1d-824d-9b8355890248","source":"wordfence","cve":"CVE-2025-13079","title":"Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens","severity":"medium","cvss":5.3,"cwe":"CWE-1241","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b29721-0580-4e1d-824d-9b8355890248?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:14Z"},{"id":"wordfence:62b56147-4cb2-4824-aa49-74ef80d373e1","source":"wordfence","cve":"CVE-2025-68066","title":"Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b56147-4cb2-4824-aa49-74ef80d373e1?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-28T00:00:00Z","updated":"2025-12-19T17:20:45Z"},{"id":"wordfence:62b56928-7125-4211-b233-07b5b51881c1","source":"wordfence","cve":"CVE-2023-0727","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folder","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b56928-7125-4211-b233-07b5b51881c1?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62b58b5c-bd1e-4317-9300-461558c95ac2","source":"wordfence","cve":"CVE-2025-32266","title":"404 Image Redirection (Replace Broken Images) <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b58b5c-bd1e-4317-9300-461558c95ac2?source=api-prod","affected":[{"type":"plugin","slug":"broken-images-redirection","name":"404 Image Redirection (Replace Broken Images)","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-11T19:39:13Z"},{"id":"wordfence:62b7bb00-8bd3-4d2b-b126-6b49b18fd920","source":"wordfence","cve":"CVE-2025-64287","title":"Alloggio - Hotel Booking <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b7bb00-8bd3-4d2b-b126-6b49b18fd920?source=api-prod","affected":[{"type":"theme","slug":"alloggio","name":"Alloggio - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-30T00:00:00Z","updated":"2025-11-12T13:49:39Z"},{"id":"wordfence:62b7f07a-8289-4e06-b0f9-d0ae53d71a47","source":"wordfence","cve":"CVE-2025-49974","title":"UpStream: a Project Management Plugin for WordPress <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b7f07a-8289-4e06-b0f9-d0ae53d71a47?source=api-prod","affected":[{"type":"plugin","slug":"upstream","name":"UpStream: a Project Management Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:03:48Z"},{"id":"wordfence:62b809dc-4089-4822-8aeb-7049fcfe376e","source":"wordfence","cve":"CVE-2024-1720","title":"User Registration \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T05:32:40Z"},{"id":"wordfence:62bb2fef-60aa-4c88-8cef-a832d65b4945","source":"wordfence","cve":"CVE-2025-69380","title":"Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62bb2fef-60aa-4c88-8cef-a832d65b4945?source=api-prod","affected":[{"type":"plugin","slug":"wp-upload-files-anywhere","name":"WordPress Upload Files Anywhere","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:18:51Z"},{"id":"wordfence:62bc3794-a2c2-4c1a-b1c9-2be6e2526635","source":"wordfence","cve":"CVE-2024-3249","title":"Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62bc3794-a2c2-4c1a-b1c9-2be6e2526635?source=api-prod","affected":[{"type":"plugin","slug":"zita-site-library","name":"Zita Site Library for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-06-24T00:00:00Z","updated":"2024-06-25T06:57:38Z"},{"id":"wordfence:62bc53ae-7cdb-491c-a315-5bf8fa80c27b","source":"wordfence","cve":"CVE-2022-3921","title":"Listingo <= 3.2.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62bc53ae-7cdb-491c-a315-5bf8fa80c27b?source=api-prod","affected":[{"type":"theme","slug":"listingo","name":"Listingo","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62c1b5ce-cd58-4805-9a40-1af529604406","source":"wordfence","cve":"CVE-2023-25474","title":"About Me 3000 widget <= 2.2.6 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c1b5ce-cd58-4805-9a40-1af529604406?source=api-prod","affected":[{"type":"plugin","slug":"about-me-3000","name":"About Me 3000 widget","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62c28db1-094c-46b7-992f-428d36cdd6ba","source":"wordfence","cve":"CVE-2025-24659","title":"Premium Packages <= 5.9.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c28db1-094c-46b7-992f-428d36cdd6ba?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.9.6","to_inclusive":true,"patched_in":"5.9.7"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:10:06Z"},{"id":"wordfence:62c3f54c-6bfb-4f11-9457-a09d28f83175","source":"wordfence","cve":"CVE-2025-11881","title":"AppPresser \u2013 Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c3f54c-6bfb-4f11-9457-a09d28f83175?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2025-10-29T00:00:00Z","updated":"2025-10-30T06:45:40Z"},{"id":"wordfence:62c3f844-ed88-4a6c-a8c2-7b573096ec8b","source":"wordfence","cve":"CVE-2024-32565","title":"App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c3f844-ed88-4a6c-a8c2-7b573096ec8b?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-10-24T19:16:32Z"},{"id":"wordfence:62c46925-8e97-4989-8c2c-56223d6911a2","source":"wordfence","cve":"CVE-2023-49764","title":"Advanced Database Cleaner <= 3.1.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c46925-8e97-4989-8c2c-56223d6911a2?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62c58bd6-77c1-48a9-bfcb-e2bdd7f5e98e","source":"wordfence","cve":"CVE-2025-66144","title":"Worker for Elementor <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c58bd6-77c1-48a9-bfcb-e2bdd7f5e98e?source=api-prod","affected":[{"type":"plugin","slug":"worker-elementor","name":"Business hours widget for Elementor \u2013 Worker","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:33:01Z"},{"id":"wordfence:62c80ca5-9007-4916-b4e8-a436dc1cfaf2","source":"wordfence","cve":"CVE-2026-32495","title":"WP Terms Popup \u2013 Terms and Conditions and Privacy Policy WordPress Popups <= 2.10.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c80ca5-9007-4916-b4e8-a436dc1cfaf2?source=api-prod","affected":[{"type":"plugin","slug":"wp-terms-popup","name":"WP Terms Popup \u2013 Terms and Conditions and Privacy Policy WordPress Popups","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:11:40Z"},{"id":"wordfence:62c8b894-b810-4011-ae0a-db401327142c","source":"wordfence","cve":"CVE-2026-39537","title":"Mikado Core <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c8b894-b810-4011-ae0a-db401327142c?source=api-prod","affected":[{"type":"plugin","slug":"mikado-core","name":"Mikado Core","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:11:13Z"},{"id":"wordfence:62c8fb1f-6cba-43cc-8aca-70812c29a63d","source":"wordfence","cve":"CVE-2026-77186","title":"My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c8fb1f-6cba-43cc-8aca-70812c29a63d?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-09-08T14:30:06Z","updated":"2026-09-09T03:28:49Z"},{"id":"wordfence:62c9ff4d-e098-4b71-ac0e-7e1d22637560","source":"wordfence","cve":"CVE-2026-24632","title":"Delay Redirects <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62c9ff4d-e098-4b71-ac0e-7e1d22637560?source=api-prod","affected":[{"type":"plugin","slug":"delay-redirects","name":"Delay Redirects","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-09T11:11:56Z","updated":"2026-02-03T13:49:00Z"},{"id":"wordfence:62cc4e29-f87e-40e7-8ae0-14a7d3bff462","source":"wordfence","cve":"CVE-2025-22719","title":"VikAppointments Services Booking Calendar <= 1.2.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62cc4e29-f87e-40e7-8ae0-14a7d3bff462?source=api-prod","affected":[{"type":"plugin","slug":"vikappointments","name":"VikAppointments Services Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T14:50:36Z"},{"id":"wordfence:62ce7300-4d97-4add-a09d-1f14c99d1c9e","source":"wordfence","cve":"CVE-2025-39366","title":"wProject < 5.8.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ce7300-4d97-4add-a09d-1f14c99d1c9e?source=api-prod","affected":[{"type":"theme","slug":"wproject","name":"wProject","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":false,"patched_in":"5.8.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:30:00Z"},{"id":"wordfence:62d1b4a2-5c1e-4381-a455-082bee734ff2","source":"wordfence","cve":"CVE-2022-29406","title":"WordPress Team Manager <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d1b4a2-5c1e-4381-a455-082bee734ff2?source=api-prod","affected":[{"type":"plugin","slug":"wp-team-manager","name":"Dynamic Team Manager \u2013 Team Member Showcase with grid, slider, table  Elementor widget & shortcode","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-06-14T09:26:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62d32cda-bb6d-4ffa-82b9-f2f6e8d4346f","source":"wordfence","cve":"CVE-2025-7354","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d32cda-bb6d-4ffa-82b9-f2f6e8d4346f?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2025-07-20T19:04:16Z","updated":"2025-07-21T07:23:25Z"},{"id":"wordfence:62d77685-1b06-44b8-8371-37d8e5018324","source":"wordfence","cve":"CVE-2026-111398","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d77685-1b06-44b8-8371-37d8e5018324?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.1","to_inclusive":true,"patched_in":"8.16.2"}],"published":"2026-10-17T00:00:00Z","updated":"2026-10-23T19:51:43Z"},{"id":"wordfence:62d81e01-9b6e-48e9-b9da-85444a3694e7","source":"wordfence","cve":"CVE-2024-8392","title":"WordPress Post Grid Layouts with Pagination \u2013 Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d81e01-9b6e-48e9-b9da-85444a3694e7?source=api-prod","affected":[{"type":"plugin","slug":"sogrid","name":"WordPress Post Grid Layouts with Pagination \u2013 Sogrid","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-29T15:52:49Z"},{"id":"wordfence:62d847f7-bd07-48c6-a083-06d7255ed7e2","source":"wordfence","cve":"CVE-2025-57890","title":"Sessions <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d847f7-bd07-48c6-a083-06d7255ed7e2?source=api-prod","affected":[{"type":"plugin","slug":"sessions","name":"Sessions","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:18:12Z"},{"id":"wordfence:62d92e24-2f6f-435c-b468-6da0b5c3ae38","source":"wordfence","cve":"CVE-2025-68086","title":"Reformer for Elementor <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d92e24-2f6f-435c-b468-6da0b5c3ae38?source=api-prod","affected":[{"type":"plugin","slug":"reformer-elementor","name":"ReFormer \u2013 Multichannel Contact Form for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:07:48Z"},{"id":"wordfence:62d9d2aa-437d-4235-9a55-38f38e5002c8","source":"wordfence","cve":"CVE-2026-39766","title":"ARforms <= 7.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62d9d2aa-437d-4235-9a55-38f38e5002c8?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:23:51Z","updated":"2026-10-08T23:28:33Z"},{"id":"wordfence:62dacee5-9b55-4d0e-aa35-d97a1666f9e1","source":"wordfence","cve":"CVE-2012-5387","title":"White Label CMS < 1.5.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62dacee5-9b55-4d0e-aa35-d97a1666f9e1?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2012-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62dd4cfc-10f7-4c16-aed8-6a7829e99224","source":"wordfence","cve":"CVE-2026-118071","title":"Joinchat 6.3.2 - 6.4.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62dd4cfc-10f7-4c16-aed8-6a7829e99224?source=api-prod","affected":[{"type":"plugin","slug":"creame-whatsapp-me","name":"Joinchat \u2013 Enhanced \u201cclick to chat\u201d","from":"6.3.2","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:39:08Z"},{"id":"wordfence:62de6922-f3f2-4996-a749-2d6d3a8be042","source":"wordfence","cve":"CVE-2015-10128","title":"Royal PrettyPhoto <= 1.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62de6922-f3f2-4996-a749-2d6d3a8be042?source=api-prod","affected":[{"type":"plugin","slug":"rt-prettyphoto","name":"Royal PrettyPhoto","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2016-05-09T00:00:00Z","updated":"2024-02-07T13:55:18Z"},{"id":"wordfence:62e01d59-e649-4b84-993b-9faf28a24274","source":"wordfence","cve":"","title":"Simple History Plugin < 2.7.5 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e01d59-e649-4b84-993b-9faf28a24274?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2016-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62e1aa14-b762-40ea-9a64-b1ecb6ed7153","source":"wordfence","cve":"CVE-2023-0405","title":"GPT AI Power <= 1.4.37 - Missing Authorization","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e1aa14-b762-40ea-9a64-b1ecb6ed7153?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.4.37","to_inclusive":true,"patched_in":"1.4.38"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62e223a5-768f-4743-99a5-2797fff7e976","source":"wordfence","cve":"CVE-2026-59527","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.14.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e223a5-768f-4743-99a5-2797fff7e976?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:39:27Z"},{"id":"wordfence:62e25985-ac19-41a5-8027-eb053f4a6490","source":"wordfence","cve":"CVE-2025-13842","title":"Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e25985-ac19-41a5-8027-eb053f4a6490?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumb-navxt","name":"Breadcrumb NavXT","from":"*","from_inclusive":true,"to":"7.5.0","to_inclusive":true,"patched_in":"7.5.1"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:14Z"},{"id":"wordfence:62e30cef-ce5d-4450-989e-f08f09b7638f","source":"wordfence","cve":"CVE-2023-32959","title":"Multiple sparklewpthemes Themes (Various versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e30cef-ce5d-4450-989e-f08f09b7638f?source=api-prod","affected":[{"type":"theme","slug":"kathmag","name":"Kathmag","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"online-estore","name":"Online eStore","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"spidermag","name":"SpiderMag","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"medical-heed","name":"Medical Heed","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"appzend","name":"Appzend","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"buzzstore","name":"BuzzStore","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"craft-blog","name":"Craft Blog","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"fitness-park","name":"Fitness Park","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"kingcabs","name":"Kingcabs","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"metrostore","name":"MetroStore","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"sparklestore","name":"SparkleStore","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-16T00:00:00Z","updated":"2024-11-07T14:33:34Z"},{"id":"wordfence:62e56040-ef01-464f-9451-2b762b652be3","source":"wordfence","cve":"CVE-2025-32524","title":"MyWorks WooCommerce Sync for QuickBooks Online <= 2.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e56040-ef01-464f-9451-2b762b652be3?source=api-prod","affected":[{"type":"plugin","slug":"myworks-woo-sync-for-quickbooks-online","name":"MyWorks Sync for WooCommerce & QuickBooks Online","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:15:40Z"},{"id":"wordfence:62e75bb6-83d9-43db-8c89-0995698ca0ca","source":"wordfence","cve":"CVE-2023-39998","title":"Betheme <= 27.1.1 - Missing Authorization via '_tool_history_delete'","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e75bb6-83d9-43db-8c89-0995698ca0ca?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.1.1","to_inclusive":true,"patched_in":"27.1.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62e903c6-36f1-45cb-8164-23a8d1ca3966","source":"wordfence","cve":"CVE-2016-10999","title":"Goodnews \u2013 Responsive WordPress News/Magazine | News / Editorial <= 5.11.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62e903c6-36f1-45cb-8164-23a8d1ca3966?source=api-prod","affected":[{"type":"plugin","slug":"goodnews5","name":"Goodnews \u2013 Responsive WordPress News/Magazine | News / Editorial","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":""}],"published":"2016-02-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62ea1427-0990-4645-aa1a-42da6fd3944f","source":"wordfence","cve":"CVE-2023-47776","title":"miniorange otp verification <= 4.2.1 - Missing Authorization via dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ea1427-0990-4645-aa1a-42da6fd3944f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62ea9e85-7752-4d0f-aafb-cbbc94294335","source":"wordfence","cve":"CVE-2023-25963","title":"JS Job Manager <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ea9e85-7752-4d0f-aafb-cbbc94294335?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62eb136f-3cb0-40dc-a154-015a7fa1077b","source":"wordfence","cve":"CVE-2023-0557","title":"ContentStudio <= 1.2.5 - Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb136f-3cb0-40dc-a154-015a7fa1077b?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62eb1ff6-8e98-4843-b697-21ce74e2aad8","source":"wordfence","cve":"CVE-2025-22336","title":"Wizhi Multi Filters by Wenprise <= 1.8.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb1ff6-8e98-4843-b697-21ce74e2aad8?source=api-prod","affected":[{"type":"plugin","slug":"wizhi-multi-filters","name":"Wizhi Multi Filters by Wenprise","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:12:30Z"},{"id":"wordfence:62eb222d-0723-428e-b7fc-6baf67213d90","source":"wordfence","cve":"CVE-2025-28861","title":"WP jQuery Persian Datepicker <= 0.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb222d-0723-428e-b7fc-6baf67213d90?source=api-prod","affected":[{"type":"plugin","slug":"wpjqp-datepicker","name":"WP jQuery Persian Datepicker","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:25:25Z"},{"id":"wordfence:62ebb1d0-e1ee-43ea-a673-15ba72a9f0c9","source":"wordfence","cve":"CVE-2024-50438","title":"Church Admin < 5.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ebb1d0-e1ee-43ea-a673-15ba72a9f0c9?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:21:19Z"},{"id":"wordfence:62ed278c-f914-4edd-aba1-4aaa099a869f","source":"wordfence","cve":"CVE-2025-9542","title":"AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62ed278c-f914-4edd-aba1-4aaa099a869f?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2025-09-08T17:53:24Z","updated":"2025-09-09T06:40:36Z"},{"id":"wordfence:62f1635a-cb94-4c5e-a1f6-90a1eeb38968","source":"wordfence","cve":"CVE-2024-54230","title":"Unlock Addons for Elementor <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62f1635a-cb94-4c5e-a1f6-90a1eeb38968?source=api-prod","affected":[{"type":"plugin","slug":"unlock-addons-for-elementor","name":"Unlock Addons for Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-24T16:06:56Z"},{"id":"wordfence:62f19301-2311-4989-a5f2-9f845b72dd54","source":"wordfence","cve":"CVE-2024-1452","title":"GenerateBlocks <= 1.8.2 - Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62f19301-2311-4989-a5f2-9f845b72dd54?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-13T15:26:53Z"},{"id":"wordfence:62f7cd02-6859-4fed-a09a-45b418f1308c","source":"wordfence","cve":"CVE-2024-54319","title":"Kundgenerator <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62f7cd02-6859-4fed-a09a-45b418f1308c?source=api-prod","affected":[{"type":"plugin","slug":"kundgenerator","name":"Kundgenerator","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:16:39Z"},{"id":"wordfence:62faa5c1-d6ac-4b76-ac08-05fffbf71391","source":"wordfence","cve":"CVE-2025-47538","title":"Cart tracking for WooCommerce <= 1.0.17 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62faa5c1-d6ac-4b76-ac08-05fffbf71391?source=api-prod","affected":[{"type":"plugin","slug":"cart-tracking-for-woocommerce","name":"Cart tracking for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:04:48Z"},{"id":"wordfence:62fd2c51-eac1-47c0-adbc-90bdd8dbbc8e","source":"wordfence","cve":"CVE-2021-24630","title":"Schreikasten <= 0.14.18 - Authenticated (Author+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62fd2c51-eac1-47c0-adbc-90bdd8dbbc8e?source=api-prod","affected":[{"type":"plugin","slug":"schreikasten","name":"Schreikasten","from":"*","from_inclusive":true,"to":"0.14.18","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:62fd472e-208b-48db-8f98-3d935c7a678c","source":"wordfence","cve":"CVE-2022-2438","title":"Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/62fd472e-208b-48db-8f98-3d935c7a678c?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.11.16","to_inclusive":true,"patched_in":"1.11.17"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:630083ca-b667-4fde-b9be-14087eda721b","source":"wordfence","cve":"CVE-2025-53214","title":"Sertifier Certificate & Badge Maker <= 1.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630083ca-b667-4fde-b9be-14087eda721b?source=api-prod","affected":[{"type":"plugin","slug":"sertifier-certificates-open-badges","name":"Sertifier Certificate & Badge Maker for WordPress \u2013 Tutor LMS","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-11-11T18:24:23Z"},{"id":"wordfence:6300c8c2-f539-46b2-9ee0-80bebbe4cad3","source":"wordfence","cve":"","title":"WordPress Core < 6.2.1 - Shortcode Execution in User Generated Content","severity":"medium","cvss":6.5,"cwe":"CWE-349","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6300c8c2-f539-46b2-9ee0-80bebbe4cad3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.6","to_inclusive":false,"patched_in":"5.9.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"5.9.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"5.9.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"5.9.6"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:630310c5-0434-4988-8bc5-09ae0cb27cbf","source":"wordfence","cve":"CVE-2024-13885","title":"WP e-Customers Beta <= 0.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630310c5-0434-4988-8bc5-09ae0cb27cbf?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-customers","name":"WP e-Customers Beta","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T22:02:32Z"},{"id":"wordfence:630516a5-9b73-48f7-9deb-1771b67e76b6","source":"wordfence","cve":"CVE-2026-65559","title":"Order Delivery Date for WooCommerce <= 4.6.0 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630516a5-9b73-48f7-9deb-1771b67e76b6?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T22:33:50Z"},{"id":"wordfence:6305b7be-8651-4028-a8cf-ea58b4977225","source":"wordfence","cve":"CVE-2025-1687","title":"Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6305b7be-8651-4028-a8cf-ea58b4977225?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-27T23:22:39Z"},{"id":"wordfence:6307864b-e89f-42ba-9efa-358a71e0a6c8","source":"wordfence","cve":"CVE-2025-58603","title":"Surfer <= 1.6.4.574 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6307864b-e89f-42ba-9efa-358a71e0a6c8?source=api-prod","affected":[{"type":"plugin","slug":"surferseo","name":"Surfer \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.6.4.574","to_inclusive":true,"patched_in":"1.6.5.584"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T21:36:52Z"},{"id":"wordfence:63089b8f-0e0f-4951-9f8b-8b64d539b4c0","source":"wordfence","cve":"CVE-2024-43128","title":"WooCommerce Product Table Lite <= 3.5.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":4.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63089b8f-0e0f-4951-9f8b-8b64d539b4c0?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:12:26Z"},{"id":"wordfence:6309258e-e4fc-4edf-a771-2d82a9a85a5c","source":"wordfence","cve":"CVE-2023-2079","title":"Buy Me a Coffee \u2013 Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6309258e-e4fc-4edf-a771-2d82a9a85a5c?source=api-prod","affected":[{"type":"plugin","slug":"buymeacoffee","name":"Buy Me a Coffee \u2013 Button and Widget Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63099a49-913f-428d-b9a4-85e1bc5afe56","source":"wordfence","cve":"CVE-2026-32385","title":"RegistrationMagic <= 6.0.7.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63099a49-913f-428d-b9a4-85e1bc5afe56?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.6","to_inclusive":true,"patched_in":"6.0.7.7"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:10:23Z"},{"id":"wordfence:6309c706-f84a-4997-9a9b-1bd8cf8f711a","source":"wordfence","cve":"","title":"Knowledge Center <= 2.7 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6309c706-f84a-4997-9a9b-1bd8cf8f711a?source=api-prod","affected":[{"type":"plugin","slug":"knowledge-center","name":"Easy Accordion FAQ and Knowledge Base Software for WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":false,"patched_in":"2.8"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:630c89bf-de7a-491f-b2b6-8f573071cf71","source":"wordfence","cve":"CVE-2026-39702","title":"Animation Addons for Elementor <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630c89bf-de7a-491f-b2b6-8f573071cf71?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:47:39Z"},{"id":"wordfence:630cc68e-102e-4e05-98ff-94de434a10ae","source":"wordfence","cve":"CVE-2026-13119","title":"Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630cc68e-102e-4e05-98ff-94de434a10ae?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-07-22T20:50:11Z","updated":"2026-07-23T09:33:58Z"},{"id":"wordfence:630d4c76-f25c-4706-b4f6-011d20fb732c","source":"wordfence","cve":"CVE-2026-13159","title":"Real Estate Papi <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630d4c76-f25c-4706-b4f6-011d20fb732c?source=api-prod","affected":[{"type":"theme","slug":"real-estate-papi","name":"Real Estate Papi","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-22T18:42:11Z"},{"id":"wordfence:630d5dcc-ee51-4c2d-b4fb-191637311d6b","source":"wordfence","cve":"CVE-2024-1688","title":"Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630d5dcc-ee51-4c2d-b4fb-191637311d6b?source=api-prod","affected":[{"type":"plugin","slug":"woo-total-sales","name":"Total Sales Counts for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:10Z"},{"id":"wordfence:630e4595-4be3-4886-8771-f781bcee674d","source":"wordfence","cve":"CVE-2024-43266","title":"WP Job Portal <= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630e4595-4be3-4886-8771-f781bcee674d?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-08-12T00:00:00Z","updated":"2024-10-23T16:49:10Z"},{"id":"wordfence:630e5edb-8f09-49cc-b396-451b035285bc","source":"wordfence","cve":"CVE-2025-60133","title":"PE Easy Slider <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/630e5edb-8f09-49cc-b396-451b035285bc?source=api-prod","affected":[{"type":"plugin","slug":"pe-easy-slider","name":"PE Easy Slider","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:17:00Z"},{"id":"wordfence:6314f5ce-4f19-4b04-b9d9-15874e792208","source":"wordfence","cve":"CVE-2025-22534","title":"Slides & Presentations <= 0.0.39 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6314f5ce-4f19-4b04-b9d9-15874e792208?source=api-prod","affected":[{"type":"plugin","slug":"slide","name":"Slides & Presentations","from":"*","from_inclusive":true,"to":"0.0.39","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:44:41Z"},{"id":"wordfence:6315e218-c547-4d10-b26c-9a9f4a70f8ba","source":"wordfence","cve":"CVE-2026-19416","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6315e218-c547-4d10-b26c-9a9f4a70f8ba?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":false,"patched_in":"4.5.4"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:13:15Z"},{"id":"wordfence:63168359-1b9f-4242-9bba-91f56e9be6d5","source":"wordfence","cve":"CVE-2026-54863","title":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63168359-1b9f-4242-9bba-91f56e9be6d5?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:30:48Z"},{"id":"wordfence:6318a1cf-716f-450c-a1c2-497de8095daa","source":"wordfence","cve":"CVE-2025-4611","title":"Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6318a1cf-716f-450c-a1c2-497de8095daa?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2025-05-20T20:50:49Z","updated":"2025-05-21T09:21:59Z"},{"id":"wordfence:63192a95-778b-452b-9081-cf20dc7f7ec1","source":"wordfence","cve":"CVE-2025-5699","title":"Developer Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63192a95-778b-452b-9081-cf20dc7f7ec1?source=api-prod","affected":[{"type":"plugin","slug":"devformatter","name":"Developer Formatter","from":"*","from_inclusive":true,"to":"2015.0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T18:42:02Z","updated":"2025-06-06T06:42:50Z"},{"id":"wordfence:6319ef8c-15ea-4e43-8d46-a6a110cba212","source":"wordfence","cve":"CVE-2024-52438","title":"de:branding <= 1.0.2 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6319ef8c-15ea-4e43-8d46-a6a110cba212?source=api-prod","affected":[{"type":"plugin","slug":"debranding","name":"de:branding","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:24:09Z"},{"id":"wordfence:631a514a-188e-45ce-9f5f-01855b9fa361","source":"wordfence","cve":"CVE-2025-69381","title":"WooCommerce Bulk Product Editor <= 3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631a514a-188e-45ce-9f5f-01855b9fa361?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-quick-product-editor","name":"WooCommerce Bulk Product Editor","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:12:54Z"},{"id":"wordfence:631c4d14-8b33-47ed-a2ff-68b2b2906b84","source":"wordfence","cve":"CVE-2026-110284","title":"LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631c4d14-8b33-47ed-a2ff-68b2b2906b84?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2026-10-13T19:22:09Z","updated":"2026-10-14T07:43:33Z"},{"id":"wordfence:631ce289-0f47-4a20-a597-fa33bda793e4","source":"wordfence","cve":"CVE-2026-22365","title":"Soleng <= 1.0.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631ce289-0f47-4a20-a597-fa33bda793e4?source=api-prod","affected":[{"type":"theme","slug":"soleng","name":"Soleng | Solar Energy WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:31:33Z"},{"id":"wordfence:631d200f-7b0b-4105-b91e-030af459ba99","source":"wordfence","cve":"CVE-2024-1349","title":"EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631d200f-7b0b-4105-b91e-030af459ba99?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T18:56:32Z"},{"id":"wordfence:631e1061-50b1-4df2-b876-37b4cd3e2478","source":"wordfence","cve":"CVE-2024-1987","title":"WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631e1061-50b1-4df2-b876-37b4cd3e2478?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.9.1","to_inclusive":true,"patched_in":"3.4.9.2"}],"published":"2024-03-07T00:00:00Z","updated":"2024-05-31T15:30:23Z"},{"id":"wordfence:631fc709-98e8-4655-96fc-c37717705a80","source":"wordfence","cve":"CVE-2023-1166","title":"USM Premium <= 16.2 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/631fc709-98e8-4655-96fc-c37717705a80?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate-Premium-Plugin","name":"USM Premium","from":"*","from_inclusive":true,"to":"16.2","to_inclusive":true,"patched_in":"16.3"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6320cd5f-c5a9-4731-9374-9b8b0838a1ec","source":"wordfence","cve":"CVE-2020-6167","title":"Minimal Coming Soon & Maintenance Mode <= 2.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Setting Changes","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6320cd5f-c5a9-4731-9374-9b8b0838a1ec?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"2.15"}],"published":"2020-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6322ba0b-e1f1-4fda-b7a4-826844046f89","source":"wordfence","cve":"CVE-2024-12683","title":"Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6322ba0b-e1f1-4fda-b7a4-826844046f89?source=api-prod","affected":[{"type":"plugin","slug":"smart-maintenance-mode","name":"Smart Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:22:35Z"},{"id":"wordfence:6322e9be-ad71-4a91-ab9f-760107d920be","source":"wordfence","cve":"CVE-2022-4680","title":"Revive Old Posts <= 9.0.10 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6322e9be-ad71-4a91-ab9f-760107d920be?source=api-prod","affected":[{"type":"plugin","slug":"tweet-old-post","name":"Revive Social \u2013 Social Media Auto Post and Scheduling Automation Plugin","from":"*","from_inclusive":true,"to":"9.0.10","to_inclusive":true,"patched_in":"9.0.11"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:632431eb-ea78-4c93-ac79-2cb92b5746c6","source":"wordfence","cve":"CVE-2026-3426","title":"RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/632431eb-ea78-4c93-ac79-2cb92b5746c6?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T12:29:54Z"},{"id":"wordfence:6324795d-3fab-4806-b7d8-f122d31429ff","source":"wordfence","cve":"CVE-2023-0261","title":"WP TripAdvisor Review Slider <= 10.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6324795d-3fab-4806-b7d8-f122d31429ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"10.7","to_inclusive":true,"patched_in":"10.8"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d","source":"wordfence","cve":"CVE-2024-8431","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T11:34:18Z"},{"id":"wordfence:632e2424-d4e0-456a-aff6-b575f5bf8405","source":"wordfence","cve":"CVE-2025-60134","title":"WP Media Categories <= 2.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/632e2424-d4e0-456a-aff6-b575f5bf8405?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-categories","name":"WP Media Categories","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-09-16T17:30:12Z"},{"id":"wordfence:63306df3-4972-426f-bfda-6af75a09971c","source":"wordfence","cve":"CVE-2024-5666","title":"Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63306df3-4972-426f-bfda-6af75a09971c?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor","name":"Extensions for Elementor","from":"*","from_inclusive":true,"to":"2.0.30","to_inclusive":true,"patched_in":"2.0.31"}],"published":"2024-06-28T19:02:54Z","updated":"2024-06-29T07:05:39Z"},{"id":"wordfence:63323552-354b-44b6-81a4-0b6e82480910","source":"wordfence","cve":"","title":"Simply Poll <= 1.4.1 - Cross-Site Request Forgery and Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63323552-354b-44b6-81a4-0b6e82480910?source=api-prod","affected":[{"type":"plugin","slug":"simply-poll","name":"simply-poll","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6334b02e-ffab-49f9-969b-d015c2babc29","source":"wordfence","cve":"CVE-2022-45373","title":"Slimstat Analytics <= 5.0.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6334b02e-ffab-49f9-969b-d015c2babc29?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6335cc7b-7282-4f54-9d8e-09a98ac3c3e5","source":"wordfence","cve":"CVE-2025-30969","title":"iFrame Images Gallery <= 9.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6335cc7b-7282-4f54-9d8e-09a98ac3c3e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-iframe-images-gallery","name":"iFrame Images Gallery","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:58:54Z"},{"id":"wordfence:63370972-a6cb-40ed-91f2-4f469dc5335b","source":"wordfence","cve":"CVE-2024-25904","title":"TinyMCE Professional Formats and Styles <= 1.1.2 - Cross-Site Request Forgery via bb_taps_backend_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63370972-a6cb-40ed-91f2-4f469dc5335b?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-and-tinymce-advanced-professsional-formats-and-styles","name":"TinyMCE and TinyMCE Advanced Professsional Formats and Styles","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T16:59:31Z"},{"id":"wordfence:63374c5c-0b0a-4091-9aee-2e6c1d17a1b2","source":"wordfence","cve":"CVE-2024-11197","title":"Lock User Account <= 1.0.5 - User Lock Bypass","severity":"medium","cvss":4.2,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63374c5c-0b0a-4091-9aee-2e6c1d17a1b2?source=api-prod","affected":[{"type":"plugin","slug":"lock-user-account","name":"Lock User Account","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:51:55Z","updated":"2024-11-21T02:06:34Z"},{"id":"wordfence:6338620f-925a-4226-9557-313a7f8a6b6a","source":"wordfence","cve":"","title":"WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6338620f-925a-4226-9557-313a7f8a6b6a?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-user-role-editor","name":"WPFront User Role Editor","from":"*","from_inclusive":true,"to":"3.2.1.11184","to_inclusive":false,"patched_in":"3.2.1.11184"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63388bb5-42f1-40c9-ac01-3ab6fc242106","source":"wordfence","cve":"CVE-2025-30622","title":"postMash Custom \u2013 custom post order <= 1.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63388bb5-42f1-40c9-ac01-3ab6fc242106?source=api-prod","affected":[{"type":"plugin","slug":"postmash-custom","name":"PostMash Custom \u2013 custom post order","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-03T14:46:29Z"},{"id":"wordfence:6339fc26-9787-4a96-ab03-8d2957155b97","source":"wordfence","cve":"CVE-2026-123860","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6339fc26-9787-4a96-ab03-8d2957155b97?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:22:35Z"},{"id":"wordfence:633a9cbf-451d-4fd1-822b-ef8966ff9a1a","source":"wordfence","cve":"","title":"Activity Log <=  2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/633a9cbf-451d-4fd1-822b-ef8966ff9a1a?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2016-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:633bb792-69c1-4c10-b64a-123ec149fd14","source":"wordfence","cve":"CVE-2026-42380","title":"AI Lab < 5.4.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/633bb792-69c1-4c10-b64a-123ec149fd14?source=api-prod","affected":[{"type":"theme","slug":"ailab","name":"AI Lab - Machine Learning WordPress Theme","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":false,"patched_in":"5.4.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:46:37Z"},{"id":"wordfence:633d26e9-8a05-4f4b-93a8-5644f2f699db","source":"wordfence","cve":"CVE-2026-8444","title":"WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/633d26e9-8a05-4f4b-93a8-5644f2f699db?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.6.8","to_inclusive":true,"patched_in":"12.7.0"}],"published":"2026-06-15T18:29:14Z","updated":"2026-06-16T06:49:11Z"},{"id":"wordfence:633d6921-eece-4e7a-8ed8-48b7c579b5ed","source":"wordfence","cve":"CVE-2024-34366","title":"Download Alt Text AI <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/633d6921-eece-4e7a-8ed8-48b7c579b5ed?source=api-prod","affected":[{"type":"plugin","slug":"alttext-ai","name":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:06:11Z"},{"id":"wordfence:633f5575-315e-46ef-ba92-8eae11a546b9","source":"wordfence","cve":"CVE-2025-58801","title":"Responder <= 4.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/633f5575-315e-46ef-ba92-8eae11a546b9?source=api-prod","affected":[{"type":"plugin","slug":"responder","name":"\u05e8\u05d1 \u05de\u05e1\u05e8 \u2013 \u05ea\u05d5\u05e1\u05e3 \u05d4\u05d8\u05e4\u05e1\u05d9\u05dd (Responder)","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-29T16:00:35Z"},{"id":"wordfence:6340984d-143e-45af-bd30-2df1ce943fc9","source":"wordfence","cve":"CVE-2025-32178","title":"6Storage Rentals <= 2.19.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6340984d-143e-45af-bd30-2df1ce943fc9?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.19.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T15:14:55Z"},{"id":"wordfence:63412848-6b1f-460a-8776-cd1cc5eb002e","source":"wordfence","cve":"CVE-2022-2987","title":"Ldap WP Login / Active Directory Integration  <= 3.0.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63412848-6b1f-460a-8776-cd1cc5eb002e?source=api-prod","affected":[{"type":"plugin","slug":"ldap-wp-login-integration-with-active-directory","name":"Ldap WP Login / Active Directory Integration","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6341bdcc-c99f-40c3-81c4-ad90ff19f802","source":"wordfence","cve":"CVE-2023-0968","title":"Watu Quiz <= 3.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6341bdcc-c99f-40c3-81c4-ad90ff19f802?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.9.1"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:634303eb-b120-4384-9780-b950de491099","source":"wordfence","cve":"","title":"\u00b5Audio Player <= 0.6.2 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634303eb-b120-4384-9780-b950de491099?source=api-prod","affected":[{"type":"plugin","slug":"microaudio","name":"\u00b5Audio Player","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63458059-c392-4e2b-be8f-cc24771261df","source":"wordfence","cve":"CVE-2025-48347","title":"bxSlider integration for WordPress <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63458059-c392-4e2b-be8f-cc24771261df?source=api-prod","affected":[{"type":"plugin","slug":"bxslider-integration","name":"bxSlider integration for WordPress","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T13:59:45Z"},{"id":"wordfence:6345d360-5f58-44d2-bc2d-1a20ee43e146","source":"wordfence","cve":"CVE-2021-29476","title":"WordPress Core < 5.5.3 - PHP Object Injection Gadget","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6345d360-5f58-44d2-bc2d-1a20ee43e146?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.35","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.35","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.33","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.32","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.32","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.29","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.25","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.24","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.23","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.20","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.19","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.15","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.16","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.11","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.8","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.9","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.6","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.4","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.3","to_inclusive":false,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6346024c-61d5-4f73-b7f2-3a8fd3fb838e","source":"wordfence","cve":"CVE-2015-3439","title":"WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6346024c-61d5-4f73-b7f2-3a8fd3fb838e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"3.7.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6347f588-a3fd-4909-ad57-9d78787b5728","source":"wordfence","cve":"CVE-2024-2172","title":"Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-304","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6347f588-a3fd-4909-ad57-9d78787b5728?source=api-prod","affected":[{"type":"plugin","slug":"web-application-firewall","name":"Web Application Firewall \u2013 website security","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"miniorange-malware-protection","name":"Malware Scanner","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-21T17:49:02Z"},{"id":"wordfence:6348b119-a0dc-40ef-ae62-1de86dcefac7","source":"wordfence","cve":"CVE-2026-0833","title":"Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6348b119-a0dc-40ef-ae62-1de86dcefac7?source=api-prod","affected":[{"type":"plugin","slug":"team-section","name":"Team Section Block \u2013 Showcase Team Members with Layout Options","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-16T17:54:29Z","updated":"2026-01-17T06:42:19Z"},{"id":"wordfence:634bec5f-e511-4047-9a46-09147ccc3a25","source":"wordfence","cve":"CVE-2021-25059","title":"Download Plugin <= 1.6.2 - Missing Authorization and Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634bec5f-e511-4047-9a46-09147ccc3a25?source=api-prod","affected":[{"type":"plugin","slug":"download-plugin","name":"Download Plugin","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:634c1e9d-85ba-4860-a3e4-a65bf3f23919","source":"wordfence","cve":"CVE-2024-39656","title":"Tin Canny Reporting for LearnDash <= 4.3.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634c1e9d-85ba-4860-a3e4-a65bf3f23919?source=api-prod","affected":[{"type":"plugin","slug":"tin-canny-learndash-reporting","name":"Tin Canny Reporting for LearnDash","from":"*","from_inclusive":true,"to":"4.3.0.7","to_inclusive":true,"patched_in":"4.3.0.8"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:33:45Z"},{"id":"wordfence:634ccd08-4f2e-4a06-8c64-dfe38fa3a481","source":"wordfence","cve":"","title":"WP Super Cache <= 1.4.4 - PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634ccd08-4f2e-4a06-8c64-dfe38fa3a481?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2015-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:634d4062-7004-4e89-89a8-323c939aae93","source":"wordfence","cve":"CVE-2024-4347","title":"WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634d4062-7004-4e89-89a8-323c939aae93?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-05-10T09:04:32Z","updated":"2024-05-23T05:32:17Z"},{"id":"wordfence:634e5c33-cd24-46ab-aac0-161eeb28aaff","source":"wordfence","cve":"CVE-2025-10192","title":"WP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634e5c33-cd24-46ab-aac0-161eeb28aaff?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-effects","name":"WP Photo Effects","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:11:37Z","updated":"2025-10-03T11:17:13Z"},{"id":"wordfence:634f6c42-6708-4e39-afdc-7838d3368fb4","source":"wordfence","cve":"CVE-2025-22523","title":"Schedule <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634f6c42-6708-4e39-afdc-7838d3368fb4?source=api-prod","affected":[{"type":"plugin","slug":"schedule","name":"Schedule","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:11:27Z"},{"id":"wordfence:634fa1ed-ad6b-4875-b6f9-f20add39dc80","source":"wordfence","cve":"CVE-2025-2576","title":"Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/634fa1ed-ad6b-4875-b6f9-f20add39dc80?source=api-prod","affected":[{"type":"plugin","slug":"ayyash-studio","name":"Ayyash Studio \u2014 The kick-start kit","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-25T14:11:41Z","updated":"2025-03-26T02:23:48Z"},{"id":"wordfence:6351a40d-523d-4edb-acba-5cf048a1014f","source":"wordfence","cve":"CVE-2024-12525","title":"Easy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6351a40d-523d-4edb-acba-5cf048a1014f?source=api-prod","affected":[{"type":"plugin","slug":"easy-mls-listings-import","name":"Easy MLS Listings Import","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-17T15:40:29Z","updated":"2025-02-20T14:45:33Z"},{"id":"wordfence:6351d3f7-2d10-4fcf-b7c1-88ce529cd9f4","source":"wordfence","cve":"CVE-2018-5290","title":"GD Rating System <= 2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6351d3f7-2d10-4fcf-b7c1-88ce529cd9f4?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63530cc4-aa9e-4b7a-b320-519028dec540","source":"wordfence","cve":"CVE-2026-14291","title":"Security Ninja (Premium) <= 5.289 - 2-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63530cc4-aa9e-4b7a-b320-519028dec540?source=api-prod","affected":[{"type":"plugin","slug":"security-ninja-premium","name":"security-ninja-premium","from":"*","from_inclusive":true,"to":"5.289","to_inclusive":true,"patched_in":"5.290"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-30T17:03:30Z"},{"id":"wordfence:63567094-9fb1-44b2-a3e6-99194389c4b6","source":"wordfence","cve":"CVE-2022-45357","title":"1003 Mortgage Application <= 1.75 - Unauthenticated CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63567094-9fb1-44b2-a3e6-99194389c4b6?source=api-prod","affected":[{"type":"plugin","slug":"1003-mortgage-application","name":"1003 Mortgage Application","from":"*","from_inclusive":true,"to":"1.75","to_inclusive":true,"patched_in":"1.80"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6356e226-a449-4cd0-be60-2a1c9c70aa59","source":"wordfence","cve":"CVE-2022-2223","title":"Image Slider <= 1.1.121 - Cross-Site Request Forgery to Post Duplication","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6356e226-a449-4cd0-be60-2a1c9c70aa59?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.121","to_inclusive":true,"patched_in":"1.1.123"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:635787ad-6cbd-4144-84f8-30124ac1bf9f","source":"wordfence","cve":"CVE-2026-32515","title":"Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme < 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635787ad-6cbd-4144-84f8-30124ac1bf9f?source=api-prod","affected":[{"type":"theme","slug":"miraculous","name":"Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:00:14Z"},{"id":"wordfence:6358fc29-5b09-481a-9040-a7890b61f419","source":"wordfence","cve":"CVE-2021-4398","title":"Amministrazione Trasparente <= 7.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6358fc29-5b09-481a-9040-a7890b61f419?source=api-prod","affected":[{"type":"plugin","slug":"amministrazione-trasparente","name":"Amministrazione Trasparente","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63590140-9723-4e91-884c-f2b11b67eb8d","source":"wordfence","cve":"CVE-2019-16223","title":"WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63590140-9723-4e91-884c-f2b11b67eb8d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:635c29d1-3638-464b-9b04-355393eac67d","source":"wordfence","cve":"CVE-2025-46472","title":"The Pack Elementor addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635c29d1-3638-464b-9b04-355393eac67d?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-10-21T20:54:58Z"},{"id":"wordfence:635c6343-dad4-4d5e-bda0-b79f2e472f3b","source":"wordfence","cve":"CVE-2026-111845","title":"YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635c6343-dad4-4d5e-bda0-b79f2e472f3b?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-bundles","name":"YITH WooCommerce Product Bundles","from":"*","from_inclusive":true,"to":"2.29.0","to_inclusive":true,"patched_in":"2.30.0"}],"published":"2026-10-19T12:38:00Z","updated":"2026-10-23T18:31:37Z"},{"id":"wordfence:635d6b0a-5895-4e50-a4ee-c7c6f40e897f","source":"wordfence","cve":"CVE-2025-23650","title":"Tidy.ro <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635d6b0a-5895-4e50-a4ee-c7c6f40e897f?source=api-prod","affected":[{"type":"plugin","slug":"tidyro","name":"Tidy.ro","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:22:51Z"},{"id":"wordfence:635e02a8-42f3-4098-aa3e-839099f40bfb","source":"wordfence","cve":"","title":"Restaurant Reservations <= 1.7 - SQL Injection","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635e02a8-42f3-4098-aa3e-839099f40bfb?source=api-prod","affected":[{"type":"plugin","slug":"nd-restaurant-reservations","name":"Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:635e19ba-da98-459c-ab91-ff969b0812fd","source":"wordfence","cve":"CVE-2026-16655","title":"Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635e19ba-da98-459c-ab91-ff969b0812fd?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2026-07-28T20:38:26Z","updated":"2026-07-29T09:31:14Z"},{"id":"wordfence:635f448b-5c51-4152-b6f5-076a686709bf","source":"wordfence","cve":"CVE-2023-46067","title":"Rocket Font <= 1.2.3 - Cross-Site Request Forgery via update_option_check_match_default","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/635f448b-5c51-4152-b6f5-076a686709bf?source=api-prod","affected":[{"type":"plugin","slug":"rocket-font","name":"Rocket Font \u2013 \ud55c\uae00","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-10-16T00:00:00Z","updated":"2026-10-28T21:05:20Z"},{"id":"wordfence:6363b693-91b8-41cb-b13a-df6fdf9402c5","source":"wordfence","cve":"CVE-2026-6506","title":"InfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6363b693-91b8-41cb-b13a-df6fdf9402c5?source=api-prod","affected":[{"type":"plugin","slug":"infusedwooPRO","name":"InfusedWoo Pro","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-13T18:13:39Z","updated":"2026-05-14T06:44:11Z"},{"id":"wordfence:63666c16-9f68-4a27-b163-4c25f0a7589e","source":"wordfence","cve":"CVE-2023-45272","title":"10Web Map Builder for Google Maps <= 1.0.73 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63666c16-9f68-4a27-b163-4c25f0a7589e?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.74","to_inclusive":false,"patched_in":"1.0.74"}],"published":"2023-09-13T00:00:00Z","updated":"2024-04-17T13:00:50Z"},{"id":"wordfence:636731ab-31e6-4750-b691-4850b29022dc","source":"wordfence","cve":"CVE-2024-8426","title":"Page Builder: Pagelayer <= 1.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/636731ab-31e6-4750-b691-4850b29022dc?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2024-07-28T00:00:00Z","updated":"2025-05-29T22:28:07Z"},{"id":"wordfence:6367c5fc-f664-4105-a1b7-a93fb0a2392b","source":"wordfence","cve":"CVE-2026-3311","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6367c5fc-f664-4105-a1b7-a93fb0a2392b?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"6.4.10"}],"published":"2026-04-07T16:43:48Z","updated":"2026-04-08T05:29:01Z"},{"id":"wordfence:6368c397-0570-4304-a764-869bacc526c7","source":"wordfence","cve":"CVE-2023-22719","title":"GiveWP <= 2.25.1 - Unauthenticated CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6368c397-0570-4304-a764-869bacc526c7?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:636bd8ce-4737-4117-9581-42c7dcb3ad22","source":"wordfence","cve":"CVE-2024-10670","title":"Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/636bd8ce-4737-4117-9581-42c7dcb3ad22?source=api-prod","affected":[{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:47:13Z"},{"id":"wordfence:636bf04e-e9ef-4691-969d-0a7249a6044e","source":"wordfence","cve":"CVE-2026-77704","title":"Booking for Appointments and Events Calendar \u2013 Amelia 1.2.32 - 2.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/636bf04e-e9ef-4691-969d-0a7249a6044e?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"1.2.32","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:48:46Z"},{"id":"wordfence:636c0ef8-262e-41f8-acab-fb7621a3e902","source":"wordfence","cve":"CVE-2026-104746","title":"Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/636c0ef8-262e-41f8-acab-fb7621a3e902?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.125","to_inclusive":true,"patched_in":"1.4.126"}],"published":"2026-11-06T23:12:10Z","updated":"2026-11-07T11:26:29Z"},{"id":"wordfence:636c9d92-ee62-499d-8d73-33cd63bb5af8","source":"wordfence","cve":"CVE-2025-8102","title":"Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/636c9d92-ee62-499d-8d73-33cd63bb5af8?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2025-08-19T23:05:32Z","updated":"2025-08-20T11:26:11Z"},{"id":"wordfence:6373a69d-5cf2-4174-9c02-0c137f8397b6","source":"wordfence","cve":"CVE-2025-68975","title":"Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6373a69d-5cf2-4174-9c02-0c137f8397b6?source=api-prod","affected":[{"type":"plugin","slug":"eagle-booking","name":"Eagle Booking","from":"*","from_inclusive":true,"to":"1.3.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-18T00:00:00Z","updated":"2026-01-06T14:57:08Z"},{"id":"wordfence:63779ab7-ba8b-459d-beb3-a32faf8f4394","source":"wordfence","cve":"CVE-2024-3730","title":"Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63779ab7-ba8b-459d-beb3-a32faf8f4394?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T11:00:21Z"},{"id":"wordfence:637972a3-1936-4add-88a2-3fbafba4b5c8","source":"wordfence","cve":"CVE-2024-4780","title":"Image Hover Effects \u2013 Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637972a3-1936-4add-88a2-3fbafba4b5c8?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-addon-for-elementor","name":"Image Hover Effects \u2013 Elementor Addon","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-07-15T17:33:55Z","updated":"2024-07-16T06:43:34Z"},{"id":"wordfence:6379ff71-20ba-473d-a2c4-3711c139ba17","source":"wordfence","cve":"CVE-2025-52807","title":"Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6379ff71-20ba-473d-a2c4-3711c139ba17?source=api-prod","affected":[{"type":"theme","slug":"kossy","name":"Kossy - Minimalist eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.45","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:40:10Z"},{"id":"wordfence:637a4815-5b71-4ba2-8bf2-e0d335cb94f3","source":"wordfence","cve":"CVE-2026-14379","title":"GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637a4815-5b71-4ba2-8bf2-e0d335cb94f3?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.4","to_inclusive":true,"patched_in":"7.9.5"}],"published":"2026-10-09T16:47:03Z","updated":"2026-10-10T05:31:00Z"},{"id":"wordfence:637a53b5-6d2f-4671-8126-f218c3ca73de","source":"wordfence","cve":"CVE-2024-56055","title":"WPLMS < 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary Directory Deletion","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637a53b5-6d2f-4671-8126-f218c3ca73de?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.2","to_inclusive":false,"patched_in":"1.9.9.5.2"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:49:03Z"},{"id":"wordfence:637aaab1-b536-4484-a8ce-646d5f9533b9","source":"wordfence","cve":"CVE-2025-58889","title":"Towny <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637aaab1-b536-4484-a8ce-646d5f9533b9?source=api-prod","affected":[{"type":"theme","slug":"towny","name":"Towny - Handyman, Cleaning & Caregiving Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:29:56Z"},{"id":"wordfence:637af5d1-eed3-4216-8d47-e68f83c63f43","source":"wordfence","cve":"CVE-2021-24397","title":"MicroCopy <= 1.1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637af5d1-eed3-4216-8d47-e68f83c63f43?source=api-prod","affected":[{"type":"plugin","slug":"microcopy","name":"MicroCopy","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:637f07c6-68cd-4ac6-83fd-65dbaab882fc","source":"wordfence","cve":"CVE-2024-0627","title":"Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/637f07c6-68cd-4ac6-83fd-65dbaab882fc?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-10T00:00:00Z","updated":"2024-07-29T21:36:28Z"},{"id":"wordfence:6381ef3b-e46b-41d2-967d-5f29d749db6d","source":"wordfence","cve":"CVE-2025-31900","title":"Lexicata <= 1.0.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6381ef3b-e46b-41d2-967d-5f29d749db6d?source=api-prod","affected":[{"type":"plugin","slug":"lexicata","name":"Lexicata","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T13:38:13Z"},{"id":"wordfence:638217c4-7a37-49e4-8660-5510ace692ec","source":"wordfence","cve":"CVE-2025-13317","title":"Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638217c4-7a37-49e4-8660-5510ace692ec?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.96","to_inclusive":true,"patched_in":"1.3.97"}],"published":"2025-11-21T18:51:38Z","updated":"2025-11-22T07:29:19Z"},{"id":"wordfence:63832076-0f66-4d45-a020-85b7f2edec70","source":"wordfence","cve":"CVE-2024-49656","title":"DocumentPress <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63832076-0f66-4d45-a020-85b7f2edec70?source=api-prod","affected":[{"type":"plugin","slug":"documentpress-display-any-document-on-your-site","name":"DocumentPress","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:53:48Z"},{"id":"wordfence:6387f210-ed4f-4f98-9e16-30f80c2889a2","source":"wordfence","cve":"CVE-2024-43979","title":"Blockbooster <= 1.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6387f210-ed4f-4f98-9e16-30f80c2889a2?source=api-prod","affected":[{"type":"theme","slug":"blockbooster","name":"Blockbooster","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T20:48:34Z"},{"id":"wordfence:638a6819-5105-491f-b5e4-ed6a495434ec","source":"wordfence","cve":"CVE-2025-46443","title":"Animate <= 0.5 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638a6819-5105-491f-b5e4-ed6a495434ec?source=api-prod","affected":[{"type":"plugin","slug":"animate","name":"Animate","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:48:35Z"},{"id":"wordfence:638c86d4-973d-41fc-9d59-9d2e79f42f72","source":"wordfence","cve":"CVE-2024-54328","title":"Invoice Payment for WooCommerce <= 1.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638c86d4-973d-41fc-9d59-9d2e79f42f72?source=api-prod","affected":[{"type":"plugin","slug":"invoice-payment-for-woocommerce","name":"Link Invoice Payment for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:16:08Z"},{"id":"wordfence:638d18ea-1ff6-432d-abe5-38e84916c106","source":"wordfence","cve":"CVE-2024-38684","title":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638d18ea-1ff6-432d-abe5-38e84916c106?source=api-prod","affected":[{"type":"plugin","slug":"slingblocks","name":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:48:07Z"},{"id":"wordfence:638d8ef6-dab0-4cfa-8ecc-af2ded3c6d79","source":"wordfence","cve":"CVE-2024-13662","title":"eHive Objects Image Grid <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638d8ef6-dab0-4cfa-8ecc-af2ded3c6d79?source=api-prod","affected":[{"type":"plugin","slug":"ehive-objects-image-grid","name":"eHive Objects Image Grid","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T11:11:11Z"},{"id":"wordfence:638e8e67-38b3-4fc4-bd77-8f268030a93a","source":"wordfence","cve":"CVE-2024-12313","title":"Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638e8e67-38b3-4fc4-bd77-8f268030a93a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-compare-products","name":"Compare Products for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-01-06T16:03:26Z","updated":"2025-07-25T19:38:19Z"},{"id":"wordfence:638eeffd-ed57-42dd-982e-3b20d852d009","source":"wordfence","cve":"CVE-2025-26971","title":"Poll Maker <= 5.6.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/638eeffd-ed57-42dd-982e-3b20d852d009?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.6.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:39:50Z"},{"id":"wordfence:639009f6-9877-45a9-b9f3-7256bc6f3360","source":"wordfence","cve":"CVE-2023-34010","title":"Media Library Assistant <= 3.07 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639009f6-9877-45a9-b9f3-7256bc6f3360?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63902f5b-98e2-4586-9e20-4b900b6f861a","source":"wordfence","cve":"CVE-2022-35235","title":"WPide <= 2.6 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63902f5b-98e2-4586-9e20-4b900b6f861a?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63904d54-1fb4-45f6-ac42-d82fe192cf1b","source":"wordfence","cve":"CVE-2026-66576","title":"JetBlocks for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63904d54-1fb4-45f6-ac42-d82fe192cf1b?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.2.1"}],"published":"2026-09-17T11:54:00Z","updated":"2026-09-22T18:45:46Z"},{"id":"wordfence:6390dba6-423b-48be-b5f0-1018d94f4a32","source":"wordfence","cve":"CVE-2025-1689","title":"ThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6390dba6-423b-48be-b5f0-1018d94f4a32?source=api-prod","affected":[{"type":"plugin","slug":"tmm_paypal_checkout","name":"ThemeMakers PayPal Express Checkout","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T06:48:39Z"},{"id":"wordfence:6391e61d-2e15-4fc5-a7a5-b8f5c45dfe73","source":"wordfence","cve":"CVE-2026-40755","title":"TechLink <= 1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6391e61d-2e15-4fc5-a7a5-b8f5c45dfe73?source=api-prod","affected":[{"type":"theme","slug":"techlink","name":"TechLink - Technology and IT Solutions WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:17:40Z"},{"id":"wordfence:63922c28-0cb5-4abe-85ee-20b2cc6f015d","source":"wordfence","cve":"CVE-2026-14490","title":"Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63922c28-0cb5-4abe-85ee-20b2cc6f015d?source=api-prod","affected":[{"type":"plugin","slug":"demi-backup-migration","name":"Demi \u2013 One Click Demo Import, Backup & Site Migration","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":"0.0.9"}],"published":"2026-07-27T16:39:28Z","updated":"2026-07-31T12:06:39Z"},{"id":"wordfence:639410e2-aecd-4545-aa3e-c795c663e8f0","source":"wordfence","cve":"CVE-2026-24573","title":"Visualizer: Tables and Charts Manager for WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639410e2-aecd-4545-aa3e-c795c663e8f0?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:31:42Z"},{"id":"wordfence:639693b6-369e-457e-a37e-30bdb8ea7275","source":"wordfence","cve":"CVE-2025-3075","title":"Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639693b6-369e-457e-a37e-30bdb8ea7275?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2025-07-28T16:22:11Z","updated":"2025-07-29T04:23:46Z"},{"id":"wordfence:639731d5-cd55-4689-b82d-4c94fa13b4da","source":"wordfence","cve":"CVE-2026-97248","title":"Booking Activities <= 1.18.7.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639731d5-cd55-4689-b82d-4c94fa13b4da?source=api-prod","affected":[{"type":"plugin","slug":"booking-activities","name":"Booking Activities","from":"*","from_inclusive":true,"to":"1.18.7.1","to_inclusive":true,"patched_in":"1.18.8"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:32:11Z"},{"id":"wordfence:63973f61-81f0-4fc8-810c-a15734ff824e","source":"wordfence","cve":"CVE-2026-5112","title":"Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63973f61-81f0-4fc8-810c-a15734ff824e?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:6397f917-7d74-43f6-96b0-4aca6447eb86","source":"wordfence","cve":"CVE-2024-31085","title":"Post-Plugin Library <= 2.6.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6397f917-7d74-43f6-96b0-4aca6447eb86?source=api-prod","affected":[{"type":"plugin","slug":"post-plugin-library","name":"Post-Plugin Library","from":"*","from_inclusive":true,"to":"2.6.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:58:30Z"},{"id":"wordfence:639a46b3-d19f-4ab4-995e-fd3de556b76e","source":"wordfence","cve":"CVE-2023-23807","title":"MojoPlug Slide Panel <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639a46b3-d19f-4ab4-995e-fd3de556b76e?source=api-prod","affected":[{"type":"plugin","slug":"mojoplug-slide-panel","name":"MojoPlug Slide Panel","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:639bf20c-04d4-49e5-8da1-685421a6f63a","source":"wordfence","cve":"","title":"Download Manager <= 2.8.7 - Sensitive Information Disclosure via Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639bf20c-04d4-49e5-8da1-685421a6f63a?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":false,"patched_in":"2.8.8"}],"published":"2016-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:639c260d-12f3-446e-8668-1de72fc759b9","source":"wordfence","cve":"CVE-2024-51904","title":"Embed documents shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639c260d-12f3-446e-8668-1de72fc759b9?source=api-prod","affected":[{"type":"plugin","slug":"embed-documents-shortcode","name":"Embed documents shortcode","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:23:33Z"},{"id":"wordfence:639f3941-7783-4500-aca4-5e8155db6460","source":"wordfence","cve":"CVE-2023-4935","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/639f3941-7783-4500-aca4-5e8155db6460?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63a2d09d-9cb8-47ba-8e40-5b43894552e3","source":"wordfence","cve":"","title":"Wordfence Security <= 3.8.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a2d09d-9cb8-47ba-8e40-5b43894552e3?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63a373a5-4284-4de5-93cd-63274b4e739f","source":"wordfence","cve":"CVE-2024-13122","title":"AFI \u2013 The Easiest Integration Plugin <= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a373a5-4284-4de5-93cd-63274b4e739f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.99.0","to_inclusive":true,"patched_in":"1.100.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:19:52Z"},{"id":"wordfence:63a3fc17-8a1e-4791-9d5a-33080112b633","source":"wordfence","cve":"CVE-2026-65465","title":"JetElements <= 2.9.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a3fc17-8a1e-4791-9d5a-33080112b633?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.1.1","to_inclusive":true,"patched_in":"2.9.1.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:53:24Z"},{"id":"wordfence:63a456e3-5bae-4a4b-850f-b35134de4cfb","source":"wordfence","cve":"","title":"Responsive Zoom In/Out Slider WordPress Plugin (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a456e3-5bae-4a4b-850f-b35134de4cfb?source=api-prod","affected":[{"type":"plugin","slug":"lbg_zoominoutslider","name":"Responsive Zoom In/Out Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63a4a077-c99e-4742-9fa1-f323fd24b950","source":"wordfence","cve":"CVE-2024-6319","title":"IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a4a077-c99e-4742-9fa1-f323fd24b950?source=api-prod","affected":[{"type":"plugin","slug":"imgspider","name":"IMGspider \u2013 \u56fe\u7247\u91c7\u96c6\u6293\u53d6\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2024-07-03T00:00:00Z","updated":"2024-07-04T08:32:22Z"},{"id":"wordfence:63a6456d-2062-47eb-9652-ff013472b00c","source":"wordfence","cve":"CVE-2025-39385","title":"Sirat <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a6456d-2062-47eb-9652-ff013472b00c?source=api-prod","affected":[{"type":"theme","slug":"sirat","name":"Sirat","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T19:19:12Z"},{"id":"wordfence:63a9fd8b-c71a-4945-bc02-1761331df832","source":"wordfence","cve":"CVE-2022-4672","title":"WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63a9fd8b-c71a-4945-bc02-1761331df832?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63ab02c1-baeb-4fd1-a527-4287d0b17a03","source":"wordfence","cve":"CVE-2024-43973","title":"GetPaid <= 2.8.11 - Missing Authorization via column_subscription()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ab02c1-baeb-4fd1-a527-4287d0b17a03?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T20:56:59Z"},{"id":"wordfence:63ab255f-e061-447b-a2b6-21a85eed9d57","source":"wordfence","cve":"CVE-2023-51497","title":"WooCommerce Ship to Multiple Addresses <= 3.8.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ab255f-e061-447b-a2b6-21a85eed9d57?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-multiple-addresses","name":"WooCommerce Ship to Multiple Addresses","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63ab6b17-360d-49b2-b1b5-652629eba3be","source":"wordfence","cve":"CVE-2026-27051","title":"Golo - City Travel Guide WordPress Theme <= 1.7.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ab6b17-360d-49b2-b1b5-652629eba3be?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:24:24Z"},{"id":"wordfence:63aba748-348e-42e2-94b0-4ce3fa9e6794","source":"wordfence","cve":"CVE-2026-73382","title":"Site Reviews <= 8.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63aba748-348e-42e2-94b0-4ce3fa9e6794?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:28:24Z"},{"id":"wordfence:63ac9de6-8713-4223-aaad-a70115d3bee7","source":"wordfence","cve":"CVE-2024-8092","title":"Accordion Image Menu <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ac9de6-8713-4223-aaad-a70115d3bee7?source=api-prod","affected":[{"type":"plugin","slug":"accordion-image-menu","name":"Accordion Image Menu","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-10-04T16:22:21Z"},{"id":"wordfence:63ade911-f9e7-4b1c-87c8-78e7664feff7","source":"wordfence","cve":"CVE-2024-12505","title":"Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ade911-f9e7-4b1c-87c8-78e7664feff7?source=api-prod","affected":[{"type":"plugin","slug":"trackserver","name":"Trackserver","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2025-01-10T14:10:04Z","updated":"2025-01-11T02:20:54Z"},{"id":"wordfence:63ae3a9d-1e6b-4784-8429-04be2a89b6cb","source":"wordfence","cve":"CVE-2021-24644","title":"Images to WebP <= 1.8 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ae3a9d-1e6b-4784-8429-04be2a89b6cb?source=api-prod","affected":[{"type":"plugin","slug":"images-to-webp","name":"Images to WebP","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63af18df-a3e4-48e6-be84-15d33edf3b46","source":"wordfence","cve":"CVE-2014-4524","title":"WP Easy Post Types < 1.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63af18df-a3e4-48e6-be84-15d33edf3b46?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-types","name":"WP Easy Post Types","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63af403f-facd-40e3-94bf-12f211d0c7ed","source":"wordfence","cve":"CVE-2026-8172","title":"Simple Basic Contact Form <= 20250114 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63af403f-facd-40e3-94bf-12f211d0c7ed?source=api-prod","affected":[{"type":"plugin","slug":"simple-basic-contact-form","name":"Simple Basic Contact Form","from":"*","from_inclusive":true,"to":"20250114","to_inclusive":true,"patched_in":""}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:47:59Z"},{"id":"wordfence:63af783b-5593-4f84-8a4b-e4a19d9c994c","source":"wordfence","cve":"CVE-2023-23721","title":"Admin Log <= 1.50 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63af783b-5593-4f84-8a4b-e4a19d9c994c?source=api-prod","affected":[{"type":"plugin","slug":"admin-log","name":"Admin Log","from":"*","from_inclusive":true,"to":"1.50","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63af850e-a989-4ba0-847b-deae35864b18","source":"wordfence","cve":"CVE-2026-81199","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63af850e-a989-4ba0-847b-deae35864b18?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:37:34Z"},{"id":"wordfence:63af91ef-54ef-4322-9931-a0d29dbd2aec","source":"wordfence","cve":"","title":"Email Artillery (MASS EMAIL) <= 4.1 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63af91ef-54ef-4322-9931-a0d29dbd2aec?source=api-prod","affected":[{"type":"plugin","slug":"email-artillery","name":"Email Artillery (MASS EMAIL)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63b272f5-08d1-4c5b-a500-d919903793b7","source":"wordfence","cve":"CVE-2021-24470","title":"Yada Wiki <= 3.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63b272f5-08d1-4c5b-a500-d919903793b7?source=api-prod","affected":[{"type":"plugin","slug":"yada-wiki","name":"Yada Wiki","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63b30d03-43d2-4696-aa36-8b39ec2c4ed0","source":"wordfence","cve":"CVE-2023-30489","title":"Email Subscription Popup <= 1.2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63b30d03-43d2-4696-aa36-8b39ec2c4ed0?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":false,"patched_in":"1.2.17"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63b388ab-77e4-4bcd-9d7b-288bbff5aa21","source":"wordfence","cve":"CVE-2025-31428","title":"HYDRO <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63b388ab-77e4-4bcd-9d7b-288bbff5aa21?source=api-prod","affected":[{"type":"theme","slug":"hydro","name":"HYDRO - One Page Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2025-06-25T17:17:02Z"},{"id":"wordfence:63b472fb-c853-4e56-b34c-3cf986c4cf80","source":"wordfence","cve":"CVE-2023-5604","title":"Asgaros Forum <= 2.7.0 - Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63b472fb-c853-4e56-b34c-3cf986c4cf80?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":false,"patched_in":"2.7.1"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63b67652-d10e-4a5a-97d5-04e6c848b752","source":"wordfence","cve":"CVE-2021-24228","title":"Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63b67652-d10e-4a5a-97d5-04e6c848b752?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63ba2d29-26dc-4c5f-9d9d-9a13e25c44b9","source":"wordfence","cve":"CVE-2025-12020","title":"Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ba2d29-26dc-4c5f-9d9d-9a13e25c44b9?source=api-prod","affected":[{"type":"plugin","slug":"double-the-donation","name":"Double the Donation \u2013 A workplace giving tool","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-11-10T15:02:07Z","updated":"2025-11-13T15:51:56Z"},{"id":"wordfence:63ba4880-9fbb-42e3-a8db-8115eb832b13","source":"wordfence","cve":"CVE-2024-13155","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ba4880-9fbb-42e3-a8db-8115eb832b13?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.140","to_inclusive":true,"patched_in":"1.5.141"}],"published":"2025-02-19T19:05:17Z","updated":"2025-02-20T07:33:37Z"},{"id":"wordfence:63bb9298-dd00-49a9-aea2-2797f0974d7f","source":"wordfence","cve":"CVE-2025-58241","title":"SnapWidget Social Photo Feed Widget <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63bb9298-dd00-49a9-aea2-2797f0974d7f?source=api-prod","affected":[{"type":"plugin","slug":"snapwidget-wp-instagram-widget","name":"SnapWidget Social Photo Feed Widget","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-11-03T22:44:41Z"},{"id":"wordfence:63bced7f-89ec-4c52-9e58-63ef2d311b31","source":"wordfence","cve":"","title":"Catch Web Tools <= 2.7.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63bced7f-89ec-4c52-9e58-63ef2d311b31?source=api-prod","affected":[{"type":"plugin","slug":"catch-web-tools","name":"Catch Web Tools","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63c1e570-c0de-44e0-ac39-0b9006c43efa","source":"wordfence","cve":"","title":"All in One Invite Codes <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63c1e570-c0de-44e0-ac39-0b9006c43efa?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-invite-codes","name":"All in One Invite Codes","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63c681e5-3110-4790-a075-4996fa1f2129","source":"wordfence","cve":"CVE-2023-30751","title":"Article Directory Redux <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63c681e5-3110-4790-a075-4996fa1f2129?source=api-prod","affected":[{"type":"plugin","slug":"article-directory-redux","name":"Article Directory Redux","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63c6eca6-9b55-48b5-ada3-97dd20d60f31","source":"wordfence","cve":"CVE-2023-50905","title":"WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63c6eca6-9b55-48b5-ada3-97dd20d60f31?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T16:18:10Z"},{"id":"wordfence:63c74d96-84da-408f-ba2c-cde0ff108bf1","source":"wordfence","cve":"CVE-2021-24527","title":"Profile Builder <= 3.4.8 - Admin Access via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63c74d96-84da-408f-ba2c-cde0ff108bf1?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":false,"patched_in":"3.4.9"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63c7bb29-c8b2-49ee-8ac4-1046b61b7e6a","source":"wordfence","cve":"CVE-2023-50887","title":"User Feedback <= 1.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63c7bb29-c8b2-49ee-8ac4-1046b61b7e6a?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63cab921-60fa-42c5-ad0d-69de8cc91332","source":"wordfence","cve":"CVE-2026-2357","title":"Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63cab921-60fa-42c5-ad0d-69de8cc91332?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"5.6.9"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T06:38:07Z"},{"id":"wordfence:63d0cb9b-e6ac-474e-ac6b-c0cbd14a19bd","source":"wordfence","cve":"CVE-2024-38755","title":"DirectoryPress <= 3.6.10 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d0cb9b-e6ac-474e-ac6b-c0cbd14a19bd?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.6.11"}],"published":"2024-07-11T00:00:00Z","updated":"2024-11-11T14:55:32Z"},{"id":"wordfence:63d49d5e-5562-4803-9e2c-429acd4ca75d","source":"wordfence","cve":"CVE-2026-26370","title":"Survey Maker by AYS < 5.1.7.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d49d5e-5562-4803-9e2c-429acd4ca75d?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.7.7","to_inclusive":false,"patched_in":"5.1.7.7"}],"published":"2026-02-20T00:00:00Z","updated":"2026-07-30T17:45:11Z"},{"id":"wordfence:63d73de6-56ac-41ab-a673-4e379eeed26c","source":"wordfence","cve":"CVE-2025-12643","title":"Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d73de6-56ac-41ab-a673-4e379eeed26c?source=api-prod","affected":[{"type":"plugin","slug":"saphali-liqpay-for-donate","name":"Saphali LiqPay for donate","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-11-07T20:46:02Z","updated":"2025-11-08T09:28:10Z"},{"id":"wordfence:63d806ed-2cfc-4ac6-9ebb-75c13d2cfad4","source":"wordfence","cve":"CVE-2015-9476","title":"Teardrop - Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-276","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d806ed-2cfc-4ac6-9ebb-75c13d2cfad4?source=api-prod","affected":[{"type":"theme","slug":"teardrop","name":"Teardrop - Fullscreen Photography Theme | Portfolio","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2015-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63d8c188-5126-461f-9e90-5c0edfc006a9","source":"wordfence","cve":"CVE-2026-114178","title":"W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d8c188-5126-461f-9e90-5c0edfc006a9?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.7","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2026-10-22T07:35:33Z","updated":"2026-10-28T01:18:49Z"},{"id":"wordfence:63d93203-e8fb-4a88-9546-580944f03d9a","source":"wordfence","cve":"CVE-2025-64293","title":"0 Day Analytics <= 4.0.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63d93203-e8fb-4a88-9546-580944f03d9a?source=api-prod","affected":[{"type":"plugin","slug":"0-day-analytics","name":"0 Day Analytics","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-17T18:14:56Z"},{"id":"wordfence:63db136b-58da-4758-a506-4dc79b3c177d","source":"wordfence","cve":"CVE-2026-17196","title":"Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63db136b-58da-4758-a506-4dc79b3c177d?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-10-07T16:28:14Z","updated":"2026-10-08T04:28:52Z"},{"id":"wordfence:63dc0acf-cec6-402b-aad3-21135354e488","source":"wordfence","cve":"CVE-2025-12502","title":"Attention Bar <= 0.7.2.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63dc0acf-cec6-402b-aad3-21135354e488?source=api-prod","affected":[{"type":"plugin","slug":"attention-bar","name":"attention-bar","from":"*","from_inclusive":true,"to":"0.7.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-24T21:10:50Z"},{"id":"wordfence:63ddf445-7b48-48f3-b097-bd7991216c3f","source":"wordfence","cve":"CVE-2026-49045","title":"Adminimize <= 1.11.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ddf445-7b48-48f3-b097-bd7991216c3f?source=api-prod","affected":[{"type":"plugin","slug":"adminimize","name":"Adminimize","from":"*","from_inclusive":true,"to":"1.11.11","to_inclusive":true,"patched_in":"1.11.12"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-08T16:15:01Z"},{"id":"wordfence:63df43cc-7f84-4316-80fc-b0242b9f454c","source":"wordfence","cve":"","title":"Careerfy <= 4.0.0 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63df43cc-7f84-4316-80fc-b0242b9f454c?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2020-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63e00072-0e3c-4b1c-8c30-3f94d5f538f0","source":"wordfence","cve":"CVE-2025-59138","title":"Genemy <= 1.6.6 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63e00072-0e3c-4b1c-8c30-3f94d5f538f0?source=api-prod","affected":[{"type":"theme","slug":"genemy","name":"Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:11:46Z"},{"id":"wordfence:63e108f4-5d9d-4bcf-aef9-aa856f4241ea","source":"wordfence","cve":"CVE-2023-3411","title":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images \u2013 Lite <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63e108f4-5d9d-4bcf-aef9-aa856f4241ea?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro-lite","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images \u2013 Lite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63e167ef-9f03-45a8-b3dc-240ccf1ea6c3","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63e167ef-9f03-45a8-b3dc-240ccf1ea6c3?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63e6d609-e221-4680-8706-187c5abdb968","source":"wordfence","cve":"CVE-2025-68856","title":"Mopinion Feedback Form <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63e6d609-e221-4680-8706-187c5abdb968?source=api-prod","affected":[{"type":"plugin","slug":"mopinion-feedback-form","name":"Mopinion Feedback Form","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:20:45Z"},{"id":"wordfence:63ea8485-8a3f-4d83-91ee-85591077464f","source":"wordfence","cve":"CVE-2024-50423","title":"Templately <= 3.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ea8485-8a3f-4d83-91ee-85591077464f?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2024-10-24T00:00:00Z","updated":"2024-12-12T17:25:34Z"},{"id":"wordfence:63ecb518-50d6-49ad-92e4-c5a7494ced82","source":"wordfence","cve":"CVE-2024-1844","title":"RevivePress \u2013 Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ecb518-50d6-49ad-92e4-c5a7494ced82?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-republish","name":"RevivePress \u2013 Keep your Old Content Evergreen","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.6.1"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-28T23:40:32Z"},{"id":"wordfence:63ed73c9-2b61-4811-ba7f-1803982f17bc","source":"wordfence","cve":"CVE-2024-2475","title":"Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ed73c9-2b61-4811-ba7f-1803982f17bc?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":true,"patched_in":"3.14"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T04:31:34Z"},{"id":"wordfence:63ef7383-d684-473b-aa0f-45027ef245f6","source":"wordfence","cve":"CVE-2024-4569","title":"Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ef7383-d684-473b-aa0f-45027ef245f6?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2024-06-26T00:00:00Z","updated":"2024-06-27T04:04:33Z"},{"id":"wordfence:63effbe3-e509-4f62-a7aa-7727e855bebf","source":"wordfence","cve":"CVE-2017-1002003","title":"Wp2android <= 1.1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63effbe3-e509-4f62-a7aa-7727e855bebf?source=api-prod","affected":[{"type":"plugin","slug":"wp2android-turn-wp-site-into-android-app","name":"Wp2android","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2017-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f10214-69ef-4b5d-8d2b-2e2c1bafa7e7","source":"wordfence","cve":"CVE-2020-8772","title":"InfiniteWP Client <= 1.9.4.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f10214-69ef-4b5d-8d2b-2e2c1bafa7e7?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.9.4.4","to_inclusive":true,"patched_in":"1.9.4.5"}],"published":"2020-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f1c60f-8f72-4c99-92af-340c67b7411f","source":"wordfence","cve":"","title":"Logaster Logo Generator <= 1.3 - Missing Authorization to Arbitrary Media Deletion and Creation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f1c60f-8f72-4c99-92af-340c67b7411f?source=api-prod","affected":[{"type":"plugin","slug":"logaster-logo-generator","name":"Logaster Logo Generator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f1c687-fa2d-4882-9bcd-68b6d8dfae8a","source":"wordfence","cve":"CVE-2026-90986","title":"Visitor Traffic Real Time Statistics pro <= 11.21 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f1c687-fa2d-4882-9bcd-68b6d8dfae8a?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.21","to_inclusive":true,"patched_in":"11.22"}],"published":"2026-09-14T17:34:35Z","updated":"2026-09-22T19:08:03Z"},{"id":"wordfence:63f26380-0bc2-4fe7-9e9d-05c688c201f9","source":"wordfence","cve":"","title":"Gutenberg 12.9.0 - 18.0.0 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f26380-0bc2-4fe7-9e9d-05c688c201f9?source=api-prod","affected":[{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"12.9.0","from_inclusive":true,"to":"18.0.0","to_inclusive":true,"patched_in":"18.01"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T13:47:48Z"},{"id":"wordfence:63f2e02c-baa4-446c-bf1c-96ce099ad02e","source":"wordfence","cve":"CVE-2023-1979","title":"Web Stories for WordPress <= 1.31.0 - Insufficient Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f2e02c-baa4-446c-bf1c-96ce099ad02e?source=api-prod","affected":[{"type":"plugin","slug":"web-stories","name":"Web Stories","from":"*","from_inclusive":true,"to":"1.32.0","to_inclusive":false,"patched_in":"1.32.0"}],"published":"2023-05-08T00:00:00Z","updated":"2024-02-13T14:38:58Z"},{"id":"wordfence:63f38644-a021-407a-9882-2c8435849c08","source":"wordfence","cve":"CVE-2025-10306","title":"Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download","severity":"low","cvss":3.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f38644-a021-407a-9882-2c8435849c08?source=api-prod","affected":[{"type":"plugin","slug":"backup-bolt","name":"Backup Bolt \u2013 Lightweight Backup, Fast WordPress Backup to ZIP","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-10-02T00:00:00Z","updated":"2025-10-10T21:05:28Z"},{"id":"wordfence:63f3aa9e-2d82-440b-b37c-211dc3b5d26d","source":"wordfence","cve":"CVE-2025-26776","title":"Chaty Pro <= 3.3.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f3aa9e-2d82-440b-b37c-211dc3b5d26d?source=api-prod","affected":[{"type":"plugin","slug":"chaty-pro","name":"Chaty Pro","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T22:35:10Z"},{"id":"wordfence:63f43fb9-3d8d-48ea-b760-0e068570b16d","source":"wordfence","cve":"CVE-2024-44063","title":"Happyforms <= 1.26.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f43fb9-3d8d-48ea-b760-0e068570b16d?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.0","to_inclusive":true,"patched_in":"1.26.1"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:26:20Z"},{"id":"wordfence:63f47b55-760e-4dbe-891f-a32685c7e3d5","source":"wordfence","cve":"CVE-2025-31005","title":"Easyfonts <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f47b55-760e-4dbe-891f-a32685c7e3d5?source=api-prod","affected":[{"type":"plugin","slug":"easyfonts","name":"EasyFonts \u2013 Host Google Fonts Locally, Fast & Auto-Optimize, GDPR Compliant","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:30:29Z"},{"id":"wordfence:63f53e3c-b038-4722-b5ba-7212e50b5978","source":"wordfence","cve":"CVE-2021-25053","title":"WP Coder <= 2.5.1 - Remote File Inclusion leading to Remote Code Execution via Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f53e3c-b038-4722-b5ba-7212e50b5978?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2021-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f588c6-6bad-44d2-a9d9-832d3a7d33ea","source":"wordfence","cve":"","title":"WP Statistics <= 12.0.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f588c6-6bad-44d2-a9d9-832d3a7d33ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.0.8.1","to_inclusive":true,"patched_in":"12.0.9"}],"published":"2017-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f6ca11-abfb-4f87-a9f7-0321f1de9abe","source":"wordfence","cve":"CVE-2023-28663","title":"Formidable PRO2PDF <= 3.09 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f6ca11-abfb-4f87-a9f7-0321f1de9abe?source=api-prod","affected":[{"type":"plugin","slug":"formidablepro-2-pdf","name":"Formidable PRO2PDF","from":"*","from_inclusive":true,"to":"3.09","to_inclusive":true,"patched_in":"3.10"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f86449-144c-494f-85d8-ce7c8d7d65d3","source":"wordfence","cve":"CVE-2021-24967","title":"Contact Form & Lead Form Elementor Builder <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f86449-144c-494f-85d8-ce7c8d7d65d3?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63f98fd6-eee8-4281-98ea-a267d0442c85","source":"wordfence","cve":"CVE-2024-0682","title":"Page Restrict <= 2.5.5 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63f98fd6-eee8-4281-98ea-a267d0442c85?source=api-prod","affected":[{"type":"plugin","slug":"pagerestrict","name":"Page Restrict","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:29Z"},{"id":"wordfence:63fa161b-c1d0-4168-b7c2-79abe515d98b","source":"wordfence","cve":"CVE-2026-100508","title":"Two Factor <= 0.16.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fa161b-c1d0-4168-b7c2-79abe515d98b?source=api-prod","affected":[{"type":"plugin","slug":"two-factor","name":"Two Factor","from":"*","from_inclusive":true,"to":"0.16.0","to_inclusive":true,"patched_in":"0.17.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:30:34Z"},{"id":"wordfence:63fab608-1a75-4b07-8d82-8ab87e197547","source":"wordfence","cve":"CVE-2025-3746","title":"OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fab608-1a75-4b07-8d82-8ab87e197547?source=api-prod","affected":[{"type":"plugin","slug":"otpless","name":"OTP-less one tap Sign in","from":"2.0.14","from_inclusive":true,"to":"2.0.59","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T13:11:34Z","updated":"2025-05-02T01:54:17Z"},{"id":"wordfence:63fb4209-374c-484a-b222-a5cee30abac0","source":"wordfence","cve":"CVE-2026-119501","title":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fb4209-374c-484a-b222-a5cee30abac0?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"10.0.2","to_inclusive":true,"patched_in":"10.0.3"}],"published":"2026-11-07T10:14:00Z","updated":"2026-11-10T19:30:11Z"},{"id":"wordfence:63fb6727-8225-481c-8252-0224577a9560","source":"wordfence","cve":"CVE-2024-33681","title":"Regenerate post permalink <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fb6727-8225-481c-8252-0224577a9560?source=api-prod","affected":[{"type":"plugin","slug":"regenerate-post-permalinks","name":"Regenerate post permalink","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-01T14:33:46Z"},{"id":"wordfence:63fc381e-ce72-4c90-bb35-daba520be40d","source":"wordfence","cve":"CVE-2023-52147","title":"All In One WP Security <= 5.2.4 - Protection Bypass of Renamed Login Page via URL Encoding","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fc381e-ce72-4c90-bb35-daba520be40d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":false,"patched_in":"5.2.5"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63fd62b2-455e-449b-b46a-78c5d2b86cde","source":"wordfence","cve":"CVE-2008-0195","title":"WordPress Core < 2.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fd62b2-455e-449b-b46a-78c5d2b86cde?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.1"}],"published":"2007-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:63fe6e87-1da1-47c8-8d2a-e95b4eb69811","source":"wordfence","cve":"CVE-2026-19077","title":"Copy & Delete Posts <= 1.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fe6e87-1da1-47c8-8d2a-e95b4eb69811?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post-littlebizzy","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-15T21:45:13Z"},{"id":"wordfence:63feaadc-27f2-4e87-892d-07595e08021a","source":"wordfence","cve":"CVE-2026-57651","title":"Ghost Kit \u2013 Page Builder Blocks, Motion Effects & Extensions <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63feaadc-27f2-4e87-892d-07595e08021a?source=api-prod","affected":[{"type":"plugin","slug":"ghostkit","name":"Block Animations, Motion & Scroll Effects \u2013 Ghost Kit","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:51:12Z"},{"id":"wordfence:63fec549-09e0-4d4e-ae41-128ce0669501","source":"wordfence","cve":"CVE-2026-13767","title":"Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63fec549-09e0-4d4e-ae41-128ce0669501?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.0","to_inclusive":true,"patched_in":"11.2.1"}],"published":"2026-07-15T19:22:09Z","updated":"2026-07-16T07:51:01Z"},{"id":"wordfence:63ff56cf-0b64-491f-8629-8b7738adee10","source":"wordfence","cve":"CVE-2024-10875","title":"Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/63ff56cf-0b64-491f-8629-8b7738adee10?source=api-prod","affected":[{"type":"plugin","slug":"fancy-gallery","name":"Gallery Manager","from":"*","from_inclusive":true,"to":"1.6.58","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T14:58:41Z","updated":"2024-11-16T03:20:47Z"},{"id":"wordfence:6401fca3-0e2b-4fb2-8f5e-ef64c2e4a1c8","source":"wordfence","cve":"CVE-2025-22506","title":"Smart Agenda <= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6401fca3-0e2b-4fb2-8f5e-ef64c2e4a1c8?source=api-prod","affected":[{"type":"plugin","slug":"smart-agenda-prise-de-rendez-vous-en-ligne","name":"SmartAgenda \u2013 Prise de rendez-vous en ligne","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-30T15:05:02Z"},{"id":"wordfence:6404476e-0c32-4f8e-882f-6a1785ba5748","source":"wordfence","cve":"CVE-2023-4139","title":"WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listing","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6404476e-0c32-4f8e-882f-6a1785ba5748?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.9.8","to_inclusive":true,"patched_in":"7.9.9"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64087631-3514-4fec-ad2f-b095d7c727bd","source":"wordfence","cve":"CVE-2023-29432","title":"Houzez <= 2.8.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64087631-3514-4fec-ad2f-b095d7c727bd?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:640b1800-3b59-4b06-a803-08cb76d62d99","source":"wordfence","cve":"CVE-2023-5907","title":"File Manager <= 6.3 - Authenticated (Admin+) Arbitrary OS File Access via Path Traversal","severity":"low","cvss":2.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640b1800-3b59-4b06-a803-08cb76d62d99?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2023-11-20T00:00:00Z","updated":"2026-09-04T00:43:51Z"},{"id":"wordfence:640d36ac-7a25-437e-8b0a-8c5beceb14bf","source":"wordfence","cve":"","title":"Myriad <= 2.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640d36ac-7a25-437e-8b0a-8c5beceb14bf?source=api-prod","affected":[{"type":"theme","slug":"myriad","name":"Myriad","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:640dafa4-c4b8-4f22-ab3b-441667c03428","source":"wordfence","cve":"CVE-2025-58598","title":"Klarna Order Management for WooCommerce <= 1.9.8 - Authenticated (Shop Manager+) Information Disclosure via Log Files","severity":"low","cvss":2.7,"cwe":"CWE-117","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640dafa4-c4b8-4f22-ab3b-441667c03428?source=api-prod","affected":[{"type":"plugin","slug":"klarna-order-management-for-woocommerce","name":"Klarna Order Management for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:29:06Z"},{"id":"wordfence:640e109c-366f-4217-98e8-b1e5a0f0f062","source":"wordfence","cve":"CVE-2025-49234","title":"WP Dummy Content Generator <= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640e109c-366f-4217-98e8-b1e5a0f0f062?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-06-16T00:00:00Z","updated":"2025-06-25T14:43:39Z"},{"id":"wordfence:640e24f6-2a0b-4435-a659-d034611d07e4","source":"wordfence","cve":"CVE-2025-49972","title":"TM Replace Howdy <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640e24f6-2a0b-4435-a659-d034611d07e4?source=api-prod","affected":[{"type":"plugin","slug":"tm-replace-howdy","name":"TM Replace Howdy","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:59:37Z"},{"id":"wordfence:640f0b06-9af2-4b79-8f87-97f93b2c51c0","source":"wordfence","cve":"CVE-2023-32516","title":"Menu - Ordering - Reservations <= 2.3.6 - Reflected Cross-Site Scripting via 'redirect'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640f0b06-9af2-4b79-8f87-97f93b2c51c0?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:640f2616-f3a5-4be6-901e-848d2d77506e","source":"wordfence","cve":"CVE-2021-24376","title":"Autoptimize <= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/640f2616-f3a5-4be6-901e-848d2d77506e?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2020-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:641123af-1ec6-4549-a58c-0a08b4678f45","source":"wordfence","cve":"CVE-2024-4295","title":"Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/641123af-1ec6-4549-a58c-0a08b4678f45?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"5.7.21"}],"published":"2024-06-04T00:00:00Z","updated":"2024-06-05T05:33:06Z"},{"id":"wordfence:64117878-2fa3-4f80-bec4-f3f10b879f83","source":"wordfence","cve":"CVE-2024-34828","title":"Church Admin <= 4.1.32 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64117878-2fa3-4f80-bec4-f3f10b879f83?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.32","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:07:05Z"},{"id":"wordfence:6417269d-3d49-4f33-b92a-5aacb052bab0","source":"wordfence","cve":"CVE-2024-4404","title":"ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6417269d-3d49-4f33-b92a-5aacb052bab0?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-14T05:39:18Z"},{"id":"wordfence:64188179-1d7d-476f-866c-62bc10c85a3d","source":"wordfence","cve":"CVE-2016-10958","title":"Estatik <= 2.2.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64188179-1d7d-476f-866c-62bc10c85a3d?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-06-17T18:51:02Z"},{"id":"wordfence:64196936-a0b8-48a7-ba5c-01ce061df82c","source":"wordfence","cve":"CVE-2022-1407","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.7 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64196936-a0b8-48a7-ba5c-01ce061df82c?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6419b4a0-5729-4162-967b-54918551f5cb","source":"wordfence","cve":"CVE-2025-23633","title":"WP Database Audit <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6419b4a0-5729-4162-967b-54918551f5cb?source=api-prod","affected":[{"type":"plugin","slug":"database-audit","name":"WP Database Audit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:06:31Z"},{"id":"wordfence:641b739d-f888-4327-b1c5-c95de39ee011","source":"wordfence","cve":"CVE-2026-4561","title":"MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/641b739d-f888-4327-b1c5-c95de39ee011?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":"4.12.1"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T13:27:15Z"},{"id":"wordfence:641e52d1-d046-4c15-9624-3b1919cd674f","source":"wordfence","cve":"CVE-2021-24989","title":"Accept Donations with PayPal <= 1.3.3 - Arbitrary Post Deletion via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/641e52d1-d046-4c15-9624-3b1919cd674f?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2021-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:641f2808-540b-446a-9bf0-5bd57f7fabdf","source":"wordfence","cve":"CVE-2026-24558","title":"ABG Rich Pins <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/641f2808-540b-446a-9bf0-5bd57f7fabdf?source=api-prod","affected":[{"type":"plugin","slug":"abg-rich-pins","name":"ABG Rich Pins","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:09:59Z"},{"id":"wordfence:641f7727-83ba-45c2-b3e1-1ce19f86eac7","source":"wordfence","cve":"CVE-2025-1408","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.4","to_inclusive":true,"patched_in":"5.9.4.5"}],"published":"2025-03-21T16:15:56Z","updated":"2025-03-22T04:22:06Z"},{"id":"wordfence:642012fa-28a5-46dc-a68f-3a4ce1cbced3","source":"wordfence","cve":"CVE-2015-1874","title":"Contact Form DB <= 2.8.29 - Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642012fa-28a5-46dc-a68f-3a4ce1cbced3?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-to-database-extension","name":"Contact Form DB","from":"*","from_inclusive":true,"to":"2.8.29","to_inclusive":true,"patched_in":"2.8.32"}],"published":"2015-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64225f1c-3981-4bae-bb6a-95d1a27ad6aa","source":"wordfence","cve":"CVE-2024-30553","title":"WP Twitter Mega Fan Box Widget  <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64225f1c-3981-4bae-bb6a-95d1a27ad6aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-twitter-mega-fan-box","name":"WP Twitter Mega Fan Box Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:16:04Z"},{"id":"wordfence:6423d84f-372d-4c6b-975f-3655dddc95a4","source":"wordfence","cve":"CVE-2025-46520","title":"Related Posts via Taxonomies <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6423d84f-372d-4c6b-975f-3655dddc95a4?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-via-taxonomies","name":"Related Posts via Taxonomies","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:16:51Z"},{"id":"wordfence:642400f6-9579-4065-a5a5-6fec23131778","source":"wordfence","cve":"","title":"Task Manager Pro <= 1.3.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642400f6-9579-4065-a5a5-6fec23131778?source=api-prod","affected":[{"type":"plugin","slug":"task-manager-pro","name":"Task Manager Pro - Task Management Plugin For Wordpress","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2017-07-11T00:00:00Z","updated":"2026-02-26T14:52:22Z"},{"id":"wordfence:64248d15-e6a7-442f-b269-e9f629d297d3","source":"wordfence","cve":"CVE-2023-5419","title":"Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64248d15-e6a7-442f-b269-e9f629d297d3?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6424c34a-a4cd-49fc-a6d4-b2bbd9dcb42c","source":"wordfence","cve":"CVE-2024-54289","title":"Awesome Support <= 6.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6424c34a-a4cd-49fc-a6d4-b2bbd9dcb42c?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-12-11T00:00:00Z","updated":"2025-04-10T18:20:12Z"},{"id":"wordfence:6424de06-95ca-4148-9b24-0df0a2a8871d","source":"wordfence","cve":"CVE-2026-7621","title":"SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6424de06-95ca-4148-9b24-0df0a2a8871d?source=api-prod","affected":[{"type":"plugin","slug":"smtp2go","name":"SMTP2GO for WordPress \u2013 Email Made Easy","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.17.0"}],"published":"2026-05-27T17:42:00Z","updated":"2026-05-28T06:45:41Z"},{"id":"wordfence:64251fd4-1627-49d0-831f-5cb9898c38bf","source":"wordfence","cve":"CVE-2026-10096","title":"Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64251fd4-1627-49d0-831f-5cb9898c38bf?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-06-30T19:07:13Z","updated":"2026-09-22T18:22:35Z"},{"id":"wordfence:6425848f-6876-47ae-a976-cef5d4ce9006","source":"wordfence","cve":"CVE-2026-105891","title":"Event Tickets and Registration <= 5.30.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6425848f-6876-47ae-a976-cef5d4ce9006?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.0.1","to_inclusive":true,"patched_in":"5.30.0.2"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:26Z"},{"id":"wordfence:6428cf3c-a784-4e64-a6ef-041b3793ff67","source":"wordfence","cve":"CVE-2024-30228","title":"Hercules Core <= 6.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6428cf3c-a784-4e64-a6ef-041b3793ff67?source=api-prod","affected":[{"type":"plugin","slug":"hercules-core","name":"Hercules Core","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:59:58Z"},{"id":"wordfence:64292fc7-8f74-4515-988b-f803b0fd7494","source":"wordfence","cve":"CVE-2026-16540","title":"Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64292fc7-8f74-4515-988b-f803b0fd7494?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.6","to_inclusive":false,"patched_in":"1.6.12.6"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:14:17Z"},{"id":"wordfence:642a6d42-100f-4461-b568-35e089287902","source":"wordfence","cve":"","title":"CRM WordPress Plugin \u2013 RepairBuddy <= 3.72 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642a6d42-100f-4461-b568-35e089287902?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.72","to_inclusive":true,"patched_in":"3.73"}],"published":"2022-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:642a8e71-c267-41f5-bcf5-f5627be9038e","source":"wordfence","cve":"CVE-2022-41685","title":"Csomagpontok \u00e9s sz\u00e1ll\u00edt\u00e1si c\u00edmk\u00e9k WooCommerce hez <= 1.9.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642a8e71-c267-41f5-bcf5-f5627be9038e?source=api-prod","affected":[{"type":"plugin","slug":"hungarian-pickup-points-for-woocommerce","name":"Hungarian Pickup Points & Shipping Labels for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.0.2","to_inclusive":true,"patched_in":"1.9.0.3"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:642b589d-cb4b-46a0-b9f3-fad8b26bba0e","source":"wordfence","cve":"CVE-2019-15770","title":"WooCommerce Address Book < 1.6.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642b589d-cb4b-46a0-b9f3-fad8b26bba0e?source=api-prod","affected":[{"type":"plugin","slug":"woo-address-book","name":"Address Book for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2019-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:642c03f4-f12c-4ae2-a4ab-4f49d6bd033c","source":"wordfence","cve":"CVE-2022-45816","title":"GD bbPress Attachments <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642c03f4-f12c-4ae2-a4ab-4f49d6bd033c?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-attachments","name":"forumAttachments for bbPress","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:642dc1d3-a008-4af8-ba9e-dbdd37b93126","source":"wordfence","cve":"CVE-2024-13841","title":"Builder Shortcode Extras \u2013 WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642dc1d3-a008-4af8-ba9e-dbdd37b93126?source=api-prod","affected":[{"type":"plugin","slug":"builder-shortcode-extras","name":"Builder Shortcode Extras \u2013 WordPress Shortcodes Collection to Save You Time","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-06T18:17:38Z","updated":"2025-02-07T06:59:58Z"},{"id":"wordfence:642e2c46-9e42-4c00-bb91-a43497094e12","source":"wordfence","cve":"CVE-2025-58667","title":"ListingPro Reviews < 2.9.11 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642e2c46-9e42-4c00-bb91-a43497094e12?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-reviews","name":"ListingPro Reviews","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":false,"patched_in":"2.9.11"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:18:30Z"},{"id":"wordfence:642f0ad9-1085-4590-b736-9dd88440d047","source":"wordfence","cve":"CVE-2015-9370","title":"Exchange Addon Invoices < 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/642f0ad9-1085-4590-b736-9dd88440d047?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-invoices","name":"Exchange Addon Invoices","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64338fc4-e8c9-4fa5-bb77-861fb5142286","source":"wordfence","cve":"CVE-2021-24900","title":"Ninja Tables <= 4.1.7 - Admin+ Stored Cross-Site Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64338fc4-e8c9-4fa5-bb77-861fb5142286?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6435fc6b-a5dc-4de3-9c53-5d1bfe8cfd88","source":"wordfence","cve":"CVE-2024-35645","title":"Random Banner <= 4.2.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6435fc6b-a5dc-4de3-9c53-5d1bfe8cfd88?source=api-prod","affected":[{"type":"plugin","slug":"random-banner","name":"Random Banner","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":""}],"published":"2024-05-30T00:00:00Z","updated":"2025-04-21T14:47:24Z"},{"id":"wordfence:64371d43-3acd-4863-80e4-deab071777b9","source":"wordfence","cve":"","title":"PowerPress <= 10.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64371d43-3acd-4863-80e4-deab071777b9?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"10.2.3","to_inclusive":true,"patched_in":"10.2.4"}],"published":"2023-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64373c83-92e0-4476-837b-1aeeeae8a2f7","source":"wordfence","cve":"CVE-2026-84760","title":"Ultimate Gift Cards for WooCommerce <= 3.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64373c83-92e0-4476-837b-1aeeeae8a2f7?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:36:37Z"},{"id":"wordfence:64399c1c-ea82-483b-b320-3c6f2cb010b3","source":"wordfence","cve":"CVE-2025-14453","title":"My Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64399c1c-ea82-483b-b320-3c6f2cb010b3?source=api-prod","affected":[{"type":"plugin","slug":"my-album-gallery","name":"My Album Gallery","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:39:43Z","updated":"2026-01-07T09:20:58Z"},{"id":"wordfence:6439ea1f-78de-432f-bb1a-9ffc731a4ff4","source":"wordfence","cve":"CVE-2023-0033","title":"PDF Viewer <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6439ea1f-78de-432f-bb1a-9ffc731a4ff4?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer","name":"PDF Viewer","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:643b8b82-c4e1-4b81-a7e0-aee0f9270702","source":"wordfence","cve":"CVE-2024-11600","title":"Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/643b8b82-c4e1-4b81-a7e0-aee0f9270702?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-01-30T00:57:00Z","updated":"2025-03-21T17:14:38Z"},{"id":"wordfence:643cca2d-5a9a-4561-adf8-af9f0b3b0242","source":"wordfence","cve":"","title":"Embed Articles <= 7.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/643cca2d-5a9a-4561-adf8-af9f0b3b0242?source=api-prod","affected":[{"type":"plugin","slug":"embed-articles","name":"embed-articles","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":""}],"published":"2015-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:643d41b9-f949-4fc1-acb4-d3147b59823b","source":"wordfence","cve":"CVE-2025-39503","title":"Goodlayers Hotel <= 3.1.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/643d41b9-f949-4fc1-acb4-d3147b59823b?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hotel","name":"Goodlayers Hotel","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:40:31Z"},{"id":"wordfence:643ea2b3-246b-40a9-ba48-e10a7d6cdd11","source":"wordfence","cve":"CVE-2025-31794","title":"WR Price List Manager For Woocommerce <= 1.0.8 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/643ea2b3-246b-40a9-ba48-e10a7d6cdd11?source=api-prod","affected":[{"type":"plugin","slug":"wr-price-list-for-woocommerce","name":"WRN Pricing Rules for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-04-02T00:00:00Z","updated":"2026-07-08T20:42:58Z"},{"id":"wordfence:643f92e2-b14e-4056-97fc-1c631027c54f","source":"wordfence","cve":"CVE-2026-18146","title":"Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/643f92e2-b14e-4056-97fc-1c631027c54f?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.11","to_inclusive":true,"patched_in":"6.2.12"}],"published":"2026-08-12T18:34:04Z","updated":"2026-08-13T06:38:30Z"},{"id":"wordfence:644290f8-24f0-425c-b114-ef464daedc84","source":"wordfence","cve":"CVE-2024-13602","title":"Poll Maker <= 5.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/644290f8-24f0-425c-b114-ef464daedc84?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-25T13:02:55Z"},{"id":"wordfence:64452bb0-32bc-4acf-8e89-f6ae7c75cef4","source":"wordfence","cve":"CVE-2023-23882","title":"Ultimate Addons for Beaver Builder - Lite <= 1.5.5 - Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64452bb0-32bc-4acf-8e89-f6ae7c75cef4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64453a11-e0dd-40f8-99c3-f05ef640b42b","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64453a11-e0dd-40f8-99c3-f05ef640b42b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:49:27Z"},{"id":"wordfence:644624d8-c193-4ee6-bc82-7ccda5d7f2ac","source":"wordfence","cve":"CVE-2021-4335","title":"Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/644624d8-c193-4ee6-bc82-7ccda5d7f2ac?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6447de64-b484-4f64-ad78-7df81b5a0ed7","source":"wordfence","cve":"CVE-2020-36709","title":"Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6447de64-b484-4f64-ad78-7df81b5a0ed7?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":false,"patched_in":"2.9.4"}],"published":"2020-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64480862-c076-4ea9-a03b-9aed81f876d5","source":"wordfence","cve":"CVE-2024-1411","title":"PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64480862-c076-4ea9-a03b-9aed81f876d5?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.15","to_inclusive":true,"patched_in":"2.7.16"}],"published":"2024-02-15T00:00:00Z","updated":"2024-02-20T18:56:32Z"},{"id":"wordfence:644a0628-2401-4581-a3a2-463dc2172808","source":"wordfence","cve":"CVE-2025-58966","title":"NEX-Forms LITE < 8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/644a0628-2401-4581-a3a2-463dc2172808?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-lite","name":"NEX-Forms LITE","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":false,"patched_in":"8.2"}],"published":"2025-10-01T00:00:00Z","updated":"2025-10-29T15:27:34Z"},{"id":"wordfence:644c8702-08ad-4048-ae91-041f1771f1dc","source":"wordfence","cve":"CVE-2022-2439","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/644c8702-08ad-4048-ae91-041f1771f1dc?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T03:17:21Z"},{"id":"wordfence:644e2267-c90b-4517-8ded-f2b7c7ec3d27","source":"wordfence","cve":"CVE-2026-9720","title":"Facturaci\u00f3n Electr\u00f3nica Costa Rica <= 2.0.4 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/644e2267-c90b-4517-8ded-f2b7c7ec3d27?source=api-prod","affected":[{"type":"plugin","slug":"factura-electronica-cr","name":"Facturaci\u00f3n Electr\u00f3nica Costa Rica","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-07-28T19:38:33Z","updated":"2026-09-14T17:14:27Z"},{"id":"wordfence:64506fb9-5f12-458e-8b30-ab650a752668","source":"wordfence","cve":"CVE-2026-66604","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.173 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64506fb9-5f12-458e-8b30-ab650a752668?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.173","to_inclusive":true,"patched_in":"2.8.174"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:24:55Z"},{"id":"wordfence:6450dafd-5992-4831-87af-e5e47cc8663e","source":"wordfence","cve":"CVE-2021-4399","title":"Edwiser Bridge <= 2.0.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6450dafd-5992-4831-87af-e5e47cc8663e?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:645328f3-2bcb-4287-952c-2e23ec57bb4e","source":"wordfence","cve":"CVE-2024-1472","title":"WP Maintenance <= 6.1.6 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645328f3-2bcb-4287-952c-2e23ec57bb4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"6.1.7"}],"published":"2024-02-16T00:00:00Z","updated":"2024-02-20T18:56:33Z"},{"id":"wordfence:64534424-709f-4bd2-aa25-638cf05e47f3","source":"wordfence","cve":"CVE-2024-52425","title":"Drozd \u2013 Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64534424-709f-4bd2-aa25-638cf05e47f3?source=api-prod","affected":[{"type":"plugin","slug":"drozd-addons-for-elementor","name":"Drozd \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:23:03Z"},{"id":"wordfence:64553742-ff2b-40e9-92c3-3458a9f988a2","source":"wordfence","cve":"CVE-2026-4244","title":"Post Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64553742-ff2b-40e9-92c3-3458a9f988a2?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T12:28:43Z"},{"id":"wordfence:645552ef-84aa-4f51-93d4-cb85c43fed58","source":"wordfence","cve":"","title":"Photospace Responsive <= 1.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645552ef-84aa-4f51-93d4-cb85c43fed58?source=api-prod","affected":[{"type":"plugin","slug":"photospace-responsive","name":"Photospace Responsive Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2019-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64559d37-0c6b-45f5-8a2a-6e70cb5e423c","source":"wordfence","cve":"CVE-2023-45045","title":"WP Custom Widget area <= 1.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64559d37-0c6b-45f5-8a2a-6e70cb5e423c?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-widget-area","name":"WP Custom Widget area","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-02-06T16:33:17Z"},{"id":"wordfence:64584fcd-be84-4d40-bfa8-e6131d0afd58","source":"wordfence","cve":"CVE-2022-41652","title":"Quiz And Survey Master <= 7.3.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64584fcd-be84-4d40-bfa8-e6131d0afd58?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.10","to_inclusive":true,"patched_in":"7.3.11"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64599caf-d79f-425a-b0b0-b97665130144","source":"wordfence","cve":"CVE-2025-39483","title":"Eventer <= 3.11.2.1 -  Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64599caf-d79f-425a-b0b0-b97665130144?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.11.2.1","to_inclusive":true,"patched_in":"3.11.2.2"}],"published":"2025-08-04T00:00:00Z","updated":"2025-08-15T22:41:24Z"},{"id":"wordfence:645ab4b9-e421-4610-b99b-960a7fbb7779","source":"wordfence","cve":"CVE-2023-36683","title":"Schema Pro <= 2.7.8 - Authenticated(Contributor+) Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645ab4b9-e421-4610-b99b-960a7fbb7779?source=api-prod","affected":[{"type":"plugin","slug":"wp-schema-pro","name":"Schema Pro","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:645ad965-4da3-45e4-aa9e-d5f5f8c9f087","source":"wordfence","cve":"CVE-2017-18598","title":"Qards (All Versions) - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645ad965-4da3-45e4-aa9e-d5f5f8c9f087?source=api-prod","affected":[{"type":"plugin","slug":"qards","name":"Quards","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:645c02b8-595c-42ab-ba83-b0eb40431aee","source":"wordfence","cve":"CVE-2026-28069","title":"Le Truffe <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645c02b8-595c-42ab-ba83-b0eb40431aee?source=api-prod","affected":[{"type":"theme","slug":"letruffe","name":"Le Truffe","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:45:57Z"},{"id":"wordfence:645cf143-5ae9-4d87-8f5d-e3daabb87291","source":"wordfence","cve":"CVE-2026-115245","title":"Chat AI with Dispatcher <= 2.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645cf143-5ae9-4d87-8f5d-e3daabb87291?source=api-prod","affected":[{"type":"plugin","slug":"chat-ai-with-dispatcher","name":"Chat AI with Dispatcher","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:25:20Z"},{"id":"wordfence:645e9b69-9030-45ee-b921-08d09ec76c65","source":"wordfence","cve":"CVE-2026-97256","title":"Page Builder by SiteOrigin <= 2.36.0 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645e9b69-9030-45ee-b921-08d09ec76c65?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.36.0","to_inclusive":true,"patched_in":"2.36.1"}],"published":"2026-09-30T12:13:34Z","updated":"2026-10-09T00:13:00Z"},{"id":"wordfence:645ec67e-f0a3-4273-970c-2073d9a80b4f","source":"wordfence","cve":"CVE-2025-22264","title":"WP Query Creator <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645ec67e-f0a3-4273-970c-2073d9a80b4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-query-creator","name":"WP Query Creator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-02-17T16:40:19Z"},{"id":"wordfence:645f60ad-c8e5-47ec-94f1-960de4ef7838","source":"wordfence","cve":"CVE-2025-13680","title":"Tiger <= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/645f60ad-c8e5-47ec-94f1-960de4ef7838?source=api-prod","affected":[{"type":"theme","slug":"tiger","name":"Tiger","from":"*","from_inclusive":true,"to":"101.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T16:19:02Z","updated":"2025-11-27T04:36:44Z"},{"id":"wordfence:64624d4c-3ffb-4516-a938-0accde24c79f","source":"wordfence","cve":"CVE-2022-0750","title":"Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64624d4c-3ffb-4516-a938-0accde24c79f?source=api-prod","affected":[{"type":"plugin","slug":"photoswipe-masonry","name":"Photoswipe Masonry","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2022-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:646555e8-f820-419c-8bbf-7c86575f7f03","source":"wordfence","cve":"CVE-2026-87848","title":"MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646555e8-f820-419c-8bbf-7c86575f7f03?source=api-prod","affected":[{"type":"plugin","slug":"mpcx-lightbox","name":"Lightbox","from":"1.2.2","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-19T00:00:00Z","updated":"2026-09-29T19:39:45Z"},{"id":"wordfence:64694d30-a780-4655-9a65-af1cfa542ccc","source":"wordfence","cve":"CVE-2022-4793","title":"Blog Designer - Post and Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64694d30-a780-4655-9a65-af1cfa542ccc?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-for-post-and-widget","name":"Blog Designer \u2013 Post and Widget","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:646a9885-8e0e-42a9-a113-0688c9f6dc93","source":"wordfence","cve":"CVE-2024-13707","title":"WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646a9885-8e0e-42a9-a113-0688c9f6dc93?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-uploader","name":"WP Image Uploader","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:41:59Z"},{"id":"wordfence:646af494-5348-484a-80d8-0f9a11ed310e","source":"wordfence","cve":"CVE-2025-32580","title":"DeBounce Email Validator <= 5.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646af494-5348-484a-80d8-0f9a11ed310e?source=api-prod","affected":[{"type":"plugin","slug":"debounce-io-email-validator","name":"DeBounce Email Validator","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.8.2"}],"published":"2025-04-09T00:00:00Z","updated":"2025-08-11T14:23:18Z"},{"id":"wordfence:646b853e-7748-4598-b0b4-feeb17f64235","source":"wordfence","cve":"CVE-2025-22277","title":"Vitepos <= 3.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646b853e-7748-4598-b0b4-feeb17f64235?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:50:10Z"},{"id":"wordfence:646ba700-28d5-455f-88de-2864ef8f202c","source":"wordfence","cve":"CVE-2024-12291","title":"ViewMedica 9 <= 1.4.17 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646ba700-28d5-455f-88de-2864ef8f202c?source=api-prod","affected":[{"type":"plugin","slug":"viewmedica","name":"ViewMedica 9","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":"1.4.18"}],"published":"2025-01-06T15:39:24Z","updated":"2025-11-05T19:04:53Z"},{"id":"wordfence:646e3a57-92e1-4502-a0dd-8921e99cfe2d","source":"wordfence","cve":"CVE-2015-1494","title":"FancyBox for WordPress <= 3.0.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646e3a57-92e1-4502-a0dd-8921e99cfe2d?source=api-prod","affected":[{"type":"plugin","slug":"fancybox-for-wordpress","name":"FancyBox for WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"}],"published":"2015-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:646e75be-716e-4336-80c4-d268e9565c5a","source":"wordfence","cve":"CVE-2025-24705","title":"WooCommerce Quick View <= 1.1.1 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/646e75be-716e-4336-80c4-d268e9565c5a?source=api-prod","affected":[{"type":"plugin","slug":"woo-quick-view","name":"Quick View For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:15:57Z"},{"id":"wordfence:6471b075-8115-4d38-a7dd-2308dca69f15","source":"wordfence","cve":"CVE-2025-4105","title":"Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6471b075-8115-4d38-a7dd-2308dca69f15?source=api-prod","affected":[{"type":"plugin","slug":"splitit-installment-payments","name":"Splitit for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2025-05-20T20:31:09Z","updated":"2025-05-23T13:35:18Z"},{"id":"wordfence:64729dfb-adfe-4eb8-ad3e-03a5784f19a1","source":"wordfence","cve":"CVE-2024-13219","title":"Policy Genius <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64729dfb-adfe-4eb8-ad3e-03a5784f19a1?source=api-prod","affected":[{"type":"plugin","slug":"policy-genius","name":"Privacy Policy Genius","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:58:17Z"},{"id":"wordfence:6478cdbc-a20e-4fe2-bbd6-8a550e5da895","source":"wordfence","cve":"CVE-2024-1990","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6478cdbc-a20e-4fe2-bbd6-8a550e5da895?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.3.1.0","to_inclusive":true,"patched_in":"5.3.2.0"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-09T18:58:52Z"},{"id":"wordfence:64792dd9-f16b-4929-a2ba-a6f53b2e975f","source":"wordfence","cve":"CVE-2022-45067","title":"Exclusive Addons for Elementor <= 2.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64792dd9-f16b-4929-a2ba-a6f53b2e975f?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2023-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:647a2f27-092a-4db1-932d-87ae8c2efcca","source":"wordfence","cve":"CVE-2023-4488","title":"Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/647a2f27-092a-4db1-932d-87ae8c2efcca?source=api-prod","affected":[{"type":"plugin","slug":"dropbox-folder-share","name":"Dropbox Folder Share","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:647b0d58-1397-47ad-b001-6d5085fb4c4f","source":"wordfence","cve":"CVE-2026-18057","title":"Events Manager <= 7.4.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/647b0d58-1397-47ad-b001-6d5085fb4c4f?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:54:31Z"},{"id":"wordfence:647be51d-e137-4e7c-a336-0a5023881c64","source":"wordfence","cve":"CVE-2025-31877","title":"RestroPress <= 3.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/647be51d-e137-4e7c-a336-0a5023881c64?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.8.1"}],"published":"2025-04-01T00:00:00Z","updated":"2026-04-15T15:13:51Z"},{"id":"wordfence:647cc71d-4d3a-4722-b498-baaee2450809","source":"wordfence","cve":"CVE-2023-25054","title":"RSVPMaker  <= 10.6.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/647cc71d-4d3a-4722-b498-baaee2450809?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"10.6.6","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:647f0b46-ac12-445b-9d41-66eba3eb2b1a","source":"wordfence","cve":"CVE-2024-12509","title":"Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/647f0b46-ac12-445b-9d41-66eba3eb2b1a?source=api-prod","affected":[{"type":"plugin","slug":"embed-twine","name":"Embed Twine","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:04:28Z","updated":"2024-12-20T06:59:07Z"},{"id":"wordfence:6480715e-efb7-4dd2-8938-c5b662d86461","source":"wordfence","cve":"CVE-2026-10820","title":"ProfilePress <= 4.16.16 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6480715e-efb7-4dd2-8938-c5b662d86461?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.16","to_inclusive":true,"patched_in":"4.16.17"}],"published":"2026-06-06T00:00:00Z","updated":"2026-08-21T13:49:50Z"},{"id":"wordfence:6481f4c7-2a62-457f-b21e-57e762aab29e","source":"wordfence","cve":"CVE-2026-56032","title":"BuddyBoss Platform <= 3.0.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6481f4c7-2a62-457f-b21e-57e762aab29e?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T13:56:43Z"},{"id":"wordfence:64827b61-42ea-454a-b41d-85ce8d6ad866","source":"wordfence","cve":"CVE-2021-24939","title":"LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64827b61-42ea-454a-b41d-85ce8d6ad866?source=api-prod","affected":[{"type":"plugin","slug":"peters-login-redirect","name":"LoginWP (Formerly Peter's Login Redirect)","from":"*","from_inclusive":true,"to":"3.0.0.5","to_inclusive":false,"patched_in":"3.0.0.5"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6483ba93-d9ae-44a1-a4fc-b3b4af5ac36f","source":"wordfence","cve":"CVE-2026-39691","title":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations <= 2.2.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6483ba93-d9ae-44a1-a4fc-b3b4af5ac36f?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-donation-box","name":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-15T21:30:43Z"},{"id":"wordfence:64852bc8-aeba-458d-9235-94bd4c4ec429","source":"wordfence","cve":"CVE-2024-34443","title":"Slider Revolution <= 6.7.10 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64852bc8-aeba-458d-9235-94bd4c4ec429?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.7.11"}],"published":"2024-05-28T00:00:00Z","updated":"2024-06-05T13:36:43Z"},{"id":"wordfence:64852c99-f1f2-4f87-84bb-59e5b3655802","source":"wordfence","cve":"CVE-2025-64261","title":"Appointment Booking Calendar <= 1.3.95 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64852c99-f1f2-4f87-84bb-59e5b3655802?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.95","to_inclusive":true,"patched_in":"1.3.96"}],"published":"2025-11-15T00:00:00Z","updated":"2025-11-17T19:02:17Z"},{"id":"wordfence:6486ffd9-4c8b-49a0-8493-0743f945b0f6","source":"wordfence","cve":"CVE-2026-119162","title":"User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6486ffd9-4c8b-49a0-8493-0743f945b0f6?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20260916","to_inclusive":true,"patched_in":"20261029"}],"published":"2026-10-30T17:56:06Z","updated":"2026-10-31T06:44:19Z"},{"id":"wordfence:64889659-24d6-40d9-97ba-b448f5205a96","source":"wordfence","cve":"CVE-2025-9196","title":"Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64889659-24d6-40d9-97ba-b448f5205a96?source=api-prod","affected":[{"type":"plugin","slug":"trinity-audio","name":"Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio","from":"*","from_inclusive":true,"to":"5.21.0","to_inclusive":true,"patched_in":"5.22.0"}],"published":"2025-10-10T19:20:55Z","updated":"2025-10-11T07:25:57Z"},{"id":"wordfence:648941b8-d1ab-4587-bd87-f23008ac9a00","source":"wordfence","cve":"CVE-2025-15268","title":"Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/648941b8-d1ab-4587-bd87-f23008ac9a00?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.14.46","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:43:35Z","updated":"2026-06-02T10:44:29Z"},{"id":"wordfence:648e70e7-1cb3-4e5d-ac7a-bc6340d39e09","source":"wordfence","cve":"CVE-2025-31780","title":"Append Content <= 2.1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/648e70e7-1cb3-4e5d-ac7a-bc6340d39e09?source=api-prod","affected":[{"type":"plugin","slug":"append-content","name":"Append Content","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:03:22Z"},{"id":"wordfence:64902171-89da-44a1-b9df-bafdb27da7a6","source":"wordfence","cve":"CVE-2025-52757","title":"SUMO Memberships for WooCommerce < 7.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64902171-89da-44a1-b9df-bafdb27da7a6?source=api-prod","affected":[{"type":"plugin","slug":"sumomemberships","name":"SUMO Memberships for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":false,"patched_in":"7.8.0"}],"published":"2025-08-27T00:00:00Z","updated":"2025-11-04T16:29:29Z"},{"id":"wordfence:64920442-ce61-4bcf-8aae-472a008be0dc","source":"wordfence","cve":"CVE-2026-28176","title":"Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64920442-ce61-4bcf-8aae-472a008be0dc?source=api-prod","affected":[{"type":"plugin","slug":"booking-activities","name":"Booking Activities","from":"*","from_inclusive":true,"to":"1.18.4","to_inclusive":true,"patched_in":"1.18.5"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:52:42Z"},{"id":"wordfence:6494e54c-db04-41f9-8b91-6ad12528cf01","source":"wordfence","cve":"CVE-2025-1061","title":"Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=api-prod","affected":[{"type":"plugin","slug":"nextend-social-login-pro","name":"Nextend Social Login Pro","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2025-02-06T00:00:00Z","updated":"2025-02-07T02:07:58Z"},{"id":"wordfence:649545c8-e6a2-4587-a439-17081f389d46","source":"wordfence","cve":"CVE-2024-12461","title":"WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/649545c8-e6a2-4587-a439-17081f389d46?source=api-prod","affected":[{"type":"plugin","slug":"wp-revive-adserver","name":"WP-Revive Adserver","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:12:13Z","updated":"2024-12-12T03:23:08Z"},{"id":"wordfence:649cbd38-d926-4638-9fb9-6704befa1660","source":"wordfence","cve":"CVE-2014-4577","title":"WP AmASIN \u2013 The Amazon Affiliate Shop <= 0.9.6 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/649cbd38-d926-4638-9fb9-6704befa1660?source=api-prod","affected":[{"type":"plugin","slug":"wp-amasin-the-amazon-affiliate-shop","name":"WP AmASIN \u2013 The Amazon Affiliate Shop","from":"*","from_inclusive":true,"to":"0.9.6","to_inclusive":true,"patched_in":"0.9.7"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:649e12e7-8b99-4076-a4e9-8545208e4fa0","source":"wordfence","cve":"CVE-2026-110893","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/649e12e7-8b99-4076-a4e9-8545208e4fa0?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"1.12.3"}],"published":"2026-10-22T07:33:00Z","updated":"2026-10-23T18:38:41Z"},{"id":"wordfence:64a0bfa9-beb3-4926-bfed-af55a101aff1","source":"wordfence","cve":"","title":"Login With Ajax <= 3.1.6 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a0bfa9-beb3-4926-bfed-af55a101aff1?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2017-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64a15397-0bd6-4be9-90e3-6cb1f56394ad","source":"wordfence","cve":"CVE-2025-3750","title":"Network Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a15397-0bd6-4be9-90e3-6cb1f56394ad?source=api-prod","affected":[{"type":"plugin","slug":"network-posts-extended","name":"Network Posts Extended","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T20:30:33Z","updated":"2025-05-21T09:21:59Z"},{"id":"wordfence:64a36778-c17c-44ee-8b09-c221d27184f8","source":"wordfence","cve":"CVE-2023-7239","title":"WP Dashboard Notes <= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a36778-c17c-44ee-8b09-c221d27184f8?source=api-prod","affected":[{"type":"plugin","slug":"wp-dashboard-notes","name":"WP Dashboard Notes","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2024-01-26T00:00:00Z","updated":"2024-01-29T13:10:03Z"},{"id":"wordfence:64a69f1e-919f-496b-900a-5294424bcccd","source":"wordfence","cve":"CVE-2026-125848","title":"Leo <= 1.7.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a69f1e-919f-496b-900a-5294424bcccd?source=api-prod","affected":[{"type":"theme","slug":"leo","name":"Leo","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:58Z"},{"id":"wordfence:64a7a4db-8b28-4085-91b0-4ea5343c5643","source":"wordfence","cve":"","title":"Import WooCommerce < 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a7a4db-8b28-4085-91b0-4ea5343c5643?source=api-prod","affected":[{"type":"plugin","slug":"import-woocommerce","name":"Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2016-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64a833df-1cb8-40a1-9a8f-c53dcf50c877","source":"wordfence","cve":"CVE-2018-20838","title":"AMP for WP <= 0.9.97.20 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a833df-1cb8-40a1-9a8f-c53dcf50c877?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"0.9.97.20","to_inclusive":true,"patched_in":"0.9.97.21"}],"published":"2018-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64a8cfdb-0e81-451a-aa46-9b99be781079","source":"wordfence","cve":"CVE-2024-4746","title":"Netgsm <= 2.9.32 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a8cfdb-0e81-451a-aa46-9b99be781079?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.9.32","to_inclusive":true,"patched_in":"2.9.33"}],"published":"2024-05-10T00:00:00Z","updated":"2026-04-15T20:36:30Z"},{"id":"wordfence:64a9d0b3-f33c-4393-8c7c-7b2aeb89ea52","source":"wordfence","cve":"CVE-2026-28093","title":"Ozisti <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64a9d0b3-f33c-4393-8c7c-7b2aeb89ea52?source=api-prod","affected":[{"type":"theme","slug":"ozisti","name":"Ozisti | Augmented Reality WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:03:09Z"},{"id":"wordfence:64aa45bd-7bf8-4fe9-85e7-ace226e09f34","source":"wordfence","cve":"CVE-2019-1010124","title":"WooCommerce Product Feed for Google, Facebook, eBay and Many More <= 3.1.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64aa45bd-7bf8-4fe9-85e7-ace226e09f34?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2019-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64aa76c3-a70a-4939-ad46-b2e67a556124","source":"wordfence","cve":"CVE-2025-26583","title":"Video Share VOD <= 2.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64aa76c3-a70a-4939-ad46-b2e67a556124?source=api-prod","affected":[{"type":"plugin","slug":"video-share-vod","name":"Video Share VOD \u2013 Turnkey Video Site Builder Script","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2025-03-12T00:00:00Z","updated":"2025-11-20T19:48:17Z"},{"id":"wordfence:64aadd20-a831-4550-b68d-827722a35c0f","source":"wordfence","cve":"CVE-2025-9945","title":"Optimize More! \u2013 CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64aadd20-a831-4550-b68d-827722a35c0f?source=api-prod","affected":[{"type":"plugin","slug":"optimize-more-css","name":"Optimize More! \u2013 CSS","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:32:49Z","updated":"2025-10-03T11:17:13Z"},{"id":"wordfence:64abe00c-05b7-4661-b560-bae3957ad3e2","source":"wordfence","cve":"CVE-2022-0647","title":"Bulk Creator <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64abe00c-05b7-4661-b560-bae3957ad3e2?source=api-prod","affected":[{"type":"plugin","slug":"bulk-creator","name":"Bulk Creator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64adf533-d83f-4d2d-8356-bdc438f21b13","source":"wordfence","cve":"CVE-2026-15038","title":"InfiniteWP Client <= 1.13.5 - Unauthenticated Administrator Account Takeover on Multi-Site","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64adf533-d83f-4d2d-8356-bdc438f21b13?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2026-08-04T00:00:00Z","updated":"2026-09-17T14:56:36Z"},{"id":"wordfence:64ae36a3-d102-4d51-b685-395283155101","source":"wordfence","cve":"CVE-2023-51676","title":"Happy Addons for Elementor <= 3.9.1.1 - Server Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64ae36a3-d102-4d51-b685-395283155101?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":false,"patched_in":"3.10.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-08T21:57:33Z"},{"id":"wordfence:64b10a7d-ca11-47ec-ba8a-e2b838fd8a2a","source":"wordfence","cve":"CVE-2021-24399","title":"The Sorter <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64b10a7d-ca11-47ec-ba8a-e2b838fd8a2a?source=api-prod","affected":[{"type":"plugin","slug":"the-sorter","name":"The Sorter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64b22728-cb07-48be-94b7-1089156490cd","source":"wordfence","cve":"CVE-2022-1009","title":"Smush \u2013 Lazy Load Images, Optimize & Compress Images <= 3.9.8 - Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64b22728-cb07-48be-94b7-1089156490cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64b49f24-db48-4199-9ce2-3ea70c68d6af","source":"wordfence","cve":"","title":"Recent Posts Widget Extended <= 0.9.9.3 - Cross Site-Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64b49f24-db48-4199-9ce2-3ea70c68d6af?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-widget-extended","name":"Recent Posts Widget Extended","from":"*","from_inclusive":true,"to":"0.9.9.3","to_inclusive":true,"patched_in":"0.9.9.4"}],"published":"2015-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64b4faf1-c2f2-43cd-900e-22edce3145a8","source":"wordfence","cve":"CVE-2007-4139","title":"WordPress Core <= 2.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64b4faf1-c2f2-43cd-900e-22edce3145a8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.2","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64b7985e-bb35-4648-8159-4424661b52a9","source":"wordfence","cve":"CVE-2024-43983","title":"Podlove Podcast Publisher <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64b7985e-bb35-4648-8159-4424661b52a9?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.14"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:03:57Z"},{"id":"wordfence:64bae119-12c3-4b3e-88a7-2eb5a7b1b537","source":"wordfence","cve":"CVE-2021-24184","title":"Tutor LMS \u2013 eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bae119-12c3-4b3e-88a7-2eb5a7b1b537?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64bb204e-3fc6-4570-a3ff-aefb72c2822a","source":"wordfence","cve":"CVE-2025-57954","title":"Poll Maker <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bb204e-3fc6-4570-a3ff-aefb72c2822a?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T16:47:41Z"},{"id":"wordfence:64bc7d47-6b63-4fd9-85d4-82126f86308a","source":"wordfence","cve":"CVE-2024-10486","title":"Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bc7d47-6b63-4fd9-85d4-82126f86308a?source=api-prod","affected":[{"type":"plugin","slug":"google-listings-and-ads","name":"Google for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2024-11-18T09:24:48Z","updated":"2024-11-18T21:31:09Z"},{"id":"wordfence:64bd14de-a201-4532-b980-962feab0d69b","source":"wordfence","cve":"CVE-2026-65458","title":"Polylang <= 3.8.5 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bd14de-a201-4532-b980-962feab0d69b?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:07:22Z"},{"id":"wordfence:64be6e85-00c9-49f5-9ee2-08dbe434a848","source":"wordfence","cve":"CVE-2023-37966","title":"User Activity Log <= 1.6.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64be6e85-00c9-49f5-9ee2-08dbe434a848?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64bf69a8-7d6f-48a8-aabb-29945353cb93","source":"wordfence","cve":"CVE-2026-97295","title":"Media Library Assistant <= 3.42 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bf69a8-7d6f-48a8-aabb-29945353cb93?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2026-10-26T10:01:00Z","updated":"2026-10-28T01:28:39Z"},{"id":"wordfence:64bffbca-39e9-4430-9dda-e50642f53ed9","source":"wordfence","cve":"CVE-2025-27266","title":"Hover Image Button <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64bffbca-39e9-4430-9dda-e50642f53ed9?source=api-prod","affected":[{"type":"plugin","slug":"hover-image-button","name":"Hover Image Button","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:10:00Z"},{"id":"wordfence:64c2c8c2-58f5-4b7d-b226-39ba39e887d5","source":"wordfence","cve":"CVE-2024-1177","title":"WP Club Manager \u2013 WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64c2c8c2-58f5-4b7d-b226-39ba39e887d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-club-manager","name":"WP Club Manager \u2013 WordPress Sports Club Plugin","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-05T21:21:46Z"},{"id":"wordfence:64c4c001-1963-437e-9394-cf3ad0e63342","source":"wordfence","cve":"CVE-2024-8968","title":"WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Color","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64c4c001-1963-437e-9394-cf3ad0e63342?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2024-11-29T00:00:00Z","updated":"2024-12-23T19:19:19Z"},{"id":"wordfence:64c72788-a8fa-4f5b-a5b0-8754e952a14d","source":"wordfence","cve":"CVE-2023-5645","title":"WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL injection via key","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64c72788-a8fa-4f5b-a5b0-8754e952a14d?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-28T00:00:00Z","updated":"2024-02-06T15:51:34Z"},{"id":"wordfence:64cce528-0ad0-45ec-a8f6-e8791b0bece0","source":"wordfence","cve":"CVE-2022-4704","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64cce528-0ad0-45ec-a8f6-e8791b0bece0?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64ccf609-5cdf-4f05-ad83-4fb7aa475ba5","source":"wordfence","cve":"CVE-2015-9376","title":"iThemes Mobile < 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64ccf609-5cdf-4f05-ad83-4fb7aa475ba5?source=api-prod","affected":[{"type":"theme","slug":"ithemes-mobile","name":"Mobile","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64ce00e9-1ef6-4155-9d0d-69a130bddba6","source":"wordfence","cve":"CVE-2025-31526","title":"Behance Portfolio Manager <= 1.7.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64ce00e9-1ef6-4155-9d0d-69a130bddba6?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-03-17T21:20:51Z"},{"id":"wordfence:64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d","source":"wordfence","cve":"CVE-2024-8349","title":"Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-groups","name":"Uncanny Groups for LearnDash","from":"*","from_inclusive":true,"to":"6.1.0.1","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:32:27Z"},{"id":"wordfence:64cf73fa-cdb9-4703-869e-343ee6f8178e","source":"wordfence","cve":"CVE-2015-10110","title":"TinyChat Room Spy <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64cf73fa-cdb9-4703-869e-343ee6f8178e?source=api-prod","affected":[{"type":"plugin","slug":"tinychat-roomspy","name":"TinyChat Room Spy","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2015-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64d0c9f4-bc44-4349-977a-2ba3f12d7398","source":"wordfence","cve":"CVE-2025-22545","title":"iframe to embed <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64d0c9f4-bc44-4349-977a-2ba3f12d7398?source=api-prod","affected":[{"type":"plugin","slug":"iframe-to-embed","name":"iframe to embed","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:37:43Z"},{"id":"wordfence:64d2174e-ee69-4e71-b8cb-ff7a1ba0f52f","source":"wordfence","cve":"CVE-2023-4476","title":"Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64d2174e-ee69-4e71-b8cb-ff7a1ba0f52f?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.23","to_inclusive":true,"patched_in":"3.9.24"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64d2d161-678a-4c0a-b0c5-c28a29a66a5b","source":"wordfence","cve":"CVE-2022-4648","title":"Real Testimonials <= 2.5.11 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64d2d161-678a-4c0a-b0c5-c28a29a66a5b?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"2.5.11","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64d4fec3-2477-4b0a-b05f-4836563fb4c0","source":"wordfence","cve":"CVE-2024-54287","title":"Advanced Blog Post Block <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64d4fec3-2477-4b0a-b05f-4836563fb4c0?source=api-prod","affected":[{"type":"plugin","slug":"advanced-blog-post-block","name":"Advanced Blog Post Block","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:30:10Z"},{"id":"wordfence:64d6099e-2435-4a3a-9dcc-dba4a674c711","source":"wordfence","cve":"CVE-2024-11410","title":"Top and footer bars for announcements, notifications, advertisements, promotions \u2013 YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64d6099e-2435-4a3a-9dcc-dba4a674c711?source=api-prod","affected":[{"type":"plugin","slug":"yoo-bar","name":"YooBar \u2013 Notification Bar & Announcement Bar","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-12-11T15:23:39Z","updated":"2025-11-05T19:16:21Z"},{"id":"wordfence:64db63e5-ff76-494a-be4f-d820f0cc9ab0","source":"wordfence","cve":"CVE-2023-5429","title":"Information Reel <= 10.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64db63e5-ff76-494a-be4f-d820f0cc9ab0?source=api-prod","affected":[{"type":"plugin","slug":"information-reel","name":"Information Reel","from":"*","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":"10.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64de1220-52f5-46a9-b8ba-cf808d5d2e29","source":"wordfence","cve":"CVE-2024-43279","title":"Newsletters <= 4.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64de1220-52f5-46a9-b8ba-cf808d5d2e29?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"4.9.9"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:09:46Z"},{"id":"wordfence:64df8260-603b-48ba-b88b-f89994dd8329","source":"wordfence","cve":"CVE-2024-30234","title":"WholesaleX <= 1.3.1 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64df8260-603b-48ba-b88b-f89994dd8329?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T18:23:13Z"},{"id":"wordfence:64e0adbc-c524-4f9d-9741-ce69edf888f7","source":"wordfence","cve":"CVE-2023-2174","title":"BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e0adbc-c524-4f9d-9741-ce69edf888f7?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64e125c7-3f1e-43ed-8655-e0fbb95bc84b","source":"wordfence","cve":"","title":"CStar Design WordPress Theme <= 4.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e125c7-3f1e-43ed-8655-e0fbb95bc84b?source=api-prod","affected":[{"type":"theme","slug":"cstardesign","name":"CStar Design WordPress Theme","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":""}],"published":"2012-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64e14944-db83-413f-82a3-cda594398c7e","source":"wordfence","cve":"CVE-2024-45625","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e14944-db83-413f-82a3-cda594398c7e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.34.0","to_inclusive":true,"patched_in":"1.34.1"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-12T16:15:05Z"},{"id":"wordfence:64e21c1c-6c52-4bc8-a399-fa010db60fe9","source":"wordfence","cve":"CVE-2025-32156","title":"Just Post Preview Widget <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e21c1c-6c52-4bc8-a399-fa010db60fe9?source=api-prod","affected":[{"type":"plugin","slug":"just-post-preview","name":"Just Post Preview Widget","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:46:37Z"},{"id":"wordfence:64e28272-722d-4a4d-98f6-84e6b29981e3","source":"wordfence","cve":"CVE-2025-10406","title":"BlindMatrix e-Commerce = 3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e28272-722d-4a4d-98f6-84e6b29981e3?source=api-prod","affected":[{"type":"plugin","slug":"window-blinds-solution","name":"BlindMatrix e-Commerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-09-24T00:00:00Z","updated":"2025-10-16T13:52:32Z"},{"id":"wordfence:64e4d51a-7b65-4fba-9742-bc7d23f46f8d","source":"wordfence","cve":"CVE-2026-13454","title":"MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e4d51a-7b65-4fba-9742-bc7d23f46f8d?source=api-prod","affected":[{"type":"plugin","slug":"motopress-appointment-lite","name":"MotoPress Appointment Booking","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-06-30T20:06:16Z","updated":"2026-07-01T08:30:04Z"},{"id":"wordfence:64e806df-4919-4a58-8f21-075f09668174","source":"wordfence","cve":"CVE-2023-0037","title":"10Web Map Builder for Google Maps <= 1.0.72 - Unauthenticated SQL Injection via Multiple Parameters","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64e806df-4919-4a58-8f21-075f09668174?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.72","to_inclusive":true,"patched_in":"1.0.73"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64ea54e2-0394-4017-a4d4-d96df424aa3f","source":"wordfence","cve":"CVE-2026-14216","title":"Booking for Appointments and Events Calendar \u2013 Amelia < 2.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64ea54e2-0394-4017-a4d4-d96df424aa3f?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":false,"patched_in":"2.4.7"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T17:52:24Z"},{"id":"wordfence:64eb3d67-7056-4a03-ba3b-a04c2e96648d","source":"wordfence","cve":"CVE-2024-3942","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.3.8 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb3d67-7056-4a03-ba3b-a04c2e96648d?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:11Z"},{"id":"wordfence:64eb4bfe-09b4-43c7-9d7e-f14fc5edf3c1","source":"wordfence","cve":"CVE-2021-25070","title":"WP Block and Stop Bad Bots <= 6.88 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb4bfe-09b4-43c7-9d7e-f14fc5edf3c1?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.88","to_inclusive":false,"patched_in":"6.90"}],"published":"2022-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64ed8547-0dc1-4f0a-8b0b-27ce20b8bbd6","source":"wordfence","cve":"CVE-2023-0374","title":"W4 Post List <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64ed8547-0dc1-4f0a-8b0b-27ce20b8bbd6?source=api-prod","affected":[{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64f04129-c833-4c2e-a00d-d4e8e435f4a5","source":"wordfence","cve":"CVE-2025-58651","title":"PlayerJS <= 2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f04129-c833-4c2e-a00d-d4e8e435f4a5?source=api-prod","affected":[{"type":"plugin","slug":"playerjs","name":"PlayerJS \u2013 Free Custom HTML5 Video and Audio Player Builder","from":"*","from_inclusive":true,"to":"2.24","to_inclusive":true,"patched_in":"2.25"}],"published":"2025-09-22T00:00:00Z","updated":"2026-06-08T16:12:57Z"},{"id":"wordfence:64f07bca-5d04-4b28-b775-f47ed692575e","source":"wordfence","cve":"CVE-2026-7543","title":"Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f07bca-5d04-4b28-b775-f47ed692575e?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-07-15T19:04:34Z","updated":"2026-07-16T07:51:02Z"},{"id":"wordfence:64f11bc9-88b5-43d5-bc76-129dc5909210","source":"wordfence","cve":"CVE-2024-5036","title":"Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f11bc9-88b5-43d5-bc76-129dc5909210?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T11:06:02Z"},{"id":"wordfence:64f1a71f-e210-4191-bfb4-56f8568180ed","source":"wordfence","cve":"CVE-2026-16149","title":"Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f1a71f-e210-4191-bfb4-56f8568180ed?source=api-prod","affected":[{"type":"plugin","slug":"security-hardener","name":"Security Hardener","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-08-22T11:09:38Z","updated":"2026-08-22T23:27:20Z"},{"id":"wordfence:64f30329-ecf2-4e30-bc23-9d447e239e08","source":"wordfence","cve":"CVE-2025-12803","title":"Bold Builder <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f30329-ecf2-4e30-bc23-9d447e239e08?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2026-02-06T17:29:33Z","updated":"2026-08-14T19:42:01Z"},{"id":"wordfence:64f3d36c-8211-4360-9235-3020395891a1","source":"wordfence","cve":"CVE-2024-51581","title":"Restaurant & Cafe Addon for Elementor <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f3d36c-8211-4360-9235-3020395891a1?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:10:08Z"},{"id":"wordfence:64f4009e-2715-4c58-acbd-e516f1a76646","source":"wordfence","cve":"CVE-2021-24134","title":"Constant Contact Forms <= 1.8.7 Editor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f4009e-2715-4c58-acbd-e516f1a76646?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms","name":"Constant Contact Forms","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":false,"patched_in":"1.8.8"}],"published":"2020-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64f43aee-01ee-4fbb-a174-966ed3c06b21","source":"wordfence","cve":"CVE-2021-4226","title":"RSFirewall! <= 1.1.24 - IP Address Spoofing","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f43aee-01ee-4fbb-a174-966ed3c06b21?source=api-prod","affected":[{"type":"plugin","slug":"rsfirewall","name":"RSFirewall!","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64f4789e-bbe7-4c07-86c6-f2767d6e1901","source":"wordfence","cve":"CVE-2025-58252","title":"Getwid <= 2.1.2 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f4789e-bbe7-4c07-86c6-f2767d6e1901?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T20:50:07Z"},{"id":"wordfence:64f51991-f767-4f7b-94e7-68c0e2214849","source":"wordfence","cve":"CVE-2011-5270","title":"WordPress Core < 3.0.6 - Incorrect Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f51991-f767-4f7b-94e7-68c0e2214849?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2011-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64f879af-aa8f-4edf-8369-ca032603d529","source":"wordfence","cve":"CVE-2023-48327","title":"WC Vendors Marketplace <= 2.4.7 - Authenticated (Shop manager+) SQL Injection via search dates","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64f879af-aa8f-4edf-8369-ca032603d529?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.7.1"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64fd32a1-da2a-42db-9597-06366a34f543","source":"wordfence","cve":"CVE-2014-9441","title":"Lightbox Photo Gallery <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64fd32a1-da2a-42db-9597-06366a34f543?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-photo-gallery","name":"Lightbox Photo Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:64fe64aa-4f55-470d-960b-3b39a4912090","source":"wordfence","cve":"CVE-2025-62912","title":"SiteGround Email Marketing <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64fe64aa-4f55-470d-960b-3b39a4912090?source=api-prod","affected":[{"type":"plugin","slug":"siteground-email-marketing","name":"SiteGround Email Marketing","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-09-30T00:00:00Z","updated":"2025-12-04T20:44:24Z"},{"id":"wordfence:64fedaf1-3edf-43e9-8521-95a5efa1c8f4","source":"wordfence","cve":"CVE-2026-118204","title":"WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/64fedaf1-3edf-43e9-8521-95a5efa1c8f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.89","to_inclusive":true,"patched_in":"5.5.90"}],"published":"2026-11-06T18:26:56Z","updated":"2026-11-07T06:39:37Z"},{"id":"wordfence:6500b559-4c26-47e8-b131-100ece3ca3bd","source":"wordfence","cve":"CVE-2025-7661","title":"Partnersk\u00fd syst\u00e9m Martinus <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6500b559-4c26-47e8-b131-100ece3ca3bd?source=api-prod","affected":[{"type":"plugin","slug":"martinus-partnersky-system","name":"Partnersk\u00fd syst\u00e9m Martinus","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T14:11:28Z","updated":"2025-07-19T02:22:57Z"},{"id":"wordfence:6501410e-8625-43ad-8ad5-57944aad052d","source":"wordfence","cve":"CVE-2026-66644","title":"Typing Effect <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6501410e-8625-43ad-8ad5-57944aad052d?source=api-prod","affected":[{"type":"plugin","slug":"animated-typing-effect","name":"Typing Effect","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:23:31Z"},{"id":"wordfence:6504ae5c-a36d-495e-aa93-40a3753857c6","source":"wordfence","cve":"CVE-2024-0768","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6504ae5c-a36d-495e-aa93-40a3753857c6?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-25T17:14:19Z"},{"id":"wordfence:65066a17-653b-4444-9bd0-894ea8c1acb1","source":"wordfence","cve":"CVE-2026-2144","title":"Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65066a17-653b-4444-9bd0-894ea8c1acb1?source=api-prod","affected":[{"type":"plugin","slug":"magic-login-mail","name":"Magic Login Mail or QR Code","from":"*","from_inclusive":true,"to":"2.05","to_inclusive":true,"patched_in":"2.06"}],"published":"2026-02-13T16:21:07Z","updated":"2026-02-16T22:01:53Z"},{"id":"wordfence:6507c647-0d1e-498c-840a-a72bd3474117","source":"wordfence","cve":"CVE-2025-3504","title":"WP Maps \u2013 Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6507c647-0d1e-498c-840a-a72bd3474117?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-06-03T14:04:11Z"},{"id":"wordfence:650b510f-dc13-4ba4-af68-187f516b3051","source":"wordfence","cve":"CVE-2026-104801","title":"PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650b510f-dc13-4ba4-af68-187f516b3051?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"34.0.10","to_inclusive":true,"patched_in":"34.0.11"}],"published":"2026-10-09T17:51:12Z","updated":"2026-10-13T14:16:49Z"},{"id":"wordfence:650b5677-7c70-415f-81bf-12514393e4c9","source":"wordfence","cve":"CVE-2024-2734","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650b5677-7c70-415f-81bf-12514393e4c9?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:21Z"},{"id":"wordfence:650d346d-c30a-4ee1-ac50-6a264e181174","source":"wordfence","cve":"CVE-2026-104729","title":"Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650d346d-c30a-4ee1-ac50-6a264e181174?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.16.2","to_inclusive":true,"patched_in":"3.16.3"}],"published":"2026-10-27T17:54:48Z","updated":"2026-10-28T06:45:13Z"},{"id":"wordfence:650dbbaa-4348-42a6-973c-487f53430955","source":"wordfence","cve":"CVE-2021-24746","title":"Sassy Social Share <= 3.3.39 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650dbbaa-4348-42a6-973c-487f53430955?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.40","to_inclusive":false,"patched_in":"3.3.40"}],"published":"2022-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:650dfc4c-d851-481c-af8f-4dfe1e128a1d","source":"wordfence","cve":"CVE-2022-0346","title":"XML Sitemap Generator for Google <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650dfc4c-d851-481c-af8f-4dfe1e128a1d?source=api-prod","affected":[{"type":"plugin","slug":"www-xml-sitemap-generator-org","name":"XML Sitemap Generator for Google","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:650f7232-7279-401d-beb1-26f70c69164b","source":"wordfence","cve":"CVE-2022-4320","title":"connectDaily <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/650f7232-7279-401d-beb1-26f70c69164b?source=api-prod","affected":[{"type":"plugin","slug":"connect-daily-web-calendar","name":"connectDaily Events Calendar Plugin","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:651572c7-83e0-4651-aa43-9177fbf9d91e","source":"wordfence","cve":"CVE-2024-52483","title":"LeanPress <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651572c7-83e0-4651-aa43-9177fbf9d91e?source=api-prod","affected":[{"type":"plugin","slug":"leanpress","name":"LeanPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:44:19Z"},{"id":"wordfence:651646b0-231f-401c-9f6d-d414609bd7ba","source":"wordfence","cve":"CVE-2024-6810","title":"Quiz Organizer <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651646b0-231f-401c-9f6d-d414609bd7ba?source=api-prod","affected":[{"type":"plugin","slug":"quiz-organizer","name":"Quiz Organizer","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-25T21:41:40Z","updated":"2025-02-26T11:12:33Z"},{"id":"wordfence:65166432-a877-4070-94c1-cdaf7e5d7586","source":"wordfence","cve":"CVE-2023-37389","title":"Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65166432-a877-4070-94c1-cdaf7e5d7586?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.5.99","to_inclusive":false,"patched_in":"1.5.99"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65189c49-600d-4a69-a687-0ff9e327783e","source":"wordfence","cve":"CVE-2022-36401","title":"TeraWallet \u2013 For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via lock_unlock_terawallet","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65189c49-600d-4a69-a687-0ff9e327783e?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.24","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6518a71b-1dd0-4bb5-b768-16674fc83120","source":"wordfence","cve":"CVE-2024-53723","title":"Google Plus Share and +1 Button <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6518a71b-1dd0-4bb5-b768-16674fc83120?source=api-prod","affected":[{"type":"plugin","slug":"google-plus-share-and-plusone-button","name":"Google Plus Share and +1 Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:01:22Z"},{"id":"wordfence:65192fdb-86db-475a-8c61-4db922920cfe","source":"wordfence","cve":"CVE-2024-12562","title":"s2Member Pro <= 241216 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65192fdb-86db-475a-8c61-4db922920cfe?source=api-prod","affected":[{"type":"plugin","slug":"s2member-pro","name":"s2Member Pro","from":"*","from_inclusive":true,"to":"241216","to_inclusive":true,"patched_in":"250214"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-15T09:24:23Z"},{"id":"wordfence:651a7036-d421-41b7-91db-102e60d8274e","source":"wordfence","cve":"CVE-2025-14069","title":"Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651a7036-d421-41b7-91db-102e60d8274e?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.54","to_inclusive":true,"patched_in":"1.54.1"}],"published":"2026-01-22T17:19:06Z","updated":"2026-01-23T05:29:51Z"},{"id":"wordfence:651aa149-0968-4916-b260-067d32193d83","source":"wordfence","cve":"CVE-2026-4375","title":"DoLeads Integrator <= 1.2.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651aa149-0968-4916-b260-067d32193d83?source=api-prod","affected":[{"type":"plugin","slug":"doleads-integrator","name":"DoLeads Integrator","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-16T00:00:00Z","updated":"2026-08-21T13:49:53Z"},{"id":"wordfence:651df16c-2472-4124-90a3-69b98e478ed3","source":"wordfence","cve":"CVE-2021-34660","title":"WP Fusion Lite <= 3.37.18 \u2013 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651df16c-2472-4124-90a3-69b98e478ed3?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"*","from_inclusive":true,"to":"3.37.18","to_inclusive":true,"patched_in":"3.37.30"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:651fa700-2462-4c9c-bd13-85f3a53a64df","source":"wordfence","cve":"CVE-2026-5109","title":"Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/651fa700-2462-4c9c-bd13-85f3a53a64df?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:652367a0-fca2-4313-8217-d8811ada0ab5","source":"wordfence","cve":"CVE-2023-51486","title":"WooCommerce PDF Invoice Builder <= 1.2.101 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/652367a0-fca2-4313-8217-d8811ada0ab5?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.101","to_inclusive":true,"patched_in":"1.2.102"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6525195e-5d90-4dd4-b9ee-612a8295c262","source":"wordfence","cve":"CVE-2026-13116","title":"PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6525195e-5d90-4dd4-b9ee-612a8295c262?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.14.0","to_inclusive":true,"patched_in":"5.15.0"}],"published":"2026-07-10T14:36:35Z","updated":"2026-10-29T23:36:09Z"},{"id":"wordfence:6528041a-0217-43d5-bf29-9208e23aadd9","source":"wordfence","cve":"","title":"Weblizar Pin It Button On Image Hover And Post < 3.4 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6528041a-0217-43d5-bf29-9208e23aadd9?source=api-prod","affected":[{"type":"plugin","slug":"pinterest-pin-it-button-on-image-hover-and-post","name":"Weblizar Pin It Button On Image Hover And Post","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2022-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:652d63ab-8c25-4b49-b6e3-69ffd363151a","source":"wordfence","cve":"CVE-2026-28056","title":"MCKinney's Politics <= 1.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/652d63ab-8c25-4b49-b6e3-69ffd363151a?source=api-prod","affected":[{"type":"theme","slug":"mckinney-politics","name":"MCKinney's Politics","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:18:29Z"},{"id":"wordfence:652f57b8-9472-469a-8edd-32825373fb67","source":"wordfence","cve":"CVE-2025-69147","title":"Putter <= 1.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/652f57b8-9472-469a-8edd-32825373fb67?source=api-prod","affected":[{"type":"theme","slug":"putter","name":"Putter","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T11:57:31Z"},{"id":"wordfence:652f7cb3-dc5a-4071-a605-0ea65beeb06c","source":"wordfence","cve":"CVE-2026-14843","title":"Events Made Easy <= 3.1.3 - Insecure Direct Object Reference to Unauthenticated Person Data Modification","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/652f7cb3-dc5a-4071-a605-0ea65beeb06c?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T14:24:50Z"},{"id":"wordfence:65301dc9-8c6c-44db-935e-9c719984bb1e","source":"wordfence","cve":"CVE-2026-28186","title":"Travelfic Toolkit <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65301dc9-8c6c-44db-935e-9c719984bb1e?source=api-prod","affected":[{"type":"plugin","slug":"travelfic-toolkit","name":"Tourfic Toolkit","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:08:55Z"},{"id":"wordfence:65329e2c-0ce2-4033-93a8-ba52ae3774c1","source":"wordfence","cve":"","title":"Audio <= 0.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65329e2c-0ce2-4033-93a8-ba52ae3774c1?source=api-prod","affected":[{"type":"plugin","slug":"audio","name":"Audio","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6535f932-3aa4-4686-adf6-4e7a1f494e02","source":"wordfence","cve":"CVE-2021-24170","title":"User Profile Picture <= 2.4.0 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6535f932-3aa4-4686-adf6-4e7a1f494e02?source=api-prod","affected":[{"type":"plugin","slug":"metronet-profile-picture","name":"User Profile Picture","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2021-03-03T00:00:00Z","updated":"2026-10-30T22:21:35Z"},{"id":"wordfence:6536d19f-a042-4404-b0c9-91aacd7768f7","source":"wordfence","cve":"CVE-2025-3671","title":"WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:56:02Z","updated":"2025-08-16T03:38:49Z"},{"id":"wordfence:65386d2b-5d0c-4e49-a79a-a793b4b599e0","source":"wordfence","cve":"CVE-2025-49447","title":"FW Food Menu  <= 6.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65386d2b-5d0c-4e49-a79a-a793b4b599e0?source=api-prod","affected":[{"type":"plugin","slug":"fw-food-menu","name":"FW Food Menu \u2013 Responsive food menu with ordering & delivery solutions","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:34:38Z"},{"id":"wordfence:65395034-0b20-462c-93ee-e755e5c888a4","source":"wordfence","cve":"CVE-2025-7367","title":"Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65395034-0b20-462c-93ee-e755e5c888a4?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2025-07-14T16:08:00Z","updated":"2025-07-15T04:23:42Z"},{"id":"wordfence:653ab9cb-7084-47e4-b5e3-6788fa5d7496","source":"wordfence","cve":"CVE-2021-24839","title":"SupportCandy <= 2.2.4 - Unauthenticated Arbitrary Ticket Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/653ab9cb-7084-47e4-b5e3-6788fa5d7496?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2022-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:653bf021-370d-4787-9ded-c5c915aed1d6","source":"wordfence","cve":"CVE-2024-1462","title":"Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/653bf021-370d-4787-9ded-c5c915aed1d6?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-page","name":"Maintenance Page","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:26:53Z"},{"id":"wordfence:653e20ae-f018-41b5-a973-f73fddae70e5","source":"wordfence","cve":"CVE-2026-2468","title":"Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/653e20ae-f018-41b5-a973-f73fddae70e5?source=api-prod","affected":[{"type":"plugin","slug":"quentn-wp","name":"Quentn WP","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2026-03-20T15:05:50Z","updated":"2026-04-27T18:10:06Z"},{"id":"wordfence:653fbe5d-3388-4227-8a0a-46764b6be4d2","source":"wordfence","cve":"CVE-2021-24986","title":"Post Grid <= 2.1.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/653fbe5d-3388-4227-8a0a-46764b6be4d2?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":false,"patched_in":"2.1.16"}],"published":"2022-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:653fe650-d2b8-4bb3-828b-2606ced2d6a1","source":"wordfence","cve":"CVE-2025-64233","title":"Codiqa < 1.2.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/653fe650-d2b8-4bb3-828b-2606ced2d6a1?source=api-prod","affected":[{"type":"theme","slug":"codiqa","name":"Codiqa - Software & Digital WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-20T19:12:07Z"},{"id":"wordfence:65402225-99ba-49ff-807b-b8e4cf474ffb","source":"wordfence","cve":"CVE-2021-25041","title":"Photo Gallery <= 1.5.67 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65402225-99ba-49ff-807b-b8e4cf474ffb?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":false,"patched_in":"1.5.68"}],"published":"2021-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6543b8ad-e3f3-43c7-93f9-23f7df07e391","source":"wordfence","cve":"CVE-2025-5703","title":"StageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6543b8ad-e3f3-43c7-93f9-23f7df07e391?source=api-prod","affected":[{"type":"plugin","slug":"stageshow","name":"StageShow","from":"*","from_inclusive":true,"to":"10.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T18:42:14Z","updated":"2025-06-06T06:42:50Z"},{"id":"wordfence:6543e6e2-e052-466e-ad19-656fd8d01805","source":"wordfence","cve":"CVE-2024-5501","title":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6543e6e2-e052-466e-ad19-656fd8d01805?source=api-prod","affected":[{"type":"plugin","slug":"supreme-modules-for-divi","name":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder","from":"*","from_inclusive":true,"to":"2.5.51","to_inclusive":true,"patched_in":"2.5.52"}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-01T05:38:11Z"},{"id":"wordfence:65465de9-c527-4b18-8a52-c9cd2d594f72","source":"wordfence","cve":"CVE-2013-2202","title":"WordPress Core < 3.5.2 - XXE Injection","severity":"medium","cvss":5.4,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65465de9-c527-4b18-8a52-c9cd2d594f72?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6546d73e-3b2e-4e90-bf93-81e8459d800d","source":"wordfence","cve":"CVE-2026-93770","title":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6546d73e-3b2e-4e90-bf93-81e8459d800d?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.13","to_inclusive":true,"patched_in":"14.16.14"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:57:09Z"},{"id":"wordfence:654727e0-6129-47c7-94f3-10567b1a42d4","source":"wordfence","cve":"CVE-2023-45274","title":"SendPulse Free Web Push <= 1.3.1 - Cross-Site Request Forgery via sendpulse_config","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654727e0-6129-47c7-94f3-10567b1a42d4?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-web-push","name":"SendPulse Free Web Push","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-10-06T00:00:00Z","updated":"2024-03-14T14:55:20Z"},{"id":"wordfence:654a9131-0e55-4cf8-9777-c466c3182418","source":"wordfence","cve":"CVE-2026-84758","title":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress <= 6.4.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654a9131-0e55-4cf8-9777-c466c3182418?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.26","to_inclusive":true,"patched_in":"6.4.27"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:13:19Z"},{"id":"wordfence:654b28a2-36e7-4226-abda-5c666e54c2de","source":"wordfence","cve":"CVE-2025-14829","title":"e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654b28a2-36e7-4226-abda-5c666e54c2de?source=api-prod","affected":[{"type":"plugin","slug":"e-xact-hosted-payment","name":"E-xact | Hosted Payment |","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-19T18:22:42Z"},{"id":"wordfence:654bcf34-33a6-425c-8830-1418444acf10","source":"wordfence","cve":"CVE-2026-39445","title":"Alukas < 3.0.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654bcf34-33a6-425c-8830-1418444acf10?source=api-prod","affected":[{"type":"theme","slug":"alukas","name":"Alukas \u2013 Luxury Jewelry Store WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:01:52Z"},{"id":"wordfence:654d9622-f43c-47e0-8518-e1e77a69963f","source":"wordfence","cve":"CVE-2026-110883","title":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat <= 6.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654d9622-f43c-47e0-8518-e1e77a69963f?source=api-prod","affected":[{"type":"plugin","slug":"webcam-2way-videochat","name":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:50:26Z"},{"id":"wordfence:654ff09e-00c5-4d7a-af72-d0bc0ec520ad","source":"wordfence","cve":"CVE-2026-27434","title":"WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/654ff09e-00c5-4d7a-af72-d0bc0ec520ad?source=api-prod","affected":[{"type":"theme","slug":"wprentals","name":"WP Rentals - Booking Accommodation WordPress Theme","from":"*","from_inclusive":true,"to":"3.14.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T09:24:00Z","updated":"2026-10-08T23:19:07Z"},{"id":"wordfence:65504747-7f1b-43f9-be4d-48b9547e7c45","source":"wordfence","cve":"CVE-2024-4446","title":"Content Views \u2013 Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65504747-7f1b-43f9-be4d-48b9547e7c45?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:29Z"},{"id":"wordfence:655077b2-7152-4fc6-845d-068a5af730bb","source":"wordfence","cve":"CVE-2024-38670","title":"Team Members <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655077b2-7152-4fc6-845d-068a5af730bb?source=api-prod","affected":[{"type":"plugin","slug":"team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:49:56Z"},{"id":"wordfence:6551eea6-1059-4caa-876c-3d08083130f6","source":"wordfence","cve":"CVE-2023-38386","title":"Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6551eea6-1059-4caa-876c-3d08083130f6?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65526517-aec5-454b-94c0-973359d840e1","source":"wordfence","cve":"CVE-2021-24455","title":"Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65526517-aec5-454b-94c0-973359d840e1?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6554a95c-13f9-4548-a062-fe9cd873d334","source":"wordfence","cve":"CVE-2026-57717","title":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6554a95c-13f9-4548-a062-fe9cd873d334?source=api-prod","affected":[{"type":"plugin","slug":"knit-pay","name":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more","from":"*","from_inclusive":true,"to":"9.6.0.0","to_inclusive":true,"patched_in":"9.6.0.1"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:42:06Z"},{"id":"wordfence:655729e1-9002-4ca5-be08-9fb601fb53ad","source":"wordfence","cve":"CVE-2025-48094","title":"Magic Slider <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655729e1-9002-4ca5-be08-9fb601fb53ad?source=api-prod","affected":[{"type":"plugin","slug":"magic_slider","name":"Magic Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:51:00Z"},{"id":"wordfence:65581fa6-110f-4ae3-a903-dbf649b44417","source":"wordfence","cve":"CVE-2022-47152","title":"ClickFunnels <= 3.1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65581fa6-110f-4ae3-a903-dbf649b44417?source=api-prod","affected":[{"type":"plugin","slug":"clickfunnels","name":"ClickFunnels","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65585b03-5a53-454a-b6f9-1d124a622f5e","source":"wordfence","cve":"CVE-2025-31554","title":"Docxpresso <= 2.6 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65585b03-5a53-454a-b6f9-1d124a622f5e?source=api-prod","affected":[{"type":"plugin","slug":"docxpresso","name":"Docxpresso","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T13:39:46Z"},{"id":"wordfence:655b35a7-a532-4ceb-aa02-4a8192e6449d","source":"wordfence","cve":"CVE-2024-2958","title":"SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655b35a7-a532-4ceb-aa02-4a8192e6449d?source=api-prod","affected":[{"type":"plugin","slug":"svs-pricing-tables","name":"SVS Pricing Tables","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:11Z"},{"id":"wordfence:655b3a54-34b1-4c1a-a1b5-51d87e3134d4","source":"wordfence","cve":"CVE-2019-15841","title":"Facebook for WooCommerce <= 1.9.12 - Cross-Site Request Forgery allowing Option Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655b3a54-34b1-4c1a-a1b5-51d87e3134d4?source=api-prod","affected":[{"type":"plugin","slug":"facebook-for-woocommerce","name":"Meta for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2019-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:655c08e6-4ef2-438e-b381-1bc3748c3771","source":"wordfence","cve":"CVE-2024-9776","title":"ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655c08e6-4ef2-438e-b381-1bc3748c3771?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery","name":"ImagePress \u2013 Front-End Photo Uploads & Member Galleries","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-11T16:56:12Z","updated":"2024-10-12T05:39:41Z"},{"id":"wordfence:655cd6ec-088f-4610-ae7f-76a959c290af","source":"wordfence","cve":"CVE-2024-49312","title":"Edwiser Bridge <= 3.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655cd6ec-088f-4610-ae7f-76a959c290af?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-14T16:45:05Z"},{"id":"wordfence:655e3795-44c8-498c-a8cd-9985abc9664c","source":"wordfence","cve":"CVE-2025-47478","title":"ProfileGrid  <= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655e3795-44c8-498c-a8cd-9985abc9664c?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.0","to_inclusive":true,"patched_in":"5.9.5.1"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-20T16:39:57Z"},{"id":"wordfence:655e6486-e35f-4e7b-b894-55606d3eba56","source":"wordfence","cve":"","title":"WP Fast Cache <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655e6486-e35f-4e7b-b894-55606d3eba56?source=api-prod","affected":[{"type":"plugin","slug":"wp-fast-cache","name":"WP Fast Cache","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2015-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:655fc91d-5920-4214-8ef1-8191e2683f9d","source":"wordfence","cve":"CVE-2023-34386","title":"WPC Smart Wishlist for WooCommerce <= 4.7.1 - Cross-Site Request Forgery via wishlist_add and wishlist_remove","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/655fc91d-5920-4214-8ef1-8191e2683f9d?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6560ba0b-2190-4d30-b0c4-f07d524ccfde","source":"wordfence","cve":"CVE-2025-12783","title":"Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6560ba0b-2190-4d30-b0c4-f07d524ccfde?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-brands","name":"Premmerce Brands for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2025-12-11T14:30:57Z","updated":"2026-02-25T15:55:42Z"},{"id":"wordfence:6560bec0-286a-499e-a3d8-98596e16c83b","source":"wordfence","cve":"CVE-2025-24747","title":"Houzez  <= 3.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6560bec0-286a-499e-a3d8-98596e16c83b?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-01-21T00:00:00Z","updated":"2025-02-24T15:25:43Z"},{"id":"wordfence:65614ad8-cec6-4768-a3f2-c550254bd418","source":"wordfence","cve":"CVE-2025-68602","title":"Accept Donations with PayPal <= 1.5.2 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65614ad8-cec6-4768-a3f2-c550254bd418?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-13T15:15:51Z"},{"id":"wordfence:656300ce-6e94-4382-b0ed-9cecca5b917c","source":"wordfence","cve":"CVE-2024-27195","title":"Watermark RELOADED <= 1.3.5 - Cross-Site Request Forgery via optionsPage","severity":"high","cvss":8.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/656300ce-6e94-4382-b0ed-9cecca5b917c?source=api-prod","affected":[{"type":"plugin","slug":"watermark-reloaded","name":"Watermark RELOADED","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-02-26T00:00:00Z","updated":"2025-12-09T17:06:21Z"},{"id":"wordfence:65644477-263d-493d-99df-80fc558aad51","source":"wordfence","cve":"CVE-2025-24563","title":"Cleanup \u2013 Directory Listing & Classifieds WordPress Plugin <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65644477-263d-493d-99df-80fc558aad51?source=api-prod","affected":[{"type":"plugin","slug":"cleanup-light","name":"Cleanup \u2013 Directory Listing & Classifieds WordPress Plugin","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2024-11-27T00:00:00Z","updated":"2025-02-20T16:47:18Z"},{"id":"wordfence:65645065-5c17-45f5-9741-26aa2b5d8815","source":"wordfence","cve":"CVE-2025-27305","title":"Table of Contents Block <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65645065-5c17-45f5-9741-26aa2b5d8815?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents","name":"Table of Contents Block","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:22:08Z"},{"id":"wordfence:65647429-8c76-4538-9725-91fda7fd7d4e","source":"wordfence","cve":"CVE-2025-22594","title":"Better User Shortcodes <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65647429-8c76-4538-9725-91fda7fd7d4e?source=api-prod","affected":[{"type":"plugin","slug":"better-user-shortcodes","name":"Better User Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:29:51Z"},{"id":"wordfence:6565e345-3374-43d9-9789-f0d9138dc3e8","source":"wordfence","cve":"CVE-2026-12077","title":"Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6565e345-3374-43d9-9789-f0d9138dc3e8?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-24T15:14:17Z","updated":"2026-06-25T03:42:21Z"},{"id":"wordfence:6566f610-1c5c-4198-ae25-e4651ee62952","source":"wordfence","cve":"CVE-2026-66579","title":"JetElements <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6566f610-1c5c-4198-ae25-e4651ee62952?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.1","to_inclusive":true,"patched_in":"2.9.2.2"}],"published":"2026-09-17T11:52:00Z","updated":"2026-09-22T18:46:21Z"},{"id":"wordfence:6567afc2-dc96-449e-b64c-af129c4bf245","source":"wordfence","cve":"CVE-2025-52745","title":"Farm Agrico <= 1.3.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6567afc2-dc96-449e-b64c-af129c4bf245?source=api-prod","affected":[{"type":"theme","slug":"farmagrico","name":"Farm Agrico | Agriculture & Organic Farm Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T21:37:37Z"},{"id":"wordfence:6567e63c-3129-47b2-a734-733eb599821a","source":"wordfence","cve":"CVE-2026-8684","title":"MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6567e63c-3129-47b2-a734-733eb599821a?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.0.2"}],"published":"2026-05-21T19:21:36Z","updated":"2026-05-22T07:50:27Z"},{"id":"wordfence:656bf2b4-1930-4e96-b92b-01593889a43f","source":"wordfence","cve":"CVE-2020-14962","title":"Final Tiles Gallery <= 3.4.18 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/656bf2b4-1930-4e96-b92b-01593889a43f?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.4.18","to_inclusive":true,"patched_in":"3.4.19"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:656c1372-3e3c-4163-a4dc-1a24ea388043","source":"wordfence","cve":"CVE-2026-118757","title":"PiWeb Disable payment method / Partial payment for WooCommerce < 1.1.10.9 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/656c1372-3e3c-4163-a4dc-1a24ea388043?source=api-prod","affected":[{"type":"plugin","slug":"disable-payment-method-for-woocommerce","name":"PiWeb Disable payment method / Partial payment for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10.9","to_inclusive":false,"patched_in":""}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-04T21:42:24Z"},{"id":"wordfence:656c6236-55e6-4989-8f3d-2d2f81ab0093","source":"wordfence","cve":"CVE-2025-5488","title":"WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/656c6236-55e6-4989-8f3d-2d2f81ab0093?source=api-prod","affected":[{"type":"plugin","slug":"wp-masonry-infinite-scroll","name":"WP Masonry & Infinite Scroll","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-06-25T13:41:51Z","updated":"2025-06-26T01:44:39Z"},{"id":"wordfence:6570c830-3084-49eb-9fe7-6c6b58711749","source":"wordfence","cve":"CVE-2026-93526","title":"Event Tickets and Registration <= 5.29.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6570c830-3084-49eb-9fe7-6c6b58711749?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.4","to_inclusive":true,"patched_in":"5.29.5"}],"published":"2026-09-23T11:01:43Z","updated":"2026-09-29T20:01:49Z"},{"id":"wordfence:6571a899-f217-434f-bbed-b1faf77a8d8b","source":"wordfence","cve":"CVE-2024-5533","title":"Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6571a899-f217-434f-bbed-b1faf77a8d8b?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.25.1","to_inclusive":true,"patched_in":"4.25.2"}],"published":"2024-06-17T19:31:11Z","updated":"2024-06-18T07:50:40Z"},{"id":"wordfence:657226b4-db55-4859-8f38-65b4ace11f4a","source":"wordfence","cve":"CVE-2019-15771","title":"ND Shortcodes  <= 5.9.1 - Unauthenticated WordPress Options Update","severity":"medium","cvss":6.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/657226b4-db55-4859-8f38-65b4ace11f4a?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":false,"patched_in":"6.0"}],"published":"2019-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6573ebcd-5cf6-4d40-8768-911304744d11","source":"wordfence","cve":"CVE-2026-96761","title":"Welcart e-Commerce <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6573ebcd-5cf6-4d40-8768-911304744d11?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.3","to_inclusive":true,"patched_in":"2.12.4"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:50:15Z"},{"id":"wordfence:6576aa18-0f30-407b-a651-127d216097f5","source":"wordfence","cve":"CVE-2026-24583","title":"SumUp Payment Gateway For WooCommerce <= 2.7.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6576aa18-0f30-407b-a651-127d216097f5?source=api-prod","affected":[{"type":"plugin","slug":"sumup-payment-gateway-for-woocommerce","name":"SumUp Payment Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2026-01-19T00:00:00Z","updated":"2026-02-06T20:20:59Z"},{"id":"wordfence:6577d7e4-af15-4b12-b8c9-94e231493b3f","source":"wordfence","cve":"CVE-2024-47640","title":"WP ERP <= 1.13.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6577d7e4-af15-4b12-b8c9-94e231493b3f?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:54:25Z"},{"id":"wordfence:657b1b7b-eac2-4935-a50f-0849c4e96b16","source":"wordfence","cve":"CVE-2023-34007","title":"Download Monitor <= 4.8.3 - Authenticated(Subscriber+) Arbitrary File Upload via upload_file","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/657b1b7b-eac2-4935-a50f-0849c4e96b16?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2023-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:657bea00-9709-48b8-807a-c9a18b0aee1d","source":"wordfence","cve":"CVE-2026-10038","title":"Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/657bea00-9709-48b8-807a-c9a18b0aee1d?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.11.1","to_inclusive":true,"patched_in":"1.8.11.2"}],"published":"2026-06-05T10:28:15Z","updated":"2026-06-05T23:28:26Z"},{"id":"wordfence:657e2a4d-7e10-495d-8352-1adc0cb89e83","source":"wordfence","cve":"CVE-2025-5142","title":"Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/657e2a4d-7e10-495d-8352-1adc0cb89e83?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-access-restriction","name":"Simple Page Access Restriction","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.32"}],"published":"2025-05-29T20:43:33Z","updated":"2025-05-30T09:22:07Z"},{"id":"wordfence:657f3bd7-2cdc-4eb6-ba50-7c7fca468df0","source":"wordfence","cve":"CVE-2019-25217","title":"SiteGround Optimizer <= 5.0.12 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/657f3bd7-2cdc-4eb6-ba50-7c7fca468df0?source=api-prod","affected":[{"type":"plugin","slug":"sg-cachepress","name":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":false,"patched_in":"5.0.13"}],"published":"2019-03-14T00:00:00Z","updated":"2024-10-16T06:43:33Z"},{"id":"wordfence:65849267-8bb5-48fd-b95e-e89a1e744fe0","source":"wordfence","cve":"CVE-2024-13639","title":"Read More & Accordion <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65849267-8bb5-48fd-b95e-e89a1e744fe0?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-02-12T19:43:15Z","updated":"2025-02-13T08:21:26Z"},{"id":"wordfence:65869722-1147-4fdd-a844-944c51a07f2e","source":"wordfence","cve":"CVE-2015-1580","title":"Redirection Page <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65869722-1147-4fdd-a844-944c51a07f2e?source=api-prod","affected":[{"type":"plugin","slug":"redirection-page","name":"Redirection Page","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2015-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:658a6e39-504d-456e-a8d1-e90cc72eca6a","source":"wordfence","cve":"CVE-2026-112843","title":"Strong Testimonials <= 3.3.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658a6e39-504d-456e-a8d1-e90cc72eca6a?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.14","to_inclusive":true,"patched_in":"3.3.15"}],"published":"2026-10-22T06:52:00Z","updated":"2026-10-23T18:53:04Z"},{"id":"wordfence:658ba848-fbfe-4cee-b997-77bc4cae53dc","source":"wordfence","cve":"CVE-2023-34029","title":"Disable WordPress Update Notifications <= 2.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658ba848-fbfe-4cee-b997-77bc4cae53dc?source=api-prod","affected":[{"type":"plugin","slug":"disable-update-notifications","name":"Disable WordPress Update Notifications and auto-update Email Notifications","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:658ccd08-5f46-4a11-8d86-38b49027f83e","source":"wordfence","cve":"","title":"Export any WordPress data to XML/CSV <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658ccd08-5f46-4a11-8d86-38b49027f83e?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:658e5ebd-692b-44ff-89a6-df4e5c00579b","source":"wordfence","cve":"CVE-2026-104652","title":"Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658e5ebd-692b-44ff-89a6-df4e5c00579b?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:26:28Z"},{"id":"wordfence:658fdcf6-17e0-4cc7-accd-32c4e1e02779","source":"wordfence","cve":"CVE-2026-15234","title":"Codeless Page Builder <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658fdcf6-17e0-4cc7-accd-32c4e1e02779?source=api-prod","affected":[{"type":"plugin","slug":"codeless-page-builder","name":"Codeless Page Builder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:14:02Z"},{"id":"wordfence:658ff7da-6496-4cca-8b1c-76b794c20aad","source":"wordfence","cve":"CVE-2023-48768","title":"Quantity Plus Minus Button for WooCommerce by CodeAstrology <= 1.1.9 - Cross-Site Request Forgery via wqpmb_form_submit","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/658ff7da-6496-4cca-8b1c-76b794c20aad?source=api-prod","affected":[{"type":"plugin","slug":"wc-quantity-plus-minus-button","name":"Quantity Plus Minus Button for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65914bbf-6563-4bf2-a358-885e182a1365","source":"wordfence","cve":"CVE-2025-9219","title":"Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65914bbf-6563-4bf2-a358-885e182a1365?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-09-02T00:00:00Z","updated":"2025-09-03T08:27:25Z"},{"id":"wordfence:6591c2a5-d238-418f-be00-1bb5c2fa77e9","source":"wordfence","cve":"","title":"Traveler \u2013 Travel Booking WordPress Theme < 2.8.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6591c2a5-d238-418f-be00-1bb5c2fa77e9?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.8.4"}],"published":"2020-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6593b0de-db7a-4b7e-bd74-cc2b1e36ac60","source":"wordfence","cve":"CVE-2024-3984","title":"EmbedSocial \u2013 Social Media Feeds, Reviews and Galleries <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6593b0de-db7a-4b7e-bd74-cc2b1e36ac60?source=api-prod","affected":[{"type":"plugin","slug":"embedalbum-pro","name":"EmbedSocial \u2013 Social Media Feeds, Reviews and Galleries","from":"*","from_inclusive":true,"to":"1.1.29","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-06-18T14:30:03Z","updated":"2024-07-01T16:29:04Z"},{"id":"wordfence:6594b5ba-57e4-4ef1-93b9-ac1e90ed13be","source":"wordfence","cve":"CVE-2022-4835","title":"Social Sharing Toolkit <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6594b5ba-57e4-4ef1-93b9-ac1e90ed13be?source=api-prod","affected":[{"type":"plugin","slug":"social-sharing-toolkit","name":"Social Sharing Toolkit","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65963ce0-6589-4753-837c-14ef37a1a9e3","source":"wordfence","cve":"CVE-2024-1083","title":"Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65963ce0-6589-4753-837c-14ef37a1a9e3?source=api-prod","affected":[{"type":"plugin","slug":"simple-restrict","name":"Simple Restrict","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:26:54Z"},{"id":"wordfence:65988550-d39d-40be-8d25-647e7237062d","source":"wordfence","cve":"CVE-2026-8732","title":"WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65988550-d39d-40be-8d25-647e7237062d?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-gold","name":"WP Maps Pro","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2026-05-28T16:51:57Z","updated":"2026-08-21T13:59:12Z"},{"id":"wordfence:6598d171-e68c-4d2f-9cd1-f1574fa90433","source":"wordfence","cve":"CVE-2025-13390","title":"WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover","severity":"critical","cvss":10.0,"cwe":"CWE-303","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6598d171-e68c-4d2f-9cd1-f1574fa90433?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"1.4.0","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-12-03T00:39:01Z","updated":"2025-12-03T16:47:43Z"},{"id":"wordfence:6598f796-2763-44c4-b3ae-62b776a149e6","source":"wordfence","cve":"CVE-2026-106932","title":"Moloni <= 5.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6598f796-2763-44c4-b3ae-62b776a149e6?source=api-prod","affected":[{"type":"plugin","slug":"moloni","name":"Moloni","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":true,"patched_in":"5.0.14"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:06:25Z"},{"id":"wordfence:659bbf79-f4f2-49fa-8ba5-60e821c798fc","source":"wordfence","cve":"CVE-2024-47338","title":"WPExperts Square For GiveWP <= 1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659bbf79-f4f2-49fa-8ba5-60e821c798fc?source=api-prod","affected":[{"type":"plugin","slug":"wpexperts-square-for-give","name":"Square Gateway for GiveWP by WPExperts","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-26T00:00:00Z","updated":"2026-02-26T15:01:58Z"},{"id":"wordfence:659e13bc-c225-4c35-95d5-455d39798bc5","source":"wordfence","cve":"CVE-2025-1620","title":"GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659e13bc-c225-4c35-95d5-455d39798bc5?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.6","to_inclusive":true,"patched_in":"4.15.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-13T21:57:52Z"},{"id":"wordfence:659eb886-dbee-4e5f-a769-17447aad8f33","source":"wordfence","cve":"CVE-2025-52833","title":"LMS <= 9.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659eb886-dbee-4e5f-a769-17447aad8f33?source=api-prod","affected":[{"type":"theme","slug":"lms","name":"LMS - Education WordPress Theme","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2025-06-30T00:00:00Z","updated":"2026-02-26T15:14:42Z"},{"id":"wordfence:659ef2e8-589c-4901-88ce-1d674c056ece","source":"wordfence","cve":"CVE-2025-2228","title":"Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":5.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659ef2e8-589c-4901-88ce-1d674c056ece?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T12:41:19Z"},{"id":"wordfence:659f5a99-84f4-44b0-8546-445831c7e0d1","source":"wordfence","cve":"CVE-2021-24272","title":"Fitness Calculators <= 1.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659f5a99-84f4-44b0-8546-445831c7e0d1?source=api-prod","affected":[{"type":"plugin","slug":"fitness-calculators","name":"fitness calculators","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:659fcb95-9041-443e-9b75-0d2f8c6108aa","source":"wordfence","cve":"CVE-2024-30502","title":"WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/659fcb95-9041-443e-9b75-0d2f8c6108aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:21:57Z"},{"id":"wordfence:65a0033d-2266-429c-aab2-80bd46c93b91","source":"wordfence","cve":"CVE-2020-6859","title":"Ultimate Member <= 2.1.2 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a0033d-2266-429c-aab2-80bd46c93b91?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"}],"published":"2020-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65a02152-be62-4e27-8a31-e88f23e0236f","source":"wordfence","cve":"CVE-2015-9339","title":"WordPress File Upload < 2.7.1 - Arbitrary File Upload","severity":"high","cvss":8.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a02152-be62-4e27-8a31-e88f23e0236f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":false,"patched_in":"2.7.1"}],"published":"2015-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65a17f2e-8ce3-4d2e-8413-05826dcd9035","source":"wordfence","cve":"CVE-2025-31474","title":"WP Database Optimizer <= 1.2.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a17f2e-8ce3-4d2e-8413-05826dcd9035?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-optimizer","name":"WP Database Optimizer","from":"*","from_inclusive":true,"to":"1.2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:56:15Z"},{"id":"wordfence:65a3604d-eb6b-484f-834a-b3d75fe3bda7","source":"wordfence","cve":"CVE-2024-13850","title":"Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a3604d-eb6b-484f-834a-b3d75fe3bda7?source=api-prod","affected":[{"type":"plugin","slug":"simple-add-pages-or-posts","name":"Simple add pages or posts","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-08T00:06:52Z","updated":"2025-02-08T12:21:40Z"},{"id":"wordfence:65a3a9b7-b7ca-41f4-b808-7d955205a104","source":"wordfence","cve":"CVE-2025-60170","title":"HTACCESS IP Blocker <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a3a9b7-b7ca-41f4-b808-7d955205a104?source=api-prod","affected":[{"type":"plugin","slug":"htaccess-ip-blocker","name":"HTACCESS IP Blocker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:09:42Z"},{"id":"wordfence:65a7f274-e54c-483b-893b-fb9bd264f41d","source":"wordfence","cve":"CVE-2026-93623","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a7f274-e54c-483b-893b-fb9bd264f41d?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2026-09-23T16:22:00Z","updated":"2026-09-29T20:02:59Z"},{"id":"wordfence:65a9e877-e870-4e36-985d-c0629abe3f78","source":"wordfence","cve":"CVE-2019-25295","title":"WP Cost Estimation < 9.660 - Upload Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65a9e877-e870-4e36-985d-c0629abe3f78?source=api-prod","affected":[{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"9.660","to_inclusive":false,"patched_in":"9.660"}],"published":"2019-02-14T00:00:00Z","updated":"2026-01-08T01:50:10Z"},{"id":"wordfence:65aa16f5-8881-41f9-b63d-77cc73e8baac","source":"wordfence","cve":"CVE-2026-109689","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers <= 3.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65aa16f5-8881-41f9-b63d-77cc73e8baac?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2026-10-15T18:14:00Z","updated":"2026-10-23T18:26:12Z"},{"id":"wordfence:65aa20e2-efc1-481a-8ed4-423d2420c3db","source":"wordfence","cve":"CVE-2026-0806","title":"WP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65aa20e2-efc1-481a-8ed4-423d2420c3db?source=api-prod","affected":[{"type":"plugin","slug":"wp-clanwars","name":"WP-ClanWars","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:25:34Z","updated":"2026-01-24T07:26:43Z"},{"id":"wordfence:65aa6694-0ed9-40a4-bd1c-1b51cd5e537d","source":"wordfence","cve":"CVE-2022-35242","title":"THE Leads Management System: 59sec LITE <= 3.4.1 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65aa6694-0ed9-40a4-bd1c-1b51cd5e537d?source=api-prod","affected":[{"type":"plugin","slug":"59sec-lite-contact-form-7-push-notifications-on-ios-and-android","name":"THE Leads Management System: 59sec LITE","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65ab07e8-4cba-4d81-8e80-8c6c96c1095e","source":"wordfence","cve":"CVE-2022-44631","title":"1app Business Forms <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ab07e8-4cba-4d81-8e80-8c6c96c1095e?source=api-prod","affected":[{"type":"plugin","slug":"1app-business-forms","name":"1app Business Forms","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65ad6138-d33b-4271-b059-c5f018af03c0","source":"wordfence","cve":"CVE-2024-54381","title":"Advance Menu Manager <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ad6138-d33b-4271-b059-c5f018af03c0?source=api-prod","affected":[{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-06T15:14:08Z"},{"id":"wordfence:65ae3119-61d1-4ec0-8ba2-352aae5cc834","source":"wordfence","cve":"CVE-2025-11987","title":"Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ae3119-61d1-4ec0-8ba2-352aae5cc834?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-11-04T21:24:01Z","updated":"2025-11-05T09:27:41Z"},{"id":"wordfence:65ae71fc-cc3e-4208-99fe-ce1984515f5a","source":"wordfence","cve":"CVE-2024-54356","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ae71fc-cc3e-4208-99fe-ce1984515f5a?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:26:01Z"},{"id":"wordfence:65aedeef-d370-4d04-9396-1cf6a2b29033","source":"wordfence","cve":"CVE-2024-43947","title":"WP Armour Extended <= 1.26 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65aedeef-d370-4d04-9396-1cf6a2b29033?source=api-prod","affected":[{"type":"plugin","slug":"wp-armour-extended","name":"WP Armour Extended","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.32"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:17:07Z"},{"id":"wordfence:65b2b72a-5c76-463e-9513-26b400b40a65","source":"wordfence","cve":"CVE-2022-1791","title":"One Click Plugin Updater <= 2.4.14 - Cross-Site Request Forgery to Settings Update","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b2b72a-5c76-463e-9513-26b400b40a65?source=api-prod","affected":[{"type":"plugin","slug":"one-click-plugin-updater","name":"One Click Plugin Updater","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65b3baaf-86e4-4dd2-b3eb-84c21eabdd6d","source":"wordfence","cve":"","title":"WP Fastest Cache <= 0.8.7.4 - SQL Injection","severity":"high","cvss":7.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b3baaf-86e4-4dd2-b3eb-84c21eabdd6d?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.7.4","to_inclusive":true,"patched_in":"0.8.7.5"}],"published":"2018-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65b3f4b3-f475-404b-b071-9b08146985db","source":"wordfence","cve":"CVE-2026-19697","title":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor < 2.5.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b3f4b3-f475-404b-b071-9b08146985db?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:12:21Z"},{"id":"wordfence:65b48fc0-27fd-4a37-afb8-2213ca0d4746","source":"wordfence","cve":"CVE-2025-5673","title":"Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b48fc0-27fd-4a37-afb8-2213ca0d4746?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.4.4","to_inclusive":true,"patched_in":"8.4.5"}],"published":"2025-06-16T13:39:52Z","updated":"2025-06-17T01:44:11Z"},{"id":"wordfence:65b54e53-ec14-4dae-bcc1-1ca9b4128324","source":"wordfence","cve":"CVE-2026-65526","title":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator <= 4.0.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b54e53-ec14-4dae-bcc1-1ca9b4128324?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-17T00:16:38Z"},{"id":"wordfence:65b55b54-9af5-4f83-93f9-079cd51d8c91","source":"wordfence","cve":"CVE-2024-43116","title":"Simple Local Avatars <= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b55b54-9af5-4f83-93f9-079cd51d8c91?source=api-prod","affected":[{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.7.11"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:13:42Z"},{"id":"wordfence:65b6bbe4-1c34-47f3-b637-c79d97383abf","source":"wordfence","cve":"CVE-2026-26212","title":"Rara One Click Demo Import <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b6bbe4-1c34-47f3-b637-c79d97383abf?source=api-prod","affected":[{"type":"plugin","slug":"rara-one-click-demo-import","name":"Rara One Click Demo Import","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T15:16:27Z"},{"id":"wordfence:65b6cca9-46f4-452a-ad03-b72af76dfe99","source":"wordfence","cve":"CVE-2026-94538","title":"WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b6cca9-46f4-452a-ad03-b72af76dfe99?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download","name":"WP File Download","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.3.10"}],"published":"2026-10-09T17:50:53Z","updated":"2026-10-16T15:24:40Z"},{"id":"wordfence:65b8e9b3-6078-4a78-86f9-7251c1978199","source":"wordfence","cve":"","title":"Eventify - Simple Events <= 1.7.f - SQL Injection via eventid","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b8e9b3-6078-4a78-86f9-7251c1978199?source=api-prod","affected":[{"type":"plugin","slug":"eventify","name":"Eventify \u2013 Events, Lists and Calendar","from":"*","from_inclusive":true,"to":"1.7.f","to_inclusive":true,"patched_in":"1.7.g"}],"published":"2011-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65b9fea3-323a-4123-ad83-3d713eb5552f","source":"wordfence","cve":"CVE-2023-37990","title":"Perelink Pro <= 2.1.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65b9fea3-323a-4123-ad83-3d713eb5552f?source=api-prod","affected":[{"type":"plugin","slug":"perelink","name":"Perelink Pro","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65be9417-7029-4f34-b834-98208a42743b","source":"wordfence","cve":"CVE-2025-3844","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65be9417-7029-4f34-b834-98208a42743b?source=api-prod","affected":[{"type":"plugin","slug":"peprodev-ups","name":"PeproDev Ultimate Profile Solutions","from":"1.9.1","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-05-06T13:28:19Z","updated":"2025-11-05T19:49:11Z"},{"id":"wordfence:65bf0897-4d90-41e7-89a3-69845ea54ce5","source":"wordfence","cve":"CVE-2024-11371","title":"Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65bf0897-4d90-41e7-89a3-69845ea54ce5?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.18.6.2","to_inclusive":true,"patched_in":"0.18.7"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T08:31:11Z"},{"id":"wordfence:65c3ca36-79e6-47f8-9524-27e7631f4caf","source":"wordfence","cve":"CVE-2026-83627","title":"Hummingbird \u2013 Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65c3ca36-79e6-47f8-9524-27e7631f4caf?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":true,"patched_in":"3.21.1"}],"published":"2026-09-04T17:05:27Z","updated":"2026-09-05T05:30:54Z"},{"id":"wordfence:65c45519-97c8-4869-bd23-ac611f5a457b","source":"wordfence","cve":"CVE-2025-14434","title":"Ultimate Post Kit <= 4.0.15 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65c45519-97c8-4869-bd23-ac611f5a457b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"4.0.16"}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-06T16:34:09Z"},{"id":"wordfence:65c72e79-f0a9-4293-98be-956d8e4afb83","source":"wordfence","cve":"CVE-2007-1897","title":"WordPress Core < 2.1.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65c72e79-f0a9-4293-98be-956d8e4afb83?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65c8514f-ffc7-4ebc-a8f0-a98040783065","source":"wordfence","cve":"CVE-2026-104049","title":"Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65c8514f-ffc7-4ebc-a8f0-a98040783065?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:21:39Z"},{"id":"wordfence:65c8ea6c-85f1-4e96-995f-57200819280e","source":"wordfence","cve":"","title":"Myriad <= 2.0 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65c8ea6c-85f1-4e96-995f-57200819280e?source=api-prod","affected":[{"type":"theme","slug":"myriad","name":"Myriad","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65ca20b0-0831-4f60-9021-679be6c145ef","source":"wordfence","cve":"CVE-2026-8198","title":"Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ca20b0-0831-4f60-9021-679be6c145ef?source=api-prod","affected":[{"type":"plugin","slug":"logtivity","name":"Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-05-08T23:40:04Z","updated":"2026-05-09T12:29:22Z"},{"id":"wordfence:65cb692f-b518-4581-ba63-c43eb450c56e","source":"wordfence","cve":"CVE-2015-4465","title":"zM Ajax Login & Register <= 1.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65cb692f-b518-4581-ba63-c43eb450c56e?source=api-prod","affected":[{"type":"plugin","slug":"zm-ajax-login-register","name":"ZM Ajax Login & Register","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2015-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65d11459-5cad-4d8b-a81d-7f0dd4342a52","source":"wordfence","cve":"CVE-2024-11748","title":"Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d11459-5cad-4d8b-a81d-7f0dd4342a52?source=api-prod","affected":[{"type":"plugin","slug":"taeggie-feed","name":"Taeggie Feed","from":"*","from_inclusive":true,"to":"0.1.9","to_inclusive":true,"patched_in":"0.1.10"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T02:26:08Z"},{"id":"wordfence:65d15ceb-ab39-4088-a289-7244063aedf8","source":"wordfence","cve":"CVE-2025-1509","title":"Show Me The Cookies <= 1.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d15ceb-ab39-4088-a289-7244063aedf8?source=api-prod","affected":[{"type":"plugin","slug":"show-me-the-cookies","name":"Show Me The Cookies","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T14:59:53Z","updated":"2025-02-22T03:20:59Z"},{"id":"wordfence:65d4350e-54b9-4b53-86c6-1486f7ddc5c1","source":"wordfence","cve":"CVE-2026-82215","title":"Payment Gateway PayPay for WooCommerce 0.5 - 0.9.3 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d4350e-54b9-4b53-86c6-1486f7ddc5c1?source=api-prod","affected":[{"type":"plugin","slug":"wc-paypay-gateway","name":"Payment Gateway PayPay for WooCommerce","from":"0.5","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:33:12Z"},{"id":"wordfence:65d88c4e-5551-4d15-9653-d64352517ec8","source":"wordfence","cve":"CVE-2025-58895","title":"Integro <= 1.8.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d88c4e-5551-4d15-9653-d64352517ec8?source=api-prod","affected":[{"type":"theme","slug":"integro","name":"Integro \u2014 IT Services & Digital Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-20T21:06:49Z"},{"id":"wordfence:65d8dbff-1402-4a84-808a-49e2a5ab861d","source":"wordfence","cve":"CVE-2025-57947","title":"Photo Gallery by Ays <= 6.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d8dbff-1402-4a84-808a-49e2a5ab861d?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T16:48:29Z"},{"id":"wordfence:65d965ac-66ae-4c23-b9c2-335b93a140d9","source":"wordfence","cve":"CVE-2025-9851","title":"Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65d965ac-66ae-4c23-b9c2-335b93a140d9?source=api-prod","affected":[{"type":"plugin","slug":"appointmind","name":"Appointmind","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-19T13:04:05Z"},{"id":"wordfence:65db0063-63c4-400b-9192-ddcc16c0a541","source":"wordfence","cve":"CVE-2023-0169","title":"Zoho Forms <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65db0063-63c4-400b-9192-ddcc16c0a541?source=api-prod","affected":[{"type":"plugin","slug":"zoho-forms","name":"Zoho Forms \u2013 Drag & Drop Form Builder for Websites \u2013 Contact Forms, Payment Forms, Order Forms & More","from":"3.0.0","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65db2345-4b55-466c-b148-7d954de96a87","source":"wordfence","cve":"CVE-2012-6623","title":"WP Forum Server < 1.7.5 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65db2345-4b55-466c-b148-7d954de96a87?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65dffde9-2a50-41fe-bc21-3d0915068887","source":"wordfence","cve":"CVE-2026-4429","title":"OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65dffde9-2a50-41fe-bc21-3d0915068887?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"6.1.16"}],"published":"2026-04-08T00:00:00Z","updated":"2026-07-30T17:35:27Z"},{"id":"wordfence:65e2e9e3-2778-4baf-8269-fc13d5ef1212","source":"wordfence","cve":"CVE-2022-46839","title":"JS Help Desk <= 2.7.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65e2e9e3-2778-4baf-8269-fc13d5ef1212?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65e34c69-f666-4bae-a086-789b93d15cc2","source":"wordfence","cve":"CVE-2025-62094","title":"Void Elementor WHMCS Elements For Elementor Page Builder <= 2.0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65e34c69-f666-4bae-a086-789b93d15cc2?source=api-prod","affected":[{"type":"plugin","slug":"void-elementor-whmcs-elements","name":"Elementor WHMCS Elements For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2026-01-05T18:23:13Z"},{"id":"wordfence:65e68147-84cc-4b2d-85b9-e5b7bde2e604","source":"wordfence","cve":"CVE-2020-29303","title":"DirectoriesPro Plugin by SabaiApps <= 1.3.45 - Cross-Site Scripting via _drts_form_build_id, _t_ Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65e68147-84cc-4b2d-85b9-e5b7bde2e604?source=api-prod","affected":[{"type":"plugin","slug":"directories","name":"directories","from":"*","from_inclusive":true,"to":"1.3.46","to_inclusive":false,"patched_in":"1.3.46"}],"published":"2020-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65e76681-80e0-40aa-a68b-87cb0c42b4f8","source":"wordfence","cve":"CVE-2023-47511","title":"Pinyin Slugs <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65e76681-80e0-40aa-a68b-87cb0c42b4f8?source=api-prod","affected":[{"type":"plugin","slug":"so-pinyin-slugs","name":"Pinyin Slugs","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65ea592e-3340-4559-8b6e-871a4e603296","source":"wordfence","cve":"CVE-2024-54257","title":"Tydskrif <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ea592e-3340-4559-8b6e-871a4e603296?source=api-prod","affected":[{"type":"theme","slug":"tydskrif","name":"Tydskrif","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:44:25Z"},{"id":"wordfence:65ebc744-6cc2-47ce-b225-81820e49d59c","source":"wordfence","cve":"CVE-2026-0920","title":"LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ebc744-6cc2-47ce-b225-81820e49d59c?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.6.3","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-01-21T17:31:45Z","updated":"2026-01-22T06:47:20Z"},{"id":"wordfence:65eda973-89ab-470e-930b-6b53127b4001","source":"wordfence","cve":"CVE-2026-122671","title":"E2Pdf \u2013 Export Pdf Tool for WordPress <= 1.32.65 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65eda973-89ab-470e-930b-6b53127b4001?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.65","to_inclusive":true,"patched_in":"2.00.00"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:54Z"},{"id":"wordfence:65ee0ac8-3fa0-4a7d-a786-36a914242634","source":"wordfence","cve":"CVE-2024-9545","title":"Shortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65ee0ac8-3fa0-4a7d-a786-36a914242634?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.17.1"}],"published":"2024-12-20T20:19:18Z","updated":"2025-03-06T20:52:23Z"},{"id":"wordfence:65f30cd4-1d47-4ebe-a6de-acdb3a813c9c","source":"wordfence","cve":"CVE-2023-34022","title":"Dynamic QR Code Generator <= 0.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f30cd4-1d47-4ebe-a6de-acdb3a813c9c?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-qr-code-generator","name":"Dynamic QR Code Generator","from":"*","from_inclusive":true,"to":"0.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:65f4978f-23c3-460d-958e-5aed66b071b4","source":"wordfence","cve":"CVE-2025-48078","title":"Slick Google Map <= 0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f4978f-23c3-460d-958e-5aed66b071b4?source=api-prod","affected":[{"type":"plugin","slug":"slick-google-map","name":"Slick Google Map","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2025-10-13T00:00:00Z","updated":"2026-06-02T10:39:49Z"},{"id":"wordfence:65f49fe0-6aad-445e-a86e-ad1089239303","source":"wordfence","cve":"CVE-2024-37217","title":"Empty Cart Button for WooCommerce <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f49fe0-6aad-445e-a86e-ad1089239303?source=api-prod","affected":[{"type":"plugin","slug":"empty-cart-button-for-woocommerce","name":"Empty Cart Button for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:37:14Z"},{"id":"wordfence:65f4de84-1472-489b-9247-0ceb53369d2b","source":"wordfence","cve":"CVE-2026-22352","title":"Persian Woocommerce SMS <= 7.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f4de84-1472-489b-9247-0ceb53369d2b?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2026-02-11T00:00:00Z","updated":"2026-10-13T16:58:20Z"},{"id":"wordfence:65f4e5e1-4c2e-4943-aa84-4caa61e14bc2","source":"wordfence","cve":"CVE-2024-11974","title":"Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f4e5e1-4c2e-4943-aa84-4caa61e14bc2?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.23","to_inclusive":true,"patched_in":"3.24"}],"published":"2025-01-03T18:55:35Z","updated":"2025-01-04T07:24:23Z"},{"id":"wordfence:65f521f4-1968-4c43-a3f0-b0f81632d7aa","source":"wordfence","cve":"CVE-2024-13895","title":"Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":4.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f521f4-1968-4c43-a3f0-b0f81632d7aa?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets-cpt","name":"Code Snippets CPT","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-07T14:14:46Z","updated":"2025-03-08T02:24:04Z"},{"id":"wordfence:65f68a49-8ded-479f-a9c3-187703bfae65","source":"wordfence","cve":"CVE-2026-16759","title":"Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f68a49-8ded-479f-a9c3-187703bfae65?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-08-27T15:34:39Z","updated":"2026-08-28T03:39:35Z"},{"id":"wordfence:65f70c77-ea67-49a3-8626-7b66a8827f11","source":"wordfence","cve":"CVE-2026-9059","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f70c77-ea67-49a3-8626-7b66a8827f11?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-07-30T17:40:30Z"},{"id":"wordfence:65f7add4-b231-43b3-9f88-1965218dd91a","source":"wordfence","cve":"CVE-2026-97267","title":"Prevent Files / Folders Access <= 2.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f7add4-b231-43b3-9f88-1965218dd91a?source=api-prod","affected":[{"type":"plugin","slug":"prevent-file-access","name":"Prevent Files / Folders Access","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:45:46Z"},{"id":"wordfence:65f89b65-7231-469e-bd7d-cf6a1d962652","source":"wordfence","cve":"CVE-2026-23807","title":"WP Telegram Widget and Join Link <= 2.2.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65f89b65-7231-469e-bd7d-cf6a1d962652?source=api-prod","affected":[{"type":"plugin","slug":"wptelegram-widget","name":"WP Telegram Widget and Join Link","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:31:03Z"},{"id":"wordfence:65fc2929-b65b-451b-b90d-6739a673ac16","source":"wordfence","cve":"CVE-2025-28947","title":"MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65fc2929-b65b-451b-b90d-6739a673ac16?source=api-prod","affected":[{"type":"theme","slug":"mbstore","name":"MBStore - Digital WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:56:04Z"},{"id":"wordfence:65fc55bb-2b86-466a-b43b-554628283f02","source":"wordfence","cve":"","title":"LoginPress <= 1.1.15 - Authenticated Stored Cross-SIte Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/65fc55bb-2b86-466a-b43b-554628283f02?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":false,"patched_in":"1.1.16"}],"published":"2018-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:660058f0-ccd9-4bb9-9e11-f1e1d1100ef2","source":"wordfence","cve":"CVE-2021-24400","title":"Display Users <= 2.0.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/660058f0-ccd9-4bb9-9e11-f1e1d1100ef2?source=api-prod","affected":[{"type":"plugin","slug":"wp-display-users","name":"Display Users","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66019297-a8a8-4bbc-99db-4b47066f3e50","source":"wordfence","cve":"CVE-2023-3244","title":"Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66019297-a8a8-4bbc-99db-4b47066f3e50?source=api-prod","affected":[{"type":"plugin","slug":"comments-like-dislike","name":"Comments Like Dislike","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-08-16T00:00:00Z","updated":"2024-10-24T18:53:19Z"},{"id":"wordfence:6602ed5f-5631-4d7e-a816-ebc602886ef6","source":"wordfence","cve":"CVE-2026-96904","title":"AWP Classifieds < 4.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6602ed5f-5631-4d7e-a816-ebc602886ef6?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":false,"patched_in":"4.4.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:24:03Z"},{"id":"wordfence:6608148c-421e-497c-a06c-6e2003362ceb","source":"wordfence","cve":"CVE-2026-62030","title":"StreamCast \u2013 bring live radio to your site with a sleek player <= 2.4.6 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6608148c-421e-497c-a06c-6e2003362ceb?source=api-prod","affected":[{"type":"plugin","slug":"streamcast","name":"StreamCast \u2013 bring live radio to your site with a sleek player","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-10-09T12:54:00Z","updated":"2026-10-28T21:20:15Z"},{"id":"wordfence:66082207-33b6-45e4-ae93-24c9a9611300","source":"wordfence","cve":"CVE-2021-24592","title":"Sitewide Notice WP <= 2.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66082207-33b6-45e4-ae93-24c9a9611300?source=api-prod","affected":[{"type":"plugin","slug":"sitewide-notice-wp","name":"Sitewide Notice WP","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66095908-875f-486d-ae77-6015671872de","source":"wordfence","cve":"CVE-2026-1640","title":"Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66095908-875f-486d-ae77-6015671872de?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-02-17T17:31:09Z","updated":"2026-02-18T06:42:42Z"},{"id":"wordfence:660d4214-999f-4a4f-9a7e-332163b9867b","source":"wordfence","cve":"CVE-2025-28973","title":"Pro Bulk Watermark Plugin for WordPress <= 2.0 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/660d4214-999f-4a4f-9a7e-332163b9867b?source=api-prod","affected":[{"type":"plugin","slug":"pro-watermark","name":"Pro Bulk Watermark Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-16T15:53:43Z"},{"id":"wordfence:660f6357-d7bd-45c4-add3-edf83d80aa30","source":"wordfence","cve":"CVE-2024-13585","title":"Ajax Search Lite <= 4.12.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/660f6357-d7bd-45c4-add3-edf83d80aa30?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.12.4","to_inclusive":true,"patched_in":"4.12.5"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-26T22:31:22Z"},{"id":"wordfence:660fa0d6-1325-4599-b146-47561c15b5fd","source":"wordfence","cve":"CVE-2026-16038","title":"MStore API <= 4.20.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/660fa0d6-1325-4599-b146-47561c15b5fd?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.20.0","to_inclusive":true,"patched_in":"4.21.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:33:33Z"},{"id":"wordfence:661016f0-be26-4318-bf84-30e47a8fe15a","source":"wordfence","cve":"CVE-2025-39469","title":"Modal Survey <= 2.0.2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/661016f0-be26-4318-bf84-30e47a8fe15a?source=api-prod","affected":[{"type":"plugin","slug":"modal-survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:33:06Z"},{"id":"wordfence:66122be6-7c28-44cc-a8dd-7b2ec64346f7","source":"wordfence","cve":"CVE-2023-47189","title":"Defender Security <= 4.2.0 - Masked Login Area Security Feature Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66122be6-7c28-44cc-a8dd-7b2ec64346f7?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66130071-668e-4692-afd3-5fcc9039f10f","source":"wordfence","cve":"","title":"Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66130071-668e-4692-afd3-5fcc9039f10f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66182fc4-863a-4a7b-92a8-2f43717b8579","source":"wordfence","cve":"CVE-2022-37411","title":"Captcha Code <= 2.7 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66182fc4-863a-4a7b-92a8-2f43717b8579?source=api-prod","affected":[{"type":"plugin","slug":"captcha-code-authentication","name":"Captcha Code","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6619b370-dd2a-4945-a776-1fecf407119e","source":"wordfence","cve":"","title":"wp-Monalisa <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6619b370-dd2a-4945-a776-1fecf407119e?source=api-prod","affected":[{"type":"plugin","slug":"wp-monalisa","name":"wp-Monalisa","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:661c3263-c507-4f59-8dfe-dbf5b3bf0256","source":"wordfence","cve":"CVE-2026-118184","title":"Premium Packages <= 7.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/661c3263-c507-4f59-8dfe-dbf5b3bf0256?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:48:11Z"},{"id":"wordfence:661d4ea9-572d-4544-b5cf-39fd69c104a6","source":"wordfence","cve":"CVE-2026-15014","title":"SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/661d4ea9-572d-4544-b5cf-39fd69c104a6?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-07-27T18:22:06Z","updated":"2026-08-13T19:56:07Z"},{"id":"wordfence:66201d43-9f25-46a8-ac29-0482e8dc5b2e","source":"wordfence","cve":"CVE-2025-63020","title":"Postie <= 1.9.73 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66201d43-9f25-46a8-ac29-0482e8dc5b2e?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.9.73","to_inclusive":true,"patched_in":"1.9.74"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-08T21:39:28Z"},{"id":"wordfence:662116f0-0d32-4d24-868a-a8eccb3ad401","source":"wordfence","cve":"CVE-2025-49250","title":"Team Showcase < 25.05.13 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662116f0-0d32-4d24-868a-a8eccb3ad401?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-cm","name":"Team Showcase","from":"*","from_inclusive":true,"to":"25.05.13","to_inclusive":false,"patched_in":"25.05.13"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:45:39Z"},{"id":"wordfence:6623f130-152e-47ec-9545-3a6128ab1c82","source":"wordfence","cve":"CVE-2025-43833","title":"Absolute Links <= 1.1.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6623f130-152e-47ec-9545-3a6128ab1c82?source=api-prod","affected":[{"type":"plugin","slug":"absolute-links","name":"Absolute Links","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:07:55Z"},{"id":"wordfence:66258605-8c35-47e4-8c17-f4b87afc0fe7","source":"wordfence","cve":"CVE-2026-103681","title":"Frontend Dashboard <= 2.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66258605-8c35-47e4-8c17-f4b87afc0fe7?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:21:08Z"},{"id":"wordfence:6625dcea-13cc-4c08-9361-946638bf6678","source":"wordfence","cve":"CVE-2026-40740","title":"Tutor LMS <= 3.9.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6625dcea-13cc-4c08-9361-946638bf6678?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-03-15T00:00:00Z","updated":"2026-05-07T14:01:38Z"},{"id":"wordfence:66293047-1d1d-434f-bde6-130197fa93ca","source":"wordfence","cve":"CVE-2024-47647","title":"Accordion & FAQ \u2013 Helpie WordPress Accordion FAQ Plugin <= 1.27 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66293047-1d1d-434f-bde6-130197fa93ca?source=api-prod","affected":[{"type":"plugin","slug":"helpie-faq","name":"Helpie FAQ \u2014 Accordion, Docs & Knowledge Base","from":"*","from_inclusive":true,"to":"1.27","to_inclusive":true,"patched_in":"1.28"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:46:04Z"},{"id":"wordfence:66294c25-d715-42f2-b249-5ef68ae92cca","source":"wordfence","cve":"CVE-2025-39522","title":"Dynamic Post <= 5.03 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66294c25-d715-42f2-b249-5ef68ae92cca?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-post","name":"Dynamic Post \u2013 AI Content \u2013 White Paper \u2013 Peer Review \u2013 Tax & Accounting Sites","from":"*","from_inclusive":true,"to":"5.03","to_inclusive":true,"patched_in":"5.04"}],"published":"2025-04-16T00:00:00Z","updated":"2026-04-15T13:29:35Z"},{"id":"wordfence:6629e1a9-3b28-4c8c-95d4-3c0011a7364a","source":"wordfence","cve":"CVE-2020-27481","title":"Good LMS <= 2.1.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6629e1a9-3b28-4c8c-95d4-3c0011a7364a?source=api-prod","affected":[{"type":"plugin","slug":"goodlms","name":"Good LMS - Learning Management System WP Plugin","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2020-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:662aa8dd-69b7-49e3-811c-04329544e106","source":"wordfence","cve":"CVE-2025-12654","title":"Migration, Backup, Staging \u2013 WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662aa8dd-69b7-49e3-811c-04329544e106?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.120","to_inclusive":true,"patched_in":"0.9.121"}],"published":"2025-12-20T14:45:41Z","updated":"2025-12-21T03:20:05Z"},{"id":"wordfence:662ca451-5c69-4973-afc8-5dc1caf57ad7","source":"wordfence","cve":"CVE-2022-44581","title":"Defender Security <= 3.3.2 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662ca451-5c69-4973-afc8-5dc1caf57ad7?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:662eb948-e1d2-4a11-a139-16d277cd5c53","source":"wordfence","cve":"CVE-2025-22538","title":"Virtual Bot <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662eb948-e1d2-4a11-a139-16d277cd5c53?source=api-prod","affected":[{"type":"plugin","slug":"virtual-bot","name":"Virtual Bot","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:27:39Z"},{"id":"wordfence:662f6ae2-2047-4bbf-b4a6-2d536051e389","source":"wordfence","cve":"CVE-2024-10050","title":"Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662f6ae2-2047-4bbf-b4a6-2d536051e389?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.43","to_inclusive":true,"patched_in":"1.6.44"}],"published":"2024-10-23T20:20:25Z","updated":"2024-11-08T16:30:33Z"},{"id":"wordfence:662fcf6c-1095-4cea-949f-91af8fba1e47","source":"wordfence","cve":"CVE-2024-33575","title":"User Meta <= 3.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/662fcf6c-1095-4cea-949f-91af8fba1e47?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:08:56Z"},{"id":"wordfence:66334c29-c9d6-48b0-8d6b-bae588da0331","source":"wordfence","cve":"CVE-2026-11780","title":"Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66334c29-c9d6-48b0-8d6b-bae588da0331?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.1","to_inclusive":true,"patched_in":"11.2.2"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T04:24:53Z"},{"id":"wordfence:66351875-42d7-45f4-a47f-22e3e26b2770","source":"wordfence","cve":"CVE-2021-24498","title":"Calendar Event Multi View <= 1.3.99 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66351875-42d7-45f4-a47f-22e3e26b2770?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.3.99","to_inclusive":true,"patched_in":"1.4.01"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6635db72-8302-421d-9011-7eabb57c43a2","source":"wordfence","cve":"","title":"Contempo Real Estate Custom Posts <= 3.2.6 - Unauthorized File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6635db72-8302-421d-9011-7eabb57c43a2?source=api-prod","affected":[{"type":"plugin","slug":"contempo-real-estate-custom-posts","name":"Contempo Real Estate Custom Posts","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6635ff4d-cbb4-4e78-9df1-1274eaa737aa","source":"wordfence","cve":"CVE-2021-24216","title":"All-in-One WP Migration <= 7.40 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6635ff4d-cbb4-4e78-9df1-1274eaa737aa?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.40","to_inclusive":true,"patched_in":"7.41"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66363035-c09f-4b41-b9fe-2e2bdd851f41","source":"wordfence","cve":"CVE-2024-10796","title":"If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66363035-c09f-4b41-b9fe-2e2bdd851f41?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.9.2.1","to_inclusive":true,"patched_in":"1.9.2.2"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T04:24:26Z"},{"id":"wordfence:66377ee2-cc87-4cfe-a4e4-cef4459bf2ec","source":"wordfence","cve":"","title":"Seraphinite Alternative Slugs Manager <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66377ee2-cc87-4cfe-a4e4-cef4459bf2ec?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-old-slugs-mgr","name":"Seraphinite Alternative Slugs Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6639c3d8-8f26-4ee5-8c4b-2efcf34668a2","source":"wordfence","cve":"CVE-2025-13384","title":"CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6639c3d8-8f26-4ee5-8c4b-2efcf34668a2?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.56","to_inclusive":true,"patched_in":"1.3.57"}],"published":"2025-11-21T18:50:24Z","updated":"2025-11-22T07:29:19Z"},{"id":"wordfence:663bd2b2-89ce-4701-9071-200cc86d0a90","source":"wordfence","cve":"CVE-2025-31815","title":"Design Blocks <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/663bd2b2-89ce-4701-9071-200cc86d0a90?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-blocks","name":"Design Blocks \u2013 Gutenberg Blocks collection","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:22:40Z"},{"id":"wordfence:663c54f4-4ca5-4916-b2a5-de3cabe77f38","source":"wordfence","cve":"CVE-2024-27991","title":"SupportCandy <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/663c54f4-4ca5-4916-b2a5-de3cabe77f38?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:48:13Z"},{"id":"wordfence:663d7ec3-5e95-41c9-aced-18756907f2db","source":"wordfence","cve":"CVE-2025-48260","title":"GDPR CCPA Compliance Support <= 2.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/663d7ec3-5e95-41c9-aced-18756907f2db?source=api-prod","affected":[{"type":"plugin","slug":"ninja-gdpr-compliance","name":"GDPR CCPA Compliance & Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:27:22Z"},{"id":"wordfence:663e8611-ce0c-4c09-9fa3-852f287351d4","source":"wordfence","cve":"CVE-2025-49921","title":"JetReviews <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/663e8611-ce0c-4c09-9fa3-852f287351d4?source=api-prod","affected":[{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.0.1"}],"published":"2025-08-05T00:00:00Z","updated":"2025-10-29T19:09:44Z"},{"id":"wordfence:664187f0-d49c-4876-bed0-ce169a2ec89a","source":"wordfence","cve":"CVE-2026-57781","title":"MeetingHub \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet <= 1.26.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664187f0-d49c-4876-bed0-ce169a2ec89a?source=api-prod","affected":[{"type":"plugin","slug":"meetinghub","name":"Booking for Appointments and Events Calendar with Zoom, Google Meet, Microsoft Teams, Webex, Jitsi \u2013 MeetingHub","from":"*","from_inclusive":true,"to":"1.26.4","to_inclusive":true,"patched_in":"1.26.5"}],"published":"2026-07-02T00:00:00Z","updated":"2026-09-09T16:07:17Z"},{"id":"wordfence:6647856b-19f2-475a-8d45-d33c7b3a8f92","source":"wordfence","cve":"CVE-2024-32799","title":"Easy Property Listings <= 3.5.3 - Missing Authorization via epl_update_listing_coordinates()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6647856b-19f2-475a-8d45-d33c7b3a8f92?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:37:16Z"},{"id":"wordfence:664b1362-c205-40b5-94b6-b32ca75dfe6d","source":"wordfence","cve":"CVE-2025-67977","title":"HAPPY <= 1.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664b1362-c205-40b5-94b6-b32ca75dfe6d?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:38:17Z"},{"id":"wordfence:664cb5db-41f8-4c69-98a6-529a1ad7c6a7","source":"wordfence","cve":"CVE-2026-104753","title":"Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664cb5db-41f8-4c69-98a6-529a1ad7c6a7?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.279","to_inclusive":true,"patched_in":"1.0.280"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:56:13Z"},{"id":"wordfence:664d22f2-b7a3-42df-9530-4040160ead2c","source":"wordfence","cve":"CVE-2023-46069","title":"Ajax Archive Calendar <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664d22f2-b7a3-42df-9530-4040160ead2c?source=api-prod","affected":[{"type":"plugin","slug":"ajax-archive-calendar","name":"Ajax Archive Calendar","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:664d265b-7b35-4c61-b48b-d051b7fb5ebd","source":"wordfence","cve":"CVE-2024-10577","title":"Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664d265b-7b35-4c61-b48b-d051b7fb5ebd?source=api-prod","affected":[{"type":"plugin","slug":"fat-rat-collect","name":"\u80d6\u9f20\u91c7\u96c6(Fat Rat Collect)","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-11-12T13:26:04Z","updated":"2024-11-20T15:08:42Z"},{"id":"wordfence:664e5a7a-bb40-4615-9482-a285bed9b23b","source":"wordfence","cve":"CVE-2026-65519","title":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.29 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664e5a7a-bb40-4615-9482-a285bed9b23b?source=api-prod","affected":[{"type":"plugin","slug":"gt3-photo-video-gallery","name":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery","from":"*","from_inclusive":true,"to":"2.7.7.29","to_inclusive":true,"patched_in":"2.7.7.30"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:27:55Z"},{"id":"wordfence:664e6e2a-faa1-4609-b250-d7e94c5d5a04","source":"wordfence","cve":"CVE-2024-10547","title":"WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664e6e2a-faa1-4609-b250-d7e94c5d5a04?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-11-08T18:58:21Z","updated":"2024-11-09T07:35:04Z"},{"id":"wordfence:664eb488-649e-4914-bd3c-cb7395893c6f","source":"wordfence","cve":"CVE-2026-27984","title":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.1.3 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664eb488-649e-4914-bd3c-cb7395893c6f?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-14T14:32:35Z"},{"id":"wordfence:664f43a6-6461-42ce-a3e4-2277c01a0efb","source":"wordfence","cve":"CVE-2024-10522","title":"Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/664f43a6-6461-42ce-a3e4-2277c01a0efb?source=api-prod","affected":[{"type":"plugin","slug":"co-marquage-service-public","name":"Co-marquage service-public.fr","from":"*","from_inclusive":true,"to":"0.5.76","to_inclusive":true,"patched_in":"0.5.77"}],"published":"2024-11-20T13:53:33Z","updated":"2024-11-21T15:21:53Z"},{"id":"wordfence:66518929-d5e7-4b4d-a04c-a96ad0df308c","source":"wordfence","cve":"CVE-2023-32596","title":"weebotLite <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66518929-d5e7-4b4d-a04c-a96ad0df308c?source=api-prod","affected":[{"type":"plugin","slug":"weebotlite","name":"weebotLite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66519150-7719-4598-8302-b3437719f0a0","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 7.62 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66519150-7719-4598-8302-b3437719f0a0?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.62","to_inclusive":true,"patched_in":"7.63"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6651c932-aa60-485b-bb5b-b66d5a8963ae","source":"wordfence","cve":"CVE-2026-116535","title":"SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6651c932-aa60-485b-bb5b-b66d5a8963ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":"10.4"}],"published":"2026-10-30T18:56:36Z","updated":"2026-10-31T07:46:49Z"},{"id":"wordfence:66529116-7b0e-4e2f-96f1-a4d91fa7f956","source":"wordfence","cve":"CVE-2024-2303","title":"Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66529116-7b0e-4e2f-96f1-a4d91fa7f956?source=api-prod","affected":[{"type":"plugin","slug":"easy-textillate","name":"Easy Textillate","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.02"}],"published":"2024-03-25T00:00:00Z","updated":"2024-05-31T15:30:23Z"},{"id":"wordfence:6654094f-a503-464c-910f-3dff643a49ba","source":"wordfence","cve":"CVE-2024-13347","title":"Essential WP Real Estate <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6654094f-a503-464c-910f-3dff643a49ba?source=api-prod","affected":[{"type":"plugin","slug":"essential-wp-real-estate","name":"Essential WP Real Estate","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-02-25T16:46:46Z"},{"id":"wordfence:66559c2a-1c8d-4861-8151-31972982683d","source":"wordfence","cve":"CVE-2025-47549","title":"BEAF <= 4.6.10 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66559c2a-1c8d-4861-8151-31972982683d?source=api-prod","affected":[{"type":"plugin","slug":"beaf-before-and-after-gallery","name":"Ultimate Before After Image Slider & Gallery \u2013 BEAF","from":"*","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"4.6.11"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:28:20Z"},{"id":"wordfence:665734d1-bc14-4d25-98c8-7191248a7254","source":"wordfence","cve":"CVE-2026-94361","title":"PAYable IPG <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/665734d1-bc14-4d25-98c8-7191248a7254?source=api-prod","affected":[{"type":"plugin","slug":"payable-payment-gateway-for-woocommerce","name":"Payable Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T20:14:19Z"},{"id":"wordfence:66585943-cb70-4296-af66-5b786d1bafb9","source":"wordfence","cve":"CVE-2023-32599","title":"reCAPTCHA for all <= 1.22 - Missing Authorization via recaptcha_for_all_image_select","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66585943-cb70-4296-af66-5b786d1bafb9?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-for-all","name":"Integrator for Turnstile and reCAPTCHA.","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6659646b-80dd-4f37-a275-4def52b9200e","source":"wordfence","cve":"CVE-2026-22324","title":"Melania <= 2.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6659646b-80dd-4f37-a275-4def52b9200e?source=api-prod","affected":[{"type":"theme","slug":"melania","name":"Melania | Blog about Handmade & Crafts WordPress Theme + Shop","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:26:55Z"},{"id":"wordfence:66607be6-cca1-4cbb-b1c0-708d640b1151","source":"wordfence","cve":"CVE-2023-25798","title":"Olevmedia Shortcodes <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66607be6-cca1-4cbb-b1c0-708d640b1151?source=api-prod","affected":[{"type":"plugin","slug":"olevmedia-shortcodes","name":"Olevmedia Shortcodes","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6662581b-a057-4b88-951d-824c64f9cdfd","source":"wordfence","cve":"CVE-2024-43224","title":"YaMaps for WordPress <= 0.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6662581b-a057-4b88-951d-824c64f9cdfd?source=api-prod","affected":[{"type":"plugin","slug":"yamaps","name":"YaMaps for WordPress Plugin","from":"*","from_inclusive":true,"to":"0.6.28","to_inclusive":true,"patched_in":"0.6.30"}],"published":"2024-08-09T00:00:00Z","updated":"2025-02-11T20:55:10Z"},{"id":"wordfence:6662c336-c8b6-4017-835f-a91f1abda400","source":"wordfence","cve":"CVE-2024-32547","title":"Code Insert Manager (Q2W3 Inc Manager) <= 2.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6662c336-c8b6-4017-835f-a91f1abda400?source=api-prod","affected":[{"type":"plugin","slug":"q2w3-inc-manager","name":"Code Insert Manager (Q2W3 Inc Manager)","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:04:13Z"},{"id":"wordfence:6662fee4-7e04-492f-bf79-2c915da92c92","source":"wordfence","cve":"CVE-2024-9454","title":"PriPre <= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6662fee4-7e04-492f-bf79-2c915da92c92?source=api-prod","affected":[{"type":"plugin","slug":"pripre","name":"PriPre","from":"*","from_inclusive":true,"to":"0.4.11","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T14:02:34Z","updated":"2024-10-26T02:31:31Z"},{"id":"wordfence:66697f3e-c023-496d-b553-7d20352e33b5","source":"wordfence","cve":"CVE-2022-1239","title":"HubSpot \u2013 CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66697f3e-c023-496d-b553-7d20352e33b5?source=api-prod","affected":[{"type":"plugin","slug":"leadin","name":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat","from":"*","from_inclusive":true,"to":"8.8.15","to_inclusive":false,"patched_in":"8.8.15"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6669d04c-9f97-43a5-a312-1cb3d67d21fa","source":"wordfence","cve":"CVE-2023-49765","title":"Rate my Post - WP Rating System <= 3.4.1 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6669d04c-9f97-43a5-a312-1cb3d67d21fa?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:666aea4b-651d-4ab6-8b2e-95f09e5faf71","source":"wordfence","cve":"CVE-2025-68868","title":"Text Slider Widget <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/666aea4b-651d-4ab6-8b2e-95f09e5faf71?source=api-prod","affected":[{"type":"plugin","slug":"wp-text-slider-widget","name":"Wp Text Slider Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T18:59:19Z"},{"id":"wordfence:666b8b39-fab0-4e99-b365-a4ac9f964494","source":"wordfence","cve":"CVE-2023-49814","title":"Symbiostock Lite <= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/666b8b39-fab0-4e99-b365-a4ac9f964494?source=api-prod","affected":[{"type":"plugin","slug":"symbiostock","name":"Symbiostock \u2013 Sell Photos Online For Free!","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:666c02bd-d3e2-4e40-b189-b73e1136610b","source":"wordfence","cve":"CVE-2020-35944","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/666c02bd-d3e2-4e40-b189-b73e1136610b?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:667023f9-9c45-4182-b1f1-9d85d17aaf58","source":"wordfence","cve":"CVE-2021-24337","title":"Video Embed <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667023f9-9c45-4182-b1f1-9d85d17aaf58?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-box","name":"Video Embed","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6670b07e-c9ff-468c-8bfe-603d21bb9afb","source":"wordfence","cve":"CVE-2026-25337","title":"Coachify <= 1.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6670b07e-c9ff-468c-8bfe-603d21bb9afb?source=api-prod","affected":[{"type":"theme","slug":"coachify","name":"Coachify","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-02-08T00:00:00Z","updated":"2026-05-04T15:29:23Z"},{"id":"wordfence:66717800-31ab-4e68-979a-4967dd2caeb8","source":"wordfence","cve":"CVE-2017-14126","title":"Participants Database <= 1.7.5.9 - Unauthorized Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66717800-31ab-4e68-979a-4967dd2caeb8?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"1.7.5.9","to_inclusive":true,"patched_in":"1.7.5.10"}],"published":"2017-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66749606-e76f-41fb-bcf1-c06681de2ee3","source":"wordfence","cve":"CVE-2023-47507","title":"Master Slider Pro <= 3.6.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66749606-e76f-41fb-bcf1-c06681de2ee3?source=api-prod","affected":[{"type":"plugin","slug":"masterslider","name":"Master Slider Pro","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:667547a9-0dc5-4810-aba9-025f0c222d24","source":"wordfence","cve":"CVE-2022-41656","title":"Account Manager for WooCommerce <= 2.1.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667547a9-0dc5-4810-aba9-025f0c222d24?source=api-prod","affected":[{"type":"plugin","slug":"account-manager-woocommerce","name":"Account Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-10-13T00:00:00Z","updated":"2024-02-19T21:40:11Z"},{"id":"wordfence:6677813d-1441-41c7-bd2d-859b79260c87","source":"wordfence","cve":"CVE-2025-58853","title":"Popping Sidebars and Widgets Light <= 1.27 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6677813d-1441-41c7-bd2d-859b79260c87?source=api-prod","affected":[{"type":"plugin","slug":"popping-sidebars-and-widgets-light","name":"Popping Sidebars and Widgets Light","from":"*","from_inclusive":true,"to":"1.27","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:15:32Z"},{"id":"wordfence:6677aa22-3248-41d5-a257-5330455d5bcc","source":"wordfence","cve":"CVE-2024-37952","title":"Book Your Travel <= 8.18.17 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6677aa22-3248-41d5-a257-5330455d5bcc?source=api-prod","affected":[{"type":"theme","slug":"bookyourtravel","name":"Book Your Travel","from":"*","from_inclusive":true,"to":"8.18.17","to_inclusive":true,"patched_in":"8.18.19"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:25:29Z"},{"id":"wordfence:667834e3-85c7-44d9-8858-b030c646edd1","source":"wordfence","cve":"CVE-2026-14827","title":"Calendar <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667834e3-85c7-44d9-8858-b030c646edd1?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:18:36Z"},{"id":"wordfence:667870b0-916d-4add-a391-ffcc177a3757","source":"wordfence","cve":"CVE-2024-3050","title":"Site Reviews <= 6.11.8 - IP Address Spoofing to Blocking Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667870b0-916d-4add-a391-ffcc177a3757?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.11.8","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2024-05-08T00:00:00Z","updated":"2024-06-06T13:52:58Z"},{"id":"wordfence:667a3824-aec7-4f8f-837d-cb945d153ef3","source":"wordfence","cve":"CVE-2026-104684","title":"Envira Gallery <= 1.16.1 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667a3824-aec7-4f8f-837d-cb945d153ef3?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:56:12Z"},{"id":"wordfence:667b11ff-496f-4560-b751-7bb25bcd7cbb","source":"wordfence","cve":"CVE-2025-67554","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667b11ff-496f-4560-b751-7bb25bcd7cbb?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-10T16:23:53Z"},{"id":"wordfence:667cb690-4b75-4844-a44e-34553d1481c7","source":"wordfence","cve":"CVE-2026-112242","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 - Authenticated (Author+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667cb690-4b75-4844-a44e-34553d1481c7?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-10-20T07:01:29Z","updated":"2026-10-23T18:49:30Z"},{"id":"wordfence:667d964a-dba6-424a-b3f5-af433616c132","source":"wordfence","cve":"","title":"BSK PDF Manager 1.3 - 2.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/667d964a-dba6-424a-b3f5-af433616c132?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"1.3","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66845165-02c7-4f4a-93fd-1a309fb7b386","source":"wordfence","cve":"CVE-2026-12981","title":"CAFEHAUS API <= 1.0.0 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66845165-02c7-4f4a-93fd-1a309fb7b386?source=api-prod","affected":[{"type":"plugin","slug":"cafe-api","name":"CAFEHAUS API","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-30T13:32:07Z"},{"id":"wordfence:66849f80-45f0-4500-a058-1b30bd56b249","source":"wordfence","cve":"CVE-2025-62747","title":"Featured Image Generator <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66849f80-45f0-4500-a058-1b30bd56b249?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-generator","name":"Featured Image Generator","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:33:42Z"},{"id":"wordfence:668621b0-67ef-44fc-a126-e8c4e372666e","source":"wordfence","cve":"CVE-2024-7122","title":"Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/668621b0-67ef-44fc-a126-e8c4e372666e?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":true,"patched_in":"1.13.7"}],"published":"2024-08-29T20:31:53Z","updated":"2024-08-30T09:29:48Z"},{"id":"wordfence:6687ebbe-fdf4-4ecb-bf59-034bb4b0104c","source":"wordfence","cve":"CVE-2025-15521","title":"Academy LMS \u2013 WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6687ebbe-fdf4-4ecb-bf59-034bb4b0104c?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2026-01-20T11:36:57Z","updated":"2026-01-21T01:23:32Z"},{"id":"wordfence:66889a85-07d9-4d0f-ac16-31bb9d2d974a","source":"wordfence","cve":"CVE-2025-58244","title":"Constructo <= 4.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66889a85-07d9-4d0f-ac16-31bb9d2d974a?source=api-prod","affected":[{"type":"theme","slug":"constructo","name":"constructo","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:38:00Z"},{"id":"wordfence:66898509-a93c-4dc3-bf01-1743daaa0ff1","source":"wordfence","cve":"CVE-2024-11205","title":"WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation","severity":"high","cvss":8.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66898509-a93c-4dc3-bf01-1743daaa0ff1?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"1.8.4","from_inclusive":true,"to":"1.9.2.1","to_inclusive":true,"patched_in":"1.9.2.2"}],"published":"2024-12-09T00:00:00Z","updated":"2024-12-10T04:23:43Z"},{"id":"wordfence:668a77e4-9d0a-4835-be5c-4c1acfe7ba43","source":"wordfence","cve":"CVE-2022-3881","title":"WP Tools <= 3.42 - Missing Authorization to Select Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/668a77e4-9d0a-4835-be5c-4c1acfe7ba43?source=api-prod","affected":[{"type":"plugin","slug":"wptools","name":"WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2022-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:668afa62-1326-4067-8d0a-f16788e85ae5","source":"wordfence","cve":"CVE-2022-0447","title":"Post Grid < 2.1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/668afa62-1326-4067-8d0a-f16788e85ae5?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":false,"patched_in":"2.1.16"}],"published":"2022-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:668ba3a9-d53c-45ab-854f-1a9e83dd54b8","source":"wordfence","cve":"","title":"WP e-Commerce \u2013 Store Exporter <= 1.6.6 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/668ba3a9-d53c-45ab-854f-1a9e83dd54b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce-exporter","name":"WP e-Commerce \u2013 Store Exporter","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2016-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:668d4bd3-adde-4347-9169-67c3c96e1743","source":"wordfence","cve":"CVE-2023-33323","title":"ARMember <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/668d4bd3-adde-4347-9169-67c3c96e1743?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66901221-c2be-47a8-a50c-1302ee5bfac1","source":"wordfence","cve":"CVE-2026-78274","title":"Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66901221-c2be-47a8-a50c-1302ee5bfac1?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards-pro","name":"Fluent Boards Pro","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T20:47:34Z"},{"id":"wordfence:66925385-d89e-45c0-a87b-4ad4f7b89d60","source":"wordfence","cve":"CVE-2023-44262","title":"Blocks <= 1.6.42 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66925385-d89e-45c0-a87b-4ad4f7b89d60?source=api-prod","affected":[{"type":"plugin","slug":"blocks","name":"Blocks: Reusable Content, Shortcodes & Site Variables","from":"*","from_inclusive":true,"to":"1.6.42","to_inclusive":true,"patched_in":"25.09.30.1006"}],"published":"2023-09-28T00:00:00Z","updated":"2025-10-08T20:57:52Z"},{"id":"wordfence:66944a3c-180b-4769-aea6-3d04b8b0544b","source":"wordfence","cve":"CVE-2026-82841","title":"UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66944a3c-180b-4769-aea6-3d04b8b0544b?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"1.23.8","from_inclusive":true,"to":"1.26.7","to_inclusive":true,"patched_in":"1.26.8"},{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"2.26","from_inclusive":true,"to":"2.26.8.26","to_inclusive":false,"patched_in":"1.26.8"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:04:13Z"},{"id":"wordfence:66950509-ce2a-42fe-a8b2-2a92a1b573c3","source":"wordfence","cve":"CVE-2026-3481","title":"WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66950509-ce2a-42fe-a8b2-2a92a1b573c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-blockade","name":"WP Blockade \u2013 Visual Page Builder","from":"*","from_inclusive":true,"to":"0.9.14","to_inclusive":true,"patched_in":""}],"published":"2026-05-21T16:12:17Z","updated":"2026-05-22T04:29:05Z"},{"id":"wordfence:66969472-4b3c-4d56-b761-523ea854e3db","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66969472-4b3c-4d56-b761-523ea854e3db?source=api-prod","affected":[{"type":"plugin","slug":"mapsmarker","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6696b262-c6e5-4413-b7dc-894965daa5ac","source":"wordfence","cve":"CVE-2026-1047","title":"salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6696b262-c6e5-4413-b7dc-894965daa5ac?source=api-prod","affected":[{"type":"plugin","slug":"salavat-counter","name":"salavat counter Plugin","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:59:20Z","updated":"2026-02-19T04:36:13Z"},{"id":"wordfence:66981560-c3d9-4533-b372-fad073d031f8","source":"wordfence","cve":"CVE-2025-31628","title":"Sliced Invoices <= 3.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66981560-c3d9-4533-b372-fad073d031f8?source=api-prod","affected":[{"type":"plugin","slug":"sliced-invoices","name":"Sliced Invoices \u2013 WordPress Invoice Plugin","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-21T14:52:36Z"},{"id":"wordfence:669833b3-1689-4051-8990-c6eddae4858f","source":"wordfence","cve":"CVE-2025-1506","title":"Wp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669833b3-1689-4051-8990-c6eddae4858f?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-02-27T16:23:38Z","updated":"2025-02-28T05:23:17Z"},{"id":"wordfence:66988357-af1a-4763-b814-9092b86e51ef","source":"wordfence","cve":"CVE-2026-32416","title":"PDF Poster <= 2.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66988357-af1a-4763-b814-9092b86e51ef?source=api-prod","affected":[{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:15:39Z"},{"id":"wordfence:669b0f30-8958-420c-93c5-0103b71967dd","source":"wordfence","cve":"CVE-2025-3949","title":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669b0f30-8958-420c-93c5-0103b71967dd?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.18.15","to_inclusive":true,"patched_in":"6.18.16"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T08:24:07Z"},{"id":"wordfence:669c50b8-316c-4f63-8b78-361cfcfd4d5f","source":"wordfence","cve":"CVE-2020-35590","title":"Limit Login Attempts Reloaded <= 2.17.3 - Login Rate Limiting Bypass","severity":"high","cvss":7.3,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669c50b8-316c-4f63-8b78-361cfcfd4d5f?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":"2.17.4"}],"published":"2020-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:669df758-0c7d-41c9-a9bd-9b3697898c77","source":"wordfence","cve":"CVE-2018-15877","title":"Plainview Activity Monitor < 20180826 - Remote Command Injection","severity":"high","cvss":8.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669df758-0c7d-41c9-a9bd-9b3697898c77?source=api-prod","affected":[{"type":"plugin","slug":"plainview-activity-monitor","name":"Plainview Activity Monitor","from":"*","from_inclusive":true,"to":"20180826","to_inclusive":false,"patched_in":"20180826"}],"published":"2018-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:669e3015-b64c-440d-bc06-db4828c07196","source":"wordfence","cve":"CVE-2025-0837","title":"Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669e3015-b64c-440d-bc06-db4828c07196?source=api-prod","affected":[{"type":"theme","slug":"puzzles","name":"Puzzles | WP Magazine / Review with Store WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2025-02-12T00:00:00Z","updated":"2025-04-07T18:37:33Z"},{"id":"wordfence:669f5363-22af-4526-b375-3cca2b1db0ec","source":"wordfence","cve":"CVE-2023-32966","title":"Jazz Popups <= 1.8.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669f5363-22af-4526-b375-3cca2b1db0ec?source=api-prod","affected":[{"type":"plugin","slug":"jazz-popups","name":"Jazz Popups","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:669fa0eb-9b75-4508-82e7-b1a991f3b01a","source":"wordfence","cve":"CVE-2024-35737","title":"WP Visitors Tracker <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/669fa0eb-9b75-4508-82e7-b1a991f3b01a?source=api-prod","affected":[{"type":"plugin","slug":"wp_visitorstracker","name":"WP Visitors Tracker","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:35:25Z"},{"id":"wordfence:66a2a159-5748-49bd-9204-e85e1c6729df","source":"wordfence","cve":"","title":"Woo Email Control < 1.02 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a2a159-5748-49bd-9204-e85e1c6729df?source=api-prod","affected":[{"type":"plugin","slug":"woo-email-control","name":"Woo Email Control","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":false,"patched_in":"1.02"}],"published":"2016-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66a2ce68-9584-4d08-bc21-5b77a991f243","source":"wordfence","cve":"CVE-2026-80339","title":"Payment Plugins for Stripe WooCommerce <= 4.0.11 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a2ce68-9584-4d08-bc21-5b77a991f243?source=api-prod","affected":[{"type":"plugin","slug":"woo-stripe-payment","name":"Payment Plugins for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:16:39Z"},{"id":"wordfence:66a3346c-47dd-4286-b3f9-01c3f5a70ac4","source":"wordfence","cve":"CVE-2026-28075","title":"Porto <= 7.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a3346c-47dd-4286-b3f9-01c3f5a70ac4?source=api-prod","affected":[{"type":"theme","slug":"porto","name":"porto","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T14:27:56Z"},{"id":"wordfence:66a339e2-5744-4a12-8751-6e4662ddc347","source":"wordfence","cve":"CVE-2026-104761","title":"Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a339e2-5744-4a12-8751-6e4662ddc347?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-13T19:22:13Z","updated":"2026-10-14T07:43:33Z"},{"id":"wordfence:66a3abc1-0508-4ce3-952b-7dbf3738879a","source":"wordfence","cve":"CVE-2025-0428","title":"AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a3abc1-0508-4ce3-952b-7dbf3738879a?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.96","to_inclusive":true,"patched_in":"1.8.97"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:29:41Z"},{"id":"wordfence:66a5a011-4c2f-4da9-9b17-96af830ba880","source":"wordfence","cve":"CVE-2024-31096","title":"Nictitate <= 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a5a011-4c2f-4da9-9b17-96af830ba880?source=api-prod","affected":[{"type":"theme","slug":"nictitate","name":"Nictitate","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:40:28Z"},{"id":"wordfence:66a65270-182b-44b1-968b-4fc2d8de1ea6","source":"wordfence","cve":"CVE-2015-9412","title":"Royal Slider Plugin < 3.2.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a65270-182b-44b1-968b-4fc2d8de1ea6?source=api-prod","affected":[{"type":"plugin","slug":"royal-slider","name":"RoyalSlider","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":false,"patched_in":"3.2.7"}],"published":"2015-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66a6569b-88ec-42d8-8396-6e62f1c51b24","source":"wordfence","cve":"","title":"Invit0r <= 0.22 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a6569b-88ec-42d8-8396-6e62f1c51b24?source=api-prod","affected":[{"type":"plugin","slug":"invit0r","name":"Invit0r","from":"*","from_inclusive":true,"to":"0.22","to_inclusive":true,"patched_in":""}],"published":"2012-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66a7ffcc-6929-4c66-bfab-15c0f0097a49","source":"wordfence","cve":"CVE-2024-56002","title":"Contact Form, Survey & Form Builder \u2013 MightyForms <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66a7ffcc-6929-4c66-bfab-15c0f0097a49?source=api-prod","affected":[{"type":"plugin","slug":"mightyforms","name":"Contact Form, Survey & Form Builder \u2013 MightyForms","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2024-12-14T00:00:00Z","updated":"2025-01-17T14:13:12Z"},{"id":"wordfence:66abfe6b-c706-4e70-b35b-ee04da613933","source":"wordfence","cve":"CVE-2024-2089","title":"Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66abfe6b-c706-4e70-b35b-ee04da613933?source=api-prod","affected":[{"type":"plugin","slug":"remote-content-shortcode","name":"Remote Content Shortcode","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T19:59:02Z","updated":"2024-05-30T08:30:13Z"},{"id":"wordfence:66ac51f9-3571-4e07-a110-afec43abab37","source":"wordfence","cve":"CVE-2025-11255","title":"Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ac51f9-3571-4e07-a110-afec43abab37?source=api-prod","affected":[{"type":"plugin","slug":"password-policy-manager","name":"Password Policy Manager","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-10-24T18:09:09Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:66ae4ef6-ae4c-4ecc-84ec-f2974a317250","source":"wordfence","cve":"CVE-2025-69369","title":"Racquet <= 1.12.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ae4ef6-ae4c-4ecc-84ec-f2974a317250?source=api-prod","affected":[{"type":"theme","slug":"racquet","name":"Racquet \u2013 Tennis, Badminton & Squash WordPress Theme","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:08:57Z"},{"id":"wordfence:66af88ab-716f-43c9-8c05-148c3f14f676","source":"wordfence","cve":"CVE-2025-60217","title":"PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66af88ab-716f-43c9-8c05-148c3f14f676?source=api-prod","affected":[{"type":"plugin","slug":"pt-luxa-addons","name":"PT Luxa Addons","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-10T00:00:00Z","updated":"2025-11-04T18:11:04Z"},{"id":"wordfence:66afddee-a136-4c71-9e5d-3cc1552010cf","source":"wordfence","cve":"CVE-2021-36908","title":"WP Reset PRO 5.00-5.98 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66afddee-a136-4c71-9e5d-3cc1552010cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset Pro \u2013 Most Advanced WordPress Reset Tool","from":"5.00","from_inclusive":true,"to":"5.98","to_inclusive":true,"patched_in":"5.99"}],"published":"2021-11-10T14:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66b1f539-9192-43f5-a77d-9763024e6b74","source":"wordfence","cve":"CVE-2024-25591","title":"WP Editor <= 1.2.7 - Sensitive Information Exposure via log file","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b1f539-9192-43f5-a77d-9763024e6b74?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:47:54Z"},{"id":"wordfence:66b1f597-f357-4525-8c67-e0be3a07bcfa","source":"wordfence","cve":"CVE-2023-38000","title":"WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b1f597-f357-4525-8c67-e0be3a07bcfa?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.9.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"5.9.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"5.9.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"5.9.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"5.9.8"},{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"*","from_inclusive":true,"to":"16.8.0","to_inclusive":true,"patched_in":"16.8.1"}],"published":"2023-10-12T00:00:00Z","updated":"2024-02-12T14:59:43Z"},{"id":"wordfence:66b279f3-ff44-4d81-b626-39489111d35d","source":"wordfence","cve":"CVE-2025-23549","title":"Maniac SEO <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b279f3-ff44-4d81-b626-39489111d35d?source=api-prod","affected":[{"type":"plugin","slug":"maniac-seo","name":"Maniac SEO","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:54:34Z"},{"id":"wordfence:66b43042-0332-4bbb-b85b-669c7e716855","source":"wordfence","cve":"CVE-2026-22375","title":"Impacto Patronus <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b43042-0332-4bbb-b85b-669c7e716855?source=api-prod","affected":[{"type":"theme","slug":"impacto-patronus","name":"Impacto Patronus | Nature Protection, Petitions & Social Activism WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:29:42Z"},{"id":"wordfence:66b5662a-0be7-43f5-b055-02b3cd3a44d1","source":"wordfence","cve":"CVE-2026-66470","title":"Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b5662a-0be7-43f5-b055-02b3cd3a44d1?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.10","to_inclusive":true,"patched_in":"3.29.11"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-29T00:53:25Z"},{"id":"wordfence:66b59837-b0e6-4bab-b7b6-7c3510164f04","source":"wordfence","cve":"CVE-2025-24622","title":"Job Board Manager <= 2.1.59 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b59837-b0e6-4bab-b7b6-7c3510164f04?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.59","to_inclusive":true,"patched_in":"2.1.60"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:06:14Z"},{"id":"wordfence:66b6443a-3bd0-4f45-8ad3-424d11ec24e1","source":"wordfence","cve":"","title":"No Page Comment <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b6443a-3bd0-4f45-8ad3-424d11ec24e1?source=api-prod","affected":[{"type":"plugin","slug":"no-page-comment","name":"No Page Comment","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66b669ce-142a-48b8-9adf-620657c2db74","source":"wordfence","cve":"CVE-2024-12421","title":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b669ce-142a-48b8-9adf-620657c2db74?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.7.1","to_inclusive":true,"patched_in":"5.16.7.2"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:50Z"},{"id":"wordfence:66b7d455-0959-4a7a-b37c-02d1ecac666b","source":"wordfence","cve":"CVE-2022-1847","title":"Rotating Posts <= 1.11 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b7d455-0959-4a7a-b37c-02d1ecac666b?source=api-prod","affected":[{"type":"plugin","slug":"rotating-posts","name":"Rotating Posts","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66b86375-81e3-4ac8-90e3-8ae34c28c1c2","source":"wordfence","cve":"CVE-2021-25113","title":"Dropdown Menu Widget <= 1.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b86375-81e3-4ac8-90e3-8ae34c28c1c2?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-menu-widget","name":"Dropdown Menu Widget","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66b91fe9-ceb3-485c-bf5f-a672656d4e86","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 2.0.2 - Authorization Bypass to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66b91fe9-ceb3-485c-bf5f-a672656d4e86?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2014-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bc83f5-0f6c-425f-a560-e79e777b76ca","source":"wordfence","cve":"CVE-2023-2179","title":"WooCommerce Order Status Change Notifier <= 1.1.0 - Authenticated (Subscriber+) Arbitrary Order Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bc83f5-0f6c-425f-a560-e79e777b76ca?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-order-status-change-notifier","name":"WooCommerce Order Status Change Notifier","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bc8d9c-1a5f-4dca-b15f-8fdf821dbc6f","source":"wordfence","cve":"CVE-2022-4359","title":"WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bc8d9c-1a5f-4dca-b15f-8fdf821dbc6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-by-publishers","name":"WP RSS By Publishers","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bca09b-7f53-4e7a-a58c-a28ad6a4825e","source":"wordfence","cve":"","title":"Download buttons for Youtube videos <= 1.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bca09b-7f53-4e7a-a58c-a28ad6a4825e?source=api-prod","affected":[{"type":"plugin","slug":"audio-video-download-buttons-for-youtube","name":"Download buttons for Youtube videos","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bd0a9f-66ec-42a5-a123-0a468bb43ed8","source":"wordfence","cve":"CVE-2022-43481","title":"Advanced Coupons for WooCommerce Coupons <= 4.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bd0a9f-66ec-42a5-a123-0a468bb43ed8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-coupons-for-woocommerce-free","name":"Advanced Coupons for WooCommerce \u2013 BOGO, Store Credit & WooCommerce Coupons","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.5.0.1"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bd5065-aa4c-4b5b-a312-2f7bd1643d35","source":"wordfence","cve":"CVE-2022-29449","title":"Opal Hotel Room Booking plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bd5065-aa4c-4b5b-a312-2f7bd1643d35?source=api-prod","affected":[{"type":"plugin","slug":"opal-hotel-room-booking","name":"Opal Hotel Room Booking","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T14:10:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66bf7ac2-8f6b-4064-9474-f0f4192a8b33","source":"wordfence","cve":"CVE-2024-3633","title":"WebP & SVG Support <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66bf7ac2-8f6b-4064-9474-f0f4192a8b33?source=api-prod","affected":[{"type":"plugin","slug":"webp-svg-support","name":"WebP & SVG Support","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-02T12:59:46Z"},{"id":"wordfence:66c0a19a-d94f-4de0-85a8-de7c7e489e33","source":"wordfence","cve":"CVE-2022-37338","title":"Blossom Recipe Maker <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c0a19a-d94f-4de0-85a8-de7c7e489e33?source=api-prod","affected":[{"type":"plugin","slug":"blossom-recipe-maker","name":"Blossom Recipe Maker","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66c0c3e0-d7a2-4759-9e56-632ba37bf4d7","source":"wordfence","cve":"CVE-2025-53267","title":"Hide Admin Bar From Front End <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c0c3e0-d7a2-4759-9e56-632ba37bf4d7?source=api-prod","affected":[{"type":"plugin","slug":"hide-admin-bar-from-front-end","name":"Hide Admin Bar From Front End","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:29:59Z"},{"id":"wordfence:66c20a71-96e2-4d5e-a2ed-7e7afbe85306","source":"wordfence","cve":"CVE-2024-50493","title":"Automatic Translation <= 1.0.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c20a71-96e2-4d5e-a2ed-7e7afbe85306?source=api-prod","affected":[{"type":"plugin","slug":"automatic-translation","name":"Automatic Translation","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:22:35Z"},{"id":"wordfence:66c3c02c-0ef4-4d71-97fa-f7b786ae64b9","source":"wordfence","cve":"CVE-2024-49231","title":"WordPress Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c3c02c-0ef4-4d71-97fa-f7b786ae64b9?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-video","name":"WordPress Video","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:10:33Z"},{"id":"wordfence:66c49614-8b57-4889-b6a2-c0cead7375d9","source":"wordfence","cve":"CVE-2025-48329","title":"Real Time Validation for Gravity Forms <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c49614-8b57-4889-b6a2-c0cead7375d9?source=api-prod","affected":[{"type":"plugin","slug":"real-time-validation-for-gravity-forms","name":"Real Time Validation for Gravity Forms","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:55:22Z"},{"id":"wordfence:66c58d4c-8c36-40af-827d-0e86f2110e3c","source":"wordfence","cve":"CVE-2023-0544","title":"WP Login Box <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c58d4c-8c36-40af-827d-0e86f2110e3c?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-box","name":"WP Login Box","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66c6a01d-35ab-496a-8457-4cd6d894f111","source":"wordfence","cve":"CVE-2026-39607","title":"Filter Plus <= 1.1.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c6a01d-35ab-496a-8457-4cd6d894f111?source=api-prod","affected":[{"type":"plugin","slug":"filter-plus","name":"Filter Plus \u2013 WooCommerce Product Filter & AJAX Post Filter","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-04-15T21:16:51Z"},{"id":"wordfence:66c7c6d1-8077-4b9c-a26c-631e18917a43","source":"wordfence","cve":"CVE-2025-30984","title":"SEO Tools <= 4.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c7c6d1-8077-4b9c-a26c-631e18917a43?source=api-prod","affected":[{"type":"plugin","slug":"seo-automatic-seo-tools","name":"SEO Tools","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T14:10:53Z"},{"id":"wordfence:66c90387-af23-48fc-94da-708b9c223fe3","source":"wordfence","cve":"CVE-2023-41737","title":"Swifty Bar, sticky bar by WPGens <= 1.2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66c90387-af23-48fc-94da-708b9c223fe3?source=api-prod","affected":[{"type":"plugin","slug":"swifty-bar","name":"Swifty Bar, sticky bar by WPGens","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66ca4e6a-e489-4c86-a9d4-1eb89c97cc1c","source":"wordfence","cve":"CVE-2026-1255","title":"YS LeadGen \u2013 Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca4e6a-e489-4c86-a9d4-1eb89c97cc1c?source=api-prod","affected":[{"type":"plugin","slug":"ysleadgen","name":"YS LeadGen \u2013 Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-09-18T19:45:55Z","updated":"2026-09-19T08:27:22Z"},{"id":"wordfence:66ca9c39-1ba0-4208-ae35-d2c3c9ea4eb9","source":"wordfence","cve":"CVE-2024-6518","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca9c39-1ba0-4208-ae35-d2c3c9ea4eb9?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2024-07-26T23:26:31Z","updated":"2024-07-29T14:18:07Z"},{"id":"wordfence:66cad18d-a433-47f1-9cb6-c619c8717a0d","source":"wordfence","cve":"CVE-2024-11198","title":"GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66cad18d-a433-47f1-9cb6-c619c8717a0d?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2024-11-19T00:05:15Z","updated":"2024-11-19T12:45:31Z"},{"id":"wordfence:66cb8c6f-d405-4115-a626-040e9b5b1e62","source":"wordfence","cve":"CVE-2026-75957","title":"Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66cb8c6f-d405-4115-a626-040e9b5b1e62?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-multisite","name":"Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"}],"published":"2026-09-30T19:18:17Z","updated":"2026-10-01T07:40:23Z"},{"id":"wordfence:66cd0ed5-070a-4408-9faa-b3d840279f77","source":"wordfence","cve":"CVE-2024-30478","title":"WordPress Announcement & Notification Banner Plugin \u2013 Bulletin <= 3.8.5 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66cd0ed5-070a-4408-9faa-b3d840279f77?source=api-prod","affected":[{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:51:18Z"},{"id":"wordfence:66cda4f0-baf1-45e6-89b6-17946118d345","source":"wordfence","cve":"CVE-2025-67981","title":"Besa <= 2.3.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66cda4f0-baf1-45e6-89b6-17946118d345?source=api-prod","affected":[{"type":"theme","slug":"besa","name":"Besa - Elementor Marketplace WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:00:34Z"},{"id":"wordfence:66ce2d12-8f57-4140-b3cf-0fc8c1c4f3d5","source":"wordfence","cve":"CVE-2015-7319","title":"Appointment Booking Calendar <= 1.1.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ce2d12-8f57-4140-b3cf-0fc8c1c4f3d5?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2015-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66d217f1-03cf-496d-b3a4-09f9b5bb7966","source":"wordfence","cve":"CVE-2024-34419","title":"Configure Login Timeout <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66d217f1-03cf-496d-b3a4-09f9b5bb7966?source=api-prod","affected":[{"type":"plugin","slug":"configure-login-timeout","name":"Configure Login Timeout","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:34:33Z"},{"id":"wordfence:66d642e0-c78f-4e50-89d9-03940fa0e34f","source":"wordfence","cve":"CVE-2026-22356","title":"Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66d642e0-c78f-4e50-89d9-03940fa0e34f?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"6.7.0","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-25T14:00:02Z"},{"id":"wordfence:66d70cf6-494f-4221-af3b-ee76cf22a305","source":"wordfence","cve":"CVE-2018-10309","title":"Responsive Cookie Consent < 1.8 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66d70cf6-494f-4221-af3b-ee76cf22a305?source=api-prod","affected":[{"type":"plugin","slug":"responsive-cookie-consent","name":"Responsive Cookie Consent","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2018-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66d77518-a258-4e79-b483-275855c0a416","source":"wordfence","cve":"CVE-2024-5255","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66d77518-a258-4e79-b483-275855c0a416?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.20","to_inclusive":true,"patched_in":"3.19.20.1"}],"published":"2024-07-16T18:30:45Z","updated":"2024-07-17T06:45:09Z"},{"id":"wordfence:66da0ad7-18a3-42b9-b59a-5927c6bc836b","source":"wordfence","cve":"CVE-2023-32508","title":"Order Your Posts Manually <= 2.2.5 - Authenticated (Administrator+) SQL Injection via 'sortdata'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66da0ad7-18a3-42b9-b59a-5927c6bc836b?source=api-prod","affected":[{"type":"plugin","slug":"order-your-posts-manually","name":"Order Your Posts Manually","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66db1cd8-92c7-4d12-9f49-6fa5fbc98d6c","source":"wordfence","cve":"CVE-2025-62968","title":"WP Last Modified Info <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66db1cd8-92c7-4d12-9f49-6fa5fbc98d6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified-info","name":"WP Last Modified Info","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-10-18T00:00:00Z","updated":"2025-11-10T15:33:03Z"},{"id":"wordfence:66dc2ca2-c61c-4c73-aa2a-0017299cbca5","source":"wordfence","cve":"CVE-2025-11973","title":"\u7b80\u6570\u91c7\u96c6\u5668 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66dc2ca2-c61c-4c73-aa2a-0017299cbca5?source=api-prod","affected":[{"type":"plugin","slug":"keydatas","name":"\u7b80\u6570\u91c7\u96c6\u5668","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2025-11-20T19:31:53Z","updated":"2025-11-25T19:11:41Z"},{"id":"wordfence:66dc7618-3d84-4a55-9bed-0f41415ed9e9","source":"wordfence","cve":"CVE-2021-24468","title":"Leaflet Map <= 2.23.3 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66dc7618-3d84-4a55-9bed-0f41415ed9e9?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-map","name":"Leaflet Map","from":"*","from_inclusive":true,"to":"2.23.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2021-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66dd73c5-1cf1-484e-b847-afe357fb2598","source":"wordfence","cve":"CVE-2026-3332","title":"Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66dd73c5-1cf1-484e-b847-afe357fb2598?source=api-prod","affected":[{"type":"plugin","slug":"xhanch-my-advanced-settings","name":"Xhanch \u2013 My Advanced Settings","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:13:32Z","updated":"2026-03-21T03:26:49Z"},{"id":"wordfence:66ddb0f7-4d4c-4c4f-b766-9a07609cd0e5","source":"wordfence","cve":"","title":"Fruitful < 3.8.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ddb0f7-4d4c-4c4f-b766-9a07609cd0e5?source=api-prod","affected":[{"type":"theme","slug":"fruitful","name":"Fruitful","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":false,"patched_in":"3.8.1"}],"published":"2020-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66e46f9f-d4f1-4fde-8aa5-a9a9c216ae04","source":"wordfence","cve":"CVE-2026-73341","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e46f9f-d4f1-4fde-8aa5-a9a9c216ae04?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.7","to_inclusive":true,"patched_in":"6.0.9.8"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:34:13Z"},{"id":"wordfence:66e55302-f889-4054-817f-aadbdd3c88de","source":"wordfence","cve":"","title":"Get Custom Field Values <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e55302-f889-4054-817f-aadbdd3c88de?source=api-prod","affected":[{"type":"plugin","slug":"get-custom-field-values","name":"Get Custom Field Values","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1"}],"published":"2023-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66e57713-c3c8-4efa-b0e3-78f70d48f8e7","source":"wordfence","cve":"CVE-2026-5336","title":"Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e57713-c3c8-4efa-b0e3-78f70d48f8e7?source=api-prod","affected":[{"type":"plugin","slug":"integration-cds","name":"DataPress (Dataverse Integration)","from":"*","from_inclusive":true,"to":"2.90","to_inclusive":true,"patched_in":"2.91"}],"published":"2026-06-02T00:00:00Z","updated":"2026-09-17T15:40:36Z"},{"id":"wordfence:66e5a569-1dd5-40e9-8356-d7c82c8e30ed","source":"wordfence","cve":"CVE-2023-34020","title":"Uncanny Toolkit for LearnDash <= 3.6.4.3 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e5a569-1dd5-40e9-8356-d7c82c8e30ed?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.6.4.4","to_inclusive":false,"patched_in":"3.6.4.4"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66e724a1-5d40-4ba0-a324-1b4f1e463f26","source":"wordfence","cve":"CVE-2024-50455","title":"SEOPress <= 8.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e724a1-5d40-4ba0-a324-1b4f1e463f26?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T19:42:19Z"},{"id":"wordfence:66e78219-b3fd-40e9-a58c-8e27ef3c5e4a","source":"wordfence","cve":"CVE-2023-22684","title":"Subscribers \u2013 Free Web Push Notifications <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e78219-b3fd-40e9-a58c-8e27ef3c5e4a?source=api-prod","affected":[{"type":"plugin","slug":"subscribers-com","name":"Subscribers \u2013 Free Web Push Notifications","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66e89753-f83e-4e60-b165-6d3d101d6c59","source":"wordfence","cve":"CVE-2022-4536","title":"IP Vault \u2013 WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66e89753-f83e-4e60-b165-6d3d101d6c59?source=api-prod","affected":[{"type":"plugin","slug":"ip-vault-wp-firewall","name":"Two-factor authentication (formerly IP Vault)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-08-30T00:00:00Z","updated":"2024-08-31T08:35:18Z"},{"id":"wordfence:66ed3f4d-1977-487a-942e-3dd599586957","source":"wordfence","cve":"CVE-2017-14751","title":"WP Jobs < 1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ed3f4d-1977-487a-942e-3dd599586957?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobs","name":"WP Jobs","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66eda073-f5d6-4ba7-90a8-bffcb38c4970","source":"wordfence","cve":"CVE-2026-102392","title":"Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66eda073-f5d6-4ba7-90a8-bffcb38c4970?source=api-prod","affected":[{"type":"plugin","slug":"woo-extra-product-options","name":"Extra Product Options For WooCommerce | Custom Product Addons and Fields","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-09-30T13:26:48Z","updated":"2026-10-08T22:57:44Z"},{"id":"wordfence:66edd8e5-1d5e-425d-a4f4-5359683c1e36","source":"wordfence","cve":"CVE-2023-27443","title":"Simple Vimeo Shortcode <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66edd8e5-1d5e-425d-a4f4-5359683c1e36?source=api-prod","affected":[{"type":"plugin","slug":"the-very-simple-vimeo-shortcode","name":"Simple Vimeo Shortcode","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66ee8428-363e-412e-82b1-0d93bfe8f89c","source":"wordfence","cve":"CVE-2025-69149","title":"Top Dog <= 1.0.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66ee8428-363e-412e-82b1-0d93bfe8f89c?source=api-prod","affected":[{"type":"theme","slug":"top-dog","name":"Top Dog","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T11:55:22Z"},{"id":"wordfence:66eeade1-d692-4c1f-a0cd-a3ea426794a1","source":"wordfence","cve":"CVE-2024-56007","title":"Leader <= 2.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66eeade1-d692-4c1f-a0cd-a3ea426794a1?source=api-prod","affected":[{"type":"plugin","slug":"leader","name":"Leader","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T11:14:02Z"},{"id":"wordfence:66efc65e-48d3-4ef9-a369-51448e47686a","source":"wordfence","cve":"CVE-2023-45629","title":"Responsive Image Gallery, Gallery Album <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66efc65e-48d3-4ef9-a369-51448e47686a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66f29499-1522-43cd-af78-9b734c66af8c","source":"wordfence","cve":"CVE-2025-13494","title":"SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f29499-1522-43cd-af78-9b734c66af8c?source=api-prod","affected":[{"type":"plugin","slug":"ssp-debugging","name":"SSP Debug","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:27:19Z","updated":"2025-12-05T04:29:11Z"},{"id":"wordfence:66f392d0-d5fb-4a8c-b972-becfac6cf6e7","source":"wordfence","cve":"CVE-2023-52125","title":"iFrame <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc","severity":"medium","cvss":5.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f392d0-d5fb-4a8c-b972-becfac6cf6e7?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66f6cae3-d38e-4ca3-82c5-606eb4a80c30","source":"wordfence","cve":"CVE-2026-27049","title":"Jobica Core <= 1.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f6cae3-d38e-4ca3-82c5-606eb4a80c30?source=api-prod","affected":[{"type":"plugin","slug":"jobica-core","name":"Jobica Core","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:05:21Z"},{"id":"wordfence:66f71440-59f4-4de4-b008-20bec4820489","source":"wordfence","cve":"CVE-2025-22321","title":"ElementsCSS Addons for Elementor <= 1.0.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f71440-59f4-4de4-b008-20bec4820489?source=api-prod","affected":[{"type":"plugin","slug":"css-for-elementor","name":"ElementsCSS Addons for Elementor (Elementor Widgets Extender & Addons)","from":"*","from_inclusive":true,"to":"1.0.8.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:06:00Z"},{"id":"wordfence:66f71de2-055d-42f0-9eb1-145c64f44d5b","source":"wordfence","cve":"","title":"Google Analytics MU < 2.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f71de2-055d-42f0-9eb1-145c64f44d5b?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-mu","name":"Google Analytics MU","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4"}],"published":"2014-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66f73c3d-3937-4b9f-a7d6-29c249e46b92","source":"wordfence","cve":"CVE-2022-4546","title":"Mapwiz <= 1.0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f73c3d-3937-4b9f-a7d6-29c249e46b92?source=api-prod","affected":[{"type":"plugin","slug":"mapwiz","name":"Mapwiz","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:66f82859-1798-42ed-bb6a-44b0af438c7f","source":"wordfence","cve":"CVE-2023-7297","title":"TwitterPosts <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66f82859-1798-42ed-bb6a-44b0af438c7f?source=api-prod","affected":[{"type":"plugin","slug":"twitter-posts","name":"TwitterPosts","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-11-25T17:31:10Z"},{"id":"wordfence:66fd9aa4-c8ec-42d6-b03a-7534d964e38f","source":"wordfence","cve":"CVE-2024-13124","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.32 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/66fd9aa4-c8ec-42d6-b03a-7534d964e38f?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.32","to_inclusive":true,"patched_in":"1.8.33"}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-27T13:30:02Z"},{"id":"wordfence:67001e61-c7f5-46bc-9d32-b121ce5d6fd5","source":"wordfence","cve":"CVE-2025-6259","title":"esri-map-view <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67001e61-c7f5-46bc-9d32-b121ce5d6fd5?source=api-prod","affected":[{"type":"plugin","slug":"esri-map-view","name":"esri-map-view","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-05T13:00:29Z","updated":"2025-08-06T01:45:11Z"},{"id":"wordfence:67008179-2e79-4d20-b36e-b63047fdedd8","source":"wordfence","cve":"CVE-2024-37433","title":"Mailster <= 4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67008179-2e79-4d20-b36e-b63047fdedd8?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster - Email Newsletter Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:58:31Z"},{"id":"wordfence:6700e926-21c1-45c9-bca9-62ef0218e998","source":"wordfence","cve":"CVE-2024-6929","title":"Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6700e926-21c1-45c9-bca9-62ef0218e998?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-featured-image","name":"Dynamic Featured Image","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-04T21:23:36Z","updated":"2024-09-05T09:29:51Z"},{"id":"wordfence:67013cc9-c20f-4137-9a4d-e7d700899131","source":"wordfence","cve":"CVE-2026-17608","title":"WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67013cc9-c20f-4137-9a4d-e7d700899131?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.10.09","to_inclusive":true,"patched_in":"7.20.01"}],"published":"2026-08-15T17:28:03Z","updated":"2026-08-16T06:38:07Z"},{"id":"wordfence:67021dde-a21c-4281-b4f2-acc840efcc69","source":"wordfence","cve":"CVE-2022-46840","title":"JS Help Desk <= 2.7.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67021dde-a21c-4281-b4f2-acc840efcc69?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6702c762-14c1-490a-92e4-313b785b3407","source":"wordfence","cve":"","title":"WP REST API <= 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6702c762-14c1-490a-92e4-313b785b3407?source=api-prod","affected":[{"type":"plugin","slug":"json-rest-api","name":"WP REST API (WP API)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2015-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67050673-73f5-4fc5-a9fc-576ab7ebd7a9","source":"wordfence","cve":"CVE-2025-48235","title":"WP Image Mask <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67050673-73f5-4fc5-a9fc-576ab7ebd7a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-mask","name":"WP Image Mask","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:53:12Z"},{"id":"wordfence:6707aa4c-c652-42c0-bdb9-00be984e7271","source":"wordfence","cve":"CVE-2025-6464","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6707aa4c-c652-42c0-bdb9-00be984e7271?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.44.2","to_inclusive":true,"patched_in":"1.44.3"}],"published":"2025-07-01T17:04:22Z","updated":"2025-07-02T05:29:18Z"},{"id":"wordfence:670953e2-46d3-46f9-9922-0a3c9c277968","source":"wordfence","cve":"CVE-2025-9463","title":"Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670953e2-46d3-46f9-9922-0a3c9c277968?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"*","from_inclusive":true,"to":"1.117.5","to_inclusive":true,"patched_in":"1.117.6"}],"published":"2025-09-09T18:09:06Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:6709f9b0-0915-4361-9fb0-1f2696e26c2f","source":"wordfence","cve":"CVE-2023-29095","title":"RSVPMaker  <= 10.5.4 - Authenticated (Administrator+) SQL Injection via 'resend'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6709f9b0-0915-4361-9fb0-1f2696e26c2f?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"10.5.5","to_inclusive":false,"patched_in":"10.5.5"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:670c1c3e-200c-4303-ac34-3bca5605fcde","source":"wordfence","cve":"CVE-2025-30570","title":"\u062f\u06a9\u0645\u0647\u060c \u0634\u0628\u06a9\u0647 \u0627\u062c\u062a\u0645\u0627\u0639\u06cc \u062e\u0631\u06cc\u062f <= 2.0.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670c1c3e-200c-4303-ac34-3bca5605fcde?source=api-prod","affected":[{"type":"plugin","slug":"dokme","name":"\u062f\u06a9\u0645\u0647\u060c \u0634\u0628\u06a9\u0647 \u0627\u062c\u062a\u0645\u0627\u0639\u06cc \u062e\u0631\u06cc\u062f","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:53:10Z"},{"id":"wordfence:670d83e4-76dd-453e-a1ac-65254fa78cee","source":"wordfence","cve":"CVE-2026-107774","title":"Dokan <= 5.3.2 - Unauthenticated Email Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670d83e4-76dd-453e-a1ac-65254fa78cee?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:36:21Z"},{"id":"wordfence:670e92d6-4136-48f1-88d1-69a9fa772a65","source":"wordfence","cve":"","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 2.11.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670e92d6-4136-48f1-88d1-69a9fa772a65?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":true,"patched_in":"2.11.2.1"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:670ea03e-2f76-48a4-9f40-bc4cfd987a89","source":"wordfence","cve":"CVE-2023-4962","title":"Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670ea03e-2f76-48a4-9f40-bc4cfd987a89?source=api-prod","affected":[{"type":"plugin","slug":"video-popup","name":"Video Popup \u2013 Video Lightbox for YouTube, Vimeo & MP4","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:670efa9a-168b-4c9b-9c8a-727dd3a13a3b","source":"wordfence","cve":"CVE-2025-23792","title":"Passwordless WP \u2013 Login with your glance or fingerprint <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670efa9a-168b-4c9b-9c8a-727dd3a13a3b?source=api-prod","affected":[{"type":"plugin","slug":"passwordless-wp","name":"Passwordless WP \u2013 Login with your glance or fingerprint","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-19T16:15:39Z"},{"id":"wordfence:670f4e26-75c9-40cd-8088-2fa4c40f6feb","source":"wordfence","cve":"CVE-2025-14436","title":"Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670f4e26-75c9-40cd-8088-2fa4c40f6feb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-sendinblue-newsletter-subscription","name":"Brevo for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.49","to_inclusive":true,"patched_in":"4.0.50"}],"published":"2026-01-08T09:02:36Z","updated":"2026-01-08T21:21:54Z"},{"id":"wordfence:670fc073-bdb4-45b1-9257-73ed0c595766","source":"wordfence","cve":"CVE-2025-69339","title":"Molla - eCommerce HTML5 Template <= 1.5.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/670fc073-bdb4-45b1-9257-73ed0c595766?source=api-prod","affected":[{"type":"theme","slug":"molla","name":"Molla - eCommerce HTML5 Template","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":true,"patched_in":"1.5.17"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:43:45Z"},{"id":"wordfence:6711f542-8b75-4968-86ac-9686ded775b7","source":"wordfence","cve":"","title":"WordPress Core 2.1.1 - Supply Chain Compromise","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6711f542-8b75-4968-86ac-9686ded775b7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"2.1.1","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2007-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6713c2dc-fc7f-4992-bde7-cfb94c383664","source":"wordfence","cve":"CVE-2026-65545","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6713c2dc-fc7f-4992-bde7-cfb94c383664?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:49:30Z"},{"id":"wordfence:67147f28-b362-46f9-9d26-7fde05dab33b","source":"wordfence","cve":"CVE-2025-69330","title":"Prestige < 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67147f28-b362-46f9-9d26-7fde05dab33b?source=api-prod","affected":[{"type":"theme","slug":"prestige","name":"Prestige","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:51:50Z"},{"id":"wordfence:6714ccff-ab6f-4222-96eb-7f442e94f225","source":"wordfence","cve":"CVE-2024-43963","title":"YellowPencil Visual CSS Style Editor <= 7.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6714ccff-ab6f-4222-96eb-7f442e94f225?source=api-prod","affected":[{"type":"plugin","slug":"yellow-pencil-visual-theme-customizer","name":"Visual CSS Style Editor","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:22:05Z"},{"id":"wordfence:67176209-443c-4f66-b5a8-1dde2f7f0837","source":"wordfence","cve":"CVE-2012-2580","title":"Postie < 1.4.10 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67176209-443c-4f66-b5a8-1dde2f7f0837?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2012-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6717adb0-27bc-4cd4-8c34-bea59bc0e016","source":"wordfence","cve":"CVE-2025-3053","title":"UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.07 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6717adb0-27bc-4cd4-8c34-bea59bc0e016?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.07","to_inclusive":true,"patched_in":"3.5.08"}],"published":"2025-05-14T00:00:00Z","updated":"2025-05-15T04:21:50Z"},{"id":"wordfence:671b93aa-fc60-4abb-a5a9-da0957c89e13","source":"wordfence","cve":"CVE-2026-11589","title":"Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/671b93aa-fc60-4abb-a5a9-da0957c89e13?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-09-18T14:43:57Z"},{"id":"wordfence:671f5ba5-1f18-49fa-aa97-eaebdb3417bb","source":"wordfence","cve":"CVE-2021-4355","title":"Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/671f5ba5-1f18-49fa-aa97-eaebdb3417bb?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":false,"patched_in":"2.2.8"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:671fe004-1481-442c-a376-967d83673252","source":"wordfence","cve":"CVE-2026-96339","title":"Houzez <= 4.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/671fe004-1481-442c-a376-967d83673252?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:42:33Z"},{"id":"wordfence:6720e68e-16fc-48c2-ad56-1f44a3e78bb2","source":"wordfence","cve":"CVE-2026-15404","title":"Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6720e68e-16fc-48c2-ad56-1f44a3e78bb2?source=api-prod","affected":[{"type":"plugin","slug":"lpagery","name":"Bulk Page Generator \u2013 LPagery","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2026-07-22T20:23:00Z","updated":"2026-07-23T08:34:38Z"},{"id":"wordfence:67279c70-c416-4d18-9951-470773b9221a","source":"wordfence","cve":"CVE-2023-47687","title":"Woo Custom and Sequential Order Number <= 2.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67279c70-c416-4d18-9951-470773b9221a?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-and-sequential-order-number","name":"Woo Custom and Sequential Order Number","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6728fca7-f66d-4b8a-a16f-db60a315b434","source":"wordfence","cve":"CVE-2026-1795","title":"Address Bar Ads <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6728fca7-f66d-4b8a-a16f-db60a315b434?source=api-prod","affected":[{"type":"plugin","slug":"address-bar-ads","name":"Address Bar Ads","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:27:17Z","updated":"2026-02-14T06:42:29Z"},{"id":"wordfence:672a7943-1b29-4a4f-a3f5-191fd9c5645c","source":"wordfence","cve":"CVE-2026-87860","title":"Subscriptions for WooCommerce <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/672a7943-1b29-4a4f-a3f5-191fd9c5645c?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T20:12:53Z"},{"id":"wordfence:672c7b4f-73f3-4133-8716-7733848298bd","source":"wordfence","cve":"CVE-2025-67543","title":"Essential Widgets <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/672c7b4f-73f3-4133-8716-7733848298bd?source=api-prod","affected":[{"type":"plugin","slug":"essential-widgets","name":"Essential Widgets","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-10T16:07:07Z"},{"id":"wordfence:672edfd2-ca4b-4937-8237-3c0a4acc8690","source":"wordfence","cve":"","title":"pb-embedFlash <= 1.5.1 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/672edfd2-ca4b-4937-8237-3c0a4acc8690?source=api-prod","affected":[{"type":"plugin","slug":"pb-embedflash","name":"pb-embedflash","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6730f4a3-e915-434a-9f0a-2e96021915ac","source":"wordfence","cve":"CVE-2026-56048","title":"Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6730f4a3-e915-434a-9f0a-2e96021915ac?source=api-prod","affected":[{"type":"plugin","slug":"checkout-fees-for-woocommerce","name":"Payment Gateway Based Fees and Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:06:33Z"},{"id":"wordfence:67351a37-a457-48d6-b40a-95a7e3a0d746","source":"wordfence","cve":"CVE-2026-2694","title":"The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67351a37-a457-48d6-b40a-95a7e3a0d746?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.16","to_inclusive":true,"patched_in":"6.15.16.1"}],"published":"2026-02-25T08:50:45Z","updated":"2026-02-25T21:25:02Z"},{"id":"wordfence:673b19be-c178-4b9a-a026-e0331766f9de","source":"wordfence","cve":"CVE-2025-32233","title":"Revive.so \u2013 Bulk Rewrite and Republish Blog Posts <= 2.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/673b19be-c178-4b9a-a026-e0331766f9de?source=api-prod","affected":[{"type":"plugin","slug":"revive-so","name":"Revive.so \u2013 Bulk Rewrite and Republish Blog Posts","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-04-04T00:00:00Z","updated":"2025-06-25T14:22:52Z"},{"id":"wordfence:673eb0ec-89c2-4d36-91fb-c18a110fe6c4","source":"wordfence","cve":"CVE-2025-30846","title":"Restaurant Menu by MotoPress <= 2.4.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/673eb0ec-89c2-4d36-91fb-c18a110fe6c4?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:40:01Z"},{"id":"wordfence:673f0910-8121-4344-b756-2ed5418fdc6b","source":"wordfence","cve":"CVE-2024-5796","title":"Infinite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/673f0910-8121-4344-b756-2ed5418fdc6b?source=api-prod","affected":[{"type":"theme","slug":"infinite","name":"Infinite","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-27T18:55:19Z","updated":"2024-06-28T06:57:46Z"},{"id":"wordfence:6741a049-1b89-4458-86e6-aabf83915b3a","source":"wordfence","cve":"CVE-2026-66634","title":"Modal Survey - WordPress Poll, Survey & Quiz Plugin <= 2.0.2.2.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6741a049-1b89-4458-86e6-aabf83915b3a?source=api-prod","affected":[{"type":"plugin","slug":"modal-survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.2.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:45:32Z"},{"id":"wordfence:6741b770-79d3-4797-8f8f-4ca83fde4705","source":"wordfence","cve":"CVE-2023-25462","title":"WP htaccess Control <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6741b770-79d3-4797-8f8f-4ca83fde4705?source=api-prod","affected":[{"type":"plugin","slug":"wp-htaccess-control","name":"WP htaccess Control","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6743a762-6d40-4ed9-95f2-f1b405683f26","source":"wordfence","cve":"CVE-2025-11826","title":"WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6743a762-6d40-4ed9-95f2-f1b405683f26?source=api-prod","affected":[{"type":"plugin","slug":"wp-company-info","name":"WP Company Info","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:32:39Z","updated":"2025-11-21T08:28:12Z"},{"id":"wordfence:674461ad-9b61-48c4-af2a-5dfcaeb38215","source":"wordfence","cve":"CVE-2023-0993","title":"Shield Security <= 17.0.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/674461ad-9b61-48c4-af2a-5dfcaeb38215?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"17.0.18","to_inclusive":false,"patched_in":"17.0.18"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6745be2e-d151-452a-8e65-0db2409dd54d","source":"wordfence","cve":"CVE-2023-50901","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6745be2e-d151-452a-8e65-0db2409dd54d?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6746d20c-d528-4c69-95e4-9f22d6460463","source":"wordfence","cve":"CVE-2024-43916","title":"Zephyr Project Manager <= 3.3.102 - Missing Authorization to Authenticated (Subscriber+) Status Updates","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6746d20c-d528-4c69-95e4-9f22d6460463?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.102","to_inclusive":true,"patched_in":"3.3.103"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-28T22:28:38Z"},{"id":"wordfence:6748841a-0984-4840-90ba-0eeff8564198","source":"wordfence","cve":"CVE-2023-32118","title":"SALERT <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6748841a-0984-4840-90ba-0eeff8564198?source=api-prod","affected":[{"type":"plugin","slug":"salert","name":"SALERT \u2013 Social Proof Notifications & Live Sales Popup","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:674df25e-fc37-4f8e-a657-7c493e9bbb15","source":"wordfence","cve":"CVE-2025-60175","title":"PopAd <= 1.0.4 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/674df25e-fc37-4f8e-a657-7c493e9bbb15?source=api-prod","affected":[{"type":"plugin","slug":"popad","name":"PopAd","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T12:44:54Z"},{"id":"wordfence:674e6722-d293-4572-80bf-984e74c3e33f","source":"wordfence","cve":"CVE-2024-1842","title":"WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/674e6722-d293-4572-80bf-984e74c3e33f?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:30:23Z"},{"id":"wordfence:674f75d7-83de-4d0b-80f2-ee83dd474728","source":"wordfence","cve":"CVE-2018-1000172","title":"NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/674f75d7-83de-4d0b-80f2-ee83dd474728?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.2.44","to_inclusive":true,"patched_in":"2.2.45"}],"published":"2018-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6751e9b3-b43f-474a-8733-c337e17ab683","source":"wordfence","cve":"CVE-2025-69033","title":"Blog Filter <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6751e9b3-b43f-474a-8733-c337e17ab683?source=api-prod","affected":[{"type":"plugin","slug":"blog-filter","name":"Blog Filter \u2013 Post Grid Filter by Category or Tag","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-08T21:42:51Z"},{"id":"wordfence:67520500-fefd-45b6-9a32-9fd44af330d3","source":"wordfence","cve":"CVE-2025-30944","title":"Tablesome Table Premium <= 1.1.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67520500-fefd-45b6-9a32-9fd44af330d3?source=api-prod","affected":[{"type":"plugin","slug":"tablesome-premium","name":"Tablesome Table Premium","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:46:56Z"},{"id":"wordfence:67526e19-b511-4cb5-8b9c-6ace8b8f340c","source":"wordfence","cve":"CVE-2026-108476","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.5.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67526e19-b511-4cb5-8b9c-6ace8b8f340c?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.5.13","to_inclusive":true,"patched_in":"7.5.14"}],"published":"2026-10-12T16:39:00Z","updated":"2026-10-13T14:04:05Z"},{"id":"wordfence:6753a37b-7242-4895-a439-f726ad835f61","source":"wordfence","cve":"CVE-2021-25015","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6753a37b-7242-4895-a439-f726ad835f61?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6754ba34-0dc7-40a5-9548-a5f77db0df53","source":"wordfence","cve":"CVE-2025-1309","title":"UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6754ba34-0dc7-40a5-9548-a5f77db0df53?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.04","to_inclusive":true,"patched_in":"3.5.05"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T07:22:24Z"},{"id":"wordfence:6755c415-427e-4572-908c-061ab8f7490a","source":"wordfence","cve":"","title":"Link Library <= 5.9.13.26 \u2013 SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6755c415-427e-4572-908c-061ab8f7490a?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"5.9.13.26","to_inclusive":true,"patched_in":"5.9.13.27"}],"published":"2017-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6755e760-7b9b-4a90-8ce4-581ba26ee8da","source":"wordfence","cve":"CVE-2025-52767","title":"NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6755e760-7b9b-4a90-8ce4-581ba26ee8da?source=api-prod","affected":[{"type":"plugin","slug":"netinsight-analytics-implementation-plugin","name":"NetInsight Analytics Implementation Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:00:35Z"},{"id":"wordfence:67571829-1636-46b5-b43f-158c97e90811","source":"wordfence","cve":"CVE-2026-57316","title":"GetGenie \u2013 AI Content Writer with Keyword Research & SEO Tracking <= 4.4.2 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67571829-1636-46b5-b43f-158c97e90811?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:52:33Z"},{"id":"wordfence:67583814-4180-4db7-ba35-fc9843648341","source":"wordfence","cve":"CVE-2025-31403","title":"Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67583814-4180-4db7-ba35-fc9843648341?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-and-notification","name":"Booking Calendar and Notification","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T15:46:12Z"},{"id":"wordfence:675937dc-a032-4bc4-a449-c815fcb12db6","source":"wordfence","cve":"CVE-2024-5252","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/675937dc-a032-4bc4-a449-c815fcb12db6?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.20","to_inclusive":true,"patched_in":"3.19.20.1"}],"published":"2024-07-16T18:30:18Z","updated":"2024-07-17T06:45:11Z"},{"id":"wordfence:675b029a-70f2-434d-8d14-0b9e9c02bd6e","source":"wordfence","cve":"CVE-2014-3923","title":"DZS Video Gallery < 7.95 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/675b029a-70f2-434d-8d14-0b9e9c02bd6e?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"7.95","to_inclusive":false,"patched_in":"7.95"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:675bf571-eb8b-4c72-9852-b3a2b37b9a04","source":"wordfence","cve":"CVE-2025-13899","title":"TR Timthumb <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/675bf571-eb8b-4c72-9852-b3a2b37b9a04?source=api-prod","affected":[{"type":"plugin","slug":"tr-timthumb","name":"TR Timthumb","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T16:45:55Z","updated":"2025-12-06T05:49:28Z"},{"id":"wordfence:675c86fb-e01f-4957-a49c-31b96383304f","source":"wordfence","cve":"CVE-2014-9305","title":"Cart66 Lite :: WordPress Ecommerce < 1.5.2 -  SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/675c86fb-e01f-4957-a49c-31b96383304f?source=api-prod","affected":[{"type":"plugin","slug":"cart66-lite","name":"Cart66 Lite :: WordPress Ecommerce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2014-12-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67631693-ae8a-4532-a9e3-f21b385131a2","source":"wordfence","cve":"CVE-2021-24131","title":"Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67631693-ae8a-4532-a9e3-f21b385131a2?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.149","to_inclusive":false,"patched_in":"5.149"}],"published":"2020-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:676346db-b861-408c-8fff-9b1c29167363","source":"wordfence","cve":"CVE-2024-55993","title":"Job Board Manager <= 2.1.60 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676346db-b861-408c-8fff-9b1c29167363?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:40:34Z"},{"id":"wordfence:6763d445-0d4f-4ac0-b41a-a30e09fcb21c","source":"wordfence","cve":"CVE-2024-32676","title":"LoginPress Pro < 3.0 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6763d445-0d4f-4ac0-b41a-a30e09fcb21c?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-08T07:18:11Z"},{"id":"wordfence:67678796-61d4-423f-b8f4-3f5667184d06","source":"wordfence","cve":"CVE-2023-6166","title":"Quiz Maker <= 6.4.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67678796-61d4-423f-b8f4-3f5667184d06?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.4.9.4","to_inclusive":true,"patched_in":"6.4.9.5"}],"published":"2023-11-30T00:00:00Z","updated":"2024-02-06T00:54:19Z"},{"id":"wordfence:6767cc8e-f327-4891-8d3c-555ba7f5062c","source":"wordfence","cve":"CVE-2022-45811","title":"Post Teaser <= 4.1.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6767cc8e-f327-4891-8d3c-555ba7f5062c?source=api-prod","affected":[{"type":"plugin","slug":"post-teaser","name":"Post Teaser","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":""}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67685b75-1dce-411d-8e18-55b4f4216099","source":"wordfence","cve":"CVE-2025-48278","title":"RSVPMarker  <= 11.5.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67685b75-1dce-411d-8e18-55b4f4216099?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"11.5.6","to_inclusive":true,"patched_in":"11.5.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T16:42:26Z"},{"id":"wordfence:676b0348-7ccd-4a14-be84-2497877a1e36","source":"wordfence","cve":"CVE-2025-31733","title":"WP Sitemap <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676b0348-7ccd-4a14-be84-2497877a1e36?source=api-prod","affected":[{"type":"plugin","slug":"wpsitemap","name":"WP Sitemap","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:55:49Z"},{"id":"wordfence:676b4637-a2c7-4a95-b644-bb0401f91b40","source":"wordfence","cve":"CVE-2026-12994","title":"WCFM \u2013 Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4637-a2c7-4a95-b644-bb0401f91b40?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.27","to_inclusive":true,"patched_in":"6.7.28"}],"published":"2026-07-10T16:57:45Z","updated":"2026-07-11T05:35:48Z"},{"id":"wordfence:676b4768-98ea-4e55-87de-ef7ae1d7a113","source":"wordfence","cve":"CVE-2025-1437","title":"Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2025.2","to_inclusive":true,"patched_in":"2025.3"}],"published":"2025-03-25T00:00:00Z","updated":"2025-08-07T05:24:28Z"},{"id":"wordfence:676c8ed5-5a59-413f-af7a-49d6927cd9b1","source":"wordfence","cve":"CVE-2024-32086","title":"Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676c8ed5-5a59-413f-af7a-49d6927cd9b1?source=api-prod","affected":[{"type":"plugin","slug":"citadela-directory","name":"Citadela Directory","from":"*","from_inclusive":true,"to":"5.18.1","to_inclusive":true,"patched_in":"5.19.1"}],"published":"2024-04-11T00:00:00Z","updated":"2026-02-26T14:55:26Z"},{"id":"wordfence:676cb664-dd9d-4b6e-80d6-c2afb2298541","source":"wordfence","cve":"","title":"ClickSold IDX < 1.49 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676cb664-dd9d-4b6e-80d6-c2afb2298541?source=api-prod","affected":[{"type":"plugin","slug":"clicksold-wordpress-plugin","name":"ClickSold IDX","from":"*","from_inclusive":true,"to":"1.48","to_inclusive":true,"patched_in":"1.49"}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:676d4cac-9df7-4aaa-9aca-a23a46974019","source":"wordfence","cve":"CVE-2025-46448","title":"Document Management System <= 1.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676d4cac-9df7-4aaa-9aca-a23a46974019?source=api-prod","affected":[{"type":"plugin","slug":"dms","name":"Document Management System","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:02:15Z"},{"id":"wordfence:676e563e-b89d-465c-912f-336a2157551a","source":"wordfence","cve":"CVE-2026-116551","title":"WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/676e563e-b89d-465c-912f-336a2157551a?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":"8.4.1"}],"published":"2026-11-05T22:07:51Z","updated":"2026-11-06T11:17:36Z"},{"id":"wordfence:677004db-d8ac-410c-89d9-ee841d643ef7","source":"wordfence","cve":"CVE-2026-85198","title":"MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/677004db-d8ac-410c-89d9-ee841d643ef7?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-09-11T18:53:30Z","updated":"2026-09-12T07:39:15Z"},{"id":"wordfence:67709117-8912-4c09-afcb-0c07345d00e0","source":"wordfence","cve":"CVE-2024-13599","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67709117-8912-4c09-afcb-0c07345d00e0?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.5","to_inclusive":true,"patched_in":"4.2.7.5.1"}],"published":"2025-01-24T19:05:51Z","updated":"2025-01-25T07:24:15Z"},{"id":"wordfence:67768957-45be-48d9-ad5e-147290ef4cd5","source":"wordfence","cve":"CVE-2024-11763","title":"Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67768957-45be-48d9-ad5e-147290ef4cd5?source=api-prod","affected":[{"type":"plugin","slug":"plezi","name":"Plezi","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-21T16:20:45Z"},{"id":"wordfence:6776b586-95c9-4e67-b7a3-a016e75d77d1","source":"wordfence","cve":"CVE-2024-37216","title":"Sketchfab Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6776b586-95c9-4e67-b7a3-a016e75d77d1?source=api-prod","affected":[{"type":"plugin","slug":"sketchfab-oembed","name":"Sketchfab Embed","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:47:35Z"},{"id":"wordfence:6778d6ad-951f-4002-9999-9bfa08bc925f","source":"wordfence","cve":"CVE-2025-28923","title":"No Disposable Email <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6778d6ad-951f-4002-9999-9bfa08bc925f?source=api-prod","affected":[{"type":"plugin","slug":"no-disposable-email","name":"No Disposable Email","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:26:04Z"},{"id":"wordfence:67790c0b-c078-4955-a175-977a695392fc","source":"wordfence","cve":"CVE-2024-2092","title":"Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67790c0b-c078-4955-a175-977a695392fc?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2024-06-11T20:53:36Z","updated":"2024-06-12T09:33:12Z"},{"id":"wordfence:677a9713-e7c6-477d-9ba9-8b0e2bdb2c6d","source":"wordfence","cve":"CVE-2026-14559","title":"Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/677a9713-e7c6-477d-9ba9-8b0e2bdb2c6d?source=api-prod","affected":[{"type":"plugin","slug":"teddy-bear-customize-addon","name":"Teddy Bear Customize Addon","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:25:46Z"},{"id":"wordfence:67817d5a-2d7a-4b96-9c04-cd1ad9c90b29","source":"wordfence","cve":"CVE-2023-5957","title":"Ni Purchase Order(PO) For WooCommerce <= 1.2.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"low","cvss":3.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67817d5a-2d7a-4b96-9c04-cd1ad9c90b29?source=api-prod","affected":[{"type":"plugin","slug":"ni-purchase-orderpo-for-woocommerce","name":"Ni Purchase Order(PO) For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-09-26T00:00:00Z","updated":"2024-05-31T16:03:01Z"},{"id":"wordfence:6781b4ac-82da-40d5-9a43-7a2c0e7ff23a","source":"wordfence","cve":"CVE-2026-19719","title":"Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6781b4ac-82da-40d5-9a43-7a2c0e7ff23a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:24:52Z"},{"id":"wordfence:6781b7b7-c11a-4328-8d14-ffafc2ccb127","source":"wordfence","cve":"CVE-2022-4211","title":"Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via emailf","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6781b7b7-c11a-4328-8d14-ffafc2ccb127?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.2.1"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6781c76b-bfcb-43b3-8275-5b4c2aa1fe07","source":"wordfence","cve":"CVE-2017-18606","title":"Avada <= 5.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6781c76b-bfcb-43b3-8275-5b4c2aa1fe07?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":false,"patched_in":"5.1.5"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6781dcc5-db95-43ca-9042-a3c05414b7e6","source":"wordfence","cve":"CVE-2025-12540","title":"ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure","severity":"medium","cvss":4.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6781dcc5-db95-43ca-9042-a3c05414b7e6?source=api-prod","affected":[{"type":"plugin","slug":"googleanalytics","name":"ShareThis Dashboard for Google Analytics","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:59:17Z","updated":"2026-04-25T15:57:44Z"},{"id":"wordfence:6782d8b3-32f9-42e1-874c-35a1e93ffde0","source":"wordfence","cve":"CVE-2023-4315","title":"Woo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_edit","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6782d8b3-32f9-42e1-874c-35a1e93ffde0?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-emails","name":"Woo Custom Emails","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6783c8a4-01a8-45be-97c5-7c8e0c9ac58d","source":"wordfence","cve":"CVE-2026-102499","title":"Modern Events Calendar < 7.37.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6783c8a4-01a8-45be-97c5-7c8e0c9ac58d?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.37.0","to_inclusive":false,"patched_in":"7.37.0"},{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.37.0","to_inclusive":false,"patched_in":"7.37.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T15:23:58Z"},{"id":"wordfence:67856d6b-9be9-494a-b713-f36d5e29e7f1","source":"wordfence","cve":"CVE-2024-33631","title":"Piotnet Addons For Elementor Pro <= 7.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67856d6b-9be9-494a-b713-f36d5e29e7f1?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:42:28Z"},{"id":"wordfence:6785be1c-85d4-48f1-be15-275c71284b3e","source":"wordfence","cve":"CVE-2022-46866","title":"Import External Images <= 1.4 - Cross-Site Request Forgery via external_image_import_all_ajax","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6785be1c-85d4-48f1-be15-275c71284b3e?source=api-prod","affected":[{"type":"plugin","slug":"import-external-images","name":"Import External Images","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:678608e0-2c13-4eb6-8d87-82e74c936225","source":"wordfence","cve":"CVE-2026-15046","title":"LitExtension \u2013 Automated Store Migration & Import <= 1.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/678608e0-2c13-4eb6-8d87-82e74c936225?source=api-prod","affected":[{"type":"plugin","slug":"litextension-data-migration-to-woocommerce","name":"LitExtension \u2013 Automated Store Migration & Import","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T15:52:49Z"},{"id":"wordfence:6786dba1-34cf-467e-9437-d3fadeb020c6","source":"wordfence","cve":"CVE-2025-63032","title":"Consulting <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6786dba1-34cf-467e-9437-d3fadeb020c6?source=api-prod","affected":[{"type":"theme","slug":"consulting","name":"Consulting","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:40:34Z"},{"id":"wordfence:67877a2e-a45d-4674-b749-05d9217ef6bf","source":"wordfence","cve":"CVE-2026-6452","title":"Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67877a2e-a45d-4674-b749-05d9217ef6bf?source=api-prod","affected":[{"type":"plugin","slug":"bigfishgames-syndicate","name":"Bigfishgames Syndicate","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:05:23Z","updated":"2026-05-20T01:25:49Z"},{"id":"wordfence:6788b92c-8a2c-4ebb-85ca-eb1fd0f3b0e0","source":"wordfence","cve":"CVE-2024-3899","title":"Gallery Plugin for WordPress \u2013 Envira Photo Gallery <= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6788b92c-8a2c-4ebb-85ca-eb1fd0f3b0e0?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2024-08-20T00:00:00Z","updated":"2024-09-20T18:40:48Z"},{"id":"wordfence:6788e2ee-ce61-494b-8d7f-6d1144466e58","source":"wordfence","cve":"CVE-2024-1479","title":"WP Show Posts <= 1.1.4 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6788e2ee-ce61-494b-8d7f-6d1144466e58?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-posts","name":"WP Show Posts","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-13T15:26:54Z"},{"id":"wordfence:67890f13-df93-4c1d-aabe-a90437183bbd","source":"wordfence","cve":"CVE-2025-53209","title":"Masteriyo LMS PRO <= 2.20.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67890f13-df93-4c1d-aabe-a90437183bbd?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system-pro","name":"Masteriyo LMS PRO","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":"2.20.1"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:51:12Z"},{"id":"wordfence:67910b99-6024-4b24-9c55-4b1cb0ddfa45","source":"wordfence","cve":"CVE-2026-74012","title":"Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67910b99-6024-4b24-9c55-4b1cb0ddfa45?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.51.0","to_inclusive":true,"patched_in":"3.52.0"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:56Z"},{"id":"wordfence:67953bf3-5465-4f25-874c-46dff59b2199","source":"wordfence","cve":"CVE-2022-0446","title":"Simple Banner <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67953bf3-5465-4f25-874c-46dff59b2199?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67965a51-39d3-4d14-adf5-d91d4c775baf","source":"wordfence","cve":"CVE-2024-13412","title":"CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67965a51-39d3-4d14-adf5-d91d4c775baf?source=api-prod","affected":[{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T06:57:41Z"},{"id":"wordfence:67981160-6c91-48a4-ba1c-68204d538ed6","source":"wordfence","cve":"CVE-2024-3343","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67981160-6c91-48a4-ba1c-68204d538ed6?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-11T11:03:51Z"},{"id":"wordfence:679da7c0-98b9-4da0-bf1f-5c991e8a8111","source":"wordfence","cve":"CVE-2024-38774","title":"Security Optimizer \u2013 The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/679da7c0-98b9-4da0-bf1f-5c991e8a8111?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T13:58:30Z"},{"id":"wordfence:679e8532-e8ec-4662-b2e5-590e46f231e3","source":"wordfence","cve":"CVE-2025-58939","title":"Super Store Finder <= 7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/679e8532-e8ec-4662-b2e5-590e46f231e3?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-11-04T15:24:28Z"},{"id":"wordfence:67a44d4c-da3f-4c3d-997b-1417c6906a9c","source":"wordfence","cve":"CVE-2024-2027","title":"Real Media Library: Media Library Folder & File Manager <= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67a44d4c-da3f-4c3d-997b-1417c6906a9c?source=api-prod","affected":[{"type":"plugin","slug":"real-media-library-lite","name":"Real Media Library: Media Library Folder & File Manager","from":"*","from_inclusive":true,"to":"4.22.7","to_inclusive":true,"patched_in":"4.22.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:58:52Z"},{"id":"wordfence:67a45428-fe3a-42cf-b081-2e04415611b1","source":"wordfence","cve":"CVE-2025-39437","title":"Anthologize <= 0.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67a45428-fe3a-42cf-b081-2e04415611b1?source=api-prod","affected":[{"type":"plugin","slug":"anthologize","name":"Anthologize","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:33:18Z"},{"id":"wordfence:67a4fbd1-0a1c-4f07-9608-682131ccbc4f","source":"wordfence","cve":"CVE-2025-68976","title":"Eagle Booking <= 1.3.4.3 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67a4fbd1-0a1c-4f07-9608-682131ccbc4f?source=api-prod","affected":[{"type":"plugin","slug":"eagle-booking","name":"Eagle Booking","from":"*","from_inclusive":true,"to":"1.3.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-18T00:00:00Z","updated":"2026-01-06T14:58:24Z"},{"id":"wordfence:67aa489c-5c54-4163-bc32-5d3ac9ba4e33","source":"wordfence","cve":"CVE-2021-24627","title":"G Auto-Hyperlink <= 1.0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67aa489c-5c54-4163-bc32-5d3ac9ba4e33?source=api-prod","affected":[{"type":"plugin","slug":"g-auto-hyperlink","name":"G Auto-Hyperlink","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67aaf9fa-e92b-42f2-94ac-f27c5d073002","source":"wordfence","cve":"CVE-2023-33320","title":"WP-Hijri <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67aaf9fa-e92b-42f2-94ac-f27c5d073002?source=api-prod","affected":[{"type":"plugin","slug":"wp-hijri","name":"WP-Hijri","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67abab41-7671-409d-bebc-353456bf65ab","source":"wordfence","cve":"CVE-2025-24577","title":"Poll Maker <= 5.5.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67abab41-7671-409d-bebc-353456bf65ab?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2024-12-15T00:00:00Z","updated":"2025-04-22T21:31:41Z"},{"id":"wordfence:67ac5336-7504-4a54-aeb3-1b4c96a1d456","source":"wordfence","cve":"CVE-2025-69121","title":"Deliciosa <= 1.10.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ac5336-7504-4a54-aeb3-1b4c96a1d456?source=api-prod","affected":[{"type":"theme","slug":"deliciosa","name":"Deliciosa","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:33:05Z"},{"id":"wordfence:67acf726-bf56-472e-aa7c-316bcd8a56fb","source":"wordfence","cve":"CVE-2025-48152","title":"Rentsyst <= 2.0.100 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67acf726-bf56-472e-aa7c-316bcd8a56fb?source=api-prod","affected":[{"type":"plugin","slug":"rentsyst","name":"RentSyst \u2013 CRM solution for fleet management","from":"*","from_inclusive":true,"to":"2.0.100","to_inclusive":true,"patched_in":"2.0.101"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:39:48Z"},{"id":"wordfence:67ad04d4-49ef-4bc4-b3b0-f2752566145e","source":"wordfence","cve":"CVE-2019-25215","title":"ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f2752566145e?source=api-prod","affected":[{"type":"plugin","slug":"ari-adminer","name":"ARI Adminer \u2013 WordPress Database Manager","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2019-04-08T00:00:00Z","updated":"2024-10-16T06:43:34Z"},{"id":"wordfence:67ae29ee-ec3d-41d2-8691-ba1c615d243d","source":"wordfence","cve":"","title":"Meow Gallery (+ Gallery Block) <= 4.1.9 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ae29ee-ec3d-41d2-8691-ba1c615d243d?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2021-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67aee1ec-44af-4904-8a9b-ecfbb8d3b302","source":"wordfence","cve":"CVE-2021-24774","title":"Check & Log Email <= 1.0.2 - Admin+ SQL Injection via Order and OrderBy parameters","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67aee1ec-44af-4904-8a9b-ecfbb8d3b302?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67afe49c-3560-414b-b848-b91a03bf7556","source":"wordfence","cve":"CVE-2025-7658","title":"Temporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67afe49c-3560-414b-b848-b91a03bf7556?source=api-prod","affected":[{"type":"plugin","slug":"temporarily-hidden-content","name":"Temporarily Hidden Content","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T14:11:09Z","updated":"2025-07-19T02:22:58Z"},{"id":"wordfence:67b0ddc6-9381-4b18-b623-372a149ffa49","source":"wordfence","cve":"CVE-2022-0780","title":"SearchIQ \u2013 The Search Solution <= 3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b0ddc6-9381-4b18-b623-372a149ffa49?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67b0f756-9130-402d-9787-78d482fa183e","source":"wordfence","cve":"CVE-2025-7440","title":"Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b0f756-9130-402d-9787-78d482fa183e?source=api-prod","affected":[{"type":"plugin","slug":"anber-elementor-addon","name":"Anber Elementor Addon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:48:44Z","updated":"2025-08-16T03:38:49Z"},{"id":"wordfence:67b14116-8708-401c-a037-4976a360256a","source":"wordfence","cve":"CVE-2022-47145","title":"WordPress Bitcoin Payments \u2013 Blockonomics <= 3.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b14116-8708-401c-a037-4976a360256a?source=api-prod","affected":[{"type":"plugin","slug":"blockonomics-bitcoin-payments","name":"Bitcoin Payments \u2013 Blockonomics","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67b152b5-e662-4dbd-a7db-87fc63cfb307","source":"wordfence","cve":"","title":"Top Quark Architecture Plugin < 2.1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b152b5-e662-4dbd-a7db-87fc63cfb307?source=api-prod","affected":[{"type":"plugin","slug":"topquark","name":"Top Quark Architecture","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2012-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67b15479-172d-456b-a8f2-57b71134664d","source":"wordfence","cve":"CVE-2026-84898","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b15479-172d-456b-a8f2-57b71134664d?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.21","to_inclusive":false,"patched_in":"4.1.21"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:19:52Z"},{"id":"wordfence:67b36ed7-d7f4-4944-b721-219d1990971a","source":"wordfence","cve":"CVE-2024-43223","title":"EventPrime <= 4.0.3.2 - Missing Authorization via calendar_event_create()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b36ed7-d7f4-4944-b721-219d1990971a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.3.2","to_inclusive":true,"patched_in":"4.0.4.0"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:00:46Z"},{"id":"wordfence:67b450fb-eb36-4d46-aea9-a6bf624203c5","source":"wordfence","cve":"CVE-2025-53465","title":"GSheets Connector <= 1.1.1 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b450fb-eb36-4d46-aea9-a6bf624203c5?source=api-prod","affected":[{"type":"plugin","slug":"sheetlink","name":"GSheets Connector","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:46:11Z"},{"id":"wordfence:67b468f7-21c7-424a-a65c-172ef47f0465","source":"wordfence","cve":"CVE-2022-21670","title":"markdown-it < 1.3.2 - Uncontrolled Resource Consumption","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b468f7-21c7-424a-a65c-172ef47f0465?source=api-prod","affected":[{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"1.0.3","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67b5d20b-4032-4d41-8ab7-6063b7e47827","source":"wordfence","cve":"CVE-2021-24785","title":"Great Quotes <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b5d20b-4032-4d41-8ab7-6063b7e47827?source=api-prod","affected":[{"type":"plugin","slug":"great-quotes","name":"Great Quotes","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67b7c2b5-c8ef-4659-b9e8-4c695bb76bff","source":"wordfence","cve":"CVE-2026-25427","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b7c2b5-c8ef-4659-b9e8-4c695bb76bff?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-28T21:11:34Z"},{"id":"wordfence:67b82539-8582-4bb4-ad4c-b626233b6075","source":"wordfence","cve":"CVE-2026-103883","title":"6Storage Rentals <= 2.31.0 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoning + Transient-Backed Auth Bypass","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b82539-8582-4bb4-ad4c-b626233b6075?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.31.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T21:44:52Z","updated":"2026-11-11T11:31:07Z"},{"id":"wordfence:67bacd52-9d23-4222-a8a7-ae98f66c752a","source":"wordfence","cve":"CVE-2026-39521","title":"Nelio Content <= 4.3.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67bacd52-9d23-4222-a8a7-ae98f66c752a?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-03-19T00:00:00Z","updated":"2026-05-05T15:00:24Z"},{"id":"wordfence:67c15451-672d-4297-9d19-090a4458605f","source":"wordfence","cve":"CVE-2025-14973","title":"Recipe Card Blocks for Gutenberg & Elementor < 3.4.13 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c15451-672d-4297-9d19-090a4458605f?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.4.13","to_inclusive":false,"patched_in":"3.4.13"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-27T19:02:43Z"},{"id":"wordfence:67c2cac8-c3cf-46d1-a592-229081bc31e1","source":"wordfence","cve":"CVE-2023-27611","title":"Reusable Blocks Extended <= 0.9 - Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c2cac8-c3cf-46d1-a592-229081bc31e1?source=api-prod","affected":[{"type":"plugin","slug":"reusable-blocks-extended","name":"Reusable Blocks Extended","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":"0.9.1"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67c4066f-b8bc-4cd0-ae47-844af23e003f","source":"wordfence","cve":"CVE-2024-11951","title":"Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=api-prod","affected":[{"type":"plugin","slug":"homey-login-register","name":"Homey Login Register","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:24:00Z","updated":"2025-03-05T11:22:10Z"},{"id":"wordfence:67c495dd-ccff-49ff-91cd-40dd66696401","source":"wordfence","cve":"CVE-2025-60141","title":"The Tribal <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c495dd-ccff-49ff-91cd-40dd66696401?source=api-prod","affected":[{"type":"plugin","slug":"the-tech-tribe","name":"The Tribal Plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:00:56Z"},{"id":"wordfence:67c7b9b2-e73f-47fe-aecc-14e998a607c8","source":"wordfence","cve":"CVE-2026-3658","title":"Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c7b9b2-e73f-47fe-aecc-14e998a607c8?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.10.0","to_inclusive":true,"patched_in":"1.6.10.2"}],"published":"2026-03-18T22:37:27Z","updated":"2026-03-19T11:15:33Z"},{"id":"wordfence:67c7e67e-3e68-4f49-9d81-fa0ed451376e","source":"wordfence","cve":"CVE-2015-9351","title":"Feed Them Social <= 1.6.9 - Arbitrary Shortcode Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c7e67e-3e68-4f49-9d81-fa0ed451376e?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67c86b04-fdbd-4782-a362-fdec5e1f7c92","source":"wordfence","cve":"CVE-2021-24173","title":"VM Backups <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c86b04-fdbd-4782-a362-fdec5e1f7c92?source=api-prod","affected":[{"type":"plugin","slug":"vm-backups","name":"VM Backups","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67ca3305-9a04-421f-a38e-66b69d2bbd38","source":"wordfence","cve":"CVE-2022-2356","title":"Frontend File Manager & Sharing \u2013 User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ca3305-9a04-421f-a38e-66b69d2bbd38?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67cab267-f776-4519-a882-4c6bdce65e1b","source":"wordfence","cve":"CVE-2025-23570","title":"WP Social Links <= 0.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67cab267-f776-4519-a882-4c6bdce65e1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-links","name":"WP Social Links","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-11T14:08:53Z"},{"id":"wordfence:67cb10e4-5d42-464b-a24f-66811a5d0991","source":"wordfence","cve":"CVE-2024-32703","title":"ARForms <= 6.4 - Missing Authorization to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67cb10e4-5d42-464b-a24f-66811a5d0991?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:07:44Z"},{"id":"wordfence:67d112e1-72d3-4ac9-93ca-82a7410cfbbb","source":"wordfence","cve":"CVE-2025-58240","title":"xili-tidy-tags <= 1.12.06 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67d112e1-72d3-4ac9-93ca-82a7410cfbbb?source=api-prod","affected":[{"type":"plugin","slug":"xili-tidy-tags","name":"xili-tidy-tags","from":"*","from_inclusive":true,"to":"1.12.06","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:37:14Z"},{"id":"wordfence:67d2364c-6c8b-4b30-8a0e-2f9ee94a3c26","source":"wordfence","cve":"CVE-2022-45376","title":"Side Cart Woocommerce (Ajax) < 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67d2364c-6c8b-4b30-8a0e-2f9ee94a3c26?source=api-prod","affected":[{"type":"plugin","slug":"side-cart-woocommerce","name":"Side Cart Woocommerce | Woocommerce Cart","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67d2e1c7-dbd3-4195-8bdb-3b85b25bfa52","source":"wordfence","cve":"CVE-2024-9377","title":"Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67d2e1c7-dbd3-4195-8bdb-3b85b25bfa52?source=api-prod","affected":[{"type":"plugin","slug":"export-woocommerce","name":"Export Products, Orders & Customers for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:09Z"},{"id":"wordfence:67d3c280-507d-4e53-81c4-621fce05b386","source":"wordfence","cve":"CVE-2025-28998","title":"SERPed.net <= 4.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67d3c280-507d-4e53-81c4-621fce05b386?source=api-prod","affected":[{"type":"plugin","slug":"serped-net","name":"SERPed.net","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-03T12:17:05Z"},{"id":"wordfence:67d8dc60-e66e-4f2f-a06d-f95375ca1994","source":"wordfence","cve":"CVE-2025-69129","title":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67d8dc60-e66e-4f2f-a06d-f95375ca1994?source=api-prod","affected":[{"type":"plugin","slug":"wp_scraper","name":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:07:45Z"},{"id":"wordfence:67db430e-d796-4ace-b5d1-de492edb8ea8","source":"wordfence","cve":"CVE-2024-13234","title":"Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67db430e-d796-4ace-b5d1-de492edb8ea8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-tables","name":"Product Table for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-23T11:13:29Z"},{"id":"wordfence:67dbaf4d-c54c-43ea-8725-3455a4c84e16","source":"wordfence","cve":"CVE-2025-62043","title":"WPCasa <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67dbaf4d-c54c-43ea-8725-3455a4c84e16?source=api-prod","affected":[{"type":"plugin","slug":"wpcasa","name":"WPCasa \u2013 Real Estate for WordPress","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:50:32Z"},{"id":"wordfence:67ddca02-2e92-4aea-ada9-ace0df29c775","source":"wordfence","cve":"CVE-2022-2544","title":"Ninja Job Board <= 1.3.2 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ddca02-2e92-4aea-ada9-ace0df29c775?source=api-prod","affected":[{"type":"plugin","slug":"ninja-job-board","name":"Ninja Job Board","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67df10cc-ce3c-4157-9860-7e367062f710","source":"wordfence","cve":"CVE-2024-12252","title":"SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67df10cc-ce3c-4157-9860-7e367062f710?source=api-prod","affected":[{"type":"plugin","slug":"seo-beginner-auto-post","name":"SEO LAT Auto Post","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:43:05Z","updated":"2025-01-07T04:22:02Z"},{"id":"wordfence:67df5620-8bd2-4aa5-a6f0-20cb302409fa","source":"wordfence","cve":"CVE-2026-16258","title":"Ajax Search Lite <= 4.14.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67df5620-8bd2-4aa5-a6f0-20cb302409fa?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.14.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:37:13Z"},{"id":"wordfence:67e0e59d-879c-434f-9ffb-1b97d8105bfa","source":"wordfence","cve":"CVE-2021-24590","title":"Cookie Notice & Consent Banner for GDPR & CCPA Compliance <= 1.7.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e0e59d-879c-434f-9ffb-1b97d8105bfa?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-and-consent-banner","name":"Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67e0f32c-7556-4568-b651-6a9d43e48566","source":"wordfence","cve":"CVE-2025-23757","title":"ZD Scribd iPaper <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e0f32c-7556-4568-b651-6a9d43e48566?source=api-prod","affected":[{"type":"plugin","slug":"zd-scribd-ipaper","name":"ZD Scribd iPaper","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:18:05Z"},{"id":"wordfence:67e1f412-3b3d-4b36-b4ff-557c4790362a","source":"wordfence","cve":"CVE-2016-1000131","title":"E Search <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e1f412-3b3d-4b36-b4ff-557c4790362a?source=api-prod","affected":[{"type":"plugin","slug":"e-search","name":"E-Search","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67e2636a-1a5d-4526-aace-b276faf321a7","source":"wordfence","cve":"CVE-2018-18460","title":"WP Live Chat Support <= 8.0.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e2636a-1a5d-4526-aace-b276faf321a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.15","to_inclusive":true,"patched_in":"8.0.16"}],"published":"2018-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67e3096e-7641-4f95-9e16-c1b45028c7eb","source":"wordfence","cve":"","title":"eCommerce Product Catalog Plugin for WordPress <= 3.0.70 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e3096e-7641-4f95-9e16-c1b45028c7eb?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.70","to_inclusive":true,"patched_in":"3.0.71"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67e3b25e-176f-4a0d-a10d-678ea772ce3c","source":"wordfence","cve":"CVE-2022-36405","title":"amCharts: Charts and Maps <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e3b25e-176f-4a0d-a10d-678ea772ce3c?source=api-prod","affected":[{"type":"plugin","slug":"amcharts-charts-and-maps","name":"amCharts: Charts and Maps","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67e45e8d-c0f1-42c1-9b51-4c1cadea8e48","source":"wordfence","cve":"CVE-2025-47565","title":"EventON <= 4.9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e45e8d-c0f1-42c1-9b51-4c1cadea8e48?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T18:59:13Z"},{"id":"wordfence:67e7f95f-3c48-4a20-ba7f-e88fa565b451","source":"wordfence","cve":"CVE-2026-65495","title":"Dokan Pro <= 5.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e7f95f-3c48-4a20-ba7f-e88fa565b451?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:30:05Z"},{"id":"wordfence:67e86c46-36f7-4aef-ab7b-33a2dd7e40d5","source":"wordfence","cve":"CVE-2025-23705","title":"Zielke Design Project Gallery <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e86c46-36f7-4aef-ab7b-33a2dd7e40d5?source=api-prod","affected":[{"type":"plugin","slug":"zielke-design-project-gallery","name":"Zielke Design Project Gallery","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:38:38Z"},{"id":"wordfence:67e9bfb8-b274-422a-a50d-a6b6b24bb193","source":"wordfence","cve":"CVE-2026-104755","title":"WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint","severity":"medium","cvss":4.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.25.00","to_inclusive":true,"patched_in":"7.26.00"}],"published":"2026-10-15T17:35:06Z","updated":"2026-10-16T06:41:05Z"},{"id":"wordfence:67eb25d7-8412-437c-942b-e003f8f0a187","source":"wordfence","cve":"CVE-2025-48151","title":"CM Map Locations <= 2.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67eb25d7-8412-437c-942b-e003f8f0a187?source=api-prod","affected":[{"type":"plugin","slug":"cm-map-locations","name":"CM Map Locations \u2013 Visualize and share your locations in a few clicks","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-28T21:00:32Z"},{"id":"wordfence:67eb77e9-7e0b-4134-9cb6-30ba78f6a686","source":"wordfence","cve":"CVE-2024-9657","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67eb77e9-7e0b-4134-9cb6-30ba78f6a686?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":true,"patched_in":"5.10.3"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-05T11:32:21Z"},{"id":"wordfence:67eef869-a57f-40b5-b289-9353bf5b680a","source":"wordfence","cve":"CVE-2024-7390","title":"WP Testimonial Widget <= 3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67eef869-a57f-40b5-b289-9353bf5b680a?source=api-prod","affected":[{"type":"plugin","slug":"wp-testimonial-widget","name":"WP Testimonial Widget","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:22:38Z","updated":"2024-09-20T22:26:08Z"},{"id":"wordfence:67f143a4-2467-48cf-8024-8529ef4ed449","source":"wordfence","cve":"CVE-2022-2261","title":"WPIDE \u2013 File Manager & Code Editor <= 2.6 - Authenticated (Admininstrator+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f143a4-2467-48cf-8024-8529ef4ed449?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2022-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67f23705-ee04-40a7-a4d9-3bf654a2cb12","source":"wordfence","cve":"CVE-2026-25472","title":"Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f23705-ee04-40a7-a4d9-3bf654a2cb12?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2026-01-15T00:00:00Z","updated":"2026-05-04T15:49:33Z"},{"id":"wordfence:67f405d0-7139-4b5c-ab3c-cd1de5592866","source":"wordfence","cve":"CVE-2024-1582","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f405d0-7139-4b5c-ab3c-cd1de5592866?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.32","to_inclusive":true,"patched_in":"9.0.33"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T01:57:29Z"},{"id":"wordfence:67f722c6-71a5-472e-ae34-bdd9d93b74cc","source":"wordfence","cve":"CVE-2026-84168","title":"Easy Hide Login <= 1.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f722c6-71a5-472e-ae34-bdd9d93b74cc?source=api-prod","affected":[{"type":"plugin","slug":"easy-hide-login","name":"Easy Hide Login","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:35:59Z"},{"id":"wordfence:67f81b8a-ef0a-4b6d-a1ee-3e19bda6fd96","source":"wordfence","cve":"CVE-2022-4384","title":"Stream <= 3.9.1 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f81b8a-ef0a-4b6d-a1ee-3e19bda6fd96?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2023-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67f9cce0-3ddb-48df-9d02-0c0d0105099e","source":"wordfence","cve":"CVE-2025-63071","title":"Shortcodes and extra features for Phlox <= 2.17.13 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f9cce0-3ddb-48df-9d02-0c0d0105099e?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.13","to_inclusive":true,"patched_in":"2.17.14"}],"published":"2025-10-26T00:00:00Z","updated":"2026-07-08T20:45:51Z"},{"id":"wordfence:67f9f44b-badc-48d5-b1d9-11cd6501fa9b","source":"wordfence","cve":"CVE-2019-17233","title":"Ultimate FAQ <= 1.8.24 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67f9f44b-badc-48d5-b1d9-11cd6501fa9b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"1.8.25","to_inclusive":false,"patched_in":"1.8.25"}],"published":"2019-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67fc4141-7875-459b-98d8-d14e0a6f566c","source":"wordfence","cve":"CVE-2024-0233","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67fc4141-7875-459b-98d8-d14e0a6f566c?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:10:07Z"},{"id":"wordfence:67fc59b6-7b6e-4dcb-b86a-c2236cb263f4","source":"wordfence","cve":"CVE-2025-23878","title":"Post-to-Post Links <= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67fc59b6-7b6e-4dcb-b86a-c2236cb263f4?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-to-post-links","name":"Post-to-Post Links","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:14:41Z"},{"id":"wordfence:67fe46cd-a6c4-4d0a-842a-f61334559731","source":"wordfence","cve":"CVE-2022-3776","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67fe46cd-a6c4-4d0a-842a-f61334559731?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:67ff1f6e-0bea-4e09-ac3d-727d13fcbfa1","source":"wordfence","cve":"CVE-2026-65463","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 2.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67ff1f6e-0bea-4e09-ac3d-727d13fcbfa1?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:12:26Z"},{"id":"wordfence:6800fec4-fd05-46d6-b179-018113308ab2","source":"wordfence","cve":"CVE-2026-25423","title":"Real 3D FlipBook <= 4.19.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6800fec4-fd05-46d6-b179-018113308ab2?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"}],"published":"2026-02-10T00:00:00Z","updated":"2026-03-17T21:33:48Z"},{"id":"wordfence:68014bb5-b2ef-4e2f-9c47-85e555ded5a7","source":"wordfence","cve":"CVE-2024-10876","title":"Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68014bb5-b2ef-4e2f-9c47-85e555ded5a7?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.3.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T06:41:30Z"},{"id":"wordfence:680219f5-631e-4318-bf1b-598947bec7d6","source":"wordfence","cve":"CVE-2024-31104","title":"GetResponse for WordPress <= 5.5.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680219f5-631e-4318-bf1b-598947bec7d6?source=api-prod","affected":[{"type":"plugin","slug":"getresponse-integration","name":"GetResponse for WordPress","from":"*","from_inclusive":true,"to":"5.5.35","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-25T18:44:48Z"},{"id":"wordfence:68023557-fc92-4cf6-96b4-405ff5a5fd5a","source":"wordfence","cve":"CVE-2026-2052","title":"Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68023557-fc92-4cf6-96b4-405ff5a5fd5a?source=api-prod","affected":[{"type":"plugin","slug":"extended-widget-options","name":"Widget Options - Extended","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"},{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T07:46:41Z"},{"id":"wordfence:68024fc9-e5b0-4d00-976f-cdf1fdc5f4f3","source":"wordfence","cve":"CVE-2026-81292","title":"Simple Payment <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68024fc9-e5b0-4d00-976f-cdf1fdc5f4f3?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:31:20Z"},{"id":"wordfence:68042314-14a4-4c9d-940c-2e2735f95d9a","source":"wordfence","cve":"CVE-2025-23472","title":"Flexo Slider <= 1.0013 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68042314-14a4-4c9d-940c-2e2735f95d9a?source=api-prod","affected":[{"type":"plugin","slug":"flexo-slider","name":"Flexo Slider","from":"*","from_inclusive":true,"to":"1.0013","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:48:42Z"},{"id":"wordfence:68042416-efa6-4814-a8d9-c74ab652c4ed","source":"wordfence","cve":"CVE-2011-3854","title":"ZenLite <= 4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68042416-efa6-4814-a8d9-c74ab652c4ed?source=api-prod","affected":[{"type":"theme","slug":"zenlite","name":"ZenLite","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68052614-204f-4237-af0e-4b8210ebd59f","source":"wordfence","cve":"CVE-2023-2986","title":"Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68052614-204f-4237-af0e-4b8210ebd59f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.15.1","to_inclusive":true,"patched_in":"5.15.2"}],"published":"2023-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6806e07b-96bf-43ad-a3ac-2105e7449e3c","source":"wordfence","cve":"CVE-2025-2578","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6806e07b-96bf-43ad-a3ac-2105e7449e3c?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2025-03-27T00:00:00Z","updated":"2025-03-28T07:33:05Z"},{"id":"wordfence:680746a3-8a72-4ec2-9f58-d744f40168ed","source":"wordfence","cve":"","title":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder < 1.2 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680746a3-8a72-4ec2-9f58-d744f40168ed?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2015-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6807689f-e78c-4098-a14b-073430d3c52b","source":"wordfence","cve":"CVE-2025-53996","title":"JetSearch <= 3.5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6807689f-e78c-4098-a14b-073430d3c52b?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.10.1","to_inclusive":true,"patched_in":"3.5.11"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:54:07Z"},{"id":"wordfence:680865ad-41f3-4c7a-889c-464b69872b72","source":"wordfence","cve":"CVE-2025-23871","title":"LSD Google Maps Embedder <= 1.1 - Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680865ad-41f3-4c7a-889c-464b69872b72?source=api-prod","affected":[{"type":"plugin","slug":"lsd-google-maps-embedder","name":"LSD Google Maps Embedder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:22:05Z"},{"id":"wordfence:68094545-0e2a-429d-95b7-bfa86eca1caa","source":"wordfence","cve":"CVE-2024-8959","title":"WP Adminify \u2013 Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68094545-0e2a-429d-95b7-bfa86eca1caa?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"4.0.1.6","to_inclusive":true,"patched_in":"4.0.1.7"}],"published":"2024-10-23T23:12:36Z","updated":"2024-10-24T11:34:08Z"},{"id":"wordfence:680b2194-0c5e-4d5c-86d8-4c1e8de378d7","source":"wordfence","cve":"CVE-2022-0327","title":"Master Addons for Elementor <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680b2194-0c5e-4d5c-86d8-4c1e8de378d7?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:680c65c4-a7db-4834-abb0-290da33bfb18","source":"wordfence","cve":"CVE-2024-50441","title":"Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680c65c4-a7db-4834-abb0-290da33bfb18?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:22:58Z"},{"id":"wordfence:680f1ce3-43ca-4325-9601-f5df4f7e5d31","source":"wordfence","cve":"CVE-2026-81651","title":"NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/680f1ce3-43ca-4325-9601-f5df4f7e5d31?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:30:51Z"},{"id":"wordfence:68110321-db1a-4634-98cd-0afd3ec933b8","source":"wordfence","cve":"CVE-2023-0291","title":"Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68110321-db1a-4634-98cd-0afd3ec933b8?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":true,"patched_in":"8.0.9"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6811abba-69a6-49c9-87e6-178b6788890d","source":"wordfence","cve":"CVE-2026-7859","title":"Motors \u2013 Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6811abba-69a6-49c9-87e6-178b6788890d?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.110","to_inclusive":false,"patched_in":"1.4.110"}],"published":"2026-06-22T00:00:00Z","updated":"2026-06-23T15:47:43Z"},{"id":"wordfence:68141f7e-9a87-4455-bd9f-e57277d4efa7","source":"wordfence","cve":"CVE-2026-16564","title":"Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68141f7e-9a87-4455-bd9f-e57277d4efa7?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:40:48Z"},{"id":"wordfence:681e91a8-af2b-4b54-80a8-5886d681fc94","source":"wordfence","cve":"CVE-2025-67942","title":"Peach Payments Gateway <= 3.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/681e91a8-af2b-4b54-80a8-5886d681fc94?source=api-prod","affected":[{"type":"plugin","slug":"wc-peach-payments-gateway","name":"Peach Payments Gateway","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T20:23:01Z"},{"id":"wordfence:681fd20b-6d89-4434-bf38-ccd2fa33a912","source":"wordfence","cve":"CVE-2024-35661","title":"Upload Fields for WPForms <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/681fd20b-6d89-4434-bf38-ccd2fa33a912?source=api-prod","affected":[{"type":"plugin","slug":"upload-fields-for-wpforms","name":"Upload Fields for WPForms \u2013 Drag and Drop Multiple File Upload, Image Upload, and Google Drive Upload for WPForms","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:42:33Z"},{"id":"wordfence:68250b6c-22c8-494f-b0b0-62b80cc4de0c","source":"wordfence","cve":"CVE-2024-11429","title":"Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews \u2013 Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68250b6c-22c8-494f-b0b0-62b80cc4de0c?source=api-prod","affected":[{"type":"plugin","slug":"stars-testimonials-with-slider-and-masonry-grid","name":"Stars Testimonials \u2014 Responsive Reviews & Star Ratings","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-12-04T16:25:19Z","updated":"2024-12-05T05:26:12Z"},{"id":"wordfence:68251e79-d064-4be4-a218-92a03e27b59d","source":"wordfence","cve":"CVE-2025-12088","title":"Meta Display Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68251e79-d064-4be4-a218-92a03e27b59d?source=api-prod","affected":[{"type":"plugin","slug":"meta-display-block","name":"Meta Display Block","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-11-17T20:49:24Z","updated":"2026-09-18T19:55:06Z"},{"id":"wordfence:68263c7d-6da0-46b2-bb78-45acf615359d","source":"wordfence","cve":"CVE-2014-10378","title":"Yoast Duplicate Post <= 2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68263c7d-6da0-46b2-bb78-45acf615359d?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post","name":"Yoast Duplicate Post","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68277e73-9ef8-42b9-8f21-8b3a9cd0cb95","source":"wordfence","cve":"CVE-2025-31567","title":"Themesflat Addons For Elementor <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68277e73-9ef8-42b9-8f21-8b3a9cd0cb95?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-03-31T00:00:00Z","updated":"2025-12-19T15:16:16Z"},{"id":"wordfence:6827dc47-669c-41de-8716-7932ce8e5259","source":"wordfence","cve":"CVE-2024-54214","title":"Revy <= 1.18 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6827dc47-669c-41de-8716-7932ce8e5259?source=api-prod","affected":[{"type":"plugin","slug":"revy","name":"Revy","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:44:07Z"},{"id":"wordfence:682a7439-d10a-48b7-84c5-60ac00cf7879","source":"wordfence","cve":"CVE-2024-37486","title":"Paid Memberships Pro <= 3.0.5 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682a7439-d10a-48b7-84c5-60ac00cf7879?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:30:20Z"},{"id":"wordfence:682b40ad-ca62-47eb-9abc-fd43122d11c8","source":"wordfence","cve":"CVE-2017-16955","title":"InLinks <= 1.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682b40ad-ca62-47eb-9abc-fd43122d11c8?source=api-prod","affected":[{"type":"plugin","slug":"inlinks","name":"inlinks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2017-11-22T00:00:00Z","updated":"2024-08-15T18:15:47Z"},{"id":"wordfence:682c7d46-560c-44b8-9c9f-96ef31440ab6","source":"wordfence","cve":"CVE-2026-89271","title":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress <= 4.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682c7d46-560c-44b8-9c9f-96ef31440ab6?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-03T19:35:20Z"},{"id":"wordfence:682e84f8-8dc4-4998-801c-8a58156c5b5b","source":"wordfence","cve":"CVE-2026-12501","title":"Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682e84f8-8dc4-4998-801c-8a58156c5b5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.8.2"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-17T15:59:41Z"},{"id":"wordfence:682ec57a-f67c-40a9-91cd-2a11159ff695","source":"wordfence","cve":"CVE-2025-11257","title":"LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682ec57a-f67c-40a9-91cd-2a11159ff695?source=api-prod","affected":[{"type":"plugin","slug":"llm-hubspot-blog-import","name":"LLM Hubspot Blog Import","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-24T08:24:02Z"},{"id":"wordfence:682f00a9-cb71-42e6-9ab8-1591059a5cb4","source":"wordfence","cve":"CVE-2026-32581","title":"Mooberry Book Manager  4.16.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/682f00a9-cb71-42e6-9ab8-1591059a5cb4?source=api-prod","affected":[{"type":"plugin","slug":"mooberry-book-manager","name":"Mooberry Book Manager","from":"4.16.2","from_inclusive":true,"to":"4.16.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:33:47Z","updated":"2026-10-08T23:21:07Z"},{"id":"wordfence:6830f98b-21f8-4089-9091-1dcd31697425","source":"wordfence","cve":"CVE-2018-5652","title":"WP Markdown Editor (Formerly Dark Mode) < 1.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6830f98b-21f8-4089-9091-1dcd31697425?source=api-prod","affected":[{"type":"plugin","slug":"dark-mode","name":"Markdown Editor (Formerly Dark Mode)","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:683131a0-eec3-4251-b322-5c2088855687","source":"wordfence","cve":"CVE-2024-4199","title":"Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/683131a0-eec3-4251-b322-5c2088855687?source=api-prod","affected":[{"type":"plugin","slug":"ithemeland-bulk-posts-editing-lite","name":"WBULKiT \u2013 Bulk Edit Posts & Pages","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2024-05-14T12:16:49Z","updated":"2024-05-15T01:56:55Z"},{"id":"wordfence:6833102f-33fb-419f-869d-b1b6cc9c147b","source":"wordfence","cve":"CVE-2024-11272","title":"Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6833102f-33fb-419f-869d-b1b6cc9c147b?source=api-prod","affected":[{"type":"plugin","slug":"pirate-forms","name":"Contact Form & SMTP Plugin for WordPress by PirateForms","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-03-03T00:00:00Z","updated":"2026-09-04T17:28:34Z"},{"id":"wordfence:68348c03-d0ba-4dcc-8b18-a4675d6dce27","source":"wordfence","cve":"CVE-2026-122063","title":"Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68348c03-d0ba-4dcc-8b18-a4675d6dce27?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.2","to_inclusive":true,"patched_in":"4.18.3"}],"published":"2026-11-12T21:04:45Z","updated":"2026-11-13T09:35:12Z"},{"id":"wordfence:6835f010-a7cd-4942-8d05-0171d216d2f1","source":"wordfence","cve":"CVE-2026-120318","title":"Product Gallery Slider, Additional Variation Images for WooCommerce  2.3.23 - 2.3.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6835f010-a7cd-4942-8d05-0171d216d2f1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-gallery-slider","name":"Product Gallery Slider, Additional Variation Images for WooCommerce","from":"2.3.23","from_inclusive":true,"to":"2.3.26","to_inclusive":false,"patched_in":"2.3.26"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-06T17:54:44Z"},{"id":"wordfence:68366105-996c-4069-978c-c6ff222acd55","source":"wordfence","cve":"CVE-2024-52404","title":"CF7 Reply Manager <= 1.2.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68366105-996c-4069-978c-c6ff222acd55?source=api-prod","affected":[{"type":"plugin","slug":"cf7-reply-manager","name":"CF7 Reply Manager","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:06:41Z"},{"id":"wordfence:68375862-a88a-4a37-a4e4-1c48b589db5c","source":"wordfence","cve":"CVE-2025-24590","title":"picu \u2013 Online Photo Proofing Gallery <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68375862-a88a-4a37-a4e4-1c48b589db5c?source=api-prod","affected":[{"type":"plugin","slug":"picu","name":"picu \u2013 Online Photo Proofing Gallery","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-12-22T00:00:00Z","updated":"2025-02-19T16:28:24Z"},{"id":"wordfence:6837b91d-b3ba-435a-965b-fa18d9b9b9c8","source":"wordfence","cve":"CVE-2022-1505","title":"RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6837b91d-b3ba-435a-965b-fa18d9b9b9c8?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"9.2.6","to_inclusive":true,"patched_in":"9.2.7"}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68394503-d989-40d8-b033-24c011294158","source":"wordfence","cve":"CVE-2024-37947","title":"Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68394503-d989-40d8-b033-24c011294158?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:55:02Z"},{"id":"wordfence:683b2083-17b2-4136-841c-734a0beaa49e","source":"wordfence","cve":"CVE-2026-116408","title":"Gallery PhotoBlocks <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/683b2083-17b2-4136-841c-734a0beaa49e?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-10-26T17:29:00Z","updated":"2026-10-28T01:27:22Z"},{"id":"wordfence:683cc327-e17e-49f6-a903-f8a40bb832d1","source":"wordfence","cve":"CVE-2024-33559","title":"XStore <= 9.3.8 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/683cc327-e17e-49f6-a903-f8a40bb832d1?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:48:41Z"},{"id":"wordfence:683e10af-5414-4959-9823-93e88e84bb1b","source":"wordfence","cve":"","title":"Crowdsignal Dashboard < 2.0.21 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/683e10af-5414-4959-9823-93e88e84bb1b?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":false,"patched_in":"2.0.21"}],"published":"2013-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:683edf03-b3ea-4de9-91d8-c4a556739f7f","source":"wordfence","cve":"CVE-2026-24383","title":"B Slider <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/683edf03-b3ea-4de9-91d8-c4a556739f7f?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T16:31:01Z"},{"id":"wordfence:6840add4-62db-4b99-b48b-0b51aa2451b8","source":"wordfence","cve":"CVE-2023-47512","title":"Product Enquiry for WooCommerce <= 3.1 - Unauthenticated Stored Cross-Site Scripting via name","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6840add4-62db-4b99-b48b-0b51aa2451b8?source=api-prod","affected":[{"type":"plugin","slug":"gm-woocommerce-quote-popup","name":"Product Enquiry for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6840c91f-a5d9-4940-8a08-d62acc5d43eb","source":"wordfence","cve":"CVE-2024-24872","title":"Themify Builder <= 7.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6840c91f-a5d9-4940-8a08-d62acc5d43eb?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:24:13Z"},{"id":"wordfence:68420c5a-4add-4597-bd2a-20dc831e81bd","source":"wordfence","cve":"CVE-2023-6947","title":"Best WordPress Gallery Plugin \u2013 FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal","severity":"high","cvss":7.7,"cwe":"CWE-25","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68420c5a-4add-4597-bd2a-20dc831e81bd?source=api-prod","affected":[{"type":"plugin","slug":"foogallery-premium","name":"FooGallery Premium","from":"*","from_inclusive":true,"to":"2.4.26","to_inclusive":true,"patched_in":"2.4.27"}],"published":"2024-12-09T17:12:04Z","updated":"2024-12-10T05:24:43Z"},{"id":"wordfence:684253b3-0a96-4822-84c8-bde8ed45f35e","source":"wordfence","cve":"CVE-2021-24522","title":"Paid Membership, User Registration, User Profile & Restrict Content Plugin \u2013 ProfilePress <= 3.1.10 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684253b3-0a96-4822-84c8-bde8ed45f35e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"3.1.10","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6843939b-889f-45d7-9758-4b76a20d15f1","source":"wordfence","cve":"","title":"Dynamic Font Replacement DFR4WP EN  <= 1.3 EN - Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6843939b-889f-45d7-9758-4b76a20d15f1?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-font-replacement-4wp","name":"Dynamic Font Replacement DFR4WP EN","from":"*","from_inclusive":true,"to":"1.3 EN","to_inclusive":true,"patched_in":""}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6844c9a6-b25a-4ae1-96f6-023c1df80ddf","source":"wordfence","cve":"CVE-2026-42412","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6844c9a6-b25a-4ae1-96f6-023c1df80ddf?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:49:43Z"},{"id":"wordfence:6845b506-3d38-47f6-9348-d7931e65707a","source":"wordfence","cve":"CVE-2023-41691","title":"WooCommerce PensoPay <= 6.3.1 - Reflected Cross-Site Scripting via 'pensopay_action'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6845b506-3d38-47f6-9348-d7931e65707a?source=api-prod","affected":[{"type":"plugin","slug":"woo-pensopay","name":"pensopay Payments","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6847da95-a157-403a-8d54-d6794da94739","source":"wordfence","cve":"CVE-2025-24569","title":"PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6847da95-a157-403a-8d54-d6794da94739?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-addon-for-elementor-page-builder","name":"PDF Generator for WordPress Elementor","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-12-12T00:00:00Z","updated":"2026-05-04T14:35:35Z"},{"id":"wordfence:6849ae28-4918-4726-a139-7c3f8395e59d","source":"wordfence","cve":"CVE-2026-25379","title":"StreamVid < 6.8.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6849ae28-4918-4726-a139-7c3f8395e59d?source=api-prod","affected":[{"type":"theme","slug":"streamvid","name":"StreamVid - Movie Video Streaming WordPress Theme","from":"*","from_inclusive":true,"to":"6.8.6","to_inclusive":false,"patched_in":"6.8.6"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:50:21Z"},{"id":"wordfence:684a1e8e-30f2-47dd-9df6-145198030c52","source":"wordfence","cve":"CVE-2020-36711","title":"Avada  <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684a1e8e-30f2-47dd-9df6-145198030c52?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":false,"patched_in":"6.2.3"}],"published":"2020-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:684b0166-56fc-433f-ae34-0ff5071e7f05","source":"wordfence","cve":"CVE-2019-15821","title":"Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684b0166-56fc-433f-ae34-0ff5071e7f05?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2019-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:684de9c5-6f94-455d-b095-9f2df733ab95","source":"wordfence","cve":"CVE-2025-13363","title":"IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684de9c5-6f94-455d-b095-9f2df733ab95?source=api-prod","affected":[{"type":"plugin","slug":"imaq-core","name":"IMAQ CORE","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:06:19Z","updated":"2025-12-12T03:20:47Z"},{"id":"wordfence:684e199b-c3c9-47d5-a67e-8f4735eaed84","source":"wordfence","cve":"CVE-2024-44043","title":"Photo Gallery by 10Web <= 1.8.27 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684e199b-c3c9-47d5-a67e-8f4735eaed84?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.27","to_inclusive":true,"patched_in":"1.8.28"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-18T13:11:08Z"},{"id":"wordfence:684e6a97-b884-4d25-99f1-81c2a43f1239","source":"wordfence","cve":"CVE-2025-2224","title":"Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/684e6a97-b884-4d25-99f1-81c2a43f1239?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":true,"patched_in":"8.3"}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T05:22:49Z"},{"id":"wordfence:68504f49-0b18-4010-97b0-7e7391408d36","source":"wordfence","cve":"CVE-2026-32461","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68504f49-0b18-4010-97b0-7e7391408d36?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.5.7","to_inclusive":true,"patched_in":"9.5.8"}],"published":"2026-03-15T00:00:00Z","updated":"2026-03-19T15:07:17Z"},{"id":"wordfence:68530904-22d2-4228-b9f2-76f5ee1fd541","source":"wordfence","cve":"CVE-2025-1802","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68530904-22d2-4228-b9f2-76f5ee1fd541?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-20T11:11:28Z"},{"id":"wordfence:68533b4c-1bdf-4104-a263-757b018af129","source":"wordfence","cve":"CVE-2025-9218","title":"rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function","severity":"low","cvss":3.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68533b4c-1bdf-4104-a263-757b018af129?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"4.7.0","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2025-12-12T15:34:22Z","updated":"2025-12-13T04:31:28Z"},{"id":"wordfence:685408e9-7e32-4e48-8517-cefa1d33c4fc","source":"wordfence","cve":"CVE-2026-66677","title":"Leyka <= 3.32.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/685408e9-7e32-4e48-8517-cefa1d33c4fc?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.32.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:19:11Z"},{"id":"wordfence:68549c3d-b52f-42c4-bf80-976c08ea6665","source":"wordfence","cve":"CVE-2026-123131","title":"GemBooking <= 1.7.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68549c3d-b52f-42c4-bf80-976c08ea6665?source=api-prod","affected":[{"type":"plugin","slug":"gembooking","name":"GemBooking \u2013 Appointment Booking, Booking Calendar & Reservations","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:18:11Z"},{"id":"wordfence:6854e470-26ac-4747-b72c-164e79e1a1b1","source":"wordfence","cve":"CVE-2025-15507","title":"Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6854e470-26ac-4747-b72c-164e79e1a1b1?source=api-prod","affected":[{"type":"plugin","slug":"magic-import-document-extractor","name":"Magic Import Document Extractor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-02-03T19:31:58Z","updated":"2026-02-06T17:28:20Z"},{"id":"wordfence:6855ba58-aaa7-44ec-b3bb-22a7f618ee9a","source":"wordfence","cve":"CVE-2026-102391","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6855ba58-aaa7-44ec-b3bb-22a7f618ee9a?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.4","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-09-30T13:18:39Z","updated":"2026-10-08T23:12:34Z"},{"id":"wordfence:6857b90e-7570-4c1c-836e-08f367bb485b","source":"wordfence","cve":"CVE-2025-68520","title":"DotLife < 4.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6857b90e-7570-4c1c-836e-08f367bb485b?source=api-prod","affected":[{"type":"theme","slug":"dotlife","name":"DotLife | Coaching Online Courses WordPress","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":false,"patched_in":"4.9.5"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:45:45Z"},{"id":"wordfence:6859b917-f1a4-4444-8775-e2e9371c8506","source":"wordfence","cve":"CVE-2025-39430","title":"mLanguage <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6859b917-f1a4-4444-8775-e2e9371c8506?source=api-prod","affected":[{"type":"plugin","slug":"mlanguage","name":"mLanguage","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:46:19Z"},{"id":"wordfence:686182c4-f6bc-41a2-a665-efce3a30c5fb","source":"wordfence","cve":"CVE-2025-23795","title":"Easy FAQs <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/686182c4-f6bc-41a2-a665-efce3a30c5fb?source=api-prod","affected":[{"type":"plugin","slug":"easy-faqs","name":"Easy FAQs","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:13:51Z"},{"id":"wordfence:686430ed-8b26-4c6a-9e49-4a2cc5f1f7dd","source":"wordfence","cve":"CVE-2025-47477","title":"Backup and Staging by WP Time Capsule <= 1.22.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/686430ed-8b26-4c6a-9e49-4a2cc5f1f7dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.23","to_inclusive":true,"patched_in":"1.22.24"}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-11T21:12:50Z"},{"id":"wordfence:6864382e-7a45-413c-a80e-a5dd827fe6c7","source":"wordfence","cve":"CVE-2024-54268","title":"SiteOrigin Widgets Bundle <= 1.64.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6864382e-7a45-413c-a80e-a5dd827fe6c7?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.64.0","to_inclusive":true,"patched_in":"1.64.1"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-18T16:08:30Z"},{"id":"wordfence:68679ff9-48a8-4146-a37f-5f844dc86c92","source":"wordfence","cve":"CVE-2025-2932","title":"JKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68679ff9-48a8-4146-a37f-5f844dc86c92?source=api-prod","affected":[{"type":"plugin","slug":"jkdevkit","name":"JKDEVKIT","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-02T00:00:00Z","updated":"2025-07-03T12:23:09Z"},{"id":"wordfence:6867d573-4ba1-4b82-b285-0696134d42fc","source":"wordfence","cve":"CVE-2022-1062","title":"th23 Social <= 1.2.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6867d573-4ba1-4b82-b285-0696134d42fc?source=api-prod","affected":[{"type":"plugin","slug":"th23-social","name":"th23 Social","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:686dd63b-5471-4654-8009-e3ab648f8b86","source":"wordfence","cve":"CVE-2026-6178","title":"Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/686dd63b-5471-4654-8009-e3ab648f8b86?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.4.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T07:42:00Z"},{"id":"wordfence:6870e237-2c2f-46c7-bf00-b3f1bedb8d8d","source":"wordfence","cve":"CVE-2013-6993","title":"Ad-minister <= 0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6870e237-2c2f-46c7-bf00-b3f1bedb8d8d?source=api-prod","affected":[{"type":"plugin","slug":"ad-minister","name":"ad-minister","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2013-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68721ded-0a80-4cff-aaf0-59b2fcf67456","source":"wordfence","cve":"CVE-2024-31921","title":"Ultimate Product Catalogue <= 5.2.15 - Cross-Site Request Forgery via reset_settings()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68721ded-0a80-4cff-aaf0-59b2fcf67456?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"5.2.16"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:29:27Z"},{"id":"wordfence:68757251-28d3-4468-9d46-16c0928d0618","source":"wordfence","cve":"CVE-2026-103514","title":"2FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68757251-28d3-4468-9d46-16c0928d0618?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:54:59Z"},{"id":"wordfence:68774d9c-7abc-416d-8ab9-2713a1bad377","source":"wordfence","cve":"CVE-2023-22704","title":"teachPress <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68774d9c-7abc-416d-8ab9-2713a1bad377?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"8.1.8","to_inclusive":true,"patched_in":"8.1.9"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:687ae27f-678e-46aa-bb32-24ab5ad771ab","source":"wordfence","cve":"CVE-2024-54348","title":"Brand <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/687ae27f-678e-46aa-bb32-24ab5ad771ab?source=api-prod","affected":[{"type":"theme","slug":"brandy","name":"Brandy","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:15:08Z"},{"id":"wordfence:687c86af-915e-4028-910e-ab83bcd86a1a","source":"wordfence","cve":"CVE-2023-23880","title":"ExactMetrics <= 7.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/687c86af-915e-4028-910e-ab83bcd86a1a?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"*","from_inclusive":true,"to":"7.14.1","to_inclusive":true,"patched_in":"7.14.2"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:687cd0ac-5f78-4429-b6b5-dd1113143a4d","source":"wordfence","cve":"CVE-2022-1969","title":"Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/687cd0ac-5f78-4429-b6b5-dd1113143a4d?source=api-prod","affected":[{"type":"plugin","slug":"mobile-browser-color-select","name":"Mobile browser color select","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:687ffac2-1f07-4adb-ba12-5f2ea357ea7e","source":"wordfence","cve":"CVE-2026-2434","title":"Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/687ffac2-1f07-4adb-ba12-5f2ea357ea7e?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-17T09:44:19Z","updated":"2026-09-09T16:36:08Z"},{"id":"wordfence:6881b0ad-7f11-4709-8c17-37aa505bad4c","source":"wordfence","cve":"CVE-2021-24410","title":"\u0c24\u0c46\u0c32\u0c41\u0c17\u0c41 \u0c2c\u0c48\u0c2c\u0c3f\u0c32\u0c4d \u0c35\u0c1a\u0c28\u0c2e\u0c41\u0c32\u0c41 <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6881b0ad-7f11-4709-8c17-37aa505bad4c?source=api-prod","affected":[{"type":"plugin","slug":"telugu-bible-verse-daily","name":"\u0c24\u0c46\u0c32\u0c41\u0c17\u0c41 \u0c2c\u0c48\u0c2c\u0c3f\u0c32\u0c4d \u0c35\u0c1a\u0c28\u0c2e\u0c41\u0c32\u0c41","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6881c774-a20f-4b18-8ce2-7e60d89073d6","source":"wordfence","cve":"CVE-2024-49307","title":"Admin Management Xtended  <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6881c774-a20f-4b18-8ce2-7e60d89073d6?source=api-prod","affected":[{"type":"plugin","slug":"admin-management-xtended","name":"Admin Management Xtended","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-23T16:29:08Z"},{"id":"wordfence:688353c9-e4e5-4717-9651-15d05248554f","source":"wordfence","cve":"CVE-2023-47768","title":"Footer Putter <= 6.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/688353c9-e4e5-4717-9651-15d05248554f?source=api-prod","affected":[{"type":"plugin","slug":"footer-putter","name":"Footer Putter","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68846ab2-684c-40ad-8a91-0b7d9de1ecde","source":"wordfence","cve":"CVE-2024-53783","title":"Ni WooCommerce Cost Of Goods <= 3.2.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68846ab2-684c-40ad-8a91-0b7d9de1ecde?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-cost-of-goods","name":"Ni Cost of Goods for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-11-28T00:00:00Z","updated":"2025-04-15T12:22:46Z"},{"id":"wordfence:688c04b5-e5fe-4ddf-b253-2418149d9aba","source":"wordfence","cve":"CVE-2024-54247","title":"ABCBiz Addons for Elementor <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/688c04b5-e5fe-4ddf-b253-2418149d9aba?source=api-prod","affected":[{"type":"plugin","slug":"abcbiz-addons","name":"ABCBiz Addons for Elementor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:59:58Z"},{"id":"wordfence:688d30ac-9b30-4298-a935-316e5503a31b","source":"wordfence","cve":"CVE-2024-31123","title":"SpiderFAQ <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/688d30ac-9b30-4298-a935-316e5503a31b?source=api-prod","affected":[{"type":"plugin","slug":"spider-faq","name":"SpiderFAQ","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T21:05:12Z"},{"id":"wordfence:689140fb-c952-4c51-96a4-60ed2b125d60","source":"wordfence","cve":"CVE-2025-62919","title":"TS Demo Importer <= 0.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689140fb-c952-4c51-96a4-60ed2b125d60?source=api-prod","affected":[{"type":"plugin","slug":"ts-demo-importer","name":"TS Demo Importer","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-04T00:00:00Z","updated":"2025-10-29T15:00:22Z"},{"id":"wordfence:6892fefa-3866-4dbf-8604-dd4bc1e7d481","source":"wordfence","cve":"CVE-2023-44264","title":"The Awesome Feed \u2013 Custom Feed <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6892fefa-3866-4dbf-8604-dd4bc1e7d481?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-feed","name":"The Awesome Feed \u2013 Custom Feed","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:689511e0-1355-4fcb-8a72-d819abc8e9a3","source":"wordfence","cve":"CVE-2023-3957","title":"ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689511e0-1355-4fcb-8a72-d819abc8e9a3?source=api-prod","affected":[{"type":"plugin","slug":"navz-photo-gallery","name":"ACF Photo Gallery Field","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6895a774-7e78-4ab2-a2b3-2a333f258778","source":"wordfence","cve":"CVE-2026-6451","title":"CMS f\u00fcr Motorrad Werkst\u00e4tten <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6895a774-7e78-4ab2-a2b3-2a333f258778?source=api-prod","affected":[{"type":"plugin","slug":"cms-fuer-motorrad-werkstaetten","name":"Plugin: CMS f\u00fcr Motorrad Werkst\u00e4tten","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-16T19:39:37Z","updated":"2026-04-17T07:45:57Z"},{"id":"wordfence:6897a8fe-c32e-430a-847c-23d1add2355d","source":"wordfence","cve":"","title":"Various Orange themes (Various Unspecified Versions) - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6897a8fe-c32e-430a-847c-23d1add2355d?source=api-prod","affected":[{"type":"theme","slug":"rockstar-theme","name":"Rockstar Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bulteno-theme","name":"Bulteno Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"oxygen-theme","name":"Oxygen Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"reganto-theme","name":"Reganto Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"rayoflight-theme","name":"Rayoflight Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bordeaux-theme","name":"Bordeaux Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"radial-theme","name":"Radial Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"agritourismo-theme","name":"AgriTourismo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:689878cd-3e25-49e9-9e85-28ecf5ed2e94","source":"wordfence","cve":"CVE-2026-39498","title":"YayMail \u2013 WooCommerce Email Customizer <= 4.3.3 - Authenticated (Shop manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689878cd-3e25-49e9-9e85-28ecf5ed2e94?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:59:14Z"},{"id":"wordfence:68991289-acfa-4ab9-9852-755e5f1eda33","source":"wordfence","cve":"CVE-2024-10010","title":"LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68991289-acfa-4ab9-9852-755e5f1eda33?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.1","to_inclusive":true,"patched_in":"4.2.7.2"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-12T16:57:12Z"},{"id":"wordfence:689a3191-b7aa-424b-9d56-176e23316f1c","source":"wordfence","cve":"CVE-2026-61987","title":"WCFM \u2013 Frontend Manager for WooCommerce <= 6.8.1 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689a3191-b7aa-424b-9d56-176e23316f1c?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.8.2"}],"published":"2026-11-06T15:42:45Z","updated":"2026-11-10T20:05:17Z"},{"id":"wordfence:689abb68-0c19-4f89-91db-fd15ab8bca8e","source":"wordfence","cve":"CVE-2024-6883","title":"Event Espresso 4 Decaf \u2013 Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689abb68-0c19-4f89-91db-fd15ab8bca8e?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-decaf","name":"Event Espresso \u2013 Event Registration & Ticketing Sales","from":"*","from_inclusive":true,"to":"4.10.46.decaf","to_inclusive":true,"patched_in":"5.0.22.decaf"}],"published":"2024-08-20T17:26:46Z","updated":"2024-08-28T13:12:02Z"},{"id":"wordfence:689e86c4-5330-4837-b3ff-2553fa1c2ead","source":"wordfence","cve":"CVE-2025-53577","title":"Global DNS <= 3.1.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689e86c4-5330-4837-b3ff-2553fa1c2ead?source=api-prod","affected":[{"type":"plugin","slug":"global-dns","name":"Global DNS","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-08-23T00:00:00Z","updated":"2025-09-03T20:55:20Z"},{"id":"wordfence:689eb95b-2f72-4aa4-9f21-6ae186346061","source":"wordfence","cve":"CVE-2024-2619","title":"Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689eb95b-2f72-4aa4-9f21-6ae186346061?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.27"}],"published":"2024-05-16T08:08:19Z","updated":"2024-05-16T20:31:06Z"},{"id":"wordfence:689ed1b8-8ef9-4994-8a39-9e0b079aed9a","source":"wordfence","cve":"CVE-2024-32947","title":"WP ADA Compliance Check Basic \u2013 Most Comprehensive Web Accessibility Solution for WordPress <= 3.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689ed1b8-8ef9-4994-8a39-9e0b079aed9a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ada-compliance-check-basic","name":"WP ADA Compliance Check Basic","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:14:31Z"},{"id":"wordfence:689f3667-2dda-40a8-8627-d38c6c6816fc","source":"wordfence","cve":"CVE-2024-1785","title":"Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/689f3667-2dda-40a8-8627-d38c6c6816fc?source=api-prod","affected":[{"type":"plugin","slug":"contests-from-rewards-fuel","name":"Contests by Rewards Fuel","from":"*","from_inclusive":true,"to":"2.0.62","to_inclusive":true,"patched_in":"2.0.63"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T01:58:04Z"},{"id":"wordfence:68a509ae-9943-4b9a-8ede-2b5732e96e6d","source":"wordfence","cve":"CVE-2024-3649","title":"Contact Form by WPForms \u2013 Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.8.7.2","to_inclusive":true,"patched_in":"1.8.8.2"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:52:12Z"},{"id":"wordfence:68a520bb-261a-43f0-993d-de208035afe5","source":"wordfence","cve":"CVE-2023-33211","title":"WP-Piwik <= 1.0.27 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Display Name","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68a520bb-261a-43f0-993d-de208035afe5?source=api-prod","affected":[{"type":"plugin","slug":"wp-piwik","name":"Connect Matomo \u2013 Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.0.28"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68a80ca3-45f4-4446-af7a-e582c94ccb52","source":"wordfence","cve":"CVE-2026-27044","title":"TotalPoll for Polls and Contests <= 4.12.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68a80ca3-45f4-4446-af7a-e582c94ccb52?source=api-prod","affected":[{"type":"plugin","slug":"totalpoll-lite","name":"TotalPoll for Polls and Contests","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-10-15T13:20:30Z"},{"id":"wordfence:68a87e74-597d-4d2c-9900-9c46dffe334f","source":"wordfence","cve":"CVE-2025-23984","title":"Dynamic URL SEO <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68a87e74-597d-4d2c-9900-9c46dffe334f?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-url-seo","name":"Dynamic URL SEO","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:16:27Z"},{"id":"wordfence:68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa","source":"wordfence","cve":"CVE-2026-8423","title":"JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa?source=api-prod","affected":[{"type":"plugin","slug":"javibola-custom-theme","name":"JaviBola Custom Theme Test","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:07:03Z","updated":"2026-05-20T01:25:49Z"},{"id":"wordfence:68aba88f-e7f9-42d7-9dea-045e7fef7056","source":"wordfence","cve":"CVE-2016-10870","title":"Google Language Translator <= 5.0.05 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68aba88f-e7f9-42d7-9dea-045e7fef7056?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"5.0.06","to_inclusive":false,"patched_in":"5.0.06"}],"published":"2016-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68ac08b0-19f7-4e05-80f8-0eb4e7b96a5f","source":"wordfence","cve":"CVE-2025-39496","title":"Product Filter Pro < 2.9.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ac08b0-19f7-4e05-80f8-0eb4e7b96a5f?source=api-prod","affected":[{"type":"plugin","slug":"woofilter-pro","name":"WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":false,"patched_in":"2.9.6"}],"published":"2025-06-03T00:00:00Z","updated":"2025-09-24T13:37:06Z"},{"id":"wordfence:68ae048c-a897-4061-b839-56ca0dbb2581","source":"wordfence","cve":"CVE-2024-52379","title":"kineticPay for WooCommerce <= 2.0.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ae048c-a897-4061-b839-56ca0dbb2581?source=api-prod","affected":[{"type":"plugin","slug":"kineticpay-for-woocommerce","name":"kineticPay for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:46:14Z"},{"id":"wordfence:68ae8404-6dfa-4b13-b2a6-bd4554f1043f","source":"wordfence","cve":"CVE-2025-4944","title":"LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ae8404-6dfa-4b13-b2a6-bd4554f1043f?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-05-29T22:06:38Z","updated":"2025-05-30T11:15:10Z"},{"id":"wordfence:68b202f7-fff1-4056-9b5b-b42b25189706","source":"wordfence","cve":"CVE-2014-7238","title":"Contact Form Integrated With Google Maps 1.0 - 2.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68b202f7-fff1-4056-9b5b-b42b25189706?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-integrated-with-google-maps","name":"Contact Form Integrated With Google Maps","from":"1.0","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2014-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68b4358d-d4b4-415b-a19f-e58b155ceac9","source":"wordfence","cve":"CVE-2024-13659","title":"Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68b4358d-d4b4-415b-a19f-e58b155ceac9?source=api-prod","affected":[{"type":"plugin","slug":"listamester","name":"Listamester","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-28T18:42:35Z"},{"id":"wordfence:68b4ef1f-93cc-4fbd-9713-9cbc6ad59f5e","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68b4ef1f-93cc-4fbd-9713-9cbc6ad59f5e?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker-pro","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68b8167f-808c-4401-bed5-14088b0c1418","source":"wordfence","cve":"CVE-2026-57808","title":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square <= 4.5.0 - Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68b8167f-808c-4401-bed5-14088b0c1418?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-29T13:11:35Z"},{"id":"wordfence:68c16098-c01a-4023-972a-d0bc0468a973","source":"wordfence","cve":"CVE-2026-34890","title":"MSTW League Manager <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c16098-c01a-4023-972a-d0bc0468a973?source=api-prod","affected":[{"type":"plugin","slug":"mstw-league-manager","name":"MSTW League Manager","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2026-04-02T00:00:00Z","updated":"2026-04-02T14:33:21Z"},{"id":"wordfence:68c1776e-8e29-4eea-87d0-cf7318a64f7d","source":"wordfence","cve":"CVE-2021-24289","title":"Store Locator Plus <= 5.5.15 - Authenticated Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c1776e-8e29-4eea-87d0-cf7318a64f7d?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-le","name":"Store Locator Plus\u00ae for WordPress","from":"*","from_inclusive":true,"to":"5.5.15","to_inclusive":true,"patched_in":"5.7"}],"published":"2021-04-26T00:00:00Z","updated":"2024-06-17T19:08:44Z"},{"id":"wordfence:68c190af-6b86-4831-a071-77e30caff912","source":"wordfence","cve":"CVE-2025-32193","title":"Simple WP Events <= 1.8.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c190af-6b86-4831-a071-77e30caff912?source=api-prod","affected":[{"type":"plugin","slug":"simple-wp-events","name":"Simple WP Events","from":"*","from_inclusive":true,"to":"1.8.17","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-23T14:26:48Z"},{"id":"wordfence:68c22e71-c704-44c1-86e6-856f6244393d","source":"wordfence","cve":"CVE-2023-41136","title":"Simple Long Form <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c22e71-c704-44c1-86e6-856f6244393d?source=api-prod","affected":[{"type":"plugin","slug":"simple-long-form","name":"Simple Long Form","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68c28402-b8b2-4efb-8725-e344d663703c","source":"wordfence","cve":"CVE-2025-31569","title":"wordpress related Posts with thumbnails <= 3.0.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c28402-b8b2-4efb-8725-e344d663703c?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-list-grid-and-slider-all-in-one","name":"wordpress related Posts with thumbnails","from":"*","from_inclusive":true,"to":"3.0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:23:04Z"},{"id":"wordfence:68c32762-38ed-4002-8ee4-6810d8471f31","source":"wordfence","cve":"CVE-2026-92541","title":"Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c32762-38ed-4002-8ee4-6810d8471f31?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:29:59Z"},{"id":"wordfence:68c4139b-60ed-4523-80f5-6630c9f0fcf9","source":"wordfence","cve":"CVE-2026-12901","title":"GetPaid <= 2.8.54 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c4139b-60ed-4523-80f5-6630c9f0fcf9?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.54","to_inclusive":true,"patched_in":"2.8.55"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-17T16:07:07Z"},{"id":"wordfence:68c5d9ad-f6ca-4a3a-b3fc-6b8997a86981","source":"wordfence","cve":"CVE-2026-49765","title":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c5d9ad-f6ca-4a3a-b3fc-6b8997a86981?source=api-prod","affected":[{"type":"plugin","slug":"cf7-mailchimp","name":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:44:14Z"},{"id":"wordfence:68c6e428-b9cf-442f-a896-a8ceb4b9be0e","source":"wordfence","cve":"CVE-2025-1456","title":"Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c6e428-b9cf-442f-a896-a8ceb4b9be0e?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1012","to_inclusive":true,"patched_in":"1.7.1013"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T08:22:41Z"},{"id":"wordfence:68c93ccb-4da8-4615-b596-5af93f55c8d7","source":"wordfence","cve":"CVE-2025-31540","title":"ACME Divi Modules <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68c93ccb-4da8-4615-b596-5af93f55c8d7?source=api-prod","affected":[{"type":"plugin","slug":"acme-divi-modules","name":"ACME Divi Modules","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T14:07:17Z"},{"id":"wordfence:68cabb14-2484-44ed-92ee-9c1d27540d6a","source":"wordfence","cve":"CVE-2025-26767","title":"Qubely <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68cabb14-2484-44ed-92ee-9c1d27540d6a?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2025-02-14T00:00:00Z","updated":"2026-04-15T20:39:42Z"},{"id":"wordfence:68cc2aec-f21d-482d-a8bd-bbc60f593cb5","source":"wordfence","cve":"CVE-2018-6467","title":"flickrRSS <= 5.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68cc2aec-f21d-482d-a8bd-bbc60f593cb5?source=api-prod","affected":[{"type":"plugin","slug":"flickr-rss","name":"flickrRSS","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":""}],"published":"2018-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68cdbe3e-6169-4177-873d-1028912ecad6","source":"wordfence","cve":"CVE-2025-8560","title":"FancyTabs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68cdbe3e-6169-4177-873d-1028912ecad6?source=api-prod","affected":[{"type":"plugin","slug":"fancytabs","name":"FancyTabs","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:24:21Z","updated":"2025-09-30T03:35:26Z"},{"id":"wordfence:68cef86f-3a6a-47c4-a092-de3bb40ac157","source":"wordfence","cve":"CVE-2026-95866","title":"User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68cef86f-3a6a-47c4-a092-de3bb40ac157?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-09-24T18:54:29Z","updated":"2026-09-25T07:40:27Z"},{"id":"wordfence:68d077ae-4ed4-4373-a1df-546ca654f51a","source":"wordfence","cve":"CVE-2026-81583","title":"Theme My Login 7.0 - 7.1.15 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d077ae-4ed4-4373-a1df-546ca654f51a?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"7.0","from_inclusive":true,"to":"7.1.15","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:14:33Z"},{"id":"wordfence:68d168fb-9f28-48b2-a054-d279d4cd21c3","source":"wordfence","cve":"CVE-2025-48268","title":"Bot for Telegram on WooCommerce <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d168fb-9f28-48b2-a054-d279d4cd21c3?source=api-prod","affected":[{"type":"plugin","slug":"bot-for-telegram-on-woocommerce","name":"Bot for Telegram on WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:17:12Z"},{"id":"wordfence:68d44dd9-cfe4-4bc0-aa2e-9b7fb766870a","source":"wordfence","cve":"CVE-2022-1512","title":"ScrollReveal.js Effects <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d44dd9-cfe4-4bc0-aa2e-9b7fb766870a?source=api-prod","affected":[{"type":"plugin","slug":"scrollrevealjs-effects","name":"ScrollReveal.js Effects","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68d4aa8c-70f9-46ba-92ce-fbb427954e86","source":"wordfence","cve":"CVE-2026-2724","title":"Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d4aa8c-70f9-46ba-92ce-fbb427954e86?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-03-09T21:26:51Z","updated":"2026-03-10T09:59:00Z"},{"id":"wordfence:68d71bd0-176c-4eee-99c2-9b591d6f70d3","source":"wordfence","cve":"","title":"ECPay Logistics for WooCommerce <= 1.2.181030 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d71bd0-176c-4eee-99c2-9b591d6f70d3?source=api-prod","affected":[{"type":"plugin","slug":"ecpay-logistics-for-woocommerce","name":"ECPay Logistics for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.181030","to_inclusive":true,"patched_in":"1.3.1910240"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68d79cb1-c9b9-441a-b265-f21edf99e801","source":"wordfence","cve":"CVE-2025-52732","title":"Google Map Targeting <= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d79cb1-c9b9-441a-b265-f21edf99e801?source=api-prod","affected":[{"type":"plugin","slug":"gmap-targeting","name":"GMap Targeting \u2013 Simple Targeting Inside Google Maps","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:22:45Z"},{"id":"wordfence:68d7b5d0-c777-4ff9-bdef-a7762cfbdf1a","source":"wordfence","cve":"CVE-2023-4968","title":"WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d7b5d0-c777-4ff9-bdef-a7762cfbdf1a?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2023-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68d9aeac-2c01-4afd-8307-906f1bc595d7","source":"wordfence","cve":"CVE-2024-43140","title":"Ultimate Bootstrap Elements for Elementor <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d9aeac-2c01-4afd-8307-906f1bc595d7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:30:39Z"},{"id":"wordfence:68d9b56b-2460-48d5-95ca-b64e65592b16","source":"wordfence","cve":"","title":"Polldaddy Polls & Rating < 2.0.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68d9b56b-2460-48d5-95ca-b64e65592b16?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"2.0.24","to_inclusive":false,"patched_in":"2.0.24"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68dd9f6f-ccee-4a27-bd21-2fb32b92cc62","source":"wordfence","cve":"CVE-2025-15403","title":"RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68dd9f6f-ccee-4a27-bd21-2fb32b92cc62?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.1","to_inclusive":true,"patched_in":"6.0.7.2"}],"published":"2026-01-16T13:22:33Z","updated":"2026-03-31T14:08:05Z"},{"id":"wordfence:68ddc0a1-2f5a-446d-9d83-b6028d012956","source":"wordfence","cve":"","title":"WP LiveChat <= 3.7.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ddc0a1-2f5a-446d-9d83-b6028d012956?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-software-for-wordpress","name":"LiveChat \u2013 Live Chat Plugin for WP Websites","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68e0f54d-08ec-4e41-ac9b-d72cdde5a724","source":"wordfence","cve":"CVE-2024-5577","title":"Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e0f54d-08ec-4e41-ac9b-d72cdde5a724?source=api-prod","affected":[{"type":"plugin","slug":"where-i-was-where-i-will-be","name":"Where I Was, Where I Will Be","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-14T07:31:06Z"},{"id":"wordfence:68e2f8ae-5908-423b-befa-17481418394c","source":"wordfence","cve":"CVE-2025-26938","title":"Countdown Timer <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e2f8ae-5908-423b-befa-17481418394c?source=api-prod","affected":[{"type":"plugin","slug":"countdown-time","name":"Countdown Timer Block \u2013 build urgency for events and launches","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:55:40Z"},{"id":"wordfence:68e395c1-f63d-4c7c-a41f-680f385554e8","source":"wordfence","cve":"CVE-2026-82183","title":"OAuth Single Sign On <= 7.0.0 - Unauthenticated Arbitrary User Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e395c1-f63d-4c7c-a41f-680f385554e8?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T16:13:03Z"},{"id":"wordfence:68e6675e-b9f4-41e5-8ebf-abab53f5d542","source":"wordfence","cve":"CVE-2021-24799","title":"Far Future Expiry Header <= 1.4 - Plugin's Settings Update via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e6675e-b9f4-41e5-8ebf-abab53f5d542?source=api-prod","affected":[{"type":"plugin","slug":"far-future-expiry-header","name":"Far Future Expiry Header","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68e6ec3a-c5fd-4f63-a9a0-2c9ddfb96e2e","source":"wordfence","cve":"CVE-2023-3093","title":"YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e6ec3a-c5fd-4f63-a9a0-2c9ddfb96e2e?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-06-12T00:00:00Z","updated":"2025-01-30T22:29:48Z"},{"id":"wordfence:68e838d4-2ff2-4925-b2ff-ba3f7b379010","source":"wordfence","cve":"CVE-2021-34624","title":"ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68e838d4-2ff2-4925-b2ff-ba3f7b379010?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"3.0.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-06-28T19:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68eaf645-3388-4bfc-8d23-45c12a4ee727","source":"wordfence","cve":"CVE-2026-89216","title":"vTables <= 0.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68eaf645-3388-4bfc-8d23-45c12a4ee727?source=api-prod","affected":[{"type":"plugin","slug":"vtables","name":"vTables \u2013 Data Table Builder for CSV, Excel & JSON","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T20:13:22Z"},{"id":"wordfence:68ec28e8-345c-4017-ab0d-04ac4facd60c","source":"wordfence","cve":"CVE-2023-25027","title":"Chained Quiz <= 1.3.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ec28e8-345c-4017-ab0d-04ac4facd60c?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.5","to_inclusive":true,"patched_in":"1.3.2.6"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68ed894d-b48b-42ef-89a9-b6a2ea093fc4","source":"wordfence","cve":"CVE-2026-13152","title":"Custom Fields Account Registration For WooCommerce <= 1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68ed894d-b48b-42ef-89a9-b6a2ea093fc4?source=api-prod","affected":[{"type":"plugin","slug":"custom-fields-account-registration-for-woocommerce","name":"Custom Fields Account Registration For Woocommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T16:49:15Z"},{"id":"wordfence:68eec693-bffe-4f3a-8e76-edf9f13093d4","source":"wordfence","cve":"CVE-2024-1310","title":"WooCommerce <= 8.5.2 - Missing Authorization to Private/Draft Product Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68eec693-bffe-4f3a-8e76-edf9f13093d4?source=api-prod","affected":[{"type":"plugin","slug":"post-new","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":false,"patched_in":"8.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-23T15:17:02Z"},{"id":"wordfence:68f20e70-121c-43d7-830d-53f6442cd20c","source":"wordfence","cve":"CVE-2026-87760","title":"Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f20e70-121c-43d7-830d-53f6442cd20c?source=api-prod","affected":[{"type":"plugin","slug":"web-vitals-tracking","name":"Web Vitals Tracking","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:15:34Z"},{"id":"wordfence:68f2e124-73c5-4ab2-ae0f-b4ca29d8312e","source":"wordfence","cve":"CVE-2024-52471","title":"Extensions for Elementor <= 2.0.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f2e124-73c5-4ab2-ae0f-b4ca29d8312e?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor","name":"Extensions for Elementor","from":"*","from_inclusive":true,"to":"2.0.40","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:13:24Z"},{"id":"wordfence:68f41e88-ed36-4361-bddd-41495a540cd9","source":"wordfence","cve":"CVE-2023-6799","title":"WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness","severity":"medium","cvss":5.9,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f41e88-ed36-4361-bddd-41495a540cd9?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.01"}],"published":"2024-03-26T00:00:00Z","updated":"2024-07-29T21:36:31Z"},{"id":"wordfence:68f460dc-bb7f-4477-821b-925c7c2c2de5","source":"wordfence","cve":"CVE-2015-4064","title":"WordPress Landing Pages <= 1.8.4 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f460dc-bb7f-4477-821b-925c7c2c2de5?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68f470ad-2475-444c-ae9d-8b86a5b8349f","source":"wordfence","cve":"CVE-2025-49051","title":"Hide Text Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f470ad-2475-444c-ae9d-8b86a5b8349f?source=api-prod","affected":[{"type":"plugin","slug":"hide-text-shortcode","name":"Hide Text Shortcode","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T20:50:17Z"},{"id":"wordfence:68f5bc13-b0b2-48b6-82ac-ff02367f4780","source":"wordfence","cve":"CVE-2023-51503","title":"WooPayments \u2013 Fully Integrated Solution Built and Supported by Woo <= 6.6.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f5bc13-b0b2-48b6-82ac-ff02367f4780?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68f5ff96-e8e1-4cbf-b42d-13c99d903a9f","source":"wordfence","cve":"CVE-2026-81343","title":"Frontend Admin by DynamiApps <= 3.29.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f5ff96-e8e1-4cbf-b42d-13c99d903a9f?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:57:31Z"},{"id":"wordfence:68f75333-5165-42ac-808e-69b20a8d7f19","source":"wordfence","cve":"CVE-2025-23830","title":"JB Horizontal Scroller News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f75333-5165-42ac-808e-69b20a8d7f19?source=api-prod","affected":[{"type":"plugin","slug":"jb-horizontal-scroller-news-ticker","name":"JB Horizontal Scroller News Ticker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:54:53Z"},{"id":"wordfence:68f7caa7-e97a-41d9-b9e3-eb37f53fb0f9","source":"wordfence","cve":"CVE-2024-56250","title":"Just Writing Statistics <= 4.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f7caa7-e97a-41d9-b9e3-eb37f53fb0f9?source=api-prod","affected":[{"type":"plugin","slug":"just-writing-statistics","name":"Just Writing Statistics","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:43:32Z"},{"id":"wordfence:68f87cc7-fde5-4cd6-ab25-bf05cd3b5cde","source":"wordfence","cve":"CVE-2020-11030","title":"WordPress Core < 5.4.1 - Cross-Site Scripting in the Block Editor","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68f87cc7-fde5-4cd6-ab25-bf05cd3b5cde?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68fb1fd3-16aa-467f-b5f6-a6126b05e088","source":"wordfence","cve":"CVE-2024-8323","title":"Pricing Tables WordPress Plugin \u2013 Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fb1fd3-16aa-467f-b5f6-a6126b05e088?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2024-11-05T23:25:43Z","updated":"2024-11-06T11:32:02Z"},{"id":"wordfence:68fc0a8b-b667-49fd-b015-ced27f5ccce8","source":"wordfence","cve":"CVE-2024-31250","title":"WP Server Health Stats <= 1.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fc0a8b-b667-49fd-b015-ced27f5ccce8?source=api-prod","affected":[{"type":"plugin","slug":"wp-server-stats","name":"WP Server Health Stats","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:15:53Z"},{"id":"wordfence:68fd5e6f-9883-4e8f-9c4f-5905b487629a","source":"wordfence","cve":"CVE-2023-0424","title":"MS-Reviews <= 1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fd5e6f-9883-4e8f-9c4f-5905b487629a?source=api-prod","affected":[{"type":"plugin","slug":"ms-reviews","name":"MS-Reviews","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68fe0f74-96d7-4d5b-99a2-dff4f1c9d30b","source":"wordfence","cve":"CVE-2021-34659","title":"Plugmatter Pricing Table Lite  <= 1.0.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fe0f74-96d7-4d5b-99a2-dff4f1c9d30b?source=api-prod","affected":[{"type":"plugin","slug":"plugmatter-pricing-table","name":"Plugmatter Pricing Table Lite ","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68fe17e2-d5ab-4ebd-a5c6-d65cea327abd","source":"wordfence","cve":"CVE-2021-4330","title":"Envato Elements <= 2.0.10 & Template Kit <= 1.0.13  - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fe17e2-d5ab-4ebd-a5c6-d65cea327abd?source=api-prod","affected":[{"type":"plugin","slug":"template-kit-import","name":"Template Kit \u2013 Import","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"},{"type":"plugin","slug":"envato-elements","name":"Envato Elements \u2013 Photos & Elementor Templates","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2021-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:68fee8cb-476d-4962-b830-59fd823329ac","source":"wordfence","cve":"CVE-2022-33142","title":"Better Messages <= 1.9.10.57 - Resource Exhaustion","severity":"high","cvss":7.7,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/68fee8cb-476d-4962-b830-59fd823329ac?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.10.57","to_inclusive":true,"patched_in":"1.9.10.58"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69007bd5-cbfa-47f1-acef-29ff493959f0","source":"wordfence","cve":"CVE-2024-44030","title":"Checkout Mestres WP <= 8.6 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69007bd5-cbfa-47f1-acef-29ff493959f0?source=api-prod","affected":[{"type":"plugin","slug":"checkout-mestres-wp","name":"Checkout Mestres do WP for WooCommerce","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:31:02Z"},{"id":"wordfence:6901648a-b54f-4d20-bc22-65731fab13b9","source":"wordfence","cve":"CVE-2025-28931","title":"Hashtags <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6901648a-b54f-4d20-bc22-65731fab13b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-hashtags","name":"WordPress Hashtags","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:19:19Z"},{"id":"wordfence:6902180a-dd74-4c50-bce2-75cef88241e9","source":"wordfence","cve":"CVE-2025-14312","title":"Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6902180a-dd74-4c50-bce2-75cef88241e9?source=api-prod","affected":[{"type":"plugin","slug":"advance-wp-query-search-filter","name":"Advance WP Query Search Filter","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-09T00:00:00Z","updated":"2026-01-06T16:17:21Z"},{"id":"wordfence:69025975-9fb7-47a7-9dea-68f4c01d5fdc","source":"wordfence","cve":"CVE-2021-24599","title":"Email Encoder <= 2.1.1 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69025975-9fb7-47a7-9dea-68f4c01d5fdc?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6903e37e-5251-47bb-8023-755821af4689","source":"wordfence","cve":"CVE-2023-46621","title":"User Avatar <= 1.4.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6903e37e-5251-47bb-8023-755821af4689?source=api-prod","affected":[{"type":"plugin","slug":"user-avatar","name":"User Avatar","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6904f168-e06f-4f17-905b-a943a39dfbdb","source":"wordfence","cve":"CVE-2025-5818","title":"Featured Image Plus \u2013 Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-plus","name":"Featured Image Plus \u2013 Bulk Edit Featured Images, Unsplash & Alt Text Manager","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2025-07-22T14:05:14Z","updated":"2025-07-25T14:59:45Z"},{"id":"wordfence:69070482-772a-4df2-952a-d291ce45c72b","source":"wordfence","cve":"CVE-2025-53983","title":"JetElements For Elementor <= 2.7.7 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69070482-772a-4df2-952a-d291ce45c72b?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.7.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:52:06Z"},{"id":"wordfence:690b74d7-2d4f-4aa6-8d1c-674887260fe4","source":"wordfence","cve":"CVE-2026-32556","title":"Boost <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690b74d7-2d4f-4aa6-8d1c-674887260fe4?source=api-prod","affected":[{"type":"plugin","slug":"boost","name":"Boost","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T10:47:47Z","updated":"2026-09-10T19:11:09Z"},{"id":"wordfence:690cc457-7951-4a4d-979b-8464513a3b50","source":"wordfence","cve":"CVE-2024-43956","title":"Memberpress <= 1.11.34 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690cc457-7951-4a4d-979b-8464513a3b50?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.34","to_inclusive":true,"patched_in":"1.11.35"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-30T13:47:35Z"},{"id":"wordfence:690cc6c5-4943-4fc1-82e0-071082c49254","source":"wordfence","cve":"CVE-2026-86787","title":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display < 3.9.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690cc6c5-4943-4fc1-82e0-071082c49254?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":false,"patched_in":"3.9.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:37:06Z"},{"id":"wordfence:690d23ee-cf70-4ecf-8cd2-21f673788d5f","source":"wordfence","cve":"CVE-2026-96660","title":"User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690d23ee-cf70-4ecf-8cd2-21f673788d5f?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-16T14:40:38Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:690e7f00-d9db-4912-9438-7fcbcb026800","source":"wordfence","cve":"CVE-2025-2893","title":"Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690e7f00-d9db-4912-9438-7fcbcb026800?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-04-28T17:26:18Z","updated":"2025-04-29T06:37:49Z"},{"id":"wordfence:690fd38c-0e12-45f3-9055-51252e4809b1","source":"wordfence","cve":"CVE-2026-11328","title":"Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/690fd38c-0e12-45f3-9055-51252e4809b1?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.9.9"}],"published":"2026-07-06T11:49:10Z","updated":"2026-07-10T08:13:10Z"},{"id":"wordfence:6913a08d-c997-4f58-bec1-eeae08a5b6c9","source":"wordfence","cve":"CVE-2025-25118","title":"Top Bar \u2013 PopUps \u2013 by WPOptin <= 2.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6913a08d-c997-4f58-bec1-eeae08a5b6c9?source=api-prod","affected":[{"type":"plugin","slug":"wpoptin","name":"WPOptin \u2013 AI-Powered Top Bars, PopUps & Lead Generation","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:49:35Z"},{"id":"wordfence:6913ae56-e8a2-40df-ae99-b1957193ccbe","source":"wordfence","cve":"CVE-2025-22734","title":"Posts Footer Manager <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6913ae56-e8a2-40df-ae99-b1957193ccbe?source=api-prod","affected":[{"type":"plugin","slug":"intelly-posts-footer-manager","name":"Posts Footer Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T16:54:29Z"},{"id":"wordfence:69149cbc-5a51-4838-9f47-3b920a1c9d6b","source":"wordfence","cve":"CVE-2026-87835","title":"Front End Users <= 3.2.35 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69149cbc-5a51-4838-9f47-3b920a1c9d6b?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.35","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T01:27:43Z"},{"id":"wordfence:69150437-dfd6-436a-b100-99f5001c7fe7","source":"wordfence","cve":"CVE-2015-9363","title":"iThemes Exchange < 1.12.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69150437-dfd6-436a-b100-99f5001c7fe7?source=api-prod","affected":[{"type":"plugin","slug":"ithemes-exchange","name":"ithemes-exchange","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6915931e-fcad-4eca-9be5-f0b8f5c4aec2","source":"wordfence","cve":"CVE-2026-57699","title":"Slider Pro <= 4.8.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6915931e-fcad-4eca-9be5-f0b8f5c4aec2?source=api-prod","affected":[{"type":"plugin","slug":"sliderpro","name":"Slider Pro","from":"*","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"4.8.14"}],"published":"2026-07-20T00:00:00Z","updated":"2026-07-27T15:42:58Z"},{"id":"wordfence:6918bbc2-ad9d-4d3b-8cdf-bf906bae180c","source":"wordfence","cve":"CVE-2025-23960","title":"Save & Import Image from URL <= 0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6918bbc2-ad9d-4d3b-8cdf-bf906bae180c?source=api-prod","affected":[{"type":"plugin","slug":"save-import-image-from-url","name":"Save & Import Image from URL","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:15:08Z"},{"id":"wordfence:691962c2-e67f-4f6e-9002-6f2a4ccbbdee","source":"wordfence","cve":"CVE-2020-9003","title":"Modula Image Gallery <= 2.2.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691962c2-e67f-4f6e-9002-6f2a4ccbbdee?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2020-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:691b080c-052a-4967-a251-98a17038448d","source":"wordfence","cve":"CVE-2014-4559","title":"WP e-Commerce Swipe plugin <= 3.1.0 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691b080c-052a-4967-a251-98a17038448d?source=api-prod","affected":[{"type":"plugin","slug":"swipehq-payment-gateway-wp-e-commerce","name":"WP e-Commerce Swipe plugin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:691b7428-73e5-4800-85a1-19daa85aff4e","source":"wordfence","cve":"CVE-2024-24883","title":"Prime Slider \u2013 Addons For Elementor <= 3.11.10 - Incorrect Authorization via bdt_duplicate_as_draft","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691b7428-73e5-4800-85a1-19daa85aff4e?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.11.10","to_inclusive":true,"patched_in":"3.11.11"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:09:00Z"},{"id":"wordfence:691c0f3b-b723-4310-b4df-ed3e1db9d548","source":"wordfence","cve":"","title":"WP Plugin Info Card < 2.3.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691c0f3b-b723-4310-b4df-ed3e1db9d548?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-info-card","name":"WP Plugin Info Card \u2013 Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2015-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:691e355f-9963-4e94-86f4-b9166262310b","source":"wordfence","cve":"CVE-2026-112347","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.4.0 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691e355f-9963-4e94-86f4-b9166262310b?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:25:12Z"},{"id":"wordfence:691eb4c1-18ba-433b-8725-70f2ecf89b0a","source":"wordfence","cve":"CVE-2022-4152","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691eb4c1-18ba-433b-8725-70f2ecf89b0a?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:691f86c2-efcd-43c2-8e7f-4cd5258014b2","source":"wordfence","cve":"CVE-2024-50537","title":"Smart Mockups <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/691f86c2-efcd-43c2-8e7f-4cd5258014b2?source=api-prod","affected":[{"type":"plugin","slug":"smart-mockups","name":"Smart Mockups","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:17:06Z"},{"id":"wordfence:6921c5a7-4895-40f0-99c4-90f78416820d","source":"wordfence","cve":"CVE-2022-34853","title":"Team <= 1.2.6 - Authenticated (Contibutor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6921c5a7-4895-40f0-99c4-90f78416820d?source=api-prod","affected":[{"type":"plugin","slug":"adl-team","name":"Team","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6921da1b-e63d-479a-9786-9b1bd8201d69","source":"wordfence","cve":"CVE-2024-5965","title":"Mosaic <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6921da1b-e63d-479a-9786-9b1bd8201d69?source=api-prod","affected":[{"type":"theme","slug":"mosaic","name":"Mosaic","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T15:08:54Z","updated":"2024-06-22T03:30:30Z"},{"id":"wordfence:69242be2-671f-417c-b527-844cee286f0f","source":"wordfence","cve":"CVE-2026-103351","title":"E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 - Missing Authroization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69242be2-671f-417c-b527-844cee286f0f?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-14T16:44:27Z"},{"id":"wordfence:692a5838-4a32-4444-b1a0-018fa25594a9","source":"wordfence","cve":"CVE-2024-13725","title":"Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/692a5838-4a32-4444-b1a0-018fa25594a9?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-official-opt-in-forms","name":"Keap Official Opt-in Forms","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-02-17T15:45:57Z","updated":"2025-04-04T13:04:06Z"},{"id":"wordfence:692e995d-cdfc-4ab8-8a8a-5423eb7f8d15","source":"wordfence","cve":"CVE-2023-34372","title":"Download SpamReferrerBlock <= 2.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/692e995d-cdfc-4ab8-8a8a-5423eb7f8d15?source=api-prod","affected":[{"type":"plugin","slug":"spamreferrerblock","name":"SpamReferrerBlock","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:692fe371-a22c-4144-a17f-bde1c1850bfa","source":"wordfence","cve":"CVE-2025-49918","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/692fe371-a22c-4144-a17f-bde1c1850bfa?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-11-07T00:00:00Z","updated":"2025-12-19T21:02:18Z"},{"id":"wordfence:6931b3b3-b1b5-4ab8-8592-82332d16168c","source":"wordfence","cve":"CVE-2025-22542","title":"Virtual Bot <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6931b3b3-b1b5-4ab8-8592-82332d16168c?source=api-prod","affected":[{"type":"plugin","slug":"virtual-bot","name":"Virtual Bot","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:28:01Z"},{"id":"wordfence:69347507-b9fe-4334-a428-e874173ddbb8","source":"wordfence","cve":"CVE-2026-11966","title":"User Registration & Membership <= 5.2.2 - Missing Authorization to Unauthenticated User Deletion via Stripe Handler","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69347507-b9fe-4334-a428-e874173ddbb8?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T12:11:05Z"},{"id":"wordfence:6935bca8-ad64-4c55-9cf0-c7dd088d8c0c","source":"wordfence","cve":"CVE-2022-1772","title":"Google Places Reviews < 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6935bca8-ad64-4c55-9cf0-c7dd088d8c0c?source=api-prod","affected":[{"type":"plugin","slug":"google-places-reviews","name":"Reviews Block for Google","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2022-05-17T00:00:00Z","updated":"2024-06-06T16:05:24Z"},{"id":"wordfence:6937ff48-f4f1-4f63-a76c-8e13cdba5800","source":"wordfence","cve":"CVE-2026-62109","title":"Sky Addons for Elementor <= 3.8.4 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6937ff48-f4f1-4f63-a76c-8e13cdba5800?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.8.5"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:25:19Z"},{"id":"wordfence:693c7554-5122-4527-8a9c-aa31ea9623b7","source":"wordfence","cve":"CVE-2026-87909","title":"WP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection","severity":"high","cvss":7.5,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/693c7554-5122-4527-8a9c-aa31ea9623b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.09.002","to_inclusive":true,"patched_in":"9.3.01.003"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-19T02:27:10Z"},{"id":"wordfence:693fbac2-46b8-4771-99b5-6cd97096286e","source":"wordfence","cve":"CVE-2021-25042","title":"WP Visitor Statistics (Real Time Traffic) <= 5.4 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/693fbac2-46b8-4771-99b5-6cd97096286e?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:694005fc-7703-4343-a7b4-d36906869df3","source":"wordfence","cve":"CVE-2016-10762","title":"CampTix Event Ticketing <= 1.4.2 - CSV Injection","severity":"medium","cvss":5.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694005fc-7703-4343-a7b4-d36906869df3?source=api-prod","affected":[{"type":"plugin","slug":"camptix","name":"CampTix Event Ticketing","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2016-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69401e9f-6bd3-49b8-8ebd-6904db680610","source":"wordfence","cve":"CVE-2018-5312","title":"WP Tabs \u2013 Responsive Tabs Plugin for WordPress <= 1.8.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69401e9f-6bd3-49b8-8ebd-6904db680610?source=api-prod","affected":[{"type":"plugin","slug":"wp-expand-tabs-free","name":"Custom Product Tabs for WooCommerce & WordPress Tabs Builder \u2013 Smart Tabs","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2018-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6940cfbb-2592-47bf-8e73-6a7cb34ff448","source":"wordfence","cve":"CVE-2026-39526","title":"WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6940cfbb-2592-47bf-8e73-6a7cb34ff448?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.11.2","to_inclusive":false,"patched_in":"4.11.2"}],"published":"2026-03-11T00:00:00Z","updated":"2026-05-05T15:01:36Z"},{"id":"wordfence:6942b352-2468-4310-a69c-2590b3b3a4a8","source":"wordfence","cve":"CVE-2024-49226","title":"TAKETIN To WP Membership <= 2.8.12 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6942b352-2468-4310-a69c-2590b3b3a4a8?source=api-prod","affected":[{"type":"plugin","slug":"taketin-to-wp-membership","name":"TAKETIN To WP Membership","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2025-08-22T15:27:34Z"},{"id":"wordfence:69430e1a-db2f-4715-84aa-5a1dfd712180","source":"wordfence","cve":"CVE-2023-52212","title":"WP Job Manager <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69430e1a-db2f-4715-84aa-5a1dfd712180?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69435cb6-9591-45bb-86e3-eaf1a9bc46f9","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69435cb6-9591-45bb-86e3-eaf1a9bc46f9?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.18","to_inclusive":true,"patched_in":"2.9.19"}],"published":"2015-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69455500-e6fb-4f01-8855-de595025fabe","source":"wordfence","cve":"CVE-2026-27047","title":"Curly Core <= 2.1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69455500-e6fb-4f01-8855-de595025fabe?source=api-prod","affected":[{"type":"plugin","slug":"curly-core","name":"Curly Core","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-04-15T13:42:14Z"},{"id":"wordfence:69475bec-1f27-4793-8697-1132ac701c62","source":"wordfence","cve":"CVE-2024-3945","title":"WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69475bec-1f27-4793-8697-1132ac701c62?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-05-29T15:54:07Z","updated":"2025-11-06T15:01:01Z"},{"id":"wordfence:69485409-8e91-4651-b9b8-69beb2364fa8","source":"wordfence","cve":"CVE-2024-11913","title":"Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69485409-8e91-4651-b9b8-69beb2364fa8?source=api-prod","affected":[{"type":"plugin","slug":"bp-activity-plus-reloaded","name":"Activity Plus Reloaded for BuddyPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T13:40:57Z"},{"id":"wordfence:694b05bf-7779-4365-811e-029408922ec9","source":"wordfence","cve":"CVE-2026-32415","title":"Squeeze <= 1.7.7 - Authenticated (Subscriber+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694b05bf-7779-4365-811e-029408922ec9?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2026-02-25T00:00:00Z","updated":"2026-05-05T14:24:24Z"},{"id":"wordfence:694b67d2-7d60-4764-a2c0-02698c331772","source":"wordfence","cve":"CVE-2026-7515","title":"BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694b67d2-7d60-4764-a2c0-02698c331772?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs-pro","name":"BetterDocs Pro","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-06-18T17:00:31Z","updated":"2026-06-19T05:33:32Z"},{"id":"wordfence:694c120a-d9cb-46a6-be24-9f1530bc2183","source":"wordfence","cve":"CVE-2022-38093","title":"All in One SEO <= 4.2.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694c120a-d9cb-46a6-be24-9f1530bc2183?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.2.3.1","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:694c3a52-959d-47ed-b534-d40ad6f2585e","source":"wordfence","cve":"CVE-2026-39444","title":"Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694c3a52-959d-47ed-b534-d40ad6f2585e?source=api-prod","affected":[{"type":"plugin","slug":"organize-series","name":"Issues and Series for Newspapers, Magazines, Publishers, Writers","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-10-02T14:45:00Z","updated":"2026-10-08T23:36:54Z"},{"id":"wordfence:694d0b49-c4dd-40f0-99c9-5eb8c3c08ba9","source":"wordfence","cve":"CVE-2024-2087","title":"Brizy \u2013 Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694d0b49-c4dd-40f0-99c9-5eb8c3c08ba9?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.43","to_inclusive":true,"patched_in":"2.4.44"}],"published":"2024-06-04T17:29:06Z","updated":"2024-06-05T05:33:08Z"},{"id":"wordfence:694fe940-3d0a-4a71-99d3-bcf3a8010585","source":"wordfence","cve":"CVE-2022-0616","title":"Amelia <= 1.0.46 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/694fe940-3d0a-4a71-99d3-bcf3a8010585?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.47"}],"published":"2022-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69527d4b-49b6-47cd-93b6-39350f881ec9","source":"wordfence","cve":"CVE-2023-0085","title":"Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6953dea2-ca2d-4283-97c2-45c3420d9390","source":"wordfence","cve":"CVE-2023-5334","title":"WP Responsive header image slider <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6953dea2-ca2d-4283-97c2-45c3420d9390?source=api-prod","affected":[{"type":"plugin","slug":"responsive-header-image-slider","name":"WP Responsive header image slider","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6954364e-567c-407c-afc6-983b7257cc88","source":"wordfence","cve":"","title":"Quotes for WooCommerce <= 2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6954364e-567c-407c-afc6-983b7257cc88?source=api-prod","affected":[{"type":"plugin","slug":"quotes-for-woocommerce","name":"Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:695563a6-ced9-4951-bc92-0b59a374673f","source":"wordfence","cve":"CVE-2026-10862","title":"Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/695563a6-ced9-4951-bc92-0b59a374673f?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.25"}],"published":"2026-06-08T13:00:23Z","updated":"2026-06-09T01:27:27Z"},{"id":"wordfence:695819e6-2574-4047-a55d-a78289c29ba0","source":"wordfence","cve":"CVE-2021-24139","title":"Photo Gallery by 10Web <= 1.5.54 - SQL Injection via bwg_search_x Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/695819e6-2574-4047-a55d-a78289c29ba0?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.55","to_inclusive":false,"patched_in":"1.5.55"}],"published":"2020-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6959abd8-5c79-4be1-975d-905632b0f922","source":"wordfence","cve":"CVE-2025-26946","title":"WP Yelp Review Slider <= 8.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6959abd8-5c79-4be1-975d-905632b0f922?source=api-prod","affected":[{"type":"plugin","slug":"wp-yelp-review-slider","name":"WP Yelp Review Slider","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:42:39Z"},{"id":"wordfence:6959e7c4-2f21-4147-bee8-02719e2b3a84","source":"wordfence","cve":"CVE-2026-113500","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6959e7c4-2f21-4147-bee8-02719e2b3a84?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":false,"patched_in":"7.9.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:07:05Z"},{"id":"wordfence:695cb611-5f85-456e-aa7b-4b21410321fe","source":"wordfence","cve":"CVE-2026-32371","title":"Elegant Pink <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/695cb611-5f85-456e-aa7b-4b21410321fe?source=api-prod","affected":[{"type":"theme","slug":"elegant-pink","name":"Elegant Pink","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:52:27Z"},{"id":"wordfence:695df547-f068-4ac1-926f-80dbf75632dd","source":"wordfence","cve":"CVE-2024-12184","title":"WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/695df547-f068-4ac1-926f-80dbf75632dd?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:12Z"},{"id":"wordfence:69618c44-5298-4b03-a63a-76f195206c8b","source":"wordfence","cve":"CVE-2021-24451","title":"Export Users With Meta < 0.6.5 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69618c44-5298-4b03-a63a-76f195206c8b?source=api-prod","affected":[{"type":"plugin","slug":"user-export-with-their-meta-data","name":"Export Users With Meta","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":false,"patched_in":"0.6.5"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69621f20-90a6-4e13-a088-3e26cd8f647a","source":"wordfence","cve":"CVE-2026-62052","title":"Tipsy <= 1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69621f20-90a6-4e13-a088-3e26cd8f647a?source=api-prod","affected":[{"type":"theme","slug":"tipsy","name":"tipsy","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T07:27:27Z","updated":"2026-10-13T13:59:24Z"},{"id":"wordfence:69622613-e636-4c27-8d05-139149889fcb","source":"wordfence","cve":"CVE-2025-49402","title":"Exertio Framework <= 1.3.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69622613-e636-4c27-8d05-139149889fcb?source=api-prod","affected":[{"type":"plugin","slug":"exertio-framework","name":"Exertio Framework","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:55:42Z"},{"id":"wordfence:6963b3ed-1b88-49bb-aa2e-99905c14f4c6","source":"wordfence","cve":"CVE-2023-0094","title":"UpQode Google Maps <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6963b3ed-1b88-49bb-aa2e-99905c14f4c6?source=api-prod","affected":[{"type":"plugin","slug":"upqode-google-maps","name":"UpQode Google Maps","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:696495c5-c8f8-4790-af89-1ee911767b1b","source":"wordfence","cve":"CVE-2025-14451","title":"Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/696495c5-c8f8-4790-af89-1ee911767b1b?source=api-prod","affected":[{"type":"plugin","slug":"solutions-ad-manager","name":"Solutions Ad Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:09:08Z","updated":"2025-12-13T04:31:26Z"},{"id":"wordfence:69654827-842f-483d-ae4c-b9c7ae271f82","source":"wordfence","cve":"CVE-2021-24365","title":"Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69654827-842f-483d-ae4c-b9c7ae271f82?source=api-prod","affected":[{"type":"plugin","slug":"codepress-admin-columns","name":"Admin Columns","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":false,"patched_in":"4.3.2"},{"type":"plugin","slug":"admin-columns-pro","name":"Admin Columns Pro","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":false,"patched_in":"5.5.2"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69660595-0bd3-46d9-9802-856d1fe96f9f","source":"wordfence","cve":"CVE-2026-105197","title":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69660595-0bd3-46d9-9802-856d1fe96f9f?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":false,"patched_in":"5.6.5"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:34:29Z"},{"id":"wordfence:6966cf31-721b-4759-a4c2-4b20c6a7053d","source":"wordfence","cve":"CVE-2025-53559","title":"Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6966cf31-721b-4759-a4c2-4b20c6a7053d?source=api-prod","affected":[{"type":"plugin","slug":"lbg-universal-video-player-addon-visual-composer","name":"Universal Video Player - Addon for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2.0"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:39:16Z"},{"id":"wordfence:69692b0c-d3f8-418b-902a-b94f76937eb8","source":"wordfence","cve":"CVE-2026-2688","title":"CM HIPAA Forms <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69692b0c-d3f8-418b-902a-b94f76937eb8?source=api-prod","affected":[{"type":"plugin","slug":"codemonkeys-hipaa-forms","name":"HIPAA Forms","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-09-10T19:09:29Z"},{"id":"wordfence:69693a9a-fc9e-49ea-8c41-438ee6af7ee8","source":"wordfence","cve":"CVE-2022-0418","title":"Event List < 0.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69693a9a-fc9e-49ea-8c41-438ee6af7ee8?source=api-prod","affected":[{"type":"plugin","slug":"event-list","name":"Event List","from":"*","from_inclusive":true,"to":"0.8.7","to_inclusive":true,"patched_in":"0.8.8"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69695e2e-2086-4d50-8518-0b2f5ab9ea56","source":"wordfence","cve":"CVE-2024-43353","title":"myCred <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69695e2e-2086-4d50-8518-0b2f5ab9ea56?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:36:56Z"},{"id":"wordfence:696960f4-ed10-4b61-8292-ef407544ba69","source":"wordfence","cve":"CVE-2024-12275","title":"CanvasFlow <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/696960f4-ed10-4b61-8292-ef407544ba69?source=api-prod","affected":[{"type":"plugin","slug":"canvasflow","name":"Canvasflow for WordPress","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:51:04Z"},{"id":"wordfence:6969d281-f280-4714-9859-38ac66e9cc60","source":"wordfence","cve":"CVE-2024-4186","title":"Edwiser Bridge <= 3.0.5 - Authentication Bypass due to Missing Empty Value Check","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6969d281-f280-4714-9859-38ac66e9cc60?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-05-06T00:00:00Z","updated":"2024-10-12T18:01:25Z"},{"id":"wordfence:696c379a-c5a4-489f-8363-8aea9a4da814","source":"wordfence","cve":"CVE-2024-5554","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/696c379a-c5a4-489f-8363-8aea9a4da814?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-08T14:32:32Z"},{"id":"wordfence:696d5fe3-1344-461b-a26f-e5099a836c33","source":"wordfence","cve":"","title":"WP Job Manager < 1.23.8 - Multiple Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/696d5fe3-1344-461b-a26f-e5099a836c33?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"1.23.8","to_inclusive":false,"patched_in":"1.23.8"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:696f7c68-d19a-48ee-abc0-044f1734dfdb","source":"wordfence","cve":"CVE-2014-0165","title":"WordPress Core < 3.8.2 - Contributor Users Can Publish Posts","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/696f7c68-d19a-48ee-abc0-044f1734dfdb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2014-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:697105e6-3155-4199-9fee-914830674023","source":"wordfence","cve":"CVE-2024-53805","title":"WP Mailster <= 1.8.16.0 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697105e6-3155-4199-9fee-914830674023?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:24:48Z"},{"id":"wordfence:69711a11-96c2-458d-87f5-a3d8152ab20c","source":"wordfence","cve":"CVE-2024-32542","title":"Bulk Block Converter <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69711a11-96c2-458d-87f5-a3d8152ab20c?source=api-prod","affected":[{"type":"plugin","slug":"bulk-block-converter","name":"Bulk Block Converter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T15:50:55Z"},{"id":"wordfence:6971eea0-9d0b-4a7f-be05-001c34770c2f","source":"wordfence","cve":"","title":"Ping List Pro <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6971eea0-9d0b-4a7f-be05-001c34770c2f?source=api-prod","affected":[{"type":"plugin","slug":"ping-list-pro","name":"Ping List Pro","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69725919-490c-4357-872c-d8112af5fe40","source":"wordfence","cve":"","title":"Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69725919-490c-4357-872c-d8112af5fe40?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6972f776-993c-4e5f-b347-5c784c42601c","source":"wordfence","cve":"CVE-2021-36848","title":"Social Media Feather <= 2.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6972f776-993c-4e5f-b347-5c784c42601c?source=api-prod","affected":[{"type":"plugin","slug":"social-media-feather","name":"Social Media Feather","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-02-10T14:33:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6973c8e0-d14b-4945-be1c-b7c8b44a4bcf","source":"wordfence","cve":"CVE-2024-29136","title":"Tourfic <= 2.11.17 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6973c8e0-d14b-4945-be1c-b7c8b44a4bcf?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.11.17","to_inclusive":true,"patched_in":"2.11.19"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:59:49Z"},{"id":"wordfence:6975e84e-06ab-41b1-ae39-64685a878d15","source":"wordfence","cve":"CVE-2021-36865","title":"Quiz And Survey Master \u2013 Best Quiz, Exam and Survey Plugin for WordPress <= 7.3.4 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6975e84e-06ab-41b1-ae39-64685a878d15?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6976c62b-9457-481a-b71f-ccd13d74e222","source":"wordfence","cve":"CVE-2026-1542","title":"Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6976c62b-9457-481a-b71f-ccd13d74e222?source=api-prod","affected":[{"type":"plugin","slug":"super-stage-wp","name":"Super Stage WP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-14T14:32:17Z"},{"id":"wordfence:6979f943-f348-4750-932f-54f0011cd23c","source":"wordfence","cve":"CVE-2026-57627","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6979f943-f348-4750-932f-54f0011cd23c?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:34:19Z"},{"id":"wordfence:697a3235-cf3a-4ec8-b8d2-60ed110d0d24","source":"wordfence","cve":"CVE-2026-28051","title":"Yacht Rental <= 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697a3235-cf3a-4ec8-b8d2-60ed110d0d24?source=api-prod","affected":[{"type":"theme","slug":"yacht-rental","name":"Yacht Rental - Boat Services WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:09:08Z"},{"id":"wordfence:697a3f53-3357-467a-8547-a440ee299f90","source":"wordfence","cve":"CVE-2025-68994","title":"Product Loops for WooCommerce <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697a3f53-3357-467a-8547-a440ee299f90?source=api-prod","affected":[{"type":"plugin","slug":"product-loops","name":"Product Loops for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-06T15:29:36Z"},{"id":"wordfence:697ce433-f321-4977-a2ad-68369d9ce9c3","source":"wordfence","cve":"CVE-2023-0714","title":"Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697ce433-f321-4977-a2ad-68369d9ce9c3?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T09:38:58Z"},{"id":"wordfence:697e8954-5adb-472a-a961-4e14f22d3b66","source":"wordfence","cve":"CVE-2022-4362","title":"Popup Maker <= 1.16.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697e8954-5adb-472a-a961-4e14f22d3b66?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.16.8","to_inclusive":true,"patched_in":"1.16.9"}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:697e9828-2bc9-4732-b564-4cb44a1dc369","source":"wordfence","cve":"CVE-2022-1844","title":"WP Sentry <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697e9828-2bc9-4732-b564-4cb44a1dc369?source=api-prod","affected":[{"type":"plugin","slug":"wp-sentry","name":"WP Sentry","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:697f3432-63b7-42d6-b188-812165cd2020","source":"wordfence","cve":"CVE-2025-6220","title":"Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/697f3432-63b7-42d6-b188-812165cd2020?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.12","to_inclusive":true,"patched_in":"3.5.13"}],"published":"2025-06-17T22:49:16Z","updated":"2025-06-18T11:16:32Z"},{"id":"wordfence:6980112b-a555-47a4-b2d7-f0187d52fc63","source":"wordfence","cve":"CVE-2025-7696","title":"Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6980112b-a555-47a4-b2d7-f0187d52fc63?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-contact-form-7-and-pipedrive","name":"Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-07-18T16:22:53Z","updated":"2025-07-19T04:23:02Z"},{"id":"wordfence:6980248b-195d-4e03-853e-a767a9a4b513","source":"wordfence","cve":"CVE-2024-56059","title":"Partners <= 0.2.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6980248b-195d-4e03-853e-a767a9a4b513?source=api-prod","affected":[{"type":"plugin","slug":"partners","name":"Partners","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:13:34Z"},{"id":"wordfence:698079d0-b539-431c-98c3-c69d0352d214","source":"wordfence","cve":"CVE-2023-23788","title":"Custom More Link Complete <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/698079d0-b539-431c-98c3-c69d0352d214?source=api-prod","affected":[{"type":"plugin","slug":"custom-more-link-complete","name":"Custom More Link Complete","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6985a8bb-0ad5-4b02-9a95-9dbc6018dec0","source":"wordfence","cve":"CVE-2023-46091","title":"Category SEO Meta Tags <= 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6985a8bb-0ad5-4b02-9a95-9dbc6018dec0?source=api-prod","affected":[{"type":"plugin","slug":"category-seo-meta-tags","name":"Category SEO Meta Tags","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6985e92d-0e7c-409c-a4ab-1edbadad3715","source":"wordfence","cve":"CVE-2022-38704","title":"SEO Redirection Plugin \u2013 301 Redirect Manager <= 8.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6985e92d-0e7c-409c-a4ab-1edbadad3715?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"8.9","to_inclusive":true,"patched_in":"9.1"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:698728b9-a4ba-4fd1-8ad4-37c148fb3d95","source":"wordfence","cve":"CVE-2025-39392","title":"WPAMS <= 44.0 (17-08-2023) - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/698728b9-a4ba-4fd1-8ad4-37c148fb3d95?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:46:35Z"},{"id":"wordfence:69885963-b103-473d-8751-d79f45e88e94","source":"wordfence","cve":"CVE-2025-32578","title":"Coming Soon Countdown <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69885963-b103-473d-8751-d79f45e88e94?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-countdown","name":"Coming Soon Countdown","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:18:12Z"},{"id":"wordfence:6989e54b-ce5e-4c79-bd0d-0f7978a4bd44","source":"wordfence","cve":"CVE-2015-9452","title":"NEX-Forms \u2013 Ultimate Form Builder < 4.6.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6989e54b-ce5e-4c79-bd0d-0f7978a4bd44?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":false,"patched_in":"4.6.1"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:698c8c4e-77ca-491c-bdd5-4a3d3b99b1b4","source":"wordfence","cve":"CVE-2024-30518","title":"Custom WooCommerce Checkout Fields Editor <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/698c8c4e-77ca-491c-bdd5-4a3d3b99b1b4?source=api-prod","affected":[{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T17:03:19Z"},{"id":"wordfence:69902627-ce79-4a43-8949-43db6a9cc0dd","source":"wordfence","cve":"CVE-2023-5431","title":"Left right image slideshow gallery <= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69902627-ce79-4a43-8949-43db6a9cc0dd?source=api-prod","affected":[{"type":"plugin","slug":"left-right-image-slideshow-gallery","name":"Left right image slideshow gallery","from":"*","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":"12.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69903c2e-749a-4a7d-99a2-b63c26d4170a","source":"wordfence","cve":"","title":"Eunoia (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69903c2e-749a-4a7d-99a2-b63c26d4170a?source=api-prod","affected":[{"type":"theme","slug":"eunoia","name":"Eunoia","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6990abdc-232f-4c25-8cba-c2639f315434","source":"wordfence","cve":"CVE-2022-1391","title":"Cab fare calculator <= 1.0.3 - Unauthenticated Local File Inclusion","severity":"medium","cvss":6.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6990abdc-232f-4c25-8cba-c2639f315434?source=api-prod","affected":[{"type":"plugin","slug":"cab-fare-calculator","name":"Cab fare calculator","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69911634-1281-487c-87f1-37f6e4b016c9","source":"wordfence","cve":"CVE-2026-5093","title":"Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69911634-1281-487c-87f1-37f6e4b016c9?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.9","to_inclusive":true,"patched_in":"12.9.0"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T13:27:15Z"},{"id":"wordfence:69938f8a-cd43-426c-8746-0c7dc1d65582","source":"wordfence","cve":"CVE-2024-38677","title":"REVIEWS.io <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69938f8a-cd43-426c-8746-0c7dc1d65582?source=api-prod","affected":[{"type":"plugin","slug":"reviewscouk-for-woocommerce","name":"REVIEWS.io for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-30T20:18:05Z"},{"id":"wordfence:699392b4-8270-47b5-90c1-5280d1389586","source":"wordfence","cve":"CVE-2025-14131","title":"WP Widget Changer <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699392b4-8270-47b5-90c1-5280d1389586?source=api-prod","affected":[{"type":"plugin","slug":"wp-widget-changer","name":"WP Widget Changer","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:31:35Z","updated":"2026-01-07T09:20:59Z"},{"id":"wordfence:699459a1-d407-4561-9d08-dd5d918ea601","source":"wordfence","cve":"CVE-2023-47810","title":"Ajax Domain Checker <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699459a1-d407-4561-9d08-dd5d918ea601?source=api-prod","affected":[{"type":"plugin","slug":"ajax-domain-checker","name":"Ajax Domain Checker","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69962453-2b70-4246-9c66-8f94df5a9a7f","source":"wordfence","cve":"CVE-2026-81420","title":"Tcard WP <= 1.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69962453-2b70-4246-9c66-8f94df5a9a7f?source=api-prod","affected":[{"type":"plugin","slug":"tcard-wp","name":"Tcard WP","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:08:57Z"},{"id":"wordfence:69971673-e317-452c-8c54-97de006a214f","source":"wordfence","cve":"CVE-2023-37978","title":"HTTP Headers <= 1.18.11 - Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69971673-e317-452c-8c54-97de006a214f?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.18.11","to_inclusive":true,"patched_in":"1.19.0"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6998cf4c-6086-402b-a95f-ee6a4980dffb","source":"wordfence","cve":"CVE-2023-3169","title":"tagDiv Composer <= 4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6998cf4c-6086-402b-a95f-ee6a4980dffb?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:699a83e0-1b92-4f16-9e8f-40576afaaa01","source":"wordfence","cve":"CVE-2024-35694","title":"WPMobile.App \u2014 Android and iOS Mobile Application <= 11.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699a83e0-1b92-4f16-9e8f-40576afaaa01?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.41","to_inclusive":true,"patched_in":"11.42"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:29:10Z"},{"id":"wordfence:699d5e15-b638-4447-a367-aa349a330d23","source":"wordfence","cve":"CVE-2025-31605","title":"Welcome Popup <= 1.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699d5e15-b638-4447-a367-aa349a330d23?source=api-prod","affected":[{"type":"plugin","slug":"welcome-popup","name":"Welcome Popup","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T20:45:15Z"},{"id":"wordfence:699e41ad-1991-4100-9ef2-caea7743e45b","source":"wordfence","cve":"CVE-2026-9243","title":"The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699e41ad-1991-4100-9ef2-caea7743e45b?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.15","to_inclusive":true,"patched_in":"6.4.16"}],"published":"2026-05-28T18:38:13Z","updated":"2026-05-29T06:43:44Z"},{"id":"wordfence:699e5c80-8a11-4f67-8b17-41170d9c6411","source":"wordfence","cve":"CVE-2024-1341","title":"Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699e5c80-8a11-4f67-8b17-41170d9c6411?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2024.1","to_inclusive":true,"patched_in":"2024.2"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T04:31:20Z"},{"id":"wordfence:699fc7f8-ed1f-465c-be37-f27a9dd74076","source":"wordfence","cve":"CVE-2024-11372","title":"Connexion Logs <= 3.0.2 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699fc7f8-ed1f-465c-be37-f27a9dd74076?source=api-prod","affected":[{"type":"plugin","slug":"logs-de-connexion","name":"Connexion Logs","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2025-03-27T13:09:07Z"},{"id":"wordfence:699fdea9-15ae-4882-9723-9a98d7d53c74","source":"wordfence","cve":"CVE-2024-9109","title":"UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/699fdea9-15ae-4882-9723-9a98d7d53c74?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping-ups","name":"Shipping Live Rates and Access Points for UPS for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-10-24T16:50:23Z","updated":"2024-10-29T12:49:51Z"},{"id":"wordfence:69a0262e-6061-4139-ac59-b1a13dd2f147","source":"wordfence","cve":"","title":"Sermon Browser < 0.43.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a0262e-6061-4139-ac59-b1a13dd2f147?source=api-prod","affected":[{"type":"plugin","slug":"sermon-browser","name":"Sermon Browser","from":"*","from_inclusive":true,"to":"0.43.6","to_inclusive":false,"patched_in":"0.43.6"}],"published":"2011-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69a0d985-cc85-45ba-889d-1ed30d06f9ce","source":"wordfence","cve":"CVE-2025-12377","title":"Gallery Plugin for WordPress \u2013 Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a0d985-cc85-45ba-889d-1ed30d06f9ce?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2025-11-12T00:00:00Z","updated":"2025-12-15T02:21:24Z"},{"id":"wordfence:69a14e2f-442e-421c-bf5d-0bff3b822911","source":"wordfence","cve":"CVE-2024-43352","title":"GivingPress Lite <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a14e2f-442e-421c-bf5d-0bff3b822911?source=api-prod","affected":[{"type":"theme","slug":"givingpress-lite","name":"GivingPress Lite","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T12:57:28Z"},{"id":"wordfence:69a22238-88e8-4ff5-8e2b-8c58a04ff154","source":"wordfence","cve":"CVE-2026-19760","title":"WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a22238-88e8-4ff5-8e2b-8c58a04ff154?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-08-25T17:14:25Z","updated":"2026-08-27T15:24:13Z"},{"id":"wordfence:69a2bce2-d731-41b9-840a-147c64cc7b3c","source":"wordfence","cve":"CVE-2025-32661","title":"Interactive US Map <= 2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a2bce2-d731-41b9-840a-147c64cc7b3c?source=api-prod","affected":[{"type":"plugin","slug":"interactive-us-map","name":"Interactive US Map","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:38:42Z"},{"id":"wordfence:69a464f4-c357-446f-a5b8-0919d9af56c9","source":"wordfence","cve":"CVE-2024-11720","title":"Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a464f4-c357-446f-a5b8-0919d9af56c9?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.24.5","to_inclusive":true,"patched_in":"3.25.1"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T08:26:39Z"},{"id":"wordfence:69a6d8a5-0325-4436-8034-8353d2a68831","source":"wordfence","cve":"CVE-2026-28106","title":"B2BKing Premium < 5.4.20 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a6d8a5-0325-4436-8034-8353d2a68831?source=api-prod","affected":[{"type":"plugin","slug":"b2bking","name":"B2Bking","from":"*","from_inclusive":true,"to":"5.4.20","to_inclusive":false,"patched_in":"5.4.20"}],"published":"2025-09-26T00:00:00Z","updated":"2026-05-05T13:29:45Z"},{"id":"wordfence:69a7d3fe-a873-448b-8e7a-f9e20d451be4","source":"wordfence","cve":"CVE-2026-57669","title":"Advanced Contact form 7 DB <= 2.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a7d3fe-a873-448b-8e7a-f9e20d451be4?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:50:53Z"},{"id":"wordfence:69a85ee3-1a26-443d-9ae8-6c6e965e7401","source":"wordfence","cve":"CVE-2025-68847","title":"iSape <= 0.72 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a85ee3-1a26-443d-9ae8-6c6e965e7401?source=api-prod","affected":[{"type":"plugin","slug":"isape","name":"iSape","from":"*","from_inclusive":true,"to":"0.72","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:21:23Z"},{"id":"wordfence:69a9f449-9f94-4da3-9fd0-4eac72b6d8be","source":"wordfence","cve":"CVE-2019-6030","title":"Custom Body Class <= 0.6.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69a9f449-9f94-4da3-9fd0-4eac72b6d8be?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-body-class","name":"Custom Body Class","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":"0.7.0"}],"published":"2019-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69aa2287-3d26-43e2-a2d0-4985ed17d096","source":"wordfence","cve":"CVE-2024-10708","title":"System Dashboard <= 2.8.14 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69aa2287-3d26-43e2-a2d0-4985ed17d096?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.14","to_inclusive":true,"patched_in":"2.8.15"}],"published":"2024-11-19T00:00:00Z","updated":"2024-12-12T18:22:07Z"},{"id":"wordfence:69aa4fd2-e331-4aa6-b8d1-b81007496357","source":"wordfence","cve":"CVE-2025-50030","title":"Spark Multipurpose <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69aa4fd2-e331-4aa6-b8d1-b81007496357?source=api-prod","affected":[{"type":"theme","slug":"spark-multipurpose","name":"Spark Multipurpose","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:54:02Z"},{"id":"wordfence:69ab17fc-8290-4230-8c44-25d12009c08a","source":"wordfence","cve":"CVE-2023-51522","title":"Paid Member Subscriptions <= 2.10.4 - Cross-Site Request Forgery via ajax_add_log_entry","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ab17fc-8290-4230-8c44-25d12009c08a?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69ab18a4-e3f2-42d4-bb3d-efb792a77c31","source":"wordfence","cve":"CVE-2025-32307","title":"Chameleon HTML5 Audio Player With/Without Playlist <= 3.5.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ab18a4-e3f2-42d4-bb3d-efb792a77c31?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio1-html5","name":"Chameleon HTML5 Audio Player With/Without Playlist","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:13:42Z"},{"id":"wordfence:69ab404b-1c2f-441b-8622-3cf830587d95","source":"wordfence","cve":"CVE-2024-3896","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ab404b-1c2f-441b-8622-3cf830587d95?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2024-07-24T00:12:34Z","updated":"2024-07-24T12:43:37Z"},{"id":"wordfence:69ac1e37-4e31-4dce-a2d6-07a4299995c5","source":"wordfence","cve":"CVE-2024-13319","title":"Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ac1e37-4e31-4dce-a2d6-07a4299995c5?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.5","to_inclusive":true,"patched_in":"7.6.6"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:29:41Z"},{"id":"wordfence:69ad89fc-6b4a-4b21-9713-23f198e086ea","source":"wordfence","cve":"CVE-2025-53284","title":"CMS Blocks <= 1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ad89fc-6b4a-4b21-9713-23f198e086ea?source=api-prod","affected":[{"type":"plugin","slug":"cms-blocks","name":"CMS Blocks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:34:31Z"},{"id":"wordfence:69b173ec-f7e9-4473-9b85-9a204a51cdf5","source":"wordfence","cve":"CVE-2019-13478","title":"Yoast SEO <= 11.5 - Authenticated Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69b173ec-f7e9-4473-9b85-9a204a51cdf5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"11.5","to_inclusive":true,"patched_in":"11.6-RC5"}],"published":"2019-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69b2f126-8f57-4bea-b0e9-14b4566ac470","source":"wordfence","cve":"CVE-2015-9323","title":"404 to 301 \u2013 Redirect, Log and Notify 404 Errors <= 2.0.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69b2f126-8f57-4bea-b0e9-14b4566ac470?source=api-prod","affected":[{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69b909da-b1b0-4dab-916c-908511f6556f","source":"wordfence","cve":"CVE-2026-12165","title":"Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.2","to_inclusive":true,"patched_in":"30.0.3"}],"published":"2026-06-16T20:57:12Z","updated":"2026-06-17T09:30:59Z"},{"id":"wordfence:69b9d4e1-895b-4199-bc4e-489afd9d36eb","source":"wordfence","cve":"CVE-2025-9493","title":"Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-editor","name":"Admin Menu Editor","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":"1.14.1"}],"published":"2025-09-05T15:11:45Z","updated":"2025-09-06T03:22:37Z"},{"id":"wordfence:69ba1a39-ddb0-4661-8104-d8bb71710e0c","source":"wordfence","cve":"CVE-2023-5659","title":"Interact: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ba1a39-ddb0-4661-8104-d8bb71710e0c?source=api-prod","affected":[{"type":"plugin","slug":"interact-quiz-embed","name":"Interact Quiz & Form Embed","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69bbe342-4969-4f82-aacb-7fd7bf65a75c","source":"wordfence","cve":"CVE-2024-13128","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69bbe342-4969-4f82-aacb-7fd7bf65a75c?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.5","to_inclusive":true,"patched_in":"4.2.7.5.1"}],"published":"2025-01-29T00:00:00Z","updated":"2025-05-29T18:05:08Z"},{"id":"wordfence:69bc3b17-87fd-4e69-b769-85bbf13b214e","source":"wordfence","cve":"CVE-2024-37921","title":"Chained Quiz <= 1.3.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69bc3b17-87fd-4e69-b769-85bbf13b214e?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.8","to_inclusive":true,"patched_in":"1.3.2.9"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-28T23:26:08Z"},{"id":"wordfence:69bd850d-79bf-429e-b133-6caefeba7377","source":"wordfence","cve":"CVE-2022-45071","title":"WPML <= 4.5.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69bd850d-79bf-429e-b133-6caefeba7377?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69bdd5e6-1334-42bc-a13f-215eb61733e7","source":"wordfence","cve":"","title":"Contus Video Comments <= 1.0 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69bdd5e6-1334-42bc-a13f-215eb61733e7?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-comments","name":"contus-video-comments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69beccd3-864c-42d7-8bf9-2e9cc9f6c81e","source":"wordfence","cve":"CVE-2025-63079","title":"Live Copy Paste for Elementor \u2013 Cross Domain Copy Paste & Page Duplicator <= 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69beccd3-864c-42d7-8bf9-2e9cc9f6c81e?source=api-prod","affected":[{"type":"plugin","slug":"live-copy-paste","name":"Live Copy Paste for Elementor \u2013 Cross Domain Copy Paste & Page Duplicator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-06-26T00:00:00Z","updated":"2026-08-25T23:31:00Z"},{"id":"wordfence:69c00ea4-c790-46a3-8046-b3782b02c2be","source":"wordfence","cve":"CVE-2025-66165","title":"Lottier for WPBakery <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69c00ea4-c790-46a3-8046-b3782b02c2be?source=api-prod","affected":[{"type":"plugin","slug":"lottier-wpbakery","name":"Lottier for WPBakery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:10:23Z"},{"id":"wordfence:69c176ae-fa98-40aa-80f5-7ed2f7626398","source":"wordfence","cve":"CVE-2026-85645","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69c176ae-fa98-40aa-80f5-7ed2f7626398?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.46","to_inclusive":true,"patched_in":"1.15.47"}],"published":"2026-09-09T17:29:48Z","updated":"2026-09-10T05:31:29Z"},{"id":"wordfence:69c7b0e4-89bf-480c-8e89-b1514d2bfefe","source":"wordfence","cve":"CVE-2022-30337","title":"WP Meta SEO <= 4.4.8 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69c7b0e4-89bf-480c-8e89-b1514d2bfefe?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69caeed4-f9e4-426a-9acb-1f52a6251072","source":"wordfence","cve":"CVE-2026-18039","title":"Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69caeed4-f9e4-426a-9acb-1f52a6251072?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.7.1","to_inclusive":true,"patched_in":"6.7.2"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-21T15:47:40Z"},{"id":"wordfence:69cb9ffe-891d-44dc-b600-f5ebc941ab47","source":"wordfence","cve":"CVE-2026-16736","title":"User Registration & Membership <= 5.2.5 - Missing Authorization to Unauthenticated Account Creation While Registration Disabled","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69cb9ffe-891d-44dc-b600-f5ebc941ab47?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:43:07Z"},{"id":"wordfence:69cc7b6c-b6c2-4bba-afb4-86ba1b36b295","source":"wordfence","cve":"CVE-2024-3490","title":"WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69cc7b6c-b6c2-4bba-afb4-86ba1b36b295?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.3.1","to_inclusive":true,"patched_in":"9.4.0"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T06:51:33Z"},{"id":"wordfence:69cf2f28-33ae-441e-95d2-01d187c7745a","source":"wordfence","cve":"","title":"Auto Upload Images <= 3.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69cf2f28-33ae-441e-95d2-01d187c7745a?source=api-prod","affected":[{"type":"plugin","slug":"auto-upload-images","name":"Auto Upload Images","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69d3d66c-5557-4fb4-8bd7-05d76d6b86ab","source":"wordfence","cve":"CVE-2024-1285","title":"Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69d3d66c-5557-4fb4-8bd7-05d76d6b86ab?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-sandwich","name":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:56:01Z"},{"id":"wordfence:69d3e61f-6aef-45ad-b29d-579fdf005ab7","source":"wordfence","cve":"CVE-2025-50018","title":"Tealium <= 2.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69d3e61f-6aef-45ad-b29d-579fdf005ab7?source=api-prod","affected":[{"type":"plugin","slug":"tealium","name":"Tealium","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.1.21"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-08T15:59:47Z"},{"id":"wordfence:69d48695-8165-42bd-b8f7-56c7394bcbcf","source":"wordfence","cve":"CVE-2025-48305","title":"Goal Tracker for Patreon <= 0.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69d48695-8165-42bd-b8f7-56c7394bcbcf?source=api-prod","affected":[{"type":"plugin","slug":"goal-tracker-for-patreon","name":"Goal Tracker for Patreon","from":"*","from_inclusive":true,"to":"0.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:08:43Z"},{"id":"wordfence:69d78334-2b38-43ee-acf6-c073d5826213","source":"wordfence","cve":"CVE-2025-8482","title":"Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69d78334-2b38-43ee-acf6-c073d5826213?source=api-prod","affected":[{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2025-08-11T18:20:29Z","updated":"2025-08-12T06:42:43Z"},{"id":"wordfence:69d957d3-a0d5-44ec-a9b0-8c9b41175379","source":"wordfence","cve":"CVE-2023-27621","title":"Livestream Notice <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69d957d3-a0d5-44ec-a9b0-8c9b41175379?source=api-prod","affected":[{"type":"plugin","slug":"livestream-notice","name":"Livestream Notice","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-07-05T00:00:00Z","updated":"2026-02-26T14:51:10Z"},{"id":"wordfence:69dc9236-8079-434f-b2b5-060a0c5eba46","source":"wordfence","cve":"CVE-2024-6703","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69dc9236-8079-434f-b2b5-060a0c5eba46?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T12:30:05Z"},{"id":"wordfence:69de4c0b-fda4-4dd0-80ae-2cdd53fc581b","source":"wordfence","cve":"CVE-2026-107756","title":"Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69de4c0b-fda4-4dd0-80ae-2cdd53fc581b?source=api-prod","affected":[{"type":"plugin","slug":"meow-lightbox","name":"Meow Lightbox","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-10-13T19:23:34Z","updated":"2026-10-14T07:43:34Z"},{"id":"wordfence:69de7d93-b255-4d41-8680-9762ff632804","source":"wordfence","cve":"CVE-2024-13816","title":"Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69de7d93-b255-4d41-8680-9762ff632804?source=api-prod","affected":[{"type":"plugin","slug":"aiomatic-automatic-ai-content-writer","name":"Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T08:22:56Z"},{"id":"wordfence:69df711e-45b7-446f-8944-247ca180e0d9","source":"wordfence","cve":"CVE-2025-13820","title":"Comments \u2013 wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69df711e-45b7-446f-8944-247ca180e0d9?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.39","to_inclusive":true,"patched_in":"7.6.40"}],"published":"2025-12-11T00:00:00Z","updated":"2026-01-06T16:28:31Z"},{"id":"wordfence:69e15a1b-4984-4889-8c57-a731a0334963","source":"wordfence","cve":"CVE-2024-25597","title":"Ultimate Reviews <= 3.2.8 - Unauthenticated stored Cross-Site Scripting via reviews","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69e15a1b-4984-4889-8c57-a731a0334963?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-reviews","name":"Ultimate Reviews","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:32:29Z"},{"id":"wordfence:69e92c75-5b14-43d9-a169-a1f8b51ab41d","source":"wordfence","cve":"CVE-2018-16363","title":"File Manager <= 2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69e92c75-5b14-43d9-a169-a1f8b51ab41d?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2018-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69ebfe9b-00be-459d-989f-64f420fa9b0b","source":"wordfence","cve":"CVE-2026-97077","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ebfe9b-00be-459d-989f-64f420fa9b0b?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:54:22Z"},{"id":"wordfence:69ec31f3-8ec8-40ad-ba7f-77f9132ad51f","source":"wordfence","cve":"","title":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.0.8 - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ec31f3-8ec8-40ad-ba7f-77f9132ad51f?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69ed990e-6c40-49d5-859c-768a5a6a803f","source":"wordfence","cve":"CVE-2017-6096","title":"Mail Masta <= 1.0 - SQL Injection via filter_list parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ed990e-6c40-49d5-859c-768a5a6a803f?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69f29a7a-5671-4de1-a010-413f20b41495","source":"wordfence","cve":"CVE-2024-47335","title":"Bit Form \u2013 Contact Form Plugin <= 2.13.11 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f29a7a-5671-4de1-a010-413f20b41495?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.13.11","to_inclusive":true,"patched_in":"2.13.12"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:10:02Z"},{"id":"wordfence:69f2fc37-4c02-48da-b1e8-350ecc8ba086","source":"wordfence","cve":"CVE-2024-2655","title":"Elementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f2fc37-4c02-48da-b1e8-350ecc8ba086?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.6","to_inclusive":true,"patched_in":"8.3.7"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T05:32:25Z"},{"id":"wordfence:69f3e8d0-1f10-456d-b116-9698dd144b68","source":"wordfence","cve":"CVE-2026-102395","title":"Easy Google Maps <= 1.14.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f3e8d0-1f10-456d-b116-9698dd144b68?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.14.6","to_inclusive":true,"patched_in":"1.15.1"}],"published":"2026-09-30T09:52:10Z","updated":"2026-10-08T23:13:18Z"},{"id":"wordfence:69f54737-4b0f-49ba-a331-1b252a5e45cb","source":"wordfence","cve":"CVE-2021-25103","title":"Translate WordPress with GTranslate <= 2.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f54737-4b0f-49ba-a331-1b252a5e45cb?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":false,"patched_in":"2.9.7"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69f861bf-933f-4413-a5c0-fd39ee78e594","source":"wordfence","cve":"","title":"WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f861bf-933f-4413-a5c0-fd39ee78e594?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.6.6.1","to_inclusive":true,"patched_in":"12.6.7"}],"published":"2019-07-01T00:00:00Z","updated":"2024-10-23T12:39:25Z"},{"id":"wordfence:69f8c0e8-bce4-4179-836b-951ac045c605","source":"wordfence","cve":"CVE-2026-116400","title":"Button Block \u2013 Stylish buttons that get more clicks <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69f8c0e8-bce4-4179-836b-951ac045c605?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-10-26T17:27:00Z","updated":"2026-10-28T01:27:08Z"},{"id":"wordfence:69fa0b8f-8509-47a8-951a-830271b2b29e","source":"wordfence","cve":"CVE-2017-18356","title":"WooCommerce <= 3.2.3 - Authenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69fa0b8f-8509-47a8-951a-830271b2b29e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"3.2.4"}],"published":"2017-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69fd1068-4bbd-4e8a-9d35-5e9a072c72e1","source":"wordfence","cve":"","title":"Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69fd1068-4bbd-4e8a-9d35-5e9a072c72e1?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":false,"patched_in":"3.6.1"}],"published":"2018-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69fd66db-5693-4976-96c0-60dbfeccd14f","source":"wordfence","cve":"CVE-2023-28666","title":"InPost Gallery <= 2.1.4.1 - Reflected Cross-Site Scripting via 'imgurl'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69fd66db-5693-4976-96c0-60dbfeccd14f?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4.1","to_inclusive":true,"patched_in":"2.1.4.2"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:69fe5af3-9ea1-4571-8013-cabe1498e004","source":"wordfence","cve":"CVE-2026-113813","title":"PayPlug for WooCommerce (Official) 2.8.0 - 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69fe5af3-9ea1-4571-8013-cabe1498e004?source=api-prod","affected":[{"type":"plugin","slug":"payplug","name":"PayPlug for WooCommerce (Official)","from":"2.8.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:14:10Z"},{"id":"wordfence:69fed134-0978-44ea-a8d1-cb836e07d546","source":"wordfence","cve":"CVE-2026-57366","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69fed134-0978-44ea-a8d1-cb836e07d546?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:59:08Z"},{"id":"wordfence:69ffb5fb-16f5-4ef8-81c5-b119da859488","source":"wordfence","cve":"CVE-2021-34632","title":"SEO Backlinks <= 4.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/69ffb5fb-16f5-4ef8-81c5-b119da859488?source=api-prod","affected":[{"type":"plugin","slug":"seo-backlinks","name":"SEO Backlinks","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-26T06:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a03556a-feac-4567-9a51-87f93a7ee7f3","source":"wordfence","cve":"CVE-2025-54740","title":"Print My Blog <= 3.27.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a03556a-feac-4567-9a51-87f93a7ee7f3?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.27.9","to_inclusive":true,"patched_in":"3.27.10"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:17:14Z"},{"id":"wordfence:6a03792a-7e14-41c6-a60c-cb5d389f7539","source":"wordfence","cve":"CVE-2015-9375","title":"Exchange Addon Table Rate Shipping < 1.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a03792a-7e14-41c6-a60c-cb5d389f7539?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-table-rate-shipping","name":"exchange-addon-table-rate-shipping","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a04e6ad-9365-4cb5-a0a0-82e047647d6b","source":"wordfence","cve":"CVE-2025-9054","title":"MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=api-prod","affected":[{"type":"plugin","slug":"WooCommerce-Multi-Locations-Inventory-Management","name":"MultiLoca - WooCommerce Multi Locations Inventory Management","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-24T11:18:34Z"},{"id":"wordfence:6a050764-0ba6-49a4-bd71-f79e3129fc4c","source":"wordfence","cve":"CVE-2025-12682","title":"Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a050764-0ba6-49a4-bd71-f79e3129fc4c?source=api-prod","affected":[{"type":"plugin","slug":"easy-upload-files-during-checkout","name":"Easy Upload Files During Checkout","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2025-11-03T00:00:00Z","updated":"2026-07-09T23:32:52Z"},{"id":"wordfence:6a05ed9c-1cd7-44ef-bea1-3e039dbf3500","source":"wordfence","cve":"CVE-2026-15245","title":"BNE Testimonials <= 2.0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a05ed9c-1cd7-44ef-bea1-3e039dbf3500?source=api-prod","affected":[{"type":"plugin","slug":"bne-testimonials","name":"BNE Testimonials","from":"*","from_inclusive":true,"to":"2.0.8.1","to_inclusive":true,"patched_in":"2.0.8.2"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:13:02Z"},{"id":"wordfence:6a061553-c988-4a31-a0a2-7a2608faa33f","source":"wordfence","cve":"CVE-2024-8669","title":"Backuply \u2013 Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a061553-c988-4a31-a0a2-7a2608faa33f?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-14T03:30:06Z"},{"id":"wordfence:6a09e351-8326-4b31-bba5-5da34b417843","source":"wordfence","cve":"","title":"DZS Video Gallery <= 9.63 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a09e351-8326-4b31-bba5-5da34b417843?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"9.63","to_inclusive":true,"patched_in":"9.64"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a0a0395-c193-4686-ba97-73fdd40d3048","source":"wordfence","cve":"CVE-2024-3061","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0a0395-c193-4686-ba97-73fdd40d3048?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.2","to_inclusive":true,"patched_in":"1.3.5.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-17T14:08:50Z"},{"id":"wordfence:6a0a376e-ea3a-40ca-9341-f28f92e15e02","source":"wordfence","cve":"CVE-2026-2712","title":"WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0a376e-ea3a-40ca-9341-f28f92e15e02?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimize","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-04-09T11:52:37Z","updated":"2026-04-10T01:24:58Z"},{"id":"wordfence:6a0be61b-a1ee-499f-b991-58d5494bce18","source":"wordfence","cve":"CVE-2023-25970","title":"Zendrop \u2013 Global Dropshipping <= 1.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0be61b-a1ee-499f-b991-58d5494bce18?source=api-prod","affected":[{"type":"plugin","slug":"zendrop-dropshipping-and-fulfillment","name":"Zendrop \u2013 Global Dropshipping","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a0c948b-7f14-450e-858a-77c1d3dd0761","source":"wordfence","cve":"","title":"All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0c948b-7f14-450e-858a-77c1d3dd0761?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":false,"patched_in":"2.10"}],"published":"2018-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a11e7c9-f565-4a8c-895f-425c6654b5a9","source":"wordfence","cve":"CVE-2023-41728","title":"Rescue Shortcodes <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a11e7c9-f565-4a8c-895f-425c6654b5a9?source=api-prod","affected":[{"type":"plugin","slug":"rescue-shortcodes","name":"Rescue Shortcodes","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2023-09-05T00:00:00Z","updated":"2024-05-03T19:08:33Z"},{"id":"wordfence:6a12acf0-932e-4dff-9da6-9fbace11dbe1","source":"wordfence","cve":"CVE-2024-1414","title":"Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a12acf0-932e-4dff-9da6-9fbace11dbe1?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:26:55Z"},{"id":"wordfence:6a192e28-45cf-4d6a-ab87-b03d8264e7df","source":"wordfence","cve":"CVE-2024-13314","title":"Carousel, Slider, Gallery by WP Carousel <= 2.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a192e28-45cf-4d6a-ab87-b03d8264e7df?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-26T22:13:50Z"},{"id":"wordfence:6a19972e-6ff9-4d18-a327-5cafef96a637","source":"wordfence","cve":"CVE-2021-24945","title":"Like Button Rating <= 2.6.37 - Unauthorised Vote Export to Email & IP Addresses Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a19972e-6ff9-4d18-a327-5cafef96a637?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.37","to_inclusive":true,"patched_in":"2.6.38"}],"published":"2021-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a19d494-08d1-479a-8ba4-edeb2873866a","source":"wordfence","cve":"CVE-2023-49840","title":"Multi Currency For WooCommerce <= 1.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a19d494-08d1-479a-8ba4-edeb2873866a?source=api-prod","affected":[{"type":"plugin","slug":"wc-multi-currency","name":"Multi Currency For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2023-12-06T00:00:00Z","updated":"2024-03-22T15:44:45Z"},{"id":"wordfence:6a1a9e22-d174-43fc-aab6-f6968067a290","source":"wordfence","cve":"CVE-2024-13318","title":"Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-463","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=api-prod","affected":[{"type":"plugin","slug":"essential-wp-real-estate","name":"Essential WP Real Estate","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T22:18:30Z","updated":"2025-01-10T11:10:45Z"},{"id":"wordfence:6a1d9d03-0216-484c-85ca-73f157595713","source":"wordfence","cve":"CVE-2026-93889","title":"Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1d9d03-0216-484c-85ca-73f157595713?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-02T17:38:12Z","updated":"2026-10-03T06:38:23Z"},{"id":"wordfence:6a1de2d6-d4a0-4770-be38-9bd09b2243b7","source":"wordfence","cve":"CVE-2022-46803","title":"Simple Newsletter Plugin \u2013 Noptin <= 1.10.3 - Unauthenticated CSV Injection","severity":"high","cvss":7.2,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1de2d6-d4a0-4770-be38-9bd09b2243b7?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a1f2a7d-f91c-4dd2-b275-0e27f65498b1","source":"wordfence","cve":"CVE-2019-19134","title":"Hero Maps Premium <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1f2a7d-f91c-4dd2-b275-0e27f65498b1?source=api-prod","affected":[{"type":"plugin","slug":"hmapsprem","name":"Hero Maps Premium","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a216505-7ab3-4ec7-bb11-e1c6ceaa2aed","source":"wordfence","cve":"","title":"RedSteel (All Versions) - File Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a216505-7ab3-4ec7-bb11-e1c6ceaa2aed?source=api-prod","affected":[{"type":"theme","slug":"RedSteel","name":"RedSteel","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a21d834-db8a-471f-b062-59ecfbab0dd6","source":"wordfence","cve":"","title":"[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a21d834-db8a-471f-b062-59ecfbab0dd6?source=api-prod","affected":[{"type":"plugin","slug":"autoresponder-gwa","name":"[GWA] AutoResponder","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"4.0"}],"published":"2022-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a226790-0774-43f6-a476-a2dac7ae153b","source":"wordfence","cve":"","title":"Freshdesk (official) <= 2.3.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a226790-0774-43f6-a476-a2dac7ae153b?source=api-prod","affected":[{"type":"plugin","slug":"freshdesk-support","name":"Freshdesk (official)","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2022-06-22T00:00:00Z","updated":"2024-05-03T19:10:20Z"},{"id":"wordfence:6a24378f-cf76-4937-99e5-a5fb2d206859","source":"wordfence","cve":"CVE-2024-32807","title":"Sendinblue for WooCommerce <= 4.0.17 - Authenticated (Editor+) Arbitrary File Download and Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a24378f-cf76-4937-99e5-a5fb2d206859?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-sendinblue-newsletter-subscription","name":"Brevo for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"4.0.18"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:02:58Z"},{"id":"wordfence:6a27fcc6-b1ac-4649-892b-7e0dee3f0d08","source":"wordfence","cve":"CVE-2023-45766","title":"Poll Maker <= 4.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a27fcc6-b1ac-4649-892b-7e0dee3f0d08?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a290ec5-1b31-431f-9eda-76302dc3784a","source":"wordfence","cve":"CVE-2025-67588","title":"Elementor Website Builder <= 3.33.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a290ec5-1b31-431f-9eda-76302dc3784a?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.33.0","to_inclusive":true,"patched_in":"3.33.1"}],"published":"2025-11-25T00:00:00Z","updated":"2025-12-11T17:08:25Z"},{"id":"wordfence:6a2dab39-f071-4261-a38d-06bd2062673d","source":"wordfence","cve":"CVE-2025-58812","title":"Best Restaurant Menu by PriceListo <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a2dab39-f071-4261-a38d-06bd2062673d?source=api-prod","affected":[{"type":"plugin","slug":"best-restaurant-menu-by-pricelisto","name":"Great Restaurant Menu WP","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:28:41Z"},{"id":"wordfence:6a2dea28-14cf-4e83-ac72-efc7c97ecf54","source":"wordfence","cve":"CVE-2024-13898","title":"Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a2dea28-14cf-4e83-ac72-efc7c97ecf54?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-04-03T17:07:19Z","updated":"2025-04-04T05:22:45Z"},{"id":"wordfence:6a30d572-e086-4b83-8cb7-4cef9a3253bd","source":"wordfence","cve":"CVE-2025-6814","title":"Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a30d572-e086-4b83-8cb7-4cef9a3253bd?source=api-prod","affected":[{"type":"plugin","slug":"booking-x","name":"Booking X \u2013 Appointment and Reservation Availability Calendar","from":"1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:20:00Z","updated":"2025-07-04T01:44:04Z"},{"id":"wordfence:6a363a7b-16c1-4350-b24c-b3ccf8514a58","source":"wordfence","cve":"CVE-2025-22817","title":"BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a363a7b-16c1-4350-b24c-b3ccf8514a58?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-shortcodes-extra","name":"BP Profile Shortcodes Extra","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:57:06Z"},{"id":"wordfence:6a39a644-947c-494f-9786-8657d95eaa2c","source":"wordfence","cve":"CVE-2026-66460","title":"AfterShip Tracking <= 1.18.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a39a644-947c-494f-9786-8657d95eaa2c?source=api-prod","affected":[{"type":"plugin","slug":"aftership-woocommerce-tracking","name":"AfterShip Tracking \u2013 All-In-One WooCommerce Order Tracking (Free plan available)","from":"*","from_inclusive":true,"to":"1.18.1","to_inclusive":true,"patched_in":"1.18.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-09-09T16:09:50Z"},{"id":"wordfence:6a39e4d4-890d-46f9-8bb9-0fc858e6f1e2","source":"wordfence","cve":"CVE-2026-15312","title":"Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a39e4d4-890d-46f9-8bb9-0fc858e6f1e2?source=api-prod","affected":[{"type":"plugin","slug":"propovoice","name":"Propovoice: All-in-One Client Management System","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:02:51Z","updated":"2026-08-15T02:26:15Z"},{"id":"wordfence:6a3db653-c39f-4097-9d31-6d009a82c4a4","source":"wordfence","cve":"CVE-2025-22657","title":"Atarim <= 4.0.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a3db653-c39f-4097-9d31-6d009a82c4a4?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-02-03T00:00:00Z","updated":"2026-05-04T14:33:45Z"},{"id":"wordfence:6a3dddda-3a65-42b6-9dc8-760bc3a24dcf","source":"wordfence","cve":"","title":"Spreadsheet Integration and Spreadsheet Integration Pro <= 3.5.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a3dddda-3a65-42b6-9dc8-760bc3a24dcf?source=api-prod","affected":[{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"},{"type":"plugin","slug":"wpgsi-professional","name":"wpgsi-professional","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2021-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a40ed3c-1f4b-4bf7-b6f4-fc1e145cc989","source":"wordfence","cve":"CVE-2024-2043","title":"EleForms \u2013 All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a40ed3c-1f4b-4bf7-b6f4-fc1e145cc989?source=api-prod","affected":[{"type":"plugin","slug":"all-contact-form-integration-for-elementor","name":"EleForms \u2013 All In One Form Integration including DB for Elementor","from":"*","from_inclusive":true,"to":"2.9.9.7","to_inclusive":true,"patched_in":"2.9.9.8"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:13Z"},{"id":"wordfence:6a423fff-7264-448e-ad97-2922a3a7151a","source":"wordfence","cve":"CVE-2025-54041","title":"Wallet System for WooCommerce <= 2.6.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a423fff-7264-448e-ad97-2922a3a7151a?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:37:36Z"},{"id":"wordfence:6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c","source":"wordfence","cve":"CVE-2026-13756","title":"WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-grid-builder","name":"WP Grid Builder","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-07-10T12:58:36Z","updated":"2026-07-11T01:29:23Z"},{"id":"wordfence:6a4359e4-5843-4d2c-b288-5c35f819241a","source":"wordfence","cve":"CVE-2026-5488","title":"ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a4359e4-5843-4d2c-b288-5c35f819241a?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2026-04-23T14:48:15Z","updated":"2026-08-14T19:07:10Z"},{"id":"wordfence:6a44a55e-a96a-4698-9948-6ef33138a834","source":"wordfence","cve":"CVE-2022-2473","title":"WP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a44a55e-a96a-4698-9948-6ef33138a834?source=api-prod","affected":[{"type":"plugin","slug":"wp-useronline","name":"WP-UserOnline","from":"*","from_inclusive":true,"to":"2.87.6","to_inclusive":true,"patched_in":"2.88.0"}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a4559f8-bd13-4a38-91c2-8569a9967700","source":"wordfence","cve":"CVE-2017-18545","title":"Invite Anyone <= 1.3.15 - Improper Input Validation","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a4559f8-bd13-4a38-91c2-8569a9967700?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2017-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a466c8f-835d-4d37-a273-7b5689dfbcea","source":"wordfence","cve":"CVE-2024-2322","title":"WooCommerce Cart Abandonment Recovery <= 1.2.26 - Cross-Site Request Forgery to Templates/Abandoned Orders Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a466c8f-835d-4d37-a273-7b5689dfbcea?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-abandonment-recovery","name":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails","from":"*","from_inclusive":true,"to":"1.2.26","to_inclusive":true,"patched_in":"1.2.27"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-06T17:16:00Z"},{"id":"wordfence:6a4d5a40-2ec0-468e-bafb-a713629f6006","source":"wordfence","cve":"","title":"Webcam Video Conference < 4.51 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a4d5a40-2ec0-468e-bafb-a713629f6006?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-video-conference-integration","name":"Webcam Video Conference","from":"*","from_inclusive":true,"to":"4.51","to_inclusive":false,"patched_in":"4.51"}],"published":"2012-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a4def27-eff6-43f3-93dc-e2472f858d1b","source":"wordfence","cve":"CVE-2024-5729","title":"Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a4def27-eff6-43f3-93dc-e2472f858d1b?source=api-prod","affected":[{"type":"plugin","slug":"simple-al-slider","name":"Simple AL Slider","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-13T14:59:26Z"},{"id":"wordfence:6a4e73ee-7d49-48ec-a0a7-b3a8a737dd63","source":"wordfence","cve":"CVE-2026-66564","title":"ShiftCV - Blog \\ Resume \\ Portfolio \\ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a4e73ee-7d49-48ec-a0a7-b3a8a737dd63?source=api-prod","affected":[{"type":"theme","slug":"shift-cv","name":"ShiftCV - Blog \\ Resume \\ Portfolio \\ WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:54:03Z","updated":"2026-10-13T14:20:35Z"},{"id":"wordfence:6a50e142-59f4-488b-8120-5bf505a9039d","source":"wordfence","cve":"CVE-2023-27451","title":"Instant Images <= 5.1.0.1 - Authenticated (Author+) Server-Side Request Forgery via instant_images_download","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a50e142-59f4-488b-8120-5bf505a9039d?source=api-prod","affected":[{"type":"plugin","slug":"instant-images","name":"Instant Images \u2013 One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy","from":"*","from_inclusive":true,"to":"5.1.0.1","to_inclusive":true,"patched_in":"5.1.0.2"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a50f6ba-1fc7-4cfb-b419-69ad7e9dacf9","source":"wordfence","cve":"CVE-2026-39574","title":"InPost Gallery <= 2.1.4.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a50f6ba-1fc7-4cfb-b419-69ad7e9dacf9?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4.6","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:03:36Z"},{"id":"wordfence:6a583966-f58a-41a0-8856-7b7b6a0eb559","source":"wordfence","cve":"CVE-2023-5942","title":"Medialist <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a583966-f58a-41a0-8856-7b7b6a0eb559?source=api-prod","affected":[{"type":"plugin","slug":"media-list","name":"Medialist","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-11-03T00:00:00Z","updated":"2024-02-12T14:14:11Z"},{"id":"wordfence:6a586bab-df87-4e21-9b05-994c4fc991de","source":"wordfence","cve":"CVE-2024-1219","title":"Easy Social Feed <= 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a586bab-df87-4e21-9b05-994c4fc991de?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-12T13:11:39Z"},{"id":"wordfence:6a587455-fd93-4f28-902a-4d84d1253e64","source":"wordfence","cve":"CVE-2026-57668","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a587455-fd93-4f28-902a-4d84d1253e64?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:31:46Z"},{"id":"wordfence:6a595b3c-2b21-43fe-8d4e-6721f4541c9b","source":"wordfence","cve":"CVE-2023-49180","title":"Automatic Youtube Video Posts Plugin <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a595b3c-2b21-43fe-8d4e-6721f4541c9b?source=api-prod","affected":[{"type":"plugin","slug":"automatic-youtube-video-posts","name":"Automatic Youtube Video Posts Plugin","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a5ad100-2522-41f0-a1d5-8e8d828afecd","source":"wordfence","cve":"CVE-2025-30619","title":"SpeakPipe <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5ad100-2522-41f0-a1d5-8e8d828afecd?source=api-prod","affected":[{"type":"plugin","slug":"speakpipe-voicemail-for-websites","name":"SpeakPipe \u2013 Voicemail for Websites","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:24:11Z"},{"id":"wordfence:6a5cc21a-eb3a-429a-a0f9-0181d95a9eeb","source":"wordfence","cve":"CVE-2025-1648","title":"Yawave <= 2.9.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5cc21a-eb3a-429a-a0f9-0181d95a9eeb?source=api-prod","affected":[{"type":"plugin","slug":"yawave","name":"Yawave","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T06:58:30Z"},{"id":"wordfence:6a5db3fc-6ae4-4566-8610-687cb725cf6e","source":"wordfence","cve":"CVE-2024-13647","title":"School Management System \u2013 SakolaWP <= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5db3fc-6ae4-4566-8610-687cb725cf6e?source=api-prod","affected":[{"type":"plugin","slug":"sakolawp-lite","name":"School Management System \u2013 SakolaWP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T15:28:22Z","updated":"2025-02-27T04:21:44Z"},{"id":"wordfence:6a5e4708-db3e-483c-852f-1a487825cf92","source":"wordfence","cve":"CVE-2023-3636","title":"WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5e4708-db3e-483c-852f-1a487825cf92?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a5edba7-2977-4f17-a0cd-857802585401","source":"wordfence","cve":"CVE-2026-27995","title":"Justitia <= 1.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a5edba7-2977-4f17-a0cd-857802585401?source=api-prod","affected":[{"type":"theme","slug":"justitia","name":"Justitia | Lawyer & Legal Adviser WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:26:09Z"},{"id":"wordfence:6a60e2c3-4597-4b21-ad20-6a00e483fcf1","source":"wordfence","cve":"CVE-2024-10801","title":"WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a60e2c3-4597-4b21-ad20-6a00e483fcf1?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.5","to_inclusive":true,"patched_in":"16.6"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T07:35:05Z"},{"id":"wordfence:6a6390d2-58cd-468e-9936-e16954e2d3ee","source":"wordfence","cve":"","title":"Download Manager <= 2.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6390d2-58cd-468e-9936-e16954e2d3ee?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a639d27-8704-4841-b2b5-6afbf342a0ff","source":"wordfence","cve":"CVE-2020-11510","title":"LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification","severity":"high","cvss":7.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a639d27-8704-4841-b2b5-6afbf342a0ff?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.6.8","to_inclusive":true,"patched_in":"3.2.6.9"}],"published":"2020-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a663d0e-f490-41cd-bb18-4cd38c9d38a5","source":"wordfence","cve":"CVE-2026-62076","title":"Kalles <= 1.1.7.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a663d0e-f490-41cd-bb18-4cd38c9d38a5?source=api-prod","affected":[{"type":"theme","slug":"kalles","name":"Kalles - Clean, Versatile, Responsive Shopify Theme - RTL support","from":"*","from_inclusive":true,"to":"1.1.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:42:04Z"},{"id":"wordfence:6a6bbcf9-5a49-4dfb-b863-2f3e61148864","source":"wordfence","cve":"CVE-2026-42673","title":"Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6bbcf9-5a49-4dfb-b863-2f3e61148864?source=api-prod","affected":[{"type":"plugin","slug":"logtivity","name":"Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-19T16:09:57Z"},{"id":"wordfence:6a6c46a2-96de-49d1-ac3b-448ccb837d78","source":"wordfence","cve":"CVE-2025-67993","title":"Atarim <= 4.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6c46a2-96de-49d1-ac3b-448ccb837d78?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:09:19Z"},{"id":"wordfence:6a6debe9-e0bb-4ea7-be91-757a250515ca","source":"wordfence","cve":"CVE-2022-3987","title":"Responsive Lightbox2 <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6debe9-e0bb-4ea7-be91-757a250515ca?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox2","name":"Responsive Lightbox2","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a6eb430-cf86-4e13-a4f7-173fada9fddf","source":"wordfence","cve":"CVE-2024-2108","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":4.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a6eb430-cf86-4e13-a4f7-173fada9fddf?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:44:01Z"},{"id":"wordfence:6a714769-589d-49ac-820d-70a2184e6ef4","source":"wordfence","cve":"CVE-2025-25078","title":"Google Earth Embed <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a714769-589d-49ac-820d-70a2184e6ef4?source=api-prod","affected":[{"type":"plugin","slug":"google-earth-tours","name":"Google Earth Embed","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:19:30Z"},{"id":"wordfence:6a75c8b0-fa1a-4032-a6fd-b504f5b05a08","source":"wordfence","cve":"CVE-2024-43923","title":"Timetics <= 1.0.23 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a75c8b0-fa1a-4032-a6fd-b504f5b05a08?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:39:39Z"},{"id":"wordfence:6a76116a-1e84-4114-9baa-3986be92d051","source":"wordfence","cve":"CVE-2024-29759","title":"Calculated Fields Form <= 1.2.54 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a76116a-1e84-4114-9baa-3986be92d051?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.2.54","to_inclusive":true,"patched_in":"1.2.55"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T14:27:30Z"},{"id":"wordfence:6a762b7d-6b54-4933-a521-0435afb6f948","source":"wordfence","cve":"CVE-2025-47639","title":"Supertext Translation and Proofreading <= 4.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a762b7d-6b54-4933-a521-0435afb6f948?source=api-prod","affected":[{"type":"plugin","slug":"polylang-supertext","name":"Supertext Translation and Proofreading","from":"*","from_inclusive":true,"to":"4.25","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:40:53Z"},{"id":"wordfence:6a765360-8603-4ba1-a6db-dd0175ff3ddf","source":"wordfence","cve":"CVE-2023-4160","title":"WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a765360-8603-4ba1-a6db-dd0175ff3ddf?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.90","to_inclusive":true,"patched_in":"1.2.91"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a766255-f144-4c4d-849d-c5c99320962b","source":"wordfence","cve":"CVE-2025-31803","title":"Turisbook Booking System <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a766255-f144-4c4d-849d-c5c99320962b?source=api-prod","affected":[{"type":"plugin","slug":"turisbook-booking-system","name":"Turisbook Booking System","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T19:10:03Z"},{"id":"wordfence:6a76b224-9b55-4294-8a04-44c94a3115f7","source":"wordfence","cve":"CVE-2023-25059","title":"avalex \u2013 Automatisch sichere Rechtstexte <= 3.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a76b224-9b55-4294-8a04-44c94a3115f7?source=api-prod","affected":[{"type":"plugin","slug":"avalex","name":"avalex \u2013 Automatisch sichere Rechtstexte","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a7d1469-37c9-4e7b-a4fc-781697e41d11","source":"wordfence","cve":"CVE-2025-50019","title":"Simple Sticky Footer  <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a7d1469-37c9-4e7b-a4fc-781697e41d11?source=api-prod","affected":[{"type":"plugin","slug":"simple-sticky-footer","name":"Simple Sticky Footer","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:52:22Z"},{"id":"wordfence:6a7e794b-aa0e-4db3-8999-c9c5134a4ded","source":"wordfence","cve":"CVE-2024-55972","title":"eTemplates <= 0.2.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a7e794b-aa0e-4db3-8999-c9c5134a4ded?source=api-prod","affected":[{"type":"plugin","slug":"etemplates","name":"eTemplates","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:04:11Z"},{"id":"wordfence:6a80dd84-f94f-4e70-9117-07f1621c9e6c","source":"wordfence","cve":"CVE-2026-74920","title":"Document Gallery <= 5.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a80dd84-f94f-4e70-9117-07f1621c9e6c?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-06T15:20:07Z"},{"id":"wordfence:6a830fb8-de5f-40c7-bb6c-464ed916b440","source":"wordfence","cve":"","title":"My WP Customize Admin/Frontend <= 1.21.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a830fb8-de5f-40c7-bb6c-464ed916b440?source=api-prod","affected":[{"type":"plugin","slug":"my-wp","name":"My WP Customize Admin/Frontend","from":"*","from_inclusive":true,"to":"1.21.1","to_inclusive":false,"patched_in":"1.21.1"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a85fe7f-2d28-4509-99f2-875cb63c6500","source":"wordfence","cve":"CVE-2022-2001","title":"DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a85fe7f-2d28-4509-99f2-875cb63c6500?source=api-prod","affected":[{"type":"plugin","slug":"dx-share-selection","name":"DX Share Selection","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a89c48d-eef2-4910-bd93-ef0a8482d814","source":"wordfence","cve":"CVE-2025-22658","title":"Listings for Appfolio <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a89c48d-eef2-4910-bd93-ef0a8482d814?source=api-prod","affected":[{"type":"plugin","slug":"listings-for-appfolio","name":"Listings for Appfolio","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:22:02Z"},{"id":"wordfence:6a8a5b2b-6cb0-48bf-ba03-d23b1624390d","source":"wordfence","cve":"CVE-2026-18988","title":"Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8a5b2b-6cb0-48bf-ba03-d23b1624390d?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-free","name":"Easy Accordion \u2013 AI-Powered FAQ & Accordion Blocks, Product FAQ","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-08T04:25:41Z"},{"id":"wordfence:6a8aca90-faf8-46fc-9133-4f4a509eb3d2","source":"wordfence","cve":"CVE-2026-81280","title":"Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 4.0.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8aca90-faf8-46fc-9133-4f4a509eb3d2?source=api-prod","affected":[{"type":"plugin","slug":"a4-barcode-generator","name":"Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-08-31T11:25:53Z","updated":"2026-09-10T19:17:20Z"},{"id":"wordfence:6a8c5d9b-4535-4edb-a92e-a9b83a0d22c3","source":"wordfence","cve":"CVE-2024-4314","title":"hostel <= 1.1.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8c5d9b-4535-4edb-a92e-a9b83a0d22c3?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.3","to_inclusive":true,"patched_in":"1.1.5.4"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:30Z"},{"id":"wordfence:6a8cb8ef-a2e5-47ef-8d8c-759ed83a015b","source":"wordfence","cve":"CVE-2024-32585","title":"Import Content in WordPress & WooCommerce with Excel <= 4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8cb8ef-a2e5-47ef-8d8c-759ed83a015b?source=api-prod","affected":[{"type":"plugin","slug":"content-excel-importer","name":"Import Content in WordPress & WooCommerce with Excel","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.3"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T14:00:46Z"},{"id":"wordfence:6a8cc968-01a5-45b8-bee8-86c858f86514","source":"wordfence","cve":"CVE-2026-3996","title":"WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8cc968-01a5-45b8-bee8-86c858f86514?source=api-prod","affected":[{"type":"plugin","slug":"wp-games-embed","name":"WP Games Embed","from":"*","from_inclusive":true,"to":"0.1beta","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:26Z","updated":"2026-03-21T03:26:49Z"},{"id":"wordfence:6a8d0f86-73fe-43a6-a03a-38bf815dd30b","source":"wordfence","cve":"CVE-2024-30492","title":"Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8d0f86-73fe-43a6-a03a-38bf815dd30b?source=api-prod","affected":[{"type":"plugin","slug":"users-customers-import-export-for-wp-woocommerce","name":"Export and Import Users and Customers","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:41:35Z"},{"id":"wordfence:6a8d121d-434d-4445-874f-d3cf6b6e7233","source":"wordfence","cve":"CVE-2024-23524","title":"PilotPress <= 2.0.30 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8d121d-434d-4445-874f-d3cf6b6e7233?source=api-prod","affected":[{"type":"plugin","slug":"pilotpress","name":"PilotPress","from":"*","from_inclusive":true,"to":"2.0.30","to_inclusive":true,"patched_in":"2.0.31"}],"published":"2024-01-31T00:00:00Z","updated":"2024-03-22T15:19:48Z"},{"id":"wordfence:6a8dc0e3-ff3a-4abc-afca-eb1879603550","source":"wordfence","cve":"CVE-2024-11815","title":"P\u00f3sturinn\\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8dc0e3-ff3a-4abc-afca-eb1879603550?source=api-prod","affected":[{"type":"plugin","slug":"posturinn","name":"P\u00f3sturinn\\'s Shipping with WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-10T14:01:27Z"},{"id":"wordfence:6a906f90-fac2-43cf-8f67-99f8862dc636","source":"wordfence","cve":"","title":"Ibtana - Ecommerce Product Addons <= 0.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a906f90-fac2-43cf-8f67-99f8862dc636?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-ecommerce-product-addons","name":"Ibtana \u2013 Ecommerce Product Addons","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":"0.2.4"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6a9285fb-fc4e-4ea4-89d5-f376f03c54a4","source":"wordfence","cve":"CVE-2026-5365","title":"LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a9285fb-fc4e-4ea4-89d5-f376f03c54a4?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-05-13T17:41:32Z","updated":"2026-05-29T14:39:22Z"},{"id":"wordfence:6a92b96b-ecbc-4414-8e42-04b5c3a02131","source":"wordfence","cve":"CVE-2023-49179","title":"Event post <= 5.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a92b96b-ecbc-4414-8e42-04b5c3a02131?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2023-11-29T00:00:00Z","updated":"2024-03-22T15:33:54Z"},{"id":"wordfence:6a9397ed-eddf-466b-b810-1e2f45afd291","source":"wordfence","cve":"CVE-2026-4683","title":"Smartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a9397ed-eddf-466b-b810-1e2f45afd291?source=api-prod","affected":[{"type":"plugin","slug":"smartcat-wpml","name":"Smartcat Translator for WPML","from":"*","from_inclusive":true,"to":"3.1.77","to_inclusive":true,"patched_in":"3.1.78"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-15T07:46:38Z"},{"id":"wordfence:6a9415da-ac77-4778-82b8-56bf25580199","source":"wordfence","cve":"CVE-2026-74991","title":"WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a9415da-ac77-4778-82b8-56bf25580199?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"1.8.8.2","from_inclusive":true,"to":"2.0.1.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:46:42Z"},{"id":"wordfence:6a97d169-c6f3-476f-858e-3cc4e86f3cb5","source":"wordfence","cve":"CVE-2026-88814","title":"YITH WooCommerce Gift Cards <= 4.38.0 - Unauthenticated Gift Card Balance Double-Spending","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a97d169-c6f3-476f-858e-3cc4e86f3cb5?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-gift-cards","name":"YITH WooCommerce Gift Cards","from":"*","from_inclusive":true,"to":"4.38.0","to_inclusive":true,"patched_in":"4.38.1"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:33:05Z"},{"id":"wordfence:6a99dade-815e-43cf-be24-92c01286f476","source":"wordfence","cve":"CVE-2024-11273","title":"Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a99dade-815e-43cf-be24-92c01286f476?source=api-prod","affected":[{"type":"plugin","slug":"pirate-forms","name":"Contact Form & SMTP Plugin for WordPress by PirateForms","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:45:45Z"},{"id":"wordfence:6a9b052a-1caf-4d39-ab91-c50605d86507","source":"wordfence","cve":"CVE-2025-29014","title":"FoodMenu <= 1.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a9b052a-1caf-4d39-ab91-c50605d86507?source=api-prod","affected":[{"type":"plugin","slug":"dzs-restaurantmenu","name":"FoodMenu - WP Creative Restaurant Menu Showcase WooCommerce","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-21T21:31:36Z"},{"id":"wordfence:6aa0dfdf-95b0-48a2-8281-1872b99b87d6","source":"wordfence","cve":"CVE-2022-2981","title":"Download Monitor <= 4.5.97 - Authenticated (Administrator+) Arbitrary File Download","severity":"medium","cvss":6.8,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa0dfdf-95b0-48a2-8281-1872b99b87d6?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.5.97","to_inclusive":true,"patched_in":"4.5.98"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aa2be6c-299e-4769-9070-a3c337bce990","source":"wordfence","cve":"CVE-2024-31107","title":"OpenID <= 3.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa2be6c-299e-4769-9070-a3c337bce990?source=api-prod","affected":[{"type":"plugin","slug":"openid","name":"OpenID","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:51:53Z"},{"id":"wordfence:6aa2d172-73b6-487d-ae65-0920f915e750","source":"wordfence","cve":"CVE-2022-47143","title":"Multiple Page Generator Plugin <= 3.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa2d172-73b6-487d-ae65-0920f915e750?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.10"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aa3d312-485a-4a93-a075-fa7152395f11","source":"wordfence","cve":"CVE-2022-4102","title":"Royal Elementor Addons <=1.3.55 - Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa3d312-485a-4a93-a075-fa7152395f11?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.56"}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aa43e74-9911-4c7a-b01a-cb77c2c3fe99","source":"wordfence","cve":"CVE-2022-2627","title":"Newspaper <= 11.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa43e74-9911-4c7a-b01a-cb77c2c3fe99?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"11.5.1","to_inclusive":true,"patched_in":"12"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aa4fd08-a1b1-4f61-a9d1-9812071b61c9","source":"wordfence","cve":"CVE-2024-22145","title":"InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aa4fd08-a1b1-4f61-a9d1-9812071b61c9?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.8","to_inclusive":true,"patched_in":"0.1.0.9"}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aaa22f5-7304-4efc-9579-80ec053c2f7e","source":"wordfence","cve":"CVE-2024-43926","title":"Beaver Builder <= 2.8.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aaa22f5-7304-4efc-9579-80ec053c2f7e?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.3.2","to_inclusive":true,"patched_in":"2.8.3.4"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:55:40Z"},{"id":"wordfence:6aab08c1-20db-46a2-b93a-d864bb57bf4d","source":"wordfence","cve":"","title":"WP-TopBar <= 4.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aab08c1-20db-46a2-b93a-d864bb57bf4d?source=api-prod","affected":[{"type":"plugin","slug":"wp-topbar","name":"WP-TopBar","from":"*","from_inclusive":true,"to":"4.02","to_inclusive":true,"patched_in":"4.03"}],"published":"2012-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aac2178-f6ce-4444-9afc-7e014547cd48","source":"wordfence","cve":"CVE-2026-118235","title":"SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aac2178-f6ce-4444-9afc-7e014547cd48?source=api-prod","affected":[{"type":"plugin","slug":"simple-form","name":"SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2026-10-30T20:12:28Z","updated":"2026-10-31T08:30:45Z"},{"id":"wordfence:6aadfb95-16bb-4c72-a161-a7f69b761ed8","source":"wordfence","cve":"CVE-2026-110191","title":"Product Delivery Date for WooCommerce \u2013 Lite <= 3.3.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aadfb95-16bb-4c72-a161-a7f69b761ed8?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:17:09Z"},{"id":"wordfence:6aae5b1d-9b84-4628-b0b6-7b39054e08a0","source":"wordfence","cve":"","title":"Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aae5b1d-9b84-4628-b0b6-7b39054e08a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2020-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aaeb0df-75e8-44ac-8964-03e3389d202c","source":"wordfence","cve":"","title":"WPBook <= 2.7 - Unauthenticated Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aaeb0df-75e8-44ac-8964-03e3389d202c?source=api-prod","affected":[{"type":"plugin","slug":"wpbook","name":"WPBook","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2015-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aaf6071-6b33-4c6c-8983-d606ceb46fb3","source":"wordfence","cve":"CVE-2025-28997","title":"WP AutoKeyword <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aaf6071-6b33-4c6c-8983-d606ceb46fb3?source=api-prod","affected":[{"type":"plugin","slug":"wp-autokeyword","name":"WP AutoKeyword","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:29:32Z"},{"id":"wordfence:6ab0aa86-5df0-4a8a-8a1b-2b4a45ba6c17","source":"wordfence","cve":"CVE-2025-69169","title":"Easy Media Download <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab0aa86-5df0-4a8a-8a1b-2b4a45ba6c17?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-download","name":"Easy Media Download","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T17:37:50Z"},{"id":"wordfence:6ab0d342-bfa7-4760-b839-37c3354414ca","source":"wordfence","cve":"CVE-2024-9822","title":"Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab0d342-bfa7-4760-b839-37c3354414ca?source=api-prod","affected":[{"type":"plugin","slug":"pedalo-connector","name":"Pedalo Connector","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T02:32:46Z"},{"id":"wordfence:6ab26526-9fbb-4c2e-be41-73450225b834","source":"wordfence","cve":"","title":"WooCommerce <= 3.4.4 - Authenticated PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab26526-9fbb-4c2e-be41-73450225b834?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"3.4.5"}],"published":"2018-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ab37e9e-032c-418b-a88b-23d730e2867f","source":"wordfence","cve":"CVE-2026-113482","title":"Media Library Assistant <= 3.43 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab37e9e-032c-418b-a88b-23d730e2867f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":true,"patched_in":"3.44"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-03T19:23:56Z"},{"id":"wordfence:6ab578cd-3a0b-43d3-aaa7-0a01f431a4e2","source":"wordfence","cve":"CVE-2023-6567","title":"LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab578cd-3a0b-43d3-aaa7-0a01f431a4e2?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.5.7","to_inclusive":true,"patched_in":"4.2.5.8"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:32Z"},{"id":"wordfence:6ab7bd94-f0cd-4ff1-a642-8317165cdbaf","source":"wordfence","cve":"CVE-2025-30847","title":"Novelist <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab7bd94-f0cd-4ff1-a642-8317165cdbaf?source=api-prod","affected":[{"type":"plugin","slug":"novelist","name":"Novelist","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:02:09Z"},{"id":"wordfence:6ab93ea4-4d15-43cb-be70-6eb4921194d1","source":"wordfence","cve":"CVE-2026-13404","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1066 - Unauthenticated Like Count Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab93ea4-4d15-43cb-be70-6eb4921194d1?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":false,"patched_in":"1.7.1066"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:50:14Z"},{"id":"wordfence:6ab975b0-4216-46df-bf5e-91e403728e5b","source":"wordfence","cve":"","title":"wpDataTables <= 1.5.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab975b0-4216-46df-bf5e-91e403728e5b?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2014-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6abbdecd-782a-44a2-981a-ae6caa50dd6a","source":"wordfence","cve":"CVE-2023-5640","title":"Article Analytics <= 1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abbdecd-782a-44a2-981a-ae6caa50dd6a?source=api-prod","affected":[{"type":"plugin","slug":"article-analytics","name":"Article analytics","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6abc7605-2daa-44a9-8f2f-cbaacbea9348","source":"wordfence","cve":"CVE-2025-12892","title":"Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abc7605-2daa-44a9-8f2f-cbaacbea9348?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.9.4","to_inclusive":true,"patched_in":"5.1.9.5"}],"published":"2025-11-12T14:58:49Z","updated":"2025-11-17T19:08:59Z"},{"id":"wordfence:6abd3968-a8e7-4b40-bb7e-387bab10eba9","source":"wordfence","cve":"CVE-2026-6293","title":"Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abd3968-a8e7-4b40-bb7e-387bab10eba9?source=api-prod","affected":[{"type":"plugin","slug":"inquiry-form-to-posts-or-pages","name":"Inquiry form to posts or pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T18:02:25Z","updated":"2026-04-15T06:46:18Z"},{"id":"wordfence:6abde5cf-9335-4ce0-a95f-94c5c29fd207","source":"wordfence","cve":"CVE-2024-7084","title":"Ajax Search Lite < 4.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abde5cf-9335-4ce0-a95f-94c5c29fd207?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.12","to_inclusive":true,"patched_in":"4.12.1"}],"published":"2024-07-16T00:00:00Z","updated":"2024-08-09T16:25:13Z"},{"id":"wordfence:6abe93e8-b088-49d3-a658-9c6265bfbcdb","source":"wordfence","cve":"","title":"All in One Support Button + Callback Request <= 1.8.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abe93e8-b088-49d3-a658-9c6265bfbcdb?source=api-prod","affected":[{"type":"plugin","slug":"ar-contactus","name":"Contact Us all-in-one button","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2020-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6abfa01b-e2ec-412c-a17d-e8bd1f5ac228","source":"wordfence","cve":"CVE-2025-1664","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6abfa01b-e2ec-412c-a17d-e8bd1f5ac228?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T11:16:42Z"},{"id":"wordfence:6ac02888-33e9-43f9-ae10-541133fe4eea","source":"wordfence","cve":"CVE-2025-58608","title":"MediaPress <= 1.5.9.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac02888-33e9-43f9-ae10-541133fe4eea?source=api-prod","affected":[{"type":"plugin","slug":"mediapress","name":"MediaPress","from":"*","from_inclusive":true,"to":"1.5.9.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:08:28Z"},{"id":"wordfence:6ac2aa61-dd07-419c-8ff6-d862c39ab785","source":"wordfence","cve":"CVE-2025-23724","title":"University quizzes online <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac2aa61-dd07-419c-8ff6-d862c39ab785?source=api-prod","affected":[{"type":"plugin","slug":"university-quizzes-online","name":"University quizzes online","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:49:57Z"},{"id":"wordfence:6ac3b00e-26f2-471d-a682-6cb4939e819e","source":"wordfence","cve":"","title":"WP PayPal <= 1.2.3.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac3b00e-26f2-471d-a682-6cb4939e819e?source=api-prod","affected":[{"type":"plugin","slug":"wp-paypal","name":"Payment Button for PayPal","from":"*","from_inclusive":true,"to":"1.2.3.7","to_inclusive":true,"patched_in":"1.2.3.8"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ac72136-7911-4980-92b0-9bf18bed2201","source":"wordfence","cve":"CVE-2023-4060","title":"WP Adminify <= 3.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac72136-7911-4980-92b0-9bf18bed2201?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ac97f2d-377c-40ad-9e2c-67ee32de6927","source":"wordfence","cve":"CVE-2026-107776","title":"Dokan <= 5.3.2 - Authenticated (Vendor+) Business Logic Flaw","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ac97f2d-377c-40ad-9e2c-67ee32de6927?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:39:22Z"},{"id":"wordfence:6acb99eb-d61c-4d1f-b399-32db07c7e3e7","source":"wordfence","cve":"CVE-2025-6987","title":"Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6acb99eb-d61c-4d1f-b399-32db07c7e3e7?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2025.5","to_inclusive":true,"patched_in":"2025.6"}],"published":"2025-07-25T00:00:00Z","updated":"2025-07-26T06:43:22Z"},{"id":"wordfence:6acc489c-283d-42a6-ab7e-89a178873c31","source":"wordfence","cve":"CVE-2025-53289","title":"Theme Blvd Widget Areas <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6acc489c-283d-42a6-ab7e-89a178873c31?source=api-prod","affected":[{"type":"plugin","slug":"theme-blvd-widget-areas","name":"Theme Blvd Widget Areas","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:14:49Z"},{"id":"wordfence:6ad1d9f5-c224-4d28-8d73-439b3c5ca24f","source":"wordfence","cve":"CVE-2025-12404","title":"Like-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad1d9f5-c224-4d28-8d73-439b3c5ca24f?source=api-prod","affected":[{"type":"plugin","slug":"like-it","name":"Like-it","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:15:35Z","updated":"2025-11-18T08:27:32Z"},{"id":"wordfence:6ad21e49-6a18-40f1-9c5f-3f1cbe97cb1d","source":"wordfence","cve":"CVE-2024-12311","title":"Email Subscribers by Icegram Express \u2013 Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad21e49-6a18-40f1-9c5f-3f1cbe97cb1d?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.43","to_inclusive":true,"patched_in":"5.7.44"}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-17T12:36:47Z"},{"id":"wordfence:6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948","source":"wordfence","cve":"CVE-2023-28166","title":"Tags Cloud Manager <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad70391-7ea0-49c0-ac5c-ecf7ddb3c948?source=api-prod","affected":[{"type":"plugin","slug":"tags-cloud-manager","name":"Tags Cloud Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ad7ec7b-c59c-41e7-92ac-134b5ad92673","source":"wordfence","cve":"CVE-2026-22435","title":"ElectroServ | Electrical Repair Service WordPress Theme <= 1.3.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad7ec7b-c59c-41e7-92ac-134b5ad92673?source=api-prod","affected":[{"type":"theme","slug":"electroserv","name":"ElectroServ | Electrical Repair Service WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:36:43Z"},{"id":"wordfence:6ad84e6e-5498-4bf1-b662-15b7628ceba2","source":"wordfence","cve":"CVE-2023-46094","title":"Conversios.io <= 6.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad84e6e-5498-4bf1-b662-15b7628ceba2?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ad895db-5fe9-419b-8884-9a840bd350f6","source":"wordfence","cve":"CVE-2023-38520","title":"Pinpoint Booking System <= 2.9.9.3.4 - Content Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-451","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ad895db-5fe9-419b-8884-9a840bd350f6?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.3.4","to_inclusive":true,"patched_in":"2.9.9.3.5"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6adab3e7-c437-4832-a015-0ebf0976a78a","source":"wordfence","cve":"CVE-2025-28932","title":"Insert Code <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6adab3e7-c437-4832-a015-0ebf0976a78a?source=api-prod","affected":[{"type":"plugin","slug":"insert-code","name":"Insert Code","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:15:29Z"},{"id":"wordfence:6adb2f80-375a-4302-ac41-7f2b87999751","source":"wordfence","cve":"CVE-2026-32381","title":"App Landing Page <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6adb2f80-375a-4302-ac41-7f2b87999751?source=api-prod","affected":[{"type":"theme","slug":"app-landing-page","name":"App Landing Page","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:54:28Z"},{"id":"wordfence:6adc0154-169a-4d72-8687-66dbf6766139","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in exec_multitask_widgets function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6adc0154-169a-4d72-8687-66dbf6766139?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6adf6f3b-aff0-4495-92a4-13855dac5030","source":"wordfence","cve":"CVE-2024-39661","title":"Kubio AI Page Builder <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6adf6f3b-aff0-4495-92a4-13855dac5030?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:34:38Z"},{"id":"wordfence:6ae1f758-0990-46c3-bd77-3e43bb14d03f","source":"wordfence","cve":"CVE-2024-49300","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae1f758-0990-46c3-bd77-3e43bb14d03f?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-14T15:17:19Z"},{"id":"wordfence:6ae244a4-8eff-4963-81e9-8e1be8529105","source":"wordfence","cve":"CVE-2026-125766","title":"WPZOOM Social Feed Widget & Block <= 2.4.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae244a4-8eff-4963-81e9-8e1be8529105?source=api-prod","affected":[{"type":"plugin","slug":"instagram-widget-by-wpzoom","name":"WPZOOM Social Feed Widget & Block","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:03Z"},{"id":"wordfence:6ae2f78b-5042-4216-903c-d5919f137a94","source":"wordfence","cve":"CVE-2025-14359","title":"Oshine <= 7.2.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae2f78b-5042-4216-903c-d5919f137a94?source=api-prod","affected":[{"type":"theme","slug":"oshin","name":"Oshin","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T17:29:07Z"},{"id":"wordfence:6ae550c9-b169-41f8-ab0a-b9f30217a518","source":"wordfence","cve":"CVE-2026-103684","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae550c9-b169-41f8-ab0a-b9f30217a518?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.1.26"}],"published":"2026-10-05T11:26:00Z","updated":"2026-10-08T23:21:17Z"},{"id":"wordfence:6ae78330-c07a-4ebc-9bb6-2aabeb0c8526","source":"wordfence","cve":"CVE-2025-28994","title":"Viral Loops WP Integration <= 3.8.1 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ae78330-c07a-4ebc-9bb6-2aabeb0c8526?source=api-prod","affected":[{"type":"plugin","slug":"viral-loops-wp-integration","name":"Viral Loops WP Integration","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:25:02Z"},{"id":"wordfence:6aeb0352-66ab-45d4-ad61-f425d7d41f45","source":"wordfence","cve":"","title":"Daily Edition <= 1.6.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aeb0352-66ab-45d4-ad61-f425d7d41f45?source=api-prod","affected":[{"type":"theme","slug":"dailyedition","name":"Daily Edition","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2015-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aec878b-79c6-45da-a8f7-0f2d3185ecc2","source":"wordfence","cve":"CVE-2024-6857","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Header/Footer/Body Script Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aec878b-79c6-45da-a8f7-0f2d3185ecc2?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-04-22T20:21:56Z"},{"id":"wordfence:6aed9434-1681-47d6-bbc1-0815db548a24","source":"wordfence","cve":"CVE-2023-40332","title":"WP-PostRatings <= 1.91 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aed9434-1681-47d6-bbc1-0815db548a24?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings","name":"WP-PostRatings","from":"*","from_inclusive":true,"to":"1.91","to_inclusive":true,"patched_in":"1.91.1"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72","source":"wordfence","cve":"CVE-2025-10484","title":"Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aef6fbb-be8c-49e1-ada5-7b4aa8b2ff72?source=api-prod","affected":[{"type":"plugin","slug":"registration-login-with-mobile-phone-number","name":"Registration & Login with Mobile Phone Number for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-17T08:24:31Z"},{"id":"wordfence:6af02955-2ea4-459a-bea7-ecbe35232ec5","source":"wordfence","cve":"CVE-2024-56244","title":"Ashe Extra <= 1.2.92 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af02955-2ea4-459a-bea7-ecbe35232ec5?source=api-prod","affected":[{"type":"plugin","slug":"ashe-extra","name":"Ashe Extra","from":"*","from_inclusive":true,"to":"1.2.92","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:43:50Z"},{"id":"wordfence:6af0aa17-2bbf-489e-aedb-95b514f6c9a2","source":"wordfence","cve":"CVE-2026-40792","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af0aa17-2bbf-489e-aedb-95b514f6c9a2?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T15:05:57Z"},{"id":"wordfence:6af1224e-0ed3-4770-96c0-c15cc895d36d","source":"wordfence","cve":"CVE-2023-47766","title":"Post Status Notifier Lite <= 1.11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af1224e-0ed3-4770-96c0-c15cc895d36d?source=api-prod","affected":[{"type":"plugin","slug":"post-status-notifier-lite","name":"Post Status Notifier Lite","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6af20a2c-065c-48d5-a95c-2883ceeb50c6","source":"wordfence","cve":"CVE-2023-47808","title":"Add Widgets to Page <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af20a2c-065c-48d5-a95c-2883ceeb50c6?source=api-prod","affected":[{"type":"plugin","slug":"add-widgets-to-page","name":"Add Widgets to Page","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6af64b51-1758-495f-b6d7-364488de9ab8","source":"wordfence","cve":"CVE-2026-4063","title":"Social Icons Widget & Block <= 4.5.8 - Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af64b51-1758-495f-b6d7-364488de9ab8?source=api-prod","affected":[{"type":"plugin","slug":"social-icons-widget-by-wpzoom","name":"WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2026-03-12T20:38:20Z","updated":"2026-03-13T09:25:05Z"},{"id":"wordfence:6af79da4-e012-47eb-ac12-584669ea68e0","source":"wordfence","cve":"CVE-2026-54860","title":"Ozisti | Augmented Reality WooCommerce Theme <= 1.1.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af79da4-e012-47eb-ac12-584669ea68e0?source=api-prod","affected":[{"type":"theme","slug":"ozisti","name":"Ozisti | Augmented Reality WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T13:05:49Z","updated":"2026-11-03T20:03:48Z"},{"id":"wordfence:6af83daa-ad8c-43ba-b77e-ad085889277c","source":"wordfence","cve":"CVE-2019-17674","title":"WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6af83daa-ad8c-43ba-b77e-ad085889277c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.14","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6afa4ca1-5284-4c05-acdc-292fab332fe0","source":"wordfence","cve":"CVE-2025-53585","title":"WeMusic <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6afa4ca1-5284-4c05-acdc-292fab332fe0?source=api-prod","affected":[{"type":"theme","slug":"noo-wemusic","name":"WeMusic - Music Band Event WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-08-02T00:00:00Z","updated":"2025-11-11T17:20:56Z"},{"id":"wordfence:6afbdac4-e52a-4ad3-a99a-2d75e698e0fc","source":"wordfence","cve":"CVE-2025-30901","title":"JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6afbdac4-e52a-4ad3-a99a-2d75e698e0fc?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:22:34Z"},{"id":"wordfence:6afce24f-30cd-4aeb-a5dd-20bd80a75779","source":"wordfence","cve":"CVE-2026-111602","title":"Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6afce24f-30cd-4aeb-a5dd-20bd80a75779?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-10-16T14:30:46Z","updated":"2026-10-17T02:31:08Z"},{"id":"wordfence:6afd5a43-a835-4251-b7b2-a787582c9e71","source":"wordfence","cve":"CVE-2026-10749","title":"Post Duplicator < 3.0.15 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6afd5a43-a835-4251-b7b2-a787582c9e71?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":false,"patched_in":"3.0.15"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:02:01Z"},{"id":"wordfence:6aff1ea6-c6d2-4195-899b-3a038b73a7f0","source":"wordfence","cve":"CVE-2024-31117","title":"WooCommerce Bookings Calendar <= 1.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6aff1ea6-c6d2-4195-899b-3a038b73a7f0?source=api-prod","affected":[{"type":"plugin","slug":"woo-bookings-calendar","name":"Bookings Calendar for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":"1.0.37"}],"published":"2024-03-29T00:00:00Z","updated":"2026-10-28T21:05:47Z"},{"id":"wordfence:6affdb56-39cc-4749-b7cb-b80b7666f028","source":"wordfence","cve":"CVE-2025-12512","title":"GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6affdb56-39cc-4749-b7cb-b80b7666f028?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-12-12T14:28:54Z","updated":"2025-12-13T03:20:25Z"},{"id":"wordfence:6b00a274-4c77-429f-9d06-72c82094c838","source":"wordfence","cve":"CVE-2025-49391","title":"Sign-up Sheets <= 2.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b00a274-4c77-429f-9d06-72c82094c838?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.3.1"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:56:35Z"},{"id":"wordfence:6b019674-cfe9-4f59-8ec2-4844cbca3c93","source":"wordfence","cve":"CVE-2024-13223","title":"Tabulate <= 2.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b019674-cfe9-4f59-8ec2-4844cbca3c93?source=api-prod","affected":[{"type":"plugin","slug":"tabulate","name":"Tabulate","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:56:38Z"},{"id":"wordfence:6b028923-82fe-4dd6-af77-69d7744f2812","source":"wordfence","cve":"CVE-2024-27965","title":"WPFunnels <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b028923-82fe-4dd6-af77-69d7744f2812?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:16:17Z"},{"id":"wordfence:6b0382e2-e029-4e19-981c-6dc570e182f0","source":"wordfence","cve":"CVE-2026-4479","title":"WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b0382e2-e029-4e19-981c-6dc570e182f0?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-products-dynamic-pricing-management-woocommerce","name":"WholeSale Products Dynamic Pricing Management WooCommerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-04-13T15:13:22Z","updated":"2026-04-14T03:37:33Z"},{"id":"wordfence:6b04a5e4-f4df-4ac4-a1a0-3e1d18bb9d02","source":"wordfence","cve":"CVE-2024-49333","title":"Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b04a5e4-f4df-4ac4-a1a0-3e1d18bb9d02?source=api-prod","affected":[{"type":"plugin","slug":"hmenu","name":"Hero Mega Menu - Responsive WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.16.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:41:08Z"},{"id":"wordfence:6b063d3f-11b3-4609-a7d5-dba961034b45","source":"wordfence","cve":"CVE-2025-31556","title":"IMPress for IDX Broker <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b063d3f-11b3-4609-a7d5-dba961034b45?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-03-31T00:00:00Z","updated":"2025-05-02T11:44:18Z"},{"id":"wordfence:6b065dbe-2218-4599-8c9c-a4b9b6097ec0","source":"wordfence","cve":"CVE-2025-22746","title":"HireHive Job Plugin <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b065dbe-2218-4599-8c9c-a4b9b6097ec0?source=api-prod","affected":[{"type":"plugin","slug":"zartis-job-plugin","name":"HireHive Job Plugin","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:48:45Z"},{"id":"wordfence:6b06667f-cda1-4177-b168-c7d26a0cd815","source":"wordfence","cve":"","title":"Coalition (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b06667f-cda1-4177-b168-c7d26a0cd815?source=api-prod","affected":[{"type":"theme","slug":"coalition","name":"Coalition","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b08105d-711e-49ea-a0bc-7179eb021300","source":"wordfence","cve":"","title":"SS Quiz <= 1.12.2 - Unspecified Vulnerabilities","severity":"high","cvss":7.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b08105d-711e-49ea-a0bc-7179eb021300?source=api-prod","affected":[{"type":"plugin","slug":"ssquiz","name":"SS Quiz","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"2.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b0b2cac-cf4f-46cd-abe9-8ac6ff763a5d","source":"wordfence","cve":"CVE-2026-28115","title":"WP Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b0b2cac-cf4f-46cd-abe9-8ac6ff763a5d?source=api-prod","affected":[{"type":"plugin","slug":"WP_AttractiveDonationsSystem","name":"WP Attractive Donations System - Easy Stripe & Paypal donations","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:32:45Z"},{"id":"wordfence:6b0f85d5-6ef7-4e6d-a03b-75672fca654c","source":"wordfence","cve":"CVE-2021-34664","title":"Moova for WooCommerce <= 3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b0f85d5-6ef7-4e6d-a03b-75672fca654c?source=api-prod","affected":[{"type":"plugin","slug":"moova-for-woocommerce","name":"Moova","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b11b6f4-0b84-4cb2-9bdf-b04b63af6197","source":"wordfence","cve":"CVE-2026-9269","title":"Secure Copy Content Protection and Content Locking <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b11b6f4-0b84-4cb2-9bdf-b04b63af6197?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2026-05-22T00:00:00Z","updated":"2026-09-18T15:05:14Z"},{"id":"wordfence:6b11dc40-e0aa-4a82-b8a3-90ef72ae6871","source":"wordfence","cve":"CVE-2025-24553","title":"Shipping with Venipak for WooCommerce <= 1.22.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b11dc40-e0aa-4a82-b8a3-90ef72ae6871?source=api-prod","affected":[{"type":"plugin","slug":"wc-venipak-shipping","name":"Shipping with Venipak for WooCommerce","from":"*","from_inclusive":true,"to":"1.22.4","to_inclusive":true,"patched_in":"1.22.5"}],"published":"2024-11-17T00:00:00Z","updated":"2025-04-22T21:56:51Z"},{"id":"wordfence:6b13b275-e2d9-427a-aed7-e52cee13e05d","source":"wordfence","cve":"CVE-2026-111974","title":"GiveWP <= 4.19.0.0 - Unauthenticated Donation Amount Restriction Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b13b275-e2d9-427a-aed7-e52cee13e05d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:05:17Z"},{"id":"wordfence:6b1524f3-1c59-49a1-bbe3-94dcfd232b1d","source":"wordfence","cve":"CVE-2025-11983","title":"WP Discourse <= 2.5.9 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1524f3-1c59-49a1-bbe3-94dcfd232b1d?source=api-prod","affected":[{"type":"plugin","slug":"wp-discourse","name":"WP Discourse","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-10-31T16:59:07Z","updated":"2025-11-01T05:40:23Z"},{"id":"wordfence:6b155ec8-d69d-40cf-8bea-201629bc9ca6","source":"wordfence","cve":"CVE-2024-9598","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b155ec8-d69d-40cf-8bea-201629bc9ca6?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.99.1","to_inclusive":true,"patched_in":"1.0.99.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T07:37:59Z"},{"id":"wordfence:6b15eca5-fd47-4f8f-8ade-3a90e0bfc110","source":"wordfence","cve":"CVE-2026-5076","title":"ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b15eca5-fd47-4f8f-8ade-3a90e0bfc110?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-06-02T05:30:45Z","updated":"2026-06-02T18:30:46Z"},{"id":"wordfence:6b16028a-0b69-422b-9471-32ea6edb93a0","source":"wordfence","cve":"CVE-2026-0725","title":"Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b16028a-0b69-422b-9471-32ea6edb93a0?source=api-prod","affected":[{"type":"plugin","slug":"integrate-dynamics-365-crm","name":"Integrate Dynamics 365 CRM","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-01-16T19:47:08Z","updated":"2026-01-17T08:24:31Z"},{"id":"wordfence:6b1bf4e0-b4e1-4c3f-ae17-ffbf31849651","source":"wordfence","cve":"CVE-2025-69337","title":"Wolmart Core <= 1.9.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1bf4e0-b4e1-4c3f-ae17-ffbf31849651?source=api-prod","affected":[{"type":"plugin","slug":"wolmart-core","name":"Wolmart Core","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:17:57Z"},{"id":"wordfence:6b1cc870-0118-4799-a981-b8926f7084cf","source":"wordfence","cve":"CVE-2026-112829","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1cc870-0118-4799-a981-b8926f7084cf?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":"1.0.31"}],"published":"2026-10-20T15:11:00Z","updated":"2026-10-23T18:51:50Z"},{"id":"wordfence:6b1d212b-75fe-4285-9c22-62b040e5a36c","source":"wordfence","cve":"CVE-2024-10020","title":"Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1d212b-75fe-4285-9c22-62b040e5a36c?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2024-11-05T00:00:00Z","updated":"2025-02-19T17:42:08Z"},{"id":"wordfence:6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69","source":"wordfence","cve":"CVE-2025-8213","title":"NinjaScanner \u2013 Virus & Malware scan <= 3.2.5 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=api-prod","affected":[{"type":"plugin","slug":"ninjascanner","name":"NinjaScanner \u2013 Virus & Malware scan","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-07-30T00:00:00Z","updated":"2025-07-31T12:24:46Z"},{"id":"wordfence:6b1e20ee-4c25-4174-a809-b4fdecc44fd1","source":"wordfence","cve":"CVE-2025-48306","title":"Savyour Affiliate Partner <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1e20ee-4c25-4174-a809-b4fdecc44fd1?source=api-prod","affected":[{"type":"plugin","slug":"savyour-affiliate-partner","name":"Savyour Affiliate Partner","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T19:58:32Z"},{"id":"wordfence:6b1f98d1-ced5-4604-83b7-e0bedc5d4915","source":"wordfence","cve":"CVE-2026-24606","title":"Bayarcash WooCommerce <= 4.3.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1f98d1-ced5-4604-83b7-e0bedc5d4915?source=api-prod","affected":[{"type":"plugin","slug":"bayarcash-wc","name":"Bayarcash WooCommerce","from":"*","from_inclusive":true,"to":"4.3.12","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-01-13T20:49:08Z","updated":"2026-02-13T18:34:54Z"},{"id":"wordfence:6b20bda7-c4dd-4260-94f1-d81515324a54","source":"wordfence","cve":"CVE-2025-66090","title":"SKT Skill Bar <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b20bda7-c4dd-4260-94f1-d81515324a54?source=api-prod","affected":[{"type":"plugin","slug":"skt-skill-bar","name":"SKT Skill Bar","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-24T20:59:43Z"},{"id":"wordfence:6b213baa-8508-4eb2-ac09-d320e2b4276c","source":"wordfence","cve":"CVE-2023-46209","title":"Grid Plus <= 1.3.4 - Reflected Cross-Site Scripting via grid_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b213baa-8508-4eb2-ac09-d320e2b4276c?source=api-prod","affected":[{"type":"plugin","slug":"grid-plus","name":"Grid Plus \u2013 Unlimited grid layout","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-10-19T00:00:00Z","updated":"2024-03-11T09:41:22Z"},{"id":"wordfence:6b226067-0287-4f7e-9415-dc3c83f2fd27","source":"wordfence","cve":"CVE-2024-3818","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via \"Social Icons\" Block","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b226067-0287-4f7e-9415-dc3c83f2fd27?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"4.5.10"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T02:34:44Z"},{"id":"wordfence:6b26093a-ffb8-4d22-add1-eecd94f88129","source":"wordfence","cve":"CVE-2022-40696","title":"Advanced Custom Fields <= 6.0.2 - Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b26093a-ffb8-4d22-add1-eecd94f88129?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b26dd2e-3d0b-4c6b-8819-6d1e437207fd","source":"wordfence","cve":"CVE-2015-3300","title":"TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b26dd2e-3d0b-4c6b-8819-6d1e437207fd?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":""}],"published":"2015-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b26f41e-fab8-4fe4-b5ab-4c238a433eab","source":"wordfence","cve":"CVE-2024-52442","title":"UserPlus <= 2.0 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b26f41e-fab8-4fe4-b5ab-4c238a433eab?source=api-prod","affected":[{"type":"plugin","slug":"userplus","name":"User registration & user profile \u2013 UserPlus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:32:48Z"},{"id":"wordfence:6b28908b-ffad-46d5-b6de-6b9c7bbe0134","source":"wordfence","cve":"","title":"JobRoller <= 1.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b28908b-ffad-46d5-b6de-6b9c7bbe0134?source=api-prod","affected":[{"type":"theme","slug":"jobroller","name":"JobRoller","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2013-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b2971f0-e989-4e2e-9207-05cd381786ce","source":"wordfence","cve":"CVE-2025-64226","title":"Stockie Extra <= 1.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b2971f0-e989-4e2e-9207-05cd381786ce?source=api-prod","affected":[{"type":"plugin","slug":"stockie-extra","name":"Stockie Extra","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-04T15:45:35Z"},{"id":"wordfence:6b2e210b-e5e3-46f1-b730-64d970160a5e","source":"wordfence","cve":"CVE-2015-0894","title":"All In One WP Security & Firewall <= 3.8.7 - SQL Injection","severity":"critical","cvss":9.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b2e210b-e5e3-46f1-b730-64d970160a5e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":false,"patched_in":"3.8.8"}],"published":"2015-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b2e61aa-617b-450e-8859-50b1012fc0c3","source":"wordfence","cve":"CVE-2021-39329","title":"JobBoardWP \u2013 Job Board Listings and Submissions <= 1.0.7 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b2e61aa-617b-450e-8859-50b1012fc0c3?source=api-prod","affected":[{"type":"plugin","slug":"jobboardwp","name":"JobBoardWP \u2013 Job Board Listings and Submissions","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2021-10-15T19:23:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b2f6506-1a45-4967-9972-283505df25af","source":"wordfence","cve":"CVE-2026-16066","title":"Welcart e-Commerce <= 2.11.33 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b2f6506-1a45-4967-9972-283505df25af?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.33","to_inclusive":true,"patched_in":"2.11.34"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:35:53Z"},{"id":"wordfence:6b30089a-2267-47b9-b0a5-d6eeadfe51d2","source":"wordfence","cve":"CVE-2026-7232","title":"FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b30089a-2267-47b9-b0a5-d6eeadfe51d2?source=api-prod","affected":[{"type":"plugin","slug":"formcraft3","name":"FormCraft","from":"*","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.9.15"}],"published":"2026-07-22T16:47:18Z","updated":"2026-07-23T05:35:54Z"},{"id":"wordfence:6b30a446-322e-4684-a654-22bbbbacefa3","source":"wordfence","cve":"CVE-2026-115607","title":"DXP ToolKit <= 2.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b30a446-322e-4684-a654-22bbbbacefa3?source=api-prod","affected":[{"type":"plugin","slug":"dxp-toolkit","name":"DXP ToolKit","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-10-26T12:10:35Z","updated":"2026-11-03T19:27:43Z"},{"id":"wordfence:6b3276c9-6f53-4c59-833e-b4d85a3f7da5","source":"wordfence","cve":"CVE-2026-62017","title":"Good Homes - Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3276c9-6f53-4c59-833e-b4d85a3f7da5?source=api-prod","affected":[{"type":"theme","slug":"good-homes","name":"Good Homes - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:38:09Z"},{"id":"wordfence:6b33c180-10b4-4550-8c24-72c9e53664a5","source":"wordfence","cve":"CVE-2024-9543","title":"Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b33c180-10b4-4550-8c24-72c9e53664a5?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.9.18","to_inclusive":true,"patched_in":"11.9.19"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T05:33:13Z"},{"id":"wordfence:6b36938e-5333-4331-9bb1-34465fe03f2f","source":"wordfence","cve":"CVE-2024-9538","title":"ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b36938e-5333-4331-9bb1-34465fe03f2f?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T11:01:55Z"},{"id":"wordfence:6b36fcc5-1f09-43b9-8877-7af6c7652db7","source":"wordfence","cve":"","title":"White Label CMS <= 1.5.2 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b36fcc5-1f09-43b9-8877-7af6c7652db7?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2015-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b3a0ceb-f42b-42dd-9308-cd66122ebb7f","source":"wordfence","cve":"CVE-2025-26534","title":"Helloprint <= 2.0.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3a0ceb-f42b-42dd-9308-cd66122ebb7f?source=api-prod","affected":[{"type":"plugin","slug":"helloprint","name":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-07T14:12:12Z"},{"id":"wordfence:6b3e93bf-af5c-4ca3-a531-2d91df880c51","source":"wordfence","cve":"CVE-2025-8151","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3e93bf-af5c-4ca3-a531-2d91df880c51?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-07-30T00:00:00Z","updated":"2025-07-31T11:19:13Z"},{"id":"wordfence:6b3fc000-57e7-4be4-959f-27dac9717b9e","source":"wordfence","cve":"CVE-2024-29792","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.93 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b3fc000-57e7-4be4-959f-27dac9717b9e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.93","to_inclusive":true,"patched_in":"1.5.94"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:11:37Z"},{"id":"wordfence:6b4087e9-071c-4cfc-b23d-ae8dd0059a2b","source":"wordfence","cve":"","title":"Live Scores for SportsPress <= 1.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b4087e9-071c-4cfc-b23d-ae8dd0059a2b?source=api-prod","affected":[{"type":"plugin","slug":"live-scores-for-sportspress","name":"Live Scores for SportsPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b41380b-5028-4230-a380-e46871e2eede","source":"wordfence","cve":"CVE-2026-109891","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b41380b-5028-4230-a380-e46871e2eede?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.50.1","to_inclusive":true,"patched_in":"3.51.0"}],"published":"2026-10-29T15:03:00Z","updated":"2026-11-03T19:21:56Z"},{"id":"wordfence:6b431493-fd96-495b-aaa7-6dfeef04b011","source":"wordfence","cve":"CVE-2022-0817","title":"BadgeOS <= 3.7.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b431493-fd96-495b-aaa7-6dfeef04b011?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b443610-416c-41d6-9449-9e20f719af06","source":"wordfence","cve":"","title":"Contus Video Gallery <= 1.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b443610-416c-41d6-9449-9e20f719af06?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-galleryversion-10","name":"Contus Video Gallery","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2012-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b456815-ffdf-41fb-b4a8-0f22fd059d34","source":"wordfence","cve":"","title":"AJAX Store Locator <= 1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b456815-ffdf-41fb-b4a8-0f22fd059d34?source=api-prod","affected":[{"type":"plugin","slug":"ajax-store-locator","name":"AJAX Store Locator","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2015-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b4851eb-ccb7-43ad-b83d-02ad2e20ddd4","source":"wordfence","cve":"CVE-2026-19436","title":"Ultimate Gift Cards for WooCommerce < 3.2.10 -  Unauthenticated Inflated Gift Card Credit Acquisition","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b4851eb-ccb7-43ad-b83d-02ad2e20ddd4?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":false,"patched_in":"3.2.10"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:55:39Z"},{"id":"wordfence:6b48cae6-254c-4882-a464-3a44a63cadf5","source":"wordfence","cve":"","title":"Ultimate Addons for WPBakery <= 3.16.11 - Stored Cross-Site Scripting","severity":"critical","cvss":9.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b48cae6-254c-4882-a464-3a44a63cadf5?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.16.11","to_inclusive":true,"patched_in":"3.16.12"}],"published":"2017-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b4a3ed0-50e9-4bc3-a003-17b5d7c15848","source":"wordfence","cve":"CVE-2025-31539","title":"Cryptocurrency Widgets Pack <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b4a3ed0-50e9-4bc3-a003-17b5d7c15848?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-widgets-pack","name":"Cryptocurrency Widgets Pack","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T14:15:38Z"},{"id":"wordfence:6b4b05a8-3a32-4fa9-9ff5-a2a62b11a05d","source":"wordfence","cve":"CVE-2023-29441","title":"WebLibrarian <= 3.5.8.1 - Reflected Cross-Site Scripting via multiple parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b4b05a8-3a32-4fa9-9ff5-a2a62b11a05d?source=api-prod","affected":[{"type":"plugin","slug":"weblibrarian","name":"WebLibrarian","from":"*","from_inclusive":true,"to":"3.5.8.1","to_inclusive":true,"patched_in":"3.5.8.2"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b50656b-6cb4-4920-aa36-2634d4d41f5c","source":"wordfence","cve":"CVE-2015-5623","title":"WordPress Core < 4.2.3 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b50656b-6cb4-4920-aa36-2634d4d41f5c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"3.7.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2015-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b524fc5-4beb-49f6-bafa-c788c6d1d78c","source":"wordfence","cve":"CVE-2024-1592","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b524fc5-4beb-49f6-bafa-c788c6d1d78c?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-02T06:46:20Z"},{"id":"wordfence:6b5288db-8996-4363-bdc0-d3bdd2445e9f","source":"wordfence","cve":"CVE-2025-32596","title":"Real Estate Manager <= 7.3 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5288db-8996-4363-bdc0-d3bdd2445e9f?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:6b53ed24-2821-440f-9aba-69d75b7459a3","source":"wordfence","cve":"CVE-2023-6391","title":"Custom User CSS <= 0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b53ed24-2821-440f-9aba-69d75b7459a3?source=api-prod","affected":[{"type":"plugin","slug":"custom-user-css","name":"Custom User CSS","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-02-04T13:53:53Z"},{"id":"wordfence:6b558818-f459-4bc1-893c-8c1c7bf9d6d2","source":"wordfence","cve":"CVE-2017-14723","title":"WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b558818-f459-4bc1-893c-8c1c7bf9d6d2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b562f31-6a57-4719-a0e1-6a92affef844","source":"wordfence","cve":"CVE-2026-93855","title":"SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b562f31-6a57-4719-a0e1-6a92affef844?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.26.1.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:44:53Z","updated":"2026-10-29T03:39:15Z"},{"id":"wordfence:6b591f0e-f9bb-4bbc-988c-7a0b03cdd1c7","source":"wordfence","cve":"CVE-2025-48264","title":"Product Code for WooCommerce <= 1.5.0 - Cross-Site Request Forgery to Database Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b591f0e-f9bb-4bbc-988c-7a0b03cdd1c7?source=api-prod","affected":[{"type":"plugin","slug":"product-code-for-woocommerce","name":"Product Code for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:49:46Z"},{"id":"wordfence:6b5964a7-410b-4fea-9de2-22ffda80c8e8","source":"wordfence","cve":"CVE-2023-50838","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.5.5 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5964a7-410b-4fea-9de2-22ffda80c8e8?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b5a2a2a-a204-4265-b81e-4b785a407871","source":"wordfence","cve":"CVE-2022-33901","title":"MultiSafepay plugin for WooCommerce <= 4.15.0 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5a2a2a-a204-4265-b81e-4b785a407871?source=api-prod","affected":[{"type":"plugin","slug":"multisafepay","name":"MultiSafepay plugin for WooCommerce","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.16.0"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b5af3f3-d2ef-4458-aac1-cd2d6902c145","source":"wordfence","cve":"CVE-2026-22424","title":"Shaha | Islamic Centre & Mosque Theme + RTL <= 1.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5af3f3-d2ef-4458-aac1-cd2d6902c145?source=api-prod","affected":[{"type":"theme","slug":"shaha","name":"Shaha | Islamic Centre & Mosque Theme + RTL","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:38:30Z"},{"id":"wordfence:6b5d31c5-0516-4089-9867-2922670e1b04","source":"wordfence","cve":"","title":"Gravityforms <= 1.9.15.11 - Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5d31c5-0516-4089-9867-2922670e1b04?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"1.9.15.11","to_inclusive":true,"patched_in":"1.9.16"}],"published":"2016-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b5e8cfd-989e-4a64-abb0-9daa22df46a4","source":"wordfence","cve":"CVE-2026-11988","title":"LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5e8cfd-989e-4a64-abb0-9daa22df46a4?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.9.1","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-06-30T16:07:05Z","updated":"2026-07-01T04:32:27Z"},{"id":"wordfence:6b5e9c7f-e0c9-4c27-8b39-87e15fd29604","source":"wordfence","cve":"CVE-2023-47829","title":"Quick Call Button <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5e9c7f-e0c9-4c27-8b39-87e15fd29604?source=api-prod","affected":[{"type":"plugin","slug":"quick-call-button","name":"Quick Call Button","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b60777e-6e07-42bd-9364-43367e209227","source":"wordfence","cve":"CVE-2025-9891","title":"User Sync \u2013 Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b60777e-6e07-42bd-9364-43367e209227?source=api-prod","affected":[{"type":"plugin","slug":"user-sync","name":"User Sync","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-09-16T13:49:44Z","updated":"2025-09-17T01:53:14Z"},{"id":"wordfence:6b6250d0-8f5e-4283-8d16-0b2f467e1224","source":"wordfence","cve":"CVE-2015-9319","title":"Greg's High Performance SEO <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6250d0-8f5e-4283-8d16-0b2f467e1224?source=api-prod","affected":[{"type":"plugin","slug":"gregs-high-performance-seo","name":"Greg's High Performance SEO","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2015-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b635525-7e0a-4bb5-84fd-f8694c352b0b","source":"wordfence","cve":"CVE-2025-23430","title":"Mass Custom Fields Manager <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b635525-7e0a-4bb5-84fd-f8694c352b0b?source=api-prod","affected":[{"type":"plugin","slug":"mass-custom-fields-manager","name":"Mass Custom Fields Manager","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:23:31Z"},{"id":"wordfence:6b665b86-6969-4458-b881-6236a4bb259d","source":"wordfence","cve":"CVE-2025-57970","title":"SALESmanago <= 3.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b665b86-6969-4458-b881-6236a4bb259d?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T22:22:54Z"},{"id":"wordfence:6b66a0bc-9125-45ee-9583-bc503634a0ce","source":"wordfence","cve":"CVE-2025-9634","title":"Plugin updates blocker <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=api-prod","affected":[{"type":"plugin","slug":"plugin-update-blocker","name":"Plugin updates blocker","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:44:07Z","updated":"2025-09-11T07:24:55Z"},{"id":"wordfence:6b6ab7bc-e815-4b3f-bda1-dd816ca457cd","source":"wordfence","cve":"","title":"Twitter Cards Meta <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6ab7bc-e815-4b3f-bda1-dd816ca457cd?source=api-prod","affected":[{"type":"plugin","slug":"twitter-cards-meta","name":"Twitter Cards Meta \u2013 Best Twitter Card Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b6b6bc9-2e4b-4a50-9ecb-4311e3555abb","source":"wordfence","cve":"CVE-2025-32143","title":"Accordion <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6b6bc9-2e4b-4a50-9ecb-4311e3555abb?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-05T17:38:55Z"},{"id":"wordfence:6b6dc426-7066-46fb-886a-0bf005829abf","source":"wordfence","cve":"CVE-2023-23667","title":"Brands for WooCommerce <= 3.7.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6dc426-7066-46fb-886a-0bf005829abf?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.0.6","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b6f6f93-4c24-4b81-bd5d-470f6dccab92","source":"wordfence","cve":"CVE-2024-3188","title":"Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6f6f93-4c24-4b81-bd5d-470f6dccab92?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-19T13:25:00Z"},{"id":"wordfence:6b6fa5c6-e9a9-45c6-a02b-3630d8ef130e","source":"wordfence","cve":"","title":"MonsterInsights - Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b6fa5c6-e9a9-45c6-a02b-3630d8ef130e?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b71c620-30f2-4d03-8f3c-af6f79e0da28","source":"wordfence","cve":"CVE-2026-32340","title":"Business One Page <= 1.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b71c620-30f2-4d03-8f3c-af6f79e0da28?source=api-prod","affected":[{"type":"theme","slug":"business-one-page","name":"Business One Page","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:46:51Z"},{"id":"wordfence:6b749ed7-ca41-4b3d-a30e-e9abdbc98fab","source":"wordfence","cve":"CVE-2026-59551","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b749ed7-ca41-4b3d-a30e-e9abdbc98fab?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.10","to_inclusive":true,"patched_in":"4.7.11"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:22:11Z"},{"id":"wordfence:6b75ffbe-ef47-4f37-811d-2d501c22b56d","source":"wordfence","cve":"CVE-2025-47517","title":"Accept Donations with PayPal <= 1.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b75ffbe-ef47-4f37-811d-2d501c22b56d?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:23:59Z"},{"id":"wordfence:6b76734b-96ed-4643-b11b-bba0f0f228ab","source":"wordfence","cve":"CVE-2011-5265","title":"Featurific For WordPress <= 1.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b76734b-96ed-4643-b11b-bba0f0f228ab?source=api-prod","affected":[{"type":"plugin","slug":"featurific-for-wordpress","name":"Featurific For WordPress","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2011-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b7877c8-0001-48e3-ab8a-eb1f2bebcbe1","source":"wordfence","cve":"CVE-2026-24983","title":"UpSolution Core <= 8.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7877c8-0001-48e3-ab8a-eb1f2bebcbe1?source=api-prod","affected":[{"type":"plugin","slug":"us-core","name":"UpSolution Core","from":"*","from_inclusive":true,"to":"8.41","to_inclusive":true,"patched_in":"8.42"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:37:28Z"},{"id":"wordfence:6b78e1e8-2298-4889-955c-e9b7472ffbff","source":"wordfence","cve":"CVE-2015-10116","title":"Favicon by RealFaviconGenerator <= 1.2.12 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b78e1e8-2298-4889-955c-e9b7472ffbff?source=api-prod","affected":[{"type":"plugin","slug":"favicon-by-realfavicongenerator","name":"Favicon by RealFaviconGenerator","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":false,"patched_in":"1.2.13"}],"published":"2015-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b7ad031-e15b-4315-9905-9f258f7c4ade","source":"wordfence","cve":"CVE-2021-24164","title":"Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7ad031-e15b-4315-9905-9f258f7c4ade?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.34.1","to_inclusive":false,"patched_in":"3.4.34.1"}],"published":"2021-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b7ce040-32b7-4440-be4f-d33fe9c49e51","source":"wordfence","cve":"CVE-2026-25308","title":"Simple Membership <= 4.6.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7ce040-32b7-4440-be4f-d33fe9c49e51?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-01-19T00:00:00Z","updated":"2026-05-04T15:26:09Z"},{"id":"wordfence:6b7cf194-f7e8-4776-ab14-77d9ad05b966","source":"wordfence","cve":"CVE-2025-48112","title":"Dot html,php,xml etc pages <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7cf194-f7e8-4776-ab14-77d9ad05b966?source=api-prod","affected":[{"type":"plugin","slug":"dot-htmlphpxml-etc-pages","name":"Dot html,php,xml etc pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:33:37Z"},{"id":"wordfence:6b7f700f-e40c-4b45-b651-ab1752255083","source":"wordfence","cve":"CVE-2013-3530","title":"Spiffy XSPF Player <= 0.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b7f700f-e40c-4b45-b651-ab1752255083?source=api-prod","affected":[{"type":"plugin","slug":"spiffy","name":"Spiffy XSPF Player","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2013-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b8038e8-a196-43f0-a250-db95aced944a","source":"wordfence","cve":"CVE-2025-22569","title":"Featured Page Widget <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8038e8-a196-43f0-a250-db95aced944a?source=api-prod","affected":[{"type":"plugin","slug":"featured-page-widget","name":"Featured Page Widget","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:33:22Z"},{"id":"wordfence:6b81ac7b-a966-47cf-8e07-4adfd7bba4f6","source":"wordfence","cve":"CVE-2026-96824","title":"Template Kit \u2013 Import <= 1.0.16 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b81ac7b-a966-47cf-8e07-4adfd7bba4f6?source=api-prod","affected":[{"type":"plugin","slug":"template-kit-import","name":"Template Kit \u2013 Import","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T17:48:14Z"},{"id":"wordfence:6b83527a-aedd-4cc5-9416-1cbdfc2b8850","source":"wordfence","cve":"CVE-2024-37236","title":"Loco Translate <= 2.6.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b83527a-aedd-4cc5-9416-1cbdfc2b8850?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-26T21:29:27Z"},{"id":"wordfence:6b839c7d-76fb-465e-9f27-1882cf0099fa","source":"wordfence","cve":"CVE-2022-4872","title":"WooCommerce Chained Products < 2.12.0 - Missing Authorization to Arbitrary Options Update","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b839c7d-76fb-465e-9f27-1882cf0099fa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-chained-products","name":"WooCommerce Chained Products","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b83e971-7e97-47e3-81a5-ff357692bca2","source":"wordfence","cve":"CVE-2022-0199","title":"Coming soon and Maintenance mode <= 3.6.7 - Cross-Site request Forgery to Arbitrary Email Send","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b83e971-7e97-47e3-81a5-ff357692bca2?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-page","name":"Coming soon and Maintenance mode","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":false,"patched_in":"3.6.8"}],"published":"2022-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b84b13a-b46c-48fc-a7a8-de32c575d576","source":"wordfence","cve":"CVE-2024-1175","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b84b13a-b46c-48fc-a7a8-de32c575d576?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.6","to_inclusive":true,"patched_in":"16.26.7"}],"published":"2024-06-05T15:33:19Z","updated":"2024-08-02T14:46:18Z"},{"id":"wordfence:6b84df5b-ff93-43b3-b9e4-cf963cf2af10","source":"wordfence","cve":"CVE-2023-49182","title":"List all posts by Authors, nested Categories and Title <= 2.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b84df5b-ff93-43b3-b9e4-cf963cf2af10?source=api-prod","affected":[{"type":"plugin","slug":"list-all-posts-by-authors-nested-categories-and-titles","name":"List all posts by Authors, nested Categories and Titles","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2023-11-29T00:00:00Z","updated":"2024-03-14T14:50:43Z"},{"id":"wordfence:6b8655a6-f410-480d-8c45-2527b53fa129","source":"wordfence","cve":"","title":"Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection","severity":"high","cvss":7.4,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8655a6-f410-480d-8c45-2527b53fa129?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":false,"patched_in":"5.0.1"}],"published":"2018-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b87f741-4115-4ded-8dff-dc36cfdf1df1","source":"wordfence","cve":"CVE-2023-32594","title":"Hyphenator <= 5.1.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b87f741-4115-4ded-8dff-dc36cfdf1df1?source=api-prod","affected":[{"type":"plugin","slug":"hyphenator","name":"Hyphenator","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b880e0d-491d-4464-902d-6e601dd7c315","source":"wordfence","cve":"CVE-2026-119211","title":"AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b880e0d-491d-4464-902d-6e601dd7c315?source=api-prod","affected":[{"type":"plugin","slug":"aaa-option-optimizer","name":"AAA Autoload Optimizer","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-11-05T21:53:43Z","updated":"2026-11-06T11:17:37Z"},{"id":"wordfence:6b89b6ac-aa00-4ba6-a1e3-382e7b630fc8","source":"wordfence","cve":"CVE-2020-9393","title":"Pricing Table by Supsystic <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b89b6ac-aa00-4ba6-a1e3-382e7b630fc8?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b89faf8-56b3-4a2d-b890-72242a7fa033","source":"wordfence","cve":"CVE-2025-47499","title":"Simple Blog Stats <= 20250416 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b89faf8-56b3-4a2d-b890-72242a7fa033?source=api-prod","affected":[{"type":"plugin","slug":"simple-blog-stats","name":"Simple Blog Stats","from":"*","from_inclusive":true,"to":"20250416","to_inclusive":true,"patched_in":"20250423"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:26:14Z"},{"id":"wordfence:6b8a0cf1-2be7-4d57-8ef6-137035ceb422","source":"wordfence","cve":"CVE-2015-9404","title":"Neuvoo Jobroll <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8a0cf1-2be7-4d57-8ef6-137035ceb422?source=api-prod","affected":[{"type":"plugin","slug":"neuvoo-jobroll","name":"neuvoo-jobroll","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2015-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b8b94fc-9ae7-47f3-b804-92d0948b662e","source":"wordfence","cve":"CVE-2024-13576","title":"Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8b94fc-9ae7-47f3-b804-92d0948b662e?source=api-prod","affected":[{"type":"plugin","slug":"gumlet-video","name":"Gumlet Video","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-02-17T15:47:38Z","updated":"2025-02-19T21:24:24Z"},{"id":"wordfence:6b8ba516-54f8-4422-846a-106b9e8bca8d","source":"wordfence","cve":"CVE-2026-15206","title":"SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.8 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ba516-54f8-4422-846a-106b9e8bca8d?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":false,"patched_in":"3.9.8"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:57:28Z"},{"id":"wordfence:6b8ed659-0590-411f-9017-f695c9c2f322","source":"wordfence","cve":"CVE-2021-24691","title":"Quiz And Survey Master <= 7.3.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ed659-0590-411f-9017-f695c9c2f322?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b8f081a-30c1-4e18-a873-e5cc3f7cf0c5","source":"wordfence","cve":"CVE-2026-96607","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8f081a-30c1-4e18-a873-e5cc3f7cf0c5?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.3.1","to_inclusive":true,"patched_in":"9.3.2"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:47:26Z"},{"id":"wordfence:6b8f64ed-abf8-4a8b-b32f-75afeaccea5c","source":"wordfence","cve":"CVE-2023-32958","title":"Novelist <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Book Information Fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8f64ed-abf8-4a8b-b32f-75afeaccea5c?source=api-prod","affected":[{"type":"plugin","slug":"novelist","name":"Novelist","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b8fac8f-619a-442e-8b8f-43a0c0a44b07","source":"wordfence","cve":"CVE-2024-7258","title":"WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Feed Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8fac8f-619a-442e-8b8f-43a0c0a44b07?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-08-22T16:29:45Z","updated":"2024-08-22T16:29:45Z"},{"id":"wordfence:6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb","source":"wordfence","cve":"CVE-2026-2494","title":"ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.2","to_inclusive":true,"patched_in":"5.9.8.3"}],"published":"2026-03-06T11:37:07Z","updated":"2026-03-07T01:21:22Z"},{"id":"wordfence:6b908de9-bc83-444e-82d3-a54804785c1d","source":"wordfence","cve":"CVE-2026-27429","title":"Nifty <= 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b908de9-bc83-444e-82d3-a54804785c1d?source=api-prod","affected":[{"type":"theme","slug":"nifty","name":"nifty","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-15T19:18:32Z"},{"id":"wordfence:6b9322d5-afa0-4f38-b5df-2344310f4119","source":"wordfence","cve":"CVE-2026-9232","title":"Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b9322d5-afa0-4f38-b5df-2344310f4119?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.27","to_inclusive":true,"patched_in":"3.12.28"}],"published":"2026-09-18T18:53:57Z","updated":"2026-09-19T07:43:16Z"},{"id":"wordfence:6b96d79b-cd9c-4925-9c15-d0aaf3c0556a","source":"wordfence","cve":"CVE-2024-7687","title":"AZIndex <= 0.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b96d79b-cd9c-4925-9c15-d0aaf3c0556a?source=api-prod","affected":[{"type":"plugin","slug":"azindex","name":"AZIndex","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-26T15:06:52Z"},{"id":"wordfence:6b978749-7ea5-45f4-9f69-66a19c0e39ca","source":"wordfence","cve":"CVE-2023-1028","title":"WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b978749-7ea5-45f4-9f69-66a19c0e39ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b9793e5-2a56-49d3-8c59-f552a4b08166","source":"wordfence","cve":"CVE-2016-10900","title":"Uji Countdown <= 2.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b9793e5-2a56-49d3-8c59-f552a4b08166?source=api-prod","affected":[{"type":"plugin","slug":"uji-countdown","name":"Uji Countdown","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2016-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6b98996c-96b1-4794-8719-359b5c1ef8ce","source":"wordfence","cve":"CVE-2026-115967","title":"OTP Login With Phone Number, OTP Verification <= 1.8.78 - Authenticated (Subscriber+) Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b98996c-96b1-4794-8719-359b5c1ef8ce?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.8.78","to_inclusive":true,"patched_in":"1.8.79"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:35:17Z"},{"id":"wordfence:6b98ea22-4c82-45c6-8e29-75cc9a9185be","source":"wordfence","cve":"CVE-2026-8681","title":"Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6b98ea22-4c82-45c6-8e29-75cc9a9185be?source=api-prod","affected":[{"type":"plugin","slug":"essential-chat-support","name":"Essential Chat Support","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-15T13:35:51Z","updated":"2026-05-16T02:26:50Z"},{"id":"wordfence:6ba2738c-c1dd-4d4f-ab11-6c739e53c4a6","source":"wordfence","cve":"CVE-2024-51805","title":"yPHPlista <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ba2738c-c1dd-4d4f-ab11-6c739e53c4a6?source=api-prod","affected":[{"type":"plugin","slug":"yphplista","name":"yPHPlista","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:24:05Z"},{"id":"wordfence:6ba500fd-3d39-4f5d-a73a-aa777ca03e7f","source":"wordfence","cve":"CVE-2025-60125","title":"FoodBook <= 4.7.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ba500fd-3d39-4f5d-a73a-aa777ca03e7f?source=api-prod","affected":[{"type":"theme","slug":"foodbook","name":"FoodBook","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":true,"patched_in":"4.7.7"}],"published":"2025-09-26T00:00:00Z","updated":"2026-03-17T21:26:53Z"},{"id":"wordfence:6ba532bd-308a-49e5-a413-54de34ac1c42","source":"wordfence","cve":"CVE-2025-63031","title":"EasyTest <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ba532bd-308a-49e5-a413-54de34ac1c42?source=api-prod","affected":[{"type":"plugin","slug":"convertpro","name":"EasyTest \u2013 Simplify A/B Testing","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-12-31T00:00:00Z","updated":"2026-09-09T16:05:07Z"},{"id":"wordfence:6ba8037d-986f-4930-80af-a2912889af2a","source":"wordfence","cve":"CVE-2024-47297","title":"CP Polls <= 1.0.74 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ba8037d-986f-4930-80af-a2912889af2a?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.74","to_inclusive":true,"patched_in":"1.0.75"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:45:45Z"},{"id":"wordfence:6ba8dd06-03a1-4cee-a5c5-ece65a401157","source":"wordfence","cve":"CVE-2026-39755","title":"WP Duplicate \u2013 WordPress Migration Plugin <= 1.1.11 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ba8dd06-03a1-4cee-a5c5-ece65a401157?source=api-prod","affected":[{"type":"plugin","slug":"local-sync","name":"WP Duplicate \u2013 WordPress Migration Plugin","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:46:14Z","updated":"2026-10-08T23:41:32Z"},{"id":"wordfence:6baa44c7-1c13-45ad-9fb5-da06933f3cd0","source":"wordfence","cve":"CVE-2024-2181","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6baa44c7-1c13-45ad-9fb5-da06933f3cd0?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:53Z"},{"id":"wordfence:6bad88b8-f978-4c8d-a93f-7facd727a86b","source":"wordfence","cve":"CVE-2026-105995","title":"Booking Package <= 1.7.29 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bad88b8-f978-4c8d-a93f-7facd727a86b?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:56:21Z"},{"id":"wordfence:6badba6d-1ff1-4d6f-bccf-1f0278edb17d","source":"wordfence","cve":"CVE-2023-0388","title":"Random Text <= 0.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":5.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6badba6d-1ff1-4d6f-bccf-1f0278edb17d?source=api-prod","affected":[{"type":"plugin","slug":"randomtext","name":"Random Text","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bb0462a-e801-4aa7-a98a-c5032cb8304c","source":"wordfence","cve":"CVE-2022-1609","title":"The School Management Pro <= 9.9.6 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb0462a-e801-4aa7-a98a-c5032cb8304c?source=api-prod","affected":[{"type":"plugin","slug":"school-management-pro","name":"The School Management Pro","from":"*","from_inclusive":true,"to":"9.9.6","to_inclusive":true,"patched_in":"9.9.7"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bb13a69-be75-48f0-9bcc-a33c5add7bd3","source":"wordfence","cve":"CVE-2022-1624","title":"Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb13a69-be75-48f0-9bcc-a33c5add7bd3?source=api-prod","affected":[{"type":"plugin","slug":"latest-tweets-widget","name":"Latest Tweets Widget","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bb1de69-7bc2-4785-9789-0a2d1cf35b9b","source":"wordfence","cve":"CVE-2025-0724","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb1de69-7bc2-4785-9789-0a2d1cf35b9b?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.5","to_inclusive":true,"patched_in":"5.9.4.6"}],"published":"2025-03-21T16:16:59Z","updated":"2025-03-22T04:22:09Z"},{"id":"wordfence:6bb3ef25-241b-42e5-824a-163fde1ede08","source":"wordfence","cve":"CVE-2025-58787","title":"Themify Popup <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb3ef25-241b-42e5-824a-163fde1ede08?source=api-prod","affected":[{"type":"plugin","slug":"themify-popup","name":"Themify Popup","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-25T23:49:54Z"},{"id":"wordfence:6bb785cf-9924-4b47-ac89-5273c6ba8ee6","source":"wordfence","cve":"CVE-2019-5984","title":"Custom CSS Pro <= 1.0.3 - Cross-site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb785cf-9924-4b47-ac89-5273c6ba8ee6?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-pro","name":"Custom CSS Pro","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bb97b95-fa6a-4566-b448-b774bb732455","source":"wordfence","cve":"CVE-2023-40214","title":"Business Pro <= 1.10.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb97b95-fa6a-4566-b448-b774bb732455?source=api-prod","affected":[{"type":"theme","slug":"business-pro","name":"Business Pro","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":""}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bbb0e81-8edd-44fa-9588-16c163a82ed1","source":"wordfence","cve":"","title":"JobCareer <= 3.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bbb0e81-8edd-44fa-9588-16c163a82ed1?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2020-07-24T00:00:00Z","updated":"2024-11-26T18:36:19Z"},{"id":"wordfence:6bbd5e03-2b66-463c-96aa-fc6b44b4f03c","source":"wordfence","cve":"CVE-2026-66475","title":"Checkout Field Editor for WooCommerce \u2013 Checkout Manager <= 3.0.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bbd5e03-2b66-463c-96aa-fc6b44b4f03c?source=api-prod","affected":[{"type":"plugin","slug":"checkout-field-editor-and-manager-for-woocommerce","name":"Checkout Field Editor for WooCommerce \u2013 Checkout Manager","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2026-07-27T00:00:00Z","updated":"2026-09-09T16:08:11Z"},{"id":"wordfence:6bc32732-87e8-4891-aa7e-175f8317bfbf","source":"wordfence","cve":"CVE-2026-73190","title":"Premium Packages \u2013 Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc32732-87e8-4891-aa7e-175f8317bfbf?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:31:39Z"},{"id":"wordfence:6bc50960-4638-44b9-baa8-977b220c5d01","source":"wordfence","cve":"CVE-2026-125437","title":"Simply Schedule Appointments <= 1.6.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc50960-4638-44b9-baa8-977b220c5d01?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.13.0","to_inclusive":true,"patched_in":"1.6.13.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:17Z"},{"id":"wordfence:6bc6a436-6df3-4eaf-a16b-d8b3c3ca7d87","source":"wordfence","cve":"CVE-2025-1441","title":"Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bc6a436-6df3-4eaf-a16b-d8b3c3ca7d87?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1007","to_inclusive":true,"patched_in":"1.7.1008"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T04:21:31Z"},{"id":"wordfence:6bcb7d69-a444-4f45-a81d-631d95ec2a60","source":"wordfence","cve":"CVE-2024-33934","title":"Mini Loops <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcb7d69-a444-4f45-a81d-631d95ec2a60?source=api-prod","affected":[{"type":"plugin","slug":"mini-loops","name":"Mini Loops","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:51:55Z"},{"id":"wordfence:6bcb9d95-acb4-4405-b785-1e5eace10dc9","source":"wordfence","cve":"CVE-2023-47822","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcb9d95-acb4-4405-b785-1e5eace10dc9?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"4.10","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bcbdf6f-770c-4496-a643-94dbf63e893a","source":"wordfence","cve":"CVE-2024-2309","title":"WP Staging (Free <= 3.3.3, Pro <= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcbdf6f-770c-4496-a643-94dbf63e893a?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.4.0"},{"type":"plugin","slug":"wp-staging-pro","name":"WP STAGING Pro WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-15T12:01:10Z"},{"id":"wordfence:6bcc353f-cdf2-4e28-a0e0-ad149ecb1c3b","source":"wordfence","cve":"CVE-2014-4940","title":"Tera Charts < 1.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcc353f-cdf2-4e28-a0e0-ad149ecb1c3b?source=api-prod","affected":[{"type":"plugin","slug":"tera-charts","name":"Tera Charts","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"1.0"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bcc8b84-34ac-4f8f-9a74-43b230877e92","source":"wordfence","cve":"CVE-2021-43353","title":"Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcc8b84-34ac-4f8f-9a74-43b230877e92?source=api-prod","affected":[{"type":"plugin","slug":"crisp","name":"Crisp \u2013 Live Chat and AI Chatbot","from":"*","from_inclusive":true,"to":"0.31","to_inclusive":true,"patched_in":"0.32"}],"published":"2021-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bcd770c-a93e-4622-8c19-d0c64aad9768","source":"wordfence","cve":"CVE-2024-3288","title":"Logo Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcd770c-a93e-4622-8c19-d0c64aad9768?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T14:45:48Z"},{"id":"wordfence:6bce1240-4ef9-4715-a178-1a8ba2c10a18","source":"wordfence","cve":"CVE-2026-115183","title":"Qi Addons For Elementor <= 1.11.1 - Authenticated (Contributor+) Arbitrary HTML Injection","severity":"medium","cvss":6.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bce1240-4ef9-4715-a178-1a8ba2c10a18?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"1.11.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:08:42Z"},{"id":"wordfence:6bceb15e-0727-4bd5-b4e7-f2c1f2f3ef51","source":"wordfence","cve":"CVE-2026-61958","title":"License Manager for WooCommerce <= 3.0.17 - Authenticated (Customer+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bceb15e-0727-4bd5-b4e7-f2c1f2f3ef51?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.17","to_inclusive":true,"patched_in":"3.0.18"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-29T13:10:28Z"},{"id":"wordfence:6bcfc8f1-e962-4ad7-8a9d-89ce5c9022b6","source":"wordfence","cve":"CVE-2024-12854","title":"Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcfc8f1-e962-4ad7-8a9d-89ce5c9022b6?source=api-prod","affected":[{"type":"plugin","slug":"garden-gnome-package","name":"Garden Gnome Package","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-01-07T20:40:36Z","updated":"2025-01-08T09:18:37Z"},{"id":"wordfence:6bd03b86-e9b7-44d5-9528-efd94f0f79f5","source":"wordfence","cve":"CVE-2024-43138","title":"Event Manager for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Local File Inclusion","severity":"critical","cvss":9.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd03b86-e9b7-44d5-9528-efd94f0f79f5?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:20:34Z"},{"id":"wordfence:6bd15878-a290-4613-83d9-011d60bb0233","source":"wordfence","cve":"CVE-2024-11451","title":"Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd15878-a290-4613-83d9-011d60bb0233?source=api-prod","affected":[{"type":"plugin","slug":"zooom","name":"Zooom","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T11:58:36Z","updated":"2024-12-07T01:45:50Z"},{"id":"wordfence:6bd670f5-390d-4380-b674-8846fde18d6e","source":"wordfence","cve":"CVE-2022-0626","title":"Advanced Admin Search <= 1.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd670f5-390d-4380-b674-8846fde18d6e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-admin-search","name":"Advanced Admin Search","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bd69711-8303-4086-87c3-eb2935a89aff","source":"wordfence","cve":"CVE-2026-1559","title":"Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd69711-8303-4086-87c3-eb2935a89aff?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2026-04-17T11:35:43Z","updated":"2026-04-18T01:26:05Z"},{"id":"wordfence:6bd74c3f-3caf-4238-9478-81a4cfa50410","source":"wordfence","cve":"CVE-2022-34839","title":"WP OAuth2 Server <= 1.0.1 - Authentication Bypass","severity":"high","cvss":7.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd74c3f-3caf-4238-9478-81a4cfa50410?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-server","name":"WP OAuth2 Server","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bd92b9d-b4b7-4106-bee4-d12b0479d0c5","source":"wordfence","cve":"CVE-2022-44634","title":"S2W \u2013 Import Shopify to WooCommerce <= 1.1.12 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd92b9d-b4b7-4106-bee4-d12b0479d0c5?source=api-prod","affected":[{"type":"plugin","slug":"import-shopify-to-woocommerce","name":"S2W \u2013 Import Shopify to WooCommerce","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bdc3413-1c17-455f-bf49-7c79f9c02d0d","source":"wordfence","cve":"CVE-2026-66649","title":"Directory Pro <= 2.5.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bdc3413-1c17-455f-bf49-7c79f9c02d0d?source=api-prod","affected":[{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:16:25Z"},{"id":"wordfence:6bdd1817-7248-48fa-8d2f-00e777bf1257","source":"wordfence","cve":"CVE-2025-24703","title":"Comment Edit Core \u2013 Simple Comment Editing <= 3.0.33 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bdd1817-7248-48fa-8d2f-00e777bf1257?source=api-prod","affected":[{"type":"plugin","slug":"simple-comment-editing","name":"Simple Comment Editing","from":"*","from_inclusive":true,"to":"3.0.33","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:19:27Z"},{"id":"wordfence:6bde6384-0fcc-4726-a7e5-bad6c3993bce","source":"wordfence","cve":"CVE-2020-36875","title":"AccessAlly < 3.3.2 - Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bde6384-0fcc-4726-a7e5-bad6c3993bce?source=api-prod","affected":[{"type":"plugin","slug":"accessally","name":"AccessAlly","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2020-01-21T00:00:00Z","updated":"2026-01-14T15:03:03Z"},{"id":"wordfence:6be26c07-cac4-42d8-becb-03045a54cd6c","source":"wordfence","cve":"CVE-2023-25978","title":"Protected Posts Logout Button <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6be26c07-cac4-42d8-becb-03045a54cd6c?source=api-prod","affected":[{"type":"plugin","slug":"protected-posts-logout-button","name":"Protected Posts Logout Button","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6be4d4ca-d9cf-4361-8763-3a34e756c9c6","source":"wordfence","cve":"CVE-2025-68902","title":"Anona <= 8.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6be4d4ca-d9cf-4361-8763-3a34e756c9c6?source=api-prod","affected":[{"type":"theme","slug":"anona","name":"Anona - Pest Control WordPress Theme","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:29:38Z"},{"id":"wordfence:6be64d8d-fc71-40c2-baa8-985445d953ea","source":"wordfence","cve":"","title":"SmartIdeo <= 2.7.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6be64d8d-fc71-40c2-baa8-985445d953ea?source=api-prod","affected":[{"type":"plugin","slug":"smartideo","name":"Smartideo","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6be74779-4db7-4d44-a706-285375f4fec9","source":"wordfence","cve":"CVE-2025-12369","title":"Extensions for Leaflet Map <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6be74779-4db7-4d44-a706-285375f4fec9?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-11-03T15:33:02Z","updated":"2025-11-04T04:27:18Z"},{"id":"wordfence:6bea6a77-79e8-4d3a-bd3e-2bb3d20b6fe9","source":"wordfence","cve":"CVE-2023-39999","title":"WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bea6a77-79e8-4d3a-bd3e-2bb3d20b6fe9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1.38","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"4.1.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"4.1.39"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bebb5c6-cce7-4320-a39c-2c547f2e6ab1","source":"wordfence","cve":"CVE-2026-10830","title":"AllCoach <= 1.0.1 - Privilege Escalation to Unauthenticated Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bebb5c6-cce7-4320-a39c-2c547f2e6ab1?source=api-prod","affected":[{"type":"plugin","slug":"allcoach","name":"AllCoach \u2013 Coaching Management & Scheduling","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-21T13:36:42Z"},{"id":"wordfence:6bec79ed-57a9-46b5-a804-3bc41ecd218c","source":"wordfence","cve":"CVE-2025-58952","title":"Neuronet < 1.14.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bec79ed-57a9-46b5-a804-3bc41ecd218c?source=api-prod","affected":[{"type":"theme","slug":"neuronet","name":"Neuronet \u2013 AI Business & Startup WordPress Theme","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":false,"patched_in":"1.14.0"}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-29T15:24:31Z"},{"id":"wordfence:6bef4137-c188-4dae-b6fc-5485cfa216c4","source":"wordfence","cve":"CVE-2025-24654","title":"SEO Plugin by Squirrly SEO <= 12.4.07 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bef4137-c188-4dae-b6fc-5485cfa216c4?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.07","to_inclusive":true,"patched_in":"12.4.08"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-21T16:21:11Z"},{"id":"wordfence:6bef7dcd-920b-4aee-b227-c7eec9fe73fc","source":"wordfence","cve":"CVE-2024-30500","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bef7dcd-920b-4aee-b227-c7eec9fe73fc?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T14:47:11Z"},{"id":"wordfence:6bf0eef5-9276-4367-8451-017c509e443d","source":"wordfence","cve":"CVE-2026-0556","title":"XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf0eef5-9276-4367-8451-017c509e443d?source=api-prod","affected":[{"type":"plugin","slug":"xo-event-calendar","name":"XO Event Calendar","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T16:30:05Z","updated":"2026-02-19T04:36:14Z"},{"id":"wordfence:6bf34f95-3275-426d-8e74-43142a03b135","source":"wordfence","cve":"CVE-2026-117572","title":"Visitor Statistics (Real Time Traffic) <= 8.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf34f95-3275-426d-8e74-43142a03b135?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":true,"patched_in":"8.8"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:38:29Z"},{"id":"wordfence:6bf3591e-96a9-43ed-9a37-cd3d8f9a88ac","source":"wordfence","cve":"CVE-2026-66468","title":"Local Delivery Drivers for WooCommerce <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf3591e-96a9-43ed-9a37-cd3d8f9a88ac?source=api-prod","affected":[{"type":"plugin","slug":"local-delivery-drivers-for-woocommerce","name":"Local Delivery Drivers for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:52:06Z"},{"id":"wordfence:6bf4cc39-3a26-462d-a540-2d53e53dfa66","source":"wordfence","cve":"CVE-2026-17602","title":"SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf4cc39-3a26-462d-a540-2d53e53dfa66?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.7.42","to_inclusive":true,"patched_in":"4.7.43"}],"published":"2026-09-24T18:57:43Z","updated":"2026-09-25T07:40:28Z"},{"id":"wordfence:6bf534ba-1288-4fa5-bdfb-de62e751e5c2","source":"wordfence","cve":"CVE-2024-11384","title":"Arena.IM \u2013 Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf534ba-1288-4fa5-bdfb-de62e751e5c2?source=api-prod","affected":[{"type":"plugin","slug":"arena-liveblog-and-chat-tool","name":"Arena.IM \u2013 Live Blogging for real-time events","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":"0.4.0"}],"published":"2024-12-11T15:30:11Z","updated":"2025-01-30T15:09:43Z"},{"id":"wordfence:6bf61bb7-f977-4afe-bb81-e6de12e00b03","source":"wordfence","cve":"CVE-2026-3641","title":"Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf61bb7-f977-4afe-bb81-e6de12e00b03?source=api-prod","affected":[{"type":"plugin","slug":"appmax","name":"Appmax","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:42Z","updated":"2026-03-21T03:26:50Z"},{"id":"wordfence:6bf6b5fd-34d3-4f75-a50f-02b81a9ec0dc","source":"wordfence","cve":"CVE-2026-66432","title":"WPJAM Basic <= 7.0.2.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf6b5fd-34d3-4f75-a50f-02b81a9ec0dc?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"7.0.2.1","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:55:27Z"},{"id":"wordfence:6bf743b1-5a59-4e22-8c59-3c17b2646ec8","source":"wordfence","cve":"","title":"Store Locator < 3.34 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf743b1-5a59-4e22-8c59-3c17b2646ec8?source=api-prod","affected":[{"type":"plugin","slug":"store-locator","name":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales","from":"*","from_inclusive":true,"to":"3.34","to_inclusive":false,"patched_in":"3.34"}],"published":"2015-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bf78fbf-c386-4961-8d41-dbdd5c98cb5f","source":"wordfence","cve":"CVE-2025-57953","title":"Open User Map <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf78fbf-c386-4961-8d41-dbdd5c98cb5f?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:26:52Z"},{"id":"wordfence:6bf7a5c3-f30d-42d6-91f9-8eb11089a499","source":"wordfence","cve":"","title":"Gallery \u2013 Photo Albums Plugin < 1.2.29 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf7a5c3-f30d-42d6-91f9-8eb11089a499?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-gallery","name":"Gallery \u2013 Photo Albums Plugin","from":"*","from_inclusive":true,"to":"1.2.29","to_inclusive":false,"patched_in":"1.2.29"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bfb8874-a2e2-474f-9f91-fefb980e2a93","source":"wordfence","cve":"CVE-2022-3440","title":"Rock Convert <= 2.10.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfb8874-a2e2-474f-9f91-fefb980e2a93?source=api-prod","affected":[{"type":"plugin","slug":"rock-convert","name":"Rock Convert","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bfc0128-a8ef-4bb9-b5c8-7003f270aa36","source":"wordfence","cve":"CVE-2022-1994","title":"Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.7 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfc0128-a8ef-4bb9-b5c8-7003f270aa36?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-google-authenticator","name":"Login with TOTP (Google Authenticator, Microsoft Authenticator)","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6bfd7bfa-acd4-4a60-8ece-6922d6ad63e5","source":"wordfence","cve":"CVE-2025-68534","title":"PDF for WPForms <= 6.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfd7bfa-acd4-4a60-8ece-6922d6ad63e5?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:39:45Z"},{"id":"wordfence:6bfda384-2b39-471d-bf2a-4a8f580ddd1a","source":"wordfence","cve":"CVE-2024-32456","title":"Envo Extra <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfda384-2b39-471d-bf2a-4a8f580ddd1a?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:48:09Z"},{"id":"wordfence:6bfdf424-5afd-4af0-a19c-bfb115450747","source":"wordfence","cve":"CVE-2026-84772","title":"Broken Link Checker <= 2.4.14 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6bfdf424-5afd-4af0-a19c-bfb115450747?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.14.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:35:55Z"},{"id":"wordfence:6c00e07a-7a0b-4cfa-8f6b-b03e3b485f07","source":"wordfence","cve":"CVE-2024-54323","title":"New User Approve <= 2.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c00e07a-7a0b-4cfa-8f6b-b03e3b485f07?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T09:07:26Z"},{"id":"wordfence:6c01da54-fbbe-42f9-a76e-8e823027d62a","source":"wordfence","cve":"CVE-2023-41662","title":"WP-dTree <= 4.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c01da54-fbbe-42f9-a76e-8e823027d62a?source=api-prod","affected":[{"type":"plugin","slug":"wp-dtree-30","name":"WP-dTree","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2023-09-01T00:00:00Z","updated":"2026-10-28T21:05:02Z"},{"id":"wordfence:6c01f098-5fd6-4c4b-9744-c902108ed72a","source":"wordfence","cve":"CVE-2025-32629","title":"WP-BusinessDirectory <= 3.1.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c01f098-5fd6-4c4b-9744-c902108ed72a?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-25T14:59:19Z"},{"id":"wordfence:6c021296-e0e8-481d-a46d-a97934492857","source":"wordfence","cve":"CVE-2022-4792","title":"News & Blog Designer Pack <= 3.2 - Authenticated (Contributor+) Stored Cross-Site SQcripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c021296-e0e8-481d-a46d-a97934492857?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c057a98-4a8d-408a-b6a4-3c322bfa0cdf","source":"wordfence","cve":"CVE-2025-4170","title":"Xavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c057a98-4a8d-408a-b6a4-3c322bfa0cdf?source=api-prod","affected":[{"type":"plugin","slug":"xavins-review-ratings","name":"Xavin&#039;s Review Ratings","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:31:04Z","updated":"2025-05-03T01:43:05Z"},{"id":"wordfence:6c06b79a-0803-4973-ba88-b97d7145f82b","source":"wordfence","cve":"","title":"Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c06b79a-0803-4973-ba88-b97d7145f82b?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c0880a9-3948-4103-9d7e-0b0223b32d91","source":"wordfence","cve":"CVE-2026-74928","title":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0880a9-3948-4103-9d7e-0b0223b32d91?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"2.1.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:41:04Z"},{"id":"wordfence:6c098b35-606e-4dde-8683-4c90f518ddb5","source":"wordfence","cve":"CVE-2024-1571","title":"WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c098b35-606e-4dde-8683-4c90f518ddb5?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.2.1","to_inclusive":true,"patched_in":"9.3.0"}],"published":"2024-03-14T00:00:00Z","updated":"2024-05-31T15:30:24Z"},{"id":"wordfence:6c0a8be1-8853-4863-90e5-af3831f800e9","source":"wordfence","cve":"CVE-2026-15441","title":"Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0a8be1-8853-4863-90e5-af3831f800e9?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2026-08-15T16:15:15Z","updated":"2026-08-16T04:24:53Z"},{"id":"wordfence:6c0afc32-ec02-4acb-a2c1-9cf94b669da2","source":"wordfence","cve":"CVE-2026-62098","title":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported ) <= 2.3.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0afc32-ec02-4acb-a2c1-9cf94b669da2?source=api-prod","affected":[{"type":"theme","slug":"kute-boutique","name":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:19:52Z"},{"id":"wordfence:6c0b3b88-e9b1-4c4a-9d9e-ea24cef8c62d","source":"wordfence","cve":"CVE-2025-47644","title":"Integrations of Zoho CRM with Elementor form <= 1.0.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0b3b88-e9b1-4c4a-9d9e-ea24cef8c62d?source=api-prod","affected":[{"type":"plugin","slug":"integrations-of-zoho-crm-with-elementor-form","name":"Integrations of Zoho CRM with Elementor form","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:58:18Z"},{"id":"wordfence:6c0c40f5-44ac-4e31-a73d-50aeefc541be","source":"wordfence","cve":"CVE-2025-67926","title":"Fluent Support <= 1.10.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0c40f5-44ac-4e31-a73d-50aeefc541be?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.5"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:36:29Z"},{"id":"wordfence:6c0c6cb5-2cc7-4790-9338-11211974d5fb","source":"wordfence","cve":"","title":"FAQs Manager <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c0c6cb5-2cc7-4790-9338-11211974d5fb?source=api-prod","affected":[{"type":"plugin","slug":"faqs-manager","name":"FAQs Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c12bcf6-6297-457a-a807-28f5dbacb0eb","source":"wordfence","cve":"CVE-2025-11995","title":"Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c12bcf6-6297-457a-a807-28f5dbacb0eb?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-10-31T16:03:56Z","updated":"2025-11-01T04:27:41Z"},{"id":"wordfence:6c172399-b443-414d-85a7-7d91acaf1774","source":"wordfence","cve":"CVE-2026-16055","title":"Contest Gallery <= 30.0.6 - Unauthenticated Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c172399-b443-414d-85a7-7d91acaf1774?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.6","to_inclusive":true,"patched_in":"30.0.7"}],"published":"2026-07-29T00:00:00Z","updated":"2026-09-17T15:20:43Z"},{"id":"wordfence:6c18938b-6c0d-461e-b83e-26bc8e7bc1b3","source":"wordfence","cve":"CVE-2022-3750","title":"Ask Me < 6.8.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c18938b-6c0d-461e-b83e-26bc8e7bc1b3?source=api-prod","affected":[{"type":"theme","slug":"ask-me","name":"Ask Me - Responsive Questions & Answers WordPress","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":false,"patched_in":"6.8.7"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c18ab1b-02f1-4679-8cff-679d98dc9f4a","source":"wordfence","cve":"CVE-2021-4358","title":"WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c18ab1b-02f1-4679-8cff-679d98dc9f4a?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":false,"patched_in":"3.1.24"}],"published":"2021-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c197521-6e8d-4cdc-b4a3-0c165ea5ff6a","source":"wordfence","cve":"CVE-2026-109980","title":"Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c197521-6e8d-4cdc-b4a3-0c165ea5ff6a?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-10-27T17:55:35Z","updated":"2026-10-28T06:45:14Z"},{"id":"wordfence:6c1b4332-9cf0-415d-acf5-2781364ca337","source":"wordfence","cve":"CVE-2025-46496","title":"Mini twitter feed <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c1b4332-9cf0-415d-acf5-2781364ca337?source=api-prod","affected":[{"type":"plugin","slug":"mini-twitter-feed","name":"Mini twitter feed","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:35:22Z"},{"id":"wordfence:6c240829-0672-4ac2-b49a-2068a0a549f1","source":"wordfence","cve":"CVE-2024-54207","title":"WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c240829-0672-4ac2-b49a-2068a0a549f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-auctions","name":"WordPress Auction Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:06:14Z"},{"id":"wordfence:6c26270b-a0a7-4877-aa66-bffe260003df","source":"wordfence","cve":"CVE-2025-0511","title":"Welcart e-Commerce <= 2.11.9 - Unauthenticated Stored Cross-Site Scripting via name Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c26270b-a0a7-4877-aa66-bffe260003df?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.9","to_inclusive":true,"patched_in":"2.11.10"}],"published":"2025-02-11T21:55:58Z","updated":"2025-02-12T11:11:17Z"},{"id":"wordfence:6c26ecf2-f5bb-427f-9f09-6b3d1fb5da3c","source":"wordfence","cve":"CVE-2022-0428","title":"Content Egg <= 5.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c26ecf2-f5bb-427f-9f09-6b3d1fb5da3c?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"}],"published":"2022-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c2843b5-9b03-48f0-9084-648edcad8670","source":"wordfence","cve":"CVE-2025-31603","title":"CF7 Spreadsheets <= 2.3.2 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c2843b5-9b03-48f0-9084-648edcad8670?source=api-prod","affected":[{"type":"plugin","slug":"cf7-spreadsheets","name":"CF7 Spreadsheets","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:48:37Z"},{"id":"wordfence:6c291da3-1326-40d8-b8e1-dfcf006ace0f","source":"wordfence","cve":"CVE-2018-5653","title":"Weblizar Pin Feeds < 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c291da3-1326-40d8-b8e1-dfcf006ace0f?source=api-prod","affected":[{"type":"plugin","slug":"weblizar-pinterest-feeds","name":"Weblizar Pin Feeds","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c29bd91-e7b1-4c26-90bf-4a77bd67edbe","source":"wordfence","cve":"CVE-2025-48316","title":"Responsive Mobile-Friendly Tooltip <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c29bd91-e7b1-4c26-90bf-4a77bd67edbe?source=api-prod","affected":[{"type":"plugin","slug":"responsive-mobile-friendly-tooltip","name":"Responsive Mobile-Friendly Tooltip","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:13:30Z"},{"id":"wordfence:6c3032ae-eb86-47d0-b160-320a67a380e1","source":"wordfence","cve":"","title":"WooCommerce Reviews Plugin with Multi-criteria Rating by ReviewX < 1.2.9 - Cross-Site Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3032ae-eb86-47d0-b160-320a67a380e1?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c3194de-5330-48d2-9d5f-c5772b756ee2","source":"wordfence","cve":"CVE-2025-22352","title":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3194de-5330-48d2-9d5f-c5772b756ee2?source=api-prod","affected":[{"type":"plugin","slug":"elex-bulk-edit-products-prices-attributes-for-woocommerce-basic","name":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-01-03T00:00:00Z","updated":"2025-05-09T13:32:19Z"},{"id":"wordfence:6c31cf92-26b7-484d-8c93-ce241d655d07","source":"wordfence","cve":"CVE-2026-1994","title":"s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"260127","to_inclusive":true,"patched_in":"260215"}],"published":"2026-02-18T18:11:15Z","updated":"2026-02-20T21:29:26Z"},{"id":"wordfence:6c31d037-1f9e-4887-aaff-3c32fb8b4501","source":"wordfence","cve":"CVE-2020-29047","title":"WP Hotel Booking <= 1.10.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31d037-1f9e-4887-aaff-3c32fb8b4501?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.10.4"}],"published":"2020-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c31dcd9-e03e-448a-9f02-a4434169a72c","source":"wordfence","cve":"CVE-2026-48883","title":"WPC Product Bundles for WooCommerce <= 8.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31dcd9-e03e-448a-9f02-a4434169a72c?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-bundle","name":"WPC Product Bundles for WooCommerce","from":"*","from_inclusive":true,"to":"8.5.3","to_inclusive":true,"patched_in":"8.5.4"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:52:15Z"},{"id":"wordfence:6c31f7d3-1f2f-4ec5-802b-ec0b22087d43","source":"wordfence","cve":"CVE-2021-24810","title":"WP Event Manager <= 3.1.22 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31f7d3-1f2f-4ec5-802b-ec0b22087d43?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.22","to_inclusive":true,"patched_in":"3.1.23"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c338010-9281-44dc-a121-dc2ab5fd6707","source":"wordfence","cve":"CVE-2024-39633","title":"PowerPack for Beaver Builder <= 2.33.0 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c338010-9281-44dc-a121-dc2ab5fd6707?source=api-prod","affected":[{"type":"plugin","slug":"bbpowerpack","name":"PowerPack for Beaver Builder","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.33.1"}],"published":"2024-07-24T00:00:00Z","updated":"2024-08-01T12:58:29Z"},{"id":"wordfence:6c357397-00b3-4a54-8dee-8d8212bdf0ad","source":"wordfence","cve":"CVE-2026-95610","title":"UpSolution Core <= 9.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c357397-00b3-4a54-8dee-8d8212bdf0ad?source=api-prod","affected":[{"type":"plugin","slug":"us-core","name":"UpSolution Core","from":"*","from_inclusive":true,"to":"9.3","to_inclusive":true,"patched_in":"9.3.1"}],"published":"2026-10-02T07:56:25Z","updated":"2026-10-13T14:32:32Z"},{"id":"wordfence:6c369971-1ae2-4e26-80cc-cf25d25a310e","source":"wordfence","cve":"CVE-2025-30993","title":"Thank You Page Customizer for WooCommerce \u2013 Increase Your Sales <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c369971-1ae2-4e26-80cc-cf25d25a310e?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-08-11T00:00:00Z","updated":"2025-09-15T19:36:57Z"},{"id":"wordfence:6c384f05-96dd-47bb-822d-16212527091a","source":"wordfence","cve":"CVE-2024-5001","title":"Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c384f05-96dd-47bb-822d-16212527091a?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-with-carousel","name":"Image Hover Effects for Elementor with Lightbox and Flipbox","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T13:04:35Z","updated":"2024-07-10T14:48:10Z"},{"id":"wordfence:6c3852d2-6a14-4132-8010-f93b606ee079","source":"wordfence","cve":"CVE-2025-47667","title":"LiveAgent <= 4.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3852d2-6a14-4132-8010-f93b606ee079?source=api-prod","affected":[{"type":"plugin","slug":"liveagent","name":"LiveAgent \u2013 Omnichannel Help Desk & Live Chat Software","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-21T13:56:47Z"},{"id":"wordfence:6c3954af-f7db-495c-b6f0-49f24d6f4b18","source":"wordfence","cve":"CVE-2024-5536","title":"GamiPress \u2013 Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3954af-f7db-495c-b6f0-49f24d6f4b18?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-link","name":"GamiPress \u2013 Link","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-06-04T20:43:51Z","updated":"2024-06-05T09:32:47Z"},{"id":"wordfence:6c396ae6-d34c-4554-b670-28868dc136a5","source":"wordfence","cve":"CVE-2015-10144","title":"Responsive Thumbnail Slider  < 1.0.1 -  Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c396ae6-d34c-4554-b670-28868dc136a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2015-08-29T00:00:00Z","updated":"2025-07-25T02:23:57Z"},{"id":"wordfence:6c3ad041-8e93-4e2b-b38d-9e0b1149950f","source":"wordfence","cve":"CVE-2026-107627","title":"Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3ad041-8e93-4e2b-b38d-9e0b1149950f?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.1","to_inclusive":true,"patched_in":"13.2.2"}],"published":"2026-10-28T21:02:39Z","updated":"2026-10-29T09:25:34Z"},{"id":"wordfence:6c3f4796-3496-4786-9afb-bd32827764ff","source":"wordfence","cve":"CVE-2022-1409","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.8 - Arbitrary File Upload","severity":"medium","cvss":5.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3f4796-3496-4786-9afb-bd32827764ff?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c3fe739-eed0-432c-8608-50dc08ef1456","source":"wordfence","cve":"CVE-2024-32822","title":"Reviews Plus <= 1.3.4 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c3fe739-eed0-432c-8608-50dc08ef1456?source=api-prod","affected":[{"type":"plugin","slug":"reviews-plus","name":"Reviews Plus","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:07:33Z"},{"id":"wordfence:6c4357a3-ef54-4843-a9ea-b1f86f542e06","source":"wordfence","cve":"CVE-2024-35717","title":"Media Slider \u2013 Photo Sleder, Video Slider, Link Slider, Carousal Slideshow <= 1.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4357a3-ef54-4843-a9ea-b1f86f542e06?source=api-prod","affected":[{"type":"plugin","slug":"media-slider","name":"Media Slider for Photos Images Videos","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:03:03Z"},{"id":"wordfence:6c439914-1d5a-4607-8e5c-9279fa3b462c","source":"wordfence","cve":"","title":"Ajax Search Lite < 3.11 - Missing Authorization to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c439914-1d5a-4607-8e5c-9279fa3b462c?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"3.11","to_inclusive":false,"patched_in":"3.11"}],"published":"2015-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c43b9b4-4394-428a-b381-d6a776fcd130","source":"wordfence","cve":"CVE-2024-13511","title":"Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c43b9b4-4394-428a-b381-d6a776fcd130?source=api-prod","affected":[{"type":"plugin","slug":"th-variation-swatches","name":"Variation Swatches for WooCommerce","from":"1.0.8","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-01-22T20:53:44Z","updated":"2025-01-23T09:21:08Z"},{"id":"wordfence:6c449e92-a176-4e18-a65a-df2c8275898b","source":"wordfence","cve":"CVE-2024-35733","title":"Auto Coupons for WooCommerce <= 3.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c449e92-a176-4e18-a65a-df2c8275898b?source=api-prod","affected":[{"type":"plugin","slug":"woo-auto-coupons","name":"Auto Coupons for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:22:35Z"},{"id":"wordfence:6c48f94b-d193-429a-9383-628ae12bfdf3","source":"wordfence","cve":"CVE-2024-0790","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c48f94b-d193-429a-9383-628ae12bfdf3?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":"1.0.8.2"}],"published":"2024-01-30T00:00:00Z","updated":"2024-07-29T21:36:32Z"},{"id":"wordfence:6c4a9092-fd49-42fe-a84d-a9f7fe708122","source":"wordfence","cve":"","title":"Stock Exporter for WooCommerce <= 1.1.0  - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4a9092-fd49-42fe-a84d-a9f7fe708122?source=api-prod","affected":[{"type":"plugin","slug":"stock-exporter-for-woocommerce","name":"Stock Exporter for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c4ae561-85f6-4fc5-bbd6-a4946dc1a714","source":"wordfence","cve":"CVE-2024-5287","title":"WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Profile Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4ae561-85f6-4fc5-bbd6-a4946dc1a714?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T20:13:24Z"},{"id":"wordfence:6c4baf2e-7f5e-4954-88f9-76d32f297aab","source":"wordfence","cve":"CVE-2023-4730","title":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026 <= 4.3 - Missing Authorization via init_endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4baf2e-7f5e-4954-88f9-76d32f297aab?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:23Z"},{"id":"wordfence:6c4c2a2e-d21b-437f-a8a0-508e4caf33bc","source":"wordfence","cve":"CVE-2025-69357","title":"TheGem Theme Elements (for Elementor) <= 5.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4c2a2e-d21b-437f-a8a0-508e4caf33bc?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.11.0","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-13T17:40:00Z"},{"id":"wordfence:6c4f8798-c0f9-4d05-808e-375864a0ad95","source":"wordfence","cve":"CVE-2023-6007","title":"UserPro <= 5.1.1 - Missing Authorization via multiple functions","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c4f8798-c0f9-4d05-808e-375864a0ad95?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c50568c-c0ec-43f9-bf06-7347f9cfc662","source":"wordfence","cve":"CVE-2022-1790","title":"New User Email Set Up <= 0.5.2 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c50568c-c0ec-43f9-bf06-7347f9cfc662?source=api-prod","affected":[{"type":"plugin","slug":"new-user-email-set-up","name":"New User Email Set Up","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c50edbb-1da5-4261-8bb8-2ef0b66fe602","source":"wordfence","cve":"CVE-2025-57962","title":"VikRestaurants Table Reservations and Take-Away <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c50edbb-1da5-4261-8bb8-2ef0b66fe602?source=api-prod","affected":[{"type":"plugin","slug":"vikrestaurants","name":"VikRestaurants Table Reservations and Take-Away","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T19:41:55Z"},{"id":"wordfence:6c51a97f-8258-4b55-bcfd-cd1cbca08f01","source":"wordfence","cve":"CVE-2024-54443","title":"Advanced Data Table For Elementor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c51a97f-8258-4b55-bcfd-cd1cbca08f01?source=api-prod","affected":[{"type":"plugin","slug":"advanced-data-table-for-elementor","name":"Table Addons for Elementor \u2013 Responsive Table Builder","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-12-14T00:00:00Z","updated":"2025-01-23T20:11:59Z"},{"id":"wordfence:6c563616-e405-4b3e-a70a-543f42118a97","source":"wordfence","cve":"","title":"MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c563616-e405-4b3e-a70a-543f42118a97?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-favorites-extension","name":"MainWP Favorites Extension","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"},{"type":"plugin","slug":"mainwp-blogvault-backup-extension","name":"MainWP BlogVault Backup Extension","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c568897-a8ff-4d3d-88b5-b7aeff454cf9","source":"wordfence","cve":"CVE-2023-22682","title":"Camera slideshow <= 1.4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c568897-a8ff-4d3d-88b5-b7aeff454cf9?source=api-prod","affected":[{"type":"plugin","slug":"camera-slideshow","name":"Camera slideshow","from":"*","from_inclusive":true,"to":"1.4.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c57f27b-2441-4f16-ab4b-bfb68b7b793f","source":"wordfence","cve":"CVE-2021-24382","title":"Smart Slider 3 <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c57f27b-2441-4f16-ab4b-bfb68b7b793f?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.0.9","to_inclusive":false,"patched_in":"3.5.0.9"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c5cffd0-3674-48de-9b4a-481815f3e730","source":"wordfence","cve":"CVE-2025-62896","title":"Multilang Contact Form <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c5cffd0-3674-48de-9b4a-481815f3e730?source=api-prod","affected":[{"type":"plugin","slug":"multilang-contact-form","name":"Multilang Contact Form","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-09-26T00:00:00Z","updated":"2026-07-08T20:45:06Z"},{"id":"wordfence:6c5db375-e865-47ba-a3dd-462c55d066fd","source":"wordfence","cve":"CVE-2025-1294","title":"eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c5db375-e865-47ba-a3dd-462c55d066fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-fsqm-pro","name":"eForm - WordPress Form Builder","from":"*","from_inclusive":true,"to":"4.18.0","to_inclusive":true,"patched_in":"4.19"}],"published":"2025-04-24T09:45:31Z","updated":"2025-04-24T22:22:14Z"},{"id":"wordfence:6c631593-4857-46c8-80b3-d028524cb86c","source":"wordfence","cve":"CVE-2026-95809","title":"Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c631593-4857-46c8-80b3-d028524cb86c?source=api-prod","affected":[{"type":"plugin","slug":"opti-behavior","name":"Opti-Behavior \u2013 Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights","from":"*","from_inclusive":true,"to":"1.9.2.1","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-15T16:29:26Z","updated":"2026-10-16T05:30:23Z"},{"id":"wordfence:6c664543-1ca1-4ba8-a6c6-f32a560bc690","source":"wordfence","cve":"CVE-2026-13179","title":"WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c664543-1ca1-4ba8-a6c6-f32a560bc690?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-09-24T19:07:18Z","updated":"2026-09-25T07:40:28Z"},{"id":"wordfence:6c671f1e-21a7-45b7-951d-41b1c308dc9d","source":"wordfence","cve":"CVE-2015-10109","title":"Cincopa video and media plug-in < 1.137 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c671f1e-21a7-45b7-951d-41b1c308dc9d?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.137","to_inclusive":false,"patched_in":"1.137"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c67aefd-5da3-437e-bd7b-1f4dbea3130f","source":"wordfence","cve":"CVE-2026-14222","title":"Easy Appointments < 3.12.28 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c67aefd-5da3-437e-bd7b-1f4dbea3130f?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.28","to_inclusive":false,"patched_in":"3.12.28"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-14T15:22:23Z"},{"id":"wordfence:6c68e8a1-926f-497f-b9f2-b0a67cd09adf","source":"wordfence","cve":"CVE-2025-11975","title":"FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=api-prod","affected":[{"type":"plugin","slug":"fusewp","name":"FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)","from":"*","from_inclusive":true,"to":"1.1.23.0","to_inclusive":true,"patched_in":"1.1.23.1"}],"published":"2025-10-30T13:59:48Z","updated":"2025-10-31T02:26:03Z"},{"id":"wordfence:6c694bce-e389-492a-827d-ae5293730612","source":"wordfence","cve":"CVE-2020-28339","title":"Welcart e-Commerce <= 1.9.35 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c694bce-e389-492a-827d-ae5293730612?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.9.36","to_inclusive":false,"patched_in":"1.9.36"}],"published":"2020-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c6a4c5f-7a02-4c53-a0ba-a2c7f592a3a8","source":"wordfence","cve":"CVE-2015-9324","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6a4c5f-7a02-4c53-a0ba-a2c7f592a3a8?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c6bc841-a168-475e-941b-a877a3a401f9","source":"wordfence","cve":"CVE-2026-65455","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6bc841-a168-475e-941b-a877a3a401f9?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:23:12Z"},{"id":"wordfence:6c6d0868-e5d6-4497-8967-6af46f4fe7d8","source":"wordfence","cve":"CVE-2023-28994","title":"Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6d0868-e5d6-4497-8967-6af46f4fe7d8?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.16.8","to_inclusive":true,"patched_in":"3.17.0"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c6e9884-0b60-4ea8-b042-55cf0fb6a6d0","source":"wordfence","cve":"","title":"Dropdown Menu Widget <= 1.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6e9884-0b60-4ea8-b042-55cf0fb6a6d0?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-menu-widget","name":"Dropdown Menu Widget","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c6fc6be-7e9a-40cb-b9cd-bb71d4f487f7","source":"wordfence","cve":"CVE-2023-30475","title":"Coupon Affiliates <= 5.4.5 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c6fc6be-7e9a-40cb-b9cd-bb71d4f487f7?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c704356-e5f7-4b91-a162-647717cbbb7b","source":"wordfence","cve":"CVE-2023-45756","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c704356-e5f7-4b91-a162-647717cbbb7b?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-25T13:47:37Z"},{"id":"wordfence:6c71183f-45e7-44de-a957-614ce417db90","source":"wordfence","cve":"CVE-2023-5177","title":"Vrm 360 3D Model Viewer <= 1.2.1 - Authenticated(Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c71183f-45e7-44de-a957-614ce417db90?source=api-prod","affected":[{"type":"plugin","slug":"vrm360","name":"Vrm 360 3D Model Viewer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c718d65-eb40-43db-821f-344c6eca2384","source":"wordfence","cve":"","title":"WP-Appbox <= 4.3.17 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c718d65-eb40-43db-821f-344c6eca2384?source=api-prod","affected":[{"type":"plugin","slug":"wp-appbox","name":"WP-Appbox","from":"*","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"4.3.18"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c72645a-dac5-473b-9ac4-75dbd2643fa1","source":"wordfence","cve":"CVE-2025-28884","title":"WP Bulk Post Duplicator <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c72645a-dac5-473b-9ac4-75dbd2643fa1?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulk-post-duplicator","name":"WP Bulk Post Duplicator","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:16:58Z"},{"id":"wordfence:6c728fa3-e917-40ca-84ca-e907c22b0a3f","source":"wordfence","cve":"CVE-2024-31259","title":"SearchIQ <= 4.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c728fa3-e917-40ca-84ca-e907c22b0a3f?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:28:41Z"},{"id":"wordfence:6c7871b8-6364-4821-891e-5c809c7bc4d5","source":"wordfence","cve":"CVE-2024-34425","title":"QuickieBar <= 1.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c7871b8-6364-4821-891e-5c809c7bc4d5?source=api-prod","affected":[{"type":"plugin","slug":"quickiebar","name":"QuickieBar","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:01:09Z"},{"id":"wordfence:6c7a0476-90ab-4022-a57a-a323a1ef8f20","source":"wordfence","cve":"CVE-2025-43838","title":"Custom PC Builder Lite for WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c7a0476-90ab-4022-a57a-a323a1ef8f20?source=api-prod","affected":[{"type":"plugin","slug":"custom-pc-builder-lite-for-woocommerce","name":"Custom PC Builder Lite for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-29T00:00:00Z","updated":"2025-05-05T18:11:39Z"},{"id":"wordfence:6c7bb20f-e164-45ce-9fe4-df4352719642","source":"wordfence","cve":"CVE-2026-42713","title":"Post title marquee scroll <= 9.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c7bb20f-e164-45ce-9fe4-df4352719642?source=api-prod","affected":[{"type":"plugin","slug":"post-title-marquee-scroll","name":"Post title marquee scroll","from":"*","from_inclusive":true,"to":"9.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T10:57:00Z","updated":"2026-10-08T23:36:15Z"},{"id":"wordfence:6c7df9ae-0969-4b5b-a6e4-6e554a1c7562","source":"wordfence","cve":"CVE-2026-118420","title":"WP Directory Kit < 1.6.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c7df9ae-0969-4b5b-a6e4-6e554a1c7562?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:30Z"},{"id":"wordfence:6c7fe504-82b0-4a90-b3a5-cfdafdc1175d","source":"wordfence","cve":"CVE-2025-30891","title":"WpTravelly <= 1.8.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c7fe504-82b0-4a90-b3a5-cfdafdc1175d?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:43:10Z"},{"id":"wordfence:6c8456fa-939c-4ceb-8361-a8758aec7708","source":"wordfence","cve":"CVE-2024-43917","title":"TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8456fa-939c-4ceb-8361-a8758aec7708?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-15T11:48:46Z"},{"id":"wordfence:6c85b895-7a55-45c6-aafb-66c7447be355","source":"wordfence","cve":"CVE-2014-4845","title":"BannerMan <= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c85b895-7a55-45c6-aafb-66c7447be355?source=api-prod","affected":[{"type":"plugin","slug":"bannerman","name":"BannerMan","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c87204d-6697-4d06-aad2-279fa95f503a","source":"wordfence","cve":"CVE-2024-4431","title":"LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c87204d-6697-4d06-aad2-279fa95f503a?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.7.6","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-05-22T15:27:21Z","updated":"2024-05-23T03:31:17Z"},{"id":"wordfence:6c8720bc-7431-416a-8da3-62c49e2f2afd","source":"wordfence","cve":"CVE-2025-48158","title":"BuddyPress XProfile Custom Image Field <= 3.0.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8720bc-7431-416a-8da3-62c49e2f2afd?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-xprofile-image-field","name":"BuddyPress XProfile Custom Image Field","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T20:14:59Z"},{"id":"wordfence:6c89db24-1710-4312-9cdd-eb524cecbfc6","source":"wordfence","cve":"CVE-2025-28911","title":"Gravity 2 PDF <= 3.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c89db24-1710-4312-9cdd-eb524cecbfc6?source=api-prod","affected":[{"type":"plugin","slug":"gf2pdf","name":"Gravity 2 PDF","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-23T00:00:00Z","updated":"2025-04-22T20:04:28Z"},{"id":"wordfence:6c8b8b0a-2d84-499b-8646-0a84e47620e7","source":"wordfence","cve":"CVE-2024-47316","title":"Salon booking system <= 10.9 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8b8b0a-2d84-499b-8646-0a84e47620e7?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.9","to_inclusive":true,"patched_in":"10.9.1"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:24:04Z"},{"id":"wordfence:6c8eaba3-9c23-4f35-8669-0ce345918fa6","source":"wordfence","cve":"CVE-2021-24124","title":"WP Shieldon <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8eaba3-9c23-4f35-8669-0ce345918fa6?source=api-prod","affected":[{"type":"plugin","slug":"wp-shieldon","name":"WP Shieldon \u2013 WordPress Firewall","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2021-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c8ed84e-3504-42e3-821d-794198d7adda","source":"wordfence","cve":"CVE-2026-7330","title":"Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c8ed84e-3504-42e3-821d-794198d7adda?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.8.8.1"}],"published":"2026-05-07T20:01:52Z","updated":"2026-05-08T08:26:34Z"},{"id":"wordfence:6c98430d-0881-4f45-b934-c393739ef71c","source":"wordfence","cve":"CVE-2023-32128","title":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations <= 2.2.7 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c98430d-0881-4f45-b934-c393739ef71c?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-donation-box","name":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6c9aaa7a-d6a7-488f-9800-7e978a765288","source":"wordfence","cve":"CVE-2022-4266","title":"Bulk Delete Users by Email <= 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c9aaa7a-d6a7-488f-9800-7e978a765288?source=api-prod","affected":[{"type":"plugin","slug":"bulk-delete-users-by-email","name":"Bulk Delete Users by Email","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-02T00:00:00Z","updated":"2025-09-26T18:27:51Z"},{"id":"wordfence:6c9e5cd4-303c-48a7-aef8-20c804aa5985","source":"wordfence","cve":"CVE-2021-24389","title":"FoodBakery | Delivery Restaurant Directory WordPress Theme <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c9e5cd4-303c-48a7-aef8-20c804aa5985?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2021-06-14T00:00:00Z","updated":"2026-04-24T15:27:52Z"},{"id":"wordfence:6c9f5515-cdf5-4883-bdeb-1de53bcc615a","source":"wordfence","cve":"CVE-2026-8048","title":"My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6c9f5515-cdf5-4883-bdeb-1de53bcc615a?source=api-prod","affected":[{"type":"plugin","slug":"my-email-shortcode","name":"My Email Shortcode","from":"*","from_inclusive":true,"to":"0.91","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:20:21Z","updated":"2026-05-27T05:31:26Z"},{"id":"wordfence:6ca0681a-59ca-42e6-8ee2-574590fc3ae2","source":"wordfence","cve":"CVE-2022-0899","title":"Header Footer Code Manager <= 1.1.23 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca0681a-59ca-42e6-8ee2-574590fc3ae2?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code-manager","name":"Header Footer Code Manager","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.24"}],"published":"2022-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ca08679-6aed-46c5-823c-6144112eed02","source":"wordfence","cve":"CVE-2023-28415","title":"Side Cart Woocommerce (Ajax) <= 2.2 Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca08679-6aed-46c5-823c-6144112eed02?source=api-prod","affected":[{"type":"plugin","slug":"side-cart-woocommerce","name":"Side Cart Woocommerce | Woocommerce Cart","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ca0ce12-4759-4182-b69e-665e189b92f7","source":"wordfence","cve":"CVE-2024-30221","title":"Sunshine Photo Cart: Free Client Photo Galleries for Photographers <= 3.1.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca0ce12-4759-4182-b69e-665e189b92f7?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T21:24:58Z"},{"id":"wordfence:6ca11df6-83e3-48b5-84b8-3f3e4f75ac4a","source":"wordfence","cve":"CVE-2025-14880","title":"Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca11df6-83e3-48b5-84b8-3f3e4f75ac4a?source=api-prod","affected":[{"type":"plugin","slug":"netcash-pay-now-payment-gateway-for-woocommerce","name":"Netcash WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-01-13T17:16:35Z","updated":"2026-01-15T17:59:13Z"},{"id":"wordfence:6ca16602-52e6-4d14-99a5-ca4e26b9f377","source":"wordfence","cve":"CVE-2023-3179","title":"POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Account Compromise","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca16602-52e6-4d14-99a5-ca4e26b9f377?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ca2311c-7b44-4dad-bea0-131776205319","source":"wordfence","cve":"CVE-2023-32130","title":"Multi Rating <= 5.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca2311c-7b44-4dad-bea0-131776205319?source=api-prod","affected":[{"type":"plugin","slug":"multi-rating","name":"Multi Rating","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ca28c91-f75e-4691-91cf-459cc9da5ad8","source":"wordfence","cve":"CVE-2024-1912","title":"Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca28c91-f75e-4691-91cf-459cc9da5ad8?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:49:02Z"},{"id":"wordfence:6ca2be3b-b447-4621-8923-382b8b5255b0","source":"wordfence","cve":"CVE-2024-53714","title":"Continue Shopping From Cart <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca2be3b-b447-4621-8923-382b8b5255b0?source=api-prod","affected":[{"type":"plugin","slug":"continue-shopping-from-cart-page","name":"Continue Shopping From Cart","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T18:48:26Z"},{"id":"wordfence:6ca2d1d4-fcf8-4943-b9c5-9560968ae2d8","source":"wordfence","cve":"CVE-2023-7088","title":"Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca2d1d4-fcf8-4943-b9c5-9560968ae2d8?source=api-prod","affected":[{"type":"plugin","slug":"add-svg-support-for-media-uploader-inventivo","name":"Add SVG Support for Media Uploader | inventivo","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:43:23Z"},{"id":"wordfence:6ca4dff0-ca3a-44cf-a30b-36b31d2848ab","source":"wordfence","cve":"CVE-2024-4707","title":"Materialis Companion <= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca4dff0-ca3a-44cf-a30b-36b31d2848ab?source=api-prod","affected":[{"type":"plugin","slug":"materialis-companion","name":"Materialis Companion","from":"*","from_inclusive":true,"to":"1.3.41","to_inclusive":true,"patched_in":"1.3.42"}],"published":"2024-06-05T15:30:15Z","updated":"2024-06-06T03:32:54Z"},{"id":"wordfence:6ca7ac42-2e61-498a-b46e-1f6fbdb0dd65","source":"wordfence","cve":"CVE-2026-1753","title":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder < 1.6.1 - Missing Authorization to Authenticated (Contributor+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca7ac42-2e61-498a-b46e-1f6fbdb0dd65?source=api-prod","affected":[{"type":"plugin","slug":"gutena-forms","name":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T13:52:11Z"},{"id":"wordfence:6ca7cbd9-54e0-4996-ba10-8453fb5128ba","source":"wordfence","cve":"CVE-2026-114188","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca7cbd9-54e0-4996-ba10-8453fb5128ba?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-06T15:26:13Z","updated":"2026-11-10T19:16:10Z"},{"id":"wordfence:6ca9eaf7-261b-42ab-a779-9e11dde5763b","source":"wordfence","cve":"CVE-2026-10033","title":"EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca9eaf7-261b-42ab-a779-9e11dde5763b?source=api-prod","affected":[{"type":"plugin","slug":"eventon-action-user","name":"EventON Action User","from":"*","from_inclusive":true,"to":"2.5.14","to_inclusive":true,"patched_in":"2.5.15"}],"published":"2026-07-23T21:26:43Z","updated":"2026-07-24T09:31:47Z"},{"id":"wordfence:6cab527f-bd67-4b67-8133-f085098d63dc","source":"wordfence","cve":"CVE-2024-10647","title":"WS Form LITE \u2013 Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cab527f-bd67-4b67-8133-f085098d63dc?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.9.244","to_inclusive":true,"patched_in":"1.9.245"}],"published":"2024-11-05T00:00:00Z","updated":"2024-11-06T02:01:56Z"},{"id":"wordfence:6cad50b5-5485-4efb-a511-9ec057cf0a28","source":"wordfence","cve":"CVE-2026-86838","title":"Bookly <= 28.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cad50b5-5485-4efb-a511-9ec057cf0a28?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:53:50Z"},{"id":"wordfence:6cad85e1-9af0-44fa-97c7-a108b30891e2","source":"wordfence","cve":"CVE-2024-31090","title":"Hacklog Down As PDF <= 2.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cad85e1-9af0-44fa-97c7-a108b30891e2?source=api-prod","affected":[{"type":"plugin","slug":"down-as-pdf","name":"Hacklog Down As PDF","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:31:05Z"},{"id":"wordfence:6cae5b10-516a-4b60-bc15-884ece5102cf","source":"wordfence","cve":"","title":"Simple Slideshow Manager <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cae5b10-516a-4b60-bc15-884ece5102cf?source=api-prod","affected":[{"type":"plugin","slug":"simple-slideshow-manager","name":"Simple Slideshow Manager","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2017-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cae72cd-8a51-4e26-8ba2-c04c7d95faf7","source":"wordfence","cve":"CVE-2025-49429","title":"Video Embeds <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cae72cd-8a51-4e26-8ba2-c04c7d95faf7?source=api-prod","affected":[{"type":"plugin","slug":"video-embeds","name":"Video Embeds","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:46:06Z"},{"id":"wordfence:6cae79d1-5ceb-4d34-9c9b-9cec4957cd6b","source":"wordfence","cve":"CVE-2025-26577","title":"DX-auto-publish <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cae79d1-5ceb-4d34-9c9b-9cec4957cd6b?source=api-prod","affected":[{"type":"plugin","slug":"dx-auto-publish","name":"DX-auto-publish","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:34:13Z"},{"id":"wordfence:6cb099ff-52c3-4ad6-994d-36275ebc0a5f","source":"wordfence","cve":"CVE-2024-12586","title":"Chalet-Montagne.com Tools <= 2.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cb099ff-52c3-4ad6-994d-36275ebc0a5f?source=api-prod","affected":[{"type":"plugin","slug":"chalet-montagne-com-tools","name":"Chalet-Montagne.com Tools","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-30T22:08:25Z"},{"id":"wordfence:6cb3bdf4-2af4-46da-a976-cdfabb3fc94d","source":"wordfence","cve":"CVE-2026-104719","title":"CookieYes \u2013 Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) < 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cb3bdf4-2af4-46da-a976-cdfabb3fc94d?source=api-prod","affected":[{"type":"plugin","slug":"cookie-law-info","name":"CookieYes \u2013 Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":false,"patched_in":"3.5.8"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:37:22Z"},{"id":"wordfence:6cbaa1eb-5e16-4b39-b7fc-9ed8967274c8","source":"wordfence","cve":"CVE-2025-67989","title":"Kerge <= 4.1.3 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbaa1eb-5e16-4b39-b7fc-9ed8967274c8?source=api-prod","affected":[{"type":"theme","slug":"kerge","name":"Personal Portfolio Resume Theme | Kerge","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:25:50Z"},{"id":"wordfence:6cbb51fe-ae7f-4fe8-89ad-38f6d3238cea","source":"wordfence","cve":"CVE-2024-8872","title":"Store Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbb51fe-ae7f-4fe8-89ad-38f6d3238cea?source=api-prod","affected":[{"type":"plugin","slug":"order-hours-scheduler-for-woocommerce","name":"Store Hours for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"4.3.22"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T08:29:47Z"},{"id":"wordfence:6cbdd498-c0dd-48d1-ae2c-6d3df3ce2f03","source":"wordfence","cve":"CVE-2025-28892","title":"FTP Sync <= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbdd498-c0dd-48d1-ae2c-6d3df3ce2f03?source=api-prod","affected":[{"type":"plugin","slug":"ftp-sync","name":"FTP Sync \u2013 Theme, Media & Plugin Files","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:10:56Z"},{"id":"wordfence:6cbe4748-6e87-4332-b84f-615aec67bcec","source":"wordfence","cve":"CVE-2024-1948","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbe4748-6e87-4332-b84f-615aec67bcec?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-03-21T00:00:00Z","updated":"2024-07-31T15:32:07Z"},{"id":"wordfence:6cbf9636-9d9d-44d4-b873-8920f2dbb846","source":"wordfence","cve":"CVE-2022-4410","title":"Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbf9636-9d9d-44d4-b873-8920f2dbb846?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.2.20.3","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2022-12-14T00:00:00Z","updated":"2024-05-31T15:30:24Z"},{"id":"wordfence:6cc1d7f2-053d-42d4-afb7-6fb69fd71b91","source":"wordfence","cve":"CVE-2022-2233","title":"Banner Cycler <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc1d7f2-053d-42d4-afb7-6fb69fd71b91?source=api-prod","affected":[{"type":"plugin","slug":"banner-cycler","name":"Banner Cycler","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cc218fb-6c2a-4676-b2d7-86abe01c1530","source":"wordfence","cve":"CVE-2023-28988","title":"Direct checkout, Add to cart redirect for Woocommerce <= 2.1.48 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc218fb-6c2a-4676-b2d7-86abe01c1530?source=api-prod","affected":[{"type":"plugin","slug":"add-to-cart-direct-checkout-for-woocommerce","name":"Add to Cart Redirect for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.48","to_inclusive":true,"patched_in":"2.1.49"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cc2dba8-a058-4a1e-a975-9c04639a4f50","source":"wordfence","cve":"CVE-2025-62760","title":"BuddyPress Activity Shortcode <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc2dba8-a058-4a1e-a975-9c04639a4f50?source=api-prod","affected":[{"type":"plugin","slug":"bp-activity-shortcode","name":"BuddyPress Activity Shortcode","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:36:23Z"},{"id":"wordfence:6cc308f4-c94f-48ae-9d65-0685236cdfbd","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc308f4-c94f-48ae-9d65-0685236cdfbd?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cc3c124-f200-4d38-92b3-b520702f3a04","source":"wordfence","cve":"CVE-2025-52725","title":"CouponXxL <= 3.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc3c124-f200-4d38-92b3-b520702f3a04?source=api-prod","affected":[{"type":"theme","slug":"couponxxl","name":"CouponXxL","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T19:00:01Z"},{"id":"wordfence:6cc43ebc-ce71-48b9-96b3-5d1c5ab4eb4c","source":"wordfence","cve":"CVE-2026-104644","title":"Image Photo Gallery Final Tiles Grid < 3.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc43ebc-ce71-48b9-96b3-5d1c5ab4eb4c?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":false,"patched_in":"3.6.15"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:43:28Z"},{"id":"wordfence:6cc4a67b-81fa-4ef6-9167-eab5cb9002ec","source":"wordfence","cve":"CVE-2024-2735","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via \"Price List\" Element","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc4a67b-81fa-4ef6-9167-eab5cb9002ec?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:21Z"},{"id":"wordfence:6cc52af3-8304-4536-af2c-8bc91b9fb9c9","source":"wordfence","cve":"CVE-2025-58013","title":"CouponXxL <= 4.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc52af3-8304-4536-af2c-8bc91b9fb9c9?source=api-prod","affected":[{"type":"theme","slug":"couponxxl","name":"CouponXxL","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:44:06Z"},{"id":"wordfence:6cc5f274-6e71-47a1-b4ec-9b3ba46fd7bf","source":"wordfence","cve":"","title":"123ContactForm for WordPress <= 1.5.6 - Validation Bypass via Plugin Verification","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc5f274-6e71-47a1-b4ec-9b3ba46fd7bf?source=api-prod","affected":[{"type":"plugin","slug":"123contactform-for-wordpress","name":"123ContactForm for WordPress","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2021-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cc65564-bda7-4e59-be74-f0341913618f","source":"wordfence","cve":"CVE-2024-43315","title":"Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc65564-bda7-4e59-be74-f0341913618f?source=api-prod","affected":[{"type":"plugin","slug":"checkout-plugins-stripe-woo","name":"Stripe Payments For WooCommerce by Checkout Plugins","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:17:06Z"},{"id":"wordfence:6cc6d71c-fb19-4142-a8be-4175afc1713c","source":"wordfence","cve":"CVE-2019-17671","title":"WordPress Core < 5.2.4 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc6d71c-fb19-4142-a8be-4175afc1713c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.14","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cc709e0-870b-4d12-9ac8-55da498768a1","source":"wordfence","cve":"CVE-2026-1208","title":"Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc709e0-870b-4d12-9ac8-55da498768a1?source=api-prod","affected":[{"type":"plugin","slug":"friendly-functions-for-welcart","name":"Friendly Functions for Welcart","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-01-23T20:32:39Z","updated":"2026-01-24T09:08:15Z"},{"id":"wordfence:6cc83edb-44ce-4dc9-8cba-734775a94779","source":"wordfence","cve":"CVE-2021-24511","title":"Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More < 3.3.1.0 - Authenticated SQL Injection via product_id Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc83edb-44ce-4dc9-8cba-734775a94779?source=api-prod","affected":[{"type":"plugin","slug":"purple-xmls-google-product-feed-for-woocommerce","name":"Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More","from":"*","from_inclusive":true,"to":"3.3.1.0","to_inclusive":false,"patched_in":"3.3.1.0"}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ccb229c-2945-4f4c-a46f-e8b21bea459d","source":"wordfence","cve":"CVE-2026-14333","title":"Demi - One Click Demo Import, Backup & Site Migration <= 0.0.6 - Unauthenticated Sensitive Data Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ccb229c-2945-4f4c-a46f-e8b21bea459d?source=api-prod","affected":[{"type":"plugin","slug":"demi-backup-migration","name":"Demi \u2013 One Click Demo Import, Backup & Site Migration","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":"0.0.7"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T14:21:33Z"},{"id":"wordfence:6ccc76fc-21c9-4188-80df-a0c14726ffc6","source":"wordfence","cve":"CVE-2025-46528","title":"Availability Calendar <= 0.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ccc76fc-21c9-4188-80df-a0c14726ffc6?source=api-prod","affected":[{"type":"plugin","slug":"availability","name":"Availability Calendar","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:49:42Z"},{"id":"wordfence:6cd116e5-2b1f-4a76-be3b-06a3a5df85d2","source":"wordfence","cve":"CVE-2025-53560","title":"Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd116e5-2b1f-4a76-be3b-06a3a5df85d2?source=api-prod","affected":[{"type":"theme","slug":"noisa","name":"Noisa","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:42:17Z"},{"id":"wordfence:6cd166bc-774e-4083-b5f7-bffba1f7c293","source":"wordfence","cve":"CVE-2025-4798","title":"WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd166bc-774e-4083-b5f7-bffba1f7c293?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.10","to_inclusive":true,"patched_in":"1.68.11"}],"published":"2025-06-10T15:30:37Z","updated":"2025-06-11T03:41:52Z"},{"id":"wordfence:6cd209ea-4698-4131-9441-1a8a92603153","source":"wordfence","cve":"CVE-2025-69052","title":"Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd209ea-4698-4131-9441-1a8a92603153?source=api-prod","affected":[{"type":"plugin","slug":"registration-login-with-mobile-phone-number","name":"Registration & Login with Mobile Phone Number for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-03-17T21:28:44Z"},{"id":"wordfence:6cd49c60-e845-4dbb-b6b1-bd59aa1bb3ba","source":"wordfence","cve":"","title":"Crayon Syntax Highlighter  2.0 - 2.6.10 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd49c60-e845-4dbb-b6b1-bd59aa1bb3ba?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"2.0","from_inclusive":true,"to":"2.6.10","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cd58adb-31cd-49e2-9c9d-e248b4b0a778","source":"wordfence","cve":"CVE-2023-29388","title":"Product Catalog Simple <= 1.6.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd58adb-31cd-49e2-9c9d-e248b4b0a778?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cd5d1c7-4be2-457b-bd28-0cb76e9800e5","source":"wordfence","cve":"CVE-2025-7730","title":"Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd5d1c7-4be2-457b-bd28-0cb76e9800e5?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2025-10-23T09:43:52Z","updated":"2025-10-23T22:25:22Z"},{"id":"wordfence:6cd64ab0-007b-4778-9d92-06e530638fad","source":"wordfence","cve":"CVE-2023-1910","title":"Getwid \u2013 Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd64ab0-007b-4778-9d92-06e530638fad?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2023-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cd9cbba-10b0-4fb0-ad49-4593a307a615","source":"wordfence","cve":"CVE-2022-4712","title":"WP Cerber Security <= 9.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd9cbba-10b0-4fb0-ad49-4593a307a615?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cdbc865-2566-419c-a54f-f719b64bf149","source":"wordfence","cve":"CVE-2024-56275","title":"Envato Elements <= 2.0.14 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cdbc865-2566-419c-a54f-f719b64bf149?source=api-prod","affected":[{"type":"plugin","slug":"envato-elements","name":"Envato Elements \u2013 Photos & Elementor Templates","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:47:55Z"},{"id":"wordfence:6cdc0096-8e21-4b82-b9d0-961f48907a09","source":"wordfence","cve":"CVE-2023-51355","title":"WC Marketplace <= 4.0.23 - Missing Authorization via mvx_save_dashpages","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cdc0096-8e21-4b82-b9d0-961f48907a09?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.0.23","to_inclusive":true,"patched_in":"4.0.24"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6cdd662b-09b9-4c0e-a543-51866f6a9d71","source":"wordfence","cve":"CVE-2025-22290","title":"LTL Freight Quotes \u2013 FreightQuote Edition <= 2.3.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cdd662b-09b9-4c0e-a543-51866f6a9d71?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-freightquote-edition","name":"LTL Freight Quotes \u2013 FreightQuote Edition","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-02-12T00:00:00Z","updated":"2025-03-21T14:47:47Z"},{"id":"wordfence:6ce177e7-a009-4b5d-ba4c-971de5496dca","source":"wordfence","cve":"CVE-2026-61961","title":"EmbedPress \u2013 PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce177e7-a009-4b5d-ba4c-971de5496dca?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:23:42Z"},{"id":"wordfence:6ce17e3d-97c1-468a-a590-0f2455e2b25f","source":"wordfence","cve":"CVE-2026-114120","title":"SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher < 5.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce17e3d-97c1-468a-a590-0f2455e2b25f?source=api-prod","affected":[{"type":"plugin","slug":"wp-scheduled-posts","name":"SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":false,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T16:37:07Z"},{"id":"wordfence:6ce24fa7-b265-4689-94b3-7df62c7074c2","source":"wordfence","cve":"CVE-2026-1430","title":"WP Lightbox 2 < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce24fa7-b265-4689-94b3-7df62c7074c2?source=api-prod","affected":[{"type":"plugin","slug":"wp-lightbox-2","name":"WP Lightbox 2","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2026-03-30T00:00:00Z","updated":"2026-04-02T14:49:17Z"},{"id":"wordfence:6ce3d237-baed-405b-82f8-98ec95ed06fc","source":"wordfence","cve":"CVE-2025-28968","title":"WP Wall <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce3d237-baed-405b-82f8-98ec95ed06fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-wall","name":"WP Wall","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:15:39Z"},{"id":"wordfence:6ce57b12-2241-416b-b466-aa06ca8c7551","source":"wordfence","cve":"CVE-2026-1938","title":"YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce57b12-2241-416b-b466-aa06ca8c7551?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-02-17T19:00:00Z","updated":"2026-02-18T07:25:41Z"},{"id":"wordfence:6ce67488-3d4b-49c7-b9b9-b6e406a30468","source":"wordfence","cve":"CVE-2025-15654","title":"Prague <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce67488-3d4b-49c7-b9b9-b6e406a30468?source=api-prod","affected":[{"type":"plugin","slug":"prague-plugins","name":"Prague","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2026-01-27T00:00:00Z","updated":"2026-07-10T19:03:07Z"},{"id":"wordfence:6ce726da-4860-4809-b579-9ec0d31a2fb1","source":"wordfence","cve":"CVE-2024-30180","title":"Easy Social Feed <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce726da-4860-4809-b579-9ec0d31a2fb1?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T17:10:37Z"},{"id":"wordfence:6cea1c79-11db-443f-8fe8-f56276ca3516","source":"wordfence","cve":"CVE-2025-39593","title":"Ever Accounting <= 2.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cea1c79-11db-443f-8fe8-f56276ca3516?source=api-prod","affected":[{"type":"plugin","slug":"wp-ever-accounting","name":"Ever Accounting \u2013 Accounting & Invoicing Solution for Small Businesses","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:56:56Z"},{"id":"wordfence:6cec3472-9778-44a6-b792-306288284b0a","source":"wordfence","cve":"CVE-2026-16070","title":"Brizy - Page Builder <= 2.8.18 - Insecure Direct Object Reference to Authenticated (Contributor+) Template Type Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cec3472-9778-44a6-b792-306288284b0a?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:38:12Z"},{"id":"wordfence:6cecd06f-c064-49fd-b3fa-505a5a0c2e0b","source":"wordfence","cve":"CVE-2026-3584","title":"Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cecd06f-c064-49fd-b3fa-505a5a0c2e0b?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2026-03-20T08:36:13Z","updated":"2026-03-20T21:25:11Z"},{"id":"wordfence:6cee38d7-08df-4cff-8546-a444fe190723","source":"wordfence","cve":"CVE-2026-15261","title":"TI WooCommerce Wishlist <= 2.12.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cee38d7-08df-4cff-8546-a444fe190723?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:41:32Z"},{"id":"wordfence:6cee8cd9-7fa9-4154-9d74-ab54da18e521","source":"wordfence","cve":"CVE-2024-32526","title":"Easy Textillate <= 2.02 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cee8cd9-7fa9-4154-9d74-ab54da18e521?source=api-prod","affected":[{"type":"plugin","slug":"easy-textillate","name":"Easy Textillate","from":"*","from_inclusive":true,"to":"2.02","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:27:30Z"},{"id":"wordfence:6cef60a8-0601-4e0b-adfb-e3fe6a5351e9","source":"wordfence","cve":"CVE-2026-94067","title":"The Voux <= 6.9.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cef60a8-0601-4e0b-adfb-e3fe6a5351e9?source=api-prod","affected":[{"type":"theme","slug":"thevoux-wp","name":"The Voux - A Multipurpose News & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:03:07Z"},{"id":"wordfence:6cf01a38-1fba-4c93-b3fa-acfdd5b19410","source":"wordfence","cve":"CVE-2025-13540","title":"Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf01a38-1fba-4c93-b3fa-acfdd5b19410?source=api-prod","affected":[{"type":"plugin","slug":"tiare-membership","name":"Tiare Membership","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-11-26T16:25:27Z","updated":"2025-11-27T04:36:45Z"},{"id":"wordfence:6cf22af6-3e25-43ae-b10d-f343720e722a","source":"wordfence","cve":"CVE-2026-102002","title":"Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget","severity":"low","cvss":3.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf22af6-3e25-43ae-b10d-f343720e722a?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2026-10-01T19:21:44Z","updated":"2026-10-02T07:39:24Z"},{"id":"wordfence:6cf64714-69e9-4734-b9f9-eb906a554005","source":"wordfence","cve":"CVE-2024-38732","title":"Patricia Blog <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf64714-69e9-4734-b9f9-eb906a554005?source=api-prod","affected":[{"type":"theme","slug":"patricia-blog","name":"Patricia Blog","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:15:39Z"},{"id":"wordfence:6cf836c6-9a78-46c7-885f-a52024669dde","source":"wordfence","cve":"CVE-2026-45212","title":"Asset CleanUp: Page Speed Booster <= 1.4.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf836c6-9a78-46c7-885f-a52024669dde?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.4.0.3","to_inclusive":true,"patched_in":"1.4.0.4"}],"published":"2026-03-07T00:00:00Z","updated":"2026-07-10T19:23:43Z"},{"id":"wordfence:6cf863ce-743e-45d0-9113-e1eb8b2e8440","source":"wordfence","cve":"CVE-2026-65541","title":"Staff Training <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf863ce-743e-45d0-9113-e1eb8b2e8440?source=api-prod","affected":[{"type":"plugin","slug":"staff-training","name":"Staff Training","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:31:10Z"},{"id":"wordfence:6cf9256c-51a1-47d5-8be5-c9697dce2ae3","source":"wordfence","cve":"CVE-2026-16611","title":"Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6cf9256c-51a1-47d5-8be5-c9697dce2ae3?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"13.5.6","to_inclusive":true,"patched_in":"13.5.7"}],"published":"2026-08-13T00:00:00Z","updated":"2026-09-02T21:47:14Z"},{"id":"wordfence:6d03f316-542c-4128-b49d-fd2fd8609dd6","source":"wordfence","cve":"CVE-2025-10489","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d03f316-542c-4128-b49d-fd2fd8609dd6?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2025-09-19T00:00:00Z","updated":"2025-09-20T04:27:55Z"},{"id":"wordfence:6d041edb-70f3-4894-8a78-f6881541054c","source":"wordfence","cve":"","title":"Shop as a Customer for WooCommerce <= 1.1.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d041edb-70f3-4894-8a78-f6881541054c?source=api-prod","affected":[{"type":"plugin","slug":"shop-as-a-customer-for-woocommerce","name":"Shop as a Customer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d050a44-41ac-46ac-ba2e-406bfaebec69","source":"wordfence","cve":"CVE-2026-14323","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d050a44-41ac-46ac-ba2e-406bfaebec69?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-09-17T18:41:08Z","updated":"2026-09-18T07:40:01Z"},{"id":"wordfence:6d063374-ecb2-41de-872d-18f94aac7e03","source":"wordfence","cve":"CVE-2022-1250","title":"LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d063374-ecb2-41de-872d-18f94aac7e03?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms-gateway-paypal","name":"LifterLMS Paypal","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d06d721-ab48-43ae-81d6-bd0b3177a7bf","source":"wordfence","cve":"CVE-2025-8295","title":"Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d06d721-ab48-43ae-81d6-bd0b3177a7bf?source=api-prod","affected":[{"type":"plugin","slug":"employee-directory","name":"Employee Directory \u2013 Staff & Team Directory","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2025-08-04T18:45:25Z","updated":"2025-08-05T07:24:16Z"},{"id":"wordfence:6d07c82d-262a-4ac1-9ee5-7ef4d025f66f","source":"wordfence","cve":"CVE-2026-18439","title":"Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d07c82d-262a-4ac1-9ee5-7ef4d025f66f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-21T18:52:22Z","updated":"2026-09-22T07:41:12Z"},{"id":"wordfence:6d081b89-1b98-4f4f-8728-d1ea676d7afd","source":"wordfence","cve":"CVE-2024-11726","title":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d081b89-1b98-4f4f-8728-d1ea676d7afd?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T11:09:52Z"},{"id":"wordfence:6d0d4d06-95f7-4ecd-84a7-2d3996b16b1c","source":"wordfence","cve":"CVE-2024-54282","title":"WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0d4d06-95f7-4ecd-84a7-2d3996b16b1c?source=api-prod","affected":[{"type":"plugin","slug":"wp-megamenu","name":"WP Mega Menu","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2026-11-10T09:55:12Z"},{"id":"wordfence:6d0e1c33-e6c7-4a59-87f1-37806a303b33","source":"wordfence","cve":"CVE-2026-14204","title":"Google Authenticator <= 0.55 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0e1c33-e6c7-4a59-87f1-37806a303b33?source=api-prod","affected":[{"type":"plugin","slug":"google-authenticator","name":"Google Authenticator","from":"*","from_inclusive":true,"to":"0.55","to_inclusive":true,"patched_in":"0.56"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:03:27Z"},{"id":"wordfence:6d0fcd82-6d4a-454f-8056-a896e8d41d00","source":"wordfence","cve":"CVE-2023-6160","title":"LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion","severity":"low","cvss":3.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fcd82-6d4a-454f-8056-a896e8d41d00?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2023-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d0fff4d-e9fa-45ef-9593-753b40a71d38","source":"wordfence","cve":"CVE-2024-39310","title":"Basil <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d0fff4d-e9fa-45ef-9593-753b40a71d38?source=api-prod","affected":[{"type":"theme","slug":"basil","name":"Basil","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-06-14T00:00:00Z","updated":"2024-07-02T13:06:15Z"},{"id":"wordfence:6d10202f-dba6-4308-9857-a576c63ec6da","source":"wordfence","cve":"CVE-2025-23929","title":"Email Capture & Lead Generation <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d10202f-dba6-4308-9857-a576c63ec6da?source=api-prod","affected":[{"type":"plugin","slug":"email-capture-lead-generation","name":"Email Capture & Lead Generation","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:12:56Z"},{"id":"wordfence:6d126213-e342-4271-aca0-5cc47214ae8b","source":"wordfence","cve":"CVE-2026-12754","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d126213-e342-4271-aca0-5cc47214ae8b?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2026-06-30T20:07:22Z","updated":"2026-07-01T08:30:05Z"},{"id":"wordfence:6d12ab8c-d5d0-4e02-986e-e894fae073e5","source":"wordfence","cve":"CVE-2024-11297","title":"Page Restriction WordPress (WP) \u2013 Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d12ab8c-d5d0-4e02-986e-e894fae073e5?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T21:45:31Z"},{"id":"wordfence:6d14a90d-65ea-45da-956b-0735e2e2b538","source":"wordfence","cve":"CVE-2024-1169","title":"Post Form \u2013 Registration Form \u2013 Profile Form for User Profiles \u2013 Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d14a90d-65ea-45da-956b-0735e2e2b538?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T11:01:58Z"},{"id":"wordfence:6d1517d4-79d0-4d4b-b54d-86e00dabd874","source":"wordfence","cve":"CVE-2023-2802","title":"Ultimate Addons for Contact Form 7 <= 3.1.28 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1517d4-79d0-4d4b-b54d-86e00dabd874?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.1.29","to_inclusive":false,"patched_in":"3.1.29"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d15f5de-9ec9-466d-aafe-6304356ccb39","source":"wordfence","cve":"CVE-2026-4118","title":"Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d15f5de-9ec9-466d-aafe-6304356ccb39?source=api-prod","affected":[{"type":"plugin","slug":"call-to-action-plugin","name":"Call To Action Plugin","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:07:28Z","updated":"2026-04-22T07:45:36Z"},{"id":"wordfence:6d18706b-bc2a-4889-8057-ebc5805c6f10","source":"wordfence","cve":"CVE-2025-23813","title":"Guten Free Options <= 0.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d18706b-bc2a-4889-8057-ebc5805c6f10?source=api-prod","affected":[{"type":"plugin","slug":"guten-free-options","name":"Guten Free Options","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:40:29Z"},{"id":"wordfence:6d1ad409-d5d3-4231-9a7c-de881c7b9de2","source":"wordfence","cve":"CVE-2019-6726","title":"WP Fastest Cache <= 0.8.9.0 - Directory Traversal to Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1ad409-d5d3-4231-9a7c-de881c7b9de2?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.9.0","to_inclusive":true,"patched_in":"0.8.9.1"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d1b255f-d775-4bd5-892e-42bf82dd5632","source":"wordfence","cve":"CVE-2024-6123","title":"Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1b255f-d775-4bd5-892e-42bf82dd5632?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.13.4"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-14T13:25:03Z"},{"id":"wordfence:6d1b948a-7a7e-4bdf-af1d-559f34d4baa3","source":"wordfence","cve":"CVE-2024-5790","title":"Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1b948a-7a7e-4bdf-af1d-559f34d4baa3?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2024-06-28T17:53:46Z","updated":"2024-06-29T07:05:39Z"},{"id":"wordfence:6d1ba996-e26c-45cc-ab95-338663f481d9","source":"wordfence","cve":"CVE-2026-13167","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1ba996-e26c-45cc-ab95-338663f481d9?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T04:24:54Z"},{"id":"wordfence:6d1d541b-7010-4dbf-9b1c-d59c84390065","source":"wordfence","cve":"CVE-2022-4948","title":"FlyingPress <= 3.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1d541b-7010-4dbf-9b1c-d59c84390065?source=api-prod","affected":[{"type":"plugin","slug":"flying-press","name":"FlyingPress","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d1ea80a-a1ce-4964-8dde-f3ed2df5537c","source":"wordfence","cve":"CVE-2024-10593","title":"WPForms \u2013 Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1ea80a-a1ce-4964-8dde-f3ed2df5537c?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.1.6","to_inclusive":true,"patched_in":"1.9.2.1"}],"published":"2024-11-12T14:02:45Z","updated":"2024-11-13T02:33:17Z"},{"id":"wordfence:6d24b714-d107-403e-a711-28efc7c29910","source":"wordfence","cve":"CVE-2026-24950","title":"Authorsy <= 1.0.6 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d24b714-d107-403e-a711-28efc7c29910?source=api-prod","affected":[{"type":"plugin","slug":"authorsy","name":"Authorsy \u2013 Author Box, Multiple Authors, Guest Authors & Post Rating","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:39:42Z"},{"id":"wordfence:6d27544c-97a5-42cd-ab07-358f819acbc4","source":"wordfence","cve":"CVE-2024-3750","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d27544c-97a5-42cd-ab07-358f819acbc4?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.10.15","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T02:36:49Z"},{"id":"wordfence:6d2a2460-fbac-41cd-9487-f83af0073de7","source":"wordfence","cve":"CVE-2025-49252","title":"Besa <= 2.3.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d2a2460-fbac-41cd-9487-f83af0073de7?source=api-prod","affected":[{"type":"theme","slug":"besa","name":"Besa - Elementor Marketplace WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T13:45:31Z"},{"id":"wordfence:6d2aa302-aaab-4bf1-9a79-144290b967de","source":"wordfence","cve":"CVE-2025-12705","title":"Social Reviews & Recommendations <= 2.5 - Unauthenticated Stored Cross-Site Scripting via Social Media Reviews","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d2aa302-aaab-4bf1-9a79-144290b967de?source=api-prod","affected":[{"type":"plugin","slug":"fb-reviews-widget","name":"Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-09T13:51:11Z"},{"id":"wordfence:6d2e3252-454c-47a2-a09d-5d0474c82e2b","source":"wordfence","cve":"CVE-2021-24824","title":"Custom Content Shortcode <= 3.8.8 - Unauthorised Arbitrary Post Metadata Access","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d2e3252-454c-47a2-a09d-5d0474c82e2b?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-shortcode","name":"Custom Content Shortcode","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d3089d3-8ea4-47f7-bbcd-3408a099ae94","source":"wordfence","cve":"CVE-2023-23970","title":"Corsa Theme <= 1.5 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3089d3-8ea4-47f7-bbcd-3408a099ae94?source=api-prod","affected":[{"type":"theme","slug":"corsa","name":"Corsa","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d31b10b-afeb-429c-9dfc-28b6891538b3","source":"wordfence","cve":"CVE-2026-106029","title":"WeddingCity Lite <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d31b10b-afeb-429c-9dfc-28b6891538b3?source=api-prod","affected":[{"type":"plugin","slug":"weddingcity-lite","name":"WeddingCity Lite \u2013 Wedding Directory and Listing","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:41:34Z"},{"id":"wordfence:6d32f5ee-2e3e-48dc-a5e3-b58c02e46f7d","source":"wordfence","cve":"CVE-2026-66424","title":"SMS Alert Order Notifications <= 3.9.7 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d32f5ee-2e3e-48dc-a5e3-b58c02e46f7d?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:51:17Z"},{"id":"wordfence:6d359a5c-db11-416e-a329-c3ed67b1a925","source":"wordfence","cve":"CVE-2024-13320","title":"CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d359a5c-db11-416e-a329-c3ed67b1a925?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multi-currency","name":"CURCY - WooCommerce Multi Currency - Currency Switcher","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T06:40:04Z"},{"id":"wordfence:6d3668b3-2bf9-48fa-af14-d0917c8b99f5","source":"wordfence","cve":"CVE-2015-7666","title":"Payment Form for PayPal Pro < 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3668b3-2bf9-48fa-af14-d0917c8b99f5?source=api-prod","affected":[{"type":"plugin","slug":"payment-form-for-paypal-pro","name":"Payment Form for PayPal Pro","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2015-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d374ccc-74f2-4064-8801-4adfcb200eb2","source":"wordfence","cve":"CVE-2025-25083","title":"EP4 More Embeds <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d374ccc-74f2-4064-8801-4adfcb200eb2?source=api-prod","affected":[{"type":"plugin","slug":"ep4-more-embeds","name":"EP4 More Embeds","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:03:26Z"},{"id":"wordfence:6d38d457-73ad-4243-89be-6c3191ae8096","source":"wordfence","cve":"CVE-2025-39432","title":"bbPress2 shortcode whitelist <= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d38d457-73ad-4243-89be-6c3191ae8096?source=api-prod","affected":[{"type":"plugin","slug":"bbpress2-shortcode-whitelist","name":"bbPress2 shortcode whitelist","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:34:31Z"},{"id":"wordfence:6d3aff16-73f0-4c1a-9838-6fd6ec69a39f","source":"wordfence","cve":"CVE-2026-86445","title":"LearnPress <= 4.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3aff16-73f0-4c1a-9838-6fd6ec69a39f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:56:57Z"},{"id":"wordfence:6d3b9d15-f6a9-4d1c-ada5-8c48add839a2","source":"wordfence","cve":"CVE-2024-43249","title":"Bit Form Pro <= 2.6.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3b9d15-f6a9-4d1c-ada5-8c48add839a2?source=api-prod","affected":[{"type":"plugin","slug":"bitformpro","name":"Bit Form Pro","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-12T14:43:13Z"},{"id":"wordfence:6d3bb015-5a01-4450-80d3-c37d5d7d8926","source":"wordfence","cve":"CVE-2024-32537","title":"Flash Video Player <= 5.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3bb015-5a01-4450-80d3-c37d5d7d8926?source=api-prod","affected":[{"type":"plugin","slug":"flash-video-player","name":"Flash Video Player","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:35:30Z"},{"id":"wordfence:6d3bfb78-0538-4627-a206-8d8b5b200bc7","source":"wordfence","cve":"","title":"Custom Contact Forms <= 5.1.0.3 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3bfb78-0538-4627-a206-8d8b5b200bc7?source=api-prod","affected":[{"type":"plugin","slug":"custom-contact-forms","name":"Custom Contact Forms","from":"*","from_inclusive":true,"to":"5.1.0.4","to_inclusive":false,"patched_in":"5.1.0.4"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d3c51e9-d66c-434f-8b01-e5af258c9a8b","source":"wordfence","cve":"CVE-2024-35753","title":"TemplatesNext OnePager <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3c51e9-d66c-434f-8b01-e5af258c9a8b?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-onepager","name":"TemplatesNext OnePager","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:08:37Z"},{"id":"wordfence:6d3cff57-ea8a-4082-bc05-d62b9d92f0e6","source":"wordfence","cve":"CVE-2023-48335","title":"Hide login page <= 1.1.7 - Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3cff57-ea8a-4082-bc05-d62b9d92f0e6?source=api-prod","affected":[{"type":"plugin","slug":"hide-login-page","name":"Hide login page, Hide wp admin \u2013 stop attack on login page","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d3fef85-70cc-49f1-b0e4-60579a3e9b07","source":"wordfence","cve":"CVE-2025-69124","title":"Especio - Food Blog Elementor Pro Template Kit <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3fef85-70cc-49f1-b0e4-60579a3e9b07?source=api-prod","affected":[{"type":"theme","slug":"especio","name":"Especio - Food Blog Elementor Pro Template Kit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:17:11Z"},{"id":"wordfence:6d420e73-24d5-4da8-8257-e0c7f0273031","source":"wordfence","cve":"CVE-2023-34017","title":"Five Star Restaurant Reservations <= 2.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d420e73-24d5-4da8-8257-e0c7f0273031?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d43235b-9c5e-4d7f-99f0-28dcab4b2a91","source":"wordfence","cve":"CVE-2024-9222","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d43235b-9c5e-4d7f-99f0-28dcab4b2a91?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.12.8","to_inclusive":true,"patched_in":"2.12.9"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T07:35:28Z"},{"id":"wordfence:6d4394fd-7063-4792-83a7-5c419fac5652","source":"wordfence","cve":"CVE-2026-57647","title":"Panorama \u2013 360 degree Virtual Tour, Panoramic Image viewer and More <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4394fd-7063-4792-83a7-5c419fac5652?source=api-prod","affected":[{"type":"plugin","slug":"panorama","name":"Panorama \u2013 Turn Photos into Immersive Virtual Tours","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:51:39Z"},{"id":"wordfence:6d43be1d-a6e7-427f-9e13-bd2fe85b3a11","source":"wordfence","cve":"CVE-2024-51671","title":"Otter - Gutenberg Block <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d43be1d-a6e7-427f-9e13-bd2fe85b3a11?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:08:32Z"},{"id":"wordfence:6d4544b9-bb15-47e2-b377-0bae91aba4da","source":"wordfence","cve":"CVE-2022-40697","title":"3com \u2013 Asesor de Cookies <= 3.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4544b9-bb15-47e2-b377-0bae91aba4da?source=api-prod","affected":[{"type":"plugin","slug":"3com-asesor-de-cookies","name":"3com \u2013 Asesor de Cookies para normativa espa\u00f1ola","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":""}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d484422-4adf-4370-b228-61496d5ad78a","source":"wordfence","cve":"CVE-2024-13420","title":"Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates","severity":"medium","cvss":4.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d484422-4adf-4370-b228-61496d5ad78a?source=api-prod","affected":[{"type":"plugin","slug":"beyot-framework","name":"Beyot Framework","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"benaa-framework","name":"Benaa Framework","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"g5plus-auteur","name":"Auteur Framework","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"april-framework","name":"April Framework","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:20Z"},{"id":"wordfence:6d48c52b-f42f-4c25-892f-3cce9ed8cbee","source":"wordfence","cve":"CVE-2012-0895","title":"Count per Day <= 3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d48c52b-f42f-4c25-892f-3cce9ed8cbee?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d490bfb-6560-428e-ad91-0f8d8bc9b1f2","source":"wordfence","cve":"CVE-2023-3404","title":"ProfileGrid <= 5.5.0 - Hardcoded Encryption Key","severity":"medium","cvss":4.9,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d490bfb-6560-428e-ad91-0f8d8bc9b1f2?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d4b0434-61ca-47b1-9119-7208283f916f","source":"wordfence","cve":"CVE-2025-5238","title":"YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4b0434-61ca-47b1-9119-7208283f916f?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-06-13T21:04:41Z","updated":"2025-06-14T09:23:34Z"},{"id":"wordfence:6d4c2944-28e8-4866-b4da-91cf12d9d115","source":"wordfence","cve":"CVE-2024-8717","title":"PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer \u2013 DearFlip <= 2.3.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4c2944-28e8-4866-b4da-91cf12d9d115?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.3.32","to_inclusive":true,"patched_in":"2.3.42"}],"published":"2024-10-23T00:00:00Z","updated":"2024-10-24T08:32:22Z"},{"id":"wordfence:6d50b1c0-9687-4ce2-bfba-c2d6a2fc28dd","source":"wordfence","cve":"CVE-2024-13334","title":"Car Demon <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d50b1c0-9687-4ce2-bfba-c2d6a2fc28dd?source=api-prod","affected":[{"type":"plugin","slug":"car-demon","name":"Car Demon","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T15:11:00Z","updated":"2025-01-15T03:22:29Z"},{"id":"wordfence:6d50b3dd-2c4b-428b-9d82-f8cc65d6ba1f","source":"wordfence","cve":"CVE-2026-96537","title":"Tutor LMS <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d50b3dd-2c4b-428b-9d82-f8cc65d6ba1f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:03:12Z"},{"id":"wordfence:6d5264a1-dabf-4630-9871-ab6e14817768","source":"wordfence","cve":"CVE-2026-15782","title":"WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"2.0.0.1","to_inclusive":true,"patched_in":"2.0.0.2"}],"published":"2026-07-20T16:53:08Z","updated":"2026-07-21T05:35:28Z"},{"id":"wordfence:6d53cd00-3d7b-4096-bc25-354fd4020f8b","source":"wordfence","cve":"CVE-2024-34549","title":"WP Job Manager <= 2.2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d53cd00-3d7b-4096-bc25-354fd4020f8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:48:28Z"},{"id":"wordfence:6d53de57-13eb-4f27-8dff-1a7027e31edc","source":"wordfence","cve":"CVE-2025-53294","title":"Smart Agenda <= 4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d53de57-13eb-4f27-8dff-1a7027e31edc?source=api-prod","affected":[{"type":"plugin","slug":"smart-agenda-prise-de-rendez-vous-en-ligne","name":"SmartAgenda \u2013 Prise de rendez-vous en ligne","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:40:24Z"},{"id":"wordfence:6d564606-695e-4e8c-90de-1d55afc06103","source":"wordfence","cve":"CVE-2021-24310","title":"Photo Gallery <= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery Title","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d564606-695e-4e8c-90de-1d55afc06103?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.67","to_inclusive":false,"patched_in":"1.5.67"}],"published":"2021-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d571dcc-74a4-4380-8961-890f10443b80","source":"wordfence","cve":"CVE-2022-47606","title":"WP-CORS <= 0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d571dcc-74a4-4380-8961-890f10443b80?source=api-prod","affected":[{"type":"plugin","slug":"wp-cors","name":"WP-CORS","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":"0.2.2"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d58355d-2762-4ecc-aec2-52a1e3323017","source":"wordfence","cve":"CVE-2025-1489","title":"WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d58355d-2762-4ecc-aec2-52a1e3323017?source=api-prod","affected":[{"type":"plugin","slug":"wp-appbox","name":"WP-Appbox","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-02-20T21:24:54Z","updated":"2025-02-21T11:09:34Z"},{"id":"wordfence:6d5889f0-5e92-4be3-b0fd-ad43311e79b6","source":"wordfence","cve":"CVE-2025-30842","title":"Christmas Panda <= 1.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5889f0-5e92-4be3-b0fd-ad43311e79b6?source=api-prod","affected":[{"type":"plugin","slug":"christmas-panda","name":"Christmas Panda","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:38:31Z"},{"id":"wordfence:6d5c0c26-01c2-48cc-9e60-30ffd2b6b6e5","source":"wordfence","cve":"CVE-2026-78277","title":"FluentCRM PRO <= 3.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5c0c26-01c2-48cc-9e60-30ffd2b6b6e5?source=api-prod","affected":[{"type":"plugin","slug":"fluentcampaign-pro","name":"FluentCRM PRO","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-08-24T10:08:00Z","updated":"2026-09-10T19:16:14Z"},{"id":"wordfence:6d5c17cb-98a9-45f0-b94f-02b48193949f","source":"wordfence","cve":"CVE-2020-23762","title":"Larsens Calender <= 1.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5c17cb-98a9-45f0-b94f-02b48193949f?source=api-prod","affected":[{"type":"plugin","slug":"larsens-calender","name":"Larsens Calender","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d5d6e10-a90d-4dfa-b4c8-776a0ff163c9","source":"wordfence","cve":"CVE-2026-80069","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.49 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5d6e10-a90d-4dfa-b4c8-776a0ff163c9?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T22:18:00Z"},{"id":"wordfence:6d5e640d-7ab9-4aea-a6a2-138cbbe0dbcc","source":"wordfence","cve":"CVE-2026-57728","title":"Flatsome <= 3.20.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5e640d-7ab9-4aea-a6a2-138cbbe0dbcc?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:41:16Z"},{"id":"wordfence:6d5ef392-6aea-4fab-95ce-d36d1cd17026","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio < 3.1.0 - Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5ef392-6aea-4fab-95ce-d36d1cd17026?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d5f0ec1-abcb-4aa2-a130-53682fa13f00","source":"wordfence","cve":"CVE-2026-92820","title":"Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5f0ec1-abcb-4aa2-a130-53682fa13f00?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.34","to_inclusive":true,"patched_in":"3.3.35"}],"published":"2026-10-01T16:54:50Z","updated":"2026-10-02T05:30:16Z"},{"id":"wordfence:6d5f3b7e-b36f-47a5-9e24-2e9bc17f6cc7","source":"wordfence","cve":"CVE-2025-8360","title":"LA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5f3b7e-b36f-47a5-9e24-2e9bc17f6cc7?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.5.1","to_inclusive":true,"patched_in":"1.5.5.2"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T02:24:17Z"},{"id":"wordfence:6d63e898-43e5-42b5-96b6-1453352e0cae","source":"wordfence","cve":"CVE-2024-4874","title":"Bricks Builder <= 1.9.8 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d63e898-43e5-42b5-96b6-1453352e0cae?source=api-prod","affected":[{"type":"plugin","slug":"bricksbuilder","name":"Bricks Builder","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2024-06-21T15:59:39Z","updated":"2024-06-22T04:32:03Z"},{"id":"wordfence:6d643d07-7533-430b-a1d8-8e66a2a2c5e6","source":"wordfence","cve":"CVE-2022-2943","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d643d07-7533-430b-a1d8-8e66a2a2c5e6?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d6606bb-b024-4f2d-8f1b-726965e7fb27","source":"wordfence","cve":"CVE-2026-15205","title":"Paymob for WooCommerce <= 4.1.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d6606bb-b024-4f2d-8f1b-726965e7fb27?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T21:26:11Z"},{"id":"wordfence:6d6eacb3-6a0f-4bea-8da6-7d1b28ca47c0","source":"wordfence","cve":"CVE-2026-85678","title":"AI Builder \u2013 Generate pages, blocks, images & translate with AI 2.4.1 - 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d6eacb3-6a0f-4bea-8da6-7d1b28ca47c0?source=api-prod","affected":[{"type":"plugin","slug":"ai-builder","name":"AI Builder \u2013 Generate pages, blocks, images & translate with AI","from":"2.4.1","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:13:11Z"},{"id":"wordfence:6d700580-1374-4a17-a6b3-59ba1d063030","source":"wordfence","cve":"","title":"WordPress Download Manager < 3.1.23 -  Arbitrary Asset Manager Usage","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d700580-1374-4a17-a6b3-59ba1d063030?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.23","to_inclusive":false,"patched_in":"3.1.23"}],"published":"2021-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d71af67-72e2-4fe0-b6a2-de9e9107cfad","source":"wordfence","cve":"CVE-2026-40802","title":"Pubjet <= 5.4.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d71af67-72e2-4fe0-b6a2-de9e9107cfad?source=api-prod","affected":[{"type":"plugin","slug":"pubjet","name":"Pubjet | \u067e\u0627\u0628\u200c\u062c\u062a","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T16:25:06Z"},{"id":"wordfence:6d780de5-d333-4af9-b9d8-0d6c8254dd05","source":"wordfence","cve":"CVE-2026-19802","title":"Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d780de5-d333-4af9-b9d8-0d6c8254dd05?source=api-prod","affected":[{"type":"plugin","slug":"checkout-custom-fields-builder-for-woocommerce","name":"Checkout Custom Fields Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-09-08T18:37:40Z","updated":"2026-09-09T06:40:41Z"},{"id":"wordfence:6d795763-1c26-4ad8-b4b5-d9c051f064fb","source":"wordfence","cve":"CVE-2026-109369","title":"WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse","severity":"medium","cvss":6.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d795763-1c26-4ad8-b4b5-d9c051f064fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.3","to_inclusive":true,"patched_in":"2.1.0.4"}],"published":"2026-10-16T14:39:08Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:6d797f36-f485-4049-83f0-01d0cb409a92","source":"wordfence","cve":"CVE-2023-46637","title":"Generate Dummy Posts <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d797f36-f485-4049-83f0-01d0cb409a92?source=api-prod","affected":[{"type":"plugin","slug":"generate-dummy-posts","name":"Generate Dummy Posts","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d79ebec-2a80-4b9a-b6d3-f3e9be30047a","source":"wordfence","cve":"CVE-2021-24581","title":"Blue Admin <= 21.06.01 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d79ebec-2a80-4b9a-b6d3-f3e9be30047a?source=api-prod","affected":[{"type":"plugin","slug":"blue-admin","name":"Blue Admin","from":"*","from_inclusive":true,"to":"21.06.01","to_inclusive":true,"patched_in":""}],"published":"2021-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d7a4f08-1a6a-4bc3-b09c-ad5fc7c5d1a7","source":"wordfence","cve":"CVE-2026-66710","title":"E2Pdf \u2013 Export Pdf Tool for WordPress <= 1.32.40 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7a4f08-1a6a-4bc3-b09c-ad5fc7c5d1a7?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.40","to_inclusive":true,"patched_in":"1.32.43"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:17:00Z"},{"id":"wordfence:6d7a86c2-16cf-4867-9b42-9db54c1c6ba6","source":"wordfence","cve":"CVE-2025-23502","title":"Curated Search <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7a86c2-16cf-4867-9b42-9db54c1c6ba6?source=api-prod","affected":[{"type":"plugin","slug":"curated-search","name":"Curated Search","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:00:56Z"},{"id":"wordfence:6d7bd36a-ee41-4121-85b8-f234fd7e5c6e","source":"wordfence","cve":"CVE-2025-10737","title":"Open Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7bd36a-ee41-4121-85b8-f234fd7e5c6e?source=api-prod","affected":[{"type":"theme","slug":"genesis","name":"Open Source Genesis Framework","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T05:31:21Z"},{"id":"wordfence:6d7c8f79-4dfd-4d6f-b533-dc7a5998dfc1","source":"wordfence","cve":"CVE-2025-12040","title":"Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7c8f79-4dfd-4d6f-b533-dc7a5998dfc1?source=api-prod","affected":[{"type":"plugin","slug":"th-wishlist","name":"Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-11-24T19:15:50Z","updated":"2025-12-01T15:28:54Z"},{"id":"wordfence:6d7f9291-5a57-4aca-b18f-623bf07348a4","source":"wordfence","cve":"CVE-2021-24991","title":"WooCommerce PDF Invoices & Packing Slips <= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d7f9291-5a57-4aca-b18f-623bf07348a4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":false,"patched_in":"2.10.5"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d833338-a343-446f-a3f1-cb5e2cff6585","source":"wordfence","cve":"CVE-2024-11337","title":"Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d833338-a343-446f-a3f1-cb5e2cff6585?source=api-prod","affected":[{"type":"plugin","slug":"horoscope-and-tarot","name":"Divine Astro","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-01-06T15:46:01Z","updated":"2025-01-10T13:58:34Z"},{"id":"wordfence:6d835d4c-0291-4f47-843c-e960f1e3676a","source":"wordfence","cve":"CVE-2025-23450","title":"AW WooCommerce Kode Pembayaran <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d835d4c-0291-4f47-843c-e960f1e3676a?source=api-prod","affected":[{"type":"plugin","slug":"aw-woocommerce-kode-pembayaran","name":"AW WooCommerce Kode Pembayaran","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:42:15Z"},{"id":"wordfence:6d849f5a-f013-4b1d-b606-c7efefdfaca5","source":"wordfence","cve":"CVE-2025-0613","title":"Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d849f5a-f013-4b1d-b606-c7efefdfaca5?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.33","to_inclusive":true,"patched_in":"1.8.34"}],"published":"2025-03-10T00:00:00Z","updated":"2025-04-09T14:05:58Z"},{"id":"wordfence:6d84fa60-f780-41e2-96dc-57057c646e01","source":"wordfence","cve":"CVE-2023-23787","title":"Premmerce Redirect Manager <= 1.0.10 - Cross-Site Request Forgery via deleteRedirect()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d84fa60-f780-41e2-96dc-57057c646e01?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-redirect-manager","name":"Premmerce Redirect Manager","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d87187a-0b60-45a1-adcc-301c76928c40","source":"wordfence","cve":"CVE-2026-28191","title":"The Grid <= 2.8.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d87187a-0b60-45a1-adcc-301c76928c40?source=api-prod","affected":[{"type":"plugin","slug":"the-grid","name":"The Grid","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-08-13T00:00:00Z","updated":"2026-10-27T15:17:54Z"},{"id":"wordfence:6d872144-f028-49fa-beac-e315fdea39df","source":"wordfence","cve":"CVE-2025-23480","title":"RSVP ME <= 1.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d872144-f028-49fa-beac-e315fdea39df?source=api-prod","affected":[{"type":"plugin","slug":"rsvp-me","name":"RSVP ME","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:51:23Z"},{"id":"wordfence:6d875c23-3d8a-4f82-bea3-1c46b5045d94","source":"wordfence","cve":"CVE-2025-3761","title":"My Tickets \u2013 Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d875c23-3d8a-4f82-bea3-1c46b5045d94?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2025-04-23T18:25:36Z","updated":"2025-04-24T06:57:08Z"},{"id":"wordfence:6d881f00-5985-45d5-9aab-d143a010d739","source":"wordfence","cve":"CVE-2026-2001","title":"WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d881f00-5985-45d5-9aab-d143a010d739?source=api-prod","affected":[{"type":"plugin","slug":"revenue","name":"WowRevenue \u2013 Product Bundles & Bulk Discounts","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-02-16T07:19:57Z","updated":"2026-02-16T19:24:03Z"},{"id":"wordfence:6d88433a-dff4-4524-9b1a-1ef929568a52","source":"wordfence","cve":"CVE-2021-24187","title":"SEO Redirection Plugin - 301 Redirect Manager <= 6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d88433a-dff4-4524-9b1a-1ef929568a52?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d8916c7-0270-4159-8072-49b1d75a579e","source":"wordfence","cve":"CVE-2024-50487","title":"MaanStore API <= 1.0.1 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8916c7-0270-4159-8072-49b1d75a579e?source=api-prod","affected":[{"type":"plugin","slug":"maanstore-api","name":"MaanStore API","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:27:30Z"},{"id":"wordfence:6d8a5268-03a2-48c6-9c59-840a11e7a34f","source":"wordfence","cve":"CVE-2026-4298","title":"DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8a5268-03a2-48c6-9c59-840a11e7a34f?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2026-07-08T20:46:28Z","updated":"2026-07-09T09:31:21Z"},{"id":"wordfence:6d8b2ec1-a76b-42df-8540-4aecaa35efd3","source":"wordfence","cve":"CVE-2025-8618","title":"WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8b2ec1-a76b-42df-8540-4aecaa35efd3?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-quick-view","name":"WPC Smart Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-08-19T16:23:59Z","updated":"2025-08-20T04:26:21Z"},{"id":"wordfence:6d8b57de-d02c-40c0-abdb-ff490bcf429e","source":"wordfence","cve":"CVE-2025-10055","title":"Time Sheets <= 2.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8b57de-d02c-40c0-abdb-ff490bcf429e?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:30:04Z","updated":"2026-10-26T05:36:55Z"},{"id":"wordfence:6d8c0198-0109-4e5d-af62-bb2c4b994840","source":"wordfence","cve":"CVE-2026-84836","title":"SmartyParcel \u2013 Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce <= 1.23.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8c0198-0109-4e5d-af62-bb2c4b994840?source=api-prod","affected":[{"type":"plugin","slug":"wc-ukr-shipping","name":"SmartyParcel Shipping \u2013 DHL Express, GLS, InPost & Nova Post for WooCommerce","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":"1.23.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-10-13T16:59:56Z"},{"id":"wordfence:6d8f0424-41a5-415a-b2c8-f14b612dd591","source":"wordfence","cve":"CVE-2026-9702","title":"InPost PL <= 1.9.0 - Missing Authorization to Unauthenticated WooCommerce Order Parcel-Locker Hijacking","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8f0424-41a5-415a-b2c8-f14b612dd591?source=api-prod","affected":[{"type":"plugin","slug":"inpost-for-woocommerce","name":"InPost PL","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2026-06-04T00:00:00Z","updated":"2026-08-21T14:01:13Z"},{"id":"wordfence:6d8f59b0-da92-43aa-990d-5271aa40d6b4","source":"wordfence","cve":"CVE-2023-2580","title":"AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable <= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8f59b0-da92-43aa-990d-5271aa40d6b4?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"1.6.83","to_inclusive":false,"patched_in":"1.6.83"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d8f7252-5e91-4e42-a6a5-056da491b4f1","source":"wordfence","cve":"CVE-2022-3762","title":"Booster (<= 5.6.6) and Booster Plus (<= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8f7252-5e91-4e42-a6a5-056da491b4f1?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d903981-bc2f-4bf3-8e8c-1c407936c8e3","source":"wordfence","cve":"CVE-2025-24766","title":"News Magazine X <= 1.2.37 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d903981-bc2f-4bf3-8e8c-1c407936c8e3?source=api-prod","affected":[{"type":"theme","slug":"news-magazine-x","name":"News Magazine X","from":"*","from_inclusive":true,"to":"1.2.37","to_inclusive":true,"patched_in":"1.2.38"}],"published":"2025-07-28T00:00:00Z","updated":"2025-09-15T19:53:36Z"},{"id":"wordfence:6d923bbe-5976-43c5-a34d-d2758c83f607","source":"wordfence","cve":"CVE-2024-37453","title":"ProfileGrid  <= 5.8.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d923bbe-5976-43c5-a34d-d2758c83f607?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"5.8.8"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:09:56Z"},{"id":"wordfence:6d92cc7e-2946-45de-b245-2a12c9b567fd","source":"wordfence","cve":"CVE-2026-107321","title":"W3 Total Cache <= 2.10.5 - Authenticated (Author+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d92cc7e-2946-45de-b245-2a12c9b567fd?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:58:47Z"},{"id":"wordfence:6d93ce6c-0139-472c-a5ec-21fdf33cd898","source":"wordfence","cve":"","title":"Titan Anti-spam & Security <= 4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d93ce6c-0139-472c-a5ec-21fdf33cd898?source=api-prod","affected":[{"type":"plugin","slug":"anti-spam","name":"Titan Anti-spam & Security \u2013 Brute Force Protection, 2FA & Spam Filter","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2016-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d9431b3-d37e-4d19-b07d-d5357affe346","source":"wordfence","cve":"CVE-2022-4392","title":"iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9431b3-d37e-4d19-b07d-d5357affe346?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.6.29","to_inclusive":true,"patched_in":"1.6.30"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d94e180-8f28-453e-a01a-bfd7b6ba1cb5","source":"wordfence","cve":"CVE-2026-27380","title":"Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d94e180-8f28-453e-a01a-bfd7b6ba1cb5?source=api-prod","affected":[{"type":"plugin","slug":"car-rental-manager","name":"Car Rental Manager \u2013 Online Vehicle Booking System","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T21:46:20Z"},{"id":"wordfence:6d96f6ef-9366-41b8-9420-fbddf270209a","source":"wordfence","cve":"CVE-2026-66678","title":"Advanced Custom Fields: Font Awesome Field <= 6.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d96f6ef-9366-41b8-9420-fbddf270209a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-font-awesome","name":"Advanced Custom Fields: Font Awesome Field","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:59:36Z"},{"id":"wordfence:6d9734bd-54de-44ab-b369-7a9d9a9e0e29","source":"wordfence","cve":"CVE-2026-79706","title":"Breeze Cache < 2.5.13 - Unauthenticated File Creation via Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9734bd-54de-44ab-b369-7a9d9a9e0e29?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.5.13","to_inclusive":false,"patched_in":"2.5.13"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:51:31Z"},{"id":"wordfence:6d984c59-77ff-4283-ac79-910885e46443","source":"wordfence","cve":"CVE-2026-62061","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 6.0.0.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d984c59-77ff-4283-ac79-910885e46443?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"6.0.0.2","to_inclusive":true,"patched_in":"6.0.0.3"}],"published":"2026-10-01T12:38:00Z","updated":"2026-10-08T23:52:45Z"},{"id":"wordfence:6d9a3ad3-90fa-46bc-b42a-7616c02a8b50","source":"wordfence","cve":"CVE-2016-10914","title":"Add From Server <= 3.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9a3ad3-90fa-46bc-b42a-7616c02a8b50?source=api-prod","affected":[{"type":"plugin","slug":"add-from-server","name":"Add From Server","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2016-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6d9ac056-860b-4b5a-849a-004deab5aeb3","source":"wordfence","cve":"CVE-2026-97262","title":"Visual Composer Website Builder <= 45.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9ac056-860b-4b5a-849a-004deab5aeb3?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.16.2","to_inclusive":true,"patched_in":"45.16.3"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:43:04Z"},{"id":"wordfence:6d9b4448-2b63-4704-ac9e-c4db4784638c","source":"wordfence","cve":"CVE-2026-12757","title":"Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9b4448-2b63-4704-ac9e-c4db4784638c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.27","to_inclusive":true,"patched_in":"5.9.28"}],"published":"2026-09-07T00:30:20Z","updated":"2026-09-07T13:28:29Z"},{"id":"wordfence:6d9eb54f-4ff2-49d6-94d7-73aa75edb97b","source":"wordfence","cve":"CVE-2024-31113","title":"Easy Digital Downloads <= 3.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9eb54f-4ff2-49d6-94d7-73aa75edb97b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-16T12:53:04Z"},{"id":"wordfence:6d9f5901-dc11-4877-b753-deb9c03f4a4e","source":"wordfence","cve":"CVE-2024-37420","title":"Zita Elementor Site Library <= 1.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9f5901-dc11-4877-b753-deb9c03f4a4e?source=api-prod","affected":[{"type":"plugin","slug":"zita-site-library","name":"Zita Site Library for Elementor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:18:25Z"},{"id":"wordfence:6d9fb74d-58fd-4881-970d-86944c8784c4","source":"wordfence","cve":"CVE-2021-24547","title":"KN Fix Your Title <= 1.0.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d9fb74d-58fd-4881-970d-86944c8784c4?source=api-prod","affected":[{"type":"plugin","slug":"kn-fix-your","name":"KN Fix Your Title","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6da00adc-8fc0-4d8f-9ff3-8c21223199f4","source":"wordfence","cve":"CVE-2023-45764","title":"Scroll post excerpt <= 8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6da00adc-8fc0-4d8f-9ff3-8c21223199f4?source=api-prod","affected":[{"type":"plugin","slug":"scroll-post-excerpt","name":"Scroll post excerpt","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6da0a85d-0c6f-40ae-8a3d-85222f0e7cc5","source":"wordfence","cve":"","title":"Ivory Search \u2013 WordPress Search Plugin <= 4.5.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6da0a85d-0c6f-40ae-8a3d-85222f0e7cc5?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"4.5.10","to_inclusive":true,"patched_in":"4.5.11"}],"published":"2021-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6da7046e-2717-4a3c-bba9-88f27de29ede","source":"wordfence","cve":"CVE-2022-3366","title":"PublishPress Capabilities <= 2.5.1 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6da7046e-2717-4a3c-bba9-88f27de29ede?source=api-prod","affected":[{"type":"plugin","slug":"capabilities-pro","name":"PublishPress Capabilities Pro","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"},{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6da9514c-a101-4f32-9a2f-697ca9ee1b26","source":"wordfence","cve":"CVE-2025-68909","title":"Blogistic <= 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6da9514c-a101-4f32-9a2f-697ca9ee1b26?source=api-prod","affected":[{"type":"theme","slug":"blogistic","name":"Blogistic","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:06:41Z"},{"id":"wordfence:6dac6353-9e70-482d-b54b-ffde661b212c","source":"wordfence","cve":"CVE-2022-4676","title":"OSM - OpenStreetMap <= 6.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dac6353-9e70-482d-b54b-ffde661b212c?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2023-05-03T00:00:00Z","updated":"2024-09-24T17:38:41Z"},{"id":"wordfence:6dadad7d-0ea9-4ac0-8d22-0acaa3fb5881","source":"wordfence","cve":"CVE-2026-25396","title":"Coinbase Commerce \u2013 Crypto Gateway for WooCommerce < 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dadad7d-0ea9-4ac0-8d22-0acaa3fb5881?source=api-prod","affected":[{"type":"plugin","slug":"commerce-coinbase-for-woocommerce","name":"Coinbase Business Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-10-28T21:11:15Z"},{"id":"wordfence:6dafc81c-f1be-422d-b34f-87f1956e8849","source":"wordfence","cve":"CVE-2023-4728","title":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026 <= 4.4 - Missing Authorization on publish_lp()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dafc81c-f1be-422d-b34f-87f1956e8849?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:55Z"},{"id":"wordfence:6db022e7-d0a7-4c32-87b4-7d9a87c4542d","source":"wordfence","cve":"CVE-2025-23926","title":"Ajax WP Query Search Filter <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db022e7-d0a7-4c32-87b4-7d9a87c4542d?source=api-prod","affected":[{"type":"plugin","slug":"ajax-wp-query-search-filter","name":"Ajax WP Query Search Filter","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:01:36Z"},{"id":"wordfence:6db025c6-a877-42fb-8f19-484472568e75","source":"wordfence","cve":"CVE-2026-45440","title":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db025c6-a877-42fb-8f19-484472568e75?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T17:03:03Z"},{"id":"wordfence:6db51b8e-2e4b-4041-b261-d46cfdb372dc","source":"wordfence","cve":"CVE-2023-7232","title":"Backup and Restore WordPress  WordPress <= 1.45 - Unauthenticated Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db51b8e-2e4b-4041-b261-d46cfdb372dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.45","to_inclusive":true,"patched_in":"1.50"}],"published":"2024-03-05T00:00:00Z","updated":"2026-09-04T00:35:12Z"},{"id":"wordfence:6db5d2f0-598a-4252-b23b-87b1f744d849","source":"wordfence","cve":"CVE-2026-86609","title":"Download Manager Pro <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db5d2f0-598a-4252-b23b-87b1f744d849?source=api-prod","affected":[{"type":"plugin","slug":"downloadmanager","name":"Download Manager","from":"*","from_inclusive":true,"to":"7.5.5","to_inclusive":true,"patched_in":"7.5.6"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:38:04Z"},{"id":"wordfence:6db5f214-ba1a-4528-9bb6-0592822bf8bb","source":"wordfence","cve":"CVE-2024-30458","title":"WOOCS \u2013 WooCommerce Currency Switcher <= 1.4.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db5f214-ba1a-4528-9bb6-0592822bf8bb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1.7","to_inclusive":true,"patched_in":"1.4.1.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:50:13Z"},{"id":"wordfence:6db8742c-b51e-4f86-9ec0-e2166920086f","source":"wordfence","cve":"CVE-2024-51939","title":"Stylish Internal Links <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db8742c-b51e-4f86-9ec0-e2166920086f?source=api-prod","affected":[{"type":"plugin","slug":"stylish-internal-links","name":"Stylish Internal Links","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:10:05Z"},{"id":"wordfence:6db9c59e-16bc-4e61-9040-7000b212675f","source":"wordfence","cve":"CVE-2021-24740","title":"Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6db9c59e-16bc-4e61-9040-7000b212675f?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":false,"patched_in":"1.9.9"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6dba72ee-7c38-4e10-9c0c-35d12aa83442","source":"wordfence","cve":"CVE-2024-11461","title":"Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dba72ee-7c38-4e10-9c0c-35d12aa83442?source=api-prod","affected":[{"type":"plugin","slug":"form-data-collector","name":"Form Data Collector","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T07:34:59Z"},{"id":"wordfence:6dbc64eb-1da6-4086-9fe1-3d9080bef12e","source":"wordfence","cve":"CVE-2024-29139","title":"MyCurator Content Curation <= 3.76 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dbc64eb-1da6-4086-9fe1-3d9080bef12e?source=api-prod","affected":[{"type":"plugin","slug":"mycurator","name":"MyCurator Content Curation","from":"*","from_inclusive":true,"to":"3.76","to_inclusive":true,"patched_in":"3.77"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:53:57Z"},{"id":"wordfence:6dbf9689-c812-4b7c-9df3-c4639aae3357","source":"wordfence","cve":"CVE-2024-13535","title":"Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dbf9689-c812-4b7c-9df3-c4639aae3357?source=api-prod","affected":[{"type":"plugin","slug":"actionwear-products-sync","name":"Actionwear products sync","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-02-17T15:39:37Z","updated":"2025-02-19T21:27:32Z"},{"id":"wordfence:6dc144cd-7119-477f-9fa1-b00cab215077","source":"wordfence","cve":"CVE-2024-1181","title":"Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc144cd-7119-477f-9fa1-b00cab215077?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-wp","name":"Coming Soon, Under Construction & Maintenance Mode By Dazzler","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-28T23:41:24Z"},{"id":"wordfence:6dc25c27-e3a8-4d69-9468-734fef450719","source":"wordfence","cve":"CVE-2026-66693","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.113 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc25c27-e3a8-4d69-9468-734fef450719?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.113","to_inclusive":true,"patched_in":"1.4.114"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:04:45Z"},{"id":"wordfence:6dc2e720-85d9-42d9-94ef-eb172425993d","source":"wordfence","cve":"CVE-2023-3063","title":"SP Project & Document Manager <= 4.67 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc2e720-85d9-42d9-94ef-eb172425993d?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.67","to_inclusive":true,"patched_in":"4.68"}],"published":"2023-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6dc3f308-d1e1-430b-bccd-168c0972fe7c","source":"wordfence","cve":"CVE-2024-7721","title":"HTML5 Video Player \u2013 mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc3f308-d1e1-430b-bccd-168c0972fe7c?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.34","to_inclusive":true,"patched_in":"2.5.35"}],"published":"2024-09-10T15:52:47Z","updated":"2024-09-11T04:31:21Z"},{"id":"wordfence:6dc5b690-2dd9-448f-aff7-94cf216ae60d","source":"wordfence","cve":"CVE-2026-119492","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc5b690-2dd9-448f-aff7-94cf216ae60d?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.71","to_inclusive":true,"patched_in":"3.1.72"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:50:23Z"},{"id":"wordfence:6dc64359-969e-4eb2-8c17-0be680b9808f","source":"wordfence","cve":"CVE-2026-115262","title":"Duplicator Pro < 5.1.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc64359-969e-4eb2-8c17-0be680b9808f?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":false,"patched_in":"5.1.0"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T15:29:25Z"},{"id":"wordfence:6dc69491-0f40-4bab-9215-b25f72110e26","source":"wordfence","cve":"CVE-2025-11889","title":"AIO Forms <= 1.3.18 - Authenticated (Admin+) Arbitrary File Upload via Zip Import","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc69491-0f40-4bab-9215-b25f72110e26?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-forms","name":"AIO Forms \u2013 Craft Complex Forms Easily","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2025-10-23T20:07:43Z","updated":"2025-11-25T19:10:40Z"},{"id":"wordfence:6dc7c5a6-513e-4aa8-9538-0ac6fb37c867","source":"wordfence","cve":"CVE-2025-8620","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc7c5a6-513e-4aa8-9538-0ac6fb37c867?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2025-08-05T00:00:00Z","updated":"2025-11-17T17:41:51Z"},{"id":"wordfence:6dc91513-da96-4a82-9004-58ffddb453d5","source":"wordfence","cve":"CVE-2024-49636","title":"Agile Video Player Lite <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc91513-da96-4a82-9004-58ffddb453d5?source=api-prod","affected":[{"type":"plugin","slug":"agile-video-player","name":"Agile Video Player Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:44:13Z"},{"id":"wordfence:6dc9b4cb-d36b-4693-a7b9-1dad123b6639","source":"wordfence","cve":"CVE-2025-6463","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion","severity":"high","cvss":8.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc9b4cb-d36b-4693-a7b9-1dad123b6639?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.44.2","to_inclusive":true,"patched_in":"1.44.3"}],"published":"2025-07-01T16:22:05Z","updated":"2025-07-02T04:24:57Z"},{"id":"wordfence:6dcb9c17-90dd-4e91-8a5d-c061e80d2f51","source":"wordfence","cve":"CVE-2026-89235","title":"Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dcb9c17-90dd-4e91-8a5d-c061e80d2f51?source=api-prod","affected":[{"type":"plugin","slug":"bws-testimonials","name":"Testimonials by BestWebSoft","from":"1.0.5","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:21:26Z"},{"id":"wordfence:6dd041ff-a0a3-4d1f-83e0-6ec2a978e9cf","source":"wordfence","cve":"CVE-2026-6080","title":"Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd041ff-a0a3-4d1f-83e0-6ec2a978e9cf?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-04-16T15:15:35Z","updated":"2026-04-17T03:36:44Z"},{"id":"wordfence:6dd14860-2cf5-45ec-a1d6-69e43ecdb3be","source":"wordfence","cve":"CVE-2026-16758","title":"Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd14860-2cf5-45ec-a1d6-69e43ecdb3be?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-variables","name":"Snippet Shortcodes","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2026-08-15T16:28:24Z","updated":"2026-08-16T05:27:29Z"},{"id":"wordfence:6dd2b375-546c-45bf-b4f0-55b73152a6ad","source":"wordfence","cve":"CVE-2026-27089","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd2b375-546c-45bf-b4f0-55b73152a6ad?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:04:24Z"},{"id":"wordfence:6dd56a7f-1f33-44c2-a49a-9bdc88c081a9","source":"wordfence","cve":"CVE-2025-69051","title":"ListingPro Reviews < 2.9.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd56a7f-1f33-44c2-a49a-9bdc88c081a9?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-reviews","name":"ListingPro Reviews","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":false,"patched_in":"2.9.11"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-25T14:39:57Z"},{"id":"wordfence:6dd5a799-9df8-4d58-b972-8ec7153a0e65","source":"wordfence","cve":"CVE-2026-94672","title":"Safe SVG <= 2.5.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd5a799-9df8-4d58-b972-8ec7153a0e65?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:42:42Z"},{"id":"wordfence:6dd6169b-bc94-4642-8975-2e96bc01576f","source":"wordfence","cve":"CVE-2025-2798","title":"Woffice <= 5.4.21 - Authentication Bypass via Registration Role","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd6169b-bc94-4642-8975-2e96bc01576f?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.21","to_inclusive":true,"patched_in":"5.4.22"}],"published":"2025-04-03T00:00:00Z","updated":"2025-06-09T19:28:23Z"},{"id":"wordfence:6dd6e04c-bac4-49c3-a934-7d3f43767684","source":"wordfence","cve":"","title":"Konzept (Unknown Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd6e04c-bac4-49c3-a934-7d3f43767684?source=api-prod","affected":[{"type":"theme","slug":"konzept","name":"Konzept - Fullscreen Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6dd8a804-a2bf-430a-8cd5-90e797ddba21","source":"wordfence","cve":"CVE-2025-30783","title":"WP Google Review Slider <= 16.0 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd8a804-a2bf-430a-8cd5-90e797ddba21?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"16.0","to_inclusive":true,"patched_in":"16.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:21:19Z"},{"id":"wordfence:6dda19a3-277e-49e6-b6fb-c4dd2df4aa38","source":"wordfence","cve":"CVE-2025-30859","title":"AliNext <= 3.5.1 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dda19a3-277e-49e6-b6fb-c4dd2df4aa38?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:52:20Z"},{"id":"wordfence:6ddab986-c017-475a-ad92-fa4221d6068c","source":"wordfence","cve":"CVE-2024-50432","title":"Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddab986-c017-475a-ad92-fa4221d6068c?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.93","to_inclusive":true,"patched_in":"2.2.94"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:45:59Z"},{"id":"wordfence:6ddd512e-efc6-444d-9c73-f07571992801","source":"wordfence","cve":"CVE-2026-84028","title":"Bold Page Builder < 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddd512e-efc6-444d-9c73-f07571992801?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":false,"patched_in":"5.9.9"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-09T13:17:42Z"},{"id":"wordfence:6ddf0452-3afe-4ada-bccc-30c818968a81","source":"wordfence","cve":"CVE-2023-4213","title":"Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddf0452-3afe-4ada-bccc-30c818968a81?source=api-prod","affected":[{"type":"plugin","slug":"simplr-registration-form","name":"Simplr Registration Form Plus+","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ddf6da6-ec71-4206-8798-2c0c751b3209","source":"wordfence","cve":"CVE-2026-12471","title":"Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddf6da6-ec71-4206-8798-2c0c751b3209?source=api-prod","affected":[{"type":"theme","slug":"spexo","name":"Spexo","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-06-26T17:49:02Z","updated":"2026-06-27T06:50:57Z"},{"id":"wordfence:6de3cbb4-61ac-443e-b7cf-5a2bfea25c56","source":"wordfence","cve":"CVE-2024-49610","title":"photokit <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de3cbb4-61ac-443e-b7cf-5a2bfea25c56?source=api-prod","affected":[{"type":"plugin","slug":"photokit","name":"photokit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T17:03:56Z"},{"id":"wordfence:6de3dfaa-4bf8-49a3-8409-7ef2d37a38cd","source":"wordfence","cve":"CVE-2025-31882","title":"WebinarPress <= 1.33.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de3dfaa-4bf8-49a3-8409-7ef2d37a38cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.27","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:54:09Z"},{"id":"wordfence:6de4c2bb-a9dd-4de5-89ef-0ed8fde2514c","source":"wordfence","cve":"CVE-2025-58194","title":"Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de4c2bb-a9dd-4de5-89ef-0ed8fde2514c?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:03:45Z"},{"id":"wordfence:6de64a12-0f73-40e9-bcd1-963dc6499ec4","source":"wordfence","cve":"CVE-2024-12072","title":"Analytics Cat \u2013 Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de64a12-0f73-40e9-bcd1-963dc6499ec4?source=api-prod","affected":[{"type":"plugin","slug":"analytics-cat","name":"Analytics Cat \u2013 Google Analytics Made Easy","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-12-11T00:00:00Z","updated":"2025-02-26T21:28:43Z"},{"id":"wordfence:6de6e95b-3ea3-4078-96cc-687d4f1191e8","source":"wordfence","cve":"CVE-2025-32154","title":"Catch Dark Mode <= 2.0.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de6e95b-3ea3-4078-96cc-687d4f1191e8?source=api-prod","affected":[{"type":"plugin","slug":"catch-dark-mode","name":"Catch Dark Mode","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-04-04T00:00:00Z","updated":"2026-01-07T14:38:18Z"},{"id":"wordfence:6de73c31-a58d-41d9-aaed-2d7853ad1f25","source":"wordfence","cve":"CVE-2022-3246","title":"Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de73c31-a58d-41d9-aaed-2d7853ad1f25?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"6.9.10"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6de76b80-fa9d-460e-9e3b-dd8de58f558b","source":"wordfence","cve":"CVE-2026-115600","title":"Restrict User Access \u2013 Ultimate Membership & Content Protection <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de76b80-fa9d-460e-9e3b-dd8de58f558b?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:36Z"},{"id":"wordfence:6de8a608-8715-4f9c-9f2f-df60dd1cc579","source":"wordfence","cve":"CVE-2024-11917","title":"JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6de8a608-8715-4f9c-9f2f-df60dd1cc579?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-06-17T18:07:28Z"},{"id":"wordfence:6dea5fd0-4996-4cd2-9775-7008b92c7224","source":"wordfence","cve":"CVE-2025-31090","title":"Dropdown Multisite selector < 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dea5fd0-4996-4cd2-9775-7008b92c7224?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-multisite-selector","name":"Dropdown Multisite Selector","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":false,"patched_in":"0.9.4"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:32:58Z"},{"id":"wordfence:6ded39db-90d7-4818-afa0-697ffe3bf1db","source":"wordfence","cve":"CVE-2025-31047","title":"Themify Edmin <= 2.0.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ded39db-90d7-4818-afa0-697ffe3bf1db?source=api-prod","affected":[{"type":"theme","slug":"edmin","name":"edmin","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:57:02Z"},{"id":"wordfence:6deebf9a-6a28-4fb7-8f97-f40bf5e228aa","source":"wordfence","cve":"CVE-2025-23727","title":"AZ Content Finder <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6deebf9a-6a28-4fb7-8f97-f40bf5e228aa?source=api-prod","affected":[{"type":"plugin","slug":"az-content-finder","name":"AZ Content Finder","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-02-17T16:52:52Z"},{"id":"wordfence:6def0fd7-4b48-4c2c-935a-f76290bc01e0","source":"wordfence","cve":"CVE-2026-61956","title":"sync-basalam <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6def0fd7-4b48-4c2c-935a-f76290bc01e0?source=api-prod","affected":[{"type":"plugin","slug":"sync-basalam","name":"\u0648\u0648\u0633\u0644\u0627\u0645 \u2013 \u0647\u0645\u06af\u0627\u0645 \u0633\u0627\u0632\u06cc \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0648 \u0628\u0627\u0633\u0644\u0627\u0645","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-07-12T00:00:00Z","updated":"2026-07-14T19:16:46Z"},{"id":"wordfence:6defd072-0203-471a-96cf-579a9eebcd9f","source":"wordfence","cve":"CVE-2024-30484","title":"RT Easy Builder \u2013 Advanced addons for Elementor <= 2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6defd072-0203-471a-96cf-579a9eebcd9f?source=api-prod","affected":[{"type":"plugin","slug":"rt-easy-builder-advanced-addons-for-elementor","name":"RT Easy Builder \u2013 Advanced addons for Elementor","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:27:45Z"},{"id":"wordfence:6df29b14-0c9d-4ecf-96be-8c39c93121e2","source":"wordfence","cve":"CVE-2024-8493","title":"The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6df29b14-0c9d-4ecf-96be-8c39c93121e2?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"6.6.4"}],"published":"2024-07-31T00:00:00Z","updated":"2024-10-11T17:08:32Z"},{"id":"wordfence:6df68d66-7294-4dff-8ba8-394932a64281","source":"wordfence","cve":"CVE-2023-47228","title":"Layer Slider <= 1.1.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6df68d66-7294-4dff-8ba8-394932a64281?source=api-prod","affected":[{"type":"plugin","slug":"slider-slideshow","name":"Layer Slider","from":"*","from_inclusive":true,"to":"1.1.9.7","to_inclusive":true,"patched_in":""}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6df7b3ed-a1e3-4df9-828e-95530661e27a","source":"wordfence","cve":"CVE-2026-104745","title":"Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7b3ed-a1e3-4df9-828e-95530661e27a?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-10-15T15:31:05Z","updated":"2026-10-16T03:38:41Z"},{"id":"wordfence:6df7bd57-7d2f-4098-b2d0-ffb2e8ed5868","source":"wordfence","cve":"CVE-2023-2143","title":"Enable SVG, WebP & ICO Upload <= 1.1.1 - Authenticated  (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6df7bd57-7d2f-4098-b2d0-ffb2e8ed5868?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-06-23T00:00:00Z","updated":"2024-11-21T14:40:25Z"},{"id":"wordfence:6dfa9533-3f3e-4a34-bcd6-4a1395983be0","source":"wordfence","cve":"CVE-2025-15690","title":"Content Mask 1.7.1 - 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dfa9533-3f3e-4a34-bcd6-4a1395983be0?source=api-prod","affected":[{"type":"plugin","slug":"content-mask","name":"Content Mask","from":"1.7.1","from_inclusive":true,"to":"1.8.5.5","to_inclusive":true,"patched_in":"1.8.5.6"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:24:22Z"},{"id":"wordfence:6dfcd264-39e3-44af-8e0e-5c35734524d0","source":"wordfence","cve":"CVE-2025-14293","title":"WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dfcd264-39e3-44af-8e0e-5c35734524d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-12-11T06:34:28Z","updated":"2026-02-14T06:40:03Z"},{"id":"wordfence:6dfe91d5-305b-414a-bbed-23c089be6176","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin <= 4.0.50 - Stored Cross-Site Scripting via Media Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6dfe91d5-305b-414a-bbed-23c089be6176?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"4.0.50","to_inclusive":true,"patched_in":""}],"published":"2022-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e00b187-9a28-45fb-8d4d-e9401d739486","source":"wordfence","cve":"CVE-2022-0641","title":"Popup Like box <= 3.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e00b187-9a28-45fb-8d4d-e9401d739486?source=api-prod","affected":[{"type":"plugin","slug":"ays-facebook-popup-likebox","name":"Popup Like box \u2013 Page Plugin","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":false,"patched_in":"3.6.1"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e01ae00-0d07-4e9a-928e-e10cf679df2e","source":"wordfence","cve":"CVE-2025-1526","title":"DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e01ae00-0d07-4e9a-928e-e10cf679df2e?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T07:23:22Z"},{"id":"wordfence:6e02d105-0f1e-479e-a537-7a7fdbbd7804","source":"wordfence","cve":"CVE-2025-12588","title":"USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=api-prod","affected":[{"type":"plugin","slug":"usb-qr-code-scanner-for-woocommerce","name":"USB Qr Code Scanner For Woocommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:24:19Z","updated":"2025-11-11T03:30:41Z"},{"id":"wordfence:6e02d123-701f-4502-ae6b-b313f39b3670","source":"wordfence","cve":"CVE-2025-23466","title":"Site Editor Google Map <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d123-701f-4502-ae6b-b313f39b3670?source=api-prod","affected":[{"type":"plugin","slug":"site-editor-google-map","name":"Site Editor Google Map \u2013 with drag and drop","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:04:41Z"},{"id":"wordfence:6e02e94f-e0f4-4a6a-9670-702b2d0a78c1","source":"wordfence","cve":"CVE-2025-13438","title":"Page Title, Description & Open Graph Updater <= 1.02 - Cross-Site Request Forgery to Arbitrary Page Title Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02e94f-e0f4-4a6a-9670-702b2d0a78c1?source=api-prod","affected":[{"type":"plugin","slug":"page-title-description-open-graph-updater","name":"Page Title, Description & Open Graph Updater","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:38:26Z","updated":"2026-02-19T04:36:14Z"},{"id":"wordfence:6e031c1d-14c9-4e5d-8881-2f02ee321efe","source":"wordfence","cve":"CVE-2025-54751","title":"PostX <= 4.1.36 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e031c1d-14c9-4e5d-8881-2f02ee321efe?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"4.1.37"}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T22:05:22Z"},{"id":"wordfence:6e0384c0-9b34-4af8-af86-75ef1e8d933b","source":"wordfence","cve":"CVE-2021-24299","title":"ReDi Restaurant Reservation <= 21.0307 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0384c0-9b34-4af8-af86-75ef1e8d933b?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"21.0307","to_inclusive":true,"patched_in":"21.0426"}],"published":"2021-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e0591f3-cb6b-4345-93ee-4ab7e01da19a","source":"wordfence","cve":"CVE-2025-31025","title":"Image Hover Effects Block <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0591f3-cb6b-4345-93ee-4ab7e01da19a?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-block","name":"Image Hover Effects Block","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:00:58Z"},{"id":"wordfence:6e0945eb-ceec-4536-822a-fe864c21b580","source":"wordfence","cve":"CVE-2024-8484","title":"REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0945eb-ceec-4536-822a-fe864c21b580?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-to-miniprogram","name":"REST API TO MiniProgram","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-09-24T12:22:26Z","updated":"2025-11-05T22:07:47Z"},{"id":"wordfence:6e0bc78e-ff6b-4662-8327-314945cb0211","source":"wordfence","cve":"CVE-2025-58937","title":"Tacticool <= 1.0.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0bc78e-ff6b-4662-8327-314945cb0211?source=api-prod","affected":[{"type":"theme","slug":"tacticool","name":"Tacticool | Shooting Range & Gun Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:34:16Z"},{"id":"wordfence:6e0bdbba-2b67-42b9-8c26-115d472aed0e","source":"wordfence","cve":"CVE-2023-41804","title":"Starter Templates <= 3.2.4 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0bdbba-2b67-42b9-8c26-115d472aed0e?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"astra-pro-sites","name":"Premium Starter Templates","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-04-04T21:26:42Z"},{"id":"wordfence:6e0d931d-91ff-4088-a183-a9497991de05","source":"wordfence","cve":"CVE-2025-30938","title":"Broadly for WordPress <= 3.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0d931d-91ff-4088-a183-a9497991de05?source=api-prod","affected":[{"type":"plugin","slug":"broadly","name":"Broadly for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:46:34Z"},{"id":"wordfence:6e0e8f5f-8216-4276-a810-860f9b52c447","source":"wordfence","cve":"CVE-2015-10139","title":"WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0e8f5f-8216-4276-a810-860f9b52c447?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.8.4.1","to_inclusive":true,"patched_in":"1.9"}],"published":"2015-02-08T00:00:00Z","updated":"2025-07-19T11:23:36Z"},{"id":"wordfence:6e15a7b0-2b0e-468d-a245-cec2ed77d73b","source":"wordfence","cve":"CVE-2021-24942","title":"Menu Item Visibility Control <= 0.5 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e15a7b0-2b0e-468d-a245-cec2ed77d73b?source=api-prod","affected":[{"type":"plugin","slug":"menu-items-visibility-control","name":"Menu Item Visibility Control","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e15d285-aa1d-461d-bdc2-642e7ccd789b","source":"wordfence","cve":"CVE-2024-1677","title":"Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e15d285-aa1d-461d-bdc2-642e7ccd789b?source=api-prod","affected":[{"type":"plugin","slug":"a4-barcode-generator","name":"Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-30T13:49:40Z"},{"id":"wordfence:6e185479-843c-4748-83e5-ae0b300c3fc7","source":"wordfence","cve":"CVE-2025-13846","title":"Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e185479-843c-4748-83e5-ae0b300c3fc7?source=api-prod","affected":[{"type":"plugin","slug":"easy-map-creator","name":"Easy Map Creator","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:30:24Z","updated":"2025-12-12T03:20:48Z"},{"id":"wordfence:6e1b7f09-f5b8-46a2-bbbe-7ee192f11c12","source":"wordfence","cve":"CVE-2025-31751","title":"Breaking News WP <= 1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e1b7f09-f5b8-46a2-bbbe-7ee192f11c12?source=api-prod","affected":[{"type":"plugin","slug":"breaking-news-wp","name":"Breaking News WP","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:04:38Z"},{"id":"wordfence:6e2128db-ca9f-4211-8bc5-01a2cc1cba64","source":"wordfence","cve":"CVE-2026-1927","title":"GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2128db-ca9f-4211-8bc5-01a2cc1cba64?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.6","to_inclusive":true,"patched_in":"12.6.1"}],"published":"2026-02-05T00:53:48Z","updated":"2026-03-03T17:53:10Z"},{"id":"wordfence:6e21a429-d77e-4a6c-a182-18e51148523c","source":"wordfence","cve":"CVE-2025-58992","title":"Product Catalog Simple <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e21a429-d77e-4a6c-a182-18e51148523c?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:02:07Z"},{"id":"wordfence:6e273662-935f-45ad-b424-612da0799eba","source":"wordfence","cve":"CVE-2024-30521","title":"Landingi Landing Pages <= 3.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e273662-935f-45ad-b424-612da0799eba?source=api-prod","affected":[{"type":"plugin","slug":"landingi-landing-pages","name":"Landingi Landing Pages","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:35:57Z"},{"id":"wordfence:6e29fd6b-462a-42be-9a2a-b6717b20a937","source":"wordfence","cve":"CVE-2023-2284","title":"WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e29fd6b-462a-42be-9a2a-b6717b20a937?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log-premium","name":"WP Activity Log Premium","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e2d0b38-8241-456f-a79b-5d31132b3233","source":"wordfence","cve":"CVE-2024-1680","title":"Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2d0b38-8241-456f-a79b-5d31132b3233?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.21","to_inclusive":true,"patched_in":"4.10.22"}],"published":"2024-02-28T00:00:00Z","updated":"2024-03-13T15:26:55Z"},{"id":"wordfence:6e2e294f-904b-4674-8baf-d3a9a260d634","source":"wordfence","cve":"CVE-2025-6679","title":"Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2e294f-904b-4674-8baf-d3a9a260d634?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.20.3","to_inclusive":true,"patched_in":"2.20.4"}],"published":"2025-08-14T18:09:50Z","updated":"2025-08-15T06:40:43Z"},{"id":"wordfence:6e2f3d0a-08b3-471f-9e59-3adcaeab95bc","source":"wordfence","cve":"CVE-2025-47632","title":"Awesome Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2f3d0a-08b3-471f-9e59-3adcaeab95bc?source=api-prod","affected":[{"type":"plugin","slug":"awesome-gallery","name":"Awesome Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:59:11Z"},{"id":"wordfence:6e2f8f97-0f45-4d04-b6ef-77b562d07662","source":"wordfence","cve":"CVE-2026-79995","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.5 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2f8f97-0f45-4d04-b6ef-77b562d07662?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":false,"patched_in":"5.2.5"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:56:55Z"},{"id":"wordfence:6e31c347-aca4-4c1f-8456-53225f6b677b","source":"wordfence","cve":"CVE-2026-56054","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e31c347-aca4-4c1f-8456-53225f6b677b?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:16:42Z"},{"id":"wordfence:6e32504a-0365-4ff7-9637-11ee04441a17","source":"wordfence","cve":"CVE-2024-39640","title":"WP Social Feed Gallery <= 4.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e32504a-0365-4ff7-9637-11ee04441a17?source=api-prod","affected":[{"type":"plugin","slug":"insta-gallery","name":"Social Feed Gallery","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:19:26Z"},{"id":"wordfence:6e327239-b4f0-4d21-b25e-f015498981cb","source":"wordfence","cve":"","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 3.1.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e327239-b4f0-4d21-b25e-f015498981cb?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2014-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e32ff58-e205-4c81-82d1-2a1048256747","source":"wordfence","cve":"CVE-2016-1000156","title":"MailCWP <= 1.100 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e32ff58-e205-4c81-82d1-2a1048256747?source=api-prod","affected":[{"type":"plugin","slug":"mailcwp","name":"MailCWP","from":"*","from_inclusive":true,"to":"1.100","to_inclusive":true,"patched_in":""}],"published":"2015-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e330894-9a15-4ce3-b388-90fda3d98f8b","source":"wordfence","cve":"CVE-2022-1398","title":"External Media without Import <= 1.1.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e330894-9a15-4ce3-b388-90fda3d98f8b?source=api-prod","affected":[{"type":"plugin","slug":"external-media-without-import","name":"External Media without Import","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e349cae-a996-4a32-807a-a98ebcb01edd","source":"wordfence","cve":"CVE-2023-6828","title":"ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e349cae-a996-4a32-807a-a98ebcb01edd?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2024-01-03T00:00:00Z","updated":"2026-06-18T13:47:40Z"},{"id":"wordfence:6e3524a6-4f12-4640-96a0-da60afa0b770","source":"wordfence","cve":"","title":"Quick Paypal Payments < 3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3524a6-4f12-4640-96a0-da60afa0b770?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2013-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e363a62-8d31-4140-878b-5034d6c7b6a1","source":"wordfence","cve":"CVE-2024-5266","title":"Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e363a62-8d31-4140-878b-5034d6c7b6a1?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.92","to_inclusive":true,"patched_in":"3.2.94"}],"published":"2024-06-11T19:58:22Z","updated":"2024-06-12T08:33:19Z"},{"id":"wordfence:6e371cb0-b393-486c-8940-515612860417","source":"wordfence","cve":"CVE-2025-49923","title":"Seriously Simple Podcasting <= 3.11.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e371cb0-b393-486c-8940-515612860417?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2025-08-05T00:00:00Z","updated":"2025-10-29T20:03:09Z"},{"id":"wordfence:6e385a61-a6c7-41a8-b0f4-619055b66b3a","source":"wordfence","cve":"CVE-2024-37458","title":"Highlight <= 1.0.29 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e385a61-a6c7-41a8-b0f4-619055b66b3a?source=api-prod","affected":[{"type":"theme","slug":"highlight","name":"Highlight","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:56:26Z"},{"id":"wordfence:6e3ae1ab-f7d1-40d8-9f35-04d1706d4134","source":"wordfence","cve":"CVE-2024-51934","title":"Ekiline Block Collection <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3ae1ab-f7d1-40d8-9f35-04d1706d4134?source=api-prod","affected":[{"type":"plugin","slug":"ekiline-block-collection","name":"Ekiline Block Collection","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-11-08T00:00:00Z","updated":"2025-01-22T22:59:54Z"},{"id":"wordfence:6e3ae3c6-a7d1-46f0-a006-996c1fbe7c7e","source":"wordfence","cve":"CVE-2026-4895","title":"Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3ae3c6-a7d1-46f0-a006-996c1fbe7c7e?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.8.9","to_inclusive":true,"patched_in":"12.9.0"}],"published":"2026-04-10T11:49:09Z","updated":"2026-04-11T01:24:59Z"},{"id":"wordfence:6e3b68c8-151a-43d7-a953-051f57dec418","source":"wordfence","cve":"CVE-2025-54670","title":"oik <= 4.15.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3b68c8-151a-43d7-a953-051f57dec418?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.15.2","to_inclusive":true,"patched_in":"4.15.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:32:29Z"},{"id":"wordfence:6e3bf81a-cfc3-4203-9534-8a70f1fbc316","source":"wordfence","cve":"CVE-2026-48878","title":"Visual Link Preview <= 2.4.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3bf81a-cfc3-4203-9534-8a70f1fbc316?source=api-prod","affected":[{"type":"plugin","slug":"visual-link-preview","name":"Visual Link Preview","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-11T14:06:03Z"},{"id":"wordfence:6e3e73b4-591d-4520-afd5-44e2bb76e4f1","source":"wordfence","cve":"CVE-2014-10395","title":"Polls CP < 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e3e73b4-591d-4520-afd5-44e2bb76e4f1?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e45dc8a-b777-4a49-b1b1-c59ffa75f5b4","source":"wordfence","cve":"CVE-2026-6642","title":"Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e45dc8a-b777-4a49-b1b1-c59ffa75f5b4?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-11T07:39:07Z"},{"id":"wordfence:6e4a7e1e-50b1-47e4-936e-46d6ff4c7f77","source":"wordfence","cve":"CVE-2026-107319","title":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 8.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e4a7e1e-50b1-47e4-936e-46d6ff4c7f77?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":false,"patched_in":"8.0.6"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:26:49Z"},{"id":"wordfence:6e4bc689-8265-4f7a-bda2-d9ca8420179f","source":"wordfence","cve":"CVE-2025-60232","title":"KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e4bc689-8265-4f7a-bda2-d9ca8420179f?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase-helpdesk-pro","name":"KBx Pro Ultimate","from":"*","from_inclusive":true,"to":"8.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-15T00:00:00Z","updated":"2025-11-04T16:43:15Z"},{"id":"wordfence:6e4cc3e9-736c-47aa-b383-bd98377f51e1","source":"wordfence","cve":"CVE-2025-22320","title":"ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e4cc3e9-736c-47aa-b383-bd98377f51e1?source=api-prod","affected":[{"type":"plugin","slug":"productdyno","name":"ProductDyno","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2025-01-03T00:00:00Z","updated":"2025-03-06T21:00:44Z"},{"id":"wordfence:6e50081f-6658-4cc7-bf0a-d04464820926","source":"wordfence","cve":"CVE-2024-1408","title":"ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e50081f-6658-4cc7-bf0a-d04464820926?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:33Z"},{"id":"wordfence:6e520850-5cc7-40f8-9222-e7e50d21f347","source":"wordfence","cve":"CVE-2014-4592","title":"WP-Planet <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e520850-5cc7-40f8-9222-e7e50d21f347?source=api-prod","affected":[{"type":"plugin","slug":"wp-planet","name":"WP-Planet","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e53e70f-45fc-41a6-8436-a8b14f7685d0","source":"wordfence","cve":"","title":"Contact Form by Supsystic < 1.7.20 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e53e70f-45fc-41a6-8436-a8b14f7685d0?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.20","to_inclusive":false,"patched_in":"1.7.20"}],"published":"2021-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e54a627-7882-47de-ba36-1c34754bd64a","source":"wordfence","cve":"","title":"Houzez <= 1.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e54a627-7882-47de-ba36-1c34754bd64a?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2020-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e554ca0-2084-4ac0-b404-845a57123e00","source":"wordfence","cve":"CVE-2024-50532","title":"Events Manager Pro \u2013 extended <= 0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e554ca0-2084-4ac0-b404-845a57123e00?source=api-prod","affected":[{"type":"plugin","slug":"events-manager-pro-extended","name":"Events Manager Pro \u2013 extended","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T13:45:36Z"},{"id":"wordfence:6e57bcf3-6f9e-4746-a3d2-76ca36abb73f","source":"wordfence","cve":"CVE-2025-23857","title":"Essential WP Real Estate <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e57bcf3-6f9e-4746-a3d2-76ca36abb73f?source=api-prod","affected":[{"type":"plugin","slug":"essential-wp-real-estate","name":"Essential WP Real Estate","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:47:39Z"},{"id":"wordfence:6e583ae8-40f7-4cd6-b72d-c47d8bec77d4","source":"wordfence","cve":"CVE-2026-18786","title":"CheckView <= 2.3.1 - Unauthenticated REST API Authorization Bypass to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e583ae8-40f7-4cd6-b72d-c47d8bec77d4?source=api-prod","affected":[{"type":"plugin","slug":"checkview","name":"CheckView \u2013 Form & Checkout Testing","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-09-17T15:23:23Z"},{"id":"wordfence:6e58d0e1-151e-4f94-b9ee-c91a19c241eb","source":"wordfence","cve":"CVE-2025-69137","title":"Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e58d0e1-151e-4f94-b9ee-c91a19c241eb?source=api-prod","affected":[{"type":"theme","slug":"genemy","name":"Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:16:43Z"},{"id":"wordfence:6e5a4ebe-5d01-4d5e-b62b-a264b61fc6ee","source":"wordfence","cve":"CVE-2022-4837","title":"CPO Companion <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5a4ebe-5d01-4d5e-b62b-a264b61fc6ee?source=api-prod","affected":[{"type":"plugin","slug":"cpo-companion","name":"CPO Companion","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e5c6bf7-a653-4571-9566-574d2bb35c4f","source":"wordfence","cve":"CVE-2022-0992","title":"SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5c6bf7-a653-4571-9566-574d2bb35c4f?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2022-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e5d9403-dccf-4a90-a239-cd63ac59caaf","source":"wordfence","cve":"CVE-2026-92998","title":"Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5d9403-dccf-4a90-a239-cd63ac59caaf?source=api-prod","affected":[{"type":"plugin","slug":"click-n-chat","name":"Click n Chat (Chat Widget Integration)","from":"1.0.4","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:46:12Z"},{"id":"wordfence:6e5e9249-9705-4cfa-9c8e-2e002190562b","source":"wordfence","cve":"CVE-2024-10263","title":"Tickera \u2013 WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e9249-9705-4cfa-9c8e-2e002190562b?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.4.4","to_inclusive":true,"patched_in":"3.5.4.6"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-05T12:45:22Z"},{"id":"wordfence:6e5e957c-7b6f-4b69-b665-59292a32671e","source":"wordfence","cve":"CVE-2025-26575","title":"Display Post Meta <= 2.4.4 -Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e957c-7b6f-4b69-b665-59292a32671e?source=api-prod","affected":[{"type":"plugin","slug":"display-post-meta","name":"Display Post Meta","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:13:45Z"},{"id":"wordfence:6e5f158e-d153-41fe-8a3b-5aa3c3435d28","source":"wordfence","cve":"CVE-2026-62070","title":"Flipmart - MegaOne Multipurpose WordPress Theme <= 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5f158e-d153-41fe-8a3b-5aa3c3435d28?source=api-prod","affected":[{"type":"theme","slug":"flipmart","name":"Flipmart - MegaOne Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:39:04Z","updated":"2026-10-13T14:00:41Z"},{"id":"wordfence:6e61119c-b83e-41b4-aa14-7dc61086520d","source":"wordfence","cve":"CVE-2026-96566","title":"Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e61119c-b83e-41b4-aa14-7dc61086520d?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.4.0","to_inclusive":true,"patched_in":"9.4.1"}],"published":"2026-10-01T19:21:04Z","updated":"2026-10-02T07:39:25Z"},{"id":"wordfence:6e640b21-c118-4278-a87a-ae71fd3c9443","source":"wordfence","cve":"CVE-2026-24610","title":"MetForm Pro <= 3.9.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e640b21-c118-4278-a87a-ae71fd3c9443?source=api-prod","affected":[{"type":"plugin","slug":"metform-pro","name":"MetForm Pro","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-01-12T00:00:00Z","updated":"2026-09-18T15:00:52Z"},{"id":"wordfence:6e6603a0-8f35-49fb-a517-ba6344538c4d","source":"wordfence","cve":"CVE-2026-12408","title":"Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6603a0-8f35-49fb-a517-ba6344538c4d?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"4.9.9"}],"published":"2026-06-30T19:21:44Z","updated":"2026-07-01T07:53:37Z"},{"id":"wordfence:6e6c56ab-b829-48b0-ba71-54b81173aaa3","source":"wordfence","cve":"CVE-2025-23539","title":"Awesome Hooks <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6c56ab-b829-48b0-ba71-54b81173aaa3?source=api-prod","affected":[{"type":"plugin","slug":"awesome-hooks","name":"Awesome Hooks","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:52:14Z"},{"id":"wordfence:6e6cda1a-e137-4c30-a66b-c10a88070c50","source":"wordfence","cve":"","title":"NativeChurch <= 1.6.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6cda1a-e137-4c30-a66b-c10a88070c50?source=api-prod","affected":[{"type":"theme","slug":"NativeChurch","name":"NativeChurch","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e6f993b-ce09-4050-84a1-cbe9953f36b1","source":"wordfence","cve":"CVE-2023-5692","title":"WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e6f993b-ce09-4050-84a1-cbe9953f36b1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-05T13:34:58Z"},{"id":"wordfence:6e71c021-4e00-4906-86b1-01d2782ef4d0","source":"wordfence","cve":"CVE-2026-103311","title":"Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e71c021-4e00-4906-86b1-01d2782ef4d0?source=api-prod","affected":[{"type":"plugin","slug":"coinbase-commerce","name":"Coinbase Commerce Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:25:51Z"},{"id":"wordfence:6e728023-d5da-44cc-bc13-68a5aa63a8a5","source":"wordfence","cve":"CVE-2025-49436","title":"Custom Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e728023-d5da-44cc-bc13-68a5aa63a8a5?source=api-prod","affected":[{"type":"plugin","slug":"custom-menu","name":"Custom Menu","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-25T17:22:29Z"},{"id":"wordfence:6e736e75-5ad4-4773-b1f7-358dc74848f0","source":"wordfence","cve":"CVE-2022-1964","title":"Easy SVG Support <= 3.2.0 - Cross-Site Scripting via SVG Upload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e736e75-5ad4-4773-b1f7-358dc74848f0?source=api-prod","affected":[{"type":"plugin","slug":"easy-svg","name":"Easy SVG Support","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e738f35-a691-4f82-8be3-92215e26aed3","source":"wordfence","cve":"CVE-2025-32236","title":"Woocommerce Products Reorder Drag Drop Multiple Sort \u2013 Sortable, Rearrange Products Vagonic <= 1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e738f35-a691-4f82-8be3-92215e26aed3?source=api-prod","affected":[{"type":"plugin","slug":"vagonic-sortable","name":"Woocommerce Advanced Product Organizer \u2013 Dynamic Sorting & Reordering","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T15:32:04Z"},{"id":"wordfence:6e739eb4-6b8b-4bc7-a1e6-790180668c93","source":"wordfence","cve":"CVE-2026-15286","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e739eb4-6b8b-4bc7-a1e6-790180668c93?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.32","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-02-10T00:00:00Z","updated":"2026-07-10T04:31:22Z"},{"id":"wordfence:6e74582f-8e94-4cba-a3eb-0a823a5235ad","source":"wordfence","cve":"CVE-2025-8342","title":"WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e74582f-8e94-4cba-a3eb-0a823a5235ad?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.8.47","to_inclusive":true,"patched_in":"1.8.48"}],"published":"2025-08-14T13:55:12Z","updated":"2025-08-15T02:24:23Z"},{"id":"wordfence:6e746509-4932-4f58-9d56-3a6596418d20","source":"wordfence","cve":"CVE-2026-76546","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e746509-4932-4f58-9d56-3a6596418d20?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-01T20:49:21Z"},{"id":"wordfence:6e766de1-10fd-43de-b487-56895a4b8db0","source":"wordfence","cve":"","title":"RokNewsPager <= 1.17 - Missing Domain Restriction","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e766de1-10fd-43de-b487-56895a4b8db0?source=api-prod","affected":[{"type":"plugin","slug":"wp_roknewspager","name":"RokNewsPager","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e770e98-3c13-4e37-b51b-4c39bce2cb42","source":"wordfence","cve":"CVE-2023-7044","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e770e98-3c13-4e37-b51b-4c39bce2cb42?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"5.9.3"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:36:33Z"},{"id":"wordfence:6e77d240-475d-41a2-9b88-1332fc60b72d","source":"wordfence","cve":"CVE-2022-36371","title":"My Calendar <= 3.3.16 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e77d240-475d-41a2-9b88-1332fc60b72d?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.3.16","to_inclusive":true,"patched_in":"3.3.17"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e78440d-54ab-400f-a8d2-9cb33f1ec861","source":"wordfence","cve":"CVE-2024-11765","title":"WordPress Portfolio Plugin \u2013 A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e78440d-54ab-400f-a8d2-9cb33f1ec861?source=api-prod","affected":[{"type":"plugin","slug":"gs-portfolio","name":"GS Portfolio \u2013 Filterable Portfolio, Portfolio Grid & Portfolio Slider","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:23Z"},{"id":"wordfence:6e7bd966-9a98-4192-83d9-e1682ec00a02","source":"wordfence","cve":"CVE-2025-11885","title":"EchBay Admin Security <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7bd966-9a98-4192-83d9-e1682ec00a02?source=api-prod","affected":[{"type":"plugin","slug":"echbay-admin-security","name":"EchBay Admin Security","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-11-20T19:30:13Z","updated":"2025-11-21T07:31:51Z"},{"id":"wordfence:6e7bfd20-a58d-4641-a2d2-6b43c5a2165e","source":"wordfence","cve":"CVE-2025-30931","title":"\u00ab\u041f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0438\u00bb \u043e\u0442 DaData.ru <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7bfd20-a58d-4641-a2d2-6b43c5a2165e?source=api-prod","affected":[{"type":"plugin","slug":"dadata-ru","name":"\u00ab\u041f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0438\u00bb \u043e\u0442 DaData.ru","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:53:21Z"},{"id":"wordfence:6e7c629f-e9c6-4254-ba37-46de5206d77d","source":"wordfence","cve":"CVE-2023-35048","title":"Booking and Rental Manager <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7c629f-e9c6-4254-ba37-46de5206d77d?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e7dcd0e-fbc8-4460-82a2-4ed20664e2b6","source":"wordfence","cve":"CVE-2025-49305","title":"Product Catalog Simple <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7dcd0e-fbc8-4460-82a2-4ed20664e2b6?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:10:19Z"},{"id":"wordfence:6e7dedc2-5ba1-49c7-9afe-f55023f24e47","source":"wordfence","cve":"CVE-2025-57951","title":"SiteNarrator Text-to-Speech Widget <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7dedc2-5ba1-49c7-9afe-f55023f24e47?source=api-prod","affected":[{"type":"plugin","slug":"sitespeaker-widget","name":"SiteNarrator Text-to-Speech Widget","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:59:20Z"},{"id":"wordfence:6e7e6445-c1c5-48a8-a76d-819f2db1efc2","source":"wordfence","cve":"CVE-2023-4643","title":"Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7e6445-c1c5-48a8-a76d-819f2db1efc2?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":false,"patched_in":"4.1.3"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e7f1fe6-0a23-48e1-a75f-f8c1c8d4f8e0","source":"wordfence","cve":"CVE-2025-2482","title":"Gotcha | Gesture-based Captcha <= 1.0.0 - Reflected Cross-Site Scripting via menu Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7f1fe6-0a23-48e1-a75f-f8c1c8d4f8e0?source=api-prod","affected":[{"type":"plugin","slug":"gotcha-gesture-based-captcha","name":"Gotcha | Gesture-based Captcha","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T17:56:35Z","updated":"2025-03-22T06:41:11Z"},{"id":"wordfence:6e7f6299-3006-465c-a65e-f483d776b2b3","source":"wordfence","cve":"CVE-2026-119477","title":"WP Photo Album Plus <= 9.3.05.003 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7f6299-3006-465c-a65e-f483d776b2b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.05.003","to_inclusive":true,"patched_in":"9.3.06.001"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:43:27Z"},{"id":"wordfence:6e80e3ac-331a-480f-94ca-06d62230cd80","source":"wordfence","cve":"CVE-2025-12400","title":"LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e80e3ac-331a-480f-94ca-06d62230cd80?source=api-prod","affected":[{"type":"plugin","slug":"lmbbox-smileys","name":"LMB^Box Smileys","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T16:03:49Z","updated":"2025-11-04T04:27:17Z"},{"id":"wordfence:6e81cbe3-1310-4f6f-ae42-8d09b321657a","source":"wordfence","cve":"CVE-2018-1000504","title":"Redirection <= 2.7.3 - Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e81cbe3-1310-4f6f-ae42-8d09b321657a?source=api-prod","affected":[{"type":"plugin","slug":"redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.8"}],"published":"2018-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e834db1-0859-4e58-a11c-96e8f201b097","source":"wordfence","cve":"CVE-2014-9014","title":"Marketplace <= 2.4.0 - Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e834db1-0859-4e58-a11c-96e8f201b097?source=api-prod","affected":[{"type":"plugin","slug":"wpmarketplace","name":"WP Marketplace \u2013 Complete Shopping Cart / eCommerce Solution","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2015-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e83c039-9b15-4e0c-8b07-3b906938c138","source":"wordfence","cve":"CVE-2025-14144","title":"Mstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e83c039-9b15-4e0c-8b07-3b906938c138?source=api-prod","affected":[{"type":"plugin","slug":"mstoic-shortcodes","name":"Mstoic Shortcodes","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:29:34Z","updated":"2026-01-07T09:20:59Z"},{"id":"wordfence:6e845eae-dae9-40bb-aca9-21afaa40576d","source":"wordfence","cve":"CVE-2024-10636","title":"Quiz Maker Business, Developer, and Agency <= (Multiple Versions)  - Reflected DOM-Based Cross-Site Scripting via content","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e845eae-dae9-40bb-aca9-21afaa40576d?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Developer","from":"20.0.0","from_inclusive":true,"to":"21.8.0","to_inclusive":true,"patched_in":"21.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"7.0.0","from_inclusive":true,"to":"8.8.0","to_inclusive":true,"patched_in":"8.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Agency","from":"30.0.0","from_inclusive":true,"to":"31.8.0","to_inclusive":true,"patched_in":"31.8.0.100"}],"published":"2025-01-25T00:00:00Z","updated":"2025-03-12T17:36:43Z"},{"id":"wordfence:6e8646f0-8bd1-4cfd-85bb-86a054ab297f","source":"wordfence","cve":"CVE-2026-7613","title":"Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8646f0-8bd1-4cfd-85bb-86a054ab297f?source=api-prod","affected":[{"type":"plugin","slug":"pixel-cost-of-goods","name":"Cost of Goods by PixelYourSite","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2026-05-19T15:32:43Z","updated":"2026-05-20T16:27:54Z"},{"id":"wordfence:6e8a3628-b7cf-4f1a-89dc-d7e58257b2e4","source":"wordfence","cve":"CVE-2025-13968","title":"Starboard Suite Reservation Calendars <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8a3628-b7cf-4f1a-89dc-d7e58257b2e4?source=api-prod","affected":[{"type":"plugin","slug":"starboard-suite-reservation-calendars","name":"Starboard Suite Reservation Calendars","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-07-10T15:21:47Z","updated":"2026-07-11T03:44:23Z"},{"id":"wordfence:6e8d038d-8e2d-442d-932d-0fd31a8c501c","source":"wordfence","cve":"CVE-2024-32443","title":"Download IP2Location Country Blocker <= 2.34.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8d038d-8e2d-442d-932d-0fd31a8c501c?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.34.2","to_inclusive":true,"patched_in":"2.34.3"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T18:57:16Z"},{"id":"wordfence:6e8d9f73-8460-4bcb-a9f8-08eb058bcc09","source":"wordfence","cve":"CVE-2026-8141","title":"Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8d9f73-8460-4bcb-a9f8-08eb058bcc09?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more-filters","name":"Ajax Load More - Filters","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-06-29T21:07:50Z","updated":"2026-06-30T09:31:48Z"},{"id":"wordfence:6e8dd97d-0a5e-474a-b2c0-47a3150c4783","source":"wordfence","cve":"CVE-2026-118076","title":"Frisbii Pay <= 1.8.19 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e8dd97d-0a5e-474a-b2c0-47a3150c4783?source=api-prod","affected":[{"type":"plugin","slug":"reepay-checkout-gateway","name":"Frisbii Pay","from":"*","from_inclusive":true,"to":"1.8.19","to_inclusive":true,"patched_in":"1.8.20"}],"published":"2026-10-28T09:08:27Z","updated":"2026-11-03T19:40:40Z"},{"id":"wordfence:6e90fe49-4ead-4468-b3cc-30040e4f278f","source":"wordfence","cve":"CVE-2018-16285","title":"UserPro <= 4.9.23 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e90fe49-4ead-4468-b3cc-30040e4f278f?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.9.24"}],"published":"2018-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e953bc0-a934-43fc-8147-4555dde069cc","source":"wordfence","cve":"","title":"GA Universal < 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e953bc0-a934-43fc-8147-4555dde069cc?source=api-prod","affected":[{"type":"plugin","slug":"ga-universal","name":"GA Universal","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2013-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e954190-7c58-4044-a85e-a188fe5b6d89","source":"wordfence","cve":"CVE-2023-49826","title":"Soledad <= 8.4.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e954190-7c58-4044-a85e-a188fe5b6d89?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e95b16f-a25a-45c7-a875-2d34a1e127ce","source":"wordfence","cve":"CVE-2025-14047","title":"WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e95b16f-a25a-45c7-a875-2d34a1e127ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2026-01-01T13:23:01Z","updated":"2026-01-23T17:28:13Z"},{"id":"wordfence:6e984ff1-9dcf-4cd3-b617-1f9e25ecae0c","source":"wordfence","cve":"CVE-2024-29926","title":"WC Builder <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e984ff1-9dcf-4cd3-b617-1f9e25ecae0c?source=api-prod","affected":[{"type":"plugin","slug":"wc-builder","name":"WC Builder \u2013 WooCommerce Page Builder for WPBakery","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:12:20Z"},{"id":"wordfence:6e98fb74-46f2-4a6a-8012-e2824bd77070","source":"wordfence","cve":"CVE-2023-28688","title":"TH Variation Swatches <= 1.2.7 - Cross-Site Request Forgery via delete_settings","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e98fb74-46f2-4a6a-8012-e2824bd77070?source=api-prod","affected":[{"type":"plugin","slug":"th-variation-swatches","name":"Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6e9eec61-bf51-4cf7-b567-58ee2ccd91c5","source":"wordfence","cve":"CVE-2025-6070","title":"Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e9eec61-bf51-4cf7-b567-58ee2ccd91c5?source=api-prod","affected":[{"type":"plugin","slug":"restrict-file-access","name":"Restrict File Access","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:37:23Z","updated":"2025-06-14T08:23:25Z"},{"id":"wordfence:6e9f6d07-5ba5-48ad-bfcc-084913436b39","source":"wordfence","cve":"CVE-2024-10794","title":"Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e9f6d07-5ba5-48ad-bfcc-084913436b39?source=api-prod","affected":[{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T03:20:06Z"},{"id":"wordfence:6ea07ba1-9d0c-4c90-9eb2-d6f1a573dca2","source":"wordfence","cve":"CVE-2024-37543","title":"Ultimate Auction  <= 4.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea07ba1-9d0c-4c90-9eb2-d6f1a573dca2?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2024-07-06T00:00:00Z","updated":"2024-08-08T20:47:22Z"},{"id":"wordfence:6ea2a3d9-1fe4-4a04-98bc-1c8ba139a20a","source":"wordfence","cve":"CVE-2026-92923","title":"Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea2a3d9-1fe4-4a04-98bc-1c8ba139a20a?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"1.5.142","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T00:03:07Z"},{"id":"wordfence:6ea2b350-7def-4af0-b872-60f28fcdc3c8","source":"wordfence","cve":"CVE-2024-50553","title":"Classy Addons for Elementor <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea2b350-7def-4af0-b872-60f28fcdc3c8?source=api-prod","affected":[{"type":"plugin","slug":"classy-addons-for-elementor","name":"Classy Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:47:05Z"},{"id":"wordfence:6ea36692-2bf3-490d-8293-7de6dcc5e5c9","source":"wordfence","cve":"","title":"PublishPress Capabilities <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea36692-2bf3-490d-8293-7de6dcc5e5c9?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ea4ad81-dba6-4055-b81c-682424a6ffd0","source":"wordfence","cve":"CVE-2026-25335","title":"Secure Copy Content Protection and Content Locking <= 5.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea4ad81-dba6-4055-b81c-682424a6ffd0?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-02-08T00:00:00Z","updated":"2026-05-04T15:43:37Z"},{"id":"wordfence:6ea92622-60df-43ab-a106-56b769964a75","source":"wordfence","cve":"CVE-2026-104726","title":"Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea92622-60df-43ab-a106-56b769964a75?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.34.2","to_inclusive":true,"patched_in":"1.34.3"}],"published":"2026-10-15T19:58:11Z","updated":"2026-10-16T08:27:43Z"},{"id":"wordfence:6ea9dda4-d667-46f3-893b-a1ae60b6ba75","source":"wordfence","cve":"CVE-2013-3263","title":"WP Ultimate Email Marketer <= 1.2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ea9dda4-d667-46f3-893b-a1ae60b6ba75?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-email-marketer","name":"WP Ultimate Email Marketer","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2013-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eab3497-bf77-43a8-962d-d63db7290777","source":"wordfence","cve":"CVE-2014-8605","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin  <= 3.1.1 - Improper Access Control to Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eab3497-bf77-43a8-962d-d63db7290777?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ead05d3-a5b1-474f-bc72-67570ff060da","source":"wordfence","cve":"CVE-2024-43924","title":"Responsive Lightbox <= 2.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ead05d3-a5b1-474f-bc72-67570ff060da?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-12T15:11:15Z"},{"id":"wordfence:6eb099c3-f6f6-4d9c-a9c7-fa1b81ce082e","source":"wordfence","cve":"CVE-2023-34006","title":"Telegram Bot & Channel <= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb099c3-f6f6-4d9c-a9c7-fa1b81ce082e?source=api-prod","affected":[{"type":"plugin","slug":"telegram-bot","name":"Telegram Bot & Channel","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2023-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eb0aa16-a269-4297-861f-6bad88066c68","source":"wordfence","cve":"CVE-2024-30515","title":"Events Manager <= 6.4.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb0aa16-a269-4297-861f-6bad88066c68?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.6.4","to_inclusive":true,"patched_in":"6.4.7"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:14:03Z"},{"id":"wordfence:6eb19d3a-b180-4141-8c9b-bec436eeea6b","source":"wordfence","cve":"CVE-2022-3374","title":"Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb19d3a-b180-4141-8c9b-bec436eeea6b?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eb23014-7bc6-4505-85d7-91d29bb2d8fb","source":"wordfence","cve":"CVE-2021-24835","title":"WCFM - Frontend Manager for WooCommerce <= 6.5.11 - Customer/Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb23014-7bc6-4505-85d7-91d29bb2d8fb?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.5.11","to_inclusive":true,"patched_in":"6.5.12"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eb3ad80-3510-4018-91af-b733ef62e28f","source":"wordfence","cve":"CVE-2024-7568","title":"Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb3ad80-3510-4018-91af-b733ef62e28f?source=api-prod","affected":[{"type":"plugin","slug":"favicon-generator","name":"Favicon Generator (CLOSED)","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-27T12:56:55Z"},{"id":"wordfence:6eb57c97-f560-42d1-87bd-b19c60700956","source":"wordfence","cve":"CVE-2024-13793","title":"Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb57c97-f560-42d1-87bd-b19c60700956?source=api-prod","affected":[{"type":"theme","slug":"wolmart","name":"Wolmart | Multi-Vendor Marketplace WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-08T04:21:33Z"},{"id":"wordfence:6eb5c8f1-d71d-4995-8242-abf9ef248b75","source":"wordfence","cve":"CVE-2026-42740","title":"Tainacan <= 1.0.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb5c8f1-d71d-4995-8242-abf9ef248b75?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:22:40Z"},{"id":"wordfence:6eb6611d-7a4b-4ca8-b9cc-c156437e89b5","source":"wordfence","cve":"CVE-2024-11641","title":"VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb6611d-7a4b-4ca8-b9cc-c156437e89b5?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T11:09:46Z"},{"id":"wordfence:6eb76b6a-142e-4918-b4f7-77debbf1b75c","source":"wordfence","cve":"CVE-2024-50416","title":"WPC Shop as a Customer for WooCommerce <= 1.2.6 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb76b6a-142e-4918-b4f7-77debbf1b75c?source=api-prod","affected":[{"type":"plugin","slug":"wpc-shop-as-customer","name":"WPC Shop as a Customer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:04:19Z"},{"id":"wordfence:6eb8756b-7c0f-4bc9-9e24-07598efa9eee","source":"wordfence","cve":"CVE-2025-7399","title":"Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb8756b-7c0f-4bc9-9e24-07598efa9eee?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.1.3","to_inclusive":true,"patched_in":"28.1.4"}],"published":"2025-08-05T15:36:42Z","updated":"2025-08-06T03:41:00Z"},{"id":"wordfence:6eb99654-c0f4-4c75-9b9d-f3075db623fc","source":"wordfence","cve":"CVE-2024-43971","title":"Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb99654-c0f4-4c75-9b9d-f3075db623fc?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:07:25Z"},{"id":"wordfence:6eb9d68c-c081-484e-ad5d-5eabcfa6d6f0","source":"wordfence","cve":"CVE-2026-4094","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb9d68c-c081-484e-ad5d-5eabcfa6d6f0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-15T06:45:58Z"},{"id":"wordfence:6eba6056-e087-4347-ad36-96501ceb4cdd","source":"wordfence","cve":"CVE-2024-4339","title":"Prime Slider \u2013 Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eba6056-e087-4347-ad36-96501ceb4cdd?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.14.3","to_inclusive":true,"patched_in":"3.14.4"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:30Z"},{"id":"wordfence:6ebb5654-ba3e-4f18-8720-a6595a771964","source":"wordfence","cve":"CVE-2024-0834","title":"Elementor Addon Elements <= 1.12.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebb5654-ba3e-4f18-8720-a6595a771964?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"1.12.11","from_inclusive":true,"to":"1.12.11","to_inclusive":true,"patched_in":"1.12.12"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-05T21:21:48Z"},{"id":"wordfence:6ebc1b85-4682-4467-b17c-9a35cc3f0f15","source":"wordfence","cve":"","title":"Shopping Cart & eCommerce Store <= 5.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebc1b85-4682-4467-b17c-9a35cc3f0f15?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2022-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ebdc324-9709-4e09-96ff-d1ea1d8bb63f","source":"wordfence","cve":"CVE-2025-39372","title":"WordPress Events Calendar Registration & Tickets <= 2.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebdc324-9709-4e09-96ff-d1ea1d8bb63f?source=api-prod","affected":[{"type":"plugin","slug":"wpeventplus","name":"WordPress Events Calendar Registration & Tickets","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T22:14:31Z"},{"id":"wordfence:6ebffb82-7455-40c9-9ffd-b78e0e73e431","source":"wordfence","cve":"CVE-2024-8425","title":"WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ebffb82-7455-40c9-9ffd-b78e0e73e431?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ultimate-gift-card","name":"WooCommerce Ultimate Gift Card","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-02-27T19:46:01Z","updated":"2025-05-27T19:54:54Z"},{"id":"wordfence:6ec02202-18e3-4a57-be2c-7dbf50e500dc","source":"wordfence","cve":"CVE-2023-23656","title":"MainWP File Uploader Extension <= 4.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec02202-18e3-4a57-be2c-7dbf50e500dc?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-file-uploader-extension","name":"MainWP File Uploader Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ec069ef-7b53-47b5-93bc-92cfc2d62c88","source":"wordfence","cve":"CVE-2024-53759","title":"ArCa Payment Gateway <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec069ef-7b53-47b5-93bc-92cfc2d62c88?source=api-prod","affected":[{"type":"plugin","slug":"arca-payment-gateway","name":"Planet Studio Payment Gateway for ArCa","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-12T22:43:55Z"},{"id":"wordfence:6ec2c2cd-f3b1-4db6-b184-7220b46168d0","source":"wordfence","cve":"CVE-2025-68048","title":"NextMove Lite <= 2.23.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec2c2cd-f3b1-4db6-b184-7220b46168d0?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.24.0"}],"published":"2026-01-27T00:00:00Z","updated":"2026-03-17T21:33:14Z"},{"id":"wordfence:6ec3051e-a5e4-48ee-8f8e-eb5dbc482f33","source":"wordfence","cve":"CVE-2023-5415","title":"Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec3051e-a5e4-48ee-8f8e-eb5dbc482f33?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eccc8cd-5f5f-45a9-90fb-8491b238a3f6","source":"wordfence","cve":"CVE-2025-23751","title":"Data Dash <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eccc8cd-5f5f-45a9-90fb-8491b238a3f6?source=api-prod","affected":[{"type":"plugin","slug":"data-dash","name":"Data Dash","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:28:25Z"},{"id":"wordfence:6eccf601-ad95-4fb5-a3a6-e916df6a6b56","source":"wordfence","cve":"CVE-2022-47155","title":"Slider by Supsystic <= 1.8.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eccf601-ad95-4fb5-a3a6-e916df6a6b56?source=api-prod","affected":[{"type":"plugin","slug":"slider-by-supsystic","name":"Slider by Supsystic","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ecd0fa6-4fdb-4780-9560-0bb126800685","source":"wordfence","cve":"CVE-2023-3082","title":"Post SMTP <= 2.5.7 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ece7e74-ffd9-48f9-b66b-58708233b24b","source":"wordfence","cve":"CVE-2024-33574","title":"Vitepos <= 3.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ece7e74-ffd9-48f9-b66b-58708233b24b?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:20:21Z"},{"id":"wordfence:6ece9b6d-6802-44b9-9ead-1563286f4ff3","source":"wordfence","cve":"CVE-2024-12166","title":"Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ece9b6d-6802-44b9-9ead-1563286f4ff3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-shortcodes-creator","name":"Shortcodes Blocks Creator Ultimate","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T11:59:23Z","updated":"2024-12-19T17:04:07Z"},{"id":"wordfence:6ecf99ef-f879-426f-8a05-129be77f1157","source":"wordfence","cve":"CVE-2024-4411","title":"Mihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecf99ef-f879-426f-8a05-129be77f1157?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-yandex-turbo-feed","name":"Mihdan: Yandex Turbo Feed","from":"*","from_inclusive":true,"to":"1.6.5.1","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-31T15:30:24Z"},{"id":"wordfence:6ed215da-10c5-469b-bab2-923808feebd4","source":"wordfence","cve":"CVE-2024-10729","title":"Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed215da-10c5-469b-bab2-923808feebd4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-booking","name":"Booking & Appointment Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.10.0"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T02:06:33Z"},{"id":"wordfence:6ed5add1-d2d9-44ae-9190-7a564bd31f57","source":"wordfence","cve":"CVE-2025-46499","title":"PayPal Express Checkout <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5add1-d2d9-44ae-9190-7a564bd31f57?source=api-prod","affected":[{"type":"plugin","slug":"paypal-express-checkout","name":"PayPal Express Checkout","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:12:29Z"},{"id":"wordfence:6ed5bdb3-c4cd-4982-bc47-feeff527e284","source":"wordfence","cve":"CVE-2025-13401","title":"Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2025-12-03T00:32:37Z","updated":"2025-12-03T13:52:45Z"},{"id":"wordfence:6ed605a1-9544-4b53-8d62-ad89214a4fb8","source":"wordfence","cve":"CVE-2025-12358","title":"ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed605a1-9544-4b53-8d62-ad89214a4fb8?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"4.8.6"}],"published":"2025-12-02T23:42:11Z","updated":"2025-12-03T12:29:58Z"},{"id":"wordfence:6ed7184d-de43-4f2f-ae49-1aecd717f8b9","source":"wordfence","cve":"CVE-2024-56015","title":"Tidy Up <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed7184d-de43-4f2f-ae49-1aecd717f8b9?source=api-prod","affected":[{"type":"plugin","slug":"tidy-up","name":"Tidy Up","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-08T14:32:22Z"},{"id":"wordfence:6ed8f004-f68d-40fb-bca1-b0b92cf24fdb","source":"wordfence","cve":"CVE-2022-47613","title":"ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed8f004-f68d-40fb-bca1-b0b92cf24fdb?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ed96d76-ef7d-46c5-a164-992dd4f15afe","source":"wordfence","cve":"CVE-2025-59576","title":"MasterStudy LMS <= 3.6.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed96d76-ef7d-46c5-a164-992dd4f15afe?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":"3.6.21"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:09:35Z"},{"id":"wordfence:6ed99dfd-6ca6-41e7-a844-d53eec7068c1","source":"wordfence","cve":"CVE-2025-11454","title":"Specific Content For Mobile \u2013 Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed99dfd-6ca6-41e7-a844-d53eec7068c1?source=api-prod","affected":[{"type":"plugin","slug":"specific-content-for-mobile","name":"Specific Content For Mobile \u2013 Customize the mobile version without redirections","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":"0.5.6"}],"published":"2025-11-11T22:53:15Z","updated":"2025-11-12T11:05:39Z"},{"id":"wordfence:6ed9a567-fde4-4b6f-81c1-423c5cbba0a9","source":"wordfence","cve":"CVE-2021-39203","title":"WordPress Core 5.8 beta - Block Editor Authorization Bypass","severity":"medium","cvss":6.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed9a567-fde4-4b6f-81c1-423c5cbba0a9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8 beta 1","from_inclusive":true,"to":"5.8 beta 1","to_inclusive":true,"patched_in":"5.8"}],"published":"2021-09-09T00:00:00Z","updated":"2024-02-06T19:47:55Z"},{"id":"wordfence:6edb6604-9da8-421e-933b-bac02b179bd0","source":"wordfence","cve":"CVE-2023-28664","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.0.1 - Relected Cross-Site Scripting via 'tax_name'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6edb6604-9da8-421e-933b-bac02b179bd0?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.0.1","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6edf91de-9553-4aa1-a29f-89771c8e852e","source":"wordfence","cve":"CVE-2025-1514","title":"Active Products Tables for WooCommerce <= 1.0.6.7 -  Unauthenticated Arbitrary Filter Call","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6edf91de-9553-4aa1-a29f-89771c8e852e?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.7","to_inclusive":true,"patched_in":"1.0.6.8"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T08:21:51Z"},{"id":"wordfence:6ee04e4d-4385-4854-9bfe-1b957ca13963","source":"wordfence","cve":"CVE-2023-51502","title":"WooCommerce Stripe Payment Gateway <= 7.6.1 - Insecure Direct Object Reference via update_payment_intent_ajax","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee04e4d-4385-4854-9bfe-1b957ca13963?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ee3b70d-bf09-4e55-9200-154f842db145","source":"wordfence","cve":"CVE-2026-13154","title":"Essential Blocks <= 6.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee3b70d-bf09-4e55-9200-154f842db145?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-17T16:13:51Z"},{"id":"wordfence:6ee48355-33a3-4689-8b09-2affee6adf21","source":"wordfence","cve":"CVE-2025-49316","title":"WP2LEADS <= 3.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee48355-33a3-4689-8b09-2affee6adf21?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2025-06-15T00:00:00Z","updated":"2025-06-25T14:45:07Z"},{"id":"wordfence:6ee577bb-7a7c-451a-a658-d3520a7475f5","source":"wordfence","cve":"CVE-2024-39630","title":"Timetable and Event Schedule <= 2.4.13 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee577bb-7a7c-451a-a658-d3520a7475f5?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.14"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-07T13:38:05Z"},{"id":"wordfence:6ee675dd-5b43-439f-9717-6c531e9bf066","source":"wordfence","cve":"CVE-2025-14151","title":"SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee675dd-5b43-439f-9717-6c531e9bf066?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2025-12-18T20:00:46Z","updated":"2026-01-05T14:53:53Z"},{"id":"wordfence:6ee6abb4-eeb7-4ea3-912d-cb86d189b3bf","source":"wordfence","cve":"CVE-2026-39438","title":"ListingPro Plugin <= 2.9.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee6abb4-eeb7-4ea3-912d-cb86d189b3bf?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":true,"patched_in":"2.9.11"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:42:07Z"},{"id":"wordfence:6ee6dedb-72bc-43b0-a7cb-9069533df705","source":"wordfence","cve":"CVE-2022-45078","title":"User Blocker <= 1.5.5 - Authenticated (Admin+) CSV Injection","severity":"medium","cvss":5.9,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee6dedb-72bc-43b0-a7cb-9069533df705?source=api-prod","affected":[{"type":"plugin","slug":"user-blocker","name":"User Blocker","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ee977de-4132-48c1-b751-fcea8d28f66b","source":"wordfence","cve":"CVE-2024-49694","title":"My Wp Brand \u2013 Hide menu & Hide Plugin <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ee977de-4132-48c1-b751-fcea8d28f66b?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-brand","name":"My Wp Brand \u2013 Hide menu & Hide Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:27:32Z"},{"id":"wordfence:6eeb6df1-9857-47a2-ad7d-f1eb082e9448","source":"wordfence","cve":"CVE-2022-36357","title":"ULTIMATE TABLES <= 1.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eeb6df1-9857-47a2-ad7d-f1eb082e9448?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-tables","name":"ULTIMATE TABLES","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-17T14:44:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eebeb72-7a4b-46d0-a585-4e44c03d187a","source":"wordfence","cve":"CVE-2022-44593","title":"Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eebeb72-7a4b-46d0-a585-4e44c03d187a?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"9.3.1","to_inclusive":true,"patched_in":"9.3.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T17:13:43Z"},{"id":"wordfence:6eec349a-0b85-4d3f-bdb7-f9eb3b9e35d9","source":"wordfence","cve":"CVE-2025-68074","title":"Image Carousel <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eec349a-0b85-4d3f-bdb7-f9eb3b9e35d9?source=api-prod","affected":[{"type":"plugin","slug":"image-carousel","name":"Image Carousel","from":"*","from_inclusive":true,"to":"1.0.0.41","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:32:04Z"},{"id":"wordfence:6eed2941-d9fe-4020-b1ab-fb0885f47d80","source":"wordfence","cve":"CVE-2023-0331","title":"Correos Oficial <= 1.3.0.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eed2941-d9fe-4020-b1ab-fb0885f47d80?source=api-prod","affected":[{"type":"plugin","slug":"correos-oficial","name":"Correos Oficial","from":"*","from_inclusive":true,"to":"1.3.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eed4626-1fa5-49b1-864e-c37e4cf58ad8","source":"wordfence","cve":"CVE-2024-25908","title":"WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Title Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eed4626-1fa5-49b1-864e-c37e4cf58ad8?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder","name":"WP Media folder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-05-07T19:56:54Z"},{"id":"wordfence:6eedf009-116c-4a98-8b84-e01bd35e7e60","source":"wordfence","cve":"CVE-2019-14945","title":"Ultimate Member <= 2.0.53 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eedf009-116c-4a98-8b84-e01bd35e7e60?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.53","to_inclusive":true,"patched_in":"2.0.54"}],"published":"2019-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6eef5549-3f89-4d6f-8c4e-6e4ee6082042","source":"wordfence","cve":"CVE-2024-0509","title":"WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6eef5549-3f89-4d6f-8c4e-6e4ee6082042?source=api-prod","affected":[{"type":"plugin","slug":"wp-404-auto-redirect-to-similar-post","name":"WP 404 Auto Redirect to Similar Post","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-02-05T00:00:00Z","updated":"2024-07-29T21:36:33Z"},{"id":"wordfence:6ef18e0e-8fad-464b-943b-54fbbe169ce9","source":"wordfence","cve":"CVE-2015-7357","title":"uDesign Theme 2.3.0 - 2.7.9 - Unauthenticated DOM Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ef18e0e-8fad-464b-943b-54fbbe169ce9?source=api-prod","affected":[{"type":"theme","slug":"u-design","name":"uDesign - Responsive WordPress Theme","from":"2.3.0","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2015-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ef48df5-dc3f-45d2-87af-35a3a0ed8c2d","source":"wordfence","cve":"CVE-2022-2118","title":"404s <= 3.4.9 - Administrator+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ef48df5-dc3f-45d2-87af-35a3a0ed8c2d?source=api-prod","affected":[{"type":"plugin","slug":"404s","name":"404s","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ef70f07-ef60-4842-91a9-879478d3f4d2","source":"wordfence","cve":"CVE-2022-0674","title":"Kunze Law < 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ef70f07-ef60-4842-91a9-879478d3f4d2?source=api-prod","affected":[{"type":"plugin","slug":"kunze-law","name":"Kunze Law","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ef8bf27-3b20-4d90-8d29-b9713d2c41d6","source":"wordfence","cve":"","title":"Contact Form Maker <= 1.7.30 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ef8bf27-3b20-4d90-8d29-b9713d2c41d6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-maker","name":"Contact Form by WD \u2013 responsive drag & drop contact form builder tool","from":"*","from_inclusive":true,"to":"1.7.31","to_inclusive":false,"patched_in":"1.7.31"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ef9a757-625b-417a-b0ec-f13e2ff4f0f4","source":"wordfence","cve":"CVE-2022-4656","title":"WP Visitor Statistics (Real Time Traffic) <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ef9a757-625b-417a-b0ec-f13e2ff4f0f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6efadbe7-ee9b-44cb-b7c6-4c38a872abf2","source":"wordfence","cve":"CVE-2024-31298","title":"User Spam Remover <= 1.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6efadbe7-ee9b-44cb-b7c6-4c38a872abf2?source=api-prod","affected":[{"type":"plugin","slug":"user-spam-remover","name":"User Spam Remover","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:31:52Z"},{"id":"wordfence:6efc3120-4eb0-4816-85ff-afe0aa8adbf0","source":"wordfence","cve":"CVE-2018-25106","title":"NebulaX < 5.0 - Unauthenticated SQL Injection","severity":"medium","cvss":6.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6efc3120-4eb0-4816-85ff-afe0aa8adbf0?source=api-prod","affected":[{"type":"plugin","slug":"NebulaX","name":"NebulaX Theme","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2018-01-04T00:00:00Z","updated":"2025-01-17T14:01:09Z"},{"id":"wordfence:6f00bbab-ef84-42cf-baa7-23c434416981","source":"wordfence","cve":"CVE-2024-3591","title":"Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f00bbab-ef84-42cf-baa7-23c434416981?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":"8.6.5"}],"published":"2024-02-10T00:00:00Z","updated":"2024-08-06T13:43:51Z"},{"id":"wordfence:6f00dfd7-3194-4459-b895-f16d3aa8d66f","source":"wordfence","cve":"","title":"Responsive Image Slider, Photo Gallery And Carousel < 1.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f00dfd7-3194-4459-b895-f16d3aa8d66f?source=api-prod","affected":[{"type":"plugin","slug":"slider-factory","name":"Slider, Image Slider & Carousel by Slider Factory \u2013 Responsive Slideshow, Video Slider","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f01ecab-2dfe-45d2-9d9a-ba1e30c7d75f","source":"wordfence","cve":"CVE-2023-50876","title":"Molongui <= 4.7.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f01ecab-2dfe-45d2-9d9a-ba1e30c7d75f?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f036c2d-eaa4-4b1a-a58b-18aa9a9cc9bd","source":"wordfence","cve":"CVE-2025-46434","title":"The Plus Addons for Elementor Pro < 6.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f036c2d-eaa4-4b1a-a58b-18aa9a9cc9bd?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":false,"patched_in":"6.3.7"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:25:12Z"},{"id":"wordfence:6f05b58a-3cab-4069-ae9e-fec82bb5cd47","source":"wordfence","cve":"CVE-2023-0146","title":"Naver Map <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f05b58a-3cab-4069-ae9e-fec82bb5cd47?source=api-prod","affected":[{"type":"plugin","slug":"naver-map","name":"Naver Map","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f099519-0ebc-45f5-93a9-2b32d51c874f","source":"wordfence","cve":"CVE-2024-56048","title":"WPLMS <= 1.9.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f099519-0ebc-45f5-93a9-2b32d51c874f?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.9.1"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:55:17Z"},{"id":"wordfence:6f0a332f-b761-44b3-86e8-82411455ba3e","source":"wordfence","cve":"CVE-2024-3815","title":"Newspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f0a332f-b761-44b3-86e8-82411455ba3e?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"12.6.5","to_inclusive":true,"patched_in":"12.6.6"}],"published":"2024-04-18T00:00:00Z","updated":"2024-06-15T02:01:59Z"},{"id":"wordfence:6f1345b0-a43e-475f-9d19-78600f17b8e6","source":"wordfence","cve":"CVE-2026-49052","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor <= 3.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1345b0-a43e-475f-9d19-78600f17b8e6?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-18T18:30:21Z"},{"id":"wordfence:6f14f19d-95b3-474b-a2ea-d846c85644cd","source":"wordfence","cve":"CVE-2023-29235","title":"Maintenance Switch <= 1.5.2 - Cross-Site Request Forgery via 'admin_action_request'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f14f19d-95b3-474b-a2ea-d846c85644cd?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-switch","name":"Maintenance Switch","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f17d54b-4890-455b-832f-9fa2376ab819","source":"wordfence","cve":"CVE-2024-37232","title":"Hercules Core  <= 6.5 - Missing Authorization to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f17d54b-4890-455b-832f-9fa2376ab819?source=api-prod","affected":[{"type":"plugin","slug":"hercules-core","name":"Hercules Core","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.7"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:54:58Z"},{"id":"wordfence:6f1856bc-6d57-416e-86e9-9114bbbe5c8d","source":"wordfence","cve":"","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 3.5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1856bc-6d57-416e-86e9-9114bbbe5c8d?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":false,"patched_in":"3.5.4"}],"published":"2013-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f1a1acc-6144-4e91-b552-240a505fad0f","source":"wordfence","cve":"CVE-2024-50529","title":"Training \u2013 Courses <= 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1a1acc-6144-4e91-b552-240a505fad0f?source=api-prod","affected":[{"type":"plugin","slug":"training","name":"Training \u2013 Courses","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T13:27:37Z"},{"id":"wordfence:6f1d2fe6-6cee-4e21-85ac-37d2d48156d2","source":"wordfence","cve":"CVE-2026-100184","title":"Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1d2fe6-6cee-4e21-85ac-37d2d48156d2?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.5.1.3","to_inclusive":true,"patched_in":"5.5.1.4"}],"published":"2026-09-30T20:14:54Z","updated":"2026-10-01T08:28:44Z"},{"id":"wordfence:6f1e0b89-9bac-4a3b-bb8c-278449789214","source":"wordfence","cve":"CVE-2026-5727","title":"Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1e0b89-9bac-4a3b-bb8c-278449789214?source=api-prod","affected":[{"type":"plugin","slug":"hello-plus","name":"Hello Plus","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2026-10-09T15:51:02Z","updated":"2026-10-10T04:26:45Z"},{"id":"wordfence:6f1e1af1-020c-4e39-b28e-e350c3e97ff0","source":"wordfence","cve":"CVE-2026-119531","title":"Live Composer \u2013 Free WordPress Website Builder < 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1e1af1-020c-4e39-b28e-e350c3e97ff0?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.24","to_inclusive":false,"patched_in":"2.1.24"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:29Z"},{"id":"wordfence:6f1e3586-99f7-4cac-bbb2-1a6406c4f8a4","source":"wordfence","cve":"CVE-2022-47174","title":"Performance Lab <= 2.2.0 - Cross-Site Request Forgery via dismiss-wp-pointer","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1e3586-99f7-4cac-bbb2-1a6406c4f8a4?source=api-prod","affected":[{"type":"plugin","slug":"performance-lab","name":"Performance Lab","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-05-18T00:00:00Z","updated":"2024-04-17T13:01:55Z"},{"id":"wordfence:6f1f479c-9a29-4a99-8459-14082f10807f","source":"wordfence","cve":"CVE-2026-123471","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1f479c-9a29-4a99-8459-14082f10807f?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:21:06Z"},{"id":"wordfence:6f1fc61a-9760-430e-a8ba-139ffef1a60d","source":"wordfence","cve":"CVE-2025-62753","title":"MAS Videos <= 1.3.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1fc61a-9760-430e-a8ba-139ffef1a60d?source=api-prod","affected":[{"type":"plugin","slug":"masvideos","name":"MAS Videos","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-12-30T00:00:00Z","updated":"2026-10-28T21:09:32Z"},{"id":"wordfence:6f21955b-1fd2-4d92-acfd-07fc1ff194fa","source":"wordfence","cve":"CVE-2024-32452","title":"WP EasyCart <= 5.5.19 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f21955b-1fd2-4d92-acfd-07fc1ff194fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.5.19","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:03:08Z"},{"id":"wordfence:6f24c2f1-be36-4d64-8f2e-ce27dfc697e3","source":"wordfence","cve":"CVE-2025-22665","title":"RapidLoad <= 2.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f24c2f1-be36-4d64-8f2e-ce27dfc697e3?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:10:31Z"},{"id":"wordfence:6f25b0cc-60ec-49a0-8356-fd3fba97e987","source":"wordfence","cve":"CVE-2024-13742","title":"iControlWP \u2013 Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f25b0cc-60ec-49a0-8356-fd3fba97e987?source=api-prod","affected":[{"type":"plugin","slug":"worpit-admin-dashboard-plugin","name":"iControlWP","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2025-01-30T00:41:10Z","updated":"2025-01-31T14:44:16Z"},{"id":"wordfence:6f26b04f-2a25-40a6-9b2c-27d9970acb8f","source":"wordfence","cve":"CVE-2023-51529","title":"HT Mega <= 2.3.3 - Cross-Site Request Forgery via Several Functions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f26b04f-2a25-40a6-9b2c-27d9970acb8f?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f2b3c4a-8dc5-459b-ae55-d11fc988dbe8","source":"wordfence","cve":"CVE-2025-64238","title":"WPS Bidouille <= 1.33.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2b3c4a-8dc5-459b-ae55-d11fc988dbe8?source=api-prod","affected":[{"type":"plugin","slug":"wps-bidouille","name":"WPS Bidouille","from":"*","from_inclusive":true,"to":"1.33.1","to_inclusive":true,"patched_in":"1.33.2"}],"published":"2025-12-02T00:00:00Z","updated":"2026-01-05T14:37:06Z"},{"id":"wordfence:6f2b46a9-d228-43b4-84af-d56218076087","source":"wordfence","cve":"CVE-2024-13470","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2b46a9-d228-43b4-84af-d56218076087?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.24","to_inclusive":true,"patched_in":"3.8.25"}],"published":"2025-01-29T18:57:39Z","updated":"2025-01-30T07:23:06Z"},{"id":"wordfence:6f2b4ac7-f888-408b-a77a-bd73ac8e967d","source":"wordfence","cve":"CVE-2023-23833","title":"Drop Shadow Boxes <= 1.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2b4ac7-f888-408b-a77a-bd73ac8e967d?source=api-prod","affected":[{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f2cf7a3-5710-4db0-b75a-44d4073ee344","source":"wordfence","cve":"CVE-2024-49326","title":"Affiliator <= 2.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2cf7a3-5710-4db0-b75a-44d4073ee344?source=api-prod","affected":[{"type":"plugin","slug":"affiliator-lite","name":"Affiliator","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T15:17:06Z"},{"id":"wordfence:6f2ef250-f951-4408-ac42-3272ddf46530","source":"wordfence","cve":"CVE-2026-1095","title":"Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2ef250-f951-4408-ac42-3272ddf46530?source=api-prod","affected":[{"type":"plugin","slug":"canto-testimonials","name":"Canto Testimonials","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:26:16Z","updated":"2026-01-24T07:26:43Z"},{"id":"wordfence:6f30d8bc-0235-493d-b7c3-1994a41f67a6","source":"wordfence","cve":"CVE-2026-28076","title":"Guff <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f30d8bc-0235-493d-b7c3-1994a41f67a6?source=api-prod","affected":[{"type":"theme","slug":"guff","name":"Guff - Blog & Magazine Ghost Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:06:51Z"},{"id":"wordfence:6f34b94f-ea72-4a42-abea-2f2eb565ffdd","source":"wordfence","cve":"CVE-2023-5119","title":"Forminator \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f34b94f-ea72-4a42-abea-2f2eb565ffdd?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.26.0","to_inclusive":true,"patched_in":"1.27.0"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f359d02-d4ce-4045-9e79-ae0f92b84766","source":"wordfence","cve":"CVE-2024-12293","title":"User Role Editor <= 4.64.3 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f359d02-d4ce-4045-9e79-ae0f92b84766?source=api-prod","affected":[{"type":"plugin","slug":"user-role-editor","name":"User Role Editor","from":"*","from_inclusive":true,"to":"4.64.3","to_inclusive":true,"patched_in":"4.64.4"}],"published":"2024-12-16T19:51:53Z","updated":"2024-12-17T08:22:47Z"},{"id":"wordfence:6f36d866-aa94-478b-8b62-0906bc95e413","source":"wordfence","cve":"","title":"Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f36d866-aa94-478b-8b62-0906bc95e413?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f38d7b7-6df6-47a2-a9ba-87ef1f039e44","source":"wordfence","cve":"CVE-2026-4394","title":"Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f38d7b7-6df6-47a2-a9ba-87ef1f039e44?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.30","to_inclusive":true,"patched_in":"2.9.31"}],"published":"2026-04-07T10:47:07Z","updated":"2026-04-07T23:25:28Z"},{"id":"wordfence:6f3bcf70-2900-4a13-9ed4-264a15af9725","source":"wordfence","cve":"CVE-2026-9635","title":"WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f3bcf70-2900-4a13-9ed4-264a15af9725?source=api-prod","affected":[{"type":"plugin","slug":"wp-shortcode","name":"WP Shortcode by MyThemeShop","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T18:43:40Z","updated":"2026-07-29T15:13:40Z"},{"id":"wordfence:6f3e4e53-3a4a-4b9d-845c-927a59e03488","source":"wordfence","cve":"CVE-2023-51372","title":"HashBar \u2013 WordPress Notification Bar <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f3e4e53-3a4a-4b9d-845c-927a59e03488?source=api-prod","affected":[{"type":"plugin","slug":"hashbar-wp-notification-bar","name":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f3fd683-9522-4e41-9ae7-751837c1844f","source":"wordfence","cve":"CVE-2025-22809","title":"PDF Catalog Woocommerce <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f3fd683-9522-4e41-9ae7-751837c1844f?source=api-prod","affected":[{"type":"plugin","slug":"pdf-catalog-woocommerce","name":"PDF Catalog for WooCommerce \u2013 Product Catalog & Price List Generator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:02:46Z"},{"id":"wordfence:6f43da15-cec5-47e5-8054-77ea2470c93d","source":"wordfence","cve":"CVE-2026-116545","title":"All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f43da15-cec5-47e5-8054-77ea2470c93d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-11-05T21:57:57Z","updated":"2026-11-06T11:17:37Z"},{"id":"wordfence:6f4424be-d63d-431d-a237-2bff6c4a647a","source":"wordfence","cve":"CVE-2024-34379","title":"Restaurant and Cafe <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f4424be-d63d-431d-a237-2bff6c4a647a?source=api-prod","affected":[{"type":"theme","slug":"restaurant-and-cafe","name":"Restaurant and Cafe","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:09:09Z"},{"id":"wordfence:6f476fc6-54c8-438f-ae6a-d29d1ffb4fbc","source":"wordfence","cve":"CVE-2025-32589","title":"Flexi \u2013 Guest Submit <= 4.28 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f476fc6-54c8-438f-ae6a-d29d1ffb4fbc?source=api-prod","affected":[{"type":"plugin","slug":"flexi","name":"Flexi \u2013 Guest Submit","from":"*","from_inclusive":true,"to":"4.28","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:25:58Z"},{"id":"wordfence:6f4835fb-72ae-498e-940e-b255a4c5ca0b","source":"wordfence","cve":"CVE-2025-64636","title":"Donation Thermometer <= 2.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f4835fb-72ae-498e-940e-b255a4c5ca0b?source=api-prod","affected":[{"type":"plugin","slug":"donation-thermometer","name":"Donation Thermometer","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-08T20:47:19Z"},{"id":"wordfence:6f4b15f4-9002-4cae-9d69-f327b8e67914","source":"wordfence","cve":"CVE-2026-11563","title":"Word Count and Social Shares <= 1.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f4b15f4-9002-4cae-9d69-f327b8e67914?source=api-prod","affected":[{"type":"plugin","slug":"word-count-and-social-shares","name":"Word Count and Social Shares","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-29T21:40:57Z"},{"id":"wordfence:6f4ea8c9-4e4b-41a7-a2ca-826cbd7d8c23","source":"wordfence","cve":"CVE-2025-32137","title":"s2Member <= 250419 - Authenticated (Administrator+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f4ea8c9-4e4b-41a7-a2ca-826cbd7d8c23?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"250419","to_inclusive":true,"patched_in":"250424"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-25T14:46:32Z"},{"id":"wordfence:6f500eb7-64a2-4734-9688-fbae84f280bc","source":"wordfence","cve":"CVE-2025-1619","title":"GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f500eb7-64a2-4734-9688-fbae84f280bc?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.6","to_inclusive":true,"patched_in":"4.15.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-24T20:01:14Z"},{"id":"wordfence:6f524163-4d4c-40fc-b58a-311f1f6cac15","source":"wordfence","cve":"CVE-2025-5529","title":"Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f524163-4d4c-40fc-b58a-311f1f6cac15?source=api-prod","affected":[{"type":"theme","slug":"educenter","name":"Educenter","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-07-25T19:14:01Z","updated":"2025-07-28T14:41:34Z"},{"id":"wordfence:6f526959-be34-48d1-8aa1-e36f7708bd20","source":"wordfence","cve":"CVE-2016-10942","title":"Podlove Podcast Publisher < 2.3.16 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f526959-be34-48d1-8aa1-e36f7708bd20?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":false,"patched_in":"2.3.16"}],"published":"2016-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f52fbbb-5ef0-438f-80a6-7ef64fae9fe6","source":"wordfence","cve":"CVE-2026-24527","title":"Autoship Cloud for WooCommerce Subscription Products <= 2.14.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f52fbbb-5ef0-438f-80a6-7ef64fae9fe6?source=api-prod","affected":[{"type":"plugin","slug":"autoship-cloud","name":"Autoship Cloud for WooCommerce Subscription Products","from":"*","from_inclusive":true,"to":"2.14.3","to_inclusive":true,"patched_in":"2.14.4"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-18T14:06:26Z"},{"id":"wordfence:6f54053e-30ff-449b-b696-92d503011a4d","source":"wordfence","cve":"CVE-2025-12878","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f54053e-30ff-449b-b696-92d503011a4d?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.13.1.2","to_inclusive":true,"patched_in":"3.13.1.3"}],"published":"2025-11-18T17:41:21Z","updated":"2025-11-19T05:45:14Z"},{"id":"wordfence:6f54fb59-03c1-45e9-a498-1fa1409c4466","source":"wordfence","cve":"CVE-2023-2009","title":"Pretty Url < 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f54fb59-03c1-45e9-a498-1fa1409c4466?source=api-prod","affected":[{"type":"plugin","slug":"pretty-url","name":"Pretty Url","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2023-04-18T00:00:00Z","updated":"2026-03-17T21:18:00Z"},{"id":"wordfence:6f561cce-1c0c-40f5-abba-ada8bc503aa8","source":"wordfence","cve":"CVE-2021-24340","title":"WP Statistics <= 13.0.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f561cce-1c0c-40f5-abba-ada8bc503aa8?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.0.8","to_inclusive":false,"patched_in":"13.0.8"}],"published":"2021-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f57d5ec-bc2d-4dc4-b1b2-c5919986d198","source":"wordfence","cve":"CVE-2026-1754","title":"personal-authors-category <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f57d5ec-bc2d-4dc4-b1b2-c5919986d198?source=api-prod","affected":[{"type":"plugin","slug":"personal-authors-category","name":"personal-authors-category","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T16:22:13Z","updated":"2026-02-14T04:35:41Z"},{"id":"wordfence:6f589b5d-9cdb-4521-bc60-c8f19d0ef982","source":"wordfence","cve":"CVE-2024-2304","title":"Animated Headline <= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f589b5d-9cdb-4521-bc60-c8f19d0ef982?source=api-prod","affected":[{"type":"plugin","slug":"animated-headline","name":"Animated Headline","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-19T00:00:00Z","updated":"2024-05-31T15:30:24Z"},{"id":"wordfence:6f593dce-4b56-46c0-becd-75fd16f165a8","source":"wordfence","cve":"CVE-2025-1284","title":"Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f593dce-4b56-46c0-becd-75fd16f165a8?source=api-prod","affected":[{"type":"plugin","slug":"xc-woo-google-cloud-print","name":"Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:39:08Z","updated":"2025-04-24T08:23:48Z"},{"id":"wordfence:6f598cfc-4d41-4d22-95f0-47efdb7d07a2","source":"wordfence","cve":"CVE-2024-11278","title":"GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f598cfc-4d41-4d22-95f0-47efdb7d07a2?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-attachments","name":"forumAttachments for bbPress","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2024-11-19T16:03:01Z","updated":"2024-11-20T04:31:28Z"},{"id":"wordfence:6f5c4194-4f97-4f85-af90-e983ba9ce3a6","source":"wordfence","cve":"CVE-2026-2518","title":"FastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f5c4194-4f97-4f85-af90-e983ba9ce3a6?source=api-prod","affected":[{"type":"theme","slug":"fastx","name":"FastX","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-21T15:59:58Z","updated":"2026-05-22T04:29:03Z"},{"id":"wordfence:6f5f6931-aeda-4499-a1a4-9e80f730dad4","source":"wordfence","cve":"CVE-2025-68516","title":"Tablesome <= 1.1.35.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f5f6931-aeda-4499-a1a4-9e80f730dad4?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.35.1","to_inclusive":true,"patched_in":"1.1.35.2"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T13:57:23Z"},{"id":"wordfence:6f60d93e-a965-4946-91ef-7735a23549da","source":"wordfence","cve":"CVE-2026-112355","title":"MembershipWorks \u2013 Membership, Events & Directory <= 6.16 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f60d93e-a965-4946-91ef-7735a23549da?source=api-prod","affected":[{"type":"plugin","slug":"memberfindme","name":"MembershipWorks \u2013 Membership, Events & Directory","from":"*","from_inclusive":true,"to":"6.16","to_inclusive":true,"patched_in":"6.17"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:30:02Z"},{"id":"wordfence:6f63d2c4-cbae-4177-8494-daca96449ecc","source":"wordfence","cve":"CVE-2025-14386","title":"Search Atlas SEO \u2013 Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f63d2c4-cbae-4177-8494-daca96449ecc?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"2.4.4","from_inclusive":true,"to":"2.5.15","to_inclusive":true,"patched_in":"2.5.16"}],"published":"2026-01-27T21:31:02Z","updated":"2026-04-09T20:59:43Z"},{"id":"wordfence:6f643ffe-a904-47fd-9f76-01acacfebef9","source":"wordfence","cve":"CVE-2025-62762","title":"SMTP Mail <= 1.3.49 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f643ffe-a904-47fd-9f76-01acacfebef9?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mail","name":"SMTP Mail","from":"*","from_inclusive":true,"to":"1.3.49","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-10T15:55:18Z"},{"id":"wordfence:6f65d5c4-6f53-4836-9130-c9f4ed3be893","source":"wordfence","cve":"CVE-2025-6895","title":"MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f65d5c4-6f53-4836-9130-c9f4ed3be893?source=api-prod","affected":[{"type":"plugin","slug":"melapress-login-security","name":"Melapress Login Security","from":"2.1.0","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-07-25T16:23:06Z","updated":"2025-07-26T04:25:25Z"},{"id":"wordfence:6f6883e4-3de6-4ca9-a26c-0b4f3bd5b70f","source":"wordfence","cve":"","title":"RegistrationMagic - Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f6883e4-3de6-4ca9-a26c-0b4f3bd5b70f?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"3.7.9.2","to_inclusive":true,"patched_in":"3.8.0.9"}],"published":"2017-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f69d100-b737-430c-a7cd-33901db18e25","source":"wordfence","cve":"CVE-2025-62957","title":"NikanWP WooCommerce Reporting <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f69d100-b737-430c-a7cd-33901db18e25?source=api-prod","affected":[{"type":"plugin","slug":"wc-reports-lite","name":"WooReports \u2014 Advanced Reporting for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-10-15T00:00:00Z","updated":"2026-04-15T13:31:27Z"},{"id":"wordfence:6f6aa094-6bac-463f-b46d-c65f591abbb3","source":"wordfence","cve":"CVE-2022-43497","title":"WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f6aa094-6bac-463f-b46d-c65f591abbb3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f6ea94a-c8c7-4ff9-9fdd-a40acd6ec4f9","source":"wordfence","cve":"CVE-2017-18634","title":"Newspaper - News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f6ea94a-c8c7-4ff9-9fdd-a40acd6ec4f9?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"6.7.2","to_inclusive":false,"patched_in":"6.7.2"}],"published":"2016-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f6ece0e-7c7c-4c9b-b860-3b279e98c087","source":"wordfence","cve":"CVE-2021-24634","title":"Recipe Card Blocks by WPZOOM <= 2.8.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f6ece0e-7c7c-4c9b-b860-3b279e98c087?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f6f8412-f1b1-4566-ad31-f006c19de948","source":"wordfence","cve":"CVE-2022-44625","title":"Cyklodev WP Notify <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f6f8412-f1b1-4566-ad31-f006c19de948?source=api-prod","affected":[{"type":"plugin","slug":"cyklodev-wp-notify","name":"Cyklodev WP Notify","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-11-07T00:00:00Z","updated":"2026-02-26T14:50:04Z"},{"id":"wordfence:6f721aa1-d12f-4829-8e82-61f9af6a3519","source":"wordfence","cve":"CVE-2016-10884","title":"Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f721aa1-d12f-4829-8e82-61f9af6a3519?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2016-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f7386bf-3968-46b8-9c47-5fbc41801e04","source":"wordfence","cve":"CVE-2023-7125","title":"Community by PeepSo <= 6.3.1.1 - Cross-Site Request Forgery to User Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7386bf-3968-46b8-9c47-5fbc41801e04?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.3.1.1","to_inclusive":true,"patched_in":"6.3.1.2"}],"published":"2024-01-09T00:00:00Z","updated":"2024-04-11T14:44:22Z"},{"id":"wordfence:6f73b12b-813d-49fa-84a0-3345023a16c6","source":"wordfence","cve":"","title":"RSVP and Event Management <= 2.7.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f73b12b-813d-49fa-84a0-3345023a16c6?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":false,"patched_in":"2.7.5"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f76fd88-95a3-4309-97d2-35c83bd09e55","source":"wordfence","cve":"CVE-2026-16623","title":"Create Block <= 2.9.0 - Code Injection to Authenticated (Admin+) PHP Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f76fd88-95a3-4309-97d2-35c83bd09e55?source=api-prod","affected":[{"type":"plugin","slug":"create-block-theme","name":"Create Block Theme","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:27:54Z"},{"id":"wordfence:6f7742e0-fae8-4fbc-9f98-9374300a528e","source":"wordfence","cve":"CVE-2026-27041","title":"Unlimited Elements for Elementor (Premium) <= 1.4.72 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7742e0-fae8-4fbc-9f98-9374300a528e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor-premium","name":"Unlimited Elements for Elementor (Premium)","from":"*","from_inclusive":true,"to":"1.4.72","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:56:23Z"},{"id":"wordfence:6f77f10b-f142-4859-a941-0fbde6ef7fdb","source":"wordfence","cve":"CVE-2025-4054","title":"Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f77f10b-f142-4859-a941-0fbde6ef7fdb?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.27.4","to_inclusive":true,"patched_in":"2.27.5"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.24.3","to_inclusive":true,"patched_in":"4.24.4"}],"published":"2025-05-06T13:45:18Z","updated":"2025-05-12T14:30:02Z"},{"id":"wordfence:6f781533-b633-4452-95bd-c32ed0de2ea9","source":"wordfence","cve":"CVE-2023-0254","title":"Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership-wp-user-import","name":"Simple Membership WP user Import","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f782dd7-df49-4c3b-b6d9-de618ab32b87","source":"wordfence","cve":"CVE-2022-3036","title":"Gettext override translations <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f782dd7-df49-4c3b-b6d9-de618ab32b87?source=api-prod","affected":[{"type":"plugin","slug":"gettext-override-translations","name":"Gettext override translations","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f789ff9-5d86-4911-8b2f-2a425393c61d","source":"wordfence","cve":"CVE-2023-51670","title":"FunnelKit Checkout <= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f789ff9-5d86-4911-8b2f-2a425393c61d?source=api-prod","affected":[{"type":"plugin","slug":"woofunnels-aero-checkout","name":"FunnelKit Checkout","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f7c164f-2f78-4857-94b9-077c2dea13df","source":"wordfence","cve":"CVE-2024-0961","title":"SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7c164f-2f78-4857-94b9-077c2dea13df?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.58.1","to_inclusive":true,"patched_in":"1.58.2"}],"published":"2024-01-29T00:00:00Z","updated":"2024-02-05T21:21:48Z"},{"id":"wordfence:6f7dc3b1-8a78-4b4d-a72f-fba34e8854e5","source":"wordfence","cve":"CVE-2026-39743","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7dc3b1-8a78-4b4d-a72f-fba34e8854e5?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:39:53Z"},{"id":"wordfence:6f7e0aa7-8834-4ff1-9ced-5d740936c721","source":"wordfence","cve":"CVE-2021-24830","title":"Advanced Access Manager <= 6.7.9 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7e0aa7-8834-4ff1-9ced-5d740936c721?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":false,"patched_in":"6.8.0"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f7e632f-eada-4a3f-9e92-ba00c6aa503e","source":"wordfence","cve":"CVE-2022-3408","title":"WP Word Count <= 3.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f7e632f-eada-4a3f-9e92-ba00c6aa503e?source=api-prod","affected":[{"type":"plugin","slug":"wp-word-count","name":"WP Word Count","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2022-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f810102-cf25-4898-a3a6-3cdc9a96aaea","source":"wordfence","cve":"CVE-2025-0935","title":"Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f810102-cf25-4898-a3a6-3cdc9a96aaea?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.3.0","to_inclusive":true,"patched_in":"8.3.1"}],"published":"2025-02-14T20:08:23Z","updated":"2025-02-15T08:25:06Z"},{"id":"wordfence:6f82cab3-f548-4f23-843b-3cbb29313caf","source":"wordfence","cve":"CVE-2026-13144","title":"Travel <= 12.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f82cab3-f548-4f23-843b-3cbb29313caf?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":true,"patched_in":"12.0.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:07:58Z"},{"id":"wordfence:6f837d6b-d1fa-4019-892a-dca3c0f29ca7","source":"wordfence","cve":"CVE-2024-1119","title":"Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f837d6b-d1fa-4019-892a-dca3c0f29ca7?source=api-prod","affected":[{"type":"plugin","slug":"order-tip-woo","name":"Order Tip for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T06:48:28Z"},{"id":"wordfence:6f8437a8-a034-40b8-bc61-d5c495865cbd","source":"wordfence","cve":"CVE-2025-57894","title":"WPPizza <= 3.19.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8437a8-a034-40b8-bc61-d5c495865cbd?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.19.8","to_inclusive":true,"patched_in":"3.19.8.1"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:42:19Z"},{"id":"wordfence:6f849ec6-1c90-4f98-a367-fea87ddc5870","source":"wordfence","cve":"CVE-2026-8871","title":"Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f849ec6-1c90-4f98-a367-fea87ddc5870?source=api-prod","affected":[{"type":"plugin","slug":"formidable-kinetic","name":"Formidable Kinetic","from":"*","from_inclusive":true,"to":"1.1.01","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:25:45Z","updated":"2026-05-27T05:31:26Z"},{"id":"wordfence:6f8514c9-0e11-4e26-ba0b-1d08a990b56c","source":"wordfence","cve":"CVE-2023-2354","title":"CHP Ads Block Detector <= 3.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8514c9-0e11-4e26-ba0b-1d08a990b56c?source=api-prod","affected":[{"type":"plugin","slug":"chp-ads-block-detector","name":"CHP Ads Block Detector","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f852a76-62fb-4797-80d3-1628e471a40f","source":"wordfence","cve":"CVE-2024-52383","title":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f852a76-62fb-4797-80d3-1628e471a40f?source=api-prod","affected":[{"type":"plugin","slug":"ai-auto-tool","name":"Ai Auto Tool Content Writing Assistant All in One","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:48:45Z"},{"id":"wordfence:6f853657-1801-4d63-89b8-b2132212a205","source":"wordfence","cve":"CVE-2025-6080","title":"WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f853657-1801-4d63-89b8-b2132212a205?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:55:07Z","updated":"2025-08-16T03:38:50Z"},{"id":"wordfence:6f854ffc-244b-45c3-94ce-198e85c11869","source":"wordfence","cve":"CVE-2025-62950","title":"Contest Gallery <= 28.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f854ffc-244b-45c3-94ce-198e85c11869?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.0.0","to_inclusive":true,"patched_in":"28.0.1"}],"published":"2025-10-12T00:00:00Z","updated":"2025-10-30T14:56:38Z"},{"id":"wordfence:6f8570c5-1e4d-4df9-bd91-ccdf8e72afbc","source":"wordfence","cve":"CVE-2025-55709","title":"Visual Composer Website Builder <= 45.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8570c5-1e4d-4df9-bd91-ccdf8e72afbc?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.13.0","to_inclusive":true,"patched_in":"45.15.0"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:46:40Z"},{"id":"wordfence:6f8814b0-6818-47c2-9f2a-8fe12485bd33","source":"wordfence","cve":"CVE-2024-47361","title":"Elementor Addon Elements <= 1.13.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8814b0-6818-47c2-9f2a-8fe12485bd33?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":true,"patched_in":"1.13.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:23:09Z"},{"id":"wordfence:6f8945e9-51db-46aa-b198-3762b6628553","source":"wordfence","cve":"CVE-2013-2693","title":"WP-Print <= 2.51 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8945e9-51db-46aa-b198-3762b6628553?source=api-prod","affected":[{"type":"plugin","slug":"wp-print","name":"WP-Print","from":"*","from_inclusive":true,"to":"2.52","to_inclusive":false,"patched_in":"2.52"}],"published":"2013-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f89c43c-6729-40c5-bd32-3c328f83e366","source":"wordfence","cve":"CVE-2019-15646","title":"RSVPMaker <= 6.1.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f89c43c-6729-40c5-bd32-3c328f83e366?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.2"}],"published":"2019-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f8a2bb9-5310-4a1f-b21c-253e3d0cb74d","source":"wordfence","cve":"CVE-2024-34427","title":"WP Favorite Posts <= 1.6.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8a2bb9-5310-4a1f-b21c-253e3d0cb74d?source=api-prod","affected":[{"type":"plugin","slug":"wp-favorite-posts","name":"WP Favorite Posts","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:26:50Z"},{"id":"wordfence:6f8b75a1-f0f2-445b-a1c7-1628916470d3","source":"wordfence","cve":"CVE-2023-3962","title":"Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8b75a1-f0f2-445b-a1c7-1628916470d3?source=api-prod","affected":[{"type":"theme","slug":"winters","name":"Winters - WordPress Blog Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f8fa20c-ed7f-40bd-b4b9-555acc889a58","source":"wordfence","cve":"CVE-2025-69375","title":"Portfolio Builder <= 1.2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f8fa20c-ed7f-40bd-b4b9-555acc889a58?source=api-prod","affected":[{"type":"plugin","slug":"swp-portfolio","name":"Portfolio Builder - Elementor Portfolio Addon","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:13:59Z"},{"id":"wordfence:6f90c0d8-ede6-4f24-870f-19e888238e93","source":"wordfence","cve":"CVE-2023-1661","title":"Display post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f90c0d8-ede6-4f24-870f-19e888238e93?source=api-prod","affected":[{"type":"plugin","slug":"display-metadata","name":"Display post meta, term meta, comment meta, and user meta","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-11-19T23:48:57Z"},{"id":"wordfence:6f9152fe-0273-4af3-8dee-ecb96ec7479b","source":"wordfence","cve":"CVE-2025-49330","title":"Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f9152fe-0273-4af3-8dee-ecb96ec7479b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zoho","name":"WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u2013 CRM, Bigin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-06-16T00:00:00Z","updated":"2025-06-25T14:45:55Z"},{"id":"wordfence:6f917973-e207-4ba3-b61b-e562e884fe0f","source":"wordfence","cve":"CVE-2022-36399","title":"Booked < 2.4.4 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f917973-e207-4ba3-b61b-e562e884fe0f?source=api-prod","affected":[{"type":"plugin","slug":"booked","name":"Booked - Appointment Booking for WordPress","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2023-06-27T00:00:00Z","updated":"2026-03-17T21:18:11Z"},{"id":"wordfence:6f946251-c7be-4ef6-885f-8b378c0c234c","source":"wordfence","cve":"CVE-2022-4165","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f946251-c7be-4ef6-885f-8b378c0c234c?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f947843-7a6f-48b0-b3cd-2f3dd1708898","source":"wordfence","cve":"CVE-2018-5659","title":"Coming Soon < 1.1.19 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f947843-7a6f-48b0-b3cd-2f3dd1708898?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":false,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f95c786-900b-4069-8509-fab623f5f988","source":"wordfence","cve":"CVE-2022-1104","title":"Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f95c786-900b-4069-8509-fab623f5f988?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.16.4","to_inclusive":true,"patched_in":"1.16.5"}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f96b3c4-bec4-4249-9a00-5c21d28d252f","source":"wordfence","cve":"CVE-2024-50457","title":"Qode Essential Addons <= 1.6.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f96b3c4-bec4-4249-9a00-5c21d28d252f?source=api-prod","affected":[{"type":"plugin","slug":"qode-essential-addons","name":"Qode Essential Addons","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:00:40Z"},{"id":"wordfence:6f9764e1-0187-4f6e-827c-84daac81872f","source":"wordfence","cve":"CVE-2025-68879","title":"Content Grid Slider <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f9764e1-0187-4f6e-827c-84daac81872f?source=api-prod","affected":[{"type":"plugin","slug":"content-grid-slider","name":"Content Grid Slider","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T19:00:26Z"},{"id":"wordfence:6f998b76-9fa8-47c4-a95b-bdb5db5893e4","source":"wordfence","cve":"CVE-2008-0194","title":"WordPress Core <= 2.0.3 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f998b76-9fa8-47c4-a95b-bdb5db5893e4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2006-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f9a6fc2-0375-480e-8c42-c6b97613bf68","source":"wordfence","cve":"CVE-2013-2010","title":"W3 Total Cache <= 0.9.2.8 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f9a6fc2-0375-480e-8c42-c6b97613bf68?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.2.8","to_inclusive":true,"patched_in":"0.9.2.9"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6f9cedea-086c-479b-a1ae-e124df1e09f1","source":"wordfence","cve":"CVE-2026-57748","title":"Shopify <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6f9cedea-086c-479b-a1ae-e124df1e09f1?source=api-prod","affected":[{"type":"plugin","slug":"shopify-plugin","name":"Shopify","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:06:27Z"},{"id":"wordfence:6fa02ba1-ab10-4a2b-a504-891d416bb1d8","source":"wordfence","cve":"CVE-2025-31887","title":"MyBookProgress by Stormhill Media <= 1.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa02ba1-ab10-4a2b-a504-891d416bb1d8?source=api-prod","affected":[{"type":"plugin","slug":"mybookprogress","name":"MyBookProgress by Stormhill Media","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:53:22Z"},{"id":"wordfence:6fa1299e-308e-47ea-843c-c76b8a412ce9","source":"wordfence","cve":"CVE-2023-46310","title":"wpDiscuz <= 7.6.10 - Unauthenticated Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa1299e-308e-47ea-843c-c76b8a412ce9?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.10","to_inclusive":true,"patched_in":"7.6.11"}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fa49a4a-867c-42a0-8cf6-a28dd9691bb5","source":"wordfence","cve":"CVE-2024-3901","title":"Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa49a4a-867c-42a0-8cf6-a28dd9691bb5?source=api-prod","affected":[{"type":"plugin","slug":"genesis-blocks","name":"Genesis Blocks","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-04-12T00:00:00Z","updated":"2026-09-04T17:19:26Z"},{"id":"wordfence:6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216","source":"wordfence","cve":"CVE-2025-5397","title":"Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2025-10-30T18:40:35Z","updated":"2025-10-31T06:42:54Z"},{"id":"wordfence:6fa5566f-b814-4173-8f7d-9a514397d653","source":"wordfence","cve":"CVE-2026-18466","title":"WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa5566f-b814-4173-8f7d-9a514397d653?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":false,"patched_in":"4.9.8"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:14:31Z"},{"id":"wordfence:6fa560b2-6283-42ab-a482-1e02d08181f8","source":"wordfence","cve":"CVE-2022-45805","title":"Paytm Payment Gateway <= 2.7.3 - Authenticated (Editor+) SQL Injection via 'post'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa560b2-6283-42ab-a482-1e02d08181f8?source=api-prod","affected":[{"type":"plugin","slug":"paytm-payments","name":"Paytm Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fa57a14-1c74-403f-bce3-242c93bc3035","source":"wordfence","cve":"CVE-2026-39612","title":"KuteShop <= 4.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa57a14-1c74-403f-bce3-242c93bc3035?source=api-prod","affected":[{"type":"theme","slug":"kuteshop","name":"kuteshop","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T21:17:53Z"},{"id":"wordfence:6fa5a20e-d3e9-4def-be50-89f5310211f7","source":"wordfence","cve":"CVE-2025-22533","title":"WOOEXIM <= 5.0.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa5a20e-d3e9-4def-be50-89f5310211f7?source=api-prod","affected":[{"type":"plugin","slug":"wooexim","name":"WOOEXIM \u2013 WooCommerce Export Import Plugin","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:55:08Z"},{"id":"wordfence:6fa6a784-f1d4-47d7-9bf8-64b3c4340328","source":"wordfence","cve":"CVE-2025-49930","title":"JetSearch <= 3.5.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa6a784-f1d4-47d7-9bf8-64b3c4340328?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.10","to_inclusive":true,"patched_in":"3.5.10.1"}],"published":"2025-07-18T00:00:00Z","updated":"2025-10-29T19:09:59Z"},{"id":"wordfence:6fa70ddc-9a5c-4001-967a-5aad789c862c","source":"wordfence","cve":"CVE-2023-47651","title":"WP Links Page <= 4.9.4 - Cross-Site Request Forgery via wplf_ajax_update_screenshots","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa70ddc-9a5c-4001-967a-5aad789c862c?source=api-prod","affected":[{"type":"plugin","slug":"wp-links-page","name":"WP Links Page","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fa810af-e620-49e5-9be0-f9fc4d09ed6d","source":"wordfence","cve":"CVE-2026-92098","title":"Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa810af-e620-49e5-9be0-f9fc4d09ed6d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-multi-step-module","name":"Webheadcoder Multi-Step Forms for Contact Form 7","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-10-27T18:42:09Z","updated":"2026-10-28T06:45:14Z"},{"id":"wordfence:6fac6a6f-07ce-4c2d-b223-c661a4dc530a","source":"wordfence","cve":"CVE-2025-31399","title":"CG Scroll To Top <= 3.5 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fac6a6f-07ce-4c2d-b223-c661a4dc530a?source=api-prod","affected":[{"type":"plugin","slug":"cg-scroll-to-top","name":"CG Scroll To Top","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:23:03Z"},{"id":"wordfence:6fad3590-86ab-4737-840e-bdf72612c779","source":"wordfence","cve":"CVE-2025-69057","title":"Eldon <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fad3590-86ab-4737-840e-bdf72612c779?source=api-prod","affected":[{"type":"theme","slug":"eldon","name":"Eldon - Artist Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:47:22Z"},{"id":"wordfence:6faf7e36-52d7-4578-bb71-2b64a761692b","source":"wordfence","cve":"CVE-2023-51513","title":"Geo Controller <= 8.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6faf7e36-52d7-4578-bb71-2b64a761692b?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.5.2","to_inclusive":true,"patched_in":"8.5.3"}],"published":"2023-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fb00ce4-aa82-4479-b7f6-79e7bde098c1","source":"wordfence","cve":"CVE-2025-14798","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2.4","to_inclusive":true,"patched_in":"4.3.2.5"}],"published":"2026-01-19T14:52:42Z","updated":"2026-01-20T03:25:17Z"},{"id":"wordfence:6fb01045-d38f-469f-8aaf-ff8882132acc","source":"wordfence","cve":"","title":"iThemes Sync <= 2.0.17 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-286","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb01045-d38f-469f-8aaf-ff8882132acc?source=api-prod","affected":[{"type":"plugin","slug":"ithemes-sync","name":"Kadence Central \u2013 Site Management, Backups, Security, and Reporting","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":false,"patched_in":"2.0.18"}],"published":"2019-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fb07b77-3d8a-42c6-b62b-9567226333c5","source":"wordfence","cve":"CVE-2025-62088","title":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb07b77-3d8a-42c6-b62b-9567226333c5?source=api-prod","affected":[{"type":"plugin","slug":"wp_scraper","name":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:14:12Z"},{"id":"wordfence:6fb1dd3d-1695-44e9-b8df-e559e53f99b0","source":"wordfence","cve":"CVE-2026-57405","title":"Open Shop <= 1.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb1dd3d-1695-44e9-b8df-e559e53f99b0?source=api-prod","affected":[{"type":"theme","slug":"open-shop","name":"Open Shop","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:27:55Z"},{"id":"wordfence:6fb1e3ea-77ba-440a-a528-b477089101f6","source":"wordfence","cve":"CVE-2026-86611","title":"Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb1e3ea-77ba-440a-a528-b477089101f6?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.70","to_inclusive":true,"patched_in":"3.3.71"},{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"4.0.0","from_inclusive":true,"to":"7.5.8","to_inclusive":true,"patched_in":"3.3.71"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:42:10Z"},{"id":"wordfence:6fb2d9ec-1082-4209-9fc9-6f10ba3a2398","source":"wordfence","cve":"","title":"User Login History <= 1.7.0 - SQL Injection via OrderBy","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb2d9ec-1082-4209-9fc9-6f10ba3a2398?source=api-prod","affected":[{"type":"plugin","slug":"user-login-history","name":"User Login History","from":"1.7.0","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2019-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fb79409-441a-4991-bc0d-c0f46eb72bb9","source":"wordfence","cve":"CVE-2024-37511","title":"Swift Performance Lite <= 2.3.6.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb79409-441a-4991-bc0d-c0f46eb72bb9?source=api-prod","affected":[{"type":"plugin","slug":"swift-performance-lite","name":"Swift Performance Lite","from":"*","from_inclusive":true,"to":"2.3.6.20","to_inclusive":true,"patched_in":"2.3.6.21"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:14:58Z"},{"id":"wordfence:6fb7944a-58ad-4e52-8fe2-6b535517541e","source":"wordfence","cve":"CVE-2025-52791","title":"Knowledge Base &#8211; Knowledge Base Maker <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb7944a-58ad-4e52-8fe2-6b535517541e?source=api-prod","affected":[{"type":"plugin","slug":"knowledge-base-maker","name":"Knowledge Base \u2013 Knowledge Base Maker","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:43:09Z"},{"id":"wordfence:6fb9c8c3-e491-4bca-adeb-b87d9f8f3b32","source":"wordfence","cve":"CVE-2023-47824","title":"Legal Pages <= 1.3.8 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb9c8c3-e491-4bca-adeb-b87d9f8f3b32?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fbcab49-5765-497b-a98e-d87c5b468b11","source":"wordfence","cve":"CVE-2022-23179","title":"Responsive Contact Form Builder & Lead Generation Plugin < 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fbcab49-5765-497b-a98e-d87c5b468b11?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2022-01-05T00:00:00Z","updated":"2024-02-06T16:04:29Z"},{"id":"wordfence:6fbd5ac8-11c0-4628-9a7b-620b17cc8ba6","source":"wordfence","cve":"CVE-2023-22716","title":"OOPSpam Anti-Spam <= 1.1.35 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fbd5ac8-11c0-4628-9a7b-620b17cc8ba6?source=api-prod","affected":[{"type":"plugin","slug":"oopspam-anti-spam","name":"oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fbde737-0730-49a4-a84e-a9c5e0e32af5","source":"wordfence","cve":"CVE-2023-1413","title":"WP VR <= 8.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fbde737-0730-49a4-a84e-a9c5e0e32af5?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fbf6181-28d1-453a-8761-a0d1e0013662","source":"wordfence","cve":"CVE-2026-81428","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fbf6181-28d1-453a-8761-a0d1e0013662?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":false,"patched_in":"2.7.2.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:38:06Z"},{"id":"wordfence:6fbf8a8f-56f7-42ae-bf96-30a2df6da378","source":"wordfence","cve":"CVE-2015-9449","title":"Microblog Poster < 1.6.2 - Authenticated Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fbf8a8f-56f7-42ae-bf96-30a2df6da378?source=api-prod","affected":[{"type":"plugin","slug":"microblog-poster","name":"Microblog Poster \u2013 Auto Publish on Social Media","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2015-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fc0cdbd-dfa0-4aca-a3b9-624bd69c66e1","source":"wordfence","cve":"CVE-2026-93945","title":"Balance <= 1.12.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc0cdbd-dfa0-4aca-a3b9-624bd69c66e1?source=api-prod","affected":[{"type":"theme","slug":"balance","name":"Balance","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:38:54Z"},{"id":"wordfence:6fc15a59-e555-450b-836e-5c3d52451b12","source":"wordfence","cve":"CVE-2024-35639","title":"Simple Spoiler <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc15a59-e555-450b-836e-5c3d52451b12?source=api-prod","affected":[{"type":"plugin","slug":"simple-spoiler","name":"Simple Spoiler","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-05-30T00:00:00Z","updated":"2024-09-13T13:18:04Z"},{"id":"wordfence:6fc1be7b-cd9e-4dc0-81b2-4bae171fa1cd","source":"wordfence","cve":"CVE-2025-23546","title":"RDP inGroups+ <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc1be7b-cd9e-4dc0-81b2-4bae171fa1cd?source=api-prod","affected":[{"type":"plugin","slug":"rdp-ingroups","name":"RDP inGroups+","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:03:31Z"},{"id":"wordfence:6fc2b2a5-00b0-424e-8678-c6b5cd76baec","source":"wordfence","cve":"CVE-2023-52228","title":"Beds24 Online Booking <= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc2b2a5-00b0-424e-8678-c6b5cd76baec?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.24","to_inclusive":true,"patched_in":"2.0.25"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-24T13:36:16Z"},{"id":"wordfence:6fc38f0b-bf13-4d01-a4b3-38a43fc726d6","source":"wordfence","cve":"CVE-2026-116624","title":"Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc38f0b-bf13-4d01-a4b3-38a43fc726d6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-members","name":"Advanced Members for ACF","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-05T21:55:11Z","updated":"2026-11-06T11:17:38Z"},{"id":"wordfence:6fc53814-05d6-4c8f-9e1d-ecb0f19dd7ab","source":"wordfence","cve":"CVE-2025-60245","title":"User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc53814-05d6-4c8f-9e1d-ecb0f19dd7ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2025-05-19T00:00:00Z","updated":"2025-12-19T14:59:17Z"},{"id":"wordfence:6fc6246e-0a39-431f-a5b1-c1a84c48817b","source":"wordfence","cve":"CVE-2026-97630","title":"FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc6246e-0a39-431f-a5b1-c1a84c48817b?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.54.7212","to_inclusive":true,"patched_in":"7.5.55.7212"}],"published":"2026-10-09T15:50:35Z","updated":"2026-10-10T04:26:45Z"},{"id":"wordfence:6fc6cf71-c20c-4d56-879e-48c40c097752","source":"wordfence","cve":"CVE-2026-105879","title":"JetElements <= 2.9.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc6cf71-c20c-4d56-879e-48c40c097752?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.2","to_inclusive":true,"patched_in":"2.9.2.3"}],"published":"2026-10-06T08:08:00Z","updated":"2026-10-08T23:32:36Z"},{"id":"wordfence:6fc92b8f-6794-461a-b6b6-598de21f5e2d","source":"wordfence","cve":"CVE-2023-41872","title":"WoodMart <= 7.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fc92b8f-6794-461a-b6b6-598de21f5e2d?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fcc3a82-f116-446e-9e5f-4f074e20403b","source":"wordfence","cve":"CVE-2023-6244","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcc3a82-f116-446e-9e5f-4f074e20403b?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:36:34Z"},{"id":"wordfence:6fcfd395-ccda-4025-8d3b-ccc3a7062b6d","source":"wordfence","cve":"CVE-2025-32227","title":"Asgaros Forum <= 3.0.0 - Authenticated (Subscriber+) Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcfd395-ccda-4025-8d3b-ccc3a7062b6d?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-04-07T00:00:00Z","updated":"2025-10-30T15:16:52Z"},{"id":"wordfence:6fd3ea16-4706-4573-b905-93dff434968d","source":"wordfence","cve":"CVE-2025-14079","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd3ea16-4706-4573-b905-93dff434968d?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2026-02-04T20:43:43Z","updated":"2026-02-05T09:13:44Z"},{"id":"wordfence:6fd46539-a55e-45ab-93b2-6a1703a91271","source":"wordfence","cve":"CVE-2022-3282","title":"Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.6.4 - File Upload Size Limit Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd46539-a55e-45ab-93b2-6a1703a91271?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.6.4","to_inclusive":true,"patched_in":"1.3.6.5"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fd4fa08-e326-47ab-96b1-be7b702a32ff","source":"wordfence","cve":"CVE-2022-29435","title":"Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd4fa08-e326-47ab-96b1-be7b702a32ff?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets-extended","name":"Code Snippets Extended","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T14:52:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fd646c7-f1b5-4ae7-adee-1e427fc4cf0a","source":"wordfence","cve":"CVE-2026-24978","title":"Jobica Core <= 1.4.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd646c7-f1b5-4ae7-adee-1e427fc4cf0a?source=api-prod","affected":[{"type":"plugin","slug":"jobica-core","name":"Jobica Core","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:04:44Z"},{"id":"wordfence:6fd6abf1-57f8-41f2-b890-ccac6f96569f","source":"wordfence","cve":"CVE-2025-50044","title":"Real Estate Manager <= 7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd6abf1-57f8-41f2-b890-ccac6f96569f?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:6fd6cb72-c508-46b1-99fb-cbd6b12b45de","source":"wordfence","cve":"CVE-2017-1000226","title":"Stop User Enumeration <= 1.3.8 - Unauthenticated Username Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd6cb72-c508-46b1-99fb-cbd6b12b45de?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2017-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fd866ac-6094-4f76-9fba-69494381214c","source":"wordfence","cve":"CVE-2025-0808","title":"Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd866ac-6094-4f76-9fba-69494381214c?source=api-prod","affected":[{"type":"plugin","slug":"houzez-property-feed","name":"Houzez Property Feed","from":"*","from_inclusive":true,"to":"2.4.21","to_inclusive":true,"patched_in":"2.4.22"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-14T17:03:06Z"},{"id":"wordfence:6fd87d34-2e7f-4c75-8816-b39820309077","source":"wordfence","cve":"CVE-2024-0588","title":"Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd87d34-2e7f-4c75-8816-b39820309077?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.10","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-07-29T21:36:34Z"},{"id":"wordfence:6fd9cfbe-2bf4-4218-a29d-c4b70ed132af","source":"wordfence","cve":"CVE-2019-5962","title":"Zoho SalesIQ <= 1.0.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fd9cfbe-2bf4-4218-a29d-c4b70ed132af?source=api-prod","affected":[{"type":"plugin","slug":"zoho-salesiq","name":"Zoho SalesIQ \u2013 Live chat, chatbots, and visitor tracking","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fde9239-edac-4f85-be12-80825595a332","source":"wordfence","cve":"","title":"RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fde9239-edac-4f85-be12-80825595a332?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"3.8.0.4","to_inclusive":true,"patched_in":"3.8.0.9"}],"published":"2017-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6fe31cc9-dcf8-480b-bc90-2c9ca91fabb3","source":"wordfence","cve":"CVE-2026-66708","title":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.17.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe31cc9-dcf8-480b-bc90-2c9ca91fabb3?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.17.2","to_inclusive":true,"patched_in":"1.17.3"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:21:01Z"},{"id":"wordfence:6fe7efb5-540b-4d85-852f-ad572da7ecdd","source":"wordfence","cve":"CVE-2026-110018","title":"aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe7efb5-540b-4d85-852f-ad572da7ecdd?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.18.0"}],"published":"2026-10-23T21:31:29Z","updated":"2026-10-24T11:30:30Z"},{"id":"wordfence:6fe8b2c8-3bb1-463a-a64c-15d7bcc29985","source":"wordfence","cve":"CVE-2023-32117","title":"Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fe8b2c8-3bb1-463a-a64c-15d7bcc29985?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.1.99","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6feae1c4-3735-4a33-85a5-867d458d2e8a","source":"wordfence","cve":"CVE-2024-4258","title":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6feae1c4-3735-4a33-85a5-867d458d2e8a?source=api-prod","affected":[{"type":"plugin","slug":"yotuwp-easy-youtube-embed","name":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2024-06-14T20:13:53Z","updated":"2024-07-03T14:48:40Z"},{"id":"wordfence:6fed4181-400b-4414-aa50-1e7bc92d542f","source":"wordfence","cve":"CVE-2024-32680","title":"HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.2 - Authenticated (Subscriber+) Remote Code Execution","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6fed4181-400b-4414-aa50-1e7bc92d542f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.2","to_inclusive":true,"patched_in":"1.3.5.3"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-25T12:40:08Z"},{"id":"wordfence:6ff01c24-fa35-43bc-be60-f2bb37854681","source":"wordfence","cve":"CVE-2025-9113","title":"Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff01c24-fa35-43bc-be60-f2bb37854681?source=api-prod","affected":[{"type":"plugin","slug":"doccure","name":"Doccure Core","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-09-08T05:35:51Z","updated":"2025-11-25T06:00:31Z"},{"id":"wordfence:6ff04e98-6c41-4117-8148-9c85b6aaf7d4","source":"wordfence","cve":"CVE-2025-25107","title":"OneStore Sites <= 0.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff04e98-6c41-4117-8148-9c85b6aaf7d4?source=api-prod","affected":[{"type":"plugin","slug":"onestore-sites","name":"OneStore Sites","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:26:22Z"},{"id":"wordfence:6ff184e6-c36b-4bbb-8dc2-f87d1d800d53","source":"wordfence","cve":"CVE-2022-1322","title":"Coming Soon \u2013 Under Construction <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff184e6-c36b-4bbb-8dc2-f87d1d800d53?source=api-prod","affected":[{"type":"plugin","slug":"coming-soons","name":"Coming Soon \u2013 Under Construction","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ff53647-572f-419f-ad39-965658a10263","source":"wordfence","cve":"CVE-2023-38515","title":"Church Admin <= 3.7.56 - Server-Side Request Forgery via church_admin_import_csv","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff53647-572f-419f-ad39-965658a10263?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"3.7.56","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ff5cda2-edcd-4fa5-9c8e-427a43802ed1","source":"wordfence","cve":"CVE-2025-1311","title":"WooCommerce Multivendor Marketplace \u2013 REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff5cda2-edcd-4fa5-9c8e-427a43802ed1?source=api-prod","affected":[{"type":"plugin","slug":"wcfm-marketplace-rest-api","name":"WCFM \u2013 Multivendor Marketplace REST API for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-03-21T17:52:03Z","updated":"2025-04-21T14:50:14Z"},{"id":"wordfence:6ff637c7-677f-4d70-b3cb-770d0a47e691","source":"wordfence","cve":"CVE-2025-12456","title":"Centangle Team Showcase <= 1.0.0 - Cross-Site Request Forgery To Plugin's Settings Modification And Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff637c7-677f-4d70-b3cb-770d0a47e691?source=api-prod","affected":[{"type":"plugin","slug":"centangle-team","name":"Centangle-Team","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:51:54Z","updated":"2025-11-04T04:27:17Z"},{"id":"wordfence:6ff76d9b-aa12-4391-90cd-f9df36d4a3a5","source":"wordfence","cve":"CVE-2026-87902","title":"WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff76d9b-aa12-4391-90cd-f9df36d4a3a5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.36","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.31","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.32","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.28","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.25","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.27","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.24","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.22","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.21","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.20","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.18","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.16","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.17","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.15","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.13","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.12","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.11","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.11","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.11","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6","from_inclusive":true,"to":"6.6.8","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.8","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.9","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.8","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"4.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"4.7.37"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-22T18:57:58Z"},{"id":"wordfence:6ff9c202-b3e8-4660-8763-a9fee468203e","source":"wordfence","cve":"CVE-2026-12224","title":"Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff9c202-b3e8-4660-8763-a9fee468203e?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-30T17:43:24Z","updated":"2026-07-01T06:51:07Z"},{"id":"wordfence:6ffa6a6b-bbb4-4361-8585-ce2cdb7d1d7e","source":"wordfence","cve":"CVE-2024-1997","title":"Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffa6a6b-bbb4-4361-8585-ce2cdb7d1d7e?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:32:39Z"},{"id":"wordfence:6ffb078c-2a92-4682-aaa9-c519e28e7e18","source":"wordfence","cve":"CVE-2023-34381","title":"Zippy <= 1.6.2 - Missing Authorization via adminInit","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffb078c-2a92-4682-aaa9-c519e28e7e18?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:6ffb494a-e9b3-46f5-825a-35ad88d5d6fa","source":"wordfence","cve":"CVE-2024-33945","title":"Eleblog \u2013 Elementor Blog And Magazine Addons <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffb494a-e9b3-46f5-825a-35ad88d5d6fa?source=api-prod","affected":[{"type":"plugin","slug":"ele-blog","name":"Eleblog \u2013 Elementor Blog And Magazine Addons","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:58:39Z"},{"id":"wordfence:6ffccb84-faee-4a47-ab49-dbbb4858a6a5","source":"wordfence","cve":"CVE-2026-39543","title":"Tourfic <= 2.21.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffccb84-faee-4a47-ab49-dbbb4858a6a5?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.21.4","to_inclusive":true,"patched_in":"2.21.5"}],"published":"2026-03-28T00:00:00Z","updated":"2026-04-15T21:29:01Z"},{"id":"wordfence:7006aa50-8fcf-46ad-921b-b47cbdb7d9e3","source":"wordfence","cve":"CVE-2024-33636","title":"WP Page Post Widget Clone <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7006aa50-8fcf-46ad-921b-b47cbdb7d9e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-post-widget-clone","name":"WP Page Post Widget Clone","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:27:03Z"},{"id":"wordfence:700755ff-6619-499e-adda-5b1fc4466dbe","source":"wordfence","cve":"CVE-2025-58022","title":"Shortcode <= 0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/700755ff-6619-499e-adda-5b1fc4466dbe?source=api-prod","affected":[{"type":"plugin","slug":"shortcode","name":"Shortcode","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:31:33Z"},{"id":"wordfence:7007c8db-b111-4c0f-a6e2-6b99971444aa","source":"wordfence","cve":"CVE-2025-39539","title":"Soho Hotel <= 4.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7007c8db-b111-4c0f-a6e2-6b99971444aa?source=api-prod","affected":[{"type":"theme","slug":"soho-hotel","name":"Soho Hotel Booking Calendar For WordPress","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-11T20:21:49Z"},{"id":"wordfence:70083f93-f110-4029-a3d3-ce8a77799a31","source":"wordfence","cve":"CVE-2024-13500","title":"WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70083f93-f110-4029-a3d3-ce8a77799a31?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.17","to_inclusive":true,"patched_in":"2.6.18"}],"published":"2025-02-14T23:02:19Z","updated":"2025-02-15T11:26:48Z"},{"id":"wordfence:7008a8a9-dd6f-413b-b530-755528391bca","source":"wordfence","cve":"CVE-2024-34573","title":"Pootle Pagebuilder \u2013 WordPress Page builder <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7008a8a9-dd6f-413b-b530-755528391bca?source=api-prod","affected":[{"type":"plugin","slug":"pootle-page-builder","name":"Pootle Pagebuilder \u2013 WordPress Page builder","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:00:00Z"},{"id":"wordfence:7009e69d-36b1-46a1-9be6-74f19fb19303","source":"wordfence","cve":"CVE-2026-62041","title":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7009e69d-36b1-46a1-9be6-74f19fb19303?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-11-03T22:47:45Z"},{"id":"wordfence:700b9a34-bf9c-444d-80c7-87bf9412673f","source":"wordfence","cve":"CVE-2024-56279","title":"Compact WP Audio Player <= 1.9.14 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/700b9a34-bf9c-444d-80c7-87bf9412673f?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:46:54Z"},{"id":"wordfence:700e9d1c-a178-4033-8607-652178860211","source":"wordfence","cve":"CVE-2026-0734","title":"WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/700e9d1c-a178-4033-8607-652178860211?source=api-prod","affected":[{"type":"plugin","slug":"wp-allow-hosts","name":"WP Allowed Hosts","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:33:03Z","updated":"2026-01-14T06:40:05Z"},{"id":"wordfence:700ef470-dfa9-498f-b4a4-57b85a349f35","source":"wordfence","cve":"CVE-2026-66456","title":"Profile Extra Fields by BestWebSoft <= 1.3.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/700ef470-dfa9-498f-b4a4-57b85a349f35?source=api-prod","affected":[{"type":"plugin","slug":"profile-extra-fields","name":"Profile Extra Fields by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-07T00:00:00Z","updated":"2026-10-23T00:51:19Z"},{"id":"wordfence:70110d50-853d-4972-a5a0-b5c566ba7de6","source":"wordfence","cve":"CVE-2020-36172","title":"Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70110d50-853d-4972-a5a0-b5c566ba7de6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.8.12","to_inclusive":false,"patched_in":"5.8.12"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7011f426-4eae-4a8a-b0ad-819981a77a1f","source":"wordfence","cve":"CVE-2026-66631","title":"MoreConvert Wishlist for WooCommerce <= 1.9.21 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7011f426-4eae-4a8a-b0ad-819981a77a1f?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.21","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-09-17T08:57:00Z","updated":"2026-09-22T18:48:18Z"},{"id":"wordfence:70128a5c-56aa-446b-ae3d-500830387200","source":"wordfence","cve":"CVE-2026-103293","title":"MPG <= 4.2.2 - Authenticated (Editor+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70128a5c-56aa-446b-ae3d-500830387200?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:17:02Z"},{"id":"wordfence:7012b34d-8d65-4575-9965-417739206b5f","source":"wordfence","cve":"CVE-2023-3139","title":"Protect WP Admin <= 3.8 - Unauthenticated Information Disclosure to Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7012b34d-8d65-4575-9965-417739206b5f?source=api-prod","affected":[{"type":"plugin","slug":"protect-wp-admin","name":"Protect WP Admin","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"4.0"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7016cd09-ce5b-45cd-8064-f1e836502aab","source":"wordfence","cve":"CVE-2025-0629","title":"Coronavirus (COVID-19) Notice Message <= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7016cd09-ce5b-45cd-8064-f1e836502aab?source=api-prod","affected":[{"type":"plugin","slug":"coronavirus-covid-19-notice-message","name":"Coronavirus (COVID-19) Notice Message","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T16:06:47Z"},{"id":"wordfence:701910b7-6da3-40db-a48b-46a93398953a","source":"wordfence","cve":"CVE-2021-36854","title":"Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701910b7-6da3-40db-a48b-46a93398953a?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7019817d-cf3b-4950-ba37-4619c6cb6bcd","source":"wordfence","cve":"CVE-2026-91076","title":"Robokassa payment gateway for Woocommerce < 1.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7019817d-cf3b-4950-ba37-4619c6cb6bcd?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":false,"patched_in":"1.9.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:25:11Z"},{"id":"wordfence:7019b542-9b9a-4d16-94a0-412cccf1e6eb","source":"wordfence","cve":"CVE-2024-33552","title":"XStore Core <= 5.3.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7019b542-9b9a-4d16-94a0-412cccf1e6eb?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:43:53Z"},{"id":"wordfence:701a037d-bbd5-436d-bfc8-394c9dcf6bab","source":"wordfence","cve":"CVE-2024-31242","title":"Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701a037d-bbd5-436d-bfc8-394c9dcf6bab?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:44:04Z"},{"id":"wordfence:701bcf98-fcb4-4722-9bf1-b94efe3bb1fd","source":"wordfence","cve":"CVE-2024-32553","title":"WordPress Menu Plugin \u2014 Superfly Responsive Menu <= 5.0.25 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701bcf98-fcb4-4722-9bf1-b94efe3bb1fd?source=api-prod","affected":[{"type":"plugin","slug":"superfly-menu","name":"WordPress Menu Plugin \u2014 Superfly Responsive Menu","from":"*","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:16:40Z"},{"id":"wordfence:701bf711-d692-4eb1-8459-befa62264b97","source":"wordfence","cve":"","title":"Fontiran <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701bf711-d692-4eb1-8459-befa62264b97?source=api-prod","affected":[{"type":"plugin","slug":"fontiran","name":"Fontiran","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:701d6bee-6eb2-4497-bf54-fbc384d9d2e5","source":"wordfence","cve":"CVE-2024-30198","title":"BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701d6bee-6eb2-4497-bf54-fbc384d9d2e5?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T14:22:14Z"},{"id":"wordfence:701d99b7-759f-4543-824d-dad84c35f5f3","source":"wordfence","cve":"CVE-2020-14092","title":"Payment Form for PayPal Pro < 1.1.65 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701d99b7-759f-4543-824d-dad84c35f5f3?source=api-prod","affected":[{"type":"plugin","slug":"payment-form-for-paypal-pro","name":"Payment Form for PayPal Pro","from":"*","from_inclusive":true,"to":"1.1.65","to_inclusive":false,"patched_in":"1.1.65"}],"published":"2020-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:701dc461-88e7-40bf-a4fb-f92723b6e05e","source":"wordfence","cve":"CVE-2024-13411","title":"Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701dc461-88e7-40bf-a4fb-f92723b6e05e?source=api-prod","affected":[{"type":"plugin","slug":"zapier","name":"Zapier for WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-03-25T22:25:19Z","updated":"2025-03-26T11:22:11Z"},{"id":"wordfence:701e349b-ce59-4724-8304-3871a3abbe8b","source":"wordfence","cve":"CVE-2024-37521","title":"zBench <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701e349b-ce59-4724-8304-3871a3abbe8b?source=api-prod","affected":[{"type":"theme","slug":"zbench","name":"zBench","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T20:53:45Z"},{"id":"wordfence:701e6afe-08fa-49c7-a6da-cb266db07c48","source":"wordfence","cve":"CVE-2024-10587","title":"Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/701e6afe-08fa-49c7-a6da-cb266db07c48?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.7.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T14:17:47Z","updated":"2024-12-17T12:58:27Z"},{"id":"wordfence:7020d5a1-a4a6-489c-8615-bc7898553bcf","source":"wordfence","cve":"CVE-2024-2738","title":"Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7020d5a1-a4a6-489c-8615-bc7898553bcf?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":true,"patched_in":"2.4.3.2"},{"type":"plugin","slug":"permalink-manager-pro","name":"Permalink Manager Pro","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":true,"patched_in":"2.4.3.2"}],"published":"2024-03-20T00:00:00Z","updated":"2024-05-31T15:30:25Z"},{"id":"wordfence:702261eb-4f85-4388-9f82-75476640e8ed","source":"wordfence","cve":"CVE-2024-6565","title":"AForms <= 2.2.6 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702261eb-4f85-4388-9f82-75476640e8ed?source=api-prod","affected":[{"type":"plugin","slug":"aforms-form-builder-for-price-calculator-cost-estimation","name":"AForms \u2014 Form Builder for Price Calculator & Cost Estimation","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2024-07-15T19:52:23Z","updated":"2024-07-16T08:32:32Z"},{"id":"wordfence:70235939-87d3-464b-9884-c5b322614f51","source":"wordfence","cve":"CVE-2026-62108","title":"Headless SSO Plugin for WP <= 1.7.0 - Unauthenticated Arbitrary Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70235939-87d3-464b-9884-c5b322614f51?source=api-prod","affected":[{"type":"plugin","slug":"headless-single-sign-on","name":"Headless SSO Plugin for WP","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:23:20Z"},{"id":"wordfence:70254a2f-08da-4f78-85d1-08c746167e0f","source":"wordfence","cve":"CVE-2022-3739","title":"WP Best Quiz <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70254a2f-08da-4f78-85d1-08c746167e0f?source=api-prod","affected":[{"type":"plugin","slug":"wp-best-quiz","name":"WP Best Quiz","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:702715a9-b180-4d31-a1df-37b732ae8226","source":"wordfence","cve":"CVE-2024-7548","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702715a9-b180-4d31-a1df-37b732ae8226?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.9.3","to_inclusive":true,"patched_in":"4.2.6.9.4"}],"published":"2024-08-07T16:50:26Z","updated":"2024-08-08T05:31:46Z"},{"id":"wordfence:702aa972-7b74-4417-8d33-a26c3831934f","source":"wordfence","cve":"CVE-2023-0505","title":"Ever Compare <= 1.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702aa972-7b74-4417-8d33-a26c3831934f?source=api-prod","affected":[{"type":"plugin","slug":"ever-compare","name":"Ever Compare \u2013 Products Compare Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:702cf60a-1d2f-4834-a8ef-96d0026fd81c","source":"wordfence","cve":"CVE-2025-32662","title":"uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702cf60a-1d2f-4834-a8ef-96d0026fd81c?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-09-19T17:13:42Z"},{"id":"wordfence:702dca65-fa8c-48c7-89e4-cba4b151e2c4","source":"wordfence","cve":"CVE-2023-47773","title":"Permalinks Customizer <= 2.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702dca65-fa8c-48c7-89e4-cba4b151e2c4?source=api-prod","affected":[{"type":"plugin","slug":"permalinks-customizer","name":"Permalinks Customizer","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:702f9d3b-5d33-4215-ac76-9aae3162d775","source":"wordfence","cve":"CVE-2023-1022","title":"WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/702f9d3b-5d33-4215-ac76-9aae3162d775?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70339e26-ff63-488c-9311-b5c221f6a5d9","source":"wordfence","cve":"CVE-2026-88844","title":"MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70339e26-ff63-488c-9311-b5c221f6a5d9?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:15:47Z"},{"id":"wordfence:70352973-5fa7-40b0-9e07-eab2e96520b7","source":"wordfence","cve":"CVE-2018-10101","title":"WordPress Core < 4.9.5 - Security Misconfiguration with URL Hostnames","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70352973-5fa7-40b0-9e07-eab2e96520b7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.23","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.15","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.14","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"3.7.26"}],"published":"2018-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70361501-8adc-499a-91d2-cf91fab5934a","source":"wordfence","cve":"CVE-2025-3917","title":"\u767e\u5ea6\u7ad9\u957fSEO\u5408\u96c6(\u652f\u6301\u767e\u5ea6/\u795e\u9a6c/Bing/\u5934\u6761\u63a8\u9001) <= 2.0.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70361501-8adc-499a-91d2-cf91fab5934a?source=api-prod","affected":[{"type":"plugin","slug":"baiduseo","name":"SEO\u5408\u96c6(\u652f\u6301\u767e\u5ea6/Google/Bing/GEO\u4f18\u5316)","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-05-14T14:24:14Z","updated":"2025-11-05T19:31:25Z"},{"id":"wordfence:7036400d-022c-4e7e-a463-6ac6f5373474","source":"wordfence","cve":"CVE-2017-17753","title":"CSV Import Export <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7036400d-022c-4e7e-a463-6ac6f5373474?source=api-prod","affected":[{"type":"plugin","slug":"csv-import-export","name":"CSV Import Export","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70391046-f6ba-49f8-ad5d-d183ff94e2ac","source":"wordfence","cve":"CVE-2026-84066","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70391046-f6ba-49f8-ad5d-d183ff94e2ac?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.9","to_inclusive":false,"patched_in":"8.9"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:23:42Z"},{"id":"wordfence:703ba736-5834-40f2-9cf6-a6a70a73e4d6","source":"wordfence","cve":"CVE-2021-4458","title":"Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/703ba736-5834-40f2-9cf6-a6a70a73e4d6?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-12T11:23:40Z"},{"id":"wordfence:703da259-7a5d-4807-827f-f1e5ba571eb8","source":"wordfence","cve":"CVE-2026-116856","title":"Flexible Quantity & Price Calculator for WooCommerce <= 2.3.24 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/703da259-7a5d-4807-827f-f1e5ba571eb8?source=api-prod","affected":[{"type":"plugin","slug":"flexible-quantity-measurement-price-calculator-for-woocommerce","name":"Flexible Quantity & Price Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.24","to_inclusive":true,"patched_in":"2.3.25"}],"published":"2026-10-29T14:24:00Z","updated":"2026-11-03T19:34:59Z"},{"id":"wordfence:703e251f-734d-4a7d-8b67-897aa6986b8c","source":"wordfence","cve":"CVE-2025-60136","title":"User Notes <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/703e251f-734d-4a7d-8b67-897aa6986b8c?source=api-prod","affected":[{"type":"plugin","slug":"user-notes","name":"User Notes","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:19:16Z"},{"id":"wordfence:70408046-5eb5-4217-9db4-e7b2a7809cf8","source":"wordfence","cve":"CVE-2025-26964","title":"Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70408046-5eb5-4217-9db4-e7b2a7809cf8?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.20","to_inclusive":true,"patched_in":"4.0.21"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:32:08Z"},{"id":"wordfence:7042b039-55a4-4005-ab99-78b0ae7dac84","source":"wordfence","cve":"CVE-2026-118804","title":"Bricks Builder <= 2.4.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7042b039-55a4-4005-ab99-78b0ae7dac84?source=api-prod","affected":[{"type":"plugin","slug":"bricksbuilder","name":"Bricks Builder","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-04T21:43:00Z"},{"id":"wordfence:70434876-4876-4da8-9af1-6f6ef5632f26","source":"wordfence","cve":"CVE-2025-14797","title":"Same Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70434876-4876-4da8-9af1-6f6ef5632f26?source=api-prod","affected":[{"type":"plugin","slug":"same-category-posts","name":"Same Category Posts","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2026-01-23T19:17:25Z","updated":"2026-01-24T07:26:44Z"},{"id":"wordfence:70479769-42d0-4108-94cd-f5ed46bde2f8","source":"wordfence","cve":"CVE-2025-69110","title":"AirSupply <= 2.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70479769-42d0-4108-94cd-f5ed46bde2f8?source=api-prod","affected":[{"type":"theme","slug":"air-supply","name":"AirSupply | Conditioning Company and Heating Services WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:36:01Z"},{"id":"wordfence:7047d53e-c9e4-46f9-8b5f-3489a1fb7e97","source":"wordfence","cve":"","title":"Database Management tool \u2013 Adminer <= 1.1.5 - Information Exposure","severity":"medium","cvss":6.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7047d53e-c9e4-46f9-8b5f-3489a1fb7e97?source=api-prod","affected":[{"type":"plugin","slug":"pexlechris-adminer","name":"Database Manager \u2013 WP Adminer","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70493df9-82b8-4160-8d75-889fada7541f","source":"wordfence","cve":"","title":"Simple Download Monitor <= 3.9.5 - Log Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70493df9-82b8-4160-8d75-889fada7541f?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:704a26f1-36d9-4503-b200-5a6b604ceddc","source":"wordfence","cve":"CVE-2024-29811","title":"Radio Player <= 2.0.73 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704a26f1-36d9-4503-b200-5a6b604ceddc?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-25T14:10:22Z"},{"id":"wordfence:704a60e1-bdb0-498f-a9f1-c9de1c29df7c","source":"wordfence","cve":"CVE-2024-34554","title":"Stockholm Core <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704a60e1-bdb0-498f-a9f1-c9de1c29df7c?source=api-prod","affected":[{"type":"plugin","slug":"stockholm-core","name":"Stockholm Core","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:57:29Z"},{"id":"wordfence:704a7df0-8e6b-4145-96a2-d179a6d75aac","source":"wordfence","cve":"CVE-2024-13460","title":"WE \u2013 Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704a7df0-8e6b-4145-96a2-d179a6d75aac?source=api-prod","affected":[{"type":"plugin","slug":"we-testimonial-slider","name":"WE \u2013 Testimonial Slider","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:46:42Z","updated":"2025-01-30T13:42:00Z"},{"id":"wordfence:704eed2c-5ea8-4c31-99c5-8c1b0572997c","source":"wordfence","cve":"CVE-2020-13642","title":"Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704eed2c-5ea8-4c31-99c5-8c1b0572997c?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.10.15","to_inclusive":true,"patched_in":"2.10.16"}],"published":"2020-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:704f9077-61c1-4105-80e6-906fe6bdddc6","source":"wordfence","cve":"CVE-2024-6334","title":"Easy Table of Contents <= 2.0.67 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704f9077-61c1-4105-80e6-906fe6bdddc6?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.67","to_inclusive":true,"patched_in":"2.0.67.1"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-16T13:06:14Z"},{"id":"wordfence:704fd636-04f6-4620-85a2-1c08f93125fe","source":"wordfence","cve":"CVE-2025-52714","title":"Traveler < 3.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/704fd636-04f6-4620-85a2-1c08f93125fe?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-16T15:55:13Z"},{"id":"wordfence:7053316b-1c15-43c0-a534-37d3c066de0d","source":"wordfence","cve":"CVE-2026-91025","title":"Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7053316b-1c15-43c0-a534-37d3c066de0d?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.1.21"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:44:02Z"},{"id":"wordfence:7053978d-4780-4532-b504-265b60d1911c","source":"wordfence","cve":"CVE-2025-54700","title":"Makeaholic <= 1.8.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7053978d-4780-4532-b504-265b60d1911c?source=api-prod","affected":[{"type":"theme","slug":"makeaholic","name":"Makeaholic - Beauty Cosmetics WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:57:23Z"},{"id":"wordfence:70544986-af4a-48e4-8497-8ee78589676e","source":"wordfence","cve":"","title":"FLASH PLAYER PLUGIN <= 1.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70544986-af4a-48e4-8497-8ee78589676e?source=api-prod","affected":[{"type":"plugin","slug":"wp-flash-player","name":"FLASH PLAYER PLUGIN","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7054dda8-4be4-4680-8d14-20e52e225e63","source":"wordfence","cve":"CVE-2024-52478","title":"Jobify - Job Board WordPress Theme < 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7054dda8-4be4-4680-8d14-20e52e225e63?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2024-11-19T00:00:00Z","updated":"2026-02-26T15:03:01Z"},{"id":"wordfence:70570837-8c11-4361-96ce-7418106fb006","source":"wordfence","cve":"CVE-2025-68012","title":"CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70570837-8c11-4361-96ce-7418106fb006?source=api-prod","affected":[{"type":"plugin","slug":"codecolorer","name":"CodeColorer","from":"*","from_inclusive":true,"to":"0.10.1","to_inclusive":true,"patched_in":"0.10.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-03-17T21:43:54Z"},{"id":"wordfence:705823ff-e9c3-4b8b-b71c-3b60d0d15b01","source":"wordfence","cve":"CVE-2024-13798","title":"Post Grid and Gutenberg Blocks \u2013 ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705823ff-e9c3-4b8b-b71c-3b60d0d15b01?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-02-21T15:23:43Z","updated":"2025-02-22T04:21:16Z"},{"id":"wordfence:70582781-9de5-4124-bde4-d3d26724e9b3","source":"wordfence","cve":"CVE-2024-2798","title":"Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70582781-9de5-4124-bde4-d3d26724e9b3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.971","to_inclusive":true,"patched_in":"1.3.972"}],"published":"2024-04-22T00:00:00Z","updated":"2024-10-24T19:18:46Z"},{"id":"wordfence:7058306f-ec20-4722-aaa1-552a75945a1e","source":"wordfence","cve":"CVE-2024-24701","title":"Setka Editor <= 2.1.20 - Cross-Site Request Forgery via handleRequest","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7058306f-ec20-4722-aaa1-552a75945a1e?source=api-prod","affected":[{"type":"plugin","slug":"setka-editor","name":"A no-code page builder for beautiful performance-based content","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":""}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T14:25:33Z"},{"id":"wordfence:70587bb9-6f76-4073-b5db-06ffda0194e9","source":"wordfence","cve":"CVE-2021-34676","title":"NEX-Forms <= 7.8.7 Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70587bb9-6f76-4073-b5db-06ffda0194e9?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"7.8.7","to_inclusive":true,"patched_in":"7.8.8"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:705a0e1f-79c6-4c2a-8622-fb3df944cf22","source":"wordfence","cve":"CVE-2014-9031","title":"WordPress Core < 4.0.1 - Cross-Site Scripting via Shortcode Brackets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705a0e1f-79c6-4c2a-8622-fb3df944cf22?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:705b1da0-df92-40c2-a608-ccad32a9c224","source":"wordfence","cve":"CVE-2026-4859","title":"SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705b1da0-df92-40c2-a608-ccad32a9c224?source=api-prod","affected":[{"type":"plugin","slug":"sp-blog-designer","name":"SP Blog Designer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:07:14Z","updated":"2026-05-12T07:48:22Z"},{"id":"wordfence:705c2322-bb52-4337-b0dd-6bf04bd1b0e0","source":"wordfence","cve":"CVE-2024-13867","title":"Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705c2322-bb52-4337-b0dd-6bf04bd1b0e0?source=api-prod","affected":[{"type":"theme","slug":"listivo","name":"Listivo - Classified Ads WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.67","to_inclusive":true,"patched_in":"2.3.68"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T09:21:46Z"},{"id":"wordfence:705d11b1-0924-46ae-a6e6-8fab16a4df00","source":"wordfence","cve":"CVE-2023-41731","title":"wordpress publish post email notification <= 1.0.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705d11b1-0924-46ae-a6e6-8fab16a4df00?source=api-prod","affected":[{"type":"plugin","slug":"publish-post-email-notification","name":"wordpress publish post email notification","from":"*","from_inclusive":true,"to":"1.0.2.2","to_inclusive":true,"patched_in":"1.0.2.3"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:705e11ff-e0c4-478a-aab2-224163357be0","source":"wordfence","cve":"CVE-2026-45443","title":"PDF for Elementor Forms + Drag And Drop Template Builder <= 5.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705e11ff-e0c4-478a-aab2-224163357be0?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-elementor-forms","name":"PDF for Elementor Forms + Drag And Drop Template Builder","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:32:33Z"},{"id":"wordfence:705ee791-6b12-47bc-9de1-09b91a55bd00","source":"wordfence","cve":"CVE-2026-4986","title":"WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705ee791-6b12-47bc-9de1-09b91a55bd00?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.10.0.4","to_inclusive":true,"patched_in":"1.10.0.5"}],"published":"2026-05-19T00:00:00Z","updated":"2026-09-17T15:07:03Z"},{"id":"wordfence:705f5adc-4be5-49bf-8244-f8b459d99c69","source":"wordfence","cve":"CVE-2026-65527","title":"LIQUID SPEECH BALLOON <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/705f5adc-4be5-49bf-8244-f8b459d99c69?source=api-prod","affected":[{"type":"plugin","slug":"liquid-speech-balloon","name":"LIQUID SPEECH BALLOON","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-07-23T00:00:00Z","updated":"2026-11-10T23:19:08Z"},{"id":"wordfence:7061781d-999b-47a7-b4b2-f0335c6247f8","source":"wordfence","cve":"CVE-2024-54438","title":"Gaxx Keywords <= 0.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7061781d-999b-47a7-b4b2-f0335c6247f8?source=api-prod","affected":[{"type":"plugin","slug":"gaxx-keywords","name":"Gaxx Keywords","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T10:57:44Z"},{"id":"wordfence:706549d9-aa2f-4b1e-83b8-0eea38654565","source":"wordfence","cve":"CVE-2024-33936","title":"Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/706549d9-aa2f-4b1e-83b8-0eea38654565?source=api-prod","affected":[{"type":"plugin","slug":"print-o-matic","name":"Print-O-Matic","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:44:50Z"},{"id":"wordfence:7065f038-2dd0-447d-bea6-385f6e9657d5","source":"wordfence","cve":"CVE-2026-39684","title":"OrganicFood <= 3.6.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7065f038-2dd0-447d-bea6-385f6e9657d5?source=api-prod","affected":[{"type":"theme","slug":"organicfood","name":"Organic Food - Farm & Food Business Eco WordPress","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-21T00:00:00Z","updated":"2026-05-05T15:43:18Z"},{"id":"wordfence:70682a2d-16f6-4d7e-bf69-f0f3999f03de","source":"wordfence","cve":"CVE-2024-3811","title":"Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70682a2d-16f6-4d7e-bf69-f0f3999f03de?source=api-prod","affected":[{"type":"plugin","slug":"salient-shortcodes","name":"Salient Shortcodes","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-18T05:40:03Z"},{"id":"wordfence:70724bc7-c1f4-4965-8bba-99b2ed21d34b","source":"wordfence","cve":"CVE-2024-2088","title":"NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure","severity":"high","cvss":8.5,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70724bc7-c1f4-4965-8bba-99b2ed21d34b?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2024-05-21T18:34:01Z","updated":"2024-05-22T06:50:34Z"},{"id":"wordfence:7072b93b-4d18-464e-802d-a6c17a224593","source":"wordfence","cve":"CVE-2024-34438","title":"Shared Files <= 1.7.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7072b93b-4d18-464e-802d-a6c17a224593?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.19","to_inclusive":true,"patched_in":"1.7.20"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:17:03Z"},{"id":"wordfence:70744b6b-faac-4b08-bf0f-10c0a01250eb","source":"wordfence","cve":"CVE-2025-67521","title":"Select Core < 2.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70744b6b-faac-4b08-bf0f-10c0a01250eb?source=api-prod","affected":[{"type":"plugin","slug":"select-core","name":"Select Core","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-11-14T00:00:00Z","updated":"2025-12-11T16:44:21Z"},{"id":"wordfence:7076c253-91ac-46b4-91ad-89a296408959","source":"wordfence","cve":"CVE-2019-15824","title":"WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'adminhash'","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7076c253-91ac-46b4-91ad-89a296408959?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.5.2.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2019-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:707c0dd5-84ae-4c0b-b625-16b65412bf8d","source":"wordfence","cve":"CVE-2026-123463","title":"Checkout Files Upload for WooCommerce <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/707c0dd5-84ae-4c0b-b625-16b65412bf8d?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-11-07T09:44:13Z","updated":"2026-11-10T19:58:56Z"},{"id":"wordfence:7082c181-88c7-40f0-b49c-ffc16ab41dcc","source":"wordfence","cve":"","title":"Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7082c181-88c7-40f0-b49c-ffc16ab41dcc?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"3.2.41","from_inclusive":true,"to":"3.2.41","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"3.2.42","from_inclusive":true,"to":"3.2.42","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7085e16a-cdf3-4467-b957-23ab372416e6","source":"wordfence","cve":"CVE-2014-8586","title":"Calendar Event Multi View < 1.0.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7085e16a-cdf3-4467-b957-23ab372416e6?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2014-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7087221f-c092-4803-8725-687ffbbbd941","source":"wordfence","cve":"CVE-2022-45377","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.0.8 - Cross-Site Request Forgery in upload and delete_file","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7087221f-c092-4803-8725-687ffbbbd941?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:708b70c7-e4e6-4422-9682-c7d05063a188","source":"wordfence","cve":"CVE-2026-9231","title":"WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/708b70c7-e4e6-4422-9682-c7d05063a188?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-09-21T19:51:45Z","updated":"2026-09-22T08:27:18Z"},{"id":"wordfence:708c2c69-aa1b-4bfb-bef5-f2faa1e49a10","source":"wordfence","cve":"CVE-2019-14313","title":"Photo Gallery by 10Web <= 1.5.30 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/708c2c69-aa1b-4bfb-bef5-f2faa1e49a10?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.31","to_inclusive":false,"patched_in":"1.5.31"}],"published":"2019-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:708e3851-a4fe-41bd-8a6c-9e1674f3b62d","source":"wordfence","cve":"CVE-2026-52697","title":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/708e3851-a4fe-41bd-8a6c-9e1674f3b62d?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-15T19:37:01Z"},{"id":"wordfence:708ec511-5635-43fc-b11d-9d98dfc7ed45","source":"wordfence","cve":"CVE-2025-32125","title":"Silvasoft boekhouden <= 3.0.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/708ec511-5635-43fc-b11d-9d98dfc7ed45?source=api-prod","affected":[{"type":"plugin","slug":"silvasoft-boekhouden","name":"Silvasoft boekhouden","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-04-04T00:00:00Z","updated":"2026-09-09T15:51:33Z"},{"id":"wordfence:7092ce4a-bad9-4426-b94e-d9d688344272","source":"wordfence","cve":"CVE-2024-3711","title":"Brizy \u2013 Page Builder <= 2.4.43 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7092ce4a-bad9-4426-b94e-d9d688344272?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.43","to_inclusive":true,"patched_in":"2.4.44"}],"published":"2024-05-22T17:00:50Z","updated":"2024-05-23T05:32:17Z"},{"id":"wordfence:7092f2c4-1f50-4daf-a428-cc80a0aaa77c","source":"wordfence","cve":"CVE-2026-57420","title":"Author Box WP Lens <= 2.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7092f2c4-1f50-4daf-a428-cc80a0aaa77c?source=api-prod","affected":[{"type":"plugin","slug":"author-box-for-divi","name":"Author Box WP Lens","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:24:13Z"},{"id":"wordfence:70968476-b064-477f-999f-4aa2c51d89cc","source":"wordfence","cve":"CVE-2023-3254","title":"Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70968476-b064-477f-999f-4aa2c51d89cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"10.9","to_inclusive":true,"patched_in":"10.9.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70971072-d743-466b-affe-d7f79d5712aa","source":"wordfence","cve":"CVE-2023-34000","title":"WooCommerce Stripe Payment Gateway <= 7.4.0 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70971072-d743-466b-affe-d7f79d5712aa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"5.5.0","from_inclusive":true,"to":"5.5.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"5.6.0","from_inclusive":true,"to":"5.6.3","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"5.7.0","from_inclusive":true,"to":"5.7.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"5.8.0","from_inclusive":true,"to":"5.8.2","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"5.9.0","from_inclusive":true,"to":"5.9.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.0.0","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.1.0","from_inclusive":true,"to":"6.1.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.2.0","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.3.0","from_inclusive":true,"to":"6.3.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.4.0","from_inclusive":true,"to":"6.4.4","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.5.0","from_inclusive":true,"to":"6.5.2","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.6.0","from_inclusive":true,"to":"6.6.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.7.0","from_inclusive":true,"to":"6.7.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.8.0","from_inclusive":true,"to":"6.8.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"6.9.0","from_inclusive":true,"to":"6.9.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"7.0.0","from_inclusive":true,"to":"7.0.3","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"7.1.0","from_inclusive":true,"to":"7.1.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"7.2.0","from_inclusive":true,"to":"7.2.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"7.3.0","from_inclusive":true,"to":"7.3.1","to_inclusive":false,"patched_in":"5.5.1"},{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"7.4.0","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70993f6f-d9b0-49d5-b35e-e129f96529f6","source":"wordfence","cve":"CVE-2025-14165","title":"Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70993f6f-d9b0-49d5-b35e-e129f96529f6?source=api-prod","affected":[{"type":"plugin","slug":"kirimemail-woocommerce-integration","name":"Kirim.Email WooCommerce Integration","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:29:33Z","updated":"2025-12-12T03:20:48Z"},{"id":"wordfence:709dd340-7764-4c4d-892b-e07eb898df74","source":"wordfence","cve":"CVE-2025-30824","title":"Textmetrics <= 3.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/709dd340-7764-4c4d-892b-e07eb898df74?source=api-prod","affected":[{"type":"plugin","slug":"webtexttool","name":"Textmetrics","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:35:42Z"},{"id":"wordfence:70a14d11-6525-465c-8fc6-0920af748027","source":"wordfence","cve":"CVE-2024-35767","title":"Squeeze <= 1.4 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70a14d11-6525-465c-8fc6-0920af748027?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-26T13:54:42Z"},{"id":"wordfence:70a2b6ff-defc-4722-9af9-3cae94e98632","source":"wordfence","cve":"CVE-2026-4001","title":"Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula","severity":"critical","cvss":9.8,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70a2b6ff-defc-4722-9af9-3cae94e98632?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-product-addons-pro","name":"Woocommerce Custom Product Addons Pro","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2026-03-23T10:53:48Z","updated":"2026-03-23T23:25:48Z"},{"id":"wordfence:70a3ff1d-3dca-40bf-9954-2b68b520629c","source":"wordfence","cve":"CVE-2026-114699","title":"\u042eKassa \u0434\u043b\u044f WooCommerce <= 2.17.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70a3ff1d-3dca-40bf-9954-2b68b520629c?source=api-prod","affected":[{"type":"plugin","slug":"yookassa","name":"\u042eKassa \u0434\u043b\u044f WooCommerce","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":"2.17.4"}],"published":"2026-10-22T08:52:00Z","updated":"2026-11-10T23:22:12Z"},{"id":"wordfence:70a93afa-9801-41d2-8923-ca4ae6ae974f","source":"wordfence","cve":"CVE-2025-1508","title":"WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70a93afa-9801-41d2-8923-ca4ae6ae974f?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2025-03-11T14:22:55Z","updated":"2025-04-30T18:16:25Z"},{"id":"wordfence:70aaef82-c93b-4f2b-8d57-6c28d45942ad","source":"wordfence","cve":"CVE-2021-24898","title":"Editable Table Simple Fast FrontEnd From Sql tables <= 0.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70aaef82-c93b-4f2b-8d57-6c28d45942ad?source=api-prod","affected":[{"type":"plugin","slug":"editable-table","name":"Editable Table Simple Fast FrontEnd From Sql tables","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70ac8447-3d42-4577-8d46-528966a9f002","source":"wordfence","cve":"CVE-2013-6991","title":"WP-Cron Dashboard < 1.1.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ac8447-3d42-4577-8d46-528966a9f002?source=api-prod","affected":[{"type":"plugin","slug":"wp-cron-dashboard","name":"WP-Cron Dashboard","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"}],"published":"2013-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70ae0f3e-75a8-41c7-91c0-52d672809835","source":"wordfence","cve":"CVE-2023-41694","title":"Realbig <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ae0f3e-75a8-41c7-91c0-52d672809835?source=api-prod","affected":[{"type":"plugin","slug":"realbig-media","name":"Realbig For WordPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-09-04T00:00:00Z","updated":"2024-05-22T16:06:34Z"},{"id":"wordfence:70b00cfc-4a9b-442a-9c80-fd080924ca34","source":"wordfence","cve":"CVE-2024-22154","title":"SalesKing <= 1.6.15 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70b00cfc-4a9b-442a-9c80-fd080924ca34?source=api-prod","affected":[{"type":"plugin","slug":"salesking","name":"SalesKing","from":"*","from_inclusive":true,"to":"1.6.15","to_inclusive":true,"patched_in":"1.6.30"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70b18fd0-41e5-4679-a7a5-3dd6eaa29136","source":"wordfence","cve":"CVE-2024-52393","title":"Podlove Podcast Publisher <= 4.1.15 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70b18fd0-41e5-4679-a7a5-3dd6eaa29136?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.17"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T14:03:30Z"},{"id":"wordfence:70b2f35d-c58b-480c-a893-e970daca5f3f","source":"wordfence","cve":"CVE-2025-12707","title":"Library Management System <= 3.2.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70b2f35d-c58b-480c-a893-e970daca5f3f?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:15Z"},{"id":"wordfence:70b472f4-3a2d-4378-8b30-42859ec6ac39","source":"wordfence","cve":"CVE-2026-8155","title":"BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70b472f4-3a2d-4378-8b30-42859ec6ac39?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.4.0","to_inclusive":true,"patched_in":"14.5.0"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:36:31Z"},{"id":"wordfence:70b56b64-2334-44f1-9924-1ea642664b41","source":"wordfence","cve":"CVE-2026-54847","title":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator <= 8.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70b56b64-2334-44f1-9924-1ea642664b41?source=api-prod","affected":[{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"8.3.9","to_inclusive":true,"patched_in":"8.3.10"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:35:07Z"},{"id":"wordfence:70bac5e0-8182-426c-94da-e6832af8c487","source":"wordfence","cve":"CVE-2023-48781","title":"MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 - Cross-Site Request Forgery via multiple functions","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70bac5e0-8182-426c-94da-e6832af8c487?source=api-prod","affected":[{"type":"plugin","slug":"wc-ciudades-y-regiones-de-chile","name":"MkRapel Regiones y Ciudades de Chile para WC","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70bc5247-525d-4aae-9d66-efd65c9beee3","source":"wordfence","cve":"CVE-2026-3533","title":"JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70bc5247-525d-4aae-9d66-efd65c9beee3?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2026-03-23T10:26:58Z","updated":"2026-03-23T23:25:49Z"},{"id":"wordfence:70bc58a7-8de3-4d3e-b8f3-b422d4af8d4b","source":"wordfence","cve":"CVE-2025-58033","title":"Draft <= 3.0.9 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70bc58a7-8de3-4d3e-b8f3-b422d4af8d4b?source=api-prod","affected":[{"type":"plugin","slug":"website-builder","name":"Draft \u2013 Tailwind CSS for WordPress.","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:32:55Z"},{"id":"wordfence:70bda4b7-e442-4956-b3cb-8df96043bcde","source":"wordfence","cve":"CVE-2024-1235","title":"Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70bda4b7-e442-4956-b3cb-8df96043bcde?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"8.3.3"}],"published":"2024-02-07T00:00:00Z","updated":"2024-02-20T18:56:34Z"},{"id":"wordfence:70beb971-9863-46c1-888a-fd8e02a9b18b","source":"wordfence","cve":"CVE-2025-59569","title":"CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70beb971-9863-46c1-888a-fd8e02a9b18b?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.26","to_inclusive":true,"patched_in":"1.1.27"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:12:55Z"},{"id":"wordfence:70c144c9-2d96-404d-bcca-707519c9b71c","source":"wordfence","cve":"","title":"WP Content Copy Protection & No Right Click <= 3.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c144c9-2d96-404d-bcca-707519c9b71c?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-copy-protector","name":"WP Content Copy Protection & No Right Click","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70c1ee04-cfb1-4819-95ab-497e814da16f","source":"wordfence","cve":"CVE-2024-8664","title":"WP Test Email <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c1ee04-cfb1-4819-95ab-497e814da16f?source=api-prod","affected":[{"type":"plugin","slug":"wp-test-email","name":"WP Test Email","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-09-12T18:16:04Z","updated":"2024-09-13T06:47:28Z"},{"id":"wordfence:70c38363-4648-4668-bb32-14351ed7fd07","source":"wordfence","cve":"CVE-2025-31831","title":"AtomChat <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c38363-4648-4668-bb32-14351ed7fd07?source=api-prod","affected":[{"type":"plugin","slug":"atomchat","name":"Group Chat & Video Chat by AtomChat","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-04-01T00:00:00Z","updated":"2026-04-15T13:28:18Z"},{"id":"wordfence:70c41a28-982f-43e6-9415-3a2d996959f3","source":"wordfence","cve":"CVE-2025-6787","title":"Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c41a28-982f-43e6-9415-3a2d996959f3?source=api-prod","affected":[{"type":"plugin","slug":"smart-docs","name":"Smart Docs","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-07-03T12:20:28Z","updated":"2025-07-10T14:04:51Z"},{"id":"wordfence:70c61873-8339-44ec-8452-17d0fc49ff49","source":"wordfence","cve":"CVE-2026-83560","title":"New User Approve 3.1.0 - 3.2.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c61873-8339-44ec-8452-17d0fc49ff49?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"3.1.0","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:55:47Z"},{"id":"wordfence:70c6bfb9-46d4-43ed-a6b4-9fe1fc9aa945","source":"wordfence","cve":"","title":"Link2Player <= 0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c6bfb9-46d4-43ed-a6b4-9fe1fc9aa945?source=api-prod","affected":[{"type":"plugin","slug":"link2player","name":"Link2Player","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70c8ab61-b2e2-4259-ae4b-248c139730ec","source":"wordfence","cve":"CVE-2025-39493","title":"Rankie < 1.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70c8ab61-b2e2-4259-ae4b-248c139730ec?source=api-prod","affected":[{"type":"plugin","slug":"valvepress-rankie","name":"Rankie - Wordpress Rank Tracker Plugin","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2025-05-16T00:00:00Z","updated":"2026-03-17T21:38:49Z"},{"id":"wordfence:70ca7ad4-6848-4f87-ae2d-4b9c2ffa668e","source":"wordfence","cve":"CVE-2023-0277","title":"WC Fields Factory <= 4.1.5 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ca7ad4-6848-4f87-ae2d-4b9c2ffa668e?source=api-prod","affected":[{"type":"plugin","slug":"wc-fields-factory","name":"WC Fields Factory","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70cd028d-122d-4e3c-ac09-150dec07a2cd","source":"wordfence","cve":"CVE-2024-2538","title":"Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70cd028d-122d-4e3c-ac09-150dec07a2cd?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":true,"patched_in":"2.4.3.2"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-20T05:32:56Z"},{"id":"wordfence:70ce4450-e38b-422e-a171-09f428dfe0d8","source":"wordfence","cve":"CVE-2015-9456","title":"Child Theme Creator by Orbisius <= 1.2.7 - Arbitrary File Write","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ce4450-e38b-422e-a171-09f428dfe0d8?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-child-theme-creator","name":"Child Theme Creator by Orbisius","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70ce8500-7140-4c97-a91c-55029e67362c","source":"wordfence","cve":"CVE-2024-50530","title":"Stars SMTP Mailer <= 1.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ce8500-7140-4c97-a91c-55029e67362c?source=api-prod","affected":[{"type":"plugin","slug":"stars-smtp-mailer","name":"Stars SMTP Mailer","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-10-30T00:00:00Z","updated":"2025-06-27T19:49:10Z"},{"id":"wordfence:70d046c9-a0c2-4059-aa1d-47caa1ffe76c","source":"wordfence","cve":"CVE-2022-2710","title":"Scroll To Top <= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d046c9-a0c2-4059-aa1d-47caa1ffe76c?source=api-prod","affected":[{"type":"plugin","slug":"scroll-top","name":"Scroll To Top","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70d05b9e-bead-42f9-9d19-c92c8e6440cd","source":"wordfence","cve":"CVE-2024-22307","title":"WP-Lister Lite for eBay <= 3.5.7 - Reflected Cross-Site Scripting via 's'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d05b9e-bead-42f9-9d19-c92c8e6440cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:56:18Z"},{"id":"wordfence:70d168a4-a659-4354-889e-7907215351a2","source":"wordfence","cve":"CVE-2022-46856","title":"Woocommerce Product Designer <= 4.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d168a4-a659-4354-889e-7907215351a2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-designer","name":"Woocommerce Products Designer by ORION \u2013 online product customizer for t-shirts, print cards, phone cases Lettering & Decals","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70d4041e-4b38-4be0-8e51-5a9db4d6c697","source":"wordfence","cve":"CVE-2021-24160","title":"Responsive Menu 4.0 - 4.0.3 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d4041e-4b38-4be0-8e51-5a9db4d6c697?source=api-prod","affected":[{"type":"plugin","slug":"responsive-menu","name":"Responsive Menu \u2013 Mobile Menu & Hamburger Menu Builder","from":"4.0","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70d5fccb-a5df-4ffc-a716-f00e6b968b40","source":"wordfence","cve":"CVE-2013-3479","title":"ShareThis <= 7.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d5fccb-a5df-4ffc-a716-f00e6b968b40?source=api-prod","affected":[{"type":"plugin","slug":"share-this","name":"share-this","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2013-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70d90c0c-e3c6-4db9-b16d-1442e7e1dc3b","source":"wordfence","cve":"CVE-2026-15965","title":"MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70d90c0c-e3c6-4db9-b16d-1442e7e1dc3b?source=api-prod","affected":[{"type":"plugin","slug":"maxupload-upload-larger-files-easily","name":"MaxUpload \u2013 Big File Uploads \u2013 Increase Maximum File Upload Size","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:02:27Z","updated":"2026-08-15T02:26:17Z"},{"id":"wordfence:70da8039-6526-47fa-934d-53fa29ca1bf0","source":"wordfence","cve":"CVE-2024-30529","title":"Tainacan <= 0.20.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70da8039-6526-47fa-934d-53fa29ca1bf0?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.20.7","to_inclusive":true,"patched_in":"0.20.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:37:04Z"},{"id":"wordfence:70db1a8e-ebff-4505-9e43-1ce48e94f3c5","source":"wordfence","cve":"","title":"WP Statistics <= 9.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70db1a8e-ebff-4505-9e43-1ce48e94f3c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"9.5.1","to_inclusive":true,"patched_in":"9.5.2"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70dd560c-975c-4c64-a0e0-de856c5bae3a","source":"wordfence","cve":"CVE-2025-24720","title":"Sticky Buttons <= 4.1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70dd560c-975c-4c64-a0e0-de856c5bae3a?source=api-prod","affected":[{"type":"plugin","slug":"sticky-buttons","name":"Sticky Buttons \u2013 Floating Buttons Builder","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:20:17Z"},{"id":"wordfence:70dda3b3-8515-49b2-8e45-21ceb9aeb419","source":"wordfence","cve":"CVE-2026-42651","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70dda3b3-8515-49b2-8e45-21ceb9aeb419?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":"5.3.10"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:56:44Z"},{"id":"wordfence:70dfe9ca-77d5-4ab9-b251-360f89cc1de1","source":"wordfence","cve":"CVE-2025-32206","title":"Processing Projects <= 1.0.2 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70dfe9ca-77d5-4ab9-b251-360f89cc1de1?source=api-prod","affected":[{"type":"plugin","slug":"processing-projects","name":"Processing Projects","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-08T00:00:00Z","updated":"2025-04-15T12:59:08Z"},{"id":"wordfence:70dffb0a-eef0-4df7-977b-a36f937a4a89","source":"wordfence","cve":"CVE-2024-11972","title":"Hunk Companion <= 1.8.5 -  Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70dffb0a-eef0-4df7-977b-a36f937a4a89?source=api-prod","affected":[{"type":"plugin","slug":"hunk-companion","name":"Hunk Companion","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-12-10T00:00:00Z","updated":"2025-01-17T14:10:43Z"},{"id":"wordfence:70e059d9-3a69-4d6b-97ea-4f7f40199af9","source":"wordfence","cve":"CVE-2025-53306","title":"WP Forum  Server <= 1.8.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e059d9-3a69-4d6b-97ea-4f7f40199af9?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:46:05Z"},{"id":"wordfence:70e1d701-2cff-4793-9e4c-5b16a4038e8d","source":"wordfence","cve":"CVE-2023-2833","title":"ReviewX <= 1.6.13 - Arbitrary Usermeta Update  to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e1d701-2cff-4793-9e4c-5b16a4038e8d?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":true,"patched_in":"1.6.14"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70e1e2b8-90cc-40eb-94ae-1d4e5b2259f3","source":"wordfence","cve":"CVE-2024-49316","title":"Akismet htaccess writer <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e1e2b8-90cc-40eb-94ae-1d4e5b2259f3?source=api-prod","affected":[{"type":"plugin","slug":"akismet-htaccess-writer","name":"Akismet htaccess writer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:43:37Z"},{"id":"wordfence:70e227a5-fc33-4ff2-a843-ef9484707ae7","source":"wordfence","cve":"CVE-2023-27422","title":"NS Coupon to Become Customer <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e227a5-fc33-4ff2-a843-ef9484707ae7?source=api-prod","affected":[{"type":"plugin","slug":"ns-coupon-to-become-customer","name":"NS Coupon To Become Customer","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70e29aa5-6f36-498f-ad85-f9d9ab8d9bcb","source":"wordfence","cve":"","title":"sem-wysiwyg <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e29aa5-6f36-498f-ad85-f9d9ab8d9bcb?source=api-prod","affected":[{"type":"plugin","slug":"sem-wysiwyg","name":"sem-wysiwyg","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2012-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70e6a0b9-5bf2-4d0b-976e-6d5c56dff37c","source":"wordfence","cve":"CVE-2024-37225","title":"Zoho Marketing Automation <= 1.2.7 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e6a0b9-5bf2-4d0b-976e-6d5c56dff37c?source=api-prod","affected":[{"type":"plugin","slug":"zoho-marketinghub","name":"Zoho Marketing Automation","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-26T19:58:11Z"},{"id":"wordfence:70e6c4cd-c415-4f17-8bc4-353aa04dda9a","source":"wordfence","cve":"CVE-2025-53989","title":"JetBlocks For Elementor <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e6c4cd-c415-4f17-8bc4-353aa04dda9a?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.19.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:49:50Z"},{"id":"wordfence:70e6fce5-dae3-447f-8342-542e8f61168d","source":"wordfence","cve":"CVE-2026-108482","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70e6fce5-dae3-447f-8342-542e8f61168d?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.110","to_inclusive":true,"patched_in":"4.11.111"}],"published":"2026-10-12T17:13:00Z","updated":"2026-10-13T14:05:30Z"},{"id":"wordfence:70eaf9b8-67a0-4e98-b65c-aea61b20b448","source":"wordfence","cve":"CVE-2025-5536","title":"Freemind Viewer <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70eaf9b8-67a0-4e98-b65c-aea61b20b448?source=api-prod","affected":[{"type":"plugin","slug":"wp-freemind","name":"Freemind Viewer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-06T06:42:51Z"},{"id":"wordfence:70ed8cfb-845c-4015-a855-69f6577ccad9","source":"wordfence","cve":"CVE-2026-61946","title":"Easy Appointments <= 3.12.27 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ed8cfb-845c-4015-a855-69f6577ccad9?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.27","to_inclusive":true,"patched_in":"3.12.28"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-23T20:50:26Z"},{"id":"wordfence:70ede219-e59d-40dd-9e5e-4f44089d7524","source":"wordfence","cve":"CVE-2012-3574","title":"MM Forms Community <= 2.2.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ede219-e59d-40dd-9e5e-4f44089d7524?source=api-prod","affected":[{"type":"plugin","slug":"mm-forms-community","name":"mm-forms-community","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2012-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70ee7a29-69b0-49a8-a60e-7364ede4490a","source":"wordfence","cve":"CVE-2025-69053","title":"Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70ee7a29-69b0-49a8-a60e-7364ede4490a?source=api-prod","affected":[{"type":"plugin","slug":"universal-video-player","name":"Universal Video Player - WordPress Plugin","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:52:31Z"},{"id":"wordfence:70eea51c-d4dd-4b9b-a1ad-6077370dec1f","source":"wordfence","cve":"CVE-2022-1828","title":"PDF24 Articles To PDF <= 4.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70eea51c-d4dd-4b9b-a1ad-6077370dec1f?source=api-prod","affected":[{"type":"plugin","slug":"pdf24-posts-to-pdf","name":"PDF24 Articles To PDF","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70eff082-be02-471e-9ee6-42a1234009b2","source":"wordfence","cve":"CVE-2025-49856","title":"Responsive Plus <= 3.2.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70eff082-be02-471e-9ee6-42a1234009b2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:52:32Z"},{"id":"wordfence:70effa22-fbf6-44cb-9d1b-8625969c10ac","source":"wordfence","cve":"CVE-2024-0697","title":"Backuply \u2013 Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70effa22-fbf6-44cb-9d1b-8625969c10ac?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:36:35Z"},{"id":"wordfence:70f04f90-a0b7-46d1-85da-e898a6981fa2","source":"wordfence","cve":"CVE-2015-10146","title":"Thumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f04f90-a0b7-46d1-85da-e898a6981fa2?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-10-28T00:00:00Z","updated":"2025-10-29T09:27:56Z"},{"id":"wordfence:70f14d9d-6ed6-4bcb-944d-f9c5aa6a17a6","source":"wordfence","cve":"CVE-2023-5712","title":"System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f14d9d-6ed6-4bcb-944d-f9c5aa6a17a6?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70f2965a-37fe-4b7e-890a-9bf73b5de1c7","source":"wordfence","cve":"CVE-2022-41609","title":"Better Messages <= 1.9.10.68 - Server-Side Request Forgery","severity":"high","cvss":7.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f2965a-37fe-4b7e-890a-9bf73b5de1c7?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.10.68","to_inclusive":true,"patched_in":"1.9.10.69"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70f2c885-14b6-4ac3-b819-502bc618d9c9","source":"wordfence","cve":"CVE-2020-36503","title":"Connections Business Directory <= 9.6 - Authenticated CSV Injection","severity":"high","cvss":7.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f2c885-14b6-4ac3-b819-502bc618d9c9?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":true,"patched_in":"9.7"}],"published":"2020-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70f464ca-ff6c-4c2e-8b56-bf5e4bc6bd1f","source":"wordfence","cve":"CVE-2025-0954","title":"WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f464ca-ff6c-4c2e-8b56-bf5e4bc6bd1f?source=api-prod","affected":[{"type":"plugin","slug":"onlinecontract","name":"WP Online Contract","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:12:27Z","updated":"2025-03-05T09:21:48Z"},{"id":"wordfence:70f548f4-b783-4f7e-9a47-86ecbdb51e64","source":"wordfence","cve":"CVE-2026-106002","title":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking < 1.12.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f548f4-b783-4f7e-9a47-86ecbdb51e64?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":false,"patched_in":"1.12.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:19:29Z"},{"id":"wordfence:70f64ea0-5375-479f-90ac-29bcdf817cef","source":"wordfence","cve":"CVE-2026-18072","title":"Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026 10.8.7 - 10.8.8 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f64ea0-5375-479f-90ac-29bcdf817cef?source=api-prod","affected":[{"type":"plugin","slug":"advanced-responsive-video-embedder","name":"Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026","from":"10.8.7","from_inclusive":true,"to":"10.8.7","to_inclusive":true,"patched_in":"10.9.0"},{"type":"plugin","slug":"advanced-responsive-video-embedder","name":"Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026","from":"10.8.8","from_inclusive":true,"to":"10.8.8","to_inclusive":true,"patched_in":"10.9.0"}],"published":"2026-07-28T15:20:58Z","updated":"2026-08-15T18:18:10Z"},{"id":"wordfence:70f79f27-e577-4e1c-886f-bdb38cdc5600","source":"wordfence","cve":"CVE-2026-96554","title":"BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70f79f27-e577-4e1c-886f-bdb38cdc5600?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2026-10-30T20:46:05Z","updated":"2026-10-31T09:29:26Z"},{"id":"wordfence:70fa060f-11eb-4b51-b985-59421f44414e","source":"wordfence","cve":"CVE-2022-0328","title":"Simple Membership <= 4.0.8 - Cross-Site Request Forgery to Arbitrary Member Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70fa060f-11eb-4b51-b985-59421f44414e?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":false,"patched_in":"4.0.9"}],"published":"2022-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:70fb90f0-1ca4-41fe-8638-cdd05747adae","source":"wordfence","cve":"CVE-2025-12882","title":"Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70fb90f0-1ca4-41fe-8638-cdd05747adae?source=api-prod","affected":[{"type":"plugin","slug":"clasifico-listing","name":"Clasifico Listing","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:10:15Z","updated":"2026-02-19T03:25:15Z"},{"id":"wordfence:70fd7ec1-b75e-4c75-b2d9-39a7fddd7339","source":"wordfence","cve":"CVE-2025-49922","title":"WPeMatico RSS Feed Fetcher <= 2.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70fd7ec1-b75e-4c75-b2d9-39a7fddd7339?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2025-05-29T00:00:00Z","updated":"2025-11-04T17:07:01Z"},{"id":"wordfence:70fee28f-7a2b-4d57-9fca-04a805dca3f6","source":"wordfence","cve":"CVE-2022-2709","title":"Float to Top Button <= 2.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/70fee28f-7a2b-4d57-9fca-04a805dca3f6?source=api-prod","affected":[{"type":"plugin","slug":"float-to-top-button","name":"Float to Top Button","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71000db4-f581-44bc-8ac7-dcc5e9f9e040","source":"wordfence","cve":"CVE-2025-47633","title":"Awin \u2013 Advertiser Tracking for WooCommerce <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71000db4-f581-44bc-8ac7-dcc5e9f9e040?source=api-prod","affected":[{"type":"plugin","slug":"awin-advertiser-tracking","name":"Awin \u2013 Advertiser Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-30T18:11:26Z"},{"id":"wordfence:7100927e-fbcc-44ed-b7e1-475a5692c173","source":"wordfence","cve":"CVE-2024-35174","title":"Flo Forms <= 1.0.42 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7100927e-fbcc-44ed-b7e1-475a5692c173?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.42","to_inclusive":true,"patched_in":"1.0.43"}],"published":"2024-05-10T00:00:00Z","updated":"2024-10-25T20:44:48Z"},{"id":"wordfence:7102fb7f-eb69-4c2f-956b-61ceace968e4","source":"wordfence","cve":"CVE-2018-6002","title":"Soundy Background Music <= 3.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7102fb7f-eb69-4c2f-956b-61ceace968e4?source=api-prod","affected":[{"type":"plugin","slug":"soundy-background-music","name":"Soundy Background Music","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2018-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7102fb97-96a4-4fd9-824d-6fa6d483f37a","source":"wordfence","cve":"CVE-2025-6062","title":"Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7102fb97-96a4-4fd9-824d-6fa6d483f37a?source=api-prod","affected":[{"type":"plugin","slug":"yougler-blogger-profile-page","name":"Yougler Blogger Profile Page","from":"*","from_inclusive":true,"to":"v1.01","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:47:06Z","updated":"2025-06-18T12:43:47Z"},{"id":"wordfence:71053df9-c4b6-4c27-9582-600363b82a36","source":"wordfence","cve":"CVE-2024-44012","title":"WP Newsletter Subscription <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71053df9-c4b6-4c27-9582-600363b82a36?source=api-prod","affected":[{"type":"plugin","slug":"wp-newsletter-subscription","name":"WP Newsletter Subscription","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:38:57Z"},{"id":"wordfence:710574a8-a6e2-4ee6-9ea7-03a34994fec7","source":"wordfence","cve":"CVE-2024-4958","title":"User Registration \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.2.0.1 - Missing Authorization to Privilege Escalation","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.2.0.1","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-05-31T18:57:59Z","updated":"2024-06-01T07:35:57Z"},{"id":"wordfence:71078aaf-9803-4b46-bc94-dbcb43745629","source":"wordfence","cve":"CVE-2023-47869","title":"wpForo Forum <= 2.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71078aaf-9803-4b46-bc94-dbcb43745629?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-11-20T00:00:00Z","updated":"2024-05-30T15:38:36Z"},{"id":"wordfence:71083db7-377b-47a1-ac8b-83d8974a2654","source":"wordfence","cve":"CVE-2023-4916","title":"Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71083db7-377b-47a1-ac8b-83d8974a2654?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7108df0d-771a-4404-b90d-8ac8bc572898","source":"wordfence","cve":"CVE-2024-13882","title":"Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7108df0d-771a-4404-b90d-8ac8bc572898?source=api-prod","affected":[{"type":"plugin","slug":"aiomatic-automatic-ai-content-writer","name":"Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T08:22:57Z"},{"id":"wordfence:710aa0fd-34e2-4f0e-b354-0722d9692410","source":"wordfence","cve":"CVE-2023-34181","title":"WP-Cirrus <= 0.6.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710aa0fd-34e2-4f0e-b354-0722d9692410?source=api-prod","affected":[{"type":"plugin","slug":"wp-cirrus","name":"WP-Cirrus","from":"*","from_inclusive":true,"to":"0.6.11","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:710b8e4e-01de-4e99-8cf2-31abc2419b29","source":"wordfence","cve":"CVE-2023-6219","title":"BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710b8e4e-01de-4e99-8cf2-31abc2419b29?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.76","to_inclusive":true,"patched_in":"1.0.77"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:710bb2c7-af37-45f4-bede-35ff0d6b90ca","source":"wordfence","cve":"CVE-2025-32293","title":"Finance Consultant <= 2.8 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710bb2c7-af37-45f4-bede-35ff0d6b90ca?source=api-prod","affected":[{"type":"theme","slug":"finance","name":"Finance Consultant - Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:41:22Z"},{"id":"wordfence:710bdf8d-b06f-4b50-9f76-129c49d32dba","source":"wordfence","cve":"CVE-2025-23455","title":"WP VTiger Synchronization <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710bdf8d-b06f-4b50-9f76-129c49d32dba?source=api-prod","affected":[{"type":"plugin","slug":"msstiger","name":"WP VTiger Synchronization","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:27:31Z"},{"id":"wordfence:710e1c2c-4b5d-412c-950d-b5e530abf3a7","source":"wordfence","cve":"CVE-2025-24752","title":"Essential Addons for Elementor <= 6.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710e1c2c-4b5d-412c-950d-b5e530abf3a7?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.14","to_inclusive":true,"patched_in":"6.0.15"}],"published":"2025-02-04T00:00:00Z","updated":"2025-04-22T22:04:11Z"},{"id":"wordfence:710ed734-ca98-4ab3-82d5-359e683ee062","source":"wordfence","cve":"CVE-2025-12782","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.4.1"}],"published":"2025-12-03T18:08:15Z","updated":"2025-12-04T06:48:40Z"},{"id":"wordfence:710f663a-c8ff-457b-8b3f-4f6601ba321f","source":"wordfence","cve":"CVE-2024-30233","title":"WholesaleX <= 1.3.1 - Sensitive Information Exposure via export_users","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710f663a-c8ff-457b-8b3f-4f6601ba321f?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T18:25:26Z"},{"id":"wordfence:710fb372-4b7e-43e3-86a7-417143536f43","source":"wordfence","cve":"CVE-2026-83593","title":"WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/710fb372-4b7e-43e3-86a7-417143536f43?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"8.7.4"}],"published":"2026-09-08T16:50:30Z","updated":"2026-09-09T05:31:04Z"},{"id":"wordfence:71105a3c-4eb7-49b4-ba47-7997ddeb62c3","source":"wordfence","cve":"CVE-2024-43145","title":"GeoDirectory <= 2.3.61 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71105a3c-4eb7-49b4-ba47-7997ddeb62c3?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.61","to_inclusive":true,"patched_in":"2.3.62"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:36:56Z"},{"id":"wordfence:7110d8f1-8978-494e-afdb-ca96ee503ab7","source":"wordfence","cve":"CVE-2017-18597","title":"JTRT Responsive Tables < 4.1.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7110d8f1-8978-494e-afdb-ca96ee503ab7?source=api-prod","affected":[{"type":"plugin","slug":"jtrt-responsive-tables","name":"JTRT Responsive Tables","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":false,"patched_in":"4.1.2"}],"published":"2017-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71110eaa-d412-4082-95c2-39d245c768b3","source":"wordfence","cve":"CVE-2025-32534","title":"Workbox Video from Vimeo & Youtube <= 3.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71110eaa-d412-4082-95c2-39d245c768b3?source=api-prod","affected":[{"type":"plugin","slug":"workbox-video-from-vimeo-youtube-plugin","name":"Workbox Video from Vimeo & Youtube Plugin","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:01:04Z"},{"id":"wordfence:71114965-c8e3-4f2f-b308-f75adc7f2d31","source":"wordfence","cve":"CVE-2014-8724","title":"W3 Total Cache <= 0.9.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71114965-c8e3-4f2f-b308-f75adc7f2d31?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.4.1"}],"published":"2014-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71130bae-d871-43b5-81cd-b8459c8db316","source":"wordfence","cve":"","title":"Google Map Generator <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71130bae-d871-43b5-81cd-b8459c8db316?source=api-prod","affected":[{"type":"plugin","slug":"google-map-generator","name":"Google Map Generator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71135ae7-0df5-42aa-9ede-28d684d3632c","source":"wordfence","cve":"CVE-2025-60137","title":"Post Featured Video <= 1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71135ae7-0df5-42aa-9ede-28d684d3632c?source=api-prod","affected":[{"type":"plugin","slug":"post-featured-video","name":"Post Featured Video","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:16:07Z"},{"id":"wordfence:7115756e-69fa-42fe-bde3-a36e34d4bae3","source":"wordfence","cve":"CVE-2026-12102","title":"UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7115756e-69fa-42fe-bde3-a36e34d4bae3?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":"1.2.64"}],"published":"2026-06-17T18:09:44Z","updated":"2026-06-18T06:50:05Z"},{"id":"wordfence:71159d32-f7a3-4c5f-ac46-505f3acb3ddc","source":"wordfence","cve":"CVE-2026-121993","title":"wePOS \u2013 Point Of Sale (POS) for WooCommerce & Dokan  1.2.6 - 2.0.2 - Authenticated (Custom+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71159d32-f7a3-4c5f-ac46-505f3acb3ddc?source=api-prod","affected":[{"type":"plugin","slug":"wepos","name":"wePOS \u2013 Point Of Sale (POS) for WooCommerce & Dokan","from":"1.2.6","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T13:15:07Z"},{"id":"wordfence:71167dec-38ec-4eb3-8fab-25eca0f8b071","source":"wordfence","cve":"CVE-2026-8891","title":"BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71167dec-38ec-4eb3-8fab-25eca0f8b071?source=api-prod","affected":[{"type":"plugin","slug":"bitform","name":"BitForm \u2013 Data management solution for WordPress","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:27:05Z","updated":"2026-05-27T05:31:27Z"},{"id":"wordfence:711a7307-0a7a-4640-8d88-5c370b0156de","source":"wordfence","cve":"CVE-2017-18494","title":"Custom Search by BestWebSoft <= 1.35 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/711a7307-0a7a-4640-8d88-5c370b0156de?source=api-prod","affected":[{"type":"plugin","slug":"custom-search-plugin","name":"Custom Search by BestWebSoft \u2013 WordPress Custom Search Plugin","from":"*","from_inclusive":true,"to":"1.35","to_inclusive":true,"patched_in":"1.36"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:711b2889-8d12-4f7c-88e7-d3bb79e9c800","source":"wordfence","cve":"","title":"Simple Balance <= 2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/711b2889-8d12-4f7c-88e7-d3bb79e9c800?source=api-prod","affected":[{"type":"theme","slug":"simplebalance","name":"Simple Balance","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2011-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:711d2c4d-700d-4d6e-911f-99abf86eff32","source":"wordfence","cve":"CVE-2023-28747","title":"CBX Currency Converter <= 3.0.3 - Cross-Site Request Forgery leading to Plugin Settings Leakage/Changes","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/711d2c4d-700d-4d6e-911f-99abf86eff32?source=api-prod","affected":[{"type":"plugin","slug":"cbcurrencyconverter","name":"CBX Currency Converter","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7121bccd-9a93-4547-8882-4000b1fc1e50","source":"wordfence","cve":"CVE-2026-62078","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7121bccd-9a93-4547-8882-4000b1fc1e50?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.105","to_inclusive":true,"patched_in":"4.11.106"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:40:32Z"},{"id":"wordfence:712535ce-8c38-4944-aa0a-36d9bacaeb67","source":"wordfence","cve":"CVE-2026-1271","title":"ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712535ce-8c38-4944-aa0a-36d9bacaeb67?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.7.2","to_inclusive":true,"patched_in":"5.9.7.3"}],"published":"2026-02-04T20:36:46Z","updated":"2026-02-05T09:15:02Z"},{"id":"wordfence:71257639-2ba5-4ac2-b4fe-8f22311b6482","source":"wordfence","cve":"CVE-2026-48881","title":"TrueBooker \u2013 Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71257639-2ba5-4ac2-b4fe-8f22311b6482?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:34:47Z"},{"id":"wordfence:7126e39a-f3aa-4815-b039-485995d6bba3","source":"wordfence","cve":"CVE-2021-25009","title":"CorreosExpress <= 2.6.0 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7126e39a-f3aa-4815-b039-485995d6bba3?source=api-prod","affected":[{"type":"plugin","slug":"correos-express","name":"CorreosExpress \u2013 Shipping Management \u2013 Tags","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:712887d9-25fd-4d8f-a2e6-e6f2855f5ddb","source":"wordfence","cve":"","title":"Music <= 1.5 - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712887d9-25fd-4d8f-a2e6-e6f2855f5ddb?source=api-prod","affected":[{"type":"theme","slug":"music","name":"Music","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7129d8cf-6b7d-4b7b-bd6a-85176247ab29","source":"wordfence","cve":"CVE-2026-3460","title":"REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7129d8cf-6b7d-4b7b-bd6a-85176247ab29?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-to-miniprogram","name":"REST API TO MiniProgram","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:12Z","updated":"2026-03-21T03:26:50Z"},{"id":"wordfence:7129e5cb-ce70-477a-a8f1-3acf152dfc21","source":"wordfence","cve":"CVE-2025-12935","title":"FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7129e5cb-ce70-477a-a8f1-3acf152dfc21?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"2.9.84","to_inclusive":true,"patched_in":"2.9.85"}],"published":"2025-11-20T00:00:00Z","updated":"2025-11-21T12:28:09Z"},{"id":"wordfence:712b0976-09a5-41d6-8f96-79006a8d41ba","source":"wordfence","cve":"CVE-2024-35632","title":"Integration for Contact Form 7 and Constant Contact <= 1.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712b0976-09a5-41d6-8f96-79006a8d41ba?source=api-prod","affected":[{"type":"plugin","slug":"cf7-constant-contact","name":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-05-27T00:00:00Z","updated":"2025-04-25T14:50:55Z"},{"id":"wordfence:712d2d8b-2103-4262-807e-bb26cabb771c","source":"wordfence","cve":"CVE-2024-24877","title":"Wonder Slider Lite <= 13.9 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712d2d8b-2103-4262-807e-bb26cabb771c?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-slider-lite","name":"Wonder Slider Lite","from":"*","from_inclusive":true,"to":"13.9","to_inclusive":true,"patched_in":"14.0"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:35:57Z"},{"id":"wordfence:712e9341-5bd5-4b9c-891c-048ccec1ba45","source":"wordfence","cve":"CVE-2025-62959","title":"Paid Videochat Turnkey Site <= 7.3.23 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712e9341-5bd5-4b9c-891c-048ccec1ba45?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.3.23","to_inclusive":true,"patched_in":"7.3.24"}],"published":"2025-10-16T00:00:00Z","updated":"2026-02-26T15:20:58Z"},{"id":"wordfence:712e9754-a6f2-43b5-97be-9d23970b46ea","source":"wordfence","cve":"CVE-2021-39355","title":"Indeed Job Importer  <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712e9754-a6f2-43b5-97be-9d23970b46ea?source=api-prod","affected":[{"type":"plugin","slug":"indeed-job-importer","name":"Indeed Job Importer","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2021-10-15T19:23:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:712ffe0a-45a5-41c7-a2b9-e88fb381a684","source":"wordfence","cve":"CVE-2022-4267","title":"Bulk Delete Users by Email <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/712ffe0a-45a5-41c7-a2b9-e88fb381a684?source=api-prod","affected":[{"type":"plugin","slug":"bulk-delete-users-by-email","name":"Bulk Delete Users by Email","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-02T00:00:00Z","updated":"2025-09-26T18:28:11Z"},{"id":"wordfence:7130f325-a0c4-479d-ac85-94542bdb5a79","source":"wordfence","cve":"CVE-2026-17555","title":"WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7130f325-a0c4-479d-ac85-94542bdb5a79?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.131","to_inclusive":true,"patched_in":"0.9.132"}],"published":"2026-07-31T19:54:10Z","updated":"2026-08-01T08:32:27Z"},{"id":"wordfence:7134bb24-11a1-41f9-ad34-b4527c22463c","source":"wordfence","cve":"CVE-2024-13734","title":"Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7134bb24-11a1-41f9-ad34-b4527c22463c?source=api-prod","affected":[{"type":"plugin","slug":"card-elements-for-elementor","name":"Card Elements for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-02-26T20:43:43Z","updated":"2025-02-27T09:21:49Z"},{"id":"wordfence:71366213-79d8-4ab3-8ac5-f071b3f40248","source":"wordfence","cve":"CVE-2026-89328","title":"FluentBoards <= 2.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71366213-79d8-4ab3-8ac5-f071b3f40248?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T20:24:33Z"},{"id":"wordfence:71371a44-fed4-4aea-9f86-a37ca26a57b1","source":"wordfence","cve":"CVE-2015-9345","title":"Link Log \u2013 external link click monitor <= 1.4 - HTTP Response Splitting","severity":"high","cvss":7.5,"cwe":"CWE-113","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71371a44-fed4-4aea-9f86-a37ca26a57b1?source=api-prod","affected":[{"type":"plugin","slug":"link-log","name":"Smart External Link Click Monitor [Link Log]","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"2.0"}],"published":"2015-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71378c94-c2e6-43a9-bb8b-f2ffb153f3fe","source":"wordfence","cve":"CVE-2025-39590","title":"Essential Addons for Elementor <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71378c94-c2e6-43a9-bb8b-f2ffb153f3fe?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:30:56Z"},{"id":"wordfence:713a0824-c170-407a-9d74-54951eaa030c","source":"wordfence","cve":"CVE-2026-123484","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713a0824-c170-407a-9d74-54951eaa030c?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:22:01Z"},{"id":"wordfence:713aff2e-2e61-400d-9454-a61fad5e374b","source":"wordfence","cve":"CVE-2024-52470","title":"Dynamic URL SEO <= 1.0 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713aff2e-2e61-400d-9454-a61fad5e374b?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-url-seo","name":"Dynamic URL SEO","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-11-18T00:00:00Z","updated":"2024-12-10T14:20:16Z"},{"id":"wordfence:713b4fbc-7a46-40b1-8c4e-088a9859d7da","source":"wordfence","cve":"CVE-2025-53342","title":"Modernize <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713b4fbc-7a46-40b1-8c4e-088a9859d7da?source=api-prod","affected":[{"type":"theme","slug":"modernize","name":"Modernize - Flexibility of WordPress","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:55:56Z"},{"id":"wordfence:713b6359-bdea-4131-b754-24ee931463f3","source":"wordfence","cve":"CVE-2026-22325","title":"Promo <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713b6359-bdea-4131-b754-24ee931463f3?source=api-prod","affected":[{"type":"theme","slug":"promo","name":"Promo","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:54:03Z"},{"id":"wordfence:713bbae4-c037-47fc-b0c7-71667232de7b","source":"wordfence","cve":"CVE-2026-14862","title":"Support Genix Lite <= 1.4.47 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713bbae4-c037-47fc-b0c7-71667232de7b?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.47","to_inclusive":true,"patched_in":"1.4.48"}],"published":"2026-07-16T00:00:00Z","updated":"2026-08-15T21:08:26Z"},{"id":"wordfence:713c4652-9ca0-41f7-9a93-8186d9b359e8","source":"wordfence","cve":"CVE-2026-92978","title":"User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4652-9ca0-41f7-9a93-8186d9b359e8?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-16T14:40:54Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:713c4aac-e68a-4563-b12f-10e700a9dc65","source":"wordfence","cve":"CVE-2025-59133","title":"Projectopia <= 5.1.22 - Authenticated (Custom+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713c4aac-e68a-4563-b12f-10e700a9dc65?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":""}],"published":"2025-12-02T00:00:00Z","updated":"2026-01-15T16:59:50Z"},{"id":"wordfence:713d28e8-aeb7-46f5-88e3-768f0fd12dcc","source":"wordfence","cve":"CVE-2025-60225","title":"BugsPatrol <= 1.5.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713d28e8-aeb7-46f5-88e3-768f0fd12dcc?source=api-prod","affected":[{"type":"theme","slug":"bugspatrol","name":"BugsPatrol - Pest & Insects Control Disinsection Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-11-04T16:07:30Z"},{"id":"wordfence:713f4e44-30af-4182-9304-0c83d041263d","source":"wordfence","cve":"CVE-2026-84151","title":"The Post Grid <= 7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713f4e44-30af-4182-9304-0c83d041263d?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.4","to_inclusive":true,"patched_in":"7.9.5"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:50:51Z"},{"id":"wordfence:713f5bf5-f282-436e-8e8c-18543458bea1","source":"wordfence","cve":"CVE-2024-13458","title":"WordPress SEO Friendly Accordion FAQ with AI assisted content generation <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/713f5bf5-f282-436e-8e8c-18543458bea1?source=api-prod","affected":[{"type":"plugin","slug":"notice-faq","name":"WordPress SEO Friendly Accordion FAQ with AI assisted content generation","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:40:46Z","updated":"2025-01-25T07:24:15Z"},{"id":"wordfence:71408e0b-aed8-4077-add2-7f3b249e85f5","source":"wordfence","cve":"CVE-2024-5218","title":"Reviews and Rating \u2013 Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71408e0b-aed8-4077-add2-7f3b249e85f5?source=api-prod","affected":[{"type":"plugin","slug":"g-business-reviews-rating","name":"Reviews and Rating \u2013 Google Reviews","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2024-05-24T14:53:12Z","updated":"2024-05-31T15:30:25Z"},{"id":"wordfence:7140e0ef-cdd9-4921-8a50-8f65f3a3c192","source":"wordfence","cve":"CVE-2026-119370","title":"The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7140e0ef-cdd9-4921-8a50-8f65f3a3c192?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.2","to_inclusive":true,"patched_in":"6.18.3"}],"published":"2026-10-30T14:41:00Z","updated":"2026-11-03T19:50:52Z"},{"id":"wordfence:71415e73-0c7c-4f4a-9322-8d8a1d61c0d4","source":"wordfence","cve":"CVE-2022-2275","title":"WP Edit Menu <= 1.5.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71415e73-0c7c-4f4a-9322-8d8a1d61c0d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-menu","name":"WP Edit Menu","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7141edc6-8b34-4624-8264-9ca1696ccdbf","source":"wordfence","cve":"CVE-2024-13570","title":"Stray Random Quotes <= 1.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7141edc6-8b34-4624-8264-9ca1696ccdbf?source=api-prod","affected":[{"type":"plugin","slug":"stray-quotes","name":"Stray Random Quotes","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-21T00:00:00Z","updated":"2025-02-26T20:31:18Z"},{"id":"wordfence:7145fe39-cc90-46e4-ae74-b64694d0dc7f","source":"wordfence","cve":"CVE-2026-85677","title":"Gutenverse News \u2013 News Blocks for Blog & Magazine Sites < 3.3.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7145fe39-cc90-46e4-ae74-b64694d0dc7f?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-news","name":"Gutenverse News \u2013 News Blocks for Blog & Magazine Sites","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:20:41Z"},{"id":"wordfence:71463210-d65f-4a6c-ab5f-ebaafebb83e2","source":"wordfence","cve":"CVE-2013-3257","title":"Related Posts < 2.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71463210-d65f-4a6c-ab5f-ebaafebb83e2?source=api-prod","affected":[{"type":"plugin","slug":"related-posts","name":"Related Posts","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2013-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7147cb69-294e-4270-bf8b-3a32a5552d1e","source":"wordfence","cve":"CVE-2024-3075","title":"MM-email2image <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7147cb69-294e-4270-bf8b-3a32a5552d1e?source=api-prod","affected":[{"type":"plugin","slug":"mm-email2image","name":"MM-email2image","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T17:36:16Z"},{"id":"wordfence:7148e182-858c-42b1-b9db-9b7a267483e1","source":"wordfence","cve":"CVE-2022-3417","title":"WPtouch <= 4.3.44 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7148e182-858c-42b1-b9db-9b7a267483e1?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"4.3.44","to_inclusive":true,"patched_in":"4.3.45"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:714acd7d-6d19-4087-bb27-b9a4ccbb678b","source":"wordfence","cve":"CVE-2024-6171","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714acd7d-6d19-4087-bb27-b9a4ccbb678b?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.112","to_inclusive":true,"patched_in":"1.5.113"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T04:32:54Z"},{"id":"wordfence:714d10b0-526c-4347-a369-85fc32ef3478","source":"wordfence","cve":"CVE-2026-119075","title":"Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714d10b0-526c-4347-a369-85fc32ef3478?source=api-prod","affected":[{"type":"plugin","slug":"registration-form-for-woocommerce","name":"Registration Form for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-11-06T21:45:02Z","updated":"2026-11-07T11:26:30Z"},{"id":"wordfence:714d7811-0425-4833-a7b2-a408799181e4","source":"wordfence","cve":"CVE-2023-25466","title":"Who Hit The Page \u2013 Hit Counter <= 1.4.14.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714d7811-0425-4833-a7b2-a408799181e4?source=api-prod","affected":[{"type":"plugin","slug":"who-hit-the-page-hit-counter","name":"Who Hit The Page \u2013 Hit Counter","from":"*","from_inclusive":true,"to":"1.4.14.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:714f9ea7-324a-4d19-8289-1a067e55b703","source":"wordfence","cve":"CVE-2026-85007","title":"YT Player <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714f9ea7-324a-4d19-8289-1a067e55b703?source=api-prod","affected":[{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T20:12:44Z"},{"id":"wordfence:714fc209-c872-45e5-9957-0671432cb42f","source":"wordfence","cve":"CVE-2026-66611","title":"Paymob for WooCommerce <= 4.1.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/714fc209-c872-45e5-9957-0671432cb42f?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:23:50Z"},{"id":"wordfence:7150179c-e449-4574-a9d3-bd4acf43b3c1","source":"wordfence","cve":"CVE-2025-25131","title":"RJ Quickcharts <= 0.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7150179c-e449-4574-a9d3-bd4acf43b3c1?source=api-prod","affected":[{"type":"plugin","slug":"rj-quickcharts","name":"RJ Quickcharts","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:10:36Z"},{"id":"wordfence:7152253a-7bb8-4b5c-bffd-86e46df54b7e","source":"wordfence","cve":"CVE-2023-5048","title":"WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7152253a-7bb8-4b5c-bffd-86e46df54b7e?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-builder","name":"WDContactFormBuilder","from":"*","from_inclusive":true,"to":"1.0.72","to_inclusive":true,"patched_in":""}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:715332d3-fa63-4036-8b10-3d500ca8963f","source":"wordfence","cve":"CVE-2024-49681","title":"WP Sessions Time Monitoring Full Automatic <= 1.0.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715332d3-fa63-4036-8b10-3d500ca8963f?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:57:36Z"},{"id":"wordfence:71548a7f-43a5-4f71-8add-45f675e8aa66","source":"wordfence","cve":"","title":"Enhanced WP Contact Form <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71548a7f-43a5-4f71-8add-45f675e8aa66?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-wordpress-contactform","name":"Enhanced WP Contact Form","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7154d788-54d8-4343-b75f-25858252ad9b","source":"wordfence","cve":"CVE-2026-106605","title":"Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce <= 2.3.22 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7154d788-54d8-4343-b75f-25858252ad9b?source=api-prod","affected":[{"type":"plugin","slug":"flexible-quantity-measurement-price-calculator-for-woocommerce","name":"Flexible Quantity & Price Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.22","to_inclusive":true,"patched_in":"2.3.23"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-13T19:32:21Z"},{"id":"wordfence:71550a11-20f4-46fa-8b2a-8d3789db4697","source":"wordfence","cve":"CVE-2024-12808","title":"WP ERP <= 1.13.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71550a11-20f4-46fa-8b2a-8d3789db4697?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T15:57:19Z"},{"id":"wordfence:71564eec-426a-46fa-b614-388bebae6ebd","source":"wordfence","cve":"CVE-2024-3548","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71564eec-426a-46fa-b614-388bebae6ebd?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:24:01Z"},{"id":"wordfence:715723e7-5820-4a64-848f-f89b5b73a681","source":"wordfence","cve":"CVE-2026-15369","title":"Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715723e7-5820-4a64-848f-f89b5b73a681?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-plugin-for-woocommerce","name":"Custom User Registration Fields for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-08-29T06:31:39Z","updated":"2026-08-29T19:26:36Z"},{"id":"wordfence:7158ed57-37b4-43ac-b323-46febaaccffc","source":"wordfence","cve":"CVE-2025-68997","title":"wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7158ed57-37b4-43ac-b323-46febaaccffc?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.42","to_inclusive":true,"patched_in":"7.6.44"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-20T15:08:25Z"},{"id":"wordfence:71597452-ac9a-4f1f-8b3a-3b711e2fcb38","source":"wordfence","cve":"CVE-2025-58612","title":"PropertyHive <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71597452-ac9a-4f1f-8b3a-3b711e2fcb38?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T20:27:15Z"},{"id":"wordfence:715b0d61-1fac-4039-b18c-e9371788c24c","source":"wordfence","cve":"CVE-2019-13578","title":"GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715b0d61-1fac-4039-b18c-e9371788c24c?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:715b4d10-b19a-4b37-8a76-985c37975c93","source":"wordfence","cve":"CVE-2026-104725","title":"Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715b4d10-b19a-4b37-8a76-985c37975c93?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2026-10-09T17:12:54Z","updated":"2026-10-10T05:31:00Z"},{"id":"wordfence:715dc265-253e-4409-b57d-474d3740adbe","source":"wordfence","cve":"CVE-2020-5780","title":"Email Subscribers & Newsletters <= 4.5.5 - Unauthenticated Email Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715dc265-253e-4409-b57d-474d3740adbe?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":false,"patched_in":"4.5.6"}],"published":"2020-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:715e3947-922e-4549-b601-6a2ae441ddf6","source":"wordfence","cve":"CVE-2024-32518","title":"PeproDev Ultimate Invoice <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/715e3947-922e-4549-b601-6a2ae441ddf6?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-03T20:02:21Z"},{"id":"wordfence:71625093-d813-43d9-95ec-d4ae0934abec","source":"wordfence","cve":"CVE-2025-39494","title":"Wilm\u00ebr < 3.4.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71625093-d813-43d9-95ec-d4ae0934abec?source=api-prod","affected":[{"type":"theme","slug":"wilmer","name":"Wilm\u00ebr - Construction WordPress Theme","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:24:57Z"},{"id":"wordfence:7163be31-8f55-45ba-8364-e84a3e636d5b","source":"wordfence","cve":"CVE-2026-116613","title":"Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7163be31-8f55-45ba-8364-e84a3e636d5b?source=api-prod","affected":[{"type":"plugin","slug":"animated-text-block","name":"Animated Text Block \u2013 Add Typing and Looping Text Effects","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-10-27T14:55:56Z","updated":"2026-10-28T03:42:54Z"},{"id":"wordfence:71642341-9fe0-44a9-88f3-70167dc6ca62","source":"wordfence","cve":"CVE-2026-1708","title":"Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71642341-9fe0-44a9-88f3-70167dc6ca62?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.27","to_inclusive":true,"patched_in":"1.6.9.29"}],"published":"2026-03-10T19:14:37Z","updated":"2026-03-11T13:37:12Z"},{"id":"wordfence:7167a731-8677-4ae2-a790-00a8295c9191","source":"wordfence","cve":"CVE-2024-0365","title":"Fancy Product Designer <= 6.1.4 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7167a731-8677-4ae2-a790-00a8295c9191?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2024-02-20T00:00:00Z","updated":"2024-04-24T14:20:47Z"},{"id":"wordfence:7169f450-9f9b-47f9-8c34-93b089f6deba","source":"wordfence","cve":"CVE-2026-32463","title":"Sync Post With Other Site <= 1.9.3 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7169f450-9f9b-47f9-8c34-93b089f6deba?source=api-prod","affected":[{"type":"plugin","slug":"sync-post-with-other-site","name":"Sync Post With Other Site","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2026-08-17T12:33:31Z","updated":"2026-11-10T23:19:29Z"},{"id":"wordfence:716a7c3c-2e26-4da9-a299-7dcbaa7e4895","source":"wordfence","cve":"CVE-2026-19887","title":"Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/716a7c3c-2e26-4da9-a299-7dcbaa7e4895?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2026-09-04T17:58:58Z","updated":"2026-09-05T06:37:57Z"},{"id":"wordfence:716b51e2-347d-42dc-b930-e02ff29385e5","source":"wordfence","cve":"CVE-2026-25381","title":"LoveDate < 3.8.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/716b51e2-347d-42dc-b930-e02ff29385e5?source=api-prod","affected":[{"type":"theme","slug":"lovedate","name":"LoveDate - Social Dating Network WordPress Theme","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":false,"patched_in":"3.8.6"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:48:19Z"},{"id":"wordfence:716d4f0b-939c-42c2-bfb8-dc39df79bdbc","source":"wordfence","cve":"CVE-2025-23698","title":"WP Custom Google Search <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/716d4f0b-939c-42c2-bfb8-dc39df79bdbc?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-google-search","name":"WP Custom Google Search","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:56:42Z"},{"id":"wordfence:71738a18-84ac-4cd9-bf1f-870813afc12d","source":"wordfence","cve":"CVE-2025-53199","title":"HT Slider For Elementor <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71738a18-84ac-4cd9-bf1f-870813afc12d?source=api-prod","affected":[{"type":"plugin","slug":"ht-slider-for-elementor","name":"HT Slider For Elementor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:36:03Z"},{"id":"wordfence:71772131-812e-4561-bab1-d4cf0832d777","source":"wordfence","cve":"CVE-2025-47640","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.4.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71772131-812e-4561-bab1-d4cf0832d777?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-05-16T00:00:00Z","updated":"2025-07-17T17:31:55Z"},{"id":"wordfence:71782003-3fbf-44d3-a5fd-7370acff2eea","source":"wordfence","cve":"CVE-2024-6205","title":"PayPlus Payment Gateway <= 6.6.8 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71782003-3fbf-44d3-a5fd-7370acff2eea?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"6.6.8","to_inclusive":true,"patched_in":"6.6.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-01T14:50:02Z"},{"id":"wordfence:7179fe0d-8cfa-4b43-82d6-5523d65ff780","source":"wordfence","cve":"CVE-2024-32836","title":"WP-Lister Lite for eBay <= 3.5.11 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7179fe0d-8cfa-4b43-82d6-5523d65ff780?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:10:56Z"},{"id":"wordfence:717ba3d3-c360-4575-aca6-a25c4147f93d","source":"wordfence","cve":"CVE-2026-22468","title":"Absolute Addons For Elementor <= 1.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/717ba3d3-c360-4575-aca6-a25c4147f93d?source=api-prod","affected":[{"type":"plugin","slug":"absolute-addons","name":"Absolute Addons For Elementor","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T19:27:31Z"},{"id":"wordfence:717dfceb-dc0b-45ef-bc06-72658486d1f1","source":"wordfence","cve":"CVE-2024-32530","title":"Simple Testimonials Showcase  <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/717dfceb-dc0b-45ef-bc06-72658486d1f1?source=api-prod","affected":[{"type":"plugin","slug":"simple-testimonials-showcase","name":"Simple Testimonials Showcase","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-29T21:10:55Z"},{"id":"wordfence:717e77b7-8b42-4fca-b288-2415db2d68e6","source":"wordfence","cve":"CVE-2024-30448","title":"Slider by Supsystic <= 1.8.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/717e77b7-8b42-4fca-b288-2415db2d68e6?source=api-prod","affected":[{"type":"plugin","slug":"slider-by-supsystic","name":"Slider by Supsystic","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.11"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T21:00:46Z"},{"id":"wordfence:717e8479-921b-4f18-8fbe-32e0d8a37590","source":"wordfence","cve":"CVE-2026-89412","title":"TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/717e8479-921b-4f18-8fbe-32e0d8a37590?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2026-09-21T17:38:25Z","updated":"2026-09-22T06:39:41Z"},{"id":"wordfence:717eba02-4ee0-4eb4-b1fb-0939e09d04c9","source":"wordfence","cve":"CVE-2025-23909","title":"Compare Ninja <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/717eba02-4ee0-4eb4-b1fb-0939e09d04c9?source=api-prod","affected":[{"type":"plugin","slug":"compare-ninja-comparison-tables","name":"Compare Ninja: Create Professional Comparison Tables and Easily Add Them to Your Website","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:11:14Z"},{"id":"wordfence:71823e36-3899-4253-a1d2-c6f8921d18dc","source":"wordfence","cve":"CVE-2023-6966","title":"The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions","severity":"high","cvss":8.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=api-prod","affected":[{"type":"plugin","slug":"the-moneytizer","name":"The Moneytizer","from":"*","from_inclusive":true,"to":"9.6.3","to_inclusive":true,"patched_in":"10.0.1"}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-29T21:36:35Z"},{"id":"wordfence:7183023b-f32c-4281-b540-3ae9875a2141","source":"wordfence","cve":"CVE-2026-95596","title":"ShopBuilder \u2013 WooCommerce Builder For Elementor <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7183023b-f32c-4281-b540-3ae9875a2141?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:51:46Z"},{"id":"wordfence:7183288f-47f1-477b-974d-e5e21c170d0f","source":"wordfence","cve":"CVE-2014-5200","title":"FBGorilla (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7183288f-47f1-477b-974d-e5e21c170d0f?source=api-prod","affected":[{"type":"plugin","slug":"fbgorilla","name":"fbgorilla","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71859023-c64a-4d77-8505-33fe4fae2475","source":"wordfence","cve":"CVE-2025-22793","title":"Bold pagos en linea <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71859023-c64a-4d77-8505-33fe4fae2475?source=api-prod","affected":[{"type":"plugin","slug":"bold-pagos-en-linea","name":"Bold pagos en linea","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-30T15:12:22Z"},{"id":"wordfence:718615b1-9c25-4119-bc30-683ef51e5861","source":"wordfence","cve":"CVE-2012-6512","title":"Organizer <= 1.2.1 - Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718615b1-9c25-4119-bc30-683ef51e5861?source=api-prod","affected":[{"type":"plugin","slug":"organizer","name":"Organizer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2012-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:718c60c1-6117-4959-a907-d0ef457f7185","source":"wordfence","cve":"CVE-2024-7092","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718c60c1-6117-4959-a907-d0ef457f7185?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.27","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2024-08-12T16:05:31Z","updated":"2024-08-13T04:29:12Z"},{"id":"wordfence:718d12fe-31e4-4fa1-ba9a-8626df8ddbfe","source":"wordfence","cve":"CVE-2024-5024","title":"MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718d12fe-31e4-4fa1-ba9a-8626df8ddbfe?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.29","to_inclusive":true,"patched_in":"1.11.30"}],"published":"2024-08-29T15:03:25Z","updated":"2024-08-30T03:37:46Z"},{"id":"wordfence:718d7ea3-d8ba-46a0-9ab1-72657bd82c17","source":"wordfence","cve":"CVE-2026-9656","title":"HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718d7ea3-d8ba-46a0-9ab1-72657bd82c17?source=api-prod","affected":[{"type":"plugin","slug":"leadin","name":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat","from":"*","from_inclusive":true,"to":"11.3.62","to_inclusive":true,"patched_in":"11.3.64"}],"published":"2026-07-16T17:50:07Z","updated":"2026-07-17T06:53:26Z"},{"id":"wordfence:718dc94c-1f4f-4b5a-969b-d98cabbbe6d8","source":"wordfence","cve":"CVE-2024-7759","title":"PWA for WP \u2013 Progressive Web Apps Made Simple <= 1.7.71 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718dc94c-1f4f-4b5a-969b-d98cabbbe6d8?source=api-prod","affected":[{"type":"plugin","slug":"pwa-for-wp","name":"PWA for WP \u2013 Progressive Web Apps Made Simple","from":"*","from_inclusive":true,"to":"1.7.71","to_inclusive":true,"patched_in":"1.7.72"}],"published":"2024-08-20T00:00:00Z","updated":"2025-05-30T18:26:48Z"},{"id":"wordfence:718e54f5-f040-42d6-958d-255d905615d5","source":"wordfence","cve":"","title":"Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718e54f5-f040-42d6-958d-255d905615d5?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.22.1","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:718f5cf2-ca83-4981-9123-4360d043a32d","source":"wordfence","cve":"CVE-2025-3430","title":"3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'printer_text'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/718f5cf2-ca83-4981-9123-4360d043a32d?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.1.3.6","to_inclusive":true,"patched_in":"2.1.3.7"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:01:04Z"},{"id":"wordfence:7191955e-0db1-4ad1-878b-74f90ca59c91","source":"wordfence","cve":"CVE-2024-1209","title":"LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7191955e-0db1-4ad1-878b-74f90ca59c91?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.10.2"}],"published":"2024-02-02T00:00:00Z","updated":"2026-03-10T16:30:07Z"},{"id":"wordfence:719289ef-30a1-4582-99e2-5aee50b80e43","source":"wordfence","cve":"CVE-2024-37226","title":"Kanban Boards for WordPress <= 2.5.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/719289ef-30a1-4582-99e2-5aee50b80e43?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.21","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:31:11Z"},{"id":"wordfence:7192ec68-1903-498b-a142-b3be4c9544b1","source":"wordfence","cve":"CVE-2025-5805","title":"Electron <= 1.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7192ec68-1903-498b-a142-b3be4c9544b1?source=api-prod","affected":[{"type":"theme","slug":"electron","name":"electron","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T15:59:48Z"},{"id":"wordfence:7192fb4c-0434-4e11-a2a7-c205b8d6b68e","source":"wordfence","cve":"CVE-2025-13618","title":"Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7192fb4c-0434-4e11-a2a7-c205b8d6b68e?source=api-prod","affected":[{"type":"plugin","slug":"mentoring","name":"Mentoring","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-05-04T13:32:59Z","updated":"2026-05-05T02:26:55Z"},{"id":"wordfence:7193052f-1bef-426c-b0fe-4d70931f47ed","source":"wordfence","cve":"CVE-2024-33545","title":"WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7193052f-1bef-426c-b0fe-4d70931f47ed?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.1.00","to_inclusive":false,"patched_in":"14.1.00"}],"published":"2024-04-25T00:00:00Z","updated":"2026-02-26T14:57:48Z"},{"id":"wordfence:7193b373-a0c9-4cd7-8a53-4f35ceff8f23","source":"wordfence","cve":"","title":"Alkubot \u2013 Gamify discounts, sell more and give less at the right time < 3.0.0 - Cross-Site Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7193b373-a0c9-4cd7-8a53-4f35ceff8f23?source=api-prod","affected":[{"type":"plugin","slug":"alkubot","name":"Alkubot \u2013 Gamify discounts, sell more and give less at the right time","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2021-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71955ba0-42ba-49a1-8b91-81069c6132ea","source":"wordfence","cve":"CVE-2021-34621","title":"User Registration, User Profiles, Login & Membership \u2013 ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71955ba0-42ba-49a1-8b91-81069c6132ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"3.0.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7196a3e3-f301-4279-84d3-2e00815ac3a3","source":"wordfence","cve":"CVE-2026-116390","title":"Filter Everything\u00a0\u2014 WordPress & WooCommerce Filters <= 1.9.7 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7196a3e3-f301-4279-84d3-2e00815ac3a3?source=api-prod","affected":[{"type":"plugin","slug":"filter-everything","name":"Filter Everything\u00a0\u2014 WordPress & WooCommerce Filters","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2026-10-26T13:04:44Z","updated":"2026-11-03T19:29:47Z"},{"id":"wordfence:719de6e5-29c5-4303-981d-81840939a0b1","source":"wordfence","cve":"CVE-2024-10696","title":"UltraAddons \u2013 Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/719de6e5-29c5-4303-981d-81840939a0b1?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-11-20T13:40:21Z","updated":"2025-01-30T22:19:25Z"},{"id":"wordfence:719fe585-369b-47ef-b3c1-15729f88ae2d","source":"wordfence","cve":"CVE-2021-44223","title":"WordPress Core < 5.8 - Dependency Confusion","severity":"high","cvss":8.1,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/719fe585-369b-47ef-b3c1-15729f88ae2d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.8"}],"published":"2021-11-25T00:00:00Z","updated":"2024-02-06T19:45:43Z"},{"id":"wordfence:71a0aa95-f2a9-4537-a8d1-d78336e36125","source":"wordfence","cve":"CVE-2024-23517","title":"Scheduling Plugin \u2013 Online Booking for WordPress <= 3.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a0aa95-f2a9-4537-a8d1-d78336e36125?source=api-prod","affected":[{"type":"plugin","slug":"calendar-booking","name":"Scheduling Plugin \u2013 Online Booking for WordPress","from":"*","from_inclusive":true,"to":"3.5.14","to_inclusive":true,"patched_in":"3.5.18"}],"published":"2024-01-30T00:00:00Z","updated":"2026-10-13T16:53:36Z"},{"id":"wordfence:71a3502a-60cc-4861-8654-42536010db92","source":"wordfence","cve":"CVE-2025-53303","title":"ThemeMove Core <= 1.4.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a3502a-60cc-4861-8654-42536010db92?source=api-prod","affected":[{"type":"plugin","slug":"thememove-core","name":"ThemeMove Core","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-09-25T20:41:57Z"},{"id":"wordfence:71a45950-bae1-4b14-8935-251b8713c570","source":"wordfence","cve":"CVE-2024-38702","title":"Product Delivery Date for WooCommerce \u2013 Lite <= 2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a45950-bae1-4b14-8935-251b8713c570?source=api-prod","affected":[{"type":"plugin","slug":"product-delivery-date-for-woocommerce-lite","name":"Product Delivery Date for WooCommerce \u2013 Lite","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:02:14Z"},{"id":"wordfence:71a45cd8-4852-4e34-9536-f865e0762b7a","source":"wordfence","cve":"CVE-2024-49617","title":"Back Link Tracker <= 1.0.0 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a45cd8-4852-4e34-9536-f865e0762b7a?source=api-prod","affected":[{"type":"plugin","slug":"back-link-tracker","name":"Back Link Tracker","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-22T18:06:47Z"},{"id":"wordfence:71a6ba3d-0473-46c9-8040-b415807f4073","source":"wordfence","cve":"CVE-2026-104763","title":"Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a6ba3d-0473-46c9-8040-b415807f4073?source=api-prod","affected":[{"type":"plugin","slug":"post-export-import-with-media","name":"Post Export Import with Media","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.17.2"}],"published":"2026-10-09T17:27:58Z","updated":"2026-10-10T05:31:00Z"},{"id":"wordfence:71a933ef-f49d-4520-90d5-9957f72d7452","source":"wordfence","cve":"CVE-2025-4217","title":"WP YouTube Video Optimizer <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71a933ef-f49d-4520-90d5-9957f72d7452?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-video-optimizer","name":"WP YouTube Video Optimizer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T20:32:32Z","updated":"2025-05-21T09:21:51Z"},{"id":"wordfence:71aa14b8-39bc-4b91-a7cf-9d203fdf44ea","source":"wordfence","cve":"CVE-2021-4357","title":"uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71aa14b8-39bc-4b91-a7cf-9d203fdf44ea?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71addc0e-c31a-4d61-995a-413c22d1db0c","source":"wordfence","cve":"CVE-2026-15240","title":"Customer Switching < 2.1.3 - Authenticated (Customer+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71addc0e-c31a-4d61-995a-413c22d1db0c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-user-switching","name":"Customer Switching for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"}],"published":"2026-07-10T00:00:00Z","updated":"2026-08-04T20:02:20Z"},{"id":"wordfence:71ae742a-3c91-476d-80d6-d39aad407afa","source":"wordfence","cve":"CVE-2025-52784","title":"Bluff Post <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71ae742a-3c91-476d-80d6-d39aad407afa?source=api-prod","affected":[{"type":"plugin","slug":"bluff-post","name":"Bluff Post","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:27:01Z"},{"id":"wordfence:71aeca29-a9bd-42c0-8150-814b79e931fa","source":"wordfence","cve":"","title":"Insert Html Snippet <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71aeca29-a9bd-42c0-8150-814b79e931fa?source=api-prod","affected":[{"type":"plugin","slug":"insert-html-snippet","name":"Insert Html Snippet","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2016-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71b05a05-9fbb-4444-a731-6d070cd56cbd","source":"wordfence","cve":"CVE-2025-39403","title":"WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b05a05-9fbb-4444-a731-6d070cd56cbd?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:48:51Z"},{"id":"wordfence:71b1e2f1-a287-4b9b-94bb-b860bc4748c3","source":"wordfence","cve":"CVE-2026-109512","title":"Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b1e2f1-a287-4b9b-94bb-b860bc4748c3?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-10-15T16:11:16Z","updated":"2026-10-16T04:26:59Z"},{"id":"wordfence:71b2b11f-9c9e-4ae9-a770-5b9f6fbf2316","source":"wordfence","cve":"CVE-2026-62100","title":"KuteShop <= 4.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b2b11f-9c9e-4ae9-a770-5b9f6fbf2316?source=api-prod","affected":[{"type":"theme","slug":"kuteshop","name":"kuteshop","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:22:19Z"},{"id":"wordfence:71b3bec2-3fb2-4b0a-aa6d-5c761d0796e2","source":"wordfence","cve":"CVE-2017-18593","title":"UpdraftPlus <= 1.13.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b3bec2-3fb2-4b0a-aa6d-5c761d0796e2?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.13.4","to_inclusive":true,"patched_in":"1.13.5"}],"published":"2017-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71b521b5-acb5-4439-90f8-7d341291d583","source":"wordfence","cve":"CVE-2006-2702","title":"WordPress Core < 2.0.3 -  IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b521b5-acb5-4439-90f8-7d341291d583?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2006-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71b64440-6a31-40e4-9f38-93eba8858a2c","source":"wordfence","cve":"CVE-2026-90960","title":"Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b64440-6a31-40e4-9f38-93eba8858a2c?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.29.24","to_inclusive":true,"patched_in":"2.29.25"}],"published":"2026-10-30T17:40:47Z","updated":"2026-10-31T06:44:19Z"},{"id":"wordfence:71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32","source":"wordfence","cve":"CVE-2025-14354","title":"Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71b82f1e-14ae-4eb3-9b46-5fcea1cd5a32?source=api-prod","affected":[{"type":"plugin","slug":"doubledome-resource-link-library","name":"Resource Library for Logged In Users","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-12-11T15:10:16Z","updated":"2026-01-06T16:57:19Z"},{"id":"wordfence:71bf0ae5-7c32-42ac-a9bc-96cb1269a458","source":"wordfence","cve":"","title":"Kioskprox (Unkown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71bf0ae5-7c32-42ac-a9bc-96cb1269a458?source=api-prod","affected":[{"type":"plugin","slug":"kioskprox","name":"Kioskprox","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71c17349-41d6-4c6f-b8ff-69ac818c2903","source":"wordfence","cve":"CVE-2025-46447","title":"Fable Extra <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71c17349-41d6-4c6f-b8ff-69ac818c2903?source=api-prod","affected":[{"type":"plugin","slug":"fable-extra","name":"Fable Extra","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:30:51Z"},{"id":"wordfence:71c21af1-a007-4535-98ea-a6f25142bcf6","source":"wordfence","cve":"CVE-2022-47420","title":"Accessibility Suite by Online ADA <= 4.12 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71c21af1-a007-4535-98ea-a6f25142bcf6?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.11","to_inclusive":true,"patched_in":"4.12"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71c7ed80-dd39-4581-8792-31dbc75471e6","source":"wordfence","cve":"CVE-2024-38742","title":"MBE eShip <= 2.1.2 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71c7ed80-dd39-4581-8792-31dbc75471e6?source=api-prod","affected":[{"type":"plugin","slug":"mail-boxes-etc","name":"MBE eShip","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-09-06T17:39:09Z"},{"id":"wordfence:71c87b41-6c90-4b4e-aa63-5db65d7b9e51","source":"wordfence","cve":"CVE-2025-30934","title":"\u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3 <= 1.4.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71c87b41-6c90-4b4e-aa63-5db65d7b9e51?source=api-prod","affected":[{"type":"plugin","slug":"os-diagnosis-generator","name":"\u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:08:17Z"},{"id":"wordfence:71caa071-d279-4807-88ad-a71673b9d17d","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'instantEditRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71caa071-d279-4807-88ad-a71673b9d17d?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71cc804f-6146-4594-8e7a-854754a1ff20","source":"wordfence","cve":"CVE-2023-6585","title":"WP JobSearch <= 2.3.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71cc804f-6146-4594-8e7a-854754a1ff20?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-11-24T00:00:00Z","updated":"2024-03-22T17:43:12Z"},{"id":"wordfence:71cf73a1-8518-40ac-b105-a87142d91a91","source":"wordfence","cve":"CVE-2024-10152","title":"Simple Certain Time to Show Content <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71cf73a1-8518-40ac-b105-a87142d91a91?source=api-prod","affected":[{"type":"plugin","slug":"simple-certain-time-to-show-content","name":"Simple Certain Time to Show Content","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:40:18Z"},{"id":"wordfence:71d63f0d-ce01-489e-bcc4-7632f1a4bb04","source":"wordfence","cve":"","title":"MainWP Dashboard and MainWP Child <= 2.0.22 - Unspecified Vulnerability","severity":"high","cvss":7.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71d63f0d-ce01-489e-bcc4-7632f1a4bb04?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"},{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2015-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71d657d4-b326-4655-808a-913bbc9a8d1d","source":"wordfence","cve":"CVE-2017-9429","title":"Event List < 0.7.9 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71d657d4-b326-4655-808a-913bbc9a8d1d?source=api-prod","affected":[{"type":"plugin","slug":"event-list","name":"Event List","from":"*","from_inclusive":true,"to":"0.7.9","to_inclusive":false,"patched_in":"0.7.9"}],"published":"2017-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71d8a8cf-4653-4515-95ce-8d71697e189c","source":"wordfence","cve":"CVE-2024-6575","title":"The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71d8a8cf-4653-4515-95ce-8d71697e189c?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2024-08-19T14:59:59Z","updated":"2024-08-20T03:21:10Z"},{"id":"wordfence:71d916aa-5382-495b-8142-80de0a0912e7","source":"wordfence","cve":"CVE-2021-24129","title":"Themify Portfolio Post <= 1.1.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71d916aa-5382-495b-8142-80de0a0912e7?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2020-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71da3176-ce22-4860-a036-77c56dc6507a","source":"wordfence","cve":"CVE-2025-26766","title":"Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71da3176-ce22-4860-a036-77c56dc6507a?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.31.8","to_inclusive":true,"patched_in":"3.31.9"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:06:54Z"},{"id":"wordfence:71da4bd0-79d7-42ec-9e79-3a44411c2313","source":"wordfence","cve":"CVE-2021-24897","title":"Add Subtitle <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71da4bd0-79d7-42ec-9e79-3a44411c2313?source=api-prod","affected":[{"type":"plugin","slug":"add-subtitle","name":"Add Subtitle","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71dd864f-1975-4cee-be26-0cdb0d54be95","source":"wordfence","cve":"CVE-2023-51421","title":"Verge3D <= 4.5.2 - Authenticated(Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71dd864f-1975-4cee-be26-0cdb0d54be95?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-03-29T15:46:09Z"},{"id":"wordfence:71de0365-9ea6-48af-b6e1-98d1c87b780b","source":"wordfence","cve":"CVE-2025-49265","title":"Membership For WooCommerce <= 2.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71de0365-9ea6-48af-b6e1-98d1c87b780b?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-17T15:03:42Z"},{"id":"wordfence:71df1c9a-b4fa-47c7-93c7-f2cb09fad3ab","source":"wordfence","cve":"CVE-2022-29433","title":"Donations <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71df1c9a-b4fa-47c7-93c7-f2cb09fad3ab?source=api-prod","affected":[{"type":"plugin","slug":"nd-donations","name":"Donations","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2022-05-13T14:27:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71df23bf-8f51-4260-be1f-ed5bc29d4afe","source":"wordfence","cve":"CVE-2024-10114","title":"Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71df23bf-8f51-4260-be1f-ed5bc29d4afe?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2024-11-04T00:00:00Z","updated":"2025-02-19T17:42:58Z"},{"id":"wordfence:71e03764-f8e8-467c-8657-e4b44bdbdc35","source":"wordfence","cve":"CVE-2025-23764","title":"Copy Move Posts <= 1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e03764-f8e8-467c-8657-e4b44bdbdc35?source=api-prod","affected":[{"type":"plugin","slug":"copy-move-posts","name":"Copy Move Posts","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-01-16T00:00:00Z","updated":"2026-07-08T20:42:19Z"},{"id":"wordfence:71e26ec2-4dd2-4762-a7dc-6ed2755eb6ba","source":"wordfence","cve":"CVE-2024-56265","title":"WooCommerce PDF Vouchers < 4.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e26ec2-4dd2-4762-a7dc-6ed2755eb6ba?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":false,"patched_in":"4.9.9"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:07:49Z"},{"id":"wordfence:71e2db7c-53a7-4b17-b00a-ce71a00bf546","source":"wordfence","cve":"CVE-2020-13125","title":"Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass","severity":"high","cvss":7.2,"cwe":"CWE-286","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e2db7c-53a7-4b17-b00a-ce71a00bf546?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.24.2","to_inclusive":false,"patched_in":"1.24.2"}],"published":"2020-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71e367fb-a663-42ba-9db0-78a436a56205","source":"wordfence","cve":"CVE-2025-47439","title":"Download Monitor <= 5.0.22 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e367fb-a663-42ba-9db0-78a436a56205?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.0.22","to_inclusive":true,"patched_in":"5.0.23"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:41:09Z"},{"id":"wordfence:71e55161-f5ad-44e5-8a61-ce48c05e6dba","source":"wordfence","cve":"CVE-2023-44991","title":"Media File Renamer <= 5.6.9 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e55161-f5ad-44e5-8a61-ce48c05e6dba?source=api-prod","affected":[{"type":"plugin","slug":"media-file-renamer","name":"Media File Renamer: Rename Images & Files for SEO (AI-Powered)","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71e587ec-ceb6-48ca-9a1a-599d9d988b4d","source":"wordfence","cve":"CVE-2025-13891","title":"Image Gallery \u2013 Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e587ec-ceb6-48ca-9a1a-599d9d988b4d?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.13.4"}],"published":"2025-12-11T18:40:32Z","updated":"2025-12-12T07:20:35Z"},{"id":"wordfence:71e8c2ae-7ed2-4b8a-a0ac-06ca6f2f2ecf","source":"wordfence","cve":"CVE-2025-62755","title":"GS Portfolio for Envato <= 1.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e8c2ae-7ed2-4b8a-a0ac-06ca6f2f2ecf?source=api-prod","affected":[{"type":"plugin","slug":"gs-envato-portfolio","name":"GS Portfolio for Envato","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:35:16Z"},{"id":"wordfence:71e951af-cb01-4c72-b113-e89539d29a4f","source":"wordfence","cve":"CVE-2024-34557","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e951af-cb01-4c72-b113-e89539d29a4f?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:22:09Z"},{"id":"wordfence:71e99412-031e-4f4a-9126-dd3a37975246","source":"wordfence","cve":"CVE-2026-6741","title":"LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e99412-031e-4f4a-9126-dd3a37975246?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2026-04-27T07:23:53Z","updated":"2026-04-27T19:36:46Z"},{"id":"wordfence:71e9ff91-4137-4c66-959b-f4ffb8d3ba32","source":"wordfence","cve":"CVE-2026-15142","title":"Real Estate Manager Pro <= 12.8.6 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71e9ff91-4137-4c66-959b-f4ffb8d3ba32?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager-pro","name":"Real Estate Manager Pro","from":"*","from_inclusive":true,"to":"12.8.6","to_inclusive":true,"patched_in":"12.8.7"}],"published":"2026-08-14T20:22:55Z","updated":"2026-08-15T08:27:16Z"},{"id":"wordfence:71eeddf4-5693-41bc-93ad-3c93dafdd3bc","source":"wordfence","cve":"CVE-2024-5881","title":"Webico Slider Flatsome Addons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71eeddf4-5693-41bc-93ad-3c93dafdd3bc?source=api-prod","affected":[{"type":"plugin","slug":"webico-slider-flatsome-addons","name":"Webico Slider Flatsome Addons","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T19:37:49Z","updated":"2024-07-09T07:38:45Z"},{"id":"wordfence:71f059ba-1874-4e8a-80e9-3f7826f9341d","source":"wordfence","cve":"CVE-2022-2374","title":"Simply Schedule Appointments <= 1.5.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f059ba-1874-4e8a-80e9-3f7826f9341d?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.5.7.5","to_inclusive":true,"patched_in":"1.5.7.7"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71f2aa53-32e5-44e0-a230-98548fcaa5c2","source":"wordfence","cve":"CVE-2026-13607","title":"File Uploads Addon for WooCommerce <= 1.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2aa53-32e5-44e0-a230-98548fcaa5c2?source=api-prod","affected":[{"type":"plugin","slug":"woo-addon-uploads","name":"File Uploads Addon for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-28T21:15:17Z"},{"id":"wordfence:71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3","source":"wordfence","cve":"CVE-2026-8912","title":"Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.6","to_inclusive":true,"patched_in":"28.1.7"}],"published":"2026-05-18T00:00:00Z","updated":"2026-05-19T11:18:47Z"},{"id":"wordfence:71f58781-3fb3-4eba-8e5a-f98f006f4607","source":"wordfence","cve":"CVE-2023-28172","title":"WP Google Map Plugin <= 4.4.2 - Cross-Site Request Forgery via delete()","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f58781-3fb3-4eba-8e5a-f98f006f4607?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71f74a54-2693-4dab-91a1-903a906cc0f1","source":"wordfence","cve":"CVE-2025-58614","title":"Tooltipy <= 5.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f74a54-2693-4dab-91a1-903a906cc0f1?source=api-prod","affected":[{"type":"plugin","slug":"bluet-keywords-tooltip-generator","name":"Tooltipy (tooltips for WP)","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.9"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:29:42Z"},{"id":"wordfence:71f7733a-1350-4e22-98d8-28be401aee69","source":"wordfence","cve":"CVE-2023-40335","title":"Cleverwise Daily Quotes <= 3.2 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f7733a-1350-4e22-98d8-28be401aee69?source=api-prod","affected":[{"type":"plugin","slug":"cleverwise-daily-quotes","name":"Cleverwise Daily Quotes","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71f78fef-50f6-49d5-94f6-6d0cf1b8f536","source":"wordfence","cve":"CVE-2024-10980","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Cookie Consent'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f78fef-50f6-49d5-94f6-6d0cf1b8f536?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":true,"patched_in":"5.10.3"}],"published":"2024-11-14T00:00:00Z","updated":"2024-12-12T16:11:10Z"},{"id":"wordfence:71f883d7-edf5-409e-92c1-f87f880602d3","source":"wordfence","cve":"","title":"WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71f883d7-edf5-409e-92c1-f87f880602d3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.37","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.32","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.33","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.26","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.28","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.25","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.23","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.21","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.18","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.16","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"4.7.38"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:04:52Z"},{"id":"wordfence:71fac3d5-40d5-41d5-b756-2f1e941709b6","source":"wordfence","cve":"CVE-2026-93766","title":"Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fac3d5-40d5-41d5-b756-2f1e941709b6?source=api-prod","affected":[{"type":"plugin","slug":"happyforms-upgrade","name":"Happyforms Pro","from":"*","from_inclusive":true,"to":"1.38.9","to_inclusive":true,"patched_in":"1.38.10"}],"published":"2026-11-06T21:59:56Z","updated":"2026-11-07T11:26:30Z"},{"id":"wordfence:71fb1cef-6e01-4bd7-b0bc-5d21295f119a","source":"wordfence","cve":"CVE-2023-52117","title":"ProfileGrid  <= 5.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fb1cef-6e01-4bd7-b0bc-5d21295f119a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71fb90b6-a484-4a70-a9dc-795cbf2e275e","source":"wordfence","cve":"CVE-2024-0678","title":"Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fb90b6-a484-4a70-a9dc-795cbf2e275e?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date for WP e-Commerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-29T00:00:00Z","updated":"2024-07-29T21:36:35Z"},{"id":"wordfence:71fd62e7-fa6a-49d7-9c5f-a54490b9cdd1","source":"wordfence","cve":"CVE-2025-32181","title":"Search, Filters & Merchandising for WooCommerce <= 3.0.58 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fd62e7-fa6a-49d7-9c5f-a54490b9cdd1?source=api-prod","affected":[{"type":"plugin","slug":"instantsearch-for-woocommerce","name":"Search, Filters & Merchandising for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.58","to_inclusive":true,"patched_in":"3.0.59"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T14:08:27Z"},{"id":"wordfence:71fe1729-4bb5-4b95-9183-b4d793bcfd72","source":"wordfence","cve":"CVE-2021-36852","title":"WP Hotel Booking <= 1.10.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fe1729-4bb5-4b95-9183-b4d793bcfd72?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"1.10.5","to_inclusive":true,"patched_in":"1.10.6"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71fe2687-0dc9-4c56-91a4-447420818cca","source":"wordfence","cve":"CVE-2020-11027","title":"WordPress Core < 5.4.1 - Password Reset Link Non-Expiration","severity":"medium","cvss":6.1,"cwe":"CWE-672","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fe2687-0dc9-4c56-91a4-447420818cca?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:71fee02f-7438-402b-802c-88ddb812e2d0","source":"wordfence","cve":"CVE-2026-86841","title":"Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71fee02f-7438-402b-802c-88ddb812e2d0?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"23.2","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:13:42Z"},{"id":"wordfence:7202c0f7-cde7-4588-95f4-367d91f2eb67","source":"wordfence","cve":"CVE-2014-6604","title":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters <= 10.15 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7202c0f7-cde7-4588-95f4-367d91f2eb67?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.16","to_inclusive":false,"patched_in":"10.16"}],"published":"2014-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:720305e1-d5a6-4a61-aa5f-7118fef326b6","source":"wordfence","cve":"CVE-2026-93549","title":"CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/720305e1-d5a6-4a61-aa5f-7118fef326b6?source=api-prod","affected":[{"type":"plugin","slug":"cart-rest-api-for-woocommerce","name":"CoCart \u2013 Headless REST API for WooCommerce","from":"4.9.0","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T13:22:08Z"},{"id":"wordfence:7203a8c1-8464-4a9f-a076-691f0ca6ad1d","source":"wordfence","cve":"CVE-2025-67920","title":"Neo Ocular < 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7203a8c1-8464-4a9f-a076-691f0ca6ad1d?source=api-prod","affected":[{"type":"theme","slug":"neoocular","name":"Neo Ocular - Optician and Optical Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:18:36Z"},{"id":"wordfence:7203b9df-bde1-47cd-9a2c-bc8f19cd64f8","source":"wordfence","cve":"CVE-2025-48163","title":"SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7203b9df-bde1-47cd-9a2c-bc8f19cd64f8?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio8-html5-radio-ads","name":"SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-23T21:14:14Z"},{"id":"wordfence:7205c238-4419-4292-8f9c-4ccf5b69dd60","source":"wordfence","cve":"CVE-2025-13738","title":"Easy Table of Contents <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7205c238-4419-4292-8f9c-4ccf5b69dd60?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.78","to_inclusive":true,"patched_in":"2.0.79"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:15Z"},{"id":"wordfence:7206b32a-3aaa-47c5-9489-11252a8434a3","source":"wordfence","cve":"CVE-2026-56070","title":"Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7206b32a-3aaa-47c5-9489-11252a8434a3?source=api-prod","affected":[{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:42:57Z"},{"id":"wordfence:72094f97-c1cc-48df-9c88-1352e6d6e67e","source":"wordfence","cve":"","title":"Jetpack <= 3.7.1 - Information disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72094f97-c1cc-48df-9c88-1352e6d6e67e?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2015-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:720a3525-01dd-4cfd-9403-2bc3f87df618","source":"wordfence","cve":"CVE-2024-2783","title":"GamiPress \u2013 The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/720a3525-01dd-4cfd-9403-2bc3f87df618?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2024-03-27T00:00:00Z","updated":"2024-05-31T15:30:25Z"},{"id":"wordfence:720b0ebf-c67f-47f4-94eb-8d9b6ab63a72","source":"wordfence","cve":"CVE-2025-69163","title":"WineShop - Food & Wine Store WordPress Theme <= 3.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/720b0ebf-c67f-47f4-94eb-8d9b6ab63a72?source=api-prod","affected":[{"type":"theme","slug":"wineshop","name":"WineShop - Food & Wine Store WordPress Theme","from":"*","from_inclusive":true,"to":"3.17","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:26:35Z"},{"id":"wordfence:720be34d-3fe4-4395-a27b-d386f8612ba9","source":"wordfence","cve":"CVE-2025-14554","title":"Sell BTC - Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/720be34d-3fe4-4395-a27b-d386f8612ba9?source=api-prod","affected":[{"type":"plugin","slug":"sell-btc-by-hayyatapps","name":"Sell BTC by Hayyat Apps \u2014 Cryptocurrency Exchange & Ordering","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-01-30T00:00:00Z","updated":"2026-01-31T13:24:24Z"},{"id":"wordfence:720d1d50-06ae-4b47-ac64-115c00d81223","source":"wordfence","cve":"CVE-2023-6050","title":"Estatik Real Estate Plugin <= 4.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/720d1d50-06ae-4b47-ac64-115c00d81223?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2024-01-25T00:00:00Z","updated":"2024-02-06T15:27:11Z"},{"id":"wordfence:72113d42-1a93-4979-849b-ba8038231417","source":"wordfence","cve":"","title":"Easy Call With Twilio <= 1.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72113d42-1a93-4979-849b-ba8038231417?source=api-prod","affected":[{"type":"plugin","slug":"twl-easy-call","name":"Easy Call With Twilio","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2022-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72131ba4-976b-4f89-9a69-2469f22eb5fd","source":"wordfence","cve":"CVE-2026-15096","title":"Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72131ba4-976b-4f89-9a69-2469f22eb5fd?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.7.6","to_inclusive":true,"patched_in":"7.7.7"}],"published":"2026-07-10T15:32:19Z","updated":"2026-07-11T03:44:23Z"},{"id":"wordfence:7213fd3f-4111-49d5-95f1-07c3663e899f","source":"wordfence","cve":"CVE-2026-105421","title":"Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7213fd3f-4111-49d5-95f1-07c3663e899f?source=api-prod","affected":[{"type":"plugin","slug":"convertkit-for-woocommerce","name":"Kit (formerly ConvertKit) for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-05T14:17:00Z","updated":"2026-10-08T23:16:39Z"},{"id":"wordfence:72154404-f956-4ea2-96ec-166ade87885f","source":"wordfence","cve":"CVE-2026-5118","title":"Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=api-prod","affected":[{"type":"plugin","slug":"divi-form-builder","name":"Divi Form Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-21T11:32:00Z"},{"id":"wordfence:72154a2d-05aa-4a13-89c5-c9bfdf5b2e7e","source":"wordfence","cve":"CVE-2025-23632","title":"CG Button <= 1.0.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72154a2d-05aa-4a13-89c5-c9bfdf5b2e7e?source=api-prod","affected":[{"type":"plugin","slug":"content-glass-button","name":"CG Button","from":"*","from_inclusive":true,"to":"1.0.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:05:57Z"},{"id":"wordfence:72198b74-90f6-49c6-b261-6f9c1cdc9692","source":"wordfence","cve":"CVE-2025-12469","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72198b74-90f6-49c6-b261-6f9c1cdc9692?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.6.4.1","to_inclusive":true,"patched_in":"3.6.4.2"}],"published":"2025-11-04T20:51:49Z","updated":"2025-11-05T19:10:16Z"},{"id":"wordfence:721b2e7d-59be-40c9-b5a9-dec679c3e99c","source":"wordfence","cve":"CVE-2025-52748","title":"Directory Pro <= 2.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/721b2e7d-59be-40c9-b5a9-dec679c3e99c?source=api-prod","affected":[{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-11-04T16:55:53Z"},{"id":"wordfence:721d29e4-397d-4965-bd64-33bced8e5de4","source":"wordfence","cve":"CVE-2025-6990","title":"Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/721d29e4-397d-4965-bd64-33bced8e5de4?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.24.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-31T00:00:00Z","updated":"2026-06-17T05:33:26Z"},{"id":"wordfence:721f7c9e-34f3-4c41-992d-df35b56f95cd","source":"wordfence","cve":"","title":"Count per Day < 3.2.6 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/721f7c9e-34f3-4c41-992d-df35b56f95cd?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:721f8943-5d59-41ee-935e-999dff2e590d","source":"wordfence","cve":"CVE-2023-23893","title":"Simple Giveaways <= 2.46.0 - Missing Authorization via AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/721f8943-5d59-41ee-935e-999dff2e590d?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.46.0","to_inclusive":true,"patched_in":"2.46.1"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:722261d0-b81c-48b9-baf3-93713a814c51","source":"wordfence","cve":"CVE-2025-23916","title":"WP Meetup <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722261d0-b81c-48b9-baf3-93713a814c51?source=api-prod","affected":[{"type":"plugin","slug":"wp-meetup","name":"WP Meetup","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T21:04:53Z"},{"id":"wordfence:72250c17-c3c4-47b7-ab3e-606d5a34449a","source":"wordfence","cve":"CVE-2026-24939","title":"Modula Image Gallery <= 2.13.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72250c17-c3c4-47b7-ab3e-606d5a34449a?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.13.6","to_inclusive":true,"patched_in":"2.13.7"}],"published":"2025-11-22T00:00:00Z","updated":"2026-02-10T19:25:03Z"},{"id":"wordfence:72256ac2-72a7-4c3c-a892-1f1795671c5d","source":"wordfence","cve":"CVE-2023-30498","title":"Vimeotheque <= 2.2.1 - Reflected Cross-Site Scripting via 'view' and 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72256ac2-72a7-4c3c-a892-1f1795671c5d?source=api-prod","affected":[{"type":"plugin","slug":"codeflavors-vimeo-video-post-lite","name":"Vimeotheque \u2013 Vimeo WordPress Plugin & Video Gallery","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72273368-042d-4ad4-9d1d-ca9c6db9cf3b","source":"wordfence","cve":"","title":"WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72273368-042d-4ad4-9d1d-ca9c6db9cf3b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-11T14:19:54Z"},{"id":"wordfence:7227749b-a920-41c8-ac3f-249a0e43e089","source":"wordfence","cve":"CVE-2025-58256","title":"DOAJ Export <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7227749b-a920-41c8-ac3f-249a0e43e089?source=api-prod","affected":[{"type":"plugin","slug":"doaj-export","name":"DOAJ Export","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-25T19:05:39Z"},{"id":"wordfence:7227f835-4f80-4274-9300-ed99e44167be","source":"wordfence","cve":"CVE-2025-62085","title":"BERTHA AI <= 1.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7227f835-4f80-4274-9300-ed99e44167be?source=api-prod","affected":[{"type":"plugin","slug":"bertha-ai-free","name":"BERTHA AI. Your AI co-pilot for WordPress and Chrome","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-10T15:52:13Z"},{"id":"wordfence:722956ec-d2f5-42ad-bb95-776ad620d788","source":"wordfence","cve":"CVE-2024-29797","title":"Grid Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722956ec-d2f5-42ad-bb95-776ad620d788?source=api-prod","affected":[{"type":"plugin","slug":"grid-shortcodes","name":"Grid Shortcodes","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-24T15:08:07Z"},{"id":"wordfence:7229d6b1-0c11-477c-8569-f5d57930d0d6","source":"wordfence","cve":"CVE-2025-24681","title":"Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.10.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7229d6b1-0c11-477c-8569-f5d57930d0d6?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:56:03Z"},{"id":"wordfence:722aae99-fcfb-4234-9245-5db57aaa03c5","source":"wordfence","cve":"CVE-2024-0664","title":"Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722aae99-fcfb-4234-9245-5db57aaa03c5?source=api-prod","affected":[{"type":"plugin","slug":"meks-smart-social-widget","name":"Meks Smart Social Widget","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:36:36Z"},{"id":"wordfence:722c04c3-8f74-4081-b3a4-cb1ae2027312","source":"wordfence","cve":"CVE-2026-6261","title":"Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722c04c3-8f74-4081-b3a4-cb1ae2027312?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.4.1"}],"published":"2026-05-04T22:35:37Z","updated":"2026-05-05T11:25:00Z"},{"id":"wordfence:722c35e5-4084-46a4-a3d4-c73f8e7a1882","source":"wordfence","cve":"CVE-2023-51470","title":"Rencontre \u2013 Dating Site <= 3.11.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722c35e5-4084-46a4-a3d4-c73f8e7a1882?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:722c666b-913f-4289-82e6-30aa0a3abc2b","source":"wordfence","cve":"CVE-2026-0939","title":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722c666b-913f-4289-82e6-30aa0a3abc2b?source=api-prod","affected":[{"type":"plugin","slug":"woo-rede","name":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-01-15T18:31:03Z","updated":"2026-01-19T17:02:29Z"},{"id":"wordfence:722d3a5e-40dc-4153-b8ce-4a94ae391896","source":"wordfence","cve":"","title":"CityBook <= 2.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722d3a5e-40dc-4153-b8ce-4a94ae391896?source=api-prod","affected":[{"type":"theme","slug":"citybook","name":"CityBook - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:722d3fe4-8eb3-451c-9efd-c7daa4a4899f","source":"wordfence","cve":"CVE-2025-30868","title":"Team Manager <= 2.1.23 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722d3fe4-8eb3-451c-9efd-c7daa4a4899f?source=api-prod","affected":[{"type":"plugin","slug":"wp-team-manager","name":"Dynamic Team Manager \u2013 Team Member Showcase with grid, slider, table  Elementor widget & shortcode","from":"*","from_inclusive":true,"to":"2.1.23","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:47:34Z"},{"id":"wordfence:722f6a3c-5a78-4c72-8aad-3c3b76735056","source":"wordfence","cve":"CVE-2026-96349","title":"SiteSkite \u2013 Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722f6a3c-5a78-4c72-8aad-3c3b76735056?source=api-prod","affected":[{"type":"plugin","slug":"siteskite","name":"SiteSkite \u2013 Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-09-29T10:01:36Z","updated":"2026-10-08T23:54:44Z"},{"id":"wordfence:722f7d6e-f082-428e-8d9e-a4d0f99bc7ec","source":"wordfence","cve":"CVE-2024-51595","title":"SKSDEV Toolkit <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722f7d6e-f082-428e-8d9e-a4d0f99bc7ec?source=api-prod","affected":[{"type":"plugin","slug":"sksdev-toolkit","name":"SKSDEV Toolkit","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:16:19Z"},{"id":"wordfence:722fa61c-4b88-41cc-bbf1-6ee3220b71a8","source":"wordfence","cve":"CVE-2025-68597","title":"Jobs for WordPress <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/722fa61c-4b88-41cc-bbf1-6ee3220b71a8?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-10-20T22:41:34Z"},{"id":"wordfence:72320980-733d-4fe6-9a13-39c476b77298","source":"wordfence","cve":"CVE-2025-6722","title":"BitFire <= 4.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72320980-733d-4fe6-9a13-39c476b77298?source=api-prod","affected":[{"type":"plugin","slug":"bitfire","name":"BitFire Security \u2013 Firewall, Malware Scanner, Bot Blocker, Login Protection","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2025-08-01T00:00:00Z","updated":"2025-08-25T14:05:07Z"},{"id":"wordfence:723322ab-2ad0-42e2-b518-0987d9203c49","source":"wordfence","cve":"CVE-2026-103520","title":"HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/723322ab-2ad0-42e2-b518-0987d9203c49?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.31","to_inclusive":true,"patched_in":"1.7.32"}],"published":"2026-10-09T17:15:30Z","updated":"2026-10-10T05:31:00Z"},{"id":"wordfence:7234d4b9-a575-428a-9d08-2dc62ba41c30","source":"wordfence","cve":"CVE-2024-5223","title":"Post Grid Gutenberg Blocks and WordPress Blog Plugin \u2013 PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7234d4b9-a575-428a-9d08-2dc62ba41c30?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2024-05-29T14:39:42Z","updated":"2024-05-31T15:30:25Z"},{"id":"wordfence:7235f5b9-43a6-4290-a6b6-f93ed8c7fa5d","source":"wordfence","cve":"CVE-2026-25315","title":"hCaptcha for WP <= 4.22.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7235f5b9-43a6-4290-a6b6-f93ed8c7fa5d?source=api-prod","affected":[{"type":"plugin","slug":"hcaptcha-for-forms-and-more","name":"hCaptcha for WP","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2026-01-26T00:00:00Z","updated":"2026-05-04T15:20:13Z"},{"id":"wordfence:72383bd3-82b4-4aea-9a1c-277ad06e2500","source":"wordfence","cve":"CVE-2024-11032","title":"Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72383bd3-82b4-4aea-9a1c-277ad06e2500?source=api-prod","affected":[{"type":"plugin","slug":"wp-parsidate","name":"Parsi Date | \u0628\u0633\u062a\u0647 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u067e\u0627\u0631\u0633\u06cc \u062f\u06cc\u062a","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2024-11-25T20:48:17Z","updated":"2024-11-26T09:32:38Z"},{"id":"wordfence:7238a6ba-4ef2-4ae1-ba20-7e0a499c98a9","source":"wordfence","cve":"CVE-2026-90884","title":"WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7238a6ba-4ef2-4ae1-ba20-7e0a499c98a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-17T20:51:16Z","updated":"2026-09-18T09:28:00Z"},{"id":"wordfence:723ad7b4-8a16-4995-af13-fd6f79f4904b","source":"wordfence","cve":"CVE-2025-39531","title":"Slazzer Background Changer <= 3.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/723ad7b4-8a16-4995-af13-fd6f79f4904b?source=api-prod","affected":[{"type":"plugin","slug":"slazzer-background-changer","name":"Slazzer Background Changer","from":"*","from_inclusive":true,"to":"3.14","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-30T22:18:53Z"},{"id":"wordfence:723bce00-e0d7-4802-8dde-7edb90015067","source":"wordfence","cve":"CVE-2026-66426","title":"WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/723bce00-e0d7-4802-8dde-7edb90015067?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats","name":"WP-Stats","from":"*","from_inclusive":true,"to":"2.56","to_inclusive":true,"patched_in":"2.56.1"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-15T22:11:40Z"},{"id":"wordfence:723ed5c7-041f-4e03-83ad-43438e3265a1","source":"wordfence","cve":"CVE-2022-4664","title":"Logo Slider <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/723ed5c7-041f-4e03-83ad-43438e3265a1?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7241175a-1006-4236-b46a-470a6eb1624c","source":"wordfence","cve":"CVE-2025-15692","title":"Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7241175a-1006-4236-b46a-470a6eb1624c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"5.8.6"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-16T15:16:17Z"},{"id":"wordfence:7242d808-9c33-4b3f-bda6-b4b72ca37de9","source":"wordfence","cve":"CVE-2024-2650","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7242d808-9c33-4b3f-bda6-b4b72ca37de9?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"5.9.12"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:58:56Z"},{"id":"wordfence:72463469-5069-446d-bd83-d31598422cb2","source":"wordfence","cve":"CVE-2026-16575","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy < 5.0.14 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72463469-5069-446d-bd83-d31598422cb2?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.14","to_inclusive":false,"patched_in":"5.0.14"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:09:20Z"},{"id":"wordfence:7249469c-a46d-40fc-bf05-ae0bef72e655","source":"wordfence","cve":"CVE-2026-57812","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7249469c-a46d-40fc-bf05-ae0bef72e655?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.4","to_inclusive":true,"patched_in":"1.6.12.6"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:33:55Z"},{"id":"wordfence:724a1790-811a-4ec5-a664-a22e6b72fba1","source":"wordfence","cve":"CVE-2022-45852","title":"WP-FormAssembly <= 2.0.5  - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724a1790-811a-4ec5-a664-a22e6b72fba1?source=api-prod","affected":[{"type":"plugin","slug":"formassembly-web-forms","name":"WP-FormAssembly","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:724a272f-90fa-41c0-bb93-b9a1f3efab22","source":"wordfence","cve":"CVE-2026-102914","title":"Presto Player <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724a272f-90fa-41c0-bb93-b9a1f3efab22?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-10-05T08:50:00Z","updated":"2026-10-08T23:14:07Z"},{"id":"wordfence:724a2da0-e4e7-4868-a1ad-fce69a915981","source":"wordfence","cve":"CVE-2025-13724","title":"VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724a2da0-e4e7-4868-a1ad-fce69a915981?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-12-01T19:42:44Z","updated":"2025-12-02T08:25:06Z"},{"id":"wordfence:724a7579-74c6-46b2-b1b4-a92e980aaa83","source":"wordfence","cve":"CVE-2024-39646","title":"Custom 404 Pro <= 3.11.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724a7579-74c6-46b2-b1b4-a92e980aaa83?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:45:29Z"},{"id":"wordfence:724ce8ef-d9fe-4f7b-861a-cbbb2bff0b86","source":"wordfence","cve":"CVE-2026-115431","title":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724ce8ef-d9fe-4f7b-861a-cbbb2bff0b86?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-11-04T12:18:13Z","updated":"2026-11-10T19:18:46Z"},{"id":"wordfence:724d4bc4-f1b4-4038-a8eb-4dd557408d9c","source":"wordfence","cve":"CVE-2026-24985","title":"WP Forms Signature Contract Add-On <= 1.8.2 - Missing Authorization to Authenticated (Subscriber+) Notice Dimissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724d4bc4-f1b4-4038-a8eb-4dd557408d9c?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-signature-contract-add-on","name":"WP Forms Signature Contract Add-On","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-01-19T00:00:00Z","updated":"2026-02-10T19:53:48Z"},{"id":"wordfence:724d8382-cef3-4584-a255-c2ecc7c986b3","source":"wordfence","cve":"CVE-2024-24927","title":"Brooklyn <= 4.9.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724d8382-cef3-4584-a255-c2ecc7c986b3?source=api-prod","affected":[{"type":"theme","slug":"brooklyn","name":"Brooklyn | Creative Multipurpose Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"4.9.9.2","to_inclusive":true,"patched_in":"4.9.9.3"}],"published":"2024-02-09T00:00:00Z","updated":"2025-03-18T17:10:24Z"},{"id":"wordfence:724d8f79-f683-4b06-841d-a9104c87f3c6","source":"wordfence","cve":"CVE-2023-49188","title":"Track Geolocation Of Users Using Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724d8f79-f683-4b06-841d-a9104c87f3c6?source=api-prod","affected":[{"type":"plugin","slug":"track-geolocation-of-users-using-contact-form-7","name":"Track Geolocation Of Users Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-11-29T00:00:00Z","updated":"2024-07-03T15:27:42Z"},{"id":"wordfence:724dead7-0e4a-420d-a5a3-fca578451211","source":"wordfence","cve":"","title":"Simple Social Media Share Buttons <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/724dead7-0e4a-420d-a5a3-fca578451211?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72505ab0-8545-4735-af15-e8794d0ac9c9","source":"wordfence","cve":"CVE-2016-10867","title":"All In One WP Security & Firewall <= 4.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72505ab0-8545-4735-af15-e8794d0ac9c9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2016-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7250aaa2-c778-4899-af76-6b3f79cff486","source":"wordfence","cve":"CVE-2025-31737","title":"Client Showcase <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7250aaa2-c778-4899-af76-6b3f79cff486?source=api-prod","affected":[{"type":"plugin","slug":"client-showcase","name":"Client Showcase","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:11:42Z"},{"id":"wordfence:7250da0a-1ac6-48a6-a480-0721d604add3","source":"wordfence","cve":"CVE-2024-43245","title":"JobSearch <= 2.3.4 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7250da0a-1ac6-48a6-a480-0721d604add3?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2025-07-03T11:51:10Z"},{"id":"wordfence:7252075f-9326-4f04-bdd9-b244609c9cd3","source":"wordfence","cve":"CVE-2023-45268","title":"Hitsteps Web Analytics <= 5.86 - Cross-Site Request Forgery via hst_optionpage","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7252075f-9326-4f04-bdd9-b244609c9cd3?source=api-prod","affected":[{"type":"plugin","slug":"hitsteps-visitor-manager","name":"Hitsteps Web Analytics","from":"*","from_inclusive":true,"to":"5.86","to_inclusive":true,"patched_in":"5.87"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7253cc66-3c57-4ba6-98dc-f7620c577f97","source":"wordfence","cve":"CVE-2026-57339","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 6.4.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7253cc66-3c57-4ba6-98dc-f7620c577f97?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.23","to_inclusive":true,"patched_in":"6.4.24"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:54:59Z"},{"id":"wordfence:7255319c-8175-4885-8f94-3f46f9e577a6","source":"wordfence","cve":"","title":"Super Progressive Web Apps <= 2.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7255319c-8175-4885-8f94-3f46f9e577a6?source=api-prod","affected":[{"type":"plugin","slug":"super-progressive-web-apps","name":"Super Progressive Web Apps","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7255e9b0-d56c-4cd6-b27b-ffb6e1a988cc","source":"wordfence","cve":"CVE-2024-13678","title":"R3W InstaFeed <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7255e9b0-d56c-4cd6-b27b-ffb6e1a988cc?source=api-prod","affected":[{"type":"plugin","slug":"r3w-instafeed","name":"R3W InstaFeed","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:32:52Z"},{"id":"wordfence:72564bc8-48b2-4fd2-aeb9-dc0bfdcf93d1","source":"wordfence","cve":"CVE-2026-57338","title":"ARforms <= 7.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72564bc8-48b2-4fd2-aeb9-dc0bfdcf93d1?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.2"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:55:14Z"},{"id":"wordfence:725682bd-620c-4d66-8b9e-3d562bc11846","source":"wordfence","cve":"CVE-2026-62129","title":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/725682bd-620c-4d66-8b9e-3d562bc11846?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":"1.2.22"}],"published":"2026-10-08T17:29:05Z","updated":"2026-10-13T14:18:47Z"},{"id":"wordfence:72585c12-baa9-4c63-8584-906a1d3b332f","source":"wordfence","cve":"CVE-2026-83628","title":"Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72585c12-baa9-4c63-8584-906a1d3b332f?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.1.15","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2026-09-04T17:10:41Z","updated":"2026-09-05T05:30:55Z"},{"id":"wordfence:725bce1b-ec76-411d-928c-2aea47867292","source":"wordfence","cve":"CVE-2023-47180","title":"Finale Lite <= 2.16.0 - Missing Authorization to Content Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/725bce1b-ec76-411d-928c-2aea47867292?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.17.0"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:725c7fb0-68db-4716-b7a3-150ffe5610ca","source":"wordfence","cve":"CVE-2026-32473","title":"PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/725c7fb0-68db-4716-b7a3-150ffe5610ca?source=api-prod","affected":[{"type":"plugin","slug":"pdf-smart-viewer-for-elementor","name":"PDF Smart Viewer for Elementor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:15:55Z"},{"id":"wordfence:725f56f3-ea01-4b7b-92ec-aece92647697","source":"wordfence","cve":"CVE-2025-28867","title":"Frontpage category filter <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/725f56f3-ea01-4b7b-92ec-aece92647697?source=api-prod","affected":[{"type":"plugin","slug":"frontpage-category-filter","name":"Frontpage category filter","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:08:28Z"},{"id":"wordfence:725feb15-aa9b-4c00-bb95-ee0616000a14","source":"wordfence","cve":"CVE-2025-5236","title":"NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/725feb15-aa9b-4c00-bb95-ee0616000a14?source=api-prod","affected":[{"type":"plugin","slug":"ninjateam-telegram","name":"WP Telegram Chat Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-05-29T18:49:32Z","updated":"2025-05-30T07:23:41Z"},{"id":"wordfence:7262da35-a570-40c3-902c-df1d691242aa","source":"wordfence","cve":"CVE-2026-101162","title":"Ultimate Review <= 2.4.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7262da35-a570-40c3-902c-df1d691242aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:10:03Z"},{"id":"wordfence:72633a5c-67e7-444f-9a32-ef3266468cee","source":"wordfence","cve":"CVE-2026-57813","title":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.77.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72633a5c-67e7-444f-9a32-ef3266468cee?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.77.3","to_inclusive":true,"patched_in":"1.2.78.0"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:51:00Z"},{"id":"wordfence:72650c92-918a-4486-9365-11bcb6b6741a","source":"wordfence","cve":"CVE-2026-107751","title":"Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72650c92-918a-4486-9365-11bcb6b6741a?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-13T19:22:16Z","updated":"2026-10-14T07:43:34Z"},{"id":"wordfence:72662a59-f41c-4df7-aa04-7243ff43c48d","source":"wordfence","cve":"CVE-2024-4695","title":"Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72662a59-f41c-4df7-aa04-7243ff43c48d?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-05-20T20:45:06Z","updated":"2024-05-21T09:31:50Z"},{"id":"wordfence:7267ede1-7745-47cc-ac0d-4362140b4c23","source":"wordfence","cve":"CVE-2022-4943","title":"miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7267ede1-7745-47cc-ac0d-4362140b4c23?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.6.6"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:726d0a00-b64b-4dfc-a498-d7decb6b5ebd","source":"wordfence","cve":"CVE-2026-94375","title":"Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure  via Missing Directory Guard Re-verification in get_file_path()","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/726d0a00-b64b-4dfc-a498-d7decb6b5ebd?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2026-10-09T17:26:21Z","updated":"2026-10-10T05:31:02Z"},{"id":"wordfence:726e079b-7d06-42d8-be8c-6ad1cf17fdfd","source":"wordfence","cve":"CVE-2026-111413","title":"aThemeArt Theme Helper <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/726e079b-7d06-42d8-be8c-6ad1cf17fdfd?source=api-prod","affected":[{"type":"plugin","slug":"athemeart-theme-helper","name":"aThemeArt Theme Helper","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-16T13:01:00Z","updated":"2026-10-23T18:28:17Z"},{"id":"wordfence:726f5063-e904-4512-bbdc-305049219003","source":"wordfence","cve":"CVE-2024-34751","title":"Order Export & Order Import for WooCommerce <= 2.4.9 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/726f5063-e904-4512-bbdc-305049219003?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T17:01:09Z"},{"id":"wordfence:72702870-8a1a-446b-8f9f-bd435e9257f2","source":"wordfence","cve":"CVE-2025-12021","title":"WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72702870-8a1a-446b-8f9f-bd435e9257f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-oauth","name":"WP-OAuth","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:16:09Z","updated":"2025-11-11T03:30:41Z"},{"id":"wordfence:7273526e-bb51-418f-9ac8-8832f2de1cd6","source":"wordfence","cve":"CVE-2024-10543","title":"Tumult Hype Animations <= 1.9.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7273526e-bb51-418f-9ac8-8832f2de1cd6?source=api-prod","affected":[{"type":"plugin","slug":"tumult-hype-animations","name":"Tumult Hype Animations","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2024-11-05T00:00:00Z","updated":"2024-11-06T06:43:31Z"},{"id":"wordfence:72779dd2-04eb-445d-88a0-28a9c4d2369b","source":"wordfence","cve":"CVE-2025-14438","title":"Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72779dd2-04eb-445d-88a0-28a9c4d2369b?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.30","to_inclusive":true,"patched_in":"7.1.0.31"}],"published":"2026-01-05T16:06:52Z","updated":"2026-01-06T04:31:57Z"},{"id":"wordfence:7277a022-34ae-40ab-b8b5-6e9ab60d52ed","source":"wordfence","cve":"CVE-2024-8855","title":"WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7277a022-34ae-40ab-b8b5-6e9ab60d52ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-auctions","name":"WordPress Auction Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-20T17:00:24Z"},{"id":"wordfence:727a0649-082f-46d0-8d6f-de53ee7fb18e","source":"wordfence","cve":"","title":"Zip Recipes <= 8.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/727a0649-082f-46d0-8d6f-de53ee7fb18e?source=api-prod","affected":[{"type":"plugin","slug":"zip-recipes","name":"Recipe Cards For Your Food Blog from Zip Recipes","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":false,"patched_in":"8.0.8"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72800e9b-8e2c-4725-9a87-a9b187ad5967","source":"wordfence","cve":"CVE-2023-52203","title":"cformsII <= 15.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72800e9b-8e2c-4725-9a87-a9b187ad5967?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.0.6","to_inclusive":true,"patched_in":"15.0.7"}],"published":"2024-01-03T00:00:00Z","updated":"2025-05-02T11:43:38Z"},{"id":"wordfence:7282c9aa-643a-48e7-9b97-09524afca1ba","source":"wordfence","cve":"CVE-2025-30829","title":"WPCafe <= 2.2.31 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7282c9aa-643a-48e7-9b97-09524afca1ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.31","to_inclusive":true,"patched_in":"2.2.32"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:47:09Z"},{"id":"wordfence:72835a3e-e842-4146-ae7d-4aea722de11f","source":"wordfence","cve":"CVE-2023-22683","title":"Clio Grow <= 1.0.0 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72835a3e-e842-4146-ae7d-4aea722de11f?source=api-prod","affected":[{"type":"plugin","slug":"clio-grow-form","name":"Clio Grow Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72857d52-ac81-4eb2-93fa-7bb03265bccf","source":"wordfence","cve":"CVE-2025-7670","title":"JS Archive List <= 6.1.5 - Unauthenticated SQL Injection via build_sql_where Function","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72857d52-ac81-4eb2-93fa-7bb03265bccf?source=api-prod","affected":[{"type":"plugin","slug":"jquery-archive-list-widget","name":"JS Archive List","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2025-08-18T19:17:52Z","updated":"2025-08-19T07:26:27Z"},{"id":"wordfence:72876300-c9e0-41f1-bef5-f56e10b51e88","source":"wordfence","cve":"CVE-2025-66103","title":"WPCal.io <= 0.9.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72876300-c9e0-41f1-bef5-f56e10b51e88?source=api-prod","affected":[{"type":"plugin","slug":"wpcal","name":"WPCal.io \u2013 Easy Meeting Scheduler","from":"*","from_inclusive":true,"to":"0.9.5.9","to_inclusive":true,"patched_in":"0.9.5.10"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T18:41:38Z"},{"id":"wordfence:72880e44-b0e0-47f4-82f0-c36c81091ba8","source":"wordfence","cve":"CVE-2024-9592","title":"Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72880e44-b0e0-47f4-82f0-c36c81091ba8?source=api-prod","affected":[{"type":"plugin","slug":"paypal-gift-certificate","name":"Easy PayPal Gift Certificate","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T02:05:44Z"},{"id":"wordfence:7289e651-a959-4cf1-8e45-538bae22029a","source":"wordfence","cve":"CVE-2026-54190","title":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.12.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7289e651-a959-4cf1-8e45-538bae22029a?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.12.5","to_inclusive":true,"patched_in":"1.12.6"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:01:01Z"},{"id":"wordfence:728aa62d-4853-4f55-9b77-82dfa6525b8a","source":"wordfence","cve":"CVE-2026-1392","title":"SR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/728aa62d-4853-4f55-9b77-82dfa6525b8a?source=api-prod","affected":[{"type":"plugin","slug":"sr-wp-minify-html","name":"SR WP Minify HTML","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:19:05Z","updated":"2026-03-21T03:26:51Z"},{"id":"wordfence:728cec6e-a246-4e2c-a906-750518bae0a4","source":"wordfence","cve":"CVE-2021-41836","title":"Fathom Analytics <= 3.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/728cec6e-a246-4e2c-a906-750518bae0a4?source=api-prod","affected":[{"type":"plugin","slug":"fathom-analytics","name":"Fathom Analytics for WP","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2021-12-08T13:23:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:728f9fe0-2a23-4f99-af30-386ce1c1f44f","source":"wordfence","cve":"CVE-2025-23881","title":"LJ Custom Menu Links <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/728f9fe0-2a23-4f99-af30-386ce1c1f44f?source=api-prod","affected":[{"type":"plugin","slug":"lj-custom-menu-links","name":"LJ Custom Menu Links","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:51:05Z"},{"id":"wordfence:72934d2f-fd52-46d1-8cf9-9a20968899f7","source":"wordfence","cve":"CVE-2024-6754","title":"Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72934d2f-fd52-46d1-8cf9-9a20968899f7?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:57Z"},{"id":"wordfence:7293664d-df09-4443-9691-b5c072951642","source":"wordfence","cve":"CVE-2025-30949","title":"Site Chat on Telegram <= 1.0.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7293664d-df09-4443-9691-b5c072951642?source=api-prod","affected":[{"type":"plugin","slug":"site-chat-on-telegram","name":"Site Chat on Telegram","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T13:43:00Z"},{"id":"wordfence:729492e8-5625-444f-84ed-36b72cebc722","source":"wordfence","cve":"CVE-2024-12463","title":"Arena.IM \u2013 Live Blogging for real-time events <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/729492e8-5625-444f-84ed-36b72cebc722?source=api-prod","affected":[{"type":"plugin","slug":"arena-liveblog-and-chat-tool","name":"Arena.IM \u2013 Live Blogging for real-time events","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:30:23Z","updated":"2025-01-30T15:08:29Z"},{"id":"wordfence:7295f851-1844-4921-922b-89669904e5be","source":"wordfence","cve":"CVE-2026-62043","title":"DTX \u2013 Dynamic Text Extension for Contact Form 7 <= 5.0.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7295f851-1844-4921-922b-89669904e5be?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T13:04:59Z","updated":"2026-10-13T14:12:35Z"},{"id":"wordfence:7299e46f-6cff-4ecc-8c2b-100c26907c91","source":"wordfence","cve":"CVE-2025-47486","title":"Gutenberg & Elementor Templates Importer For Responsive <= 3.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7299e46f-6cff-4ecc-8c2b-100c26907c91?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:09:43Z"},{"id":"wordfence:729aa413-6edb-4a1b-a0aa-89dbe3e4b3de","source":"wordfence","cve":"CVE-2026-40806","title":"Blog, Posts and Category Filter for Elementor <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/729aa413-6edb-4a1b-a0aa-89dbe3e4b3de?source=api-prod","affected":[{"type":"plugin","slug":"blog-posts-and-category-for-elementor","name":"Blog, Posts and Category Filter for Elementor","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:31:34Z","updated":"2026-10-08T23:32:38Z"},{"id":"wordfence:729dacbf-47ad-4c4b-b7a6-fcd6304f97cc","source":"wordfence","cve":"CVE-2026-74014","title":"IT Residence <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/729dacbf-47ad-4c4b-b7a6-fcd6304f97cc?source=api-prod","affected":[{"type":"theme","slug":"it-residence","name":"IT Residence","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:04:55Z"},{"id":"wordfence:729e8a06-abaa-4468-8a80-1e5c6cbace92","source":"wordfence","cve":"CVE-2025-12984","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/729e8a06-abaa-4468-8a80-1e5c6cbace92?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-17T06:42:20Z"},{"id":"wordfence:72a06690-f40a-472b-b9d1-985a49b914b3","source":"wordfence","cve":"CVE-2023-51506","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a06690-f40a-472b-b9d1-985a49b914b3?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.0.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72a0df23-38cd-4926-9099-8eb652e05a15","source":"wordfence","cve":"CVE-2023-37975","title":"Variation Swatches for WooCommerce <= 2.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a0df23-38cd-4926-9099-8eb652e05a15?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-variation-swatches","name":"Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72a179af-25a0-40f2-a585-8d25c0289782","source":"wordfence","cve":"CVE-2026-12526","title":"Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Privilege Escalation via Administrator Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a179af-25a0-40f2-a585-8d25c0289782?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":false,"patched_in":"0.9.2.7"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:45:21Z"},{"id":"wordfence:72a2449c-4292-45e6-bfe8-106f8043fcad","source":"wordfence","cve":"CVE-2023-25797","title":"vSlider Multi Image Slider <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a2449c-4292-45e6-bfe8-106f8043fcad?source=api-prod","affected":[{"type":"plugin","slug":"vslider","name":"vSlider Multi Image Slider for WordPress","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72a56589-9dc0-47a7-bb68-e31f84a639ee","source":"wordfence","cve":"CVE-2025-3433","title":"Advanced Advertising System <= 1.3.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a56589-9dc0-47a7-bb68-e31f84a639ee?source=api-prod","affected":[{"type":"plugin","slug":"advanced-advertising-system","name":"Advanced Advertising System","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T08:22:09Z"},{"id":"wordfence:72a5bbcf-94ef-4c73-8275-7609cc36e5f4","source":"wordfence","cve":"CVE-2025-60237","title":"Finag <= 1.5.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a5bbcf-94ef-4c73-8275-7609cc36e5f4?source=api-prod","affected":[{"type":"theme","slug":"finag","name":"FinAg - Creative & Finance Agency PSD Template","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2026-05-04T14:49:27Z"},{"id":"wordfence:72a6b040-ed02-4561-82f2-4adb820bdf7d","source":"wordfence","cve":"CVE-2026-1543","title":"Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a6b040-ed02-4561-82f2-4adb820bdf7d?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.2","to_inclusive":true,"patched_in":"3.15.3"}],"published":"2026-05-20T16:21:42Z","updated":"2026-05-21T04:28:03Z"},{"id":"wordfence:72a74483-e159-4c51-a9e0-4a128cbf72dd","source":"wordfence","cve":"CVE-2024-4366","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72a74483-e159-4c51-a9e0-4a128cbf72dd?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T07:30:35Z"},{"id":"wordfence:72aa362f-927d-427f-8de9-f5119d53497e","source":"wordfence","cve":"CVE-2016-10886","title":"WP Editor < 1.2.6 - Incorrect Permission Assignment or Protection","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72aa362f-927d-427f-8de9-f5119d53497e?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2021-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72aa9128-eecb-4090-ab9e-e5fbbfc1fb5c","source":"wordfence","cve":"CVE-2024-2375","title":"WPQA - Builder forms Addon For WordPress plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72aa9128-eecb-4090-ab9e-e5fbbfc1fb5c?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T20:44:32Z"},{"id":"wordfence:72abfbcf-4be4-4e0a-89a7-94caa01c22a6","source":"wordfence","cve":"CVE-2026-25002","title":"LearnPress \u2013 Sepay Payment <= 4.0.0 - Missing Authorization","severity":"low","cvss":3.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72abfbcf-4be4-4e0a-89a7-94caa01c22a6?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-sepay-payment","name":"LearnPress \u2013 Sepay Payment","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:53:31Z"},{"id":"wordfence:72ad7420-5793-496e-8607-2b346c7a3ce5","source":"wordfence","cve":"CVE-2026-15439","title":"GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72ad7420-5793-496e-8607-2b346c7a3ce5?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.7","to_inclusive":true,"patched_in":"7.9.8"}],"published":"2026-09-10T14:36:16Z","updated":"2026-09-11T15:27:51Z"},{"id":"wordfence:72af8a37-f6c0-4353-ab27-1b671158ef5a","source":"wordfence","cve":"CVE-2026-25375","title":"Image Photo Gallery Final Tiles Grid <= 3.6.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72af8a37-f6c0-4353-ab27-1b671158ef5a?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.6.11"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-24T19:21:55Z"},{"id":"wordfence:72b14197-560a-4dc2-9c23-a250f51dc51e","source":"wordfence","cve":"CVE-2016-9263","title":"WordPress Core < 4.9.1 - Cross-domain Flash injection","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b14197-560a-4dc2-9c23-a250f51dc51e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.24","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.24","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.23","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.21","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.21","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.14","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.13","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"3.7.25"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"3.7.25"}],"published":"2017-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72b15de4-29d1-46ab-a16f-cd2cacab8dd0","source":"wordfence","cve":"CVE-2026-109901","title":"CP Multi View Events Calendar <= 1.4.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b15de4-29d1-46ab-a16f-cd2cacab8dd0?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.41","to_inclusive":true,"patched_in":"1.4.42"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:38:53Z"},{"id":"wordfence:72b3cbe6-f4a6-4a28-90c3-0e03bb8c88b0","source":"wordfence","cve":"CVE-2025-69298","title":"Gauge <= 6.56.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b3cbe6-f4a6-4a28-90c3-0e03bb8c88b0?source=api-prod","affected":[{"type":"theme","slug":"gauge","name":"Gauge: Multi-Purpose Review Theme","from":"*","from_inclusive":true,"to":"6.56.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:32:56Z"},{"id":"wordfence:72b4f6bb-59dd-453c-b089-4777dcefb11f","source":"wordfence","cve":"CVE-2023-2592","title":"FormCraft Premium <= 3.9.6 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b4f6bb-59dd-453c-b089-4777dcefb11f?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72b4fe0f-13cd-4580-9010-1a3e66000251","source":"wordfence","cve":"CVE-2022-1572","title":"HTML2WP <= 1.0.0 - Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b4fe0f-13cd-4580-9010-1a3e66000251?source=api-prod","affected":[{"type":"plugin","slug":"html2wp","name":"HTML2WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72b50c83-7128-4e38-9a5e-0954928ff002","source":"wordfence","cve":"CVE-2024-11853","title":"jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b50c83-7128-4e38-9a5e-0954928ff002?source=api-prod","affected":[{"type":"plugin","slug":"jalbum-bridge","name":"jAlbum Bridge","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2024-12-02T19:24:34Z","updated":"2025-01-24T16:57:10Z"},{"id":"wordfence:72b6c411-36f5-4104-b5f3-3b92915ad54a","source":"wordfence","cve":"CVE-2026-18603","title":"Cancel Order & Request Woocommerce <= 1.3.4.33 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b6c411-36f5-4104-b5f3-3b92915ad54a?source=api-prod","affected":[{"type":"plugin","slug":"cancel-order-request-woocommerce","name":"PiWeb Cancel order / Refund request for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4.33","to_inclusive":true,"patched_in":"1.3.4.34"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:42:09Z"},{"id":"wordfence:72b76475-5215-47fd-badf-e2c542b25d4b","source":"wordfence","cve":"CVE-2025-5289","title":"3D FlipBook - Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b76475-5215-47fd-badf-e2c542b25d4b?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.16.15","to_inclusive":true,"patched_in":"1.16.16"}],"published":"2025-06-20T22:29:56Z","updated":"2025-06-21T11:09:41Z"},{"id":"wordfence:72b777ac-1870-4588-82fe-da96a784ec81","source":"wordfence","cve":"CVE-2024-12314","title":"Rapid Cache <= 1.2.3 - Unauthenticated Cache Poisoning","severity":"high","cvss":7.2,"cwe":"CWE-524","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b777ac-1870-4588-82fe-da96a784ec81?source=api-prod","affected":[{"type":"plugin","slug":"rapid-cache","name":"Rapid Cache","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:43:06Z","updated":"2025-02-18T04:21:18Z"},{"id":"wordfence:72b936f5-373e-4cde-baad-549beb29929b","source":"wordfence","cve":"CVE-2025-53248","title":"Magazine <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b936f5-373e-4cde-baad-549beb29929b?source=api-prod","affected":[{"type":"theme","slug":"eximious-magazine","name":"Eximious Magazine","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:13:44Z"},{"id":"wordfence:72b95777-d17b-4504-95fd-c83b18106b9e","source":"wordfence","cve":"CVE-2025-14442","title":"Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72b95777-d17b-4504-95fd-c83b18106b9e?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-12-11T21:22:25Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:72baf0b2-48c1-437a-9570-9ecbaaca742a","source":"wordfence","cve":"CVE-2024-52480","title":"Jobify - Job Board WordPress Theme < 4.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72baf0b2-48c1-437a-9570-9ecbaaca742a?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2024-11-18T00:00:00Z","updated":"2026-02-26T15:02:48Z"},{"id":"wordfence:72bcfd2a-6803-4073-8fa9-62bcf0a10571","source":"wordfence","cve":"CVE-2023-6708","title":"SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72bcfd2a-6803-4073-8fa9-62bcf0a10571?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-15T14:17:41Z"},{"id":"wordfence:72bdc81e-1a9d-4dd8-93a5-fb1026d6a2d9","source":"wordfence","cve":"CVE-2023-47770","title":"Betheme <= 27.1.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72bdc81e-1a9d-4dd8-93a5-fb1026d6a2d9?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.1.1","to_inclusive":true,"patched_in":"27.1.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72be8df6-7489-4214-af6e-d1d95f79fd8f","source":"wordfence","cve":"CVE-2024-32717","title":"SchedulePress <= 5.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72be8df6-7489-4214-af6e-d1d95f79fd8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-scheduled-posts","name":"SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:51:42Z"},{"id":"wordfence:72bf7aa9-9b3c-4229-b5ba-989303379feb","source":"wordfence","cve":"CVE-2025-27267","title":"Random Quotes <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72bf7aa9-9b3c-4229-b5ba-989303379feb?source=api-prod","affected":[{"type":"plugin","slug":"random-quotes","name":"Random Quotes","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:15:49Z"},{"id":"wordfence:72c04de6-78d2-4a45-834a-01ed879b528f","source":"wordfence","cve":"","title":"Visibility Logic for Elementor <= 2.3.4 - Missing Authorization via admin_post 'toggle_option'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c04de6-78d2-4a45-834a-01ed879b528f?source=api-prod","affected":[{"type":"plugin","slug":"visibility-logic-elementor","name":"Visibility Logic for Elementor","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72c0fc66-44c7-4657-878a-e5109178e8e3","source":"wordfence","cve":"CVE-2024-43263","title":"Visual Composer Starter <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c0fc66-44c7-4657-878a-e5109178e8e3?source=api-prod","affected":[{"type":"theme","slug":"visual-composer-starter","name":"Visual Composer Starter","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-27T16:46:09Z"},{"id":"wordfence:72c16a66-05fa-4d47-937d-415f18cec0ab","source":"wordfence","cve":"CVE-2023-23971","title":"WP Time Slots Booking Form <= 1.1.81 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c16a66-05fa-4d47-937d-415f18cec0ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.1.81","to_inclusive":true,"patched_in":"1.1.82"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72c2a5d4-f201-4cc8-ac49-cde1160ca468","source":"wordfence","cve":"CVE-2024-5006","title":"Boostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c2a5d4-f201-4cc8-ac49-cde1160ca468?source=api-prod","affected":[{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-06-04T18:59:20Z","updated":"2024-06-05T07:34:53Z"},{"id":"wordfence:72c5d1b1-00bf-4352-b885-a8a7875c2bc6","source":"wordfence","cve":"CVE-2023-32291","title":"MonsterInsights Pro <= 8.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c5d1b1-00bf-4352-b885-a8a7875c2bc6?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-premium","name":"MonsterInsights Pro","from":"*","from_inclusive":true,"to":"8.14.1","to_inclusive":true,"patched_in":"8.15"}],"published":"2023-06-21T00:00:00Z","updated":"2026-08-17T16:33:39Z"},{"id":"wordfence:72c5fd31-f457-494a-a160-1f64366e3e63","source":"wordfence","cve":"CVE-2016-1000146","title":"Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c5fd31-f457-494a-a160-1f64366e3e63?source=api-prod","affected":[{"type":"plugin","slug":"pondol-formmail","name":"Pondol Form to Mail","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72c66e71-dddb-4142-ae13-da3caffd8714","source":"wordfence","cve":"CVE-2024-13228","title":"Qubely \u2013 Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content","severity":"medium","cvss":4.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c66e71-dddb-4142-ae13-da3caffd8714?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.13","to_inclusive":true,"patched_in":"1.8.14"}],"published":"2025-03-10T00:00:00Z","updated":"2025-03-11T07:05:17Z"},{"id":"wordfence:72c85bbd-2953-4f25-9a26-7edd48a4e50c","source":"wordfence","cve":"CVE-2025-30943","title":"Posts Slider Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c85bbd-2953-4f25-9a26-7edd48a4e50c?source=api-prod","affected":[{"type":"plugin","slug":"posts-slider-shortcode","name":"Posts Slider Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:54:18Z"},{"id":"wordfence:72c8be2b-b52a-47e5-91f7-aac1e89e00f3","source":"wordfence","cve":"CVE-2024-37240","title":"Falang multilanguage <= 1.3.51 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72c8be2b-b52a-47e5-91f7-aac1e89e00f3?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.51","to_inclusive":true,"patched_in":"1.3.52"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:56:03Z"},{"id":"wordfence:72d18504-7b12-43f0-b2ea-40dbc25912c4","source":"wordfence","cve":"CVE-2023-26531","title":"\u591a\u5408\u4e00\u641c\u7d22\u81ea\u52a8\u63a8\u9001\u7ba1\u7406\u63d2\u4ef6-\u652f\u6301Baidu/Google/Bing/IndexNow/Yandex/\u5934\u6761 <= 4.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72d18504-7b12-43f0-b2ea-40dbc25912c4?source=api-prod","affected":[{"type":"plugin","slug":"baidu-submit-link","name":"\u591a\u5408\u4e00\u641c\u7d22\u81ea\u52a8\u63a8\u9001\u7ba1\u7406\u63d2\u4ef6-\u652f\u6301Baidu/Google/Bing/IndexNow/Yandex/\u5934\u6761","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72d1c099-7653-4c25-b721-930b618f4000","source":"wordfence","cve":"CVE-2026-96895","title":"YouTube Lyte <= 1.7.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72d1c099-7653-4c25-b721-930b618f4000?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-lyte","name":"WP YouTube Lyte","from":"*","from_inclusive":true,"to":"1.7.30","to_inclusive":true,"patched_in":"1.7.31"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T20:11:23Z"},{"id":"wordfence:72d325c5-ea41-45c7-97d7-c15c0038ade6","source":"wordfence","cve":"CVE-2025-27268","title":"Small Package Quotes \u2013 Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72d325c5-ea41-45c7-97d7-c15c0038ade6?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-wwe-edition","name":"Small Package Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"5.2.19"}],"published":"2025-02-21T00:00:00Z","updated":"2026-04-15T20:55:14Z"},{"id":"wordfence:72d33132-aba7-4e97-90c6-359298b1c06e","source":"wordfence","cve":"","title":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 6.61 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72d33132-aba7-4e97-90c6-359298b1c06e?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.61","to_inclusive":true,"patched_in":"6.62"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72d9efad-9afd-4d7a-a1dd-7623a9e5a7db","source":"wordfence","cve":"CVE-2014-9511","title":"Sell Downloads <= 1.0.1 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72d9efad-9afd-4d7a-a1dd-7623a9e5a7db?source=api-prod","affected":[{"type":"plugin","slug":"sell-downloads","name":"Sell Downloads","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2014-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72daa533-8b17-420c-9b51-b5f72da2726c","source":"wordfence","cve":"CVE-2023-5063","title":"Widget Responsive for Youtube <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72daa533-8b17-420c-9b51-b5f72da2726c?source=api-prod","affected":[{"type":"plugin","slug":"youtube-widget-responsive","name":"Widget Responsive for Youtube","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72dc919a-c13d-49b4-927d-a0bb837b63dd","source":"wordfence","cve":"CVE-2024-13775","title":"WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72dc919a-c13d-49b4-927d-a0bb837b63dd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-support-ticket-system","name":"WooCommerce Support Ticket System","from":"*","from_inclusive":true,"to":"17.8","to_inclusive":true,"patched_in":"17.9"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T12:21:31Z"},{"id":"wordfence:72de1ac3-8007-4c9b-b4c5-aa54c1896ab1","source":"wordfence","cve":"CVE-2026-110692","title":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates 2.10.0 - 3.1.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72de1ac3-8007-4c9b-b4c5-aa54c1896ab1?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"2.10.0","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:36:39Z"},{"id":"wordfence:72de9f64-f3e0-4705-adc1-6c22076b382f","source":"wordfence","cve":"CVE-2025-4391","title":"Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72de9f64-f3e0-4705-adc1-6c22076b382f?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-post-generator-echo","name":"Echo RSS Feed Post Generator","from":"*","from_inclusive":true,"to":"5.4.8.1","to_inclusive":true,"patched_in":"5.4.8.2"}],"published":"2025-05-16T16:28:23Z","updated":"2025-05-17T05:30:34Z"},{"id":"wordfence:72e1482c-0f55-4f43-8590-d4f2758f0eea","source":"wordfence","cve":"CVE-2023-52191","title":"Infogram <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1482c-0f55-4f43-8590-d4f2758f0eea?source=api-prod","affected":[{"type":"plugin","slug":"infogram","name":"Infogram \u2013 Add charts, maps and infographics","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72e1bbd5-ffbf-4428-ac7e-82f18f2aa940","source":"wordfence","cve":"CVE-2025-66152","title":"Criptopayer for Elementor <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1bbd5-ffbf-4428-ac7e-82f18f2aa940?source=api-prod","affected":[{"type":"plugin","slug":"criptopayer-elementor","name":"Criptopayer \u2013 Crypto Payment Button for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-06T16:26:10Z"},{"id":"wordfence:72e1fbce-86ae-4518-a613-7c322193acf4","source":"wordfence","cve":"CVE-2024-1978","title":"Friends <= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1fbce-86ae-4518-a613-7c322193acf4?source=api-prod","affected":[{"type":"plugin","slug":"friends","name":"Friends","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T06:47:57Z"},{"id":"wordfence:72e4428b-d2cd-471f-9821-947f4601fd64","source":"wordfence","cve":"CVE-2023-5382","title":"Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e4428b-d2cd-471f-9821-947f4601fd64?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72e7dbe0-0e48-4511-9e35-77af7d3d13e5","source":"wordfence","cve":"CVE-2014-8955","title":"Contact Form Clean and Simple < 4.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e7dbe0-0e48-4511-9e35-77af7d3d13e5?source=api-prod","affected":[{"type":"plugin","slug":"clean-and-simple-contact-form-by-meg-nicholas","name":"Contact Form Clean and Simple","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":false,"patched_in":"4.4.1"}],"published":"2014-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72e92bd8-9060-4312-800c-e637e6881aa5","source":"wordfence","cve":"CVE-2026-14832","title":"ShopSmart Loyalty for WooCommerce <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72e92bd8-9060-4312-800c-e637e6881aa5?source=api-prod","affected":[{"type":"plugin","slug":"shopsmart-loyalty-for-woocommerce","name":"ShopSmart Loyalty for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-21T13:00:42Z"},{"id":"wordfence:72eb1cd3-47cb-4d9b-9bfd-87fef7859974","source":"wordfence","cve":"CVE-2024-33694","title":"Meks ThemeForest Smart Widget <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72eb1cd3-47cb-4d9b-9bfd-87fef7859974?source=api-prod","affected":[{"type":"plugin","slug":"meks-themeforest-smart-widget","name":"Meks ThemeForest Smart Widget","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-04-26T00:00:00Z","updated":"2024-08-01T20:10:55Z"},{"id":"wordfence:72ed9cba-fe5c-4cee-9e1b-c3edde2521ca","source":"wordfence","cve":"CVE-2018-1000131","title":"WP Support Plus Responsive Ticket System <= 9.0.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72ed9cba-fe5c-4cee-9e1b-c3edde2521ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2018-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72eda38d-34e9-4a0e-a760-a9b991e590de","source":"wordfence","cve":"CVE-2022-3679","title":"Starter Templates by Kadence WP <= 1.2.16 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72eda38d-34e9-4a0e-a760-a9b991e590de?source=api-prod","affected":[{"type":"plugin","slug":"kadence-starter-templates","name":"Kadence Starter Templates \u2014 Predesigned Website Templates","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2022-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72f1ffe1-d8af-4aa2-bc58-5f1cd4eaa856","source":"wordfence","cve":"CVE-2023-0096","title":"Happyforms <= 1.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f1ffe1-d8af-4aa2-bc58-5f1cd4eaa856?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.21.1","to_inclusive":true,"patched_in":"1.22.0"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72f3416a-4d5e-4b95-8f83-7b9440f9e9df","source":"wordfence","cve":"CVE-2024-11360","title":"Page Parts <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f3416a-4d5e-4b95-8f83-7b9440f9e9df?source=api-prod","affected":[{"type":"plugin","slug":"page-parts","name":"Page Parts","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-11-20T13:48:43Z","updated":"2024-11-22T14:49:58Z"},{"id":"wordfence:72f3541e-e589-4f21-ab51-89dba704b271","source":"wordfence","cve":"CVE-2021-24238","title":"Realteo < 1.2.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f3541e-e589-4f21-ab51-89dba704b271?source=api-prod","affected":[{"type":"plugin","slug":"realteo","name":"Realteo","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2021-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72f3925d-6b3a-43bf-bfd1-fef7e71d5e43","source":"wordfence","cve":"CVE-2023-49812","title":"WP Photo Album Plus <= 8.5.02.005 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f3925d-6b3a-43bf-bfd1-fef7e71d5e43?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.5.02.005","to_inclusive":true,"patched_in":"8.6.01.005"}],"published":"2023-12-05T00:00:00Z","updated":"2024-02-05T17:31:56Z"},{"id":"wordfence:72f3a9bd-440e-4b1d-a628-ae28487e535a","source":"wordfence","cve":"CVE-2026-77006","title":"WebTotem Backups < 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f3a9bd-440e-4b1d-a628-ae28487e535a?source=api-prod","affected":[{"type":"plugin","slug":"wt-backups","name":"WebTotem Backups","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-23T14:30:58Z"},{"id":"wordfence:72f4776f-5450-4022-92dd-47ddaa91a5cd","source":"wordfence","cve":"","title":"Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f4776f-5450-4022-92dd-47ddaa91a5cd?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.0","from_inclusive":true,"to":"12.0.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.1","from_inclusive":true,"to":"12.1.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.2","from_inclusive":true,"to":"12.2.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.3","from_inclusive":true,"to":"12.3.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.4","from_inclusive":true,"to":"12.4.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.5","from_inclusive":true,"to":"12.5.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.6","from_inclusive":true,"to":"12.6.3","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.7","from_inclusive":true,"to":"12.7.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.8","from_inclusive":true,"to":"12.8.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.9","from_inclusive":true,"to":"12.9.4","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.0","from_inclusive":true,"to":"13.0.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.1","from_inclusive":true,"to":"13.1.4","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.2","from_inclusive":true,"to":"13.2.3","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.3","from_inclusive":true,"to":"13.3.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.4","from_inclusive":true,"to":"13.4.4","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.5","from_inclusive":true,"to":"13.5.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.6","from_inclusive":true,"to":"13.6.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.7","from_inclusive":true,"to":"13.7.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.8","from_inclusive":true,"to":"13.8.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.9","from_inclusive":true,"to":"13.9.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.0","from_inclusive":true,"to":"14.0","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.1","from_inclusive":true,"to":"14.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.2","from_inclusive":true,"to":"14.2.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.3","from_inclusive":true,"to":"14.3","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.4","from_inclusive":true,"to":"14.4.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.5","from_inclusive":true,"to":"14.5","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.6","from_inclusive":true,"to":"14.6","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.7","from_inclusive":true,"to":"14.7","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.8","from_inclusive":true,"to":"14.8","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.9","from_inclusive":true,"to":"14.9.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.0","from_inclusive":true,"to":"15.0.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.1","from_inclusive":true,"to":"15.1.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.2","from_inclusive":true,"to":"15.2","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.3","from_inclusive":true,"to":"15.3.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.4","from_inclusive":true,"to":"15.4","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.5","from_inclusive":true,"to":"15.5","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.6","from_inclusive":true,"to":"15.6","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.7","from_inclusive":true,"to":"15.7.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.8","from_inclusive":true,"to":"15.8","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.9","from_inclusive":true,"to":"15.9.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.0","from_inclusive":true,"to":"16.0.1","to_inclusive":true,"patched_in":"12.0.3"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.1","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"12.0.3"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-04T20:32:22Z"},{"id":"wordfence:72f5213a-4a1e-4e71-b67a-09a9bb527bfa","source":"wordfence","cve":"CVE-2025-39440","title":"Broken Links Remover <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f5213a-4a1e-4e71-b67a-09a9bb527bfa?source=api-prod","affected":[{"type":"plugin","slug":"broken-links-remover","name":"Broken Links Remover","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:35:39Z"},{"id":"wordfence:72f6b96e-cff4-414e-bbe8-6a244cc6feed","source":"wordfence","cve":"CVE-2026-48877","title":"GenerateBlocks <= 2.1.0 - Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72f6b96e-cff4-414e-bbe8-6a244cc6feed?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T12:05:22Z"},{"id":"wordfence:72fa004c-5293-4977-b99c-2c7c12790615","source":"wordfence","cve":"CVE-2026-125784","title":"RestroPress \u2013 Online Food Ordering System <= 3.4.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fa004c-5293-4977-b99c-2c7c12790615?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:44Z"},{"id":"wordfence:72fa042f-e532-44ee-a94e-e6049675b880","source":"wordfence","cve":"CVE-2026-97265","title":"JetEngine <= 3.8.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fa042f-e532-44ee-a94e-e6049675b880?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.15.3","to_inclusive":true,"patched_in":"3.8.15.4"}],"published":"2026-09-30T12:33:32Z","updated":"2026-10-09T00:13:56Z"},{"id":"wordfence:72fa6b56-dfbf-4c27-a6f3-418d1ab5dc0f","source":"wordfence","cve":"CVE-2020-20626","title":"Lara Google Analytics <= 2.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fa6b56-dfbf-4c27-a6f3-418d1ab5dc0f?source=api-prod","affected":[{"type":"plugin","slug":"lara-google-analytics","name":"Lara's Google Analytics (GA4)","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72fac756-6e43-4880-8328-c023429759f3","source":"wordfence","cve":"CVE-2026-34896","title":"Under Construction, Coming Soon & Maintenance Mode <= 2.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fac756-6e43-4880-8328-c023429759f3?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-maintenance-mode","name":"Under Construction, Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:50:59Z"},{"id":"wordfence:72fadfa8-4b53-4661-8b6c-69cdb79d3fd7","source":"wordfence","cve":"CVE-2022-3380","title":"Customizer Export/Import <= 0.9.4 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fadfa8-4b53-4661-8b6c-69cdb79d3fd7?source=api-prod","affected":[{"type":"plugin","slug":"customizer-export-import","name":"Customizer Export/Import","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:72fb0557-27ac-40fe-8440-06c89e1133be","source":"wordfence","cve":"CVE-2025-24611","title":"WP Ultimate Exporter <= 2.9 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fb0557-27ac-40fe-8440-06c89e1133be?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:20:27Z"},{"id":"wordfence:72fcb66d-ad00-4df0-a176-7b7c17756f52","source":"wordfence","cve":"CVE-2025-64202","title":"Sahifa < 5.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72fcb66d-ad00-4df0-a176-7b7c17756f52?source=api-prod","affected":[{"type":"theme","slug":"sahifa","name":"Sahifa","from":"*","from_inclusive":true,"to":"5.8.6","to_inclusive":false,"patched_in":"5.8.6"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-03T18:09:36Z"},{"id":"wordfence:73017e92-d95e-4b9c-a44a-779b498f58b7","source":"wordfence","cve":"CVE-2023-25790","title":"WoodMart <= 7.1.1 - Missing Authorization to Shortcode Injection","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73017e92-d95e-4b9c-a44a-779b498f58b7?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7303c2d0-f3b0-41b2-9786-acbe181ccb2e","source":"wordfence","cve":"CVE-2024-54382","title":"Bold Page Builder <= 5.1.5 - Authenticated (Editor+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7303c2d0-f3b0-41b2-9786-acbe181ccb2e?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:38:50Z"},{"id":"wordfence:7309ef28-8ec7-40aa-a891-bff088c435c1","source":"wordfence","cve":"CVE-2018-25329","title":"WP with Spritz <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7309ef28-8ec7-40aa-a891-bff088c435c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-with-spritz","name":"WP with Spritz","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-17T00:00:00Z","updated":"2026-07-29T19:56:19Z"},{"id":"wordfence:730a3cde-bcbd-4d60-80bb-3944cc5386e5","source":"wordfence","cve":"","title":"SAM Pro (Free Edition) < 1.9.7.69 & Simple Ads Manager <= 2.10.0.130 & SAM Pro Lite < 1.9.0.53 - Local/Remote File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/730a3cde-bcbd-4d60-80bb-3944cc5386e5?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.10.0.130","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sam-pro-lite","name":"SAM Pro Lite","from":"*","from_inclusive":true,"to":"1.9.0.53","to_inclusive":false,"patched_in":"1.9.0.53"},{"type":"plugin","slug":"sam-pro-free","name":"SAM Pro (Free Edition)","from":"*","from_inclusive":true,"to":"1.9.7.69","to_inclusive":false,"patched_in":"1.9.7.69"}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:730d0ff6-9881-4d69-bdaf-924d3d9f522c","source":"wordfence","cve":"CVE-2025-31009","title":"IndieBlocks <= 0.13.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/730d0ff6-9881-4d69-bdaf-924d3d9f522c?source=api-prod","affected":[{"type":"plugin","slug":"indieblocks","name":"IndieBlocks","from":"*","from_inclusive":true,"to":"0.13.1","to_inclusive":true,"patched_in":"0.13.2"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:48:16Z"},{"id":"wordfence:730dac2b-edc2-4bfc-a1c5-ffeba71308ad","source":"wordfence","cve":"","title":"Popular Posts by BestWebSoft < 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/730dac2b-edc2-4bfc-a1c5-ffeba71308ad?source=api-prod","affected":[{"type":"plugin","slug":"bws-popular-posts","name":"Popular Posts by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:731089f1-ad98-4d6a-a165-f3d5970915a9","source":"wordfence","cve":"CVE-2024-51890","title":"Geoportail Shortcode <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/731089f1-ad98-4d6a-a165-f3d5970915a9?source=api-prod","affected":[{"type":"plugin","slug":"geoportail-shortcode","name":"Geoportail Shortcode","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:30:00Z"},{"id":"wordfence:73115c27-86f1-4421-9fe5-bf5d8cf54d9f","source":"wordfence","cve":"","title":"WPLocalPlaces (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73115c27-86f1-4421-9fe5-bf5d8cf54d9f?source=api-prod","affected":[{"type":"theme","slug":"wplocalplaces","name":"WPLocalPlaces","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73163743-2bff-459d-bed9-593f6ce837fa","source":"wordfence","cve":"CVE-2011-3126","title":"WordPress Core < 3.1.3 - Username Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-204","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73163743-2bff-459d-bed9-593f6ce837fa?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73167e7c-a790-4c08-ab4d-59a684bab68f","source":"wordfence","cve":"CVE-2026-115595","title":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics <= 1.10.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73167e7c-a790-4c08-ab4d-59a684bab68f?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.10.7","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T10:35:00Z","updated":"2026-10-28T01:22:58Z"},{"id":"wordfence:7317d716-39e0-40d6-92a8-e59bd8470e5d","source":"wordfence","cve":"CVE-2018-10504","title":"Form Maker by 10Web <= 1.12.21 - CSV Injection","severity":"high","cvss":7.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7317d716-39e0-40d6-92a8-e59bd8470e5d?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.12.22","to_inclusive":false,"patched_in":"1.12.22"}],"published":"2018-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7317ecf5-d43d-4080-ad2a-7644764dd41e","source":"wordfence","cve":"CVE-2024-8902","title":"Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7317ecf5-d43d-4080-ad2a-7644764dd41e?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.8","to_inclusive":true,"patched_in":"1.13.9"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T09:39:17Z"},{"id":"wordfence:7319293e-f921-46d1-aea6-2578d1a251a7","source":"wordfence","cve":"","title":"avalex \u2013 Automatisch sichere Rechtstexte <= 3.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7319293e-f921-46d1-aea6-2578d1a251a7?source=api-prod","affected":[{"type":"plugin","slug":"avalex","name":"avalex \u2013 Automatisch sichere Rechtstexte","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7319ca86-0575-4d52-9ca2-1527d7394748","source":"wordfence","cve":"CVE-2025-57941","title":"Append Link on Copy <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7319ca86-0575-4d52-9ca2-1527d7394748?source=api-prod","affected":[{"type":"plugin","slug":"append-link-on-copy","name":"Append Link on Copy","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:27:10Z"},{"id":"wordfence:731a42fa-d48c-475e-8868-0ff5603b65de","source":"wordfence","cve":"CVE-2025-47676","title":"User Login History <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/731a42fa-d48c-475e-8868-0ff5603b65de?source=api-prod","affected":[{"type":"plugin","slug":"user-login-history","name":"User Login History","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-17T14:10:20Z"},{"id":"wordfence:731cbeed-d4aa-448f-878a-8c51a3da4e18","source":"wordfence","cve":"CVE-2023-2415","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/731cbeed-d4aa-448f-878a-8c51a3da4e18?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7320421b-6b88-452d-a363-a71cdf7953a6","source":"wordfence","cve":"CVE-2026-14785","title":"Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7320421b-6b88-452d-a363-a71cdf7953a6?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-07-27T21:29:21Z","updated":"2026-08-07T15:41:32Z"},{"id":"wordfence:7320c06e-a7a7-4ed0-93cd-e85d74bae73f","source":"wordfence","cve":"CVE-2025-6970","title":"Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7320c06e-a7a7-4ed0-93cd-e85d74bae73f?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.6.4.4","to_inclusive":true,"patched_in":"6.6.5"},{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"7.0.1","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"6.6.5"}],"published":"2025-07-09T09:58:32Z","updated":"2025-07-09T22:22:46Z"},{"id":"wordfence:73210f4b-3f4a-4fdc-9d4d-1a97d79f04c0","source":"wordfence","cve":"CVE-2025-4567","title":"Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider <= 3.2.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73210f4b-3f4a-4fdc-9d4d-1a97d79f04c0?source=api-prod","affected":[{"type":"plugin","slug":"post-slider-and-carousel","name":"Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2025-05-13T00:00:00Z","updated":"2025-06-06T14:13:36Z"},{"id":"wordfence:732311d9-8155-42e0-90e7-faf4668d91ca","source":"wordfence","cve":"CVE-2024-49691","title":"Product Filter by WBW <= 2.7.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732311d9-8155-42e0-90e7-faf4668d91ca?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:59:17Z"},{"id":"wordfence:73232bff-b11a-4580-8cde-5bf085ba749c","source":"wordfence","cve":"CVE-2023-51370","title":"WP Chat App <= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73232bff-b11a-4580-8cde-5bf085ba749c?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73241750-cd21-4eee-9d43-8c5e26f9b9cf","source":"wordfence","cve":"CVE-2018-9020","title":"Events Manager <= 5.8.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73241750-cd21-4eee-9d43-8c5e26f9b9cf?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.8.1.2","to_inclusive":false,"patched_in":"5.8.1.2"}],"published":"2018-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73251a74-5be3-446b-8e0a-ff2d1484c467","source":"wordfence","cve":"CVE-2026-18315","title":"TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73251a74-5be3-446b-8e0a-ff2d1484c467?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-18T14:52:24Z","updated":"2026-08-19T18:27:41Z"},{"id":"wordfence:7327bf48-73ef-4f64-bbad-91cc135b19a4","source":"wordfence","cve":"CVE-2026-89302","title":"Post Voting System <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7327bf48-73ef-4f64-bbad-91cc135b19a4?source=api-prod","affected":[{"type":"plugin","slug":"post-voting-system","name":"Post Voting System","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:11Z"},{"id":"wordfence:7327f439-0088-4ad8-898a-30740fc62d6e","source":"wordfence","cve":"CVE-2011-3858","title":"Pixiv Custom < 2.1.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7327f439-0088-4ad8-898a-30740fc62d6e?source=api-prod","affected":[{"type":"theme","slug":"pixiv-custom","name":"Pixiv Custom","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2011-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7329241f-f9a1-4afb-8030-e0bfe0dce283","source":"wordfence","cve":"CVE-2024-51921","title":"scrollup <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7329241f-f9a1-4afb-8030-e0bfe0dce283?source=api-prod","affected":[{"type":"plugin","slug":"scrollup","name":"scrollup","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:58:48Z"},{"id":"wordfence:732a8d81-ea99-4223-9997-04ac88fd29d7","source":"wordfence","cve":"CVE-2026-40757","title":"Ch\u00e2teau <= 1.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732a8d81-ea99-4223-9997-04ac88fd29d7?source=api-prod","affected":[{"type":"theme","slug":"chateau","name":"Ch\u00e2teau - Winery and Wine Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:16:51Z"},{"id":"wordfence:732ae100-4d85-4a26-96c6-3698ad99ae47","source":"wordfence","cve":"CVE-2015-20123","title":"Aspose.Words Exporter <= 1.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732ae100-4d85-4a26-96c6-3698ad99ae47?source=api-prod","affected":[{"type":"plugin","slug":"aspose-doc-exporter","name":"Aspose.Words \u2013 Import and Export word documents","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2015-03-28T00:00:00Z","updated":"2026-10-23T18:00:09Z"},{"id":"wordfence:732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4","source":"wordfence","cve":"CVE-2026-14482","title":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732c7ccd-de50-4e27-8cb9-3bb0ed30f0b4?source=api-prod","affected":[{"type":"plugin","slug":"duoshuo","name":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:30:16Z","updated":"2026-07-08T04:30:50Z"},{"id":"wordfence:732d567d-5946-47b8-8228-9f5e75eab57e","source":"wordfence","cve":"CVE-2025-60103","title":"ListingPro <= 2.9.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732d567d-5946-47b8-8228-9f5e75eab57e?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:22:51Z"},{"id":"wordfence:732f6458-c39f-4e77-8ce6-68d74c67084a","source":"wordfence","cve":"CVE-2023-2635","title":"Call Now Accessibility Button <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732f6458-c39f-4e77-8ce6-68d74c67084a?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-help-button","name":"Call Now Accessibility Button","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-06-19T00:00:00Z","updated":"2024-08-09T20:10:10Z"},{"id":"wordfence:732fb8ec-b520-4e24-a479-4c7be15b67f7","source":"wordfence","cve":"CVE-2026-83543","title":"Greenshift \u2013 animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/732fb8ec-b520-4e24-a479-4c7be15b67f7?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.0","to_inclusive":false,"patched_in":"13.2.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:47Z"},{"id":"wordfence:73323c62-c23f-4bf2-b266-df63db63d4d3","source":"wordfence","cve":"CVE-2023-23735","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73323c62-c23f-4bf2-b266-df63db63d4d3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7332c21a-3501-4066-b7b7-34914a228d8f","source":"wordfence","cve":"CVE-2024-12261","title":"SmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7332c21a-3501-4066-b7b7-34914a228d8f?source=api-prod","affected":[{"type":"plugin","slug":"smartemailing","name":"SmartEmailing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-01-06T16:07:59Z","updated":"2025-01-24T18:48:52Z"},{"id":"wordfence:7332fe2e-9bef-42b7-946e-4a2ee812ca26","source":"wordfence","cve":"CVE-2024-24797","title":"ERE Recently Viewed <= 1.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7332fe2e-9bef-42b7-946e-4a2ee812ca26?source=api-prod","affected":[{"type":"plugin","slug":"ere-recently-viewed","name":"ERE Recently Viewed \u2013 Essential Real Estate Add-On","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-27T00:40:16Z"},{"id":"wordfence:73347ab9-2248-4402-85bf-8996b342501b","source":"wordfence","cve":"CVE-2025-7963","title":"Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73347ab9-2248-4402-85bf-8996b342501b?source=api-prod","affected":[{"type":"plugin","slug":"easy-waveform-player","name":"Easy Waveform Player","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-09-01T19:14:41Z","updated":"2026-09-02T07:39:08Z"},{"id":"wordfence:733ae8c8-fa52-418d-b42e-75516906fb66","source":"wordfence","cve":"CVE-2021-24312","title":"WP Super Cache <= 1.7.2 - Authenticated Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/733ae8c8-fa52-418d-b42e-75516906fb66?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":false,"patched_in":"1.7.3"}],"published":"2021-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:733c291d-b4d9-4e39-a093-877574913609","source":"wordfence","cve":"CVE-2025-58032","title":"WP Compiler <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/733c291d-b4d9-4e39-a093-877574913609?source=api-prod","affected":[{"type":"plugin","slug":"wp-compiler","name":"WP Compiler","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:32:45Z"},{"id":"wordfence:733ddf62-278b-4a2d-9dc5-28db3491cb29","source":"wordfence","cve":"CVE-2024-25912","title":"MoveTo <= 6.2 - Missing Authorization to Unauthenticated Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/733ddf62-278b-4a2d-9dc5-28db3491cb29?source=api-prod","affected":[{"type":"plugin","slug":"moveto","name":"Moveto - Movers quotation and booking management tool","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T14:51:54Z"},{"id":"wordfence:733f5ded-e8cb-4895-b938-889cea32f027","source":"wordfence","cve":"CVE-2024-2923","title":"Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/733f5ded-e8cb-4895-b938-889cea32f027?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.1.37","to_inclusive":true,"patched_in":"1.1.38"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:32Z"},{"id":"wordfence:733f7666-468a-455c-a953-3d8946940f13","source":"wordfence","cve":"CVE-2025-2807","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/733f7666-468a-455c-a953-3d8946940f13?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.64","to_inclusive":true,"patched_in":"1.4.65"}],"published":"2025-04-07T20:33:10Z","updated":"2025-04-08T09:21:21Z"},{"id":"wordfence:73418252-ce07-4872-97ae-c6ea71c2105b","source":"wordfence","cve":"CVE-2026-25399","title":"Serious Slider <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73418252-ce07-4872-97ae-c6ea71c2105b?source=api-prod","affected":[{"type":"plugin","slug":"cryout-serious-slider","name":"Serious Slider","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-01-30T00:00:00Z","updated":"2026-03-17T21:33:33Z"},{"id":"wordfence:73442cf9-615a-47a0-860e-fb8263ae65ee","source":"wordfence","cve":"","title":"Custom Fields Search by BestWebSoft < 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73442cf9-615a-47a0-860e-fb8263ae65ee?source=api-prod","affected":[{"type":"plugin","slug":"custom-fields-search","name":"Custom Fields Search by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73445d8f-1f9c-4ba7-9e3c-3e6221f3b23e","source":"wordfence","cve":"CVE-2024-31244","title":"Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73445d8f-1f9c-4ba7-9e3c-3e6221f3b23e?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:41:24Z"},{"id":"wordfence:7346eeba-904b-4cf9-9d10-33a33120aea4","source":"wordfence","cve":"CVE-2015-5485","title":"The Events Calendar: Eventbrite Tickets < 3.10.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7346eeba-904b-4cf9-9d10-33a33120aea4?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar-eventbrite-tickets","name":"The Events Calendar: Eventbrite Tickets","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":false,"patched_in":"3.10.2"}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73472066-8e5c-46a4-906d-f459a2ebf40d","source":"wordfence","cve":"CVE-2022-0321","title":"WP Voting Contest < 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73472066-8e5c-46a4-906d-f459a2ebf40d?source=api-prod","affected":[{"type":"plugin","slug":"wp-voting-contest","name":"WP Voting Contest Lite","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:734b6ae0-b2f6-4bad-a6d3-bef48fd8cdd0","source":"wordfence","cve":"CVE-2013-7477","title":"Events Manager <= 5.5.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/734b6ae0-b2f6-4bad-a6d3-bef48fd8cdd0?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73500260-4eff-4e56-a27c-1ff90b23e8d3","source":"wordfence","cve":"CVE-2025-62951","title":"Interactive Content \u2013 H5P <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73500260-4eff-4e56-a27c-1ff90b23e8d3?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"}],"published":"2025-10-13T00:00:00Z","updated":"2025-11-11T14:51:58Z"},{"id":"wordfence:7350bb9f-8c75-4292-9769-bccb3805292e","source":"wordfence","cve":"CVE-2024-10560","title":"Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7350bb9f-8c75-4292-9769-bccb3805292e?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.29","to_inclusive":true,"patched_in":"1.15.30"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-17T14:39:20Z"},{"id":"wordfence:73524687-7703-4912-aad5-2a31122ba9b2","source":"wordfence","cve":"CVE-2024-7054","title":"Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73524687-7703-4912-aad5-2a31122ba9b2?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.19.0","to_inclusive":true,"patched_in":"1.19.1"}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-20T10:58:30Z"},{"id":"wordfence:7352ab6d-b582-4512-a9fa-4b42b78fa862","source":"wordfence","cve":"CVE-2024-1993","title":"Icon Widget <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7352ab6d-b582-4512-a9fa-4b42b78fa862?source=api-prod","affected":[{"type":"plugin","slug":"icon-widget","name":"Icon Widget","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-31T15:30:25Z"},{"id":"wordfence:7353179a-8e60-497b-9ca0-0bf0530f5917","source":"wordfence","cve":"CVE-2026-39782","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7353179a-8e60-497b-9ca0-0bf0530f5917?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2026-10-29T13:56:00Z","updated":"2026-11-03T19:57:12Z"},{"id":"wordfence:7356a030-14c8-4fcb-b5a2-cf23d8a8bc7f","source":"wordfence","cve":"CVE-2025-28894","title":"List of Posts from each Category plugin for WordPress <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7356a030-14c8-4fcb-b5a2-cf23d8a8bc7f?source=api-prod","affected":[{"type":"plugin","slug":"list-posts-by-category","name":"List of Posts from each Category plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:18:39Z"},{"id":"wordfence:73577a0d-8aac-4369-8022-98c198f79224","source":"wordfence","cve":"CVE-2026-89138","title":"Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73577a0d-8aac-4369-8022-98c198f79224?source=api-prod","affected":[{"type":"plugin","slug":"filter-gallery","name":"Filter Gallery","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-17T18:32:23Z","updated":"2026-09-18T06:38:53Z"},{"id":"wordfence:735b20ff-a708-4e1c-b96e-bcdec72aad95","source":"wordfence","cve":"CVE-2026-39562","title":"Client Invoicing by Sprout Invoices <= 20.8.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/735b20ff-a708-4e1c-b96e-bcdec72aad95?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.10","to_inclusive":true,"patched_in":"20.8.11"}],"published":"2026-03-19T00:00:00Z","updated":"2026-04-15T21:29:32Z"},{"id":"wordfence:735d44ae-8072-48bb-a498-a0f130d1130b","source":"wordfence","cve":"CVE-2024-4969","title":"Widget Bundle <= 2.0.0 - Cross-Site Request Forgery to Widget Disable/Enable","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/735d44ae-8072-48bb-a498-a0f130d1130b?source=api-prod","affected":[{"type":"plugin","slug":"wp-widget-bundle","name":"Widget Bundle","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T15:57:32Z"},{"id":"wordfence:735d6492-a17e-4440-9727-aacfed54b0ac","source":"wordfence","cve":"CVE-2026-17515","title":"MLS Import <= 7.0.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/735d6492-a17e-4440-9727-aacfed54b0ac?source=api-prod","affected":[{"type":"plugin","slug":"mlsimport","name":"MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.4"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-21T15:31:54Z"},{"id":"wordfence:73600498-f55c-4b8e-a625-4f292e58e0ee","source":"wordfence","cve":"CVE-2023-2440","title":"UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73600498-f55c-4b8e-a625-4f292e58e0ee?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73615729-c32a-45f7-b2d8-5c978370e18c","source":"wordfence","cve":"CVE-2026-4080","title":"Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73615729-c32a-45f7-b2d8-5c978370e18c?source=api-prod","affected":[{"type":"plugin","slug":"easy-cart","name":"Easy Cart","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-06-01T19:45:45Z","updated":"2026-07-10T17:14:15Z"},{"id":"wordfence:7363b5de-db30-4b35-b701-5c8f2835ec6c","source":"wordfence","cve":"CVE-2025-1404","title":"Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7363b5de-db30-4b35-b701-5c8f2835ec6c?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2025-02-28T22:01:07Z","updated":"2025-03-01T11:22:48Z"},{"id":"wordfence:73643d45-9542-4372-a7a2-0a443819b8a2","source":"wordfence","cve":"CVE-2023-52146","title":"404 Solution <= 2.33.0 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73643d45-9542-4372-a7a2-0a443819b8a2?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.33.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7364f803-9808-4337-8922-2d7c88849361","source":"wordfence","cve":"CVE-2026-65525","title":"Civi Framework <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7364f803-9808-4337-8922-2d7c88849361?source=api-prod","affected":[{"type":"plugin","slug":"civi-framework","name":"Civi Framework","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:27:20Z"},{"id":"wordfence:7365d3ba-e983-464e-9a15-90195a08290a","source":"wordfence","cve":"CVE-2026-4079","title":"SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7365d3ba-e983-464e-9a15-90195a08290a?source=api-prod","affected":[{"type":"plugin","slug":"sql-chart-builder","name":"SQL Chart Builder","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T20:56:38Z"},{"id":"wordfence:736cb9a4-bd43-4aaa-a918-d15ca3ff4dbf","source":"wordfence","cve":"CVE-2021-25105","title":"Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/736cb9a4-bd43-4aaa-a918-d15ca3ff4dbf?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:736d08ca-3f65-4232-96a9-303bafbf3471","source":"wordfence","cve":"CVE-2023-25056","title":"Feed Them Social <= 3.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/736d08ca-3f65-4232-96a9-303bafbf3471?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:736e0010-f1fc-42c4-8173-b81c5c78e34e","source":"wordfence","cve":"CVE-2026-61963","title":"Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/736e0010-f1fc-42c4-8173-b81c5c78e34e?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.38","to_inclusive":true,"patched_in":"3.39"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:21:11Z"},{"id":"wordfence:736e51d4-da1d-4252-a10f-d89eb6a68de4","source":"wordfence","cve":"CVE-2021-25095","title":"IP2Location Country Blocker <= 2.26.4 - Subscriber+ Arbitrary Country Ban","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/736e51d4-da1d-4252-a10f-d89eb6a68de4?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.26.4","to_inclusive":true,"patched_in":"2.26.5"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7370e3c3-90e6-4698-88e7-baf56832528d","source":"wordfence","cve":"CVE-2012-3588","title":"Plugin: Newsletter <= 1.5 - Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7370e3c3-90e6-4698-88e7-baf56832528d?source=api-prod","affected":[{"type":"plugin","slug":"plugin-newsletter","name":"Plugin: Newsletter","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2012-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73720e67-79e5-4b4c-8720-e28ad718b2b3","source":"wordfence","cve":"CVE-2023-47693","title":"Ultimate Addons for Contact Form 7 <= 3.2.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73720e67-79e5-4b4c-8720-e28ad718b2b3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7374db91-4e7d-4db2-9c58-bb9bdda5c85d","source":"wordfence","cve":"CVE-2025-14943","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7374db91-4e7d-4db2-9c58-bb9bdda5c85d?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.7.2","to_inclusive":true,"patched_in":"8.7.3"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T06:32:34Z"},{"id":"wordfence:73776e0a-4d2a-44f9-97a2-f06055ce2c63","source":"wordfence","cve":"CVE-2014-4663","title":"TimThumb <= 2.8.13 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73776e0a-4d2a-44f9-97a2-f06055ce2c63?source=api-prod","affected":[{"type":"plugin","slug":"wordthumb","name":"WordThumb","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"user-avatar","name":"User Avatar","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"timthumb","name":"TimThumb","from":"*","from_inclusive":true,"to":"2.8.13","to_inclusive":true,"patched_in":""}],"published":"2014-07-04T00:00:00Z","updated":"2025-01-29T21:30:12Z"},{"id":"wordfence:737aa726-b0df-47ac-aad1-0acf4bb1abdb","source":"wordfence","cve":"CVE-2024-54310","title":"Gou Manage My Account Menu <= 1.0.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/737aa726-b0df-47ac-aad1-0acf4bb1abdb?source=api-prod","affected":[{"type":"plugin","slug":"gou-wc-account-tabs","name":"Gou Manage My Account Menu \u2013 User Roles","from":"*","from_inclusive":true,"to":"1.0.1.8","to_inclusive":true,"patched_in":"1.0.1.9"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:53:22Z"},{"id":"wordfence:737cc158-a18e-43ff-82c6-b33d090dc80b","source":"wordfence","cve":"CVE-2025-30595","title":"include-file <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/737cc158-a18e-43ff-82c6-b33d090dc80b?source=api-prod","affected":[{"type":"plugin","slug":"include-file","name":"include-file","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T21:01:02Z"},{"id":"wordfence:737e3b2c-ee39-476a-b928-e496e7aeb5fe","source":"wordfence","cve":"CVE-2026-28162","title":"Events Made Easy <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/737e3b2c-ee39-476a-b928-e496e7aeb5fe?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:16:35Z"},{"id":"wordfence:73809551-b925-4789-b059-b9e60743f693","source":"wordfence","cve":"CVE-2026-59558","title":"Booking Calendar <= 11.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73809551-b925-4789-b059-b9e60743f693?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.4.2","to_inclusive":true,"patched_in":"11.4.3"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:20:54Z"},{"id":"wordfence:73835cfc-4c10-40d5-8df2-903d907326d4","source":"wordfence","cve":"CVE-2026-10580","title":"Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73835cfc-4c10-40d5-8df2-903d907326d4?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2026-06-05T05:47:24Z","updated":"2026-06-18T13:33:46Z"},{"id":"wordfence:73837bb4-8af9-4455-93dc-522d64258014","source":"wordfence","cve":"CVE-2024-49247","title":"BuddyPress Better Registration <= 1.6 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73837bb4-8af9-4455-93dc-522d64258014?source=api-prod","affected":[{"type":"plugin","slug":"better-bp-registration","name":"BuddyPress Better Registration","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:31:55Z"},{"id":"wordfence:7385e053-4741-4884-8ccb-2c0b6f3a40d8","source":"wordfence","cve":"CVE-2025-31010","title":"SimplyRETS Real Estate IDX <= 3.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7385e053-4741-4884-8ccb-2c0b6f3a40d8?source=api-prod","affected":[{"type":"plugin","slug":"simply-rets","name":"SimplyRETS Real Estate IDX","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-10-30T14:52:31Z"},{"id":"wordfence:73878d57-dd94-41d7-a26a-47c8e6eac0fd","source":"wordfence","cve":"CVE-2013-3477","title":"Related Posts by Zemanta <= 1.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73878d57-dd94-41d7-a26a-47c8e6eac0fd?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-by-zemanta","name":"Related Posts by Zemanta","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2013-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73897594-d25c-410e-81b1-70b6a8136aee","source":"wordfence","cve":"CVE-2025-60100","title":"XStore < 9.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73897594-d25c-410e-81b1-70b6a8136aee?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":false,"patched_in":"9.6"}],"published":"2025-09-26T00:00:00Z","updated":"2026-03-17T21:27:06Z"},{"id":"wordfence:738a9651-974e-4861-be7a-2d9b191d582b","source":"wordfence","cve":"CVE-2018-0576","title":"Events Manager <= 5.8.1.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738a9651-974e-4861-be7a-2d9b191d582b?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":false,"patched_in":"5.9"}],"published":"2018-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:738ad4c2-614a-4b60-b066-14d92ce25276","source":"wordfence","cve":"CVE-2025-49511","title":"Civi Framework <= 2.1.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738ad4c2-614a-4b60-b066-14d92ce25276?source=api-prod","affected":[{"type":"plugin","slug":"civi-framework","name":"Civi Framework","from":"*","from_inclusive":true,"to":"2.1.6.3","to_inclusive":true,"patched_in":"2.1.6.4"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T14:55:10Z"},{"id":"wordfence:738c6c77-97ef-4e47-9f14-9b73ea425bc2","source":"wordfence","cve":"CVE-2019-25140","title":"Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738c6c77-97ef-4e47-9f14-9b73ea425bc2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon","name":"Coming Soon Page & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2019-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:738d266b-4bd4-4c0e-aac4-ef0ffeb33c45","source":"wordfence","cve":"CVE-2026-32354","title":"WpEvently < 5.1.9 - Unauthenticated Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738d266b-4bd4-4c0e-aac4-ef0ffeb33c45?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":false,"patched_in":"5.1.9"}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-05T14:19:36Z"},{"id":"wordfence:738e5946-65e4-4403-bb23-f84910289a45","source":"wordfence","cve":"CVE-2020-13700","title":"ACF to REST API <= 3.2.0 - Insecure direct object reference via permalinks manipulation","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738e5946-65e4-4403-bb23-f84910289a45?source=api-prod","affected":[{"type":"plugin","slug":"acf-to-rest-api","name":"ACF to REST API","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2020-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:738eb021-1166-4fbe-a502-2db12c6533c3","source":"wordfence","cve":"CVE-2024-30494","title":"OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738eb021-1166-4fbe-a502-2db12c6533c3?source=api-prod","affected":[{"type":"plugin","slug":"oss-aliyun","name":"OSS Aliyun","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:01:40Z"},{"id":"wordfence:738f2929-afe9-4ffd-a6db-394e8c87e24e","source":"wordfence","cve":"CVE-2026-78264","title":"Toolset Blocks <= 1.6.26 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/738f2929-afe9-4ffd-a6db-394e8c87e24e?source=api-prod","affected":[{"type":"plugin","slug":"toolset-blocks","name":"Toolset Blocks","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.27"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:51:16Z"},{"id":"wordfence:73913fc5-aee4-4613-9bd6-76e091227c2c","source":"wordfence","cve":"CVE-2025-22709","title":"Verge3D <= 4.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73913fc5-aee4-4613-9bd6-76e091227c2c?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T20:37:00Z"},{"id":"wordfence:7391dd8c-0170-48c6-8451-9e7a00e268d0","source":"wordfence","cve":"CVE-2023-44983","title":"Aruba HiSpeed Cache <= 2.0.6 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7391dd8c-0170-48c6-8451-9e7a00e268d0?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7392c960-ee4a-477c-92ee-1e3aca6828d8","source":"wordfence","cve":"CVE-2025-60203","title":"Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7392c960-ee4a-477c-92ee-1e3aca6828d8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-07-15T00:00:00Z","updated":"2025-11-20T19:47:28Z"},{"id":"wordfence:7392fcb8-f125-4a1e-bb33-5614aeacb4cc","source":"wordfence","cve":"CVE-2015-9408","title":"xPinner Lite <= 2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7392fcb8-f125-4a1e-bb33-5614aeacb4cc?source=api-prod","affected":[{"type":"plugin","slug":"xpinner-lite","name":"xPinner Lite","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2015-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7394be7e-9a1f-4c85-ac2d-cace39def330","source":"wordfence","cve":"CVE-2024-24719","title":"Location Picker at Checkout for WooCommerce <= 1.8.9 - Missing Authorization via checkout_map_rules_order_ajax_handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7394be7e-9a1f-4c85-ac2d-cace39def330?source=api-prod","affected":[{"type":"plugin","slug":"map-location-picker-at-checkout-for-woocommerce","name":"Kikote \u2013 Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T17:59:11Z"},{"id":"wordfence:7394f468-b1d6-477e-9213-e01c74e2e504","source":"wordfence","cve":"CVE-2024-2578","title":"WP Coder <= 3.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7394f468-b1d6-477e-9213-e01c74e2e504?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T15:04:29Z"},{"id":"wordfence:7397898c-8d43-4399-9c2b-22f9287aa12d","source":"wordfence","cve":"CVE-2023-1069","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7397898c-8d43-4399-9c2b-22f9287aa12d?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"},{"type":"plugin","slug":"complianz-gdpr-premium","name":"Complianz - GDPR/CCPA Cookie Consent (Premium)","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7397c95e-9aba-4d89-9c18-184480efccd1","source":"wordfence","cve":"CVE-2026-77018","title":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7397c95e-9aba-4d89-9c18-184480efccd1?source=api-prod","affected":[{"type":"plugin","slug":"workeera-remote-tech-job-board","name":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS)","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:43:45Z"},{"id":"wordfence:73980a90-bb17-46e4-a0ea-691f80500fe3","source":"wordfence","cve":"CVE-2023-6164","title":"MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection","severity":"low","cvss":2.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73980a90-bb17-46e4-a0ea-691f80500fe3?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"4.5.1.2","to_inclusive":true,"patched_in":"4.5.1.3"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73986641-b3a4-438d-90ae-6ff0f6f73f01","source":"wordfence","cve":"CVE-2023-26518","title":"WP TFeed <= 1.6.9 - Cross-Site Request Forgery via aptf_delete_cache","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73986641-b3a4-438d-90ae-6ff0f6f73f01?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-twitter-feed","name":"WP TFeed","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7399f8f3-70ee-44ed-b8c8-211ae22aa86b","source":"wordfence","cve":"CVE-2025-10019","title":"Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7399f8f3-70ee-44ed-b8c8-211ae22aa86b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.60","to_inclusive":true,"patched_in":"1.3.61"}],"published":"2025-12-01T00:00:00Z","updated":"2026-01-07T14:26:34Z"},{"id":"wordfence:739abe9a-bcc2-4014-8441-38b326802a70","source":"wordfence","cve":"CVE-2025-24581","title":"Instantio <= 3.3.7 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/739abe9a-bcc2-4014-8441-38b326802a70?source=api-prod","affected":[{"type":"plugin","slug":"instantio","name":"Instantio \u2014 Side Cart & One-Page Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2024-12-18T00:00:00Z","updated":"2025-04-22T21:21:24Z"},{"id":"wordfence:739b57d9-8066-4c2a-9419-f6cd9409433c","source":"wordfence","cve":"CVE-2026-76009","title":"Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/739b57d9-8066-4c2a-9419-f6cd9409433c?source=api-prod","affected":[{"type":"plugin","slug":"nextcart-woocommerce-migration","name":"Next-Cart Store to WooCommerce Migration","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-09-08T17:22:58Z","updated":"2026-09-09T05:31:04Z"},{"id":"wordfence:739cfb80-da3d-41c8-a299-fd3f0168fb8d","source":"wordfence","cve":"CVE-2026-13157","title":"Theme Demo Import <= 1.1.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/739cfb80-da3d-41c8-a299-fd3f0168fb8d?source=api-prod","affected":[{"type":"plugin","slug":"theme-demo-import","name":"Theme Demo Import","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-14T12:40:53Z"},{"id":"wordfence:73a049de-f4b2-4b87-a78b-62cd333853b8","source":"wordfence","cve":"CVE-2015-3302","title":"TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a049de-f4b2-4b87-a78b-62cd333853b8?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":""}],"published":"2015-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73a0d7a9-374b-430d-a7e5-3c7cdaff5785","source":"wordfence","cve":"CVE-2024-43311","title":"Login As Users <= 1.4.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a0d7a9-374b-430d-a7e5-3c7cdaff5785?source=api-prod","affected":[{"type":"plugin","slug":"login-as-users","name":"Login As Users","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:38:59Z"},{"id":"wordfence:73a1174d-fb5a-4cc0-ada0-dbf1e011619a","source":"wordfence","cve":"CVE-2022-4307","title":"Pardakht Delkhah <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a1174d-fb5a-4cc0-ada0-dbf1e011619a?source=api-prod","affected":[{"type":"plugin","slug":"pardakht-delkhah","name":"\u067e\u0644\u0627\u06af\u06cc\u0646 \u067e\u0631\u062f\u0627\u062e\u062a \u062f\u0644\u062e\u0648\u0627\u0647","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73a15b12-20d5-4448-b69c-9a577ff907b9","source":"wordfence","cve":"CVE-2013-7475","title":"Contact Form by BestWebSoft <= 3.51 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a15b12-20d5-4448-b69c-9a577ff907b9?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.51","to_inclusive":true,"patched_in":"3.52"}],"published":"2013-08-13T00:00:00Z","updated":"2024-02-06T01:23:16Z"},{"id":"wordfence:73a25208-81fe-4337-a344-1c129bd80862","source":"wordfence","cve":"CVE-2024-9656","title":"Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a25208-81fe-4337-a344-1c129bd80862?source=api-prod","affected":[{"type":"plugin","slug":"mynx-page-builder","name":"Mynx Page Builder","from":"*","from_inclusive":true,"to":"0.27.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-11T16:35:56Z","updated":"2024-10-12T05:39:41Z"},{"id":"wordfence:73a5058c-74e2-419d-8034-d742cb8816ac","source":"wordfence","cve":"CVE-2026-16297","title":"Clearfy <= 2.4.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a5058c-74e2-419d-8034-d742cb8816ac?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:40:46Z"},{"id":"wordfence:73a6c292-b598-497c-b42c-a1261f888621","source":"wordfence","cve":"CVE-2026-100515","title":"Photo Reviews for WooCommerce <= 1.2.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a6c292-b598-497c-b42c-a1261f888621?source=api-prod","affected":[{"type":"plugin","slug":"woo-photo-reviews","name":"Revopic \u2013 Photo Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.30","to_inclusive":true,"patched_in":"1.2.31"}],"published":"2026-10-03T17:37:49Z","updated":"2026-10-08T23:09:15Z"},{"id":"wordfence:73a82b69-0bd2-4b47-b27f-067875071cb8","source":"wordfence","cve":"CVE-2025-31543","title":"Twice Commerce <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a82b69-0bd2-4b47-b27f-067875071cb8?source=api-prod","affected":[{"type":"plugin","slug":"embed-rentle","name":"Twice Commerce \u2013 Easy Rental Booking System","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-03-31T00:00:00Z","updated":"2025-05-16T14:22:16Z"},{"id":"wordfence:73a83f2b-835b-44cd-9d09-1b4fba3e9c8b","source":"wordfence","cve":"CVE-2022-1916","title":"Active Products Tables for WooCommerce <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a83f2b-835b-44cd-9d09-1b4fba3e9c8b?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73a91a9e-5209-4da5-b6f4-f412fd7fb5c4","source":"wordfence","cve":"CVE-2026-65556","title":"WPBruiser {no- Captcha anti-Spam} <= 3.1.43 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a91a9e-5209-4da5-b6f4-f412fd7fb5c4?source=api-prod","affected":[{"type":"plugin","slug":"goodbye-captcha","name":"WPBruiser Security \u2013 No CAPTCHA Anti-Spam & Login Protection","from":"*","from_inclusive":true,"to":"3.1.43","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-10-22T14:09:25Z"},{"id":"wordfence:73a9580c-d8fd-4720-8ea7-3308dc71b4d4","source":"wordfence","cve":"CVE-2026-39435","title":"cformsII <= 15.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73a9580c-d8fd-4720-8ea7-3308dc71b4d4?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.1.3","to_inclusive":true,"patched_in":"15.1.4"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:39:21Z"},{"id":"wordfence:73aa7b26-dbdf-4859-8fb9-f71dc734bb87","source":"wordfence","cve":"CVE-2012-5853","title":"Cardoza AJAX Search < 1.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73aa7b26-dbdf-4859-8fb9-f71dc734bb87?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-ajax-search","name":"Cardoza AJAX Search","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2012-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73aad911-531b-4118-9d39-27cbae75db01","source":"wordfence","cve":"CVE-2024-12454","title":"Affiliate Program Suite \u2014 SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73aad911-531b-4118-9d39-27cbae75db01?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.24"}],"published":"2024-12-17T21:10:02Z","updated":"2024-12-18T09:22:40Z"},{"id":"wordfence:73ab9f95-05cc-47fc-bfcb-1787f6f80789","source":"wordfence","cve":"CVE-2023-3392","title":"Read More & Accordion <= 3.2.6.1 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ab9f95-05cc-47fc-bfcb-1787f6f80789?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.2.6.1","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73ad8840-b60f-4a92-b1c9-0996f78ab6b4","source":"wordfence","cve":"CVE-2024-10782","title":"Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ad8840-b60f-4a92-b1c9-0996f78ab6b4?source=api-prod","affected":[{"type":"plugin","slug":"theme-builder-for-elementor","name":"Theme Builder For Elementor & Starter Templates","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T05:33:49Z"},{"id":"wordfence:73aebd68-4f36-4999-844c-f09b10462ef8","source":"wordfence","cve":"CVE-2023-0154","title":"GamiPress \u2013 Vimeo integration <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73aebd68-4f36-4999-844c-f09b10462ef8?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-vimeo-integration","name":"GamiPress \u2013 Vimeo integration","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73af1648-5248-45e4-8663-79595a70528a","source":"wordfence","cve":"CVE-2025-69096","title":"Zorka \u2013 Wonderful Fashion WooCommerce Theme <= 1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73af1648-5248-45e4-8663-79595a70528a?source=api-prod","affected":[{"type":"theme","slug":"zorka","name":"Zorka \u2013 Wonderful Fashion WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-12T16:11:43Z"},{"id":"wordfence:73b2d6bb-8e98-42f5-8435-7f0cc8be7d7e","source":"wordfence","cve":"CVE-2026-73998","title":"WP w3all phpBB <= 3.0.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b2d6bb-8e98-42f5-8435-7f0cc8be7d7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:07:40Z"},{"id":"wordfence:73b4e081-caa8-4055-91e2-11979df20159","source":"wordfence","cve":"CVE-2026-39524","title":"Masteriyo LMS \u2013 Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b4e081-caa8-4055-91e2-11979df20159?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:03:58Z"},{"id":"wordfence:73b4e5a2-bf75-4df9-a816-2cc858947c39","source":"wordfence","cve":"CVE-2026-1943","title":"YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b4e5a2-bf75-4df9-a816-2cc858947c39?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-02-17T18:44:08Z","updated":"2026-02-18T07:25:41Z"},{"id":"wordfence:73b55486-adb8-40c6-9113-c98618d9cb00","source":"wordfence","cve":"CVE-2026-1042","title":"WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b55486-adb8-40c6-9113-c98618d9cb00?source=api-prod","affected":[{"type":"plugin","slug":"wp-hello-bar","name":"WP Hello Bar","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""}],"published":"2026-01-19T17:06:39Z","updated":"2026-01-20T05:30:18Z"},{"id":"wordfence:73b6b22a-4699-4307-8a03-148dd9e95d36","source":"wordfence","cve":"CVE-2024-7780","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b6b22a-4699-4307-8a03-148dd9e95d36?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"2.0","from_inclusive":true,"to":"2.13.9","to_inclusive":true,"patched_in":"2.13.10"}],"published":"2024-08-19T15:01:49Z","updated":"2024-08-20T03:21:10Z"},{"id":"wordfence:73b78d92-5a91-4db7-ab8b-0867e4464516","source":"wordfence","cve":"CVE-2025-32633","title":"Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b78d92-5a91-4db7-ab8b-0867e4464516?source=api-prod","affected":[{"type":"plugin","slug":"database-toolset","name":"Database Toolset","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T12:53:10Z"},{"id":"wordfence:73b93a44-1d91-4755-ae48-73f74a6fe415","source":"wordfence","cve":"CVE-2021-24486","title":"Simple Social Media Share Buttons <= 3.2.2 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b93a44-1d91-4755-ae48-73f74a6fe415?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73b99342-65ca-4f63-b1ea-638255821265","source":"wordfence","cve":"CVE-2024-31421","title":"Popup by Supsystic <= 1.10.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73b99342-65ca-4f63-b1ea-638255821265?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.27","to_inclusive":true,"patched_in":"1.10.28"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:30:00Z"},{"id":"wordfence:73bece33-1fdf-4b43-95de-35e455763d03","source":"wordfence","cve":"CVE-2025-60053","title":"MaxCube <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73bece33-1fdf-4b43-95de-35e455763d03?source=api-prod","affected":[{"type":"theme","slug":"maxcube","name":"MaxCube | Moving & Self Storage Relocation Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:39:29Z"},{"id":"wordfence:73c01967-262c-48ab-a464-401b1cadd4be","source":"wordfence","cve":"CVE-2024-12494","title":"BMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73c01967-262c-48ab-a464-401b1cadd4be?source=api-prod","affected":[{"type":"plugin","slug":"bmlt-meeting-map","name":"BMLT Meeting Map","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-23T21:18:19Z","updated":"2025-01-24T09:21:52Z"},{"id":"wordfence:73c3dfc7-58de-4b24-ad91-0f8040d1f75e","source":"wordfence","cve":"CVE-2021-36910","title":"WP-Appbox <= 4.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73c3dfc7-58de-4b24-ad91-0f8040d1f75e?source=api-prod","affected":[{"type":"plugin","slug":"wp-appbox","name":"WP-Appbox","from":"*","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"4.3.21"}],"published":"2022-04-05T09:55:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73c6522a-cb95-4037-92e9-3dca0f52f538","source":"wordfence","cve":"CVE-2024-39678","title":"Cooked \u2013 Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery via cooked_get_recipe_ids","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73c6522a-cb95-4037-92e9-3dca0f52f538?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-09T14:01:14Z"},{"id":"wordfence:73c8267c-8c03-4ee6-9d3e-e383188b82ad","source":"wordfence","cve":"CVE-2026-96650","title":"Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73c8267c-8c03-4ee6-9d3e-e383188b82ad?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":"3.3.12"}],"published":"2026-10-02T17:06:53Z","updated":"2026-10-03T05:29:15Z"},{"id":"wordfence:73c98e25-98ae-48b8-9572-2d6a5dbbeb99","source":"wordfence","cve":"CVE-2025-58963","title":"Medcity < 1.1.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73c98e25-98ae-48b8-9572-2d6a5dbbeb99?source=api-prod","affected":[{"type":"theme","slug":"medcity","name":"Medcity - Health & Medical WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2025-09-17T00:00:00Z","updated":"2025-11-04T18:39:05Z"},{"id":"wordfence:73ca6a08-b01f-4df6-89ab-32b917c92236","source":"wordfence","cve":"CVE-2024-32956","title":"RomethemeKit For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ca6a08-b01f-4df6-89ab-32b917c92236?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:39:43Z"},{"id":"wordfence:73cbb65e-b4e3-4374-9916-9a3d1be5a014","source":"wordfence","cve":"CVE-2024-5889","title":"Events Manager <= 6.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73cbb65e-b4e3-4374-9916-9a3d1be5a014?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.4.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T04:33:30Z"},{"id":"wordfence:73d188a5-97b4-4f54-8cb4-f26481ddcb56","source":"wordfence","cve":"CVE-2026-42763","title":"SePay Gateway <= 1.1.20 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d188a5-97b4-4f54-8cb4-f26481ddcb56?source=api-prod","affected":[{"type":"plugin","slug":"sepay-gateway","name":"SePay Gateway","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:47:24Z"},{"id":"wordfence:73d3f73f-5407-4acf-ac65-1f7eadbaa58f","source":"wordfence","cve":"CVE-2021-24495","title":"Marmoset Viewer < 1.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d3f73f-5407-4acf-ac65-1f7eadbaa58f?source=api-prod","affected":[{"type":"plugin","slug":"marmoset-viewer","name":"Marmoset Viewer","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":false,"patched_in":"1.9.3"}],"published":"2021-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73d5df9f-98f7-4a47-a8e1-727cd60b29c7","source":"wordfence","cve":"CVE-2026-68568","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d5df9f-98f7-4a47-a8e1-727cd60b29c7?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.41","to_inclusive":true,"patched_in":"3.7.42"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:35:46Z"},{"id":"wordfence:73d6efc5-8f91-453a-8c84-4b373aaf4d7a","source":"wordfence","cve":"CVE-2025-22638","title":"Product Table For WooCommerce <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d6efc5-8f91-453a-8c84-4b373aaf4d7a?source=api-prod","affected":[{"type":"plugin","slug":"product-table-for-woocommerce","name":"Product Table For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:27:29Z"},{"id":"wordfence:73d8135e-7324-4830-bb73-184b627d4106","source":"wordfence","cve":"CVE-2025-48147","title":"CryptoCloud - Crypto Payment Gateway <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d8135e-7324-4830-bb73-184b627d4106?source=api-prod","affected":[{"type":"plugin","slug":"cryptocloud-crypto-payment-gateway","name":"CryptoCloud \u2013 Crypto Payment Gateway","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-05-22T00:00:00Z","updated":"2026-03-17T21:24:13Z"},{"id":"wordfence:73d89f61-e34a-493b-a856-63f1553f3000","source":"wordfence","cve":"CVE-2021-24982","title":"Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73d89f61-e34a-493b-a856-63f1553f3000?source=api-prod","affected":[{"type":"plugin","slug":"child-theme-generator","name":"Child Theme Generator","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2021-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73dba3da-03fb-4e3c-9318-c8762fdf2670","source":"wordfence","cve":"CVE-2026-101166","title":"Mollie Payments for WooCommerce < 8.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73dba3da-03fb-4e3c-9318-c8762fdf2670?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":false,"patched_in":"8.2.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:37:32Z"},{"id":"wordfence:73dd286e-5338-42d2-9928-1e14150ccf56","source":"wordfence","cve":"CVE-2023-49154","title":"Button Generator \u2013 easily Button Builder <= 2.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73dd286e-5338-42d2-9928-1e14150ccf56?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-24T14:09:25Z"},{"id":"wordfence:73ddf729-da69-4d0b-866f-34a92ec72800","source":"wordfence","cve":"CVE-2026-1608","title":"Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ddf729-da69-4d0b-866f-34a92ec72800?source=api-prod","affected":[{"type":"plugin","slug":"video-onclick","name":"Video Onclick","from":"*","from_inclusive":true,"to":"0.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:25:41Z","updated":"2026-02-07T08:26:38Z"},{"id":"wordfence:73de57bf-ca40-45f3-ab5c-021704436a23","source":"wordfence","cve":"CVE-2025-66119","title":"Hostel <= 1.1.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73de57bf-ca40-45f3-ab5c-021704436a23?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.9","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-19T16:54:36Z"},{"id":"wordfence:73de609d-f823-43b6-9406-61bb904ae3e9","source":"wordfence","cve":"CVE-2026-62005","title":"Muzicon - Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73de609d-f823-43b6-9406-61bb904ae3e9?source=api-prod","affected":[{"type":"theme","slug":"muzicon","name":"Muzicon - Music Festival & Concert WordPress Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:52Z"},{"id":"wordfence:73e19ad5-97a9-4c0d-a350-eb556bf20772","source":"wordfence","cve":"","title":"Direct Checkout for WooCommerce \u2013 Skip Cart with Buy Buttons <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73e19ad5-97a9-4c0d-a350-eb556bf20772?source=api-prod","affected":[{"type":"plugin","slug":"direct-checkout-for-woocommerce","name":"Direct Checkout for WooCommerce \u2013 Skip Cart with Buy Buttons","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73e2c5bd-c81d-48ee-a5fc-346dd820d0a4","source":"wordfence","cve":"CVE-2023-46614","title":"WP Helper Premium <= 4.5.1 - Cross-Site Request Forgery via whp_fields","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73e2c5bd-c81d-48ee-a5fc-346dd820d0a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73e4b097-a33b-47c4-8899-f14e2858a1d0","source":"wordfence","cve":"","title":"WP Easy Gallery <= 2.7 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73e4b097-a33b-47c4-8899-f14e2858a1d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73e4ec2f-f4e1-469d-a4b7-5a10d44b7a2f","source":"wordfence","cve":"CVE-2024-2788","title":"Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73e4ec2f-f4e1-469d-a4b7-5a10d44b7a2f?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-24T12:37:52Z"},{"id":"wordfence:73e51f52-70e9-4620-8c87-2a3982b98681","source":"wordfence","cve":"CVE-2025-30810","title":"Lead Form Data Collection to CRM <= 3.0.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73e51f52-70e9-4620-8c87-2a3982b98681?source=api-prod","affected":[{"type":"plugin","slug":"wp-leads-builder-any-crm","name":"Lead Form Data Collection to CRM","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:21:38Z"},{"id":"wordfence:73ea7672-4e3f-4a26-a59e-043c2cd10a7a","source":"wordfence","cve":"CVE-2023-52131","title":"Page Generator <= 1.7.1 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ea7672-4e3f-4a26-a59e-043c2cd10a7a?source=api-prod","affected":[{"type":"plugin","slug":"page-generator","name":"Bulk Page Generator and Mass Page Builder \u2013 Page Generator","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73ecfe84-dbe1-4e89-959b-e810d9a436f6","source":"wordfence","cve":"CVE-2026-109197","title":"WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73ecfe84-dbe1-4e89-959b-e810d9a436f6?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-10-30T20:54:23Z","updated":"2026-10-31T09:29:26Z"},{"id":"wordfence:73efd9ad-9515-4ca8-bfb3-1d478f39c2b9","source":"wordfence","cve":"CVE-2025-10134","title":"Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=api-prod","affected":[{"type":"theme","slug":"goza-theme","name":"Goza - Nonprofit Charity WordPress Theme","from":"3.2.2","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-07-14T15:24:20Z","updated":"2025-09-09T08:22:36Z"},{"id":"wordfence:73f0e8f0-88cd-4994-ad85-a0cf3e825a7b","source":"wordfence","cve":"CVE-2026-27329","title":"YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73f0e8f0-88cd-4994-ad85-a0cf3e825a7b?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":"4.13.0"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:43:14Z"},{"id":"wordfence:73f12f22-c0a4-4010-9634-ce7308254028","source":"wordfence","cve":"CVE-2022-0834","title":"Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73f12f22-c0a4-4010-9634-ce7308254028?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.47"}],"published":"2022-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73f28157-a613-487b-b7bc-da9a956080b8","source":"wordfence","cve":"CVE-2025-27297","title":"Bravo Search & Replace <= 1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73f28157-a613-487b-b7bc-da9a956080b8?source=api-prod","affected":[{"type":"plugin","slug":"bravo-search-and-replace","name":"Bravo Search & Replace","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:38:46Z"},{"id":"wordfence:73f37502-6e11-4fba-802f-9b15ea9064ab","source":"wordfence","cve":"CVE-2025-23991","title":"Product Size Charts Plugin for WooCommerce <= 2.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73f37502-6e11-4fba-802f-9b15ea9064ab?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-product-size-chart","name":"Product Size Charts Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-02-11T21:33:24Z"},{"id":"wordfence:73f7646f-f01f-4f57-836c-e0bd04764ba9","source":"wordfence","cve":"CVE-2025-3870","title":"1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73f7646f-f01f-4f57-836c-e0bd04764ba9?source=api-prod","affected":[{"type":"plugin","slug":"1-decembrie-1918","name":"1 Decembrie 1918","from":"*","from_inclusive":true,"to":"1.dec.2012","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T20:01:14Z","updated":"2025-04-25T08:22:13Z"},{"id":"wordfence:73fae3a0-6987-45bf-a20e-4ea9c6f73924","source":"wordfence","cve":"CVE-2017-18538","title":"WebLibrarian < 3.4.8.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73fae3a0-6987-45bf-a20e-4ea9c6f73924?source=api-prod","affected":[{"type":"plugin","slug":"weblibrarian","name":"WebLibrarian","from":"*","from_inclusive":true,"to":"3.4.8.5","to_inclusive":false,"patched_in":"3.4.8.5"}],"published":"2017-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73fb7102-66ff-4309-a98f-bbbfd3ddbba6","source":"wordfence","cve":"CVE-2026-4327","title":"The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=api-prod","affected":[{"type":"plugin","slug":"the-welcomizer","name":"The Welcomizer","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"999.0"}],"published":"2026-09-18T19:27:36Z","updated":"2026-09-19T07:43:17Z"},{"id":"wordfence:73fca37e-c6cf-420c-b984-3ef89acf3216","source":"wordfence","cve":"CVE-2023-39157","title":"JetElements <= 2.6.10 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73fca37e-c6cf-420c-b984-3ef89acf3216?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.10","to_inclusive":true,"patched_in":"2.6.11"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:73fd35b4-16b3-4f57-a3e4-46e4de0ee822","source":"wordfence","cve":"CVE-2022-3399","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73fd35b4-16b3-4f57-a3e4-46e4de0ee822?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.4.17.1","to_inclusive":true,"patched_in":"2.4.18"}],"published":"2024-08-15T00:00:00Z","updated":"2024-11-22T14:46:27Z"},{"id":"wordfence:73fe5da6-165d-454f-91d8-73d4cb90f5df","source":"wordfence","cve":"CVE-2025-23655","title":"Contact Form 7 \u2013 Paystack Add-on <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/73fe5da6-165d-454f-91d8-73d4cb90f5df?source=api-prod","affected":[{"type":"plugin","slug":"cf7-paystack-add-on","name":"Contact Form 7 \u2013 Paystack Add-on","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:37:35Z"},{"id":"wordfence:74042b84-eee4-474e-afde-b101ad5ce467","source":"wordfence","cve":"CVE-2025-54749","title":"JetProductGallery <= 2.2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74042b84-eee4-474e-afde-b101ad5ce467?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-product-gallery","name":"JetProductGallery","from":"*","from_inclusive":true,"to":"2.2.0.2","to_inclusive":true,"patched_in":"2.2.0.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T21:08:58Z"},{"id":"wordfence:740438a1-9bc3-42bc-aea6-aa9489132349","source":"wordfence","cve":"CVE-2026-27381","title":"Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/740438a1-9bc3-42bc-aea6-aa9489132349?source=api-prod","affected":[{"type":"theme","slug":"aora","name":"Aora - Home & Lifestyle Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T14:46:17Z"},{"id":"wordfence:74089b16-76fa-4654-9007-3f0c2e894894","source":"wordfence","cve":"CVE-2023-2599","title":"Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection","severity":"low","cvss":3.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74089b16-76fa-4654-9007-3f0c2e894894?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:740ed055-8548-42fd-81e1-9f63dda85374","source":"wordfence","cve":"CVE-2024-56061","title":"Computer Repair Shop <= 3.8119 - Authenticated (Customer+) Privilege Esclation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/740ed055-8548-42fd-81e1-9f63dda85374?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.8119","to_inclusive":true,"patched_in":"3.8120"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T16:18:23Z"},{"id":"wordfence:741028c9-6021-4522-b7e5-b31f0c3a9f10","source":"wordfence","cve":"CVE-2019-14470","title":"UserPro <= 4.9.34 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741028c9-6021-4522-b7e5-b31f0c3a9f10?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"4.9.34","to_inclusive":true,"patched_in":"4.9.35.1"}],"published":"2019-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:741065aa-15ec-4cea-a5f5-97e7ba756195","source":"wordfence","cve":"CVE-2026-93936","title":"iPharm - Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741065aa-15ec-4cea-a5f5-97e7ba756195?source=api-prod","affected":[{"type":"theme","slug":"ipharm","name":"iPharm - Online Pharmacy Woocommerce Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:48:39Z","updated":"2026-10-13T14:27:41Z"},{"id":"wordfence:741150a3-1b2a-4b54-9dd5-992d3d7079dc","source":"wordfence","cve":"CVE-2026-8625","title":"Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741150a3-1b2a-4b54-9dd5-992d3d7079dc?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.4.30","to_inclusive":true,"patched_in":"2.4.37"}],"published":"2026-09-04T16:54:13Z","updated":"2026-09-05T05:30:55Z"},{"id":"wordfence:74117559-c55a-4b1f-8b39-3a1852463cc0","source":"wordfence","cve":"CVE-2026-82519","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 - Missing Authorization to 2FA Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74117559-c55a-4b1f-8b39-3a1852463cc0?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.1","to_inclusive":true,"patched_in":"9.8.2"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-16T18:29:53Z"},{"id":"wordfence:7412030e-94ec-40d2-8cbc-d5df9a7f1c5b","source":"wordfence","cve":"CVE-2025-32655","title":"Restrict User Registration <= 1.0.1  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7412030e-94ec-40d2-8cbc-d5df9a7f1c5b?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-registration","name":"Restrict User Registration","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:21:41Z"},{"id":"wordfence:7414779e-7241-4ab2-9b1f-34c3e1acc66b","source":"wordfence","cve":"CVE-2023-40602","title":"Doofinder for WooCommerce <= 1.5.49 - Unauthenticated Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7414779e-7241-4ab2-9b1f-34c3e1acc66b?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"1.5.49","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:741582e9-e99a-4756-a817-d120135d77c9","source":"wordfence","cve":"CVE-2025-23469","title":"Sleekplan <= 0.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741582e9-e99a-4756-a817-d120135d77c9?source=api-prod","affected":[{"type":"plugin","slug":"sleekplan","name":"Sleekplan \u2013 User Feedback, Roadmap & Changelog","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2025-03-18T00:00:00Z","updated":"2026-08-14T15:13:22Z"},{"id":"wordfence:74160271-b27d-49fe-9550-e3949ecad048","source":"wordfence","cve":"CVE-2024-43209","title":"Bitly's WordPress Plugin <= 2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74160271-b27d-49fe-9550-e3949ecad048?source=api-prod","affected":[{"type":"plugin","slug":"wp-bitly","name":"Bitly's WordPress Plugin","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-11-04T21:44:09Z"},{"id":"wordfence:7416a3fc-e585-4298-acf9-9fdaf3b6cbff","source":"wordfence","cve":"CVE-2026-94161","title":"Grand Restaurant WordPress < 7.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7416a3fc-e585-4298-acf9-9fdaf3b6cbff?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0.11","to_inclusive":false,"patched_in":"7.0.11"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:31:30Z"},{"id":"wordfence:7416f5e2-5c59-4192-a87c-b3174fd84a01","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7416f5e2-5c59-4192-a87c-b3174fd84a01?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:14Z"},{"id":"wordfence:74172fcb-7428-464a-89f1-f1f3af50e361","source":"wordfence","cve":"CVE-2026-0862","title":"Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via options","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74172fcb-7428-464a-89f1-f1f3af50e361?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-01-24T02:47:36Z","updated":"2026-01-24T15:34:07Z"},{"id":"wordfence:741764b3-b147-416f-85b9-5dca994b4f18","source":"wordfence","cve":"CVE-2024-52467","title":"AI Responsive Gallery Album <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741764b3-b147-416f-85b9-5dca994b4f18?source=api-prod","affected":[{"type":"plugin","slug":"ai-responsive-gallery-album","name":"AI Responsive Gallery Album","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:55:32Z"},{"id":"wordfence:74184cfd-d3ce-4295-8c17-89e521139445","source":"wordfence","cve":"CVE-2026-66672","title":"Flatastic <= 2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74184cfd-d3ce-4295-8c17-89e521139445?source=api-prod","affected":[{"type":"plugin","slug":"flatastic","name":"Flatastic - Versatile MultiVendor WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:13:06Z"},{"id":"wordfence:741915a7-c88d-41e1-9347-1d5d6494d051","source":"wordfence","cve":"","title":"mTheme-Unus (All Versions) - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741915a7-c88d-41e1-9347-1d5d6494d051?source=api-prod","affected":[{"type":"theme","slug":"mTheme-Unus","name":"mTheme-Unus","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:741ad2f5-d5cf-44bc-ac4a-7894df77a3d1","source":"wordfence","cve":"","title":"Keep Backup Daily <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741ad2f5-d5cf-44bc-ac4a-7894df77a3d1?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:741c479a-520b-46d7-b145-ffa8e6382788","source":"wordfence","cve":"CVE-2024-35654","title":"Responsive <= 5.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741c479a-520b-46d7-b145-ffa8e6382788?source=api-prod","affected":[{"type":"theme","slug":"responsive","name":"Responsive","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.3.1"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T19:05:38Z"},{"id":"wordfence:741d5cb6-0119-45a7-81df-400103d75c42","source":"wordfence","cve":"CVE-2025-49937","title":"Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/741d5cb6-0119-45a7-81df-400103d75c42?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T16:24:31Z"},{"id":"wordfence:74204510-a573-49c9-af76-4c9a7dad394b","source":"wordfence","cve":"CVE-2026-32580","title":"WooCommerce Lottery <= 2.2.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74204510-a573-49c9-af76-4c9a7dad394b?source=api-prod","affected":[{"type":"plugin","slug":"wc-lottery","name":"WooCommerce Lottery","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:51:43Z"},{"id":"wordfence:74211733-142b-4071-b80c-f8beafe0ee4c","source":"wordfence","cve":"CVE-2025-26760","title":"Calculator Builder \u2013 Create an Online Calculator <= 1.6.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74211733-142b-4071-b80c-f8beafe0ee4c?source=api-prod","affected":[{"type":"plugin","slug":"calculator-builder","name":"Calculator Builder \u2013 Create an Online Calculator","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T20:17:10Z"},{"id":"wordfence:7422e7c6-fe0a-49be-ba9e-d14f66e328d0","source":"wordfence","cve":"CVE-2025-58226","title":"3D FlipBook \u2013 PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.16 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7422e7c6-fe0a-49be-ba9e-d14f66e328d0?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.16.16","to_inclusive":true,"patched_in":"1.16.17"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-14T14:16:30Z"},{"id":"wordfence:742acb6b-a799-4bb8-b4dc-f7359e7fdd4e","source":"wordfence","cve":"CVE-2020-12696","title":"iframe <= 4.4 - Authenticated Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/742acb6b-a799-4bb8-b4dc-f7359e7fdd4e?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2020-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:742d3b59-e533-4398-9c8c-4aa1e17129f6","source":"wordfence","cve":"CVE-2025-67947","title":"AdForest Elementor <= 3.0.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/742d3b59-e533-4398-9c8c-4aa1e17129f6?source=api-prod","affected":[{"type":"plugin","slug":"adforest-elementor","name":"AdForest Elementor","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:53:05Z"},{"id":"wordfence:7430594c-3a71-4b24-875b-014e03be868f","source":"wordfence","cve":"CVE-2026-15827","title":"GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7430594c-3a71-4b24-875b-014e03be868f?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2026-07-22T20:27:40Z","updated":"2026-07-23T08:34:39Z"},{"id":"wordfence:74315031-8498-4ae5-bcfc-ba22af4b58dc","source":"wordfence","cve":"CVE-2026-6171","title":"Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74315031-8498-4ae5-bcfc-ba22af4b58dc?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-29T19:33:56Z","updated":"2026-09-30T07:41:06Z"},{"id":"wordfence:7431ee0f-f485-48a4-9cdd-8fb2ac43e216","source":"wordfence","cve":"CVE-2023-0276","title":"Weaver Xtreme Theme Support <= 6.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7431ee0f-f485-48a4-9cdd-8fb2ac43e216?source=api-prod","affected":[{"type":"plugin","slug":"weaverx-theme-support","name":"Weaver Xtreme Theme Support","from":"*","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.2.7"}],"published":"2023-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:743788ed-bd40-4eb4-a27e-d4eb89df3a41","source":"wordfence","cve":"CVE-2026-5169","title":"Inquiry form to posts or pages <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Header Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743788ed-bd40-4eb4-a27e-d4eb89df3a41?source=api-prod","affected":[{"type":"plugin","slug":"inquiry-form-to-posts-or-pages","name":"Inquiry form to posts or pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:36:43Z","updated":"2026-04-08T06:43:39Z"},{"id":"wordfence:7438623e-690e-400c-a9ef-0a02eda0e494","source":"wordfence","cve":"CVE-2024-12714","title":"Backlink Monitoring Manager <= 0.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7438623e-690e-400c-a9ef-0a02eda0e494?source=api-prod","affected":[{"type":"plugin","slug":"backlink-monitoring-manager","name":"Backlink Monitoring Manager","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:28:33Z"},{"id":"wordfence:74386b2f-9686-4f55-be30-c02ea8fb12b0","source":"wordfence","cve":"CVE-2019-15872","title":"LoginPress <= 1.1.15 - Authenticated SQL Injection via Settings Import","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74386b2f-9686-4f55-be30-c02ea8fb12b0?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":false,"patched_in":"1.1.16"}],"published":"2018-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:743a52f4-8412-4fc6-a1f2-e21711394b75","source":"wordfence","cve":"CVE-2025-58648","title":"Simple JWT Login <= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743a52f4-8412-4fc6-a1f2-e21711394b75?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:26:01Z"},{"id":"wordfence:743d7370-cf33-481c-8d0a-c6f969e38b42","source":"wordfence","cve":"","title":"Email Before Download <= 3.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743d7370-cf33-481c-8d0a-c6f969e38b42?source=api-prod","affected":[{"type":"plugin","slug":"email-before-download","name":"Email Before Download","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2015-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:743de308-1152-40ad-8c77-bb9e222b9654","source":"wordfence","cve":"CVE-2026-49044","title":"Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743de308-1152-40ad-8c77-bb9e222b9654?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-font-awesome","name":"Advanced Custom Fields: Font Awesome Field","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:09:36Z"},{"id":"wordfence:743e40f6-dde3-4d8f-938e-b2a0dcdfb901","source":"wordfence","cve":"CVE-2023-51478","title":"Build App Online <= 1.0.21 - Authentication Bypass via Header","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743e40f6-dde3-4d8f-938e-b2a0dcdfb901?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2023-12-27T00:00:00Z","updated":"2024-08-15T14:21:58Z"},{"id":"wordfence:743f6e8b-4694-4d6a-94db-093162ba94b3","source":"wordfence","cve":"CVE-2022-3359","title":"Shortcodes and extra features for Phlox theme <= 2.10.5 - PHP Objection Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/743f6e8b-4694-4d6a-94db-093162ba94b3?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74403688-06a0-453f-ac44-bd731c389892","source":"wordfence","cve":"CVE-2022-46838","title":"JS Help Desk <= 2.7.1 - Missing Authorization to Plugin Settings Update","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74403688-06a0-453f-ac44-bd731c389892?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"2.7.1","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74428e76-1946-408f-8adc-24ab4b7e46c5","source":"wordfence","cve":"CVE-2025-3472","title":"Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74428e76-1946-408f-8adc-24ab4b7e46c5?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-22T11:12:30Z"},{"id":"wordfence:744310b2-ebe9-4dd5-8f18-6ba72c52dd61","source":"wordfence","cve":"CVE-2023-4289","title":"WP Matterport Shortcode <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/744310b2-ebe9-4dd5-8f18-6ba72c52dd61?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-gallery-for-matterport-showcase","name":"Matterport Shortcode","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:744354bc-3663-40bd-b799-589cb0978b40","source":"wordfence","cve":"CVE-2021-24583","title":"Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/744354bc-3663-40bd-b799-589cb0978b40?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7446bf86-81fa-4f89-8773-44b993ae2f7c","source":"wordfence","cve":"CVE-2024-38713","title":"WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7446bf86-81fa-4f89-8773-44b993ae2f7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.8.02.002","to_inclusive":true,"patched_in":"8.8.02.003"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:35:52Z"},{"id":"wordfence:7447fc39-a517-4ba0-93d6-381a6eeb5b7b","source":"wordfence","cve":"CVE-2015-9537","title":"NextGen Gallery <= 2.1.9 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7447fc39-a517-4ba0-93d6-381a6eeb5b7b?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2015-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7448983b-47ad-4a71-84a8-ee1f96b3f6cb","source":"wordfence","cve":"CVE-2012-4268","title":"BulletProof Security < .47.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7448983b-47ad-4a71-84a8-ee1f96b3f6cb?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".47.1","to_inclusive":false,"patched_in":".47.1"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7448e2bd-07f2-49fe-b094-9d55ea7cbe35","source":"wordfence","cve":"CVE-2026-24368","title":"The Grid < 2.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7448e2bd-07f2-49fe-b094-9d55ea7cbe35?source=api-prod","affected":[{"type":"plugin","slug":"the-grid","name":"The Grid","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T16:43:43Z"},{"id":"wordfence:7449ed1e-cc09-4b8b-8226-7cdc70be2b36","source":"wordfence","cve":"CVE-2024-39642","title":"LearnPress <= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7449ed1e-cc09-4b8b-8226-7cdc70be2b36?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8.2","to_inclusive":true,"patched_in":"4.2.6.9"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:25:42Z"},{"id":"wordfence:744a902e-d4fd-4159-9e68-dbb167573793","source":"wordfence","cve":"CVE-2026-89327","title":"FluentBoards <= 2.0.14 - Authenticated (Board Member+) Comment Author Spoofing","severity":"medium","cvss":4.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/744a902e-d4fd-4159-9e68-dbb167573793?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T20:24:20Z"},{"id":"wordfence:74506798-a198-4ea8-8628-01ce4df27abe","source":"wordfence","cve":"CVE-2024-8031","title":"Secure Downloads <= 1.2.2 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74506798-a198-4ea8-8628-01ce4df27abe?source=api-prod","affected":[{"type":"plugin","slug":"secure-downloads","name":"Secure Downloads","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-12T14:04:10Z"},{"id":"wordfence:745262f6-4f73-453e-b650-15115536f221","source":"wordfence","cve":"CVE-2024-6588","title":"PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745262f6-4f73-453e-b650-15115536f221?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.9.10","to_inclusive":true,"patched_in":"11.9.11"}],"published":"2024-07-11T17:50:34Z","updated":"2024-07-12T06:50:30Z"},{"id":"wordfence:7454dc72-744e-411b-b9f9-12a3846ecdd5","source":"wordfence","cve":"CVE-2026-105872","title":"Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7454dc72-744e-411b-b9f9-12a3846ecdd5?source=api-prod","affected":[{"type":"plugin","slug":"product-configurator-for-woocommerce","name":"MKL Product Configurator for WooCommerce \u2013 2D & 3D Live Preview","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:25:58Z"},{"id":"wordfence:74551e01-063c-4493-8472-9c0903ac17c5","source":"wordfence","cve":"CVE-2025-4590","title":"Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74551e01-063c-4493-8472-9c0903ac17c5?source=api-prod","affected":[{"type":"plugin","slug":"daisycon","name":"Daisycon prijsvergelijkers","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-05-30T18:09:32Z","updated":"2025-07-25T19:23:29Z"},{"id":"wordfence:7455901f-ca0b-4b55-811e-76685fe7fd63","source":"wordfence","cve":"CVE-2024-10472","title":"Stylish Price List <= 7.1.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7455901f-ca0b-4b55-811e-76685fe7fd63?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"7.1.11","to_inclusive":true,"patched_in":"7.1.12"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:08:00Z"},{"id":"wordfence:7456ce70-dfa1-46b4-af9e-8185c4f7e5f8","source":"wordfence","cve":"","title":"Image Gallery - Responsive Photo Gallery <= 1.9.57 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7456ce70-dfa1-46b4-af9e-8185c4f7e5f8?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.9.57","to_inclusive":true,"patched_in":"1.9.58"}],"published":"2016-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:745709f4-bb9c-41c4-ab60-d9fc18e406a8","source":"wordfence","cve":"CVE-2024-2457","title":"Modal Window \u2013 create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745709f4-bb9c-41c4-ab60-d9fc18e406a8?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-03-20T00:00:00Z","updated":"2024-05-31T15:30:26Z"},{"id":"wordfence:745bd805-7b18-4633-ad5f-94d3a00e0807","source":"wordfence","cve":"CVE-2026-24595","title":"Zoho CRM Lead Magnet <= 1.8.1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745bd805-7b18-4633-ad5f-94d3a00e0807?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.8.1.9","to_inclusive":true,"patched_in":"1.8.2.0"}],"published":"2026-01-15T00:00:00Z","updated":"2026-06-08T16:13:21Z"},{"id":"wordfence:745c1501-a148-47ff-adb3-a6af06357bf4","source":"wordfence","cve":"CVE-2024-51570","title":"Easy Gallery <= 1.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745c1501-a148-47ff-adb3-a6af06357bf4?source=api-prod","affected":[{"type":"plugin","slug":"simple-gallery-odihost","name":"Easy Gallery","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:40:33Z"},{"id":"wordfence:745cf98c-ad3a-4ec9-9ee8-ae817d5d7358","source":"wordfence","cve":"CVE-2023-32505","title":"Easy Hide Login <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745cf98c-ad3a-4ec9-9ee8-ae817d5d7358?source=api-prod","affected":[{"type":"plugin","slug":"easy-hide-login","name":"Easy Hide Login","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:745da770-dd78-4ffb-ae15-4b90682911e3","source":"wordfence","cve":"CVE-2025-9852","title":"Yoga Schedule Momoyoga <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745da770-dd78-4ffb-ae15-4b90682911e3?source=api-prod","affected":[{"type":"plugin","slug":"momoyoga-integration","name":"Yoga Schedule Momoyoga","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-09-29T15:30:54Z","updated":"2025-10-21T20:58:05Z"},{"id":"wordfence:745da883-c9f2-438c-8a22-bd3d1a729424","source":"wordfence","cve":"CVE-2025-22787","title":"Button Block <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745da883-c9f2-438c-8a22-bd3d1a729424?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-21T16:09:02Z"},{"id":"wordfence:745dcc4c-1c52-4ac7-9ac6-033770282a3b","source":"wordfence","cve":"CVE-2025-14985","title":"Alpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/745dcc4c-1c52-4ac7-9ac6-033770282a3b?source=api-prod","affected":[{"type":"plugin","slug":"alpha-blocks","name":"Alpha Blocks","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:21:56Z","updated":"2026-06-02T10:36:12Z"},{"id":"wordfence:746265fa-151b-4ea8-8871-8828b878da62","source":"wordfence","cve":"CVE-2025-27008","title":"Unlimited Timeline < 1.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746265fa-151b-4ea8-8871-8828b878da62?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-timeline","name":"Unlimited Timeline","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:21:43Z"},{"id":"wordfence:746385e0-6bb9-47f2-a3e7-72f8e28be731","source":"wordfence","cve":"CVE-2024-2186","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746385e0-6bb9-47f2-a3e7-72f8e28be731?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:58:57Z"},{"id":"wordfence:746b77c9-64f8-43e8-9c2a-ce6bc35fd24c","source":"wordfence","cve":"CVE-2024-6579","title":"Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746b77c9-64f8-43e8-9c2a-ce6bc35fd24c?source=api-prod","affected":[{"type":"plugin","slug":"vc-addons-by-bit14","name":"Web and WooCommerce Addons for WPBakery Builder","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-07-15T21:28:57Z","updated":"2024-07-16T09:32:12Z"},{"id":"wordfence:746b9ecc-49c1-4f6e-9f86-4147c98fe325","source":"wordfence","cve":"CVE-2021-24955","title":"ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746b9ecc-49c1-4f6e-9f86-4147c98fe325?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:746bf178-5e1b-4f1a-8072-d0c1be005f88","source":"wordfence","cve":"CVE-2024-53725","title":"Post Hits Counter <= 2.8.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746bf178-5e1b-4f1a-8072-d0c1be005f88?source=api-prod","affected":[{"type":"plugin","slug":"hits-counter","name":"Post Hits Counter","from":"*","from_inclusive":true,"to":"2.8.23","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-12-12T18:44:50Z"},{"id":"wordfence:746e47f2-3fe3-439c-bd54-a9bba9c86271","source":"wordfence","cve":"CVE-2025-2078","title":"BlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746e47f2-3fe3-439c-bd54-a9bba9c86271?source=api-prod","affected":[{"type":"plugin","slug":"blogbuzztime-for-wp","name":"BlogBuzzTime for WP","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T14:23:27Z","updated":"2025-03-12T03:21:28Z"},{"id":"wordfence:746ed5d5-983f-40b1-b12b-f7cbe231597c","source":"wordfence","cve":"CVE-2026-52716","title":"Workscout Core <= 1.7.11 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746ed5d5-983f-40b1-b12b-f7cbe231597c?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.7.11","to_inclusive":true,"patched_in":"1.7.12"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-25T17:16:29Z"},{"id":"wordfence:746eec41-e8d2-4c51-b63e-726eeadbb2ab","source":"wordfence","cve":"CVE-2026-15267","title":"Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/746eec41-e8d2-4c51-b63e-726eeadbb2ab?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-07-27T20:21:03Z","updated":"2026-07-28T08:34:36Z"},{"id":"wordfence:74732912-979a-41e6-95de-e34b1847f8d3","source":"wordfence","cve":"CVE-2025-26562","title":"RSS Filter <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74732912-979a-41e6-95de-e34b1847f8d3?source=api-prod","affected":[{"type":"plugin","slug":"rss-filter","name":"RSS Filter","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:38:28Z"},{"id":"wordfence:7474639a-5afa-4c67-8524-9b019528ba55","source":"wordfence","cve":"CVE-2026-87777","title":"Hostinger Reach 1.0.6 - 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7474639a-5afa-4c67-8524-9b019528ba55?source=api-prod","affected":[{"type":"plugin","slug":"hostinger-reach","name":"Hostinger Reach \u2013 AI-Powered Email Marketing for WordPress","from":"1.0.6","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:58:50Z"},{"id":"wordfence:7477ecd2-904b-4c1a-bc77-5d99ec207310","source":"wordfence","cve":"CVE-2025-31531","title":"History Log by click5 <= 1.0.13 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7477ecd2-904b-4c1a-bc77-5d99ec207310?source=api-prod","affected":[{"type":"plugin","slug":"history-log-by-click5","name":"History Log by click5","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-03-31T00:00:00Z","updated":"2026-11-10T23:17:14Z"},{"id":"wordfence:747a3efc-c0fb-4b3c-bc17-7b6306b17d4f","source":"wordfence","cve":"CVE-2025-39390","title":"Booking and Rental Manager <= 2.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/747a3efc-c0fb-4b3c-bc17-7b6306b17d4f?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-04-18T00:00:00Z","updated":"2025-05-09T13:17:51Z"},{"id":"wordfence:747afa58-182a-4fb3-bfe3-f15db0b1d85a","source":"wordfence","cve":"","title":"WP SMS <= 6.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/747afa58-182a-4fb3-bfe3-f15db0b1d85a?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":false,"patched_in":"6.2.0"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:747c86f4-118b-4a9c-899c-e9067d2c7a02","source":"wordfence","cve":"CVE-2022-4931","title":"BackupWordPress <= 3.12 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/747c86f4-118b-4a9c-899c-e9067d2c7a02?source=api-prod","affected":[{"type":"plugin","slug":"backupwordpress","name":"BackUpWordPress","from":"3.12","from_inclusive":true,"to":"3.12","to_inclusive":true,"patched_in":"3.13"}],"published":"2022-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:747d7649-bdf5-46d0-a496-59cb7eac77ac","source":"wordfence","cve":"CVE-2024-11916","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/747d7649-bdf5-46d0-a496-59cb7eac77ac?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T03:18:12Z"},{"id":"wordfence:748101c3-0a47-4a3d-b2c1-e05d0919432b","source":"wordfence","cve":"CVE-2024-49223","title":"CJ Change Howdy <= 3.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748101c3-0a47-4a3d-b2c1-e05d0919432b?source=api-prod","affected":[{"type":"plugin","slug":"cj-change-howdy","name":"CJ Change Howdy","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:35:13Z"},{"id":"wordfence:748220a6-9882-458c-8f80-a928f449c400","source":"wordfence","cve":"CVE-2022-45829","title":"Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748220a6-9882-458c-8f80-a928f449c400?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74831bf8-0a30-4758-bfe6-5a5b4ee7ec24","source":"wordfence","cve":"CVE-2024-9184","title":"SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74831bf8-0a30-4758-bfe6-5a5b4ee7ec24?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-web-push","name":"SendPulse Free Web Push","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-10-16T20:37:09Z","updated":"2024-10-17T09:32:17Z"},{"id":"wordfence:74832626-5d79-4f8c-8dec-e244dbcf326b","source":"wordfence","cve":"CVE-2026-119369","title":"The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74832626-5d79-4f8c-8dec-e244dbcf326b?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.2","to_inclusive":true,"patched_in":"6.18.3"}],"published":"2026-10-30T15:09:00Z","updated":"2026-11-03T19:50:33Z"},{"id":"wordfence:7483762c-5356-4844-90a9-511d9ec48625","source":"wordfence","cve":"CVE-2026-13443","title":"Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7483762c-5356-4844-90a9-511d9ec48625?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.13","to_inclusive":true,"patched_in":"3.9.14"}],"published":"2026-06-30T14:59:54Z","updated":"2026-07-01T03:43:36Z"},{"id":"wordfence:74841c33-83fa-465e-a5a9-88c34bbc9f6c","source":"wordfence","cve":"","title":"Floating Action Button <= 1.2 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74841c33-83fa-465e-a5a9-88c34bbc9f6c?source=api-prod","affected":[{"type":"plugin","slug":"floating-action-button","name":"Floating Action Button","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7486289b-3cb7-4f8b-abcb-9bfb4b82a95b","source":"wordfence","cve":"CVE-2025-26887","title":"EZ SQL Reports Shortcode Widget and DB Backup <= 5.21.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7486289b-3cb7-4f8b-abcb-9bfb4b82a95b?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"*","from_inclusive":true,"to":"5.21.35","to_inclusive":true,"patched_in":"5.25.08"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T16:59:51Z"},{"id":"wordfence:7487f72c-9852-4651-a848-239d4882bbf8","source":"wordfence","cve":"CVE-2023-23823","title":"Enhanced Text Widget <= 1.5.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7487f72c-9852-4651-a848-239d4882bbf8?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7488b71b-c439-447a-ac99-184551ac51aa","source":"wordfence","cve":"CVE-2026-62058","title":"CF7 Apps \u2013 Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 <= 3.7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7488b71b-c439-447a-ac99-184551ac51aa?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-honeypot","name":"CF7 Apps \u2013 Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.)","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2026-10-01T12:40:00Z","updated":"2026-10-08T23:52:13Z"},{"id":"wordfence:748bc714-25ba-404e-ac3d-e588fd95b2f9","source":"wordfence","cve":"CVE-2024-1796","title":"HUSKY \u2013 Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748bc714-25ba-404e-ac3d-e588fd95b2f9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.1","to_inclusive":true,"patched_in":"1.3.5.2"}],"published":"2024-03-14T00:00:00Z","updated":"2024-03-15T06:48:46Z"},{"id":"wordfence:748c4ca8-fcbf-43e5-ab70-721e83253663","source":"wordfence","cve":"CVE-2026-11911","title":"Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748c4ca8-fcbf-43e5-ab70-721e83253663?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2026-06-19T20:27:13Z","updated":"2026-06-20T08:29:52Z"},{"id":"wordfence:748c5c5b-6786-47b4-baed-cd7fcf0fa7f9","source":"wordfence","cve":"CVE-2025-15693","title":"JCH Optimize 4.2.1 - 5.0.0 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748c5c5b-6786-47b4-baed-cd7fcf0fa7f9?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"4.2.1","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:06:59Z"},{"id":"wordfence:748d01ca-9dd5-4d03-88e7-e80932744fdc","source":"wordfence","cve":"CVE-2021-23174","title":"Download Monitor <= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748d01ca-9dd5-4d03-88e7-e80932744fdc?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2021-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:748d817d-2a47-4426-b166-746ee89d9e61","source":"wordfence","cve":"CVE-2024-49648","title":"SVG Captcha <= 1.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748d817d-2a47-4426-b166-746ee89d9e61?source=api-prod","affected":[{"type":"plugin","slug":"svg-captcha","name":"SVG Captcha","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:10:19Z"},{"id":"wordfence:748e2f67-cd28-4d02-9460-ef88a609d811","source":"wordfence","cve":"CVE-2022-2410","title":"mTouch Quiz <= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/748e2f67-cd28-4d02-9460-ef88a609d811?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7492cffe-6e17-4c59-8979-2fa168b4f41d","source":"wordfence","cve":"CVE-2023-29435","title":"Cryptocurrency All-in-One <= 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7492cffe-6e17-4c59-8979-2fa168b4f41d?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-prices","name":"Cryptocurrency All-in-One","from":"*","from_inclusive":true,"to":"3.0.19","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74984cc6-06b1-4c3a-a3e6-9e104c71e9c5","source":"wordfence","cve":"CVE-2025-8994","title":"WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74984cc6-06b1-4c3a-a3e6-9e104c71e9c5?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.26","to_inclusive":true,"patched_in":"2.6.27"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-15T05:45:34Z"},{"id":"wordfence:749c5d09-1e9a-4aa1-b7c2-6f9d24f3a09b","source":"wordfence","cve":"CVE-2024-0384","title":"WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/749c5d09-1e9a-4aa1-b7c2-6f9d24f3a09b?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:36:36Z"},{"id":"wordfence:74a23c66-3b72-4eab-9e65-c1b9c601f906","source":"wordfence","cve":"CVE-2025-67537","title":"ThirstyAffiliates <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a23c66-3b72-4eab-9e65-c1b9c601f906?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.11.8","to_inclusive":true,"patched_in":"3.11.9"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:00:25Z"},{"id":"wordfence:74a26e81-c063-4590-abe8-6cac9ec62316","source":"wordfence","cve":"","title":"MarketPress <= 3.2.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a26e81-c063-4590-abe8-6cac9ec62316?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-ecommerce","name":"MarketPress \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2017-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74a280e1-e4b6-4bd9-882b-d9f185332d61","source":"wordfence","cve":"CVE-2023-2171","title":"BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a280e1-e4b6-4bd9-882b-d9f185332d61?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74a33813-ca5a-4cf4-9d36-b71ca76b8915","source":"wordfence","cve":"","title":"Flow-Flow Social Feed Stream <= 3.0.71 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a33813-ca5a-4cf4-9d36-b71ca76b8915?source=api-prod","affected":[{"type":"plugin","slug":"flow-flow-social-streams","name":"Flow-Flow Social Feed & Social Wall","from":"*","from_inclusive":true,"to":"3.0.72","to_inclusive":false,"patched_in":"3.0.72"}],"published":"2018-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74a566ea-fffc-4e7e-b6bf-086aeb5b7ce1","source":"wordfence","cve":"CVE-2026-15381","title":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a566ea-fffc-4e7e-b6bf-086aeb5b7ce1?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.1.04","to_inclusive":false,"patched_in":"10.1.04"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:23:16Z"},{"id":"wordfence:74a74817-30ff-42ec-9bd4-7d0638d6643c","source":"wordfence","cve":"CVE-2023-41858","title":"Order Delivery Date for WP e-Commerce <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a74817-30ff-42ec-9bd4-7d0638d6643c?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date for WP e-Commerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74a7db23-f91c-452b-bc24-58fda69caf17","source":"wordfence","cve":"CVE-2026-2358","title":"WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74a7db23-f91c-452b-bc24-58fda69caf17?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-03-10T17:08:30Z","updated":"2026-04-16T13:11:23Z"},{"id":"wordfence:74aad4b3-3e35-4abe-ba26-48334da0face","source":"wordfence","cve":"CVE-2022-2839","title":"Zephyr Project Manager < 3.2.55 - Missing Authorization to Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74aad4b3-3e35-4abe-ba26-48334da0face?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.2.55","to_inclusive":false,"patched_in":"3.2.55"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74ab025d-4e76-46e5-b8f8-963eeea5b802","source":"wordfence","cve":"CVE-2023-51500","title":"Uncode Core <= 2.8.8 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ab025d-4e76-46e5-b8f8-963eeea5b802?source=api-prod","affected":[{"type":"plugin","slug":"uncode-core","name":"Uncode Core","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74ac2b14-aea1-4366-acf4-d2d86cdec4c2","source":"wordfence","cve":"CVE-2024-3475","title":"Sticky Buttons \u2013 floating buttons builder <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ac2b14-aea1-4366-acf4-d2d86cdec4c2?source=api-prod","affected":[{"type":"plugin","slug":"sticky-buttons","name":"Sticky Buttons \u2013 Floating Buttons Builder","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:40:32Z"},{"id":"wordfence:74ad664d-5cfa-481c-a318-30999c43e4ac","source":"wordfence","cve":"CVE-2025-14161","title":"Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ad664d-5cfa-481c-a318-30999c43e4ac?source=api-prod","affected":[{"type":"plugin","slug":"truefy-embed","name":"Truefy Embed","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:37:17Z","updated":"2025-12-12T03:20:49Z"},{"id":"wordfence:74af51ee-c168-4f1b-8c6b-659ad6d148de","source":"wordfence","cve":"CVE-2026-73355","title":"Affiliates Manager <= 2.9.53 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74af51ee-c168-4f1b-8c6b-659ad6d148de?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.53","to_inclusive":true,"patched_in":"2.9.54"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:18:55Z"},{"id":"wordfence:74b186fd-5825-4a20-829b-6b8a5ddbe853","source":"wordfence","cve":"CVE-2026-1644","title":"WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b186fd-5825-4a20-829b-6b8a5ddbe853?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-03-06T11:21:23Z","updated":"2026-03-06T23:22:59Z"},{"id":"wordfence:74b27798-3c6f-4c4e-80f8-7aa40f704fb7","source":"wordfence","cve":"CVE-2024-12504","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b27798-3c6f-4c4e-80f8-7aa40f704fb7?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-23T11:13:29Z"},{"id":"wordfence:74b284b7-ec0a-42c1-82e5-0c8cb422c0c5","source":"wordfence","cve":"CVE-2023-40665","title":"Save as Image plugin by Pdfcrowd <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b284b7-ec0a-42c1-82e5-0c8cb422c0c5?source=api-prod","affected":[{"type":"plugin","slug":"save-as-image-by-pdfcrowd","name":"Save as Image Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74b3223d-53a6-4d29-bab1-29650d2f5d26","source":"wordfence","cve":"CVE-2026-84260","title":"click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b3223d-53a6-4d29-bab1-29650d2f5d26?source=api-prod","affected":[{"type":"plugin","slug":"gf-add-on-by-click5","name":"click5 CRM add-on to Gravity Forms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:12:35Z"},{"id":"wordfence:74b4a2c0-a3c1-4049-aea7-133408ebdf32","source":"wordfence","cve":"CVE-2026-25471","title":"Admin Safety Guard \u2014 Login Security & 2FA <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b4a2c0-a3c1-4049-aea7-133408ebdf32?source=api-prod","affected":[{"type":"plugin","slug":"admin-safety-guard","name":"Admin Safety Guard \u2014 Login Security, Limit Logins, 2FA & Brute Force Protection","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-03-16T00:00:00Z","updated":"2026-06-23T17:35:08Z"},{"id":"wordfence:74b5b076-95cf-4d74-9b2d-af6a068f0490","source":"wordfence","cve":"CVE-2025-66112","title":"Accessibility Toolkit by WebYes <= 2.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b5b076-95cf-4d74-9b2d-af6a068f0490?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-plus","name":"Accessibility Tool Kit: WP Accessibility checker plugin for WCAG, Section 508, ADA, EAA Compliance","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-25T15:56:53Z"},{"id":"wordfence:74b5b09a-33fc-4898-9ead-a7bf47bf7833","source":"wordfence","cve":"CVE-2025-68554","title":"Keenarch < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b5b09a-33fc-4898-9ead-a7bf47bf7833?source=api-prod","affected":[{"type":"theme","slug":"keenarch","name":"Keenarch - Building & Construction WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:32:47Z"},{"id":"wordfence:74b6749b-a51c-4f9a-bb58-f7a9cc0205df","source":"wordfence","cve":"CVE-2025-62867","title":"Ergonet Cache <= 1.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b6749b-a51c-4f9a-bb58-f7a9cc0205df?source=api-prod","affected":[{"type":"plugin","slug":"ergonet-varnish-cache","name":"Ergonet Cache","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-12-06T00:00:00Z","updated":"2026-04-15T13:32:09Z"},{"id":"wordfence:74b81d31-8ee6-47cf-a5e8-3cf0900ebea0","source":"wordfence","cve":"","title":"Events Manager < 5.9.7.2 & Events Manager Pro < 2.6.7.2 - Unauthenticated CSV Injection","severity":"high","cvss":7.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74b81d31-8ee6-47cf-a5e8-3cf0900ebea0?source=api-prod","affected":[{"type":"plugin","slug":"events-manager-pro","name":"Events Manager Pro","from":"*","from_inclusive":true,"to":"2.6.7.2","to_inclusive":false,"patched_in":"2.6.7.2"},{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.7.2","to_inclusive":false,"patched_in":"5.9.7.2"}],"published":"2020-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74bbd842-833b-4c3d-9829-72469591bcaa","source":"wordfence","cve":"CVE-2025-58681","title":"Easy Quotes <= 1.2.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74bbd842-833b-4c3d-9829-72469591bcaa?source=api-prod","affected":[{"type":"plugin","slug":"easy-quotes","name":"Easy Quotes","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-29T16:01:33Z"},{"id":"wordfence:74bbe655-ce86-4a87-a79f-f25bd0680e49","source":"wordfence","cve":"CVE-2024-43147","title":"Selection Lite <= 1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74bbe655-ce86-4a87-a79f-f25bd0680e49?source=api-prod","affected":[{"type":"plugin","slug":"selection-lite","name":"Selection Lite","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.12"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:41:53Z"},{"id":"wordfence:74bca579-85ec-4882-a00b-be341ce26c77","source":"wordfence","cve":"CVE-2025-31572","title":"Multi Days Events and Multi Events in One Day Calendar <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74bca579-85ec-4882-a00b-be341ce26c77?source=api-prod","affected":[{"type":"plugin","slug":"dragon-calendar-free-version","name":"Multi Days Events and Multi Events in One Day Calendar","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:10:09Z"},{"id":"wordfence:74bd595b-d2fa-4c62-82d2-dba2c2b128f0","source":"wordfence","cve":"CVE-2024-9263","title":"WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74bd595b-d2fa-4c62-82d2-dba2c2b128f0?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.25","to_inclusive":true,"patched_in":"1.0.26"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T03:32:49Z"},{"id":"wordfence:74bf6cb2-318f-4b2a-b79c-729fe09570fe","source":"wordfence","cve":"CVE-2014-125103","title":"BestWebSoft's Twitter <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74bf6cb2-318f-4b2a-b79c-729fe09570fe?source=api-prod","affected":[{"type":"plugin","slug":"twitter-plugin","name":"BestWebSoft's Twitter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2014-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74c169b9-4207-4cd8-89df-084db2bb947b","source":"wordfence","cve":"CVE-2024-52474","title":"Express Payments Module <= 1.1.8 - Unauthenticated SQL Injection via type_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74c169b9-4207-4cd8-89df-084db2bb947b?source=api-prod","affected":[{"type":"plugin","slug":"express-pay","name":"ExpressPay Payment Module","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T17:40:26Z"},{"id":"wordfence:74c1bc1d-27f1-4953-8ebd-9396fce0f834","source":"wordfence","cve":"CVE-2026-12137","title":"SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74c1bc1d-27f1-4953-8ebd-9396fce0f834?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-06-17T17:36:34Z","updated":"2026-06-18T06:50:05Z"},{"id":"wordfence:74c2c447-2ec5-4bba-a884-a366c5197dbb","source":"wordfence","cve":"CVE-2026-42639","title":"GD Rating System <= 3.6.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74c2c447-2ec5-4bba-a884-a366c5197dbb?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.7"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:42:48Z"},{"id":"wordfence:74c71541-6706-43d2-af3d-0655e59f997c","source":"wordfence","cve":"CVE-2026-2993","title":"AI Chatbot & Workflow Automation by AIWU <= 1.5.6 - Unauthenticated SQL Injection in getListForTbl()","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74c71541-6706-43d2-af3d-0655e59f997c?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-05-11T19:07:34Z","updated":"2026-08-14T20:56:41Z"},{"id":"wordfence:74cc9d91-5b6a-48fc-8bd1-01100b45ffdb","source":"wordfence","cve":"CVE-2021-34654","title":"Custom Post Type Relations <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74cc9d91-5b6a-48fc-8bd1-01100b45ffdb?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-relations","name":"Custom Post Type Relations","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74cd34be-008c-4ff3-ae3c-417cfd2fee9b","source":"wordfence","cve":"CVE-2026-14343","title":"Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74cd34be-008c-4ff3-ae3c-417cfd2fee9b?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.61","to_inclusive":true,"patched_in":"3.3.62"}],"published":"2026-07-08T18:12:21Z","updated":"2026-07-09T06:52:45Z"},{"id":"wordfence:74d222b9-22e9-485d-8111-d3bee505b200","source":"wordfence","cve":"","title":"Wbcom Designs Plugins (Various Versions) - Arbitrary Plugin Installation, Activation and Deactivation","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74d222b9-22e9-485d-8111-d3bee505b200?source=api-prod","affected":[{"type":"plugin","slug":"bp-user-profile-reviews","name":"Wbcom Designs \u2013 BuddyPress Member Reviews","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"},{"type":"plugin","slug":"bp-create-group-type","name":"Wbcom Designs \u2013 BuddyPress Create Group Type","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-font-uploader","name":"Wbcom Designs \u2013 Custom Font Uploader","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"},{"type":"plugin","slug":"wbcom-designs-buddypress-search","name":"Wbcom Designs \u2013 BuddyPress Search","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"buddypress-sticky-post","name":"BuddyPress Sticky Post","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":false,"patched_in":"1.9.9"},{"type":"plugin","slug":"bp-user-to-do-list","name":"Todo for BuddyPress & BuddyBoss","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"},{"type":"plugin","slug":"wp-system-log","name":"WordPress System Log","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"review-buddypress-groups","name":"Wbcom Designs \u2013 BuddyPress Group Reviews","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":false,"patched_in":"2.8.1"},{"type":"plugin","slug":"bp-job-manager-integration","name":"BP Job Manager integration","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"},{"type":"plugin","slug":"bp-activity-social-share","name":"Wbcom Designs \u2013 BuddyPress Activity Social Share","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"},{"type":"plugin","slug":"custom-email-options","name":"Custom Email Options","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-audio-preview","name":"Audio Preview for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"},{"type":"plugin","slug":"bp-activity-filter","name":"BuddyPress Activity Filter","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"},{"type":"plugin","slug":"woo-document-preview","name":"Document Preview For WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"},{"type":"plugin","slug":"wbcom-designs-buddypress-ads","name":"Wbcom Designs \u2013 BuddyPress Ads","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"},{"type":"plugin","slug":"buddypress-check-ins-pro","name":"BuddyPress Check-ins Pro","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"},{"type":"plugin","slug":"lock-my-bp","name":"Wbcom Designs \u2013 Private Community for BuddyPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"},{"type":"plugin","slug":"buddypress-hashtag","name":"BuddyPress Hashtags","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"},{"type":"plugin","slug":"bp-check-in","name":"Wbcom Designs \u2013 BuddyPress Check-ins","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":false,"patched_in":"1.9.4"}],"published":"2022-04-13T00:00:00Z","updated":"2025-03-04T20:36:33Z"},{"id":"wordfence:74d3606f-bd62-4844-ac17-8e47feddab92","source":"wordfence","cve":"CVE-2023-34369","title":"Login Configurator <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74d3606f-bd62-4844-ac17-8e47feddab92?source=api-prod","affected":[{"type":"plugin","slug":"login-configurator","name":"Login Configurator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74d635b6-2b4a-49af-af5c-6bfa1b5d220e","source":"wordfence","cve":"CVE-2024-7150","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74d635b6-2b4a-49af-af5c-6bfa1b5d220e?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.57","to_inclusive":true,"patched_in":"1.2.58"}],"published":"2024-08-07T17:31:41Z","updated":"2024-08-08T05:31:46Z"},{"id":"wordfence:74da323b-634b-40d0-b29c-901401cf6852","source":"wordfence","cve":"CVE-2024-51848","title":"Parallaxer <= 1.00 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74da323b-634b-40d0-b29c-901401cf6852?source=api-prod","affected":[{"type":"plugin","slug":"parallaxer-lite-parallax-effects-on-images","name":"Parallaxer \u2013 Parallax Effect on Content","from":"*","from_inclusive":true,"to":"1.00","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:50:29Z"},{"id":"wordfence:74dad6f0-0760-4420-b8cc-dc84cafd9b0d","source":"wordfence","cve":"CVE-2024-8678","title":"Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74dad6f0-0760-4420-b8cc-dc84cafd9b0d?source=api-prod","affected":[{"type":"plugin","slug":"revolut-gateway-for-woocommerce","name":"Revolut Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.17.3","to_inclusive":true,"patched_in":"4.17.4"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T06:49:01Z"},{"id":"wordfence:74db4d3a-ee3f-460a-b880-f61a8e33ea57","source":"wordfence","cve":"CVE-2017-20008","title":"myCred Plugin <= 1.7.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74db4d3a-ee3f-460a-b880-f61a8e33ea57?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":false,"patched_in":"1.7.8"}],"published":"2017-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74dd2198-967e-4d12-98ea-a0c87da7ec6e","source":"wordfence","cve":"CVE-2026-93527","title":"Live Copy Paste for Elementor \u2013 Cross Domain Copy Paste & Page Duplicator <= 1.5.10 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74dd2198-967e-4d12-98ea-a0c87da7ec6e?source=api-prod","affected":[{"type":"plugin","slug":"live-copy-paste","name":"Live Copy Paste for Elementor \u2013 Cross Domain Copy Paste & Page Duplicator","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2026-09-23T09:53:00Z","updated":"2026-09-29T20:01:59Z"},{"id":"wordfence:74df2a1c-c42f-4edc-9407-bf2b9b9d679b","source":"wordfence","cve":"CVE-2025-49449","title":"Interactive Regional Map of Africa <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74df2a1c-c42f-4edc-9407-bf2b9b9d679b?source=api-prod","affected":[{"type":"plugin","slug":"interactive-map-of-africa","name":"Interactive Regional Map of Africa","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:27:25Z"},{"id":"wordfence:74df81cd-8cea-4545-86d0-eea2fdf75457","source":"wordfence","cve":"CVE-2026-83537","title":"Express Checkout <= 2.4.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74df81cd-8cea-4545-86d0-eea2fdf75457?source=api-prod","affected":[{"type":"plugin","slug":"wp-express-checkout","name":"WP Express Checkout (Fast Payments via PayPal & Stripe)","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:20:28Z"},{"id":"wordfence:74dfa62b-846e-4e61-89ec-8b64d175f53a","source":"wordfence","cve":"CVE-2026-16054","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.1.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74dfa62b-846e-4e61-89ec-8b64d175f53a?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-21T15:37:43Z"},{"id":"wordfence:74e00d27-1462-4225-b205-da4c2e480de3","source":"wordfence","cve":"CVE-2026-66613","title":"JetEngine <= 3.8.14 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e00d27-1462-4225-b205-da4c2e480de3?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.8.14.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:27:18Z"},{"id":"wordfence:74e15c52-4245-41b0-8005-41e9ac2c2edc","source":"wordfence","cve":"CVE-2024-32801","title":"Widget Post Slider <= 1.3.5. - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e15c52-4245-41b0-8005-41e9ac2c2edc?source=api-prod","affected":[{"type":"plugin","slug":"widget-post-slider","name":"Widget Post Slider","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:32:33Z"},{"id":"wordfence:74e25ef2-ca4d-416e-8a9b-2ed09a93d1aa","source":"wordfence","cve":"CVE-2015-9533","title":"Lattice < 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e25ef2-ca4d-416e-8a9b-2ed09a93d1aa?source=api-prod","affected":[{"type":"theme","slug":"lattice","name":"Lattice","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74e38291-b312-4742-857e-b080321d8225","source":"wordfence","cve":"CVE-2024-6164","title":"Filter & Grids <= 2.8.32 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e38291-b312-4742-857e-b080321d8225?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"2.8.32","to_inclusive":true,"patched_in":"2.8.33"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-01T14:52:29Z"},{"id":"wordfence:74e4808f-bd6f-4e62-91cb-31c86a427498","source":"wordfence","cve":"CVE-2026-3453","title":"ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e4808f-bd6f-4e62-91cb-31c86a427498?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.11","to_inclusive":true,"patched_in":"4.16.12"}],"published":"2026-03-10T14:08:52Z","updated":"2026-03-11T02:22:46Z"},{"id":"wordfence:74e495e0-9085-4f22-af9c-f47cfa1a46e9","source":"wordfence","cve":"CVE-2026-39557","title":"NeoBeat - Music WordPress Theme <= 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e495e0-9085-4f22-af9c-f47cfa1a46e9?source=api-prod","affected":[{"type":"theme","slug":"neobeat","name":"NeoBeat - Music WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:00:05Z"},{"id":"wordfence:74e5b870-337f-4412-8110-786446c047ee","source":"wordfence","cve":"CVE-2026-32436","title":"VW Photography <= 1.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e5b870-337f-4412-8110-786446c047ee?source=api-prod","affected":[{"type":"theme","slug":"vw-photography","name":"VW Photography","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:04:42Z"},{"id":"wordfence:74e5bed8-3c6a-479a-9f2f-f15a467cd896","source":"wordfence","cve":"CVE-2019-17072","title":"Contact Form Widget \u2013 Contact Query, Contact Page, Form Maker, Query Table <= 1.3.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e5bed8-3c6a-479a-9f2f-f15a467cd896?source=api-prod","affected":[{"type":"plugin","slug":"new-contact-form-widget","name":"Contact Form Widget \u2013 Responsive Contact Form, Query Form & Form Builder","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2019-10-10T00:00:00Z","updated":"2024-08-09T19:58:45Z"},{"id":"wordfence:74e728fd-1498-4b2f-8a0d-9d5aaf58787e","source":"wordfence","cve":"CVE-2025-39399","title":"License For Envato <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e728fd-1498-4b2f-8a0d-9d5aaf58787e?source=api-prod","affected":[{"type":"plugin","slug":"license-envato","name":"License For Envato","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-04-21T00:00:00Z","updated":"2025-05-14T14:17:25Z"},{"id":"wordfence:74e790e7-60fd-45cd-942f-0f24365d7fc8","source":"wordfence","cve":"CVE-2025-13969","title":"Reviews Sorted <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e790e7-60fd-45cd-942f-0f24365d7fc8?source=api-prod","affected":[{"type":"plugin","slug":"reviews-sorted","name":"Reviews Sorted","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-12-11T14:22:51Z","updated":"2026-09-18T19:24:18Z"},{"id":"wordfence:74e796c4-0bc8-4033-b0fc-62e3760ab44b","source":"wordfence","cve":"CVE-2026-96327","title":"WPLMS Plugin < 1.9.9.8.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e796c4-0bc8-4033-b0fc-62e3760ab44b?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.8.2","to_inclusive":false,"patched_in":"1.9.9.8.2"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-14T15:49:35Z"},{"id":"wordfence:74e8259b-b702-4cdd-a0ec-4fed255069c9","source":"wordfence","cve":"CVE-2024-37117","title":"Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74e8259b-b702-4cdd-a0ec-4fed255069c9?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator-pro","name":"Uncanny Automator Pro","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.3.0.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:31:32Z"},{"id":"wordfence:74ea8f1e-d6ff-4a32-b8bf-5d4c8e69433e","source":"wordfence","cve":"CVE-2022-46817","title":"Flyzoo Chat <= 2.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ea8f1e-d6ff-4a32-b8bf-5d4c8e69433e?source=api-prod","affected":[{"type":"plugin","slug":"flyzoo","name":"Flyzoo Chat","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74ec5f4c-1957-48f6-8bdb-4155b394b57c","source":"wordfence","cve":"CVE-2024-13868","title":"URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ec5f4c-1957-48f6-8bdb-4155b394b57c?source=api-prod","affected":[{"type":"plugin","slug":"easy-broken-link-checker","name":"URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-03-03T21:53:50Z"},{"id":"wordfence:74ec7886-153a-44f2-9603-d4f1780132ad","source":"wordfence","cve":"CVE-2025-24680","title":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ec7886-153a-44f2-9603-d4f1780132ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-19T16:53:23Z"},{"id":"wordfence:74ee6bf0-7091-40b8-a3e7-9ba1411b7ea4","source":"wordfence","cve":"CVE-2022-2460","title":"WPDating <= 7.4.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ee6bf0-7091-40b8-a3e7-9ba1411b7ea4?source=api-prod","affected":[{"type":"plugin","slug":"dsp_dating","name":"WPDating","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74eecbe1-0563-48f9-9846-3c67d5833f8b","source":"wordfence","cve":"CVE-2025-12954","title":"Timetable and Event Schedule by MotoPress <= 2.4.15 - Insecure Direct Object Reference to Authenticated (Contributor+) Event Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74eecbe1-0563-48f9-9846-3c67d5833f8b?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2025-11-12T00:00:00Z","updated":"2025-12-11T16:27:11Z"},{"id":"wordfence:74f0af24-e4d9-4b89-b91e-c6ec3e3918e7","source":"wordfence","cve":"CVE-2023-36527","title":"Post to CSV by BestWebSoft <= 1.4.0 - Authenticated (Author+) CSV Injection","severity":"high","cvss":7.4,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f0af24-e4d9-4b89-b91e-c6ec3e3918e7?source=api-prod","affected":[{"type":"plugin","slug":"post-to-csv","name":"Post to CSV by BestWebSoft","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74f15066-097d-4d4f-9cf2-a4889043496b","source":"wordfence","cve":"CVE-2025-32665","title":"Office Locator <= 1.3.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f15066-097d-4d4f-9cf2-a4889043496b?source=api-prod","affected":[{"type":"plugin","slug":"office-locator","name":"Office Locator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T19:22:44Z"},{"id":"wordfence:74f1966c-f465-4c8f-b7ae-131974961d72","source":"wordfence","cve":"CVE-2023-23813","title":"My Calendar <= 3.4.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f1966c-f465-4c8f-b7ae-131974961d72?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74f212b1-9f70-44c8-a7bb-ee8887be9ea6","source":"wordfence","cve":"CVE-2024-43211","title":"MailChimp Subscribe Forms  <= 4.0.9.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f212b1-9f70-44c8-a7bb-ee8887be9ea6?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.0.9.7","to_inclusive":true,"patched_in":"4.0.9.8"}],"published":"2024-08-09T00:00:00Z","updated":"2025-02-03T15:00:13Z"},{"id":"wordfence:74f4068b-224e-4523-9a8d-8713b779a262","source":"wordfence","cve":"CVE-2022-36346","title":"WordPress Button Plugin MaxButtons <= 9.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f4068b-224e-4523-9a8d-8713b779a262?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74f53eb4-299f-438a-8eb5-bf1ede31a915","source":"wordfence","cve":"CVE-2026-87067","title":"Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f53eb4-299f-438a-8eb5-bf1ede31a915?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:10:26Z"},{"id":"wordfence:74f59ee0-19dd-4cc9-ab24-22f26d71d248","source":"wordfence","cve":"CVE-2024-5060","title":"LottieFiles \u2013 JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f59ee0-19dd-4cc9-ab24-22f26d71d248?source=api-prod","affected":[{"type":"plugin","slug":"include-lottie-animation-for-elementor","name":"LottieFiles \u2013 JSON Based Animation Lottie & Bodymovin for Elementor","from":"*","from_inclusive":true,"to":"1.10.9","to_inclusive":true,"patched_in":"1.10.10"}],"published":"2024-05-23T18:30:59Z","updated":"2024-05-24T06:42:18Z"},{"id":"wordfence:74f632d6-1150-4ce0-a047-636ed90d19d6","source":"wordfence","cve":"CVE-2026-89304","title":"Paymendo Bank Transfer <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f632d6-1150-4ce0-a047-636ed90d19d6?source=api-prod","affected":[{"type":"plugin","slug":"paymendo-bank-transfer","name":"paymendo \u2013 Bank Transfer (Lite)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:30Z"},{"id":"wordfence:74f6667f-fa30-454f-a100-cfdb50d47026","source":"wordfence","cve":"CVE-2026-82126","title":"Schema & Structured Data for WP & AMP <= 1.65 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6667f-fa30-454f-a100-cfdb50d47026?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.65","to_inclusive":true,"patched_in":"1.66"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:18:41Z"},{"id":"wordfence:74f6bf42-3406-47c5-b255-6cc1e8084fb5","source":"wordfence","cve":"CVE-2024-2543","title":"Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f6bf42-3406-47c5-b255-6cc1e8084fb5?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":true,"patched_in":"2.4.3.2"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:58:44Z"},{"id":"wordfence:74f8af2b-69fb-41db-b978-62709322aed3","source":"wordfence","cve":"","title":"Email Newsletter <= 20.13.6 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f8af2b-69fb-41db-b978-62709322aed3?source=api-prod","affected":[{"type":"plugin","slug":"email-newsletter","name":"Email Newsletter","from":"*","from_inclusive":true,"to":"20.13.6","to_inclusive":true,"patched_in":"20.13.7"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74f92bd4-c752-4620-b506-d7588ff2e586","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_create_pages","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f92bd4-c752-4620-b506-d7588ff2e586?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74f94c83-847e-4ee4-b0d0-f028e3439d1c","source":"wordfence","cve":"CVE-2025-67577","title":"Easy Form Builder <= 3.8.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74f94c83-847e-4ee4-b0d0-f028e3439d1c?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.8.21"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:18:38Z"},{"id":"wordfence:74fa4240-6f62-4db6-b7e7-56998fc29e42","source":"wordfence","cve":"CVE-2026-9185","title":"6Storage Rentals <= 2.26.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74fa4240-6f62-4db6-b7e7-56998fc29e42?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.26.0","to_inclusive":true,"patched_in":"2.27.0"}],"published":"2026-06-08T15:06:25Z","updated":"2026-09-14T16:52:21Z"},{"id":"wordfence:74fa5a77-3c66-4aa5-aa58-3e608e3cba70","source":"wordfence","cve":"CVE-2023-6139","title":"Essential Real Estate <= 4.3.5 - Missing Authorization to Denial of Service","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74fa5a77-3c66-4aa5-aa58-3e608e3cba70?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-12-18T00:00:00Z","updated":"2024-02-06T15:16:45Z"},{"id":"wordfence:74fac72d-6f16-475c-bc80-e77968dd23ad","source":"wordfence","cve":"CVE-2021-24918","title":"Smash Balloon Social Post Feed <= 4.0 - Arbitrary Plugin Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74fac72d-6f16-475c-bc80-e77968dd23ad?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2021-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:74ff6acc-b362-428a-b227-24282e0f2783","source":"wordfence","cve":"CVE-2025-10132","title":"Dhivehi Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/74ff6acc-b362-428a-b227-24282e0f2783?source=api-prod","affected":[{"type":"plugin","slug":"dhivehi-text","name":"Dhivehi Text","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:55:59Z","updated":"2025-10-15T08:25:56Z"},{"id":"wordfence:75000e67-7914-43af-be1d-82990ada5129","source":"wordfence","cve":"CVE-2026-0549","title":"Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75000e67-7914-43af-be1d-82990ada5129?source=api-prod","affected":[{"type":"plugin","slug":"groups","name":"Groups \u2013 Memberships and Access Control","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:17Z"},{"id":"wordfence:75015eb0-3ba0-4858-b54f-151dcfe108cd","source":"wordfence","cve":"CVE-2025-47473","title":"PW WooCommerce Bulk Edit <= 2.134 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75015eb0-3ba0-4858-b54f-151dcfe108cd?source=api-prod","affected":[{"type":"plugin","slug":"pw-bulk-edit","name":"PW WooCommerce Bulk Edit","from":"*","from_inclusive":true,"to":"2.134","to_inclusive":true,"patched_in":"2.135"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:39:54Z"},{"id":"wordfence:75036037-514a-462e-a6a5-4913d70c3335","source":"wordfence","cve":"CVE-2026-89050","title":"Quads Ads Manager for Google AdSense  3.0.4 - Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75036037-514a-462e-a6a5-4913d70c3335?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"3.0.4","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:14:46Z"},{"id":"wordfence:75067f95-48b6-4c1d-8d8b-2601185b1f81","source":"wordfence","cve":"CVE-2023-2321","title":"WPForms Google Sheet Connector <= 3.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75067f95-48b6-4c1d-8d8b-2601185b1f81?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-wpforms-pro","name":"WPForms Google Sheet Connector Pro","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":false,"patched_in":"2.5.7"},{"type":"plugin","slug":"gsheetconnector-wpforms","name":"GSheetConnector \u2013 WPForms Google Sheets Connector, Save WPForms Lite & PRO Entries to Database & Sheets","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75078a4d-8dc3-4b88-b1ec-f98ba0c01fac","source":"wordfence","cve":"CVE-2025-68559","title":"TheGem Theme Elements (for Elementor) <= 5.10.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75078a4d-8dc3-4b88-b1ec-f98ba0c01fac?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.10.5.1","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-12T00:00:00Z","updated":"2026-01-06T14:23:17Z"},{"id":"wordfence:750a4a94-458c-4944-a99b-a1c8e23e57d1","source":"wordfence","cve":"CVE-2023-25784","title":"Sticky Ad Bar <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750a4a94-458c-4944-a99b-a1c8e23e57d1?source=api-prod","affected":[{"type":"plugin","slug":"sticky-ad-bar","name":"Sticky Ad Bar Plugin","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:750bb2b6-4d3e-4e1f-bb93-ede8d7b3ebf1","source":"wordfence","cve":"CVE-2026-78275","title":"Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750bb2b6-4d3e-4e1f-bb93-ede8d7b3ebf1?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards-pro","name":"Fluent Boards Pro","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:17:22Z"},{"id":"wordfence:750be90d-dc12-4974-8921-75259d56c7b3","source":"wordfence","cve":"CVE-2023-1155","title":"Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750be90d-dc12-4974-8921-75259d56c7b3?source=api-prod","affected":[{"type":"plugin","slug":"nd-projects","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:750d0925-aecb-4360-869d-765d7e46541a","source":"wordfence","cve":"CVE-2026-57653","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750d0925-aecb-4360-869d-765d7e46541a?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:50:43Z"},{"id":"wordfence:750f35ce-0f1c-4a12-a7a0-2c217de277fd","source":"wordfence","cve":"CVE-2025-8778","title":"NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750f35ce-0f1c-4a12-a7a0-2c217de277fd?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.18.4","to_inclusive":true,"patched_in":"1.18.5"}],"published":"2025-09-09T18:06:39Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:750fc65a-081d-4c4d-ba14-73b68abd019e","source":"wordfence","cve":"CVE-2024-49627","title":"WordPress Image SEO <= 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750fc65a-081d-4c4d-ba14-73b68abd019e?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-seo","name":"WordPress Image SEO","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:09:18Z"},{"id":"wordfence:750ff77f-3591-43e9-8763-56e3b6006adc","source":"wordfence","cve":"CVE-2026-54843","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/750ff77f-3591-43e9-8763-56e3b6006adc?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:51:16Z"},{"id":"wordfence:75105db1-e627-4cd4-a553-cdb5e8ef11c5","source":"wordfence","cve":"CVE-2025-48296","title":"UpStore <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75105db1-e627-4cd4-a553-cdb5e8ef11c5?source=api-prod","affected":[{"type":"theme","slug":"upstore","name":"UpStore - Multi-Purpose WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-08-02T00:00:00Z","updated":"2025-08-11T17:56:46Z"},{"id":"wordfence:75126f4e-bb9d-4edb-b792-5456f3de614d","source":"wordfence","cve":"CVE-2026-27352","title":"Starto < 2.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75126f4e-bb9d-4edb-b792-5456f3de614d?source=api-prod","affected":[{"type":"theme","slug":"starto","name":"Starto | Software AI Startup WordPress","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:39:12Z"},{"id":"wordfence:75154d59-458f-4a82-bff6-d28c1dbd8d7e","source":"wordfence","cve":"CVE-2025-8062","title":"WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75154d59-458f-4a82-bff6-d28c1dbd8d7e?source=api-prod","affected":[{"type":"plugin","slug":"ws-theme-addons","name":"WS Theme Addons","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:50:55Z","updated":"2025-08-23T04:25:47Z"},{"id":"wordfence:75169963-9ed4-4b3d-8121-2f9153c6a6d9","source":"wordfence","cve":"CVE-2026-114190","title":"LiteSpeed Cache <= 7.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75169963-9ed4-4b3d-8121-2f9153c6a6d9?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2026-10-22T07:31:04Z","updated":"2026-10-28T01:19:03Z"},{"id":"wordfence:7520010f-c402-4fe9-82dc-a973ce446765","source":"wordfence","cve":"CVE-2022-1390","title":"Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7520010f-c402-4fe9-82dc-a973ce446765?source=api-prod","affected":[{"type":"plugin","slug":"admin-word-count-column","name":"Admin Word Count Column","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-20T00:00:00Z","updated":"2026-07-29T21:13:38Z"},{"id":"wordfence:7528d520-7e91-49a8-b421-f27c9e82ed71","source":"wordfence","cve":"CVE-2025-23737","title":"Network-Favorites <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7528d520-7e91-49a8-b421-f27c9e82ed71?source=api-prod","affected":[{"type":"plugin","slug":"network-favorites","name":"Network-Favorites","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:24:06Z"},{"id":"wordfence:752a07c4-ae88-4152-b449-68228a54604a","source":"wordfence","cve":"CVE-2023-38392","title":"Custom Field Template <= 2.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752a07c4-ae88-4152-b449-68228a54604a?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:752b9c5f-4c36-4182-9dd4-0e840a727ceb","source":"wordfence","cve":"CVE-2021-36913","title":"Redirection for Contact Form 7 <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752b9c5f-4c36-4182-9dd4-0e840a727ceb?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:752bc871-7933-4a69-b66a-a01e36872076","source":"wordfence","cve":"CVE-2026-14939","title":"Visualizer: Tables and Charts Manager <= 4.0.5 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752bc871-7933-4a69-b66a-a01e36872076?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:32:49Z"},{"id":"wordfence:752caefe-7e87-4d4f-89e0-fbd28e4076c4","source":"wordfence","cve":"","title":"NextScripts: Social Networks Auto-Poster <= 4.3.25 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752caefe-7e87-4d4f-89e0-fbd28e4076c4?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.3.25","to_inclusive":true,"patched_in":"4.3.26"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:752d5de4-34c2-4a40-af47-69bd7e0ee48e","source":"wordfence","cve":"CVE-2024-47320","title":"WS Form LITE <= 1.9.238 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752d5de4-34c2-4a40-af47-69bd7e0ee48e?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.9.238","to_inclusive":true,"patched_in":"1.9.244"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:17:08Z"},{"id":"wordfence:752e3d68-001b-4523-9040-b1ef8fbffa7e","source":"wordfence","cve":"CVE-2021-36899","title":"Asset CleanUp: Page Speed Booster <= 1.3.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752e3d68-001b-4523-9040-b1ef8fbffa7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.8.4","to_inclusive":true,"patched_in":"1.3.8.5"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:752ec260-d405-41af-8700-7780df1aa59b","source":"wordfence","cve":"CVE-2026-73381","title":"Smart Popup by Supsystic <= 1.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/752ec260-d405-41af-8700-7780df1aa59b?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:59:30Z"},{"id":"wordfence:75324bf1-a00e-4da7-8d42-d224c39ceb79","source":"wordfence","cve":"CVE-2024-10788","title":"Activity Log \u2013 Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75324bf1-a00e-4da7-8d42-d224c39ceb79?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2024-11-20T17:10:23Z","updated":"2024-11-21T05:33:50Z"},{"id":"wordfence:7533b65e-3612-4c8e-8b67-3cbcb80b4331","source":"wordfence","cve":"CVE-2014-2333","title":"Lazyest Gallery < 1.1.21 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7533b65e-3612-4c8e-8b67-3cbcb80b4331?source=api-prod","affected":[{"type":"plugin","slug":"lazyest-gallery","name":"Lazyest Gallery","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":false,"patched_in":"1.1.21"}],"published":"2014-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7534f2e5-a296-4c54-99e3-d84f5c9a5b51","source":"wordfence","cve":"","title":"WordPress File Upload <= 4.16.3 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7534f2e5-a296-4c54-99e3-d84f5c9a5b51?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":true,"patched_in":"4.16.4"}],"published":"2022-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75386d77-44c0-4250-a71a-516f2ec42109","source":"wordfence","cve":"CVE-2025-64218","title":"Passster <= 4.2.19 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75386d77-44c0-4250-a71a-516f2ec42109?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"4.2.20"}],"published":"2025-11-12T00:00:00Z","updated":"2025-12-20T19:20:46Z"},{"id":"wordfence:75388e1c-e1ad-4f65-9f5a-a5da8fd4ecc0","source":"wordfence","cve":"CVE-2026-28177","title":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.23.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75388e1c-e1ad-4f65-9f5a-a5da8fd4ecc0?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.23.0","to_inclusive":true,"patched_in":"1.24.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:18:43Z"},{"id":"wordfence:753a4f7a-7bd4-43a4-b8fb-9e982239ba0e","source":"wordfence","cve":"CVE-2024-7257","title":"YayExtra \u2013 WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/753a4f7a-7bd4-43a4-b8fb-9e982239ba0e?source=api-prod","affected":[{"type":"plugin","slug":"yayextra","name":"YayExtra \u2013 WooCommerce Extra Product Options","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-08-02T21:03:50Z","updated":"2024-08-03T09:37:18Z"},{"id":"wordfence:75410bb1-ab77-45cb-a83d-3515092658ab","source":"wordfence","cve":"CVE-2026-101888","title":"Prime Mover \u2013 Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75410bb1-ab77-45cb-a83d-3515092658ab?source=api-prod","affected":[{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:36:24Z"},{"id":"wordfence:75413c3f-7880-4b10-bf1a-fcfdab877ff5","source":"wordfence","cve":"CVE-2024-47318","title":"PWA for WP & AMP <= 1.7.72 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75413c3f-7880-4b10-bf1a-fcfdab877ff5?source=api-prod","affected":[{"type":"plugin","slug":"pwa-for-wp","name":"PWA for WP \u2013 Progressive Web Apps Made Simple","from":"*","from_inclusive":true,"to":"1.7.72","to_inclusive":true,"patched_in":"1.7.73"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T20:51:18Z"},{"id":"wordfence:7541a595-aae4-49d2-862a-c1d1f4a1e6e5","source":"wordfence","cve":"CVE-2024-12069","title":"Lexicata <= 1.0.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7541a595-aae4-49d2-862a-c1d1f4a1e6e5?source=api-prod","affected":[{"type":"plugin","slug":"lexicata","name":"Lexicata","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:26:44Z","updated":"2025-02-19T07:32:11Z"},{"id":"wordfence:75424878-5976-4dc6-8a09-8eb46a7425b8","source":"wordfence","cve":"","title":"Mail Subscribe List <= 2.1.6 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75424878-5976-4dc6-8a09-8eb46a7425b8?source=api-prod","affected":[{"type":"plugin","slug":"mail-subscribe-list","name":"Mail Subscribe List","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75432cfd-7c0d-4d93-9b62-cac0fd9b49d5","source":"wordfence","cve":"CVE-2024-22309","title":"ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75432cfd-7c0d-4d93-9b62-cac0fd9b49d5?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:57:08Z"},{"id":"wordfence:7546b0b7-8081-4762-9e20-76dfb3c8a8a7","source":"wordfence","cve":"CVE-2023-5823","title":"TK Google Fonts GDPR Compliant <= 2.2.11 - Missing Authorization to Font Addition","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7546b0b7-8081-4762-9e20-76dfb3c8a8a7?source=api-prod","affected":[{"type":"plugin","slug":"tk-google-fonts","name":"TK Google Fonts","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7549e2f1-1ba9-4cd4-b2c2-6812d48e1590","source":"wordfence","cve":"CVE-2026-92766","title":"Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7549e2f1-1ba9-4cd4-b2c2-6812d48e1590?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-10-15T19:56:02Z","updated":"2026-10-16T08:27:43Z"},{"id":"wordfence:754deb8f-6118-4a35-9059-7a83ec8bfc81","source":"wordfence","cve":"CVE-2025-30571","title":"STEdb Forms <= 1.0.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/754deb8f-6118-4a35-9059-7a83ec8bfc81?source=api-prod","affected":[{"type":"plugin","slug":"stedb-forms","name":"STEdb Forms","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:52:55Z"},{"id":"wordfence:754f9598-3b41-4fe3-b290-8422031991a8","source":"wordfence","cve":"CVE-2026-8614","title":"Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/754f9598-3b41-4fe3-b290-8422031991a8?source=api-prod","affected":[{"type":"plugin","slug":"assistio","name":"Assistio","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:38:07Z","updated":"2026-06-24T05:33:25Z"},{"id":"wordfence:75510022-382c-4d03-9c59-1d06349e72bb","source":"wordfence","cve":"CVE-2026-109367","title":"All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75510022-382c-4d03-9c59-1d06349e72bb?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-10-30T20:26:56Z","updated":"2026-10-31T08:30:45Z"},{"id":"wordfence:75537b61-5622-4b35-b80e-389526bd99f0","source":"wordfence","cve":"CVE-2024-7149","title":"Event Manager, Events Calendar, Tickets, Registrations \u2013 Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75537b61-5622-4b35-b80e-389526bd99f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-09-26T00:00:00Z","updated":"2024-09-27T13:52:55Z"},{"id":"wordfence:7553ff69-0f56-4554-8867-9323e83dd8ce","source":"wordfence","cve":"CVE-2026-39620","title":"Appointment <= 3.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7553ff69-0f56-4554-8867-9323e83dd8ce?source=api-prod","affected":[{"type":"theme","slug":"appointment","name":"Appointment","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2026-02-11T00:00:00Z","updated":"2026-06-23T17:34:38Z"},{"id":"wordfence:755454cc-b1a8-4a38-9e73-c47a6ef562a2","source":"wordfence","cve":"","title":"Super Socializer <= 7.13.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755454cc-b1a8-4a38-9e73-c47a6ef562a2?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.53","to_inclusive":true,"patched_in":"7.13.54"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7555c5a5-54e2-4740-9b2f-84d526c9a5c1","source":"wordfence","cve":"CVE-2025-53350","title":"Calendar Plus <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7555c5a5-54e2-4740-9b2f-84d526c9a5c1?source=api-prod","affected":[{"type":"plugin","slug":"calendar-plus","name":"Calendar Plus","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-12T00:00:00Z","updated":"2025-10-29T20:01:04Z"},{"id":"wordfence:75572d36-28ca-4fed-b4b7-1fc4b9485499","source":"wordfence","cve":"CVE-2026-110981","title":"Photo Album Plus <= 9.2.11.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75572d36-28ca-4fed-b4b7-1fc4b9485499?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.11.1","to_inclusive":true,"patched_in":"9.2.11.002"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:40:47Z"},{"id":"wordfence:755768e6-2260-4932-acde-54b246ccda07","source":"wordfence","cve":"CVE-2024-51866","title":"Social button <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755768e6-2260-4932-acde-54b246ccda07?source=api-prod","affected":[{"type":"plugin","slug":"social-button","name":"Social button","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:09:04Z"},{"id":"wordfence:7559dfad-75cb-4ed6-b18a-2c0fc04c309a","source":"wordfence","cve":"CVE-2025-47684","title":"Smaily for WP <= 3.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7559dfad-75cb-4ed6-b18a-2c0fc04c309a?source=api-prod","affected":[{"type":"plugin","slug":"smaily-for-wp","name":"Smaily for WP","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:43:06Z"},{"id":"wordfence:755a2c02-f442-46ca-9b45-644b7098b1e3","source":"wordfence","cve":"CVE-2024-35707","title":"Heateor Social Login WordPress <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755a2c02-f442-46ca-9b45-644b7098b1e3?source=api-prod","affected":[{"type":"plugin","slug":"heateor-social-login","name":"Heateor Social Login WordPress","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:34:00Z"},{"id":"wordfence:755a6556-f1e0-45ae-a65a-6d5e20bd2b48","source":"wordfence","cve":"CVE-2026-22472","title":"Easy Form Builder <= 3.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755a6556-f1e0-45ae-a65a-6d5e20bd2b48?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-01-06T00:00:00Z","updated":"2026-03-17T21:30:29Z"},{"id":"wordfence:755ae574-9df3-44d1-a14b-16887f234510","source":"wordfence","cve":"CVE-2023-0363","title":"Scheduled Announcements Widget <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755ae574-9df3-44d1-a14b-16887f234510?source=api-prod","affected":[{"type":"plugin","slug":"scheduled-announcements-widget","name":"Scheduled Announcements Widget","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"1.0"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:755b53e4-051a-4a25-8fd9-fe10c28acc25","source":"wordfence","cve":"CVE-2018-1002009","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755b53e4-051a-4a25-8fd9-fe10c28acc25?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:755c8863-33c2-47aa-880a-0ef8b2d594a3","source":"wordfence","cve":"CVE-2024-12207","title":"Toggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755c8863-33c2-47aa-880a-0ef8b2d594a3?source=api-prod","affected":[{"type":"plugin","slug":"toggles-shortcode-and-widget","name":"Toggles Shortcode and Widget","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:09:22Z","updated":"2025-01-07T04:22:15Z"},{"id":"wordfence:755e0998-0f0d-4259-881d-ed07aecb0b10","source":"wordfence","cve":"CVE-2024-9177","title":"Themedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755e0998-0f0d-4259-881d-ed07aecb0b10?source=api-prod","affected":[{"type":"plugin","slug":"themedy-toolbox","name":"Themedy Toolbox","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2024-09-26T00:45:54Z","updated":"2024-09-26T13:54:58Z"},{"id":"wordfence:755efea0-b538-44a0-b00a-83b75523bba6","source":"wordfence","cve":"CVE-2026-66628","title":"WP-Lister Lite for eBay <= 3.8.11 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/755efea0-b538-44a0-b00a-83b75523bba6?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.8.11","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2026-09-17T09:02:00Z","updated":"2026-09-22T18:47:56Z"},{"id":"wordfence:7561a71a-c3f0-45f1-8230-2c17cbeff916","source":"wordfence","cve":"CVE-2024-0432","title":"Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7561a71a-c3f0-45f1-8230-2c17cbeff916?source=api-prod","affected":[{"type":"plugin","slug":"gestpay-for-woocommerce","name":"Ecommerce Fabrick","from":"*","from_inclusive":true,"to":"20221130","to_inclusive":true,"patched_in":"20240307"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:37Z"},{"id":"wordfence:7561bce2-bd70-4da3-bbf0-318e59cd1852","source":"wordfence","cve":"CVE-2023-0441","title":"Gallery Blocks with Lightbox <= 3.0.7 - Missing Authorization in pgc_sgb_action_wizard","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7561bce2-bd70-4da3-bbf0-318e59cd1852?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75625e6e-f75b-4e11-acd8-7388efb12b29","source":"wordfence","cve":"CVE-2025-12901","title":"Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75625e6e-f75b-4e11-acd8-7388efb12b29?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-11-11T15:30:02Z","updated":"2025-11-12T04:29:11Z"},{"id":"wordfence:75642531-781a-4c5b-84ae-0e25669d7e40","source":"wordfence","cve":"CVE-2025-22269","title":"Real Testimonials <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75642531-781a-4c5b-84ae-0e25669d7e40?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:52:58Z"},{"id":"wordfence:756679f3-b6d2-4458-ad68-556551491ac7","source":"wordfence","cve":"CVE-2026-109230","title":"WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/756679f3-b6d2-4458-ad68-556551491ac7?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.7.1","to_inclusive":true,"patched_in":"8.8"}],"published":"2026-11-06T21:36:50Z","updated":"2026-11-07T11:26:30Z"},{"id":"wordfence:7566beda-649f-4dfc-860f-fb1c48809461","source":"wordfence","cve":"CVE-2022-37335","title":"Word Search Puzzles game  <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7566beda-649f-4dfc-860f-fb1c48809461?source=api-prod","affected":[{"type":"plugin","slug":"wha-wordsearch","name":"Word Search Puzzles game","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:756810c0-d805-4391-a67b-19b40597d219","source":"wordfence","cve":"CVE-2023-25052","title":"Yandex.News Feed by Teplitsa <= 1.12.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/756810c0-d805-4391-a67b-19b40597d219?source=api-prod","affected":[{"type":"plugin","slug":"yandexnews-feed-by-teplitsa","name":"Yandex.News Feed by Teplitsa","from":"*","from_inclusive":true,"to":"1.12.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75685f2f-b1d0-4f38-a2b4-1cc0259aedc7","source":"wordfence","cve":"","title":"Backup and Restore WordPress \u2013 Backup Plugin <= 1.9 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75685f2f-b1d0-4f38-a2b4-1cc0259aedc7?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2014-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75693bd1-f022-47b9-b498-5ea1bda387e3","source":"wordfence","cve":"CVE-2026-1645","title":"Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75693bd1-f022-47b9-b498-5ea1bda387e3?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-09-21T19:02:52Z","updated":"2026-09-22T07:41:12Z"},{"id":"wordfence:75699831-de38-4c3b-840d-82a04fc97048","source":"wordfence","cve":"","title":"Ghost (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75699831-de38-4c3b-840d-82a04fc97048?source=api-prod","affected":[{"type":"theme","slug":"ghost","name":"Ghost","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:756b5e3e-46fa-483e-945a-86166e79d989","source":"wordfence","cve":"CVE-2023-52130","title":"Affiliates Manager <= 2.9.31 - Cross-Site Request Forgery via multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/756b5e3e-46fa-483e-945a-86166e79d989?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.31","to_inclusive":true,"patched_in":"2.9.32"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:756c203e-8fbe-46f0-8ae7-a3f2d005cd6f","source":"wordfence","cve":"CVE-2026-120685","title":"Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/756c203e-8fbe-46f0-8ae7-a3f2d005cd6f?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-11-06T21:32:03Z","updated":"2026-11-07T11:26:31Z"},{"id":"wordfence:7571a0c6-0baf-4fc0-bd6e-e792e47dffe5","source":"wordfence","cve":"CVE-2024-51651","title":"CubeWP Forms \u2013 All-in-One Form Builder <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7571a0c6-0baf-4fc0-bd6e-e792e47dffe5?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-forms","name":"CubeWP Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-08-01T03:24:49Z"},{"id":"wordfence:7575e290-ad31-4c1b-9a89-eaa8b3eda6d1","source":"wordfence","cve":"CVE-2023-23703","title":"Arconix Shortcodes <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7575e290-ad31-4c1b-9a89-eaa8b3eda6d1?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:757690b0-6c59-4e74-aad2-f5fde9f7a2fb","source":"wordfence","cve":"CVE-2023-52227","title":"MailerLite \u2013 WooCommerce integration <= 2.0.8 - Missing Authorization via Multiple Functions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757690b0-6c59-4e74-aad2-f5fde9f7a2fb?source=api-prod","affected":[{"type":"plugin","slug":"woo-mailerlite","name":"MailerLite \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:757938f4-c6ef-4152-a0d6-f14d2a043c85","source":"wordfence","cve":"CVE-2022-2432","title":"Ecwid Ecommerce Shopping Cart <= 6.10.23 - Cross-Site Request Forgery to Settings/Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757938f4-c6ef-4152-a0d6-f14d2a043c85?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.10.23","to_inclusive":true,"patched_in":"6.10.24"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:757b776b-d0b1-46ee-a58f-48979c3c1b2e","source":"wordfence","cve":"CVE-2025-46501","title":"Mixcloud Embed <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757b776b-d0b1-46ee-a58f-48979c3c1b2e?source=api-prod","affected":[{"type":"plugin","slug":"mixcloud-embed","name":"Mixcloud Embed","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:35:45Z"},{"id":"wordfence:757d8211-88d5-4187-9f82-79339ed70825","source":"wordfence","cve":"CVE-2026-56046","title":"ListingPro - WordPress Directory & Listing Theme <= 2.9.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757d8211-88d5-4187-9f82-79339ed70825?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:04:42Z"},{"id":"wordfence:757e41dd-d72f-4e87-a087-c5c38bd727e5","source":"wordfence","cve":"CVE-2025-12360","title":"Better Find and Replace <= 1.7.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757e41dd-d72f-4e87-a087-c5c38bd727e5?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-11-05T19:08:46Z","updated":"2025-11-06T07:27:06Z"},{"id":"wordfence:757e7eec-ac03-4d5b-8307-b167f9b3d5b5","source":"wordfence","cve":"CVE-2025-22801","title":"Free WooCommerce Theme 99fy Extension <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757e7eec-ac03-4d5b-8307-b167f9b3d5b5?source=api-prod","affected":[{"type":"plugin","slug":"99fy-core","name":"Free WooCommerce Theme 99fy Extension","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:55:30Z"},{"id":"wordfence:757e7f3d-8e16-4a1d-9760-257cf382ab74","source":"wordfence","cve":"CVE-2026-56037","title":"Themify Popup <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757e7f3d-8e16-4a1d-9760-257cf382ab74?source=api-prod","affected":[{"type":"plugin","slug":"themify-popup","name":"Themify Popup","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-10T19:09:29Z"},{"id":"wordfence:757f8ff6-f655-459c-bdd8-a3cbeade7b5d","source":"wordfence","cve":"CVE-2026-28011","title":"Yottis <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/757f8ff6-f655-459c-bdd8-a3cbeade7b5d?source=api-prod","affected":[{"type":"theme","slug":"yottis","name":"Yottis","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:56:45Z"},{"id":"wordfence:75824b96-8674-4340-9e56-b0cb0f52503d","source":"wordfence","cve":"","title":"Robokassa payment gateway for Woocommerce <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75824b96-8674-4340-9e56-b0cb0f52503d?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:758a4b81-4c34-4a01-a0ef-eaa60555fb29","source":"wordfence","cve":"CVE-2025-62107","title":"Feather Login Page <= 1.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758a4b81-4c34-4a01-a0ef-eaa60555fb29?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-05T00:00:00Z","updated":"2026-01-05T18:24:37Z"},{"id":"wordfence:758b7c61-92cc-4100-b04a-e5ff6c90f779","source":"wordfence","cve":"CVE-2025-57980","title":"Safety Exit <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758b7c61-92cc-4100-b04a-e5ff6c90f779?source=api-prod","affected":[{"type":"plugin","slug":"safety-exit","name":"Safety Exit","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:26:31Z"},{"id":"wordfence:758beea4-809c-4837-839d-76ee982d0ae5","source":"wordfence","cve":"CVE-2024-32554","title":"Knight Lab Timeline <= 3.9.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758beea4-809c-4837-839d-76ee982d0ae5?source=api-prod","affected":[{"type":"plugin","slug":"knight-lab-timelinejs","name":"Knight Lab Timeline","from":"*","from_inclusive":true,"to":"3.9.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T13:13:00Z"},{"id":"wordfence:758ccfd2-e984-46d9-9643-29299d64940e","source":"wordfence","cve":"","title":"My Category Order <= 4.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758ccfd2-e984-46d9-9643-29299d64940e?source=api-prod","affected":[{"type":"plugin","slug":"my-category-order","name":"my-category-order","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:758e035f-5713-4af0-a771-8214c753a9ba","source":"wordfence","cve":"CVE-2024-37262","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758e035f-5713-4af0-a771-8214c753a9ba?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:47:30Z"},{"id":"wordfence:758e23b9-c3d5-4f1c-9659-66483d6f0578","source":"wordfence","cve":"CVE-2025-12964","title":"Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758e23b9-c3d5-4f1c-9659-66483d6f0578?source=api-prod","affected":[{"type":"plugin","slug":"magical-products-display","name":"Magical Shop Builder \u2013 WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder","from":"*","from_inclusive":true,"to":"1.1.29","to_inclusive":true,"patched_in":"1.1.30"}],"published":"2025-11-20T20:44:27Z","updated":"2025-11-21T09:27:00Z"},{"id":"wordfence:758e23e4-72e6-4dc1-94f9-d02b75bb9857","source":"wordfence","cve":"","title":"Ultimate Maps by Supsystic <= 1.1.16 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758e23e4-72e6-4dc1-94f9-d02b75bb9857?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":false,"patched_in":"1.1.17"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:758f9402-33f4-40a6-a021-bf689d3b4a1b","source":"wordfence","cve":"CVE-2026-93875","title":"JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/758f9402-33f4-40a6-a021-bf689d3b4a1b?source=api-prod","affected":[{"type":"plugin","slug":"jet-appointments-booking","name":"JetAppointment","from":"*","from_inclusive":true,"to":"2.5.2.1","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-10-01T16:43:58Z","updated":"2026-10-02T13:29:05Z"},{"id":"wordfence:75938876-d644-47b1-a0b9-c3544f23186d","source":"wordfence","cve":"CVE-2025-24678","title":"Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75938876-d644-47b1-a0b9-c3544f23186d?source=api-prod","affected":[{"type":"plugin","slug":"listamester","name":"Listamester","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-01-24T00:00:00Z","updated":"2026-04-15T20:39:22Z"},{"id":"wordfence:7593b8b5-36c0-4c68-b1f2-d505fafc3328","source":"wordfence","cve":"CVE-2025-6261","title":"Fleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7593b8b5-36c0-4c68-b1f2-d505fafc3328?source=api-prod","affected":[{"type":"plugin","slug":"fleetwire-fleet-management","name":"Fleetwire \u2013 Car Rental Booking & Website Builder","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-07-22T14:01:34Z","updated":"2025-09-26T18:29:41Z"},{"id":"wordfence:7594a0ed-cde4-4575-b155-e3717f0fee90","source":"wordfence","cve":"CVE-2025-23706","title":"Jet Skinner for BuddyPress <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7594a0ed-cde4-4575-b155-e3717f0fee90?source=api-prod","affected":[{"type":"plugin","slug":"jet-skinner-for-buddypress","name":"Jet Skinner for BuddyPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:55:14Z"},{"id":"wordfence:7595a1f6-6923-4102-8efe-a414adebce65","source":"wordfence","cve":"CVE-2025-3458","title":"Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7595a1f6-6923-4102-8efe-a414adebce65?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-22T11:12:30Z"},{"id":"wordfence:7598b38b-26b1-4640-9bd7-60613a5f704d","source":"wordfence","cve":"CVE-2026-1916","title":"WPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7598b38b-26b1-4640-9bd7-60613a5f704d?source=api-prod","affected":[{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-02-24T19:34:56Z","updated":"2026-02-25T08:25:32Z"},{"id":"wordfence:7598e56d-a60f-4caa-86de-db731079f538","source":"wordfence","cve":"CVE-2025-49356","title":"Orders Chat for WooCommerce <= 2.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7598e56d-a60f-4caa-86de-db731079f538?source=api-prod","affected":[{"type":"plugin","slug":"orders-chat-for-woocommerce","name":"Orders Chat for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-09-09T16:05:21Z"},{"id":"wordfence:75993820-e3bb-43c4-92a6-5aad2a7187e9","source":"wordfence","cve":"CVE-2024-44022","title":"Review & testimonial widgets <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75993820-e3bb-43c4-92a6-5aad2a7187e9?source=api-prod","affected":[{"type":"plugin","slug":"trustmary","name":"Review & testimonial widgets","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-16T14:24:59Z"},{"id":"wordfence:759add85-3d72-46d5-a973-dd8dcfb9f336","source":"wordfence","cve":"CVE-2026-5116","title":"Contact Form 7 \u2013 Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/759add85-3d72-46d5-a973-dd8dcfb9f336?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2026-08-04T18:02:23Z","updated":"2026-08-05T06:37:56Z"},{"id":"wordfence:759bb4c0-2d51-49d3-9132-6a2a246cebc0","source":"wordfence","cve":"CVE-2024-11842","title":"DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/759bb4c0-2d51-49d3-9132-6a2a246cebc0?source=api-prod","affected":[{"type":"plugin","slug":"dn-shipping-by-weight","name":"Shipping by Weight for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-10T16:13:09Z"},{"id":"wordfence:759f5687-4ff1-4b8d-a5e7-3fb409fc2ba0","source":"wordfence","cve":"CVE-2022-3883","title":"StopBadBots <= 7.23 - Missing Authorization to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/759f5687-4ff1-4b8d-a5e7-3fb409fc2ba0?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"7.23","to_inclusive":true,"patched_in":"7.24"}],"published":"2022-11-18T00:00:00Z","updated":"2024-10-23T08:38:21Z"},{"id":"wordfence:75a00c52-5c2f-43e2-a869-f2304347d76e","source":"wordfence","cve":"CVE-2026-94360","title":"Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Arbitrary Order Status Manipulation","severity":"high","cvss":7.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a00c52-5c2f-43e2-a869-f2304347d76e?source=api-prod","affected":[{"type":"plugin","slug":"paymentfor-gateway-for-woocommerce","name":"Paymentfor Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2026-10-14T00:00:00Z","updated":"2026-11-03T19:33:40Z"},{"id":"wordfence:75a1b096-183c-4c97-adcb-4edca7668f05","source":"wordfence","cve":"CVE-2025-26540","title":"Helloprint <= 2.0.7 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a1b096-183c-4c97-adcb-4edca7668f05?source=api-prod","affected":[{"type":"plugin","slug":"helloprint","name":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-07T14:12:35Z"},{"id":"wordfence:75a1f49d-2352-40f0-a830-7cff0e5163f2","source":"wordfence","cve":"CVE-2024-1333","title":"Responsive Pricing Table <= 5.1.10 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a1f49d-2352-40f0-a830-7cff0e5163f2?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":true,"patched_in":"5.1.11"}],"published":"2024-02-26T00:00:00Z","updated":"2024-03-08T14:00:27Z"},{"id":"wordfence:75a2e8b1-d5e0-4f7b-a70a-f0aadf58c778","source":"wordfence","cve":"CVE-2026-8832","title":"WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a2e8b1-d5e0-4f7b-a70a-f0aadf58c778?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers","name":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-05-26T17:48:25Z","updated":"2026-05-27T06:46:16Z"},{"id":"wordfence:75a3a8ee-42c6-4963-bb48-6794b310b861","source":"wordfence","cve":"CVE-2025-12837","title":"aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a3a8ee-42c6-4963-bb48-6794b310b861?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-11-07T20:47:37Z","updated":"2025-11-08T09:28:11Z"},{"id":"wordfence:75a5853a-7497-4312-b7e1-e21b1425dc05","source":"wordfence","cve":"CVE-2011-5304","title":"SodaHead Polls < 2.0.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a5853a-7497-4312-b7e1-e21b1425dc05?source=api-prod","affected":[{"type":"plugin","slug":"sodahead-polls","name":"SodaHead Polls","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2011-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75a90089-2198-459e-86a4-eb7937bd223f","source":"wordfence","cve":"CVE-2025-46507","title":"Unsafe Mimetypes <= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75a90089-2198-459e-86a4-eb7937bd223f?source=api-prod","affected":[{"type":"plugin","slug":"unsafe-mimetypes","name":"Unsafe Mimetypes","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:19:54Z"},{"id":"wordfence:75aa7541-d9d4-4526-9831-238327d0f3ae","source":"wordfence","cve":"CVE-2022-44580","title":"Plugin for Google Reviews <= 2.2.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75aa7541-d9d4-4526-9831-238327d0f3ae?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75aadbf5-763b-48cb-9d9e-fb8edb894d08","source":"wordfence","cve":"CVE-2024-29918","title":"Survey Maker <= 4.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75aadbf5-763b-48cb-9d9e-fb8edb894d08?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:07:15Z"},{"id":"wordfence:75ac23b7-bcc0-41ce-8cfc-e1de3954d169","source":"wordfence","cve":"CVE-2021-24453","title":"Include Me <= 1.2.1 - Local File Inclusion leading to Authenticated Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ac23b7-bcc0-41ce-8cfc-e1de3954d169?source=api-prod","affected":[{"type":"plugin","slug":"include-me","name":"Include Me","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75ad72b7-c1ac-4f91-8a55-bfee456bec15","source":"wordfence","cve":"CVE-2026-39703","title":"WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ad72b7-c1ac-4f91-8a55-bfee456bec15?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:47:55Z"},{"id":"wordfence:75b09cf8-cfe4-4a8a-838c-e4b1cedf5d5a","source":"wordfence","cve":"CVE-2024-38681","title":"Magical Addons For Elementor <= 1.1.41 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b09cf8-cfe4-4a8a-838c-e4b1cedf5d5a?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.1.41","to_inclusive":true,"patched_in":"1.1.42"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-01T13:32:29Z"},{"id":"wordfence:75b26ed9-3250-40c9-849c-f76d8d435b1a","source":"wordfence","cve":"CVE-2026-49779","title":"Tax Exempt for WooCommerce <= 1.9.3 - Authenticated (Customer+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b26ed9-3250-40c9-849c-f76d8d435b1a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-tax-exempt-plugin","name":"Tax Exempt for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T13:50:02Z"},{"id":"wordfence:75b84eae-6ff2-49af-a420-2aeef50224e3","source":"wordfence","cve":"CVE-2023-1208","title":"HTTP Headers <= 1.18.10 - Authenticated(Administrator+) Remote Code Execution","severity":"medium","cvss":6.6,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b84eae-6ff2-49af-a420-2aeef50224e3?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.18.10","to_inclusive":true,"patched_in":"1.18.11"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75b8f71d-9f75-4b42-ac5f-c6ffb476aae4","source":"wordfence","cve":"CVE-2023-0088","title":"Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b8f71d-9f75-4b42-ac5f-c6ffb476aae4?source=api-prod","affected":[{"type":"plugin","slug":"swifty-page-manager","name":"Swifty Page Manager","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75b8fce9-023d-4603-9d92-46a053d16291","source":"wordfence","cve":"CVE-2024-12273","title":"Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b8fce9-023d-4603-9d92-46a053d16291?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.2.61","to_inclusive":true,"patched_in":"5.2.62"}],"published":"2025-04-08T00:00:00Z","updated":"2026-09-04T17:29:51Z"},{"id":"wordfence:75b91e92-7c00-447d-80fa-6e20ca8df7ce","source":"wordfence","cve":"CVE-2022-4368","title":"WP CSV <= 1.8.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b91e92-7c00-447d-80fa-6e20ca8df7ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-csv","name":"WP CSV","from":"*","from_inclusive":true,"to":"1.8.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75b92908-83cc-4189-995f-5dcea44fe8f7","source":"wordfence","cve":"CVE-2026-57655","title":"Child Theme Wizard <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75b92908-83cc-4189-995f-5dcea44fe8f7?source=api-prod","affected":[{"type":"plugin","slug":"child-theme-wizard","name":"Child Theme Wizard","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:35:28Z"},{"id":"wordfence:75ba5ffa-aba7-4b70-9724-a6380ccda933","source":"wordfence","cve":"CVE-2026-96671","title":"Featured Image from URL (FIFU) <= 6.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ba5ffa-aba7-4b70-9724-a6380ccda933?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:50:27Z"},{"id":"wordfence:75ba69c5-9e1d-4644-b28c-069c904798cc","source":"wordfence","cve":"CVE-2025-31888","title":"WP Multistore Locator <= 2.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ba69c5-9e1d-4644-b28c-069c904798cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-04-22T21:00:02Z"},{"id":"wordfence:75bc2295-bf9a-430f-92b7-d380eed6df11","source":"wordfence","cve":"CVE-2025-2779","title":"Insert Headers and Footers Code \u2013 HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75bc2295-bf9a-430f-92b7-d380eed6df11?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers-script","name":"Insert Headers and Footers Code \u2013 HT Script","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-04-01T12:13:01Z","updated":"2025-04-02T01:44:29Z"},{"id":"wordfence:75c2b82e-cf1c-4db2-811c-82d05c6a1212","source":"wordfence","cve":"CVE-2026-15459","title":"WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c2b82e-cf1c-4db2-811c-82d05c6a1212?source=api-prod","affected":[{"type":"plugin","slug":"wpmudev-updates","name":"WPMU DEV Dashboard","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-08-05T16:25:27Z","updated":"2026-09-17T15:04:38Z"},{"id":"wordfence:75c325a1-1a88-4b67-a5f8-6307627d8c6a","source":"wordfence","cve":"CVE-2023-6384","title":"WP User Profile Avatar <= 1.0.0 - Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c325a1-1a88-4b67-a5f8-6307627d8c6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profile-avatar","name":"WP User Profile Avatar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75c5602c-1369-43e4-8010-4a3dfa9bef1f","source":"wordfence","cve":"CVE-2024-54316","title":"Restaurant & Cafe Addon for Elementor <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c5602c-1369-43e4-8010-4a3dfa9bef1f?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:20:18Z"},{"id":"wordfence:75c5d4e6-9ef3-4b12-9ee9-67121dbb0fcd","source":"wordfence","cve":"CVE-2024-8516","title":"Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c5d4e6-9ef3-4b12-9ee9-67121dbb0fcd?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-21T16:42:43Z"},{"id":"wordfence:75c6697c-bc1d-456f-baee-ee9c57e40d21","source":"wordfence","cve":"CVE-2022-4162","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c6697c-bc1d-456f-baee-ee9c57e40d21?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75c6f881-e466-4c83-a7bf-a5e29e9134bf","source":"wordfence","cve":"CVE-2026-111849","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce <= 2.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c6f881-e466-4c83-a7bf-a5e29e9134bf?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-10-19T12:13:00Z","updated":"2026-10-23T18:47:11Z"},{"id":"wordfence:75c9c106-d1f9-43ee-be1f-3eddec8f2529","source":"wordfence","cve":"CVE-2024-12270","title":"Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75c9c106-d1f9-43ee-be1f-3eddec8f2529?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-taxonomy-filters","name":"Beautiful taxonomy filters","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2024-12-06T21:20:23Z","updated":"2025-11-05T18:54:01Z"},{"id":"wordfence:75cc5088-9376-4b9a-bc1e-83269e9652fa","source":"wordfence","cve":"CVE-2026-25028","title":"ElementInvader Addons for Elementor <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75cc5088-9376-4b9a-bc1e-83269e9652fa?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:29:32Z"},{"id":"wordfence:75cc74f6-aaab-4d5a-bd71-c238fa74a9bb","source":"wordfence","cve":"CVE-2021-24712","title":"Appointment Hour Booking <= 1.3.16 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75cc74f6-aaab-4d5a-bd71-c238fa74a9bb?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":false,"patched_in":"1.3.17"}],"published":"2021-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75cf7c78-ffce-4f30-a542-efd86b8542cc","source":"wordfence","cve":"CVE-2025-31819","title":"Nova Blocks by Pixelgrade <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75cf7c78-ffce-4f30-a542-efd86b8542cc?source=api-prod","affected":[{"type":"plugin","slug":"nova-blocks","name":"Nova Blocks by Pixelgrade","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-04-01T00:00:00Z","updated":"2026-02-10T20:43:17Z"},{"id":"wordfence:75d5366e-2908-4b8d-9ee2-1f11e483add1","source":"wordfence","cve":"CVE-2021-24258","title":"Elements Kit Lite/Pro <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75d5366e-2908-4b8d-9ee2-1f11e483add1?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75d5c684-090e-4fff-9bf7-2b7c41ef95d3","source":"wordfence","cve":"CVE-2026-16797","title":"ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75d5c684-090e-4fff-9bf7-2b7c41ef95d3?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-07-27T16:45:38Z","updated":"2026-07-28T05:39:43Z"},{"id":"wordfence:75d65a82-145e-4d73-9c9d-8792a3d05d7e","source":"wordfence","cve":"CVE-2026-39688","title":"Frontend Profile <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75d65a82-145e-4d73-9c9d-8792a3d05d7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-15T21:30:04Z"},{"id":"wordfence:75d66a45-5bb9-4e82-acd5-e0b92e3870a9","source":"wordfence","cve":"CVE-2025-11452","title":"Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75d66a45-5bb9-4e82-acd5-e0b92e3870a9?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-11-07T14:15:33Z","updated":"2025-11-08T02:28:03Z"},{"id":"wordfence:75da181d-3162-448f-afb8-dc05748184f6","source":"wordfence","cve":"CVE-2024-30177","title":"Exclusive Addons Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75da181d-3162-448f-afb8-dc05748184f6?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:19:34Z"},{"id":"wordfence:75da660b-04c7-4f15-b49d-2aa320ef5b4b","source":"wordfence","cve":"CVE-2026-12041","title":"Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75da660b-04c7-4f15-b49d-2aa320ef5b4b?source=api-prod","affected":[{"type":"plugin","slug":"chatra-live-chat","name":"Chatra Live Chat + ChatBot + Cart Saver","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2026-07-07T16:40:01Z","updated":"2026-07-31T19:20:15Z"},{"id":"wordfence:75dafb36-7596-492f-a377-32315b1abe33","source":"wordfence","cve":"CVE-2023-44985","title":"BuddyMeet <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75dafb36-7596-492f-a377-32315b1abe33?source=api-prod","affected":[{"type":"plugin","slug":"buddymeet","name":"BuddyMeet","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75ddf732-ddb2-47ba-884a-477fcc6595b4","source":"wordfence","cve":"CVE-2023-37973","title":"Replace Word <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ddf732-ddb2-47ba-884a-477fcc6595b4?source=api-prod","affected":[{"type":"plugin","slug":"replace-word","name":"Replace Word","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75de6387-fac7-403d-9e6c-89570658d978","source":"wordfence","cve":"CVE-2025-13077","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0641\u0648\u0642 \u062d\u0631\u0641\u0647 \u0627\u06cc (\u062c\u062f\u06cc\u062f) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75de6387-fac7-403d-9e6c-89570658d978?source=api-prod","affected":[{"type":"plugin","slug":"payamito-sms-woocommerce","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0641\u0648\u0642 \u062d\u0631\u0641\u0647 \u0627\u06cc (\u062c\u062f\u06cc\u062f) payamito sms woocommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:10:11Z","updated":"2025-12-13T04:31:28Z"},{"id":"wordfence:75e02357-391a-4f21-9024-ca4a0ea24d50","source":"wordfence","cve":"CVE-2022-42699","title":"Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e02357-391a-4f21-9024-ca4a0ea24d50?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75e321ea-569f-450c-a120-39011568a28f","source":"wordfence","cve":"CVE-2025-23971","title":"KI Live Video Conferences <= 5.5.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e321ea-569f-450c-a120-39011568a28f?source=api-prod","affected":[{"type":"plugin","slug":"ki-live-video-conferences","name":"KI Live Video Conferences","from":"*","from_inclusive":true,"to":"5.5.15","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:29:08Z"},{"id":"wordfence:75e41e78-ce8c-4248-9eca-b36391fbbbde","source":"wordfence","cve":"CVE-2025-6385","title":"WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e41e78-ce8c-4248-9eca-b36391fbbbde?source=api-prod","affected":[{"type":"plugin","slug":"wp-applink","name":"WP Applink","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:42:08Z","updated":"2025-07-24T09:22:18Z"},{"id":"wordfence:75e55138-b091-4113-89da-e1ca45fb99ea","source":"wordfence","cve":"CVE-2024-0216","title":"Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e55138-b091-4113-89da-e1ca45fb99ea?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-04-30T01:54:21Z"},{"id":"wordfence:75e5c379-02a2-4f1e-b62f-e02087c8446b","source":"wordfence","cve":"CVE-2026-18480","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 - Authenticated (Subscriber+) Arbitrary Account Email Takeover","severity":"high","cvss":8.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e5c379-02a2-4f1e-b62f-e02087c8446b?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":false,"patched_in":"4.6.3"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:49:11Z"},{"id":"wordfence:75e5e1eb-300f-4ddf-aec5-4fae9dba0f5d","source":"wordfence","cve":"","title":"Unlimited Category slider for WooCommerce <= 2.0.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e5e1eb-300f-4ddf-aec5-4fae9dba0f5d?source=api-prod","affected":[{"type":"plugin","slug":"wc-basic-slider","name":"Category slider for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75e89574-a0d4-4383-a6f8-bf977e2ffe4d","source":"wordfence","cve":"CVE-2022-47610","title":"Simple Image Popup <= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e89574-a0d4-4383-a6f8-bf977e2ffe4d?source=api-prod","affected":[{"type":"plugin","slug":"simple-image-popup","name":"Simple Image Popup","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75e9a90d-ef24-425c-b8c5-f8bd16feb858","source":"wordfence","cve":"CVE-2026-16269","title":"Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling","severity":"high","cvss":7.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e9a90d-ef24-425c-b8c5-f8bd16feb858?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-17T15:26:12Z"},{"id":"wordfence:75e9b879-a080-46b3-b97d-5e18faf863c7","source":"wordfence","cve":"CVE-2025-4190","title":"CSV Mass Importer <= 1.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75e9b879-a080-46b3-b97d-5e18faf863c7?source=api-prod","affected":[{"type":"plugin","slug":"csv-mass-importer","name":"CSV Mass Importer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-30T20:12:43Z"},{"id":"wordfence:75eab54b-dbe0-4440-b4ab-601c5041e180","source":"wordfence","cve":"CVE-2024-3682","title":"WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75eab54b-dbe0-4440-b4ab-601c5041e180?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.5.0"},{"type":"plugin","slug":"wp-staging-pro","name":"WP STAGING Pro WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T09:29:51Z"},{"id":"wordfence:75ec04f1-8bea-4514-b1d0-da5b305219d7","source":"wordfence","cve":"CVE-2024-6254","title":"Brizy \u2013 Page Builder <= 2.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ec04f1-8bea-4514-b1d0-da5b305219d7?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2024-08-07T15:16:24Z","updated":"2024-08-08T03:30:47Z"},{"id":"wordfence:75ee17a7-2f7f-4102-97ab-7b348a24d6d7","source":"wordfence","cve":"CVE-2025-24646","title":"XML for Avito <= 2.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ee17a7-2f7f-4102-97ab-7b348a24d6d7?source=api-prod","affected":[{"type":"plugin","slug":"xml-for-avito","name":"XML for Avito","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-25T17:09:00Z"},{"id":"wordfence:75f01eb4-5d53-441d-9bee-e97857dadaf9","source":"wordfence","cve":"CVE-2023-2805","title":"SupportCandy <= 3.1.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f01eb4-5d53-441d-9bee-e97857dadaf9?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75f0bc5a-f588-4aeb-9e55-72e180d39ddf","source":"wordfence","cve":"","title":"ALD Dropping and Fulfillment for AliExpress and WooCommerce <= 1.0.21 - Missing Authorization to Order Information Disclosure","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f0bc5a-f588-4aeb-9e55-72e180d39ddf?source=api-prod","affected":[{"type":"plugin","slug":"woo-alidropship","name":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75f272ab-c740-4b41-ad9a-963ed96f5bad","source":"wordfence","cve":"CVE-2026-97279","title":"Polylang <= 3.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f272ab-c740-4b41-ad9a-963ed96f5bad?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:27:43Z"},{"id":"wordfence:75f45345-216e-48a8-b131-672aa12a0e0f","source":"wordfence","cve":"CVE-2024-3986","title":"SportsPress \u2013 Sports Club & League Manager <= 2.7.21 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f45345-216e-48a8-b131-672aa12a0e0f?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.21","to_inclusive":true,"patched_in":"2.7.22"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-02T20:23:55Z"},{"id":"wordfence:75f5f59e-b071-43aa-87a5-d7c31fb35dae","source":"wordfence","cve":"CVE-2026-39472","title":"PDF Invoices & Packing Slips for WooCommerce < 5.9.0 - Authenticated (Shop manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f5f59e-b071-43aa-87a5-d7c31fb35dae?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":false,"patched_in":"5.9.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:44:38Z"},{"id":"wordfence:75f87f99-9f0d-46c2-a6f1-3c1ea0176303","source":"wordfence","cve":"CVE-2024-3097","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f87f99-9f0d-46c2-a6f1-3c1ea0176303?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59","to_inclusive":true,"patched_in":"3.59.1"}],"published":"2024-04-05T12:00:00Z","updated":"2024-04-09T18:58:58Z"},{"id":"wordfence:75f964a8-a5eb-4990-a6d4-e911a20d0035","source":"wordfence","cve":"","title":"Real3D Flipbook <= 2.8 - Reflected Cross-Site Scripting via bookId parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f964a8-a5eb-4990-a6d4-e911a20d0035?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2016-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75f98731-f5a1-46aa-bf00-3b119a3b917e","source":"wordfence","cve":"CVE-2024-47389","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75f98731-f5a1-46aa-bf00-3b119a3b917e?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"8.7.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:55:25Z"},{"id":"wordfence:75fa3541-6410-4e3e-9f17-c39b7321c5ec","source":"wordfence","cve":"CVE-2025-26893","title":"Easy Charts <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75fa3541-6410-4e3e-9f17-c39b7321c5ec?source=api-prod","affected":[{"type":"plugin","slug":"easy-charts","name":"Easy Charts","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T16:56:38Z"},{"id":"wordfence:75fc21c8-352c-48dc-9d3f-53a738306f97","source":"wordfence","cve":"CVE-2022-3536","title":"Role Based Pricing for WooCommerce <= 1.6.2 - Missing Authorization to PHAR Deserialization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75fc21c8-352c-48dc-9d3f-53a738306f97?source=api-prod","affected":[{"type":"plugin","slug":"role-based-pricing-for-woocommerce","name":"Role Based Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:75fc5104-04c4-4a9d-9c9e-dcb15182120b","source":"wordfence","cve":"CVE-2025-68039","title":"BackItUp <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75fc5104-04c4-4a9d-9c9e-dcb15182120b?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:13:01Z"},{"id":"wordfence:75fc5df5-a774-4fe1-8452-d35ba7b69081","source":"wordfence","cve":"CVE-2026-87115","title":"VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75fc5df5-a774-4fe1-8452-d35ba7b69081?source=api-prod","affected":[{"type":"plugin","slug":"vikappointments","name":"VikAppointments Services Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":"1.2.22"}],"published":"2026-10-02T17:35:22Z","updated":"2026-10-03T06:38:23Z"},{"id":"wordfence:75fe1d0c-52a3-4fcc-a80b-d05af7f2b0bc","source":"wordfence","cve":"CVE-2025-25117","title":"Smart Countdown FX <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75fe1d0c-52a3-4fcc-a80b-d05af7f2b0bc?source=api-prod","affected":[{"type":"plugin","slug":"smart-countdown-fx","name":"Smart Countdown FX","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:32:00Z"},{"id":"wordfence:75ffafcc-7126-410d-b800-b249c03885a8","source":"wordfence","cve":"CVE-2025-47638","title":"WP Discord Invite <= 2.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/75ffafcc-7126-410d-b800-b249c03885a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-invite","name":"WP Discord Invite","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-16T22:02:55Z"},{"id":"wordfence:760012c0-d871-41fa-a026-d831d5148744","source":"wordfence","cve":"CVE-2025-49049","title":"DZS Video Gallery <= 12.39 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760012c0-d871-41fa-a026-d831d5148744?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"12.39","to_inclusive":true,"patched_in":"12.40"}],"published":"2026-01-12T00:00:00Z","updated":"2026-02-25T14:39:22Z"},{"id":"wordfence:7600e7df-725d-4877-b0bf-5329f814723f","source":"wordfence","cve":"CVE-2024-7620","title":"Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import","severity":"medium","cvss":6.6,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7600e7df-725d-4877-b0bf-5329f814723f?source=api-prod","affected":[{"type":"plugin","slug":"customizer-export-import","name":"Customizer Export/Import","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.7.1"}],"published":"2024-09-06T00:00:00Z","updated":"2024-09-07T11:17:05Z"},{"id":"wordfence:76044985-477c-4d62-aec3-1905add0a9e2","source":"wordfence","cve":"","title":"Duplicate Page Plugins <= (Various Versions) - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76044985-477c-4d62-aec3-1905add0a9e2?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-wp-page-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":false,"patched_in":"2.5.7"},{"type":"plugin","slug":"wp-post-page-clone","name":"WP Post Page Clone","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"},{"type":"plugin","slug":"duplicate-page","name":"Duplicate Page","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2020-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:760573ff-bb19-46d2-9a3f-f82875585571","source":"wordfence","cve":"CVE-2025-54040","title":"Webba Booking <= 5.1.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760573ff-bb19-46d2-9a3f-f82875585571?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"5.1.20","to_inclusive":true,"patched_in":"5.1.22"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:26:49Z"},{"id":"wordfence:760cea25-0d1f-4dd7-a85a-6f41173e8c15","source":"wordfence","cve":"CVE-2024-55991","title":"WordPress CRM Plugin \u2013 WP-CRM System <= 3.2.9.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760cea25-0d1f-4dd7-a85a-6f41173e8c15?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.2.9.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-12-14T00:00:00Z","updated":"2025-01-24T18:50:54Z"},{"id":"wordfence:760e12f5-4af5-4fe6-a97c-350f75961b70","source":"wordfence","cve":"CVE-2026-32388","title":"GLB <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760e12f5-4af5-4fe6-a97c-350f75961b70?source=api-prod","affected":[{"type":"theme","slug":"glb","name":"glb","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-15T20:56:03Z"},{"id":"wordfence:760e999e-cac9-493f-9737-ad0cf055c880","source":"wordfence","cve":"CVE-2024-12172","title":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760e999e-cac9-493f-9737-ad0cf055c880?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:23Z"},{"id":"wordfence:760f46b9-23a2-4f30-be40-abb29b096c01","source":"wordfence","cve":"CVE-2025-50013","title":"CSV Importer Improved <= 0.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760f46b9-23a2-4f30-be40-abb29b096c01?source=api-prod","affected":[{"type":"plugin","slug":"csv-importer-improved","name":"CSV Importer Improved","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:01:22Z"},{"id":"wordfence:760f7736-db49-4210-a2f3-3abb506106d7","source":"wordfence","cve":"CVE-2026-3139","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/760f7736-db49-4210-a2f3-3abb506106d7?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-03-30T21:39:25Z","updated":"2026-03-31T11:18:59Z"},{"id":"wordfence:7612b680-fb4a-4c5a-aa46-fb3473da78b4","source":"wordfence","cve":"","title":"Count Per Day <= 3.2.3 - Path Disclosure and Denial of Service","severity":"critical","cvss":9.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7612b680-fb4a-4c5a-aa46-fb3473da78b4?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7614fa27-a5f3-4744-8b1e-716854fe7dac","source":"wordfence","cve":"CVE-2025-68607","title":"Custom Field Template <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7614fa27-a5f3-4744-8b1e-716854fe7dac?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2025-12-24T00:00:00Z","updated":"2026-04-24T19:41:33Z"},{"id":"wordfence:7615c391-ccb1-4990-bbfd-949782cc609a","source":"wordfence","cve":"CVE-2024-11090","title":"Membership Plugin \u2013 Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7615c391-ccb1-4990-bbfd-949782cc609a?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.13","to_inclusive":true,"patched_in":"3.2.14"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T06:41:21Z"},{"id":"wordfence:761a4801-fc4a-40a0-b5aa-303d88a87062","source":"wordfence","cve":"","title":"User Registration <= 1.5.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/761a4801-fc4a-40a0-b5aa-303d88a87062?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2019-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:761c89a5-0176-45e6-87f1-0d510d271f18","source":"wordfence","cve":"CVE-2025-68906","title":"JNews - Video <= 11.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/761c89a5-0176-45e6-87f1-0d510d271f18?source=api-prod","affected":[{"type":"plugin","slug":"jnews-video","name":"JNews - Video","from":"*","from_inclusive":true,"to":"11.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:11:55Z"},{"id":"wordfence:761ec035-5961-45a5-8197-b5209df8bc3a","source":"wordfence","cve":"","title":"Jigoshop \u2013 Store Toolkit <= 1.3.8 - Missing Authorization Checks","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/761ec035-5961-45a5-8197-b5209df8bc3a?source=api-prod","affected":[{"type":"plugin","slug":"jigoshop-store-toolkit","name":"Jigoshop \u2013 Store Toolkit","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2016-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:762190dc-cd19-4bc1-8204-9219881d95e9","source":"wordfence","cve":"CVE-2023-23732","title":"Disqus Conditional Load <= 11.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings.","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/762190dc-cd19-4bc1-8204-9219881d95e9?source=api-prod","affected":[{"type":"plugin","slug":"disqus-conditional-load","name":"Disqus Conditional Load","from":"*","from_inclusive":true,"to":"11.1.1","to_inclusive":true,"patched_in":"11.1.2"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:762be203-b4bb-4618-9916-1ed4f33dbe2e","source":"wordfence","cve":"CVE-2026-16562","title":"Statistics <= 14.16.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/762be203-b4bb-4618-9916-1ed4f33dbe2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.9","to_inclusive":true,"patched_in":"14.16.10"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:40:25Z"},{"id":"wordfence:762c45a4-e699-428c-ae0a-a5b6498e15c6","source":"wordfence","cve":"CVE-2024-54330","title":"Hurrakify <= 2.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/762c45a4-e699-428c-ae0a-a5b6498e15c6?source=api-prod","affected":[{"type":"plugin","slug":"hurrakify","name":"Hurrakify","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"8.0.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:24:56Z"},{"id":"wordfence:762c5217-bea7-4351-92bb-d3e408c47d6a","source":"wordfence","cve":"CVE-2025-27287","title":"SS Quiz <= 2.0.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/762c5217-bea7-4351-92bb-d3e408c47d6a?source=api-prod","affected":[{"type":"plugin","slug":"ssquiz","name":"SS Quiz","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:43:06Z"},{"id":"wordfence:762fe5b1-6290-432f-904f-08dcf966e304","source":"wordfence","cve":"CVE-2026-66457","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/762fe5b1-6290-432f-904f-08dcf966e304?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2026-08-04T00:00:00Z","updated":"2026-09-09T16:08:49Z"},{"id":"wordfence:7632fe73-4011-4e6e-8ce7-38a9359ac259","source":"wordfence","cve":"CVE-2024-6574","title":"Laposta <= 1.12 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7632fe73-4011-4e6e-8ce7-38a9359ac259?source=api-prod","affected":[{"type":"plugin","slug":"laposta","name":"Laposta","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-13T05:38:10Z"},{"id":"wordfence:7633b5cd-0e8f-4744-bfee-d6d54a44c143","source":"wordfence","cve":"CVE-2023-1546","title":"MyCryptoCheckout <= 2.123 - Reflected Cross-Site Scripting via url","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7633b5cd-0e8f-4744-bfee-d6d54a44c143?source=api-prod","affected":[{"type":"plugin","slug":"mycryptocheckout","name":"MyCryptoCheckout \u2013 Bitcoin, Ethereum, and 100+ altcoins for WooCommerce","from":"*","from_inclusive":true,"to":"2.123","to_inclusive":true,"patched_in":"2.124"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7633b5fb-e382-4d72-b23b-ce21f2d207cb","source":"wordfence","cve":"CVE-2025-68060","title":"Team Members \u2013 Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7633b5fb-e382-4d72-b23b-ce21f2d207cb?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-supreme","name":"Team Members \u2013 Multi Language Supported Team Plugin","from":"*","from_inclusive":true,"to":"8.5","to_inclusive":true,"patched_in":"8.6"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:14:04Z"},{"id":"wordfence:7633efe4-f914-4683-a79b-baaa60975282","source":"wordfence","cve":"CVE-2020-10385","title":"Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7633efe4-f914-4683-a79b-baaa60975282?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2020-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76345533-ec81-4a6e-bb20-12449dd63a27","source":"wordfence","cve":"","title":"AddThis <= 5.0.12 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76345533-ec81-4a6e-bb20-12449dd63a27?source=api-prod","affected":[{"type":"plugin","slug":"addthis","name":"WordPress Share Buttons Plugin \u2013 AddThis","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":false,"patched_in":"5.0.13"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76346f96-d2cd-44de-beb0-c15536a7305c","source":"wordfence","cve":"CVE-2024-52419","title":"Copy Anything to Clipboard <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76346f96-d2cd-44de-beb0-c15536a7305c?source=api-prod","affected":[{"type":"plugin","slug":"copy-the-code","name":"Copy Anything to Clipboard for WordPress \u2013 Copy Button, Copy Text & Copy Code","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2024-11-13T00:00:00Z","updated":"2024-12-10T17:44:46Z"},{"id":"wordfence:7635a48a-6ae9-41aa-ba3d-886cf3bfdf54","source":"wordfence","cve":"CVE-2026-92099","title":"WPGraphQL Smart Cache <= 2.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7635a48a-6ae9-41aa-ba3d-886cf3bfdf54?source=api-prod","affected":[{"type":"plugin","slug":"wpgraphql-smart-cache","name":"WPGraphQL Smart Cache","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:51:21Z"},{"id":"wordfence:7638c454-2941-4a86-bb49-c3647b131fac","source":"wordfence","cve":"CVE-2024-51837","title":"WP Contest <= 1.0.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7638c454-2941-4a86-bb49-c3647b131fac?source=api-prod","affected":[{"type":"plugin","slug":"wp-contest","name":"WP Contest","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:26:09Z"},{"id":"wordfence:7638fd24-d376-4b5b-98bb-4a40ada6a4da","source":"wordfence","cve":"CVE-2022-38074","title":"WP Statistics <= 13.2.10 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7638fd24-d376-4b5b-98bb-4a40ada6a4da?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.10","to_inclusive":true,"patched_in":"13.2.11"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:763a7dec-72e3-46d2-a82e-268c577e0289","source":"wordfence","cve":"CVE-2025-22800","title":"Post SMTP <= 2.9.11 - Missing Authorization via regenerate_qrcode()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/763a7dec-72e3-46d2-a82e-268c577e0289?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:53:25Z"},{"id":"wordfence:763a9aff-9bc0-4c79-9383-778a9034b436","source":"wordfence","cve":"CVE-2025-1267","title":"Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/763a9aff-9bc0-4c79-9383-778a9034b436?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"3.7.4.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T06:52:05Z"},{"id":"wordfence:763b8cfd-def2-4f4f-b2fb-e19cb6bb41ad","source":"wordfence","cve":"CVE-2026-111842","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/763b8cfd-def2-4f4f-b2fb-e19cb6bb41ad?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.8"}],"published":"2026-10-22T08:45:00Z","updated":"2026-10-23T18:46:05Z"},{"id":"wordfence:763f0c23-49c8-4e7a-b1c1-d33eb5b1b7c2","source":"wordfence","cve":"CVE-2024-33910","title":"Digital Publications by Supsystic <= 1.7.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/763f0c23-49c8-4e7a-b1c1-d33eb5b1b7c2?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:12:41Z"},{"id":"wordfence:763fec04-72c5-4910-af97-f58b5b69a02e","source":"wordfence","cve":"CVE-2023-28495","title":"WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/763fec04-72c5-4910-af97-f58b5b69a02e?source=api-prod","affected":[{"type":"plugin","slug":"wp-shortcode","name":"WP Shortcode by MyThemeShop","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.4.17"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:764041ca-65cd-498c-97e5-a33d7b54a2b9","source":"wordfence","cve":"CVE-2025-7036","title":"CleverReach WP <= 1.5.20 - Unauthenticated SQL Injection via title Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/764041ca-65cd-498c-97e5-a33d7b54a2b9?source=api-prod","affected":[{"type":"plugin","slug":"cleverreach-wp","name":"CleverReach\u00ae WP","from":"*","from_inclusive":true,"to":"1.5.20","to_inclusive":true,"patched_in":"1.5.21"}],"published":"2025-08-05T13:00:58Z","updated":"2025-08-18T15:59:46Z"},{"id":"wordfence:7641cae5-e173-490d-95c3-754d574eda34","source":"wordfence","cve":"CVE-2025-67567","title":"Sober <= 3.5.11 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7641cae5-e173-490d-95c3-754d574eda34?source=api-prod","affected":[{"type":"theme","slug":"sober","name":"Sober","from":"*","from_inclusive":true,"to":"3.5.11","to_inclusive":true,"patched_in":"3.5.12"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:16:09Z"},{"id":"wordfence:76421c8e-de5f-4469-9a32-09976de873b4","source":"wordfence","cve":"CVE-2026-32496","title":"Spam Protect for Contact Form 7 <= 1.2.9 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76421c8e-de5f-4469-9a32-09976de873b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form-7-spam-blocker","name":"Spam Protect for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:33:46Z"},{"id":"wordfence:764aec73-f291-4372-9dde-812ffaf025ed","source":"wordfence","cve":"CVE-2023-1029","title":"WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/764aec73-f291-4372-9dde-812ffaf025ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:764af015-6741-4290-a2fe-95389eb28f17","source":"wordfence","cve":"CVE-2026-27430","title":"TheFox <= 3.9.76 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/764af015-6741-4290-a2fe-95389eb28f17?source=api-prod","affected":[{"type":"theme","slug":"thefox","name":"TheFox | Responsive Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.76","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-10T19:07:15Z"},{"id":"wordfence:764e496f-5c0c-4c21-83d8-61399244b8ce","source":"wordfence","cve":"CVE-2026-115964","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.126 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/764e496f-5c0c-4c21-83d8-61399244b8ce?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.126","to_inclusive":true,"patched_in":"1.4.127"}],"published":"2026-10-27T10:42:45Z","updated":"2026-11-03T19:28:53Z"},{"id":"wordfence:76516f23-487f-48f6-82c0-88df651ddc65","source":"wordfence","cve":"CVE-2017-17091","title":"WordPress Core < 4.9.1 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76516f23-487f-48f6-82c0-88df651ddc65?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.21","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2017-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76529b0d-6679-4709-851e-5c9c01e7e085","source":"wordfence","cve":"CVE-2025-39485","title":"Grand Tour | Travel Agency WordPress <= 5.5.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76529b0d-6679-4709-851e-5c9c01e7e085?source=api-prod","affected":[{"type":"theme","slug":"grandtour","name":"Grand Tour | Travel Agency WordPress","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T15:52:20Z"},{"id":"wordfence:7659ac9b-fa4e-4cb7-9887-38aa65b6d1c3","source":"wordfence","cve":"CVE-2023-3416","title":"tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7659ac9b-fa4e-4cb7-9887-38aa65b6d1c3?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T09:38:59Z"},{"id":"wordfence:765b09ef-dd6d-4c4e-a381-7bb0dc8d6652","source":"wordfence","cve":"CVE-2023-32498","title":"Easy Form by AYS <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/765b09ef-dd6d-4c4e-a381-7bb0dc8d6652?source=api-prod","affected":[{"type":"plugin","slug":"easy-form","name":"Easy Form","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:765d0933-8db2-471c-ad4e-e19d3b4ff015","source":"wordfence","cve":"CVE-2024-1321","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/765d0933-8db2-471c-ad4e-e19d3b4ff015?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-03-08T00:00:00Z","updated":"2025-11-04T05:28:17Z"},{"id":"wordfence:765df8f4-438c-41b6-ac74-494f1b74cf33","source":"wordfence","cve":"","title":"Cookiebot | GDPR/CCPA Compliant Cookie Consent and Control <=  3.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/765df8f4-438c-41b6-ac74-494f1b74cf33?source=api-prod","affected":[{"type":"plugin","slug":"cookiebot","name":"Cookiebot \u2013 Cookie Banner & Cookie Consent for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":false,"patched_in":"3.6.1"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:766003e7-712e-481b-b09d-91d62a325718","source":"wordfence","cve":"","title":"Get URL Cron <= 1.4.7 - Missing Authorization via geturlcron_action_handle","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766003e7-712e-481b-b09d-91d62a325718?source=api-prod","affected":[{"type":"plugin","slug":"get-url-cron","name":"Cron Setup and Monitor \u2013 Get URL Cron","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7660c8ce-3215-4ecc-8c94-9750878cb37c","source":"wordfence","cve":"CVE-2025-24778","title":"No Spam At All <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7660c8ce-3215-4ecc-8c94-9750878cb37c?source=api-prod","affected":[{"type":"plugin","slug":"no-spam-at-all","name":"No Spam At All","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:52:55Z"},{"id":"wordfence:7661d648-543e-46c8-a859-fb722a0c3fc2","source":"wordfence","cve":"CVE-2022-0398","title":"ThirstyAffiliates Affiliate Link Manager <= 3.10.4 - Subscriber+ Arbitrary Affiliate Links Creation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7661d648-543e-46c8-a859-fb722a0c3fc2?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2022-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7662e554-b62f-49a8-8aab-74c967cd9db5","source":"wordfence","cve":"CVE-2025-67937","title":"Hendon < 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7662e554-b62f-49a8-8aab-74c967cd9db5?source=api-prod","affected":[{"type":"theme","slug":"hendon","name":"Hendon - Single Property WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-14T14:28:10Z"},{"id":"wordfence:7663359c-259e-4d74-8e62-ef4adda3a693","source":"wordfence","cve":"CVE-2025-54743","title":"Download After Email  2.1.5 - 2.1.6 - Unauthorized Repeated Form Submissions","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7663359c-259e-4d74-8e62-ef4adda3a693?source=api-prod","affected":[{"type":"plugin","slug":"download-after-email","name":"Download After Email \u2013 Subscribe & Download Form Plugin","from":"2.1.5","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-30T12:35:56Z"},{"id":"wordfence:76639a75-65f9-4c0c-9182-f8de470da431","source":"wordfence","cve":"CVE-2025-32505","title":"MultiMailer <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76639a75-65f9-4c0c-9182-f8de470da431?source=api-prod","affected":[{"type":"plugin","slug":"scand-multi-mailer","name":"MultiMailer","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:36:21Z"},{"id":"wordfence:76664f7a-b27d-4f2c-9314-92f4515c359f","source":"wordfence","cve":"CVE-2026-5074","title":"ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76664f7a-b27d-4f2c-9314-92f4515c359f?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-06-02T05:30:43Z","updated":"2026-06-02T18:30:46Z"},{"id":"wordfence:76698491-f41a-4184-8b80-fce4a6ff2e04","source":"wordfence","cve":"CVE-2026-0675","title":"NextGEN Download Gallery <= 1.6.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76698491-f41a-4184-8b80-fce4a6ff2e04?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-download-gallery","name":"NextGEN Download Gallery","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T15:13:28Z"},{"id":"wordfence:7669f1d3-450c-4c17-aa1e-44ddda194727","source":"wordfence","cve":"CVE-2026-13357","title":"Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7669f1d3-450c-4c17-aa1e-44ddda194727?source=api-prod","affected":[{"type":"plugin","slug":"houzez-property-feed","name":"Houzez Property Feed","from":"*","from_inclusive":true,"to":"2.5.46","to_inclusive":true,"patched_in":"2.5.47"}],"published":"2026-07-01T16:40:50Z","updated":"2026-07-02T05:35:07Z"},{"id":"wordfence:766ac399-7280-4186-8972-94da813da85e","source":"wordfence","cve":"CVE-2024-1328","title":"Newsletter2Go <= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766ac399-7280-4186-8972-94da813da85e?source=api-prod","affected":[{"type":"plugin","slug":"newsletter2go","name":"Newsletter2Go","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-05-29T14:33:10Z"},{"id":"wordfence:766b0bde-c555-40c1-b174-20045bd89c11","source":"wordfence","cve":"CVE-2024-3189","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766b0bde-c555-40c1-b174-20045bd89c11?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.37","to_inclusive":true,"patched_in":"3.2.38"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T02:32:46Z"},{"id":"wordfence:766b5c62-0701-47d5-9839-445c2654d3e0","source":"wordfence","cve":"","title":"WP Accessibility < 1.7.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766b5c62-0701-47d5-9839-445c2654d3e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility","name":"WP Accessibility","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2019-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:766c2aa5-e829-45b9-b6e3-0a522a0977d4","source":"wordfence","cve":"CVE-2022-44738","title":"Posts and Users Stats <= 1.1.3 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766c2aa5-e829-45b9-b6e3-0a522a0977d4?source=api-prod","affected":[{"type":"plugin","slug":"posts-and-users-stats","name":"Posts and Users Stats","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-02T00:00:00Z","updated":"2024-10-24T18:54:14Z"},{"id":"wordfence:766cb6d0-1839-4d8c-819c-4e5dab408f6c","source":"wordfence","cve":"CVE-2024-12588","title":"Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766cb6d0-1839-4d8c-819c-4e5dab408f6c?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":true,"patched_in":"2.17.3"}],"published":"2024-12-20T20:19:42Z","updated":"2025-03-06T20:54:04Z"},{"id":"wordfence:766e34a9-ed95-4049-ba48-0bf69134e4ba","source":"wordfence","cve":"CVE-2023-4250","title":"EventPrime < 3.2.0 - Reflected Cross-Site Scripting via keyword and ep_filter_date","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766e34a9-ed95-4049-ba48-0bf69134e4ba?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:766e3966-157a-4db3-9179-813032343f76","source":"wordfence","cve":"CVE-2024-1991","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766e3966-157a-4db3-9179-813032343f76?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.3.0.0","to_inclusive":true,"patched_in":"5.3.1.0"}],"published":"2024-03-14T00:00:00Z","updated":"2024-04-09T18:58:59Z"},{"id":"wordfence:76734ad0-e8e8-4106-858b-0f77d2ac17ec","source":"wordfence","cve":"CVE-2024-6021","title":"Donation Block For PayPal <=  2.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76734ad0-e8e8-4106-858b-0f77d2ac17ec?source=api-prod","affected":[{"type":"plugin","slug":"donations-block","name":"Donation Block For PayPal","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-26T16:41:14Z"},{"id":"wordfence:7673b2ba-5d7a-4ae9-92e7-1a910687fdb8","source":"wordfence","cve":"CVE-2024-1165","title":"Brizy \u2013 Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7673b2ba-5d7a-4ae9-92e7-1a910687fdb8?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.40","to_inclusive":true,"patched_in":"2.4.41"}],"published":"2024-02-23T00:00:00Z","updated":"2024-02-24T09:38:22Z"},{"id":"wordfence:7678b80f-3184-4979-b1f4-25cd75836010","source":"wordfence","cve":"CVE-2023-34025","title":"LWS Hide Login <= 2.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7678b80f-3184-4979-b1f4-25cd75836010?source=api-prod","affected":[{"type":"plugin","slug":"lws-hide-login","name":"LWS Hide Login","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:767b1234-5b4a-4baa-9048-7b2e413cdba5","source":"wordfence","cve":"CVE-2024-8632","title":"KB Support \u2013 WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/767b1234-5b4a-4baa-9048-7b2e413cdba5?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-17T16:08:02Z"},{"id":"wordfence:767bd8dd-993f-48d3-92f1-669d2329f1ab","source":"wordfence","cve":"CVE-2022-46867","title":"Universal Star Rating <= 2.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/767bd8dd-993f-48d3-92f1-669d2329f1ab?source=api-prod","affected":[{"type":"plugin","slug":"universal-star-rating","name":"Universal Star Rating","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:767fb03a-58a3-464b-98b2-5378cfec09ae","source":"wordfence","cve":"CVE-2026-82814","title":"Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/767fb03a-58a3-464b-98b2-5378cfec09ae?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"5.0.0"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-20T13:29:13Z","updated":"2026-10-21T01:30:39Z"},{"id":"wordfence:7681a661-21bd-42fb-ac97-1da808435520","source":"wordfence","cve":"","title":"Qubely <= 1.7.8 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7681a661-21bd-42fb-ac97-1da808435520?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7681f984-d488-4da7-afe1-988e5ad012f2","source":"wordfence","cve":"CVE-2023-6629","title":"POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:38Z"},{"id":"wordfence:76820ffd-5f35-46d0-b54a-2488ee96ee7a","source":"wordfence","cve":"CVE-2026-14823","title":"Event Tickets and Registration < 5.29.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76820ffd-5f35-46d0-b54a-2488ee96ee7a?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.0.1","to_inclusive":false,"patched_in":"5.29.0.1"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:27:50Z"},{"id":"wordfence:76827a76-f5f7-49e4-88e3-4446c0bce670","source":"wordfence","cve":"CVE-2026-112218","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76827a76-f5f7-49e4-88e3-4446c0bce670?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-10-22T08:46:00Z","updated":"2026-10-23T18:48:57Z"},{"id":"wordfence:7683a91d-8c16-481e-a300-590ac378890a","source":"wordfence","cve":"CVE-2024-30186","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7683a91d-8c16-481e-a300-590ac378890a?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T17:05:49Z"},{"id":"wordfence:7683e708-b7cb-444e-9069-f33e4ef3ac76","source":"wordfence","cve":"CVE-2025-7500","title":"Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7683e708-b7cb-444e-9069-f33e4ef3ac76?source=api-prod","affected":[{"type":"plugin","slug":"ocean-social-sharing","name":"Ocean Social Sharing","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-08-01T21:38:40Z","updated":"2025-08-02T11:23:56Z"},{"id":"wordfence:768730c1-a70e-432d-a234-4ce2b8aec424","source":"wordfence","cve":"CVE-2024-13818","title":"Registration Forms \u2013 User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/768730c1-a70e-432d-a234-4ce2b8aec424?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.8.4.1"}],"published":"2025-02-20T15:01:12Z","updated":"2025-03-18T17:55:15Z"},{"id":"wordfence:7689d8f4-9311-40f6-a4c3-117abfcf91e1","source":"wordfence","cve":"CVE-2024-52452","title":"Open edX LMS <= 2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7689d8f4-9311-40f6-a4c3-117abfcf91e1?source=api-prod","affected":[{"type":"plugin","slug":"edunext-openedx-integrator","name":"Open edX LMS and WordPress integrator (LITE)","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:08:33Z"},{"id":"wordfence:768d0d53-8724-4598-ae73-305225b52633","source":"wordfence","cve":"CVE-2026-40771","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/768d0d53-8724-4598-ae73-305225b52633?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.6","to_inclusive":true,"patched_in":"28.1.7"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:56:53Z"},{"id":"wordfence:768d0ef5-5213-4283-b95e-ddfe0d2196bf","source":"wordfence","cve":"CVE-2024-13573","title":"Zigaform \u2013 Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/768d0ef5-5213-4283-b95e-ddfe0d2196bf?source=api-prod","affected":[{"type":"plugin","slug":"zigaform-form-builder-lite","name":"Zigaform \u2013 Form Builder Lite","from":"*","from_inclusive":true,"to":"7.4.7","to_inclusive":true,"patched_in":"7.4.8"}],"published":"2025-02-17T15:43:23Z","updated":"2025-03-12T13:25:02Z"},{"id":"wordfence:768fb279-8d35-4002-91d8-c6a3b0f8f51d","source":"wordfence","cve":"CVE-2026-3850","title":"Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/768fb279-8d35-4002-91d8-c6a3b0f8f51d?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.5","to_inclusive":true,"patched_in":"4.27.7"}],"published":"2026-09-01T17:38:06Z","updated":"2026-09-02T06:37:34Z"},{"id":"wordfence:7691152e-f962-4d82-b877-df1345b703cc","source":"wordfence","cve":"CVE-2022-37404","title":"add2fav <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7691152e-f962-4d82-b877-df1345b703cc?source=api-prod","affected":[{"type":"plugin","slug":"add2fav","name":"add2fav","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76986a3a-67f8-4d91-9f48-88fad356c3b4","source":"wordfence","cve":"CVE-2026-103519","title":"WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76986a3a-67f8-4d91-9f48-88fad356c3b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-02T17:41:13Z","updated":"2026-10-03T06:38:24Z"},{"id":"wordfence:7699f6bd-b965-412d-80f5-a999f2299e12","source":"wordfence","cve":"CVE-2026-22437","title":"Playa | Beach & Pool Club WordPress Theme <= 1.3.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7699f6bd-b965-412d-80f5-a999f2299e12?source=api-prod","affected":[{"type":"theme","slug":"playa","name":"Playa | Beach & Pool Club WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:36:30Z"},{"id":"wordfence:7699f741-b743-4fe7-9acb-d81d4da711ce","source":"wordfence","cve":"CVE-2026-57641","title":"Real Estate 7 WordPress <= 3.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7699f741-b743-4fe7-9acb-d81d4da711ce?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:38:20Z"},{"id":"wordfence:769a39e0-f626-4c48-a1bb-c9f2402b3098","source":"wordfence","cve":"CVE-2026-103426","title":"Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769a39e0-f626-4c48-a1bb-c9f2402b3098?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.31.4","to_inclusive":true,"patched_in":"2.31.5"}],"published":"2026-10-01T19:23:36Z","updated":"2026-10-02T07:39:25Z"},{"id":"wordfence:769b9846-8c1d-4b7f-8bbe-d6665407cedb","source":"wordfence","cve":"CVE-2025-69088","title":"Combo Offers WooCommerce <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769b9846-8c1d-4b7f-8bbe-d6665407cedb?source=api-prod","affected":[{"type":"plugin","slug":"woo-combo-offers","name":"Combo Offers WooCommerce","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.3"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:07:18Z"},{"id":"wordfence:769bc1fa-4f41-431e-9907-6e03d2c921be","source":"wordfence","cve":"CVE-2024-13463","title":"SeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769bc1fa-4f41-431e-9907-6e03d2c921be?source=api-prod","affected":[{"type":"plugin","slug":"seatreg","name":"SeatReg","from":"*","from_inclusive":true,"to":"1.56.0","to_inclusive":true,"patched_in":"1.56.1"}],"published":"2025-01-30T15:02:59Z","updated":"2025-01-31T03:21:28Z"},{"id":"wordfence:769c8483-2975-44d3-9a2b-e015a5d00708","source":"wordfence","cve":"CVE-2025-31789","title":"TextMe SMS <= 1.9.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769c8483-2975-44d3-9a2b-e015a5d00708?source=api-prod","affected":[{"type":"plugin","slug":"textme-sms-integration","name":"TextMe SMS","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-04-03T00:00:00Z","updated":"2025-05-12T14:06:19Z"},{"id":"wordfence:769d05ce-3ddd-48bf-862b-425435f9d042","source":"wordfence","cve":"CVE-2026-87764","title":"BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769d05ce-3ddd-48bf-862b-425435f9d042?source=api-prod","affected":[{"type":"plugin","slug":"bp-instant-chat","name":"BuddyPress Instant Chat","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:16:34Z"},{"id":"wordfence:769da699-f5dc-4faf-9a4e-a98d76106f47","source":"wordfence","cve":"CVE-2026-81196","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769da699-f5dc-4faf-9a4e-a98d76106f47?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:38:27Z"},{"id":"wordfence:769fbe66-fcf5-4b16-8cc3-7c9bc561257a","source":"wordfence","cve":"","title":"The WP Remote WordPress Plugin <= 4.64 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/769fbe66-fcf5-4b16-8cc3-7c9bc561257a?source=api-prod","affected":[{"type":"plugin","slug":"wpremote","name":"The WP Remote WordPress Plugin","from":"*","from_inclusive":true,"to":"4.64","to_inclusive":true,"patched_in":"4.65"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76a0a87a-dff0-4a51-bad0-8868c342ecde","source":"wordfence","cve":"CVE-2023-6969","title":"User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76a0a87a-dff0-4a51-bad0-8868c342ecde?source=api-prod","affected":[{"type":"plugin","slug":"user-shortcodes-plus","name":"User Shortcodes Plus","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-10-24T19:19:55Z"},{"id":"wordfence:76a1d39e-8d69-4507-b75c-d376a2122d15","source":"wordfence","cve":"CVE-2023-25473","title":"Flickr Justified Gallery <= 3.5 - Cross-Site Request Forgery via fjgwpp_settings()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76a1d39e-8d69-4507-b75c-d376a2122d15?source=api-prod","affected":[{"type":"plugin","slug":"flickr-justified-gallery","name":"Flickr Justified Gallery","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76a4dbcd-b3f3-48e9-8175-c701837ac2ae","source":"wordfence","cve":"","title":"Chained Quiz <= 0.9.8 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76a4dbcd-b3f3-48e9-8175-c701837ac2ae?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2016-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76a52a46-fd97-4246-a4fa-e97c614c6666","source":"wordfence","cve":"CVE-2026-42645","title":"Barcode Scanner with Inventory & Order Manager <= 1.11.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76a52a46-fd97-4246-a4fa-e97c614c6666?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-05-07T14:03:45Z"},{"id":"wordfence:76a5b421-beba-4e13-9819-350fabf459b3","source":"wordfence","cve":"CVE-2025-31791","title":"Pin Generator <= 2.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76a5b421-beba-4e13-9819-350fabf459b3?source=api-prod","affected":[{"type":"plugin","slug":"pin-generator","name":"Pin Generator","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-12T14:12:02Z"},{"id":"wordfence:76ac20e0-c4d1-40ad-8f15-70aad547f08f","source":"wordfence","cve":"","title":"Expose (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76ac20e0-c4d1-40ad-8f15-70aad547f08f?source=api-prod","affected":[{"type":"theme","slug":"expose","name":"Expose","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76ad6d21-f277-496f-aa6b-f9d5cb8a3801","source":"wordfence","cve":"CVE-2026-15103","title":"WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76ad6d21-f277-496f-aa6b-f9d5cb8a3801?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.12.8","to_inclusive":true,"patched_in":"3.12.9"}],"published":"2026-07-15T20:13:20Z","updated":"2026-07-16T08:26:50Z"},{"id":"wordfence:76af3f0a-2e35-4059-960c-09769459bc01","source":"wordfence","cve":"CVE-2023-25467","title":"Resize at Upload Plus <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76af3f0a-2e35-4059-960c-09769459bc01?source=api-prod","affected":[{"type":"plugin","slug":"resize-at-upload-plus","name":"Resize at Upload Plus","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76af4656-547b-4daf-9078-8ed2b425d1ca","source":"wordfence","cve":"CVE-2017-14725","title":"WordPress Core < 4.8.2 - Open Redirect in Admin Dashboard","severity":"low","cvss":3.5,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76af4656-547b-4daf-9078-8ed2b425d1ca?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76b0c41c-c825-4ac2-8a7f-4b1a54f21f0b","source":"wordfence","cve":"","title":"Smart Start <= 1.0.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b0c41c-c825-4ac2-8a7f-4b1a54f21f0b?source=api-prod","affected":[{"type":"theme","slug":"smartstart","name":"SmartStart WP - Responsive HTML5 Theme | Creative","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76b0eac4-de08-4f73-9897-6047374243ba","source":"wordfence","cve":"CVE-2025-30968","title":"Advanced Post List <= 0.5.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b0eac4-de08-4f73-9897-6047374243ba?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-list","name":"Advanced Post List","from":"*","from_inclusive":true,"to":"0.5.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T14:58:19Z"},{"id":"wordfence:76b11177-782a-4d9c-a974-4cb9ff55fa99","source":"wordfence","cve":"CVE-2018-5366","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[more_languages]","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b11177-782a-4d9c-a974-4cb9ff55fa99?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76b1f8d8-ab5f-4ce8-a30b-8e9eb0e127a5","source":"wordfence","cve":"CVE-2026-7842","title":"Infility Global < 2.15.20 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b1f8d8-ab5f-4ce8-a30b-8e9eb0e127a5?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.20","to_inclusive":false,"patched_in":"2.15.20"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:49:26Z"},{"id":"wordfence:76b25ae3-b813-4e79-a5e3-0af5e6eb8a06","source":"wordfence","cve":"CVE-2024-31089","title":"Platinum SEO <= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b25ae3-b813-4e79-a5e3-0af5e6eb8a06?source=api-prod","affected":[{"type":"plugin","slug":"platinum-seo-pack","name":"Platinum SEO","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:56:53Z"},{"id":"wordfence:76b3b5b7-fefe-44fb-a30e-c55226d4aaea","source":"wordfence","cve":"CVE-2023-49172","title":"BrainCert \u2013 HTML5 Virtual Classroom <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b3b5b7-fefe-44fb-a30e-c55226d4aaea?source=api-prod","affected":[{"type":"plugin","slug":"html5-virtual-classroom","name":"BrainCert Virtual Classroom","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-11-29T00:00:00Z","updated":"2024-05-20T18:36:01Z"},{"id":"wordfence:76b4e3d1-170c-4fe0-8e84-246b973d48b1","source":"wordfence","cve":"CVE-2024-47376","title":"Slideshow Gallery <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b4e3d1-170c-4fe0-8e84-246b973d48b1?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:07:12Z"},{"id":"wordfence:76b75e61-e7f8-41cc-ab4f-e6ca42d68308","source":"wordfence","cve":"CVE-2026-6514","title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b75e61-e7f8-41cc-ab4f-e6ca42d68308?source=api-prod","affected":[{"type":"plugin","slug":"infusedwooPRO","name":"InfusedWoo Pro","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-13T19:52:06Z","updated":"2026-05-14T08:24:26Z"},{"id":"wordfence:76b7a946-71ad-46da-95f6-a02703812938","source":"wordfence","cve":"CVE-2025-11724","title":"EM Beer Manager <= 3.2.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b7a946-71ad-46da-95f6-a02703812938?source=api-prod","affected":[{"type":"plugin","slug":"em-beer-manager","name":"EM Beer Manager","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:34:22Z","updated":"2025-11-04T04:27:18Z"},{"id":"wordfence:76b8e263-7073-4f93-95cb-0b61580337b3","source":"wordfence","cve":"CVE-2024-43208","title":"Send Emails with Mandrill <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b8e263-7073-4f93-95cb-0b61580337b3?source=api-prod","affected":[{"type":"plugin","slug":"send-emails-with-mandrill","name":"Send Emails with Mandrill","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-08-09T00:00:00Z","updated":"2024-09-05T15:32:40Z"},{"id":"wordfence:76b987f1-2524-498a-a02c-a3ca390026e1","source":"wordfence","cve":"CVE-2024-3489","title":"Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76b987f1-2524-498a-a02c-a3ca390026e1?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.4","to_inclusive":true,"patched_in":"2.6.9.5"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:52:14Z"},{"id":"wordfence:76ba273d-0919-45b3-8044-b8f0ff3972ab","source":"wordfence","cve":"CVE-2023-44477","title":"Cooked <= 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76ba273d-0919-45b3-8044-b8f0ff3972ab?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.14","to_inclusive":true,"patched_in":"1.7.15.1"}],"published":"2023-09-29T00:00:00Z","updated":"2024-04-18T19:38:54Z"},{"id":"wordfence:76bb0578-d562-4612-b7aa-db49c43b2fe1","source":"wordfence","cve":"CVE-2015-9492","title":"SmartIT Premium Responsive (Unspecified Version) - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76bb0578-d562-4612-b7aa-db49c43b2fe1?source=api-prod","affected":[{"type":"theme","slug":"smartit","name":"SmartIT Premium Responsive","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76bec529-bf1f-4f99-a809-3642f8c7e433","source":"wordfence","cve":"CVE-2026-96667","title":"Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76bec529-bf1f-4f99-a809-3642f8c7e433?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2026-10-09T16:56:59Z","updated":"2026-10-10T05:31:00Z"},{"id":"wordfence:76c073d9-9572-43e4-82eb-49adf678535b","source":"wordfence","cve":"CVE-2026-10196","title":"Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c073d9-9572-43e4-82eb-49adf678535b?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T11:28:47Z"},{"id":"wordfence:76c0d4f8-230d-452a-b39d-cbcb0af0fd72","source":"wordfence","cve":"CVE-2021-24242","title":"Tutor LMS <= 1.8.7 - Authenticated Local File Inclusion","severity":"medium","cvss":5.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c0d4f8-230d-452a-b39d-cbcb0af0fd72?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2021-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76c292dc-e9da-4256-82df-58ac5def4771","source":"wordfence","cve":"CVE-2024-8742","title":"Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c292dc-e9da-4256-82df-58ac5def4771?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-09-12T17:39:27Z","updated":"2024-09-13T06:47:29Z"},{"id":"wordfence:76c31190-9db9-4d14-83e0-cbfca812e8ea","source":"wordfence","cve":"CVE-2026-3132","title":"Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c31190-9db9-4d14-83e0-cbfca812e8ea?source=api-prod","affected":[{"type":"plugin","slug":"master-addons-pro","name":"Master Addons for Elementor Premium","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-03-02T04:48:53Z","updated":"2026-03-02T17:23:35Z"},{"id":"wordfence:76c38826-4d49-4204-b6b6-b01d01373fa9","source":"wordfence","cve":"CVE-2024-5481","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function","severity":"medium","cvss":6.8,"cwe":"CWE-35","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c38826-4d49-4204-b6b6-b01d01373fa9?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.23","to_inclusive":true,"patched_in":"1.8.24"}],"published":"2024-06-06T21:19:21Z","updated":"2024-06-07T09:33:36Z"},{"id":"wordfence:76c39a00-b40a-4d06-96bc-864624e0ef8b","source":"wordfence","cve":"CVE-2019-6027","title":"WP Spell Check <= 7.1.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c39a00-b40a-4d06-96bc-864624e0ef8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"7.1.9","to_inclusive":true,"patched_in":"7.1.10"}],"published":"2019-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76c468cb-8ad6-4b62-8de5-dc8efd4b8e61","source":"wordfence","cve":"CVE-2023-1425","title":"Groundhogg <= 2.7.9.3 - Authenticated (Administrator)+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c468cb-8ad6-4b62-8de5-dc8efd4b8e61?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.3","to_inclusive":true,"patched_in":"2.7.9.4"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76c5559d-f9dd-43cf-8c8e-07188b4edf7f","source":"wordfence","cve":"CVE-2024-13906","title":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c5559d-f9dd-43cf-8c8e-07188b4edf7f?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T07:22:24Z"},{"id":"wordfence:76c5b5f1-a04b-4219-b8c0-ee53139fa787","source":"wordfence","cve":"CVE-2026-87112","title":"QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c5b5f1-a04b-4219-b8c0-ee53139fa787?source=api-prod","affected":[{"type":"plugin","slug":"qa-heatmap-analytics","name":"QA Assistants \u2013 Driven by data","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.0.1"}],"published":"2026-11-06T18:15:14Z","updated":"2026-11-07T06:39:37Z"},{"id":"wordfence:76c6fa7e-9250-464e-a7ee-8a6814e18446","source":"wordfence","cve":"CVE-2025-23568","title":"WP Login Attempt Log <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c6fa7e-9250-464e-a7ee-8a6814e18446?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-attempt-log","name":"WP Login Attempt Log","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:45:11Z"},{"id":"wordfence:76c8ffac-6971-4161-bd83-f53f6c6158db","source":"wordfence","cve":"CVE-2024-38703","title":"WP Event Aggregator <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c8ffac-6971-4161-bd83-f53f6c6158db?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-aggregator","name":"WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:34:44Z"},{"id":"wordfence:76c9384d-880b-4dc5-9961-cb727f2d7cdf","source":"wordfence","cve":"CVE-2025-53335","title":"Berger <= 1.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76c9384d-880b-4dc5-9961-cb727f2d7cdf?source=api-prod","affected":[{"type":"theme","slug":"berger","name":"Berger - WordPress Creative Agency Portfolio Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:13:54Z"},{"id":"wordfence:76ccc688-79c0-4b6e-aac9-cf18baf9af46","source":"wordfence","cve":"CVE-2022-4679","title":"Wufoo Shortcode <= 1.51 - Authenticated (Contributor+) Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76ccc688-79c0-4b6e-aac9-cf18baf9af46?source=api-prod","affected":[{"type":"plugin","slug":"wufoo-shortcode","name":"Wufoo Shortcode","from":"*","from_inclusive":true,"to":"1.51","to_inclusive":true,"patched_in":"1.52"}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76cd5762-1ad4-4b76-8161-5a4ce4fc8118","source":"wordfence","cve":"CVE-2022-23183","title":"Advanced Custom Fields <= 5.12 - Authenticated Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76cd5762-1ad4-4b76-8161-5a4ce4fc8118?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.12.1","to_inclusive":false,"patched_in":"5.12.1"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"5.12.1","to_inclusive":false,"patched_in":"5.12.1"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76cfe806-a8d9-4249-b2d0-eb3a314ca69a","source":"wordfence","cve":"CVE-2025-7727","title":"Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76cfe806-a8d9-4249-b2d0-eb3a314ca69a?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-08-05T17:41:10Z","updated":"2025-08-06T06:38:39Z"},{"id":"wordfence:76d10adf-5a17-49af-8ce3-f0714e8c2da6","source":"wordfence","cve":"CVE-2025-57927","title":"Dashboard Notepad <= 1.42 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d10adf-5a17-49af-8ce3-f0714e8c2da6?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-notepad","name":"Dashboard Notepad","from":"*","from_inclusive":true,"to":"1.42","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:23:23Z"},{"id":"wordfence:76d57372-9fb5-4166-bfa9-835e3ff7b755","source":"wordfence","cve":"CVE-2021-24873","title":"Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d57372-9fb5-4166-bfa9-835e3ff7b755?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.9.11"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76d7588e-7062-419a-b0a2-ddc1955a710c","source":"wordfence","cve":"CVE-2024-34564","title":"Counter Up \u2013 Animated Number Counter & Milestone Showcase <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d7588e-7062-419a-b0a2-ddc1955a710c?source=api-prod","affected":[{"type":"plugin","slug":"wp-counter-up","name":"WP Counter Up \u2013 Animated Number Counter & Milestone Showcase","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:06:41Z"},{"id":"wordfence:76d79ced-54cd-4b06-9b13-eaf7b0e02aa4","source":"wordfence","cve":"CVE-2025-69340","title":"WeDesignTech Ultimate Booking Addon <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d79ced-54cd-4b06-9b13-eaf7b0e02aa4?source=api-prod","affected":[{"type":"plugin","slug":"wedesigntech-ultimate-booking-addon","name":"WeDesignTech Ultimate Booking Addon","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:35:55Z"},{"id":"wordfence:76d850dd-75f3-4671-9561-0e361d09a121","source":"wordfence","cve":"","title":"Pods \u2013 Custom Content Types and Fields <= 2.7.28 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d850dd-75f3-4671-9561-0e361d09a121?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.7.28","to_inclusive":true,"patched_in":"2.7.29"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76d8c4dd-6ab2-4c48-b7d9-104ffdba55c6","source":"wordfence","cve":"CVE-2025-32643","title":"WPGYM < 67.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d8c4dd-6ab2-4c48-b7d9-104ffdba55c6?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.8.0","to_inclusive":false,"patched_in":"67.8.0"}],"published":"2025-05-16T00:00:00Z","updated":"2026-03-17T21:23:17Z"},{"id":"wordfence:76d96ab1-e667-4242-aee3-95f8dfb07ccd","source":"wordfence","cve":"","title":"WordPress File Monitor <= 2.3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76d96ab1-e667-4242-aee3-95f8dfb07ccd?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-file-monitor","name":"WordPress File Monitor","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2016-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76dbd82d-60a4-40c8-8f66-6bbe45b4d199","source":"wordfence","cve":"CVE-2025-6327","title":"King Addons for Elementor <= 51.1.36 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76dbd82d-60a4-40c8-8f66-6bbe45b4d199?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.36","to_inclusive":true,"patched_in":"51.1.37"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-29T15:46:49Z"},{"id":"wordfence:76dc5fc0-adb9-401c-ab50-e0cb23a88fa3","source":"wordfence","cve":"CVE-2024-39622","title":"ListingPro <= 2.9.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76dc5fc0-adb9-401c-ab50-e0cb23a88fa3?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2026-02-26T15:16:47Z"},{"id":"wordfence:76dcb0f4-cb5b-447c-8cd1-ae97196d73a5","source":"wordfence","cve":"CVE-2026-66575","title":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76dcb0f4-cb5b-447c-8cd1-ae97196d73a5?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.81","to_inclusive":true,"patched_in":"51.1.82"}],"published":"2026-09-17T11:55:00Z","updated":"2026-09-22T18:30:31Z"},{"id":"wordfence:76e185c3-d62b-42f7-a943-0498da2d76ce","source":"wordfence","cve":"CVE-2016-10987","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 Persian WooCommerce SMS < 3.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e185c3-d62b-42f7-a943-0498da2d76ce?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76e2aec2-fd46-40b7-8a94-aae8e7cbc12d","source":"wordfence","cve":"CVE-2026-77693","title":"Order Tip for WooCommerce < 1.6.0 - Authenticated (Shop Manager+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e2aec2-fd46-40b7-8a94-aae8e7cbc12d?source=api-prod","affected":[{"type":"plugin","slug":"order-tip-woo","name":"Order Tip for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T14:13:38Z"},{"id":"wordfence:76e35dc6-a4d2-4dca-a186-395f0dd954aa","source":"wordfence","cve":"CVE-2023-5057","title":"ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e35dc6-a4d2-4dca-a186-395f0dd954aa?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"0.17.0","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76e41376-3db0-481b-9f86-bb77b00882e0","source":"wordfence","cve":"","title":"Mistape 1.4.0 - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e41376-3db0-481b-9f86-bb77b00882e0?source=api-prod","affected":[{"type":"plugin","slug":"mistape","name":"Mistape","from":"1.4.0","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76e46759-ff83-4a6b-b510-28965c88bb94","source":"wordfence","cve":"CVE-2019-15778","title":"Additional Variation Images Gallery for WooCommerce <= 1.1.28 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e46759-ff83-4a6b-b510-28965c88bb94?source=api-prod","affected":[{"type":"plugin","slug":"woo-variation-gallery","name":"Additional Variation Images Gallery for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.29","to_inclusive":false,"patched_in":"1.2.29"}],"published":"2019-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76e468fe-437e-4ca7-9485-b97990af2d01","source":"wordfence","cve":"CVE-2026-56014","title":"Master Slider \u2013 Responsive Touch Slider <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e468fe-437e-4ca7-9485-b97990af2d01?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:48:38Z"},{"id":"wordfence:76e4bde3-e815-49c1-9098-c09a54e2274a","source":"wordfence","cve":"CVE-2024-51800","title":"Homey <= 2.4.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e4bde3-e815-49c1-9098-c09a54e2274a?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:54:10Z"},{"id":"wordfence:76e941b1-6c64-496e-863b-406375e59a7c","source":"wordfence","cve":"CVE-2025-53422","title":"WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76e941b1-6c64-496e-863b-406375e59a7c?source=api-prod","affected":[{"type":"plugin","slug":"tw-whatsapp-chat-rotator","name":"WhatsApp Chat for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-18T00:00:00Z","updated":"2025-11-04T18:23:10Z"},{"id":"wordfence:76eff464-69f0-47c1-bdcb-f8caa28a1280","source":"wordfence","cve":"CVE-2013-1916","title":"User Photo <= 0.9.4 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76eff464-69f0-47c1-bdcb-f8caa28a1280?source=api-prod","affected":[{"type":"plugin","slug":"user-photo","name":"User Photo","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2011-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76f32441-ce6a-472d-a437-c284cb91eb8c","source":"wordfence","cve":"CVE-2017-17719","title":"WP Concours <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76f32441-ce6a-472d-a437-c284cb91eb8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-concours","name":"WP Concours","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76f37d0c-d994-402e-83e3-462aea88e243","source":"wordfence","cve":"CVE-2026-103306","title":"iKhokha Payment Gateway <= 3.0.3 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76f37d0c-d994-402e-83e3-462aea88e243?source=api-prod","affected":[{"type":"plugin","slug":"ikhokha-payment-gateway","name":"Online Payments with iK Pay Gateway","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:13:11Z"},{"id":"wordfence:76f549ff-4c96-4cb4-a8c7-4967ec79727e","source":"wordfence","cve":"CVE-2025-64192","title":"XStore < 9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76f549ff-4c96-4cb4-a8c7-4967ec79727e?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":false,"patched_in":"9.6"}],"published":"2025-09-10T00:00:00Z","updated":"2025-12-20T19:02:24Z"},{"id":"wordfence:76f7ca62-50b0-4d67-a6f6-7e79cadafc3f","source":"wordfence","cve":"CVE-2025-68599","title":"YouTube Embed <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76f7ca62-50b0-4d67-a6f6-7e79cadafc3f?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed","name":"Embeds for YouTube","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-05T18:57:38Z"},{"id":"wordfence:76f9d37e-1339-4267-aaf6-38a591e97fa2","source":"wordfence","cve":"","title":"WP Database Backup <= 4.3.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76f9d37e-1339-4267-aaf6-38a591e97fa2?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":false,"patched_in":"4.3.6"}],"published":"2016-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76fb0ffd-32c1-483d-ae95-9bc70ba1c064","source":"wordfence","cve":"CVE-2026-120558","title":"Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76fb0ffd-32c1-483d-ae95-9bc70ba1c064?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-shipment-tracking","name":"Advanced Shipment Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-07-28T21:25:46Z","updated":"2026-11-03T04:43:08Z"},{"id":"wordfence:76fb7f1d-4f41-4a73-acbf-c0f49f0123b4","source":"wordfence","cve":"CVE-2018-20231","title":"Two Factor Authentication <= 1.3.12 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76fb7f1d-4f41-4a73-acbf-c0f49f0123b4?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-authentication","name":"Two Factor Authentication","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":false,"patched_in":"1.3.13"}],"published":"2018-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:76fca864-d97e-443a-aec0-c43391c0ecb5","source":"wordfence","cve":"CVE-2026-111829","title":"WP Mailster <= 1.9.1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76fca864-d97e-443a-aec0-c43391c0ecb5?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.9.1.0","to_inclusive":true,"patched_in":"1.9.2.0"}],"published":"2026-10-19T13:27:00Z","updated":"2026-10-23T18:29:05Z"},{"id":"wordfence:76fe8746-582e-49a5-b0c1-19d2aaef44df","source":"wordfence","cve":"CVE-2024-1094","title":"Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76fe8746-582e-49a5-b0c1-19d2aaef44df?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2024-06-13T00:00:00Z","updated":"2024-07-02T14:37:04Z"},{"id":"wordfence:76ff305f-dc92-44ec-90bb-b504ed9b930e","source":"wordfence","cve":"CVE-2024-13862","title":"S3Bubble Media Streaming <= 8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/76ff305f-dc92-44ec-90bb-b504ed9b930e?source=api-prod","affected":[{"type":"plugin","slug":"s3bubble-amazon-web-services-oembed-media-streaming-support","name":"S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T16:08:55Z"},{"id":"wordfence:7700f1f3-90e2-450d-9cfe-c922d0cc6a1e","source":"wordfence","cve":"CVE-2024-11902","title":"Slope Widgets <= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7700f1f3-90e2-450d-9cfe-c922d0cc6a1e?source=api-prod","affected":[{"type":"plugin","slug":"slope-widgets","name":"Slope Widgets","from":"*","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"4.2.13"}],"published":"2024-12-16T10:47:09Z","updated":"2024-12-23T17:29:30Z"},{"id":"wordfence:7701f05b-3c74-4e0b-aa12-3a17f799ca67","source":"wordfence","cve":"CVE-2025-31608","title":"CookieHint WP <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7701f05b-3c74-4e0b-aa12-3a17f799ca67?source=api-prod","affected":[{"type":"plugin","slug":"cookiehint-wp","name":"CookieHint WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:14:26Z"},{"id":"wordfence:77033d00-f794-4dbe-9454-17c312855491","source":"wordfence","cve":"CVE-2025-9854","title":"A Simple Multilanguage Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77033d00-f794-4dbe-9454-17c312855491?source=api-prod","affected":[{"type":"plugin","slug":"a-simple-multilanguage","name":"A Simple Multilanguage Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:29:20Z","updated":"2025-10-03T11:17:14Z"},{"id":"wordfence:7703c73d-a854-4e29-b99e-4f9a414b7579","source":"wordfence","cve":"CVE-2024-49677","title":"Bootstrap Buttons <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7703c73d-a854-4e29-b99e-4f9a414b7579?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-buttons","name":"Bootstrap Buttons","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:55:05Z"},{"id":"wordfence:7707ca04-e136-4d4b-869b-cd270359991e","source":"wordfence","cve":"CVE-2021-24266","title":"The Plus Addons for Elementor Page Builder Lite < 2.0.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7707ca04-e136-4d4b-869b-cd270359991e?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":false,"patched_in":"2.0.6"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7708ec57-96d9-4250-b36a-f9ea79ef18da","source":"wordfence","cve":"CVE-2026-84777","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7708ec57-96d9-4250-b36a-f9ea79ef18da?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:35:05Z"},{"id":"wordfence:7709f5c9-a938-4e6e-8430-6468fb618ef3","source":"wordfence","cve":"CVE-2025-58631","title":"IssueM <= 2.9.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7709f5c9-a938-4e6e-8430-6468fb618ef3?source=api-prod","affected":[{"type":"plugin","slug":"issuem","name":"IssueM","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:22:56Z"},{"id":"wordfence:770b0401-4d05-476e-a2b1-e9e9c920f5fa","source":"wordfence","cve":"CVE-2025-6726","title":"Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770b0401-4d05-476e-a2b1-e9e9c920f5fa?source=api-prod","affected":[{"type":"plugin","slug":"block-editor-gallery-slider","name":"Block Editor Gallery Slider for WordPress \u2013 Image Slider, Gallery Carousel & Lightbox Plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-07-17T16:28:18Z","updated":"2025-07-25T14:58:45Z"},{"id":"wordfence:770c64d3-3cc8-4fd9-91d6-96a1c252265a","source":"wordfence","cve":"CVE-2025-3502","title":"WP Maps \u2013 Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770c64d3-3cc8-4fd9-91d6-96a1c252265a?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-06-03T14:04:43Z"},{"id":"wordfence:770d1b3f-45f1-40f6-80b7-808c633d2be7","source":"wordfence","cve":"CVE-2024-9635","title":"Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770d1b3f-45f1-40f6-80b7-808c633d2be7?source=api-prod","affected":[{"type":"plugin","slug":"wc-cashapp","name":"Checkout with Cash App on WooCommerce","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2024-11-22T18:51:26Z","updated":"2024-11-23T06:54:55Z"},{"id":"wordfence:770dbc3c-d05c-453e-bf64-5d45f395c53b","source":"wordfence","cve":"CVE-2025-23935","title":"Magic Google Maps <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770dbc3c-d05c-453e-bf64-5d45f395c53b?source=api-prod","affected":[{"type":"plugin","slug":"magic-google-maps","name":"Magic Google Maps","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:58:46Z"},{"id":"wordfence:770f3c25-effb-40ea-bd1c-7874c456ab0e","source":"wordfence","cve":"CVE-2021-24563","title":"Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770f3c25-effb-40ea-bd1c-7874c456ab0e?source=api-prod","affected":[{"type":"plugin","slug":"frontend-uploader","name":"Frontend Uploader","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:770fd2b9-b226-4b6a-84f6-674061ddad93","source":"wordfence","cve":"CVE-2026-49070","title":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770fd2b9-b226-4b6a-84f6-674061ddad93?source=api-prod","affected":[{"type":"plugin","slug":"knit-pay","name":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more","from":"*","from_inclusive":true,"to":"9.4.0.0","to_inclusive":true,"patched_in":"9.4.0.1"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:23:55Z"},{"id":"wordfence:770fe29d-601b-487b-b102-d5027f09fc24","source":"wordfence","cve":"CVE-2021-4428","title":"what3words Address Field <= 4.0.0 - Authenticated (Administrator+) Sensitive Information Exposure in class-w3w-autosuggest-public.php","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/770fe29d-601b-487b-b102-d5027f09fc24?source=api-prod","affected":[{"type":"plugin","slug":"3-word-address-validation-field","name":"what3words Address Field","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2023-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77104b2f-2348-45df-90b1-41a3a3983101","source":"wordfence","cve":"CVE-2026-22497","title":"Jardi | Winery, Vineyard & Wine Shop WordPress Theme <= 1.7.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77104b2f-2348-45df-90b1-41a3a3983101?source=api-prod","affected":[{"type":"theme","slug":"jardi","name":"Jardi | Winery, Vineyard & Wine Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:34:15Z"},{"id":"wordfence:77122403-5865-40d7-96d5-557147098c4e","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77122403-5865-40d7-96d5-557147098c4e?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:26Z"},{"id":"wordfence:77137612-d36c-4c75-a9d3-469bf5faa6a1","source":"wordfence","cve":"CVE-2025-62923","title":"Marquee Addons for Elementor <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77137612-d36c-4c75-a9d3-469bf5faa6a1?source=api-prod","affected":[{"type":"plugin","slug":"marquee-addons-for-elementor","name":"Marquee Addons for Elementor \u2013 Essential Motion Widgets & Templates","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2025-10-04T00:00:00Z","updated":"2025-12-18T18:50:55Z"},{"id":"wordfence:7713f2b3-1f85-4ad3-822a-3a6746fcf6ec","source":"wordfence","cve":"CVE-2025-28992","title":"SNS Anton <= 4.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7713f2b3-1f85-4ad3-822a-3a6746fcf6ec?source=api-prod","affected":[{"type":"theme","slug":"snsanton","name":"SNS Anton - Furniture WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:44:49Z"},{"id":"wordfence:771511c1-cdf3-47b3-88dd-a915ad5b17f1","source":"wordfence","cve":"CVE-2026-123483","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/771511c1-cdf3-47b3-88dd-a915ad5b17f1?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:21:45Z"},{"id":"wordfence:7716e77f-e899-4046-9421-86fc0c36c245","source":"wordfence","cve":"CVE-2026-2717","title":"HTTP Headers <= 1.19.5 - Authenticated (Administrator+) CRLF Injection via Custom Header Values","severity":"medium","cvss":5.5,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7716e77f-e899-4046-9421-86fc0c36c245?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.19.5","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:13:17Z","updated":"2026-09-21T19:08:47Z"},{"id":"wordfence:7716f995-107a-4798-b5b1-38a547b59022","source":"wordfence","cve":"CVE-2026-105317","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7716f995-107a-4798-b5b1-38a547b59022?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-10-05T10:36:01Z","updated":"2026-10-08T23:31:22Z"},{"id":"wordfence:7717cd0f-6aac-4cb0-b27e-2517d5d7ecd9","source":"wordfence","cve":"CVE-2023-24417","title":"Worthy \u2013 VG WORT Integration f\u00fcr WordPress <= 1.6.5-6497609 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7717cd0f-6aac-4cb0-b27e-2517d5d7ecd9?source=api-prod","affected":[{"type":"plugin","slug":"wp-worthy","name":"Worthy \u2013 VG WORT Integration f\u00fcr WordPress","from":"*","from_inclusive":true,"to":"1.6.5-6497609","to_inclusive":true,"patched_in":"1.7.0-0cde1c2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77189684-b794-41a0-8fc0-3320032c2f69","source":"wordfence","cve":"CVE-2025-9890","title":"Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77189684-b794-41a0-8fc0-3320032c2f69?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-10-17T19:39:27Z","updated":"2025-10-18T08:25:36Z"},{"id":"wordfence:771da808-8962-46a3-8519-85d9422583f6","source":"wordfence","cve":"CVE-2023-24381","title":"Advanced Social Pixel <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/771da808-8962-46a3-8519-85d9422583f6?source=api-prod","affected":[{"type":"plugin","slug":"ns-facebook-pixel-for-wp","name":"Advanced Social Pixel","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:771ecb8c-feb1-40ea-b47b-a2ae033b3c87","source":"wordfence","cve":"CVE-2023-5230","title":"TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/771ecb8c-feb1-40ea-b47b-a2ae033b3c87?source=api-prod","affected":[{"type":"plugin","slug":"tm-woocommerce-compare-wishlist","name":"TM WooCommerce Compare & Wishlist","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:771ed385-587c-400f-89c6-1a827c3e2c79","source":"wordfence","cve":"CVE-2025-14720","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/771ed385-587c-400f-89c6-1a827c3e2c79?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.38","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-01-08T17:39:35Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:7720ae0a-edeb-4e76-9bb4-4a51265d192c","source":"wordfence","cve":"CVE-2024-43314","title":"Asset CleanUp: Page Speed Booster <= 1.3.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7720ae0a-edeb-4e76-9bb4-4a51265d192c?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.9.3","to_inclusive":true,"patched_in":"1.3.9.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:45:29Z"},{"id":"wordfence:7721c49c-82e3-493d-9f53-187d7737ae93","source":"wordfence","cve":"CVE-2026-66700","title":"Smart Online Order for Clover <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7721c49c-82e3-493d-9f53-187d7737ae93?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:50:17Z"},{"id":"wordfence:77227fc5-7c38-476d-af4c-4b2ad3dd8420","source":"wordfence","cve":"CVE-2026-0682","title":"Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter","severity":"low","cvss":2.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77227fc5-7c38-476d-af4c-4b2ad3dd8420?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.28","to_inclusive":true,"patched_in":"5.0.29"}],"published":"2026-01-16T14:51:20Z","updated":"2026-01-17T03:24:24Z"},{"id":"wordfence:7724344d-de86-4d49-8c06-fa4b7559a753","source":"wordfence","cve":"CVE-2026-95608","title":"HUSKY \u2013 Products Filter for WooCommerce Professional <= 1.4.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7724344d-de86-4d49-8c06-fa4b7559a753?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.3.2","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-10-02T08:09:33Z","updated":"2026-10-13T14:47:11Z"},{"id":"wordfence:77247a6b-2473-4b36-9ad8-b7802e4fad32","source":"wordfence","cve":"CVE-2024-9023","title":"WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77247a6b-2473-4b36-9ad8-b7802e4fad32?source=api-prod","affected":[{"type":"plugin","slug":"wp-webauthn","name":"WP-WebAuthn","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-09-27T13:56:09Z","updated":"2024-10-07T20:07:22Z"},{"id":"wordfence:7728b8d3-5f85-4411-968a-2239c05273d8","source":"wordfence","cve":"CVE-2026-39713","title":"Mailercloud \u2013 Integrate webforms and synchronize website contacts <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7728b8d3-5f85-4411-968a-2239c05273d8?source=api-prod","affected":[{"type":"plugin","slug":"mailercloud-integrate-webforms-synchronize-contacts","name":"Mailercloud \u2013 Integrate webforms and synchronize website contacts","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-26T18:19:07Z"},{"id":"wordfence:772c4a92-171e-4516-8f13-448d9048727a","source":"wordfence","cve":"CVE-2026-42692","title":"WP Crowdfunding <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/772c4a92-171e-4516-8f13-448d9048727a?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T10:42:40Z","updated":"2026-11-03T19:58:10Z"},{"id":"wordfence:772c9330-97d5-42d5-a49c-d9a86a14b235","source":"wordfence","cve":"CVE-2023-22705","title":"Welcart e-Commerce <= 2.8.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/772c9330-97d5-42d5-a49c-d9a86a14b235?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":true,"patched_in":"2.8.11"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:772e17d6-2819-4e66-88f2-0c7a6c0aaff0","source":"wordfence","cve":"CVE-2026-56058","title":"Quform - WordPress Form Builder <= 2.23.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/772e17d6-2819-4e66-88f2-0c7a6c0aaff0?source=api-prod","affected":[{"type":"plugin","slug":"quform","name":"Quform - WordPress Form Builder","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.23.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:59:49Z"},{"id":"wordfence:772e843b-00ea-45f5-b730-c9a793d4c2db","source":"wordfence","cve":"CVE-2023-47772","title":"Slider Revolution <= 6.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/772e843b-00ea-45f5-b730-c9a793d4c2db?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.14","to_inclusive":true,"patched_in":"6.6.15"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:772e9b2b-b2d5-4950-804b-d0914004710c","source":"wordfence","cve":"CVE-2026-4090","title":"Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/772e9b2b-b2d5-4950-804b-d0914004710c?source=api-prod","affected":[{"type":"plugin","slug":"inquiry-cart","name":"Inquiry cart","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:08:19Z","updated":"2026-04-22T07:45:37Z"},{"id":"wordfence:7730d670-d270-4755-bc9a-550498a28edb","source":"wordfence","cve":"CVE-2023-41735","title":"Email posts to subscribers <= 6.2 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7730d670-d270-4755-bc9a-550498a28edb?source=api-prod","affected":[{"type":"plugin","slug":"email-posts-to-subscribers","name":"Email posts to subscribers","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7732742c-e8a9-4bd0-8013-76418a563fc2","source":"wordfence","cve":"CVE-2024-34821","title":"Contact List \u2013 Easy Business Directory, Staff Directory and Address Book Plugin <= 2.9.87 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7732742c-e8a9-4bd0-8013-76418a563fc2?source=api-prod","affected":[{"type":"plugin","slug":"contact-list","name":"Contact List \u2013 Online Staff Directory & Address Book","from":"*","from_inclusive":true,"to":"2.9.87","to_inclusive":true,"patched_in":"2.9.88"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T01:08:08Z"},{"id":"wordfence:77328e35-b6e6-40eb-8c85-896d54419aef","source":"wordfence","cve":"CVE-2025-1561","title":"AppPresser \u2013 Mobile App Framework <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77328e35-b6e6-40eb-8c85-896d54419aef?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T04:21:06Z"},{"id":"wordfence:7736342c-21e8-42e6-8af8-31c69ff7781e","source":"wordfence","cve":"CVE-2026-10511","title":"Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7736342c-21e8-42e6-8af8-31c69ff7781e?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.61.0","to_inclusive":true,"patched_in":"4.62.0"}],"published":"2026-10-26T19:41:35Z","updated":"2026-10-27T07:42:53Z"},{"id":"wordfence:77397408-30a7-4be2-bc1f-505e58aafdf7","source":"wordfence","cve":"CVE-2026-24587","title":"AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77397408-30a7-4be2-bc1f-505e58aafdf7?source=api-prod","affected":[{"type":"plugin","slug":"ajax-hits-counter","name":"AJAX Hits Counter + Popular Posts Widget","from":"*","from_inclusive":true,"to":"0.10.210305","to_inclusive":true,"patched_in":""}],"published":"2026-01-18T00:00:00Z","updated":"2026-01-27T19:23:17Z"},{"id":"wordfence:773b5a79-017a-4e16-b563-3aa2939fa179","source":"wordfence","cve":"CVE-2023-5641","title":"Martins Free & Easy SEO BackLink Link Building Network <= 1.2.29 - Reflected Cross-Site Scripting via _wpnonce","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773b5a79-017a-4e16-b563-3aa2939fa179?source=api-prod","affected":[{"type":"plugin","slug":"martins-link-network","name":"LexonRank: AI Link Building, Free Backlinks, GEO & SEO Automation","from":"*","from_inclusive":true,"to":"1.2.29","to_inclusive":true,"patched_in":"1.2.30"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:773b6c7e-f3ea-4827-93e3-b76b6adbac8f","source":"wordfence","cve":"CVE-2026-16558","title":"YMC Filter <= 3.12.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773b6c7e-f3ea-4827-93e3-b76b6adbac8f?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.12.7","to_inclusive":true,"patched_in":"3.12.8"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:28:39Z"},{"id":"wordfence:773be426-6fbc-49be-8a2a-5e794c58be8b","source":"wordfence","cve":"CVE-2026-15209","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Cross-User Support Ticket Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773be426-6fbc-49be-8a2a-5e794c58be8b?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:34:22Z"},{"id":"wordfence:773c20a3-d1db-4e1c-a3d9-c3a544e81f56","source":"wordfence","cve":"CVE-2026-25031","title":"Tasty Daily < 1.27 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773c20a3-d1db-4e1c-a3d9-c3a544e81f56?source=api-prod","affected":[{"type":"theme","slug":"tastydaily","name":"Tasty Daily - Grocery Store & Food WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.27","to_inclusive":false,"patched_in":"1.27"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:05:51Z"},{"id":"wordfence:773e2c1f-cebb-46b8-a073-98814c274b8f","source":"wordfence","cve":"CVE-2026-25863","title":"Conditional Fields for Contact Form 7 <= 2.7.2 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773e2c1f-cebb-46b8-a073-98814c274b8f?source=api-prod","affected":[{"type":"plugin","slug":"cf7-conditional-fields","name":"Conditional Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-05-04T00:00:00Z","updated":"2026-07-30T12:21:52Z"},{"id":"wordfence:773ed184-1478-417d-9a57-93f3971d4bc8","source":"wordfence","cve":"CVE-2021-24278","title":"Redirection for Contact Form 7 <= 2.3.3 - Unauthenticated Arbitrary Nonce Generation","severity":"high","cvss":7.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773ed184-1478-417d-9a57-93f3971d4bc8?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:773f2b16-3a70-4d06-9a9c-77a787596e37","source":"wordfence","cve":"CVE-2026-25354","title":"Reebox < 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/773f2b16-3a70-4d06-9a9c-77a787596e37?source=api-prod","affected":[{"type":"theme","slug":"reebox","name":"Reebox - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2026-03-20T00:00:00Z","updated":"2026-05-05T14:45:55Z"},{"id":"wordfence:77409977-6822-4d14-9842-cb6a5aff2162","source":"wordfence","cve":"CVE-2023-4025","title":"Radio Player <= 2.0.73 - Missing Authorization to Player Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77409977-6822-4d14-9842-cb6a5aff2162?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:24Z"},{"id":"wordfence:7740fdfb-65b2-4d27-935f-b0e73487f0c4","source":"wordfence","cve":"CVE-2026-4362","title":"ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7740fdfb-65b2-4d27-935f-b0e73487f0c4?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-05-04T16:06:48Z","updated":"2026-05-05T04:27:57Z"},{"id":"wordfence:7741ac32-47d1-47c1-b012-20f1c500bd7b","source":"wordfence","cve":"CVE-2026-81154","title":"Robo Gallery <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7741ac32-47d1-47c1-b012-20f1c500bd7b?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:13Z"},{"id":"wordfence:7742ba13-062a-4b22-9396-07de4c3db62c","source":"wordfence","cve":"CVE-2026-84169","title":"UPI QR Code Payment Gateway < 1.4.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7742ba13-062a-4b22-9396-07de4c3db62c?source=api-prod","affected":[{"type":"plugin","slug":"upi-qr-code-payment-gateway","name":"UPI QR Code Payment Gateway","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-28T21:15:30Z"},{"id":"wordfence:77440d6e-b660-433b-9953-c1f92644302e","source":"wordfence","cve":"CVE-2017-18502","title":"Subscriber by BestWebSoft <= 1.3.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77440d6e-b660-433b-9953-c1f92644302e?source=api-prod","affected":[{"type":"plugin","slug":"subscriber","name":"Subscriber by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7745de26-8c38-48db-a361-a243519f0237","source":"wordfence","cve":"CVE-2024-56019","title":"Inline Footnotes <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7745de26-8c38-48db-a361-a243519f0237?source=api-prod","affected":[{"type":"plugin","slug":"inline-footnotes","name":"Inline Footnotes","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:57:01Z"},{"id":"wordfence:77462f1f-f7d8-4d11-aaf1-82395897fcfa","source":"wordfence","cve":"CVE-2023-4279","title":"User Activity Log <= 1.6.6 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77462f1f-f7d8-4d11-aaf1-82395897fcfa?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77464287-bbaa-428e-9292-c97c10733adf","source":"wordfence","cve":"CVE-2026-103900","title":"WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77464287-bbaa-428e-9292-c97c10733adf?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2026-11-06T21:20:42Z","updated":"2026-11-07T09:25:47Z"},{"id":"wordfence:77476bad-e9a4-4266-b07e-b402b33cc27a","source":"wordfence","cve":"CVE-2024-8739","title":"ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77476bad-e9a4-4266-b07e-b402b33cc27a?source=api-prod","affected":[{"type":"plugin","slug":"wp-recaptcha-integration","name":"ReCaptcha Integration for WordPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-02T02:03:08Z"},{"id":"wordfence:774776dc-3780-496c-907a-0d1f86a5d0ac","source":"wordfence","cve":"CVE-2024-33930","title":"Share This Image <= 1.98 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/774776dc-3780-496c-907a-0d1f86a5d0ac?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"1.98","to_inclusive":true,"patched_in":"1.99"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-21T13:11:54Z"},{"id":"wordfence:7749c45a-f956-4df6-98d0-5ec0db95185e","source":"wordfence","cve":"CVE-2026-5451","title":"Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7749c45a-f956-4df6-98d0-5ec0db95185e?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"4.14","to_inclusive":true,"patched_in":"4.15"}],"published":"2026-04-02T00:00:00Z","updated":"2026-04-08T20:25:09Z"},{"id":"wordfence:774afb96-4385-4693-a446-c87f81b39feb","source":"wordfence","cve":"CVE-2021-24280","title":"Redirection for Contact Form 7 <= 2.3.3 - Authenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/774afb96-4385-4693-a446-c87f81b39feb?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:774c00fb-82cd-44ca-bf96-3f6dfd1977d0","source":"wordfence","cve":"CVE-2023-6959","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:36:39Z"},{"id":"wordfence:774ca633-cda0-43d0-9bf9-cff181109d17","source":"wordfence","cve":"CVE-2024-56031","title":"Smart Shopify Product <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/774ca633-cda0-43d0-9bf9-cff181109d17?source=api-prod","affected":[{"type":"plugin","slug":"smart-shopify-product","name":"Smart Shopify Product","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:37:16Z"},{"id":"wordfence:77537eb8-1c84-4702-aba1-727b0de1c3e1","source":"wordfence","cve":"CVE-2023-3158","title":"Mail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77537eb8-1c84-4702-aba1-727b0de1c3e1?source=api-prod","affected":[{"type":"plugin","slug":"mail-control","name":"Mail Control \u2013 Email Customizer, SMTP Deliverability, logging, open and click Tracking","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":"0.3.2"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7757f41d-c1f1-4df1-8048-b1c78a897548","source":"wordfence","cve":"CVE-2026-107645","title":"Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7757f41d-c1f1-4df1-8048-b1c78a897548?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.58","to_inclusive":true,"patched_in":"2.1.59"}],"published":"2026-10-09T15:15:10Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:77582ba1-98b0-41c1-a665-e49704313823","source":"wordfence","cve":"CVE-2022-3141","title":"TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77582ba1-98b0-41c1-a665-e49704313823?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:775860e5-87c9-4878-a629-d7a7cd0cbf1d","source":"wordfence","cve":"CVE-2014-9097","title":"WORDPRESS VIDEO GALLERY < 2.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775860e5-87c9-4878-a629-d7a7cd0cbf1d?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2014-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:775891d7-d02e-4f6c-a16c-8441a4f1d2cd","source":"wordfence","cve":"CVE-2025-32139","title":"FooBox Image Lightbox  <= 2.7.33 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775891d7-d02e-4f6c-a16c-8441a4f1d2cd?source=api-prod","affected":[{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.33","to_inclusive":true,"patched_in":"2.7.34"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-11T12:25:17Z"},{"id":"wordfence:7759b209-4211-4ee5-ae7a-42645f5d5e96","source":"wordfence","cve":"","title":"Contest Gallery < 13.1.0.7 - Authenticated Email Address Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7759b209-4211-4ee5-ae7a-42645f5d5e96?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"13.1.0.7","to_inclusive":false,"patched_in":"13.1.0.7"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7759d119-503f-4097-83ba-6c469276450d","source":"wordfence","cve":"CVE-2021-24821","title":"Cost Calculator <= 1.5 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7759d119-503f-4097-83ba-6c469276450d?source=api-prod","affected":[{"type":"plugin","slug":"nd-projects","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:775a0071-0c07-4438-918a-ff997961a6b3","source":"wordfence","cve":"CVE-2025-68603","title":"Editorial Calendar <= 3.8.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775a0071-0c07-4438-918a-ff997961a6b3?source=api-prod","affected":[{"type":"plugin","slug":"editorial-calendar","name":"Editorial Calendar","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-27T20:43:09Z"},{"id":"wordfence:775a8904-0c6a-4968-8efb-b6ef1a599818","source":"wordfence","cve":"CVE-2026-116749","title":"VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775a8904-0c6a-4968-8efb-b6ef1a599818?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2026-10-27T18:05:02Z","updated":"2026-10-28T06:45:14Z"},{"id":"wordfence:775b6034-617a-4d84-a8fe-773ffbd9742a","source":"wordfence","cve":"CVE-2024-13559","title":"TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775b6034-617a-4d84-a8fe-773ffbd9742a?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-toolkit","name":"TemplatesNext ToolKit","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-28T15:27:36Z","updated":"2025-03-01T04:21:50Z"},{"id":"wordfence:775d4ba7-7198-493c-bae0-7f3f78741b90","source":"wordfence","cve":"CVE-2023-50851","title":"Simply Schedule Appointments <= 1.6.5.27 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775d4ba7-7198-493c-bae0-7f3f78741b90?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.6.1","to_inclusive":false,"patched_in":"1.6.6.1"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:775e9f94-b66d-4c22-81ef-c335c0654f08","source":"wordfence","cve":"CVE-2021-26754","title":"wpDataTables (Premium) <= 3.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775e9f94-b66d-4c22-81ef-c335c0654f08?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2021-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:775fa406-ddad-465a-81f3-74a4c7399f64","source":"wordfence","cve":"CVE-2025-31065","title":"Rozario <= 1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/775fa406-ddad-465a-81f3-74a4c7399f64?source=api-prod","affected":[{"type":"theme","slug":"rozario","name":"Rozario - Restaurant & Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T20:05:27Z"},{"id":"wordfence:77608ee4-1917-4b2c-8acf-5d6087c5ae7a","source":"wordfence","cve":"CVE-2026-39518","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77608ee4-1917-4b2c-8acf-5d6087c5ae7a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.0.0","to_inclusive":true,"patched_in":"4.3.0.1"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:48:25Z"},{"id":"wordfence:7761fe7c-e7f5-4bab-8820-42e6fcabcb2f","source":"wordfence","cve":"CVE-2023-30474","title":"Ultimate Noindex Nofollow Tool II <= 1.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7761fe7c-e7f5-4bab-8820-42e6fcabcb2f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-noindex-nofollow-tool-ii","name":"Ultimate Noindex Nofollow Tool II","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7762fe69-9bd4-4e4e-a6c5-1263fad352a0","source":"wordfence","cve":"CVE-2024-52401","title":"Hacklog DownloadManager <= 2.1.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7762fe69-9bd4-4e4e-a6c5-1263fad352a0?source=api-prod","affected":[{"type":"plugin","slug":"hacklog-downloadmanager","name":"Hacklog DownloadManager","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:17:12Z"},{"id":"wordfence:7769f3d4-041d-445f-a5fc-d5bc9e45ed58","source":"wordfence","cve":"CVE-2024-47378","title":"WPCOM Member <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7769f3d4-041d-445f-a5fc-d5bc9e45ed58?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.4.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:30:37Z"},{"id":"wordfence:776a0059-9e9a-454a-a325-2e3a0e133000","source":"wordfence","cve":"","title":"SpiderVPlayer <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/776a0059-9e9a-454a-a325-2e3a0e133000?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2013-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:776a441b-1bb8-46ea-9884-4abf562f6e5c","source":"wordfence","cve":"CVE-2025-13727","title":"Video Share VOD <= 2.7.11 - Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/776a441b-1bb8-46ea-9884-4abf562f6e5c?source=api-prod","affected":[{"type":"plugin","slug":"video-share-vod","name":"Video Share VOD \u2013 Turnkey Video Site Builder Script","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.7.12"}],"published":"2026-02-17T20:33:31Z","updated":"2026-02-18T09:25:54Z"},{"id":"wordfence:776de802-5748-4b71-930b-6ff9e597ed93","source":"wordfence","cve":"CVE-2024-37238","title":"WPAdverts \u2013 Classifieds Plugin <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/776de802-5748-4b71-930b-6ff9e597ed93?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-26T20:07:10Z"},{"id":"wordfence:776fc47e-a86c-43dc-8d5e-50273c4411b2","source":"wordfence","cve":"CVE-2021-34638","title":"WordPress Download Manager <= 3.1.24 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/776fc47e-a86c-43dc-8d5e-50273c4411b2?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":"3.1.25"}],"published":"2021-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7770ab04-eb40-450e-ab8a-2a8e5d13d4a4","source":"wordfence","cve":"CVE-2023-0539","title":"GS Insever Portfolio <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7770ab04-eb40-450e-ab8a-2a8e5d13d4a4?source=api-prod","affected":[{"type":"plugin","slug":"gs-instagram-portfolio","name":"GS Insever Portfolio","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77727d02-796b-4c5b-ad5d-d1c366760abc","source":"wordfence","cve":"CVE-2026-16090","title":"GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77727d02-796b-4c5b-ad5d-d1c366760abc?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.9.1","to_inclusive":true,"patched_in":"7.9.9.2"}],"published":"2026-07-31T19:28:21Z","updated":"2026-08-01T07:49:48Z"},{"id":"wordfence:7772c78e-3134-4855-ac4e-3520c584c2e7","source":"wordfence","cve":"CVE-2022-4469","title":"Simple Membership <= 4.2.1 - Authenticated (Contributor+) Cross Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7772c78e-3134-4855-ac4e-3520c584c2e7?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7773650c-99dd-4492-b9d7-e931d178b31e","source":"wordfence","cve":"CVE-2024-54349","title":"Plain Post <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7773650c-99dd-4492-b9d7-e931d178b31e?source=api-prod","affected":[{"type":"theme","slug":"plain-post","name":"Plain Post","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:10:50Z"},{"id":"wordfence:7773fd3a-2417-415e-97b0-735e99e62097","source":"wordfence","cve":"CVE-2024-10325","title":"Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7773fd3a-2417-415e-97b0-735e99e62097?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.45","to_inclusive":true,"patched_in":"1.6.46"}],"published":"2024-11-07T23:08:13Z","updated":"2024-11-08T11:31:07Z"},{"id":"wordfence:7774cdfd-622a-4608-9efd-273923a0d0aa","source":"wordfence","cve":"CVE-2025-12962","title":"Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7774cdfd-622a-4608-9efd-273923a0d0aa?source=api-prod","affected":[{"type":"plugin","slug":"local-syndication","name":"Local Syndication","from":"*","from_inclusive":true,"to":"1.5a","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:14:00Z","updated":"2025-11-18T08:27:32Z"},{"id":"wordfence:77771c45-4a67-4c26-a679-86110459aaeb","source":"wordfence","cve":"CVE-2025-62980","title":"Persian Admnin Fonts <= 4.1.03 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77771c45-4a67-4c26-a679-86110459aaeb?source=api-prod","affected":[{"type":"plugin","slug":"persian-admin-fonts","name":"Persian Admnin Fonts","from":"*","from_inclusive":true,"to":"4.1.03","to_inclusive":true,"patched_in":"4.1.05"}],"published":"2025-10-21T00:00:00Z","updated":"2026-02-24T18:48:06Z"},{"id":"wordfence:777e2e60-46c3-496c-8263-f2e253014ba5","source":"wordfence","cve":"CVE-2023-6268","title":"Get Use APIs \u2013 JSON Content Importer <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/777e2e60-46c3-496c-8263-f2e253014ba5?source=api-prod","affected":[{"type":"plugin","slug":"json-content-importer","name":"Get Use APIs \u2013 JSON Content Importer","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2023-12-04T00:00:00Z","updated":"2024-02-06T16:28:05Z"},{"id":"wordfence:777eb35b-c829-4a3b-a9e9-6d766f062813","source":"wordfence","cve":"CVE-2024-51879","title":"Text Advertisements <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/777eb35b-c829-4a3b-a9e9-6d766f062813?source=api-prod","affected":[{"type":"plugin","slug":"text-advertisements","name":"Text Advertisements","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:11:16Z"},{"id":"wordfence:7781e20b-c258-4bfd-9050-75a50a335628","source":"wordfence","cve":"CVE-2023-31077","title":"Export WP Page to Static HTML/CSS <= 2.1.9 - Cross-Site Request Forgery via Multiple AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7781e20b-c258-4bfd-9050-75a50a335628?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:778242f4-5dfa-4d72-a032-8b5521c5b8ce","source":"wordfence","cve":"CVE-2026-0831","title":"Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778242f4-5dfa-4d72-a032-8b5521c5b8ce?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2026-01-09T20:32:57Z","updated":"2026-01-11T05:11:22Z"},{"id":"wordfence:77838bf8-7809-4dd6-87f1-a9bda40275a6","source":"wordfence","cve":"CVE-2024-1691","title":"Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77838bf8-7809-4dd6-87f1-a9bda40275a6?source=api-prod","affected":[{"type":"plugin","slug":"otter-pro","name":"Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-03-06T00:00:00Z","updated":"2024-05-31T15:30:26Z"},{"id":"wordfence:7783f6fd-02c9-4ff0-ba36-77a0ad5a4bb6","source":"wordfence","cve":"CVE-2024-48040","title":"Tainacan <= 0.21.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7783f6fd-02c9-4ff0-ba36-77a0ad5a4bb6?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.8","to_inclusive":true,"patched_in":"0.21.9"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:59:08Z"},{"id":"wordfence:77851c3a-7f6d-42af-91c6-39f3fdfd0f2f","source":"wordfence","cve":"CVE-2025-62870","title":"Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77851c3a-7f6d-42af-91c6-39f3fdfd0f2f?source=api-prod","affected":[{"type":"plugin","slug":"eupago-gateway-for-woocommerce","name":"Eupago Gateway For Woocommerce","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-12-08T00:00:00Z","updated":"2026-07-28T18:05:46Z"},{"id":"wordfence:77876d74-5825-4bd8-812e-87061d0470e6","source":"wordfence","cve":"","title":"Advanced Custom Fields PRO 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77876d74-5825-4bd8-812e-87061d0470e6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"6.1","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:778aa2be-ffcb-4d28-9efe-c29c8d5391bd","source":"wordfence","cve":"CVE-2023-49178","title":"HDW Player Plugin (Video Player & Video Gallery) <= 5.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778aa2be-ffcb-4d28-9efe-c29c8d5391bd?source=api-prod","affected":[{"type":"plugin","slug":"hdw-player-video-player-video-gallery","name":"HDW Player Plugin (Video Player & Video Gallery)","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:778af777-4c98-45cd-9704-1bdc96054aa7","source":"wordfence","cve":"CVE-2023-4961","title":"Poptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778af777-4c98-45cd-9704-1bdc96054aa7?source=api-prod","affected":[{"type":"plugin","slug":"poptin","name":"Poptin \u2013 Email Marketing Automation, Newsletter & Exit Pop Ups, Email Popups","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:778d8443-fc0f-4e97-8460-e5ceee8b62a1","source":"wordfence","cve":"CVE-2024-3244","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778d8443-fc0f-4e97-8460-e5ceee8b62a1?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.9.15"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-09T18:58:59Z"},{"id":"wordfence:778e2191-d764-44a1-9f52-9698e9183fd2","source":"wordfence","cve":"CVE-2023-0489","title":"SlideOnline <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778e2191-d764-44a1-9f52-9698e9183fd2?source=api-prod","affected":[{"type":"plugin","slug":"slideonline","name":"SlideOnline","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:778f7d9b-6376-4026-a291-1fedeabe8c99","source":"wordfence","cve":"CVE-2024-11501","title":"Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778f7d9b-6376-4026-a291-1fedeabe8c99?source=api-prod","affected":[{"type":"plugin","slug":"multi-gallery","name":"Gallery","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:32:17Z","updated":"2024-12-07T11:09:53Z"},{"id":"wordfence:7790777d-9421-48c6-b789-f1feab109ec7","source":"wordfence","cve":"CVE-2024-43346","title":"Modal Window <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7790777d-9421-48c6-b789-f1feab109ec7?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:08:57Z"},{"id":"wordfence:77911b0f-c028-49ae-b85e-15909d806e30","source":"wordfence","cve":"CVE-2023-5668","title":"WhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77911b0f-c028-49ae-b85e-15909d806e30?source=api-prod","affected":[{"type":"plugin","slug":"whatsapp","name":"WhatsApp Share Button","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77930416-d79b-42bc-8a84-f7f140679a8a","source":"wordfence","cve":"CVE-2024-34824","title":"SportsPress \u2013 Sports Club & League Manager <= 2.7.20 - Missing Authorization to Notice Dismissal","severity":"low","cvss":3.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77930416-d79b-42bc-8a84-f7f140679a8a?source=api-prod","affected":[{"type":"plugin","slug":"sportspress","name":"SportsPress \u2013 Sports Club & League Manager","from":"*","from_inclusive":true,"to":"2.7.20","to_inclusive":true,"patched_in":"2.7.21"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T19:56:09Z"},{"id":"wordfence:7793c171-8aca-461c-9942-9f4d075be5ae","source":"wordfence","cve":"CVE-2026-120524","title":"News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7793c171-8aca-461c-9942-9f4d075be5ae?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-16T14:54:35Z","updated":"2026-11-03T04:43:08Z"},{"id":"wordfence:7794f043-0e0b-4ff3-b2dd-1caff8d7168d","source":"wordfence","cve":"CVE-2022-1007","title":"Advanced Booking Calendar <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7794f043-0e0b-4ff3-b2dd-1caff8d7168d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:779a9f7a-4582-4d5e-bd9a-9ff7f14b452a","source":"wordfence","cve":"CVE-2024-13682","title":"Wallet System for WooCommerce \u2013 Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/779a9f7a-4582-4d5e-bd9a-9ff7f14b452a?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-03T20:19:36Z","updated":"2025-03-04T08:23:40Z"},{"id":"wordfence:779ccc74-757d-4741-af82-53f8988ef9e0","source":"wordfence","cve":"CVE-2024-38741","title":"Amazing Hover Effects <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/779ccc74-757d-4741-af82-53f8988ef9e0?source=api-prod","affected":[{"type":"plugin","slug":"amazing-hover-effects","name":"Amazing Hover Effects","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:18:33Z"},{"id":"wordfence:779df91d-bf27-42ac-9445-13a4ad63a322","source":"wordfence","cve":"CVE-2025-46523","title":"COVID-19 (Coronavirus) Update Your Customers <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/779df91d-bf27-42ac-9445-13a4ad63a322?source=api-prod","affected":[{"type":"plugin","slug":"covid-19-alert","name":"COVID-19 (Coronavirus) Update Your Customers","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:29:24Z"},{"id":"wordfence:779e7bd1-c02c-4eaa-b85f-3df87baa9783","source":"wordfence","cve":"CVE-2026-32490","title":"WP TripAdvisor Review Slider <= 14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/779e7bd1-c02c-4eaa-b85f-3df87baa9783?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"14.1","to_inclusive":true,"patched_in":"14.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:27:48Z"},{"id":"wordfence:779ecd51-16d6-4799-aad7-372c5d5f2884","source":"wordfence","cve":"CVE-2012-3383","title":"WordPress Core < 3.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/779ecd51-16d6-4799-aad7-372c5d5f2884?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2012-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77a2d64f-852f-4cc2-9905-98c8f0930817","source":"wordfence","cve":"CVE-2019-5920","title":"FormCraft <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77a2d64f-852f-4cc2-9905-98c8f0930817?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2019-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77a5f551-523c-4c7c-9834-9443ecfd3456","source":"wordfence","cve":"CVE-2026-119615","title":"Reset Database <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77a5f551-523c-4c7c-9834-9443ecfd3456?source=api-prod","affected":[{"type":"plugin","slug":"reset-database","name":"Reset Database","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T21:45:00Z","updated":"2026-11-11T11:31:07Z"},{"id":"wordfence:77a85024-33ff-4056-89f6-991182d71b80","source":"wordfence","cve":"CVE-2023-52150","title":"Dynamic Content for Elementor < 2.12.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77a85024-33ff-4056-89f6-991182d71b80?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-content-for-elementor","name":"Dynamic Content for Elementor","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":false,"patched_in":"2.12.5"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77a923d5-b73e-45cf-9617-09b4d5c8bb5a","source":"wordfence","cve":"CVE-2023-51371","title":"Bit Assist <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77a923d5-b73e-45cf-9617-09b4d5c8bb5a?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77ab3a4b-da39-454e-b223-56a36a7c9447","source":"wordfence","cve":"CVE-2024-51640","title":"MDR Webmaster Tools <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77ab3a4b-da39-454e-b223-56a36a7c9447?source=api-prod","affected":[{"type":"plugin","slug":"mdr-webmaster-tools","name":"MDR Webmaster Tools","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:50:40Z"},{"id":"wordfence:77acb885-1776-4a74-96d0-4edbf1a92917","source":"wordfence","cve":"CVE-2023-50877","title":"Product Filter by WBW <= 2.5.0 - Missing Authorization via getListForTbl","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77acb885-1776-4a74-96d0-4edbf1a92917?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77af1ffa-beef-4d56-9ae4-7aab671b5421","source":"wordfence","cve":"CVE-2026-105055","title":"WP Mailster <= 1.9.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77af1ffa-beef-4d56-9ae4-7aab671b5421?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.9.0.0","to_inclusive":true,"patched_in":"1.9.1.0"}],"published":"2026-10-05T08:40:00Z","updated":"2026-10-08T23:13:41Z"},{"id":"wordfence:77b19085-4a7f-4554-bbad-46aa9ab10fc5","source":"wordfence","cve":"CVE-2026-84750","title":"Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b19085-4a7f-4554-bbad-46aa9ab10fc5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"3.2.4","from_inclusive":true,"to":"3.5.50","to_inclusive":true,"patched_in":"3.5.51"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:35:34Z"},{"id":"wordfence:77b57f2a-0b46-4b4a-bdca-1c5218d739ce","source":"wordfence","cve":"CVE-2025-14163","title":"Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b57f2a-0b46-4b4a-bdca-1c5218d739ce?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.53","to_inclusive":true,"patched_in":"4.11.54"}],"published":"2025-12-22T00:00:00Z","updated":"2026-02-13T19:10:37Z"},{"id":"wordfence:77b6d38e-71d1-44bc-b25b-f912c1e31ce2","source":"wordfence","cve":"CVE-2026-19073","title":"Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b6d38e-71d1-44bc-b25b-f912c1e31ce2?source=api-prod","affected":[{"type":"plugin","slug":"mwb-zendesk-woo-order-sync","name":"Order Sync with Zendesk for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:45:43Z"},{"id":"wordfence:77b7cf5d-2dad-4a4f-ae48-f1ab86065c2d","source":"wordfence","cve":"","title":"Careerfy <= 4.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b7cf5d-2dad-4a4f-ae48-f1ab86065c2d?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2020-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77b7fb02-1b79-4b0b-99ab-fa042e86391a","source":"wordfence","cve":"CVE-2021-20781","title":"Meta Data Filter & Taxonomies Filter <= 1.2.7.2 -  Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b7fb02-1b79-4b0b-99ab-fa042e86391a?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":false,"patched_in":"2.2.8"}],"published":"2021-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77b8b8f3-5cd3-4337-8010-04c5088f5994","source":"wordfence","cve":"CVE-2026-91019","title":"Event Booking Manager for WooCommerce <= 5.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77b8b8f3-5cd3-4337-8010-04c5088f5994?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:06Z"},{"id":"wordfence:77bed6ce-84e7-4b71-8acd-bb5b73e362d2","source":"wordfence","cve":"CVE-2024-8747","title":"Email Obfuscate Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77bed6ce-84e7-4b71-8acd-bb5b73e362d2?source=api-prod","affected":[{"type":"plugin","slug":"email-obfuscate-shortcode","name":"Email Obfuscate Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:24:49Z","updated":"2024-09-13T15:10:40Z"},{"id":"wordfence:77c125fd-a954-4523-b415-21bf9e835452","source":"wordfence","cve":"CVE-2024-52390","title":"CYAN Backup <= 2.5.3 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c125fd-a954-4523-b415-21bf9e835452?source=api-prod","affected":[{"type":"plugin","slug":"cyan-backup","name":"CYAN Backup","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:31:56Z"},{"id":"wordfence:77c25966-756d-47f6-a133-eeccdc2d86e7","source":"wordfence","cve":"CVE-2025-67914","title":"VidMov <= 2.3.8 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c25966-756d-47f6-a133-eeccdc2d86e7?source=api-prod","affected":[{"type":"theme","slug":"vidmov","name":"VidMov - Video WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T14:27:11Z"},{"id":"wordfence:77c4078a-0549-4b9e-ade6-f6133be73b1c","source":"wordfence","cve":"CVE-2026-22374","title":"Zio Alberto <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c4078a-0549-4b9e-ade6-f6133be73b1c?source=api-prod","affected":[{"type":"theme","slug":"zioalberto","name":"Zio Alberto \u2013 Restaurant \u2013 Cafe \u2013 Bistro Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:22:42Z"},{"id":"wordfence:77c4515f-bab7-4bb9-bbf6-ca0ee557055d","source":"wordfence","cve":"CVE-2026-59513","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c4515f-bab7-4bb9-bbf6-ca0ee557055d?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:56:23Z"},{"id":"wordfence:77c77949-6feb-498a-80fc-d5a6fbb1e966","source":"wordfence","cve":"CVE-2025-60128","title":"Delisho <= 1.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c77949-6feb-498a-80fc-d5a6fbb1e966?source=api-prod","affected":[{"type":"plugin","slug":"dr-widgets-blocks","name":"Delisho \u2013 Recipe Widgets and Blocks","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T16:53:17Z"},{"id":"wordfence:77c8e65d-d7cc-43c5-9e8b-43c7d2e392f5","source":"wordfence","cve":"CVE-2025-58676","title":"HORIZONTAL SLIDER <= 2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77c8e65d-d7cc-43c5-9e8b-43c7d2e392f5?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-slider","name":"HORIZONTAL SLIDER","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:50:35Z"},{"id":"wordfence:77cb14b1-d9e5-4296-ad8c-6642327ef310","source":"wordfence","cve":"CVE-2023-44238","title":"Remove slug from custom post type <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77cb14b1-d9e5-4296-ad8c-6642327ef310?source=api-prod","affected":[{"type":"plugin","slug":"remove-slug-from-custom-post-type","name":"Remove slug from custom post type","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77cc3871-664b-404c-b06c-b757374a777a","source":"wordfence","cve":"CVE-2025-24586","title":"Shipment Tracker for Woocommerce <= 1.4.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77cc3871-664b-404c-b06c-b757374a777a?source=api-prod","affected":[{"type":"plugin","slug":"shipment-tracker-for-woocommerce","name":"Shipment Tracker for Woocommerce","from":"*","from_inclusive":true,"to":"1.4.23","to_inclusive":true,"patched_in":"1.4.23.1"}],"published":"2024-12-19T00:00:00Z","updated":"2025-04-22T21:38:32Z"},{"id":"wordfence:77cea6a1-d5e8-459c-97cc-9dc8f7c0f48f","source":"wordfence","cve":"CVE-2015-5472","title":"IBS Mappro < 1.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77cea6a1-d5e8-459c-97cc-9dc8f7c0f48f?source=api-prod","affected":[{"type":"plugin","slug":"ibs-mappro","name":"IBS Mappro","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":"1.0"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77cf3e7c-bcb5-421d-a537-a0d28c36cd05","source":"wordfence","cve":"CVE-2025-28891","title":"price-calc <= 0.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77cf3e7c-bcb5-421d-a537-a0d28c36cd05?source=api-prod","affected":[{"type":"plugin","slug":"price-calc","name":"price-calc","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:30:40Z"},{"id":"wordfence:77d56f61-7e45-405e-878d-fa3d53acede0","source":"wordfence","cve":"CVE-2022-46814","title":"Kodex Posts likes <= 2.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d56f61-7e45-405e-878d-fa3d53acede0?source=api-prod","affected":[{"type":"plugin","slug":"kodex-posts-likes","name":"Kodex Posts likes","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77d66c35-7606-4ba0-a070-4a26eba0fa36","source":"wordfence","cve":"CVE-2026-49110","title":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d66c35-7606-4ba0-a070-4a26eba0fa36?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:56:40Z"},{"id":"wordfence:77d66e98-9987-430d-8866-496debe8f65e","source":"wordfence","cve":"CVE-2026-32493","title":"JobSearch WP Job Board <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d66e98-9987-430d-8866-496debe8f65e?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:44:50Z"},{"id":"wordfence:77d69631-9159-4619-9891-745dc2327e7c","source":"wordfence","cve":"CVE-2023-7268","title":"ArtPlacer Widget <= 2.21.1 - Missing Authorization to Widget Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d69631-9159-4619-9891-745dc2327e7c?source=api-prod","affected":[{"type":"plugin","slug":"artplacer-widget","name":"ArtPlacer Widget","from":"*","from_inclusive":true,"to":"2.21.1","to_inclusive":true,"patched_in":"2.21.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-08-02T18:08:44Z"},{"id":"wordfence:77d6d38a-f590-4188-8941-ea6936ae5cf4","source":"wordfence","cve":"CVE-2026-49084","title":"JetEngine < 3.8.9.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d6d38a-f590-4188-8941-ea6936ae5cf4?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.9.1","to_inclusive":false,"patched_in":"3.8.9.1"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:40:45Z"},{"id":"wordfence:77d8d29b-b730-46be-a354-7abfa83ac664","source":"wordfence","cve":"CVE-2023-32798","title":"Simple Page Ordering <= 2.5.0 - Missing Authorization to Information Disclosure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77d8d29b-b730-46be-a354-7abfa83ac664?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-ordering","name":"Simple Page Ordering","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77db423c-af60-4539-8e3d-fde997741617","source":"wordfence","cve":"CVE-2023-3279","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77db423c-af60-4539-8e3d-fde997741617?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.38","to_inclusive":true,"patched_in":"3.39"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77db827d-9afd-4b59-b0ad-1ad562634c52","source":"wordfence","cve":"CVE-2025-13371","title":"Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":8.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77db827d-9afd-4b59-b0ad-1ad562634c52?source=api-prod","affected":[{"type":"plugin","slug":"money-space","name":"Money Space","from":"*","from_inclusive":true,"to":"2.13.9","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-01-06T18:35:53Z","updated":"2026-01-13T17:15:24Z"},{"id":"wordfence:77db9906-ff6f-400c-bb02-8c64eb016a77","source":"wordfence","cve":"","title":"Method <= 2.1 - Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77db9906-ff6f-400c-bb02-8c64eb016a77?source=api-prod","affected":[{"type":"theme","slug":"method","name":"Method","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77de0955-d6e4-4da0-8a71-772c404e5dc2","source":"wordfence","cve":"CVE-2022-3926","title":"WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77de0955-d6e4-4da0-8a71-772c404e5dc2?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77e43062-1a3d-4db1-aeac-4d7505d18730","source":"wordfence","cve":"CVE-2024-11092","title":"SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77e43062-1a3d-4db1-aeac-4d7505d18730?source=api-prod","affected":[{"type":"plugin","slug":"svgplus","name":"SVGPlus","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T14:59:23Z","updated":"2024-11-16T03:20:48Z"},{"id":"wordfence:77e4e516-8a12-48ee-9124-27f941b68b13","source":"wordfence","cve":"CVE-2026-7522","title":"Advanced Database Cleaner \u2013 Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77e4e516-8a12-48ee-9124-27f941b68b13?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner-premium","name":"Advanced Database Cleaner \u2013 Premium","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-05-19T16:25:52Z","updated":"2026-05-20T04:27:51Z"},{"id":"wordfence:77e5155d-5279-4609-93de-18fa54702c3e","source":"wordfence","cve":"CVE-2026-49046","title":"Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77e5155d-5279-4609-93de-18fa54702c3e?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-wp-page-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-05-27T00:00:00Z","updated":"2026-09-09T16:06:42Z"},{"id":"wordfence:77e7f847-9848-4725-938c-3ce1b5e3f666","source":"wordfence","cve":"CVE-2026-39724","title":"HTTP Requests Manager <= 1.3.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77e7f847-9848-4725-938c-3ce1b5e3f666?source=api-prod","affected":[{"type":"plugin","slug":"http-requests-manager","name":"HTTP Requests Manager","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2026-10-05T13:29:01Z","updated":"2026-10-28T21:16:47Z"},{"id":"wordfence:77ea4ba8-6c13-494a-92e3-12643003635b","source":"wordfence","cve":"CVE-2024-6636","title":"WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77ea4ba8-6c13-494a-92e3-12643003635b?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T07:38:05Z"},{"id":"wordfence:77eabbd2-f682-4ff7-a411-c869b78a7a9b","source":"wordfence","cve":"CVE-2026-1661","title":"Mail Logging <= 1.16.0 - Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77eabbd2-f682-4ff7-a411-c869b78a7a9b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.17.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:03:03Z"},{"id":"wordfence:77eb40c2-735a-49f2-9d07-5cf7535bd722","source":"wordfence","cve":"CVE-2021-39341","title":"OptinMonster <= 2.6.4 - Unprotected REST-API Endpoints","severity":"high","cvss":8.2,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77eb40c2-735a-49f2-9d07-5cf7535bd722?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2021-11-01T09:02:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77ebd648-3851-47ea-a5eb-86af4899727c","source":"wordfence","cve":"CVE-2021-25094","title":"Tatsu <= 3.3.12 - Unauthenticated Remote Code Execution","severity":"medium","cvss":6.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77ebd648-3851-47ea-a5eb-86af4899727c?source=api-prod","affected":[{"type":"plugin","slug":"tatsu","name":"Tatsu","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2022-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77f0c100-1e33-4f18-80df-ed607faba5f7","source":"wordfence","cve":"","title":"Email Users < 4.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77f0c100-1e33-4f18-80df-ed607faba5f7?source=api-prod","affected":[{"type":"plugin","slug":"email-users","name":"Email Users","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2016-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77f12178-dc92-41fe-a289-222e83f72a27","source":"wordfence","cve":"CVE-2024-33573","title":"EPROLO Dropshipping <= 1.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77f12178-dc92-41fe-a289-222e83f72a27?source=api-prod","affected":[{"type":"plugin","slug":"eprolo-dropshipping","name":"EPROLO-Dropshipping","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:45:07Z"},{"id":"wordfence:77f18273-4507-49e6-b616-b37c89a64968","source":"wordfence","cve":"CVE-2025-28984","title":"Subscription Renewal Reminders for WooCommerce <= 1.4.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77f18273-4507-49e6-b616-b37c89a64968?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-renewal-reminders","name":"Subscription Renewal Reminders for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2025-06-05T00:00:00Z","updated":"2026-01-06T19:06:53Z"},{"id":"wordfence:77f3db0c-d575-48a8-872a-a64fd77486de","source":"wordfence","cve":"","title":"WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77f3db0c-d575-48a8-872a-a64fd77486de?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2013-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77fa042d-1e4f-4344-bf5a-3860add7aae3","source":"wordfence","cve":"CVE-2023-40328","title":"Carrot <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77fa042d-1e4f-4344-bf5a-3860add7aae3?source=api-prod","affected":[{"type":"plugin","slug":"carrrot","name":"Carrrot","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77faa23e-4475-43d9-b475-fe999cda7b62","source":"wordfence","cve":"CVE-2024-7412","title":"No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77faa23e-4475-43d9-b475-fe999cda7b62?source=api-prod","affected":[{"type":"plugin","slug":"no-update-nag","name":"No Update Nag","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.4.13"}],"published":"2024-08-08T20:35:41Z","updated":"2025-04-17T12:52:44Z"},{"id":"wordfence:77fcf27c-fc1c-49cf-9669-9ceb9343777c","source":"wordfence","cve":"CVE-2025-39513","title":"ActiveDEMAND <= 0.2.46 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77fcf27c-fc1c-49cf-9669-9ceb9343777c?source=api-prod","affected":[{"type":"plugin","slug":"activedemand","name":"ActiveDEMAND","from":"*","from_inclusive":true,"to":"0.2.46","to_inclusive":true,"patched_in":"0.2.47"}],"published":"2025-04-16T00:00:00Z","updated":"2025-10-17T19:34:58Z"},{"id":"wordfence:77fd0714-ae9d-4136-beed-7f37b1266dc9","source":"wordfence","cve":"","title":"iPages Flipbook < 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77fd0714-ae9d-4136-beed-7f37b1266dc9?source=api-prod","affected":[{"type":"plugin","slug":"ipages-flipbook","name":"iPages \u2013 FlipBook Image & PDF Viewer","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77fdfb42-6540-43be-be5c-63dd6e1a34d7","source":"wordfence","cve":"CVE-2016-10953","title":"Headway < 3.8.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77fdfb42-6540-43be-be5c-63dd6e1a34d7?source=api-prod","affected":[{"type":"theme","slug":"headway","name":"Headway","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":false,"patched_in":"3.8.9"}],"published":"2006-10-13T20:01:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:77ff128b-952b-43a3-a57a-f274491ac022","source":"wordfence","cve":"CVE-2024-37114","title":"My Favorites <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77ff128b-952b-43a3-a57a-f274491ac022?source=api-prod","affected":[{"type":"plugin","slug":"my-favorites","name":"My Favorites","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-06-20T00:00:00Z","updated":"2026-01-13T16:53:19Z"},{"id":"wordfence:77ff6195-e2e6-49bd-a96e-d2f60b309368","source":"wordfence","cve":"CVE-2021-25008","title":"Code Snippets <= 2.14.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/77ff6195-e2e6-49bd-a96e-d2f60b309368?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"2.14.3","to_inclusive":false,"patched_in":"2.14.3"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7800d876-d55c-49cc-8881-d8935c4261eb","source":"wordfence","cve":"CVE-2026-93940","title":"Greeny - Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7800d876-d55c-49cc-8881-d8935c4261eb?source=api-prod","affected":[{"type":"theme","slug":"greeny","name":"Greeny - Electric Car Dealership WordPress Theme","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:49:18Z","updated":"2026-10-13T14:28:28Z"},{"id":"wordfence:7801d3e1-90aa-434d-ae3d-9f19670280c0","source":"wordfence","cve":"","title":"LayerSlider <= 4.6.1 - Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7801d3e1-90aa-434d-ae3d-9f19670280c0?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7802ed1f-138c-4a3d-916c-80fb4f7699b2","source":"wordfence","cve":"CVE-2024-1207","title":"Booking Calendar <= 9.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7802ed1f-138c-4a3d-916c-80fb4f7699b2?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.9","to_inclusive":true,"patched_in":"9.9.1"}],"published":"2024-02-07T00:00:00Z","updated":"2024-02-08T08:32:09Z"},{"id":"wordfence:7804c518-d0d6-474e-9a56-daf6a6eecccc","source":"wordfence","cve":"CVE-2016-10943","title":"ZX_CSV Upload <= 1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7804c518-d0d6-474e-9a56-daf6a6eecccc?source=api-prod","affected":[{"type":"plugin","slug":"zx-csv-upload","name":"ZX_CSV Upload","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2016-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78072f78-1c87-4ce0-b712-e10a25096316","source":"wordfence","cve":"CVE-2026-9690","title":"Media folder Addon <= 4.0.1 - Unauthenticated Arbitrary File Download","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78072f78-1c87-4ce0-b712-e10a25096316?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder-addon","name":"Media folder Addon","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:34:22Z"},{"id":"wordfence:7808329f-1688-480c-a83c-c4ab2fa86da6","source":"wordfence","cve":"CVE-2020-36710","title":"WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7808329f-1688-480c-a83c-c4ab2fa86da6?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.5.4.2","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2020-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7809697d-367a-4051-9865-440ba8ce7ad5","source":"wordfence","cve":"CVE-2024-47386","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7809697d-367a-4051-9865-440ba8ce7ad5?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:31:14Z"},{"id":"wordfence:7809f5ec-0b76-4244-ab9d-b6a90cf74716","source":"wordfence","cve":"CVE-2025-31579","title":"WP AutoKeyword <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7809f5ec-0b76-4244-ab9d-b6a90cf74716?source=api-prod","affected":[{"type":"plugin","slug":"wp-autokeyword","name":"WP AutoKeyword","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:34:11Z"},{"id":"wordfence:7812dd30-2896-45a7-8920-92ea061f4da3","source":"wordfence","cve":"CVE-2024-32457","title":"Elements Plus! <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7812dd30-2896-45a7-8920-92ea061f4da3?source=api-prod","affected":[{"type":"plugin","slug":"elements-plus","name":"Elements Plus!","from":"*","from_inclusive":true,"to":"2.16.3","to_inclusive":true,"patched_in":"2.16.4"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:25:57Z"},{"id":"wordfence:7813dfdc-06e0-4fa9-aabe-b5b9772368c2","source":"wordfence","cve":"CVE-2024-10117","title":"WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7813dfdc-06e0-4fa9-aabe-b5b9772368c2?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.1.12"}],"published":"2024-10-25T21:54:03Z","updated":"2024-10-26T11:18:19Z"},{"id":"wordfence:7814d40f-35ac-4a4c-9a77-70877e2bd103","source":"wordfence","cve":"CVE-2026-100145","title":"Synchrony Financing 1.0.5 - 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7814d40f-35ac-4a4c-9a77-70877e2bd103?source=api-prod","affected":[{"type":"plugin","slug":"synchrony-payments","name":"Synchrony Financing","from":"1.0.5","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:01:02Z"},{"id":"wordfence:7815322d-a240-4855-b458-60caa3cec96c","source":"wordfence","cve":"CVE-2023-51411","title":"Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7815322d-a240-4855-b458-60caa3cec96c?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.18.4"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-24T13:39:52Z"},{"id":"wordfence:7817a840-325a-4709-8374-84bb32d98d0e","source":"wordfence","cve":"CVE-2022-3708","title":"Web Stories <= 1.24.0 - Server Side Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=api-prod","affected":[{"type":"plugin","slug":"web-stories","name":"Web Stories","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2022-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7817f343-1ed6-4b76-afbe-1054de892422","source":"wordfence","cve":"CVE-2021-24956","title":"Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7817f343-1ed6-4b76-afbe-1054de892422?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"6.8.7"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:781987af-3753-46ec-9d56-fb8b6ef42277","source":"wordfence","cve":"CVE-2024-2183","title":"Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781987af-3753-46ec-9d56-fb8b6ef42277?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-addons-for-beaver-builder","name":"WPZOOM Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:00Z"},{"id":"wordfence:7819c1fa-884b-4f1d-ba63-84057bf6da84","source":"wordfence","cve":"CVE-2026-125055","title":"Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7819c1fa-884b-4f1d-ba63-84057bf6da84?source=api-prod","affected":[{"type":"plugin","slug":"chatterbug-forms","name":"Chatterbug Forms \u2013 Fast, Flexible WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-11-12T21:10:49Z","updated":"2026-11-13T09:35:13Z"},{"id":"wordfence:781a15da-5747-4480-a8a6-2944632742c1","source":"wordfence","cve":"","title":"PHP Event Calendar for WordPress < 1.5.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781a15da-5747-4480-a8a6-2944632742c1?source=api-prod","affected":[{"type":"plugin","slug":"php-event-calendar","name":"PHP Event Calendar for WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2015-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:781b00cd-3af9-432a-876b-bff482106ab0","source":"wordfence","cve":"CVE-2026-12248","title":"WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781b00cd-3af9-432a-876b-bff482106ab0?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-15T11:27:35Z"},{"id":"wordfence:781b4122-e3a0-465f-936c-4996577a3c40","source":"wordfence","cve":"CVE-2025-60235","title":"Helpdesk Support Ticket System for WooCommerce <= 2.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781b4122-e3a0-465f-936c-4996577a3c40?source=api-prod","affected":[{"type":"plugin","slug":"support-ticket-system-for-woocommerce","name":"Support Ticket System for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-12-11T20:42:13Z"},{"id":"wordfence:781c3b84-df80-470e-8bcb-3305a8bbb64a","source":"wordfence","cve":"CVE-2025-13376","title":"ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781c3b84-df80-470e-8bcb-3305a8bbb64a?source=api-prod","affected":[{"type":"plugin","slug":"projectlist","name":"ProjectList","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:12:59Z","updated":"2025-11-25T07:28:21Z"},{"id":"wordfence:781ead7a-f6d3-4fa8-b9aa-fd089e5cfd2b","source":"wordfence","cve":"CVE-2025-59592","title":"Make Column Clickable Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/781ead7a-f6d3-4fa8-b9aa-fd089e5cfd2b?source=api-prod","affected":[{"type":"plugin","slug":"make-column-clickable-elementor","name":"Make Column Clickable for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:38:23Z"},{"id":"wordfence:78203b98-15bc-4d8e-9278-c472b518be07","source":"wordfence","cve":"CVE-2024-1075","title":"Minimal Coming Soon \u2013 Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass","severity":"low","cvss":3.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78203b98-15bc-4d8e-9278-c472b518be07?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.37","to_inclusive":true,"patched_in":"2.38"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-05T21:21:51Z"},{"id":"wordfence:7821b17a-7da7-434f-8e3f-540e7d7cf6bb","source":"wordfence","cve":"CVE-2024-9652","title":"Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7821b17a-7da7-434f-8e3f-540e7d7cf6bb?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.47","to_inclusive":true,"patched_in":"3.9.48"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:06Z"},{"id":"wordfence:7822b102-e2c6-45f8-8800-8b932e473b9c","source":"wordfence","cve":"CVE-2025-53312","title":"OnionBuzz <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7822b102-e2c6-45f8-8800-8b932e473b9c?source=api-prod","affected":[{"type":"plugin","slug":"onionbuzz-viral-quiz","name":"OnionBuzz","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:22:51Z"},{"id":"wordfence:7826a6ab-50c4-4fc0-b58d-74084172b4e5","source":"wordfence","cve":"CVE-2024-1434","title":"Media Alt Renamer  0.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via _wp_attachment_image_alt postmeta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7826a6ab-50c4-4fc0-b58d-74084172b4e5?source=api-prod","affected":[{"type":"plugin","slug":"media-alt-renamer","name":"Media Alt Renamer","from":"0.0.1","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T19:21:37Z"},{"id":"wordfence:7827df3d-10ba-4bf1-aecb-fdf3f6f36ea6","source":"wordfence","cve":"CVE-2025-49889","title":"Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7827df3d-10ba-4bf1-aecb-fdf3f6f36ea6?source=api-prod","affected":[{"type":"plugin","slug":"customcomment","name":"Custom Comment","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-25T17:23:04Z"},{"id":"wordfence:782bb81f-f325-4ed3-9154-3ce7831f5561","source":"wordfence","cve":"CVE-2024-34550","title":"Dynamics 365 Integration <= 1.3.17 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782bb81f-f325-4ed3-9154-3ce7831f5561?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:49:43Z"},{"id":"wordfence:782bcc9b-222e-4fee-a9c4-563e64dda1fd","source":"wordfence","cve":"CVE-2026-96326","title":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782bcc9b-222e-4fee-a9c4-563e64dda1fd?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-09-28T13:26:28Z","updated":"2026-09-29T01:27:52Z"},{"id":"wordfence:782d0920-08dd-4df7-958c-3ed7128f3d55","source":"wordfence","cve":"CVE-2020-28649","title":"Child Theme Creator by Orbisius <= 1.5.1 - Cross-Site Request Forgery to Arbitrary File Modification and Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782d0920-08dd-4df7-958c-3ed7128f3d55?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-child-theme-creator","name":"Child Theme Creator by Orbisius","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2020-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:782d6b8d-92a0-4fdf-92b0-80e964cdbcf0","source":"wordfence","cve":"CVE-2025-62922","title":"Export Categories <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782d6b8d-92a0-4fdf-92b0-80e964cdbcf0?source=api-prod","affected":[{"type":"plugin","slug":"export-categories","name":"Export Categories","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-04T00:00:00Z","updated":"2025-10-29T14:59:44Z"},{"id":"wordfence:782d91d4-4e52-4ce6-9fd3-8f9a816856ce","source":"wordfence","cve":"CVE-2026-49776","title":"GPTranslate \u2013 Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782d91d4-4e52-4ce6-9fd3-8f9a816856ce?source=api-prod","affected":[{"type":"plugin","slug":"gptranslate","name":"GPTranslate \u2013 Multilingual AI Translation Agent for WordPress: Translate Your Site with AI","from":"*","from_inclusive":true,"to":"2.32.6","to_inclusive":true,"patched_in":"2.32.7"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:30:41Z"},{"id":"wordfence:782e30a7-6813-47b4-b447-d5f03dcb9dc4","source":"wordfence","cve":"CVE-2022-0271","title":"LearnPress <= 4.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782e30a7-6813-47b4-b447-d5f03dcb9dc4?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":false,"patched_in":"4.1.6"}],"published":"2022-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:782e954f-1fdf-49fa-97bc-60f8fb8c4ecd","source":"wordfence","cve":"CVE-2024-31350","title":"AWP Classifieds <= 4.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782e954f-1fdf-49fa-97bc-60f8fb8c4ecd?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:28:52Z"},{"id":"wordfence:782fcee6-0892-4454-be1f-384df653fb6e","source":"wordfence","cve":"CVE-2025-30812","title":"SKT Addons for Elementor <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/782fcee6-0892-4454-be1f-384df653fb6e?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:43:47Z"},{"id":"wordfence:7830b3dc-7d20-4516-b4d6-57636ca773e9","source":"wordfence","cve":"CVE-2026-13295","title":"Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7830b3dc-7d20-4516-b4d6-57636ca773e9?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.34.3","to_inclusive":true,"patched_in":"2.34.4"}],"published":"2026-06-26T17:44:35Z","updated":"2026-06-27T06:50:58Z"},{"id":"wordfence:7831b324-7016-4a5e-85bb-89de773cde0e","source":"wordfence","cve":"CVE-2025-23754","title":"The Loops <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7831b324-7016-4a5e-85bb-89de773cde0e?source=api-prod","affected":[{"type":"plugin","slug":"the-loops","name":"The Loops","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-19T16:14:57Z"},{"id":"wordfence:7832f8fe-2b41-4cfb-a734-db4ec88d91a3","source":"wordfence","cve":"CVE-2024-8614","title":"WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7832f8fe-2b41-4cfb-a734-db4ec88d91a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2024-11-05T19:59:05Z","updated":"2024-11-06T08:29:57Z"},{"id":"wordfence:7834c0be-3051-4d97-928e-cf5295c93463","source":"wordfence","cve":"CVE-2024-12457","title":"Chat Support for Viber \u2013 Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7834c0be-3051-4d97-928e-cf5295c93463?source=api-prod","affected":[{"type":"plugin","slug":"chat-viber","name":"Chat Support for Viber \u2013 Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-01-06T16:15:05Z","updated":"2025-01-17T19:00:21Z"},{"id":"wordfence:78376368-4883-48ce-aad0-e1d5a993cd74","source":"wordfence","cve":"CVE-2022-29424","title":"Image Hover Effects Ultimate <= 9.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78376368-4883-48ce-aad0-e1d5a993cd74?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"9.7.2"}],"published":"2022-05-04T06:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:783829c2-fe09-44a1-bbb5-2a694ad816ee","source":"wordfence","cve":"CVE-2023-23799","title":"Easy Panorama <= 1.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/783829c2-fe09-44a1-bbb5-2a694ad816ee?source=api-prod","affected":[{"type":"plugin","slug":"easy-panorama","name":"Easy Panorama","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78391643-6625-4f5b-a08d-3d8462292a1e","source":"wordfence","cve":"CVE-2025-68863","title":"iContact for Gravity Forms <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78391643-6625-4f5b-a08d-3d8462292a1e?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-icontact","name":"iContact for Gravity Forms","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T20:56:53Z"},{"id":"wordfence:78393d56-5e83-4eac-bee7-a194aaaa8f5e","source":"wordfence","cve":"CVE-2025-23822","title":"Category Custom Fields <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78393d56-5e83-4eac-bee7-a194aaaa8f5e?source=api-prod","affected":[{"type":"plugin","slug":"categorycustomfields","name":"Category Custom Fields","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:46:49Z"},{"id":"wordfence:783ccf21-db16-4aac-9a3c-992b3aac5526","source":"wordfence","cve":"CVE-2026-15159","title":"Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/783ccf21-db16-4aac-9a3c-992b3aac5526?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-excel-export","name":"Ninja Forms - Excel Export","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-07-16T13:43:17Z","updated":"2026-07-17T02:31:32Z"},{"id":"wordfence:783e5794-0d74-4b7a-a1cd-2b834a50c50c","source":"wordfence","cve":"CVE-2023-25468","title":"Reservation.Studio widget <= 1.0.11 - Cross-Site Request Forgery via plugin settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/783e5794-0d74-4b7a-a1cd-2b834a50c50c?source=api-prod","affected":[{"type":"plugin","slug":"reservation-studio-widget","name":"Reservation.Studio widget","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78422a30-bdc6-4e7c-a018-c3dc4b4be6a0","source":"wordfence","cve":"CVE-2024-1906","title":"Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78422a30-bdc6-4e7c-a018-c3dc4b4be6a0?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:49:20Z"},{"id":"wordfence:784593ec-b635-4f59-9afb-ab506f786d21","source":"wordfence","cve":"CVE-2024-7855","title":"WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/784593ec-b635-4f59-9afb-ab506f786d21?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T04:31:18Z"},{"id":"wordfence:784683f5-031e-4436-a462-296893f5453f","source":"wordfence","cve":"CVE-2026-96331","title":"Ajax Search Pro <= 4.29.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/784683f5-031e-4436-a462-296893f5453f?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-pro","name":"Ajax Search Pro","from":"*","from_inclusive":true,"to":"4.29.1","to_inclusive":true,"patched_in":"4.29.2"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:35:37Z"},{"id":"wordfence:7846dc45-206c-43b3-8a3a-84199248b262","source":"wordfence","cve":"CVE-2025-57923","title":"UK Address Postcode Validation <= 3.9.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7846dc45-206c-43b3-8a3a-84199248b262?source=api-prod","affected":[{"type":"plugin","slug":"uk-address-postcode-validation","name":"UK Address Postcode Validation","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T13:59:17Z"},{"id":"wordfence:7848e904-b521-479b-bf7e-d695ad0163b0","source":"wordfence","cve":"CVE-2021-24979","title":"Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7848e904-b521-479b-bf7e-d695ad0163b0?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":false,"patched_in":"2.6.6"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:784998a7-550d-4299-9995-af01e5ee1d21","source":"wordfence","cve":"CVE-2025-6783","title":"GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/784998a7-550d-4299-9995-af01e5ee1d21?source=api-prod","affected":[{"type":"plugin","slug":"gozen-forms","name":"GoZen Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:18:15Z","updated":"2025-07-04T01:44:04Z"},{"id":"wordfence:7849addf-cdee-4de2-9b6c-bb1c92a472fd","source":"wordfence","cve":"CVE-2025-30794","title":"Event Tickets <= 5.20.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7849addf-cdee-4de2-9b6c-bb1c92a472fd?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.20.0","to_inclusive":true,"patched_in":"5.20.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:33:23Z"},{"id":"wordfence:784e3b21-08f5-4cbc-b726-fe60e1faefea","source":"wordfence","cve":"","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.4.95 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/784e3b21-08f5-4cbc-b726-fe60e1faefea?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.4.95","to_inclusive":true,"patched_in":"1.4.96"}],"published":"2015-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78502e58-c447-48d3-a627-ec5eeb330928","source":"wordfence","cve":"CVE-2026-110776","title":"MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78502e58-c447-48d3-a627-ec5eeb330928?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-11-05T20:43:37Z","updated":"2026-11-06T09:38:13Z"},{"id":"wordfence:78526fa8-31f8-4618-8064-60baa2cd5615","source":"wordfence","cve":"CVE-2025-27330","title":"PlayerJS <= 2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78526fa8-31f8-4618-8064-60baa2cd5615?source=api-prod","affected":[{"type":"plugin","slug":"playerjs","name":"PlayerJS \u2013 Free Custom HTML5 Video and Audio Player Builder","from":"*","from_inclusive":true,"to":"2.23","to_inclusive":true,"patched_in":"2.24"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:14:24Z"},{"id":"wordfence:7853c3e8-0c21-4681-a5b9-05ad2db02a7a","source":"wordfence","cve":"CVE-2025-28886","title":"REST API TO MiniProgram <= 4.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7853c3e8-0c21-4681-a5b9-05ad2db02a7a?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-to-miniprogram","name":"REST API TO MiniProgram","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:35:17Z"},{"id":"wordfence:7857571c-182f-4072-8cae-8b0c1b3a9d31","source":"wordfence","cve":"CVE-2025-32519","title":"IDonate <= 2.1.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7857571c-182f-4072-8cae-8b0c1b3a9d31?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2026-10-27T07:30:06Z"},{"id":"wordfence:78579ed9-1540-44be-9884-51fc2afec2bd","source":"wordfence","cve":"CVE-2023-31213","title":"WPBakery Page Builder for WordPress <= 6.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78579ed9-1540-44be-9884-51fc2afec2bd?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"6.12.0","to_inclusive":true,"patched_in":"6.13.0"}],"published":"2023-06-20T00:00:00Z","updated":"2025-07-15T13:27:07Z"},{"id":"wordfence:7860dfa8-de76-4ca3-bd80-98550afab56b","source":"wordfence","cve":"CVE-2025-13756","title":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7860dfa8-de76-4ca3-bd80-98550afab56b?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2025-12-03T00:41:01Z","updated":"2025-12-03T13:52:46Z"},{"id":"wordfence:7863c5fb-1eda-41a3-b8ec-054784ab2438","source":"wordfence","cve":"CVE-2024-13713","title":"WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7863c5fb-1eda-41a3-b8ec-054784ab2438?source=api-prod","affected":[{"type":"plugin","slug":"wpexperts-square-for-give","name":"Square Gateway for GiveWP by WPExperts","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-02-20T21:30:15Z","updated":"2025-02-21T11:09:34Z"},{"id":"wordfence:7863f63c-11b5-43ac-9d68-8eb9925cdf7e","source":"wordfence","cve":"CVE-2018-1002002","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7863f63c-11b5-43ac-9d68-8eb9925cdf7e?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7864cd19-85bd-4c8c-818d-4e14ea2e3bc1","source":"wordfence","cve":"CVE-2025-15489","title":"Passster <= 4.2.23 - Unauthenticated Protected Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7864cd19-85bd-4c8c-818d-4e14ea2e3bc1?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"4.2.24"}],"published":"2026-02-17T00:00:00Z","updated":"2026-09-16T15:11:45Z"},{"id":"wordfence:78669d4f-3c1e-49e6-af8d-56f105f99d01","source":"wordfence","cve":"CVE-2005-1810","title":"WordPress Core < 1.5.1.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78669d4f-3c1e-49e6-af8d-56f105f99d01?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.1","to_inclusive":true,"patched_in":"1.5.1.2"}],"published":"2005-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7867d651-dd15-4d91-a7ca-65f49cb94b65","source":"wordfence","cve":"","title":"Search Autocomplete < 1.0.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7867d651-dd15-4d91-a7ca-65f49cb94b65?source=api-prod","affected":[{"type":"plugin","slug":"search-autocomplete","name":"SearchAutocomplete","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2011-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:786af6d8-64ca-4dd8-9539-f521b30796b9","source":"wordfence","cve":"CVE-2026-28095","title":"Marcell <= 1.2.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786af6d8-64ca-4dd8-9539-f521b30796b9?source=api-prod","affected":[{"type":"theme","slug":"marcell","name":"Marcell - Personal Blog & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:05:30Z"},{"id":"wordfence:786b1b8f-7f63-4ac4-a808-668b38bf0fb4","source":"wordfence","cve":"CVE-2025-9172","title":"Vibes <= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786b1b8f-7f63-4ac4-a808-668b38bf0fb4?source=api-prod","affected":[{"type":"plugin","slug":"vibes","name":"Vibes","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-08-25T14:10:31Z","updated":"2025-08-26T03:24:49Z"},{"id":"wordfence:786d147b-2013-476b-a684-d070f07a166d","source":"wordfence","cve":"CVE-2021-24838","title":"AnyComment <= 0.3.4 - Open Redirect via redirect parameter","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786d147b-2013-476b-a684-d070f07a166d?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":false,"patched_in":"0.3.5"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:786e16be-dee9-43de-afe3-dcc0d17bc92b","source":"wordfence","cve":"CVE-2024-13549","title":"All Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786e16be-dee9-43de-afe3-dcc0d17bc92b?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.26","to_inclusive":true,"patched_in":"1.3.27"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:42:03Z"},{"id":"wordfence:786ef53a-0fcd-4226-b469-52b72cd6890c","source":"wordfence","cve":"CVE-2026-15761","title":"Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786ef53a-0fcd-4226-b469-52b72cd6890c?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.1","to_inclusive":true,"patched_in":"3.6.0.2"}],"published":"2026-07-22T20:30:43Z","updated":"2026-07-23T08:34:39Z"},{"id":"wordfence:786f58d7-2379-49f4-8eba-4d0b2e2c71bc","source":"wordfence","cve":"CVE-2026-107790","title":"Job Openings <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/786f58d7-2379-49f4-8eba-4d0b2e2c71bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-openings","name":"HireZoot \u2013 Job Listings, Career Page & Recruitment Tool","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:23:12Z"},{"id":"wordfence:7870badf-a1c8-4a47-adac-d6535ab81d79","source":"wordfence","cve":"","title":"CURCY <= 2.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7870badf-a1c8-4a47-adac-d6535ab81d79?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78736dd3-68d8-46b5-9d6c-08e08f36f27e","source":"wordfence","cve":"CVE-2026-39070","title":"Bit Assist  <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78736dd3-68d8-46b5-9d6c-08e08f36f27e?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-16T18:36:12Z"},{"id":"wordfence:78746454-ba1f-4b1e-8111-1e239100f0be","source":"wordfence","cve":"CVE-2026-81760","title":"JetEngine <= 3.8.14.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78746454-ba1f-4b1e-8111-1e239100f0be?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14.2","to_inclusive":true,"patched_in":"3.8.14.3"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:57:46Z"},{"id":"wordfence:78759abf-4584-4beb-9ae7-39a5c3fe4b75","source":"wordfence","cve":"","title":"YARPP \u2013 Yet Another Related Posts Plugin < 4.2.5 - Cross-Site Request Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78759abf-4584-4beb-9ae7-39a5c3fe4b75?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":false,"patched_in":"4.2.5"}],"published":"2015-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7875e975-0559-4c18-819b-1171d2c8b87e","source":"wordfence","cve":"CVE-2026-39580","title":"Micdrop <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7875e975-0559-4c18-819b-1171d2c8b87e?source=api-prod","affected":[{"type":"theme","slug":"micdrop","name":"Micdrop - Music WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:52:07Z"},{"id":"wordfence:78760d4d-04fc-4a6c-8c0d-6bf897335651","source":"wordfence","cve":"","title":"Flamingo <= 2.1 - CSV Injection","severity":"medium","cvss":6.4,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78760d4d-04fc-4a6c-8c0d-6bf897335651?source=api-prod","affected":[{"type":"plugin","slug":"flamingo","name":"Flamingo","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2020-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:787929b7-e8e0-4b24-9556-0198199c417f","source":"wordfence","cve":"CVE-2025-9635","title":"Analytics Reduce Bounce Rate <= 2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787929b7-e8e0-4b24-9556-0198199c417f?source=api-prod","affected":[{"type":"plugin","slug":"analytics-unbounce","name":"Analytics Reduce Bounce Rate","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:44:22Z","updated":"2025-09-11T07:24:55Z"},{"id":"wordfence:78794ea4-6eff-4e6f-af0a-dd8cab8ac859","source":"wordfence","cve":"CVE-2025-13093","title":"Devs CRM \u2013 Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78794ea4-6eff-4e6f-af0a-dd8cab8ac859?source=api-prod","affected":[{"type":"plugin","slug":"devs-crm","name":"Devs CRM","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-12-12T16:08:07Z","updated":"2026-09-18T18:47:31Z"},{"id":"wordfence:78797c97-a5b8-4d2d-acd2-ebd508f2f836","source":"wordfence","cve":"CVE-2024-31108","title":"iFlyChat \u2013 WordPress Chat <= 4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78797c97-a5b8-4d2d-acd2-ebd508f2f836?source=api-prod","affected":[{"type":"plugin","slug":"iflychat","name":"iFlyChat \u2013 WordPress Chat","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:40:57Z"},{"id":"wordfence:7879aaad-37b2-410d-9b21-029bed47202c","source":"wordfence","cve":"CVE-2026-1820","title":"Media Library Alt Text Editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7879aaad-37b2-410d-9b21-029bed47202c?source=api-prod","affected":[{"type":"plugin","slug":"media-library-alt-text-editor","name":"Media Library Alt Text Editor","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:44:35Z","updated":"2026-03-07T07:22:05Z"},{"id":"wordfence:787a19cf-a553-4aec-96c5-978956826756","source":"wordfence","cve":"","title":"WP Spell Check <= 9.12 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787a19cf-a553-4aec-96c5-978956826756?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"9.12","to_inclusive":true,"patched_in":"9.13"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:787ab3f0-c8c4-46cd-bfbe-ac1ca508898a","source":"wordfence","cve":"CVE-2022-4512","title":"Better Font Awesome <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787ab3f0-c8c4-46cd-bfbe-ac1ca508898a?source=api-prod","affected":[{"type":"plugin","slug":"better-font-awesome","name":"Better Font Awesome","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:787cd2bb-489f-471a-82e0-073b4766b45a","source":"wordfence","cve":"CVE-2024-11299","title":"Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787cd2bb-489f-471a-82e0-073b4766b45a?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.37","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-22T11:12:30Z"},{"id":"wordfence:787e22a9-329b-4e71-bc2a-4f5524fc9356","source":"wordfence","cve":"CVE-2026-84434","title":"Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.1.0.4","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-09-18T13:56:54Z","updated":"2026-09-19T02:27:10Z"},{"id":"wordfence:78823184-e90a-4f5c-9f08-5ffc22787f16","source":"wordfence","cve":"CVE-2015-9442","title":"Avenir-soft Direct Download <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78823184-e90a-4f5c-9f08-5ffc22787f16?source=api-prod","affected":[{"type":"plugin","slug":"avenirsoft-directdownload","name":"Avenir-soft Direct Download","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:788422c4-e070-48aa-a85d-a5d5a25a6a1d","source":"wordfence","cve":"CVE-2026-5192","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.52.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2026-05-04T17:49:05Z","updated":"2026-05-05T06:43:31Z"},{"id":"wordfence:788461ba-2cf2-49d2-bbaa-a02de15f33ae","source":"wordfence","cve":"CVE-2026-93388","title":"Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788461ba-2cf2-49d2-bbaa-a02de15f33ae?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-10-13T13:14:38Z","updated":"2026-10-14T01:27:14Z"},{"id":"wordfence:7886708a-8daa-465b-b820-53bf409e682c","source":"wordfence","cve":"","title":"Tidio Live Chat < 4.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7886708a-8daa-465b-b820-53bf409e682c?source=api-prod","affected":[{"type":"plugin","slug":"tidio-live-chat","name":"Tidio \u2013 Live Chat & AI Chatbots","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"}],"published":"2019-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7887e0a6-53bf-49c7-a7a6-7c65cec28cae","source":"wordfence","cve":"","title":"Refraction <= 1.3 - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7887e0a6-53bf-49c7-a7a6-7c65cec28cae?source=api-prod","affected":[{"type":"theme","slug":"refraction","name":"Refraction","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"rt_refraction_wp","name":"rt_refraction_wp","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2014-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7888aedb-5421-4c3a-8459-d6177b398a06","source":"wordfence","cve":"CVE-2025-8690","title":"Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7888aedb-5421-4c3a-8459-d6177b398a06?source=api-prod","affected":[{"type":"plugin","slug":"addi-simple-slider","name":"Simple Responsive Slider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T14:05:09Z","updated":"2025-08-12T02:24:47Z"},{"id":"wordfence:7889e071-84a8-46ec-abe5-5c98980ce275","source":"wordfence","cve":"CVE-2026-6235","title":"Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7889e071-84a8-46ec-abe5-5c98980ce275?source=api-prod","affected":[{"type":"plugin","slug":"sendmachine","name":"Sendmachine for WordPress","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-04-21T19:01:50Z","updated":"2026-08-06T16:27:31Z"},{"id":"wordfence:788bd3dc-43c3-4115-b760-f04ec6d30f4e","source":"wordfence","cve":"CVE-2025-68850","title":"Sell Downloads <= 1.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788bd3dc-43c3-4115-b760-f04ec6d30f4e?source=api-prod","affected":[{"type":"plugin","slug":"sell-downloads","name":"Sell Downloads","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-27T20:48:31Z"},{"id":"wordfence:788bf199-bf09-4076-b5f1-129b6287096a","source":"wordfence","cve":"CVE-2015-10124","title":"Most Popular Posts Widget <= 0.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788bf199-bf09-4076-b5f1-129b6287096a?source=api-prod","affected":[{"type":"plugin","slug":"most-popular-posts-widget-lite","name":"Most Popular Posts Widget","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":"0.9"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:788c94a7-a8d6-4ae3-b4ca-f5c60e536f57","source":"wordfence","cve":"CVE-2024-13456","title":"Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788c94a7-a8d6-4ae3-b4ca-f5c60e536f57?source=api-prod","affected":[{"type":"plugin","slug":"n-media-wp-simple-quiz","name":"Easy Quiz Maker","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T09:22:49Z"},{"id":"wordfence:788e1c5c-67a9-4b06-a2cf-15c980e83618","source":"wordfence","cve":"CVE-2019-20211","title":"CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788e1c5c-67a9-4b06-a2cf-15c980e83618?source=api-prod","affected":[{"type":"theme","slug":"easybook","name":"EasyBook \u2013 Hotel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"theme","slug":"townhub","name":"TownHub - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"citybook","name":"CityBook - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2019-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:788e314b-ac82-4669-bcf4-7c369f67d42f","source":"wordfence","cve":"CVE-2026-116395","title":"All In One Lightbox \u2013 show any media in beautiful popups <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788e314b-ac82-4669-bcf4-7c369f67d42f?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-block","name":"All In One Lightbox \u2013 show any media in beautiful popups","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-10-26T16:46:00Z","updated":"2026-10-28T01:26:36Z"},{"id":"wordfence:788fdee8-2eae-437e-8a8d-1d01776cbe6b","source":"wordfence","cve":"CVE-2023-37989","title":"Easyship WooCommerce Shipping Rates <= 0.8.9 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788fdee8-2eae-437e-8a8d-1d01776cbe6b?source=api-prod","affected":[{"type":"plugin","slug":"easyship-woocommerce-shipping-rates","name":"Easyship WooCommerce Shipping Rates","from":"*","from_inclusive":true,"to":"0.8.9","to_inclusive":true,"patched_in":"0.9.1"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78912210-50d3-41fd-9d79-61b09b54ac78","source":"wordfence","cve":"CVE-2024-51604","title":"Media Modal <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78912210-50d3-41fd-9d79-61b09b54ac78?source=api-prod","affected":[{"type":"plugin","slug":"media-modal","name":"Media Modal","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:57:54Z"},{"id":"wordfence:78914fef-6ab4-49b8-8c67-3a634759194c","source":"wordfence","cve":"","title":"Tinymce Thumbnail Gallery <= 1.0.7 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78914fef-6ab4-49b8-8c67-3a634759194c?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-thumbnail-gallery","name":"Tinymce Thumbnail Gallery","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7891b657-a6bc-40e8-bf43-02b4c05d63a9","source":"wordfence","cve":"CVE-2024-47629","title":"Ultimate Store Kit Elementor Addons <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7891b657-a6bc-40e8-bf43-02b4c05d63a9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:11:21Z"},{"id":"wordfence:7892842f-88d0-404e-ba1d-47239f4a4b66","source":"wordfence","cve":"CVE-2024-51853","title":"Faltu Testimonial Rotator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7892842f-88d0-404e-ba1d-47239f4a4b66?source=api-prod","affected":[{"type":"plugin","slug":"faltu-testimonial-rotator","name":"Faltu Testimonial Rotator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:24:10Z"},{"id":"wordfence:7892c40e-d755-4be4-8662-5e00f98b4a4a","source":"wordfence","cve":"CVE-2026-103082","title":"LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7892c40e-d755-4be4-8662-5e00f98b4a4a?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-10-01T10:39:00Z","updated":"2026-10-08T23:16:19Z"},{"id":"wordfence:7892c965-c82b-4fe7-be45-ae2c0356a3e5","source":"wordfence","cve":"CVE-2026-62074","title":"Ozeum | Art Gallery and Museum Theme <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7892c965-c82b-4fe7-be45-ae2c0356a3e5?source=api-prod","affected":[{"type":"theme","slug":"ozeum","name":"Ozeum | Art Gallery and Museum Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:39:15Z","updated":"2026-10-13T14:16:01Z"},{"id":"wordfence:789497b1-36cf-4de2-bca0-52c0c2a08f72","source":"wordfence","cve":"CVE-2023-23873","title":"BBSpoiler <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/789497b1-36cf-4de2-bca0-52c0c2a08f72?source=api-prod","affected":[{"type":"plugin","slug":"bbspoiler","name":"BBSpoiler","from":"*","from_inclusive":true,"to":"2.01","to_inclusive":true,"patched_in":"2.02"}],"published":"2023-04-18T00:00:00Z","updated":"2026-02-26T14:50:58Z"},{"id":"wordfence:7894a19c-b873-4c5b-8c82-6656cc306ee2","source":"wordfence","cve":"CVE-2024-0844","title":"Popup More <= 2.2.4 - Authenticated (Admin+) Directory Traversal to Limited Local File Inclusion","severity":"medium","cvss":4.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7894a19c-b873-4c5b-8c82-6656cc306ee2?source=api-prod","affected":[{"type":"plugin","slug":"popup-more","name":"AI Popup","from":"2.1.6","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-09T19:19:14Z"},{"id":"wordfence:789670b1-8cc3-4b66-87e3-a0da6fbd2706","source":"wordfence","cve":"CVE-2024-51793","title":"Computer Repair Shop <= 3.8115 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/789670b1-8cc3-4b66-87e3-a0da6fbd2706?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.8115","to_inclusive":true,"patched_in":"3.8116"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-15T16:40:40Z"},{"id":"wordfence:7897ebc7-3ede-465e-b037-86096eb4435a","source":"wordfence","cve":"CVE-2024-33586","title":"Photo Gallery by 10Web <= 1.8.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7897ebc7-3ede-465e-b037-86096eb4435a?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.20","to_inclusive":true,"patched_in":"1.8.21"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:02:12Z"},{"id":"wordfence:78a411e3-5228-4ac2-bf39-6bdec5d9e313","source":"wordfence","cve":"CVE-2021-24328","title":"WP Login Security and History <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78a411e3-5228-4ac2-bf39-6bdec5d9e313?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-security-and-history","name":"WP Login Security and History","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78a464e0-f2d9-4916-aa93-d52a98757a91","source":"wordfence","cve":"CVE-2024-5604","title":"Bug Library <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78a464e0-f2d9-4916-aa93-d52a98757a91?source=api-prod","affected":[{"type":"plugin","slug":"bug-library","name":"Bug Library","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-25T14:04:43Z"},{"id":"wordfence:78a5b2ab-4735-41b9-8807-8f98586cd3d7","source":"wordfence","cve":"CVE-2024-43932","title":"The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78a5b2ab-4735-41b9-8807-8f98586cd3d7?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:49:22Z"},{"id":"wordfence:78a8feac-70f5-4593-a855-da66d3c7d6b6","source":"wordfence","cve":"CVE-2024-8536","title":"Ultimate Blocks <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78a8feac-70f5-4593-a855-da66d3c7d6b6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-09-09T00:00:00Z","updated":"2024-10-03T20:53:38Z"},{"id":"wordfence:78ab6263-7762-4fd2-af42-2224efa9509e","source":"wordfence","cve":"CVE-2026-12110","title":"Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ab6263-7762-4fd2-af42-2224efa9509e?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-06-30T15:24:40Z","updated":"2026-07-01T03:43:36Z"},{"id":"wordfence:78ac100e-ba2f-4ba6-9125-9cc2d531cc0e","source":"wordfence","cve":"CVE-2026-32516","title":"Miraculous Core < 2.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ac100e-ba2f-4ba6-9125-9cc2d531cc0e?source=api-prod","affected":[{"type":"plugin","slug":"miraculouscore","name":"Miraculous Core","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:05:16Z"},{"id":"wordfence:78ac91af-4d71-43f4-b9fc-cf5e6874e7de","source":"wordfence","cve":"CVE-2025-3434","title":"SMTP for Amazon SES \u2013 YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ac91af-4d71-43f4-b9fc-cf5e6874e7de?source=api-prod","affected":[{"type":"plugin","slug":"smtp-amazon-ses","name":"SMTP for Amazon SES \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-04-10T19:59:29Z","updated":"2025-04-11T08:21:33Z"},{"id":"wordfence:78af081a-807b-48c8-82cd-f87fbef0fbe6","source":"wordfence","cve":"CVE-2024-2959","title":"SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78af081a-807b-48c8-82cd-f87fbef0fbe6?source=api-prod","affected":[{"type":"plugin","slug":"svs-pricing-tables","name":"SVS Pricing Tables","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:15Z"},{"id":"wordfence:78af6e06-4b4c-4f56-a6f8-f98e8f681976","source":"wordfence","cve":"CVE-2024-8500","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78af6e06-4b4c-4f56-a6f8-f98e8f681976?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2024-10-22T00:00:00Z","updated":"2024-10-23T11:04:27Z"},{"id":"wordfence:78af7acb-bcaf-4ad9-807e-4a95a522f8c5","source":"wordfence","cve":"CVE-2024-52481","title":"Jobify - Job Board WordPress Theme < 4.3.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78af7acb-bcaf-4ad9-807e-4a95a522f8c5?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2024-11-18T00:00:00Z","updated":"2026-02-26T15:02:36Z"},{"id":"wordfence:78b12984-72ce-493f-b1ef-200e96c6eb57","source":"wordfence","cve":"","title":"Explicit (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b12984-72ce-493f-b1ef-200e96c6eb57?source=api-prod","affected":[{"type":"theme","slug":"explicit","name":"Explicit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78b24567-c185-4bef-b025-016b091be2e4","source":"wordfence","cve":"CVE-2024-3988","title":"Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b24567-c185-4bef-b025-016b091be2e4?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2024-04-24T00:00:00Z","updated":"2024-04-25T07:33:59Z"},{"id":"wordfence:78b2e66b-7ef1-40f7-a65e-0ed979197a4c","source":"wordfence","cve":"CVE-2024-37487","title":"WP Directory Kit <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b2e66b-7ef1-40f7-a65e-0ed979197a4c?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T20:52:18Z"},{"id":"wordfence:78b444a2-e5d7-4c3a-86a4-c215c54687a2","source":"wordfence","cve":"CVE-2025-6229","title":"Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b444a2-e5d7-4c3a-86a4-c215c54687a2?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-03-22T18:10:01Z","updated":"2026-03-23T06:41:08Z"},{"id":"wordfence:78b60dca-0225-43c8-b6cf-0213b1619b65","source":"wordfence","cve":"CVE-2024-25094","title":"PJ News Ticker <= 1.9.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b60dca-0225-43c8-b6cf-0213b1619b65?source=api-prod","affected":[{"type":"plugin","slug":"pj-news-ticker","name":"PJ News Ticker","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2024-02-12T00:00:00Z","updated":"2024-10-15T11:50:00Z"},{"id":"wordfence:78b79a03-f2d0-42bb-a6e9-298c6cdd2ffa","source":"wordfence","cve":"CVE-2024-2402","title":"Better Comments <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b79a03-f2d0-42bb-a6e9-298c6cdd2ffa?source=api-prod","affected":[{"type":"plugin","slug":"better-comments","name":"Better Comments","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-04-03T00:00:00Z","updated":"2024-05-01T13:35:09Z"},{"id":"wordfence:78b7d99a-d521-4491-a168-df7c2cb4f285","source":"wordfence","cve":"CVE-2024-52343","title":"OS Pricing Tables <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b7d99a-d521-4491-a168-df7c2cb4f285?source=api-prod","affected":[{"type":"plugin","slug":"os-pricing-tables","name":"OS Pricing Tables","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:49:00Z"},{"id":"wordfence:78b8e9f7-969f-42fa-8544-0ac4089aa35b","source":"wordfence","cve":"CVE-2025-68041","title":"Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b8e9f7-969f-42fa-8544-0ac4089aa35b?source=api-prod","affected":[{"type":"plugin","slug":"codistoconnect","name":"Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration \u2013 Powered by Codisto","from":"*","from_inclusive":true,"to":"1.3.65","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T15:55:31Z"},{"id":"wordfence:78b98f21-ac0c-496b-8cb9-8d2f3bd751b1","source":"wordfence","cve":"CVE-2019-16780","title":"WordPress Core < 5.3.1 - Stored Cross-Site Scripting via Block Editor","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78b98f21-ac0c-496b-8cb9-8d2f3bd751b1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.20","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.19","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.16","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.15","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2019-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78ba132c-b5b4-4999-a0ec-67d17ae2857f","source":"wordfence","cve":"CVE-2024-8352","title":"Social Web Suite \u2013 Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=api-prod","affected":[{"type":"plugin","slug":"social-web-suite","name":"Social Web Suite \u2013 Social Media Auto Post, Social Media Auto Publish","from":"*","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"4.1.12"}],"published":"2024-10-02T15:30:20Z","updated":"2024-10-03T03:39:03Z"},{"id":"wordfence:78bb5e18-5535-4cee-a38b-e38802059ef7","source":"wordfence","cve":"","title":"Paid Memberships Pro <= 2.0.5 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78bb5e18-5535-4cee-a38b-e38802059ef7?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2019-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78bc002d-5b29-4bcd-8837-7c014be68b9e","source":"wordfence","cve":"CVE-2026-111972","title":"Photo Engine <= 6.5.7 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78bc002d-5b29-4bcd-8837-7c014be68b9e?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:48:36Z"},{"id":"wordfence:78c1308b-0849-4235-b2d6-0b1750a5614f","source":"wordfence","cve":"CVE-2024-13446","title":"Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c1308b-0849-4235-b2d6-0b1750a5614f?source=api-prod","affected":[{"type":"plugin","slug":"workreap","name":"Workreap","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T09:22:26Z"},{"id":"wordfence:78c19531-550d-4b97-a30d-adcaad43b53b","source":"wordfence","cve":"CVE-2019-14791","title":"Appointment Booking Calendar < 1.3.19 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c19531-550d-4b97-a30d-adcaad43b53b?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":false,"patched_in":"1.3.19"}],"published":"2019-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78c2d5fc-240a-4fed-92ae-b9f84de3e119","source":"wordfence","cve":"CVE-2024-12453","title":"Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c2d5fc-240a-4fed-92ae-b9f84de3e119?source=api-prod","affected":[{"type":"plugin","slug":"uptodown-apk-download-widget","name":"Uptodown APK Download Widget","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":"0.1.11"}],"published":"2025-01-06T16:17:43Z","updated":"2025-01-24T18:50:03Z"},{"id":"wordfence:78c3c57f-9e52-42c4-9e94-806fe5fb75f9","source":"wordfence","cve":"CVE-2026-32489","title":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection < 2.0.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c3c57f-9e52-42c4-9e94-806fe5fb75f9?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.0.30","to_inclusive":false,"patched_in":"2.0.30"}],"published":"2026-04-23T00:00:00Z","updated":"2026-05-05T14:58:53Z"},{"id":"wordfence:78c6b9c0-c503-4486-8102-92dbd34ad9c9","source":"wordfence","cve":"CVE-2025-22500","title":"Alpha Price Table For Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c6b9c0-c503-4486-8102-92dbd34ad9c9?source=api-prod","affected":[{"type":"plugin","slug":"alpha-price-table-for-elementor","name":"Alpha Price Table For Elementor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:29:11Z"},{"id":"wordfence:78c6c5ff-8658-4a3d-be01-2141d1cff8bf","source":"wordfence","cve":"CVE-2024-32704","title":"ARForms <= 6.4 - Missing Authorization to Arbitrary Option Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c6c5ff-8658-4a3d-be01-2141d1cff8bf?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:06:47Z"},{"id":"wordfence:78c88402-52ca-44ff-8767-1f843fcb66fd","source":"wordfence","cve":"CVE-2024-6688","title":"Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78c88402-52ca-44ff-8767-1f843fcb66fd?source=api-prod","affected":[{"type":"plugin","slug":"oxygenbuilder","name":"Oxygen Builder","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.9"}],"published":"2024-08-26T15:48:07Z","updated":"2024-08-27T04:29:18Z"},{"id":"wordfence:78ca8110-fd39-4fcb-bac7-94732c14aee2","source":"wordfence","cve":"CVE-2018-0578","title":"PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ca8110-fd39-4fcb-bac7-94732c14aee2?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"}],"published":"2018-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78cb078e-a3ce-42e7-a2e3-b85f5343a0d0","source":"wordfence","cve":"CVE-2025-32162","title":"Chamber Dashboard Business Directory <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78cb078e-a3ce-42e7-a2e3-b85f5343a0d0?source=api-prod","affected":[{"type":"plugin","slug":"chamber-dashboard-business-directory","name":"Chamber Dashboard Business Directory","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T18:49:32Z"},{"id":"wordfence:78ce3f11-666f-4f2e-b917-df0b7ca92da1","source":"wordfence","cve":"CVE-2026-106609","title":"Bayarcash WooCommerce <= 4.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ce3f11-666f-4f2e-b917-df0b7ca92da1?source=api-prod","affected":[{"type":"plugin","slug":"bayarcash-wc","name":"Bayarcash WooCommerce","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2026-10-08T16:38:44Z","updated":"2026-10-13T13:43:08Z"},{"id":"wordfence:78ce6a2a-aa28-4ae9-a2e7-ca3861a9677f","source":"wordfence","cve":"CVE-2023-46193","title":"Internal Link Building <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ce6a2a-aa28-4ae9-a2e7-ca3861a9677f?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-building-plugin","name":"Internal Link Building","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78d63e8d-447e-462a-bdce-7824d6db4101","source":"wordfence","cve":"CVE-2025-22798","title":"Responsive jQuery Slider <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78d63e8d-447e-462a-bdce-7824d6db4101?source=api-prod","affected":[{"type":"plugin","slug":"responsive-jquery-slider","name":"Responsive jQuery Slider","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:13:27Z"},{"id":"wordfence:78d7920b-3e20-43c7-a522-72bac824c2cb","source":"wordfence","cve":"CVE-2024-1072","title":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78d7920b-3e20-43c7-a522-72bac824c2cb?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.15.21","to_inclusive":true,"patched_in":"6.15.22"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T21:21:52Z"},{"id":"wordfence:78d8ddc9-69ad-4d69-ac23-5a31dfeafd54","source":"wordfence","cve":"CVE-2024-3190","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78d8ddc9-69ad-4d69-ac23-5a31dfeafd54?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.107","to_inclusive":true,"patched_in":"1.5.108"}],"published":"2024-05-29T15:02:34Z","updated":"2024-05-30T03:34:28Z"},{"id":"wordfence:78da1f88-2446-4ea5-9437-a118324ab6c2","source":"wordfence","cve":"CVE-2024-1282","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78da1f88-2446-4ea5-9437-a118324ab6c2?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-02-13T00:00:00Z","updated":"2024-02-20T18:56:34Z"},{"id":"wordfence:78da9e79-399e-43e3-ac27-a162861cae71","source":"wordfence","cve":"CVE-2024-2025","title":"BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71?source=api-prod","affected":[{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.20","to_inclusive":true,"patched_in":"3.4.21"}],"published":"2024-03-22T00:00:00Z","updated":"2024-04-24T13:30:45Z"},{"id":"wordfence:78dae5be-a71b-45bc-8814-7cc86233ae90","source":"wordfence","cve":"CVE-2024-5892","title":"Divi Torque Lite \u2013 Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78dae5be-a71b-45bc-8814-7cc86233ae90?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-divi","name":"Divi Torque Lite","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-06-11T16:52:03Z","updated":"2024-06-12T05:34:02Z"},{"id":"wordfence:78dc41f0-117e-44f6-b387-283353b1e8cc","source":"wordfence","cve":"CVE-2024-37278","title":"Cards for Beaver Builder <= 1.1.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78dc41f0-117e-44f6-b387-283353b1e8cc?source=api-prod","affected":[{"type":"plugin","slug":"bb-bootstrap-cards","name":"Cards for Beaver Builder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:02:30Z"},{"id":"wordfence:78e2001a-81e7-4fc6-a6cd-ee6afb4e4081","source":"wordfence","cve":"CVE-2025-63007","title":"EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e2001a-81e7-4fc6-a6cd-ee6afb4e4081?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.4.1","to_inclusive":true,"patched_in":"4.2.5.0"}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-19T15:58:14Z"},{"id":"wordfence:78e27833-d5e5-4ed9-b8a2-98a14586651a","source":"wordfence","cve":"CVE-2024-35667","title":"WP EasyCart <= 5.5.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e27833-d5e5-4ed9-b8a2-98a14586651a?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.5.19","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:44:18Z"},{"id":"wordfence:78e35406-c416-4f7b-9241-34c2686788e3","source":"wordfence","cve":"CVE-2024-37452","title":"Schema Lite <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e35406-c416-4f7b-9241-34c2686788e3?source=api-prod","affected":[{"type":"theme","slug":"schema-lite","name":"Schema Lite","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-29T00:00:00Z","updated":"2025-01-20T16:53:35Z"},{"id":"wordfence:78e35c10-2480-4b23-8f5c-a196ccdc71f2","source":"wordfence","cve":"CVE-2022-41785","title":"Gallery Images Ape <= 2.2.8 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e35c10-2480-4b23-8f5c-a196ccdc71f2?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images-ape","name":"Gallery Images Ape","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2022-10-31T00:00:00Z","updated":"2026-02-25T13:28:00Z"},{"id":"wordfence:78e49869-5e7e-45f2-8239-4df18b28db53","source":"wordfence","cve":"CVE-2024-8045","title":"Advanced WordPress Backgrounds <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via imageTag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e49869-5e7e-45f2-8239-4df18b28db53?source=api-prod","affected":[{"type":"plugin","slug":"advanced-backgrounds","name":"Advanced WordPress Backgrounds","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2024-09-10T18:48:06Z","updated":"2024-09-11T07:31:35Z"},{"id":"wordfence:78e604e8-42f3-4c53-a59a-86a49043bde1","source":"wordfence","cve":"CVE-2024-49216","title":"Feed Comments Number <= 0.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e604e8-42f3-4c53-a59a-86a49043bde1?source=api-prod","affected":[{"type":"plugin","slug":"feed-comments-number","name":"Feed Comments Number","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:22:18Z"},{"id":"wordfence:78e79423-7b69-4d85-a939-96eb5385624c","source":"wordfence","cve":"CVE-2022-47139","title":"WP Basic Elements <= 5.2.15 - Cross-Site Request Forgery via wpbe_save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e79423-7b69-4d85-a939-96eb5385624c?source=api-prod","affected":[{"type":"plugin","slug":"wp-basic-elements","name":"WP Basic Elements","from":"*","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78e7b65d-91f8-477e-b992-3148c1b65d7b","source":"wordfence","cve":"CVE-2024-5599","title":"FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing","severity":"high","cvss":7.5,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7b65d-91f8-477e-b992-3148c1b65d7b?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T12:33:43Z"},{"id":"wordfence:78e7d0f7-b588-407b-bb3e-068589114ab0","source":"wordfence","cve":"CVE-2015-0901","title":"flashy <= 1.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e7d0f7-b588-407b-bb3e-068589114ab0?source=api-prod","affected":[{"type":"theme","slug":"flashy","name":"flashy","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2015-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78e9beef-4d2b-4004-8db7-4963882e405b","source":"wordfence","cve":"CVE-2024-2926","title":"Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78e9beef-4d2b-4004-8db7-4963882e405b?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.4"}],"published":"2024-07-03T14:51:15Z","updated":"2024-07-19T15:47:18Z"},{"id":"wordfence:78ec499e-5edd-4f11-9090-f79868864fee","source":"wordfence","cve":"CVE-2026-5324","title":"Brizy \u2013 Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78ec499e-5edd-4f11-9090-f79868864fee?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2026-05-01T20:15:49Z","updated":"2026-05-02T08:27:05Z"},{"id":"wordfence:78eeef12-123b-42f6-b446-c3f2d43153fd","source":"wordfence","cve":"CVE-2024-4783","title":"jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78eeef12-123b-42f6-b446-c3f2d43153fd?source=api-prod","affected":[{"type":"plugin","slug":"jquery-t-countdown-widget","name":"jQuery T(-) Countdown Widget","from":"*","from_inclusive":true,"to":"2.3.25","to_inclusive":true,"patched_in":""}],"published":"2024-05-22T12:56:47Z","updated":"2024-07-02T13:28:27Z"},{"id":"wordfence:78f04982-7f42-4c10-9fad-2584a26a4c79","source":"wordfence","cve":"","title":"Multilanguage by BestWebSoft < 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f04982-7f42-4c10-9fad-2584a26a4c79?source=api-prod","affected":[{"type":"plugin","slug":"multilanguage","name":"Multilanguage by BestWebSoft \u2013 WordPress Translation Plugin and Language Switcher","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f08c2b-c6e4-431e-bbbd-5dd082b29195","source":"wordfence","cve":"","title":"Age Verify <= 0.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f08c2b-c6e4-431e-bbbd-5dd082b29195?source=api-prod","affected":[{"type":"plugin","slug":"age-verify","name":"Age Verify","from":"*","from_inclusive":true,"to":"0.2.8","to_inclusive":true,"patched_in":"0.2.9"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f36195-55e5-4a7f-82c7-a6eb75d8efa6","source":"wordfence","cve":"CVE-2026-107594","title":"File Upload to Order <= 1.1.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f36195-55e5-4a7f-82c7-a6eb75d8efa6?source=api-prod","affected":[{"type":"plugin","slug":"file-upload-to-order","name":"File Upload to Order for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-23T19:27:37Z"},{"id":"wordfence:78f3c503-e255-44d2-8432-48dc2c5f553d","source":"wordfence","cve":"CVE-2023-3200","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f3c503-e255-44d2-8432-48dc2c5f553d?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f3e63b-1d60-47bb-9366-dbdd81d6ed19","source":"wordfence","cve":"","title":"SlideShare for WordPress by Yoast <= 1.9.1 - Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f3e63b-1d60-47bb-9366-dbdd81d6ed19?source=api-prod","affected":[{"type":"plugin","slug":"slideshare","name":"SlideShare for WordPress by Yoast","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f43693-ff83-48d6-827d-6d521eb8e89c","source":"wordfence","cve":"CVE-2024-12302","title":"Icegram Engage <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f43693-ff83-48d6-827d-6d521eb8e89c?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-17T12:49:48Z"},{"id":"wordfence:78f4709b-0560-48c6-a26c-d806311758a3","source":"wordfence","cve":"CVE-2024-33598","title":"Annual Archive <= 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f4709b-0560-48c6-a26c-d806311758a3?source=api-prod","affected":[{"type":"plugin","slug":"anual-archive","name":"Annual Archive","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:32:55Z"},{"id":"wordfence:78f6d878-6ba8-4d80-9c9b-1a363d6aaed5","source":"wordfence","cve":"CVE-2023-4035","title":"Simple Blog Card <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f6d878-6ba8-4d80-9c9b-1a363d6aaed5?source=api-prod","affected":[{"type":"plugin","slug":"simple-blog-card","name":"Simple Blog Card","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f745f9-c44e-4458-9381-f639c842a31e","source":"wordfence","cve":"CVE-2022-27853","title":"Contest Gallery <= 13.1.0.9 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f745f9-c44e-4458-9381-f639c842a31e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"13.1.0.9","to_inclusive":true,"patched_in":"14.0.0"}],"published":"2021-12-20T12:39:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f90656-49cb-4f13-8488-45a601048ade","source":"wordfence","cve":"CVE-2022-0193","title":"Complianz - GDPR/CCPA Cookie Consent <= 5.5.2 - Reflected Cross-Site Scripting via s parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f90656-49cb-4f13-8488-45a601048ade?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78f964a7-bed3-435e-94c5-750883a0c836","source":"wordfence","cve":"CVE-2026-15162","title":"Object Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f964a7-bed3-435e-94c5-750883a0c836?source=api-prod","affected":[{"type":"plugin","slug":"object-sync-for-salesforce","name":"Object Sync for Salesforce","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:02:43Z","updated":"2026-08-15T02:26:17Z"},{"id":"wordfence:78f96d7f-aeca-4959-9573-0fb6402de007","source":"wordfence","cve":"CVE-2024-2974","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78f96d7f-aeca-4959-9573-0fb6402de007?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"5.9.14"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-09T18:59:00Z"},{"id":"wordfence:78fce739-5cc7-4a7f-bf3b-665f35ef3579","source":"wordfence","cve":"CVE-2022-1153","title":"LayerSlider <= 7.1.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78fce739-5cc7-4a7f-bf3b-665f35ef3579?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78fd6eba-4458-4737-89fc-f846049af905","source":"wordfence","cve":"CVE-2026-39556","title":"Konsept <= 1.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78fd6eba-4458-4737-89fc-f846049af905?source=api-prod","affected":[{"type":"theme","slug":"konsept","name":"Konsept - Furniture Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:57:53Z"},{"id":"wordfence:78fd9dcf-228e-46ec-b34f-2cb0c87cc895","source":"wordfence","cve":"CVE-2023-49747","title":"Guest Author <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78fd9dcf-228e-46ec-b34f-2cb0c87cc895?source=api-prod","affected":[{"type":"plugin","slug":"guest-author","name":"Guest Author","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78fedd41-f0ab-4148-a798-88de62f27008","source":"wordfence","cve":"","title":"NextGen Gallery <= 2.1.77 - SQL Injection","severity":"high","cvss":8.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78fedd41-f0ab-4148-a798-88de62f27008?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.77","to_inclusive":true,"patched_in":"2.1.79"}],"published":"2017-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:78fef897-fcef-4238-9925-0ce610ee7686","source":"wordfence","cve":"CVE-2019-15327","title":"Import and export users and customers <= 1.14.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/78fef897-fcef-4238-9925-0ce610ee7686?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.14.1.2","to_inclusive":true,"patched_in":"1.14.1.3"}],"published":"2019-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7902180e-c341-4220-b1ad-dcd59da5bd09","source":"wordfence","cve":"CVE-2026-119487","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7902180e-c341-4220-b1ad-dcd59da5bd09?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:39:07Z"},{"id":"wordfence:7902795a-5839-4899-a7a2-e0d69e23c63a","source":"wordfence","cve":"CVE-2025-49980","title":"WP User Profile Avatar <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7902795a-5839-4899-a7a2-e0d69e23c63a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profile-avatar","name":"WP User Profile Avatar","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:24:41Z"},{"id":"wordfence:790514c4-47f2-4c8f-a0c0-cd0b761dd5fc","source":"wordfence","cve":"CVE-2025-49323","title":"Hydra Booking <= 1.1.10 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790514c4-47f2-4c8f-a0c0-cd0b761dd5fc?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:46:54Z"},{"id":"wordfence:7908d167-f831-4ed0-b754-2b390b5c3b2c","source":"wordfence","cve":"CVE-2026-5100","title":"AWP Classifieds <= 4.4.6 - Unauthenticated SQL Injection via 'regions'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7908d167-f831-4ed0-b754-2b390b5c3b2c?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.6.1"}],"published":"2026-05-04T14:11:27Z","updated":"2026-05-20T12:48:39Z"},{"id":"wordfence:79091bc0-d9b6-4a4b-926d-0447193d27c5","source":"wordfence","cve":"CVE-2024-10175","title":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79091bc0-d9b6-4a4b-926d-0447193d27c5?source=api-prod","affected":[{"type":"plugin","slug":"pricing-tables-for-visual-composer","name":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-26T18:28:52Z","updated":"2024-11-27T06:41:29Z"},{"id":"wordfence:79097eee-f76b-459e-9e7d-03013ee21695","source":"wordfence","cve":"CVE-2024-49272","title":"Social Auto Poster <= 5.3.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79097eee-f76b-459e-9e7d-03013ee21695?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"5.3.16"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:42:39Z"},{"id":"wordfence:790a2c64-b358-41ed-be17-f2b99d294617","source":"wordfence","cve":"CVE-2024-13831","title":"Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790a2c64-b358-41ed-be17-f2b99d294617?source=api-prod","affected":[{"type":"plugin","slug":"wc-tabs","name":"Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:11:05Z","updated":"2025-02-28T08:23:17Z"},{"id":"wordfence:790bd89d-3913-4b43-9b00-7d4de5c4227d","source":"wordfence","cve":"CVE-2023-23699","title":"Progress Bar <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppb shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790bd89d-3913-4b43-9b00-7d4de5c4227d?source=api-prod","affected":[{"type":"plugin","slug":"progress-bar","name":"Progress Bar","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:790c1783-3cc3-4ba4-a261-e92abb03d14a","source":"wordfence","cve":"CVE-2024-54431","title":"Admin Customization <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790c1783-3cc3-4ba4-a261-e92abb03d14a?source=api-prod","affected":[{"type":"plugin","slug":"wpp-customization","name":"Admin Customization","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T16:48:35Z"},{"id":"wordfence:790d6336-0c16-4058-9ddb-d182ef56263c","source":"wordfence","cve":"CVE-2025-6262","title":"muse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790d6336-0c16-4058-9ddb-d182ef56263c?source=api-prod","affected":[{"type":"plugin","slug":"muse-ai","name":"skiv video embedding","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":"0.5"}],"published":"2025-07-23T20:43:52Z","updated":"2025-10-21T21:02:41Z"},{"id":"wordfence:790f93b0-eb69-473f-a726-bfe215f5d870","source":"wordfence","cve":"CVE-2025-14383","title":"Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/790f93b0-eb69-473f-a726-bfe215f5d870?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.8","to_inclusive":true,"patched_in":"10.14.9"}],"published":"2025-12-15T02:24:51Z","updated":"2025-12-15T14:25:12Z"},{"id":"wordfence:7911c774-3fb0-4d6c-a847-101e5ad8637a","source":"wordfence","cve":"CVE-2024-1046","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7911c774-3fb0-4d6c-a847-101e5ad8637a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.14.3","to_inclusive":true,"patched_in":"4.14.4"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-05T21:21:52Z"},{"id":"wordfence:79125ac2-f3ed-40c9-a81b-340195fc8da5","source":"wordfence","cve":"CVE-2024-12473","title":"AI Scribe \u2013 SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79125ac2-f3ed-40c9-a81b-340195fc8da5?source=api-prod","affected":[{"type":"plugin","slug":"ai-scribe-the-chatgpt-powered-seo-content-creation-wizard","name":"Opace AI Scribe: SEO Content Creator & Humanizer for OpenAI, Anthropic & Gemini","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-01-09T15:00:11Z","updated":"2025-11-05T19:13:51Z"},{"id":"wordfence:79147dad-4bce-40fb-b9c1-e211845251a0","source":"wordfence","cve":"CVE-2024-10112","title":"Simple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79147dad-4bce-40fb-b9c1-e211845251a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-news","name":"Simple News","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T19:57:57Z","updated":"2024-10-25T08:34:41Z"},{"id":"wordfence:7914ebe6-b5e1-4a1a-8794-80f515e6c9f6","source":"wordfence","cve":"CVE-2024-13681","title":"Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7914ebe6-b5e1-4a1a-8794-80f515e6c9f6?source=api-prod","affected":[{"type":"theme","slug":"uncode","name":"Uncode","from":"*","from_inclusive":true,"to":"2.9.1.6","to_inclusive":true,"patched_in":"2.9.1.7"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:19Z"},{"id":"wordfence:79172fe3-c0cf-48c4-8bc5-862c628c1a09","source":"wordfence","cve":"CVE-2024-8290","title":"WCFM \u2013 Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79172fe3-c0cf-48c4-8bc5-862c628c1a09?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.12","to_inclusive":true,"patched_in":"6.7.13"}],"published":"2024-09-24T17:50:38Z","updated":"2024-09-25T06:49:01Z"},{"id":"wordfence:7917c9c1-fb94-411f-85c7-b1d1c2224c5e","source":"wordfence","cve":"CVE-2025-26899","title":"Recapture for WooCommerce <= 1.0.43 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7917c9c1-fb94-411f-85c7-b1d1c2224c5e?source=api-prod","affected":[{"type":"plugin","slug":"recapture-for-woocommerce","name":"Recapture for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":"1.0.44"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-10T14:35:47Z"},{"id":"wordfence:791866b1-e59f-4ef3-8e1b-a7eeb91b39af","source":"wordfence","cve":"CVE-2026-81771","title":"TrustedSite <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791866b1-e59f-4ef3-8e1b-a7eeb91b39af?source=api-prod","affected":[{"type":"plugin","slug":"trustedsite","name":"TrustedSite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-23T14:30:21Z"},{"id":"wordfence:791a7063-fb1e-4147-b253-8baf889307c6","source":"wordfence","cve":"CVE-2023-38519","title":"MainWP <= 4.4.3.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791a7063-fb1e-4147-b253-8baf889307c6?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"4.4.3.3","to_inclusive":true,"patched_in":"4.4.3.4"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:791ae60d-f2b7-4a53-9008-35cd2d465124","source":"wordfence","cve":"CVE-2021-24568","title":"AddToAny Share Buttons <= 1.7.45 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791ae60d-f2b7-4a53-9008-35cd2d465124?source=api-prod","affected":[{"type":"plugin","slug":"add-to-any","name":"AddToAny Share Buttons","from":"*","from_inclusive":true,"to":"1.7.46","to_inclusive":false,"patched_in":"1.7.46"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:791e2fb0-dda2-4ae1-bfb6-0b8e66413344","source":"wordfence","cve":"CVE-2025-31839","title":"DN Footer Contacts <= 1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791e2fb0-dda2-4ae1-bfb6-0b8e66413344?source=api-prod","affected":[{"type":"plugin","slug":"dn-footer-contacts","name":"Footer Contacts D","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-12-13T14:20:47Z"},{"id":"wordfence:791ee926-edd9-4615-9a46-1d8836938fd9","source":"wordfence","cve":"CVE-2026-18548","title":"Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791ee926-edd9-4615-9a46-1d8836938fd9?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"4.5.15"}],"published":"2026-10-14T16:32:48Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:791ef534-3191-4788-beb7-f5a0e83ffc4b","source":"wordfence","cve":"CVE-2026-57733","title":"tagDiv Cloud Library <= 3.9.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791ef534-3191-4788-beb7-f5a0e83ffc4b?source=api-prod","affected":[{"type":"plugin","slug":"td-cloud-library","name":"tagDiv Cloud Library","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T12:28:55Z"},{"id":"wordfence:791f650a-8fe0-4643-ba03-c6d017266c56","source":"wordfence","cve":"CVE-2026-82846","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/791f650a-8fe0-4643-ba03-c6d017266c56?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"1.18.0","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:57Z"},{"id":"wordfence:7921c896-dca4-460d-90dc-458eb0d82334","source":"wordfence","cve":"","title":"Choices (All Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7921c896-dca4-460d-90dc-458eb0d82334?source=api-prod","affected":[{"type":"theme","slug":"choices","name":"Choices","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:792282d1-5f43-4511-becc-9c5bb5ae513a","source":"wordfence","cve":"CVE-2022-2273","title":"Simple Membership <= 4.1.2 - Membership Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/792282d1-5f43-4511-becc-9c5bb5ae513a?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7922de94-986c-47c1-ab95-284734ef85d1","source":"wordfence","cve":"CVE-2024-52493","title":"Meteor Slides <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7922de94-986c-47c1-ab95-284734ef85d1?source=api-prod","affected":[{"type":"plugin","slug":"meteor-slides","name":"Meteor Slides","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:12:41Z"},{"id":"wordfence:7927edf2-b092-4b56-83aa-038f99ea658e","source":"wordfence","cve":"CVE-2023-51546","title":"WooCommerce PDF Invoices <= 4.2.1 - Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7927edf2-b092-4b56-83aa-038f99ea658e?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79287545-77db-4c55-85cd-57dfd3fd4420","source":"wordfence","cve":"CVE-2025-1033","title":"Badgearoo <= 1.0.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79287545-77db-4c55-85cd-57dfd3fd4420?source=api-prod","affected":[{"type":"plugin","slug":"badgearoo","name":"Badgearoo","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-05-29T22:23:34Z"},{"id":"wordfence:79289ad7-f289-4472-973d-d0ec2996c5c5","source":"wordfence","cve":"","title":"Visual Form Builder <= 2.8.2 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79289ad7-f289-4472-973d-d0ec2996c5c5?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:792d6c70-4c17-493a-bb4a-08a55e8240d3","source":"wordfence","cve":"CVE-2017-18563","title":"RSVP and Event Management Plugin <= 2.3.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/792d6c70-4c17-493a-bb4a-08a55e8240d3?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"}],"published":"2017-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:792fa6cb-e55a-4f68-b8a8-9039fb1ff694","source":"wordfence","cve":"CVE-2025-14984","title":"Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/792fa6cb-e55a-4f68-b8a8-9039fb1ff694?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-form","name":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-01-07T20:40:47Z","updated":"2026-01-08T09:20:55Z"},{"id":"wordfence:793072e9-250b-4a2c-819f-aa7e1dc7d4d6","source":"wordfence","cve":"CVE-2026-10552","title":"Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793072e9-250b-4a2c-819f-aa7e1dc7d4d6?source=api-prod","affected":[{"type":"plugin","slug":"blue-captcha","name":"Blue Captcha","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-06-23T16:41:19Z","updated":"2026-09-21T16:43:50Z"},{"id":"wordfence:793082f8-5b5e-4973-819c-d2f11d1a596e","source":"wordfence","cve":"CVE-2021-24812","title":"BetterLinks \u2013 Shorten, Track and Manage any URL <= 1.2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793082f8-5b5e-4973-819c-d2f11d1a596e?source=api-prod","affected":[{"type":"plugin","slug":"betterlinks","name":"BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2021-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7932fcd1-60be-4e28-b957-029292614000","source":"wordfence","cve":"CVE-2025-59579","title":"Simple Job Board <= 2.13.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7932fcd1-60be-4e28-b957-029292614000?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.13.7","to_inclusive":true,"patched_in":"2.13.8"}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-23T14:07:09Z"},{"id":"wordfence:79337804-beff-4316-98b3-aacb8416eb52","source":"wordfence","cve":"CVE-2024-50452","title":"Nexter Blocks <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79337804-beff-4316-98b3-aacb8416eb52?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:50:14Z"},{"id":"wordfence:7934c73c-17cf-4cec-a8da-654cee453b8f","source":"wordfence","cve":"","title":"Backup by Supsystic <= 2.3.11 - Cross-Site Request Forgery to Arbitrary File Download/Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7934c73c-17cf-4cec-a8da-654cee453b8f?source=api-prod","affected":[{"type":"plugin","slug":"backup-by-supsystic","name":"Backup by Supsystic","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:793594f7-6325-4561-ad74-a08aebc20c53","source":"wordfence","cve":"CVE-2023-29174","title":"SKU Label Changer For WooCommerce <= 3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793594f7-6325-4561-ad74-a08aebc20c53?source=api-prod","affected":[{"type":"plugin","slug":"woo-sku-label-changer","name":"SKU Label Changer For WooCommerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2023-05-25T00:00:00Z","updated":"2024-04-25T18:25:51Z"},{"id":"wordfence:7938e9f4-d905-4968-b811-23eb8ec4dd9d","source":"wordfence","cve":"CVE-2025-8113","title":"Ebook Store <= 5.8014 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7938e9f4-d905-4968-b811-23eb8ec4dd9d?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8014","to_inclusive":true,"patched_in":"5.8015"}],"published":"2025-07-26T00:00:00Z","updated":"2025-08-25T15:59:32Z"},{"id":"wordfence:793a2096-3332-412e-a45a-a7367b1209a3","source":"wordfence","cve":"CVE-2025-7664","title":"Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793a2096-3332-412e-a45a-a7367b1209a3?source=api-prod","affected":[{"type":"plugin","slug":"alpack","name":"AL Pack","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-08-15T14:45:56Z","updated":"2025-08-22T15:29:05Z"},{"id":"wordfence:793a7ef0-8938-47a6-80ed-83f69fbbb27f","source":"wordfence","cve":"CVE-2026-18436","title":"MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793a7ef0-8938-47a6-80ed-83f69fbbb27f?source=api-prod","affected":[{"type":"plugin","slug":"mailerpress","name":"MailerPress \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-07-30T00:00:00Z","updated":"2026-07-31T08:30:15Z"},{"id":"wordfence:793df609-77bb-47fd-8383-93884675f217","source":"wordfence","cve":"CVE-2022-38467","title":"CRM Perks Forms <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793df609-77bb-47fd-8383-93884675f217?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:793e650c-27f7-4eff-9922-8e01ba24e96d","source":"wordfence","cve":"CVE-2015-5469","title":"MDC YouTube Downloader < 2.1.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793e650c-27f7-4eff-9922-8e01ba24e96d?source=api-prod","affected":[{"type":"plugin","slug":"mdc-youtube-downloader","name":"MDC YouTube Downloader","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2015-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:793f27ec-a3bb-4273-a41c-cc5b04c8e8fc","source":"wordfence","cve":"CVE-2024-7145","title":"JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/793f27ec-a3bb-4273-a41c-cc5b04c8e8fc?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.20","to_inclusive":true,"patched_in":"2.6.20.1"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T13:48:56Z"},{"id":"wordfence:7941a6d3-9785-4dcb-ac56-17d4611f5201","source":"wordfence","cve":"CVE-2024-37246","title":"Gallery Slideshow <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7941a6d3-9785-4dcb-ac56-17d4611f5201?source=api-prod","affected":[{"type":"plugin","slug":"gallery-slideshow","name":"Gallery Slideshow","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-25T00:00:00Z","updated":"2024-07-02T13:25:47Z"},{"id":"wordfence:7942cbc8-3b4d-424d-97a1-d3895552c823","source":"wordfence","cve":"CVE-2026-115300","title":"Contact Form by Supsystic <= 1.11.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7942cbc8-3b4d-424d-97a1-d3895552c823?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T21:32:58Z"},{"id":"wordfence:7943c21b-dfc3-4f31-a636-0a1a745628bf","source":"wordfence","cve":"CVE-2022-4715","title":"Structured Content <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7943c21b-dfc3-4f31-a636-0a1a745628bf?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7945110e-2a9d-4e0e-b0e8-77c16694993b","source":"wordfence","cve":"","title":"Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7945110e-2a9d-4e0e-b0e8-77c16694993b?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7948dc00-6ee7-4458-9636-d6909913d3a3","source":"wordfence","cve":"CVE-2024-13875","title":"WP-PManager <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7948dc00-6ee7-4458-9636-d6909913d3a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-programmmanager","name":"WP-PManager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:07:52Z"},{"id":"wordfence:794b96ac-8edb-401a-8ba7-4b11fea6dde3","source":"wordfence","cve":"CVE-2025-68584","title":"Vimeotheque <= 2.3.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/794b96ac-8edb-401a-8ba7-4b11fea6dde3?source=api-prod","affected":[{"type":"plugin","slug":"codeflavors-vimeo-video-post-lite","name":"Vimeotheque \u2013 Vimeo WordPress Plugin & Video Gallery","from":"*","from_inclusive":true,"to":"2.3.5.2","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-06T14:43:31Z"},{"id":"wordfence:794bc5cd-c9ac-4583-ae3d-a92361374b5f","source":"wordfence","cve":"CVE-2024-8483","title":"MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/794bc5cd-c9ac-4583-ae3d-a92361374b5f?source=api-prod","affected":[{"type":"plugin","slug":"mas-static-content","name":"MAS Static Content","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:17Z"},{"id":"wordfence:794d0661-59c3-4cdf-90fe-e2289922c211","source":"wordfence","cve":"CVE-2026-87978","title":"Paymob for WooCommerce <= 4.1.13 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/794d0661-59c3-4cdf-90fe-e2289922c211?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.14"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:54:56Z"},{"id":"wordfence:794d1149-5c6a-4e92-bbc9-00d718799df9","source":"wordfence","cve":"CVE-2025-9626","title":"Page Blocks <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/794d1149-5c6a-4e92-bbc9-00d718799df9?source=api-prod","affected":[{"type":"plugin","slug":"page-blocks","name":"Page Blocks","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:40:12Z","updated":"2025-10-11T09:28:38Z"},{"id":"wordfence:794e6d9b-ac07-4261-a60d-81c474973005","source":"wordfence","cve":"CVE-2026-92084","title":"Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/794e6d9b-ac07-4261-a60d-81c474973005?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.11.0.5","to_inclusive":true,"patched_in":"2.11.0.6"}],"published":"2026-10-02T18:39:13Z","updated":"2026-10-03T07:39:17Z"},{"id":"wordfence:795002a5-1233-4472-93fe-78e33e53aa80","source":"wordfence","cve":"CVE-2025-28898","title":"WP Multistore Locator <= 2.5.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/795002a5-1233-4472-93fe-78e33e53aa80?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:53:09Z"},{"id":"wordfence:7951c8e4-b610-4cc4-ab27-4cfa78d72302","source":"wordfence","cve":"CVE-2025-10038","title":"Binary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalation","severity":"medium","cvss":6.5,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7951c8e4-b610-4cc4-ab27-4cfa78d72302?source=api-prod","affected":[{"type":"plugin","slug":"binary-mlm-plan","name":"Binary MLM Plan","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-10-14T20:04:50Z","updated":"2025-11-06T15:28:02Z"},{"id":"wordfence:79545b24-b325-486b-b34f-87bba14b8cd4","source":"wordfence","cve":"CVE-2021-24692","title":"Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79545b24-b325-486b-b34f-87bba14b8cd4?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.5"}],"published":"2021-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7955b162-ed0f-4455-a429-ed292771c701","source":"wordfence","cve":"CVE-2025-13997","title":"King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.49","to_inclusive":true,"patched_in":"51.1.51"}],"published":"2026-03-22T18:29:11Z","updated":"2026-03-23T06:41:09Z"},{"id":"wordfence:7955c993-e8e2-4afa-be15-5f4a05b391ac","source":"wordfence","cve":"CVE-2026-92435","title":"Mailchimp for WooCommerce <= 6.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7955c993-e8e2-4afa-be15-5f4a05b391ac?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:52:34Z"},{"id":"wordfence:7956f547-a207-4aef-84f1-82894cd8942e","source":"wordfence","cve":"CVE-2025-5803","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7956f547-a207-4aef-84f1-82894cd8942e?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-29T15:44:29Z"},{"id":"wordfence:7956fe49-b3b3-4f8d-8e90-8719bc2fa0fa","source":"wordfence","cve":"CVE-2026-17587","title":"My Agile Privacy\u00ae <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7956fe49-b3b3-4f8d-8e90-8719bc2fa0fa?source=api-prod","affected":[{"type":"plugin","slug":"myagileprivacy","name":"My Agile Privacy\u00ae \u2013 CMP, Cookie Consent & Privacy Tools","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-08-24T22:26:03Z","updated":"2026-08-25T11:27:11Z"},{"id":"wordfence:7957f5e8-a3ee-452f-969e-169544773d51","source":"wordfence","cve":"CVE-2026-25362","title":"FooGallery <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7957f5e8-a3ee-452f-969e-169544773d51?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-02-15T00:00:00Z","updated":"2026-02-24T19:27:11Z"},{"id":"wordfence:795c1fd6-137b-4414-8d6b-30053bfb5924","source":"wordfence","cve":"CVE-2026-9851","title":"Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/795c1fd6-137b-4414-8d6b-30053bfb5924?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2026-06-05T15:42:19Z","updated":"2026-06-06T04:28:22Z"},{"id":"wordfence:796c0ded-3a23-4dd6-968a-a8e60bd8ea0e","source":"wordfence","cve":"CVE-2025-12174","title":"Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/796c0ded-3a23-4dd6-968a-a8e60bd8ea0e?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.5.2","to_inclusive":true,"patched_in":"8.5.3"}],"published":"2025-11-18T00:00:00Z","updated":"2025-11-19T05:45:14Z"},{"id":"wordfence:796c37bb-0ff2-4f13-b752-71319adcbc61","source":"wordfence","cve":"CVE-2026-56005","title":"WP Activity Log <= 5.6.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/796c37bb-0ff2-4f13-b752-71319adcbc61?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.3.1","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:48:55Z"},{"id":"wordfence:796e35bc-db5f-45e3-8f79-73b30add877f","source":"wordfence","cve":"CVE-2022-4442","title":"Custom Post Types and Custom Fields creator <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/796e35bc-db5f-45e3-8f79-73b30add877f?source=api-prod","affected":[{"type":"plugin","slug":"wck-custom-fields-and-custom-post-types-creator","name":"Custom Post Types and Custom Fields creator \u2013 WCK","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:796fb66c-5a06-4f78-b3f2-a9b0717514e0","source":"wordfence","cve":"CVE-2025-49408","title":"Templately <= 3.2.7 - Authenticated (Author+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/796fb66c-5a06-4f78-b3f2-a9b0717514e0?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:55:06Z"},{"id":"wordfence:796fd9a1-6599-4319-8d3e-aa962c6875ff","source":"wordfence","cve":"CVE-2024-51829","title":"Mobile Kiosk <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/796fd9a1-6599-4319-8d3e-aa962c6875ff?source=api-prod","affected":[{"type":"plugin","slug":"mobile-kiosk","name":"Mobile Kiosk","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:43:54Z"},{"id":"wordfence:79705897-77d7-409d-bf04-c1e3742c92a7","source":"wordfence","cve":"CVE-2025-31805","title":"Gutena Kit \u2013 Gutenberg Blocks and Templates <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79705897-77d7-409d-bf04-c1e3742c92a7?source=api-prod","affected":[{"type":"plugin","slug":"gutena-kit","name":"Gutena Kit \u2013 Gutenberg Blocks and Templates","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2025-04-01T00:00:00Z","updated":"2026-05-26T18:30:01Z"},{"id":"wordfence:797118e9-2b15-42ae-ae14-b9efa3dbbbba","source":"wordfence","cve":"CVE-2026-24380","title":"EventPrime <= 4.2.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797118e9-2b15-42ae-ae14-b9efa3dbbbba?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.0","to_inclusive":true,"patched_in":"4.2.8.1"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:17:17Z"},{"id":"wordfence:79752ac3-cb5f-4d86-be58-c4b892e4edd6","source":"wordfence","cve":"CVE-2025-2543","title":"Advanced Accordion Gutenberg Block <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79752ac3-cb5f-4d86-be58-c4b892e4edd6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-accordion-block","name":"Advanced Accordion Gutenberg Block \u2013 Create Beautiful FAQs, Content Accordions & Interactive Tabs","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2025-04-23T19:59:13Z","updated":"2025-04-30T15:04:10Z"},{"id":"wordfence:797554c9-7008-451a-8e8d-3242a207347e","source":"wordfence","cve":"CVE-2024-24704","title":"Load More Anything <= 3.3.3 - Missing Authorization to Plugin Settings Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797554c9-7008-451a-8e8d-3242a207347e?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more-anything","name":"Load More Anything","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-07T20:49:36Z"},{"id":"wordfence:79766bb2-a796-48b4-afb5-520303a73739","source":"wordfence","cve":"CVE-2022-1953","title":"Product Configurator for WooCommerce <= 1.2.31 - Arbitrary File Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79766bb2-a796-48b4-afb5-520303a73739?source=api-prod","affected":[{"type":"plugin","slug":"expivi","name":"3D Product configurator for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:797768b3-5e4b-4f6e-8c5b-3513eace447d","source":"wordfence","cve":"CVE-2022-2934","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797768b3-5e4b-4f6e-8c5b-3513eace447d?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.5.5.2","to_inclusive":true,"patched_in":"2.5.5.3"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7977fbfd-9864-4883-955e-3d5646763b1b","source":"wordfence","cve":"CVE-2022-27861","title":"Ninja Popups <= 4.7.7 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7977fbfd-9864-4883-955e-3d5646763b1b?source=api-prod","affected":[{"type":"plugin","slug":"arscode-ninja-popups","name":"Ninja Popups","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2023-07-18T00:00:00Z","updated":"2026-02-26T14:51:22Z"},{"id":"wordfence:797840ba-5589-42d6-9d50-52bf8c131d6e","source":"wordfence","cve":"CVE-2023-29093","title":"Conditional cart fee / Extra charge rule for WooCommerce extra fees <= 1.0.96 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797840ba-5589-42d6-9d50-52bf8c131d6e?source=api-prod","affected":[{"type":"plugin","slug":"conditional-extra-fees-for-woocommerce","name":"PI Conditional cart fee / Extra charge rule for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.96","to_inclusive":true,"patched_in":"1.0.97"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:797c2c60-51bd-4992-86fc-23fda363ad76","source":"wordfence","cve":"CVE-2022-3506","title":"Related Posts for WordPress <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797c2c60-51bd-4992-86fc-23fda363ad76?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:797ec6dc-bced-48d0-b39f-4ad640b697fe","source":"wordfence","cve":"CVE-2025-30893","title":"LeadConnector <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797ec6dc-bced-48d0-b39f-4ad640b697fe?source=api-prod","affected":[{"type":"plugin","slug":"leadconnector","name":"LeadConnector","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:00:25Z"},{"id":"wordfence:797faa73-401d-492c-a99d-0724df57b6e9","source":"wordfence","cve":"CVE-2024-30196","title":"Easy Social Share Buttons <= 9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/797faa73-401d-492c-a99d-0724df57b6e9?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons3","name":"Easy Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"9.4","to_inclusive":true,"patched_in":"9.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T17:12:55Z"},{"id":"wordfence:79844b53-5527-42e2-8363-db0eb73d1f6c","source":"wordfence","cve":"CVE-2024-53753","title":"CultBooking Hotel Booking Engine <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79844b53-5527-42e2-8363-db0eb73d1f6c?source=api-prod","affected":[{"type":"plugin","slug":"cultbooking-booking-engine","name":"CultBooking Hotel Booking Engine","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:31:23Z"},{"id":"wordfence:79896a39-eada-4136-a820-47e93b4595f1","source":"wordfence","cve":"CVE-2025-54024","title":"WPAdverts <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79896a39-eada-4136-a820-47e93b4595f1?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:44:32Z"},{"id":"wordfence:79899dc1-4953-4f95-95f5-853d24e7b9ab","source":"wordfence","cve":"","title":"Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery on AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79899dc1-4953-4f95-95f5-853d24e7b9ab?source=api-prod","affected":[{"type":"plugin","slug":"just-custom-fields","name":"Just Custom Fields","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:798b57ad-0922-435c-8b4d-8a96b388b314","source":"wordfence","cve":"CVE-2022-4938","title":"WCFM Frontend Manager <= 6.5.13 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/798b57ad-0922-435c-8b4d-8a96b388b314?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:798d120a-edec-4af9-b574-46f9beabc491","source":"wordfence","cve":"CVE-2024-12195","title":"WP Project Manager \u2013 Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/798d120a-edec-4af9-b574-46f9beabc491?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.16","to_inclusive":true,"patched_in":"2.6.17"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-04T11:24:20Z"},{"id":"wordfence:799000d1-eb43-4bfc-86bd-37285089431b","source":"wordfence","cve":"CVE-2026-110365","title":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution <= 5.4.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/799000d1-eb43-4bfc-86bd-37285089431b?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.4.14","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-10-16T10:34:26Z","updated":"2026-10-23T18:33:13Z"},{"id":"wordfence:799087f0-d9da-4061-a29f-5bd634147b2e","source":"wordfence","cve":"CVE-2024-4145","title":"Search & Replace <= 3.2.1 - Authenticated (Administrator+) SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/799087f0-d9da-4061-a29f-5bd634147b2e?source=api-prod","affected":[{"type":"plugin","slug":"search-and-replace","name":"Search & Replace","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-05-23T00:00:00Z","updated":"2024-06-18T15:30:07Z"},{"id":"wordfence:7990f4f3-838c-4112-8958-2b2dd8fe54d5","source":"wordfence","cve":"CVE-2024-37248","title":"Anima <= <=1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7990f4f3-838c-4112-8958-2b2dd8fe54d5?source=api-prod","affected":[{"type":"theme","slug":"anima","name":"Anima","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.1.1"}],"published":"2024-06-25T00:00:00Z","updated":"2024-09-23T18:37:42Z"},{"id":"wordfence:7996ce73-32d7-49d5-b47b-71f9fc106d3d","source":"wordfence","cve":"CVE-2026-122231","title":"WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7996ce73-32d7-49d5-b47b-71f9fc106d3d?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.12.18","to_inclusive":true,"patched_in":"1.12.19"}],"published":"2026-11-06T21:25:51Z","updated":"2026-11-07T11:26:31Z"},{"id":"wordfence:799779a3-8a73-4be5-a868-1d9300d847dd","source":"wordfence","cve":"CVE-2025-30543","title":"Menu Duplicator <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/799779a3-8a73-4be5-a868-1d9300d847dd?source=api-prod","affected":[{"type":"plugin","slug":"copy-menu","name":"Menu Duplicator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:09:29Z"},{"id":"wordfence:7997ae20-88d2-4e12-87a0-a6e83808a495","source":"wordfence","cve":"CVE-2023-25029","title":"WP Social Bookmarking Light <= 2.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7997ae20-88d2-4e12-87a0-a6e83808a495?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-bookmarking-light","name":"WP Social Bookmarking Light","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:799975aa-44fe-48dc-8ac9-469c89a03c67","source":"wordfence","cve":"CVE-2023-40664","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/799975aa-44fe-48dc-8ac9-469c89a03c67?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:799b1f12-05f3-4b8b-9e1f-45c676e4f2a0","source":"wordfence","cve":"CVE-2023-27418","title":"Side Menu Lite <= 4.0 - Cross-Site Request Forgery to Item Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/799b1f12-05f3-4b8b-9e1f-45c676e4f2a0?source=api-prod","affected":[{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79a2fa3b-f9eb-49d8-97be-3a81d1b69c2e","source":"wordfence","cve":"CVE-2026-91707","title":"Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a2fa3b-f9eb-49d8-97be-3a81d1b69c2e?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"5.0","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.12.0"}],"published":"2026-09-17T18:29:03Z","updated":"2026-09-22T13:14:25Z"},{"id":"wordfence:79a41b84-2e19-46eb-9f6b-5155da0b15cc","source":"wordfence","cve":"","title":"Google Tag Manager for WordPress <= 1.15 - Cross-Site Scripting via Cloudflare Country Code","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a41b84-2e19-46eb-9f6b-5155da0b15cc?source=api-prod","affected":[{"type":"plugin","slug":"duracelltomi-google-tag-manager","name":"GTM4WP \u2013 A Google Tag Manager (GTM) plugin for WordPress","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.15.1"}],"published":"2022-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79a574c4-1faf-4572-801c-00b50923a669","source":"wordfence","cve":"","title":"Cookie Information | Free GDPR Consent Solution <= 1.5.5 - Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a574c4-1faf-4572-801c-00b50923a669?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-compliance","name":"Cookie Information | Free GDPR Consent Solution","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79a5c01d-3867-4b1e-b0ba-9a802f0bed92","source":"wordfence","cve":"CVE-2023-6878","title":"Slick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a5c01d-3867-4b1e-b0ba-9a802f0bed92?source=api-prod","affected":[{"type":"plugin","slug":"slick-social-share-buttons","name":"Slick Social Share Buttons","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":""}],"published":"2023-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79a71442-05d3-4c84-881d-39c9a7f1bf40","source":"wordfence","cve":"CVE-2026-88910","title":"KBoard <= 6.6 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a71442-05d3-4c84-881d-39c9a7f1bf40?source=api-prod","affected":[{"type":"plugin","slug":"kboard","name":"kboard","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":"6.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:47:24Z"},{"id":"wordfence:79a91fd1-305e-4307-84fa-53a557bacef6","source":"wordfence","cve":"CVE-2025-25082","title":"FlexIDX Home Search <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79a91fd1-305e-4307-84fa-53a557bacef6?source=api-prod","affected":[{"type":"plugin","slug":"flexidx-home-search","name":"FlexIDX Home Search","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:18:44Z"},{"id":"wordfence:79abf52c-c653-4346-94cd-4b56564e6b99","source":"wordfence","cve":"CVE-2026-14936","title":"Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79abf52c-c653-4346-94cd-4b56564e6b99?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":true,"patched_in":"4.7.7"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:32:38Z"},{"id":"wordfence:79ae062c-b084-4045-9407-2d94919993af","source":"wordfence","cve":"CVE-2024-10781","title":"Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation","severity":"high","cvss":8.1,"cwe":"CWE-703","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ae062c-b084-4045-9407-2d94919993af?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.44","to_inclusive":true,"patched_in":"6.45"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T05:33:03Z"},{"id":"wordfence:79ae682a-c048-427c-abf8-3ecbccc9c95c","source":"wordfence","cve":"CVE-2025-12076","title":"Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ae682a-c048-427c-abf8-3ecbccc9c95c?source=api-prod","affected":[{"type":"plugin","slug":"social-media-auto-publish","name":"Social Media Auto Publish","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2025-12-12T15:24:30Z","updated":"2025-12-13T04:31:28Z"},{"id":"wordfence:79ae6c3e-5584-448b-a5c5-0a105377b81d","source":"wordfence","cve":"CVE-2019-17661","title":"Admin Columns PRO <= 6.4.9 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":4.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ae6c3e-5584-448b-a5c5-0a105377b81d?source=api-prod","affected":[{"type":"plugin","slug":"admin-columns-pro","name":"Admin Columns Pro","from":"*","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"6.4.10"}],"published":"2019-10-29T00:00:00Z","updated":"2024-06-13T16:41:02Z"},{"id":"wordfence:79af711e-d044-447e-9802-8be648a3843d","source":"wordfence","cve":"CVE-2024-12385","title":"WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79af711e-d044-447e-9802-8be648a3843d?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2025-01-17T17:50:10Z","updated":"2025-01-18T07:05:09Z"},{"id":"wordfence:79b0a90b-5b75-4757-bd7b-909350f54175","source":"wordfence","cve":"CVE-2020-13640","title":"Comments - wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79b0a90b-5b75-4757-bd7b-909350f54175?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":false,"patched_in":"5.3.6"}],"published":"2020-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79b5883b-a3be-497e-b911-7dc39e7fb418","source":"wordfence","cve":"","title":"WordPress Download Manager <= 2.9.6 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79b5883b-a3be-497e-b911-7dc39e7fb418?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"2.9.61"}],"published":"2018-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79b631a0-08a7-460f-8668-0b10b42f12d7","source":"wordfence","cve":"CVE-2016-10921","title":"Photo Gallery by Ays \u2013 Responsive Image Gallery < 1.0.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79b631a0-08a7-460f-8668-0b10b42f12d7?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2016-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79b6b896-df66-4c3d-a4d4-d3dbeb630134","source":"wordfence","cve":"CVE-2026-1992","title":"ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79b6b896-df66-4c3d-a4d4-d3dbeb630134?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"8.0.0","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2026-03-10T21:00:15Z","updated":"2026-03-11T09:25:45Z"},{"id":"wordfence:79b859ef-5417-47e5-8b9a-763c62a6a127","source":"wordfence","cve":"","title":"VDZ Verification <= 1.3.12 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79b859ef-5417-47e5-8b9a-763c62a6a127?source=api-prod","affected":[{"type":"plugin","slug":"vdz-verification","name":"VDZ VERIFICATION (Custom Meta Tags)","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.4"}],"published":"2021-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79ba8dc8-dfc0-405a-bec0-ddc52ed3d831","source":"wordfence","cve":"CVE-2025-64634","title":"Avada <= 7.13.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ba8dc8-dfc0-405a-bec0-ddc52ed3d831?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.13.2","to_inclusive":true,"patched_in":"7.13.3"}],"published":"2025-10-03T00:00:00Z","updated":"2026-02-06T22:08:21Z"},{"id":"wordfence:79bb311d-d10d-4e4e-b690-84c0051b9911","source":"wordfence","cve":"","title":"Restrict Content <= 3.2.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79bb311d-d10d-4e4e-b690-84c0051b9911?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79bf1072-6ef1-4d53-962a-bc72a8d85b21","source":"wordfence","cve":"CVE-2026-123465","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79bf1072-6ef1-4d53-962a-bc72a8d85b21?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-07T09:41:54Z","updated":"2026-11-10T19:59:22Z"},{"id":"wordfence:79c296b1-e385-404d-96c0-a98f10b89f08","source":"wordfence","cve":"CVE-2023-32580","title":"Password Protected <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79c296b1-e385-404d-96c0-a98f10b89f08?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79c3abc6-68fa-4c51-88fa-03ab7d26cc4c","source":"wordfence","cve":"CVE-2024-0906","title":"f(x) Private Site <= 1.2.1 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79c3abc6-68fa-4c51-88fa-03ab7d26cc4c?source=api-prod","affected":[{"type":"plugin","slug":"fx-private-site","name":"f(x) Private Site","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T08:34:17Z"},{"id":"wordfence:79cc102a-6777-41be-a395-8c2eeb6deb73","source":"wordfence","cve":"CVE-2026-6248","title":"wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc102a-6777-41be-a395-8c2eeb6deb73?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2026-04-20T05:51:32Z","updated":"2026-04-20T18:31:33Z"},{"id":"wordfence:79cc1f11-9b53-4e71-b0cc-8f8ebd4a5f32","source":"wordfence","cve":"CVE-2024-11098","title":"SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc1f11-9b53-4e71-b0cc-8f8ebd4a5f32?source=api-prod","affected":[{"type":"plugin","slug":"svg-block","name":"SVG Block","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2024-11-18T18:51:03Z","updated":"2024-11-19T07:35:25Z"},{"id":"wordfence:79cce1fc-a27f-4842-b1a2-2c53857add4c","source":"wordfence","cve":"CVE-2023-4726","title":"Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79cce1fc-a27f-4842-b1a2-2c53857add4c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79d0e247-18f3-4e98-b24e-336a17276b7e","source":"wordfence","cve":"CVE-2024-52449","title":"Bootscraper <= 3.0.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d0e247-18f3-4e98-b24e-336a17276b7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-bootscraper","name":"WordPress Bootscraper","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:36:35Z"},{"id":"wordfence:79d4d776-411e-45ec-aff7-23453e686bf2","source":"wordfence","cve":"CVE-2026-13440","title":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d4d776-411e-45ec-aff7-23453e686bf2?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-07-27T23:27:46Z","updated":"2026-07-28T11:32:48Z"},{"id":"wordfence:79d4e5a8-028a-488e-b419-77a0981a28a9","source":"wordfence","cve":"CVE-2023-51397","title":"WP Remote Site Search <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d4e5a8-028a-488e-b419-77a0981a28a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-remote-site-search","name":"WP Remote Site Search","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79d55217-f634-4fce-9f32-21d69d69c7f4","source":"wordfence","cve":"CVE-2025-53316","title":"WP GDPR Cookie Consent <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d55217-f634-4fce-9f32-21d69d69c7f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-cookie-consen","name":"wp-gdpr-cookie-consen","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:30:09Z"},{"id":"wordfence:79d828b8-aea2-4705-ae23-ac70133a6c3e","source":"wordfence","cve":"CVE-2024-3961","title":"ConvertKit <= 2.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d828b8-aea2-4705-ae23-ac70133a6c3e?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.9.1"}],"published":"2024-06-20T15:27:19Z","updated":"2024-06-21T03:49:01Z"},{"id":"wordfence:79d91300-b6b7-4c3f-89b1-c48b9e47c415","source":"wordfence","cve":"CVE-2026-12095","title":"Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d91300-b6b7-4c3f-89b1-c48b9e47c415?source=api-prod","affected":[{"type":"plugin","slug":"kargo-takip","name":"Kargo Takip","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:41:49Z","updated":"2026-06-24T05:33:26Z"},{"id":"wordfence:79d96a6c-6191-44d8-aab8-f01bb2692767","source":"wordfence","cve":"CVE-2022-4674","title":"Ibtana \u2013 WordPress Website Builder <= 1.1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79d96a6c-6191-44d8-aab8-f01bb2692767?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.1.8.7","to_inclusive":true,"patched_in":"1.1.8.8"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79da7239-0343-465e-8dda-44ff440939c4","source":"wordfence","cve":"CVE-2024-0608","title":"WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79da7239-0343-465e-8dda-44ff440939c4?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2024-03-28T00:00:00Z","updated":"2025-11-05T18:44:53Z"},{"id":"wordfence:79dabaa6-d907-4fa6-bc6f-f28f39578256","source":"wordfence","cve":"CVE-2023-34383","title":"WP Project Manager <= 2.6.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79dabaa6-d907-4fa6-bc6f-f28f39578256?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79dd492e-d4da-4209-83a8-d8059263ae92","source":"wordfence","cve":"CVE-2024-6132","title":"Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79dd492e-d4da-4209-83a8-d8059263ae92?source=api-prod","affected":[{"type":"plugin","slug":"wp-pexels-free-stock-photos","name":"Pexels: Free Stock Photos","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T05:37:44Z"},{"id":"wordfence:79de2a90-225a-4d3e-b511-d12ede2cface","source":"wordfence","cve":"CVE-2024-32698","title":"Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79de2a90-225a-4d3e-b511-d12ede2cface?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-19T00:00:00Z","updated":"2026-04-15T20:48:55Z"},{"id":"wordfence:79e2011c-5e4d-4d02-831f-6b4dcfcaa51e","source":"wordfence","cve":"CVE-2021-4356","title":"Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download","severity":"critical","cvss":9.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e2011c-5e4d-4d02-831f-6b4dcfcaa51e?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79e20ca1-9325-43af-b5c6-a66a7a15605a","source":"wordfence","cve":"CVE-2026-28179","title":"FiboSearch \u2013 Ajax Search for WooCommerce <= 1.33.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e20ca1-9325-43af-b5c6-a66a7a15605a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.33.0","to_inclusive":true,"patched_in":"1.34.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:19:40Z"},{"id":"wordfence:79e3a675-6fe9-4a22-9879-d33ed57cb4bc","source":"wordfence","cve":"CVE-2025-62888","title":"Attachments <= 5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e3a675-6fe9-4a22-9879-d33ed57cb4bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachments","name":"WP Attachments \u2013 Smarter File Management & Download Lists","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-27T20:49:45Z"},{"id":"wordfence:79e4b7e1-9fff-4ff2-be2b-6dfa5f1ff48a","source":"wordfence","cve":"CVE-2026-1748","title":"Invoct \u2013 PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e4b7e1-9fff-4ff2-be2b-6dfa5f1ff48a?source=api-prod","affected":[{"type":"plugin","slug":"kirilkirkov-pdf-invoice-manager","name":"Invoct \u2013 PDF Invoices & Billing for WooCommerce","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-02-10T20:09:18Z","updated":"2026-02-12T16:29:36Z"},{"id":"wordfence:79e68c5b-1f1a-4af3-acf4-1a38f2d72424","source":"wordfence","cve":"CVE-2023-40662","title":"Cookies and Content Security Policy <= 2.15 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e68c5b-1f1a-4af3-acf4-1a38f2d72424?source=api-prod","affected":[{"type":"plugin","slug":"cookies-and-content-security-policy","name":"Cookies and Content Security Policy","from":"*","from_inclusive":true,"to":"2.15","to_inclusive":true,"patched_in":"2.16"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79e7542f-451b-4391-8367-42a1a93ceb18","source":"wordfence","cve":"CVE-2024-2441","title":"VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Insecure Direct Object Reference to Menu Access","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e7542f-451b-4391-8367-42a1a93ceb18?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-16T13:36:44Z"},{"id":"wordfence:79e786ce-a3eb-40df-8dad-4c9c75243bec","source":"wordfence","cve":"CVE-2024-1371","title":"LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e786ce-a3eb-40df-8dad-4c9c75243bec?source=api-prod","affected":[{"type":"plugin","slug":"leadconnector","name":"LeadConnector","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:16:29Z"},{"id":"wordfence:79e8190c-c6a2-4604-a9e7-d76a3549befb","source":"wordfence","cve":"CVE-2026-62066","title":"Volos <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e8190c-c6a2-4604-a9e7-d76a3549befb?source=api-prod","affected":[{"type":"theme","slug":"volos-wp","name":"Volos - One Page Resume WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:36:04Z"},{"id":"wordfence:79e9e251-9fcd-4172-aff5-5e41c5d937bf","source":"wordfence","cve":"CVE-2026-104681","title":"Envira Gallery <= 1.16.1 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79e9e251-9fcd-4172-aff5-5e41c5d937bf?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:53:08Z"},{"id":"wordfence:79ea853e-9d1d-4be0-8fd4-a80a924018ae","source":"wordfence","cve":"CVE-2009-2432","title":"WordPress Core & WordPress MU < 2.8.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ea853e-9d1d-4be0-8fd4-a80a924018ae?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2009-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79ed2c2b-5d76-4202-ac8a-d1813a57dcec","source":"wordfence","cve":"CVE-2025-22362","title":"WPAchievements Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ed2c2b-5d76-4202-ac8a-d1813a57dcec?source=api-prod","affected":[{"type":"plugin","slug":"wpachievements-free","name":"WPAchievements Free","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:24:46Z"},{"id":"wordfence:79ed7ed7-bf66-4bbe-b2b7-6a039bcf4df3","source":"wordfence","cve":"CVE-2026-78535","title":"Photolia | Photo Company & Supply Store WordPress Theme <= 1.0.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ed7ed7-bf66-4bbe-b2b7-6a039bcf4df3?source=api-prod","affected":[{"type":"theme","slug":"photolia","name":"Photolia | Photo Company & Supply Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:43:20Z","updated":"2026-10-13T14:07:38Z"},{"id":"wordfence:79ef7b33-ea6b-4cf2-bed4-8177927ab650","source":"wordfence","cve":"","title":"WPDating <= 7.4.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ef7b33-ea6b-4cf2-bed4-8177927ab650?source=api-prod","affected":[{"type":"plugin","slug":"dsp_dating","name":"WPDating","from":"*","from_inclusive":true,"to":"7.4.1","to_inclusive":true,"patched_in":"7.4.2"}],"published":"2023-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79f03bfe-dd7e-47e7-9e6f-4539d26cc101","source":"wordfence","cve":"CVE-2025-12590","title":"YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=api-prod","affected":[{"type":"plugin","slug":"yslider","name":"YSlider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:57:45Z","updated":"2025-11-11T03:30:42Z"},{"id":"wordfence:79f14b3f-3163-41c2-88ff-a1e0879e8248","source":"wordfence","cve":"CVE-2022-33965","title":"WP Visitor Statistics (Real Time Traffic) <= 5.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79f14b3f-3163-41c2-88ff-a1e0879e8248?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"5.8"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79f9632e-cfaf-48bd-aeed-919fc729f2b4","source":"wordfence","cve":"CVE-2021-24183","title":"Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79f9632e-cfaf-48bd-aeed-919fc729f2b4?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79fb0600-6150-4e26-b447-4414460fd62e","source":"wordfence","cve":"CVE-2024-38754","title":"Taggbox <= 3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79fb0600-6150-4e26-b447-4414460fd62e?source=api-prod","affected":[{"type":"plugin","slug":"taggbox-widget","name":"Taggbox: Social Media Feed Widget","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-07-11T00:00:00Z","updated":"2026-02-26T15:01:04Z"},{"id":"wordfence:79fb4f24-8a59-4e57-b583-c87ee2493cdb","source":"wordfence","cve":"CVE-2024-30236","title":"Photos and Files Contest Gallery <= 21.3.4 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79fb4f24-8a59-4e57-b583-c87ee2493cdb?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.3.4","to_inclusive":true,"patched_in":"21.3.5"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:37:35Z"},{"id":"wordfence:79fcf18e-39f7-42f2-90e4-3a5bac3382e0","source":"wordfence","cve":"CVE-2022-1985","title":"Download Manager <= 3.2.42 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79fcf18e-39f7-42f2-90e4-3a5bac3382e0?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.42","to_inclusive":true,"patched_in":"3.2.43"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79ff2a5d-ee75-4dc2-85a0-6eb1a032678c","source":"wordfence","cve":"CVE-2026-97397","title":"Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ff2a5d-ee75-4dc2-85a0-6eb1a032678c?source=api-prod","affected":[{"type":"plugin","slug":"use-bunnyfont-host-google-fonts","name":"Remove Google Fonts \u2013 Disable, Block, or Replace with Bunny Fonts for GDPR Compliance","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T21:31:41Z","updated":"2026-11-04T11:26:22Z"},{"id":"wordfence:79ff583b-f18a-4e04-9c23-9d3a4eca8c6b","source":"wordfence","cve":"","title":"WP Mail Logging < 1.10.0 - Unauthenticated Arbitrary Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ff583b-f18a-4e04-9c23-9d3a4eca8c6b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":false,"patched_in":"1.10.0"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:79ffe548-0005-4f5e-873f-a1afec64a251","source":"wordfence","cve":"CVE-2025-2485","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/79ffe548-0005-4f5e-873f-a1afec64a251?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.8.8","to_inclusive":true,"patched_in":"1.3.8.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-05-07T15:40:57Z"},{"id":"wordfence:7a027f8f-bec8-456c-804b-b18fdb9532db","source":"wordfence","cve":"CVE-2022-36379","title":"\u042eKassa \u0434\u043b\u044f WooCommerce <= 2.3.0 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a027f8f-bec8-456c-804b-b18fdb9532db?source=api-prod","affected":[{"type":"plugin","slug":"yookassa","name":"\u042eKassa \u0434\u043b\u044f WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a04705d-cd17-4b4b-b04d-de55d6479dab","source":"wordfence","cve":"CVE-2024-1567","title":"Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload","severity":"high","cvss":8.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a04705d-cd17-4b4b-b04d-de55d6479dab?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.94","to_inclusive":true,"patched_in":"1.3.95"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:52:15Z"},{"id":"wordfence:7a04ede7-4ce6-4714-a776-3aa949a92ae2","source":"wordfence","cve":"CVE-2026-88783","title":"Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a04ede7-4ce6-4714-a776-3aa949a92ae2?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:59:38Z"},{"id":"wordfence:7a08d857-c8be-4ba8-b9fb-eed222a8cd8c","source":"wordfence","cve":"CVE-2024-13364","title":"Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a08d857-c8be-4ba8-b9fb-eed222a8cd8c?source=api-prod","affected":[{"type":"plugin","slug":"adthrive-ads","name":"Raptive Ads","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-02-18T19:34:23Z","updated":"2025-03-13T19:51:39Z"},{"id":"wordfence:7a09288c-b8de-4674-9f96-d26ff3c7d917","source":"wordfence","cve":"CVE-2024-43248","title":"Bit Form Pro <= 2.6.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a09288c-b8de-4674-9f96-d26ff3c7d917?source=api-prod","affected":[{"type":"plugin","slug":"bitformpro","name":"Bit Form Pro","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-12T14:43:34Z"},{"id":"wordfence:7a0a281d-840f-488f-b9ef-c0df8514b47c","source":"wordfence","cve":"CVE-2025-3077","title":"Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a281d-840f-488f-b9ef-c0df8514b47c?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.0.3","to_inclusive":true,"patched_in":"28.0.4"}],"published":"2025-04-15T19:05:04Z","updated":"2025-04-16T07:31:09Z"},{"id":"wordfence:7a0a9ff8-ed93-4de9-ba49-730b2253c6a4","source":"wordfence","cve":"CVE-2025-2325","title":"WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a9ff8-ed93-4de9-ba49-730b2253c6a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-test-email","name":"WP Test Email","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-03-14T00:00:00Z","updated":"2025-03-15T06:40:02Z"},{"id":"wordfence:7a0b5585-1182-4f82-8b9e-11df39136199","source":"wordfence","cve":"CVE-2024-51832","title":"Plenigo <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0b5585-1182-4f82-8b9e-11df39136199?source=api-prod","affected":[{"type":"plugin","slug":"plenigo","name":"Plenigo","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:53:57Z"},{"id":"wordfence:7a0c6425-866d-4b50-b464-87a8173c4abd","source":"wordfence","cve":"","title":"WP Statistics <= 13.2.5 - Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0c6425-866d-4b50-b464-87a8173c4abd?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"13.2.5","from_inclusive":true,"to":"13.2.5","to_inclusive":true,"patched_in":"13.2.6"}],"published":"2022-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a0ed307-091a-473f-a95f-f270ec4dc2f1","source":"wordfence","cve":"CVE-2025-64216","title":"SmartMag <= 10.3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0ed307-091a-473f-a95f-f270ec4dc2f1?source=api-prod","affected":[{"type":"theme","slug":"smart-mag","name":"SmartMag - Newspaper Magazine & News WordPress","from":"*","from_inclusive":true,"to":"10.3.0","to_inclusive":true,"patched_in":"10.3.1"}],"published":"2025-11-01T00:00:00Z","updated":"2025-11-04T15:31:12Z"},{"id":"wordfence:7a1044f0-a49a-4746-b4bf-20f7de46f8c9","source":"wordfence","cve":"CVE-2024-44009","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.6.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1044f0-a49a-4746-b4bf-20f7de46f8c9?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.11","to_inclusive":true,"patched_in":"3.6.12"}],"published":"2024-09-16T00:00:00Z","updated":"2024-10-04T16:33:21Z"},{"id":"wordfence:7a116f28-a560-4b54-9cd1-f1dd9ac3238d","source":"wordfence","cve":"CVE-2026-2599","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a116f28-a560-4b54-9cd1-f1dd9ac3238d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-05T12:26:08Z"},{"id":"wordfence:7a1240b7-e476-4834-aaae-36aa826eb725","source":"wordfence","cve":"CVE-2025-47547","title":"SendPulse Email Marketing Newsletter <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1240b7-e476-4834-aaae-36aa826eb725?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-email-marketing-newsletter","name":"SendPulse Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:25:13Z"},{"id":"wordfence:7a140b07-e8b4-48a5-8585-79ad2744f3f3","source":"wordfence","cve":"CVE-2025-23967","title":"GG Bought Together for WooCommerce <= 1.0.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a140b07-e8b4-48a5-8585-79ad2744f3f3?source=api-prod","affected":[{"type":"plugin","slug":"gg-bought-together","name":"GG Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-07-01T19:21:08Z"},{"id":"wordfence:7a14d35d-144c-4ddd-b288-5e0e006fb165","source":"wordfence","cve":"CVE-2026-3551","title":"Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a14d35d-144c-4ddd-b288-5e0e006fb165?source=api-prod","affected":[{"type":"plugin","slug":"custom-new-user-notification","name":"Custom New User Notification","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T16:46:28Z","updated":"2026-04-16T05:29:55Z"},{"id":"wordfence:7a189e25-0d9e-4e0c-b74d-e7f9d2556872","source":"wordfence","cve":"CVE-2022-41831","title":"WP Glossary <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a189e25-0d9e-4e0c-b74d-e7f9d2556872?source=api-prod","affected":[{"type":"plugin","slug":"wp-glossary","name":"WP Glossary","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a1a46b3-77a1-4d69-9a0d-90794e78f828","source":"wordfence","cve":"CVE-2025-31050","title":"Apptha Slider Gallery <= 2.5 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1a46b3-77a1-4d69-9a0d-90794e78f828?source=api-prod","affected":[{"type":"plugin","slug":"apptha-slider-gallery","name":"Apptha Slider Gallery","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-02T19:19:55Z"},{"id":"wordfence:7a1a9cce-135a-4a5e-a477-ee2615237642","source":"wordfence","cve":"CVE-2026-96834","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1a9cce-135a-4a5e-a477-ee2615237642?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.9","to_inclusive":true,"patched_in":"4.17.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:09Z"},{"id":"wordfence:7a1b0440-743a-4c6f-aea5-bd46037dd149","source":"wordfence","cve":"CVE-2025-59590","title":"Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1b0440-743a-4c6f-aea5-bd46037dd149?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.28","to_inclusive":true,"patched_in":"3.29"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:55:05Z"},{"id":"wordfence:7a1ee5da-4e15-427a-96bc-0d1a015cdb17","source":"wordfence","cve":"CVE-2025-22528","title":"Huurkalender WP <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1ee5da-4e15-427a-96bc-0d1a015cdb17?source=api-prod","affected":[{"type":"plugin","slug":"huurkalender-wp","name":"Huurkalender WP","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-30T22:16:42Z"},{"id":"wordfence:7a1f91a3-6b8d-4be4-817c-9c88d2349723","source":"wordfence","cve":"CVE-2015-5481","title":"GD bbPress Attachments < 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1f91a3-6b8d-4be4-817c-9c88d2349723?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-attachments","name":"forumAttachments for bbPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a1fb413-de45-4401-923b-b3b7bef526b4","source":"wordfence","cve":"CVE-2026-18557","title":"Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1fb413-de45-4401-923b-b3b7bef526b4?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.42","to_inclusive":true,"patched_in":"1.8.43"}],"published":"2026-10-14T16:31:34Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:7a20b65a-6d3a-41fc-80c5-94cce0459a6b","source":"wordfence","cve":"CVE-2023-52144","title":"Product Feed Manager <= 7.3.15 - Authenticated (Admin+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a20b65a-6d3a-41fc-80c5-94cce0459a6b?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.3.15","to_inclusive":true,"patched_in":"7.3.16"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a2420ca-e079-429b-b1f1-47bf1d0a9f71","source":"wordfence","cve":"CVE-2026-15287","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a2420ca-e079-429b-b1f1-47bf1d0a9f71?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"4.6.19"}],"published":"2024-04-29T00:00:00Z","updated":"2026-07-10T04:31:22Z"},{"id":"wordfence:7a25d691-ba1e-41e6-9923-9c8d16b993a2","source":"wordfence","cve":"CVE-2025-24633","title":"Build Private Store For Woocommerce <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a25d691-ba1e-41e6-9923-9c8d16b993a2?source=api-prod","affected":[{"type":"plugin","slug":"build-private-store-for-woocommerce","name":"Build Private Store For WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:28:11Z"},{"id":"wordfence:7a26c1ee-4934-405e-b7ba-09adf543f1a8","source":"wordfence","cve":"CVE-2026-86602","title":"Recipe Maker 10.3.0 - 10.8.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a26c1ee-4934-405e-b7ba-09adf543f1a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"10.3.0","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:52:30Z"},{"id":"wordfence:7a275fd7-e1c9-462a-8fe5-2c05e171f235","source":"wordfence","cve":"CVE-2024-50465","title":"Premium SEO Pack <= 1.6.001 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a275fd7-e1c9-462a-8fe5-2c05e171f235?source=api-prod","affected":[{"type":"plugin","slug":"premium-seo-pack","name":"Premium SEO Pack \u2013 WP SEO Plugin","from":"*","from_inclusive":true,"to":"1.6.001","to_inclusive":true,"patched_in":"1.6.002"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T10:05:55Z"},{"id":"wordfence:7a27a5f8-6e77-4ace-9367-11abb4ac1130","source":"wordfence","cve":"CVE-2026-12493","title":"Clover Payment Gateway by Zaytech for WooCommerce <= 1.3.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a27a5f8-6e77-4ace-9367-11abb4ac1130?source=api-prod","affected":[{"type":"plugin","slug":"woo-clover-gateway-by-zaytech","name":"Clover Payment Gateway by Zaytech for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T12:48:31Z"},{"id":"wordfence:7a2f1cc7-f3f6-4a69-8b15-dfa13b136334","source":"wordfence","cve":"CVE-2025-32673","title":"Epeken All Kurir <= 2.1.1 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a2f1cc7-f3f6-4a69-8b15-dfa13b136334?source=api-prod","affected":[{"type":"plugin","slug":"epeken-all-kurir","name":"Epeken All Kurir for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-04-09T00:00:00Z","updated":"2026-09-16T17:29:11Z"},{"id":"wordfence:7a30452a-9d7e-4312-87eb-56d9d1aeced3","source":"wordfence","cve":"CVE-2025-22650","title":"Smartarget \u2013 Get 40% more sales, improve user engagement with 25+ free apps. <= 1.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a30452a-9d7e-4312-87eb-56d9d1aeced3?source=api-prod","affected":[{"type":"plugin","slug":"smartarget-contact-us","name":"Smartarget \u2013 Chat Buttons & Engagement Apps","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-02-03T00:00:00Z","updated":"2026-07-08T20:42:33Z"},{"id":"wordfence:7a32393e-f233-4ab6-addc-9dd1e04c0e0a","source":"wordfence","cve":"CVE-2026-16685","title":"Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a32393e-f233-4ab6-addc-9dd1e04c0e0a?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.66","to_inclusive":true,"patched_in":"3.3.67"}],"published":"2026-07-31T19:29:43Z","updated":"2026-08-01T07:49:48Z"},{"id":"wordfence:7a325783-3c90-4af2-a64f-7f178cea7276","source":"wordfence","cve":"CVE-2026-13156","title":"MailerSend - Official SMTP Integration <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a325783-3c90-4af2-a64f-7f178cea7276?source=api-prod","affected":[{"type":"plugin","slug":"mailersend-official-smtp-integration","name":"MailerSend \u2013 Official SMTP Integration","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T23:00:44Z"},{"id":"wordfence:7a341a7e-9ed2-436f-846a-59a5d51916fe","source":"wordfence","cve":"CVE-2025-9080","title":"Generic Elements <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a341a7e-9ed2-436f-846a-59a5d51916fe?source=api-prod","affected":[{"type":"plugin","slug":"generic-elements-for-elementor","name":"Generic Elements","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:11:08Z","updated":"2026-09-21T19:08:14Z"},{"id":"wordfence:7a36310c-8a61-40aa-9520-89ead37553c4","source":"wordfence","cve":"CVE-2023-6250","title":"BestWebSoft's Like & Share <= 2.73 - Unauthenticated Password Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a36310c-8a61-40aa-9520-89ead37553c4?source=api-prod","affected":[{"type":"plugin","slug":"facebook-button-plugin","name":"BestWebSoft's Like & Share \u2013 Posts, Pages and Widget Social Extension plugin for WordPress","from":"*","from_inclusive":true,"to":"2.73","to_inclusive":true,"patched_in":"2.74"}],"published":"2023-11-29T00:00:00Z","updated":"2024-02-06T16:31:31Z"},{"id":"wordfence:7a374bef-5359-41a4-a136-c9f29802766d","source":"wordfence","cve":"CVE-2026-86828","title":"BackWPup \u2013 WordPress Backup & Restore Plugin < 5.7.7 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a374bef-5359-41a4-a136-c9f29802766d?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":false,"patched_in":"5.7.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:18:46Z"},{"id":"wordfence:7a38b41c-0371-4488-a941-0ae70368ce9b","source":"wordfence","cve":"CVE-2025-58928","title":"Heart <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a38b41c-0371-4488-a941-0ae70368ce9b?source=api-prod","affected":[{"type":"theme","slug":"heart","name":"Heart - Donation & Non-Profit Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:32:30Z"},{"id":"wordfence:7a3e89cc-56cb-42d7-b4f6-bfc7ca0e03e6","source":"wordfence","cve":"CVE-2023-50839","title":"JS Help Desk <= 2.8.1 - Unauthenticated SQL Injection via email and trackingid","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a3e89cc-56cb-42d7-b4f6-bfc7ca0e03e6?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":false,"patched_in":"2.8.2"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a3e8edd-f0be-46a6-b33f-4b9d6a671b09","source":"wordfence","cve":"CVE-2026-125439","title":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership <= 3.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a3e8edd-f0be-46a6-b33f-4b9d6a671b09?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:02Z"},{"id":"wordfence:7a42716b-76b7-4f24-be54-4175d06215f6","source":"wordfence","cve":"CVE-2025-32298","title":"CTUsers <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a42716b-76b7-4f24-be54-4175d06215f6?source=api-prod","affected":[{"type":"plugin","slug":"ctuser","name":"CTUsers","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:42:50Z"},{"id":"wordfence:7a4332a2-b26e-43b8-be4a-50ac54a1ab2b","source":"wordfence","cve":"CVE-2025-58813","title":"Consultstreet <= 3.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4332a2-b26e-43b8-be4a-50ac54a1ab2b?source=api-prod","affected":[{"type":"theme","slug":"consultstreet","name":"ConsultStreet","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T19:32:56Z"},{"id":"wordfence:7a44873c-5f14-4ff5-85ed-a6575aaa9347","source":"wordfence","cve":"","title":"Felici (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a44873c-5f14-4ff5-85ed-a6575aaa9347?source=api-prod","affected":[{"type":"theme","slug":"felici","name":"Felici - WordPress Magazine Theme | Blog / Magazine","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a44d182-2a43-47c0-ab2e-36c0514c1d47","source":"wordfence","cve":"CVE-2024-5453","title":"ProfileGrid <= 5.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a44d182-2a43-47c0-ab2e-36c0514c1d47?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.6","to_inclusive":true,"patched_in":"5.8.7"}],"published":"2024-06-04T19:31:30Z","updated":"2024-06-05T07:34:56Z"},{"id":"wordfence:7a44d391-63e0-46a5-83fd-5624055705ea","source":"wordfence","cve":"CVE-2013-0736","title":"Mingle Forum <= 1.0.34 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a44d391-63e0-46a5-83fd-5624055705ea?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2013-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a45ec93-8e0b-4765-9883-12aae42fdeef","source":"wordfence","cve":"CVE-2024-10710","title":"YaDisk Files <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a45ec93-8e0b-4765-9883-12aae42fdeef?source=api-prod","affected":[{"type":"plugin","slug":"wp-yadisk-files","name":"YaDisk Files","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-07T19:05:38Z"},{"id":"wordfence:7a46c049-367d-4a67-9607-c74ef0b96c71","source":"wordfence","cve":"","title":"Ultimate CSV Importer < 3.6.75 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a46c049-367d-4a67-9607-c74ef0b96c71?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"3.6.75","to_inclusive":false,"patched_in":"3.6.75"}],"published":"2015-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a480473-ceae-4621-9b13-e0f0543c57e3","source":"wordfence","cve":"CVE-2026-3003","title":"Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a480473-ceae-4621-9b13-e0f0543c57e3?source=api-prod","affected":[{"type":"plugin","slug":"vagaro-booking-widget","name":"Vagaro Booking Widget","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:05:40Z","updated":"2026-03-21T03:26:51Z"},{"id":"wordfence:7a48eaf5-2d31-4f56-9669-027741c2034b","source":"wordfence","cve":"CVE-2024-49238","title":"ADIF Log Search Widget <= 1.0f - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a48eaf5-2d31-4f56-9669-027741c2034b?source=api-prod","affected":[{"type":"plugin","slug":"adif-log-search-widget","name":"ADIF Log Search Widget","from":"*","from_inclusive":true,"to":"1.0f","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-21T15:23:37Z"},{"id":"wordfence:7a49edd8-099d-4232-9cce-21932c44ae28","source":"wordfence","cve":"CVE-2024-53797","title":"Beaver Builder <= 2.8.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a49edd8-099d-4232-9cce-21932c44ae28?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.4.3","to_inclusive":true,"patched_in":"2.8.4.4"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:40:44Z"},{"id":"wordfence:7a4a0c26-6b7b-4dcf-a266-a6548431e6a8","source":"wordfence","cve":"CVE-2025-2101","title":"Edumall <= 4.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=api-prod","affected":[{"type":"theme","slug":"edumall","name":"EduMall - Professional LMS Education Center WordPress Theme","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-04-25T19:47:44Z","updated":"2025-04-26T08:23:20Z"},{"id":"wordfence:7a4ab215-c5ee-4841-858a-e5e8d3199fb2","source":"wordfence","cve":"CVE-2026-12696","title":"wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4ab215-c5ee-4841-858a-e5e8d3199fb2?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-15T21:14:44Z"},{"id":"wordfence:7a4cc65b-b0a7-4002-add4-ceacfe2f54f1","source":"wordfence","cve":"CVE-2026-0724","title":"WPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4cc65b-b0a7-4002-add4-ceacfe2f54f1?source=api-prod","affected":[{"type":"plugin","slug":"wplyr-media-block","name":"WPlyr Media Block","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:08:39Z","updated":"2026-02-11T08:26:26Z"},{"id":"wordfence:7a4db03d-ec40-4145-aa95-fee78bda5205","source":"wordfence","cve":"CVE-2023-4923","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4db03d-ec40-4145-aa95-fee78bda5205?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a4ea418-2ae0-4a3a-8dad-123f144b1f7d","source":"wordfence","cve":"CVE-2025-49279","title":"Blogvy <= 1.0.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4ea418-2ae0-4a3a-8dad-123f144b1f7d?source=api-prod","affected":[{"type":"theme","slug":"blogvy","name":"Blogvy","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:36:33Z"},{"id":"wordfence:7a4ef9e6-2299-4024-a6a9-482199ca06db","source":"wordfence","cve":"CVE-2022-1167","title":"CareerUp < 2.3.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4ef9e6-2299-4024-a6a9-482199ca06db?source=api-prod","affected":[{"type":"theme","slug":"careerup","name":"CareerUp - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a5123a7-8eb4-481e-88fe-6310be37a077","source":"wordfence","cve":"CVE-2023-5126","title":"Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5123a7-8eb4-481e-88fe-6310be37a077?source=api-prod","affected":[{"type":"plugin","slug":"delete-me","name":"Delete Me","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a51fe96-f3d3-46fe-9e3a-fb7c1bd17b05","source":"wordfence","cve":"CVE-2026-4817","title":"MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a51fe96-f3d3-46fe-9e3a-fb7c1bd17b05?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.25","to_inclusive":true,"patched_in":"3.7.26"}],"published":"2026-04-16T12:48:08Z","updated":"2026-04-17T01:24:37Z"},{"id":"wordfence:7a52a278-1729-4027-8a00-e9804fa6698b","source":"wordfence","cve":"CVE-2024-6641","title":"WP Hardening \u2013 Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-185","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a52a278-1729-4027-8a00-e9804fa6698b?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-hardening","name":"WP Hardening (discontinued)","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-09-17T00:00:00Z","updated":"2024-09-18T05:32:27Z"},{"id":"wordfence:7a52b36f-5f37-4867-aa1f-42f6a5e2480d","source":"wordfence","cve":"CVE-2025-69134","title":"OpenAI Chatbot for WordPress \u2013 Helper <= 1.1.4 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a52b36f-5f37-4867-aa1f-42f6a5e2480d?source=api-prod","affected":[{"type":"plugin","slug":"helper","name":"OpenAI Chatbot for WordPress \u2013 Helper","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T13:52:15Z"},{"id":"wordfence:7a54b803-7e30-4964-88f0-d79276e67218","source":"wordfence","cve":"CVE-2026-15136","title":"Cookie Banner for GDPR / CCPA \u2013 WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a54b803-7e30-4964-88f0-d79276e67218?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-07-27T16:38:20Z","updated":"2026-07-28T05:39:43Z"},{"id":"wordfence:7a571386-fae1-4a56-8567-9d3e23249de1","source":"wordfence","cve":"CVE-2024-1805","title":"WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a571386-fae1-4a56-8567-9d3e23249de1?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:30:27Z"},{"id":"wordfence:7a573ee8-2d11-4653-8454-7f1cbed0c80e","source":"wordfence","cve":"CVE-2025-58894","title":"Good Mood <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a573ee8-2d11-4653-8454-7f1cbed0c80e?source=api-prod","affected":[{"type":"theme","slug":"good-mood","name":"Good Mood - Wine Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-20T21:06:37Z"},{"id":"wordfence:7a58a158-34d9-4e97-b681-b1ebc321fe23","source":"wordfence","cve":"CVE-2026-106025","title":"Cargo Shipping Location for WooCommerce < 6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a58a158-34d9-4e97-b681-b1ebc321fe23?source=api-prod","affected":[{"type":"plugin","slug":"cargo-shipping-location-for-woocommerce","name":"Cargo Shipping Location for WooCommerce","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":false,"patched_in":"6.0"}],"published":"2026-11-10T00:00:00Z","updated":"2026-11-11T16:08:23Z"},{"id":"wordfence:7a59ccdc-d265-4e8c-96b2-4eba3bb33591","source":"wordfence","cve":"CVE-2026-2626","title":"Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a59ccdc-d265-4e8c-96b2-4eba3bb33591?source=api-prod","affected":[{"type":"plugin","slug":"divi-booster","name":"divi-booster","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":false,"patched_in":"5.0.2"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T13:35:04Z"},{"id":"wordfence:7a5a33fd-ecc6-40bf-93a5-10ead1c4c1f5","source":"wordfence","cve":"CVE-2024-11811","title":"Feedify \u2013 Web Push Notifications <= 2.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5a33fd-ecc6-40bf-93a5-10ead1c4c1f5?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-by-feedify","name":"Feedify \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-12-20T09:38:08Z","updated":"2024-12-20T22:23:07Z"},{"id":"wordfence:7a5ab5f1-db14-4448-9186-35a5f382cd1a","source":"wordfence","cve":"","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5ab5f1-db14-4448-9186-35a5f382cd1a?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.0.1","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a5acdeb-0aef-4124-bb18-43587a032206","source":"wordfence","cve":"CVE-2024-52380","title":"Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5acdeb-0aef-4124-bb18-43587a032206?source=api-prod","affected":[{"type":"plugin","slug":"picsmize","name":"Picsmize","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:47:14Z"},{"id":"wordfence:7a5da306-c798-4f2b-8875-8ae54c83ccd8","source":"wordfence","cve":"CVE-2025-23440","title":"radSLIDE <= 2.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5da306-c798-4f2b-8875-8ae54c83ccd8?source=api-prod","affected":[{"type":"plugin","slug":"radslide","name":"radSLIDE","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:40:28Z"},{"id":"wordfence:7a5dc4c8-9402-4003-8fa6-b2b98a868024","source":"wordfence","cve":"CVE-2026-57412","title":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.6.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5dc4c8-9402-4003-8fa6-b2b98a868024?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:26:03Z"},{"id":"wordfence:7a5e08d8-c6ef-42a3-9599-28c3bfb35017","source":"wordfence","cve":"CVE-2026-9290","title":"WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5e08d8-c6ef-42a3-9599-28c3bfb35017?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.17","to_inclusive":true,"patched_in":"2.9.18"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-05T23:28:26Z"},{"id":"wordfence:7a5e3d82-4722-47ff-b66f-448cb2851c1f","source":"wordfence","cve":"CVE-2023-2272","title":"Tiempo.com <= 0.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5e3d82-4722-47ff-b66f-448cb2851c1f?source=api-prod","affected":[{"type":"plugin","slug":"tiempocom","name":"Tiempo.com","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a600f11-03c3-4777-b1fe-212b085bacba","source":"wordfence","cve":"CVE-2024-22282","title":"SimpleMap Store Locator <= 2.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a600f11-03c3-4777-b1fe-212b085bacba?source=api-prod","affected":[{"type":"plugin","slug":"simplemap","name":"SimpleMap Store Locator","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2025-07-29T06:39:25Z"},{"id":"wordfence:7a6085fb-f701-4a85-9dca-3e04091f34c6","source":"wordfence","cve":"CVE-2026-62084","title":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End <= 20260810 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6085fb-f701-4a85-9dca-3e04091f34c6?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20260810","to_inclusive":true,"patched_in":"20260916"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:41:29Z"},{"id":"wordfence:7a61ab8b-e41b-44de-aa08-f5d659346a5b","source":"wordfence","cve":"CVE-2026-39563","title":"Share This Image <= 2.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a61ab8b-e41b-44de-aa08-f5d659346a5b?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":true,"patched_in":"2.13"}],"published":"2026-03-26T00:00:00Z","updated":"2026-05-07T13:59:37Z"},{"id":"wordfence:7a659071-df11-4318-86c2-7881163c8b62","source":"wordfence","cve":"CVE-2024-1809","title":"Analytify \u2013 Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-497","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a659071-df11-4318-86c2-7881163c8b62?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:16Z"},{"id":"wordfence:7a69cc6e-cbb7-4b66-8a55-709e29273378","source":"wordfence","cve":"CVE-2026-24638","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1121 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a69cc6e-cbb7-4b66-8a55-709e29273378?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1121","to_inclusive":true,"patched_in":"4.1125"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:25:25Z"},{"id":"wordfence:7a6a39d6-570a-4ffe-b9a4-abdfbebd7a61","source":"wordfence","cve":"CVE-2026-59542","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6a39d6-570a-4ffe-b9a4-abdfbebd7a61?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:59:59Z"},{"id":"wordfence:7a6b3ae2-796b-4084-ad19-4b67ea6dea25","source":"wordfence","cve":"CVE-2021-24916","title":"Qubely \u2013 Advanced Gutenberg Blocks <= 1.8.5 - Insufficient Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6b3ae2-796b-4084-ad19-4b67ea6dea25?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"}],"published":"2023-07-17T00:00:00Z","updated":"2024-06-06T16:05:51Z"},{"id":"wordfence:7a6b7639-3aaf-44e5-9482-291f8432b41a","source":"wordfence","cve":"CVE-2024-49227","title":"Free Stock Photos Foter <= 1.5.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6b7639-3aaf-44e5-9482-291f8432b41a?source=api-prod","affected":[{"type":"plugin","slug":"free-stock-photos-foter","name":"Free Stock Photos Foter","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:15:50Z"},{"id":"wordfence:7a6c16dd-3681-4867-b608-5501ff9e9331","source":"wordfence","cve":"CVE-2017-6954","title":"BuddyPress Docs <= 1.9.2 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6c16dd-3681-4867-b608-5501ff9e9331?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-docs","name":"BuddyPress Docs","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":false,"patched_in":"1.9.3"}],"published":"2017-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a6c4945-68d3-4ce9-b00c-40591fa15ada","source":"wordfence","cve":"CVE-2017-18493","title":"Custom Admin Page by BestWebSoft <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6c4945-68d3-4ce9-b00c-40591fa15ada?source=api-prod","affected":[{"type":"plugin","slug":"custom-admin-page","name":"Custom Admin Page by BestWebSoft \u2013 Configurable WordPress Dashboard Pages Plugin","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":"0.1.2"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a6e24db-7b4c-415d-9018-2fd53f5d2e5e","source":"wordfence","cve":"CVE-2026-81776","title":"WP QuickLaTeX <= 3.8.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6e24db-7b4c-415d-9018-2fd53f5d2e5e?source=api-prod","affected":[{"type":"plugin","slug":"wp-quicklatex","name":"WP QuickLaTeX","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:16:43Z"},{"id":"wordfence:7a6e361d-4a20-4c22-9003-84b2f2d94e2a","source":"wordfence","cve":"CVE-2025-49929","title":"Ultimate Blocks <= 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a6e361d-4a20-4c22-9003-84b2f2d94e2a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2025-06-16T00:00:00Z","updated":"2025-10-29T21:15:38Z"},{"id":"wordfence:7a7157c0-8378-4aa0-bc47-635be4ba2f8f","source":"wordfence","cve":"CVE-2025-2128","title":"Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7157c0-8378-4aa0-bc47-635be4ba2f8f?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.67","to_inclusive":true,"patched_in":"3.2.68"}],"published":"2025-04-10T20:32:04Z","updated":"2025-04-11T09:21:56Z"},{"id":"wordfence:7a71b7e0-0562-4832-ab83-45ba1af57f1c","source":"wordfence","cve":"CVE-2025-49320","title":"FraudLabs Pro for WooCommerce <= 2.22.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a71b7e0-0562-4832-ab83-45ba1af57f1c?source=api-prod","affected":[{"type":"plugin","slug":"fraudlabs-pro-for-woocommerce","name":"FraudLabs Pro for WooCommerce","from":"*","from_inclusive":true,"to":"2.22.11","to_inclusive":true,"patched_in":"2.22.12"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:05:01Z"},{"id":"wordfence:7a71c1e1-c0f5-4b11-9f15-02ac22e4a376","source":"wordfence","cve":"CVE-2025-24603","title":"Print Barcode Labels for your WooCommerce products/orders <= 3.4.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a71c1e1-c0f5-4b11-9f15-02ac22e4a376?source=api-prod","affected":[{"type":"plugin","slug":"a4-barcode-generator","name":"Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":"3.4.11"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:22:30Z"},{"id":"wordfence:7a747542-0601-4fa5-a97c-c72d1347013b","source":"wordfence","cve":"CVE-2023-3131","title":"MStore API <= 3.9.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a747542-0601-4fa5-a97c-c72d1347013b?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":false,"patched_in":"3.9.7"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a74b09e-5cc0-4798-9f00-4a004b4ea3ae","source":"wordfence","cve":"CVE-2025-66081","title":"Head Meta Data <= 20250327 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a74b09e-5cc0-4798-9f00-4a004b4ea3ae?source=api-prod","affected":[{"type":"plugin","slug":"head-meta-data","name":"Head Meta Data","from":"*","from_inclusive":true,"to":"20250327","to_inclusive":true,"patched_in":"20251118"}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T16:53:28Z"},{"id":"wordfence:7a74e4fb-15a9-4fc9-afa6-396b0f026615","source":"wordfence","cve":"CVE-2026-12098","title":"PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a74e4fb-15a9-4fc9-afa6-396b0f026615?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.16.8","to_inclusive":true,"patched_in":"11.16.9"}],"published":"2026-06-17T18:12:12Z","updated":"2026-06-18T06:50:06Z"},{"id":"wordfence:7a7677a4-0cd5-496e-82cb-f6582e63475d","source":"wordfence","cve":"CVE-2019-16250","title":"Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7677a4-0cd5-496e-82cb-f6582e63475d?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a7c53b9-e9b6-4337-9c89-326e66c4bd27","source":"wordfence","cve":"CVE-2026-104001","title":"Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7c53b9-e9b6-4337-9c89-326e66c4bd27?source=api-prod","affected":[{"type":"plugin","slug":"slim-seo","name":"Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated","from":"*","from_inclusive":true,"to":"4.11.1","to_inclusive":true,"patched_in":"4.11.2"}],"published":"2026-10-15T16:57:00Z","updated":"2026-10-16T05:30:24Z"},{"id":"wordfence:7a7d55fb-8874-4d3a-a880-521dbfd61611","source":"wordfence","cve":"CVE-2025-32630","title":"WP-BusinessDirectory <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7d55fb-8874-4d3a-a880-521dbfd61611?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-25T14:59:27Z"},{"id":"wordfence:7a7e624b-2b1b-4f7e-857d-db65f17e7787","source":"wordfence","cve":"CVE-2026-85132","title":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode 4.0.2 - 4.4.1 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a7e624b-2b1b-4f7e-857d-db65f17e7787?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"4.0.2","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T14:49:39Z"},{"id":"wordfence:7a82f52a-0a9a-4b36-960d-f0c7d692c8ee","source":"wordfence","cve":"CVE-2025-23942","title":"WP Load Gallery <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a82f52a-0a9a-4b36-960d-f0c7d692c8ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-load-gallery","name":"WP Load Gallery","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:05:37Z"},{"id":"wordfence:7a830d58-14e8-4929-a0f8-08ee4efae340","source":"wordfence","cve":"CVE-2022-4553","title":"FL3R FeelBox <= 8.1 - Cross-Site Request Forgery leading to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a830d58-14e8-4929-a0f8-08ee4efae340?source=api-prod","affected":[{"type":"plugin","slug":"fl3r-feelbox","name":"FL3R FeelBox","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a874287-c648-4807-8387-b0b47187651e","source":"wordfence","cve":"CVE-2023-28498","title":"Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a874287-c648-4807-8387-b0b47187651e?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a87f248-a613-44c5-aebc-970a8161ffba","source":"wordfence","cve":"CVE-2024-8050","title":"Custom Author Base <= 1.1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a87f248-a613-44c5-aebc-970a8161ffba?source=api-prod","affected":[{"type":"plugin","slug":"custom-author-base","name":"Custom Author Base","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-24T15:39:03Z"},{"id":"wordfence:7a893319-a83d-4475-991a-2bb7fc90836c","source":"wordfence","cve":"CVE-2026-22506","title":"Amoli <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a893319-a83d-4475-991a-2bb7fc90836c?source=api-prod","affected":[{"type":"theme","slug":"amoli","name":"Amoli - Fashion Photography WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-03-06T00:00:00Z","updated":"2026-04-15T13:40:42Z"},{"id":"wordfence:7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0","source":"wordfence","cve":"CVE-2026-109216","title":"Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8948f5-8bcf-48f2-b3a6-bfa24ba9bef0?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.15.2","to_inclusive":true,"patched_in":"5.15.3"}],"published":"2026-10-28T21:31:51Z","updated":"2026-10-29T11:27:14Z"},{"id":"wordfence:7a8c28d9-f290-4b08-b48c-beb560c63d2f","source":"wordfence","cve":"CVE-2026-32462","title":"Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8c28d9-f290-4b08-b48c-beb560c63d2f?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-19T15:08:16Z"},{"id":"wordfence:7a8c4232-2e1e-4c99-83d5-d70f7ca1c879","source":"wordfence","cve":"","title":"Stamped.io Product Reviews & UGC for WooCommerce <= 2.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8c4232-2e1e-4c99-83d5-d70f7ca1c879?source=api-prod","affected":[{"type":"plugin","slug":"stampedio-product-reviews","name":"Stamped.io Product Reviews & UGC for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a8eda88-c45a-4867-b427-d63b586e6de3","source":"wordfence","cve":"CVE-2024-8667","title":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a8eda88-c45a-4867-b427-d63b586e6de3?source=api-prod","affected":[{"type":"plugin","slug":"hurrytimer","name":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2024-10-23T19:06:04Z","updated":"2024-10-24T07:35:56Z"},{"id":"wordfence:7a914802-0cda-4038-8828-81fd74090801","source":"wordfence","cve":"CVE-2025-22498","title":"LucidLMS <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a914802-0cda-4038-8828-81fd74090801?source=api-prod","affected":[{"type":"plugin","slug":"lucidlms","name":"LucidLMS","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:40:58Z"},{"id":"wordfence:7a931496-f130-4910-9116-6c2c4df760f5","source":"wordfence","cve":"CVE-2023-46632","title":"My Shortcodes <= 2.3 - Missing Authorization via Multiple AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a931496-f130-4910-9116-6c2c4df760f5?source=api-prod","affected":[{"type":"plugin","slug":"my-shortcodes","name":"My Shortcodes","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a94229a-6316-48e7-bcaa-23cb2cc047b4","source":"wordfence","cve":"","title":"Activity Log 2.3.5 - 2.6.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a94229a-6316-48e7-bcaa-23cb2cc047b4?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"2.3.5","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2021-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a970323-ddfd-4a86-a5eb-f8dae5dff294","source":"wordfence","cve":"CVE-2024-51780","title":"eewee admin custom <= 1.8.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a970323-ddfd-4a86-a5eb-f8dae5dff294?source=api-prod","affected":[{"type":"plugin","slug":"eewee-admincustom","name":"eewee admin custom","from":"*","from_inclusive":true,"to":"1.8.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T19:54:05Z"},{"id":"wordfence:7a97f6f8-2226-4c63-965b-4dee58c254ad","source":"wordfence","cve":"CVE-2024-49228","title":"bVerse Convert <= 1.3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a97f6f8-2226-4c63-965b-4dee58c254ad?source=api-prod","affected":[{"type":"plugin","slug":"bverse-convert","name":"bVerse Convert","from":"*","from_inclusive":true,"to":"1.3.7.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:53:19Z"},{"id":"wordfence:7a9846c4-4678-4c25-84fd-b05d21ea34fb","source":"wordfence","cve":"CVE-2023-49825","title":"Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9846c4-4678-4c25-84fd-b05d21ea34fb?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a98f7e9-3e50-41a1-9d53-29cafd3649eb","source":"wordfence","cve":"CVE-2025-39448","title":"JetElements For Elementor <= 2.7.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a98f7e9-3e50-41a1-9d53-29cafd3649eb?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.4.1","to_inclusive":true,"patched_in":"2.7.4.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:10:26Z"},{"id":"wordfence:7a9a1605-6f62-445d-bd20-eeec0767d894","source":"wordfence","cve":"CVE-2025-69091","title":"Demo Importer Plus <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9a1605-6f62-445d-bd20-eeec0767d894?source=api-prod","affected":[{"type":"plugin","slug":"demo-importer-plus","name":"Demo Importer Plus","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:54:24Z"},{"id":"wordfence:7a9c1a7a-c09b-4c2d-b294-7cd42883c853","source":"wordfence","cve":"CVE-2026-28128","title":"Verse <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9c1a7a-c09b-4c2d-b294-7cd42883c853?source=api-prod","affected":[{"type":"theme","slug":"verse","name":"Verse - Music, Radio & Concert WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:19:02Z"},{"id":"wordfence:7a9cfd7a-7e6a-4a1f-86bc-b53ef461dde2","source":"wordfence","cve":"CVE-2015-1000006","title":"Recent Backups <= 0.7 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9cfd7a-7e6a-4a1f-86bc-b53ef461dde2?source=api-prod","affected":[{"type":"plugin","slug":"recent-backups","name":"Recent Backups","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7a9e129c-05e2-46b8-9bdd-2e986977591a","source":"wordfence","cve":"CVE-2026-24579","title":"Ai Image Alt Text Generator for WP <= 1.1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9e129c-05e2-46b8-9bdd-2e986977591a?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-alt-text-generator-for-wp","name":"Ai Image Alt Text Generator for WP","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:18:08Z"},{"id":"wordfence:7a9e81bc-0258-4daf-b583-eeec6bfb9b48","source":"wordfence","cve":"CVE-2026-28170","title":"Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9e81bc-0258-4daf-b583-eeec6bfb9b48?source=api-prod","affected":[{"type":"plugin","slug":"blog-floating-button","name":"Blog Floating Button","from":"*","from_inclusive":true,"to":"1.4.20","to_inclusive":true,"patched_in":"1.4.21"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:51:34Z"},{"id":"wordfence:7a9e958f-e53b-4aa0-b7d6-7469852f0d97","source":"wordfence","cve":"CVE-2008-0205","title":"Math Comment Spam Protection <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7a9e958f-e53b-4aa0-b7d6-7469852f0d97?source=api-prod","affected":[{"type":"plugin","slug":"math-comment-spam-protection","name":"Math Comment Spam Protection","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2007-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7aa05744-59c7-43ca-acb3-e6df09fa109b","source":"wordfence","cve":"CVE-2024-3634","title":"month name translation benaceur <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa05744-59c7-43ca-acb3-e6df09fa109b?source=api-prod","affected":[{"type":"plugin","slug":"month-name-translation-benaceur","name":"month name translation benaceur","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:26:20Z"},{"id":"wordfence:7aa0bb19-4f06-4e16-bdd0-7cb125d5dfe2","source":"wordfence","cve":"CVE-2024-13896","title":"WP-GeSHi-Highlight <= 1.4.3 Authenticated (Author+) ReDoS","severity":"medium","cvss":4.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa0bb19-4f06-4e16-bdd0-7cb125d5dfe2?source=api-prod","affected":[{"type":"plugin","slug":"wp-geshi-highlight","name":"WP-GeSHi-Highlight \u2014 rock-solid syntax highlighting for 259 languages","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-04-16T20:21:32Z"},{"id":"wordfence:7aa62be9-93b9-423f-89f8-809ca0035547","source":"wordfence","cve":"CVE-2022-24665","title":"PHP Everywhere <= 2.0.3 - Remote Code Execution by Contributor+ users via gutenberg block","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa62be9-93b9-423f-89f8-809ca0035547?source=api-prod","affected":[{"type":"plugin","slug":"php-everywhere","name":"PHP Everywhere","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7aa6da4d-7221-4878-8532-5372227f906a","source":"wordfence","cve":"CVE-2022-0681","title":"Simple Membership <= 4.0.9 - Cross-Site Request Forgery to Arbitrary Transaction Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa6da4d-7221-4878-8532-5372227f906a?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2022-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7aa700ac-32de-4cd4-9d56-eea8ec0ba61b","source":"wordfence","cve":"CVE-2023-0379","title":"Spotlight Social Feeds <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa700ac-32de-4cd4-9d56-eea8ec0ba61b?source=api-prod","affected":[{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7aa73c13-3f58-423a-ba5f-bebaae2b8371","source":"wordfence","cve":"CVE-2014-9039","title":"WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aa73c13-3f58-423a-ba5f-bebaae2b8371?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7aab1307-7fb5-46fb-ae12-087dce3086fc","source":"wordfence","cve":"CVE-2026-2421","title":"ilGhera Carta Docente for WooCommerce <= 1.5.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aab1307-7fb5-46fb-ae12-087dce3086fc?source=api-prod","affected":[{"type":"plugin","slug":"wc-carta-docente","name":"ilGhera Carta Docente for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-03-19T20:03:09Z","updated":"2026-03-20T08:26:02Z"},{"id":"wordfence:7ab15669-92f6-4e85-bfa5-684e82f341ea","source":"wordfence","cve":"CVE-2024-34418","title":"WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab15669-92f6-4e85-bfa5-684e82f341ea?source=api-prod","affected":[{"type":"plugin","slug":"wpcs-wp-custom-search","name":"WPCS ( WordPress Custom Search )","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-15T21:22:29Z"},{"id":"wordfence:7ab3e286-05db-430e-bbe7-bfaa31134c3c","source":"wordfence","cve":"CVE-2024-5092","title":"Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab3e286-05db-430e-bbe7-bfaa31134c3c?source=api-prod","affected":[{"type":"plugin","slug":"elegant-addons-for-elementor","name":"Elegant Addons for elementor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T17:05:13Z","updated":"2024-05-22T05:32:50Z"},{"id":"wordfence:7ab4517e-8dd8-47a8-8e03-d3e0fd991820","source":"wordfence","cve":"CVE-2025-64368","title":"Bard <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab4517e-8dd8-47a8-8e03-d3e0fd991820?source=api-prod","affected":[{"type":"theme","slug":"bardwp","name":"Bard - A Theatre and Performing Arts WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-04T15:39:51Z"},{"id":"wordfence:7ab50032-abc0-4160-b9ad-369da67ef79a","source":"wordfence","cve":"CVE-2025-4094","title":"Digits < 8.4.6.1 - Authentication Bypass via Weak OTP","severity":"critical","cvss":9.8,"cwe":"CWE-1390","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab50032-abc0-4160-b9ad-369da67ef79a?source=api-prod","affected":[{"type":"plugin","slug":"digits","name":"Digits: WordPress Mobile Number Signup and Login","from":"*","from_inclusive":true,"to":"8.4.6.1","to_inclusive":false,"patched_in":"8.4.6.1"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-29T16:04:02Z"},{"id":"wordfence:7ab83559-752f-4e6d-b8b2-e312a98516b4","source":"wordfence","cve":"CVE-2026-73358","title":"Affiliates Manager <= 2.9.53 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab83559-752f-4e6d-b8b2-e312a98516b4?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.53","to_inclusive":true,"patched_in":"2.9.54"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:19:03Z"},{"id":"wordfence:7ab8f856-1cfe-4d76-9c50-dc97b1f7af2f","source":"wordfence","cve":"CVE-2026-102386","title":"WP Photo Album Plus <= 9.3.02.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab8f856-1cfe-4d76-9c50-dc97b1f7af2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.02.003","to_inclusive":true,"patched_in":"9.3.03.002"}],"published":"2026-09-30T10:02:00Z","updated":"2026-10-08T23:12:03Z"},{"id":"wordfence:7ab99751-24b7-41db-8a27-d86eda3eeee5","source":"wordfence","cve":"CVE-2023-7046","title":"WP Encryption \u2013 One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ab99751-24b7-41db-8a27-d86eda3eeee5?source=api-prod","affected":[{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2024-04-09T00:00:00Z","updated":"2024-07-29T21:36:40Z"},{"id":"wordfence:7abb5103-7063-4a8d-8ca0-66074954acd5","source":"wordfence","cve":"CVE-2024-43292","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.16 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abb5103-7063-4a8d-8ca0-66074954acd5?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.4.17"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-03T16:38:03Z"},{"id":"wordfence:7abd382d-7cc0-4439-a1ff-6d1c99eeb871","source":"wordfence","cve":"CVE-2025-32634","title":"Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abd382d-7cc0-4439-a1ff-6d1c99eeb871?source=api-prod","affected":[{"type":"plugin","slug":"contest-code-checker","name":"Run Contests, Raffles, and Giveaways with ContestsWP","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T20:18:49Z"},{"id":"wordfence:7abf08c2-0b2f-48cd-a438-69c66dbc0238","source":"wordfence","cve":"CVE-2025-30946","title":"Custom Bulk/Quick Edit <= 1.6.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abf08c2-0b2f-48cd-a438-69c66dbc0238?source=api-prod","affected":[{"type":"plugin","slug":"custom-bulkquick-edit","name":"Custom Bulk/Quick Edit","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:05:07Z"},{"id":"wordfence:7abf5f68-2a5f-4cdf-90cf-38dd7189b8c9","source":"wordfence","cve":"CVE-2025-22562","title":"Title Experiments Free <= 9.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abf5f68-2a5f-4cdf-90cf-38dd7189b8c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-experiments-free","name":"Title Experiments Free","from":"*","from_inclusive":true,"to":"9.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:17:44Z"},{"id":"wordfence:7abf84ff-15e6-4fde-ae7d-23283ec83a28","source":"wordfence","cve":"CVE-2024-6243","title":"HTML Forms \u2013 Simple WordPress Forms <= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abf84ff-15e6-4fde-ae7d-23283ec83a28?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.3.32","to_inclusive":true,"patched_in":"1.3.33"}],"published":"2024-07-01T00:00:00Z","updated":"2024-08-09T19:32:15Z"},{"id":"wordfence:7abfa4d5-b7ad-4b26-99e7-de45a0b3413e","source":"wordfence","cve":"CVE-2026-119751","title":"Content Egg \u2013 Affiliate Product Importer & Price Comparison <= 12.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7abfa4d5-b7ad-4b26-99e7-de45a0b3413e?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"12.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T12:57:23Z"},{"id":"wordfence:7ac15c0d-74d3-4121-a63e-97dbbe594274","source":"wordfence","cve":"CVE-2023-32106","title":"WP Docs <= 1.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac15c0d-74d3-4121-a63e-97dbbe594274?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ac215a6-40a2-4e2e-b309-7ecf309ca8b8","source":"wordfence","cve":"CVE-2025-66073","title":"Webhooks <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac215a6-40a2-4e2e-b309-7ecf309ca8b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-webhooks","name":"WP Webhooks Automation \u2013 Automate repetitive tasks by creating powerful WordPress automation workflows","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-01T17:31:35Z"},{"id":"wordfence:7ac22c99-e6f7-4340-9e78-64285fe030a0","source":"wordfence","cve":"CVE-2026-78371","title":"File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac22c99-e6f7-4340-9e78-64285fe030a0?source=api-prod","affected":[{"type":"plugin","slug":"woo-addon-uploads","name":"File Uploads Addon for WooCommerce","from":"1.7.2","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-08T23:54:13Z"},{"id":"wordfence:7ac251c8-4ade-4391-aedd-f48b13045a31","source":"wordfence","cve":"CVE-2018-11568","title":"Gameplan - Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac251c8-4ade-4391-aedd-f48b13045a31?source=api-prod","affected":[{"type":"theme","slug":"gameplan","name":"Gameplan - Event and Gym Fitness WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2017-08-04T00:00:00Z","updated":"2024-08-15T18:15:56Z"},{"id":"wordfence:7ac2ac7a-4cb5-4051-bec7-a22693c50915","source":"wordfence","cve":"CVE-2025-5259","title":"Minimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac2ac7a-4cb5-4051-bec7-a22693c50915?source=api-prod","affected":[{"type":"plugin","slug":"minimal-share-buttons","name":"Minimal Share Buttons","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-05-29T16:53:21Z","updated":"2025-05-30T05:23:22Z"},{"id":"wordfence:7ac4388b-0d23-4d42-910f-8391730fd312","source":"wordfence","cve":"CVE-2026-84217","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 6.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac4388b-0d23-4d42-910f-8391730fd312?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-23T14:30:34Z"},{"id":"wordfence:7ac5e363-e1ae-4bab-b94f-73365c35e67d","source":"wordfence","cve":"CVE-2025-58259","title":"Nokri <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac5e363-e1ae-4bab-b94f-73365c35e67d?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:40:17Z"},{"id":"wordfence:7ac68314-c704-4273-addc-4bc623659769","source":"wordfence","cve":"CVE-2024-12062","title":"Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ac68314-c704-4273-addc-4bc623659769?source=api-prod","affected":[{"type":"plugin","slug":"charity-addon-for-elementor","name":"Charity Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T20:46:26Z","updated":"2025-01-30T21:50:20Z"},{"id":"wordfence:7aca3b02-6c97-4d86-9378-e808c184e84c","source":"wordfence","cve":"CVE-2014-8335","title":"WP-DBManager < 2.72 - Command Injection","severity":"high","cvss":8.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aca3b02-6c97-4d86-9378-e808c184e84c?source=api-prod","affected":[{"type":"plugin","slug":"wp-dbmanager","name":"WP-DBManager","from":"*","from_inclusive":true,"to":"2.72","to_inclusive":false,"patched_in":"2.72"}],"published":"2014-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7acb52d3-7bed-40fb-95dc-ad0bf262649b","source":"wordfence","cve":"CVE-2024-38758","title":"WappPress <= 6.0.4 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7acb52d3-7bed-40fb-95dc-ad0bf262649b?source=api-prod","affected":[{"type":"plugin","slug":"wapppress-builds-android-app-for-website","name":"WappPress \u2013 Convert Site to App Fast \u2013 WordPress to Mobile App Builder","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-31T21:05:03Z"},{"id":"wordfence:7acbcf74-2bae-412b-bf9d-70287a91deea","source":"wordfence","cve":"CVE-2021-4400","title":"Better Search <= 2.5.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7acbcf74-2bae-412b-bf9d-70287a91deea?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7acf0035-12c1-4b94-8c46-dfe92cf984d9","source":"wordfence","cve":"CVE-2026-32502","title":"Borgholm < 1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7acf0035-12c1-4b94-8c46-dfe92cf984d9?source=api-prod","affected":[{"type":"theme","slug":"borgholm-marketing-agency-theme","name":"Borgholm - Marketing Agency Wordpress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:47:29Z"},{"id":"wordfence:7ad16d1e-e778-4cb4-a15d-ddb906f27762","source":"wordfence","cve":"CVE-2023-51472","title":"Checkout Mestres WP <= 7.1.9.6 - Authentication Bypass via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad16d1e-e778-4cb4-a15d-ddb906f27762?source=api-prod","affected":[{"type":"plugin","slug":"checkout-mestres-wp","name":"Checkout Mestres do WP for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.9.6","to_inclusive":true,"patched_in":"7.1.9.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-02T00:08:54Z"},{"id":"wordfence:7ad25948-3265-4c4c-9b99-86f7240600ce","source":"wordfence","cve":"CVE-2025-14342","title":"SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad25948-3265-4c4c-9b99-86f7240600ce?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.14","to_inclusive":true,"patched_in":"12.4.15"}],"published":"2026-02-18T16:09:56Z","updated":"2026-02-19T04:36:17Z"},{"id":"wordfence:7ad4272c-75a1-4bc9-be3b-add80de45871","source":"wordfence","cve":"CVE-2024-39666","title":"WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad4272c-75a1-4bc9-be3b-add80de45871?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:17:27Z"},{"id":"wordfence:7ad6aaf4-7727-4b4a-920a-0d1754405163","source":"wordfence","cve":"CVE-2024-5429","title":"Logo Slider <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad6aaf4-7727-4b4a-920a-0d1754405163?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-18T14:51:33Z"},{"id":"wordfence:7ad6b011-ffe0-4548-b8e8-d03508960413","source":"wordfence","cve":"","title":"Alpine Photo Tile for Instagram < 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad6b011-ffe0-4548-b8e8-d03508960413?source=api-prod","affected":[{"type":"plugin","slug":"alpine-photo-tile-for-instagram","name":"Alpine Photo Tile for Instagram","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":false,"patched_in":"1.2.10"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ad70c32-ad98-4e67-a23c-3e61192b76f4","source":"wordfence","cve":"CVE-2026-24528","title":"Nova Blocks <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad70c32-ad98-4e67-a23c-3e61192b76f4?source=api-prod","affected":[{"type":"plugin","slug":"nova-blocks","name":"Nova Blocks by Pixelgrade","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-10T20:43:38Z"},{"id":"wordfence:7ad9e7e0-f673-455b-8e99-a12cf3bf161d","source":"wordfence","cve":"CVE-2025-60239","title":"CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ad9e7e0-f673-455b-8e99-a12cf3bf161d?source=api-prod","affected":[{"type":"plugin","slug":"coschool","name":"CoSchool LMS \u2013 A complete Learning Management System to Create and Sell Your Courses Online","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-14T00:00:00Z","updated":"2025-11-11T18:25:33Z"},{"id":"wordfence:7ada8d4d-124d-4c8e-be4c-a80ee8c867f6","source":"wordfence","cve":"CVE-2025-47560","title":"MapSVG < 8.6.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ada8d4d-124d-4c8e-be4c-a80ee8c867f6?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.6.13","to_inclusive":false,"patched_in":"8.6.13"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:07:57Z"},{"id":"wordfence:7addc83b-cde5-4f91-b286-70db6f384a9f","source":"wordfence","cve":"CVE-2023-48760","title":"Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7addc83b-cde5-4f91-b286-70db6f384a9f?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.1.25.1","to_inclusive":true,"patched_in":"2.1.25.2"},{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.5.1"},{"type":"plugin","slug":"jet-theme-core","name":"JetThemeCore for Elementor","from":"*","from_inclusive":true,"to":"2.1.2.1","to_inclusive":true,"patched_in":"2.1.2.2"},{"type":"plugin","slug":"jet-compare-wishlist","name":"JetCompareWishlist","from":"*","from_inclusive":true,"to":"1.5.5.1","to_inclusive":true,"patched_in":"1.5.5.2"},{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.13.1"},{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.7.2","to_inclusive":true,"patched_in":"2.1.7.3"},{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.2.1"},{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":true,"patched_in":"1.4.6.2"},{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"},{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.8.1"},{"type":"plugin","slug":"jet-woo-product-gallery","name":"JetProductGallery","from":"*","from_inclusive":true,"to":"2.1.13.1","to_inclusive":true,"patched_in":"2.1.13.2"},{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.2.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7adebd83-8186-402a-8327-c7f9c009ed62","source":"wordfence","cve":"CVE-2021-24663","title":"Simple Schools Staff Directory <= 1.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7adebd83-8186-402a-8327-c7f9c009ed62?source=api-prod","affected":[{"type":"plugin","slug":"simple-schools-staff-directory","name":"Simple Schools Staff Directory","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7adf3335-ed13-43f4-a5f3-05e89be44d2d","source":"wordfence","cve":"CVE-2025-12510","title":"Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7adf3335-ed13-43f4-a5f3-05e89be44d2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"13.2.4","to_inclusive":true,"patched_in":"13.2.5"}],"published":"2025-12-05T15:07:55Z","updated":"2025-12-06T03:27:05Z"},{"id":"wordfence:7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4","source":"wordfence","cve":"CVE-2025-0817","title":"FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0710a-8c9b-41b0-860f-ae79b7ed1ee4?source=api-prod","affected":[{"type":"plugin","slug":"formcraft3","name":"FormCraft","from":"*","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.9.12"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:20Z"},{"id":"wordfence:7ae0ce4b-743b-476d-93b3-bd5006f49c51","source":"wordfence","cve":"CVE-2025-23641","title":"Powie's pLinks PagePeeker <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae0ce4b-743b-476d-93b3-bd5006f49c51?source=api-prod","affected":[{"type":"plugin","slug":"plinks","name":"Powie&#039;s pLinks PagePeeker","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:09:04Z"},{"id":"wordfence:7ae14765-ba85-4aba-83ae-41f7de2f2551","source":"wordfence","cve":"CVE-2023-2223","title":"Login rebuilder <= 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae14765-ba85-4aba-83ae-41f7de2f2551?source=api-prod","affected":[{"type":"plugin","slug":"login-rebuilder","name":"Login rebuilder","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ae17154-bd68-4260-9b3a-bb73f2a70694","source":"wordfence","cve":"CVE-2024-33651","title":"MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae17154-bd68-4260-9b3a-bb73f2a70694?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:35:19Z"},{"id":"wordfence:7ae1d155-deb4-4847-858b-37b5cd9ac1c5","source":"wordfence","cve":"","title":"FormBuilder < 1.08 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae1d155-deb4-4847-858b-37b5cd9ac1c5?source=api-prod","affected":[{"type":"plugin","slug":"formbuilder","name":"FormBuilder","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":"1.08"}],"published":"2016-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ae1e8fd-4d1b-4590-a141-f93d6347c0f2","source":"wordfence","cve":"CVE-2024-1088","title":"Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae1e8fd-4d1b-4590-a141-f93d6347c0f2?source=api-prod","affected":[{"type":"plugin","slug":"password-protected-woo-store","name":"Password Protected Store for WooCommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-08T19:07:24Z"},{"id":"wordfence:7ae31a9f-e5b2-46de-8e66-39dec7a73c57","source":"wordfence","cve":"CVE-2025-32184","title":"Ultimate Store Kit Elementor Addons <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae31a9f-e5b2-46de-8e66-39dec7a73c57?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-16T14:24:31Z"},{"id":"wordfence:7ae34640-ce6a-4d87-9d75-d3a574d23a93","source":"wordfence","cve":"CVE-2025-30952","title":"Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae34640-ce6a-4d87-9d75-d3a574d23a93?source=api-prod","affected":[{"type":"plugin","slug":"nexa-blocks","name":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:03:31Z"},{"id":"wordfence:7ae5b7b8-bafc-4979-85cd-a61fa654d21f","source":"wordfence","cve":"CVE-2024-56069","title":"WP SuperBackup <= 2.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae5b7b8-bafc-4979-85cd-a61fa654d21f?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:07:12Z"},{"id":"wordfence:7ae5bbd0-2f95-41f3-a484-a9bb21b23b0e","source":"wordfence","cve":"CVE-2023-36504","title":"BBS e-Popup <= 2.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae5bbd0-2f95-41f3-a484-a9bb21b23b0e?source=api-prod","affected":[{"type":"plugin","slug":"bbs-e-popup","name":"BBS e-Popup","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ae90bf5-3c3f-4da1-a09f-e10c65b88e68","source":"wordfence","cve":"CVE-2025-23645","title":"Find Content IDs <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae90bf5-3c3f-4da1-a09f-e10c65b88e68?source=api-prod","affected":[{"type":"plugin","slug":"find-content-ids","name":"Find Content IDs","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:24:34Z"},{"id":"wordfence:7ae927b1-401f-4227-9d50-4adde8e95f24","source":"wordfence","cve":"CVE-2026-75091","title":"Quill Forms  <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ae927b1-401f-4227-9d50-4adde8e95f24?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-08-14T00:00:00Z","updated":"2026-09-09T16:10:43Z"},{"id":"wordfence:7aee2acb-f109-4ba7-91ed-e65868b32f4f","source":"wordfence","cve":"CVE-2026-90437","title":"Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aee2acb-f109-4ba7-91ed-e65868b32f4f?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-10-29T18:36:52Z","updated":"2026-10-30T06:47:31Z"},{"id":"wordfence:7af05793-b495-4cad-842b-f168d0dc8253","source":"wordfence","cve":"","title":"Analytics Stats Counter Statistics <= 1.2.2.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7af05793-b495-4cad-842b-f168d0dc8253?source=api-prod","affected":[{"type":"plugin","slug":"stats-counter","name":"Analytics Stats Counter Statistics","from":"*","from_inclusive":true,"to":"1.2.2.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7af13d87-c36b-4a75-8364-f151571f52b2","source":"wordfence","cve":"CVE-2024-51623","title":"WP EIS <= 1.3.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7af13d87-c36b-4a75-8364-f151571f52b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-eis","name":"WP EIS","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:42:07Z"},{"id":"wordfence:7af32d7b-3832-4192-bc31-b4ba1f419668","source":"wordfence","cve":"CVE-2011-5257","title":"Classipress <= 3.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7af32d7b-3832-4192-bc31-b4ba1f419668?source=api-prod","affected":[{"type":"theme","slug":"classipress","name":"Classipress","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2011-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7af56157-7b69-4bbd-8f22-4963d0cdf9eb","source":"wordfence","cve":"CVE-2024-56212","title":"Userpro <= 5.1.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7af56157-7b69-4bbd-8f22-4963d0cdf9eb?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:10:50Z"},{"id":"wordfence:7af97962-52fc-42d3-9499-41ee9424bb3e","source":"wordfence","cve":"CVE-2026-0677","title":"Photo Contest  | Competition | Video Contest <= 2.9.1 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7af97962-52fc-42d3-9499-41ee9424bb3e?source=api-prod","affected":[{"type":"plugin","slug":"totalcontest-lite","name":"Photo Contest  | Competition | Video Contest","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-10-15T13:20:30Z"},{"id":"wordfence:7aff5aa6-59b1-4d5e-b3a9-5101a489fb37","source":"wordfence","cve":"CVE-2025-53453","title":"Hygia <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7aff5aa6-59b1-4d5e-b3a9-5101a489fb37?source=api-prod","affected":[{"type":"theme","slug":"hygia","name":"Hygia - Cleaning Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:27:45Z"},{"id":"wordfence:7b00d175-261d-46e3-bf3c-2d18f4e4972d","source":"wordfence","cve":"CVE-2025-2111","title":"WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00d175-261d-46e3-bf3c-2d18f4e4972d?source=api-prod","affected":[{"type":"plugin","slug":"wp-headers-and-footers","name":"Insert Headers And Footers","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T05:30:15Z"},{"id":"wordfence:7b00f5fd-80f2-4c54-8042-fed7fab9cf0f","source":"wordfence","cve":"CVE-2024-49640","title":"ACL Floating Cart for WooCommerce <= 0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b00f5fd-80f2-4c54-8042-fed7fab9cf0f?source=api-prod","affected":[{"type":"plugin","slug":"acl-floating-cart-for-woocommerce","name":"ACL Floating Cart for WooCommerce","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:43:01Z"},{"id":"wordfence:7b026b30-5a1b-4551-93a4-0c0cdbac650b","source":"wordfence","cve":"CVE-2025-31732","title":"GB Gallery Slideshow <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b026b30-5a1b-4551-93a4-0c0cdbac650b?source=api-prod","affected":[{"type":"plugin","slug":"gb-gallery-slideshow","name":"GB Gallery Slideshow","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:21:42Z"},{"id":"wordfence:7b035d17-303b-4a8b-a15e-615df6b605d1","source":"wordfence","cve":"CVE-2026-1313","title":"MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=api-prod","affected":[{"type":"plugin","slug":"mimetypes-link-icons","name":"MimeTypes Link Icons","from":"*","from_inclusive":true,"to":"3.2.20","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-03-20T15:17:37Z","updated":"2026-04-17T14:57:58Z"},{"id":"wordfence:7b039c23-51d4-422a-a57b-59abaeca682c","source":"wordfence","cve":"CVE-2023-37889","title":"WPAdmin AWS CDN <= 2.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b039c23-51d4-422a-a57b-59abaeca682c?source=api-prod","affected":[{"type":"plugin","slug":"aws-cdn-by-wpadmin","name":"WPAdmin AWS CDN","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b049489-50b1-4199-9e66-0db5d745b968","source":"wordfence","cve":"CVE-2026-28127","title":"Lawyer Directory <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b049489-50b1-4199-9e66-0db5d745b968?source=api-prod","affected":[{"type":"plugin","slug":"lawyer-directory","name":"Lawyer Directory","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:15:06Z"},{"id":"wordfence:7b086aec-3af4-4498-bb7d-dd6f6d264be7","source":"wordfence","cve":"CVE-2024-52488","title":"Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b086aec-3af4-4498-bb7d-dd6f6d264be7?source=api-prod","affected":[{"type":"theme","slug":"grip","name":"Grip","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gaga-lite","name":"Gaga Lite","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"one-paze","name":"One Paze","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"accesspress-staple","name":"AccessPress Staple","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-12-18T15:37:49Z"},{"id":"wordfence:7b093135-5eed-41b8-8c90-8217bb9a90a1","source":"wordfence","cve":"CVE-2025-39564","title":"Conditional Shipping for WooCommerce <= 3.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b093135-5eed-41b8-8c90-8217bb9a90a1?source=api-prod","affected":[{"type":"plugin","slug":"conditional-shipping-for-woocommerce","name":"Conditional Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:37:46Z"},{"id":"wordfence:7b0aeb61-6b10-4e36-8236-160d061d8965","source":"wordfence","cve":"CVE-2026-106933","title":"Blaze Demo Importer <= 1.0.16 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b0aeb61-6b10-4e36-8236-160d061d8965?source=api-prod","affected":[{"type":"plugin","slug":"blaze-demo-importer","name":"Blaze Demo Importer","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:21:37Z"},{"id":"wordfence:7b0b02ad-6ab6-47f3-9cf8-fd993a8051db","source":"wordfence","cve":"CVE-2024-47327","title":"GEO my WordPress <= 4.5.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b0b02ad-6ab6-47f3-9cf8-fd993a8051db?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.0.3","to_inclusive":true,"patched_in":"4.5.0.4"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:09:32Z"},{"id":"wordfence:7b0d5d92-1aba-4a0a-a989-a2d797112ade","source":"wordfence","cve":"CVE-2014-4856","title":"Crowdsignal Dashboard <= 2.0.24 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b0d5d92-1aba-4a0a-a989-a2d797112ade?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"2.0.24","to_inclusive":true,"patched_in":"2.0.25"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b0eff94-6fb9-4caf-b60d-f92f63a41915","source":"wordfence","cve":"CVE-2026-57714","title":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b0eff94-6fb9-4caf-b60d-f92f63a41915?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:37:26Z"},{"id":"wordfence:7b0ff45d-0514-4090-bfa3-c3b75766ac61","source":"wordfence","cve":"CVE-2024-32958","title":"Slash Admin  <= 3.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b0ff45d-0514-4090-bfa3-c3b75766ac61?source=api-prod","affected":[{"type":"plugin","slug":"slash-admin","name":"Slash Admin","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T15:36:35Z"},{"id":"wordfence:7b1019ef-02fd-4220-9dcf-e7776d40b3e7","source":"wordfence","cve":"CVE-2026-66694","title":"Thrive Visual Editor <= 10.9.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1019ef-02fd-4220-9dcf-e7776d40b3e7?source=api-prod","affected":[{"type":"plugin","slug":"thrive-visual-editor","name":"Thrive Visual Editor","from":"*","from_inclusive":true,"to":"10.9.3.1","to_inclusive":true,"patched_in":"10.9.3.2"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:29:01Z"},{"id":"wordfence:7b107c5d-ff82-4422-b201-39b745c2f412","source":"wordfence","cve":"CVE-2025-30850","title":"Dr. Flex <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b107c5d-ff82-4422-b201-39b745c2f412?source=api-prod","affected":[{"type":"plugin","slug":"dr-flex","name":"Dr. Flex","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:31:27Z"},{"id":"wordfence:7b10dde5-dfb9-4bff-9d78-042ae3e73bba","source":"wordfence","cve":"CVE-2026-96451","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b10dde5-dfb9-4bff-9d78-042ae3e73bba?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-01T14:14:29Z","updated":"2026-10-09T00:09:54Z"},{"id":"wordfence:7b110a6c-fd6d-4c00-bdd6-08fce116b937","source":"wordfence","cve":"CVE-2020-29045","title":"Five Star Restaurant Menu <= 2.2.0 - Unauthenticated Arbitrary Object Deserialization leading to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b110a6c-fd6d-4c00-bdd6-08fce116b937?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2021-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b121abf-3842-43ac-a3dc-bde6d5e0b263","source":"wordfence","cve":"CVE-2023-51510","title":"Export Media URLs <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b121abf-3842-43ac-a3dc-bde6d5e0b263?source=api-prod","affected":[{"type":"plugin","slug":"export-media-urls","name":"Export Media URLs","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b1242fc-1bbf-4686-ba7d-d948336f65a3","source":"wordfence","cve":"CVE-2023-23680","title":"WP TopBar <= 5.36 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1242fc-1bbf-4686-ba7d-d948336f65a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-topbar","name":"WP-TopBar","from":"*","from_inclusive":true,"to":"5.36","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b168e3e-9d22-4318-9b71-c217733a8d28","source":"wordfence","cve":"CVE-2024-54272","title":"Radius Blocks \u2013 WordPress Gutenberg Blocks <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b168e3e-9d22-4318-9b71-c217733a8d28?source=api-prod","affected":[{"type":"plugin","slug":"radius-blocks","name":"Radius Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-17T14:23:19Z"},{"id":"wordfence:7b1771f2-6741-410d-9544-4178a0b962eb","source":"wordfence","cve":"CVE-2012-6713","title":"Job Manager <= 0.7.18 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1771f2-6741-410d-9544-4178a0b962eb?source=api-prod","affected":[{"type":"plugin","slug":"job-manager","name":"Job Manager","from":"*","from_inclusive":true,"to":"0.7.18","to_inclusive":true,"patched_in":"0.7.19"}],"published":"2012-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b18918f-5a06-4bf7-9b6c-7b8517064f6d","source":"wordfence","cve":"CVE-2026-32376","title":"Kalon <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b18918f-5a06-4bf7-9b6c-7b8517064f6d?source=api-prod","affected":[{"type":"theme","slug":"kalon","name":"Kalon","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:53:23Z"},{"id":"wordfence:7b19b0b2-d6cb-4d92-9925-c77d517ddfb7","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress <= 3.10.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b19b0b2-d6cb-4d92-9925-c77d517ddfb7?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":false,"patched_in":"3.10.2"}],"published":"2016-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b1daf51-ae9d-4c02-8fb2-0c5f9e20b7c5","source":"wordfence","cve":"CVE-2025-62901","title":"WP Microdata <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1daf51-ae9d-4c02-8fb2-0c5f9e20b7c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-microdata","name":"WP Microdata","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-27T00:00:00Z","updated":"2025-10-29T15:05:35Z"},{"id":"wordfence:7b1e4f3b-071b-4ef7-9a07-f26da45b916e","source":"wordfence","cve":"CVE-2026-100161","title":"Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1e4f3b-071b-4ef7-9a07-f26da45b916e?source=api-prod","affected":[{"type":"plugin","slug":"woo-photo-reviews","name":"Revopic \u2013 Photo Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.30","to_inclusive":true,"patched_in":"1.2.31"}],"published":"2026-10-09T17:46:05Z","updated":"2026-10-10T06:40:13Z"},{"id":"wordfence:7b22eb82-f073-4adf-8dc6-57025b9bcef8","source":"wordfence","cve":"CVE-2025-49294","title":"Crawlomatic Multisite Scraper Post Generator <= 2.6.8.2 - Unauthenticated Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b22eb82-f073-4adf-8dc6-57025b9bcef8?source=api-prod","affected":[{"type":"plugin","slug":"crawlomatic-multipage-scraper-post-generator","name":"Crawlomatic Multipage Scraper Post Generator","from":"*","from_inclusive":true,"to":"2.6.8.2","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:34:12Z"},{"id":"wordfence:7b23308d-7439-4dd2-9ec7-57b987909121","source":"wordfence","cve":"CVE-2009-2335","title":"WordPress Core & WordPress MU < 2.8.1 - Username Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-204","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b23308d-7439-4dd2-9ec7-57b987909121?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2009-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b24fe1d-1b21-4f8f-b66e-6df3bfc0e180","source":"wordfence","cve":"CVE-2023-37890","title":"KB Support <= 1.5.88 - Missing Authorization to Sensitive Data Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b24fe1d-1b21-4f8f-b66e-6df3bfc0e180?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.5.88","to_inclusive":true,"patched_in":"1.5.89"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b2688ee-f416-4fce-b73a-864f31057146","source":"wordfence","cve":"CVE-2026-15820","title":"Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2688ee-f416-4fce-b73a-864f31057146?source=api-prod","affected":[{"type":"plugin","slug":"builderall-cheetah-for-wp","name":"Builderall for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:44Z","updated":"2026-09-10T03:40:41Z"},{"id":"wordfence:7b26e5f7-bd35-4412-a608-9cdfeff0b025","source":"wordfence","cve":"CVE-2024-31371","title":"WP Event Aggregator <= 1.7.6 - Cross-Site Request Forgery via wpea_deauthorize_user()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b26e5f7-bd35-4412-a608-9cdfeff0b025?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-aggregator","name":"WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-16T15:40:32Z"},{"id":"wordfence:7b2a3b17-0551-4e02-8e6a-ae8d46da0ef8","source":"wordfence","cve":"CVE-2024-1380","title":"Relevanssi \u2013 A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2a3b17-0551-4e02-8e6a-ae8d46da0ef8?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25.0","to_inclusive":true,"patched_in":"2.25.1"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.22.1"}],"published":"2024-02-22T00:00:00Z","updated":"2025-05-13T07:23:57Z"},{"id":"wordfence:7b2cac27-4a36-490f-b2d8-3c6f32843a38","source":"wordfence","cve":"CVE-2025-1305","title":"NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2cac27-4a36-490f-b2d8-3c6f32843a38?source=api-prod","affected":[{"type":"theme","slug":"newsblogger","name":"NewsBlogger","from":"*","from_inclusive":true,"to":"0.2.5.4","to_inclusive":true,"patched_in":"0.2.5.5"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-01T03:23:39Z"},{"id":"wordfence:7b2d1879-c337-41c9-9f47-f9c2fe8e5928","source":"wordfence","cve":"CVE-2023-7320","title":"WooCommerce <= 7.8.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2d1879-c337-41c9-9f47-f9c2fe8e5928?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"7.9.0"}],"published":"2023-09-11T00:00:00Z","updated":"2025-10-29T06:45:49Z"},{"id":"wordfence:7b2d77a2-1165-4e23-82ef-3c46e4da7dac","source":"wordfence","cve":"CVE-2026-94679","title":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System <= 2.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2d77a2-1165-4e23-82ef-3c46e4da7dac?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-09-23T09:52:00Z","updated":"2026-09-29T20:06:45Z"},{"id":"wordfence:7b2ebbb5-0590-4e4a-a9b6-abc80b220d18","source":"wordfence","cve":"CVE-2021-24778","title":"Tradetracker-Store < 4.6.60 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2ebbb5-0590-4e4a-a9b6-abc80b220d18?source=api-prod","affected":[{"type":"plugin","slug":"tradetracker-store","name":"Tradetracker-Store","from":"*","from_inclusive":true,"to":"4.6.60","to_inclusive":false,"patched_in":"4.6.60"}],"published":"2021-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b33f2ee-3f20-4494-bdae-3f8cc3c6dc73","source":"wordfence","cve":"CVE-2024-1121","title":"Advanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b33f2ee-3f20-4494-bdae-3f8cc3c6dc73?source=api-prod","affected":[{"type":"plugin","slug":"advanced-forms","name":"Advanced Forms for ACF","from":"*","from_inclusive":true,"to":"1.9.3.2","to_inclusive":true,"patched_in":"1.9.3.3"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-05T21:21:52Z"},{"id":"wordfence:7b3446e5-ca01-4468-927a-86e951e662ab","source":"wordfence","cve":"CVE-2024-10705","title":"Multiple Page Generator Plugin \u2013 MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3446e5-ca01-4468-927a-86e951e662ab?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T06:41:22Z"},{"id":"wordfence:7b34f50a-4d2d-49b8-86e4-0416c8be202b","source":"wordfence","cve":"CVE-2024-0708","title":"Landing Page Cat \u2013 Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b34f50a-4d2d-49b8-86e4-0416c8be202b?source=api-prod","affected":[{"type":"plugin","slug":"landing-page-cat","name":"Landing Page Cat \u2013 Coming Soon & Maintenance Pages","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-02-14T00:00:00Z","updated":"2024-07-29T21:36:40Z"},{"id":"wordfence:7b3608ca-8ed6-46ff-8e57-d8b68f91b9f2","source":"wordfence","cve":"CVE-2023-6785","title":"Download Manager <= 3.2.84 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3608ca-8ed6-46ff-8e57-d8b68f91b9f2?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.84","to_inclusive":true,"patched_in":"3.2.85"}],"published":"2024-02-28T00:00:00Z","updated":"2024-07-29T21:36:41Z"},{"id":"wordfence:7b384246-7f6f-489f-897d-53f1b1ae51c3","source":"wordfence","cve":"CVE-2026-42739","title":"Advanced IP Blocker <= 8.10.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b384246-7f6f-489f-897d-53f1b1ae51c3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ip-blocker","name":"Advanced IP Blocker","from":"*","from_inclusive":true,"to":"8.10.7","to_inclusive":true,"patched_in":"8.10.8"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:07:53Z"},{"id":"wordfence:7b3954c0-294d-42d2-93af-35853d6b09c2","source":"wordfence","cve":"CVE-2025-27303","title":"Contact Form 7 Star Rating <= 1.10 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3954c0-294d-42d2-93af-35853d6b09c2?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-star-rating","name":"Contact Form 7 Star Rating","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:52:34Z"},{"id":"wordfence:7b3b2b53-4984-4841-8a25-621e16eb5802","source":"wordfence","cve":"CVE-2025-59566","title":"Workreap <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3b2b53-4984-4841-8a25-621e16eb5802?source=api-prod","affected":[{"type":"plugin","slug":"workreap","name":"Workreap","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-29T16:25:41Z"},{"id":"wordfence:7b3c77d8-0e90-41ee-b7e4-6160f1d5760f","source":"wordfence","cve":"CVE-2021-24270","title":"DethemeKit For Elementor <= 1.5.5.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3c77d8-0e90-41ee-b7e4-6160f1d5760f?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"1.5.5.5","to_inclusive":false,"patched_in":"1.5.5.5"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b3ce7e7-c816-49d3-b794-91b71cb3e9c7","source":"wordfence","cve":"CVE-2015-9374","title":"Stripe Add-on for iThemes Exchange < 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3ce7e7-c816-49d3-b794-91b71cb3e9c7?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-stripe","name":"Stripe Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b3d39be-83de-46e7-9eab-57c1e94ab59a","source":"wordfence","cve":"CVE-2024-44064","title":"Like Button Rating <= 2.6.53 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3d39be-83de-46e7-9eab-57c1e94ab59a?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.53","to_inclusive":true,"patched_in":"2.6.54"}],"published":"2024-08-29T00:00:00Z","updated":"2024-10-15T17:34:37Z"},{"id":"wordfence:7b3d68d9-fa82-4be3-8692-39a9dc216d17","source":"wordfence","cve":"CVE-2024-1401","title":"Profile Box Shortcode And Widget <= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3d68d9-fa82-4be3-8692-39a9dc216d17?source=api-prod","affected":[{"type":"plugin","slug":"facebook-likebox-widget-and-shortcode","name":"Profile Box Shortcode And Widget","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-13T12:46:56Z"},{"id":"wordfence:7b3e9ff7-c33b-4e47-8dfb-120577b815f2","source":"wordfence","cve":"CVE-2025-52779","title":"Dot html,php,xml etc pages <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3e9ff7-c33b-4e47-8dfb-120577b815f2?source=api-prod","affected":[{"type":"plugin","slug":"dot-htmlphpxml-etc-pages","name":"Dot html,php,xml etc pages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:43:35Z"},{"id":"wordfence:7b41a6bd-8b0c-4d00-8cc3-9589fca5e406","source":"wordfence","cve":"CVE-2021-25012","title":"Pz-LinkCard <= 2.4.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b41a6bd-8b0c-4d00-8cc3-9589fca5e406?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.4.5.1","to_inclusive":true,"patched_in":"2.4.5.2"}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b44130c-b526-4670-bde2-e47fe823ac62","source":"wordfence","cve":"CVE-2021-36915","title":"Profile Builder \u2013 User Profile & User Registration Forms <= 3.6.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b44130c-b526-4670-bde2-e47fe823ac62?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b452283-9f0d-469b-b1b8-4bd253f9ea1d","source":"wordfence","cve":"CVE-2023-4294","title":"URL Shortify <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via Referrer Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b452283-9f0d-469b-b1b8-4bd253f9ea1d?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b473f26-8f78-4e07-acc6-65a638743163","source":"wordfence","cve":"CVE-2026-24614","title":"Flex QR Code Generator <= 1.2.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b473f26-8f78-4e07-acc6-65a638743163?source=api-prod","affected":[{"type":"plugin","slug":"flex-qr-code-generator","name":"Flex QR Code Generator","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2026-01-12T04:11:43Z","updated":"2026-08-14T15:16:44Z"},{"id":"wordfence:7b498c5a-9fd1-43b8-b456-f6cec65d5077","source":"wordfence","cve":"CVE-2022-4555","title":"WP Shamsi <= 4.1.0 - Missing Authorization to Arbitrary Plugin Deactivation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077?source=api-prod","affected":[{"type":"plugin","slug":"wp-shamsi","name":"WP Shamsi \u2013 \u0627\u0641\u0632\u0648\u0646\u0647 \u062a\u0627\u0631\u06cc\u062e \u0634\u0645\u0633\u06cc \u0648 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b49af95-2310-4f71-921b-ee66588dd6d5","source":"wordfence","cve":"CVE-2022-3897","title":"WP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b49af95-2310-4f71-921b-ee66588dd6d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b4d99d9-e58b-47c5-bb10-35f09b25cbf4","source":"wordfence","cve":"CVE-2025-48294","title":"FG Drupal to WordPress <= 3.90.0 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b4d99d9-e58b-47c5-bb10-35f09b25cbf4?source=api-prod","affected":[{"type":"plugin","slug":"fg-drupal-to-wp","name":"FG Drupal to WordPress","from":"*","from_inclusive":true,"to":"3.90.0","to_inclusive":true,"patched_in":"3.90.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:01:07Z"},{"id":"wordfence:7b4e9cf7-e60c-414d-94fa-a43191baf9ac","source":"wordfence","cve":"CVE-2018-25437","title":"Cherry Framework <= 3.1.4 - Unauthenticated Backup Download","severity":"high","cvss":7.5,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b4e9cf7-e60c-414d-94fa-a43191baf9ac?source=api-prod","affected":[{"type":"theme","slug":"CherryFramework","name":"Cherry Framework","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T20:00:19Z"},{"id":"wordfence:7b4f63af-cb43-4287-8fdd-0ff1df70c6d6","source":"wordfence","cve":"","title":"Rencontre \u2013 Dating Site <= 3.2.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b4f63af-cb43-4287-8fdd-0ff1df70c6d6?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2019-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b509887-6d32-4e7f-bdff-fd4f6c76f6f2","source":"wordfence","cve":"CVE-2023-32299","title":"Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b509887-6d32-4e7f-bdff-fd4f6c76f6f2?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-sales-report","name":"Ni WooCommerce Sales Report \u2013 Orders, Revenue & Sales Analytics Dashboard","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2023-10-25T00:00:00Z","updated":"2024-04-01T17:06:12Z"},{"id":"wordfence:7b56c684-90f6-4e8b-86fc-355a13b5368c","source":"wordfence","cve":"CVE-2023-45073","title":"Mendeley <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b56c684-90f6-4e8b-86fc-355a13b5368c?source=api-prod","affected":[{"type":"plugin","slug":"mendeleyplugin","name":"Mendeley Plugin","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-02-01T23:55:11Z"},{"id":"wordfence:7b57e750-71ec-4c52-999b-6c14a78c3bff","source":"wordfence","cve":"CVE-2024-6500","title":"InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete","severity":"critical","cvss":10.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b57e750-71ec-4c52-999b-6c14a78c3bff?source=api-prod","affected":[{"type":"plugin","slug":"inpost-for-woocommerce","name":"InPost PL","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"},{"type":"plugin","slug":"woo-inpost","name":"InPost for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T14:24:22Z","updated":"2024-08-17T02:31:01Z"},{"id":"wordfence:7b5d35a6-aa75-43ee-a4fa-12e999428fe3","source":"wordfence","cve":"CVE-2026-111836","title":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b5d35a6-aa75-43ee-a4fa-12e999428fe3?source=api-prod","affected":[{"type":"plugin","slug":"fluent-community","name":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-10-19T12:21:00Z","updated":"2026-10-23T18:45:14Z"},{"id":"wordfence:7b5e5b0a-dd6a-401f-86db-940b3386ed21","source":"wordfence","cve":"CVE-2019-13572","title":"Blog2Social: Social Media Auto Post & Scheduler <= 5.5.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b5e5b0a-dd6a-401f-86db-940b3386ed21?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":false,"patched_in":"5.6.0"}],"published":"2019-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b5ef9de-ba5e-463e-a528-098d724b1657","source":"wordfence","cve":"CVE-2019-14794","title":"Meta Box <= 4.16.1 - Mishandling of File Upload","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b5ef9de-ba5e-463e-a528-098d724b1657?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"4.16.1","to_inclusive":true,"patched_in":"4.16.2"}],"published":"2019-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b604ad0-6b26-4aed-9380-bda04a8f3d17","source":"wordfence","cve":"CVE-2024-51658","title":"WP Course Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b604ad0-6b26-4aed-9380-bda04a8f3d17?source=api-prod","affected":[{"type":"plugin","slug":"wp-course-manager","name":"WP Course Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:29:35Z"},{"id":"wordfence:7b6557de-fd4f-4172-ad7d-940f9f3ea2db","source":"wordfence","cve":"","title":"Running Line <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b6557de-fd4f-4172-ad7d-940f9f3ea2db?source=api-prod","affected":[{"type":"plugin","slug":"running-line","name":"Running Line","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b67f7e4-d431-4185-9509-217f6e22c98b","source":"wordfence","cve":"CVE-2025-28962","title":"Advanced Google Universal Analytics <= 1.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b67f7e4-d431-4185-9509-217f6e22c98b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-universal-analytics","name":"Advanced Google Universal Analytics","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T19:32:09Z"},{"id":"wordfence:7b6ac72f-11f4-46bd-a972-fbcb46b34ce6","source":"wordfence","cve":"CVE-2021-24660","title":"PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b6ac72f-11f4-46bd-a972-fbcb46b34ce6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":false,"patched_in":"2.4.10"}],"published":"2021-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b6b9da8-75bb-4a5d-8168-6272a6292903","source":"wordfence","cve":"CVE-2024-51876","title":"wp_automatic_widget <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b6b9da8-75bb-4a5d-8168-6272a6292903?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic-widget","name":"wp_automatic_widget","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:22:12Z"},{"id":"wordfence:7b6db928-f8ff-4e78-bfc7-51f1d1ccd1fa","source":"wordfence","cve":"CVE-2023-25486","title":"Clone <= 2.3.7 - Missing Authorization via wp_ajax_tifm_save_decision","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b6db928-f8ff-4e78-bfc7-51f1d1ccd1fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b70b152-eb65-4273-8063-37cfec7ecefb","source":"wordfence","cve":"CVE-2013-1464","title":"Audio Player <= 2.0.4.5 - Cross-Site Scripting via playerID Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b70b152-eb65-4273-8063-37cfec7ecefb?source=api-prod","affected":[{"type":"plugin","slug":"audio-player","name":"audio-player","from":"*","from_inclusive":true,"to":"2.0.4.6","to_inclusive":false,"patched_in":"2.0.4.6"}],"published":"2013-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b712d9c-a1d0-422d-8a6e-76c298744838","source":"wordfence","cve":"CVE-2024-37271","title":"Print My Blog <= 3.27.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b712d9c-a1d0-422d-8a6e-76c298744838?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.27.0","to_inclusive":true,"patched_in":"3.27.1"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:50:11Z"},{"id":"wordfence:7b738676-250d-4af4-81ff-cee9efcf996e","source":"wordfence","cve":"CVE-2015-9315","title":"NewStatPress <= 1.0.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b738676-250d-4af4-81ff-cee9efcf996e?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2015-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b73d309-5c3a-4a46-95df-fd7a59c66275","source":"wordfence","cve":"CVE-2014-10076","title":"Database Backup for WordPress <= 2.2.4 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b73d309-5c3a-4a46-95df-fd7a59c66275?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2014-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b744385-60ee-4a1a-a6f6-fbdc88f17019","source":"wordfence","cve":"CVE-2025-39364","title":"Product Category Slider for WooCommerce <= 4.3.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b744385-60ee-4a1a-a6f6-fbdc88f17019?source=api-prod","affected":[{"type":"plugin","slug":"woo-category-slider-by-pluginever","name":"Product Category Slider for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:22:46Z"},{"id":"wordfence:7b76ce38-d9ee-4998-ba3b-9f21158ce18a","source":"wordfence","cve":"CVE-2023-35094","title":"WP Matterport Shortcode <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b76ce38-d9ee-4998-ba3b-9f21158ce18a?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-gallery-for-matterport-showcase","name":"Matterport Shortcode","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b78004e-caa5-4478-ba16-5f1a10e31541","source":"wordfence","cve":"","title":"DX Delete Attached Media <= 2.0.2 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b78004e-caa5-4478-ba16-5f1a10e31541?source=api-prod","affected":[{"type":"plugin","slug":"dx-delete-attached-media","name":"DX Delete Attached Media","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b795352-fad8-485e-bd1b-68c0913555e2","source":"wordfence","cve":"CVE-2021-39350","title":"FV Flowplayer Video Player 7.5.0.727 - 7.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b795352-fad8-485e-bd1b-68c0913555e2?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"7.5.0.727","from_inclusive":true,"to":"7.5.2.727","to_inclusive":true,"patched_in":"7.5.3.727"}],"published":"2021-10-05T20:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b7c2644-5409-4a21-ba14-91475cb14cb2","source":"wordfence","cve":"CVE-2026-25389","title":"EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c2644-5409-4a21-ba14-91475cb14cb2?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.3","to_inclusive":true,"patched_in":"4.2.8.4"}],"published":"2026-02-20T00:00:00Z","updated":"2026-02-25T15:21:56Z"},{"id":"wordfence:7b7c9123-a918-4fc0-9b16-f537b418b990","source":"wordfence","cve":"CVE-2026-3331","title":"Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7c9123-a918-4fc0-9b16-f537b418b990?source=api-prod","affected":[{"type":"plugin","slug":"lobot-slider-administrator","name":"Lobot Slider Administrator","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:13:22Z","updated":"2026-03-21T03:26:52Z"},{"id":"wordfence:7b7dee9e-1272-4e70-926c-a73e2897968c","source":"wordfence","cve":"CVE-2023-50831","title":"CURCY \u2013 Multi Currency for WooCommerce <= 2.2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b7dee9e-1272-4e70-926c-a73e2897968c?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0.1","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-12-19T00:00:00Z","updated":"2024-11-11T15:52:33Z"},{"id":"wordfence:7b82e8d1-c2f4-43ad-a645-63808ac1ded6","source":"wordfence","cve":"CVE-2025-22712","title":"Typify <= 3.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b82e8d1-c2f4-43ad-a645-63808ac1ded6?source=api-prod","affected":[{"type":"theme","slug":"typify","name":"Typify - Newspaper & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T22:00:34Z"},{"id":"wordfence:7b834a3c-6af0-48fd-aa13-985d226b546d","source":"wordfence","cve":"","title":"Nextend Facebook Connect <= 1.5.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b834a3c-6af0-48fd-aa13-985d226b546d?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2016-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b8483b8-07b4-436f-992f-35e16fef867b","source":"wordfence","cve":"CVE-2023-47186","title":"Kadence WooCommerce Email Designer <= 1.5.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8483b8-07b4-436f-992f-35e16fef867b?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.5.12"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b848b66-1dcd-4357-b472-4b7a27d2682f","source":"wordfence","cve":"CVE-2024-32453","title":"POEditor <= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b848b66-1dcd-4357-b472-4b7a27d2682f?source=api-prod","affected":[{"type":"plugin","slug":"poeditor","name":"POEditor","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:29:05Z"},{"id":"wordfence:7b851fd6-1477-4370-abf9-42ae2b6f8899","source":"wordfence","cve":"CVE-2021-39200","title":"WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b851fd6-1477-4370-abf9-42ae2b6f8899?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.7","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.6","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.5","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"5.4.7"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b869c65-5d2c-45d6-b873-0676643af394","source":"wordfence","cve":"CVE-2026-87071","title":"Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b869c65-5d2c-45d6-b873-0676643af394?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:13:57Z"},{"id":"wordfence:7b86a774-a420-41a8-85ad-44fe8b32d4c2","source":"wordfence","cve":"CVE-2016-4826","title":"Welcart e-Commerce < 1.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b86a774-a420-41a8-85ad-44fe8b32d4c2?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2016-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b899c03-e5f0-485d-accf-15acfd4e1b0c","source":"wordfence","cve":"CVE-2026-16538","title":"TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b899c03-e5f0-485d-accf-15acfd4e1b0c?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.10"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:39:50Z"},{"id":"wordfence:7b8ab7f8-a10c-4acb-887a-6c5c4055d526","source":"wordfence","cve":"CVE-2026-57654","title":"Affiliates Manager <= 2.9.49 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8ab7f8-a10c-4acb-887a-6c5c4055d526?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.49","to_inclusive":true,"patched_in":"2.9.50"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:35:02Z"},{"id":"wordfence:7b8b111a-9626-41f4-8a13-51f576af0257","source":"wordfence","cve":"CVE-2025-13935","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8b111a-9626-41f4-8a13-51f576af0257?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-01-08T18:44:27Z","updated":"2026-01-09T07:22:31Z"},{"id":"wordfence:7b8c29f6-8bdb-4601-8d2f-d258ead4dd4a","source":"wordfence","cve":"CVE-2026-93771","title":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 3.5.2 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8c29f6-8bdb-4601-8d2f-d258ead4dd4a?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:48:58Z"},{"id":"wordfence:7b8ea76e-1519-4b6a-b73e-af95cc3d1fcb","source":"wordfence","cve":"CVE-2024-56018","title":"BU Section Editing <= 0.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8ea76e-1519-4b6a-b73e-af95cc3d1fcb?source=api-prod","affected":[{"type":"plugin","slug":"bu-section-editing","name":"BU Section Editing","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-04-04T19:19:37Z"},{"id":"wordfence:7b941db0-9d6d-4b89-8e04-8770499b6a9a","source":"wordfence","cve":"CVE-2022-40692","title":"Sunshine Photo Cart <= 2.9.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b941db0-9d6d-4b89-8e04-8770499b6a9a?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b971ae0-624d-416e-b2f2-92ce44e96418","source":"wordfence","cve":"CVE-2023-52204","title":"Randomize <= 1.4.3 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b971ae0-624d-416e-b2f2-92ce44e96418?source=api-prod","affected":[{"type":"plugin","slug":"randomize","name":"Randomize","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7b9aaafb-cb39-4a3b-85db-d0a8e9498d60","source":"wordfence","cve":"CVE-2024-47370","title":"Author Avatars List/Block <= 2.1.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b9aaafb-cb39-4a3b-85db-d0a8e9498d60?source=api-prod","affected":[{"type":"plugin","slug":"author-avatars","name":"Author Avatars List/Block","from":"*","from_inclusive":true,"to":"2.1.21","to_inclusive":true,"patched_in":"2.1.22"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:24:31Z"},{"id":"wordfence:7b9dea34-d500-4b52-b020-1e278151cb44","source":"wordfence","cve":"CVE-2024-54388","title":"Multiple Admin Emails <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7b9dea34-d500-4b52-b020-1e278151cb44?source=api-prod","affected":[{"type":"plugin","slug":"multiple-admin-emails","name":"Multiple Admin Emails","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:58:47Z"},{"id":"wordfence:7ba1c899-b98b-4048-8ea6-e3e315efcd47","source":"wordfence","cve":"CVE-2026-88801","title":"MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ba1c899-b98b-4048-8ea6-e3e315efcd47?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:32:46Z"},{"id":"wordfence:7ba2b270-5f02-4cd8-8a22-1723c3873d67","source":"wordfence","cve":"CVE-2024-1078","title":"Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ba2b270-5f02-4cd8-8a22-1723c3873d67?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.2.4","to_inclusive":true,"patched_in":"6.5.2.5"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T07:32:21Z"},{"id":"wordfence:7ba3b72b-67a6-4f7c-adcd-6ce39663cda5","source":"wordfence","cve":"CVE-2025-57946","title":"payOS <= 1.0.75 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ba3b72b-67a6-4f7c-adcd-6ce39663cda5?source=api-prod","affected":[{"type":"plugin","slug":"payos","name":"payOS","from":"*","from_inclusive":true,"to":"1.0.75","to_inclusive":true,"patched_in":"1.0.76"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-28T21:08:43Z"},{"id":"wordfence:7ba9b813-c6eb-47da-9fc1-1992413fc9a3","source":"wordfence","cve":"CVE-2025-49306","title":"WP Social Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ba9b813-c6eb-47da-9fc1-1992413fc9a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-widget","name":"WP Social Widget","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T21:12:14Z"},{"id":"wordfence:7baa8cca-96a5-4d6b-86d5-53cd1a4675cf","source":"wordfence","cve":"CVE-2025-2944","title":"Jeg Elementor Kit <= 2.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Button and Countdown Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7baa8cca-96a5-4d6b-86d5-53cd1a4675cf?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":true,"patched_in":"2.6.13"}],"published":"2025-05-09T16:33:39Z","updated":"2025-05-10T05:32:16Z"},{"id":"wordfence:7bab6db1-771b-4459-a8c9-d4a9d1bc9394","source":"wordfence","cve":"CVE-2025-27293","title":"Shipmozo Courier Tracking <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bab6db1-771b-4459-a8c9-d4a9d1bc9394?source=api-prod","affected":[{"type":"plugin","slug":"webparex","name":"Shipmozo Courier Tracking","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:40:40Z"},{"id":"wordfence:7bacae6f-d23d-414c-8d8a-0f1702eafd84","source":"wordfence","cve":"CVE-2013-1463","title":"WP-Table Reloaded <= 1.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bacae6f-d23d-414c-8d8a-0f1702eafd84?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-reloaded","name":"WP-Table Reloaded","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bacf821-d993-4ece-960c-ceadacd19fce","source":"wordfence","cve":"CVE-2024-13055","title":"Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bacf821-d993-4ece-960c-ceadacd19fce?source=api-prod","affected":[{"type":"plugin","slug":"dyn-business-panel","name":"Dyn Business Panel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:34:56Z"},{"id":"wordfence:7bae3acf-bbb3-4b10-b46f-8086240a2f02","source":"wordfence","cve":"","title":"Mukioplayer For WordPress <= 1.6 - SQL injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bae3acf-bbb3-4b10-b46f-8086240a2f02?source=api-prod","affected":[{"type":"plugin","slug":"mukioplayer-for-wordpress","name":"Mukioplayer For WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2013-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bb161eb-665e-4191-a891-5a7822d92c22","source":"wordfence","cve":"CVE-2026-120842","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb161eb-665e-4191-a891-5a7822d92c22?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2026-11-07T10:10:00Z","updated":"2026-11-10T19:39:25Z"},{"id":"wordfence:7bb1be6d-5af9-4b58-a641-05a913548fe7","source":"wordfence","cve":"CVE-2022-41987","title":"BadgeOS <= 3.7.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb1be6d-5af9-4b58-a641-05a913548fe7?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bb36c0f-68b3-492e-9f08-fe6228b0363f","source":"wordfence","cve":"CVE-2025-3924","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb36c0f-68b3-492e-9f08-fe6228b0363f?source=api-prod","affected":[{"type":"plugin","slug":"peprodev-ups","name":"PeproDev Ultimate Profile Solutions","from":"1.9.1","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-05-06T13:27:02Z","updated":"2025-11-05T19:48:34Z"},{"id":"wordfence:7bb377a9-fd31-4e1e-97d0-b764acba3122","source":"wordfence","cve":"CVE-2024-32442","title":"Zoho Campaigns <= 2.0.7 - Cross-Site Request Forgery via zcwc_integration_disconnect","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb377a9-fd31-4e1e-97d0-b764acba3122?source=api-prod","affected":[{"type":"plugin","slug":"zoho-campaigns","name":"Zoho Campaigns","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:07:42Z"},{"id":"wordfence:7bb5a5a2-9644-4850-a5f9-7c925af000c8","source":"wordfence","cve":"CVE-2026-4056","title":"User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb5a5a2-9644-4850-a5f9-7c925af000c8?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2026-03-23T11:24:15Z","updated":"2026-03-23T23:25:50Z"},{"id":"wordfence:7bb6caf6-5676-49cd-8577-5a41b44b00c0","source":"wordfence","cve":"CVE-2023-23800","title":"Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb6caf6-5676-49cd-8577-5a41b44b00c0?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.6","to_inclusive":true,"patched_in":"5.12.7"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bb7ee83-f75a-4f19-8595-f5cf2ee97ae0","source":"wordfence","cve":"CVE-2008-0490","title":"WP-Cal <= 0.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bb7ee83-f75a-4f19-8595-f5cf2ee97ae0?source=api-prod","affected":[{"type":"plugin","slug":"wp-cal","name":"wp-cal","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2008-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bbae2db-3b69-47ac-8fe9-934d6ecbaa63","source":"wordfence","cve":"CVE-2026-73397","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbae2db-3b69-47ac-8fe9-934d6ecbaa63?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:32:58Z"},{"id":"wordfence:7bbc181f-318e-48ea-a2f7-c668ad15c8a6","source":"wordfence","cve":"CVE-2023-25786","title":"Eyes Only: User Access Shortcode <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbc181f-318e-48ea-a2f7-c668ad15c8a6?source=api-prod","affected":[{"type":"plugin","slug":"eyes-only-user-access-shortcode","name":"Eyes Only: User Access Shortcode","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bbead7c-47b9-473f-b335-6fae4b5998d6","source":"wordfence","cve":"CVE-2026-120559","title":"Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bbead7c-47b9-473f-b335-6fae4b5998d6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-extender-for-divi-builder","name":"Contact Form Extender for Divi \u2013 Submissions DB & Extra Fields","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-08-04T18:40:24Z","updated":"2026-11-03T04:43:08Z"},{"id":"wordfence:7bc142c3-6c80-49e2-9274-a211c8cc736f","source":"wordfence","cve":"CVE-2025-64237","title":"Quick Interest Slider <= 3.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc142c3-6c80-49e2-9274-a211c8cc736f?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2025-11-29T00:00:00Z","updated":"2026-04-25T15:35:14Z"},{"id":"wordfence:7bc2d608-637c-4098-8ac9-07997df3138a","source":"wordfence","cve":"CVE-2026-8157","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce < 3.4.2 - Authenticated (Outlet Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc2d608-637c-4098-8ac9-07997df3138a?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2026-06-01T00:00:00Z","updated":"2026-07-28T16:14:10Z"},{"id":"wordfence:7bc2eebb-d232-4aef-94e5-68876bba0f93","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc2eebb-d232-4aef-94e5-68876bba0f93?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:37Z"},{"id":"wordfence:7bc33a05-d462-492e-9ea5-cf37b887cc94","source":"wordfence","cve":"CVE-2024-4560","title":"Kognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc33a05-d462-492e-9ea5-cf37b887cc94?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-05-10T16:31:08Z","updated":"2024-05-11T05:38:42Z"},{"id":"wordfence:7bc875b3-8250-4447-b921-243926849fa2","source":"wordfence","cve":"CVE-2022-45832","title":"Attorney <= 3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc875b3-8250-4447-b921-243926849fa2?source=api-prod","affected":[{"type":"theme","slug":"attorney","name":"Attorney","from":"*","from_inclusive":true,"to":"3","to_inclusive":true,"patched_in":""}],"published":"2022-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bc9627b-08ff-43cf-a528-5f1fd25cb729","source":"wordfence","cve":"CVE-2025-62907","title":"Custom Post Type Attachment <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc9627b-08ff-43cf-a528-5f1fd25cb729?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-pdf-attachment","name":"Custom Post Type Attachment","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T00:00:00Z","updated":"2025-10-29T15:04:10Z"},{"id":"wordfence:7bc97a43-6d81-401d-8090-825c6127c4c8","source":"wordfence","cve":"CVE-2026-109232","title":"Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc97a43-6d81-401d-8090-825c6127c4c8?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.9","to_inclusive":true,"patched_in":"10.31.10"}],"published":"2026-10-15T16:45:12Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:7bc9f86f-fd60-48bc-8df0-3b122facb0a0","source":"wordfence","cve":"CVE-2021-24707","title":"Learning Courses < 5.0 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc9f86f-fd60-48bc-8df0-3b122facb0a0?source=api-prod","affected":[{"type":"plugin","slug":"nd-learning","name":"Learning Courses","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2021-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bcbc6b6-ed05-4709-bf05-214418798339","source":"wordfence","cve":"CVE-2024-3987","title":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcbc6b6-ed05-4709-bf05-214418798339?source=api-prod","affected":[{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.4.2","to_inclusive":true,"patched_in":"2.8.4.3"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T02:39:28Z"},{"id":"wordfence:7bccc409-e16f-4c32-ad3b-743defd7200f","source":"wordfence","cve":"","title":"Inazo Advanced Ads Management < 1.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bccc409-e16f-4c32-ad3b-743defd7200f?source=api-prod","affected":[{"type":"plugin","slug":"inazo-advanced-ads-management","name":"Advanced ads Management by Inazo","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2016-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bcd9611-8f1e-42da-a47b-abcbe0cfd849","source":"wordfence","cve":"CVE-2025-31082","title":"News & Blog Designer Pack <= 4.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcd9611-8f1e-42da-a47b-abcbe0cfd849?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:39:26Z"},{"id":"wordfence:7bcfb35d-6d86-4481-be97-58c2c410e0cd","source":"wordfence","cve":"CVE-2025-12156","title":"Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One 2.0.7 - 2.3.4 - Missing Authorization to Authenticated (Subscriber+) Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcfb35d-6d86-4481-be97-58c2c410e0cd?source=api-prod","affected":[{"type":"plugin","slug":"ai-auto-tool","name":"Ai Auto Tool Content Writing Assistant All in One","from":"2.0.7","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-11-03T15:39:21Z","updated":"2026-09-14T16:54:16Z"},{"id":"wordfence:7bd057d5-5350-43c9-abfc-34d8f6537d2e","source":"wordfence","cve":"CVE-2024-7703","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd057d5-5350-43c9-abfc-34d8f6537d2e?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.37","to_inclusive":true,"patched_in":"4.0.38"}],"published":"2024-08-16T23:05:07Z","updated":"2024-08-17T11:15:02Z"},{"id":"wordfence:7bd3c653-249c-42b1-8af7-beac4ac3dd30","source":"wordfence","cve":"CVE-2026-42730","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd3c653-249c-42b1-8af7-beac4ac3dd30?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2026-05-24T00:00:00Z","updated":"2026-05-26T19:29:39Z"},{"id":"wordfence:7bd43980-9193-4a63-adba-720dd1b11699","source":"wordfence","cve":"CVE-2024-11868","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd43980-9193-4a63-adba-720dd1b11699?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.3","to_inclusive":true,"patched_in":"4.2.7.4"}],"published":"2024-12-09T00:00:00Z","updated":"2025-03-24T15:04:24Z"},{"id":"wordfence:7bd64a61-3bc7-4d0f-b3bc-1988e75cf749","source":"wordfence","cve":"CVE-2025-62981","title":"WP Gravity Forms Zoho CRM and Bigin <= 1.2.8 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd64a61-3bc7-4d0f-b3bc-1988e75cf749?source=api-prod","affected":[{"type":"plugin","slug":"gf-zoho","name":"WP Gravity Forms Zoho CRM and Bigin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-30T14:56:13Z"},{"id":"wordfence:7bd89bd9-4f99-4828-bacc-15d2cfe13066","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd89bd9-4f99-4828-bacc-15d2cfe13066?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.28","to_inclusive":true,"patched_in":"2.9.29"}],"published":"2015-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bd90f3b-056d-4e3f-ba35-040a02e7c258","source":"wordfence","cve":"CVE-2026-78393","title":"Link Library <= 7.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd90f3b-056d-4e3f-ba35-040a02e7c258?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-29T19:47:17Z"},{"id":"wordfence:7bd931a9-18ec-48fa-9382-d4c2d99258c5","source":"wordfence","cve":"CVE-2023-50893","title":"Impreza <= 8.17.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd931a9-18ec-48fa-9382-d4c2d99258c5?source=api-prod","affected":[{"type":"plugin","slug":"impreza","name":"Impreza \u2013 WordPress Website and WooCommerce Builder","from":"*","from_inclusive":true,"to":"8.17.4","to_inclusive":true,"patched_in":"8.18"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bdadc84-0cfb-4bec-aeb9-f59f205d269b","source":"wordfence","cve":"CVE-2025-11888","title":"ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update","severity":"low","cvss":2.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdadc84-0cfb-4bec-aeb9-f59f205d269b?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:7bde6d5c-85a1-47d4-a017-23ce69a3bb5e","source":"wordfence","cve":"CVE-2026-56040","title":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde6d5c-85a1-47d4-a017-23ce69a3bb5e?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-form","name":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:05:36Z"},{"id":"wordfence:7bde76d9-34f3-46c9-a05a-e5204b661b26","source":"wordfence","cve":"CVE-2022-3426","title":"Advanced WP Columns <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde76d9-34f3-46c9-a05a-e5204b661b26?source=api-prod","affected":[{"type":"plugin","slug":"advanced-wp-columns","name":"Advanced WP Columns","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bde915d-092a-452b-a0e0-ce5c2ce203dc","source":"wordfence","cve":"CVE-2026-1787","title":"LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion","severity":"medium","cvss":4.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bde915d-092a-452b-a0e0-ce5c2ce203dc?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-21T10:37:20Z"},{"id":"wordfence:7bdebd9c-f6fb-4de7-bd6b-5f52ef34ffb3","source":"wordfence","cve":"CVE-2020-9392","title":"Pricing Table by Supsystic <= 1.8.1 - Missing Authorization on AJAX Actions","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bdebd9c-f6fb-4de7-bd6b-5f52ef34ffb3?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7be214ef-8111-435a-9191-d4b8389972ff","source":"wordfence","cve":"CVE-2025-39523","title":"GoodBarber <= 1.0.26 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be214ef-8111-435a-9191-d4b8389972ff?source=api-prod","affected":[{"type":"plugin","slug":"goodbarber","name":"GoodBarber","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-23T17:52:29Z"},{"id":"wordfence:7be28b54-def9-46b7-bb59-58b0ae5ea674","source":"wordfence","cve":"CVE-2019-15649","title":"Insert or Embed Articulate Content into WordPress < 4.2999 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be28b54-def9-46b7-bb59-58b0ae5ea674?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.2999","to_inclusive":false,"patched_in":"4.2999"}],"published":"2019-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7be3688d-61f5-457d-a38b-0560205b2f8d","source":"wordfence","cve":"CVE-2011-5180","title":"ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast \u2013 HTML5 <= 1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be3688d-61f5-457d-a38b-0560205b2f8d?source=api-prod","affected":[{"type":"plugin","slug":"1-jquery-photo-gallery-slideshow-flash","name":"ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast \u2013 HTML5","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2011-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7be3750b-213e-42dd-9bbb-ef49ba3e16a3","source":"wordfence","cve":"CVE-2026-39567","title":"Sant\u00e9 <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be3750b-213e-42dd-9bbb-ef49ba3e16a3?source=api-prod","affected":[{"type":"theme","slug":"sante","name":"Sant\u00e9 - Organic Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:57:28Z"},{"id":"wordfence:7be669db-eb70-4cdd-9705-cb68781254e0","source":"wordfence","cve":"CVE-2025-30919","title":"Store Locator Widget <= 2025r2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be669db-eb70-4cdd-9705-cb68781254e0?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-widget","name":"Store Locator Widget","from":"*","from_inclusive":true,"to":"2025r2","to_inclusive":true,"patched_in":"2025r3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:13:26Z"},{"id":"wordfence:7be75b0a-737d-4f0d-b024-e207af4573cd","source":"wordfence","cve":"CVE-2024-1217","title":"Contact Form builder with drag & drop for WordPress \u2013 Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation","severity":"high","cvss":7.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7be75b0a-737d-4f0d-b024-e207af4573cd?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.3.41","to_inclusive":true,"patched_in":"2.3.42"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:35Z"},{"id":"wordfence:7bea239c-8af6-4492-baf7-e63de2750005","source":"wordfence","cve":"CVE-2026-62062","title":"Elementor Website Builder 4.3.0 - 4.3.1 - Cross-Site Request Forgery via REST Nonce Bypass to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bea239c-8af6-4492-baf7-e63de2750005?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"4.3.0","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-09-25T11:59:17Z","updated":"2026-09-29T19:53:24Z"},{"id":"wordfence:7becdab6-f952-4649-8cea-4efadf841619","source":"wordfence","cve":"CVE-2024-5571","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 -  Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7becdab6-f952-4649-8cea-4efadf841619?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-06-04T19:46:14Z","updated":"2024-06-05T08:33:18Z"},{"id":"wordfence:7bf04825-8f98-4f4f-ab09-a2e4caa9c2ee","source":"wordfence","cve":"CVE-2025-62934","title":"WP Business Hours <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf04825-8f98-4f4f-ab09-a2e4caa9c2ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-business-hours","name":"Plugin Name: WP Business Hours","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-29T14:56:04Z"},{"id":"wordfence:7bf1d5a8-84b7-40e3-b258-eef599b64add","source":"wordfence","cve":"CVE-2026-4657","title":"Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d5a8-84b7-40e3-b258-eef599b64add?source=api-prod","affected":[{"type":"plugin","slug":"easy-google-fonts","name":"Easy Google Fonts","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T15:19:39Z","updated":"2026-09-10T03:40:42Z"},{"id":"wordfence:7bf1d6f9-afe2-41c2-968b-20dbc474cd73","source":"wordfence","cve":"CVE-2026-92991","title":"Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d6f9-afe2-41c2-968b-20dbc474cd73?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"},{"type":"plugin","slug":"smart-admin-assistant","name":"Smart Admin Assistant","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"},{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"},{"type":"plugin","slug":"pixel-gallery","name":"Pixel Gallery Addons for Elementor","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"},{"type":"plugin","slug":"live-copy-paste","name":"Live Copy Paste for Elementor \u2013 Cross Domain Copy Paste & Page Duplicator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.9"},{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.7.14","to_inclusive":true,"patched_in":"8.7.15"},{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-08-08T00:00:00Z","updated":"2026-09-18T02:27:55Z"},{"id":"wordfence:7bf3f882-40d6-404f-a101-ff38d116d080","source":"wordfence","cve":"CVE-2026-16263","title":"Maps <= 4.9.6 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf3f882-40d6-404f-a101-ff38d116d080?source=api-prod","affected":[{"type":"plugin","slug":"wp-maps","name":"Wp Maps","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:22:55Z"},{"id":"wordfence:7bf4fe42-435b-449e-bb8c-57cef3b93471","source":"wordfence","cve":"CVE-2022-4547","title":"Conditional Payment Methods for WooCommerce <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf4fe42-435b-449e-bb8c-57cef3b93471?source=api-prod","affected":[{"type":"plugin","slug":"conditional-payment-methods-for-woocommerce","name":"Conditional Payment Methods for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bf5bf4f-47c7-41c8-b1e5-33874d688e07","source":"wordfence","cve":"CVE-2025-60052","title":"W&D <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf5bf4f-47c7-41c8-b1e5-33874d688e07?source=api-prod","affected":[{"type":"theme","slug":"wd","name":"W&D - Windows & Doors Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:39:16Z"},{"id":"wordfence:7bf68565-ea30-4caf-8323-b0b88561e89f","source":"wordfence","cve":"CVE-2024-9386","title":"Exclusive Divi \u2013 Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf68565-ea30-4caf-8323-b0b88561e89f?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-divi","name":"Exclusive Divi \u2013 Divi Preloader, Modules for Divi & Extra Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:15:56Z","updated":"2024-11-16T03:20:48Z"},{"id":"wordfence:7bfabeb4-c57d-412a-b27b-a6387d30081f","source":"wordfence","cve":"CVE-2023-25446","title":"HappyFiles Pro <= 1.8.1 - Missing Authorization to Arbitrary File Deletion","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bfabeb4-c57d-412a-b27b-a6387d30081f?source=api-prod","affected":[{"type":"plugin","slug":"happyfiles-pro","name":"HappyFiles Pro","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bfd4e4c-63c2-4442-b91a-ca940a31c3be","source":"wordfence","cve":"CVE-2015-1393","title":"Photo Gallery by 10Web <= 1.2.10 - Authenticated SQL Injection via asc_or_desc Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bfd4e4c-63c2-4442-b91a-ca940a31c3be?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":false,"patched_in":"1.2.11"}],"published":"2015-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7bfd8c31-4f89-4f09-8d46-11340c4eea1d","source":"wordfence","cve":"CVE-2021-47979","title":"Backup and Restore plugin \u2013 WordPress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bfd8c31-4f89-4f09-8d46-11340c4eea1d?source=api-prod","affected":[{"type":"plugin","slug":"backup-and-restore-for-wp","name":"Backup and Restore plugin \u2013 WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-16T00:00:00Z","updated":"2026-07-29T20:59:56Z"},{"id":"wordfence:7bfe87cf-9883-4f8f-a0f5-23bbc7bb9b7c","source":"wordfence","cve":"CVE-2024-9988","title":"Crypto <= 2.19 - Authentication Bypass via register","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bfe87cf-9883-4f8f-a0f5-23bbc7bb9b7c?source=api-prod","affected":[{"type":"plugin","slug":"crypto","name":"Crypto","from":"*","from_inclusive":true,"to":"2.19","to_inclusive":true,"patched_in":"2.20"}],"published":"2024-10-28T00:00:00Z","updated":"2024-11-25T17:52:35Z"},{"id":"wordfence:7bff8172-b879-40b0-a229-a54787baa38a","source":"wordfence","cve":"CVE-2024-1776","title":"Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bff8172-b879-40b0-a229-a54787baa38a?source=api-prod","affected":[{"type":"plugin","slug":"admin-side-data-storage-for-contact-form-7","name":"Admin side data storage for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T06:48:17Z"},{"id":"wordfence:7bffb16d-38dc-49b8-96bd-c13923069d9c","source":"wordfence","cve":"CVE-2026-6447","title":"Call for Price for WooCommerce <= 4.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7bffb16d-38dc-49b8-96bd-c13923069d9c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-call-for-price","name":"Call for Price for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T05:29:33Z"},{"id":"wordfence:7c030b62-1bee-4534-9e93-41e726ae43a6","source":"wordfence","cve":"CVE-2025-66057","title":"Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c030b62-1bee-4534-9e93-41e726ae43a6?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-01T16:57:34Z"},{"id":"wordfence:7c043945-d327-4f26-98b4-99ac5b4761f1","source":"wordfence","cve":"CVE-2023-50855","title":"Pre* Party Resource Hints < 1.8.19 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c043945-d327-4f26-98b4-99ac5b4761f1?source=api-prod","affected":[{"type":"plugin","slug":"pre-party-browser-hints","name":"Pre* Party Resource Hints","from":"*","from_inclusive":true,"to":"1.8.19","to_inclusive":false,"patched_in":"1.8.19"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-29T14:03:38Z"},{"id":"wordfence:7c07098d-8d7c-4a7f-b58c-b0daf2f56e1e","source":"wordfence","cve":"CVE-2026-27365","title":"Issues and Series for Newspapers, Magazines, Publishers, Writers <= 2.17.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c07098d-8d7c-4a7f-b58c-b0daf2f56e1e?source=api-prod","affected":[{"type":"plugin","slug":"organize-series","name":"Issues and Series for Newspapers, Magazines, Publishers, Writers","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.17.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:29:51Z"},{"id":"wordfence:7c08260c-872d-4607-a87a-feb85cde2d2e","source":"wordfence","cve":"CVE-2025-47476","title":"Cost Calculator for Elementor <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c08260c-872d-4607-a87a-feb85cde2d2e?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-for-elementor","name":"Cost Calculator for Elementor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:12:47Z"},{"id":"wordfence:7c0a6e1a-1cf1-438f-ba6b-63202c392b3c","source":"wordfence","cve":"CVE-2025-23622","title":"CBX Accounting & Bookkeeping <= 1.3.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0a6e1a-1cf1-438f-ba6b-63202c392b3c?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpsimpleaccounting","name":"CBX Accounting & Bookkeeping","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:19:10Z"},{"id":"wordfence:7c0a75f2-be2e-4764-8a1d-c916c8132b06","source":"wordfence","cve":"CVE-2026-115251","title":"Duplicator <= 1.5.17 - Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0a75f2-be2e-4764-8a1d-c916c8132b06?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:09:49Z"},{"id":"wordfence:7c0d1fdb-b5a2-4a6b-a537-cacbb356dae4","source":"wordfence","cve":"CVE-2026-45435","title":"WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0d1fdb-b5a2-4a6b-a537-cacbb356dae4?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.3.1"}],"published":"2026-05-19T00:00:00Z","updated":"2026-05-26T19:32:48Z"},{"id":"wordfence:7c0ed22d-6102-47d6-9afb-fed8515ea74c","source":"wordfence","cve":"CVE-2025-12415","title":"MapMap <= 1.1 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c0ed22d-6102-47d6-9afb-fed8515ea74c?source=api-prod","affected":[{"type":"plugin","slug":"mapmap","name":"MapMap","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:33:46Z","updated":"2025-11-04T04:27:19Z"},{"id":"wordfence:7c10be28-43ff-4b43-8186-6ad9a487321e","source":"wordfence","cve":"CVE-2024-3677","title":"Ultimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c10be28-43ff-4b43-8186-6ad9a487321e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-410","name":"Ultimate 410 Gone Status Code","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-04-22T00:00:00Z","updated":"2026-01-16T13:27:14Z"},{"id":"wordfence:7c1372bd-821d-439c-9b11-dfa5f08dd0dd","source":"wordfence","cve":"CVE-2024-13448","title":"ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1372bd-821d-439c-9b11-dfa5f08dd0dd?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.32.3","to_inclusive":true,"patched_in":"2.34.0"}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-28T06:38:42Z"},{"id":"wordfence:7c1388d2-ba60-4738-94d6-31123ef64ef8","source":"wordfence","cve":"CVE-2025-48336","title":"Course Builder - Online Course WordPress Theme < 3.6.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1388d2-ba60-4738-94d6-31123ef64ef8?source=api-prod","affected":[{"type":"theme","slug":"course-builder","name":"Course Builder - Online Course WordPress Theme","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":false,"patched_in":"3.6.6"}],"published":"2025-05-29T00:00:00Z","updated":"2025-05-30T20:34:44Z"},{"id":"wordfence:7c1418be-6d87-4056-a75f-431a26bd9d88","source":"wordfence","cve":"CVE-2025-15695","title":"Translate WordPress with GTranslate < 3.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1418be-6d87-4056-a75f-431a26bd9d88?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":false,"patched_in":"3.0.10"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:34:07Z"},{"id":"wordfence:7c1811f7-0fb4-4f50-93ac-6abd9e6a1d66","source":"wordfence","cve":"CVE-2023-49770","title":"Smart External Link Click Monitor [Link Log] <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1811f7-0fb4-4f50-93ac-6abd9e6a1d66?source=api-prod","affected":[{"type":"plugin","slug":"link-log","name":"Smart External Link Click Monitor [Link Log]","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c1c24cc-9388-4d91-8dc6-c67d3420cc94","source":"wordfence","cve":"CVE-2020-36853","title":"10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1c24cc-9388-4d91-8dc6-c67d3420cc94?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.64","to_inclusive":false,"patched_in":"1.0.64"}],"published":"2020-02-27T00:00:00Z","updated":"2025-10-18T03:33:24Z"},{"id":"wordfence:7c1e005f-c0f1-4dff-928b-18919f117048","source":"wordfence","cve":"","title":"TK Google Fonts GDPR Compliant <= 2.2.7 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1e005f-c0f1-4dff-928b-18919f117048?source=api-prod","affected":[{"type":"plugin","slug":"tk-google-fonts","name":"TK Google Fonts","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2023-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c1e63df-d326-40bf-a428-fdb11150e8d1","source":"wordfence","cve":"CVE-2022-3762","title":"Booster Elite for WooCommerce < 1.1.7 - Authenticated (Admin/Shop Manager+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1e63df-d326-40bf-a428-fdb11150e8d1?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c1f3979-5688-4958-8297-6e332f98a00f","source":"wordfence","cve":"CVE-2026-107434","title":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.9 - Authenticated (Subscriber+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1f3979-5688-4958-8297-6e332f98a00f?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:39:56Z"},{"id":"wordfence:7c22bf07-753b-4874-893a-952105dc8107","source":"wordfence","cve":"CVE-2025-46230","title":"Popup Builder <= 1.1.35 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c22bf07-753b-4874-893a-952105dc8107?source=api-prod","affected":[{"type":"plugin","slug":"easy-notify-lite","name":"Easy Notify Lite","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.37"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:27:39Z"},{"id":"wordfence:7c23bd29-ba02-4c90-a631-5ce6294d7760","source":"wordfence","cve":"CVE-2024-5628","title":"Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c23bd29-ba02-4c90-a631-5ce6294d7760?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.9","to_inclusive":true,"patched_in":"3.11.10"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T05:31:03Z"},{"id":"wordfence:7c2482cc-1717-4fae-b45b-3a1a1ce95fdc","source":"wordfence","cve":"CVE-2026-42657","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c2482cc-1717-4fae-b45b-3a1a1ce95fdc?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.7","to_inclusive":true,"patched_in":"29.0.0"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T14:05:28Z"},{"id":"wordfence:7c248e3d-b6b2-4064-9006-3ddd85079308","source":"wordfence","cve":"CVE-2025-23898","title":"Apply with LinkedIn buttons <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c248e3d-b6b2-4064-9006-3ddd85079308?source=api-prod","affected":[{"type":"plugin","slug":"apply-with-linkedin-buttons","name":"Apply with LinkedIn buttons","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:37:50Z"},{"id":"wordfence:7c28869c-c880-4322-9f17-09495a08576e","source":"wordfence","cve":"CVE-2026-92229","title":"Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c28869c-c880-4322-9f17-09495a08576e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2","to_inclusive":true,"patched_in":"1.57.3"}],"published":"2026-09-18T13:55:04Z","updated":"2026-09-19T02:27:10Z"},{"id":"wordfence:7c2aba47-a1bf-448d-b5fb-9c9c86e43c98","source":"wordfence","cve":"CVE-2026-107712","title":"WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c2aba47-a1bf-448d-b5fb-9c9c86e43c98?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.1","to_inclusive":true,"patched_in":"2.1.0.2"}],"published":"2026-10-09T17:48:46Z","updated":"2026-10-10T06:40:13Z"},{"id":"wordfence:7c2c52e4-a1a5-490c-8245-c659f231df4f","source":"wordfence","cve":"CVE-2026-97235","title":"ThemeREX Addons < 2.45.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c2c52e4-a1a5-490c-8245-c659f231df4f?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":false,"patched_in":"2.45.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T17:51:48Z"},{"id":"wordfence:7c2f0a6f-41cd-4dd2-a814-ad057e4e9fc0","source":"wordfence","cve":"CVE-2025-39516","title":"Author WIP Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c2f0a6f-41cd-4dd2-a814-ad057e4e9fc0?source=api-prod","affected":[{"type":"plugin","slug":"author-work-in-progress-bar","name":"Author WIP Progress Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:14:19Z"},{"id":"wordfence:7c307d66-11f9-4593-9ada-252d034fd421","source":"wordfence","cve":"","title":"Quotes and Tips by BestWebSoft < 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c307d66-11f9-4593-9ada-252d034fd421?source=api-prod","affected":[{"type":"plugin","slug":"quotes-and-tips","name":"Quotes and Tips by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c312478-0d6e-400b-81c2-172c2c5798ff","source":"wordfence","cve":"","title":"jQuery HTML5 File Upload <= 3.0 - Unauthenticated Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c312478-0d6e-400b-81c2-172c2c5798ff?source=api-prod","affected":[{"type":"plugin","slug":"jquery-html5-file-upload","name":"JQuery Html5 File Upload","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c31d9b3-38b1-49a1-b361-ffe97e02bff0","source":"wordfence","cve":"CVE-2024-9290","title":"Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c31d9b3-38b1-49a1-b361-ffe97e02bff0?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T09:27:29Z"},{"id":"wordfence:7c32d967-85b9-4c93-a948-0126efb78f39","source":"wordfence","cve":"","title":"WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c32d967-85b9-4c93-a948-0126efb78f39?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.0","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.1","from_inclusive":true,"to":"4.1.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.2","from_inclusive":true,"to":"4.2.4","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.3","from_inclusive":true,"to":"4.3.5","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.6","from_inclusive":true,"to":"4.6.4","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.7","from_inclusive":true,"to":"4.7.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.8","from_inclusive":true,"to":"4.8.2","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"4.9","from_inclusive":true,"to":"4.9.4","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.0","from_inclusive":true,"to":"5.0.2","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.4","from_inclusive":true,"to":"5.4.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.5","from_inclusive":true,"to":"5.5.3","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"5.6","from_inclusive":true,"to":"5.6.1","to_inclusive":false,"patched_in":"4.0.3"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.0","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.1","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.2","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.3","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.4","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.5","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.6","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.7","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.8","from_inclusive":true,"to":"1.8.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"1.9","from_inclusive":true,"to":"1.9.1","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.0","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.1","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.2","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.3","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.4","from_inclusive":true,"to":"2.4.5","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.5","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"woocommerce-admin","name":"WooCommerce Admin","from":"2.6","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2022-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c336530-09b2-4ead-923f-f1a6266e3e8e","source":"wordfence","cve":"CVE-2024-6455","title":"ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-07-18T08:02:02Z","updated":"2024-08-08T17:59:45Z"},{"id":"wordfence:7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e","source":"wordfence","cve":"CVE-2025-0856","title":"PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e?source=api-prod","affected":[{"type":"plugin","slug":"pgs-core","name":"PGS Core","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2025-05-06T00:00:00Z","updated":"2025-05-06T22:22:31Z"},{"id":"wordfence:7c35e20f-bfb0-4de0-9f8f-6e04fbbe138a","source":"wordfence","cve":"CVE-2024-13687","title":"Team Builder \u2013 Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c35e20f-bfb0-4de0-9f8f-6e04fbbe138a?source=api-prod","affected":[{"type":"plugin","slug":"team-display","name":"Team Builder \u2013 Meet the Team","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:39:20Z","updated":"2025-02-18T04:21:18Z"},{"id":"wordfence:7c3726fa-e3ee-4c5d-a727-b33d0d077ef1","source":"wordfence","cve":"CVE-2016-1000139","title":"Infusionsoft Gravity Forms Add-on <= 1.5.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3726fa-e3ee-4c5d-a727-b33d0d077ef1?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft","name":"Infusionsoft Gravity Forms Add-on","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":false,"patched_in":"1.5.12"}],"published":"2016-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c387a20-47dd-42d9-bf22-a28c613c5bde","source":"wordfence","cve":"CVE-2022-3856","title":"Comic Book Management System < 2.2.0 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c387a20-47dd-42d9-bf22-a28c613c5bde?source=api-prod","affected":[{"type":"plugin","slug":"comicbookmanagementsystemweeklypicks","name":"Comic Book Management System","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c3ae610-44ef-4354-b085-00c00a486dc9","source":"wordfence","cve":"","title":"Login with Cognito <= 1.4.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3ae610-44ef-4354-b085-00c00a486dc9?source=api-prod","affected":[{"type":"plugin","slug":"login-with-cognito","name":"Login with Cognito","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c3b57c3-8689-4040-8eab-a5ed6585d38f","source":"wordfence","cve":"CVE-2026-97194","title":"Secure Custom Fields <= 6.9.7 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3b57c3-8689-4040-8eab-a5ed6585d38f?source=api-prod","affected":[{"type":"plugin","slug":"secure-custom-fields","name":"Secure Custom Fields","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:34:06Z"},{"id":"wordfence:7c3f7108-eb32-425a-a705-4f032e7da6b0","source":"wordfence","cve":"CVE-2026-1294","title":"All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3f7108-eb32-425a-a705-4f032e7da6b0?source=api-prod","affected":[{"type":"plugin","slug":"image-viewer","name":"All In One Image Viewer \u2013 Zoom, Magnify, Maps & Rotation","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-02-04T20:41:56Z","updated":"2026-02-05T09:13:45Z"},{"id":"wordfence:7c439193-cc7d-4e40-8585-87cb2c40fe9b","source":"wordfence","cve":"CVE-2025-11856","title":"Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c439193-cc7d-4e40-8585-87cb2c40fe9b?source=api-prod","affected":[{"type":"plugin","slug":"eventbee-ticketing-widget","name":"Eventbee Ticketing Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:55:21Z","updated":"2025-11-11T03:30:42Z"},{"id":"wordfence:7c44efe0-bdc0-42e0-9bdd-cf25bff1d2d5","source":"wordfence","cve":"CVE-2023-50896","title":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c44efe0-bdc0-42e0-9bdd-cf25bff1d2d5?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.17","to_inclusive":true,"patched_in":"1.6.18"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c458034-9c44-4b46-8845-4c05bea043a0","source":"wordfence","cve":"CVE-2026-119980","title":"UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c458034-9c44-4b46-8845-4c05bea043a0?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.78","to_inclusive":true,"patched_in":"1.2.79"}],"published":"2026-10-30T17:58:07Z","updated":"2026-10-31T06:44:20Z"},{"id":"wordfence:7c4787ea-dc40-4eeb-a827-1fddb4ad1055","source":"wordfence","cve":"CVE-2024-54301","title":"FormFacade <= 1.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4787ea-dc40-4eeb-a827-1fddb4ad1055?source=api-prod","affected":[{"type":"plugin","slug":"formfacade","name":"FormFacade \u2013 Embed Google Forms in your website","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:51:05Z"},{"id":"wordfence:7c4797a6-43c1-4183-95ec-4e150a1d774a","source":"wordfence","cve":"","title":"Google Analytics Dashboard <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4797a6-43c1-4183-95ec-4e150a1d774a?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard","name":"google-analytics-dashboard","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c48a2dc-65d8-4fc5-9ee2-70c6a78611e6","source":"wordfence","cve":"CVE-2024-55976","title":"Critical Site Intel <= 1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c48a2dc-65d8-4fc5-9ee2-70c6a78611e6?source=api-prod","affected":[{"type":"plugin","slug":"critical-site-intel-stats","name":"This is a Subversion repository; use the &#039;svnadmin&#039; tool to examine","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:00:54Z"},{"id":"wordfence:7c492357-3293-49cf-9e4a-3e144b58b6f7","source":"wordfence","cve":"CVE-2026-111106","title":"Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c492357-3293-49cf-9e4a-3e144b58b6f7?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.31.4","to_inclusive":true,"patched_in":"1.31.5"}],"published":"2026-10-15T15:56:06Z","updated":"2026-10-16T04:27:00Z"},{"id":"wordfence:7c4c6b46-0858-46c0-8f33-47d2429d848c","source":"wordfence","cve":"CVE-2026-12083","title":"Admin and Site Enhancements <= 8.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4c6b46-0858-46c0-8f33-47d2429d848c?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"},{"type":"plugin","slug":"admin-site-enhancements-pro","name":"Admin and Site Enhancements (ASE) Pro","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T11:58:12Z"},{"id":"wordfence:7c4ceb2e-c718-43e2-bb7b-ab0404271134","source":"wordfence","cve":"","title":"Passwords Manager <= 1.4.4 - Cross-Site Scripting via pwdms_csv_category parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4ceb2e-c718-43e2-bb7b-ab0404271134?source=api-prod","affected":[{"type":"plugin","slug":"passwords-manager","name":"Passwords Manager","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2022-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c4f9958-0e5a-483c-926e-ceaee00ffa45","source":"wordfence","cve":"CVE-2021-24576","title":"Easy Accordion <= 2.0.21 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4f9958-0e5a-483c-926e-ceaee00ffa45?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-free","name":"Easy Accordion \u2013 AI-Powered FAQ & Accordion Blocks, Product FAQ","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2021-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c4fc322-1f62-48e3-8177-4894c947624b","source":"wordfence","cve":"CVE-2023-4819","title":"Shared Files <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c4fc322-1f62-48e3-8177-4894c947624b?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c500c5b-04b9-47d7-9296-dd5378cd5ab0","source":"wordfence","cve":"CVE-2021-24252","title":"Event Banner <= 1.3 - Cross-Site Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c500c5b-04b9-47d7-9296-dd5378cd5ab0?source=api-prod","affected":[{"type":"plugin","slug":"free-event-banner","name":"Event Banner","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2021-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c5092fa-a2ea-4a84-8ebd-273faf6c8707","source":"wordfence","cve":"CVE-2012-1125","title":"Kish Guest Posting <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5092fa-a2ea-4a84-8ebd-273faf6c8707?source=api-prod","affected":[{"type":"plugin","slug":"kish-guest-posting","name":"Kish Guest Posting","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2012-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c5101a1-fbf6-4311-965c-ac40b8681707","source":"wordfence","cve":"CVE-2026-123661","title":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content 4.16.13 - 4.17.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5101a1-fbf6-4311-965c-ac40b8681707?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"4.16.13","from_inclusive":true,"to":"4.17.3","to_inclusive":true,"patched_in":"4.17.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:28Z"},{"id":"wordfence:7c5248cc-6676-46cb-846b-a2c246425a54","source":"wordfence","cve":"CVE-2026-86447","title":"LearnPress <= 4.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5248cc-6676-46cb-846b-a2c246425a54?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:57:09Z"},{"id":"wordfence:7c54588f-6436-406f-93cb-b08965586d11","source":"wordfence","cve":"CVE-2024-12477","title":"Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c54588f-6436-406f-93cb-b08965586d11?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.11","to_inclusive":true,"patched_in":"3.11.12"}],"published":"2025-01-22T08:24:14Z","updated":"2025-01-22T21:21:53Z"},{"id":"wordfence:7c562a8f-e2c7-4452-ae15-fab369933712","source":"wordfence","cve":"CVE-2025-23695","title":"CtyGrid Hyp3rL0cal Search WordPress Plugin <= 0.1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c562a8f-e2c7-4452-ae15-fab369933712?source=api-prod","affected":[{"type":"plugin","slug":"hyp3rl0cal-city-search","name":"CtyGrid Hyp3rL0cal Search WordPress Plugin","from":"*","from_inclusive":true,"to":"0.1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:07:45Z"},{"id":"wordfence:7c5ba00f-f5ec-42d9-8f30-9ce30a94fb0d","source":"wordfence","cve":"CVE-2025-24584","title":"Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5ba00f-f5ec-42d9-8f30-9ce30a94fb0d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-12-19T00:00:00Z","updated":"2025-02-19T16:23:41Z"},{"id":"wordfence:7c5cfe67-b1b7-4149-a425-9b9f252f2a36","source":"wordfence","cve":"CVE-2025-59550","title":"Xcare < 6.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5cfe67-b1b7-4149-a425-9b9f252f2a36?source=api-prod","affected":[{"type":"theme","slug":"xcare","name":"Xcare - Medical and Health Care WordPress Theme","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":false,"patched_in":"6.5"}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-29T15:25:21Z"},{"id":"wordfence:7c5d7818-e548-4d8f-b847-396d528b58cd","source":"wordfence","cve":"CVE-2025-15470","title":"Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5d7818-e548-4d8f-b847-396d528b58cd?source=api-prod","affected":[{"type":"theme","slug":"eleganzo","name":"Eleganzo","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-14T11:01:50Z","updated":"2026-04-14T23:26:06Z"},{"id":"wordfence:7c5e400a-e578-4ec4-98b3-01bf45aac542","source":"wordfence","cve":"CVE-2025-53321","title":"Raise The Money <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5e400a-e578-4ec4-98b3-01bf45aac542?source=api-prod","affected":[{"type":"plugin","slug":"raise-the-money","name":"Raise The Money","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:39:33Z"},{"id":"wordfence:7c632452-8b13-4f78-aa8a-3c92bef5907f","source":"wordfence","cve":"CVE-2024-9584","title":"Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c632452-8b13-4f78-aa8a-3c92bef5907f?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images","from":"*","from_inclusive":true,"to":"6.0.20","to_inclusive":true,"patched_in":"6.0.21"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T17:32:19Z"},{"id":"wordfence:7c633419-e231-437f-a2af-6f564cffc2df","source":"wordfence","cve":"CVE-2025-3106","title":"LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c633419-e231-437f-a2af-6f564cffc2df?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-04-17T20:56:28Z","updated":"2025-04-18T09:21:52Z"},{"id":"wordfence:7c63bb98-5bfb-471f-a612-cc7634cd6dc5","source":"wordfence","cve":"CVE-2025-14076","title":"iXML \u2013 Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c63bb98-5bfb-471f-a612-cc7634cd6dc5?source=api-prod","affected":[{"type":"plugin","slug":"ixml","name":"iXML \u2013 Google XML sitemap generator","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:56:28Z","updated":"2026-02-19T04:36:16Z"},{"id":"wordfence:7c666589-6a2b-4edd-bc28-1d609217584e","source":"wordfence","cve":"CVE-2025-49442","title":"Simple Nested Menu <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c666589-6a2b-4edd-bc28-1d609217584e?source=api-prod","affected":[{"type":"plugin","slug":"simple-nested-menu","name":"Simple Nested Menu","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:19:14Z"},{"id":"wordfence:7c66894a-8d0f-4946-ae4d-bffd35f3ffb7","source":"wordfence","cve":"CVE-2023-1342","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ucss_connect'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c66894a-8d0f-4946-ae4d-bffd35f3ffb7?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c66eadc-a6a1-4378-9bcc-a801f10208e2","source":"wordfence","cve":"CVE-2026-115612","title":"Affiliate Program Suite \u2014 SliceWP Affiliates <= 1.2.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c66eadc-a6a1-4378-9bcc-a801f10208e2?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2026-10-26T12:30:49Z","updated":"2026-11-03T19:28:17Z"},{"id":"wordfence:7c66fdab-d067-4043-a602-9bbe94962a00","source":"wordfence","cve":"CVE-2024-4096","title":"Responsive Tabs <= 4.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c66fdab-d067-4043-a602-9bbe94962a00?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs","name":"Responsive Tabs","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-23T14:00:31Z"},{"id":"wordfence:7c67d2f8-d918-42ef-a301-27eed7fa41b2","source":"wordfence","cve":"CVE-2024-6208","title":"Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c67d2f8-d918-42ef-a301-27eed7fa41b2?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.97","to_inclusive":true,"patched_in":"3.2.98"}],"published":"2024-07-30T00:00:00Z","updated":"2024-07-31T12:43:17Z"},{"id":"wordfence:7c69d0ec-d533-416b-9bc1-a3d5a871469a","source":"wordfence","cve":"CVE-2026-39493","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c69d0ec-d533-416b-9bc1-a3d5a871469a?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.27","to_inclusive":true,"patched_in":"1.6.9.29"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T21:10:30Z"},{"id":"wordfence:7c6aef41-e4f9-4494-a5fd-47f55973d1d9","source":"wordfence","cve":"CVE-2021-24779","title":"WP Debugging <= 2.10.2 - Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6aef41-e4f9-4494-a5fd-47f55973d1d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-debugging","name":"WP Debugging","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c6b7dca-dd82-45b4-b9e2-0b44201396e9","source":"wordfence","cve":"","title":"GamiPress <= 2.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6b7dca-dd82-45b4-b9e2-0b44201396e9?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c6be4e1-1b24-4a95-a6fd-3196f47796a6","source":"wordfence","cve":"","title":"TDO Mini Forms <= 0.13.9 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6be4e1-1b24-4a95-a6fd-3196f47796a6?source=api-prod","affected":[{"type":"plugin","slug":"tdo-mini-forms","name":"TDO Mini Forms","from":"*","from_inclusive":true,"to":"0.13.9","to_inclusive":true,"patched_in":""}],"published":"2012-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c6be7f2-5526-4fba-9fe0-003b8460c926","source":"wordfence","cve":"CVE-2024-1566","title":"Redirects <= 1.2.1 - Missing Authorization via save","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6be7f2-5526-4fba-9fe0-003b8460c926?source=api-prod","affected":[{"type":"plugin","slug":"redirects","name":"Redirects","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:10Z"},{"id":"wordfence:7c6c51f1-1a36-494a-abf4-b5f8db030ca6","source":"wordfence","cve":"CVE-2025-49993","title":"Cookie-Script.com <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6c51f1-1a36-494a-abf4-b5f8db030ca6?source=api-prod","affected":[{"type":"plugin","slug":"cookie-script-com","name":"Cookie-Script.com","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-01T13:48:22Z"},{"id":"wordfence:7c6db7a5-712e-4c6b-ac29-813f6e1b78d9","source":"wordfence","cve":"CVE-2024-51678","title":"Elo Rating Shortcode <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6db7a5-712e-4c6b-ac29-813f6e1b78d9?source=api-prod","affected":[{"type":"plugin","slug":"elo-rating-shortcode","name":"Elo Rating Shortcode","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:39:27Z"},{"id":"wordfence:7c6e233f-c612-4625-8097-0637e976190d","source":"wordfence","cve":"","title":"User Access Manager <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6e233f-c612-4625-8097-0637e976190d?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2017-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c6ea33f-ee43-4df8-9633-60303b68b859","source":"wordfence","cve":"","title":"AdPlugg WordPress Ad Plugin < 1.1.34 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6ea33f-ee43-4df8-9633-60303b68b859?source=api-prod","affected":[{"type":"plugin","slug":"adplugg","name":"AdPlugg WordPress Ad Plugin","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":false,"patched_in":"1.1.34"}],"published":"2015-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c6fe986-df68-4a62-9a43-5632c622b5fc","source":"wordfence","cve":"CVE-2021-24259","title":"Elementor Addon Elements <= 1.11.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c6fe986-df68-4a62-9a43-5632c622b5fc?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":false,"patched_in":"1.11.2"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c7115f9-a0b0-43ed-9153-a9fe87176e4e","source":"wordfence","cve":"CVE-2013-10025","title":"WordPress Exit Strategy <= 1.55 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c7115f9-a0b0-43ed-9153-a9fe87176e4e?source=api-prod","affected":[{"type":"plugin","slug":"exit-strategy","name":"WordPress Exit Strategy","from":"*","from_inclusive":true,"to":"1.55","to_inclusive":true,"patched_in":"1.59"}],"published":"2013-05-28T00:00:00Z","updated":"2024-02-07T14:42:00Z"},{"id":"wordfence:7c723848-d1b4-4aa8-a223-40207ef18e3d","source":"wordfence","cve":"CVE-2026-96833","title":"Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c723848-d1b4-4aa8-a223-40207ef18e3d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.51","to_inclusive":true,"patched_in":"3.5.52"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:51:48Z"},{"id":"wordfence:7c734aa9-ee9e-4605-a4b8-5075ce4b941f","source":"wordfence","cve":"CVE-2023-39309","title":"Fusion Builder <= 3.11.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c734aa9-ee9e-4605-a4b8-5075ce4b941f?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c77259a-cdf3-4fa0-b468-9e98645293fe","source":"wordfence","cve":"CVE-2023-36689","title":"WPFactory Helper <= 1.5.2 - Reflected Cross-Site Scripting via item_slug","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c77259a-cdf3-4fa0-b468-9e98645293fe?source=api-prod","affected":[{"type":"plugin","slug":"wpcodefactory-helper","name":"WPFactory Helper","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c781c8a-1ffb-438b-bf78-9d386fbd16eb","source":"wordfence","cve":"CVE-2024-11805","title":"Quick License Manager \u2013 WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c781c8a-1ffb-438b-bf78-9d386fbd16eb?source=api-prod","affected":[{"type":"plugin","slug":"quick-license-manager","name":"Quick License Manager \u2013 WooCommerce Plugin","from":"*","from_inclusive":true,"to":"2.4.17","to_inclusive":true,"patched_in":"2.4.18"}],"published":"2024-12-02T19:19:24Z","updated":"2024-12-03T07:35:00Z"},{"id":"wordfence:7c7ad744-949c-4a27-81c9-b2badbaa1eec","source":"wordfence","cve":"CVE-2025-49883","title":"Greenmart <= 4.2.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c7ad744-949c-4a27-81c9-b2badbaa1eec?source=api-prod","affected":[{"type":"theme","slug":"greenmart","name":"GreenMart \u2013 Organic & Food WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:47:47Z"},{"id":"wordfence:7c7f6ef2-6c50-4739-8844-0db7d9ffe7f7","source":"wordfence","cve":"","title":"MC Woocommerce Wishlist <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c7f6ef2-6c50-4739-8844-0db7d9ffe7f7?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c80c04a-5637-45f3-b875-5cc6c56ba40d","source":"wordfence","cve":"CVE-2025-23544","title":"StatPressCN <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c80c04a-5637-45f3-b875-5cc6c56ba40d?source=api-prod","affected":[{"type":"plugin","slug":"statpresscn","name":"StatPressCN","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:42:19Z"},{"id":"wordfence:7c813654-de1f-40e8-a970-c61850adf933","source":"wordfence","cve":"CVE-2026-82225","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Authentication Bypass","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c813654-de1f-40e8-a970-c61850adf933?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.8","to_inclusive":true,"patched_in":"6.0.9.9"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:03:29Z"},{"id":"wordfence:7c82577a-e7ee-4549-8d0f-bed09effa035","source":"wordfence","cve":"CVE-2026-1870","title":"Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c82577a-e7ee-4549-8d0f-bed09effa035?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-03-14T00:34:04Z","updated":"2026-03-14T13:26:22Z"},{"id":"wordfence:7c84b432-4d33-47ad-8057-0bc831929879","source":"wordfence","cve":"CVE-2022-27845","title":"Plausible Analytics <= 1.2.2 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c84b432-4d33-47ad-8057-0bc831929879?source=api-prod","affected":[{"type":"plugin","slug":"plausible-analytics","name":"Plausible Analytics","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2022-04-07T10:58:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c8516ba-9bc9-40ae-989c-6ca23937282d","source":"wordfence","cve":"CVE-2026-108494","title":"Chained Quiz <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c8516ba-9bc9-40ae-989c-6ca23937282d?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-10-13T07:03:27Z","updated":"2026-11-03T19:21:22Z"},{"id":"wordfence:7c8529fc-9995-45c5-ad21-c960eb796fb3","source":"wordfence","cve":"CVE-2022-1845","title":"WP Post Styling <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c8529fc-9995-45c5-ad21-c960eb796fb3?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-styling","name":"WP Post Styling","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c89eb8e-bbd1-4c26-84ed-74456a6157a1","source":"wordfence","cve":"CVE-2025-58660","title":"Oshine Core <= 1.5.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c89eb8e-bbd1-4c26-84ed-74456a6157a1?source=api-prod","affected":[{"type":"plugin","slug":"oshine-core","name":"Oshine Core","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:47:58Z"},{"id":"wordfence:7c8b22aa-e7e3-4e20-8e4b-fa807d1d2963","source":"wordfence","cve":"CVE-2026-28165","title":"Digits: WordPress Mobile Number Signup and Login <= 9.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c8b22aa-e7e3-4e20-8e4b-fa807d1d2963?source=api-prod","affected":[{"type":"plugin","slug":"digits","name":"Digits: WordPress Mobile Number Signup and Login","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-17T23:58:02Z"},{"id":"wordfence:7c8faa22-ff1f-4267-b690-a2c51c4807f5","source":"wordfence","cve":"CVE-2024-31926","title":"Advanced Cron Manager \u2013 debug & control  <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c8faa22-ff1f-4267-b690-a2c51c4807f5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cron-manager","name":"Advanced Cron Manager \u2013 debug & control","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:43:44Z"},{"id":"wordfence:7c911773-79f5-4d91-b0f9-a05bc17516b2","source":"wordfence","cve":"","title":"Event Easy Calendar <= 1.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c911773-79f5-4d91-b0f9-a05bc17516b2?source=api-prod","affected":[{"type":"plugin","slug":"event-easy-calendar","name":"Event Easy Calendar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2013-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c94f47a-4a1b-434c-b446-0ff1a7290e16","source":"wordfence","cve":"CVE-2019-15776","title":"Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authorization","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c94f47a-4a1b-434c-b446-0ff1a7290e16?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects-addon-bulk-uploader","name":"Simple 301 Redirects \u2013 Addon \u2013 Bulk Uploader","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2019-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c959f9c-8ac4-4f59-9d93-8f96e650b02d","source":"wordfence","cve":"CVE-2024-8103","title":"WP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c959f9c-8ac4-4f59-9d93-8f96e650b02d?source=api-prod","affected":[{"type":"plugin","slug":"wp-category-dropdown","name":"Category Dropdown by GCS Design","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-18T13:47:55Z"},{"id":"wordfence:7c95bbba-6459-420f-a072-3b02c7d58ea0","source":"wordfence","cve":"CVE-2023-23685","title":"Portfolio \u2013 WordPress Portfolio Plugin <= 2.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c95bbba-6459-420f-a072-3b02c7d58ea0?source=api-prod","affected":[{"type":"plugin","slug":"tlp-portfolio","name":"Radius Portfolio \u2013 Filterable Grid, Gallery & Slider Portfolio","from":"*","from_inclusive":true,"to":"2.8.10","to_inclusive":true,"patched_in":"2.8.11"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c964abb-8b7b-4dc4-a64a-817d450eb3b9","source":"wordfence","cve":"CVE-2024-4377","title":"DOP Shortcodes <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c964abb-8b7b-4dc4-a64a-817d450eb3b9?source=api-prod","affected":[{"type":"plugin","slug":"dop-shortcodes","name":"DOP Shortcodes","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:29:44Z"},{"id":"wordfence:7c9820d1-e9f6-4875-842f-9d6565273515","source":"wordfence","cve":"CVE-2025-28880","title":"Blue Captcha <= 1.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9820d1-e9f6-4875-842f-9d6565273515?source=api-prod","affected":[{"type":"plugin","slug":"blue-captcha","name":"Blue Captcha","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-24T00:00:00Z","updated":"2025-05-07T13:58:39Z"},{"id":"wordfence:7c9a2045-7d24-4871-b962-32bc0fdf5476","source":"wordfence","cve":"CVE-2021-24713","title":"Video Lessons Manager < 1.7.2 and Video Lessons Manager Pro < 3.5.9 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9a2045-7d24-4871-b962-32bc0fdf5476?source=api-prod","affected":[{"type":"plugin","slug":"cm-video-lesson-manager","name":"CM Video Lessons Manager \u2013 Simplify video lessons management for better education","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"cm-video-lesson-manager-pro","name":"Video Lessons Manager Pro \u2013 Best Video Course LMS","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c9ae1cd-c2fa-40a3-88f7-9ee7428391e5","source":"wordfence","cve":"CVE-2026-6922","title":"WP Table Builder 2.1.1 - 2.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter","severity":"high","cvss":7.1,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9ae1cd-c2fa-40a3-88f7-9ee7428391e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"2.1.1","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2026-09-21T18:57:04Z","updated":"2026-09-22T13:13:37Z"},{"id":"wordfence:7c9b9ab3-ecfa-49d0-820f-4edb5abae9ee","source":"wordfence","cve":"CVE-2025-57939","title":"Image Hover Effects \u2013 Elementor Addon <= 1.4.4 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9b9ab3-ecfa-49d0-820f-4edb5abae9ee?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-addon-for-elementor","name":"Image Hover Effects \u2013 Elementor Addon","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:26:33Z"},{"id":"wordfence:7c9c36b3-f76b-4af9-bb2d-8b16e021cf12","source":"wordfence","cve":"CVE-2026-48875","title":"JetSmartFilters <= 3.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9c36b3-f76b-4af9-bb2d-8b16e021cf12?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.1.1"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:52:02Z"},{"id":"wordfence:7c9d088c-e71a-4e73-a7e3-d99f3511e519","source":"wordfence","cve":"CVE-2023-50837","title":"Login Lockdown \u2013 Protect Login Form <= 2.06 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9d088c-e71a-4e73-a7e3-d99f3511e519?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.07","to_inclusive":false,"patched_in":"2.07"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7c9e5fb6-5a78-4890-8cc4-2b9e417ff903","source":"wordfence","cve":"CVE-2025-24679","title":"Internal Links Manager <= 2.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7c9e5fb6-5a78-4890-8cc4-2b9e417ff903?source=api-prod","affected":[{"type":"plugin","slug":"seo-automated-link-building","name":"Internal Links Manager","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:39:31Z"},{"id":"wordfence:7ca2c82d-0962-4e18-83d7-636bcef18ca5","source":"wordfence","cve":"CVE-2025-31049","title":"Dash <= 1.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ca2c82d-0962-4e18-83d7-636bcef18ca5?source=api-prod","affected":[{"type":"theme","slug":"dash","name":"Dash - Creative Business Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T15:39:42Z"},{"id":"wordfence:7ca5bffa-e170-40f6-a317-6e0e6c1230f6","source":"wordfence","cve":"CVE-2026-106014","title":"Gateway for Vantiv on WC <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ca5bffa-e170-40f6-a317-6e0e6c1230f6?source=api-prod","affected":[{"type":"plugin","slug":"gateway-for-vantiv-on-wc","name":"Gateway for Vantiv on WC","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:05:30Z"},{"id":"wordfence:7ca83efe-298c-4ce9-a726-dbe76607aebf","source":"wordfence","cve":"","title":"SEO Redirection <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ca83efe-298c-4ce9-a726-dbe76607aebf?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ca93715-bcc4-4710-bfda-f1774fc66cbe","source":"wordfence","cve":"CVE-2025-47582","title":"WPBot Pro Wordpress Chatbot <= 12.7.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ca93715-bcc4-4710-bfda-f1774fc66cbe?source=api-prod","affected":[{"type":"plugin","slug":"wpbot-pro","name":"WPBot Pro Wordpress Chatbot","from":"*","from_inclusive":true,"to":"12.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T00:00:00Z","updated":"2025-05-22T13:18:46Z"},{"id":"wordfence:7caa4c73-cf57-4f99-8bc6-6fd02308a58f","source":"wordfence","cve":"CVE-2023-24397","title":"Reservation.Studio widget <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7caa4c73-cf57-4f99-8bc6-6fd02308a58f?source=api-prod","affected":[{"type":"plugin","slug":"reservation-studio-widget","name":"Reservation.Studio widget","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7caaaaef-075b-44f6-8809-a02d5f034f26","source":"wordfence","cve":"CVE-2023-47661","title":"Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7caaaaef-075b-44f6-8809-a02d5f034f26?source=api-prod","affected":[{"type":"plugin","slug":"dragfy-addons-for-elementor","name":"Dragfy Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cb00342-64f9-4eeb-ba75-1c1544b11334","source":"wordfence","cve":"CVE-2024-25929","title":"Product Catalog Enquiry for WooCommerce by MultiVendorX <= 5.0.5 - Cross-Site Request Forgery via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb00342-64f9-4eeb-ba75-1c1544b11334?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-23T16:49:16Z"},{"id":"wordfence:7cb08fc1-fb8b-4478-8569-eb9b28aff50b","source":"wordfence","cve":"CVE-2021-4401","title":"Style Kits <= 1.8.0 - Cross-Site Request Forgery Bypass","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb08fc1-fb8b-4478-8569-eb9b28aff50b?source=api-prod","affected":[{"type":"plugin","slug":"analogwp-templates","name":"Style Kits for Elementor","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cb4150d-55ae-44d3-a708-fdc6a3c3c990","source":"wordfence","cve":"CVE-2025-69050","title":"Overworld <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb4150d-55ae-44d3-a708-fdc6a3c3c990?source=api-prod","affected":[{"type":"theme","slug":"overworld","name":"Overworld - eSports and Gaming WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T22:03:56Z"},{"id":"wordfence:7cb428db-b56b-4c21-b119-ca7a1a95181e","source":"wordfence","cve":"CVE-2022-4897","title":"BackupBuddy <= 8.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb428db-b56b-4c21-b119-ca7a1a95181e?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"*","from_inclusive":true,"to":"8.8.2","to_inclusive":true,"patched_in":"8.8.3"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cb710ff-0802-4300-ad6f-efbd54ab4da7","source":"wordfence","cve":"CVE-2025-52723","title":"Networker <= 1.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb710ff-0802-4300-ad6f-efbd54ab4da7?source=api-prod","affected":[{"type":"theme","slug":"networker","name":"Networker - Tech News WordPress Theme with Dark Mode","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:41:11Z"},{"id":"wordfence:7cb81956-856a-49cc-a437-a2094d958b5d","source":"wordfence","cve":"CVE-2021-24237","title":"Realteo <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb81956-856a-49cc-a437-a2094d958b5d?source=api-prod","affected":[{"type":"plugin","slug":"realteo","name":"Realteo","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2021-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cb8f025-8490-4c3b-b525-f6562c9a4946","source":"wordfence","cve":"CVE-2026-94295","title":"Chikkili Google Pay for WooCommerce <= 1.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb8f025-8490-4c3b-b525-f6562c9a4946?source=api-prod","affected":[{"type":"plugin","slug":"chikkili-google-pay-for-woocommerce","name":"Chikkili- Google Pay India for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:28:07Z"},{"id":"wordfence:7cb95ee1-5c21-407f-aa8c-c3ec1c97015a","source":"wordfence","cve":"CVE-2025-1487","title":"WoWPth <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb95ee1-5c21-407f-aa8c-c3ec1c97015a?source=api-prod","affected":[{"type":"plugin","slug":"wowpth","name":"WoWPth","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T22:01:31Z"},{"id":"wordfence:7cb9cc24-920f-402d-8a87-8b6c6a1b1a51","source":"wordfence","cve":"CVE-2021-24866","title":"WP Data Access <= 4.3.1 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb9cc24-920f-402d-8a87-8b6c6a1b1a51?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cbb1e71-baf1-4d1d-96c8-93fd2686297d","source":"wordfence","cve":"CVE-2023-0259","title":"WP Google Review Slider <= 11.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbb1e71-baf1-4d1d-96c8-93fd2686297d?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"11.7","to_inclusive":true,"patched_in":"11.8"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cbc157b-4f1b-4212-9e5c-dd10dd443df7","source":"wordfence","cve":"CVE-2024-12545","title":"Scratch & Win \u2013 Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbc157b-4f1b-4212-9e5c-dd10dd443df7?source=api-prod","affected":[{"type":"plugin","slug":"scratch-win-giveaways-for-website-facebook","name":"Scratch & Win \u2013 Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-01-03T19:18:18Z","updated":"2025-01-04T07:24:24Z"},{"id":"wordfence:7cbe39ae-d10b-432f-afab-682948de2521","source":"wordfence","cve":"CVE-2025-14390","title":"Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbe39ae-d10b-432f-afab-682948de2521?source=api-prod","affected":[{"type":"plugin","slug":"video-merchant","name":"Video Merchant","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-09T00:00:00Z","updated":"2025-12-10T09:23:56Z"},{"id":"wordfence:7cbe9175-4a6f-4eb6-8d31-9a9fda9b4f40","source":"wordfence","cve":"CVE-2023-2448","title":"UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbe9175-4a6f-4eb6-8d31-9a9fda9b4f40?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cc416cc-49a4-4752-86e7-acc52ba4f92d","source":"wordfence","cve":"CVE-2021-34629","title":"SendGrid <= 1.11.8 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc416cc-49a4-4752-86e7-acc52ba4f92d?source=api-prod","affected":[{"type":"plugin","slug":"sendgrid-email-delivery-simplified","name":"SendGrid","from":"*","from_inclusive":true,"to":"1.11.8","to_inclusive":true,"patched_in":""}],"published":"2021-07-21T15:18:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cc618c8-63a9-4321-ad18-ee5277a5f5e0","source":"wordfence","cve":"CVE-2023-28496","title":"SMTP2GO <= 1.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc618c8-63a9-4321-ad18-ee5277a5f5e0?source=api-prod","affected":[{"type":"plugin","slug":"smtp2go","name":"SMTP2GO for WordPress \u2013 Email Made Easy","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cc7ec8b-4480-4422-8831-97f20a5d8d67","source":"wordfence","cve":"CVE-2022-1436","title":"WPCargo Track & Trace <= 6.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc7ec8b-4480-4422-8831-97f20a5d8d67?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"6.9.4","to_inclusive":true,"patched_in":"6.9.5"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cc86970-7e63-47d0-9971-ddd0fc992a5a","source":"wordfence","cve":"","title":"AddToAny Share Buttons <= 1.7.14 - HTTP Host Header Injection","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc86970-7e63-47d0-9971-ddd0fc992a5a?source=api-prod","affected":[{"type":"plugin","slug":"add-to-any","name":"AddToAny Share Buttons","from":"*","from_inclusive":true,"to":"1.7.14","to_inclusive":true,"patched_in":"1.7.15"}],"published":"2017-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cc96e83-28d9-4c6e-876f-23f1836ffd74","source":"wordfence","cve":"","title":"Google Maps <= 2.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc96e83-28d9-4c6e-876f-23f1836ffd74?source=api-prod","affected":[{"type":"plugin","slug":"google-maps","name":"Google Maps","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2016-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cca8164-c0ce-4c10-aeb2-5ba7983e4e81","source":"wordfence","cve":"CVE-2026-65449","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cca8164-c0ce-4c10-aeb2-5ba7983e4e81?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:55:30Z"},{"id":"wordfence:7ccaee26-277e-4730-8242-9b5e6a281fcc","source":"wordfence","cve":"CVE-2024-13642","title":"Stratum \u2013 Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccaee26-277e-4730-8242-9b5e6a281fcc?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T06:41:09Z"},{"id":"wordfence:7ccb7534-b588-4bdd-9627-0e38c0ee5e8a","source":"wordfence","cve":"CVE-2026-3142","title":"Pinterest Site Verification plugin using Meta Tag <= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccb7534-b588-4bdd-9627-0e38c0ee5e8a?source=api-prod","affected":[{"type":"plugin","slug":"pinterest-site-verification","name":"Pinterest Site Verification plugin using Meta Tag","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:19Z","updated":"2026-04-08T06:43:39Z"},{"id":"wordfence:7ccca628-9851-44d1-b4be-77c04e8b8de4","source":"wordfence","cve":"CVE-2025-31043","title":"JetSearch <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccca628-9851-44d1-b4be-77c04e8b8de4?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.7.1"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-09T13:35:26Z"},{"id":"wordfence:7cce2f9f-5f47-4e10-a846-0aab4bcad616","source":"wordfence","cve":"CVE-2023-32603","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce2f9f-5f47-4e10-a846-0aab4bcad616?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cce9b8b-0589-4b09-b184-a66fc86fcb46","source":"wordfence","cve":"CVE-2025-1909","title":"BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform-pro","name":"BuddyBoss Platform Pro","from":"*","from_inclusive":true,"to":"2.7.01","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2025-05-05T00:00:00Z","updated":"2025-05-05T19:42:25Z"},{"id":"wordfence:7ccf6945-6f18-410b-9f1a-6d52a3cdda1a","source":"wordfence","cve":"CVE-2022-0252","title":"GiveWP <= 2.17.2 - Reflected Cross-Site Scripting via Import Tool","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccf6945-6f18-410b-9f1a-6d52a3cdda1a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":false,"patched_in":"2.17.3"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cd3c84b-dacc-44e8-a236-bfc80e6dceba","source":"wordfence","cve":"CVE-2015-9469","title":"Content Grabber <= 1.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd3c84b-dacc-44e8-a236-bfc80e6dceba?source=api-prod","affected":[{"type":"plugin","slug":"content-grabber","name":"Content Grabber","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cd412d8-6d14-4803-aae6-087e02f9d75f","source":"wordfence","cve":"CVE-2025-12018","title":"MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd412d8-6d14-4803-aae6-087e02f9d75f?source=api-prod","affected":[{"type":"plugin","slug":"memberfindme","name":"MembershipWorks \u2013 Membership, Events & Directory","from":"*","from_inclusive":true,"to":"6.14","to_inclusive":true,"patched_in":"6.15"}],"published":"2025-11-11T19:16:16Z","updated":"2025-11-12T07:27:43Z"},{"id":"wordfence:7cd4b1da-faee-4c4e-b323-e77c4c033149","source":"wordfence","cve":"CVE-2023-47845","title":"Grab & Save <= 1.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd4b1da-faee-4c4e-b323-e77c4c033149?source=api-prod","affected":[{"type":"plugin","slug":"save-grab","name":"Grab & Save","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cd55eb6-89a9-4a30-9772-04ca90200e23","source":"wordfence","cve":"CVE-2024-2904","title":"Calliope <= 1.0.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd55eb6-89a9-4a30-9772-04ca90200e23?source=api-prod","affected":[{"type":"theme","slug":"calliope","name":"Calliope","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2024-03-26T00:00:00Z","updated":"2026-05-07T13:43:10Z"},{"id":"wordfence:7cd8dc3e-6328-49f2-8cc7-cc395646ee40","source":"wordfence","cve":"CVE-2025-24769","title":"Zenny <= 1.7.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd8dc3e-6328-49f2-8cc7-cc395646ee40?source=api-prod","affected":[{"type":"theme","slug":"bw-zenny","name":"Zenny - Jewelry, Watches & Glasses Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:39:18Z"},{"id":"wordfence:7cd8ea73-81f3-41fe-bb1e-403d2645ff39","source":"wordfence","cve":"CVE-2017-14313","title":"Shibboleth <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd8ea73-81f3-41fe-bb1e-403d2645ff39?source=api-prod","affected":[{"type":"plugin","slug":"shibboleth","name":"Shibboleth","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2016-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cd8f7da-86d4-4e58-8ce8-f1d147fdcdcc","source":"wordfence","cve":"CVE-2025-9501","title":"W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection","severity":"high","cvss":8.1,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cd8f7da-86d4-4e58-8ce8-f1d147fdcdcc?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":"2.8.13"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-20T21:43:49Z"},{"id":"wordfence:7cda6aad-36e1-45c7-af46-a7b90bb2d339","source":"wordfence","cve":"CVE-2025-12484","title":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cda6aad-36e1-45c7-af46-a7b90bb2d339?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.19","to_inclusive":true,"patched_in":"1.12.21"}],"published":"2025-11-18T19:41:33Z","updated":"2025-11-19T07:46:07Z"},{"id":"wordfence:7cdfba69-c232-4387-aa7e-961e70cef378","source":"wordfence","cve":"CVE-2025-60160","title":"Smart Related Products <= 2.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cdfba69-c232-4387-aa7e-961e70cef378?source=api-prod","affected":[{"type":"plugin","slug":"ai-related-products","name":"Smart Related Products \u2013 AI-Inspired Recommendations for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:11:24Z"},{"id":"wordfence:7cdfce88-b6c2-4820-9d6f-446f61b9b596","source":"wordfence","cve":"CVE-2024-12213","title":"WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cdfce88-b6c2-4820-9d6f-446f61b9b596?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-board-pro","name":"WP Job Board Pro","from":"*","from_inclusive":true,"to":"1.2.85","to_inclusive":false,"patched_in":"1.2.85"}],"published":"2025-02-11T00:00:00Z","updated":"2026-01-22T13:39:37Z"},{"id":"wordfence:7ce1ae54-1011-4d8e-9329-ac72770c4386","source":"wordfence","cve":"CVE-2025-25091","title":"NextGen Cooliris Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce1ae54-1011-4d8e-9329-ac72770c4386?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-cooliris-gallery","name":"NextGen Cooliris Gallery","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:24:53Z"},{"id":"wordfence:7ce32ecf-6995-4794-8559-2f84533ecf50","source":"wordfence","cve":"CVE-2023-40330","title":"GD Security Headers <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce32ecf-6995-4794-8559-2f84533ecf50?source=api-prod","affected":[{"type":"plugin","slug":"gd-security-headers","name":"GD Security Headers","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.7"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ce4050e-3563-4aac-b1c1-16cba20e1e86","source":"wordfence","cve":"CVE-2026-56044","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce4050e-3563-4aac-b1c1-16cba20e1e86?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"8.9.3"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:01:17Z"},{"id":"wordfence:7ce6e40e-b090-447a-9bf9-6337d30e7da3","source":"wordfence","cve":"CVE-2024-1464","title":"Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce6e40e-b090-447a-9bf9-6337d30e7da3?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:01Z"},{"id":"wordfence:7ce8ae7d-c2a5-4da3-8bdd-20dfdb5ce700","source":"wordfence","cve":"CVE-2021-4363","title":"WP Quick FrontEnd Editor <= 5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce8ae7d-c2a5-4da3-8bdd-20dfdb5ce700?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-front-end-editor","name":"WP Quick FrontEnd Editor \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2021-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ce9bac7-60bb-4880-9e37-4d71f02ee941","source":"wordfence","cve":"CVE-2024-47315","title":"GiveWP <= 3.15.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce9bac7-60bb-4880-9e37-4d71f02ee941?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.16.0"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:03:45Z"},{"id":"wordfence:7cebc89a-5e01-4a3c-a549-d4a0620290b0","source":"wordfence","cve":"CVE-2026-84752","title":"RTMKit <= 2.1.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cebc89a-5e01-4a3c-a549-d4a0620290b0?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:33:50Z"},{"id":"wordfence:7cecb044-2dba-494f-b85c-41bafa69e330","source":"wordfence","cve":"CVE-2026-116614","title":"WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cecb044-2dba-494f-b85c-41bafa69e330?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.24.1","to_inclusive":true,"patched_in":"2.24.2"}],"published":"2026-11-12T20:59:39Z","updated":"2026-11-13T09:35:13Z"},{"id":"wordfence:7ced687c-8595-4a56-b0dd-d8783b49fd1b","source":"wordfence","cve":"CVE-2026-84814","title":"Bricksforge <= 3.1.8.8 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ced687c-8595-4a56-b0dd-d8783b49fd1b?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"3.1.8.8","to_inclusive":true,"patched_in":"3.1.8.9"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:47:09Z"},{"id":"wordfence:7cef819e-71a3-4fe0-9d32-8d0e292bb904","source":"wordfence","cve":"CVE-2026-66666","title":"WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds","severity":"medium","cvss":5.3,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cef819e-71a3-4fe0-9d32-8d0e292bb904?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.37","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.32","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.33","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.26","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.28","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.25","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.23","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.21","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.18","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.16","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"4.7.38"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:04:20Z"},{"id":"wordfence:7cf05767-af07-4577-9f00-b2695237e041","source":"wordfence","cve":"CVE-2025-39551","title":"FluentBoards <= 1.47 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf05767-af07-4577-9f00-b2695237e041?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"1.47","to_inclusive":true,"patched_in":"1.48"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:54:43Z"},{"id":"wordfence:7cf1a90d-6157-40e7-aed8-4d18bc22432d","source":"wordfence","cve":"CVE-2025-12585","title":"MxChat \u2013 AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf1a90d-6157-40e7-aed8-4d18bc22432d?source=api-prod","affected":[{"type":"plugin","slug":"mxchat-basic","name":"MxChat \u2013 AI Chatbot & Content Generation for WordPress","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2025-12-02T14:25:33Z","updated":"2025-12-04T22:31:06Z"},{"id":"wordfence:7cf28b29-6e09-4359-9fe9-739d46fa5c2d","source":"wordfence","cve":"CVE-2025-23453","title":"Stars SMTP Mailer <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf28b29-6e09-4359-9fe9-739d46fa5c2d?source=api-prod","affected":[{"type":"plugin","slug":"stars-smtp-mailer","name":"Stars SMTP Mailer","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-01-16T00:00:00Z","updated":"2025-06-27T19:49:30Z"},{"id":"wordfence:7cf3e557-5964-4a76-920f-1936d2225437","source":"wordfence","cve":"CVE-2024-12873","title":"Custom Field Manager <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf3e557-5964-4a76-920f-1936d2225437?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-manager","name":"Custom Field Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T18:43:42Z"},{"id":"wordfence:7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28","source":"wordfence","cve":"CVE-2025-9874","title":"Ultimate Classified Listings <= 1.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-09-10T18:52:29Z","updated":"2025-11-06T15:13:51Z"},{"id":"wordfence:7cf65364-c728-43f7-82eb-4cd443bee938","source":"wordfence","cve":"CVE-2026-109686","title":"Link Whisper Free <= 0.9.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf65364-c728-43f7-82eb-4cd443bee938?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2026-10-13T12:57:23Z","updated":"2026-10-23T18:25:50Z"},{"id":"wordfence:7cf70172-b8d7-4854-ab8d-f57b430ada67","source":"wordfence","cve":"CVE-2025-47556","title":"CSS3 Compare Pricing Tables for WordPress <= 11.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf70172-b8d7-4854-ab8d-f57b430ada67?source=api-prod","affected":[{"type":"plugin","slug":"css3_web_pricing_tables_grids","name":"CSS3 Compare Pricing Tables for WordPress","from":"*","from_inclusive":true,"to":"11.6","to_inclusive":true,"patched_in":"11.7"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:07:45Z"},{"id":"wordfence:7cfa1b8d-a4cb-4944-8ffa-4060c8f362dd","source":"wordfence","cve":"CVE-2025-50028","title":"Ultimate Push Notifications <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfa1b8d-a4cb-4944-8ffa-4060c8f362dd?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-push-notifications","name":"Ultimate Push Notifications","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-07-07T00:00:00Z","updated":"2026-09-23T14:28:34Z"},{"id":"wordfence:7cfab048-efc6-4c7c-a1bd-0a9daf8779bc","source":"wordfence","cve":"CVE-2024-9505","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfab048-efc6-4c7c-a1bd-0a9daf8779bc?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.4.2","to_inclusive":true,"patched_in":"2.8.4.3"}],"published":"2024-10-29T00:41:13Z","updated":"2024-10-29T13:53:55Z"},{"id":"wordfence:7cfaf155-7766-4bb9-b89a-368d8adb889f","source":"wordfence","cve":"CVE-2017-5610","title":"WordPress Core < 4.7.2 - Authorization Bypass to Term Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfaf155-7766-4bb9-b89a-368d8adb889f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.7.18"}],"published":"2017-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cfbaa87-1af7-4f5d-820b-1f2194765121","source":"wordfence","cve":"CVE-2014-4581","title":"WPCB <= 2.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfbaa87-1af7-4f5d-820b-1f2194765121?source=api-prod","affected":[{"type":"plugin","slug":"wpcb","name":"WPCB","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cfc1f42-c9dd-4dcb-8be5-c440a568a02e","source":"wordfence","cve":"CVE-2020-11029","title":"WordPress Core < 5.4.1 - Reflected Cross Site Scripting","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfc1f42-c9dd-4dcb-8be5-c440a568a02e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cfe0f4c-763a-4e02-b180-9fe333253f84","source":"wordfence","cve":"CVE-2026-83492","title":"Kubio AI Website Builder < 2.9.1 - Authenticated (Admin+) Denial of Service","severity":"medium","cvss":4.9,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfe0f4c-763a-4e02-b180-9fe333253f84?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T18:06:25Z"},{"id":"wordfence:7cfeed0f-ab3e-4b35-9b69-08cc7e7ffb45","source":"wordfence","cve":"","title":"Flexi Quote Rotator <= 0.9.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfeed0f-ab3e-4b35-9b69-08cc7e7ffb45?source=api-prod","affected":[{"type":"plugin","slug":"flexi-quote-rotator","name":"Flexi Quote Rotator","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cff6946-3983-49ea-ab4f-22cf9fa149a4","source":"wordfence","cve":"CVE-2025-54009","title":"JetSmartFilters <= 3.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cff6946-3983-49ea-ab4f-22cf9fa149a4?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:54:49Z"},{"id":"wordfence:7cff7dc5-23e1-424c-923b-68eef49dec6f","source":"wordfence","cve":"CVE-2023-41957","title":"Simple Membership <= 4.3.4 - Privilege escalation via Registration","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cff7dc5-23e1-424c-923b-68eef49dec6f?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7cffdb27-c87b-467b-93d0-e92001caea9a","source":"wordfence","cve":"CVE-2024-37473","title":"Trendy News <= 1.0.15 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cffdb27-c87b-467b-93d0-e92001caea9a?source=api-prod","affected":[{"type":"theme","slug":"trendy-news","name":"Trendy News","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:58:51Z"},{"id":"wordfence:7cffe04e-a2e5-4752-a5c1-7c95f0007e0b","source":"wordfence","cve":"CVE-2025-14159","title":"Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7cffe04e-a2e5-4752-a5c1-7c95f0007e0b?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-12-11T21:20:54Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:7d02bed5-c45b-46db-a2c2-9c741f8b1dc5","source":"wordfence","cve":"CVE-2018-11579","title":"Woocommerce Category Banner Management <= 1.1.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d02bed5-c45b-46db-a2c2-9c741f8b1dc5?source=api-prod","affected":[{"type":"plugin","slug":"banner-management-for-woocommerce","name":"Banner Management For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2018-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d02e0e4-e023-4655-838a-aec2ab942160","source":"wordfence","cve":"CVE-2026-111411","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.5.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d02e0e4-e023-4655-838a-aec2ab942160?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.8.5.2","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-10-26T12:22:02Z","updated":"2026-11-03T19:23:01Z"},{"id":"wordfence:7d047fe7-bf00-4f93-91d2-c5da41664bfc","source":"wordfence","cve":"","title":"Age Gate <= 2.13.4 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d047fe7-bf00-4f93-91d2-c5da41664bfc?source=api-prod","affected":[{"type":"plugin","slug":"age-gate","name":"Age Gate","from":"*","from_inclusive":true,"to":"2.13.5","to_inclusive":false,"patched_in":"2.13.5"}],"published":"2022-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d057ac6-a341-4ec3-956c-2a2a5636155c","source":"wordfence","cve":"CVE-2025-2780","title":"Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d057ac6-a341-4ec3-956c-2a2a5636155c?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.21","to_inclusive":true,"patched_in":"5.4.22"}],"published":"2025-04-03T00:00:00Z","updated":"2025-06-09T19:25:54Z"},{"id":"wordfence:7d090e5e-bbcf-4e26-81c5-ed7dcae21f31","source":"wordfence","cve":"CVE-2026-42725","title":"Checkout Files Upload for WooCommerce <= 2.2.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d090e5e-bbcf-4e26-81c5-ed7dcae21f31?source=api-prod","affected":[{"type":"plugin","slug":"checkout-files-upload-woocommerce","name":"Checkout Files Upload for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T16:12:11Z"},{"id":"wordfence:7d0919de-dac5-4168-aae4-74bf528a27e4","source":"wordfence","cve":"CVE-2025-49271","title":"GravityWP - Merge Tags <= 1.4.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d0919de-dac5-4168-aae4-74bf528a27e4?source=api-prod","affected":[{"type":"plugin","slug":"gravitywp-merge-tags","name":"GravityWP \u2013 Merge Tags","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-11T14:41:40Z"},{"id":"wordfence:7d096c3c-421b-48d8-90be-462398004a95","source":"wordfence","cve":"CVE-2025-30974","title":"Post Grid Master <= 3.4.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d096c3c-421b-48d8-90be-462398004a95?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-10-24T06:44:54Z"},{"id":"wordfence:7d0bc838-3653-408d-8be3-b9d910b30f67","source":"wordfence","cve":"CVE-2025-26554","title":"WP Discord Post <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d0bc838-3653-408d-8be3-b9d910b30f67?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-post","name":"WP Discord Post","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:39:18Z"},{"id":"wordfence:7d0cb432-785a-4f38-830f-72b95e65aa5a","source":"wordfence","cve":"CVE-2026-3498","title":"BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d0cb432-785a-4f38-830f-72b95e65aa5a?source=api-prod","affected":[{"type":"plugin","slug":"blockart-blocks","name":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library","from":"*","from_inclusive":true,"to":"2.2.15","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-04-10T12:03:21Z","updated":"2026-04-11T01:24:59Z"},{"id":"wordfence:7d0e4fc9-1997-4d83-b424-93607380a352","source":"wordfence","cve":"CVE-2026-9691","title":"Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d0e4fc9-1997-4d83-b424-93607380a352?source=api-prod","affected":[{"type":"plugin","slug":"cf7-active-campaign","name":"Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:42:41Z"},{"id":"wordfence:7d11b2db-d097-433f-923c-f49ef2951c0e","source":"wordfence","cve":"CVE-2026-4142","title":"Sentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d11b2db-d097-433f-923c-f49ef2951c0e?source=api-prod","affected":[{"type":"plugin","slug":"sentence-to-seo","name":"Sentence To SEO (keywords, description and tags)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:05:43Z","updated":"2026-04-22T07:45:38Z"},{"id":"wordfence:7d19800a-bff3-414f-a809-0159f49d263a","source":"wordfence","cve":"CVE-2022-45367","title":"Custom Order Numbers for WooCommerce <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d19800a-bff3-414f-a809-0159f49d263a?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-numbers-for-woocommerce","name":"Custom Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d1cc8c4-6c14-4d0c-9420-02d709f88b2f","source":"wordfence","cve":"CVE-2023-3076","title":"MStore API <= 3.9.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d1cc8c4-6c14-4d0c-9420-02d709f88b2f?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d1e0423-a91b-4096-ad65-19e2d11cfea1","source":"wordfence","cve":"CVE-2022-1643","title":"Birthdays Widget <= 1.7.18 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d1e0423-a91b-4096-ad65-19e2d11cfea1?source=api-prod","affected":[{"type":"plugin","slug":"birthdays-widget","name":"Birthdays Widget","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d1ea1c5-6a9e-4b77-bfdf-62e50d4a4c03","source":"wordfence","cve":"CVE-2024-1496","title":"Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d1ea1c5-6a9e-4b77-bfdf-62e50d4a4c03?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2024-02-19T00:00:00Z","updated":"2024-05-31T15:30:28Z"},{"id":"wordfence:7d23e7f7-d5fa-4c40-b6ad-70e9ee147c5c","source":"wordfence","cve":"CVE-2026-32583","title":"Modern Events Calendar <= 7.32.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d23e7f7-d5fa-4c40-b6ad-70e9ee147c5c?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.32.0","to_inclusive":true,"patched_in":"7.33.0"}],"published":"2026-03-16T00:00:00Z","updated":"2026-06-18T20:17:26Z"},{"id":"wordfence:7d242775-3161-4e74-adb4-db4369e3cae6","source":"wordfence","cve":"CVE-2025-48167","title":"Chatbox Manager <= 1.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d242775-3161-4e74-adb4-db4369e3cae6?source=api-prod","affected":[{"type":"plugin","slug":"wa-chatbox-manager","name":"Chatbox Manager","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:10:55Z"},{"id":"wordfence:7d249bc4-1230-4d85-8b29-e00a9cb80434","source":"wordfence","cve":"CVE-2024-51664","title":"Beds24 Online Booking <= 2.0.25 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d249bc4-1230-4d85-8b29-e00a9cb80434?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.25","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:43:41Z"},{"id":"wordfence:7d25cca1-eb57-4ba2-8923-a3c56f41ce22","source":"wordfence","cve":"CVE-2023-4059","title":"Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d25cca1-eb57-4ba2-8923-a3c56f41ce22?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":false,"patched_in":"3.9.8"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d25e85f-28f7-4cc5-9856-25cc5aaf1418","source":"wordfence","cve":"CVE-2023-6877","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d25e85f-28f7-4cc5-9856-25cc5aaf1418?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2024-04-06T00:00:00Z","updated":"2024-07-29T21:36:41Z"},{"id":"wordfence:7d262a3b-6205-45b3-8d8e-da541e07de46","source":"wordfence","cve":"CVE-2024-11363","title":"Same but Different \u2013 Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d262a3b-6205-45b3-8d8e-da541e07de46?source=api-prod","affected":[{"type":"plugin","slug":"same-but-different","name":"Same but Different \u2013 Related Posts by Taxonomy","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:07:29Z","updated":"2025-01-07T04:22:15Z"},{"id":"wordfence:7d264e88-7137-48ff-8ce3-5fff77e2474a","source":"wordfence","cve":"CVE-2024-43247","title":"WHMpress <= 6.2-revision-5 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d264e88-7137-48ff-8ce3-5fff77e2474a?source=api-prod","affected":[{"type":"plugin","slug":"whmpress","name":"WHMpress - WHMCS WordPress Integration Plugin","from":"*","from_inclusive":true,"to":"6.2-revision-5","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:55:38Z"},{"id":"wordfence:7d2bfbce-8e50-415c-997e-881b240c5807","source":"wordfence","cve":"CVE-2026-39586","title":"RepairBuddy <= 4.1132 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d2bfbce-8e50-415c-997e-881b240c5807?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1132","to_inclusive":true,"patched_in":"4.1133"}],"published":"2026-02-26T00:00:00Z","updated":"2026-05-05T15:31:58Z"},{"id":"wordfence:7d2cec6e-9ce9-448f-8e32-a3f1877e2575","source":"wordfence","cve":"CVE-2025-53442","title":"Rentic <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d2cec6e-9ce9-448f-8e32-a3f1877e2575?source=api-prod","affected":[{"type":"theme","slug":"rentic","name":"Rentic - Car Rental & Dealership WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:26:16Z"},{"id":"wordfence:7d2f30e7-75f2-40c2-a421-aec13d436efc","source":"wordfence","cve":"CVE-2024-6693","title":"WP Content Copy Protection & No Right Click (PRO) <= 15.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d2f30e7-75f2-40c2-a421-aec13d436efc?source=api-prod","affected":[{"type":"plugin","slug":"wccp-pro","name":"WP Content Copy Protection & No Right Click (PRO)","from":"*","from_inclusive":true,"to":"15.0","to_inclusive":true,"patched_in":"15.3"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-26T22:38:21Z"},{"id":"wordfence:7d30adc5-27a5-4549-84fc-b930f27f03e5","source":"wordfence","cve":"CVE-2023-2438","title":"UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d30adc5-27a5-4549-84fc-b930f27f03e5?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d30e813-010f-4881-8b8e-f3d62d928c57","source":"wordfence","cve":"CVE-2023-0375","title":"Easy Affiliate Links <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Settings","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d30e813-010f-4881-8b8e-f3d62d928c57?source=api-prod","affected":[{"type":"plugin","slug":"easy-affiliate-links","name":"Easy Affiliate Links","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d32b2cc-9336-432e-9d2e-67db8b0e3f90","source":"wordfence","cve":"CVE-2024-9372","title":"WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d32b2cc-9336-432e-9d2e-67db8b0e3f90?source=api-prod","affected":[{"type":"plugin","slug":"wp-blocks-hub","name":"WP Blocks Hub","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-03T13:31:01Z","updated":"2024-10-04T02:04:52Z"},{"id":"wordfence:7d33594b-e7b7-4685-97c1-37a2fecc1b8a","source":"wordfence","cve":"","title":"Yoast SEO <= 1.4.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d33594b-e7b7-4685-97c1-37a2fecc1b8a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d338b15-ec26-4239-b90a-1ea8d5ba5ce0","source":"wordfence","cve":"CVE-2026-93904","title":"Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d338b15-ec26-4239-b90a-1ea8d5ba5ce0?source=api-prod","affected":[{"type":"plugin","slug":"social-web-suite","name":"Social Web Suite \u2013 Social Media Auto Post, Social Media Auto Publish","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:44:46Z","updated":"2026-10-29T03:39:15Z"},{"id":"wordfence:7d358718-18e7-4c8c-88be-184b4850fdaa","source":"wordfence","cve":"CVE-2026-94061","title":"Whistle - Sports Club <= 4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d358718-18e7-4c8c-88be-184b4850fdaa?source=api-prod","affected":[{"type":"theme","slug":"whistle-sports-club","name":"Whistle - Sports Clothing & Fitness Equipment","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:15:23Z"},{"id":"wordfence:7d379721-d629-433d-ba89-a74c9dec537e","source":"wordfence","cve":"CVE-2022-38095","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.3 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d379721-d629-433d-ba89-a74c9dec537e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d3a6650-5be0-4162-93eb-369538a2ebc5","source":"wordfence","cve":"CVE-2024-0431","title":"Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d3a6650-5be0-4162-93eb-369538a2ebc5?source=api-prod","affected":[{"type":"plugin","slug":"gestpay-for-woocommerce","name":"Ecommerce Fabrick","from":"*","from_inclusive":true,"to":"20221130","to_inclusive":true,"patched_in":"20240307"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:36:41Z"},{"id":"wordfence:7d3c44eb-ef25-43f5-a872-6ef52c3d9c1f","source":"wordfence","cve":"CVE-2024-8793","title":"Store Exporter for WooCommerce \u2013 Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d3c44eb-ef25-43f5-a872-6ef52c3d9c1f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-09-30T19:46:32Z","updated":"2024-12-10T16:12:47Z"},{"id":"wordfence:7d3e9909-54ce-43f0-8e75-27e3a61817c9","source":"wordfence","cve":"CVE-2026-61995","title":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d3e9909-54ce-43f0-8e75-27e3a61817c9?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T06:16:15Z","updated":"2026-11-03T20:06:42Z"},{"id":"wordfence:7d40c658-a156-470e-bf93-a1f2ccec9c61","source":"wordfence","cve":"CVE-2024-12104","title":"Visual Website Collaboration, Feedback & Project Management \u2013 Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d40c658-a156-470e-bf93-a1f2ccec9c61?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-01-20T00:00:00Z","updated":"2025-02-26T21:55:39Z"},{"id":"wordfence:7d4141bd-cd3f-44e9-b423-be03377a342d","source":"wordfence","cve":"CVE-2026-4299","title":"MainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4141bd-cd3f-44e9-b423-be03377a342d?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child-reports","name":"MainWP Child Reports","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-04-07T15:21:54Z","updated":"2026-04-08T03:36:09Z"},{"id":"wordfence:7d45ab3c-0186-4feb-821d-24c37cb68ee5","source":"wordfence","cve":"CVE-2024-10818","title":"JSFiddle Shortcode <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d45ab3c-0186-4feb-821d-24c37cb68ee5?source=api-prod","affected":[{"type":"plugin","slug":"jsfiddle-shortcode","name":"JSFiddle Shortcode","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T15:05:22Z"},{"id":"wordfence:7d4ae4a7-aec1-4cc1-bea0-61dde44027fc","source":"wordfence","cve":"CVE-2024-8254","title":"Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4ae4a7-aec1-4cc1-bea0-61dde44027fc?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.34","to_inclusive":true,"patched_in":"5.7.35"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T06:46:02Z"},{"id":"wordfence:7d4c574f-f603-49eb-8d86-c98c060c1dfe","source":"wordfence","cve":"CVE-2026-57693","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4c574f-f603-49eb-8d86-c98c060c1dfe?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:36:38Z"},{"id":"wordfence:7d4e685a-0462-447f-a639-4f95d5aa27ab","source":"wordfence","cve":"CVE-2026-9857","title":"Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4e685a-0462-447f-a639-4f95d5aa27ab?source=api-prod","affected":[{"type":"plugin","slug":"saskaita123-lt","name":"Invoice123","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-07-09T20:50:27Z","updated":"2026-07-10T09:32:42Z"},{"id":"wordfence:7d4f490e-c86e-490e-8041-36c154b890aa","source":"wordfence","cve":"CVE-2023-40556","title":"Schedule Posts Calendar <= 5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4f490e-c86e-490e-8041-36c154b890aa?source=api-prod","affected":[{"type":"plugin","slug":"schedule-posts-calendar","name":"Schedule Posts Calendar","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d500729-3b1a-4ece-81de-4c1f9afbf798","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d500729-3b1a-4ece-81de-4c1f9afbf798?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d51ce34-3768-4dc6-bb28-ac59284d4945","source":"wordfence","cve":"CVE-2025-67524","title":"Jobmonster Elementor Addon <= 1.1.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d51ce34-3768-4dc6-bb28-ac59284d4945?source=api-prod","affected":[{"type":"plugin","slug":"jobmonster-addon","name":"Jobmonster Elementor Addon","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T17:15:53Z"},{"id":"wordfence:7d525c50-5911-4be6-a860-b48db619adba","source":"wordfence","cve":"","title":"Limit Login Attempts (Spam Protection) <= 2.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d525c50-5911-4be6-a860-b48db619adba?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-failed-login-attempts","name":"Limit Login Attempts (Spam Protection)","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.1"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d536acc-b297-4acd-97e2-87eae2e2b95a","source":"wordfence","cve":"CVE-2023-28780","title":"Yoast SEO: Local <= 14.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d536acc-b297-4acd-97e2-87eae2e2b95a?source=api-prod","affected":[{"type":"plugin","slug":"wpseo-local","name":"Yoast SEO: Local","from":"*","from_inclusive":true,"to":"14.8","to_inclusive":true,"patched_in":"14.9"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d539aaf-8121-4556-b4a9-127b491a8689","source":"wordfence","cve":"CVE-2026-18474","title":"Directory Kit <= 1.5.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d539aaf-8121-4556-b4a9-127b491a8689?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:56:48Z"},{"id":"wordfence:7d546f05-4aad-49c8-aefd-9f5d10529be5","source":"wordfence","cve":"CVE-2014-9094","title":"DZS Video Gallery < 7.95 -  Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d546f05-4aad-49c8-aefd-9f5d10529be5?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"7.95","to_inclusive":false,"patched_in":"7.95"}],"published":"2014-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d54a72c-8fd5-418f-8109-078d0d75138d","source":"wordfence","cve":"CVE-2026-48885","title":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d54a72c-8fd5-418f-8109-078d0d75138d?source=api-prod","affected":[{"type":"plugin","slug":"holler-box","name":"HollerBox \u2014 Fast & Effective Popups & Lead-Generation","from":"*","from_inclusive":true,"to":"2.3.10.1","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:49:34Z"},{"id":"wordfence:7d55c2b8-c05e-419b-8c2d-8c07c8655c17","source":"wordfence","cve":"","title":"WDContactFormBuilder <= 1.0.24 - Authenticated Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d55c2b8-c05e-419b-8c2d-8c07c8655c17?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-builder","name":"WDContactFormBuilder","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d563826-5b84-4fc9-a6e5-d6d1562de09b","source":"wordfence","cve":"CVE-2024-49670","title":"Client Power Tools Portal <= 1.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d563826-5b84-4fc9-a6e5-d6d1562de09b?source=api-prod","affected":[{"type":"plugin","slug":"client-power-tools","name":"Client Power Tools Portal","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:49:35Z"},{"id":"wordfence:7d567665-543c-4a6b-bb07-9388fea09ee9","source":"wordfence","cve":"CVE-2024-27992","title":"Link Whisper Free <= 0.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d567665-543c-4a6b-bb07-9388fea09ee9?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.6.8","to_inclusive":true,"patched_in":"0.6.9"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:51:00Z"},{"id":"wordfence:7d5a921c-992f-43d6-9083-9ac75637f66c","source":"wordfence","cve":"CVE-2026-81340","title":"MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5a921c-992f-43d6-9083-9ac75637f66c?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:29:53Z"},{"id":"wordfence:7d5ab2ab-aef7-4583-9bfe-52f18d418f37","source":"wordfence","cve":"CVE-2025-58938","title":"IDonatePro <= 2.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5ab2ab-aef7-4583-9bfe-52f18d418f37?source=api-prod","affected":[{"type":"plugin","slug":"idonate-pro","name":"IDonatePro - Blood Donation, Request And Donor Management WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-12-19T16:34:29Z"},{"id":"wordfence:7d5d05ad-1a7a-43d2-bbbf-597e975446be","source":"wordfence","cve":"CVE-2024-10924","title":"Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl-pro-multisite","name":"Really Simple Security Pro multisite","from":"9.0.0","from_inclusive":true,"to":"9.1.1.1","to_inclusive":true,"patched_in":"9.1.2"},{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"9.0.0","from_inclusive":true,"to":"9.1.1.1","to_inclusive":true,"patched_in":"9.1.2"},{"type":"plugin","slug":"really-simple-ssl-pro","name":"Really Simple Security Pro","from":"9.0.0","from_inclusive":true,"to":"9.1.1.1","to_inclusive":true,"patched_in":"9.1.2"}],"published":"2024-11-14T00:00:00Z","updated":"2024-11-15T09:30:27Z"},{"id":"wordfence:7d5dd7cd-f96a-48df-a553-be5e59d8290f","source":"wordfence","cve":"CVE-2024-2693","title":"Link Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5dd7cd-f96a-48df-a553-be5e59d8290f?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.7.1","to_inclusive":true,"patched_in":"0.7.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-09T18:59:02Z"},{"id":"wordfence:7d5f2f1c-e93d-4fc5-bf1b-2f18996f2b5b","source":"wordfence","cve":"CVE-2025-31633","title":"Kiamo - Responsive Business Service WordPress Theme < 1.3.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5f2f1c-e93d-4fc5-bf1b-2f18996f2b5b?source=api-prod","affected":[{"type":"theme","slug":"kiamo","name":"Kiamo - Responsive Business Service WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T19:33:57Z"},{"id":"wordfence:7d604ef5-7c49-44af-8e4f-242b98ba4ab8","source":"wordfence","cve":"CVE-2025-69133","title":"Tour Master - Tour Booking, Travel, Hotel <= 5.4.5 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d604ef5-7c49-44af-8e4f-242b98ba4ab8?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T13:52:36Z"},{"id":"wordfence:7d61b06b-6709-4f60-8324-53775dbb3c04","source":"wordfence","cve":"CVE-2018-20147","title":"WordPress Core < 5.0.1 -  Arbitrary File Deletion","severity":"high","cvss":7.7,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d61b06b-6709-4f60-8324-53775dbb3c04?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d61e6ea-4975-452a-8f9c-1c6d428372ac","source":"wordfence","cve":"CVE-2026-6246","title":"Simple Random Posts Shortcode <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d61e6ea-4975-452a-8f9c-1c6d428372ac?source=api-prod","affected":[{"type":"plugin","slug":"simple-random-posts-shortcode","name":"Simple Random Posts Shortcode","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:02:04Z","updated":"2026-04-22T07:45:38Z"},{"id":"wordfence:7d623512-ee99-4a73-a752-ecbb6ad96b63","source":"wordfence","cve":"CVE-2023-25990","title":"Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d623512-ee99-4a73-a752-ecbb6ad96b63?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d623840-30d1-4599-a52d-08c28e190699","source":"wordfence","cve":"CVE-2024-11686","title":"WhatsApp click to chat <= 3.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d623840-30d1-4599-a52d-08c28e190699?source=api-prod","affected":[{"type":"plugin","slug":"manycontacts-bar","name":"WhatsApp \ud83d\ude80 click to chat","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:03:43Z","updated":"2025-01-09T11:11:01Z"},{"id":"wordfence:7d636768-37b4-4343-9028-30e7b1f997f2","source":"wordfence","cve":"CVE-2025-0177","title":"Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d636768-37b4-4343-9028-30e7b1f997f2?source=api-prod","affected":[{"type":"plugin","slug":"javo-core","name":"Javo Core","from":"*","from_inclusive":true,"to":"3.0.0.080","to_inclusive":true,"patched_in":"3.0.0.266"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T08:22:57Z"},{"id":"wordfence:7d64a6e8-2649-422d-b004-67e061e58c2b","source":"wordfence","cve":"CVE-2025-49359","title":"ShieldGroup <= 2.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d64a6e8-2649-422d-b004-67e061e58c2b?source=api-prod","affected":[{"type":"theme","slug":"shieldgroup","name":"ShieldGroup | Insurance & Finance WordPress Theme","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:20:30Z"},{"id":"wordfence:7d6509b7-c1c1-44ef-9a86-d77cfb7fd5bd","source":"wordfence","cve":"CVE-2026-96765","title":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d6509b7-c1c1-44ef-9a86-d77cfb7fd5bd?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"44.1","to_inclusive":true,"patched_in":"45.0"}],"published":"2026-10-09T19:22:22Z","updated":"2026-10-10T07:41:45Z"},{"id":"wordfence:7d65a987-e8a6-4615-b681-9f48b7caed4f","source":"wordfence","cve":"CVE-2018-9172","title":"WordPress File Upload <= 4.3.2 - Cross-Site Scripting via Shortcodes","severity":"medium","cvss":4.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d65a987-e8a6-4615-b681-9f48b7caed4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2018-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d66694a-c99f-44f8-8004-1a47ad9f9250","source":"wordfence","cve":"CVE-2024-8268","title":"Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d66694a-c99f-44f8-8004-1a47ad9f9250?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T02:05:13Z"},{"id":"wordfence:7d68ada0-eddf-407e-95c6-5b9b0b52cd82","source":"wordfence","cve":"CVE-2025-46449","title":"WoWHead Tooltips <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d68ada0-eddf-407e-95c6-5b9b0b52cd82?source=api-prod","affected":[{"type":"plugin","slug":"wowhead-tooltips","name":"WoWHead Tooltips","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:44:24Z"},{"id":"wordfence:7d692242-4779-449a-94a7-88e202aaefc2","source":"wordfence","cve":"CVE-2024-2369","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d692242-4779-449a-94a7-88e202aaefc2?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-27T19:27:07Z"},{"id":"wordfence:7d6a09f5-029a-4710-b2bd-974d0d8348b1","source":"wordfence","cve":"CVE-2020-28040","title":"WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d6a09f5-029a-4710-b2bd-974d0d8348b1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d6c19e2-b280-4937-8f66-eac1da3cd365","source":"wordfence","cve":"CVE-2024-33572","title":"The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d6c19e2-b280-4937-8f66-eac1da3cd365?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:15:36Z"},{"id":"wordfence:7d70e56f-3bb2-4cfd-8998-e419bbdf016c","source":"wordfence","cve":"CVE-2024-50483","title":"Meetup <= 0.1 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d70e56f-3bb2-4cfd-8998-e419bbdf016c?source=api-prod","affected":[{"type":"plugin","slug":"meetup","name":"Meetup","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:59:27Z"},{"id":"wordfence:7d713de0-40a4-4926-9942-e5e2bf7434c4","source":"wordfence","cve":"CVE-2023-51537","title":"Awesome Support <= 6.1.5 - Missing Authorization via wpas_load_reply_history","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d713de0-40a4-4926-9942-e5e2bf7434c4?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d757080-d2dc-49f9-bdc6-dba762a8f981","source":"wordfence","cve":"CVE-2026-16495","title":"Countdown Timer \u2013 Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d757080-d2dc-49f9-bdc6-dba762a8f981?source=api-prod","affected":[{"type":"plugin","slug":"widget-countdown","name":"Countdown Timer \u2013 Widget Countdown","from":"3.0.0","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:36:40Z","updated":"2026-10-14T03:40:01Z"},{"id":"wordfence:7d75851d-4dd5-4fb4-97bc-fc63575e483e","source":"wordfence","cve":"CVE-2025-7058","title":"Kingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d75851d-4dd5-4fb4-97bc-fc63575e483e?source=api-prod","affected":[{"type":"theme","slug":"kingcabs","name":"Kingcabs","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2025-12-12T15:30:56Z","updated":"2025-12-13T04:31:28Z"},{"id":"wordfence:7d770e25-3b76-49a1-896b-adbdd91d1e47","source":"wordfence","cve":"CVE-2024-27192","title":"Configure SMTP <= 3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d770e25-3b76-49a1-896b-adbdd91d1e47?source=api-prod","affected":[{"type":"plugin","slug":"configure-smtp","name":"Configure SMTP","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-02-26T00:00:00Z","updated":"2026-02-26T14:54:23Z"},{"id":"wordfence:7d7a819a-97e6-444f-b48c-8fac9c405486","source":"wordfence","cve":"CVE-2025-49893","title":"Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7a819a-97e6-444f-b48c-8fac9c405486?source=api-prod","affected":[{"type":"plugin","slug":"elizaibot-chatbots","name":"Elizaibots","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2025-08-18T15:46:39Z"},{"id":"wordfence:7d7abd28-43be-49a7-9b2e-2e44e9208db1","source":"wordfence","cve":"CVE-2024-37937","title":"Rara Business <= 1.2.5 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7abd28-43be-49a7-9b2e-2e44e9208db1?source=api-prod","affected":[{"type":"theme","slug":"rara-business","name":"Rara Business","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:10:39Z"},{"id":"wordfence:7d7b1748-f946-4b70-9cf5-a035de158b20","source":"wordfence","cve":"CVE-2026-91077","title":"Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7b1748-f946-4b70-9cf5-a035de158b20?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"5.3.6","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:59:23Z"},{"id":"wordfence:7d7b2c79-c4f7-4611-a22a-685d4421a4ab","source":"wordfence","cve":"CVE-2025-12135","title":"WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7b2c79-c4f7-4611-a22a-685d4421a4ab?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-11-20T18:42:40Z","updated":"2025-11-21T07:31:51Z"},{"id":"wordfence:7d7da9c3-dc46-4c61-8737-052844939e93","source":"wordfence","cve":"","title":"123ContactForm for WordPress <= 1.5.6 - Arbitrary Post Creation","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7da9c3-dc46-4c61-8737-052844939e93?source=api-prod","affected":[{"type":"plugin","slug":"123contactform-for-wordpress","name":"123ContactForm for WordPress","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2021-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d7f2cb6-5c19-4126-9f39-439cf6057c5b","source":"wordfence","cve":"CVE-2024-13369","title":"Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d7f2cb6-5c19-4126-9f39-439cf6057c5b?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2025-02-17T21:19:23Z","updated":"2025-02-18T22:13:58Z"},{"id":"wordfence:7d81bc83-9e36-4fe9-8274-c65d17905f6e","source":"wordfence","cve":"","title":"Grimag <= 1.1.0 - Open Redirection","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d81bc83-9e36-4fe9-8274-c65d17905f6e?source=api-prod","affected":[{"type":"theme","slug":"Grimag","name":"Grimag","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2014-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d8365a6-dfa2-4753-b655-3c2bcadeae75","source":"wordfence","cve":"CVE-2022-39369","title":"phpCAS authentication library < 1.6.0 - Service Hostname Discovery Exploitation","severity":"high","cvss":8.0,"cwe":"CWE-1287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d8365a6-dfa2-4753-b655-3c2bcadeae75?source=api-prod","affected":[{"type":"plugin","slug":"authorizer","name":"Authorizer","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d849eda-4c61-47e2-af7c-59a57fffab65","source":"wordfence","cve":"CVE-2021-36905","title":"Quiz And Survey Master <= 7.3.4 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d849eda-4c61-47e2-af7c-59a57fffab65?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d8a3b41-efc1-4ad0-b9ca-80936831a368","source":"wordfence","cve":"CVE-2026-115953","title":"Geo Mashup <= 1.13.22 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d8a3b41-efc1-4ad0-b9ca-80936831a368?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.22","to_inclusive":true,"patched_in":"1.13.23"}],"published":"2026-10-26T10:27:00Z","updated":"2026-10-28T01:24:55Z"},{"id":"wordfence:7d8bee60-33f8-465b-80a9-90bc7a4d2054","source":"wordfence","cve":"CVE-2015-9304","title":"Ultimate Member <= 1.3.17 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d8bee60-33f8-465b-80a9-90bc7a4d2054?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d8dcf85-9009-4788-9a12-7f2656aa5595","source":"wordfence","cve":"","title":"JS Restaurant (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d8dcf85-9009-4788-9a12-7f2656aa5595?source=api-prod","affected":[{"type":"plugin","slug":"js-restaurant","name":"js-restaurant","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d90dad3-d7ef-4060-8328-fd551cee92e2","source":"wordfence","cve":"CVE-2023-32740","title":"Custom 404 Pro <= 3.8.1 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d90dad3-d7ef-4060-8328-fd551cee92e2?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d92790d-cc45-4507-b178-5f654383c90f","source":"wordfence","cve":"CVE-2024-51588","title":"Super Addons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d92790d-cc45-4507-b178-5f654383c90f?source=api-prod","affected":[{"type":"plugin","slug":"super-addons-for-elementor","name":"Super Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:17:58Z"},{"id":"wordfence:7d947023-60d3-4bd8-b45d-e1663326d6c1","source":"wordfence","cve":"CVE-2024-9669","title":"File Manager Pro \u2013 Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d947023-60d3-4bd8-b45d-e1663326d6c1?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2024-11-27T00:00:00Z","updated":"2026-01-23T16:08:13Z"},{"id":"wordfence:7d977636-a509-4f32-9ad3-762720fdb433","source":"wordfence","cve":"CVE-2023-50842","title":"MF Gig Calendar <=1.2.1 - Authenticated(Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d977636-a509-4f32-9ad3-762720fdb433?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7d98034d-e91e-4f37-8309-621555fcf309","source":"wordfence","cve":"CVE-2024-4483","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d98034d-e91e-4f37-8309-621555fcf309?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-09T17:22:20Z"},{"id":"wordfence:7d98f57f-5ae8-4669-8d79-cc3f236e7a8e","source":"wordfence","cve":"CVE-2025-28983","title":"Click & Pledge Connect <= 25.04010101-WP6.8 - Unauthenticated SQL Injection to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d98f57f-5ae8-4669-8d79-cc3f236e7a8e?source=api-prod","affected":[{"type":"plugin","slug":"click-pledge-connect","name":"Click & Pledge CONNECT","from":"*","from_inclusive":true,"to":"25.04010101-WP6.8","to_inclusive":true,"patched_in":"25.07000000-WP6.8.1"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-10T15:02:00Z"},{"id":"wordfence:7d9aca11-3930-42f0-9e08-0776049a2335","source":"wordfence","cve":"CVE-2026-103303","title":"Turisbook Booking System <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d9aca11-3930-42f0-9e08-0776049a2335?source=api-prod","affected":[{"type":"plugin","slug":"turisbook-booking-system","name":"Turisbook Booking System","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:07:41Z"},{"id":"wordfence:7d9b5f4e-5d98-49b2-adbb-1db906b07c45","source":"wordfence","cve":"CVE-2020-36656","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 1.14.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d9b5f4e-5d98-49b2-adbb-1db906b07c45?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.14.11","to_inclusive":true,"patched_in":"1.15.0"}],"published":"2023-01-24T00:00:00Z","updated":"2024-10-24T18:17:56Z"},{"id":"wordfence:7d9d7cab-c840-469f-ba2d-f81c785ffb8f","source":"wordfence","cve":"CVE-2024-32097","title":"GEO my WordPress <= 4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d9d7cab-c840-469f-ba2d-f81c785ffb8f?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:47:10Z"},{"id":"wordfence:7d9dc500-f7b5-418f-a6e3-116f844556d0","source":"wordfence","cve":"CVE-2025-3650","title":"jQuery Colorbox <= 4.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d9dc500-f7b5-418f-a6e3-116f844556d0?source=api-prod","affected":[{"type":"plugin","slug":"jquery-colorbox","name":"jQuery Colorbox","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-09-25T19:41:24Z"},{"id":"wordfence:7d9f27e4-2261-4e33-838c-93f4fabad80e","source":"wordfence","cve":"CVE-2026-105890","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7d9f27e4-2261-4e33-838c-93f4fabad80e?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.7.12.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:50Z"},{"id":"wordfence:7da00af0-edd1-4c39-ae33-a0dc21bd25a2","source":"wordfence","cve":"CVE-2024-1508","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da00af0-edd1-4c39-ae33-a0dc21bd25a2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T13:52:12Z"},{"id":"wordfence:7da114bc-158d-485c-ad3b-4b1c2a099d30","source":"wordfence","cve":"CVE-2025-69402","title":"R&F <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da114bc-158d-485c-ad3b-4b1c2a099d30?source=api-prod","affected":[{"type":"theme","slug":"rf","name":"R&F - Roof & Floor Carpenter WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:27:25Z"},{"id":"wordfence:7da1c26e-39da-4d54-ac5f-03b4d6241a77","source":"wordfence","cve":"CVE-2024-51801","title":"Brand my Footer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da1c26e-39da-4d54-ac5f-03b4d6241a77?source=api-prod","affected":[{"type":"plugin","slug":"brand-my-footer","name":"Brand my Footer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:48:59Z"},{"id":"wordfence:7da1d7cf-e8b5-4b7c-bdc1-13ef8c11b663","source":"wordfence","cve":"CVE-2022-3026","title":"WP Users Exporter <= 1.4.2 - CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da1d7cf-e8b5-4b7c-bdc1-13ef8c11b663?source=api-prod","affected":[{"type":"plugin","slug":"wp-users-exporter","name":"WP Users Exporter","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7da40b9c-5fb0-49d7-b0d7-bca32209d40d","source":"wordfence","cve":"CVE-2026-11962","title":"FileOrganizer <= 1.1.0 - Authenticated (Authenticated+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da40b9c-5fb0-49d7-b0d7-bca32209d40d?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T22:36:24Z"},{"id":"wordfence:7da41c7c-31c4-4e95-ac5a-25bd17e507b9","source":"wordfence","cve":"CVE-2024-11808","title":"Pingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da41c7c-31c4-4e95-ac5a-25bd17e507b9?source=api-prod","affected":[{"type":"plugin","slug":"pingmeter-uptime-monitoring","name":"Pingmeter Uptime Monitoring","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T20:09:39Z","updated":"2024-12-21T08:24:00Z"},{"id":"wordfence:7da44874-fa6f-49f7-96e2-cff6a40e23b2","source":"wordfence","cve":"CVE-2026-97315","title":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns < 2.3.0 - Unauthenticated Arbitrary HTML Injection in Notification Email","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da44874-fa6f-49f7-96e2-cff6a40e23b2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:06:17Z"},{"id":"wordfence:7da4e3a2-29b3-47f3-b3fb-3a6ad0b8b8ac","source":"wordfence","cve":"CVE-2026-57811","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7da4e3a2-29b3-47f3-b3fb-3a6ad0b8b8ac?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:29:44Z"},{"id":"wordfence:7dab03b8-6ed9-4f08-bd52-0f507de882de","source":"wordfence","cve":"CVE-2016-10966","title":"Real3D Flipbook <= 1.0.0 - File Upload to User Controlled Location","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dab03b8-6ed9-4f08-bd52-0f507de882de?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2016-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7db04a93-a384-4093-8cab-6f1d6822f625","source":"wordfence","cve":"CVE-2023-1405","title":"Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7db04a93-a384-4093-8cab-6f1d6822f625?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.2"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7db0a94e-2633-4f62-adb6-9acb3f884cb8","source":"wordfence","cve":"CVE-2026-24965","title":"Contest Gallery <= 28.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7db0a94e-2633-4f62-adb6-9acb3f884cb8?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.1","to_inclusive":true,"patched_in":"28.1.2"}],"published":"2026-01-09T00:00:00Z","updated":"2026-02-10T19:45:40Z"},{"id":"wordfence:7db3475a-3a70-4776-8ea3-337192f88973","source":"wordfence","cve":"CVE-2026-100106","title":"FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7db3475a-3a70-4776-8ea3-337192f88973?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.34.2","to_inclusive":true,"patched_in":"1.34.3"}],"published":"2026-10-15T18:46:42Z","updated":"2026-10-16T07:44:03Z"},{"id":"wordfence:7db39101-f16d-4a4b-8165-437af63d55e7","source":"wordfence","cve":"CVE-2026-8902","title":"AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7db39101-f16d-4a4b-8165-437af63d55e7?source=api-prod","affected":[{"type":"plugin","slug":"report-comments","name":"AJAX Report Comments","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:25Z","updated":"2026-06-09T03:41:20Z"},{"id":"wordfence:7db401e4-59d5-4a04-84bb-061098bf9e66","source":"wordfence","cve":"CVE-2024-54292","title":"Appsplate <= 2.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7db401e4-59d5-4a04-84bb-061098bf9e66?source=api-prod","affected":[{"type":"plugin","slug":"appsplate","name":"Appsplate","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:43:49Z"},{"id":"wordfence:7dba6e37-3d16-428f-9c68-724c850ef53d","source":"wordfence","cve":"CVE-2026-57793","title":"Flow <= 1.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dba6e37-3d16-428f-9c68-724c850ef53d?source=api-prod","affected":[{"type":"theme","slug":"flow","name":"Flow","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:36:21Z"},{"id":"wordfence:7dbb6c21-8a70-44b9-9915-3f146a2066ce","source":"wordfence","cve":"CVE-2016-1000136","title":"Heat Trackr < 1.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbb6c21-8a70-44b9-9915-3f146a2066ce?source=api-prod","affected":[{"type":"plugin","slug":"heat-trackr","name":"heat-trackr","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":false,"patched_in":"1.01"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dbca642-c7ee-4c43-b8b5-99784a6f58f1","source":"wordfence","cve":"CVE-2025-24771","title":"Content Manager Light <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbca642-c7ee-4c43-b8b5-99784a6f58f1?source=api-prod","affected":[{"type":"plugin","slug":"content-manager-light","name":"Content Manager Light","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:00:02Z"},{"id":"wordfence:7dbd3b23-cebc-4212-bcae-c6f23031c040","source":"wordfence","cve":"CVE-2023-28784","title":"Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbd3b23-cebc-4212-bcae-c6f23031c040?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.1.2","to_inclusive":true,"patched_in":"21.1.2.1"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dbf982f-c83f-4980-b758-9e241e0de67b","source":"wordfence","cve":"CVE-2024-33644","title":"Customify Site Library <= 0.0.9 - Unauthenticated Remote Code Execution","severity":"critical","cvss":10.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbf982f-c83f-4980-b758-9e241e0de67b?source=api-prod","affected":[{"type":"plugin","slug":"customify-sites","name":"Customify Site Library","from":"*","from_inclusive":true,"to":"0.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:19:26Z"},{"id":"wordfence:7dc02b21-5102-4789-8db4-84014f8807ca","source":"wordfence","cve":"CVE-2025-64359","title":"Consulting < 6.7.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc02b21-5102-4789-8db4-84014f8807ca?source=api-prod","affected":[{"type":"theme","slug":"consulting","name":"Consulting","from":"*","from_inclusive":true,"to":"6.7.5","to_inclusive":false,"patched_in":"6.7.5"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-03T18:09:26Z"},{"id":"wordfence:7dc267d5-ecea-4732-b716-dfaf63167b81","source":"wordfence","cve":"","title":"Claptastic Clap! Button <= 1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc267d5-ecea-4732-b716-dfaf63167b81?source=api-prod","affected":[{"type":"plugin","slug":"claptastic-clap-button","name":"Claptastic Clap! Button","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2016-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dc34ff1-1b7e-4974-907a-745911df5dc8","source":"wordfence","cve":"CVE-2024-24837","title":"FG Drupal to WordPress <= 3.67.0 - Cross-Site Request Forgery via ajax_importer","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc34ff1-1b7e-4974-907a-745911df5dc8?source=api-prod","affected":[{"type":"plugin","slug":"fg-joomla-to-wordpress","name":"FG Joomla to WordPress","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.17.0"},{"type":"plugin","slug":"fg-prestashop-to-woocommerce","name":"FG PrestaShop to WooCommerce","from":"*","from_inclusive":true,"to":"4.44.3","to_inclusive":true,"patched_in":"4.45.0"},{"type":"plugin","slug":"fg-drupal-to-wp","name":"FG Drupal to WordPress","from":"*","from_inclusive":true,"to":"3.67.0","to_inclusive":true,"patched_in":"3.68.0"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:31:21Z"},{"id":"wordfence:7dc41eb7-5c9a-4a67-902d-9a855840668b","source":"wordfence","cve":"CVE-2024-4274","title":"Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc41eb7-5c9a-4a67-902d-9a855840668b?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2024-06-03T16:39:54Z","updated":"2024-07-08T20:44:45Z"},{"id":"wordfence:7dc46bc4-ecfb-438f-b951-7b957489cd96","source":"wordfence","cve":"CVE-2026-4331","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc46bc4-ecfb-438f-b951-7b957489cd96?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.8.2","to_inclusive":true,"patched_in":"8.8.3"}],"published":"2026-03-25T14:26:40Z","updated":"2026-03-26T03:37:27Z"},{"id":"wordfence:7dc47704-656c-4258-9808-c6c33d67461c","source":"wordfence","cve":"CVE-2026-28046","title":"Law Office <= 3.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc47704-656c-4258-9808-c6c33d67461c?source=api-prod","affected":[{"type":"theme","slug":"law-office","name":"Law Office","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:04:17Z"},{"id":"wordfence:7dc65c3e-b55f-416a-8315-36a3d9483154","source":"wordfence","cve":"CVE-2026-24369","title":"The Grid < 2.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc65c3e-b55f-416a-8315-36a3d9483154?source=api-prod","affected":[{"type":"plugin","slug":"the-grid","name":"The Grid","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T14:53:35Z"},{"id":"wordfence:7dc6d1db-37ae-4198-84bd-944dad4926c7","source":"wordfence","cve":"CVE-2024-0856","title":"Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6d1db-37ae-4198-84bd-944dad4926c7?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.82","to_inclusive":true,"patched_in":"1.3.83"}],"published":"2024-02-28T00:00:00Z","updated":"2024-04-24T14:50:28Z"},{"id":"wordfence:7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22","source":"wordfence","cve":"CVE-2025-13362","title":"Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc6f6e2-6777-4056-95d0-e3d3e7ad7a22?source=api-prod","affected":[{"type":"plugin","slug":"norby-ai","name":"Norby AI","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:26:16Z","updated":"2025-12-05T04:29:11Z"},{"id":"wordfence:7dc9973a-4b5f-4efb-8df5-df1cbf9fe3b0","source":"wordfence","cve":"","title":"EZ Portfolio (Unmaintained) < 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc9973a-4b5f-4efb-8df5-df1cbf9fe3b0?source=api-prod","affected":[{"type":"plugin","slug":"ez-portfolio","name":"EZ Portfolio (Unmaintained)","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2015-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dc9c0ed-a77c-4ad8-8e6e-75c1a2998fe6","source":"wordfence","cve":"","title":"Slideshow Gallery <= 1.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc9c0ed-a77c-4ad8-8e6e-75c1a2998fe6?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2016-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dc9dc1c-2d79-4dc3-9fee-be5d591d2400","source":"wordfence","cve":"","title":"Google Analytics Counter Tracker <= 3.4.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc9dc1c-2d79-4dc3-9fee-be5d591d2400?source=api-prod","affected":[{"type":"plugin","slug":"analytics-counter","name":"Google Analytics Counter Tracker","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":false,"patched_in":"3.5.0"}],"published":"2016-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dcc3c09-8bd2-4a08-a368-3f406170081e","source":"wordfence","cve":"CVE-2013-2741","title":"BackupBuddy < 3.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dcc3c09-8bd2-4a08-a368-3f406170081e?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2013-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dcd0c5a-757d-4256-ac0a-36620914bc45","source":"wordfence","cve":"CVE-2016-10865","title":"Lightbox Plus <= 2.7.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dcd0c5a-757d-4256-ac0a-36620914bc45?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-plus","name":"Lightbox Plus","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":""}],"published":"2016-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dcd3452-a340-44e5-b292-347dc69ab863","source":"wordfence","cve":"CVE-2023-27619","title":"Regina Lite <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dcd3452-a340-44e5-b292-347dc69ab863?source=api-prod","affected":[{"type":"theme","slug":"regina-lite","name":"Regina Lite","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dcde10d-4eb7-42fe-926e-05e56affc521","source":"wordfence","cve":"CVE-2023-47645","title":"RegistrationMagic <= 5.2.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dcde10d-4eb7-42fe-926e-05e56affc521?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.2.6","to_inclusive":true,"patched_in":"5.2.3.0"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dce295a-a191-4a61-8fb4-7bf705138738","source":"wordfence","cve":"CVE-2025-69144","title":"Preservation <= 1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dce295a-a191-4a61-8fb4-7bf705138738?source=api-prod","affected":[{"type":"theme","slug":"preservation","name":"Preservation","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:11:43Z"},{"id":"wordfence:7dd02ebc-41dd-4499-ad3e-a81259a76b53","source":"wordfence","cve":"CVE-2026-87856","title":"Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd02ebc-41dd-4499-ad3e-a81259a76b53?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"2.0.0","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:09:15Z"},{"id":"wordfence:7dd030ce-0457-4890-a880-89284f336e94","source":"wordfence","cve":"CVE-2026-10824","title":"Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd030ce-0457-4890-a880-89284f336e94?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-06-04T00:00:00Z","updated":"2026-08-21T13:50:44Z"},{"id":"wordfence:7dd18e4e-9aa6-403e-aec3-21f33d739066","source":"wordfence","cve":"CVE-2025-12014","title":"NGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd18e4e-9aa6-403e-aec3-21f33d739066?source=api-prod","affected":[{"type":"plugin","slug":"nginx-cache-optimizer","name":"NGINX Cache Optimizer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T20:08:31Z","updated":"2025-10-24T08:24:02Z"},{"id":"wordfence:7dd2732d-5586-404f-b3fe-98748361b5f0","source":"wordfence","cve":"CVE-2024-38749","title":"Olive One Click Demo Import <= 1.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd2732d-5586-404f-b3fe-98748361b5f0?source=api-prod","affected":[{"type":"plugin","slug":"olive-one-click-demo-import","name":"Olive One Click Demo Import","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:11:43Z"},{"id":"wordfence:7dd45dc7-b37c-42f3-a4b5-c4564174148c","source":"wordfence","cve":"CVE-2022-1683","title":"amtyThumb <= 4.2.0 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd45dc7-b37c-42f3-a4b5-c4564174148c?source=api-prod","affected":[{"type":"plugin","slug":"amtythumb","name":"amtyThumb","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dd67111-514f-4f7d-8cdd-7b10ea718530","source":"wordfence","cve":"CVE-2023-23713","title":"Theme Tweaker <= 5.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd67111-514f-4f7d-8cdd-7b10ea718530?source=api-prod","affected":[{"type":"plugin","slug":"theme-tweaker-lite","name":"Theme Tweaker","from":"*","from_inclusive":true,"to":"5.20","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dd6f9d2-e6c2-49fa-a4bb-1f2126809a06","source":"wordfence","cve":"","title":"Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd6f9d2-e6c2-49fa-a4bb-1f2126809a06?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dd7542a-357e-4a0f-879d-794b3451668e","source":"wordfence","cve":"CVE-2025-39411","title":"WhatsApp Click to Chat Plugin for WordPress <= 2.2.12 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd7542a-357e-4a0f-879d-794b3451668e?source=api-prod","affected":[{"type":"plugin","slug":"wpt-whatsapp","name":"wpt-whatsapp","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:50:03Z"},{"id":"wordfence:7dd90aa0-492f-455b-a889-a8cd5e389958","source":"wordfence","cve":"CVE-2026-115606","title":"DXP ToolKit <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd90aa0-492f-455b-a889-a8cd5e389958?source=api-prod","affected":[{"type":"plugin","slug":"dxp-toolkit","name":"DXP ToolKit","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-10-26T12:09:00Z","updated":"2026-11-03T19:27:35Z"},{"id":"wordfence:7dd95956-d86b-4198-a3b9-d5d9308f36dd","source":"wordfence","cve":"CVE-2021-25044","title":"Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dd95956-d86b-4198-a3b9-d5d9308f36dd?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-pricing-list","name":"Cryptocurrency Pricing list and Ticker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ddabda2-1e27-4b87-b643-b0166112a890","source":"wordfence","cve":"CVE-2023-32964","title":"Better Notifications for WP <= 1.9.2 - Cross-Site Request Forgery via handle_actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ddabda2-1e27-4b87-b643-b0166112a890?source=api-prod","affected":[{"type":"plugin","slug":"bnfw","name":"Customize WordPress Emails and Alerts \u2013 Better Notifications for WP","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ddbf1e0-55a9-45d6-953b-0a2e413dbb9d","source":"wordfence","cve":"CVE-2026-16746","title":"MultiVendorX <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Store Owner+) Cross-Store Commission Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ddbf1e0-55a9-45d6-953b-0a2e413dbb9d?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:43:29Z"},{"id":"wordfence:7ddd27ba-ae65-4bb4-989d-0d677e15077a","source":"wordfence","cve":"CVE-2023-0479","title":"Print Invoice & Delivery Notes for WooCommerce <= 4.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ddd27ba-ae65-4bb4-989d-0d677e15077a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dded505-8968-4ed2-8883-42a3ec50155c","source":"wordfence","cve":"CVE-2025-5684","title":"MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dded505-8968-4ed2-8883-42a3ec50155c?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-07-29T07:07:14Z","updated":"2025-07-29T19:42:34Z"},{"id":"wordfence:7ddf167e-f436-4150-87e2-69c970952cd9","source":"wordfence","cve":"CVE-2026-24576","title":"UX Flat <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ddf167e-f436-4150-87e2-69c970952cd9?source=api-prod","affected":[{"type":"plugin","slug":"ux-flat","name":"UX Flat","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:15:04Z"},{"id":"wordfence:7de132d5-51c9-464c-b687-8e367dd8d846","source":"wordfence","cve":"CVE-2023-5737","title":"WordPress Backup & Migration <= 1.4.3 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de132d5-51c9-464c-b687-8e367dd8d846?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7de26eac-9726-4285-8f65-439f318d8687","source":"wordfence","cve":"CVE-2026-25470","title":"ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de26eac-9726-4285-8f65-439f318d8687?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-post-type","name":"ACPT (Premium)","from":"*","from_inclusive":true,"to":"2.0.47","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:52:07Z"},{"id":"wordfence:7de2cb7a-dc3d-41f2-8faa-9e87f78531b5","source":"wordfence","cve":"CVE-2026-12902","title":"Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de2cb7a-dc3d-41f2-8faa-9e87f78531b5?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-01T03:43:36Z"},{"id":"wordfence:7de3606a-254c-4e5f-9499-b1cc79dce7c8","source":"wordfence","cve":"CVE-2026-107652","title":"Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de3606a-254c-4e5f-9499-b1cc79dce7c8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-10-13T12:38:18Z","updated":"2026-10-14T01:27:16Z"},{"id":"wordfence:7de4282f-157b-4ba0-b400-e4e9982beb31","source":"wordfence","cve":"CVE-2023-39923","title":"The Post Grid <= 7.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de4282f-157b-4ba0-b400-e4e9982beb31?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7de51bf2-f3dc-40d7-8d63-c85c267c4e98","source":"wordfence","cve":"CVE-2021-24575","title":"School Management System \u2013 WPSchoolPress <= 2.1.9 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de51bf2-f3dc-40d7-8d63-c85c267c4e98?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":false,"patched_in":"2.1.10"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7de5cb89-240a-4ba3-a82c-261629620948","source":"wordfence","cve":"CVE-2022-4678","title":"TemplatesNext ToolKit <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de5cb89-240a-4ba3-a82c-261629620948?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-toolkit","name":"TemplatesNext ToolKit","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7de6415a-5236-46ec-ae2e-f4ec40c90f4d","source":"wordfence","cve":"CVE-2024-30555","title":"Ultimate Social Comments \u2013 Email Notification & Lazy Load <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7de6415a-5236-46ec-ae2e-f4ec40c90f4d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-facebook-comments","name":"Ultimate Social Comments \u2013 Email Notification & Lazy Load","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:06:36Z"},{"id":"wordfence:7dea9b4a-d7a5-4ea7-b55f-b42f8f5c4a91","source":"wordfence","cve":"CVE-2025-8142","title":"Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dea9b4a-d7a5-4ea7-b55f-b42f8f5c4a91?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.7","to_inclusive":true,"patched_in":"8.6.8"}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T11:11:24Z"},{"id":"wordfence:7def307b-5788-4cb4-82a4-517c5c9fe500","source":"wordfence","cve":"","title":"Easy Media Download <= 1.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7def307b-5788-4cb4-82a4-517c5c9fe500?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-download","name":"Easy Media Download","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2020-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7df0ea8a-5e2c-4f5e-a326-b92df37ffa3c","source":"wordfence","cve":"CVE-2025-13066","title":"Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df0ea8a-5e2c-4f5e-a326-b92df37ffa3c?source=api-prod","affected":[{"type":"plugin","slug":"demo-importer-plus","name":"Demo Importer Plus","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-12-04T14:25:28Z","updated":"2025-12-05T03:28:36Z"},{"id":"wordfence:7df1901f-fb18-4d1b-ac80-38b676efb64f","source":"wordfence","cve":"CVE-2024-53776","title":"Donate Me <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df1901f-fb18-4d1b-ac80-38b676efb64f?source=api-prod","affected":[{"type":"plugin","slug":"donate-me","name":"Donate Me","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-11-28T00:00:00Z","updated":"2026-05-11T19:38:36Z"},{"id":"wordfence:7df2996f-bc0e-4608-a80e-6167ac26469a","source":"wordfence","cve":"CVE-2024-29924","title":"Premium Packages <= 5.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df2996f-bc0e-4608-a80e-6167ac26469a?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.8.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:36:02Z"},{"id":"wordfence:7df39a64-76c5-4ebe-a271-44bd147a3a86","source":"wordfence","cve":"CVE-2024-9161","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df39a64-76c5-4ebe-a271-44bd147a3a86?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.228","to_inclusive":true,"patched_in":"1.0.229"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T11:21:19Z"},{"id":"wordfence:7df452c9-4e73-40d7-88a3-d38ae1309d8f","source":"wordfence","cve":"CVE-2024-13477","title":"LTL Freight Quotes \u2013 Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df452c9-4e73-40d7-88a3-d38ae1309d8f?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-unishippers-edition","name":"LTL Freight Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-02-11T21:27:24Z","updated":"2025-02-12T11:11:18Z"},{"id":"wordfence:7df7f541-b8aa-46fa-bfca-b333beea27f9","source":"wordfence","cve":"CVE-2026-8626","title":"SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df7f541-b8aa-46fa-bfca-b333beea27f9?source=api-prod","affected":[{"type":"plugin","slug":"sponsorme","name":"SponsorMe","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:08:15Z","updated":"2026-05-20T01:25:50Z"},{"id":"wordfence:7df85c11-6308-4b23-8c41-eea6bff5ca50","source":"wordfence","cve":"CVE-2022-4474","title":"Easy Social Feed <= 6.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7df85c11-6308-4b23-8c41-eea6bff5ca50?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dfa42ad-9b5d-43d6-97b6-f105d31dd141","source":"wordfence","cve":"CVE-2025-62018","title":"Kallyas <= 4.22.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfa42ad-9b5d-43d6-97b6-f105d31dd141?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:16:48Z"},{"id":"wordfence:7dfa84ed-0edf-4a75-8ec3-986c3880353c","source":"wordfence","cve":"","title":"Easy Social Icons <= 3.1.4 - Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfa84ed-0edf-4a75-8ec3-986c3880353c?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dfb7e28-7fd4-4023-bd20-44eb834a1a79","source":"wordfence","cve":"CVE-2026-28569","title":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects <= 4.7.43 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfb7e28-7fd4-4023-bd20-44eb834a1a79?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.7.43","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-03T16:24:40Z"},{"id":"wordfence:7dfc419d-dc45-43f2-8899-0181523180ba","source":"wordfence","cve":"CVE-2025-39362","title":"Mollie Payments for WooCommerce <= 8.0.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfc419d-dc45-43f2-8899-0181523180ba?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":true,"patched_in":"8.0.3"}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-08T16:01:49Z"},{"id":"wordfence:7dfcc252-1da3-4504-9b63-75bbd6a9765a","source":"wordfence","cve":"CVE-2024-12724","title":"WP DeskLite \u2013 Helpdesk and Support Plugin <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfcc252-1da3-4504-9b63-75bbd6a9765a?source=api-prod","affected":[{"type":"plugin","slug":"wp-desklite","name":"WP DeskLite \u2013 Helpdesk and Support Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-05-29T17:56:24Z"},{"id":"wordfence:7dfd0246-4265-4dde-8a1e-18b7042eae74","source":"wordfence","cve":"CVE-2023-4924","title":"BEAR <= 1.1.3.3 - Missing Authorization to Product Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dfd0246-4265-4dde-8a1e-18b7042eae74?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dff5a77-a5d6-4aba-bf39-aa110a4f4996","source":"wordfence","cve":"CVE-2015-8834","title":"WordPress Core < 4.2.2 - Cross-Site Scripting via Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dff5a77-a5d6-4aba-bf39-aa110a4f4996?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"3.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2015-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7dff9b5f-def3-420b-a28f-e0d225747c52","source":"wordfence","cve":"CVE-2024-47353","title":"ElementsReady Addons for Elementor  6.4.2 -  Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7dff9b5f-def3-420b-a28f-e0d225747c52?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"6.4.2","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:47:03Z"},{"id":"wordfence:7e033919-ca00-4789-8635-b4189e1499ef","source":"wordfence","cve":"CVE-2026-5341","title":"NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e033919-ca00-4789-8635-b4189e1499ef?source=api-prod","affected":[{"type":"plugin","slug":"nmr-strava-activities","name":"NMR Strava activities","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2026-05-07T21:24:20Z","updated":"2026-05-08T09:26:53Z"},{"id":"wordfence:7e069678-0c0a-4e4a-b0ee-404f488f9d01","source":"wordfence","cve":"CVE-2024-31378","title":"MailChimp Forms by MailMunch <= 3.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e069678-0c0a-4e4a-b0ee-404f488f9d01?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:58:57Z"},{"id":"wordfence:7e092d67-ab81-4366-824c-cfb240ba3042","source":"wordfence","cve":"CVE-2023-5620","title":"Webpushr <= 4.34.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e092d67-ab81-4366-824c-cfb240ba3042?source=api-prod","affected":[{"type":"plugin","slug":"webpushr-web-push-notifications","name":"Web Push Notifications \u2013 Webpushr","from":"*","from_inclusive":true,"to":"4.34.0","to_inclusive":true,"patched_in":"4.35.0"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e0a6ba5-6b2a-49b2-8780-df5eb6a5eecd","source":"wordfence","cve":"CVE-2026-96666","title":"Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0a6ba5-6b2a-49b2-8780-df5eb6a5eecd?source=api-prod","affected":[{"type":"plugin","slug":"schema-app-structured-data-for-schemaorg","name":"Schema App Structured Data","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:46:32Z","updated":"2026-10-29T03:39:15Z"},{"id":"wordfence:7e0abbd5-fe2d-49b5-9a7e-859ea3a64496","source":"wordfence","cve":"CVE-2025-23746","title":"CMC MIGRATE <= 0.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0abbd5-fe2d-49b5-9a7e-859ea3a64496?source=api-prod","affected":[{"type":"plugin","slug":"cmc-migrate","name":"CMC MIGRATE","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:32:40Z"},{"id":"wordfence:7e0b8ef5-739c-4c9a-9b44-e5bd977c7359","source":"wordfence","cve":"CVE-2026-107158","title":"LTL Freight Quotes \u2013 ODFL Edition < 4.2.19 - Missing Authorization to Unauthenticated Settings Modification","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0b8ef5-739c-4c9a-9b44-e5bd977c7359?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-odfl-edition","name":"LTL Freight Quotes \u2013 ODFL Edition","from":"*","from_inclusive":true,"to":"4.2.19","to_inclusive":false,"patched_in":"4.2.19"}],"published":"2026-10-14T00:00:00Z","updated":"2026-11-03T19:35:01Z"},{"id":"wordfence:7e0b9dd4-d882-4f56-9f6b-2f2955690a05","source":"wordfence","cve":"","title":"Bonuspressx (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0b9dd4-d882-4f56-9f6b-2f2955690a05?source=api-prod","affected":[{"type":"plugin","slug":"bonuspressx","name":"Bonuspressx","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e0c9369-55ba-4c1c-a222-d114d146b031","source":"wordfence","cve":"CVE-2025-49052","title":"Netease Music <= 3.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0c9369-55ba-4c1c-a222-d114d146b031?source=api-prod","affected":[{"type":"plugin","slug":"netease-music","name":"Netease Music","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T18:34:50Z"},{"id":"wordfence:7e0cbef8-223a-44c0-a07f-28de2670da99","source":"wordfence","cve":"CVE-2025-11263","title":"Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0cbef8-223a-44c0-a07f-28de2670da99?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.8.8","to_inclusive":true,"patched_in":"0.8.9"}],"published":"2025-12-05T14:52:44Z","updated":"2025-12-06T03:27:05Z"},{"id":"wordfence:7e0ccf7e-1276-4aa8-872f-440528699ba9","source":"wordfence","cve":"CVE-2024-37096","title":"Popup box <= 4.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0ccf7e-1276-4aa8-872f-440528699ba9?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:15:54Z"},{"id":"wordfence:7e0e00ec-f7c2-4c1b-802a-acf0892d2083","source":"wordfence","cve":"CVE-2024-43343","title":"Order Tracking <= 3.3.11 - Missing Authorization via send_test_email()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0e00ec-f7c2-4c1b-802a-acf0892d2083?source=api-prod","affected":[{"type":"plugin","slug":"order-tracking","name":"Order Tracking \u2013 WordPress Status Tracking Plugin","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":"3.3.12b"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:15:54Z"},{"id":"wordfence:7e0ef4a5-42d7-4cea-b19f-51917e3ee55f","source":"wordfence","cve":"CVE-2024-0453","title":"AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback","severity":"medium","cvss":5.0,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0ef4a5-42d7-4cea-b19f-51917e3ee55f?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2024-05-21T00:00:00Z","updated":"2024-07-29T21:36:42Z"},{"id":"wordfence:7e0f903a-e882-4de9-953a-c377b591004e","source":"wordfence","cve":"CVE-2017-18590","title":"Help Center by BestWebSoft < 0.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0f903a-e882-4de9-953a-c377b591004e?source=api-prod","affected":[{"type":"plugin","slug":"timesheet","name":"Timesheet by BestWebSoft","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":false,"patched_in":"0.1.5"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e0fd44d-e152-4883-a734-031f68e3ba97","source":"wordfence","cve":"CVE-2022-2172","title":"LinkWorth plugin <= 3.3.3 - Cross-Site Request Forgery to Plugin Setting Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0fd44d-e152-4883-a734-031f68e3ba97?source=api-prod","affected":[{"type":"plugin","slug":"linkworth-wp-plugin","name":"LinkWorth Plugin","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e10babc-fc65-46f9-8b88-95b00f66d01b","source":"wordfence","cve":"CVE-2022-3847","title":"Showing URL in QR Code <= 0.0.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e10babc-fc65-46f9-8b88-95b00f66d01b?source=api-prod","affected":[{"type":"plugin","slug":"get-site-to-phone-by-qr-code","name":"Showing URL in QR Code","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e144feb-0062-4f05-8f19-e4d493991fa1","source":"wordfence","cve":"CVE-2026-22405","title":"Overton - Creative WordPress Theme for Agencies and Freelancers <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e144feb-0062-4f05-8f19-e4d493991fa1?source=api-prod","affected":[{"type":"theme","slug":"overton","name":"Overton - Creative WordPress Theme for Agencies and Freelancers","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:42:16Z"},{"id":"wordfence:7e15f804-f5a9-4e29-8aeb-4ba2b116dc46","source":"wordfence","cve":"CVE-2023-48778","title":"Product Size Chart For WooCommerce <= 1.1.5 - Cross-Site Request Forgery via get_save_option","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e15f804-f5a9-4e29-8aeb-4ba2b116dc46?source=api-prod","affected":[{"type":"plugin","slug":"product-size-chart-for-woo","name":"Sizor Product Size Chart for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-24T13:36:26Z"},{"id":"wordfence:7e1885be-dc9f-4858-a155-ad6fcc117d0d","source":"wordfence","cve":"CVE-2024-33630","title":"Piotnet Addons For Elementor <= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1885be-dc9f-4858-a155-ad6fcc117d0d?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-17T13:32:06Z"},{"id":"wordfence:7e199cd3-e2ce-4969-a517-4a9c2a84bf44","source":"wordfence","cve":"","title":"Travelpayouts <= 1.0.16 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e199cd3-e2ce-4969-a517-4a9c2a84bf44?source=api-prod","affected":[{"type":"plugin","slug":"travelpayouts","name":"Travelpayouts: All Travel Brands in One Place","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e19a144-55b9-4a32-b2d6-cb70be241d10","source":"wordfence","cve":"CVE-2024-54407","title":"CK and SyntaxHighlighter <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e19a144-55b9-4a32-b2d6-cb70be241d10?source=api-prod","affected":[{"type":"plugin","slug":"ck-and-syntaxhighlighter","name":"CK and SyntaxHighlighter","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:42:45Z"},{"id":"wordfence:7e1bb306-c1a4-4b59-ad57-a9ca4500b049","source":"wordfence","cve":"CVE-2019-15830","title":"Icegram <= 1.10.28.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1bb306-c1a4-4b59-ad57-a9ca4500b049?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"1.10.28.2","to_inclusive":true,"patched_in":"1.10.29"}],"published":"2019-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e1cdaf3-76fe-4b73-b30b-4554f0d34d11","source":"wordfence","cve":"CVE-2024-3519","title":"Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang","severity":"medium","cvss":6.1,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1cdaf3-76fe-4b73-b30b-4554f0d34d11?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.15","to_inclusive":true,"patched_in":"3.16"}],"published":"2024-05-21T11:13:42Z","updated":"2024-05-21T23:30:41Z"},{"id":"wordfence:7e1d4080-cd8a-455a-85f4-87f195ebe4a2","source":"wordfence","cve":"CVE-2022-45363","title":"Betheme <= 26.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1d4080-cd8a-455a-85f4-87f195ebe4a2?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.2","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e1ec075-5971-46e3-ba2c-e01ab30a1767","source":"wordfence","cve":"CVE-2025-23536","title":"Track Page Scroll <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e1ec075-5971-46e3-ba2c-e01ab30a1767?source=api-prod","affected":[{"type":"plugin","slug":"track-page-scroll","name":"Track Page Scroll","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-11T13:51:24Z"},{"id":"wordfence:7e2014bd-2809-4f79-913d-d7a35eda63ef","source":"wordfence","cve":"CVE-2023-26519","title":"Publish to Schedule <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e2014bd-2809-4f79-913d-d7a35eda63ef?source=api-prod","affected":[{"type":"plugin","slug":"publish-to-schedule","name":"Publish to Schedule","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e210be9-3acb-4b42-8882-0f5f57eac964","source":"wordfence","cve":"CVE-2025-30557","title":"Easy 301 Redirects <= 1.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e210be9-3acb-4b42-8882-0f5f57eac964?source=api-prod","affected":[{"type":"plugin","slug":"odihost-easy-redirect-301","name":"Easy 301 Redirects","from":"*","from_inclusive":true,"to":"1.33","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:57:21Z"},{"id":"wordfence:7e232114-c14a-43a7-bc78-423f7e5b35fb","source":"wordfence","cve":"CVE-2024-37448","title":"OnePress <= 2.3.6 - Cross-Site Request Forgery via save_settings()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e232114-c14a-43a7-bc78-423f7e5b35fb?source=api-prod","affected":[{"type":"theme","slug":"onepress","name":"OnePress","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:55:22Z"},{"id":"wordfence:7e23b7a5-8ee6-4818-a52e-4fa66bee02e2","source":"wordfence","cve":"CVE-2025-39434","title":"Avatar <= 0.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e23b7a5-8ee6-4818-a52e-4fa66bee02e2?source=api-prod","affected":[{"type":"plugin","slug":"avatar","name":"Avatar","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:33:24Z"},{"id":"wordfence:7e23fcd0-62b4-460d-9b64-8adbf14bf820","source":"wordfence","cve":"CVE-2026-88944","title":"Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e23fcd0-62b4-460d-9b64-8adbf14bf820?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2026-09-18T14:03:05Z","updated":"2026-09-19T02:27:11Z"},{"id":"wordfence:7e24383b-5b0f-4114-908b-4c2778632f73","source":"wordfence","cve":"CVE-2023-5438","title":"wp image slideshow <= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e24383b-5b0f-4114-908b-4c2778632f73?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-slideshow","name":"wp image slideshow","from":"*","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":"12.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e289b06-66c8-4d50-a8f7-e07c5ae8f7c8","source":"wordfence","cve":"CVE-2024-9581","title":"Shortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e289b06-66c8-4d50-a8f7-e07c5ae8f7c8?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-anywhere","name":"Shortcodes AnyWhere","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:34:22Z","updated":"2024-10-10T02:06:09Z"},{"id":"wordfence:7e2b9612-a757-4933-9246-f5b141a99d1d","source":"wordfence","cve":"CVE-2026-104399","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.124 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e2b9612-a757-4933-9246-f5b141a99d1d?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.124","to_inclusive":true,"patched_in":"1.4.125"}],"published":"2026-10-05T11:15:56Z","updated":"2026-10-08T23:24:26Z"},{"id":"wordfence:7e2f8b99-3362-4090-8532-97233a73b3ad","source":"wordfence","cve":"CVE-2026-39554","title":"Fidalgo <= 1.2.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e2f8b99-3362-4090-8532-97233a73b3ad?source=api-prod","affected":[{"type":"theme","slug":"fidalgo","name":"Fidalgo - Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:01:46Z"},{"id":"wordfence:7e3069d4-12b8-4949-9daf-0e01590799da","source":"wordfence","cve":"CVE-2024-13434","title":"WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3069d4-12b8-4949-9daf-0e01590799da?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T04:30:22Z"},{"id":"wordfence:7e31400c-e22d-406b-a8d6-244f68f9f27d","source":"wordfence","cve":"CVE-2025-52711","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.27.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e31400c-e22d-406b-a8d6-244f68f9f27d?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.8","to_inclusive":true,"patched_in":"1.27.9"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T19:41:03Z"},{"id":"wordfence:7e328f1d-687d-424f-aab7-343bcece90cd","source":"wordfence","cve":"CVE-2026-2422","title":"WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e328f1d-687d-424f-aab7-343bcece90cd?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-wp","name":"WP Composer \u2013 The Easiest Page Builder","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-09-18T19:18:29Z","updated":"2026-09-19T07:43:17Z"},{"id":"wordfence:7e3322f0-6cff-4508-83c7-291608672707","source":"wordfence","cve":"CVE-2026-119505","title":"Welcart e-Commerce <= 2.12.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3322f0-6cff-4508-83c7-291608672707?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":true,"patched_in":"2.12.7"}],"published":"2026-11-07T09:44:23Z","updated":"2026-11-10T19:31:16Z"},{"id":"wordfence:7e342aac-2f32-48a6-8801-19c81af5a73a","source":"wordfence","cve":"CVE-2025-22281","title":"Simplish <= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e342aac-2f32-48a6-8801-19c81af5a73a?source=api-prod","affected":[{"type":"theme","slug":"simplish","name":"Simplish","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T14:18:43Z"},{"id":"wordfence:7e35a2e0-4008-4ebf-99d8-f35f5a707e6d","source":"wordfence","cve":"CVE-2025-30592","title":"Advanced Dewplayer <= 1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e35a2e0-4008-4ebf-99d8-f35f5a707e6d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dewplayer","name":"Advanced Dewplayer","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:08:55Z"},{"id":"wordfence:7e35e79a-4838-4ed9-bd08-80e8f9043ec4","source":"wordfence","cve":"CVE-2025-7653","title":"EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e35e79a-4838-4ed9-bd08-80e8f9043ec4?source=api-prod","affected":[{"type":"plugin","slug":"epaybg-payments","name":"EPay.bg Payments","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T14:11:57Z","updated":"2025-07-19T02:22:58Z"},{"id":"wordfence:7e36f3a0-2215-4c1c-99c4-9405ad7b913b","source":"wordfence","cve":"CVE-2025-11972","title":"Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e36f3a0-2215-4c1c-99c4-9405ad7b913b?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.40.0","to_inclusive":true,"patched_in":"3.40.1"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:49Z"},{"id":"wordfence:7e391830-ca46-4aa2-b31d-0a1985e138e5","source":"wordfence","cve":"CVE-2025-49045","title":"Super Interactive Maps <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e391830-ca46-4aa2-b31d-0a1985e138e5?source=api-prod","affected":[{"type":"plugin","slug":"super-interactive-maps","name":"Super Interactive Maps","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:48:59Z"},{"id":"wordfence:7e392355-ff56-47c3-a836-04ef8ae84602","source":"wordfence","cve":"CVE-2025-23712","title":"Kapost <= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e392355-ff56-47c3-a836-04ef8ae84602?source=api-prod","affected":[{"type":"plugin","slug":"kapost-byline","name":"Kapost","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-06-25T13:33:52Z"},{"id":"wordfence:7e3a1e3c-eba0-4ef4-bcb8-929799bb56a8","source":"wordfence","cve":"CVE-2024-4743","title":"LifterLMS \u2013 WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3a1e3c-eba0-4ef4-bcb8-929799bb56a8?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2024-06-04T19:34:55Z","updated":"2024-10-24T19:24:01Z"},{"id":"wordfence:7e3ad5fd-e190-48c8-864f-11cc7342080a","source":"wordfence","cve":"CVE-2026-39447","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3ad5fd-e190-48c8-864f-11cc7342080a?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.10.6","to_inclusive":true,"patched_in":"1.6.11.0"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:21:15Z"},{"id":"wordfence:7e3ae5e7-1f41-48cd-8aea-698e3b00066c","source":"wordfence","cve":"CVE-2023-27449","title":"Total Poll Lite <= 4.8.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3ae5e7-1f41-48cd-8aea-698e3b00066c?source=api-prod","affected":[{"type":"plugin","slug":"totalpoll-lite","name":"TotalPoll for Polls and Contests","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e3f3104-e213-4b0f-9821-b3f1a5c06191","source":"wordfence","cve":"CVE-2023-47825","title":"WP EXtra <= 6.4 - Cross-Site Request Forgery ToolImport","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3f3104-e213-4b0f-9821-b3f1a5c06191?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra","name":"WP EXtra \u2013 One Click Optimize","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e3fd472-c8ea-42dc-93df-872361ec97f3","source":"wordfence","cve":"CVE-2024-6309","title":"Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3fd472-c8ea-42dc-93df-872361ec97f3?source=api-prod","affected":[{"type":"plugin","slug":"attachment-file-icons","name":"Attachment File Icons (AF Icons)","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:46Z"},{"id":"wordfence:7e3fe5f1-87a9-491e-8ea4-2c6160bcbc20","source":"wordfence","cve":"CVE-2025-68575","title":"Wappointment <=2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3fe5f1-87a9-491e-8ea4-2c6160bcbc20?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-12-21T00:00:00Z","updated":"2026-05-26T18:33:11Z"},{"id":"wordfence:7e402e3e-7b11-4931-8a4b-a80d26b9eb04","source":"wordfence","cve":"CVE-2025-66074","title":"Webhooks <= 3.3.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e402e3e-7b11-4931-8a4b-a80d26b9eb04?source=api-prod","affected":[{"type":"plugin","slug":"wp-webhooks","name":"WP Webhooks Automation \u2013 Automate repetitive tasks by creating powerful WordPress automation workflows","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T17:15:29Z"},{"id":"wordfence:7e412f8a-f872-47cf-bbce-554b3559ef8a","source":"wordfence","cve":"CVE-2026-92086","title":"MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e412f8a-f872-47cf-bbce-554b3559ef8a?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-10-28T21:32:13Z","updated":"2026-10-29T11:27:15Z"},{"id":"wordfence:7e42954c-1ae3-41ef-8dd3-16e5820aa36f","source":"wordfence","cve":"CVE-2013-2204","title":"WordPress Core <= 3.5.1 - Content-Spoofing Attacks","severity":"medium","cvss":4.6,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e42954c-1ae3-41ef-8dd3-16e5820aa36f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e452aa0-bfb9-4805-b2ed-53464a4b5308","source":"wordfence","cve":"CVE-2024-12033","title":"Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e452aa0-bfb9-4805-b2ed-53464a4b5308?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"4.8.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T11:11:13Z"},{"id":"wordfence:7e473896-d94c-4f6a-a96c-bb90902532cc","source":"wordfence","cve":"CVE-2026-77264","title":"Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e473896-d94c-4f6a-a96c-bb90902532cc?source=api-prod","affected":[{"type":"plugin","slug":"automation-web-platform","name":"Wawp Country Code & Chat Widget for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2026-08-20T19:06:41Z","updated":"2026-09-26T14:34:03Z"},{"id":"wordfence:7e49d389-0ae8-48e1-8ff7-67ddaa5b2867","source":"wordfence","cve":"CVE-2021-36839","title":"Social Media Follow Buttons Bar <= 4.73 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e49d389-0ae8-48e1-8ff7-67ddaa5b2867?source=api-prod","affected":[{"type":"plugin","slug":"social-media-buttons-toolbar","name":"Social Media Follow Buttons Bar","from":"*","from_inclusive":true,"to":"4.73","to_inclusive":true,"patched_in":"5.0"}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e4e1afd-604d-45c2-ab6b-fa9ccac0c361","source":"wordfence","cve":"","title":"All Import Pro Plugin < 4.1.2 - SQL injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e4e1afd-604d-45c2-ab6b-fa9ccac0c361?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":false,"patched_in":"4.1.2"}],"published":"2020-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e4fe5a4-a025-43e6-9aa0-01ee9dfd2a43","source":"wordfence","cve":"CVE-2026-34898","title":"Event Tickets Manager for WooCommerce <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e4fe5a4-a025-43e6-9aa0-01ee9dfd2a43?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-manager-for-woocommerce","name":"Event Tickets Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:47:38Z"},{"id":"wordfence:7e501592-4411-4c0a-aa67-e2d0a29d5d35","source":"wordfence","cve":"CVE-2023-31217","title":"User Location and IP <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e501592-4411-4c0a-aa67-e2d0a29d5d35?source=api-prod","affected":[{"type":"plugin","slug":"user-location-and-ip","name":"User Location and IP","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-10-03T00:00:00Z","updated":"2025-10-08T16:58:54Z"},{"id":"wordfence:7e503e94-f544-4b77-9a79-e51836e30806","source":"wordfence","cve":"CVE-2026-40799","title":"Simple CAPTCHA Alternative with Cloudflare Turnstile <= 1.38.0 - Broken Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e503e94-f544-4b77-9a79-e51836e30806?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.38.0","to_inclusive":true,"patched_in":"1.38.1"}],"published":"2026-05-08T00:00:00Z","updated":"2026-05-11T20:26:15Z"},{"id":"wordfence:7e52882e-d86f-4863-bdb6-e33c0449d14c","source":"wordfence","cve":"CVE-2022-24664","title":"PHP Everywhere <= 2.0.3 - Authenticated (Contributor+) Remote Code Execution via Metabox","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52882e-d86f-4863-bdb6-e33c0449d14c?source=api-prod","affected":[{"type":"plugin","slug":"php-everywhere","name":"PHP Everywhere","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e52a487-8e87-49b7-a044-9fb8452f3dd1","source":"wordfence","cve":"CVE-2025-8783","title":"Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52a487-8e87-49b7-a044-9fb8452f3dd1?source=api-prod","affected":[{"type":"plugin","slug":"contact-manager","name":"Contact Manager","from":"*","from_inclusive":true,"to":"8.6.5","to_inclusive":true,"patched_in":"8.6.6"}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-19T10:57:28Z"},{"id":"wordfence:7e539549-1125-4b0e-aa3c-c8844041c23a","source":"wordfence","cve":"CVE-2023-5772","title":"Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e539549-1125-4b0e-aa3c-c8844041c23a?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e577828-4368-4781-877b-badb4dc50763","source":"wordfence","cve":"CVE-2025-5926","title":"Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e577828-4368-4781-877b-badb4dc50763?source=api-prod","affected":[{"type":"plugin","slug":"link-shield","name":"Link Shield","from":"*","from_inclusive":true,"to":"0.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:08:29Z","updated":"2025-06-13T01:47:48Z"},{"id":"wordfence:7e589327-110b-4ede-9496-888d1bc31fc2","source":"wordfence","cve":"CVE-2025-69293","title":"Final User <= 1.2.5 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e589327-110b-4ede-9496-888d1bc31fc2?source=api-prod","affected":[{"type":"plugin","slug":"final-user","name":"Final User","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:50:38Z"},{"id":"wordfence:7e5b1e90-53f7-4afc-9544-c36afe1ee813","source":"wordfence","cve":"CVE-2025-11369","title":"Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e5b1e90-53f7-4afc-9544-c36afe1ee813?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2025-12-16T11:33:20Z","updated":"2026-02-11T15:31:31Z"},{"id":"wordfence:7e61a7ae-b9c9-44ca-81b7-db8323ee66a3","source":"wordfence","cve":"CVE-2025-30876","title":"Ads by WPQuads <= 2.0.87.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e61a7ae-b9c9-44ca-81b7-db8323ee66a3?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"2.0.87.1","to_inclusive":true,"patched_in":"2.0.88"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:26:26Z"},{"id":"wordfence:7e639aed-ec67-4212-9051-1f7465bbfde2","source":"wordfence","cve":"CVE-2026-0656","title":"iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e639aed-ec67-4212-9051-1f7465bbfde2?source=api-prod","affected":[{"type":"plugin","slug":"ipaymu-for-woocommerce","name":"iPaymu Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-01-06T18:32:55Z","updated":"2026-01-07T06:36:03Z"},{"id":"wordfence:7e675c06-2a87-460b-98e0-6b7faedf8862","source":"wordfence","cve":"CVE-2026-28018","title":"Global Logistics <= 3.20 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e675c06-2a87-460b-98e0-6b7faedf8862?source=api-prod","affected":[{"type":"theme","slug":"globallogistics","name":"Global Logistics","from":"*","from_inclusive":true,"to":"3.20","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:24:25Z"},{"id":"wordfence:7e697e7f-8d5b-4a9f-9148-f2dc5fb1ba38","source":"wordfence","cve":"","title":"Web and WooCommerce Addons for WPBakery Builder <= 1.4.4.1 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e697e7f-8d5b-4a9f-9148-f2dc5fb1ba38?source=api-prod","affected":[{"type":"plugin","slug":"vc-addons-by-bit14","name":"Web and WooCommerce Addons for WPBakery Builder","from":"*","from_inclusive":true,"to":"1.4.4.1","to_inclusive":true,"patched_in":"1.4.4.2"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e6a0bf9-4767-4d4c-9a1e-adcb3c7719d9","source":"wordfence","cve":"CVE-2023-2298","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e6a0bf9-4767-4d4c-9a1e-adcb3c7719d9?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e6b24a2-55ed-40e7-bcf0-a9ceb8ea022c","source":"wordfence","cve":"CVE-2024-12593","title":"PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e6b24a2-55ed-40e7-bcf0-a9ceb8ea022c?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2025-01-14T21:51:16Z","updated":"2025-01-15T11:24:38Z"},{"id":"wordfence:7e6f9f8c-a36b-412d-a2ae-cc90e3a840f6","source":"wordfence","cve":"CVE-2024-32092","title":"Kimili Flash Embed <= 2.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e6f9f8c-a36b-412d-a2ae-cc90e3a840f6?source=api-prod","affected":[{"type":"plugin","slug":"kimili-flash-embed","name":"Kimili Flash Embed","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:59:07Z"},{"id":"wordfence:7e7044aa-a1e7-4b1d-9f50-5e250426c6b0","source":"wordfence","cve":"CVE-2024-12026","title":"Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7044aa-a1e7-4b1d-9f50-5e250426c6b0?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.3.1"}],"published":"2024-12-06T12:01:13Z","updated":"2024-12-12T13:50:39Z"},{"id":"wordfence:7e738142-d1db-48e5-9c5a-823136aa1d05","source":"wordfence","cve":"CVE-2026-77790","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e738142-d1db-48e5-9c5a-823136aa1d05?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.4","to_inclusive":false,"patched_in":"6.0.9.4"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:03:47Z"},{"id":"wordfence:7e7411ab-174e-4bc2-9f96-dbce925a21eb","source":"wordfence","cve":"CVE-2026-10035","title":"Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7411ab-174e-4bc2-9f96-dbce925a21eb?source=api-prod","affected":[{"type":"plugin","slug":"weaver-for-bbpress","name":"Turnkey bbPress by WeaverTheme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-08-15T17:23:46Z","updated":"2026-08-16T05:27:29Z"},{"id":"wordfence:7e7741d1-8b30-460d-bf1b-edc475841c71","source":"wordfence","cve":"CVE-2023-23980","title":"MailOptin <= 1.2.54.0 - Authenticated (Admin+) Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7741d1-8b30-460d-bf1b-edc475841c71?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"1.2.54.0","from_inclusive":true,"to":"1.2.54.0","to_inclusive":true,"patched_in":"1.2.54.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e78d678-1560-401d-a409-21207332e062","source":"wordfence","cve":"CVE-2022-0863","title":"WP SVG Icons <= 3.2.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e78d678-1560-401d-a409-21207332e062?source=api-prod","affected":[{"type":"plugin","slug":"svg-vector-icon-plugin","name":"WP SVG Icons","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e7a289f-39ef-4961-bd08-34e6a7dfdac5","source":"wordfence","cve":"CVE-2024-6792","title":"WP ULike 4.7.1 - 4.7.2 - Authenticated (Subscriber+) Stored-Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7a289f-39ef-4961-bd08-34e6a7dfdac5?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"4.7.1","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.2.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-12T14:47:04Z"},{"id":"wordfence:7e7acb4d-7f4c-4b3f-a0df-7de99249034e","source":"wordfence","cve":"CVE-2025-31918","title":"Simple Business Directory Pro < 15.6.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7acb4d-7f4c-4b3f-a0df-7de99249034e?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-directory-pro","name":"Simple Business Directory Pro","from":"*","from_inclusive":true,"to":"15.6.9","to_inclusive":false,"patched_in":"15.6.9"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-25T13:24:05Z"},{"id":"wordfence:7e7b24b5-13e4-4164-8462-fd81b1033f2c","source":"wordfence","cve":"CVE-2021-24142","title":"301 Redirects - Easy Redirect Manager < 2.51 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7b24b5-13e4-4164-8462-fd81b1033f2c?source=api-prod","affected":[{"type":"plugin","slug":"eps-301-redirects","name":"301 Redirects \u2013 Redirect Manager","from":"*","from_inclusive":true,"to":"2.51","to_inclusive":false,"patched_in":"2.51"}],"published":"2021-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e7d3bf0-1860-45b0-b928-2291b0f98902","source":"wordfence","cve":"CVE-2023-47238","title":"Top 10 <= 3.3.2 - Cross-Site Request Forgery via edit_count_ajax","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7d3bf0-1860-45b0-b928-2291b0f98902?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2023-11-03T00:00:00Z","updated":"2024-08-06T13:56:43Z"},{"id":"wordfence:7e7e6ea7-4e0b-4d8a-9306-45b55d41fbb5","source":"wordfence","cve":"CVE-2024-1586","title":"Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e7e6ea7-4e0b-4d8a-9306-45b55d41fbb5?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.27"}],"published":"2024-02-19T00:00:00Z","updated":"2024-05-31T15:30:28Z"},{"id":"wordfence:7e805a72-b49e-4f0a-83c6-be55d14812d2","source":"wordfence","cve":"CVE-2025-62148","title":"Robots.txt rewrite <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e805a72-b49e-4f0a-83c6-be55d14812d2?source=api-prod","affected":[{"type":"plugin","slug":"robotstxt-rewrite","name":"Robots.txt rewrite","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:31:54Z"},{"id":"wordfence:7e82e1c5-0ed4-4dee-9990-976591693eb5","source":"wordfence","cve":"CVE-2024-1320","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e82e1c5-0ed4-4dee-9990-976591693eb5?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-09T07:01:10Z"},{"id":"wordfence:7e82ef74-e350-44b9-a1c9-9ae0f3f9ca1e","source":"wordfence","cve":"CVE-2026-113494","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory < 2.8.195 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e82ef74-e350-44b9-a1c9-9ae0f3f9ca1e?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.195","to_inclusive":false,"patched_in":"2.8.195"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:03Z"},{"id":"wordfence:7e867285-511b-45e4-9732-73cbdbe7bccb","source":"wordfence","cve":"CVE-2026-81347","title":"Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Path Traversal","severity":"high","cvss":8.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e867285-511b-45e4-9732-73cbdbe7bccb?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.12","to_inclusive":true,"patched_in":"3.29.13"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-16T16:07:44Z"},{"id":"wordfence:7e869568-9de9-40b9-b826-aa35585e19cb","source":"wordfence","cve":"CVE-2026-62071","title":"Iptanus File Upload <= 5.1.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e869568-9de9-40b9-b826-aa35585e19cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2026-10-01T11:37:25Z","updated":"2026-10-08T23:38:06Z"},{"id":"wordfence:7e870ae2-abae-457a-b3d1-75a96ec09d41","source":"wordfence","cve":"CVE-2024-8666","title":"Shoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e870ae2-abae-457a-b3d1-75a96ec09d41?source=api-prod","affected":[{"type":"plugin","slug":"shoutcast-icecast-html5-radio-player","name":"Shoutcast Icecast HTML5 Radio Player","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-10-24T20:13:28Z","updated":"2025-11-20T19:31:08Z"},{"id":"wordfence:7e8745da-fd3a-44b3-b288-9a2b83e8dcd8","source":"wordfence","cve":"CVE-2023-3721","title":"WP-EMail <= 2.69.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8745da-fd3a-44b3-b288-9a2b83e8dcd8?source=api-prod","affected":[{"type":"plugin","slug":"wp-email","name":"WP-EMail","from":"*","from_inclusive":true,"to":"2.69.1","to_inclusive":false,"patched_in":"2.69.1"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e8911a3-ce0f-420c-bf2a-1c2929d01cef","source":"wordfence","cve":"CVE-2023-7027","title":"POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8911a3-ce0f-420c-bf2a-1c2929d01cef?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:42Z"},{"id":"wordfence:7e898e40-2cc3-4b5a-833b-899e9c9f26d3","source":"wordfence","cve":"CVE-2026-15397","title":"Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e898e40-2cc3-4b5a-833b-899e9c9f26d3?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-07-29T22:06:32Z","updated":"2026-07-30T11:03:24Z"},{"id":"wordfence:7e89b33e-fc3c-44e9-823c-e9349147acf5","source":"wordfence","cve":"CVE-2022-1939","title":"Allow SVG Files <= 1.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e89b33e-fc3c-44e9-823c-e9349147acf5?source=api-prod","affected":[{"type":"plugin","slug":"asf-allow-svg-files","name":"Allow svg files","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2020-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e8ab165-57b8-4509-86b8-6e5226812264","source":"wordfence","cve":"CVE-2022-41840","title":"Welcart e-Commerce 2.6.0-2.7.7 - Information Disclosure via Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8ab165-57b8-4509-86b8-6e5226812264?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"2.6.0","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2022-09-02T00:00:00Z","updated":"2024-06-18T12:37:44Z"},{"id":"wordfence:7e8b5ce7-d7ee-4feb-8524-d2f79f37ce0e","source":"wordfence","cve":"CVE-2025-69009","title":"Medical Equipment eCommerce WordPress Theme <= 1.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8b5ce7-d7ee-4feb-8524-d2f79f37ce0e?source=api-prod","affected":[{"type":"theme","slug":"medicalequipment","name":"Medical Equipment eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-06T15:32:44Z"},{"id":"wordfence:7e8c8027-6340-40d7-b34a-34024d5b2d89","source":"wordfence","cve":"CVE-2025-49292","title":"Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8c8027-6340-40d7-b34a-34024d5b2d89?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.13.8","to_inclusive":true,"patched_in":"3.13.9"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:49:41Z"},{"id":"wordfence:7e8f230e-3f96-4efd-806d-72725b960303","source":"wordfence","cve":"CVE-2017-20206","title":"Appointments <= 2.2.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8f230e-3f96-4efd-806d-72725b960303?source=api-prod","affected":[{"type":"plugin","slug":"appointments","name":"Appointments","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2017-10-02T00:00:00Z","updated":"2025-10-18T03:33:24Z"},{"id":"wordfence:7e904ec1-c389-4e4c-9893-385f3482034e","source":"wordfence","cve":"CVE-2025-47656","title":"Spiraclethemes Site Library <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e904ec1-c389-4e4c-9893-385f3482034e?source=api-prod","affected":[{"type":"plugin","slug":"spiraclethemes-site-library","name":"Spiraclethemes Site Library","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-07-25T15:46:11Z"},{"id":"wordfence:7e947678-a575-4b2c-8da1-4a801a7a642c","source":"wordfence","cve":"CVE-2026-4432","title":"YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Insecure Direct Object Reference to Wishlist Rename","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e947678-a575-4b2c-8da1-4a801a7a642c?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":false,"patched_in":"4.13.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-04-15T19:01:01Z"},{"id":"wordfence:7e94cbf8-c74a-4546-83de-b5c5b094762b","source":"wordfence","cve":"CVE-2026-2573","title":"GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e94cbf8-c74a-4546-83de-b5c5b094762b?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-09-02T16:05:06Z","updated":"2026-09-03T04:29:00Z"},{"id":"wordfence:7e95773c-b968-47b3-8ae7-9a8d3389666c","source":"wordfence","cve":"CVE-2023-46635","title":"YITH WooCommerce Product Add-Ons <= 4.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e95773c-b968-47b3-8ae7-9a8d3389666c?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e963601-dc41-4218-9119-708c74e51bc2","source":"wordfence","cve":"CVE-2026-4661","title":"WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e963601-dc41-4218-9119-708c74e51bc2?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-07-10T16:57:59Z","updated":"2026-07-11T05:35:48Z"},{"id":"wordfence:7e96c65d-be0f-4333-90d2-e1cc792f54b2","source":"wordfence","cve":"CVE-2024-52416","title":"Debug Tool <= 2.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e96c65d-be0f-4333-90d2-e1cc792f54b2?source=api-prod","affected":[{"type":"plugin","slug":"debug-tool","name":"Debug Tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-13T00:00:00Z","updated":"2026-05-04T14:25:22Z"},{"id":"wordfence:7e977be1-d346-4fcc-89a5-332cbd010d18","source":"wordfence","cve":"CVE-2023-0076","title":"Download Attachments <= 1.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e977be1-d346-4fcc-89a5-332cbd010d18?source=api-prod","affected":[{"type":"plugin","slug":"download-attachments","name":"Download Attachments","from":"*","from_inclusive":true,"to":"1.2.24","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-02-13T00:00:00Z","updated":"2024-02-09T19:21:11Z"},{"id":"wordfence:7e97d9dd-7d4a-4862-abba-6e8816bbbe9b","source":"wordfence","cve":"CVE-2024-27963","title":"Crisp <= 0.44 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e97d9dd-7d4a-4862-abba-6e8816bbbe9b?source=api-prod","affected":[{"type":"plugin","slug":"crisp","name":"Crisp \u2013 Live Chat and AI Chatbot","from":"*","from_inclusive":true,"to":"0.44","to_inclusive":true,"patched_in":"0.45"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T19:19:39Z"},{"id":"wordfence:7e987c38-b3a0-470e-9688-c8d79c853501","source":"wordfence","cve":"CVE-2024-50509","title":"Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e987c38-b3a0-470e-9688-c8d79c853501?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-design","name":"Woocommerce Product Design","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:38:25Z"},{"id":"wordfence:7e98b1ef-70dd-408d-8644-08933bca1cdd","source":"wordfence","cve":"CVE-2024-13638","title":"Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e98b1ef-70dd-408d-8644-08933bca1cdd?source=api-prod","affected":[{"type":"plugin","slug":"order-attachments-for-woocommerce","name":"Order Attachments for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:12:46Z","updated":"2025-02-28T08:23:18Z"},{"id":"wordfence:7e9acd26-c341-4ece-bcf1-102f953a4b4f","source":"wordfence","cve":"CVE-2025-3769","title":"Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.92","to_inclusive":true,"patched_in":"5.1.93"}],"published":"2025-05-13T00:00:00Z","updated":"2025-05-14T11:12:27Z"},{"id":"wordfence:7e9b004a-2050-47e8-ac4d-491b715c87d2","source":"wordfence","cve":"CVE-2024-5964","title":"Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9b004a-2050-47e8-ac4d-491b715c87d2?source=api-prod","affected":[{"type":"theme","slug":"zenon-lite","name":"Zenon Lite","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-07-17T14:01:41Z","updated":"2024-07-18T02:03:57Z"},{"id":"wordfence:7e9cee82-7854-49ee-881d-0336466a157c","source":"wordfence","cve":"CVE-2025-47536","title":"Content Egg <= 7.0.0 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9cee82-7854-49ee-881d-0336466a157c?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:09:45Z"},{"id":"wordfence:7e9d3c2a-54af-4583-b008-b77ffad4e9cd","source":"wordfence","cve":"CVE-2025-32656","title":"Testimonial Slider And Showcase Pro <= 2.3.15 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9d3c2a-54af-4583-b008-b77ffad4e9cd?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-showcase-pro","name":"Testimonial Slider And Showcase Pro","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:34:56Z"},{"id":"wordfence:7e9dcedd-aa81-47c4-9fc5-cecc7bc394b5","source":"wordfence","cve":"","title":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress <= 5.3.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9dcedd-aa81-47c4-9fc5-cecc7bc394b5?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2015-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7e9e7f3e-900c-4e84-8226-8dc6450b0a31","source":"wordfence","cve":"CVE-2026-103962","title":"User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9e7f3e-900c-4e84-8226-8dc6450b0a31?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-10-30T19:34:09Z","updated":"2026-10-31T07:46:50Z"},{"id":"wordfence:7e9f7670-fcde-4e6f-a0c1-f7eb43b320ba","source":"wordfence","cve":"CVE-2024-51927","title":"Rig Elements For Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9f7670-fcde-4e6f-a0c1-f7eb43b320ba?source=api-prod","affected":[{"type":"plugin","slug":"rig-elements","name":"Rig Elements For Elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:57:48Z"},{"id":"wordfence:7e9fec92-f471-4ce9-9138-1c58ad658da2","source":"wordfence","cve":"CVE-2026-1492","title":"User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-03-02T16:05:18Z","updated":"2026-03-03T04:33:21Z"},{"id":"wordfence:7ea0cfbc-4494-4170-af59-3218e636e2fe","source":"wordfence","cve":"CVE-2025-32157","title":"Sparkle Elementor Kit <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea0cfbc-4494-4170-af59-3218e636e2fe?source=api-prod","affected":[{"type":"plugin","slug":"sparkle-elementor-kit","name":"Sparkle Elementor Kit","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-10T12:50:28Z"},{"id":"wordfence:7ea10a95-c24b-49ae-8a70-317fe04590bf","source":"wordfence","cve":"CVE-2025-30628","title":"Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea10a95-c24b-49ae-8a70-317fe04590bf?source=api-prod","affected":[{"type":"plugin","slug":"azon-addon-js-composer","name":"Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T13:48:25Z"},{"id":"wordfence:7ea13a80-c744-4de3-ac19-178b67e1afc4","source":"wordfence","cve":"CVE-2025-23532","title":"MyAnime Widget <= 1.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea13a80-c744-4de3-ac19-178b67e1afc4?source=api-prod","affected":[{"type":"plugin","slug":"myanime-widget","name":"MyAnime Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:28:42Z"},{"id":"wordfence:7ea2726a-a601-45ac-9f20-c34b82edf441","source":"wordfence","cve":"CVE-2023-32963","title":"WooCommerce Predictive Search <= 5.8.0 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea2726a-a601-45ac-9f20-c34b82edf441?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-predictive-search","name":"Predictive Search for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ea2bb8c-cc8b-49de-9c8e-2c8c0569f4ac","source":"wordfence","cve":"CVE-2024-4208","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea2bb8c-cc8b-49de-9c8e-2c8c0569f4ac?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.37","to_inclusive":true,"patched_in":"3.2.38"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T02:32:46Z"},{"id":"wordfence:7ea3e243-8deb-4fd7-a5db-a7a1294373b7","source":"wordfence","cve":"CVE-2025-24782","title":"Post Grid, Slider & Carousel Ultimate <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea3e243-8deb-4fd7-a5db-a7a1294373b7?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:35:01Z"},{"id":"wordfence:7ea4ca2d-6a67-43ad-817d-960cad3030b8","source":"wordfence","cve":"CVE-2023-23714","title":"Uncanny Toolkit for LearnDash <= 3.6.4.1 - Cross-Site Request Forgery to Arbitrary Plugin Install and Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea4ca2d-6a67-43ad-817d-960cad3030b8?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.6.4.1","to_inclusive":true,"patched_in":"3.6.4.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ea6079f-45a1-438f-890f-36457b7468ec","source":"wordfence","cve":"CVE-2026-8846","title":"Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea6079f-45a1-438f-890f-36457b7468ec?source=api-prod","affected":[{"type":"plugin","slug":"tuxquote","name":"Tuxquote","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:23Z","updated":"2026-05-27T05:31:27Z"},{"id":"wordfence:7ea72320-0e1e-45e3-987d-9ab7eecf1aee","source":"wordfence","cve":"CVE-2026-13339","title":"CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2026-08-01T10:44:26Z","updated":"2026-08-01T23:29:35Z"},{"id":"wordfence:7ea78c3f-f033-4a47-8190-07ae2552fdd2","source":"wordfence","cve":"CVE-2024-56229","title":"SearchIQ <= 4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea78c3f-f033-4a47-8190-07ae2552fdd2?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:25:32Z"},{"id":"wordfence:7eaa0117-5320-431f-b3d2-05a867901528","source":"wordfence","cve":"CVE-2024-10578","title":"Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eaa0117-5320-431f-b3d2-05a867901528?source=api-prod","affected":[{"type":"theme","slug":"pubnews","name":"Pubnews","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-12-05T16:47:54Z","updated":"2025-01-22T19:05:58Z"},{"id":"wordfence:7eaa196b-429a-4d15-903b-16f33cc0bd6f","source":"wordfence","cve":"CVE-2020-7107","title":"Ultimate FAQ <= 1.8.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eaa196b-429a-4d15-903b-16f33cc0bd6f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"1.8.29","to_inclusive":true,"patched_in":"1.8.30"}],"published":"2020-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7eada9b7-8d53-4e95-858e-aa706f74b2a1","source":"wordfence","cve":"CVE-2023-44227","title":"Simple File List <= 6.1.9 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eada9b7-8d53-4e95-858e-aa706f74b2a1?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7eae5d83-1443-4682-9e97-dfbc08146b18","source":"wordfence","cve":"CVE-2025-24541","title":"DK White Label <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eae5d83-1443-4682-9e97-dfbc08146b18?source=api-prod","affected":[{"type":"plugin","slug":"dk-white-label","name":"DK White Label","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-11-14T00:00:00Z","updated":"2025-02-25T16:54:48Z"},{"id":"wordfence:7eb018bc-2650-4e0d-8da9-325eac826d45","source":"wordfence","cve":"CVE-2025-5948","title":"Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-18T16:31:15Z","updated":"2025-09-19T05:28:53Z"},{"id":"wordfence:7eb0b413-d165-4b4f-9eda-49df664f0473","source":"wordfence","cve":"CVE-2025-67533","title":"Themify Portfolio Post <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb0b413-d165-4b4f-9eda-49df664f0473?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:00:12Z"},{"id":"wordfence:7eb0f690-c977-43de-a713-9d02ee99ba2e","source":"wordfence","cve":"CVE-2023-49282","title":"Amelia 1.2.18 - 1.2.36 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb0f690-c977-43de-a713-9d02ee99ba2e?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"1.2.18","from_inclusive":true,"to":"1.2.36","to_inclusive":true,"patched_in":"1.2.37"}],"published":"2025-11-18T00:00:00Z","updated":"2026-01-16T13:14:58Z"},{"id":"wordfence:7eb185cf-4a9e-46e1-98ac-7349e27994ca","source":"wordfence","cve":"CVE-2025-53295","title":"iCount Payment Gateway <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb185cf-4a9e-46e1-98ac-7349e27994ca?source=api-prod","affected":[{"type":"plugin","slug":"icount","name":"iCount Payment Gateway","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-06-27T00:00:00Z","updated":"2026-07-08T20:43:50Z"},{"id":"wordfence:7eb37504-a3b0-4e95-b66f-d9a1683c6a0e","source":"wordfence","cve":"CVE-2025-54729","title":"Webba Booking <= 6.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb37504-a3b0-4e95-b66f-d9a1683c6a0e?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:48:34Z"},{"id":"wordfence:7eb4b190-5b4f-4950-b8ec-381c94c7f0cd","source":"wordfence","cve":"CVE-2025-28906","title":"Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb4b190-5b4f-4950-b8ec-381c94c7f0cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-skitter-slideshow","name":"Skitter Slideshow","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:42:55Z"},{"id":"wordfence:7eb53a80-89e5-4d8c-a1ba-c272196a3340","source":"wordfence","cve":"CVE-2025-13684","title":"ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb53a80-89e5-4d8c-a1ba-c272196a3340?source=api-prod","affected":[{"type":"plugin","slug":"ark-relatedpost","name":"ARK Related Posts","from":"*","from_inclusive":true,"to":"2.19","to_inclusive":true,"patched_in":"2.20"}],"published":"2025-12-04T19:20:29Z","updated":"2025-12-11T15:13:35Z"},{"id":"wordfence:7eb60874-85c1-40a9-b19d-131c2c2d49ba","source":"wordfence","cve":"CVE-2025-4169","title":"Posts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb60874-85c1-40a9-b19d-131c2c2d49ba?source=api-prod","affected":[{"type":"plugin","slug":"posts-per-cat","name":"Posts per Cat","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-05-15T00:00:00Z","updated":"2025-05-16T02:21:45Z"},{"id":"wordfence:7eb62d35-3f0e-4733-8f7f-723d0f25b710","source":"wordfence","cve":"CVE-2026-15989","title":"Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb62d35-3f0e-4733-8f7f-723d0f25b710?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-09-30T19:23:33Z","updated":"2026-10-01T07:40:24Z"},{"id":"wordfence:7eb78b64-ebe3-44e9-9061-d380693c5566","source":"wordfence","cve":"CVE-2024-9694","title":"CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb78b64-ebe3-44e9-9061-d380693c5566?source=api-prod","affected":[{"type":"plugin","slug":"cmsmasters-elementor-addon","name":"CMSMasters Elementor Addon","from":"*","from_inclusive":true,"to":"1.14.7","to_inclusive":true,"patched_in":"1.15.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T02:05:35Z"},{"id":"wordfence:7eb7c846-c82b-40c8-a5ae-88b30c761ba9","source":"wordfence","cve":"CVE-2024-13476","title":"LTL Freight Quotes \u2013 GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb7c846-c82b-40c8-a5ae-88b30c761ba9?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-globaltranz-edition","name":"LTL Freight Quotes \u2013 GlobalTranz Edition","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T09:21:39Z"},{"id":"wordfence:7eb7d499-28ba-48ef-9798-b7c8cbb7aa3e","source":"wordfence","cve":"CVE-2024-1203","title":"Conversios \u2013 Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb7d499-28ba-48ef-9798-b7c8cbb7aa3e?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"7.0.8"}],"published":"2024-02-27T00:00:00Z","updated":"2024-04-01T18:00:33Z"},{"id":"wordfence:7eb8a509-9acd-457c-8cb9-725f615148ce","source":"wordfence","cve":"CVE-2025-4188","title":"Advanced Reorder Image Text Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb8a509-9acd-457c-8cb9-725f615148ce?source=api-prod","affected":[{"type":"plugin","slug":"advanced-reorder-image-text-slider","name":"Advanced Reorder Image Text Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:31:51Z","updated":"2025-05-03T01:43:05Z"},{"id":"wordfence:7ebd4936-9d68-42cb-a427-a1db894b49ec","source":"wordfence","cve":"CVE-2024-9349","title":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ebd4936-9d68-42cb-a427-a1db894b49ec?source=api-prod","affected":[{"type":"plugin","slug":"amazon-auto-links","name":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:04:52Z"},{"id":"wordfence:7ebe84ba-abc1-410c-b315-118746ff235a","source":"wordfence","cve":"CVE-2025-11457","title":"EasyCommerce \u2013 AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ebe84ba-abc1-410c-b315-118746ff235a?source=api-prod","affected":[{"type":"plugin","slug":"easycommerce","name":"EasyCommerce \u2013 Agentic AI Ecommerce & Online Store Builder","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-11-10T15:10:06Z","updated":"2025-11-13T16:02:09Z"},{"id":"wordfence:7ec03e35-9de7-44e8-88be-5a374edd8984","source":"wordfence","cve":"CVE-2024-33690","title":"Financio <= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec03e35-9de7-44e8-88be-5a374edd8984?source=api-prod","affected":[{"type":"theme","slug":"financio","name":"Financio","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:23:14Z"},{"id":"wordfence:7ec14923-0f68-45e8-8d99-9921c5928ac4","source":"wordfence","cve":"CVE-2025-32235","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec14923-0f68-45e8-8d99-9921c5928ac4?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:21:42Z"},{"id":"wordfence:7ec15c74-5188-4769-ab16-98d9c85bb0c2","source":"wordfence","cve":"CVE-2024-37245","title":"All In One Redirection <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec15c74-5188-4769-ab16-98d9c85bb0c2?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-redirection","name":"All In One Redirection","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-06-25T00:00:00Z","updated":"2026-09-16T17:28:03Z"},{"id":"wordfence:7ec1d883-147f-4a15-89ab-bd9c41893589","source":"wordfence","cve":"CVE-2024-2580","title":"Automation By Autonami <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec1d883-147f-4a15-89ab-bd9c41893589?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T15:05:26Z"},{"id":"wordfence:7ec29589-b524-4b67-af60-982cd78b81c5","source":"wordfence","cve":"CVE-2024-50439","title":"Astra Widgets <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec29589-b524-4b67-af60-982cd78b81c5?source=api-prod","affected":[{"type":"plugin","slug":"astra-widgets","name":"Astra Widgets","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:15:44Z"},{"id":"wordfence:7ec55694-d03e-4e84-b33b-61e2549cbc58","source":"wordfence","cve":"CVE-2026-108179","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.1.1 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec55694-d03e-4e84-b33b-61e2549cbc58?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:04Z"},{"id":"wordfence:7ec6b03c-e594-4b20-9da0-78413048ba70","source":"wordfence","cve":"CVE-2024-1429","title":"Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ec6b03c-e594-4b20-9da0-78413048ba70?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:49:39Z"},{"id":"wordfence:7ecb4f95-346e-49b3-859f-44f28a72f065","source":"wordfence","cve":"CVE-2026-1060","title":"WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb4f95-346e-49b3-859f-44f28a72f065?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"4.0.7.7","to_inclusive":true,"patched_in":"4.0.7.8"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T14:25:13Z"},{"id":"wordfence:7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9","source":"wordfence","cve":"CVE-2026-4945","title":"Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecb9f61-68d5-4c70-8d7d-e4fb067fcff9?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-07T12:29:05Z"},{"id":"wordfence:7ecbf3cb-6b4b-4e49-b301-53eb3965aec3","source":"wordfence","cve":"CVE-2025-39510","title":"Pinterest Automatic Pin < 4.19.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecbf3cb-6b4b-4e49-b301-53eb3965aec3?source=api-prod","affected":[{"type":"plugin","slug":"wp-pinterest-automatic","name":"Pinterest Automatic","from":"*","from_inclusive":true,"to":"4.19.0","to_inclusive":false,"patched_in":"4.19.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:11:31Z"},{"id":"wordfence:7ecc92c7-619d-442a-811f-4606e6d85d48","source":"wordfence","cve":"CVE-2024-49221","title":"cSlider <= 2.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ecc92c7-619d-442a-811f-4606e6d85d48?source=api-prod","affected":[{"type":"plugin","slug":"cslider","name":"cSlider","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:37:13Z"},{"id":"wordfence:7eccbf15-db22-439b-a733-1ce9b991728f","source":"wordfence","cve":"CVE-2024-6074","title":"WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Customer Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eccbf15-db22-439b-a733-1ce9b991728f?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-06-24T00:00:00Z","updated":"2024-07-01T14:42:11Z"},{"id":"wordfence:7ece53a2-cbad-4ff8-baad-0e4ec14ecbee","source":"wordfence","cve":"CVE-2025-46254","title":"Visual Composer Website Builder <= 45.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ece53a2-cbad-4ff8-baad-0e4ec14ecbee?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.10.0","to_inclusive":true,"patched_in":"45.11.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:25:33Z"},{"id":"wordfence:7ed01b31-fef2-49c2-9c5e-45d80e7dbcff","source":"wordfence","cve":"CVE-2025-68543","title":"Diza <= 1.3.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ed01b31-fef2-49c2-9c5e-45d80e7dbcff?source=api-prod","affected":[{"type":"theme","slug":"diza","name":"Diza - Pharmacy Store Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:44:56Z"},{"id":"wordfence:7edad4f6-e470-4a72-b618-d2dad64e0ac1","source":"wordfence","cve":"CVE-2021-24834","title":"YOP Poll <= 6.3.0 - Author+ Stored Cross-Site Scripting via Options Module","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7edad4f6-e470-4a72-b618-d2dad64e0ac1?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2021-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7edc150f-5c38-4bb7-a65c-44a91c24325a","source":"wordfence","cve":"CVE-2024-38678","title":"Calendar.online / Kalender.digital <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7edc150f-5c38-4bb7-a65c-44a91c24325a?source=api-prod","affected":[{"type":"plugin","slug":"kalender-digital","name":"Calendar.online / Kalender.digital \u2013 Plugin","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-23T17:47:55Z"},{"id":"wordfence:7edd06d9-3897-4644-a77e-e58ab6d14c95","source":"wordfence","cve":"CVE-2023-49777","title":"YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7edd06d9-3897-4644-a77e-e58ab6d14c95?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7edfff03-1fa5-4aa8-b93f-33b9d4241538","source":"wordfence","cve":"CVE-2026-57681","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7edfff03-1fa5-4aa8-b93f-33b9d4241538?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.161","to_inclusive":true,"patched_in":"2.8.162"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:47:50Z"},{"id":"wordfence:7ee108b0-cf90-4c3e-aea4-140da19efd88","source":"wordfence","cve":"CVE-2025-68539","title":"Fana <= 1.1.35 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee108b0-cf90-4c3e-aea4-140da19efd88?source=api-prod","affected":[{"type":"theme","slug":"fana","name":"Fana - Fashion Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:45:12Z"},{"id":"wordfence:7ee1660e-10c0-447b-8562-c3af07997f56","source":"wordfence","cve":"CVE-2023-32507","title":"Woo Custom Emails <= 2.2 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee1660e-10c0-447b-8562-c3af07997f56?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-emails","name":"Woo Custom Emails","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ee188cc-2c3f-45e7-b7ce-928242035e37","source":"wordfence","cve":"CVE-2024-13667","title":"Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee188cc-2c3f-45e7-b7ce-928242035e37?source=api-prod","affected":[{"type":"theme","slug":"uncode","name":"Uncode","from":"*","from_inclusive":true,"to":"2.9.1.6","to_inclusive":true,"patched_in":"2.9.1.7"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:20Z"},{"id":"wordfence:7ee1b56c-5ddc-4011-88b1-898feab591e5","source":"wordfence","cve":"CVE-2026-62047","title":"Event Tickets and Registration <= 5.30.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee1b56c-5ddc-4011-88b1-898feab591e5?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.2","to_inclusive":true,"patched_in":"5.30.3"}],"published":"2026-10-30T18:12:00Z","updated":"2026-11-03T20:07:42Z"},{"id":"wordfence:7ee267ff-b650-44a5-994b-3a22d34722e8","source":"wordfence","cve":"","title":"WordPress Backup and Migrate Plugin \u2013 Backup Guard < 1.0.3 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee267ff-b650-44a5-994b-3a22d34722e8?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2016-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ee3d1ed-5d75-4539-bb1b-bfd3518043df","source":"wordfence","cve":"CVE-2025-23747","title":"Awesome WordPress Timeline Plugin <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee3d1ed-5d75-4539-bb1b-bfd3518043df?source=api-prod","affected":[{"type":"plugin","slug":"awesome-timeline","name":"Awesome WordPress Timeline Plugin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T16:06:53Z"},{"id":"wordfence:7ee68705-cbb3-44b8-8223-4cecd678bcab","source":"wordfence","cve":"CVE-2025-9979","title":"Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee68705-cbb3-44b8-8223-4cecd678bcab?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-09-09T17:27:41Z","updated":"2025-10-28T17:19:51Z"},{"id":"wordfence:7ee6ca74-3684-46df-9b42-e97ee8cdbdb8","source":"wordfence","cve":"CVE-2026-25318","title":"WiserReview Product Reviews for WooCommerce <= 2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee6ca74-3684-46df-9b42-e97ee8cdbdb8?source=api-prod","affected":[{"type":"plugin","slug":"wiser-review","name":"WiserReview Product Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2026-01-26T00:00:00Z","updated":"2026-05-04T15:20:57Z"},{"id":"wordfence:7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5","source":"wordfence","cve":"CVE-2024-6099","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-420","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8.1","to_inclusive":true,"patched_in":"4.2.6.8.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T11:01:35Z"},{"id":"wordfence:7ee73abf-0ab8-48ab-bd94-18ed66f877fd","source":"wordfence","cve":"CVE-2023-49160","title":"Formzu WP <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee73abf-0ab8-48ab-bd94-18ed66f877fd?source=api-prod","affected":[{"type":"plugin","slug":"formzu-wp","name":"Formzu WP","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ee89f85-7d2a-4b8f-85e3-c742b6878b6a","source":"wordfence","cve":"CVE-2026-15048","title":"GeekyBot <= 1.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee89f85-7d2a-4b8f-85e3-c742b6878b6a?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:33:27Z"},{"id":"wordfence:7ee8f9d3-a8c4-443c-a297-27559142bb8e","source":"wordfence","cve":"CVE-2025-47441","title":"Progress Bar <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee8f9d3-a8c4-443c-a297-27559142bb8e?source=api-prod","affected":[{"type":"plugin","slug":"progress-bar","name":"Progress Bar","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:22:22Z"},{"id":"wordfence:7ee97559-fee4-48e5-8255-0044cdf8fa8e","source":"wordfence","cve":"CVE-2025-47616","title":"aBlocks <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee97559-fee4-48e5-8255-0044cdf8fa8e?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-07-25T15:52:42Z"},{"id":"wordfence:7eebfbf8-250b-44be-aadb-79647371c8d9","source":"wordfence","cve":"CVE-2026-66680","title":"Locatoraid Store Locator <= 3.9.72 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eebfbf8-250b-44be-aadb-79647371c8d9?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.72","to_inclusive":true,"patched_in":"3.9.73"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:18:46Z"},{"id":"wordfence:7eed1ae6-ee59-4616-9564-9aa5ec302ea9","source":"wordfence","cve":"CVE-2014-5182","title":"YAWPP (Yet Another WordPress Petition Plugin) <= 1.2.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eed1ae6-ee59-4616-9564-9aa5ec302ea9?source=api-prod","affected":[{"type":"plugin","slug":"yawpp","name":"YAWPP (Yet Another WordPress Petition Plugin)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7eee591c-2676-479c-ab15-96da10f51ae0","source":"wordfence","cve":"CVE-2024-23514","title":"Click To Tweet <= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7eee591c-2676-479c-ab15-96da10f51ae0?source=api-prod","affected":[{"type":"plugin","slug":"click-to-tweet","name":"Click To Tweet","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":""}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-04T13:32:51Z"},{"id":"wordfence:7ef23b03-8452-4730-860c-2c2ef1686202","source":"wordfence","cve":"CVE-2023-0844","title":"Namaste! LMS <= 2.5.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'accept_other_payment_methods', 'other_payment_methods' Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef23b03-8452-4730-860c-2c2ef1686202?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.5.9.9","to_inclusive":true,"patched_in":"2.6"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ef37e72-f98f-4df6-8adb-514690350a82","source":"wordfence","cve":"CVE-2024-1487","title":"Photos and Files Contest Gallery \u2013 Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress <= 21.3.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef37e72-f98f-4df6-8adb-514690350a82?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.3.0","to_inclusive":true,"patched_in":"21.3.1"}],"published":"2024-02-14T00:00:00Z","updated":"2024-04-24T14:43:45Z"},{"id":"wordfence:7ef64118-b388-4260-930b-6a31992d4076","source":"wordfence","cve":"CVE-2017-18605","title":"Gravitate QA Tracker <= 1.2.1 - Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef64118-b388-4260-930b-6a31992d4076?source=api-prod","affected":[{"type":"plugin","slug":"gravitate-qa-tracker","name":"Gravitate QA Tracker","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2017-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ef6f598-e1a7-4036-9485-1aad0416349a","source":"wordfence","cve":"CVE-2023-5658","title":"WP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef6f598-e1a7-4036-9485-1aad0416349a?source=api-prod","affected":[{"type":"plugin","slug":"wp-mapit","name":"WP MapIt","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ef79c77-53e7-439d-985a-786eb73c44eb","source":"wordfence","cve":"CVE-2023-25061","title":"Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef79c77-53e7-439d-985a-786eb73c44eb?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.1.1"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7efa41a3-4752-451c-a2d8-1dce9781dd6f","source":"wordfence","cve":"CVE-2025-64258","title":"Follow My Blog Post <= 2.3.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7efa41a3-4752-451c-a2d8-1dce9781dd6f?source=api-prod","affected":[{"type":"plugin","slug":"follow-my-blog-post","name":"follow-my-blog-post","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-20T19:18:06Z"},{"id":"wordfence:7efacddc-3ca9-488b-a143-fe3a990d1324","source":"wordfence","cve":"CVE-2025-26933","title":"WC Place Order Without Payment <= 2.6.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7efacddc-3ca9-488b-a143-fe3a990d1324?source=api-prod","affected":[{"type":"plugin","slug":"wc-place-order-without-payment","name":"Place Order Without Payment for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:31:13Z"},{"id":"wordfence:7efb5260-0717-421b-9e23-4badd2874110","source":"wordfence","cve":"CVE-2025-69070","title":"Tornados <= 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7efb5260-0717-421b-9e23-4badd2874110?source=api-prod","affected":[{"type":"theme","slug":"tornados","name":"Tornados | Basketball NBA Team WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:32:35Z"},{"id":"wordfence:7efbe153-65fe-443f-838f-5fb19af734c6","source":"wordfence","cve":"CVE-2026-110508","title":"Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7efbe153-65fe-443f-838f-5fb19af734c6?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"6.7.3","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"6.8.7"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T21:16:22Z"},{"id":"wordfence:7efe0cd8-e8a0-43e8-b797-ddb690ba9e51","source":"wordfence","cve":"CVE-2024-38672","title":"AdPush <= 1.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7efe0cd8-e8a0-43e8-b797-ddb690ba9e51?source=api-prod","affected":[{"type":"plugin","slug":"adsense-plugin","name":"AdPush","from":"*","from_inclusive":true,"to":"1.50","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:12:03Z"},{"id":"wordfence:7f01ad95-7a51-408c-917f-4350dbeabb2b","source":"wordfence","cve":"CVE-2023-36520","title":"Editorial Calendar <= 3.7.12 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f01ad95-7a51-408c-917f-4350dbeabb2b?source=api-prod","affected":[{"type":"plugin","slug":"editorial-calendar","name":"Editorial Calendar","from":"*","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f0458ad-fe21-43ac-ac8a-4ad0f3c957a8","source":"wordfence","cve":"CVE-2024-51630","title":"Responsive Flickr Gallery <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0458ad-fe21-43ac-ac8a-4ad0f3c957a8?source=api-prod","affected":[{"type":"plugin","slug":"responsive-flickr-gallery","name":"Responsive Flickr Gallery","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:18:07Z"},{"id":"wordfence:7f051566-ac84-4ab6-b0ce-4dbcafc09d67","source":"wordfence","cve":"CVE-2022-4754","title":"Easy Social Box / Page Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f051566-ac84-4ab6-b0ce-4dbcafc09d67?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-like-box","name":"Easy Social Box / Page Plugin","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f0741c1-a5d7-41a4-a739-2cb7cb836509","source":"wordfence","cve":"CVE-2026-0593","title":"WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0741c1-a5d7-41a4-a739-2cb7cb836509?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.0.04","to_inclusive":true,"patched_in":"10.0.05"}],"published":"2026-01-24T04:04:19Z","updated":"2026-01-24T16:25:51Z"},{"id":"wordfence:7f098942-caa1-45fb-841c-5b9e0826ee15","source":"wordfence","cve":"CVE-2025-53244","title":"Magazine Elite <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f098942-caa1-45fb-841c-5b9e0826ee15?source=api-prod","affected":[{"type":"theme","slug":"magazine-elite","name":"Magazine Elite","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:16:27Z"},{"id":"wordfence:7f0be29a-7896-4166-a2a6-64f99d845236","source":"wordfence","cve":"CVE-2023-27628","title":"Sitekit <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0be29a-7896-4166-a2a6-64f99d845236?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f0eac1e-4988-4b73-bf13-c959b0dc11e2","source":"wordfence","cve":"","title":"Form Maker <= 1.15.16 - Missing Authorization in check_score","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0eac1e-4988-4b73-bf13-c959b0dc11e2?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.16","to_inclusive":true,"patched_in":"1.15.17"}],"published":"2023-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f0f453c-ca01-4ccc-b8c0-4468db40386a","source":"wordfence","cve":"CVE-2026-87869","title":"Filter Everything\u00a0\u2014 WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0f453c-ca01-4ccc-b8c0-4468db40386a?source=api-prod","affected":[{"type":"plugin","slug":"filter-everything","name":"Filter Everything\u00a0\u2014 WordPress & WooCommerce Filters","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2026-10-09T15:41:31Z","updated":"2026-10-10T04:26:46Z"},{"id":"wordfence:7f119b98-9c42-40e2-b4f3-c26bed3cc213","source":"wordfence","cve":"CVE-2025-31560","title":"Salon booking system <= 10.11 - Authenticated Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f119b98-9c42-40e2-b4f3-c26bed3cc213?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.11","to_inclusive":true,"patched_in":"10.15"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-17T13:00:42Z"},{"id":"wordfence:7f13a432-e37d-4183-85ff-e2a04b40cda8","source":"wordfence","cve":"CVE-2023-47532","title":"WP Crowdfunding <= 2.1.6 - Reflected Cross-Site Scripting via postid","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f13a432-e37d-4183-85ff-e2a04b40cda8?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f15ac06-b5d3-4265-b69b-1d46b12a0522","source":"wordfence","cve":"CVE-2023-29426","title":"Spreadshop Plugin <= 1.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f15ac06-b5d3-4265-b69b-1d46b12a0522?source=api-prod","affected":[{"type":"plugin","slug":"spreadshop","name":"Spreadshop Plugin","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f16f623-8443-42d4-bfb5-a7618872bc10","source":"wordfence","cve":"CVE-2026-82305","title":"YITH WooCommerce Wishlist < 4.18.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f16f623-8443-42d4-bfb5-a7618872bc10?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.18.1","to_inclusive":false,"patched_in":"4.18.1"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:28:58Z"},{"id":"wordfence:7f17e055-ad49-4115-89c5-dd76b6c531f7","source":"wordfence","cve":"CVE-2024-7621","title":"Visual Website Collaboration, Feedback & Project Management \u2013 Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f17e055-ad49-4115-89c5-dd76b6c531f7?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2024-08-09T13:41:33Z","updated":"2024-08-10T02:01:22Z"},{"id":"wordfence:7f192811-378b-422d-8086-9a957b464bb7","source":"wordfence","cve":"CVE-2023-47848","title":"Tainacan <= 0.20.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f192811-378b-422d-8086-9a957b464bb7?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.20.4","to_inclusive":true,"patched_in":"0.20.5"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f197721-d7d6-49db-8cdc-0162c0c2960b","source":"wordfence","cve":"CVE-2026-27421","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f197721-d7d6-49db-8cdc-0162c0c2960b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1053","to_inclusive":false,"patched_in":"1.7.1053"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:29:52Z"},{"id":"wordfence:7f1a0d90-2574-4d48-b673-f47c8bc65d21","source":"wordfence","cve":"CVE-2019-15318","title":"Easy Forms for Mailchimp <= 6.5.2 - Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f1a0d90-2574-4d48-b673-f47c8bc65d21?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":false,"patched_in":"6.5.3"}],"published":"2019-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f1e81de-44fc-4125-b722-2c16c1f22ffa","source":"wordfence","cve":"CVE-2025-49410","title":"Portfolio Manager Pro  3.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f1e81de-44fc-4125-b722-2c16c1f22ffa?source=api-prod","affected":[{"type":"plugin","slug":"otw-portfolio-manager","name":"Portfolio Manager Pro - WordPress Responsive Portfolio & Gallery","from":"3.8","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:23:13Z"},{"id":"wordfence:7f20352f-386f-45ab-b719-8a70f5c11b02","source":"wordfence","cve":"CVE-2017-1000170","title":"JQueryFileTree <= 2.1.5 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f20352f-386f-45ab-b719-8a70f5c11b02?source=api-prod","affected":[{"type":"plugin","slug":"better-search-tmc","name":"Better Search TMC","from":"*","from_inclusive":true,"to":"1.0.52","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"admin-page-framework","name":"Admin Page Framework","from":"*","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.9.0"},{"type":"plugin","slug":"task-scheduler","name":"Task Scheduler","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"faculty-weekly-schedule","name":"Faculty Weekly Schedule","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"read-offline","name":"Read Offline","from":"*","from_inclusive":true,"to":"0.9.17","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"revision-manager-tmc","name":"Revision Manager TMC","from":"*","from_inclusive":true,"to":"2.7.91","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"delightful-downloads","name":"Delightful Downloads","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2017-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f250c22-5615-4223-a7d0-8467cb2f8541","source":"wordfence","cve":"CVE-2026-78295","title":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f250c22-5615-4223-a7d0-8467cb2f8541?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.43","to_inclusive":true,"patched_in":"7.1.0.44"}],"published":"2026-09-16T18:12:00Z","updated":"2026-09-22T18:50:59Z"},{"id":"wordfence:7f25f001-cbb7-4d73-b37d-47bc1681c690","source":"wordfence","cve":"CVE-2024-43334","title":"Multiple Themes by gavias <= Various Versions - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f25f001-cbb7-4d73-b37d-47bc1681c690?source=api-prod","affected":[{"type":"theme","slug":"fioxen","name":"Fioxen - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"theme","slug":"boliin","name":"Boliin - Resort & Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"},{"type":"theme","slug":"paroti","name":"Paroti - Nonprofit Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"theme","slug":"lestin","name":"Lestin - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"theme","slug":"conult","name":"Conult - Consulting Business WordPress Themes","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"},{"type":"theme","slug":"constix","name":"Constix - Construction Factory & Industrial WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"},{"type":"theme","slug":"sominx","name":"Sominx - Creative Business Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"halpes","name":"Halpes - Nonprofit Charity Drupal 10 Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"theme","slug":"modins","name":"Modins - Insurance & Finance Drupal 11 Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"theme","slug":"welowe","name":"Welowe - Nonprofit Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"theme","slug":"qizon","name":"Qizon - Crowdfunding & Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"theme","slug":"fude","name":"TheFude - Crowdfunding & Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"},{"type":"theme","slug":"aports","name":"Aports - Single Property WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"},{"type":"theme","slug":"gowilds","name":"Gowilds - Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"theme","slug":"qempo","name":"Qempo - Digital Agency Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"pisole","name":"Pisole - Digital Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"theme","slug":"orgarium","name":"Orgarium - Agriculture & Organic Farm WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"theme","slug":"tevily","name":"Tevily - Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"theme","slug":"zilom","name":"Zilom - Online Education Learning WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2025-01-06T00:00:00Z","updated":"2026-03-06T13:21:28Z"},{"id":"wordfence:7f26cf69-5dad-41ab-b302-6d4a753a9586","source":"wordfence","cve":"CVE-2026-27389","title":"WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f26cf69-5dad-41ab-b302-6d4a753a9586?source=api-prod","affected":[{"type":"plugin","slug":"wedesigntech-ultimate-booking-addon","name":"WeDesignTech Ultimate Booking Addon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T17:58:31Z"},{"id":"wordfence:7f2b424c-8f2b-4535-a556-0bd833eff2aa","source":"wordfence","cve":"CVE-2025-48157","title":"Formality <= 1.5.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2b424c-8f2b-4535-a556-0bd833eff2aa?source=api-prod","affected":[{"type":"plugin","slug":"formality","name":"Formality","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:27:26Z"},{"id":"wordfence:7f2bd1b0-c130-4317-a159-abcb4af290e7","source":"wordfence","cve":"CVE-2025-26904","title":"WP Responsive Auto Fit Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2bd1b0-c130-4317-a159-abcb4af290e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slab-text","name":"WP Responsive Auto Fit Text","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:19:39Z"},{"id":"wordfence:7f2c39f6-3d37-4765-99e8-023610856b61","source":"wordfence","cve":"CVE-2026-6206","title":"MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2c39f6-3d37-4765-99e8-023610856b61?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-13T19:51:32Z","updated":"2026-05-14T08:24:28Z"},{"id":"wordfence:7f2d3acb-5931-4629-8f03-4ab40fadf7c7","source":"wordfence","cve":"CVE-2024-9647","title":"Kama SpamBlock <= 1.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2d3acb-5931-4629-8f03-4ab40fadf7c7?source=api-prod","affected":[{"type":"plugin","slug":"kama-spamblock","name":"Kama SpamBlock","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:08Z"},{"id":"wordfence:7f2dcf48-168d-4ae9-834c-8d0adf2f8f71","source":"wordfence","cve":"CVE-2025-49298","title":"Event post <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2dcf48-168d-4ae9-834c-8d0adf2f8f71?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:55:46Z"},{"id":"wordfence:7f33bc98-167d-4913-8de5-b80296955673","source":"wordfence","cve":"CVE-2016-10879","title":"3CX Free Live Chat <= 6.2.03 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f33bc98-167d-4913-8de5-b80296955673?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"6.2.03","to_inclusive":true,"patched_in":"6.2.04"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f341562-232e-437f-8d3d-83a06402e8ef","source":"wordfence","cve":"CVE-2024-37095","title":"Envira Photo Gallery <= 1.8.7.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f341562-232e-437f-8d3d-83a06402e8ef?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.7.3","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:48:18Z"},{"id":"wordfence:7f34f4a6-9092-4e67-8a1e-7c60edde0b2a","source":"wordfence","cve":"CVE-2024-1386","title":"MailerLite \u2013 Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f34f4a6-9092-4e67-8a1e-7c60edde0b2a?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"1.5.0","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:17Z"},{"id":"wordfence:7f365519-dd0a-4f39-880d-7216ce2f7d1e","source":"wordfence","cve":"CVE-2026-3360","title":"Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-04-09T12:40:11Z","updated":"2026-04-10T01:24:58Z"},{"id":"wordfence:7f380786-7fd8-4a01-b491-63a2c6098a9e","source":"wordfence","cve":"CVE-2022-4383","title":"CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f380786-7fd8-4a01-b491-63a2c6098a9e?source=api-prod","affected":[{"type":"plugin","slug":"cbxpetition","name":"CBX Petition","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-27T00:00:00Z","updated":"2025-06-05T17:42:55Z"},{"id":"wordfence:7f3b13a5-0711-4ad3-b11c-f8556e1ca9f9","source":"wordfence","cve":"CVE-2026-1252","title":"Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3b13a5-0711-4ad3-b11c-f8556e1ca9f9?source=api-prod","affected":[{"type":"plugin","slug":"events-listing-widget","name":"Events Listing Widget","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-02-05T19:36:04Z","updated":"2026-02-06T08:25:27Z"},{"id":"wordfence:7f3b7b5e-486b-447a-af65-b58d680b9870","source":"wordfence","cve":"CVE-2026-57643","title":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3b7b5e-486b-447a-af65-b58d680b9870?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:54:13Z"},{"id":"wordfence:7f3dac5a-9ff8-4e8c-8c73-422123e121d8","source":"wordfence","cve":"CVE-2024-12583","title":"Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection","severity":"critical","cvss":9.9,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.23","to_inclusive":true,"patched_in":"1.3.24"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-04T08:22:52Z"},{"id":"wordfence:7f42730f-f701-4f35-a240-5fa4229dff8b","source":"wordfence","cve":"CVE-2025-22537","title":"Google Maps Travel Route <= 1.3.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f42730f-f701-4f35-a240-5fa4229dff8b?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-travel-route","name":"Google Maps Travel Route","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:53:57Z"},{"id":"wordfence:7f42ce13-9dca-4d99-baae-ec2b6f2e82e4","source":"wordfence","cve":"CVE-2025-64194","title":"Eduma <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f42ce13-9dca-4d99-baae-ec2b6f2e82e4?source=api-prod","affected":[{"type":"theme","slug":"eduma","name":"Eduma","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2025-10-18T00:00:00Z","updated":"2025-11-04T15:47:39Z"},{"id":"wordfence:7f447d25-1a38-48fe-8079-5ff425382046","source":"wordfence","cve":"","title":"eCommerce Product Catalog Plugin for WordPress <= 3.0.69 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f447d25-1a38-48fe-8079-5ff425382046?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.69","to_inclusive":true,"patched_in":"3.0.70"}],"published":"2022-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f45b7d0-6816-45dc-b373-b63a42bbb9f1","source":"wordfence","cve":"CVE-2026-76006","title":"Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f45b7d0-6816-45dc-b373-b63a42bbb9f1?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":true,"patched_in":"6.8.3"}],"published":"2026-08-31T15:57:55Z","updated":"2026-09-01T04:27:51Z"},{"id":"wordfence:7f46ab3d-83fc-46a2-863e-7ce9b5391524","source":"wordfence","cve":"CVE-2021-24604","title":"Availability Calendar <= 1.2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f46ab3d-83fc-46a2-863e-7ce9b5391524?source=api-prod","affected":[{"type":"plugin","slug":"availability-calendar","name":"Availability Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2021-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f47ab91-7d91-4231-91ef-66c556ad8496","source":"wordfence","cve":"CVE-2025-13215","title":"Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f47ab91-7d91-4231-91ef-66c556ad8496?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.13","to_inclusive":true,"patched_in":"2.17.14"}],"published":"2026-01-05T17:46:17Z","updated":"2026-01-06T06:36:26Z"},{"id":"wordfence:7f48ee6c-147b-4461-ae45-fe10a930f036","source":"wordfence","cve":"CVE-2026-19858","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f48ee6c-147b-4461-ae45-fe10a930f036?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.2","to_inclusive":false,"patched_in":"3.6.5.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:17:09Z"},{"id":"wordfence:7f49477f-7a43-489b-8d3c-db8d0efeb596","source":"wordfence","cve":"CVE-2023-29423","title":"Cancel order request WooCommerce <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f49477f-7a43-489b-8d3c-db8d0efeb596?source=api-prod","affected":[{"type":"plugin","slug":"cancel-order-request-woocommerce","name":"PiWeb Cancel order / Refund request for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f4959a8-21e7-4cbf-a150-704abc956f31","source":"wordfence","cve":"CVE-2025-62882","title":"Seriously Simple Podcasting <= 3.13.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4959a8-21e7-4cbf-a150-704abc956f31?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2025-06-12T00:00:00Z","updated":"2025-11-13T15:48:10Z"},{"id":"wordfence:7f4c0bd6-f289-4a52-ac11-345076c32d84","source":"wordfence","cve":"CVE-2025-12359","title":"Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4c0bd6-f289-4a52-ac11-345076c32d84?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-11-18T17:10:58Z","updated":"2025-11-19T05:45:16Z"},{"id":"wordfence:7f4c9a5b-93ec-4979-921a-91134cb09566","source":"wordfence","cve":"CVE-2022-4655","title":"Welcart e-Commerce <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4c9a5b-93ec-4979-921a-91134cb09566?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f4cf85d-6105-4f7d-b4a0-18a3513a93a8","source":"wordfence","cve":"CVE-2026-1032","title":"Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4cf85d-6105-4f7d-b4a0-18a3513a93a8?source=api-prod","affected":[{"type":"plugin","slug":"conditional-menus","name":"Conditional Menus","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T13:26:09Z"},{"id":"wordfence:7f4df92b-b6b5-441e-a772-fed63cb83bf7","source":"wordfence","cve":"CVE-2022-3994","title":"Authenticator <= 1.3.0 - Missing Authorization","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4df92b-b6b5-441e-a772-fed63cb83bf7?source=api-prod","affected":[{"type":"plugin","slug":"authenticator","name":"Authenticator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2022-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f4e6133-f833-4da2-af4a-e7e7fcedfe3c","source":"wordfence","cve":"CVE-2026-12400","title":"FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4e6133-f833-4da2-af4a-e7e7fcedfe3c?source=api-prod","affected":[{"type":"plugin","slug":"flowforms","name":"FlowForms \u2013 Conversational Form Builder","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-07-09T19:17:45Z","updated":"2026-07-10T07:48:43Z"},{"id":"wordfence:7f4ee2ab-7741-4c5c-b8aa-19577c1293b8","source":"wordfence","cve":"CVE-2025-49406","title":"Houzez <= 4.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4ee2ab-7741-4c5c-b8aa-19577c1293b8?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-25T20:12:19Z"},{"id":"wordfence:7f4f188f-ca84-44df-9738-d61094c2e695","source":"wordfence","cve":"CVE-2022-2311","title":"Find and Replace All <= 1.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4f188f-ca84-44df-9738-d61094c2e695?source=api-prod","affected":[{"type":"plugin","slug":"find-and-replace-all","name":"Find and Replace All","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f50769c-77b8-42ff-b67d-b9b289fc51da","source":"wordfence","cve":"CVE-2024-8478","title":"Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f50769c-77b8-42ff-b67d-b9b289fc51da?source=api-prod","affected":[{"type":"plugin","slug":"amazonsimpleadmin","name":"Affiliate Super Assistent","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T02:05:15Z"},{"id":"wordfence:7f51ae93-6880-4dc8-b183-424a8407f441","source":"wordfence","cve":"","title":"Livefyre Comments 3 <= 4.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f51ae93-6880-4dc8-b183-424a8407f441?source=api-prod","affected":[{"type":"plugin","slug":"livefyre-comments","name":"Livefyre Comments 3","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2015-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f52cbb4-8fe3-4402-8ece-261d32329a42","source":"wordfence","cve":"CVE-2025-5055","title":"Smart Forms <= 2.6.98 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f52cbb4-8fe3-4402-8ece-261d32329a42?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.98","to_inclusive":true,"patched_in":"2.6.99"}],"published":"2025-05-23T13:53:24Z","updated":"2025-08-01T19:31:43Z"},{"id":"wordfence:7f54b42c-798b-4c6b-9b05-3ad6a35b562f","source":"wordfence","cve":"CVE-2026-118087","title":"Site Reviews <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f54b42c-798b-4c6b-9b05-3ad6a35b562f?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.3.5","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2026-10-29T13:00:00Z","updated":"2026-11-03T19:44:03Z"},{"id":"wordfence:7f559d7f-3faf-4549-b529-f4db03dce2dd","source":"wordfence","cve":"CVE-2025-12136","title":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint","severity":"medium","cvss":6.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f559d7f-3faf-4549-b529-f4db03dce2dd?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-24T09:23:33Z"},{"id":"wordfence:7f562b4c-8934-45fd-b9a4-eeb3a6bcf609","source":"wordfence","cve":"CVE-2020-36505","title":"Delete All Comments Easily <= 1.3 - All Comments Deletion via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f562b4c-8934-45fd-b9a4-eeb3a6bcf609?source=api-prod","affected":[{"type":"plugin","slug":"delete-all-comments-easily","name":"Delete All Comments Easily","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2020-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f585328-81c5-4925-b879-30d6ab6fe2c9","source":"wordfence","cve":"CVE-2026-73181","title":"Extra Product Options & Add-Ons for WooCommerce < 7.6 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f585328-81c5-4925-b879-30d6ab6fe2c9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-tm-extra-product-options","name":"Extra Product Options & Add-Ons for WooCommerce","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":false,"patched_in":"7.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T16:33:22Z"},{"id":"wordfence:7f58c208-71a8-4276-bdba-f7e87acd78fc","source":"wordfence","cve":"CVE-2026-81801","title":"WP-Stateless \u2013 Google Cloud Storage <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f58c208-71a8-4276-bdba-f7e87acd78fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-stateless","name":"WP-Stateless \u2013 Google Cloud Storage","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:53:12Z"},{"id":"wordfence:7f5bc5cc-fe96-48f6-b9c9-a2b9d83406b6","source":"wordfence","cve":"CVE-2022-1217","title":"Custom TinyMCE Shortcode Button <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5bc5cc-fe96-48f6-b9c9-a2b9d83406b6?source=api-prod","affected":[{"type":"plugin","slug":"custom-tinymce-shortcode-button","name":"Custom TinyMCE Shortcode Button","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f5c5f64-a864-4ce1-9080-19f7c4418307","source":"wordfence","cve":"CVE-2026-1371","title":"Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-02-02T18:49:17Z","updated":"2026-02-03T07:31:25Z"},{"id":"wordfence:7f5d3973-5bbb-4c85-9790-e12f3fc14f30","source":"wordfence","cve":"CVE-2023-47551","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5d3973-5bbb-4c85-9790-e12f3fc14f30?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f5d8eac-fca9-4222-9a5f-a12748d298ec","source":"wordfence","cve":"CVE-2025-2513","title":"Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5d8eac-fca9-4222-9a5f-a12748d298ec?source=api-prod","affected":[{"type":"plugin","slug":"smartifw","name":"Smart Icons For WordPress","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:28:05Z","updated":"2025-04-02T09:21:44Z"},{"id":"wordfence:7f603e21-56ba-40a7-923d-eb5cd659dfe2","source":"wordfence","cve":"CVE-2026-96818","title":"WP Express Checkout (Fast Payments via PayPal & Stripe) <= 2.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f603e21-56ba-40a7-923d-eb5cd659dfe2?source=api-prod","affected":[{"type":"plugin","slug":"wp-express-checkout","name":"WP Express Checkout (Fast Payments via PayPal & Stripe)","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-09-29T07:17:28Z","updated":"2026-10-08T23:55:16Z"},{"id":"wordfence:7f654a3f-1fd6-4a0f-9490-b0ad7ca161c4","source":"wordfence","cve":"CVE-2026-93344","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f654a3f-1fd6-4a0f-9490-b0ad7ca161c4?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.71","to_inclusive":true,"patched_in":"2.1.72"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:07:48Z"},{"id":"wordfence:7f6693fd-2ffc-4281-9da3-bdbf70e20cfa","source":"wordfence","cve":"CVE-2021-24780","title":"Single Post Exporter <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f6693fd-2ffc-4281-9da3-bdbf70e20cfa?source=api-prod","affected":[{"type":"plugin","slug":"single-post-exporter","name":"Single Post Exporter","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f66d26a-8eb7-4b29-bb7f-afdd762be4b2","source":"wordfence","cve":"CVE-2026-75017","title":"Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f66d26a-8eb7-4b29-bb7f-afdd762be4b2?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2026-09-17T18:37:21Z","updated":"2026-09-18T06:38:54Z"},{"id":"wordfence:7f690ea9-b773-49d4-9fa4-2a8bb7593d62","source":"wordfence","cve":"CVE-2023-49170","title":"Forms by CaptainForm <= 2.5.3 - Reflected Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f690ea9-b773-49d4-9fa4-2a8bb7593d62?source=api-prod","affected":[{"type":"plugin","slug":"captainform","name":"Forms by CaptainForm \u2013 Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f6c33f4-58e7-4a0b-8293-5cb951f63ffc","source":"wordfence","cve":"CVE-2021-36847","title":"Webba Booking <= 4.2.21 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f6c33f4-58e7-4a0b-8293-5cb951f63ffc?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"4.2.22"}],"published":"2022-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f6ecf14-669a-41a6-bacd-de64d497be50","source":"wordfence","cve":"CVE-2026-39704","title":"Precious Metals Automated Product Pricing \u2013 Pro <= 4.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f6ecf14-669a-41a6-bacd-de64d497be50?source=api-prod","affected":[{"type":"plugin","slug":"precious-metals-automated-product-pricing-pro","name":"Precious Metals Product Prices for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-03-01T00:00:00Z","updated":"2026-09-30T14:23:28Z"},{"id":"wordfence:7f6f1c16-afd6-4c69-8988-70c6c0105748","source":"wordfence","cve":"CVE-2024-10471","title":"Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f6f1c16-afd6-4c69-8988-70c6c0105748?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.0.4.1","to_inclusive":true,"patched_in":"3.0.4.2"}],"published":"2024-11-05T00:00:00Z","updated":"2026-09-04T00:51:57Z"},{"id":"wordfence:7f706c15-56c8-4eb4-9790-b394d37b0e33","source":"wordfence","cve":"CVE-2021-39347","title":"Stripe for WooCommerce 3.0.0 - 3.3.9 - Missing Authorization Controls to Financial Account Hijacking","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f706c15-56c8-4eb4-9790-b394d37b0e33?source=api-prod","affected":[{"type":"plugin","slug":"stripe-for-woocommerce","name":"Stripe for WooCommerce","from":"3.0.0","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.10"}],"published":"2021-10-01T15:29:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f708c72-7ce2-4eb0-869b-cec4613f6f3f","source":"wordfence","cve":"CVE-2025-1491","title":"WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-carousel","name":"CCI Posts Carousel All In One","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-03-01T00:08:23Z","updated":"2025-03-01T12:22:45Z"},{"id":"wordfence:7f716cbb-a8be-4e32-a7ce-0b393a89b32e","source":"wordfence","cve":"CVE-2025-67951","title":"WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f716cbb-a8be-4e32-a7ce-0b393a89b32e?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-19T17:03:17Z"},{"id":"wordfence:7f734db8-216e-43f3-8082-ebdcc28d3606","source":"wordfence","cve":"CVE-2024-31297","title":"Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f734db8-216e-43f3-8082-ebdcc28d3606?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-pricing","name":"Wholesale For WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:02:56Z"},{"id":"wordfence:7f73d0a6-2eae-4d85-96ce-db5902bd6e3a","source":"wordfence","cve":"","title":"WooCommerce Pre-Orders <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f73d0a6-2eae-4d85-96ce-db5902bd6e3a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pre-orders","name":"WooCommerce Pre-Orders","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f745e44-fdf1-416d-b1aa-27305533464e","source":"wordfence","cve":"CVE-2024-49250","title":"Table of Contents Plus <= 2408 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f745e44-fdf1-416d-b1aa-27305533464e?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-plus","name":"Table of Contents Plus \u2013 Automatic Table of Contents for Posts & Pages","from":"*","from_inclusive":true,"to":"2408","to_inclusive":true,"patched_in":"2411"}],"published":"2024-10-14T00:00:00Z","updated":"2025-02-28T14:20:02Z"},{"id":"wordfence:7f765327-3872-46cc-a4f9-40219bf0dd99","source":"wordfence","cve":"CVE-2023-41857","title":"Click To Tweet <= 2.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f765327-3872-46cc-a4f9-40219bf0dd99?source=api-prod","affected":[{"type":"plugin","slug":"click-to-tweet","name":"Click To Tweet","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f7827bb-44d7-432d-85aa-3fdb117e1898","source":"wordfence","cve":"CVE-2026-1231","title":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7827bb-44d7-432d-85aa-3fdb117e1898?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.10.0.5","to_inclusive":true,"patched_in":"2.10.0.6"}],"published":"2026-02-10T12:42:02Z","updated":"2026-02-11T01:23:34Z"},{"id":"wordfence:7f787c75-7b27-4256-ac0c-abc2988ea7c8","source":"wordfence","cve":"CVE-2022-45840","title":"Auto Affiliate Links <= 6.2.1.5 - Authenticated (Subscriber+) Plugin Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f787c75-7b27-4256-ac0c-abc2988ea7c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.2.1.5","to_inclusive":true,"patched_in":"6.2.1.6"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f7968c4-589c-4949-9f69-4a0ba4db4ea9","source":"wordfence","cve":"CVE-2025-12813","title":"Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7968c4-589c-4949-9f69-4a0ba4db4ea9?source=api-prod","affected":[{"type":"plugin","slug":"holiday-class-post-calendar","name":"Holiday class post calendar","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.2"}],"published":"2025-11-10T14:59:44Z","updated":"2025-12-11T14:18:45Z"},{"id":"wordfence:7f7a8ee7-af69-4aff-abf7-6d69d920fe61","source":"wordfence","cve":"","title":"Spam Free WordPress <= 1.9.3 - IP Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7a8ee7-af69-4aff-abf7-6d69d920fe61?source=api-prod","affected":[{"type":"plugin","slug":"spam-free-wordpress","name":"Spam Free WordPress","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"2.0"}],"published":"2013-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f7d16d2-ecc0-4352-b7b9-2c3242f43dbf","source":"wordfence","cve":"CVE-2020-9458","title":"RegistrationMagic \u2013 Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings and User Data Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7d16d2-ecc0-4352-b7b9-2c3242f43dbf?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.4","to_inclusive":false,"patched_in":"4.6.0.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f7d8375-e45c-4dae-ae99-eeb7441bcd84","source":"wordfence","cve":"CVE-2025-32299","title":"QuickCal <= 1.0.15 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7d8375-e45c-4dae-ae99-eeb7441bcd84?source=api-prod","affected":[{"type":"plugin","slug":"quickcal","name":"QuickCal","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:07:44Z"},{"id":"wordfence:7f7dca64-4965-4b19-96a1-8c24c49468fb","source":"wordfence","cve":"CVE-2024-10075","title":"Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7dca64-4965-4b19-96a1-8c24c49468fb?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"13.7","to_inclusive":true,"patched_in":"13.8"}],"published":"2024-10-17T00:00:00Z","updated":"2025-05-27T14:41:51Z"},{"id":"wordfence:7f7e3198-39bb-4f56-ace0-dc835a435ce4","source":"wordfence","cve":"CVE-2025-12573","title":"Bookingor <= 1.0.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7e3198-39bb-4f56-ace0-dc835a435ce4?source=api-prod","affected":[{"type":"plugin","slug":"bookingor","name":"Bookingor \u2013 Booking System and Appointment Booking Calendar, Meeting Scheduling & WooCommerce","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:14:50Z"},{"id":"wordfence:7f7ffa58-d942-4d60-9df4-6e646fadc23a","source":"wordfence","cve":"CVE-2024-49245","title":"Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Download","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f7ffa58-d942-4d60-9df4-6e646fadc23a?source=api-prod","affected":[{"type":"plugin","slug":"ahime-image-printer","name":"Ahime Image Printer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:07:08Z"},{"id":"wordfence:7f800bc0-5b1b-43fa-a267-d8db444d0c2c","source":"wordfence","cve":"CVE-2024-54223","title":"ARForms Form Builder <= 1.7.1 - HTML Injection","severity":"medium","cvss":6.5,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f800bc0-5b1b-43fa-a267-d8db444d0c2c?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:47:19Z"},{"id":"wordfence:7f825181-5e83-4a02-975d-5a8829f9c07d","source":"wordfence","cve":"CVE-2026-114185","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f825181-5e83-4a02-975d-5a8829f9c07d?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:35Z"},{"id":"wordfence:7f86568f-dcdd-44fb-905a-9c5474f56515","source":"wordfence","cve":"CVE-2024-10227","title":"affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f86568f-dcdd-44fb-905a-9c5474f56515?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2024-10-28T21:04:00Z","updated":"2024-10-29T09:31:30Z"},{"id":"wordfence:7f86a85c-fe40-4020-b4d2-623dabac98a2","source":"wordfence","cve":"CVE-2025-6681","title":"Fan Page <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f86a85c-fe40-4020-b4d2-623dabac98a2?source=api-prod","affected":[{"type":"plugin","slug":"fan-page","name":"Fan Page","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T20:27:00Z","updated":"2025-07-29T09:23:46Z"},{"id":"wordfence:7f8839cf-9e48-4981-8a0d-bb0c06cdf441","source":"wordfence","cve":"CVE-2023-49165","title":"Client Dash <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f8839cf-9e48-4981-8a0d-bb0c06cdf441?source=api-prod","affected":[{"type":"plugin","slug":"client-dash","name":"Client Dash","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f890e7b-4255-4d74-b717-bc4c9ad0eea6","source":"wordfence","cve":"CVE-2026-109994","title":"Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f890e7b-4255-4d74-b717-bc4c9ad0eea6?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"4.1.30"}],"published":"2026-11-05T20:43:31Z","updated":"2026-11-06T09:38:13Z"},{"id":"wordfence:7f89ce1c-3f5e-43cb-9dd2-7ab5880d78d3","source":"wordfence","cve":"CVE-2022-1216","title":"Advanced Image Sitemap <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f89ce1c-3f5e-43cb-9dd2-7ab5880d78d3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-image-sitemap","name":"Advanced Image Sitemap","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f8bcbe0-dc47-404d-b990-ce0448b69dcb","source":"wordfence","cve":"CVE-2026-78474","title":"Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f8bcbe0-dc47-404d-b990-ce0448b69dcb?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-sales-report","name":"Ni WooCommerce Sales Report \u2013 Orders, Revenue & Sales Analytics Dashboard","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:36:22Z"},{"id":"wordfence:7f8cc393-4d6f-4d15-ad95-d4a89dfe433c","source":"wordfence","cve":"CVE-2025-9216","title":"StoreEngine \u2013 Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f8cc393-4d6f-4d15-ad95-d4a89dfe433c?source=api-prod","affected":[{"type":"plugin","slug":"storeengine","name":"StoreEngine \u2014 Complete eCommerce Solution with Memberships, Licensing, Affiliates & More","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T06:17:50Z"},{"id":"wordfence:7f8e836e-c9af-4614-83b2-c15e77d51155","source":"wordfence","cve":"CVE-2023-0149","title":"WordPrezi <= 0.8.2 - Authenticated (Contributor+) Strored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f8e836e-c9af-4614-83b2-c15e77d51155?source=api-prod","affected":[{"type":"plugin","slug":"wordprezi","name":"WordPrezi","from":"*","from_inclusive":true,"to":"0.8.2","to_inclusive":true,"patched_in":"0.9"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f9069b7-a9b2-4b34-8de8-9fd491c19a7b","source":"wordfence","cve":"CVE-2025-62995","title":"MultiParcels Shipping For WooCommerce <= 1.30.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f9069b7-a9b2-4b34-8de8-9fd491c19a7b?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.30.12","to_inclusive":true,"patched_in":"1.30.13"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-19T15:10:25Z"},{"id":"wordfence:7f910193-9ecc-45eb-b820-adf0da36fa76","source":"wordfence","cve":"CVE-2026-42756","title":"QuickWebP \u2013 Compress / Optimize Images & Convert WebP | SEO Friendly <= 3.2.7 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f910193-9ecc-45eb-b820-adf0da36fa76?source=api-prod","affected":[{"type":"plugin","slug":"quickwebp","name":"QuickWebP \u2013 WebP & AVIF Image Optimizer, Compression & SEO for WordPress","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2026-05-20T00:00:00Z","updated":"2026-06-02T11:18:07Z"},{"id":"wordfence:7f91992e-33fb-4384-af34-e27f68e1ca6e","source":"wordfence","cve":"CVE-2020-5392","title":"Login by Auth0 Plugin <= 3.11.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f91992e-33fb-4384-af34-e27f68e1ca6e?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f94efa6-b88b-442d-8162-f03efa7f2f65","source":"wordfence","cve":"CVE-2024-0900","title":"Elespare \u2013 Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f94efa6-b88b-442d-8162-f03efa7f2f65?source=api-prod","affected":[{"type":"plugin","slug":"elespare","name":"EleSpare \u2013 Elementor News, Magazine & Blog Addons with Post Grid","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T08:32:55Z"},{"id":"wordfence:7f96a16e-0ae5-421e-b3d3-7299a5f99e1d","source":"wordfence","cve":"CVE-2026-12971","title":"LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f96a16e-0ae5-421e-b3d3-7299a5f99e1d?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-17T16:08:54Z"},{"id":"wordfence:7f97af51-1532-4034-8b2a-8356b65cb617","source":"wordfence","cve":"CVE-2023-3226","title":"Popup Builder <= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f97af51-1532-4034-8b2a-8356b65cb617?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f99af65-c283-4da4-8912-9a3e15d9c46d","source":"wordfence","cve":"CVE-2025-48087","title":"Memberlite Shortcodes <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f99af65-c283-4da4-8912-9a3e15d9c46d?source=api-prod","affected":[{"type":"plugin","slug":"memberlite-shortcodes","name":"Memberlite Shortcodes","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-17T00:00:00Z","updated":"2026-06-21T18:52:21Z"},{"id":"wordfence:7f99fc40-c5b8-4ce8-9422-9c02b1eca9cc","source":"wordfence","cve":"CVE-2025-39458","title":"Foton <= 2.5.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f99fc40-c5b8-4ce8-9422-9c02b1eca9cc?source=api-prod","affected":[{"type":"theme","slug":"foton","name":"Foton - Software and App Landing Page Theme","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:41:41Z"},{"id":"wordfence:7f9b1ed9-fdbf-4096-b355-9798a3f5c5ba","source":"wordfence","cve":"CVE-2025-29008","title":"SocialMark <= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f9b1ed9-fdbf-4096-b355-9798a3f5c5ba?source=api-prod","affected":[{"type":"plugin","slug":"socialmark","name":"SocialMark \u2013 Easy Watermark/Logo on Social Media Post Link Share Preview","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:27:05Z"},{"id":"wordfence:7f9b86a3-c68a-443f-a2f3-5f31f3280a6f","source":"wordfence","cve":"","title":"ShortPixel Image Optimizer <= 4.22.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f9b86a3-c68a-443f-a2f3-5f31f3280a6f?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"4.22.9","to_inclusive":true,"patched_in":"4.22.10"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7f9b9d94-92c8-477f-8b35-78cae2e07558","source":"wordfence","cve":"CVE-2025-26553","title":"Pre Order Addon for WooCommerce \u2013 Advance Order/Backorder Plugin <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7f9b9d94-92c8-477f-8b35-78cae2e07558?source=api-prod","affected":[{"type":"plugin","slug":"wc-pre-order","name":"Pre Order Addon for WooCommerce \u2013 Advance Order/Backorder Plugin","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:38:47Z"},{"id":"wordfence:7fa2c000-7cb1-4f77-baa3-dbeeeccb9c01","source":"wordfence","cve":"CVE-2025-62873","title":"Flashy Marketing Automation <= 2.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa2c000-7cb1-4f77-baa3-dbeeeccb9c01?source=api-prod","affected":[{"type":"plugin","slug":"wp-flashy-marketing-automation","name":"WP Flashy Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-12-08T00:00:00Z","updated":"2026-01-06T19:05:57Z"},{"id":"wordfence:7fa34f23-a319-46ec-baea-dd9753ccc5ba","source":"wordfence","cve":"CVE-2025-23688","title":"Cobwebo URL Plugin <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa34f23-a319-46ec-baea-dd9753ccc5ba?source=api-prod","affected":[{"type":"plugin","slug":"cobwebo-url","name":"Cobwebo URL Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:25:51Z"},{"id":"wordfence:7fa5206e-8888-4872-b4bd-91fe5628498c","source":"wordfence","cve":"CVE-2026-3639","title":"PPWP \u2013 Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa5206e-8888-4872-b4bd-91fe5628498c?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.21","to_inclusive":true,"patched_in":"1.9.22"}],"published":"2026-08-12T18:40:45Z","updated":"2026-08-28T22:44:27Z"},{"id":"wordfence:7fa57b92-3a3e-418c-bfc2-7ed2602004e4","source":"wordfence","cve":"CVE-2023-23700","title":"OceanWP <= 3.4.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa57b92-3a3e-418c-bfc2-7ed2602004e4?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fa5ac48-57b6-4367-81a0-8310360d0c7d","source":"wordfence","cve":"CVE-2023-23882","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa5ac48-57b6-4367-81a0-8310360d0c7d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fa8c406-e64d-4093-a102-436ecfb7dd76","source":"wordfence","cve":"CVE-2023-32513","title":"GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa8c406-e64d-4093-a102-436ecfb7dd76?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.3","to_inclusive":true,"patched_in":"2.26.0"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fa986aa-e899-42e1-9b86-8b205e247cbf","source":"wordfence","cve":"CVE-2022-1595","title":"HC Custom WP-Admin URL <= 1.4 - Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa986aa-e899-42e1-9b86-8b205e247cbf?source=api-prod","affected":[{"type":"plugin","slug":"hc-custom-wp-admin-url","name":"HC Custom WP-Admin URL","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fab0e10-d388-41d4-a01f-9bbb8c3cfb5f","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fab0e10-d388-41d4-a01f-9bbb8c3cfb5f?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:48Z"},{"id":"wordfence:7fab176c-d9fc-4114-8ee5-25be4b8571b6","source":"wordfence","cve":"CVE-2025-53460","title":"AffiliateWP \u2013 External Referral Links <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fab176c-d9fc-4114-8ee5-25be4b8571b6?source=api-prod","affected":[{"type":"plugin","slug":"affiliatewp-external-referral-links","name":"AffiliateWP \u2013 External Referral Links","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:09:59Z"},{"id":"wordfence:7fabdf42-4608-4182-aaa9-ba6ef0b3f001","source":"wordfence","cve":"CVE-2024-13208","title":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map <= 1.9.3 - Maps Plugin using Google Maps for WordPress \u2013 WP Google Map <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Markers","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fabdf42-4608-4182-aaa9-ba6ef0b3f001?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-02-26T21:34:46Z"},{"id":"wordfence:7fad30c8-fd8a-4cf2-a3aa-16a374231b87","source":"wordfence","cve":"CVE-2024-5709","title":"WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fad30c8-fd8a-4cf2-a3aa-16a374231b87?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-06T05:32:01Z"},{"id":"wordfence:7fb0cb21-6645-4a28-a78c-d5dbeaddbf21","source":"wordfence","cve":"CVE-2022-45070","title":"Conditional Checkout Fields & Edit Checkout Fields for WooCommerce <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb0cb21-6645-4a28-a78c-d5dbeaddbf21?source=api-prod","affected":[{"type":"plugin","slug":"conditional-checkout-fields-for-woocommerce","name":"Conditional Checkout Fields & Edit Checkout Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-02-24T00:00:00Z","updated":"2026-02-26T14:50:50Z"},{"id":"wordfence:7fb42402-4cd8-4d5d-b95a-47076ace27c0","source":"wordfence","cve":"CVE-2023-6163","title":"WP Crowdfunding <= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb42402-4cd8-4d5d-b95a-47076ace27c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2023-12-22T00:00:00Z","updated":"2024-02-06T15:09:40Z"},{"id":"wordfence:7fb4f15f-a432-413f-b6b8-7480559e10f3","source":"wordfence","cve":"CVE-2025-58245","title":"Portfolio  <= 2.58 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb4f15f-a432-413f-b6b8-7480559e10f3?source=api-prod","affected":[{"type":"plugin","slug":"portfolio","name":"Portfolio by BestWebSoft \u2013 Work and Projects Presentation Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.58","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:38:12Z"},{"id":"wordfence:7fb5496e-6d2a-467f-b4cc-8c9d61283462","source":"wordfence","cve":"CVE-2025-26868","title":"Fast Flow <= 1.2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb5496e-6d2a-467f-b4cc-8c9d61283462?source=api-prod","affected":[{"type":"plugin","slug":"fast-flow-dashboard","name":"Fast Flow","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T17:00:18Z"},{"id":"wordfence:7fb646c4-6269-4354-b3a6-872c6303a6d2","source":"wordfence","cve":"CVE-2023-6592","title":"FastDup <= 2.1.9 - Sensitive Information Exposure via Directory Listing","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb646c4-6269-4354-b3a6-872c6303a6d2?source=api-prod","affected":[{"type":"plugin","slug":"fastdup","name":"FastDup \u2013 Fastest WordPress Migration & Duplicator","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fb7dd8f-6258-46e1-9cc5-87ec73d5736c","source":"wordfence","cve":"CVE-2023-4810","title":"Responsive Pricing Table < 5.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb7dd8f-6258-46e1-9cc5-87ec73d5736c?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":false,"patched_in":"5.1.8"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fb9ceb4-84a6-41bc-97e4-5e4e12a6ea15","source":"wordfence","cve":"CVE-2022-35238","title":"Awesome Filterable Portfolio <= 1.9.7 - Missing Authorization to Plugin Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fb9ceb4-84a6-41bc-97e4-5e4e12a6ea15?source=api-prod","affected":[{"type":"plugin","slug":"awesome-filterable-portfolio","name":"Awesome Filterable Portfolio","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fba4d55-b9fd-4d02-9a86-1ca2130e8ba0","source":"wordfence","cve":"CVE-2025-25073","title":"Easy WP Tiles <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fba4d55-b9fd-4d02-9a86-1ca2130e8ba0?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-tiles","name":"Easy WP Tiles","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:17:38Z"},{"id":"wordfence:7fbad834-7e28-4e32-bd88-7751ec2d630b","source":"wordfence","cve":"CVE-2025-60164","title":"NewsmanApp <= 2.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbad834-7e28-4e32-bd88-7751ec2d630b?source=api-prod","affected":[{"type":"plugin","slug":"newsmanapp","name":"NewsmanApp","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-09-26T00:00:00Z","updated":"2025-11-11T14:52:16Z"},{"id":"wordfence:7fbb7a39-936b-48f1-97f1-46dc23180b00","source":"wordfence","cve":"CVE-2022-4675","title":"Mongoose Page Plugin <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbb7a39-936b-48f1-97f1-46dc23180b00?source=api-prod","affected":[{"type":"plugin","slug":"facebook-page-feed-graph-api","name":"Mongoose Page Plugin","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2022-12-27T00:00:00Z","updated":"2024-10-24T18:18:45Z"},{"id":"wordfence:7fbbd0d7-882f-4bc8-a67a-4d6dc05cb796","source":"wordfence","cve":"CVE-2024-5648","title":"LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbbd0d7-882f-4bc8-a67a-4d6dc05cb796?source=api-prod","affected":[{"type":"plugin","slug":"wisdm-reports-for-learndash","name":"LearnDash LMS \u2013 Reports","from":"*","from_inclusive":true,"to":"1.8.2.1","to_inclusive":true,"patched_in":"1.8.2.2"}],"published":"2024-07-08T20:01:16Z","updated":"2024-08-01T20:15:13Z"},{"id":"wordfence:7fbd3170-a45b-4ae6-bc59-4cfb92f6c2a6","source":"wordfence","cve":"CVE-2025-1458","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fbd3170-a45b-4ae6-bc59-4cfb92f6c2a6?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.29","to_inclusive":true,"patched_in":"5.10.30"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-26T05:34:23Z"},{"id":"wordfence:7fc20069-5c1d-481a-b0fd-6f29ed6b41ee","source":"wordfence","cve":"CVE-2024-11874","title":"Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc20069-5c1d-481a-b0fd-6f29ed6b41ee?source=api-prod","affected":[{"type":"plugin","slug":"grid-accordion-lite","name":"Grid Accordion Lite","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T19:02:30Z","updated":"2025-01-11T07:21:51Z"},{"id":"wordfence:7fc410f2-5f2b-4eea-a0fb-fe58f988f95f","source":"wordfence","cve":"CVE-2026-3655","title":"OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc410f2-5f2b-4eea-a0fb-fe58f988f95f?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"1.8.50","from_inclusive":true,"to":"1.8.60","to_inclusive":true,"patched_in":"1.8.61"}],"published":"2026-05-28T17:56:28Z","updated":"2026-05-29T06:43:44Z"},{"id":"wordfence:7fc6b0d0-a872-4491-894e-54258b062ab2","source":"wordfence","cve":"CVE-2026-41554","title":"Bricks  <= 1.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc6b0d0-a872-4491-894e-54258b062ab2?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T15:10:16Z"},{"id":"wordfence:7fc72cff-b708-4fa2-a734-481446641a61","source":"wordfence","cve":"CVE-2018-15571","title":"Export Users to CSV <= 1.1.1 - CSV Injection","severity":"high","cvss":8.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc72cff-b708-4fa2-a734-481446641a61?source=api-prod","affected":[{"type":"plugin","slug":"export-users-to-csv","name":"Export Users to CSV","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2018-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fc83471-60eb-4f8c-9525-9eedbe191c0b","source":"wordfence","cve":"CVE-2026-105194","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc83471-60eb-4f8c-9525-9eedbe191c0b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:35:02Z"},{"id":"wordfence:7fc8436b-f787-41dd-8404-9e85cca38cdf","source":"wordfence","cve":"CVE-2023-25988","title":"Video Gallery \u2013 YouTube Gallery <= 1.7.6 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc8436b-f787-41dd-8404-9e85cca38cdf?source=api-prod","affected":[{"type":"plugin","slug":"gallery-videos","name":"Video Gallery \u2013 YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fc8862f-f3d9-4eb8-90ab-bde23a636f1d","source":"wordfence","cve":"CVE-2025-32544","title":"WooCommerce Loyal Customers <= 2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc8862f-f3d9-4eb8-90ab-bde23a636f1d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-loyal-customer","name":"WooCommerce Loyal Customers","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T13:11:12Z"},{"id":"wordfence:7fc9bf38-0214-4f0d-9f3d-5ba0da9b76d9","source":"wordfence","cve":"CVE-2026-27538","title":"WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc9bf38-0214-4f0d-9f3d-5ba0da9b76d9?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T13:03:40Z"},{"id":"wordfence:7fcd0410-9423-4349-8d1c-3551de38a7c7","source":"wordfence","cve":"CVE-2023-6748","title":"Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fcd0410-9423-4349-8d1c-3551de38a7c7?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-10T00:00:00Z","updated":"2024-07-29T21:36:42Z"},{"id":"wordfence:7fcde31b-6a58-4d8a-887f-1b2221b72c77","source":"wordfence","cve":"CVE-2019-12241","title":"Carts Guru <= 1.4.5 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fcde31b-6a58-4d8a-887f-1b2221b72c77?source=api-prod","affected":[{"type":"plugin","slug":"carts-guru","name":"Carts Guru","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fd179ab-f2ab-4ce3-851f-d6da3f0243c6","source":"wordfence","cve":"CVE-2021-24549","title":"AceIDE <= 2.6.2 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd179ab-f2ab-4ce3-851f-d6da3f0243c6?source=api-prod","affected":[{"type":"plugin","slug":"aceide","name":"AceIDE","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fd2d8cd-277d-4951-9445-45e8e37db9b4","source":"wordfence","cve":"CVE-2025-30936","title":"Torod <= 2.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd2d8cd-277d-4951-9445-45e8e37db9b4?source=api-prod","affected":[{"type":"plugin","slug":"torod","name":"Torod \u2013 WooCommerce Shipping for Saudi Arabia & GCC","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-07-07T00:00:00Z","updated":"2026-11-10T23:18:09Z"},{"id":"wordfence:7fd2e4ab-61a2-4a92-b11e-746ef64f2f2a","source":"wordfence","cve":"CVE-2026-57620","title":"Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd2e4ab-61a2-4a92-b11e-746ef64f2f2a?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.9.9"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:40:23Z"},{"id":"wordfence:7fd5d31d-a4f3-458a-b457-f20aeaa71749","source":"wordfence","cve":"CVE-2025-2892","title":"All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd5d31d-a4f3-458a-b457-f20aeaa71749?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.8.1.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2025-05-18T16:21:32Z","updated":"2025-05-19T04:22:20Z"},{"id":"wordfence:7fd7a515-6389-4152-8dac-d5497dd94f6d","source":"wordfence","cve":"CVE-2024-7870","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd7a515-6389-4152-8dac-d5497dd94f6d?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"10.4.2","to_inclusive":true,"patched_in":"10.4.3"},{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"9.7.2"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T08:30:38Z"},{"id":"wordfence:7fd8277c-b096-4cee-bd13-fcb8c8b00ca0","source":"wordfence","cve":"CVE-2019-15112","title":"WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd8277c-b096-4cee-bd13-fcb8c8b00ca0?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2019-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fd919ca-bf74-48d0-855a-fcdc66bb314c","source":"wordfence","cve":"CVE-2026-108763","title":"Wallet System for WooCommerce <= 2.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd919ca-bf74-48d0-855a-fcdc66bb314c?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:21:47Z"},{"id":"wordfence:7fd9bb08-1093-4ccd-9817-052760c19588","source":"wordfence","cve":"CVE-2024-37414","title":"Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd9bb08-1093-4ccd-9817-052760c19588?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:44:25Z"},{"id":"wordfence:7fdad62e-d43a-4eb8-a637-0a257f3f18d4","source":"wordfence","cve":"CVE-2024-3645","title":"Essential Addons for Elementor Pro <= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_html_tag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdad62e-d43a-4eb8-a637-0a257f3f18d4?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-elementor","name":"Essential Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"5.8.11","to_inclusive":true,"patched_in":"5.8.12"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-22T13:51:47Z"},{"id":"wordfence:7fdb93fa-e9b4-4d00-8bb3-ff171a916b65","source":"wordfence","cve":"CVE-2023-23644","title":"MainWP Page Speed Extension <= 4.0.2 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdb93fa-e9b4-4d00-8bb3-ff171a916b65?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-page-speed-extension","name":"MainWP Page Speed Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fdc5bc4-b5eb-4826-a7db-323c85e683a0","source":"wordfence","cve":"CVE-2026-14239","title":"Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdc5bc4-b5eb-4826-a7db-323c85e683a0?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":false,"patched_in":"5.4.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-14T12:43:05Z"},{"id":"wordfence:7fdc9003-35e9-4fe9-a3e9-353d6bab525a","source":"wordfence","cve":"CVE-2024-34760","title":"Magazine Blocks <= 1.3.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdc9003-35e9-4fe9-a3e9-353d6bab525a?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:44:41Z"},{"id":"wordfence:7fdd1b1c-84b5-451a-a921-80be3b154398","source":"wordfence","cve":"CVE-2024-5576","title":"Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdd1b1c-84b5-451a-a921-80be3b154398?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-08-19T16:30:11Z","updated":"2024-08-20T05:30:03Z"},{"id":"wordfence:7fdd670f-2a71-4c1d-af46-f0fd05352f7e","source":"wordfence","cve":"CVE-2025-12674","title":"KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdd670f-2a71-4c1d-af46-f0fd05352f7e?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-05T07:28:17Z"},{"id":"wordfence:7fdf428d-b57a-4f2d-acfd-24a3a059e5c1","source":"wordfence","cve":"CVE-2025-13431","title":"SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdf428d-b57a-4f2d-acfd-24a3a059e5c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2026-02-10T12:36:33Z","updated":"2026-02-11T01:23:34Z"},{"id":"wordfence:7fe140ea-9d29-49be-a425-ada274290932","source":"wordfence","cve":"CVE-2024-49241","title":"Tito <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe140ea-9d29-49be-a425-ada274290932?source=api-prod","affected":[{"type":"plugin","slug":"tito","name":"Tito","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:09:34Z"},{"id":"wordfence:7fe3849a-05df-4530-91af-be0402169544","source":"wordfence","cve":"CVE-2026-57685","title":"Martfury - WooCommerce Marketplace WordPress <= 3.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe3849a-05df-4530-91af-be0402169544?source=api-prod","affected":[{"type":"theme","slug":"martfury","name":"Martfury - Marketplace Mobile App Figma Template","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-02T11:32:18Z"},{"id":"wordfence:7fe3d251-4edf-4d94-a946-0aa918135784","source":"wordfence","cve":"CVE-2026-11454","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe3d251-4edf-4d94-a946-0aa918135784?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-08-04T18:37:06Z","updated":"2026-08-05T06:37:56Z"},{"id":"wordfence:7fe3e55e-7286-4d12-b24f-fce69248a446","source":"wordfence","cve":"CVE-2023-34368","title":"Kanban Boards for WordPress <= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe3e55e-7286-4d12-b24f-fce69248a446?source=api-prod","affected":[{"type":"plugin","slug":"kanban","name":"Kanban Boards for WordPress","from":"*","from_inclusive":true,"to":"2.5.20","to_inclusive":true,"patched_in":"2.5.21"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fe412b3-038b-4cc7-88e9-d30f719273ab","source":"wordfence","cve":"CVE-2024-32149","title":"Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe412b3-038b-4cc7-88e9-d30f719273ab?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:16:24Z"},{"id":"wordfence:7fe4c0ee-8b85-488f-81be-98316d21e160","source":"wordfence","cve":"CVE-2024-37209","title":"User Rights Access Manager <= 1.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe4c0ee-8b85-488f-81be-98316d21e160?source=api-prod","affected":[{"type":"plugin","slug":"user-rights-access-manager","name":"User Rights Access Manager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:38:07Z"},{"id":"wordfence:7fe4e182-5d0b-41da-8402-8b7de0b2c2e7","source":"wordfence","cve":"CVE-2026-8628","title":"EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe4e182-5d0b-41da-8402-8b7de0b2c2e7?source=api-prod","affected":[{"type":"plugin","slug":"entredropper","name":"EntreDroppers","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:40:07Z","updated":"2026-06-24T05:33:27Z"},{"id":"wordfence:7fe50510-6736-4bcf-b62f-0b8d2cb8ff3a","source":"wordfence","cve":"CVE-2021-24295","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 5.153.3 - Unauthenticated Blind SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe50510-6736-4bcf-b62f-0b8d2cb8ff3a?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.153.3","to_inclusive":true,"patched_in":"5.153.4"}],"published":"2021-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7fe5240f-f6c3-43f2-b17c-e7d94905ea79","source":"wordfence","cve":"CVE-2025-48295","title":"Easy Elementor Addons <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe5240f-f6c3-43f2-b17c-e7d94905ea79?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:33:26Z"},{"id":"wordfence:7fe5cc35-8f76-43e3-8fbd-c5a2bda165e1","source":"wordfence","cve":"CVE-2026-57737","title":"Shortcodes and extra features for Phlox theme <= 2.17.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe5cc35-8f76-43e3-8fbd-c5a2bda165e1?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.22","to_inclusive":true,"patched_in":"2.17.24"}],"published":"2026-07-01T00:00:00Z","updated":"2026-10-13T16:58:47Z"},{"id":"wordfence:7fe97e7a-5a4e-43e7-b4f3-81786e9ee3dc","source":"wordfence","cve":"CVE-2015-4413","title":"Nextend Social Login and Register <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe97e7a-5a4e-43e7-b4f3-81786e9ee3dc?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2015-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7febe807-df4c-4b6d-83b5-e61f23ea6ad7","source":"wordfence","cve":"CVE-2026-28118","title":"Welldone - Sports Store WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7febe807-df4c-4b6d-83b5-e61f23ea6ad7?source=api-prod","affected":[{"type":"theme","slug":"welldone","name":"Welldone - Sports Store WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:33:35Z"},{"id":"wordfence:7fed4607-7431-41c0-84d9-86731e5ea744","source":"wordfence","cve":"CVE-2026-22458","title":"Wanderland <= 1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fed4607-7431-41c0-84d9-86731e5ea744?source=api-prod","affected":[{"type":"theme","slug":"wanderland","name":"Wanderland - Travel Blog","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-03T00:00:00Z","updated":"2026-01-14T19:28:51Z"},{"id":"wordfence:7feecce5-f2ce-4278-b648-e363b1fa5d7a","source":"wordfence","cve":"CVE-2023-25709","title":"Locatoraid Store Locator <= 3.9.11 - Cross Site Request Forgery in grab","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7feecce5-f2ce-4278-b648-e363b1fa5d7a?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.9.12"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ff038a7-4997-4a14-9846-2b8aea9a2bf3","source":"wordfence","cve":"CVE-2024-37413","title":"Preschool and Kindergarten <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff038a7-4997-4a14-9846-2b8aea9a2bf3?source=api-prod","affected":[{"type":"theme","slug":"preschool-and-kindergarten","name":"Preschool and Kindergarten","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:57:40Z"},{"id":"wordfence:7ff230b0-c186-41fc-93a5-2ed90e8aab4d","source":"wordfence","cve":"CVE-2022-46808","title":"ARMember <= 3.4.11 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff230b0-c186-41fc-93a5-2ed90e8aab4d?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"4.0"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ff39b8f-ef87-4b1c-888e-00c9599c7b07","source":"wordfence","cve":"CVE-2026-9009","title":"Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff39b8f-ef87-4b1c-888e-00c9599c7b07?source=api-prod","affected":[{"type":"plugin","slug":"crawlomatic-multipage-scraper-post-generator","name":"Crawlomatic Multipage Scraper Post Generator","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-05-27T17:20:12Z","updated":"2026-05-28T05:30:40Z"},{"id":"wordfence:7ff3cf3a-1b28-4662-b0ef-a76f729635e7","source":"wordfence","cve":"CVE-2026-77003","title":"Content Mask 1.8.0 - 1.8.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff3cf3a-1b28-4662-b0ef-a76f729635e7?source=api-prod","affected":[{"type":"plugin","slug":"content-mask","name":"Content Mask","from":"1.8.0","from_inclusive":true,"to":"1.8.5.4","to_inclusive":true,"patched_in":"1.8.5.5"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:13:23Z"},{"id":"wordfence:7ff58a34-93ab-4e51-b857-fed1107631ea","source":"wordfence","cve":"","title":"Affiliates Manager <= 2.7.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff58a34-93ab-4e51-b857-fed1107631ea?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2020-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ff92bf8-371e-4d47-881c-a0f9eadc5061","source":"wordfence","cve":"CVE-2026-57727","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff92bf8-371e-4d47-881c-a0f9eadc5061?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-08-17T04:32:04Z"},{"id":"wordfence:7ffa92be-9d38-40d9-954d-d890136b5aa1","source":"wordfence","cve":"CVE-2026-2495","title":"WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffa92be-9d38-40d9-954d-d890136b5aa1?source=api-prod","affected":[{"type":"plugin","slug":"wpnakama","name":"WPNakama \u2013 Editorial Workflow & Content Planning for WP","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":true,"patched_in":"0.6.6"}],"published":"2026-02-17T20:24:50Z","updated":"2026-02-18T08:26:03Z"},{"id":"wordfence:7ffac29d-d1cc-4d5d-aff8-0cb639a1e3d7","source":"wordfence","cve":"CVE-2016-20010","title":"EWWW Image Optimizer <= 2.8.4 - Remote Code Execution","severity":"critical","cvss":9.6,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffac29d-d1cc-4d5d-aff8-0cb639a1e3d7?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2016-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ffba592-6d0d-408f-89fa-079066750b0a","source":"wordfence","cve":"CVE-2023-4000","title":"Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffba592-6d0d-408f-89fa-079066750b0a?source=api-prod","affected":[{"type":"plugin","slug":"waiting","name":"Waiting: One-click countdowns","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:7ffc705f-2fc8-4ab9-9853-fb4611188320","source":"wordfence","cve":"CVE-2026-22440","title":"Thecs <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffc705f-2fc8-4ab9-9853-fb4611188320?source=api-prod","affected":[{"type":"theme","slug":"thecs","name":"Thecs - Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:14:39Z"},{"id":"wordfence:7ffcb74b-230b-4629-b22d-5db96ac5fa06","source":"wordfence","cve":"CVE-2024-13856","title":"Make Builder <= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffcb74b-230b-4629-b22d-5db96ac5fa06?source=api-prod","affected":[{"type":"plugin","slug":"make-builder","name":"Your Friendly Drag and Drop Page Builder \u2014 Make Builder","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-03-21T18:21:53Z","updated":"2025-03-22T06:41:12Z"},{"id":"wordfence:7ffddc03-d4ae-460e-972a-98804d947d09","source":"wordfence","cve":"CVE-2024-8520","title":"Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:32:23Z"},{"id":"wordfence:8004a306-4c8f-40e9-accc-a12d65b5f2f9","source":"wordfence","cve":"CVE-2023-41686","title":"Woocommerce Support System <= 1.2.2 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8004a306-4c8f-40e9-accc-a12d65b5f2f9?source=api-prod","affected":[{"type":"plugin","slug":"wc-support-system","name":"ilGhera Support System for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-09-04T00:00:00Z","updated":"2024-05-15T17:54:22Z"},{"id":"wordfence:80064e3b-6996-49eb-a475-0ffe0e894f9e","source":"wordfence","cve":"CVE-2024-5031","title":"MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80064e3b-6996-49eb-a475-0ffe0e894f9e?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.29","to_inclusive":true,"patched_in":"1.11.30"}],"published":"2024-05-21T20:06:41Z","updated":"2024-05-22T08:31:23Z"},{"id":"wordfence:80067f73-53df-4014-b171-8435061a5cc7","source":"wordfence","cve":"CVE-2026-28189","title":"Participants Database <= 2.7.8.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80067f73-53df-4014-b171-8435061a5cc7?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.4","to_inclusive":true,"patched_in":"2.7.8.5"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:36:45Z"},{"id":"wordfence:8008b5e2-f3b4-492c-8e50-b673f725b2b1","source":"wordfence","cve":"CVE-2024-12312","title":"Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8008b5e2-f3b4-492c-8e50-b673f725b2b1?source=api-prod","affected":[{"type":"plugin","slug":"print-science-designer","name":"Print Science Designer","from":"*","from_inclusive":true,"to":"1.3.152","to_inclusive":true,"patched_in":"1.3.153"}],"published":"2024-12-11T18:17:20Z","updated":"2024-12-12T06:46:34Z"},{"id":"wordfence:80098d80-79f5-4016-860a-15f7f608da29","source":"wordfence","cve":"CVE-2021-38339","title":"Simple Matted Thumbnails <= 1.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80098d80-79f5-4016-860a-15f7f608da29?source=api-prod","affected":[{"type":"plugin","slug":"simple-matted-thumbnails","name":"Simple Matted Thumbnails","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:800a06f3-8a5b-4ba1-ad16-3d3a214f372f","source":"wordfence","cve":"","title":"UpdraftPlus WordPress Backup <= 1.9.6.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/800a06f3-8a5b-4ba1-ad16-3d3a214f372f?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.9.6.3","to_inclusive":true,"patched_in":"1.9.6.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:800b1a44-4173-4b8e-bc69-9a64218e64d6","source":"wordfence","cve":"CVE-2026-3367","title":"Lockme OAuth2 calendars integration <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/800b1a44-4173-4b8e-bc69-9a64218e64d6?source=api-prod","affected":[{"type":"plugin","slug":"lockme-calendars-integration","name":"Lockme calendars integration","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2026-07-10T14:05:13Z","updated":"2026-07-11T02:31:17Z"},{"id":"wordfence:800c55b1-7d1f-4525-a4c3-8da5b69355fb","source":"wordfence","cve":"CVE-2025-22748","title":"SetMore Theme \u2013 Custom Post Types <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/800c55b1-7d1f-4525-a4c3-8da5b69355fb?source=api-prod","affected":[{"type":"plugin","slug":"service-provider-profile-cpt","name":"SetMore Theme \u2013 Custom Post Types","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:29:51Z"},{"id":"wordfence:800eba54-1bfb-4f44-9d5f-ca650e7fea30","source":"wordfence","cve":"CVE-2024-49289","title":"Cooked Pro < 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/800eba54-1bfb-4f44-9d5f-ca650e7fea30?source=api-prod","affected":[{"type":"plugin","slug":"cooked-pro","name":"Cooked Pro","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:41:57Z"},{"id":"wordfence:800fa098-b29f-4979-b7bd-b1186a4dafcb","source":"wordfence","cve":"CVE-2023-2249","title":"wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/800fa098-b29f-4979-b7bd-b1186a4dafcb?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:801132f5-e4ea-4d56-8429-9f33896f6dff","source":"wordfence","cve":"","title":"My Calendar <= 3.3.16 - Administrator+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801132f5-e4ea-4d56-8429-9f33896f6dff?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.3.16","to_inclusive":true,"patched_in":"3.3.17"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80127842-a931-41c7-9af8-3f0452a8c1a8","source":"wordfence","cve":"CVE-2022-45083","title":"ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80127842-a931-41c7-9af8-3f0452a8c1a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80128b8c-a2ae-410f-ad82-64e204f62585","source":"wordfence","cve":"CVE-2025-68053","title":"xPromoter <= 1.3.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80128b8c-a2ae-410f-ad82-64e204f62585?source=api-prod","affected":[{"type":"plugin","slug":"top_bar_promoter","name":"xPromoter","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-12-14T00:00:00Z","updated":"2026-02-26T15:22:54Z"},{"id":"wordfence:80153f79-0fb0-458b-a39b-c4cd726546f9","source":"wordfence","cve":"CVE-2026-32526","title":"Abandoned Cart Recovery for WooCommerce <= 1.1.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80153f79-0fb0-458b-a39b-c4cd726546f9?source=api-prod","affected":[{"type":"plugin","slug":"woo-abandoned-cart-recovery","name":"Recarto \u2013 Abandoned Cart Recovery for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:52:07Z"},{"id":"wordfence:80178b72-56ff-448f-a558-de0b63198e44","source":"wordfence","cve":"CVE-2024-32511","title":"Simple Registration for WooCommerce <= 1.5.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80178b72-56ff-448f-a558-de0b63198e44?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-simple-registration","name":"Simple Registration for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-21T17:38:37Z"},{"id":"wordfence:80192348-dcf4-4bab-80d1-ae7a4d194270","source":"wordfence","cve":"","title":"Breeze <= 2.0.8 - Cross-Site Request Forgery via import_json_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80192348-dcf4-4bab-80d1-ae7a4d194270?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8019da67-fd2c-48f8-8983-6fb8fb30510b","source":"wordfence","cve":"CVE-2022-4340","title":"BookingPress <= 1.0.30 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8019da67-fd2c-48f8-8983-6fb8fb30510b?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":"1.0.31"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:801a48ab-f4b7-4194-a9ee-719c74e36ea2","source":"wordfence","cve":"CVE-2026-56026","title":"utm.codes <= 1.9.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801a48ab-f4b7-4194-a9ee-719c74e36ea2?source=api-prod","affected":[{"type":"plugin","slug":"utm-dot-codes","name":"utm.codes","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T13:57:58Z"},{"id":"wordfence:801b593c-2822-4ac4-8411-29ef1e1484b1","source":"wordfence","cve":"CVE-2022-44739","title":"Quick Restaurant Reservations <= 1.5.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801b593c-2822-4ac4-8411-29ef1e1484b1?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-reservations","name":"Quick Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:801d6cde-f9c6-4e68-8bfc-ff8c0593372d","source":"wordfence","cve":"CVE-2024-8126","title":"Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801d6cde-f9c6-4e68-8bfc-ff8c0593372d?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.2.9"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T10:59:33Z"},{"id":"wordfence:801d6f21-1f52-48d4-9f8e-5c971dd037f7","source":"wordfence","cve":"CVE-2017-9065","title":"WordPress Core < 4.7.5 - Authorization Bypass Allowing Post Meta Updates","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801d6f21-1f52-48d4-9f8e-5c971dd037f7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:801f7c4d-472d-4f0d-9d99-3b3a28f5e3f9","source":"wordfence","cve":"CVE-2025-64249","title":"Protect WP Admin <= 4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/801f7c4d-472d-4f0d-9d99-3b3a28f5e3f9?source=api-prod","affected":[{"type":"plugin","slug":"protect-wp-admin","name":"Protect WP Admin","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-12-15T00:00:00Z","updated":"2026-02-06T17:35:14Z"},{"id":"wordfence:80203516-8546-441a-b51d-2d09968492b5","source":"wordfence","cve":"CVE-2024-13839","title":"Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80203516-8546-441a-b51d-2d09968492b5?source=api-prod","affected":[{"type":"plugin","slug":"staff-directory-pro","name":"Staff Directory Plugin: Company Directory","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:16:08Z","updated":"2025-03-05T09:21:49Z"},{"id":"wordfence:80228d74-498f-4fd5-a378-c9254045b64e","source":"wordfence","cve":"CVE-2025-58806","title":"Error Monitoring by Bugsnag <= 1.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80228d74-498f-4fd5-a378-c9254045b64e?source=api-prod","affected":[{"type":"plugin","slug":"bugsnag","name":"BugSnag Error Monitoring plugin","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-30T13:04:17Z"},{"id":"wordfence:80235228-f23c-4f8e-9d26-b66cd44c4bed","source":"wordfence","cve":"CVE-2024-51854","title":"Hola Free Video Player <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80235228-f23c-4f8e-9d26-b66cd44c4bed?source=api-prod","affected":[{"type":"plugin","slug":"hola-free-video-player","name":"Hola Free Video Player","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:32:33Z"},{"id":"wordfence:8023be86-2bdb-4f16-9b54-a959f1e75e46","source":"wordfence","cve":"CVE-2024-13660","title":"Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8023be86-2bdb-4f16-9b54-a959f1e75e46?source=api-prod","affected":[{"type":"plugin","slug":"mobile-friendly-flickr-slideshow","name":"Responsive Flickr Slideshow","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-02-18T19:28:06Z","updated":"2025-02-27T20:23:39Z"},{"id":"wordfence:8027fa07-6bc2-4e63-89d0-98079729921d","source":"wordfence","cve":"CVE-2021-24210","title":"PhastPress <= 1.110 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8027fa07-6bc2-4e63-89d0-98079729921d?source=api-prod","affected":[{"type":"plugin","slug":"phastpress","name":"PhastPress","from":"*","from_inclusive":true,"to":"1.110","to_inclusive":true,"patched_in":"1.111"}],"published":"2021-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8028b14b-8a41-4284-9560-4b8595e7eaa9","source":"wordfence","cve":"CVE-2008-0682","title":"WordSpew <= 3.71 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8028b14b-8a41-4284-9560-4b8595e7eaa9?source=api-prod","affected":[{"type":"plugin","slug":"wordspew","name":"WordSpew","from":"*","from_inclusive":true,"to":"3.71","to_inclusive":true,"patched_in":""}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:802c83c6-4da2-4286-b1a3-f964cf5e789a","source":"wordfence","cve":"CVE-2018-6015","title":"Email Subscribers & Newsletters <= 3.4.7 - Unauthenticated Subscriber Download","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/802c83c6-4da2-4286-b1a3-f964cf5e789a?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2018-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:802c9177-becf-4c54-ada9-a6de8904a322","source":"wordfence","cve":"CVE-2025-31604","title":"Cal.com <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/802c9177-becf-4c54-ada9-a6de8904a322?source=api-prod","affected":[{"type":"plugin","slug":"cal-com","name":"Cal.com","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-04-15T13:27:54Z"},{"id":"wordfence:802cd945-043d-4cbe-8dbc-474846fb62af","source":"wordfence","cve":"CVE-2025-62082","title":"Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/802cd945-043d-4cbe-8dbc-474846fb62af?source=api-prod","affected":[{"type":"plugin","slug":"generic-elements-for-elementor","name":"Generic Elements","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-07T00:00:00Z","updated":"2025-12-10T15:52:03Z"},{"id":"wordfence:80303684-5e10-474b-b6be-a63327015826","source":"wordfence","cve":"CVE-2024-32134","title":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook <= 1.1.12 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80303684-5e10-474b-b6be-a63327015826?source=api-prod","affected":[{"type":"plugin","slug":"forms-to-zapier","name":"Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:52:57Z"},{"id":"wordfence:8030c334-458a-4d21-9a64-3f5df715ba97","source":"wordfence","cve":"CVE-2026-2879","title":"GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8030c334-458a-4d21-9a64-3f5df715ba97?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-03-12T19:28:21Z","updated":"2026-03-13T08:25:19Z"},{"id":"wordfence:80328a83-d70a-4801-8935-c7e1dddc5b23","source":"wordfence","cve":"CVE-2025-23687","title":"Woo Store Mode <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80328a83-d70a-4801-8935-c7e1dddc5b23?source=api-prod","affected":[{"type":"plugin","slug":"woo-store-mode","name":"Woo Store Mode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-03T21:12:01Z"},{"id":"wordfence:80334e81-c33d-464c-9409-f49c34681890","source":"wordfence","cve":"CVE-2024-12579","title":"Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80334e81-c33d-464c-9409-f49c34681890?source=api-prod","affected":[{"type":"plugin","slug":"minify-html-markup","name":"Minify HTML","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T04:23:27Z"},{"id":"wordfence:8035023c-347f-4227-98cb-5b277fba4812","source":"wordfence","cve":"CVE-2022-3834","title":"Google Forms <= 0.95 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8035023c-347f-4227-98cb-5b277fba4812?source=api-prod","affected":[{"type":"plugin","slug":"wpgform","name":"Google Forms","from":"*","from_inclusive":true,"to":"0.95","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8035484b-dc2f-4d54-802b-b09bd88a8bf6","source":"wordfence","cve":"CVE-2023-45654","title":"Comments Ratings <= 1.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8035484b-dc2f-4d54-802b-b09bd88a8bf6?source=api-prod","affected":[{"type":"plugin","slug":"comments-ratings","name":"Comments Ratings","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8036bd83-9af5-4b71-8974-9b0690ea6769","source":"wordfence","cve":"CVE-2024-3246","title":"LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8036bd83-9af5-4b71-8974-9b0690ea6769?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.2.0.1","to_inclusive":true,"patched_in":"6.3"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T03:26:54Z"},{"id":"wordfence:8036d889-b5c9-46fc-af95-80d28292fdc1","source":"wordfence","cve":"CVE-2026-81272","title":"FluentPlayer Pro <= 1.3.2 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8036d889-b5c9-46fc-af95-80d28292fdc1?source=api-prod","affected":[{"type":"plugin","slug":"fluent-player-pro","name":"Fluent Player Pro","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:15:58Z"},{"id":"wordfence:80388709-77ee-4f18-9da2-b99f562a20cd","source":"wordfence","cve":"CVE-2017-6955","title":"Invite Anyone <= 1.3.14 - Change of Email Invitation Content","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80388709-77ee-4f18-9da2-b99f562a20cd?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":false,"patched_in":"1.3.15"}],"published":"2017-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80399759-88dd-478d-a20e-04e8750e12c4","source":"wordfence","cve":"CVE-2023-37984","title":"Quiz And Survey Master <= 8.1.10 - Excessive Quiz Attempts","severity":"medium","cvss":5.3,"cwe":"CWE-799","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80399759-88dd-478d-a20e-04e8750e12c4?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.10","to_inclusive":true,"patched_in":"8.1.11"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:803b5a64-f861-4510-9838-2a39e0ad9baa","source":"wordfence","cve":"CVE-2025-60058","title":"DetailX <= 1.10.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/803b5a64-f861-4510-9838-2a39e0ad9baa?source=api-prod","affected":[{"type":"theme","slug":"detailx","name":"DetailX - Car Detailing, Shop & Repair Theme","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:40:32Z"},{"id":"wordfence:803c32e9-665c-40a0-b52d-f2c0b8fbe931","source":"wordfence","cve":"CVE-2023-0219","title":"FluentSMTP <= 2.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Email Logs","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/803c32e9-665c-40a0-b52d-f2c0b8fbe931?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:803e5d97-6e42-4366-975d-f4525f9c0ef1","source":"wordfence","cve":"CVE-2026-12983","title":"Dinatur <= 1.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/803e5d97-6e42-4366-975d-f4525f9c0ef1?source=api-prod","affected":[{"type":"plugin","slug":"dinatur","name":"Dinatur","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T19:33:33Z"},{"id":"wordfence:803e9059-7606-42eb-9193-1a18d57153b1","source":"wordfence","cve":"CVE-2021-36855","title":"Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/803e9059-7606-42eb-9193-1a18d57153b1?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:804169d3-a53a-42ba-821d-e9647ac075c4","source":"wordfence","cve":"CVE-2023-48753","title":"Restricted Site Access  <= 7.4.1 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/804169d3-a53a-42ba-821d-e9647ac075c4?source=api-prod","affected":[{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.4.1","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2023-11-27T00:00:00Z","updated":"2026-04-24T15:35:36Z"},{"id":"wordfence:80436ede-dafb-469c-b97d-ef797e1bed20","source":"wordfence","cve":"CVE-2025-67529","title":"Fashion < 5.3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80436ede-dafb-469c-b97d-ef797e1bed20?source=api-prod","affected":[{"type":"theme","slug":"fashion2","name":"Fashion - WooCommerce Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":false,"patched_in":"5.3.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:11:20Z"},{"id":"wordfence:80440bfa-4a02-4441-bbdb-52d7dd065a9d","source":"wordfence","cve":"CVE-2023-2987","title":"Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature","severity":"critical","cvss":9.8,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80440bfa-4a02-4441-bbdb-52d7dd065a9d?source=api-prod","affected":[{"type":"plugin","slug":"wordapp","name":"Wordapp","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-05-30T00:00:00Z","updated":"2024-08-20T13:53:18Z"},{"id":"wordfence:8044951e-be32-4cc8-ac3f-dde21ea932af","source":"wordfence","cve":"CVE-2026-94641","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.73 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8044951e-be32-4cc8-ac3f-dde21ea932af?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.73","to_inclusive":true,"patched_in":"1.2.74"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:49:20Z"},{"id":"wordfence:8049bff1-3262-464b-a9fa-d216eb3ab299","source":"wordfence","cve":"CVE-2024-32789","title":"Seers | GDPR & CCPA Cookie Consent & Compliance <= 8.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8049bff1-3262-464b-a9fa-d216eb3ab299?source=api-prod","affected":[{"type":"plugin","slug":"seers-cookie-consent-banner-privacy-policy","name":"Seers AI | Cookie Consent Banner \u2013 GDPR & CCPA Compliant Consent Management Platform","from":"*","from_inclusive":true,"to":"8.1.0","to_inclusive":true,"patched_in":"8.1.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:20:47Z"},{"id":"wordfence:804a973e-4650-428c-910f-09e4fc3aa4bb","source":"wordfence","cve":"CVE-2024-2506","title":"Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/804a973e-4650-428c-910f-09e4fc3aa4bb?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2024-05-31T18:10:56Z","updated":"2024-07-26T14:23:04Z"},{"id":"wordfence:804b42a0-1cea-4f68-bd4a-d292a9f23fbe","source":"wordfence","cve":"CVE-2024-9461","title":"Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/804b42a0-1cea-4f68-bd4a-d292a9f23fbe?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.16.6","to_inclusive":true,"patched_in":"1.16.7"}],"published":"2024-11-26T00:50:09Z","updated":"2024-11-26T13:56:54Z"},{"id":"wordfence:804cfd49-267e-4e84-ab01-f1b63a8332a5","source":"wordfence","cve":"CVE-2026-24548","title":"Radio Player <= 2.0.91 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/804cfd49-267e-4e84-ab01-f1b63a8332a5?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.91","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T00:00:00Z","updated":"2026-02-26T15:25:55Z"},{"id":"wordfence:804dafd1-0f18-4248-a243-8b26d161bc85","source":"wordfence","cve":"CVE-2022-29453","title":"API KEY for Google Maps <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/804dafd1-0f18-4248-a243-8b26d161bc85?source=api-prod","affected":[{"type":"plugin","slug":"api-key-for-google-maps","name":"API KEY for Google Maps","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-06-08T10:50:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80510ade-cb58-45b3-89f2-2cbbc5640cae","source":"wordfence","cve":"CVE-2024-10673","title":"Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80510ade-cb58-45b3-89f2-2cbbc5640cae?source=api-prod","affected":[{"type":"theme","slug":"top-store","name":"Top Store","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:18:12Z"},{"id":"wordfence:8051fb03-7c38-4902-bbff-049c270d2be2","source":"wordfence","cve":"CVE-2024-22293","title":"BP Profile Search <= 5.5 - Reflected Cross-Site Scripting via BPS_FORM","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8051fb03-7c38-4902-bbff-049c270d2be2?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-search","name":"BP Profile Search","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.6"}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805311c4-45ad-4d60-aa1c-35c710bfad90","source":"wordfence","cve":"CVE-2025-47673","title":"Arconix Shortcodes <= 2.1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805311c4-45ad-4d60-aa1c-35c710bfad90?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.1.17"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-12T18:29:22Z"},{"id":"wordfence:8053e812-21c0-4e3a-8d5b-52ef9991eb61","source":"wordfence","cve":"CVE-2023-0061","title":"Judge.me Product Reviews for WooCommerce <= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8053e812-21c0-4e3a-8d5b-52ef9991eb61?source=api-prod","affected":[{"type":"plugin","slug":"judgeme-product-reviews-woocommerce","name":"Judge.me Product Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80544889-8efc-4aa0-a690-774b1ee6a1a0","source":"wordfence","cve":"CVE-2026-5050","title":"Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80544889-8efc-4aa0-a690-774b1ee6a1a0?source=api-prod","affected":[{"type":"plugin","slug":"woo-redsys-gateway-light","name":"Payment Gateway for Redsys & WooCommerce Lite","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-04-15T16:43:26Z","updated":"2026-04-16T05:29:55Z"},{"id":"wordfence:8055886f-d0a9-4784-8430-41816db6c884","source":"wordfence","cve":"CVE-2020-25286","title":"WordPress Core < 5.4.2 - Comment Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8055886f-d0a9-4784-8430-41816db6c884?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8056af63-e81f-4321-991e-d201ad1095c4","source":"wordfence","cve":"CVE-2024-3692","title":"Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8056af63-e81f-4321-991e-d201ad1095c4?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-29T08:54:09Z"},{"id":"wordfence:8056cf18-8059-44dc-8ca9-54b252d3a4a7","source":"wordfence","cve":"CVE-2026-22459","title":"WP CTA \u2013 Sticky CTA Builder, Generate Leads, Promote Sales <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8056cf18-8059-44dc-8ca9-54b252d3a4a7?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-03T00:00:00Z","updated":"2026-04-15T13:39:50Z"},{"id":"wordfence:8056d44f-7089-4645-bd73-65e8a5f48502","source":"wordfence","cve":"CVE-2025-58861","title":"Quick Event Calendar <= 1.4.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8056d44f-7089-4645-bd73-65e8a5f48502?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-calendar","name":"Quick Event Calendar","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:16:36Z"},{"id":"wordfence:8057937d-69d2-4d33-828b-d8b50351189b","source":"wordfence","cve":"CVE-2025-49261","title":"Diza <= 1.3.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8057937d-69d2-4d33-828b-d8b50351189b?source=api-prod","affected":[{"type":"theme","slug":"diza","name":"Diza - Pharmacy Store Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:12:47Z"},{"id":"wordfence:8058ea74-f872-4f08-ae4d-c8d1c2a40f08","source":"wordfence","cve":"CVE-2026-87786","title":"Dewa Kirim <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8058ea74-f872-4f08-ae4d-c8d1c2a40f08?source=api-prod","affected":[{"type":"plugin","slug":"dewa-kirim-woocommerce-gojek","name":"Dewa Kirim \u2013 WooCommerce Gojek / Gosend","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:44:38Z"},{"id":"wordfence:8059ea88-55b9-423e-9827-075d0aa90938","source":"wordfence","cve":"CVE-2015-9367","title":"Easy Canadian Sales Taxes Add-On for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8059ea88-55b9-423e-9827-075d0aa90938?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-easy-canadian-sales-taxes","name":"Easy Canadian Sales Taxes Add-On for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805a7bef-d56b-4678-8db9-798ad401352f","source":"wordfence","cve":"CVE-2012-6511","title":"Organizer <= 1.2.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805a7bef-d56b-4678-8db9-798ad401352f?source=api-prod","affected":[{"type":"plugin","slug":"organizer","name":"Organizer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2012-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805b070e-0575-42d8-8e16-b2467afe8ebc","source":"wordfence","cve":"CVE-2026-24371","title":"BA Book Everything <= 1.8.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805b070e-0575-42d8-8e16-b2467afe8ebc?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.8.16","to_inclusive":true,"patched_in":"1.8.17"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-03T21:12:16Z"},{"id":"wordfence:805c46ec-0b8a-4a40-bfc9-5d2d8d43a17b","source":"wordfence","cve":"CVE-2023-49758","title":"WP Booking System <= 2.0.19.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805c46ec-0b8a-4a40-bfc9-5d2d8d43a17b?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.19.2","to_inclusive":true,"patched_in":"2.0.19.3"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805d70d8-084b-4849-bf3e-c9cc7ec02bc5","source":"wordfence","cve":"CVE-2022-35882","title":"GS Testimonial Slider <= 1.9.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805d70d8-084b-4849-bf3e-c9cc7ec02bc5?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2022-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805e3eba-639e-48a1-a867-a2c56fa01081","source":"wordfence","cve":"CVE-2015-9428","title":"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages < 1.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805e3eba-639e-48a1-a867-a2c56fa01081?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:805f18e2-9a5a-48cf-81f4-825da4bfd8ef","source":"wordfence","cve":"CVE-2024-9890","title":"User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/805f18e2-9a5a-48cf-81f4-825da4bfd8ef?source=api-prod","affected":[{"type":"plugin","slug":"user-toolkit","name":"User Toolkit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-10-25T00:00:00Z","updated":"2024-12-12T17:26:39Z"},{"id":"wordfence:80635f61-a9b5-4536-b6ed-826c538fc16d","source":"wordfence","cve":"CVE-2024-51830","title":"News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80635f61-a9b5-4536-b6ed-826c538fc16d?source=api-prod","affected":[{"type":"plugin","slug":"newsticker","name":"News Ticker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:46:47Z"},{"id":"wordfence:8063a545-4792-4ab7-b188-0e51a0fcfed4","source":"wordfence","cve":"CVE-2024-1762","title":"NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8063a545-4792-4ab7-b188-0e51a0fcfed4?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2024-05-21T18:29:23Z","updated":"2024-05-22T06:50:35Z"},{"id":"wordfence:8064526f-edd3-43e4-9732-47b25ab256fe","source":"wordfence","cve":"CVE-2022-44588","title":"Cryptocurrency Widgets Pack <= 1.8.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8064526f-edd3-43e4-9732-47b25ab256fe?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-widgets-pack","name":"Cryptocurrency Widgets Pack","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8069e16d-a68a-4c72-934f-f79e50777565","source":"wordfence","cve":"CVE-2024-43303","title":"White Label CMS <= 2.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8069e16d-a68a-4c72-934f-f79e50777565?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:15:45Z"},{"id":"wordfence:806bbfb8-ebf3-4823-a241-91e01dc95228","source":"wordfence","cve":"CVE-2022-4058","title":"Photo Gallery <= 1.8.2 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/806bbfb8-ebf3-4823-a241-91e01dc95228?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:806d3919-7a10-43f3-9c68-ce38ba359a35","source":"wordfence","cve":"CVE-2023-6505","title":"Prime Mover <= 1.9.2 - Sensitive Information Exposure via Directory Listing","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/806d3919-7a10-43f3-9c68-ce38ba359a35?source=api-prod","affected":[{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:806e5056-5c29-49d0-9150-add6ee485758","source":"wordfence","cve":"","title":"Simple Ads Manager <= 2.9.4.116 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/806e5056-5c29-49d0-9150-add6ee485758?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.9.5.118","to_inclusive":false,"patched_in":"2.9.5.118"}],"published":"2015-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:806f7e7c-3e0b-40a0-a1a9-05bdf723d3b9","source":"wordfence","cve":"CVE-2025-25120","title":"Slide Banners <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/806f7e7c-3e0b-40a0-a1a9-05bdf723d3b9?source=api-prod","affected":[{"type":"plugin","slug":"slide-banners","name":"Slide Banners","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:08:00Z"},{"id":"wordfence:8070a920-9e8d-4bae-9ae5-f5732c8fb6d5","source":"wordfence","cve":"CVE-2025-31440","title":"Terms of Use <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8070a920-9e8d-4bae-9ae5-f5732c8fb6d5?source=api-prod","affected":[{"type":"plugin","slug":"terms-of-use-2","name":"Terms of Use","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:14:01Z"},{"id":"wordfence:8071f117-c341-45bc-8d6e-8aa5d677d65c","source":"wordfence","cve":"","title":"WordPress WP-Advanced-Search <= 3.3.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8071f117-c341-45bc-8d6e-8aa5d677d65c?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":false,"patched_in":"3.3.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:807345dc-5e93-4dcf-a1a2-f13d6370d4a5","source":"wordfence","cve":"CVE-2024-13822","title":"Total Contest Lite <= 2.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/807345dc-5e93-4dcf-a1a2-f13d6370d4a5?source=api-prod","affected":[{"type":"plugin","slug":"totalcontest-lite","name":"Photo Contest  | Competition | Video Contest","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-04-22T21:52:30Z"},{"id":"wordfence:8073cc59-e5cc-4940-bce0-e501f0d959cc","source":"wordfence","cve":"CVE-2019-1000003","title":"MapSVG Lite < 3.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8073cc59-e5cc-4940-bce0-e501f0d959cc?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"}],"published":"2019-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:807764ae-b898-416d-81ca-be2374a6d73f","source":"wordfence","cve":"CVE-2026-27349","title":"Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/807764ae-b898-416d-81ca-be2374a6d73f?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.19.5","to_inclusive":true,"patched_in":"1.20.0"}],"published":"2026-05-21T00:00:00Z","updated":"2026-05-26T19:53:13Z"},{"id":"wordfence:80797183-c69f-4dce-a2e0-52a395ceffaa","source":"wordfence","cve":"CVE-2023-0725","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80797183-c69f-4dce-a2e0-52a395ceffaa?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:807eadff-b39e-4d7a-9b0a-06fc18a90626","source":"wordfence","cve":"CVE-2024-1081","title":"3D FlipBook \u2013 PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/807eadff-b39e-4d7a-9b0a-06fc18a90626?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.15.3","to_inclusive":true,"patched_in":"1.15.4"}],"published":"2024-02-20T00:00:00Z","updated":"2026-03-16T14:16:51Z"},{"id":"wordfence:807f895e-8a1d-4bf3-87df-2c9a5af54267","source":"wordfence","cve":"CVE-2025-22338","title":"WP-tagMaker <= 0.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/807f895e-8a1d-4bf3-87df-2c9a5af54267?source=api-prod","affected":[{"type":"plugin","slug":"tagmaker","name":"WP-tagMaker","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:02:23Z"},{"id":"wordfence:8080d02a-a89a-4f26-9895-0c11c59188d9","source":"wordfence","cve":"CVE-2026-16592","title":"Directory Kit <= 1.6.0 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8080d02a-a89a-4f26-9895-0c11c59188d9?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-10-22T23:58:53Z"},{"id":"wordfence:808392a9-dbac-4896-8677-6ddc1213d80d","source":"wordfence","cve":"CVE-2025-6553","title":"Ovatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808392a9-dbac-4896-8677-6ddc1213d80d?source=api-prod","affected":[{"type":"plugin","slug":"ova-events-manager","name":"Ovatheme Events Manager","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T08:29:16Z"},{"id":"wordfence:80848de3-a772-4078-aa04-29e1d6e3ff73","source":"wordfence","cve":"CVE-2026-2269","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80848de3-a772-4078-aa04-29e1d6e3ff73?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.0.0.3","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2026-03-02T12:35:59Z","updated":"2026-03-03T01:21:50Z"},{"id":"wordfence:80861cca-de9c-457d-a126-de5fda628ef4","source":"wordfence","cve":"CVE-2026-125743","title":"Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80861cca-de9c-457d-a126-de5fda628ef4?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:46Z"},{"id":"wordfence:808695a2-4d34-4b43-88a6-7da788100f2e","source":"wordfence","cve":"CVE-2024-11333","title":"HLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808695a2-4d34-4b43-88a6-7da788100f2e?source=api-prod","affected":[{"type":"plugin","slug":"hls-player","name":"HLS Player","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2024-11-27T20:29:57Z","updated":"2024-11-28T09:08:20Z"},{"id":"wordfence:80871684-037a-472e-bc38-10dfe33d5c41","source":"wordfence","cve":"CVE-2025-53226","title":"Comments Capcha Box <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80871684-037a-472e-bc38-10dfe33d5c41?source=api-prod","affected":[{"type":"plugin","slug":"comments-capcha-box","name":"Comments Capcha Box","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:05:18Z"},{"id":"wordfence:808ba7c9-438f-4282-9b37-d56e079b6c2e","source":"wordfence","cve":"CVE-2025-24709","title":"Plethora Plugins Tabs + Accordions <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808ba7c9-438f-4282-9b37-d56e079b6c2e?source=api-prod","affected":[{"type":"plugin","slug":"plethora-tabs-accordions","name":"Plethora Tabs + Accordions","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:47:21Z"},{"id":"wordfence:808daff1-e9a8-45ee-adca-19b3391c1522","source":"wordfence","cve":"CVE-2024-51571","title":"MasterBip para Elementor <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808daff1-e9a8-45ee-adca-19b3391c1522?source=api-prod","affected":[{"type":"plugin","slug":"masterbip-for-elementor","name":"MasterBip para Elementor","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:57:31Z"},{"id":"wordfence:808e5246-30b1-4706-b11f-27fb74b117ed","source":"wordfence","cve":"CVE-2021-24191","title":"WP Maintenance Mode & Site Under Construction < 1.8.2 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808e5246-30b1-4706-b11f-27fb74b117ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode-site-under-construction","name":"WP Maintenance Mode & Site Under Construction","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:808ef87d-298c-4622-9fcd-cf879e7157bd","source":"wordfence","cve":"CVE-2024-32079","title":"Advanced iFrame <= 2024.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808ef87d-298c-4622-9fcd-cf879e7157bd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2024.2","to_inclusive":true,"patched_in":"2024.3"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T21:12:49Z"},{"id":"wordfence:808f5ddc-9ddb-456a-a497-deffac0744ba","source":"wordfence","cve":"CVE-2025-58602","title":"If-So Dynamic Content Personalization <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/808f5ddc-9ddb-456a-a497-deffac0744ba?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.4.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:42:13Z"},{"id":"wordfence:80902e0d-39fd-48c0-96e5-774c91113d1c","source":"wordfence","cve":"CVE-2025-58975","title":"Advanced Settings <= 3.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80902e0d-39fd-48c0-96e5-774c91113d1c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-settings","name":"Advanced Settings 3","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:09:30Z"},{"id":"wordfence:809472d5-1698-42da-b414-1dda40983a6e","source":"wordfence","cve":"CVE-2025-12584","title":"Quick View for WooCommerce <= 2.2.17 - Unauthenticated Private Product Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809472d5-1698-42da-b414-1dda40983a6e?source=api-prod","affected":[{"type":"plugin","slug":"woo-quickview","name":"Quick View for WooCommerce \u2013 Reno QuickView","from":"*","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":"2.2.18"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T09:27:49Z"},{"id":"wordfence:8094e72e-1a9d-40da-95fb-14e341ce9ac1","source":"wordfence","cve":"CVE-2026-65480","title":"TheGem <= 5.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8094e72e-1a9d-40da-95fb-14e341ce9ac1?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:38:34Z"},{"id":"wordfence:80997d2f-3e16-48f6-969b-58844cb83d53","source":"wordfence","cve":"CVE-2024-12259","title":"CRM WordPress Plugin \u2013 RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80997d2f-3e16-48f6-969b-58844cb83d53?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.8120","to_inclusive":true,"patched_in":"3.8122"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T03:22:06Z"},{"id":"wordfence:8099c650-96d7-47b6-a81b-83ff663edb6b","source":"wordfence","cve":"CVE-2025-24704","title":"Magic the Gathering Card Tooltips <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8099c650-96d7-47b6-a81b-83ff663edb6b?source=api-prod","affected":[{"type":"plugin","slug":"magic-the-gathering-card-tooltips","name":"Magic the Gathering Card Tooltips","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:43:04Z"},{"id":"wordfence:8099e6b7-97d6-4b33-b664-d7423525094f","source":"wordfence","cve":"CVE-2025-23780","title":"Easy Code Snippets <= 1.0.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8099e6b7-97d6-4b33-b664-d7423525094f?source=api-prod","affected":[{"type":"plugin","slug":"easy-code-snippets","name":"Easy Code Snippets","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:58:36Z"},{"id":"wordfence:809c18bd-d531-4a7b-b252-9c97938d3c6f","source":"wordfence","cve":"CVE-2026-97314","title":"ThirstyAffiliates <= 3.12.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809c18bd-d531-4a7b-b252-9c97938d3c6f?source=api-prod","affected":[{"type":"plugin","slug":"thirstyaffiliates","name":"ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T19:03:52Z"},{"id":"wordfence:809cd97c-22ea-49e7-be46-688fefe50236","source":"wordfence","cve":"CVE-2025-13731","title":"Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809cd97c-22ea-49e7-be46-688fefe50236?source=api-prod","affected":[{"type":"plugin","slug":"nexter-extension","name":"Nexter Extension \u2013 Security, Performance, Code Snippets & Site Toolkit","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2025-12-01T00:00:00Z","updated":"2025-12-02T13:53:27Z"},{"id":"wordfence:809d0632-39a7-44a7-b368-9dc58270c666","source":"wordfence","cve":"","title":"Wordfence Security \u2013 Firewall & Malware Scan 6.1.1 - 6.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809d0632-39a7-44a7-b368-9dc58270c666?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"6.1.1","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"6.1.7"}],"published":"2016-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:809eb78f-fd8e-4434-a36b-bb8e313cf264","source":"wordfence","cve":"CVE-2026-109382","title":"WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809eb78f-fd8e-4434-a36b-bb8e313cf264?source=api-prod","affected":[{"type":"plugin","slug":"wsp-mcp-ai-agents-connector","name":"WSP MCP \u2013 Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-10-15T17:48:16Z","updated":"2026-10-16T06:41:05Z"},{"id":"wordfence:809fe65f-219c-4d4e-961b-8cd00cab9a13","source":"wordfence","cve":"CVE-2012-20005","title":"SocialFit <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/809fe65f-219c-4d4e-961b-8cd00cab9a13?source=api-prod","affected":[{"type":"plugin","slug":"socialfit","name":"socialfit","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2012-07-06T00:00:00Z","updated":"2026-10-28T15:12:14Z"},{"id":"wordfence:80a258a6-634c-4d7d-981f-bcbc0bb044f7","source":"wordfence","cve":"CVE-2026-7106","title":"Highland Software Custom Role Manager <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80a258a6-634c-4d7d-981f-bcbc0bb044f7?source=api-prod","affected":[{"type":"plugin","slug":"highland-software-custom-role-manager","name":"Highland Software Custom Role Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-04-26T14:20:30Z","updated":"2026-04-27T02:26:24Z"},{"id":"wordfence:80a385bc-809b-4fcd-8a5c-957c9f897c13","source":"wordfence","cve":"CVE-2026-92425","title":"Hydra Booking <= 1.2.3 - Authenticated (Hydra Host+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80a385bc-809b-4fcd-8a5c-957c9f897c13?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T20:28:10Z"},{"id":"wordfence:80a5fac0-9f85-4de1-9c15-51e9bd65e47b","source":"wordfence","cve":"CVE-2025-23998","title":"UltraLight <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80a5fac0-9f85-4de1-9c15-51e9bd65e47b?source=api-prod","affected":[{"type":"theme","slug":"the-ultralight","name":"The Ultralight","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:33:50Z"},{"id":"wordfence:80a627a5-6b76-4525-a76a-ac96986bd21b","source":"wordfence","cve":"","title":"Animal Captcha <= 1.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80a627a5-6b76-4525-a76a-ac96986bd21b?source=api-prod","affected":[{"type":"plugin","slug":"animal-captcha","name":"Animal Captcha","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80ad0b55-bd85-4240-ae54-f72d6b81ea7c","source":"wordfence","cve":"CVE-2023-32125","title":"Multi Rating <= 5.0.6 - Cross-Site Request Forgery to Arbitrary Ratings Value Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80ad0b55-bd85-4240-ae54-f72d6b81ea7c?source=api-prod","affected":[{"type":"plugin","slug":"multi-rating","name":"Multi Rating","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80ae05c4-64de-48df-b302-6110403b79d0","source":"wordfence","cve":"","title":"Easy PayPal Buy Now Button <= 1.7.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80ae05c4-64de-48df-b302-6110403b79d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":false,"patched_in":"1.7.3"}],"published":"2017-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80afca9d-8f9c-412f-b2dd-f0078ec8173c","source":"wordfence","cve":"CVE-2023-49836","title":"Cookie Bar <= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80afca9d-8f9c-412f-b2dd-f0078ec8173c?source=api-prod","affected":[{"type":"plugin","slug":"cookie-bar","name":"Cookie Bar","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80b02df4-9003-44bc-8d6e-695b2cd87bc0","source":"wordfence","cve":"CVE-2024-35636","title":"Uploadcare File Uploader and Adaptive Delivery (beta) <= 3.0.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b02df4-9003-44bc-8d6e-695b2cd87bc0?source=api-prod","affected":[{"type":"plugin","slug":"uploadcare","name":"Uploadcare File Uploader and Adaptive Delivery (beta)","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-27T18:09:17Z"},{"id":"wordfence:80b03e81-6660-483a-9150-e6075b7bffbd","source":"wordfence","cve":"CVE-2026-1043","title":"PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b03e81-6660-483a-9150-e6075b7bffbd?source=api-prod","affected":[{"type":"plugin","slug":"postmarkapp-email-integrator","name":"PostmarkApp Email Integrator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-02-18T15:45:28Z","updated":"2026-07-10T14:44:13Z"},{"id":"wordfence:80b099db-682e-48ad-8efb-d94abe6e4e61","source":"wordfence","cve":"CVE-2025-49251","title":"Fana <= 1.1.28 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b099db-682e-48ad-8efb-d94abe6e4e61?source=api-prod","affected":[{"type":"theme","slug":"fana","name":"Fana - Fashion Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.28","to_inclusive":true,"patched_in":"1.1.29"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:15:14Z"},{"id":"wordfence:80b15512-210c-4c6b-a3ad-f5d6042091a3","source":"wordfence","cve":"CVE-2022-0287","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b15512-210c-4c6b-a3ad-f5d6042091a3?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.4.3.1","to_inclusive":false,"patched_in":"2.4.3.1"}],"published":"2022-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80b1d728-b5aa-4811-b92a-9ce36abc2b80","source":"wordfence","cve":"CVE-2024-10182","title":"Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b1d728-b5aa-4811-b92a-9ce36abc2b80?source=api-prod","affected":[{"type":"plugin","slug":"cognito-forms","name":"Cognito Forms","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-12-11T15:39:58Z","updated":"2026-01-27T18:04:02Z"},{"id":"wordfence:80b27cde-68d7-439d-aee6-a390035e2022","source":"wordfence","cve":"CVE-2026-7050","title":"Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b27cde-68d7-439d-aee6-a390035e2022?source=api-prod","affected":[{"type":"plugin","slug":"forms-rb","name":"Forms RB \u2013 Contact Form Builder & Custom Forms","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:05:08Z","updated":"2026-05-12T07:48:22Z"},{"id":"wordfence:80b31295-474e-4375-b566-c628e869da10","source":"wordfence","cve":"CVE-2019-7299","title":"WP Support Plus Responsive Ticket System <= 9.1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b31295-474e-4375-b566-c628e869da10?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":false,"patched_in":"9.1.2"}],"published":"2019-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80b3c2d3-b8dc-429f-b2d7-6a697ad47a9a","source":"wordfence","cve":"CVE-2021-24968","title":"Ultimate FAQ <= 2.1.1 - Missing Authorization to Arbitrary FAQ Creation","severity":"medium","cvss":5.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b3c2d3-b8dc-429f-b2d7-6a697ad47a9a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80b57df9-f5a6-408b-be1b-1cc7fc28ed76","source":"wordfence","cve":"CVE-2024-35726","title":"BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.19 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b57df9-f5a6-408b-be1b-1cc7fc28ed76?source=api-prod","affected":[{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.19","to_inclusive":true,"patched_in":"3.4.20"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:20:02Z"},{"id":"wordfence:80b5ca3d-d651-4c8a-8c64-6938d4a03710","source":"wordfence","cve":"","title":"Kenta Gutenberg Blocks <= 1.0.7 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b5ca3d-d651-4c8a-8c64-6938d4a03710?source=api-prod","affected":[{"type":"plugin","slug":"kenta-blocks","name":"Kenta Blocks \u2013 Responsive Blocks and block templates library","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80b6d533-b282-4c13-bb0b-6be3f456203c","source":"wordfence","cve":"CVE-2025-52829","title":"DirectIQ Email Marketing <= 2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b6d533-b282-4c13-bb0b-6be3f456203c?source=api-prod","affected":[{"type":"plugin","slug":"directiq-wp","name":"DirectIQ Email Marketing","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:20:43Z"},{"id":"wordfence:80b6f2e6-1f06-4ead-8c31-fc4fffe8323b","source":"wordfence","cve":"CVE-2024-3753","title":"Hostel <= 1.1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b6f2e6-1f06-4ead-8c31-fc4fffe8323b?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.2","to_inclusive":true,"patched_in":"1.1.5.3"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T17:39:43Z"},{"id":"wordfence:80b71264-5b0f-41cb-86c1-a052d1976597","source":"wordfence","cve":"CVE-2024-11450","title":"ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80b71264-5b0f-41cb-86c1-a052d1976597?source=api-prod","affected":[{"type":"plugin","slug":"onlyoffice","name":"ONLYOFFICE Docs","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:54Z"},{"id":"wordfence:80ba732f-b3cc-4b42-8c56-9fa1cee08c7b","source":"wordfence","cve":"CVE-2022-2151","title":"Best Contact Management Software <= 3.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80ba732f-b3cc-4b42-8c56-9fa1cee08c7b?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.8"}],"published":"2022-06-21T00:00:00Z","updated":"2025-02-11T21:16:15Z"},{"id":"wordfence:80bb4009-7857-4af4-9c55-0ef69b538e6f","source":"wordfence","cve":"CVE-2025-5526","title":"BuddyPress Docs <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Document Read/Update","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80bb4009-7857-4af4-9c55-0ef69b538e6f?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-docs","name":"BuddyPress Docs","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T15:31:49Z"},{"id":"wordfence:80bd4b15-c2a8-401e-8901-fd008cb52f62","source":"wordfence","cve":"CVE-2025-58203","title":"Solace Extra <= 1.3.2 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80bd4b15-c2a8-401e-8901-fd008cb52f62?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T21:00:25Z"},{"id":"wordfence:80beb6d5-a032-4e35-a4f2-18b6127f031c","source":"wordfence","cve":"CVE-2025-69165","title":"Choreo <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80beb6d5-a032-4e35-a4f2-18b6127f031c?source=api-prod","affected":[{"type":"theme","slug":"choreo","name":"Choreo","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:40:57Z"},{"id":"wordfence:80bfb470-a3df-497f-940d-051ccaa6215b","source":"wordfence","cve":"CVE-2024-0899","title":"s2Member \u2013 Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80bfb470-a3df-497f-940d-051ccaa6215b?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"230815","to_inclusive":true,"patched_in":"240315"}],"published":"2024-03-18T00:00:00Z","updated":"2024-04-09T18:59:02Z"},{"id":"wordfence:80c700fa-619f-4ffe-a09a-bcdae2f71a7d","source":"wordfence","cve":"CVE-2025-12649","title":"SortTable Post <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80c700fa-619f-4ffe-a09a-bcdae2f71a7d?source=api-prod","affected":[{"type":"plugin","slug":"sorttable-post","name":"SortTable Post","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:21:23Z","updated":"2025-11-27T02:26:14Z"},{"id":"wordfence:80c90bc0-ca24-4c7f-93b9-a9d0804ee459","source":"wordfence","cve":"CVE-2024-35668","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.77 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80c90bc0-ca24-4c7f-93b9-a9d0804ee459?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.77","to_inclusive":true,"patched_in":"3.1.78"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-07T13:18:54Z"},{"id":"wordfence:80c9f2e3-afdc-4ba2-a1ef-4c1d166d0757","source":"wordfence","cve":"","title":"RestroPress <= 2.8.2 - Cross-Site Request Forgery to Cart Manipulation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80c9f2e3-afdc-4ba2-a1ef-4c1d166d0757?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80cab51a-d9d9-4cdd-a310-efddb1620c8c","source":"wordfence","cve":"CVE-2026-85306","title":"MountDev AI MCP Connector for WordPress <= 1.6.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80cab51a-d9d9-4cdd-a310-efddb1620c8c?source=api-prod","affected":[{"type":"plugin","slug":"mountdev-ai-mcp-connector","name":"MountDev AI MCP Connector for WordPress","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:25:47Z"},{"id":"wordfence:80ce6564-8559-4e99-a69e-d210db5c87f3","source":"wordfence","cve":"CVE-2025-22815","title":"Button Block <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80ce6564-8559-4e99-a69e-d210db5c87f3?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-03-04T20:03:50Z"},{"id":"wordfence:80d113aa-7401-4b58-a755-f64146d9fb08","source":"wordfence","cve":"CVE-2024-4133","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80d113aa-7401-4b58-a755-f64146d9fb08?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"4.0.31"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:17Z"},{"id":"wordfence:80d3ceea-a7c4-4113-80a8-c19a580f2c4f","source":"wordfence","cve":"CVE-2026-61974","title":"Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80d3ceea-a7c4-4113-80a8-c19a580f2c4f?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:10:25Z"},{"id":"wordfence:80d976f3-cf78-498e-a3c3-a88624426414","source":"wordfence","cve":"","title":"Advanced XML Reader Plugin <= 0.3.4 - XML External Entity Injection","severity":"high","cvss":7.2,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80d976f3-cf78-498e-a3c3-a88624426414?source=api-prod","affected":[{"type":"plugin","slug":"advanced-xml-reader","name":"Advanced XML Reader","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2013-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80da130c-4cb0-45d1-9cea-dc7b33bd20a0","source":"wordfence","cve":"CVE-2026-108125","title":"WP Post Author 4.0.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80da130c-4cb0-45d1-9cea-dc7b33bd20a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"4.0.0","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T15:08:23Z"},{"id":"wordfence:80dbb49d-d21d-41ef-90af-f74f46e5b703","source":"wordfence","cve":"CVE-2014-100003","title":"YourMembers <= 3.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80dbb49d-d21d-41ef-90af-f74f46e5b703?source=api-prod","affected":[{"type":"plugin","slug":"yourmembers","name":"YourMembers","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2014-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80dc998d-24a6-4694-955c-63c62ace69be","source":"wordfence","cve":"CVE-2025-50042","title":"WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80dc998d-24a6-4694-955c-63c62ace69be?source=api-prod","affected":[{"type":"plugin","slug":"wp-register-profile-with-shortcode","name":"WP Register Profile With Shortcode","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:59:42Z"},{"id":"wordfence:80dd4f6a-20dd-4532-913b-ab08f89db836","source":"wordfence","cve":"CVE-2025-10902","title":"Originality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80dd4f6a-20dd-4532-913b-ab08f89db836?source=api-prod","affected":[{"type":"plugin","slug":"originality-ai","name":"Originality.ai AI Checker","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2025-10-23T19:37:41Z","updated":"2025-11-07T16:46:49Z"},{"id":"wordfence:80de464f-a4b0-4aaf-8869-f8d29a422bdb","source":"wordfence","cve":"CVE-2025-13725","title":"Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80de464f-a4b0-4aaf-8869-f8d29a422bdb?source=api-prod","affected":[{"type":"plugin","slug":"thim-blocks","name":"Thim Blocks","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-01-16T15:00:50Z","updated":"2026-01-17T03:24:24Z"},{"id":"wordfence:80dfbcf3-61e9-4187-a2bf-38234348e535","source":"wordfence","cve":"CVE-2025-53436","title":"Monki <= 2.0.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80dfbcf3-61e9-4187-a2bf-38234348e535?source=api-prod","affected":[{"type":"theme","slug":"monki","name":"Monki - Fashion WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-09-04T00:00:00Z","updated":"2026-02-26T15:16:57Z"},{"id":"wordfence:80dfc293-a182-4ed5-9127-6ec788312416","source":"wordfence","cve":"CVE-2020-11515","title":"Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint","severity":"high","cvss":7.4,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80dfc293-a182-4ed5-9127-6ec788312416?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":"1.0.41"}],"published":"2020-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80e0db86-0073-4797-93b1-aa2141f3e60a","source":"wordfence","cve":"CVE-2026-65503","title":"Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e0db86-0073-4797-93b1-aa2141f3e60a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:44:34Z"},{"id":"wordfence:80e2a376-ae15-4883-8a80-0b867fbeeb4c","source":"wordfence","cve":"CVE-2025-60173","title":"GST for WooCommerce <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e2a376-ae15-4883-8a80-0b867fbeeb4c?source=api-prod","affected":[{"type":"plugin","slug":"gst-for-woocommerce","name":"GST for WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:09:02Z"},{"id":"wordfence:80e2f799-2cd7-414f-9701-2269eeecf22a","source":"wordfence","cve":"CVE-2025-23559","title":"MemeOne <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e2f799-2cd7-414f-9701-2269eeecf22a?source=api-prod","affected":[{"type":"plugin","slug":"memeone","name":"MemeOne","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:25:02Z"},{"id":"wordfence:80e74852-517e-4cd0-a7d3-6f6fe3433bff","source":"wordfence","cve":"CVE-2019-9879","title":"WPGraphQL <= 0.2.3 - Administrative User Creation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e74852-517e-4cd0-a7d3-6f6fe3433bff?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":"0.3.0"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80e85c7e-41e5-4b21-aa99-aa2097dfc4a9","source":"wordfence","cve":"CVE-2020-24142","title":"Video Downloader for TikTok < 1.4 - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e85c7e-41e5-4b21-aa99-aa2097dfc4a9?source=api-prod","affected":[{"type":"plugin","slug":"downloader-tiktok","name":"Video Downloader for TikTok","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80e956d9-48d7-4189-ae5d-2f7538c10e1b","source":"wordfence","cve":"CVE-2026-62117","title":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e956d9-48d7-4189-ae5d-2f7538c10e1b?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:39:24Z"},{"id":"wordfence:80e9aa1f-166f-47df-bc50-c7dd55c6e7cc","source":"wordfence","cve":"CVE-2023-25458","title":"TypeSquare Webfonts for ConoHa <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80e9aa1f-166f-47df-bc50-c7dd55c6e7cc?source=api-prod","affected":[{"type":"plugin","slug":"ts-webfonts-for-conoha","name":"TypeSquare Webfonts for ConoHa","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-02-23T00:00:00Z","updated":"2026-02-26T14:50:38Z"},{"id":"wordfence:80f32108-16a5-478f-9966-7153735cad6d","source":"wordfence","cve":"CVE-2024-6715","title":"Ditty 3.1.39 - 3.1.45 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80f32108-16a5-478f-9966-7153735cad6d?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"3.1.39","from_inclusive":true,"to":"3.1.45","to_inclusive":true,"patched_in":"3.1.46"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-28T22:39:16Z"},{"id":"wordfence:80f39182-9835-4bd5-b3cd-41fe20983e1e","source":"wordfence","cve":"CVE-2024-31094","title":"Filter Custom Fields & Taxonomies Light <= 1.05 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80f39182-9835-4bd5-b3cd-41fe20983e1e?source=api-prod","affected":[{"type":"plugin","slug":"filter-custom-fields-taxonomies-light","name":"Filter Custom Fields & Taxonomies Light","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:39:17Z"},{"id":"wordfence:80f7e161-b071-4cb1-8080-ff0ad926a5ca","source":"wordfence","cve":"CVE-2024-31286","title":"WP Photo Album Plus <= 8.6.03.004 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80f7e161-b071-4cb1-8080-ff0ad926a5ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.6.03.004","to_inclusive":true,"patched_in":"8.6.03.005"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:20:24Z"},{"id":"wordfence:80f8dd28-f01d-457d-986c-58e38d266202","source":"wordfence","cve":"CVE-2025-47569","title":"WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates <= 2.9.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80f8dd28-f01d-457d-986c-58e38d266202?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ultimate-gift-card","name":"WooCommerce Ultimate Gift Card","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"2.9.7"}],"published":"2025-06-03T00:00:00Z","updated":"2025-12-05T16:49:41Z"},{"id":"wordfence:80f92f7f-72e7-4d83-9ceb-ed0e11fb8003","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80f92f7f-72e7-4d83-9ceb-ed0e11fb8003?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:32:06Z"},{"id":"wordfence:80fb6586-8dc4-4565-838e-f7175604c2b3","source":"wordfence","cve":"CVE-2026-103337","title":"SmartyParcel \u2013 Shipping Automation & Order Tracking for GLS, InPost, Nova Post and more <= 1.23.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80fb6586-8dc4-4565-838e-f7175604c2b3?source=api-prod","affected":[{"type":"plugin","slug":"wc-ukr-shipping","name":"SmartyParcel Shipping \u2013 DHL Express, GLS, InPost & Nova Post for WooCommerce","from":"*","from_inclusive":true,"to":"1.23.2","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T12:38:53Z"},{"id":"wordfence:80fb6ac9-29af-4a11-ad2f-52cc1bfda6b3","source":"wordfence","cve":"CVE-2012-10013","title":"Backend Localization <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80fb6ac9-29af-4a11-ad2f-52cc1bfda6b3?source=api-prod","affected":[{"type":"plugin","slug":"kau-boys-backend-localization","name":"Backend Localization","from":"1.6.1","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2012-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:80fcaea8-5837-4d8c-afef-b9ed4fd31227","source":"wordfence","cve":"CVE-2024-11710","title":"WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80fcaea8-5837-4d8c-afef-b9ed4fd31227?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:16Z"},{"id":"wordfence:80fcb3af-0b27-4442-aca0-58626b68f0d9","source":"wordfence","cve":"CVE-2025-7444","title":"LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80fcb3af-0b27-4442-aca0-58626b68f0d9?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-18T08:22:44Z"},{"id":"wordfence:80fce3ef-ab77-40e1-a98f-bb0c3f9924d6","source":"wordfence","cve":"CVE-2024-37213","title":"Ali2Woo Lite <= 3.4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/80fce3ef-ab77-40e1-a98f-bb0c3f9924d6?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-06-20T00:00:00Z","updated":"2024-12-06T12:20:03Z"},{"id":"wordfence:81022d05-d1fc-4f27-9f89-b6f9c79cc084","source":"wordfence","cve":"CVE-2013-2201","title":"WordPress Core < 3.5.2 - Cross-Site Scripting via Multiple Vectors","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81022d05-d1fc-4f27-9f89-b6f9c79cc084?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:810362b6-4145-4b2a-b50b-b4637852155f","source":"wordfence","cve":"CVE-2025-62101","title":"Pardakht Delkhah <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810362b6-4145-4b2a-b50b-b4637852155f?source=api-prod","affected":[{"type":"plugin","slug":"pardakht-delkhah","name":"\u067e\u0644\u0627\u06af\u06cc\u0646 \u067e\u0631\u062f\u0627\u062e\u062a \u062f\u0644\u062e\u0648\u0627\u0647","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:24:24Z"},{"id":"wordfence:81062f13-98ed-4ba7-8725-35406ac71568","source":"wordfence","cve":"","title":"ThinkIT WP Contact Form Plugin < 0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81062f13-98ed-4ba7-8725-35406ac71568?source=api-prod","affected":[{"type":"plugin","slug":"thinkit-wp-contact-form","name":"ThinkIT WP Contact Form","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":false,"patched_in":"0.3"}],"published":"2013-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81070529-b269-44b0-8f21-b08add63a099","source":"wordfence","cve":"CVE-2025-13134","title":"AuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81070529-b269-44b0-8f21-b08add63a099?source=api-prod","affected":[{"type":"plugin","slug":"authorsure","name":"AuthorSure","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:20:32Z","updated":"2025-11-21T07:31:53Z"},{"id":"wordfence:8107ed0c-c4eb-4704-9261-4e320e10cdb5","source":"wordfence","cve":"CVE-2014-4163","title":"Featured Comments < 1.2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8107ed0c-c4eb-4704-9261-4e320e10cdb5?source=api-prod","affected":[{"type":"plugin","slug":"feature-comments","name":"Featured Comments","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2014-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8108fe83-86fd-4c57-b963-6dad9f50f3f7","source":"wordfence","cve":"CVE-2024-52450","title":"nBlocks <= 1.0.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8108fe83-86fd-4c57-b963-6dad9f50f3f7?source=api-prod","affected":[{"type":"plugin","slug":"nblocks","name":"nBlocks \u2013 Responsive Gutenberg News Blocks","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:26:48Z"},{"id":"wordfence:81099cdc-bce6-4ee6-b819-c3925acf96a8","source":"wordfence","cve":"CVE-2023-52220","title":"Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81099cdc-bce6-4ee6-b819-c3925acf96a8?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"8.21.0","to_inclusive":true,"patched_in":"8.22.0"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:810a15f7-09e0-4941-997d-475a2873fae2","source":"wordfence","cve":"CVE-2026-90974","title":"Fusion Lite 3.37.14 - 3.47.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810a15f7-09e0-4941-997d-475a2873fae2?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"3.37.14","from_inclusive":true,"to":"3.47.14","to_inclusive":true,"patched_in":"3.48.0"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T00:01:31Z"},{"id":"wordfence:810a999d-c5d5-4004-9399-bb5d64734266","source":"wordfence","cve":"CVE-2024-37515","title":"XPlainer - WooCommerce Product FAQ <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810a999d-c5d5-4004-9399-bb5d64734266?source=api-prod","affected":[{"type":"plugin","slug":"faq-for-woocommerce","name":"Happy FAQs \u2013 FAQ, Product FAQ & Help Center","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:35:26Z"},{"id":"wordfence:810adc9a-d4e1-46a8-89e4-22615cbbb9c6","source":"wordfence","cve":"CVE-2023-44236","title":"WP Captcha <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810adc9a-d4e1-46a8-89e4-22615cbbb9c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-captcha","name":"WP Captcha","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:810c641b-e9e0-462c-96ef-008c083208a0","source":"wordfence","cve":"CVE-2015-10107","title":"Simplr Registration Form Plus+ <= 2.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810c641b-e9e0-462c-96ef-008c083208a0?source=api-prod","affected":[{"type":"plugin","slug":"simplr-registration-form","name":"Simplr Registration Form Plus+","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:810e0fad-38d5-42de-bc46-8176b7756ffd","source":"wordfence","cve":"CVE-2026-39710","title":"RT-Theme 18 | Extensions <= 2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810e0fad-38d5-42de-bc46-8176b7756ffd?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:34:14Z"},{"id":"wordfence:810f1d11-5c29-4b62-aaf4-a765764595ed","source":"wordfence","cve":"CVE-2026-103336","title":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export <= 9.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810f1d11-5c29-4b62-aaf4-a765764595ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2026-10-01T11:43:00Z","updated":"2026-10-08T23:17:47Z"},{"id":"wordfence:810faad2-b63d-497c-af00-b57a07705608","source":"wordfence","cve":"CVE-2023-2964","title":"Simple Iframe <= 1.1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via block attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/810faad2-b63d-497c-af00-b57a07705608?source=api-prod","affected":[{"type":"plugin","slug":"simple-iframe","name":"Simple Iframe","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81108abb-69e5-4571-8209-484b4b0f5617","source":"wordfence","cve":"CVE-2019-17550","title":"Blog2Social: Social Media Auto Post & Scheduler < 5.9.0 - Reflected Cross-Site Scripting via b2s_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81108abb-69e5-4571-8209-484b4b0f5617?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":false,"patched_in":"5.9.0"}],"published":"2019-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:811253a4-6dc9-45a2-b08f-74069fdcc9ea","source":"wordfence","cve":"CVE-2024-32532","title":"Speed Optimizer  <= 7.4.6 - Missing Authorization via purge_on_other_events()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/811253a4-6dc9-45a2-b08f-74069fdcc9ea?source=api-prod","affected":[{"type":"plugin","slug":"sg-cachepress","name":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin","from":"*","from_inclusive":true,"to":"7.4.6","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T14:30:55Z"},{"id":"wordfence:8113fd51-9e2b-45c4-a17b-b38072da0de9","source":"wordfence","cve":"CVE-2026-13754","title":"Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8113fd51-9e2b-45c4-a17b-b38072da0de9?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.0","to_inclusive":true,"patched_in":"3.6.0.1"}],"published":"2026-07-15T19:44:22Z","updated":"2026-07-16T07:51:03Z"},{"id":"wordfence:81141b8c-9677-4267-9026-33267e3135f5","source":"wordfence","cve":"CVE-2021-24343","title":"iFlyChat \u2013 WordPress Chat <= 4.6.4 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81141b8c-9677-4267-9026-33267e3135f5?source=api-prod","affected":[{"type":"plugin","slug":"iflychat","name":"iFlyChat \u2013 WordPress Chat","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":false,"patched_in":"4.7.0"}],"published":"2021-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8114905a-f08c-425f-ae48-06302cfcb20a","source":"wordfence","cve":"","title":"Switchblade - Powerful WordPress Theme <= 1.3.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8114905a-f08c-425f-ae48-06302cfcb20a?source=api-prod","affected":[{"type":"theme","slug":"switchblade","name":"switchblade","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2013-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8118a479-998c-4f43-9749-a5f251f13f85","source":"wordfence","cve":"CVE-2025-31807","title":"Product Notices for WooCommerce <= 1.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8118a479-998c-4f43-9749-a5f251f13f85?source=api-prod","affected":[{"type":"plugin","slug":"product-notices-for-woocommerce","name":"Product Notices for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:22:09Z"},{"id":"wordfence:8118e676-6506-42ae-9f30-536cc1243dbf","source":"wordfence","cve":"CVE-2026-45211","title":"APIExperts Square for WooCommerce <= 4.7.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8118e676-6506-42ae-9f30-536cc1243dbf?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-07-10T19:08:29Z"},{"id":"wordfence:811bd2b0-1e66-4351-8b69-70f5d93ac144","source":"wordfence","cve":"CVE-2025-68545","title":"Nika <= 1.2.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/811bd2b0-1e66-4351-8b69-70f5d93ac144?source=api-prod","affected":[{"type":"theme","slug":"nika","name":"Nika - Medical Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:44:41Z"},{"id":"wordfence:811dc53c-a701-47fc-be06-bd668e34c99f","source":"wordfence","cve":"CVE-2025-52830","title":"bSecure &#8211; Your Universal Checkout <= 1.7.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/811dc53c-a701-47fc-be06-bd668e34c99f?source=api-prod","affected":[{"type":"plugin","slug":"bsecure","name":"bSecure \u2013 Your Universal Checkout","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-07-03T00:00:00Z","updated":"2026-04-25T15:34:03Z"},{"id":"wordfence:811f147e-5829-4f7e-91d8-9dba780950d5","source":"wordfence","cve":"CVE-2025-12953","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/811f147e-5829-4f7e-91d8-9dba780950d5?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2025-11-10T22:39:09Z","updated":"2025-11-11T11:03:45Z"},{"id":"wordfence:812029d9-95d6-4bc9-98b2-700f462163b3","source":"wordfence","cve":"CVE-2025-0493","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/812029d9-95d6-4bc9-98b2-700f462163b3?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"4.2.15"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T04:21:47Z"},{"id":"wordfence:8122afe3-35bf-463b-8443-c093f00bf210","source":"wordfence","cve":"CVE-2024-32685","title":"Wp Ultimate Review <= 2.2.5 - Unauthenticated Review Restriction Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8122afe3-35bf-463b-8443-c093f00bf210?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:27:19Z"},{"id":"wordfence:8123fc2e-54c9-4e0d-b1c6-6f994f07e7e3","source":"wordfence","cve":"CVE-2026-42676","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8123fc2e-54c9-4e0d-b1c6-6f994f07e7e3?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-05-15T00:00:00Z","updated":"2026-05-19T13:31:05Z"},{"id":"wordfence:81258fcc-18cc-4614-a644-5cfb004d019b","source":"wordfence","cve":"CVE-2023-0495","title":"HT Slider For Elementor <= 1.3.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81258fcc-18cc-4614-a644-5cfb004d019b?source=api-prod","affected":[{"type":"plugin","slug":"ht-slider-for-elementor","name":"HT Slider For Elementor","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8129046a-5aa5-4644-babc-0eca9aa524d2","source":"wordfence","cve":"CVE-2026-5144","title":"BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8129046a-5aa5-4644-babc-0eca9aa524d2?source=api-prod","affected":[{"type":"plugin","slug":"bp-groupblog","name":"BuddyPress Groupblog","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2026-04-10T12:09:00Z","updated":"2026-04-11T01:24:59Z"},{"id":"wordfence:8129bc3a-41c9-4a1e-8e04-55e23bb8d46d","source":"wordfence","cve":"CVE-2024-11367","title":"Smoove connector for Elementor forms <= 4.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8129bc3a-41c9-4a1e-8e04-55e23bb8d46d?source=api-prod","affected":[{"type":"plugin","slug":"smoove-elementor","name":"Smoove connector for Elementor forms","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-12-06T21:19:44Z","updated":"2024-12-13T17:04:50Z"},{"id":"wordfence:812cc8f1-f89e-47c4-b029-f6a3dbc55d70","source":"wordfence","cve":"CVE-2024-4262","title":"Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/812cc8f1-f89e-47c4-b029-f6a3dbc55d70?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.28","to_inclusive":true,"patched_in":"2.4.29"}],"published":"2024-05-21T00:00:00Z","updated":"2024-10-24T19:22:54Z"},{"id":"wordfence:812d99bc-8d86-44a9-bafa-be8ce979229c","source":"wordfence","cve":"CVE-2015-5731","title":"WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/812d99bc-8d86-44a9-bafa-be8ce979229c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81330ff8-25a5-403d-abaf-e7c54467abbc","source":"wordfence","cve":"CVE-2022-45850","title":"Image Map Pro < 5.6.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81330ff8-25a5-403d-abaf-e7c54467abbc?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":false,"patched_in":"5.6.9"}],"published":"2022-11-23T00:00:00Z","updated":"2026-02-26T14:50:18Z"},{"id":"wordfence:813532fd-0613-47df-a4d0-54d6b33f37b3","source":"wordfence","cve":"CVE-2024-43939","title":"Zynith SEO <= 7.4.9 - Missing Authorization to Unauthenticated Arbitrary Option Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/813532fd-0613-47df-a4d0-54d6b33f37b3?source=api-prod","affected":[{"type":"plugin","slug":"zynith-seo","name":"Zynith SEO","from":"*","from_inclusive":true,"to":"7.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:43:58Z"},{"id":"wordfence:81354461-70a9-4a5d-9a75-1f2445f7e8aa","source":"wordfence","cve":"","title":"WPRealty <= 2.9.1 - Time-Based Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81354461-70a9-4a5d-9a75-1f2445f7e8aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-realty","name":"WPRealty","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2013-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81378f24-4ecc-48db-86c9-c743ed77c743","source":"wordfence","cve":"CVE-2025-30528","title":"Awesome Logos <= 1.2 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81378f24-4ecc-48db-86c9-c743ed77c743?source=api-prod","affected":[{"type":"plugin","slug":"awesome-logos","name":"Awesome Logos","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:08:38Z"},{"id":"wordfence:813821c8-a9f9-408e-b85e-1c24d90f5e4a","source":"wordfence","cve":"CVE-2024-32709","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.5 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/813821c8-a9f9-408e-b85e-1c24d90f5e4a?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.5","to_inclusive":true,"patched_in":"16.26.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:11:52Z"},{"id":"wordfence:8139bc38-2b78-4b02-bce8-c28dd258ee49","source":"wordfence","cve":"","title":"Adminer < 1.4.4 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8139bc38-2b78-4b02-bce8-c28dd258ee49?source=api-prod","affected":[{"type":"plugin","slug":"adminer","name":"adminer","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2016-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8139f512-7bc9-45ae-83d7-bf496e1ad56d","source":"wordfence","cve":"CVE-2026-15094","title":"WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8139f512-7bc9-45ae-83d7-bf496e1ad56d?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-07-16T17:01:30Z","updated":"2026-07-17T05:35:59Z"},{"id":"wordfence:813f57ca-9c6a-48bc-a013-428cc93ff24d","source":"wordfence","cve":"CVE-2025-49946","title":"Auto Login After Registration <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/813f57ca-9c6a-48bc-a013-428cc93ff24d?source=api-prod","affected":[{"type":"plugin","slug":"auto-login-after-registration","name":"Auto Login After Registration","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-10-29T21:01:21Z"},{"id":"wordfence:813fa4c0-ca2a-45e9-8cb9-8157e92ad056","source":"wordfence","cve":"CVE-2025-63001","title":"Hotel Booking <= 3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/813fa4c0-ca2a-45e9-8cb9-8157e92ad056?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:38:41Z"},{"id":"wordfence:813fe9d2-913c-4e04-bcb7-443eef95c62e","source":"wordfence","cve":"CVE-2024-13532","title":"Small Package Quotes \u2013 Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/813fe9d2-913c-4e04-bcb7-443eef95c62e?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-purolator-edition","name":"Small Package Quotes \u2013 Purolator Edition","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2025-02-11T21:31:13Z","updated":"2025-02-18T21:33:00Z"},{"id":"wordfence:8141f6c1-f5f3-465e-94e8-f1df9b36ecf0","source":"wordfence","cve":"CVE-2025-31756","title":"TZ PlusGallery <= 1.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8141f6c1-f5f3-465e-94e8-f1df9b36ecf0?source=api-prod","affected":[{"type":"plugin","slug":"tz-plus-gallery","name":"TZ Plus Gallery","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:31:43Z"},{"id":"wordfence:81437db2-252e-4031-884e-34112bc7b179","source":"wordfence","cve":"","title":"Top 10 \u2013 Popular posts plugin for WordPress < 2.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81437db2-252e-4031-884e-34112bc7b179?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2016-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:814488b9-2e0a-42f9-bfba-b4d249161099","source":"wordfence","cve":"CVE-2024-11108","title":"Serious Slider <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814488b9-2e0a-42f9-bfba-b4d249161099?source=api-prod","affected":[{"type":"plugin","slug":"cryout-serious-slider","name":"Serious Slider","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-11-29T00:00:00Z","updated":"2025-01-17T13:55:31Z"},{"id":"wordfence:81463022-c075-40e8-962d-b2ca27fd4f70","source":"wordfence","cve":"CVE-2023-35877","title":"Extra User Details <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81463022-c075-40e8-962d-b2ca27fd4f70?source=api-prod","affected":[{"type":"plugin","slug":"extra-user-details","name":"Extra User Details","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.5.1"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8148b6d0-190a-4b97-8af7-edd6943116d1","source":"wordfence","cve":"CVE-2021-4362","title":"Kiwi Social Sharing 2.1.0 - 2.1.2 - Arbitrary Options Change","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1?source=api-prod","affected":[{"type":"plugin","slug":"kiwi-social-share","name":"Social Sharing Plugin \u2013 Kiwi","from":"2.1.0","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2021-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8149103e-105d-401d-8a15-b07d131baaac","source":"wordfence","cve":"CVE-2025-14298","title":"FiboSearch \u2013 Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8149103e-105d-401d-8a15-b07d131baaac?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.32.0","to_inclusive":true,"patched_in":"1.32.1"}],"published":"2025-12-19T19:45:56Z","updated":"2025-12-20T08:22:11Z"},{"id":"wordfence:814b1d7c-0601-4afb-b84c-7aa8ffadd57c","source":"wordfence","cve":"CVE-2026-24953","title":"Simple File List <= 6.1.15 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814b1d7c-0601-4afb-b84c-7aa8ffadd57c?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"6.1.16"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:08:53Z"},{"id":"wordfence:814b6043-e155-4acb-ba4f-bff7f5953a03","source":"wordfence","cve":"CVE-2017-20245","title":"Wow Viral Signups <= 2.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814b6043-e155-4acb-ba4f-bff7f5953a03?source=api-prod","affected":[{"type":"plugin","slug":"mwp-viral-signup","name":"mwp-viral-signup","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T17:37:33Z"},{"id":"wordfence:814cce39-ef25-4d0f-b793-dca5c873f468","source":"wordfence","cve":"CVE-2024-2794","title":"Gutenberg Block Editor Toolkit \u2013 EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814cce39-ef25-4d0f-b793-dca5c873f468?source=api-prod","affected":[{"type":"plugin","slug":"block-options","name":"Gutenberg Block Editor Toolkit \u2013 EditorsKit","from":"*","from_inclusive":true,"to":"1.40.4","to_inclusive":true,"patched_in":"1.40.5"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-23T15:53:16Z"},{"id":"wordfence:814e50de-3690-4adf-bc01-a63cd71bd1cf","source":"wordfence","cve":"CVE-2025-14463","title":"Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814e50de-3690-4adf-bc01-a63cd71bd1cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-paypal","name":"Payment Button for PayPal","from":"*","from_inclusive":true,"to":"1.2.3.41","to_inclusive":true,"patched_in":"1.2.3.42"}],"published":"2026-01-16T14:37:42Z","updated":"2026-01-17T03:24:24Z"},{"id":"wordfence:814f46c2-ac89-4743-81da-3b81a7853afc","source":"wordfence","cve":"CVE-2022-1152","title":"Menubar <= 5.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814f46c2-ac89-4743-81da-3b81a7853afc?source=api-prod","affected":[{"type":"plugin","slug":"menubar","name":"Menubar","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.8"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:814fcd67-9788-4392-8910-7a2bc8782fd8","source":"wordfence","cve":"CVE-2023-3130","title":"Short URL <=  1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814fcd67-9788-4392-8910-7a2bc8782fd8?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"1.6.4","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:814fd060-8781-46ad-86e6-e2b75a7fffc0","source":"wordfence","cve":"CVE-2023-37865","title":"Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/814fd060-8781-46ad-86e6-e2b75a7fffc0?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.29.1","to_inclusive":true,"patched_in":"2.29.2"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81500371-93d3-4cee-a992-93d2469f5233","source":"wordfence","cve":"CVE-2024-53771","title":"SimpleSchema <= 1.7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81500371-93d3-4cee-a992-93d2469f5233?source=api-prod","affected":[{"type":"plugin","slug":"simpleschema-free","name":"SimpleSchema Free","from":"*","from_inclusive":true,"to":"1.7.6.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:18:37Z"},{"id":"wordfence:815054e2-c575-439a-9a66-fce251b4da80","source":"wordfence","cve":"CVE-2026-13015","title":"WP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815054e2-c575-439a-9a66-fce251b4da80?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"18.1","to_inclusive":true,"patched_in":"18.2"}],"published":"2026-06-30T15:04:28Z","updated":"2026-07-01T03:43:37Z"},{"id":"wordfence:815055b7-9bb0-4af3-93fa-b7565bfbccd0","source":"wordfence","cve":"CVE-2025-64223","title":"PenNews < 6.7.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815055b7-9bb0-4af3-93fa-b7565bfbccd0?source=api-prod","affected":[{"type":"theme","slug":"pennews","name":"PenNews - Multi-Purpose AMP WordPress Theme","from":"*","from_inclusive":true,"to":"6.7.3","to_inclusive":false,"patched_in":"6.7.3"}],"published":"2025-08-02T00:00:00Z","updated":"2025-12-20T19:08:37Z"},{"id":"wordfence:81505a97-7244-4318-87b8-a04042bb1eca","source":"wordfence","cve":"CVE-2025-47642","title":"Ajar in5 Embed <= 3.1.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81505a97-7244-4318-87b8-a04042bb1eca?source=api-prod","affected":[{"type":"plugin","slug":"ajar-productions-in5-embed","name":"Ajar in5 Embed","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-09T00:00:00Z","updated":"2025-05-12T14:17:23Z"},{"id":"wordfence:81548e0f-e71c-4746-b93a-a6ff74f28c6b","source":"wordfence","cve":"CVE-2026-93941","title":"Edema | Wellness & Spa WordPress Theme <= 1.2.2.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81548e0f-e71c-4746-b93a-a6ff74f28c6b?source=api-prod","affected":[{"type":"theme","slug":"edema","name":"Edema | Wellness & Spa WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:49:36Z","updated":"2026-10-13T14:28:47Z"},{"id":"wordfence:8155585e-c29c-484c-ab2e-371b5723539e","source":"wordfence","cve":"CVE-2024-31934","title":"Link Whisper Free <= 0.6.9","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8155585e-c29c-484c-ab2e-371b5723539e?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.6.9","to_inclusive":true,"patched_in":"0.7.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:54:01Z"},{"id":"wordfence:81557da6-c98a-4e71-ab88-e987a3650158","source":"wordfence","cve":"CVE-2026-11995","title":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81557da6-c98a-4e71-ab88-e987a3650158?source=api-prod","affected":[{"type":"plugin","slug":"gutena-forms","name":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-07-31T19:31:37Z","updated":"2026-08-01T07:49:49Z"},{"id":"wordfence:81559c61-8816-462d-a64d-6b039fd15b1d","source":"wordfence","cve":"CVE-2025-54746","title":"Shortcode Redirect <= 1.0.02 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81559c61-8816-462d-a64d-6b039fd15b1d?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-redirect","name":"Shortcode Redirect","from":"*","from_inclusive":true,"to":"1.0.02","to_inclusive":true,"patched_in":"1.0.03"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:41:33Z"},{"id":"wordfence:8156d204-f48a-43aa-af2f-86d4aaf4f50e","source":"wordfence","cve":"CVE-2025-49303","title":"Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8156d204-f48a-43aa-af2f-86d4aaf4f50e?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.7","to_inclusive":true,"patched_in":"3.28.8"}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T13:58:33Z"},{"id":"wordfence:8156eafc-5c76-43ef-8f39-1dd6e58c538c","source":"wordfence","cve":"CVE-2025-28887","title":"Plugins Last Updated Column <= 0.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8156eafc-5c76-43ef-8f39-1dd6e58c538c?source=api-prod","affected":[{"type":"plugin","slug":"plugins-last-updated-column","name":"Plugins Last Updated Column","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":"0.1.4"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-04T13:10:16Z"},{"id":"wordfence:8159265b-43b7-4656-98e6-b51feb89a069","source":"wordfence","cve":"CVE-2026-97277","title":"Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more <= 3.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8159265b-43b7-4656-98e6-b51feb89a069?source=api-prod","affected":[{"type":"plugin","slug":"social-boost","name":"Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2026-10-01T13:30:39Z","updated":"2026-10-09T00:00:26Z"},{"id":"wordfence:8159ee7c-69ac-4422-ba8b-664f1fee8e07","source":"wordfence","cve":"CVE-2023-0537","title":"Product Slider For WooCommerce Lite <= 1.1.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Keys","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8159ee7c-69ac-4422-ba8b-664f1fee8e07?source=api-prod","affected":[{"type":"plugin","slug":"product-slider-for-woocommerce-lite","name":"Product Slider For WooCommerce Lite","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:815a8764-9004-4cd7-9558-6ce0f804c936","source":"wordfence","cve":"CVE-2026-65504","title":"BOX NOW Delivery Croatia <= 3.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815a8764-9004-4cd7-9558-6ce0f804c936?source=api-prod","affected":[{"type":"plugin","slug":"box-now-delivery-croatia","name":"BOX NOW Delivery Croatia + Slovenia","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:33:18Z"},{"id":"wordfence:815bd708-b2f8-4add-901b-863fbb3c4d81","source":"wordfence","cve":"CVE-2026-3642","title":"e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815bd708-b2f8-4add-901b-863fbb3c4d81?source=api-prod","affected":[{"type":"plugin","slug":"e-shot-form-builder","name":"e-shot","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:45:48Z","updated":"2026-04-15T08:28:14Z"},{"id":"wordfence:815ce00b-3753-4c38-8a30-5242a5841734","source":"wordfence","cve":"CVE-2024-13897","title":"Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815ce00b-3753-4c38-8a30-5242a5841734?source=api-prod","affected":[{"type":"plugin","slug":"moving-media-library","name":"Moving Media Library","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2025-03-05T20:19:26Z","updated":"2025-03-06T08:21:44Z"},{"id":"wordfence:815e5b86-2d1b-4794-b761-dad770393d3e","source":"wordfence","cve":"CVE-2025-12062","title":"WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/815e5b86-2d1b-4794-b761-dad770393d3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2026-02-16T10:59:48Z","updated":"2026-02-16T23:22:38Z"},{"id":"wordfence:81638472-b635-4100-8fb9-3daf35fa172e","source":"wordfence","cve":"CVE-2023-27461","title":"When Last Login <= 1.2.1 - Cross-Site Request Forgery via wll_hide_subscription_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81638472-b635-4100-8fb9-3daf35fa172e?source=api-prod","affected":[{"type":"plugin","slug":"when-last-login","name":"When Last Login","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8165196d-0117-473f-8ccf-57ffd3e08e16","source":"wordfence","cve":"CVE-2025-12827","title":"Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8165196d-0117-473f-8ccf-57ffd3e08e16?source=api-prod","affected":[{"type":"plugin","slug":"top-friends","name":"Top Friends","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:16:42Z","updated":"2025-11-18T08:27:33Z"},{"id":"wordfence:816573b7-e720-4470-a929-a6cad0d73dc8","source":"wordfence","cve":"CVE-2019-15842","title":"Easy restaurant menu manager <= 1.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816573b7-e720-4470-a929-a6cad0d73dc8?source=api-prod","affected":[{"type":"plugin","slug":"easy-pdf-restaurant-menu-upload","name":"Easy restaurant menu manager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2"}],"published":"2019-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8167b8c1-d365-4b52-9be0-28cbd0f4c36a","source":"wordfence","cve":"CVE-2026-27040","title":"WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8167b8c1-d365-4b52-9be0-28cbd0f4c36a?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.0.31","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-05-05T14:46:55Z"},{"id":"wordfence:816956d1-8a76-44ff-841a-e609c6e51af3","source":"wordfence","cve":"CVE-2025-68872","title":"Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816956d1-8a76-44ff-841a-e609c6e51af3?source=api-prod","affected":[{"type":"plugin","slug":"wordcents","name":"Eli's WordCents adSense Widget with Analytics","from":"*","from_inclusive":true,"to":"1.3.03.27","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:53:55Z"},{"id":"wordfence:8169a655-67ae-49f3-b535-4bcb2c637bc4","source":"wordfence","cve":"CVE-2026-54864","title":"Cincopa video and media plug-in <= 1.165 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8169a655-67ae-49f3-b535-4bcb2c637bc4?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.165","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T07:02:41Z","updated":"2026-11-03T20:04:29Z"},{"id":"wordfence:8169c3b8-dc45-4031-a118-378ec5c7d673","source":"wordfence","cve":"CVE-2026-84762","title":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square <= 4.5.3 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8169c3b8-dc45-4031-a118-378ec5c7d673?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:31:49Z"},{"id":"wordfence:8169e533-ef3b-4fd7-9571-61e5528b7652","source":"wordfence","cve":"CVE-2025-10580","title":"Widget Options \u2013 The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8169e533-ef3b-4fd7-9571-61e5528b7652?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:816bcd51-2424-41a1-8a0d-583268d8c6cd","source":"wordfence","cve":"CVE-2026-24564","title":"Textmetrics <= 3.6.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816bcd51-2424-41a1-8a0d-583268d8c6cd?source=api-prod","affected":[{"type":"plugin","slug":"webtexttool","name":"Textmetrics","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-01-21T00:00:00Z","updated":"2026-04-15T13:35:27Z"},{"id":"wordfence:816e70ce-c599-4ed6-84c6-72f18f8c162d","source":"wordfence","cve":"CVE-2025-62049","title":"Cost Calculator Builder <= 3.5.32 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816e70ce-c599-4ed6-84c6-72f18f8c162d?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.5.32","to_inclusive":true,"patched_in":"3.5.33"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-29T16:10:25Z"},{"id":"wordfence:816ec7bd-dd0f-4c52-b73f-72cd25c410b2","source":"wordfence","cve":"CVE-2021-24710","title":"Print-O-Matic <= 2.0.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816ec7bd-dd0f-4c52-b73f-72cd25c410b2?source=api-prod","affected":[{"type":"plugin","slug":"print-o-matic","name":"Print-O-Matic","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:816f5fc1-e4e6-4c0d-b222-fe733f026e33","source":"wordfence","cve":"CVE-2023-5411","title":"Funnelforms Free <= 3.4 - Missing Authorization to Post Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816f5fc1-e4e6-4c0d-b222-fe733f026e33?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:816fb31d-0b06-4a86-9534-81457903002e","source":"wordfence","cve":"CVE-2025-1798","title":"Design Comuni Italia <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/816fb31d-0b06-4a86-9534-81457903002e?source=api-prod","affected":[{"type":"theme","slug":"design-comuni-wordpress-theme","name":"Design Comuni Italia","from":"1.1.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-03-04T00:00:00Z","updated":"2025-04-28T13:59:47Z"},{"id":"wordfence:817189e9-a4d2-4bb1-b866-fc7ae2d2be4f","source":"wordfence","cve":"CVE-2026-75799","title":"YAHMAN Add-ons <= 0.9.30 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/817189e9-a4d2-4bb1-b866-fc7ae2d2be4f?source=api-prod","affected":[{"type":"plugin","slug":"yahman-add-ons","name":"YAHMAN Add-ons","from":"*","from_inclusive":true,"to":"0.9.30","to_inclusive":true,"patched_in":"0.9.31"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:31:52Z"},{"id":"wordfence:8173596d-a127-4dc1-a72a-640381536c67","source":"wordfence","cve":"CVE-2021-24874","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.30 - Reflected Cross-Site Scripting via lang & pid Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8173596d-a127-4dc1-a72a-640381536c67?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":false,"patched_in":"3.1.31"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8175ff00-e588-46cf-a743-9c4d4717657a","source":"wordfence","cve":"CVE-2025-14734","title":"Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8175ff00-e588-46cf-a743-9c4d4717657a?source=api-prod","affected":[{"type":"plugin","slug":"afiliados-de-amazon-lite","name":"Amazon affiliate lite Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:05:22Z","updated":"2025-12-20T03:20:22Z"},{"id":"wordfence:8176dd33-80d2-4cc7-9edb-e1d7a1277f28","source":"wordfence","cve":"CVE-2023-38478","title":"Integration for WooCommerce and QuickBooks <= 1.2.3 - Open Redirect via setup_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8176dd33-80d2-4cc7-9edb-e1d7a1277f28?source=api-prod","affected":[{"type":"plugin","slug":"wp-woocommerce-quickbooks","name":"Integration for WooCommerce and QuickBooks","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:817ca119-ddaf-4525-beee-68c4e0aac544","source":"wordfence","cve":"CVE-2023-1615","title":"Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated(Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/817ca119-ddaf-4525-beee-68c4e0aac544?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"3.1.23","from_inclusive":true,"to":"3.1.23","to_inclusive":true,"patched_in":"3.1.24"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8180160d-ba33-4f79-baa5-2613be470b0f","source":"wordfence","cve":"CVE-2026-107625","title":"Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8180160d-ba33-4f79-baa5-2613be470b0f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.14.1"}],"published":"2026-10-27T13:58:38Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:81803a24-51ba-4d23-88ef-553cb4754977","source":"wordfence","cve":"CVE-2025-1559","title":"CC-IMG-Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81803a24-51ba-4d23-88ef-553cb4754977?source=api-prod","affected":[{"type":"plugin","slug":"cc-img-shortcode","name":"CC-IMG-Shortcode","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T13:22:46Z","updated":"2025-03-13T01:45:27Z"},{"id":"wordfence:8184fbf0-a798-494b-830d-b98b9ab7d2d0","source":"wordfence","cve":"CVE-2026-92989","title":"SendPress Newsletters <= 1.26.1.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8184fbf0-a798-494b-830d-b98b9ab7d2d0?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.26.1.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:24:28Z"},{"id":"wordfence:81850474-5e85-4c4b-95ca-80092b05c6ff","source":"wordfence","cve":"CVE-2024-37926","title":"WP Accessibility Helper (WAH) <= 0.6.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81850474-5e85-4c4b-95ca-80092b05c6ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.2.9","to_inclusive":true,"patched_in":"0.6.3"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-18T14:12:22Z"},{"id":"wordfence:8185c7a4-3d8e-4a24-9746-536337afbcfe","source":"wordfence","cve":"CVE-2021-24253","title":"classyfrieds <= 3.8 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8185c7a4-3d8e-4a24-9746-536337afbcfe?source=api-prod","affected":[{"type":"plugin","slug":"classyfrieds","name":"classyfrieds","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2021-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8187c6eb-d962-48a7-bbe8-5949cfdefbce","source":"wordfence","cve":"CVE-2022-2449","title":"reSmush.it Image Optimizer <= 0.4.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8187c6eb-d962-48a7-bbe8-5949cfdefbce?source=api-prod","affected":[{"type":"plugin","slug":"resmushit-image-optimizer","name":"reSmush.it : The original free image compressor and optimizer plugin","from":"*","from_inclusive":true,"to":"0.4.6","to_inclusive":true,"patched_in":"0.4.7"}],"published":"2022-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8188c96d-6658-42da-bfea-10a7044348a0","source":"wordfence","cve":"CVE-2024-51676","title":"Delisho <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8188c96d-6658-42da-bfea-10a7044348a0?source=api-prod","affected":[{"type":"plugin","slug":"dr-widgets-blocks","name":"Delisho \u2013 Recipe Widgets and Blocks","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:38:25Z"},{"id":"wordfence:818b2547-844d-4667-acc7-66843ca28cfe","source":"wordfence","cve":"CVE-2025-62750","title":"WooCommerce Parcelas <= 1.3.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/818b2547-844d-4667-acc7-66843ca28cfe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-parcelas","name":"Installment Prices for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-10-13T16:57:59Z"},{"id":"wordfence:818c9ddc-be95-4997-8041-cf856a964657","source":"wordfence","cve":"CVE-2024-43330","title":"PowerPack for Beaver Builder <= 2.37.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/818c9ddc-be95-4997-8041-cf856a964657?source=api-prod","affected":[{"type":"plugin","slug":"bbpowerpack","name":"PowerPack for Beaver Builder","from":"*","from_inclusive":true,"to":"2.37.3","to_inclusive":true,"patched_in":"2.37.4"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:34:10Z"},{"id":"wordfence:818d3418-8e14-49b9-a112-8eab9eb3c283","source":"wordfence","cve":"CVE-2024-1160","title":"Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/818d3418-8e14-49b9-a112-8eab9eb3c283?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2024-02-12T00:00:00Z","updated":"2024-04-03T20:16:48Z"},{"id":"wordfence:818de7f7-913a-4ade-927e-bba281b4709a","source":"wordfence","cve":"CVE-2023-5073","title":"iframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/818de7f7-913a-4ade-927e-bba281b4709a?source=api-prod","affected":[{"type":"plugin","slug":"iframe-forms","name":"iframe forms","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:818ef655-aef3-4808-88ae-ecf2ba209d67","source":"wordfence","cve":"CVE-2020-20627","title":"GiveWP <= 2.5.9 - Missing Authorization to Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/818ef655-aef3-4808-88ae-ecf2ba209d67?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.5.10","to_inclusive":false,"patched_in":"2.5.10"}],"published":"2019-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81925286-ad18-4ba2-9f59-814a47dba5e3","source":"wordfence","cve":"","title":"WordPress Core 5.9.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Block Labels","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81925286-ad18-4ba2-9f59-814a47dba5e3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"5.9.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"5.9.20"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T16:57:15Z"},{"id":"wordfence:8192cbb0-ea1f-4897-808c-67f5002d56fb","source":"wordfence","cve":"CVE-2026-96267","title":"WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8192cbb0-ea1f-4897-808c-67f5002d56fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":true,"patched_in":"8.7.1"}],"published":"2026-10-02T17:38:58Z","updated":"2026-10-03T06:38:24Z"},{"id":"wordfence:81936c52-feb7-4f10-940d-cfce5963f400","source":"wordfence","cve":"CVE-2023-25022","title":"Watu Quiz <= 3.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81936c52-feb7-4f10-940d-cfce5963f400?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.8.1"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81939cc9-b8f7-4c40-b963-4f6f8c7043e7","source":"wordfence","cve":"CVE-2019-5924","title":"Smart Forms < 2.6.26 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81939cc9-b8f7-4c40-b963-4f6f8c7043e7?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.26","to_inclusive":false,"patched_in":"2.6.26"}],"published":"2019-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:819542fe-004e-4636-ad38-f11642d52ede","source":"wordfence","cve":"CVE-2026-65493","title":"Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819542fe-004e-4636-ad38-f11642d52ede?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:33:13Z"},{"id":"wordfence:819580a0-75ea-475d-b6b8-47d57e5c3d05","source":"wordfence","cve":"CVE-2024-56294","title":"Nexter Blocks <= 4.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819580a0-75ea-475d-b6b8-47d57e5c3d05?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:53:46Z"},{"id":"wordfence:8196e947-c3d1-46ba-aee2-25834c1a9c05","source":"wordfence","cve":"CVE-2025-52817","title":"Abandoned Contact Form 7 < 2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8196e947-c3d1-46ba-aee2-25834c1a9c05?source=api-prod","affected":[{"type":"plugin","slug":"abandoned-contact-form-7","name":"Abandoned Contact Form 7","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2025-06-23T00:00:00Z","updated":"2026-05-26T18:16:05Z"},{"id":"wordfence:8198d81a-40c0-49c1-8c38-f5ef6fb911ad","source":"wordfence","cve":"CVE-2025-14718","title":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8198d81a-40c0-49c1-8c38-f5ef6fb911ad?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2026-01-08T17:41:07Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:81998d01-8ae7-44ac-a22e-7bdbebee6c49","source":"wordfence","cve":"CVE-2024-13443","title":"Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81998d01-8ae7-44ac-a22e-7bdbebee6c49?source=api-prod","affected":[{"type":"plugin","slug":"easypromos","name":"Easypromos Plugin","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-02-18T14:44:31Z","updated":"2025-02-19T03:21:12Z"},{"id":"wordfence:819b232b-3d42-4c6b-b32c-8302f32305ef","source":"wordfence","cve":"CVE-2025-39388","title":"AnalyticsWP <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819b232b-3d42-4c6b-b32c-8302f32305ef?source=api-prod","affected":[{"type":"plugin","slug":"analyticswp","name":"AnalyticsWP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T18:59:22Z"},{"id":"wordfence:819b3e0c-1cd0-45f9-8621-41817ad1de5e","source":"wordfence","cve":"CVE-2023-49755","title":"Elementor Timeline Widget <= 2.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819b3e0c-1cd0-45f9-8621-41817ad1de5e?source=api-prod","affected":[{"type":"plugin","slug":"3r-elementor-timeline-widget","name":"Vertical Timeline Widget for Elementor","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-12-04T00:00:00Z","updated":"2024-04-17T12:58:45Z"},{"id":"wordfence:819b9565-2eb1-4b87-bf3a-5cd93429cafe","source":"wordfence","cve":"CVE-2025-34077","title":"Pie Register <= 3.7.1.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819b9565-2eb1-4b87-bf3a-5cd93429cafe?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.7.1.4","to_inclusive":true,"patched_in":"3.7.1.5"}],"published":"2021-10-11T00:00:00Z","updated":"2025-07-25T14:53:06Z"},{"id":"wordfence:819e2a4a-d282-4c52-852a-e3a2051a04e9","source":"wordfence","cve":"","title":"Klarna Checkout for WooCommerce <= 2.0.9 - Arbitrary Plugin Installation, Activation and Deactivation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819e2a4a-d282-4c52-852a-e3a2051a04e9?source=api-prod","affected":[{"type":"plugin","slug":"klarna-checkout-for-woocommerce","name":"Kustom Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":false,"patched_in":"2.0.10"}],"published":"2020-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:819f93ae-cfbd-4ba5-979f-18adc7b9c8fe","source":"wordfence","cve":"CVE-2024-29760","title":"Booster for WooCommerce <= 7.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/819f93ae-cfbd-4ba5-979f-18adc7b9c8fe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:17:45Z"},{"id":"wordfence:81a293ea-abda-4c90-a109-791ca5ba89a4","source":"wordfence","cve":"CVE-2023-6325","title":"RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a293ea-abda-4c90-a109-791ca5ba89a4?source=api-prod","affected":[{"type":"plugin","slug":"romethemeform","name":"RTMForm \u2013 Contact Form, Multi-Step Forms & Form Templates for Elementor","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-05-22T00:00:00Z","updated":"2024-07-29T21:36:43Z"},{"id":"wordfence:81a2c94c-712a-4f72-842e-acb97abb4ea7","source":"wordfence","cve":"CVE-2024-9641","title":"LuckyWP Table of Contents <= 2.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a2c94c-712a-4f72-842e-acb97abb4ea7?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-table-of-contents","name":"LuckyWP Table of Contents","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-11-21T00:00:00Z","updated":"2025-01-17T13:04:36Z"},{"id":"wordfence:81a3460e-f2c8-422f-9256-3aef24afb42b","source":"wordfence","cve":"CVE-2021-24983","title":"Asset CleanUp <= 1.3.8.4 - Reflected Cross-Site Scripting via AJAX Action","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a3460e-f2c8-422f-9256-3aef24afb42b?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.8.5","to_inclusive":false,"patched_in":"1.3.8.5"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81a48c61-4191-4252-9230-9df8fc5e3443","source":"wordfence","cve":"CVE-2024-1537","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a48c61-4191-4252-9230-9df8fc5e3443?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:26:59Z"},{"id":"wordfence:81a503f9-3bd2-4fb8-8c3e-8d68d41f7918","source":"wordfence","cve":"CVE-2026-110184","title":"Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a503f9-3bd2-4fb8-8c3e-8d68d41f7918?source=api-prod","affected":[{"type":"theme","slug":"newsmatic","name":"Newsmatic","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-10-28T21:31:21Z","updated":"2026-10-29T11:27:15Z"},{"id":"wordfence:81a7afc0-05be-4966-b762-081ef553d4e8","source":"wordfence","cve":"CVE-2013-2710","title":"Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a7afc0-05be-4966-b762-081ef553d4e8?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81a82caf-4013-42c4-ad63-4e13bfa4322f","source":"wordfence","cve":"CVE-2024-2536","title":"Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a82caf-4013-42c4-ad63-4e13bfa4322f?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.214","to_inclusive":true,"patched_in":"1.0.215"}],"published":"2024-03-21T00:00:00Z","updated":"2024-04-09T18:59:03Z"},{"id":"wordfence:81a8e749-3ddf-4bf0-a2c3-578304fa0ba4","source":"wordfence","cve":"CVE-2025-27339","title":"Minimum Password Strength <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81a8e749-3ddf-4bf0-a2c3-578304fa0ba4?source=api-prod","affected":[{"type":"plugin","slug":"minimum-password-strength","name":"Minimum Password Strength","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:38:46Z"},{"id":"wordfence:81aad41e-0330-4dff-a5f8-08a108d724f5","source":"wordfence","cve":"CVE-2026-5396","title":"Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter","severity":"high","cvss":8.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81aad41e-0330-4dff-a5f8-08a108d724f5?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.21","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-05-13T17:13:18Z","updated":"2026-05-14T05:30:30Z"},{"id":"wordfence:81ab48c6-6add-4eb8-89a4-681af833fa11","source":"wordfence","cve":"CVE-2025-32229","title":"Variable Inspector < 2.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ab48c6-6add-4eb8-89a4-681af833fa11?source=api-prod","affected":[{"type":"plugin","slug":"variable-inspector","name":"Variable Inspector","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":false,"patched_in":"2.7.1"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-26T18:15:28Z"},{"id":"wordfence:81ab65c1-9440-49fb-9369-feda1b662fe0","source":"wordfence","cve":"CVE-2025-23505","title":"Pit Login Welcome <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ab65c1-9440-49fb-9369-feda1b662fe0?source=api-prod","affected":[{"type":"plugin","slug":"pit-login-welcome","name":"Pit Login Welcome","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:00:16Z"},{"id":"wordfence:81ac0ec4-8476-4ed5-9b00-a0456afef191","source":"wordfence","cve":"CVE-2024-35631","title":"FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ac0ec4-8476-4ed5-9b00-a0456afef191?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.45.7212","to_inclusive":true,"patched_in":"7.5.46.7212"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-05T13:35:45Z"},{"id":"wordfence:81b079d7-937a-4a30-8e52-716989a37b77","source":"wordfence","cve":"CVE-2025-53282","title":"Thumbnail Editor <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b079d7-937a-4a30-8e52-716989a37b77?source=api-prod","affected":[{"type":"plugin","slug":"thumbnail-editor","name":"Thumbnail Editor","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:41:25Z"},{"id":"wordfence:81b4302f-1a2f-49f4-8bfc-a511604dc51b","source":"wordfence","cve":"CVE-2025-28874","title":"BP Email Assign Templates <= 1.7 - Authenticated (Admin+) Arbitrary Option Deletion","severity":"medium","cvss":6.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b4302f-1a2f-49f4-8bfc-a511604dc51b?source=api-prod","affected":[{"type":"plugin","slug":"bp-email-assign-templates","name":"BP Email Assign Templates","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-21T14:25:42Z"},{"id":"wordfence:81b44abb-6d30-4930-b68b-9a04d93f5169","source":"wordfence","cve":"CVE-2025-5396","title":"Bears Backup <= 2.0.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b44abb-6d30-4930-b68b-9a04d93f5169?source=api-prod","affected":[{"type":"plugin","slug":"bears-backup","name":"Bears Backup","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-17T01:44:54Z"},{"id":"wordfence:81b49050-84e4-4fb4-b8ed-baf21c8bb5a3","source":"wordfence","cve":"CVE-2015-9434","title":"Logo Carousel < 1.7.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b49050-84e4-4fb4-b8ed-baf21c8bb5a3?source=api-prod","affected":[{"type":"plugin","slug":"kiwi-logo-carousel","name":"Logo Carousel","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81b4a218-7752-4276-a523-1edbe1e36442","source":"wordfence","cve":"CVE-2021-25001","title":"Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in Product XML Feeds Module","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b4a218-7752-4276-a523-1edbe1e36442?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"5.4.9"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81b76824-8099-433d-88e3-c05df9434fd6","source":"wordfence","cve":"CVE-2006-10001","title":"Subscribe to Comments <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b76824-8099-433d-88e3-c05df9434fd6?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2006-09-17T00:00:00Z","updated":"2024-02-07T15:06:07Z"},{"id":"wordfence:81b8451a-e5b8-44e9-8253-48beb2a43e6d","source":"wordfence","cve":"CVE-2024-9771","title":"WP-Recall <= 16.26.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b8451a-e5b8-44e9-8253-48beb2a43e6d?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.11","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-30T19:51:47Z"},{"id":"wordfence:81b9cebd-eff6-4650-977e-ee81089e683a","source":"wordfence","cve":"","title":"Levo Slideshow <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81b9cebd-eff6-4650-977e-ee81089e683a?source=api-prod","affected":[{"type":"plugin","slug":"wp-levoslideshow","name":"Levo Slideshow","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2016-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81bafe3c-ce52-49c9-8818-e177205a463c","source":"wordfence","cve":"CVE-2026-112230","title":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. < 4.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bafe3c-ce52-49c9-8818-e177205a463c?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":false,"patched_in":"4.4.6"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:08:09Z"},{"id":"wordfence:81bb4b60-a674-4276-b7e5-5626f9eb3ff8","source":"wordfence","cve":"CVE-2024-2232","title":"Himer - Social Questions and Answers <= 2.1.2 - Cross-Site Request Forgery to Arbitrary User Invites","severity":"medium","cvss":5.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bb4b60-a674-4276-b7e5-5626f9eb3ff8?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-09T17:29:09Z"},{"id":"wordfence:81bb8458-140f-4b2b-802e-af8aa2e1666c","source":"wordfence","cve":"CVE-2026-120854","title":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bb8458-140f-4b2b-802e-af8aa2e1666c?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.13.6","to_inclusive":true,"patched_in":"3.13.7"}],"published":"2026-11-07T11:28:51Z","updated":"2026-11-10T19:41:01Z"},{"id":"wordfence:81bcbf7d-d33f-4cf2-8411-613cf54095b4","source":"wordfence","cve":"CVE-2022-0663","title":"Print, PDF, Email by PrintFriendly <= 5.2.2 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bcbf7d-d33f-4cf2-8411-613cf54095b4?source=api-prod","affected":[{"type":"plugin","slug":"printfriendly","name":"Print, PDF & Email by PrintFriendly","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":false,"patched_in":"5.2.3"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81bce8ce-0158-48d5-aae4-cda0c93de191","source":"wordfence","cve":"CVE-2026-32410","title":"WBW Currency Switcher for WooCommerce <= 2.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bce8ce-0158-48d5-aae4-cda0c93de191?source=api-prod","affected":[{"type":"plugin","slug":"woo-currency","name":"Currency Switcher for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-15T21:14:47Z"},{"id":"wordfence:81bedea8-fbf7-411b-a31b-51af23522498","source":"wordfence","cve":"CVE-2012-6624","title":"Soundcloud Is Gold <= 2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bedea8-fbf7-411b-a31b-51af23522498?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-is-gold","name":"SoundCloud Is Gold","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81bf9a8d-fc70-45d9-a352-4a5bfb2c43f4","source":"wordfence","cve":"CVE-2009-3622","title":"WordPress Core <= 2.8.4 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81bf9a8d-fc70-45d9-a352-4a5bfb2c43f4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2009-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81c4dd54-a248-48a0-a407-ffd3162e0abe","source":"wordfence","cve":"CVE-2022-4763","title":"Icon Widget <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81c4dd54-a248-48a0-a407-ffd3162e0abe?source=api-prod","affected":[{"type":"plugin","slug":"icon-widget","name":"Icon Widget","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81c62f9d-6a98-4f18-8c4a-c81c2730ce5d","source":"wordfence","cve":"CVE-2024-52428","title":"Ads Booster by Ads Pro <= 1.12 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81c62f9d-6a98-4f18-8c4a-c81c2730ce5d?source=api-prod","affected":[{"type":"plugin","slug":"free-wp-booster-by-ads-pro","name":"Ads Booster by Ads Pro","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:31:34Z"},{"id":"wordfence:81c80424-3ecb-4740-b458-00a983f35298","source":"wordfence","cve":"CVE-2017-18602","title":"IBPS Online Exam Plugin for WordPress <= 1.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81c80424-3ecb-4740-b458-00a983f35298?source=api-prod","affected":[{"type":"plugin","slug":"examapp","name":"IBPS Online Exam Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81ca577d-5337-4d46-94bb-93c230cf0348","source":"wordfence","cve":"","title":"The7 \u2014 Website and eCommerce Builder for WordPress <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ca577d-5337-4d46-94bb-93c230cf0348?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2015-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81cb9888-2a1c-4cfd-ad62-ed8cfc2f22b3","source":"wordfence","cve":"CVE-2025-58838","title":"Smooth Accordion <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cb9888-2a1c-4cfd-ad62-ed8cfc2f22b3?source=api-prod","affected":[{"type":"plugin","slug":"smooth-accordion","name":"Smooth Accordion","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:50:01Z"},{"id":"wordfence:81cc09ee-da3d-407d-82c0-542b56df5aed","source":"wordfence","cve":"CVE-2024-12077","title":"Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cc09ee-da3d-407d-82c0-542b56df5aed?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"},{"type":"plugin","slug":"booking-calendar-pro","name":"Booking Calendar Pro WpDevArt","from":"*","from_inclusive":true,"to":"11.2.19","to_inclusive":true,"patched_in":"11.2.20"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T07:22:35Z"},{"id":"wordfence:81cc4ef1-6303-4ecd-8b51-2602ddd74ece","source":"wordfence","cve":"CVE-2024-43228","title":"SecuPress Free <= 2.2.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cc4ef1-6303-4ecd-8b51-2602ddd74ece?source=api-prod","affected":[{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.2.5.3","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:34:53Z"},{"id":"wordfence:81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f","source":"wordfence","cve":"CVE-2026-111862","title":"Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cd7a2c-ad0c-4dbc-b5dc-07ec866d5c1f?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math-pro","name":"Rank Math SEO PRO","from":"3.0.123","from_inclusive":true,"to":"3.0.123","to_inclusive":true,"patched_in":"3.0.124"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-19T16:36:02Z"},{"id":"wordfence:81cdb8b3-4e61-4f8d-af72-557e8435c7af","source":"wordfence","cve":"CVE-2025-62928","title":"SEO Meta Description Updater <= 1.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cdb8b3-4e61-4f8d-af72-557e8435c7af?source=api-prod","affected":[{"type":"plugin","slug":"seo-meta-description-updater","name":"SEO Meta Description Updater","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-05T00:00:00Z","updated":"2025-10-29T14:58:27Z"},{"id":"wordfence:81cf06d2-9b5a-4f9f-adf9-890b46db7783","source":"wordfence","cve":"CVE-2026-125409","title":"Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81cf06d2-9b5a-4f9f-adf9-890b46db7783?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"4.3.22"}],"published":"2026-11-12T20:48:11Z","updated":"2026-11-13T09:35:14Z"},{"id":"wordfence:81d28e90-252f-4b5f-a55b-8cb96292538e","source":"wordfence","cve":"CVE-2026-17505","title":"TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81d28e90-252f-4b5f-a55b-8cb96292538e?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-08-04T18:24:12Z","updated":"2026-08-05T06:37:57Z"},{"id":"wordfence:81d43850-c6aa-4340-a0e0-41e04e958848","source":"wordfence","cve":"CVE-2025-12038","title":"Folderly <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81d43850-c6aa-4340-a0e0-41e04e958848?source=api-prod","affected":[{"type":"plugin","slug":"folderly","name":"Folderly","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.3.1"}],"published":"2025-10-31T16:35:14Z","updated":"2025-11-01T05:40:23Z"},{"id":"wordfence:81d46c7a-dfe4-4991-99cc-66e5c6d3e3c8","source":"wordfence","cve":"CVE-2026-19652","title":"Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81d46c7a-dfe4-4991-99cc-66e5c6d3e3c8?source=api-prod","affected":[{"type":"plugin","slug":"divi-membership","name":"Divi Membership","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-10-01T16:23:18Z","updated":"2026-10-02T13:29:05Z"},{"id":"wordfence:81d73996-d192-485b-bc47-1db7e6ca70e6","source":"wordfence","cve":"CVE-2024-47306","title":"Secure Copy Content Protection and Content Locking <= 4.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81d73996-d192-485b-bc47-1db7e6ca70e6?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:15:50Z"},{"id":"wordfence:81e1bc49-8ed0-4605-bc81-682b89f53796","source":"wordfence","cve":"CVE-2025-31824","title":"WP Optin Wheel <= 1.4.7 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81e1bc49-8ed0-4605-bc81-682b89f53796?source=api-prod","affected":[{"type":"plugin","slug":"wp-optin-wheel","name":"WP Optin Wheel \u2013 Gamified Optin Email Marketing Tool for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-17T12:53:14Z"},{"id":"wordfence:81e26924-c9eb-4ddf-89e3-a8bf95d23b78","source":"wordfence","cve":"CVE-2026-2289","title":"Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81e26924-c9eb-4ddf-89e3-a8bf95d23b78?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-03-03T12:40:33Z","updated":"2026-03-04T01:21:58Z"},{"id":"wordfence:81e6e266-078a-4f4f-a335-c9d388f41ef2","source":"wordfence","cve":"CVE-2024-9352","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81e6e266-078a-4f4f-a335-c9d388f41ef2?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.35.1","to_inclusive":true,"patched_in":"1.36.0"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T05:33:08Z"},{"id":"wordfence:81e7ab80-7df2-4ef4-80ee-a11d057151c4","source":"wordfence","cve":"CVE-2024-10124","title":"Vayu Blocks \u2013 Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81e7ab80-7df2-4ef4-80ee-a11d057151c4?source=api-prod","affected":[{"type":"plugin","slug":"vayu-blocks","name":"Vayu Blocks \u2013 Website Builder for the Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:81eb489c-ee56-4587-90b8-0a1a1c66ae66","source":"wordfence","cve":"CVE-2025-58929","title":"Pantry <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81eb489c-ee56-4587-90b8-0a1a1c66ae66?source=api-prod","affected":[{"type":"theme","slug":"pantry","name":"Pantry \u2014 Kitchen Cabinets & Furniture WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:32:42Z"},{"id":"wordfence:81eb8963-548f-4e94-83bd-266a19c09aab","source":"wordfence","cve":"CVE-2024-8499","title":"Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81eb8963-548f-4e94-83bd-266a19c09aab?source=api-prod","affected":[{"type":"plugin","slug":"woo-checkout-field-editor-pro","name":"Checkout Field Editor (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T12:46:53Z"},{"id":"wordfence:81ebbfb5-8189-4ba0-80cd-380c897ab234","source":"wordfence","cve":"CVE-2025-64196","title":"Booster for WooCommerce <= 7.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ebbfb5-8189-4ba0-80cd-380c897ab234?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.2.5","to_inclusive":true,"patched_in":"7.2.6"}],"published":"2025-04-22T00:00:00Z","updated":"2025-11-11T18:23:51Z"},{"id":"wordfence:81ed1733-0073-464c-8ef7-28db228618e1","source":"wordfence","cve":"CVE-2022-34656","title":"Poll, Survey, Questionnaire and Voting system <= 1.7.4 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ed1733-0073-464c-8ef7-28db228618e1?source=api-prod","affected":[{"type":"plugin","slug":"polls-widget","name":"Poll, Survey, Questionnaire and Voting system","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81ef3b6a-b8f3-43ea-a68d-55ab1575bdbe","source":"wordfence","cve":"CVE-2026-87846","title":"Shipping for Nova Poshta 1.18.7 - 1.19.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81ef3b6a-b8f3-43ea-a68d-55ab1575bdbe?source=api-prod","affected":[{"type":"plugin","slug":"nova-poshta-ttn","name":"Shipping for Nova Poshta","from":"1.18.7","from_inclusive":true,"to":"1.19.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:17:57Z"},{"id":"wordfence:81f00661-1dfa-426f-b775-aaa4712d34bc","source":"wordfence","cve":"CVE-2025-24596","title":"WooCommerce Product Table Lite <= 3.8.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f00661-1dfa-426f-b775-aaa4712d34bc?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:47:43Z"},{"id":"wordfence:81f025da-c28c-4a80-8b4f-27dae07b2b04","source":"wordfence","cve":"CVE-2024-4389","title":"Slider & Popup Builder by Depicter \u2013 Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f025da-c28c-4a80-8b4f-27dae07b2b04?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-08-13T19:54:53Z","updated":"2024-08-14T08:29:45Z"},{"id":"wordfence:81f4f8e8-cac3-4865-a686-212f6c7f7b65","source":"wordfence","cve":"","title":"CAPTCHA in Thai <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f4f8e8-cac3-4865-a686-212f6c7f7b65?source=api-prod","affected":[{"type":"plugin","slug":"captcha-in-thai","name":"CAPTCHA in Thai","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81f61ef0-b3c7-4c69-bd18-5e5f0ea09abc","source":"wordfence","cve":"CVE-2026-12157","title":"BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f61ef0-b3c7-4c69-bd18-5e5f0ea09abc?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-06-18T15:43:58Z","updated":"2026-06-19T04:31:33Z"},{"id":"wordfence:81f835ae-322f-417e-8d0f-05b3d75fcb80","source":"wordfence","cve":"CVE-2026-19453","title":"JetBackup \u2013 Backup, Restore & Migrate 3.1.7.9 - 3.1.23.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f835ae-322f-417e-8d0f-05b3d75fcb80?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"3.1.7.9","from_inclusive":true,"to":"3.1.23.3","to_inclusive":true,"patched_in":"3.1.23.5"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:30:30Z"},{"id":"wordfence:81f993ec-9a7f-4e55-bc88-ea832ce49773","source":"wordfence","cve":"CVE-2020-11509","title":"WP Lead Plus X <= 0.98 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f993ec-9a7f-4e55-bc88-ea832ce49773?source=api-prod","affected":[{"type":"plugin","slug":"free-sales-funnel-squeeze-pages-landing-page-builder-templates-make","name":"WordPress Landing Page \u2013 Squeeze Page \u2013 Responsive Landing Page Builder Free \u2013 WP Lead Plus X","from":"*","from_inclusive":true,"to":"0.98","to_inclusive":true,"patched_in":"0.99"}],"published":"2020-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81f9a4c6-971f-4f6d-8bb1-e97bf75cf8d3","source":"wordfence","cve":"CVE-2023-4500","title":"Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81f9a4c6-971f-4f6d-8bb1-e97bf75cf8d3?source=api-prod","affected":[{"type":"plugin","slug":"order-tracking","name":"Order Tracking \u2013 WordPress Status Tracking Plugin","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81fa4987-d019-4d0c-a002-eceef956161e","source":"wordfence","cve":"CVE-2023-0278","title":"GeoDirectory <= 2.2.23 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81fa4987-d019-4d0c-a002-eceef956161e?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81fb9d43-3c27-4de9-aa2e-66b783c78fa2","source":"wordfence","cve":"CVE-2025-31912","title":"Enzio - Responsive Business WordPress Theme < 1.2.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81fb9d43-3c27-4de9-aa2e-66b783c78fa2?source=api-prod","affected":[{"type":"theme","slug":"enzio","name":"Enzio - Responsive Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2025-05-21T00:00:00Z","updated":"2026-03-06T15:03:28Z"},{"id":"wordfence:81fc41a4-9206-404c-bd5b-821c77ff3593","source":"wordfence","cve":"CVE-2023-0688","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81fc41a4-9206-404c-bd5b-821c77ff3593?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:81fd3ac1-91af-4cfa-ac4e-712beb4236c0","source":"wordfence","cve":"CVE-2023-5558","title":"LearnPress <= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81fd3ac1-91af-4cfa-ac4e-712beb4236c0?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.5.4","to_inclusive":false,"patched_in":"4.2.5.4"}],"published":"2023-11-07T00:00:00Z","updated":"2024-02-06T17:59:28Z"},{"id":"wordfence:81fd6ec4-9cff-4604-8b7f-5b8683096c34","source":"wordfence","cve":"CVE-2024-32106","title":"WP Compress \u2013 Image Optimizer [All-In-One] <= 6.10.35 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/81fd6ec4-9cff-4604-8b7f-5b8683096c34?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.10.35","to_inclusive":true,"patched_in":"6.11.01"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T15:39:25Z"},{"id":"wordfence:82002a9d-68a5-43fe-b46d-da4bf35b4e81","source":"wordfence","cve":"CVE-2026-25314","title":"TOP Table Of Contents <= 1.3.31 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82002a9d-68a5-43fe-b46d-da4bf35b4e81?source=api-prod","affected":[{"type":"plugin","slug":"top-table-of-contents","name":"TOP Table Of Contents","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-01-25T00:00:00Z","updated":"2026-05-04T15:19:48Z"},{"id":"wordfence:82016921-4efb-47b4-9a75-45cae4ad80f9","source":"wordfence","cve":"CVE-2024-12416","title":"Woomotiv <= 3.6.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82016921-4efb-47b4-9a75-45cae4ad80f9?source=api-prod","affected":[{"type":"plugin","slug":"woomotiv","name":"Live Sales Notification for Woocommerce \u2013 Woomotiv","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-01-06T15:09:22Z","updated":"2025-03-13T20:03:11Z"},{"id":"wordfence:8202e9e7-b05b-4603-9ebd-8084bf17a230","source":"wordfence","cve":"CVE-2020-12675","title":"MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8202e9e7-b05b-4603-9ebd-8084bf17a230?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.54.5","to_inclusive":true,"patched_in":"2.54.6"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82061b1f-a717-4007-978c-a3875669556f","source":"wordfence","cve":"CVE-2026-3619","title":"Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82061b1f-a717-4007-978c-a3875669556f?source=api-prod","affected":[{"type":"plugin","slug":"sheets2table","name":"Sheets2Table","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:57Z","updated":"2026-03-21T03:26:53Z"},{"id":"wordfence:82069cd8-e799-4682-80cf-997f1de36617","source":"wordfence","cve":"CVE-2026-103355","title":"Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82069cd8-e799-4682-80cf-997f1de36617?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-02T07:34:04Z","updated":"2026-10-08T23:20:41Z"},{"id":"wordfence:8206d00c-7eb1-4ef2-b3d3-be78d39036db","source":"wordfence","cve":"CVE-2022-37344","title":"Accommodation System <= 1.0.1 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8206d00c-7eb1-4ef2-b3d3-be78d39036db?source=api-prod","affected":[{"type":"plugin","slug":"accommodation-system","name":"Accommodation System","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8206ed66-8a90-4104-af49-d18c9a751deb","source":"wordfence","cve":"CVE-2026-28057","title":"Mandala <= 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8206ed66-8a90-4104-af49-d18c9a751deb?source=api-prod","affected":[{"type":"theme","slug":"mandala","name":"Mandala - Responsive Ecommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:18:48Z"},{"id":"wordfence:8207ae15-b6ae-4b58-8877-1f87c12dbe7c","source":"wordfence","cve":"CVE-2024-9619","title":"WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8207ae15-b6ae-4b58-8877-1f87c12dbe7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-shapes","name":"WP SHAPES","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:06:18Z","updated":"2024-12-20T06:59:07Z"},{"id":"wordfence:8209761c-2cfe-49b9-ab4c-49a9a13b5dcf","source":"wordfence","cve":"CVE-2024-12637","title":"Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8209761c-2cfe-49b9-ab4c-49a9a13b5dcf?source=api-prod","affected":[{"type":"plugin","slug":"moving-users","name":"Moving Users","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":"1.10"}],"published":"2025-01-16T18:23:12Z","updated":"2025-01-17T19:00:51Z"},{"id":"wordfence:820b289c-f907-42b1-8b22-52d614398fba","source":"wordfence","cve":"CVE-2024-9201","title":"SEUR Oficial <= 2.2.10.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/820b289c-f907-42b1-8b22-52d614398fba?source=api-prod","affected":[{"type":"plugin","slug":"seur","name":"SEUR Oficial","from":"*","from_inclusive":true,"to":"2.2.10.2","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-18T13:30:37Z"},{"id":"wordfence:820e81e1-6156-443c-bd6a-fc9922daf26a","source":"wordfence","cve":"CVE-2026-106095","title":"Code Snippets <= 3.9.0 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/820e81e1-6156-443c-bd6a-fc9922daf26a?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T13:56:54Z"},{"id":"wordfence:82137302-60ca-44d5-b087-dc96e2815fca","source":"wordfence","cve":"CVE-2023-4293","title":"Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82137302-60ca-44d5-b087-dc96e2815fca?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:821462d6-970e-4e3e-b91d-e7153296ba9f","source":"wordfence","cve":"CVE-2023-6636","title":"Greenshift \u2013 animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/821462d6-970e-4e3e-b91d-e7153296ba9f?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2023-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82173c1b-dce8-4713-87c7-2c54ba8cc02c","source":"wordfence","cve":"CVE-2022-0232","title":"User Registration, Login & Landing Pages  <= 1.2.7 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82173c1b-dce8-4713-87c7-2c54ba8cc02c?source=api-prod","affected":[{"type":"plugin","slug":"custom-landing-pages-leadmagic","name":"User Registration, Login & Landing Pages \u2013 LeadMagic","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:821b8ed1-10be-4798-826a-aaaef4888950","source":"wordfence","cve":"CVE-2021-39335","title":"WpGenius Job Listing <= 1.0.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/821b8ed1-10be-4798-826a-aaaef4888950?source=api-prod","affected":[{"type":"plugin","slug":"wpgenious-job-listing","name":"WpGenius Job Listing","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2021-10-14T13:46:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:821e763a-fe84-4471-99d0-515e036122c0","source":"wordfence","cve":"CVE-2024-43273","title":"Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin <= 1.3.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/821e763a-fe84-4471-99d0-515e036122c0?source=api-prod","affected":[{"type":"plugin","slug":"icegram-rainmaker","name":"Icegram Collect \u2013 Easy Contact Form, Subscription Form & Lead Collection Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:33:56Z"},{"id":"wordfence:821f4ea9-bc25-4d65-9058-5b77c4f1b230","source":"wordfence","cve":"CVE-2026-0691","title":"CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/821f4ea9-bc25-4d65-9058-5b77c4f1b230?source=api-prod","affected":[{"type":"plugin","slug":"cm-email-blacklist","name":"CM E-Mail Blacklist \u2013 Simple email filtering for safer registration","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-17T06:42:20Z"},{"id":"wordfence:82201a3e-6b0b-4565-932d-9193cf371fa6","source":"wordfence","cve":"CVE-2026-123091","title":"Vigilant <= 2.10.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82201a3e-6b0b-4565-932d-9193cf371fa6?source=api-prod","affected":[{"type":"plugin","slug":"vigilante","name":"Vigilant \u2013 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner\u2026","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:17:40Z"},{"id":"wordfence:8222e290-1602-4f3d-b041-b3d24502dfee","source":"wordfence","cve":"CVE-2023-2334","title":"Easy Digital Downloads Google Sheet Connector <= 1.6.6 - Cross-Site Request Forgery to Access Code Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8222e290-1602-4f3d-b041-b3d24502dfee?source=api-prod","affected":[{"type":"plugin","slug":"edd-google-sheet-connector-pro","name":"Edd Google Sheet Connector Pro","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"},{"type":"plugin","slug":"gsheetconnector-easy-digital-downloads","name":"GSheetConnector for Easy Digital Downloads","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-03T22:18:29Z"},{"id":"wordfence:822349d3-e712-48f5-949f-a0c720175788","source":"wordfence","cve":"CVE-2025-24698","title":"Essential Real Estate <= 5.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822349d3-e712-48f5-949f-a0c720175788?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:03:33Z"},{"id":"wordfence:8223f9dd-1c2d-40bd-a17d-1bb317829d3b","source":"wordfence","cve":"","title":"Sell Photo <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8223f9dd-1c2d-40bd-a17d-1bb317829d3b?source=api-prod","affected":[{"type":"plugin","slug":"sell-photo","name":"Sell Photo","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2020-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82246b72-3c29-4574-af86-d0435eecce5d","source":"wordfence","cve":"CVE-2014-5185","title":"Quartz <= 1.01.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82246b72-3c29-4574-af86-d0435eecce5d?source=api-prod","affected":[{"type":"plugin","slug":"quartz","name":"quartz","from":"*","from_inclusive":true,"to":"1.01.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8224b9ae-799b-4675-b9ae-f6132f86c429","source":"wordfence","cve":"CVE-2025-4578","title":"File Provider <= 1.2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8224b9ae-799b-4675-b9ae-f6132f86c429?source=api-prod","affected":[{"type":"plugin","slug":"file-provider","name":"File Provider","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T00:00:00Z","updated":"2025-06-06T14:04:03Z"},{"id":"wordfence:82253cd8-e9ff-4f3d-8844-c270dae445a4","source":"wordfence","cve":"CVE-2022-4699","title":"MediaElement.js \u2013 HTML5 Video & Audio Player <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82253cd8-e9ff-4f3d-8844-c270dae445a4?source=api-prod","affected":[{"type":"plugin","slug":"media-element-html5-video-and-audio-player","name":"MediaElement.js \u2013 HTML5 Video & Audio Player","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":""}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82259b54-0313-41a2-ace4-41e583b93e8a","source":"wordfence","cve":"CVE-2019-15116","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 2.9.15 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82259b54-0313-41a2-ace4-41e583b93e8a?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.9.16","to_inclusive":false,"patched_in":"2.9.16"}],"published":"2019-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82268ef9-6468-43a5-8578-86c8aec51f2c","source":"wordfence","cve":"CVE-2026-23977","title":"Helpdesk Support Ticket System for WooCommerce <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82268ef9-6468-43a5-8578-86c8aec51f2c?source=api-prod","affected":[{"type":"plugin","slug":"support-ticket-system-for-woocommerce","name":"Helpdesk Support Ticket System for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T14:58:40Z"},{"id":"wordfence:82299c65-2d27-472f-85c8-9e8b3d8ff02b","source":"wordfence","cve":"CVE-2026-65451","title":"MapSVG <= 8.14.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82299c65-2d27-472f-85c8-9e8b3d8ff02b?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-30T12:37:28Z"},{"id":"wordfence:822a3b3b-db39-4edc-ae68-80fb82359316","source":"wordfence","cve":"","title":"WordPress RSS Feed Retriever <= 1.6.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822a3b3b-db39-4edc-ae68-80fb82359316?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-retriever","name":"RSS Feed Retriever","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:822b5a6b-0be6-4511-bf5d-c32574f27865","source":"wordfence","cve":"CVE-2020-7916","title":"LearnPress <= 3.2.6.6 - Privilege Escalation","severity":"high","cvss":7.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822b5a6b-0be6-4511-bf5d-c32574f27865?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.6.6","to_inclusive":true,"patched_in":"3.2.6.8"}],"published":"2020-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:822c0a33-e57e-48c7-b8df-fddf3bb2e552","source":"wordfence","cve":"CVE-2024-9347","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822c0a33-e57e-48c7-b8df-fddf3bb2e552?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"},{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"2.0.12","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"3.0.10"},{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"3.0.11","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2024-10-16T00:00:00Z","updated":"2025-01-31T15:32:34Z"},{"id":"wordfence:822d9f69-3422-431f-a838-a7bca508d156","source":"wordfence","cve":"CVE-2024-6860","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Permalink Suffix Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822d9f69-3422-431f-a838-a7bca508d156?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-04-22T20:19:56Z"},{"id":"wordfence:822f5b92-8c58-4132-80a7-d15e1215c934","source":"wordfence","cve":"CVE-2013-2697","title":"WP-DownloadManager Plugin < 1.61 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/822f5b92-8c58-4132-80a7-d15e1215c934?source=api-prod","affected":[{"type":"plugin","slug":"wp-download-manager","name":"wp-download-manager","from":"*","from_inclusive":true,"to":"1.61","to_inclusive":false,"patched_in":"1.61"}],"published":"2013-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8230d5f8-01d9-465a-8a43-e9852248bb3d","source":"wordfence","cve":"CVE-2026-1065","title":"Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8230d5f8-01d9-465a-8a43-e9852248bb3d?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.35","to_inclusive":true,"patched_in":"1.15.36"}],"published":"2026-02-02T18:12:37Z","updated":"2026-02-03T06:38:05Z"},{"id":"wordfence:8232ff9e-e8de-4bd1-9a73-2383a4a25b80","source":"wordfence","cve":"CVE-2024-32785","title":"The Pack Elementor addons (Header Footer & WooCommerce Builder,  Template Library) <= 2.0.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8232ff9e-e8de-4bd1-9a73-2383a4a25b80?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.0.8.3","to_inclusive":true,"patched_in":"2.0.8.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:18:36Z"},{"id":"wordfence:823418d9-a231-4306-8575-2937a491509f","source":"wordfence","cve":"CVE-2024-2293","title":"Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823418d9-a231-4306-8575-2937a491509f?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.11.4","to_inclusive":true,"patched_in":"6.11.7"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:27:00Z"},{"id":"wordfence:823632aa-446f-4365-b44b-74b6375cffc6","source":"wordfence","cve":"CVE-2026-12082","title":"Praison AI SEO <= 5.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823632aa-446f-4365-b44b-74b6375cffc6?source=api-prod","affected":[{"type":"plugin","slug":"seo-wordpress","name":"Praison AI SEO","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-29T22:21:57Z"},{"id":"wordfence:823677be-c12b-4c75-ae42-7238f7a32a82","source":"wordfence","cve":"CVE-2025-23739","title":"WP Ultimate Reviews FREE <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823677be-c12b-4c75-ae42-7238f7a32a82?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-reviews-free","name":"WP Ultimate Reviews FREE","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:34:51Z"},{"id":"wordfence:823d7145-2347-4a07-b756-2dfc7878456e","source":"wordfence","cve":"CVE-2025-30942","title":"Post Custom Templates Lite <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823d7145-2347-4a07-b756-2dfc7878456e?source=api-prod","affected":[{"type":"plugin","slug":"post-custom-templates-lite","name":"Post Custom Templates Lite","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:09:43Z"},{"id":"wordfence:823dc422-12f4-4f7d-a305-2e4db18bafdf","source":"wordfence","cve":"CVE-2023-32293","title":"WRC Pricing Tables <= 2.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823dc422-12f4-4f7d-a305-2e4db18bafdf?source=api-prod","affected":[{"type":"plugin","slug":"wrc-pricing-tables","name":"WRC Pricing Tables \u2013 Responsive CSS3 Pricing Tables","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:823dce74-2688-4573-b0c8-353f1789ea48","source":"wordfence","cve":"CVE-2023-30476","title":"Blogger Buzz <= 1.2.4 - Missing Authorization via activate_plugin","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823dce74-2688-4573-b0c8-353f1789ea48?source=api-prod","affected":[{"type":"theme","slug":"blogger-buzz","name":"Blogger Buzz","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-13T00:00:00Z","updated":"2024-03-25T16:22:42Z"},{"id":"wordfence:823fee99-5c91-456d-9a09-f942f42aa8fa","source":"wordfence","cve":"CVE-2023-45649","title":"Appointment Hour Booking <= 1.4.23 - Missing Authorization to Double Booking","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/823fee99-5c91-456d-9a09-f942f42aa8fa?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.23","to_inclusive":true,"patched_in":"1.4.24"}],"published":"2023-10-11T00:00:00Z","updated":"2024-08-16T18:35:38Z"},{"id":"wordfence:82420667-9ba6-46ed-9a53-d16850755bb9","source":"wordfence","cve":"","title":"TI WooCommerce Wishlist <= 2.7.3 - Unauthenticated Blind SQL Injection via Rest API","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82420667-9ba6-46ed-9a53-d16850755bb9?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":false,"patched_in":"2.7.4"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8242b23f-bc2b-4d10-b323-641602539d4e","source":"wordfence","cve":"CVE-2026-28167","title":"Super Forms \u2013 Drag & Drop Form Builder <= 6.3.316 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8242b23f-bc2b-4d10-b323-641602539d4e?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-08-24T07:47:53Z","updated":"2026-10-22T19:15:49Z"},{"id":"wordfence:8242e0f0-b9c5-46fe-b691-3275cd0f9a43","source":"wordfence","cve":"CVE-2024-5053","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 -  Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification","severity":"medium","cvss":4.2,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8242e0f0-b9c5-46fe-b691-3275cd0f9a43?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.18","to_inclusive":true,"patched_in":"5.1.19"}],"published":"2024-08-31T21:37:21Z","updated":"2024-09-01T10:58:06Z"},{"id":"wordfence:824360ab-c797-465a-8480-baeae941af29","source":"wordfence","cve":"CVE-2023-45050","title":"Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/824360ab-c797-465a-8480-baeae941af29?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"12.8-a.1","to_inclusive":true,"patched_in":"12.8-a.3"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8243b65b-8340-404d-90cb-5706fb239dc2","source":"wordfence","cve":"CVE-2026-74992","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer < 6.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8243b65b-8340-404d-90cb-5706fb239dc2?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":false,"patched_in":"6.2.3"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:11:48Z"},{"id":"wordfence:8246ea9f-3ccb-4448-bf32-135c8140b09b","source":"wordfence","cve":"CVE-2023-25965","title":"Upload Resume <= 1.2.0 - Authenticated Sensitive Information Disclosure via resume_upload_form_list shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8246ea9f-3ccb-4448-bf32-135c8140b09b?source=api-prod","affected":[{"type":"plugin","slug":"resume-upload-form","name":"Upload Resume","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8247a05c-0a23-4f0c-8578-d679df773401","source":"wordfence","cve":"CVE-2024-52352","title":"Postcasa Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8247a05c-0a23-4f0c-8578-d679df773401?source=api-prod","affected":[{"type":"plugin","slug":"postcasa","name":"Postcasa Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:54:41Z"},{"id":"wordfence:8247acc4-04dc-463a-906a-f6085116cf40","source":"wordfence","cve":"","title":"Zingiri Web Shop <= 2.2.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8247acc4-04dc-463a-906a-f6085116cf40?source=api-prod","affected":[{"type":"plugin","slug":"g-web-shop","name":"Zingiri Web Shop","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2011-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8247c654-0082-4677-a0a6-b90a0256de81","source":"wordfence","cve":"","title":"Smash Balloon Social Photo Feed <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8247c654-0082-4677-a0a6-b90a0256de81?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2018-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:824a1305-7cdd-4b08-a59b-1af32116c4e8","source":"wordfence","cve":"CVE-2019-25727","title":"10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/824a1305-7cdd-4b08-a59b-1af32116c4e8?source=api-prod","affected":[{"type":"plugin","slug":"ad-manager-wd","name":"10WebAdManager","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-18T13:37:49Z"},{"id":"wordfence:824b27e8-1f07-4cd0-9335-5860d1b58562","source":"wordfence","cve":"CVE-2015-9441","title":"Bookmarkify <= 1.1.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/824b27e8-1f07-4cd0-9335-5860d1b58562?source=api-prod","affected":[{"type":"plugin","slug":"bookmarkify","name":"bookmarkify","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2015-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:824c5a51-68cc-4d03-87b5-2cb90763334e","source":"wordfence","cve":"CVE-2025-13307","title":"Ocean Modal Window <= 2.3.2 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/824c5a51-68cc-4d03-87b5-2cb90763334e?source=api-prod","affected":[{"type":"plugin","slug":"ocean-modal-window","name":"Ocean Modal Window","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-20T21:32:58Z"},{"id":"wordfence:824ec2ba-b701-46e9-b237-53cd7d0e46da","source":"wordfence","cve":"CVE-2024-5941","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/824ec2ba-b701-46e9-b237-53cd7d0e46da?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-20T02:03:14Z"},{"id":"wordfence:8250434a-2fad-4f44-9813-90e734d32d2e","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'LoadTab' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8250434a-2fad-4f44-9813-90e734d32d2e?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8250c277-200a-4808-98ae-ede169aad3fd","source":"wordfence","cve":"CVE-2023-4930","title":"Front End PM < 11.4.3  - Sensitive Information Exposure via Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8250c277-200a-4808-98ae-ede169aad3fd?source=api-prod","affected":[{"type":"plugin","slug":"front-end-pm","name":"Front End PM","from":"*","from_inclusive":true,"to":"11.4.3","to_inclusive":false,"patched_in":"11.4.3"}],"published":"2023-11-07T00:00:00Z","updated":"2026-09-04T00:26:59Z"},{"id":"wordfence:82540d34-c42b-451c-a837-54e26e09c596","source":"wordfence","cve":"CVE-2025-69115","title":"LuxMed | Medicine & Healthcare Doctor WordPress <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82540d34-c42b-451c-a837-54e26e09c596?source=api-prod","affected":[{"type":"theme","slug":"luxmed","name":"LuxMed | Medicine & Healthcare Doctor WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:38:24Z"},{"id":"wordfence:8254f4ab-b7a4-4823-8bf9-0673cea1248e","source":"wordfence","cve":"CVE-2022-1551","title":"SP Project & Document Manager <= 4.57 - Sensitive File Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8254f4ab-b7a4-4823-8bf9-0673cea1248e?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.57","to_inclusive":true,"patched_in":"4.58"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8256b8e4-f8c5-4feb-b6e4-668ed3b6fccd","source":"wordfence","cve":"CVE-2024-5938","title":"Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8256b8e4-f8c5-4feb-b6e4-668ed3b6fccd?source=api-prod","affected":[{"type":"theme","slug":"boot-store","name":"Boot Store","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-07-01T13:24:26Z","updated":"2024-07-02T02:02:11Z"},{"id":"wordfence:82583e18-2e0b-4618-bc0c-d8b058acc1c8","source":"wordfence","cve":"CVE-2025-26581","title":"Picture Gallery <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82583e18-2e0b-4618-bc0c-d8b058acc1c8?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-03-12T00:00:00Z","updated":"2026-02-26T15:19:50Z"},{"id":"wordfence:8259508b-186d-4f2f-ac37-72e3b259ea5e","source":"wordfence","cve":"CVE-2024-54413","title":"Display Future Posts <= 0.2.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8259508b-186d-4f2f-ac37-72e3b259ea5e?source=api-prod","affected":[{"type":"plugin","slug":"display-future-posts","name":"Display Future Posts","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:38:02Z"},{"id":"wordfence:825af974-dccd-4409-8f22-fa70240b0c66","source":"wordfence","cve":"CVE-2024-33645","title":"Easy Set Favicon <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/825af974-dccd-4409-8f22-fa70240b0c66?source=api-prod","affected":[{"type":"plugin","slug":"easy-set-favicon","name":"Easy Set Favicon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:41:54Z"},{"id":"wordfence:825d9154-7385-4652-b258-cf813be9bcdb","source":"wordfence","cve":"CVE-2018-0603","title":"Site Reviews <= 2.15.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/825d9154-7385-4652-b258-cf813be9bcdb?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"2.15.3","to_inclusive":false,"patched_in":"2.15.3"}],"published":"2018-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8260a74a-e338-42f6-ad9d-cb30f1a9bc86","source":"wordfence","cve":"CVE-2022-2186","title":"Simple Post Notes <= 1.7.5 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8260a74a-e338-42f6-ad9d-cb30f1a9bc86?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-notes","name":"Simple Post Notes","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82619274-4339-44ba-b50c-d1194c34b695","source":"wordfence","cve":"","title":"IgnitionDeck Crowdfunding Platform <= 1.1.6 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82619274-4339-44ba-b50c-d1194c34b695?source=api-prod","affected":[{"type":"plugin","slug":"ignitiondeck","name":"IgnitionDeck Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2015-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82644c46-205b-4005-bba8-6b3e45769639","source":"wordfence","cve":"CVE-2024-1237","title":"Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82644c46-205b-4005-bba8-6b3e45769639?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.24","to_inclusive":true,"patched_in":"1.6.25"}],"published":"2024-03-11T00:00:00Z","updated":"2024-05-31T15:30:28Z"},{"id":"wordfence:826483d7-948d-46c4-890c-71001b03847c","source":"wordfence","cve":"CVE-2024-3724","title":"Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826483d7-948d-46c4-890c-71001b03847c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:52:18Z"},{"id":"wordfence:82699a17-ea45-4493-98c4-07f62ca0b1f9","source":"wordfence","cve":"CVE-2025-12879","title":"User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82699a17-ea45-4493-98c4-07f62ca0b1f9?source=api-prod","affected":[{"type":"plugin","slug":"user-importer-and-generator","name":"User Generator and Importer","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T20:38:15Z","updated":"2025-12-05T09:27:02Z"},{"id":"wordfence:8269f83b-5d7d-4f01-85ee-fd7262fed5b1","source":"wordfence","cve":"CVE-2024-22296","title":"12 Step Meeting List <= 3.14.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8269f83b-5d7d-4f01-85ee-fd7262fed5b1?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.14.28","to_inclusive":true,"patched_in":"3.14.29"}],"published":"2024-01-17T00:00:00Z","updated":"2024-02-08T12:48:17Z"},{"id":"wordfence:826a2003-c526-4760-8c21-10d5ae7bb384","source":"wordfence","cve":"CVE-2026-6127","title":"Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826a2003-c526-4760-8c21-10d5ae7bb384?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-04-30T00:00:00Z","updated":"2026-05-01T05:29:54Z"},{"id":"wordfence:826a3fa2-ee41-4960-becb-0df8813a964a","source":"wordfence","cve":"CVE-2023-25969","title":"Multiple Plugins By ThemeHunk (Various Versions) - Missing Authorization via settings_init","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826a3fa2-ee41-4960-becb-0df8813a964a?source=api-prod","affected":[{"type":"plugin","slug":"th-product-compare","name":"ThemeHunk Product Compare for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"},{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:826b3913-9a37-4e15-80fd-b35cefb51af8","source":"wordfence","cve":"CVE-2023-1509","title":"GMAce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826b3913-9a37-4e15-80fd-b35cefb51af8?source=api-prod","affected":[{"type":"plugin","slug":"gmace","name":"GMAce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:826b5dac-4a54-44c7-979b-8901bb468777","source":"wordfence","cve":"CVE-2023-22707","title":"Greenshift \u2013 animation and page builder blocks <= 4.9.9 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826b5dac-4a54-44c7-979b-8901bb468777?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:826e7e0a-79b1-4828-8eeb-159ef3cc2c65","source":"wordfence","cve":"CVE-2023-47850","title":"Community by PeepSo <= 6.2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826e7e0a-79b1-4828-8eeb-159ef3cc2c65?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.2.2.0","to_inclusive":true,"patched_in":"6.2.3.0"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:826f75dd-ff37-459a-8a28-c70e403b720a","source":"wordfence","cve":"CVE-2022-2426","title":"Thinkific Uploader <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826f75dd-ff37-459a-8a28-c70e403b720a?source=api-prod","affected":[{"type":"plugin","slug":"thinkific-uploader","name":"Thinkific Uploader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:826fe5a8-3290-4f70-b9bb-8bd4aec3634c","source":"wordfence","cve":"CVE-2023-32744","title":"WooCommerce Product Recommendations < 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/826fe5a8-3290-4f70-b9bb-8bd4aec3634c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-recommendations","name":"Product Recommendations","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:827220d0-edb7-4a41-9b00-a289073c6aad","source":"wordfence","cve":"CVE-2025-69392","title":"iMoney <= 0.36 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/827220d0-edb7-4a41-9b00-a289073c6aad?source=api-prod","affected":[{"type":"plugin","slug":"imoney","name":"iMoney","from":"*","from_inclusive":true,"to":"0.36","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:46:10Z"},{"id":"wordfence:8276ecfe-962b-4813-8011-4c8ca59d5389","source":"wordfence","cve":"CVE-2024-52377","title":"Instant Image Generator <= 1.5.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8276ecfe-962b-4813-8011-4c8ca59d5389?source=api-prod","affected":[{"type":"plugin","slug":"ai-image","name":"Instant AI Image Generator \u2013 Create & Import Images","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-25T19:48:58Z"},{"id":"wordfence:8278dd45-d450-4322-9a74-4494596ed737","source":"wordfence","cve":"CVE-2026-41558","title":"WP Synchro \u2013 The Ultimate WordPress Migration Tool <= 1.16.1 - 2-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8278dd45-d450-4322-9a74-4494596ed737?source=api-prod","affected":[{"type":"plugin","slug":"wpsynchro","name":"WP Synchro \u2013 The Ultimate WordPress Migration Tool","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-05T00:00:00Z","updated":"2026-11-03T22:46:36Z"},{"id":"wordfence:8278debf-074f-40ba-ae35-db278a73880e","source":"wordfence","cve":"CVE-2025-23832","title":"Admin Cleanup <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8278debf-074f-40ba-ae35-db278a73880e?source=api-prod","affected":[{"type":"plugin","slug":"admin-cleanup","name":"Admin Cleanup","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:36:04Z"},{"id":"wordfence:8278f5bf-2f40-4f3d-b38d-0ecea9d47f83","source":"wordfence","cve":"CVE-2024-30544","title":"Whizzy <= 1.1.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8278f5bf-2f40-4f3d-b38d-0ecea9d47f83?source=api-prod","affected":[{"type":"plugin","slug":"whizzy","name":"Whizzy","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T16:41:38Z"},{"id":"wordfence:827b5482-cb42-4aaa-80b5-3d0143fcead8","source":"wordfence","cve":"CVE-2024-13442","title":"Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/827b5482-cb42-4aaa-80b5-3d0143fcead8?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T11:10:40Z"},{"id":"wordfence:827c0459-1328-4fb1-b044-ae80298fa5ea","source":"wordfence","cve":"CVE-2024-12516","title":"Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/827c0459-1328-4fb1-b044-ae80298fa5ea?source=api-prod","affected":[{"type":"plugin","slug":"coupon-lite","name":"Coupon Plugin Lite","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T07:22:35Z"},{"id":"wordfence:827c5dc2-3195-47d9-9e44-ca2043748eed","source":"wordfence","cve":"CVE-2024-5804","title":"Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/827c5dc2-3195-47d9-9e44-ca2043748eed?source=api-prod","affected":[{"type":"plugin","slug":"cf7-conditional-fields","name":"Conditional Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.14"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T02:02:17Z"},{"id":"wordfence:827f1e30-a1a2-4ad7-a726-d183fa9fd4da","source":"wordfence","cve":"CVE-2026-94500","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/827f1e30-a1a2-4ad7-a726-d183fa9fd4da?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-09-23T14:08:00Z","updated":"2026-09-29T20:06:22Z"},{"id":"wordfence:82802e80-efb5-4aa3-9fea-9c21bfb71efa","source":"wordfence","cve":"","title":"Real3D Flipbook <= 2.8 - Unauthenticated Arbitrary File or Directory Delete","severity":"critical","cvss":10.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82802e80-efb5-4aa3-9fea-9c21bfb71efa?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2016-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:828050ce-4775-4256-8dcf-2cdb96d5ec4e","source":"wordfence","cve":"CVE-2026-94505","title":"Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/828050ce-4775-4256-8dcf-2cdb96d5ec4e?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-10-02T18:35:30Z","updated":"2026-10-03T06:38:24Z"},{"id":"wordfence:8281cb20-73d3-4ab5-910e-d353b2a5cbd8","source":"wordfence","cve":"CVE-2023-1471","title":"WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8281cb20-73d3-4ab5-910e-d353b2a5cbd8?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-banners","name":"WP Popup Banners","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8283a502-6fb8-43ff-8f46-8afbfdbb22f7","source":"wordfence","cve":"CVE-2023-5980","title":"BSK Forms Blacklist <= 3.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8283a502-6fb8-43ff-8f46-8afbfdbb22f7?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravityforms-blacklist","name":"BSK Forms Blacklist","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82862fc6-a542-4329-b9fd-e69f18288ac4","source":"wordfence","cve":"CVE-2025-49862","title":"Ebook Store <= 5.8008 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82862fc6-a542-4329-b9fd-e69f18288ac4?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8008","to_inclusive":true,"patched_in":"5.8009"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:00:39Z"},{"id":"wordfence:82892be3-91d5-4350-96b0-dc68a67b4637","source":"wordfence","cve":"CVE-2025-2540","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82892be3-91d5-4350-96b0-dc68a67b4637?source=api-prod","affected":[{"type":"plugin","slug":"awesome-wp-image-gallery","name":"Awesome Wp Image Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"},{"type":"plugin","slug":"awesome-gallery","name":"Awesome Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-image-gallery","name":"Easy Image Gallery","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"},{"type":"plugin","slug":"woo-3d-viewer","name":"Easy 3D Viewer","from":"*","from_inclusive":true,"to":"1.8.6.6","to_inclusive":true,"patched_in":"1.8.6.7"}],"published":"2025-07-02T23:16:46Z","updated":"2025-12-09T19:15:47Z"},{"id":"wordfence:828b3644-5ff8-4f9a-9592-b0bae40cbaa6","source":"wordfence","cve":"CVE-2026-78294","title":"Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/828b3644-5ff8-4f9a-9592-b0bae40cbaa6?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.21","to_inclusive":true,"patched_in":"1.13.22"}],"published":"2026-09-16T18:12:00Z","updated":"2026-09-22T18:50:46Z"},{"id":"wordfence:8291fd89-aea1-4f7b-abd8-dee8438c3ed5","source":"wordfence","cve":"CVE-2023-6203","title":"The Events Calendar <= 6.2.8 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8291fd89-aea1-4f7b-abd8-dee8438c3ed5?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.2.8.1","to_inclusive":false,"patched_in":"6.2.8.1"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8292f23c-fb17-4082-9788-f643d1bb097e","source":"wordfence","cve":"CVE-2024-12008","title":"W3 Total Cache <= 2.8.1 Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8292f23c-fb17-4082-9788-f643d1bb097e?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-14T07:05:42Z"},{"id":"wordfence:82960f7a-db21-4e47-a375-473e0b843250","source":"wordfence","cve":"CVE-2025-47663","title":"Hospital Management System <= 47.0(20-11-2023) - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82960f7a-db21-4e47-a375-473e0b843250?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:06:41Z"},{"id":"wordfence:8298f1fb-3165-40e3-9192-805a07c14cae","source":"wordfence","cve":"CVE-2024-1108","title":"Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8298f1fb-3165-40e3-9192-805a07c14cae?source=api-prod","affected":[{"type":"plugin","slug":"plugin-groups","name":"Plugin Groups","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-21T03:11:16Z"},{"id":"wordfence:829a19fc-f262-4b67-b499-76580779eb9a","source":"wordfence","cve":"CVE-2024-38771","title":"Atarim <= 4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/829a19fc-f262-4b67-b499-76580779eb9a?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T13:56:00Z"},{"id":"wordfence:829facc1-443d-481f-b23f-7a93938dd866","source":"wordfence","cve":"CVE-2025-9367","title":"Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/829facc1-443d-481f-b23f-7a93938dd866?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.20","to_inclusive":true,"patched_in":"2.11.21"}],"published":"2025-09-09T18:30:04Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:82a26836-44fc-47cf-ad09-bd3d264e8635","source":"wordfence","cve":"","title":"Welcome Bar <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82a26836-44fc-47cf-ad09-bd3d264e8635?source=api-prod","affected":[{"type":"plugin","slug":"intelly-welcome-bar","name":"Welcome Bar","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82ace2e3-1120-4be9-a7c6-b64590c8a35f","source":"wordfence","cve":"CVE-2026-100151","title":"Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ace2e3-1120-4be9-a7c6-b64590c8a35f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-10-30T21:10:48Z","updated":"2026-10-31T09:29:26Z"},{"id":"wordfence:82acefe0-a839-4721-858d-120326e45664","source":"wordfence","cve":"CVE-2021-25010","title":"Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82acefe0-a839-4721-858d-120326e45664?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82aeab24-3467-4cb0-b71f-b7f97c26dc80","source":"wordfence","cve":"CVE-2026-3565","title":"Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82aeab24-3467-4cb0-b71f-b7f97c26dc80?source=api-prod","affected":[{"type":"plugin","slug":"taqnix","name":"Taqnix","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-04-23T19:16:41Z","updated":"2026-04-24T07:45:07Z"},{"id":"wordfence:82b020ea-fe42-4a97-b851-a335e73c9cd6","source":"wordfence","cve":"CVE-2026-22523","title":"Ultra WordPress Admin <= 11.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b020ea-fe42-4a97-b851-a335e73c9cd6?source=api-prod","affected":[{"type":"plugin","slug":"ultra-admin","name":"Ultra Admin","from":"*","from_inclusive":true,"to":"11.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:57:30Z"},{"id":"wordfence:82b182db-3f7b-4e8f-95ef-19800bb01a24","source":"wordfence","cve":"CVE-2025-22678","title":"my white <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b182db-3f7b-4e8f-95ef-19800bb01a24?source=api-prod","affected":[{"type":"theme","slug":"my-white","name":"my white","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:04:53Z"},{"id":"wordfence:82b243c7-5b58-4765-9083-4660c0b479cc","source":"wordfence","cve":"CVE-2025-14465","title":"Sticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b243c7-5b58-4765-9083-4660c0b479cc?source=api-prod","affected":[{"type":"plugin","slug":"sticky-action-buttons","name":"Sticky Action Buttons","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:32:42Z","updated":"2026-01-07T09:20:59Z"},{"id":"wordfence:82b4291c-5e31-4909-b743-778e68a0fe20","source":"wordfence","cve":"CVE-2024-6072","title":"WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b4291c-5e31-4909-b743-778e68a0fe20?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-06-24T00:00:00Z","updated":"2024-07-01T14:41:31Z"},{"id":"wordfence:82b45bd5-4e47-458c-bff8-ee15cd9a3c0e","source":"wordfence","cve":"CVE-2025-25134","title":"Theme Demo Bar <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b45bd5-4e47-458c-bff8-ee15cd9a3c0e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-theme-demo-bar","name":"WordPress Theme Demo Bar","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:16:56Z"},{"id":"wordfence:82b46474-9a32-4d7e-8fa4-91f6465c5fa7","source":"wordfence","cve":"CVE-2015-4153","title":"ZM Ajax Login & Register <= 1.0.9 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b46474-9a32-4d7e-8fa4-91f6465c5fa7?source=api-prod","affected":[{"type":"plugin","slug":"zm-ajax-login-register","name":"ZM Ajax Login & Register","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82b48e39-4f8f-48b8-ba46-49e06bee2cc7","source":"wordfence","cve":"CVE-2021-24963","title":"LiteSpeed Cache <= 4.4.3 - Reflected Cross-Site Scripting via qc_res","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b48e39-4f8f-48b8-ba46-49e06bee2cc7?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"1.0.15","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2021-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82b59dd0-4101-4bfb-ad3b-ba5a44cebe2a","source":"wordfence","cve":"CVE-2025-12394","title":"Backup Migration <= 1.4.9 - Information Exposure to Unauthenticated Back-up Download","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b59dd0-4101-4bfb-ad3b-ba5a44cebe2a?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-01T17:11:53Z"},{"id":"wordfence:82b5ade8-582e-4440-b043-d30e757c9467","source":"wordfence","cve":"CVE-2025-14552","title":"MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b5ade8-582e-4440-b043-d30e757c9467?source=api-prod","affected":[{"type":"plugin","slug":"mediapress","name":"MediaPress","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-01-05T21:13:39Z","updated":"2026-01-06T09:20:59Z"},{"id":"wordfence:82b78826-b256-4612-a830-d44a9bc97541","source":"wordfence","cve":"","title":"Twigify <= 1.1.2 & AP Twig Bridge <= 1.0 & Content Template Engine <= 0.9.4  - Running Vulnerable Twig Package","severity":"high","cvss":7.3,"cwe":"CWE-1395","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b78826-b256-4612-a830-d44a9bc97541?source=api-prod","affected":[{"type":"plugin","slug":"twigify","name":"Twigify","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ap-twig-bridge","name":"AP Twig Bridge","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"content-template-engine","name":"Content Template Engine","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T00:00:00Z","updated":"2025-01-17T16:43:47Z"},{"id":"wordfence:82b87634-f740-4e4e-bc7e-f8bf7e657486","source":"wordfence","cve":"CVE-2025-60041","title":"Emails Catch <= 3.5.3 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82b87634-f740-4e4e-bc7e-f8bf7e657486?source=api-prod","affected":[{"type":"plugin","slug":"emails-catch-all","name":"Emails Catch All","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-23T14:49:21Z"},{"id":"wordfence:82bad228-f12a-45ca-a4a4-769f092f4dd8","source":"wordfence","cve":"CVE-2025-68608","title":"Userpro <= 5.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82bad228-f12a-45ca-a4a4-769f092f4dd8?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-06T14:48:23Z"},{"id":"wordfence:82bc9997-0521-4023-bdf9-fcf0baec2642","source":"wordfence","cve":"CVE-2026-24586","title":"Newses <= 2.0.0.77 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82bc9997-0521-4023-bdf9-fcf0baec2642?source=api-prod","affected":[{"type":"theme","slug":"newses","name":"Newses","from":"*","from_inclusive":true,"to":"2.0.0.77","to_inclusive":true,"patched_in":"2.0.0.78"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-08T16:14:18Z"},{"id":"wordfence:82bfdacf-86e1-4383-995e-e757fd389aab","source":"wordfence","cve":"CVE-2025-66068","title":"InstaWP Connect <= 0.1.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82bfdacf-86e1-4383-995e-e757fd389aab?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.1.9","to_inclusive":true,"patched_in":"0.1.2.0"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-19T16:59:33Z"},{"id":"wordfence:82c08769-2bb6-4c87-b198-f18216b3e744","source":"wordfence","cve":"CVE-2023-32102","title":"Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c08769-2bb6-4c87-b198-f18216b3e744?source=api-prod","affected":[{"type":"plugin","slug":"library-viewer","name":"Library Viewer","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.6.1"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82c3c97d-f9dd-4667-a1a8-94cf12947618","source":"wordfence","cve":"CVE-2021-24314","title":"Goto - Tour & Travel WordPress Theme < 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c3c97d-f9dd-4667-a1a8-94cf12947618?source=api-prod","affected":[{"type":"theme","slug":"goto","name":"Goto - Tour & Travel WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2021-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82c6ed2f-20e8-46d1-a460-16d32b7536cd","source":"wordfence","cve":"CVE-2023-2277","title":"WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c6ed2f-20e8-46d1-a460-16d32b7536cd?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82c788eb-373b-47be-abe6-f4cef3291b10","source":"wordfence","cve":"CVE-2025-68075","title":"BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c788eb-373b-47be-abe6-f4cef3291b10?source=api-prod","affected":[{"type":"plugin","slug":"bne-testimonials","name":"BNE Testimonials","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.8.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-08T20:47:31Z"},{"id":"wordfence:82c9a361-8a69-4468-8f3e-3caa2c169332","source":"wordfence","cve":"CVE-2024-56254","title":"Move Addons for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c9a361-8a69-4468-8f3e-3caa2c169332?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:17:22Z"},{"id":"wordfence:82c9e3be-a6b8-4d3a-8e1a-cc2e29bb95b6","source":"wordfence","cve":"CVE-2024-52400","title":"Gallerio <= 1.01 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82c9e3be-a6b8-4d3a-8e1a-cc2e29bb95b6?source=api-prod","affected":[{"type":"plugin","slug":"gallerio","name":"Gallerio","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:11:11Z"},{"id":"wordfence:82ca2dfc-a820-49d7-bb73-38dbb8406841","source":"wordfence","cve":"CVE-2026-76573","title":"Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ca2dfc-a820-49d7-bb73-38dbb8406841?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.3.9.1","to_inclusive":true,"patched_in":"3.3.9.2"}],"published":"2026-09-04T19:50:28Z","updated":"2026-09-05T08:27:20Z"},{"id":"wordfence:82caf69a-2423-4f0f-9cf2-7d4fe428e915","source":"wordfence","cve":"CVE-2026-7561","title":"Tm \u2013 WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82caf69a-2423-4f0f-9cf2-7d4fe428e915?source=api-prod","affected":[{"type":"plugin","slug":"tm-wordpress-redirection","name":"Tm \u2013 WordPress Redirection","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:05:20Z","updated":"2026-05-12T07:48:23Z"},{"id":"wordfence:82cde234-ae87-438f-911e-bdd0e3ac1132","source":"wordfence","cve":"CVE-2024-2346","title":"FileBird \u2013 WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-15T20:31:37Z"},{"id":"wordfence:82ce66d0-dc53-4433-b499-30bfd48efaf2","source":"wordfence","cve":"","title":"Elegant Themes Divi 3.23 - 4.0.9, Divi Extra 2.23 - 4.0.9, Divi Builder 2.23 - 4.0.9 - PHP Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ce66d0-dc53-4433-b499-30bfd48efaf2?source=api-prod","affected":[{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"2.23","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"},{"type":"theme","slug":"Divi","name":"Divi","from":"3.23","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"},{"type":"theme","slug":"extra","name":"Divi Extra","from":"2.23","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2020-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82cee07d-871a-4579-aa53-ca0d14315458","source":"wordfence","cve":"CVE-2024-13355","title":"Admin and Customer Messages After Order for WooCommerce <= 13.2 - Authenticated (Subscriber+) Limited File Upload to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82cee07d-871a-4579-aa53-ca0d14315458?source=api-prod","affected":[{"type":"plugin","slug":"admin-and-client-message-after-order-for-woocommerce","name":"OrderConvo \u2013 Vendor & Customer Messages After Orders","from":"*","from_inclusive":true,"to":"13.2","to_inclusive":true,"patched_in":"13.3"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T09:39:15Z"},{"id":"wordfence:82cfeff9-7079-408e-9c22-bae0d45000ed","source":"wordfence","cve":"CVE-2024-11334","title":"My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82cfeff9-7079-408e-9c22-bae0d45000ed?source=api-prod","affected":[{"type":"plugin","slug":"my-contador-wp","name":"My Contador lesr","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-11-20T17:28:44Z","updated":"2024-11-21T05:33:50Z"},{"id":"wordfence:82d408f2-9d72-465e-aa3d-eca4dab2af60","source":"wordfence","cve":"CVE-2026-78362","title":"SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82d408f2-9d72-465e-aa3d-eca4dab2af60?source=api-prod","affected":[{"type":"plugin","slug":"lupsonline-link-netwerk","name":"SEO Flow by LupsOnline","from":"3.0.0","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:02:21Z"},{"id":"wordfence:82d6fc5d-8678-4459-8d2a-423803629d10","source":"wordfence","cve":"CVE-2025-23867","title":"WordPress File Search <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82d6fc5d-8678-4459-8d2a-423803629d10?source=api-prod","affected":[{"type":"plugin","slug":"wpfilesearch","name":"WordPress File Search","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:47:42Z"},{"id":"wordfence:82d725a7-f4a8-4473-874b-496852a352cc","source":"wordfence","cve":"CVE-2025-23985","title":"Dynamic URL SEO <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82d725a7-f4a8-4473-874b-496852a352cc?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-url-seo","name":"Dynamic URL SEO","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:29:00Z"},{"id":"wordfence:82d87c8b-c503-43e8-aba9-cc98427e0859","source":"wordfence","cve":"CVE-2026-48872","title":"EmbedPress \u2013 PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more <= 4.5.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82d87c8b-c503-43e8-aba9-cc98427e0859?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:07:10Z"},{"id":"wordfence:82da75f4-f036-40e0-ae4c-5011d6a39df4","source":"wordfence","cve":"CVE-2012-4273","title":"2 Click Social Media Buttons < 0.34 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82da75f4-f036-40e0-ae4c-5011d6a39df4?source=api-prod","affected":[{"type":"plugin","slug":"2-click-socialmedia-buttons","name":"2 Click Social Media Buttons","from":"*","from_inclusive":true,"to":"0.34","to_inclusive":false,"patched_in":"0.34"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82de0a8c-2be9-4780-9d2e-1c6788be5249","source":"wordfence","cve":"CVE-2024-1286","title":"Paid Memberships Pro - Membership Maps Add On < 0.7 - Authenticated (contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82de0a8c-2be9-4780-9d2e-1c6788be5249?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-membership-maps","name":"Paid Memberships Pro - Membership Maps Add On","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":false,"patched_in":"0.7"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-09T17:04:55Z"},{"id":"wordfence:82df5b2e-4c4a-402f-99c9-694fa710009b","source":"wordfence","cve":"CVE-2025-2299","title":"LuckyWP Table of Contents <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82df5b2e-4c4a-402f-99c9-694fa710009b?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-table-of-contents","name":"LuckyWP Table of Contents","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-03T11:12:35Z"},{"id":"wordfence:82df7569-919a-4f95-b0e2-f866133771eb","source":"wordfence","cve":"CVE-2014-10381","title":"User Domain Whitelist <= 1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82df7569-919a-4f95-b0e2-f866133771eb?source=api-prod","affected":[{"type":"plugin","slug":"user-domain-whitelist","name":"User Domain Whitelist","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2014-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82e1e34c-61c4-4d94-8fca-27f86b95e6f2","source":"wordfence","cve":"CVE-2026-115960","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e1e34c-61c4-4d94-8fca-27f86b95e6f2?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-10-26T10:35:00Z","updated":"2026-10-28T01:25:51Z"},{"id":"wordfence:82e235ac-55b9-4cb7-94cd-086142accf3a","source":"wordfence","cve":"CVE-2025-31388","title":"The World <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e235ac-55b9-4cb7-94cd-086142accf3a?source=api-prod","affected":[{"type":"plugin","slug":"the-world","name":"The World","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:59:21Z"},{"id":"wordfence:82e2d184-d922-4ddb-b3aa-0191f7ff7603","source":"wordfence","cve":"CVE-2025-31731","title":"Author Bio Shortcode <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e2d184-d922-4ddb-b3aa-0191f7ff7603?source=api-prod","affected":[{"type":"plugin","slug":"author-bio-shortcode","name":"Author Bio Shortcode","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:40:07Z"},{"id":"wordfence:82e5fd9f-9a1f-4a4c-ac06-61bf65e3c8ab","source":"wordfence","cve":"CVE-2024-2238","title":"Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e5fd9f-9a1f-4a4c-ac06-61bf65e3c8ab?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:32:39Z"},{"id":"wordfence:82e6abde-b826-4dd9-81bb-89b6549b3789","source":"wordfence","cve":"CVE-2026-87767","title":"Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e6abde-b826-4dd9-81bb-89b6549b3789?source=api-prod","affected":[{"type":"plugin","slug":"wp-shortcut-link","name":"wp shortcut link and advertisement baner","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:43:46Z"},{"id":"wordfence:82e77268-2437-46a9-989f-ecee9c3e730f","source":"wordfence","cve":"CVE-2025-68547","title":"Follow My Blog Post <= 2.4.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e77268-2437-46a9-989f-ecee9c3e730f?source=api-prod","affected":[{"type":"plugin","slug":"follow-my-blog-post","name":"Follow My Blog Post - WordPress / WooCommerce Plugin","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T14:37:40Z"},{"id":"wordfence:82e9bd78-726f-421f-8bf0-560fa9eeab2c","source":"wordfence","cve":"CVE-2024-43238","title":"weMail <= 1.14.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82e9bd78-726f-421f-8bf0-560fa9eeab2c?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.5","to_inclusive":true,"patched_in":"1.14.6"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:49:01Z"},{"id":"wordfence:82ea0ebc-08aa-4ef5-b6b1-c7c13715ef6d","source":"wordfence","cve":"CVE-2025-13149","title":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ea0ebc-08aa-4ef5-b6b1-c7c13715ef6d?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2025-11-20T19:53:09Z","updated":"2025-11-21T08:28:13Z"},{"id":"wordfence:82eb759f-e8d5-40c6-998f-f6981d9d6644","source":"wordfence","cve":"CVE-2024-2967","title":"Guest posting / Frontend Posting wordpress plugin \u2013 WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82eb759f-e8d5-40c6-998f-f6981d9d6644?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2024-04-29T00:00:00Z","updated":"2024-06-14T18:35:44Z"},{"id":"wordfence:82ec3600-1e32-4871-a41f-ab42d7bded5d","source":"wordfence","cve":"CVE-2026-16273","title":"Narrative Publisher <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ec3600-1e32-4871-a41f-ab42d7bded5d?source=api-prod","affected":[{"type":"plugin","slug":"narrative-so","name":"Narrative Publisher","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:11:08Z"},{"id":"wordfence:82f02548-f3a4-490a-8587-66044dcdd15d","source":"wordfence","cve":"CVE-2026-76558","title":"Import Export Lite <= 3.9.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f02548-f3a4-490a-8587-66044dcdd15d?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:50:05Z"},{"id":"wordfence:82f0b4c3-d0fb-4f3c-b8aa-c5f5ce6c3f16","source":"wordfence","cve":"CVE-2026-48867","title":"Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f0b4c3-d0fb-4f3c-b8aa-c5f5ce6c3f16?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"11.1.3"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:32:24Z"},{"id":"wordfence:82f1a77d-1068-48e5-8c3b-1fa4b43221f8","source":"wordfence","cve":"CVE-2026-39573","title":"Mildhill <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f1a77d-1068-48e5-8c3b-1fa4b43221f8?source=api-prod","affected":[{"type":"theme","slug":"mildhill","name":"Mildhill - Organic and Food Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:54:22Z"},{"id":"wordfence:82f214e3-a869-4295-9b92-725724cf059c","source":"wordfence","cve":"CVE-2025-23458","title":"Ads24 Lite <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f214e3-a869-4295-9b92-725724cf059c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ad-management","name":"Ads24 Lite \u2013 Ultimate WP Ads Manager Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:07:23Z"},{"id":"wordfence:82f311a5-6ef3-4052-ab9d-fdb23f7b7406","source":"wordfence","cve":"CVE-2021-24853","title":"QR Redirector <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f311a5-6ef3-4052-ab9d-fdb23f7b7406?source=api-prod","affected":[{"type":"plugin","slug":"qr-redirector","name":"QR Redirector","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82f4ad21-bc55-4daf-bc46-90969dcbabdd","source":"wordfence","cve":"","title":"We\u2019re Open! <= 1.44 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f4ad21-bc55-4daf-bc46-90969dcbabdd?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"1.44","to_inclusive":true,"patched_in":"1.45"}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82f525c9-c032-4770-8424-4ab7e05784f4","source":"wordfence","cve":"CVE-2025-23439","title":"TinyMCE Extended Config <= 0.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f525c9-c032-4770-8424-4ab7e05784f4?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-extended-config","name":"TinyMCE Extended Config","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:38:47Z"},{"id":"wordfence:82f5456e-f2cc-47f3-a957-f85d26834031","source":"wordfence","cve":"CVE-2026-65442","title":"FormCraft <= 3.9.15 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f5456e-f2cc-47f3-a957-f85d26834031?source=api-prod","affected":[{"type":"plugin","slug":"formcraft","name":"FormCraft","from":"*","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.9.16"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:37:15Z"},{"id":"wordfence:82f5e976-2564-4f8b-96d5-cfac9945737c","source":"wordfence","cve":"CVE-2023-34187","title":"Call Now Icon Animate <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f5e976-2564-4f8b-96d5-cfac9945737c?source=api-prod","affected":[{"type":"plugin","slug":"call-now-icon-animate","name":"Call Now Icon Animate","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82f80916-37ab-4c5a-9787-2544c620acac","source":"wordfence","cve":"CVE-2020-36836","title":"WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.0,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.9.0.3","to_inclusive":false,"patched_in":"0.9.0.3"}],"published":"2020-02-05T00:00:00Z","updated":"2024-10-24T18:54:54Z"},{"id":"wordfence:82fb1ea4-12cc-4c8c-b51e-cf878a791d0e","source":"wordfence","cve":"CVE-2022-2194","title":"Accept Stripe Payments <= 2.0.63 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82fb1ea4-12cc-4c8c-b51e-cf878a791d0e?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.63","to_inclusive":true,"patched_in":"2.0.64"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82fb39e0-8f49-4274-87de-a191b43657a0","source":"wordfence","cve":"CVE-2026-24952","title":"Seriously Simple Podcasting <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82fb39e0-8f49-4274-87de-a191b43657a0?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2025-12-21T02:09:55Z","updated":"2026-02-09T22:01:35Z"},{"id":"wordfence:82fdcf4b-712e-4d53-87dd-ec4daa3a7fdb","source":"wordfence","cve":"CVE-2026-124274","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82fdcf4b-712e-4d53-87dd-ec4daa3a7fdb?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-07T08:50:00Z","updated":"2026-11-10T20:03:38Z"},{"id":"wordfence:82fe99af-f254-4f4f-ac27-3e1997c370f6","source":"wordfence","cve":"CVE-2020-36389","title":"CiviCRM < 5.28.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82fe99af-f254-4f4f-ac27-3e1997c370f6?source=api-prod","affected":[{"type":"plugin","slug":"civicrm","name":"CiviCRM for WordPress","from":"*","from_inclusive":true,"to":"5.28.0","to_inclusive":true,"patched_in":"5.28.1"}],"published":"2021-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:82ff0450-5a76-453e-bb27-45c11fff7419","source":"wordfence","cve":"CVE-2026-66690","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ff0450-5a76-453e-bb27-45c11fff7419?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.5","to_inclusive":true,"patched_in":"4.16.5.1"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:35:21Z"},{"id":"wordfence:82ffa37a-786c-4af7-8038-f452828160c9","source":"wordfence","cve":"CVE-2025-32281","title":"WPKit For Elementor <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/82ffa37a-786c-4af7-8038-f452828160c9?source=api-prod","affected":[{"type":"plugin","slug":"wpkit-elementor","name":"WPKit For Elementor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:17:45Z"},{"id":"wordfence:83009e29-6860-4d0c-954a-8035dc361cdc","source":"wordfence","cve":"","title":"WP-lightpop <= 0.8.5.6 - Remote Media File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83009e29-6860-4d0c-954a-8035dc361cdc?source=api-prod","affected":[{"type":"plugin","slug":"wp-lightpop","name":"wp-lightpop","from":"*","from_inclusive":true,"to":"0.8.5.6","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8302e390-35f5-4046-bab0-d5560d099681","source":"wordfence","cve":"CVE-2025-49373","title":"Evergreen Content Poster <= 1.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8302e390-35f5-4046-bab0-d5560d099681?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-07-12T00:00:00Z","updated":"2025-11-04T18:17:07Z"},{"id":"wordfence:8303c84f-8065-4394-a692-29cb72bada0a","source":"wordfence","cve":"","title":"Hunk External Links <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8303c84f-8065-4394-a692-29cb72bada0a?source=api-prod","affected":[{"type":"plugin","slug":"hunk-external-links","name":"Hunk External Links","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8304037f-6d04-4df1-987f-fd62cfec00b3","source":"wordfence","cve":"CVE-2025-53208","title":"Maya Business <= 1.2.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8304037f-6d04-4df1-987f-fd62cfec00b3?source=api-prod","affected":[{"type":"plugin","slug":"paymaya-checkout-for-woocommerce","name":"Maya Business Plugin","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:48:31Z"},{"id":"wordfence:83048a4b-b64f-43d4-8cd2-f45cccd636f4","source":"wordfence","cve":"CVE-2025-63063","title":"Yandex.Metrica <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83048a4b-b64f-43d4-8cd2-f45cccd636f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-yandex-metrika","name":"Yandex.Metrica","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-07T00:00:00Z","updated":"2025-12-10T16:02:32Z"},{"id":"wordfence:8305175b-2e61-49e3-847b-580a52a5c666","source":"wordfence","cve":"CVE-2025-62993","title":"Notification for Telegram <= 3.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8305175b-2e61-49e3-847b-580a52a5c666?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-11-29T00:00:00Z","updated":"2026-05-11T19:40:33Z"},{"id":"wordfence:8305be9c-cad5-4bbc-beab-0730a9abe1d9","source":"wordfence","cve":"CVE-2015-9296","title":"Download Monitor < 1.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8305be9c-cad5-4bbc-beab-0730a9abe1d9?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8306090a-cb23-4cff-b859-07b0a0bf9186","source":"wordfence","cve":"CVE-2024-54312","title":"Persian Woocommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8306090a-cb23-4cff-b859-07b0a0bf9186?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:52:49Z"},{"id":"wordfence:830663b6-0786-48c7-9ffd-ac3ba2bd3e0c","source":"wordfence","cve":"CVE-2025-14455","title":"Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830663b6-0786-48c7-9ffd-ac3ba2bd3e0c?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2025-12-18T20:29:17Z","updated":"2026-01-05T15:40:19Z"},{"id":"wordfence:83082d5f-b65b-47cb-9026-8b23800c0e28","source":"wordfence","cve":"CVE-2024-51591","title":"Slicko <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83082d5f-b65b-47cb-9026-8b23800c0e28?source=api-prod","affected":[{"type":"plugin","slug":"slicko-for-elementor","name":"Slicko","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:16:40Z"},{"id":"wordfence:830a5784-5ebb-4a32-b214-a601bb41062c","source":"wordfence","cve":"CVE-2025-27281","title":"All In Menu <= 1.1.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830a5784-5ebb-4a32-b214-a601bb41062c?source=api-prod","affected":[{"type":"plugin","slug":"all-in-menu","name":"All In Menu \u2013 Header menu creator","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:44:57Z"},{"id":"wordfence:830a7ca0-a83b-49e9-bbfb-43b509ec4aff","source":"wordfence","cve":"CVE-2026-65490","title":"Create <= 2.6.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830a7ca0-a83b-49e9-bbfb-43b509ec4aff?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:20:23Z"},{"id":"wordfence:830a8e85-6134-4f85-996f-b0cb7ccb9d5c","source":"wordfence","cve":"CVE-2021-24661","title":"PostX Gutenberg Blocks Saved Templates Addon <= 2.4.9 - Private Content Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830a8e85-6134-4f85-996f-b0cb7ccb9d5c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2021-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:830ac75b-708a-435c-8837-b79a2f41575c","source":"wordfence","cve":"CVE-2024-8239","title":"Starbox <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter URL Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830ac75b-708a-435c-8837-b79a2f41575c?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2024-09-09T00:00:00Z","updated":"2024-10-08T16:01:19Z"},{"id":"wordfence:830baa14-e6bb-4d89-8678-dcf48c8b8377","source":"wordfence","cve":"CVE-2025-22326","title":"5centsCDN <= 25.4.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830baa14-e6bb-4d89-8678-dcf48c8b8377?source=api-prod","affected":[{"type":"plugin","slug":"5centscdn","name":"5centsCDN \u2013 WordPress CDN Plugin","from":"*","from_inclusive":true,"to":"25.4.15","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-04-17T12:55:40Z"},{"id":"wordfence:830f53a4-da3b-4a95-99f1-c4a4c8e6944c","source":"wordfence","cve":"CVE-2024-4445","title":"WP Compress \u2013 Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830f53a4-da3b-4a95-99f1-c4a4c8e6944c?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.20.01","to_inclusive":true,"patched_in":"6.20.02"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-14T05:33:00Z"},{"id":"wordfence:830ff660-0265-46e5-8d16-ecd03cdf9f52","source":"wordfence","cve":"CVE-2023-49194","title":"Importify <= 1.0.4 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/830ff660-0265-46e5-8d16-ecd03cdf9f52?source=api-prod","affected":[{"type":"plugin","slug":"importify","name":"Importify \u2013 AI Dropshipping for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-24T13:46:55Z"},{"id":"wordfence:83106660-0678-44c0-894d-7287230f616e","source":"wordfence","cve":"CVE-2024-37199","title":"Enfold <= 5.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83106660-0678-44c0-894d-7287230f616e?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"5.6.10"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T15:14:12Z"},{"id":"wordfence:8311e675-cff6-4d89-9111-7668cb3df282","source":"wordfence","cve":"CVE-2026-96886","title":"Course Booking System <= 7.0.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8311e675-cff6-4d89-9111-7668cb3df282?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-system","name":"Course Booking System","from":"*","from_inclusive":true,"to":"7.0.8","to_inclusive":true,"patched_in":"7.0.9"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:10:48Z"},{"id":"wordfence:83145c07-29e5-4609-8f14-d62fe6b64c73","source":"wordfence","cve":"CVE-2025-23460","title":"RWS Enquiry And Lead Follow-up <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83145c07-29e5-4609-8f14-d62fe6b64c73?source=api-prod","affected":[{"type":"plugin","slug":"rws-enquiry","name":"RWS Enquiry And Lead Follow-up","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:04:16Z"},{"id":"wordfence:8314f607-5904-4da8-b2a2-5d77e2edc764","source":"wordfence","cve":"CVE-2024-38695","title":"WP GoToWebinar <= 15.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8314f607-5904-4da8-b2a2-5d77e2edc764?source=api-prod","affected":[{"type":"plugin","slug":"wp-gotowebinar","name":"WP GoToWebinar","from":"*","from_inclusive":true,"to":"15.6","to_inclusive":true,"patched_in":"15.7"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:41:14Z"},{"id":"wordfence:83157b37-75f6-4ab9-8759-3d9a9cb9303d","source":"wordfence","cve":"CVE-2017-18565","title":"Updater by BestWebSoft <= 1.34 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83157b37-75f6-4ab9-8759-3d9a9cb9303d?source=api-prod","affected":[{"type":"plugin","slug":"updater","name":"Updater by BestWebSoft","from":"*","from_inclusive":true,"to":"1.34","to_inclusive":true,"patched_in":"1.35"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83189c51-2605-4808-a0fa-3e5245cc0806","source":"wordfence","cve":"CVE-2024-30243","title":"WordPress Tooltips <= 9.4.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83189c51-2605-4808-a0fa-3e5245cc0806?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-tooltips","name":"Tooltips for WordPress","from":"*","from_inclusive":true,"to":"9.4.3","to_inclusive":true,"patched_in":"9.4.5"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-11T15:14:27Z"},{"id":"wordfence:831d5b15-513b-45bd-b049-c83d92e731ec","source":"wordfence","cve":"CVE-2025-46453","title":"Zoho Creator Forms <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/831d5b15-513b-45bd-b049-c83d92e731ec?source=api-prod","affected":[{"type":"plugin","slug":"zohocreator","name":"Zoho Creator Forms","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:46:33Z"},{"id":"wordfence:831d9e4d-21b4-45db-83f8-e8b220c6c44b","source":"wordfence","cve":"CVE-2025-58786","title":"Ibtana \u2013 Ecommerce Product Addons <= 0.4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/831d9e4d-21b4-45db-83f8-e8b220c6c44b?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-ecommerce-product-addons","name":"Ibtana \u2013 Ecommerce Product Addons","from":"*","from_inclusive":true,"to":"0.4.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:41:17Z"},{"id":"wordfence:831e94da-b149-48f0-9b4f-32f40cad79d6","source":"wordfence","cve":"CVE-2026-108478","title":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/831e94da-b149-48f0-9b4f-32f40cad79d6?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.8.8","to_inclusive":true,"patched_in":"8.8.9"}],"published":"2026-10-12T17:11:00Z","updated":"2026-10-13T14:04:36Z"},{"id":"wordfence:831f0610-91e9-4d4b-aa8a-3643ddf9716b","source":"wordfence","cve":"CVE-2026-54862","title":"Import and export users and customers <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/831f0610-91e9-4d4b-aa8a-3643ddf9716b?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2026-10-29T13:08:00Z","updated":"2026-11-03T20:04:08Z"},{"id":"wordfence:8321c669-af27-4454-ab7a-374de4f149cf","source":"wordfence","cve":"CVE-2025-22628","title":"Filled In <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8321c669-af27-4454-ab7a-374de4f149cf?source=api-prod","affected":[{"type":"plugin","slug":"filled-in","name":"Filled In","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-02-11T00:00:00Z","updated":"2025-04-21T14:48:38Z"},{"id":"wordfence:8321f68f-da2d-4382-979d-54008de2cae7","source":"wordfence","cve":"CVE-2023-6289","title":"Swift Performance Lite <= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8321f68f-da2d-4382-979d-54008de2cae7?source=api-prod","affected":[{"type":"plugin","slug":"swift-performance-lite","name":"Swift Performance Lite","from":"*","from_inclusive":true,"to":"2.3.6.14","to_inclusive":true,"patched_in":"2.3.6.15"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8322fe81-2c2f-4aa6-b08f-fa5c16e62218","source":"wordfence","cve":"CVE-2024-13479","title":"LTL Freight Quotes \u2013 SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8322fe81-2c2f-4aa6-b08f-fa5c16e62218?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-sefl-edition","name":"LTL Freight Quotes \u2013 SEFL Edition","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-02-18T21:56:01Z","updated":"2025-02-19T11:10:39Z"},{"id":"wordfence:8323dbff-3d35-4b31-8ec6-645de676adab","source":"wordfence","cve":"CVE-2025-58225","title":"Paragon <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8323dbff-3d35-4b31-8ec6-645de676adab?source=api-prod","affected":[{"type":"theme","slug":"paragon","name":"Paragon - Consulting & Corporate Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-20T21:06:00Z"},{"id":"wordfence:832af296-7d7c-47a0-84a4-01a1fe78ff21","source":"wordfence","cve":"CVE-2026-49113","title":"Cornerstone < 7.8.8 - Authenticated (Subscriber+) Arbitrary Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/832af296-7d7c-47a0-84a4-01a1fe78ff21?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"7.8.8","to_inclusive":false,"patched_in":"7.8.8"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:42:53Z"},{"id":"wordfence:832ba0eb-6399-44d5-9055-9bb97f97095f","source":"wordfence","cve":"CVE-2026-14195","title":"Brizy \u2013 Page Builder < 2.8.18 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/832ba0eb-6399-44d5-9055-9bb97f97095f?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":false,"patched_in":"2.8.18"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:28:35Z"},{"id":"wordfence:832e2348-0c1d-4f65-a773-59ae807044e0","source":"wordfence","cve":"CVE-2025-49896","title":"School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/832e2348-0c1d-4f65-a773-59ae807044e0?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:06:13Z"},{"id":"wordfence:833006a6-462a-4729-8f3e-dca74a3802a2","source":"wordfence","cve":"CVE-2023-23996","title":"ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/833006a6-462a-4729-8f3e-dca74a3802a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8331fe3f-e943-4f4c-887f-761f3e18eb79","source":"wordfence","cve":"CVE-2026-15948","title":"Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8331fe3f-e943-4f4c-887f-761f3e18eb79?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-08-14T15:06:20Z","updated":"2026-08-15T03:26:00Z"},{"id":"wordfence:8336d8d6-81ac-40a6-af1e-167c12440908","source":"wordfence","cve":"CVE-2026-81825","title":"Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8336d8d6-81ac-40a6-af1e-167c12440908?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20260811","to_inclusive":true,"patched_in":"20260827"}],"published":"2026-09-10T14:45:50Z","updated":"2026-09-11T03:39:36Z"},{"id":"wordfence:833d9f92-9af1-4332-9b1d-2d1d37073b4b","source":"wordfence","cve":"CVE-2026-104767","title":"Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/833d9f92-9af1-4332-9b1d-2d1d37073b4b?source=api-prod","affected":[{"type":"plugin","slug":"dfx-woo-role-changer","name":"Membership & User Roles for WooCommerce (Automatic Role Changer)","from":"*","from_inclusive":true,"to":"20260828","to_inclusive":true,"patched_in":"20261007"}],"published":"2026-10-13T12:40:58Z","updated":"2026-10-14T01:27:14Z"},{"id":"wordfence:833eb481-4fb4-432e-8e93-3f497ccbf1eb","source":"wordfence","cve":"CVE-2022-3144","title":"Wordfence Security \u2013 Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:833f13b4-3180-475d-b924-b6cc3d4a99b6","source":"wordfence","cve":"CVE-2025-46246","title":"CM Answers <= 3.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/833f13b4-3180-475d-b924-b6cc3d4a99b6?source=api-prod","affected":[{"type":"plugin","slug":"cm-answers","name":"CM Answers \u2013 Discussion Forum Plugin for WordPress Q&A","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:32:40Z"},{"id":"wordfence:8341c7fb-6f3f-45ee-86c3-9c9d2617594a","source":"wordfence","cve":"CVE-2019-14793","title":"Meta Box - WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8341c7fb-6f3f-45ee-86c3-9c9d2617594a?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":false,"patched_in":"4.16.3"}],"published":"2019-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8341eaea-cc54-43e2-bc4f-a892e3756fa3","source":"wordfence","cve":"CVE-2024-43154","title":"Advanced Cron Manager \u2013 debug & control <= 2.5.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8341eaea-cc54-43e2-bc4f-a892e3756fa3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cron-manager","name":"Advanced Cron Manager \u2013 debug & control","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:30:36Z"},{"id":"wordfence:8342baa8-93b2-4136-9dd9-a66e37b400de","source":"wordfence","cve":"CVE-2025-62740","title":"WP-CRM System <= 3.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8342baa8-93b2-4136-9dd9-a66e37b400de?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2025-12-08T00:00:00Z","updated":"2026-09-30T14:38:14Z"},{"id":"wordfence:83455de5-4fb2-4782-8063-646d3daf29e5","source":"wordfence","cve":"CVE-2026-16614","title":"GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83455de5-4fb2-4782-8063-646d3daf29e5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-sheets-connector","name":"GSheetConnector \u2013 CF7 Google Sheets Connector & Save CF7 Entries to Database","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-07-31T19:30:52Z","updated":"2026-08-01T07:49:49Z"},{"id":"wordfence:83460136-5a51-4c11-a695-ea2b2d60d68f","source":"wordfence","cve":"","title":"WP-Property \u2013 WordPress Powered Real Estate and Property Management < 1.38.4 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83460136-5a51-4c11-a695-ea2b2d60d68f?source=api-prod","affected":[{"type":"plugin","slug":"wp-property","name":"WP-Property \u2013 WordPress Powered Real Estate and Property Management","from":"*","from_inclusive":true,"to":"1.38.4","to_inclusive":false,"patched_in":"1.38.4"}],"published":"2014-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:834bedf0-a2bc-4396-a160-3d3f399c1897","source":"wordfence","cve":"CVE-2024-8284","title":"Download Manager <= 3.2.98 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834bedf0-a2bc-4396-a160-3d3f399c1897?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.98","to_inclusive":true,"patched_in":"3.2.99"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-18T15:21:48Z"},{"id":"wordfence:834c4ca9-7173-4c84-8287-9916ec72935d","source":"wordfence","cve":"CVE-2024-1502","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834c4ca9-7173-4c84-8287-9916ec72935d?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T23:33:50Z"},{"id":"wordfence:834c6a56-7b02-4f5d-9e10-94ba7da6d47e","source":"wordfence","cve":"CVE-2026-73404","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.41 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834c6a56-7b02-4f5d-9e10-94ba7da6d47e?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.41","to_inclusive":true,"patched_in":"3.7.42"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:35:33Z"},{"id":"wordfence:834c92ba-8b48-4ae3-9073-085e8f559762","source":"wordfence","cve":"","title":"WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834c92ba-8b48-4ae3-9073-085e8f559762?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.38","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.6","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"4.1.38"}],"published":"2023-05-16T00:00:00Z","updated":"2024-05-31T15:30:29Z"},{"id":"wordfence:834df212-a4da-425f-9c15-358211b5cb54","source":"wordfence","cve":"CVE-2025-50023","title":"CodePen Embed Block <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834df212-a4da-425f-9c15-358211b5cb54?source=api-prod","affected":[{"type":"plugin","slug":"codepen-embed-block","name":"CodePen Embed Block","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-06-19T00:00:00Z","updated":"2026-09-09T15:52:38Z"},{"id":"wordfence:834e86c6-f516-4991-a693-d23db2bf14ce","source":"wordfence","cve":"CVE-2022-2312","title":"Student Result or Employee Database <= 1.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834e86c6-f516-4991-a693-d23db2bf14ce?source=api-prod","affected":[{"type":"plugin","slug":"simple-student-result","name":"Student Result or Employee Database","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:834ff44a-4259-49a5-bad3-26fce393fb98","source":"wordfence","cve":"","title":"Docket Cache \u2013 Object Cache Accelerator <= 21.08.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/834ff44a-4259-49a5-bad3-26fce393fb98?source=api-prod","affected":[{"type":"plugin","slug":"docket-cache","name":"Docket Cache \u2013 Object Cache Accelerator","from":"*","from_inclusive":true,"to":"21.08.01","to_inclusive":true,"patched_in":"21.08.02"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8352400f-fea1-486d-872a-66340300cee9","source":"wordfence","cve":"CVE-2025-12965","title":"Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8352400f-fea1-486d-872a-66340300cee9?source=api-prod","affected":[{"type":"plugin","slug":"magical-posts-display","name":"Magical Posts Display \u2013 Elementor Advanced Posts widgets","from":"*","from_inclusive":true,"to":"1.2.54","to_inclusive":true,"patched_in":"1.2.55"}],"published":"2025-12-11T22:32:34Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:835353e7-871d-4daf-9ed4-86321daf2366","source":"wordfence","cve":"CVE-2025-12891","title":"Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835353e7-871d-4daf-9ed4-86321daf2366?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.9.4","to_inclusive":true,"patched_in":"5.1.9.5"}],"published":"2025-11-12T15:37:46Z","updated":"2025-11-13T04:28:01Z"},{"id":"wordfence:83539a88-b90e-49f0-a599-b3f83b2d97b9","source":"wordfence","cve":"CVE-2026-111464","title":"WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response","severity":"medium","cvss":5.9,"cwe":"CWE-524","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83539a88-b90e-49f0-a599-b3f83b2d97b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-11-02T13:45:57Z","updated":"2026-11-03T02:31:21Z"},{"id":"wordfence:83556ba7-6eb3-404e-a077-05d78171badd","source":"wordfence","cve":"CVE-2026-57734","title":"tagDiv Composer <= 5.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83556ba7-6eb3-404e-a077-05d78171badd?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":"5.4.6"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-23T22:44:17Z"},{"id":"wordfence:835579b0-8a96-40fa-a6a3-30571a0a1d0a","source":"wordfence","cve":"CVE-2026-18322","title":"Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835579b0-8a96-40fa-a6a3-30571a0a1d0a?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.13.0"}],"published":"2026-08-04T16:04:04Z","updated":"2026-08-05T04:25:25Z"},{"id":"wordfence:8357511a-09c5-46a0-a22e-ebaa3dee4acd","source":"wordfence","cve":"CVE-2026-97268","title":"Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8357511a-09c5-46a0-a22e-ebaa3dee4acd?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2026-10-01T13:26:09Z","updated":"2026-10-08T23:59:06Z"},{"id":"wordfence:835941f1-e2f6-41aa-9a46-cdbeb5741d20","source":"wordfence","cve":"CVE-2021-25025","title":"Event Calendar <= 1.1.50 - Subscriber+ Event Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835941f1-e2f6-41aa-9a46-cdbeb5741d20?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.1.50","to_inclusive":true,"patched_in":"1.1.51"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83597e50-1992-4171-b24e-b14f55be6e4c","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83597e50-1992-4171-b24e-b14f55be6e4c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:55:48Z"},{"id":"wordfence:835aaf5e-08c8-4bf8-add7-82a1f1fdc2c0","source":"wordfence","cve":"CVE-2024-49310","title":"Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835aaf5e-08c8-4bf8-add7-82a1f1fdc2c0?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-21T16:39:05Z"},{"id":"wordfence:835b254a-9135-4b9d-8607-7122304601bc","source":"wordfence","cve":"CVE-2008-4616","title":"Spambam <= 2.1 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835b254a-9135-4b9d-8607-7122304601bc?source=api-prod","affected":[{"type":"plugin","slug":"spambam","name":"SpamBam","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2008-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:835cbcfa-bb8d-4b46-9316-500e1b47cfb5","source":"wordfence","cve":"CVE-2014-100007","title":"HK Exif Tags <= 1.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835cbcfa-bb8d-4b46-9316-500e1b47cfb5?source=api-prod","affected":[{"type":"plugin","slug":"hk-exif-tags","name":"HK Exif Tags","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.12"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:835db0c0-f3c9-4acd-aee8-bf7b52447ac9","source":"wordfence","cve":"CVE-2014-4585","title":"WP Facethumb <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835db0c0-f3c9-4acd-aee8-bf7b52447ac9?source=api-prod","affected":[{"type":"plugin","slug":"wp-facethumb","name":"WP-FaceThumb","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:835dd5f5-9517-456e-a48e-6be98b47eaf2","source":"wordfence","cve":"CVE-2026-31915","title":"Flatsome <= 3.19.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835dd5f5-9517-456e-a48e-6be98b47eaf2?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.19.6","to_inclusive":true,"patched_in":"3.19.7"}],"published":"2024-10-24T00:00:00Z","updated":"2026-04-15T20:43:05Z"},{"id":"wordfence:835f16c1-d609-4ae1-9e43-95aced5f70b8","source":"wordfence","cve":"CVE-2026-32554","title":"WooCommerce Product Filter <= 3.1.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835f16c1-d609-4ae1-9e43-95aced5f70b8?source=api-prod","affected":[{"type":"plugin","slug":"woofilter-pro","name":"WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T10:39:25Z","updated":"2026-09-10T19:10:51Z"},{"id":"wordfence:835f553b-9c43-47f2-aecf-61c9397e6b5b","source":"wordfence","cve":"CVE-2021-24362","title":"Photo Gallery <= 1.5.74 - Stored Cross-Site Scripting via Uploaded SVG","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835f553b-9c43-47f2-aecf-61c9397e6b5b?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.75","to_inclusive":false,"patched_in":"1.5.75"}],"published":"2021-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:835f6efd-636e-411f-97a1-fa14b9a629b3","source":"wordfence","cve":"CVE-2023-23979","title":"Quick Event Manager <= 9.7.4 - Unauthenticated Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/835f6efd-636e-411f-97a1-fa14b9a629b3?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.7.4","to_inclusive":true,"patched_in":"9.7.5"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83603d33-b616-4332-aa05-b8ac61424614","source":"wordfence","cve":"CVE-2023-2579","title":"InventoryPress <= 1.7 - Authenticated(Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83603d33-b616-4332-aa05-b8ac61424614?source=api-prod","affected":[{"type":"plugin","slug":"inventorypress","name":"InventoryPress","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83624120-bc7b-4778-b6e5-aebe478d3f19","source":"wordfence","cve":"CVE-2025-53254","title":"Cyrlitera <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83624120-bc7b-4778-b6e5-aebe478d3f19?source=api-prod","affected":[{"type":"plugin","slug":"cyrlitera","name":"Cyrlitera \u2013 Transliteration of Links and File Names","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-06-27T00:00:00Z","updated":"2025-12-19T15:03:24Z"},{"id":"wordfence:83633ccd-923d-4d74-9429-7c7d93a24323","source":"wordfence","cve":"CVE-2025-23534","title":"WPLingo \u2013 Forum Plugin <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83633ccd-923d-4d74-9429-7c7d93a24323?source=api-prod","affected":[{"type":"plugin","slug":"wplingo","name":"WPLingo \u2013 Forum Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T15:53:56Z"},{"id":"wordfence:83660c88-1115-450d-88b0-29d62319dac7","source":"wordfence","cve":"CVE-2024-38750","title":"Advanced post slider <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83660c88-1115-450d-88b0-29d62319dac7?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-slider","name":"Advanced post slider","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:17:54Z"},{"id":"wordfence:836884b5-f547-4f50-8a97-5d910d877e5e","source":"wordfence","cve":"CVE-2024-11423","title":"Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/836884b5-f547-4f50-8a97-5d910d877e5e?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"},{"type":"plugin","slug":"gift-cards-for-woocommerce-pro","name":"Gift Cards for WooCommerce Pro","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-07T21:46:18Z","updated":"2025-01-08T11:09:27Z"},{"id":"wordfence:8368e18a-14b8-452f-aad8-0d550302a4a4","source":"wordfence","cve":"CVE-2024-52339","title":"Mage Front End Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8368e18a-14b8-452f-aad8-0d550302a4a4?source=api-prod","affected":[{"type":"plugin","slug":"mage-forms","name":"Mage Front End Forms","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:41:53Z"},{"id":"wordfence:83695ac4-a08b-4c25-ac33-d9b7498f5a2c","source":"wordfence","cve":"CVE-2025-5336","title":"Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83695ac4-a08b-4c25-ac33-d9b7498f5a2c?source=api-prod","affected":[{"type":"plugin","slug":"click-to-chat-for-whatsapp","name":"Click to Chat \u2013 HoliThemes","from":"*","from_inclusive":true,"to":"4.22","to_inclusive":true,"patched_in":"4.23"}],"published":"2025-06-13T20:15:36Z","updated":"2025-06-14T08:23:26Z"},{"id":"wordfence:8369d83a-bfbf-4e29-8b0b-ceb371a271b6","source":"wordfence","cve":"CVE-2008-0691","title":"WP-Footnotes <= 2.2 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8369d83a-bfbf-4e29-8b0b-ceb371a271b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-footnotes","name":"WP-Footnotes","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"3.0"}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:836a646c-af96-45eb-841d-c6bde270a27e","source":"wordfence","cve":"CVE-2025-58870","title":"WP-GraphViz <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/836a646c-af96-45eb-841d-c6bde270a27e?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphviz","name":"WP-GraphViz","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T22:10:00Z"},{"id":"wordfence:836af607-a9cb-4ea2-b3e8-0cd42a04254b","source":"wordfence","cve":"CVE-2026-65547","title":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/836af607-a9cb-4ea2-b3e8-0cd42a04254b?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:34:48Z"},{"id":"wordfence:836bac94-fd74-4ef9-a79b-4ea13de8f44f","source":"wordfence","cve":"CVE-2012-6078","title":"W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/836bac94-fd74-4ef9-a79b-4ea13de8f44f?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.2.4","to_inclusive":true,"patched_in":"0.9.2.5"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:836e3ca0-9f41-4ab2-a9bf-64a593f37c8a","source":"wordfence","cve":"","title":"WP Keyword link <= 1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/836e3ca0-9f41-4ab2-a9bf-64a593f37c8a?source=api-prod","affected":[{"type":"plugin","slug":"wp-keyword-link","name":"wp-keyword-link","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83734fe1-23e5-4b40-8daa-f5c8b9f9896a","source":"wordfence","cve":"CVE-2025-22572","title":"Legacy ePlayer <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83734fe1-23e5-4b40-8daa-f5c8b9f9896a?source=api-prod","affected":[{"type":"plugin","slug":"sportspress-tv","name":"Legacy ePlayer","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:46:04Z"},{"id":"wordfence:8373938c-060a-4579-a133-d25b4d065d36","source":"wordfence","cve":"CVE-2024-12517","title":"WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8373938c-060a-4579-a133-d25b4d065d36?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-count-shortcode","name":"WooCommerce Cart Count Shortcode","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:55:27Z","updated":"2024-12-14T04:23:43Z"},{"id":"wordfence:8375a8f4-274d-4c4f-8833-067efc7e57a2","source":"wordfence","cve":"CVE-2026-103525","title":"FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8375a8f4-274d-4c4f-8833-067efc7e57a2?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-10-15T15:40:21Z","updated":"2026-10-16T04:27:00Z"},{"id":"wordfence:8376556e-ed78-4a0e-a23f-9b2a39db94d9","source":"wordfence","cve":"CVE-2024-5724","title":"Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8376556e-ed78-4a0e-a23f-9b2a39db94d9?source=api-prod","affected":[{"type":"plugin","slug":"photo-video-gallery-master","name":"Photo Video Gallery Master","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T14:35:15Z","updated":"2024-06-19T03:12:31Z"},{"id":"wordfence:837e596e-a4a7-4fcf-a761-aed35a789770","source":"wordfence","cve":"CVE-2023-7195","title":"WP-Reply Notify <= 1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/837e596e-a4a7-4fcf-a761-aed35a789770?source=api-prod","affected":[{"type":"plugin","slug":"wp-reply-notify","name":"WP-Reply Notify","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:46:12Z"},{"id":"wordfence:837eea49-0b2c-46b4-a325-526d7c143fdc","source":"wordfence","cve":"CVE-2020-35234","title":"Easy WP SMTP <= 1.4.2 - Sensitive Information Disclosure","severity":"high","cvss":8.1,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/837eea49-0b2c-46b4-a325-526d7c143fdc?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2020-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:837f49e6-dcba-4451-bbbe-14890ab87207","source":"wordfence","cve":"CVE-2025-14999","title":"Latest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/837f49e6-dcba-4451-bbbe-14890ab87207?source=api-prod","affected":[{"type":"plugin","slug":"kento-latest-tabs","name":"Latest Tabs","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:02:48Z","updated":"2026-01-07T08:21:53Z"},{"id":"wordfence:83804c2a-2c4a-4f69-b833-dcd53ddab94d","source":"wordfence","cve":"CVE-2024-8274","title":"WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83804c2a-2c4a-4f69-b833-dcd53ddab94d?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.5","to_inclusive":true,"patched_in":"10.5.1"}],"published":"2024-08-29T00:00:00Z","updated":"2024-08-30T09:29:49Z"},{"id":"wordfence:8384d80b-6fe6-45ba-b28a-a0884280409a","source":"wordfence","cve":"CVE-2025-64198","title":"Easy Social Share Buttons < 10.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8384d80b-6fe6-45ba-b28a-a0884280409a?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons3","name":"Easy Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"10.7.1","to_inclusive":false,"patched_in":"10.7.1"}],"published":"2025-10-26T00:00:00Z","updated":"2025-11-04T14:46:18Z"},{"id":"wordfence:8385dd30-28e5-4572-8504-2f3e7029bad6","source":"wordfence","cve":"CVE-2026-84999","title":"Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8385dd30-28e5-4572-8504-2f3e7029bad6?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.4.0","to_inclusive":true,"patched_in":"3.8.4.1"}],"published":"2026-10-27T14:10:08Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:838bfa4c-2eb7-4f76-a6c3-ab4684f3913c","source":"wordfence","cve":"CVE-2024-9368","title":"Aggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/838bfa4c-2eb7-4f76-a6c3-ab4684f3913c?source=api-prod","affected":[{"type":"plugin","slug":"aggregator-advanced-settings","name":"Aggregator Advanced Settings","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-03T13:31:42Z","updated":"2024-10-04T02:04:53Z"},{"id":"wordfence:838ccf02-2b01-42f8-b5bf-6fafbb2db673","source":"wordfence","cve":"CVE-2022-2558","title":"Simple Job Board <= 2.9.6 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/838ccf02-2b01-42f8-b5bf-6fafbb2db673?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":"2.9.10"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:838dd2f9-22e3-4833-9f55-09bd729fd6ed","source":"wordfence","cve":"CVE-2026-13359","title":"Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/838dd2f9-22e3-4833-9f55-09bd729fd6ed?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-09-08T13:43:13Z","updated":"2026-09-09T02:27:34Z"},{"id":"wordfence:8390ab61-197a-4eb7-a589-47bf46a0e123","source":"wordfence","cve":"CVE-2023-31086","title":"Simple Giveaways <= 2.46 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8390ab61-197a-4eb7-a589-47bf46a0e123?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.46","to_inclusive":true,"patched_in":"2.46.1"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83936cda-e868-44f6-be5d-f26086bc4688","source":"wordfence","cve":"CVE-2026-10630","title":"WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83936cda-e868-44f6-be5d-f26086bc4688?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.29","to_inclusive":true,"patched_in":"3.2.30"}],"published":"2026-08-24T13:26:34Z","updated":"2026-08-25T01:26:44Z"},{"id":"wordfence:8395e0c4-3feb-4551-9f2f-7b80cd187eca","source":"wordfence","cve":"CVE-2015-10137","title":"Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8395e0c4-3feb-4551-9f2f-7b80cd187eca?source=api-prod","affected":[{"type":"plugin","slug":"website-contact-form-with-file-upload","name":"Website Contact Form With File Upload","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.4"}],"published":"2015-04-12T00:00:00Z","updated":"2025-07-22T01:44:28Z"},{"id":"wordfence:8396c124-9c72-4801-8964-1cd5fbd52d20","source":"wordfence","cve":"CVE-2026-6454","title":"Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8396c124-9c72-4801-8964-1cd5fbd52d20?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.20","to_inclusive":true,"patched_in":"2.3.21"}],"published":"2026-07-23T14:27:39Z","updated":"2026-07-24T02:32:00Z"},{"id":"wordfence:8396cd8d-6546-4014-9109-bd407fd7d363","source":"wordfence","cve":"CVE-2026-94268","title":"Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8396cd8d-6546-4014-9109-bd407fd7d363?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.9.2.7","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"},{"type":"plugin","slug":"acf-extended-pro","name":"Advanced Custom Fields: Extended PRO","from":"0.9.2.7","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:48:29Z"},{"id":"wordfence:8397e583-a8f5-422c-805d-c43328c4bc84","source":"wordfence","cve":"CVE-2026-34889","title":"Ultimate Addons for WPBakery Page Builder < 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8397e583-a8f5-422c-805d-c43328c4bc84?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.4","to_inclusive":false,"patched_in":"3.21.4"}],"published":"2026-04-01T00:00:00Z","updated":"2026-04-09T16:22:09Z"},{"id":"wordfence:839957ea-5186-4cce-971d-57eed84639d5","source":"wordfence","cve":"CVE-2019-14328","title":"Simple Membership <= 3.8.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839957ea-5186-4cce-971d-57eed84639d5?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":false,"patched_in":"3.8.5"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:839a0cc0-a656-4107-a748-4ad85e950237","source":"wordfence","cve":"CVE-2021-4361","title":"JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839a0cc0-a656-4107-a748-4ad85e950237?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:839b68e6-0462-4f88-ac13-ed4b69887d6b","source":"wordfence","cve":"CVE-2024-43282","title":"Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839b68e6-0462-4f88-ac13-ed4b69887d6b?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:40:50Z"},{"id":"wordfence:839c29bd-c064-495c-9c4f-37e12843336f","source":"wordfence","cve":"CVE-2025-23930","title":"PayPal Marketing Solutions <= 1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839c29bd-c064-495c-9c4f-37e12843336f?source=api-prod","affected":[{"type":"plugin","slug":"paypal-promotions-and-insights","name":"PayPal Marketing Solutions","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:17:30Z"},{"id":"wordfence:839c3b99-189d-4a74-b295-d44eb39d86c8","source":"wordfence","cve":"CVE-2025-9993","title":"Bei Fen \u2013 WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839c3b99-189d-4a74-b295-d44eb39d86c8?source=api-prod","affected":[{"type":"plugin","slug":"bei-fen","name":"Bei Fen \u2013 WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:30:29Z","updated":"2025-09-30T03:35:27Z"},{"id":"wordfence:839ecd06-9c74-4ddc-b455-26ec3e627889","source":"wordfence","cve":"CVE-2024-8991","title":"OSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/839ecd06-9c74-4ddc-b455-26ec3e627889?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-09-26T18:40:16Z","updated":"2024-09-27T06:53:59Z"},{"id":"wordfence:83a0150d-a9fa-4cc2-8fe8-a429747a9964","source":"wordfence","cve":"CVE-2024-5818","title":"Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a0150d-a9fa-4cc2-8fe8-a429747a9964?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.980","to_inclusive":true,"patched_in":"1.3.981"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T12:43:44Z"},{"id":"wordfence:83a2abb6-ecc8-446f-a99b-603d65872d29","source":"wordfence","cve":"CVE-2024-54278","title":"News Ticker for Elementor <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a2abb6-ecc8-446f-a99b-603d65872d29?source=api-prod","affected":[{"type":"plugin","slug":"news-ticker-for-elementor","name":"News Ticker for Elementor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T09:10:10Z"},{"id":"wordfence:83a2dcbb-bd7d-49b2-ab90-38e76679ae2f","source":"wordfence","cve":"CVE-2026-78258","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a2dcbb-bd7d-49b2-ab90-38e76679ae2f?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T15:56:04Z"},{"id":"wordfence:83a35d16-526d-4e45-b2cf-a6858b2b2f21","source":"wordfence","cve":"CVE-2024-3473","title":"Header Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via message","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a35d16-526d-4e45-b2cf-a6858b2b2f21?source=api-prod","affected":[{"type":"plugin","slug":"99robots-header-footer-code-manager-pro","name":"Header Footer Code Manager Pro","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:57:16Z"},{"id":"wordfence:83a3ed21-bfef-4aef-a32d-5af5be23a067","source":"wordfence","cve":"CVE-2024-43212","title":"WpTravelly <= 1.7.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a3ed21-bfef-4aef-a32d-5af5be23a067?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-30T15:06:25Z"},{"id":"wordfence:83a3f61c-2385-456f-bca3-6d3f3ffd9694","source":"wordfence","cve":"CVE-2023-3954","title":"MultiParcels Shipping For WooCommerce <= 1.15.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a3f61c-2385-456f-bca3-6d3f3ffd9694?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.15.3","to_inclusive":true,"patched_in":"1.15.4"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83a4caa6-207d-4ca0-bf4e-e7701d9edf91","source":"wordfence","cve":"CVE-2025-59011","title":"Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a4caa6-207d-4ca0-bf4e-e7701d9edf91?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2025-09-06T00:00:00Z","updated":"2025-10-15T18:12:12Z"},{"id":"wordfence:83a58119-d0ed-47fe-93d1-1aa1def2cf44","source":"wordfence","cve":"CVE-2025-2525","title":"Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a58119-d0ed-47fe-93d1-1aa1def2cf44?source=api-prod","affected":[{"type":"theme","slug":"streamit","name":"Streamit","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T01:44:21Z"},{"id":"wordfence:83a595b7-379c-4202-abdd-d8ba4a30c6a4","source":"wordfence","cve":"CVE-2024-1772","title":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a595b7-379c-4202-abdd-d8ba4a30c6a4?source=api-prod","affected":[{"type":"plugin","slug":"play-ht","name":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-03-13T15:27:01Z"},{"id":"wordfence:83a7e451-6d8f-48aa-9774-46e3d4434330","source":"wordfence","cve":"CVE-2026-24522","title":"Subscribe <= 1.2.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a7e451-6d8f-48aa-9774-46e3d4434330?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscribe","name":"WP Subscribe","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":""}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T16:22:54Z"},{"id":"wordfence:83a81b1c-40cf-43ea-a36d-eaf342e65fc2","source":"wordfence","cve":"CVE-2024-34765","title":"Sensei Pro (WC Paid Courses) <= 4.23.1.1.23.1 - Authenticated (Student+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a81b1c-40cf-43ea-a36d-eaf342e65fc2?source=api-prod","affected":[{"type":"plugin","slug":"woothemes-sensei","name":"Sensei Pro (WC Paid Courses)","from":"*","from_inclusive":true,"to":"4.23.1.1.23.1","to_inclusive":true,"patched_in":"4.24.0.1.24.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:24:26Z"},{"id":"wordfence:83a8c282-8552-420d-842f-acd235ad61b8","source":"wordfence","cve":"CVE-2026-116610","title":"Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83a8c282-8552-420d-842f-acd235ad61b8?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.20.1","to_inclusive":true,"patched_in":"1.21"}],"published":"2026-10-27T17:34:59Z","updated":"2026-10-28T06:45:15Z"},{"id":"wordfence:83aa1e83-45ff-4aa5-9c06-f79bdc3bf6c0","source":"wordfence","cve":"CVE-2026-27377","title":"QuickCal <= 1.0.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83aa1e83-45ff-4aa5-9c06-f79bdc3bf6c0?source=api-prod","affected":[{"type":"plugin","slug":"quickcal","name":"QuickCal","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:34:03Z"},{"id":"wordfence:83abcebf-2d39-4ccd-9606-1a1b04f79675","source":"wordfence","cve":"CVE-2025-59556","title":"GoStore < 1.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83abcebf-2d39-4ccd-9606-1a1b04f79675?source=api-prod","affected":[{"type":"theme","slug":"gostore","name":"GoStore - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-29T15:13:59Z"},{"id":"wordfence:83ac0dfc-88cd-48f0-9914-2258d5dfe834","source":"wordfence","cve":"CVE-2023-24009","title":"Upfrontwp <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83ac0dfc-88cd-48f0-9914-2258d5dfe834?source=api-prod","affected":[{"type":"theme","slug":"upfrontwp","name":"Upfrontwp","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83ad7ab2-4257-4aac-9388-bfcbc2938984","source":"wordfence","cve":"CVE-2011-5128","title":"Adminimize < 1.7.22 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83ad7ab2-4257-4aac-9388-bfcbc2938984?source=api-prod","affected":[{"type":"plugin","slug":"adminimize","name":"Adminimize","from":"*","from_inclusive":true,"to":"1.7.22","to_inclusive":false,"patched_in":"1.7.22"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83adfbff-f625-4474-81b9-961c496d59a0","source":"wordfence","cve":"CVE-2026-104003","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83adfbff-f625-4474-81b9-961c496d59a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.5","to_inclusive":true,"patched_in":"4.17.6"}],"published":"2026-10-15T19:57:58Z","updated":"2026-10-16T08:27:43Z"},{"id":"wordfence:83af4ee4-2763-4706-8cb2-fa102a72be68","source":"wordfence","cve":"CVE-2024-13709","title":"Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83af4ee4-2763-4706-8cb2-fa102a72be68?source=api-prod","affected":[{"type":"plugin","slug":"linear","name":"Linear","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2025-01-24T14:38:51Z","updated":"2025-11-05T19:08:36Z"},{"id":"wordfence:83b03f44-aed4-4f50-94db-8ad1c560be34","source":"wordfence","cve":"CVE-2025-64296","title":"Facebook for WooCommerce <= 3.5.7 - Missing Authorization to Unauthenticated Notification Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b03f44-aed4-4f50-94db-8ad1c560be34?source=api-prod","affected":[{"type":"plugin","slug":"facebook-for-woocommerce","name":"Meta for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-04T14:37:11Z"},{"id":"wordfence:83b0534e-1b8d-46a8-9698-e7ca73e5ab57","source":"wordfence","cve":"CVE-2022-2633","title":"All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0534e-1b8d-46a8-9698-e7ca73e5ab57?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"2.5.8","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83b062c8-4884-4ffa-89e6-71140c99e422","source":"wordfence","cve":"","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b062c8-4884-4ffa-89e6-71140c99e422?source=api-prod","affected":[{"type":"plugin","slug":"mapsmarker","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2012-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83b0ae2c-6b08-4b71-a728-c60722ec20c7","source":"wordfence","cve":"CVE-2025-13318","title":"Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0ae2c-6b08-4b71-a728-c60722ec20c7?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.60","to_inclusive":true,"patched_in":"1.2.61"}],"published":"2025-11-21T19:35:42Z","updated":"2025-11-22T08:30:29Z"},{"id":"wordfence:83b1740c-6392-4b52-82e0-377201aa61ac","source":"wordfence","cve":"CVE-2008-0837","title":"Search Unleashed <= 0.2.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b1740c-6392-4b52-82e0-377201aa61ac?source=api-prod","affected":[{"type":"plugin","slug":"search-unleashed","name":"Search Unleashed","from":"*","from_inclusive":true,"to":"0.2.10","to_inclusive":true,"patched_in":"0.2.11"}],"published":"2008-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83b2226e-0b30-4a1e-9757-8afc76435211","source":"wordfence","cve":"CVE-2025-32667","title":"Doppler Forms <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b2226e-0b30-4a1e-9757-8afc76435211?source=api-prod","affected":[{"type":"plugin","slug":"doppler-form","name":"Doppler Easy Multichannel Marketing enhanced with IA","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-10-10T20:44:56Z"},{"id":"wordfence:83b48cfc-04e7-4929-8da2-cf6beee6d88e","source":"wordfence","cve":"CVE-2023-44476","title":"CopyRightPro <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b48cfc-04e7-4929-8da2-cf6beee6d88e?source=api-prod","affected":[{"type":"plugin","slug":"copyrightpro","name":"CopyRightPro","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83b91ce9-a060-47db-8120-bbed45889f9f","source":"wordfence","cve":"CVE-2024-39679","title":"Cooked \u2013 Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Template Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83b91ce9-a060-47db-8120-bbed45889f9f?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-09T14:01:19Z"},{"id":"wordfence:83bd221e-7d01-4cba-8577-ce0a69e4a75c","source":"wordfence","cve":"","title":"WPsc MijnPress <= 0.0.1 - Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83bd221e-7d01-4cba-8577-ce0a69e4a75c?source=api-prod","affected":[{"type":"plugin","slug":"wpsc-mijnpress","name":"WPsc MijnPress","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2012-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83bd48fb-f5f9-4d3d-8fc4-a06adfa5a225","source":"wordfence","cve":"CVE-2024-12164","title":"WPSyncSheets Lite For WPForms \u2013 WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83bd48fb-f5f9-4d3d-8fc4-a06adfa5a225?source=api-prod","affected":[{"type":"plugin","slug":"wpsyncsheets-wpforms","name":"WPSyncSheets For WPForms \u2013 Google Sheets Connector for WPForms & Real\u2011Time Data Export","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:14Z"},{"id":"wordfence:83bf3f3d-49f1-473a-a9ee-d78eb8981ad3","source":"wordfence","cve":"CVE-2025-6086","title":"CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83bf3f3d-49f1-473a-a9ee-d78eb8981ad3?source=api-prod","affected":[{"type":"plugin","slug":"csv-me","name":"CSV Me","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-17T20:42:24Z","updated":"2025-06-18T09:21:31Z"},{"id":"wordfence:83c0e096-f054-4367-a85f-582c0771e3fe","source":"wordfence","cve":"CVE-2022-3747","title":"Becustom <= 1.0.5.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83c0e096-f054-4367-a85f-582c0771e3fe?source=api-prod","affected":[{"type":"plugin","slug":"becustom","name":"Becustom","from":"*","from_inclusive":true,"to":"1.0.5.2","to_inclusive":true,"patched_in":"1.0.5.3"}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83c47201-f5b7-4ca4-90ab-f886af24db43","source":"wordfence","cve":"CVE-2026-107867","title":"JetProductTables <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83c47201-f5b7-4ca4-90ab-f886af24db43?source=api-prod","affected":[{"type":"plugin","slug":"jet-product-tables","name":"JetProductTables","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.4.1"}],"published":"2026-10-12T00:00:00Z","updated":"2026-11-03T19:36:42Z"},{"id":"wordfence:83c4a78e-f3e9-442d-99de-915a64132c32","source":"wordfence","cve":"CVE-2025-52806","title":"JobSearch < 3.0.8 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83c4a78e-f3e9-442d-99de-915a64132c32?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2025-08-14T00:00:00Z","updated":"2025-10-08T16:56:41Z"},{"id":"wordfence:83c97e9b-a5bc-4059-8355-f93a7a36037c","source":"wordfence","cve":"CVE-2026-39496","title":"YayMail <= 4.3.3 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83c97e9b-a5bc-4059-8355-f93a7a36037c?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-03-15T00:00:00Z","updated":"2026-04-15T21:25:43Z"},{"id":"wordfence:83cb1333-3c74-426d-9838-a5cb90be29b2","source":"wordfence","cve":"CVE-2022-38055","title":"wpForo Forum <= 2.0.9 - Authenticated (Subscriber+) HTML Injection","severity":"medium","cvss":5.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83cb1333-3c74-426d-9838-a5cb90be29b2?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83cdc51f-b5e1-42b9-972a-7e781f97b43e","source":"wordfence","cve":"CVE-2026-17538","title":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83cdc51f-b5e1-42b9-972a-7e781f97b43e?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"5.6.10"}],"published":"2026-10-07T11:12:20Z","updated":"2026-10-07T23:27:15Z"},{"id":"wordfence:83d162f9-32a9-4d03-845e-6fc9b8574fb5","source":"wordfence","cve":"CVE-2023-25961","title":"Darcie <= 1.1.5 - Reflected Cross-Site Scripting via JS split","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d162f9-32a9-4d03-845e-6fc9b8574fb5?source=api-prod","affected":[{"type":"theme","slug":"darcie","name":"Darcie","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83d46dce-b218-49ed-85ee-0e8d2a391eb9","source":"wordfence","cve":"","title":"Contact Form Entries \u2013 Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d46dce-b218-49ed-85ee-0e8d2a391eb9?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83d4e8d6-079e-4615-bdc8-b3e20060727f","source":"wordfence","cve":"CVE-2025-60229","title":"Lagom <= 2.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d4e8d6-079e-4615-bdc8-b3e20060727f?source=api-prod","affected":[{"type":"theme","slug":"lagom","name":"Lagom","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2026-07-10T19:04:35Z"},{"id":"wordfence:83d4f114-c113-4c66-be74-2d438aa00502","source":"wordfence","cve":"CVE-2013-2700","title":"WP125 <= 1.4.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d4f114-c113-4c66-be74-2d438aa00502?source=api-prod","affected":[{"type":"plugin","slug":"wp125","name":"WP125","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2013-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83d50e66-85d9-4514-9020-96cfcab50d96","source":"wordfence","cve":"CVE-2026-28048","title":"FlashMart <= 2.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d50e66-85d9-4514-9020-96cfcab50d96?source=api-prod","affected":[{"type":"theme","slug":"flashmart","name":"FlashMart - Multipurpose Sections Shopify Theme","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-05T15:55:30Z"},{"id":"wordfence:83d5337b-8c06-41ee-b18c-2c39150a7f30","source":"wordfence","cve":"CVE-2025-2330","title":"All-in-One Addons for Elementor \u2013 WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d5337b-8c06-41ee-b18c-2c39150a7f30?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-07-01T20:38:15Z","updated":"2025-07-02T09:23:24Z"},{"id":"wordfence:83d63545-00f3-411b-9d4a-6837759bc3af","source":"wordfence","cve":"CVE-2024-49229","title":"Better Author Bio <= 2.7.10.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d63545-00f3-411b-9d4a-6837759bc3af?source=api-prod","affected":[{"type":"plugin","slug":"better-author-bio","name":"Better Author Bio","from":"*","from_inclusive":true,"to":"2.7.10.11","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:34:18Z"},{"id":"wordfence:83d69f7b-0f98-43d3-baef-51216e26d357","source":"wordfence","cve":"CVE-2025-30871","title":"WP Travel Engine <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d69f7b-0f98-43d3-baef-51216e26d357?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:50:48Z"},{"id":"wordfence:83d71349-ddef-492d-8fc6-eb73d379cac2","source":"wordfence","cve":"CVE-2025-53426","title":"Likert Survey Master <= 0.8.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d71349-ddef-492d-8fc6-eb73d379cac2?source=api-prod","affected":[{"type":"plugin","slug":"likert-survey-master","name":"Likert Survey Master","from":"*","from_inclusive":true,"to":"0.8.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-20T00:00:00Z","updated":"2025-11-04T17:00:10Z"},{"id":"wordfence:83d78ff7-bd59-431e-b579-156e23ede053","source":"wordfence","cve":"CVE-2024-4385","title":"Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d78ff7-bd59-431e-b579-156e23ede053?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.8.16","to_inclusive":true,"patched_in":"1.8.17"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T11:05:28Z"},{"id":"wordfence:83d7bf88-5def-4663-a446-dc205f2cd671","source":"wordfence","cve":"CVE-2025-9512","title":"Schema & Structured Data for WP & AMP <= 1.49 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d7bf88-5def-4663-a446-dc205f2cd671?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.49","to_inclusive":true,"patched_in":"1.50"}],"published":"2025-09-10T00:00:00Z","updated":"2025-10-15T17:51:30Z"},{"id":"wordfence:83d935fc-7d7b-4c25-97f8-d3fe35307c7a","source":"wordfence","cve":"CVE-2023-28413","title":"Snow Monkey Forms <= 5.1.1 - Directory Traversal via 'view' REST endpiont","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83d935fc-7d7b-4c25-97f8-d3fe35307c7a?source=api-prod","affected":[{"type":"plugin","slug":"snow-monkey-forms","name":"Snow Monkey Forms","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83dcf56d-d483-4fac-8c70-d14a1e6c975d","source":"wordfence","cve":"CVE-2025-68568","title":"Claspo \u2013 Popups, Spin the Wheel & Email Capture <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83dcf56d-d483-4fac-8c70-d14a1e6c975d?source=api-prod","affected":[{"type":"plugin","slug":"claspo","name":"Popup Builder by Claspo \u2013 Email Popup, Spin the Wheel, Exit Intent","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-12-17T00:00:00Z","updated":"2026-02-26T15:23:04Z"},{"id":"wordfence:83dfd6a2-2944-42a9-9e3d-60836ebfb106","source":"wordfence","cve":"CVE-2025-53200","title":"ChatBot <= 6.7.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83dfd6a2-2944-42a9-9e3d-60836ebfb106?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"6.7.3","to_inclusive":true,"patched_in":"6.7.5"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:34:00Z"},{"id":"wordfence:83e1f631-28ec-4924-9d69-caaba00fe276","source":"wordfence","cve":"CVE-2024-12697","title":"real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e1f631-28ec-4924-9d69-caaba00fe276?source=api-prod","affected":[{"type":"plugin","slug":"real-kit","name":"real.Kit","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T18:47:59Z","updated":"2024-12-21T07:03:01Z"},{"id":"wordfence:83e396c3-e843-4337-bf90-894d9d7de2a8","source":"wordfence","cve":"CVE-2021-24167","title":"Web-Stat <= 1.4.0 - API Key Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e396c3-e843-4337-bf90-894d9d7de2a8?source=api-prod","affected":[{"type":"plugin","slug":"web-stat","name":"Web-Stat \u2013 Live Visitor Analytics","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2021-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83e53dc4-84fe-4835-aaea-b72dfe8f7475","source":"wordfence","cve":"CVE-2021-24144","title":"Contact Form 7 Database Addon <= 1.2.5.4 - CSV Injection","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e53dc4-84fe-4835-aaea-b72dfe8f7475?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.5.6","to_inclusive":false,"patched_in":"1.2.5.6"}],"published":"2021-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83e5a0dc-fc51-4565-945f-190cf9175874","source":"wordfence","cve":"CVE-2023-5199","title":"PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode","severity":"critical","cvss":9.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e5a0dc-fc51-4565-945f-190cf9175874?source=api-prod","affected":[{"type":"plugin","slug":"php-to-page","name":"PHP to Page","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83e672e7-2483-46e9-ae16-a9e7ccc4bcb8","source":"wordfence","cve":"CVE-2026-103896","title":"10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83e672e7-2483-46e9-ae16-a9e7ccc4bcb8?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.34.5","to_inclusive":true,"patched_in":"2.34.8"}],"published":"2026-10-15T17:03:48Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:83ea2ec3-5d5b-44ea-83e6-41c4fa6e2e5f","source":"wordfence","cve":"CVE-2024-3889","title":"Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via  Advanced Accordion Title Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83ea2ec3-5d5b-44ea-83e6-41c4fa6e2e5f?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.971","to_inclusive":true,"patched_in":"1.3.972"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T05:35:22Z"},{"id":"wordfence:83ec5fa5-2fd9-4c7d-a2f1-de885746d2d3","source":"wordfence","cve":"CVE-2006-5705","title":"WordPress Core <= 2.0.4 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83ec5fa5-2fd9-4c7d-a2f1-de885746d2d3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2006-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83eee860-ce3a-419c-937f-0fa24e04b04b","source":"wordfence","cve":"CVE-2025-62138","title":"Advanced PDF <= 1.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83eee860-ce3a-419c-937f-0fa24e04b04b?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-pdf","name":"WP Advanced PDF","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:20:45Z"},{"id":"wordfence:83f1777b-aa44-40a3-84d5-5743d64b1533","source":"wordfence","cve":"CVE-2026-110524","title":"Copy Anything to Clipboard for WordPress \u2013 Copy Button, Copy Text & Copy Code < 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f1777b-aa44-40a3-84d5-5743d64b1533?source=api-prod","affected":[{"type":"plugin","slug":"copy-the-code","name":"Copy Anything to Clipboard for WordPress \u2013 Copy Button, Copy Text & Copy Code","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":false,"patched_in":"5.5.5"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:17:55Z"},{"id":"wordfence:83f21ed2-305a-4c5c-a2d5-7ddc35a7459b","source":"wordfence","cve":"CVE-2025-62982","title":"Dynamic User Directory <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f21ed2-305a-4c5c-a2d5-7ddc35a7459b?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-user-directory","name":"Dynamic User Directory","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-13T15:58:45Z"},{"id":"wordfence:83f2ceee-4422-4ed5-adc7-91bc022ae42d","source":"wordfence","cve":"CVE-2025-2803","title":"So-Called Air Quotes <= 0.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f2ceee-4422-4ed5-adc7-91bc022ae42d?source=api-prod","affected":[{"type":"plugin","slug":"so-called-air-quotes","name":"So-Called Air Quotes","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T18:38:14Z","updated":"2025-03-29T07:03:30Z"},{"id":"wordfence:83f6bdda-e489-4e85-b510-7bfaa2329609","source":"wordfence","cve":"","title":"Page Generator <= 1.6.5 - Cross-Site Request Forgery to Arbitrary Keywords Deletion/Duplication","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f6bdda-e489-4e85-b510-7bfaa2329609?source=api-prod","affected":[{"type":"plugin","slug":"page-generator","name":"Bulk Page Generator and Mass Page Builder \u2013 Page Generator","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83f6c9fb-4ee7-42c0-9369-a0d577dd485f","source":"wordfence","cve":"CVE-2024-49657","title":"3D Work In Progress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f6c9fb-4ee7-42c0-9369-a0d577dd485f?source=api-prod","affected":[{"type":"plugin","slug":"renee-work-in-progress","name":"3D Work In Progress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:11:44Z"},{"id":"wordfence:83f7d9b9-793e-4380-b971-bc13c77a06a8","source":"wordfence","cve":"CVE-2024-11408","title":"Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f7d9b9-793e-4380-b971-bc13c77a06a8?source=api-prod","affected":[{"type":"plugin","slug":"slotti-ajanvaraus","name":"Slotti Ajanvaraus","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:20Z"},{"id":"wordfence:83f8adea-4735-4c72-b274-58e813cab6ab","source":"wordfence","cve":"CVE-2016-6896","title":"WordPress Core <= 4.5.3 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83f8adea-4735-4c72-b274-58e813cab6ab?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":false,"patched_in":"4.6"}],"published":"2016-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83fd4f00-e8a8-4a33-af6b-20ff539fbfeb","source":"wordfence","cve":"","title":"MoneyTheme (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83fd4f00-e8a8-4a33-af6b-20ff539fbfeb?source=api-prod","affected":[{"type":"theme","slug":"moneytheme","name":"MoneyTheme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:83fe5090-744e-4541-8015-34a8256f256e","source":"wordfence","cve":"CVE-2026-106602","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/83fe5090-744e-4541-8015-34a8256f256e?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"16.2","to_inclusive":true,"patched_in":"16.3"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:38:52Z"},{"id":"wordfence:84003388-c47c-41db-8d2d-4643aa375a89","source":"wordfence","cve":"","title":"Appsero <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84003388-c47c-41db-8d2d-4643aa375a89?source=api-prod","affected":[{"type":"plugin","slug":"pt-elementor-addons-lite","name":"PT Addons for Elementor Lite","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.37","to_inclusive":true,"patched_in":"10.38"},{"type":"plugin","slug":"wepos","name":"wePOS \u2013 Point Of Sale (POS) for WooCommerce & Dokan","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"easy-video-reviews","name":"Easy Video Reviews \u2013 Testimonial Grid & Social Proof","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"worth-the-read","name":"Worth The Read","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":"1.14.1"},{"type":"plugin","slug":"woostify-sites-library","name":"Woostify Sites Library","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"2.12.14","to_inclusive":true,"patched_in":"2.12.15"},{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"wp-edit-password-protected","name":"WPEPP \u2013 All In One WordPress Security, Firewall, Malware Scanner & Login Protection","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"woo-product-gallery-slider","name":"Product Gallery Slider, Additional Variation Images for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"},{"type":"plugin","slug":"dark-mode","name":"Markdown Editor (Formerly Dark Mode)","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"},{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":true,"patched_in":"2.6.13"},{"type":"plugin","slug":"dashboard-welcome-for-elementor","name":"Dashboard Welcome for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"},{"type":"plugin","slug":"fuse-social-floating-sidebar","name":"Fuse Social Icons","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"},{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"},{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.28.0","to_inclusive":true,"patched_in":"3.28.1"},{"type":"plugin","slug":"woo-category-slider-by-pluginever","name":"Product Category Slider for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"},{"type":"plugin","slug":"webinar-and-video-conference-with-jitsi-meet","name":"FlexMeeting \u2013 Webinar & Meeting Plugin for Jitsi Meet","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"},{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":"1.14.2"},{"type":"plugin","slug":"stax-buddy-builder","name":"BuddyPress Builder for Elementor \u2013 BuddyBuilder","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"},{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"},{"type":"plugin","slug":"woocommerce-conversion-tracking","name":"Conversion Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"},{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"},{"type":"plugin","slug":"wp-maximum-upload-file-size","name":"EasyMedia \u2013 Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"1.6","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"},{"type":"plugin","slug":"bangladeshi-payment-gateways","name":"Bangladeshi Payment Gateways \u2013 Make Payment Using QR Code","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"},{"type":"plugin","slug":"texty","name":"Texty \u2013 SMS Notification for WordPress, WooCommerce, Dokan and more","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"visibility-logic-elementor","name":"Visibility Logic for Elementor","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"},{"type":"plugin","slug":"webappick-pdf-invoice-for-woocommerce","name":"PDF Invoices & Packing Slips for WooCommerce \u2013 Challan Invoice Plugin","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"},{"type":"plugin","slug":"darklup-lite-wp-dark-mode","name":"Darklup \u2013 Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"exclusive-team-for-elementor","name":"Exclusive Team for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"click-to-top","name":"Click to top","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"},{"type":"plugin","slug":"update-alt-attribute","name":"Update Image Tag Alt Attribute","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"magical-posts-display","name":"Magical Posts Display \u2013 Elementor Advanced Posts widgets","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"},{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"},{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"1.10.5","from_inclusive":true,"to":"1.10.5","to_inclusive":true,"patched_in":"1.11.0"},{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"},{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"},{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"},{"type":"plugin","slug":"gallery-box","name":"Gallery Box","from":"*","from_inclusive":true,"to":"1.7.30","to_inclusive":true,"patched_in":"1.7.31"},{"type":"plugin","slug":"unlimited-elementor-inner-sections-by-boomdevs","name":"Prime Elementor Addons \u2013 Lightweight Elementor Widgets for Faster Pages","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"woo-reviews-by-wiremo","name":"Wiremo \u2013 Product Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.96","to_inclusive":true,"patched_in":"1.4.97"},{"type":"plugin","slug":"cart-lift","name":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"},{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"},{"type":"plugin","slug":"wc-category-showcase","name":"Product Category Showcase for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-16T00:00:00Z","updated":"2024-11-13T15:47:37Z"},{"id":"wordfence:84019c69-32fd-4331-95d7-53ea1aaff616","source":"wordfence","cve":"","title":"MainWP Child \u2013 Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84019c69-32fd-4331-95d7-53ea1aaff616?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.0.9.2","to_inclusive":false,"patched_in":"2.0.9.2"}],"published":"2015-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8405e80d-fd72-4d87-b08a-19a686eb2982","source":"wordfence","cve":"CVE-2025-14367","title":"Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8405e80d-fd72-4d87-b08a-19a686eb2982?source=api-prod","affected":[{"type":"plugin","slug":"easy-theme-options","name":"Easy Theme Options","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:05:27Z","updated":"2025-12-13T04:31:28Z"},{"id":"wordfence:8407b678-76c5-4232-b17e-8db05f9e7b12","source":"wordfence","cve":"CVE-2023-51492","title":"If-So Dynamic Content Personalization <= 1.6.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8407b678-76c5-4232-b17e-8db05f9e7b12?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.6.3.1","to_inclusive":true,"patched_in":"1.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84090828-f132-4848-8d84-dfff79b44818","source":"wordfence","cve":"CVE-2024-52406","title":"CSV to html <= 3.26 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84090828-f132-4848-8d84-dfff79b44818?source=api-prod","affected":[{"type":"plugin","slug":"csv-to-html","name":"CSV to HTML","from":"*","from_inclusive":true,"to":"3.26","to_inclusive":true,"patched_in":"3.27"}],"published":"2024-11-13T00:00:00Z","updated":"2025-01-20T21:49:53Z"},{"id":"wordfence:840b2211-7061-4ab9-976f-2cb09a429eb5","source":"wordfence","cve":"CVE-2025-31577","title":"Appointify <= 1.0.8 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840b2211-7061-4ab9-976f-2cb09a429eb5?source=api-prod","affected":[{"type":"plugin","slug":"appointify","name":"Appointify","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T13:48:51Z"},{"id":"wordfence:840b4382-8175-4811-995c-2828fabcd97c","source":"wordfence","cve":"CVE-2016-20070","title":"Booking Calendar Contact Form <= 1.0.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840b4382-8175-4811-995c-2828fabcd97c?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-17T04:02:18Z"},{"id":"wordfence:840ba5b2-838a-455a-b39d-865f89c05249","source":"wordfence","cve":"CVE-2025-11166","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840ba5b2-838a-455a-b39d-865f89c05249?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.46","to_inclusive":true,"patched_in":"9.0.47"}],"published":"2025-10-08T13:41:56Z","updated":"2025-10-09T01:48:48Z"},{"id":"wordfence:840dd4a9-103a-4ff9-ba26-3bf5b6e831a1","source":"wordfence","cve":"CVE-2024-5611","title":"Stratum \u2013 Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840dd4a9-103a-4ff9-ba26-3bf5b6e831a1?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-06-14T21:36:24Z","updated":"2024-06-15T09:43:51Z"},{"id":"wordfence:840e9a50-ce53-4b9a-b6ae-c5016e11373b","source":"wordfence","cve":"CVE-2022-1576","title":"WP Maintenance Mode & Coming Soon <= 2.4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840e9a50-ce53-4b9a-b6ae-c5016e11373b?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:840f54c4-898d-40f3-ad0b-fb1a359165e5","source":"wordfence","cve":"CVE-2025-25151","title":"uListing <= 2.1.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840f54c4-898d-40f3-ad0b-fb1a359165e5?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:59:29Z"},{"id":"wordfence:840fd950-3ce3-4068-b8bc-270f168a5091","source":"wordfence","cve":"CVE-2025-14032","title":"Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840fd950-3ce3-4068-b8bc-270f168a5091?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-12-11T15:10:30Z","updated":"2025-12-12T16:02:43Z"},{"id":"wordfence:840fefde-8c9d-413f-a6a6-1e796fb9e910","source":"wordfence","cve":"CVE-2025-7826","title":"Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/840fefde-8c9d-413f-a6a6-1e796fb9e910?source=api-prod","affected":[{"type":"plugin","slug":"indianic-testimonial","name":"Testimonial","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-09T17:41:44Z","updated":"2025-09-10T06:38:48Z"},{"id":"wordfence:84141197-b6a7-44fa-8058-e9f192d1d56f","source":"wordfence","cve":"CVE-2024-43954","title":"Droip < 2.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84141197-b6a7-44fa-8058-e9f192d1d56f?source=api-prod","affected":[{"type":"plugin","slug":"droip","name":"Droip","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2024-08-26T00:00:00Z","updated":"2025-12-19T15:43:49Z"},{"id":"wordfence:8416b394-28ae-41de-8784-2ae39f4d201f","source":"wordfence","cve":"CVE-2025-7669","title":"Avishi WP PayPal Payment Button <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8416b394-28ae-41de-8784-2ae39f4d201f?source=api-prod","affected":[{"type":"plugin","slug":"avishi-wp-paypal-payment-button","name":"Avishi WP PayPal Payment Button","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T14:11:43Z","updated":"2025-07-19T02:22:58Z"},{"id":"wordfence:841a028d-ff36-4e3f-903b-e25951648075","source":"wordfence","cve":"CVE-2024-12620","title":"AnimateGL Animations for WordPress \u2013 Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/841a028d-ff36-4e3f-903b-e25951648075?source=api-prod","affected":[{"type":"plugin","slug":"animategl","name":"AnimateGL \u2013 WebGL & CSS Scroll Animations and Hover Effects for Gutenberg and Elementor","from":"*","from_inclusive":true,"to":"1.4.23","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T14:42:26Z","updated":"2025-02-01T03:21:12Z"},{"id":"wordfence:841adf53-930a-4286-96d0-9ee8b0c188c4","source":"wordfence","cve":"CVE-2025-13839","title":"LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/841adf53-930a-4286-96d0-9ee8b0c188c4?source=api-prod","affected":[{"type":"plugin","slug":"ljusers","name":"LJUsers","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:19:27Z","updated":"2025-12-12T02:20:56Z"},{"id":"wordfence:841e999a-3501-4295-bfea-8027a5ed3308","source":"wordfence","cve":"CVE-2026-65528","title":"BSK PDF Manager <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/841e999a-3501-4295-bfea-8027a5ed3308?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-14T15:21:17Z"},{"id":"wordfence:84227fd2-c322-45e3-82cd-70e1d870eceb","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84227fd2-c322-45e3-82cd-70e1d870eceb?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.4.1"}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84262b4a-a662-4aaf-9eae-f5cca8f6cd06","source":"wordfence","cve":"CVE-2024-4288","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84262b4a-a662-4aaf-9eae-f5cca8f6cd06?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.14","to_inclusive":true,"patched_in":"1.6.7.18"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T11:05:28Z"},{"id":"wordfence:8426920c-e0df-4a13-9f1f-2d6b6a5ab1ab","source":"wordfence","cve":"CVE-2025-31472","title":"Flatty <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8426920c-e0df-4a13-9f1f-2d6b6a5ab1ab?source=api-prod","affected":[{"type":"plugin","slug":"flatty-flat-admin-theme","name":"Flatty \u2013 Flat Admin Theme","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:33:48Z"},{"id":"wordfence:8429148b-e28e-4bb3-bd18-390216b74dc4","source":"wordfence","cve":"","title":"Request for Quote < 1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8429148b-e28e-4bb3-bd18-390216b74dc4?source=api-prod","affected":[{"type":"plugin","slug":"wpheka-request-for-quote","name":"WPHEKA Request For Quote for WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:842d12fd-86bc-4dd5-9926-ab4093d4c03e","source":"wordfence","cve":"CVE-2026-27351","title":"Employee, Leave and Recruitment Management System \u2013 Crew HRM <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/842d12fd-86bc-4dd5-9926-ab4093d4c03e?source=api-prod","affected":[{"type":"plugin","slug":"hr-management","name":"Employee, Leave and Recruitment Management System \u2013 Crew HRM","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:35:32Z"},{"id":"wordfence:842f3cb4-857e-4e9c-b84e-9a47ec65db0d","source":"wordfence","cve":"CVE-2025-9616","title":"PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/842f3cb4-857e-4e9c-b84e-9a47ec65db0d?source=api-prod","affected":[{"type":"plugin","slug":"popad","name":"PopAd","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-03T21:05:44Z","updated":"2025-09-04T09:22:24Z"},{"id":"wordfence:84366708-9dcc-4f34-b1b5-7d956e3801af","source":"wordfence","cve":"CVE-2018-10752","title":"Tagregator <= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84366708-9dcc-4f34-b1b5-7d956e3801af?source=api-prod","affected":[{"type":"plugin","slug":"tagregator","name":"Tagregator","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2018-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8436ba39-b236-4d76-95b6-d2bed3728d8a","source":"wordfence","cve":"CVE-2022-4109","title":"Wholesale Market for WooCommerce < 2.0.0 - Authenticated (Administrator+) Arbitrary Log File Download","severity":"medium","cvss":4.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8436ba39-b236-4d76-95b6-d2bed3728d8a?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market-for-woocommerce","name":"Wholesale Market for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8437abcc-3e34-4a8a-bfe2-2ff7c9f41164","source":"wordfence","cve":"CVE-2024-4092","title":"Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8437abcc-3e34-4a8a-bfe2-2ff7c9f41164?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.7.8"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:20Z"},{"id":"wordfence:843822f0-dd4c-4ae6-823d-96dd7a59df8e","source":"wordfence","cve":"CVE-2019-12239","title":"WP Booking System Free version < 1.5.2 - Cross-Site Request Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/843822f0-dd4c-4ae6-823d-96dd7a59df8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2019-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84389347-5dc2-4c58-bc73-1d7384241c2c","source":"wordfence","cve":"CVE-2024-56241","title":"WPKoi Templates for Elementor <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84389347-5dc2-4c58-bc73-1d7384241c2c?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:27:18Z"},{"id":"wordfence:8438ea46-9ac1-4ef5-a436-e438c35a4321","source":"wordfence","cve":"CVE-2023-31230","title":"Baidu Tongji generator <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8438ea46-9ac1-4ef5-a436-e438c35a4321?source=api-prod","affected":[{"type":"plugin","slug":"baidu-tongji-generator","name":"Baidu Tongji generator","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:843aae1e-f926-42b1-80fc-48910111b1f4","source":"wordfence","cve":"CVE-2025-25121","title":"Theme Options Z <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/843aae1e-f926-42b1-80fc-48910111b1f4?source=api-prod","affected":[{"type":"plugin","slug":"theme-options-z","name":"Theme Options Z","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:06:44Z"},{"id":"wordfence:843b569d-d70e-46ae-b8f1-65579f0af333","source":"wordfence","cve":"CVE-2026-27373","title":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/843b569d-d70e-46ae-b8f1-65579f0af333?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-17T13:11:19Z"},{"id":"wordfence:843cc5e7-7820-409c-8de0-bd70245811cd","source":"wordfence","cve":"CVE-2025-12401","title":"Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/843cc5e7-7820-409c-8de0-bd70245811cd?source=api-prod","affected":[{"type":"plugin","slug":"label-plugins","name":"Label Plugins","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:24:29Z","updated":"2025-11-04T03:26:46Z"},{"id":"wordfence:843ef712-6ca6-44d2-825f-7ce9a82d74e6","source":"wordfence","cve":"CVE-2022-2552","title":"Duplicator \u2013 WordPress Migration Plugin <= 1.4.7 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/843ef712-6ca6-44d2-825f-7ce9a82d74e6?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.7.1"}],"published":"2022-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8441e5f2-cff0-4f6c-a584-861650f5a121","source":"wordfence","cve":"CVE-2026-39595","title":"W3 Total Cache <= 2.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8441e5f2-cff0-4f6c-a584-861650f5a121?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-03-12T00:00:00Z","updated":"2026-07-10T19:22:28Z"},{"id":"wordfence:8442fc5c-c940-4dc2-88df-676248fbc00b","source":"wordfence","cve":"CVE-2024-56020","title":"SvegliaT Buttons <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8442fc5c-c940-4dc2-88df-676248fbc00b?source=api-prod","affected":[{"type":"plugin","slug":"svegliat-buttons","name":"SvegliaT Buttons","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:05:45Z"},{"id":"wordfence:8444429e-147f-434d-9602-e4a1e05f4a09","source":"wordfence","cve":"CVE-2025-67965","title":"Homey Core <= 2.4.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8444429e-147f-434d-9602-e4a1e05f4a09?source=api-prod","affected":[{"type":"plugin","slug":"homey-core","name":"Homey Core","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-12-10T00:00:00Z","updated":"2025-12-19T17:21:48Z"},{"id":"wordfence:8444743c-ba57-4a51-990c-eb9058829d09","source":"wordfence","cve":"CVE-2026-1904","title":"Simple Wp colorfull Accordion <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8444743c-ba57-4a51-990c-eb9058829d09?source=api-prod","affected":[{"type":"plugin","slug":"simple-wp-colorfull-accordion","name":"Simple Wp colorfull Accordion","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T16:22:48Z","updated":"2026-02-14T04:35:41Z"},{"id":"wordfence:8445140c-05ce-4d21-9367-97db0f33a47a","source":"wordfence","cve":"CVE-2025-62128","title":"SiteLock Security <= 5.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8445140c-05ce-4d21-9367-97db0f33a47a?source=api-prod","affected":[{"type":"plugin","slug":"sitelock","name":"SiteLock Security \u2013 WP Hardening, Login Security & Malware Scans","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T20:18:50Z"},{"id":"wordfence:8445aed7-107c-4627-9390-b4b5eb402b11","source":"wordfence","cve":"CVE-2023-32501","title":"VikBooking Hotel Booking Engine & PMS <= 1.6.1 - Cross-Site Request Forgery in listenTosFieldSavingTask function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8445aed7-107c-4627-9390-b4b5eb402b11?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8445f318-ef4e-45c5-be9b-6080833c3bb6","source":"wordfence","cve":"CVE-2024-6420","title":"Hide My WP Ghost \u2013 Security & Firewall <= 5.2.01 - Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8445f318-ef4e-45c5-be9b-6080833c3bb6?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.2.01","to_inclusive":true,"patched_in":"5.2.02"}],"published":"2024-07-02T00:00:00Z","updated":"2024-08-09T21:06:20Z"},{"id":"wordfence:84467bda-aaf8-45df-b4cc-f7e08d0c3848","source":"wordfence","cve":"CVE-2026-22333","title":"YITH WooCommerce Compare <= 3.6.0 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84467bda-aaf8-45df-b4cc-f7e08d0c3848?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2025-08-07T00:00:00Z","updated":"2026-05-04T14:59:13Z"},{"id":"wordfence:844b7471-3adf-45fd-9906-f0c817d6565c","source":"wordfence","cve":"CVE-2025-6832","title":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=api-prod","affected":[{"type":"plugin","slug":"aio-time-clock-lite","name":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-08-01T19:33:30Z","updated":"2025-08-02T08:24:48Z"},{"id":"wordfence:844c5012-f823-46ae-8de2-e2803b7cd063","source":"wordfence","cve":"CVE-2020-36747","title":"Lightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/844c5012-f823-46ae-8de2-e2803b7cd063?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-manager","name":"Lightweight Sidebar Manager","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:844d6c7e-123b-4eab-8d90-781ab0ee6f64","source":"wordfence","cve":"CVE-2026-123699","title":"Security For WooCommerce <= 1.0.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/844d6c7e-123b-4eab-8d90-781ab0ee6f64?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:03:54Z"},{"id":"wordfence:844fec4b-5913-45b2-bef6-b6df2e94dc28","source":"wordfence","cve":"CVE-2026-87780","title":"LTL Freight Quotes \u2013 Old Dominion Edition <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/844fec4b-5913-45b2-bef6-b6df2e94dc28?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-odfl-edition","name":"LTL Freight Quotes \u2013 ODFL Edition","from":"*","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"4.2.19"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T14:31:55Z"},{"id":"wordfence:8451fe09-4280-49ef-b088-698cbf40b86b","source":"wordfence","cve":"CVE-2026-8906","title":"WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8451fe09-4280-49ef-b088-698cbf40b86b?source=api-prod","affected":[{"type":"plugin","slug":"wp-promoter","name":"WP Promoter","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T19:07:52Z","updated":"2026-05-27T07:45:56Z"},{"id":"wordfence:84520916-3c9e-4b01-918f-d1fc86eb5e0b","source":"wordfence","cve":"CVE-2021-36870","title":"WP Google Maps <= 8.1.12 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84520916-3c9e-4b01-918f-d1fc86eb5e0b?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"8.1.13","to_inclusive":false,"patched_in":"8.1.13"}],"published":"2021-09-08T10:12:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84554aaa-2b91-4435-a082-25bfa823156e","source":"wordfence","cve":"CVE-2025-32208","title":"Hive Support <= 1.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84554aaa-2b91-4435-a082-25bfa823156e?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-04-07T00:00:00Z","updated":"2025-06-17T14:14:19Z"},{"id":"wordfence:8457c5e1-9c31-4a1a-a221-36647753a877","source":"wordfence","cve":"CVE-2020-5244","title":"BuddyPress <= 5.1.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8457c5e1-9c31-4a1a-a221-36647753a877?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2020-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84598365-dd46-424b-b6ff-6b8880cadb57","source":"wordfence","cve":"CVE-2026-39624","title":"Biolife <= 3.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84598365-dd46-424b-b6ff-6b8880cadb57?source=api-prod","affected":[{"type":"theme","slug":"biolife","name":"Biolife - Organic Food WordPress Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T15:20:23Z"},{"id":"wordfence:8459c436-0c4d-40e6-a30d-94b8ac50df83","source":"wordfence","cve":"","title":"WooCommerce Custom Registration Form <= 1.0.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8459c436-0c4d-40e6-a30d-94b8ac50df83?source=api-prod","affected":[{"type":"plugin","slug":"fma-additional-registration-attributes","name":"WooCommerce Custom Registration Form","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:845b6bcf-004b-4b92-88d7-3d331fa58c11","source":"wordfence","cve":"CVE-2025-14399","title":"Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845b6bcf-004b-4b92-88d7-3d331fa58c11?source=api-prod","affected":[{"type":"plugin","slug":"download-plugins-dashboard","name":"Download Plugins and Themes in ZIP from Dashboard","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-12-16T19:02:52Z","updated":"2025-12-17T07:21:05Z"},{"id":"wordfence:845c4c37-ed90-40a1-9400-951214534060","source":"wordfence","cve":"CVE-2025-68585","title":"Document Revisions <= 3.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845c4c37-ed90-40a1-9400-951214534060?source=api-prod","affected":[{"type":"plugin","slug":"wp-document-revisions","name":"WP Document Revisions","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-06T14:44:01Z"},{"id":"wordfence:845caaa9-185f-4f06-bae0-d10e2c6ab373","source":"wordfence","cve":"CVE-2025-58202","title":"Simple Page Access Restriction <= 1.0.32 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845caaa9-185f-4f06-bae0-d10e2c6ab373?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-access-restriction","name":"Simple Page Access Restriction","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":"1.0.33"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:00:37Z"},{"id":"wordfence:845cea77-ea74-4459-817b-cfbdb877b75a","source":"wordfence","cve":"CVE-2024-3603","title":"OSM \u2013 OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845cea77-ea74-4459-817b-cfbdb877b75a?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-07-08T20:10:10Z","updated":"2024-09-24T18:06:14Z"},{"id":"wordfence:845e476a-cc0a-4ee1-853d-bb5b7b081e04","source":"wordfence","cve":"CVE-2024-35727","title":"Extra Product Options for WooCommerce <= 3.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845e476a-cc0a-4ee1-853d-bb5b7b081e04?source=api-prod","affected":[{"type":"plugin","slug":"extra-product-options-for-woocommerce","name":"Extra Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:56:19Z"},{"id":"wordfence:845fbf0f-c7c4-483e-b671-1a703d857792","source":"wordfence","cve":"CVE-2023-4922","title":"WPB Show Core <= 2.2 - Unauthenticated Local File Inlclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/845fbf0f-c7c4-483e-b671-1a703d857792?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8461b617-818c-4278-b324-06b20cae0ebe","source":"wordfence","cve":"CVE-2026-109927","title":"CM HIPAA Forms <= 3.3.1 - Authenticated (hipaa_forms+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8461b617-818c-4278-b324-06b20cae0ebe?source=api-prod","affected":[{"type":"plugin","slug":"codemonkeys-hipaa-forms","name":"HIPAA Forms","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T19:29:15Z"},{"id":"wordfence:84624efa-4cdb-4d8c-9c98-84c334c02a9b","source":"wordfence","cve":"CVE-2024-12566","title":"Email Subscribers by Icegram Express \u2013 Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84624efa-4cdb-4d8c-9c98-84c334c02a9b?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.44","to_inclusive":true,"patched_in":"5.7.45"}],"published":"2024-12-23T00:00:00Z","updated":"2026-09-04T17:30:20Z"},{"id":"wordfence:8464a63f-db39-4a2c-b408-d7fd7539d6dc","source":"wordfence","cve":"CVE-2024-33689","title":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress! <= 2.5.7 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8464a63f-db39-4a2c-b408-d7fd7539d6dc?source=api-prod","affected":[{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T14:33:03Z"},{"id":"wordfence:84683caa-8bc7-4adf-ad64-249f988047bf","source":"wordfence","cve":"CVE-2022-1194","title":"Mobile Events Manager <= 1.4.7 - Authenticated (Administrator+) CSV Injection","severity":"low","cvss":2.7,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84683caa-8bc7-4adf-ad64-249f988047bf?source=api-prod","affected":[{"type":"plugin","slug":"mobile-events-manager","name":"Mobile Events Manager","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2022-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:846bd929-45cd-4e91-b232-ae16dd2b12a0","source":"wordfence","cve":"CVE-2023-5534","title":"AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/846bd929-45cd-4e91-b232-ae16dd2b12a0?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"},{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"4.9.2","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:846ccac2-ad56-4128-836d-2807c700c3fc","source":"wordfence","cve":"CVE-2026-1809","title":"HTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/846ccac2-ad56-4128-836d-2807c700c3fc?source=api-prod","affected":[{"type":"plugin","slug":"html-shortcodes","name":"HTML Shortcodes","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:06:53Z","updated":"2026-02-11T08:26:26Z"},{"id":"wordfence:846f9828-2f1f-4d08-abfb-909b8d634d8a","source":"wordfence","cve":"CVE-2024-12276","title":"Ultimate Member <= 2.9.2 - Authenticated SQL Injection","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/846f9828-2f1f-4d08-abfb-909b8d634d8a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2025-02-20T21:16:05Z","updated":"2025-02-21T09:21:07Z"},{"id":"wordfence:846fb218-ba71-41a2-af2f-931c2bfd5fdb","source":"wordfence","cve":"CVE-2024-54367","title":"ForumWP <= 2.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/846fb218-ba71-41a2-af2f-931c2bfd5fdb?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:42:55Z"},{"id":"wordfence:8470b7be-6fae-4941-b523-93e230366522","source":"wordfence","cve":"CVE-2025-12408","title":"Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8470b7be-6fae-4941-b523-93e230366522?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.2.2.2","to_inclusive":true,"patched_in":"7.2.2.3"}],"published":"2025-12-11T21:39:32Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:8472c1ae-5db2-4ff6-abf3-f9088fc6f531","source":"wordfence","cve":"CVE-2025-22285","title":"Pallet Packaging for WooCommerce <= 1.1.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8472c1ae-5db2-4ff6-abf3-f9088fc6f531?source=api-prod","affected":[{"type":"plugin","slug":"pallet-packaging-for-woocommerce","name":"Pallet Packaging for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-27T20:15:44Z"},{"id":"wordfence:8472cdbe-89a8-49ac-ab7e-065ebf717692","source":"wordfence","cve":"CVE-2023-1110","title":"Yellow Yard Searchbar <= 2.7.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8472cdbe-89a8-49ac-ab7e-065ebf717692?source=api-prod","affected":[{"type":"plugin","slug":"yellow-yard","name":"Yellow Yard Searchbar","from":"*","from_inclusive":true,"to":"2.7.27","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84739305-2f10-4688-b038-c132e06da059","source":"wordfence","cve":"CVE-2025-48156","title":"Image Wall <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84739305-2f10-4688-b038-c132e06da059?source=api-prod","affected":[{"type":"plugin","slug":"image-wall","name":"Image Wall","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:34:24Z"},{"id":"wordfence:8475dd90-b47a-42b4-8e4e-44e8512e4fca","source":"wordfence","cve":"CVE-2025-12733","title":"Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8475dd90-b47a-42b4-8e4e-44e8512e4fca?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-13T03:27:38Z"},{"id":"wordfence:84791a83-197b-4a73-826d-517bf47bc5c9","source":"wordfence","cve":"CVE-2026-103964","title":"Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84791a83-197b-4a73-826d-517bf47bc5c9?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.71","to_inclusive":true,"patched_in":"3.3.72"}],"published":"2026-10-09T15:29:44Z","updated":"2026-10-10T04:26:46Z"},{"id":"wordfence:8479d002-f2c1-4456-a653-2469c6705718","source":"wordfence","cve":"CVE-2024-43150","title":"Xpro Elementor Addons <= 1.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8479d002-f2c1-4456-a653-2469c6705718?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.4.2","to_inclusive":true,"patched_in":"1.4.4.3"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:03:04Z"},{"id":"wordfence:847a4fc7-3580-421e-8045-41b5a85f2d97","source":"wordfence","cve":"CVE-2025-6244","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/847a4fc7-3580-421e-8045-41b5a85f2d97?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.1.19","to_inclusive":true,"patched_in":"6.1.20"}],"published":"2025-07-07T13:19:56Z","updated":"2025-07-08T01:43:46Z"},{"id":"wordfence:847f1c00-0e8f-4d38-84af-fe959e2efe5c","source":"wordfence","cve":"CVE-2023-2835","title":"WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/847f1c00-0e8f-4d38-84af-fe959e2efe5c?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8483196e-f476-41e5-a988-bcd8a9952a64","source":"wordfence","cve":"","title":"User Activity Log <= 1.6.2 - Unauthenticated SQL Injection via username","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8483196e-f476-41e5-a988-bcd8a9952a64?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84846d95-792d-4569-b0eb-876d82d0beee","source":"wordfence","cve":"CVE-2026-1103","title":"AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84846d95-792d-4569-b0eb-876d82d0beee?source=api-prod","affected":[{"type":"plugin","slug":"aiktp","name":"AIKTP","from":"*","from_inclusive":true,"to":"5.0.04","to_inclusive":true,"patched_in":"5.0.05"}],"published":"2026-01-23T19:19:27Z","updated":"2026-01-24T07:26:45Z"},{"id":"wordfence:84857045-833f-44fb-ada0-1e0f4eb84a52","source":"wordfence","cve":"CVE-2026-97342","title":"JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84857045-833f-44fb-ada0-1e0f4eb84a52?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.4","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-10-01T19:00:40Z","updated":"2026-10-02T07:39:26Z"},{"id":"wordfence:84861460-5257-466e-b2c1-4b8abcf86bd1","source":"wordfence","cve":"CVE-2025-9490","title":"Popup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84861460-5257-466e-b2c1-4b8abcf86bd1?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.20.6","to_inclusive":true,"patched_in":"1.21.0"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T05:27:21Z"},{"id":"wordfence:84875591-2754-4415-9a77-8824fdfa89dd","source":"wordfence","cve":"CVE-2025-69333","title":"JetEngine <= 3.8.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84875591-2754-4415-9a77-8824fdfa89dd?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.1.1","to_inclusive":true,"patched_in":"3.8.1.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T16:19:18Z"},{"id":"wordfence:84878b9c-c13c-44d5-a39d-6befd51a14ff","source":"wordfence","cve":"CVE-2026-66595","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.80 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84878b9c-c13c-44d5-a39d-6befd51a14ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.80","to_inclusive":true,"patched_in":"5.5.81"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:25:07Z"},{"id":"wordfence:84888ea6-122d-4480-8262-d87c33113bd7","source":"wordfence","cve":"CVE-2017-18523","title":"EELV Newsletter <= 4.6.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84888ea6-122d-4480-8262-d87c33113bd7?source=api-prod","affected":[{"type":"plugin","slug":"eelv-newsletter","name":"EELV Newsletter","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2017-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:848b9c6d-e0db-43ad-ac6d-3674435339dd","source":"wordfence","cve":"CVE-2026-13042","title":"RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/848b9c6d-e0db-43ad-ac6d-3674435339dd?source=api-prod","affected":[{"type":"plugin","slug":"rpb-chessboard","name":"RPB Chessboard","from":"*","from_inclusive":true,"to":"8.1.2","to_inclusive":true,"patched_in":"8.1.3"}],"published":"2026-07-15T15:16:25Z","updated":"2026-07-16T03:44:32Z"},{"id":"wordfence:848bfa37-7560-4c6b-8bbf-ee133c799291","source":"wordfence","cve":"CVE-2025-23501","title":"Cookie Consent & Autoblock for GDPR/CCPA <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/848bfa37-7560-4c6b-8bbf-ee133c799291?source=api-prod","affected":[{"type":"plugin","slug":"cookie-consent-autoblock","name":"Cookie Consent & Autoblock for GDPR/CCPA","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:50:58Z"},{"id":"wordfence:848cfa72-4211-4576-91c2-4f643e3161c3","source":"wordfence","cve":"CVE-2024-6725","title":"Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/848cfa72-4211-4576-91c2-4f643e3161c3?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.11.1","to_inclusive":true,"patched_in":"6.11.2"}],"published":"2024-07-30T00:00:00Z","updated":"2024-07-31T10:59:17Z"},{"id":"wordfence:848f36de-c62a-45ee-b259-46dab73e4439","source":"wordfence","cve":"CVE-2024-0447","title":"ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/848f36de-c62a-45ee-b259-46dab73e4439?source=api-prod","affected":[{"type":"plugin","slug":"artibot","name":"ArtiBot Free Chat Bot for WebSites","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:36:44Z"},{"id":"wordfence:848f3b21-fb44-45c4-944e-7c4c62448ffc","source":"wordfence","cve":"","title":"L4 Shopping Cart Plugin < 8.1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/848f3b21-fb44-45c4-944e-7c4c62448ffc?source=api-prod","affected":[{"type":"plugin","slug":"levelfourstorefront","name":"Level Four Store Front","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.1.1"}],"published":"2013-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:849127cc-0b28-4673-addc-100a7d232798","source":"wordfence","cve":"CVE-2026-2025","title":"Mail Mint \u2013 Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more < 1.19.5 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/849127cc-0b28-4673-addc-100a7d232798?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.19.5","to_inclusive":false,"patched_in":"1.19.5"}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:29:34Z"},{"id":"wordfence:84936b68-923a-4da1-ae67-1d63d025342e","source":"wordfence","cve":"CVE-2025-14868","title":"Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84936b68-923a-4da1-ae67-1d63d025342e?source=api-prod","affected":[{"type":"plugin","slug":"career-section","name":"Career Section","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-04-15T18:53:02Z","updated":"2026-04-16T07:39:49Z"},{"id":"wordfence:8493d59e-72d0-4d86-91b1-7284c31c1b1d","source":"wordfence","cve":"CVE-2025-31739","title":"Minimalistic Event Manager <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8493d59e-72d0-4d86-91b1-7284c31c1b1d?source=api-prod","affected":[{"type":"plugin","slug":"minimalistic-event-manager","name":"Minimalistic Event Manager","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T14:46:44Z"},{"id":"wordfence:8494a0f6-7079-4fba-9901-76932b002c5a","source":"wordfence","cve":"CVE-2024-0594","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8494a0f6-7079-4fba-9901-76932b002c5a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2024-02-09T00:00:00Z","updated":"2024-07-29T21:36:44Z"},{"id":"wordfence:8494a17a-d6e7-4acb-b08f-3bc4aea0a488","source":"wordfence","cve":"CVE-2024-55977","title":"LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8494a17a-d6e7-4acb-b08f-3bc4aea0a488?source=api-prod","affected":[{"type":"plugin","slug":"launchpage-app-importer","name":"LaunchPage.app Importer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:05:05Z"},{"id":"wordfence:8494c3b1-350e-4d78-9acb-9d5e876e4ab1","source":"wordfence","cve":"CVE-2025-23824","title":"FontAwesome.io ShortCodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8494c3b1-350e-4d78-9acb-9d5e876e4ab1?source=api-prod","affected":[{"type":"plugin","slug":"fontawesomeio-shortcodes","name":"FontAwesome.io ShortCodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:44:20Z"},{"id":"wordfence:849888c9-61db-4b94-8140-0cd417a0f362","source":"wordfence","cve":"CVE-2025-46229","title":"Textmetrics <= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/849888c9-61db-4b94-8140-0cd417a0f362?source=api-prod","affected":[{"type":"plugin","slug":"webtexttool","name":"Textmetrics","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:26:06Z"},{"id":"wordfence:8498c671-b46e-420c-a482-7c6983596753","source":"wordfence","cve":"CVE-2025-12621","title":"Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8498c671-b46e-420c-a482-7c6983596753?source=api-prod","affected":[{"type":"plugin","slug":"flexible-refund-and-return-order-for-woocommerce","name":"Flexible Refund for WooCommerce \u2013 EU One Click Return","from":"*","from_inclusive":true,"to":"1.0.42","to_inclusive":true,"patched_in":"1.0.43"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T07:26:28Z"},{"id":"wordfence:849d0d4a-bc4c-4a45-a2db-0ad12ddcf5e4","source":"wordfence","cve":"","title":"StudioZen Theme (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/849d0d4a-bc4c-4a45-a2db-0ad12ddcf5e4?source=api-prod","affected":[{"type":"theme","slug":"studiozen","name":"Studio Zen | Photography Theme for WordPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:849e8ac6-73a8-4236-8c01-b341a2de3775","source":"wordfence","cve":"CVE-2022-1294","title":"IMDB Info Box <= 2.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/849e8ac6-73a8-4236-8c01-b341a2de3775?source=api-prod","affected":[{"type":"plugin","slug":"imdb-info-box","name":"IMDB Info Box","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:849f14df-d122-4644-a1af-90a60e1fb003","source":"wordfence","cve":"CVE-2026-57645","title":"Newsletters <= 4.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/849f14df-d122-4644-a1af-90a60e1fb003?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.13","to_inclusive":true,"patched_in":"4.14"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:52:03Z"},{"id":"wordfence:84a206fd-c743-4214-a71a-9996a22ab19c","source":"wordfence","cve":"CVE-2025-31391","title":"Script Compressor <= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84a206fd-c743-4214-a71a-9996a22ab19c?source=api-prod","affected":[{"type":"plugin","slug":"script-compressor","name":"Script Compressor","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:52:36Z"},{"id":"wordfence:84a5348a-a307-4db4-83b6-08682282a4b8","source":"wordfence","cve":"CVE-2026-13039","title":"Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"4.0.26","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.16"}],"published":"2026-07-09T19:12:34Z","updated":"2026-07-10T20:31:37Z"},{"id":"wordfence:84a63e2b-4842-4132-ae56-f9ef4fbaf06a","source":"wordfence","cve":"CVE-2025-48132","title":"X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84a63e2b-4842-4132-ae56-f9ef4fbaf06a?source=api-prod","affected":[{"type":"plugin","slug":"x-addons-elementor","name":"X Addons for Elementor \u2013 20+ Widgets, Templates & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2025-05-16T00:00:00Z","updated":"2025-10-17T19:56:34Z"},{"id":"wordfence:84adbde0-9a9b-4a76-9333-56880fcc139d","source":"wordfence","cve":"CVE-2024-11754","title":"Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84adbde0-9a9b-4a76-9333-56880fcc139d?source=api-prod","affected":[{"type":"plugin","slug":"booking-system-trafft","name":"Booking System Trafft","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-12-12T20:15:09Z","updated":"2024-12-13T08:24:49Z"},{"id":"wordfence:84afe5a7-1bf4-4b83-bf77-efbb003a30cd","source":"wordfence","cve":"CVE-2026-12949","title":"Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84afe5a7-1bf4-4b83-bf77-efbb003a30cd?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.34.1","to_inclusive":true,"patched_in":"3.34.2"}],"published":"2026-08-13T17:19:58Z","updated":"2026-08-14T05:30:44Z"},{"id":"wordfence:84b45b34-c74c-4b56-bcb0-c905a9a44969","source":"wordfence","cve":"CVE-2024-3582","title":"UnGallery <= 2.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b45b34-c74c-4b56-bcb0-c905a9a44969?source=api-prod","affected":[{"type":"plugin","slug":"ungallery","name":"UnGallery","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-16T12:33:44Z"},{"id":"wordfence:84b5e044-4522-480a-ad14-8886ed691a86","source":"wordfence","cve":"CVE-2026-110721","title":"NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2026-10-15T16:22:58Z","updated":"2026-10-16T04:27:01Z"},{"id":"wordfence:84b609a5-d3d6-4a30-b55e-7f7972c64ccb","source":"wordfence","cve":"CVE-2022-43488","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b609a5-d3d6-4a30-b55e-7f7972c64ccb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2022-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84b616fa-ff64-49e8-8c4a-7d7bfdf758be","source":"wordfence","cve":"CVE-2022-3794","title":"Jeg Elementor Kit <= 2.5.6 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b616fa-ff64-49e8-8c4a-7d7bfdf758be?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84b6f093-afd4-401f-ba82-d5be10b0fff8","source":"wordfence","cve":"CVE-2024-31101","title":"AI Twitter Feeds (Twitter widget & shortcode) <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b6f093-afd4-401f-ba82-d5be10b0fff8?source=api-prod","affected":[{"type":"plugin","slug":"ai-twitter-feeds","name":"AI Twitter Feeds (Twitter widget & shortcode)","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:09:18Z"},{"id":"wordfence:84b75f7d-7258-46f6-aee6-b96d70bee264","source":"wordfence","cve":"CVE-2019-25141","title":"Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84b75f7d-7258-46f6-aee6-b96d70bee264?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.3.9.1","to_inclusive":false,"patched_in":"1.3.9.1"}],"published":"2019-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84bad995-e653-46d6-96ff-e41cbac29b01","source":"wordfence","cve":"CVE-2026-9062","title":"Agile Store Locator <= 1.6.8 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84bad995-e653-46d6-96ff-e41cbac29b01?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2026-05-23T00:00:00Z","updated":"2026-08-21T14:00:13Z"},{"id":"wordfence:84bc611c-c38a-4282-9a9b-5bb9157fb1de","source":"wordfence","cve":"CVE-2024-3155","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel \u2013 Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84bc611c-c38a-4282-9a9b-5bb9157fb1de?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.80","to_inclusive":true,"patched_in":"2.2.81"}],"published":"2024-05-20T14:10:56Z","updated":"2024-05-31T15:30:38Z"},{"id":"wordfence:84be56bd-b9b5-4211-82f3-c86d4eee3a16","source":"wordfence","cve":"CVE-2025-27332","title":"Smart Maintenance & Countdown <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84be56bd-b9b5-4211-82f3-c86d4eee3a16?source=api-prod","affected":[{"type":"plugin","slug":"smart-maintenance-countdown","name":"Smart Maintenance & Countdown","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:42:41Z"},{"id":"wordfence:84c3b04d-8e15-4a12-877d-536cbfbd8a5e","source":"wordfence","cve":"CVE-2026-89195","title":"Site Setup Wizard <= 1.5.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c3b04d-8e15-4a12-877d-536cbfbd8a5e?source=api-prod","affected":[{"type":"plugin","slug":"site-setup-wizard","name":"Site Setup Wizard","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:19:54Z"},{"id":"wordfence:84c4e3cc-1f7c-4ed9-9072-32f3e84419c9","source":"wordfence","cve":"","title":"Booking Calendar \u2013 Event Calendar <= 1.0.2 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c4e3cc-1f7c-4ed9-9072-32f3e84419c9?source=api-prod","affected":[{"type":"plugin","slug":"hbook","name":"Booking Calendar \u2013 Event Calendar","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84c57acb-e19b-4efa-95a2-82219b20964e","source":"wordfence","cve":"CVE-2025-22740","title":"Sensei LMS <= 4.24.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c57acb-e19b-4efa-95a2-82219b20964e?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.24.4","to_inclusive":true,"patched_in":"4.24.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:29:07Z"},{"id":"wordfence:84c61d00-20c1-4176-a74d-ea6ff6220f26","source":"wordfence","cve":"CVE-2021-4359","title":"Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c61d00-20c1-4176-a74d-ea6ff6220f26?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84c74c68-619f-4372-8abe-36c1b8eca858","source":"wordfence","cve":"CVE-2024-33540","title":"ColorNews <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c74c68-619f-4372-8abe-36c1b8eca858?source=api-prod","affected":[{"type":"theme","slug":"colornews","name":"ColorNews","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:41:16Z"},{"id":"wordfence:84c79b0e-01d2-4710-9a02-edceab8db22d","source":"wordfence","cve":"CVE-2023-0377","title":"Scriptless Social Sharing <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84c79b0e-01d2-4710-9a02-edceab8db22d?source=api-prod","affected":[{"type":"plugin","slug":"scriptless-social-sharing","name":"Scriptless Social Sharing","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2023-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84cb907c-bd6b-4031-96a1-8a6de71923e0","source":"wordfence","cve":"CVE-2022-4789","title":"WPZOOM Portfolio <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84cb907c-bd6b-4031-96a1-8a6de71923e0?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-portfolio","name":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84cd2529-7b9b-47c2-9e9c-72bb208a60e6","source":"wordfence","cve":"CVE-2024-13094","title":"WP Triggers Lite <= 2.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84cd2529-7b9b-47c2-9e9c-72bb208a60e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-triggers-lite","name":"WP Triggers Lite","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:32:45Z"},{"id":"wordfence:84ce21b9-91ac-4990-8665-69a1461147ab","source":"wordfence","cve":"CVE-2024-43296","title":"Flash & HTML5 Video <= 2.5.30 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ce21b9-91ac-4990-8665-69a1461147ab?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.30","to_inclusive":true,"patched_in":"2.5.31"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:46:25Z"},{"id":"wordfence:84cf26a6-2b80-4440-845e-8031dc6b5f69","source":"wordfence","cve":"CVE-2026-107427","title":"Event Post <= 6.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84cf26a6-2b80-4440-845e-8031dc6b5f69?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-10-12T07:44:00Z","updated":"2026-10-13T13:45:06Z"},{"id":"wordfence:84d0a029-c18c-47f9-80e0-294d050007a1","source":"wordfence","cve":"CVE-2025-23612","title":"Pixobe Cartography <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84d0a029-c18c-47f9-80e0-294d050007a1?source=api-prod","affected":[{"type":"plugin","slug":"pixobe-cartography","name":"Pixobe Cartography","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:09:11Z"},{"id":"wordfence:84d362e2-a0ba-48e6-b4f5-46e080a7eee1","source":"wordfence","cve":"CVE-2026-100178","title":"WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84d362e2-a0ba-48e6-b4f5-46e080a7eee1?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-10-09T19:25:05Z","updated":"2026-10-10T07:41:46Z"},{"id":"wordfence:84d43356-274e-42d5-ac40-10a34effce8d","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirectRule' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84d43356-274e-42d5-ac40-10a34effce8d?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84d55f24-c4de-4574-b0cc-cc1b4935d281","source":"wordfence","cve":"CVE-2024-24718","title":"PropertyHive <= 2.0.6 - Missing Authorization via activate_pro_feature","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84d55f24-c4de-4574-b0cc-cc1b4935d281?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T18:04:07Z"},{"id":"wordfence:84db3251-5a01-48dc-b00e-d58c717a4b9e","source":"wordfence","cve":"CVE-2025-57931","title":"Popup box <= 5.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84db3251-5a01-48dc-b00e-d58c717a4b9e?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-04T14:52:44Z"},{"id":"wordfence:84dcc345-7075-45e8-b353-6ec72ffecb8d","source":"wordfence","cve":"CVE-2026-57409","title":"Active Products Tables for WooCommerce. Use constructor to create tables\u00a0 <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84dcc345-7075-45e8-b353-6ec72ffecb8d?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:41:47Z"},{"id":"wordfence:84ddb481-f989-4ba8-9925-e8327c30de38","source":"wordfence","cve":"CVE-2025-1725","title":"Bit File Manager \u2013 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ddb481-f989-4ba8-9925-e8327c30de38?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.8"}],"published":"2025-06-02T20:00:00Z","updated":"2025-06-03T08:21:53Z"},{"id":"wordfence:84e18c54-4bc2-45c1-90fb-960a862170b6","source":"wordfence","cve":"CVE-2025-54667","title":"myCred <= 2.9.4.3 - Authenticated (Subscriber+) Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e18c54-4bc2-45c1-90fb-960a862170b6?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.4.3","to_inclusive":true,"patched_in":"2.9.4.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:02:50Z"},{"id":"wordfence:84e230d1-9b62-450b-8d8f-bdf25e17a97a","source":"wordfence","cve":"CVE-2025-28975","title":"Alike - WordPress Custom Post Comparison <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e230d1-9b62-450b-8d8f-bdf25e17a97a?source=api-prod","affected":[{"type":"plugin","slug":"alike","name":"Alike - WordPress Custom Post Comparison","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-21T21:28:38Z"},{"id":"wordfence:84e25621-6535-43d7-a762-1dd4ffe87ee0","source":"wordfence","cve":"CVE-2025-53334","title":"Jannah < 7.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e25621-6535-43d7-a762-1dd4ffe87ee0?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":false,"patched_in":"7.5.1"}],"published":"2025-08-25T00:00:00Z","updated":"2025-11-24T20:39:40Z"},{"id":"wordfence:84e269dd-05bd-4671-802d-b21e4987b3f0","source":"wordfence","cve":"CVE-2026-54841","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.4.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e269dd-05bd-4671-802d-b21e4987b3f0?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-25T13:49:00Z"},{"id":"wordfence:84e341ec-f93b-4d10-a603-b1c804d46347","source":"wordfence","cve":"CVE-2025-64211","title":"Masterstudy Elementor Widgets <= 1.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e341ec-f93b-4d10-a603-b1c804d46347?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-elementor-widgets","name":"Masterstudy Elementor Widgets","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-10-12T00:00:00Z","updated":"2025-11-04T15:36:21Z"},{"id":"wordfence:84e6bd88-88d1-4529-86f3-6c73fb47db9b","source":"wordfence","cve":"CVE-2026-1893","title":"Orbisius Random Name Generator <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e6bd88-88d1-4529-86f3-6c73fb47db9b?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-random-name-generator","name":"Orbisius Random Name Generator","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-02-10T15:58:41Z","updated":"2026-02-11T04:36:06Z"},{"id":"wordfence:84e70472-26a4-4d9a-b1c8-15ab3827c690","source":"wordfence","cve":"CVE-2026-54832","title":"Gutenverse Companion <= 2.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e70472-26a4-4d9a-b1c8-15ab3827c690?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-companion","name":"Gutenverse Companion","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:38:26Z"},{"id":"wordfence:84e9c24c-5507-446d-9bfd-f01244f43449","source":"wordfence","cve":"CVE-2025-23761","title":"Woo Tuner <= 0.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84e9c24c-5507-446d-9bfd-f01244f43449?source=api-prod","affected":[{"type":"plugin","slug":"woo-tuner","name":"Woo Tuner","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:24:26Z"},{"id":"wordfence:84ec28d1-8634-41df-ab1e-b56ed84f2809","source":"wordfence","cve":"CVE-2025-24711","title":"Popup Box <= 3.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ec28d1-8634-41df-ab1e-b56ed84f2809?source=api-prod","affected":[{"type":"plugin","slug":"popup-box","name":"Popup Box \u2013 Easily Create WordPress Popups","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:12:50Z"},{"id":"wordfence:84ed666c-3154-4f26-beae-aba190f7a2f4","source":"wordfence","cve":"CVE-2024-38734","title":"Import Spreadsheets from Microsoft Excel <= 10.1.4 - Authenticated (Editor+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ed666c-3154-4f26-beae-aba190f7a2f4?source=api-prod","affected":[{"type":"plugin","slug":"import-spreadsheets-from-microsoft-excel","name":"SpreadsheetConverter Calculator","from":"*","from_inclusive":true,"to":"10.1.4","to_inclusive":true,"patched_in":"10.1.5"}],"published":"2024-07-11T00:00:00Z","updated":"2024-10-03T17:00:24Z"},{"id":"wordfence:84ef0f21-74af-4cb7-bab6-47c25df0522e","source":"wordfence","cve":"CVE-2011-3862","title":"Morning Coffee < 3.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ef0f21-74af-4cb7-bab6-47c25df0522e?source=api-prod","affected":[{"type":"theme","slug":"morning-coffee","name":"Morning Coffee","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2011-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84ef25b6-8119-41e5-9959-ccdfb9893e75","source":"wordfence","cve":"CVE-2024-10148","title":"Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ef25b6-8119-41e5-9959-ccdfb9893e75?source=api-prod","affected":[{"type":"plugin","slug":"wp-awesome-buttons","name":"Awesome buttons","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T18:12:32Z","updated":"2024-10-25T06:51:24Z"},{"id":"wordfence:84f08111-d116-46f9-9765-28966e338753","source":"wordfence","cve":"CVE-2025-1515","title":"WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f08111-d116-46f9-9765-28966e338753?source=api-prod","affected":[{"type":"plugin","slug":"wp-realestate-manager","name":"WP Real Estate Manager","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:14:10Z","updated":"2025-03-05T09:21:47Z"},{"id":"wordfence:84f10360-3c8b-487e-9213-dbdf1e41cbe7","source":"wordfence","cve":"","title":"Ecommerce - Two Factor Authentication <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f10360-3c8b-487e-9213-dbdf1e41cbe7?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-two-factor-authentication","name":"Ecommerce \u2013 Two Factor Authentication \u00a0","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:84f129bd-698c-40c2-bd29-e8d0b2a59e1b","source":"wordfence","cve":"CVE-2026-66623","title":"Social Media Share Buttons & Social Sharing Icons <= 2.9.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f129bd-698c-40c2-bd29-e8d0b2a59e1b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:01:44Z"},{"id":"wordfence:84f2afb4-f1c6-4313-8958-38f1b5140a67","source":"wordfence","cve":"CVE-2024-0203","title":"Digits <= 8.4.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f2afb4-f1c6-4313-8958-38f1b5140a67?source=api-prod","affected":[{"type":"plugin","slug":"digits","name":"Digits: WordPress Mobile Number Signup and Login","from":"8.4.1","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2024-02-22T00:00:00Z","updated":"2024-03-07T19:32:59Z"},{"id":"wordfence:84f57623-b6a6-4717-857d-93fa9d279882","source":"wordfence","cve":"CVE-2024-2080","title":"LiquidPoll \u2013 Polls, Surveys, NPS and Feedback Reviews <= 3.3.76 - Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f57623-b6a6-4717-857d-93fa9d279882?source=api-prod","affected":[{"type":"plugin","slug":"wp-poll","name":"LiquidPoll \u2013 Polls, Surveys, NPS and Feedback Reviews","from":"*","from_inclusive":true,"to":"3.3.76","to_inclusive":true,"patched_in":"3.3.77"}],"published":"2024-03-21T00:00:00Z","updated":"2024-03-22T02:00:00Z"},{"id":"wordfence:84f65255-f710-44f9-9f77-61776a40abae","source":"wordfence","cve":"CVE-2026-13464","title":"Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84f65255-f710-44f9-9f77-61776a40abae?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.14","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2026-07-23T14:28:39Z","updated":"2026-07-24T02:32:00Z"},{"id":"wordfence:84fb53bb-cced-4585-bb0d-c09d89293300","source":"wordfence","cve":"CVE-2025-53425","title":"Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84fb53bb-cced-4585-bb0d-c09d89293300?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-09-20T00:00:00Z","updated":"2025-11-07T17:51:45Z"},{"id":"wordfence:84fdd899-46d9-4778-bd88-8df8f2f9e540","source":"wordfence","cve":"CVE-2025-23891","title":"Yet Another Countdown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84fdd899-46d9-4778-bd88-8df8f2f9e540?source=api-prod","affected":[{"type":"plugin","slug":"yacp","name":"Yet Another Countdown Plugin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:48:03Z"},{"id":"wordfence:84ff7fa7-c005-4a3d-b8b8-c251275b0653","source":"wordfence","cve":"CVE-2024-51861","title":"EventPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ff7fa7-c005-4a3d-b8b8-c251275b0653?source=api-prod","affected":[{"type":"plugin","slug":"wp-eventpress","name":"EventPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:22:30Z"},{"id":"wordfence:84ffb581-cd59-41df-a6c5-8b2a5923e900","source":"wordfence","cve":"CVE-2025-68986","title":"Miion <= 1.2.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/84ffb581-cd59-41df-a6c5-8b2a5923e900?source=api-prod","affected":[{"type":"theme","slug":"miion","name":"Miion | Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:58:31Z"},{"id":"wordfence:8500ac5b-44e6-47b9-ab16-e7636c3fea66","source":"wordfence","cve":"CVE-2024-9173","title":"GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8500ac5b-44e6-47b9-ab16-e7636c3fea66?source=api-prod","affected":[{"type":"plugin","slug":"gf-custom-style","name":"GF Custom Style","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T21:21:15Z","updated":"2024-09-26T09:29:41Z"},{"id":"wordfence:85013657-51a6-4d7f-bb9a-aca52d8669bf","source":"wordfence","cve":"CVE-2024-32682","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85013657-51a6-4d7f-bb9a-aca52d8669bf?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T13:38:55Z"},{"id":"wordfence:85025fb9-6e19-4c0f-bf16-4b890ba5f7f5","source":"wordfence","cve":"CVE-2026-23693","title":"ElementsKit Elementor addons Lite < 3.7.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85025fb9-6e19-4c0f-bf16-4b890ba5f7f5?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":false,"patched_in":"3.7.9"}],"published":"2026-02-24T00:00:00Z","updated":"2026-02-24T17:39:34Z"},{"id":"wordfence:85034045-5176-4dee-9f88-8be41d00f854","source":"wordfence","cve":"CVE-2026-32470","title":"FundEngine \u2013 Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85034045-5176-4dee-9f88-8be41d00f854?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:42:37Z"},{"id":"wordfence:850590a0-2bbc-45ff-8538-4d11b587383f","source":"wordfence","cve":"CVE-2026-54188","title":"JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/850590a0-2bbc-45ff-8538-4d11b587383f?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10","to_inclusive":true,"patched_in":"3.8.10.1"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:59:10Z"},{"id":"wordfence:85069d6a-deaa-43a3-add8-e10293701bec","source":"wordfence","cve":"CVE-2025-57978","title":"Advanced Appointment Booking &amp; Scheduling <= 2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85069d6a-deaa-43a3-add8-e10293701bec?source=api-prod","affected":[{"type":"plugin","slug":"advanced-appointment-booking-scheduling","name":"Advanced Appointment Booking & Scheduling","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-09-22T00:00:00Z","updated":"2026-09-16T17:30:02Z"},{"id":"wordfence:850a39f9-749d-4429-ab27-90ce2c0b1316","source":"wordfence","cve":"CVE-2026-19406","title":"Easy Appointments < 4.0.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/850a39f9-749d-4429-ab27-90ce2c0b1316?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T15:58:26Z"},{"id":"wordfence:850f554f-abb5-4b9f-9b7b-67439abb1a31","source":"wordfence","cve":"CVE-2021-24664","title":"School Management System \u2013 WPSchoolPress <= 2.1.16 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/850f554f-abb5-4b9f-9b7b-67439abb1a31?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":false,"patched_in":"2.1.17"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:850fc4db-6e02-44c7-836a-02c433a0bae7","source":"wordfence","cve":"CVE-2024-13011","title":"WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/850fc4db-6e02-44c7-836a-02c433a0bae7?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-02-10T00:00:00Z","updated":"2025-02-24T08:21:29Z"},{"id":"wordfence:8510aa3d-5500-4c31-aa46-c4650aeabb29","source":"wordfence","cve":"CVE-2025-64383","title":"Qi Blocks <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8510aa3d-5500-4c31-aa46-c4650aeabb29?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-08-11T00:00:00Z","updated":"2025-11-17T18:30:53Z"},{"id":"wordfence:8512cc6b-d2a4-4436-81b8-2745cd4e6063","source":"wordfence","cve":"CVE-2026-24389","title":"Gallery PhotoBlocks <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8512cc6b-d2a4-4436-81b8-2745cd4e6063?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T16:39:11Z"},{"id":"wordfence:85150a6f-b2f3-4b95-9c9b-78f50cb8468f","source":"wordfence","cve":"CVE-2022-32280","title":"XO Slider <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85150a6f-b2f3-4b95-9c9b-78f50cb8468f?source=api-prod","affected":[{"type":"plugin","slug":"xo-liteslider","name":"XO Slider","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2022-06-14T13:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8517eaa7-278c-4671-855e-bf8c87068c4c","source":"wordfence","cve":"CVE-2025-48309","title":"BetPress <= 1.0.1 Lite - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8517eaa7-278c-4671-855e-bf8c87068c4c?source=api-prod","affected":[{"type":"plugin","slug":"betpress","name":"BetPress","from":"*","from_inclusive":true,"to":"1.0.1 Lite","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T17:37:22Z"},{"id":"wordfence:85198759-0b9c-4c8a-b650-ad268d0cb784","source":"wordfence","cve":"CVE-2021-24213","title":"GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85198759-0b9c-4c8a-b650-ad268d0cb784?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"2.4.0","from_inclusive":true,"to":"2.10.0","to_inclusive":false,"patched_in":"2.10.0"}],"published":"2021-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:851bade8-bd3a-4fb1-8a1d-12461287694e","source":"wordfence","cve":"CVE-2024-12519","title":"TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/851bade8-bd3a-4fb1-8a1d-12461287694e?source=api-prod","affected":[{"type":"plugin","slug":"tcbd-auto-refresher","name":"TCBD Auto Refresher","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T19:05:13Z","updated":"2025-01-11T07:21:51Z"},{"id":"wordfence:851daaab-4509-4a1e-b0bb-f9eda2b801c6","source":"wordfence","cve":"","title":"Malmonation (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/851daaab-4509-4a1e-b0bb-f9eda2b801c6?source=api-prod","affected":[{"type":"theme","slug":"malmonation","name":"Malmonation","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:851ff861-474e-4063-88ff-d8d35b10e9a0","source":"wordfence","cve":"CVE-2024-6660","title":"BookingPress \u2013 Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-280","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/851ff861-474e-4063-88ff-d8d35b10e9a0?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-07-16T18:09:31Z","updated":"2024-07-17T06:45:11Z"},{"id":"wordfence:85201c44-34a9-4995-a162-242dfe703934","source":"wordfence","cve":"CVE-2024-41816","title":"Cooked \u2013 Recipe Management <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85201c44-34a9-4995-a162-242dfe703934?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-08-04T00:00:00Z","updated":"2024-08-09T13:59:12Z"},{"id":"wordfence:8520ae92-0b37-4f7a-afd1-427e1a9a31f1","source":"wordfence","cve":"CVE-2025-67619","title":"Kids Heaven <= 3.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8520ae92-0b37-4f7a-afd1-427e1a9a31f1?source=api-prod","affected":[{"type":"theme","slug":"kids-world","name":"Kids Heaven - Children Education WordPress Theme","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T16:27:18Z"},{"id":"wordfence:85216580-f19e-4e69-93d9-8593b8524cdc","source":"wordfence","cve":"CVE-2024-0756","title":"Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Authenticated (Author+) Stored Cross-Site Scripting via Code Injection","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85216580-f19e-4e69-93d9-8593b8524cdc?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000023","to_inclusive":true,"patched_in":"4.3000000025"}],"published":"2024-05-14T00:00:00Z","updated":"2026-02-25T19:05:11Z"},{"id":"wordfence:85277960-2bba-4cd7-9f4c-e04f6743b96c","source":"wordfence","cve":"CVE-2022-4971","title":"Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85277960-2bba-4cd7-9f4c-e04f6743b96c?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2022-11-29T00:00:00Z","updated":"2024-10-16T06:43:35Z"},{"id":"wordfence:85277e85-b28e-47e1-a24a-5ba971d9f868","source":"wordfence","cve":"CVE-2025-30561","title":"CAS Maestro <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85277e85-b28e-47e1-a24a-5ba971d9f868?source=api-prod","affected":[{"type":"plugin","slug":"cas-maestro","name":"CAS Maestro","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T19:00:05Z"},{"id":"wordfence:85281c48-d427-49c4-95aa-420eb328e798","source":"wordfence","cve":"CVE-2025-64204","title":"SmartMag <= 10.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85281c48-d427-49c4-95aa-420eb328e798?source=api-prod","affected":[{"type":"theme","slug":"smart-mag","name":"SmartMag - Newspaper Magazine & News WordPress","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-04T14:27:42Z"},{"id":"wordfence:85283c15-3632-4b73-9f75-17a828fb3114","source":"wordfence","cve":"CVE-2026-105064","title":"Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85283c15-3632-4b73-9f75-17a828fb3114?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T15:46:03Z"},{"id":"wordfence:85290224-a051-4913-83c7-f54f2b67621e","source":"wordfence","cve":"","title":"Social Media Widget 4.0 - Spam Link Injection","severity":"medium","cvss":5.3,"cwe":"CWE-610","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85290224-a051-4913-83c7-f54f2b67621e?source=api-prod","affected":[{"type":"plugin","slug":"social-media-widget","name":"Social Media Widget","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2013-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:852959d1-f8e0-4c1f-8a5c-5923bedc4889","source":"wordfence","cve":"CVE-2025-13603","title":"WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/852959d1-f8e0-4c1f-8a5c-5923bedc4889?source=api-prod","affected":[{"type":"plugin","slug":"wp-audio-gallery","name":"WP AUDIO GALLERY","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:29:33Z","updated":"2026-02-19T04:36:17Z"},{"id":"wordfence:852b1766-8674-44a0-843c-381cd4155a2b","source":"wordfence","cve":"CVE-2026-16786","title":"Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/852b1766-8674-44a0-843c-381cd4155a2b?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2026-08-31T20:54:37Z","updated":"2026-09-01T09:28:20Z"},{"id":"wordfence:852b1895-3bed-4c2f-912c-c136b38a09bb","source":"wordfence","cve":"","title":"Paid Memberships Pro <= 2.12.6 - Information Exposure in Debug Logs","severity":"medium","cvss":5.3,"cwe":"CWE-215","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/852b1895-3bed-4c2f-912c-c136b38a09bb?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":true,"patched_in":"2.12.7"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:852c44ba-e5c5-4206-b727-f4c4c1b889a1","source":"wordfence","cve":"CVE-2024-34431","title":"WP etracker <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/852c44ba-e5c5-4206-b727-f4c4c1b889a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-etracker","name":"WP etracker","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-15T21:23:06Z"},{"id":"wordfence:8530affb-0b6e-4b71-acab-3561cccc1855","source":"wordfence","cve":"","title":"Advanced Access Manager <= 3.2.1 - Unrestricted AJAX Actions allowing Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8530affb-0b6e-4b71-acab-3561cccc1855?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2016-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85317781-7e77-4a78-af67-0a1dce39364c","source":"wordfence","cve":"CVE-2023-27433","title":"Make Paths Relative <= 1.3.0 - Cross-Site Request Forgery via 'admin/class-make-paths-relative-admin.php'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85317781-7e77-4a78-af67-0a1dce39364c?source=api-prod","affected":[{"type":"plugin","slug":"make-paths-relative","name":"Make Paths Relative","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-08-14T00:00:00Z","updated":"2024-07-11T17:08:30Z"},{"id":"wordfence:853516b2-ec50-4937-89d3-d16042a6f71c","source":"wordfence","cve":"CVE-2024-0825","title":"Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/853516b2-ec50-4937-89d3-d16042a6f71c?source=api-prod","affected":[{"type":"plugin","slug":"vimeography","name":"Vimeography: Vimeo Video Gallery WordPress Plugin","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2024-03-04T00:00:00Z","updated":"2024-07-29T21:36:45Z"},{"id":"wordfence:853562ed-7f2e-453c-b3d0-67c90bd0231f","source":"wordfence","cve":"CVE-2025-1570","title":"Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/853562ed-7f2e-453c-b3d0-67c90bd0231f?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T08:23:18Z"},{"id":"wordfence:8536c845-8253-4e7b-8bec-8659fd428cba","source":"wordfence","cve":"CVE-2026-77012","title":"\u7231\u91c7\u96c6\u6570\u636e\u91c7\u96c6\u548c\u53d1\u5e03\u63d2\u4ef6 <= 1.0.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8536c845-8253-4e7b-8bec-8659fd428cba?source=api-prod","affected":[{"type":"plugin","slug":"icollect","name":"\u7231\u91c7\u96c6\u6570\u636e\u91c7\u96c6\u548c\u53d1\u5e03\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:31:27Z"},{"id":"wordfence:8536e655-72cc-4d7a-8ca0-7ba3042e03c1","source":"wordfence","cve":"CVE-2024-54244","title":"Easy Replace <= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8536e655-72cc-4d7a-8ca0-7ba3042e03c1?source=api-prod","affected":[{"type":"plugin","slug":"easy-replace","name":"Easy Replace","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-18T16:04:10Z"},{"id":"wordfence:853b86ca-0231-4b1c-b1d2-b8c23dbdc3c5","source":"wordfence","cve":"CVE-2025-8605","title":"Gutenify - Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/853b86ca-0231-4b1c-b1d2-b8c23dbdc3c5?source=api-prod","affected":[{"type":"plugin","slug":"gutenify","name":"Gutenify \u2013 Visual Site Builder Blocks & Starter Templates","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:27:25Z","updated":"2025-11-18T08:27:34Z"},{"id":"wordfence:8540b8f3-aace-4559-b83c-6244f2249548","source":"wordfence","cve":"CVE-2022-4470","title":"Widgets for Google Reviews < 9.8 - Authenticated (Contributor+) Stored XSS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8540b8f3-aace-4559-b83c-6244f2249548?source=api-prod","affected":[{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"9.8"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85438fad-2111-494a-9ba6-854c66d21149","source":"wordfence","cve":"CVE-2022-43480","title":"Homepage Popup <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85438fad-2111-494a-9ba6-854c66d21149?source=api-prod","affected":[{"type":"plugin","slug":"homepage-pop-up","name":"Homepage Pop-up","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85446b44-8f66-40d3-ad1e-d5d52479cd96","source":"wordfence","cve":"CVE-2026-15049","title":"Depicter \u2014 Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85446b44-8f66-40d3-ad1e-d5d52479cd96?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":false,"patched_in":"4.8.0"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:11:38Z"},{"id":"wordfence:8546cd0b-2d6c-4428-81d5-ffd00540b823","source":"wordfence","cve":"CVE-2025-49871","title":"Noptin <= 3.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8546cd0b-2d6c-4428-81d5-ffd00540b823?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:05:17Z"},{"id":"wordfence:8548a8c6-3acf-4de5-a1e9-e3fe5dc8abf1","source":"wordfence","cve":"CVE-2026-22351","title":"FullCalendar <= 1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8548a8c6-3acf-4de5-a1e9-e3fe5dc8abf1?source=api-prod","affected":[{"type":"plugin","slug":"wp-fullcalendar","name":"WP FullCalendar","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-09-23T14:29:17Z"},{"id":"wordfence:854ab1f3-5f7c-40a4-85a5-db4e20dc72cc","source":"wordfence","cve":"CVE-2023-29386","title":"Manager for Icomoon <= 2.0 - Unauthenticated Arbitrary File Upload via 'upload'","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/854ab1f3-5f7c-40a4-85a5-db4e20dc72cc?source=api-prod","affected":[{"type":"plugin","slug":"manager-for-icomoon","name":"Manager for IcoMoon","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:854e5d70-f42f-48c4-b1bb-687610f86cfb","source":"wordfence","cve":"","title":"FireStorm Professional Real Estate Plugin <= 2.06.03 - SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/854e5d70-f42f-48c4-b1bb-687610f86cfb?source=api-prod","affected":[{"type":"plugin","slug":"fs-real-estate-plugin","name":"FireStorm Professional Real Estate Plugin","from":"*","from_inclusive":true,"to":"2.06.03","to_inclusive":true,"patched_in":"2.06.04"}],"published":"2012-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85501fc0-5d51-492b-b208-4b84f371ee77","source":"wordfence","cve":"CVE-2024-12572","title":"Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85501fc0-5d51-492b-b208-4b84f371ee77?source=api-prod","affected":[{"type":"plugin","slug":"hello-in-all-languages","name":"Hello In All Languages","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T03:24:34Z"},{"id":"wordfence:855055d5-362e-4a92-9e9d-97eab328dcc3","source":"wordfence","cve":"CVE-2024-3915","title":"Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855055d5-362e-4a92-9e9d-97eab328dcc3?source=api-prod","affected":[{"type":"plugin","slug":"swift-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2.7.31","to_inclusive":true,"patched_in":""}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:32Z"},{"id":"wordfence:8550a405-9fa2-41a3-b556-05ff9f577ce4","source":"wordfence","cve":"CVE-2023-0087","title":"Swifty Page Manager <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8550a405-9fa2-41a3-b556-05ff9f577ce4?source=api-prod","affected":[{"type":"plugin","slug":"swifty-page-manager","name":"Swifty Page Manager","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8550c89d-05af-4506-8fa7-cd1762a6c330","source":"wordfence","cve":"CVE-2025-1232","title":"Site Reviews <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8550c89d-05af-4506-8fa7-cd1762a6c330?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-24T19:54:11Z"},{"id":"wordfence:8551ae2f-4be4-4dc6-952d-1d25ae127150","source":"wordfence","cve":"","title":"Jeeng Push Notifications <= 2.0.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8551ae2f-4be4-4dc6-952d-1d25ae127150?source=api-prod","affected":[{"type":"plugin","slug":"jeeng-push-notifications","name":"Jeeng Push Notifications","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85546429-f11c-40f2-978c-7efdd36c273f","source":"wordfence","cve":"CVE-2026-39781","title":"Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85546429-f11c-40f2-978c-7efdd36c273f?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-05T16:42:10Z","updated":"2026-11-03T22:47:12Z"},{"id":"wordfence:85546e18-2c66-4199-9909-842e86833927","source":"wordfence","cve":"CVE-2026-25368","title":"Calculated Fields Form <= 5.4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85546e18-2c66-4199-9909-842e86833927?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.4.4.1","to_inclusive":true,"patched_in":"5.4.4.2"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-26T15:28:00Z"},{"id":"wordfence:85548bc4-8f78-4610-a27f-93ae2cf43b74","source":"wordfence","cve":"CVE-2025-68016","title":"onepay Payment Gateway For WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85548bc4-8f78-4610-a27f-93ae2cf43b74?source=api-prod","affected":[{"type":"plugin","slug":"onepay-payment-gateway-for-woocommerce","name":"onepay Payment Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-20T15:06:37Z"},{"id":"wordfence:85550779-fd46-4130-92f1-b291d4e86b21","source":"wordfence","cve":"CVE-2026-15420","title":"Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85550779-fd46-4130-92f1-b291d4e86b21?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-07-23T14:21:30Z","updated":"2026-07-24T02:32:00Z"},{"id":"wordfence:85551a4b-d75d-4bbb-bfcb-465cdb4ad4eb","source":"wordfence","cve":"CVE-2025-69085","title":"JobBank <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85551a4b-d75d-4bbb-bfcb-465cdb4ad4eb?source=api-prod","affected":[{"type":"plugin","slug":"jobbank","name":"JobBank - WordPress Job manager plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:40:22Z"},{"id":"wordfence:85551ba1-6d6e-47a0-864f-f9d0a0a11056","source":"wordfence","cve":"","title":"Shortcodes and extra features for Phlox theme <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85551ba1-6d6e-47a0-864f-f9d0a0a11056?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85555a8f-5d23-458d-9166-d30f8f0551e0","source":"wordfence","cve":"CVE-2023-51517","title":"Calculated Fields Form <= 1.2.28 - Authenticated (Contributor+) Open Redirect via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85555a8f-5d23-458d-9166-d30f8f0551e0?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.2.28","to_inclusive":true,"patched_in":"1.2.29"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8555b662-f1c8-418a-896e-1558e6e34c14","source":"wordfence","cve":"CVE-2015-9309","title":"WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8555b662-f1c8-418a-896e-1558e6e34c14?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85581a5d-a898-4dac-af48-139b36728760","source":"wordfence","cve":"CVE-2021-34649","title":"Simple Behance Portfolio <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85581a5d-a898-4dac-af48-139b36728760?source=api-prod","affected":[{"type":"plugin","slug":"simple-behace-portfolio","name":"Simple Behance Portfolio","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8558cd96-3b2a-4282-950b-6d9753698291","source":"wordfence","cve":"CVE-2023-51545","title":"Job Manager & Career \u2013 Manage job board listings, and recruitments <= 1.4.4 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8558cd96-3b2a-4282-950b-6d9753698291?source=api-prod","affected":[{"type":"plugin","slug":"job-manager-career","name":"Job Manager & Career \u2013 Manage job board listings, and recruitments","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8559690a-3cae-47c5-b2fe-521365541126","source":"wordfence","cve":"CVE-2026-57329","title":"WooCommerce Designer Pro <= 1.9.34 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8559690a-3cae-47c5-b2fe-521365541126?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.34","to_inclusive":true,"patched_in":"1.9.35"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:57:05Z"},{"id":"wordfence:855a06dc-5e92-4354-b4ab-456a224e2903","source":"wordfence","cve":"CVE-2026-40787","title":"Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855a06dc-5e92-4354-b4ab-456a224e2903?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:38:47Z"},{"id":"wordfence:855ae993-d887-4416-9b3c-8274a90dce5f","source":"wordfence","cve":"CVE-2024-9994","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855ae993-d887-4416-9b3c-8274a90dce5f?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.1.12","to_inclusive":true,"patched_in":"6.1.13"}],"published":"2025-06-06T21:37:15Z","updated":"2025-06-07T11:17:53Z"},{"id":"wordfence:855ca8f0-5078-48ec-a5d0-3f43a217a91e","source":"wordfence","cve":"CVE-2021-24361","title":"Location Manager < 2.1.0.10 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855ca8f0-5078-48ec-a5d0-3f43a217a91e?source=api-prod","affected":[{"type":"plugin","slug":"geodir_location_manager","name":"Location Manager","from":"*","from_inclusive":true,"to":"2.1.0.10","to_inclusive":false,"patched_in":"2.1.0.10"}],"published":"2021-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:855d3e2a-8ab1-4e7b-b435-f3c31171deeb","source":"wordfence","cve":"CVE-2021-37597","title":"WP Cerber Security < 8.9.3 - Multifactor Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855d3e2a-8ab1-4e7b-b435-f3c31171deeb?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"8.9.3","to_inclusive":false,"patched_in":"8.9.3"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:855ef024-98a6-4afb-acc8-1b6677ffd433","source":"wordfence","cve":"CVE-2024-51577","title":"bpmn.io <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855ef024-98a6-4afb-acc8-1b6677ffd433?source=api-prod","affected":[{"type":"plugin","slug":"bpmnio","name":"bpmn.io","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:45:11Z"},{"id":"wordfence:855f3030-3d0b-4886-8d40-a2245a787ab4","source":"wordfence","cve":"CVE-2026-57713","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 7.3.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855f3030-3d0b-4886-8d40-a2245a787ab4?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:37:42Z"},{"id":"wordfence:855f5cca-b0cc-4a1b-be33-d11776ad7c08","source":"wordfence","cve":"CVE-2014-5240","title":"WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/855f5cca-b0cc-4a1b-be33-d11776ad7c08?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85622720-970f-48e5-b5d2-63b501af9151","source":"wordfence","cve":"CVE-2026-108489","title":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0 <= 2.1.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85622720-970f-48e5-b5d2-63b501af9151?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:16Z"},{"id":"wordfence:8564fc82-ff23-44b6-91b0-d63e6afb1a73","source":"wordfence","cve":"CVE-2023-46084","title":"Icons Font Loader <= 1.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8564fc82-ff23-44b6-91b0-d63e6afb1a73?source=api-prod","affected":[{"type":"plugin","slug":"icons-font-loader","name":"Icons Font Loader \u2013 use web icons anywhere on your site, fast","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8566a5ad-df8a-4843-82c9-05da9d44582d","source":"wordfence","cve":"","title":"Easy Quiz Maker <= 1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8566a5ad-df8a-4843-82c9-05da9d44582d?source=api-prod","affected":[{"type":"plugin","slug":"n-media-wp-simple-quiz","name":"Easy Quiz Maker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85674d8a-96b3-4fae-8bff-900ca78073a4","source":"wordfence","cve":"CVE-2026-2893","title":"Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85674d8a-96b3-4fae-8bff-900ca78073a4?source=api-prod","affected":[{"type":"plugin","slug":"page-or-post-clone","name":"Fast Page & Post Duplicator","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4"}],"published":"2026-03-04T19:00:38Z","updated":"2026-03-05T07:30:56Z"},{"id":"wordfence:8567a7d7-4f4b-41de-a4e2-03f22f429774","source":"wordfence","cve":"CVE-2024-54269","title":"Notibar <= 2.1.4 - Missing Authorization via ajax_install_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8567a7d7-4f4b-41de-a4e2-03f22f429774?source=api-prod","affected":[{"type":"plugin","slug":"notibar","name":"Notibar \u2013 Notification Bar for WordPress","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T09:54:20Z"},{"id":"wordfence:856a6b88-f5fc-4b87-8a94-81e233f02e2f","source":"wordfence","cve":"CVE-2014-9035","title":"WordPress Core < 4.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/856a6b88-f5fc-4b87-8a94-81e233f02e2f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:856a7d47-4c76-4163-a3e2-7e62024dd98a","source":"wordfence","cve":"CVE-2026-22413","title":"Malgr\u00e9 <= 1.0.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/856a7d47-4c76-4163-a3e2-7e62024dd98a?source=api-prod","affected":[{"type":"theme","slug":"malgre","name":"Malgr\u00e9 - Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:34:18Z"},{"id":"wordfence:856e27ea-fec2-4805-bc66-f20b83b9610c","source":"wordfence","cve":"CVE-2024-35653","title":"Visual Composer Website Builder <= 45.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/856e27ea-fec2-4805-bc66-f20b83b9610c?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.8.0","to_inclusive":true,"patched_in":"45.9.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T19:25:45Z"},{"id":"wordfence:856e3e77-d330-4fa0-9f07-f77a56dbb5bd","source":"wordfence","cve":"CVE-2024-33557","title":"XStore Core <= 5.3.8 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/856e3e77-d330-4fa0-9f07-f77a56dbb5bd?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:44:23Z"},{"id":"wordfence:856f8b5f-809e-4ce2-8ef1-3ed169bc2b19","source":"wordfence","cve":"CVE-2019-15838","title":"Custom 404 Pro <= 3.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/856f8b5f-809e-4ce2-8ef1-3ed169bc2b19?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85705e52-5ff1-424d-bff7-4a09b3f288de","source":"wordfence","cve":"CVE-2026-95604","title":"Tangible: Loops & Logic <= 4.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85705e52-5ff1-424d-bff7-4a09b3f288de?source=api-prod","affected":[{"type":"plugin","slug":"tangible-loops-and-logic","name":"Tangible: Loops & Logic","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-09-23T11:57:15Z","updated":"2026-09-29T19:54:58Z"},{"id":"wordfence:8571b80b-a76d-4ade-98c9-c0bd44eee344","source":"wordfence","cve":"CVE-2026-12375","title":"Uncanny Automator Pro 7.3.0.5 - Maliciously Injected Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8571b80b-a76d-4ade-98c9-c0bd44eee344?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator-pro","name":"Uncanny Automator Pro","from":"7.3.0.5","from_inclusive":true,"to":"7.3.0.5","to_inclusive":true,"patched_in":"7.3.0.6"}],"published":"2026-06-16T00:00:00Z","updated":"2026-07-30T12:15:43Z"},{"id":"wordfence:85730e9b-c5da-473c-a324-891c5c9f7ba3","source":"wordfence","cve":"CVE-2022-4935","title":"WCFM Marketplace <= 3.4.11 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85730e9b-c5da-473c-a324-891c5c9f7ba3?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.4.12"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8575de20-a108-40df-a304-44e5fc8049f4","source":"wordfence","cve":"CVE-2025-58959","title":"Taskbot <= 6.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8575de20-a108-40df-a304-44e5fc8049f4?source=api-prod","affected":[{"type":"plugin","slug":"taskbot","name":"Taskbot","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T16:23:03Z"},{"id":"wordfence:85790564-811c-4087-ad36-345e443ae9f8","source":"wordfence","cve":"CVE-2015-5483","title":"Private Only <= 3.5.1 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85790564-811c-4087-ad36-345e443ae9f8?source=api-prod","affected":[{"type":"plugin","slug":"private-only","name":"Private Only","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:857a2728-23d8-4e16-8913-62faf52254f1","source":"wordfence","cve":"CVE-2025-27299","title":"MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/857a2728-23d8-4e16-8913-62faf52254f1?source=api-prod","affected":[{"type":"plugin","slug":"myticket-events","name":"MyTicket Events","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:27:42Z"},{"id":"wordfence:857ed49c-8d0f-44d6-a97b-d0bc142dd43f","source":"wordfence","cve":"CVE-2024-37951","title":"Magical Posts Display \u2013 Elementor & Gutenberg Posts Blocks <= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/857ed49c-8d0f-44d6-a97b-d0bc142dd43f?source=api-prod","affected":[{"type":"plugin","slug":"magical-posts-display","name":"Magical Posts Display \u2013 Elementor Advanced Posts widgets","from":"*","from_inclusive":true,"to":"1.2.38","to_inclusive":true,"patched_in":"1.2.39"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-26T19:46:23Z"},{"id":"wordfence:8583c1f2-0820-492c-9fa1-d96e0ce2ddf2","source":"wordfence","cve":"CVE-2026-18406","title":"SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8583c1f2-0820-492c-9fa1-d96e0ce2ddf2?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2026-09-04T18:09:55Z","updated":"2026-09-05T06:37:57Z"},{"id":"wordfence:8584e86d-bafe-4032-9483-c92ecb28ab9c","source":"wordfence","cve":"CVE-2025-63068","title":"Contact Form 7 \u2013 Dynamic Text Extension <= 5.0.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8584e86d-bafe-4032-9483-c92ecb28ab9c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2026-05-01T19:26:20Z"},{"id":"wordfence:8588f9e8-441c-4b9e-bd78-8526d8c28fa3","source":"wordfence","cve":"CVE-2024-0966","title":"Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8588f9e8-441c-4b9e-bd78-8526d8c28fa3?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.6.10"}],"published":"2024-03-12T00:00:00Z","updated":"2024-05-31T15:30:44Z"},{"id":"wordfence:858d8641-7455-47c2-9639-480ce4ec3540","source":"wordfence","cve":"CVE-2024-4261","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/858d8641-7455-47c2-9639-480ce4ec3540?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-22T12:44:36Z"},{"id":"wordfence:8591cbd0-0bdb-4222-8485-0e96cf15e39f","source":"wordfence","cve":"CVE-2026-31919","title":"Advanced Coupons for WooCommerce Coupons <= 4.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8591cbd0-0bdb-4222-8485-0e96cf15e39f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-coupons-for-woocommerce-free","name":"Advanced Coupons for WooCommerce \u2013 BOGO, Store Credit & WooCommerce Coupons","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.1.1"}],"published":"2026-02-06T00:00:00Z","updated":"2026-04-15T20:58:59Z"},{"id":"wordfence:85930893-d415-4131-bcda-54a20644eddc","source":"wordfence","cve":"CVE-2025-8490","title":"All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85930893-d415-4131-bcda-54a20644eddc?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.97","to_inclusive":true,"patched_in":"7.98"}],"published":"2025-08-26T10:28:31Z","updated":"2025-08-26T23:22:41Z"},{"id":"wordfence:8593b14e-672d-43b8-b516-d068cbd735b7","source":"wordfence","cve":"CVE-2015-3986","title":"TheCartPress eCommerce Shopping Cart <= 1.5.3.6 Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8593b14e-672d-43b8-b516-d068cbd735b7?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":""}],"published":"2015-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:859426fa-1c1a-4f82-a5a7-f94e11ee1d42","source":"wordfence","cve":"CVE-2026-110361","title":"Infinite Uploads \u2013 Offload, Optimize & Organize Your Media Library <= 3.4.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/859426fa-1c1a-4f82-a5a7-f94e11ee1d42?source=api-prod","affected":[{"type":"plugin","slug":"infinite-uploads","name":"Infinite Uploads \u2013 Offload, Optimize & Organize Your Media Library","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-10-15T18:21:00Z","updated":"2026-10-23T18:32:30Z"},{"id":"wordfence:85950e4c-59fe-4ad3-8c43-e161259d6ded","source":"wordfence","cve":"CVE-2025-27306","title":"Pathomation <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85950e4c-59fe-4ad3-8c43-e161259d6ded?source=api-prod","affected":[{"type":"plugin","slug":"pathomation","name":"Pathomation","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:12:58Z"},{"id":"wordfence:85979ad1-675b-4cfb-b3f4-c27e1b4387d5","source":"wordfence","cve":"CVE-2025-49376","title":"DELUCKS SEO <= 2.5.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85979ad1-675b-4cfb-b3f4-c27e1b4387d5?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-06-19T00:00:00Z","updated":"2025-10-30T14:48:29Z"},{"id":"wordfence:8599cb81-4f51-40b5-a0aa-5d27f2ae085d","source":"wordfence","cve":"","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.8.5 - Cross-Site Request Forgery to Plugin Settings Update","severity":"critical","cvss":9.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8599cb81-4f51-40b5-a0aa-5d27f2ae085d?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.8.5","to_inclusive":true,"patched_in":"2.9.8.6"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:859e78cd-3dfe-41b9-86dd-6f9db319cad8","source":"wordfence","cve":"CVE-2026-85414","title":"Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/859e78cd-3dfe-41b9-86dd-6f9db319cad8?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-09-04T19:36:32Z","updated":"2026-09-05T07:38:13Z"},{"id":"wordfence:859e9233-1e5d-4430-87c1-bcd8225b6258","source":"wordfence","cve":"CVE-2024-53740","title":"WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates < 2.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/859e9233-1e5d-4430-87c1-bcd8225b6258?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ultimate-gift-card","name":"WooCommerce Ultimate Gift Card","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:46:12Z"},{"id":"wordfence:859ed9a5-2222-4044-a26e-f5c50289651b","source":"wordfence","cve":"CVE-2026-110813","title":"Advanced Custom Fields (ACF\u00ae) <= 6.8.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/859ed9a5-2222-4044-a26e-f5c50289651b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"6.8.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:14:24Z"},{"id":"wordfence:859fe629-701e-4d47-8e90-59860f7c6b82","source":"wordfence","cve":"CVE-2021-24869","title":"WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/859fe629-701e-4d47-8e90-59860f7c6b82?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":false,"patched_in":"0.9.5"}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85a19135-2936-4f48-9bf8-1c160ca58f9e","source":"wordfence","cve":"CVE-2026-15208","title":"RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85a19135-2936-4f48-9bf8-1c160ca58f9e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.4","to_inclusive":true,"patched_in":"6.0.9.5"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-21T15:34:13Z"},{"id":"wordfence:85a33508-71f2-4aa1-8d51-667eb0690fbd","source":"wordfence","cve":"CVE-2024-43295","title":"WP Data Access <= 5.5.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85a33508-71f2-4aa1-8d51-667eb0690fbd?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.9"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:27:25Z"},{"id":"wordfence:85a37373-a97f-44b7-a743-bbaaa0056a6c","source":"wordfence","cve":"CVE-2026-7559","title":"Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85a37373-a97f-44b7-a743-bbaaa0056a6c?source=api-prod","affected":[{"type":"plugin","slug":"affiliaa-affiliate-program-with-mlm","name":"Affilia \u2013 Affiliate Program","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2026-07-10T15:14:31Z","updated":"2026-07-11T03:44:23Z"},{"id":"wordfence:85a8a7df-b472-4a81-b808-a413c158c1cf","source":"wordfence","cve":"CVE-2024-9221","title":"Tainacan <= 0.21.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85a8a7df-b472-4a81-b808-a413c158c1cf?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.10","to_inclusive":true,"patched_in":"0.21.11"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:18Z"},{"id":"wordfence:85a94f32-e1e5-48ea-822e-c54d0592da28","source":"wordfence","cve":"CVE-2024-1761","title":"WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85a94f32-e1e5-48ea-822e-c54d0592da28?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T04:31:36Z"},{"id":"wordfence:85abf905-ec47-4847-b3d6-8570fd5eb287","source":"wordfence","cve":"CVE-2023-7164","title":"BackWPup <= 4.0.3 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85abf905-ec47-4847-b3d6-8570fd5eb287?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2023-12-18T00:00:00Z","updated":"2024-03-20T14:38:14Z"},{"id":"wordfence:85af2186-0807-4926-9285-f8ac93f76b93","source":"wordfence","cve":"CVE-2022-29434","title":"Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85af2186-0807-4926-9285-f8ac93f76b93?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2022-02-10T13:33:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85afaef5-e19d-4052-ba72-89518f33b462","source":"wordfence","cve":"CVE-2024-51580","title":"Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85afaef5-e19d-4052-ba72-89518f33b462?source=api-prod","affected":[{"type":"plugin","slug":"cafe-lite","name":"Clever Addons for Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:46:46Z"},{"id":"wordfence:85b02779-d85f-4700-9994-68391e69c1ea","source":"wordfence","cve":"CVE-2026-18323","title":"Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b02779-d85f-4700-9994-68391e69c1ea?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0.2","to_inclusive":true,"patched_in":"1.57.0.3"}],"published":"2026-08-24T18:47:20Z","updated":"2026-08-25T07:39:50Z"},{"id":"wordfence:85b0841c-eae1-4cce-9bfb-0ef5ba6abccc","source":"wordfence","cve":"CVE-2024-43301","title":"Fonts <= 3.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b0841c-eae1-4cce-9bfb-0ef5ba6abccc?source=api-prod","affected":[{"type":"plugin","slug":"olympus-google-fonts","name":"Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:13:18Z"},{"id":"wordfence:85b08a8f-8dfe-4ed4-8694-76382c6308c3","source":"wordfence","cve":"CVE-2024-54434","title":"phZoom <= 1.2.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b08a8f-8dfe-4ed4-8694-76382c6308c3?source=api-prod","affected":[{"type":"plugin","slug":"phzoom","name":"phZoom Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.92","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:00:28Z"},{"id":"wordfence:85b2557e-0420-4087-a6d8-1d54fd269261","source":"wordfence","cve":"CVE-2024-5811","title":"Simple Video Directory <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b2557e-0420-4087-a6d8-1d54fd269261?source=api-prod","affected":[{"type":"plugin","slug":"simple-media-directory","name":"Simple Video Directory","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-01T14:35:40Z"},{"id":"wordfence:85b439ea-08f9-4b4e-80da-7c5f80bc2818","source":"wordfence","cve":"CVE-2023-44990","title":"WOLF <= 1.0.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b439ea-08f9-4b4e-80da-7c5f80bc2818?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.7.1","to_inclusive":true,"patched_in":"1.0.7.2"}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85b61e0f-3bb2-4688-b513-14f4d2da6c30","source":"wordfence","cve":"CVE-2026-15026","title":"Import and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b61e0f-3bb2-4688-b513-14f4d2da6c30?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-07-09T19:58:11Z","updated":"2026-07-10T08:30:39Z"},{"id":"wordfence:85b6262c-2576-4177-a683-44464dba0978","source":"wordfence","cve":"CVE-2023-34387","title":"Constant Contact Forms <= 1.14.0 - Missing Authorization via constant_contact_optin_ajax_handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85b6262c-2576-4177-a683-44464dba0978?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms","name":"Constant Contact Forms","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85ba54cc-3ef8-49ee-bef0-6fef8e116871","source":"wordfence","cve":"CVE-2021-25057","title":"Translation Exchange <= 1.0.14 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85ba54cc-3ef8-49ee-bef0-6fef8e116871?source=api-prod","affected":[{"type":"plugin","slug":"translation-exchange","name":"Translation Exchange \u2013 Translate Your WordPress Site In Minutes!","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85ba90ae-8144-42f0-90db-e7f2638fec47","source":"wordfence","cve":"CVE-2023-36686","title":"CartFlows Pro <= 1.11.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85ba90ae-8144-42f0-90db-e7f2638fec47?source=api-prod","affected":[{"type":"plugin","slug":"cartflows-pro","name":"CartFlows Pro","from":"*","from_inclusive":true,"to":"1.11.11","to_inclusive":true,"patched_in":"1.11.12"}],"published":"2023-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85bcfab6-568e-4bb5-bf5e-99d1c014f9a1","source":"wordfence","cve":"CVE-2026-82185","title":"WPLP Cookie Consent <= 4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85bcfab6-568e-4bb5-bf5e-99d1c014f9a1?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:19:26Z"},{"id":"wordfence:85bd9922-3316-4fd0-b31e-c3ca5ab8a79d","source":"wordfence","cve":"","title":"Email Verification for WooCommerce <= 1.8.1 - Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85bd9922-3316-4fd0-b31e-c3ca5ab8a79d?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"},{"type":"plugin","slug":"email-verification-for-woocommerce-pro","name":"Email Verification for WooCommerce Pro","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2020-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85be8ca3-e08e-4d6a-bc15-65a3435fb9f3","source":"wordfence","cve":"CVE-2025-46477","title":"WP Customize Login Page <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85be8ca3-e08e-4d6a-bc15-65a3435fb9f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-customize-login-page","name":"WP Customize Login Page","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:48:05Z"},{"id":"wordfence:85bea0bc-4254-43dd-baac-d19db8abf5ca","source":"wordfence","cve":"CVE-2026-104389","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85bea0bc-4254-43dd-baac-d19db8abf5ca?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2026-10-05T08:57:00Z","updated":"2026-10-08T23:07:59Z"},{"id":"wordfence:85bea3da-f54a-4a77-9abe-6c24bbdcc25c","source":"wordfence","cve":"CVE-2015-9338","title":"WordPress File Upload <= 2.4.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85bea3da-f54a-4a77-9abe-6c24bbdcc25c?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2015-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85bf7a1b-3c54-40c9-8f19-fcb9dd478a0e","source":"wordfence","cve":"CVE-2026-0913","title":"User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85bf7a1b-3c54-40c9-8f19-fcb9dd478a0e?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20260110","to_inclusive":true,"patched_in":"20260113"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-16T08:23:38Z"},{"id":"wordfence:85c123ee-8de0-4800-b96b-68bb4d763560","source":"wordfence","cve":"CVE-2025-3752","title":"Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c123ee-8de0-4800-b96b-68bb4d763560?source=api-prod","affected":[{"type":"plugin","slug":"ableplayer","name":"Able Player, accessible HTML5 media player","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-24T00:00:00Z","updated":"2025-07-01T14:13:20Z"},{"id":"wordfence:85c18159-b08e-441b-8e12-51e046f5f739","source":"wordfence","cve":"CVE-2025-31782","title":"mb.YTPlayer <= 3.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c18159-b08e-441b-8e12-51e046f5f739?source=api-prod","affected":[{"type":"plugin","slug":"wpmbytplayer","name":"mb.YTPlayer for background videos","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:39:24Z"},{"id":"wordfence:85c40853-c100-4c5a-a93a-f27b199dba2d","source":"wordfence","cve":"CVE-2025-24731","title":"Download IP2Location Country Blocker <= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c40853-c100-4c5a-a93a-f27b199dba2d?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.38.3","to_inclusive":true,"patched_in":"2.38.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:40:52Z"},{"id":"wordfence:85c56443-1e59-45b2-b1e3-c644c39c6bf6","source":"wordfence","cve":"CVE-2025-39439","title":"wpLike2Get <= 1.2.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c56443-1e59-45b2-b1e3-c644c39c6bf6?source=api-prod","affected":[{"type":"plugin","slug":"wplike2get","name":"wpLike2Get","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:34:07Z"},{"id":"wordfence:85c7af8b-31d4-4672-a857-da0e39c1c803","source":"wordfence","cve":"CVE-2026-65467","title":"JetEngine <= 3.8.11 - Authenticated (Contributor+) Sever-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c7af8b-31d4-4672-a857-da0e39c1c803?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.11","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:10:30Z"},{"id":"wordfence:85c96534-0bc6-4d70-89a2-6844807b1ef8","source":"wordfence","cve":"CVE-2026-32480","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85c96534-0bc6-4d70-89a2-6844807b1ef8?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.11.11","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:23:32Z"},{"id":"wordfence:85ca96a6-7992-424b-8b88-9a0751925223","source":"wordfence","cve":"CVE-2024-0587","title":"Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85ca96a6-7992-424b-8b88-9a0751925223?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.92.1","to_inclusive":true,"patched_in":"1.0.93"}],"published":"2024-01-22T00:00:00Z","updated":"2024-07-29T21:36:46Z"},{"id":"wordfence:85cea6b5-d57b-495e-a504-a0c1ba691637","source":"wordfence","cve":"CVE-2025-1304","title":"NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85cea6b5-d57b-495e-a504-a0c1ba691637?source=api-prod","affected":[{"type":"theme","slug":"newsblogger","name":"NewsBlogger","from":"*","from_inclusive":true,"to":"0.2.5.1","to_inclusive":true,"patched_in":"0.2.5.2"}],"published":"2025-04-30T15:00:22Z","updated":"2025-05-01T03:23:39Z"},{"id":"wordfence:85d1e133-0007-4672-832a-635ac8017d34","source":"wordfence","cve":"CVE-2026-32577","title":"Frontend File Manager Plugin <= 23.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85d1e133-0007-4672-832a-635ac8017d34?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:28:43Z","updated":"2026-10-08T23:35:31Z"},{"id":"wordfence:85d2bd06-c2b7-47ad-ae24-fbedf30bbf33","source":"wordfence","cve":"CVE-2025-66096","title":"Table Block by Tableberg <= 0.6.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85d2bd06-c2b7-47ad-ae24-fbedf30bbf33?source=api-prod","affected":[{"type":"plugin","slug":"tableberg","name":"Tableberg \u2013 Simple Gutenberg Table Block","from":"*","from_inclusive":true,"to":"0.6.9","to_inclusive":true,"patched_in":"0.6.10"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-12T21:15:34Z"},{"id":"wordfence:85d8bfaa-db94-4c15-8f55-eeefe5882f90","source":"wordfence","cve":"CVE-2022-38079","title":"Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85d8bfaa-db94-4c15-8f55-eeefe5882f90?source=api-prod","affected":[{"type":"plugin","slug":"backup-scheduler","name":"Backup Scheduler","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":true,"patched_in":""}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85dc6513-90cb-433d-8f8f-5b56b4a76897","source":"wordfence","cve":"CVE-2011-1047","title":"WP Forum Server <= 1.6.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85dc6513-90cb-433d-8f8f-5b56b4a76897?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2011-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85e0e1c5-211f-434c-8cc8-1ca676a8c7c2","source":"wordfence","cve":"CVE-2024-6849","title":"Preloader Plus \u2013 WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85e0e1c5-211f-434c-8cc8-1ca676a8c7c2?source=api-prod","affected":[{"type":"plugin","slug":"preloader-plus","name":"Preloader Plus \u2013 WordPress Loading Screen Plugin","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-06T20:26:20Z","updated":"2024-09-07T08:37:03Z"},{"id":"wordfence:85e17f3a-cec1-41de-b3e2-ac06a9c9290f","source":"wordfence","cve":"","title":"KODO Qiniu <= 1.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85e17f3a-cec1-41de-b3e2-ac06a9c9290f?source=api-prod","affected":[{"type":"plugin","slug":"kodo-qiniu","name":"KODO Qiniu","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2024-02-23T00:00:00Z","updated":"2024-02-23T15:35:55Z"},{"id":"wordfence:85e68071-47e3-45a0-8c38-801f125331ba","source":"wordfence","cve":"CVE-2025-39527","title":"Rating by BestWebSoft <= 1.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85e68071-47e3-45a0-8c38-801f125331ba?source=api-prod","affected":[{"type":"plugin","slug":"rating-bws","name":"Rating by BestWebSoft","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:58:04Z"},{"id":"wordfence:85e70be3-3ed7-4ce1-a20c-046fb7c4ec31","source":"wordfence","cve":"CVE-2019-25212","title":"video carousel slider with lightbox <= 1.0.6 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85e70be3-3ed7-4ce1-a20c-046fb7c4ec31?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-video-gallery-with-lightbox","name":"Video Gallery \u2013 YouTube, Vimeo & Video Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-09-10T00:00:00Z","updated":"2024-10-18T15:28:13Z"},{"id":"wordfence:85f7c69d-0b48-47af-9451-3cfd4326ffe5","source":"wordfence","cve":"CVE-2024-10937","title":"Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.58 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85f7c69d-0b48-47af-9451-3cfd4326ffe5?source=api-prod","affected":[{"type":"plugin","slug":"related-post","name":"Related Posts By PickPlugins","from":"*","from_inclusive":true,"to":"2.0.58","to_inclusive":true,"patched_in":"2.0.59"}],"published":"2024-12-04T19:46:06Z","updated":"2024-12-05T08:24:00Z"},{"id":"wordfence:85f89f95-43df-4177-aaac-27d494eaff69","source":"wordfence","cve":"CVE-2026-66627","title":"GP Premium <= 2.5.5 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85f89f95-43df-4177-aaac-27d494eaff69?source=api-prod","affected":[{"type":"plugin","slug":"gp-premium","name":"GP Premium","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:43:06Z"},{"id":"wordfence:85fd3e3c-f1cb-4384-86fd-3691f1deb963","source":"wordfence","cve":"CVE-2021-36874","title":"uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR)","severity":"high","cvss":7.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85fd3e3c-f1cb-4384-86fd-3691f1deb963?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:85fdd63e-a683-4bed-ac1a-3d8b8cbd67d2","source":"wordfence","cve":"CVE-2026-52702","title":"SEO Redirection Plugin \u2013 301 Redirect Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85fdd63e-a683-4bed-ac1a-3d8b8cbd67d2?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"9.17","to_inclusive":true,"patched_in":"9.18"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-15T19:18:55Z"},{"id":"wordfence:85fdf21b-0d16-4404-aad0-a2eae12f5db5","source":"wordfence","cve":"CVE-2025-46248","title":"Frontend Dashboard <= 2.2.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85fdf21b-0d16-4404-aad0-a2eae12f5db5?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-04-22T00:00:00Z","updated":"2026-07-29T22:55:37Z"},{"id":"wordfence:85ff1468-2cbf-4c25-9fc6-9ee419dcaea8","source":"wordfence","cve":"CVE-2026-27055","title":"Penci AI SmartContent Creator <= 2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/85ff1468-2cbf-4c25-9fc6-9ee419dcaea8?source=api-prod","affected":[{"type":"plugin","slug":"penci-ai","name":"Penci AI SmartContent Creator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-11T00:00:00Z","updated":"2026-05-04T15:36:13Z"},{"id":"wordfence:86015938-0b07-4116-9752-b45db148fd44","source":"wordfence","cve":"CVE-2026-27340","title":"Apollo | Night Club, DJ Event WordPress <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86015938-0b07-4116-9752-b45db148fd44?source=api-prod","affected":[{"type":"theme","slug":"apollo","name":"apollo","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:40:32Z"},{"id":"wordfence:8603d4cd-5e01-4a68-b127-8c99609e0413","source":"wordfence","cve":"CVE-2024-47633","title":"Zoho Forms <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8603d4cd-5e01-4a68-b127-8c99609e0413?source=api-prod","affected":[{"type":"plugin","slug":"zoho-forms","name":"Zoho Forms \u2013 Drag & Drop Form Builder for Websites \u2013 Contact Forms, Payment Forms, Order Forms & More","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:43:46Z"},{"id":"wordfence:8604f1d2-7300-4163-828b-ca17ba53f613","source":"wordfence","cve":"CVE-2025-12193","title":"Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8604f1d2-7300-4163-828b-ca17ba53f613?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-11-07T15:19:02Z","updated":"2025-11-08T03:27:49Z"},{"id":"wordfence:86052c10-ede8-4951-8bbd-bb7032493e03","source":"wordfence","cve":"CVE-2026-95591","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86052c10-ede8-4951-8bbd-bb7032493e03?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:51:57Z"},{"id":"wordfence:86055b1b-23a6-4e33-8818-0af58c8e6383","source":"wordfence","cve":"CVE-2023-41690","title":"WiserNotify Social Proof <= 2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86055b1b-23a6-4e33-8818-0af58c8e6383?source=api-prod","affected":[{"type":"plugin","slug":"wiser-notify","name":"WiserNotify \u2013 Social Proof & FOMO Notifications, WooCommerce Sales Popups, Reviews & Announcement Bar","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86068c50-2f24-4af9-a20f-704d52e98ce2","source":"wordfence","cve":"CVE-2024-7247","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86068c50-2f24-4af9-a20f-704d52e98ce2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-08-12T16:29:27Z","updated":"2024-08-13T05:30:56Z"},{"id":"wordfence:860747b9-46ab-4c97-af36-f2e104043be0","source":"wordfence","cve":"CVE-2026-13250","title":"Solace Extra <= 1.5.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion via delete_previously_imported AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860747b9-46ab-4c97-af36-f2e104043be0?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-07-10T15:06:54Z","updated":"2026-07-11T03:44:24Z"},{"id":"wordfence:86079059-11c7-4545-b254-6bf524367b46","source":"wordfence","cve":"CVE-2022-45827","title":"Video Contest WordPress Plugin <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86079059-11c7-4545-b254-6bf524367b46?source=api-prod","affected":[{"type":"plugin","slug":"video-contest","name":"Video Contest WordPress Plugin","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8607acb6-743b-4a32-9941-27ce72379f0a","source":"wordfence","cve":"CVE-2024-54294","title":"Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8607acb6-743b-4a32-9941-27ce72379f0a?source=api-prod","affected":[{"type":"plugin","slug":"authentication-via-otp-using-firebase","name":"Firebase OTP Authentication","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:24:29Z"},{"id":"wordfence:8607de39-39cd-4edb-82da-179f4518b462","source":"wordfence","cve":"CVE-2025-23966","title":"Gateway for Pasargad Bank <= 2.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8607de39-39cd-4edb-82da-179f4518b462?source=api-prod","affected":[{"type":"plugin","slug":"a-gateway-for-pasargad-bank-on-woocommerce","name":"a Gateway for Pasargad Bank on WooCommerce","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:35:31Z"},{"id":"wordfence:860848c1-dd67-4baf-a571-bc866c5f12f8","source":"wordfence","cve":"CVE-2024-7424","title":"Multiple Page Generator Plugin \u2013 MPG <= 4.0.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860848c1-dd67-4baf-a571-bc866c5f12f8?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-10-31T18:58:56Z","updated":"2024-11-01T07:33:29Z"},{"id":"wordfence:86090ab4-9f1d-4a92-a302-118524a5ffaa","source":"wordfence","cve":"CVE-2024-1790","title":"Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86090ab4-9f1d-4a92-a302-118524a5ffaa?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-09T18:59:03Z"},{"id":"wordfence:86098754-f66d-4524-a6f0-05444dce49eb","source":"wordfence","cve":"CVE-2026-92426","title":"YITH WooCommerce Popup < 1.60.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86098754-f66d-4524-a6f0-05444dce49eb?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-popup","name":"YITH WooCommerce Popup","from":"*","from_inclusive":true,"to":"1.60.0","to_inclusive":false,"patched_in":"1.60.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:24:50Z"},{"id":"wordfence:86098d46-9e88-4558-b9b2-e3905716f2a9","source":"wordfence","cve":"CVE-2024-3632","title":"Smart Image Gallery <= 1.0.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86098d46-9e88-4558-b9b2-e3905716f2a9?source=api-prod","affected":[{"type":"plugin","slug":"photoshow","name":"Smart Image Gallery","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T17:18:40Z"},{"id":"wordfence:860b13d9-f906-4a10-98be-d4a7ac75d09d","source":"wordfence","cve":"CVE-2024-50486","title":"Acnoo Flutter API <= 1.0.5 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860b13d9-f906-4a10-98be-d4a7ac75d09d?source=api-prod","affected":[{"type":"plugin","slug":"acnoo-flutter-api","name":"Acnoo Flutter API","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:35:51Z"},{"id":"wordfence:860c2339-b2a9-4a4e-a186-07a5fb042b06","source":"wordfence","cve":"CVE-2023-7067","title":"ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860c2339-b2a9-4a4e-a186-07a5fb042b06?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2024-04-18T00:00:00Z","updated":"2024-07-29T21:36:46Z"},{"id":"wordfence:860ce27b-749d-497f-9038-7e035cb3fe1d","source":"wordfence","cve":"","title":"Live Chat from ClickDesk \u2013 Live Chat \u2013 Help Desk Plugin for Websites <= 4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860ce27b-749d-497f-9038-7e035cb3fe1d?source=api-prod","affected":[{"type":"plugin","slug":"clickdesk-live-support-chat-plugin","name":"Live Chat from ClickDesk \u2013 Live Chat \u2013 Help Desk Plugin for Websites","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2014-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:860e70be-2ccd-4d4d-b0d9-bde8d163c211","source":"wordfence","cve":"","title":"123ContactForm for WordPress <= 1.5.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/860e70be-2ccd-4d4d-b0d9-bde8d163c211?source=api-prod","affected":[{"type":"plugin","slug":"123contactform-for-wordpress","name":"123ContactForm for WordPress","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2021-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86121a7c-906b-405d-bb4c-19982eeaec3b","source":"wordfence","cve":"CVE-2025-30885","title":"Bit Form \u2013 Contact Form Plugin <= 2.18.0 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86121a7c-906b-405d-bb4c-19982eeaec3b?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:52:52Z"},{"id":"wordfence:861325b1-92ca-4cd1-aa94-089de1ccba96","source":"wordfence","cve":"CVE-2025-58981","title":"Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/861325b1-92ca-4cd1-aa94-089de1ccba96?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T17:58:31Z"},{"id":"wordfence:86167b8c-6d4e-495d-96f7-8cda8e2c80b8","source":"wordfence","cve":"","title":"Social Media Share Buttons & Social Sharing Icons <= 1.5.1 - Arbitrary Options Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86167b8c-6d4e-495d-96f7-8cda8e2c80b8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2016-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8617dc53-8994-4fab-a3df-27863ad3dd10","source":"wordfence","cve":"CVE-2011-3865","title":"Black-Letterhead <= 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8617dc53-8994-4fab-a3df-27863ad3dd10?source=api-prod","affected":[{"type":"theme","slug":"black-letterhead","name":"Black-Letterhead","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2011-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8619c999-5cf7-4888-bdb2-815238411303","source":"wordfence","cve":"CVE-2024-1500","title":"Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8619c999-5cf7-4888-bdb2-815238411303?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.91","to_inclusive":true,"patched_in":"1.3.92"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T05:32:40Z"},{"id":"wordfence:861d0218-0f0f-4299-a0ff-854832348457","source":"wordfence","cve":"CVE-2024-10268","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/861d0218-0f0f-4299-a0ff-854832348457?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2024-11-18T18:57:36Z","updated":"2024-11-19T07:35:25Z"},{"id":"wordfence:861da9ac-fd73-4bb5-bc39-baf9efe71899","source":"wordfence","cve":"CVE-2011-3129","title":"WordPress Core <= 3.1.2 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/861da9ac-fd73-4bb5-bc39-baf9efe71899?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:861ece65-bee7-4124-b1a8-de9fb0c1cbc7","source":"wordfence","cve":"CVE-2026-7665","title":"Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/861ece65-bee7-4124-b1a8-de9fb0c1cbc7?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.4","to_inclusive":true,"patched_in":"6.6.5"}],"published":"2026-06-05T14:25:47Z","updated":"2026-06-06T02:28:36Z"},{"id":"wordfence:8620bbc1-efb2-471d-89fc-02e945675e65","source":"wordfence","cve":"CVE-2024-7762","title":"Simple Job Board <= 2.12.5 - Unauthenticated Resumes Download","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8620bbc1-efb2-471d-89fc-02e945675e65?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.16"}],"published":"2024-09-13T00:00:00Z","updated":"2024-10-08T16:28:33Z"},{"id":"wordfence:8620d181-22f9-4054-9d5c-1b26a315d10c","source":"wordfence","cve":"CVE-2024-32568","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8620d181-22f9-4054-9d5c-1b26a315d10c?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:46:03Z"},{"id":"wordfence:86218eaa-916b-4197-8fa4-62b527bd29a4","source":"wordfence","cve":"CVE-2025-68901","title":"Anona <= 8.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86218eaa-916b-4197-8fa4-62b527bd29a4?source=api-prod","affected":[{"type":"theme","slug":"anona","name":"Anona - Pest Control WordPress Theme","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:36:42Z"},{"id":"wordfence:8621bc52-3a71-4e01-9823-129ce0831ec4","source":"wordfence","cve":"CVE-2015-2825","title":"Simple Ads Manager <= 2.5.94 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8621bc52-3a71-4e01-9823-129ce0831ec4?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.5.94","to_inclusive":true,"patched_in":"2.5.96"}],"published":"2015-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8623d2cc-dcdd-4453-9a86-669bdd44eae1","source":"wordfence","cve":"CVE-2026-0813","title":"Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8623d2cc-dcdd-4453-9a86-669bdd44eae1?source=api-prod","affected":[{"type":"plugin","slug":"short-link","name":"Short Link","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:30:17Z","updated":"2026-01-14T06:40:05Z"},{"id":"wordfence:8624cb09-b3b4-4d45-8b9e-c45d83477ea0","source":"wordfence","cve":"CVE-2026-112846","title":"Save Life | Non-Profit, Charity & Donations WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8624cb09-b3b4-4d45-8b9e-c45d83477ea0?source=api-prod","affected":[{"type":"theme","slug":"save-life","name":"Save Life | Non-Profit, Charity & Donations WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:55:55Z"},{"id":"wordfence:86264c7d-d1a5-4f3a-872f-b27a94d796e3","source":"wordfence","cve":"CVE-2022-0209","title":"Mitsol Social Post Feed <= 1.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86264c7d-d1a5-4f3a-872f-b27a94d796e3?source=api-prod","affected":[{"type":"plugin","slug":"facebook-wall-and-social-integration","name":"Mitsol Social Post Feed","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.11"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8626e4e6-b3fd-4fab-91fd-5c2d3bd2b2e4","source":"wordfence","cve":"CVE-2026-115604","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8626e4e6-b3fd-4fab-91fd-5c2d3bd2b2e4?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:34:06Z"},{"id":"wordfence:86276cc4-635d-4bb8-93b2-75ce3fab0f90","source":"wordfence","cve":"CVE-2025-32198","title":"Brizy <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86276cc4-635d-4bb8-93b2-75ce3fab0f90?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-10T15:38:01Z"},{"id":"wordfence:8629d6a3-d35f-4aba-a33c-2800bb677616","source":"wordfence","cve":"CVE-2025-32566","title":"License For Envato <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8629d6a3-d35f-4aba-a33c-2800bb677616?source=api-prod","affected":[{"type":"plugin","slug":"license-envato","name":"License For Envato","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-14T14:17:36Z"},{"id":"wordfence:862ab8c7-c4af-437e-a72d-31a401cd1765","source":"wordfence","cve":"CVE-2014-4536","title":"Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862ab8c7-c4af-437e-a72d-31a401cd1765?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft","name":"Infusionsoft Gravity Forms Add-on","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:862ce9f6-db1d-4d3c-8c0e-e3177173d3c7","source":"wordfence","cve":"CVE-2026-91011","title":"EWWW Image Optimizer <= 8.7.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862ce9f6-db1d-4d3c-8c0e-e3177173d3c7?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.6","to_inclusive":true,"patched_in":"8.7.7"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:04Z"},{"id":"wordfence:862d6ae8-5684-4a33-b85c-1d46e48f10f5","source":"wordfence","cve":"CVE-2024-48048","title":"Wsify Widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862d6ae8-5684-4a33-b85c-1d46e48f10f5?source=api-prod","affected":[{"type":"plugin","slug":"wsify-widget","name":"Wsify widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:50:00Z"},{"id":"wordfence:862f331d-4bb9-4249-a224-3eee4802ee6f","source":"wordfence","cve":"CVE-2025-57916","title":"WP System Information <= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862f331d-4bb9-4249-a224-3eee4802ee6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-system-info","name":"WP System Information","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:48:19Z"},{"id":"wordfence:862f8743-5c8c-45ee-a2eb-9ae12c2800ca","source":"wordfence","cve":"CVE-2024-12339","title":"Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862f8743-5c8c-45ee-a2eb-9ae12c2800ca?source=api-prod","affected":[{"type":"plugin","slug":"wedesin-html-sitemap","name":"Digihood HTML Sitemap","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:23:25Z","updated":"2025-02-19T07:32:10Z"},{"id":"wordfence:862fa0c3-c16f-493e-9bf6-92debc0e30f6","source":"wordfence","cve":"CVE-2021-4402","title":"Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/862fa0c3-c16f-493e-9bf6-92debc0e30f6?source=api-prod","affected":[{"type":"plugin","slug":"multiple-roles","name":"Multiple Roles","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2021-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86301ef6-28b8-4831-b542-6aae33f705ea","source":"wordfence","cve":"CVE-2025-22823","title":"Genesis Style Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86301ef6-28b8-4831-b542-6aae33f705ea?source=api-prod","affected":[{"type":"plugin","slug":"genesis-style-shortcodes","name":"Genesis Style Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:59:19Z"},{"id":"wordfence:8631462c-75cd-4452-8698-e0d5b8f0963f","source":"wordfence","cve":"CVE-2026-14560","title":"Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8631462c-75cd-4452-8698-e0d5b8f0963f?source=api-prod","affected":[{"type":"plugin","slug":"teddy-bear-customize-addon","name":"Teddy Bear Customize Addon","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:24:43Z"},{"id":"wordfence:8631b31a-b892-4667-9e64-b4ded1815977","source":"wordfence","cve":"CVE-2026-81653","title":"NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Insecure Direct Object Reference","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8631b31a-b892-4667-9e64-b4ded1815977?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:31:15Z"},{"id":"wordfence:86346be9-7ca6-49b7-83b2-01a335d48c94","source":"wordfence","cve":"CVE-2026-4782","title":"Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86346be9-7ca6-49b7-83b2-01a335d48c94?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.2","to_inclusive":true,"patched_in":"3.15.3"}],"published":"2026-05-12T21:06:22Z","updated":"2026-05-13T09:26:13Z"},{"id":"wordfence:86351e2c-8c5a-4d71-bd73-d5ae1f03038f","source":"wordfence","cve":"CVE-2024-30421","title":"Events Manager <= 6.4.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86351e2c-8c5a-4d71-bd73-d5ae1f03038f?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.7.1","to_inclusive":true,"patched_in":"6.4.7.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-17T13:04:53Z"},{"id":"wordfence:86358a01-bf69-4a7f-8b78-a0d42d362d96","source":"wordfence","cve":"CVE-2025-13892","title":"MG AdvancedOptions <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86358a01-bf69-4a7f-8b78-a0d42d362d96?source=api-prod","affected":[{"type":"plugin","slug":"mg-advancedoptions","name":"MG AdvancedOptions","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:35:53Z","updated":"2026-01-09T11:15:33Z"},{"id":"wordfence:86364b6f-dec8-48d8-9d2d-de1ee4901872","source":"wordfence","cve":"CVE-2024-1854","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86364b6f-dec8-48d8-9d2d-de1ee4901872?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2024-02-28T00:00:00Z","updated":"2024-03-13T15:27:02Z"},{"id":"wordfence:86374310-748e-4adb-9d6f-6442fbb921be","source":"wordfence","cve":"CVE-2025-23890","title":"Easy Tweet Embed <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86374310-748e-4adb-9d6f-6442fbb921be?source=api-prod","affected":[{"type":"plugin","slug":"easy-tweet-embed","name":"Easy Tweet Embed","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:15:22Z"},{"id":"wordfence:86389489-9f9d-479b-b351-19f25166fc91","source":"wordfence","cve":"CVE-2024-8870","title":"Forms for Mailchimp by Optin Cat \u2013 Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86389489-9f9d-479b-b351-19f25166fc91?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-wp","name":"Forms for Mailchimp by Optin Cat \u2013 Grow Your MailChimp List","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-10-25T15:05:33Z","updated":"2024-12-02T21:28:38Z"},{"id":"wordfence:863a3087-8009-468a-a33a-3ec4a34681c1","source":"wordfence","cve":"CVE-2025-23972","title":"Contact Form 7 reCAPTCHA <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863a3087-8009-468a-a33a-3ec4a34681c1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-recaptcha","name":"Contact Form 7 reCAPTCHA","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:51:49Z"},{"id":"wordfence:863acd01-c9fa-44d5-afc4-1a6baefcf709","source":"wordfence","cve":"CVE-2026-48838","title":"Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863acd01-c9fa-44d5-afc4-1a6baefcf709?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:21:31Z"},{"id":"wordfence:863c29b7-892f-4520-92db-66431c10fac8","source":"wordfence","cve":"CVE-2026-76554","title":"Import Export Lite <= 3.9.34 - Authenticated (Admin+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863c29b7-892f-4520-92db-66431c10fac8?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.34","to_inclusive":true,"patched_in":"3.9.35"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:26:28Z"},{"id":"wordfence:863c4897-d61a-4f38-97c9-ec6113d47678","source":"wordfence","cve":"CVE-2025-58213","title":"Booking System Trafft <= 1.0.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863c4897-d61a-4f38-97c9-ec6113d47678?source=api-prod","affected":[{"type":"plugin","slug":"booking-system-trafft","name":"Booking System Trafft","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:04:57Z"},{"id":"wordfence:863c8d7f-106a-40e5-a679-a796225569ae","source":"wordfence","cve":"CVE-2025-22769","title":"Multifox <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863c8d7f-106a-40e5-a679-a796225569ae?source=api-prod","affected":[{"type":"theme","slug":"multifox","name":"Multifox","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:03:01Z"},{"id":"wordfence:863d59d5-ae74-4fc7-82fb-3039743af4b8","source":"wordfence","cve":"CVE-2025-9860","title":"Mixtape <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/863d59d5-ae74-4fc7-82fb-3039743af4b8?source=api-prod","affected":[{"type":"plugin","slug":"mixtape","name":"Mixtape","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:53:35Z","updated":"2025-09-11T07:24:56Z"},{"id":"wordfence:8640724c-0bd4-4684-9fd1-027f2af64e67","source":"wordfence","cve":"CVE-2026-4085","title":"Easy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8640724c-0bd4-4684-9fd1-027f2af64e67?source=api-prod","affected":[{"type":"plugin","slug":"my-instagram-feed","name":"Easy Social Photos Gallery \u2013 MIF","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:46Z","updated":"2026-04-22T07:45:38Z"},{"id":"wordfence:8641aa6d-e865-46cd-91f5-faec81a7bb55","source":"wordfence","cve":"CVE-2021-34633","title":"Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8641aa6d-e865-46cd-91f5-faec81a7bb55?source=api-prod","affected":[{"type":"plugin","slug":"youtube-feeder","name":"Youtube Feeder","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-31T00:29:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8641dec6-a754-446a-a011-9b4b0fc252c0","source":"wordfence","cve":"CVE-2021-24430","title":"Speed Booster Pack PageSpeed Optimization Suite <= 4.1.9. - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8641dec6-a754-446a-a011-9b4b0fc252c0?source=api-prod","affected":[{"type":"plugin","slug":"speed-booster-pack","name":"Speed Booster Pack \u26a1 PageSpeed Optimization Suite","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8641eb53-6a9a-4549-b8ef-e37acbcc7f03","source":"wordfence","cve":"CVE-2026-5478","title":"Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8641eb53-6a9a-4549-b8ef-e37acbcc7f03?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-04-20T07:13:38Z","updated":"2026-04-20T19:27:08Z"},{"id":"wordfence:8642657a-08a1-44eb-8c83-90307769d604","source":"wordfence","cve":"CVE-2026-105882","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8642657a-08a1-44eb-8c83-90307769d604?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T12:45:18Z","updated":"2026-10-23T18:19:12Z"},{"id":"wordfence:8647005a-23ce-417f-9bdb-c54ac506942b","source":"wordfence","cve":"CVE-2024-30497","title":"WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8647005a-23ce-417f-9bdb-c54ac506942b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-horizontal-vertical-and-accordion-tabs","name":"Responsive Tabs \u2014 Horizontal, Vertical & Accordion Tabs for WordPress","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":"1.1.18"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:02:50Z"},{"id":"wordfence:864a3444-0479-4b9f-beca-584a4a9b8682","source":"wordfence","cve":"CVE-2024-3295","title":"User Registration \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/864a3444-0479-4b9f-beca-584a4a9b8682?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:52:21Z"},{"id":"wordfence:864ca2e5-c421-4aa2-b3c8-1c22ef54ef34","source":"wordfence","cve":"CVE-2024-12709","title":"Bulk Me Now! <= 2.0 - Cross-Site Request Forgery to Message Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/864ca2e5-c421-4aa2-b3c8-1c22ef54ef34?source=api-prod","affected":[{"type":"plugin","slug":"bulk-me-now","name":"Bulk Me Now!","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:41:04Z"},{"id":"wordfence:86502cdf-f726-4f58-a674-fa35f90db943","source":"wordfence","cve":"CVE-2024-54300","title":"AutoWP <= 2.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86502cdf-f726-4f58-a674-fa35f90db943?source=api-prod","affected":[{"type":"plugin","slug":"autowp-ai-content-writer-rewriter","name":"AutoWP \u2013 AI Content Writer & Rewriter","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:49:25Z"},{"id":"wordfence:8650383a-712b-4830-894f-cd7ec7b0d5bc","source":"wordfence","cve":"CVE-2014-8364","title":"WordPress Spreadsheet (wpSS) <= 0.62 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8650383a-712b-4830-894f-cd7ec7b0d5bc?source=api-prod","affected":[{"type":"plugin","slug":"wpSS","name":"WordPress Spreadsheet","from":"*","from_inclusive":true,"to":"0.62","to_inclusive":true,"patched_in":""}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86508e90-07aa-4026-8590-83ccb098c109","source":"wordfence","cve":"CVE-2026-85009","title":"RestroPress < 3.4.8 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86508e90-07aa-4026-8590-83ccb098c109?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":false,"patched_in":"3.4.8"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-30T14:24:29Z"},{"id":"wordfence:86520275-85f8-4010-bd28-21bf2e5768fb","source":"wordfence","cve":"CVE-2025-69399","title":"Cobble <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86520275-85f8-4010-bd28-21bf2e5768fb?source=api-prod","affected":[{"type":"theme","slug":"cobble","name":"Cobble","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:30:42Z"},{"id":"wordfence:8655569e-e7dc-4e2a-8a79-8749dabd3e5e","source":"wordfence","cve":"CVE-2026-89287","title":"ASPL Product Quotation <= 1.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8655569e-e7dc-4e2a-8a79-8749dabd3e5e?source=api-prod","affected":[{"type":"plugin","slug":"aspl-product-quotation","name":"ASPL Product Quotation","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:22:20Z"},{"id":"wordfence:86566819-ec2e-4d56-87f6-4cd4b6de6192","source":"wordfence","cve":"","title":"Quasar - WordPress Theme with Animation Builder <= 1.9.2 - Authorization Bypass","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86566819-ec2e-4d56-87f6-4cd4b6de6192?source=api-prod","affected":[{"type":"theme","slug":"quasar","name":"Quasar - WordPress Theme with Animation Builder","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8657003f-da37-4169-9f00-262d7f3d9a9c","source":"wordfence","cve":"","title":"iThemes Security <= 5.6.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8657003f-da37-4169-9f00-262d7f3d9a9c?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":false,"patched_in":"5.6.2"}],"published":"2016-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:865b87a8-ab8a-4054-9e18-50693023cb96","source":"wordfence","cve":"CVE-2025-1233","title":"Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/865b87a8-ab8a-4054-9e18-50693023cb96?source=api-prod","affected":[{"type":"plugin","slug":"lafka-plugin","name":"Lafka Plugin","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-05T05:32:15Z"},{"id":"wordfence:865dbcf5-7990-40f3-bb90-3ae359b52c6f","source":"wordfence","cve":"CVE-2025-14629","title":"Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/865dbcf5-7990-40f3-bb90-3ae359b52c6f?source=api-prod","affected":[{"type":"plugin","slug":"alchemist-ajax-upload","name":"Alchemist Ajax Upload","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:18:36Z","updated":"2026-01-24T07:26:45Z"},{"id":"wordfence:865ff4bf-608e-45f0-a160-35581b82cc2b","source":"wordfence","cve":"CVE-2025-13463","title":"Bold Page Builder <= 5.6.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/865ff4bf-608e-45f0-a160-35581b82cc2b?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-02-06T17:29:47Z","updated":"2026-08-25T23:46:33Z"},{"id":"wordfence:86600d3e-11db-4a94-adc6-7b02089c70fb","source":"wordfence","cve":"CVE-2025-24641","title":"Better WishList API <= 1.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86600d3e-11db-4a94-adc6-7b02089c70fb?source=api-prod","affected":[{"type":"plugin","slug":"better-wlm-api","name":"Better WishList API","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-21T14:42:50Z"},{"id":"wordfence:86609dfe-2060-4db2-8c5c-4e541302fc50","source":"wordfence","cve":"CVE-2019-25763","title":"Ultimate Addons for Beaver Builder <= 1.24.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86609dfe-2060-4db2-8c5c-4e541302fc50?source=api-prod","affected":[{"type":"plugin","slug":"bb-ultimate-addon","name":"Ultimate Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":false,"patched_in":"1.24.1"}],"published":"2019-12-12T00:00:00Z","updated":"2026-07-29T20:39:12Z"},{"id":"wordfence:86616f56-74cb-4ceb-95ce-fbd4a3842edd","source":"wordfence","cve":"","title":"Filtre de surveillance gouvernemental <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86616f56-74cb-4ceb-95ce-fbd4a3842edd?source=api-prod","affected":[{"type":"plugin","slug":"filtre-de-surveillance-gouvernemental","name":"Filtre de surveillance gouvernemental","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86632212-37b5-4280-8a2a-163957ad9787","source":"wordfence","cve":"CVE-2024-11729","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86632212-37b5-4280-8a2a-163957ad9787?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T11:09:12Z"},{"id":"wordfence:8664fec3-4e11-4775-a5ca-b4f58931da76","source":"wordfence","cve":"CVE-2024-7030","title":"Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8664fec3-4e11-4775-a5ca-b4f58931da76?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-08-20T17:25:42Z","updated":"2024-08-28T16:39:35Z"},{"id":"wordfence:8669a8c5-6eb2-4486-bdde-05935cb71556","source":"wordfence","cve":"CVE-2026-96837","title":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8669a8c5-6eb2-4486-bdde-05935cb71556?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:56:44Z"},{"id":"wordfence:866b4ca8-563f-4a19-bbf7-79a79f07d53d","source":"wordfence","cve":"CVE-2025-14061","title":"Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/866b4ca8-563f-4a19-bbf7-79a79f07d53d?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2025-12-16T17:48:32Z","updated":"2025-12-17T06:37:00Z"},{"id":"wordfence:866e4bc3-080a-4498-b210-e692d72d3db0","source":"wordfence","cve":"CVE-2024-8621","title":"Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/866e4bc3-080a-4498-b210-e692d72d3db0?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2024.08.26","to_inclusive":true,"patched_in":"2024.09.14"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:18Z"},{"id":"wordfence:866f5121-81be-409e-b6d5-81b72bfb5539","source":"wordfence","cve":"","title":"WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export","severity":"medium","cvss":4.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/866f5121-81be-409e-b6d5-81b72bfb5539?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"6.5.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"6.5.13"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:03:36Z"},{"id":"wordfence:866f780e-46fa-407a-b777-951a328003dd","source":"wordfence","cve":"CVE-2021-24240","title":"Business Hours Pro <= 5.5.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/866f780e-46fa-407a-b777-951a328003dd?source=api-prod","affected":[{"type":"plugin","slug":"iva-business-hours-pro","name":"Business Hours Pro WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":""}],"published":"2021-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8671b549-2cce-4f38-ad2d-a9472f7e8e7b","source":"wordfence","cve":"CVE-2023-46078","title":"Serial Numbers for WooCommerce \u2013 License Manager <= 1.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8671b549-2cce-4f38-ad2d-a9472f7e8e7b?source=api-prod","affected":[{"type":"plugin","slug":"wc-serial-numbers","name":"Serial Numbers \u2013 Ultimate License Manager for Selling, Licensing & Securely Delivering Digital Content with WooCommerce","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8671bf69-640d-4656-ae22-a46daadf58a0","source":"wordfence","cve":"CVE-2023-4209","title":"POEditor <= 0.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8671bf69-640d-4656-ae22-a46daadf58a0?source=api-prod","affected":[{"type":"plugin","slug":"poeditor","name":"POEditor","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86741f4a-8700-45dd-8998-b3f0387c27ed","source":"wordfence","cve":"CVE-2025-10645","title":"WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-reset","name":"WP Reset","from":"*","from_inclusive":true,"to":"2.05","to_inclusive":true,"patched_in":"2.06"}],"published":"2025-10-06T00:00:00Z","updated":"2025-11-11T14:26:30Z"},{"id":"wordfence:86744065-862c-4167-9644-d675662c66e0","source":"wordfence","cve":"CVE-2026-66621","title":"Ultimate Dashboard Pro <= 3.11.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86744065-862c-4167-9644-d675662c66e0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard-pro","name":"Ultimate Dashboard PRO","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2026-08-18T00:00:00Z","updated":"2026-10-21T18:07:15Z"},{"id":"wordfence:8679f4cd-2cb8-48ad-a531-a00c1b85ed2e","source":"wordfence","cve":"CVE-2024-6410","title":"ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8679f4cd-2cb8-48ad-a531-a00c1b85ed2e?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.9","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2024-07-09T15:38:54Z","updated":"2024-07-10T04:31:31Z"},{"id":"wordfence:867a0742-4fa9-4473-8d51-9abb6ec353a8","source":"wordfence","cve":"CVE-2026-12141","title":"Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/867a0742-4fa9-4473-8d51-9abb6ec353a8?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.84","to_inclusive":true,"patched_in":"4.11.85"}],"published":"2026-07-10T14:58:32Z","updated":"2026-07-11T03:44:25Z"},{"id":"wordfence:867ad3a9-7e43-48ac-b5bf-8bd47ccfd8c5","source":"wordfence","cve":"CVE-2026-87870","title":"Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/867ad3a9-7e43-48ac-b5bf-8bd47ccfd8c5?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-scheduled-exports","name":"Ninja Forms - Scheduled Exports","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-10T02:28:56Z"},{"id":"wordfence:867c9de4-b547-4bf2-8ff1-897c49077f76","source":"wordfence","cve":"CVE-2025-10635","title":"Find Me On <= 2.0.9.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/867c9de4-b547-4bf2-8ff1-897c49077f76?source=api-prod","affected":[{"type":"plugin","slug":"find-me-on","name":"Find Me On","from":"*","from_inclusive":true,"to":"2.0.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-17T00:00:00Z","updated":"2025-10-16T14:40:31Z"},{"id":"wordfence:867d706c-31f9-44ac-ae25-5b722b85a4c8","source":"wordfence","cve":"CVE-2024-3971","title":"Similarity <= 3.0 - Cross-Site Request Forgery to Plugin Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/867d706c-31f9-44ac-ae25-5b722b85a4c8?source=api-prod","affected":[{"type":"plugin","slug":"similarity","name":"Similarity","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:30:21Z"},{"id":"wordfence:867f374c-633f-4384-aa2b-5bb8daa5b7a2","source":"wordfence","cve":"CVE-2024-32953","title":"Newsletters <= 4.9.5 - Information Exposure via Log files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/867f374c-633f-4384-aa2b-5bb8daa5b7a2?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:08:42Z"},{"id":"wordfence:8680ad0a-7513-408d-a62d-ffb0b0e7addb","source":"wordfence","cve":"CVE-2024-13879","title":"Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8680ad0a-7513-408d-a62d-ffb0b0e7addb?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-17T15:21:19Z"},{"id":"wordfence:86837f87-ea91-404a-92ac-38d1abf14cde","source":"wordfence","cve":"CVE-2023-47791","title":"Leadster <= 1.1.2 - Cross-Site Request Forgery via leadster_script_code_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86837f87-ea91-404a-92ac-38d1abf14cde?source=api-prod","affected":[{"type":"plugin","slug":"leadster-marketing-conversacional","name":"Leadster","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8683bc00-1136-42c4-a256-84b2cac1d575","source":"wordfence","cve":"CVE-2025-2164","title":"pixelstats <= 0.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8683bc00-1136-42c4-a256-84b2cac1d575?source=api-prod","affected":[{"type":"plugin","slug":"pixelstats","name":"pixelstats","from":"*","from_inclusive":true,"to":"0.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T14:23:53Z","updated":"2025-03-15T03:23:23Z"},{"id":"wordfence:8685fabe-2b22-45ee-a1ff-7326b6106749","source":"wordfence","cve":"CVE-2025-49509","title":"Audio Editor & Recorder <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8685fabe-2b22-45ee-a1ff-7326b6106749?source=api-prod","affected":[{"type":"plugin","slug":"audio-editor-recorder","name":"Audio Editor & Recorder","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T14:48:24Z"},{"id":"wordfence:86882722-3475-47a4-b301-978dc5fd2153","source":"wordfence","cve":"CVE-2026-77116","title":"Brave Popup Builder <= 0.8.5 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86882722-3475-47a4-b301-978dc5fd2153?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.8.5","to_inclusive":true,"patched_in":"0.8.6"}],"published":"2026-08-21T00:00:00Z","updated":"2026-09-10T19:29:31Z"},{"id":"wordfence:868905af-ee6e-41a8-8040-84eee696b747","source":"wordfence","cve":"CVE-2024-43126","title":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/868905af-ee6e-41a8-8040-84eee696b747?source=api-prod","affected":[{"type":"plugin","slug":"sender-net-automated-emails","name":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.15","to_inclusive":true,"patched_in":"2.6.16"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:46:56Z"},{"id":"wordfence:868b7492-c550-4c06-adb0-3478eb7d9b55","source":"wordfence","cve":"","title":"CSS & JavaScript Toolbox <= 8.4.1 - Information Exposure","severity":"medium","cvss":5.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/868b7492-c550-4c06-adb0-3478eb7d9b55?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2018-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:868bbe8c-6d21-4d4b-ae23-e08dfb7a1277","source":"wordfence","cve":"","title":"Ultimate Profile Builder < 3.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/868bbe8c-6d21-4d4b-ae23-e08dfb7a1277?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-profile-builder","name":"Ultimate Profile Builder","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2015-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:868c178f-9389-4da0-8ebb-ee94f025039f","source":"wordfence","cve":"CVE-2026-39470","title":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails < 2.1.0 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/868c178f-9389-4da0-8ebb-ee94f025039f?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-abandonment-recovery","name":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:32:58Z"},{"id":"wordfence:86908097-a5b2-427a-85c9-fbe29b519883","source":"wordfence","cve":"CVE-2022-46860","title":"Short URL <= 1.6.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86908097-a5b2-427a-85c9-fbe29b519883?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86937e94-b6ab-45f6-93c8-1bb786b5732b","source":"wordfence","cve":"CVE-2025-67627","title":"Draft Notify <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86937e94-b6ab-45f6-93c8-1bb786b5732b?source=api-prod","affected":[{"type":"plugin","slug":"draft-notify","name":"Draft Notify","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-05T18:43:26Z"},{"id":"wordfence:8693a8b1-15e1-4c9c-90fb-51fcaf5ff451","source":"wordfence","cve":"CVE-2022-1820","title":"Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8693a8b1-15e1-4c9c-90fb-51fcaf5ff451?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8698255b-6c03-464b-8cb5-191d3e77009f","source":"wordfence","cve":"CVE-2025-0862","title":"SuperSaaS \u2013 online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8698255b-6c03-464b-8cb5-191d3e77009f?source=api-prod","affected":[{"type":"plugin","slug":"supersaas-appointment-scheduling","name":"SuperSaaS \u2013 online appointment scheduling","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2025-02-10T22:06:43Z","updated":"2025-02-11T11:10:05Z"},{"id":"wordfence:8698d6dd-7376-4d29-8a5c-21c239a7aa03","source":"wordfence","cve":"CVE-2024-2121","title":"Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8698d6dd-7376-4d29-8a5c-21c239a7aa03?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T06:40:51Z"},{"id":"wordfence:86991143-d4e7-4114-b219-0deedd084858","source":"wordfence","cve":"CVE-2023-1120","title":"Simple Giveaways <= 2.45.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86991143-d4e7-4114-b219-0deedd084858?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":true,"patched_in":"2.45.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8699142d-4ddd-4ca1-9886-9b2d905a36cd","source":"wordfence","cve":"CVE-2024-5455","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8699142d-4ddd-4ca1-9886-9b2d905a36cd?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T03:40:04Z"},{"id":"wordfence:869b8923-d8f9-4a14-89ef-6e8871fa114c","source":"wordfence","cve":"CVE-2025-64289","title":"Premmerce Product Search for WooCommerce <= 2.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/869b8923-d8f9-4a14-89ef-6e8871fa114c?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-search","name":"Premmerce Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-05-10T00:00:00Z","updated":"2026-09-30T14:22:38Z"},{"id":"wordfence:869d7cab-cf21-4168-b45d-1681c76d896c","source":"wordfence","cve":"CVE-2025-11380","title":"Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/869d7cab-cf21-4168-b45d-1681c76d896c?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T02:24:52Z"},{"id":"wordfence:869e57f8-7524-497a-8d24-bb9f2ee3898b","source":"wordfence","cve":"CVE-2023-0900","title":"AP Pricing Tables Lite <= 1.1.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/869e57f8-7524-497a-8d24-bb9f2ee3898b?source=api-prod","affected":[{"type":"plugin","slug":"ap-pricing-tables-lite","name":"Pricing Table Builder \u2013 AP Pricing Tables Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86a134e9-104a-4ce3-be0f-d2db692c86df","source":"wordfence","cve":"CVE-2026-16947","title":"Total processing card payments for WooCommerce <= 7.3 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a134e9-104a-4ce3-be0f-d2db692c86df?source=api-prod","affected":[{"type":"plugin","slug":"totalprocessing-card-payments","name":"Total processing card payments for WooCommerce","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:30:59Z"},{"id":"wordfence:86a14cbc-16f2-479b-b40f-6d1224595721","source":"wordfence","cve":"CVE-2026-78259","title":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages <= 3.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a14cbc-16f2-479b-b40f-6d1224595721?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:49:34Z"},{"id":"wordfence:86a3dd1b-49cd-467b-b826-d906d9fb775f","source":"wordfence","cve":"CVE-2025-27006","title":"Authorsy \u2013 Author Box, Multiple Authors, Guest Authors & Post Rating <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a3dd1b-49cd-467b-b826-d906d9fb775f?source=api-prod","affected":[{"type":"plugin","slug":"authorsy","name":"Authorsy \u2013 Author Box, Multiple Authors, Guest Authors & Post Rating","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-09-10T00:00:00Z","updated":"2025-10-15T18:12:15Z"},{"id":"wordfence:86a41cdf-8d7a-4d62-9370-8bdf4a259819","source":"wordfence","cve":"CVE-2025-3742","title":"Responsive Lightbox & Gallery <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a41cdf-8d7a-4d62-9370-8bdf4a259819?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-30T19:10:52Z"},{"id":"wordfence:86a5adaf-02b7-4b42-a048-8bc01f07656b","source":"wordfence","cve":"CVE-2020-36848","title":"Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a5adaf-02b7-4b42-a048-8bc01f07656b?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.14.9","to_inclusive":true,"patched_in":"1.14.10"}],"published":"2020-12-14T00:00:00Z","updated":"2025-07-12T11:23:40Z"},{"id":"wordfence:86a69b00-5258-473d-840a-54800d28ea98","source":"wordfence","cve":"CVE-2025-58807","title":"Purge Varnish Cache <= 2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a69b00-5258-473d-840a-54800d28ea98?source=api-prod","affected":[{"type":"plugin","slug":"purge-varnish","name":"Purge Varnish Cache","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:16:02Z"},{"id":"wordfence:86a85e07-8359-441f-abb4-a1ca6083e6cd","source":"wordfence","cve":"CVE-2026-7616","title":"Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86a85e07-8359-441f-abb4-a1ca6083e6cd?source=api-prod","affected":[{"type":"plugin","slug":"zawgyi-embed","name":"Zawgyi Embed","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:05:58Z","updated":"2026-05-12T07:48:23Z"},{"id":"wordfence:86af62b9-8a32-4521-85ad-b58c1cb3de35","source":"wordfence","cve":"CVE-2025-68870","title":"CookieHint WP <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86af62b9-8a32-4521-85ad-b58c1cb3de35?source=api-prod","affected":[{"type":"plugin","slug":"cookiehint-wp","name":"CookieHint WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T18:59:32Z"},{"id":"wordfence:86b0558b-74ed-4ddd-9b18-e7795cefc00e","source":"wordfence","cve":"CVE-2024-49633","title":"DirectoryPress <= 3.6.19 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b0558b-74ed-4ddd-9b18-e7795cefc00e?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.19","to_inclusive":true,"patched_in":"3.6.20"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:22:47Z"},{"id":"wordfence:86b1710d-9503-4be3-a443-8c0ad6161d88","source":"wordfence","cve":"CVE-2025-23519","title":"G Web Pro Store Locator  <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b1710d-9503-4be3-a443-8c0ad6161d88?source=api-prod","affected":[{"type":"plugin","slug":"gwebpro-store-locator","name":"G Web Pro Store Locator","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:29:28Z"},{"id":"wordfence:86b2123f-9616-4dcc-904f-c7be802a8f8c","source":"wordfence","cve":"CVE-2011-3130","title":"WordPress Core <= 3.1.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b2123f-9616-4dcc-904f-c7be802a8f8c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86b21472-6a76-4d7b-84ff-f8b79c052aba","source":"wordfence","cve":"CVE-2025-6546","title":"Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b21472-6a76-4d7b-84ff-f8b79c052aba?source=api-prod","affected":[{"type":"plugin","slug":"drive-folder-embeder","name":"Drive Folder Embedder","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T14:17:02Z","updated":"2025-06-26T02:22:22Z"},{"id":"wordfence:86b4b0d6-bda2-47f3-a0b5-9733cb7a11f6","source":"wordfence","cve":"CVE-2025-2075","title":"Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b4b0d6-bda2-47f3-a0b5-9733cb7a11f6?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.3.0.2","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2025-04-03T16:02:29Z","updated":"2025-04-04T04:21:23Z"},{"id":"wordfence:86b54c46-a637-4fc4-8d48-a02383c9814b","source":"wordfence","cve":"CVE-2021-24308","title":"LMS by LifterLMS \u2013 Online Course, Membership & Learning Management System Plugin <= 4.21.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b54c46-a637-4fc4-8d48-a02383c9814b?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"4.21.1","to_inclusive":false,"patched_in":"4.21.1"}],"published":"2021-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86b655a6-7d71-441a-8430-6e72aecb37d8","source":"wordfence","cve":"CVE-2025-27334","title":"Simple Google Static Map <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b655a6-7d71-441a-8430-6e72aecb37d8?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-static-map","name":"Simple Google Static Map","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:18:17Z"},{"id":"wordfence:86b85505-8cae-4607-a645-5b127f6f37e7","source":"wordfence","cve":"CVE-2024-12320","title":"Team Rosters <= 4.7 - Reflected Cross-Site Scripting via 'tab'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b85505-8cae-4607-a645-5b127f6f37e7?source=api-prod","affected":[{"type":"plugin","slug":"team-rosters","name":"Team Rosters","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-01-30T00:40:54Z","updated":"2025-08-28T15:51:26Z"},{"id":"wordfence:86b8844e-5d6f-4bc6-97b2-4ff487bb2188","source":"wordfence","cve":"CVE-2021-24730","title":"Logo Showcase with Slick Slider \u2013 Logo Carousel, Logo Slider & Logo Grid <= 1.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b8844e-5d6f-4bc6-97b2-4ff487bb2188?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2021-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86b9b17f-f819-4316-8565-4e7603cd5de7","source":"wordfence","cve":"CVE-2024-9630","title":"WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=api-prod","affected":[{"type":"plugin","slug":"wps-telegram-chat","name":"WPS Telegram Chat","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T20:48:25Z"},{"id":"wordfence:86ba4092-5d92-476c-b4e4-24429a077c60","source":"wordfence","cve":"CVE-2025-23756","title":"LawPress \u2013 Law Firm Website Management <= 1.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ba4092-5d92-476c-b4e4-24429a077c60?source=api-prod","affected":[{"type":"plugin","slug":"lawpress","name":"LawPress \u2013 Law Firm Website Management","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:45:51Z"},{"id":"wordfence:86bb44f0-142d-4c4e-8fc5-a50526118130","source":"wordfence","cve":"CVE-2023-40004","title":"Multiple ServMask Plugins <= (Various Versions) - Missing Authorization to Access Token Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86bb44f0-142d-4c4e-8fc5-a50526118130?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration-dropbox-extension","name":"All-in-One WP Migration Dropbox Extension","from":"*","from_inclusive":true,"to":"3.75","to_inclusive":true,"patched_in":"3.76"},{"type":"plugin","slug":"all-in-one-wp-migration-onedrive-extension","name":"All-in-One WP Migration OneDrive Extension","from":"*","from_inclusive":true,"to":"1.66","to_inclusive":true,"patched_in":"1.67"},{"type":"plugin","slug":"all-in-one-wp-migration-gdrive-extension","name":"All-in-One WP Migration Google Drive Extension","from":"*","from_inclusive":true,"to":"2.79","to_inclusive":true,"patched_in":"2.80"},{"type":"plugin","slug":"all-in-one-wp-migration-box-extension","name":"All-in-One WP Migration Box Extension","from":"*","from_inclusive":true,"to":"1.53","to_inclusive":true,"patched_in":"1.54"}],"published":"2023-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86bd6ae1-e74d-4aab-98e1-3c47cb484fe9","source":"wordfence","cve":"CVE-2023-51668","title":"Inline Image Upload for BBPress <= 1.1.18 - Cross-Site Request Forgery via hm_bbpui_admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86bd6ae1-e74d-4aab-98e1-3c47cb484fe9?source=api-prod","affected":[{"type":"plugin","slug":"image-upload-for-bbpress","name":"Inline Image Upload for BBPress","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86becbbf-6d3c-4f06-bcb9-92167aad4084","source":"wordfence","cve":"CVE-2025-39429","title":"Sz\u00e9chenyi 2020 Logo <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86becbbf-6d3c-4f06-bcb9-92167aad4084?source=api-prod","affected":[{"type":"plugin","slug":"szechenyi-2020-logo","name":"Sz\u00e9chenyi 2020 Logo","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-04-17T00:00:00Z","updated":"2026-01-06T18:57:06Z"},{"id":"wordfence:86c04e9d-0bcd-4637-bd4a-aeb2e3f373ff","source":"wordfence","cve":"CVE-2020-9459","title":"Modern Events Calendar Lite <= 5.1.6 - Missing Authorization to Stored Cross-Site Scripting and Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c04e9d-0bcd-4637-bd4a-aeb2e3f373ff?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":false,"patched_in":"5.1.7"}],"published":"2020-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86c0f530-bf4c-4de4-84db-e8469cea76c5","source":"wordfence","cve":"","title":"Woocommerce CSV importer <= 3.3.6 - Arbitrary File Deletion","severity":"medium","cvss":6.4,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c0f530-bf4c-4de4-84db-e8469cea76c5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-csvimport","name":"Woocommerce CSV importer","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2017-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86c1b729-e8fe-46e8-8d57-c6312087c6b2","source":"wordfence","cve":"","title":"Under Construction, Coming Soon & Maintenance Mode <= 1.1.1 - Server Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c1b729-e8fe-46e8-8d57-c6312087c6b2?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-maintenance-mode","name":"Under Construction, Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2021-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86c3ef76-d4d0-4106-850f-88e9ea176979","source":"wordfence","cve":"","title":"Easy Social Icons <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c3ef76-d4d0-4106-850f-88e9ea176979?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2021-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86c4e138-0ef1-46b4-b925-e82e18c30835","source":"wordfence","cve":"CVE-2025-32175","title":"VK Filter Search <= 2.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c4e138-0ef1-46b4-b925-e82e18c30835?source=api-prod","affected":[{"type":"plugin","slug":"vk-filter-search","name":"VK Filter Search","from":"*","from_inclusive":true,"to":"2.20.3","to_inclusive":true,"patched_in":"2.20.4"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-26T18:15:41Z"},{"id":"wordfence:86c7bca9-4290-4c71-9a1a-7f14032075d5","source":"wordfence","cve":"CVE-2025-66085","title":"Arconix Shortcodes <= 2.1.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c7bca9-4290-4c71-9a1a-7f14032075d5?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.1.19"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-25T15:50:40Z"},{"id":"wordfence:86c8f14a-bb64-41bb-9ab7-dd86f122dc4c","source":"wordfence","cve":"CVE-2026-14821","title":"Quiz And Survey Master <= 11.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c8f14a-bb64-41bb-9ab7-dd86f122dc4c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.1.4","to_inclusive":true,"patched_in":"11.1.5"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T23:03:24Z"},{"id":"wordfence:86c9bcf1-c69e-47ca-b74b-8ce6157f520b","source":"wordfence","cve":"CVE-2023-3709","title":"Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86c9bcf1-c69e-47ca-b74b-8ce6157f520b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.70","to_inclusive":true,"patched_in":"1.3.71"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86ca6f9f-5a04-4e56-a7c7-d18a0c6fdad4","source":"wordfence","cve":"CVE-2026-57332","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ca6f9f-5a04-4e56-a7c7-d18a0c6fdad4?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:11:33Z"},{"id":"wordfence:86cb08ae-aa21-4ee6-baed-03429e4d38e2","source":"wordfence","cve":"","title":"MC4WP: Mailchimp for WordPress <= 4.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86cb08ae-aa21-4ee6-baed-03429e4d38e2?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2019-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86cdbfec-b1af-48ec-ae70-f97768694e44","source":"wordfence","cve":"CVE-2023-5709","title":"WD WidgetTwitter <= 1.0.9 -  Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86cdbfec-b1af-48ec-ae70-f97768694e44?source=api-prod","affected":[{"type":"plugin","slug":"widget-twitter","name":"WD WidgetTwitter","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86cee705-6874-4fcc-b13c-bd20f6e0704b","source":"wordfence","cve":"CVE-2021-24734","title":"Compact WP Audio Player <= 1.9.6 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86cee705-6874-4fcc-b13c-bd20f6e0704b?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86cf664f-5de1-4692-96b3-2fd8ae35110b","source":"wordfence","cve":"CVE-2024-2736","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86cf664f-5de1-4692-96b3-2fd8ae35110b?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:21Z"},{"id":"wordfence:86d01f1b-f1f3-4d28-8fd9-6f17d610a38c","source":"wordfence","cve":"CVE-2026-24992","title":"Advanced WooCommerce Product Sales Reporting <= 4.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d01f1b-f1f3-4d28-8fd9-6f17d610a38c?source=api-prod","affected":[{"type":"plugin","slug":"webd-woocommerce-advanced-reporting-statistics","name":"Advanced Reporting and Statistics for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-01-23T00:00:00Z","updated":"2026-02-02T21:02:08Z"},{"id":"wordfence:86d2aa56-c543-4cb6-aa9f-715879c18f83","source":"wordfence","cve":"CVE-2025-47690","title":"Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d2aa56-c543-4cb6-aa9f-715879c18f83?source=api-prod","affected":[{"type":"plugin","slug":"wp-leads-builder-any-crm","name":"Lead Form Data Collection to CRM","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-05-09T00:00:00Z","updated":"2025-07-01T14:05:24Z"},{"id":"wordfence:86d32797-a924-4d38-8543-eddb5f725d46","source":"wordfence","cve":"CVE-2024-52432","title":"NIX Anti-Spam Light <= 0.0.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d32797-a924-4d38-8543-eddb5f725d46?source=api-prod","affected":[{"type":"plugin","slug":"nix-anti-spam-light","name":"NIX Anti-Spam Light","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:32:57Z"},{"id":"wordfence:86d3ff76-49be-4517-a62e-7522e26479b7","source":"wordfence","cve":"CVE-2022-3021","title":"Slickr Flickr <= 2.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d3ff76-49be-4517-a62e-7522e26479b7?source=api-prod","affected":[{"type":"plugin","slug":"slickr-flickr","name":"Slickr Flickr","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86d54e0c-39a8-435c-81a7-cbc35d9da11c","source":"wordfence","cve":"CVE-2025-23560","title":"Web Testimonials <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d54e0c-39a8-435c-81a7-cbc35d9da11c?source=api-prod","affected":[{"type":"plugin","slug":"web-testimonials","name":"Web Testimonials","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:52:28Z"},{"id":"wordfence:86d5af9f-ffe9-4d22-885d-e117da7687de","source":"wordfence","cve":"CVE-2024-31266","title":"Advanced Order Export For WooCommerce <= 3.4.4 - Authenticated (Shop Manager+) Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d5af9f-ffe9-4d22-885d-e117da7687de?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:09:50Z"},{"id":"wordfence:86d705bc-1555-49a6-ac75-7b1776a037e5","source":"wordfence","cve":"CVE-2026-89297","title":"Loja Autom\u00e1tica <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d705bc-1555-49a6-ac75-7b1776a037e5?source=api-prod","affected":[{"type":"plugin","slug":"loja-automatica","name":"Loja Autom\u00e1tica","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:22:39Z"},{"id":"wordfence:86d7d9a0-9bb3-4110-99d3-bf044d513ebe","source":"wordfence","cve":"CVE-2025-49363","title":"Kings & Queens <= 1.1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d7d9a0-9bb3-4110-99d3-bf044d513ebe?source=api-prod","affected":[{"type":"theme","slug":"kings-queens","name":"Kings & Queens | Historical War Medieval Reenactment WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:21:19Z"},{"id":"wordfence:86d8ea64-39a7-46c1-bc21-39814c2ac869","source":"wordfence","cve":"CVE-2025-31552","title":"RSVPMarker  <= 11.6.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86d8ea64-39a7-46c1-bc21-39814c2ac869?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"11.6.7","to_inclusive":true,"patched_in":"11.6.8"}],"published":"2025-03-31T00:00:00Z","updated":"2025-12-18T18:46:58Z"},{"id":"wordfence:86dab8e6-b9fd-45ca-bdd1-8665f3bb75f2","source":"wordfence","cve":"CVE-2025-12161","title":"Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86dab8e6-b9fd-45ca-bdd1-8665f3bb75f2?source=api-prod","affected":[{"type":"plugin","slug":"smart-auto-upload-images","name":"Smart Auto Upload Images \u2013 Import External Images","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:49Z"},{"id":"wordfence:86dd9106-880d-49db-8021-4fac71ae865f","source":"wordfence","cve":"CVE-2024-47328","title":"Automation By Autonami <= 3.1.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86dd9106-880d-49db-8021-4fac71ae865f?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:31:20Z"},{"id":"wordfence:86ddd5fd-137b-478e-952e-b36fc6a5c28d","source":"wordfence","cve":"CVE-2024-2765","title":"Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ddd5fd-137b-478e-952e-b36fc6a5c28d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2024-04-10T00:00:00Z","updated":"2025-01-31T20:30:19Z"},{"id":"wordfence:86df2310-aad5-48ef-ad31-1b5dbcbccb44","source":"wordfence","cve":"CVE-2026-48966","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86df2310-aad5-48ef-ad31-1b5dbcbccb44?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.2","to_inclusive":true,"patched_in":"3.15.0.3"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:48:37Z"},{"id":"wordfence:86dfdc4f-1cc2-4b0d-b79c-bee3d6956eb4","source":"wordfence","cve":"CVE-2024-5215","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86dfdc4f-1cc2-4b0d-b79c-bee3d6956eb4?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2024-06-25T18:16:09Z","updated":"2024-06-26T06:56:04Z"},{"id":"wordfence:86e01e59-7863-4121-a231-53299aa6f0c4","source":"wordfence","cve":"CVE-2025-64224","title":"Grand Conference Theme Custom Post Type < 2.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e01e59-7863-4121-a231-53299aa6f0c4?source=api-prod","affected":[{"type":"plugin","slug":"grandconference-custom-post","name":"Grand Conference Theme Custom Post Type","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2025-05-13T00:00:00Z","updated":"2025-11-11T18:26:41Z"},{"id":"wordfence:86e0ae2b-128c-4406-aef9-357904be86fa","source":"wordfence","cve":"CVE-2024-4977","title":"Index WP MySQL For Speed <= 1.4.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e0ae2b-128c-4406-aef9-357904be86fa?source=api-prod","affected":[{"type":"plugin","slug":"index-wp-mysql-for-speed","name":"Index WP MySQL For Speed","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":"1.4.18"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:17:13Z"},{"id":"wordfence:86e3eae3-21bb-4695-8650-4c6ba6ababe3","source":"wordfence","cve":"CVE-2024-30462","title":"HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e3eae3-21bb-4695-8650-4c6ba6ababe3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.1","to_inclusive":true,"patched_in":"1.3.5.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:53:05Z"},{"id":"wordfence:86e62a7d-53d6-40c8-823d-811cfb3d75b2","source":"wordfence","cve":"CVE-2022-4756","title":"YouTube Channel < 3.0.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e62a7d-53d6-40c8-823d-811cfb3d75b2?source=api-prod","affected":[{"type":"plugin","slug":"youtube-channel","name":"My YouTube Channel","from":"*","from_inclusive":true,"to":"3.0.12.1","to_inclusive":true,"patched_in":"3.23.0"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86e6a246-557a-42f7-8f1b-b1b914f9f928","source":"wordfence","cve":"","title":"Afterpay Gateway for WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e6a246-557a-42f7-8f1b-b1b914f9f928?source=api-prod","affected":[{"type":"plugin","slug":"afterpay-gateway-for-woocommerce","name":"Afterpay Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86e8e16f-9d93-457a-9093-2fd236e51682","source":"wordfence","cve":"CVE-2024-10885","title":"SearchIQ \u2013 The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e8e16f-9d93-457a-9093-2fd236e51682?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-12-03T14:43:56Z","updated":"2024-12-04T03:37:42Z"},{"id":"wordfence:86e990ae-6bfe-4f2b-8c37-b0675430a638","source":"wordfence","cve":"CVE-2024-12023","title":"FULL \u2013 Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86e990ae-6bfe-4f2b-8c37-b0675430a638?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"3.1.25","to_inclusive":true,"patched_in":"3.1.26"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:20Z"},{"id":"wordfence:86eb42de-a820-4ba7-99cb-03d068e208a9","source":"wordfence","cve":"","title":"Category and Page Icons <= 0.9.1 - Arbitrary File Upload and Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86eb42de-a820-4ba7-99cb-03d068e208a9?source=api-prod","affected":[{"type":"plugin","slug":"category-page-icons","name":"Category and Page Icons","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2014-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86ebb3d1-5fd1-48cb-95b7-f82014323f01","source":"wordfence","cve":"CVE-2023-51544","title":"RegistrationMagic <= 5.2.5.0 - Form Submission Limit Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ebb3d1-5fd1-48cb-95b7-f82014323f01?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.5.0","to_inclusive":true,"patched_in":"5.2.5.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86ebb886-ad30-44e0-bed1-32d2ffefd50b","source":"wordfence","cve":"CVE-2026-52704","title":"PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ebb886-ad30-44e0-bed1-32d2ffefd50b?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-25T17:51:42Z"},{"id":"wordfence:86edc116-054f-4962-a57c-0ce7e1b8ff8c","source":"wordfence","cve":"CVE-2025-13973","title":"StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86edc116-054f-4962-a57c-0ce7e1b8ff8c?source=api-prod","affected":[{"type":"plugin","slug":"stickeasy-protected-contact-form","name":"StickEasy Protected Contact Form","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-02-13T14:25:27Z","updated":"2026-02-14T03:25:27Z"},{"id":"wordfence:86ee1acb-6f0c-40e6-80a0-fc93b61c1602","source":"wordfence","cve":"CVE-2023-3088","title":"WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ee1acb-6f0c-40e6-80a0-fc93b61c1602?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f15e94-6ca7-4eb2-8a38-b4add9251dab","source":"wordfence","cve":"","title":"WP Hotel Booking <= 2.0.9.2 - Improper Authorization on Multiple REST API Routes","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f15e94-6ca7-4eb2-8a38-b4add9251dab?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.9.2","to_inclusive":true,"patched_in":"2.0.9.3"}],"published":"2024-02-03T00:00:00Z","updated":"2024-02-06T23:37:20Z"},{"id":"wordfence:86f3c549-2cdd-4294-bc62-0892e94ddbb7","source":"wordfence","cve":"","title":"Qubely <= 1.7.9 - Incorrect Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f3c549-2cdd-4294-bc62-0892e94ddbb7?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"1.8.0","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f67129-2042-4dff-85de-e189e9f6b53d","source":"wordfence","cve":"CVE-2023-5955","title":"Contact Form Email <= 1.3.43 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f67129-2042-4dff-85de-e189e9f6b53d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.43","to_inclusive":true,"patched_in":"1.3.44"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f6e8b8-ebfd-4d9f-a285-9d0aa2e961ff","source":"wordfence","cve":"CVE-2023-33328","title":"MailChimp Subscribe Forms  <= 4.0.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f6e8b8-ebfd-4d9f-a285-9d0aa2e961ff?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.0.9.1","to_inclusive":true,"patched_in":"4.0.9.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f798f5-77ed-408b-a0f2-91ea3061fd74","source":"wordfence","cve":"CVE-2026-66574","title":"Element Pack Addons for Elementor \u2013 Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f798f5-77ed-408b-a0f2-91ea3061fd74?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"}],"published":"2026-09-17T11:55:00Z","updated":"2026-09-22T18:45:21Z"},{"id":"wordfence:86f7eb83-8483-4c6b-993e-ce11084241e8","source":"wordfence","cve":"","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.39 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f7eb83-8483-4c6b-993e-ce11084241e8?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.39","to_inclusive":true,"patched_in":"3.1.40"}],"published":"2022-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f84434-ac85-4c5f-8dd7-11d02ae9ee89","source":"wordfence","cve":"CVE-2024-43332","title":"Photo Engine <= 6.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f84434-ac85-4c5f-8dd7-11d02ae9ee89?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-26T17:01:51Z"},{"id":"wordfence:86f91589-b309-49aa-8b04-ca972acaf8fb","source":"wordfence","cve":"CVE-2025-5394","title":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f91589-b309-49aa-8b04-ca972acaf8fb?source=api-prod","affected":[{"type":"theme","slug":"alone","name":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme","from":"*","from_inclusive":true,"to":"7.8.3","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2025-07-14T15:24:17Z","updated":"2025-10-29T12:35:55Z"},{"id":"wordfence:86f95721-ff77-4137-adba-61d74373ee06","source":"wordfence","cve":"","title":"Jetapo | Jobboard WordPress Theme and Jetapo | Jobboard WordPress Theme with WooCommerce < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f95721-ff77-4137-adba-61d74373ee06?source=api-prod","affected":[{"type":"theme","slug":"jetapo-with-woocommerce","name":"Jetapo | Jobboard WordPress Theme with WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1"},{"type":"theme","slug":"jetapo","name":"Jetapo | Jobboard WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2020-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:86f9c68f-73ab-4f2b-8424-8515cdf82577","source":"wordfence","cve":"CVE-2026-103369","title":"Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86f9c68f-73ab-4f2b-8424-8515cdf82577?source=api-prod","affected":[{"type":"plugin","slug":"wp-share-buttons-analytics-by-getsocial","name":"Social Share Buttons & Analytics Plugin \u2013 GetSocial.io","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:42:05Z","updated":"2026-10-14T04:28:11Z"},{"id":"wordfence:86fbc499-dca3-41da-a6ef-8e97d7e46d0e","source":"wordfence","cve":"CVE-2026-12154","title":"Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86fbc499-dca3-41da-a6ef-8e97d7e46d0e?source=api-prod","affected":[{"type":"plugin","slug":"fb-reviews-widget","name":"Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.8"}],"published":"2026-07-02T12:00:58Z","updated":"2026-07-06T17:31:48Z"},{"id":"wordfence:86fd7044-7ffb-41a8-bba4-f7dd01710689","source":"wordfence","cve":"CVE-2026-110292","title":"PayPlug for WooCommerce (Official) 2.9.0 - 3.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86fd7044-7ffb-41a8-bba4-f7dd01710689?source=api-prod","affected":[{"type":"plugin","slug":"payplug","name":"PayPlug for WooCommerce (Official)","from":"2.9.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:14:37Z"},{"id":"wordfence:86fe0238-aafb-435f-a686-59393ed68444","source":"wordfence","cve":"CVE-2025-32581","title":"WordPress Spam Blocker <= 2.0.4 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86fe0238-aafb-435f-a686-59393ed68444?source=api-prod","affected":[{"type":"plugin","slug":"cf7-manual-spam-blocker","name":"Spam Blocker | Stop Spam for Contact Form 7, WP Forms and Formidable Forms","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:22:34Z"},{"id":"wordfence:86fe195e-7ebf-4840-89e2-619a238c3082","source":"wordfence","cve":"CVE-2026-32442","title":"e2pdf <= 1.28.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86fe195e-7ebf-4840-89e2-619a238c3082?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.28.15","to_inclusive":true,"patched_in":"1.32.00"}],"published":"2026-03-04T00:00:00Z","updated":"2026-04-15T21:05:38Z"},{"id":"wordfence:86ff2412-23c6-450e-b351-ba994d68aae6","source":"wordfence","cve":"CVE-2022-3930","title":"Directorist <= 7.4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/86ff2412-23c6-450e-b351-ba994d68aae6?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.4.2.1","to_inclusive":true,"patched_in":"7.4.2.2"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87019de5-abd3-4080-a5fa-f476a1645456","source":"wordfence","cve":"CVE-2025-27336","title":"Just Variables <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87019de5-abd3-4080-a5fa-f476a1645456?source=api-prod","affected":[{"type":"plugin","slug":"just-wp-variables","name":"Just Variables","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:36:33Z"},{"id":"wordfence:8703c76b-89c6-438a-b953-03847d965096","source":"wordfence","cve":"CVE-2021-24381","title":"Ninja Forms <= 3.5.8.1 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8703c76b-89c6-438a-b953-03847d965096?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.5.8.2","to_inclusive":false,"patched_in":"3.5.8.2"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87040f2b-4de0-4a8d-ae30-b340638a6df2","source":"wordfence","cve":"CVE-2025-14627","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87040f2b-4de0-4a8d-ae30-b340638a6df2?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.35","to_inclusive":true,"patched_in":"7.36"}],"published":"2026-01-01T03:53:26Z","updated":"2026-01-01T16:19:32Z"},{"id":"wordfence:8704320e-9624-4924-92e8-adb61356aecb","source":"wordfence","cve":"CVE-2025-14120","title":"URL Image Importer <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8704320e-9624-4924-92e8-adb61356aecb?source=api-prod","affected":[{"type":"plugin","slug":"url-image-importer","name":"URL Image Importer \u2013 Import External Images to the Media Library from URL, CSV & XML","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-01-05T15:33:33Z","updated":"2026-01-06T04:31:57Z"},{"id":"wordfence:87045c4e-d52f-4c35-81be-e8c8fc04479b","source":"wordfence","cve":"CVE-2024-54347","title":"FloristPress <= 7.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87045c4e-d52f-4c35-81be-e8c8fc04479b?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:16:58Z"},{"id":"wordfence:8706c3f6-64e0-440e-a802-5c80d9cc3643","source":"wordfence","cve":"CVE-2024-4662","title":"Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8706c3f6-64e0-440e-a802-5c80d9cc3643?source=api-prod","affected":[{"type":"plugin","slug":"oxygenbuilder","name":"Oxygen Builder","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T04:30:54Z"},{"id":"wordfence:87084994-04ea-47ce-ae3a-5f29c30f61d0","source":"wordfence","cve":"CVE-2026-27083","title":"Work & Travel Company <= 1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87084994-04ea-47ce-ae3a-5f29c30f61d0?source=api-prod","affected":[{"type":"theme","slug":"work-travel-company","name":"Work & Travel Company - Youth Programs Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:42:08Z"},{"id":"wordfence:87099513-d8e2-45e5-b7e6-b46558a10d3b","source":"wordfence","cve":"CVE-2025-7045","title":"Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action","severity":"medium","cvss":6.5,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87099513-d8e2-45e5-b7e6-b46558a10d3b?source=api-prod","affected":[{"type":"plugin","slug":"cloud-sso-single-sign-on","name":"Cloud SAML SSO \u2013 Single Sign On Login","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T03:22:37Z"},{"id":"wordfence:870a0989-03ce-4c71-86a5-2e536bfadbc0","source":"wordfence","cve":"CVE-2026-111213","title":"Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870a0989-03ce-4c71-86a5-2e536bfadbc0?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2026-10-27T17:43:41Z","updated":"2026-10-28T06:45:15Z"},{"id":"wordfence:870ae326-a7c9-4201-bf0d-0fbda663a694","source":"wordfence","cve":"CVE-2022-4035","title":"Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870ae326-a7c9-4201-bf0d-0fbda663a694?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.72","to_inclusive":true,"patched_in":"1.3.73"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:870beaba-5294-4a77-89d1-8d5cf92974dc","source":"wordfence","cve":"CVE-2024-54213","title":"WordPress Page Builder \u2013 Zion Builder <= 3.6.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870beaba-5294-4a77-89d1-8d5cf92974dc?source=api-prod","affected":[{"type":"plugin","slug":"zionbuilder","name":"Zion Builder \u2013 Website Builder for Speed & Creativity","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"3.6.17"}],"published":"2024-12-02T00:00:00Z","updated":"2026-01-23T18:57:25Z"},{"id":"wordfence:870bf5fe-00c6-48fe-b9e6-e8233c689b71","source":"wordfence","cve":"CVE-2026-4808","title":"Gerador de Certificados \u2013 DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870bf5fe-00c6-48fe-b9e6-e8233c689b71?source=api-prod","affected":[{"type":"plugin","slug":"gerador-de-certificados-devapps","name":"Gerador de Certificados \u2013 DevApps","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:58Z","updated":"2026-04-08T06:43:40Z"},{"id":"wordfence:870e2eb8-1d31-4782-b4ff-9f033c1b060e","source":"wordfence","cve":"CVE-2026-112863","title":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/870e2eb8-1d31-4782-b4ff-9f033c1b060e?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"kallyas","from":"*","from_inclusive":true,"to":"4.25.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:57:10Z"},{"id":"wordfence:8712893a-5bd3-419f-b816-2f0d8511938f","source":"wordfence","cve":"CVE-2026-114193","title":"GEO my WP <= 4.5.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8712893a-5bd3-419f-b816-2f0d8511938f?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5.5","to_inclusive":true,"patched_in":"4.5.5.7"}],"published":"2026-10-27T10:26:14Z","updated":"2026-11-03T19:24:26Z"},{"id":"wordfence:87135f68-8010-40ff-8507-3111cf8e86e2","source":"wordfence","cve":"CVE-2025-23447","title":"Smooth Dynamic Slider <= 1.0 - Reflected Cross-Site Scriptign","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87135f68-8010-40ff-8507-3111cf8e86e2?source=api-prod","affected":[{"type":"plugin","slug":"smooth-dynamic-slider","name":"Smooth Dynamic Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:42:57Z"},{"id":"wordfence:8714f5cc-56c7-4976-b021-956883a2bc73","source":"wordfence","cve":"","title":"BP Group Documents <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8714f5cc-56c7-4976-b021-956883a2bc73?source=api-prod","affected":[{"type":"plugin","slug":"bp-group-documents","name":"BP Group Documents","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2013-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87154180-620b-47da-9ee5-c5d08ed862f4","source":"wordfence","cve":"CVE-2025-58619","title":"Falang multilanguage <= 1.3.65 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87154180-620b-47da-9ee5-c5d08ed862f4?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.65","to_inclusive":true,"patched_in":"1.3.66"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-22T14:20:15Z"},{"id":"wordfence:87178c7c-343b-487a-9adb-7ff13aae81df","source":"wordfence","cve":"CVE-2025-2800","title":"WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87178c7c-343b-487a-9adb-7ff13aae81df?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.50","to_inclusive":true,"patched_in":"3.1.51"}],"published":"2025-07-15T17:11:50Z","updated":"2025-07-16T05:23:50Z"},{"id":"wordfence:871b94a8-d2ab-4135-8087-80a51f7fea11","source":"wordfence","cve":"CVE-2025-59572","title":"WorkScout-Core < 1.7.06 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871b94a8-d2ab-4135-8087-80a51f7fea11?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.7.06","to_inclusive":false,"patched_in":"1.7.06"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:57:21Z"},{"id":"wordfence:871bef47-a151-4c5b-bffa-bc0abb53e191","source":"wordfence","cve":"CVE-2025-47455","title":"Integration for WooCommerce and Salesforce <= 1.7.5 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871bef47-a151-4c5b-bffa-bc0abb53e191?source=api-prod","affected":[{"type":"plugin","slug":"woo-salesforce-plugin-crm-perks","name":"Integration for WooCommerce and Salesforce","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:59:07Z"},{"id":"wordfence:871e1be0-2dd2-47d1-b497-ca71e6f3b090","source":"wordfence","cve":"CVE-2025-46262","title":"Mad Mimi for WordPress <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871e1be0-2dd2-47d1-b497-ca71e6f3b090?source=api-prod","affected":[{"type":"plugin","slug":"mad-mimi","name":"Mad Mimi for WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:03:42Z"},{"id":"wordfence:871e5091-bb20-4a53-83e2-85ed6f26247a","source":"wordfence","cve":"CVE-2023-28788","title":"Advanced Page Visit Counter <= 6.4.2 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871e5091-bb20-4a53-83e2-85ed6f26247a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.2.1"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:871e5bb2-acda-4b57-8d9f-f7c47ee606fb","source":"wordfence","cve":"CVE-2024-51905","title":"RSV PDF Preview <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871e5bb2-acda-4b57-8d9f-f7c47ee606fb?source=api-prod","affected":[{"type":"plugin","slug":"rsv-pdf-preview","name":"RSV PDF Preview","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:58:26Z"},{"id":"wordfence:871f6611-3b5e-4e36-992c-726b31e88c95","source":"wordfence","cve":"CVE-2026-8705","title":"ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/871f6611-3b5e-4e36-992c-726b31e88c95?source=api-prod","affected":[{"type":"plugin","slug":"clearsale-total","name":"ClearSale Total","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:37:17Z","updated":"2026-09-30T13:49:58Z"},{"id":"wordfence:8721b15f-cb17-48d2-bd8f-20125452d621","source":"wordfence","cve":"CVE-2025-23427","title":"Redux Converter <= 1.1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8721b15f-cb17-48d2-bd8f-20125452d621?source=api-prod","affected":[{"type":"plugin","slug":"redux-converter","name":"Redux Converter","from":"*","from_inclusive":true,"to":"1.1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:19:47Z"},{"id":"wordfence:87246b00-7a61-4ab4-90f1-2ac42f5b9f1d","source":"wordfence","cve":"CVE-2026-39464","title":"Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.19.8 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87246b00-7a61-4ab4-90f1-2ac42f5b9f1d?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.19.8","to_inclusive":true,"patched_in":"6.19.9"}],"published":"2026-03-14T00:00:00Z","updated":"2026-05-05T14:53:55Z"},{"id":"wordfence:8726375f-de67-4c92-9cf8-1bfb7330f327","source":"wordfence","cve":"CVE-2025-8357","title":"Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8726375f-de67-4c92-9cf8-1bfb7330f327?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.27","to_inclusive":true,"patched_in":"3.28"}],"published":"2025-08-18T16:23:26Z","updated":"2025-08-19T04:26:03Z"},{"id":"wordfence:8727f4fa-b6a9-4da7-b2a5-5d74ddcc082f","source":"wordfence","cve":"CVE-2026-57350","title":"WP Debugging <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8727f4fa-b6a9-4da7-b2a5-5d74ddcc082f?source=api-prod","affected":[{"type":"plugin","slug":"wp-debugging","name":"WP Debugging","from":"*","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:46:30Z"},{"id":"wordfence:87287221-ee9b-4ca2-bb35-f8945cd58ce7","source":"wordfence","cve":"CVE-2026-82607","title":"Profile Builder < 3.16.1 - Unauthenticated Limited File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87287221-ee9b-4ca2-bb35-f8945cd58ce7?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2026-08-30T00:00:00Z","updated":"2026-09-16T18:23:43Z"},{"id":"wordfence:872a6264-f0e2-4936-a942-172a99892672","source":"wordfence","cve":"CVE-2016-10881","title":"Google Doc Embedder <= 2.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872a6264-f0e2-4936-a942-172a99892672?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":false,"patched_in":"2.6.2"}],"published":"2016-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:872c42d5-56f4-4825-b664-92e43b6d089a","source":"wordfence","cve":"CVE-2024-53734","title":"Idealien Category Enhancements <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872c42d5-56f4-4825-b664-92e43b6d089a?source=api-prod","affected":[{"type":"plugin","slug":"idealien-category-enhancements","name":"Idealien Category Enhancements","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:24:04Z"},{"id":"wordfence:872c61aa-c95c-4b86-8e39-8112bb117a0b","source":"wordfence","cve":"CVE-2026-0687","title":"Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872c61aa-c95c-4b86-8e39-8112bb117a0b?source=api-prod","affected":[{"type":"plugin","slug":"meta-box-gallerymeta","name":"Meta-box GalleryMeta","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-01-23T20:03:22Z","updated":"2026-02-03T18:51:47Z"},{"id":"wordfence:872c8328-9089-4bc0-af17-f755524da610","source":"wordfence","cve":"CVE-2024-9028","title":"WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872c8328-9089-4bc0-af17-f755524da610?source=api-prod","affected":[{"type":"plugin","slug":"wp-gpx-maps","name":"WP GPX Maps \u2013 GPX, FIT & KML maps with elevation profile","from":"*","from_inclusive":true,"to":"1.7.08","to_inclusive":true,"patched_in":"1.7.10"}],"published":"2024-09-24T12:13:51Z","updated":"2025-03-13T20:22:48Z"},{"id":"wordfence:872e1a05-aacc-44fa-93c1-8c3f7b2fb46d","source":"wordfence","cve":"CVE-2026-82901","title":"Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872e1a05-aacc-44fa-93c1-8c3f7b2fb46d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.50","to_inclusive":true,"patched_in":"3.5.51"}],"published":"2026-09-26T06:02:31Z","updated":"2026-09-26T18:28:25Z"},{"id":"wordfence:872f13bc-e6d0-4307-b2c9-b55a44df1016","source":"wordfence","cve":"","title":"LiveChat WooCommerce <= 2.2.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872f13bc-e6d0-4307-b2c9-b55a44df1016?source=api-prod","affected":[{"type":"plugin","slug":"livechat-woocommerce","name":"Live Chat Plugin for WooCommerce \u2013 LiveChat","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:872f216c-b8ed-409d-a7eb-f5187ea2b8dd","source":"wordfence","cve":"CVE-2026-32377","title":"Pranayama Yoga <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/872f216c-b8ed-409d-a7eb-f5187ea2b8dd?source=api-prod","affected":[{"type":"theme","slug":"pranayama-yoga","name":"Pranayama Yoga","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:53:36Z"},{"id":"wordfence:8730912d-6098-44c9-bff3-87f1c3e0aa3d","source":"wordfence","cve":"CVE-2025-54017","title":"Paid Membership Subscriptions <= 2.15.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8730912d-6098-44c9-bff3-87f1c3e0aa3d?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.15.4","to_inclusive":true,"patched_in":"2.15.5"}],"published":"2025-07-29T00:00:00Z","updated":"2025-08-04T21:33:19Z"},{"id":"wordfence:8731565f-4d8a-49e6-9c38-6d4f5e51d68c","source":"wordfence","cve":"CVE-2026-5415","title":"WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8731565f-4d8a-49e6-9c38-6d4f5e51d68c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"5.38","to_inclusive":true,"patched_in":"5.39"}],"published":"2026-06-05T05:58:19Z","updated":"2026-06-05T18:31:11Z"},{"id":"wordfence:87333eee-36ae-4272-b300-7352eb133745","source":"wordfence","cve":"CVE-2012-3414","title":"WordPress Core <= 3.3.1 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87333eee-36ae-4272-b300-7352eb133745?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2012-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87368d85-04d4-42e6-9ba6-2a1fc3b945a8","source":"wordfence","cve":"CVE-2024-6864","title":"WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87368d85-04d4-42e6-9ba6-2a1fc3b945a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified-info","name":"WP Last Modified Info","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-08-19T15:52:33Z","updated":"2024-08-20T04:28:33Z"},{"id":"wordfence:8736cf81-3fb8-4c81-a878-7d73a3e68fc2","source":"wordfence","cve":"CVE-2024-9452","title":"Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8736cf81-3fb8-4c81-a878-7d73a3e68fc2?source=api-prod","affected":[{"type":"plugin","slug":"branding","name":"Branding","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T16:06:19Z","updated":"2024-10-18T04:32:54Z"},{"id":"wordfence:8736fb91-d05c-4f7e-81ff-00dfa44961f5","source":"wordfence","cve":"CVE-2024-3997","title":"Prime Slider \u2013 Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8736fb91-d05c-4f7e-81ff-00dfa44961f5?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T11:02:38Z"},{"id":"wordfence:87399a07-d2d8-42cd-81f0-9060f6cfff48","source":"wordfence","cve":"CVE-2023-2278","title":"WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87399a07-d2d8-42cd-81f0-9060f6cfff48?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:873b54ba-d29f-4e09-9dc1-a38c10ebfcb1","source":"wordfence","cve":"CVE-2025-13091","title":"Shopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install","severity":"medium","cvss":4.3,"cwe":"CWE-15","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/873b54ba-d29f-4e09-9dc1-a38c10ebfcb1?source=api-prod","affected":[{"type":"theme","slug":"shopire","name":"Shopire","from":"*","from_inclusive":true,"to":"1.0.57","to_inclusive":true,"patched_in":"1.0.58"}],"published":"2026-02-18T15:29:13Z","updated":"2026-02-19T04:36:18Z"},{"id":"wordfence:873b6ace-0377-42d8-a6c5-3fe0226cebc5","source":"wordfence","cve":"CVE-2021-24985","title":"Easy Forms for Mailchimp <= 6.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/873b6ace-0377-42d8-a6c5-3fe0226cebc5?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.6","to_inclusive":false,"patched_in":"6.8.6"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:873d82ef-cc73-4294-a972-9cd5392d3b54","source":"wordfence","cve":"CVE-2026-39588","title":"NM Gift Registry and Wishlist Lite <= 5.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/873d82ef-cc73-4294-a972-9cd5392d3b54?source=api-prod","affected":[{"type":"plugin","slug":"nm-gift-registry-and-wishlist-lite","name":"NM Gift Registry and Wishlist Lite","from":"*","from_inclusive":true,"to":"5.13","to_inclusive":true,"patched_in":"5.14"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:15:55Z"},{"id":"wordfence:873deede-6fcc-48b8-8b26-2661b83107d9","source":"wordfence","cve":"CVE-2026-12393","title":"WPS Bookings for WooCommerce <= 3.11.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/873deede-6fcc-48b8-8b26-2661b83107d9?source=api-prod","affected":[{"type":"plugin","slug":"mwb-bookings-for-woocommerce","name":"WPS Bookings for WooCommerce","from":"*","from_inclusive":true,"to":"3.11.6","to_inclusive":true,"patched_in":"3.11.7"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T12:31:35Z"},{"id":"wordfence:873e8f12-19a8-43b4-8da0-8b740853b658","source":"wordfence","cve":"CVE-2024-50539","title":"Lodgix.com Vacation Rental Website Builder <= 3.9.73 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/873e8f12-19a8-43b4-8da0-8b740853b658?source=api-prod","affected":[{"type":"plugin","slug":"lodgixcom-vacation-rental-listing-management-booking-plugin","name":"Lodgix.com Vacation Rental Website Builder","from":"*","from_inclusive":true,"to":"3.9.73","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:35:19Z"},{"id":"wordfence:874130f0-7dc9-49fe-a7b0-e0be432799bd","source":"wordfence","cve":"","title":"Google XML Sitemaps Generator < 3.2.9 - Authenticated (Admin+) PHP Code Injection","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874130f0-7dc9-49fe-a7b0-e0be432799bd?source=api-prod","affected":[{"type":"plugin","slug":"google-xml-sitemaps-generator","name":"Google XML Sitemaps Generator","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2013-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87418933-53a6-41d4-af7b-f1d2408ff4cd","source":"wordfence","cve":"CVE-2024-54424","title":"Like in Vk.com <= 0.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87418933-53a6-41d4-af7b-f1d2408ff4cd?source=api-prod","affected":[{"type":"plugin","slug":"like-on-vkontakte","name":"Like in Vk.com","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:03:26Z"},{"id":"wordfence:8741bbdf-ddd9-41f7-8d22-b9350f2cf659","source":"wordfence","cve":"CVE-2025-5083","title":"Amministrazione Trasparente <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8741bbdf-ddd9-41f7-8d22-b9350f2cf659?source=api-prod","affected":[{"type":"plugin","slug":"amministrazione-trasparente","name":"Amministrazione Trasparente","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"9.1"}],"published":"2025-08-30T16:22:25Z","updated":"2025-08-31T04:25:49Z"},{"id":"wordfence:8746b363-f1c2-42cb-83cf-639ab4102a50","source":"wordfence","cve":"CVE-2025-9206","title":"Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8746b363-f1c2-42cb-83cf-639ab4102a50?source=api-prod","affected":[{"type":"plugin","slug":"meks-easy-maps","name":"Meks Easy Maps","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-10-02T22:34:49Z","updated":"2026-09-18T19:12:07Z"},{"id":"wordfence:8746bd3a-6e2b-4ed2-9b21-4ed5a0e58de8","source":"wordfence","cve":"CVE-2020-4050","title":"WordPress Core < 5.4.2 - Arbitrary User Meta Update","severity":"low","cvss":3.5,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8746bd3a-6e2b-4ed2-9b21-4ed5a0e58de8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:874a989e-7a8a-4837-b66f-320f35cd9aca","source":"wordfence","cve":"CVE-2026-17540","title":"Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874a989e-7a8a-4837-b66f-320f35cd9aca?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-21T15:47:05Z"},{"id":"wordfence:874b3448-df4c-49c4-bf4f-435cf48f6305","source":"wordfence","cve":"CVE-2025-13419","title":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874b3448-df4c-49c4-bf4f-435cf48f6305?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-01-06T20:25:47Z","updated":"2026-01-07T09:21:00Z"},{"id":"wordfence:874b4d60-153a-44e5-b7c5-037ba66b34ea","source":"wordfence","cve":"CVE-2025-26995","title":"Market Exporter <= 2.0.21 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874b4d60-153a-44e5-b7c5-037ba66b34ea?source=api-prod","affected":[{"type":"plugin","slug":"market-exporter","name":"Market Exporter","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:19:58Z"},{"id":"wordfence:874c1ba5-1bbd-43ac-bc5c-901638fa56ef","source":"wordfence","cve":"CVE-2026-15018","title":"Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874c1ba5-1bbd-43ac-bc5c-901638fa56ef?source=api-prod","affected":[{"type":"plugin","slug":"database-collation-fix","name":"Database Collation Fix","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-07-31T19:22:46Z","updated":"2026-08-01T07:49:49Z"},{"id":"wordfence:874e9e14-1330-40f0-8199-8abcaae58e98","source":"wordfence","cve":"CVE-2023-46150","title":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/874e9e14-1330-40f0-8199-8abcaae58e98?source=api-prod","affected":[{"type":"plugin","slug":"wp-radio","name":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8755ab3f-ee77-44ea-8620-590f1f1cb333","source":"wordfence","cve":"CVE-2025-14437","title":"Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8755ab3f-ee77-44ea-8620-590f1f1cb333?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.18.0","to_inclusive":true,"patched_in":"3.18.1"}],"published":"2025-12-17T23:41:59Z","updated":"2025-12-18T12:22:29Z"},{"id":"wordfence:87578417-6360-4551-b61c-237a3a1fb348","source":"wordfence","cve":"CVE-2026-77010","title":"HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87578417-6360-4551-b61c-237a3a1fb348?source=api-prod","affected":[{"type":"plugin","slug":"hel-online-classroom","name":"HEL Online Classroom: AI-powered Online Classrooms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-02T13:32:10Z"},{"id":"wordfence:8758cda7-06a7-4bc4-b393-bca654f7ecd3","source":"wordfence","cve":"CVE-2025-55712","title":"The Plus Addons for Elementor Page Builder Lite <= 6.3.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8758cda7-06a7-4bc4-b393-bca654f7ecd3?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"6.3.14"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:54:54Z"},{"id":"wordfence:8759bb88-2c19-4875-99c1-f83a2abaffa2","source":"wordfence","cve":"CVE-2025-24635","title":"Paytm Payment Donation <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8759bb88-2c19-4875-99c1-f83a2abaffa2?source=api-prod","affected":[{"type":"plugin","slug":"paytm-donation","name":"Paytm Payment Donation","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-01-05T00:00:00Z","updated":"2025-02-19T17:02:06Z"},{"id":"wordfence:875b15a1-c747-4a74-a77e-d541f92468a3","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/875b15a1-c747-4a74-a77e-d541f92468a3?source=api-prod","affected":[{"type":"plugin","slug":"mapsmarker","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:875c6474-5bf3-4556-b529-299cd2f65afe","source":"wordfence","cve":"CVE-2022-45366","title":"Slimstat Analytics <= 5.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/875c6474-5bf3-4556-b529-299cd2f65afe?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:875db71d-c799-40b9-95e1-74d53046b0a9","source":"wordfence","cve":"CVE-2024-0954","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/875db71d-c799-40b9-95e1-74d53046b0a9?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-05T21:21:52Z"},{"id":"wordfence:875fbe6e-436c-445c-bd0c-0e6beae3fbf2","source":"wordfence","cve":"CVE-2025-23842","title":"WordPress Gallery Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/875fbe6e-436c-445c-bd0c-0e6beae3fbf2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gallery-plugin","name":"WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:54:12Z"},{"id":"wordfence:8761c046-35da-4fc9-a839-c06405ff4b31","source":"wordfence","cve":"CVE-2025-10131","title":"All Social Share Options <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8761c046-35da-4fc9-a839-c06405ff4b31?source=api-prod","affected":[{"type":"plugin","slug":"all-social-share-options","name":"All Social Share Options","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:32:36Z","updated":"2025-09-30T03:35:27Z"},{"id":"wordfence:8765b075-a2db-4423-a449-d7aa0c15db74","source":"wordfence","cve":"CVE-2026-39566","title":"DirectoryPress <= 3.6.26 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8765b075-a2db-4423-a449-d7aa0c15db74?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.26","to_inclusive":true,"patched_in":"3.6.27"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T15:23:22Z"},{"id":"wordfence:87661de6-e835-495e-9bd2-4d64b4718108","source":"wordfence","cve":"CVE-2026-89435","title":"Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87661de6-e835-495e-9bd2-4d64b4718108?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.35","to_inclusive":true,"patched_in":"7.0"}],"published":"2026-10-29T18:46:13Z","updated":"2026-10-30T06:47:31Z"},{"id":"wordfence:8766608e-df72-4b9d-a301-a50c64fadc9a","source":"wordfence","cve":"CVE-2025-7221","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8766608e-df72-4b9d-a301-a50c64fadc9a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2025-08-20T16:38:25Z","updated":"2025-08-21T05:28:16Z"},{"id":"wordfence:87672771-585b-41ca-a274-5bd6f8401ff3","source":"wordfence","cve":"CVE-2025-67552","title":"Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87672771-585b-41ca-a274-5bd6f8401ff3?source=api-prod","affected":[{"type":"plugin","slug":"walker-core","name":"Walker Core","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2025-11-19T00:00:00Z","updated":"2025-12-10T16:08:28Z"},{"id":"wordfence:876b57e0-cf1e-4ce9-ba85-a5d4554797bd","source":"wordfence","cve":"CVE-2025-13217","title":"Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2025-12-16T00:00:00Z","updated":"2025-12-17T18:21:34Z"},{"id":"wordfence:876d81fd-f8fc-481c-b5d6-e071591ac438","source":"wordfence","cve":"CVE-2025-58677","title":"ShrinkTheWeb (STW) Website Previews <= 2.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/876d81fd-f8fc-481c-b5d6-e071591ac438?source=api-prod","affected":[{"type":"plugin","slug":"shrinktheweb-website-preview-plugin","name":"ShrinkTheWeb (STW) Website Previews Plugin","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:50:46Z"},{"id":"wordfence:876efd71-8867-44b8-8017-86fad2a1b89f","source":"wordfence","cve":"CVE-2023-6063","title":"WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/876efd71-8867-44b8-8017-86fad2a1b89f?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-11-13T00:00:00Z","updated":"2025-10-30T12:54:51Z"},{"id":"wordfence:876f0843-c75b-40aa-9e14-9ffbffea6ef6","source":"wordfence","cve":"CVE-2025-62077","title":"Affiliate Link Tracker <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/876f0843-c75b-40aa-9e14-9ffbffea6ef6?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-link-tracker","name":"Affiliate Link Tracker","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T05:46:18Z","updated":"2026-02-03T13:42:18Z"},{"id":"wordfence:876f9c76-dc4f-4d79-a037-43304245df32","source":"wordfence","cve":"CVE-2024-10076","title":"Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/876f9c76-dc4f-4d79-a037-43304245df32?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"13.7","to_inclusive":true,"patched_in":"13.8"},{"type":"plugin","slug":"jetpack-boost","name":"Jetpack Boost \u2013 Website Speed, Performance and Critical CSS","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-10-17T00:00:00Z","updated":"2025-05-27T14:45:25Z"},{"id":"wordfence:8772a00a-b285-4b1e-a903-6f8404cf21a3","source":"wordfence","cve":"CVE-2022-4625","title":"Login Logout Menu <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8772a00a-b285-4b1e-a903-6f8404cf21a3?source=api-prod","affected":[{"type":"plugin","slug":"login-logout-menu","name":"Login Logout Menu","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8773fa6e-6e81-4565-a9be-36ad0ea6ac88","source":"wordfence","cve":"CVE-2022-43469","title":"Corona Virus (COVID-19) Banner & Live Data <= 1.7.0.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8773fa6e-6e81-4565-a9be-36ad0ea6ac88?source=api-prod","affected":[{"type":"plugin","slug":"corona-virus-covid-19-banner","name":"Simple Website Banner","from":"*","from_inclusive":true,"to":"1.7.0.6","to_inclusive":true,"patched_in":"1.8.0.0"}],"published":"2022-10-24T00:00:00Z","updated":"2024-02-19T22:15:03Z"},{"id":"wordfence:8774f448-ba63-428c-8a82-b229718fdd10","source":"wordfence","cve":"CVE-2021-38344","title":"Brizy - Page Builder <= 2.3.11 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8774f448-ba63-428c-8a82-b229718fdd10?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8775662f-d007-4edf-826e-f755d7b11c25","source":"wordfence","cve":"CVE-2024-9626","title":"Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8775662f-d007-4edf-826e-f755d7b11c25?source=api-prod","affected":[{"type":"plugin","slug":"zemanta","name":"Editorial Assistant by Sovrn","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T01:58:36Z"},{"id":"wordfence:8777f440-732b-4fef-9830-aa6b92265ddc","source":"wordfence","cve":"CVE-2025-62131","title":"Tasty Recipes Lite <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8777f440-732b-4fef-9830-aa6b92265ddc?source=api-prod","affected":[{"type":"plugin","slug":"tasty-recipes-lite","name":"Tasty Recipes Lite \u2013 WordPress Recipe Card Plugin with Built-In Recipe Schema","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T16:34:11Z"},{"id":"wordfence:877a42c9-958d-46ed-8f9a-5972bd5f43f8","source":"wordfence","cve":"CVE-2020-20406","title":"Elementor Website Builder <= 2.9.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/877a42c9-958d-46ed-8f9a-5972bd5f43f8?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2020-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87813484-152f-4165-83ac-0678be1262e1","source":"wordfence","cve":"CVE-2026-93528","title":"NP Quote Request for WooCommerce <= 2.4.15 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87813484-152f-4165-83ac-0678be1262e1?source=api-prod","affected":[{"type":"plugin","slug":"woo-rfq-for-woocommerce","name":"NP Quote Request for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:47:11Z"},{"id":"wordfence:878246f7-17c5-4ea0-a450-27244ace2717","source":"wordfence","cve":"CVE-2021-20867","title":"Advanced Custom Fields <= 5.10 - Missing Authorization on Option Changes","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878246f7-17c5-4ea0-a450-27244ace2717?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"}],"published":"2021-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8782aefa-6fb6-4b42-b697-cee3e1713e9c","source":"wordfence","cve":"CVE-2025-32609","title":"Verowa Connect <= 3.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8782aefa-6fb6-4b42-b697-cee3e1713e9c?source=api-prod","affected":[{"type":"plugin","slug":"verowa-connect","name":"Verowa Connect","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:23:24Z"},{"id":"wordfence:878420ce-3a39-494d-9169-44220b2c3307","source":"wordfence","cve":"","title":"iThemes2 < 1.4.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878420ce-3a39-494d-9169-44220b2c3307?source=api-prod","affected":[{"type":"theme","slug":"ithemes2","name":"iThemes2","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2013-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:878653e9-da8e-451b-8f23-7ea3418d3b37","source":"wordfence","cve":"CVE-2024-56070","title":"WP SuperBackup <= 2.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878653e9-da8e-451b-8f23-7ea3418d3b37?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:06:26Z"},{"id":"wordfence:878671d2-572c-43f9-8fba-f2e2e955b7a6","source":"wordfence","cve":"","title":"Protect WP Admin <= 3.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878671d2-572c-43f9-8fba-f2e2e955b7a6?source=api-prod","affected":[{"type":"plugin","slug":"protect-wp-admin","name":"Protect WP Admin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87870d48-05ff-4f51-9ad9-091ce2ffaf01","source":"wordfence","cve":"CVE-2014-3842","title":"iMember360is 3.8.012 - 3.9.001 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87870d48-05ff-4f51-9ad9-091ce2ffaf01?source=api-prod","affected":[{"type":"plugin","slug":"imember360","name":"iMember360is","from":"3.8.012","from_inclusive":true,"to":"3.9.002","to_inclusive":false,"patched_in":"3.9.002"}],"published":"2014-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87888350-1230-4fec-9de2-c58fa24e6a05","source":"wordfence","cve":"CVE-2024-4441","title":"XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87888350-1230-4fec-9de2-c58fa24e6a05?source=api-prod","affected":[{"type":"plugin","slug":"xml-sitemap-feed","name":"XML Sitemap & Google News","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:32Z"},{"id":"wordfence:878a687c-9baf-4cb3-b603-e3dec1eb0544","source":"wordfence","cve":"CVE-2025-67632","title":"Google AdSense for Responsive Design \u2013 GARD <= 2.23 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878a687c-9baf-4cb3-b603-e3dec1eb0544?source=api-prod","affected":[{"type":"plugin","slug":"google-adsense-for-responsive-design-gard","name":"Google AdSense for Responsive Design \u2013 GARD","from":"*","from_inclusive":true,"to":"2.23","to_inclusive":true,"patched_in":""}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-05T18:44:33Z"},{"id":"wordfence:878ec7b7-356a-4e14-8c48-3e217f5f51a1","source":"wordfence","cve":"CVE-2025-32605","title":"MemberPress Discord Addon <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878ec7b7-356a-4e14-8c48-3e217f5f51a1?source=api-prod","affected":[{"type":"plugin","slug":"expresstechsoftwares-memberpress-discord-add-on","name":"ExpressTechSoftwares Addon for MemberPress and Discord","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:23:19Z"},{"id":"wordfence:878f27d3-bb57-46b4-aee4-03720d695504","source":"wordfence","cve":"CVE-2020-25379","title":"Recall Products <= 0.8 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/878f27d3-bb57-46b4-aee4-03720d695504?source=api-prod","affected":[{"type":"plugin","slug":"recall-products","name":"Recall Products","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8790bcca-a8c8-4b66-9ecc-47b7783cb224","source":"wordfence","cve":"CVE-2025-60115","title":"Instapage Plugin <= 3.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8790bcca-a8c8-4b66-9ecc-47b7783cb224?source=api-prod","affected":[{"type":"plugin","slug":"instapage","name":"Instapage Plugin","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-09-26T00:00:00Z","updated":"2025-12-04T16:42:07Z"},{"id":"wordfence:87927bb0-6848-4714-9d28-f76c8cea838b","source":"wordfence","cve":"CVE-2026-103077","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87927bb0-6848-4714-9d28-f76c8cea838b?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:24Z"},{"id":"wordfence:879384eb-bfea-4667-a7de-9f723dbea74b","source":"wordfence","cve":"CVE-2024-4354","title":"TablePress \u2013 Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879384eb-bfea-4667-a7de-9f723dbea74b?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T05:33:47Z"},{"id":"wordfence:87944086-a4a4-4152-99f1-847eef7569ea","source":"wordfence","cve":"CVE-2024-44051","title":"Content Blocks (Custom Post Widget) <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87944086-a4a4-4152-99f1-847eef7569ea?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2024-09-05T00:00:00Z","updated":"2024-10-04T18:28:30Z"},{"id":"wordfence:8794854d-e931-4a85-b767-2ab81bfcb780","source":"wordfence","cve":"CVE-2023-47843","title":"CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8794854d-e931-4a85-b767-2ab81bfcb780?source=api-prod","affected":[{"type":"plugin","slug":"catablog","name":"CataBlog","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87950d16-dba6-4759-b15f-57c495cdda67","source":"wordfence","cve":"CVE-2026-39645","title":"GlobalPayments WooCommerce <= 1.18.3 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87950d16-dba6-4759-b15f-57c495cdda67?source=api-prod","affected":[{"type":"plugin","slug":"global-payments-woocommerce","name":"GlobalPayments Gateway Provider for WooCommerce","from":"*","from_inclusive":true,"to":"1.18.3","to_inclusive":true,"patched_in":"1.18.4"}],"published":"2026-02-15T00:00:00Z","updated":"2026-05-19T12:42:23Z"},{"id":"wordfence:8798e16d-84dd-40bb-b4ff-db800e850b0e","source":"wordfence","cve":"CVE-2024-9475","title":"Poll Maker \u2013 Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8798e16d-84dd-40bb-b4ff-db800e850b0e?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T01:58:36Z"},{"id":"wordfence:8799a4d7-ac88-4ec9-8552-b9058b305f13","source":"wordfence","cve":"CVE-2026-116857","title":"JetSmartFilters <= 3.8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8799a4d7-ac88-4ec9-8552-b9058b305f13?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.8.6.2","to_inclusive":true,"patched_in":"3.8.6.3"}],"published":"2026-10-29T13:53:00Z","updated":"2026-11-03T19:35:15Z"},{"id":"wordfence:879bd819-5513-4253-b6e0-a34dbebae287","source":"wordfence","cve":"CVE-2021-24676","title":"Better Find and Replace <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879bd819-5513-4253-b6e0-a34dbebae287?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:879c0a85-ed94-430c-8e8e-6389294b432b","source":"wordfence","cve":"CVE-2019-15115","title":"LoginWP <= 2.9.1 - Multiple Cross-Site Request Forgery vulnerabilities","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879c0a85-ed94-430c-8e8e-6389294b432b?source=api-prod","affected":[{"type":"plugin","slug":"peters-login-redirect","name":"LoginWP (Formerly Peter's Login Redirect)","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2019-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:879c201d-676d-42f4-a8a6-05ea52b00407","source":"wordfence","cve":"CVE-2026-94166","title":"UpSolution Core <= 8.44 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879c201d-676d-42f4-a8a6-05ea52b00407?source=api-prod","affected":[{"type":"plugin","slug":"us-core","name":"UpSolution Core","from":"*","from_inclusive":true,"to":"8.44","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:35:02Z"},{"id":"wordfence:879df622-ca6a-45ea-b8f9-e3882d4bfff7","source":"wordfence","cve":"CVE-2026-65513","title":"Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879df622-ca6a-45ea-b8f9-e3882d4bfff7?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.10","to_inclusive":true,"patched_in":"1.6.12.11"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:47:20Z"},{"id":"wordfence:879e7695-3a61-4e65-b102-fcdc63fac688","source":"wordfence","cve":"CVE-2022-45348","title":"amr users <= 4.59.4 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879e7695-3a61-4e65-b102-fcdc63fac688?source=api-prod","affected":[{"type":"plugin","slug":"amr-users","name":"amr users","from":"*","from_inclusive":true,"to":"4.59.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-10-24T18:56:55Z"},{"id":"wordfence:879f298d-a84a-44ea-a3dc-2c5663d52a2a","source":"wordfence","cve":"CVE-2026-15231","title":"TaxoPress <= 3.50.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Private Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/879f298d-a84a-44ea-a3dc-2c5663d52a2a?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.50.0","to_inclusive":true,"patched_in":"3.51.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:35:41Z"},{"id":"wordfence:87a1bf86-7e05-4124-b774-9e27902be688","source":"wordfence","cve":"CVE-2025-14360","title":"Blockons <= 1.2.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87a1bf86-7e05-4124-b774-9e27902be688?source=api-prod","affected":[{"type":"plugin","slug":"blockons","name":"Blockons \u2013 Gutenberg blocks for WordPress and WooCommerce websites","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T17:29:20Z"},{"id":"wordfence:87a1cc00-330c-40c3-a174-8ea50075c4bd","source":"wordfence","cve":"CVE-2023-47769","title":"WP Maintenance <= 6.1.3 - IP Restriction Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87a1cc00-330c-40c3-a174-8ea50075c4bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.1.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87a2f576-2e72-44c9-a379-b24bee273ee5","source":"wordfence","cve":"CVE-2025-1626","title":"Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87a2f576-2e72-44c9-a379-b24bee273ee5?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-04-28T00:00:00Z","updated":"2025-05-23T15:08:29Z"},{"id":"wordfence:87aa7d7e-f6f4-42c1-9b15-2fcab6750cd3","source":"wordfence","cve":"CVE-2026-96653","title":"WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87aa7d7e-f6f4-42c1-9b15-2fcab6750cd3?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-10-09T19:09:45Z","updated":"2026-10-10T07:41:46Z"},{"id":"wordfence:87adbc9d-cb7b-4e3b-be43-73663d549d20","source":"wordfence","cve":"CVE-2025-54026","title":"GymBase Theme Classes <= 1.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87adbc9d-cb7b-4e3b-be43-73663d549d20?source=api-prod","affected":[{"type":"theme","slug":"gymbase_classes","name":"GymBase Theme Classes","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:54:13Z"},{"id":"wordfence:87ae0d66-3974-48ed-8a84-722e52df6b64","source":"wordfence","cve":"CVE-2026-66660","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87ae0d66-3974-48ed-8a84-722e52df6b64?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-18T00:28:23Z"},{"id":"wordfence:87b26fcf-d0b3-4ab3-92d8-8f1ba72af0a3","source":"wordfence","cve":"","title":"BuddyPress <= 9.0.0 - Information Disclosure via REST API","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87b26fcf-d0b3-4ab3-92d8-8f1ba72af0a3?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87b49bae-05e6-44cd-86a1-8df3249a25f9","source":"wordfence","cve":"CVE-2024-31387","title":"Popup Like box \u2013 Page <= 3.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87b49bae-05e6-44cd-86a1-8df3249a25f9?source=api-prod","affected":[{"type":"plugin","slug":"ays-facebook-popup-likebox","name":"Popup Like box \u2013 Page Plugin","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:45:27Z"},{"id":"wordfence:87b7bc4a-4d2f-4bcb-a9d5-72e31c95c09e","source":"wordfence","cve":"CVE-2024-3813","title":"tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87b7bc4a-4d2f-4bcb-a9d5-72e31c95c09e?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2024-04-18T00:00:00Z","updated":"2024-06-15T02:02:00Z"},{"id":"wordfence:87b8386e-863e-4a33-8beb-aab3e704ecb6","source":"wordfence","cve":"","title":"Built-in Widgets Query extend <= 1.05 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87b8386e-863e-4a33-8beb-aab3e704ecb6?source=api-prod","affected":[{"type":"plugin","slug":"widget-extend-builtin-query","name":"Built-in Widgets Query extend (Custom Post Types & more)","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":"1.06"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87bb2aa8-9554-493b-931f-bef80dc5404a","source":"wordfence","cve":"CVE-2025-23837","title":"One Backend Language <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87bb2aa8-9554-493b-931f-bef80dc5404a?source=api-prod","affected":[{"type":"plugin","slug":"one-backend-language","name":"One Backend Language","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:24:51Z"},{"id":"wordfence:87bd0e6b-7f0d-4696-99aa-c87013efc5a8","source":"wordfence","cve":"CVE-2024-47372","title":"TNC PDF viewer <= 3.1.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87bd0e6b-7f0d-4696-99aa-c87013efc5a8?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-by-themencode","name":"TNC PDF viewer","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:56:53Z"},{"id":"wordfence:87c7ea55-f1ac-411e-9b27-650461f74afb","source":"wordfence","cve":"CVE-2026-66620","title":"OptionTree <= 2.7.3 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87c7ea55-f1ac-411e-9b27-650461f74afb?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:18:11Z"},{"id":"wordfence:87c7fe1a-c7d3-4d95-b3ed-da08c7428ad1","source":"wordfence","cve":"CVE-2024-52414","title":"WDES Responsive Mobile Menu <= 1.2.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87c7fe1a-c7d3-4d95-b3ed-da08c7428ad1?source=api-prod","affected":[{"type":"plugin","slug":"wdes-responsive-mobile-menu","name":"WDES Responsive Mobile Menu","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-12-04T16:15:50Z"},{"id":"wordfence:87c99299-d23b-4cab-b2dc-abeed89155ff","source":"wordfence","cve":"CVE-2019-14936","title":"Easy!Appointments <= 1.3.2 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87c99299-d23b-4cab-b2dc-abeed89155ff?source=api-prod","affected":[{"type":"plugin","slug":"easyappointments","name":"Easy!Appointments","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2019-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87ca07ac-6080-45d7-a8f5-74a918adec43","source":"wordfence","cve":"CVE-2024-2343","title":"Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87ca07ac-6080-45d7-a8f5-74a918adec43?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.6","to_inclusive":true,"patched_in":"7.11.7"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:54:39Z"},{"id":"wordfence:87ca4c05-b9fc-4932-be4b-beb57ca3bb7e","source":"wordfence","cve":"","title":"WordPress Content Slide <= 1.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87ca4c05-b9fc-4932-be4b-beb57ca3bb7e?source=api-prod","affected":[{"type":"plugin","slug":"content-slide","name":"WordPress Content Slide","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2015-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87cc821c-21d5-49b7-9b72-030ca016efd8","source":"wordfence","cve":"CVE-2025-12711","title":"Share to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87cc821c-21d5-49b7-9b72-030ca016efd8?source=api-prod","affected":[{"type":"plugin","slug":"share-to-google-classroom","name":"Share to Google Classroom","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:06:52Z","updated":"2025-11-11T03:30:43Z"},{"id":"wordfence:87d064fc-923a-41f1-a14f-09ff91b2aaee","source":"wordfence","cve":"CVE-2020-24145","title":"CM Download Manager <= 2.7.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d064fc-923a-41f1-a14f-09ff91b2aaee?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87d153df-93b0-40a3-b119-9fad41fbd0ee","source":"wordfence","cve":"CVE-2021-36880","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d153df-93b0-40a3-b119-9fad41fbd0ee?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87d228bb-eb5b-44ca-91f7-ada730635a3f","source":"wordfence","cve":"CVE-2026-1295","title":"Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d228bb-eb5b-44ca-91f7-ada730635a3f?source=api-prod","affected":[{"type":"plugin","slug":"buy-now-plus","name":"Buy Now Plus \u2014 Payments with Stripe","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T06:43:43Z"},{"id":"wordfence:87d4c2f5-d285-4063-af97-d060ae8496d8","source":"wordfence","cve":"CVE-2024-47329","title":"ElementsReady Addons for Elementor <= 6.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d4c2f5-d285-4063-af97-d060ae8496d8?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:08:35Z"},{"id":"wordfence:87d4dd4a-b1e2-4d08-aef1-77e58aa7531d","source":"wordfence","cve":"CVE-2026-13369","title":"Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d4dd4a-b1e2-4d08-aef1-77e58aa7531d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.29","to_inclusive":true,"patched_in":"3.3.30"}],"published":"2026-07-01T20:41:55Z","updated":"2026-07-02T09:32:03Z"},{"id":"wordfence:87d6322c-3031-47c7-a1ad-2ce805e58755","source":"wordfence","cve":"CVE-2026-73996","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d6322c-3031-47c7-a1ad-2ce805e58755?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:32:28Z"},{"id":"wordfence:87d684ba-4856-429f-9e4e-baa61c3967e1","source":"wordfence","cve":"CVE-2026-32535","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87d684ba-4856-429f-9e4e-baa61c3967e1?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:27:05Z"},{"id":"wordfence:87da5300-1add-44fc-a3e0-e8912f946c84","source":"wordfence","cve":"CVE-2023-4772","title":"Newsletter <= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87da5300-1add-44fc-a3e0-e8912f946c84?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"7.8.9","to_inclusive":true,"patched_in":"7.9.0"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87e32ddb-6f3e-4896-965c-f30b016f9a72","source":"wordfence","cve":"CVE-2022-34868","title":"\u042eKassa \u0434\u043b\u044f WooCommerce <= 2.3.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e32ddb-6f3e-4896-965c-f30b016f9a72?source=api-prod","affected":[{"type":"plugin","slug":"yookassa","name":"\u042eKassa \u0434\u043b\u044f WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87e3d9bc-a14c-4134-91ed-9de5177942ca","source":"wordfence","cve":"CVE-2024-50424","title":"Templately <= 3.1.5 - Missing Authorization via AJAX actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e3d9bc-a14c-4134-91ed-9de5177942ca?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:57:28Z"},{"id":"wordfence:87e3dd5e-0d77-4d78-8171-0beaf9482699","source":"wordfence","cve":"CVE-2023-5311","title":"WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e3dd5e-0d77-4d78-8171-0beaf9482699?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra","name":"WP EXtra \u2013 One Click Optimize","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87e408c4-55da-4765-8ca6-e709b9045c8b","source":"wordfence","cve":"CVE-2016-10951","title":"FireStorm Shopping Cart eCommerce Plugin <= 2.07.02 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e408c4-55da-4765-8ca6-e709b9045c8b?source=api-prod","affected":[{"type":"plugin","slug":"fs-shopping-cart","name":"FireStorm Shopping Cart eCommerce Plugin","from":"*","from_inclusive":true,"to":"2.07.02","to_inclusive":true,"patched_in":""}],"published":"2016-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87e4cd87-56d5-44fe-a21d-03e2732c4b58","source":"wordfence","cve":"CVE-2026-54859","title":"Preservation <= 1.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e4cd87-56d5-44fe-a21d-03e2732c4b58?source=api-prod","affected":[{"type":"theme","slug":"preservation","name":"Preservation","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T13:05:42Z","updated":"2026-11-03T20:03:35Z"},{"id":"wordfence:87e74f4f-8426-4550-8c4d-eb776f023d09","source":"wordfence","cve":"CVE-2024-47627","title":"WP Travel Gutenberg Blocks <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e74f4f-8426-4550-8c4d-eb776f023d09?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-blocks","name":"WP Travel Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:27:40Z"},{"id":"wordfence:87e76cf7-cfaf-499d-8929-db7efd6ec284","source":"wordfence","cve":"CVE-2025-31086","title":"Product Table by WBW <= 2.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e76cf7-cfaf-499d-8929-db7efd6ec284?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-tables","name":"Product Table for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:48:32Z"},{"id":"wordfence:87e98702-6616-4e11-aeaf-733cd9d700fe","source":"wordfence","cve":"CVE-2026-61976","title":"JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e98702-6616-4e11-aeaf-733cd9d700fe?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.0.1"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-04T19:33:48Z"},{"id":"wordfence:87e9d29b-9e0d-409c-97a5-7c444dff7382","source":"wordfence","cve":"CVE-2011-0760","title":"WP Related Posts <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87e9d29b-9e0d-409c-97a5-7c444dff7382?source=api-prod","affected":[{"type":"plugin","slug":"wp-related-posts","name":"WP Related Posts","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2011-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87eaa518-44fb-48ae-b700-ac65141905b3","source":"wordfence","cve":"CVE-2013-3252","title":"WP-PostViews < 1.63 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87eaa518-44fb-48ae-b700-ac65141905b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-postviews","name":"WP-PostViews","from":"*","from_inclusive":true,"to":"1.63","to_inclusive":false,"patched_in":"1.63"}],"published":"2013-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87eafa6c-459e-49e3-b4c9-2be48c5dfc78","source":"wordfence","cve":"CVE-2026-16948","title":"Solace Extra <= 1.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87eafa6c-459e-49e3-b4c9-2be48c5dfc78?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:48:48Z"},{"id":"wordfence:87eb4569-bfde-4bd8-95ef-561ec04158c8","source":"wordfence","cve":"CVE-2025-23553","title":"Userbase Access Control <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87eb4569-bfde-4bd8-95ef-561ec04158c8?source=api-prod","affected":[{"type":"plugin","slug":"userbase-access-control","name":"Userbase Access Control","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:53:54Z"},{"id":"wordfence:87eb6644-fd70-42a1-b05d-b166cb89c45c","source":"wordfence","cve":"CVE-2023-0418","title":"Video Central for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87eb6644-fd70-42a1-b05d-b166cb89c45c?source=api-prod","affected":[{"type":"plugin","slug":"video-central","name":"Video Central for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87ec5542-b6e7-4b18-a3ec-c258e749d32e","source":"wordfence","cve":"CVE-2023-2499","title":"RegistrationMagic <= 5.2.1.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87ec5542-b6e7-4b18-a3ec-c258e749d32e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.1.0","to_inclusive":true,"patched_in":"5.2.1.1"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:87ee0da1-3a95-4e09-a070-4c8aa336ffe8","source":"wordfence","cve":"CVE-2024-13112","title":"WP MediaTagger <= 4.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87ee0da1-3a95-4e09-a070-4c8aa336ffe8?source=api-prod","affected":[{"type":"plugin","slug":"wp-mediatagger","name":"WP MediaTagger","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:52:04Z"},{"id":"wordfence:87efa10d-d359-4258-9db2-811d5ae75c60","source":"wordfence","cve":"CVE-2025-12402","title":"LinkedIn Resume <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87efa10d-d359-4258-9db2-811d5ae75c60?source=api-prod","affected":[{"type":"plugin","slug":"linkedin-resume","name":"LinkedIn Resume","from":"*","from_inclusive":true,"to":"2.00","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:38:09Z","updated":"2025-11-04T04:27:19Z"},{"id":"wordfence:87f52e3a-e414-4f47-b46c-e3811e76744b","source":"wordfence","cve":"CVE-2026-4066","title":"Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87f52e3a-e414-4f47-b46c-e3811e76744b?source=api-prod","affected":[{"type":"plugin","slug":"smart-custom-fields","name":"Smart Custom Fields","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2026-03-23T09:49:02Z","updated":"2026-03-23T22:25:39Z"},{"id":"wordfence:87f7b9c3-f3aa-4ace-ab67-c32fa92fcffe","source":"wordfence","cve":"CVE-2026-59556","title":"Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87f7b9c3-f3aa-4ace-ab67-c32fa92fcffe?source=api-prod","affected":[{"type":"plugin","slug":"aco-woo-dynamic-pricing","name":"Dynamic Pricing With Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:21:18Z"},{"id":"wordfence:87f82d5d-d89a-440d-8c23-ace5160a0739","source":"wordfence","cve":"CVE-2026-4109","title":"Eventin \u2013 Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87f82d5d-d89a-440d-8c23-ace5160a0739?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2026-04-13T18:46:40Z","updated":"2026-04-14T07:43:04Z"},{"id":"wordfence:87f9f052-2963-4548-9ff8-91dc2b4ecb43","source":"wordfence","cve":"CVE-2024-13651","title":"RapidLoad \u2013 Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87f9f052-2963-4548-9ff8-91dc2b4ecb43?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:13Z"},{"id":"wordfence:87fa5b87-1b32-4d00-8b43-fd51416d3099","source":"wordfence","cve":"CVE-2026-96813","title":"Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87fa5b87-1b32-4d00-8b43-fd51416d3099?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.47","to_inclusive":true,"patched_in":"1.15.48"}],"published":"2026-09-30T19:51:50Z","updated":"2026-10-01T08:28:45Z"},{"id":"wordfence:87fdadcd-b776-471a-9756-708e384de4f0","source":"wordfence","cve":"CVE-2024-12464","title":"Chatroll Live Chat <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/87fdadcd-b776-471a-9756-708e384de4f0?source=api-prod","affected":[{"type":"plugin","slug":"chatroll-live-chat","name":"Chatroll Live Chat","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-01-06T16:23:19Z","updated":"2025-01-10T13:57:38Z"},{"id":"wordfence:88001f3c-f5cc-4051-a713-788014e2241a","source":"wordfence","cve":"CVE-2024-7420","title":"Insert PHP Code Snippet <= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletion","severity":"medium","cvss":5.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88001f3c-f5cc-4051-a713-788014e2241a?source=api-prod","affected":[{"type":"plugin","slug":"insert-php-code-snippet","name":"Insert PHP Code Snippet","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-08-14T14:04:23Z","updated":"2024-08-16T17:36:36Z"},{"id":"wordfence:88002a25-6890-4f8b-8a11-239b59d56672","source":"wordfence","cve":"CVE-2026-8610","title":"TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88002a25-6890-4f8b-8a11-239b59d56672?source=api-prod","affected":[{"type":"plugin","slug":"ts-webfonts-for-conoha","name":"TypeSquare Webfonts for ConoHa","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:13:19Z","updated":"2026-05-20T01:25:50Z"},{"id":"wordfence:880036ab-509b-406e-a11e-d4b638d98450","source":"wordfence","cve":"CVE-2025-30813","title":"Listamester <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/880036ab-509b-406e-a11e-d4b638d98450?source=api-prod","affected":[{"type":"plugin","slug":"listamester","name":"Listamester","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:01:18Z"},{"id":"wordfence:880573d8-6dad-4a1b-a5db-33e1dc243062","source":"wordfence","cve":"CVE-2023-2450","title":"FiboSearch - AJAX Search for WooCommerce <= 1.23.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/880573d8-6dad-4a1b-a5db-33e1dc243062?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"1.23.0","from_inclusive":true,"to":"1.23.0","to_inclusive":true,"patched_in":"1.24.0"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88068243-9e2a-4893-a432-fd1973db7ca8","source":"wordfence","cve":"CVE-2022-38070","title":"Pop-up <= 1.1.5 - Privilege Escalation","severity":"medium","cvss":5.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88068243-9e2a-4893-a432-fd1973db7ca8?source=api-prod","affected":[{"type":"plugin","slug":"pop-up-pop-up","name":"Pop-up","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2022-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8806a1b7-03c9-40a8-a1ef-f122329e0443","source":"wordfence","cve":"","title":"FG Joomla to WordPress < 3.31.0 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8806a1b7-03c9-40a8-a1ef-f122329e0443?source=api-prod","affected":[{"type":"plugin","slug":"fg-joomla-to-wordpress","name":"FG Joomla to WordPress","from":"*","from_inclusive":true,"to":"3.31.0","to_inclusive":false,"patched_in":"3.31.0"}],"published":"2017-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:880712ee-373f-49e7-93e3-968f3a0f3f83","source":"wordfence","cve":"CVE-2025-14392","title":"Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/880712ee-373f-49e7-93e3-968f3a0f3f83?source=api-prod","affected":[{"type":"plugin","slug":"simple-theme-changer","name":"Simple Theme Changer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:07:09Z","updated":"2025-12-12T03:20:50Z"},{"id":"wordfence:88075c15-079f-4de2-8e15-374eb7b8c77b","source":"wordfence","cve":"CVE-2023-6487","title":"LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88075c15-079f-4de2-8e15-374eb7b8c77b?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-table-of-contents","name":"LuckyWP Table of Contents","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-05-21T00:00:00Z","updated":"2024-10-03T19:23:16Z"},{"id":"wordfence:88089d8e-9040-482d-b0e5-d2412885f390","source":"wordfence","cve":"CVE-2026-11887","title":"Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88089d8e-9040-482d-b0e5-d2412885f390?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.19","to_inclusive":true,"patched_in":"10.30.20"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T13:46:35Z"},{"id":"wordfence:8808e4bd-76ea-4e31-8a2c-92c5b7dd3c68","source":"wordfence","cve":"CVE-2023-36682","title":"Schema Pro <= 2.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8808e4bd-76ea-4e31-8a2c-92c5b7dd3c68?source=api-prod","affected":[{"type":"plugin","slug":"wp-schema-pro","name":"Schema Pro","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2023-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88097744-d2f5-4ae5-aa71-0f4a0decd911","source":"wordfence","cve":"CVE-2026-0811","title":"Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88097744-d2f5-4ae5-aa71-0f4a0decd911?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-04-08T05:13:07Z","updated":"2026-04-08T17:25:52Z"},{"id":"wordfence:880e5752-cc69-4c38-bd00-a3b8517e5fa6","source":"wordfence","cve":"CVE-2024-32081","title":"Filter Custom Fields & Taxonomies Light <= 1.05 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/880e5752-cc69-4c38-bd00-a3b8517e5fa6?source=api-prod","affected":[{"type":"plugin","slug":"filter-custom-fields-taxonomies-light","name":"Filter Custom Fields & Taxonomies Light","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T17:37:50Z"},{"id":"wordfence:880f1f3f-857c-46da-a65c-082348260f89","source":"wordfence","cve":"CVE-2024-2026","title":"Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/880f1f3f-857c-46da-a65c-082348260f89?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.6.4","to_inclusive":true,"patched_in":"4.2.6.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-15T21:10:57Z"},{"id":"wordfence:8810200b-e026-4258-86aa-5c1a200fcf9b","source":"wordfence","cve":"CVE-2026-17123","title":"Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting","severity":"high","cvss":8.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8810200b-e026-4258-86aa-5c1a200fcf9b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1064","to_inclusive":true,"patched_in":"1.7.1065"}],"published":"2026-08-15T16:21:37Z","updated":"2026-08-16T04:24:54Z"},{"id":"wordfence:88103a90-aa51-4510-8cb2-6915e0dfdf3f","source":"wordfence","cve":"CVE-2026-24529","title":"Quick Restaurant Reservations <= 1.6.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88103a90-aa51-4510-8cb2-6915e0dfdf3f?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-reservations","name":"Quick Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T16:24:27Z"},{"id":"wordfence:8810d237-06d5-45a0-8402-a2e7e15418d0","source":"wordfence","cve":"CVE-2024-29105","title":"WP Popups <= 2.1.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8810d237-06d5-45a0-8402-a2e7e15418d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.1.5.5","to_inclusive":true,"patched_in":"2.1.5.6"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T21:09:23Z"},{"id":"wordfence:8815abff-6bd5-4ce4-9adf-afd699f628c4","source":"wordfence","cve":"CVE-2021-24655","title":"WP User Manager <= 2.6.2 - Arbitrary User Password Reset","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8815abff-6bd5-4ce4-9adf-afd699f628c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2021-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88163d55-ab97-4697-a25b-d54615e2a843","source":"wordfence","cve":"","title":"Solid Security Basic <= 9.0.0 - Unauthenticated Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88163d55-ab97-4697-a25b-d54615e2a843?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.0.1"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:881b8b18-d048-4de4-a797-a5de60d7fd3e","source":"wordfence","cve":"CVE-2025-22587","title":"SEO Bulk Editor <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/881b8b18-d048-4de4-a797-a5de60d7fd3e?source=api-prod","affected":[{"type":"plugin","slug":"seo-bulk-editor","name":"SEO Bulk Editor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-20T19:07:49Z"},{"id":"wordfence:881e8096-e75f-49a7-87ed-c230e93ea378","source":"wordfence","cve":"CVE-2024-3869","title":"Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/881e8096-e75f-49a7-87ed-c230e93ea378?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.46.0","to_inclusive":true,"patched_in":"5.47.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-16T12:51:46Z"},{"id":"wordfence:881ec131-a716-4929-a44e-84bac161d81c","source":"wordfence","cve":"CVE-2026-12126","title":"WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/881ec131-a716-4929-a44e-84bac161d81c?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2026-07-10T16:41:41Z","updated":"2026-07-11T05:35:49Z"},{"id":"wordfence:882070df-8a76-490b-a77c-03cdf84c481f","source":"wordfence","cve":"CVE-2025-10135","title":"WP ViewSTL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/882070df-8a76-490b-a77c-03cdf84c481f?source=api-prod","affected":[{"type":"plugin","slug":"wp-viewstl","name":"WP ViewSTL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:37:55Z","updated":"2025-10-15T08:25:57Z"},{"id":"wordfence:88223f4a-f879-41fe-85bf-a14501462aca","source":"wordfence","cve":"CVE-2026-81276","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88223f4a-f879-41fe-85bf-a14501462aca?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.23","to_inclusive":true,"patched_in":"2.4.24"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:01:38Z"},{"id":"wordfence:88241855-075b-4608-aa04-ceb96d062033","source":"wordfence","cve":"CVE-2024-50544","title":"RSVP ME <= 1.9.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88241855-075b-4608-aa04-ceb96d062033?source=api-prod","affected":[{"type":"plugin","slug":"rsvp-me","name":"RSVP ME","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:40:12Z"},{"id":"wordfence:882631ab-ef16-4158-adbc-60ad177ae6b8","source":"wordfence","cve":"CVE-2024-1412","title":"Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/882631ab-ef16-4158-adbc-60ad177ae6b8?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.26","to_inclusive":true,"patched_in":"1.11.27"}],"published":"2024-03-21T00:00:00Z","updated":"2026-05-20T20:19:49Z"},{"id":"wordfence:882639e3-615f-48df-9ddc-afbe0788d55f","source":"wordfence","cve":"CVE-2024-8054","title":"MM-Breaking News <= 0.7.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/882639e3-615f-48df-9ddc-afbe0788d55f?source=api-prod","affected":[{"type":"plugin","slug":"mm-breaking-news","name":"MM-Breaking News","from":"*","from_inclusive":true,"to":"0.7.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T23:38:19Z"},{"id":"wordfence:8827f882-3c3b-4362-ac90-a1b61364f5c7","source":"wordfence","cve":"CVE-2024-56230","title":"Dynamic Product Category Grid, Slider for WooCommerce <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8827f882-3c3b-4362-ac90-a1b61364f5c7?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-product-categories-design","name":"Dynamic Product Category Grid, Slider for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:09:06Z"},{"id":"wordfence:88290419-2086-4b43-b2b9-5d8128b208e2","source":"wordfence","cve":"","title":"Allure Real Estate Theme <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88290419-2086-4b43-b2b9-5d8128b208e2?source=api-prod","affected":[{"type":"theme","slug":"allure-real-estate-theme-for-real-estate","name":"Allure Real Estate Theme","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88291698-32e4-4b48-a9d5-9ad337ea6095","source":"wordfence","cve":"CVE-2025-31919","title":"Spare <= 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88291698-32e4-4b48-a9d5-9ad337ea6095?source=api-prod","affected":[{"type":"theme","slug":"spare","name":"Spare - Ultimate MultiPurpose LESS Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-18T14:58:44Z"},{"id":"wordfence:882caa58-b56f-455f-ab3e-1fd8fd4e10e2","source":"wordfence","cve":"CVE-2023-23881","title":"Circles Gallery <= 1.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/882caa58-b56f-455f-ab3e-1fd8fd4e10e2?source=api-prod","affected":[{"type":"plugin","slug":"circles-gallery","name":"Circles Gallery","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:882f6ef6-3fae-42a8-80e9-f53455323287","source":"wordfence","cve":"CVE-2026-19714","title":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints. < 3.6.8 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/882f6ef6-3fae-42a8-80e9-f53455323287?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":false,"patched_in":"3.6.8"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:05:05Z"},{"id":"wordfence:883484dd-d48d-46f9-ae96-223626c50039","source":"wordfence","cve":"CVE-2026-4074","title":"Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/883484dd-d48d-46f9-ae96-223626c50039?source=api-prod","affected":[{"type":"plugin","slug":"quran-live","name":"Quran Live Multilanguage","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:06:14Z","updated":"2026-04-22T07:45:39Z"},{"id":"wordfence:8834d017-04e8-4748-9acc-3f2213fc8592","source":"wordfence","cve":"CVE-2025-69139","title":"CarZone - A Complete Car Dealer HTML Wire-Frame <= 3.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8834d017-04e8-4748-9acc-3f2213fc8592?source=api-prod","affected":[{"type":"theme","slug":"carzone","name":"CarZone - A Complete Car Dealer HTML Wire-Frame","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:16:08Z"},{"id":"wordfence:8837e74c-677b-494d-9d7a-4bb166921bbf","source":"wordfence","cve":"","title":"Reality <= 2.3.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8837e74c-677b-494d-9d7a-4bb166921bbf?source=api-prod","affected":[{"type":"theme","slug":"reality","name":"Reality | Estate Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88391d02-66d9-4c00-a519-17f92f64a17a","source":"wordfence","cve":"CVE-2024-11830","title":"Dear Flipbook \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88391d02-66d9-4c00-a519-17f92f64a17a?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.3.52","to_inclusive":true,"patched_in":"2.3.53"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T11:09:27Z"},{"id":"wordfence:883ad6f7-e701-4708-b5d4-69b72ff38499","source":"wordfence","cve":"CVE-2026-4805","title":"Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/883ad6f7-e701-4708-b5d4-69b72ff38499?source=api-prod","affected":[{"type":"theme","slug":"woostify","name":"Woostify","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-04-27T18:15:01Z","updated":"2026-04-28T06:45:46Z"},{"id":"wordfence:883e1f3c-7e47-4522-ae8c-a9a6b4160be2","source":"wordfence","cve":"CVE-2024-24844","title":"PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/883e1f3c-7e47-4522-ae8c-a9a6b4160be2?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.8"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T17:40:09Z"},{"id":"wordfence:883fae5a-ac23-488a-9b26-fb914727f06a","source":"wordfence","cve":"CVE-2026-27054","title":"Penci Soledad Data Migrator <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/883fae5a-ac23-488a-9b26-fb914727f06a?source=api-prod","affected":[{"type":"plugin","slug":"penci-data-migrator","name":"Penci Soledad Data Migrator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:33:52Z"},{"id":"wordfence:88409bb0-5cb0-4f63-b8f0-d72f54fa17b0","source":"wordfence","cve":"CVE-2026-8840","title":"Booking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88409bb0-5cb0-4f63-b8f0-d72f54fa17b0?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:05:28Z","updated":"2026-08-15T02:26:17Z"},{"id":"wordfence:8840bb3c-3e4b-48d5-bf01-2ed9bcfcf27a","source":"wordfence","cve":"CVE-2014-6446","title":"Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8840bb3c-3e4b-48d5-bf01-2ed9bcfcf27a?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft","name":"Infusionsoft Gravity Forms Add-on","from":"1.5.3","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2014-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88426c25-d6a6-4720-84e9-90e28a552cea","source":"wordfence","cve":"CVE-2025-49043","title":"Magic Responsive Slider and Carousel WordPress <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88426c25-d6a6-4720-84e9-90e28a552cea?source=api-prod","affected":[{"type":"plugin","slug":"magic_carousel","name":"Magic Responsive Slider and Carousel WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:50:01Z"},{"id":"wordfence:88442edf-bec6-49df-89a9-7d6852dd87db","source":"wordfence","cve":"CVE-2026-27337","title":"Chronicle <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88442edf-bec6-49df-89a9-7d6852dd87db?source=api-prod","affected":[{"type":"theme","slug":"chronicle","name":"Chronicle","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:40:16Z"},{"id":"wordfence:8844c230-162d-46c4-9b34-fc9d18b93f4f","source":"wordfence","cve":"CVE-2022-28612","title":"Popup | Custom Popup Builder <= 1.3.1 - Missing Capabilities Check","severity":"medium","cvss":6.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8844c230-162d-46c4-9b34-fc9d18b93f4f?source=api-prod","affected":[{"type":"plugin","slug":"m-wp-popup","name":"Popup | Custom Popup Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-14T14:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8846a0c8-f60a-463e-9c8a-4e43679b4e6e","source":"wordfence","cve":"CVE-2026-103299","title":"nexi Alpha Bank for WooCommerce < 2.2.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8846a0c8-f60a-463e-9c8a-4e43679b4e6e?source=api-prod","affected":[{"type":"plugin","slug":"woo-alpha-bank-payment-gateway","name":"Payment Gateway \u2013 nexi Alpha Bank for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-11-10T23:22:47Z"},{"id":"wordfence:8848a247-52a6-48de-9ad5-deef89c2c599","source":"wordfence","cve":"CVE-2021-24628","title":"Wow Forms \u2013 create any form with custom style <= 3.1.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8848a247-52a6-48de-9ad5-deef89c2c599?source=api-prod","affected":[{"type":"plugin","slug":"mwp-forms","name":"Wow Forms \u2013 create any form with custom style","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:884973e2-3836-448f-8c0d-1235fb2c09b6","source":"wordfence","cve":"CVE-2015-2315","title":"WPML < 3.1.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/884973e2-3836-448f-8c0d-1235fb2c09b6?source=api-prod","affected":[{"type":"plugin","slug":"wpml","name":"wpml","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":false,"patched_in":"3.1.9"}],"published":"2015-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:884b97b7-d023-4752-81b1-086ab022f85e","source":"wordfence","cve":"CVE-2026-2497","title":"Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/884b97b7-d023-4752-81b1-086ab022f85e?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2026-08-15T17:47:32Z","updated":"2026-08-16T06:38:08Z"},{"id":"wordfence:884c4508-1ee1-4384-9fc2-29e2c9042426","source":"wordfence","cve":"CVE-2025-14802","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/884c4508-1ee1-4384-9fc2-29e2c9042426?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2.1","to_inclusive":true,"patched_in":"4.3.2.2"}],"published":"2026-01-06T18:42:00Z","updated":"2026-01-07T07:17:37Z"},{"id":"wordfence:884dd491-c5b9-4278-9532-4896b6076f0a","source":"wordfence","cve":"CVE-2024-50526","title":"Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/884dd491-c5b9-4278-9532-4896b6076f0a?source=api-prod","affected":[{"type":"plugin","slug":"multi-purpose-mail-form","name":"Multi Purpose Mail Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T13:24:59Z"},{"id":"wordfence:88508dbd-b7a0-441d-918b-f4cb7a7cd000","source":"wordfence","cve":"CVE-2024-11271","title":"WordPress Webinar Plugin \u2013 WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88508dbd-b7a0-441d-918b-f4cb7a7cd000?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.24","to_inclusive":true,"patched_in":"1.33.25"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T04:17:59Z"},{"id":"wordfence:88520d8e-8e13-4b58-9df3-3b99afd39144","source":"wordfence","cve":"CVE-2025-5923","title":"Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88520d8e-8e13-4b58-9df3-3b99afd39144?source=api-prod","affected":[{"type":"plugin","slug":"game-review-block","name":"Game Review Block","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-13T06:41:24Z"},{"id":"wordfence:8852cd88-fe13-4613-be6c-514b90b896a3","source":"wordfence","cve":"CVE-2025-26737","title":"City Store <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8852cd88-fe13-4613-be6c-514b90b896a3?source=api-prod","affected":[{"type":"theme","slug":"city-store","name":"City Store","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:58:16Z"},{"id":"wordfence:8856f3db-a5e5-4f7a-8527-8e0a9616feb1","source":"wordfence","cve":"CVE-2025-30864","title":"Exchange Rates <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8856f3db-a5e5-4f7a-8527-8e0a9616feb1?source=api-prod","affected":[{"type":"plugin","slug":"exchange-rates","name":"Exchange Rates","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:14:26Z"},{"id":"wordfence:88591c56-ff79-47bf-b5e0-e3471884d3b4","source":"wordfence","cve":"CVE-2025-23463","title":"MD Custom content after or before of post <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88591c56-ff79-47bf-b5e0-e3471884d3b4?source=api-prod","affected":[{"type":"plugin","slug":"md-custom-content","name":"MD Custom content after or before of post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:24:00Z"},{"id":"wordfence:885dd550-4c80-4e36-8dae-cb47c1500ea5","source":"wordfence","cve":"CVE-2026-4290","title":"WP Travel Pro <= 11.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-pro","name":"WP Travel Pro","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":true,"patched_in":"11.2.0"}],"published":"2026-05-28T14:22:39Z","updated":"2026-11-13T16:45:21Z"},{"id":"wordfence:885eb923-8e69-416b-8494-a42a9465cfe0","source":"wordfence","cve":"CVE-2025-9762","title":"Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments","severity":"critical","cvss":9.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/885eb923-8e69-416b-8494-a42a9465cfe0?source=api-prod","affected":[{"type":"plugin","slug":"post-by-email","name":"Post By Email","from":"*","from_inclusive":true,"to":"1.0.4b","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:30:11Z","updated":"2025-09-30T03:35:28Z"},{"id":"wordfence:885ecd04-53f0-4f61-a38f-1bb467960ad7","source":"wordfence","cve":"CVE-2025-62890","title":"Premmerce Brands for WooCommerce <= 1.2.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/885ecd04-53f0-4f61-a38f-1bb467960ad7?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-brands","name":"Premmerce Brands for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2025-08-22T00:00:00Z","updated":"2026-02-26T15:16:44Z"},{"id":"wordfence:885ee376-26cb-4330-9494-019b8870a982","source":"wordfence","cve":"CVE-2025-31632","title":"La Boom <= 2.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/885ee376-26cb-4330-9494-019b8870a982?source=api-prod","affected":[{"type":"theme","slug":"laboom","name":"La Boom - Food & Restaurant Bistro WordPress Theme","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T16:46:31Z"},{"id":"wordfence:88622945-9a55-4e44-86e3-f111b9490aa8","source":"wordfence","cve":"CVE-2021-34666","title":"Sidebar Adder 2 <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88622945-9a55-4e44-86e3-f111b9490aa8?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-adder","name":"Sidebar Adder 2","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8863bbc2-1d3a-4cc7-9b30-299799be4f72","source":"wordfence","cve":"CVE-2026-16949","title":"Term Pages <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8863bbc2-1d3a-4cc7-9b30-299799be4f72?source=api-prod","affected":[{"type":"plugin","slug":"term-pages","name":"Term Pages","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:34:08Z"},{"id":"wordfence:88666497-d10f-47ee-bfe8-578f3fb1c668","source":"wordfence","cve":"CVE-2026-96524","title":"MCP Server for WordPress <= 1.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88666497-d10f-47ee-bfe8-578f3fb1c668?source=api-prod","affected":[{"type":"plugin","slug":"ai-workflow-automation-ai-agent-hub","name":"MCP Server for WordPress \u2013 Connect Claude, ChatGPT & Gemini | AtlasMCP","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:55:08Z"},{"id":"wordfence:88686ab2-178b-4a18-aec3-5f751a583b8c","source":"wordfence","cve":"CVE-2026-62028","title":"Before After Image Comparison \u2013 Visual Comparison for Two Images <= 1.1.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88686ab2-178b-4a18-aec3-5f751a583b8c?source=api-prod","affected":[{"type":"plugin","slug":"before-after-image-compare","name":"Before After Image Comparison \u2013 Visual Comparison for Two Images","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-28T21:19:43Z"},{"id":"wordfence:8869a4fc-279f-4828-a271-8680d037fa85","source":"wordfence","cve":"CVE-2022-0683","title":"Essential Addons for Elementor Lite <= 5.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8869a4fc-279f-4828-a271-8680d037fa85?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2022-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:886b612a-d0d1-4880-b423-eb62410a28cd","source":"wordfence","cve":"CVE-2025-9322","title":"Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/886b612a-d0d1-4880-b423-eb62410a28cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":true,"patched_in":"8.3.2"}],"published":"2025-10-24T18:16:58Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:886c4ce5-275c-49aa-86eb-b11c3c22ad79","source":"wordfence","cve":"CVE-2025-28871","title":"Block Spam By Math Reloaded <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/886c4ce5-275c-49aa-86eb-b11c3c22ad79?source=api-prod","affected":[{"type":"plugin","slug":"block-spam-by-math-reloaded","name":"Block Spam By Math Reloaded","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:26:34Z"},{"id":"wordfence:8872eca8-4812-4f5f-b775-cbfab90ba2ca","source":"wordfence","cve":"CVE-2023-34003","title":"WooCommerce Box Office <= 1.1.51 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8872eca8-4812-4f5f-b775-cbfab90ba2ca?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-box-office","name":"WooCommerce Box Office","from":"*","from_inclusive":true,"to":"1.1.51","to_inclusive":true,"patched_in":"1.1.52"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8875d2d5-1de0-4a8c-8acb-69c8095effe5","source":"wordfence","cve":"CVE-2025-62967","title":"DirectoryPress <= 3.6.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8875d2d5-1de0-4a8c-8acb-69c8095effe5?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2025-10-18T00:00:00Z","updated":"2026-01-27T21:38:33Z"},{"id":"wordfence:8876ecc4-1a50-43ac-9c8d-354f6de4abdd","source":"wordfence","cve":"CVE-2023-27614","title":"Motor Racing League <= 1.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8876ecc4-1a50-43ac-9c8d-354f6de4abdd?source=api-prod","affected":[{"type":"plugin","slug":"motor-racing-league","name":"Motor Racing League","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:887a1697-608e-4bf8-8c15-188737cb22c6","source":"wordfence","cve":"CVE-2023-32624","title":"TS Webfonts for SAKURA  <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/887a1697-608e-4bf8-8c15-188737cb22c6?source=api-prod","affected":[{"type":"plugin","slug":"ts-webfonts-for-sakura","name":"TS Webfonts for \u3055\u304f\u3089\u306e\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:887ca432-5412-401c-8d4e-52dcb511e5ba","source":"wordfence","cve":"CVE-2022-2173","title":"Advanced Database Cleaner <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/887ca432-5412-401c-8d4e-52dcb511e5ba?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:887ccf72-9ae1-4b7e-9f62-253dea459652","source":"wordfence","cve":"CVE-2017-18490","title":"Contact Form Multi by BestWebSoft \u2013 Multiple Forms Plugin for Single WordPress Website < 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/887ccf72-9ae1-4b7e-9f62-253dea459652?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-multi","name":"Contact Form Multi by BestWebSoft \u2013 Multiple Forms Plugin for Single WordPress Website","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:887ecedb-0bc8-4488-b6fa-27cfa22345e6","source":"wordfence","cve":"CVE-2025-31609","title":"WPCargo Track & Trace <= 8.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/887ecedb-0bc8-4488-b6fa-27cfa22345e6?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-05-21T13:32:26Z"},{"id":"wordfence:88809668-ea6b-41df-b2a7-ffe03a931c86","source":"wordfence","cve":"CVE-2023-5338","title":"Theme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88809668-ea6b-41df-b2a7-ffe03a931c86?source=api-prod","affected":[{"type":"plugin","slug":"theme-blvd-shortcodes","name":"Theme Blvd Shortcodes","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8881c74f-9941-4919-8a15-99407fca0946","source":"wordfence","cve":"CVE-2017-18540","title":"WebLibrarian < 3.4.8.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8881c74f-9941-4919-8a15-99407fca0946?source=api-prod","affected":[{"type":"plugin","slug":"weblibrarian","name":"WebLibrarian","from":"*","from_inclusive":true,"to":"3.4.8.7","to_inclusive":false,"patched_in":"3.4.8.7"}],"published":"2017-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88829cca-4389-4b1a-a376-7abfbc37508e","source":"wordfence","cve":"CVE-2023-23708","title":"Visualizer <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88829cca-4389-4b1a-a376-7abfbc37508e?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8883d4fe-3ca6-4591-9972-219b114126d3","source":"wordfence","cve":"CVE-2024-12210","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8883d4fe-3ca6-4591-9972-219b114126d3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:44Z"},{"id":"wordfence:88840d66-1644-4af0-b811-41f0e9fe2c0c","source":"wordfence","cve":"CVE-2023-29173","title":"Product Category Tree <= 2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88840d66-1644-4af0-b811-41f0e9fe2c0c?source=api-prod","affected":[{"type":"plugin","slug":"product-category-tree","name":"Product Category Tree","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88855d83-d182-4b10-b44f-cd0edec07db1","source":"wordfence","cve":"CVE-2024-29815","title":"WP Change Email Sender <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88855d83-d182-4b10-b44f-cd0edec07db1?source=api-prod","affected":[{"type":"plugin","slug":"wp-change-email-sender","name":"WP Change Email Sender","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:21:26Z"},{"id":"wordfence:8885fc41-1b3b-4170-9752-aea7628daf4f","source":"wordfence","cve":"CVE-2025-22550","title":"AddFunc Mobile Detect <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8885fc41-1b3b-4170-9752-aea7628daf4f?source=api-prod","affected":[{"type":"plugin","slug":"addfunc-mobile-detect","name":"AddFunc Mobile Detect","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:28:52Z"},{"id":"wordfence:88864e88-30c8-440c-9263-4995f239cdec","source":"wordfence","cve":"CVE-2025-60196","title":"Clearblue\u00ae Ovulation Calculator <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88864e88-30c8-440c-9263-4995f239cdec?source=api-prod","affected":[{"type":"plugin","slug":"clearblue-ovulation-calculator","name":"Clearblue\u00ae Ovulation Calculator","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-24T00:00:00Z","updated":"2025-11-11T17:13:47Z"},{"id":"wordfence:8886e9f8-81d6-458a-b029-f62d4baaf189","source":"wordfence","cve":"CVE-2026-39553","title":"WaveRide <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8886e9f8-81d6-458a-b029-f62d4baaf189?source=api-prod","affected":[{"type":"theme","slug":"waveride","name":"WaveRide - Surfing and Water Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:07:21Z"},{"id":"wordfence:888877c9-45e1-405a-ac0c-bbe512188141","source":"wordfence","cve":"","title":"Youtube Freedown <= 1.0 - Remote Media File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/888877c9-45e1-405a-ac0c-bbe512188141?source=api-prod","affected":[{"type":"plugin","slug":"youtubefreedown","name":"Youtube Freedown","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88898997-6199-4b33-bd35-70a1a01812ec","source":"wordfence","cve":"CVE-2023-2627","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.2.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88898997-6199-4b33-bd35-70a1a01812ec?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:888aa96e-7da6-4778-83f6-294f77f51ee4","source":"wordfence","cve":"CVE-2026-105316","title":"Magee Shortcodes <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/888aa96e-7da6-4778-83f6-294f77f51ee4?source=api-prod","affected":[{"type":"plugin","slug":"magee-shortcodes","name":"Magee Shortcodes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:16:10Z"},{"id":"wordfence:888dfcc5-a903-4b2d-846b-c93f0b33b0c7","source":"wordfence","cve":"CVE-2026-76931","title":"Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/888dfcc5-a903-4b2d-846b-c93f0b33b0c7?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.205","to_inclusive":true,"patched_in":"3.3.206"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:29:59Z"},{"id":"wordfence:88907f28-7b1d-4a5a-b846-67dfd21d6488","source":"wordfence","cve":"CVE-2023-52200","title":"ARMember <= 4.0.22 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88907f28-7b1d-4a5a-b846-67dfd21d6488?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.22","to_inclusive":true,"patched_in":"4.0.23"}],"published":"2024-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8894272c-2aad-4230-b5b9-8c8ff5a0d064","source":"wordfence","cve":"CVE-2026-62097","title":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8894272c-2aad-4230-b5b9-8c8ff5a0d064?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.27","to_inclusive":true,"patched_in":"6.4.28"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:26:17Z"},{"id":"wordfence:889593b5-0fc4-4513-9db1-9a7dbabb5408","source":"wordfence","cve":"CVE-2026-57341","title":"Colissimo shipping methods for WooCommerce <= 2.9.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/889593b5-0fc4-4513-9db1-9a7dbabb5408?source=api-prod","affected":[{"type":"plugin","slug":"colissimo-shipping-methods-for-woocommerce","name":"Colissimo shipping methods for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:21:06Z"},{"id":"wordfence:8896fa5a-1642-4fcd-8fff-1e5828c28523","source":"wordfence","cve":"CVE-2023-38477","title":"QR code MeCard/vCard generator <= 1.6.0 - Missing Authorization via wqm_make_url_permanent","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8896fa5a-1642-4fcd-8fff-1e5828c28523?source=api-prod","affected":[{"type":"plugin","slug":"wp-qrcode-me-v-card","name":"QR code MeCard/vCard generator","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8898bae3-067c-4505-9a96-05b7a08d90c6","source":"wordfence","cve":"","title":"Admin Menu Editor Pro 2.35 - 2.36 - Backdoored Software","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-editor-pro","name":"Admin Menu Editor Pro","from":"2.35","from_inclusive":true,"to":"2.36","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-16T14:07:37Z"},{"id":"wordfence:889986f8-224e-4af4-a1d2-ef4b04a7e83f","source":"wordfence","cve":"CVE-2023-29170","title":"Product Enquiry for WooCommerce <= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/889986f8-224e-4af4-a1d2-ef4b04a7e83f?source=api-prod","affected":[{"type":"plugin","slug":"enquiry-quotation-for-woocommerce","name":"PiWeb Product Enquiry or product catalog for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:889cb1d5-7f5c-4904-9b5f-cc8a505eb65c","source":"wordfence","cve":"CVE-2023-2488","title":"Stop Spammers Security <= 2022.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/889cb1d5-7f5c-4904-9b5f-cc8a505eb65c?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2022.6","to_inclusive":true,"patched_in":"2023"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:889ec0f7-22e3-48b9-9571-d0c399b9d5c2","source":"wordfence","cve":"CVE-2025-48331","title":"WooCommerce Orders & Customers Exporter <= 5.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/889ec0f7-22e3-48b9-9571-d0c399b9d5c2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-orders-customers-exporter","name":"WooCommerce Orders & Customers Exporter","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:59:06Z"},{"id":"wordfence:88a3b4ad-7b8c-40ae-b81f-ccb979b49a47","source":"wordfence","cve":"CVE-2018-20153","title":"WordPress Core < 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88a3b4ad-7b8c-40ae-b81f-ccb979b49a47?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88a46a24-6d46-44cc-ac01-70a1c329cb51","source":"wordfence","cve":"CVE-2024-1934","title":"WP Compress \u2013 Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88a46a24-6d46-44cc-ac01-70a1c329cb51?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.11.10","to_inclusive":true,"patched_in":"6.11.11"}],"published":"2024-03-21T00:00:00Z","updated":"2024-07-31T15:41:07Z"},{"id":"wordfence:88a649de-ea56-4bd9-b82f-9b3a35a6e4b0","source":"wordfence","cve":"CVE-2025-26968","title":"Cloak Front End Email <= 1.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88a649de-ea56-4bd9-b82f-9b3a35a6e4b0?source=api-prod","affected":[{"type":"plugin","slug":"cloak-front-end-email","name":"Cloak Front End Email","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:04:47Z"},{"id":"wordfence:88a9abf4-62a9-4695-87e7-18ff0b0075e9","source":"wordfence","cve":"CVE-2025-9637","title":"Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2026-01-05T20:24:52Z","updated":"2026-01-06T09:21:00Z"},{"id":"wordfence:88aac10a-c927-45be-83b4-eae878c4b59a","source":"wordfence","cve":"CVE-2026-111396","title":"Advanced Post Manager <= 4.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88aac10a-c927-45be-83b4-eae878c4b59a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-manager","name":"Advanced Post Manager","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2026-10-16T12:54:00Z","updated":"2026-10-23T18:26:18Z"},{"id":"wordfence:88ade7a7-da31-4752-b100-40dae81735b0","source":"wordfence","cve":"CVE-2023-4799","title":"Magic Embeds <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88ade7a7-da31-4752-b100-40dae81735b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-embed-facebook","name":"Magic Embeds","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88aef7e0-ffa4-4090-a6e9-295023c71c6c","source":"wordfence","cve":"CVE-2024-51669","title":"Dynamic Widgets <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88aef7e0-ffa4-4090-a6e9-295023c71c6c?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:44:08Z"},{"id":"wordfence:88b0acee-f378-487d-8ab9-96146e0cde10","source":"wordfence","cve":"CVE-2024-10867","title":"Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b0acee-f378-487d-8ab9-96146e0cde10?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-01-30T15:36:38Z","updated":"2025-03-21T17:16:20Z"},{"id":"wordfence:88b0e98b-3416-40d1-9901-6ab0dfb7dea1","source":"wordfence","cve":"CVE-2024-37106","title":"WishList Member X < 3.26.7 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b0e98b-3416-40d1-9901-6ab0dfb7dea1?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T14:58:51Z"},{"id":"wordfence:88b2d8e6-d242-4943-a121-23898a8fde55","source":"wordfence","cve":"CVE-2024-35660","title":"Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization via get_jltma_save_menuitem_settings()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b2d8e6-d242-4943-a121-23898a8fde55?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.4.1","to_inclusive":true,"patched_in":"2.0.5.6"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:41:03Z"},{"id":"wordfence:88b38a0d-2742-48f7-8af4-f05c91a94820","source":"wordfence","cve":"CVE-2025-31437","title":"WP-OGP <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b38a0d-2742-48f7-8af4-f05c91a94820?source=api-prod","affected":[{"type":"plugin","slug":"wp-ogp","name":"WP-OGP","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:58:07Z"},{"id":"wordfence:88b3a69d-2c94-48e6-b965-8a67b2fe42b2","source":"wordfence","cve":"","title":"WooCommerce <= 2.3.10 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b3a69d-2c94-48e6-b965-8a67b2fe42b2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2015-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88b40b01-2e4c-4368-960a-ffc8f0978e59","source":"wordfence","cve":"CVE-2025-24632","title":"Advanced Dynamic Pricing for WooCommerce <= 4.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b40b01-2e4c-4368-960a-ffc8f0978e59?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2025-01-05T00:00:00Z","updated":"2025-02-19T16:58:03Z"},{"id":"wordfence:88b4791e-8c48-446e-b713-8958d60f668f","source":"wordfence","cve":"CVE-2026-66602","title":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b4791e-8c48-446e-b713-8958d60f668f?source=api-prod","affected":[{"type":"plugin","slug":"hashbar-wp-notification-bar","name":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:15:19Z"},{"id":"wordfence:88b5842d-7b8b-4ea7-b2c3-6ac6fac6d2a6","source":"wordfence","cve":"CVE-2026-6806","title":"Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b5842d-7b8b-4ea7-b2c3-6ac6fac6d2a6?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.109","to_inclusive":true,"patched_in":"1.4.110"}],"published":"2026-09-29T19:37:26Z","updated":"2026-09-30T07:41:06Z"},{"id":"wordfence:88b76986-73d4-415b-a62d-8012d0bccd66","source":"wordfence","cve":"CVE-2025-57932","title":"PowerFolio <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b76986-73d4-415b-a62d-8012d0bccd66?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-elementor","name":"PowerFolio \u2013 Portfolio & Image Gallery for Elementor","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-14T19:17:50Z"},{"id":"wordfence:88b8a93b-f34f-4188-8153-ce36b03b6a4c","source":"wordfence","cve":"CVE-2024-38692","title":"Spiffy Calendar <= 4.9.11 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b8a93b-f34f-4188-8153-ce36b03b6a4c?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"4.9.12"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T14:03:38Z"},{"id":"wordfence:88b9f09b-b5fe-400a-8943-70431e617438","source":"wordfence","cve":"CVE-2026-62012","title":"Coinpress <= 1.0.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88b9f09b-b5fe-400a-8943-70431e617438?source=api-prod","affected":[{"type":"theme","slug":"coinpress","name":"Coinpress","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:37:38Z"},{"id":"wordfence:88bba345-5330-4780-8c76-fd0f72fb4048","source":"wordfence","cve":"CVE-2025-31443","title":"KK I Like It <= 1.7.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88bba345-5330-4780-8c76-fd0f72fb4048?source=api-prod","affected":[{"type":"plugin","slug":"kk-i-like-it","name":"KK I Like It","from":"*","from_inclusive":true,"to":"1.7.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:04:12Z"},{"id":"wordfence:88bbdb6d-c824-4f31-9352-ebc0f8fd8247","source":"wordfence","cve":"CVE-2025-8623","title":"WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88bbdb6d-c824-4f31-9352-ebc0f8fd8247?source=api-prod","affected":[{"type":"plugin","slug":"weedmaps-menu-embed","name":"WeedMaps Menu for WordPress","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:24:02Z","updated":"2025-09-30T03:35:28Z"},{"id":"wordfence:88bfd754-e2ee-47c7-9af5-f31cbe993102","source":"wordfence","cve":"CVE-2026-109447","title":"User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-15T16:37:33Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:88c2033d-705e-4950-b6c8-7039e365dcc0","source":"wordfence","cve":"CVE-2025-22805","title":"Skill Bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c2033d-705e-4950-b6c8-7039e365dcc0?source=api-prod","affected":[{"type":"plugin","slug":"skillbars","name":"Skill Bars","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:04:26Z"},{"id":"wordfence:88c45af5-f698-42b3-b71f-39d7187b4783","source":"wordfence","cve":"CVE-2026-112860","title":"Participants Database <= 2.7.8.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c45af5-f698-42b3-b71f-39d7187b4783?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:12:36Z"},{"id":"wordfence:88c496df-a5c0-4ac9-8fc1-37fcddfa13d3","source":"wordfence","cve":"CVE-2024-52402","title":"Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c496df-a5c0-4ac9-8fc1-37fcddfa13d3?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-content-password-protect","name":"Exclusive Content Password Protect","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:16:30Z"},{"id":"wordfence:88c5752c-ef4e-4343-810e-ecf1f33d3538","source":"wordfence","cve":"CVE-2022-1601","title":"User Access Manager <= 2.2.16 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c5752c-ef4e-4343-810e-ecf1f33d3538?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.18"}],"published":"2023-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88c771a9-e908-451b-bbc4-c10634d9c36b","source":"wordfence","cve":"CVE-2025-48350","title":"AutoWP <= 2.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c771a9-e908-451b-bbc4-c10634d9c36b?source=api-prod","affected":[{"type":"plugin","slug":"autowp-ai-content-writer-rewriter","name":"AutoWP \u2013 AI Content Writer & Rewriter","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-25T20:06:12Z"},{"id":"wordfence:88c85270-d464-4f20-84e5-80f63e7c73e2","source":"wordfence","cve":"CVE-2024-31098","title":"New Order Notification for Woocommerce <= 2.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c85270-d464-4f20-84e5-80f63e7c73e2?source=api-prod","affected":[{"type":"plugin","slug":"new-order-notification-for-woocommerce","name":"New Order Notification for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-03-29T00:00:00Z","updated":"2025-06-25T13:32:30Z"},{"id":"wordfence:88c8b359-fad3-4bd9-8388-b1f7dea64ffc","source":"wordfence","cve":"CVE-2026-79631","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88c8b359-fad3-4bd9-8388-b1f7dea64ffc?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":false,"patched_in":"3.13.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:24:17Z"},{"id":"wordfence:88ca14d5-bbdd-4efa-a729-40a73f701aae","source":"wordfence","cve":"CVE-2024-3471","title":"Button Generator \u2013 easily Button Builder <= 2.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88ca14d5-bbdd-4efa-a729-40a73f701aae?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:38:44Z"},{"id":"wordfence:88cea535-1042-4011-aee9-684d7661e193","source":"wordfence","cve":"CVE-2022-44629","title":"Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88cea535-1042-4011-aee9-684d7661e193?source=api-prod","affected":[{"type":"plugin","slug":"catalyst-connect-client-portal","name":"Catalyst Connect Zoho CRM Client Portal","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88cf21c3-52d7-472f-8f55-8e1a5819f133","source":"wordfence","cve":"CVE-2023-51534","title":"Brave Popup Builder <= 0.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88cf21c3-52d7-472f-8f55-8e1a5819f133?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":"0.6.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88d0d6b7-f33f-4c7b-9006-d54578fbe003","source":"wordfence","cve":"CVE-2022-45846","title":"Image Map Pro < 5.6.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d0d6b7-f33f-4c7b-9006-d54578fbe003?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":false,"patched_in":"5.6.9"}],"published":"2022-11-23T00:00:00Z","updated":"2026-02-26T14:50:30Z"},{"id":"wordfence:88d16ce2-a1cf-4402-b140-3cab17f8c638","source":"wordfence","cve":"CVE-2024-1954","title":"Oliver POS \u2013 A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d16ce2-a1cf-4402-b140-3cab17f8c638?source=api-prod","affected":[{"type":"plugin","slug":"oliver-pos","name":"Oliver POS \u2013 WooCommerce POS for iPhone, iPad & Android","from":"*","from_inclusive":true,"to":"2.4.1.8","to_inclusive":true,"patched_in":"2.4.1.9"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:48Z"},{"id":"wordfence:88d19782-492f-4306-a8c0-5eaa470e457d","source":"wordfence","cve":"CVE-2024-29104","title":"Ticket Tailor <= 1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d19782-492f-4306-a8c0-5eaa470e457d?source=api-prod","affected":[{"type":"plugin","slug":"ticket-tailor","name":"Ticket Tailor \u2014 Event Ticketing & Registration","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.12"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:56:46Z"},{"id":"wordfence:88d27385-9b92-419c-9e03-687d7192bbb5","source":"wordfence","cve":"CVE-2024-12535","title":"Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d27385-9b92-419c-9e03-687d7192bbb5?source=api-prod","affected":[{"type":"plugin","slug":"host-php-info","name":"Host PHP Info","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:23:54Z","updated":"2025-01-07T05:23:55Z"},{"id":"wordfence:88d62d58-9d06-4a48-b76e-0265892107dc","source":"wordfence","cve":"CVE-2026-88043","title":"Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d62d58-9d06-4a48-b76e-0265892107dc?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-14T16:45:53Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:88d769cd-bea8-42e4-80a8-a77c0699b50c","source":"wordfence","cve":"CVE-2026-3239","title":"Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d769cd-bea8-42e4-80a8-a77c0699b50c?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2026-04-07T15:48:51Z","updated":"2026-04-08T04:27:19Z"},{"id":"wordfence:88d80702-a987-4b12-a003-2fa564fda409","source":"wordfence","cve":"CVE-2023-1809","title":"Download Manager Pro <= 6.2.9 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d80702-a987-4b12-a003-2fa564fda409?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager Pro","from":"4.0","from_inclusive":true,"to":"6.3.0","to_inclusive":false,"patched_in":"6.3.0"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88d93119-5eaa-4c9b-a8dc-f40a5d91c8da","source":"wordfence","cve":"CVE-2025-23787","title":"Easy Bet <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d93119-5eaa-4c9b-a8dc-f40a5d91c8da?source=api-prod","affected":[{"type":"plugin","slug":"easy-bet","name":"Easy Bet","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:36:05Z"},{"id":"wordfence:88d9f0b1-040d-4f95-95dd-021ceb0cdb39","source":"wordfence","cve":"CVE-2024-43982","title":"Login As Users <= 1.4.3 - Missing Authorization to Privielge Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88d9f0b1-040d-4f95-95dd-021ceb0cdb39?source=api-prod","affected":[{"type":"plugin","slug":"login-as-users","name":"Login As Users","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T20:54:58Z"},{"id":"wordfence:88dab094-aaa0-4287-bbb0-2101a6c970cc","source":"wordfence","cve":"CVE-2025-66148","title":"Conformer for Elementor <= 1.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88dab094-aaa0-4287-bbb0-2101a6c970cc?source=api-prod","affected":[{"type":"plugin","slug":"conformer-elementor","name":"Contact Form 7 styler for Elementor \u2013 Conformer","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-25T14:40:07Z"},{"id":"wordfence:88db1993-f13a-4ddd-b410-47a2bf08ee3f","source":"wordfence","cve":"CVE-2026-54804","title":"Melhor Envio <= 2.16.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88db1993-f13a-4ddd-b410-47a2bf08ee3f?source=api-prod","affected":[{"type":"plugin","slug":"melhor-envio-cotacao","name":"Melhor Envio","from":"*","from_inclusive":true,"to":"2.16.3","to_inclusive":true,"patched_in":"2.16.4"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:07:31Z"},{"id":"wordfence:88db56a6-8e4c-4ef8-b51a-a2744c3132e2","source":"wordfence","cve":"CVE-2024-37254","title":"File Manager <= 7.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88db56a6-8e4c-4ef8-b51a-a2744c3132e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:34:04Z"},{"id":"wordfence:88db8ee1-4c13-41e6-9dce-04cd9fa8ca70","source":"wordfence","cve":"CVE-2025-54728","title":"CM On Demand Search And Replace <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88db8ee1-4c13-41e6-9dce-04cd9fa8ca70?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:49:20Z"},{"id":"wordfence:88dc08ff-3966-4606-855c-57c25552599e","source":"wordfence","cve":"CVE-2024-7717","title":"WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc08ff-3966-4606-855c-57c25552599e?source=api-prod","affected":[{"type":"plugin","slug":"wp-events-manager","name":"WP Events Manager","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-08-30T19:50:46Z","updated":"2024-08-31T08:35:19Z"},{"id":"wordfence:88dc4a77-0d81-4d90-9a43-cc4d3055e39c","source":"wordfence","cve":"CVE-2022-46862","title":"Quiz And Survey Master <= 8.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc4a77-0d81-4d90-9a43-cc4d3055e39c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.7","to_inclusive":true,"patched_in":"8.0.8"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88dcc5a9-9c34-48f1-a581-f3d4e51a77a7","source":"wordfence","cve":"CVE-2026-27420","title":"Zotpress <= 7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88dcc5a9-9c34-48f1-a581-f3d4e51a77a7?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.4.4","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-28T21:19:00Z"},{"id":"wordfence:88dec08d-cb27-4ea8-853e-0c12dd0a6ab6","source":"wordfence","cve":"CVE-2025-13627","title":"Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88dec08d-cb27-4ea8-853e-0c12dd0a6ab6?source=api-prod","affected":[{"type":"plugin","slug":"makesweat","name":"Makesweat","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:47:38Z","updated":"2026-01-14T05:28:10Z"},{"id":"wordfence:88e10fb7-df45-460a-92fa-7d1734dd7fa6","source":"wordfence","cve":"CVE-2026-87966","title":"Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88e10fb7-df45-460a-92fa-7d1734dd7fa6?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"4.0","from_inclusive":true,"to":"4.0.2.1","to_inclusive":true,"patched_in":"4.0.2.2"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:59:24Z"},{"id":"wordfence:88e2db46-3781-4872-9b8f-73661b7003ed","source":"wordfence","cve":"CVE-2025-67633","title":"Greenhouse Job Board <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88e2db46-3781-4872-9b8f-73661b7003ed?source=api-prod","affected":[{"type":"plugin","slug":"greenhouse-job-board","name":"Greenhouse Job Board","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-05T18:44:46Z"},{"id":"wordfence:88e4eec2-2861-4d1d-97eb-67887f59c745","source":"wordfence","cve":"CVE-2025-14891","title":"Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.93.1","to_inclusive":true,"patched_in":"5.94.0"}],"published":"2026-01-06T14:32:24Z","updated":"2026-01-07T03:21:03Z"},{"id":"wordfence:88e508ad-e7dd-4c8f-a44d-ef633e826007","source":"wordfence","cve":"CVE-2025-9882","title":"osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88e508ad-e7dd-4c8f-a44d-ef633e826007?source=api-prod","affected":[{"type":"plugin","slug":"osticket-wp-bridge","name":"osTicket WP Bridge","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T18:23:56Z","updated":"2025-09-20T06:43:19Z"},{"id":"wordfence:88e74cb2-7b6f-43ac-bb30-4763c5afe493","source":"wordfence","cve":"CVE-2024-8990","title":"Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88e74cb2-7b6f-43ac-bb30-4763c5afe493?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.13","to_inclusive":true,"patched_in":"1.13.14"}],"published":"2024-09-30T18:40:22Z","updated":"2024-10-01T07:30:20Z"},{"id":"wordfence:88eb424b-112e-4580-b883-baba360c1ecd","source":"wordfence","cve":"CVE-2024-49668","title":"Verbalize WP <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88eb424b-112e-4580-b883-baba360c1ecd?source=api-prod","affected":[{"type":"plugin","slug":"verbalize-wp","name":"Verbalize WP","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:18:04Z"},{"id":"wordfence:88edf229-2be2-49d0-b500-e8ff7708f806","source":"wordfence","cve":"CVE-2024-9438","title":"SEUR Oficial <= 2.2.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88edf229-2be2-49d0-b500-e8ff7708f806?source=api-prod","affected":[{"type":"plugin","slug":"seur","name":"SEUR Oficial","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2024-10-28T20:26:08Z","updated":"2024-10-29T08:31:17Z"},{"id":"wordfence:88f1eb9a-f3bb-4b62-975f-a6cb95850966","source":"wordfence","cve":"CVE-2024-8746","title":"File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f1eb9a-f3bb-4b62-975f-a6cb95850966?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.9","to_inclusive":true,"patched_in":"8.3.10"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T06:43:35Z"},{"id":"wordfence:88f2fa28-5bb2-4633-b2bc-27cc6a4e304c","source":"wordfence","cve":"CVE-2024-1363","title":"Easy Accordion \u2013 Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f2fa28-5bb2-4633-b2bc-27cc6a4e304c?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-free","name":"Easy Accordion \u2013 AI-Powered FAQ & Accordion Blocks, Product FAQ","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-13T15:27:03Z"},{"id":"wordfence:88f447d5-990f-4d86-93a3-fd11b63af408","source":"wordfence","cve":"","title":"Custom Product Tabs Lite for WooCommerce <= 1.7.6 - Authenticated (Store Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f447d5-990f-4d86-93a3-fd11b63af408?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-custom-product-tabs-lite","name":"Custom Product Tabs Lite for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2022-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88f4af1b-5e3c-4129-93c3-4f368bd2b0db","source":"wordfence","cve":"CVE-2024-13379","title":"C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f4af1b-5e3c-4129-93c3-4f368bd2b0db?source=api-prod","affected":[{"type":"plugin","slug":"c9-admin-dashboard","name":"C9 Admin Dashboard","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T15:04:17Z","updated":"2025-02-21T03:21:21Z"},{"id":"wordfence:88f4c567-eb57-4f98-afdc-65f8863b90c3","source":"wordfence","cve":"CVE-2023-29384","title":"WordPress Job Board and Recruitment Plugin \u2013 JobWP <= 2.0 - Arbitrary File Upload via 'jobwp_upload_resume'","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f4c567-eb57-4f98-afdc-65f8863b90c3?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88f51ef6-2207-4e91-9182-48c6babe178b","source":"wordfence","cve":"CVE-2025-24753","title":"Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f51ef6-2207-4e91-9182-48c6babe178b?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:32:42Z"},{"id":"wordfence:88f665b7-22ac-492e-8e98-dee1b2dd0a3f","source":"wordfence","cve":"CVE-2025-23721","title":"Mobigate <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f665b7-22ac-492e-8e98-dee1b2dd0a3f?source=api-prod","affected":[{"type":"plugin","slug":"mobigatevn","name":"Mobigate","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:29:00Z"},{"id":"wordfence:88f6a24f-f14a-4d0a-be5a-f8c84910b4fc","source":"wordfence","cve":"CVE-2024-1162","title":"Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f6a24f-f14a-4d0a-be5a-f8c84910b4fc?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.29","to_inclusive":true,"patched_in":"2.10.230"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-02T05:33:17Z"},{"id":"wordfence:88f78dd8-f720-4c10-98e8-bd7d522c3ceb","source":"wordfence","cve":"CVE-2015-9437","title":"Dynamic Widgets <= 1.5.10 - Refletced Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f78dd8-f720-4c10-98e8-bd7d522c3ceb?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":false,"patched_in":"1.5.11"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88f8c67b-ec7e-491e-b5af-c08546eac7ca","source":"wordfence","cve":"CVE-2026-95522","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f8c67b-ec7e-491e-b5af-c08546eac7ca?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-09-23T09:49:00Z","updated":"2026-09-29T20:07:51Z"},{"id":"wordfence:88f8fa25-e3d5-4dfd-aae5-68b5880ffd53","source":"wordfence","cve":"CVE-2025-2186","title":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f8fa25-e3d5-4dfd-aae5-68b5880ffd53?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-22T12:42:12Z"},{"id":"wordfence:88f90762-2d2b-4a31-ac8d-324eab702727","source":"wordfence","cve":"CVE-2024-37409","title":"PowerPack Lite for Beaver Builder <= 1.3.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f90762-2d2b-4a31-ac8d-324eab702727?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.0.4","to_inclusive":true,"patched_in":"1.3.0.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:21:27Z"},{"id":"wordfence:88f9f4db-b15b-43d4-918a-a4c83e5735d1","source":"wordfence","cve":"CVE-2023-25979","title":"Video Gallery \u2013 YouTube Gallery <= 1.7.6 -  Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88f9f4db-b15b-43d4-918a-a4c83e5735d1?source=api-prod","affected":[{"type":"plugin","slug":"gallery-videos","name":"Video Gallery \u2013 YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88fa4a43-7126-42e6-9469-25ffbfd8ed17","source":"wordfence","cve":"CVE-2025-66532","title":"Powerlift < 3.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88fa4a43-7126-42e6-9469-25ffbfd8ed17?source=api-prod","affected":[{"type":"theme","slug":"powerlift","name":"Powerlift - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-11T16:40:32Z"},{"id":"wordfence:88fa97ce-191c-4e95-89b2-2e8a81bcbdf0","source":"wordfence","cve":"CVE-2026-81274","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.67 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88fa97ce-191c-4e95-89b2-2e8a81bcbdf0?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.67","to_inclusive":true,"patched_in":"3.1.69"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:01:53Z"},{"id":"wordfence:88fb7e43-26b1-44e4-864a-e6bd6f2c48fa","source":"wordfence","cve":"CVE-2024-37516","title":"Featured Image from URL <= 4.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88fb7e43-26b1-44e4-864a-e6bd6f2c48fa?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T13:44:41Z"},{"id":"wordfence:88fdd087-4bce-4ead-bc78-c6bdbaa70d9c","source":"wordfence","cve":"","title":"WooCommerce Amazon Pay 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88fdd087-4bce-4ead-bc78-c6bdbaa70d9c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-amazon-payments-advanced","name":"Amazon Pay for WooCommerce","from":"2.0.0","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2021-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:88fe46bf-8e85-4550-92ad-bdd426e5a745","source":"wordfence","cve":"CVE-2022-2440","title":"Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/88fe46bf-8e85-4550-92ad-bdd426e5a745?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.9"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T03:30:46Z"},{"id":"wordfence:89058e5a-0f67-4162-ba3b-0a4353d1e0a9","source":"wordfence","cve":"CVE-2023-25479","title":"Podlove Subscribe button <= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89058e5a-0f67-4162-ba3b-0a4353d1e0a9?source=api-prod","affected":[{"type":"plugin","slug":"podlove-subscribe-button","name":"Podlove Subscribe button","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8905dcc7-d3c8-4ae8-818c-df3e6ed2ad9c","source":"wordfence","cve":"CVE-2025-13920","title":"WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8905dcc7-d3c8-4ae8-818c-df3e6ed2ad9c?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-01-23T23:36:25Z","updated":"2026-01-24T12:27:15Z"},{"id":"wordfence:8909dafa-3383-405e-a264-f0770e6714a4","source":"wordfence","cve":"CVE-2023-51547","title":"Fluent Support <= 1.7.6 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8909dafa-3383-405e-a264-f0770e6714a4?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:890ac1f4-6003-428f-a4d3-123d6a4994b5","source":"wordfence","cve":"CVE-2025-31738","title":"LeadQuizzes <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890ac1f4-6003-428f-a4d3-123d6a4994b5?source=api-prod","affected":[{"type":"plugin","slug":"leadquizzes","name":"LeadQuizzes","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:37:43Z"},{"id":"wordfence:890aeff2-47f2-4377-879e-2254d45312dd","source":"wordfence","cve":"CVE-2025-59008","title":"ZIP Code Based Content Protection <= 1.0.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890aeff2-47f2-4377-879e-2254d45312dd?source=api-prod","affected":[{"type":"plugin","slug":"zip-code-based-content-protection","name":"ZIP Code Based Content Protection","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-09-08T00:00:00Z","updated":"2025-09-16T14:57:24Z"},{"id":"wordfence:890bcce2-18c2-4df8-a945-0c23437534fc","source":"wordfence","cve":"CVE-2024-33686","title":"ColibriWP Theme framework <= (Various Versions) - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890bcce2-18c2-4df8-a945-0c23437534fc?source=api-prod","affected":[{"type":"theme","slug":"colibri-wp","name":"Colibri WP","from":"*","from_inclusive":true,"to":"1.0.94","to_inclusive":true,"patched_in":"1.0.99"},{"type":"theme","slug":"elevate-wp","name":"Elevate WP","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.17"},{"type":"theme","slug":"calliope","name":"Calliope","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":true,"patched_in":"1.0.35"},{"type":"theme","slug":"teluro","name":"Teluro","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.36"},{"type":"theme","slug":"althea-wp","name":"Althea WP","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.16"},{"type":"theme","slug":"hugo-wp","name":"Hugo WP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.10"},{"type":"theme","slug":"pathway","name":"Pathway","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"},{"type":"theme","slug":"brite","name":"Brite","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.15"},{"type":"theme","slug":"vertice","name":"Vertice","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-07T21:10:56Z"},{"id":"wordfence:890bfe44-32e6-4edd-b46c-379ef4ce54d2","source":"wordfence","cve":"CVE-2024-12733","title":"AffiliateImporterEb <= 1.0.6 - Reflected Cross-Site Scripting via 'ebdn_min_price'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890bfe44-32e6-4edd-b46c-379ef4ce54d2?source=api-prod","affected":[{"type":"plugin","slug":"affiliateimportereb","name":"AffiliateImporterEb","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-05-27T15:17:10Z"},{"id":"wordfence:890c324a-34e0-455f-9782-6fc13ab10f6f","source":"wordfence","cve":"CVE-2025-49063","title":"BaiduXZH Submit(\u767e\u5ea6\u718a\u638c\u53f7) <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890c324a-34e0-455f-9782-6fc13ab10f6f?source=api-prod","affected":[{"type":"plugin","slug":"i3geek-baiduxzh","name":"BaiduXZH Submit(\u767e\u5ea6\u718a\u638c\u53f7)","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:37:49Z"},{"id":"wordfence:890c743e-da5e-46ed-a011-cecd24778163","source":"wordfence","cve":"CVE-2025-14056","title":"Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890c743e-da5e-46ed-a011-cecd24778163?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-ui","name":"Custom Post Type UI","from":"*","from_inclusive":true,"to":"1.18.1","to_inclusive":true,"patched_in":"1.18.2"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-13T03:20:25Z"},{"id":"wordfence:890dadec-b60c-4f4c-8644-1a0d1eecc74d","source":"wordfence","cve":"CVE-2025-26876","title":"Search with Typesense <= 2.0.8 - Authenticated (Admin+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890dadec-b60c-4f4c-8644-1a0d1eecc74d?source=api-prod","affected":[{"type":"plugin","slug":"search-with-typesense","name":"Search with Typesense","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T20:35:49Z"},{"id":"wordfence:890f83dc-d8d2-4fb2-a04a-c7b70d104b49","source":"wordfence","cve":"CVE-2022-38068","title":"Export Post Info <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/890f83dc-d8d2-4fb2-a04a-c7b70d104b49?source=api-prod","affected":[{"type":"plugin","slug":"export-post-info","name":"Export Post Info","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89100b33-0e27-4a04-9407-8505524e7e45","source":"wordfence","cve":"CVE-2025-66065","title":"Gutenverse <= 3.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89100b33-0e27-4a04-9407-8505524e7e45?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T17:15:46Z"},{"id":"wordfence:8910b6f0-1bf4-4ac0-93b7-54db7c15392c","source":"wordfence","cve":"CVE-2024-2139","title":"Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8910b6f0-1bf4-4ac0-93b7-54db7c15392c?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.6","to_inclusive":true,"patched_in":"2.0.5.7"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T01:56:47Z"},{"id":"wordfence:8910d60c-45be-41a1-86fb-a0d60a78e660","source":"wordfence","cve":"","title":"WordPress Landing Pages <= 2.2.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8910d60c-45be-41a1-86fb-a0d60a78e660?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2016-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8911642f-6061-42a1-b733-8cc44b2870f1","source":"wordfence","cve":"","title":"Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8911642f-6061-42a1-b733-8cc44b2870f1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.75","to_inclusive":true,"patched_in":"1.3.76"}],"published":"2016-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8915116c-5355-4497-a688-ca7327108945","source":"wordfence","cve":"CVE-2025-30630","title":"Global Translator <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8915116c-5355-4497-a688-ca7327108945?source=api-prod","affected":[{"type":"plugin","slug":"global-translator","name":"Global Translator","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:57:40Z"},{"id":"wordfence:8915c76f-84ca-4d8d-b5ec-43dc22aeffa2","source":"wordfence","cve":"CVE-2025-53439","title":"Harper <= 1.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8915c76f-84ca-4d8d-b5ec-43dc22aeffa2?source=api-prod","affected":[{"type":"theme","slug":"harper","name":"Harper -  Digital Marketing Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:25:52Z"},{"id":"wordfence:89183a72-5b35-4c11-81d7-0a735ebce884","source":"wordfence","cve":"CVE-2025-54677","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89183a72-5b35-4c11-81d7-0a735ebce884?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:26:19Z"},{"id":"wordfence:8919207c-fea7-4e07-9794-1089b996780d","source":"wordfence","cve":"CVE-2025-27355","title":"Woocommerce \u2013 Loi Hamon <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8919207c-fea7-4e07-9794-1089b996780d?source=api-prod","affected":[{"type":"plugin","slug":"loi-hamon","name":"Woocommerce \u2013 Loi Hamon","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:37:53Z"},{"id":"wordfence:8919ba4e-e217-4e1d-8bd6-4c2387f9680f","source":"wordfence","cve":"CVE-2026-32527","title":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8919ba4e-e217-4e1d-8bd6-4c2387f9680f?source=api-prod","affected":[{"type":"plugin","slug":"cf7-insightly","name":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:31:08Z"},{"id":"wordfence:891a625e-8248-4d21-a796-bf0cff6fc253","source":"wordfence","cve":"CVE-2024-3059","title":"ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery to Campaign Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/891a625e-8248-4d21-a796-bf0cff6fc253?source=api-prod","affected":[{"type":"plugin","slug":"enl-newsletter","name":"ENL Newsletter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-05-01T15:16:11Z"},{"id":"wordfence:89209bcb-c74d-4bf9-b1a8-5b529f4d73be","source":"wordfence","cve":"CVE-2021-24560","title":"Software License Manager <= 4.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89209bcb-c74d-4bf9-b1a8-5b529f4d73be?source=api-prod","affected":[{"type":"plugin","slug":"software-license-manager","name":"Software License Manager","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":false,"patched_in":"4.4.8"}],"published":"2021-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89218de3-7bb9-42f5-86d8-48d28c380231","source":"wordfence","cve":"CVE-2026-39579","title":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89218de3-7bb9-42f5-86d8-48d28c380231?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:26:37Z"},{"id":"wordfence:8921ea7f-5e27-4f05-b338-1c16366a8c8e","source":"wordfence","cve":"CVE-2024-32534","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.23 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8921ea7f-5e27-4f05-b338-1c16366a8c8e?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.23","to_inclusive":true,"patched_in":"1.15.24"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T14:57:52Z"},{"id":"wordfence:892372c9-380c-43b2-b928-b5964574c414","source":"wordfence","cve":"CVE-2023-28987","title":"Wp Ultimate Review <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/892372c9-380c-43b2-b928-b5964574c414?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8923d9c9-7af6-4109-9c39-b5faee57f8e1","source":"wordfence","cve":"CVE-2026-23971","title":"Woodmart <= 8.3.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8923d9c9-7af6-4109-9c39-b5faee57f8e1?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.8","to_inclusive":true,"patched_in":"8.3.9"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:24:39Z"},{"id":"wordfence:89246ce6-4d8d-4489-a6e1-cecb0a40e791","source":"wordfence","cve":"CVE-2026-106611","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89246ce6-4d8d-4489-a6e1-cecb0a40e791?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.3","to_inclusive":true,"patched_in":"1.58.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:28:51Z"},{"id":"wordfence:8925157c-8642-4cbc-89e3-fb2ac148eee6","source":"wordfence","cve":"CVE-2024-2233","title":"Himer <= 2.1.0 - Cross-Site Request Forgery to Group Leave","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8925157c-8642-4cbc-89e3-fb2ac148eee6?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T18:37:47Z"},{"id":"wordfence:89253d8c-6e19-4980-bf87-21e0c5cfe35d","source":"wordfence","cve":"CVE-2025-23748","title":"Singsys -Awesome Gallery <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89253d8c-6e19-4980-bf87-21e0c5cfe35d?source=api-prod","affected":[{"type":"plugin","slug":"awesome-gallery-singsys","name":"Singsys -Awesome Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:13:35Z"},{"id":"wordfence:892a1983-018b-480d-adab-29c32fd88be5","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/892a1983-018b-480d-adab-29c32fd88be5?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:892c44bf-09b2-41cd-b2c5-894363495347","source":"wordfence","cve":"CVE-2025-22774","title":"CRUDLab Scroll to Top <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/892c44bf-09b2-41cd-b2c5-894363495347?source=api-prod","affected":[{"type":"plugin","slug":"crudlab-scroll-to-top","name":"CRUDLab Scroll to Top","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T21:39:23Z"},{"id":"wordfence:892cb187-95b6-4df7-a0dc-4db6d8cee902","source":"wordfence","cve":"CVE-2024-54442","title":"Better WP Login Page <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/892cb187-95b6-4df7-a0dc-4db6d8cee902?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-login-page","name":"Better WP Login Page","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:54:39Z"},{"id":"wordfence:892fe839-57ca-45bc-aa9b-f1bf87994a77","source":"wordfence","cve":"CVE-2023-51361","title":"Sticky Chat Widget <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/892fe839-57ca-45bc-aa9b-f1bf87994a77?source=api-prod","affected":[{"type":"plugin","slug":"sticky-chat-widget","name":"Sticky Chat Widget \u2013 Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89315bf7-19f2-4fec-b9f5-62aa2a928d7a","source":"wordfence","cve":"CVE-2025-26901","title":"Brizy Pro <= 2.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89315bf7-19f2-4fec-b9f5-62aa2a928d7a?source=api-prod","affected":[{"type":"plugin","slug":"brizy-pro","name":"Brizy Pro","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-04-09T00:00:00Z","updated":"2026-04-15T13:28:52Z"},{"id":"wordfence:8931a3ab-886c-4618-b413-c25884ef24bc","source":"wordfence","cve":"CVE-2025-59137","title":"Behance Portfolio Manager <= 1.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8931a3ab-886c-4618-b413-c25884ef24bc?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:29:44Z"},{"id":"wordfence:89321887-0116-47fb-b65b-008c9fb01b62","source":"wordfence","cve":"CVE-2022-47437","title":"WSB Brands <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via $logo","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89321887-0116-47fb-b65b-008c9fb01b62?source=api-prod","affected":[{"type":"plugin","slug":"wsb-brands","name":"WSB Brands","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:893500ba-cc16-4429-bbe1-725aa65589c9","source":"wordfence","cve":"CVE-2023-48761","title":"Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/893500ba-cc16-4429-bbe1-725aa65589c9?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.2.1"},{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.1.25.1","to_inclusive":true,"patched_in":"2.1.25.2"},{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.5.1"},{"type":"plugin","slug":"jet-theme-core","name":"JetThemeCore for Elementor","from":"*","from_inclusive":true,"to":"2.1.2.1","to_inclusive":true,"patched_in":"2.1.2.2"},{"type":"plugin","slug":"jet-compare-wishlist","name":"JetCompareWishlist","from":"*","from_inclusive":true,"to":"1.5.5.1","to_inclusive":true,"patched_in":"1.5.5.2"},{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.13.1"},{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.2.1"},{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.7.2","to_inclusive":true,"patched_in":"2.1.7.3"},{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.2.1"},{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.2.5.1","to_inclusive":true,"patched_in":"3.2.5.2"},{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":true,"patched_in":"1.4.6.2"},{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"},{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.8.1"},{"type":"plugin","slug":"jet-woo-product-gallery","name":"JetProductGallery","from":"*","from_inclusive":true,"to":"2.1.13.1","to_inclusive":true,"patched_in":"2.1.13.2"},{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.2.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8936f366-fd3d-4d82-9b11-e040f706511e","source":"wordfence","cve":"CVE-2025-60223","title":"WPBot Pro Wordpress Chatbot <= 13.6.5 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8936f366-fd3d-4d82-9b11-e040f706511e?source=api-prod","affected":[{"type":"plugin","slug":"wpbot-pro","name":"WPBot Pro Wordpress Chatbot","from":"*","from_inclusive":true,"to":"13.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2026-09-17T14:49:47Z"},{"id":"wordfence:89384b42-8c66-469d-a7d2-1c50c89cfe7e","source":"wordfence","cve":"CVE-2022-2425","title":"WP DS Blog Map <= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89384b42-8c66-469d-a7d2-1c50c89cfe7e?source=api-prod","affected":[{"type":"plugin","slug":"wp-ds-blog-map","name":"WP DS Blog Map","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8938c153-0640-418b-87ab-ae65d6c80b97","source":"wordfence","cve":"CVE-2021-24326","title":"All 404 Redirect to Homepage < 1.21 - Reflected Cross-Site Scripting via tab Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8938c153-0640-418b-87ab-ae65d6c80b97?source=api-prod","affected":[{"type":"plugin","slug":"all-404-redirect-to-homepage","name":"All 404 Redirect to Homepage","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":false,"patched_in":"1.21"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89392f97-58c5-48db-b835-013ef493ca5e","source":"wordfence","cve":"CVE-2026-14472","title":"Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89392f97-58c5-48db-b835-013ef493ca5e?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2026-09-17T19:10:54Z","updated":"2026-09-18T07:40:02Z"},{"id":"wordfence:8939cad2-f9fc-45aa-97d1-9a1a2a59bf94","source":"wordfence","cve":"CVE-2025-68591","title":"Simple File List <= 6.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8939cad2-f9fc-45aa-97d1-9a1a2a59bf94?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2025-12-25T00:00:00Z","updated":"2026-06-22T21:42:31Z"},{"id":"wordfence:893d44a5-5a8a-4c39-a819-892df00f6472","source":"wordfence","cve":"CVE-2026-103375","title":"Antom Payments <= 2.0.11 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/893d44a5-5a8a-4c39-a819-892df00f6472?source=api-prod","affected":[{"type":"plugin","slug":"antom-payments","name":"Antom Payments","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:08:00Z"},{"id":"wordfence:893f39fb-6e4b-436f-a503-34bab19b554a","source":"wordfence","cve":"CVE-2026-48200","title":"Document Library Lite <= 1.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/893f39fb-6e4b-436f-a503-34bab19b554a?source=api-prod","affected":[{"type":"plugin","slug":"document-library-lite","name":"Document Library Lite","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-10-29T15:04:00Z","updated":"2026-11-03T20:00:02Z"},{"id":"wordfence:893f7ee5-e15a-4505-a6f9-29c8d346b772","source":"wordfence","cve":"CVE-2026-111965","title":"Profile Builder 4.0.0 - 4.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/893f7ee5-e15a-4505-a6f9-29c8d346b772?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"4.0.0","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T15:05:00Z"},{"id":"wordfence:893fa8c6-dcb4-4613-a836-8c717f859696","source":"wordfence","cve":"CVE-2026-5508","title":"WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/893fa8c6-dcb4-4613-a836-8c717f859696?source=api-prod","affected":[{"type":"plugin","slug":"wowpress","name":"WowPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:36:55Z","updated":"2026-04-08T06:43:40Z"},{"id":"wordfence:894080c3-f00a-491b-bebf-469e35118965","source":"wordfence","cve":"CVE-2025-62114","title":"Download Media Library <= 0.2.1 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/894080c3-f00a-491b-bebf-469e35118965?source=api-prod","affected":[{"type":"plugin","slug":"download-media-library","name":"Download Media Library","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:17:20Z"},{"id":"wordfence:89409461-c87e-4882-bf53-cc789e459b4f","source":"wordfence","cve":"CVE-2023-0536","title":"Wp-D3 <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89409461-c87e-4882-bf53-cc789e459b4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-d3","name":"Wp-D3","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8945128b-79b7-46c7-b981-78e6619d3f63","source":"wordfence","cve":"","title":"WPSID Shortcode <= 1.0.9.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8945128b-79b7-46c7-b981-78e6619d3f63?source=api-prod","affected":[{"type":"plugin","slug":"wpsid-shortcode","name":"WPSID Shortcode","from":"*","from_inclusive":true,"to":"1.0.9.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89458095-2efe-4162-961a-7dc80852d312","source":"wordfence","cve":"CVE-2024-2109","title":"Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89458095-2efe-4162-961a-7dc80852d312?source=api-prod","affected":[{"type":"plugin","slug":"booster-extension","name":"Booster Extension","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-31T14:31:18Z"},{"id":"wordfence:8945bae7-2224-4d9f-b693-10c94c94dea0","source":"wordfence","cve":"CVE-2024-11851","title":"NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.17.6"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T11:29:55Z"},{"id":"wordfence:8945cd7a-4185-4f0f-b56b-8ddd193dfed7","source":"wordfence","cve":"CVE-2019-6117","title":"Gallery Images Ape <= 1.6.14 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8945cd7a-4185-4f0f-b56b-8ddd193dfed7?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images-ape","name":"Gallery Images Ape","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2019-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8946d3be-857c-4675-999a-5b35633668d2","source":"wordfence","cve":"CVE-2025-23729","title":"XTRA Settings <= 2.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8946d3be-857c-4675-999a-5b35633668d2?source=api-prod","affected":[{"type":"plugin","slug":"xtra-settings","name":"XTRA Settings","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:54:47Z"},{"id":"wordfence:89489218-263f-4157-a5cd-a12bc6a0dfe6","source":"wordfence","cve":"CVE-2023-4723","title":"Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89489218-263f-4157-a5cd-a12bc6a0dfe6?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.7","to_inclusive":true,"patched_in":"1.12.8"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:894ad797-5143-4493-a3d6-29b22cee1cc6","source":"wordfence","cve":"CVE-2026-28181","title":"AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/894ad797-5143-4493-a3d6-29b22cee1cc6?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:08:03Z"},{"id":"wordfence:894b43ed-143d-4c0b-afd1-05fcd6fa5018","source":"wordfence","cve":"CVE-2025-7645","title":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/894b43ed-143d-4c0b-afd1-05fcd6fa5018?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-22T06:38:51Z"},{"id":"wordfence:894c875a-078f-4c1f-83d2-4a6e4a309c3e","source":"wordfence","cve":"CVE-2020-36748","title":"Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/894c875a-078f-4c1f-83d2-4a6e4a309c3e?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:894ef079-8c57-4e69-94a9-0be71f2f6176","source":"wordfence","cve":"CVE-2026-8615","title":"ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/894ef079-8c57-4e69-94a9-0be71f2f6176?source=api-prod","affected":[{"type":"plugin","slug":"wc-exporter-for-reviso","name":"ilGhera Reviso Exporter for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-08T17:19:16Z","updated":"2026-09-09T05:31:05Z"},{"id":"wordfence:8950b98d-7e7d-4cad-bb3d-d7a5d8edbdf5","source":"wordfence","cve":"CVE-2022-42888","title":"ARMember Premium <= 5.5.1 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8950b98d-7e7d-4cad-bb3d-d7a5d8edbdf5?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.6"}],"published":"2022-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89512190-a0fe-495a-9dda-8d8540a5325c","source":"wordfence","cve":"CVE-2024-11883","title":"Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89512190-a0fe-495a-9dda-8d8540a5325c?source=api-prod","affected":[{"type":"plugin","slug":"connatix-video-embed","name":"Connatix Video Embed","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T16:02:31Z","updated":"2024-12-14T04:23:43Z"},{"id":"wordfence:89525af0-105a-4d7d-93d1-af724a837e7a","source":"wordfence","cve":"CVE-2024-8046","title":"Logo Showcase Ultimate \u2013 Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89525af0-105a-4d7d-93d1-af724a837e7a?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-ultimate","name":"Logo Showcase Ultimate \u2013 Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-08-26T19:28:13Z","updated":"2024-08-27T07:34:42Z"},{"id":"wordfence:8953c08c-78fd-415a-899d-99eba7ea1517","source":"wordfence","cve":"CVE-2026-16539","title":"SM Page Duplicator <= 1.0.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8953c08c-78fd-415a-899d-99eba7ea1517?source=api-prod","affected":[{"type":"plugin","slug":"sm-page-duplicator","name":"sm page duplicator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:27:50Z"},{"id":"wordfence:8955456c-c356-4e72-87d2-2ffa910c6808","source":"wordfence","cve":"CVE-2025-31748","title":"Opal Portfolio <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8955456c-c356-4e72-87d2-2ffa910c6808?source=api-prod","affected":[{"type":"plugin","slug":"opal-portfolios","name":"Opal Portfolio","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:59:32Z"},{"id":"wordfence:8957413c-95e0-49c8-ba8a-02b9b5141e08","source":"wordfence","cve":"CVE-2022-2945","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 5.5.3 - Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8957413c-95e0-49c8-ba8a-02b9b5141e08?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89584034-4a93-42a6-8fef-55dc3895c45c","source":"wordfence","cve":"CVE-2024-1813","title":"Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2024-03-15T00:00:00Z","updated":"2024-04-09T18:59:06Z"},{"id":"wordfence:89586fcc-f0f6-4f44-841b-04eee64c0ab3","source":"wordfence","cve":"CVE-2024-27957","title":"Pie Register <= 3.8.3.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89586fcc-f0f6-4f44-841b-04eee64c0ab3?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.3.2","to_inclusive":true,"patched_in":"3.8.3.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-05-23T15:37:02Z"},{"id":"wordfence:895d882b-f4ca-4837-9d8e-aca04c3fb9e3","source":"wordfence","cve":"CVE-2023-0095","title":"Page View Count <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/895d882b-f4ca-4837-9d8e-aca04c3fb9e3?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:895e9ead-14d8-432b-81dd-4d292eee462a","source":"wordfence","cve":"CVE-2017-1000227","title":"Salutation < 3.0.16 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/895e9ead-14d8-432b-81dd-4d292eee462a?source=api-prod","affected":[{"type":"theme","slug":"salutation-wp","name":"Salutation","from":"*","from_inclusive":true,"to":"3.0.16","to_inclusive":false,"patched_in":"3.0.16"}],"published":"2017-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:895f2db1-a2ed-4a17-a4f6-cd13ee8f84af","source":"wordfence","cve":"CVE-2023-6933","title":"Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/895f2db1-a2ed-4a17-a4f6-cd13ee8f84af?source=api-prod","affected":[{"type":"plugin","slug":"better-search-replace","name":"Better Search Replace","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:36:48Z"},{"id":"wordfence:89611ead-5082-4ef2-a98c-8713843d1225","source":"wordfence","cve":"CVE-2026-105256","title":"LatePoint <= 5.7.4 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89611ead-5082-4ef2-a98c-8713843d1225?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:18:48Z"},{"id":"wordfence:89614950-8517-4765-886a-1aa30a2f052e","source":"wordfence","cve":"","title":"Paid Member Subscriptions <= 2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89614950-8517-4765-886a-1aa30a2f052e?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89620065-b961-49c9-a662-bee300b5da72","source":"wordfence","cve":"","title":"Lightspeed <= 1.1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89620065-b961-49c9-a662-bee300b5da72?source=api-prod","affected":[{"type":"theme","slug":"lightspeed","name":"Lightspeed","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2013-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8962c601-2c2c-4b96-b8a4-fdc2ad8a2c08","source":"wordfence","cve":"CVE-2022-46863","title":"Quick Event Manager <= 9.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-692","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8962c601-2c2c-4b96-b8a4-fdc2ad8a2c08?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.6.4","to_inclusive":true,"patched_in":"9.6.5"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89634f57-5cc0-4559-8e13-27374ef29f12","source":"wordfence","cve":"CVE-2026-119473","title":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.17.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89634f57-5cc0-4559-8e13-27374ef29f12?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.7","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:48:34Z"},{"id":"wordfence:89635463-966d-4f7d-995d-ad83a502d95b","source":"wordfence","cve":"CVE-2021-4403","title":"Remove Schema <= 1.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89635463-966d-4f7d-995d-ad83a502d95b?source=api-prod","affected":[{"type":"plugin","slug":"remove-schema","name":"Remove Schema","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:896384a7-0868-45b3-9ea6-20ff12169b58","source":"wordfence","cve":"CVE-2025-2248","title":"WP-PManager <= 1.2 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/896384a7-0868-45b3-9ea6-20ff12169b58?source=api-prod","affected":[{"type":"plugin","slug":"wp-programmmanager","name":"WP-PManager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-05-23T15:04:00Z"},{"id":"wordfence:89655e84-acb5-40f2-a22f-a483a1bb29df","source":"wordfence","cve":"CVE-2022-3142","title":"NEX-Forms <= 7.9.6 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89655e84-acb5-40f2-a22f-a483a1bb29df?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"7.9.6","to_inclusive":true,"patched_in":"7.9.7"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8965a9e4-af93-49fb-8224-2d6e62fa2fd3","source":"wordfence","cve":"CVE-2026-27088","title":"Darna Framework <= 2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8965a9e4-af93-49fb-8224-2d6e62fa2fd3?source=api-prod","affected":[{"type":"plugin","slug":"darna-framework","name":"Darna Framework","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:45:14Z"},{"id":"wordfence:89696d1c-8e6e-402a-9d7a-03fe0f364a72","source":"wordfence","cve":"CVE-2025-12085","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89696d1c-8e6e-402a-9d7a-03fe0f364a72?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-11-20T17:00:40Z","updated":"2025-11-21T05:32:07Z"},{"id":"wordfence:896a038f-fe54-4120-842e-093ef236a898","source":"wordfence","cve":"CVE-2024-3228","title":"Social Sharing Plugin \u2013 Kiwi <= 2.1.7 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/896a038f-fe54-4120-842e-093ef236a898?source=api-prod","affected":[{"type":"plugin","slug":"kiwi-social-share","name":"Social Sharing Plugin \u2013 Kiwi","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T08:33:10Z"},{"id":"wordfence:896bb599-0525-478f-9c6b-bb40b630edbd","source":"wordfence","cve":"CVE-2026-87894","title":"Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution 1.0.9 - 1.2.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/896bb599-0525-478f-9c6b-bb40b630edbd?source=api-prod","affected":[{"type":"plugin","slug":"rox-appointment-booking","name":"Rox Appointment Booking \u2013 Event, Calendar & Appointment Scheduling","from":"1.0.9","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T19:59:42Z"},{"id":"wordfence:896d69ff-ec05-4811-a959-84f632b4b915","source":"wordfence","cve":"CVE-2025-24738","title":"Call Now Button <= 1.4.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/896d69ff-ec05-4811-a959-84f632b4b915?source=api-prod","affected":[{"type":"plugin","slug":"call-now-button","name":"Call Now Button \u2013 The Free Click to Call Button for WordPress","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:02:10Z"},{"id":"wordfence:8972b507-4aae-40cc-a79e-2603dbdc70c0","source":"wordfence","cve":"CVE-2026-15448","title":"Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8972b507-4aae-40cc-a79e-2603dbdc70c0?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.1","to_inclusive":true,"patched_in":"3.6.0.2"}],"published":"2026-07-22T20:55:02Z","updated":"2026-07-23T09:33:58Z"},{"id":"wordfence:8972e095-e478-4a3a-bfa9-a63128d1f6bf","source":"wordfence","cve":"CVE-2025-58826","title":"WP Publication Archive  <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8972e095-e478-4a3a-bfa9-a63128d1f6bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-publication-archive","name":"WP Publication Archive","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T13:33:16Z"},{"id":"wordfence:89746f2b-4893-4e9b-841a-6f346cd8dac4","source":"wordfence","cve":"CVE-2025-23620","title":"Captchelfie \u2013 Captcha by Selfie <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89746f2b-4893-4e9b-841a-6f346cd8dac4?source=api-prod","affected":[{"type":"plugin","slug":"captchelfie-captcha-by-selfie","name":"Captchelfie \u2013 Captcha by Selfie","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:08:02Z"},{"id":"wordfence:8976c4ac-495b-4fd5-9759-df6b572aaa3a","source":"wordfence","cve":"CVE-2026-123466","title":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates <= 2.3.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8976c4ac-495b-4fd5-9759-df6b572aaa3a?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.3.18","to_inclusive":true,"patched_in":"2.3.19"}],"published":"2026-11-07T09:08:00Z","updated":"2026-11-10T19:59:43Z"},{"id":"wordfence:897824d0-17cc-4322-bcd9-5e41d141bf62","source":"wordfence","cve":"CVE-2022-1046","title":"Visual Form Builder <= 3.0.6 - Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897824d0-17cc-4322-bcd9-5e41d141bf62?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2022-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:897ce9a9-8b3e-40bc-9815-c55cc7a838f9","source":"wordfence","cve":"CVE-2024-13373","title":"Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update","severity":"high","cvss":8.1,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897ce9a9-8b3e-40bc-9815-c55cc7a838f9?source=api-prod","affected":[{"type":"plugin","slug":"exertio-framework","name":"Exertio Framework","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T06:39:27Z"},{"id":"wordfence:897ee0c1-9f28-47b5-9b10-f6fd8c4c4f18","source":"wordfence","cve":"CVE-2026-52698","title":"PushEngage \u2013 Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897ee0c1-9f28-47b5-9b10-f6fd8c4c4f18?source=api-prod","affected":[{"type":"plugin","slug":"pushengage","name":"PushEngage \u2013 Web Push Notifications, WooCommerce Automation & Chat Widget","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-18T13:35:16Z"},{"id":"wordfence:897f42da-cbe4-4a43-abc0-659bb9cda7a0","source":"wordfence","cve":"CVE-2024-48036","title":"SKT Blocks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897f42da-cbe4-4a43-abc0-659bb9cda7a0?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-10-09T00:00:00Z","updated":"2026-04-15T20:36:43Z"},{"id":"wordfence:897f8459-b998-46f9-8429-aeffb71b93c7","source":"wordfence","cve":"CVE-2025-31818","title":"ContentBot AI Writer <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897f8459-b998-46f9-8429-aeffb71b93c7?source=api-prod","affected":[{"type":"plugin","slug":"content-bot","name":"ContentBot AI Writer (AI Content)","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:13:50Z"},{"id":"wordfence:897fcc35-b700-4699-acd0-04a271686498","source":"wordfence","cve":"CVE-2024-51893","title":"Postify: Post Layout For Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/897fcc35-b700-4699-acd0-04a271686498?source=api-prod","affected":[{"type":"plugin","slug":"postify-for-elementor","name":"Postify: Post Layout For Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:55:02Z"},{"id":"wordfence:8981ab1d-5957-444c-a5f1-57317a2e8395","source":"wordfence","cve":"","title":"MyAlice \u2013 Live Chat, WhatsApp, Facebook Messenger, Instagram, & Chatbot for WooCommerce <= 1.2.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8981ab1d-5957-444c-a5f1-57317a2e8395?source=api-prod","affected":[{"type":"plugin","slug":"myaliceai","name":"Social Live Chat Helpdesk \u2013 MyAlice","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89838360-1693-4283-86d5-0334b91ab879","source":"wordfence","cve":"CVE-2024-54366","title":"Vimeography <= 2.4.4 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89838360-1693-4283-86d5-0334b91ab879?source=api-prod","affected":[{"type":"plugin","slug":"vimeography","name":"Vimeography: Vimeo Video Gallery WordPress Plugin","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:26:36Z"},{"id":"wordfence:89888c4c-74e1-4808-9a1e-6d23df513db5","source":"wordfence","cve":"CVE-2025-13071","title":"Custom Admin Menu <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89888c4c-74e1-4808-9a1e-6d23df513db5?source=api-prod","affected":[{"type":"plugin","slug":"custom-admin-menu","name":"Custom Admin Menu","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-11T16:18:47Z"},{"id":"wordfence:89899ead-eebc-4fcd-a9b2-12d3ac2beedd","source":"wordfence","cve":"CVE-2025-57912","title":"Dialogity Free Live Chat <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89899ead-eebc-4fcd-a9b2-12d3ac2beedd?source=api-prod","affected":[{"type":"plugin","slug":"dialogity-website-chat","name":"Dialogity Free Live Chat","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-25T13:30:22Z"},{"id":"wordfence:898af9aa-72c4-46a6-afc2-76dd17672fbc","source":"wordfence","cve":"CVE-2023-34170","title":"Quick/Bulk Order Form for WooCommerce <= 3.5.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898af9aa-72c4-46a6-afc2-76dd17672fbc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bulk-order-form","name":"Bulk Order Form for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:898ba68f-2b0c-462a-87ee-272ee624396e","source":"wordfence","cve":"","title":"Jock on air now <= 5.6.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898ba68f-2b0c-462a-87ee-272ee624396e?source=api-prod","affected":[{"type":"plugin","slug":"joan","name":"Jock On Air Now (JOAN)","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:898bd4ae-6dc7-4fb3-8236-d46b891e086f","source":"wordfence","cve":"CVE-2025-30621","title":"Translator <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898bd4ae-6dc7-4fb3-8236-d46b891e086f?source=api-prod","affected":[{"type":"plugin","slug":"translator","name":"Translator","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:25:10Z"},{"id":"wordfence:898c2851-27e9-493a-96c7-b6be1c1f5c7f","source":"wordfence","cve":"CVE-2019-20173","title":"Login by Auth0 3.11.0 - 3.11.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898c2851-27e9-493a-96c7-b6be1c1f5c7f?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"3.11.0","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.11.3"}],"published":"2020-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:898c5554-fd02-47a2-a1f9-1c488cfab57e","source":"wordfence","cve":"CVE-2024-12614","title":"Passwords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898c5554-fd02-47a2-a1f9-1c488cfab57e?source=api-prod","affected":[{"type":"plugin","slug":"passwords-manager","name":"Passwords Manager","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T09:39:16Z"},{"id":"wordfence:898cdd21-792b-4548-ba32-eb97dfefea23","source":"wordfence","cve":"CVE-2026-104390","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/898cdd21-792b-4548-ba32-eb97dfefea23?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.0.28"}],"published":"2026-10-07T09:17:00Z","updated":"2026-10-08T23:23:11Z"},{"id":"wordfence:89904362-4ac2-450a-89ac-8935fdb4976d","source":"wordfence","cve":"CVE-2013-5963","title":"Simple Dropbox Upload < 1.8.8.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89904362-4ac2-450a-89ac-8935fdb4976d?source=api-prod","affected":[{"type":"plugin","slug":"simple-dropbox-upload-form","name":"Simple Dropbox Upload","from":"*","from_inclusive":true,"to":"1.8.8.1","to_inclusive":false,"patched_in":"1.8.8.1"}],"published":"2013-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89916f4e-71a2-4e26-9cfb-40f11a101321","source":"wordfence","cve":"CVE-2026-32511","title":"St\u00e5l < 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89916f4e-71a2-4e26-9cfb-40f11a101321?source=api-prod","affected":[{"type":"theme","slug":"stal","name":"St\u00e5l - Industry WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:56:24Z"},{"id":"wordfence:8996a0f0-8a49-4310-917b-62172c12afdb","source":"wordfence","cve":"CVE-2025-11267","title":"VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8996a0f0-8a49-4310-917b-62172c12afdb?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.112.1","to_inclusive":true,"patched_in":"9.112.2"}],"published":"2025-11-17T19:13:27Z","updated":"2025-11-18T07:30:38Z"},{"id":"wordfence:89a02485-a2a5-467d-ad19-6b267059389d","source":"wordfence","cve":"CVE-2022-1614","title":"WP-EMail <= 2.68.2 - Spam Protection Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a02485-a2a5-467d-ad19-6b267059389d?source=api-prod","affected":[{"type":"plugin","slug":"wp-email","name":"WP-EMail","from":"*","from_inclusive":true,"to":"2.69.0","to_inclusive":false,"patched_in":"2.69.0"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89a05036-93f6-421f-ac64-a26622427ebb","source":"wordfence","cve":"CVE-2026-61981","title":"Simple Link Directory Pro - AI Powered <= 15.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a05036-93f6-421f-ac64-a26622427ebb?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory-pro","name":"Simple Link Directory Pro - AI Powered","from":"*","from_inclusive":true,"to":"15.0.8","to_inclusive":true,"patched_in":"15.0.9"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:56:18Z"},{"id":"wordfence:89a07c47-b57c-49de-9f7c-a2bb29e3fecc","source":"wordfence","cve":"CVE-2026-93368","title":"Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a07c47-b57c-49de-9f7c-a2bb29e3fecc?source=api-prod","affected":[{"type":"plugin","slug":"rename-wp-loginphp-to-anything-you-want","name":"Rename wp-login.php to anything you want","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-22T19:45:00Z","updated":"2026-09-23T08:28:05Z"},{"id":"wordfence:89a15f3d-8aa7-4f74-841e-f53347c02dc5","source":"wordfence","cve":"CVE-2024-37219","title":"Page Builder Sandwich \u2013 Front-End Page Builder <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a15f3d-8aa7-4f74-841e-f53347c02dc5?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-sandwich","name":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:39:50Z"},{"id":"wordfence:89a23d5a-7728-403e-b654-595d92c20b66","source":"wordfence","cve":"","title":"eRoom \u2013 Zoom Meetings & Webinar <= 1.3.7 - Unauthorized Setting Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a23d5a-7728-403e-b654-595d92c20b66?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2022-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89a44d42-a110-4f55-ad27-2be4ccb41a16","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a44d42-a110-4f55-ad27-2be4ccb41a16?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.55.2","to_inclusive":false,"patched_in":"2.9.55.2"}],"published":"2016-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89a6aab0-e85b-4604-b911-03a01c5cca13","source":"wordfence","cve":"CVE-2019-19112","title":"wpForo Forum <= 1.6.5 - Cross-Site Scripting via wpf-dw-td-value class","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a6aab0-e85b-4604-b911-03a01c5cca13?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2020-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89a7a717-dac3-490e-89dd-268be8eb7bf5","source":"wordfence","cve":"CVE-2025-14997","title":"BuddyPress Xprofile Custom Field Types <= 1.2.8 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a7a717-dac3-490e-89dd-268be8eb7bf5?source=api-prod","affected":[{"type":"plugin","slug":"bp-xprofile-custom-field-types","name":"BuddyPress Xprofile Custom Field Types","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-01-05T16:27:40Z","updated":"2026-03-24T08:35:40Z"},{"id":"wordfence:89a98053-33c7-4e75-87a1-0f483a990641","source":"wordfence","cve":"CVE-2023-0710","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a98053-33c7-4e75-87a1-0f483a990641?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89a9d925-6ca3-481f-ba7d-ea9869d51b52","source":"wordfence","cve":"CVE-2023-0224","title":"GiveWP <= 2.23.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a9d925-6ca3-481f-ba7d-ea9869d51b52?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.23.2","to_inclusive":true,"patched_in":"2.24"}],"published":"2023-01-19T00:00:00Z","updated":"2024-02-06T16:08:12Z"},{"id":"wordfence:89acb513-60aa-49ad-8050-9dff1ce71cc5","source":"wordfence","cve":"CVE-2025-26880","title":"SKT Skill Bar <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89acb513-60aa-49ad-8050-9dff1ce71cc5?source=api-prod","affected":[{"type":"plugin","slug":"skt-skill-bar","name":"SKT Skill Bar","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:46:43Z"},{"id":"wordfence:89afc78b-efd5-445e-884f-2345e08df705","source":"wordfence","cve":"CVE-2024-12821","title":"Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89afc78b-efd5-445e-884f-2345e08df705?source=api-prod","affected":[{"type":"plugin","slug":"userpro-mediamanager","name":"Media Manager for UserPro","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:49:17Z","updated":"2025-01-30T13:42:03Z"},{"id":"wordfence:89b12c36-e115-4f67-86e6-647dfc9fd25b","source":"wordfence","cve":"CVE-2025-4189","title":"Audio Comments Plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89b12c36-e115-4f67-86e6-647dfc9fd25b?source=api-prod","affected":[{"type":"plugin","slug":"audio-comments","name":"Audio Comments Plugin","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T03:24:50Z"},{"id":"wordfence:89b528f7-42a7-4b6a-b3f7-3176b91e0dfe","source":"wordfence","cve":"CVE-2022-3610","title":"Jeeng Push Notifications <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89b528f7-42a7-4b6a-b3f7-3176b91e0dfe?source=api-prod","affected":[{"type":"plugin","slug":"jeeng-push-notifications","name":"Jeeng Push Notifications","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89bc17fd-14e8-4210-8cf7-a043d1ea9c22","source":"wordfence","cve":"CVE-2023-23817","title":"Simple PDF Viewer <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via googlepdf Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89bc17fd-14e8-4210-8cf7-a043d1ea9c22?source=api-prod","affected":[{"type":"plugin","slug":"simple-pdf-viewer","name":"Simple PDF Viewer","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89bd0f8f-45c7-4b54-bc89-e1ba4f867eb9","source":"wordfence","cve":"CVE-2026-66679","title":"Appointment Hour Booking \u2013 Booking Calendar <= 1.5.94 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89bd0f8f-45c7-4b54-bc89-e1ba4f867eb9?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.94","to_inclusive":true,"patched_in":"1.5.95"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-16T17:31:31Z"},{"id":"wordfence:89bd70b2-0b5f-4edb-890b-d291bdb8a851","source":"wordfence","cve":"CVE-2024-10034","title":"Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89bd70b2-0b5f-4edb-890b-d291bdb8a851?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.2.4.2","to_inclusive":true,"patched_in":"3.2.4.3"}],"published":"2024-11-21T17:21:58Z","updated":"2024-11-22T05:33:42Z"},{"id":"wordfence:89bdd732-a9ee-4ab8-a70e-195b92142fe1","source":"wordfence","cve":"CVE-2022-4578","title":"Video Conferencing with Zoom <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89bdd732-a9ee-4ab8-a70e-195b92142fe1?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89c199e0-c8ec-4867-b9b5-412a5603c46c","source":"wordfence","cve":"CVE-2026-32332","title":"Easy Form <= 2.7.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89c199e0-c8ec-4867-b9b5-412a5603c46c?source=api-prod","affected":[{"type":"plugin","slug":"easy-form","name":"Easy Form","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T21:00:21Z"},{"id":"wordfence:89c32230-99e4-4d08-8afb-8f6f8bf94eab","source":"wordfence","cve":"CVE-2015-9302","title":"Simple Fields <= 1.4.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89c32230-99e4-4d08-8afb-8f6f8bf94eab?source=api-prod","affected":[{"type":"plugin","slug":"simple-fields","name":"Simple Fields","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":false,"patched_in":"1.4.11"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89c3aae0-68f4-471e-8687-e87e71fa7a82","source":"wordfence","cve":"CVE-2025-32546","title":"All push notification for WP <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89c3aae0-68f4-471e-8687-e87e71fa7a82?source=api-prod","affected":[{"type":"plugin","slug":"all-push-notification","name":"All push notification for WP","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T19:32:00Z"},{"id":"wordfence:89c588e4-2f42-4ec5-8d05-3b45b23066c5","source":"wordfence","cve":"CVE-2012-2572","title":"ThreeWP Email Reflector < 1.16 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89c588e4-2f42-4ec5-8d05-3b45b23066c5?source=api-prod","affected":[{"type":"plugin","slug":"threewp-email-reflector","name":"ThreeWP Email Reflector","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":false,"patched_in":"1.16"}],"published":"2012-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89ca9214-145e-43c6-a642-7c371f635332","source":"wordfence","cve":"CVE-2024-24802","title":"JTRT Responsive Tables <= 4.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ca9214-145e-43c6-a642-7c371f635332?source=api-prod","affected":[{"type":"plugin","slug":"jtrt-responsive-tables","name":"JTRT Responsive Tables","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T20:42:41Z"},{"id":"wordfence:89cb81c3-25d7-4a4e-beed-558ea8ce721d","source":"wordfence","cve":"CVE-2026-1808","title":"Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89cb81c3-25d7-4a4e-beed-558ea8ce721d?source=api-prod","affected":[{"type":"plugin","slug":"orange-confort-plus","name":"Orange Comfort+ accessibility toolbar for WordPress","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":"0.7.1"}],"published":"2026-02-05T18:31:50Z","updated":"2026-02-06T06:46:29Z"},{"id":"wordfence:89cbe41d-3765-4061-8ef6-b63556a5677c","source":"wordfence","cve":"CVE-2023-6633","title":"Site Notes <= 2.0.0 - Cross-Site Request Forgery to Admin Note Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89cbe41d-3765-4061-8ef6-b63556a5677c?source=api-prod","affected":[{"type":"plugin","slug":"site-notes","name":"Site Notes","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89ccfd33-042f-4d9e-a70e-dfbd4235efa6","source":"wordfence","cve":"CVE-2024-54432","title":"WP Flipkart Importer <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ccfd33-042f-4d9e-a70e-dfbd4235efa6?source=api-prod","affected":[{"type":"plugin","slug":"wp-flipkart-importer","name":"WP Flipkart Importer","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T13:57:15Z"},{"id":"wordfence:89cd5429-39a0-441f-ba69-dea111eae5ed","source":"wordfence","cve":"CVE-2025-12903","title":"Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89cd5429-39a0-441f-ba69-dea111eae5ed?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway","name":"Payment Plugins Braintree For WooCommerce","from":"*","from_inclusive":true,"to":"3.2.78","to_inclusive":true,"patched_in":"3.2.79"}],"published":"2025-11-11T20:05:21Z","updated":"2025-11-12T08:28:06Z"},{"id":"wordfence:89d1fa00-4757-4f86-bddb-a6a2dbcf9625","source":"wordfence","cve":"CVE-2025-14448","title":"WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89d1fa00-4757-4f86-bddb-a6a2dbcf9625?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4.3","to_inclusive":true,"patched_in":"3.5.4.4"}],"published":"2026-01-14T17:16:18Z","updated":"2026-01-15T05:24:21Z"},{"id":"wordfence:89d3a9da-2496-4f75-ad8f-65629f198fe5","source":"wordfence","cve":"CVE-2021-4404","title":"Event Espresso 4 Decaf <= 4.10.11 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89d3a9da-2496-4f75-ad8f-65629f198fe5?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-decaf","name":"Event Espresso \u2013 Event Registration & Ticketing Sales","from":"*","from_inclusive":true,"to":"4.10.11","to_inclusive":true,"patched_in":"4.10.12"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89d42a87-6adc-43e6-868f-b9b2c51ed8e0","source":"wordfence","cve":"CVE-2024-31923","title":"Feather Login Page <= 1.1.5 - Cross-Site Request Forgery via saveData()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89d42a87-6adc-43e6-868f-b9b2c51ed8e0?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:29:47Z"},{"id":"wordfence:89d6a232-fea0-4938-9241-ef3bc083816d","source":"wordfence","cve":"CVE-2026-66435","title":"WP Rollback \u2013 Rollback Plugins and Themes <= 3.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89d6a232-fea0-4938-9241-ef3bc083816d?source=api-prod","affected":[{"type":"plugin","slug":"wp-rollback","name":"WP Rollback \u2013 Rollback Plugins and Themes","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-10-08T13:26:19Z","updated":"2026-10-13T14:04:37Z"},{"id":"wordfence:89dab433-91e9-4500-ab40-f4b500e66983","source":"wordfence","cve":"CVE-2023-33996","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dab433-91e9-4500-ab40-f4b500e66983?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.10","to_inclusive":true,"patched_in":"6.11"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89dbc40a-d2a2-408f-a337-f9b7c14e0a04","source":"wordfence","cve":"CVE-2026-27437","title":"Tennis SportClub - Tennis Sports Events WordPress Theme <= 1.2.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dbc40a-d2a2-408f-a337-f9b7c14e0a04?source=api-prod","affected":[{"type":"theme","slug":"tennis-sportclub","name":"Tennis SportClub - Tennis Sports Events WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:05:01Z"},{"id":"wordfence:89dbf14f-1cc8-4a66-b3d3-3568cba9a0aa","source":"wordfence","cve":"CVE-2023-47830","title":"Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dbf14f-1cc8-4a66-b3d3-3568cba9a0aa?source=api-prod","affected":[{"type":"plugin","slug":"cf7-live-preview","name":"Live Preview for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89dc1740-0050-4793-847b-9aa44cc12822","source":"wordfence","cve":"CVE-2026-59520","title":"CrawlWP SEO \u2013 Instant Search Engine Indexing & SEO Performance Monitor <= 3.0.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dc1740-0050-4793-847b-9aa44cc12822?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-index-now","name":"CrawlWP SEO \u2013 Complete WordPress SEO Plugin with AI, Indexing & Search Performance","from":"*","from_inclusive":true,"to":"3.0.16","to_inclusive":true,"patched_in":"3.0.17"}],"published":"2026-07-05T00:00:00Z","updated":"2026-07-07T19:49:14Z"},{"id":"wordfence:89dd21b1-35f4-45f1-a9b0-f64434220a94","source":"wordfence","cve":"CVE-2026-27424","title":"Image Photo Gallery Final Tiles Grid <= 3.6.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dd21b1-35f4-45f1-a9b0-f64434220a94?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.11","to_inclusive":true,"patched_in":"3.6.12"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:32:20Z"},{"id":"wordfence:89ddede9-3170-48bb-aae5-14f915330f67","source":"wordfence","cve":"CVE-2024-13380","title":"Alex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ddede9-3170-48bb-aae5-14f915330f67?source=api-prod","affected":[{"type":"plugin","slug":"alex-reservations","name":"Alex Reservations \u2013 Restaurant Reservations, Tables & White-Label Booking System","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T12:22:27Z"},{"id":"wordfence:89de168e-1bce-4e11-a765-afc1d7dce8fe","source":"wordfence","cve":"CVE-2026-7753","title":"Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89de168e-1bce-4e11-a765-afc1d7dce8fe?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.6.17","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-08-04T17:05:53Z","updated":"2026-08-05T05:27:37Z"},{"id":"wordfence:89de2cb3-c089-49eb-8bb2-cfa11d66fa18","source":"wordfence","cve":"CVE-2025-46451","title":"Floating Social Bar <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89de2cb3-c089-49eb-8bb2-cfa11d66fa18?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-bar","name":"Floating Social Bar","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-07-29T06:39:25Z"},{"id":"wordfence:89dec659-5427-46bb-8250-1e4a132611df","source":"wordfence","cve":"CVE-2024-29931","title":"WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89dec659-5427-46bb-8250-1e4a132611df?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.29","to_inclusive":true,"patched_in":"9.0.30"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:23:07Z"},{"id":"wordfence:89df3005-0967-474f-8a4e-3b23273dd1a2","source":"wordfence","cve":"CVE-2026-1251","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89df3005-0967-474f-8a4e-3b23273dd1a2?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-31T06:39:24Z"},{"id":"wordfence:89e053ac-6ef9-4f5a-8aab-bdca40d68ab4","source":"wordfence","cve":"CVE-2026-4920","title":"Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e053ac-6ef9-4f5a-8aab-bdca40d68ab4?source=api-prod","affected":[{"type":"plugin","slug":"nextdate","name":"Next Date","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:07:24Z","updated":"2026-05-12T07:48:24Z"},{"id":"wordfence:89e0babf-780c-467b-b1df-62b5b9403c8f","source":"wordfence","cve":"CVE-2026-2585","title":"Brizy \u2013 Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e0babf-780c-467b-b1df-62b5b9403c8f?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.14","to_inclusive":true,"patched_in":"2.8.15"}],"published":"2026-09-17T11:24:02Z","updated":"2026-09-17T23:27:11Z"},{"id":"wordfence:89e2962a-b884-4577-a29b-92087e10ce58","source":"wordfence","cve":"CVE-2025-68898","title":"Synergy Project Manager <= 1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e2962a-b884-4577-a29b-92087e10ce58?source=api-prod","affected":[{"type":"plugin","slug":"synergy-project-manager","name":"Synergy Project Manager","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T15:55:05Z"},{"id":"wordfence:89e3cef3-c1aa-4df7-a9f9-1ca5837643e1","source":"wordfence","cve":"CVE-2024-12848","title":"SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e3cef3-c1aa-4df7-a9f9-1ca5837643e1?source=api-prod","affected":[{"type":"plugin","slug":"skt-builder","name":"SKT Page Builder","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-09T11:11:02Z"},{"id":"wordfence:89e3fd97-1d37-4e6f-b340-bb80373c6738","source":"wordfence","cve":"CVE-2025-26877","title":"Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e3fd97-1d37-4e6f-b340-bb80373c6738?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.30","to_inclusive":true,"patched_in":"3.2.31"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T18:08:46Z"},{"id":"wordfence:89e9cc7b-7a43-4d08-8123-5acf0782dc26","source":"wordfence","cve":"CVE-2026-2811","title":"Ajaxify Comments <= 3.1 - Unauthenticated HTTP Header Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89e9cc7b-7a43-4d08-8123-5acf0782dc26?source=api-prod","affected":[{"type":"plugin","slug":"wp-ajaxify-comments","name":"Ajaxify Comments \u2013 Ajax and Lazy Loading Comments","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2026-02-27T00:00:00Z","updated":"2026-09-16T15:32:24Z"},{"id":"wordfence:89ea4709-f637-4932-9dbd-8b3fccab45a8","source":"wordfence","cve":"CVE-2022-2278","title":"Featured Image from URL (FIFU) <= 4.0.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ea4709-f637-4932-9dbd-8b3fccab45a8?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89eb2229-a507-4f7c-be31-58959d3eca62","source":"wordfence","cve":"CVE-2025-6067","title":"Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89eb2229-a507-4f7c-be31-58959d3eca62?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2025-09-05T13:45:16Z","updated":"2025-09-06T01:47:27Z"},{"id":"wordfence:89ed1f07-a230-4478-b6d4-7f74c9dd7656","source":"wordfence","cve":"CVE-2014-2995","title":"Twitget <= 3.3.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ed1f07-a230-4478-b6d4-7f74c9dd7656?source=api-prod","affected":[{"type":"plugin","slug":"twitget","name":"Twitget","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2014-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89ee5d27-9123-4fd2-94f8-4395db5663ec","source":"wordfence","cve":"CVE-2023-51507","title":"Quiz And Survey Master <= 8.1.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ee5d27-9123-4fd2-94f8-4395db5663ec?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.16","to_inclusive":true,"patched_in":"8.1.17"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89ef2ee1-2bec-459f-9a85-c260cbb129ca","source":"wordfence","cve":"CVE-2026-17086","title":"ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89ef2ee1-2bec-459f-9a85-c260cbb129ca?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2026-09-17T14:29:30Z","updated":"2026-09-18T03:38:13Z"},{"id":"wordfence:89f4d353-bb6a-4520-bb3e-a0121fb4bf9b","source":"wordfence","cve":"CVE-2025-6988","title":"Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f4d353-bb6a-4520-bb3e-a0121fb4bf9b?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.23.0","to_inclusive":true,"patched_in":"4.24.0"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T07:30:05Z"},{"id":"wordfence:89f57714-7643-4839-9932-7a2918dc7127","source":"wordfence","cve":"CVE-2024-43919","title":"YARPP <= 5.30.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f57714-7643-4839-9932-7a2918dc7127?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.10","to_inclusive":true,"patched_in":"5.30.11"}],"published":"2024-08-26T00:00:00Z","updated":"2024-11-12T13:14:38Z"},{"id":"wordfence:89f6d261-b815-49c6-b4d1-b0f3ff9904d6","source":"wordfence","cve":"CVE-2024-56068","title":"WP SuperBackup <= 2.3.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6d261-b815-49c6-b4d1-b0f3ff9904d6?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:08:04Z"},{"id":"wordfence:89f6f1cd-91ab-416b-b76b-162b3b29d752","source":"wordfence","cve":"CVE-2022-47151","title":"JS Help Desk <= 2.7.1 - Unauthenticated SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6f1cd-91ab-416b-b76b-162b3b29d752?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89f6fa65-ef71-491e-8959-591b58d1444c","source":"wordfence","cve":"CVE-2026-15647","title":"Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f6fa65-ef71-491e-8959-591b58d1444c?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.8.1"}],"published":"2026-07-22T20:21:24Z","updated":"2026-07-23T08:34:40Z"},{"id":"wordfence:89f7c287-c2b5-465b-97b4-414ee87df8a8","source":"wordfence","cve":"CVE-2025-39451","title":"JetBlocks For Elementor <= 1.3.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f7c287-c2b5-465b-97b4-414ee87df8a8?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":true,"patched_in":"1.3.16.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:07:58Z"},{"id":"wordfence:89f7c342-1526-4702-88ac-ce37d158d9b2","source":"wordfence","cve":"CVE-2025-14072","title":"Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89f7c342-1526-4702-88ac-ce37d158d9b2?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2025-12-12T00:00:00Z","updated":"2026-01-21T16:53:08Z"},{"id":"wordfence:89fc8407-3d1f-4b1b-9b4c-13c0da928231","source":"wordfence","cve":"CVE-2022-47434","title":"PB SEO Friendly Images <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89fc8407-3d1f-4b1b-9b4c-13c0da928231?source=api-prod","affected":[{"type":"plugin","slug":"pb-seo-friendly-images","name":"PB SEO Friendly Images","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:89fe030b-253f-4fbc-b593-fb92fb7eb323","source":"wordfence","cve":"CVE-2026-14293","title":"Autopay / Blue Media for WooCommerce <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89fe030b-253f-4fbc-b593-fb92fb7eb323?source=api-prod","affected":[{"type":"plugin","slug":"platnosci-online-blue-media","name":"Autopay","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-15T21:04:36Z"},{"id":"wordfence:8a003bbc-2a75-4629-ab2e-8f0cbdaf4d45","source":"wordfence","cve":"CVE-2026-86809","title":"\u0627\u0644\u0645\u0646\u062a\u0648\u0631 \u0641\u0627\u0631\u0633\u06cc 2.7.10 - 2.8.1 - Payment Bypass to Unauthenticated Unauthorized Order Completion","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a003bbc-2a75-4629-ab2e-8f0cbdaf4d45?source=api-prod","affected":[{"type":"plugin","slug":"persian-elementor","name":"\u0627\u0644\u0645\u0646\u062a\u0648\u0631 \u0641\u0627\u0631\u0633\u06cc","from":"2.7.10","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:21:26Z"},{"id":"wordfence:8a00ece0-6644-4535-86aa-d0802d94a1a7","source":"wordfence","cve":"CVE-2025-5058","title":"eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image()","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a00ece0-6644-4535-86aa-d0802d94a1a7?source=api-prod","affected":[{"type":"plugin","slug":"store-manager-connector","name":"eMagicOne Store Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-05-23T14:33:44Z","updated":"2025-11-05T21:27:32Z"},{"id":"wordfence:8a017198-daf1-4779-a101-dc539e263e50","source":"wordfence","cve":"CVE-2026-91152","title":"Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a017198-daf1-4779-a101-dc539e263e50?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-10-28T20:44:14Z","updated":"2026-10-29T09:25:34Z"},{"id":"wordfence:8a01ed06-4b48-4958-9990-469bf43d3e00","source":"wordfence","cve":"CVE-2024-32531","title":"GuCherry Blog <= 1.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a01ed06-4b48-4958-9990-469bf43d3e00?source=api-prod","affected":[{"type":"theme","slug":"gucherry-blog","name":"GuCherry Blog","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:15:20Z"},{"id":"wordfence:8a02f5b1-5f0a-45f7-925c-1837a47dd051","source":"wordfence","cve":"CVE-2024-4077","title":"UDesign <= 4.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a02f5b1-5f0a-45f7-925c-1837a47dd051?source=api-prod","affected":[{"type":"theme","slug":"u-design","name":"uDesign - Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T13:44:17Z"},{"id":"wordfence:8a047313-fdbc-47fa-912a-a624033bbce1","source":"wordfence","cve":"CVE-2025-13513","title":"Clik stats <= 0.8 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a047313-fdbc-47fa-912a-a624033bbce1?source=api-prod","affected":[{"type":"plugin","slug":"clikstats","name":"Clik stats","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-03T17:02:06Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:8a052ca1-2c2c-4c8a-9213-5f01b0fa70dd","source":"wordfence","cve":"CVE-2020-35589","title":"Limit Login Attempts Reloaded <= 2.15.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a052ca1-2c2c-4c8a-9213-5f01b0fa70dd?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"2.15.2","to_inclusive":true,"patched_in":"2.17.4"}],"published":"2020-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a071801-be75-4cd8-8610-576a170a41a4","source":"wordfence","cve":"CVE-2025-47628","title":"QS Dark Mode <= 3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a071801-be75-4cd8-8610-576a170a41a4?source=api-prod","affected":[{"type":"plugin","slug":"qs-dark-mode","name":"QS Dark Mode Plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:08:10Z"},{"id":"wordfence:8a07d293-4c50-4be0-955f-b7c4a0eaef4b","source":"wordfence","cve":"CVE-2024-4233","title":"Multiple Plugins by tychesoftwares <= (Various Versions) - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a07d293-4c50-4be0-955f-b7c4a0eaef4b?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"},{"type":"plugin","slug":"arconix-faq","name":"Arconix FAQ","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-30T13:55:32Z"},{"id":"wordfence:8a089ebf-9c42-4e88-8e97-9a83ca4cd5f0","source":"wordfence","cve":"CVE-2025-31589","title":"Ethiopian Calendar <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a089ebf-9c42-4e88-8e97-9a83ca4cd5f0?source=api-prod","affected":[{"type":"plugin","slug":"ethiopian-calendar","name":"Ethiopian Calendar","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:21:58Z"},{"id":"wordfence:8a096e35-4480-4950-96ea-02a8751b8e98","source":"wordfence","cve":"CVE-2025-53201","title":"Jobmonster <= 4.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a096e35-4480-4950-96ea-02a8751b8e98?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:39:48Z"},{"id":"wordfence:8a0b961e-ccc3-4da0-b007-bbafa133a3a8","source":"wordfence","cve":"CVE-2024-13821","title":"WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a0b961e-ccc3-4da0-b007-bbafa133a3a8?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.10","to_inclusive":true,"patched_in":"10.10.1"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T07:35:39Z"},{"id":"wordfence:8a106ebb-f3ec-4995-9717-358b91d468b4","source":"wordfence","cve":"CVE-2026-65441","title":"GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a106ebb-f3ec-4995-9717-358b91d468b4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":true,"patched_in":"4.16.4"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:23:28Z"},{"id":"wordfence:8a1179bc-6f8d-4223-a80b-9834adc08d3b","source":"wordfence","cve":"CVE-2021-4227","title":"ark-commenteditor <= 2.15.6 - iframe Injection","severity":"high","cvss":7.2,"cwe":"CWE-1021","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a1179bc-6f8d-4223-a80b-9834adc08d3b?source=api-prod","affected":[{"type":"plugin","slug":"ark-wysiwyg-comment-editor","name":"ark-commenteditor","from":"*","from_inclusive":true,"to":"2.15.6","to_inclusive":true,"patched_in":""}],"published":"2021-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a11c169-a232-49a9-80be-40d45d0c6dc0","source":"wordfence","cve":"CVE-2014-5324","title":"Frontend File Manager Plugin < 3.6 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a11c169-a232-49a9-80be-40d45d0c6dc0?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":false,"patched_in":"3.6"}],"published":"2014-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a11e702-34d2-49ee-8762-cc3614a7950a","source":"wordfence","cve":"CVE-2024-13445","title":"Elementor Website Builder \u2013 More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a11e702-34d2-49ee-8762-cc3614a7950a?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.27.4","to_inclusive":true,"patched_in":"3.27.5"}],"published":"2025-02-19T15:50:22Z","updated":"2025-02-20T04:22:26Z"},{"id":"wordfence:8a143d0f-0f51-4105-b7b4-d8337432c890","source":"wordfence","cve":"CVE-2024-12770","title":"WP ULike <= 4.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a143d0f-0f51-4105-b7b4-d8337432c890?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2025-01-23T00:00:00Z","updated":"2025-02-21T19:45:40Z"},{"id":"wordfence:8a15ab92-2142-43cb-9600-f4cfa164de31","source":"wordfence","cve":"CVE-2023-5003","title":"Active Directory Integration / LDAP Integration <= 4.1.9 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-538","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a15ab92-2142-43cb-9600-f4cfa164de31?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.1.10"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a17cd6e-8c9c-4427-ac59-2bd8624be492","source":"wordfence","cve":"CVE-2026-93883","title":"Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a17cd6e-8c9c-4427-ac59-2bd8624be492?source=api-prod","affected":[{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-10-09T14:24:14Z","updated":"2026-10-10T02:26:33Z"},{"id":"wordfence:8a19b102-e097-46b3-9804-71edb91b3daa","source":"wordfence","cve":"CVE-2023-2225","title":"SEO ALert <= 1.5.9 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a19b102-e097-46b3-9804-71edb91b3daa?source=api-prod","affected":[{"type":"plugin","slug":"seo-alert","name":"SEO ALert","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a1d90f6-40fc-40b5-a46c-9ba9ac2fc1b5","source":"wordfence","cve":"CVE-2020-11548","title":"Search Meter <= 2.13.2 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a1d90f6-40fc-40b5-a46c-9ba9ac2fc1b5?source=api-prod","affected":[{"type":"plugin","slug":"search-meter","name":"Search Meter","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":false,"patched_in":"2.13.3"}],"published":"2020-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a20f582-10e7-4530-8d3c-9bc1e844badd","source":"wordfence","cve":"CVE-2022-4448","title":"GiveWP <= 2.23.2  - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a20f582-10e7-4530-8d3c-9bc1e844badd?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.23.2","to_inclusive":true,"patched_in":"2.24"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a2186c9-fa27-4d7d-be41-c82711c49334","source":"wordfence","cve":"","title":"WP User Frontend < 2.3.11 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a2186c9-fa27-4d7d-be41-c82711c49334?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":false,"patched_in":"2.3.11"}],"published":"2016-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a22873f-6f09-4183-92c5-a84e0d378920","source":"wordfence","cve":"CVE-2023-49176","title":"WP Pocket URLs <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a22873f-6f09-4183-92c5-a84e0d378920?source=api-prod","affected":[{"type":"plugin","slug":"wp-pocket-urls","name":"WP Pocket URLs","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2023-11-29T00:00:00Z","updated":"2024-09-03T12:53:07Z"},{"id":"wordfence:8a233c61-5ce3-4ec8-8fd9-334cc572458c","source":"wordfence","cve":"CVE-2026-66563","title":"Windsor - Apartment Complex Single Property WordPress Theme <= 2.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a233c61-5ce3-4ec8-8fd9-334cc572458c?source=api-prod","affected":[{"type":"theme","slug":"windsor","name":"Windsor - Apartment Complex Single Property WordPress Theme","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:53:51Z","updated":"2026-10-13T14:05:16Z"},{"id":"wordfence:8a23622a-f217-4e66-b3aa-1a6a701ed925","source":"wordfence","cve":"CVE-2024-44048","title":"Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a23622a-f217-4e66-b3aa-1a6a701ed925?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2024-09-16T00:00:00Z","updated":"2024-12-10T17:43:04Z"},{"id":"wordfence:8a24e409-8aa9-4d18-b428-b202407fdbfe","source":"wordfence","cve":"CVE-2024-54291","title":"PluginPass <= 0.9.10 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a24e409-8aa9-4d18-b428-b202407fdbfe?source=api-prod","affected":[{"type":"plugin","slug":"pluginpass-pro-plugintheme-licensing","name":"PluginPass \u2013 WordPress PRO Plugin/Theme Licensing (Public Alpha)","from":"*","from_inclusive":true,"to":"0.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T00:00:00Z","updated":"2025-04-22T20:58:57Z"},{"id":"wordfence:8a253b04-bbe9-42d1-b6d9-1a62ad37855c","source":"wordfence","cve":"","title":"WassUp Real Time Analytics <= 1.9.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a253b04-bbe9-42d1-b6d9-1a62ad37855c?source=api-prod","affected":[{"type":"plugin","slug":"wassup","name":"WassUp Real Time Analytics","from":"*","from_inclusive":true,"to":"1.9.4.4","to_inclusive":true,"patched_in":"1.9.4.5"}],"published":"2020-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a2542e9-d50d-4254-8163-205240a5efdb","source":"wordfence","cve":"CVE-2025-49969","title":"Zara 4 Image Compression <= 1.2.17.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a2542e9-d50d-4254-8163-205240a5efdb?source=api-prod","affected":[{"type":"plugin","slug":"zara-4","name":"Zara 4 Image Compression","from":"*","from_inclusive":true,"to":"1.2.17.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:26:09Z"},{"id":"wordfence:8a27253d-bfc1-40b5-9da4-d16cc403ad41","source":"wordfence","cve":"CVE-2023-33214","title":"Taggbox <= 3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a27253d-bfc1-40b5-9da4-d16cc403ad41?source=api-prod","affected":[{"type":"plugin","slug":"taggbox-widget","name":"Taggbox: Social Media Feed Widget","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-10-12T00:00:00Z","updated":"2026-02-26T14:51:46Z"},{"id":"wordfence:8a276a3e-12c3-4af7-9eb8-a25d20563de7","source":"wordfence","cve":"CVE-2026-1372","title":"Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a276a3e-12c3-4af7-9eb8-a25d20563de7?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-20T19:30:42Z","updated":"2026-09-09T16:37:23Z"},{"id":"wordfence:8a297784-96cd-4135-a8f1-e50f3a0d71bd","source":"wordfence","cve":"CVE-2024-5641","title":"One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a297784-96cd-4135-a8f1-e50f3a0d71bd?source=api-prod","affected":[{"type":"plugin","slug":"one-click-order-reorder","name":"One Click Order Re-Order","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2024-07-03T00:00:00Z","updated":"2024-07-04T07:32:30Z"},{"id":"wordfence:8a2cd4d3-12d3-43bd-bde1-927b793f04a8","source":"wordfence","cve":"CVE-2024-43946","title":"SKT Blocks \u2013 Gutenberg based Page Builder <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a2cd4d3-12d3-43bd-bde1-927b793f04a8?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-08-26T00:00:00Z","updated":"2024-10-16T12:51:47Z"},{"id":"wordfence:8a2df1f5-3843-4745-b251-ad40a9272b7b","source":"wordfence","cve":"CVE-2024-52440","title":"Xpresslane Fast Checkout <= 1.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a2df1f5-3843-4745-b251-ad40a9272b7b?source=api-prod","affected":[{"type":"plugin","slug":"xpresslane-integration-for-woocommerce","name":"Xpresslane Fast Checkout","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:05:20Z"},{"id":"wordfence:8a303875-ad8c-40ed-a3ab-4a63080c9845","source":"wordfence","cve":"CVE-2021-24877","title":"MainWP Child <= 4.1.7.1 - SQL Injection via orderby,  order Parameters","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a303875-ad8c-40ed-a3ab-4a63080c9845?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":false,"patched_in":"4.1.8"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a3138b3-9a20-43f6-9697-4c0e524b4964","source":"wordfence","cve":"CVE-2026-15384","title":"Manual Image Crop < 1.15 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3138b3-9a20-43f6-9697-4c0e524b4964?source=api-prod","affected":[{"type":"plugin","slug":"manual-image-crop","name":"Manual Image Crop","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":false,"patched_in":"1.15"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:06:04Z"},{"id":"wordfence:8a345197-d8ba-47ef-a88c-c9e45ddc0319","source":"wordfence","cve":"","title":"Melhor Envio <= 2.11.19 - Cross-Site Request Forgery and Authenticated Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a345197-d8ba-47ef-a88c-c9e45ddc0319?source=api-prod","affected":[{"type":"plugin","slug":"melhor-envio-cotacao","name":"Melhor Envio","from":"*","from_inclusive":true,"to":"2.11.19","to_inclusive":true,"patched_in":"2.11.20"}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a35f0bb-691f-4acf-a30d-4ddabe3b919c","source":"wordfence","cve":"CVE-2024-11777","title":"Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a35f0bb-691f-4acf-a30d-4ddabe3b919c?source=api-prod","affected":[{"type":"plugin","slug":"sell-media","name":"Sell Media","from":"*","from_inclusive":true,"to":"2.5.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:06:00Z","updated":"2025-01-07T03:21:57Z"},{"id":"wordfence:8a36b98b-7197-434e-88ac-6fcfa34d6abb","source":"wordfence","cve":"CVE-2023-47522","title":"Photo Feed <= 2.2.1 - Reflected Cross-Site Scripting via pf-gid","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a36b98b-7197-434e-88ac-6fcfa34d6abb?source=api-prod","affected":[{"type":"plugin","slug":"photo-feed","name":"Photo Feed","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a377ac8-7ef2-4450-9987-4d5c66378023","source":"wordfence","cve":"CVE-2015-9497","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads < 1.5.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a377ac8-7ef2-4450-9987-4d5c66378023?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2015-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a390a29-c8f4-49d5-98d1-8b63b3f42d5f","source":"wordfence","cve":"CVE-2024-51877","title":"SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a390a29-c8f4-49d5-98d1-8b63b3f42d5f?source=api-prod","affected":[{"type":"plugin","slug":"sv-forms","name":"SV Forms","from":"*","from_inclusive":true,"to":"2.0.05","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:10:40Z"},{"id":"wordfence:8a3a1769-fda2-43ca-b201-35eaeda77c6d","source":"wordfence","cve":"CVE-2026-39572","title":"Bus Ticket Booking with Seat Reservation < 5.6.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3a1769-fda2-43ca-b201-35eaeda77c6d?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":false,"patched_in":"5.6.5"}],"published":"2026-03-22T00:00:00Z","updated":"2026-05-05T15:15:58Z"},{"id":"wordfence:8a3da2af-2273-44ff-addd-1ac8a75e1c3d","source":"wordfence","cve":"","title":"All in One Social Lite <= 1.0 - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3da2af-2273-44ff-addd-1ac8a75e1c3d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-social-lite","name":"All in One Social Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a3e3d91-5ce5-4db1-856e-c1d12471f9ed","source":"wordfence","cve":"CVE-2025-7668","title":"Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3e3d91-5ce5-4db1-856e-c1d12471f9ed?source=api-prod","affected":[{"type":"plugin","slug":"linux-promotional-plugin","name":"Linux Promotional Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:48:12Z","updated":"2025-08-16T03:38:51Z"},{"id":"wordfence:8a3f0895-02e4-4661-8741-cd1a144dbf8f","source":"wordfence","cve":"CVE-2026-66618","title":"WP Maps \u2013 Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a3f0895-02e4-4661-8741-cd1a144dbf8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-09-17T11:46:00Z","updated":"2026-09-22T18:47:06Z"},{"id":"wordfence:8a410d51-f926-4b6a-adab-91e9fa97a4b9","source":"wordfence","cve":"CVE-2025-27331","title":"WooCommerce Display Products by Tags <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a410d51-f926-4b6a-adab-91e9fa97a4b9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-display-products-by-tags","name":"WooCommerce Display Products by Tags","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:17:35Z"},{"id":"wordfence:8a41f96d-216f-4e5a-a28d-665b052666fb","source":"wordfence","cve":"CVE-2023-29427","title":"Amelia <= 1.0.75 - Unauthenticated Reflected Cross-Site Scripting via 'code'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a41f96d-216f-4e5a-a28d-665b052666fb?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.75","to_inclusive":true,"patched_in":"1.0.76"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a420f63-2d8e-49c9-baaa-a7476a1b9128","source":"wordfence","cve":"CVE-2026-12512","title":"Quotes Llama <= 3.1.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a420f63-2d8e-49c9-baaa-a7476a1b9128?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-06-24T00:00:00Z","updated":"2026-07-29T22:23:26Z"},{"id":"wordfence:8a43db90-2a9e-4223-bf55-fef1a6bb2280","source":"wordfence","cve":"CVE-2021-24298","title":"Simple Giveaways <= 2.36.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a43db90-2a9e-4223-bf55-fef1a6bb2280?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.36.1","to_inclusive":false,"patched_in":"2.36.2"}],"published":"2021-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a43ec32-ed48-4590-8fef-c4f460ffcabc","source":"wordfence","cve":"CVE-2023-5905","title":"DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Missing Authorization to Blog Data Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a43ec32-ed48-4590-8fef-c4f460ffcabc?source=api-prod","affected":[{"type":"plugin","slug":"demomentsomtres-wp-export","name":"DeMomentSomTres WordPress Export Posts With Images","from":"*","from_inclusive":true,"to":"20220825","to_inclusive":true,"patched_in":""}],"published":"2023-12-21T00:00:00Z","updated":"2024-02-06T17:54:49Z"},{"id":"wordfence:8a474b6a-9fde-4577-af84-d7a6c060ef56","source":"wordfence","cve":"CVE-2025-58212","title":"Epeken All Kurir <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a474b6a-9fde-4577-af84-d7a6c060ef56?source=api-prod","affected":[{"type":"plugin","slug":"epeken-all-kurir","name":"Epeken All Kurir for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:08:08Z"},{"id":"wordfence:8a48f82a-761b-4b7a-a51e-0f9c780e0306","source":"wordfence","cve":"","title":"IFrame Admin Pages <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a48f82a-761b-4b7a-a51e-0f9c780e0306?source=api-prod","affected":[{"type":"plugin","slug":"iframe-admin-pages","name":"IFrame Admin Pages","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2012-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a4978c1-087f-4784-9691-91ca5044f60a","source":"wordfence","cve":"CVE-2024-13646","title":"Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4978c1-087f-4784-9691-91ca5044f60a?source=api-prod","affected":[{"type":"plugin","slug":"single-user-chat","name":"Single-user-chat","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:45:01Z","updated":"2025-01-30T13:42:03Z"},{"id":"wordfence:8a4ae629-51c8-4acc-bf95-fb0282e88383","source":"wordfence","cve":"CVE-2014-9175","title":"wpDataTables (Premium) <= 1.5.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4ae629-51c8-4acc-bf95-fb0282e88383?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2014-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a4b01a3-0479-48f1-b5d8-bc49266a43ca","source":"wordfence","cve":"CVE-2026-73184","title":"Global Gallery - WordPress Responsive Gallery <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4b01a3-0479-48f1-b5d8-bc49266a43ca?source=api-prod","affected":[{"type":"plugin","slug":"global-gallery","name":"Global Gallery - WordPress Responsive Gallery","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:14:37Z"},{"id":"wordfence:8a4ee97c-63cd-4a5e-a112-6d4c4c627a57","source":"wordfence","cve":"CVE-2023-1080","title":"GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4ee97c-63cd-4a5e-a112-6d4c4c627a57?source=api-prod","affected":[{"type":"plugin","slug":"gn-publisher","name":"GN Publisher: Google News Compatible RSS Feeds","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a52bf70-667b-400f-8912-75fae20a3f5b","source":"wordfence","cve":"CVE-2023-51471","title":"Checkout Mestres WP <= 7.1.9.6 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a52bf70-667b-400f-8912-75fae20a3f5b?source=api-prod","affected":[{"type":"plugin","slug":"checkout-mestres-wp","name":"Checkout Mestres do WP for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.9.6","to_inclusive":true,"patched_in":"7.1.9.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-02T00:09:15Z"},{"id":"wordfence:8a530a55-44d7-4f78-9cbd-513ef290908a","source":"wordfence","cve":"CVE-2022-46855","title":"Responsive Pricing Table <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a530a55-44d7-4f78-9cbd-513ef290908a?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a539a4e-f4df-46c7-83c2-9f189f081405","source":"wordfence","cve":"CVE-2021-34661","title":"WP Fusion Lite <= 3.37.18 \u2013 Cross-Site Request Forgery to Data Deletion","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a539a4e-f4df-46c7-83c2-9f189f081405?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"*","from_inclusive":true,"to":"3.37.18","to_inclusive":true,"patched_in":"3.37.30"}],"published":"2021-08-06T17:51:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a56c38c-93ba-4e22-92b4-72d79ba8cca4","source":"wordfence","cve":"","title":"WP Database Error Manager <= 2.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a56c38c-93ba-4e22-92b4-72d79ba8cca4?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-error-manager","name":"WP DB Error Manager","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2020-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a5bcf8f-9aa0-4a78-b3a8-21571700ea8b","source":"wordfence","cve":"","title":"Spam Free WordPress <= 1.9.3 - Full Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a5bcf8f-9aa0-4a78-b3a8-21571700ea8b?source=api-prod","affected":[{"type":"plugin","slug":"spam-free-wordpress","name":"Spam Free WordPress","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"2.0"}],"published":"2013-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a5bf903-9da0-46fd-8134-3abe8e97e3b4","source":"wordfence","cve":"CVE-2021-24315","title":"GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a5bf903-9da0-46fd-8134-3abe8e97e3b4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":false,"patched_in":"2.10.4"}],"published":"2021-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a5d32fc-41cd-4477-af2d-4a9709b05e72","source":"wordfence","cve":"CVE-2026-25383","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a5d32fc-41cd-4477-af2d-4a9709b05e72?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:45:26Z"},{"id":"wordfence:8a5fd702-201a-4e19-b5c8-9cb30330c14a","source":"wordfence","cve":"CVE-2026-114701","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a5fd702-201a-4e19-b5c8-9cb30330c14a?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-10-22T08:55:00Z","updated":"2026-10-28T21:21:04Z"},{"id":"wordfence:8a613e56-54c0-4bf5-b87f-0e4e507c1337","source":"wordfence","cve":"","title":"FormBuilder < 1.08 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a613e56-54c0-4bf5-b87f-0e4e507c1337?source=api-prod","affected":[{"type":"plugin","slug":"formbuilder","name":"FormBuilder","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":false,"patched_in":"1.08"}],"published":"2016-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a631446-90b6-4326-9700-12ebbe1c7877","source":"wordfence","cve":"CVE-2024-51641","title":"Advanced PDF Generator <= 0.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a631446-90b6-4326-9700-12ebbe1c7877?source=api-prod","affected":[{"type":"plugin","slug":"advanced-pdf-generator","name":"Advanced PDF Generator","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:33:35Z"},{"id":"wordfence:8a63a9b3-c056-45f3-952c-9aee997d1d27","source":"wordfence","cve":"CVE-2025-11163","title":"SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a63a9b3-c056-45f3-952c-9aee997d1d27?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.14.3","to_inclusive":true,"patched_in":"3.14.4"}],"published":"2025-09-29T16:32:13Z","updated":"2025-09-30T05:28:54Z"},{"id":"wordfence:8a643fa1-afdb-4710-ba1c-3b226b4098bd","source":"wordfence","cve":"CVE-2024-33593","title":"Smart Forms <= 2.6.91 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a643fa1-afdb-4710-ba1c-3b226b4098bd?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.91","to_inclusive":true,"patched_in":"2.6.92"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:12:44Z"},{"id":"wordfence:8a64d68b-8a0d-451b-ae2e-3cc583b4ed5a","source":"wordfence","cve":"CVE-2026-25005","title":"Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a64d68b-8a0d-451b-ae2e-3cc583b4ed5a?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.5","to_inclusive":true,"patched_in":"23.6"}],"published":"2026-01-16T00:00:00Z","updated":"2026-05-04T15:07:55Z"},{"id":"wordfence:8a660750-1dd2-4e6b-ba74-0a487829a3a1","source":"wordfence","cve":"CVE-2026-94075","title":"Newsletters <= 4.18.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a660750-1dd2-4e6b-ba74-0a487829a3a1?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.1","to_inclusive":true,"patched_in":"4.18.2"}],"published":"2026-10-22T07:24:22Z","updated":"2026-10-28T01:27:53Z"},{"id":"wordfence:8a6784cc-f673-4783-bea5-6a57c4c00ca4","source":"wordfence","cve":"CVE-2025-48171","title":"Cena Store <= 2.11.26 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a6784cc-f673-4783-bea5-6a57c4c00ca4?source=api-prod","affected":[{"type":"theme","slug":"cena","name":"cena","from":"*","from_inclusive":true,"to":"2.11.26","to_inclusive":true,"patched_in":"2.11.27"}],"published":"2025-07-23T00:00:00Z","updated":"2025-07-28T20:35:13Z"},{"id":"wordfence:8a68d036-9109-4bc0-9451-47fa2f9fa628","source":"wordfence","cve":"","title":"Paid Memberships Pro <= 2.5.0 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a68d036-9109-4bc0-9451-47fa2f9fa628?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2020-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a6ca886-de4c-4d45-a934-3e90378e7eb3","source":"wordfence","cve":"CVE-2024-1985","title":"Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a6ca886-de4c-4d45-a934-3e90378e7eb3?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-03-05T00:00:00Z","updated":"2024-03-13T15:27:03Z"},{"id":"wordfence:8a6f7952-cb64-4cff-aae7-0f03692cd95f","source":"wordfence","cve":"","title":"WP Courses LMS <= 3.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a6f7952-cb64-4cff-aae7-0f03692cd95f?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a711984-4eb2-4d96-b2b9-0ecd840679b1","source":"wordfence","cve":"CVE-2022-3400","title":"Bricks 1.0 - 1.5.3 - Missing Authorization to Arbitrary Content Creation/Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a711984-4eb2-4d96-b2b9-0ecd840679b1?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"1.0","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a73b4c1-f5a8-44fc-9136-368b88468711","source":"wordfence","cve":"CVE-2026-61955","title":"sync-basalam <= 3.0.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a73b4c1-f5a8-44fc-9136-368b88468711?source=api-prod","affected":[{"type":"plugin","slug":"persian-gravity-forms","name":"\u06af\u0631\u0648\u06cc\u062a\u06cc \u0641\u0631\u0645 \u0641\u0627\u0631\u0633\u06cc | Persian Gravity Forms","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-07-12T00:00:00Z","updated":"2026-07-14T19:16:54Z"},{"id":"wordfence:8a756804-4f39-46ce-8a0e-c5632f78686d","source":"wordfence","cve":"CVE-2025-24669","title":"SERPed.net <= 4.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a756804-4f39-46ce-8a0e-c5632f78686d?source=api-prod","affected":[{"type":"plugin","slug":"serped-net","name":"SERPed.net","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:09:06Z"},{"id":"wordfence:8a79fda3-44eb-41fd-b049-971b959daecf","source":"wordfence","cve":"CVE-2021-24388","title":"Vik Rent Car <= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a79fda3-44eb-41fd-b049-971b959daecf?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a7a6da3-d67c-42b3-8826-7e7fc9b938b4","source":"wordfence","cve":"CVE-2023-2279","title":"WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7a6da3-d67c-42b3-8826-7e7fc9b938b4?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a7b0d7a-c104-4008-b7de-e32905e3084f","source":"wordfence","cve":"CVE-2026-89305","title":"Paymendo Bank Transfer <= 1.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7b0d7a-c104-4008-b7de-e32905e3084f?source=api-prod","affected":[{"type":"plugin","slug":"paymendo-bank-transfer","name":"paymendo \u2013 Bank Transfer (Lite)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:23:49Z"},{"id":"wordfence:8a7b4d0b-9845-4d0b-b255-a311076f5ca7","source":"wordfence","cve":"CVE-2021-24705","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7b4d0b-9845-4d0b-b255-a311076f5ca7?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.4.2","to_inclusive":true,"patched_in":"8.4.3"}],"published":"2021-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a7bf74b-1dc7-4159-a874-29694fe5895e","source":"wordfence","cve":"CVE-2023-45634","title":"Copy Or Move Comments <= 5.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7bf74b-1dc7-4159-a874-29694fe5895e?source=api-prod","affected":[{"type":"plugin","slug":"copy-or-move-comments","name":"Copy or Move Comments","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a7ced3b-4cb5-463a-aa32-3ccdc886e1a6","source":"wordfence","cve":"CVE-2024-0421","title":"MapPress Maps for WordPress <= 2.88.15 - Insufficient Authorization to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7ced3b-4cb5-463a-aa32-3ccdc886e1a6?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.88.15","to_inclusive":true,"patched_in":"2.88.16"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-22T17:55:21Z"},{"id":"wordfence:8a7e2ad0-8427-450d-aa7e-abdbbc668247","source":"wordfence","cve":"CVE-2014-8801","title":"Paid Memberships Pro < 1.7.15 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7e2ad0-8427-450d-aa7e-abdbbc668247?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"1.7.15","to_inclusive":false,"patched_in":"1.7.15"}],"published":"2014-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a7eb2ed-67e8-4769-92b5-d56a124d4ba5","source":"wordfence","cve":"CVE-2026-32370","title":"Influencer <= 1.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7eb2ed-67e8-4769-92b5-d56a124d4ba5?source=api-prod","affected":[{"type":"theme","slug":"influencer","name":"Influencer","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:52:14Z"},{"id":"wordfence:8a7ff364-dd50-44d4-a8ff-f0cebe392bcf","source":"wordfence","cve":"CVE-2024-51784","title":"FriendStore for WooCommerce <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a7ff364-dd50-44d4-a8ff-f0cebe392bcf?source=api-prod","affected":[{"type":"plugin","slug":"friendstore-for-woocommerce","name":"FriendStore for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-11-04T00:00:00Z","updated":"2026-09-30T14:22:15Z"},{"id":"wordfence:8a832e2b-a900-4057-96fc-1bd6899e3950","source":"wordfence","cve":"CVE-2024-3063","title":"WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a832e2b-a900-4057-96fc-1bd6899e3950?source=api-prod","affected":[{"type":"plugin","slug":"wpb-elementor-addons","name":"WPB Addons for Elementor \u2013 News Ticker, Timeline, Team & More Widgets","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-05-29T15:16:26Z","updated":"2024-05-31T15:30:47Z"},{"id":"wordfence:8a84bcc2-23e0-4624-89a4-7bbb1b34c498","source":"wordfence","cve":"CVE-2025-14464","title":"PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a84bcc2-23e0-4624-89a4-7bbb1b34c498?source=api-prod","affected":[{"type":"plugin","slug":"pdf-resume-parser","name":"PDF Resume Parser","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:44:18Z","updated":"2026-01-14T05:28:10Z"},{"id":"wordfence:8a876469-72b1-478f-926b-57da237e3a95","source":"wordfence","cve":"CVE-2019-15839","title":"Sina Extension for Elementor < 2.2.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a876469-72b1-478f-926b-57da237e3a95?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2019-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a87bbfe-8cf5-4bba-90bc-902071b72bca","source":"wordfence","cve":"CVE-2015-20125","title":"Aspose.PDF Exporter < 2.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a87bbfe-8cf5-4bba-90bc-902071b72bca?source=api-prod","affected":[{"type":"plugin","slug":"aspose-pdf-exporter","name":"Aspose.PDF Exporter","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2015-03-29T00:00:00Z","updated":"2026-10-28T14:51:37Z"},{"id":"wordfence:8a8ac15a-9f9b-4bb8-81a4-1fdd11670a07","source":"wordfence","cve":"CVE-2023-32092","title":"Community by PeepSo <= 6.0.9.0 - Cross-Site Request Forgery to Field Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8ac15a-9f9b-4bb8-81a4-1fdd11670a07?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.0.9.0","to_inclusive":true,"patched_in":"6.1.0.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a8ae1b0-e9a0-4179-970b-dbcb0642547c","source":"wordfence","cve":"CVE-2025-0912","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8ae1b0-e9a0-4179-970b-dbcb0642547c?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.19.4","to_inclusive":true,"patched_in":"3.20.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-04T03:38:01Z"},{"id":"wordfence:8a8c626f-221c-4b81-a8af-7a836ec40475","source":"wordfence","cve":"CVE-2024-51831","title":"Persian Nested Show/Hide Text <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8c626f-221c-4b81-a8af-7a836ec40475?source=api-prod","affected":[{"type":"plugin","slug":"persian-nested-showhide-text","name":"Persian Nested Show/Hide Text","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:52:02Z"},{"id":"wordfence:8a8d1b0c-8699-4d52-b848-2826cb1ce8a3","source":"wordfence","cve":"CVE-2025-68577","title":"Virusdie <= 1.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8d1b0c-8699-4d52-b848-2826cb1ce8a3?source=api-prod","affected":[{"type":"plugin","slug":"virusdie","name":"Virusdie | One-click website security","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-06T14:35:09Z"},{"id":"wordfence:8a8d3c6a-728d-44d4-ae24-655dd77232a8","source":"wordfence","cve":"CVE-2024-37411","title":"Progress Planner <= 0.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8d3c6a-728d-44d4-ae24-655dd77232a8?source=api-prod","affected":[{"type":"plugin","slug":"progress-planner","name":"Progress Planner","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:52:32Z"},{"id":"wordfence:8a8edf0c-1e40-4aab-b704-b67e41214ce0","source":"wordfence","cve":"CVE-2014-5344","title":"MobiLoud \u2013 WordPress Mobile Apps \u2013 Convert your WordPress Website to Native Mobile Apps < 2.3.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8edf0c-1e40-4aab-b704-b67e41214ce0?source=api-prod","affected":[{"type":"plugin","slug":"mobiloud-mobile-app-plugin","name":"MobiLoud \u2013 WordPress Mobile Apps \u2013 Convert your WordPress Website to Native Mobile Apps","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"}],"published":"2014-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a8ee823-74f2-4cab-99a1-f2f613929b44","source":"wordfence","cve":"CVE-2024-33922","title":"Media Cleaner: Clean your WordPress! <= 6.7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8ee823-74f2-4cab-99a1-f2f613929b44?source=api-prod","affected":[{"type":"plugin","slug":"media-cleaner","name":"Media Cleaner: Delete Unused Images & Clean Your Media Library","from":"*","from_inclusive":true,"to":"6.7.2","to_inclusive":true,"patched_in":"6.7.3"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:32:45Z"},{"id":"wordfence:8a8eeae9-572c-420a-be7d-a240c54e96ae","source":"wordfence","cve":"CVE-2024-12861","title":"W2S \u2013 Migrate WooCommerce to Shopify <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8eeae9-572c-420a-be7d-a240c54e96ae?source=api-prod","affected":[{"type":"plugin","slug":"w2s-migrate-woo-to-shopify","name":"W2S \u2013 Migrate WooCommerce to Shopify","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:42:06Z"},{"id":"wordfence:8a8fc6a5-a28a-4d6b-8d63-c5e2f4d26422","source":"wordfence","cve":"CVE-2024-37449","title":"Slider Revolution <= 6.7.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8fc6a5-a28a-4d6b-8d63-c5e2f4d26422?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.13","to_inclusive":true,"patched_in":"6.7.14"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:10:12Z"},{"id":"wordfence:8a90de6e-6bd5-43b6-980d-84d25d4120ad","source":"wordfence","cve":"CVE-2026-11784","title":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-18T05:34:27Z"},{"id":"wordfence:8a934ccd-9330-4585-9994-838940d24980","source":"wordfence","cve":"CVE-2026-3688","title":"WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a934ccd-9330-4585-9994-838940d24980?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.11.10","to_inclusive":true,"patched_in":"2.11.11"}],"published":"2026-07-07T23:34:27Z","updated":"2026-07-08T11:35:40Z"},{"id":"wordfence:8a94aac9-e31e-45ed-b126-469c83f4d74b","source":"wordfence","cve":"CVE-2026-15388","title":"Cookie Consent \u2013 GDPR & CCPA Cookie Banner & Consent Manager < 0.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a94aac9-e31e-45ed-b126-469c83f4d74b?source=api-prod","affected":[{"type":"plugin","slug":"cookiez","name":"Cookiez \u2013 GDPR & CCPA Cookie Banner & Consent Manager","from":"*","from_inclusive":true,"to":"0.0.10","to_inclusive":false,"patched_in":"0.0.10"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:31:42Z"},{"id":"wordfence:8a955d4f-6609-4aa8-806c-48af0c6dbac1","source":"wordfence","cve":"CVE-2020-35235","title":"Secure File Manager < 2.8.2 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a955d4f-6609-4aa8-806c-48af0c6dbac1?source=api-prod","affected":[{"type":"plugin","slug":"secure-file-manager","name":"Secure File Manager","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":false,"patched_in":"2.8.2"}],"published":"2020-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a95633f-b5e1-4a92-b566-90fb05a289ce","source":"wordfence","cve":"","title":"Software License Manager <= 4.4.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a95633f-b5e1-4a92-b566-90fb05a289ce?source=api-prod","affected":[{"type":"plugin","slug":"software-license-manager","name":"Software License Manager","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a95af34-559c-4644-9941-7bd1551aba33","source":"wordfence","cve":"CVE-2023-2362","title":"Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a95af34-559c-4644-9941-7bd1551aba33?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"},{"type":"plugin","slug":"popup-box","name":"Popup Box \u2013 Easily Create WordPress Popups","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"},{"type":"plugin","slug":"mwp-skype","name":"Wow Skype Buttons","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"},{"type":"plugin","slug":"float-menu","name":"Float menu \u2013 awesome floating side menu","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"},{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"},{"type":"plugin","slug":"profit-button","name":"Floating button","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"},{"type":"plugin","slug":"sticky-buttons","name":"Sticky Buttons \u2013 Floating Buttons Builder","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"},{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"bubble-menu","name":"Bubble Menu \u2013 Floating Button Menu with Sticky Navigation","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"},{"type":"plugin","slug":"calculator-builder","name":"Calculator Builder \u2013 Create an Online Calculator","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"},{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"},{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a96d6d5-a5e3-4648-902b-f9d1f8e57e5c","source":"wordfence","cve":"CVE-2025-11170","title":"WP\u79fb\u884c\u5c02\u7528\u30d7\u30e9\u30b0\u30a4\u30f3 for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a96d6d5-a5e3-4648-902b-f9d1f8e57e5c?source=api-prod","affected":[{"type":"plugin","slug":"cpi-wp-migration","name":"WP\u79fb\u884c\u5c02\u7528\u30d7\u30e9\u30b0\u30a4\u30f3 for CPI","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:51:30Z","updated":"2025-11-11T03:30:44Z"},{"id":"wordfence:8a9742e8-92c1-46f9-b8c6-4f9b26d59dcb","source":"wordfence","cve":"CVE-2026-39596","title":"Blocksy Companion Pro < 2.1.29 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9742e8-92c1-46f9-b8c6-4f9b26d59dcb?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion-pro","name":"Blocksy Companion Pro","from":"*","from_inclusive":true,"to":"2.1.29","to_inclusive":false,"patched_in":"2.1.29"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:08:25Z"},{"id":"wordfence:8a98c966-8a3c-4af8-af98-e16104e59726","source":"wordfence","cve":"CVE-2026-39561","title":"Revive.so <= 2.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a98c966-8a3c-4af8-af98-e16104e59726?source=api-prod","affected":[{"type":"plugin","slug":"revive-so","name":"Revive.so \u2013 Bulk Rewrite and Republish Blog Posts","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-03-12T00:00:00Z","updated":"2026-04-15T21:29:20Z"},{"id":"wordfence:8a99f19a-7874-4f55-bbdd-db23182a0ece","source":"wordfence","cve":"CVE-2022-4669","title":"Page Builder: Live Composer <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a99f19a-7874-4f55-bbdd-db23182a0ece?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.22","to_inclusive":true,"patched_in":"1.5.23"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a9b2ec2-edbe-45c5-bd36-45a6101356d1","source":"wordfence","cve":"CVE-2023-34031","title":"bbPress Toolkit <= 1.0.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9b2ec2-edbe-45c5-bd36-45a6101356d1?source=api-prod","affected":[{"type":"plugin","slug":"bbp-toolkit","name":"bbPress Toolkit","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8a9bdc86-98f5-4a28-902a-64e2d2a83b05","source":"wordfence","cve":"CVE-2026-48094","title":"ShareOpenly < 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9bdc86-98f5-4a28-902a-64e2d2a83b05?source=api-prod","affected":[{"type":"plugin","slug":"shareopenly","name":"ShareOpenly","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-09-16T18:26:39Z"},{"id":"wordfence:8a9cfef5-d9fc-4dbf-b3ec-d8d4da2edd2f","source":"wordfence","cve":"CVE-2026-24601","title":"Penci Pay Writer <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9cfef5-d9fc-4dbf-b3ec-d8d4da2edd2f?source=api-prod","affected":[{"type":"plugin","slug":"penci-pay-writer","name":"Penci Pay Writer","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-14T00:00:00Z","updated":"2026-01-28T18:39:09Z"},{"id":"wordfence:8a9df5f6-2df7-4d32-81ee-da9c4080420d","source":"wordfence","cve":"CVE-2025-31832","title":"ACF City Selector <= 1.16.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9df5f6-2df7-4d32-81ee-da9c4080420d?source=api-prod","affected":[{"type":"plugin","slug":"acf-city-selector","name":"ACF City Selector","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T13:13:49Z"},{"id":"wordfence:8a9e1325-1027-41ea-93be-c321aef61dea","source":"wordfence","cve":"CVE-2024-12255","title":"Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9e1325-1027-41ea-93be-c321aef61dea?source=api-prod","affected":[{"type":"plugin","slug":"accept-stripe-payments-using-contact-form-7","name":"Accept Stripe Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:8a9f17e3-f1cf-44c5-a4eb-38b43b00f912","source":"wordfence","cve":"CVE-2015-9528","title":"Easy Digital Downloads \u2013 Software Licensing < 3.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8a9f17e3-f1cf-44c5-a4eb-38b43b00f912?source=api-prod","affected":[{"type":"plugin","slug":"edd-software-licensing","name":"Easy Digital Downloads \u2013 Software Licensing","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8aa02b58-02af-46af-8a20-b94a125b6a12","source":"wordfence","cve":"CVE-2025-47553","title":"DZS Video Gallery <= 12.39 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa02b58-02af-46af-8a20-b94a125b6a12?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"12.39","to_inclusive":true,"patched_in":"12.40"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:10:04Z"},{"id":"wordfence:8aa0eada-dc6c-4cd5-9ced-f162416ec439","source":"wordfence","cve":"CVE-2024-31306","title":"Essential Blocks for Gutenberg <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa0eada-dc6c-4cd5-9ced-f162416ec439?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:18:58Z"},{"id":"wordfence:8aa0fffa-475e-4227-9ab1-17ca6fcce529","source":"wordfence","cve":"CVE-2021-46743","title":"Firebase PHP-JWT < 6.0.0 - Algorithm Confusion","severity":"critical","cvss":9.1,"cwe":"CWE-843","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa0fffa-475e-4227-9ab1-17ca6fcce529?source=api-prod","affected":[{"type":"plugin","slug":"jwt-auth","name":"JWT Auth \u2013 WordPress JSON Web Token Authentication","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8aa19b3a-229e-460d-b592-c0a2c7fd5c06","source":"wordfence","cve":"CVE-2021-24911","title":"Transposh WordPress Translation <= 1.0.7 -  Unauthenticated Stored Cross-Site Scripting via 'tp_translation'","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa19b3a-229e-460d-b592-c0a2c7fd5c06?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8aa2ba7f-c33d-4e80-b1cf-2d7b2a497f04","source":"wordfence","cve":"CVE-2024-10352","title":"Magical Addons For Elementor <= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa2ba7f-c33d-4e80-b1cf-2d7b2a497f04?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T11:38:25Z"},{"id":"wordfence:8aa467ad-9744-4594-91b6-02df0970aa60","source":"wordfence","cve":"CVE-2024-34814","title":"Unyson <= 2.7.29 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa467ad-9744-4594-91b6-02df0970aa60?source=api-prod","affected":[{"type":"plugin","slug":"unyson","name":"Unyson","from":"*","from_inclusive":true,"to":"2.7.30","to_inclusive":true,"patched_in":"2.7.31"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:15:33Z"},{"id":"wordfence:8aac2717-0d1c-4c77-9dd2-b659fa2863a3","source":"wordfence","cve":"CVE-2022-1394","title":"Photo Gallery by 10Web <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aac2717-0d1c-4c77-9dd2-b659fa2863a3?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ab0cad4-1a82-4127-bedb-c0ddfce4ec10","source":"wordfence","cve":"CVE-2023-5803","title":"Business Directory Plugin <= 6.3.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab0cad4-1a82-4127-bedb-c0ddfce4ec10?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.3.10","to_inclusive":true,"patched_in":"6.3.11"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ab2882e-60c6-4eb9-91e7-3be4fa625711","source":"wordfence","cve":"CVE-2014-10377","title":"cformsII <= 13.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab2882e-60c6-4eb9-91e7-3be4fa625711?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"13.1","to_inclusive":true,"patched_in":"13.2"}],"published":"2014-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ab3df33-0644-4983-8818-23f63db4c89f","source":"wordfence","cve":"CVE-2025-69073","title":"Piqes <= 1.0.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab3df33-0644-4983-8818-23f63db4c89f?source=api-prod","affected":[{"type":"theme","slug":"piqes","name":"Piqes | Creative Startup & Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:31:58Z"},{"id":"wordfence:8ab5ca55-0a8a-45a8-9ab0-aa3bbfa85417","source":"wordfence","cve":"CVE-2026-2416","title":"Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab5ca55-0a8a-45a8-9ab0-aa3bbfa85417?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.17","to_inclusive":true,"patched_in":"1.13.18"}],"published":"2026-02-24T19:41:19Z","updated":"2026-02-25T08:25:33Z"},{"id":"wordfence:8ab8eb9d-1427-4e99-8986-179147e0862e","source":"wordfence","cve":"CVE-2021-4405","title":"ElasticPress <= 3.5.3 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab8eb9d-1427-4e99-8986-179147e0862e?source=api-prod","affected":[{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8abca32c-7af3-4785-8038-3dbc8823f414","source":"wordfence","cve":"CVE-2026-32551","title":"Woo Essential <= 4.3.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8abca32c-7af3-4785-8038-3dbc8823f414?source=api-prod","affected":[{"type":"plugin","slug":"woo-essential","name":"Woo essential","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:28:51Z"},{"id":"wordfence:8abe5885-0f04-4545-a2fe-7aa2a1dcbbe6","source":"wordfence","cve":"CVE-2024-33548","title":"WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8abe5885-0f04-4545-a2fe-7aa2a1dcbbe6?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.1.00","to_inclusive":false,"patched_in":"14.1.00"}],"published":"2024-04-25T00:00:00Z","updated":"2026-02-26T14:56:12Z"},{"id":"wordfence:8abe897e-d9e2-49fc-abab-0c738e585a30","source":"wordfence","cve":"CVE-2025-48135","title":"Aptivada for WP <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8abe897e-d9e2-49fc-abab-0c738e585a30?source=api-prod","affected":[{"type":"plugin","slug":"aptivada-for-wp","name":"Aptivada for WP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:24:38Z"},{"id":"wordfence:8abed8c7-0c3f-4054-a116-82ce47d605de","source":"wordfence","cve":"CVE-2024-12819","title":"Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8abed8c7-0c3f-4054-a116-82ce47d605de?source=api-prod","affected":[{"type":"plugin","slug":"searchie","name":"Searchie","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:03:23Z","updated":"2025-01-09T11:11:02Z"},{"id":"wordfence:8ac37b1f-a4da-41d7-92c4-9ca09cc9372c","source":"wordfence","cve":"CVE-2026-95523","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Subscription Gate Bypass on Post Submission","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ac37b1f-a4da-41d7-92c4-9ca09cc9372c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:28:33Z"},{"id":"wordfence:8ac5fe69-7885-4fb7-8107-079216d6955e","source":"wordfence","cve":"CVE-2025-0512","title":"Structured Content (JSON-LD) #wpsc <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ac5fe69-7885-4fb7-8107-079216d6955e?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-03-03T19:48:24Z","updated":"2025-03-04T08:23:41Z"},{"id":"wordfence:8ac66027-14b8-4e0a-a483-c014905ef04e","source":"wordfence","cve":"CVE-2024-1397","title":"HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ac66027-14b8-4e0a-a483-c014905ef04e?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T22:32:27Z"},{"id":"wordfence:8acb7893-85b2-404a-b3fe-b4c1a835b3eb","source":"wordfence","cve":"CVE-2023-3387","title":"Lana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8acb7893-85b2-404a-b3fe-b4c1a835b3eb?source=api-prod","affected":[{"type":"plugin","slug":"lana-text-to-image","name":"Lana Text to Image","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8acb86fa-50b4-45b3-9bf8-ef65679b85ac","source":"wordfence","cve":"CVE-2022-29448","title":"Herd Effects <= 5.2 - Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8acb86fa-50b4-45b3-9bf8-ef65679b85ac?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2022-05-16T06:54:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8accf552-f235-46dd-857b-330eef7765a0","source":"wordfence","cve":"CVE-2024-10693","title":"SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8accf552-f235-46dd-857b-330eef7765a0?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:30:48Z"},{"id":"wordfence:8acf7327-2cdc-44ad-a04c-01cb0337d510","source":"wordfence","cve":"CVE-2016-1564","title":"WordPress Core < 4.4.1 - Cross-Site Scripting via Theme Names","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8acf7327-2cdc-44ad-a04c-01cb0337d510?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.11","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.11","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"3.7.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"3.7.12"}],"published":"2016-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ad03d04-a93a-4be0-b18a-00bf37b70950","source":"wordfence","cve":"CVE-2025-58986","title":"Jock On Air Now (JOAN) <= 6.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad03d04-a93a-4be0-b18a-00bf37b70950?source=api-prod","affected":[{"type":"plugin","slug":"joan","name":"Jock On Air Now (JOAN)","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2025-10-02T00:00:00Z","updated":"2025-10-29T16:19:25Z"},{"id":"wordfence:8ad239d3-c761-4c78-903d-119133fcb79b","source":"wordfence","cve":"","title":"Special Text Boxes <= 5.9.110 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad239d3-c761-4c78-903d-119133fcb79b?source=api-prod","affected":[{"type":"plugin","slug":"wp-special-textboxes","name":"Special Text Boxes","from":"*","from_inclusive":true,"to":"5.9.110","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ad2890c-2385-414b-8630-f2c2f2199db9","source":"wordfence","cve":"CVE-2024-5728","title":"Animated AL List <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad2890c-2385-414b-8630-f2c2f2199db9?source=api-prod","affected":[{"type":"plugin","slug":"animated-al-list","name":"Animated AL List","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-13T15:00:35Z"},{"id":"wordfence:8ad473d5-f54b-4801-9ba3-54e4dddf26f7","source":"wordfence","cve":"CVE-2025-53194","title":"JetEngine <= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution","severity":"high","cvss":7.5,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad473d5-f54b-4801-9ba3-54e4dddf26f7?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.1.1"}],"published":"2025-07-13T00:00:00Z","updated":"2025-09-25T20:55:28Z"},{"id":"wordfence:8ad52e6f-0dbf-459c-badb-86b9036760d7","source":"wordfence","cve":"CVE-2026-32513","title":"JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad52e6f-0dbf-459c-badb-86b9036760d7?source=api-prod","affected":[{"type":"plugin","slug":"jquery-archive-list-widget","name":"JS Archive List","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:13:34Z"},{"id":"wordfence:8ad5db8f-c3c2-4b76-abc6-3d95e0567ab0","source":"wordfence","cve":"CVE-2023-22691","title":"Category Specific RSS feed Subscription <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad5db8f-c3c2-4b76-abc6-3d95e0567ab0?source=api-prod","affected":[{"type":"plugin","slug":"category-specific-rss-feed-menu","name":"Category Specific RSS feed Subscription","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ad642df-1a3f-4eb2-a64c-431b32ef5aef","source":"wordfence","cve":"CVE-2025-28967","title":"Contact Us page - Contact people LITE <= 3.7.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad642df-1a3f-4eb2-a64c-431b32ef5aef?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:57:24Z"},{"id":"wordfence:8ad6ddec-e25f-4553-a116-25a44acdcbbf","source":"wordfence","cve":"CVE-2026-105436","title":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad6ddec-e25f-4553-a116-25a44acdcbbf?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:42:16Z"},{"id":"wordfence:8ad7c3d5-fce8-4214-a7f8-5aa2b9fe0934","source":"wordfence","cve":"CVE-2022-0267","title":"AdRotate \u2013 Ad manager & AdSense Ads <= 5.8.17 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ad7c3d5-fce8-4214-a7f8-5aa2b9fe0934?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"5.8.22"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ada3f45-e9f3-46f0-810a-26545a1a54d9","source":"wordfence","cve":"CVE-2025-23828","title":"WordPress Data Guard <= 8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ada3f45-e9f3-46f0-810a-26545a1a54d9?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-data-guards","name":"WordPress Data Guard [Website Security]","from":"*","from_inclusive":true,"to":"8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:53:44Z"},{"id":"wordfence:8ada8a27-752c-4726-b330-895b967ea290","source":"wordfence","cve":"","title":"WordPress File Upload < 3.9.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ada8a27-752c-4726-b330-895b967ea290?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":false,"patched_in":"3.9.0"}],"published":"2016-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8adabc89-e3f5-43db-b19a-ee38513c6d0f","source":"wordfence","cve":"CVE-2025-12630","title":"Upload.am File Hosting VPN <= 1.0.0 - Authenticated (Contributor+) Arbitrary Options Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8adabc89-e3f5-43db-b19a-ee38513c6d0f?source=api-prod","affected":[{"type":"plugin","slug":"upload-am-file-hosting-vpn","name":"Upload.am \u2013 File Hosting & VPN","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-09-29T00:00:00Z","updated":"2025-12-11T16:10:24Z"},{"id":"wordfence:8ade80e4-a05a-4418-9c01-67c0366213b6","source":"wordfence","cve":"CVE-2024-30465","title":"PageLayer <= 1.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ade80e4-a05a-4418-9c01-67c0366213b6?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:24:00Z"},{"id":"wordfence:8adfd055-833c-41f8-99b7-ebc4c2231973","source":"wordfence","cve":"CVE-2024-32560","title":"QR Code Composer \u2013 Automatic QR code Generator <= 2.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8adfd055-833c-41f8-99b7-ebc4c2231973?source=api-prod","affected":[{"type":"plugin","slug":"qr-code-composer","name":"QR Code Composer \u2013 Automatic QR code generation","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-08T14:08:42Z"},{"id":"wordfence:8ae0030f-af21-43fb-959a-8da04cab05bb","source":"wordfence","cve":"CVE-2024-10872","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae0030f-af21-43fb-959a-8da04cab05bb?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T11:03:43Z"},{"id":"wordfence:8ae360d3-bd38-40f5-ac0f-7cb4f685fcbe","source":"wordfence","cve":"CVE-2025-30604","title":"JiangQie Official Website Mini Program <= 1.8.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae360d3-bd38-40f5-ac0f-7cb4f685fcbe?source=api-prod","affected":[{"type":"plugin","slug":"jiangqie-official-website-mini-program","name":"ZhuiGe Official Website Mini Program","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:50:35Z"},{"id":"wordfence:8ae463ae-5bfb-4e7c-9f84-edaa9a826ffa","source":"wordfence","cve":"CVE-2024-53756","title":"Vertical Carousel <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae463ae-5bfb-4e7c-9f84-edaa9a826ffa?source=api-prod","affected":[{"type":"plugin","slug":"vertical-carousel-slider","name":"Vertical Carousel","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:30:51Z"},{"id":"wordfence:8ae4ffe1-ecb6-4bde-8ac4-baeea82a0299","source":"wordfence","cve":"CVE-2023-37893","title":"Coming Soon Chop Chop <= 2.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae4ffe1-ecb6-4bde-8ac4-baeea82a0299?source=api-prod","affected":[{"type":"plugin","slug":"cc-coming-soon","name":"Coming Soon Chop Chop","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ae734d1-0cd4-4ff5-8448-828b0fb64f70","source":"wordfence","cve":"CVE-2023-3092","title":"SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae734d1-0cd4-4ff5-8448-828b0fb64f70?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mail","name":"SMTP Mail","from":"*","from_inclusive":true,"to":"1.3.46","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2025-10-08T13:47:02Z"},{"id":"wordfence:8ae8d77c-cf52-442a-a273-9bca21db6e32","source":"wordfence","cve":"CVE-2026-96871","title":"Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae8d77c-cf52-442a-a273-9bca21db6e32?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-10-01T19:16:29Z","updated":"2026-10-02T07:39:26Z"},{"id":"wordfence:8ae9640f-b088-4d9f-9ced-6bf7940345a3","source":"wordfence","cve":"CVE-2024-29803","title":"FlatPM < 3.1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae9640f-b088-4d9f-9ced-6bf7940345a3?source=api-prod","affected":[{"type":"plugin","slug":"flatpm-wp","name":"FlatPM \u2013 Ad Manager, AdSense and Custom Code","from":"*","from_inclusive":true,"to":"3.1.05","to_inclusive":false,"patched_in":"3.1.05"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:30:54Z"},{"id":"wordfence:8aeaba0e-0a23-48f6-aa42-7f2f3bd741f1","source":"wordfence","cve":"CVE-2025-14353","title":"ZIP Code Based Content Protection <= 1.0.2 - Unauthenticated SQL Injection via 'zipcode' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aeaba0e-0a23-48f6-aa42-7f2f3bd741f1?source=api-prod","affected":[{"type":"plugin","slug":"zip-code-based-content-protection","name":"ZIP Code Based Content Protection","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-03-06T11:52:34Z","updated":"2026-03-07T01:21:22Z"},{"id":"wordfence:8aec2a8b-c0d7-440f-a389-1d98cef77c2e","source":"wordfence","cve":"CVE-2016-10957","title":"Akal - Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aec2a8b-c0d7-440f-a389-1d98cef77c2e?source=api-prod","affected":[{"type":"theme","slug":"akal","name":"Akal - Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2016-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8aecdd7e-3d51-413e-b181-9b367ccf7931","source":"wordfence","cve":"CVE-2025-23492","title":"WordPress \u6dd8\u5b9d\u5ba2\u63d2\u4ef6 <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aecdd7e-3d51-413e-b181-9b367ccf7931?source=api-prod","affected":[{"type":"plugin","slug":"taobaoke","name":"WordPress \u6dd8\u5b9d\u5ba2\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:34:27Z"},{"id":"wordfence:8aee568b-13f9-41ec-948d-ed4f9953c366","source":"wordfence","cve":"CVE-2026-82844","title":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass on Paid Forms","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aee568b-13f9-41ec-948d-ed4f9953c366?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"1.10.0.1","from_inclusive":true,"to":"2.0.2.1","to_inclusive":true,"patched_in":"2.0.2.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:18:38Z"},{"id":"wordfence:8aee76b0-7a28-4f03-95a8-15d504cf38a4","source":"wordfence","cve":"CVE-2025-23946","title":"Enhanced YouTube Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aee76b0-7a28-4f03-95a8-15d504cf38a4?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-youtube-shortcode","name":"Enhanced YouTube Shortcode","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:41:17Z"},{"id":"wordfence:8aef0e9d-fc63-445d-a5fa-08e6cd5f0dbc","source":"wordfence","cve":"CVE-2024-44006","title":"WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8aef0e9d-fc63-445d-a5fa-08e6cd5f0dbc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.3.7"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-18T16:03:56Z"},{"id":"wordfence:8af105f0-171d-40d3-a62c-062de897592c","source":"wordfence","cve":"CVE-2025-67997","title":"Travelicious < 1.6.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af105f0-171d-40d3-a62c-062de897592c?source=api-prod","affected":[{"type":"theme","slug":"travelicious","name":"Travelicious - Tour Operator WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T14:58:11Z"},{"id":"wordfence:8af26db8-5cae-45ba-9573-2bc4e885de81","source":"wordfence","cve":"","title":"Kudos Donations \u2013 Easy donations and payments with Mollie < 3.1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af26db8-5cae-45ba-9573-2bc4e885de81?source=api-prod","affected":[{"type":"plugin","slug":"kudos-donations","name":"Kudos Donations \u2013 Donation Forms for Mollie & Stripe","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8af3cef8-927e-4b3e-9698-f4657a8a03b7","source":"wordfence","cve":"CVE-2026-110372","title":"OttoKit: All-in-One Automation Platform <= 1.1.40 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af3cef8-927e-4b3e-9698-f4657a8a03b7?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.1.40","to_inclusive":true,"patched_in":"1.1.41"}],"published":"2026-10-16T10:36:59Z","updated":"2026-10-23T18:34:16Z"},{"id":"wordfence:8af44af4-ea56-4686-ad35-5bcdd98ba2cc","source":"wordfence","cve":"CVE-2023-50857","title":"Automation By Autonami <= 2.6.1 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af44af4-ea56-4686-ad35-5bcdd98ba2cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8af4f5b3-498a-4543-ad08-2140f6d51562","source":"wordfence","cve":"CVE-2026-74000","title":"Simple Membership <= 4.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af4f5b3-498a-4543-ad08-2140f6d51562?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2026-09-16T18:17:00Z","updated":"2026-09-22T18:48:50Z"},{"id":"wordfence:8af960cd-6f39-4ce1-888a-f32f01b833df","source":"wordfence","cve":"CVE-2024-30445","title":"Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8af960cd-6f39-4ce1-888a-f32f01b833df?source=api-prod","affected":[{"type":"plugin","slug":"icon","name":"Web Icons","from":"*","from_inclusive":true,"to":"1.0.0.10","to_inclusive":true,"patched_in":"1.0.0.11"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:40:26Z"},{"id":"wordfence:8afcb18c-71e6-4c77-b0f9-0700ee05966e","source":"wordfence","cve":"CVE-2008-5695","title":"WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8afcb18c-71e6-4c77-b0f9-0700ee05966e?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2007-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8afe386e-1e4f-4668-8309-6d47dedb008a","source":"wordfence","cve":"CVE-2024-11284","title":"WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8afe386e-1e4f-4668-8309-6d47dedb008a?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:32Z"},{"id":"wordfence:8b007bf9-9756-4f18-81b9-7d4b15c5dca8","source":"wordfence","cve":"CVE-2024-48024","title":"Keep Backup Daily <= 2.0.8 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b007bf9-9756-4f18-81b9-7d4b15c5dca8?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-24T18:15:24Z"},{"id":"wordfence:8b0140f2-ceaa-4589-b1ad-1daa244aa3cd","source":"wordfence","cve":"CVE-2022-41620","title":"SeoSamba for WordPress Webmasters <= 1.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0140f2-ceaa-4589-b1ad-1daa244aa3cd?source=api-prod","affected":[{"type":"plugin","slug":"seosamba-webmasters","name":"SeoSamba for WordPress Webmasters","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b019499-8edf-4921-9612-12d39c2e8e85","source":"wordfence","cve":"CVE-2021-24318","title":"Listeo - Directory & Listings With Booking - WordPress Theme < 1.6.11 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b019499-8edf-4921-9612-12d39c2e8e85?source=api-prod","affected":[{"type":"theme","slug":"listeo","name":"Listeo - Directory & Listings With Booking - WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":false,"patched_in":"1.6.11"}],"published":"2021-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b040f47-b126-4640-9fc5-bda8650f6c69","source":"wordfence","cve":"CVE-2023-47763","title":"WP Custom Admin Interface <= 7.31 - Missing Authorization via wpcai_pro_notice_disable","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b040f47-b126-4640-9fc5-bda8650f6c69?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.31","to_inclusive":true,"patched_in":"7.32"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b0504f3-f8df-4b37-bafa-5320920e9571","source":"wordfence","cve":"CVE-2023-51499","title":"WooCommerce Shipping Per Product <= 2.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0504f3-f8df-4b37-bafa-5320920e9571?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-per-product","name":"WooCommerce Per Product Shipping","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b06d68e-153d-4cee-94d5-cbeac7468665","source":"wordfence","cve":"CVE-2023-30747","title":"WooCommerce Easy Duplicate Product <= 0.3.0.0 - Reflected Cross-Site Scripting via wedp_duplicated","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b06d68e-153d-4cee-94d5-cbeac7468665?source=api-prod","affected":[{"type":"plugin","slug":"woo-easy-duplicate-product","name":"Easy Duplicate Product for WooCommerce","from":"*","from_inclusive":true,"to":"0.3.0.0","to_inclusive":true,"patched_in":"0.3.0.1"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b089114-b403-4e42-a578-c1f3b100978f","source":"wordfence","cve":"","title":"Cookieless Backend Server Tracking for Google Analytics \u2013 WordPress Plugin < 1.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b089114-b403-4e42-a578-c1f3b100978f?source=api-prod","affected":[{"type":"plugin","slug":"ga-backend-tracking","name":"Cookieless Backend Server Tracking for Google Analytics \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2019-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b08f273-2d38-4559-9120-1aef8e8a69e4","source":"wordfence","cve":"CVE-2024-49649","title":"Build App Online <= 1.0.23 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b08f273-2d38-4559-9120-1aef8e8a69e4?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-20T16:56:45Z"},{"id":"wordfence:8b09fb17-ef1e-45ed-9091-8310432bd1cf","source":"wordfence","cve":"CVE-2026-109897","title":"Strong Testimonials <= 3.3.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b09fb17-ef1e-45ed-9091-8310432bd1cf?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2026-10-15T18:11:00Z","updated":"2026-10-23T18:28:23Z"},{"id":"wordfence:8b0a47e0-5be1-418c-afdf-8bb2d784bcc9","source":"wordfence","cve":"CVE-2022-38134","title":"Customer Reviews for WooCommerce <= 5.3.5 - Multiple Unprotected AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0a47e0-5be1-418c-afdf-8bb2d784bcc9?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b0c54f2-3942-48bd-b821-b66a57fd1506","source":"wordfence","cve":"CVE-2024-30428","title":"Contest Gallery <= 21.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0c54f2-3942-48bd-b821-b66a57fd1506?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.3.5","to_inclusive":true,"patched_in":"21.3.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:26:06Z"},{"id":"wordfence:8b0df7f4-d916-414a-8d03-941aab06a001","source":"wordfence","cve":"CVE-2017-18603","title":"Postman SMTP <= 1.7.2 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0df7f4-d916-414a-8d03-941aab06a001?source=api-prod","affected":[{"type":"plugin","slug":"postman-smtp","name":"Postman SMTP","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2017-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b0e0f22-de42-4da9-a0c1-ae41ba57be03","source":"wordfence","cve":"CVE-2026-15288","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0e0f22-de42-4da9-a0c1-ae41ba57be03?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-02-13T18:17:21Z","updated":"2026-07-10T04:31:23Z"},{"id":"wordfence:8b0ecf40-d68d-4059-a89b-c6532d1292d7","source":"wordfence","cve":"CVE-2026-22419","title":"Honor | Shooting Club & Weapon and Gun Store Theme <= 2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0ecf40-d68d-4059-a89b-c6532d1292d7?source=api-prod","affected":[{"type":"theme","slug":"honor","name":"Honor | Shooting Club & Weapon and Gun Store Theme","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:39:12Z"},{"id":"wordfence:8b0f58b8-46d6-4deb-bfcc-806bb635b060","source":"wordfence","cve":"CVE-2024-32602","title":"WooCommerce Multilingual & Multicurrency with WPML <= 5.3.3.1 - Authenticated (Shop Manager+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0f58b8-46d6-4deb-bfcc-806bb635b060?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.3.1","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:34:11Z"},{"id":"wordfence:8b104666-a038-442f-8db8-78ccb64879a7","source":"wordfence","cve":"CVE-2024-39620","title":"ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b104666-a038-442f-8db8-78ccb64879a7?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2025-03-24T15:24:29Z"},{"id":"wordfence:8b11a4ce-9e11-4c4b-8c61-3de05750f568","source":"wordfence","cve":"","title":"Solace Extra <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b11a4ce-9e11-4c4b-8c61-3de05750f568?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-06T14:46:36Z"},{"id":"wordfence:8b12777d-36ab-4ced-9050-b2ce11b23625","source":"wordfence","cve":"CVE-2025-28858","title":"Arrow Maps <= 1.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b12777d-36ab-4ced-9050-b2ce11b23625?source=api-prod","affected":[{"type":"plugin","slug":"ap-google-maps","name":"Arrow Maps \u2013 Custom Maps for WordPress","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:40:14Z"},{"id":"wordfence:8b13a072-f90f-4982-b4d1-d0b9903e59ea","source":"wordfence","cve":"CVE-2026-3174","title":"Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b13a072-f90f-4982-b4d1-d0b9903e59ea?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.27.4","to_inclusive":true,"patched_in":"5.27.4.1"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:29:59Z"},{"id":"wordfence:8b13fd84-1037-4190-8261-743becb07646","source":"wordfence","cve":"CVE-2025-54023","title":"WP Delicious <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b13fd84-1037-4190-8261-743becb07646?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:29:50Z"},{"id":"wordfence:8b145772-624e-4af0-9156-03c483bf8381","source":"wordfence","cve":"CVE-2023-5661","title":"Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b145772-624e-4af0-9156-03c483bf8381?source=api-prod","affected":[{"type":"plugin","slug":"add-facebook","name":"Social Feed | All social media in one place","from":"*","from_inclusive":true,"to":"1.5.4.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b14bdec-9737-4b03-8cc0-e4018494d162","source":"wordfence","cve":"CVE-2024-1331","title":"Team Members <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b14bdec-9737-4b03-8cc0-e4018494d162?source=api-prod","affected":[{"type":"plugin","slug":"team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2024-02-26T00:00:00Z","updated":"2025-02-21T19:57:05Z"},{"id":"wordfence:8b14c07b-23bb-4a14-8018-fa2462383b35","source":"wordfence","cve":"CVE-2023-0496","title":"HT Event <= 1.4.5 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b14c07b-23bb-4a14-8018-fa2462383b35?source=api-prod","affected":[{"type":"plugin","slug":"ht-event","name":"HT Event \u2013 WordPress Event Manager Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b1573e6-8fe6-40dd-82d0-dbb51e22e5e8","source":"wordfence","cve":"CVE-2025-68532","title":"ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1573e6-8fe6-40dd-82d0-dbb51e22e5e8?source=api-prod","affected":[{"type":"plugin","slug":"modeltheme-addons-for-wpbakery","name":"ModelTheme Addons for WPBakery and Elementor","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-06T14:19:30Z"},{"id":"wordfence:8b189452-0d77-4a83-8afc-27bc2e52b060","source":"wordfence","cve":"CVE-2026-22369","title":"Ironfit <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b189452-0d77-4a83-8afc-27bc2e52b060?source=api-prod","affected":[{"type":"theme","slug":"ironfit","name":"Ironfit - Fitness, Gym and Crossfit WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:30:41Z"},{"id":"wordfence:8b1af76a-3836-4527-9ea6-8bffa173a84e","source":"wordfence","cve":"CVE-2023-52211","title":"WP Job Manager <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1af76a-3836-4527-9ea6-8bffa173a84e?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b1bd0be-a0a5-4d0b-a334-f847f325e9f8","source":"wordfence","cve":"CVE-2026-112848","title":"Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1bd0be-a0a5-4d0b-a334-f847f325e9f8?source=api-prod","affected":[{"type":"theme","slug":"hostmev2","name":"Hostme v2 - Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:55:19Z"},{"id":"wordfence:8b1bfd36-8020-4e38-967e-768a920253f0","source":"wordfence","cve":"CVE-2025-26761","title":"Easy Elementor Addons <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1bfd36-8020-4e38-967e-768a920253f0?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:02:33Z"},{"id":"wordfence:8b1cf5dc-c823-4603-959a-5dfc21f7d338","source":"wordfence","cve":"CVE-2022-41618","title":"Media Library Assistant <= 3.00 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1cf5dc-c823-4603-959a-5dfc21f7d338?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.00","to_inclusive":true,"patched_in":"3.01"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b1f0741-1ccc-497a-b239-3cefb1204f04","source":"wordfence","cve":"CVE-2016-10925","title":"LoginWP < 2.9.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1f0741-1ccc-497a-b239-3cefb1204f04?source=api-prod","affected":[{"type":"plugin","slug":"peters-login-redirect","name":"LoginWP (Formerly Peter's Login Redirect)","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2016-08-11T00:00:00Z","updated":"2024-08-15T18:16:22Z"},{"id":"wordfence:8b1f5965-f9a8-4c2b-bbc4-55bcea35dce8","source":"wordfence","cve":"CVE-2026-11868","title":"Travel <= 11.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b1f5965-f9a8-4c2b-bbc4-55bcea35dce8?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"11.7.0","to_inclusive":true,"patched_in":"11.7.1"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T22:21:09Z"},{"id":"wordfence:8b212a1a-0e2b-4327-93b5-398bd7a36b5c","source":"wordfence","cve":"CVE-2025-2874","title":"User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b212a1a-0e2b-4327-93b5-398bd7a36b5c?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20241026","to_inclusive":true,"patched_in":"20250327"}],"published":"2025-04-02T18:47:46Z","updated":"2025-04-03T07:21:23Z"},{"id":"wordfence:8b213c3b-3907-47d9-9826-379936f15078","source":"wordfence","cve":"CVE-2024-10108","title":"WPAdverts \u2013 Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b213c3b-3907-47d9-9826-379936f15078?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-10-29T18:16:59Z","updated":"2024-10-30T06:43:37Z"},{"id":"wordfence:8b22c60b-1754-4ab7-b4d2-405e143a047c","source":"wordfence","cve":"CVE-2026-39794","title":"WCFM \u2013 Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b22c60b-1754-4ab7-b4d2-405e143a047c?source=api-prod","affected":[{"type":"plugin","slug":"wcfm-marketplace-rest-api","name":"WCFM \u2013 Multivendor Marketplace REST API for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:53:37Z","updated":"2026-10-08T23:31:51Z"},{"id":"wordfence:8b2409a3-e94f-4d1d-bdf6-870fc8f0c84f","source":"wordfence","cve":"CVE-2025-6236","title":"Hostel <= 1.1.5.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2409a3-e94f-4d1d-bdf6-870fc8f0c84f?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.8","to_inclusive":true,"patched_in":"1.1.5.9"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T14:14:15Z"},{"id":"wordfence:8b24c3da-4d4b-4cb3-836e-b58f38dd80cf","source":"wordfence","cve":"CVE-2024-3964","title":"Product Enquiry for WooCommerce <= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b24c3da-4d4b-4cb3-836e-b58f38dd80cf?source=api-prod","affected":[{"type":"plugin","slug":"product-enquiry-for-woocommerce","name":"Product Enquiry for WooCommerce (Now with AI Assistant)","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T18:16:43Z"},{"id":"wordfence:8b271f2f-d765-4d2d-bb0d-f8425ebc64ca","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.6.8 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b271f2f-d765-4d2d-bb0d-f8425ebc64ca?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2022-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b29bc45-dff5-49e2-9a18-8c4a89edd424","source":"wordfence","cve":"CVE-2025-49507","title":"CozyStay < 1.7.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b29bc45-dff5-49e2-9a18-8c4a89edd424?source=api-prod","affected":[{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:11:24Z"},{"id":"wordfence:8b2a5938-232e-487c-b31b-f48e2b9acb65","source":"wordfence","cve":"CVE-2023-52175","title":"Auto Amazon Links <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2a5938-232e-487c-b31b-f48e2b9acb65?source=api-prod","affected":[{"type":"plugin","slug":"amazon-auto-links","name":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b2afc70-6e93-4a7f-b452-c2481d25d8de","source":"wordfence","cve":"CVE-2024-35650","title":"MelaPress Login Security <= 1.3.0 - Authenticated (Admin+) Remote File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2afc70-6e93-4a7f-b452-c2481d25d8de?source=api-prod","affected":[{"type":"plugin","slug":"melapress-login-security","name":"Melapress Login Security","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T19:37:31Z"},{"id":"wordfence:8b2b6a6b-73c2-441e-893d-ec171a659546","source":"wordfence","cve":"CVE-2024-9775","title":"Anih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2b6a6b-73c2-441e-893d-ec171a659546?source=api-prod","affected":[{"type":"theme","slug":"anih","name":"Anih - Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2024","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T14:11:08Z","updated":"2024-11-09T02:32:02Z"},{"id":"wordfence:8b2d42ab-46c1-4c3e-b99a-1cdcade1b5bb","source":"wordfence","cve":"CVE-2023-1408","title":"Video List Manager <= 1.7 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2d42ab-46c1-4c3e-b99a-1cdcade1b5bb?source=api-prod","affected":[{"type":"plugin","slug":"video-list-manager","name":"Video List Manager","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b2e4d4e-0bd8-4e06-9968-33b20982f333","source":"wordfence","cve":"CVE-2026-104752","title":"Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2e4d4e-0bd8-4e06-9968-33b20982f333?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.279","to_inclusive":true,"patched_in":"1.0.280"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:56:12Z"},{"id":"wordfence:8b2e7c2d-ed2f-439b-9cee-f2e5d46121b6","source":"wordfence","cve":"CVE-2026-1293","title":"Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b2e7c2d-ed2f-439b-9cee-f2e5d46121b6?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"26.8","to_inclusive":true,"patched_in":"26.9"}],"published":"2026-02-05T22:18:00Z","updated":"2026-02-06T11:21:34Z"},{"id":"wordfence:8b32c517-ef6b-4cc9-8316-6289676d8222","source":"wordfence","cve":"CVE-2023-37872","title":"WooCommerce Ship to Multiple Addresses <= 3.8.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b32c517-ef6b-4cc9-8316-6289676d8222?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-multiple-addresses","name":"WooCommerce Ship to Multiple Addresses","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b3cfe0a-dcfb-40f3-ba43-4e838c113010","source":"wordfence","cve":"CVE-2024-10952","title":"Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b3cfe0a-dcfb-40f3-ba43-4e838c113010?source=api-prod","affected":[{"type":"plugin","slug":"authors-list","name":"Authors List","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-12-03T14:19:13Z","updated":"2024-12-12T18:40:59Z"},{"id":"wordfence:8b3f0d5c-7daa-47e2-9e73-6e4f31dd7148","source":"wordfence","cve":"CVE-2024-54211","title":"Borderless <= 1.5.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b3f0d5c-7daa-47e2-9e73-6e4f31dd7148?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-20T20:45:38Z"},{"id":"wordfence:8b40165b-17e3-4b87-8d0d-90d60ba4bf81","source":"wordfence","cve":"CVE-2023-25021","title":"FareHarbor for WordPress <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b40165b-17e3-4b87-8d0d-90d60ba4bf81?source=api-prod","affected":[{"type":"plugin","slug":"fareharbor","name":"FareHarbor for WordPress","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b411b23-1bf9-4f9f-9791-59dabbd2ce0c","source":"wordfence","cve":"CVE-2026-32400","title":"Boldman <= 7.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b411b23-1bf9-4f9f-9791-59dabbd2ce0c?source=api-prod","affected":[{"type":"theme","slug":"boldman","name":"Boldman - Handyman Renovation Services WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2026-02-20T00:00:00Z","updated":"2026-05-05T14:21:17Z"},{"id":"wordfence:8b421330-dd3c-4af0-9f42-95430117eb9b","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'saveRedirectSettings' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b421330-dd3c-4af0-9f42-95430117eb9b?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b42be8d-5637-497c-bb11-759dba21e934","source":"wordfence","cve":"CVE-2025-63006","title":"EventPrime <= 4.2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b42be8d-5637-497c-bb11-759dba21e934?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.4.1","to_inclusive":true,"patched_in":"4.2.5.0"}],"published":"2025-11-06T00:00:00Z","updated":"2026-01-06T20:18:46Z"},{"id":"wordfence:8b430f0a-d50c-4923-8916-2c26bf5d619a","source":"wordfence","cve":"CVE-2021-36895","title":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto <= 5.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b430f0a-d50c-4923-8916-2c26bf5d619a?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2022-04-26T06:54:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b4568dc-afcd-4172-b39a-0d06dfa2f87a","source":"wordfence","cve":"CVE-2017-15863","title":"WP No External Links < 3.5.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4568dc-afcd-4172-b39a-0d06dfa2f87a?source=api-prod","affected":[{"type":"plugin","slug":"wp-noexternallinks","name":"wp-noexternallinks","from":"*","from_inclusive":true,"to":"3.5.19","to_inclusive":false,"patched_in":"3.5.19"}],"published":"2017-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b4650d2-4469-43ac-a432-43ca6e125dff","source":"wordfence","cve":"CVE-2026-104388","title":"PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4650d2-4469-43ac-a432-43ca6e125dff?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.17.9","to_inclusive":true,"patched_in":"11.17.11"}],"published":"2026-10-05T08:56:00Z","updated":"2026-10-08T23:22:48Z"},{"id":"wordfence:8b481631-effc-40e8-8be0-18a36ea1c081","source":"wordfence","cve":"CVE-2024-35781","title":"Word Balloon <= 4.21.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b481631-effc-40e8-8be0-18a36ea1c081?source=api-prod","affected":[{"type":"plugin","slug":"word-balloon","name":"Word Balloon","from":"*","from_inclusive":true,"to":"4.21.1","to_inclusive":true,"patched_in":"4.22.0"}],"published":"2024-06-19T00:00:00Z","updated":"2024-07-08T20:24:05Z"},{"id":"wordfence:8b4921c8-8e53-4f9d-be21-cf365869a435","source":"wordfence","cve":"CVE-2014-9338","title":"O2tweet <= 0.0.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4921c8-8e53-4f9d-be21-cf365869a435?source=api-prod","affected":[{"type":"plugin","slug":"o2tweet","name":"O2tweet","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b4a47f7-0161-4a57-994f-c48795810ea3","source":"wordfence","cve":"CVE-2024-13785","title":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms <= 1.7.4 - Unauthenticated Blind Arbitrary Shortcode Execution","severity":"medium","cvss":5.6,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4a47f7-0161-4a57-994f-c48795810ea3?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-03-20T15:21:14Z","updated":"2026-07-08T20:58:28Z"},{"id":"wordfence:8b4bc525-a21f-46f2-895a-c8474f72eb92","source":"wordfence","cve":"CVE-2023-0820","title":"User Role by BestWebSoft <= 1.6.6 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4bc525-a21f-46f2-895a-c8474f72eb92?source=api-prod","affected":[{"type":"plugin","slug":"user-role","name":"User Role by BestWebSoft \u2013 Add and Customize Roles and Capabilities in WordPress","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b4cf195-d476-4acf-bfb0-df6d971e6c7b","source":"wordfence","cve":"CVE-2025-22590","title":"Prayer Times Anywhere <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4cf195-d476-4acf-bfb0-df6d971e6c7b?source=api-prod","affected":[{"type":"plugin","slug":"prayer-times-anywhere","name":"Prayer Times Anywhere","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:23:03Z"},{"id":"wordfence:8b4ddcc5-a046-494e-a79f-c4c41969481e","source":"wordfence","cve":"CVE-2025-68030","title":"Frontis Blocks <= 1.1.5 - Unauthenticated Server-Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4ddcc5-a046-494e-a79f-c4c41969481e?source=api-prod","affected":[{"type":"plugin","slug":"frontis-blocks","name":"Frontis Blocks \u2014 Block Library for the Block Editor","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:02:44Z"},{"id":"wordfence:8b4e2f87-e3ad-4f1b-b647-f5e5a49f691b","source":"wordfence","cve":"CVE-2025-6688","title":"Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4e2f87-e3ad-4f1b-b647-f5e5a49f691b?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"1.3.6","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2025-06-26T00:00:00Z","updated":"2025-06-27T07:22:23Z"},{"id":"wordfence:8b4effc8-7b24-4a6c-a161-176a22de6d6a","source":"wordfence","cve":"CVE-2024-4668","title":"Gum Elementor Addon <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4effc8-7b24-4a6c-a161-176a22de6d6a?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-05-29T21:25:23Z","updated":"2024-05-30T09:30:40Z"},{"id":"wordfence:8b4fcc97-1b6b-4411-8b55-0ef7a2c8d44e","source":"wordfence","cve":"CVE-2021-36888","title":"Image Hover Effects Ultimate <= 9.6.1 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4fcc97-1b6b-4411-8b55-0ef7a2c8d44e?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.6.1","to_inclusive":true,"patched_in":"9.6.2"}],"published":"2021-12-15T14:44:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b504c90-4ece-4e09-8c19-710e1d3762cd","source":"wordfence","cve":"CVE-2026-39746","title":"Booknetic <= 4.8.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b504c90-4ece-4e09-8c19-710e1d3762cd?source=api-prod","affected":[{"type":"plugin","slug":"booknetic","name":"Booknetic","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:25:12Z","updated":"2026-10-08T23:40:11Z"},{"id":"wordfence:8b507369-49f7-4a1d-900b-c7bef40aec96","source":"wordfence","cve":"CVE-2024-12300","title":"AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload","severity":"low","cvss":3.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b507369-49f7-4a1d-900b-c7bef40aec96?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-wordpress","name":"AR for WordPress","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2024-12-12T14:54:29Z","updated":"2024-12-13T03:24:37Z"},{"id":"wordfence:8b510ffb-27fe-41f2-8176-676cf9540ee8","source":"wordfence","cve":"CVE-2022-0643","title":"Bank Mellat <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b510ffb-27fe-41f2-8176-676cf9540ee8?source=api-prod","affected":[{"type":"plugin","slug":"bank-mellat","name":"Online Payment for Bank Mellat","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-03-01T00:00:00Z","updated":"2024-09-04T21:21:32Z"},{"id":"wordfence:8b51556f-5a42-4061-80d8-bd37a6405a7a","source":"wordfence","cve":"CVE-2026-17559","title":"Passster \u2013 Password Protect Pages and Content < 4.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b51556f-5a42-4061-80d8-bd37a6405a7a?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":false,"patched_in":"4.3.9"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:07:33Z"},{"id":"wordfence:8b56ca04-c6eb-401f-aa8a-b933c0527e51","source":"wordfence","cve":"CVE-2026-11392","title":"WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b56ca04-c6eb-401f-aa8a-b933c0527e51?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-07-09T14:45:55Z","updated":"2026-07-10T03:31:16Z"},{"id":"wordfence:8b56dcd7-f261-42db-833d-5673c8805bb4","source":"wordfence","cve":"CVE-2014-4932","title":"Wordfence <= 5.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b56dcd7-f261-42db-833d-5673c8805bb4?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":false,"patched_in":"5.1.5"}],"published":"2014-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b56fd35-377a-4d18-abf7-7946e5d4e21c","source":"wordfence","cve":"CVE-2024-56255","title":"AyeCode Connect <= 1.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b56fd35-377a-4d18-abf7-7946e5d4e21c?source=api-prod","affected":[{"type":"plugin","slug":"ayecode-connect","name":"AyeCode Connect","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:45:27Z"},{"id":"wordfence:8b57249c-f85b-4698-8212-f3e88c1bc141","source":"wordfence","cve":"CVE-2025-30790","title":"Chatbox Manager <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b57249c-f85b-4698-8212-f3e88c1bc141?source=api-prod","affected":[{"type":"plugin","slug":"wa-chatbox-manager","name":"Chatbox Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:34:56Z"},{"id":"wordfence:8b5b0d41-165b-4e4b-8bf2-d8c36880a2ea","source":"wordfence","cve":"CVE-2026-27383","title":"Metro <= 2.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b5b0d41-165b-4e4b-8bf2-d8c36880a2ea?source=api-prod","affected":[{"type":"theme","slug":"metro","name":"metro","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T14:46:43Z"},{"id":"wordfence:8b5cbabb-e236-4abd-a195-9689cb9aa785","source":"wordfence","cve":"CVE-2026-27326","title":"AC Services | HVAC, Air Conditioning & Heating Company WordPress <= 1.2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b5cbabb-e236-4abd-a195-9689cb9aa785?source=api-prod","affected":[{"type":"theme","slug":"window-ac-services","name":"AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T18:21:45Z"},{"id":"wordfence:8b5db7fa-2e72-4719-b85e-cc31778c2274","source":"wordfence","cve":"CVE-2026-12122","title":"Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b5db7fa-2e72-4719-b85e-cc31778c2274?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-07-01T20:00:36Z","updated":"2026-07-02T08:33:06Z"},{"id":"wordfence:8b5e86be-8a35-48d8-a676-9f7074b81cb7","source":"wordfence","cve":"CVE-2022-47608","title":"Quick Contact Form <= 8.0.3.1 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b5e86be-8a35-48d8-a676-9f7074b81cb7?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.0.3.1","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b602f33-ae2f-4349-a8be-901a9eec91c3","source":"wordfence","cve":"CVE-2019-15889","title":"WordPress Download Manager <= 2.9.93 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b602f33-ae2f-4349-a8be-901a9eec91c3?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.94","to_inclusive":false,"patched_in":"2.9.94"}],"published":"2019-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b639c5c-e4ff-4e43-9088-249c75046d39","source":"wordfence","cve":"CVE-2024-22150","title":"Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b639c5c-e4ff-4e43-9088-249c75046d39?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-elementor","name":"PowerFolio \u2013 Portfolio & Image Gallery for Elementor","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b65d1d1-2fa1-4aa5-8e40-9d24cd0251e0","source":"wordfence","cve":"CVE-2025-27348","title":"WP Social SEO Booster \u2013 Knowledge Graph Social Signals SEO <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b65d1d1-2fa1-4aa5-8e40-9d24cd0251e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-seo-booster","name":"WP Social SEO Booster \u2013 Knowledge Graph Social Signals SEO","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:19:59Z"},{"id":"wordfence:8b669c19-c8fc-4cb5-b2bc-d9e5c4e08231","source":"wordfence","cve":"CVE-2025-68045","title":"Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b669c19-c8fc-4cb5-b2bc-d9e5c4e08231?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"4.1.13"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:02:09Z"},{"id":"wordfence:8b67557c-785f-433b-8e5b-fcc0bda14892","source":"wordfence","cve":"CVE-2026-11802","title":"FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b67557c-785f-433b-8e5b-fcc0bda14892?source=api-prod","affected":[{"type":"plugin","slug":"foodbook-light-online-food-ordering-system","name":"FoodBook Lite \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2026-07-13T13:10:51Z","updated":"2026-07-14T01:30:02Z"},{"id":"wordfence:8b6c6e10-3feb-4ecd-a17a-81e15c471d3d","source":"wordfence","cve":"CVE-2024-2142","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b6c6e10-3feb-4ecd-a17a-81e15c471d3d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T06:44:46Z"},{"id":"wordfence:8b6e18dd-cb00-4cff-8cda-bf8f7df1cb27","source":"wordfence","cve":"CVE-2025-22312","title":"Thim Elementor Kit <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b6e18dd-cb00-4cff-8cda-bf8f7df1cb27?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.9.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-30T22:09:11Z"},{"id":"wordfence:8b707d85-ba12-4f54-bd86-6f11d47515e0","source":"wordfence","cve":"CVE-2025-23662","title":"WP Panoramio <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b707d85-ba12-4f54-bd86-6f11d47515e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-panoramio","name":"WP Panoramio","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-22T14:58:09Z"},{"id":"wordfence:8b7321e8-153c-4586-8114-65583e06573e","source":"wordfence","cve":"CVE-2023-52202","title":"HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7321e8-153c-4586-8114-65583e06573e?source=api-prod","affected":[{"type":"plugin","slug":"html5-mp3-player-with-mp3-folder-feedburner-playlist","name":"HTML5 MP3 Player with Folder Feedburner Playlist Free","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b73f864-68b5-4ba8-93a3-37f2564cc240","source":"wordfence","cve":"CVE-2024-4468","title":"Salon booking system <= 9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-280","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b73f864-68b5-4ba8-93a3-37f2564cc240?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.9","to_inclusive":true,"patched_in":"10.0"}],"published":"2024-06-07T19:08:35Z","updated":"2024-06-08T07:37:38Z"},{"id":"wordfence:8b771d76-b79a-4ff2-9433-8d35734a4396","source":"wordfence","cve":"CVE-2023-46152","title":"WOLF <= 1.0.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b771d76-b79a-4ff2-9433-8d35734a4396?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.7.1","to_inclusive":true,"patched_in":"1.0.7.2"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b776a8a-b071-4caf-9e67-6f08ace4da2a","source":"wordfence","cve":"CVE-2019-15774","title":"ND Booking <= 2.4 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b776a8a-b071-4caf-9e67-6f08ace4da2a?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":false,"patched_in":"2.5"}],"published":"2019-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b777b19-ca0a-4082-80ee-e18a31ba6308","source":"wordfence","cve":"CVE-2024-11935","title":"Email Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b777b19-ca0a-4082-80ee-e18a31ba6308?source=api-prod","affected":[{"type":"plugin","slug":"email-address-obfuscation","name":"Email Address Obfuscation","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-12-03T23:42:14Z","updated":"2024-12-04T12:37:46Z"},{"id":"wordfence:8b77eff6-52a0-4f51-9b14-a58dec454466","source":"wordfence","cve":"CVE-2025-32305","title":"FlatNews <= 5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b77eff6-52a0-4f51-9b14-a58dec454466?source=api-prod","affected":[{"type":"theme","slug":"flatnews","name":"FlatNews \u2013 Responsive Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"6.2"}],"published":"2025-06-03T00:00:00Z","updated":"2026-02-25T13:23:38Z"},{"id":"wordfence:8b783b94-7135-49c1-aff2-1c2ea24bbfcd","source":"wordfence","cve":"","title":"CIP4 Folder Download Widget < 1.11 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b783b94-7135-49c1-aff2-1c2ea24bbfcd?source=api-prod","affected":[{"type":"plugin","slug":"cip4-folder-download-widget","name":"CIP4 Folder Download Widget","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":false,"patched_in":"1.11"}],"published":"2015-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b79fa47-f045-44e9-84b8-60aa3a302dac","source":"wordfence","cve":"CVE-2015-1000004","title":"filedownload plugin <= 1.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b79fa47-f045-44e9-84b8-60aa3a302dac?source=api-prod","affected":[{"type":"plugin","slug":"filedownload","name":"filedownload","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"2.0"}],"published":"2015-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b7ab27f-566f-46f4-9c8e-aedfa3410dec","source":"wordfence","cve":"","title":"SocialGrid <= 2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7ab27f-566f-46f4-9c8e-aedfa3410dec?source=api-prod","affected":[{"type":"plugin","slug":"socialgrid","name":"SocialGrid","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2011-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b7c9d89-c6bf-4973-87c8-0511758519f7","source":"wordfence","cve":"CVE-2019-16119","title":"Photo Gallery by 10Web <= 1.5.34 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7c9d89-c6bf-4973-87c8-0511758519f7?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.35","to_inclusive":false,"patched_in":"1.5.35"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b7d7373-e38a-428c-be8c-a5b05e8dc1e9","source":"wordfence","cve":"CVE-2013-7419","title":"JS MultiHotel <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7d7373-e38a-428c-be8c-a5b05e8dc1e9?source=api-prod","affected":[{"type":"plugin","slug":"js-multihotel","name":"JS Multi Hotel","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2013-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b7dd3c0-a91f-4fb4-a47e-38f6d389bf65","source":"wordfence","cve":"CVE-2025-54711","title":"Info Cards <= 1.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7dd3c0-a91f-4fb4-a47e-38f6d389bf65?source=api-prod","affected":[{"type":"plugin","slug":"info-cards","name":"Info Cards \u2013 Add Text and Media in Card Layouts","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-26T00:00:00Z","updated":"2025-11-12T13:51:35Z"},{"id":"wordfence:8b7e1da1-8e40-4119-894d-43e82e188608","source":"wordfence","cve":"CVE-2026-42737","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.10 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b7e1da1-8e40-4119-894d-43e82e188608?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.11"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-18T18:29:07Z"},{"id":"wordfence:8b80c7e0-73a1-42fc-8248-f2a1710297fe","source":"wordfence","cve":"CVE-2024-51925","title":"Testimonial Slider Shortcode <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b80c7e0-73a1-42fc-8248-f2a1710297fe?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-shortcode","name":"Testimonial Slider Shortcode","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:10:59Z"},{"id":"wordfence:8b818586-99a2-4865-bd5b-3c77e9aca29e","source":"wordfence","cve":"CVE-2025-39463","title":"Dessau < 1.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b818586-99a2-4865-bd5b-3c77e9aca29e?source=api-prod","affected":[{"type":"theme","slug":"dessau","name":"Dessau - Contemporary Theme for Architects and Interior Designers","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:36:41Z"},{"id":"wordfence:8b81f965-9ade-477f-98f0-c0742a797298","source":"wordfence","cve":"CVE-2024-52501","title":"Office Locator <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b81f965-9ade-477f-98f0-c0742a797298?source=api-prod","affected":[{"type":"plugin","slug":"office-locator","name":"Office Locator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:27:05Z"},{"id":"wordfence:8b8372e0-ab18-4817-b293-b75f4855620d","source":"wordfence","cve":"CVE-2025-48083","title":"wpNamedUsers <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8372e0-ab18-4817-b293-b75f4855620d?source=api-prod","affected":[{"type":"plugin","slug":"wpnamedusers","name":"wpNamedUsers","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-22T20:42:43Z"},{"id":"wordfence:8b83bf61-c957-47a1-9e83-ec27edac8108","source":"wordfence","cve":"CVE-2026-115241","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.137 - Authenticated (Administrator+) Arbitrary Database Table Deletion","severity":"low","cvss":2.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b83bf61-c957-47a1-9e83-ec27edac8108?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.137","to_inclusive":false,"patched_in":"0.9.137"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T15:30:08Z"},{"id":"wordfence:8b84cc59-3820-4aba-a2d7-fa884b46c5b4","source":"wordfence","cve":"CVE-2022-41650","title":"Custom Content by Country <= 3.1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b84cc59-3820-4aba-a2d7-fa884b46c5b4?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-by-country","name":"Custom Content by Country (by Shield Security)","from":"3.1.2","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b85b1e3-4eb0-4ba1-8d61-ec82fac123ce","source":"wordfence","cve":"CVE-2018-5365","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b85b1e3-4eb0-4ba1-8d61-ec82fac123ce?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b865fde-1c47-4574-932c-334ebefb3579","source":"wordfence","cve":"CVE-2009-4672","title":"Lytebox <= 1.3 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b865fde-1c47-4574-932c-334ebefb3579?source=api-prod","affected":[{"type":"plugin","slug":"wp-lytebox","name":"wp-lytebox","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2009-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b88b195-6c02-4a11-91de-d21c808650fb","source":"wordfence","cve":"CVE-2024-37230","title":"Book Landing Page <= 1.2.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b88b195-6c02-4a11-91de-d21c808650fb?source=api-prod","affected":[{"type":"theme","slug":"book-landing-page","name":"Book Landing Page","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:34:17Z"},{"id":"wordfence:8b8b7ee8-4c11-4353-b664-761955d49b8c","source":"wordfence","cve":"CVE-2021-24614","title":"Book appointment online <= 1.38 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8b7ee8-4c11-4353-b664-761955d49b8c?source=api-prod","affected":[{"type":"plugin","slug":"book-appointment-online","name":"Book appointment online","from":"*","from_inclusive":true,"to":"1.38","to_inclusive":true,"patched_in":"1.39"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b8c85f2-11c7-491f-9b91-0ddf4814e40d","source":"wordfence","cve":"CVE-2026-22422","title":"Everest Forms <= 3.4.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8c85f2-11c7-491f-9b91-0ddf4814e40d?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-09-26T00:00:00Z","updated":"2026-05-04T15:15:13Z"},{"id":"wordfence:8b8d21cb-fe87-4947-a44b-7d670cf2123e","source":"wordfence","cve":"CVE-2025-2166","title":"CM FAQ  \u2013 Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8d21cb-fe87-4947-a44b-7d670cf2123e?source=api-prod","affected":[{"type":"plugin","slug":"cm-faq","name":"CM FAQ  \u2013 Simplify support with an intuitive FAQ management tool","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:33Z"},{"id":"wordfence:8b8d4431-ac72-45a2-b4a1-19690946d0ee","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8d4431-ac72-45a2-b4a1-19690946d0ee?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:57:16Z"},{"id":"wordfence:8b8e3cb9-00b3-4500-adf0-c8a9fbf9d546","source":"wordfence","cve":"CVE-2025-13880","title":"WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8e3cb9-00b3-4500-adf0-c8a9fbf9d546?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-reviews","name":"WP Social Ninja \u2013 Embed Social Feeds, User Reviews & Chat Widgets","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-12-16T16:22:36Z","updated":"2025-12-17T04:31:31Z"},{"id":"wordfence:8b932141-5adc-4ec2-9b4f-c6ba610de1b9","source":"wordfence","cve":"CVE-2026-42752","title":"Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b932141-5adc-4ec2-9b4f-c6ba610de1b9?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.98","to_inclusive":true,"patched_in":"2.0.99"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-02T11:19:40Z"},{"id":"wordfence:8b93655b-9a26-4515-8ae2-105271aba9c4","source":"wordfence","cve":"CVE-2024-4180","title":"The Events Calendar <= 6.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b93655b-9a26-4515-8ae2-105271aba9c4?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.0.1"}],"published":"2024-05-14T00:00:00Z","updated":"2024-06-06T13:35:50Z"},{"id":"wordfence:8b968849-32ef-4cc9-8ac6-5477b2906952","source":"wordfence","cve":"CVE-2024-5032","title":"SULly <= 4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b968849-32ef-4cc9-8ac6-5477b2906952?source=api-prod","affected":[{"type":"plugin","slug":"sully","name":"SULly","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:21:57Z"},{"id":"wordfence:8b9843bf-97d4-4dd4-be9f-7e7679fcf5aa","source":"wordfence","cve":"CVE-2025-28937","title":"Lava Ajax Search <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9843bf-97d4-4dd4-be9f-7e7679fcf5aa?source=api-prod","affected":[{"type":"plugin","slug":"lava-ajax-search","name":"Lava Ajax Search","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:16:10Z"},{"id":"wordfence:8b9a40e6-2b63-4866-9eec-ff09e73dc8fb","source":"wordfence","cve":"CVE-2025-0329","title":"AI ChatBot for WordPress \u2013 WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9a40e6-2b63-4866-9eec-ff09e73dc8fb?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-30T19:04:58Z"},{"id":"wordfence:8b9ba35b-5ef8-4170-97f4-400fe9bd3af2","source":"wordfence","cve":"CVE-2025-9627","title":"Run Log <= 1.7.10 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9ba35b-5ef8-4170-97f4-400fe9bd3af2?source=api-prod","affected":[{"type":"plugin","slug":"run-log","name":"Run Log","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2025-09-10T18:53:02Z","updated":"2025-10-21T21:00:32Z"},{"id":"wordfence:8b9debd8-bb92-4966-a0b9-7920a447a313","source":"wordfence","cve":"CVE-2025-15673","title":"Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9debd8-bb92-4966-a0b9-7920a447a313?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":false,"patched_in":"2.4.3"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-14T12:53:55Z"},{"id":"wordfence:8b9e3aaf-5182-4622-9b5b-d67af200e2b6","source":"wordfence","cve":"CVE-2022-0439","title":"Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9e3aaf-5182-4622-9b5b-d67af200e2b6?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"5.3.2"}],"published":"2022-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b9e69f0-7b21-4cc5-924c-1556764cbb0d","source":"wordfence","cve":"CVE-2025-69351","title":"Ninja Tables <= 5.2.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9e69f0-7b21-4cc5-924c-1556764cbb0d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T17:54:18Z"},{"id":"wordfence:8b9ea717-65a3-49a3-80ca-a91797e8465c","source":"wordfence","cve":"CVE-2026-65563","title":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9ea717-65a3-49a3-80ca-a91797e8465c?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:36:07Z"},{"id":"wordfence:8b9f171f-56d8-4ab9-bf61-0daa7c0d928f","source":"wordfence","cve":"CVE-2023-49762","title":"AppMySite <= 3.11.0 - Unauthenticated Information Disclsoure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9f171f-56d8-4ab9-bf61-0daa7c0d928f?source=api-prod","affected":[{"type":"plugin","slug":"appmysite","name":"AppMySite \u2013 WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.11.1"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8b9fe020-1bec-4891-b2c5-a0a8f6349f0f","source":"wordfence","cve":"CVE-2026-56041","title":"Responsive Lightbox & Gallery <= 2.7.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9fe020-1bec-4891-b2c5-a0a8f6349f0f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:05:24Z"},{"id":"wordfence:8ba30cbb-7a20-47aa-bbd6-82fdb27d4705","source":"wordfence","cve":"CVE-2006-1012","title":"WordPress Core <= 1.5.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba30cbb-7a20-47aa-bbd6-82fdb27d4705?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"2.0"}],"published":"2005-12-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ba5ec9f-8746-43cd-83df-4e71a8d6e5d1","source":"wordfence","cve":"CVE-2026-94677","title":"Kadence WooCommerce Email Designer <= 1.5.19.1 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba5ec9f-8746-43cd-83df-4e71a8d6e5d1?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.19.1","to_inclusive":true,"patched_in":"1.5.19.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:56:13Z"},{"id":"wordfence:8ba608a6-16f3-4ded-a08e-53bc75f73d2f","source":"wordfence","cve":"CVE-2026-28009","title":"DroneX <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba608a6-16f3-4ded-a08e-53bc75f73d2f?source=api-prod","affected":[{"type":"theme","slug":"dronex","name":"DroneX","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:41:28Z"},{"id":"wordfence:8ba63df6-ae71-4320-bb82-87d6e17cc47d","source":"wordfence","cve":"CVE-2026-93901","title":"Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba63df6-ae71-4320-bb82-87d6e17cc47d?source=api-prod","affected":[{"type":"plugin","slug":"optima-express","name":"Optima Express IDX","from":"*","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":"8.7.6"}],"published":"2026-09-24T18:52:57Z","updated":"2026-09-25T07:40:29Z"},{"id":"wordfence:8ba6749d-22bd-4021-95d7-9db4d9ecaceb","source":"wordfence","cve":"CVE-2026-110504","title":"Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba6749d-22bd-4021-95d7-9db4d9ecaceb?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"1.1.3","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:22:21Z"},{"id":"wordfence:8ba90d0f-5ef9-4931-85a9-edf08275510f","source":"wordfence","cve":"CVE-2022-1630","title":"WP-EMail <= 2.68.2 - Cross-Site Request Forgery to Log Deletion","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ba90d0f-5ef9-4931-85a9-edf08275510f?source=api-prod","affected":[{"type":"plugin","slug":"wp-email","name":"WP-EMail","from":"*","from_inclusive":true,"to":"2.69.0","to_inclusive":false,"patched_in":"2.69.0"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bab0acc-5a5d-4dd4-9201-199b7f5aaa69","source":"wordfence","cve":"CVE-2024-6282","title":"Master Addons \u2013 Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bab0acc-5a5d-4dd4-9201-199b7f5aaa69?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.4","to_inclusive":true,"patched_in":"2.0.6.5"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T11:30:31Z"},{"id":"wordfence:8babc42a-c45c-423f-bd09-da7afb947691","source":"wordfence","cve":"CVE-2023-41849","title":"Posts Like Dislike <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8babc42a-c45c-423f-bd09-da7afb947691?source=api-prod","affected":[{"type":"plugin","slug":"posts-like-dislike","name":"Posts Like Dislike","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-08-21T00:00:00Z","updated":"2024-10-24T18:57:28Z"},{"id":"wordfence:8bac8450-7ea9-4859-a8f6-97311345f290","source":"wordfence","cve":"CVE-2026-13690","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP < 1.2.67 - Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bac8450-7ea9-4859-a8f6-97311345f290?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.67","to_inclusive":false,"patched_in":"1.2.67"}],"published":"2026-07-08T00:00:00Z","updated":"2026-08-04T20:08:20Z"},{"id":"wordfence:8bb172cc-b7a6-401d-a246-1918702d654d","source":"wordfence","cve":"CVE-2024-13341","title":"MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb172cc-b7a6-401d-a246-1918702d654d?source=api-prod","affected":[{"type":"plugin","slug":"WooCommerce-Multi-Locations-Inventory-Management","name":"MultiLoca - WooCommerce Multi Locations Inventory Management","from":"*","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"4.1.12"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T06:41:50Z"},{"id":"wordfence:8bb2ce22-077b-41dd-a2ff-cc1db9d20d38","source":"wordfence","cve":"CVE-2023-6827","title":"Essential Real Estate <= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb2ce22-077b-41dd-a2ff-cc1db9d20d38?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-12-14T00:00:00Z","updated":"2024-02-06T15:11:18Z"},{"id":"wordfence:8bb330be-f12c-475c-97b6-745a1e6edb58","source":"wordfence","cve":"CVE-2023-25976","title":"Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.2.2 - Cross-Site Request Forgery via settings_page function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb330be-f12c-475c-97b6-745a1e6edb58?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zoho","name":"WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u2013 CRM, Bigin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bb34d74-4d13-4e7a-b78d-5691eb778401","source":"wordfence","cve":"CVE-2026-49056","title":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb34d74-4d13-4e7a-b78d-5691eb778401?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-11T13:25:15Z"},{"id":"wordfence:8bb385d5-b5a1-4068-8897-7360e5ab1b1e","source":"wordfence","cve":"CVE-2026-104386","title":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress <= 9.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb385d5-b5a1-4068-8897-7360e5ab1b1e?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"9.1.3","to_inclusive":true,"patched_in":"9.1.4"}],"published":"2026-10-05T08:34:00Z","updated":"2026-10-08T23:22:26Z"},{"id":"wordfence:8bb3ee9d-084a-42f6-bf9c-e398ddde56ed","source":"wordfence","cve":"CVE-2025-57990","title":"Blog Designer <= 3.1.8 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb3ee9d-084a-42f6-bf9c-e398ddde56ed?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer","name":"Blog Designer","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:25:28Z"},{"id":"wordfence:8bb5abff-d762-459a-b96c-5cbbb9f5a22e","source":"wordfence","cve":"CVE-2023-25036","title":"Social Media Icons Widget <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb5abff-d762-459a-b96c-5cbbb9f5a22e?source=api-prod","affected":[{"type":"plugin","slug":"spoontalk-social-media-icons-widget","name":"Social Media Icons Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bb71f5d-a766-4f39-a2c6-78644cdd2882","source":"wordfence","cve":"CVE-2025-32270","title":"Broadstreet <= 1.51.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb71f5d-a766-4f39-a2c6-78644cdd2882?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.51.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2025-04-04T00:00:00Z","updated":"2026-02-02T15:30:44Z"},{"id":"wordfence:8bb9b6e3-0c86-44aa-9e26-9de656822f59","source":"wordfence","cve":"CVE-2025-49248","title":"Team Showcase < 25.05.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb9b6e3-0c86-44aa-9e26-9de656822f59?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-cm","name":"Team Showcase","from":"*","from_inclusive":true,"to":"25.05.13","to_inclusive":false,"patched_in":"25.05.13"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:46:28Z"},{"id":"wordfence:8bbb473a-055c-421a-89d2-d25c46939731","source":"wordfence","cve":"CVE-2024-51901","title":"Smooth Maps <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bbb473a-055c-421a-89d2-d25c46939731?source=api-prod","affected":[{"type":"plugin","slug":"colour-smooth-maps","name":"Smooth Maps","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:54:06Z"},{"id":"wordfence:8bbc0b64-7d9e-4f76-bde4-25c625a4213e","source":"wordfence","cve":"CVE-2025-31891","title":"Gosign \u2013 Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bbc0b64-7d9e-4f76-bde4-25c625a4213e?source=api-prod","affected":[{"type":"plugin","slug":"gosign-posts-slider-block","name":"Gosign \u2013 Posts Slider Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:27:55Z"},{"id":"wordfence:8bbc6aa7-0625-4689-8afe-d7399009ee53","source":"wordfence","cve":"CVE-2023-35043","title":"Recent Posts Slider <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bbc6aa7-0625-4689-8afe-d7399009ee53?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-slider","name":"Recent Posts Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bbcbefa-f38d-4752-acca-3545976cc59f","source":"wordfence","cve":"CVE-2023-0552","title":"Pie Register <= 3.8.2.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bbcbefa-f38d-4752-acca-3545976cc59f?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.2.2","to_inclusive":true,"patched_in":"3.8.2.3"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bc0969f-7b29-41fb-8d41-869049f87c7d","source":"wordfence","cve":"CVE-2021-24222","title":"WP-Curriculo Vitae Free <= 6.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc0969f-7b29-41fb-8d41-869049f87c7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-curriculo-vitae","name":"WP-Curriculo Vitae Free","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":""}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bc34490-66a1-4e43-83a4-b6e680237008","source":"wordfence","cve":"CVE-2022-36404","title":"Simple SEO <= 1.8.12 - Cross-Site Request Forgery to Sitemap Deletion/Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc34490-66a1-4e43-83a4-b6e680237008?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bc41c61-1d8a-445f-bd70-3b14a40c89d4","source":"wordfence","cve":"CVE-2026-3897","title":"Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc41c61-1d8a-445f-bd70-3b14a40c89d4?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-beaver-builder","name":"Livemesh Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:34:25Z","updated":"2026-05-27T06:46:16Z"},{"id":"wordfence:8bc78a2b-dc7c-4ee9-8721-e644f3670091","source":"wordfence","cve":"CVE-2025-23854","title":"Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com <= 3.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc78a2b-dc7c-4ee9-8721-e644f3670091?source=api-prod","affected":[{"type":"plugin","slug":"shoutcast-and-icecast-html5-web-radio-player-by-yesstreaming-com","name":"Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:30:29Z"},{"id":"wordfence:8bc861b2-1e8a-42be-b70b-e9f9224bd8bb","source":"wordfence","cve":"CVE-2026-1235","title":"eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc861b2-1e8a-42be-b70b-e9f9224bd8bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-02-25T15:44:22Z"},{"id":"wordfence:8bc86a29-cb1f-4711-925c-51dbbf682477","source":"wordfence","cve":"CVE-2026-15335","title":"Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc86a29-cb1f-4711-925c-51dbbf682477?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.20","to_inclusive":true,"patched_in":"1.7.21"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-11T03:44:25Z"},{"id":"wordfence:8bc96b4f-256e-491b-9d27-de1adbf67643","source":"wordfence","cve":"CVE-2026-2029","title":"Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bc96b4f-256e-491b-9d27-de1adbf67643?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-beaver-builder","name":"Livemesh Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:50:36Z","updated":"2026-02-26T01:24:15Z"},{"id":"wordfence:8bca36f7-4087-4378-b4f6-6c0bb24f24ff","source":"wordfence","cve":"CVE-2025-58846","title":"WordPress Buffer \u2013 HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule <= 2020.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bca36f7-4087-4378-b4f6-6c0bb24f24ff?source=api-prod","affected":[{"type":"plugin","slug":"buffer-my-post","name":"WordPress Buffer \u2013 HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule","from":"*","from_inclusive":true,"to":"2020.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:56:31Z"},{"id":"wordfence:8bcae8d6-6dbd-4174-85ff-0b52d8e45c84","source":"wordfence","cve":"CVE-2024-25097","title":"TNC PDF viewer <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcae8d6-6dbd-4174-85ff-0b52d8e45c84?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-by-themencode","name":"TNC PDF viewer","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:30:50Z"},{"id":"wordfence:8bccefbe-2d20-40a7-b24f-d867d80250e3","source":"wordfence","cve":"CVE-2023-45834","title":"Libsyn Publisher Hub <= 1.4.4 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bccefbe-2d20-40a7-b24f-d867d80250e3?source=api-prod","affected":[{"type":"plugin","slug":"libsyn-podcasting","name":"Libsyn Publisher Hub","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bcd2c5e-4969-4530-b3ab-930c5051d8f1","source":"wordfence","cve":"CVE-2024-1533","title":"Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd2c5e-4969-4530-b3ab-930c5051d8f1?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:21:41Z"},{"id":"wordfence:8bcd44c3-75e6-453f-a9e7-3a547eba55e1","source":"wordfence","cve":"CVE-2024-11362","title":"Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.112.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd44c3-75e6-453f-a9e7-3a547eba55e1?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"*","from_inclusive":true,"to":"1.112.0","to_inclusive":true,"patched_in":"1.113.0"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:8bcd5259-2e35-41f6-b269-5b679e4eaab9","source":"wordfence","cve":"CVE-2026-7556","title":"FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd5259-2e35-41f6-b269-5b679e4eaab9?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.49.7212","to_inclusive":true,"patched_in":"7.5.50.7212"}],"published":"2026-06-08T13:48:41Z","updated":"2026-06-09T02:28:48Z"},{"id":"wordfence:8bcdaf14-aa5d-4c23-8250-8d0d22ac6191","source":"wordfence","cve":"CVE-2026-56059","title":"Travel Booking <= 2.2.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcdaf14-aa5d-4c23-8250-8d0d22ac6191?source=api-prod","affected":[{"type":"theme","slug":"travel-booking","name":"Travel Booking","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:47:24Z"},{"id":"wordfence:8bced7df-3e1a-4d7b-9ad0-64be5e18900f","source":"wordfence","cve":"CVE-2026-4888","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bced7df-3e1a-4d7b-9ad0-64be5e18900f?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2026-05-27T10:58:29Z","updated":"2026-05-27T23:26:34Z"},{"id":"wordfence:8bcf22c7-bea5-4108-8fb4-ff9ff566c618","source":"wordfence","cve":"CVE-2017-18513","title":"Responsive Menu <= 3.1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcf22c7-bea5-4108-8fb4-ff9ff566c618?source=api-prod","affected":[{"type":"plugin","slug":"responsive-menu","name":"Responsive Menu \u2013 Mobile Menu & Hamburger Menu Builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2020-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bcfbc26-9b5d-4df8-9f16-293734bd2805","source":"wordfence","cve":"CVE-2024-13490","title":"LTL Freight Quotes \u2013 XPO Edition <= 4.3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcfbc26-9b5d-4df8-9f16-293734bd2805?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-xpo-edition","name":"LTL Freight Quotes \u2013 XPO Edition","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T09:22:51Z"},{"id":"wordfence:8bd035bf-003f-4f97-be76-7b1c50727d21","source":"wordfence","cve":"CVE-2026-23800","title":"Modular DS  2.5.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd035bf-003f-4f97-be76-7b1c50727d21?source=api-prod","affected":[{"type":"plugin","slug":"modular-connector","name":"Modular DS: Monitor, update, and backup multiple websites","from":"2.5.2","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T20:22:32Z"},{"id":"wordfence:8bd04a52-ed59-4305-831e-646ab5801d36","source":"wordfence","cve":"","title":"WPS Cleaner <= 1.4.4 - Arbitrary Media File Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd04a52-ed59-4305-831e-646ab5801d36?source=api-prod","affected":[{"type":"plugin","slug":"wps-cleaner","name":"WPS Cleaner","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bd18b7a-6555-4838-821d-fcbe0be34ac4","source":"wordfence","cve":"CVE-2025-6387","title":"WP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd18b7a-6555-4838-821d-fcbe0be34ac4?source=api-prod","affected":[{"type":"plugin","slug":"wp-get-the-table","name":"WP Get The Table","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-07-23T20:40:47Z","updated":"2025-11-05T21:37:49Z"},{"id":"wordfence:8bd4a111-9d60-4ff7-83bc-24e9aaeff907","source":"wordfence","cve":"CVE-2026-22391","title":"Cocco <= 1.5.1 - Authenticated (Subscriber+) Authenticated Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd4a111-9d60-4ff7-83bc-24e9aaeff907?source=api-prod","affected":[{"type":"theme","slug":"cocco","name":"Cocco - Kids Store and Baby Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:35:23Z"},{"id":"wordfence:8bd77afe-585d-445e-adfd-48c5e0c4dca9","source":"wordfence","cve":"","title":"Super Store Finder <= 7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd77afe-585d-445e-adfd-48c5e0c4dca9?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.7"}],"published":"2025-08-21T00:00:00Z","updated":"2025-09-05T14:28:31Z"},{"id":"wordfence:8bd81f3c-f801-4fc6-b2db-754e5ebed688","source":"wordfence","cve":"CVE-2016-15004","title":"InfiniteWP Client <= 1.6.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bd81f3c-f801-4fc6-b2db-754e5ebed688?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.6.1.1","to_inclusive":false,"patched_in":"1.6.1.1"}],"published":"2017-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bdbd196-cb77-4042-86bb-7c67325c8c07","source":"wordfence","cve":"CVE-2024-43934","title":"Collapsing Archives <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bdbd196-cb77-4042-86bb-7c67325c8c07?source=api-prod","affected":[{"type":"plugin","slug":"collapsing-archives","name":"Collapsing Archives","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:58:52Z"},{"id":"wordfence:8bdcc0ec-79ce-4108-b60a-5930266bbf48","source":"wordfence","cve":"CVE-2026-57364","title":"Better Payment \u2013 Instant Payments, Donations, Fundraising with Subscriptions & More <= 2.2.0 - Unauthenticated Business Logic Flaw","severity":"medium","cvss":5.3,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bdcc0ec-79ce-4108-b60a-5930266bbf48?source=api-prod","affected":[{"type":"plugin","slug":"better-payment","name":"Better Payment \u2013 Instant Payments, Donations, Fundraising with Subscriptions & More","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:51:15Z"},{"id":"wordfence:8bde357d-e34a-4931-a1a4-bd3ed3b72cec","source":"wordfence","cve":"CVE-2021-25018","title":"PPOM for WooCommerce <= 23.9 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bde357d-e34a-4931-a1a4-bd3ed3b72cec?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"23.9","to_inclusive":true,"patched_in":"24.0"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bde77fe-b3e1-44c1-a0da-964a0cc983a5","source":"wordfence","cve":"CVE-2025-48345","title":"Contact Form 7 Editor Button <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bde77fe-b3e1-44c1-a0da-964a0cc983a5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-editor-button","name":"Contact Form 7 Editor Button","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:40:35Z"},{"id":"wordfence:8bdf6a52-7316-440b-9d36-d405a672dce1","source":"wordfence","cve":"CVE-2024-12532","title":"BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bdf6a52-7316-440b-9d36-d405a672dce1?source=api-prod","affected":[{"type":"plugin","slug":"bwd-elementor-addons","name":"BWD Elementor Addons","from":"*","from_inclusive":true,"to":"4.3.18","to_inclusive":true,"patched_in":"4.3.19"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T11:11:11Z"},{"id":"wordfence:8be16fec-8961-49ad-ba2f-8bec70c33ec0","source":"wordfence","cve":"CVE-2022-1541","title":"Video Slider WordPress <= 1.4.6 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be16fec-8961-49ad-ba2f-8bec70c33ec0?source=api-prod","affected":[{"type":"plugin","slug":"slider-video","name":"Video Slider \u2013 Slider Carousel","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8be18b89-378c-4506-a8e0-b92c2b6f2f11","source":"wordfence","cve":"CVE-2026-65577","title":"Advice - Psychology, Therapy & Counseling Theme <= 1.18.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be18b89-378c-4506-a8e0-b92c2b6f2f11?source=api-prod","affected":[{"type":"theme","slug":"advice","name":"Advice - Psychology, Therapy & Counseling Theme","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:31Z"},{"id":"wordfence:8be18dd9-4d50-4693-aded-38b583190bd8","source":"wordfence","cve":"CVE-2026-14562","title":"Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be18dd9-4d50-4693-aded-38b583190bd8?source=api-prod","affected":[{"type":"plugin","slug":"teddy-bear-customize-addon","name":"Teddy Bear Customize Addon","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:34:20Z"},{"id":"wordfence:8be739cd-e594-41a5-85a4-9cf7d3436953","source":"wordfence","cve":"CVE-2017-14719","title":"WordPress Core < 4.8.2 - Directory Traversal during unzip","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be739cd-e594-41a5-85a4-9cf7d3436953?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8be8bcd5-aabc-49a7-bedf-f29bff662ff3","source":"wordfence","cve":"CVE-2026-111409","title":"YITH PayPal Express Checkout for WooCommerce <= 1.61.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be8bcd5-aabc-49a7-bedf-f29bff662ff3?source=api-prod","affected":[{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.61.0","to_inclusive":true,"patched_in":"1.62.0"}],"published":"2026-10-16T12:52:00Z","updated":"2026-10-23T18:27:56Z"},{"id":"wordfence:8be98cba-b891-42cf-8a6c-8fe05f27c9c3","source":"wordfence","cve":"CVE-2026-4275","title":"Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8be98cba-b891-42cf-8a6c-8fe05f27c9c3?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-divi","name":"Divi Torque Lite","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-07-08T20:45:30Z","updated":"2026-07-09T09:31:21Z"},{"id":"wordfence:8bea21d9-26d1-49a5-a130-26d99818d4d3","source":"wordfence","cve":"CVE-2025-10053","title":"TableGen \u2013 Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bea21d9-26d1-49a5-a130-26d99818d4d3?source=api-prod","affected":[{"type":"plugin","slug":"table-creator","name":"TableGen \u2013 Data Table Generator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:33:29Z","updated":"2025-10-03T11:17:15Z"},{"id":"wordfence:8bebc229-9d15-439f-a8df-f68455bc5193","source":"wordfence","cve":"CVE-2023-4963","title":"WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bebc229-9d15-439f-a8df-f68455bc5193?source=api-prod","affected":[{"type":"plugin","slug":"ws-facebook-likebox","name":"WS Facebook Like Box Widget","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-14T00:00:00Z","updated":"2024-10-24T18:07:14Z"},{"id":"wordfence:8bec327f-433f-4bc6-ae50-ed4d12fef81c","source":"wordfence","cve":"CVE-2025-24749","title":"EZPZ SAML SP Single Sign On (SSO) <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bec327f-433f-4bc6-ae50-ed4d12fef81c?source=api-prod","affected":[{"type":"plugin","slug":"ezpz-sp","name":"EZPZ SAML SP Single Sign On (SSO)","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-11-05T00:00:00Z","updated":"2025-02-19T16:59:33Z"},{"id":"wordfence:8bed0637-6d1b-4c30-b87c-01c88d573ae6","source":"wordfence","cve":"CVE-2017-6514","title":"WordPress Core < 4.7.2 - Path Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bed0637-6d1b-4c30-b87c-01c88d573ae6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.7.18"}],"published":"2017-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bed0bb4-11d6-4533-a6e1-8e8986dd92d1","source":"wordfence","cve":"CVE-2025-30841","title":"Countdown & Clock <= 2.8.8 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bed0bb4-11d6-4533-a6e1-8e8986dd92d1?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:42:03Z"},{"id":"wordfence:8bee9a19-4a19-4f47-96ce-353c8fbebb24","source":"wordfence","cve":"CVE-2026-81778","title":"Kalles Addons <= 1.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bee9a19-4a19-4f47-96ce-353c8fbebb24?source=api-prod","affected":[{"type":"plugin","slug":"kalles-addons","name":"Kalles Addons","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-31T11:25:12Z","updated":"2026-09-10T19:17:52Z"},{"id":"wordfence:8bf009f5-cf9e-4d38-9679-d3abb5817d30","source":"wordfence","cve":"CVE-2023-7062","title":"Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal","severity":"high","cvss":8.8,"cwe":"CWE-538","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf009f5-cf9e-4d38-9679-d3abb5817d30?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced-shortcode","name":"Advanced File Manager Shortcodes","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-29T21:36:49Z"},{"id":"wordfence:8bf04325-e313-4a68-89a0-b560bdef5a14","source":"wordfence","cve":"CVE-2025-13141","title":"HT Mega \u2013 Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf04325-e313-4a68-89a0-b560bdef5a14?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-11-20T19:53:23Z","updated":"2025-11-21T08:28:16Z"},{"id":"wordfence:8bf0e224-d8c7-4bf9-b9a3-97545da9d90c","source":"wordfence","cve":"CVE-2023-47814","title":"BMI Calculator Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf0e224-d8c7-4bf9-b9a3-97545da9d90c?source=api-prod","affected":[{"type":"plugin","slug":"bmi-calculator-shortcode","name":"BMI Calculator Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8bf60b2c-773c-44d2-a8d8-47c30be7edc1","source":"wordfence","cve":"CVE-2025-27276","title":"Photo Gallery ( Responsive ) <= 4.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf60b2c-773c-44d2-a8d8-47c30be7edc1?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery-pearlbells","name":"Photo Gallery ( Responsive )","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:41:01Z"},{"id":"wordfence:8bf73313-3612-400f-929e-958a06314a28","source":"wordfence","cve":"CVE-2025-30776","title":"Sitekit <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf73313-3612-400f-929e-958a06314a28?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:19:48Z"},{"id":"wordfence:8bf9b130-bb1e-43fc-b5c9-337646b8976e","source":"wordfence","cve":"CVE-2026-109215","title":"LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bf9b130-bb1e-43fc-b5c9-337646b8976e?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.1","to_inclusive":true,"patched_in":"7.9.2"}],"published":"2026-10-28T21:06:28Z","updated":"2026-10-29T09:25:35Z"},{"id":"wordfence:8bfc4713-e0f0-45ec-9ac9-e5f48ba0de97","source":"wordfence","cve":"CVE-2025-32625","title":"Mobile Pages <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bfc4713-e0f0-45ec-9ac9-e5f48ba0de97?source=api-prod","affected":[{"type":"plugin","slug":"mobile-pages","name":"Mobile Blocks","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:14:13Z"},{"id":"wordfence:8bfd363d-5cf1-45f3-aa74-070d49a22718","source":"wordfence","cve":"CVE-2025-25079","title":"Simple Select All Text Box <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bfd363d-5cf1-45f3-aa74-070d49a22718?source=api-prod","affected":[{"type":"plugin","slug":"simple-select-all-text-box","name":"Simple Select All Text Box","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:31:29Z"},{"id":"wordfence:8bfefe86-b25e-4ffe-9beb-28dc22a99d62","source":"wordfence","cve":"CVE-2023-47847","title":"PayTR Taksit Tablosu <= 1.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8bfefe86-b25e-4ffe-9beb-28dc22a99d62?source=api-prod","affected":[{"type":"plugin","slug":"paytr-taksit-tablosu-woocommerce","name":"PayTR Taksit Tablosu \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-11-20T00:00:00Z","updated":"2024-08-02T15:55:24Z"},{"id":"wordfence:8c009c74-d877-46af-90b3-55292f6b2695","source":"wordfence","cve":"CVE-2026-39644","title":"Ultimate Review <= 2.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c009c74-d877-46af-90b3-55292f6b2695?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-26T18:18:33Z"},{"id":"wordfence:8c046bf6-bc0d-45b1-9424-316ae6a01a3d","source":"wordfence","cve":"CVE-2025-46252","title":"Message Filter for Contact Form 7 <= 1.6.3.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c046bf6-bc0d-45b1-9424-316ae6a01a3d?source=api-prod","affected":[{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3.2","to_inclusive":true,"patched_in":"1.6.33"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:32:00Z"},{"id":"wordfence:8c04d8c9-acad-4832-aa8a-8372c58a0387","source":"wordfence","cve":"CVE-2025-1128","title":"Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.0.9.4","to_inclusive":true,"patched_in":"3.0.9.5"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-25T06:58:31Z"},{"id":"wordfence:8c04e40a-6d94-4688-9159-07bf27a9efe0","source":"wordfence","cve":"CVE-2024-43264","title":"Create by Mediavine <= 1.9.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04e40a-6d94-4688-9159-07bf27a9efe0?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2024-08-12T00:00:00Z","updated":"2024-09-06T16:00:46Z"},{"id":"wordfence:8c052622-ac99-4069-b7df-41aea303ed9d","source":"wordfence","cve":"CVE-2026-15289","title":"Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c052622-ac99-4069-b7df-41aea303ed9d?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.17","to_inclusive":true,"patched_in":"3.2.18"}],"published":"2025-07-01T14:49:07Z","updated":"2026-07-10T04:31:23Z"},{"id":"wordfence:8c057b43-a544-4448-8370-697ad12b5e4b","source":"wordfence","cve":"CVE-2026-27327","title":"YayMail \u2013 WooCommerce Email Customizer <= 4.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c057b43-a544-4448-8370-697ad12b5e4b?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-01-06T00:00:00Z","updated":"2026-05-04T15:52:15Z"},{"id":"wordfence:8c06d7aa-ac51-4e59-9d5b-ba0961a5e637","source":"wordfence","cve":"CVE-2025-31004","title":"Rich Table of Contents <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c06d7aa-ac51-4e59-9d5b-ba0961a5e637?source=api-prod","affected":[{"type":"plugin","slug":"rich-table-of-content","name":"Rich Table of Contents","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T14:19:30Z"},{"id":"wordfence:8c076c46-c87c-4fb2-8e8e-b342c016e09a","source":"wordfence","cve":"CVE-2024-4665","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.5.0 - Insecure Direct Object Reference to (Subscriber+) Arbitrary Booking Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c076c46-c87c-4fb2-8e8e-b342c016e09a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-10-29T00:00:00Z","updated":"2025-05-29T22:14:01Z"},{"id":"wordfence:8c0b64a0-c462-4c39-bf67-e2af54ac4154","source":"wordfence","cve":"CVE-2024-38722","title":"Job Board Manager <= 2.1.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c0b64a0-c462-4c39-bf67-e2af54ac4154?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.58","to_inclusive":true,"patched_in":"2.1.59"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-09T13:36:44Z"},{"id":"wordfence:8c0dc694-854e-4f96-8c2d-7251c41a3ee9","source":"wordfence","cve":"CVE-2020-36837","title":"ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c0dc694-854e-4f96-8c2d-7251c41a3ee9?source=api-prod","affected":[{"type":"plugin","slug":"themegrill-demo-importer","name":"Starter Templates & Sites Pack by ThemeGrill","from":"1.3.4","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2020-02-16T00:00:00Z","updated":"2024-10-16T06:43:36Z"},{"id":"wordfence:8c0efb37-2510-4362-86db-e5298bea2efe","source":"wordfence","cve":"CVE-2024-54342","title":"Staggs Product Configurator for WooCommerce <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c0efb37-2510-4362-86db-e5298bea2efe?source=api-prod","affected":[{"type":"plugin","slug":"staggs","name":"STAGGS \u2013 Product Configurator Toolkit","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:08:54Z"},{"id":"wordfence:8c107e4c-1ba5-4c22-ad56-bd03342a3418","source":"wordfence","cve":"CVE-2015-2321","title":"Job Manager - < 0.7.23 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c107e4c-1ba5-4c22-ad56-bd03342a3418?source=api-prod","affected":[{"type":"plugin","slug":"job-manager","name":"Job Manager","from":"*","from_inclusive":true,"to":"0.7.23","to_inclusive":false,"patched_in":"0.7.23"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c10c649-1ef9-42d4-ab8e-a710a9f66f35","source":"wordfence","cve":"CVE-2026-111841","title":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.8.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c10c649-1ef9-42d4-ab8e-a710a9f66f35?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.8.5.2","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-10-26T08:46:00Z","updated":"2026-10-28T01:15:49Z"},{"id":"wordfence:8c10cbe0-4996-4f70-8c00-1ae866a483fc","source":"wordfence","cve":"CVE-2025-69126","title":"Fortius <= 2.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c10cbe0-4996-4f70-8c00-1ae866a483fc?source=api-prod","affected":[{"type":"theme","slug":"fortius","name":"Fortius","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:35:27Z"},{"id":"wordfence:8c10e7f5-91e7-48c8-8c84-b61138ac1665","source":"wordfence","cve":"CVE-2025-3516","title":"Simple Lightbox <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c10e7f5-91e7-48c8-8c84-b61138ac1665?source=api-prod","affected":[{"type":"plugin","slug":"simple-lightbox","name":"Simple Lightbox","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2025-04-25T00:00:00Z","updated":"2025-05-30T19:13:41Z"},{"id":"wordfence:8c13701e-424d-462f-b152-4dc5ad3ef197","source":"wordfence","cve":"CVE-2023-41955","title":"Essential Addons for Elementor <= 5.8.8 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c13701e-424d-462f-b152-4dc5ad3ef197?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.8.8","to_inclusive":true,"patched_in":"5.8.9"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c163c9e-5f63-4501-8c51-89ef47488b03","source":"wordfence","cve":"CVE-2025-22307","title":"Product Table for WooCommerce <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c163c9e-5f63-4501-8c51-89ef47488b03?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-table","name":"Product Table for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-05-12T14:10:16Z"},{"id":"wordfence:8c176594-989c-4f3a-94c9-57e1a6ff3a69","source":"wordfence","cve":"CVE-2025-23831","title":"QR Code Generator <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c176594-989c-4f3a-94c9-57e1a6ff3a69?source=api-prod","affected":[{"type":"plugin","slug":"qrcode-wprhe","name":"QR Code Generator","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:11:34Z"},{"id":"wordfence:8c1a7103-14be-46ce-bac3-fb88b7f51003","source":"wordfence","cve":"","title":"My Link Order <= 4.3 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c1a7103-14be-46ce-bac3-fb88b7f51003?source=api-prod","affected":[{"type":"plugin","slug":"my-link-order","name":"My Link Order","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2015-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c1d8c1a-3adb-4b0b-8e2a-96ee2ff94218","source":"wordfence","cve":"CVE-2021-46889","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c1d8c1a-3adb-4b0b-8e2a-96ee2ff94218?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":true,"patched_in":"1.5.69"}],"published":"2021-04-19T00:00:00Z","updated":"2024-03-29T18:01:23Z"},{"id":"wordfence:8c1e1fe4-23be-4f66-ae9f-cabb83811b71","source":"wordfence","cve":"CVE-2024-3312","title":"Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c1e1fe4-23be-4f66-ae9f-cabb83811b71?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-auto-excerpt","name":"Easy Custom Auto Excerpt","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-02T16:52:23Z"},{"id":"wordfence:8c21de03-4d62-4ecf-a2f1-57e0e416792b","source":"wordfence","cve":"CVE-2024-10672","title":"Multiple Page Generator Plugin \u2013 MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c21de03-4d62-4ecf-a2f1-57e0e416792b?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2024-11-11T14:56:50Z","updated":"2024-11-12T03:24:58Z"},{"id":"wordfence:8c26d080-978b-4a3d-827b-7e9712eb2aad","source":"wordfence","cve":"CVE-2025-22291","title":"LTL Freight Quotes \u2013 Worldwide Express Edition <= 5.0.20 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c26d080-978b-4a3d-827b-7e9712eb2aad?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-worldwide-express-edition","name":"LTL Freight Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.0.20","to_inclusive":true,"patched_in":"5.0.21"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-18T20:32:02Z"},{"id":"wordfence:8c2707ae-8dc0-417c-be4b-83db7dda9c76","source":"wordfence","cve":"CVE-2024-32514","title":"Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2707ae-8dc0-417c-be4b-83db7dda9c76?source=api-prod","affected":[{"type":"plugin","slug":"epoll-wp-voting","name":"ePoll \u2013 Contest Poll Survey & Voting","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-04-15T00:00:00Z","updated":"2024-07-18T14:21:47Z"},{"id":"wordfence:8c2747e6-dcaf-4627-801a-1a40ac12b343","source":"wordfence","cve":"CVE-2025-58709","title":"Legacy <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2747e6-dcaf-4627-801a-1a40ac12b343?source=api-prod","affected":[{"type":"theme","slug":"legacy","name":"Legacy - Antique, Vintage & Collectibles WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:28:54Z"},{"id":"wordfence:8c27fc2c-b515-4314-908d-435a4167ee99","source":"wordfence","cve":"CVE-2024-33933","title":"Elementor \u2013 Header, Footer & Blocks Template <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c27fc2c-b515-4314-908d-435a4167ee99?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.35","to_inclusive":true,"patched_in":"1.6.36"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:00:06Z"},{"id":"wordfence:8c28689f-8f0a-4645-93fc-f130dfffb7b6","source":"wordfence","cve":"CVE-2025-26551","title":"Bootstrap collapse <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c28689f-8f0a-4645-93fc-f130dfffb7b6?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-collapse","name":"Bootstrap collapse","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:33:04Z"},{"id":"wordfence:8c29046f-43f7-4198-9359-044bed598c66","source":"wordfence","cve":"CVE-2026-57387","title":"picu \u2013 Online Photo Proofing Gallery <= 3.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c29046f-43f7-4198-9359-044bed598c66?source=api-prod","affected":[{"type":"plugin","slug":"picu","name":"picu \u2013 Online Photo Proofing Gallery","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:31:51Z"},{"id":"wordfence:8c2965c0-a07f-46a2-b06c-fa2e739aea94","source":"wordfence","cve":"CVE-2024-12145","title":"BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c2965c0-a07f-46a2-b06c-fa2e739aea94?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.3.3","to_inclusive":true,"patched_in":"14.3.4"}],"published":"2026-09-10T21:43:29Z","updated":"2026-09-11T11:28:52Z"},{"id":"wordfence:8c37cc28-fde0-45c6-b49c-d6dfb296c4a5","source":"wordfence","cve":"CVE-2025-13993","title":"MailerLite \u2013 Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c37cc28-fde0-45c6-b49c-d6dfb296c4a5?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2025-12-11T21:04:21Z","updated":"2025-12-12T09:20:31Z"},{"id":"wordfence:8c384d30-be18-4dfa-a385-5a8bee38bd14","source":"wordfence","cve":"CVE-2026-57657","title":"Gmail SMTP <= 1.2.3.19 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c384d30-be18-4dfa-a385-5a8bee38bd14?source=api-prod","affected":[{"type":"plugin","slug":"gmail-smtp","name":"Gmail SMTP","from":"*","from_inclusive":true,"to":"1.2.3.19","to_inclusive":true,"patched_in":"1.2.3.20"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:34:49Z"},{"id":"wordfence:8c38ee66-fd0b-40de-b136-a2c5bf5b37f3","source":"wordfence","cve":"CVE-2025-62884","title":"Coupon Affiliates <= 7.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c38ee66-fd0b-40de-b136-a2c5bf5b37f3?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2025-06-25T00:00:00Z","updated":"2025-11-13T16:08:39Z"},{"id":"wordfence:8c3de1af-b6d4-4b14-bdca-bb67ced0778e","source":"wordfence","cve":"CVE-2025-32694","title":"Ultimate WP Mail <= 1.3.13 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c3de1af-b6d4-4b14-bdca-bb67ced0778e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-04-09T00:00:00Z","updated":"2026-10-13T17:09:49Z"},{"id":"wordfence:8c3e61e9-3610-41b5-9820-28012dc657fd","source":"wordfence","cve":"CVE-2023-2434","title":"Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset","severity":"low","cvss":3.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c3e61e9-3610-41b5-9820-28012dc657fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c3ef1bf-ef81-4e24-9813-de1a25b0e8ae","source":"wordfence","cve":"CVE-2018-20987","title":"Newsletters <= 4.6.8.5 - Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c3ef1bf-ef81-4e24-9813-de1a25b0e8ae?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.6.8.6","to_inclusive":false,"patched_in":"4.6.8.6"}],"published":"2018-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c3f1202-886a-471c-9b93-0efbf4282618","source":"wordfence","cve":"CVE-2024-30435","title":"The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c3f1202-886a-471c-9b93-0efbf4282618?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T23:58:09Z"},{"id":"wordfence:8c43870a-6ae7-4c31-b7d0-1cb1afc6be35","source":"wordfence","cve":"CVE-2025-68861","title":"Plugin Optimizer <= 1.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c43870a-6ae7-4c31-b7d0-1cb1afc6be35?source=api-prod","affected":[{"type":"plugin","slug":"plugin-optimizer","name":"Plugin Optimizer \u2013 Speed Up Your WordPress Like Never Before","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T18:59:06Z"},{"id":"wordfence:8c44361b-dbc5-4534-a1a7-416a47ebabe4","source":"wordfence","cve":"CVE-2024-50450","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c44361b-dbc5-4534-a1a7-416a47ebabe4?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.4","to_inclusive":true,"patched_in":"1.3.3.5"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:55:00Z"},{"id":"wordfence:8c483cf9-fb63-4c43-ad42-1404448540c2","source":"wordfence","cve":"CVE-2019-20042","title":"WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c483cf9-fb63-4c43-ad42-1404448540c2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.31","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.29","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.28","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.20","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.19","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.16","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.15","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.11","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"3.7.32"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2019-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c48dae5-133e-4051-89ad-3e3479431d82","source":"wordfence","cve":"CVE-2025-58647","title":"Simple Restaurant Menu <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c48dae5-133e-4051-89ad-3e3479431d82?source=api-prod","affected":[{"type":"plugin","slug":"simple-restaurant-menu","name":"Simple Restaurant Menu","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:45:52Z"},{"id":"wordfence:8c4b8521-c6cf-4bdc-a7c9-7ba01d59715c","source":"wordfence","cve":"CVE-2025-64244","title":"Restrict Elementor Widgets, Columns and Sections <= 1.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c4b8521-c6cf-4bdc-a7c9-7ba01d59715c?source=api-prod","affected":[{"type":"plugin","slug":"restrict-elementor-widgets","name":"Restrict Elementor Widgets, Columns and Sections","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-13T00:00:00Z","updated":"2025-12-19T16:48:08Z"},{"id":"wordfence:8c4ef5e0-668d-4814-87fe-5a4a1ae1bb7f","source":"wordfence","cve":"CVE-2024-49635","title":"Banner Slider <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c4ef5e0-668d-4814-87fe-5a4a1ae1bb7f?source=api-prod","affected":[{"type":"plugin","slug":"banner-slider","name":"Banner Slider","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:44:43Z"},{"id":"wordfence:8c5042aa-80d6-47c3-aa85-7e16f40aa47d","source":"wordfence","cve":"CVE-2025-39491","title":"WHMpress <= 6.2-revision-9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5042aa-80d6-47c3-aa85-7e16f40aa47d?source=api-prod","affected":[{"type":"plugin","slug":"whmpress","name":"WHMpress - WHMCS WordPress Integration Plugin","from":"*","from_inclusive":true,"to":"6.2-revision-9","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:04:46Z"},{"id":"wordfence:8c529017-2fb9-4665-97a6-3ec062908299","source":"wordfence","cve":"CVE-2025-13159","title":"Flo Forms \u2013 Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c529017-2fb9-4665-97a6-3ec062908299?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:28:18Z","updated":"2025-11-21T07:31:54Z"},{"id":"wordfence:8c52c496-2f77-4faa-9a73-dafe4a66905d","source":"wordfence","cve":"CVE-2025-27009","title":"My auctions allegro <= 3.6.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c52c496-2f77-4faa-9a73-dafe4a66905d?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.33","to_inclusive":true,"patched_in":"3.6.34"}],"published":"2025-04-14T00:00:00Z","updated":"2026-02-26T15:06:47Z"},{"id":"wordfence:8c5642fa-d001-47c4-8acd-94ae944e5129","source":"wordfence","cve":"CVE-2022-0889","title":"Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5642fa-d001-47c4-8acd-94ae944e5129?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2021-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c56e308-cd21-4dd3-ac0a-d9908c8d0819","source":"wordfence","cve":"CVE-2026-11875","title":"Support Plus Responsive Ticket System <= 9.1.2 - Insecure Direct Object Reference to Unauthenticated Support Ticket Access","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c56e308-cd21-4dd3-ac0a-d9908c8d0819?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:44:52Z"},{"id":"wordfence:8c57211a-f59d-4379-b09e-7c6049a6b04d","source":"wordfence","cve":"CVE-2021-4360","title":"Controlled Admin Access < 1.5.6 - Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=api-prod","affected":[{"type":"plugin","slug":"controlled-admin-access","name":"Controlled Admin Access","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c574642-7c24-4ede-a94d-b0af55fc9f5a","source":"wordfence","cve":"CVE-2026-85005","title":"Popup Maker WP 1.2.2.1 - 1.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c574642-7c24-4ede-a94d-b0af55fc9f5a?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker-wp","name":"Popup Maker \u2013 Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More","from":"1.2.2.1","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-28T21:14:58Z"},{"id":"wordfence:8c5a065a-a81e-4963-af54-21f145632bed","source":"wordfence","cve":"CVE-2022-0709","title":"Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5a065a-a81e-4963-af54-21f145632bed?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.5.29","to_inclusive":false,"patched_in":"1.5.29"}],"published":"2022-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c5a6fcb-72f0-4188-b883-d1dcaf1d13ff","source":"wordfence","cve":"CVE-2015-10100","title":"Dynamic Widgets <= 1.5.10 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5a6fcb-72f0-4188-b883-d1dcaf1d13ff?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2015-10-14T00:00:00Z","updated":"2024-06-06T16:06:35Z"},{"id":"wordfence:8c5aa062-b9a2-4ddb-a5bf-4c8368218e85","source":"wordfence","cve":"CVE-2025-1295","title":"Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5aa062-b9a2-4ddb-a5bf-4c8368218e85?source=api-prod","affected":[{"type":"plugin","slug":"templines-helper-core","name":"Templines Elementor Helper Core","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T05:23:04Z"},{"id":"wordfence:8c5adae3-b242-4408-bcff-93d8fb976b38","source":"wordfence","cve":"CVE-2025-30971","title":"XV Random Quotes <= 2.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5adae3-b242-4408-bcff-93d8fb976b38?source=api-prod","affected":[{"type":"plugin","slug":"xv-random-quotes","name":"XV Random Quotes","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-03-31T00:00:00Z","updated":"2026-01-06T19:30:05Z"},{"id":"wordfence:8c5fc64f-4a4c-4a23-a72f-9ba9fa7ab6b0","source":"wordfence","cve":"CVE-2026-115225","title":"Customer Engagement System \u2013 Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5fc64f-4a4c-4a23-a72f-9ba9fa7ab6b0?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:15:43Z"},{"id":"wordfence:8c62b50a-f760-40c5-a408-27a6cfd44126","source":"wordfence","cve":"CVE-2021-24733","title":"WP Post Page Clone <= 1.1 - Missing Authorization to Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c62b50a-f760-40c5-a408-27a6cfd44126?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-page-clone","name":"WP Post Page Clone","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2021-12-27T00:00:00Z","updated":"2024-10-11T17:10:13Z"},{"id":"wordfence:8c63b5e2-f543-4c12-97c0-c6b11f56ccc1","source":"wordfence","cve":"CVE-2024-50500","title":"Shortcodes and extra features for Phlox theme <= 2.17.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c63b5e2-f543-4c12-97c0-c6b11f56ccc1?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.4","to_inclusive":true,"patched_in":"2.17.5"}],"published":"2025-01-31T00:00:00Z","updated":"2025-03-06T20:50:12Z"},{"id":"wordfence:8c646335-ef11-42bd-926b-d44372ad3c6f","source":"wordfence","cve":"CVE-2025-48321","title":"Ultimate twitter profile widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c646335-ef11-42bd-926b-d44372ad3c6f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-twitter-profile-widget","name":"Ultimate twitter profile widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-08-25T17:18:21Z"},{"id":"wordfence:8c652a98-2762-4ecf-8037-58377d6e1b5a","source":"wordfence","cve":"CVE-2007-2482","title":"wordTube <= 1.43 - Directory Traversal and File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c652a98-2762-4ecf-8037-58377d6e1b5a?source=api-prod","affected":[{"type":"plugin","slug":"wordtube","name":"wordTube","from":"*","from_inclusive":true,"to":"1.43","to_inclusive":true,"patched_in":"1.44"}],"published":"2007-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c6702f5-f7eb-497c-a9a2-679daabd6637","source":"wordfence","cve":"CVE-2026-82850","title":"Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c6702f5-f7eb-497c-a9a2-679daabd6637?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:49:02Z"},{"id":"wordfence:8c687b5d-360f-4f25-8685-aa4a8ab9b123","source":"wordfence","cve":"CVE-2025-49247","title":"Team Showcase < 25.05.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c687b5d-360f-4f25-8685-aa4a8ab9b123?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-cm","name":"Team Showcase","from":"*","from_inclusive":true,"to":"25.05.13","to_inclusive":false,"patched_in":"25.05.13"}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:05:54Z"},{"id":"wordfence:8c68cf18-0210-452f-933e-6f1e50323b15","source":"wordfence","cve":"","title":"Popup box <= 2.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c68cf18-0210-452f-933e-6f1e50323b15?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c6c2695-6244-43fa-8920-7dba14668659","source":"wordfence","cve":"CVE-2022-2863","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c6c2695-6244-43fa-8920-7dba14668659?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.75","to_inclusive":true,"patched_in":"0.9.76"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c6f5f8c-7a8c-4524-8cb8-e14a6f182bbf","source":"wordfence","cve":"CVE-2024-43999","title":"Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c6f5f8c-7a8c-4524-8cb8-e14a6f182bbf?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.11","to_inclusive":true,"patched_in":"3.8.12"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:06:06Z"},{"id":"wordfence:8c71eb01-116b-4139-9a5e-6b890d7451bd","source":"wordfence","cve":"CVE-2025-64188","title":"Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c71eb01-116b-4139-9a5e-6b890d7451bd?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.9","to_inclusive":true,"patched_in":"8.6.9.1"}],"published":"2025-10-23T00:00:00Z","updated":"2025-12-05T20:17:48Z"},{"id":"wordfence:8c732b0e-9898-48f2-99b2-068f31532b17","source":"wordfence","cve":"CVE-2022-41790","title":"WP Time Slots Booking Form <= 1.1.76 - Missing Authorization to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c732b0e-9898-48f2-99b2-068f31532b17?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.1.76","to_inclusive":true,"patched_in":"1.1.77"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c7385c7-47de-4511-b474-7415c3977aa8","source":"wordfence","cve":"CVE-2023-5664","title":"Garden Gnome Package <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7385c7-47de-4511-b474-7415c3977aa8?source=api-prod","affected":[{"type":"plugin","slug":"garden-gnome-package","name":"Garden Gnome Package","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c74d5ad-30f3-4fde-b240-97318fc3c7d6","source":"wordfence","cve":"CVE-2022-0873","title":"Gmedia Photo Gallery < 1.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c74d5ad-30f3-4fde-b240-97318fc3c7d6?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":false,"patched_in":"1.20.0"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c755b87-68b9-4a42-bb4d-ecdb4cff6de2","source":"wordfence","cve":"CVE-2022-1814","title":"WP Admin Style <= 0.1.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c755b87-68b9-4a42-bb4d-ecdb4cff6de2?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-style","name":"WP Admin Style","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c78e14b-6925-4630-b19c-13b192f9fea3","source":"wordfence","cve":"","title":"SQL Shortcode <= 1.1 - SQL Execution","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c78e14b-6925-4630-b19c-13b192f9fea3?source=api-prod","affected":[{"type":"plugin","slug":"sql-shortcode","name":"SQL Shortcode","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2017-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c7d208b-84e4-4759-8b61-3ef43c1d0732","source":"wordfence","cve":"CVE-2022-29429","title":"Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7d208b-84e4-4759-8b61-3ef43c1d0732?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets-extended","name":"Code Snippets Extended","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-04T14:51:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c7d5fbe-d272-46d4-9b33-889ba77dcc52","source":"wordfence","cve":"CVE-2022-3361","title":"Ultimate Member \u2013 User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7d5fbe-d272-46d4-9b33-889ba77dcc52?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c7fee7f-b75f-4926-9f0b-cf138be2225b","source":"wordfence","cve":"CVE-2026-14548","title":"Ray Enterprise Translation <= 1.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7fee7f-b75f-4926-9f0b-cf138be2225b?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-08-08T00:00:00Z","updated":"2026-11-06T15:20:42Z"},{"id":"wordfence:8c82d209-3c69-4d6e-a129-d519f6601540","source":"wordfence","cve":"CVE-2026-1503","title":"login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c82d209-3c69-4d6e-a129-d519f6601540?source=api-prod","affected":[{"type":"plugin","slug":"login-register","name":"Plugin Name: login_register","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:29Z","updated":"2026-03-21T03:26:54Z"},{"id":"wordfence:8c82dc37-0b9a-48c2-a8a6-fbee6182003f","source":"wordfence","cve":"CVE-2024-12408","title":"WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c82dc37-0b9a-48c2-a8a6-fbee6182003f?source=api-prod","affected":[{"type":"plugin","slug":"wp-migrate-2-aws","name":"WP on AWS","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2024-12-20T00:00:00Z","updated":"2024-12-21T09:23:55Z"},{"id":"wordfence:8c83f430-8a4d-40fa-890c-387c787a3b55","source":"wordfence","cve":"CVE-2025-12886","title":"Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=api-prod","affected":[{"type":"theme","slug":"oxygen","name":"Oxygen - WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":"6.0.9"}],"published":"2026-03-27T14:05:45Z","updated":"2026-03-28T02:26:37Z"},{"id":"wordfence:8c84ffd3-e000-4d67-9789-e439e7c128e8","source":"wordfence","cve":"CVE-2023-47652","title":"Auto Affiliate Links <= 6.4.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c84ffd3-e000-4d67-9789-e439e7c128e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.2.4","to_inclusive":true,"patched_in":"6.4.2.5"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c852eb8-4b55-48e1-95e8-43e9a2962015","source":"wordfence","cve":"CVE-2025-39378","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c852eb8-4b55-48e1-95e8-43e9a2962015?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-09-18T14:34:58Z"},{"id":"wordfence:8c881211-9f5f-4f93-8608-d91cf58f0f6d","source":"wordfence","cve":"CVE-2025-48301","title":"SMTP for SendGrid \u2013 YaySMTP <= 1.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c881211-9f5f-4f93-8608-d91cf58f0f6d?source=api-prod","affected":[{"type":"plugin","slug":"smtp-sendgrid","name":"SMTP for SendGrid \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:55:40Z"},{"id":"wordfence:8c8a3f00-4006-4a9e-8492-03e0b2820739","source":"wordfence","cve":"CVE-2024-50411","title":"WP Abstracts <= 2.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c8a3f00-4006-4a9e-8492-03e0b2820739?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:42:18Z"},{"id":"wordfence:8c8beca2-d02b-4379-99e9-8090ef84ca6d","source":"wordfence","cve":"CVE-2026-77187","title":"My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c8beca2-d02b-4379-99e9-8090ef84ca6d?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-09-08T14:29:40Z","updated":"2026-09-09T03:28:49Z"},{"id":"wordfence:8c8e37f8-708e-41d5-a6b8-3ba587437532","source":"wordfence","cve":"CVE-2024-10189","title":"Anchor Episodes Index (Spotify for Podcasters) <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c8e37f8-708e-41d5-a6b8-3ba587437532?source=api-prod","affected":[{"type":"plugin","slug":"anchor-episodes-index","name":"Anchor Episodes Index (Spotify for Podcasters)","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2024-10-21T20:53:46Z","updated":"2024-10-22T09:32:10Z"},{"id":"wordfence:8c8f6f49-df06-48c5-885e-9a835dc5d87b","source":"wordfence","cve":"CVE-2026-66439","title":"Advanced AJAX Product Filters <= 3.2.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c8f6f49-df06-48c5-885e-9a835dc5d87b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ajax-filters","name":"Advanced AJAX Product Filters","from":"*","from_inclusive":true,"to":"3.2.0.3","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-15T22:12:01Z"},{"id":"wordfence:8c938a33-e88b-4e4b-af5e-37ea46f2a111","source":"wordfence","cve":"","title":"WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Denial of Service via Malformed Interactivity API Bindings","severity":"low","cvss":3.5,"cwe":"CWE-248","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c938a33-e88b-4e4b-af5e-37ea46f2a111?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.4.14"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T15:45:05Z"},{"id":"wordfence:8c93991e-9a71-4600-94a0-8c344ed6bc81","source":"wordfence","cve":"CVE-2025-69312","title":"Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c93991e-9a71-4600-94a0-8c344ed6bc81?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.19.1","to_inclusive":true,"patched_in":"1.4.20"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:42:26Z"},{"id":"wordfence:8c960623-fbcc-4513-a745-a60d41a92aab","source":"wordfence","cve":"CVE-2026-75824","title":"User Frontend 2.5.8 - 4.3.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c960623-fbcc-4513-a745-a60d41a92aab?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"2.5.8","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:53:58Z"},{"id":"wordfence:8c965f4c-5fb6-4992-b004-f85eed3a70a6","source":"wordfence","cve":"CVE-2026-54818","title":"SlimStat Analytics <= 5.4.11 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c965f4c-5fb6-4992-b004-f85eed3a70a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"5.4.12"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:56:10Z"},{"id":"wordfence:8c99f70b-77a6-4bd7-99b1-ad4ec76d50c6","source":"wordfence","cve":"CVE-2023-49823","title":"Bold Page Builder <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c99f70b-77a6-4bd7-99b1-ad4ec76d50c6?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c9a223c-6c34-4c64-92b5-d986f9791ebb","source":"wordfence","cve":"CVE-2026-1073","title":"Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9a223c-6c34-4c64-92b5-d986f9791ebb?source=api-prod","affected":[{"type":"plugin","slug":"purchase-button","name":"Purchase Button For Affiliate Link","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:46:36Z","updated":"2026-03-07T07:22:06Z"},{"id":"wordfence:8c9c3302-47cd-4dbe-b79e-5e6032928074","source":"wordfence","cve":"CVE-2019-25142","title":"Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=api-prod","affected":[{"type":"theme","slug":"mesmerize","name":"Mesmerize","from":"*","from_inclusive":true,"to":"1.6.89","to_inclusive":true,"patched_in":"1.6.90"},{"type":"theme","slug":"materialis","name":"Materialis","from":"*","from_inclusive":true,"to":"1.0.172","to_inclusive":true,"patched_in":"1.0.173"}],"published":"2019-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8c9c37e2-c9f7-4a07-94d0-51298d98ff80","source":"wordfence","cve":"CVE-2026-14825","title":"Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c37e2-c9f7-4a07-94d0-51298d98ff80?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.3","to_inclusive":true,"patched_in":"11.2.4"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T22:28:54Z"},{"id":"wordfence:8c9e2b92-fde2-49b7-aae9-964e359610a5","source":"wordfence","cve":"CVE-2025-31772","title":"WP Modal Popup with Cookie Integration <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9e2b92-fde2-49b7-aae9-964e359610a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-modal-popup-with-cookie-integration","name":"WP Modal Popup with Cookie Integration","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-07-17T17:12:50Z"},{"id":"wordfence:8ca19824-f47b-4af5-a3cf-646aa9baeae8","source":"wordfence","cve":"CVE-2024-6536","title":"Zephyr Project Manager <= 3.3.97 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca19824-f47b-4af5-a3cf-646aa9baeae8?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.97","to_inclusive":true,"patched_in":"3.3.99"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-02T17:42:48Z"},{"id":"wordfence:8ca1bf69-bc71-4137-a908-58c1915f654a","source":"wordfence","cve":"CVE-2025-68989","title":"Contact Form 7 Extension For Mailchimp <= 0.9.54 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca1bf69-bc71-4137-a908-58c1915f654a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-mailchimp-extension","name":"Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend","from":"*","from_inclusive":true,"to":"0.9.54","to_inclusive":true,"patched_in":"0.9.69"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-13T16:57:51Z"},{"id":"wordfence:8ca2d48b-5fb6-4eb9-85ea-be5a21130039","source":"wordfence","cve":"CVE-2019-1010034","title":"Web Librarian <= 3.5.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca2d48b-5fb6-4eb9-85ea-be5a21130039?source=api-prod","affected":[{"type":"plugin","slug":"weblibrarian","name":"WebLibrarian","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2019-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ca7b2ab-bc01-4fd7-9cee-7cdc5a62177d","source":"wordfence","cve":"","title":"Echelon (All Versions) -  Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca7b2ab-bc01-4fd7-9cee-7cdc5a62177d?source=api-prod","affected":[{"type":"theme","slug":"echelon","name":"Echelon","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-04-25T00:00:00Z","updated":"2024-10-23T12:42:03Z"},{"id":"wordfence:8ca830d6-3d3c-4026-85cd-8447b8a568d3","source":"wordfence","cve":"CVE-2026-8181","title":"Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca830d6-3d3c-4026-85cd-8447b8a568d3?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"3.4.0","from_inclusive":true,"to":"3.4.1.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-05-13T16:44:16Z","updated":"2026-05-14T05:30:30Z"},{"id":"wordfence:8ca87868-357b-4d71-9bf9-cd3b15b2555d","source":"wordfence","cve":"CVE-2026-11324","title":"WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ca87868-357b-4d71-9bf9-cd3b15b2555d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-placetopay-belice","name":"WooCommerce Placetopay Gateway Belice","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-gateway-placetopay-ecuador","name":"WooCommerce Placetopay Gateway Ecuador","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-gateway-placetopay-colombia","name":"WooCommerce Placetopay Gateway Colombia","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-gateway-placetopay-uruguay","name":"WooCommerce Placetopay Gateway Uruguay","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"https://github.com/placetopay/woocommerce-gateway-placetopay","name":"WooCommerce Placetopay Gateway","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-gateway-placetopay-honduras","name":"WooCommerce Placetopay Gateway Honduras","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-16T13:36:44Z","updated":"2026-07-17T02:31:31Z"},{"id":"wordfence:8caa3644-101c-4e08-832d-63d6f5079c69","source":"wordfence","cve":"CVE-2025-32500","title":"Codescar Radio Widget <= 0.4.2 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8caa3644-101c-4e08-832d-63d6f5079c69?source=api-prod","affected":[{"type":"plugin","slug":"codescar-radio-widget","name":"Codescar Radio Widget","from":"*","from_inclusive":true,"to":"0.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:25:06Z"},{"id":"wordfence:8cac4bde-8518-48ec-8cbd-4cdf6094b831","source":"wordfence","cve":"CVE-2021-24722","title":"Restaurant Menu by MotoPress <= 2.4.1 - Admin+ Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cac4bde-8518-48ec-8cbd-4cdf6094b831?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cae2842-577d-4836-9de1-c55b0167aabd","source":"wordfence","cve":"CVE-2024-51705","title":"WP MMenu Lite <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cae2842-577d-4836-9de1-c55b0167aabd?source=api-prod","affected":[{"type":"plugin","slug":"wp-mmenu-lite","name":"WP MMenu Lite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:20:19Z"},{"id":"wordfence:8cb37019-33f6-4f72-adfc-befbfbf69e47","source":"wordfence","cve":"CVE-2023-6556","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb37019-33f6-4f72-adfc-befbfbf69e47?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.1.6","to_inclusive":true,"patched_in":"1.4.1.7"}],"published":"2023-12-23T00:00:00Z","updated":"2024-07-29T21:36:50Z"},{"id":"wordfence:8cb4a14a-8bef-4747-ac89-70891f5c44bb","source":"wordfence","cve":"CVE-2021-36884","title":"Backup Migration <= 1.1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb4a14a-8bef-4747-ac89-70891f5c44bb?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2021-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cb5c386-eee3-4e88-a827-766a4901f432","source":"wordfence","cve":"CVE-2023-50885","title":"Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb5c386-eee3-4e88-a827-766a4901f432?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cb6639d-06ba-4bad-af73-d387a7e3f6b5","source":"wordfence","cve":"CVE-2024-29107","title":"Elementor Addon Elements <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb6639d-06ba-4bad-af73-d387a7e3f6b5?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.10","to_inclusive":true,"patched_in":"1.12.11"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:41:39Z"},{"id":"wordfence:8cb6c075-81f8-491d-bcef-6974861424db","source":"wordfence","cve":"CVE-2026-65570","title":"OTP Login With Phone Number, OTP Verification <= 1.8.70 - OTP Brute Force","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cb6c075-81f8-491d-bcef-6974861424db?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.8.70","to_inclusive":true,"patched_in":"1.8.71"}],"published":"2026-08-06T00:00:00Z","updated":"2026-09-17T14:53:25Z"},{"id":"wordfence:8cbc45be-72a9-4abb-9997-249f88e48a9a","source":"wordfence","cve":"CVE-2025-31615","title":"Simple Contact Forms <= 1.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cbc45be-72a9-4abb-9997-249f88e48a9a?source=api-prod","affected":[{"type":"plugin","slug":"simple-contact-forms","name":"Simple Contact Forms","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:28:46Z"},{"id":"wordfence:8cbce71b-0c3c-4dbd-a83e-3f2d64f8aade","source":"wordfence","cve":"CVE-2025-32520","title":"WordPress Health and Server Condition \u2013 Integrated with Google Page Speed <= 4.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cbce71b-0c3c-4dbd-a83e-3f2d64f8aade?source=api-prod","affected":[{"type":"plugin","slug":"wp-condition","name":"Health and Server Condition \u2013 Site Health Reports & Monitoring","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-04-10T00:00:00Z","updated":"2026-11-10T23:17:34Z"},{"id":"wordfence:8cbf5121-2511-4e21-a346-67fa1e34fc02","source":"wordfence","cve":"CVE-2026-12153","title":"WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cbf5121-2511-4e21-a346-67fa1e34fc02?source=api-prod","affected":[{"type":"plugin","slug":"learn-manager","name":"WP Learn Manager","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:31:46Z","updated":"2026-07-08T05:34:09Z"},{"id":"wordfence:8cc15755-0348-48e6-b269-cefad504752d","source":"wordfence","cve":"CVE-2025-1363","title":"URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc15755-0348-48e6-b269-cefad504752d?source=api-prod","affected":[{"type":"plugin","slug":"easy-broken-link-checker","name":"URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-03T21:56:19Z"},{"id":"wordfence:8cc178d7-da99-4fbc-9277-52c6299f0417","source":"wordfence","cve":"CVE-2024-31280","title":"Church Admin <= 4.1.5 -  Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc178d7-da99-4fbc-9277-52c6299f0417?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:36:00Z"},{"id":"wordfence:8cc25fe1-82f0-493b-a9d3-1a4892e35613","source":"wordfence","cve":"CVE-2025-10309","title":"PayPal Forms <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc25fe1-82f0-493b-a9d3-1a4892e35613?source=api-prod","affected":[{"type":"plugin","slug":"paypal-forms","name":"PayPal Forms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:12:54Z","updated":"2025-10-03T11:17:16Z"},{"id":"wordfence:8cc56ea6-96d5-4041-a21c-1e9e19636a19","source":"wordfence","cve":"CVE-2025-46534","title":"Image Style Hover <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc56ea6-96d5-4041-a21c-1e9e19636a19?source=api-prod","affected":[{"type":"plugin","slug":"image-content-show-hover","name":"Image Style Hover \u2013 Displays content when you hover on image","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:34:02Z"},{"id":"wordfence:8cc7a0f3-6a58-4e42-9341-aecf55d2ccb1","source":"wordfence","cve":"CVE-2026-5748","title":"Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc7a0f3-6a58-4e42-9341-aecf55d2ccb1?source=api-prod","affected":[{"type":"plugin","slug":"text-snippet","name":"Text Snippets","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:02:47Z","updated":"2026-04-22T07:45:39Z"},{"id":"wordfence:8ccb1304-326e-43af-b75d-23874f92ba8b","source":"wordfence","cve":"CVE-2025-12374","title":"Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login \u2013 User Verification <= 2.0.44 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccb1304-326e-43af-b75d-23874f92ba8b?source=api-prod","affected":[{"type":"plugin","slug":"user-verification","name":"User Verification by PickPlugins","from":"*","from_inclusive":true,"to":"2.0.44","to_inclusive":true,"patched_in":"2.0.45"}],"published":"2025-12-04T17:39:15Z","updated":"2026-04-30T03:17:44Z"},{"id":"wordfence:8ccb9b0c-873d-4d5d-be77-98e4ab27346b","source":"wordfence","cve":"CVE-2026-39433","title":"WPAMS - Apartment Management System for wordpress < 49.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccb9b0c-873d-4d5d-be77-98e4ab27346b?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"49.5.3","to_inclusive":false,"patched_in":"49.5.3"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:25:53Z"},{"id":"wordfence:8ccbbdf8-58cf-41ad-b4b5-8ada3b4e822f","source":"wordfence","cve":"CVE-2025-32628","title":"Crowdfunding for WooCommerce <= 3.1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccbbdf8-58cf-41ad-b4b5-8ada3b4e822f?source=api-prod","affected":[{"type":"plugin","slug":"crowdfunding-for-woocommerce","name":"Crowdfunding for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:23:18Z"},{"id":"wordfence:8ccdad2e-66a6-4263-a10e-f7b045d71c0d","source":"wordfence","cve":"CVE-2024-38743","title":"Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ccdad2e-66a6-4263-a10e-f7b045d71c0d?source=api-prod","affected":[{"type":"plugin","slug":"qodeblock","name":"Plum: Spin Wheel & Email Pop-up","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:28:52Z"},{"id":"wordfence:8cd1b975-ac38-4393-9928-109db507828c","source":"wordfence","cve":"CVE-2022-46816","title":"Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd1b975-ac38-4393-9928-109db507828c?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cd1d385-001c-4c84-9a80-553315336a63","source":"wordfence","cve":"CVE-2023-36525","title":"WPJobBoard <= 5.9.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd1d385-001c-4c84-9a80-553315336a63?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cd603aa-c4d4-488c-b134-6983240c3a18","source":"wordfence","cve":"CVE-2026-15022","title":"Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd603aa-c4d4-488c-b134-6983240c3a18?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-07-15T19:32:11Z","updated":"2026-07-16T07:51:03Z"},{"id":"wordfence:8cd7bbfb-57e7-4bee-ad99-b8e9710da81d","source":"wordfence","cve":"CVE-2025-24662","title":"LearnDash LMS <= 4.20.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd7bbfb-57e7-4bee-ad99-b8e9710da81d?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.20.0.1","to_inclusive":true,"patched_in":"4.20.0.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:40:32Z"},{"id":"wordfence:8cd7dfb3-bc73-4f6a-9827-0003452ebf59","source":"wordfence","cve":"CVE-2022-29441","title":"Private Messages For WordPress <= 2.1.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd7dfb3-bc73-4f6a-9827-0003452ebf59?source=api-prod","affected":[{"type":"plugin","slug":"private-messages-for-wordpress","name":"Private Messages For WordPress","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T11:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cd8ffcb-0a24-4e0a-a9f9-23501742715f","source":"wordfence","cve":"CVE-2025-0764","title":"wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T07:03:46Z"},{"id":"wordfence:8cde404a-a419-4aa9-95d8-7f5dcde29daa","source":"wordfence","cve":"CVE-2025-49035","title":"Admin Menu Groups <= 0.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cde404a-a419-4aa9-95d8-7f5dcde29daa?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-groups","name":"Admin Menu Groups","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:03:59Z"},{"id":"wordfence:8cde9f8d-ce66-419e-91a2-63a63a95f032","source":"wordfence","cve":"CVE-2024-43161","title":"Depicter Slider <= 3.1.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cde9f8d-ce66-419e-91a2-63a63a95f032?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:58:39Z"},{"id":"wordfence:8cdea5f0-b3a9-492a-be00-cb63fc570464","source":"wordfence","cve":"CVE-2024-38698","title":"SKT Skill Bar <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cdea5f0-b3a9-492a-be00-cb63fc570464?source=api-prod","affected":[{"type":"plugin","slug":"skt-skill-bar","name":"SKT Skill Bar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:29:51Z"},{"id":"wordfence:8ce1253e-48fe-4005-816c-9cf6127cae54","source":"wordfence","cve":"CVE-2026-24375","title":"Ultimate Gift Cards for WooCommerce <= 3.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce1253e-48fe-4005-816c-9cf6127cae54?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2026-01-08T00:00:00Z","updated":"2026-05-04T15:18:37Z"},{"id":"wordfence:8ce350cb-78ae-4d76-99a7-8a81d342a9c8","source":"wordfence","cve":"CVE-2022-2148","title":"LinkedIn Company Updates <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce350cb-78ae-4d76-99a7-8a81d342a9c8?source=api-prod","affected":[{"type":"plugin","slug":"company-updates-for-linkedin","name":"LinkedIn Company Updates","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ce4204f-3ee3-4877-8e9d-123d01ae80f5","source":"wordfence","cve":"CVE-2023-50854","title":"Squirrly SEO - Advanced Pack < 2.4.02 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce4204f-3ee3-4877-8e9d-123d01ae80f5?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo-pack","name":"Squirrly SEO - Advanced Pack","from":"*","from_inclusive":true,"to":"2.4.02","to_inclusive":false,"patched_in":"2.4.02"}],"published":"2023-12-21T00:00:00Z","updated":"2026-02-26T14:53:23Z"},{"id":"wordfence:8ce45d53-27a3-40be-a9c4-866ad6bf3ab6","source":"wordfence","cve":"CVE-2026-120834","title":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden <= 3.5.17 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce45d53-27a3-40be-a9c4-866ad6bf3ab6?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.17","to_inclusive":true,"patched_in":"3.5.18"}],"published":"2026-11-07T17:12:42Z","updated":"2026-11-10T19:37:29Z"},{"id":"wordfence:8ce4be1b-3807-4ded-80a5-30f2f80db89d","source":"wordfence","cve":"","title":"All In One WP Security & Firewall 5.0.0 - 5.0.7 - Protection Bypass via IP Spoofing","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce4be1b-3807-4ded-80a5-30f2f80db89d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"5.0.0","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ce635f1-3798-4ca2-b4cf-ea183a1e1d79","source":"wordfence","cve":"CVE-2015-6805","title":"MDC Private Message <= 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce635f1-3798-4ca2-b4cf-ea183a1e1d79?source=api-prod","affected":[{"type":"plugin","slug":"mdc-private-message","name":"MDC Private Message","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ce7aa01-7e79-4048-a84d-fcb9541d5f8b","source":"wordfence","cve":"CVE-2024-4367","title":"PDF.js < 4.2.67 - Arbitrary JavaScript Execution","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce7aa01-7e79-4048-a84d-fcb9541d5f8b?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"pdfjs-viewer-shortcode","name":"PDF.js Viewer","from":"*","from_inclusive":true,"to":"2.1.8.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.5","to_inclusive":true,"patched_in":"0.21.6"},{"type":"plugin","slug":"pdf-viewer-for-elementor","name":"PDF Viewer for Elementor","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ari-fancy-lightbox","name":"ARI Fancy Lightbox \u2013 Popup for WordPress","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"},{"type":"plugin","slug":"wonderplugin-pdf-embed","name":"Wonder PDF Embed","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"},{"type":"plugin","slug":"pdf-embedder","name":"PDF Embedder \u2013 PDF Viewer & Embed PDF Files for WordPress","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.8.0"},{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.1.21","to_inclusive":true,"patched_in":"2.1.22"},{"type":"plugin","slug":"pdfjs-viewer-for-elementor","name":"PDF viewer for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"1.15.5","to_inclusive":true,"patched_in":"1.15.6"}],"published":"2024-05-20T00:00:00Z","updated":"2024-09-26T17:24:56Z"},{"id":"wordfence:8cea16a6-fb4c-48d5-a187-b7fe1679fd35","source":"wordfence","cve":"CVE-2025-32530","title":"Wallet System for WooCommerce <= 2.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cea16a6-fb4c-48d5-a187-b7fe1679fd35?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2025-04-10T00:00:00Z","updated":"2025-07-24T17:41:49Z"},{"id":"wordfence:8cea7f17-743a-4dce-bd86-5713ff6d8520","source":"wordfence","cve":"CVE-2023-45759","title":"Peter\u2019s Custom Anti-Spam <= 3.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cea7f17-743a-4dce-bd86-5713ff6d8520?source=api-prod","affected":[{"type":"plugin","slug":"peters-custom-anti-spam-image","name":"Peter\u2019s Custom Anti-Spam","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ceb4750-0780-4437-a3b0-c4c4606f2715","source":"wordfence","cve":"CVE-2026-4087","title":"Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ceb4750-0780-4437-a3b0-c4c4606f2715?source=api-prod","affected":[{"type":"plugin","slug":"pre-party-browser-hints","name":"Pre* Party Resource Hints","from":"*","from_inclusive":true,"to":"1.8.20","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T14:37:45Z","updated":"2026-03-21T03:26:55Z"},{"id":"wordfence:8cec5695-1fe5-4349-b78d-2e4f7d3b9908","source":"wordfence","cve":"CVE-2020-29172","title":"LiteSpeed Cache <= 3.6 - Authenticated Stored Cross-Site Scripting via IP setting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cec5695-1fe5-4349-b78d-2e4f7d3b9908?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2020-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cee662f-f639-47ba-9534-92f4c1fe7068","source":"wordfence","cve":"CVE-2026-56067","title":"JetSmartFilters <= 3.8.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cee662f-f639-47ba-9534-92f4c1fe7068?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.3.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:58:32Z"},{"id":"wordfence:8cef4b2b-ae8d-4e18-b763-6960a0b944f7","source":"wordfence","cve":"CVE-2026-1305","title":"Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cef4b2b-ae8d-4e18-b763-6960a0b944f7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2026-02-26T21:04:26Z","updated":"2026-02-27T09:23:47Z"},{"id":"wordfence:8cf1276b-401d-4166-940e-e5d60f85e762","source":"wordfence","cve":"CVE-2024-24882","title":"Masteriyo - LMS <= 1.7.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1276b-401d-4166-940e-e5d60f85e762?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:07:45Z"},{"id":"wordfence:8cf1889b-c249-4bd7-ae23-2db66ca9d873","source":"wordfence","cve":"CVE-2026-22460","title":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.4.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1889b-c249-4bd7-ae23-2db66ca9d873?source=api-prod","affected":[{"type":"plugin","slug":"formgent","name":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-25T04:44:01Z"},{"id":"wordfence:8cf1ac25-2e55-4e27-af01-9b5b1997f339","source":"wordfence","cve":"CVE-2020-28038","title":"WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1ac25-2e55-4e27-af01-9b5b1997f339?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cf1b234-862b-41a0-ab63-a986f8023613","source":"wordfence","cve":"CVE-2024-2006","title":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1b234-862b-41a0-ab63-a986f8023613?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-03-05T00:00:00Z","updated":"2024-07-31T15:36:07Z"},{"id":"wordfence:8cf507de-d003-43f3-9763-f1cff5508685","source":"wordfence","cve":"CVE-2026-66428","title":"Google Review Slider <= 18.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf507de-d003-43f3-9763-f1cff5508685?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"18.4","to_inclusive":true,"patched_in":"18.5"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:25:24Z"},{"id":"wordfence:8cfbad9f-61ba-4216-9078-c1e7e809899a","source":"wordfence","cve":"CVE-2023-2708","title":"Video Gallery <= 1.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfbad9f-61ba-4216-9078-c1e7e809899a?source=api-prod","affected":[{"type":"plugin","slug":"video-slider-with-thumbnails","name":"Video Gallery","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cfc0162-f80d-4979-9b87-df24c30e99ba","source":"wordfence","cve":"CVE-2024-5475","title":"Responsive video embed <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfc0162-f80d-4979-9b87-df24c30e99ba?source=api-prod","affected":[{"type":"plugin","slug":"responsive-video-embed","name":"Responsive video embed","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.5.1"}],"published":"2024-05-30T00:00:00Z","updated":"2024-05-31T18:33:40Z"},{"id":"wordfence:8cfc0403-48cb-443e-b55f-b8692aaad180","source":"wordfence","cve":"CVE-2025-23772","title":"imaGenius <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfc0403-48cb-443e-b55f-b8692aaad180?source=api-prod","affected":[{"type":"plugin","slug":"imagenius","name":"imaGenius","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:53:14Z"},{"id":"wordfence:8cfcdc33-f5aa-4ca9-a2b6-30fcba174c85","source":"wordfence","cve":"CVE-2022-2352","title":"Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery","severity":"medium","cvss":6.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cfcdc33-f5aa-4ca9-a2b6-30fcba174c85?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8cff3784-1b3f-45bb-a0b8-481dd24ed67d","source":"wordfence","cve":"CVE-2026-42377","title":"SureForms Pro <= 2.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cff3784-1b3f-45bb-a0b8-481dd24ed67d?source=api-prod","affected":[{"type":"plugin","slug":"sureforms-pro","name":"SureForms Pro","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:50:49Z"},{"id":"wordfence:8cffcb34-4d35-4e1e-bc0a-53a41bc91e87","source":"wordfence","cve":"CVE-2026-14223","title":"Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8cffcb34-4d35-4e1e-bc0a-53a41bc91e87?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.28","to_inclusive":false,"patched_in":"3.12.28"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-14T15:22:33Z"},{"id":"wordfence:8d024ad7-6932-4c84-ae2e-493a1cebbbee","source":"wordfence","cve":"CVE-2025-53463","title":"HT Mega \u2013 Absolute Addons for WPBakery Page Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d024ad7-6932-4c84-ae2e-493a1cebbbee?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-wpbakery","name":"HT Mega \u2013 Absolute Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T16:50:03Z"},{"id":"wordfence:8d03af4d-a1f9-4c15-a62e-f4cdbcfc9af7","source":"wordfence","cve":"CVE-2024-8672","title":"Widget Options \u2013 The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d03af4d-a1f9-4c15-a62e-f4cdbcfc9af7?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:47:13Z"},{"id":"wordfence:8d07b7c1-8180-4b2a-bf35-2c5b3d419152","source":"wordfence","cve":"CVE-2024-13126","title":"Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d07b7c1-8180-4b2a-bf35-2c5b3d419152?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.06","to_inclusive":true,"patched_in":"3.3.07"}],"published":"2025-01-17T00:00:00Z","updated":"2025-03-07T20:21:56Z"},{"id":"wordfence:8d07dcb9-ec8c-4f38-b5c2-2f4020a1c610","source":"wordfence","cve":"CVE-2023-0369","title":"GoToWP <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d07dcb9-ec8c-4f38-b5c2-2f4020a1c610?source=api-prod","affected":[{"type":"plugin","slug":"gotowp","name":"GoToWP","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d08d381-d0ef-4f40-975d-51e919a7c872","source":"wordfence","cve":"CVE-2025-9207","title":"TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d08d381-d0ef-4f40-975d-51e919a7c872?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2025-12-12T19:15:23Z","updated":"2025-12-13T07:21:05Z"},{"id":"wordfence:8d0d5ab9-b56d-4d23-9db6-44b7b8fc361a","source":"wordfence","cve":"CVE-2025-66159","title":"Walker for Elementor <= 1.1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d0d5ab9-b56d-4d23-9db6-44b7b8fc361a?source=api-prod","affected":[{"type":"plugin","slug":"walker-elementor","name":"Google Street View for Elementor \u2013 Walker","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T21:03:48Z"},{"id":"wordfence:8d0e8494-13d9-4d5d-98e7-e3ba5ee358aa","source":"wordfence","cve":"CVE-2025-31889","title":"Extensions for Elementor <= 2.0.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d0e8494-13d9-4d5d-98e7-e3ba5ee358aa?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor","name":"Extensions for Elementor","from":"*","from_inclusive":true,"to":"2.0.40","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:23:42Z"},{"id":"wordfence:8d0fef4d-2c0e-486e-8a55-1c7230636a5c","source":"wordfence","cve":"CVE-2026-2515","title":"Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d0fef4d-2c0e-486e-8a55-1c7230636a5c?source=api-prod","affected":[{"type":"plugin","slug":"hostinger-reach","name":"Hostinger Reach \u2013 AI-Powered Email Marketing for WordPress","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-21T20:13:44Z"},{"id":"wordfence:8d12f90c-016e-4c5c-8da7-ba1d963a4ed9","source":"wordfence","cve":"CVE-2026-25442","title":"Kentha <= 4.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d12f90c-016e-4c5c-8da7-ba1d963a4ed9?source=api-prod","affected":[{"type":"theme","slug":"kentha","name":"Kentha - Music WordPress Theme","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T20:00:31Z"},{"id":"wordfence:8d132e9c-2dfb-49f6-bd35-9616f7932023","source":"wordfence","cve":"CVE-2025-6325","title":"King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d132e9c-2dfb-49f6-bd35-9616f7932023?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.36","to_inclusive":true,"patched_in":"51.1.37"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-29T15:46:06Z"},{"id":"wordfence:8d182c47-3840-4ab7-a4b8-cfaf02586a5b","source":"wordfence","cve":"CVE-2025-8564","title":"SKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d182c47-3840-4ab7-a4b8-cfaf02586a5b?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-09-05T15:12:26Z","updated":"2025-09-06T03:22:37Z"},{"id":"wordfence:8d189baf-e0d4-4b23-91b8-0c802941b982","source":"wordfence","cve":"CVE-2019-15865","title":"Breadcrumbs by menu <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d189baf-e0d4-4b23-91b8-0c802941b982?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumbs-by-menu","name":"Breadcrumbs by menu","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2019-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d18e1c7-65b6-4c1f-88bf-4014418ff920","source":"wordfence","cve":"CVE-2022-4833","title":"YourChannel <= 1.2.2 Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d18e1c7-65b6-4c1f-88bf-4014418ff920?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d19e18d-6f2e-48e7-b8da-1d399dc4d65c","source":"wordfence","cve":"CVE-2015-4338","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d19e18d-6f2e-48e7-b8da-1d399dc4d65c?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2015-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d1dd819-07e8-4578-a994-2ca7fbab216b","source":"wordfence","cve":"CVE-2025-50009","title":"Kata Plus <= 1.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d1dd819-07e8-4578-a994-2ca7fbab216b?source=api-prod","affected":[{"type":"plugin","slug":"kata-plus","name":"Kata Plus \u2013 Addons for Elementor \u2013 Widgets, Extensions and Templates","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:00:31Z"},{"id":"wordfence:8d22448b-aa8e-4775-b7c5-e7bae94a3f6d","source":"wordfence","cve":"CVE-2026-2991","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d22448b-aa8e-4775-b7c5-e7bae94a3f6d?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-24T16:03:10Z"},{"id":"wordfence:8d22b146-46c8-4b64-964e-526fe3211a7a","source":"wordfence","cve":"CVE-2024-13492","title":"Guten Free Options <= 0.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d22b146-46c8-4b64-964e-526fe3211a7a?source=api-prod","affected":[{"type":"plugin","slug":"guten-free-options","name":"Guten Free Options","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-30T22:14:07Z"},{"id":"wordfence:8d26e885-7555-46a1-9ac8-a06bc9a67dba","source":"wordfence","cve":"CVE-2026-89289","title":"Fast Courier <= 5.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d26e885-7555-46a1-9ac8-a06bc9a67dba?source=api-prod","affected":[{"type":"plugin","slug":"fast-courier-shipping-freight","name":"Fast Courier \u2013 Shipping & Freight","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:45:46Z"},{"id":"wordfence:8d2a1774-1deb-42ac-bae5-7d33d39023c0","source":"wordfence","cve":"CVE-2026-12970","title":"LearnPress <= 4.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d2a1774-1deb-42ac-bae5-7d33d39023c0?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T23:14:34Z"},{"id":"wordfence:8d2c5f6e-10d1-427b-88d5-4328268ee76b","source":"wordfence","cve":"CVE-2026-114703","title":"Extensions for Leaflet Map <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d2c5f6e-10d1-427b-88d5-4328268ee76b?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2026-10-22T08:59:00Z","updated":"2026-11-10T23:22:22Z"},{"id":"wordfence:8d2dd5e4-558b-44fe-a47c-fb2b5639f39c","source":"wordfence","cve":"CVE-2014-125090","title":"Media Downloader <= 0.1.992 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d2dd5e4-558b-44fe-a47c-fb2b5639f39c?source=api-prod","affected":[{"type":"plugin","slug":"media-downloader","name":"Media Downloader","from":"*","from_inclusive":true,"to":"0.1.992","to_inclusive":true,"patched_in":"0.1.993"}],"published":"2014-01-23T00:00:00Z","updated":"2024-02-07T14:39:16Z"},{"id":"wordfence:8d32694c-ddc9-40e3-b8f1-55d9ffb1baa8","source":"wordfence","cve":"CVE-2025-49240","title":"DocsPress <= 2.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d32694c-ddc9-40e3-b8f1-55d9ffb1baa8?source=api-prod","affected":[{"type":"plugin","slug":"docspress","name":"DocsPress \u2013 Online Documentation","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:02:27Z"},{"id":"wordfence:8d391629-b0a0-4b85-86d3-e1c7603adc95","source":"wordfence","cve":"CVE-2023-2398","title":"Icegram Engage <= 3.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d391629-b0a0-4b85-86d3-e1c7603adc95?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.12"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d392d0b-f286-44da-aa32-a08d0279baed","source":"wordfence","cve":"CVE-2023-0720","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d392d0b-f286-44da-aa32-a08d0279baed?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d3aea10-d7a0-44bd-94dc-3bad0d27dbd8","source":"wordfence","cve":"CVE-2026-3461","title":"Visa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3aea10-d7a0-44bd-94dc-3bad0d27dbd8?source=api-prod","affected":[{"type":"plugin","slug":"visa-acceptance-solutions","name":"Visa Acceptance Solutions","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:51:38Z","updated":"2026-05-04T15:56:05Z"},{"id":"wordfence:8d3c29b8-7910-41f1-b203-6c89519f8806","source":"wordfence","cve":"CVE-2026-16654","title":"Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3c29b8-7910-41f1-b203-6c89519f8806?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.6","to_inclusive":true,"patched_in":"3.16"}],"published":"2026-08-27T15:41:32Z","updated":"2026-08-28T04:28:23Z"},{"id":"wordfence:8d3d5f62-9e68-4d45-bc3a-b1ac53a05ee4","source":"wordfence","cve":"CVE-2026-52692","title":"Affiliates Manager <= 2.9.50 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d3d5f62-9e68-4d45-bc3a-b1ac53a05ee4?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.50","to_inclusive":true,"patched_in":"2.9.51"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:24:41Z"},{"id":"wordfence:8d413350-f520-4dd9-af7d-e776628aef1d","source":"wordfence","cve":"CVE-2023-28791","title":"Simple Org Chart <= 2.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d413350-f520-4dd9-af7d-e776628aef1d?source=api-prod","affected":[{"type":"plugin","slug":"simple-org-chart","name":"Simple Org Chart","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-08-17T00:00:00Z","updated":"2025-05-07T14:05:40Z"},{"id":"wordfence:8d41ea3c-2c48-49a4-9432-7727987fe681","source":"wordfence","cve":"CVE-2025-53229","title":"RockON DJ <= 3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d41ea3c-2c48-49a4-9432-7727987fe681?source=api-prod","affected":[{"type":"theme","slug":"rockon","name":"rockon","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2025-09-02T00:00:00Z","updated":"2025-10-29T19:15:06Z"},{"id":"wordfence:8d434250-aa16-4ba1-a1f8-289371176545","source":"wordfence","cve":"CVE-2026-2955","title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d434250-aa16-4ba1-a1f8-289371176545?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2026-05-19T17:23:48Z","updated":"2026-05-20T05:31:18Z"},{"id":"wordfence:8d44dcef-6330-4ef6-8385-923e88db669f","source":"wordfence","cve":"CVE-2025-8617","title":"YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d44dcef-6330-4ef6-8385-923e88db669f?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-quick-view","name":"YITH WooCommerce Quick View","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2025-12-12T15:32:35Z","updated":"2025-12-13T04:31:29Z"},{"id":"wordfence:8d45640a-859a-488c-b134-3c260d3d3078","source":"wordfence","cve":"CVE-2025-62011","title":"TheGem <= 5.10.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d45640a-859a-488c-b134-3c260d3d3078?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.5.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-11-11T17:26:27Z"},{"id":"wordfence:8d4719da-aed3-413d-be8c-62a8ca376b90","source":"wordfence","cve":"CVE-2026-81929","title":"Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4719da-aed3-413d-be8c-62a8ca376b90?source=api-prod","affected":[{"type":"plugin","slug":"ocean-pro-demos","name":"Ocean Pro Demos","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"},{"type":"plugin","slug":"ocean-ecommerce","name":"Ocean eComm Treasure Box","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-10-08T17:53:48Z","updated":"2026-10-09T06:42:14Z"},{"id":"wordfence:8d4a546a-1c15-4fc5-a2ae-8640457a0c22","source":"wordfence","cve":"CVE-2015-9436","title":"Dynamic Widgets <= 1.5.10 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4a546a-1c15-4fc5-a2ae-8640457a0c22?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":false,"patched_in":"1.5.11"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d4bbbf9-db8e-4e8a-999b-9fa279d3daea","source":"wordfence","cve":"CVE-2025-69347","title":"Subscription for WooCommerce \u2013 WordPress Recurring Payments Plugin <= 1.8.10 - Authenticated (Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4bbbf9-db8e-4e8a-999b-9fa279d3daea?source=api-prod","affected":[{"type":"plugin","slug":"subscription","name":"Subscriptions for WooCommerce with Stripe Recurring Payments","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.8.11"}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:07:30Z"},{"id":"wordfence:8d4d948e-359e-4514-9c8f-dbd8198ef4fe","source":"wordfence","cve":"CVE-2024-9702","title":"Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4d948e-359e-4514-9c8f-dbd8198ef4fe?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.4.1"}],"published":"2025-01-06T16:28:37Z","updated":"2026-01-13T16:41:50Z"},{"id":"wordfence:8d4ea0a8-d2f6-4209-b17f-0a26ba664c63","source":"wordfence","cve":"","title":"Zebra_Form PHP library <= 2.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4ea0a8-d2f6-4209-b17f-0a26ba664c63?source=api-prod","affected":[{"type":"plugin","slug":"wp-inimat","name":"WP Inimat","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"ad-swapper","name":"Ad Swapper","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"drug-search","name":"Drug Search","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"teaser-maker-standard","name":"Teaser Maker","from":"*","from_inclusive":true,"to":"0.1.114","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2021-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d4ec326-3008-45f9-a3d7-59b3676182fc","source":"wordfence","cve":"CVE-2024-32448","title":"Ads.txt Admin <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4ec326-3008-45f9-a3d7-59b3676182fc?source=api-prod","affected":[{"type":"plugin","slug":"ads-txt-admin","name":"Ads.txt Admin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:57:00Z"},{"id":"wordfence:8d4f018c-483b-4435-a8b1-f18e5f843507","source":"wordfence","cve":"CVE-2022-4624","title":"GS Logo Slider \u2013 Ticker, Grid, List, Table & Filter Views <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4f018c-483b-4435-a8b1-f18e5f843507?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d4f0513-ac9c-4eaf-b3ce-3a7c47908ef7","source":"wordfence","cve":"CVE-2024-32810","title":"ShortPixel Critical CSS <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4f0513-ac9c-4eaf-b3ce-3a7c47908ef7?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-critical-css","name":"ShortPixel Critical CSS","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:13:29Z"},{"id":"wordfence:8d52779e-3c86-4823-af0e-6f8d55d35e90","source":"wordfence","cve":"CVE-2021-24871","title":"Get Custom Field Values <= 4.0.0 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d52779e-3c86-4823-af0e-6f8d55d35e90?source=api-prod","affected":[{"type":"plugin","slug":"get-custom-field-values","name":"Get Custom Field Values","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2021-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d54079a-1a7e-4391-b7ee-d06d7f8b2312","source":"wordfence","cve":"CVE-2024-43942","title":"Greenshift Query and Meta Addon < 3.9.2 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d54079a-1a7e-4391-b7ee-d06d7f8b2312?source=api-prod","affected":[{"type":"plugin","slug":"greenshiftquery","name":"Greenshift Query and Meta Addon","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":false,"patched_in":"3.9.2"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:31:06Z"},{"id":"wordfence:8d553ff1-9f05-47c2-83be-66dba318e63e","source":"wordfence","cve":"CVE-2020-7104","title":"Chained Quiz <= 1.1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d553ff1-9f05-47c2-83be-66dba318e63e?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.1.8.2","to_inclusive":false,"patched_in":"1.1.8.2"}],"published":"2020-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d5a1aec-11f5-4516-9454-651ca4cd6600","source":"wordfence","cve":"CVE-2021-24151","title":"WP Editor <= 1.2.6.3 - Authenticated (Admin+) SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5a1aec-11f5-4516-9454-651ca4cd6600?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.6.3","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2021-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d5ae315-adc8-4a86-afa0-078feba8e782","source":"wordfence","cve":"CVE-2026-87970","title":"If-So Dynamic Content 1.8 - 1.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5ae315-adc8-4a86-afa0-078feba8e782?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"1.8","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:59:11Z"},{"id":"wordfence:8d5d0c82-f5cd-4eaf-9530-0541985cb533","source":"wordfence","cve":"CVE-2024-37237","title":"FS Poster <= 6.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5d0c82-f5cd-4eaf-9530-0541985cb533?source=api-prod","affected":[{"type":"plugin","slug":"fs-poster","name":"FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]","from":"*","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"6.5.9"}],"published":"2024-06-21T00:00:00Z","updated":"2026-02-26T15:00:22Z"},{"id":"wordfence:8d5d554c-f155-4609-afe0-98f331940b65","source":"wordfence","cve":"CVE-2024-34571","title":"Himalayas <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5d554c-f155-4609-afe0-98f331940b65?source=api-prod","affected":[{"type":"theme","slug":"himalayas","name":"Himalayas","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:52:50Z"},{"id":"wordfence:8d5e45a2-012d-4ccf-a93d-553916f75777","source":"wordfence","cve":"CVE-2026-92420","title":"Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5e45a2-012d-4ccf-a93d-553916f75777?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T20:27:22Z"},{"id":"wordfence:8d5fad17-3b28-4f99-9508-f807cb06cfe5","source":"wordfence","cve":"CVE-2022-46175","title":"json5 <= 1.0.1 and 2.0.0-2.2.1 - Prototype Pollution","severity":"high","cvss":8.8,"cwe":"CWE-1321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d5fad17-3b28-4f99-9508-f807cb06cfe5?source=api-prod","affected":[{"type":"plugin","slug":"simple-podcasting","name":"Simple Podcasting","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d605f1e-6922-48ab-ae94-2f499750fea5","source":"wordfence","cve":"CVE-2026-62040","title":"Restrict User Access \u2013 Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d605f1e-6922-48ab-ae94-2f499750fea5?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-28T21:19:52Z"},{"id":"wordfence:8d60ddd3-b064-48de-bfd3-baac342150b4","source":"wordfence","cve":"CVE-2026-39643","title":"Payment Plugins for PayPal WooCommerce <= 2.0.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d60ddd3-b064-48de-bfd3-baac342150b4?source=api-prod","affected":[{"type":"plugin","slug":"pymntpl-paypal-woocommerce","name":"Payment Plugins for PayPal WooCommerce","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2026-02-14T00:00:00Z","updated":"2026-04-15T21:22:01Z"},{"id":"wordfence:8d652a1e-82b5-4843-8546-c25ca02051d4","source":"wordfence","cve":"CVE-2025-60156","title":"AR For WordPress <= 8.44 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d652a1e-82b5-4843-8546-c25ca02051d4?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-wordpress","name":"AR for WordPress","from":"*","from_inclusive":true,"to":"8.44","to_inclusive":true,"patched_in":"8.45"}],"published":"2025-09-26T00:00:00Z","updated":"2026-07-24T23:54:10Z"},{"id":"wordfence:8d65b779-717b-4efc-b13d-acdf83ca1e63","source":"wordfence","cve":"","title":"Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d65b779-717b-4efc-b13d-acdf83ca1e63?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d6637f7-7035-4355-9c9d-193ea87c6e62","source":"wordfence","cve":"CVE-2024-54242","title":"Simple Notification <= 1.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6637f7-7035-4355-9c9d-193ea87c6e62?source=api-prod","affected":[{"type":"plugin","slug":"simple-notification","name":"Simple Notification","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-18T15:59:39Z"},{"id":"wordfence:8d6a32ac-dae5-4cc0-84b4-c0bef2334c49","source":"wordfence","cve":"CVE-2024-52469","title":"WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6a32ac-dae5-4cc0-84b4-c0bef2334c49?source=api-prod","affected":[{"type":"plugin","slug":"price-alert-woocommerce","name":"WooCommerce Price Alert","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:20:36Z"},{"id":"wordfence:8d6b0d86-3cb4-4723-b677-141c604f00cc","source":"wordfence","cve":"CVE-2025-9376","title":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d6b0d86-3cb4-4723-b677-141c604f00cc?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"11.58","to_inclusive":true,"patched_in":"11.59"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T11:16:23Z"},{"id":"wordfence:8d745937-4b0a-480a-9771-8af3288ee98f","source":"wordfence","cve":"CVE-2024-13517","title":"Easy Digital Downloads \u2013 Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d745937-4b0a-480a-9771-8af3288ee98f?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:09Z"},{"id":"wordfence:8d74c1dd-6bbb-4175-965b-6259e44695c9","source":"wordfence","cve":"CVE-2026-119491","title":"Media Library Assistant <= 3.43 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d74c1dd-6bbb-4175-965b-6259e44695c9?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":true,"patched_in":"3.44"}],"published":"2026-11-07T09:11:00Z","updated":"2026-11-10T19:28:15Z"},{"id":"wordfence:8d761d6b-6019-4ad7-8ca3-bdd260fad1fd","source":"wordfence","cve":"CVE-2026-95515","title":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d761d6b-6019-4ad7-8ca3-bdd260fad1fd?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-09-23T10:48:06Z","updated":"2026-09-29T20:07:40Z"},{"id":"wordfence:8d769308-6273-4ed2-b64a-d9f065de4cce","source":"wordfence","cve":"CVE-2023-1890","title":"Tablesome <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d769308-6273-4ed2-b64a-d9f065de4cce?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d797238-f8f3-44d7-8c16-bee23ce12ae0","source":"wordfence","cve":"CVE-2024-4103","title":"ADFO \u2013 Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d797238-f8f3-44d7-8c16-bee23ce12ae0?source=api-prod","affected":[{"type":"plugin","slug":"admin-form","name":"ADFO \u2013 Custom data in admin dashboard","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:33Z"},{"id":"wordfence:8d7b6ae4-8cf7-4576-ad17-f05f01490e74","source":"wordfence","cve":"CVE-2025-68605","title":"Post Grid and Gutenberg Blocks <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d7b6ae4-8cf7-4576-ad17-f05f01490e74?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.24"}],"published":"2025-12-21T00:00:00Z","updated":"2026-09-09T16:19:34Z"},{"id":"wordfence:8d7c63f3-d845-4a9a-ab98-4da5ee4b3727","source":"wordfence","cve":"CVE-2026-12396","title":"Job Portal <= 2.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d7c63f3-d845-4a9a-ab98-4da5ee4b3727?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-29T22:37:55Z"},{"id":"wordfence:8d7cc468-eeba-497f-9e11-79d4bebdd7a2","source":"wordfence","cve":"CVE-2026-6449","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.2.1 - Unauthenticated Authorization Bypass via Remote Approval Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d7cc468-eeba-497f-9e11-79d4bebdd7a2?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-05-01T19:17:26Z","updated":"2026-05-06T13:18:08Z"},{"id":"wordfence:8d7de93c-f642-4870-b2f9-5070fdccd26b","source":"wordfence","cve":"","title":"Wbcom Designs \u2013 BuddyPress Group Reviews <= 2.8.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d7de93c-f642-4870-b2f9-5070fdccd26b?source=api-prod","affected":[{"type":"plugin","slug":"review-buddypress-groups","name":"Wbcom Designs \u2013 BuddyPress Group Reviews","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d81c8d5-3862-4401-9226-9c7380f364a7","source":"wordfence","cve":"CVE-2025-10048","title":"My Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d81c8d5-3862-4401-9226-9c7380f364a7?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.31","to_inclusive":true,"patched_in":"3.6.32"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T07:25:58Z"},{"id":"wordfence:8d83dd7e-d331-4de0-bd64-69fc5c6b4121","source":"wordfence","cve":"CVE-2026-66619","title":"Newsletters <= 4.18 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d83dd7e-d331-4de0-bd64-69fc5c6b4121?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18","to_inclusive":true,"patched_in":"4.18.1"}],"published":"2026-09-17T11:45:00Z","updated":"2026-09-22T18:47:15Z"},{"id":"wordfence:8d874540-dced-420d-81c0-46c185df10f1","source":"wordfence","cve":"CVE-2006-1796","title":"WordPress Core < 2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d874540-dced-420d-81c0-46c185df10f1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2006-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d89e3b7-d980-42bb-ab0c-d86ab174a69c","source":"wordfence","cve":"CVE-2024-9351","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d89e3b7-d980-42bb-ab0c-d86ab174a69c?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.35.1","to_inclusive":true,"patched_in":"1.36.0"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T05:33:09Z"},{"id":"wordfence:8d8c602f-3ab2-4ccd-8d3c-cfb9d4be540d","source":"wordfence","cve":"CVE-2026-76586","title":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation","severity":"high","cvss":7.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d8c602f-3ab2-4ccd-8d3c-cfb9d4be540d?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"1.5.6","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-08-29T00:00:00Z","updated":"2026-09-02T13:57:08Z"},{"id":"wordfence:8d8ffb68-cd85-4ea9-a772-3539728c76e1","source":"wordfence","cve":"","title":"Members Import <= 1.3 - Cross-Site Request Forgery to User Import and Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d8ffb68-cd85-4ea9-a772-3539728c76e1?source=api-prod","affected":[{"type":"plugin","slug":"members-import","name":"Members Import","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2016-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d93a157-ca5d-4e30-bb9d-c46311d46453","source":"wordfence","cve":"CVE-2025-60089","title":"Gravity Forms FreshDesk <= 1.3.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d93a157-ca5d-4e30-bb9d-c46311d46453?source=api-prod","affected":[{"type":"plugin","slug":"gf-freshdesk","name":"WP Gravity Forms FreshDesk Plugin","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-08-09T00:00:00Z","updated":"2025-12-20T15:45:34Z"},{"id":"wordfence:8d945c4b-3eb1-4bab-b355-117b7fd06553","source":"wordfence","cve":"CVE-2024-6261","title":"Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d945c4b-3eb1-4bab-b355-117b7fd06553?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-02-26T17:00:16Z","updated":"2025-02-27T05:23:08Z"},{"id":"wordfence:8d954868-eff2-497d-84e7-cc42da8a4c6f","source":"wordfence","cve":"CVE-2026-2580","title":"WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d954868-eff2-497d-84e7-cc42da8a4c6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2026-03-22T11:17:17Z","updated":"2026-03-22T23:24:32Z"},{"id":"wordfence:8d966924-aeab-4397-9555-78291af70efe","source":"wordfence","cve":"CVE-2024-10715","title":"MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d966924-aeab-4397-9555-78291af70efe?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.94.1","to_inclusive":true,"patched_in":"2.94.2"}],"published":"2024-11-05T00:00:00Z","updated":"2024-11-06T11:00:29Z"},{"id":"wordfence:8d9720e0-444a-4611-ab8f-33ad005749d5","source":"wordfence","cve":"CVE-2024-37119","title":"Uncanny Automator Pro < 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9720e0-444a-4611-ab8f-33ad005749d5?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator-pro","name":"Uncanny Automator Pro","from":"*","from_inclusive":true,"to":"5.3.0.1","to_inclusive":false,"patched_in":"5.3.0.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:00:10Z"},{"id":"wordfence:8d97a1d3-0f78-4fc2-80ea-8dd600451326","source":"wordfence","cve":"CVE-2025-46237","title":"Link Library <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d97a1d3-0f78-4fc2-80ea-8dd600451326?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":"7.8.1"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:14:04Z"},{"id":"wordfence:8d983e98-c7a9-49f5-ab0d-fdbb94ca1922","source":"wordfence","cve":"CVE-2025-48334","title":"Woo Slider Pro <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d983e98-c7a9-49f5-ab0d-fdbb94ca1922?source=api-prod","affected":[{"type":"plugin","slug":"woo-slider-pro-drag-drop-slider-builder-for-woocommerce","name":"Woo Slider Pro \u2013 Drag Drop Slider Builder For WooCommerce","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:33:28Z"},{"id":"wordfence:8d98a961-bef3-4bce-b493-410eee688bc6","source":"wordfence","cve":"CVE-2023-32510","title":"Order Your Posts Manually <= 2.2.5 - Reflected Cross-Site Scripting via '_user_request'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d98a961-bef3-4bce-b493-410eee688bc6?source=api-prod","affected":[{"type":"plugin","slug":"order-your-posts-manually","name":"Order Your Posts Manually","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8d9a779f-870c-4e57-88fb-c98c8b3cf15d","source":"wordfence","cve":"CVE-2021-47941","title":"WordPress Survey & Pol <= 1.5.7.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9a779f-870c-4e57-88fb-c98c8b3cf15d?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-poll","name":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.5.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-10T00:00:00Z","updated":"2026-07-29T20:51:52Z"},{"id":"wordfence:8d9ba69a-6918-4999-a74c-c8e740ea46db","source":"wordfence","cve":"CVE-2026-27350","title":"Builderius \u2013 Landing Page Builder + Dynamic Templates <= 1.4-beta - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9ba69a-6918-4999-a74c-c8e740ea46db?source=api-prod","affected":[{"type":"plugin","slug":"builderius","name":"Builderius \u2013 Landing Page Builder + Dynamic Templates","from":"*","from_inclusive":true,"to":"1.4-beta","to_inclusive":true,"patched_in":"1.5-rc1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-11-11T14:21:28Z"},{"id":"wordfence:8d9bba8c-0e75-4170-a006-16fa4bd0d0ed","source":"wordfence","cve":"CVE-2024-29820","title":"PDF Builder for WPForms <= 1.2.88 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9bba8c-0e75-4170-a006-16fa4bd0d0ed?source=api-prod","affected":[{"type":"plugin","slug":"pdf-builder-for-wpforms","name":"PDF Builder for WPForms","from":"*","from_inclusive":true,"to":"1.2.88","to_inclusive":true,"patched_in":"1.2.89"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:24:54Z"},{"id":"wordfence:8d9f75e0-1be8-4372-92c5-1f146b08a770","source":"wordfence","cve":"CVE-2025-32167","title":"SurveyJS <= 1.12.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9f75e0-1be8-4372-92c5-1f146b08a770?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.12.20","to_inclusive":true,"patched_in":"1.12.57"}],"published":"2025-04-04T00:00:00Z","updated":"2025-12-19T15:26:43Z"},{"id":"wordfence:8d9fb215-4c00-4b73-824b-e2ee0b7294fe","source":"wordfence","cve":"CVE-2025-31582","title":"Contact Form vCard Generator <= 2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9fb215-4c00-4b73-824b-e2ee0b7294fe?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-vcard-generator","name":"Contact Form vCard Generator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T13:12:52Z"},{"id":"wordfence:8d9fe6b4-8696-45eb-bdb8-764dea7cce88","source":"wordfence","cve":"CVE-2026-16974","title":"Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8d9fe6b4-8696-45eb-bdb8-764dea7cce88?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-08-10T15:36:36Z","updated":"2026-08-11T04:25:51Z"},{"id":"wordfence:8da0b944-aa60-489b-8622-44b325fcd242","source":"wordfence","cve":"","title":"FoxyPress <= 0.4.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da0b944-aa60-489b-8622-44b325fcd242?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.2.6","to_inclusive":true,"patched_in":"0.4.2.7"}],"published":"2012-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da0fed9-4b88-4b68-b317-124fe678cfa4","source":"wordfence","cve":"CVE-2023-35773","title":"Template Debugger <= 3.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da0fed9-4b88-4b68-b317-124fe678cfa4?source=api-prod","affected":[{"type":"plugin","slug":"quick-edit-template-link","name":"Template Debugger","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da178a2-5baa-46fe-b4da-67e26b219bc0","source":"wordfence","cve":"CVE-2026-93620","title":"PayPlus Payment Gateway <= 8.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da178a2-5baa-46fe-b4da-67e26b219bc0?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2026-09-23T13:16:05Z","updated":"2026-09-29T19:47:37Z"},{"id":"wordfence:8da2619f-bc41-4088-9192-902b3c24ec5d","source":"wordfence","cve":"CVE-2022-3097","title":"Plugin LBstopattack <= 1.1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da2619f-bc41-4088-9192-902b3c24ec5d?source=api-prod","affected":[{"type":"plugin","slug":"lbstopattack","name":"Plugin LBstopattack","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da2ac6e-4fdc-448f-928d-495f65e0ec1f","source":"wordfence","cve":"CVE-2024-37438","title":"Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da2ac6e-4fdc-448f-928d-495f65e0ec1f?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-toolkit-pro","name":"Uncanny Toolkit Pro for LearnDash","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.4.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:25:34Z"},{"id":"wordfence:8da42003-f2d8-4837-84b2-e0e7171fa3fe","source":"wordfence","cve":"CVE-2023-45047","title":"LeadSquared Suite <= 0.7.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da42003-f2d8-4837-84b2-e0e7171fa3fe?source=api-prod","affected":[{"type":"plugin","slug":"leadsquared-suite","name":"LeadSquared Suite","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da49c2e-576c-490b-b812-96d15b6d2b1b","source":"wordfence","cve":"CVE-2020-36749","title":"Easy Testimonials <= 3.6.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da49c2e-576c-490b-b812-96d15b6d2b1b?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da49fb2-d12a-4d23-9a8a-1b999046573a","source":"wordfence","cve":"CVE-2016-10980","title":"Kento Post View Counter <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da49fb2-d12a-4d23-9a8a-1b999046573a?source=api-prod","affected":[{"type":"plugin","slug":"kento-post-view-counter","name":"Kento Post View Counter","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2016-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8da64b2f-8546-4276-9dbf-b60e885a0309","source":"wordfence","cve":"CVE-2024-12636","title":"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da64b2f-8546-4276-9dbf-b60e885a0309?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T04:22:05Z"},{"id":"wordfence:8da902c8-7b48-4628-a83f-91bd01451ff0","source":"wordfence","cve":"CVE-2026-22331","title":"AutoParts <= 1.5.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8da902c8-7b48-4628-a83f-91bd01451ff0?source=api-prod","affected":[{"type":"theme","slug":"autoparts","name":"AutoParts - Car Parts Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:22:09Z"},{"id":"wordfence:8daa0321-e8cc-416d-ad0e-173e316caf83","source":"wordfence","cve":"CVE-2026-5715","title":"Voyage Plus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8daa0321-e8cc-416d-ad0e-173e316caf83?source=api-prod","affected":[{"type":"plugin","slug":"voyage-plus","name":"Voyage Plus","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:04:30Z","updated":"2026-05-12T07:48:24Z"},{"id":"wordfence:8daa04cd-b61e-435f-9e10-3319949fdac7","source":"wordfence","cve":"CVE-2024-43930","title":"JobSearch <= 2.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8daa04cd-b61e-435f-9e10-3319949fdac7?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:25:38Z"},{"id":"wordfence:8dad1a7c-a5a5-486b-bf15-6fd455e6612c","source":"wordfence","cve":"CVE-2024-1962","title":"CM Download Manager < 2.9.1 - Cross-Site Request Forgery via editHeader","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dad1a7c-a5a5-486b-bf15-6fd455e6612c?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-27T20:51:29Z"},{"id":"wordfence:8dae13e5-cee7-4392-af71-7d466ba6f6c4","source":"wordfence","cve":"CVE-2023-34168","title":"WP Report Post <= 2.1.2 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dae13e5-cee7-4392-af71-7d466ba6f6c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-report-post","name":"WP Report Post","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8db434d3-1bbc-499c-a2b2-0e2e86d7a088","source":"wordfence","cve":"CVE-2026-24609","title":"Laurent <= 3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8db434d3-1bbc-499c-a2b2-0e2e86d7a088?source=api-prod","affected":[{"type":"theme","slug":"laurent","name":"Laurent - Elegant Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-02-03T21:02:17Z"},{"id":"wordfence:8db71624-5394-417b-9cc4-ae7376a475c7","source":"wordfence","cve":"CVE-2025-22501","title":"Improve My City <= 1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8db71624-5394-417b-9cc4-ae7376a475c7?source=api-prod","affected":[{"type":"plugin","slug":"improve-my-city","name":"Improve My City","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:00:24Z"},{"id":"wordfence:8db736fb-cd6c-4a52-9dd3-eefd0a8d9267","source":"wordfence","cve":"CVE-2026-5721","title":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 - Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8db736fb-cd6c-4a52-9dd3-eefd0a8d9267?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"6.5.0.4","to_inclusive":true,"patched_in":"6.5.0.5"}],"published":"2026-04-20T09:28:15Z","updated":"2026-04-20T22:25:26Z"},{"id":"wordfence:8db8adba-347f-4bdc-8215-23b6f8eb0327","source":"wordfence","cve":"CVE-2023-38482","title":"Post Affiliate Pro <= 1.24.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8adba-347f-4bdc-8215-23b6f8eb0327?source=api-prod","affected":[{"type":"plugin","slug":"postaffiliatepro","name":"Post Affiliate Pro","from":"*","from_inclusive":true,"to":"1.24.9","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8db8bbc3-43ca-4ef5-a44d-2987c8597961","source":"wordfence","cve":"CVE-2024-2340","title":"Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing","severity":"medium","cvss":5.3,"cwe":"CWE-548","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.6","to_inclusive":true,"patched_in":"7.11.7"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:55:12Z"},{"id":"wordfence:8dba465f-cbdb-4c0b-bb73-89514b36f3cc","source":"wordfence","cve":"CVE-2026-41562","title":"Norvis Backup <= 1.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dba465f-cbdb-4c0b-bb73-89514b36f3cc?source=api-prod","affected":[{"type":"plugin","slug":"norvis-backup","name":"Norvis Backup","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:29:07Z","updated":"2026-10-08T23:33:48Z"},{"id":"wordfence:8dbaed2a-cc35-455c-ad7e-c7826d5b3e7f","source":"wordfence","cve":"CVE-2022-3441","title":"Rock Convert <= 2.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbaed2a-cc35-455c-ad7e-c7826d5b3e7f?source=api-prod","affected":[{"type":"plugin","slug":"rock-convert","name":"Rock Convert","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dbb8e0f-c846-47c0-bdae-14520e960d73","source":"wordfence","cve":"CVE-2026-77757","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.5 - 8.9.2 - Authenticated (Subscriber+) Arbitrary Image Move","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbb8e0f-c846-47c0-bdae-14520e960d73?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"8.5","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"8.9.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:48:21Z"},{"id":"wordfence:8dbce591-8eb9-479d-9786-be08984bc0eb","source":"wordfence","cve":"CVE-2025-23790","title":"Easy Code Placement <= 18.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbce591-8eb9-479d-9786-be08984bc0eb?source=api-prod","affected":[{"type":"plugin","slug":"easy-code-placement","name":"Easy Code Placement","from":"*","from_inclusive":true,"to":"18.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:24:21Z"},{"id":"wordfence:8dbdc4f6-0a3b-4f06-b1e5-e80e4795bf4b","source":"wordfence","cve":"CVE-2025-28966","title":"Recent Posts Slider Responsive <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbdc4f6-0a3b-4f06-b1e5-e80e4795bf4b?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-slider-responsive","name":"Recent Posts Slider Responsive","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:03:07Z"},{"id":"wordfence:8dbe4104-b7d1-484f-a843-a3d1fc02999d","source":"wordfence","cve":"CVE-2024-5612","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dbe4104-b7d1-484f-a843-a3d1fc02999d?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-elementor","name":"Essential Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"5.8.15","to_inclusive":true,"patched_in":"5.8.16"}],"published":"2024-06-06T16:18:55Z","updated":"2024-06-07T04:33:24Z"},{"id":"wordfence:8dc16ba4-3c2e-43e2-82a0-b742276b9640","source":"wordfence","cve":"CVE-2025-6639","title":"Tutor LMS Pro \u2013 eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc16ba4-3c2e-43e2-82a0-b742276b9640?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-10-24T17:30:42Z","updated":"2025-10-25T05:31:22Z"},{"id":"wordfence:8dc3cd92-db38-4aa4-8907-9ba7e99380f6","source":"wordfence","cve":"","title":"WR ContactForm < 1.1.10 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc3cd92-db38-4aa4-8907-9ba7e99380f6?source=api-prod","affected":[{"type":"plugin","slug":"wr-contactform","name":"WR ContactForm","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dc41ac8-1126-4fcc-942e-89e15b1ebfb7","source":"wordfence","cve":"CVE-2022-1539","title":"Exports and Reports <= 0.9.1 - CSV Injection","severity":"high","cvss":7.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc41ac8-1126-4fcc-942e-89e15b1ebfb7?source=api-prod","affected":[{"type":"plugin","slug":"exports-and-reports","name":"Exports and Reports","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dc5404b-b2dd-496f-b56c-e4f3960e77e7","source":"wordfence","cve":"CVE-2025-53348","title":"Kalium <= 3.18.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc5404b-b2dd-496f-b56c-e4f3960e77e7?source=api-prod","affected":[{"type":"theme","slug":"kalium","name":"Kalium 3 | Creative WordPress & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.19"}],"published":"2025-08-21T00:00:00Z","updated":"2026-02-26T15:31:24Z"},{"id":"wordfence:8dc548cd-16ea-47ac-b4be-eecaf4799690","source":"wordfence","cve":"","title":"Responsive Slider \u2013 Image Slider \u2013 Slideshow for WordPress <= 2.8.6 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc548cd-16ea-47ac-b4be-eecaf4799690?source=api-prod","affected":[{"type":"plugin","slug":"slider-image","name":"Responsive Slider \u2013 Image Slider \u2013 Slideshow for WordPress","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":false,"patched_in":"2.8.7"}],"published":"2015-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dc991ea-0d00-4734-9b9a-5af759e83540","source":"wordfence","cve":"CVE-2025-13853","title":"Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc991ea-0d00-4734-9b9a-5af759e83540?source=api-prod","affected":[{"type":"plugin","slug":"nearby-now-reviews","name":"Nearby Now Reviews","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:19:01Z","updated":"2026-01-09T09:19:47Z"},{"id":"wordfence:8dca7f2e-f572-468a-8342-a6e096441561","source":"wordfence","cve":"CVE-2024-1977","title":"Restaurant Solutions \u2013 Checklist 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dca7f2e-f572-468a-8342-a6e096441561?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-solutions-checklist","name":"Restaurant Solutions \u2013 Checklist","from":"1.0.0","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T05:32:21Z"},{"id":"wordfence:8dcf5685-94b8-432c-8073-e1fb1a2ca29b","source":"wordfence","cve":"CVE-2024-55979","title":"Wr Age Verification <= 2.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dcf5685-94b8-432c-8073-e1fb1a2ca29b?source=api-prod","affected":[{"type":"plugin","slug":"wr-age-verification","name":"Wr Age Verification","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T16:59:02Z"},{"id":"wordfence:8dd34937-7641-4b9c-ba59-c4a1ec95f4cd","source":"wordfence","cve":"CVE-2024-43222","title":"Sweet Date <= 3.7.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dd34937-7641-4b9c-ba59-c4a1ec95f4cd?source=api-prod","affected":[{"type":"theme","slug":"sweetdate","name":"Sweet Date","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-12T18:43:16Z"},{"id":"wordfence:8dd3e94d-4397-4f8e-af21-b12e87e0cfb8","source":"wordfence","cve":"CVE-2025-69319","title":"Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dd3e94d-4397-4f8e-af21-b12e87e0cfb8?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.4.1","to_inclusive":true,"patched_in":"2.9.4.2"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:46:28Z"},{"id":"wordfence:8dd697ef-cffb-4360-94b5-42178c221a39","source":"wordfence","cve":"CVE-2025-23959","title":"Good Old Gallery <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dd697ef-cffb-4360-94b5-42178c221a39?source=api-prod","affected":[{"type":"plugin","slug":"good-old-gallery","name":"Good Old Gallery","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:36:09Z"},{"id":"wordfence:8dda7b14-c341-434b-85f1-029f384c65d6","source":"wordfence","cve":"CVE-2023-23786","title":"affiliate-toolkit \u2013 WordPress Affiliate Plugin <= 3.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dda7b14-c341-434b-85f1-029f384c65d6?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ddacd1d-3789-438a-92c6-edc198d4df14","source":"wordfence","cve":"CVE-2025-68894","title":"ShoutOut <= 4.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddacd1d-3789-438a-92c6-edc198d4df14?source=api-prod","affected":[{"type":"plugin","slug":"shoutout","name":"ShoutOut","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-27T19:22:08Z"},{"id":"wordfence:8ddbad10-6827-4587-b039-3d22d8383c12","source":"wordfence","cve":"CVE-2025-53446","title":"Beautique <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddbad10-6827-4587-b039-3d22d8383c12?source=api-prod","affected":[{"type":"theme","slug":"beautique","name":"Beautique \u2014 Luxury Salon & Barbershop WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:26:53Z"},{"id":"wordfence:8ddbfa41-94c3-4aca-a3ec-f46b4b248f66","source":"wordfence","cve":"CVE-2025-49398","title":"Easy Appointments <= 3.12.14 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddbfa41-94c3-4aca-a3ec-f46b4b248f66?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.14","to_inclusive":true,"patched_in":"3.12.14.1"}],"published":"2025-09-09T00:00:00Z","updated":"2025-11-12T13:54:21Z"},{"id":"wordfence:8ddc2351-c73c-407d-a3a8-eccde252819b","source":"wordfence","cve":"CVE-2025-48243","title":"reCAPTCHA for all <= 2.26 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddc2351-c73c-407d-a3a8-eccde252819b?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-for-all","name":"Integrator for Turnstile and reCAPTCHA.","from":"*","from_inclusive":true,"to":"2.26","to_inclusive":true,"patched_in":"2.27"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:55:22Z"},{"id":"wordfence:8ddc4593-bdb4-4b01-be28-4317c76ae6b0","source":"wordfence","cve":"","title":"WPS Bidouille <= 1.12.2 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddc4593-bdb4-4b01-be28-4317c76ae6b0?source=api-prod","affected":[{"type":"plugin","slug":"wps-bidouille","name":"WPS Bidouille","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ddeaf57-df82-48f0-b53d-a35a6cd80aca","source":"wordfence","cve":"CVE-2017-5611","title":"WordPress Core < 4.7.2 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddeaf57-df82-48f0-b53d-a35a6cd80aca?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.7.18"}],"published":"2017-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ddf6964-e0e7-4093-8aea-ac33f4214122","source":"wordfence","cve":"","title":"Blaze Slideshow <= 2.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddf6964-e0e7-4093-8aea-ac33f4214122?source=api-prod","affected":[{"type":"plugin","slug":"blaze-slide-show-for-wordpress","name":"Blaze Slideshow","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.6"}],"published":"2012-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ddfafbf-3489-4d41-9ca7-d9757fd8cb04","source":"wordfence","cve":"CVE-2025-47587","title":"YaySMTP <= 2.6.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ddfafbf-3489-4d41-9ca7-d9757fd8cb04?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:24:04Z"},{"id":"wordfence:8de2156f-5087-4c16-8e5d-93b5c72ec536","source":"wordfence","cve":"CVE-2026-1051","title":"Newsletter \u2013 Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de2156f-5087-4c16-8e5d-93b5c72ec536?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2026-01-19T11:44:32Z","updated":"2026-01-20T01:22:46Z"},{"id":"wordfence:8de25651-4119-4806-91e4-4ea213086bfb","source":"wordfence","cve":"CVE-2023-5991","title":"Hotel Booking Lite <= 4.8.4 - Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de25651-4119-4806-91e4-4ea213086bfb?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":false,"patched_in":"4.8.5"}],"published":"2023-12-01T00:00:00Z","updated":"2024-02-06T16:47:21Z"},{"id":"wordfence:8de3580c-7740-41a1-a9e3-4b0abcac2a05","source":"wordfence","cve":"CVE-2024-45459","title":"Product Slider for WooCommerce <= 1.13.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3580c-7740-41a1-a9e3-4b0abcac2a05?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-slider","name":"Product Slider, Product Grid, Product Masonry","from":"*","from_inclusive":true,"to":"1.13.50","to_inclusive":true,"patched_in":"1.13.51"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T15:58:14Z"},{"id":"wordfence:8de3b45c-e0f2-48a6-a7b3-207981161691","source":"wordfence","cve":"CVE-2025-23976","title":"Issuu Panel <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3b45c-e0f2-48a6-a7b3-207981161691?source=api-prod","affected":[{"type":"plugin","slug":"issuu-panel","name":"Issuu Panel","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:31:59Z"},{"id":"wordfence:8de3d3c7-bde2-4455-8d60-20307f0a53ee","source":"wordfence","cve":"CVE-2023-0086","title":"JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3d3c7-bde2-4455-8d60-20307f0a53ee?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8de52b68-c273-4561-98b0-e51afd6cd47b","source":"wordfence","cve":"CVE-2024-23825","title":"TablePress <= 2.2.4 - Authenticated(Author+) Server Side Request Forgery(SSRF) via _get_import_files","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de52b68-c273-4561-98b0-e51afd6cd47b?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T18:18:36Z"},{"id":"wordfence:8de8a412-af19-4a1e-a131-47815b38517f","source":"wordfence","cve":"","title":"My Calendar < 2.3.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de8a412-af19-4a1e-a131-47815b38517f?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"2.3.30","to_inclusive":false,"patched_in":"2.3.30"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8de966f8-6e3d-459e-8d15-3c028af64d1c","source":"wordfence","cve":"CVE-2026-114444","title":"Security by CleanTalk <= 2.190 - Authenticated (Administrator+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8de966f8-6e3d-459e-8d15-3c028af64d1c?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.190","to_inclusive":true,"patched_in":"2.191"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:24:55Z"},{"id":"wordfence:8debe6ab-2705-40f5-8bcb-7b0c823d55e9","source":"wordfence","cve":"CVE-2025-67595","title":"Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8debe6ab-2705-40f5-8bcb-7b0c823d55e9?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.82","to_inclusive":true,"patched_in":"6.7.0.83"}],"published":"2025-12-02T00:00:00Z","updated":"2025-12-11T16:14:43Z"},{"id":"wordfence:8ded7bd6-3dd8-4659-9704-f197e7c2f941","source":"wordfence","cve":"CVE-2026-1641","title":"Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ded7bd6-3dd8-4659-9704-f197e7c2f941?source=api-prod","affected":[{"type":"plugin","slug":"wow-elements-addons-for-elementor","name":"Wow Elements Addons for Elementor","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.11.3"}],"published":"2026-09-18T19:31:31Z","updated":"2026-09-19T07:43:17Z"},{"id":"wordfence:8dee1e17-0144-482d-81bc-a345ddce6abf","source":"wordfence","cve":"CVE-2024-56028","title":"Lemonade Social Networks Autoposter Pinterest <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dee1e17-0144-482d-81bc-a345ddce6abf?source=api-prod","affected":[{"type":"plugin","slug":"lemonade-sna-pinterest-edition","name":"Lemonade Social Networks Autoposter Pinterest","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:00:50Z"},{"id":"wordfence:8dee5ec0-d319-4898-ad7c-8685ea197de6","source":"wordfence","cve":"CVE-2025-57977","title":"Flexible PDF Invoices for WooCommerce &amp; WordPress <= 6.0.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dee5ec0-d319-4898-ad7c-8685ea197de6?source=api-prod","affected":[{"type":"plugin","slug":"flexible-invoices","name":"Flexible PDF Invoices for WooCommerce & WordPress","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"6.0.14"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T21:10:04Z"},{"id":"wordfence:8dee7376-0177-4b9d-88f6-d2df054aca65","source":"wordfence","cve":"CVE-2026-39545","title":"Zermatt <= 1.6.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dee7376-0177-4b9d-88f6-d2df054aca65?source=api-prod","affected":[{"type":"theme","slug":"zermatt","name":"Zermatt - Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:05:40Z"},{"id":"wordfence:8def156a-f2f2-4640-a1c9-c21c74e1f308","source":"wordfence","cve":"CVE-2024-4157","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8def156a-f2f2-4640-a1c9-c21c74e1f308?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.15","to_inclusive":true,"patched_in":"5.1.16"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-22T07:37:26Z"},{"id":"wordfence:8def925b-c123-47d8-984f-a7e78b9db6dc","source":"wordfence","cve":"CVE-2025-26570","title":"Glance That <= 4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8def925b-c123-47d8-984f-a7e78b9db6dc?source=api-prod","affected":[{"type":"plugin","slug":"glance-that","name":"Glance That","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:34:59Z"},{"id":"wordfence:8defdd2e-e191-498e-826a-b73c6b4f2f57","source":"wordfence","cve":"CVE-2022-45818","title":"Hero Banner Ultimate <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8defdd2e-e191-498e-826a-b73c6b4f2f57?source=api-prod","affected":[{"type":"plugin","slug":"hero-banner-ultimate","name":"Hero Banner Ultimate","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.4"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8df03b7f-58c0-4a84-9f96-7ae7596e5b77","source":"wordfence","cve":"CVE-2025-62940","title":"Blox Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df03b7f-58c0-4a84-9f96-7ae7596e5b77?source=api-prod","affected":[{"type":"plugin","slug":"blox-lite","name":"Blox Lite","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:52:24Z"},{"id":"wordfence:8df2134a-5099-415e-a9e0-3c8e2f2c2720","source":"wordfence","cve":"CVE-2024-6462","title":"DL Yandex Metrika <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df2134a-5099-415e-a9e0-3c8e2f2c2720?source=api-prod","affected":[{"type":"plugin","slug":"dl-yandex-metrika","name":"DL Yandex Metrika","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-06T00:00:00Z","updated":"2024-08-09T14:08:26Z"},{"id":"wordfence:8df4f144-0bf3-457f-8014-f603f7179044","source":"wordfence","cve":"CVE-2021-24616","title":"AddToAny Share Buttons <= 1.7.47 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df4f144-0bf3-457f-8014-f603f7179044?source=api-prod","affected":[{"type":"plugin","slug":"add-to-any","name":"AddToAny Share Buttons","from":"*","from_inclusive":true,"to":"1.7.48","to_inclusive":false,"patched_in":"1.7.48"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8df5c412-e995-411f-94a9-afd7f9941125","source":"wordfence","cve":"CVE-2024-43978","title":"Super Store Finder <= 6.9.7 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df5c412-e995-411f-94a9-afd7f9941125?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:11:42Z"},{"id":"wordfence:8df66139-68bc-4bb4-80b5-aca604800ece","source":"wordfence","cve":"CVE-2026-13142","title":"Social Login, Passkeys, Magic Link & Email OTP < 1.4.1 - Unauthenticated Account Takeover via OTP Brute Force","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df66139-68bc-4bb4-80b5-aca604800ece?source=api-prod","affected":[{"type":"plugin","slug":"ventraconnect-social-login","name":"Social Login, Passkeys, Magic Link & Email OTP \u2013 Passwordless Login by VentraConnect","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-30T14:48:12Z"},{"id":"wordfence:8df77bb7-4453-403d-8d35-66251f6d399c","source":"wordfence","cve":"CVE-2022-1787","title":"Sideblog WordPress Plugin <= 6.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8df77bb7-4453-403d-8d35-66251f6d399c?source=api-prod","affected":[{"type":"plugin","slug":"sideblog","name":"Sideblog WordPress Plugin","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dfa65cb-3d16-471a-8464-b71510d65fd5","source":"wordfence","cve":"","title":"Toolbox <= 1.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dfa65cb-3d16-471a-8464-b71510d65fd5?source=api-prod","affected":[{"type":"theme","slug":"toolbox","name":"Toolbox","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2012-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dfae3cc-b885-4fb8-a6df-a904d5df3c3b","source":"wordfence","cve":"CVE-2025-23442","title":"Shockingly Big IE6 Warning <= 1.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dfae3cc-b885-4fb8-a6df-a904d5df3c3b?source=api-prod","affected":[{"type":"plugin","slug":"shockingly-big-ie6-warning","name":"Shockingly Big IE6 Warning","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:36:21Z"},{"id":"wordfence:8dfc0d5e-bdc4-4f71-8aa3-0a4fbd7ef37d","source":"wordfence","cve":"CVE-2023-41850","title":"Outbound Link Manager <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dfc0d5e-bdc4-4f71-8aa3-0a4fbd7ef37d?source=api-prod","affected":[{"type":"plugin","slug":"outbound-link-manager","name":"Outbound Link Manager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8dfd2822-29c8-4929-b153-6530c70431b6","source":"wordfence","cve":"CVE-2025-54031","title":"Support Board <= 3.8.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dfd2822-29c8-4929-b153-6530c70431b6?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T21:05:48Z"},{"id":"wordfence:8dfd77b4-0604-4724-9293-ddc71b90102f","source":"wordfence","cve":"CVE-2026-16620","title":"WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8dfd77b4-0604-4724-9293-ddc71b90102f?source=api-prod","affected":[{"type":"plugin","slug":"wpc-name-your-price","name":"WPC Name Your Price for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-21T15:42:43Z"},{"id":"wordfence:8e00a06c-9623-48e0-b212-20a2f1e7e640","source":"wordfence","cve":"CVE-2023-44151","title":"Pre-Publish Checklist <= 1.1.1 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e00a06c-9623-48e0-b212-20a2f1e7e640?source=api-prod","affected":[{"type":"plugin","slug":"pre-publish-checklist","name":"Pre-Publish Checklist","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e014aa5-4fdf-458b-a975-e3ced7186dc2","source":"wordfence","cve":"CVE-2024-10320","title":"Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e014aa5-4fdf-458b-a975-e3ced7186dc2?source=api-prod","affected":[{"type":"plugin","slug":"cookielay","name":"Cookielay","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:43:42Z","updated":"2024-12-06T08:24:55Z"},{"id":"wordfence:8e01e4ec-287b-405d-94c8-4627c54ede37","source":"wordfence","cve":"CVE-2025-23617","title":"Floatbox Plus <= 1.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e01e4ec-287b-405d-94c8-4627c54ede37?source=api-prod","affected":[{"type":"plugin","slug":"floatbox-plus","name":"Floatbox Plus","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:15:38Z"},{"id":"wordfence:8e029624-7fc2-4290-8d54-94b319793d76","source":"wordfence","cve":"CVE-2026-16042","title":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools < 3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e029624-7fc2-4290-8d54-94b319793d76?source=api-prod","affected":[{"type":"plugin","slug":"lws-optimize","name":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:11:19Z"},{"id":"wordfence:8e039295-2ccf-450c-8f2a-d113117b9dce","source":"wordfence","cve":"CVE-2021-34620","title":"WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e039295-2ccf-450c-8f2a-d113117b9dce?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"3.6.67","to_inclusive":false,"patched_in":"3.6.67"}],"published":"2021-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e04769b-2977-48fc-8ec8-bb0b2905f89c","source":"wordfence","cve":"CVE-2024-10903","title":"Broken Link Checker <= 2.4.1 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e04769b-2977-48fc-8ec8-bb0b2905f89c?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T14:04:13Z"},{"id":"wordfence:8e05cf0c-3eea-46fd-ab47-e8080a0d2797","source":"wordfence","cve":"CVE-2026-116868","title":"BuddyPress Xprofile Custom Field Types <= 1.3.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e05cf0c-3eea-46fd-ab47-e8080a0d2797?source=api-prod","affected":[{"type":"plugin","slug":"bp-xprofile-custom-field-types","name":"BuddyPress Xprofile Custom Field Types","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T07:23:21Z","updated":"2026-11-03T19:37:38Z"},{"id":"wordfence:8e06032d-2e03-448b-9fe0-282d7723a605","source":"wordfence","cve":"CVE-2018-20970","title":"PDF & Print by BestWebSoft < 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e06032d-2e03-448b-9fe0-282d7723a605?source=api-prod","affected":[{"type":"plugin","slug":"pdf-print","name":"PDF & Print by BestWebSoft \u2013 WordPress Posts and Pages PDF Generator Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2017-12-04T00:00:00Z","updated":"2024-08-15T18:18:46Z"},{"id":"wordfence:8e0e1557-3861-44e3-b7ca-8b2d19550e25","source":"wordfence","cve":"CVE-2026-94263","title":"Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e0e1557-3861-44e3-b7ca-8b2d19550e25?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.9.2.4","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T15:11:20Z"},{"id":"wordfence:8e0e6fdd-49d2-404a-83e8-c4884bbe7088","source":"wordfence","cve":"","title":"Newsletters <= 4.6.4.2 - Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e0e6fdd-49d2-404a-83e8-c4884bbe7088?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.6.4.2","to_inclusive":true,"patched_in":"4.6.4.3"}],"published":"2017-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e0ff2d6-65d2-4a54-b3e5-64b424013313","source":"wordfence","cve":"CVE-2025-6206","title":"Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e0ff2d6-65d2-4a54-b3e5-64b424013313?source=api-prod","affected":[{"type":"plugin","slug":"aiomatic-automatic-ai-content-writer","name":"Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-06-23T00:00:00Z","updated":"2025-06-24T08:23:57Z"},{"id":"wordfence:8e103afe-3ae7-413f-92b2-0e4dd9436f3e","source":"wordfence","cve":"CVE-2024-12110","title":"Gold Addons for Elementor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e103afe-3ae7-413f-92b2-0e4dd9436f3e?source=api-prod","affected":[{"type":"plugin","slug":"gold-addons-for-elementor","name":"Gold Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:43:57Z","updated":"2024-12-06T08:24:55Z"},{"id":"wordfence:8e11fcc5-c9af-43e7-8c1d-803124e04e63","source":"wordfence","cve":"CVE-2023-23864","title":"Very Simple Google Maps <= 2.8.4 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e11fcc5-c9af-43e7-8c1d-803124e04e63?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-google-maps","name":"Very Simple Google Maps","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.9"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e125188-4aff-4c64-b4ec-a363db2431b7","source":"wordfence","cve":"CVE-2023-27428","title":"WP Users Media <= 4.2.3 - Missing Authorization via wpusme_save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e125188-4aff-4c64-b4ec-a363db2431b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-users-media","name":"WP Users Media","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e127217-fd2a-4b8b-a6a5-85e246bc1289","source":"wordfence","cve":"CVE-2024-31091","title":"Custom Field Bulk Editor <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e127217-fd2a-4b8b-a6a5-85e246bc1289?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-bulk-editor","name":"Custom Field Bulk Editor","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:28:57Z"},{"id":"wordfence:8e12950d-9896-4fad-bf6e-239f5ed501e5","source":"wordfence","cve":"CVE-2025-62130","title":"Accordion Slider Gallery <= 2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e12950d-9896-4fad-bf6e-239f5ed501e5?source=api-prod","affected":[{"type":"plugin","slug":"accordion-slider-gallery","name":"Accordion Slider Gallery","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:28:23Z"},{"id":"wordfence:8e12d132-c036-4665-bb8d-e31e2b155fbd","source":"wordfence","cve":"","title":"Relevanssi - A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e12d132-c036-4665-bb8d-e31e2b155fbd?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.16.3","to_inclusive":false,"patched_in":"2.16.4"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.14.3","to_inclusive":false,"patched_in":"4.14.4"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e1371a5-ed2e-4a1b-901e-8aef4d0d3acf","source":"wordfence","cve":"CVE-2026-57626","title":"MailPoet \u2013 Newsletters, Email Marketing, and Automation  5.30.0-5.33.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e1371a5-ed2e-4a1b-901e-8aef4d0d3acf?source=api-prod","affected":[{"type":"plugin","slug":"mailpoet","name":"MailPoet \u2013 Newsletters, Email Marketing, and Automation","from":"5.30.0","from_inclusive":true,"to":"5.33.0","to_inclusive":true,"patched_in":"5.33.1"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:55:46Z"},{"id":"wordfence:8e13e57e-becf-4f03-bba2-e4584c84b95c","source":"wordfence","cve":"CVE-2025-68494","title":"Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e13e57e-becf-4f03-bba2-e4584c84b95c?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.53","to_inclusive":true,"patched_in":"4.11.54"}],"published":"2025-12-04T00:00:00Z","updated":"2026-01-05T21:24:17Z"},{"id":"wordfence:8e143386-4ff7-4d2d-9cea-642cee198d55","source":"wordfence","cve":"CVE-2026-27427","title":"Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e143386-4ff7-4d2d-9cea-642cee198d55?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:25:37Z"},{"id":"wordfence:8e15d347-8cdb-4988-a68b-eb2f713ae69f","source":"wordfence","cve":"CVE-2026-25342","title":"Boutique < 2.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e15d347-8cdb-4988-a68b-eb2f713ae69f?source=api-prod","affected":[{"type":"theme","slug":"kute-boutique","name":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":false,"patched_in":"2.4.6"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:38:24Z"},{"id":"wordfence:8e175383-be6c-441b-a29a-02277c599ebb","source":"wordfence","cve":"CVE-2026-14872","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.4 - Authenticated (Authenticated+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e175383-be6c-441b-a29a-02277c599ebb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:23:49Z"},{"id":"wordfence:8e187b71-860e-4404-bbe2-193c6ecfd485","source":"wordfence","cve":"CVE-2023-23683","title":"White Label Branding for Elementor Page Builder <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e187b71-860e-4404-bbe2-193c6ecfd485?source=api-prod","affected":[{"type":"plugin","slug":"white-label-branding-elementor","name":"White Label Branding for Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e1ede84-05f5-4eae-97de-63b32b62bad3","source":"wordfence","cve":"CVE-2025-57974","title":"TZ PlusGallery <= 1.5.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e1ede84-05f5-4eae-97de-63b32b62bad3?source=api-prod","affected":[{"type":"plugin","slug":"tz-plus-gallery","name":"TZ Plus Gallery","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:09:01Z"},{"id":"wordfence:8e1fb02f-b19c-42d3-8a31-6465077a1715","source":"wordfence","cve":"CVE-2025-25098","title":"Links in Captions <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e1fb02f-b19c-42d3-8a31-6465077a1715?source=api-prod","affected":[{"type":"plugin","slug":"links-in-captions","name":"Links in Captions","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:24:06Z"},{"id":"wordfence:8e227e25-3dd9-47fd-bba8-e076f7f92d56","source":"wordfence","cve":"CVE-2023-45761","title":"Sendle Shipping <= 5.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e227e25-3dd9-47fd-bba8-e076f7f92d56?source=api-prod","affected":[{"type":"plugin","slug":"official-sendle-shipping-method","name":"Sendle Shipping Plugin","from":"*","from_inclusive":true,"to":"5.17","to_inclusive":true,"patched_in":"5.18"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-14T14:24:19Z"},{"id":"wordfence:8e24306a-b741-4840-b238-e37138425bf8","source":"wordfence","cve":"CVE-2024-4356","title":"List categories <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e24306a-b741-4840-b238-e37138425bf8?source=api-prod","affected":[{"type":"plugin","slug":"list-categories","name":"List categories","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":"0.5"}],"published":"2024-05-29T15:51:10Z","updated":"2024-06-05T13:44:55Z"},{"id":"wordfence:8e25914f-f2c6-4224-a2f4-0b691d1e77aa","source":"wordfence","cve":"CVE-2019-16120","title":"Event Tickets <= 4.10.7.1 - CSV Injection","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e25914f-f2c6-4224-a2f4-0b691d1e77aa?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"4.10.7.1","to_inclusive":true,"patched_in":"4.10.7.2"}],"published":"2019-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e25a511-f176-4532-bb9f-a7a3134ee29a","source":"wordfence","cve":"CVE-2022-1558","title":"Curtain <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e25a511-f176-4532-bb9f-a7a3134ee29a?source=api-prod","affected":[{"type":"plugin","slug":"curtain","name":"Curtain","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e2672b5-64a2-4b30-b0be-2a9303d46ac1","source":"wordfence","cve":"CVE-2026-3018","title":"Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2672b5-64a2-4b30-b0be-2a9303d46ac1?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.13","to_inclusive":true,"patched_in":"4.14"}],"published":"2026-06-09T20:03:28Z","updated":"2026-06-10T08:28:21Z"},{"id":"wordfence:8e2a994f-7a42-4ccb-8fa0-77107ba1150c","source":"wordfence","cve":"CVE-2025-14539","title":"Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2a994f-7a42-4ccb-8fa0-77107ba1150c?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-ajax","name":"Shortcode Ajax","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:11:16Z","updated":"2025-12-13T04:31:29Z"},{"id":"wordfence:8e2c6030-d117-4c0b-a97a-d0bb89e948ef","source":"wordfence","cve":"CVE-2021-24284","title":"Kaswara Modern VC Addons <= 3.0.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2c6030-d117-4c0b-a97a-d0bb89e948ef?source=api-prod","affected":[{"type":"plugin","slug":"kaswara","name":"Kaswara Modern VC Addons","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e323b87-7b2e-4e5c-94a4-a4a0712f50ba","source":"wordfence","cve":"CVE-2025-13990","title":"Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=api-prod","affected":[{"type":"plugin","slug":"mamurjor-employee-info","name":"Mamurjor Employee Info","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:30:06Z","updated":"2026-01-07T09:21:00Z"},{"id":"wordfence:8e332a52-071c-4725-99db-3cc10ee50230","source":"wordfence","cve":"CVE-2023-31074","title":"Extensions for Leaflet Map <= 3.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e332a52-071c-4725-99db-3cc10ee50230?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e33d72d-00d4-45c8-98d2-0a0a73d13b35","source":"wordfence","cve":"CVE-2022-0898","title":"IgniteUp \u2013 Coming Soon and Maintenance Mode <= 3.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e33d72d-00d4-45c8-98d2-0a0a73d13b35?source=api-prod","affected":[{"type":"plugin","slug":"igniteup","name":"IgniteUp \u2013 Coming Soon and Maintenance Mode","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e361473-8ed6-41d0-b409-2436189c1120","source":"wordfence","cve":"CVE-2021-24146","title":"Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Export","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e361473-8ed6-41d0-b409-2436189c1120?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2021-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e37331b-0b75-41ee-b390-532efd674cc1","source":"wordfence","cve":"CVE-2024-6621","title":"WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e37331b-0b75-41ee-b390-532efd674cc1?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.23.11","to_inclusive":true,"patched_in":"4.23.12"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T11:00:58Z"},{"id":"wordfence:8e38553d-5dba-4c84-95f7-43420245c770","source":"wordfence","cve":"CVE-2025-2939","title":"Ninja Tables \u2013 Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution","severity":"medium","cvss":5.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e38553d-5dba-4c84-95f7-43420245c770?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.18","to_inclusive":true,"patched_in":"5.0.19"}],"published":"2025-06-02T00:00:00Z","updated":"2025-06-03T02:27:36Z"},{"id":"wordfence:8e3a5566-eee5-4f71-9c93-e59abf913d04","source":"wordfence","cve":"CVE-2022-0993","title":"SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c93-e59abf913d04?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2022-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e3bcea6-edca-4b2d-8b8a-99921766de23","source":"wordfence","cve":"CVE-2025-25167","title":"BookPress \u2013 For Book Authors <= 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3bcea6-edca-4b2d-8b8a-99921766de23?source=api-prod","affected":[{"type":"plugin","slug":"book-press","name":"BookPress \u2013 For Book Authors","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T15:13:15Z"},{"id":"wordfence:8e3c45ac-44c0-47e1-81af-65014f064513","source":"wordfence","cve":"CVE-2022-0316","title":"Themes from Chimpstudio and Pixfill (Various Versions) - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3c45ac-44c0-47e1-81af-65014f064513?source=api-prod","affected":[{"type":"theme","slug":"aidreform","name":"Aidreform","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"kingclub-theme","name":"Kingclub Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"spikes-black","name":"Spikes Black","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"statfort","name":"Statfort","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bolster","name":"Bolster","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"club-theme","name":"Club Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"spikes","name":"Spikes","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"soundblast","name":"Soundblast","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"westand","name":"Westand","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"},{"type":"theme","slug":"footysquare","name":"Footysquare","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e3e07c8-8fd0-4966-8276-aece794b75b2","source":"wordfence","cve":"CVE-2023-30869","title":"Easy Digital Downloads 3.1 - 3.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3e07c8-8fd0-4966-8276-aece794b75b2?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"3.1","from_inclusive":true,"to":"3.1.1.4.2","to_inclusive":false,"patched_in":"3.1.1.4.2"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e40a954-53c4-453b-85f0-d3febaa6ae84","source":"wordfence","cve":"CVE-2022-0444","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.16 - Unauthenticated Plugin Settings Reset","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e40a954-53c4-453b-85f0-d3febaa6ae84?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"4.2.16","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e42831f-844d-40dc-965e-80334aab333c","source":"wordfence","cve":"CVE-2023-23876","title":"wpDataTables <= 2.1.49 -  Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e42831f-844d-40dc-965e-80334aab333c?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.1.49","to_inclusive":true,"patched_in":"2.1.50"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e43e19a-5624-4e17-8f9b-40ce2cf9c150","source":"wordfence","cve":"CVE-2025-49998","title":"WooCommerce Fortnox Integration <= 4.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e43e19a-5624-4e17-8f9b-40ce2cf9c150?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-fortnox-integration","name":"Fortnox for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-27T17:16:30Z"},{"id":"wordfence:8e461095-8dce-4502-8bbf-8c985105cf24","source":"wordfence","cve":"CVE-2024-10886","title":"Tribute Testimonials \u2013 WordPress Testimonial Grid/Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e461095-8dce-4502-8bbf-8c985105cf24?source=api-prod","affected":[{"type":"plugin","slug":"tribute-testimonial-gridslider","name":"Tribute Testimonials \u2013 WordPress Testimonial Grid/Slider","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T15:09:03Z","updated":"2024-11-23T03:25:50Z"},{"id":"wordfence:8e47a612-4921-4227-be86-54711bf61c43","source":"wordfence","cve":"CVE-2026-57313","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e47a612-4921-4227-be86-54711bf61c43?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:57:29Z"},{"id":"wordfence:8e4947d5-91f3-4b36-b309-7c52c483be3d","source":"wordfence","cve":"CVE-2026-96228","title":"SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4947d5-91f3-4b36-b309-7c52c483be3d?source=api-prod","affected":[{"type":"plugin","slug":"ssl-wireless-sms-notification","name":"SSL Wireless SMS Notification","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:44:31Z","updated":"2026-10-29T03:39:15Z"},{"id":"wordfence:8e4ad8fa-b04c-4821-aadb-3120f824557f","source":"wordfence","cve":"CVE-2023-44999","title":"Stripe Gateway <= 7.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4ad8fa-b04c-4821-aadb-3120f824557f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":false,"patched_in":"7.6.1"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e4c42e6-92f3-4c2f-8748-877c6df39e62","source":"wordfence","cve":"CVE-2025-9199","title":"Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4c42e6-92f3-4c2f-8748-877c6df39e62?source=api-prod","affected":[{"type":"plugin","slug":"woo-superb-slideshow-transition-gallery-with-random-effect","name":"Woo superb slideshow transition gallery with random effect","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:35:04Z","updated":"2025-10-03T11:17:16Z"},{"id":"wordfence:8e4cf9eb-8f89-4cc7-9cdf-6d2e76f31388","source":"wordfence","cve":"CVE-2026-14189","title":"WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4cf9eb-8f89-4cc7-9cdf-6d2e76f31388?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.1","to_inclusive":true,"patched_in":"8.5.2"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:17:15Z"},{"id":"wordfence:8e4dbf38-e955-4634-9a07-775ea49b0051","source":"wordfence","cve":"CVE-2014-4854","title":"WP Construction Mode <= 1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dbf38-e955-4634-9a07-775ea49b0051?source=api-prod","affected":[{"type":"plugin","slug":"wp-construction-mode","name":"WP Construction Mode","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3","source":"wordfence","cve":"CVE-2024-3558","title":"Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4dc6fd-4bd5-4ed1-ade0-cf2f8831fac3?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-19T13:17:11Z","updated":"2024-06-20T02:08:26Z"},{"id":"wordfence:8e4e7d1d-1bd3-48d7-b8f7-2e4ce9f1b38d","source":"wordfence","cve":"CVE-2026-19049","title":"ProSolution WP Client <= 2.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4e7d1d-1bd3-48d7-b8f7-2e4ce9f1b38d?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:43:55Z"},{"id":"wordfence:8e501b31-a7f4-4d0d-bf83-af7b6c023a6b","source":"wordfence","cve":"CVE-2024-11904","title":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e501b31-a7f4-4d0d-bf83-af7b6c023a6b?source=api-prod","affected":[{"type":"plugin","slug":"mshop-naver-talktalk","name":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-07T01:45:51Z"},{"id":"wordfence:8e50c519-7d79-4270-92e8-75e54bb08cff","source":"wordfence","cve":"CVE-2024-12594","title":"ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e50c519-7d79-4270-92e8-75e54bb08cff?source=api-prod","affected":[{"type":"plugin","slug":"login-page-styler","name":"Login Page Styler \u2013 Custom WordPress Login Page Customizer & Security","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:44Z"},{"id":"wordfence:8e53c2e4-2edf-4c5f-83bf-b6cd93b15ec9","source":"wordfence","cve":"CVE-2026-84766","title":"Fluent Booking Pro <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e53c2e4-2edf-4c5f-83bf-b6cd93b15ec9?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking-pro","name":"Fluent Booking Pro","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T14:26:42Z"},{"id":"wordfence:8e5417d3-c466-4caf-9fb6-26d6e2c06fe1","source":"wordfence","cve":"CVE-2024-2084","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5417d3-c466-4caf-9fb6-26d6e2c06fe1?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:23Z"},{"id":"wordfence:8e59e02f-d701-476a-9fd8-2098004089ec","source":"wordfence","cve":"CVE-2016-1000145","title":"Pondol Carousel <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e59e02f-d701-476a-9fd8-2098004089ec?source=api-prod","affected":[{"type":"plugin","slug":"pondol-carousel","name":"Pondol Carousel","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e5c0282-6d13-4c83-8d1f-c49430f714d6","source":"wordfence","cve":"CVE-2022-44594","title":"All in One Time Clok Lite <= 1.3.320 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5c0282-6d13-4c83-8d1f-c49430f714d6?source=api-prod","affected":[{"type":"plugin","slug":"aio-time-clock-lite","name":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier","from":"*","from_inclusive":true,"to":"1.3.320","to_inclusive":true,"patched_in":"1.3.321"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e5c3d74-1240-4501-856f-18a1c6369d1c","source":"wordfence","cve":"CVE-2024-33595","title":"Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization on Duplicate Post","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5c3d74-1240-4501-856f-18a1c6369d1c?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.4.1","to_inclusive":true,"patched_in":"2.0.5.6"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:55:09Z"},{"id":"wordfence:8e5d8419-3dff-45f0-b91b-a9c69f5d3e98","source":"wordfence","cve":"CVE-2026-16292","title":"Frontend File Manager Plugin <= 23.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5d8419-3dff-45f0-b91b-a9c69f5d3e98?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:25:16Z"},{"id":"wordfence:8e5e92f2-6fd0-4102-aa8e-2fe8efd9cbaa","source":"wordfence","cve":"CVE-2024-38784","title":"Livemesh Addons for Beaver Builder <= 3.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5e92f2-6fd0-4102-aa8e-2fe8efd9cbaa?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-beaver-builder","name":"Livemesh Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:03:11Z"},{"id":"wordfence:8e618025-f631-48af-b360-e11524e61be3","source":"wordfence","cve":"CVE-2024-53773","title":"Znajd\u017a Prac\u0119 z Praca.pl <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e618025-f631-48af-b360-e11524e61be3?source=api-prod","affected":[{"type":"plugin","slug":"znajdz-prace-z-pracapl","name":"Znajd\u017a Prac\u0119 z Praca.pl","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:18:07Z"},{"id":"wordfence:8e64d865-5acc-419b-8c61-e8fd8207fa94","source":"wordfence","cve":"CVE-2023-49752","title":"Adifier System < 3.1.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e64d865-5acc-419b-8c61-e8fd8207fa94?source=api-prod","affected":[{"type":"theme","slug":"adifier-system","name":"Adifier - Classified Ads WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e65e06f-f907-4f42-a454-4da63a11136d","source":"wordfence","cve":"CVE-2025-48080","title":"Uncanny Toolkit for LearnDash <= 3.7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e65e06f-f907-4f42-a454-4da63a11136d?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.7.0.2","to_inclusive":true,"patched_in":"3.7.0.3"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:56:04Z"},{"id":"wordfence:8e6627f8-9fc4-426a-977a-e3e0f9c857ee","source":"wordfence","cve":"CVE-2025-31528","title":"StaticPress <= 0.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e6627f8-9fc4-426a-977a-e3e0f9c857ee?source=api-prod","affected":[{"type":"plugin","slug":"staticpress","name":"StaticPress","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:27:06Z"},{"id":"wordfence:8e688654-8e21-48e8-a497-06812f3be9fb","source":"wordfence","cve":"CVE-2025-7842","title":"Silencesoft RSS Reader <= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e688654-8e21-48e8-a497-06812f3be9fb?source=api-prod","affected":[{"type":"plugin","slug":"external-rss-reader","name":"Silencesoft RSS Reader","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:52:08Z","updated":"2025-08-23T04:25:47Z"},{"id":"wordfence:8e68cb68-45ab-4c2f-a105-1ef01da42453","source":"wordfence","cve":"CVE-2025-10300","title":"TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e68cb68-45ab-4c2f-a105-1ef01da42453?source=api-prod","affected":[{"type":"plugin","slug":"topbar","name":"TopBar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:36:56Z","updated":"2025-10-15T08:25:57Z"},{"id":"wordfence:8e68ec8c-e46a-4886-b386-9664a8e5ba26","source":"wordfence","cve":"CVE-2026-27338","title":"Car Zone <= 3.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e68ec8c-e46a-4886-b386-9664a8e5ba26?source=api-prod","affected":[{"type":"theme","slug":"carzone","name":"CarZone - A Complete Car Dealer HTML Wire-Frame","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:41:15Z"},{"id":"wordfence:8e6b08fc-f42e-4e5b-be73-44af92c05d1d","source":"wordfence","cve":"CVE-2026-84816","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e6b08fc-f42e-4e5b-be73-44af92c05d1d?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:35:34Z"},{"id":"wordfence:8e6e91c2-cb6b-4b5d-b13e-099969dca847","source":"wordfence","cve":"CVE-2025-23520","title":"Heartland Management Terminal <= 1.3. 0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e6e91c2-cb6b-4b5d-b13e-099969dca847?source=api-prod","affected":[{"type":"plugin","slug":"heartland-management-terminal","name":"Heartland Management Terminal","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:05:22Z"},{"id":"wordfence:8e721128-2e34-4717-8945-5fd25f2efd7d","source":"wordfence","cve":"CVE-2024-11387","title":"Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e721128-2e34-4717-8945-5fd25f2efd7d?source=api-prod","affected":[{"type":"plugin","slug":"easy-liveblogs","name":"Easy Liveblogs","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:21Z"},{"id":"wordfence:8e73b00e-38f7-45dc-8577-5cc47c18b9fd","source":"wordfence","cve":"CVE-2024-37098","title":"BlossomThemes Email Newsletter <= 2.2.6 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e73b00e-38f7-45dc-8577-5cc47c18b9fd?source=api-prod","affected":[{"type":"plugin","slug":"blossomthemes-email-newsletter","name":"BlossomThemes Email Newsletter","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-08T16:46:46Z"},{"id":"wordfence:8e75a03b-7552-4228-a4d0-13c78d20f6d5","source":"wordfence","cve":"CVE-2024-12596","title":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75a03b-7552-4228-a4d0-13c78d20f6d5?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.6"}],"published":"2024-12-17T14:26:20Z","updated":"2024-12-18T03:22:06Z"},{"id":"wordfence:8e75bc13-4a9c-439d-a361-33711886bfac","source":"wordfence","cve":"CVE-2025-59581","title":"Ibtana <= 1.2.5.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75bc13-4a9c-439d-a361-33711886bfac?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.5.3","to_inclusive":true,"patched_in":"1.2.5.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:51:00Z"},{"id":"wordfence:8e75d72d-d999-4755-8c90-7fb7d630ab00","source":"wordfence","cve":"CVE-2024-3894","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75d72d-d999-4755-8c90-7fb7d630ab00?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2024-06-18T18:55:20Z","updated":"2024-06-19T06:55:46Z"},{"id":"wordfence:8e7693a3-642a-4eff-902c-d29a3c12deb0","source":"wordfence","cve":"CVE-2025-4973","title":"Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7693a3-642a-4eff-902c-d29a3c12deb0?source=api-prod","affected":[{"type":"plugin","slug":"workreap","name":"Workreap","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-06-11T16:31:01Z","updated":"2025-06-12T05:23:40Z"},{"id":"wordfence:8e76ee22-b05c-424a-a2a9-8d83811668e0","source":"wordfence","cve":"CVE-2026-16541","title":"Simply Schedule Appointments <= 1.6.12.16 - Authenticated (Team Member+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e76ee22-b05c-424a-a2a9-8d83811668e0?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.16","to_inclusive":true,"patched_in":"1.6.12.17"}],"published":"2026-08-13T00:00:00Z","updated":"2026-09-03T16:38:57Z"},{"id":"wordfence:8e76fe1d-6315-41ae-bde1-47e0bb2264fc","source":"wordfence","cve":"CVE-2026-65535","title":"TinyMCE Templates <= 4.8.1 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e76fe1d-6315-41ae-bde1-47e0bb2264fc?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-templates","name":"TinyMCE Templates","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:08:32Z"},{"id":"wordfence:8e776008-2b26-49bb-b2f0-9621fd71d176","source":"wordfence","cve":"CVE-2026-111737","title":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin < 7.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e776008-2b26-49bb-b2f0-9621fd71d176?source=api-prod","affected":[{"type":"plugin","slug":"sg-cachepress","name":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":false,"patched_in":"7.8.5"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:51:42Z"},{"id":"wordfence:8e7831c5-2262-42c9-9655-a43ef2dac54f","source":"wordfence","cve":"CVE-2025-11745","title":"Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7831c5-2262-42c9-9655-a43ef2dac54f?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2025-11-04T21:29:14Z","updated":"2025-11-05T11:24:41Z"},{"id":"wordfence:8e796458-acd4-4334-af1c-29c82f0791ac","source":"wordfence","cve":"CVE-2026-11402","title":"Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e796458-acd4-4334-af1c-29c82f0791ac?source=api-prod","affected":[{"type":"plugin","slug":"services-section","name":"Services Section Block \u2013 present your services in clean grids and columns","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2026-06-17T16:51:11Z","updated":"2026-06-18T05:34:27Z"},{"id":"wordfence:8e7b40e4-c80a-4317-acff-77696fd8098f","source":"wordfence","cve":"CVE-2023-47812","title":"Bamboo Columns <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7b40e4-c80a-4317-acff-77696fd8098f?source=api-prod","affected":[{"type":"plugin","slug":"bamboo-columns","name":"Bamboo Columns","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e7cbe45-5dd5-4b8f-8504-a52358156838","source":"wordfence","cve":"CVE-2024-3072","title":"ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7cbe45-5dd5-4b8f-8504-a52358156838?source=api-prod","affected":[{"type":"plugin","slug":"acf-front-end-editor","name":"ACF Front End Editor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-04-30T08:32:23Z"},{"id":"wordfence:8e7e7d78-de2f-4bdf-b04a-373463bd4d9c","source":"wordfence","cve":"CVE-2026-17509","title":"WPML Multilingual CMS <= 4.9.5 -  Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via \u2018elementIds\u2019","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7e7d78-de2f-4bdf-b04a-373463bd4d9c?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:30:00Z"},{"id":"wordfence:8e800ef1-6bab-4053-a023-2849d17ed3b4","source":"wordfence","cve":"CVE-2026-87981","title":"Paymob for WooCommerce <= 4.1.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e800ef1-6bab-4053-a023-2849d17ed3b4?source=api-prod","affected":[{"type":"plugin","slug":"paymob-for-woocommerce","name":"Paymob for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.14"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:55:17Z"},{"id":"wordfence:8e809215-8b20-4a36-acd9-d16cf4a55bc5","source":"wordfence","cve":"CVE-2025-22814","title":"Zephyr Admin Theme <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e809215-8b20-4a36-acd9-d16cf4a55bc5?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-modern-admin-theme","name":"Zephyr Admin Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:54:40Z"},{"id":"wordfence:8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308","source":"wordfence","cve":"CVE-2026-103768","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2026-10-15T17:03:00Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:8e83475e-03fc-47b8-b23c-a7b16641351b","source":"wordfence","cve":"CVE-2015-9518","title":"Easy Digital Downloads \u2013 PDF Invoices < 1.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e83475e-03fc-47b8-b23c-a7b16641351b?source=api-prod","affected":[{"type":"plugin","slug":"edd-invoices","name":"Easy Digital Downloads \u2013 Invoices","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e850339-b191-4ca9-acbb-9e895b107477","source":"wordfence","cve":"CVE-2026-94421","title":"Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e850339-b191-4ca9-acbb-9e895b107477?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-10-09T17:05:56Z","updated":"2026-10-10T05:31:02Z"},{"id":"wordfence:8e8c2aa5-5770-4b88-b415-40c2aff69d84","source":"wordfence","cve":"CVE-2024-13703","title":"CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8c2aa5-5770-4b88-b415-40c2aff69d84?source=api-prod","affected":[{"type":"plugin","slug":"crm-customer-relationship-management-by-vcita","name":"CRM and Lead Management by vcita","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-03-12T13:08:11Z","updated":"2025-07-22T14:07:19Z"},{"id":"wordfence:8e8d7aa4-d2df-47ec-a5dc-c2cfd74763aa","source":"wordfence","cve":"CVE-2025-67527","title":"Digiqole < 2.2.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8d7aa4-d2df-47ec-a5dc-c2cfd74763aa?source=api-prod","affected":[{"type":"theme","slug":"digiqole","name":"Digiqole - News Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2025-12-13T00:00:00Z","updated":"2025-12-19T17:18:09Z"},{"id":"wordfence:8e8e5a64-0e11-42e7-bc7b-674abbeee25f","source":"wordfence","cve":"CVE-2025-24534","title":"DPortfolio <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8e5a64-0e11-42e7-bc7b-674abbeee25f?source=api-prod","affected":[{"type":"plugin","slug":"dportfolio","name":"DPortfolio","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-11-14T00:00:00Z","updated":"2025-02-20T16:01:29Z"},{"id":"wordfence:8e8e967f-f627-4c0c-ac0f-0a66ae25c602","source":"wordfence","cve":"CVE-2023-45002","title":"WP User Frontend <= 3.6.8 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8e967f-f627-4c0c-ac0f-0a66ae25c602?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8e8fe6f4-7e41-44d3-9980-b5e7f43aa849","source":"wordfence","cve":"CVE-2024-9383","title":"Parcel Pro <= 1.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8fe6f4-7e41-44d3-9980-b5e7f43aa849?source=api-prod","affected":[{"type":"plugin","slug":"woo-parcel-pro","name":"Parcel Pro","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-10-17T15:42:33Z","updated":"2024-10-24T19:42:25Z"},{"id":"wordfence:8e926708-3c7f-4d7b-a64b-209f696984f9","source":"wordfence","cve":"CVE-2024-52386","title":"Classified Listing <= 3.1.16 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e926708-3c7f-4d7b-a64b-209f696984f9?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-27T13:43:01Z"},{"id":"wordfence:8e93072c-eb0c-46a7-8ed7-7f48916dab50","source":"wordfence","cve":"CVE-2023-6385","title":"WordPress Ping Optimizer <= 2.35.1.3.0 - Cross-Site Request Forgery to Log Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e93072c-eb0c-46a7-8ed7-7f48916dab50?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-ping-optimizer","name":"WordPress Ping Optimizer","from":"*","from_inclusive":true,"to":"2.35.1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-20T00:00:00Z","updated":"2024-05-07T12:11:07Z"},{"id":"wordfence:8e94d308-8d36-487e-be72-e1599c4384f9","source":"wordfence","cve":"CVE-2026-59539","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e94d308-8d36-487e-be72-e1599c4384f9?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:17:40Z"},{"id":"wordfence:8e958653-36c4-4979-89e1-d9411a35a92a","source":"wordfence","cve":"CVE-2024-11010","title":"FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e958653-36c4-4979-89e1-d9411a35a92a?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-12-06T21:06:15Z","updated":"2024-12-09T23:58:23Z"},{"id":"wordfence:8e96b53e-218e-416e-8910-940ed2093f0f","source":"wordfence","cve":"CVE-2026-24524","title":"Tablesome <= 1.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e96b53e-218e-416e-8910-940ed2093f0f?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-01-26T00:00:00Z","updated":"2026-05-11T19:41:34Z"},{"id":"wordfence:8e98d92a-fe64-4591-972b-ed11542506b7","source":"wordfence","cve":"CVE-2024-1381","title":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e98d92a-fe64-4591-972b-ed11542506b7?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-sandwich","name":"Page Builder Sandwich \u2013 Front End WordPress Page Builder Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:56:02Z"},{"id":"wordfence:8e99a3e3-c5c9-400e-95ce-80d4cbe01649","source":"wordfence","cve":"CVE-2026-13389","title":"webtoffee-cookie-consent < 3.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e99a3e3-c5c9-400e-95ce-80d4cbe01649?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-cookie-consent","name":"GDPR Cookie Consent Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T20:15:12Z"},{"id":"wordfence:8e9a872d-575c-455c-8f26-709878817ae0","source":"wordfence","cve":"CVE-2025-13622","title":"Jabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFO","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e9a872d-575c-455c-8f26-709878817ae0?source=api-prod","affected":[{"type":"plugin","slug":"jabberbenachrichtigung","name":"Jabbernotification","from":"*","from_inclusive":true,"to":"0.99-RC2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:30:39Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:8e9bf649-7cf7-4d90-812f-4af847818387","source":"wordfence","cve":"CVE-2024-10475","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e9bf649-7cf7-4d90-812f-4af847818387?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T14:59:33Z"},{"id":"wordfence:8ea002da-bf37-4c6d-a46e-4f0e7f8968ad","source":"wordfence","cve":"CVE-2024-3560","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea002da-bf37-4c6d-a46e-4f0e7f8968ad?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.4","to_inclusive":true,"patched_in":"4.2.6.5"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T01:57:10Z"},{"id":"wordfence:8ea04e2b-8473-40b7-a734-b409d539b494","source":"wordfence","cve":"CVE-2025-69350","title":"Accordion <= 3.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea04e2b-8473-40b7-a734-b409d539b494?source=api-prod","affected":[{"type":"plugin","slug":"accordions-wp","name":"Accordions \u2013 Responsive Accordion & FAQ Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T17:39:02Z"},{"id":"wordfence:8ea087a7-197b-4dbe-b551-8074a0ea23ba","source":"wordfence","cve":"CVE-2018-1002004","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea087a7-197b-4dbe-b551-8074a0ea23ba?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ea0e5ae-c8b8-4782-a130-e5460a81b066","source":"wordfence","cve":"","title":"Hide Admin Bar Based On User Roles < 3.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea0e5ae-c8b8-4782-a130-e5460a81b066?source=api-prod","affected":[{"type":"plugin","slug":"hide-admin-bar-based-on-user-roles","name":"Hide Admin Bar Based on User Roles \u2013 Disable the WordPress Toolbar by Role or Capability","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ea25e80-af12-4845-b505-16654a68b009","source":"wordfence","cve":"CVE-2014-4723","title":"Easy Banners <= 1.4 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea25e80-af12-4845-b505-16654a68b009?source=api-prod","affected":[{"type":"plugin","slug":"easy-banners","name":"Easy Banners","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2014-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8","source":"wordfence","cve":"CVE-2025-9807","title":"The Events Calendar <= 6.15.1 -  Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea2ce90-6c8c-4a31-8faa-4ab99879d8b8?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.1","to_inclusive":true,"patched_in":"6.15.1.1"}],"published":"2025-09-11T12:26:47Z","updated":"2025-09-12T01:46:00Z"},{"id":"wordfence:8ea4617a-6211-4f8d-ab51-10ca509aaacf","source":"wordfence","cve":"CVE-2023-46610","title":"Quill Forms <= 3.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea4617a-6211-4f8d-ab51-10ca509aaacf?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ea53b11-37fa-4c45-a158-5a7709b842fc","source":"wordfence","cve":"CVE-2024-0830","title":"Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea53b11-37fa-4c45-a158-5a7709b842fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-fields","name":"Comments Extra Fields For Post,Pages and CPT","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:36:50Z"},{"id":"wordfence:8ea59532-e1c2-4dad-b2a8-01f401c54181","source":"wordfence","cve":"CVE-2024-37275","title":"NextScripts <= 4.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea59532-e1c2-4dad-b2a8-01f401c54181?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2024-06-27T00:00:00Z","updated":"2026-09-16T17:28:12Z"},{"id":"wordfence:8ea64186-9f25-4685-b435-7890e8d0d1ee","source":"wordfence","cve":"CVE-2025-53343","title":"Modernize <= 3.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea64186-9f25-4685-b435-7890e8d0d1ee?source=api-prod","affected":[{"type":"theme","slug":"modernize","name":"Modernize - Flexibility of WordPress","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:56:32Z"},{"id":"wordfence:8ea6b79c-2a09-4a6e-9b4b-a81f96e3bc12","source":"wordfence","cve":"CVE-2023-1207","title":"HTTP Headers <= 1.18.8 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea6b79c-2a09-4a6e-9b4b-a81f96e3bc12?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.18.8","to_inclusive":true,"patched_in":"1.18.9"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ea7b7b5-ba3a-4d9c-9a63-ed9f645c6b1b","source":"wordfence","cve":"CVE-2024-31273","title":"JS Help Desk \u2013 Best Help Desk & Support Plugin <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea7b7b5-ba3a-4d9c-9a63-ed9f645c6b1b?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:56:51Z"},{"id":"wordfence:8ead01c4-9a87-4939-9f91-1ec3df097ebd","source":"wordfence","cve":"CVE-2025-69393","title":"Exzo <= 1.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ead01c4-9a87-4939-9f91-1ec3df097ebd?source=api-prod","affected":[{"type":"theme","slug":"exzo","name":"Electronics eCommerce WordPress Woocommerce Theme - Exzo","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:50:43Z"},{"id":"wordfence:8ead2f07-b6d7-47a5-818f-35d3cbdb8620","source":"wordfence","cve":"CVE-2026-66566","title":"Ambient <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ead2f07-b6d7-47a5-818f-35d3cbdb8620?source=api-prod","affected":[{"type":"theme","slug":"ambient","name":"Ambient - Modern Interior Design and Decoration WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:14:40Z"},{"id":"wordfence:8eaf6dfd-bc66-466f-af80-213213fdb839","source":"wordfence","cve":"CVE-2022-38703","title":"MaxButtons <= 9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eaf6dfd-bc66-466f-af80-213213fdb839?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8eb4e5bf-d9cf-4123-8180-34b3624e86ae","source":"wordfence","cve":"CVE-2025-49268","title":"Verge3D <= 4.9.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eb4e5bf-d9cf-4123-8180-34b3624e86ae?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:24:28Z"},{"id":"wordfence:8eb778d0-2aa4-4d0a-9ac1-42af51c335bf","source":"wordfence","cve":"CVE-2022-43487","title":"Salon booking system <= 7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eb778d0-2aa4-4d0a-9ac1-42af51c335bf?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"7.9","to_inclusive":true,"patched_in":"7.9.4"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8eb77a53-4aea-46c3-8eea-a16f728dfa23","source":"wordfence","cve":"CVE-2024-21750","title":"Shortcodes Finder <= 1.5.4 - Reflected Cross-Site Scripting via nonce","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eb77a53-4aea-46c3-8eea-a16f728dfa23?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-finder","name":"Shortcodes Finder","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8eba82b9-20cd-4bf1-85bc-2daea4423ee8","source":"wordfence","cve":"CVE-2021-24643","title":"WP Map Block \u2013 Gutenberg Map Block for Google Map and OpenStreet Map <= 1.2.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eba82b9-20cd-4bf1-85bc-2daea4423ee8?source=api-prod","affected":[{"type":"plugin","slug":"wp-map-block","name":"WP Map Block \u2013 Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ebb1072-ea05-4914-961d-0d8f20248078","source":"wordfence","cve":"CVE-2024-3412","title":"WP STAGING WordPress Backup Plugin \u2013 Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ebb1072-ea05-4914-961d-0d8f20248078?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-29T08:30:07Z"},{"id":"wordfence:8ebc05b6-89dd-4373-a632-75c783716643","source":"wordfence","cve":"CVE-2018-5671","title":"Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ebc05b6-89dd-4373-a632-75c783716643?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ebfc52b-278c-49d5-9226-d28a59335d46","source":"wordfence","cve":"CVE-2026-15281","title":"User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ebfc52b-278c-49d5-9226-d28a59335d46?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.3.13"}],"published":"2026-08-04T18:31:53Z","updated":"2026-08-05T06:37:57Z"},{"id":"wordfence:8ec27c65-5104-4636-bb95-f9832a3f4fff","source":"wordfence","cve":"CVE-2026-97254","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1069 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec27c65-5104-4636-bb95-f9832a3f4fff?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-26T10:02:00Z","updated":"2026-10-28T01:28:18Z"},{"id":"wordfence:8ec4eb8a-7b03-4392-9137-4f17622bfe54","source":"wordfence","cve":"CVE-2024-13670","title":"Music Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec4eb8a-7b03-4392-9137-4f17622bfe54?source=api-prod","affected":[{"type":"plugin","slug":"music-sheet-viewer","name":"Music Sheet Viewer","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:43:16Z","updated":"2025-01-30T13:42:04Z"},{"id":"wordfence:8ec5173b-7b0d-4887-8c13-f48137aa8593","source":"wordfence","cve":"CVE-2023-1019","title":"Help Desk WP <= 1.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec5173b-7b0d-4887-8c13-f48137aa8593?source=api-prod","affected":[{"type":"plugin","slug":"helpdeskwp","name":"Help Desk WP","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ec87dd1-9ff3-474d-a913-a31fa9747d0d","source":"wordfence","cve":"CVE-2025-52793","title":"Esselink.nu Settings <= 4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec87dd1-9ff3-474d-a913-a31fa9747d0d?source=api-prod","affected":[{"type":"plugin","slug":"esselinknu-settings","name":"Esselink.nu Settings","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-06-19T00:00:00Z","updated":"2026-07-28T18:42:58Z"},{"id":"wordfence:8ec9b8f4-0531-4d3b-8416-ba6dd41a3bac","source":"wordfence","cve":"CVE-2024-37538","title":"Link To Bible <= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec9b8f4-0531-4d3b-8416-ba6dd41a3bac?source=api-prod","affected":[{"type":"plugin","slug":"link-to-bible","name":"Link To Bible","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2024-07-06T00:00:00Z","updated":"2024-09-13T20:28:52Z"},{"id":"wordfence:8eca8a98-73df-4062-8800-34c0fdd2a6b1","source":"wordfence","cve":"CVE-2024-51714","title":"User Password Reset <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eca8a98-73df-4062-8800-34c0fdd2a6b1?source=api-prod","affected":[{"type":"plugin","slug":"user-password-reset","name":"User Password Reset","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:05:56Z"},{"id":"wordfence:8ecd781f-1bef-4f22-ac1f-88709ea45616","source":"wordfence","cve":"CVE-2024-8094","title":"Ntz Antispam <= 2.0e - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ecd781f-1bef-4f22-ac1f-88709ea45616?source=api-prod","affected":[{"type":"plugin","slug":"ntzantispam","name":"Ntz Antispam","from":"*","from_inclusive":true,"to":"2.0e","to_inclusive":true,"patched_in":""}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-24T15:41:24Z"},{"id":"wordfence:8ecf826d-cdb9-4a6e-b97f-38992c5ece85","source":"wordfence","cve":"CVE-2026-11766","title":"Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ecf826d-cdb9-4a6e-b97f-38992c5ece85?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-06-15T00:00:00Z","updated":"2026-09-18T14:59:35Z"},{"id":"wordfence:8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3","source":"wordfence","cve":"CVE-2026-125948","title":"Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-11-12T20:54:40Z","updated":"2026-11-13T09:35:14Z"},{"id":"wordfence:8ed413a9-bf1d-4564-b740-4c92ec2c2249","source":"wordfence","cve":"CVE-2025-12753","title":"Chart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed413a9-bf1d-4564-b740-4c92ec2c2249?source=api-prod","affected":[{"type":"plugin","slug":"chart-expert","name":"Chart Expert","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:15:45Z","updated":"2025-11-11T03:30:44Z"},{"id":"wordfence:8ed63de5-ef65-4e90-afc1-b7a075e99316","source":"wordfence","cve":"CVE-2024-32778","title":"Contest Gallery <= 21.3.4 - Authenticated (Author+) Arbitrary File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed63de5-ef65-4e90-afc1-b7a075e99316?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.3.4","to_inclusive":true,"patched_in":"21.3.5"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T13:49:56Z"},{"id":"wordfence:8ed90a91-e007-42a5-bbef-f186bd3875ea","source":"wordfence","cve":"","title":"Pretty Google Calendar <= 1.5.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via pretty_google_calendar shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed90a91-e007-42a5-bbef-f186bd3875ea?source=api-prod","affected":[{"type":"plugin","slug":"pretty-google-calendar","name":"Pretty Google Calendar","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ed9a5df-90d0-4abe-be1c-49c50a6b48b3","source":"wordfence","cve":"","title":"Duplicate Page <= 3.3 - SQL Injection","severity":"high","cvss":7.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed9a5df-90d0-4abe-be1c-49c50a6b48b3?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-page","name":"Duplicate Page","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2019-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8eda641b-eddc-4255-80e4-c77c217f979f","source":"wordfence","cve":"CVE-2022-44734","title":"Car Rental by BestWebSoft <= 1.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eda641b-eddc-4255-80e4-c77c217f979f?source=api-prod","affected":[{"type":"plugin","slug":"car-rental","name":"Car Rental by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8edaf5ce-6a26-44cc-b4d8-e3b0ccfa9c11","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_edit_item","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8edaf5ce-6a26-44cc-b4d8-e3b0ccfa9c11?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8edb060b-349c-46bb-9440-94f753621111","source":"wordfence","cve":"CVE-2024-35750","title":"Gallery \u2013 Image and Video Gallery with Thumbnails <= 2.0.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb060b-349c-46bb-9440-94f753621111?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:44:29Z"},{"id":"wordfence:8edb72f5-dda3-4c59-ba7a-7a460cb59c03","source":"wordfence","cve":"CVE-2024-4266","title":"MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8edb72f5-dda3-4c59-ba7a-7a460cb59c03?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-11T07:32:26Z"},{"id":"wordfence:8edf693e-8a84-4f0c-a169-605522603fe9","source":"wordfence","cve":"CVE-2025-60188","title":"Atarim <= 4.2.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8edf693e-8a84-4f0c-a169-605522603fe9?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-07-29T00:00:00Z","updated":"2025-12-12T16:22:10Z"},{"id":"wordfence:8ee08aac-7bcc-4809-a5aa-7b95ed736f19","source":"wordfence","cve":"CVE-2026-6498","title":"Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee08aac-7bcc-4809-a5aa-7b95ed736f19?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":true,"patched_in":"2.7.17"}],"published":"2026-04-29T20:28:51Z","updated":"2026-04-30T09:29:18Z"},{"id":"wordfence:8ee21796-5340-4f84-b1c4-a95137a27223","source":"wordfence","cve":"CVE-2022-4519","title":"WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee21796-5340-4f84-b1c4-a95137a27223?source=api-prod","affected":[{"type":"plugin","slug":"wp-user","name":"WP User \u2013 Custom Registration Forms, Login and User Profile","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ee2e088-8206-4a97-98f0-167fef451925","source":"wordfence","cve":"CVE-2026-39614","title":"JW Player for WordPress <= 2.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee2e088-8206-4a97-98f0-167fef451925?source=api-prod","affected":[{"type":"plugin","slug":"jw-player-7-for-wp","name":"JW Player for WordPress","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2026-02-10T00:00:00Z","updated":"2026-07-28T18:20:04Z"},{"id":"wordfence:8ee528d1-b69c-499a-b289-3c2c05c59a16","source":"wordfence","cve":"CVE-2026-106599","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ee528d1-b69c-499a-b289-3c2c05c59a16?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:50:48Z"},{"id":"wordfence:8eee3809-133e-4fd9-ad49-cc6fe3822457","source":"wordfence","cve":"CVE-2026-14250","title":"Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8eee3809-133e-4fd9-ad49-cc6fe3822457?source=api-prod","affected":[{"type":"plugin","slug":"themehunk-login-registration","name":"TH Login Registration","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-07-07T22:41:39Z","updated":"2026-07-08T11:30:33Z"},{"id":"wordfence:8ef0934a-ee5b-4f94-af9f-edd841256396","source":"wordfence","cve":"CVE-2025-1525","title":"Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef0934a-ee5b-4f94-af9f-edd841256396?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T20:14:09Z"},{"id":"wordfence:8ef2e0b1-52ef-4f70-9e95-d010a586d060","source":"wordfence","cve":"CVE-2025-14864","title":"Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef2e0b1-52ef-4f70-9e95-d010a586d060?source=api-prod","affected":[{"type":"plugin","slug":"virusdie","name":"Virusdie | One-click website security","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:19Z"},{"id":"wordfence:8ef33e3c-187a-45d9-9dac-0895dce34216","source":"wordfence","cve":"CVE-2020-36750","title":"EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef33e3c-187a-45d9-9dac-0895dce34216?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.9"}],"published":"2020-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ef3a657-28ce-4a27-b4d8-617db8027ffc","source":"wordfence","cve":"CVE-2021-39322","title":"Easy Social Icons <= 3.0.8 \u2013 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef3a657-28ce-4a27-b4d8-617db8027ffc?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ef64d17-fc52-4d47-aca3-e136245bc114","source":"wordfence","cve":"CVE-2023-37987","title":"YourMembership Single Sign On <= 1.1.3 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef64d17-fc52-4d47-aca3-e136245bc114?source=api-prod","affected":[{"type":"plugin","slug":"login-with-yourmembership","name":"Login with YourMembership \u2013 YM SSO Login","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ef7232d-4acd-4db2-bfd0-d8e44bd59c19","source":"wordfence","cve":"CVE-2026-119164","title":"wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7232d-4acd-4db2-bfd0-d8e44bd59c19?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-11-06T21:21:01Z","updated":"2026-11-07T09:25:47Z"},{"id":"wordfence:8ef75bb4-febf-4009-a6b4-f0b40a4fc903","source":"wordfence","cve":"CVE-2023-29387","title":"Manager for Icomoon <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef75bb4-febf-4009-a6b4-f0b40a4fc903?source=api-prod","affected":[{"type":"plugin","slug":"manager-for-icomoon","name":"Manager for IcoMoon","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ef7c48b-e8f2-40bd-aa48-191059e15453","source":"wordfence","cve":"CVE-2024-8914","title":"Thanh To\u00e1n Qu\u00e9t M\u00e3 QR Code T\u1ef1 \u0110\u1ed9ng \u2013 MoMo, ViettelPay, VNPay v\u00e0 40 ng\u00e2n h\u00e0ng Vi\u1ec7t Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7c48b-e8f2-40bd-aa48-191059e15453?source=api-prod","affected":[{"type":"plugin","slug":"bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang","name":"Thanh To\u00e1n Qu\u00e9t M\u00e3 QR Code T\u1ef1 \u0110\u1ed9ng \u2013 MoMo, ViettelPay, VNPay v\u00e0 40 ng\u00e2n h\u00e0ng Vi\u1ec7t Nam","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-23T18:36:58Z","updated":"2025-08-28T15:24:14Z"},{"id":"wordfence:8ef9c8ce-8272-4804-82da-525f4b63a83f","source":"wordfence","cve":"CVE-2026-104680","title":"Envira Gallery <= 1.16.1 - Authenticated (Admin+) Arbitrary Plugin Installation","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef9c8ce-8272-4804-82da-525f4b63a83f?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.16.1","to_inclusive":true,"patched_in":"1.16.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:29:21Z"},{"id":"wordfence:8efa8e86-6260-484a-a6da-18574bf41ed9","source":"wordfence","cve":"CVE-2024-49243","title":"Dynamic Elementor Addons <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8efa8e86-6260-484a-a6da-18574bf41ed9?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-elementor-addons","name":"Dynamic Elementor Addons","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:14:45Z"},{"id":"wordfence:8efe0759-a3b6-43b7-b333-0e72df1ff96d","source":"wordfence","cve":"CVE-2025-69294","title":"PeakShops <= 1.5.9 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8efe0759-a3b6-43b7-b333-0e72df1ff96d?source=api-prod","affected":[{"type":"theme","slug":"peakshops","name":"PeakShops - Modern & Multi-Concept WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-28T13:46:39Z"},{"id":"wordfence:8efe2ccf-33cb-4db3-bc3d-ead826adb7d0","source":"wordfence","cve":"CVE-2023-33324","title":"Easy Captcha <= 1.0 - Missing Authorization via easy_captcha_update_settings","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8efe2ccf-33cb-4db3-bc3d-ead826adb7d0?source=api-prod","affected":[{"type":"plugin","slug":"easy-captcha","name":"Easy Captcha","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f034716-5004-49ca-94f7-e05a1a4c30ee","source":"wordfence","cve":"CVE-2026-14922","title":"WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f034716-5004-49ca-94f7-e05a1a4c30ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.04.003","to_inclusive":false,"patched_in":"9.2.04.003"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T19:00:28Z"},{"id":"wordfence:8f03b4ef-e877-430e-a440-3af0feca818c","source":"wordfence","cve":"CVE-2025-4571","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f03b4ef-e877-430e-a440-3af0feca818c?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2025-06-18T17:35:14Z","updated":"2025-06-19T06:44:49Z"},{"id":"wordfence:8f052dfc-609d-43ed-a8bb-e30294749d03","source":"wordfence","cve":"CVE-2023-23724","title":"WordPress Email Marketing Plugin \u2013 WP Email Capture <= 3.9.3 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f052dfc-609d-43ed-a8bb-e30294749d03?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.10"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f094317-3088-4660-beae-4cf30df8528b","source":"wordfence","cve":"CVE-2026-27411","title":"SiteGuard WP Plugin <= 1.7.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f094317-3088-4660-beae-4cf30df8528b?source=api-prod","affected":[{"type":"plugin","slug":"siteguard","name":"SiteGuard WP Plugin","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.7.10"}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-24T19:42:58Z"},{"id":"wordfence:8f09f239-dd6e-4fc0-b656-f8c73b7e9022","source":"wordfence","cve":"CVE-2026-8885","title":"DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f09f239-dd6e-4fc0-b656-f8c73b7e9022?source=api-prod","affected":[{"type":"plugin","slug":"demomentsomtres-shortcodes","name":"DeMomentSomTres Shortcodes","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:10Z","updated":"2026-06-02T07:48:30Z"},{"id":"wordfence:8f0cc587-bed2-4feb-b7b4-529ec44796d0","source":"wordfence","cve":"CVE-2026-11581","title":"Kali Forms <= 2.4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f0cc587-bed2-4feb-b7b4-529ec44796d0?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2026-06-09T00:00:00Z","updated":"2026-09-18T14:58:40Z"},{"id":"wordfence:8f0ee03c-8cf6-4372-b740-722fc1283ee3","source":"wordfence","cve":"CVE-2024-3076","title":"MM-email2image <= 0.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f0ee03c-8cf6-4372-b740-722fc1283ee3?source=api-prod","affected":[{"type":"plugin","slug":"mm-email2image","name":"MM-email2image","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T17:38:39Z"},{"id":"wordfence:8f105002-a19a-4376-af65-7e9416175174","source":"wordfence","cve":"CVE-2023-1839","title":"PPOM for WooCommerce <= 32.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f105002-a19a-4376-af65-7e9416175174?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"32.0.6","to_inclusive":false,"patched_in":"32.0.6"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f10a95c-59ff-49a2-8bbf-1b0a802b62c6","source":"wordfence","cve":"CVE-2016-1000141","title":"Page Layout Builder <= 1.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f10a95c-59ff-49a2-8bbf-1b0a802b62c6?source=api-prod","affected":[{"type":"plugin","slug":"page-layout-builder","name":"MiniMax \u2013 Page Layout Builder","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f1866d6-79ac-444c-ab73-eab081786c93","source":"wordfence","cve":"CVE-2024-35644","title":"Preferred Languages <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1866d6-79ac-444c-ab73-eab081786c93?source=api-prod","affected":[{"type":"plugin","slug":"preferred-languages","name":"Preferred Languages","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:17:20Z"},{"id":"wordfence:8f18e3b1-4f91-4718-8da8-ad23c8d6da75","source":"wordfence","cve":"CVE-2025-30793","title":"Houzez Property Feed <= 2.5.4 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f18e3b1-4f91-4718-8da8-ad23c8d6da75?source=api-prod","affected":[{"type":"plugin","slug":"houzez-property-feed","name":"Houzez Property Feed","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-08T13:41:38Z"},{"id":"wordfence:8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded","source":"wordfence","cve":"CVE-2026-97652","title":"WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1d2fe2-816b-46ee-8ab5-ae9936ac9ded?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.14","to_inclusive":true,"patched_in":"14.16.15"}],"published":"2026-10-01T21:08:29Z","updated":"2026-10-02T09:25:57Z"},{"id":"wordfence:8f1e3c0d-3b67-40e8-b233-e23e257982f4","source":"wordfence","cve":"CVE-2026-65511","title":"Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1e3c0d-3b67-40e8-b233-e23e257982f4?source=api-prod","affected":[{"type":"theme","slug":"manual","name":"Manual - Documentation, Knowledge Base & Education WordPress Theme","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T23:09:55Z"},{"id":"wordfence:8f1e6f04-04d4-4484-86bd-28df6388a953","source":"wordfence","cve":"CVE-2022-45350","title":"Simple History <= 3.3.1 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":6.0,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f1e6f04-04d4-4484-86bd-28df6388a953?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f20734d-4105-401b-992a-b47d049f70f4","source":"wordfence","cve":"","title":"AJAX Multi Upload <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f20734d-4105-401b-992a-b47d049f70f4?source=api-prod","affected":[{"type":"plugin","slug":"ajax_multi_upload","name":"AJAX Multi Upload","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2012-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f220293-9789-4824-b736-ead014c45366","source":"wordfence","cve":"CVE-2023-49157","title":"Multiple Post Passwords <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f220293-9789-4824-b736-ead014c45366?source=api-prod","affected":[{"type":"plugin","slug":"multiple-post-passwords","name":"Multiple Post Passwords","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f2333a1-b255-4219-a7b2-3de3a3e74e8c","source":"wordfence","cve":"CVE-2025-22686","title":"CF7 Google Sheets Connector <= 5.0.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f2333a1-b255-4219-a7b2-3de3a3e74e8c?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-sheets-connector","name":"GSheetConnector \u2013 CF7 Google Sheets Connector & Save CF7 Entries to Database","from":"*","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"5.0.18"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:38:42Z"},{"id":"wordfence:8f243012-a1c6-4d08-a55f-73d4a0d4911f","source":"wordfence","cve":"CVE-2026-73183","title":"Maps Marker Pro <= 4.32 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f243012-a1c6-4d08-a55f-73d4a0d4911f?source=api-prod","affected":[{"type":"plugin","slug":"maps-marker-pro","name":"Maps Marker Pro","from":"*","from_inclusive":true,"to":"4.32","to_inclusive":true,"patched_in":"4.32.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-03T16:34:25Z"},{"id":"wordfence:8f24743c-3894-40a8-9128-7d04bc2c8345","source":"wordfence","cve":"","title":"WP Post to PDF <= 2.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f24743c-3894-40a8-9128-7d04bc2c8345?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-to-pdf","name":"WP Post to PDF","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f24f7e2-2516-4f4d-955f-f3f6001cbce7","source":"wordfence","cve":"CVE-2022-45835","title":"PhonePe Payment Solutions <= 1.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f24f7e2-2516-4f4d-955f-f3f6001cbce7?source=api-prod","affected":[{"type":"plugin","slug":"phonepe-payment-solutions","name":"PhonePe Payment Solutions","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f29da38-177e-4c8d-964f-473b2a3e1b78","source":"wordfence","cve":"CVE-2024-37102","title":"Vilva <= 1.2.2 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f29da38-177e-4c8d-964f-473b2a3e1b78?source=api-prod","affected":[{"type":"theme","slug":"vilva","name":"Vilva","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:50:33Z"},{"id":"wordfence:8f2d99ce-89b6-441d-b185-2c321b08b73c","source":"wordfence","cve":"CVE-2025-25089","title":"Image Rotator <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f2d99ce-89b6-441d-b185-2c321b08b73c?source=api-prod","affected":[{"type":"plugin","slug":"appten-image-rotator","name":"Image Rotator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:14:03Z"},{"id":"wordfence:8f32791a-4249-4f9b-aa66-cab66f1bf1fc","source":"wordfence","cve":"CVE-2026-22478","title":"FindAll - Business Directory WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f32791a-4249-4f9b-aa66-cab66f1bf1fc?source=api-prod","affected":[{"type":"theme","slug":"findall","name":"FindAll - Business Directory WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:52:07Z"},{"id":"wordfence:8f342fb7-8f52-43d9-a887-1cf1fffa6ec6","source":"wordfence","cve":"CVE-2023-25034","title":"WP Clean Up <= 1.2.3 - Cross-Site Request Forgery via wp_clean_up_optimize","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f342fb7-8f52-43d9-a887-1cf1fffa6ec6?source=api-prod","affected":[{"type":"plugin","slug":"wp-clean-up","name":"WP Clean Up","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f34ecd8-ee38-4313-9c4d-fd138a93f4be","source":"wordfence","cve":"CVE-2025-23543","title":"FOMO Pay Chinese Payment Solution <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f34ecd8-ee38-4313-9c4d-fd138a93f4be?source=api-prod","affected":[{"type":"plugin","slug":"fomo-payment-gateway-for-woocommerce","name":"FOMO Pay Chinese Payment Solution","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T12:59:27Z"},{"id":"wordfence:8f35838f-4a7d-4d25-9e5e-956411e59b62","source":"wordfence","cve":"CVE-2024-43270","title":"Backup and Restore WordPress <= 1.50 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f35838f-4a7d-4d25-9e5e-956411e59b62?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.50","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-22T15:37:17Z"},{"id":"wordfence:8f374eea-e6c0-4007-8855-4b1b63335775","source":"wordfence","cve":"","title":"LDD Directory Lite - <= 3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f374eea-e6c0-4007-8855-4b1b63335775?source=api-prod","affected":[{"type":"plugin","slug":"ldd-directory-lite","name":"LDD Directory Lite","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f394209-df80-491f-b700-cc06e54ea676","source":"wordfence","cve":"CVE-2024-13781","title":"Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f394209-df80-491f-b700-cc06e54ea676?source=api-prod","affected":[{"type":"plugin","slug":"hmapsprem","name":"Hero Maps Premium","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T19:33:32Z","updated":"2025-03-07T08:21:25Z"},{"id":"wordfence:8f3c9b96-70e8-452e-9065-28dff744a69d","source":"wordfence","cve":"CVE-2025-54738","title":"Jobmonster <= 4.7.9 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f3c9b96-70e8-452e-9065-28dff744a69d?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:37:31Z"},{"id":"wordfence:8f3ed0f0-897d-47f4-acdc-b483838af4bc","source":"wordfence","cve":"CVE-2013-7483","title":"SlideDeck 2 <= 2.3.3 - Local/Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f3ed0f0-897d-47f4-acdc-b483838af4bc?source=api-prod","affected":[{"type":"plugin","slug":"slidedeck2","name":"SlideDeck 2 Lite Responsive Content Slider","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f3f3591-5169-4885-95ec-c2aae888b88b","source":"wordfence","cve":"CVE-2024-51935","title":"Fast Video and Image Display <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f3f3591-5169-4885-95ec-c2aae888b88b?source=api-prod","affected":[{"type":"plugin","slug":"fast-video-and-image-display","name":"Fast Video and Image Display","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:24:50Z"},{"id":"wordfence:8f411d17-5b0d-4a4a-afa8-7efebf6965f2","source":"wordfence","cve":"CVE-2024-6120","title":"Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f411d17-5b0d-4a4a-afa8-7efebf6965f2?source=api-prod","affected":[{"type":"plugin","slug":"sparkle-demo-importer","name":"Sparkle Demo Importer","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-06-21T11:04:07Z","updated":"2024-06-21T23:33:49Z"},{"id":"wordfence:8f444df8-a7ed-4ab0-bf68-8b18ba5e90c0","source":"wordfence","cve":"CVE-2025-31850","title":"PDF Generator Addon for Elementor Page Builder <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f444df8-a7ed-4ab0-bf68-8b18ba5e90c0?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-addon-for-elementor-page-builder","name":"PDF Generator for WordPress Elementor","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-02-10T20:53:15Z"},{"id":"wordfence:8f491d48-935c-4fd9-a342-44d98c5601b3","source":"wordfence","cve":"CVE-2025-2221","title":"WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f491d48-935c-4fd9-a342-44d98c5601b3?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T06:43:18Z"},{"id":"wordfence:8f494ca7-3f2f-4535-92ff-1ed5c469bf45","source":"wordfence","cve":"CVE-2024-29767","title":"Doneren met Mollie <= 2.10.2 - Unauthenticated Reflected Cross-Site Scripting via search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f494ca7-3f2f-4535-92ff-1ed5c469bf45?source=api-prod","affected":[{"type":"plugin","slug":"doneren-met-mollie","name":"Doneren met Mollie","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T17:01:51Z"},{"id":"wordfence:8f4a2ec5-ce42-4be2-9994-9b9df532461f","source":"wordfence","cve":"CVE-2025-68980","title":"WeDesignTech Portfolio <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4a2ec5-ce42-4be2-9994-9b9df532461f?source=api-prod","affected":[{"type":"plugin","slug":"wedesigntech-portfolio","name":"WeDesignTech Portfolio","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-06T15:14:35Z"},{"id":"wordfence:8f4a9f9f-a342-4053-b4e0-cbaa9796e4ba","source":"wordfence","cve":"CVE-2015-4066","title":"GigPress <= 2.3.8 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4a9f9f-a342-4053-b4e0-cbaa9796e4ba?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":false,"patched_in":"2.3.9"}],"published":"2015-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f4ae82c-f249-4094-a0ef-568c3a30d16b","source":"wordfence","cve":"CVE-2022-1594","title":"HC Custom WP-Admin URL <= 1.4 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4ae82c-f249-4094-a0ef-568c3a30d16b?source=api-prod","affected":[{"type":"plugin","slug":"hc-custom-wp-admin-url","name":"HC Custom WP-Admin URL","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f4b9647-84ac-4011-a063-56740b42359e","source":"wordfence","cve":"CVE-2025-68070","title":"VK Google Job Posting Manager <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4b9647-84ac-4011-a063-56740b42359e?source=api-prod","affected":[{"type":"plugin","slug":"vk-google-job-posting-manager","name":"VK Google Job Posting Manager","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":"1.2.23"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:06:12Z"},{"id":"wordfence:8f4c086d-8209-4212-9d91-67238c1a9143","source":"wordfence","cve":"CVE-2021-4407","title":"Custom Banners <= 3.2.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4c086d-8209-4212-9d91-67238c1a9143?source=api-prod","affected":[{"type":"plugin","slug":"custom-banners","name":"Custom Banners","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f4d38f7-b2a1-4772-b9e3-250fedce2f2a","source":"wordfence","cve":"CVE-2026-116859","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.58.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4d38f7-b2a1-4772-b9e3-250fedce2f2a?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.3","to_inclusive":true,"patched_in":"1.58.4"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:39:39Z"},{"id":"wordfence:8f4dc917-028c-451a-9b32-26ef2c488850","source":"wordfence","cve":"CVE-2023-45750","title":"Nexter Extension <= 2.0.3 - Reflected Cross-Site Scripting via post and post_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4dc917-028c-451a-9b32-26ef2c488850?source=api-prod","affected":[{"type":"plugin","slug":"nexter-extension","name":"Nexter Extension \u2013 Security, Performance, Code Snippets & Site Toolkit","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f4f2317-945e-4fd8-8a0b-981b88a8412c","source":"wordfence","cve":"CVE-2023-47525","title":"Event Management Tickets Booking <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4f2317-945e-4fd8-8a0b-981b88a8412c?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-12-19T00:00:00Z","updated":"2026-02-03T19:15:08Z"},{"id":"wordfence:8f4f7cb9-22ef-46fb-bb0a-98fe9af32d38","source":"wordfence","cve":"CVE-2024-27190","title":"Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4f7cb9-22ef-46fb-bb0a-98fe9af32d38?source=api-prod","affected":[{"type":"plugin","slug":"download-media","name":"Download Media","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T15:59:58Z"},{"id":"wordfence:8f50812a-c6a7-4bb3-9833-e10acd0460c0","source":"wordfence","cve":"CVE-2024-8624","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f50812a-c6a7-4bb3-9833-e10acd0460c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.3","to_inclusive":true,"patched_in":"1.3.3.4"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T02:31:03Z"},{"id":"wordfence:8f50a1ab-c51c-46e2-837c-340c796d875c","source":"wordfence","cve":"CVE-2026-66652","title":"Grand Tour | Travel Agency WordPress <= 5.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f50a1ab-c51c-46e2-837c-340c796d875c?source=api-prod","affected":[{"type":"theme","slug":"grandtour","name":"Grand Tour | Travel Agency WordPress","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:18:08Z"},{"id":"wordfence:8f51aa9f-056a-441c-8752-edb1c7277808","source":"wordfence","cve":"CVE-2025-9892","title":"Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f51aa9f-056a-441c-8752-edb1c7277808?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-registration","name":"Restrict User Registration","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:32:32Z","updated":"2025-10-03T11:17:16Z"},{"id":"wordfence:8f52fd57-abfe-48c4-a950-66d72a5a9627","source":"wordfence","cve":"","title":"Tracking Code Manager < 1.11.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f52fd57-abfe-48c4-a950-66d72a5a9627?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2017-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f5357e0-1e1b-4090-a6ae-9587c6a8d290","source":"wordfence","cve":"CVE-2023-44150","title":"ProfilePress <= 4.13.2 - Information Disclosure via Debug Log","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5357e0-1e1b-4090-a6ae-9587c6a8d290?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.13.2","to_inclusive":true,"patched_in":"4.13.3"}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f539e25-5483-417d-a3c5-e7034c03c673","source":"wordfence","cve":"CVE-2026-15290","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f539e25-5483-417d-a3c5-e7034c03c673?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2025-04-16T00:00:00Z","updated":"2026-07-10T04:31:23Z"},{"id":"wordfence:8f53a8d1-e7d6-4085-a1e6-f4263ec341b6","source":"wordfence","cve":"CVE-2025-48082","title":"Progress Planner <= 1.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f53a8d1-e7d6-4085-a1e6-f4263ec341b6?source=api-prod","affected":[{"type":"plugin","slug":"progress-planner","name":"Progress Planner","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-10-06T00:00:00Z","updated":"2025-11-05T15:34:39Z"},{"id":"wordfence:8f551441-1f41-4ae2-93a7-6385fa3a70e3","source":"wordfence","cve":"CVE-2024-37221","title":"Kimili Flash Embed <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f551441-1f41-4ae2-93a7-6385fa3a70e3?source=api-prod","affected":[{"type":"plugin","slug":"kimili-flash-embed","name":"Kimili Flash Embed","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:37:50Z"},{"id":"wordfence:8f562e33-2aef-46f0-8a65-691155ede9e7","source":"wordfence","cve":"CVE-2023-1874","title":"WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":7.5,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f562e33-2aef-46f0-8a65-691155ede9e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":true,"patched_in":"5.3.8"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f56e7de-5a85-4b99-95d3-596af7694394","source":"wordfence","cve":"CVE-2026-107631","title":"Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f56e7de-5a85-4b99-95d3-596af7694394?source=api-prod","affected":[{"type":"plugin","slug":"record-of-consent-extension-for-complianz","name":"Record of Consent Extension for Complianz","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2026-10-13T19:40:24Z","updated":"2026-10-14T07:43:34Z"},{"id":"wordfence:8f5722b0-0d54-4c44-b168-a886da1077cb","source":"wordfence","cve":"CVE-2025-5190","title":"Browse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5722b0-0d54-4c44-b168-a886da1077cb?source=api-prod","affected":[{"type":"plugin","slug":"browse-as","name":"Browse As","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T00:00:00Z","updated":"2025-05-30T11:15:10Z"},{"id":"wordfence:8f59e069-a953-47b6-8106-55f55df722ed","source":"wordfence","cve":"CVE-2026-2986","title":"Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f59e069-a953-47b6-8106-55f55df722ed?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-04-17T21:46:50Z","updated":"2026-04-18T11:16:13Z"},{"id":"wordfence:8f5a3ed2-1db2-47e4-9aca-8fb197174342","source":"wordfence","cve":"CVE-2021-25109","title":"Futurio Extra <= 1.6.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5a3ed2-1db2-47e4-9aca-8fb197174342?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f5b9aff-0833-4887-ae59-df5bc88c7f91","source":"wordfence","cve":"CVE-2023-4842","title":"Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5b9aff-0833-4887-ae59-df5bc88c7f91?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f5d0539-4cd5-469c-8dd5-fd528aa519b7","source":"wordfence","cve":"CVE-2024-52455","title":"GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5d0539-4cd5-469c-8dd5-fd528aa519b7?source=api-prod","affected":[{"type":"plugin","slug":"goqsmile","name":"GoQSmile","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:13:47Z"},{"id":"wordfence:8f5f5b75-abaf-4e4b-8509-f8b569519166","source":"wordfence","cve":"CVE-2026-96564","title":"SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5f5b75-abaf-4e4b-8509-f8b569519166?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.2","to_inclusive":true,"patched_in":"10.3"}],"published":"2026-10-02T17:22:09Z","updated":"2026-10-03T05:29:15Z"},{"id":"wordfence:8f5fa529-4c6e-465e-a281-78ba74e5a718","source":"wordfence","cve":"","title":"Accordion (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f5fa529-4c6e-465e-a281-78ba74e5a718?source=api-prod","affected":[{"type":"plugin","slug":"accordion","name":"Accordion","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f617090-f2cf-4ac4-8d09-c1d5c21e120d","source":"wordfence","cve":"CVE-2021-36841","title":"YITH Maintenance Mode <= 1.3.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f617090-f2cf-4ac4-8d09-c1d5c21e120d?source=api-prod","affected":[{"type":"plugin","slug":"yith-maintenance-mode","name":"YITH Maintenance Mode","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2021-09-15T11:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f630a7c-9082-400d-9d09-1280330ffbc6","source":"wordfence","cve":"CVE-2025-58951","title":"Advance Seat Reservation Management for WooCommerce <= 3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f630a7c-9082-400d-9d09-1280330ffbc6?source=api-prod","affected":[{"type":"plugin","slug":"scw-seat-reservation","name":"Advance Seat Reservation Management for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-12-19T22:02:59Z"},{"id":"wordfence:8f64361a-e5b5-4481-b25c-bdffeb80c198","source":"wordfence","cve":"CVE-2026-1359","title":"Genolve \u2013 AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f64361a-e5b5-4481-b25c-bdffeb80c198?source=api-prod","affected":[{"type":"plugin","slug":"genolve-toolkit","name":"Genolve \u2013 AI Business Graphics, Images & Video","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2026-07-10T18:57:09Z","updated":"2026-07-11T07:47:54Z"},{"id":"wordfence:8f66e25f-b67e-4227-95fe-69b40551af61","source":"wordfence","cve":"CVE-2026-12418","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f66e25f-b67e-4227-95fe-69b40551af61?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-07-08T19:37:25Z","updated":"2026-07-09T07:55:13Z"},{"id":"wordfence:8f687ee4-9760-48dd-9427-853de877dacc","source":"wordfence","cve":"CVE-2024-43981","title":"GeoDirectory <= 2.3.70 - Missing Authorization via geodirectory_rated()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f687ee4-9760-48dd-9427-853de877dacc?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.70","to_inclusive":true,"patched_in":"2.3.71"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T20:52:04Z"},{"id":"wordfence:8f68c70b-9fde-43a6-8a7c-00938aa0e109","source":"wordfence","cve":"CVE-2023-33925","title":"WooCommerce Product Categories Selection Widget <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f68c70b-9fde-43a6-8a7c-00938aa0e109?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-category-selection-widget","name":"WooCommerce Product Categories Selection Widget","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f6bbaa1-c50f-4dad-9e5b-04bdffd4a0ae","source":"wordfence","cve":"CVE-2024-0789","title":"WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6bbaa1-c50f-4dad-9e5b-04bdffd4a0ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.1.9.2","to_inclusive":true,"patched_in":"6.1.9.3"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-29T21:36:50Z"},{"id":"wordfence:8f6c20cb-b3a9-41d3-bccf-5b834424a59a","source":"wordfence","cve":"CVE-2023-0075","title":"Amazon JS <= 0.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6c20cb-b3a9-41d3-bccf-5b834424a59a?source=api-prod","affected":[{"type":"plugin","slug":"amazonjs","name":"Amazon JS","from":"*","from_inclusive":true,"to":"0.10","to_inclusive":true,"patched_in":""}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f6e6fcb-1688-424e-b0fa-1c0ace474c2c","source":"wordfence","cve":"CVE-2026-1939","title":"Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6e6fcb-1688-424e-b0fa-1c0ace474c2c?source=api-prod","affected":[{"type":"plugin","slug":"percent-to-infograph","name":"Percent to Infograph","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:28:00Z","updated":"2026-02-14T06:42:29Z"},{"id":"wordfence:8f6e7756-d8cc-4380-a93e-47d7916a5f7b","source":"wordfence","cve":"CVE-2025-13623","title":"Twitscription <= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH_INFO","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6e7756-d8cc-4380-a93e-47d7916a5f7b?source=api-prod","affected":[{"type":"plugin","slug":"twitscription","name":"Twitscription","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:29:24Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:8f6fd0bb-d37b-40b6-b84e-9b21aae891cc","source":"wordfence","cve":"CVE-2023-51683","title":"Easy PayPal Buy Now Button <= 1.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6fd0bb-d37b-40b6-b84e-9b21aae891cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f706b78-2d67-442c-b7a0-7d7a0fd24b2d","source":"wordfence","cve":"CVE-2025-12752","title":"Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f706b78-2d67-442c-b7a0-7d7a0fd24b2d?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-memberships-for-paypal","name":"Subscriptions & Memberships for PayPal","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-11-21T18:49:09Z","updated":"2025-11-22T07:29:24Z"},{"id":"wordfence:8f70c96c-5146-41d8-9d9c-7f2adb336049","source":"wordfence","cve":"CVE-2011-3851","title":"News <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f70c96c-5146-41d8-9d9c-7f2adb336049?source=api-prod","affected":[{"type":"theme","slug":"news","name":"News","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"0.2"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f715947-e379-4a05-9ab8-5d9e94ffc136","source":"wordfence","cve":"CVE-2023-34174","title":"BBS e-Popup <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f715947-e379-4a05-9ab8-5d9e94ffc136?source=api-prod","affected":[{"type":"plugin","slug":"bbs-e-popup","name":"BBS e-Popup","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f740671-6316-4626-ac98-dfcfc8a9c88f","source":"wordfence","cve":"CVE-2026-12592","title":"SlimStat Analytics <= 5.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f740671-6316-4626-ac98-dfcfc8a9c88f?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T22:39:07Z"},{"id":"wordfence:8f7626b3-86b5-4aa2-871b-07f84a43c47f","source":"wordfence","cve":"CVE-2024-54326","title":"GEO my WordPress <= 4.5.0.4 - Missing Authorization via get_field_options_ajax","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7626b3-86b5-4aa2-871b-07f84a43c47f?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.0.4","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:47:49Z"},{"id":"wordfence:8f7b0a1c-16d7-45db-b419-569ed5c4a5e4","source":"wordfence","cve":"","title":"Make, formerly Integromat Connector <= 1.5.2 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7b0a1c-16d7-45db-b419-569ed5c4a5e4?source=api-prod","affected":[{"type":"plugin","slug":"integromat-connector","name":"Make Connector","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f7ce513-45ba-427b-8ee0-1007e404c1a9","source":"wordfence","cve":"CVE-2024-9421","title":"Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7ce513-45ba-427b-8ee0-1007e404c1a9?source=api-prod","affected":[{"type":"plugin","slug":"login-logout-shortcode","name":"Login Logout Shortcode","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-03T13:33:13Z","updated":"2024-10-04T02:04:54Z"},{"id":"wordfence:8f7edb22-1441-4cac-9899-cd27dc313870","source":"wordfence","cve":"CVE-2015-10013","title":"Taxonomy Switcher <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7edb22-1441-4cac-9899-cd27dc313870?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-switcher","name":"Taxonomy Switcher","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-02-07T14:26:45Z"},{"id":"wordfence:8f7ee196-1151-4312-ac61-0bb6756850bb","source":"wordfence","cve":"CVE-2026-15180","title":"Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7ee196-1151-4312-ac61-0bb6756850bb?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2026-10-14T16:28:15Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:8f812539-ebb3-4b80-a599-2e695154d6c0","source":"wordfence","cve":"CVE-2025-58250","title":"Findgo <= 1.3.55 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f812539-ebb3-4b80-a599-2e695154d6c0?source=api-prod","affected":[{"type":"theme","slug":"fingo","name":"fingo","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.60.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:17:43Z"},{"id":"wordfence:8f8128a6-4252-4243-94ad-ca43fbe1a04e","source":"wordfence","cve":"CVE-2025-23766","title":"OPSI Israel Domestic Shipments <= 2.9.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8128a6-4252-4243-94ad-ca43fbe1a04e?source=api-prod","affected":[{"type":"plugin","slug":"woo-ups-pickup","name":"OPSI Israel Domestic Shipments","from":"*","from_inclusive":true,"to":"2.9.1.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-01-16T00:00:00Z","updated":"2026-09-09T15:50:40Z"},{"id":"wordfence:8f81ca6c-2479-4193-9f2c-6645cd7bca8a","source":"wordfence","cve":"CVE-2025-62918","title":"IgnitionDeck <= 2.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f81ca6c-2479-4193-9f2c-6645cd7bca8a?source=api-prod","affected":[{"type":"plugin","slug":"ignitiondeck","name":"IgnitionDeck Crowdfunding Platform","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-10-04T00:00:00Z","updated":"2025-10-29T15:00:37Z"},{"id":"wordfence:8f825049-80e8-4a51-8ead-5d214cfbbbd0","source":"wordfence","cve":"CVE-2026-105878","title":"YITH WooCommerce Product Bundles <= 2.29.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f825049-80e8-4a51-8ead-5d214cfbbbd0?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-bundles","name":"YITH WooCommerce Product Bundles","from":"*","from_inclusive":true,"to":"2.29.0","to_inclusive":true,"patched_in":"2.30.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:16:37Z"},{"id":"wordfence:8f82ad33-8c9b-47f8-b02b-013b4112c914","source":"wordfence","cve":"CVE-2026-40782","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f82ad33-8c9b-47f8-b02b-013b4112c914?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T14:40:04Z"},{"id":"wordfence:8f83c4b4-6ff9-4d25-9c71-8ce1cfa515f1","source":"wordfence","cve":"CVE-2026-18364","title":"Zportals <= 6.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f83c4b4-6ff9-4d25-9c71-8ce1cfa515f1?source=api-prod","affected":[{"type":"plugin","slug":"zportals","name":"Zportals","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T13:44:02Z"},{"id":"wordfence:8f83ebb2-f84f-4701-9d2b-9f7fadcb6796","source":"wordfence","cve":"CVE-2026-32380","title":"Numinous <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f83ebb2-f84f-4701-9d2b-9f7fadcb6796?source=api-prod","affected":[{"type":"theme","slug":"numinous","name":"Numinous","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:54:15Z"},{"id":"wordfence:8f840a96-8cda-4237-b445-284b88eaf623","source":"wordfence","cve":"CVE-2021-24970","title":"All-In-One-Gallery <= 2.4.9 - Admin+ Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f840a96-8cda-4237-b445-284b88eaf623?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f847a61-4378-4b04-8eb4-99ef36417b6c","source":"wordfence","cve":"CVE-2023-4013","title":"GDPR Cookie Compliance <= 4.12.4 - Cross-Site Request Forgery to License Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f847a61-4378-4b04-8eb4-99ef36417b6c?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.12.4","to_inclusive":true,"patched_in":"4.12.5"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f854737-e87b-4c50-a9fb-d3b129f9d9fc","source":"wordfence","cve":"CVE-2024-12153","title":"GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f854737-e87b-4c50-a9fb-d3b129f9d9fc?source=api-prod","affected":[{"type":"plugin","slug":"gdy-modular-content","name":"GDY Modular Content","from":"*","from_inclusive":true,"to":"0.9.92","to_inclusive":true,"patched_in":"0.9.93"}],"published":"2025-01-06T15:38:45Z","updated":"2025-01-24T18:51:53Z"},{"id":"wordfence:8f88ff96-5bd7-448d-a030-e75fd268bff6","source":"wordfence","cve":"CVE-2023-49158","title":"LadiApp <= 4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f88ff96-5bd7-448d-a030-e75fd268bff6?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f890790-c5ca-4812-9566-6c945d8f39b5","source":"wordfence","cve":"CVE-2024-8052","title":"Review Ratings <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f890790-c5ca-4812-9566-6c945d8f39b5?source=api-prod","affected":[{"type":"plugin","slug":"ratings-shorttags","name":"Review Ratings","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T22:13:50Z"},{"id":"wordfence:8f896e4a-565a-4545-9683-045cd08ccca0","source":"wordfence","cve":"CVE-2007-4153","title":"WordPress Core <= 2.2.1 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f896e4a-565a-4545-9683-045cd08ccca0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f8b1d8f-b2b6-415c-91f2-e5b98048258d","source":"wordfence","cve":"CVE-2025-9114","title":"Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8b1d8f-b2b6-415c-91f2-e5b98048258d?source=api-prod","affected":[{"type":"theme","slug":"doccure","name":"Doccure","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-08T05:36:20Z","updated":"2025-11-25T06:04:46Z"},{"id":"wordfence:8f8bd107-5459-4093-8593-deedec6ffcd6","source":"wordfence","cve":"CVE-2024-5649","title":"Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection","severity":"medium","cvss":5.4,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8bd107-5459-4093-8593-deedec6ffcd6?source=api-prod","affected":[{"type":"plugin","slug":"fusion-slider","name":"Universal Slider","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T14:43:30Z","updated":"2024-06-19T03:12:31Z"},{"id":"wordfence:8f8d7397-0201-4194-8604-057f905ef10b","source":"wordfence","cve":"CVE-2025-11815","title":"UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.08","to_inclusive":true,"patched_in":"3.5.09"}],"published":"2025-11-20T19:17:51Z","updated":"2026-09-10T19:16:36Z"},{"id":"wordfence:8f8e6ca4-ceeb-4d0c-8b05-86c2abe435a2","source":"wordfence","cve":"CVE-2024-6887","title":"Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8e6ca4-ceeb-4d0c-8b05-86c2abe435a2?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.16","to_inclusive":true,"patched_in":"1.12.17"}],"published":"2024-08-22T00:00:00Z","updated":"2026-09-04T17:37:26Z"},{"id":"wordfence:8f906e8c-0b20-4da7-86b8-3306f36c46a4","source":"wordfence","cve":"CVE-2026-59523","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.11.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f906e8c-0b20-4da7-86b8-3306f36c46a4?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.11","to_inclusive":true,"patched_in":"1.6.12.0"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:35:41Z"},{"id":"wordfence:8f95276c-7486-4dbe-a79d-702fd6be9cfa","source":"wordfence","cve":"CVE-2025-14037","title":"Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f95276c-7486-4dbe-a79d-702fd6be9cfa?source=api-prod","affected":[{"type":"plugin","slug":"invelity-products-feeds","name":"Invelity Product Feeds","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:21:04Z","updated":"2026-03-21T03:26:55Z"},{"id":"wordfence:8f9615a9-e001-4a1f-a675-21515b4ba97f","source":"wordfence","cve":"CVE-2022-4355","title":"LetsRecover <= 1.1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9615a9-e001-4a1f-a675-21515b4ba97f?source=api-prod","affected":[{"type":"plugin","slug":"letsrecover-woocommerce-abandoned-cart","name":"LetsRecover \u2013 WooCommerce Abandoned Cart Notifications","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f9863b2-177d-4b72-8337-90fbedfd5b54","source":"wordfence","cve":"CVE-2019-18668","title":"Currency Switcher <= 2.11.1 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9863b2-177d-4b72-8337-90fbedfd5b54?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher-woocommerce","name":"Currency Switcher for WooCommerce","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":false,"patched_in":"2.11.2"}],"published":"2019-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f9cd0f2-1ca6-47cb-94bd-5c286cf9c67f","source":"wordfence","cve":"CVE-2014-3845","title":"TinyMCE Color Picker < 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9cd0f2-1ca6-47cb-94bd-5c286cf9c67f?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-colorpicker","name":"TinyMCE Color Picker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2014-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f9ce7a1-3e90-4b98-9fc2-4fcd37d332ed","source":"wordfence","cve":"CVE-2022-1591","title":"WordPress Ping Optimizer <= 2.35.1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9ce7a1-3e90-4b98-9fc2-4fcd37d332ed?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-ping-optimizer","name":"WordPress Ping Optimizer","from":"*","from_inclusive":true,"to":"2.35.1.2.3","to_inclusive":true,"patched_in":"2.35.1.3.0"}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8f9cf8d3-ebc1-4d94-909e-938beb58601e","source":"wordfence","cve":"CVE-2025-54742","title":"WpEvently <= 4.4.8 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9cf8d3-ebc1-4d94-909e-938beb58601e?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:55:24Z"},{"id":"wordfence:8f9db3b8-dd37-4d8b-b041-50b453858a39","source":"wordfence","cve":"CVE-2026-13228","title":"LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9db3b8-dd37-4d8b-b041-50b453858a39?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-06-30T21:30:37Z","updated":"2026-07-01T09:32:28Z"},{"id":"wordfence:8f9ee168-82b1-4d13-a84e-379f16dcb283","source":"wordfence","cve":"CVE-2023-1472","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fa1048e-bdcd-41d1-a7c4-196731a60843","source":"wordfence","cve":"CVE-2023-28167","title":"CF7 Invisible reCAPTCHA <= 1.3.3 - Cross-Site Request Forgery via vsz_cf7_invisible_recaptcha_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa1048e-bdcd-41d1-a7c4-196731a60843?source=api-prod","affected":[{"type":"plugin","slug":"cf7-invisible-recaptcha","name":"CF7 Invisible reCAPTCHA","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fa2e98b-5054-46fd-b22e-eac59b581a3c","source":"wordfence","cve":"CVE-2025-11828","title":"Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa2e98b-5054-46fd-b22e-eac59b581a3c?source=api-prod","affected":[{"type":"plugin","slug":"bnm-blocks","name":"Post Blocks & Tools","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-11-10T15:05:52Z","updated":"2025-11-13T15:52:49Z"},{"id":"wordfence:8fa382bf-a501-44eb-8a39-7ceb5829378f","source":"wordfence","cve":"CVE-2024-31427","title":"Marker.io  <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa382bf-a501-44eb-8a39-7ceb5829378f?source=api-prod","affected":[{"type":"plugin","slug":"marker-io","name":"Marker.io \u2013 Visual Website Feedback","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:00:46Z"},{"id":"wordfence:8fa3bcb9-df3e-4042-a28b-3d09bfebeebc","source":"wordfence","cve":"CVE-2026-15646","title":"Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa3bcb9-df3e-4042-a28b-3d09bfebeebc?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.8.1"}],"published":"2026-07-22T20:20:46Z","updated":"2026-07-23T08:34:40Z"},{"id":"wordfence:8fa4b5df-dc71-49de-880b-895eb1d9cdca","source":"wordfence","cve":"CVE-2024-8292","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa4b5df-dc71-49de-880b-895eb1d9cdca?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.8","to_inclusive":true,"patched_in":"16.26.9"}],"published":"2024-09-05T00:00:00Z","updated":"2024-09-06T18:28:47Z"},{"id":"wordfence:8fa6d1f2-17d3-4fc3-b8cc-c5b246a07be5","source":"wordfence","cve":"CVE-2024-13313","title":"AWeber  <= 7.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa6d1f2-17d3-4fc3-b8cc-c5b246a07be5?source=api-prod","affected":[{"type":"plugin","slug":"aweber-web-form-widget","name":"AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth","from":"*","from_inclusive":true,"to":"7.3.20","to_inclusive":true,"patched_in":"7.3.21"}],"published":"2025-03-06T00:00:00Z","updated":"2025-05-29T18:07:05Z"},{"id":"wordfence:8fa97e67-08c1-4553-bada-e4c59f797207","source":"wordfence","cve":"","title":"Buddyboss Platform <= 1.7.8 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa97e67-08c1-4553-bada-e4c59f797207?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2021-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fab1e59-5123-4ccb-bc0c-b8908643af89","source":"wordfence","cve":"CVE-2014-4595","title":"WP Restful <= 0.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fab1e59-5123-4ccb-bc0c-b8908643af89?source=api-prod","affected":[{"type":"plugin","slug":"wp-restful","name":"wp-restful","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8faecb99-df49-40b5-a5cb-7a8a21cb512c","source":"wordfence","cve":"CVE-2015-9317","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin < 3.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8faecb99-df49-40b5-a5cb-7a8a21cb512c?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":false,"patched_in":"3.1.7"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fb3c416-10d2-48b1-a158-74613be2fd21","source":"wordfence","cve":"CVE-2024-9882","title":"Salon Booking System <= 10.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb3c416-10d2-48b1-a158-74613be2fd21?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.9.3","to_inclusive":true,"patched_in":"10.9.4"}],"published":"2024-09-13T00:00:00Z","updated":"2024-11-15T19:38:47Z"},{"id":"wordfence:8fb6c221-d885-42b5-977c-39e8608e3e31","source":"wordfence","cve":"CVE-2024-0908","title":"Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-block","name":"Advanced Post Block \u2013 Display Your Posts Exactly How You Want","from":"*","from_inclusive":true,"to":"1.13.4","to_inclusive":true,"patched_in":"1.13.5"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-09T19:40:33Z"},{"id":"wordfence:8fb7241f-f7fc-48c0-8111-5ceceb156f9f","source":"wordfence","cve":"CVE-2026-39476","title":"User Feedback <= 1.10.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb7241f-f7fc-48c0-8111-5ceceb156f9f?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-04-15T21:23:23Z"},{"id":"wordfence:8fb7dc15-45e6-4209-a4c6-34c9c268e17b","source":"wordfence","cve":"CVE-2025-39592","title":"Subscribe to Unlock Lite <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb7dc15-45e6-4209-a4c6-34c9c268e17b?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-unlock-lite","name":"Subscribe to Unlock Lite \u2013 Opt In Content Locker Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:45:54Z"},{"id":"wordfence:8fbb92ac-a8e7-480d-8910-416fbe902a2a","source":"wordfence","cve":"CVE-2026-11613","title":"Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbb92ac-a8e7-480d-8910-416fbe902a2a?source=api-prod","affected":[{"type":"plugin","slug":"divi-ajax-filter","name":"Divi Ajax Filter","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-09-03T15:42:59Z","updated":"2026-09-04T04:29:08Z"},{"id":"wordfence:8fbc88da-8944-433c-b94d-9604ffe13d8a","source":"wordfence","cve":"CVE-2012-10020","title":"FoxyPress <= 0.4.2.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbc88da-8944-433c-b94d-9604ffe13d8a?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.2.2","to_inclusive":false,"patched_in":"0.4.2.2"}],"published":"2012-06-12T00:00:00Z","updated":"2025-07-22T01:44:29Z"},{"id":"wordfence:8fbc9c82-4736-47d9-88ac-bea0b66d6c9e","source":"wordfence","cve":"CVE-2026-14859","title":"Crowdfunding <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbc9c82-4736-47d9-88ac-bea0b66d6c9e?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:23:03Z"},{"id":"wordfence:8fbcd728-d2a2-4787-841d-0ce77356f737","source":"wordfence","cve":"CVE-2023-28993","title":"Albo Pretorio Online <= 4.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbcd728-d2a2-4787-841d-0ce77356f737?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fc02501-2bb6-4817-8e01-273d3d91ac57","source":"wordfence","cve":"CVE-2011-5216","title":"SCORM Cloud For WordPress < 1.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc02501-2bb6-4817-8e01-273d3d91ac57?source=api-prod","affected":[{"type":"plugin","slug":"scormcloud","name":"SCORM Cloud For WordPress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"}],"published":"2011-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fc28132-eae6-4082-988c-2d9e56ff1283","source":"wordfence","cve":"CVE-2024-31300","title":"Easy Social Share Buttons <= 9.4 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc28132-eae6-4082-988c-2d9e56ff1283?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons3","name":"Easy Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"9.4","to_inclusive":true,"patched_in":"9.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:41:39Z"},{"id":"wordfence:8fc4b815-dc05-4270-bf7a-3b01622739d7","source":"wordfence","cve":"CVE-2023-0691","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc4b815-dc05-4270-bf7a-3b01622739d7?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fc6c23c-1c5c-4fd8-aeea-8eb431e33b39","source":"wordfence","cve":"CVE-2023-32741","title":"Contact Form to Any API <= 1.1.2 - Authenticated (Administrator+) SQL Injection via 'form_id'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc6c23c-1c5c-4fd8-aeea-8eb431e33b39?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fc6d3e0-3e64-4a75-82a1-ca988b72b953","source":"wordfence","cve":"CVE-2025-62083","title":"BoomDevs WordPress Coming Soon <= 1.0.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc6d3e0-3e64-4a75-82a1-ca988b72b953?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-by-boomdevs","name":"Coming Soon & Maintenance Mode for WordPress by WP Messiah","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:12:26Z"},{"id":"wordfence:8fc88821-b2be-49a5-a2cf-53e87d0349a2","source":"wordfence","cve":"CVE-2023-0335","title":"WP Shamsi <= 4.3.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fc88821-b2be-49a5-a2cf-53e87d0349a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-shamsi","name":"WP Shamsi \u2013 \u0627\u0641\u0632\u0648\u0646\u0647 \u062a\u0627\u0631\u06cc\u062e \u0634\u0645\u0633\u06cc \u0648 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fcb4047-5173-4d10-a4bb-72f1919b9203","source":"wordfence","cve":"CVE-2025-14275","title":"Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fcb4047-5173-4d10-a4bb-72f1919b9203?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-01-07T14:17:03Z","updated":"2026-01-08T02:21:16Z"},{"id":"wordfence:8fcc8b94-6ed3-4784-93f3-ec1654d197bd","source":"wordfence","cve":"CVE-2024-49609","title":"Author Discussion <= 0.2.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fcc8b94-6ed3-4784-93f3-ec1654d197bd?source=api-prod","affected":[{"type":"plugin","slug":"author-discussion","name":"Author Discussion","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:46:04Z"},{"id":"wordfence:8fcf7283-eb6c-4fee-b606-79026e2227fc","source":"wordfence","cve":"","title":"Profile Builder <= 3.1.0 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fcf7283-eb6c-4fee-b606-79026e2227fc?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"},{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2020-02-13T00:00:00Z","updated":"2024-06-17T18:30:43Z"},{"id":"wordfence:8fcfd8c1-89b3-49f1-90dc-5eac1f9dbae5","source":"wordfence","cve":"CVE-2024-29129","title":"OxyExtras <= 1.4.4 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fcfd8c1-89b3-49f1-90dc-5eac1f9dbae5?source=api-prod","affected":[{"type":"plugin","slug":"oxyextras","name":"OxyExtras","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:53:37Z"},{"id":"wordfence:8fd13b18-63e6-4af2-a224-d87ad3a70dba","source":"wordfence","cve":"CVE-2012-6717","title":"Redirection < 2.2.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd13b18-63e6-4af2-a224-d87ad3a70dba?source=api-prod","affected":[{"type":"plugin","slug":"redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":false,"patched_in":"2.2.12"}],"published":"2012-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fd1de2b-bb88-4f7c-b9eb-784eb7af17a6","source":"wordfence","cve":"CVE-2013-3251","title":"qTranslate <= 2.5.39 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd1de2b-bb88-4f7c-b9eb-784eb7af17a6?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate","name":"qTranslate","from":"*","from_inclusive":true,"to":"2.5.39","to_inclusive":true,"patched_in":""}],"published":"2013-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fd2ed33-6977-4480-bdcb-d7afae7bfd06","source":"wordfence","cve":"CVE-2014-4938","title":"WP Rss Poster <= 1.0.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd2ed33-6977-4480-bdcb-d7afae7bfd06?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-poster","name":"WP Rss Poster","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fd845f2-9943-462a-afab-bd19b8064a88","source":"wordfence","cve":"CVE-2026-8380","title":"Frontend File Manager <= 23.6 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd845f2-9943-462a-afab-bd19b8064a88?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-04T00:00:00Z","updated":"2026-08-21T14:10:41Z"},{"id":"wordfence:8fd93a48-72ab-4475-a25d-d68c98939533","source":"wordfence","cve":"CVE-2023-6141","title":"Essential Real Estate <= 4.3.5 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd93a48-72ab-4475-a25d-d68c98939533?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-12-18T00:00:00Z","updated":"2024-02-06T15:18:25Z"},{"id":"wordfence:8fd93c96-36e9-4e9b-a7ef-b4dc6b7221a8","source":"wordfence","cve":"CVE-2024-39639","title":"WordPress File Upload <= 4.24.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fd93c96-36e9-4e9b-a7ef-b4dc6b7221a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.7","to_inclusive":true,"patched_in":"4.24.8"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:25:16Z"},{"id":"wordfence:8fdb3f8e-083a-4271-b490-465ded618bb5","source":"wordfence","cve":"CVE-2026-94590","title":"Sell Downloads <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fdb3f8e-083a-4271-b490-465ded618bb5?source=api-prod","affected":[{"type":"plugin","slug":"sell-downloads","name":"Sell Downloads","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-10-08T10:38:00Z","updated":"2026-10-13T14:46:16Z"},{"id":"wordfence:8fdf07b3-30f2-4b9c-a0c1-b6775a437e02","source":"wordfence","cve":"CVE-2026-81787","title":"IMPress for IDX Broker <= 3.3.0 -  Unauthenticated Unauthorized Lead and Search Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fdf07b3-30f2-4b9c-a0c1-b6775a437e02?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:54:45Z"},{"id":"wordfence:8fe0cb36-7b61-412f-ad2a-d31b18417ce8","source":"wordfence","cve":"CVE-2024-32506","title":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.73 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe0cb36-7b61-412f-ad2a-d31b18417ce8?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.73","to_inclusive":true,"patched_in":"2.0.74"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:52:10Z"},{"id":"wordfence:8fe1609d-17d6-4afe-90b2-5473dc9b6c3b","source":"wordfence","cve":"CVE-2025-3812","title":"WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe1609d-17d6-4afe-90b2-5473dc9b6c3b?source=api-prod","affected":[{"type":"plugin","slug":"wpbot-pro","name":"WPBot Pro Wordpress Chatbot","from":"*","from_inclusive":true,"to":"13.6.2","to_inclusive":true,"patched_in":"13.7.0"}],"published":"2025-05-16T16:36:34Z","updated":"2025-05-17T05:30:34Z"},{"id":"wordfence:8fe397d3-68de-4358-8490-8fbafa1908ef","source":"wordfence","cve":"CVE-2025-14067","title":"Easy Form Builder <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe397d3-68de-4358-8490-8fbafa1908ef?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2026-02-13T14:26:12Z","updated":"2026-02-14T03:25:27Z"},{"id":"wordfence:8fe7b884-c245-4412-b43d-38d0565fccbd","source":"wordfence","cve":"CVE-2026-32331","title":"Textmetrics <= 3.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe7b884-c245-4412-b43d-38d0565fccbd?source=api-prod","affected":[{"type":"plugin","slug":"webtexttool","name":"Textmetrics","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2026-02-08T00:00:00Z","updated":"2026-04-15T20:45:07Z"},{"id":"wordfence:8fe7dc0e-3b8c-409d-a66a-2f67b88d0d32","source":"wordfence","cve":"CVE-2025-47480","title":"Graphina <= 3.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe7dc0e-3b8c-409d-a66a-2f67b88d0d32?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:33:13Z"},{"id":"wordfence:8fea93d2-c1a5-416d-90d4-92304d8dc41f","source":"wordfence","cve":"","title":"1 Flash Gallery <= 1.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fea93d2-c1a5-416d-90d4-92304d8dc41f?source=api-prod","affected":[{"type":"plugin","slug":"1-flash-gallery","name":"1-flash-gallery","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8feabfb4-d094-467e-a1b7-266631a04c2f","source":"wordfence","cve":"CVE-2026-15054","title":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8feabfb4-d094-467e-a1b7-266631a04c2f?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-07T18:40:42Z"},{"id":"wordfence:8febf4ba-ad0f-4f93-8c13-f976d583e689","source":"wordfence","cve":"CVE-2021-38357","title":"SMS OVH <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8febf4ba-ad0f-4f93-8c13-f976d583e689?source=api-prod","affected":[{"type":"plugin","slug":"sms-ovh","name":"SMS OVH","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8fecc015-518f-4aab-a17e-17cf4b8cf123","source":"wordfence","cve":"CVE-2025-3529","title":"WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter","severity":"high","cvss":8.2,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2025-04-22T19:00:28Z","updated":"2025-04-23T07:06:54Z"},{"id":"wordfence:8fed0fae-fdac-4bb1-a0ad-99c48f82bfc7","source":"wordfence","cve":"CVE-2025-47635","title":"WebinarPress <= 1.33.30 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fed0fae-fdac-4bb1-a0ad-99c48f82bfc7?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.30","to_inclusive":true,"patched_in":"1.33.31"}],"published":"2025-05-07T00:00:00Z","updated":"2026-10-13T16:55:02Z"},{"id":"wordfence:8fef8676-8bf7-495f-a134-497756f329f2","source":"wordfence","cve":"CVE-2026-56042","title":"Advanced Order Export For WooCommerce <= 4.0.9 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fef8676-8bf7-495f-a134-497756f329f2?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:05:10Z"},{"id":"wordfence:8fefda27-aa3c-4fdf-beea-aaf0cdaaeb77","source":"wordfence","cve":"CVE-2024-29092","title":"Permalink Manager Lite <= 2.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8fefda27-aa3c-4fdf-beea-aaf0cdaaeb77?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.3.1"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:36:12Z"},{"id":"wordfence:8ff05617-61b1-4d1f-9230-c771f23d3283","source":"wordfence","cve":"CVE-2023-50372","title":"Custom Post Type Page Template <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff05617-61b1-4d1f-9230-c771f23d3283?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-page-template","name":"Custom Post Type Page Template","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ff16906-2516-4b3c-8217-e3fb24924e27","source":"wordfence","cve":"CVE-2024-1089","title":"ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff16906-2516-4b3c-8217-e3fb24924e27?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:49:37Z"},{"id":"wordfence:8ff18222-5796-432e-a810-d01fd5fbec4e","source":"wordfence","cve":"CVE-2015-10127","title":"PlusCaptcha <= 2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff18222-5796-432e-a810-d01fd5fbec4e?source=api-prod","affected":[{"type":"plugin","slug":"pluscaptcha","name":"PlusCaptcha","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2015-02-15T00:00:00Z","updated":"2024-02-07T13:58:40Z"},{"id":"wordfence:8ff1ca68-7c71-4442-b27f-12743fc39b37","source":"wordfence","cve":"CVE-2021-24872","title":"Get Custom Field Values < 4.0 - Arbitrary Post Metadata Access","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff1ca68-7c71-4442-b27f-12743fc39b37?source=api-prod","affected":[{"type":"plugin","slug":"get-custom-field-values","name":"Get Custom Field Values","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2021-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ff2a842-2e46-4267-bbf1-e7d9d4a7e277","source":"wordfence","cve":"CVE-2024-47314","title":"Sunshine Photo Cart <= 3.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff2a842-2e46-4267-bbf1-e7d9d4a7e277?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T20:57:21Z"},{"id":"wordfence:8ff3b35c-f7e3-4cae-b7f1-1a0930173ac5","source":"wordfence","cve":"CVE-2022-45349","title":"Betheme <= 26.6.2 - Missing Authorization to Post Title Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff3b35c-f7e3-4cae-b7f1-1a0930173ac5?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.2","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ff54e1c-7d6c-4360-a9b3-4e8928fff6de","source":"wordfence","cve":"CVE-2025-26894","title":"Coming Soon, Maintenance Mode <= 1.1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff54e1c-7d6c-4360-a9b3-4e8928fff6de?source=api-prod","affected":[{"type":"plugin","slug":"site-mode","name":"Coming Soon, Maintenance Mode & Under Construction Page Builder by Site Mode","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:33:49Z"},{"id":"wordfence:8ff66981-68ed-489a-b53f-4a1029e7590e","source":"wordfence","cve":"CVE-2025-57921","title":"Frontend File Manager <= 23.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff66981-68ed-489a-b53f-4a1029e7590e?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.2","to_inclusive":true,"patched_in":"23.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-17T20:55:46Z"},{"id":"wordfence:8ff92ea9-a9d9-4d74-b91e-44ecb19c59f8","source":"wordfence","cve":"CVE-2024-7590","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff92ea9-a9d9-4d74-b91e-44ecb19c59f8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T20:33:33Z"},{"id":"wordfence:8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6","source":"wordfence","cve":"CVE-2025-7839","title":"Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6?source=api-prod","affected":[{"type":"plugin","slug":"restore-permanently-delete-post-or-page-data","name":"Restore Permanently delete Post or Page Data","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:52:29Z","updated":"2025-08-23T04:25:47Z"},{"id":"wordfence:8ffb789a-409f-4771-a5e1-2643b6aeadf8","source":"wordfence","cve":"CVE-2024-44033","title":"Primary Addon for Elementor <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ffb789a-409f-4771-a5e1-2643b6aeadf8?source=api-prod","affected":[{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:24:30Z"},{"id":"wordfence:8ffc76d8-b841-4c26-bbc6-1f96664efe36","source":"wordfence","cve":"CVE-2024-8479","title":"Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ffc76d8-b841-4c26-bbc6-1f96664efe36?source=api-prod","affected":[{"type":"plugin","slug":"simple-spoiler","name":"Simple Spoiler","from":"1.2","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-14T03:29:29Z"},{"id":"wordfence:8ffdcc0f-8214-4056-abe1-926ed255e9f0","source":"wordfence","cve":"CVE-2016-11010","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ffdcc0f-8214-4056-abe1-926ed255e9f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:8ffde2ce-2857-473f-8956-ddce81001070","source":"wordfence","cve":"CVE-2024-35640","title":"Safety Exit <= 1.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8ffde2ce-2857-473f-8956-ddce81001070?source=api-prod","affected":[{"type":"plugin","slug":"safety-exit","name":"Safety Exit","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:21:57Z"},{"id":"wordfence:900294ef-dedb-49d3-b544-eae64399ea03","source":"wordfence","cve":"CVE-2025-12526","title":"Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900294ef-dedb-49d3-b544-eae64399ea03?source=api-prod","affected":[{"type":"plugin","slug":"private-google-calendars","name":"Private Google Calendars","from":"*","from_inclusive":true,"to":"20250811","to_inclusive":true,"patched_in":"20251128"}],"published":"2025-11-10T15:11:48Z","updated":"2025-12-01T15:30:12Z"},{"id":"wordfence:9002fe5c-d7c7-4d4a-9e92-db6ff390d78b","source":"wordfence","cve":"CVE-2022-1171","title":"Vertical scroll recent post <= 13.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9002fe5c-d7c7-4d4a-9e92-db6ff390d78b?source=api-prod","affected":[{"type":"plugin","slug":"vertical-scroll-recent-post","name":"Vertical scroll recent post","from":"*","from_inclusive":true,"to":"14.0","to_inclusive":false,"patched_in":"14.0"}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:900339ef-7481-4c55-ab1d-df2617987520","source":"wordfence","cve":"CVE-2026-23547","title":"CMSMasters Content Composer <= 2.5.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900339ef-7481-4c55-ab1d-df2617987520?source=api-prod","affected":[{"type":"plugin","slug":"cmsmasters-content-composer","name":"CMSMasters Content Composer","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-12-14T00:00:00Z","updated":"2026-05-04T15:01:13Z"},{"id":"wordfence:900506c0-7417-4da2-a1db-f3f6b96699e3","source":"wordfence","cve":"CVE-2026-121762","title":"PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900506c0-7417-4da2-a1db-f3f6b96699e3?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.18.0","to_inclusive":true,"patched_in":"11.18.2"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T16:10:30Z"},{"id":"wordfence:9009deff-bf5a-4434-8f73-1485f733d599","source":"wordfence","cve":"CVE-2026-40764","title":"Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9009deff-bf5a-4434-8f73-1485f733d599?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.10.0.2","to_inclusive":true,"patched_in":"1.10.0.3"}],"published":"2026-03-31T00:00:00Z","updated":"2026-05-07T14:02:35Z"},{"id":"wordfence:900cfb6d-61c8-4696-9a5d-1ff03cd76a22","source":"wordfence","cve":"CVE-2024-53803","title":"WP Mailster <= 1.8.16.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900cfb6d-61c8-4696-9a5d-1ff03cd76a22?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:24:11Z"},{"id":"wordfence:900d09e8-ded5-49b9-81bf-ddfc85d3cf2b","source":"wordfence","cve":"CVE-2025-2267","title":"WP01 \u2013 Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2b?source=api-prod","affected":[{"type":"plugin","slug":"wp01","name":"WP01 \u2013 Speed, Security, SEO consultant","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T14:25:22Z","updated":"2025-03-26T14:16:17Z"},{"id":"wordfence:900e45fc-3544-4c04-9940-a07e69795816","source":"wordfence","cve":"CVE-2024-56056","title":"SimpleCharm <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900e45fc-3544-4c04-9940-a07e69795816?source=api-prod","affected":[{"type":"theme","slug":"simplecharm","name":"SimpleCharm","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T17:59:31Z"},{"id":"wordfence:900e6528-f350-4e1b-80a5-aa01248323a8","source":"wordfence","cve":"CVE-2025-11448","title":"Gallery Plugin for WordPress \u2013 Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900e6528-f350-4e1b-80a5-aa01248323a8?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2025-11-07T20:58:55Z","updated":"2025-11-08T09:28:11Z"},{"id":"wordfence:900fcaab-2424-4ae8-af18-95659db0dbe3","source":"wordfence","cve":"CVE-2017-20192","title":"Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/900fcaab-2424-4ae8-af18-95659db0dbe3?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.05.03","to_inclusive":false,"patched_in":"2.05.03"}],"published":"2017-11-13T00:00:00Z","updated":"2024-10-16T06:43:36Z"},{"id":"wordfence:9011c84a-e4e5-460c-ab5e-f4451ab3cb07","source":"wordfence","cve":"CVE-2026-66608","title":"Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9011c84a-e4e5-460c-ab5e-f4451ab3cb07?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-09-17T11:50:00Z","updated":"2026-09-22T18:31:42Z"},{"id":"wordfence:901354c7-a908-4014-aee2-085892f4e4d6","source":"wordfence","cve":"CVE-2024-47310","title":"ARI Fancy Lightbox <= 1.3.17 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901354c7-a908-4014-aee2-085892f4e4d6?source=api-prod","affected":[{"type":"plugin","slug":"ari-fancy-lightbox","name":"ARI Fancy Lightbox \u2013 Popup for WordPress","from":"*","from_inclusive":true,"to":"1.3.17","to_inclusive":true,"patched_in":"1.3.18"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:06:04Z"},{"id":"wordfence:9013e816-1f5c-48cc-b79b-37cd9a75c2f6","source":"wordfence","cve":"CVE-2020-35936","title":"Team Showcase <= 1.22.15 - Stored Cross-Site Scripting","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9013e816-1f5c-48cc-b79b-37cd9a75c2f6?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.16","to_inclusive":false,"patched_in":"1.22.16"}],"published":"2020-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90141b96-83cb-4c33-9ffe-ffda1b249acc","source":"wordfence","cve":"CVE-2025-67960","title":"WorkScout-Core <= 1.7.06 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90141b96-83cb-4c33-9ffe-ffda1b249acc?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.7.06","to_inclusive":true,"patched_in":"1.7.07"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:13:17Z"},{"id":"wordfence:90162481-c20e-4c35-b6ed-79433529b89d","source":"wordfence","cve":"CVE-2025-47474","title":"Anarkali <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90162481-c20e-4c35-b6ed-79433529b89d?source=api-prod","affected":[{"type":"theme","slug":"anarkali","name":"Anarkali - Fashion Shop WooCommerce Elementor Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:52:17Z"},{"id":"wordfence:9016822f-f167-4225-8216-e74cd687443c","source":"wordfence","cve":"CVE-2024-11093","title":"SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9016822f-f167-4225-8216-e74cd687443c?source=api-prod","affected":[{"type":"plugin","slug":"sg-helper","name":"SG Helper","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T14:20:10Z","updated":"2024-12-04T02:40:26Z"},{"id":"wordfence:9019ff9f-6a2b-4617-8fe4-e860b9d38f9e","source":"wordfence","cve":"CVE-2026-116850","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.50.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9019ff9f-6a2b-4617-8fe4-e860b9d38f9e?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.50.1","to_inclusive":true,"patched_in":"3.51.0"}],"published":"2026-10-29T14:28:00Z","updated":"2026-11-03T19:33:29Z"},{"id":"wordfence:901baf71-03b5-4493-9318-ba28dcb97dbe","source":"wordfence","cve":"CVE-2023-36676","title":"Spectra <= 2.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901baf71-03b5-4493-9318-ba28dcb97dbe?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2023-07-14T00:00:00Z","updated":"2024-06-21T17:06:59Z"},{"id":"wordfence:901cc40d-fa20-4a1f-b01a-e3295891ebda","source":"wordfence","cve":"CVE-2025-68995","title":"My Sticky Elements <= 2.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901cc40d-fa20-4a1f-b01a-e3295891ebda?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-06T15:45:10Z"},{"id":"wordfence:901d4e10-06e9-4acd-ba4a-85a537fa10bc","source":"wordfence","cve":"CVE-2023-3771","title":"T1 Theme <= 19.0 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901d4e10-06e9-4acd-ba4a-85a537fa10bc?source=api-prod","affected":[{"type":"theme","slug":"t1","name":"T1 Theme","from":"*","from_inclusive":true,"to":"19.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:901d7f63-3c3f-453e-9b6a-85441c1a04c8","source":"wordfence","cve":"CVE-2025-39532","title":"Spice Blocks <= 2.0.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901d7f63-3c3f-453e-9b6a-85441c1a04c8?source=api-prod","affected":[{"type":"plugin","slug":"spice-blocks","name":"Spice Blocks","from":"*","from_inclusive":true,"to":"2.0.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-10-13T21:22:56Z"},{"id":"wordfence:901da3fd-930f-4253-978b-93e9b1d5e902","source":"wordfence","cve":"CVE-2026-12081","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901da3fd-930f-4253-978b-93e9b1d5e902?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-29T22:36:45Z"},{"id":"wordfence:901e015c-58fc-40ac-b078-f7040cbed274","source":"wordfence","cve":"CVE-2026-39511","title":"WP Photo Album Plus <= 9.1.08.001 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901e015c-58fc-40ac-b078-f7040cbed274?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.1.08.001","to_inclusive":true,"patched_in":"9.1.08.002"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:05:57Z"},{"id":"wordfence:901e85b9-0948-4a00-a29f-a726b53ba51b","source":"wordfence","cve":"CVE-2024-1068","title":"404 Solution <= 2.35.7 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/901e85b9-0948-4a00-a29f-a726b53ba51b?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.35.7","to_inclusive":true,"patched_in":"2.35.8"}],"published":"2024-02-17T00:00:00Z","updated":"2024-04-24T14:32:01Z"},{"id":"wordfence:9020faf4-0577-41d9-b005-4d4ffc99ba30","source":"wordfence","cve":"CVE-2025-26925","title":"Admin Menu Manager <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9020faf4-0577-41d9-b005-4d4ffc99ba30?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu-manager","name":"Admin Menu Manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T21:14:07Z"},{"id":"wordfence:90220c8d-8efc-48a2-955c-3155598f5f19","source":"wordfence","cve":"CVE-2024-10048","title":"Post Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90220c8d-8efc-48a2-955c-3155598f5f19?source=api-prod","affected":[{"type":"plugin","slug":"post-status-notifier","name":"Post Status Notifier","from":"*","from_inclusive":true,"to":"1.11.6","to_inclusive":true,"patched_in":"1.11.7"},{"type":"plugin","slug":"post-status-notifier-lite","name":"Post Status Notifier Lite","from":"*","from_inclusive":true,"to":"1.11.6","to_inclusive":true,"patched_in":"1.11.7"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T08:31:18Z"},{"id":"wordfence:9022b3b7-40c5-4d65-901f-bab5f78ccc34","source":"wordfence","cve":"CVE-2026-109698","title":"Mang Board <= 2.4.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9022b3b7-40c5-4d65-901f-bab5f78ccc34?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-10-13T11:09:38Z","updated":"2026-10-23T18:27:08Z"},{"id":"wordfence:9022b4d9-f076-41b1-8fdf-2752199aeca3","source":"wordfence","cve":"CVE-2025-30611","title":"Wptobe-signinup <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9022b4d9-f076-41b1-8fdf-2752199aeca3?source=api-prod","affected":[{"type":"plugin","slug":"wptobe-signinup","name":"Wptobe-signinup","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T20:56:09Z"},{"id":"wordfence:902312d2-8cd8-4e22-a5b8-d3ec50126cdb","source":"wordfence","cve":"CVE-2026-27048","title":"The Aisle Core <= 2.0.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/902312d2-8cd8-4e22-a5b8-d3ec50126cdb?source=api-prod","affected":[{"type":"plugin","slug":"theaisle-core","name":"The Aisle Core","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:02:36Z"},{"id":"wordfence:9026b417-4b35-4bec-9dc6-6797661dc7a8","source":"wordfence","cve":"CVE-2025-10694","title":"User Feedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9026b417-4b35-4bec-9dc6-6797661dc7a8?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-10-24T17:09:00Z","updated":"2025-10-25T05:31:25Z"},{"id":"wordfence:90284576-6570-4e4c-8eb3-743bc402ea1b","source":"wordfence","cve":"CVE-2024-4635","title":"Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90284576-6570-4e4c-8eb3-743bc402ea1b?source=api-prod","affected":[{"type":"plugin","slug":"menu-icons","name":"Menu Icons by Themeisle \u2013 Add Icons to Navigation Menus","from":"*","from_inclusive":true,"to":"0.13.13","to_inclusive":true,"patched_in":"0.13.14"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T05:33:28Z"},{"id":"wordfence:902c017d-c907-4335-9e1e-1d23580d9caf","source":"wordfence","cve":"CVE-2024-4753","title":"WP Secure Maintenance <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/902c017d-c907-4335-9e1e-1d23580d9caf?source=api-prod","affected":[{"type":"plugin","slug":"wp-secure-maintainance","name":"WP Secure Maintenance","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-21T15:33:01Z"},{"id":"wordfence:902c0c84-fcae-4ce4-9885-89fd135a4ffd","source":"wordfence","cve":"CVE-2024-0212","title":"Cloudflare <= 4.12.2 - Missing Authorization via initProxy","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/902c0c84-fcae-4ce4-9885-89fd135a4ffd?source=api-prod","affected":[{"type":"plugin","slug":"cloudflare","name":"Cloudflare","from":"*","from_inclusive":true,"to":"4.12.2","to_inclusive":true,"patched_in":"4.12.3"}],"published":"2024-01-04T00:00:00Z","updated":"2024-02-06T13:38:03Z"},{"id":"wordfence:902ec583-c072-4c6d-8250-ad08d7ecf239","source":"wordfence","cve":"CVE-2024-12177","title":"Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/902ec583-c072-4c6d-8250-ad08d7ecf239?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-alt-text-generator-for-wp","name":"Ai Image Alt Text Generator for WP","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-01-30T00:50:08Z","updated":"2025-01-30T16:40:14Z"},{"id":"wordfence:903161b0-b64c-4986-8c94-b90221bc911b","source":"wordfence","cve":"CVE-2023-49845","title":"Redirects <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/903161b0-b64c-4986-8c94-b90221bc911b?source=api-prod","affected":[{"type":"plugin","slug":"redirects","name":"Redirects","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9032d416-28d1-4fdc-ac95-ba807df165a2","source":"wordfence","cve":"CVE-2017-18537","title":"Visitors Online by BestWebSoft < 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9032d416-28d1-4fdc-ac95-ba807df165a2?source=api-prod","affected":[{"type":"plugin","slug":"visitors-online","name":"Visitors Online by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":false,"patched_in":"1.0.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90331fdc-6a44-4a35-941f-dd5717a7632b","source":"wordfence","cve":"CVE-2025-22564","title":"Pretty Url <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90331fdc-6a44-4a35-941f-dd5717a7632b?source=api-prod","affected":[{"type":"plugin","slug":"pretty-url","name":"Pretty Url","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-01-07T00:00:00Z","updated":"2026-02-26T15:04:07Z"},{"id":"wordfence:90333dc7-8bdf-4a59-8001-7eb76b4bc61d","source":"wordfence","cve":"CVE-2023-25490","title":"Archivist \u2013 Custom Archive Templates <= 1.7.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90333dc7-8bdf-4a59-8001-7eb76b4bc61d?source=api-prod","affected":[{"type":"plugin","slug":"archivist-custom-archive-templates","name":"Archivist \u2013 Custom Archive Templates","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90385cd2-e9c3-4e63-b536-418b66cb0919","source":"wordfence","cve":"CVE-2025-15656","title":"School Management <= 93.2.0 - Authenticated (Support Staff+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90385cd2-e9c3-4e63-b536-418b66cb0919?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-17T00:00:00Z","updated":"2026-08-21T13:27:55Z"},{"id":"wordfence:903abd7f-6bee-4d96-96c2-f09abbb2eefe","source":"wordfence","cve":"CVE-2022-50970","title":"Amazon Affiliate <= 3.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/903abd7f-6bee-4d96-96c2-f09abbb2eefe?source=api-prod","affected":[{"type":"plugin","slug":"aawp","name":"Amazon Affiliate","from":"*","from_inclusive":true,"to":"3.17","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2022-01-04T00:00:00Z","updated":"2026-07-29T21:16:02Z"},{"id":"wordfence:903eb0d5-9fb3-4c7b-898c-903ead241746","source":"wordfence","cve":"CVE-2026-94680","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/903eb0d5-9fb3-4c7b-898c-903ead241746?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-09-23T14:38:00Z","updated":"2026-09-29T20:06:54Z"},{"id":"wordfence:903f706c-4078-4c99-92e0-0f8ab27848f1","source":"wordfence","cve":"CVE-2026-39756","title":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment <= 2.7.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/903f706c-4078-4c99-92e0-0f8ab27848f1?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:54:42Z","updated":"2026-10-08T23:41:44Z"},{"id":"wordfence:90408242-562b-4dd7-aa65-eeeb60da178c","source":"wordfence","cve":"CVE-2026-82223","title":"Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90408242-562b-4dd7-aa65-eeeb60da178c?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"4.1.23"}],"published":"2026-09-01T00:00:00Z","updated":"2026-10-16T18:51:39Z"},{"id":"wordfence:9040aa36-2d3b-4470-93ae-19ad16fcd929","source":"wordfence","cve":"CVE-2022-2546","title":"All-in-One WP Migration <=  7.62 - Unauthenticated Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9040aa36-2d3b-4470-93ae-19ad16fcd929?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.62","to_inclusive":true,"patched_in":"7.63"}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9040e2bb-e30a-4e18-b486-76aa601ae888","source":"wordfence","cve":"CVE-2026-27400","title":"BookPro <= 1.1.0 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9040e2bb-e30a-4e18-b486-76aa601ae888?source=api-prod","affected":[{"type":"plugin","slug":"ovabookpro","name":"BookPro - Appointment Booking WordPress Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:09:46Z"},{"id":"wordfence:90411c04-8d5b-4d9d-9beb-ef8374b31bb3","source":"wordfence","cve":"CVE-2025-48237","title":"Wishlist for WooCommerce <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90411c04-8d5b-4d9d-9beb-ef8374b31bb3?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce","name":"Wishlist for WooCommerce: Multiple Wishlists per Customer","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:52:50Z"},{"id":"wordfence:904181bc-fd56-4296-9c59-532bbc272abd","source":"wordfence","cve":"CVE-2026-120114","title":"Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904181bc-fd56-4296-9c59-532bbc272abd?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-10-30T20:56:04Z","updated":"2026-10-31T09:29:27Z"},{"id":"wordfence:90465354-0174-4f85-a66b-589d9408c3c8","source":"wordfence","cve":"CVE-2024-22283","title":"Delhivery Logistics Courier <= 1.0.107 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90465354-0174-4f85-a66b-589d9408c3c8?source=api-prod","affected":[{"type":"plugin","slug":"delhivery-logistics-courier","name":"Delhivery Logistics Courier","from":"*","from_inclusive":true,"to":"1.0.107","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:904691f4-26fd-4065-b9c1-aacdd6b3b3ee","source":"wordfence","cve":"CVE-2026-74925","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 - 5.0.15 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904691f4-26fd-4065-b9c1-aacdd6b3b3ee?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"5.0.0","from_inclusive":true,"to":"5.0.15","to_inclusive":true,"patched_in":"5.0.16"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:21:05Z"},{"id":"wordfence:9046f2cd-f046-46ce-b91c-db9d036ab1fb","source":"wordfence","cve":"CVE-2025-53311","title":"Navayan Subscribe <= 1.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9046f2cd-f046-46ce-b91c-db9d036ab1fb?source=api-prod","affected":[{"type":"plugin","slug":"navayan-subscribe","name":"Navayan Subscribe","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:21:49Z"},{"id":"wordfence:9048eaa1-159f-4464-89da-fcd80b732f18","source":"wordfence","cve":"CVE-2026-32508","title":"Halstein < 1.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9048eaa1-159f-4464-89da-fcd80b732f18?source=api-prod","affected":[{"type":"theme","slug":"halstein","name":"Halstein - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:49:42Z"},{"id":"wordfence:9049ac31-b79a-4872-a522-2930fb1dfea6","source":"wordfence","cve":"CVE-2024-31304","title":"WC Marketplace <= 4.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9049ac31-b79a-4872-a522-2930fb1dfea6?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:38:17Z"},{"id":"wordfence:904a7751-fbf6-47a7-8b68-87f1f042c89c","source":"wordfence","cve":"CVE-2025-62051","title":"UDesign Core <= 4.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904a7751-fbf6-47a7-8b68-87f1f042c89c?source=api-prod","affected":[{"type":"plugin","slug":"u-design-core","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:50:03Z"},{"id":"wordfence:904b9aed-0bd6-414e-a347-3881188a04cf","source":"wordfence","cve":"CVE-2025-62735","title":"User Spam Remover <= 1.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904b9aed-0bd6-414e-a347-3881188a04cf?source=api-prod","affected":[{"type":"plugin","slug":"user-spam-remover","name":"User Spam Remover","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T15:39:41Z"},{"id":"wordfence:904ba3ec-efde-424c-a50b-2ce71ad91ca5","source":"wordfence","cve":"CVE-2025-3669","title":"Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904ba3ec-efde-424c-a50b-2ce71ad91ca5?source=api-prod","affected":[{"type":"plugin","slug":"supreme-addons-for-beaver-builder-lite","name":"Supreme Addons for Beaver Builder \u2013","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:52:24Z","updated":"2025-07-24T09:22:19Z"},{"id":"wordfence:904e407c-5ec7-433f-9161-eb4d6d263a97","source":"wordfence","cve":"CVE-2020-24063","title":"Canto <= 1.9.0 - Blind Server-Side Request Forgery via download.php","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904e407c-5ec7-433f-9161-eb4d6d263a97?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2020-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:904e9ac2-1f28-43ba-914c-3b4fd5a0bb22","source":"wordfence","cve":"CVE-2025-31034","title":"Customize Login Page <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904e9ac2-1f28-43ba-914c-3b4fd5a0bb22?source=api-prod","affected":[{"type":"plugin","slug":"customize-login-page","name":"Customize Login Page","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:28:07Z"},{"id":"wordfence:904f8881-1513-43b7-a9cf-1b81d8493b12","source":"wordfence","cve":"CVE-2014-4518","title":"Contact Form by ContactMe.com <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904f8881-1513-43b7-a9cf-1b81d8493b12?source=api-prod","affected":[{"type":"plugin","slug":"contactme","name":"Contact Form by ContactMe.com","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2015-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:904fbd97-244b-40f5-a57a-7c8cb15cb625","source":"wordfence","cve":"CVE-2026-89213","title":"Llavero.io <= 0.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/904fbd97-244b-40f5-a57a-7c8cb15cb625?source=api-prod","affected":[{"type":"plugin","slug":"llavero-io","name":"Llavero.io","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:20:07Z"},{"id":"wordfence:90503670-702f-4113-9887-61558bf7ea5c","source":"wordfence","cve":"CVE-2024-37474","title":"Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90503670-702f-4113-9887-61558bf7ea5c?source=api-prod","affected":[{"type":"plugin","slug":"newspack-ads","name":"Newspack Ads","from":"*","from_inclusive":true,"to":"1.47.1","to_inclusive":true,"patched_in":"1.47.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:10:30Z"},{"id":"wordfence:9052d3ab-d2b1-4d94-917e-f500a28b8137","source":"wordfence","cve":"CVE-2026-116405","title":"VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9052d3ab-d2b1-4d94-917e-f500a28b8137?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2026-10-30T08:27:18Z","updated":"2026-11-03T19:30:57Z"},{"id":"wordfence:9053995a-b1de-427f-b16d-31fa8cd026b2","source":"wordfence","cve":"CVE-2023-5956","title":"Wp-Adv-Quiz <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Title","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9053995a-b1de-427f-b16d-31fa8cd026b2?source=api-prod","affected":[{"type":"plugin","slug":"advanced-quiz","name":"Wp-Adv-Quiz","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-02-04T12:55:44Z"},{"id":"wordfence:9053cf91-0af1-44f8-9fdf-7ecbd457545b","source":"wordfence","cve":"CVE-2023-48326","title":"Events Manager <= 6.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9053cf91-0af1-44f8-9fdf-7ecbd457545b?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90552d5a-6103-48c7-ad44-52ee8ecac114","source":"wordfence","cve":"CVE-2025-12904","title":"SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90552d5a-6103-48c7-ad44-52ee8ecac114?source=api-prod","affected":[{"type":"plugin","slug":"h5pxapikatchu","name":"SNORDIAN's H5PxAPIkatchu","from":"*","from_inclusive":true,"to":"0.4.17","to_inclusive":true,"patched_in":"0.4.18"}],"published":"2025-11-13T13:59:40Z","updated":"2025-11-14T02:24:19Z"},{"id":"wordfence:90579442-b05c-459e-93cb-f4883b6472ff","source":"wordfence","cve":"CVE-2025-1512","title":"PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90579442-b05c-459e-93cb-f4883b6472ff?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T06:52:06Z"},{"id":"wordfence:9058bdd5-09cf-42e2-8edb-27f8acfb525f","source":"wordfence","cve":"CVE-2026-66483","title":"Education Center <= 3.6.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9058bdd5-09cf-42e2-8edb-27f8acfb525f?source=api-prod","affected":[{"type":"theme","slug":"education","name":"Education Center | LMS & Online Courses WordPress Theme","from":"*","from_inclusive":true,"to":"3.6.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:09:00Z"},{"id":"wordfence:905cb57b-70ec-4324-ae66-9c06d1737939","source":"wordfence","cve":"CVE-2023-25452","title":"CMS Press <= 0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/905cb57b-70ec-4324-ae66-9c06d1737939?source=api-prod","affected":[{"type":"plugin","slug":"cms-press","name":"CMS Press","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:905ced90-3a24-4dd6-b415-890804bb6f5b","source":"wordfence","cve":"CVE-2023-0099","title":"Simple URLs <= 114 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/905ced90-3a24-4dd6-b415-890804bb6f5b?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"114","to_inclusive":true,"patched_in":"115"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:906049c0-4710-47aa-bf44-cdf29032dc1f","source":"wordfence","cve":"CVE-2023-6934","title":"Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/906049c0-4710-47aa-bf44-cdf29032dc1f?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"2.25.26","to_inclusive":true,"patched_in":"2.25.27"}],"published":"2023-12-20T00:00:00Z","updated":"2024-07-29T21:36:51Z"},{"id":"wordfence:9060bb2a-b9d9-466d-bb8d-14173a51d145","source":"wordfence","cve":"CVE-2023-27632","title":"Daily Prayer Time <= 2023.03.08 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9060bb2a-b9d9-466d-bb8d-14173a51d145?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2023.03.08","to_inclusive":true,"patched_in":"2023.03.17"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90636bd7-df29-4536-ac1f-538283eaf82d","source":"wordfence","cve":"CVE-2026-106008","title":"FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90636bd7-df29-4536-ac1f-538283eaf82d?source=api-prod","affected":[{"type":"plugin","slug":"fraudlabs-pro-sms-verification","name":"FraudLabs Pro SMS Verification","from":"1.11.2","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:33:25Z"},{"id":"wordfence:90637d9c-88af-443e-aaa8-4ebcb65b3cef","source":"wordfence","cve":"CVE-2026-65452","title":"Ebook Store <= 6.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90637d9c-88af-443e-aaa8-4ebcb65b3cef?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"6.19","to_inclusive":true,"patched_in":"6.20"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:55:06Z"},{"id":"wordfence:90654fac-b9c7-422f-8472-2a7c7fd0de0d","source":"wordfence","cve":"CVE-2023-23885","title":"Quick Contact Form <= 8.0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90654fac-b9c7-422f-8472-2a7c7fd0de0d?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.0.3.1","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90689ba2-4f82-4116-85d7-1266189aa34e","source":"wordfence","cve":"CVE-2019-12498","title":"WP Live Chat Support <= 8.0.32 - Unprotected Functions","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90689ba2-4f82-4116-85d7-1266189aa34e?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.33","to_inclusive":false,"patched_in":"8.0.33"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:906ac214-2ec0-4f2f-8bd5-df2f642e43ee","source":"wordfence","cve":"CVE-2026-112327","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/906ac214-2ec0-4f2f-8bd5-df2f642e43ee?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":"2.4.12"}],"published":"2026-10-20T06:53:02Z","updated":"2026-10-23T18:50:36Z"},{"id":"wordfence:906dcf2a-6be1-4966-9a70-1ef9a8f1017d","source":"wordfence","cve":"CVE-2023-40329","title":"Custom Admin Login Page | WPZest <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/906dcf2a-6be1-4966-9a70-1ef9a8f1017d?source=api-prod","affected":[{"type":"plugin","slug":"custom-admin-login-styler-wpzest","name":"Custom Admin Login Page | WPZest","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:906e73a2-c05c-4a5e-b111-df3c1b05f8a5","source":"wordfence","cve":"CVE-2026-82220","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/906e73a2-c05c-4a5e-b111-df3c1b05f8a5?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.1","to_inclusive":true,"patched_in":"1.57.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T15:02:36Z"},{"id":"wordfence:90706a16-cd71-4040-ab0e-be8649110d3c","source":"wordfence","cve":"CVE-2022-3833","title":"Fancier Author Box by ThematoSoup <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90706a16-cd71-4040-ab0e-be8649110d3c?source=api-prod","affected":[{"type":"plugin","slug":"fancier-author-box","name":"Fancier Author Box by ThematoSoup","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9071acdf-8d40-4e8b-8d1f-be2cabf3d66e","source":"wordfence","cve":"CVE-2023-36690","title":"WPLMS  < 4.900 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9071acdf-8d40-4e8b-8d1f-be2cabf3d66e?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"4.900","to_inclusive":false,"patched_in":"4.900"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:907329af-2ff0-475e-b4b2-3ac7ae4b9ced","source":"wordfence","cve":"","title":"WP Post Statistics (Visitors & Visits Counter) <= 2.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/907329af-2ff0-475e-b4b2-3ac7ae4b9ced?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-real-time-statistics","name":"Real-Time Post Statistics for WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90752679-4b21-4db7-89f4-19a1b2adb914","source":"wordfence","cve":"CVE-2026-54823","title":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90752679-4b21-4db7-89f4-19a1b2adb914?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T14:10:02Z"},{"id":"wordfence:90752d8a-2e0c-4d46-8a49-778fe06361bd","source":"wordfence","cve":"CVE-2024-35648","title":"Emergency Password Reset <= 8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90752d8a-2e0c-4d46-8a49-778fe06361bd?source=api-prod","affected":[{"type":"plugin","slug":"emergency-password-reset","name":"Emergency password reset","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":"9.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:53:34Z"},{"id":"wordfence:9075a705-e72f-4331-ab8f-bb06e1a58225","source":"wordfence","cve":"CVE-2025-53315","title":"Relocate Upload <= 0.24.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9075a705-e72f-4331-ab8f-bb06e1a58225?source=api-prod","affected":[{"type":"plugin","slug":"relocate-upload","name":"Relocate Upload","from":"*","from_inclusive":true,"to":"0.24.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:23:20Z"},{"id":"wordfence:90775c17-4cd5-47e5-afa9-9413988b8638","source":"wordfence","cve":"CVE-2025-63017","title":"WerkStatt <= 1.6.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90775c17-4cd5-47e5-afa9-9413988b8638?source=api-prod","affected":[{"type":"plugin","slug":"werkstatt-plugin","name":"Werkstatt","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2025-11-30T00:00:00Z","updated":"2026-02-26T15:21:50Z"},{"id":"wordfence:9077bdce-31c9-4877-8bb5-db87046125cc","source":"wordfence","cve":"CVE-2022-1421","title":"Discy <= 5.1 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9077bdce-31c9-4877-8bb5-db87046125cc?source=api-prod","affected":[{"type":"theme","slug":"discy","name":"Discy - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90783d75-a255-4133-ac7b-32e0a70c8c69","source":"wordfence","cve":"CVE-2026-8787","title":"Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90783d75-a255-4133-ac7b-32e0a70c8c69?source=api-prod","affected":[{"type":"plugin","slug":"admin-chat-box","name":"Admin Chat Management","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-05-26T17:20:41Z","updated":"2026-06-10T13:28:43Z"},{"id":"wordfence:9079f511-c53d-4721-b975-929a81df8d92","source":"wordfence","cve":"CVE-2025-67569","title":"AdForest <= 6.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9079f511-c53d-4721-b975-929a81df8d92?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T16:09:31Z"},{"id":"wordfence:907a02b8-6965-4d0b-b4bf-c8fc0201ee12","source":"wordfence","cve":"CVE-2017-1002007","title":"DTracker <= 1.5 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/907a02b8-6965-4d0b-b4bf-c8fc0201ee12?source=api-prod","affected":[{"type":"plugin","slug":"dtracker","name":"DTracker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9080542f-9c42-439b-b4da-b25f67f2aa97","source":"wordfence","cve":"CVE-2025-7808","title":"WP Shopify <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9080542f-9c42-439b-b4da-b25f67f2aa97?source=api-prod","affected":[{"type":"plugin","slug":"wp-shopify","name":"External Store for Shopify","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-07-24T00:00:00Z","updated":"2025-08-25T15:46:48Z"},{"id":"wordfence:9080d53b-8eb9-492a-8203-2928dcd81b9a","source":"wordfence","cve":"CVE-2026-17005","title":"Horizontal Scrolling Announcements <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9080d53b-8eb9-492a-8203-2928dcd81b9a?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-scrolling-announcements","name":"Horizontal scrolling announcements","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:18:17Z"},{"id":"wordfence:9082adc5-508d-47ac-a74a-868e2600e3d6","source":"wordfence","cve":"CVE-2026-40308","title":"My Calendar < 3.7.7 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9082adc5-508d-47ac-a74a-868e2600e3d6?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":false,"patched_in":"3.7.7"}],"published":"2026-04-16T00:00:00Z","updated":"2026-07-30T17:49:28Z"},{"id":"wordfence:9083d875-ff86-4f18-ad63-368bcb269ad9","source":"wordfence","cve":"CVE-2017-1000434","title":"furikake <= 0.1.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9083d875-ff86-4f18-ad63-368bcb269ad9?source=api-prod","affected":[{"type":"plugin","slug":"furikake","name":"furikake","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":"0.1.1"}],"published":"2018-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9085b3b8-ee5e-455c-af39-1cb674a44f61","source":"wordfence","cve":"CVE-2025-67949","title":"Hostiko < 94.3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9085b3b8-ee5e-455c-af39-1cb674a44f61?source=api-prod","affected":[{"type":"theme","slug":"hostiko","name":"Hostiko - Hosting WordPress & WHMCS Theme","from":"*","from_inclusive":true,"to":"94.3.6","to_inclusive":false,"patched_in":"94.3.6"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:16:23Z"},{"id":"wordfence:90863334-9464-466b-bb32-870c78095ca4","source":"wordfence","cve":"CVE-2024-32773","title":"Royal Elementor Kit <= 1.0.116 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90863334-9464-466b-bb32-870c78095ca4?source=api-prod","affected":[{"type":"theme","slug":"royal-elementor-kit","name":"Royal Elementor Kit","from":"*","from_inclusive":true,"to":"1.0.116","to_inclusive":true,"patched_in":"1.0.117"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:22:51Z"},{"id":"wordfence:90867c8b-a025-4c46-986f-9e83866033b5","source":"wordfence","cve":"CVE-2025-46258","title":"Element Pack Pro <= 7.21.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90867c8b-a025-4c46-986f-9e83866033b5?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack","name":"Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin","from":"*","from_inclusive":true,"to":"7.21.0","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-05-16T00:00:00Z","updated":"2025-06-05T18:06:40Z"},{"id":"wordfence:9087b16e-488b-431d-a7f7-ab0d49520756","source":"wordfence","cve":"CVE-2021-24464","title":"YouTube Embed, Playlist and Popup <= 2.3.8 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9087b16e-488b-431d-a7f7-ab0d49520756?source=api-prod","affected":[{"type":"plugin","slug":"youtube-video-player","name":"YouTube Embed, Playlist and Popup by WpDevArt","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":false,"patched_in":"2.3.9"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:908c9c83-545d-40df-b7dc-4132359d675b","source":"wordfence","cve":"CVE-2026-65566","title":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.8.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/908c9c83-545d-40df-b7dc-4132359d675b?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2026-10-30T16:15:00Z","updated":"2026-11-03T20:10:24Z"},{"id":"wordfence:908dbe64-e214-4880-a85d-38df4c722a43","source":"wordfence","cve":"","title":"Dagda Theme <= 5.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/908dbe64-e214-4880-a85d-38df4c722a43?source=api-prod","affected":[{"type":"theme","slug":"dagda","name":"dagda","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2012-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:908df18e-7178-4d40-becb-86e1a714a7da","source":"wordfence","cve":"CVE-2024-7727","title":"HTML5 Video Player \u2013 mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/908df18e-7178-4d40-becb-86e1a714a7da?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.32","to_inclusive":true,"patched_in":"2.5.33"}],"published":"2024-09-10T00:00:00Z","updated":"2024-09-11T04:31:22Z"},{"id":"wordfence:908e4755-e439-4714-b0cb-3fc546c5ac63","source":"wordfence","cve":"CVE-2024-43307","title":"Structured Content <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/908e4755-e439-4714-b0cb-3fc546c5ac63?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-03T16:38:11Z"},{"id":"wordfence:908ef8e1-d4dc-4348-90b8-d8f38666d9ed","source":"wordfence","cve":"CVE-2024-3472","title":"Modal Window \u2013 create popup modal window <= 5.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/908ef8e1-d4dc-4348-90b8-d8f38666d9ed?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"5.3.9","to_inclusive":true,"patched_in":"5.3.10"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:03:54Z"},{"id":"wordfence:9090f6b4-a47b-44e0-8efe-b53211b39460","source":"wordfence","cve":"CVE-2024-51857","title":"Olympus Shortcodes <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9090f6b4-a47b-44e0-8efe-b53211b39460?source=api-prod","affected":[{"type":"plugin","slug":"olympus-shortcodes","name":"Olympus Shortcodes","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:47:45Z"},{"id":"wordfence:90920df9-1362-466b-b14b-4714087f556b","source":"wordfence","cve":"CVE-2025-15057","title":"SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90920df9-1362-466b-b14b-4714087f556b?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2026-01-08T18:00:57Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:9095bf69-e682-48aa-b206-8bd2b6c2b170","source":"wordfence","cve":"","title":"Sermon Browser < 0.43.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9095bf69-e682-48aa-b206-8bd2b6c2b170?source=api-prod","affected":[{"type":"plugin","slug":"sermon-browser","name":"Sermon Browser","from":"*","from_inclusive":true,"to":"0.43.6","to_inclusive":false,"patched_in":"0.43.6"}],"published":"2011-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9099d421-3407-45c3-a1f3-1e1084ec65cb","source":"wordfence","cve":"CVE-2025-10638","title":"NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9099d421-3407-45c3-a1f3-1e1084ec65cb?source=api-prod","affected":[{"type":"plugin","slug":"ns-maintenance-mode-for-wp","name":"NS Maintenance Mode for WP","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-29T15:39:59Z"},{"id":"wordfence:909afec0-7ff5-430d-814d-d75fcfcd6232","source":"wordfence","cve":"CVE-2025-11869","title":"Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/909afec0-7ff5-430d-814d-d75fcfcd6232?source=api-prod","affected":[{"type":"plugin","slug":"precise-columns","name":"Precise Columns","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:10:41Z","updated":"2025-11-11T03:30:45Z"},{"id":"wordfence:909b5421-210d-427a-94a0-e1ea25880cec","source":"wordfence","cve":"CVE-2023-0816","title":"Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header","severity":"medium","cvss":5.3,"cwe":"CWE-807","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/909b5421-210d-427a-94a0-e1ea25880cec?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.1"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:909beed4-06a9-4ec4-bf00-4072a38af82b","source":"wordfence","cve":"CVE-2024-11782","title":"WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/909beed4-06a9-4ec4-bf00-4072a38af82b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.17.0","to_inclusive":true,"patched_in":"1.8.18.0"}],"published":"2024-12-02T20:47:11Z","updated":"2024-12-03T09:32:02Z"},{"id":"wordfence:909d9b9b-78da-41c0-87bc-54730f452bff","source":"wordfence","cve":"CVE-2025-28986","title":"Epicwin Plugin <= 1.5 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/909d9b9b-78da-41c0-87bc-54730f452bff?source=api-prod","affected":[{"type":"plugin","slug":"epicwin-subscribers","name":"Epicwin Plugin","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:11:14Z"},{"id":"wordfence:90a5589f-f0e9-4511-9c5e-0afcee0824d5","source":"wordfence","cve":"CVE-2026-1558","title":"WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90a5589f-f0e9-4511-9c5e-0afcee0824d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.3.2","to_inclusive":true,"patched_in":"10.3.3"}],"published":"2026-02-26T15:59:49Z","updated":"2026-02-27T04:33:04Z"},{"id":"wordfence:90a8230f-7008-48af-a1a9-fbaf38dcb21c","source":"wordfence","cve":"CVE-2023-46211","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90a8230f-7008-48af-a1a9-fbaf38dcb21c?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.14","to_inclusive":true,"patched_in":"3.19.15"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90a868a3-051e-4a01-8367-a4e16fb2ccc2","source":"wordfence","cve":"CVE-2026-112839","title":"Customer Coupons for WooCommerce <= 1.3.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90a868a3-051e-4a01-8367-a4e16fb2ccc2?source=api-prod","affected":[{"type":"plugin","slug":"woo-customer-coupons","name":"Customer Coupons for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2026-10-26T17:28:00Z","updated":"2026-10-28T01:16:50Z"},{"id":"wordfence:90a97e6e-629b-4640-b930-ca06f79276e2","source":"wordfence","cve":"CVE-2026-105190","title":"Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90a97e6e-629b-4640-b930-ca06f79276e2?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T19:30:18Z"},{"id":"wordfence:90ab885e-b4df-4774-96e0-53cff569713a","source":"wordfence","cve":"CVE-2026-25387","title":"Image Optimizer by Elementor <= 1.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ab885e-b4df-4774-96e0-53cff569713a?source=api-prod","affected":[{"type":"plugin","slug":"image-optimization","name":"Image Optimizer \u2013 Compress Images and Convert to WebP or AVIF","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-02-20T00:00:00Z","updated":"2026-02-24T19:19:28Z"},{"id":"wordfence:90b015c7-c41e-4387-80af-d9067bb661d3","source":"wordfence","cve":"CVE-2025-60230","title":"The Barber Shop <= 1.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b015c7-c41e-4387-80af-d9067bb661d3?source=api-prod","affected":[{"type":"theme","slug":"nrgbarbershop","name":"nrgbarbershop","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2026-09-18T14:37:25Z"},{"id":"wordfence:90b06fe3-a57b-4ba0-a976-c630e69e3d04","source":"wordfence","cve":"CVE-2025-50040","title":"CF7 Spreadsheets <= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b06fe3-a57b-4ba0-a976-c630e69e3d04?source=api-prod","affected":[{"type":"plugin","slug":"cf7-spreadsheets","name":"CF7 Spreadsheets","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-18T15:48:52Z"},{"id":"wordfence:90b11be6-ae6c-4155-87a2-0d106eec264a","source":"wordfence","cve":"CVE-2025-24774","title":"WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b11be6-ae6c-4155-87a2-0d106eec264a?source=api-prod","affected":[{"type":"plugin","slug":"wpcrm","name":"WPCRM - CRM for Contact form CF7 & WooCommerce","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:32:31Z"},{"id":"wordfence:90b2a644-19a0-43a1-8ff6-7486d7ef29b3","source":"wordfence","cve":"CVE-2026-0555","title":"Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b2a644-19a0-43a1-8ff6-7486d7ef29b3?source=api-prod","affected":[{"type":"plugin","slug":"premmerce","name":"Premmerce","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2026-02-06T20:25:58Z","updated":"2026-02-25T15:58:31Z"},{"id":"wordfence:90b7fa47-ca32-41a6-ae9c-e15f361c6398","source":"wordfence","cve":"CVE-2026-32373","title":"SMS Alert Order Notifications <= 3.9.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b7fa47-ca32-41a6-ae9c-e15f361c6398?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:52:44Z"},{"id":"wordfence:90b97e57-a021-462c-b3d2-49cf959950dd","source":"wordfence","cve":"CVE-2020-9019","title":"WPJobBoard <= 5.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b97e57-a021-462c-b3d2-49cf959950dd?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2020-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90b991f7-d936-44f2-8b9c-155b6af5e898","source":"wordfence","cve":"CVE-2025-58805","title":"Widgetize Pages Light <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90b991f7-d936-44f2-8b9c-155b6af5e898?source=api-prod","affected":[{"type":"plugin","slug":"widgetize-pages-light","name":"Widgetize Pages Light","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T22:09:14Z"},{"id":"wordfence:90bab2a1-7c19-45d2-909f-05014fb24740","source":"wordfence","cve":"CVE-2013-2699","title":"underConstruction < 1.09 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90bab2a1-7c19-45d2-909f-05014fb24740?source=api-prod","affected":[{"type":"plugin","slug":"underconstruction","name":"underConstruction","from":"*","from_inclusive":true,"to":"1.09","to_inclusive":false,"patched_in":"1.09"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90bf79b5-b3d2-44ab-8d90-847e2b6703f1","source":"wordfence","cve":"CVE-2026-97298","title":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.86 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90bf79b5-b3d2-44ab-8d90-847e2b6703f1?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.86","to_inclusive":true,"patched_in":"51.1.87"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:27:11Z"},{"id":"wordfence:90c0be4a-1146-4a17-918e-ed5362bde022","source":"wordfence","cve":"CVE-2024-32826","title":"VK Block Patterns <= 1.31.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c0be4a-1146-4a17-918e-ed5362bde022?source=api-prod","affected":[{"type":"plugin","slug":"vk-block-patterns","name":"VK Block Patterns","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:39:00Z"},{"id":"wordfence:90c0e937-19fd-484e-a50f-42b00a6eeb30","source":"wordfence","cve":"","title":"Moosend Website Connector <= 1.0.189 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c0e937-19fd-484e-a50f-42b00a6eeb30?source=api-prod","affected":[{"type":"plugin","slug":"moosend-email-marketing","name":"Moosend Website Connector","from":"*","from_inclusive":true,"to":"1.0.189","to_inclusive":true,"patched_in":"1.0.190"}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90c0eb3e-b3f1-483c-9afd-2bbc4ff0cdf3","source":"wordfence","cve":"CVE-2022-1321","title":"miniOrange's Google Authenticator <= 5.5.5 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c0eb3e-b3f1-483c-9afd-2bbc4ff0cdf3?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":"5.5.6"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90c1fd9c-eb5c-45fb-b641-75cb3fdad87a","source":"wordfence","cve":"CVE-2023-24383","title":"Namaste! LMS <= 2.5.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c1fd9c-eb5c-45fb-b641-75cb3fdad87a?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.5.9.2","to_inclusive":false,"patched_in":"2.5.9.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90c34a01-a0d1-4305-b74b-b5a568a42b13","source":"wordfence","cve":"CVE-2024-2542","title":"Jotform Online Forms  <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c34a01-a0d1-4305-b74b-b5a568a42b13?source=api-prod","affected":[{"type":"plugin","slug":"embed-form","name":"Online Forms \u2014 Customizable Payment, Contact, Quiz, Survey Form Builder \u2013 Jotform","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-31T15:30:47Z"},{"id":"wordfence:90c3f8bc-fc41-4ba7-b9f2-8873203d5794","source":"wordfence","cve":"CVE-2020-36835","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.35 - Sensitive Information Disclosure","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c3f8bc-fc41-4ba7-b9f2-8873203d5794?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.36","to_inclusive":false,"patched_in":"0.9.36"}],"published":"2020-03-23T00:00:00Z","updated":"2024-10-16T06:43:36Z"},{"id":"wordfence:90c4441e-3578-4bb0-befe-cfedcb5c1a71","source":"wordfence","cve":"CVE-2026-66702","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c4441e-3578-4bb0-befe-cfedcb5c1a71?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.274.1","to_inclusive":true,"patched_in":"1.0.275"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:36:07Z"},{"id":"wordfence:90c6fd67-2140-4835-98d0-cfd1af95ac4c","source":"wordfence","cve":"CVE-2024-12103","title":"Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c6fd67-2140-4835-98d0-cfd1af95ac4c?source=api-prod","affected":[{"type":"plugin","slug":"content-no-cache","name":"Content No Cache | Serve uncached partial content even when you add it to a page that is fully cached.","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":"0.1.3"}],"published":"2024-12-23T20:43:35Z","updated":"2024-12-24T09:22:23Z"},{"id":"wordfence:90c71b01-f82e-4f06-b1c9-6a2a5618a744","source":"wordfence","cve":"CVE-2025-28866","title":"Login Logger <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c71b01-f82e-4f06-b1c9-6a2a5618a744?source=api-prod","affected":[{"type":"plugin","slug":"login-logger","name":"Login Logger","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:19:37Z"},{"id":"wordfence:90c774a5-e315-4671-a21b-ccfd1b1346ac","source":"wordfence","cve":"CVE-2026-11562","title":"WS Form LITE <= 1.11.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c774a5-e315-4671-a21b-ccfd1b1346ac?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.11.7","to_inclusive":true,"patched_in":"1.11.8"}],"published":"2026-07-10T00:00:00Z","updated":"2026-08-21T13:52:06Z"},{"id":"wordfence:90c88379-e87f-4c32-af2b-83704cb14e29","source":"wordfence","cve":"CVE-2025-23981","title":"CarZine <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90c88379-e87f-4c32-af2b-83704cb14e29?source=api-prod","affected":[{"type":"theme","slug":"carzine","name":"CarZine","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T15:08:39Z"},{"id":"wordfence:90cd3722-c3cb-4ac3-871d-cacda49be294","source":"wordfence","cve":"CVE-2018-5367","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][post]","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90cd3722-c3cb-4ac3-871d-cacda49be294?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90ce0f70-d3a2-48cb-b6f8-7dda7ac25866","source":"wordfence","cve":"CVE-2011-3861","title":"Web Minimalist 200901 <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ce0f70-d3a2-48cb-b6f8-7dda7ac25866?source=api-prod","affected":[{"type":"theme","slug":"web-minimalist-200901","name":"Web Minimalist 200901","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90d0b748-a56a-4932-8e43-751ca363725c","source":"wordfence","cve":"CVE-2024-56249","title":"WPMasterToolKit <= 1.13.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d0b748-a56a-4932-8e43-751ca363725c?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.14.0"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:39:32Z"},{"id":"wordfence:90d114c1-61e5-4d2b-9311-0c9c9ad3b888","source":"wordfence","cve":"CVE-2026-122037","title":"AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d114c1-61e5-4d2b-9311-0c9c9ad3b888?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jne","name":"AgenWebsite Shipping \u2013 Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia","from":"*","from_inclusive":true,"to":"9.2.41","to_inclusive":true,"patched_in":"9.2.42"}],"published":"2026-11-06T18:23:51Z","updated":"2026-11-07T06:39:38Z"},{"id":"wordfence:90d1baf1-2c65-4bdf-958d-001dcfe04d7f","source":"wordfence","cve":"CVE-2024-43349","title":"All Bootstrap Blocks <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d1baf1-2c65-4bdf-958d-001dcfe04d7f?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-26T17:09:45Z"},{"id":"wordfence:90d203b1-9426-4eff-b566-02c8a1c6adfa","source":"wordfence","cve":"CVE-2025-12826","title":"Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification","severity":"medium","cvss":4.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d203b1-9426-4eff-b566-02c8a1c6adfa?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-ui","name":"Custom Post Type UI","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"}],"published":"2025-12-03T18:13:21Z","updated":"2025-12-04T06:48:42Z"},{"id":"wordfence:90d23f3a-a67d-4f92-9ca8-926569b72a71","source":"wordfence","cve":"CVE-2024-49259","title":"Primary Addon for Elementor <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d23f3a-a67d-4f92-9ca8-926569b72a71?source=api-prod","affected":[{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:08:39Z"},{"id":"wordfence:90d40b66-e178-4f2b-beb3-9e45269abaea","source":"wordfence","cve":"CVE-2026-40733","title":"ShiftUp <= 1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d40b66-e178-4f2b-beb3-9e45269abaea?source=api-prod","affected":[{"type":"theme","slug":"shiftup","name":"ShiftUp - Car Repair & Auto Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:10:24Z"},{"id":"wordfence:90d4d8c8-ccc1-46f8-bbf5-6aabaacc9d79","source":"wordfence","cve":"CVE-2024-37514","title":"CopySafe Web Protection <= 3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d4d8c8-ccc1-46f8-bbf5-6aabaacc9d79?source=api-prod","affected":[{"type":"plugin","slug":"wp-copysafe-web","name":"CopySafe Web Protection \u2013 Copy Protect Images","from":"*","from_inclusive":true,"to":"3.14","to_inclusive":true,"patched_in":"3.15"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T20:48:59Z"},{"id":"wordfence:90d8e345-b549-493b-a84b-abe56ab42a04","source":"wordfence","cve":"CVE-2026-3477","title":"PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90d8e345-b549-493b-a84b-abe56ab42a04?source=api-prod","affected":[{"type":"plugin","slug":"pz-frontend-manager","name":"PZ Frontend Manager","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:39:02Z","updated":"2026-04-08T06:43:41Z"},{"id":"wordfence:90de88d4-5cd0-4dc9-add1-563bb030e4a6","source":"wordfence","cve":"CVE-2025-54034","title":"Newsletters <= 4.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90de88d4-5cd0-4dc9-add1-563bb030e4a6?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.10","to_inclusive":true,"patched_in":"4.11"}],"published":"2025-07-29T00:00:00Z","updated":"2025-08-04T21:31:18Z"},{"id":"wordfence:90e24dba-e251-476e-87b8-c8df1e4317d4","source":"wordfence","cve":"CVE-2025-9877","title":"Embed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e24dba-e251-476e-87b8-c8df1e4317d4?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-data-studio","name":"Embed Google Datastudio","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T14:48:39Z","updated":"2025-09-12T03:22:44Z"},{"id":"wordfence:90e39398-19d7-435d-b23f-e93b8cdbcae4","source":"wordfence","cve":"CVE-2026-15395","title":"Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e39398-19d7-435d-b23f-e93b8cdbcae4?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2026-07-16T14:00:19Z","updated":"2026-07-17T02:31:32Z"},{"id":"wordfence:90e420be-fe6e-4a35-9c06-f0d360c9f9bf","source":"wordfence","cve":"CVE-2025-2808","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e420be-fe6e-4a35-9c06-f0d360c9f9bf?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.63","to_inclusive":true,"patched_in":"1.4.64"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T09:21:21Z"},{"id":"wordfence:90e462ef-053e-4590-b94c-05f21d047b85","source":"wordfence","cve":"CVE-2026-121875","title":"Post Duplicator < 3.0.18 - Authenticated (Administrator+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e462ef-053e-4590-b94c-05f21d047b85?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":false,"patched_in":"3.0.18"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:10:01Z"},{"id":"wordfence:90e4fb13-e007-4278-aee4-c61b6612544d","source":"wordfence","cve":"CVE-2025-68525","title":"Category Icon <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e4fb13-e007-4278-aee4-c61b6612544d?source=api-prod","affected":[{"type":"plugin","slug":"category-icon","name":"Category Icon","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T18:48:01Z"},{"id":"wordfence:90e69e43-597c-4c18-b581-d99dacefb9b8","source":"wordfence","cve":"CVE-2023-44994","title":"ShortCodes UI <= 1.9.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e69e43-597c-4c18-b581-d99dacefb9b8?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ui","name":"ShortCodes UI","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90e736ee-f159-4da8-8336-6187b8e26c53","source":"wordfence","cve":"CVE-2026-10834","title":"Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File Move","severity":"medium","cvss":4.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e736ee-f159-4da8-8336-6187b8e26c53?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-06-16T00:00:00Z","updated":"2026-09-17T15:05:54Z"},{"id":"wordfence:90e7951b-3834-48a3-8a40-2b6055d1b62c","source":"wordfence","cve":"CVE-2015-9359","title":"Jetpack <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e7951b-3834-48a3-8a40-2b6055d1b62c?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":false,"patched_in":"3.4.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-08-15T18:19:01Z"},{"id":"wordfence:90e8a6e1-438b-432b-8d01-ca494e307079","source":"wordfence","cve":"CVE-2025-58271","title":"AnyClip Luminous Studio <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90e8a6e1-438b-432b-8d01-ca494e307079?source=api-prod","affected":[{"type":"plugin","slug":"anyclip-media","name":"AnyClip Luminous Studio","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:27Z"},{"id":"wordfence:90ea439b-48a6-4b21-a277-35db458e5a7a","source":"wordfence","cve":"CVE-2026-57741","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ea439b-48a6-4b21-a277-35db458e5a7a?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.0","to_inclusive":true,"patched_in":"10.11.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:55:30Z"},{"id":"wordfence:90ea5c51-e739-42c1-a276-851ad800ff00","source":"wordfence","cve":"CVE-2026-17506","title":"Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ea5c51-e739-42c1-a276-851ad800ff00?source=api-prod","affected":[{"type":"plugin","slug":"independent-analytics","name":"Independent Analytics \u2013 WordPress Analytics Plugin","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"}],"published":"2026-08-04T16:10:27Z","updated":"2026-08-05T13:26:42Z"},{"id":"wordfence:90ebe593-6511-4998-a45e-795f3597b191","source":"wordfence","cve":"CVE-2021-24561","title":"WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ebe593-6511-4998-a45e-795f3597b191?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"5.4.13","to_inclusive":false,"patched_in":"5.4.13"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90ec6c64-f2c6-483e-9d8b-25e65ccb4a90","source":"wordfence","cve":"CVE-2025-12671","title":"WP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90ec6c64-f2c6-483e-9d8b-25e65ccb4a90?source=api-prod","affected":[{"type":"plugin","slug":"wp-iconics","name":"WP-Iconics","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:25:43Z","updated":"2025-11-11T03:30:46Z"},{"id":"wordfence:90edb2f1-0203-4f31-be13-cac21d156920","source":"wordfence","cve":"CVE-2025-26537","title":"GDPR Tools <= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90edb2f1-0203-4f31-be13-cac21d156920?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-tools","name":"GDPR Tools","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:14:05Z"},{"id":"wordfence:90f40820-b854-4aaf-a17e-699fd06b2de9","source":"wordfence","cve":"CVE-2025-46464","title":"Ads Pro Plugin <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f40820-b854-4aaf-a17e-699fd06b2de9?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-04-01T18:48:39Z"},{"id":"wordfence:90f523ff-4acf-4888-8dd7-5f1270030305","source":"wordfence","cve":"CVE-2026-107887","title":"Advanced Twenty Seventeen <= 1.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f523ff-4acf-4888-8dd7-5f1270030305?source=api-prod","affected":[{"type":"plugin","slug":"advanced-twenty-seventeen","name":"Advanced Twenty Seventeen","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T01:14:28Z"},{"id":"wordfence:90f62ee2-f2a8-49e6-ba7a-8c408c66c456","source":"wordfence","cve":"CVE-2024-43158","title":"Masteriyo - LMS <= 1.11.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f62ee2-f2a8-49e6-ba7a-8c408c66c456?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:49:24Z"},{"id":"wordfence:90f63303-32a1-472a-830a-1d165b134360","source":"wordfence","cve":"CVE-2025-68877","title":"CedCommerce Integration for Good Market <= 1.0.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f63303-32a1-472a-830a-1d165b134360?source=api-prod","affected":[{"type":"plugin","slug":"ced-good-market-integration","name":"CedCommerce Integration for Good Market","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T18:59:59Z"},{"id":"wordfence:90f74376-07b2-4d4c-8d7b-35b92de1adf6","source":"wordfence","cve":"CVE-2024-13632","title":"WP Extra Fields <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f74376-07b2-4d4c-8d7b-35b92de1adf6?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra-fields","name":"WP Extra Fields","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:30:03Z"},{"id":"wordfence:90f96795-8df7-4388-b58e-fc3611bc215c","source":"wordfence","cve":"CVE-2021-24202","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90f96795-8df7-4388-b58e-fc3611bc215c?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"0.1.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:90fdf5ca-f310-4e03-9662-dcaa68f90ea1","source":"wordfence","cve":"CVE-2025-52762","title":"flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90fdf5ca-f310-4e03-9662-dcaa68f90ea1?source=api-prod","affected":[{"type":"plugin","slug":"flexo-posts-manager","name":"flexo-posts-manager","from":"*","from_inclusive":true,"to":"1.0001","to_inclusive":true,"patched_in":""}],"published":"2025-06-14T14:20:33Z","updated":"2026-02-02T20:57:23Z"},{"id":"wordfence:90fe067f-ecd5-4d73-821b-31549dcb0d03","source":"wordfence","cve":"CVE-2025-60050","title":"Panda <= 1.21 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90fe067f-ecd5-4d73-821b-31549dcb0d03?source=api-prod","affected":[{"type":"theme","slug":"panda","name":"Panda - Digital Marketing & Adveritsing WordPressTheme","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:38:51Z"},{"id":"wordfence:91019c36-bf33-4cd6-ac54-86c118d086fe","source":"wordfence","cve":"CVE-2024-13385","title":"JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91019c36-bf33-4cd6-ac54-86c118d086fe?source=api-prod","affected":[{"type":"plugin","slug":"screenshot-machine-shortcode","name":"JSM Screenshot Machine Shortcode","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:09Z"},{"id":"wordfence:91021b7f-06d1-4403-81bd-ba082685e58e","source":"wordfence","cve":"CVE-2012-6499","title":"Age Verification <= 0.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91021b7f-06d1-4403-81bd-ba082685e58e?source=api-prod","affected":[{"type":"plugin","slug":"age-verification","name":"Age Verification","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":"0.5"}],"published":"2012-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9102ecd8-4860-4521-be34-bfcc91408c0c","source":"wordfence","cve":"CVE-2025-22623","title":"Ad Inserter - Ad Manager and AdSense Ads  <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9102ecd8-4860-4521-be34-bfcc91408c0c?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-03-05T00:00:00Z","updated":"2025-03-14T17:29:27Z"},{"id":"wordfence:9102fe7e-7baa-4bc0-879f-cc7df1ea13d2","source":"wordfence","cve":"CVE-2025-14508","title":"MediaCommander \u2013 Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9102fe7e-7baa-4bc0-879f-cc7df1ea13d2?source=api-prod","affected":[{"type":"plugin","slug":"mediacommander","name":"MediaCommander \u2013 Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-12-12T16:18:08Z","updated":"2025-12-13T04:31:29Z"},{"id":"wordfence:9103c67c-d75f-469d-94f1-ce7877384417","source":"wordfence","cve":"CVE-2014-4531","title":"Game Tabs <= 0.4.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9103c67c-d75f-469d-94f1-ce7877384417?source=api-prod","affected":[{"type":"plugin","slug":"game-tabs","name":"Game tabs","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2014-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9104e7df-1a7b-491f-9b51-25467004d8ca","source":"wordfence","cve":"CVE-2025-48146","title":"SEO Flow by LupsOnline <= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9104e7df-1a7b-491f-9b51-25467004d8ca?source=api-prod","affected":[{"type":"plugin","slug":"lupsonline-link-netwerk","name":"SEO Flow by LupsOnline","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-25T14:27:27Z"},{"id":"wordfence:91062d2c-f2a6-4a92-b684-e133391afe60","source":"wordfence","cve":"CVE-2023-0498","title":"WP Education <= 1.2.6 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91062d2c-f2a6-4a92-b684-e133391afe60?source=api-prod","affected":[{"type":"plugin","slug":"wp-education","name":"WP Education \u2013 Education WordPress Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:910902ab-8bd4-42b8-bd60-dce973e80ee5","source":"wordfence","cve":"CVE-2024-49651","title":"WooCommerce Maintenance Mode <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910902ab-8bd4-42b8-bd60-dce973e80ee5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-maintenance-mode","name":"WooCommerce Maintenance Mode (Free)","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:14:18Z"},{"id":"wordfence:910a877d-384f-46a3-b90d-bc56543caa03","source":"wordfence","cve":"CVE-2024-5020","title":"Thumbnail Slider With Lightbox <= 1.0.21 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910a877d-384f-46a3-b90d-bc56543caa03?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2025-11-11T00:00:00Z","updated":"2025-11-11T21:05:23Z"},{"id":"wordfence:910c0a32-b169-4728-888c-0dfea2066c9c","source":"wordfence","cve":"CVE-2024-4360","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910c0a32-b169-4728-888c-0dfea2066c9c?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2024-08-08T00:00:00Z","updated":"2024-09-03T20:50:56Z"},{"id":"wordfence:910c3d74-63ed-476d-b014-659d7780260f","source":"wordfence","cve":"CVE-2018-5658","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910c3d74-63ed-476d-b014-659d7780260f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:910cf7bd-1c2b-4e08-9088-e95ea6867ac3","source":"wordfence","cve":"CVE-2024-11804","title":"Planaday API <= 11.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910cf7bd-1c2b-4e08-9088-e95ea6867ac3?source=api-prod","affected":[{"type":"plugin","slug":"planaday-api","name":"Planaday API","from":"*","from_inclusive":true,"to":"11.4","to_inclusive":true,"patched_in":"11.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:15Z"},{"id":"wordfence:910d98a3-bfdb-4bb9-bd24-c57fa1a1a107","source":"wordfence","cve":"","title":"Ultimate Addons for WPBakery <= 3.16.11 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910d98a3-bfdb-4bb9-bd24-c57fa1a1a107?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.16.11","to_inclusive":true,"patched_in":"3.16.12"}],"published":"2017-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:910d9b31-b63a-427e-830b-a4c6a7e77ade","source":"wordfence","cve":"CVE-2024-13509","title":"WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910d9b31-b63a-427e-830b-a4c6a7e77ade?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.10.13","to_inclusive":true,"patched_in":"1.10.14"},{"type":"plugin","slug":"ws-form-pro","name":"WS Form Pro","from":"*","from_inclusive":true,"to":"1.10.13","to_inclusive":true,"patched_in":"1.10.14"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-12T14:30:01Z"},{"id":"wordfence:910e51da-6ee2-45d5-837b-7fea80f79390","source":"wordfence","cve":"CVE-2026-96561","title":"AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter \u2192 PHP Error-Log Injection \u2192 Advisor Indirect Prompt Injection","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910e51da-6ee2-45d5-837b-7fea80f79390?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-09-30T15:12:28Z","updated":"2026-10-01T03:28:24Z"},{"id":"wordfence:910e7446-2fdd-487e-a096-29c771e33213","source":"wordfence","cve":"CVE-2024-5075","title":"WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'editrecord'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910e7446-2fdd-487e-a096-29c771e33213?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T19:43:15Z"},{"id":"wordfence:9114018f-0678-4973-bb1e-932f0d93f963","source":"wordfence","cve":"CVE-2021-4364","title":"JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9114018f-0678-4973-bb1e-932f0d93f963?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91142cb2-aae4-496a-bfa3-6d5d8516aba1","source":"wordfence","cve":"CVE-2025-49426","title":"Kitring <= 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91142cb2-aae4-496a-bfa3-6d5d8516aba1?source=api-prod","affected":[{"type":"theme","slug":"kitring","name":"Kitring - A Beauty & Hair Salon WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:16:05Z"},{"id":"wordfence:9116cfea-eef8-480c-b75a-c6825d14f37a","source":"wordfence","cve":"CVE-2022-34648","title":"Uploading SVG, WEBP and ICO files <= 1.0.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9116cfea-eef8-480c-b75a-c6825d14f37a?source=api-prod","affected":[{"type":"plugin","slug":"uploading-svgwebp-and-ico-files","name":"Uploading SVG, WEBP and ICO files","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9116d719-f536-4b8a-9e73-9a8a922f8a35","source":"wordfence","cve":"CVE-2019-25143","title":"GDPR Cookie Compliance <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9116d719-f536-4b8a-9e73-9a8a922f8a35?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2019-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91173862-4f2d-4ca5-a58e-6fdaaeb71fc7","source":"wordfence","cve":"CVE-2025-22536","title":"WP Music Player <= 1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91173862-4f2d-4ca5-a58e-6fdaaeb71fc7?source=api-prod","affected":[{"type":"plugin","slug":"wp-music-player","name":"WP Music Player","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:56:12Z"},{"id":"wordfence:9117c46b-33cc-41f5-98e9-4dac8d6352d4","source":"wordfence","cve":"CVE-2023-32600","title":"Rank Math SEO <= 1.0.119 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9117c46b-33cc-41f5-98e9-4dac8d6352d4?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.119.1","to_inclusive":false,"patched_in":"1.0.119.1"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9118acb5-65d7-4058-82f0-0989d33ea44c","source":"wordfence","cve":"CVE-2025-39586","title":"ProfileGrid  <= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9118acb5-65d7-4058-82f0-0989d33ea44c?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.8","to_inclusive":true,"patched_in":"5.9.4.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:23:20Z"},{"id":"wordfence:911a9550-1f62-4f28-9d8c-00d9769949c9","source":"wordfence","cve":"CVE-2025-1671","title":"Academist Membership <= 1.1.6 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/911a9550-1f62-4f28-9d8c-00d9769949c9?source=api-prod","affected":[{"type":"plugin","slug":"academist-membership","name":"Academist Membership","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:04Z"},{"id":"wordfence:911d083a-57d2-4574-a5b3-b299c368400c","source":"wordfence","cve":"CVE-2024-32085","title":"Citadela Listing < 5.20.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/911d083a-57d2-4574-a5b3-b299c368400c?source=api-prod","affected":[{"type":"plugin","slug":"citadela-directory","name":"Citadela Directory","from":"*","from_inclusive":true,"to":"5.20.0","to_inclusive":false,"patched_in":"5.20.0"}],"published":"2024-04-11T00:00:00Z","updated":"2026-02-26T14:55:50Z"},{"id":"wordfence:911f3449-f906-493a-942b-eca26fdc10aa","source":"wordfence","cve":"CVE-2025-28944","title":"Avaz <= 2.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/911f3449-f906-493a-942b-eca26fdc10aa?source=api-prod","affected":[{"type":"theme","slug":"snsavaz","name":"Avaz","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-25T19:30:04Z"},{"id":"wordfence:9121ab04-d16b-468b-880f-8f00bcec6489","source":"wordfence","cve":"CVE-2024-13339","title":"DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9121ab04-d16b-468b-880f-8f00bcec6489?source=api-prod","affected":[{"type":"plugin","slug":"debounce-io-email-validator","name":"DeBounce Email Validator","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2025-02-18T19:33:29Z","updated":"2025-11-05T21:49:19Z"},{"id":"wordfence:9122068b-567f-462e-86b8-0419804bd46c","source":"wordfence","cve":"CVE-2025-68032","title":"Advanced WC Analytics <= 3.19.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9122068b-567f-462e-86b8-0419804bd46c?source=api-prod","affected":[{"type":"plugin","slug":"advance-wc-analytics","name":"AWCA \u2013 The Great Analytics Insights for Your eStore","from":"*","from_inclusive":true,"to":"3.19.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-02-05T00:00:00Z","updated":"2026-04-15T17:58:08Z"},{"id":"wordfence:91221712-8f66-4c6f-94fb-75c34a7f1fa8","source":"wordfence","cve":"CVE-2022-31474","title":"BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91221712-8f66-4c6f-94fb-75c34a7f1fa8?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"8.5.8.0","from_inclusive":true,"to":"8.7.4.1","to_inclusive":true,"patched_in":"8.7.5"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9124240d-e540-4a59-a4c5-c4279bb39399","source":"wordfence","cve":"CVE-2015-9353","title":"GigPress <= 2.3.10 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9124240d-e540-4a59-a4c5-c4279bb39399?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":false,"patched_in":"2.3.11"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:912488f1-c06c-4504-a3d8-a3730c4253b0","source":"wordfence","cve":"CVE-2025-49352","title":"Order Cancellation & Returns for WooCommerce <= 1.1.12 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/912488f1-c06c-4504-a3d8-a3730c4253b0?source=api-prod","affected":[{"type":"plugin","slug":"wc-order-cancellation-return","name":"Order Cancellation & Returns for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2025-12-31T00:00:00Z","updated":"2026-06-18T13:53:22Z"},{"id":"wordfence:912523ae-f619-46af-83b9-e9fca81bd5b0","source":"wordfence","cve":"CVE-2024-48020","title":"Backup and Staging by WP Time Capsule <= 1.22.21 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/912523ae-f619-46af-83b9-e9fca81bd5b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.21","to_inclusive":true,"patched_in":"1.22.22"}],"published":"2024-10-08T00:00:00Z","updated":"2024-10-16T12:38:01Z"},{"id":"wordfence:91253487-b82e-4431-aa16-76d94c063c83","source":"wordfence","cve":"CVE-2025-22803","title":"Advanced Product Information for WooCommerce <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91253487-b82e-4431-aa16-76d94c063c83?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-product-information","name":"Advanced Product Information for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:06:29Z"},{"id":"wordfence:91272920-fec6-4c75-b7d9-a97a23a54742","source":"wordfence","cve":"CVE-2025-22637","title":"Print PDF Generator and Publisher <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91272920-fec6-4c75-b7d9-a97a23a54742?source=api-prod","affected":[{"type":"plugin","slug":"nopeamedia","name":"Print PDF Generator and Publisher","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-10-23T20:19:50Z"},{"id":"wordfence:91286dc8-8015-4adc-9a21-d6187997cef4","source":"wordfence","cve":"CVE-2022-0867","title":"Pricing Table Plugin <= 3.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91286dc8-8015-4adc-9a21-d6187997cef4?source=api-prod","affected":[{"type":"plugin","slug":"arprice-responsive-pricing-table","name":"Pricing Table Plugin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91291608-5aa4-4fa1-b0d8-2b94d3d46f9c","source":"wordfence","cve":"CVE-2024-10517","title":"ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via \"Labels\"","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91291608-5aa4-4fa1-b0d8-2b94d3d46f9c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.14","to_inclusive":true,"patched_in":"4.15.15"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-12T16:50:44Z"},{"id":"wordfence:912be6d7-5ff2-4820-9591-2dadb962d2ea","source":"wordfence","cve":"CVE-2026-81281","title":"Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/912be6d7-5ff2-4820-9591-2dadb962d2ea?source=api-prod","affected":[{"type":"theme","slug":"graphene","name":"Graphene","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:18:29Z"},{"id":"wordfence:912c13e9-e525-4f7b-98b1-f25a51264e64","source":"wordfence","cve":"CVE-2026-93934","title":"Partiso | Political Party & Candidate Elementor Template Kit <= 1.1.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/912c13e9-e525-4f7b-98b1-f25a51264e64?source=api-prod","affected":[{"type":"theme","slug":"partiso","name":"Partiso | Political Party & Candidate Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:46:48Z","updated":"2026-10-13T14:27:03Z"},{"id":"wordfence:9132a605-7bed-4741-83f9-dfe8cbaf36cd","source":"wordfence","cve":"CVE-2024-39621","title":"ListingPro Plugin <= 2.9.4 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":8.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9132a605-7bed-4741-83f9-dfe8cbaf36cd?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2024-07-22T00:00:00Z","updated":"2025-03-24T15:23:58Z"},{"id":"wordfence:9133fa10-036b-4f42-9d0c-8e15d2625f5e","source":"wordfence","cve":"","title":"a3rev Multiple Plugins <= Various Versions - Cross-Site Request Forgery to Settings Changes","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9133fa10-036b-4f42-9d0c-8e15d2625f5e?source=api-prod","affected":[{"type":"plugin","slug":"a3-portfolio","name":"a3 Portfolio","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"3.0.0"},{"type":"plugin","slug":"woocommerce-dynamic-gallery","name":"Dynamic Product Gallery for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"3.0.0"},{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"a3-responsive-slider","name":"a3 Responsive Slider","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.1.0"},{"type":"plugin","slug":"woocommerce-compare-products","name":"Compare Products for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"},{"type":"plugin","slug":"a3-lazy-load","name":"a3 Lazy Load","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:913538e6-db9c-4073-ba4b-639b1996a416","source":"wordfence","cve":"CVE-2025-62910","title":"Video Gallery by Huzzaz <= 10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/913538e6-db9c-4073-ba4b-639b1996a416?source=api-prod","affected":[{"type":"plugin","slug":"huzzaz-video-gallery","name":"Video Gallery by Huzzaz","from":"*","from_inclusive":true,"to":"10.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:03:32Z"},{"id":"wordfence:91358e40-e64f-4e8e-b5a3-7d2133db5fe9","source":"wordfence","cve":"CVE-2024-0251","title":"Advanced Woo Search <= 2.96 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91358e40-e64f-4e8e-b5a3-7d2133db5fe9?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-search","name":"Advanced Woo Search \u2013 Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"2.96","to_inclusive":true,"patched_in":"2.97"}],"published":"2024-01-12T00:00:00Z","updated":"2024-07-29T21:36:51Z"},{"id":"wordfence:91365d3b-8e93-4202-8d44-9d217aaae0a4","source":"wordfence","cve":"CVE-2024-50550","title":"LiteSpeed Cache <= 6.5.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91365d3b-8e93-4202-8d44-9d217aaae0a4?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2024-10-29T00:00:00Z","updated":"2024-12-12T17:23:51Z"},{"id":"wordfence:913a94ad-f425-4d24-9e23-7074ecfed8ad","source":"wordfence","cve":"CVE-2026-3903","title":"Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/913a94ad-f425-4d24-9e23-7074ecfed8ad?source=api-prod","affected":[{"type":"plugin","slug":"modular-connector","name":"Modular DS: Monitor, update, and backup multiple websites","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-11T07:36:25Z"},{"id":"wordfence:913e4f70-7f4e-4d63-a7ba-6850190bdc1f","source":"wordfence","cve":"CVE-2025-49933","title":"JetBlog <= 2.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/913e4f70-7f4e-4d63-a7ba-6850190bdc1f?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.4.1"}],"published":"2025-07-17T00:00:00Z","updated":"2026-01-07T14:30:50Z"},{"id":"wordfence:913ffe0c-c8f8-4cda-be9a-96c056d4c4a8","source":"wordfence","cve":"CVE-2025-3278","title":"UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/913ffe0c-c8f8-4cda-be9a-96c056d4c4a8?source=api-prod","affected":[{"type":"plugin","slug":"urbango-membership","name":"UrbanGo Membership","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T02:22:33Z"},{"id":"wordfence:91417d83-b645-4072-92f5-e0f3a398ac95","source":"wordfence","cve":"CVE-2025-26872","title":"Eximius <= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91417d83-b645-4072-92f5-e0f3a398ac95?source=api-prod","affected":[{"type":"theme","slug":"eximius","name":"Eximius","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T18:50:26Z"},{"id":"wordfence:91425ae9-ce0a-4ed8-89fb-6dec7c73033d","source":"wordfence","cve":"CVE-2026-116846","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91425ae9-ce0a-4ed8-89fb-6dec7c73033d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.26","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-10-29T14:14:00Z","updated":"2026-11-03T19:32:19Z"},{"id":"wordfence:91427e3e-fedb-407e-8af6-8f4411a4166a","source":"wordfence","cve":"CVE-2024-12879","title":"WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91427e3e-fedb-407e-8af6-8f4411a4166a?source=api-prod","affected":[{"type":"plugin","slug":"wpbot-pro","name":"WPBot Pro Wordpress Chatbot","from":"*","from_inclusive":true,"to":"13.5.5","to_inclusive":true,"patched_in":"13.5.6"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T05:23:04Z"},{"id":"wordfence:914554fd-1525-4925-bce4-2df4a8df5dbf","source":"wordfence","cve":"CVE-2026-15653","title":"Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/914554fd-1525-4925-bce4-2df4a8df5dbf?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-07-23T18:05:48Z","updated":"2026-07-24T06:52:01Z"},{"id":"wordfence:9145ce0d-311c-4be1-be15-7e1791c17860","source":"wordfence","cve":"CVE-2022-4214","title":"Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via ip","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9145ce0d-311c-4be1-be15-7e1791c17860?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.3","to_inclusive":true,"patched_in":"1.3.2.4"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9148268a-1179-4bc5-b388-309cf08510d7","source":"wordfence","cve":"CVE-2024-33589","title":"KB Support <= 1.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9148268a-1179-4bc5-b388-309cf08510d7?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:50:37Z"},{"id":"wordfence:9149d2c6-b6c7-430d-8886-c8c5de483220","source":"wordfence","cve":"CVE-2025-13389","title":"Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9149d2c6-b6c7-430d-8886-c8c5de483220?source=api-prod","affected":[{"type":"plugin","slug":"admin-and-client-message-after-order-for-woocommerce","name":"OrderConvo \u2013 Vendor & Customer Messages After Orders","from":"*","from_inclusive":true,"to":"14","to_inclusive":true,"patched_in":"15"}],"published":"2025-11-24T19:18:04Z","updated":"2026-01-15T18:30:44Z"},{"id":"wordfence:914bcc8f-fecd-450e-b2a7-0989b7a0dd4c","source":"wordfence","cve":"CVE-2023-5615","title":"Skype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/914bcc8f-fecd-450e-b2a7-0989b7a0dd4c?source=api-prod","affected":[{"type":"plugin","slug":"skype-online-status","name":"Skype Legacy Buttons","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:914d6f7a-053a-4555-9cbc-98bd0789bcd9","source":"wordfence","cve":"CVE-2022-47587","title":"WP Search Analytics <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/914d6f7a-053a-4555-9cbc-98bd0789bcd9?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:914de8f3-e052-4256-af14-4a08eaa464b8","source":"wordfence","cve":"CVE-2023-0823","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_revoke_shortcode' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/914de8f3-e052-4256-af14-4a08eaa464b8?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:914e17ce-ab09-4e9f-9466-0ed21712cf66","source":"wordfence","cve":"","title":"Events Made Easy < 1.5.50 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/914e17ce-ab09-4e9f-9466-0ed21712cf66?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"1.5.50","to_inclusive":false,"patched_in":"1.5.50"}],"published":"2015-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9150a7d9-d792-4bb6-9d33-5892f9cdfd1e","source":"wordfence","cve":"CVE-2023-0395","title":"menu shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9150a7d9-d792-4bb6-9d33-5892f9cdfd1e?source=api-prod","affected":[{"type":"plugin","slug":"menu-shortcode","name":"menu shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91529cba-ef88-469a-9122-778db6863acc","source":"wordfence","cve":"CVE-2026-86786","title":"Slider Pro <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91529cba-ef88-469a-9122-778db6863acc?source=api-prod","affected":[{"type":"plugin","slug":"slider-pro-wp","name":"Slider Pro","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:42:41Z"},{"id":"wordfence:91531e13-5344-442c-99d3-8ccfd61b715d","source":"wordfence","cve":"CVE-2006-6016","title":"WordPress Core < 2.0.5 - User Metadata Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91531e13-5344-442c-99d3-8ccfd61b715d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2006-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91534af0-74e6-438f-9f28-27ac559b2655","source":"wordfence","cve":"CVE-2025-24707","title":"Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91534af0-74e6-438f-9f28-27ac559b2655?source=api-prod","affected":[{"type":"plugin","slug":"gt3-photo-video-gallery","name":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery","from":"*","from_inclusive":true,"to":"2.7.7.24","to_inclusive":true,"patched_in":"2.7.7.25"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:45:21Z"},{"id":"wordfence:91552a9b-d46b-4a75-b096-8f28bdd9fb56","source":"wordfence","cve":"CVE-2023-1121","title":"Simple Giveaways <= 2.45.0 - Authenticated(Admin+) Stored Cross-Site Scripting via form fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91552a9b-d46b-4a75-b096-8f28bdd9fb56?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":true,"patched_in":"2.45.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9156a588-7615-4575-9784-8716c54fee11","source":"wordfence","cve":"CVE-2025-22303","title":"WP Mailster <= 1.8.17.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9156a588-7615-4575-9784-8716c54fee11?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.17.0","to_inclusive":true,"patched_in":"1.8.18.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T15:01:32Z"},{"id":"wordfence:9156e536-a58e-4d78-b136-af8a9613ee23","source":"wordfence","cve":"CVE-2024-10783","title":"MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9156e536-a58e-4d78-b136-af8a9613ee23?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2024-12-12T00:00:00Z","updated":"2025-01-31T14:23:24Z"},{"id":"wordfence:915708c5-c958-4c4d-8d94-b93b1bea6013","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin <= 4.0.50 - Stored Cross-Site Scripting via Gallery Description","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915708c5-c958-4c4d-8d94-b93b1bea6013?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"4.0.50","to_inclusive":true,"patched_in":""}],"published":"2022-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9157fa5e-3af8-48ee-bb73-3df6109aae76","source":"wordfence","cve":"CVE-2021-34641","title":"SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9157fa5e-3af8-48ee-bb73-3df6109aae76?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"5.0.0","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.4"},{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"5.0.1","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.4"},{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"5.0.2","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.4"},{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"5.0.3","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2021-08-16T15:33:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91590b70-f6c6-4f05-a43e-92351d79baba","source":"wordfence","cve":"CVE-2026-104395","title":"picu \u2013 Online Photo Proofing Gallery <= 3.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91590b70-f6c6-4f05-a43e-92351d79baba?source=api-prod","affected":[{"type":"plugin","slug":"picu","name":"picu \u2013 Online Photo Proofing Gallery","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2026-10-05T10:48:46Z","updated":"2026-10-08T23:08:52Z"},{"id":"wordfence:915a20e4-e66f-4f94-a6e6-19b82b3c8f5e","source":"wordfence","cve":"CVE-2025-60119","title":"CoSchedule <= 3.3.11 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915a20e4-e66f-4f94-a6e6-19b82b3c8f5e?source=api-prod","affected":[{"type":"plugin","slug":"coschedule-by-todaymade","name":"CoSchedule","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:08:59Z"},{"id":"wordfence:915b7939-5480-4c2e-92e6-41dc65a33784","source":"wordfence","cve":"CVE-2026-22445","title":"Apimo Connector <= 2.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915b7939-5480-4c2e-92e6-41dc65a33784?source=api-prod","affected":[{"type":"plugin","slug":"apimo","name":"Apimo Connector","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-03T00:00:00Z","updated":"2026-01-14T19:29:10Z"},{"id":"wordfence:915c119d-2bae-4ea6-babb-7e8e99054cd0","source":"wordfence","cve":"CVE-2026-2509","title":"Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915c119d-2bae-4ea6-babb-7e8e99054cd0?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-08T13:26:01Z"},{"id":"wordfence:915c46f9-a342-4cc6-a726-2f1581a5d481","source":"wordfence","cve":"CVE-2024-10181","title":"Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915c46f9-a342-4cc6-a726-2f1581a5d481?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.4","to_inclusive":true,"patched_in":"4.9.9.5"}],"published":"2024-10-28T23:13:25Z","updated":"2024-10-29T11:32:51Z"},{"id":"wordfence:915cce97-8305-4249-b2d3-c4da2f59a95a","source":"wordfence","cve":"CVE-2025-12937","title":"ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915cce97-8305-4249-b2d3-c4da2f59a95a?source=api-prod","affected":[{"type":"plugin","slug":"acf-flexible-layouts-manager","name":"ACF Flexible Layouts Manager","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:17:22Z","updated":"2025-11-18T08:27:34Z"},{"id":"wordfence:915d73ed-33ae-4580-9a51-aa4e9a015ff6","source":"wordfence","cve":"CVE-2014-100027","title":"Slimstat Analytics <= 3.5.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915d73ed-33ae-4580-9a51-aa4e9a015ff6?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":false,"patched_in":"3.5.6"}],"published":"2015-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:915e1a6e-ad9c-4849-8ae0-3ded18720a1f","source":"wordfence","cve":"CVE-2025-10753","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915e1a6e-ad9c-4849-8ae0-3ded18720a1f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.26.14","to_inclusive":true,"patched_in":"6.26.15"}],"published":"2026-02-05T18:30:28Z","updated":"2026-02-06T06:46:32Z"},{"id":"wordfence:915f464f-449d-4ad2-9f43-6ce5d93ccb05","source":"wordfence","cve":"CVE-2024-3027","title":"Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915f464f-449d-4ad2-9f43-6ce5d93ccb05?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.22","to_inclusive":true,"patched_in":"3.5.1.23"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-13T01:57:50Z"},{"id":"wordfence:915f6423-18de-415b-ab89-baaa805203ae","source":"wordfence","cve":"CVE-2025-22705","title":"Disqus Popular Posts <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915f6423-18de-415b-ab89-baaa805203ae?source=api-prod","affected":[{"type":"plugin","slug":"disqus-popular-posts","name":"Disqus Popular Posts","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-21T14:35:20Z"},{"id":"wordfence:915f81ec-8b48-4036-90c6-9a1c31febfdd","source":"wordfence","cve":"CVE-2025-68517","title":"Tablesome <= 1.1.35.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/915f81ec-8b48-4036-90c6-9a1c31febfdd?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.35.1","to_inclusive":true,"patched_in":"1.1.35.2"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T13:57:49Z"},{"id":"wordfence:9160b0a0-1225-4e29-9a2e-db217e50337b","source":"wordfence","cve":"CVE-2026-22381","title":"PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9160b0a0-1225-4e29-9a2e-db217e50337b?source=api-prod","affected":[{"type":"theme","slug":"pawfriends","name":"PawFriends - Pet Shop and Veterinary WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:28:09Z"},{"id":"wordfence:9163861b-735b-4007-97f7-8f9095d93ec9","source":"wordfence","cve":"CVE-2023-30745","title":"IP Metaboxes <= 2.1.1 -  Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9163861b-735b-4007-97f7-8f9095d93ec9?source=api-prod","affected":[{"type":"plugin","slug":"ip-metaboxes","name":"IP Metaboxes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91652abf-2127-40be-bcd8-4a0679707953","source":"wordfence","cve":"CVE-2016-10705","title":"Jetpack <= 4.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91652abf-2127-40be-bcd8-4a0679707953?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2016-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91654765-6631-4eb4-9971-32b7db7933e1","source":"wordfence","cve":"CVE-2026-15291","title":"Chat Help \u2013 Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91654765-6631-4eb4-9971-32b7db7933e1?source=api-prod","affected":[{"type":"plugin","slug":"chat-help","name":"ChatHelp \u2013 Click to Chat Button, Chat to Order for WooCommerce & Floating Chat Form","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-11-18T17:40:13Z","updated":"2026-07-10T04:31:24Z"},{"id":"wordfence:9167e4bd-74be-46c9-b06e-566c13c02c7d","source":"wordfence","cve":"CVE-2017-11658","title":"WP Rocket <= 2.10.3 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9167e4bd-74be-46c9-b06e-566c13c02c7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":false,"patched_in":"2.10.4"}],"published":"2017-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9169931c-a679-4801-b33b-08c4f464dc43","source":"wordfence","cve":"CVE-2025-9200","title":"Blappsta Mobile App Plugin \u2013 Your native, mobile iPhone App and Android App <= 0.8.8.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9169931c-a679-4801-b33b-08c4f464dc43?source=api-prod","affected":[{"type":"plugin","slug":"yournewsapp","name":"Blappsta Mobile App Plugin \u2013 Your native, mobile iPhone App and Android App","from":"*","from_inclusive":true,"to":"0.8.8.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:15:02Z","updated":"2025-10-03T11:17:17Z"},{"id":"wordfence:91699d32-1768-4d87-a4f2-91969b3e3355","source":"wordfence","cve":"CVE-2025-0924","title":"WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91699d32-1768-4d87-a4f2-91969b3e3355?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2025-02-12T19:09:37Z","updated":"2025-02-17T04:22:46Z"},{"id":"wordfence:9169af40-32da-4b38-95ee-d0c7d4e67779","source":"wordfence","cve":"","title":"IMPress for IDX Broker <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9169af40-32da-4b38-95ee-d0c7d4e67779?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:916a9d2b-0da6-494a-a3aa-5d5f4ccdd4b8","source":"wordfence","cve":"CVE-2021-24267","title":"All-in-One Addons for Elementor - WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916a9d2b-0da6-494a-a3aa-5d5f4ccdd4b8?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:916ada05-894e-4e61-ba0a-25b9a48461a1","source":"wordfence","cve":"CVE-2022-4357","title":"LetsRecover <= 1.1.0 - Unauthenticated SQL Injection via AJAX action","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916ada05-894e-4e61-ba0a-25b9a48461a1?source=api-prod","affected":[{"type":"plugin","slug":"letsrecover-woocommerce-abandoned-cart","name":"LetsRecover \u2013 WooCommerce Abandoned Cart Notifications","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:916c1f63-2bf6-472e-86b4-05a89e1d8dee","source":"wordfence","cve":"CVE-2025-60047","title":"IPharm <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916c1f63-2bf6-472e-86b4-05a89e1d8dee?source=api-prod","affected":[{"type":"theme","slug":"ipharm","name":"iPharm - Online Pharmacy Woocommerce Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:38:12Z"},{"id":"wordfence:916c2984-292c-458b-b3be-c187e7c4d30a","source":"wordfence","cve":"CVE-2024-52477","title":"Document & Data Automation <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916c2984-292c-458b-b3be-c187e7c4d30a?source=api-prod","affected":[{"type":"plugin","slug":"document-data-automation","name":"Document & Data Automation","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:42:24Z"},{"id":"wordfence:916c73e8-a150-4b35-8773-ea0ec29f7fd1","source":"wordfence","cve":"CVE-2023-4469","title":"Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916c73e8-a150-4b35-8773-ea0ec29f7fd1?source=api-prod","affected":[{"type":"plugin","slug":"profile-extra-fields","name":"Profile Extra Fields by BestWebSoft","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:916cf0df-31ab-4f99-82d1-e1e30f5f8c6f","source":"wordfence","cve":"CVE-2024-44054","title":"Fluida <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916cf0df-31ab-4f99-82d1-e1e30f5f8c6f?source=api-prod","affected":[{"type":"theme","slug":"fluida","name":"Fluida","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.8.1"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-23T18:35:24Z"},{"id":"wordfence:916d4f2f-769b-4902-9464-f55d8f64c9d2","source":"wordfence","cve":"CVE-2022-46858","title":"Product Specifications for Woocommerce <= 0.6.0 - Reflected Cross-Site Scripting via Arbitrary Query String Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916d4f2f-769b-4902-9464-f55d8f64c9d2?source=api-prod","affected":[{"type":"plugin","slug":"product-specifications","name":"Product Specifications for Woocommerce","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":"0.7.0"}],"published":"2023-03-28T00:00:00Z","updated":"2024-08-28T22:09:53Z"},{"id":"wordfence:916e6f8b-cb29-4062-9a05-0337cfdb382a","source":"wordfence","cve":"CVE-2023-2237","title":"WP Replicate Post <= 4.0.2 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/916e6f8b-cb29-4062-9a05-0337cfdb382a?source=api-prod","affected":[{"type":"plugin","slug":"wp-replicate-post","name":"WP Replicate Post","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.1"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91754c4d-a0d0-4d35-a70a-446d2bdf6c73","source":"wordfence","cve":"CVE-2024-11286","title":"WP JobHunt <= 7.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91754c4d-a0d0-4d35-a70a-446d2bdf6c73?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:33Z"},{"id":"wordfence:91758857-87ef-458a-bd19-e102fc0f3a6a","source":"wordfence","cve":"CVE-2025-58269","title":"WP Project Manager <= 2.6.25 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91758857-87ef-458a-bd19-e102fc0f3a6a?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.25","to_inclusive":true,"patched_in":"2.6.26"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-07T17:56:41Z"},{"id":"wordfence:9176535c-8e37-4a18-b458-a71c4a84daa4","source":"wordfence","cve":"CVE-2026-2385","title":"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9176535c-8e37-4a18-b458-a71c4a84daa4?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.4.7","to_inclusive":true,"patched_in":"6.4.8"}],"published":"2026-02-21T19:49:02Z","updated":"2026-02-22T08:24:46Z"},{"id":"wordfence:917820b1-c6a6-4afd-9009-60fc1c0a39d8","source":"wordfence","cve":"CVE-2024-54288","title":"LDD Directory Lite <= 3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/917820b1-c6a6-4afd-9009-60fc1c0a39d8?source=api-prod","affected":[{"type":"plugin","slug":"ldd-directory-lite","name":"LDD Directory Lite","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-17T16:46:10Z"},{"id":"wordfence:9178723e-c51d-4f78-82b1-59b0c8eb0f8f","source":"wordfence","cve":"CVE-2026-39548","title":"MagOne <= 9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9178723e-c51d-4f78-82b1-59b0c8eb0f8f?source=api-prod","affected":[{"type":"theme","slug":"magone","name":"magone","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"9.1"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:44:21Z"},{"id":"wordfence:917a6b76-0bb4-4320-9ab9-bc433b6dfbe8","source":"wordfence","cve":"CVE-2025-49375","title":"HomeLancer <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/917a6b76-0bb4-4320-9ab9-bc433b6dfbe8?source=api-prod","affected":[{"type":"theme","slug":"homelancer","name":"HomeLancer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:20:25Z"},{"id":"wordfence:917a95d7-d2b2-4e89-b892-4025b335d34b","source":"wordfence","cve":"CVE-2025-68853","title":"Contact Manager <= 9.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/917a95d7-d2b2-4e89-b892-4025b335d34b?source=api-prod","affected":[{"type":"plugin","slug":"contact-manager","name":"Contact Manager","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-27T10:11:48Z"},{"id":"wordfence:917c70f5-154c-4c49-b06b-109cc0277a1a","source":"wordfence","cve":"CVE-2026-32538","title":"SMTP Mailer <= 1.1.24 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/917c70f5-154c-4c49-b06b-109cc0277a1a?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mailer","name":"SMTP Mailer","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:21:22Z"},{"id":"wordfence:91898465-55fa-417c-8f00-ffe118232516","source":"wordfence","cve":"CVE-2023-28693","title":"Advanced Youtube Channel Pagination <= 1.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91898465-55fa-417c-8f00-ffe118232516?source=api-prod","affected":[{"type":"plugin","slug":"advanced-youtube-channel-pagination","name":"Advanced Youtube Channel Pagination","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:918af0dc-afad-4645-b4ad-8b10a34e20b2","source":"wordfence","cve":"CVE-2026-18964","title":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918af0dc-afad-4645-b4ad-8b10a34e20b2?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-09-10T14:42:25Z","updated":"2026-09-11T03:39:36Z"},{"id":"wordfence:918c418a-9d86-461d-91cb-33d04010c577","source":"wordfence","cve":"CVE-2024-32696","title":"AI Infographic Maker <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918c418a-9d86-461d-91cb-33d04010c577?source=api-prod","affected":[{"type":"plugin","slug":"infographic-and-list-builder-ilist","name":"AI Infographic Maker","from":"*","from_inclusive":true,"to":"4.6.7","to_inclusive":true,"patched_in":"4.6.8"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T12:42:05Z"},{"id":"wordfence:918cddb9-ecd6-4ae0-8f6e-da44c60fc5cb","source":"wordfence","cve":"CVE-2025-54008","title":"JetSmartFilters <= 3.6.7 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918cddb9-ecd6-4ae0-8f6e-da44c60fc5cb?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.7.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:55:50Z"},{"id":"wordfence:918dd473-dbe7-4352-95e9-3f705b09a4f2","source":"wordfence","cve":"CVE-2026-111111","title":"Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918dd473-dbe7-4352-95e9-3f705b09a4f2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2026-10-27T18:39:01Z","updated":"2026-10-28T06:45:16Z"},{"id":"wordfence:918fbf35-7ef8-455d-af3c-23da415860b2","source":"wordfence","cve":"CVE-2025-28914","title":"wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/918fbf35-7ef8-455d-af3c-23da415860b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-login-form","name":"wordpress login form to anywhere","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:41:10Z"},{"id":"wordfence:9195ac7e-2995-44d0-b5c6-8ffb47395f24","source":"wordfence","cve":"CVE-2023-0162","title":"CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9195ac7e-2995-44d0-b5c6-8ffb47395f24?source=api-prod","affected":[{"type":"plugin","slug":"cpo-companion","name":"CPO Companion","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9198ffe4-2f9e-4d80-9f5d-cf967b3feb43","source":"wordfence","cve":"CVE-2023-25795","title":"Feed Changer <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9198ffe4-2f9e-4d80-9f5d-cf967b3feb43?source=api-prod","affected":[{"type":"plugin","slug":"feed-changer","name":"Feed Changer & Remover","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91998552-bf97-40e0-b5b2-be35a8d58b54","source":"wordfence","cve":"CVE-2015-1376","title":"Pixabay Images <= 2.3 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91998552-bf97-40e0-b5b2-be35a8d58b54?source=api-prod","affected":[{"type":"plugin","slug":"pixabay-images","name":"Pixabay Images","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2015-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:919a2a4a-061e-4206-84b2-7b43b1276fa0","source":"wordfence","cve":"CVE-2012-6627","title":"Newsletter Manager < 1.0.2 - Cross-Site Scripting via test_mail.php","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/919a2a4a-061e-4206-84b2-7b43b1276fa0?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-manager","name":"Newsletter Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:919d31a8-932e-438b-a039-89a24781524c","source":"wordfence","cve":"CVE-2023-3647","title":"IURNY by INDIGITALL \u2013 WhatsApp Chat, Web Push Notifications (FREE) <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/919d31a8-932e-438b-a039-89a24781524c?source=api-prod","affected":[{"type":"plugin","slug":"indigitall-web-push-notifications","name":"INDIGITALL \u2013 Instant Chat, Web Push Notifications","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:919dd168-1b4c-4e3a-977e-051cb48eaded","source":"wordfence","cve":"CVE-2025-26928","title":"Order Limit for WooCommerce <= 3.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/919dd168-1b4c-4e3a-977e-051cb48eaded?source=api-prod","affected":[{"type":"plugin","slug":"wc-order-limit-lite","name":"Order Limit for WooCommerce (Free Version)","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:24:20Z"},{"id":"wordfence:919f02ab-a336-46c9-9ce7-f94acac29145","source":"wordfence","cve":"CVE-2024-47380","title":"WP-Lister Lite for eBay <= 3.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/919f02ab-a336-46c9-9ce7-f94acac29145?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:23:42Z"},{"id":"wordfence:91a1278a-0308-4fe0-a46e-172ca1735c53","source":"wordfence","cve":"CVE-2025-58261","title":"Mavis HTTPS to HTTP Redirection <= 1.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a1278a-0308-4fe0-a46e-172ca1735c53?source=api-prod","affected":[{"type":"plugin","slug":"mavis-https-to-http-redirect","name":"Mavis HTTPS to HTTP Redirection","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:40:41Z"},{"id":"wordfence:91a1604c-c729-4c68-90a8-91862a351ecc","source":"wordfence","cve":"CVE-2022-4049","title":"WP User <= 7.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a1604c-c729-4c68-90a8-91862a351ecc?source=api-prod","affected":[{"type":"plugin","slug":"wp-user","name":"WP User \u2013 Custom Registration Forms, Login and User Profile","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91a20180-871b-4208-b11e-d3ff2a7e8d23","source":"wordfence","cve":"CVE-2024-54267","title":"CM Answers <= 3.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a20180-871b-4208-b11e-d3ff2a7e8d23?source=api-prod","affected":[{"type":"plugin","slug":"cm-answers","name":"CM Answers \u2013 Discussion Forum Plugin for WordPress Q&A","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-18T16:07:21Z"},{"id":"wordfence:91a2fa6e-f434-4b56-af68-71e1ee565cc8","source":"wordfence","cve":"CVE-2025-47583","title":"Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a2fa6e-f434-4b56-af68-71e1ee565cc8?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.16","to_inclusive":true,"patched_in":"10.17"}],"published":"2025-05-15T00:00:00Z","updated":"2025-06-25T14:08:34Z"},{"id":"wordfence:91a83f52-069e-4611-9b46-4a1913e23f42","source":"wordfence","cve":"CVE-2026-0929","title":"RegistrationMagic < 6.0.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a83f52-069e-4611-9b46-4a1913e23f42?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.2","to_inclusive":false,"patched_in":"6.0.7.2"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-24T19:24:43Z"},{"id":"wordfence:91a8721e-de2d-45db-85a8-1b65f7b38892","source":"wordfence","cve":"CVE-2025-49934","title":"JetBlocks For Elementor <= 1.3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a8721e-de2d-45db-85a8-1b65f7b38892?source=api-prod","affected":[{"type":"plugin","slug":"jet-blocks","name":"JetBlocks for Elementor","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2025-07-17T00:00:00Z","updated":"2025-10-29T19:06:38Z"},{"id":"wordfence:91a9dcf2-ba6b-4d03-9cdf-f50ea0d259d8","source":"wordfence","cve":"CVE-2024-5457","title":"Panda Video <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a9dcf2-ba6b-4d03-9cdf-f50ea0d259d8?source=api-prod","affected":[{"type":"plugin","slug":"pandavideo","name":"Panda Video","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-07-08T20:01:37Z","updated":"2024-08-01T20:23:45Z"},{"id":"wordfence:91a9e602-44c6-4148-8316-27760f9e5c61","source":"wordfence","cve":"CVE-2025-32226","title":"Display product variations dropdown on shop page <= 1.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91a9e602-44c6-4148-8316-27760f9e5c61?source=api-prod","affected":[{"type":"plugin","slug":"display-product-variations-dropdown-on-shop-page","name":"Display Product Variations Dropdown on Shop Page","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-04-04T00:00:00Z","updated":"2026-10-13T16:54:34Z"},{"id":"wordfence:91aa163b-ac5b-4737-afa7-be4b55cb1e90","source":"wordfence","cve":"CVE-2025-32543","title":"Canonical Attachments <= 1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91aa163b-ac5b-4737-afa7-be4b55cb1e90?source=api-prod","affected":[{"type":"plugin","slug":"canonical-attachments","name":"Canonical Attachments","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:14:49Z"},{"id":"wordfence:91aa1f4c-ace7-43a4-a9e6-82c15e00d0eb","source":"wordfence","cve":"CVE-2022-1829","title":"Inline Google Maps <= 5.11 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91aa1f4c-ace7-43a4-a9e6-82c15e00d0eb?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-advanced","name":"Inline Google Maps","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91aa86d9-8e42-4deb-b6ca-c3b388fefcb1","source":"wordfence","cve":"CVE-2025-11008","title":"CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91aa86d9-8e42-4deb-b6ca-c3b388fefcb1?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:24:06Z","updated":"2026-09-09T16:33:16Z"},{"id":"wordfence:91aaf15f-dc47-4f7f-b5f7-aba7c67f7233","source":"wordfence","cve":"CVE-2025-9372","title":"Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91aaf15f-dc47-4f7f-b5f7-aba7c67f7233?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-multi-design-video-carousel","name":"Ultimate Multi Design Video Carousel","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:32:04Z","updated":"2025-10-03T11:17:17Z"},{"id":"wordfence:91abd172-e024-4272-96ee-1725af4d5488","source":"wordfence","cve":"CVE-2020-24314","title":"RSS Feed Widget <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91abd172-e024-4272-96ee-1725af4d5488?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":false,"patched_in":"2.8.1"}],"published":"2020-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91b06d7d-7e92-49f0-b161-9b25318edfeb","source":"wordfence","cve":"CVE-2023-45051","title":"Image vertical reel scroll slideshow <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91b06d7d-7e92-49f0-b161-9b25318edfeb?source=api-prod","affected":[{"type":"plugin","slug":"image-vertical-reel-scroll-slideshow","name":"Image vertical reel scroll slideshow","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91b0801b-4eaa-4188-af68-a2531c8412ed","source":"wordfence","cve":"CVE-2025-60197","title":"Simple Contact Forms <= 1.6.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91b0801b-4eaa-4188-af68-a2531c8412ed?source=api-prod","affected":[{"type":"plugin","slug":"simple-contact-forms","name":"Simple Contact Forms","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2025-11-11T17:14:00Z"},{"id":"wordfence:91ba2c79-ac70-4bb2-b687-65db27469557","source":"wordfence","cve":"CVE-2025-31875","title":"FancyPost <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ba2c79-ac70-4bb2-b687-65db27469557?source=api-prod","affected":[{"type":"plugin","slug":"post-block","name":"FancyPost \u2013 Post Blocks, Grids & Sliders for Block Editor and Elementor","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:07:52Z"},{"id":"wordfence:91ba93de-4c5f-4611-8296-adfc85c8dd2b","source":"wordfence","cve":"CVE-2023-47780","title":"EasyAzon \u2013 Amazon Associates Affiliate <= 5.1.0 - Missing Authorization on AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ba93de-4c5f-4611-8296-adfc85c8dd2b?source=api-prod","affected":[{"type":"plugin","slug":"easyazon","name":"EasyAzon \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-11-14T00:00:00Z","updated":"2024-03-22T15:20:41Z"},{"id":"wordfence:91c0c738-37f9-476b-9d54-e01c721ca9bc","source":"wordfence","cve":"CVE-2025-25114","title":"User Role <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c0c738-37f9-476b-9d54-e01c721ca9bc?source=api-prod","affected":[{"type":"plugin","slug":"user-roles","name":"User Roles","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:40:06Z"},{"id":"wordfence:91c1100b-be67-4610-947a-c6a010a2757e","source":"wordfence","cve":"CVE-2022-35726","title":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP <= 1.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c1100b-be67-4610-947a-c6a010a2757e?source=api-prod","affected":[{"type":"plugin","slug":"yotuwp-easy-youtube-embed","name":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91c147f9-8179-4ce0-8d17-87ea47cf08fe","source":"wordfence","cve":"CVE-2015-2673","title":"EasyCart 1.1.30 - 3.0.20 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c147f9-8179-4ce0-8d17-87ea47cf08fe?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"1.1.30","from_inclusive":true,"to":"3.0.20","to_inclusive":true,"patched_in":"3.0.21"}],"published":"2015-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91c79862-cf85-42ad-9996-f679edab678e","source":"wordfence","cve":"CVE-2026-25415","title":"WPBookit Pro <= 1.6.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c79862-cf85-42ad-9996-f679edab678e?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit-pro","name":"WPBookit Pro - Appointment Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-05-04T15:31:49Z"},{"id":"wordfence:91c87d34-ef9a-42f4-b11a-7c5a5c842550","source":"wordfence","cve":"CVE-2025-8621","title":"Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c87d34-ef9a-42f4-b11a-7c5a5c842550?source=api-prod","affected":[{"type":"plugin","slug":"mosaic-generator","name":"Mosaic Generator","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T14:05:25Z","updated":"2025-08-12T02:24:49Z"},{"id":"wordfence:91c9fb05-e853-4d59-95ec-a0c2ff06565b","source":"wordfence","cve":"","title":"Envato Sales By Item <= 1.1 - Unauthenticated SQL Injection via AJAX call","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91c9fb05-e853-4d59-95ec-a0c2ff06565b?source=api-prod","affected":[{"type":"plugin","slug":"nd-stats-for-envato-sales-by-item","name":"Envato Sales By Item","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91ca027c-0483-44de-b19e-243ccb2c7b31","source":"wordfence","cve":"CVE-2025-58993","title":"Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ca027c-0483-44de-b19e-243ccb2c7b31?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:32:57Z"},{"id":"wordfence:91cb78f7-8a2f-4e57-b62a-d9ef56f39523","source":"wordfence","cve":"CVE-2026-22408","title":"Justicia - Lawyer WordPress Theme <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91cb78f7-8a2f-4e57-b62a-d9ef56f39523?source=api-prod","affected":[{"type":"theme","slug":"justicia","name":"Justicia - Lawyer WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:42:03Z"},{"id":"wordfence:91ccbf0e-4cb8-405a-96ad-d3dafcb31838","source":"wordfence","cve":"CVE-2026-96815","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.5.0 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ccbf0e-4cb8-405a-96ad-d3dafcb31838?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:46:19Z"},{"id":"wordfence:91cd949f-5e6f-41cb-9a93-f3d763a8cece","source":"wordfence","cve":"CVE-2025-31856","title":"Export All Post Meta <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91cd949f-5e6f-41cb-9a93-f3d763a8cece?source=api-prod","affected":[{"type":"plugin","slug":"export-all-post-meta","name":"Export All Post Meta","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:20:43Z"},{"id":"wordfence:91cf37df-fbe3-485c-9103-d8c139421aed","source":"wordfence","cve":"CVE-2025-60216","title":"Addison < 1.4.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91cf37df-fbe3-485c-9103-d8c139421aed?source=api-prod","affected":[{"type":"theme","slug":"addison","name":"Addison - Architecture & Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2025-09-23T00:00:00Z","updated":"2025-11-04T18:12:22Z"},{"id":"wordfence:91d12259-a611-4921-ba03-eb9221ef49fd","source":"wordfence","cve":"CVE-2025-23581","title":"Demo User DZS \u2013 Showcase your admin safely <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d12259-a611-4921-ba03-eb9221ef49fd?source=api-prod","affected":[{"type":"plugin","slug":"demo-user-dzs-showcase-your-admin-safely","name":"Demo User DZS \u2013 Showcase your admin safely","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T15:48:26Z"},{"id":"wordfence:91d1c81d-cf06-45db-a868-8f1c6ba3ccc9","source":"wordfence","cve":"CVE-2024-52349","title":"Awesome Tool Tip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d1c81d-cf06-45db-a868-8f1c6ba3ccc9?source=api-prod","affected":[{"type":"plugin","slug":"awesome-tool-tip","name":"Awesome Tool Tip","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:40:01Z"},{"id":"wordfence:91d21894-2728-467c-9eb1-2ba2b32fcb28","source":"wordfence","cve":"CVE-2024-54433","title":"Simple Booking Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d21894-2728-467c-9eb1-2ba2b32fcb28?source=api-prod","affected":[{"type":"plugin","slug":"simple-booking-widget","name":"Simple Booking \u2013 Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T13:59:35Z"},{"id":"wordfence:91d3cbc2-00ca-4384-a52d-84fe2f0328b3","source":"wordfence","cve":"CVE-2026-121976","title":"Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d3cbc2-00ca-4384-a52d-84fe2f0328b3?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"3.0.17","to_inclusive":true,"patched_in":"3.0.18"}],"published":"2026-11-06T21:49:31Z","updated":"2026-11-07T11:26:32Z"},{"id":"wordfence:91d52a64-8dc1-4923-be0b-06800382151e","source":"wordfence","cve":"CVE-2026-3180","title":"Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d52a64-8dc1-4923-be0b-06800382151e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.4","to_inclusive":true,"patched_in":"28.1.5"}],"published":"2026-03-02T04:44:39Z","updated":"2026-03-02T17:23:36Z"},{"id":"wordfence:91d5d052-d219-4c2f-9341-19f415ff90c4","source":"wordfence","cve":"CVE-2022-46852","title":"WP Table Builder \u2013 WordPress Table Plugin <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d5d052-d219-4c2f-9341-19f415ff90c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91d6cf21-cb65-40cb-ad19-5a8e7179fd98","source":"wordfence","cve":"CVE-2025-13364","title":"WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d6cf21-cb65-40cb-ad19-5a8e7179fd98?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"4.8.8"}],"published":"2026-04-15T17:46:52Z","updated":"2026-04-16T06:44:52Z"},{"id":"wordfence:91d72089-6ad9-401b-ab7b-0996e28d3be9","source":"wordfence","cve":"CVE-2014-4573","title":"Walk Score Plugin <= 0.5.5 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91d72089-6ad9-401b-ab7b-0996e28d3be9?source=api-prod","affected":[{"type":"plugin","slug":"walk-score","name":"Walk Score Plugin","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91da9275-0934-496e-9cf9-5f5e6eedfdff","source":"wordfence","cve":"CVE-2025-23681","title":"REDIRECTION PLUS <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91da9275-0934-496e-9cf9-5f5e6eedfdff?source=api-prod","affected":[{"type":"plugin","slug":"redirection-plus","name":"301 SEO REDIRECTION | COUNTRY BASED REDIRECTION [ REDIRECTION PLUS ]","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:12:16Z"},{"id":"wordfence:91dbc521-c24b-4b73-9b70-46d363ccb535","source":"wordfence","cve":"CVE-2025-14427","title":"Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 - Missing Authorization to Authenticated (Subscriber+) Email MFA Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91dbc521-c24b-4b73-9b70-46d363ccb535?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"21.0.9","to_inclusive":true,"patched_in":"21.0.10"}],"published":"2026-02-18T16:16:58Z","updated":"2026-02-19T04:36:20Z"},{"id":"wordfence:91ddc368-bfe5-4581-aa99-ac9f4bcf9da4","source":"wordfence","cve":"CVE-2025-8776","title":"Epic Bootstrap Buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ddc368-bfe5-4581-aa99-ac9f4bcf9da4?source=api-prod","affected":[{"type":"plugin","slug":"epic-bootstrap-buttons","name":"Epic Bootstrap Buttons","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:12:25Z","updated":"2025-10-03T11:17:18Z"},{"id":"wordfence:91de3a32-236e-441d-b648-56cd69257c5f","source":"wordfence","cve":"CVE-2025-24781","title":"WPJobBoard <= 5.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91de3a32-236e-441d-b648-56cd69257c5f?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.11.1"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:34:10Z"},{"id":"wordfence:91de6cf4-e5df-4130-bb96-92b89717a678","source":"wordfence","cve":"CVE-2023-51483","title":"WP Frontend Profile <= 1.3.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91de6cf4-e5df-4130-bb96-92b89717a678?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-05-21T13:03:20Z"},{"id":"wordfence:91e0b45c-e73f-408a-94b8-fdbc5da64b20","source":"wordfence","cve":"CVE-2025-26763","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider <= 3.94.0 - Authenticated (Editor+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e0b45c-e73f-408a-94b8-fdbc5da64b20?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.94.0","to_inclusive":true,"patched_in":"3.95.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T22:36:43Z"},{"id":"wordfence:91e1a199-f062-4555-ae7b-ed8732686303","source":"wordfence","cve":"CVE-2023-37972","title":"WooCommerce Product Stock Alert <= 2.0.1 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e1a199-f062-4555-ae7b-ed8732686303?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-stock-alert","name":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91e27e66-daf2-41d4-91bd-22c398559c23","source":"wordfence","cve":"CVE-2024-5333","title":"The Events Calendar <= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e27e66-daf2-41d4-91bd-22c398559c23?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":true,"patched_in":"6.8.2.1"}],"published":"2024-11-25T00:00:00Z","updated":"2025-01-17T13:51:41Z"},{"id":"wordfence:91e44955-d01c-4e81-89bf-35f27b8cda43","source":"wordfence","cve":"CVE-2026-100107","title":"Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e44955-d01c-4e81-89bf-35f27b8cda43?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2026-10-01T19:02:10Z","updated":"2026-10-02T07:39:27Z"},{"id":"wordfence:91e5c89e-85d3-4dda-8b79-e0b4d64e29f0","source":"wordfence","cve":"","title":"All custom fields & groups <= 1.04 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e5c89e-85d3-4dda-8b79-e0b4d64e29f0?source=api-prod","affected":[{"type":"plugin","slug":"all-custom-fields-groups","name":"All custom fields & groups","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":"1.05"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91e61664-3b98-4a97-b35c-1ec88034d05b","source":"wordfence","cve":"CVE-2017-5492","title":"WordPress Core < 4.7.1 - Cross-Site Request Forgery via Widget Editing","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e61664-3b98-4a97-b35c-1ec88034d05b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91e7afef-8e43-400e-a0ed-a2b5f1fc7b6d","source":"wordfence","cve":"CVE-2025-50038","title":"Anant Addons for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e7afef-8e43-400e-a0ed-a2b5f1fc7b6d?source=api-prod","affected":[{"type":"plugin","slug":"anant-addons-for-elementor","name":"Anant Addons for Elementor \u2013 Widgets, Templates & WooCommerce Builder","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:55:24Z"},{"id":"wordfence:91e7dba4-e2f6-4b46-bb2b-ee8922b4f86e","source":"wordfence","cve":"CVE-2026-96894","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e7dba4-e2f6-4b46-bb2b-ee8922b4f86e?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.10","to_inclusive":true,"patched_in":"1.17.11"}],"published":"2026-10-30T16:19:31Z","updated":"2026-10-30T17:15:28Z"},{"id":"wordfence:91e7e93d-348b-40d7-b803-5dbd7c6a684a","source":"wordfence","cve":"CVE-2023-50375","title":"Google Language Translator <= 6.0.19 - Missing Authorization via admin notifications","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91e7e93d-348b-40d7-b803-5dbd7c6a684a?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.19","to_inclusive":true,"patched_in":"6.0.20"}],"published":"2023-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91ea157f-7a74-427f-b1eb-a9187f2d9096","source":"wordfence","cve":"CVE-2023-29433","title":"tencentcloud-cos <= 1.0.7 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ea157f-7a74-427f-b1eb-a9187f2d9096?source=api-prod","affected":[{"type":"plugin","slug":"tencentcloud-cos","name":"tencentcloud-cos","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91ebde99-3383-4179-a72b-2709c1db9e53","source":"wordfence","cve":"CVE-2017-1000224","title":"Embed Plus Plugin for YouTube <= 11.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ebde99-3383-4179-a72b-2709c1db9e53?source=api-prod","affected":[{"type":"plugin","slug":"youtube-embed-plus","name":"Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades","from":"*","from_inclusive":true,"to":"11.8.1","to_inclusive":true,"patched_in":"11.8.2"}],"published":"2017-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91ebe8cb-99ec-4380-a77e-17e17144a17e","source":"wordfence","cve":"CVE-2025-14059","title":"EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91ebe8cb-99ec-4380-a77e-17e17144a17e?source=api-prod","affected":[{"type":"plugin","slug":"emailkit","name":"EmailKit \u2013 Email Customizer for WooCommerce & WP","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-01-06T14:21:45Z","updated":"2026-09-16T23:45:23Z"},{"id":"wordfence:91f025f6-2938-42dc-a70b-4bdfb18cf3b8","source":"wordfence","cve":"CVE-2026-13178","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f025f6-2938-42dc-a70b-4bdfb18cf3b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.16","to_inclusive":false,"patched_in":"4.1.16"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:46:34Z"},{"id":"wordfence:91f13d74-0ad9-4790-a534-e8ff1655f06f","source":"wordfence","cve":"CVE-2020-11511","title":"LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f13d74-0ad9-4790-a534-e8ff1655f06f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.6.8","to_inclusive":true,"patched_in":"3.2.6.9"}],"published":"2020-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91f45973-5a98-4fdd-88fd-83b95f6d77e7","source":"wordfence","cve":"CVE-2026-3333","title":"MinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f45973-5a98-4fdd-88fd-83b95f6d77e7?source=api-prod","affected":[{"type":"plugin","slug":"minhnhut-link-gateway","name":"MinhNhut Link Gateway","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:21Z","updated":"2026-03-21T03:26:56Z"},{"id":"wordfence:91f50b65-f001-4c73-bfe3-1aed3fc10d26","source":"wordfence","cve":"CVE-2024-4275","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f50b65-f001-4c73-bfe3-1aed3fc10d26?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"5.9.20"}],"published":"2024-05-09T19:28:58Z","updated":"2024-05-10T07:33:39Z"},{"id":"wordfence:91f67907-9b42-4fa3-a333-2ac0d3afaaad","source":"wordfence","cve":"CVE-2026-56049","title":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer <= 4.0.19 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f67907-9b42-4fa3-a333-2ac0d3afaaad?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.0.19","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:18:06Z"},{"id":"wordfence:91f6c9d3-641d-42f7-bf11-e3c3a44eeb76","source":"wordfence","cve":"CVE-2023-5135","title":"Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f6c9d3-641d-42f7-bf11-e3c3a44eeb76?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.23.1","to_inclusive":true,"patched_in":"1.23.2"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91f7b0d3-a2d4-4689-9029-14f3463bc4fa","source":"wordfence","cve":"CVE-2025-26536","title":"Another Events Calendar <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f7b0d3-a2d4-4689-9029-14f3463bc4fa?source=api-prod","affected":[{"type":"plugin","slug":"another-events-calendar","name":"Another Events Calendar","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:53:01Z"},{"id":"wordfence:91f86c22-94db-4c43-985a-2f3dd96ece21","source":"wordfence","cve":"","title":"Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f86c22-94db-4c43-985a-2f3dd96ece21?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":false,"patched_in":"2.9.6"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91f9235e-f578-475f-92c3-34062d6d1e3d","source":"wordfence","cve":"CVE-2026-4409","title":"Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f9235e-f578-475f-92c3-34062d6d1e3d?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments-reloaded","name":"Subscribe To Comments Reloaded","from":"*","from_inclusive":true,"to":"240119","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:11:52Z","updated":"2026-05-05T02:26:56Z"},{"id":"wordfence:91f93b13-528b-42f5-9b3b-edc84d7ae3d4","source":"wordfence","cve":"CVE-2026-18395","title":"Child Pages Card <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91f93b13-528b-42f5-9b3b-edc84d7ae3d4?source=api-prod","affected":[{"type":"plugin","slug":"child-pages-card","name":"Child Pages Card","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.09"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-15T21:40:25Z"},{"id":"wordfence:91fcb76f-89b5-492e-b595-b0f91bca14a4","source":"wordfence","cve":"","title":"WP-Cumulus <= 1.22 - Cross-Site Scripting via xmlpath","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91fcb76f-89b5-492e-b595-b0f91bca14a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-cumulus","name":"WP Cumulus","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2011-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:91fe78d3-519a-4b54-afe4-8c7d00e776cb","source":"wordfence","cve":"CVE-2025-48096","title":"Custom CSS <= 1.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91fe78d3-519a-4b54-afe4-8c7d00e776cb?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-editor","name":"Custom CSS","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:55:10Z"},{"id":"wordfence:91febd9e-0b46-4f67-9ba0-97c01bf1c699","source":"wordfence","cve":"CVE-2026-16787","title":"Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/91febd9e-0b46-4f67-9ba0-97c01bf1c699?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2026-08-31T15:54:38Z","updated":"2026-09-01T04:27:51Z"},{"id":"wordfence:9202cb4d-7fd4-444d-ab44-8f6d9e68d869","source":"wordfence","cve":"CVE-2023-32743","title":"AutomateWoo <= 5.7.1 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9202cb4d-7fd4-444d-ab44-8f6d9e68d869?source=api-prod","affected":[{"type":"plugin","slug":"automatewoo","name":"AutomateWoo","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92058a88-7a65-4319-9f12-e38267e36c5c","source":"wordfence","cve":"CVE-2024-2843","title":"WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion via 'Delete'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92058a88-7a65-4319-9f12-e38267e36c5c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"30.1","to_inclusive":false,"patched_in":"30.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-02T20:19:46Z"},{"id":"wordfence:920708d9-44e8-45c4-85d4-c19bb507cca7","source":"wordfence","cve":"CVE-2026-73383","title":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping & Social Channels <= 6.6.47 - Authenticated (Shop Manager+) Arbitrary File Downloaf","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/920708d9-44e8-45c4-85d4-c19bb507cca7?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.47","to_inclusive":true,"patched_in":"6.6.48"}],"published":"2026-08-14T00:00:00Z","updated":"2026-09-09T16:10:59Z"},{"id":"wordfence:9207db0b-7c92-48b4-8d2e-2d52d6ec24de","source":"wordfence","cve":"CVE-2026-105889","title":"Tickera \u2013 Sell Tickets & Manage Events <= 3.6.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9207db0b-7c92-48b4-8d2e-2d52d6ec24de?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.6","to_inclusive":true,"patched_in":"3.6.0.7"}],"published":"2026-10-08T16:53:02Z","updated":"2026-10-13T13:56:15Z"},{"id":"wordfence:92084af7-142b-45de-8881-dee5cf1367e2","source":"wordfence","cve":"CVE-2022-4786","title":"Video.js \u2013 HTML5 Video Player for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92084af7-142b-45de-8881-dee5cf1367e2?source=api-prod","affected":[{"type":"plugin","slug":"videojs-html5-video-player-for-wordpress","name":"Video.js \u2013 HTML5 Video Player for WordPress","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:920ba51a-3434-4d7e-8b62-f9fb9e57b9d6","source":"wordfence","cve":"CVE-2025-69317","title":"CarSpot < 2.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/920ba51a-3434-4d7e-8b62-f9fb9e57b9d6?source=api-prod","affected":[{"type":"theme","slug":"carspot","name":"CarSpot \u2013 Dealership Wordpress Classified Theme","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":false,"patched_in":"2.4.6"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:16:39Z"},{"id":"wordfence:920dbe31-ccbd-4ad9-9c5f-f7389c1b4318","source":"wordfence","cve":"CVE-2024-33916","title":"CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/920dbe31-ccbd-4ad9-9c5f-f7389c1b4318?source=api-prod","affected":[{"type":"plugin","slug":"cpo-companion","name":"CPO Companion","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:59:12Z"},{"id":"wordfence:920e4111-ac5c-4562-8529-67b17ceeb506","source":"wordfence","cve":"CVE-2024-44055","title":"Oshine Modules < 3.3.8 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/920e4111-ac5c-4562-8529-67b17ceeb506?source=api-prod","affected":[{"type":"plugin","slug":"oshine-modules","name":"Oshine Modules","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":false,"patched_in":"3.3.8"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:37:32Z"},{"id":"wordfence:9213db60-c0c1-44a9-9b8c-621029c3a08f","source":"wordfence","cve":"CVE-2025-5814","title":"Profiler \u2013 What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9213db60-c0c1-44a9-9b8c-621029c3a08f?source=api-prod","affected":[{"type":"plugin","slug":"profiler-what-slowing-down","name":"Profiler \u2013 What Slowing Down Your WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-06T16:15:42Z","updated":"2025-06-07T04:22:07Z"},{"id":"wordfence:921489e9-a083-47b3-a20d-e2566b51d8d4","source":"wordfence","cve":"CVE-2017-9603","title":"WP Jobs < 1.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921489e9-a083-47b3-a20d-e2566b51d8d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobs","name":"WP Jobs","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2017-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:921616e4-2b66-4847-869a-90c1c459685f","source":"wordfence","cve":"CVE-2024-5502","title":"Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921616e4-2b66-4847-869a-90c1c459685f?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.30","to_inclusive":true,"patched_in":"2.4.31"}],"published":"2024-08-22T19:57:38Z","updated":"2024-08-23T08:29:41Z"},{"id":"wordfence:92175fc7-4880-47d4-96fa-ecbe15f61fb0","source":"wordfence","cve":"CVE-2025-30918","title":"Structured Content <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92175fc7-4880-47d4-96fa-ecbe15f61fb0?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:44:36Z"},{"id":"wordfence:921795f5-0477-474b-a9c2-3f5955c6f131","source":"wordfence","cve":"CVE-2025-47660","title":"WC Affiliate <= 2.16 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921795f5-0477-474b-a9c2-3f5955c6f131?source=api-prod","affected":[{"type":"plugin","slug":"wc-affiliate","name":"WC Affiliate \u2013 WooCommerce Affiliate Plugin","from":"*","from_inclusive":true,"to":"2.16","to_inclusive":true,"patched_in":"2.17"}],"published":"2025-05-16T00:00:00Z","updated":"2026-01-13T17:51:27Z"},{"id":"wordfence:92180939-eae9-4b8f-9fa3-cd8e79b71291","source":"wordfence","cve":"CVE-2024-38686","title":"FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92180939-eae9-4b8f-9fa3-cd8e79b71291?source=api-prod","affected":[{"type":"plugin","slug":"post-block","name":"FancyPost \u2013 Post Blocks, Grids & Sliders for Block Editor and Elementor","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:38:39Z"},{"id":"wordfence:92187edb-6388-45c0-b97f-16e83bb685f1","source":"wordfence","cve":"CVE-2025-30903","title":"SyntaxHighlighter Evolved <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92187edb-6388-45c0-b97f-16e83bb685f1?source=api-prod","affected":[{"type":"plugin","slug":"syntaxhighlighter","name":"SyntaxHighlighter Evolved","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:45:30Z"},{"id":"wordfence:921be7ff-3d38-4b69-8a1f-a64d5aabd2dd","source":"wordfence","cve":"CVE-2024-9178","title":"XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921be7ff-3d38-4b69-8a1f-a64d5aabd2dd?source=api-prod","affected":[{"type":"plugin","slug":"woo-floating-cart-lite","name":"XT Floating Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-11-04T22:58:12Z","updated":"2024-11-05T11:00:48Z"},{"id":"wordfence:921c2486-42cb-42f2-a326-e951c20bd7ea","source":"wordfence","cve":"CVE-2020-13426","title":"multi Scheduler <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921c2486-42cb-42f2-a326-e951c20bd7ea?source=api-prod","affected":[{"type":"plugin","slug":"multi-scheduler","name":"multi Scheduler","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2020-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:921d6de9-8c76-40f3-a6ed-eb749f5c446d","source":"wordfence","cve":"CVE-2024-11847","title":"WP SVG Upload <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/921d6de9-8c76-40f3-a6ed-eb749f5c446d?source=api-prod","affected":[{"type":"plugin","slug":"wp-svg-upload","name":"Wp Svg Upload","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-05T00:00:00Z","updated":"2025-03-13T14:30:50Z"},{"id":"wordfence:9220d87a-6016-4d24-9d47-81db5a6609a0","source":"wordfence","cve":"CVE-2026-91847","title":"Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9220d87a-6016-4d24-9d47-81db5a6609a0?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.1","to_inclusive":true,"patched_in":"28.2"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:08:06Z"},{"id":"wordfence:9223b028-bcdd-4ce2-b80b-710041426429","source":"wordfence","cve":"CVE-2026-57761","title":"SEOWP <= 3.12.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9223b028-bcdd-4ce2-b80b-710041426429?source=api-prod","affected":[{"type":"theme","slug":"seowp","name":"seowp","from":"*","from_inclusive":true,"to":"3.12.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-09-18T14:47:44Z"},{"id":"wordfence:9225d2ad-9045-4c96-9274-682adab3cd21","source":"wordfence","cve":"CVE-2024-37211","title":"Ali2Woo Lite <= 3.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9225d2ad-9045-4c96-9274-682adab3cd21?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2024-06-20T00:00:00Z","updated":"2024-08-01T20:26:34Z"},{"id":"wordfence:9225ebc6-bff9-4176-a86e-022ff8ec3b05","source":"wordfence","cve":"CVE-2023-47785","title":"LayerSlider <= 7.7.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9225ebc6-bff9-4176-a86e-022ff8ec3b05?source=api-prod","affected":[{"type":"plugin","slug":"LayerSlider","name":"LayerSlider","from":"*","from_inclusive":true,"to":"7.7.9","to_inclusive":true,"patched_in":"7.7.10"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92281eda-4f79-427d-af70-015f0ef9096c","source":"wordfence","cve":"CVE-2026-62034","title":"Before After Image Comparison \u2013 Visual Comparison for Two Images <= 1.1.21 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92281eda-4f79-427d-af70-015f0ef9096c?source=api-prod","affected":[{"type":"plugin","slug":"before-after-image-compare","name":"Before After Image Comparison \u2013 Visual Comparison for Two Images","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2026-10-09T12:52:11Z","updated":"2026-10-28T21:20:02Z"},{"id":"wordfence:92298f2d-aced-4177-b6e8-36e153e9c930","source":"wordfence","cve":"","title":"Contact Form 7 <= 3.5.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92298f2d-aced-4177-b6e8-36e153e9c930?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:922c029e-57a9-4c18-8598-9ea3bbc2ab69","source":"wordfence","cve":"CVE-2026-65439","title":"Ultimate Addons for Contact Form 7 <= 3.5.45 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922c029e-57a9-4c18-8598-9ea3bbc2ab69?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.45","to_inclusive":true,"patched_in":"3.5.46"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:51:58Z"},{"id":"wordfence:922ced40-defd-42a5-a57e-09e8397c7409","source":"wordfence","cve":"CVE-2025-31639","title":"Spare <= 1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922ced40-defd-42a5-a57e-09e8397c7409?source=api-prod","affected":[{"type":"theme","slug":"spare","name":"Spare - Ultimate MultiPurpose LESS Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:20:52Z"},{"id":"wordfence:922d851a-906c-4413-b6a9-a7b35a547db2","source":"wordfence","cve":"CVE-2025-50021","title":"Better Random Redirect <= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922d851a-906c-4413-b6a9-a7b35a547db2?source=api-prod","affected":[{"type":"plugin","slug":"better-random-redirect","name":"Better Random Redirect","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:57:44Z"},{"id":"wordfence:922f981d-3c14-48d3-881e-9d3a08bfab57","source":"wordfence","cve":"CVE-2025-30881","title":"Big Store <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922f981d-3c14-48d3-881e-9d3a08bfab57?source=api-prod","affected":[{"type":"theme","slug":"big-store","name":"Big Store","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T13:58:43Z"},{"id":"wordfence:922fb1e9-c285-4977-ab8d-5f08001dabb2","source":"wordfence","cve":"CVE-2026-11351","title":"ShinyStat Analytics 1.0.12 - 1.0.17 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922fb1e9-c285-4977-ab8d-5f08001dabb2?source=api-prod","affected":[{"type":"plugin","slug":"shinystat-analytics","name":"ShinyStat Analytics","from":"1.0.12","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-07-08T00:00:00Z","updated":"2026-08-07T18:27:33Z"},{"id":"wordfence:922fd4a4-88ea-417e-90c2-0062b5859a14","source":"wordfence","cve":"CVE-2026-66436","title":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0 <= 1.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/922fd4a4-88ea-417e-90c2-0062b5859a14?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T19:10:17Z"},{"id":"wordfence:92313cda-5e93-4c25-93f3-d0c23f30d290","source":"wordfence","cve":"CVE-2024-43291","title":"Void Contact Form 7 Widget For Elementor Page Builder <= 2.4.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92313cda-5e93-4c25-93f3-d0c23f30d290?source=api-prod","affected":[{"type":"plugin","slug":"cf7-widget-elementor","name":"Void Contact Form 7 Widget For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-03T16:38:18Z"},{"id":"wordfence:9231645c-aadd-4bc9-a5b7-b94802a2dd1e","source":"wordfence","cve":"CVE-2025-23778","title":"User Sync ActiveCampaign <= 1.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9231645c-aadd-4bc9-a5b7-b94802a2dd1e?source=api-prod","affected":[{"type":"plugin","slug":"registered-user-sync-activecampaign","name":"User Sync ActiveCampaign","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:18:44Z"},{"id":"wordfence:92321a3e-947b-4013-9b36-8bd6ea361f20","source":"wordfence","cve":"CVE-2016-20072","title":"BBS e-Franchise < 1.1.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92321a3e-947b-4013-9b36-8bd6ea361f20?source=api-prod","affected":[{"type":"plugin","slug":"bbs-e-franchise","name":"BBS e-Franchise","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2016-11-17T00:00:00Z","updated":"2026-07-29T16:37:26Z"},{"id":"wordfence:9232b77e-e23f-4e91-8ea3-5e740956f51e","source":"wordfence","cve":"CVE-2026-2024","title":"PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9232b77e-e23f-4e91-8ea3-5e740956f51e?source=api-prod","affected":[{"type":"plugin","slug":"photostack-gallery","name":"PhotoStack Gallery","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:10:18Z","updated":"2026-02-14T06:42:29Z"},{"id":"wordfence:9234b1ce-032f-487d-b60a-f80c78373238","source":"wordfence","cve":"CVE-2026-2917","title":"Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9234b1ce-032f-487d-b60a-f80c78373238?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":true,"patched_in":"3.21.1"}],"published":"2026-03-10T19:07:37Z","updated":"2026-07-08T15:30:56Z"},{"id":"wordfence:9239d691-c431-402e-83ce-01896c9433fc","source":"wordfence","cve":"CVE-2025-39352","title":"Grand Restaurant WordPress <= 7.0 - Missing Authorization to Unauthenticated Arbitrary Options Deletion","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9239d691-c431-402e-83ce-01896c9433fc?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:13:55Z"},{"id":"wordfence:923a274e-b41b-43a1-9069-4ffcb40a0a12","source":"wordfence","cve":"CVE-2025-30948","title":"Layouts for Elementor <= 1.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923a274e-b41b-43a1-9069-4ffcb40a0a12?source=api-prod","affected":[{"type":"plugin","slug":"layouts-for-elementor","name":"Layouts for Elementor","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.12"}],"published":"2025-06-05T00:00:00Z","updated":"2026-06-18T18:38:14Z"},{"id":"wordfence:923c513b-596f-44db-a98f-a33e8baec12e","source":"wordfence","cve":"CVE-2025-31087","title":"Multiple Shipping And Billing Address For Woocommerce <= 1.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923c513b-596f-44db-a98f-a33e8baec12e?source=api-prod","affected":[{"type":"plugin","slug":"different-shipping-and-billing-address-for-woocommerce","name":"Multiple Shipping And Billing Address For WooCommerce","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T13:58:58Z"},{"id":"wordfence:923c51ba-0ec2-4e32-a86e-404f3fe2ac7c","source":"wordfence","cve":"CVE-2026-3228","title":"NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923c51ba-0ec2-4e32-a86e-404f3fe2ac7c?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-03-09T21:33:10Z","updated":"2026-03-10T09:59:00Z"},{"id":"wordfence:923de52e-2916-4977-9306-2abd92d231de","source":"wordfence","cve":"CVE-2025-54701","title":"Unicamp <= 2.6.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923de52e-2916-4977-9306-2abd92d231de?source=api-prod","affected":[{"type":"theme","slug":"unicamp","name":"Unicamp - University and College WordPress Theme","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:59:25Z"},{"id":"wordfence:923ee3a7-a591-4132-8fbe-bd0edf8b7bb8","source":"wordfence","cve":"CVE-2025-39444","title":"MaxButtons <= 9.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923ee3a7-a591-4132-8fbe-bd0edf8b7bb8?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.8.3","to_inclusive":true,"patched_in":"9.8.4"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-23T17:54:55Z"},{"id":"wordfence:923f9e66-2e26-4ec2-a4b3-439881a6ca10","source":"wordfence","cve":"CVE-2024-5668","title":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/923f9e66-2e26-4ec2-a4b3-439881a6ca10?source=api-prod","affected":[{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.28","to_inclusive":true,"patched_in":"2.7.32"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T04:31:35Z"},{"id":"wordfence:9240aa50-f8b4-47c9-bedd-cffd4e1b4d58","source":"wordfence","cve":"CVE-2025-53466","title":"Better Find and Replace <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9240aa50-f8b4-47c9-bedd-cffd4e1b4d58?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-29T15:57:31Z"},{"id":"wordfence:924145bb-d636-4184-8f3f-578c8b11e3a6","source":"wordfence","cve":"CVE-2024-33941","title":"iPanorama 360 WordPress Virtual Tour Builder <= 1.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924145bb-d636-4184-8f3f-578c8b11e3a6?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T18:16:55Z"},{"id":"wordfence:92424e24-17db-45dc-804b-32a411f0b233","source":"wordfence","cve":"CVE-2025-31828","title":"Easy!Appointments <= 1.4.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92424e24-17db-45dc-804b-32a411f0b233?source=api-prod","affected":[{"type":"plugin","slug":"easyappointments","name":"Easy!Appointments","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-04-01T00:00:00Z","updated":"2026-02-26T15:05:14Z"},{"id":"wordfence:9242cebe-3394-4df9-9c60-8d8d6297d791","source":"wordfence","cve":"","title":"Open Graph and Twitter Card Tags <= 2.2.4.1 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9242cebe-3394-4df9-9c60-8d8d6297d791?source=api-prod","affected":[{"type":"plugin","slug":"wonderm00ns-simple-facebook-open-graph-tags","name":"Social Preview and Open Graph Tags","from":"*","from_inclusive":true,"to":"2.2.4.2","to_inclusive":false,"patched_in":"2.2.4.2"}],"published":"2018-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92474491-b9fa-49f8-9256-8400af9eef95","source":"wordfence","cve":"CVE-2018-1002003","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92474491-b9fa-49f8-9256-8400af9eef95?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92474cf6-2ae5-402f-8eb4-853277eac78d","source":"wordfence","cve":"CVE-2025-32563","title":"WP Calais Auto Tagger <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92474cf6-2ae5-402f-8eb4-853277eac78d?source=api-prod","affected":[{"type":"plugin","slug":"calais-auto-tagger","name":"WP Calais Auto Tagger","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:22:03Z"},{"id":"wordfence:92484681-e677-4a7b-b2df-40aad49baf44","source":"wordfence","cve":"CVE-2024-31930","title":"Save as PDF  <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92484681-e677-4a7b-b2df-40aad49baf44?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-25T14:07:33Z"},{"id":"wordfence:924903f8-3b25-4d56-ae37-d3afd58ad4ed","source":"wordfence","cve":"CVE-2026-32458","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924903f8-3b25-4d56-ae37-d3afd58ad4ed?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.7","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:14:41Z"},{"id":"wordfence:924a06a0-361e-4ecc-9db2-0375db7cf87a","source":"wordfence","cve":"CVE-2025-25111","title":"WP Spell Check <= 9.21 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924a06a0-361e-4ecc-9db2-0375db7cf87a?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"9.21","to_inclusive":true,"patched_in":"9.22"}],"published":"2025-02-03T00:00:00Z","updated":"2026-02-03T19:58:40Z"},{"id":"wordfence:924b6413-79f2-4f8f-8d73-74dbfb48550c","source":"wordfence","cve":"CVE-2026-24361","title":"LearnPress \u2013 Course Review <= 4.1.9 - Authenticated (Learnpress student+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924b6413-79f2-4f8f-8d73-74dbfb48550c?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-course-review","name":"LearnPress \u2013 Course Review","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-27T19:39:57Z"},{"id":"wordfence:924b98eb-c352-44ea-a0b7-42abc3df730b","source":"wordfence","cve":"CVE-2025-48285","title":"Falang multilanguage <= 1.3.61 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924b98eb-c352-44ea-a0b7-42abc3df730b?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.61","to_inclusive":true,"patched_in":"1.3.62"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:48:59Z"},{"id":"wordfence:924d7a5b-c5a1-47c5-9524-30230bfd2d05","source":"wordfence","cve":"CVE-2026-66624","title":"WPMasterToolKit (WPMTK) \u2013 All in one plugin <= 2.22.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924d7a5b-c5a1-47c5-9524-30230bfd2d05?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"2.22.0","to_inclusive":true,"patched_in":"2.23.1"}],"published":"2026-09-17T11:32:00Z","updated":"2026-09-22T18:47:25Z"},{"id":"wordfence:924d8186-63bd-4604-8262-a6481425bc7a","source":"wordfence","cve":"CVE-2026-97269","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/924d8186-63bd-4604-8262-a6481425bc7a?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2026-10-01T12:02:44Z","updated":"2026-10-09T00:14:17Z"},{"id":"wordfence:9251afbb-1a6d-40c6-b62e-a8866742f669","source":"wordfence","cve":"CVE-2022-44626","title":"SEO Plugin by Squirrly SEO <= 12.1.20 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9251afbb-1a6d-40c6-b62e-a8866742f669?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.1.20","to_inclusive":true,"patched_in":"12.1.21"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:925402a5-e203-4976-b0a9-88c974b540b9","source":"wordfence","cve":"CVE-2024-11260","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925402a5-e203-4976-b0a9-88c974b540b9?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"6.6.4"}],"published":"2025-02-20T16:21:48Z","updated":"2025-02-21T05:22:33Z"},{"id":"wordfence:925438fb-099f-4563-90ba-b4d10eac1ced","source":"wordfence","cve":"CVE-2025-53227","title":"Magazine Saga <= 1.2.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925438fb-099f-4563-90ba-b4d10eac1ced?source=api-prod","affected":[{"type":"theme","slug":"magazine-saga","name":"Magazine Saga","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:28:22Z"},{"id":"wordfence:92544c04-c499-420e-98f4-58834e579725","source":"wordfence","cve":"CVE-2026-6433","title":"Custom css-js-php <= 2.0.7 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92544c04-c499-420e-98f4-58834e579725?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-js-php","name":"Custom css-js-php","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T16:25:06Z"},{"id":"wordfence:925af22b-a728-496e-a63a-5966347ebe6c","source":"wordfence","cve":"CVE-2025-10057","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress 7.20 -  7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925af22b-a728-496e-a63a-5966347ebe6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"7.20","from_inclusive":true,"to":"7.28","to_inclusive":true,"patched_in":"7.29"}],"published":"2025-09-16T17:10:32Z","updated":"2025-09-17T05:18:46Z"},{"id":"wordfence:925b009e-3aeb-496d-8218-6ea5dc9d9989","source":"wordfence","cve":"CVE-2026-109400","title":"InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925b009e-3aeb-496d-8218-6ea5dc9d9989?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.4.1","to_inclusive":true,"patched_in":"0.1.4.2"}],"published":"2026-10-15T15:51:06Z","updated":"2026-10-16T04:27:01Z"},{"id":"wordfence:925b0a86-ed23-471c-84e2-ae78a01b1876","source":"wordfence","cve":"CVE-2024-0824","title":"Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925b0a86-ed23-471c-84e2-ae78a01b1876?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:36:52Z"},{"id":"wordfence:925ca72b-3761-42e5-aace-b31d42bc9a73","source":"wordfence","cve":"CVE-2022-25952","title":"Content Egg <= 5.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/925ca72b-3761-42e5-aace-b31d42bc9a73?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:926201d1-36bd-451f-a433-862e0484b36d","source":"wordfence","cve":"CVE-2025-48236","title":"bunny.net <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926201d1-36bd-451f-a433-862e0484b36d?source=api-prod","affected":[{"type":"plugin","slug":"bunnycdn","name":"bunny.net \u2013 WordPress CDN Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T20:57:32Z"},{"id":"wordfence:926246a7-2f0d-4472-ae0a-fa3d95e5810f","source":"wordfence","cve":"","title":"Contact List \u2013 Easy Business Directory, Staff Directory and Address Book Plugin <= 2.9.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926246a7-2f0d-4472-ae0a-fa3d95e5810f?source=api-prod","affected":[{"type":"plugin","slug":"contact-list","name":"Contact List \u2013 Online Staff Directory & Address Book","from":"*","from_inclusive":true,"to":"2.9.41","to_inclusive":true,"patched_in":"2.9.42"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:926341b5-345a-4906-b578-b32bfe2ee4ac","source":"wordfence","cve":"CVE-2017-14622","title":"2kb Amazon Affiliates Store < 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926341b5-345a-4906-b578-b32bfe2ee4ac?source=api-prod","affected":[{"type":"plugin","slug":"2kb-amazon-affiliates-store","name":"2kb Amazon Affiliates Store","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2017-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92644676-add4-415c-9a1a-c6616108688d","source":"wordfence","cve":"CVE-2020-36712","title":"Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92644676-add4-415c-9a1a-c6616108688d?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2020-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9264d7f3-cbd2-4528-8222-93a456332e9c","source":"wordfence","cve":"CVE-2026-42755","title":"TableOn \u2013 WordPress Posts Table Filterable\u00a0 <= 1.0.5.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9264d7f3-cbd2-4528-8222-93a456332e9c?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-01T16:18:52Z"},{"id":"wordfence:92651031-e6f4-46af-bd5d-d37a2834b56b","source":"wordfence","cve":"CVE-2025-58817","title":"SoftMe <= 1.1.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92651031-e6f4-46af-bd5d-d37a2834b56b?source=api-prod","affected":[{"type":"theme","slug":"softme","name":"SoftMe","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:35:29Z"},{"id":"wordfence:92652339-ec86-4069-aeee-91c314ed2540","source":"wordfence","cve":"CVE-2026-5411","title":"WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92652339-ec86-4069-aeee-91c314ed2540?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"5.38","to_inclusive":true,"patched_in":"5.39"}],"published":"2026-06-05T05:58:17Z","updated":"2026-06-05T18:31:12Z"},{"id":"wordfence:926550bb-265d-4811-a375-10c47e9fb4d6","source":"wordfence","cve":"CVE-2023-2189","title":"Elementor Addons, Widgets and Enhancements \u2013 Stax <= 1.4.3 - Missing Authorization in toggle_widget","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926550bb-265d-4811-a375-10c47e9fb4d6?source=api-prod","affected":[{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92663d4a-da6f-433b-afe9-13c6c17c69fa","source":"wordfence","cve":"CVE-2026-109684","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92663d4a-da6f-433b-afe9-13c6c17c69fa?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:46:49Z"},{"id":"wordfence:926646de-4fb0-4460-b0d1-4d451e6505ca","source":"wordfence","cve":"CVE-2024-13462","title":"WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926646de-4fb0-4460-b0d1-4d451e6505ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-wiki-tooltip","name":"WP Wiki Tooltip","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-02-18T19:21:58Z","updated":"2025-08-11T14:26:37Z"},{"id":"wordfence:926827a5-4231-4188-bece-fd37c1829412","source":"wordfence","cve":"CVE-2022-4000","title":"WooCommerce Shipping \u2013 DPD baltic <= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926827a5-4231-4188-bece-fd37c1829412?source=api-prod","affected":[{"type":"plugin","slug":"woo-shipping-dpd-baltic","name":"DPD Baltic Shipping","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9269c3e7-2495-4665-ad08-d6dcf659db21","source":"wordfence","cve":"CVE-2024-31235","title":"WordPress Comments Import & Export <= 2.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9269c3e7-2495-4665-ad08-d6dcf659db21?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T17:00:50Z"},{"id":"wordfence:9269d18d-8d83-43ff-b777-ba8f58321e9e","source":"wordfence","cve":"CVE-2025-4672","title":"Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9269d18d-8d83-43ff-b777-ba8f58321e9e?source=api-prod","affected":[{"type":"plugin","slug":"offsprout-page-builder","name":"Offsprout Page Builder","from":"2.2.1","from_inclusive":true,"to":"2.15.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T18:09:03Z","updated":"2025-05-31T06:40:56Z"},{"id":"wordfence:9269e358-83cb-42e7-a30d-79f1504e576c","source":"wordfence","cve":"CVE-2014-9524","title":"Easy Social Like Box \u2013 Popup \u2013 Sidebar Widget < 2.8.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9269e358-83cb-42e7-a30d-79f1504e576c?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-facebook-like-box","name":"Easy Social Like Box \u2013 Popup \u2013 Sidebar Widget","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:926b0a28-17b8-4d28-b911-03c75c2e64c9","source":"wordfence","cve":"CVE-2026-13613","title":"KiviCare <= 4.5.1 - Authenticated (Authenticated+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926b0a28-17b8-4d28-b911-03c75c2e64c9?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:17:39Z"},{"id":"wordfence:926c09d5-3824-4745-99f6-50d9c945d252","source":"wordfence","cve":"CVE-2024-1376","title":"Event post <= 5.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926c09d5-3824-4745-99f6-50d9c945d252?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2024-05-23T18:07:59Z","updated":"2026-09-09T16:19:13Z"},{"id":"wordfence:926e5e4c-ea78-46f2-8fac-d9ee71aeaab8","source":"wordfence","cve":"CVE-2025-49865","title":"Advanced Settings <= 3.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926e5e4c-ea78-46f2-8fac-d9ee71aeaab8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-settings","name":"Advanced Settings 3","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:51:14Z"},{"id":"wordfence:926e7bbf-7e19-4bc3-b976-5003399cdcdc","source":"wordfence","cve":"CVE-2025-67518","title":"Accordion Slider PRO <= 1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/926e7bbf-7e19-4bc3-b976-5003399cdcdc?source=api-prod","affected":[{"type":"plugin","slug":"accordion_slider_pro","name":"Accordion Slider PRO","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T17:13:52Z"},{"id":"wordfence:92705581-9a0d-4d23-9118-fec9100e4ce1","source":"wordfence","cve":"CVE-2026-2499","title":"Custom Logo <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Logo Path Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92705581-9a0d-4d23-9118-fec9100e4ce1?source=api-prod","affected":[{"type":"plugin","slug":"custom-logo","name":"Custom Logo","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T12:48:46Z","updated":"2026-02-26T01:24:15Z"},{"id":"wordfence:927076bc-bafa-43d6-bf3b-5861844c932a","source":"wordfence","cve":"CVE-2024-12031","title":"Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/927076bc-bafa-43d6-bf3b-5861844c932a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-floating-content","name":"Advanced Floating Content","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T09:22:23Z"},{"id":"wordfence:9271c465-cc60-4e0f-a2e4-f0a428ca3ded","source":"wordfence","cve":"CVE-2024-52458","title":"TM Islamic Helper <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9271c465-cc60-4e0f-a2e4-f0a428ca3ded?source=api-prod","affected":[{"type":"plugin","slug":"tm-islamic-helper","name":"TM Islamic Helper","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:21:31Z"},{"id":"wordfence:92734acf-2021-4217-8cdd-a9d269198db3","source":"wordfence","cve":"CVE-2023-45005","title":"Seriously Simple Stats <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92734acf-2021-4217-8cdd-a9d269198db3?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-stats","name":"Seriously Simple Stats","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92745a9c-49d4-4d73-9f95-5973ad01aa55","source":"wordfence","cve":"CVE-2025-27013","title":"MediCenter - Health Medical Clinic WordPress Theme <= 14.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92745a9c-49d4-4d73-9f95-5973ad01aa55?source=api-prod","affected":[{"type":"theme","slug":"medicenter","name":"MediCenter - Health Medical Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"14.6","to_inclusive":true,"patched_in":"14.7"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-24T15:27:19Z"},{"id":"wordfence:92749a6c-388c-4b4e-b29f-f35aada96367","source":"wordfence","cve":"CVE-2024-47336","title":"Terms descriptions <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92749a6c-388c-4b4e-b29f-f35aada96367?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-09-26T00:00:00Z","updated":"2024-12-23T17:35:36Z"},{"id":"wordfence:927674db-05f1-4f3b-8297-8a907955ea87","source":"wordfence","cve":"CVE-2024-11289","title":"Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/927674db-05f1-4f3b-8297-8a907955ea87?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.5.9","to_inclusive":true,"patched_in":"8.6.0"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T09:22:59Z"},{"id":"wordfence:927696bd-bf0c-4f15-9b06-21c3d0a11aed","source":"wordfence","cve":"CVE-2023-4862","title":"File Manager Pro <= 1.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/927696bd-bf0c-4f15-9b06-21c3d0a11aed?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9279e01d-53b8-4816-b405-0db2f984cb5a","source":"wordfence","cve":"CVE-2026-13200","title":"Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9279e01d-53b8-4816-b405-0db2f984cb5a?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-09-18T19:11:33Z","updated":"2026-09-19T07:43:18Z"},{"id":"wordfence:9279ffc8-ab81-4dae-9174-49103b990d0d","source":"wordfence","cve":"CVE-2025-31431","title":"WP Bookmarks <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9279ffc8-ab81-4dae-9174-49103b990d0d?source=api-prod","affected":[{"type":"plugin","slug":"wp-bookmarks","name":"WP Bookmarks","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:49:15Z"},{"id":"wordfence:927f94b0-2a5d-4d17-a05b-7940d7976158","source":"wordfence","cve":"CVE-2025-12525","title":"Locker Content <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/927f94b0-2a5d-4d17-a05b-7940d7976158?source=api-prod","affected":[{"type":"plugin","slug":"locker-content","name":"Locker Content \u2014 Content Locking & Engagement Gates","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-11-24T19:16:22Z","updated":"2025-11-25T19:13:09Z"},{"id":"wordfence:928352ea-f6ce-4bc7-8f0c-8e3c4d075a95","source":"wordfence","cve":"CVE-2026-12690","title":"ProfileGrid <= 5.9.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928352ea-f6ce-4bc7-8f0c-8e3c4d075a95?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.6","to_inclusive":true,"patched_in":"5.9.9.7"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-29T22:39:42Z"},{"id":"wordfence:9283f6ea-8bc4-4fdd-a0b9-05de127f34e4","source":"wordfence","cve":"CVE-2026-0572","title":"WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9283f6ea-8bc4-4fdd-a0b9-05de127f34e4?source=api-prod","affected":[{"type":"plugin","slug":"webpurifytextreplace","name":"WebPurify Profanity Filter","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-02-03T19:32:52Z","updated":"2026-02-13T08:53:10Z"},{"id":"wordfence:928584e5-7391-4442-820e-d5d5fc288572","source":"wordfence","cve":"CVE-2007-4014","title":"Blix <= 0.9.1, Blixed <= 1.0, BlixKrieg <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928584e5-7391-4442-820e-d5d5fc288572?source=api-prod","affected":[{"type":"theme","slug":"blixed","name":"blixed","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"blixkrieg","name":"BlixKrieg","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"blix","name":"Blix","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":""}],"published":"2007-07-18T00:00:00Z","updated":"2026-02-25T13:27:18Z"},{"id":"wordfence:92880588-a733-43df-adf6-74fe6291822d","source":"wordfence","cve":"CVE-2023-25710","title":"Click to Call or Chat Buttons <= 1.4.0 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92880588-a733-43df-adf6-74fe6291822d?source=api-prod","affected":[{"type":"plugin","slug":"click-to-call-or-chat-buttons","name":"Click to Call or Chat Buttons","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:928877a6-eeeb-4ed5-900b-9b1560e1bf87","source":"wordfence","cve":"CVE-2025-14440","title":"JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie","severity":"critical","cvss":9.8,"cwe":"CWE-565","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=api-prod","affected":[{"type":"plugin","slug":"jay-login-register","name":"JAY Login & Register","from":"*","from_inclusive":true,"to":"2.4.01","to_inclusive":true,"patched_in":"2.5.01"}],"published":"2025-12-12T16:06:15Z","updated":"2025-12-19T14:27:44Z"},{"id":"wordfence:9288ed60-b14b-4188-84d4-efe770093551","source":"wordfence","cve":"CVE-2025-11519","title":"Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9288ed60-b14b-4188-84d4-efe770093551?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-10-17T18:03:14Z","updated":"2025-10-18T06:42:47Z"},{"id":"wordfence:92895f8e-59c9-4988-9d7a-2601880d71a2","source":"wordfence","cve":"CVE-2020-4049","title":"WordPress Core < 5.4.2 - Self-Cross Site Scripting via Theme Folder Name","severity":"low","cvss":2.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92895f8e-59c9-4988-9d7a-2601880d71a2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-05-31T15:30:47Z"},{"id":"wordfence:9289e93c-22ac-4f3f-8a8a-591d9a598713","source":"wordfence","cve":"CVE-2025-12118","title":"Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9289e93c-22ac-4f3f-8a8a-591d9a598713?source=api-prod","affected":[{"type":"plugin","slug":"schema-scalpel","name":"Schema Scalpel","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T04:27:41Z"},{"id":"wordfence:928b4c4f-0614-410a-857b-90037770cfbf","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 2.55 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928b4c4f-0614-410a-857b-90037770cfbf?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.55","to_inclusive":true,"patched_in":"2.56"}],"published":"2013-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:928bb18a-0453-49a1-8bd1-7d0d8350fd8f","source":"wordfence","cve":"CVE-2026-92924","title":"Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928bb18a-0453-49a1-8bd1-7d0d8350fd8f?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T00:03:17Z"},{"id":"wordfence:928dd5c1-c396-4ddb-b910-697884dbc824","source":"wordfence","cve":"CVE-2026-65464","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928dd5c1-c396-4ddb-b910-697884dbc824?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":true,"patched_in":"4.16.4"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:53:35Z"},{"id":"wordfence:928df20e-6c5b-46a4-a814-28d15cb0e1c2","source":"wordfence","cve":"CVE-2026-66625","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/928df20e-6c5b-46a4-a814-28d15cb0e1c2?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":true,"patched_in":"2.7.2.2"}],"published":"2026-09-17T10:49:00Z","updated":"2026-09-22T18:47:37Z"},{"id":"wordfence:9290532f-58d7-4e7d-9fa0-89c7f82b0466","source":"wordfence","cve":"CVE-2023-23688","title":"Social Share Boost <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ssboost shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9290532f-58d7-4e7d-9fa0-89c7f82b0466?source=api-prod","affected":[{"type":"plugin","slug":"social-share-boost","name":"Social Share Boost","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:929085b2-3038-41d1-bd61-ce9e7dc79f78","source":"wordfence","cve":"CVE-2022-37407","title":"Gallery PhotoBlocks <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929085b2-3038-41d1-bd61-ce9e7dc79f78?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:929152b6-d7eb-4a81-a1cc-453cf17c6e25","source":"wordfence","cve":"CVE-2026-66587","title":"WP Cafe Pro  <= 3.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929152b6-d7eb-4a81-a1cc-453cf17c6e25?source=api-prod","affected":[{"type":"plugin","slug":"wpcafe-pro","name":"WP Cafe Pro","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:54:53Z"},{"id":"wordfence:92915943-c6ff-46df-adbd-382eabe44021","source":"wordfence","cve":"","title":"Manage WP Worker <= 4.9.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92915943-c6ff-46df-adbd-382eabe44021?source=api-prod","affected":[{"type":"plugin","slug":"worker","name":"ManageWP Worker","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2020-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92917534-54c0-478e-ae7e-92195ae0a32a","source":"wordfence","cve":"CVE-2026-77787","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92917534-54c0-478e-ae7e-92195ae0a32a?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:39:33Z"},{"id":"wordfence:9291dff0-84f0-4818-b71d-e68cab530698","source":"wordfence","cve":"CVE-2026-27418","title":"WP Fast Total Search \u2013 The Power of Indexed Search <= 1.81.282 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9291dff0-84f0-4818-b71d-e68cab530698?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.81.282","to_inclusive":true,"patched_in":"1.81.284"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-17T03:38:16Z"},{"id":"wordfence:92928f3b-cf45-4735-87d7-040afa4857f4","source":"wordfence","cve":"CVE-2024-4469","title":"Migration Backup Restore <= 3.4.3 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92928f3b-cf45-4735-87d7-040afa4857f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-16T09:01:23Z"},{"id":"wordfence:92947896-5ec1-4c5c-9eed-37f3566dbf6f","source":"wordfence","cve":"CVE-2025-53236","title":"UDesign Core <= 4.14.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92947896-5ec1-4c5c-9eed-37f3566dbf6f?source=api-prod","affected":[{"type":"plugin","slug":"u-design-core","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-06T00:00:00Z","updated":"2025-10-29T20:00:25Z"},{"id":"wordfence:9295126c-f188-4616-9959-8fd2520566b4","source":"wordfence","cve":"CVE-2026-39786","title":"BA Book Everything <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9295126c-f188-4616-9959-8fd2520566b4?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.8.33","to_inclusive":true,"patched_in":"1.8.34"}],"published":"2026-10-30T07:22:08Z","updated":"2026-11-03T19:57:32Z"},{"id":"wordfence:92959269-464f-4845-9381-fffb2ff66c56","source":"wordfence","cve":"CVE-2026-12688","title":"ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92959269-464f-4845-9381-fffb2ff66c56?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.9.6","to_inclusive":true,"patched_in":"5.9.9.7"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-30T13:35:52Z"},{"id":"wordfence:929674a1-348e-44b6-b849-72ed5e5d39d9","source":"wordfence","cve":"CVE-2024-56034","title":"Services updates for customers <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929674a1-348e-44b6-b849-72ed5e5d39d9?source=api-prod","affected":[{"type":"plugin","slug":"service-updates-for-customers","name":"Services updates for customers","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:05:00Z"},{"id":"wordfence:92967831-fb76-494e-af95-146dc26b01d9","source":"wordfence","cve":"CVE-2026-27535","title":"Solace Extra <= 1.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92967831-fb76-494e-af95-146dc26b01d9?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:02:38Z"},{"id":"wordfence:92967cd6-3619-4892-b481-75a35a0f2c33","source":"wordfence","cve":"CVE-2024-51855","title":"Redirecter <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92967cd6-3619-4892-b481-75a35a0f2c33?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-for-redirection","name":"Redirecter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:03:17Z"},{"id":"wordfence:9296deb9-51c5-4390-b121-2f6ac8adcc97","source":"wordfence","cve":"CVE-2024-53710","title":"ITERAS <= 1.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9296deb9-51c5-4390-b121-2f6ac8adcc97?source=api-prod","affected":[{"type":"plugin","slug":"iteras","name":"ITERAS","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-11-22T00:00:00Z","updated":"2025-02-11T21:00:47Z"},{"id":"wordfence:9298820e-3753-41b3-8ba6-9fb494e215a8","source":"wordfence","cve":"CVE-2025-3294","title":"WP Editor <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9298820e-3753-41b3-8ba6-9fb494e215a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.9.1","to_inclusive":true,"patched_in":"1.2.9.2"}],"published":"2025-04-16T17:10:07Z","updated":"2025-04-17T05:23:21Z"},{"id":"wordfence:929bb635-0d1c-423e-ac39-2fec4c19f862","source":"wordfence","cve":"CVE-2026-86601","title":"Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929bb635-0d1c-423e-ac39-2fec4c19f862?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:52:19Z"},{"id":"wordfence:929bc383-cafc-4f70-9589-b630756b1143","source":"wordfence","cve":"CVE-2025-48364","title":"rajce <= 0.4.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929bc383-cafc-4f70-9589-b630756b1143?source=api-prod","affected":[{"type":"plugin","slug":"rajce","name":"Raj\u010de","from":"*","from_inclusive":true,"to":"0.4.2","to_inclusive":true,"patched_in":"0.5.0"}],"published":"2025-08-20T00:00:00Z","updated":"2026-11-03T22:44:14Z"},{"id":"wordfence:929de794-756c-4074-8361-17f7eebc07a8","source":"wordfence","cve":"CVE-2025-69186","title":"Hospital Doctor Directory <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929de794-756c-4074-8361-17f7eebc07a8?source=api-prod","affected":[{"type":"plugin","slug":"hospital-doctor-directory","name":"Hospital Doctor Directory","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:03:20Z"},{"id":"wordfence:929ec66c-a4b2-4846-8330-65fd0e595e58","source":"wordfence","cve":"CVE-2024-34561","title":"3D FlipBook, PDF Viewer, PDF Embedder \u2013 Real 3D FlipBook WordPress Plugin <= 3.71 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929ec66c-a4b2-4846-8330-65fd0e595e58?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"3.71","to_inclusive":true,"patched_in":"3.72"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:54:55Z"},{"id":"wordfence:929fd4e6-9040-41cb-98f0-0cfdd80caf42","source":"wordfence","cve":"CVE-2024-30510","title":"Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/929fd4e6-9040-41cb-98f0-0cfdd80caf42?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.5","to_inclusive":true,"patched_in":"9.5.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T14:53:40Z"},{"id":"wordfence:92a00fb4-7b50-43fd-ac04-5d6e29336e9c","source":"wordfence","cve":"CVE-2024-4898","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a00fb4-7b50-43fd-ac04-5d6e29336e9c?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.38","to_inclusive":true,"patched_in":"0.1.0.39"}],"published":"2024-06-11T21:44:53Z","updated":"2024-06-12T11:05:07Z"},{"id":"wordfence:92a120ac-66ae-4678-a87a-e62da885d50b","source":"wordfence","cve":"CVE-2026-0953","title":"Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a120ac-66ae-4678-a87a-e62da885d50b?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-03-09T16:33:12Z","updated":"2026-03-10T05:26:28Z"},{"id":"wordfence:92a20a1f-6403-4561-acd8-5b076fe2999f","source":"wordfence","cve":"CVE-2023-32577","title":"DevBuddy Twitter Feed <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a20a1f-6403-4561-acd8-5b076fe2999f?source=api-prod","affected":[{"type":"plugin","slug":"devbuddy-twitter-feed","name":"DevBuddy Twitter Feed","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92a234cb-9807-4ee5-b727-bc3bdacd77aa","source":"wordfence","cve":"CVE-2025-47678","title":"FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a234cb-9807-4ee5-b727-bc3bdacd77aa?source=api-prod","affected":[{"type":"plugin","slug":"funnelcockpit","name":"FunnelCockpit","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-05-09T00:00:00Z","updated":"2025-08-05T12:57:42Z"},{"id":"wordfence:92a35989-2b71-4eca-aae0-c8ea0d60ce40","source":"wordfence","cve":"CVE-2025-68601","title":"Five Star Restaurant Reservations <= 2.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a35989-2b71-4eca-aae0-c8ea0d60ce40?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2025-12-24T00:00:00Z","updated":"2026-02-10T19:09:06Z"},{"id":"wordfence:92a3e622-b3b2-450e-82a7-0a942711e8c0","source":"wordfence","cve":"CVE-2023-47774","title":"Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection","severity":"medium","cvss":5.0,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a3e622-b3b2-450e-82a7-0a942711e8c0?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":false,"patched_in":"12.7"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92a4bfab-6813-42c2-b1dd-f0b88c494e0f","source":"wordfence","cve":"CVE-2026-65474","title":"Ninja Tables \u2013 Easy Data Table Builder <= 5.2.10 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a4bfab-6813-42c2-b1dd-f0b88c494e0f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":true,"patched_in":"5.2.11"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:06:07Z"},{"id":"wordfence:92a50f24-7011-4fe4-a095-e7e320bfec81","source":"wordfence","cve":"CVE-2024-6545","title":"Admin Trim Interface <= 3.5.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a50f24-7011-4fe4-a095-e7e320bfec81?source=api-prod","affected":[{"type":"plugin","slug":"admin-trim-interface","name":"Admin Trim Interface","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:08:35Z","updated":"2024-07-27T01:51:04Z"},{"id":"wordfence:92a543e2-1af1-4857-8e2f-c8658eac7fe0","source":"wordfence","cve":"CVE-2023-4311","title":"Vrm 360 3D Model Viewer <= 1.2.1 - Authenticated (Contributor+) Arbitrary File Upload","severity":"medium","cvss":5.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a543e2-1af1-4857-8e2f-c8658eac7fe0?source=api-prod","affected":[{"type":"plugin","slug":"vrm360","name":"Vrm 360 3D Model Viewer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92a81d4a-58ed-4812-a1f8-db86e410393c","source":"wordfence","cve":"CVE-2025-62983","title":"Posts By Tag <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a81d4a-58ed-4812-a1f8-db86e410393c?source=api-prod","affected":[{"type":"plugin","slug":"posts-by-tag","name":"Posts By Tag","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-29T14:37:57Z"},{"id":"wordfence:92a9ca70-2867-433a-932e-191ed7f01945","source":"wordfence","cve":"","title":"CSV Import <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92a9ca70-2867-433a-932e-191ed7f01945?source=api-prod","affected":[{"type":"plugin","slug":"csv-import","name":"CSV Import","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2016-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92aae1f6-e624-4619-8195-ee3c443a31fc","source":"wordfence","cve":"CVE-2023-47550","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92aae1f6-e624-4619-8195-ee3c443a31fc?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92ab1f56-5ca6-48e8-b380-ac2e302d63d2","source":"wordfence","cve":"CVE-2025-12066","title":"WP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ab1f56-5ca6-48e8-b380-ac2e302d63d2?source=api-prod","affected":[{"type":"plugin","slug":"etruel-del-post-copies","name":"WP Delete Post Copies","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-11-20T20:39:08Z","updated":"2025-11-21T09:27:01Z"},{"id":"wordfence:92ab9ad3-1c93-4791-9fc0-a3cf59eca9d8","source":"wordfence","cve":"CVE-2024-53795","title":"Church Admin <= 5.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ab9ad3-1c93-4791-9fc0-a3cf59eca9d8?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:37:41Z"},{"id":"wordfence:92abab9e-904a-4a62-a911-a57baa9aa4af","source":"wordfence","cve":"CVE-2024-9614","title":"Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92abab9e-904a-4a62-a911-a57baa9aa4af?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms-by-mailmunch","name":"Constant Contact Forms by MailMunch","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-11-12T13:25:02Z","updated":"2024-11-25T16:11:43Z"},{"id":"wordfence:92abc078-4fdd-4afe-aa46-cdd3a18161f4","source":"wordfence","cve":"CVE-2026-66671","title":"Verdure Core <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92abc078-4fdd-4afe-aa46-cdd3a18161f4?source=api-prod","affected":[{"type":"plugin","slug":"verdure-core","name":"Verdure Core","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-01T13:19:26Z"},{"id":"wordfence:92acc393-b483-4a86-b393-8466867c94d3","source":"wordfence","cve":"CVE-2026-107907","title":"MAS Videos < 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92acc393-b483-4a86-b393-8466867c94d3?source=api-prod","affected":[{"type":"plugin","slug":"masvideos","name":"MAS Videos","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"}],"published":"2026-10-21T00:00:00Z","updated":"2026-11-10T23:22:03Z"},{"id":"wordfence:92ad097a-9559-42c0-baed-b4d0ada19711","source":"wordfence","cve":"CVE-2024-13580","title":"XV Random Quotes <= 1.40 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ad097a-9559-42c0-baed-b4d0ada19711?source=api-prod","affected":[{"type":"plugin","slug":"xv-random-quotes","name":"XV Random Quotes","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T15:57:27Z"},{"id":"wordfence:92ae41bb-fc9a-486f-937d-e755b7f840fe","source":"wordfence","cve":"CVE-2025-31407","title":"Tiger <= 2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ae41bb-fc9a-486f-937d-e755b7f840fe?source=api-prod","affected":[{"type":"theme","slug":"tiger","name":"Tiger","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T14:32:22Z"},{"id":"wordfence:92ae6f51-a6cb-46ce-b45b-ca4f12f5a67f","source":"wordfence","cve":"","title":"RokNewsPager <= 1.17 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ae6f51-a6cb-46ce-b45b-ca4f12f5a67f?source=api-prod","affected":[{"type":"plugin","slug":"wp_roknewspager","name":"RokNewsPager","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92b1a47e-31e2-4cfd-a24c-460ff2f00d09","source":"wordfence","cve":"","title":"Webcam 2Way Videochat <= 4.41 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b1a47e-31e2-4cfd-a24c-460ff2f00d09?source=api-prod","affected":[{"type":"plugin","slug":"webcam-2way-videochat","name":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat","from":"*","from_inclusive":true,"to":"4.41","to_inclusive":true,"patched_in":"4.41.2"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92b1db98-aa8e-45ab-83c4-495f6390ee17","source":"wordfence","cve":"CVE-2026-25408","title":"Broken Link Notifier <= 1.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b1db98-aa8e-45ab-83c4-495f6390ee17?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-notifier","name":"Broken Link Notifier","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-01-29T00:00:00Z","updated":"2026-03-06T14:43:09Z"},{"id":"wordfence:92b29336-6a1d-427b-875f-268faa4cb6b1","source":"wordfence","cve":"CVE-2026-111406","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b29336-6a1d-427b-875f-268faa4cb6b1?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.1","to_inclusive":true,"patched_in":"8.16.2"}],"published":"2026-10-17T08:20:59Z","updated":"2026-10-23T18:42:24Z"},{"id":"wordfence:92b4d800-2895-4f7b-8b3b-ee6df75a7908","source":"wordfence","cve":"CVE-2023-3407","title":"Subscribe2 <= 10.40 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.40","to_inclusive":true,"patched_in":"10.41"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92b677b1-cd63-4586-bb86-dff43dd8ff33","source":"wordfence","cve":"CVE-2026-22495","title":"Greenville | Private School & University Education WordPress Theme <= 1.3.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b677b1-cd63-4586-bb86-dff43dd8ff33?source=api-prod","affected":[{"type":"theme","slug":"greenville","name":"Greenville | Private School & University Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:14:41Z"},{"id":"wordfence:92b8829e-a8eb-4fdb-a772-9efbb5aaeb6c","source":"wordfence","cve":"CVE-2023-45104","title":"BetterLinks <= 1.6.0 - Improper Authorization to Data Import and Export","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b8829e-a8eb-4fdb-a772-9efbb5aaeb6c?source=api-prod","affected":[{"type":"plugin","slug":"betterlinks","name":"BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92babbbf-74bd-474f-9057-c5022a7d64c7","source":"wordfence","cve":"CVE-2026-114570","title":"WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92babbbf-74bd-474f-9057-c5022a7d64c7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-10-22T05:29:50Z"},{"id":"wordfence:92bb3464-c15b-4d95-8732-9d3bd801999a","source":"wordfence","cve":"CVE-2025-23818","title":"More Link Modifier <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92bb3464-c15b-4d95-8732-9d3bd801999a?source=api-prod","affected":[{"type":"plugin","slug":"more-link-modifier","name":"More Link Modifier","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:26:59Z"},{"id":"wordfence:92bcdbd9-1f41-4990-9bea-587fb0e7355a","source":"wordfence","cve":"CVE-2023-23829","title":"Owl Carousel <= 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92bcdbd9-1f41-4990-9bea-587fb0e7355a?source=api-prod","affected":[{"type":"plugin","slug":"owl-carousel","name":"Owl Carousel","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92bd8f53-7845-4741-84e7-4930dfa973ea","source":"wordfence","cve":"CVE-2018-11525","title":"Advanced Order Export For WooCommerce <= 1.5.4 - CSV Injection","severity":"high","cvss":7.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92bd8f53-7845-4741-84e7-4930dfa973ea?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2018-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92bdf5c9-37ef-450a-874c-e21a60b03baa","source":"wordfence","cve":"CVE-2024-31270","title":"ARForms Form Builder <= 1.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92bdf5c9-37ef-450a-874c-e21a60b03baa?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:32:16Z"},{"id":"wordfence:92c072d0-92de-4189-8ccd-c8d9b748855b","source":"wordfence","cve":"CVE-2025-26891","title":"Ibtana <= 1.2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c072d0-92de-4189-8ccd-c8d9b748855b?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:10:23Z"},{"id":"wordfence:92c16bb5-b52c-4453-9121-0c9d056a0cdb","source":"wordfence","cve":"CVE-2021-24904","title":"Mortgage Calculators WP < 1.53 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c16bb5-b52c-4453-9121-0c9d056a0cdb?source=api-prod","affected":[{"type":"plugin","slug":"mortgage-calculators-wp","name":"Mortgage Calculators WP","from":"*","from_inclusive":true,"to":"1.53","to_inclusive":false,"patched_in":"1.53"}],"published":"2022-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92c1bd85-5f81-4bb6-b6af-6cda85b91b9e","source":"wordfence","cve":"CVE-2025-3488","title":"WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c1bd85-5f81-4bb6-b6af-6cda85b91b9e?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"3.6.0","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2025-05-01T17:11:30Z","updated":"2025-05-02T05:22:36Z"},{"id":"wordfence:92c22d7e-64d5-465e-b7c2-62b6d9db4cc5","source":"wordfence","cve":"CVE-2025-58916","title":"Author: Munzir <= 0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c22d7e-64d5-465e-b7c2-62b6d9db4cc5?source=api-prod","affected":[{"type":"plugin","slug":"myshouts-shoutbox","name":"Author: Munzir","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T00:00:00Z","updated":"2025-10-29T20:20:45Z"},{"id":"wordfence:92c37a5e-7896-44f6-807d-61e06bfbda99","source":"wordfence","cve":"CVE-2025-68881","title":"AppExperts <= 1.4.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c37a5e-7896-44f6-807d-61e06bfbda99?source=api-prod","affected":[{"type":"plugin","slug":"appexperts","name":"APPExperts \u2013 Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:07:34Z"},{"id":"wordfence:92c3d275-5fb3-4a8e-8a00-fcfed00e2fa0","source":"wordfence","cve":"CVE-2025-15689","title":"Capella | Restaurant WordPress <= 2.5.5 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c3d275-5fb3-4a8e-8a00-fcfed00e2fa0?source=api-prod","affected":[{"type":"theme","slug":"capella","name":"Capella | Restaurant WordPress","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:07:00Z"},{"id":"wordfence:92c49231-f042-4ecc-8e31-ffe55b695c73","source":"wordfence","cve":"CVE-2025-26953","title":"JetMenu <= 2.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c49231-f042-4ecc-8e31-ffe55b695c73?source=api-prod","affected":[{"type":"plugin","slug":"jet-menu","name":"JetMenu","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.9.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:10:57Z"},{"id":"wordfence:92c52129-7cf5-4a1b-80a1-b01140e6a72b","source":"wordfence","cve":"CVE-2026-1296","title":"Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c52129-7cf5-4a1b-80a1-b01140e6a72b?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission-manager-lite","name":"Frontend Post Submission Manager Lite \u2013 Guest Post and Frontend Submission Forms","from":"1.0.0","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-02-17T16:14:54Z","updated":"2026-02-18T04:35:44Z"},{"id":"wordfence:92c5c282-9193-41b3-9c1e-cd700765f346","source":"wordfence","cve":"","title":"Global Flash Gallery < 0.13.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c5c282-9193-41b3-9c1e-cd700765f346?source=api-prod","affected":[{"type":"plugin","slug":"global-flash-galleries","name":"Global Flash Gallery","from":"*","from_inclusive":true,"to":"0.13.3","to_inclusive":true,"patched_in":"0.13.4"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92c79e51-3b14-4d1c-893b-a683b55f3011","source":"wordfence","cve":"CVE-2014-10387","title":"Support Plus Responsive Ticket System <= 4.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c79e51-3b14-4d1c-893b-a683b55f3011?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2014-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92c88e7f-9393-4e44-8a1d-314f6560bf63","source":"wordfence","cve":"CVE-2015-9398","title":"GoCodes <= 1.3.5 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c88e7f-9393-4e44-8a1d-314f6560bf63?source=api-prod","affected":[{"type":"plugin","slug":"gocodes","name":"GoCodes","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92c8ce3d-a9a1-41ba-a8f8-e4d821108a6d","source":"wordfence","cve":"CVE-2024-56033","title":"FAQs <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c8ce3d-a9a1-41ba-a8f8-e4d821108a6d?source=api-prod","affected":[{"type":"plugin","slug":"faqs","name":"FAQs","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:53:50Z"},{"id":"wordfence:92c90d09-3673-4298-9c54-c3fe1edf6c09","source":"wordfence","cve":"CVE-2026-110071","title":"Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92c90d09-3673-4298-9c54-c3fe1edf6c09?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-10-27T17:40:57Z","updated":"2026-10-28T06:45:16Z"},{"id":"wordfence:92ccd3dd-3fad-47f9-8cc3-99be4bb8906a","source":"wordfence","cve":"CVE-2025-64271","title":"Plugin Manager <= 1.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ccd3dd-3fad-47f9-8cc3-99be4bb8906a?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-manager","name":"WP Plugin Manager \u2013 Deactivate plugins per page","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-11-13T00:00:00Z","updated":"2025-11-17T19:23:14Z"},{"id":"wordfence:92cdb716-8e45-41ea-8805-527d20a4bcb5","source":"wordfence","cve":"CVE-2021-24504","title":"WP LMS \u2013 Best WordPress LMS Plugin <= 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92cdb716-8e45-41ea-8805-527d20a4bcb5?source=api-prod","affected":[{"type":"plugin","slug":"learn-manager","name":"WP Learn Manager","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2021-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92cdf0ca-8e63-4b2a-8bbc-d4ddf87eb6ca","source":"wordfence","cve":"CVE-2025-69306","title":"Electio Core <= 1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92cdf0ca-8e63-4b2a-8bbc-d4ddf87eb6ca?source=api-prod","affected":[{"type":"plugin","slug":"electio-core","name":"Electio Core","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:21:58Z"},{"id":"wordfence:92d048a2-3ecb-466d-9e0c-f1b654d2a944","source":"wordfence","cve":"CVE-2025-48300","title":"Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d048a2-3ecb-466d-9e0c-f1b654d2a944?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:25:48Z"},{"id":"wordfence:92d106c6-a910-4f41-94d1-59f6b7f3aeb0","source":"wordfence","cve":"CVE-2025-5398","title":"Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d106c6-a910-4f41-94d1-59f6b7f3aeb0?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.10.2.1","to_inclusive":true,"patched_in":"3.10.2.2"}],"published":"2025-06-26T00:00:00Z","updated":"2025-06-27T09:23:20Z"},{"id":"wordfence:92d59dd4-7338-40ac-9a73-37e9e85351d7","source":"wordfence","cve":"CVE-2014-2579","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d59dd4-7338-40ac-9a73-37e9e85351d7?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2014-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92d5be7a-ce96-4e26-afd1-a84b6f46b03f","source":"wordfence","cve":"CVE-2025-12061","title":"Tax Service Electronic HDM <= 1.2.0 - Unauthenticated Arbitrary SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d5be7a-ce96-4e26-afd1-a84b6f46b03f?source=api-prod","affected":[{"type":"plugin","slug":"virtual-hdm-for-taxservice-am","name":"TAX SERVICE Electronic HDM","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-11-05T00:00:00Z","updated":"2025-12-01T17:08:03Z"},{"id":"wordfence:92d6421a-b408-48b2-bf97-98087c3e329b","source":"wordfence","cve":"CVE-2025-24609","title":"PORTONE \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d6421a-b408-48b2-bf97-98087c3e329b?source=api-prod","affected":[{"type":"plugin","slug":"iamport-for-woocommerce","name":"\uc6b0\ucee4\uba38\uc2a4 \ud3ec\ud2b8\uc6d0 \ud50c\ub7ec\uadf8\uc778 (\uad6d\ub0b4 \ubaa8\ub4e0 PG\ub97c \ud55c \ubc88\uc5d0)","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-12-28T00:00:00Z","updated":"2025-02-19T16:56:50Z"},{"id":"wordfence:92d94f9a-150f-40ca-88e1-57cbd6e6880a","source":"wordfence","cve":"CVE-2026-57380","title":"Extensions for Leaflet Map <= 5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d94f9a-150f-40ca-88e1-57cbd6e6880a?source=api-prod","affected":[{"type":"plugin","slug":"extensions-leaflet-map","name":"Extensions for Leaflet Map","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.2"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:48:52Z"},{"id":"wordfence:92d9b21a-3f53-4f37-b439-56865e39e984","source":"wordfence","cve":"CVE-2025-53985","title":"JetTabs <= 2.2.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92d9b21a-3f53-4f37-b439-56865e39e984?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.9.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:56:53Z"},{"id":"wordfence:92daf977-1b60-4ecf-b3bc-e8d356b4e0b7","source":"wordfence","cve":"CVE-2024-37955","title":"GutSlider \u2013 All in One Block Slider <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92daf977-1b60-4ecf-b3bc-e8d356b4e0b7?source=api-prod","affected":[{"type":"plugin","slug":"slider-blocks","name":"GutSlider \u2013 All in One Slider and Carousel Blocks for Gutenberg","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-31T20:58:23Z"},{"id":"wordfence:92dbc405-a11c-4c2e-a98c-8dcb4e0b64e8","source":"wordfence","cve":"CVE-2026-42773","title":"eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92dbc405-a11c-4c2e-a98c-8dcb4e0b64e8?source=api-prod","affected":[{"type":"plugin","slug":"store-manager-connector","name":"eMagicOne Store Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:28:02Z"},{"id":"wordfence:92dd10fa-0241-4238-9ed2-31de0dc450d7","source":"wordfence","cve":"CVE-2025-26988","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.7.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92dd10fa-0241-4238-9ed2-31de0dc450d7?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-10T14:41:46Z"},{"id":"wordfence:92e37b28-1a17-417a-b40f-cb4bbe6ec759","source":"wordfence","cve":"CVE-2024-0895","title":"PDF Flipbook, 3D Flipbook \u2013 DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92e37b28-1a17-417a-b40f-cb4bbe6ec759?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.2.26","to_inclusive":true,"patched_in":"2.2.27"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-03T05:38:34Z"},{"id":"wordfence:92e404ab-fe2b-45b3-b8ff-672f7888b747","source":"wordfence","cve":"CVE-2026-3585","title":"The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92e404ab-fe2b-45b3-b8ff-672f7888b747?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.17","to_inclusive":true,"patched_in":"6.15.17.1"}],"published":"2026-03-09T14:40:15Z","updated":"2026-03-13T20:54:51Z"},{"id":"wordfence:92e444db-72d5-444f-811e-ade0bc097769","source":"wordfence","cve":"CVE-2024-1639","title":"License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92e444db-72d5-444f-811e-ade0bc097769?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-06-20T00:00:00Z","updated":"2024-07-01T16:48:19Z"},{"id":"wordfence:92e9af52-a9a8-4b68-8351-f1091855fedc","source":"wordfence","cve":"CVE-2022-3689","title":"HTML Forms <= 1.3.24 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92e9af52-a9a8-4b68-8351-f1091855fedc?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.3.24","to_inclusive":true,"patched_in":"1.3.25"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92ea6a89-b14f-4252-b886-e219c1bb658d","source":"wordfence","cve":"CVE-2024-13403","title":"WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ea6a89-b14f-4252-b886-e219c1bb658d?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.3.1","to_inclusive":true,"patched_in":"1.9.3.2"}],"published":"2025-02-03T20:01:06Z","updated":"2025-02-04T08:21:09Z"},{"id":"wordfence:92ea7488-f99b-4bae-8972-1e84a0a74071","source":"wordfence","cve":"CVE-2024-5882","title":"Ultimate Classified Listings <= 1.3 - Unauthenticated Local File Inclusion","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ea7488-f99b-4bae-8972-1e84a0a74071?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-15T20:12:59Z"},{"id":"wordfence:92ee1ac0-3e1c-420a-ba09-014027400221","source":"wordfence","cve":"CVE-2026-73365","title":"JetAppointment <= 2.5.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ee1ac0-3e1c-420a-ba09-014027400221?source=api-prod","affected":[{"type":"plugin","slug":"jet-appointments-booking","name":"JetAppointment","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.2.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:32:06Z"},{"id":"wordfence:92f02a92-9364-492e-a896-2f7e6f8b3b13","source":"wordfence","cve":"CVE-2025-30999","title":"WP Shopify <= 1.5.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f02a92-9364-492e-a896-2f7e6f8b3b13?source=api-prod","affected":[{"type":"plugin","slug":"wp-shopify","name":"External Store for Shopify","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-06-05T00:00:00Z","updated":"2026-02-25T13:33:31Z"},{"id":"wordfence:92f26c43-cc7a-4a7a-be11-2eb1cf358a3d","source":"wordfence","cve":"CVE-2026-22393","title":"Curly <= 3.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f26c43-cc7a-4a7a-be11-2eb1cf358a3d?source=api-prod","affected":[{"type":"theme","slug":"curly","name":"Curly - A Stylish WordPress Theme for Hairdressers and Hair Salons","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:32:55Z"},{"id":"wordfence:92f36efb-7eaa-42bd-adca-ec2d626d52aa","source":"wordfence","cve":"CVE-2025-30925","title":"The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f36efb-7eaa-42bd-adca-ec2d626d52aa?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:47:48Z"},{"id":"wordfence:92f3b923-884e-4f61-9bf8-62dfb267a27e","source":"wordfence","cve":"CVE-2025-10586","title":"Community Events <= 1.5.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f3b923-884e-4f61-9bf8-62dfb267a27e?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-10-08T13:32:46Z","updated":"2025-10-09T01:48:48Z"},{"id":"wordfence:92f53507-4475-401b-b57c-f6652a868be9","source":"wordfence","cve":"CVE-2025-13656","title":"Cute News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f53507-4475-401b-b57c-f6652a868be9?source=api-prod","affected":[{"type":"plugin","slug":"cute-news-ticker","name":"Cute News Ticker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:43:24Z","updated":"2025-12-06T05:49:29Z"},{"id":"wordfence:92f667bc-c8fa-4c0d-a14d-db5227168aac","source":"wordfence","cve":"CVE-2025-58204","title":"Podlove Podcast Publisher <= 4.2.5 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f667bc-c8fa-4c0d-a14d-db5227168aac?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:49:06Z"},{"id":"wordfence:92f6f3f7-c49b-4290-806f-6add333159b9","source":"wordfence","cve":"CVE-2021-24952","title":"Conversios.io - Google Analytics and Google Shopping plugin for WooCommerce <= 4.6.1 Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f6f3f7-c49b-4290-806f-6add333159b9?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":false,"patched_in":"4.6.2"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:92f8e3b7-a896-494b-96cd-6ecb8918ebd6","source":"wordfence","cve":"CVE-2024-22302","title":"Albo Pretorio Online <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92f8e3b7-a896-494b-96cd-6ecb8918ebd6?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-14T13:00:30Z"},{"id":"wordfence:92feef8c-61dc-4e96-9fca-e87e35c9d584","source":"wordfence","cve":"CVE-2026-110013","title":"Salon Booking System <= 10.31.8 - Insufficient Authorization to Booking API Access","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92feef8c-61dc-4e96-9fca-e87e35c9d584?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.8","to_inclusive":true,"patched_in":"10.31.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:30:27Z"},{"id":"wordfence:92ffaa23-08f2-4aa4-84c3-a84c26ed8474","source":"wordfence","cve":"CVE-2023-23681","title":"Image Hover Effects For WPBakery Page Builder <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92ffaa23-08f2-4aa4-84c3-a84c26ed8474?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-visual-composer-extension","name":"Image Hover Effects For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"5.0"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9300af5d-7886-4f4e-8454-0dcf2d895fee","source":"wordfence","cve":"CVE-2025-11866","title":"Photographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9300af5d-7886-4f4e-8454-0dcf2d895fee?source=api-prod","affected":[{"type":"plugin","slug":"photographers-galleries","name":"Photographers galleries","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:21:57Z","updated":"2025-10-22T08:27:08Z"},{"id":"wordfence:93027dd1-f36a-4954-a8d2-b77bbbaef6fb","source":"wordfence","cve":"CVE-2025-7689","title":"Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93027dd1-f36a-4954-a8d2-b77bbbaef6fb?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"1.1.0","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2025-07-28T20:38:11Z","updated":"2025-07-29T09:23:47Z"},{"id":"wordfence:93029d39-adaa-4cf6-9081-28c9e84ec2e5","source":"wordfence","cve":"CVE-2023-37970","title":"MF Gig Calendar  <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93029d39-adaa-4cf6-9081-28c9e84ec2e5?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9302ed6a-1725-4215-ba75-e5cb10da292e","source":"wordfence","cve":"CVE-2024-55864","title":"My WP Customize Admin/Frontend <= 1.24.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9302ed6a-1725-4215-ba75-e5cb10da292e?source=api-prod","affected":[{"type":"plugin","slug":"my-wp","name":"My WP Customize Admin/Frontend","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":"1.24.1"}],"published":"2024-12-13T00:00:00Z","updated":"2025-01-17T13:53:41Z"},{"id":"wordfence:930802e6-437b-437a-b530-7992094073f9","source":"wordfence","cve":"CVE-2024-11757","title":"WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/930802e6-437b-437a-b530-7992094073f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-geonames","name":"WP GeoNames","from":"*","from_inclusive":true,"to":"1.9.0.1","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:9309b8bf-f581-4a56-a1ed-3941ebb36127","source":"wordfence","cve":"CVE-2025-8878","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content  \u2013 ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9309b8bf-f581-4a56-a1ed-3941ebb36127?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.4","to_inclusive":true,"patched_in":"4.16.5"}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T11:11:24Z"},{"id":"wordfence:930d8c9e-4af0-49f0-adcc-246800e71284","source":"wordfence","cve":"CVE-2015-10112","title":"WooFramework Branding <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/930d8c9e-4af0-49f0-adcc-246800e71284?source=api-prod","affected":[{"type":"plugin","slug":"wooframework-branding","name":"WooFramework Branding","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:930e7fd6-ae0b-465a-aa93-04ef80011d32","source":"wordfence","cve":"CVE-2026-1942","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/930e7fd6-ae0b-465a-aa93-04ef80011d32?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.7.4","to_inclusive":true,"patched_in":"8.7.5"}],"published":"2026-02-17T21:30:45Z","updated":"2026-02-18T10:20:54Z"},{"id":"wordfence:9311b20b-daad-408f-a1a0-d1e42573ab97","source":"wordfence","cve":"CVE-2024-13845","title":"Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9311b20b-daad-408f-a1a0-d1e42573ab97?source=api-prod","affected":[{"type":"plugin","slug":"gravityformswebhooks","name":"Gravity Forms WebHooks","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-01T04:22:58Z"},{"id":"wordfence:9311c7b6-2c32-4f30-8286-6d59c267c09d","source":"wordfence","cve":"CVE-2023-46202","title":"Auto Login New User After Registration <= 1.9.6 - Cross-Site Request Forgery to Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9311c7b6-2c32-4f30-8286-6d59c267c09d?source=api-prod","affected":[{"type":"plugin","slug":"auto-login-new-user-after-registration","name":"Auto Login New User After Registration","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9312c73d-8eb6-4ca0-a03b-566099dc6487","source":"wordfence","cve":"CVE-2018-19207","title":"WP GDPR Compliance <= 1.4.2 - Arbitrary Options Update and Action Calling","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9312c73d-8eb6-4ca0-a03b-566099dc6487?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-compliance","name":"Cookie Information | Free GDPR Consent Solution","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2018-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9314454b-c790-44a5-90bb-1c38bd75b23f","source":"wordfence","cve":"CVE-2026-108366","title":"easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9314454b-c790-44a5-90bb-1c38bd75b23f?source=api-prod","affected":[{"type":"plugin","slug":"easyjobs","name":"easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-10-27T17:37:31Z","updated":"2026-10-28T06:45:17Z"},{"id":"wordfence:93164941-effe-4363-811e-3161cff10c88","source":"wordfence","cve":"CVE-2021-24726","title":"WP Simple Booking Calendar <= 2.0.6 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93164941-effe-4363-811e-3161cff10c88?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-booking-calendar","name":"WP Simple Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9316796b-312f-4562-b92f-7de0129e4163","source":"wordfence","cve":"CVE-2025-10312","title":"Theme Importer <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9316796b-312f-4562-b92f-7de0129e4163?source=api-prod","affected":[{"type":"plugin","slug":"theme-importer","name":"Theme Importer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:46:46Z","updated":"2025-10-15T08:25:58Z"},{"id":"wordfence:931983c3-d704-4c95-8078-7db4d79e1e1c","source":"wordfence","cve":"","title":"Newsletter by Supsystic <= 1.5.6 - Authenticated (Admin+) Time-Based Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/931983c3-d704-4c95-8078-7db4d79e1e1c?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-by-supsystic","name":"Newsletter by Supsystic","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9319dfc7-2b23-4056-8310-41a07535379d","source":"wordfence","cve":"CVE-2024-49254","title":"ajax-extend <= 1.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9319dfc7-2b23-4056-8310-41a07535379d?source=api-prod","affected":[{"type":"plugin","slug":"ajax-extend","name":"ajax-extend","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:25:23Z"},{"id":"wordfence:931e83b6-b05a-4f48-a159-e15cc99e0fe4","source":"wordfence","cve":"CVE-2021-24352","title":"Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Export","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/931e83b6-b05a-4f48-a159-e15cc99e0fe4?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"2.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93224641-2079-4eb5-bf8f-82298d9d5ef6","source":"wordfence","cve":"CVE-2026-25358","title":"Meloo < 2.8.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93224641-2079-4eb5-bf8f-82298d9d5ef6?source=api-prod","affected":[{"type":"theme","slug":"meloo","name":"Meloo - Music Theme for WordPress","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":false,"patched_in":"2.8.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:25:47Z"},{"id":"wordfence:93237020-435f-41a6-bcca-fe7b605723ae","source":"wordfence","cve":"CVE-2026-14873","title":"Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset","severity":"high","cvss":8.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93237020-435f-41a6-bcca-fe7b605723ae?source=api-prod","affected":[{"type":"plugin","slug":"bulk-password-reset","name":"Bulk Password Reset","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:19Z","updated":"2026-09-10T03:40:42Z"},{"id":"wordfence:932ba486-d98d-4c16-afe5-3aaf030a1e48","source":"wordfence","cve":"CVE-2024-30185","title":"Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/932ba486-d98d-4c16-afe5-3aaf030a1e48?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:59:27Z"},{"id":"wordfence:932d6c6e-3e0f-4834-aa39-8ca9c3b40ef5","source":"wordfence","cve":"CVE-2024-43215","title":"Social Slider Feed <= 2.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/932d6c6e-3e0f-4834-aa39-8ca9c3b40ef5?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-08-09T00:00:00Z","updated":"2024-09-25T13:31:19Z"},{"id":"wordfence:9330ae5a-1f30-4934-ad78-ad1b886de277","source":"wordfence","cve":"CVE-2025-66088","title":"PropertyHive <= 2.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9330ae5a-1f30-4934-ad78-ad1b886de277?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-20T19:40:29Z"},{"id":"wordfence:9331aa66-2eee-4745-b286-fa6db3bd9f37","source":"wordfence","cve":"CVE-2024-10850","title":"Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9331aa66-2eee-4745-b286-fa6db3bd9f37?source=api-prod","affected":[{"type":"plugin","slug":"razorpay-payment-button-elementor","name":"Razorpay Payment Button Elementor Plugin","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-11-12T13:21:48Z","updated":"2024-11-14T18:26:04Z"},{"id":"wordfence:9332f737-7620-412a-9338-1212c9c4ebd8","source":"wordfence","cve":"CVE-2026-40786","title":"MyRewards <= 5.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9332f737-7620-412a-9338-1212c9c4ebd8?source=api-prod","affected":[{"type":"plugin","slug":"woorewards","name":"MyRewards","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:46:20Z"},{"id":"wordfence:93385acc-aede-4948-b64e-d1ab23167d17","source":"wordfence","cve":"CVE-2023-2029","title":"PrePost SEO <= 3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93385acc-aede-4948-b64e-d1ab23167d17?source=api-prod","affected":[{"type":"plugin","slug":"prepost-seo","name":"PrePost SEO","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93393fd3-828b-49f2-ae19-a9e1cce5b22d","source":"wordfence","cve":"CVE-2026-86817","title":"Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93393fd3-828b-49f2-ae19-a9e1cce5b22d?source=api-prod","affected":[{"type":"plugin","slug":"business-profile","name":"Five Star Business Profile and Schema","from":"2.3.20","from_inclusive":true,"to":"2.3.21","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-08T23:58:14Z"},{"id":"wordfence:933d8f1a-ae6e-4c49-92bc-a0b6bd3a0598","source":"wordfence","cve":"CVE-2019-14364","title":"Email Subscribers & Newsletters <= 4.1.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/933d8f1a-ae6e-4c49-92bc-a0b6bd3a0598?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2019-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:933dd704-5a31-42a9-9b87-bf14a9d4ffa9","source":"wordfence","cve":"CVE-2025-4403","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/933dd704-5a31-42a9-9b87-bf14a9d4ffa9?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-05-08T20:19:50Z","updated":"2025-05-09T08:24:07Z"},{"id":"wordfence:933ea8a2-3d1d-43a3-bb14-52f37576c9e5","source":"wordfence","cve":"CVE-2024-0848","title":"AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/933ea8a2-3d1d-43a3-bb14-52f37576c9e5?source=api-prod","affected":[{"type":"plugin","slug":"aa-calculator","name":"AA Cash Calculator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-07-29T21:36:52Z"},{"id":"wordfence:93427a3a-8cbe-4aa7-93e2-c6807bc3390c","source":"wordfence","cve":"CVE-2024-32147","title":"Easy Contact Form Lite  <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93427a3a-8cbe-4aa7-93e2-c6807bc3390c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-lite","name":"Contact Form Plugin","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:14:10Z"},{"id":"wordfence:934358c3-9ac6-473f-a60f-6989e0e6a145","source":"wordfence","cve":"CVE-2025-64229","title":"Client Invoicing by Sprout Invoices <= 20.8.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934358c3-9ac6-473f-a60f-6989e0e6a145?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.7","to_inclusive":true,"patched_in":"20.8.8"}],"published":"2025-10-24T00:00:00Z","updated":"2025-11-04T15:38:58Z"},{"id":"wordfence:934545ff-8886-47c7-ad50-0e5ff513a26c","source":"wordfence","cve":"","title":"PWA for WP & AMP Plugin <= 1.0.8 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934545ff-8886-47c7-ad50-0e5ff513a26c?source=api-prod","affected":[{"type":"plugin","slug":"pwa-for-wp","name":"PWA for WP \u2013 Progressive Web Apps Made Simple","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2019-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9347900c-61c2-4d63-885e-e971c646b737","source":"wordfence","cve":"CVE-2025-13440","title":"Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9347900c-61c2-4d63-885e-e971c646b737?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-12-11T15:05:19Z","updated":"2026-01-06T19:01:23Z"},{"id":"wordfence:9347dafb-1789-4855-b09e-2a1ef5f7f2c1","source":"wordfence","cve":"","title":"Form Maker by 10Web <= 1.13.35 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9347dafb-1789-4855-b09e-2a1ef5f7f2c1?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.13.35","to_inclusive":true,"patched_in":"1.13.36"}],"published":"2020-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9349208c-3e86-4ec6-9e10-5ecaa4923922","source":"wordfence","cve":"CVE-2024-2949","title":"Carousel, Slider, Gallery by WP Carousel \u2013 Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9349208c-3e86-4ec6-9e10-5ecaa4923922?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:18:23Z"},{"id":"wordfence:93495395-42cc-4787-be95-4691ff77d01b","source":"wordfence","cve":"CVE-2026-40772","title":"GeekyBot \u2014 AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.2 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93495395-42cc-4787-be95-4691ff77d01b?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T15:20:49Z"},{"id":"wordfence:934b2767-eae4-4c2d-a635-2e6a27fd9f49","source":"wordfence","cve":"","title":"Get URL Cron <= 1.4.7 - Cross-Site Request Forgery via geturlcron_action_handle","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934b2767-eae4-4c2d-a635-2e6a27fd9f49?source=api-prod","affected":[{"type":"plugin","slug":"get-url-cron","name":"Cron Setup and Monitor \u2013 Get URL Cron","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:934bf839-152d-4d10-9ac8-c64cf042dc18","source":"wordfence","cve":"CVE-2024-1684","title":"Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934bf839-152d-4d10-9ac8-c64cf042dc18?source=api-prod","affected":[{"type":"plugin","slug":"otter-pro","name":"Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-03-06T00:00:00Z","updated":"2024-05-31T15:30:48Z"},{"id":"wordfence:934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d","source":"wordfence","cve":"CVE-2020-36713","title":"MStore API <= 2.1.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934c3ce9-cf2d-4bf6-9a34-f448cb2e5a1d?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2020-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:934d11e7-ea86-4ce8-aadd-a1739b125be0","source":"wordfence","cve":"CVE-2025-26871","title":"Essential Blocks for Gutenberg <= 4.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934d11e7-ea86-4ce8-aadd-a1739b125be0?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T16:18:47Z"},{"id":"wordfence:934db08b-7dde-43bf-848b-48fba38ef195","source":"wordfence","cve":"CVE-2023-0034","title":"JetWidgets For Elementor <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934db08b-7dde-43bf-848b-48fba38ef195?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:934fd6a8-7d94-4127-9a00-1ea2f0c66cdd","source":"wordfence","cve":"CVE-2025-2942","title":"Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/934fd6a8-7d94-4127-9a00-1ea2f0c66cdd?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date Pro for WooCommerce","from":"2.0","from_inclusive":true,"to":"12.6.0","to_inclusive":false,"patched_in":"12.6.0"}],"published":"2025-06-20T00:00:00Z","updated":"2025-07-25T14:43:35Z"},{"id":"wordfence:93504959-2154-4b8c-a7d1-c982bdc8d034","source":"wordfence","cve":"CVE-2025-8897","title":"Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93504959-2154-4b8c-a7d1-c982bdc8d034?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.2.1","to_inclusive":true,"patched_in":"2.9.3.1"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T01:46:29Z"},{"id":"wordfence:935054c3-8541-4ff3-a035-7ee8afe53f72","source":"wordfence","cve":"CVE-2023-5237","title":"Memberlite Shortcodes <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935054c3-8541-4ff3-a035-7ee8afe53f72?source=api-prod","affected":[{"type":"plugin","slug":"memberlite-shortcodes","name":"Memberlite Shortcodes","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9350fba0-2cb3-43dd-9ea5-214dc631267a","source":"wordfence","cve":"CVE-2023-26528","title":"Shipyaari Shipping Management <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9350fba0-2cb3-43dd-9ea5-214dc631267a?source=api-prod","affected":[{"type":"plugin","slug":"manage-shipyaari-shipping","name":"Shipyaari Shipping Management","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:935171a3-9db0-4b01-babb-fa0b3d8985f6","source":"wordfence","cve":"CVE-2024-56247","title":"WP Post Author <= 3.8.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935171a3-9db0-4b01-babb-fa0b3d8985f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:45:15Z"},{"id":"wordfence:93554eb7-2f81-4eb1-809e-6dfe1f5b6196","source":"wordfence","cve":"CVE-2023-52209","title":"WPForms User Registration <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93554eb7-2f81-4eb1-809e-6dfe1f5b6196?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-user-registration","name":"WPForms User Registration","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-07-18T00:00:00Z","updated":"2024-08-09T21:12:54Z"},{"id":"wordfence:9355b100-08a9-4640-a91b-e56ba1ab9b07","source":"wordfence","cve":"CVE-2024-13924","title":"Starter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9355b100-08a9-4640-a91b-e56ba1ab9b07?source=api-prod","affected":[{"type":"plugin","slug":"starter-templates","name":"Starter Templates by FancyWP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:46:15Z","updated":"2025-03-08T12:21:32Z"},{"id":"wordfence:9356a7e8-8fc7-4969-bc41-7268241cb1e6","source":"wordfence","cve":"CVE-2026-88995","title":"Bookit \u2014 Booking & Appointment Calendar < 2.6.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9356a7e8-8fc7-4969-bc41-7268241cb1e6?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.1","to_inclusive":false,"patched_in":"2.6.0.1"}],"published":"2026-09-13T00:00:00Z","updated":"2026-09-15T20:13:35Z"},{"id":"wordfence:935a8d4e-5d5e-46c2-b3b2-eb550f27d535","source":"wordfence","cve":"CVE-2025-68836","title":"Table of Contents Creator <= 1.6.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935a8d4e-5d5e-46c2-b3b2-eb550f27d535?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-creator","name":"Table of Contents Creator","from":"*","from_inclusive":true,"to":"1.6.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-27T19:21:08Z"},{"id":"wordfence:935b5620-40d8-40ef-99f3-260e6f49f84c","source":"wordfence","cve":"CVE-2025-62759","title":"Series <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935b5620-40d8-40ef-99f3-260e6f49f84c?source=api-prod","affected":[{"type":"plugin","slug":"series","name":"Series","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:36:10Z"},{"id":"wordfence:935bf651-888e-4922-81fc-7e2e5a6fe3ba","source":"wordfence","cve":"CVE-2021-25084","title":"Advanced Cron Manager <= 2.4.1 - Subscriber+ Arbitrary Events/Schedules Creation/Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935bf651-888e-4922-81fc-7e2e5a6fe3ba?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cron-manager","name":"Advanced Cron Manager \u2013 debug & control","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"},{"type":"plugin","slug":"advanced-cron-manager-pro","name":"Advanced Cron Manager Pro","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:935caa43-4c75-47ad-a631-63988e21f834","source":"wordfence","cve":"CVE-2025-3604","title":"Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935caa43-4c75-47ad-a631-63988e21f834?source=api-prod","affected":[{"type":"plugin","slug":"flynax-bridge","name":"Flynax Bridge","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-04-23T19:43:51Z","updated":"2025-11-05T21:25:28Z"},{"id":"wordfence:935f1a6f-8c4c-4b46-ab87-be92c5d79a2e","source":"wordfence","cve":"CVE-2025-58888","title":"The Flash <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935f1a6f-8c4c-4b46-ab87-be92c5d79a2e?source=api-prod","affected":[{"type":"theme","slug":"theflash","name":"The Flash - Electric Vehicle & Car Station WordPress Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T22:01:26Z"},{"id":"wordfence:935f5d76-d63a-4db4-b645-b7961ae8bfaf","source":"wordfence","cve":"CVE-2026-3235","title":"WP Data Access \u2013 No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/935f5d76-d63a-4db4-b645-b7961ae8bfaf?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.68","to_inclusive":true,"patched_in":"5.5.69"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T11:05:44Z"},{"id":"wordfence:936041b9-3448-4494-94d7-e3d646caa448","source":"wordfence","cve":"CVE-2026-81344","title":"Frontend Admin by DynamiApps <= 3.29.0 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936041b9-3448-4494-94d7-e3d646caa448?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.0","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:57:42Z"},{"id":"wordfence:936186f9-185a-481e-a8df-5a2a3def9188","source":"wordfence","cve":"CVE-2026-103907","title":"Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936186f9-185a-481e-a8df-5a2a3def9188?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2026-10-13T19:20:41Z","updated":"2026-10-14T07:43:35Z"},{"id":"wordfence:93619957-246a-48e4-8803-0a0522d08776","source":"wordfence","cve":"CVE-2026-39723","title":"Morning for WooCommerce <= 2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93619957-246a-48e4-8803-0a0522d08776?source=api-prod","affected":[{"type":"plugin","slug":"wc-gateway-greeninvoice","name":"Morning for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-10-05T13:29:21Z","updated":"2026-10-08T23:23:21Z"},{"id":"wordfence:93635e8c-930d-4074-a32f-198145ebbd43","source":"wordfence","cve":"CVE-2025-46509","title":"360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93635e8c-930d-4074-a32f-198145ebbd43?source=api-prod","affected":[{"type":"plugin","slug":"360-view","name":"360 View","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:25:25Z"},{"id":"wordfence:9363b671-edc5-4699-b536-0b42917b27ba","source":"wordfence","cve":"CVE-2025-49335","title":"External Media <= 1.0.36 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9363b671-edc5-4699-b536-0b42917b27ba?source=api-prod","affected":[{"type":"plugin","slug":"external-media","name":"External Media","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":""}],"published":"2025-11-23T00:00:00Z","updated":"2026-02-03T20:09:49Z"},{"id":"wordfence:9364c4a3-c43c-43b4-a3e3-14269ca2b928","source":"wordfence","cve":"CVE-2025-32269","title":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9364c4a3-c43c-43b4-a3e3-14269ca2b928?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zendesk","name":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T20:45:46Z"},{"id":"wordfence:936564ab-3119-4627-b7eb-4ca45ea377e5","source":"wordfence","cve":"CVE-2024-56205","title":"AI Magic <= 1.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936564ab-3119-4627-b7eb-4ca45ea377e5?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-page-redirects","name":"Insya Magic \u2014 AI Content Generator for ChatGPT, Claude and Gemini","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-12-18T00:00:00Z","updated":"2025-12-04T16:47:49Z"},{"id":"wordfence:936803ab-93d5-4808-8758-6b8f7c01b3c2","source":"wordfence","cve":"CVE-2023-0894","title":"Pickup | Delivery | Dine-in date time <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936803ab-93d5-4808-8758-6b8f7c01b3c2?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-pickup-delivery-dine-in","name":"Pickup | Delivery | Dine-in date time","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93698608-eda1-4479-8089-5b6ed7ed7607","source":"wordfence","cve":"CVE-2025-62990","title":"Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93698608-eda1-4479-8089-5b6ed7ed7607?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-beaver-builder","name":"Livemesh Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:37:46Z"},{"id":"wordfence:936c1b74-30ce-4be2-bb31-566fb557597e","source":"wordfence","cve":"CVE-2025-24725","title":"Thim Elementor Kit <= 1.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936c1b74-30ce-4be2-bb31-566fb557597e?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:41:43Z"},{"id":"wordfence:936d2714-4ace-4685-b3ff-6adac76495a3","source":"wordfence","cve":"CVE-2024-35759","title":"WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936d2714-4ace-4685-b3ff-6adac76495a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-01T19:28:59Z"},{"id":"wordfence:936d8c03-31e4-4fd6-94f6-8b81afce315f","source":"wordfence","cve":"CVE-2019-25745","title":"WP Google Review Slider <= 6.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936d8c03-31e4-4fd6-94f6-8b81afce315f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2026-06-04T00:00:00Z","updated":"2026-10-21T01:03:03Z"},{"id":"wordfence:936de04d-9b80-430b-a8b7-9755b68e2a02","source":"wordfence","cve":"CVE-2024-10877","title":"AFI \u2013 The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936de04d-9b80-430b-a8b7-9755b68e2a02?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.92.0","to_inclusive":true,"patched_in":"1.92.1"}],"published":"2024-11-12T18:26:36Z","updated":"2024-11-13T06:47:34Z"},{"id":"wordfence:936e753b-b3e9-43c9-8686-c610faa8b20e","source":"wordfence","cve":"CVE-2023-1124","title":"Shopping Cart & eCommerce Store <= 5.4.2 - Authenticated (Admin+) Local File Inclusion via import_file_url","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/936e753b-b3e9-43c9-8686-c610faa8b20e?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9370c320-b3bc-4965-9cc7-b2bf3a24e251","source":"wordfence","cve":"CVE-2024-47644","title":"Copyscape Premium <= 1.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9370c320-b3bc-4965-9cc7-b2bf3a24e251?source=api-prod","affected":[{"type":"plugin","slug":"copyscape-premium","name":"Copyscape Premium","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-11-01T13:11:53Z"},{"id":"wordfence:9370cf3f-27bd-42f7-bd0c-88dcb86fd459","source":"wordfence","cve":"CVE-2026-65476","title":"Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9370cf3f-27bd-42f7-bd0c-88dcb86fd459?source=api-prod","affected":[{"type":"theme","slug":"civi","name":"Civi - Job Board & Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:35:57Z"},{"id":"wordfence:9370f05a-9c69-45f4-9fd8-7017bfcf4d1e","source":"wordfence","cve":"CVE-2023-26523","title":"Calculated Fields Form <= 1.1.120 - Missing Authorization to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9370f05a-9c69-45f4-9fd8-7017bfcf4d1e?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.1.120","to_inclusive":true,"patched_in":"1.1.121"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9373c82d-15a8-495a-8290-1b85c096f7e5","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Weak validation of Amazon SNS push messages","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9373c82d-15a8-495a-8290-1b85c096f7e5?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93784c84-93b3-4f43-84a0-5aeed3ba9cfd","source":"wordfence","cve":"CVE-2023-52214","title":"Void Contact Form 7 Widget For Elementor Page Builder <= 2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93784c84-93b3-4f43-84a0-5aeed3ba9cfd?source=api-prod","affected":[{"type":"plugin","slug":"cf7-widget-elementor","name":"Void Contact Form 7 Widget For Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9379e1c9-fb83-43e4-af89-898dc0c2216c","source":"wordfence","cve":"CVE-2023-0144","title":"Event Manager and Tickets Selling Plugin for WooCommerce <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9379e1c9-fb83-43e4-af89-898dc0c2216c?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:937a1474-2fe8-40dd-86c3-2d839a7b9c07","source":"wordfence","cve":"CVE-2025-22690","title":"DigiTimber cPanel Integration <= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/937a1474-2fe8-40dd-86c3-2d839a7b9c07?source=api-prod","affected":[{"type":"plugin","slug":"digitimber-cpanel-integration","name":"DigiTimber cPanel Integration","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:42:02Z"},{"id":"wordfence:937a2256-a48c-4132-874f-62983ff003a4","source":"wordfence","cve":"CVE-2026-81773","title":"Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/937a2256-a48c-4132-874f-62983ff003a4?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.26","to_inclusive":true,"patched_in":""}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:32:09Z"},{"id":"wordfence:937d1870-a844-4033-8bc0-88e2cd9db25b","source":"wordfence","cve":"CVE-2026-9709","title":"Cornerstone < 7.8.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/937d1870-a844-4033-8bc0-88e2cd9db25b?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"7.8.9","to_inclusive":false,"patched_in":"7.8.9"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-28T16:14:01Z"},{"id":"wordfence:937d2dac-3f07-4c0f-9f3b-c85080ba11f8","source":"wordfence","cve":"CVE-2025-31410","title":"WP Church Donation <= 1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/937d2dac-3f07-4c0f-9f3b-c85080ba11f8?source=api-prod","affected":[{"type":"plugin","slug":"wp-church-donation","name":"WP Church Donation","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:34:55Z"},{"id":"wordfence:937e56cc-58dc-483c-8f17-ced3b1f7a481","source":"wordfence","cve":"CVE-2021-38340","title":"WordPress Simple Shop <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/937e56cc-58dc-483c-8f17-ced3b1f7a481?source=api-prod","affected":[{"type":"plugin","slug":"webful-simple-grocery-shop","name":"WordPress Simple Shop","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93800bd9-5d11-4d5b-99b2-4c5c78510af7","source":"wordfence","cve":"CVE-2024-13717","title":"Contact Form and Calls To Action by vcita <= 2.7.1 - Missing Authorization to Authenticated (Subscriber+) Contact/Widget Toggle","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93800bd9-5d11-4d5b-99b2-4c5c78510af7?source=api-prod","affected":[{"type":"plugin","slug":"lead-capturing-call-to-actions-by-vcita","name":"Contact Form and Calls To Action by vcita","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T16:51:19Z","updated":"2025-01-31T05:22:34Z"},{"id":"wordfence:9380f847-3506-474c-803a-27648b45da27","source":"wordfence","cve":"CVE-2026-91051","title":"EWWW Image Optimizer 8.6.0 - 8.7.7 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9380f847-3506-474c-803a-27648b45da27?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"8.6.0","from_inclusive":true,"to":"8.7.7","to_inclusive":true,"patched_in":"8.8.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:02:12Z"},{"id":"wordfence:93818487-739e-48ed-ac67-02469277c22d","source":"wordfence","cve":"CVE-2025-7843","title":"Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93818487-739e-48ed-ac67-02469277c22d?source=api-prod","affected":[{"type":"plugin","slug":"auto-save-remote-images-drafts","name":"Auto Save Remote Images (Drafts)","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-09T17:42:18Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:9382d94c-3767-4d05-ada7-2857713b9e3a","source":"wordfence","cve":"","title":"Sahifa <= 2.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9382d94c-3767-4d05-ada7-2857713b9e3a?source=api-prod","affected":[{"type":"theme","slug":"sahifa","name":"Sahifa","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2013-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9383627d-901d-4c2a-965c-f9b8ddd38a4b","source":"wordfence","cve":"CVE-2025-67570","title":"WPForms Google Sheet Connector <= 4.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9383627d-901d-4c2a-965c-f9b8ddd38a4b?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-wpforms","name":"GSheetConnector \u2013 WPForms Google Sheets Connector, Save WPForms Lite & PRO Entries to Database & Sheets","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T16:10:05Z"},{"id":"wordfence:9384d32d-77a1-4794-aace-96f553302a3b","source":"wordfence","cve":"CVE-2026-3851","title":"Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9384d32d-77a1-4794-aace-96f553302a3b?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.6","to_inclusive":true,"patched_in":"4.27.7"}],"published":"2026-09-01T14:46:50Z","updated":"2026-09-02T03:38:32Z"},{"id":"wordfence:93875f19-d9b9-4e33-bba9-afc75cf26bf2","source":"wordfence","cve":"CVE-2023-3427","title":"Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93875f19-d9b9-4e33-bba9-afc75cf26bf2?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"8.4.7","to_inclusive":true,"patched_in":"8.4.8"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9388434a-1a3c-4c5a-8bc9-07585df09f6e","source":"wordfence","cve":"CVE-2026-81300","title":"Calculation for contact form 7 <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9388434a-1a3c-4c5a-8bc9-07585df09f6e?source=api-prod","affected":[{"type":"plugin","slug":"calculation-for-contact-form-7","name":"Calculation for contact form 7","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:16:08Z"},{"id":"wordfence:938852c9-bc9b-4215-9e6b-9af122d1e8e7","source":"wordfence","cve":"CVE-2026-13340","title":"SVG Support <= 2.5.16 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938852c9-bc9b-4215-9e6b-9af122d1e8e7?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.5.16","to_inclusive":true,"patched_in":"2.5.17"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:01:20Z"},{"id":"wordfence:93898bf8-cfed-44bf-9d68-a0167beba86a","source":"wordfence","cve":"CVE-2025-3890","title":"WordPress Simple PayPal Shopping Cart <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93898bf8-cfed-44bf-9d68-a0167beba86a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2025-04-30T22:01:39Z","updated":"2025-05-01T11:11:45Z"},{"id":"wordfence:938a896d-90a0-4f29-942f-df8d6ed3613e","source":"wordfence","cve":"CVE-2025-49047","title":"DigitalOcean Spaces Sync <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938a896d-90a0-4f29-942f-df8d6ed3613e?source=api-prod","affected":[{"type":"plugin","slug":"do-spaces-sync","name":"DigitalOcean Spaces Sync","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:49:53Z"},{"id":"wordfence:938b8a4f-96cf-488d-8fd9-116caa929ccf","source":"wordfence","cve":"CVE-2026-57710","title":"WoowBot Pro Max <= 14.1.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938b8a4f-96cf-488d-8fd9-116caa929ccf?source=api-prod","affected":[{"type":"plugin","slug":"woowbot-pro-max","name":"AI ChatBot for WooCommerce with ChatGPT, Retargeting, Exit Intent","from":"*","from_inclusive":true,"to":"14.1.7","to_inclusive":true,"patched_in":"14.1.8"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:10:37Z"},{"id":"wordfence:938be2d0-1e56-42d5-874e-574e78a44932","source":"wordfence","cve":"","title":"Developer Formatter < 2013.0.1.41 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938be2d0-1e56-42d5-874e-574e78a44932?source=api-prod","affected":[{"type":"plugin","slug":"devformatter","name":"Developer Formatter","from":"*","from_inclusive":true,"to":"2013.0.1.41","to_inclusive":false,"patched_in":"2013.0.1.41"}],"published":"2013-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:938d24c2-24f5-42d4-9a8f-f25b65a312f1","source":"wordfence","cve":"CVE-2021-24485","title":"Special Text Boxes <= 5.9.109 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938d24c2-24f5-42d4-9a8f-f25b65a312f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-special-textboxes","name":"Special Text Boxes","from":"*","from_inclusive":true,"to":"5.9.109","to_inclusive":true,"patched_in":"5.9.110"}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:938e5d6b-1ad6-4021-a148-1d1c9e8a0a83","source":"wordfence","cve":"CVE-2025-9260","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938e5d6b-1ad6-4021-a148-1d1c9e8a0a83?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"5.1.16","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2025-09-02T10:27:32Z","updated":"2025-09-05T11:43:31Z"},{"id":"wordfence:938e8f54-56f0-4066-bc78-ebfc2abe0743","source":"wordfence","cve":"","title":"Flash player widget <= 1.3 - Content Spoofing","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938e8f54-56f0-4066-bc78-ebfc2abe0743?source=api-prod","affected":[{"type":"plugin","slug":"flash-player-widget","name":"flash-player-widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:938f0ac2-6454-472b-8119-4ffaa7a3670c","source":"wordfence","cve":"CVE-2026-45217","title":"Payment Gateway of Stripe for WooCommerce <= 5.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/938f0ac2-6454-472b-8119-4ffaa7a3670c?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T16:14:14Z"},{"id":"wordfence:9391474f-8cf8-4e8b-b3e6-39b397b7b6b6","source":"wordfence","cve":"","title":"Master Slider - Responsive Touch Slider <= 2.5.1 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9391474f-8cf8-4e8b-b3e6-39b397b7b6b6?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93920201-fd53-45ad-983a-a2b04b96db77","source":"wordfence","cve":"CVE-2023-25024","title":"Icegram Collect <= 1.3.8 - Authenticated(Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93920201-fd53-45ad-983a-a2b04b96db77?source=api-prod","affected":[{"type":"plugin","slug":"icegram-rainmaker","name":"Icegram Collect \u2013 Easy Contact Form, Subscription Form & Lead Collection Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93928123-c90d-4bbb-b51d-33e809867b79","source":"wordfence","cve":"CVE-2024-9204","title":"Smart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93928123-c90d-4bbb-b51d-33e809867b79?source=api-prod","affected":[{"type":"plugin","slug":"404page","name":"Smart Custom 404 Error Page","from":"*","from_inclusive":true,"to":"11.4.7","to_inclusive":true,"patched_in":"11.4.8"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:04:56Z"},{"id":"wordfence:9393e103-7009-457b-ba14-fa5ef45b97df","source":"wordfence","cve":"CVE-2022-45841","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.9 - Missing Authorization","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9393e103-7009-457b-ba14-fa5ef45b97df?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9395585d-e0cd-41f5-af29-328fdaf8b600","source":"wordfence","cve":"CVE-2025-31848","title":"WordPress Adverts Plugin <= 1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9395585d-e0cd-41f5-af29-328fdaf8b600?source=api-prod","affected":[{"type":"plugin","slug":"adverts-click-tracker","name":"WordPress Adverts Plugin \u2013 Adverts Click Tracker","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:08:11Z"},{"id":"wordfence:9396c350-d72e-472b-8cbc-44edce557256","source":"wordfence","cve":"CVE-2024-29113","title":"RegistrationMagic <= 5.2.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9396c350-d72e-472b-8cbc-44edce557256?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.5.9","to_inclusive":true,"patched_in":"5.2.6.0"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:21:15Z"},{"id":"wordfence:939b408c-ae22-40ce-b500-317150a2da3b","source":"wordfence","cve":"CVE-2025-8682","title":"Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40ce-b500-317150a2da3b?source=api-prod","affected":[{"type":"theme","slug":"newsup","name":"Newsup","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T09:28:39Z"},{"id":"wordfence:939f0660-067f-49c9-b4eb-e174985165fd","source":"wordfence","cve":"CVE-2025-47567","title":"Video Player & FullScreen Video Background <= 2.4.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/939f0660-067f-49c9-b4eb-e174985165fd?source=api-prod","affected":[{"type":"plugin","slug":"universal-video-player-and-bg","name":"Video Player & FullScreen Video Background","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:25:03Z"},{"id":"wordfence:93a07027-1068-41fa-bd6b-74ccc0441a16","source":"wordfence","cve":"CVE-2022-4217","title":"Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93a07027-1068-41fa-bd6b-74ccc0441a16?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.2","to_inclusive":true,"patched_in":"1.3.2.3"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93a07f4e-8359-4ca2-a1cc-ca0ba2b7c0de","source":"wordfence","cve":"CVE-2022-3836","title":"Seed Social <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93a07f4e-8359-4ca2-a1cc-ca0ba2b7c0de?source=api-prod","affected":[{"type":"plugin","slug":"seed-social","name":"Seed Social","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93a4d653-a852-41c1-8942-8f059420aeb1","source":"wordfence","cve":"CVE-2018-20556","title":"Booking Calendar <= 8.4.3 - SQL injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93a4d653-a852-41c1-8942-8f059420aeb1?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2018-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93a698df-fd68-4fbc-946e-a9b5a7f93b71","source":"wordfence","cve":"CVE-2024-12158","title":"Popup \u2013 MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93a698df-fd68-4fbc-946e-a9b5a7f93b71?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-popup-creator","name":"Popup \u2013 MailChimp, GetResponse and ActiveCampaign Intergrations","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T04:22:18Z"},{"id":"wordfence:93a9ee27-b344-4870-afe0-dfecbaf433a2","source":"wordfence","cve":"CVE-2025-69146","title":"Dom <= 1.24 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93a9ee27-b344-4870-afe0-dfecbaf433a2?source=api-prod","affected":[{"type":"theme","slug":"dom","name":"Dom","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T11:58:06Z"},{"id":"wordfence:93ab3e05-dbaf-4f55-a411-793a74c75071","source":"wordfence","cve":"CVE-2025-8688","title":"Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ab3e05-dbaf-4f55-a411-793a74c75071?source=api-prod","affected":[{"type":"plugin","slug":"inline-stock-quotes","name":"Inline Stock Quotes","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T14:04:57Z","updated":"2025-08-12T02:24:48Z"},{"id":"wordfence:93ab9f1a-26ce-466a-a5d3-d2046ec8f94d","source":"wordfence","cve":"CVE-2024-0621","title":"Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ab9f1a-26ce-466a-a5d3-d2046ec8f94d?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"8.4.11","to_inclusive":true,"patched_in":"8.4.12"}],"published":"2024-02-14T00:00:00Z","updated":"2024-07-29T21:36:52Z"},{"id":"wordfence:93aeb280-1ce0-419d-947e-ec4b06a40307","source":"wordfence","cve":"CVE-2026-32339","title":"Bakes And Cakes <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93aeb280-1ce0-419d-947e-ec4b06a40307?source=api-prod","affected":[{"type":"theme","slug":"bakes-and-cakes","name":"Bakes And Cakes","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:46:38Z"},{"id":"wordfence:93b527a8-30c0-4e47-bb2b-522380b21699","source":"wordfence","cve":"CVE-2023-47792","title":"Big File Uploads <= 2.1.1 - Cross-Site Request Forgery via actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b527a8-30c0-4e47-bb2b-522380b21699?source=api-prod","affected":[{"type":"plugin","slug":"tuxedo-big-file-uploads","name":"Big File Uploads \u2013 Increase Maximum File Upload Size","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93b53241-6556-4a67-97e6-ea30f3c4ef76","source":"wordfence","cve":"CVE-2025-12116","title":"Drift <= 1.6.0 - Authenticated  (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b53241-6556-4a67-97e6-ea30f3c4ef76?source=api-prod","affected":[{"type":"theme","slug":"drift","name":"Drift","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:05:38Z","updated":"2026-09-21T19:07:40Z"},{"id":"wordfence:93b5525c-a298-420d-80cd-84cb35913981","source":"wordfence","cve":"CVE-2024-32522","title":"Open Close WooCommerce Store <= 4.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b5525c-a298-420d-80cd-84cb35913981?source=api-prod","affected":[{"type":"plugin","slug":"woc-open-close","name":"Open Close Store for WooCommerce \u2013 Business Hours & Order Scheduling","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:05:23Z"},{"id":"wordfence:93b5552e-bb24-4dfb-a779-8451f619ff50","source":"wordfence","cve":"CVE-2021-24472","title":"QT KenthaRadio < 2.0.2 & OnAir2 < 3.9.9.2 - Server-Side Request Forgery & Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b5552e-bb24-4dfb-a779-8451f619ff50?source=api-prod","affected":[{"type":"theme","slug":"onair2","name":"Onair2: Radio Station WordPress Theme With Non-Stop Music Player","from":"*","from_inclusive":true,"to":"3.9.9.2","to_inclusive":false,"patched_in":"3.9.9.2"},{"type":"theme","slug":"qt-kentharadio","name":"KenthaRadio - Addon for Kentha Music WordPress Theme To Add Radio Station and Schedule Functionality","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2021-06-28T00:00:00Z","updated":"2026-04-24T15:19:23Z"},{"id":"wordfence:93b5bc57-3bfa-4477-a9d4-f0563008cf94","source":"wordfence","cve":"CVE-2023-25477","title":"Video Gallery <= 1.3.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b5bc57-3bfa-4477-a9d4-f0563008cf94?source=api-prod","affected":[{"type":"plugin","slug":"yotuwp-easy-youtube-embed","name":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93b83e65-09d6-4ad5-85f3-d18a9a35f39d","source":"wordfence","cve":"CVE-2025-3521","title":"Team Members \u2013 Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d?source=api-prod","affected":[{"type":"plugin","slug":"wps-team","name":"Team Members Showcase","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-04-30T18:14:23Z","updated":"2025-11-05T21:34:14Z"},{"id":"wordfence:93ba8247-ed6b-47fd-a0af-4d5121825969","source":"wordfence","cve":"CVE-2025-14579","title":"Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ba8247-ed6b-47fd-a0af-4d5121825969?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.88","to_inclusive":true,"patched_in":"6.7.0.89"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-13T22:00:33Z"},{"id":"wordfence:93badb2f-bb47-4ae6-a447-d8237cc9237f","source":"wordfence","cve":"CVE-2014-7151","title":"NEX-Forms Lite \u2013 WordPress Contact Form builder < 3.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93badb2f-bb47-4ae6-a447-d8237cc9237f?source=api-prod","affected":[{"type":"plugin","slug":"x-forms-express","name":"NEX-Forms Lite \u2013 WordPress Contact Form builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2014-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93bbedc5-b801-4e33-9df6-3ce376d90062","source":"wordfence","cve":"CVE-2025-58955","title":"Karzo < 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93bbedc5-b801-4e33-9df6-3ce376d90062?source=api-prod","affected":[{"type":"theme","slug":"karzo","name":"Karzo","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-10-12T00:00:00Z","updated":"2025-10-23T14:42:00Z"},{"id":"wordfence:93bda572-2acf-4a1b-93ac-72dc9537cb4d","source":"wordfence","cve":"CVE-2024-12743","title":"MailPoet <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93bda572-2acf-4a1b-93ac-72dc9537cb4d?source=api-prod","affected":[{"type":"plugin","slug":"mailpoet","name":"MailPoet \u2013 Newsletters, Email Marketing, and Automation","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2025-03-06T00:00:00Z","updated":"2025-05-09T17:47:32Z"},{"id":"wordfence:93be1150-4c83-4fa3-8dc6-71e2f1ddaa66","source":"wordfence","cve":"CVE-2026-7662","title":"ePaperFlip Publisher <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93be1150-4c83-4fa3-8dc6-71e2f1ddaa66?source=api-prod","affected":[{"type":"plugin","slug":"epaperflip-publisher","name":"Plugin Name: ePaperFlip Publisher","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:04:44Z","updated":"2026-06-09T03:41:21Z"},{"id":"wordfence:93c1033e-aaa6-4ddc-a3f0-a41e09069e3e","source":"wordfence","cve":"CVE-2025-57988","title":"Uncanny Toolkit for LearnDash <= 3.7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93c1033e-aaa6-4ddc-a3f0-a41e09069e3e?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.7.0.3","to_inclusive":true,"patched_in":"3.7.0.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-30T12:56:34Z"},{"id":"wordfence:93c10a58-c5f2-440b-a88e-5314143fdd90","source":"wordfence","cve":"CVE-2023-5314","title":"WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93c10a58-c5f2-440b-a88e-5314143fdd90?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra","name":"WP EXtra \u2013 One Click Optimize","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93c1b6d2-a818-4ce5-96b7-524fac4081b2","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93c1b6d2-a818-4ce5-96b7-524fac4081b2?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93c940a5-1145-47ac-b55f-bf346719e584","source":"wordfence","cve":"CVE-2022-1268","title":"Donate Extra <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93c940a5-1145-47ac-b55f-bf346719e584?source=api-prod","affected":[{"type":"plugin","slug":"donate-extra","name":"Donate Extra","from":"*","from_inclusive":true,"to":"2.02","to_inclusive":true,"patched_in":""}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93c9e453-f67c-4c4a-9873-1f00c8d9168b","source":"wordfence","cve":"CVE-2026-107100","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor 1.3.81 - 1.7.1069 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93c9e453-f67c-4c4a-9873-1f00c8d9168b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.3.81","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:37Z"},{"id":"wordfence:93ca1959-1747-4141-9b48-1ae782b9700a","source":"wordfence","cve":"CVE-2025-53339","title":"Devnex Addons For Elementor <= 1.0.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ca1959-1747-4141-9b48-1ae782b9700a?source=api-prod","affected":[{"type":"plugin","slug":"devnex-addons-for-elementor","name":"Devnex Addons For Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:43:47Z"},{"id":"wordfence:93cb3b29-b1a0-4d40-a057-1b41f3b181f2","source":"wordfence","cve":"CVE-2024-0630","title":"WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93cb3b29-b1a0-4d40-a057-1b41f3b181f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.23.4","to_inclusive":true,"patched_in":"4.23.5"}],"published":"2024-01-25T00:00:00Z","updated":"2024-07-29T21:36:53Z"},{"id":"wordfence:93cb6d59-6654-4ce1-b65f-0e162ae58bac","source":"wordfence","cve":"","title":"Download Monitor <= 1.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93cb6d59-6654-4ce1-b65f-0e162ae58bac?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"},{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"1.7.0","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93cf6dce-892e-4106-bb37-b7952e5ea5a1","source":"wordfence","cve":"CVE-2022-1208","title":"Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93cf8a35-61a4-4998-ae34-86c96898e30f","source":"wordfence","cve":"CVE-2026-109198","title":"Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf8a35-61a4-4998-ae34-86c96898e30f?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.89.1","to_inclusive":true,"patched_in":"6.90"}],"published":"2026-10-22T16:27:43Z","updated":"2026-10-23T04:31:55Z"},{"id":"wordfence:93d00b7e-cad1-4521-8acf-94818258a9d9","source":"wordfence","cve":"CVE-2026-31913","title":"Scape - Multipurpose WordPress theme < 1.5.16 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93d00b7e-cad1-4521-8acf-94818258a9d9?source=api-prod","affected":[{"type":"theme","slug":"scape","name":"Scape - Multipurpose WordPress theme","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":false,"patched_in":"1.5.16"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:27:56Z"},{"id":"wordfence:93d78063-238d-40c0-92c9-6870d85d29f7","source":"wordfence","cve":"CVE-2023-45632","title":"Video Player <= 1.5.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93d78063-238d-40c0-92c9-6870d85d29f7?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"1.5.22","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93d8277f-3c5a-4024-a7c0-27ccb1a23cfc","source":"wordfence","cve":"CVE-2024-30557","title":"Aesop Story Engine <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93d8277f-3c5a-4024-a7c0-27ccb1a23cfc?source=api-prod","affected":[{"type":"plugin","slug":"aesop-story-engine","name":"Aesop Story Engine","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:08:37Z"},{"id":"wordfence:93d8ed64-0b3e-4410-9166-6e7861d885ca","source":"wordfence","cve":"CVE-2026-40766","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93d8ed64-0b3e-4410-9166-6e7861d885ca?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.25","to_inclusive":true,"patched_in":"3.7.26"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:58:21Z"},{"id":"wordfence:93daab72-1243-4a05-91d3-9254a1aac727","source":"wordfence","cve":"CVE-2024-4213","title":"Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93daab72-1243-4a05-91d3-9254a1aac727?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2024-05-10T09:18:19Z","updated":"2024-05-10T21:32:42Z"},{"id":"wordfence:93dadc33-cabf-4701-97ca-861ad90597fb","source":"wordfence","cve":"CVE-2025-12527","title":"Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93dadc33-cabf-4701-97ca-861ad90597fb?source=api-prod","affected":[{"type":"plugin","slug":"page-post-notes","name":"Page & Post Notes","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-11-06T17:14:46Z","updated":"2025-11-07T05:29:59Z"},{"id":"wordfence:93db56df-d21b-4788-84b2-7b28641b5a7a","source":"wordfence","cve":"CVE-2025-14853","title":"LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93db56df-d21b-4788-84b2-7b28641b5a7a?source=api-prod","affected":[{"type":"plugin","slug":"last-email-address-validator","name":"LEAV Last Email Address Validator","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T18:32:15Z","updated":"2026-01-16T06:43:21Z"},{"id":"wordfence:93dcbab7-fdf5-4631-8605-77f8f190512d","source":"wordfence","cve":"CVE-2024-3650","title":"ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93dcbab7-fdf5-4631-8605-77f8f190512d?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"3.0.7","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:25Z"},{"id":"wordfence:93de1604-2494-4c51-a93d-b01bf7ed4c07","source":"wordfence","cve":"CVE-2023-5738","title":"WordPress Backup & Migration <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93de1604-2494-4c51-a93d-b01bf7ed4c07?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93df6480-9bb1-4f5d-bb39-ff1a01d739cf","source":"wordfence","cve":"CVE-2026-4091","title":"OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93df6480-9bb1-4f5d-bb39-ff1a01d739cf?source=api-prod","affected":[{"type":"plugin","slug":"open-brain","name":"OPEN-BRAIN","from":"*","from_inclusive":true,"to":"0.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:46:41Z","updated":"2026-04-15T08:28:15Z"},{"id":"wordfence:93e0a1a1-fba6-4209-b679-e66d77870be2","source":"wordfence","cve":"CVE-2025-10862","title":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93e0a1a1-fba6-4209-b679-e66d77870be2?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-09T08:23:19Z"},{"id":"wordfence:93e2d007-8157-42c5-92ad-704dc80749a3","source":"wordfence","cve":"CVE-2024-5932","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution","severity":"critical","cvss":10.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93e2d007-8157-42c5-92ad-704dc80749a3?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2024-08-19T13:55:41Z","updated":"2024-08-20T02:03:16Z"},{"id":"wordfence:93e407d9-6878-4d2f-9f86-4037be95f239","source":"wordfence","cve":"CVE-2025-67561","title":"Debug Log Viewer <= 2.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93e407d9-6878-4d2f-9f86-4037be95f239?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-viewer","name":"Debug Log Viewer","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-11T16:47:46Z"},{"id":"wordfence:93e4fb7c-7973-496e-891f-d3b54d786e26","source":"wordfence","cve":"CVE-2026-76548","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93e4fb7c-7973-496e-891f-d3b54d786e26?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":false,"patched_in":"4.0.1"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:45:48Z"},{"id":"wordfence:93e590f8-5f8d-4ee5-bcff-96bcb8daf4b7","source":"wordfence","cve":"CVE-2023-51679","title":"BulkGate SMS Plugin for WooCommerce <= 3.0.2 - Missing Authorization via Multiple AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93e590f8-5f8d-4ee5-bcff-96bcb8daf4b7?source=api-prod","affected":[{"type":"plugin","slug":"woosms-sms-module-for-woocommerce","name":"BulkGate SMS Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93ea426e-8c5e-4dd9-8b4e-93ef337e0e3d","source":"wordfence","cve":"CVE-2026-97272","title":"Premmerce Permalink Manager for WooCommerce <= 2.3.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ea426e-8c5e-4dd9-8b4e-93ef337e0e3d?source=api-prod","affected":[{"type":"plugin","slug":"woo-permalink-manager","name":"Premmerce Permalink Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2026-09-30T09:41:40Z","updated":"2026-10-08T23:59:48Z"},{"id":"wordfence:93ec134f-246a-4b1c-8850-8d26126fd9a8","source":"wordfence","cve":"CVE-2024-43993","title":"Liquido <= 1.0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ec134f-246a-4b1c-8850-8d26126fd9a8?source=api-prod","affected":[{"type":"theme","slug":"liquido","name":"Liquido","from":"*","from_inclusive":true,"to":"1.0.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:29:53Z"},{"id":"wordfence:93ef0a2c-2197-4c23-b5c4-5a94bd44130d","source":"wordfence","cve":"CVE-2021-24580","title":"Side Menu Lite - add sticky fixed buttons < 2.2.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ef0a2c-2197-4c23-b5c4-5a94bd44130d?source=api-prod","affected":[{"type":"plugin","slug":"side-menu-lite","name":"Side Menu Lite \u2013 Sticky Floating Side Menu","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2021-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93efae1f-1e4a-48ee-8a69-558c38925250","source":"wordfence","cve":"CVE-2024-11769","title":"Flower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93efae1f-1e4a-48ee-8a69-558c38925250?source=api-prod","affected":[{"type":"plugin","slug":"flower-delivery-by-florist-one","name":"Flower Delivery by Florist One","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T07:32:27Z"},{"id":"wordfence:93f11b26-17eb-406b-a722-4f5ef74ed9c1","source":"wordfence","cve":"CVE-2026-78533","title":"Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f11b26-17eb-406b-a722-4f5ef74ed9c1?source=api-prod","affected":[{"type":"theme","slug":"qwery","name":"Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:53:32Z","updated":"2026-10-13T14:07:06Z"},{"id":"wordfence:93f14c9c-a313-4b36-83c4-7b3d4dfbc015","source":"wordfence","cve":"CVE-2026-114741","title":"VR 9.0.0 - 9.0.2 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f14c9c-a313-4b36-83c4-7b3d4dfbc015?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"9.0.0","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.0.3"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:22:06Z"},{"id":"wordfence:93f377a1-2c33-4dd7-8fd6-190d9148e804","source":"wordfence","cve":"CVE-2023-6825","title":"File Manager And File Manager Pro (Multiple Versions) - Directory Traversal","severity":"critical","cvss":9.9,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f377a1-2c33-4dd7-8fd6-190d9148e804?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"},{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2024-03-04T00:00:00Z","updated":"2024-07-29T21:36:53Z"},{"id":"wordfence:93f80716-a95b-49fc-805f-446d4723ca77","source":"wordfence","cve":"CVE-2025-12067","title":"Table Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f80716-a95b-49fc-805f-446d4723ca77?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-table-field","name":"Table Field Add-on for ACF and SCF","from":"*","from_inclusive":true,"to":"1.3.30","to_inclusive":true,"patched_in":"1.3.31"}],"published":"2026-01-05T19:00:21Z","updated":"2026-01-06T07:22:12Z"},{"id":"wordfence:93f80f84-68b1-4c11-8bc8-19b78e253129","source":"wordfence","cve":"CVE-2026-88942","title":"Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f80f84-68b1-4c11-8bc8-19b78e253129?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-10-30T18:20:44Z","updated":"2026-10-31T06:44:20Z"},{"id":"wordfence:93f9862f-745f-44d5-ac49-f8d2d19b35ed","source":"wordfence","cve":"","title":"Wordfence Security - Firewall & Malware Scan <= 3.3.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f9862f-745f-44d5-ac49-f8d2d19b35ed?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2012-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:93f9e932-a084-4a88-a180-027054ede77d","source":"wordfence","cve":"CVE-2025-30608","title":"WordPress SQL Backup <= 3.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93f9e932-a084-4a88-a180-027054ede77d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-sql-backup","name":"WordPress SQL Backup","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:26:50Z"},{"id":"wordfence:93ff1634-d520-4895-8822-2dbfa7b5e030","source":"wordfence","cve":"CVE-2019-10866","title":"Form Maker by 10Web <= 1.13.2 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/93ff1634-d520-4895-8822-2dbfa7b5e030?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":false,"patched_in":"1.13.3"}],"published":"2019-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94015a8a-8779-4479-84c2-30e39742f5a4","source":"wordfence","cve":"CVE-2026-97328","title":"WebP Express <= 0.25.15 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94015a8a-8779-4479-84c2-30e39742f5a4?source=api-prod","affected":[{"type":"plugin","slug":"webp-express","name":"WebP Express","from":"*","from_inclusive":true,"to":"0.25.15","to_inclusive":true,"patched_in":"0.25.16"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:49:00Z"},{"id":"wordfence:9407c53a-c4b4-4f5a-a516-6fb29eb11836","source":"wordfence","cve":"CVE-2026-14829","title":"Checkimate <= 1.0.13 - Missing Authorization to Unauthenticated License Deactivation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9407c53a-c4b4-4f5a-a516-6fb29eb11836?source=api-prod","affected":[{"type":"plugin","slug":"checkimate","name":"Checkimate \u2014 WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-21T14:08:49Z"},{"id":"wordfence:940aabdc-e98e-45be-87dd-cafae45f2474","source":"wordfence","cve":"CVE-2008-0664","title":"WordPress Core < 2.3.3 - Improper Authorization Checks","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/940aabdc-e98e-45be-87dd-cafae45f2474?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2007-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:940c6a27-05a2-4eca-89ee-b483f88b9524","source":"wordfence","cve":"CVE-2025-12876","title":"Projectopia \u2013 WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/940c6a27-05a2-4eca-89ee-b483f88b9524?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2025-12-04T20:37:48Z","updated":"2025-12-12T21:07:50Z"},{"id":"wordfence:940d0c9b-a82e-474d-b664-52e46a5a2c3b","source":"wordfence","cve":"CVE-2026-107320","title":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI 7.9.5 - 8.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/940d0c9b-a82e-474d-b664-52e46a5a2c3b?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"7.9.5","from_inclusive":true,"to":"8.0.5","to_inclusive":true,"patched_in":"8.0.6"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:26:38Z"},{"id":"wordfence:94104431-6278-49a2-9b1a-d4ccac5f457b","source":"wordfence","cve":"CVE-2025-60165","title":"Frames <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94104431-6278-49a2-9b1a-d4ccac5f457b?source=api-prod","affected":[{"type":"theme","slug":"frames","name":"frames","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:10:28Z"},{"id":"wordfence:9410b5b8-1bb2-42d7-8d4d-721131d392e3","source":"wordfence","cve":"CVE-2023-3604","title":"Change WP Admin Login <= 1.1.3 - Protection Mechanism Failure to Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9410b5b8-1bb2-42d7-8d4d-721131d392e3?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-admin-login","name":"All In One Login","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:941233d8-f382-40a0-81b2-18a682ae07ca","source":"wordfence","cve":"CVE-2014-1854","title":"AdRotate \u2013 Ad manager & AdSense Ads 3.9 - 3.9.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941233d8-f382-40a0-81b2-18a682ae07ca?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"3.9","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2014-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94171811-5c4b-4306-b180-142e09891f50","source":"wordfence","cve":"CVE-2026-94389","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94171811-5c4b-4306-b180-142e09891f50?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"11.0.5","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-09-30T10:45:09Z","updated":"2026-10-09T00:07:49Z"},{"id":"wordfence:941aef7f-435b-4e59-8d55-f95800233c80","source":"wordfence","cve":"CVE-2025-64253","title":"Health Check & Troubleshooting <= 1.7.1 - Authenticated (Admin+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941aef7f-435b-4e59-8d55-f95800233c80?source=api-prod","affected":[{"type":"plugin","slug":"health-check","name":"Health Check & Troubleshooting","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:16:32Z"},{"id":"wordfence:941c9586-96a2-434e-af0d-c488e22ef97f","source":"wordfence","cve":"CVE-2026-10551","title":"Breeze Cache <= 2.5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941c9586-96a2-434e-af0d-c488e22ef97f?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-29T21:31:14Z"},{"id":"wordfence:941cf3f8-20a0-4d41-8fce-1554653d98da","source":"wordfence","cve":"CVE-2023-0551","title":"REST API TO MiniProgram <= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941cf3f8-20a0-4d41-8fce-1554653d98da?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-to-miniprogram","name":"REST API TO MiniProgram","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-12-05T15:52:11Z"},{"id":"wordfence:941d0647-5027-4642-88fc-3ab26acbb639","source":"wordfence","cve":"CVE-2026-0673","title":"Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection","severity":"medium","cvss":5.3,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941d0647-5027-4642-88fc-3ab26acbb639?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.3.15","to_inclusive":true,"patched_in":"8.3.16"}],"published":"2026-08-06T00:15:01Z","updated":"2026-08-06T12:27:39Z"},{"id":"wordfence:941ecfbd-d9d1-4103-aab2-fa843c4f8db3","source":"wordfence","cve":"CVE-2026-81273","title":"FluentBooking Pro <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/941ecfbd-d9d1-4103-aab2-fa843c4f8db3?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking-pro","name":"Fluent Booking Pro","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:15:18Z"},{"id":"wordfence:94217d06-21c2-443d-ae2c-a2dbd65b7908","source":"wordfence","cve":"CVE-2025-12537","title":"Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.14.3","to_inclusive":true,"patched_in":"1.14.4"}],"published":"2025-12-13T16:57:04Z","updated":"2025-12-14T05:21:20Z"},{"id":"wordfence:9423858b-74be-4b34-961d-97765d8edcbf","source":"wordfence","cve":"CVE-2025-9984","title":"Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9423858b-74be-4b34-961d-97765d8edcbf?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-09-25T16:00:23Z","updated":"2025-09-26T04:25:18Z"},{"id":"wordfence:9423e0a7-d5cf-4a67-b792-7685bf731015","source":"wordfence","cve":"CVE-2026-91831","title":"Subscribe to Comments 2.3 - 2.3.2 - Authenticated (Author+) Arbitrary Email Header Injection","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9423e0a7-d5cf-4a67-b792-7685bf731015?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"2.3","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T19:40:07Z"},{"id":"wordfence:9424e6ef-c1e4-44ee-8654-b3b93d6d5403","source":"wordfence","cve":"CVE-2025-46521","title":"WS Force Login Page <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9424e6ef-c1e4-44ee-8654-b3b93d6d5403?source=api-prod","affected":[{"type":"plugin","slug":"ws-force-login-page","name":"WS Force Login Page","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-21T13:47:55Z"},{"id":"wordfence:9428f710-db34-418f-9918-b35609ca5185","source":"wordfence","cve":"CVE-2019-14978","title":"WooCommerce PayU India <= 2.1.1 - Improper Input Validation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9428f710-db34-418f-9918-b35609ca5185?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payu-paisa","name":"WooCommerce PayU India (PayUmoney \u2013 PayUbiz)","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2019-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94297481-9ebb-42cb-9362-be8bc52b126f","source":"wordfence","cve":"CVE-2026-15897","title":"Super Forms \u2013 Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94297481-9ebb-42cb-9362-be8bc52b126f?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-10-01T16:34:31Z","updated":"2026-10-02T05:30:18Z"},{"id":"wordfence:942aad86-787e-4c25-a98b-9b7fe64aec23","source":"wordfence","cve":"CVE-2016-10913","title":"WP Latest Posts <= 3.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942aad86-787e-4c25-a98b-9b7fe64aec23?source=api-prod","affected":[{"type":"plugin","slug":"wp-latest-posts","name":"WP Latest Posts","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2015-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:942ae035-91b3-4330-800c-2dbe94a4b4b5","source":"wordfence","cve":"CVE-2019-15858","title":"Woody Ad Snippets <= 2.2.4 - Missing Authorization to Settings Import","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942ae035-91b3-4330-800c-2dbe94a4b4b5?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2019-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:942bceac-0587-4e74-bf3e-12d56dbb2186","source":"wordfence","cve":"CVE-2026-104727","title":"Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942bceac-0587-4e74-bf3e-12d56dbb2186?source=api-prod","affected":[{"type":"plugin","slug":"sequential-order-numbers-for-woocommerce","name":"Sequential Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.7"}],"published":"2026-10-28T20:35:05Z","updated":"2026-10-29T09:25:35Z"},{"id":"wordfence:942be1b2-0227-49e3-9e99-63b3de48fb22","source":"wordfence","cve":"CVE-2026-66668","title":"Community by PeepSo \u2013 Download from PeepSo.com <= 9.0.5.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942be1b2-0227-49e3-9e99-63b3de48fb22?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"9.0.5.2","to_inclusive":true,"patched_in":"9.0.5.3"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:29:02Z"},{"id":"wordfence:942df4bc-2a17-4add-9664-60d77319b93a","source":"wordfence","cve":"CVE-2025-7495","title":"WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942df4bc-2a17-4add-9664-60d77319b93a?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4.1","to_inclusive":true,"patched_in":"3.5.4.2"}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-22T04:25:07Z"},{"id":"wordfence:942e6724-5ef4-4b33-96ba-308806345c2a","source":"wordfence","cve":"CVE-2026-111835","title":"BjornTech Swish for WooCommerce <= 3.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942e6724-5ef4-4b33-96ba-308806345c2a?source=api-prod","affected":[{"type":"plugin","slug":"woo-swish-e-commerce","name":"BjornTech Swish for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2026-10-19T13:39:52Z","updated":"2026-10-23T18:30:01Z"},{"id":"wordfence:942fd805-0f4f-44e5-98df-0b44ed8c7543","source":"wordfence","cve":"CVE-2025-52726","title":"CouponXxL Custom Post Types <= 3.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942fd805-0f4f-44e5-98df-0b44ed8c7543?source=api-prod","affected":[{"type":"plugin","slug":"couponxxl-cpt","name":"CouponXxL Custom Post Types","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:49:29Z"},{"id":"wordfence:942fffb6-2719-4b70-9759-21b2d50002c5","source":"wordfence","cve":"CVE-2024-4222","title":"Tutor LMS Pro <= 2.7.0 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/942fffb6-2719-4b70-9759-21b2d50002c5?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T09:32:12Z"},{"id":"wordfence:94332eb8-0961-4c8d-97bb-3d5d08e8119f","source":"wordfence","cve":"CVE-2007-0539","title":"WordPress Core < 2.1 - Denial of Service","severity":"medium","cvss":4.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94332eb8-0961-4c8d-97bb-3d5d08e8119f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2007-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94337b59-6a88-467e-b487-b7b7e4f6f7a0","source":"wordfence","cve":"CVE-2014-1750","title":"Nokia Maps & Places < 1.6.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94337b59-6a88-467e-b487-b7b7e4f6f7a0?source=api-prod","affected":[{"type":"plugin","slug":"nokia-mapsplaces","name":"Nokia Maps & Places","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"}],"published":"2014-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94356695-d2b1-4144-a0ca-b638d4e70d8f","source":"wordfence","cve":"CVE-2025-30892","title":"WpTravelly <= 1.8.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94356695-d2b1-4144-a0ca-b638d4e70d8f?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:54:22Z"},{"id":"wordfence:943668eb-0185-4029-9459-f99141bf84cf","source":"wordfence","cve":"CVE-2026-14372","title":"Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/943668eb-0185-4029-9459-f99141bf84cf?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-08T21:29:05Z","updated":"2026-07-09T09:31:22Z"},{"id":"wordfence:94384812-fa6e-48db-a84a-b1769e62ca58","source":"wordfence","cve":"CVE-2026-11397","title":"WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94384812-fa6e-48db-a84a-b1769e62ca58?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.9.31"}],"published":"2026-07-02T16:07:10Z","updated":"2026-07-03T04:30:18Z"},{"id":"wordfence:94392c66-6e50-48bb-93cb-9aa9d0229761","source":"wordfence","cve":"CVE-2025-12483","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94392c66-6e50-48bb-93cb-9aa9d0229761?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.11.12","to_inclusive":true,"patched_in":"3.11.13"}],"published":"2025-12-01T17:52:15Z","updated":"2025-12-02T06:40:26Z"},{"id":"wordfence:943cd10b-1b58-4803-ba6f-291f73353422","source":"wordfence","cve":"CVE-2023-47756","title":"Welcome Email Editor <= 5.0.5 - Missing Authorization via ajax_handler","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/943cd10b-1b58-4803-ba6f-291f73353422?source=api-prod","affected":[{"type":"plugin","slug":"welcome-email-editor","name":"Swift SMTP (formerly Welcome Email Editor)","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:943d0fa8-8639-4e1d-9857-8a12b11c16d1","source":"wordfence","cve":"CVE-2026-94173","title":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/943d0fa8-8639-4e1d-9857-8a12b11c16d1?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.27","to_inclusive":true,"patched_in":"6.4.28"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:39:43Z"},{"id":"wordfence:943e20a1-b9f8-49b1-960a-7cab0f1b7683","source":"wordfence","cve":"CVE-2025-58962","title":"Publitio <= 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/943e20a1-b9f8-49b1-960a-7cab0f1b7683?source=api-prod","affected":[{"type":"plugin","slug":"publitio","name":"Publitio","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:15:06Z"},{"id":"wordfence:943f9389-5306-44c6-be81-76f7f07d6d57","source":"wordfence","cve":"CVE-2024-50520","title":"Ancient World Linked Data <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/943f9389-5306-44c6-be81-76f7f07d6d57?source=api-prod","affected":[{"type":"plugin","slug":"ancient-world-linked-data-for-wordpress","name":"Ancient World Linked Data for WordPress","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T14:41:16Z"},{"id":"wordfence:94426ff8-55e2-4c8e-86dc-aca306075f89","source":"wordfence","cve":"CVE-2025-32638","title":"ShopApper <= 0.4.62 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94426ff8-55e2-4c8e-86dc-aca306075f89?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-for-woocommerce","name":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce","from":"*","from_inclusive":true,"to":"0.4.62","to_inclusive":true,"patched_in":"0.4.63"}],"published":"2025-04-14T00:00:00Z","updated":"2026-09-09T15:52:01Z"},{"id":"wordfence:944360bd-3787-45cb-aeb0-48bb2874f372","source":"wordfence","cve":"CVE-2025-69171","title":"Orpheus <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/944360bd-3787-45cb-aeb0-48bb2874f372?source=api-prod","affected":[{"type":"theme","slug":"orpheus","name":"Orpheus","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:37:48Z"},{"id":"wordfence:9445a54c-06b9-400a-a8ae-a58f1b968196","source":"wordfence","cve":"CVE-2023-34012","title":"Premium Addons PRO <= 2.8.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9445a54c-06b9-400a-a8ae-a58f1b968196?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.8.24","to_inclusive":true,"patched_in":"2.8.25"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:944ba5a2-50fd-4b7c-8044-eec0aff2e20d","source":"wordfence","cve":"CVE-2026-88931","title":"Social Web Suite <= 4.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/944ba5a2-50fd-4b7c-8044-eec0aff2e20d?source=api-prod","affected":[{"type":"plugin","slug":"social-web-suite","name":"Social Web Suite \u2013 Social Media Auto Post, Social Media Auto Publish","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:19:41Z"},{"id":"wordfence:944cd237-d5cb-44da-8d4a-5cf7edd368a4","source":"wordfence","cve":"CVE-2015-2090","title":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress < 1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/944cd237-d5cb-44da-8d4a-5cf7edd368a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-poll","name":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2015-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:944e4c96-6ded-4483-9eaf-d976646f45ea","source":"wordfence","cve":"CVE-2024-13904","title":"Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/944e4c96-6ded-4483-9eaf-d976646f45ea?source=api-prod","affected":[{"type":"plugin","slug":"platformly-for-woocommerce","name":"Platform.ly for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:25Z"},{"id":"wordfence:94507563-d16c-497a-b242-705e8fc903d5","source":"wordfence","cve":"CVE-2025-69160","title":"Gita <= 1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94507563-d16c-497a-b242-705e8fc903d5?source=api-prod","affected":[{"type":"theme","slug":"gita","name":"Gita","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:44:33Z"},{"id":"wordfence:9450ad3b-065b-48f1-860a-7efc86dbcd23","source":"wordfence","cve":"CVE-2024-35696","title":"WP Docs <= 2.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9450ad3b-065b-48f1-860a-7efc86dbcd23?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:25:45Z"},{"id":"wordfence:94530e50-02ab-4e58-9230-5c6a7b6c13e5","source":"wordfence","cve":"CVE-2025-53455","title":"CashBill.pl - P\u0142atno\u015bci WooCommerce <= 3.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94530e50-02ab-4e58-9230-5c6a7b6c13e5?source=api-prod","affected":[{"type":"plugin","slug":"cashbill-payment-method","name":"CashBill.pl \u2013 P\u0142atno\u015bci WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-29T15:58:53Z"},{"id":"wordfence:9455c6c6-39cd-4dfd-be4e-c3e4569d6867","source":"wordfence","cve":"CVE-2025-62949","title":"Activity Plus Reloaded for BuddyPress <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9455c6c6-39cd-4dfd-be4e-c3e4569d6867?source=api-prod","affected":[{"type":"plugin","slug":"bp-activity-plus-reloaded","name":"Activity Plus Reloaded for BuddyPress","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-12T00:00:00Z","updated":"2025-10-29T14:48:53Z"},{"id":"wordfence:9455eccb-9f32-4e4e-8fe4-f345bf6e8da7","source":"wordfence","cve":"CVE-2025-9950","title":"Error Log Viewer by BestWebSoft <= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9455eccb-9f32-4e4e-8fe4-f345bf6e8da7?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer","name":"Error Log Viewer by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-10-10T20:39:18Z","updated":"2025-10-14T19:22:26Z"},{"id":"wordfence:94564fad-cfda-497f-a542-94f19960eb6d","source":"wordfence","cve":"CVE-2025-53297","title":"Woocommerce Envato Affiliates <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94564fad-cfda-497f-a542-94f19960eb6d?source=api-prod","affected":[{"type":"plugin","slug":"wooenvato","name":"Woocommerce Envato Affiliates","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T00:00:00Z","updated":"2025-11-04T16:34:30Z"},{"id":"wordfence:9456cd66-d608-49b8-ad4c-fdc89db4cd29","source":"wordfence","cve":"CVE-2026-107750","title":"PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9456cd66-d608-49b8-ad4c-fdc89db4cd29?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2026-10-30T18:26:39Z","updated":"2026-10-31T06:44:20Z"},{"id":"wordfence:9462b048-0e01-43b0-894d-43a53f744eb9","source":"wordfence","cve":"CVE-2022-1028","title":"WordPress Security <= 4.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9462b048-0e01-43b0-894d-43a53f744eb9?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-pro","name":"WordPress Security \u2013 Firewall, Malware Scanner, Secure Login and Backup","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94696151-9f99-4847-bd67-8fb77f8b6a0e","source":"wordfence","cve":"CVE-2023-49773","title":"BCorp Shortcodes <= 0.23 -  Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94696151-9f99-4847-bd67-8fb77f8b6a0e?source=api-prod","affected":[{"type":"plugin","slug":"bcorp-shortcodes","name":"BCorp Shortcodes","from":"*","from_inclusive":true,"to":"0.23","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9469946f-f471-4c7f-b69c-a38cbc08b0ac","source":"wordfence","cve":"CVE-2025-23616","title":"Canalplan <= 5.31 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9469946f-f471-4c7f-b69c-a38cbc08b0ac?source=api-prod","affected":[{"type":"plugin","slug":"canalplan-ac","name":"Canalplan","from":"*","from_inclusive":true,"to":"5.31","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T21:02:50Z"},{"id":"wordfence:946add6f-4cd5-4c55-9399-a782140f217c","source":"wordfence","cve":"CVE-2023-48737","title":"TriPay Payment Gateway <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946add6f-4cd5-4c55-9399-a782140f217c?source=api-prod","affected":[{"type":"plugin","slug":"tripay-payment-gateway","name":"TriPay Payment Gateway","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:946ba166-3309-4e47-8b6b-d3f017bbfcc8","source":"wordfence","cve":"CVE-2019-25144","title":"WP HTML Mail < 2.2.11 - HTML injection","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946ba166-3309-4e47-8b6b-d3f017bbfcc8?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-template","name":"WP Email Template","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":false,"patched_in":"2.2.11"}],"published":"2019-10-25T00:00:00Z","updated":"2024-05-31T15:30:48Z"},{"id":"wordfence:946bff00-32ff-4d9b-93e1-77e6ee4cd987","source":"wordfence","cve":"CVE-2014-4516","title":"BIC Media Widget <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946bff00-32ff-4d9b-93e1-77e6ee4cd987?source=api-prod","affected":[{"type":"plugin","slug":"bic-media","name":"BIC Media Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:946d4ec2-b75f-41e2-8132-47ccfc41d91a","source":"wordfence","cve":"CVE-2026-57322","title":"weMail \u2013 Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946d4ec2-b75f-41e2-8132-47ccfc41d91a?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:56:08Z"},{"id":"wordfence:946d5a2c-f20f-483a-8150-0266a631a112","source":"wordfence","cve":"","title":"Homepage SlideShow Plugin < 2.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946d5a2c-f20f-483a-8150-0266a631a112?source=api-prod","affected":[{"type":"plugin","slug":"wp-homepage-slideshow","name":"Homepage SlideShow","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2012-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:946ec633-a271-4e39-9ffe-e5543b063066","source":"wordfence","cve":"CVE-2026-76549","title":"UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946ec633-a271-4e39-9ffe-e5543b063066?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.26.7","to_inclusive":false,"patched_in":"1.26.7"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T21:00:17Z"},{"id":"wordfence:946f3b30-2f6f-41df-8944-a5da488b4278","source":"wordfence","cve":"CVE-2025-13073","title":"HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946f3b30-2f6f-41df-8944-a5da488b4278?source=api-prod","affected":[{"type":"plugin","slug":"handl-utm-grabber","name":"HandL UTM Grabber / Tracker","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-11-19T00:00:00Z","updated":"2025-12-12T21:00:59Z"},{"id":"wordfence:946f9596-3212-4208-a7e2-9e33a21dd97c","source":"wordfence","cve":"CVE-2025-23892","title":"Progress Tracker <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/946f9596-3212-4208-a7e2-9e33a21dd97c?source=api-prod","affected":[{"type":"plugin","slug":"progress-tracker","name":"Progress Tracker","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:11:11Z"},{"id":"wordfence:94712f92-5045-420b-9d6d-59a4c031e998","source":"wordfence","cve":"CVE-2023-34180","title":"Google Fonts For WordPress <= 3.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94712f92-5045-420b-9d6d-59a4c031e998?source=api-prod","affected":[{"type":"plugin","slug":"free-google-fonts","name":"Google Fonts For WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94724ff1-d3a7-4d9d-9423-a0e795360c95","source":"wordfence","cve":"CVE-2026-89051","title":"Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94724ff1-d3a7-4d9d-9423-a0e795360c95?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.12","to_inclusive":true,"patched_in":"7.0.13"}],"published":"2026-10-15T16:59:39Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:947286b0-347f-47ab-885a-7805b50f0be8","source":"wordfence","cve":"CVE-2023-46822","title":"WooCommerce - Store Exporter <= 2.7.2 - Reflected Cross-Site Scripting via 'filter'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/947286b0-347f-47ab-885a-7805b50f0be8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.2.1"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94736152-b365-4b3a-a786-ed49f7d0fc7a","source":"wordfence","cve":"CVE-2024-2409","title":"MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T08:31:30Z"},{"id":"wordfence:94750424-bb52-4236-962e-aa8cbdeb1459","source":"wordfence","cve":"CVE-2023-7015","title":"File Manager Pro <= 8.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94750424-bb52-4236-962e-aa8cbdeb1459?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-29T21:36:53Z"},{"id":"wordfence:947602ee-eaf2-4f00-af41-4080b6f6228f","source":"wordfence","cve":"CVE-2026-104313","title":"WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/947602ee-eaf2-4f00-af41-4080b6f6228f?source=api-prod","affected":[{"type":"plugin","slug":"wpc-estimated-delivery-date","name":"WPC Estimated Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-10-02T17:43:00Z","updated":"2026-10-29T15:00:57Z"},{"id":"wordfence:947626b4-c640-4b45-8186-2ed4ff7c2c18","source":"wordfence","cve":"CVE-2024-31234","title":"REHub Framework < 19.6.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/947626b4-c640-4b45-8186-2ed4ff7c2c18?source=api-prod","affected":[{"type":"plugin","slug":"rehub-framework","name":"reHub Framework","from":"*","from_inclusive":true,"to":"19.6.2","to_inclusive":false,"patched_in":"19.6.2"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-06T17:24:35Z"},{"id":"wordfence:9476b41d-a9a2-46a7-8cf1-62de5d1703b1","source":"wordfence","cve":"CVE-2024-30491","title":"ProfileGrid  <= 5.7.8 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9476b41d-a9a2-46a7-8cf1-62de5d1703b1?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:27:03Z"},{"id":"wordfence:94772de9-6ab8-45ff-8b56-19b50a81b66f","source":"wordfence","cve":"CVE-2024-1173","title":"WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94772de9-6ab8-45ff-8b56-19b50a81b66f?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2024-05-01T00:00:00Z","updated":"2025-11-10T11:29:37Z"},{"id":"wordfence:9479765c-65e8-484f-bade-413733e2c464","source":"wordfence","cve":"CVE-2026-94060","title":"Voldor <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9479765c-65e8-484f-bade-413733e2c464?source=api-prod","affected":[{"type":"theme","slug":"voldor","name":"Voldor - Welding & Metal Work WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:18:01Z"},{"id":"wordfence:9479c9ff-6da3-4391-802d-9e3eb14eff77","source":"wordfence","cve":"CVE-2022-3880","title":"Anti Hacker <= 4.19 - Missing Authorization to Arbitrary Plugin Install","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9479c9ff-6da3-4391-802d-9e3eb14eff77?source=api-prod","affected":[{"type":"plugin","slug":"antihacker","name":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan","from":"*","from_inclusive":true,"to":"4.19","to_inclusive":true,"patched_in":"4.20"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9481a3a6-6d79-4246-852e-f664f578ee71","source":"wordfence","cve":"CVE-2026-25431","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9481a3a6-6d79-4246-852e-f664f578ee71?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.10.1","to_inclusive":true,"patched_in":"7.8.10.2"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T13:35:20Z"},{"id":"wordfence:94827865-0c1b-4bdc-8562-d2559a0d56ac","source":"wordfence","cve":"CVE-2026-73338","title":"Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94827865-0c1b-4bdc-8562-d2559a0d56ac?source=api-prod","affected":[{"type":"plugin","slug":"platnosci-online-blue-media","name":"Autopay","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:16:31Z"},{"id":"wordfence:94864056-25bb-4a61-bb03-4ac8569d4de1","source":"wordfence","cve":"CVE-2026-22414","title":"Marra <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94864056-25bb-4a61-bb03-4ac8569d4de1?source=api-prod","affected":[{"type":"theme","slug":"marra","name":"Marra - Beauty WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:33:43Z"},{"id":"wordfence:94868d48-2d36-49f1-9da1-7965ecaeae3c","source":"wordfence","cve":"CVE-2023-0764","title":"Gallery by BestWebSoft <= 4.6.9 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94868d48-2d36-49f1-9da1-7965ecaeae3c?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9489f066-5898-4908-b3aa-cf856958cb4e","source":"wordfence","cve":"CVE-2024-39626","title":"Pretty Simple Popup Builder <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9489f066-5898-4908-b3aa-cf856958cb4e?source=api-prod","affected":[{"type":"plugin","slug":"pretty-simple-popup-builder","name":"Pretty Simple Popup Builder","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2024-07-22T00:00:00Z","updated":"2024-12-05T20:35:24Z"},{"id":"wordfence:948b9d68-8b31-42a0-bdc5-4a8e4e969ca9","source":"wordfence","cve":"CVE-2022-4385","title":"Intuitive Custom Post Order <= 3.1.3 - Missing Authorization to Authenticated Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/948b9d68-8b31-42a0-bdc5-4a8e4e969ca9?source=api-prod","affected":[{"type":"plugin","slug":"intuitive-custom-post-order","name":"Intuitive Custom Post Order","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:948d3d24-f596-4ef3-936b-d68219826942","source":"wordfence","cve":"CVE-2026-19613","title":"ECS \u2013 Ele Custom Skin for Elementor < 4.3.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/948d3d24-f596-4ef3-936b-d68219826942?source=api-prod","affected":[{"type":"plugin","slug":"ele-custom-skin","name":"ECS \u2013 Ele Custom Skin for Elementor","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":false,"patched_in":"4.3.10"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:05:37Z"},{"id":"wordfence:948d40f5-2c87-4439-b4ef-3e02c397bf0f","source":"wordfence","cve":"CVE-2015-10099","title":"CP Appointment Calendar <= 1.1.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/948d40f5-2c87-4439-b4ef-3e02c397bf0f?source=api-prod","affected":[{"type":"plugin","slug":"cp-appointment-calendar","name":"CP Appointment Calendar","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2015-02-12T00:00:00Z","updated":"2024-06-06T16:06:59Z"},{"id":"wordfence:948dc4ed-7dd3-4a53-83db-82b8c39ace7a","source":"wordfence","cve":"CVE-2024-10009","title":"Melapress File Monitor <= 2.0.2 - Authenticated (Admin+) Authenticated SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/948dc4ed-7dd3-4a53-83db-82b8c39ace7a?source=api-prod","affected":[{"type":"plugin","slug":"website-file-changes-monitor","name":"Melapress File Monitor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-03-02T00:00:00Z","updated":"2025-05-27T14:35:47Z"},{"id":"wordfence:94932f9a-89d4-47f1-941e-eb1bdd2df63f","source":"wordfence","cve":"CVE-2025-69035","title":"Dental Care CPT <= 20.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94932f9a-89d4-47f1-941e-eb1bdd2df63f?source=api-prod","affected":[{"type":"plugin","slug":"dentalcare-cpt","name":"Dental Care CPT","from":"*","from_inclusive":true,"to":"20.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:54:53Z"},{"id":"wordfence:94953618-2beb-43f6-ab73-94e676546fa7","source":"wordfence","cve":"CVE-2025-32598","title":"WP Table Builder <= 2.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94953618-2beb-43f6-ab73-94e676546fa7?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-23T17:49:20Z"},{"id":"wordfence:9495e25d-a5a6-4f25-9363-783626e58a4a","source":"wordfence","cve":"CVE-2020-36714","title":"Brizy < 1.0.126 - Authorization Bypass to Settings Updates","severity":"high","cvss":7.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9495e25d-a5a6-4f25-9363-783626e58a4a?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"1.0.126","to_inclusive":false,"patched_in":"1.0.126"}],"published":"2020-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94974552-1c52-417b-9b4e-c30fd13a8ad4","source":"wordfence","cve":"CVE-2025-9436","title":"Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94974552-1c52-417b-9b4e-c30fd13a8ad4?source=api-prod","affected":[{"type":"plugin","slug":"wp-reviews-plugin-for-google","name":"Widgets for Google Reviews","from":"*","from_inclusive":true,"to":"13.2.1","to_inclusive":true,"patched_in":"13.2.2"}],"published":"2025-12-10T15:02:27Z","updated":"2025-12-11T03:27:12Z"},{"id":"wordfence:949d61d9-641e-4e66-a3de-8408632b8c77","source":"wordfence","cve":"CVE-2026-62138","title":"Visual Composer Website Builder <= 45.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/949d61d9-641e-4e66-a3de-8408632b8c77?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.16.1","to_inclusive":true,"patched_in":"45.16.2"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:31:26Z"},{"id":"wordfence:949ea4e6-420a-437d-8e71-ee20119343f3","source":"wordfence","cve":"CVE-2024-50514","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/949ea4e6-420a-437d-8e71-ee20119343f3?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.8.18"}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T18:54:52Z"},{"id":"wordfence:949eb9d6-0c8f-43f1-8580-998ea78c9549","source":"wordfence","cve":"CVE-2025-13678","title":"Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/949eb9d6-0c8f-43f1-8580-998ea78c9549?source=api-prod","affected":[{"type":"plugin","slug":"thai-lottery-widget","name":"Thai Lottery Widget","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-12-04T20:35:14Z","updated":"2026-07-10T15:27:48Z"},{"id":"wordfence:949effee-d99c-4965-9d89-3309d4df66cd","source":"wordfence","cve":"CVE-2017-6103","title":"AnyVar <= 0.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/949effee-d99c-4965-9d89-3309d4df66cd?source=api-prod","affected":[{"type":"plugin","slug":"anyvar","name":"Wordpress plugin AnyVar","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2017-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94a18ddb-fa30-4a0f-9ce7-390dc1cee8a8","source":"wordfence","cve":"CVE-2024-3965","title":"Pray For Me <= 1.0.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94a18ddb-fa30-4a0f-9ce7-390dc1cee8a8?source=api-prod","affected":[{"type":"plugin","slug":"pray-for-me","name":"Pray For Me","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:33:45Z"},{"id":"wordfence:94a4123b-c21b-4f3e-b1cc-96c8f07c3fc6","source":"wordfence","cve":"CVE-2024-25934","title":"FormFacade <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94a4123b-c21b-4f3e-b1cc-96c8f07c3fc6?source=api-prod","affected":[{"type":"plugin","slug":"formfacade","name":"FormFacade \u2013 Embed Google Forms in your website","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-02-20T00:00:00Z","updated":"2024-03-14T12:54:43Z"},{"id":"wordfence:94a9ef6b-57f9-4e3b-a048-27538bbecf2f","source":"wordfence","cve":"","title":"MyBookTable Bookstore by Stormhill Media <= 2.1.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94a9ef6b-57f9-4e3b-a048-27538bbecf2f?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2015-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94ab250a-387c-431e-9b75-16ede94bf0ef","source":"wordfence","cve":"CVE-2024-5456","title":"Panda Video <= 1.4.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ab250a-387c-431e-9b75-16ede94bf0ef?source=api-prod","affected":[{"type":"plugin","slug":"pandavideo","name":"Panda Video","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-07-08T20:01:45Z","updated":"2024-08-01T20:24:34Z"},{"id":"wordfence:94abb34a-4451-4f41-ba23-d2a723e5a2e7","source":"wordfence","cve":"CVE-2022-45371","title":"ShopEngine <= 4.1.1 - Cross-Site Request Forgery via get_product","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94abb34a-4451-4f41-ba23-d2a723e5a2e7?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94aca046-a680-4d13-a7ba-501573aace59","source":"wordfence","cve":"CVE-2025-24634","title":"Orbisius Simple Notice <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94aca046-a680-4d13-a7ba-501573aace59?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-simple-notice","name":"Orbisius Simple Notice","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:43:53Z"},{"id":"wordfence:94aca289-e242-4b0c-9bd8-cc77b1d26b34","source":"wordfence","cve":"CVE-2025-47545","title":"Poll Maker <= 5.7.7 - Unauthenticated Race Condition to Multi-Vote","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94aca289-e242-4b0c-9bd8-cc77b1d26b34?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"5.7.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:03:40Z"},{"id":"wordfence:94ad6b51-ff8d-48d5-9a70-1781d13990a5","source":"wordfence","cve":"CVE-2023-6980","title":"WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ad6b51-ff8d-48d5-9a70-1781d13990a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:36:54Z"},{"id":"wordfence:94ada60f-1e20-454e-a9d7-7849be764d81","source":"wordfence","cve":"CVE-2024-8494","title":"Elementor Website Builder Pro \u2013 More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ada60f-1e20-454e-a9d7-7849be764d81?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.25.10","to_inclusive":true,"patched_in":"3.25.11"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:42:06Z"},{"id":"wordfence:94ae2c4e-7281-4993-967b-6321e6279c47","source":"wordfence","cve":"CVE-2024-37962","title":"Fusion <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ae2c4e-7281-4993-967b-6321e6279c47?source=api-prod","affected":[{"type":"plugin","slug":"fusion","name":"Fusion Page Builder","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-07-10T00:00:00Z","updated":"2024-09-09T20:14:38Z"},{"id":"wordfence:94afe3e2-a1f1-470b-afaf-c7926beaec9a","source":"wordfence","cve":"CVE-2024-7302","title":"Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94afe3e2-a1f1-470b-afaf-c7926beaec9a?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":"7.5.5"}],"published":"2024-07-31T18:01:17Z","updated":"2024-08-01T06:47:06Z"},{"id":"wordfence:94b289bf-0ef1-47d1-98bd-8f7bb753c2bc","source":"wordfence","cve":"CVE-2025-1505","title":"Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b289bf-0ef1-47d1-98bd-8f7bb753c2bc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ajax-filters","name":"Advanced AJAX Product Filters","from":"*","from_inclusive":true,"to":"1.6.8.1","to_inclusive":true,"patched_in":"1.6.8.2"}],"published":"2025-02-27T16:18:52Z","updated":"2025-02-28T04:21:57Z"},{"id":"wordfence:94b39ba7-1163-4cc1-952b-5e25a38c8a5d","source":"wordfence","cve":"CVE-2026-93935","title":"Let's Play | Hockey School & Winter Sports WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b39ba7-1163-4cc1-952b-5e25a38c8a5d?source=api-prod","affected":[{"type":"theme","slug":"playhockey","name":"Let's Play | Hockey School & Winter Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:48:00Z","updated":"2026-10-13T14:27:22Z"},{"id":"wordfence:94b3bda3-d95b-4328-9637-b7b192d8b0e5","source":"wordfence","cve":"CVE-2025-67596","title":"Business Directory <= 6.4.19 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b3bda3-d95b-4328-9637-b7b192d8b0e5?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.19","to_inclusive":true,"patched_in":"6.4.20"}],"published":"2025-12-03T00:00:00Z","updated":"2025-12-11T16:00:04Z"},{"id":"wordfence:94b7909b-a222-40ec-9e20-3ae655ecfc78","source":"wordfence","cve":"CVE-2025-13070","title":"CSV to SortTable <= 4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b7909b-a222-40ec-9e20-3ae655ecfc78?source=api-prod","affected":[{"type":"plugin","slug":"csv-to-sorttable","name":"CSV to SortTable","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-11T16:18:22Z"},{"id":"wordfence:94b89921-96a3-449a-998f-74cde4570468","source":"wordfence","cve":"CVE-2024-34441","title":"Easy Affiliate Links <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b89921-96a3-449a-998f-74cde4570468?source=api-prod","affected":[{"type":"plugin","slug":"easy-affiliate-links","name":"Easy Affiliate Links","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:40:58Z"},{"id":"wordfence:94b98842-8c75-4623-8cc9-ad3dc0916a18","source":"wordfence","cve":"CVE-2023-28423","title":"Modern Footnotes <= 1.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94b98842-8c75-4623-8cc9-ad3dc0916a18?source=api-prod","affected":[{"type":"plugin","slug":"modern-footnotes","name":"Modern Footnotes","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":true,"patched_in":"1.4.16"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94bae97d-2959-4ace-992d-1f4b1ccc8c3b","source":"wordfence","cve":"CVE-2024-10226","title":"Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94bae97d-2959-4ace-992d-1f4b1ccc8c3b?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2024-10-29T00:48:58Z","updated":"2024-10-29T13:53:56Z"},{"id":"wordfence:94bd2229-0dfa-4f8b-9aa8-e2ee1bb7bc27","source":"wordfence","cve":"CVE-2022-1387","title":"No Future Posts <= 1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94bd2229-0dfa-4f8b-9aa8-e2ee1bb7bc27?source=api-prod","affected":[{"type":"plugin","slug":"no-future-posts","name":"No Future Posts","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94bef2d7-3f71-4231-bc54-c9120ccc779e","source":"wordfence","cve":"CVE-2026-1829","title":"Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94bef2d7-3f71-4231-bc54-c9120ccc779e?source=api-prod","affected":[{"type":"plugin","slug":"content-visibility-for-divi-builder","name":"Content Visibility for Divi Builder","from":"*","from_inclusive":true,"to":"4.02","to_inclusive":true,"patched_in":"5.00"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T18:16:27Z"},{"id":"wordfence:94c118a2-b0af-488f-bbb7-e2575c2c9523","source":"wordfence","cve":"CVE-2025-30584","title":"AlphaOmega Captcha &amp; Anti-Spam Filter <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c118a2-b0af-488f-bbb7-e2575c2c9523?source=api-prod","affected":[{"type":"plugin","slug":"alphaomega-captcha-anti-spam","name":"AlphaOmega Captcha & Anti-Spam Filter","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:12:57Z"},{"id":"wordfence:94c14f1b-4ab3-4d96-bf87-6cbb682c9fd9","source":"wordfence","cve":"CVE-2026-22397","title":"Fleur <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c14f1b-4ab3-4d96-bf87-6cbb682c9fd9?source=api-prod","affected":[{"type":"theme","slug":"fleur","name":"fleur","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:42:54Z"},{"id":"wordfence:94c1e520-efd7-479f-8cfc-bc75a00a610f","source":"wordfence","cve":"CVE-2025-69048","title":"Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c1e520-efd7-479f-8cfc-bc75a00a610f?source=api-prod","affected":[{"type":"plugin","slug":"universal-video-player","name":"Universal Video Player - WordPress Plugin","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T22:02:53Z"},{"id":"wordfence:94c2dab9-40b3-4863-a5f3-fcaba10d2e20","source":"wordfence","cve":"CVE-2022-1933","title":"CDI \u2013 Collect and Deliver Interface for Woocommerce <= 5.1.9 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c2dab9-40b3-4863-a5f3-fcaba10d2e20?source=api-prod","affected":[{"type":"plugin","slug":"collect-and-deliver-interface-for-woocommerce","name":"CDI \u2013 Collect and Deliver Interface for Woocommerce","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":"5.1.10"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94c3e857-6e5b-4f1f-8ebb-fee439541beb","source":"wordfence","cve":"CVE-2025-22727","title":"MailChimp Subscribe Forms  <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c3e857-6e5b-4f1f-8ebb-fee439541beb?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T16:59:33Z"},{"id":"wordfence:94c3fb5a-c6bb-447f-9b37-0eadaccbf374","source":"wordfence","cve":"CVE-2026-25343","title":"WSMS (formerly WP SMS) \u2013 SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c3fb5a-c6bb-447f-9b37-0eadaccbf374?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-26T20:07:39Z"},{"id":"wordfence:94c6ee49-604d-4183-bd47-7ab2732de6b4","source":"wordfence","cve":"CVE-2026-118500","title":"Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c6ee49-604d-4183-bd47-7ab2732de6b4?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor-form","name":"Cool FormKit Lite \u2013 Advanced Form Builder for Elementor","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2026-10-29T17:03:09Z","updated":"2026-10-30T05:35:52Z"},{"id":"wordfence:94c8979a-db2e-490f-b055-cdf19a48cf73","source":"wordfence","cve":"CVE-2023-51490","title":"Defender Security <= 4.1.0 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c8979a-db2e-490f-b055-cdf19a48cf73?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94c8a94b-1f18-4ed5-9392-113cc752a238","source":"wordfence","cve":"CVE-2026-17517","title":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets) < 4.5.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c8a94b-1f18-4ed5-9392-113cc752a238?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"4.5.1.2","to_inclusive":false,"patched_in":"4.5.1.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:25:04Z"},{"id":"wordfence:94c98edf-6f4a-4c23-afa7-d5caaa22397f","source":"wordfence","cve":"CVE-2023-47191","title":"Youzify <= 1.2.2 - Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c98edf-6f4a-4c23-afa7-d5caaa22397f?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94ca4814-d55c-4756-b4cf-2619a6fd0999","source":"wordfence","cve":"CVE-2026-25355","title":"Sanzo < 2.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ca4814-d55c-4756-b4cf-2619a6fd0999?source=api-prod","affected":[{"type":"theme","slug":"sanzo","name":"sanzo","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":false,"patched_in":"2.4.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:16:50Z"},{"id":"wordfence:94cbd525-de3b-448a-b65b-21c63208b8b8","source":"wordfence","cve":"CVE-2021-39332","title":"Business Manager  <= 1.4.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94cbd525-de3b-448a-b65b-21c63208b8b8?source=api-prod","affected":[{"type":"plugin","slug":"business-manager","name":"WordPress ERP, HR, CRM, and Project Management Plugin \u2013 Business Manager","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2021-10-14T13:46:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94d26ec1-88e4-4bd5-89a6-692d7418df7c","source":"wordfence","cve":"CVE-2025-60088","title":"WebinarIgnition <= 4.06.04 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d26ec1-88e4-4bd5-89a6-692d7418df7c?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"4.06.04","to_inclusive":true,"patched_in":"4.06.05"}],"published":"2025-08-10T00:00:00Z","updated":"2026-01-23T20:36:37Z"},{"id":"wordfence:94d2eaed-048b-40b6-9880-fa32fbb66f92","source":"wordfence","cve":"CVE-2018-13137","title":"Events Manager <= 5.9.4 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d2eaed-048b-40b6-9880-fa32fbb66f92?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2018-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94d522bc-9808-435d-804d-e979a6c8be66","source":"wordfence","cve":"CVE-2015-5057","title":"Broken Link Checker <= 1.10.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d522bc-9808-435d-804d-e979a6c8be66?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.10.9","to_inclusive":false,"patched_in":"1.10.9"}],"published":"2015-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94d60fcb-a542-41a9-b6ac-6ac2607068aa","source":"wordfence","cve":"CVE-2023-40011","title":"Cost Calculator Builder <= 3.1.42 - Improper Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d60fcb-a542-41a9-b6ac-6ac2607068aa?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.1.43","to_inclusive":false,"patched_in":"3.1.43"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94d67030-30ea-4583-a716-79805a5619e8","source":"wordfence","cve":"CVE-2024-49611","title":"Product Website Showcase <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d67030-30ea-4583-a716-79805a5619e8?source=api-prod","affected":[{"type":"plugin","slug":"product-websites-showcase","name":"Product Website Showcase","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T17:07:34Z"},{"id":"wordfence:94d682bb-ed94-40fc-98b4-2f404d6cd8ea","source":"wordfence","cve":"CVE-2022-2099","title":"WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d682bb-ed94-40fc-98b4-2f404d6cd8ea?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"6.6.0","to_inclusive":false,"patched_in":"6.6.0"}],"published":"2022-06-20T00:00:00Z","updated":"2024-05-31T15:30:48Z"},{"id":"wordfence:94d75f18-67ab-4367-982b-73e256d5dbe2","source":"wordfence","cve":"CVE-2026-2281","title":"Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d75f18-67ab-4367-982b-73e256d5dbe2?source=api-prod","affected":[{"type":"plugin","slug":"private-comment","name":"Private Comment","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":"0.0.5"}],"published":"2026-02-17T18:31:20Z","updated":"2026-02-18T06:42:42Z"},{"id":"wordfence:94d8211d-4027-4335-8c06-d8080231e511","source":"wordfence","cve":"CVE-2017-14848","title":"WPHRM - Human Resource Management System < 1.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94d8211d-4027-4335-8c06-d8080231e511?source=api-prod","affected":[{"type":"theme","slug":"wphrm","name":"WPHRM \u2013 Human Resource Management System for Wordpress | WordPress","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2017-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94dbf144-4a8f-4d9a-ad32-703a91823acb","source":"wordfence","cve":"","title":"Limit Login Attempts Plus <= 1.0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dbf144-4a8f-4d9a-ad32-703a91823acb?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-plus","name":"Limit Login Attempts Plus \u2013 WordPress Limit Login Attempts By Felix","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94dc8fc6-8212-4f83-a844-f08174531d3b","source":"wordfence","cve":"","title":"Simple Login Registration <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dc8fc6-8212-4f83-a844-f08174531d3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-login-registration-plugin","name":"wp-simple-login-registration-plugin","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2013-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94dcaa35-f39f-4e8b-a57c-78343520cca6","source":"wordfence","cve":"CVE-2026-57671","title":"Perfmatters <= 2.6.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dcaa35-f39f-4e8b-a57c-78343520cca6?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:05:22Z"},{"id":"wordfence:94dd90ef-d801-4fd6-ade7-e1e7ad2e5fec","source":"wordfence","cve":"CVE-2011-3856","title":"Elegant Grunge <= 1.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dd90ef-d801-4fd6-ade7-e1e7ad2e5fec?source=api-prod","affected":[{"type":"theme","slug":"elegant-grunge","name":"Elegant Grunge","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2011-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94df820c-cafb-4a43-ace1-ec396b1ae6c5","source":"wordfence","cve":"","title":"Cache Images <= 3.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94df820c-cafb-4a43-ace1-ec396b1ae6c5?source=api-prod","affected":[{"type":"plugin","slug":"cache-images","name":"Cache Images","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94dfb7fc-1d57-4ff9-ae9e-5f7172e9b859","source":"wordfence","cve":"CVE-2025-48266","title":"Active Products Tables for WooCommerce <= 1.0.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dfb7fc-1d57-4ff9-ae9e-5f7172e9b859?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.8","to_inclusive":true,"patched_in":"1.0.6.9"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:53:45Z"},{"id":"wordfence:94dfd689-7def-4920-bc9e-c80a0cf11ac5","source":"wordfence","cve":"CVE-2026-85038","title":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More < 5.2.40 -  Unauthenticated Unauthorized B2B Group Assignment","severity":"medium","cvss":5.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94dfd689-7def-4920-bc9e-c80a0cf11ac5?source=api-prod","affected":[{"type":"plugin","slug":"b2bking-wholesale-for-woocommerce","name":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More","from":"*","from_inclusive":true,"to":"5.2.40","to_inclusive":false,"patched_in":"5.2.40"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:30:39Z"},{"id":"wordfence:94e0f4cd-55fa-42f4-8d56-c8598ade4dc7","source":"wordfence","cve":"CVE-2025-27310","title":"Page and Post Lister <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e0f4cd-55fa-42f4-8d56-c8598ade4dc7?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-lister","name":"Page and Post Lister","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:26:52Z"},{"id":"wordfence:94e17808-9eb7-4a4d-8287-30d571df0f77","source":"wordfence","cve":"CVE-2026-48889","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e17808-9eb7-4a4d-8287-30d571df0f77?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-11T13:59:44Z"},{"id":"wordfence:94e373fb-b3f5-4c1b-9eaa-89747af4dc30","source":"wordfence","cve":"CVE-2025-1665","title":"Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e373fb-b3f5-4c1b-9eaa-89747af4dc30?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.14","to_inclusive":true,"patched_in":"3.11.15"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-01T05:22:46Z"},{"id":"wordfence:94e541ad-83dd-40eb-ab9e-e675e4021c3a","source":"wordfence","cve":"CVE-2025-67913","title":"Aruba HiSpeed Cache < 3.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e541ad-83dd-40eb-ab9e-e675e4021c3a?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T14:11:13Z"},{"id":"wordfence:94e604ec-4a9e-4da2-a902-31df4252fca3","source":"wordfence","cve":"CVE-2026-82182","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e604ec-4a9e-4da2-a902-31df4252fca3?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.133","to_inclusive":false,"patched_in":"0.9.133"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:22:08Z"},{"id":"wordfence:94e6118a-5950-481a-92f3-f25e01f186d7","source":"wordfence","cve":"CVE-2024-56243","title":"WPSSO Core <= 18.18.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e6118a-5950-481a-92f3-f25e01f186d7?source=api-prod","affected":[{"type":"plugin","slug":"wpsso","name":"WPSSO Core \u2013 Complete Schema Markup and Meta Tags","from":"*","from_inclusive":true,"to":"18.18.1","to_inclusive":true,"patched_in":"18.18.2"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:57:49Z"},{"id":"wordfence:94e859ea-3f90-49d1-9e66-fe3ab749c872","source":"wordfence","cve":"CVE-2024-32695","title":"Language Switcher for Transposh <= 1.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e859ea-3f90-49d1-9e66-fe3ab749c872?source=api-prod","affected":[{"type":"plugin","slug":"language-switcher-for-transposh","name":"Language Switcher for Transposh","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T12:48:08Z"},{"id":"wordfence:94e8de22-c373-4f0c-9723-f19752ade4e7","source":"wordfence","cve":"CVE-2026-101928","title":"Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e8de22-c373-4f0c-9723-f19752ade4e7?source=api-prod","affected":[{"type":"plugin","slug":"magic-tooltips-for-contact-form-7","name":"Magic Tooltips For Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2026-10-02T16:39:35Z","updated":"2026-10-03T05:29:16Z"},{"id":"wordfence:94e987be-bdfc-4691-b250-2b7d7249df0a","source":"wordfence","cve":"CVE-2026-15303","title":"6Storage Rentals <= 2.28.0 - Unauthenticated Account Takeover via 'email' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e987be-bdfc-4691-b250-2b7d7249df0a?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.28.0","to_inclusive":true,"patched_in":"2.29.0"}],"published":"2026-08-14T14:02:10Z","updated":"2026-09-02T21:03:02Z"},{"id":"wordfence:94e9a982-a46d-4dda-9145-e7f74cf09820","source":"wordfence","cve":"","title":"WP-Filebase <= 3.4.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94e9a982-a46d-4dda-9145-e7f74cf09820?source=api-prod","affected":[{"type":"plugin","slug":"wp-filebase","name":"WP-Filebase","from":"*","from_inclusive":true,"to":"3.4.23","to_inclusive":true,"patched_in":"3.4.24"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94ed918c-8f6f-4e1f-ab1d-e16632831951","source":"wordfence","cve":"CVE-2023-32512","title":"ShortPixel Adaptive Images <= 3.7.1 - Cross-Site Request Forgery via shortpixel_ai_handle_page_action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94ed918c-8f6f-4e1f-ab1d-e16632831951?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":false,"patched_in":"3.7.2"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94efdb07-653b-4838-b584-e45e9ab9b7a5","source":"wordfence","cve":"CVE-2024-9868","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94efdb07-653b-4838-b584-e45e9ab9b7a5?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-02T02:03:08Z"},{"id":"wordfence:94f0041d-eed6-4980-a7b8-f7410ca68e67","source":"wordfence","cve":"CVE-2022-45833","title":"Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f0041d-eed6-4980-a7b8-f7410ca68e67?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94f03821-eb33-4eb6-b7ff-b32a74facdd2","source":"wordfence","cve":"CVE-2021-24309","title":"Weekly Schedule <= 3.4.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f03821-eb33-4eb6-b7ff-b32a74facdd2?source=api-prod","affected":[{"type":"plugin","slug":"weekly-schedule","name":"Weekly Schedule","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":false,"patched_in":"3.4.3"}],"published":"2021-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94f0aa43-3d36-4e02-8d96-5d0a2bd8dbd9","source":"wordfence","cve":"CVE-2026-17018","title":"CubeWP Framework <= 1.1.30 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f0aa43-3d36-4e02-8d96-5d0a2bd8dbd9?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":""}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-21T15:46:11Z"},{"id":"wordfence:94f118c3-d470-43c4-a61a-1ec998694880","source":"wordfence","cve":"CVE-2023-52134","title":"GEO my WordPress <= 4.0.2 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f118c3-d470-43c4-a61a-1ec998694880?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94f19f56-0667-443e-8545-a17fbe9c3ddb","source":"wordfence","cve":"CVE-2024-9582","title":"Accordion Slider <= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f19f56-0667-443e-8545-a17fbe9c3ddb?source=api-prod","affected":[{"type":"plugin","slug":"accordion-slider","name":"Accordion Slider","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T06:43:37Z"},{"id":"wordfence:94f338c2-95c9-4ce8-8579-0b2b66547aa0","source":"wordfence","cve":"CVE-2023-47546","title":"OneClick Chat to Order <= 1.0.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f338c2-95c9-4ce8-8579-0b2b66547aa0?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.4.2","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94f366c8-65d7-4086-8a33-d4d81124d03f","source":"wordfence","cve":"CVE-2025-26922","title":"AuraMart <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f366c8-65d7-4086-8a33-d4d81124d03f?source=api-prod","affected":[{"type":"theme","slug":"auramart","name":"AuraMart","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:41:28Z"},{"id":"wordfence:94f3b21d-1910-46e9-af89-4602099f207c","source":"wordfence","cve":"CVE-2024-35171","title":"Academy LMS <= 1.9.25 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f3b21d-1910-46e9-af89-4602099f207c?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"1.9.25","to_inclusive":true,"patched_in":"1.9.26"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:25:41Z"},{"id":"wordfence:94f6aab3-49a7-4837-a424-e40e483f3f68","source":"wordfence","cve":"CVE-2024-13345","title":"Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f6aab3-49a7-4837-a424-e40e483f3f68?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.13","to_inclusive":true,"patched_in":"3.11.14"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T06:58:06Z"},{"id":"wordfence:94f6b24e-2c53-45c7-a19a-c37486838183","source":"wordfence","cve":"CVE-2026-25376","title":"Addon Jobsearch Chat <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f6b24e-2c53-45c7-a19a-c37486838183?source=api-prod","affected":[{"type":"plugin","slug":"addon-jobsearch-chat","name":"Addon Jobsearch Chat","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:22:31Z"},{"id":"wordfence:94f7f2d2-e90b-4978-bab8-eee160949567","source":"wordfence","cve":"","title":"MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f7f2d2-e90b-4978-bab8-eee160949567?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-updraftplus-extension","name":"MainWP UpdraftPlus Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94f803f4-0a06-4b77-9483-5c63f6dfd2f0","source":"wordfence","cve":"CVE-2016-10878","title":"WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94f803f4-0a06-4b77-9483-5c63f6dfd2f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2016-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:94faab0a-dee9-4c31-a5be-4de35cc01d62","source":"wordfence","cve":"CVE-2025-5194","title":"WP Map Block <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94faab0a-dee9-4c31-a5be-4de35cc01d62?source=api-prod","affected":[{"type":"plugin","slug":"wp-map-block","name":"WP Map Block \u2013 Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T15:14:13Z"},{"id":"wordfence:94fc7e20-0fd1-4a10-b821-e5aba4512f3f","source":"wordfence","cve":"CVE-2026-40768","title":"Salon Booking System \u2013 Free Version <= 10.30.24 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94fc7e20-0fd1-4a10-b821-e5aba4512f3f?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.24","to_inclusive":true,"patched_in":"10.30.25"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T15:08:54Z"},{"id":"wordfence:94fd4626-6ff9-449b-8894-f974c8c5ace0","source":"wordfence","cve":"CVE-2026-42745","title":"Smart Online Order for Clover <= 1.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94fd4626-6ff9-449b-8894-f974c8c5ace0?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:23:00Z"},{"id":"wordfence:94fdc98a-c8be-47b4-a0a2-02d7373ab85e","source":"wordfence","cve":"CVE-2024-48033","title":"Talkback <= 1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94fdc98a-c8be-47b4-a0a2-02d7373ab85e?source=api-prod","affected":[{"type":"plugin","slug":"talkback-secure-linkback-protocol","name":"Talkback","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:55:24Z"},{"id":"wordfence:9503f908-ead2-4c34-89b9-1e2348b90f3c","source":"wordfence","cve":"CVE-2026-1081","title":"Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9503f908-ead2-4c34-89b9-1e2348b90f3c?source=api-prod","affected":[{"type":"plugin","slug":"set-bulk-post-categories","name":"Set Bulk Post Categories","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:23:29Z","updated":"2026-01-24T07:26:45Z"},{"id":"wordfence:9505b778-294f-45bc-a36c-22fbb894a294","source":"wordfence","cve":"CVE-2025-68043","title":"LottieFiles <= 3.0.0 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9505b778-294f-45bc-a36c-22fbb894a294?source=api-prod","affected":[{"type":"plugin","slug":"lottiefiles","name":"LottieFiles","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:09:42Z"},{"id":"wordfence:950908c8-9afc-4fc4-aa02-0c9790cdcb4c","source":"wordfence","cve":"CVE-2026-15262","title":"Admin Columns for ACF Fields < 0.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950908c8-9afc-4fc4-aa02-0c9790cdcb4c?source=api-prod","affected":[{"type":"plugin","slug":"admin-columns-for-acf-fields","name":"Admin Columns for ACF Fields","from":"*","from_inclusive":true,"to":"0.3.3.1","to_inclusive":false,"patched_in":"0.3.3.1"}],"published":"2026-08-01T00:00:00Z","updated":"2026-10-28T21:12:10Z"},{"id":"wordfence:950a7cc8-c057-41ba-ae2c-e6393cd5a01b","source":"wordfence","cve":"CVE-2024-38708","title":"Barcode Scanner with Inventory & Order Manager <= 1.6.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950a7cc8-c057-41ba-ae2c-e6393cd5a01b?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:07:11Z"},{"id":"wordfence:950bed9d-8698-4aa0-86a4-fac9e07bb42b","source":"wordfence","cve":"CVE-2026-7619","title":"Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950bed9d-8698-4aa0-86a4-fac9e07bb42b?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.10.4","to_inclusive":true,"patched_in":"1.8.10.5"}],"published":"2026-05-12T15:46:10Z","updated":"2026-05-13T04:26:44Z"},{"id":"wordfence:950d1c8f-6715-4b0d-bf3d-af978a146838","source":"wordfence","cve":"CVE-2024-13770","title":"Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950d1c8f-6715-4b0d-bf3d-af978a146838?source=api-prod","affected":[{"type":"theme","slug":"puzzles","name":"Puzzles | WP Magazine / Review with Store WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2025-02-12T16:10:16Z","updated":"2025-02-14T14:48:46Z"},{"id":"wordfence:950d71ae-29a1-4b71-b74a-b1a5c9f3326e","source":"wordfence","cve":"CVE-2023-0285","title":"Real Media Library: Media Library Folder & File Manager <= 4.18.28 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950d71ae-29a1-4b71-b74a-b1a5c9f3326e?source=api-prod","affected":[{"type":"plugin","slug":"real-media-library-lite","name":"Real Media Library: Media Library Folder & File Manager","from":"*","from_inclusive":true,"to":"4.18.28","to_inclusive":true,"patched_in":"4.18.29"}],"published":"2023-02-02T00:00:00Z","updated":"2024-08-06T14:07:30Z"},{"id":"wordfence:950e5d04-1436-4886-8d36-fca38bd9414a","source":"wordfence","cve":"CVE-2025-12715","title":"Canadian Nutrition Facts Label <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950e5d04-1436-4886-8d36-fca38bd9414a?source=api-prod","affected":[{"type":"plugin","slug":"canadian-nutrition-facts-label","name":"Canadian Nutrition Facts Label","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:47:10Z","updated":"2025-12-06T05:49:30Z"},{"id":"wordfence:950e9042-1364-4200-8f57-171346075764","source":"wordfence","cve":"CVE-2024-0334","title":"Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950e9042-1364-4200-8f57-171346075764?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-04-30T00:00:00Z","updated":"2024-07-29T21:36:54Z"},{"id":"wordfence:950ef9f8-2700-4bab-90af-154fc9ed5bc6","source":"wordfence","cve":"CVE-2025-15473","title":"Timetics \u2013 Appointment Booking Calendar & Scheduling System < 1.0.52 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950ef9f8-2700-4bab-90af-154fc9ed5bc6?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.52","to_inclusive":false,"patched_in":"1.0.52"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:38:10Z"},{"id":"wordfence:950f7493-4ccb-4a8a-9cc2-23b9ba3a9cd0","source":"wordfence","cve":"CVE-2026-2924","title":"Gutenverse \u2013 Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/950f7493-4ccb-4a8a-9cc2-23b9ba3a9cd0?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-04-03T13:45:17Z","updated":"2026-04-04T02:26:20Z"},{"id":"wordfence:95103830-9009-48df-ab15-476402b59e3f","source":"wordfence","cve":"CVE-2024-13316","title":"Scratch & Win \u2013 Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95103830-9009-48df-ab15-476402b59e3f?source=api-prod","affected":[{"type":"plugin","slug":"scratch-win-giveaways-for-website-facebook","name":"Scratch & Win \u2013 Giveaways and Contests. Boost subscribers, traffic, repeat visits,  referrals, sales and more","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T08:21:45Z"},{"id":"wordfence:9511d8f1-ab96-4695-aa8c-16a3482a6de4","source":"wordfence","cve":"CVE-2023-22696","title":"Affiliate Links Lite <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9511d8f1-ab96-4695-aa8c-16a3482a6de4?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-links","name":"Affiliate Links \u2013 Link Cloaking and Management","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2023-04-14T00:00:00Z","updated":"2024-08-13T20:51:47Z"},{"id":"wordfence:95136083-58d7-4ee4-b894-6910c3992d20","source":"wordfence","cve":"CVE-2026-8677","title":"Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95136083-58d7-4ee4-b894-6910c3992d20?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elementor-inner-sections-by-boomdevs","name":"Prime Elementor Addons \u2013 Lightweight Elementor Widgets for Faster Pages","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-06-08T19:49:58Z","updated":"2026-06-09T08:29:40Z"},{"id":"wordfence:9514757b-903d-45af-b612-cfabc09abbaa","source":"wordfence","cve":"CVE-2026-115840","title":"VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9514757b-903d-45af-b612-cfabc09abbaa?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2026-10-30T17:54:52Z","updated":"2026-10-31T06:44:21Z"},{"id":"wordfence:951570f4-9895-4b97-bf6f-4cfa722ba397","source":"wordfence","cve":"CVE-2026-110362","title":"PlanetStudio Payment Gateway <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/951570f4-9895-4b97-bf6f-4cfa722ba397?source=api-prod","affected":[{"type":"plugin","slug":"planetstudio-payment-gateway","name":"PlanetStudio Payment Gateway","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-10-15T18:21:00Z","updated":"2026-10-23T18:17:41Z"},{"id":"wordfence:9516e64c-1959-4980-9a96-c6f5f1baa6f6","source":"wordfence","cve":"CVE-2024-31275","title":"EventPrime <= 3.3.4 - Missing Authorization to Booking Price Maniputlation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9516e64c-1959-4980-9a96-c6f5f1baa6f6?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:51:57Z"},{"id":"wordfence:9517db1f-1704-4f25-9b02-795da3c4c067","source":"wordfence","cve":"CVE-2024-9696","title":"Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9517db1f-1704-4f25-9b02-795da3c4c067?source=api-prod","affected":[{"type":"plugin","slug":"rescue-shortcodes","name":"Rescue Shortcodes","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.9"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-12T08:41:06Z"},{"id":"wordfence:951b2a15-04c1-4c5b-9cef-146628079c36","source":"wordfence","cve":"CVE-2017-18584","title":"Post Pay Counter < 2.731 - Arbitrary Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/951b2a15-04c1-4c5b-9cef-146628079c36?source=api-prod","affected":[{"type":"plugin","slug":"post-pay-counter","name":"Post Pay Counter","from":"*","from_inclusive":true,"to":"2.731","to_inclusive":false,"patched_in":"2.731"}],"published":"2017-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:951b8cbd-0509-4548-ae69-6cfd67e83b1a","source":"wordfence","cve":"CVE-2022-1583","title":"External Links in New Window / New Tab <= 1.42 - Tabnabbing","severity":"medium","cvss":6.5,"cwe":"CWE-1022","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/951b8cbd-0509-4548-ae69-6cfd67e83b1a?source=api-prod","affected":[{"type":"plugin","slug":"open-external-links-in-a-new-window","name":"External Links in New Window / New Tab","from":"*","from_inclusive":true,"to":"1.42","to_inclusive":true,"patched_in":"1.43"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:951e3497-8fbc-4cc9-a784-edf7bb679175","source":"wordfence","cve":"CVE-2023-6528","title":"Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/951e3497-8fbc-4cc9-a784-edf7bb679175?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.19","to_inclusive":false,"patched_in":"6.6.19"}],"published":"2023-11-30T00:00:00Z","updated":"2024-02-06T16:14:58Z"},{"id":"wordfence:951e4651-56d6-474d-84b3-5a7cfc357b9f","source":"wordfence","cve":"CVE-2023-2562","title":"Gallery Metabox <= 1.5 - Missing Authorization via refresh_metabox","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/951e4651-56d6-474d-84b3-5a7cfc357b9f?source=api-prod","affected":[{"type":"plugin","slug":"gallery-metabox","name":"Gallery Metabox","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95210ed8-4606-44fa-b823-b33e1d4a4ce0","source":"wordfence","cve":"CVE-2023-2995","title":"Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95210ed8-4606-44fa-b823-b33e1d4a4ce0?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.30.3","to_inclusive":false,"patched_in":"3.30.3"}],"published":"2023-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9521ad5b-83c3-487e-a69e-ca057777bc9e","source":"wordfence","cve":"CVE-2023-45072","title":"Order auto complete for WooCommerce <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9521ad5b-83c3-487e-a69e-ca057777bc9e?source=api-prod","affected":[{"type":"plugin","slug":"order-auto-complete-for-woocommerce","name":"Order auto complete for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:952293ff-ff17-4e35-8afb-88638265ec8d","source":"wordfence","cve":"CVE-2025-53423","title":"Triss <= 2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952293ff-ff17-4e35-8afb-88638265ec8d?source=api-prod","affected":[{"type":"theme","slug":"triss","name":"Triss - Beauty Cosmetics Shop WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T00:00:00Z","updated":"2025-11-04T16:58:38Z"},{"id":"wordfence:95247ff5-0277-4270-a1ea-221ea2ecee0c","source":"wordfence","cve":"CVE-2024-32507","title":"Login with phone number <= 1.7.16 - Unauthorized Account Password Change to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95247ff5-0277-4270-a1ea-221ea2ecee0c?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T12:45:23Z"},{"id":"wordfence:95265186-ff13-464b-adb9-3cf1753487d5","source":"wordfence","cve":"CVE-2015-9432","title":"Alpine PhotoTile for Instagram < 1.2.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95265186-ff13-464b-adb9-3cf1753487d5?source=api-prod","affected":[{"type":"plugin","slug":"alpine-photo-tile-for-instagram","name":"Alpine Photo Tile for Instagram","from":"*","from_inclusive":true,"to":"1.2.7.6","to_inclusive":false,"patched_in":"1.2.7.6"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95269053-59fa-4396-bd2b-c8c4f9c05595","source":"wordfence","cve":"CVE-2015-4062","title":"NewStatPress <= 0.9.8 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95269053-59fa-4396-bd2b-c8c4f9c05595?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9528d0d8-9f56-43e4-9b86-92e54ea38013","source":"wordfence","cve":"CVE-2024-37417","title":"Coachify <= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9528d0d8-9f56-43e4-9b86-92e54ea38013?source=api-prod","affected":[{"type":"theme","slug":"coachify","name":"Coachify","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:46:54Z"},{"id":"wordfence:9529babf-bf5e-4de1-bf84-2eae11832379","source":"wordfence","cve":"CVE-2026-7385","title":"Decent Comments < 3.0.2 - Unauthenticated Information Exopsure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9529babf-bf5e-4de1-bf84-2eae11832379?source=api-prod","affected":[{"type":"plugin","slug":"decent-comments","name":"Decent Comments","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-18T13:16:27Z"},{"id":"wordfence:952a3e52-4e23-4bc4-92d3-e15ae2f3d28b","source":"wordfence","cve":"CVE-2023-35909","title":"Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952a3e52-4e23-4bc4-92d3-e15ae2f3d28b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:952a61e8-4be1-4974-9076-4493708bf51e","source":"wordfence","cve":"CVE-2024-47319","title":"Bit Form \u2013 Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952a61e8-4be1-4974-9076-4493708bf51e?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.13.10","to_inclusive":true,"patched_in":"2.13.11"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T20:50:00Z"},{"id":"wordfence:952aec28-a380-4c6d-8391-b21cddf90a5c","source":"wordfence","cve":"CVE-2022-47146","title":"Real Estate 7 Theme <= 3.3.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952aec28-a380-4c6d-8391-b21cddf90a5c?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:952d3ca6-9083-4c96-9bc1-94bb87fcc19c","source":"wordfence","cve":"CVE-2024-13610","title":"Simple Social Media Share Buttons <= 5.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952d3ca6-9083-4c96-9bc1-94bb87fcc19c?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-21T20:46:06Z"},{"id":"wordfence:952e299a-5cec-444b-8359-3e7d8dec3ccb","source":"wordfence","cve":"","title":"Event Registration <= 6.02.02 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/952e299a-5cec-444b-8359-3e7d8dec3ccb?source=api-prod","affected":[{"type":"plugin","slug":"event-registration","name":"Event Registration","from":"*","from_inclusive":true,"to":"6.02.02","to_inclusive":true,"patched_in":"6.03.01"}],"published":"2016-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9533206f-ae81-4223-aae5-01f40197b02b","source":"wordfence","cve":"CVE-2026-105967","title":"Gallery for Social Photo <= 1.0.0.41 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9533206f-ae81-4223-aae5-01f40197b02b?source=api-prod","affected":[{"type":"plugin","slug":"feed-instagram-lite","name":"Gallery for Social Photo","from":"*","from_inclusive":true,"to":"1.0.0.41","to_inclusive":true,"patched_in":"1.0.0.43"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:41:38Z"},{"id":"wordfence:9534b2dc-fe56-4f97-bb6e-79d55508ed38","source":"wordfence","cve":"CVE-2025-48280","title":"AutomatorWP <= 5.2.1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9534b2dc-fe56-4f97-bb6e-79d55508ed38?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.2.1.3","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T16:33:51Z"},{"id":"wordfence:9536e78e-f9c9-444f-9fae-0ffa24590c5a","source":"wordfence","cve":"CVE-2026-73402","title":"WP BASE Booking of Appointments, Services and Events <= 6.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9536e78e-f9c9-444f-9fae-0ffa24590c5a?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:04:39Z"},{"id":"wordfence:9538ae73-eaed-4f7d-8e87-77b1063407f0","source":"wordfence","cve":"CVE-2026-108497","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9538ae73-eaed-4f7d-8e87-77b1063407f0?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2026-10-13T10:55:29Z","updated":"2026-10-23T18:24:47Z"},{"id":"wordfence:953a0aa5-552b-44df-935d-719c1eae9d98","source":"wordfence","cve":"CVE-2026-123129","title":"Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/953a0aa5-552b-44df-935d-719c1eae9d98?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-manager-for-woocommerce","name":"Event Tickets Manager for WooCommerce","from":"1.5.4","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:57:12Z"},{"id":"wordfence:953be831-d688-4ae1-b8c1-d863eded945b","source":"wordfence","cve":"CVE-2024-4704","title":"Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/953be831-d688-4ae1-b8c1-d863eded945b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:50:25Z"},{"id":"wordfence:953d64f2-a514-48e9-9ab3-f9a793ad953a","source":"wordfence","cve":"CVE-2024-9057","title":"Curator.io: Show all your social media posts in a beautiful feed. <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/953d64f2-a514-48e9-9ab3-f9a793ad953a?source=api-prod","affected":[{"type":"plugin","slug":"curatorio","name":"Curator.io","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-10-09T13:30:14Z","updated":"2024-10-18T14:10:19Z"},{"id":"wordfence:953e10a1-df11-40d3-869c-2974a344630e","source":"wordfence","cve":"CVE-2016-10929","title":"Advanced AJAX Page Loader < 2.7.7 - Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/953e10a1-df11-40d3-869c-2974a344630e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ajax-page-loader","name":"Advanced AJAX Page Loader","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":false,"patched_in":"2.7.7"}],"published":"2016-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:953f4838-d0d5-4546-ac97-c1b442236c5d","source":"wordfence","cve":"CVE-2024-22285","title":"Frontpage Manager <= 1.3 - Cross-Site Request Forgery via admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/953f4838-d0d5-4546-ac97-c1b442236c5d?source=api-prod","affected":[{"type":"plugin","slug":"frontpage-manager","name":"Frontpage Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9540b339-3386-4ee8-8141-acb9f3d83772","source":"wordfence","cve":"CVE-2025-8401","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9540b339-3386-4ee8-8141-acb9f3d83772?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-07-30T00:00:00Z","updated":"2025-07-31T11:19:13Z"},{"id":"wordfence:954175eb-50ac-4e72-9489-428fbf47062a","source":"wordfence","cve":"CVE-2026-108488","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/954175eb-50ac-4e72-9489-428fbf47062a?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:46:17Z"},{"id":"wordfence:954227d2-aa11-4b1c-8aab-6b61418a0d77","source":"wordfence","cve":"CVE-2026-89299","title":"Verify API <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/954227d2-aa11-4b1c-8aab-6b61418a0d77?source=api-prod","affected":[{"type":"plugin","slug":"wp-verify-api","name":"WP Verify API","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:22:52Z"},{"id":"wordfence:9545cff3-fa65-4f2e-8a9f-98d884e5608f","source":"wordfence","cve":"CVE-2019-16902","title":"ARforms <= 3.7.1 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9545cff3-fa65-4f2e-8a9f-98d884e5608f?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2019-10-11T00:00:00Z","updated":"2024-05-15T19:01:26Z"},{"id":"wordfence:9546ab46-737c-4bd3-9542-8ab1b776b3ea","source":"wordfence","cve":"CVE-2025-2332","title":"Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9546ab46-737c-4bd3-9542-8ab1b776b3ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":"2.14"}],"published":"2025-03-26T00:00:00Z","updated":"2025-03-27T05:22:31Z"},{"id":"wordfence:9547c6e9-3dfc-442c-900d-111b1528aa5b","source":"wordfence","cve":"CVE-2025-30836","title":"LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9547c6e9-3dfc-442c-900d-111b1528aa5b?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:59:56Z"},{"id":"wordfence:9548f647-9fcb-481c-874e-0184609283fe","source":"wordfence","cve":"CVE-2026-8873","title":"Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9548f647-9fcb-481c-874e-0184609283fe?source=api-prod","affected":[{"type":"plugin","slug":"content-slideshow","name":"Content Slideshow","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5"}],"published":"2026-05-26T17:26:05Z","updated":"2026-07-31T19:21:02Z"},{"id":"wordfence:954b8064-f317-4af4-a55f-9a61ee945006","source":"wordfence","cve":"","title":"WordPress Core < 5.9.2 & Gutenberg < 12.7.2 - Prototype Pollution via Block Editor","severity":"medium","cvss":5.4,"cwe":"CWE-915","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/954b8064-f317-4af4-a55f-9a61ee945006?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.37","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.37","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.35","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.34","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"3.7.38"},{"type":"plugin","slug":"gutenberg","name":"Gutenberg","from":"*","from_inclusive":true,"to":"12.7.2","to_inclusive":false,"patched_in":"12.7.2"}],"published":"2022-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:954e7509-3ebf-429a-8c65-9825ea190d53","source":"wordfence","cve":"CVE-2023-24410","title":"FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/954e7509-3ebf-429a-8c65-9825ea190d53?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"4.3.25","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:954ef157-ecd1-42bd-b288-d5866b9c11f0","source":"wordfence","cve":"CVE-2022-1956","title":"Shortcut Macros <= 1.3 - Missing Authorization to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/954ef157-ecd1-42bd-b288-d5866b9c11f0?source=api-prod","affected":[{"type":"plugin","slug":"shortcut-macros","name":"Shortcut Macros","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95550fd3-13e5-4341-8551-efe9070b0ada","source":"wordfence","cve":"","title":"WP Discord Post Plus -  Supports Unlimited Channels <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95550fd3-13e5-4341-8551-efe9070b0ada?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-post-plus","name":"WP Discord Post Plus \u2013  Supports Unlimited Channels","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:07:50Z"},{"id":"wordfence:95551566-34e8-4392-ad1a-f88f61af831b","source":"wordfence","cve":"CVE-2026-94667","title":"JetReviews <= 3.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95551566-34e8-4392-ad1a-f88f61af831b?source=api-prod","affected":[{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.2.1"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:48:33Z"},{"id":"wordfence:9555c48f-5ce3-4c0c-88f3-83776b42b808","source":"wordfence","cve":"CVE-2022-25149","title":"WP Statistics <= 13.1.5 - Unauthenticated Blind SQL Injection via IP","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9555c48f-5ce3-4c0c-88f3-83776b42b808?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95579b81-857a-4ebb-9943-3761a2e5b3d9","source":"wordfence","cve":"CVE-2025-48170","title":"Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95579b81-857a-4ebb-9943-3761a2e5b3d9?source=api-prod","affected":[{"type":"plugin","slug":"lbg-universal-video-player-addon-visual-composer","name":"Universal Video Player - Addon for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2.0"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-22T13:36:23Z"},{"id":"wordfence:955b7d69-7921-4c79-9443-c494f5bba57d","source":"wordfence","cve":"","title":"Houzez Theme - Functionality <= 4.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/955b7d69-7921-4c79-9443-c494f5bba57d?source=api-prod","affected":[{"type":"plugin","slug":"houzez-theme-functionality","name":"Houzez Theme - Functionality","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T13:12:38Z"},{"id":"wordfence:955d0aa2-bf57-4df7-a2d3-0a4ade4fc50f","source":"wordfence","cve":"CVE-2026-9576","title":"Fluent Booking <= 2.1.1 - Authenticated (Calendar Manager+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/955d0aa2-bf57-4df7-a2d3-0a4ade4fc50f?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-06-09T00:00:00Z","updated":"2026-08-21T14:15:30Z"},{"id":"wordfence:955d2b8d-af39-43f9-a513-7cc421cbd4b5","source":"wordfence","cve":"CVE-2026-65433","title":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/955d2b8d-af39-43f9-a513-7cc421cbd4b5?source=api-prod","affected":[{"type":"plugin","slug":"rt-mega-menu","name":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:07:16Z"},{"id":"wordfence:95624a3b-70cc-4815-a604-c6b19fc84e93","source":"wordfence","cve":"CVE-2017-18607","title":"Avada <= 5.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95624a3b-70cc-4815-a604-c6b19fc84e93?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":false,"patched_in":"5.1.5"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95631d97-14c9-45f2-b709-3eca7c38f09d","source":"wordfence","cve":"CVE-2022-4651","title":"Justified Gallery <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95631d97-14c9-45f2-b709-3eca7c38f09d?source=api-prod","affected":[{"type":"plugin","slug":"justified-gallery","name":"Justified Gallery","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9567f199-7c31-4df3-aa2c-911780b2497a","source":"wordfence","cve":"CVE-2023-39995","title":"Portfolio and Projects <= 1.3.7 - Cross-Site Request Forgery via 'wpos_anylc_admin_init_process'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9567f199-7c31-4df3-aa2c-911780b2497a?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-and-projects","name":"Portfolio and Projects","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95691873-a16a-4e41-9456-41fa07efd6ce","source":"wordfence","cve":"CVE-2023-27631","title":"Daily Prayer Time <= 2023.03.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95691873-a16a-4e41-9456-41fa07efd6ce?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2023.03.20","to_inclusive":true,"patched_in":"2023.05.05"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:956984d4-4f8b-4e20-8002-4e9809b3872c","source":"wordfence","cve":"CVE-2024-24702","title":"Page Restrict <= 2.5.5 - Cross-Site Request Forgery via pr_admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/956984d4-4f8b-4e20-8002-4e9809b3872c?source=api-prod","affected":[{"type":"plugin","slug":"pagerestrict","name":"Page Restrict","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T14:16:44Z"},{"id":"wordfence:956b49c3-42ee-447d-8a0c-56af64793464","source":"wordfence","cve":"CVE-2025-3649","title":"LightPress Lightbox <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/956b49c3-42ee-447d-8a0c-56af64793464?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-lightbox","name":"LightPress Lightbox","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2025-04-21T00:00:00Z","updated":"2025-05-14T20:16:49Z"},{"id":"wordfence:956f2f87-e33e-4561-8e95-b861a2286f01","source":"wordfence","cve":"CVE-2025-67576","title":"Simple Link Directory <= 8.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/956f2f87-e33e-4561-8e95-b861a2286f01?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:18:20Z"},{"id":"wordfence:956f86c5-05af-41c3-a779-5b25f62122dd","source":"wordfence","cve":"CVE-2025-5807","title":"Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/956f86c5-05af-41c3-a779-5b25f62122dd?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-07-09T12:49:48Z","updated":"2025-07-10T01:43:44Z"},{"id":"wordfence:956fa041-1a48-4a88-a78b-a1617540d6dc","source":"wordfence","cve":"CVE-2025-66528","title":"Thank You Page Customizer for WooCommerce <= 1.1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/956fa041-1a48-4a88-a78b-a1617540d6dc?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-11T16:03:39Z"},{"id":"wordfence:9571a2f3-d148-4e9b-8837-b8d212418613","source":"wordfence","cve":"CVE-2026-15066","title":"Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9571a2f3-d148-4e9b-8837-b8d212418613?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2026-08-15T15:34:26Z","updated":"2026-08-16T04:24:56Z"},{"id":"wordfence:95723482-a6c5-4e95-a88d-c50a88108715","source":"wordfence","cve":"CVE-2023-23804","title":"HT Feed <= 1.2.7 - Cross-Site Request Forgery leading to Limited Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95723482-a6c5-4e95-a88d-c50a88108715?source=api-prod","affected":[{"type":"plugin","slug":"ht-instagram","name":"HT Feed","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95737062-587a-447c-b448-06dc2d22dbdf","source":"wordfence","cve":"CVE-2024-13053","title":"Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95737062-587a-447c-b448-06dc2d22dbdf?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.32","to_inclusive":true,"patched_in":"1.15.33"}],"published":"2025-02-07T00:00:00Z","updated":"2025-05-27T15:54:25Z"},{"id":"wordfence:957476a7-f787-4206-b8dc-93e48704b2a4","source":"wordfence","cve":"CVE-2026-114189","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/957476a7-f787-4206-b8dc-93e48704b2a4?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-06T15:27:29Z","updated":"2026-11-10T19:16:32Z"},{"id":"wordfence:9576408b-d048-4e36-bc1a-c01c9f586365","source":"wordfence","cve":"CVE-2024-31343","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10.1 - Unauthenticated Arbitrary File Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9576408b-d048-4e36-bc1a-c01c9f586365?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"5.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:10:35Z"},{"id":"wordfence:957ace25-786f-41d7-9fcb-dec41a662fd4","source":"wordfence","cve":"CVE-2026-87770","title":"Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/957ace25-786f-41d7-9fcb-dec41a662fd4?source=api-prod","affected":[{"type":"plugin","slug":"woo-price-drop-alert","name":"Price Drop Alert for Woo Commerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:43:56Z"},{"id":"wordfence:957fde11-9dec-4d68-813c-2f6f4973900e","source":"wordfence","cve":"CVE-2025-30994","title":"CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/957fde11-9dec-4d68-813c-2f6f4973900e?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-08-01T03:24:49Z"},{"id":"wordfence:958118ec-437e-45c8-a0f0-6aaf54e60d04","source":"wordfence","cve":"CVE-2024-21751","title":"RabbitLoader <= 2.19.13 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/958118ec-437e-45c8-a0f0-6aaf54e60d04?source=api-prod","affected":[{"type":"plugin","slug":"rabbit-loader","name":"RabbitLoader","from":"*","from_inclusive":true,"to":"2.19.13","to_inclusive":true,"patched_in":"2.19.14"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95823720-e1dc-46c1-887b-ffd877b2fbe5","source":"wordfence","cve":"CVE-2025-13206","title":"GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95823720-e1dc-46c1-887b-ffd877b2fbe5?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.13.1"}],"published":"2025-11-18T00:00:00Z","updated":"2025-11-19T07:46:08Z"},{"id":"wordfence:9587ebca-1951-4dca-8421-4f3963d25911","source":"wordfence","cve":"CVE-2026-62016","title":"Gamic - Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9587ebca-1951-4dca-8421-4f3963d25911?source=api-prod","affected":[{"type":"theme","slug":"gamic","name":"Gamic - Gaming Metaverse Game & Crypto WordPress Theme","from":"*","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:37:59Z"},{"id":"wordfence:9589d44b-55c3-45b4-84bb-c86143de3f95","source":"wordfence","cve":"CVE-2023-36678","title":"WP Content Copy Protection & No Right Click <= 3.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9589d44b-55c3-45b4-84bb-c86143de3f95?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-copy-protector","name":"WP Content Copy Protection & No Right Click","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:958a036e-2893-40c2-a542-7a33c12161e3","source":"wordfence","cve":"CVE-2020-37227","title":"Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/958a036e-2893-40c2-a542-7a33c12161e3?source=api-prod","affected":[{"type":"plugin","slug":"hs-brand-logo-slider","name":"Helios Solutions Brand Logo Slider","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-16T00:00:00Z","updated":"2026-07-29T20:25:25Z"},{"id":"wordfence:958bad47-f65d-45d9-ae89-f447e9ae163d","source":"wordfence","cve":"CVE-2026-42706","title":"DK <= 3.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/958bad47-f65d-45d9-ae89-f447e9ae163d?source=api-prod","affected":[{"type":"theme","slug":"dk","name":"DK","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T13:35:08Z","updated":"2026-10-13T13:52:17Z"},{"id":"wordfence:959197c0-ce59-4f61-8fe9-11ac38bb0e41","source":"wordfence","cve":"CVE-2024-50458","title":"Advanced Sermons <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959197c0-ce59-4f61-8fe9-11ac38bb0e41?source=api-prod","affected":[{"type":"plugin","slug":"advanced-sermons","name":"Advanced Sermons","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:14:29Z"},{"id":"wordfence:9592bb6d-8e1d-4c89-addd-11c07272a628","source":"wordfence","cve":"CVE-2026-0608","title":"Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9592bb6d-8e1d-4c89-addd-11c07272a628?source=api-prod","affected":[{"type":"plugin","slug":"head-meta-data","name":"Head Meta Data","from":"*","from_inclusive":true,"to":"20251118","to_inclusive":true,"patched_in":"20260105"}],"published":"2026-01-20T01:55:44Z","updated":"2026-01-20T14:26:33Z"},{"id":"wordfence:9592e315-8489-4e49-83ac-00491e1b0bba","source":"wordfence","cve":"CVE-2026-27371","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9592e315-8489-4e49-83ac-00491e1b0bba?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T13:03:47Z"},{"id":"wordfence:9594b351-52ba-48a7-a875-a914b70ce7b8","source":"wordfence","cve":"CVE-2026-27379","title":"NextScripts: Social Networks Auto-Poster <= 4.4.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9594b351-52ba-48a7-a875-a914b70ce7b8?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2026-02-24T00:00:00Z","updated":"2026-08-17T04:29:33Z"},{"id":"wordfence:9595fa45-6b00-4ee0-89aa-a236dbf82423","source":"wordfence","cve":"CVE-2022-4466","title":"WordPress Infinite Scroll - Ajax Load More <= 5.6.0.2 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9595fa45-6b00-4ee0-89aa-a236dbf82423?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"5.6.0.2","to_inclusive":true,"patched_in":"5.6.0.3"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:959608e2-7745-403c-953e-4b5d73062f47","source":"wordfence","cve":"CVE-2026-10827","title":"Spectra Legacy \u2013 Gutenberg Blocks < 2.20.0 - Authenticated (Contributor+) CSS Injection","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959608e2-7745-403c-953e-4b5d73062f47?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":false,"patched_in":"2.20.0"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-14T12:56:54Z"},{"id":"wordfence:9596c243-4099-420a-aa2a-381b6299f927","source":"wordfence","cve":"CVE-2023-28494","title":"Contact Form Email <= 1.3.31 - Missing Authorization to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9596c243-4099-420a-aa2a-381b6299f927?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":"1.3.32"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9596cae1-37d8-4618-a701-34e8461c3d73","source":"wordfence","cve":"CVE-2025-52797","title":"StoryMap <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9596cae1-37d8-4618-a701-34e8461c3d73?source=api-prod","affected":[{"type":"plugin","slug":"wp-storymap","name":"StoryMap Plugin","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-08-14T00:00:00Z","updated":"2026-10-28T21:07:55Z"},{"id":"wordfence:959775d4-1c03-454a-b13b-670c726fec91","source":"wordfence","cve":"CVE-2025-25159","title":"WP doodlez <= 1.0.10 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959775d4-1c03-454a-b13b-670c726fec91?source=api-prod","affected":[{"type":"plugin","slug":"wpdoodlez","name":"WP doodlez","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:49:06Z"},{"id":"wordfence:959846a3-0e57-4227-a52b-942b589596f0","source":"wordfence","cve":"CVE-2014-1908","title":"Broadcast Live Video \u2013 Live Streaming < 4.29.5 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959846a3-0e57-4227-a52b-942b589596f0?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.29.5","to_inclusive":false,"patched_in":"4.29.5"}],"published":"2014-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95986a4d-94fb-4afe-ba1e-382d6f4c550f","source":"wordfence","cve":"CVE-2023-34002","title":"WP Inventory Manager <= 2.1.0.13 - Cross-Site Request Forgery via delete_item","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95986a4d-94fb-4afe-ba1e-382d6f4c550f?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.1.0.13","to_inclusive":true,"patched_in":"2.1.0.14"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9598ba18-1fcc-4f2f-af57-a33ae98ed46b","source":"wordfence","cve":"CVE-2026-114743","title":"InstaWP Connect <= 0.1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9598ba18-1fcc-4f2f-af57-a33ae98ed46b?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.4.1","to_inclusive":true,"patched_in":"0.1.4.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:08:26Z"},{"id":"wordfence:959a086e-15f0-492a-a19b-3160ad47f1be","source":"wordfence","cve":"CVE-2025-69099","title":"North <= 5.7.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959a086e-15f0-492a-a19b-3160ad47f1be?source=api-prod","affected":[{"type":"theme","slug":"north-wp","name":"North - One Page Parallax WordPress Theme","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:39:36Z"},{"id":"wordfence:959ce050-bafc-4d17-93bd-a9b09b4b4baa","source":"wordfence","cve":"CVE-2024-29913","title":"Tutor LMS Elementor Addons <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959ce050-bafc-4d17-93bd-a9b09b4b4baa?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:09:58Z"},{"id":"wordfence:959ece75-b7a6-4729-abe8-1df9398d95f4","source":"wordfence","cve":"","title":"Social Hashtags <= 3.0.0 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959ece75-b7a6-4729-abe8-1df9398d95f4?source=api-prod","affected":[{"type":"plugin","slug":"social-hashtags","name":"Social Hashtags","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2012-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:959f7e13-ef58-4b02-a721-7bb10373aaaa","source":"wordfence","cve":"CVE-2022-4106","title":"Wholesale Market for WooCommerce <= 1.0.6 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/959f7e13-ef58-4b02-a721-7bb10373aaaa?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market-for-woocommerce","name":"Wholesale Market for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95a01f44-2356-4ea4-b48e-80e3c6114efa","source":"wordfence","cve":"CVE-2024-11089","title":"Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95a01f44-2356-4ea4-b48e-80e3c6114efa?source=api-prod","affected":[{"type":"plugin","slug":"anonymous-restricted-content","name":"Anonymous Restricted Content","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T13:55:32Z"},{"id":"wordfence:95a10bf8-12bc-4b71-b74b-698a455cdbc8","source":"wordfence","cve":"CVE-2026-41560","title":"WXD Backup Lite <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95a10bf8-12bc-4b71-b74b-698a455cdbc8?source=api-prod","affected":[{"type":"plugin","slug":"wxd-backup-lite","name":"WXD Backup Lite","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:30:10Z","updated":"2026-10-08T23:33:26Z"},{"id":"wordfence:95a68ae0-36da-499b-a09d-4c91db8aa338","source":"wordfence","cve":"CVE-2024-4936","title":"Canto <= 3.0.8 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95a68ae0-36da-499b-a09d-4c91db8aa338?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-06-13T15:59:14Z","updated":"2024-07-01T13:33:10Z"},{"id":"wordfence:95ab7473-e368-47ad-a8a0-0efbdafce562","source":"wordfence","cve":"CVE-2025-13386","title":"Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ab7473-e368-47ad-a8a0-0efbdafce562?source=api-prod","affected":[{"type":"plugin","slug":"social-images-widget","name":"Social Images Widget","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:13:27Z","updated":"2025-11-25T07:28:22Z"},{"id":"wordfence:95abec2d-a03a-4b07-8890-18568650c41f","source":"wordfence","cve":"","title":"Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95abec2d-a03a-4b07-8890-18568650c41f?source=api-prod","affected":[{"type":"plugin","slug":"gift-up","name":"Gift Up Gift Cards for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"2.21.3","to_inclusive":true,"patched_in":"2.22"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95acec2a-ba1b-4b61-a4d6-3b0250a32835","source":"wordfence","cve":"CVE-2023-24400","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_policy_link' Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95acec2a-ba1b-4b61-a4d6-3b0250a32835?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95ad0139-eb12-4c02-95fb-cd19b6a6ab02","source":"wordfence","cve":"","title":"Health Check & Troubleshooting <= 1.2.3 - Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ad0139-eb12-4c02-95fb-cd19b6a6ab02?source=api-prod","affected":[{"type":"plugin","slug":"health-check","name":"Health Check & Troubleshooting","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2019-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95ae7cb4-3434-4c75-a803-81ae96ba5891","source":"wordfence","cve":"CVE-2026-12976","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ae7cb4-3434-4c75-a803-81ae96ba5891?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":false,"patched_in":"4.4.4"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T19:00:13Z"},{"id":"wordfence:95b36b47-dbb7-47f7-ba0d-ce4c6b183617","source":"wordfence","cve":"CVE-2026-42727","title":"Active Products Tables for WooCommerce. Use constructor to create tables\u00a0 <= 1.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95b36b47-dbb7-47f7-ba0d-ce4c6b183617?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-05-19T00:00:00Z","updated":"2026-05-26T19:32:59Z"},{"id":"wordfence:95b3a3bb-8b64-4659-a4cd-b0109d1b572d","source":"wordfence","cve":"CVE-2025-26903","title":"InPost Gallery <= 2.1.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95b3a3bb-8b64-4659-a4cd-b0109d1b572d?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4.3","to_inclusive":true,"patched_in":"2.1.4.4"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T13:38:09Z"},{"id":"wordfence:95b727ee-b410-471b-98f2-7cebd7f64a58","source":"wordfence","cve":"CVE-2026-11390","title":"News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95b727ee-b410-471b-98f2-7cebd7f64a58?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-07-13T13:07:18Z","updated":"2026-07-14T01:30:01Z"},{"id":"wordfence:95b82437-e63c-4762-9193-40ea74dbf1c9","source":"wordfence","cve":"CVE-2025-31079","title":"Usermaven <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95b82437-e63c-4762-9193-40ea74dbf1c9?source=api-prod","affected":[{"type":"plugin","slug":"usermaven","name":"Usermaven","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:16:25Z"},{"id":"wordfence:95ba48b9-4a9c-47df-b05e-e670ae547810","source":"wordfence","cve":"CVE-2022-4544","title":"Social Media Share Buttons <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ba48b9-4a9c-47df-b05e-e670ae547810?source=api-prod","affected":[{"type":"plugin","slug":"mashsharer","name":"MashShare \u2013 Social Media Share Buttons, Social Share Icons","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95bae3f2-313b-4b6c-a81c-8af6f169151b","source":"wordfence","cve":"","title":"Woody code snippets <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95bae3f2-313b-4b6c-a81c-8af6f169151b?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95bc1aa4-f517-4921-99c4-f8fe071eafd9","source":"wordfence","cve":"CVE-2026-11984","title":"Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95bc1aa4-f517-4921-99c4-f8fe071eafd9?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.16","to_inclusive":true,"patched_in":"2.8.17"}],"published":"2026-09-15T15:24:44Z","updated":"2026-09-16T03:28:21Z"},{"id":"wordfence:95c2038f-c4f9-472a-92ab-59ee395bda3d","source":"wordfence","cve":"","title":"Simple Membership < 3.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c2038f-c4f9-472a-92ab-59ee395bda3d?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":false,"patched_in":"3.2.9"}],"published":"2016-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95c262b6-4f63-4f81-bc73-b2b3fa586a21","source":"wordfence","cve":"CVE-2024-35769","title":"Slideshow SE <= 2.5.20 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c262b6-4f63-4f81-bc73-b2b3fa586a21?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-se","name":"Slideshow SE","from":"*","from_inclusive":true,"to":"2.5.20","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-06-18T00:00:00Z","updated":"2026-04-25T15:33:29Z"},{"id":"wordfence:95c421a8-b945-424b-bd8e-e95691be2c04","source":"wordfence","cve":"CVE-2026-91862","title":"Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c421a8-b945-424b-bd8e-e95691be2c04?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-10-09T17:05:22Z","updated":"2026-10-10T05:31:03Z"},{"id":"wordfence:95c43224-ad93-4148-809f-90f6ca0afba6","source":"wordfence","cve":"CVE-2026-39734","title":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square <= 4.5.4 - Unauthenticated Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c43224-ad93-4148-809f-90f6ca0afba6?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-10-30T07:20:42Z","updated":"2026-11-03T19:54:52Z"},{"id":"wordfence:95c47c7b-df83-43ee-9091-136b6622e88c","source":"wordfence","cve":"CVE-2023-32518","title":"WP Chinese Conversion <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c47c7b-df83-43ee-9091-136b6622e88c?source=api-prod","affected":[{"type":"plugin","slug":"wp-chinese-conversion","name":"WP Chinese Conversion","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95c59e71-b755-4b39-bd5f-b2b2ac99f934","source":"wordfence","cve":"CVE-2016-10866","title":"All In One WP Security & Firewall <= 4.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c59e71-b755-4b39-bd5f-b2b2ac99f934?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2016-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95c5a219-0b04-424c-a3dd-d705b1b41ddc","source":"wordfence","cve":"CVE-2023-45058","title":"Short URL <= 1.6.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c5a219-0b04-424c-a3dd-d705b1b41ddc?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95c5bfc5-53b3-482f-856b-db6b6cac93a2","source":"wordfence","cve":"CVE-2025-4670","title":"Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c5bfc5-53b3-482f-856b-db6b6cac93a2?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.8.1","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2025-05-28T19:44:57Z","updated":"2025-05-29T08:22:04Z"},{"id":"wordfence:95c7f999-3676-4b91-9ee0-f55a27bcd93c","source":"wordfence","cve":"CVE-2026-8977","title":"WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c7f999-3676-4b91-9ee0-f55a27bcd93c?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-cookie-consent","name":"WP GDPR Cookie Consent","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:04Z","updated":"2026-06-09T03:41:21Z"},{"id":"wordfence:95c8722e-07c3-4728-8723-4d4a6188fe5e","source":"wordfence","cve":"CVE-2025-5018","title":"Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95c8722e-07c3-4728-8723-4d4a6188fe5e?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-06-05T17:48:57Z","updated":"2025-07-25T19:19:09Z"},{"id":"wordfence:95ca322f-3965-4635-8cbd-8764205d7928","source":"wordfence","cve":"CVE-2024-43980","title":"Fota WP <= 1.4.1 - Missing Authorization via fotawp_install_and_activate_plugins()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ca322f-3965-4635-8cbd-8764205d7928?source=api-prod","affected":[{"type":"theme","slug":"fotawp","name":"FotaWP","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T20:50:17Z"},{"id":"wordfence:95cb355f-0f3a-4eb1-b218-e6b0c457d0e7","source":"wordfence","cve":"CVE-2025-22518","title":"Justified Image Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95cb355f-0f3a-4eb1-b218-e6b0c457d0e7?source=api-prod","affected":[{"type":"plugin","slug":"justified-image-gallery","name":"Justified Image Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:39:12Z"},{"id":"wordfence:95cb607f-f110-416b-b9e4-87a68710f230","source":"wordfence","cve":"CVE-2026-12898","title":"All-in-One WP Migration and Backup <= 7.105 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95cb607f-f110-416b-b9e4-87a68710f230?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.105","to_inclusive":true,"patched_in":"7.106"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-30T13:40:50Z"},{"id":"wordfence:95cd2bae-4ab7-4a0c-bb71-c17b119eaaa9","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 2.0.4 - Missing Authorization to Database Export","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95cd2bae-4ab7-4a0c-bb71-c17b119eaaa9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2015-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95ce3773-a676-4aa6-9314-6adccf44d070","source":"wordfence","cve":"CVE-2026-45218","title":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ce3773-a676-4aa6-9314-6adccf44d070?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"11.4.0","to_inclusive":true,"patched_in":"11.5.0"}],"published":"2026-05-09T00:00:00Z","updated":"2026-05-19T13:19:20Z"},{"id":"wordfence:95ce515a-377c-49b4-8d1b-7ac22769c759","source":"wordfence","cve":"CVE-2023-0731","title":"Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ce515a-377c-49b4-8d1b-7ac22769c759?source=api-prod","affected":[{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95d06679-a603-45c4-840f-e38a7cd0c739","source":"wordfence","cve":"CVE-2025-58023","title":"Genealogical Tree <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d06679-a603-45c4-840f-e38a7cd0c739?source=api-prod","affected":[{"type":"plugin","slug":"genealogical-tree","name":"Genealogical Tree \u2013 Family Tree & Ancestry for WordPress","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:30:56Z"},{"id":"wordfence:95d0d6a1-a3d3-4792-bdf6-e07db83d646c","source":"wordfence","cve":"CVE-2025-31730","title":"Marketer Addons <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d0d6a1-a3d3-4792-bdf6-e07db83d646c?source=api-prod","affected":[{"type":"plugin","slug":"marketer-addons","name":"Marketer Addons","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-12T14:48:13Z"},{"id":"wordfence:95d2a05d-67ae-45b1-8add-0dcf73d43181","source":"wordfence","cve":"CVE-2024-13741","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d2a05d-67ae-45b1-8add-0dcf73d43181?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.2","to_inclusive":true,"patched_in":"5.9.4.3"}],"published":"2025-02-17T13:43:48Z","updated":"2025-02-18T01:44:01Z"},{"id":"wordfence:95d2bf1a-0993-4553-a00e-6f555c3f15be","source":"wordfence","cve":"CVE-2026-7459","title":"Simple History \u2013 Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d2bf1a-0993-4553-a00e-6f555c3f15be?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"5.26.0","to_inclusive":true,"patched_in":"5.27.0"}],"published":"2026-05-29T20:38:32Z","updated":"2026-05-30T09:29:01Z"},{"id":"wordfence:95d3e76c-612d-436c-9d32-6228d7dcbf35","source":"wordfence","cve":"CVE-2025-13535","title":"King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d3e76c-612d-436c-9d32-6228d7dcbf35?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.53","to_inclusive":true,"patched_in":"51.1.54"}],"published":"2026-03-31T00:00:00Z","updated":"2026-04-01T14:37:35Z"},{"id":"wordfence:95d4fbf6-e21a-48db-bfb3-32fc9116afa0","source":"wordfence","cve":"CVE-2023-46624","title":"Parcel Pro <= 1.6.11 - Open Redirect via 'redirect'","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d4fbf6-e21a-48db-bfb3-32fc9116afa0?source=api-prod","affected":[{"type":"plugin","slug":"woo-parcel-pro","name":"Parcel Pro","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.6.12"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95d61090-b3ee-4b38-b13e-a11796e6a324","source":"wordfence","cve":"CVE-2026-119485","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d61090-b3ee-4b38-b13e-a11796e6a324?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:46Z"},{"id":"wordfence:95d61096-8e44-4b70-a409-c02cb3d1e32c","source":"wordfence","cve":"CVE-2023-50368","title":"Shortcodes and extra features for Phlox theme <= 2.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d61096-8e44-4b70-a409-c02cb3d1e32c?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.4","to_inclusive":true,"patched_in":"2.15.5"}],"published":"2023-12-06T00:00:00Z","updated":"2024-02-08T18:07:43Z"},{"id":"wordfence:95d68a5d-4d0b-4030-a80a-ada31b118af2","source":"wordfence","cve":"CVE-2025-6247","title":"WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d68a5d-4d0b-4030-a80a-ada31b118af2?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.118.0","to_inclusive":true,"patched_in":"3.119.0"}],"published":"2025-08-25T20:27:36Z","updated":"2025-08-26T09:06:09Z"},{"id":"wordfence:95d85e42-4872-4fc4-9e6f-4b9d9fb75ef2","source":"wordfence","cve":"CVE-2026-59532","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.2 - Unauthenticated Price Maniputlation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d85e42-4872-4fc4-9e6f-4b9d9fb75ef2?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:04:36Z"},{"id":"wordfence:95d8b7c8-55c2-4760-aaf3-47fc5b43fc9c","source":"wordfence","cve":"CVE-2025-50051","title":"WP-Members <= 3.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d8b7c8-55c2-4760-aaf3-47fc5b43fc9c?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.4.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:58:14Z"},{"id":"wordfence:95d9995a-d99e-4136-84f9-1d3dfc4a4bf0","source":"wordfence","cve":"CVE-2026-61968","title":"myCred <= 3.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95d9995a-d99e-4136-84f9-1d3dfc4a4bf0?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-07-29T00:00:00Z","updated":"2026-07-29T23:21:36Z"},{"id":"wordfence:95da08b2-e26a-4323-89ad-7f9d870e0186","source":"wordfence","cve":"CVE-2025-59131","title":"WP-CalDav2ICS <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95da08b2-e26a-4323-89ad-7f9d870e0186?source=api-prod","affected":[{"type":"plugin","slug":"wp-caldav2ics","name":"WP-CalDav2ICS","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T18:20:18Z"},{"id":"wordfence:95dc0d79-b65a-4bfb-89c0-569bf26232df","source":"wordfence","cve":"CVE-2020-35933","title":"Newsletter <= 6.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95dc0d79-b65a-4bfb-89c0-569bf26232df?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"6.8.2"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95de9099-6071-46d8-a7c9-bb2c1caa6b38","source":"wordfence","cve":"CVE-2024-56276","title":"Contact Form by WPForms <= 1.9.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95de9099-6071-46d8-a7c9-bb2c1caa6b38?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.2.2","to_inclusive":true,"patched_in":"1.9.2.3"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:55:06Z"},{"id":"wordfence:95ded4bf-9964-4bb3-b6e5-5ad37360f87d","source":"wordfence","cve":"CVE-2024-2111","title":"Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ded4bf-9964-4bb3-b6e5-5ad37360f87d?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.7.1","to_inclusive":true,"patched_in":"6.4.7.2"}],"published":"2024-03-27T00:00:00Z","updated":"2024-03-28T02:04:09Z"},{"id":"wordfence:95e18a52-a027-413d-b21d-df5518f23308","source":"wordfence","cve":"CVE-2024-52486","title":"Elementor Portfolio Builder <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95e18a52-a027-413d-b21d-df5518f23308?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-builder-elementor","name":"Elementor Portfolio Builder","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:45:01Z"},{"id":"wordfence:95e4163d-e9fc-4470-91bb-a408a35d5113","source":"wordfence","cve":"CVE-2025-52708","title":"HUSKY <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95e4163d-e9fc-4470-91bb-a408a35d5113?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.7.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T18:24:36Z"},{"id":"wordfence:95e74e70-9dc9-4e63-b371-fd2a38692907","source":"wordfence","cve":"CVE-2025-4335","title":"Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95e74e70-9dc9-4e63-b371-fd2a38692907?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multiple-addresses","name":"Woocommerce Multiple Addresses","from":"*","from_inclusive":true,"to":"1.0.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-06T13:28:35Z","updated":"2025-05-07T01:43:08Z"},{"id":"wordfence:95e79929-332f-42bc-b2ad-00b8867dcb86","source":"wordfence","cve":"CVE-2025-47543","title":"TrueBooker <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95e79929-332f-42bc-b2ad-00b8867dcb86?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:46:31Z"},{"id":"wordfence:95ebb2ad-91a8-4a0d-ba91-f417943545b4","source":"wordfence","cve":"CVE-2024-11326","title":"Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ebb2ad-91a8-4a0d-ba91-f417943545b4?source=api-prod","affected":[{"type":"plugin","slug":"campaign-monitor-wp","name":"Campaign Monitor Forms by Optin Cat","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-12-02T21:32:59Z","updated":"2024-12-03T11:04:03Z"},{"id":"wordfence:95f1b5ca-5110-407a-8fbb-375ac445294b","source":"wordfence","cve":"CVE-2024-37552","title":"Social Media & Share Icons <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f1b5ca-5110-407a-8fbb-375ac445294b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-18T14:18:49Z"},{"id":"wordfence:95f1e3eb-da87-417e-8e8c-e5035e072950","source":"wordfence","cve":"CVE-2021-24706","title":"Qwizcards <= 3.61 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f1e3eb-da87-417e-8e8c-e5035e072950?source=api-prod","affected":[{"type":"plugin","slug":"qwiz-online-quizzes-and-flashcards","name":"Qwizcards | online quizzes and flashcards","from":"*","from_inclusive":true,"to":"3.61","to_inclusive":true,"patched_in":"3.62"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95f2af83-2667-49e1-8890-99559cd90ec4","source":"wordfence","cve":"CVE-2026-18021","title":"Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f2af83-2667-49e1-8890-99559cd90ec4?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.10.3.1","to_inclusive":true,"patched_in":"2.10.3.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:30:00Z"},{"id":"wordfence:95f49080-2263-4f6d-9372-30137efd8e10","source":"wordfence","cve":"CVE-2025-13753","title":"WP Table Builder <= 2.0.19 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f49080-2263-4f6d-9372-30137efd8e10?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-01-08T18:58:47Z","updated":"2026-03-13T20:54:15Z"},{"id":"wordfence:95f49cbd-a794-4b39-92cb-9d9c8df82685","source":"wordfence","cve":"CVE-2026-14319","title":"GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f49cbd-a794-4b39-92cb-9d9c8df82685?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.2","to_inclusive":true,"patched_in":"4.16.3"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:42:39Z"},{"id":"wordfence:95f5b4df-5214-4f36-8dd5-a1a816fbc3db","source":"wordfence","cve":"CVE-2023-47875","title":"Perfmatters <= 2.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f5b4df-5214-4f36-8dd5-a1a816fbc3db?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95f6e5cd-e153-419b-86f6-ce5c73d73738","source":"wordfence","cve":"CVE-2025-13000","title":"DB Access <= 0.8.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f6e5cd-e153-419b-86f6-ce5c73d73738?source=api-prod","affected":[{"type":"plugin","slug":"db-access","name":"db-access","from":"*","from_inclusive":true,"to":"0.8.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-11T00:00:00Z","updated":"2025-12-11T16:13:13Z"},{"id":"wordfence:95f9066c-e0dd-4909-a57b-c52070b135d1","source":"wordfence","cve":"CVE-2022-0640","title":"AP Pricing Tables Lite <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95f9066c-e0dd-4909-a57b-c52070b135d1?source=api-prod","affected":[{"type":"plugin","slug":"ap-pricing-tables-lite","name":"Pricing Table Builder \u2013 AP Pricing Tables Lite","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:95fa3158-9add-4fed-b9ff-7442f74ba70c","source":"wordfence","cve":"CVE-2025-54747","title":"Templatera <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95fa3158-9add-4fed-b9ff-7442f74ba70c?source=api-prod","affected":[{"type":"plugin","slug":"templatera","name":"Templatera","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:43:13Z"},{"id":"wordfence:95fde924-bba5-4b7d-8cee-50bb3d2b4134","source":"wordfence","cve":"CVE-2024-11620","title":"Rank Math SEO <= 1.0.231 - .htaccess File Manipulation to Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95fde924-bba5-4b7d-8cee-50bb3d2b4134?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.231","to_inclusive":true,"patched_in":"1.0.232"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T20:00:28Z"},{"id":"wordfence:95ff5150-ff45-48f8-bd39-0df79838942e","source":"wordfence","cve":"CVE-2024-30226","title":"BetterDocs \u2013 Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ff5150-ff45-48f8-bd39-0df79838942e?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-03-26T00:00:00Z","updated":"2024-06-06T16:07:22Z"},{"id":"wordfence:95ffefff-80e1-4f5a-8939-47a00f75493d","source":"wordfence","cve":"CVE-2023-23883","title":"WP Content Filter \u2013 Censor All Offensive Content From Your Site <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/95ffefff-80e1-4f5a-8939-47a00f75493d?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-filter","name":"Content Censor","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:960096d6-4083-4c39-b491-1f6042e5509e","source":"wordfence","cve":"CVE-2025-58931","title":"Palatio <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/960096d6-4083-4c39-b491-1f6042e5509e?source=api-prod","affected":[{"type":"theme","slug":"palatio","name":"Palatio \u2014 Luxury Hotel & Resort WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:33:09Z"},{"id":"wordfence:9601932a-0e0d-408f-91d0-47ff4e726b23","source":"wordfence","cve":"CVE-2025-54705","title":"WpEvently <= 4.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9601932a-0e0d-408f-91d0-47ff4e726b23?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:37:34Z"},{"id":"wordfence:960249b2-61e7-4105-a946-e3aea8d0ab16","source":"wordfence","cve":"CVE-2025-23459","title":"NS Simple Intro Loader <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/960249b2-61e7-4105-a946-e3aea8d0ab16?source=api-prod","affected":[{"type":"plugin","slug":"ns-simple-intro-loader","name":"NS Simple Intro Loader","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:00:45Z"},{"id":"wordfence:96035f77-a707-4538-aea3-88077858ab9b","source":"wordfence","cve":"CVE-2025-67624","title":"Optimize More! \u2013 Images <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96035f77-a707-4538-aea3-88077858ab9b?source=api-prod","affected":[{"type":"plugin","slug":"optimize-more-images","name":"Optimize More! \u2013 Images","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:02:08Z"},{"id":"wordfence:960365c3-f01e-4728-8035-f918db6f16c1","source":"wordfence","cve":"CVE-2026-42635","title":"WooCommerce Simple Auctions <= 3.0.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/960365c3-f01e-4728-8035-f918db6f16c1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-simple-auctions","name":"WooCommerce Simple Auctions","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-11-04T14:14:21Z"},{"id":"wordfence:9603e394-b358-4599-8610-ef5737a39de0","source":"wordfence","cve":"CVE-2023-51671","title":"FunnelKit Checkout <= 3.10.3 - Authenticated(Subscriber+) Missing Authorization to Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9603e394-b358-4599-8610-ef5737a39de0?source=api-prod","affected":[{"type":"plugin","slug":"woofunnels-aero-checkout","name":"FunnelKit Checkout","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9604fccc-ed8b-480b-ab56-ffa341631b52","source":"wordfence","cve":"CVE-2024-33696","title":"WordPress Ad Widget <= 2.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9604fccc-ed8b-480b-ab56-ffa341631b52?source=api-prod","affected":[{"type":"plugin","slug":"ad-widget","name":"Ad Widget for WordPress","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:30:07Z"},{"id":"wordfence:9607c9a9-29b3-47f0-a629-5a82d112b288","source":"wordfence","cve":"CVE-2026-113481","title":"Media Library Assistant <= 3.43 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9607c9a9-29b3-47f0-a629-5a82d112b288?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":true,"patched_in":"3.44"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-03T19:23:48Z"},{"id":"wordfence:96084352-cc53-45fc-a33f-2ebf470f81a7","source":"wordfence","cve":"","title":"Webcam Video Conference <= 3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96084352-cc53-45fc-a33f-2ebf470f81a7?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-video-conference-integration","name":"Webcam Video Conference","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"4.51"}],"published":"2013-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96086886-72f4-4a62-8f31-fc20e5240ba4","source":"wordfence","cve":"CVE-2024-0896","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96086886-72f4-4a62-8f31-fc20e5240ba4?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.2","to_inclusive":true,"patched_in":"2.7.4.3"}],"published":"2024-02-20T00:00:00Z","updated":"2024-03-13T15:27:06Z"},{"id":"wordfence:96103ad6-6800-401e-bbda-26ef3215b540","source":"wordfence","cve":"CVE-2026-81271","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.176 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96103ad6-6800-401e-bbda-26ef3215b540?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.176","to_inclusive":true,"patched_in":"2.8.177"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:02:03Z"},{"id":"wordfence:96111116-6b6f-42fc-98d8-6f5c27dc3c1c","source":"wordfence","cve":"CVE-2026-109515","title":"MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.78.6","to_inclusive":true,"patched_in":"1.2.78.7"}],"published":"2026-10-15T16:09:03Z","updated":"2026-10-16T04:27:01Z"},{"id":"wordfence:96112707-04ca-4647-9008-31954764486f","source":"wordfence","cve":"","title":"Gallery Portfolio <= 1.4.6 - Missing Authorization via Multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96112707-04ca-4647-9008-31954764486f?source=api-prod","affected":[{"type":"plugin","slug":"gallery-portfolio","name":"Portfolio Gallery \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":false,"patched_in":"1.4.7"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9611b4ba-0946-4180-a51d-18fcba84661e","source":"wordfence","cve":"CVE-2024-37242","title":"Newspack Newsletters <= 2.13.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9611b4ba-0946-4180-a51d-18fcba84661e?source=api-prod","affected":[{"type":"plugin","slug":"newspack-newsletters","name":"Newspack Newsletters","from":"*","from_inclusive":true,"to":"2.13.2","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-26T20:43:44Z"},{"id":"wordfence:96140bf6-d1fc-4eb5-aaf5-4bd6a6ebdee7","source":"wordfence","cve":"CVE-2026-15249","title":"Patterns Kit <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96140bf6-d1fc-4eb5-aaf5-4bd6a6ebdee7?source=api-prod","affected":[{"type":"plugin","slug":"patterns-kit","name":"Patterns Kit","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:13:27Z"},{"id":"wordfence:9614aaa9-d343-4fd4-8a40-7366cd961bd3","source":"wordfence","cve":"CVE-2022-2373","title":"Simply Schedule Appointments <= 1.5.7.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9614aaa9-d343-4fd4-8a40-7366cd961bd3?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.5.7.5","to_inclusive":true,"patched_in":"1.5.7.7"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96154542-b600-471a-a539-319352a3fe18","source":"wordfence","cve":"CVE-2024-49646","title":"Code Generate <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96154542-b600-471a-a539-319352a3fe18?source=api-prod","affected":[{"type":"plugin","slug":"code-generator","name":"Code Generate","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:50:02Z"},{"id":"wordfence:9615ef3f-e1e3-4791-a5a5-19260fee6354","source":"wordfence","cve":"CVE-2025-14804","title":"Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9615ef3f-e1e3-4791-a5a5-19260fee6354?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.4","to_inclusive":true,"patched_in":"23.5"}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-13T21:51:21Z"},{"id":"wordfence:96161594-9513-49f7-91ab-9ad05b900a81","source":"wordfence","cve":"CVE-2024-4710","title":"Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96161594-9513-49f7-91ab-9ad05b900a81?source=api-prod","affected":[{"type":"plugin","slug":"ubermenu","name":"UberMenu","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-21T06:49:59Z"},{"id":"wordfence:961702ff-60fb-41ff-99b0-a37ade051083","source":"wordfence","cve":"CVE-2026-4811","title":"WPB Floating Menu or Categories \u2013 Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961702ff-60fb-41ff-99b0-a37ade051083?source=api-prod","affected":[{"type":"plugin","slug":"wpb-floating-menu-or-categories","name":"WPB Floating Menu or Categories \u2013 Sticky Floating Side Menu & Categories with Icons","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-05-20T14:09:47Z","updated":"2026-05-21T02:27:39Z"},{"id":"wordfence:96170346-36c7-44ca-9324-12843ecc32aa","source":"wordfence","cve":"CVE-2026-107435","title":"Strong Testimonials <= 3.3.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96170346-36c7-44ca-9324-12843ecc32aa?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2026-10-19T07:27:53Z","updated":"2026-10-23T18:22:22Z"},{"id":"wordfence:96170b82-6ed9-4a52-8592-944163cdd3cf","source":"wordfence","cve":"CVE-2025-6423","title":"BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96170b82-6ed9-4a52-8592-944163cdd3cf?source=api-prod","affected":[{"type":"plugin","slug":"beeteam368-extensions","name":"BeeTeam368 Extensions","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-07-11T18:49:36Z","updated":"2025-07-12T07:24:26Z"},{"id":"wordfence:96192fdc-e9fe-403f-b233-28faa497a5c4","source":"wordfence","cve":"CVE-2025-11855","title":"Age Restriction <= 3.0.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96192fdc-e9fe-403f-b233-28faa497a5c4?source=api-prod","affected":[{"type":"plugin","slug":"age-restriction","name":"Premium Age Verification / Restriction for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-17T18:24:46Z"},{"id":"wordfence:961b2b60-2026-42fc-be55-e7023e8ef3df","source":"wordfence","cve":"CVE-2021-24480","title":"Event Geek <= 2.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961b2b60-2026-42fc-be55-e7023e8ef3df?source=api-prod","affected":[{"type":"plugin","slug":"event-geek","name":"Event Geek","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:961b9872-e602-49a7-a11a-566f3cd4bd0a","source":"wordfence","cve":"CVE-2026-24575","title":"WishList Member X <= 3.32.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961b9872-e602-49a7-a11a-566f3cd4bd0a?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2026-01-20T00:00:00Z","updated":"2026-08-17T04:34:47Z"},{"id":"wordfence:961b9a16-0b99-4a56-a158-864d643d5c96","source":"wordfence","cve":"CVE-2026-100180","title":"Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961b9a16-0b99-4a56-a158-864d643d5c96?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2026-10-02T13:57:49Z","updated":"2026-10-03T02:25:35Z"},{"id":"wordfence:961cf553-8871-436d-af95-61af963f5e9d","source":"wordfence","cve":"","title":"SAML Single Sign On \u2013 SAML SSO Login <= 4.9.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961cf553-8871-436d-af95-61af963f5e9d?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"4.9.20","to_inclusive":true,"patched_in":"4.9.21"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:961d6d1d-46e8-489f-ac5f-51b55c5a0460","source":"wordfence","cve":"CVE-2023-46073","title":"DX Delete Attached Media <= 2.0.5.1 - Cross-Site Request Forgery via add_to_base","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961d6d1d-46e8-489f-ac5f-51b55c5a0460?source=api-prod","affected":[{"type":"plugin","slug":"dx-delete-attached-media","name":"DX Delete Attached Media","from":"*","from_inclusive":true,"to":"2.0.5.1","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:961f4a7d-ca95-4c2c-8355-9d1d65cb614d","source":"wordfence","cve":"CVE-2025-67599","title":"WebToffee eCommerce Marketing Automation <= 2.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/961f4a7d-ca95-4c2c-8355-9d1d65cb614d?source=api-prod","affected":[{"type":"plugin","slug":"decorator-woocommerce-email-customizer","name":"WebToffee eCommerce Marketing Automation \u2013 Email marketing, Popups, Email customizer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-10-30T00:00:00Z","updated":"2025-12-11T16:55:52Z"},{"id":"wordfence:9622c839-a1dd-4633-8a9c-cec41d1041ff","source":"wordfence","cve":"CVE-2015-9228","title":"NextGen Gallery <= 2.1.10 - Unrestricted File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9622c839-a1dd-4633-8a9c-cec41d1041ff?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2015-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9623e815-a107-4f9f-90b2-ec8b1cc87ddc","source":"wordfence","cve":"CVE-2024-37261","title":"WP-Lister Lite for Amazon <= 2.6.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9623e815-a107-4f9f-90b2-ec8b1cc87ddc?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-amazon","name":"WP-Lister Lite for Amazon","from":"*","from_inclusive":true,"to":"2.6.16","to_inclusive":true,"patched_in":"2.6.17"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:00:13Z"},{"id":"wordfence:96259333-8d6f-4a27-9f52-c65d599ed981","source":"wordfence","cve":"CVE-2026-15090","title":"Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96259333-8d6f-4a27-9f52-c65d599ed981?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":true,"patched_in":"7.9.3"}],"published":"2026-10-14T16:27:11Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:96265dd0-ed3d-4557-80e9-41f8b943b2a7","source":"wordfence","cve":"CVE-2021-24999","title":"Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in PDF Invoicing Module","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96265dd0-ed3d-4557-80e9-41f8b943b2a7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"5.4.9"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96288db4-2758-4562-8b26-0523926c9156","source":"wordfence","cve":"","title":"Rencontre \u2013 Dating Site <= 3.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96288db4-2758-4562-8b26-0523926c9156?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2019-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9628d0dc-a25a-4cc5-bea7-92aae8f45c0d","source":"wordfence","cve":"CVE-2026-107650","title":"GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9628d0dc-a25a-4cc5-bea7-92aae8f45c0d?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.190","to_inclusive":true,"patched_in":"2.8.191"}],"published":"2026-10-13T19:15:25Z","updated":"2026-10-14T07:43:35Z"},{"id":"wordfence:962af7eb-b2eb-4190-bf0d-cb05cb28f10b","source":"wordfence","cve":"CVE-2023-23679","title":"JS Help Desk \u2013 Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/962af7eb-b2eb-4190-bf0d-cb05cb28f10b?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:962c0440-04d7-4201-829c-dad9b8f796d5","source":"wordfence","cve":"CVE-2021-38349","title":"Integration of Moneybird for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/962c0440-04d7-4201-829c-dad9b8f796d5?source=api-prod","affected":[{"type":"plugin","slug":"woo-moneybird","name":"Integration of Moneybird for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:962ca39f-dec5-4881-aeb7-7cdfa607af31","source":"wordfence","cve":"CVE-2026-40729","title":"3D viewer \u2013 Embed 3D Models <= 1.8.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/962ca39f-dec5-4881-aeb7-7cdfa607af31?source=api-prod","affected":[{"type":"plugin","slug":"3d-viewer","name":"3D Viewer \u2013 Turn Product Pages into Interactive 3D Experiences","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2026-03-01T00:00:00Z","updated":"2026-05-07T14:00:58Z"},{"id":"wordfence:962f31e6-7863-45e1-835e-c679046deeea","source":"wordfence","cve":"CVE-2022-0404","title":"Material Design for Contact Form 7 <= 2.6.4 - Missing Authorization to Arbitrary Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/962f31e6-7863-45e1-835e-c679046deeea?source=api-prod","affected":[{"type":"plugin","slug":"material-design-for-contact-form-7","name":"Material Design for Contact Form 7","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2022-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96320410-48e2-42a6-9a1e-1641c1229256","source":"wordfence","cve":"CVE-2021-25055","title":"FeedWordPress <= 2021.0713 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96320410-48e2-42a6-9a1e-1641c1229256?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2021.0713","to_inclusive":true,"patched_in":"2022.0123"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:963332d7-9c01-4698-b9ea-60f63e302ada","source":"wordfence","cve":"CVE-2026-105886","title":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963332d7-9c01-4698-b9ea-60f63e302ada?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:31:05Z"},{"id":"wordfence:9634fbea-7562-43c4-bde9-03e762ce01a1","source":"wordfence","cve":"CVE-2026-27415","title":"BEAR \u2013 Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9634fbea-7562-43c4-bde9-03e762ce01a1?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:28:15Z"},{"id":"wordfence:96388c82-2392-42b3-b0a0-c3d92910fb5c","source":"wordfence","cve":"CVE-2021-4331","title":"The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96388c82-2392-42b3-b0a0-c3d92910fb5c?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.1.10"},{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9638fb3b-e1dd-4917-8770-62b1598b85be","source":"wordfence","cve":"CVE-2024-54322","title":"Media Downloader <= 0.4.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9638fb3b-e1dd-4917-8770-62b1598b85be?source=api-prod","affected":[{"type":"plugin","slug":"media-downloader","name":"Media Downloader","from":"*","from_inclusive":true,"to":"0.4.7.4","to_inclusive":true,"patched_in":"0.4.7.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:17:39Z"},{"id":"wordfence:9638fb98-045b-44ec-8b53-15cfa3693ee7","source":"wordfence","cve":"CVE-2024-13236","title":"Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9638fb98-045b-44ec-8b53-15cfa3693ee7?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.12","to_inclusive":true,"patched_in":"0.21.13"}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-23T11:13:29Z"},{"id":"wordfence:963a9b30-9194-4abc-aa69-eb333cbddef3","source":"wordfence","cve":"CVE-2025-2074","title":"Advanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963a9b30-9194-4abc-aa69-eb333cbddef3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.30"}],"published":"2025-03-27T19:32:14Z","updated":"2025-03-28T07:33:05Z"},{"id":"wordfence:963aea10-07ef-430e-8b05-8cb8ceca5113","source":"wordfence","cve":"CVE-2026-32467","title":"[\u51f9\u51f8\u66fc] \u4e00\u952e\u91c7\u96c6\u5fae\u4fe1\u6587\u7ae0 <= 2.0.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963aea10-07ef-430e-8b05-8cb8ceca5113?source=api-prod","affected":[{"type":"plugin","slug":"apoyl-grabweixin","name":"[\u51f9\u51f8\u66fc] \u4e00\u952e\u91c7\u96c6\u5fae\u4fe1\u6587\u7ae0","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-03T16:25:45Z"},{"id":"wordfence:963c2d10-692b-4447-8d0b-7ccc2e533f01","source":"wordfence","cve":"CVE-2024-9872","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963c2d10-692b-4447-8d0b-7ccc2e533f01?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:56Z"},{"id":"wordfence:963cb544-165e-4378-9844-753c72bf2274","source":"wordfence","cve":"CVE-2024-37513","title":"WPCafe <= 2.2.27 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963cb544-165e-4378-9844-753c72bf2274?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-11T13:20:38Z"},{"id":"wordfence:963db13e-14aa-4fc0-8d28-3f8a22361361","source":"wordfence","cve":"CVE-2020-26672","title":"Testimonial Rotator <= 3.0.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963db13e-14aa-4fc0-8d28-3f8a22361361?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-rotator","name":"Testimonial Rotator","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":""}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:963f2485-3afa-4e17-8278-b75415af3915","source":"wordfence","cve":"CVE-2024-6397","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/963f2485-3afa-4e17-8278-b75415af3915?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.44","to_inclusive":true,"patched_in":"0.1.0.45"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-11T03:33:20Z"},{"id":"wordfence:9642be85-2817-4a3b-831b-0f1535106897","source":"wordfence","cve":"CVE-2023-23718","title":"Page Loading Effects <= 2.0.0 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9642be85-2817-4a3b-831b-0f1535106897?source=api-prod","affected":[{"type":"plugin","slug":"page-loading-effects","name":"Page Loading Effects","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9645b17e-6a7c-4cdd-ae43-7d2c84b624cc","source":"wordfence","cve":"CVE-2024-11952","title":"Classic Addons \u2013 WPBakery Page Builder <= 3.0 - Authenticated (Contributor+) Limited Local PHP File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9645b17e-6a7c-4cdd-ae43-7d2c84b624cc?source=api-prod","affected":[{"type":"plugin","slug":"classic-addons-wpbakery-page-builder-addons","name":"Classic Addons \u2013 WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T08:22:47Z"},{"id":"wordfence:964601d5-8460-41c5-9791-ff9e3af964e3","source":"wordfence","cve":"","title":"Simple Ads Manager  < 2.9.4.116 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/964601d5-8460-41c5-9791-ff9e3af964e3?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"*","from_inclusive":true,"to":"2.9.4.116","to_inclusive":false,"patched_in":"2.9.4.116"}],"published":"2015-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9646cfdc-1cf4-4785-8b3e-86143658c149","source":"wordfence","cve":"CVE-2025-67966","title":"Lawyer Directory <= 1.3.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9646cfdc-1cf4-4785-8b3e-86143658c149?source=api-prod","affected":[{"type":"plugin","slug":"lawyer-directory","name":"Lawyer Directory","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:30:11Z"},{"id":"wordfence:96484a39-d64a-48a1-aaf6-678855eebf0b","source":"wordfence","cve":"CVE-2026-82195","title":"10Web Booster <= 2.33.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96484a39-d64a-48a1-aaf6-678855eebf0b?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.34.0"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:48:35Z"},{"id":"wordfence:964950dc-d8e1-4a9b-bef2-ea51abc5a925","source":"wordfence","cve":"CVE-2024-1375","title":"Event post <= 5.9.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/964950dc-d8e1-4a9b-bef2-ea51abc5a925?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2025-03-21T16:27:03Z"},{"id":"wordfence:9649b153-3acc-4e5b-9338-448099aba887","source":"wordfence","cve":"CVE-2024-44024","title":"Medical Addon for Elementor <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9649b153-3acc-4e5b-9338-448099aba887?source=api-prod","affected":[{"type":"plugin","slug":"medical-addon-for-elementor","name":"Medical Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-30T17:04:12Z"},{"id":"wordfence:964aa996-3f4d-4118-98ba-cd82da8d34bb","source":"wordfence","cve":"CVE-2025-69106","title":"Imba <= 1.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/964aa996-3f4d-4118-98ba-cd82da8d34bb?source=api-prod","affected":[{"type":"theme","slug":"imba","name":"Imba","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:43:01Z"},{"id":"wordfence:964d6dd2-0e93-4fc2-87ca-0257186d1b37","source":"wordfence","cve":"CVE-2024-34412","title":"Shipment Tracking, Tracking, and Order Tracking for WooCommerce \u2013 ParcelPanel (Free to install) <= 3.8.2 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/964d6dd2-0e93-4fc2-87ca-0257186d1b37?source=api-prod","affected":[{"type":"plugin","slug":"parcelpanel","name":"CWILL (Formerly ParcelPanel) \u2013 Shipment Tracking, Tracking & Order Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T19:00:31Z"},{"id":"wordfence:965107bd-e1ee-4a0c-af9e-bdd765d3eab5","source":"wordfence","cve":"CVE-2016-11009","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965107bd-e1ee-4a0c-af9e-bdd765d3eab5?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9651f4cf-5349-460c-a453-326600280990","source":"wordfence","cve":"CVE-2024-56025","title":"AdWork Media EZ Content Locker <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9651f4cf-5349-460c-a453-326600280990?source=api-prod","affected":[{"type":"plugin","slug":"adwork-media-ez-content-locker","name":"AdWork Media EZ Content Locker","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:29:05Z"},{"id":"wordfence:9652575b-389c-42e3-800a-0f133e0c224b","source":"wordfence","cve":"","title":"Shortcodes by Angie Makes < 2.07 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9652575b-389c-42e3-800a-0f133e0c224b?source=api-prod","affected":[{"type":"plugin","slug":"wc-shortcodes","name":"Shortcodes by Angie Makes","from":"*","from_inclusive":true,"to":"2.07","to_inclusive":false,"patched_in":"2.07"}],"published":"2016-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9655379f-9fbe-4d19-a0b7-2fe640be09be","source":"wordfence","cve":"CVE-2026-87759","title":"Add User Autocomplete < 1.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9655379f-9fbe-4d19-a0b7-2fe640be09be?source=api-prod","affected":[{"type":"plugin","slug":"add-user-autocomplete","name":"Add User Autocomplete","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:58:13Z"},{"id":"wordfence:965582c6-a52e-4f88-81ef-b5dd761a0c23","source":"wordfence","cve":"CVE-2025-8999","title":"Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965582c6-a52e-4f88-81ef-b5dd761a0c23?source=api-prod","affected":[{"type":"theme","slug":"sydney","name":"Sydney","from":"*","from_inclusive":true,"to":"2.56","to_inclusive":true,"patched_in":"2.57"}],"published":"2025-09-16T00:00:00Z","updated":"2025-10-28T17:20:24Z"},{"id":"wordfence:9659c277-e028-4544-bf67-61916dcc1e94","source":"wordfence","cve":"CVE-2025-53302","title":"Constructor <= 1.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9659c277-e028-4544-bf67-61916dcc1e94?source=api-prod","affected":[{"type":"theme","slug":"constructor","name":"Constructor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-08-19T17:10:19Z"},{"id":"wordfence:965b5979-9bf6-4124-86c4-e246f8f17270","source":"wordfence","cve":"CVE-2023-0429","title":"Watu Quiz <= 3.3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965b5979-9bf6-4124-86c4-e246f8f17270?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.3.8.2","to_inclusive":true,"patched_in":"3.3.8.3"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:965b6a19-3e5f-446c-a739-746e886a5585","source":"wordfence","cve":"CVE-2026-9599","title":"Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965b6a19-3e5f-446c-a739-746e886a5585?source=api-prod","affected":[{"type":"plugin","slug":"tectite-forms","name":"Tectite Forms","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:43:19Z","updated":"2026-06-02T07:48:31Z"},{"id":"wordfence:965bb0f7-0757-4842-9c26-a5574145a6a3","source":"wordfence","cve":"CVE-2025-60132","title":"Video Blogster Lite <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965bb0f7-0757-4842-9c26-a5574145a6a3?source=api-prod","affected":[{"type":"plugin","slug":"video-blogster-lite","name":"Video Blogster Lite","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:17:13Z"},{"id":"wordfence:965bb642-4472-491f-8378-f4331ba4ab7c","source":"wordfence","cve":"CVE-2026-3546","title":"e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965bb642-4472-491f-8378-f4331ba4ab7c?source=api-prod","affected":[{"type":"plugin","slug":"e-shot-form-builder","name":"e-shot","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:33Z","updated":"2026-03-21T03:26:56Z"},{"id":"wordfence:965cacd3-1786-4e7d-8209-eea293b161d3","source":"wordfence","cve":"CVE-2024-4633","title":"Slider & Popup Builder by Depicter \u2013 Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965cacd3-1786-4e7d-8209-eea293b161d3?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T13:45:21Z"},{"id":"wordfence:965cd061-d34e-4749-85a6-efa2456b1446","source":"wordfence","cve":"CVE-2024-33953","title":"Adventure Journal <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965cd061-d34e-4749-85a6-efa2456b1446?source=api-prod","affected":[{"type":"theme","slug":"adventure-journal","name":"Adventure Journal","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:02:10Z"},{"id":"wordfence:965dce53-2865-4179-9505-a64e4db1d1fd","source":"wordfence","cve":"CVE-2025-27007","title":"OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/965dce53-2865-4179-9505-a64e4db1d1fd?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.0.82","to_inclusive":true,"patched_in":"1.0.83"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-02T16:31:09Z"},{"id":"wordfence:96608c76-6dfd-4ff8-b114-070ff6706214","source":"wordfence","cve":"","title":"Ajax Search Pro <= 4.18.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96608c76-6dfd-4ff8-b114-070ff6706214?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-pro","name":"Ajax Search Pro","from":"*","from_inclusive":true,"to":"4.18.7","to_inclusive":true,"patched_in":"4.19"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:966159e8-e393-4eba-a8cd-8f343762b0b8","source":"wordfence","cve":"CVE-2025-53347","title":"Kalium <= 3.18.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966159e8-e393-4eba-a8cd-8f343762b0b8?source=api-prod","affected":[{"type":"theme","slug":"kalium","name":"Kalium 3 | Creative WordPress & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.18.3","to_inclusive":true,"patched_in":"3.19"}],"published":"2025-08-14T00:00:00Z","updated":"2026-01-07T14:51:59Z"},{"id":"wordfence:96623f61-8dfc-4b17-bee7-8b2279efcc0d","source":"wordfence","cve":"CVE-2025-30637","title":"Booking Ultra Pro <= 1.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96623f61-8dfc-4b17-bee7-8b2279efcc0d?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:46:09Z"},{"id":"wordfence:96649aa6-f3ba-4e9e-9fa5-a5fbd52c3836","source":"wordfence","cve":"CVE-2023-47524","title":"CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Reflected Cross-Site Scripting via cb_p6_tab","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96649aa6-f3ba-4e9e-9fa5-a5fbd52c3836?source=api-prod","affected":[{"type":"plugin","slug":"patron-button-and-widgets-by-codebard","name":"CodeBard\u2019s Patron Button and Widgets for Patreon","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:966523a4-3d4b-444b-b9d0-63c72527a99f","source":"wordfence","cve":"CVE-2025-12822","title":"WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966523a4-3d4b-444b-b9d0-63c72527a99f?source=api-prod","affected":[{"type":"plugin","slug":"login-register-using-jwt","name":"WP Login and Register using JWT","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-11-18T17:17:49Z","updated":"2025-11-19T05:45:15Z"},{"id":"wordfence:9666913e-55a3-441c-85ef-8a12756e37ba","source":"wordfence","cve":"CVE-2023-5133","title":"User Activity Log Pro <= 2.3.3 - Tracking Bypass via IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9666913e-55a3-441c-85ef-8a12756e37ba?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log-pro","name":"User Activity Log Pro","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9666ed12-bc1c-4bd3-bb56-39b7d6511100","source":"wordfence","cve":"CVE-2026-86612","title":"Ninja Tables <= 5.2.16 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9666ed12-bc1c-4bd3-bb56-39b7d6511100?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"5.2.17"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:53:15Z"},{"id":"wordfence:966843d1-64c2-4f49-852c-d362714db823","source":"wordfence","cve":"CVE-2018-11580","title":"Mass Pages/Posts Creator <= 1.2.2 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966843d1-64c2-4f49-852c-d362714db823?source=api-prod","affected":[{"type":"plugin","slug":"mass-pagesposts-creator","name":"Mass Pages/Posts Creator","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2018-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9669fbae-cf7a-4715-a1f3-cdbbb1c1cedd","source":"wordfence","cve":"CVE-2024-43165","title":"WPSection <= 1.3.8 - Authenticated (Contributor+) Local File Inlcusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9669fbae-cf7a-4715-a1f3-cdbbb1c1cedd?source=api-prod","affected":[{"type":"plugin","slug":"wpsection","name":"wpsection","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:24:26Z"},{"id":"wordfence:966a3a33-3d22-4671-8893-7a64ff838f39","source":"wordfence","cve":"CVE-2022-4220","title":"Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Question Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966a3a33-3d22-4671-8893-7a64ff838f39?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.4","to_inclusive":true,"patched_in":"1.3.2.5"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:966b43ea-dbd3-4f1e-b803-08027fff6f8f","source":"wordfence","cve":"","title":"wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966b43ea-dbd3-4f1e-b803-08027fff6f8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-vertical-image-slider","name":"Vertical Image Slider \u2013 Responsive Thumbnail Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2015-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:966c1da2-bf43-44e2-b4ff-dce66433e940","source":"wordfence","cve":"CVE-2026-9278","title":"Form Builder CP <= 1.2.46 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966c1da2-bf43-44e2-b4ff-dce66433e940?source=api-prod","affected":[{"type":"plugin","slug":"cp-easy-form-builder","name":"Form Builder CP","from":"*","from_inclusive":true,"to":"1.2.46","to_inclusive":true,"patched_in":"1.2.47"}],"published":"2026-05-25T00:00:00Z","updated":"2026-09-18T15:06:21Z"},{"id":"wordfence:966fdfc9-7c8d-4912-80d7-7371b6fce0f3","source":"wordfence","cve":"CVE-2026-65497","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 7.5.1 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/966fdfc9-7c8d-4912-80d7-7371b6fce0f3?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-17T04:14:26Z"},{"id":"wordfence:9670bd32-34ce-48b1-82d9-62ab8869a89b","source":"wordfence","cve":"CVE-2024-3342","title":"Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9670bd32-34ce-48b1-82d9-62ab8869a89b?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":"2.4.12"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-27T08:37:55Z"},{"id":"wordfence:9670ce65-bbcb-4959-8417-b8aae7c97b88","source":"wordfence","cve":"CVE-2026-84769","title":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress <= 6.4.26 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9670ce65-bbcb-4959-8417-b8aae7c97b88?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.26","to_inclusive":true,"patched_in":"6.4.27"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:13:47Z"},{"id":"wordfence:9671081f-ce7d-4141-be82-104ce08c4382","source":"wordfence","cve":"CVE-2026-80433","title":"SureFeedback Client Site <= 1.2.12 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9671081f-ce7d-4141-be82-104ce08c4382?source=api-prod","affected":[{"type":"plugin","slug":"projecthuddle-child-site","name":"SureFeedback Client Site","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":"1.2.13"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:02:58Z"},{"id":"wordfence:967201a0-a47f-497e-a062-d6c60e1edb86","source":"wordfence","cve":"CVE-2024-50430","title":"Beaver Builder <= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/967201a0-a47f-497e-a062-d6c60e1edb86?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.3.7","to_inclusive":true,"patched_in":"2.8.3.9"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:16:28Z"},{"id":"wordfence:96769a0e-d4a9-4196-8ded-b600046c0943","source":"wordfence","cve":"CVE-2024-1808","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96769a0e-d4a9-4196-8ded-b600046c0943?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.4"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T12:50:50Z"},{"id":"wordfence:9676c768-496a-4131-93ff-481db158cceb","source":"wordfence","cve":"CVE-2024-35712","title":"Database Cleaner <= 1.0.5 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9676c768-496a-4131-93ff-481db158cceb?source=api-prod","affected":[{"type":"plugin","slug":"database-cleaner","name":"Database Cleaner: Cleanup, Optimization & Repair","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:37:51Z"},{"id":"wordfence:9678e683-5d51-47dd-8c0f-4eb47d9be636","source":"wordfence","cve":"CVE-2024-51649","title":"Mobilize <= 3.0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9678e683-5d51-47dd-8c0f-4eb47d9be636?source=api-prod","affected":[{"type":"plugin","slug":"mobilize","name":"Mobilize","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:51:27Z"},{"id":"wordfence:9678ef78-ac5c-4dc0-8c15-092359f3defa","source":"wordfence","cve":"CVE-2026-109977","title":"YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9678ef78-ac5c-4dc0-8c15-092359f3defa?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.9"}],"published":"2026-11-05T20:46:36Z","updated":"2026-11-06T09:38:14Z"},{"id":"wordfence:967ff273-33f3-4580-928a-7764583429aa","source":"wordfence","cve":"CVE-2022-33961","title":"YellowPencil Visual CSS Style Editor <= 7.5.8 - Reflected Cross-Site Scripting liveLink","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/967ff273-33f3-4580-928a-7764583429aa?source=api-prod","affected":[{"type":"plugin","slug":"yellow-pencil-visual-theme-customizer","name":"Visual CSS Style Editor","from":"*","from_inclusive":true,"to":"7.5.8","to_inclusive":true,"patched_in":"7.5.9"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9680fed3-e8fe-4845-9807-f139f9e22e79","source":"wordfence","cve":"CVE-2022-1547","title":"Check & Log email <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9680fed3-e8fe-4845-9807-f139f9e22e79?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9681ecf9-e020-4b3a-ad31-f8f203d548aa","source":"wordfence","cve":"CVE-2025-23863","title":"Rollover Tab <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9681ecf9-e020-4b3a-ad31-f8f203d548aa?source=api-prod","affected":[{"type":"plugin","slug":"rollover-tab","name":"Rollover Tab","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:14:01Z"},{"id":"wordfence:96844c67-671b-4159-a6fd-a91eadde6cbe","source":"wordfence","cve":"CVE-2025-32144","title":"Job Board Manager <= 2.1.60 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96844c67-671b-4159-a6fd-a91eadde6cbe?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:45:20Z"},{"id":"wordfence:96850eb6-77d8-4012-b360-a417918cab0e","source":"wordfence","cve":"CVE-2026-3056","title":"Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96850eb6-77d8-4012-b360-a417918cab0e?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.28.14","to_inclusive":true,"patched_in":"2.28.15"}],"published":"2026-03-03T21:55:42Z","updated":"2026-03-04T11:22:36Z"},{"id":"wordfence:9686e2ab-3328-43d6-bc70-b61555cb3791","source":"wordfence","cve":"CVE-2025-64358","title":"Smart Coupons for WooCommerce <= 2.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9686e2ab-3328-43d6-bc70-b61555cb3791?source=api-prod","affected":[{"type":"plugin","slug":"wt-smart-coupons-for-woocommerce","name":"Smart Coupons For WooCommerce Coupons","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-04T14:28:29Z"},{"id":"wordfence:9687a88f-ac5b-4746-a68c-91c358b5fb87","source":"wordfence","cve":"CVE-2025-12153","title":"Featured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9687a88f-ac5b-4746-a68c-91c358b5fb87?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-via-url","name":"Featured Image via URL","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:21:27Z","updated":"2025-12-05T05:31:26Z"},{"id":"wordfence:9687e8e5-add1-477d-9cb7-f94b8af10da5","source":"wordfence","cve":"CVE-2021-24750","title":"WP Visitor Statistics (Real Time Traffic) <= 4.7 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9687e8e5-add1-477d-9cb7-f94b8af10da5?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":false,"patched_in":"4.8"}],"published":"2021-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:968920b9-febf-4d76-a16b-f27954cd72e5","source":"wordfence","cve":"CVE-2023-0385","title":"Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/968920b9-febf-4d76-a16b-f27954cd72e5?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96896174-3ad9-4dcf-b06b-cd5ee91a6240","source":"wordfence","cve":"CVE-2023-3650","title":"Bubble Menu <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96896174-3ad9-4dcf-b06b-cd5ee91a6240?source=api-prod","affected":[{"type":"plugin","slug":"bubble-menu","name":"Bubble Menu \u2013 Floating Button Menu with Sticky Navigation","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2023-07-17T00:00:00Z","updated":"2024-06-06T16:07:44Z"},{"id":"wordfence:9689a638-f7e5-4340-8a69-990fc2f6b9e5","source":"wordfence","cve":"CVE-2025-22710","title":"Smart Manager <= 8.52.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9689a638-f7e5-4340-8a69-990fc2f6b9e5?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.52.0","to_inclusive":true,"patched_in":"8.53.0"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T21:00:29Z"},{"id":"wordfence:968d5d31-2592-4bed-9d18-5877f0d6062e","source":"wordfence","cve":"CVE-2024-9860","title":"Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/968d5d31-2592-4bed-9d18-5877f0d6062e?source=api-prod","affected":[{"type":"plugin","slug":"bridge-core","name":"Bridge Core","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-10-11T00:00:00Z","updated":"2024-10-24T18:14:09Z"},{"id":"wordfence:968dce76-783a-4c1a-8d62-e1f8d6cc2f2c","source":"wordfence","cve":"CVE-2025-23950","title":"EZPlayer <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/968dce76-783a-4c1a-8d62-e1f8d6cc2f2c?source=api-prod","affected":[{"type":"plugin","slug":"ezplayer","name":"EZPlayer","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:43:09Z"},{"id":"wordfence:968ead80-eed6-4a42-a3cd-73cf4cbbb1e5","source":"wordfence","cve":"CVE-2018-20988","title":"Google Forms <= 0.93 - Remote Code Execution","severity":"high","cvss":7.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/968ead80-eed6-4a42-a3cd-73cf4cbbb1e5?source=api-prod","affected":[{"type":"plugin","slug":"wpgform","name":"Google Forms","from":"*","from_inclusive":true,"to":"0.94","to_inclusive":false,"patched_in":"0.94"}],"published":"2018-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9692deb2-2526-4983-8a13-93a382e230c8","source":"wordfence","cve":"CVE-2026-5524","title":"Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9692deb2-2526-4983-8a13-93a382e230c8?source=api-prod","affected":[{"type":"plugin","slug":"divi-form-builder","name":"Divi Form Builder","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-02T12:34:40Z"},{"id":"wordfence:9694c8b6-3e2f-499f-bdac-eed78d89e08a","source":"wordfence","cve":"","title":"WP Last Modified Info <= 1.6.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9694c8b6-3e2f-499f-bdac-eed78d89e08a?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified-info","name":"WP Last Modified Info","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2020-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9694f4e0-be99-4122-82d2-b22e7422c877","source":"wordfence","cve":"CVE-2024-8700","title":"Event Calendar <= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9694f4e0-be99-4122-82d2-b22e7422c877?source=api-prod","affected":[{"type":"plugin","slug":"event-calendars","name":"Event Calendar","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-16T14:44:58Z"},{"id":"wordfence:9694fae8-dfe9-4e19-bebc-2f2a607cff82","source":"wordfence","cve":"CVE-2024-1273","title":"Starbox <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9694fae8-dfe9-4e19-bebc-2f2a607cff82?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-02-13T00:00:00Z","updated":"2024-04-24T14:34:22Z"},{"id":"wordfence:9696fae6-39fe-4478-90e7-488b5b573fa8","source":"wordfence","cve":"CVE-2026-3722","title":"Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9696fae6-39fe-4478-90e7-488b5b573fa8?source=api-prod","affected":[{"type":"plugin","slug":"auto-image-attributes-from-filename-with-bulk-updater","name":"Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO)","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2026-06-01T12:44:43Z","updated":"2026-06-02T01:28:04Z"},{"id":"wordfence:9697fa6d-9356-4d9d-b8cd-ba933674b213","source":"wordfence","cve":"CVE-2026-12276","title":"LA-Studio Element Kit for Elementor <= 1.6.0 - Unauthenticated Open Registration","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9697fa6d-9356-4d9d-b8cd-ba933674b213?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-06-19T00:00:00Z","updated":"2026-07-30T12:20:28Z"},{"id":"wordfence:9699118a-e12f-491f-b464-51129888fb1a","source":"wordfence","cve":"","title":"Two Way Chat <= 3.1.4 - Authenticated (Admin+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9699118a-e12f-491f-b464-51129888fb1a?source=api-prod","affected":[{"type":"plugin","slug":"twchat","name":"TWChat \u2013 Send or receive messages from users","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9699944e-7f1b-4d79-9dca-98472d3db48f","source":"wordfence","cve":"CVE-2024-34424","title":"Featured Content Gallery <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9699944e-7f1b-4d79-9dca-98472d3db48f?source=api-prod","affected":[{"type":"plugin","slug":"featured-content-gallery","name":"Featured Content Gallery","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:45:12Z"},{"id":"wordfence:9699970f-76a4-4f10-9836-4e46ac8d6914","source":"wordfence","cve":"CVE-2025-24751","title":"CoBlocks <= 3.1.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9699970f-76a4-4f10-9836-4e46ac8d6914?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:28:51Z"},{"id":"wordfence:969a9357-47ce-4c7e-a259-559a2584485a","source":"wordfence","cve":"CVE-2025-24594","title":"Linet ERP-Woocommerce Integration <= 3.5.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/969a9357-47ce-4c7e-a259-559a2584485a?source=api-prod","affected":[{"type":"plugin","slug":"linet-erp-woocommerce-integration","name":"Linet ERP Integration For Woocommerce","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:08:36Z"},{"id":"wordfence:969b54d4-50db-4a2f-afa1-e22b29af661e","source":"wordfence","cve":"","title":"WordPress Colorbox Lightbox Plugin <= 1.1.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/969b54d4-50db-4a2f-afa1-e22b29af661e?source=api-prod","affected":[{"type":"plugin","slug":"wp-colorbox","name":"WP Colorbox","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2020-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:969c17d4-9ca2-48ff-a5a6-9139b3da99c4","source":"wordfence","cve":"CVE-2025-9543","title":"FlexTable Google Sheets Connector <= 3.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/969c17d4-9ca2-48ff-a5a6-9139b3da99c4?source=api-prod","affected":[{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"3.19.1","to_inclusive":true,"patched_in":"3.19.2"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-14T14:57:54Z"},{"id":"wordfence:969d35b5-2f2e-4255-b336-947414f269a5","source":"wordfence","cve":"CVE-2026-1969","title":"ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/969d35b5-2f2e-4255-b336-947414f269a5?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.38.5","to_inclusive":false,"patched_in":"2.38.5"}],"published":"2026-03-30T00:00:00Z","updated":"2026-04-09T16:46:48Z"},{"id":"wordfence:969d605d-e093-447c-abf7-0d56cb3ac569","source":"wordfence","cve":"CVE-2026-18561","title":"Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/969d605d-e093-447c-abf7-0d56cb3ac569?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2026-09-10T14:43:49Z","updated":"2026-09-11T03:39:37Z"},{"id":"wordfence:96a0c18f-ddd7-4cae-bc61-c8fbf4cc3e66","source":"wordfence","cve":"CVE-2025-53301","title":"Theme Junkie Team Content <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a0c18f-ddd7-4cae-bc61-c8fbf4cc3e66?source=api-prod","affected":[{"type":"plugin","slug":"theme-junkie-team-content","name":"Theme Junkie Team Content","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:40:48Z"},{"id":"wordfence:96a0ca0c-7cd5-4be4-a833-fc15fff62362","source":"wordfence","cve":"CVE-2021-24957","title":"Advanced Page Visit Counter <= 6.1.5 - Subscriber+ Blind SQL injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a0ca0c-7cd5-4be4-a833-fc15fff62362?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.1.6","to_inclusive":false,"patched_in":"6.1.6"}],"published":"2022-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96a2a552-e73f-4b27-88de-50eb63a8d131","source":"wordfence","cve":"CVE-2026-75865","title":"WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a2a552-e73f-4b27-88de-50eb63a8d131?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-08-31T14:24:56Z","updated":"2026-09-01T02:26:49Z"},{"id":"wordfence:96a2e7cc-23ae-404a-9889-e7bf9f744ec5","source":"wordfence","cve":"CVE-2026-25316","title":"CartFlows \u2013 Checkout & Funnel Builder for WooCommerce <= 2.1.19 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a2e7cc-23ae-404a-9889-e7bf9f744ec5?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-01-26T00:00:00Z","updated":"2026-05-04T15:35:33Z"},{"id":"wordfence:96a5db79-a88d-4c1f-9da4-6dd3120ff85e","source":"wordfence","cve":"CVE-2024-53761","title":"WP Revisions Manager <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a5db79-a88d-4c1f-9da4-6dd3120ff85e?source=api-prod","affected":[{"type":"plugin","slug":"wp-revisions-manager","name":"WP Revisions Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2026-04-21T13:35:04Z"},{"id":"wordfence:96a72f20-25a0-4c8f-a789-83833798bcb8","source":"wordfence","cve":"CVE-2026-103330","title":"Sadad QA Payment <= 1.28 - Payment Verification Bypass to Unauthenticated Arbitrary Order Payment Confirmation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a72f20-25a0-4c8f-a789-83833798bcb8?source=api-prod","affected":[{"type":"plugin","slug":"woo-sadad-payment-gateway","name":"Sadad QA Payment","from":"*","from_inclusive":true,"to":"1.28","to_inclusive":true,"patched_in":"1.29"}],"published":"2026-10-25T00:00:00Z","updated":"2026-11-04T21:11:41Z"},{"id":"wordfence:96a79f00-1797-4180-b92f-e1767c1fe8ed","source":"wordfence","cve":"CVE-2026-122670","title":"Polylang <= 3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a79f00-1797-4180-b92f-e1767c1fe8ed?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-11-06T22:28:00Z","updated":"2026-11-10T19:55:26Z"},{"id":"wordfence:96a7ebcb-3420-497c-80e6-54e42afe41a3","source":"wordfence","cve":"CVE-2024-27989","title":"WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a7ebcb-3420-497c-80e6-54e42afe41a3?source=api-prod","affected":[{"type":"plugin","slug":"responsive-horizontal-vertical-and-accordion-tabs","name":"Responsive Tabs \u2014 Horizontal, Vertical & Accordion Tabs for WordPress","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":"1.1.18"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:40:51Z"},{"id":"wordfence:96a80b89-94e0-4bbd-88cf-5eb5349c320b","source":"wordfence","cve":"CVE-2026-6457","title":"Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a80b89-94e0-4bbd-88cf-5eb5349c320b?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.19","to_inclusive":true,"patched_in":"1.13.20"}],"published":"2026-05-01T19:15:56Z","updated":"2026-05-02T07:46:41Z"},{"id":"wordfence:96a8fc8b-6f0a-486c-89d1-7211b4ca31bd","source":"wordfence","cve":"CVE-2025-14971","title":"Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a8fc8b-6f0a-486c-89d1-7211b4ca31bd?source=api-prod","affected":[{"type":"plugin","slug":"invoice-payment-for-woocommerce","name":"Link Invoice Payment for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-01-26T18:22:41Z","updated":"2026-01-27T06:44:14Z"},{"id":"wordfence:96a9f567-6cf8-4988-bf8e-77eade71c5f6","source":"wordfence","cve":"CVE-2016-10998","title":"Ocim MP3 (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96a9f567-6cf8-4988-bf8e-77eade71c5f6?source=api-prod","affected":[{"type":"plugin","slug":"ocim-mp3","name":"Ocim MP3","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2016-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96ab5bb0-724c-434b-acc4-be8265b4838f","source":"wordfence","cve":"CVE-2023-25785","title":"WP Post Rating <= 2.4.6 - Missing Authorization to Vote Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96ab5bb0-724c-434b-acc4-be8265b4838f?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-comment-rating","name":"WP Post Rating","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96ad872f-9831-4113-99ae-322bcd2b6fbd","source":"wordfence","cve":"CVE-2024-11939","title":"Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96ad872f-9831-4113-99ae-322bcd2b6fbd?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T08:18:18Z"},{"id":"wordfence:96b168fc-b862-49b0-9b5d-b66639c989fb","source":"wordfence","cve":"CVE-2026-57331","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.4.8 - Authenticated (Performer+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b168fc-b862-49b0-9b5d-b66639c989fb?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.4.8","to_inclusive":true,"patched_in":"7.4.9"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:37:03Z"},{"id":"wordfence:96b58c2c-f292-4a48-bd1e-c33cf464c1ce","source":"wordfence","cve":"CVE-2021-42361","title":"Contact Form Email <= 1.3.24 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b58c2c-f292-4a48-bd1e-c33cf464c1ce?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.24","to_inclusive":true,"patched_in":"1.3.25"}],"published":"2021-11-11T14:20:00Z","updated":"2026-07-29T20:59:15Z"},{"id":"wordfence:96b5a1d3-57f7-46da-919d-b4344421bf94","source":"wordfence","cve":"CVE-2025-69403","title":"Bravis Addons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b5a1d3-57f7-46da-919d-b4344421bf94?source=api-prod","affected":[{"type":"plugin","slug":"bravis-addons","name":"Bravis Addons","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T13:37:12Z"},{"id":"wordfence:96b68824-3080-4959-a7d7-43d29c5c4119","source":"wordfence","cve":"CVE-2021-24786","title":"Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b68824-3080-4959-a7d7-43d29c5c4119?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":false,"patched_in":"4.4.5"}],"published":"2021-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96b6ac2c-a732-4d9a-9060-922ca482d1b2","source":"wordfence","cve":"CVE-2024-10149","title":"Social Slider Feed <= 2.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b6ac2c-a732-4d9a-9060-922ca482d1b2?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-02-25T00:00:00Z","updated":"2026-09-04T00:51:23Z"},{"id":"wordfence:96b8186c-dfe9-4137-b28d-cc09a25aa9ac","source":"wordfence","cve":"CVE-2025-3852","title":"WPshop 2 \u2013 E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96b8186c-dfe9-4137-b28d-cc09a25aa9ac?source=api-prod","affected":[{"type":"plugin","slug":"wpshop","name":"WPshop 2 \u2013 E-Commerce","from":"2.0.0","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-05-06T13:34:23Z","updated":"2025-07-25T19:49:29Z"},{"id":"wordfence:96bc0d9b-1f03-48d4-aa99-954e92e77c04","source":"wordfence","cve":"","title":"Cyclone Slider <= 3.2.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96bc0d9b-1f03-48d4-aa99-954e92e77c04?source=api-prod","affected":[{"type":"plugin","slug":"cyclone-slider","name":"Cyclone Slider","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96bc27f3-6aa4-4119-9978-5e9dee5f1796","source":"wordfence","cve":"CVE-2023-6155","title":"Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96bc27f3-6aa4-4119-9978-5e9dee5f1796?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.4.9.4","to_inclusive":true,"patched_in":"6.4.9.5"}],"published":"2023-11-30T00:00:00Z","updated":"2024-02-06T14:42:46Z"},{"id":"wordfence:96bd997f-63d5-47a7-b433-486c1113b44b","source":"wordfence","cve":"CVE-2025-12877","title":"IDonate \u2013 Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96bd997f-63d5-47a7-b433-486c1113b44b?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2025-11-21T19:24:57Z","updated":"2025-12-11T15:56:31Z"},{"id":"wordfence:96bdd465-e4ca-4a32-b38a-a2a51598a3a9","source":"wordfence","cve":"CVE-2024-1465","title":"Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96bdd465-e4ca-4a32-b38a-a2a51598a3a9?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:07Z"},{"id":"wordfence:96c5836f-6d33-4a56-b30b-5e5d95b81b6b","source":"wordfence","cve":"CVE-2024-11327","title":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96c5836f-6d33-4a56-b30b-5e5d95b81b6b?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-11T02:20:54Z"},{"id":"wordfence:96c77102-3293-476c-93bd-5bbbe39f3a5e","source":"wordfence","cve":"CVE-2026-52693","title":"eCommerce Product Catalog Plugin for WordPress <= 3.5.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96c77102-3293-476c-93bd-5bbbe39f3a5e?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2026-06-09T00:00:00Z","updated":"2026-06-15T19:22:25Z"},{"id":"wordfence:96c80d8a-aecc-4f0a-a337-84c97386e24b","source":"wordfence","cve":"CVE-2026-67187","title":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated CSV Injection","severity":"medium","cvss":5.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96c80d8a-aecc-4f0a-a337-84c97386e24b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-04T22:18:59Z"},{"id":"wordfence:96ca4f34-e4f4-4e38-b963-82bfe69b9687","source":"wordfence","cve":"CVE-2026-95527","title":"Conekta Payment Gateway <= 6.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96ca4f34-e4f4-4e38-b963-82bfe69b9687?source=api-prod","affected":[{"type":"plugin","slug":"conekta-payment-gateway","name":"Conekta Payment Gateway","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2026-09-23T11:48:51Z","updated":"2026-09-29T19:53:11Z"},{"id":"wordfence:96cb9096-f3bd-4fe2-affb-ca8c69af14f1","source":"wordfence","cve":"CVE-2025-25075","title":"Show notice or message on admin area <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96cb9096-f3bd-4fe2-affb-ca8c69af14f1?source=api-prod","affected":[{"type":"plugin","slug":"show-notice-or-message-on-admin-area","name":"Show notice or message on admin area","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:28:43Z"},{"id":"wordfence:96cd6027-e8c5-4efa-ac02-14a1c086caff","source":"wordfence","cve":"CVE-2026-39800","title":"Additional Order Filters for WooCommerce <= 1.24 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96cd6027-e8c5-4efa-ac02-14a1c086caff?source=api-prod","affected":[{"type":"plugin","slug":"additional-order-filters-for-woocommerce","name":"Additional Order Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:30:12Z"},{"id":"wordfence:96cdba03-7385-4374-915d-061be0276a95","source":"wordfence","cve":"CVE-2026-6455","title":"WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96cdba03-7385-4374-915d-061be0276a95?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form-7-db-handler","name":"WP Contact Form 7 DB Handler","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-05-27T18:05:02Z","updated":"2026-05-28T06:45:41Z"},{"id":"wordfence:96cec16e-7bb3-4279-8c17-eca88d413ad8","source":"wordfence","cve":"CVE-2024-13523","title":"MemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96cec16e-7bb3-4279-8c17-eca88d413ad8?source=api-prod","affected":[{"type":"plugin","slug":"memorialday","name":"MemorialDay","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-02-17T17:31:51Z","updated":"2025-02-18T07:02:26Z"},{"id":"wordfence:96cfd09d-2238-43aa-917c-94f418cc91ce","source":"wordfence","cve":"CVE-2025-30542","title":"SoundCloud Ultimate <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96cfd09d-2238-43aa-917c-94f418cc91ce?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-ultimate","name":"SoundCloud Ultimate Plugin","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:23:42Z"},{"id":"wordfence:96d03984-623a-44c7-a46f-e1aabbc566d5","source":"wordfence","cve":"CVE-2026-10100","title":"Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d03984-623a-44c7-a46f-e1aabbc566d5?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-login-page","name":"Simple Custom Login Page","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-06-01T13:00:11Z","updated":"2026-06-03T06:16:40Z"},{"id":"wordfence:96d1d456-a96f-4566-8d5e-6c8aff74137d","source":"wordfence","cve":"CVE-2026-89080","title":"Really Simple Security <= 9.8.0 -  Unauthenticated Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d1d456-a96f-4566-8d5e-6c8aff74137d?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T18:31:48Z"},{"id":"wordfence:96d264fe-e7e1-4eec-b235-9d288bc5a22f","source":"wordfence","cve":"CVE-2020-36715","title":"Login/Signup Popup < 1.5 - Missing Authorization","severity":"high","cvss":7.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d264fe-e7e1-4eec-b235-9d288bc5a22f?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2020-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96d48392-fb64-4e5e-be9c-21df0bf75de6","source":"wordfence","cve":"CVE-2025-12392","title":"Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d48392-fb64-4e5e-be9c-21df0bf75de6?source=api-prod","affected":[{"type":"plugin","slug":"triplea-cryptocurrency-payment-gateway-for-woocommerce","name":"Cryptocurrency Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.25","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2025-11-17T20:53:28Z","updated":"2026-02-03T19:26:09Z"},{"id":"wordfence:96d5bfeb-b082-44cc-8d84-1ef1c3f5b562","source":"wordfence","cve":"CVE-2022-0208","title":"MapPress Maps <= 2.73.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d5bfeb-b082-44cc-8d84-1ef1c3f5b562?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.73.4","to_inclusive":false,"patched_in":"2.73.4"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96d8da55-0706-42b6-8423-260f6138387d","source":"wordfence","cve":"CVE-2026-9289","title":"WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96d8da55-0706-42b6-8423-260f6138387d?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.54.10","to_inclusive":true,"patched_in":"3.54.14"}],"published":"2026-09-18T19:56:54Z","updated":"2026-09-19T08:27:22Z"},{"id":"wordfence:96dadf30-a66f-476c-8baf-d6e21a76185a","source":"wordfence","cve":"CVE-2026-57407","title":"PDF Generator for WordPress <= 1.6.2 - Authenticated (Subscriber+) Server-side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96dadf30-a66f-476c-8baf-d6e21a76185a?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-for-wp","name":"PDF Generator for WordPress","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:15:27Z"},{"id":"wordfence:96dbf90d-2db9-4bfd-8110-dbe322a690bc","source":"wordfence","cve":"CVE-2024-37541","title":"Elementor Addons, Widgets and Enhancements \u2013 Stax <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96dbf90d-2db9-4bfd-8110-dbe322a690bc?source=api-prod","affected":[{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-07-06T00:00:00Z","updated":"2026-04-15T20:35:23Z"},{"id":"wordfence:96deac16-cb64-4246-b8d0-05a020142f1d","source":"wordfence","cve":"CVE-2024-32432","title":"Ovic Addon Toolkit <= 2.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96deac16-cb64-4246-b8d0-05a020142f1d?source=api-prod","affected":[{"type":"plugin","slug":"ovic-addon-toolkit","name":"Ovic Addon Toolkit","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:38:57Z"},{"id":"wordfence:96defcb7-6af1-4fb8-9fa0-231c6776bbc1","source":"wordfence","cve":"CVE-2023-44145","title":"Anchor Episodes Index (Spotify for Podcasters) <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96defcb7-6af1-4fb8-9fa0-231c6776bbc1?source=api-prod","affected":[{"type":"plugin","slug":"anchor-episodes-index","name":"Anchor Episodes Index (Spotify for Podcasters)","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96dfba93-6e63-4d6d-982d-8aa6d77346a6","source":"wordfence","cve":"CVE-2025-62145","title":"DMCA Protection Badge <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96dfba93-6e63-4d6d-982d-8aa6d77346a6?source=api-prod","affected":[{"type":"plugin","slug":"dmca-badge","name":"DMCA Website Protection Badge","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-08-14T15:16:24Z"},{"id":"wordfence:96e12fa5-eba4-4f69-ae3a-7e460bfa9e5d","source":"wordfence","cve":"CVE-2024-10790","title":"Admin and Site Enhancements (ASE) <= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96e12fa5-eba4-4f69-ae3a-7e460bfa9e5d?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2024-11-11T16:57:04Z","updated":"2024-11-12T05:31:08Z"},{"id":"wordfence:96e2ba3d-4e6d-42b8-832c-03ef4915cadb","source":"wordfence","cve":"CVE-2008-0491","title":"fGallery 2.4.1 - SQL injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96e2ba3d-4e6d-42b8-832c-03ef4915cadb?source=api-prod","affected":[{"type":"plugin","slug":"fgallery","name":"fgallery","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2008-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96e47918-7848-407a-8f77-dbbfeb17029d","source":"wordfence","cve":"CVE-2024-11342","title":"Skt NURCaptcha <= 3.5.0 - Cross-Site Request Forgery  to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96e47918-7848-407a-8f77-dbbfeb17029d?source=api-prod","affected":[{"type":"plugin","slug":"skt-nurcaptcha","name":"Skt NURCaptcha","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T03:36:25Z"},{"id":"wordfence:96e86515-5786-4652-b65e-f4c9b009c598","source":"wordfence","cve":"CVE-2025-32204","title":"Split Test For Elementor <= 1.8.3 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96e86515-5786-4652-b65e-f4c9b009c598?source=api-prod","affected":[{"type":"plugin","slug":"split-test-for-elementor","name":"Split Test For Elementor","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2025-04-04T00:00:00Z","updated":"2026-03-17T21:21:25Z"},{"id":"wordfence:96e9af3e-d745-4aec-a4ba-958dc8ee9610","source":"wordfence","cve":"CVE-2026-125777","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96e9af3e-d745-4aec-a4ba-958dc8ee9610?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:53Z"},{"id":"wordfence:96eba67c-58e7-4eea-84d4-9b3bb275b42d","source":"wordfence","cve":"CVE-2024-4335","title":"Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96eba67c-58e7-4eea-84d4-9b3bb275b42d?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.217","to_inclusive":true,"patched_in":"1.0.218"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:33Z"},{"id":"wordfence:96ebf817-14b6-43c9-b2a0-02feb6258c3a","source":"wordfence","cve":"CVE-2026-112823","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96ebf817-14b6-43c9-b2a0-02feb6258c3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.25","to_inclusive":true,"patched_in":"2.9.26"}],"published":"2026-10-20T15:14:00Z","updated":"2026-10-23T18:51:18Z"},{"id":"wordfence:96ef8459-1600-4ca0-93c6-0ee42f8adabd","source":"wordfence","cve":"CVE-2026-7462","title":"VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96ef8459-1600-4ca0-93c6-0ee42f8adabd?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms-vatansms-com","name":"VatanSMS WP SMS","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:06:06Z","updated":"2026-05-20T01:25:50Z"},{"id":"wordfence:96f08ba8-102e-425e-b3e6-21e689682a24","source":"wordfence","cve":"CVE-2025-23518","title":"GoogleMapper <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f08ba8-102e-425e-b3e6-21e689682a24?source=api-prod","affected":[{"type":"plugin","slug":"googlemapper-2","name":"GoogleMapper","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:27:56Z"},{"id":"wordfence:96f149a9-cf2e-49b7-8a5f-e87d3e5209ca","source":"wordfence","cve":"CVE-2024-43221","title":"JetGridBuilder <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f149a9-cf2e-49b7-8a5f-e87d3e5209ca?source=api-prod","affected":[{"type":"plugin","slug":"jetgridbuilder","name":"JetGridBuilder \u2014 Grid Builder for Elementor and Gutenberg","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:26:52Z"},{"id":"wordfence:96f1bb31-5723-4de3-a063-49099c8c1b8d","source":"wordfence","cve":"CVE-2025-69359","title":"Creator LMS <= 1.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f1bb31-5723-4de3-a063-49099c8c1b8d?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-14T14:56:27Z"},{"id":"wordfence:96f1ede7-ec36-4edf-baee-5e41907290af","source":"wordfence","cve":"","title":"Gwolle Guestbook <= 2.1.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f1ede7-ec36-4edf-baee-5e41907290af?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96f2207a-6921-4868-8412-79da22c9acec","source":"wordfence","cve":"CVE-2026-81783","title":"MailMunch \u2013 Grow your Email List <= 3.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f2207a-6921-4868-8412-79da22c9acec?source=api-prod","affected":[{"type":"plugin","slug":"mailmunch","name":"MailMunch \u2013 Grow your Email List","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-09-08T00:00:00Z","updated":"2026-10-13T17:00:34Z"},{"id":"wordfence:96f30a22-f218-48e7-9796-b9f1d5becc2c","source":"wordfence","cve":"CVE-2023-49190","title":"Site Offline <= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f30a22-f218-48e7-9796-b9f1d5becc2c?source=api-prod","affected":[{"type":"plugin","slug":"site-offline","name":"Site Offline Or Coming Soon Or Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2023-11-29T00:00:00Z","updated":"2024-03-29T16:23:36Z"},{"id":"wordfence:96f63469-d05d-4c7a-8fc6-165c361a7c82","source":"wordfence","cve":"CVE-2024-11871","title":"Social Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f63469-d05d-4c7a-8fc6-165c361a7c82?source=api-prod","affected":[{"type":"plugin","slug":"social-media-shortcodes","name":"Social Media Shortcodes","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:23Z"},{"id":"wordfence:96f77fdc-4e91-43c0-8bc6-7bb202945c7d","source":"wordfence","cve":"CVE-2025-15527","title":"WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f77fdc-4e91-43c0-8bc6-7bb202945c7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":"10.2.3"}],"published":"2025-12-11T20:23:48Z","updated":"2026-02-06T20:30:40Z"},{"id":"wordfence:96f9c5b3-43b7-46e0-aa0c-a5179a99096b","source":"wordfence","cve":"CVE-2011-4671","title":"AdRotate \u2013 Ad manager & AdSense Ads < 3.6.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96f9c5b3-43b7-46e0-aa0c-a5179a99096b?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":false,"patched_in":"3.6.8"}],"published":"2011-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96fa9ed7-6c13-4356-8a25-8a309be2b0e9","source":"wordfence","cve":"CVE-2024-6757","title":"Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96fa9ed7-6c13-4356-8a25-8a309be2b0e9?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.24.5","to_inclusive":true,"patched_in":"3.24.6"}],"published":"2024-10-14T12:07:14Z","updated":"2024-10-15T02:03:52Z"},{"id":"wordfence:96fb8398-d566-439c-8ed0-78e71276b577","source":"wordfence","cve":"CVE-2024-29912","title":"iCalendrier <= 1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96fb8398-d566-439c-8ed0-78e71276b577?source=api-prod","affected":[{"type":"plugin","slug":"icalendrier","name":"iCalendrier","from":"*","from_inclusive":true,"to":"1.80","to_inclusive":true,"patched_in":"1.81"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:03:07Z"},{"id":"wordfence:96fc3ead-7ae4-4d2c-a0b5-13f3e3bf429b","source":"wordfence","cve":"CVE-2013-5673","title":"Testimonial < 2.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96fc3ead-7ae4-4d2c-a0b5-13f3e3bf429b?source=api-prod","affected":[{"type":"plugin","slug":"indianic-testimonial","name":"Testimonial","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2013-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:96fd3647-e006-430e-8252-6bd79263e02a","source":"wordfence","cve":"CVE-2026-5725","title":"Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/96fd3647-e006-430e-8252-6bd79263e02a?source=api-prod","affected":[{"type":"plugin","slug":"favicon-rotator","name":"Favicon Rotator","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2026-10-09T17:50:38Z","updated":"2026-10-10T06:40:13Z"},{"id":"wordfence:9700a21e-19cb-4ba9-8bc1-3fb11187152c","source":"wordfence","cve":"CVE-2025-6200","title":"GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9700a21e-19cb-4ba9-8bc1-3fb11187152c?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.119","to_inclusive":true,"patched_in":"2.8.120"}],"published":"2025-06-20T00:00:00Z","updated":"2025-07-25T14:48:39Z"},{"id":"wordfence:9703fa76-fd73-4cd8-aa41-8adcb55190be","source":"wordfence","cve":"CVE-2026-94378","title":"SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9703fa76-fd73-4cd8-aa41-8adcb55190be?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2026-10-02T14:16:04Z","updated":"2026-10-03T02:25:35Z"},{"id":"wordfence:9704b633-5779-42a7-90d7-e532448f2e51","source":"wordfence","cve":"CVE-2017-18567","title":"Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9704b633-5779-42a7-90d7-e532448f2e51?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2017-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9705d293-ea89-46dc-95f5-15ff0f9c8d1e","source":"wordfence","cve":"CVE-2025-26902","title":"Brizy Pro <= 2.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9705d293-ea89-46dc-95f5-15ff0f9c8d1e?source=api-prod","affected":[{"type":"plugin","slug":"brizy-pro","name":"Brizy Pro","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-04-09T00:00:00Z","updated":"2026-04-15T13:29:08Z"},{"id":"wordfence:9707faea-ed46-4b7e-b4f5-a2aacdc70c80","source":"wordfence","cve":"CVE-2025-23451","title":"Awesome Twitter Feeds <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9707faea-ed46-4b7e-b4f5-a2aacdc70c80?source=api-prod","affected":[{"type":"plugin","slug":"awesome-twitter-feeds","name":"Awesome Twitter Feeds","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:44:35Z"},{"id":"wordfence:970826cf-316d-4fce-ac90-bf338c5ef3e4","source":"wordfence","cve":"CVE-2024-11784","title":"Sell Tickets Online \u2013 TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970826cf-316d-4fce-ac90-bf338c5ef3e4?source=api-prod","affected":[{"type":"plugin","slug":"ticketsource-events","name":"TicketSource Ticket Shop","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-12-19T18:05:41Z","updated":"2024-12-23T17:30:39Z"},{"id":"wordfence:97084759-a8fb-4b26-a6fa-93d005b1110e","source":"wordfence","cve":"CVE-2026-91092","title":"wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97084759-a8fb-4b26-a6fa-93d005b1110e?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-09-21T19:01:21Z","updated":"2026-09-22T07:41:13Z"},{"id":"wordfence:97097d41-1d78-4db0-8ee2-70a776bd99f2","source":"wordfence","cve":"CVE-2026-77183","title":"FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97097d41-1d78-4db0-8ee2-70a776bd99f2?source=api-prod","affected":[{"type":"plugin","slug":"foosales","name":"FooSales \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"1.43.0","to_inclusive":true,"patched_in":"1.43.1"}],"published":"2026-10-09T17:06:52Z","updated":"2026-10-10T05:31:03Z"},{"id":"wordfence:970a2868-fc9c-4e70-8766-f207c887bddf","source":"wordfence","cve":"CVE-2026-32333","title":"Mayosis Core <= 5.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970a2868-fc9c-4e70-8766-f207c887bddf?source=api-prod","affected":[{"type":"plugin","slug":"mayosis-core","name":"Mayosis Core","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-03T16:25:13Z"},{"id":"wordfence:970b3a0f-c1cc-4d85-8271-a523ccdbcc39","source":"wordfence","cve":"CVE-2023-41695","title":"Analytify Dashboard <= 5.1.0 - Missing Authorization to Opt-In","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970b3a0f-c1cc-4d85-8271-a523ccdbcc39?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":false,"patched_in":"5.1.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:970bc71c-7d0a-4761-874a-379cda71418e","source":"wordfence","cve":"CVE-2024-0978","title":"My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970bc71c-7d0a-4761-874a-379cda71418e?source=api-prod","affected":[{"type":"plugin","slug":"jonradio-private-site","name":"My Private Site \u2013 Make Your Whole Site Private, Force Login & Block Registration Spam","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-02-16T00:00:00Z","updated":"2024-02-20T18:56:37Z"},{"id":"wordfence:970c7495-e43c-4606-8154-e2ac7d1c4816","source":"wordfence","cve":"CVE-2024-54261","title":"TAX SERVICE Electronic HDM <= 1.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970c7495-e43c-4606-8154-e2ac7d1c4816?source=api-prod","affected":[{"type":"plugin","slug":"virtual-hdm-for-taxservice-am","name":"TAX SERVICE Electronic HDM","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-12-06T00:00:00Z","updated":"2025-11-11T14:51:39Z"},{"id":"wordfence:970fc0af-d049-4aad-a439-7d1ea6bcca9b","source":"wordfence","cve":"CVE-2026-57397","title":"Coaching <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/970fc0af-d049-4aad-a439-7d1ea6bcca9b?source=api-prod","affected":[{"type":"theme","slug":"coaching","name":"coaching","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:03:29Z"},{"id":"wordfence:97108ad1-c7b8-4050-ba0d-7a1fd4bdedb3","source":"wordfence","cve":"CVE-2021-24256","title":"Elementor Header & Footer Builder <= 1.5.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97108ad1-c7b8-4050-ba0d-7a1fd4bdedb3?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2021-04-13T00:00:00Z","updated":"2024-03-11T17:14:00Z"},{"id":"wordfence:9711efe5-dd9b-4451-9bc4-22c8a5095cd8","source":"wordfence","cve":"CVE-2025-48136","title":"Mortgage Calculator Estatik <= 2.0.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9711efe5-dd9b-4451-9bc4-22c8a5095cd8?source=api-prod","affected":[{"type":"plugin","slug":"estatik-mortgage-calculator","name":"Estatik Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-03-23T15:44:42Z"},{"id":"wordfence:9715d1b2-1d82-4f48-89c3-9a389ab31360","source":"wordfence","cve":"CVE-2024-34440","title":"AI Engine: ChatGPT Chatbot <= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9715d1b2-1d82-4f48-89c3-9a389ab31360?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.2.63","to_inclusive":true,"patched_in":"2.2.70"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:07:34Z"},{"id":"wordfence:97174ec0-a2b7-455e-9bf8-b6f51546beee","source":"wordfence","cve":"CVE-2024-8369","title":"EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97174ec0-a2b7-455e-9bf8-b6f51546beee?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.4.3","to_inclusive":true,"patched_in":"4.0.4.4"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T11:30:31Z"},{"id":"wordfence:9717e4aa-4294-4194-b2ab-3b0ec845a1ca","source":"wordfence","cve":"CVE-2015-9320","title":"Option Tree <= 2.5.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9717e4aa-4294-4194-b2ab-3b0ec845a1ca?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9719d083-cc7c-4655-a4c4-f5370cfe76e0","source":"wordfence","cve":"CVE-2023-41874","title":"Order Delivery Date for WooCommerce <= 3.20.0 - Reflected Cross-Site Scripting via 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9719d083-cc7c-4655-a4c4-f5370cfe76e0?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"3.20.0","to_inclusive":true,"patched_in":"3.20.1"}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:971d06e2-29dc-424d-b20e-8ec34990014d","source":"wordfence","cve":"","title":"Ambience (Unspecified Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/971d06e2-29dc-424d-b20e-8ec34990014d?source=api-prod","affected":[{"type":"theme","slug":"ambience","name":"Ambience","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:971d40d2-428f-49d9-8918-89843980f177","source":"wordfence","cve":"CVE-2024-6924","title":"TrueBooker <= 1.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/971d40d2-428f-49d9-8918-89843980f177?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-08-10T00:00:00Z","updated":"2024-09-24T13:36:13Z"},{"id":"wordfence:97200206-e43d-403e-8aa1-4f11422385c6","source":"wordfence","cve":"CVE-2026-109974","title":"All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97200206-e43d-403e-8aa1-4f11422385c6?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-27T14:26:21Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:97204be9-f5a0-45b4-843e-139a545f3e54","source":"wordfence","cve":"CVE-2026-104675","title":"Event Tickets and Registration <= 5.30.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97204be9-f5a0-45b4-843e-139a545f3e54?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.0","to_inclusive":true,"patched_in":"5.30.0.1"}],"published":"2026-10-05T08:50:00Z","updated":"2026-10-08T23:27:33Z"},{"id":"wordfence:97215367-08c0-46cc-a595-4475274a5a1c","source":"wordfence","cve":"CVE-2026-116761","title":"CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97215367-08c0-46cc-a595-4475274a5a1c?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2026-10-27T18:41:44Z","updated":"2026-10-28T06:45:17Z"},{"id":"wordfence:97215c69-e371-48b6-9282-6241f9b187c8","source":"wordfence","cve":"CVE-2025-26745","title":"RS Elements Elementor Addon <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97215c69-e371-48b6-9282-6241f9b187c8?source=api-prod","affected":[{"type":"plugin","slug":"rselements-lite","name":"RS Elements Elementor Addon","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:35:29Z"},{"id":"wordfence:9726b59e-4826-4253-889c-686763ad3689","source":"wordfence","cve":"CVE-2024-37467","title":"Hestia <= 3.1.2 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9726b59e-4826-4253-889c-686763ad3689?source=api-prod","affected":[{"type":"theme","slug":"hestia","name":"Hestia","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T14:55:24Z"},{"id":"wordfence:97291fdf-ca78-4588-ba38-b021654a168f","source":"wordfence","cve":"CVE-2025-46508","title":"Advanced lazy load <=  1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97291fdf-ca78-4588-ba38-b021654a168f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-lazy-load","name":"Advanced lazy load","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:48:52Z"},{"id":"wordfence:9729ccc9-e3f1-4096-8430-22998b386cec","source":"wordfence","cve":"CVE-2024-3639","title":"Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9729ccc9-e3f1-4096-8430-22998b386cec?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.4"}],"published":"2024-07-03T00:00:00Z","updated":"2024-07-19T15:44:48Z"},{"id":"wordfence:9729ebf5-ef78-4ef4-81d4-165f422c3847","source":"wordfence","cve":"","title":"FV Flowplayer Video Player <= 7.3.14.727 - Unauthenticated SQL Injection","severity":"critical","cvss":9.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9729ebf5-ef78-4ef4-81d4-165f422c3847?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.15.727","to_inclusive":false,"patched_in":"7.3.15.727"}],"published":"2019-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:972be091-64c4-4cb7-9563-70249c0db157","source":"wordfence","cve":"CVE-2024-11911","title":"WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/972be091-64c4-4cb7-9563-70249c0db157?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2024-12-12T20:17:29Z","updated":"2024-12-13T08:24:50Z"},{"id":"wordfence:972ce9b3-93f6-449d-8d3e-79cfaffa082d","source":"wordfence","cve":"CVE-2025-62154","title":"AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/972ce9b3-93f6-449d-8d3e-79cfaffa082d?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-writing-assistant","name":"AI Content Writing Assistant","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:32:35Z"},{"id":"wordfence:972fba75-8230-4991-a697-34ab850ddee5","source":"wordfence","cve":"CVE-2022-41640","title":"Wholesale Suite <= 2.1.5 - Authenticated (Subscriber+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/972fba75-8230-4991-a697-34ab850ddee5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.5.1"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97312cf2-dcff-466f-a27c-25686216ed04","source":"wordfence","cve":"CVE-2024-32090","title":"Church Admin <= 4.0.27 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97312cf2-dcff-466f-a27c-25686216ed04?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"4.0.28"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:15:54Z"},{"id":"wordfence:9731a6bc-18f4-42cc-862b-f098251228ef","source":"wordfence","cve":"CVE-2025-47609","title":"EasyMe Connect <= 3.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9731a6bc-18f4-42cc-862b-f098251228ef?source=api-prod","affected":[{"type":"plugin","slug":"easyme-connect","name":"EasyMe Connect","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-05-07T00:00:00Z","updated":"2026-05-26T19:14:52Z"},{"id":"wordfence:97344674-15df-45e6-9906-f21a9920a6e1","source":"wordfence","cve":"CVE-2023-47663","title":"Foyer <= 1.7.5 - Content Injection via Improper Access Control","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97344674-15df-45e6-9906-f21a9920a6e1?source=api-prod","affected":[{"type":"plugin","slug":"foyer","name":"Foyer \u2013 Digital Signage for WordPress","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9734a4e0-04f9-478e-9bb9-5127671bf8f6","source":"wordfence","cve":"CVE-2026-32834","title":"Easy PayPal Events & Tickets <= 1.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9734a4e0-04f9-478e-9bb9-5127671bf8f6?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-events-tickets","name":"Easy PayPal Events & Tickets","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-06-04T00:00:00Z","updated":"2026-07-30T12:41:06Z"},{"id":"wordfence:97396207-4892-4d1a-8740-3000484f1317","source":"wordfence","cve":"CVE-2021-24601","title":"WPFront Notification Bar <= 2.0.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97396207-4892-4d1a-8740-3000484f1317?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-notification-bar","name":"WPFront Notification Bar","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:973b23c6-4edd-4f89-b5cf-68e83cfdb8ac","source":"wordfence","cve":"CVE-2026-15797","title":"Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/973b23c6-4edd-4f89-b5cf-68e83cfdb8ac?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2026-09-17T20:49:14Z","updated":"2026-09-18T14:20:26Z"},{"id":"wordfence:973ebafc-85c0-4cc5-b307-2fdb0a4a7577","source":"wordfence","cve":"CVE-2026-1239","title":"Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2026-06-30T17:19:54Z","updated":"2026-07-01T05:35:30Z"},{"id":"wordfence:974091fa-0327-49c3-8834-e59772c310e2","source":"wordfence","cve":"CVE-2025-57952","title":"Maps for WP <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974091fa-0327-49c3-8834-e59772c310e2?source=api-prod","affected":[{"type":"plugin","slug":"maps-for-wp","name":"Maps for WP","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:59:39Z"},{"id":"wordfence:9740ac09-a366-400d-ae0d-20681e1aba34","source":"wordfence","cve":"CVE-2026-15239","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.41.0 - Unauthenticated CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9740ac09-a366-400d-ae0d-20681e1aba34?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.41.0","to_inclusive":true,"patched_in":"1.42.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-17T15:45:07Z"},{"id":"wordfence:97411fd3-72c0-4715-be1c-c01e8744d278","source":"wordfence","cve":"CVE-2025-23827","title":"Strx Magic Floating Sidebar Maker <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97411fd3-72c0-4715-be1c-c01e8744d278?source=api-prod","affected":[{"type":"plugin","slug":"strx-magic-floating-sidebar-maker","name":"Strx Magic Floating Sidebar Maker","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:44:44Z"},{"id":"wordfence:97416640-c076-4f5e-9119-adbca2fcc495","source":"wordfence","cve":"CVE-2015-1000009","title":"Google Adsense and Hotel Booking <= 1.05 - Open Proxy","severity":"critical","cvss":9.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97416640-c076-4f5e-9119-adbca2fcc495?source=api-prod","affected":[{"type":"plugin","slug":"google-adsense-and-hotel-booking","name":"google-adsense-and-hotel-booking","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2015-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9742a4d0-34b0-4f7f-aa2b-a6f7cb6aacd4","source":"wordfence","cve":"CVE-2018-10233","title":"Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9742a4d0-34b0-4f7f-aa2b-a6f7cb6aacd4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2018-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9744055a-b199-4945-afcc-4f5b85f5f1e8","source":"wordfence","cve":"CVE-2026-6229","title":"Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9744055a-b199-4945-afcc-4f5b85f5f1e8?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1057","to_inclusive":true,"patched_in":"1.7.1058"}],"published":"2026-05-01T00:00:00Z","updated":"2026-08-17T23:43:20Z"},{"id":"wordfence:97460a9c-e996-4170-afa3-47db9097f3f4","source":"wordfence","cve":"CVE-2022-2942","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.9 - Cross-Site Request Forgery to Settings update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97460a9c-e996-4170-afa3-47db9097f3f4?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97465c19-4d32-4e0f-ba71-fd03fb6b9e15","source":"wordfence","cve":"CVE-2026-115952","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.58.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97465c19-4d32-4e0f-ba71-fd03fb6b9e15?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.3","to_inclusive":true,"patched_in":"1.58.4"}],"published":"2026-11-04T12:10:48Z","updated":"2026-11-10T19:19:28Z"},{"id":"wordfence:9746cd9f-afb2-41b2-9e31-7c77222d9cfd","source":"wordfence","cve":"CVE-2024-1164","title":"Brizy \u2013 Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9746cd9f-afb2-41b2-9e31-7c77222d9cfd?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.43","to_inclusive":true,"patched_in":"2.4.44"}],"published":"2024-06-04T17:42:40Z","updated":"2024-06-05T06:50:29Z"},{"id":"wordfence:974a3228-5eab-41be-b3c1-82e71cde8de7","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974a3228-5eab-41be-b3c1-82e71cde8de7?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:03:59Z"},{"id":"wordfence:974b3894-f4e2-49c7-ba92-eaa5be0b4298","source":"wordfence","cve":"CVE-2015-3998","title":"Adsense Click Fraud Monitoring <= 1.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974b3894-f4e2-49c7-ba92-eaa5be0b4298?source=api-prod","affected":[{"type":"plugin","slug":"adsense-click-fraud-monitoring","name":"Google AdSense Click-Fraud Monitoring Plugin","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""}],"published":"2015-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:974b9211-04e4-4309-8a7b-aeccc5b55ce7","source":"wordfence","cve":"CVE-2015-9400","title":"WordPress Meta Robots <= 2.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974b9211-04e4-4309-8a7b-aeccc5b55ce7?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-meta-robots","name":"WordPress Meta Robots","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:974c0e94-8d09-488a-9a09-49f0b9ce112c","source":"wordfence","cve":"CVE-2024-1295","title":"The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974c0e94-8d09-488a-9a09-49f0b9ce112c?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.0.1"},{"type":"plugin","slug":"events-calendar-pro","name":"The Events Calendar Pro","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.0.1"}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:44:34Z"},{"id":"wordfence:974f14e8-1a59-4ba5-8806-b4d8b135315e","source":"wordfence","cve":"CVE-2023-0603","title":"Sloth Logo Customizer <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974f14e8-1a59-4ba5-8806-b4d8b135315e?source=api-prod","affected":[{"type":"plugin","slug":"sloth-logo-customizer","name":"Sloth Logo Customizer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:974f6e3f-9d47-4753-a826-261d5b71651c","source":"wordfence","cve":"CVE-2025-50037","title":"Buying Buddy IDX CRM <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974f6e3f-9d47-4753-a826-261d5b71651c?source=api-prod","affected":[{"type":"plugin","slug":"buying-buddy-idx-crm","name":"Buying Buddy IDX CRM \u2013 Real Estate MLS Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-10T14:16:46Z"},{"id":"wordfence:974ffc87-369a-431e-b601-8c6679d963c3","source":"wordfence","cve":"CVE-2024-13715","title":"zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/974ffc87-369a-431e-b601-8c6679d963c3?source=api-prod","affected":[{"type":"plugin","slug":"zstore-manager-basic","name":"zStore Manager Basic","from":"*","from_inclusive":true,"to":"3.311","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:40:24Z","updated":"2025-01-30T13:42:05Z"},{"id":"wordfence:9751da30-abc7-466d-8990-4eefe65cb878","source":"wordfence","cve":"CVE-2024-56245","title":"Premium Blocks \u2013 Gutenberg Blocks for WordPress <= 2.1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9751da30-abc7-466d-8990-4eefe65cb878?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.1.42","to_inclusive":true,"patched_in":"2.1.43"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:18:53Z"},{"id":"wordfence:975293a1-7b69-4e10-93a3-74c00562c758","source":"wordfence","cve":"","title":"Shared Counts \u2013 Social Media Share Buttons <= 1.4.1 - Missing Authorization to Arbitrary Email Sending","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975293a1-7b69-4e10-93a3-74c00562c758?source=api-prod","affected":[{"type":"plugin","slug":"shared-counts","name":"Shared Counts \u2013 Social Media Share Buttons","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-07T10:46:18Z"},{"id":"wordfence:975487bf-5e62-47e7-8112-5cd91f9c9483","source":"wordfence","cve":"CVE-2024-37435","title":"Perfect Portfolio <= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975487bf-5e62-47e7-8112-5cd91f9c9483?source=api-prod","affected":[{"type":"theme","slug":"perfect-portfolio","name":"Perfect Portfolio","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:56:27Z"},{"id":"wordfence:97548879-f015-4adc-8a84-535d210ae0de","source":"wordfence","cve":"CVE-2023-47685","title":"Preloader Matrix <= 2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97548879-f015-4adc-8a84-535d210ae0de?source=api-prod","affected":[{"type":"plugin","slug":"matrix-pre-loader","name":"Preloader Matrix","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9754bdc9-5638-4227-87ee-3bda34d10e01","source":"wordfence","cve":"CVE-2025-49302","title":"Easy Stripe <= 1.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9754bdc9-5638-4227-87ee-3bda34d10e01?source=api-prod","affected":[{"type":"plugin","slug":"easy-stripe","name":"Easy Stripe \u2013 Tips, Payments, and Donations","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:08:30Z"},{"id":"wordfence:97553155-c425-4ea1-964a-b5df4263161b","source":"wordfence","cve":"CVE-2025-4302","title":"Stop User Enumeration <= 1.7.2 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97553155-c425-4ea1-964a-b5df4263161b?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-25T13:48:44Z"},{"id":"wordfence:9755323f-42bd-491d-8d82-b1905eed0d9b","source":"wordfence","cve":"CVE-2024-27988","title":"WEN Responsive Columns <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9755323f-42bd-491d-8d82-b1905eed0d9b?source=api-prod","affected":[{"type":"plugin","slug":"wen-responsive-columns","name":"WEN Responsive Columns","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T21:00:47Z"},{"id":"wordfence:9755e5d4-dbf6-4778-84d6-cc967e8afb48","source":"wordfence","cve":"CVE-2024-13721","title":"Plethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor","severity":"medium","cvss":6.4,"cwe":"CWE-85","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9755e5d4-dbf6-4778-84d6-cc967e8afb48?source=api-prod","affected":[{"type":"plugin","slug":"plethora-tabs-accordions","name":"Plethora Tabs + Accordions","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-24T16:27:02Z","updated":"2025-01-25T05:30:07Z"},{"id":"wordfence:9757afd0-0c03-491d-85c7-a661d4c42264","source":"wordfence","cve":"CVE-2025-48324","title":"tli.tl auto Twitter poster <= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9757afd0-0c03-491d-85c7-a661d4c42264?source=api-prod","affected":[{"type":"plugin","slug":"tlitl-auto-twitter-poster","name":"tli.tl auto Twitter poster","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:08:12Z"},{"id":"wordfence:9758a59c-4370-4b26-b32a-004565f28d76","source":"wordfence","cve":"CVE-2017-16949","title":"AccessPress Anonymous Post Pro <= 3.1.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9758a59c-4370-4b26-b32a-004565f28d76?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-anonymous-post-pro","name":"accesspress-anonymous-post-pro","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9759e1f0-e134-4c7f-88aa-63dbae7067f1","source":"wordfence","cve":"CVE-2024-28004","title":"Colibri Page Builder <= 1.0.248 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9759e1f0-e134-4c7f-88aa-63dbae7067f1?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.248","to_inclusive":true,"patched_in":"1.0.249"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:19:28Z"},{"id":"wordfence:975c02d9-3e70-4e58-a6bb-57d45282459b","source":"wordfence","cve":"CVE-2026-32544","title":"OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.62 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975c02d9-3e70-4e58-a6bb-57d45282459b?source=api-prod","affected":[{"type":"plugin","slug":"oopspam-anti-spam","name":"oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)","from":"*","from_inclusive":true,"to":"1.2.62","to_inclusive":true,"patched_in":"1.2.63"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:48:20Z"},{"id":"wordfence:975ddadd-12f8-4ace-9c1a-489114a2da6a","source":"wordfence","cve":"CVE-2024-12410","title":"Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975ddadd-12f8-4ace-9c1a-489114a2da6a?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.32","to_inclusive":true,"patched_in":"3.2.33"}],"published":"2025-04-01T20:34:20Z","updated":"2025-11-05T21:23:46Z"},{"id":"wordfence:975e760f-c099-414b-9179-6f2a1f1358b5","source":"wordfence","cve":"CVE-2024-35676","title":"Recurring PayPal Donations <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975e760f-c099-414b-9179-6f2a1f1358b5?source=api-prod","affected":[{"type":"plugin","slug":"recurring-donation","name":"Recurring PayPal Donations","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-13T13:57:08Z"},{"id":"wordfence:975f7c66-033d-47b2-9e7a-b33b8fe06b17","source":"wordfence","cve":"CVE-2025-63062","title":"UDesign Core <= 4.14.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/975f7c66-033d-47b2-9e7a-b33b8fe06b17?source=api-prod","affected":[{"type":"plugin","slug":"u-design-core","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-15T00:00:00Z","updated":"2025-12-11T16:31:20Z"},{"id":"wordfence:9760bf39-6ec3-416e-95f0-3b3ce3ecdf7f","source":"wordfence","cve":"CVE-2026-116617","title":"Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9760bf39-6ec3-416e-95f0-3b3ce3ecdf7f?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.128","to_inclusive":true,"patched_in":"1.4.129"}],"published":"2026-11-04T16:08:21Z","updated":"2026-11-05T04:48:07Z"},{"id":"wordfence:97628ee2-f7d9-4be5-8230-c38e531d1974","source":"wordfence","cve":"CVE-2016-20066","title":"Polls CP <= 1.0.8 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97628ee2-f7d9-4be5-8230-c38e531d1974?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-17T04:04:51Z"},{"id":"wordfence:9764d402-b8a2-43d5-882a-bc3886078b7f","source":"wordfence","cve":"CVE-2023-4019","title":"Media from FTP <= 11.16 - Authenticated (Author+) Improper Privilege Management","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9764d402-b8a2-43d5-882a-bc3886078b7f?source=api-prod","affected":[{"type":"plugin","slug":"media-from-ftp","name":"Media from FTP","from":"*","from_inclusive":true,"to":"11.16","to_inclusive":true,"patched_in":"11.17"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97666e54-8e86-4f18-ae32-ad8ca607aeff","source":"wordfence","cve":"CVE-2024-5253","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97666e54-8e86-4f18-ae32-ad8ca607aeff?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.20","to_inclusive":true,"patched_in":"3.19.20.1"}],"published":"2024-07-16T18:29:58Z","updated":"2024-07-17T06:45:11Z"},{"id":"wordfence:97669ac1-2ff0-46f6-8709-c007476ed4a0","source":"wordfence","cve":"CVE-2025-23444","title":"Scroll Top Advanced <= 2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97669ac1-2ff0-46f6-8709-c007476ed4a0?source=api-prod","affected":[{"type":"plugin","slug":"scroll-top-advanced","name":"Scroll Top Advanced \u2013 Scroll to ID or Class","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:15:27Z"},{"id":"wordfence:9766a657-1cf2-448a-bd66-a27c0ebd8261","source":"wordfence","cve":"","title":"Payment Gateways Caller for WP e-Commerce < 0.1.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9766a657-1cf2-448a-bd66-a27c0ebd8261?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateways-caller-for-wp-e-commerce","name":"Payment Gateways Caller for WP e-Commerce","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":false,"patched_in":"0.1.1"}],"published":"2013-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97677968-9231-4a6b-ad81-ddb9eb9791dd","source":"wordfence","cve":"","title":"Activity Log Plugin < 2.0.4 - Fulle Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97677968-9231-4a6b-ad81-ddb9eb9791dd?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2014-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97690bde-f2c6-429b-8d5a-51bee4a981ca","source":"wordfence","cve":"CVE-2017-2217","title":"WordPress Download Manager < 2.9.51 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97690bde-f2c6-429b-8d5a-51bee4a981ca?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.51","to_inclusive":false,"patched_in":"2.9.51"}],"published":"2017-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97696702-4d40-41dd-a25f-f2ee7681a2c9","source":"wordfence","cve":"CVE-2026-1191","title":"JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97696702-4d40-41dd-a25f-f2ee7681a2c9?source=api-prod","affected":[{"type":"plugin","slug":"javascript-notifier","name":"JavaScript Notifier","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-01-23T20:32:01Z","updated":"2026-02-03T19:49:26Z"},{"id":"wordfence:976f1f01-ad5d-413e-a208-ae4b71a61502","source":"wordfence","cve":"CVE-2026-18100","title":"MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/976f1f01-ad5d-413e-a208-ae4b71a61502?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2026-08-24T19:12:51Z","updated":"2026-08-25T07:39:50Z"},{"id":"wordfence:976f9d0e-8ad8-4ce8-8917-b5c7f5a24cbb","source":"wordfence","cve":"CVE-2019-7413","title":"Parallax Scroll <= 2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/976f9d0e-8ad8-4ce8-8917-b5c7f5a24cbb?source=api-prod","affected":[{"type":"plugin","slug":"adamrob-parallax-scroll","name":"Parallax Scroll by adamrob.co.uk","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2019-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9771d688-9c96-4ffb-823e-dcdf8b1cbc51","source":"wordfence","cve":"CVE-2022-38073","title":"Awesome Support <= 6.0.7 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9771d688-9c96-4ffb-823e-dcdf8b1cbc51?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9772aa85-15e6-4254-9e76-e5794d71084b","source":"wordfence","cve":"CVE-2024-9226","title":"Landing Page Cat \u2013 Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9772aa85-15e6-4254-9e76-e5794d71084b?source=api-prod","affected":[{"type":"plugin","slug":"landing-page-cat","name":"Landing Page Cat \u2013 Coming Soon & Maintenance Pages","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:18:13Z"},{"id":"wordfence:9773329c-8d08-4467-a546-03c5a2531303","source":"wordfence","cve":"CVE-2024-49643","title":"Whitelist <= 3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9773329c-8d08-4467-a546-03c5a2531303?source=api-prod","affected":[{"type":"plugin","slug":"fifthsegment-whitelist","name":"Whitelist","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:59:06Z"},{"id":"wordfence:97742c7c-4957-4597-9cc0-c9594e8c8482","source":"wordfence","cve":"CVE-2026-111122","title":"SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97742c7c-4957-4597-9cc0-c9594e8c8482?source=api-prod","affected":[{"type":"plugin","slug":"so-css","name":"SiteOrigin CSS","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2026-10-15T16:56:54Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:9774c999-acb6-4c5f-ad6c-10979660b164","source":"wordfence","cve":"CVE-2024-1766","title":"Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9774c999-acb6-4c5f-ad6c-10979660b164?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.86","to_inclusive":true,"patched_in":"3.2.87"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-12T11:05:08Z"},{"id":"wordfence:97759a47-c52a-4113-86c0-453a53fb44a6","source":"wordfence","cve":"CVE-2024-29769","title":"Portfolio Gallery \u2013 Image Gallery Plugin <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97759a47-c52a-4113-86c0-453a53fb44a6?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-filter-gallery","name":"Portfolio Filter Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:32:15Z"},{"id":"wordfence:977a673c-075a-4662-b3e1-91a604e546f8","source":"wordfence","cve":"CVE-2026-57348","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.4 - Unauthenticated Server-Side Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/977a673c-075a-4662-b3e1-91a604e546f8?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-09T13:43:54Z"},{"id":"wordfence:977ab23a-06b2-4f54-a2c2-3be2316eaceb","source":"wordfence","cve":"CVE-2023-6279","title":"Woostify Sites Library <= 1.4.7 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/977ab23a-06b2-4f54-a2c2-3be2316eaceb?source=api-prod","affected":[{"type":"plugin","slug":"woostify-sites-library","name":"Woostify Sites Library","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-01-31T00:00:00Z","updated":"2024-08-13T15:06:58Z"},{"id":"wordfence:977bab12-969d-4b15-9942-2b17c8541f61","source":"wordfence","cve":"CVE-2024-1391","title":"Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/977bab12-969d-4b15-9942-2b17c8541f61?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-02-21T00:00:00Z","updated":"2024-05-31T15:30:48Z"},{"id":"wordfence:977d1ec4-327b-4563-a3b1-ac4fad195eb7","source":"wordfence","cve":"CVE-2017-6574","title":"Mail Masta Plugin <= 1.0 - SQL Injection via filter_list","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/977d1ec4-327b-4563-a3b1-ac4fad195eb7?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:977e407c-0650-454f-98bd-b39bb8c8c61f","source":"wordfence","cve":"CVE-2024-12113","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/977e407c-0650-454f-98bd-b39bb8c8c61f?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-01-24T18:53:19Z","updated":"2025-01-30T14:47:15Z"},{"id":"wordfence:978159d3-39b2-49b7-a59a-2da72f1792fd","source":"wordfence","cve":"CVE-2022-40672","title":"CPO Shortcodes <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/978159d3-39b2-49b7-a59a-2da72f1792fd?source=api-prod","affected":[{"type":"plugin","slug":"cpo-shortcodes","name":"CPO Shortcodes","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97818871-a27f-4d16-bdef-230f6324d886","source":"wordfence","cve":"CVE-2026-62059","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97818871-a27f-4d16-bdef-230f6324d886?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-01T12:39:00Z","updated":"2026-10-08T23:52:25Z"},{"id":"wordfence:9781b2bf-464c-4ff6-87d1-6c38acbd457c","source":"wordfence","cve":"CVE-2025-27353","title":"Namaste! LMS <= 2.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9781b2bf-464c-4ff6-87d1-6c38acbd457c?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:39:38Z"},{"id":"wordfence:9781f10d-040d-4f2e-aac4-3aa395f364ec","source":"wordfence","cve":"CVE-2024-51789","title":"Image Classify <= 1.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9781f10d-040d-4f2e-aac4-3aa395f364ec?source=api-prod","affected":[{"type":"plugin","slug":"image-classify","name":"Image Classify","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:19:26Z"},{"id":"wordfence:97827e26-d418-4c96-b0d0-10b92a4513bd","source":"wordfence","cve":"CVE-2019-25221","title":"Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97827e26-d418-4c96-b0d0-10b92a4513bd?source=api-prod","affected":[{"type":"plugin","slug":"responsive-filterable-portfolio","name":"Responsive Filterable Portfolio Gallery \u2013 Media Grid & Video Portfolio","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T03:24:35Z"},{"id":"wordfence:97829d9e-b734-4ebb-8704-5ff981b70748","source":"wordfence","cve":"CVE-2026-105199","title":"Pixel Tag Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97829d9e-b734-4ebb-8704-5ff981b70748?source=api-prod","affected":[{"type":"plugin","slug":"pixel-manager-for-woocommerce","name":"Pixel Tag Manager for WooCommerce \u2013 Google Analytics 4, Google Ads, and More Pixels","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:14:18Z"},{"id":"wordfence:97840f5f-77b8-4b89-8d3e-1d3a9b727a06","source":"wordfence","cve":"CVE-2025-58683","title":"Last Updated Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97840f5f-77b8-4b89-8d3e-1d3a9b727a06?source=api-prod","affected":[{"type":"plugin","slug":"last-updated-shortcode","name":"Last Updated Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:51:54Z"},{"id":"wordfence:97845a09-d7ae-42bc-b59b-e93f76289b09","source":"wordfence","cve":"CVE-2026-57787","title":"CWS SVGicons <= 1.5.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97845a09-d7ae-42bc-b59b-e93f76289b09?source=api-prod","affected":[{"type":"plugin","slug":"cws-svgicons","name":"cws-svgicons","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:01:19Z"},{"id":"wordfence:978850f0-c498-40a7-aab5-22afc7e97824","source":"wordfence","cve":"CVE-2026-22490","title":"Bulk Landing Page Creator for WordPress LPagery <= 2.4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/978850f0-c498-40a7-aab5-22afc7e97824?source=api-prod","affected":[{"type":"plugin","slug":"lpagery","name":"Bulk Page Generator \u2013 LPagery","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:11:07Z"},{"id":"wordfence:9788e450-4e79-43ce-ae78-466eef458c29","source":"wordfence","cve":"CVE-2024-11785","title":"Integrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9788e450-4e79-43ce-ae78-466eef458c29?source=api-prod","affected":[{"type":"plugin","slug":"integrate-firebase","name":"Integrate Firebase","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":"0.10.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:978c13e5-d30c-4caa-ab6d-256f2517fd79","source":"wordfence","cve":"CVE-2025-6012","title":"Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/978c13e5-d30c-4caa-ab6d-256f2517fd79?source=api-prod","affected":[{"type":"plugin","slug":"auto-attachments","name":"Auto Attachments","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T18:51:17Z","updated":"2025-06-13T07:23:46Z"},{"id":"wordfence:978d1747-fbcf-4c08-9563-49041f225120","source":"wordfence","cve":"","title":"MoneyMasters (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/978d1747-fbcf-4c08-9563-49041f225120?source=api-prod","affected":[{"type":"theme","slug":"moneymasters","name":"MoneyMasters","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:978d5715-7993-4f89-8d69-895467633bfb","source":"wordfence","cve":"CVE-2023-1026","title":"WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/978d5715-7993-4f89-8d69-895467633bfb?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:979001c4-45dd-4168-8749-c8eebe237b60","source":"wordfence","cve":"CVE-2025-12639","title":"wModes \u2013 Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979001c4-45dd-4168-8749-c8eebe237b60?source=api-prod","affected":[{"type":"plugin","slug":"catalog-mode-pricing-enquiry-forms-promotions","name":"wModes \u2013 Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-11-17T20:52:07Z","updated":"2025-11-18T09:27:39Z"},{"id":"wordfence:979072fc-3bf9-4969-8e84-4648ec0928bd","source":"wordfence","cve":"CVE-2025-48290","title":"Multiple Themes by bslthemes <= Various Version - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979072fc-3bf9-4969-8e84-4648ec0928bd?source=api-prod","affected":[{"type":"theme","slug":"builty","name":"Builty - Construction WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"},{"type":"theme","slug":"kinsley","name":"Kinsley - Hotel Booking Theme","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"},{"type":"theme","slug":"kaffen","name":"Kaffen - Restaurant & Cafe WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"oblo","name":"Oblo - Creative Agency Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"ober","name":"OBER - CV Resume WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"theme","slug":"lesya","name":"Lesya - Beauty Salon & Spa WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"},{"type":"theme","slug":"minterio","name":"Minterio","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"},{"type":"theme","slug":"starbelly","name":"Starbelly - Restaurant & Cafe WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"theme","slug":"luique","name":"Luique - Personal Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"theme","slug":"samantha","name":"Samantha - Personal Trainer & Fitness WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"ashley","name":"Ashley - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"},{"type":"theme","slug":"courtney","name":"Courtney - Personal Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"theme","slug":"lettery","name":"Lettery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"},{"type":"theme","slug":"itsulu","name":"ITSulu - Technology & IT Solutions WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"},{"type":"theme","slug":"larson","name":"Larson - Architecture WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"},{"type":"theme","slug":"ruizarch","name":"Ruizarch - Architecture WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-05-20T00:00:00Z","updated":"2025-09-11T14:09:57Z"},{"id":"wordfence:9790bb19-bb5c-407c-9a2f-589b8b318ffb","source":"wordfence","cve":"CVE-2025-31538","title":"Checklist <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9790bb19-bb5c-407c-9a2f-589b8b318ffb?source=api-prod","affected":[{"type":"plugin","slug":"checklist","name":"Checklist","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:11:19Z"},{"id":"wordfence:9790c592-1445-4f9d-987e-ae5ab49c4dcd","source":"wordfence","cve":"CVE-2024-24706","title":"WP-CFM  <= 1.7.8 - Cross-Site Request Forgery via multiple AJAX functions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9790c592-1445-4f9d-987e-ae5ab49c4dcd?source=api-prod","affected":[{"type":"plugin","slug":"wp-cfm","name":"WP-CFM","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-07T19:02:09Z"},{"id":"wordfence:97919084-d91d-473e-8f9b-d069c4bf22ea","source":"wordfence","cve":"CVE-2026-86783","title":"PostX <= 5.0.40 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97919084-d91d-473e-8f9b-d069c4bf22ea?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.40","to_inclusive":true,"patched_in":"5.0.41"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:53:27Z"},{"id":"wordfence:97925dfe-76f6-4214-930d-aafd4caec42e","source":"wordfence","cve":"CVE-2026-14213","title":"Booking for Appointments and Events Calendar \u2013 Amelia < 2.4.6 - Authenticated (Custom role+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97925dfe-76f6-4214-930d-aafd4caec42e?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":false,"patched_in":"2.4.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:44:48Z"},{"id":"wordfence:9792f1aa-6137-4427-8f56-32d598fcc20d","source":"wordfence","cve":"CVE-2026-109999","title":"AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9792f1aa-6137-4427-8f56-32d598fcc20d?source=api-prod","affected":[{"type":"plugin","slug":"ai-marketing-expert","name":"AI Marketing Expert \u2014 AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2026-10-27T14:27:57Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:97964532-c9bd-4bc1-8f57-b2cd2c47a0e0","source":"wordfence","cve":"CVE-2024-35740","title":"Pixgraphy <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97964532-c9bd-4bc1-8f57-b2cd2c47a0e0?source=api-prod","affected":[{"type":"theme","slug":"pixgraphy","name":"Pixgraphy","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:52:06Z"},{"id":"wordfence:97964ebd-be0b-4187-b393-17edf4ba5caf","source":"wordfence","cve":"CVE-2024-0609","title":"WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97964ebd-be0b-4187-b393-17edf4ba5caf?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2024-03-28T00:00:00Z","updated":"2025-11-05T18:46:08Z"},{"id":"wordfence:979699fd-ff31-4cba-bbf2-03fa51554031","source":"wordfence","cve":"CVE-2022-47433","title":"Multi Rating <= 5.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979699fd-ff31-4cba-bbf2-03fa51554031?source=api-prod","affected":[{"type":"plugin","slug":"multi-rating","name":"Multi Rating","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97974da8-cb02-491e-940a-3e08f94a4373","source":"wordfence","cve":"CVE-2025-58220","title":"Card Elements for WPBakery <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97974da8-cb02-491e-940a-3e08f94a4373?source=api-prod","affected":[{"type":"plugin","slug":"card-elements-for-wpbakery","name":"Card Elements for WPBakery","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-08-29T00:42:41Z"},{"id":"wordfence:97977c09-b8e0-4ad3-8819-67d7bcff596a","source":"wordfence","cve":"CVE-2026-122265","title":"Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter","severity":"medium","cvss":5.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97977c09-b8e0-4ad3-8819-67d7bcff596a?source=api-prod","affected":[{"type":"plugin","slug":"vanquish-upload-files-for-woocommerce","name":"Vanquish Upload Files for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-11-06T18:19:18Z","updated":"2026-11-07T06:39:38Z"},{"id":"wordfence:97984c7d-d6ff-480c-acfe-20ab0eb04141","source":"wordfence","cve":"CVE-2023-0555","title":"Quick Restaurant Menu <= 2.0.2 - Missing Authorization","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97984c7d-d6ff-480c-acfe-20ab0eb04141?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-menu","name":"Quick Restaurant Menu","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97985b75-6ac9-4aba-8f76-5633418e7907","source":"wordfence","cve":"CVE-2025-8089","title":"Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97985b75-6ac9-4aba-8f76-5633418e7907?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2025.6","to_inclusive":true,"patched_in":"2025.7"}],"published":"2025-08-15T18:33:05Z","updated":"2025-08-16T06:39:23Z"},{"id":"wordfence:9798cee8-9aaa-40c1-91a4-55251baafbb0","source":"wordfence","cve":"CVE-2025-67922","title":"Grand Restaurant < 7.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9798cee8-9aaa-40c1-91a4-55251baafbb0?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0.9","to_inclusive":false,"patched_in":"7.0.9"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-13T17:32:45Z"},{"id":"wordfence:979962e3-9052-4dc9-94d0-3ec8de3d5460","source":"wordfence","cve":"CVE-2026-3475","title":"Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979962e3-9052-4dc9-94d0-3ec8de3d5460?source=api-prod","affected":[{"type":"plugin","slug":"instant-popup-builder","name":"Instant Popup Builder \u2013 Popup Maker for Videos, Forms, Offers, Announcements, Galleries & Exit Intent","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-03-18T19:02:53Z","updated":"2026-03-19T07:34:56Z"},{"id":"wordfence:9799df3f-e34e-42a7-8a72-fa57682f7014","source":"wordfence","cve":"CVE-2023-4243","title":"FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9799df3f-e34e-42a7-8a72-fa57682f7014?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:979bb48d-6dbf-4bb2-90f3-573797ff23f7","source":"wordfence","cve":"","title":"mb.mb.miniAudioPlayer < 1.4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979bb48d-6dbf-4bb2-90f3-573797ff23f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-miniaudioplayer","name":"mb.miniAudioPlayer \u2013 an HTML5 audio player for your mp3 files","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2013-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:979bc132-739c-4e4c-a878-1691c762f5ff","source":"wordfence","cve":"CVE-2026-28150","title":"Golo Framework < 1.7.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979bc132-739c-4e4c-a878-1691c762f5ff?source=api-prod","affected":[{"type":"plugin","slug":"golo-framework","name":"Golo Framework","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:09:05Z"},{"id":"wordfence:979c1107-788a-4130-b1d1-5cad3717962b","source":"wordfence","cve":"CVE-2019-14230","title":"OnionBuzz Plugin < 1.2.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979c1107-788a-4130-b1d1-5cad3717962b?source=api-prod","affected":[{"type":"plugin","slug":"onionbuzz-viral-quiz","name":"OnionBuzz","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2019-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:979efaa4-10f1-4c7f-b4b0-5a41678c9d66","source":"wordfence","cve":"CVE-2025-7441","title":"StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979efaa4-10f1-4c7f-b4b0-5a41678c9d66?source=api-prod","affected":[{"type":"plugin","slug":"story-chief","name":"StoryChief","from":"*","from_inclusive":true,"to":"1.0.42","to_inclusive":true,"patched_in":"1.0.43"}],"published":"2025-08-15T14:41:13Z","updated":"2026-09-10T19:17:51Z"},{"id":"wordfence:979f52b8-0860-43d0-9675-6e9880f48e21","source":"wordfence","cve":"CVE-2025-49868","title":"Automation By Autonami <= 3.6.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/979f52b8-0860-43d0-9675-6e9880f48e21?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-18T14:53:02Z"},{"id":"wordfence:97a0ceb5-d576-45a3-9b61-4efd4c3ad871","source":"wordfence","cve":"CVE-2026-84930","title":"CatFolders Document Gallery & PDF Library < 2.0.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97a0ceb5-d576-45a3-9b61-4efd4c3ad871?source=api-prod","affected":[{"type":"plugin","slug":"catfolders-document-gallery","name":"CatFolders Document Gallery & PDF Library","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:03:33Z"},{"id":"wordfence:97a1ab2f-b531-46a7-ad51-a652fc078212","source":"wordfence","cve":"CVE-2024-4615","title":"Elespare \u2013 Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97a1ab2f-b531-46a7-ad51-a652fc078212?source=api-prod","affected":[{"type":"plugin","slug":"elespare","name":"EleSpare \u2013 Elementor News, Magazine & Blog Addons with Post Grid","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-06-12T19:14:37Z","updated":"2024-06-20T12:48:26Z"},{"id":"wordfence:97a3fc27-4b58-400a-b831-6423e3de5cb7","source":"wordfence","cve":"CVE-2017-1000600","title":"WordPress Core < 4.9 - Insecure Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97a3fc27-4b58-400a-b831-6423e3de5cb7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":false,"patched_in":"4.9"}],"published":"2018-08-16T00:00:00Z","updated":"2024-02-07T15:14:40Z"},{"id":"wordfence:97a6da6b-ed85-4bf4-8ae7-5cd831d022a7","source":"wordfence","cve":"CVE-2025-24672","title":"Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97a6da6b-ed85-4bf4-8ae7-5cd831d022a7?source=api-prod","affected":[{"type":"plugin","slug":"cp-easy-form-builder","name":"Form Builder CP","from":"*","from_inclusive":true,"to":"1.2.41","to_inclusive":true,"patched_in":"1.2.42"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:06:40Z"},{"id":"wordfence:97ab2585-4178-4a5b-923f-2ce9ca44a8d7","source":"wordfence","cve":"CVE-2015-5730","title":"WordPress Core < 4.2.4 - Timing Side-Channel Attack","severity":"medium","cvss":5.3,"cwe":"CWE-208","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97ab2585-4178-4a5b-923f-2ce9ca44a8d7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97acf80f-2a50-457a-8418-1b99408c6e9d","source":"wordfence","cve":"CVE-2026-77784","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization to Authenticated (Author+) SEO Object Updates","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97acf80f-2a50-457a-8418-1b99408c6e9d?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T14:44:11Z"},{"id":"wordfence:97ad1b6e-2f2b-49f6-9970-fd413bfc544a","source":"wordfence","cve":"CVE-2012-6527","title":"My Calendar < 1.10.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97ad1b6e-2f2b-49f6-9970-fd413bfc544a?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"1.10.5","to_inclusive":false,"patched_in":"1.10.5"}],"published":"2012-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97b10f88-1911-4416-a5cd-83b4c991e6c9","source":"wordfence","cve":"CVE-2022-2169","title":"Loading Page with Loading Screen <= 1.0.82 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97b10f88-1911-4416-a5cd-83b4c991e6c9?source=api-prod","affected":[{"type":"plugin","slug":"loading-page","name":"Loading Page with Loading Screen","from":"*","from_inclusive":true,"to":"1.0.82","to_inclusive":true,"patched_in":"1.0.83"}],"published":"2022-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97b2b43b-61c9-48ea-82ba-07774fcc461a","source":"wordfence","cve":"CVE-2026-114187","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97b2b43b-61c9-48ea-82ba-07774fcc461a?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:14Z"},{"id":"wordfence:97b327cc-7a72-4cc3-a4db-a693469f6917","source":"wordfence","cve":"CVE-2025-15512","title":"Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97b327cc-7a72-4cc3-a4db-a693469f6917?source=api-prod","affected":[{"type":"plugin","slug":"aplazo-payment-gateway","name":"Aplazo Payment Gateway","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-01-13T17:29:56Z","updated":"2026-02-16T21:56:16Z"},{"id":"wordfence:97b9cfa8-0bb4-47ac-b811-514c0d76d8ef","source":"wordfence","cve":"CVE-2026-17022","title":"Salon Booking System \u2013 Free Version <= 10.30.33 - Unauthenticated Booking Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97b9cfa8-0bb4-47ac-b811-514c0d76d8ef?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.33","to_inclusive":true,"patched_in":"10.30.34"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:43:15Z"},{"id":"wordfence:97bc8742-f47a-448d-9eb2-8f08c1cb1e07","source":"wordfence","cve":"CVE-2025-64377","title":"ListingPro < 2.9.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97bc8742-f47a-448d-9eb2-8f08c1cb1e07?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":false,"patched_in":"2.9.10"}],"published":"2025-09-12T00:00:00Z","updated":"2025-12-19T17:06:37Z"},{"id":"wordfence:97bd4897-c0c2-4819-aa25-942e256de9a3","source":"wordfence","cve":"CVE-2024-13743","title":"Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97bd4897-c0c2-4819-aa25-942e256de9a3?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-video-embed","name":"Wonder Video Embed","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-02-18T09:35:42Z","updated":"2025-02-18T22:21:32Z"},{"id":"wordfence:97bff7aa-d304-4ccd-bfca-d3f18568df6c","source":"wordfence","cve":"CVE-2013-6281","title":"dhtmlxSpreadsheet <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97bff7aa-d304-4ccd-bfca-d3f18568df6c?source=api-prod","affected":[{"type":"plugin","slug":"dhtmlxspreadsheet","name":"dhtmlxspreadsheet","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2013-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c07a3e-4538-4e0f-a597-6b843ff7feb5","source":"wordfence","cve":"CVE-2015-4616","title":"Easy2Map <= 1.2.4 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c07a3e-4538-4e0f-a597-6b843ff7feb5?source=api-prod","affected":[{"type":"plugin","slug":"easy2map","name":"Easy2Map","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2015-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c100c3-8a96-4198-b38a-206268ff20ec","source":"wordfence","cve":"CVE-2025-11536","title":"Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c100c3-8a96-4198-b38a-206268ff20ec?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2025-10-20T08:59:46Z","updated":"2025-10-20T21:23:48Z"},{"id":"wordfence:97c1aeee-a82e-4d09-bffb-a91a89d0ea1e","source":"wordfence","cve":"CVE-2023-0364","title":"real.Kit <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c1aeee-a82e-4d09-bffb-a91a89d0ea1e?source=api-prod","affected":[{"type":"plugin","slug":"real-kit","name":"real.Kit","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c21d5a-9140-4e97-b166-531d243b084d","source":"wordfence","cve":"CVE-2026-18197","title":"Link Library < 7.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c21d5a-9140-4e97-b166-531d243b084d?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.4","to_inclusive":false,"patched_in":"7.9.4"}],"published":"2026-07-29T00:00:00Z","updated":"2026-07-30T17:52:17Z"},{"id":"wordfence:97c24208-46b2-48a0-a87b-78e642c044cd","source":"wordfence","cve":"CVE-2021-24387","title":"WP Pro Real Estate 7 < 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c24208-46b2-48a0-a87b-78e642c044cd?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2021-06-10T00:00:00Z","updated":"2025-01-15T18:43:30Z"},{"id":"wordfence:97c441c3-ae8b-4b7a-8480-da81c0f339ab","source":"wordfence","cve":"","title":"Donate With QRCode <= 1.4.5 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c441c3-ae8b-4b7a-8480-da81c0f339ab?source=api-prod","affected":[{"type":"plugin","slug":"donate-with-qrcode","name":"\u535a\u5ba2\u793e\u4ea4\u5206\u4eab\u7ec4\u4ef6","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2021-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c46a13-6981-426f-b24a-c9820657042f","source":"wordfence","cve":"CVE-2025-10745","title":"Banhammer \u2013 Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c46a13-6981-426f-b24a-c9820657042f?source=api-prod","affected":[{"type":"plugin","slug":"banhammer","name":"Banhammer \u2013 Monitor Site Traffic, Block Bad Users and Bots","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2025-09-25T14:27:24Z","updated":"2025-09-26T03:25:34Z"},{"id":"wordfence:97c68df7-69fd-4817-9473-3d3e1fd6d348","source":"wordfence","cve":"CVE-2023-32796","title":"WooCommerce Product Enquiry <= 2.6.0 - Unauthenticated Self-Based Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c68df7-69fd-4817-9473-3d3e1fd6d348?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-enquiry","name":"WooCommerce Product Enquiry","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2023-11-08T00:00:00Z","updated":"2024-05-17T13:30:23Z"},{"id":"wordfence:97c7b0bc-4c73-4330-851a-2d6d6d0b62c9","source":"wordfence","cve":"CVE-2022-0887","title":"Easy Social Icons <= 3.1.3 - Admin+ SQL Injection","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c7b0bc-4c73-4330-851a-2d6d6d0b62c9?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2022-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c8858a-f05d-4159-b914-4e6ae9bf0d79","source":"wordfence","cve":"CVE-2023-28420","title":"Custom Options Plus <= 1.8.1 - Cross-Site Request Forgery via custom_options_plus_adm","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c8858a-f05d-4159-b914-4e6ae9bf0d79?source=api-prod","affected":[{"type":"plugin","slug":"custom-options-plus","name":"Custom Options Plus","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97c921e4-a05d-43db-9fe7-3dac8ea4d249","source":"wordfence","cve":"CVE-2021-24358","title":"The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97c921e4-a05d-43db-9fe7-3dac8ea4d249?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":false,"patched_in":"4.1.10"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97cb2707-c67a-4b2b-a7fc-8778580a5f13","source":"wordfence","cve":"CVE-2025-26947","title":"Services Section block <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97cb2707-c67a-4b2b-a7fc-8778580a5f13?source=api-prod","affected":[{"type":"plugin","slug":"services-section","name":"Services Section Block \u2013 present your services in clean grids and columns","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:17:38Z"},{"id":"wordfence:97cb7216-fe65-46db-9ab2-62d409f056cd","source":"wordfence","cve":"CVE-2024-35646","title":"Smartarget Message Bar <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97cb7216-fe65-46db-9ab2-62d409f056cd?source=api-prod","affected":[{"type":"plugin","slug":"smartarget-message-bar","name":"Smartarget Message Bar","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-30T00:00:00Z","updated":"2024-09-09T20:35:54Z"},{"id":"wordfence:97cbf2d7-2fdc-4c10-872d-add54687dd9b","source":"wordfence","cve":"CVE-2024-31857","title":"Forminator <= 1.15.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97cbf2d7-2fdc-4c10-872d-add54687dd9b?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.15.2","to_inclusive":true,"patched_in":"1.15.4"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-24T13:07:34Z"},{"id":"wordfence:97cdcc23-4f63-4976-bc47-805d5dbbee09","source":"wordfence","cve":"","title":"Fixedly Media Gallery <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97cdcc23-4f63-4976-bc47-805d5dbbee09?source=api-prod","affected":[{"type":"plugin","slug":"fixedly","name":"Fixedly Media Gallery","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97ced4ed-915b-4234-b59d-75db983f90e8","source":"wordfence","cve":"CVE-2023-31216","title":"Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97ced4ed-915b-4234-b59d-75db983f90e8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97cef309-da2f-461a-b5a3-3a85c540c7aa","source":"wordfence","cve":"CVE-2024-11722","title":"Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97cef309-da2f-461a-b5a3-3a85c540c7aa?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.25.1","to_inclusive":true,"patched_in":"3.25.2"}],"published":"2024-12-20T20:35:02Z","updated":"2024-12-21T09:23:55Z"},{"id":"wordfence:97d0647f-3a13-4008-98ab-d35b8d27283b","source":"wordfence","cve":"CVE-2026-120856","title":"Invoice Gateway for WooCommerce \u2013 Invoice Payment Gateway <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d0647f-3a13-4008-98ab-d35b8d27283b?source=api-prod","affected":[{"type":"plugin","slug":"invoice-gateway-for-woocommerce","name":"Invoice Gateway for WooCommerce \u2013 Invoice Payment Gateway","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T16:10:22Z"},{"id":"wordfence:97d28ec3-a06a-4f8b-9926-f81166be324d","source":"wordfence","cve":"CVE-2025-30965","title":"WPJobBoard < 5.11.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d28ec3-a06a-4f8b-9926-f81166be324d?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":false,"patched_in":"5.11.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:49:15Z"},{"id":"wordfence:97d305b8-0454-4407-8fed-7884c4b19d8e","source":"wordfence","cve":"CVE-2026-14926","title":"FluentCart <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Subscription Payment Tampering","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d305b8-0454-4407-8fed-7884c4b19d8e?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-30T17:23:38Z"},{"id":"wordfence:97d5007f-1786-4a36-a3d2-b536bec31a29","source":"wordfence","cve":"CVE-2025-54674","title":"Product Configurator for WooCommerce <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d5007f-1786-4a36-a3d2-b536bec31a29?source=api-prod","affected":[{"type":"plugin","slug":"product-configurator-for-woocommerce","name":"MKL Product Configurator for WooCommerce \u2013 2D & 3D Live Preview","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:50:25Z"},{"id":"wordfence:97d78b4b-568e-43e7-bebf-091179c321f6","source":"wordfence","cve":"CVE-2024-2326","title":"Pretty Links \u2013 Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d78b4b-568e-43e7-bebf-091179c321f6?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T03:33:44Z"},{"id":"wordfence:97d83816-5a27-4172-a7fe-724870f2ca77","source":"wordfence","cve":"CVE-2024-7878","title":"WP ULike <= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d83816-5a27-4172-a7fe-724870f2ca77?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2024-09-04T00:00:00Z","updated":"2024-10-04T17:02:05Z"},{"id":"wordfence:97d9389b-7844-49f2-ab0a-6720e8659001","source":"wordfence","cve":"CVE-2026-118418","title":"WP Directory Kit < 1.6.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97d9389b-7844-49f2-ab0a-6720e8659001?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:39Z"},{"id":"wordfence:97da8e3d-0e29-423a-bd59-dbcff1eb1249","source":"wordfence","cve":"CVE-2025-67945","title":"MailerLite \u2013 WooCommerce integration <= 3.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97da8e3d-0e29-423a-bd59-dbcff1eb1249?source=api-prod","affected":[{"type":"plugin","slug":"woo-mailerlite","name":"MailerLite \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:32:31Z"},{"id":"wordfence:97dd7e1a-9189-4a35-9cd0-e80b5d9a0e9f","source":"wordfence","cve":"CVE-2022-3206","title":"Passster <= 3.5.5.5.1 - Insecure Password Storage to Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-326","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97dd7e1a-9189-4a35-9cd0-e80b5d9a0e9f?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"3.5.5.5.1","to_inclusive":true,"patched_in":"3.5.5.5.2"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97ddb0e9-1bb8-48ed-9fa3-d2b5f260263b","source":"wordfence","cve":"CVE-2026-0557","title":"WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97ddb0e9-1bb8-48ed-9fa3-d2b5f260263b?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.63","to_inclusive":true,"patched_in":"5.5.64"}],"published":"2026-02-13T18:19:08Z","updated":"2026-02-14T06:42:31Z"},{"id":"wordfence:97df0ac7-3240-4d2b-aa2c-779c8e9359e8","source":"wordfence","cve":"CVE-2024-50513","title":"PostX <= 4.1.15 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97df0ac7-3240-4d2b-aa2c-779c8e9359e8?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.16"}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T18:49:11Z"},{"id":"wordfence:97e1d671-7be9-4515-8df1-b2e617f0c94d","source":"wordfence","cve":"CVE-2025-31917","title":"Universal Video Player <= 3.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e1d671-7be9-4515-8df1-b2e617f0c94d?source=api-prod","affected":[{"type":"plugin","slug":"universal_video_player","name":"Universal Video Player","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:33:21Z"},{"id":"wordfence:97e68562-92b8-43ac-9a8c-778d2b61f889","source":"wordfence","cve":"CVE-2026-27064","title":"Mailster - Email Newsletter Plugin for WordPress <= 4.1.17 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e68562-92b8-43ac-9a8c-778d2b61f889?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster WordPress Newsletter Plugin","from":"*","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"4.1.18"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:47:10Z"},{"id":"wordfence:97e73872-bd1a-4b3a-9021-d0cd648456eb","source":"wordfence","cve":"CVE-2026-118070","title":"Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e73872-bd1a-4b3a-9021-d0cd648456eb?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.6"}],"published":"2026-10-30T17:50:52Z","updated":"2026-10-31T06:44:21Z"},{"id":"wordfence:97e863fd-0256-421e-8a3d-ef9460248d2e","source":"wordfence","cve":"CVE-2025-54679","title":"Neon Channel Product Customizer Free <= 2.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e863fd-0256-421e-8a3d-ef9460248d2e?source=api-prod","affected":[{"type":"plugin","slug":"neon-channel-product-customizer-free","name":"Neon Channel Product Customizer Free","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:14:46Z"},{"id":"wordfence:97e9037e-7d7a-4dad-bce1-0211822c04c1","source":"wordfence","cve":"CVE-2021-24856","title":"Shared Files \u2013 Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.60 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e9037e-7d7a-4dad-bce1-0211822c04c1?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.6.61","to_inclusive":false,"patched_in":"1.6.61"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97e97825-8144-423c-ac4c-3c5ae0dbbb10","source":"wordfence","cve":"CVE-2021-38323","title":"RentPress <= 6.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e97825-8144-423c-ac4c-3c5ae0dbbb10?source=api-prod","affected":[{"type":"plugin","slug":"rentpress","name":"RentPress","from":"*","from_inclusive":true,"to":"6.6.4","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T20:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97e9c99f-e143-42db-a02a-1467276e32b1","source":"wordfence","cve":"CVE-2026-54810","title":"Nexi XPay <= 8.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97e9c99f-e143-42db-a02a-1467276e32b1?source=api-prod","affected":[{"type":"plugin","slug":"cartasi-x-pay","name":"Nexi XPay","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":true,"patched_in":"8.3.2"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:42:51Z"},{"id":"wordfence:97ed0ef5-2a01-4531-a844-81766bdfc7c8","source":"wordfence","cve":"CVE-2024-32710","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.5 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97ed0ef5-2a01-4531-a844-81766bdfc7c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.5","to_inclusive":true,"patched_in":"16.26.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:10:24Z"},{"id":"wordfence:97f16bad-f0ad-44cc-bb07-04ce33d0cdf9","source":"wordfence","cve":"CVE-2024-29907","title":"SEO Backlink Monitor <= 1.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f16bad-f0ad-44cc-bb07-04ce33d0cdf9?source=api-prod","affected":[{"type":"plugin","slug":"seo-backlink-monitor","name":"SEO Backlink Monitor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:47:03Z"},{"id":"wordfence:97f1b126-5056-496e-b5fb-49e777392233","source":"wordfence","cve":"CVE-2024-50480","title":"Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f1b126-5056-496e-b5fb-49e777392233?source=api-prod","affected":[{"type":"plugin","slug":"marketing-automation-by-azexo","name":"Marketing Automation by AZEXO","from":"*","from_inclusive":true,"to":"1.27.80","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:55:31Z"},{"id":"wordfence:97f2b71f-ef3e-4826-8e78-62820672ec0c","source":"wordfence","cve":"CVE-2014-4552","title":"Spotlight <= 4.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f2b71f-ef3e-4826-8e78-62820672ec0c?source=api-prod","affected":[{"type":"plugin","slug":"spotlightyour","name":"Spotlight","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97f6e03b-19ac-450b-9895-45f7d5328907","source":"wordfence","cve":"CVE-2015-3647","title":"WP Photo Album Plus < 6.1.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f6e03b-19ac-450b-9895-45f7d5328907?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":false,"patched_in":"6.1.3"}],"published":"2015-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97f7cdf1-1439-40b3-90de-cdf19de4108a","source":"wordfence","cve":"CVE-2025-62141","title":"Wawp <= 4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f7cdf1-1439-40b3-90de-cdf19de4108a?source=api-prod","affected":[{"type":"plugin","slug":"automation-web-platform","name":"Wawp Country Code & Chat Widget for WooCommerce","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T16:59:28Z"},{"id":"wordfence:97f83e6b-a0df-4ed6-a528-7243bf851c1b","source":"wordfence","cve":"CVE-2025-57965","title":"WP Proposals <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f83e6b-a0df-4ed6-a528-7243bf851c1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-proposals","name":"WP Proposals","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:06:13Z"},{"id":"wordfence:97f8549a-292d-4a6d-8ec0-550467e5cf0f","source":"wordfence","cve":"CVE-2023-0926","title":"Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8549a-292d-4a6d-8ec0-550467e5cf0f?source=api-prod","affected":[{"type":"plugin","slug":"custom-permalinks","name":"Custom Permalinks","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-24T02:02:32Z"},{"id":"wordfence:97f8bd19-85a5-4cd5-bc61-8637541cdc53","source":"wordfence","cve":"CVE-2025-69039","title":"Bailly <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8bd19-85a5-4cd5-bc61-8637541cdc53?source=api-prod","affected":[{"type":"theme","slug":"bailly","name":"Bailly - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:45:36Z"},{"id":"wordfence:97f96f18-3296-4e9b-adae-a073da520778","source":"wordfence","cve":"CVE-2025-24572","title":"WP Fast Total Search <= 1.78.258 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97f96f18-3296-4e9b-adae-a073da520778?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.78.258","to_inclusive":true,"patched_in":"1.79.262"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:04:55Z"},{"id":"wordfence:97fbbf5b-d3c7-47ce-b251-ce1fe38af152","source":"wordfence","cve":"CVE-2024-5868","title":"WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness","severity":"medium","cvss":6.5,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97fbbf5b-d3c7-47ce-b251-ce1fe38af152?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-06-14T00:00:00Z","updated":"2024-06-15T03:35:11Z"},{"id":"wordfence:97fc00d0-ca3d-462a-ac9f-bfac4c882cc1","source":"wordfence","cve":"CVE-2012-5388","title":"White Label CMS < 1.5.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97fc00d0-ca3d-462a-ac9f-bfac4c882cc1?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2012-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97fd7952-a7f0-4797-82cd-840c0a3e5fbe","source":"wordfence","cve":"CVE-2015-8354","title":"Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97fd7952-a7f0-4797-82cd-840c0a3e5fbe?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.29","to_inclusive":false,"patched_in":"1.3.29"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:97fdd2f9-02ad-492c-88d1-1e7bd9c404a5","source":"wordfence","cve":"CVE-2026-22332","title":"Tutor LMS Pro <= 3.9.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/97fdd2f9-02ad-492c-88d1-1e7bd9c404a5?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-01-13T00:00:00Z","updated":"2026-05-05T18:20:52Z"},{"id":"wordfence:98008119-1be7-404c-b191-7585d51549d3","source":"wordfence","cve":"CVE-2025-48144","title":"Import Export For WooCommerce <= 1.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98008119-1be7-404c-b191-7585d51549d3?source=api-prod","affected":[{"type":"plugin","slug":"import-export-for-woocommerce","name":"Import Export For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:15:16Z"},{"id":"wordfence:980387d1-dd16-405d-8af2-fb7fb8b926db","source":"wordfence","cve":"CVE-2026-120479","title":"WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980387d1-dd16-405d-8af2-fb7fb8b926db?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.90","to_inclusive":true,"patched_in":"5.5.91"}],"published":"2026-11-06T18:26:29Z","updated":"2026-11-07T06:39:39Z"},{"id":"wordfence:9804ec4c-0229-4cbf-907b-05b3bdc49bd9","source":"wordfence","cve":"CVE-2025-60074","title":"Lazy Load Optimizer <= 1.4.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9804ec4c-0229-4cbf-907b-05b3bdc49bd9?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load-optimizer","name":"Lazy Load Optimizer","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-11-11T17:12:13Z"},{"id":"wordfence:98053141-fe97-4bd4-b820-b6cca3426109","source":"wordfence","cve":"CVE-2024-1092","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98053141-fe97-4bd4-b820-b6cca3426109?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T21:21:56Z"},{"id":"wordfence:98078b3f-cb7a-44fe-8619-088399bc3382","source":"wordfence","cve":"CVE-2025-39470","title":"IvyPrep <= 1.6.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98078b3f-cb7a-44fe-8619-088399bc3382?source=api-prod","affected":[{"type":"theme","slug":"ivy-school","name":"IvyPrep - Education & School WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:44:06Z"},{"id":"wordfence:98085a23-0cb6-442a-a28a-cb5c2890b60d","source":"wordfence","cve":"CVE-2023-5505","title":"BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98085a23-0cb6-442a-a28a-cb5c2890b60d?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T08:37:24Z"},{"id":"wordfence:980a9237-7dea-4058-a850-b849457b4fef","source":"wordfence","cve":"CVE-2023-38388","title":"JupiterX Core <= 3.3.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980a9237-7dea-4058-a850-b849457b4fef?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:980b16d4-3c4a-4ed1-af46-f39f3ec6dd19","source":"wordfence","cve":"CVE-2024-12028","title":"Friends <= 3.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980b16d4-3c4a-4ed1-af46-f39f3ec6dd19?source=api-prod","affected":[{"type":"plugin","slug":"friends","name":"Friends","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-12-05T19:45:41Z","updated":"2024-12-10T14:35:46Z"},{"id":"wordfence:980c1f30-0877-4437-aff8-6d5235b6a4d6","source":"wordfence","cve":"CVE-2024-38731","title":"i-amaze <= 1.3.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980c1f30-0877-4437-aff8-6d5235b6a4d6?source=api-prod","affected":[{"type":"theme","slug":"i-amaze","name":"i-amaze","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:13:05Z"},{"id":"wordfence:980d1726-375f-41b2-a67c-1b934e20312c","source":"wordfence","cve":"CVE-2015-9507","title":"Easy Digital Downloads \u2013 Attach Accounts to Orders <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980d1726-375f-41b2-a67c-1b934e20312c?source=api-prod","affected":[{"type":"plugin","slug":"edd-attach-accounts-to-orders","name":"Easy Digital Downloads \u2013 Attach Accounts to Orders","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:980ed456-b6a9-4ca0-99ce-513b20af6d8f","source":"wordfence","cve":"","title":"WP Print Friendly <= 0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/980ed456-b6a9-4ca0-99ce-513b20af6d8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-print-friendly","name":"WP Print Friendly","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":"0.6.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98125cd1-b037-4ace-9769-3522db53d081","source":"wordfence","cve":"CVE-2025-31468","title":"WP_Identicon <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98125cd1-b037-4ace-9769-3522db53d081?source=api-prod","affected":[{"type":"plugin","slug":"wp-identicon","name":"WP_Identicon","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T20:51:09Z"},{"id":"wordfence:9814c782-2a78-4501-be05-b759db99b485","source":"wordfence","cve":"CVE-2024-49253","title":"Analyse Uploads <= 0.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9814c782-2a78-4501-be05-b759db99b485?source=api-prod","affected":[{"type":"plugin","slug":"analyse-uploads","name":"Analyse Uploads","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:03:38Z"},{"id":"wordfence:981639a3-63c4-4b3f-827f-4d770bd44806","source":"wordfence","cve":"CVE-2023-4945","title":"Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/981639a3-63c4-4b3f-827f-4d770bd44806?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9817f6b8-19c2-46d6-8169-f8abbc695379","source":"wordfence","cve":"CVE-2026-18558","title":"Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9817f6b8-19c2-46d6-8169-f8abbc695379?source=api-prod","affected":[{"type":"plugin","slug":"embed-any-document","name":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.7.14"}],"published":"2026-10-09T17:03:32Z","updated":"2026-10-10T05:31:03Z"},{"id":"wordfence:981908d3-e1e7-4093-a2ee-69aa50127731","source":"wordfence","cve":"","title":"Custom Order Numbers for WooCommerce <= 1.6.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/981908d3-e1e7-4093-a2ee-69aa50127731?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-numbers-for-woocommerce","name":"Custom Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-01-30T00:00:00Z","updated":"2024-04-17T12:58:03Z"},{"id":"wordfence:981c9cd8-9765-405e-b53f-be7c6f839764","source":"wordfence","cve":"CVE-2025-62009","title":"UPC/EAN/GTIN Code Generator <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/981c9cd8-9765-405e-b53f-be7c6f839764?source=api-prod","affected":[{"type":"plugin","slug":"upc-ean-barcode-generator","name":"UPC/EAN/GTIN Barcode Generator/Importer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:19:47Z"},{"id":"wordfence:981ed50b-8f03-4320-99f0-3f53f7b2fc44","source":"wordfence","cve":"CVE-2025-8152","title":"WP CTA \u2013 Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/981ed50b-8f03-4320-99f0-3f53f7b2fc44?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-08-01T18:48:08Z","updated":"2025-08-02T07:24:22Z"},{"id":"wordfence:9820b52b-540a-47e8-9e5f-274ef1720ffa","source":"wordfence","cve":"CVE-2024-5640","title":"Prime Slider \u2013 Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9820b52b-540a-47e8-9e5f-274ef1720ffa?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.14.7","to_inclusive":true,"patched_in":"3.14.8"}],"published":"2024-06-06T15:35:44Z","updated":"2024-06-07T04:33:25Z"},{"id":"wordfence:9821e51c-1042-47b8-b104-32f5651c31c9","source":"wordfence","cve":"","title":"TextMe SMS <= 1.8.8 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9821e51c-1042-47b8-b104-32f5651c31c9?source=api-prod","affected":[{"type":"plugin","slug":"textme-sms-integration","name":"TextMe SMS","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":false,"patched_in":"1.8.9"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:982680a5-c534-4038-ae80-e59aa9761174","source":"wordfence","cve":"CVE-2024-49304","title":"Pinpoint Booking System <= 2.9.9.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982680a5-c534-4038-ae80-e59aa9761174?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.5.7","to_inclusive":true,"patched_in":"2.9.9.5.8"}],"published":"2024-10-15T00:00:00Z","updated":"2025-09-15T19:38:21Z"},{"id":"wordfence:9826c91c-0f6e-4d3b-bc14-4af6b60ef246","source":"wordfence","cve":"CVE-2024-6166","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9826c91c-0f6e-4d3b-bc14-4af6b60ef246?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.112","to_inclusive":true,"patched_in":"1.5.113"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T04:32:54Z"},{"id":"wordfence:982817f8-c85c-4e25-a33a-6fbf3ab06808","source":"wordfence","cve":"CVE-2012-4915","title":"Google Doc Embedder < 2.5.4 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982817f8-c85c-4e25-a33a-6fbf3ab06808?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2013-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98286172-99b0-43d6-9876-972e270aa19f","source":"wordfence","cve":"","title":"Theme Editor <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98286172-99b0-43d6-9876-972e270aa19f?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2019-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9829ec10-ad37-4345-b4d6-cd0429b2d8f7","source":"wordfence","cve":"CVE-2023-50840","title":"Booking Manager <= 2.1.5 - Authenticated(Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9829ec10-ad37-4345-b4d6-cd0429b2d8f7?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:982b23c5-2414-48f7-a2f5-96fef54f8d69","source":"wordfence","cve":"CVE-2025-12022","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982b23c5-2414-48f7-a2f5-96fef54f8d69?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-11-20T16:58:48Z","updated":"2025-11-21T05:32:07Z"},{"id":"wordfence:982b8880-650f-49a6-9877-c28ee35e9e1d","source":"wordfence","cve":"CVE-2026-85006","title":"Happy Addons for Elementor <= 3.49.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982b8880-650f-49a6-9877-c28ee35e9e1d?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.49.0","to_inclusive":true,"patched_in":"3.50.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:52:05Z"},{"id":"wordfence:982bc924-1dcd-47b5-b15a-4ff0ad123ad1","source":"wordfence","cve":"CVE-2024-9436","title":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982bc924-1dcd-47b5-b15a-4ff0ad123ad1?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"3.5.14","to_inclusive":true,"patched_in":"3.5.15"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:18Z"},{"id":"wordfence:982be9d7-fe9f-40c6-a474-fcc2d6455839","source":"wordfence","cve":"CVE-2022-33177","title":"Booking Calendar <= 9.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982be9d7-fe9f-40c6-a474-fcc2d6455839?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.2.1","to_inclusive":true,"patched_in":"9.2.2"}],"published":"2022-09-06T14:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:982fb304-08d6-4195-97a3-f18e94295492","source":"wordfence","cve":"CVE-2024-4443","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/982fb304-08d6-4195-97a3-f18e94295492?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2024-05-21T16:56:59Z","updated":"2024-05-22T05:32:51Z"},{"id":"wordfence:9831d7d4-14ba-4db5-99ea-72f366eda4d5","source":"wordfence","cve":"CVE-2025-5125","title":"Custom Post Carousels with Owl  <= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9831d7d4-14ba-4db5-99ea-72f366eda4d5?source=api-prod","affected":[{"type":"plugin","slug":"dd-post-carousel","name":"Custom Post Carousels with Owl","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2025-05-30T00:00:00Z","updated":"2025-07-09T15:10:11Z"},{"id":"wordfence:9831ebf6-a6a6-4495-8cda-969c7d7d3a6c","source":"wordfence","cve":"CVE-2022-1903","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9831ebf6-a6a6-4495-8cda-969c7d7d3a6c?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9832c598-aa12-4a98-8e0f-643ecbe75839","source":"wordfence","cve":"CVE-2020-8549","title":"Strong Testimonials <= 2.40.0 - Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9832c598-aa12-4a98-8e0f-643ecbe75839?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"2.40.0","to_inclusive":true,"patched_in":"2.40.1"}],"published":"2020-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98345631-45df-419b-aada-b7053a31b68c","source":"wordfence","cve":"CVE-2025-39400","title":"User Registration <= 4.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98345631-45df-419b-aada-b7053a31b68c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:23:36Z"},{"id":"wordfence:98347e88-c5ef-4695-9059-83bbaa10fc6b","source":"wordfence","cve":"CVE-2026-28041","title":"Grit - Life Coach & Business Coaching WordPress Theme <= 1.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98347e88-c5ef-4695-9059-83bbaa10fc6b?source=api-prod","affected":[{"type":"theme","slug":"grit","name":"Grit - Life Coach & Business Coaching WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:27:17Z"},{"id":"wordfence:9834fd5b-8445-4c6f-95f9-f0df785c65f8","source":"wordfence","cve":"CVE-2025-2266","title":"Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9834fd5b-8445-4c6f-95f9-f0df785c65f8?source=api-prod","affected":[{"type":"plugin","slug":"checkout-mestres-wp","name":"Checkout Mestres do WP for WooCommerce","from":"8.6.5","from_inclusive":true,"to":"8.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T18:37:10Z","updated":"2025-04-16T20:50:13Z"},{"id":"wordfence:983524ad-8696-4239-bee0-f0ef80d7180c","source":"wordfence","cve":"CVE-2026-95870","title":"wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983524ad-8696-4239-bee0-f0ef80d7180c?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-11-06T21:20:53Z","updated":"2026-11-07T09:25:47Z"},{"id":"wordfence:98358366-7cb0-40ae-a931-10985c916af1","source":"wordfence","cve":"CVE-2023-35912","title":"Potent Donations for WooCommerce <= 1.1.9 - Cross-Site Request Forgery in hm_wcdon_admin_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98358366-7cb0-40ae-a931-10985c916af1?source=api-prod","affected":[{"type":"plugin","slug":"donations-for-woocommerce","name":"Potent Donations for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98361cfd-1277-43fd-b0da-db2549628383","source":"wordfence","cve":"CVE-2021-24126","title":"Envira Gallery Lite <= 1.8.3.2 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98361cfd-1277-43fd-b0da-db2549628383?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.3.3","to_inclusive":false,"patched_in":"1.8.3.3"}],"published":"2020-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98386090-ff19-4e02-9f19-428da4494220","source":"wordfence","cve":"CVE-2024-55999","title":"XML Multilanguage Sitemap Generator <= 2.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98386090-ff19-4e02-9f19-428da4494220?source=api-prod","affected":[{"type":"plugin","slug":"xml-multilanguage-sitemap-generator","name":"XML Multilanguage Sitemap Generator","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:43:48Z"},{"id":"wordfence:983a5b15-adf7-4f34-bf2a-30857ada2753","source":"wordfence","cve":"CVE-2022-4485","title":"Page-list <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983a5b15-adf7-4f34-bf2a-30857ada2753?source=api-prod","affected":[{"type":"plugin","slug":"page-list","name":"Page-list","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:983a9501-cb09-436a-8b0d-392cfef8643b","source":"wordfence","cve":"CVE-2023-3499","title":"Robo Gallery <= 3.2.15 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983a9501-cb09-436a-8b0d-392cfef8643b?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2023-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:983b0fb8-a6e6-422e-ad90-325ad7aa628b","source":"wordfence","cve":"CVE-2026-25369","title":"Flexmls\u00ae IDX Plugin <= 3.15.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983b0fb8-a6e6-422e-ad90-325ad7aa628b?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.15.9","to_inclusive":true,"patched_in":"3.15.10"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-19T14:53:45Z"},{"id":"wordfence:983b4fac-cf27-4156-85a0-e4db90aee327","source":"wordfence","cve":"","title":"Felici Premium Magazine Theme <= 1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983b4fac-cf27-4156-85a0-e4db90aee327?source=api-prod","affected":[{"type":"theme","slug":"felici","name":"Felici - WordPress Magazine Theme | Blog / Magazine","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2013-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:983b91f1-d9a4-4035-82b4-2b81238b055f","source":"wordfence","cve":"CVE-2025-54731","title":"YouTube Showcase <= 3.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983b91f1-d9a4-4035-82b4-2b81238b055f?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T21:05:48Z"},{"id":"wordfence:983c603b-b9bb-4942-b554-345535886aea","source":"wordfence","cve":"","title":"World of Warcraft \u2013 Armory Table < 0.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983c603b-b9bb-4942-b554-345535886aea?source=api-prod","affected":[{"type":"plugin","slug":"world-of-warcraft-armory-table","name":"World of Warcraft \u2013 Armory Table","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":false,"patched_in":"0.2.6"}],"published":"2014-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:983e5334-85e3-476d-9f47-874a35f70177","source":"wordfence","cve":"CVE-2025-30907","title":"SecuPress Free <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983e5334-85e3-476d-9f47-874a35f70177?source=api-prod","affected":[{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.2.5.3","to_inclusive":true,"patched_in":"2.2.5.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:16:53Z"},{"id":"wordfence:983e8ec0-fec4-4420-8ef6-6bf43881f5f1","source":"wordfence","cve":"CVE-2023-48321","title":"Accelerated Mobile Pages <= 1.0.88.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/983e8ec0-fec4-4420-8ef6-6bf43881f5f1?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.88.1","to_inclusive":true,"patched_in":"1.0.89"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9841b57b-b869-4282-8781-60538f6f269f","source":"wordfence","cve":"CVE-2023-5205","title":"Add Custom Body Class <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9841b57b-b869-4282-8781-60538f6f269f?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-body-class","name":"Add Custom Body Class","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9846cb0e-fc68-4a1b-a5a5-63116289c369","source":"wordfence","cve":"CVE-2024-10792","title":"Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9846cb0e-fc68-4a1b-a5a5-63116289c369?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T09:32:49Z"},{"id":"wordfence:984b6387-98bf-4ee2-82fb-6af72e75af7f","source":"wordfence","cve":"CVE-2026-62036","title":"All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/984b6387-98bf-4ee2-82fb-6af72e75af7f?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:11:30Z"},{"id":"wordfence:984bfc69-e203-4a06-9d4b-2185ecf771bd","source":"wordfence","cve":"CVE-2017-18582","title":"Time Sheets < 1.5.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/984bfc69-e203-4a06-9d4b-2185ecf771bd?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2017-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:984ca0d3-26c3-40cf-8e77-2ec1e3b89ce2","source":"wordfence","cve":"CVE-2023-23868","title":"Cost of Goods for WooCommerce <= 2.8.6 - Missing Authorization in save_costs","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/984ca0d3-26c3-40cf-8e77-2ec1e3b89ce2?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:985115ca-56f0-48ca-ae58-f09e1cc80046","source":"wordfence","cve":"CVE-2025-22808","title":"Surbma | Premium WP <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/985115ca-56f0-48ca-ae58-f09e1cc80046?source=api-prod","affected":[{"type":"plugin","slug":"surbma-premium-wp","name":"Surbma | Premium WP","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"10.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:05:09Z"},{"id":"wordfence:98527ebf-26a3-4900-84b5-3d2245783e8e","source":"wordfence","cve":"","title":"BuddyPress BP Gallery Plus <= 1.2.5 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98527ebf-26a3-4900-84b5-3d2245783e8e?source=api-prod","affected":[{"type":"plugin","slug":"bp-gallery","name":"BuddyPress BP Gallery Plus","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9852e499-f413-4218-9bac-6c2be62ecc32","source":"wordfence","cve":"CVE-2021-4408","title":"DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9852e499-f413-4218-9bac-6c2be62ecc32?source=api-prod","affected":[{"type":"plugin","slug":"dw-question-answer","name":"DW Question & Answer","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98536242-64c7-4e02-aa00-a3efbf5c90d8","source":"wordfence","cve":"CVE-2024-1332","title":"Custom Fonts \u2013 Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98536242-64c7-4e02-aa00-a3efbf5c90d8?source=api-prod","affected":[{"type":"plugin","slug":"custom-fonts","name":"Custom Fonts \u2013 Host Your Fonts Locally","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-05-23T17:52:52Z","updated":"2024-05-24T06:42:19Z"},{"id":"wordfence:98536f33-eb3d-4b2f-bda3-97f8cf9e5b19","source":"wordfence","cve":"CVE-2024-52503","title":"Tailored Tools <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98536f33-eb3d-4b2f-bda3-97f8cf9e5b19?source=api-prod","affected":[{"type":"plugin","slug":"tailored-tools","name":"Tailored Tools","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-11-20T00:00:00Z","updated":"2026-09-09T15:50:04Z"},{"id":"wordfence:98541343-a23f-4e90-91c4-06cba4338281","source":"wordfence","cve":"CVE-2024-49658","title":"Woocommerce Custom Profile Picture <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98541343-a23f-4e90-91c4-06cba4338281?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-profile-picture","name":"Woocommerce Custom Profile Picture","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:21:00Z"},{"id":"wordfence:9854d09a-2fab-46e6-9fc1-ff6d68df2662","source":"wordfence","cve":"","title":"Request a Quote <= 2.3.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9854d09a-2fab-46e6-9fc1-ff6d68df2662?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":false,"patched_in":"2.3.11"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98553e47-f121-4300-b6d9-ab309516cf1d","source":"wordfence","cve":"CVE-2023-23878","title":"WP MAPS <= 4.3.9 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98553e47-f121-4300-b6d9-ab309516cf1d?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:985daa72-80be-477d-9c80-b7849c94a405","source":"wordfence","cve":"CVE-2025-68845","title":"eDS Responsive Menu <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/985daa72-80be-477d-9c80-b7849c94a405?source=api-prod","affected":[{"type":"plugin","slug":"eds-responsive-menu","name":"eDS Responsive Menu","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:20:18Z"},{"id":"wordfence:985dfe25-4860-477a-bd85-5bf3375b86db","source":"wordfence","cve":"CVE-2025-24736","title":"Post Duplicator <= 2.35 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/985dfe25-4860-477a-bd85-5bf3375b86db?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"2.35","to_inclusive":true,"patched_in":"2.36"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:37:28Z"},{"id":"wordfence:985fd6a4-282a-48e9-9149-69e6ee794667","source":"wordfence","cve":"","title":"Booster for WooCommerce <= 5.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/985fd6a4-282a-48e9-9149-69e6ee794667?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"5.5.9"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:985fdf6e-5070-48da-8cee-6ec3f2fecda4","source":"wordfence","cve":"CVE-2025-68579","title":"FV Simpler SEO <= 1.9.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/985fdf6e-5070-48da-8cee-6ec3f2fecda4?source=api-prod","affected":[{"type":"plugin","slug":"fv-all-in-one-seo-pack","name":"FV Simpler SEO","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T14:35:37Z"},{"id":"wordfence:9864507c-c09c-413c-ba5a-18792ba7598f","source":"wordfence","cve":"CVE-2024-56281","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9864507c-c09c-413c-ba5a-18792ba7598f?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:29:25Z"},{"id":"wordfence:986835a7-2f73-4139-b080-ca1f7af077fb","source":"wordfence","cve":"CVE-2025-58809","title":"To Lead For Salesforce <= 2.7.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/986835a7-2f73-4139-b080-ca1f7af077fb?source=api-prod","affected":[{"type":"plugin","slug":"salesforce-wordpress-to-lead","name":"Brilliant Web-to-Lead for Salesforce","from":"*","from_inclusive":true,"to":"2.7.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:18:05Z"},{"id":"wordfence:98691973-0d7a-4fab-8d23-4105647cf728","source":"wordfence","cve":"CVE-2024-52413","title":"Airin Blog <= 1.6.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98691973-0d7a-4fab-8d23-4105647cf728?source=api-prod","affected":[{"type":"theme","slug":"airin-blog","name":"Airin Blog","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-27T13:53:34Z"},{"id":"wordfence:986957ab-7394-457e-9a6f-f6b96b56cd15","source":"wordfence","cve":"","title":"Breadcrumbs Shortcode <= 1.44 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/986957ab-7394-457e-9a6f-f6b96b56cd15?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumbs-shortcode","name":"Breadcrumbs Shortcode","from":"*","from_inclusive":true,"to":"1.44","to_inclusive":true,"patched_in":"1.45"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:986d16d5-f1f4-4ed9-9978-0f12ee22a543","source":"wordfence","cve":"CVE-2023-24372","title":"Simple Custom Author Profiles <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/986d16d5-f1f4-4ed9-9978-0f12ee22a543?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-author-profiles","name":"Simple Custom Author Profiles","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:986e0252-b94d-4ac8-9083-0218fa8a651e","source":"wordfence","cve":"CVE-2026-3208","title":"Mercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/986e0252-b94d-4ac8-9083-0218fa8a651e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mercadopago","name":"Mercado Pago payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.7.11","to_inclusive":true,"patched_in":"8.7.12"}],"published":"2026-05-05T15:16:10Z","updated":"2026-05-06T03:27:21Z"},{"id":"wordfence:986f158e-1960-4105-b477-9587850aa0aa","source":"wordfence","cve":"CVE-2025-30533","title":"Message ticker <= 9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/986f158e-1960-4105-b477-9587850aa0aa?source=api-prod","affected":[{"type":"plugin","slug":"message-ticker","name":"Message ticker","from":"*","from_inclusive":true,"to":"9.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:36:32Z"},{"id":"wordfence:9870db7f-0c8e-44a4-aa0f-13709d773756","source":"wordfence","cve":"CVE-2024-1230","title":"SimpleShop <= 2.10.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9870db7f-0c8e-44a4-aa0f-13709d773756?source=api-prod","affected":[{"type":"plugin","slug":"simpleshop-cz","name":"SimpleShop","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:34Z"},{"id":"wordfence:98719f12-d100-4f72-a8fa-61205a24784d","source":"wordfence","cve":"CVE-2026-42666","title":"Salon Booking System \u2013 Free Version <= 10.30.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98719f12-d100-4f72-a8fa-61205a24784d?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.25","to_inclusive":true,"patched_in":"10.30.26"}],"published":"2026-05-10T00:00:00Z","updated":"2026-05-19T13:19:07Z"},{"id":"wordfence:98719f1b-31ac-4a21-9c4c-c404f39dede5","source":"wordfence","cve":"CVE-2026-113489","title":"GeoDirectory <= 2.8.193 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98719f1b-31ac-4a21-9c4c-c404f39dede5?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:17:43Z"},{"id":"wordfence:9871f683-136e-45b5-90fb-a373a771014b","source":"wordfence","cve":"CVE-2024-7447","title":"Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor \u2013 Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9871f683-136e-45b5-90fb-a373a771014b?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.7.3.2","to_inclusive":true,"patched_in":"3.7.4.1"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T11:31:25Z"},{"id":"wordfence:98730677-200b-4b1a-8568-7af8b2b0e94b","source":"wordfence","cve":"","title":"Welcome Bar <= 2.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98730677-200b-4b1a-8568-7af8b2b0e94b?source=api-prod","affected":[{"type":"plugin","slug":"intelly-welcome-bar","name":"Welcome Bar","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98736b9d-3e0a-40c0-900a-fbbaaac07958","source":"wordfence","cve":"CVE-2026-1082","title":"TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98736b9d-3e0a-40c0-900a-fbbaaac07958?source=api-prod","affected":[{"type":"plugin","slug":"title-animator","name":"TITLE ANIMATOR","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:24:28Z","updated":"2026-02-07T08:26:39Z"},{"id":"wordfence:98780ecc-fb45-4392-955d-ddecf9f7fca1","source":"wordfence","cve":"CVE-2023-37388","title":"Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98780ecc-fb45-4392-955d-ddecf9f7fca1?source=api-prod","affected":[{"type":"plugin","slug":"only-tweet-like-share-and-google-1","name":"Simple Light Weight Social Share (Tweet, Like, Share and Linkedin)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9879150f-ea35-4b05-af67-06f82714c430","source":"wordfence","cve":"CVE-2024-35689","title":"Analytify \u2013 Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9879150f-ea35-4b05-af67-06f82714c430?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:45:07Z"},{"id":"wordfence:987dcb6e-0f58-484f-9e9d-5ac721c145ca","source":"wordfence","cve":"CVE-2024-34563","title":"Gold Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/987dcb6e-0f58-484f-9e9d-5ac721c145ca?source=api-prod","affected":[{"type":"plugin","slug":"gold-addons-for-elementor","name":"Gold Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:47:51Z"},{"id":"wordfence:987e228b-3a89-463e-aa4f-52d9edf911b2","source":"wordfence","cve":"CVE-2024-49625","title":"SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/987e228b-3a89-463e-aa4f-52d9edf911b2?source=api-prod","affected":[{"type":"plugin","slug":"sitebuilder-dynamic-components","name":"SiteBuilder Dynamic Components","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:40:23Z"},{"id":"wordfence:987ecbdb-d669-493d-a0bc-4d74f312d129","source":"wordfence","cve":"CVE-2026-97075","title":"WP Rocket < 3.23.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/987ecbdb-d669-493d-a0bc-4d74f312d129?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"*","from_inclusive":true,"to":"3.23.5","to_inclusive":false,"patched_in":"3.23.5"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:39:10Z"},{"id":"wordfence:98859214-7acf-4d40-9291-b5669b9614b7","source":"wordfence","cve":"CVE-2024-13453","title":"Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98859214-7acf-4d40-9291-b5669b9614b7?source=api-prod","affected":[{"type":"plugin","slug":"pirate-forms","name":"Contact Form & SMTP Plugin for WordPress by PirateForms","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-01-29T21:22:01Z","updated":"2025-01-30T11:10:21Z"},{"id":"wordfence:9889aa40-c4a4-4218-918a-57c5dc17e076","source":"wordfence","cve":"CVE-2024-56026","title":"Simple Proxy <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9889aa40-c4a4-4218-918a-57c5dc17e076?source=api-prod","affected":[{"type":"plugin","slug":"simple-proxy","name":"Simple Proxy","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:05:22Z"},{"id":"wordfence:9889e718-381b-4d11-a234-0278037c61c4","source":"wordfence","cve":"CVE-2026-97645","title":"Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9889e718-381b-4d11-a234-0278037c61c4?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-10-29T18:25:02Z","updated":"2026-10-30T06:47:31Z"},{"id":"wordfence:988a7d0a-72d2-4962-bcb4-b08859de925c","source":"wordfence","cve":"CVE-2024-11332","title":"HIPAA Compliant Forms with Drag\u2019n\u2019Drop HIPAA Form Builder. Sign HIPAA documents <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988a7d0a-72d2-4962-bcb4-b08859de925c?source=api-prod","affected":[{"type":"plugin","slug":"hipaatizer","name":"HIPAA Compliant Forms with Drag\u2019n\u2019Drop HIPAA Form Builder. Sign HIPAA documents","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:24Z"},{"id":"wordfence:988ba837-4711-4111-bbd1-6edaac663810","source":"wordfence","cve":"CVE-2026-74853","title":"Pods \u2013 Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988ba837-4711-4111-bbd1-6edaac663810?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3.3","from_inclusive":true,"to":"3.3.9.1","to_inclusive":true,"patched_in":"3.3.9.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:22:16Z"},{"id":"wordfence:988bc04a-9294-4433-b4b2-d7ccf2e08297","source":"wordfence","cve":"CVE-2025-64252","title":"ANAC XML Viewer <= 1.8.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988bc04a-9294-4433-b4b2-d7ccf2e08297?source=api-prod","affected":[{"type":"plugin","slug":"anac-xml-viewer","name":"ANAC XML Viewer","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-11-26T00:00:00Z","updated":"2026-01-19T18:12:59Z"},{"id":"wordfence:988c1968-ef92-4d3d-bbd5-88e73512ebb4","source":"wordfence","cve":"","title":"Require & Limit Categories, Tags, Featured Image and taxonomies <= 1.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988c1968-ef92-4d3d-bbd5-88e73512ebb4?source=api-prod","affected":[{"type":"plugin","slug":"require-taxonomy-image-category-tag","name":"Require & Limit Categories, Tags, Featured Image and taxonomies","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.27"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:988c30f7-5f04-4ee5-b3d5-0dd66d23e1cc","source":"wordfence","cve":"CVE-2026-59519","title":"FormLayer <= 1.0.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988c30f7-5f04-4ee5-b3d5-0dd66d23e1cc?source=api-prod","affected":[{"type":"plugin","slug":"formlayer","name":"FormLayer","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-07-05T00:00:00Z","updated":"2026-07-08T19:50:10Z"},{"id":"wordfence:988d7b33-f985-4d22-a2db-3922002fcecb","source":"wordfence","cve":"CVE-2020-36840","title":"Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988d7b33-f985-4d22-a2db-3922002fcecb?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2020-04-21T00:00:00Z","updated":"2024-10-16T07:31:50Z"},{"id":"wordfence:988f102e-08b6-4436-be03-fc37a4084ca1","source":"wordfence","cve":"CVE-2022-4256","title":"All-in-One Addons for Elementor - WidgetKit <= 2.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/988f102e-08b6-4436-be03-fc37a4084ca1?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98907ef3-7c54-4d08-9eb4-2409f1de893f","source":"wordfence","cve":"CVE-2025-58919","title":"Wide Banner <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98907ef3-7c54-4d08-9eb4-2409f1de893f?source=api-prod","affected":[{"type":"plugin","slug":"wide-banner","name":"Wide Banner","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-22T14:19:40Z"},{"id":"wordfence:9890c852-a38d-4429-bd75-751bd0f986fc","source":"wordfence","cve":"CVE-2022-45808","title":"LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9890c852-a38d-4429-bd75-751bd0f986fc?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.7.3.2","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9891587b-2a63-41be-b79d-afe407dd57fa","source":"wordfence","cve":"CVE-2023-7049","title":"Custom Field For WP Job Manager <= 1.2 -  Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9891587b-2a63-41be-b79d-afe407dd57fa?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-for-wp-job-manager","name":"Custom Field For WP Job Manager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T01:59:59Z"},{"id":"wordfence:989836fc-a15d-4424-be0e-348e1acc7466","source":"wordfence","cve":"CVE-2023-40199","title":"WP Like Button <= 1.6.11 - Cross-Site Request Forgery via 'saveData'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989836fc-a15d-4424-be0e-348e1acc7466?source=api-prod","affected":[{"type":"plugin","slug":"wp-like-button","name":"WP Like Button","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98994612-c9b4-45a1-afc1-5d7a0712376d","source":"wordfence","cve":"CVE-2025-23629","title":"Gallerio <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98994612-c9b4-45a1-afc1-5d7a0712376d?source=api-prod","affected":[{"type":"plugin","slug":"gallerio","name":"Gallerio","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:47:19Z"},{"id":"wordfence:98994c7d-87a0-4b35-beb4-34f4c140dac9","source":"wordfence","cve":"CVE-2026-16547","title":"REST API Log <= 1.7.0 - Missing Authorization to Unauthenticated Sensitive Log Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98994c7d-87a0-4b35-beb4-34f4c140dac9?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-log","name":"REST API Log","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:25:00Z"},{"id":"wordfence:989b4b9d-e22e-46a7-8ebc-5c8b33f98111","source":"wordfence","cve":"CVE-2025-13999","title":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989b4b9d-e22e-46a7-8ebc-5c8b33f98111?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"2.4.0","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-12-18T18:14:27Z","updated":"2025-12-19T06:48:25Z"},{"id":"wordfence:989bd778-c7b2-41c5-ac4a-2f1a4e594f0d","source":"wordfence","cve":"CVE-2024-0598","title":"Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989bd778-c7b2-41c5-ac4a-2f1a4e594f0d?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.17","to_inclusive":true,"patched_in":"3.2.18"}],"published":"2024-04-02T00:00:00Z","updated":"2024-07-29T21:36:55Z"},{"id":"wordfence:989e666c-4187-4220-9c1b-dd43c8a72c70","source":"wordfence","cve":"CVE-2026-16253","title":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid < 1.17.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989e666c-4187-4220-9c1b-dd43c8a72c70?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.17.3","to_inclusive":false,"patched_in":"1.17.3"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:46:31Z"},{"id":"wordfence:989f0e0b-8a57-4435-95b0-21fec215112d","source":"wordfence","cve":"CVE-2025-3054","title":"WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989f0e0b-8a57-4435-95b0-21fec215112d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend-pro","name":"WP User Frontend Pro","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-06-04T16:33:46Z","updated":"2025-06-05T05:23:01Z"},{"id":"wordfence:989f312b-9c6c-44e1-9c4c-03917c8ec296","source":"wordfence","cve":"CVE-2025-58657","title":"Grid <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989f312b-9c6c-44e1-9c4c-03917c8ec296?source=api-prod","affected":[{"type":"plugin","slug":"grid","name":"Grid Landing Page Editor","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T18:12:26Z"},{"id":"wordfence:989f4c4b-e0d6-4755-89ef-6cf4624f5473","source":"wordfence","cve":"CVE-2022-2034","title":"Sensei LMS <= 4.4.3 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/989f4c4b-e0d6-4755-89ef-6cf4624f5473?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2022-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98a2570c-c757-44ad-9981-af0bf2d3c341","source":"wordfence","cve":"CVE-2022-41786","title":"WP Job Portal <= 2.0.1 - Cross-Site Request Forgery to Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a2570c-c757-44ad-9981-af0bf2d3c341?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-05-05T00:00:00Z","updated":"2024-10-15T18:46:38Z"},{"id":"wordfence:98a274eb-036f-44f1-861d-1cfea0b34d7f","source":"wordfence","cve":"CVE-2024-31241","title":"LearnPress Export Import <= 4.0.3 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a274eb-036f-44f1-861d-1cfea0b34d7f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:13:05Z"},{"id":"wordfence:98a734d2-ea6f-4053-94b5-d20d6418b3ae","source":"wordfence","cve":"CVE-2024-37235","title":"Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a734d2-ea6f-4053-94b5-d20d6418b3ae?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"3.4.2.3","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-26T21:39:37Z"},{"id":"wordfence:98a73a02-33fa-4dd4-9606-3d35d58c2398","source":"wordfence","cve":"CVE-2024-43322","title":"Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a73a02-33fa-4dd4-9606-3d35d58c2398?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.100","to_inclusive":true,"patched_in":"3.3.101"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:28:06Z"},{"id":"wordfence:98a7572d-9642-4150-8112-c0fa2b25ae05","source":"wordfence","cve":"CVE-2026-1944","title":"CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a7572d-9642-4150-8112-c0fa2b25ae05?source=api-prod","affected":[{"type":"plugin","slug":"callbackkiller-service-widget","name":"CallbackKiller service widget","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:24:51Z","updated":"2026-02-14T06:42:30Z"},{"id":"wordfence:98a953b9-60e1-4445-a61e-88d5867895eb","source":"wordfence","cve":"CVE-2025-69345","title":"Post and Page Builder by BoldGrid <= 1.27.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98a953b9-60e1-4445-a61e-88d5867895eb?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.9","to_inclusive":true,"patched_in":"1.27.10"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T15:05:26Z"},{"id":"wordfence:98ab264f-b210-41d0-bb6f-b4f31d933f80","source":"wordfence","cve":"CVE-2022-3342","title":"Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ab264f-b210-41d0-bb6f-b4f31d933f80?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98ab4a17-c350-49a9-921d-7ef04e923110","source":"wordfence","cve":"CVE-2025-30979","title":"Pixelating image slideshow gallery <= 8.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ab4a17-c350-49a9-921d-7ef04e923110?source=api-prod","affected":[{"type":"plugin","slug":"pixelating-image-slideshow-gallery","name":"Pixelating image slideshow gallery","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:58:30Z"},{"id":"wordfence:98acac5c-65d7-4aaf-adcc-a58515c28fc3","source":"wordfence","cve":"CVE-2017-6818","title":"WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98acac5c-65d7-4aaf-adcc-a58515c28fc3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98adce63-69e6-4a3b-97fe-ecd0480659f4","source":"wordfence","cve":"CVE-2021-24844","title":"Affiliate Manager <= 2.8.6 - Admin+ SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98adce63-69e6-4a3b-97fe-ecd0480659f4?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98ae3315-8361-43bb-be2c-1564f4df8d5b","source":"wordfence","cve":"CVE-2022-47446","title":"Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ae3315-8361-43bb-be2c-1564f4df8d5b?source=api-prod","affected":[{"type":"plugin","slug":"store-locator","name":"Store Locator for WordPress with Google Maps \u2013 LotsOfLocales","from":"*","from_inclusive":true,"to":"3.98.7","to_inclusive":true,"patched_in":"3.98.8"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98aed079-672c-43bb-a5eb-faf8ffc04b71","source":"wordfence","cve":"CVE-2024-10308","title":"Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98aed079-672c-43bb-a5eb-faf8ffc04b71?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T11:04:35Z"},{"id":"wordfence:98b172d3-9751-4a55-8327-57ca7abf8a20","source":"wordfence","cve":"CVE-2025-23545","title":"WP Social Broadcast <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98b172d3-9751-4a55-8327-57ca7abf8a20?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-broadcast","name":"WP Social Broadcast","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:44:56Z"},{"id":"wordfence:98b38844-c6fe-4655-8bbe-7600203b567e","source":"wordfence","cve":"CVE-2026-12103","title":"Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98b38844-c6fe-4655-8bbe-7600203b567e?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-07-10T17:34:12Z","updated":"2026-07-11T05:35:49Z"},{"id":"wordfence:98b87082-c5ec-4354-9937-df692a03f84d","source":"wordfence","cve":"CVE-2026-40801","title":"Wordable \u2013 Export Google Docs to WordPress <= 8.2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98b87082-c5ec-4354-9937-df692a03f84d?source=api-prod","affected":[{"type":"plugin","slug":"wordable","name":"Wordable \u2013 Export Google Docs to WordPress","from":"*","from_inclusive":true,"to":"8.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:27:45Z"},{"id":"wordfence:98bacd8c-8bd3-4b18-9aab-41a60784b8ce","source":"wordfence","cve":"CVE-2026-102393","title":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98bacd8c-8bd3-4b18-9aab-41a60784b8ce?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2026-10-05T08:55:00Z","updated":"2026-10-08T23:12:55Z"},{"id":"wordfence:98bbec12-25f5-429c-a926-e8da34945962","source":"wordfence","cve":"CVE-2026-32445","title":"Elementor Website Builder <= 3.35.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98bbec12-25f5-429c-a926-e8da34945962?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.35.5","to_inclusive":true,"patched_in":"3.35.6"}],"published":"2026-03-07T00:00:00Z","updated":"2026-04-15T21:21:08Z"},{"id":"wordfence:98be1eb8-ee7d-4a39-b70f-5037b651ba96","source":"wordfence","cve":"","title":"Pixel Cat \u2013 Conversion Pixel Manager <= 2.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98be1eb8-ee7d-4a39-b70f-5037b651ba96?source=api-prod","affected":[{"type":"plugin","slug":"facebook-conversion-pixel","name":"Pixel Cat \u2013 Conversion Pixel Manager","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2021-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98beda7c-7896-4b53-b22a-83aac79563fa","source":"wordfence","cve":"CVE-2025-25148","title":"Read More Copy Link <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98beda7c-7896-4b53-b22a-83aac79563fa?source=api-prod","affected":[{"type":"plugin","slug":"read-more-copy-link","name":"Read More Copy Link","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:28:08Z"},{"id":"wordfence:98bff131-dee2-4549-9167-69dc3f8d6b9d","source":"wordfence","cve":"CVE-2024-2127","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98bff131-dee2-4549-9167-69dc3f8d6b9d?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-07T19:33:04Z"},{"id":"wordfence:98c1363e-b25d-46fc-b6bf-0285a37f748c","source":"wordfence","cve":"CVE-2025-6746","title":"WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c1363e-b25d-46fc-b6bf-0285a37f748c?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.2.3","to_inclusive":true,"patched_in":"8.2.4"}],"published":"2025-07-07T17:24:44Z","updated":"2025-07-08T06:41:58Z"},{"id":"wordfence:98c263b5-8de6-4a75-9f4c-9756d6f3a050","source":"wordfence","cve":"CVE-2026-23544","title":"Valenti <= 5.6.3.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c263b5-8de6-4a75-9f4c-9756d6f3a050?source=api-prod","affected":[{"type":"theme","slug":"valenti","name":"Valenti","from":"*","from_inclusive":true,"to":"5.6.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-25T15:12:13Z"},{"id":"wordfence:98c2d04d-c401-411f-8bf0-4aebb1779e8d","source":"wordfence","cve":"CVE-2022-40311","title":"Analytics Cat \u2013 Google Analytics Made Easy <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c2d04d-c401-411f-8bf0-4aebb1779e8d?source=api-prod","affected":[{"type":"plugin","slug":"analytics-cat","name":"Analytics Cat \u2013 Google Analytics Made Easy","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98c3762b-9dcd-4931-846e-3f54fe2bf5e2","source":"wordfence","cve":"CVE-2026-8845","title":"Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c3762b-9dcd-4931-846e-3f54fe2bf5e2?source=api-prod","affected":[{"type":"plugin","slug":"islamic-database","name":"Islamic Database","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:13Z","updated":"2026-05-27T05:31:28Z"},{"id":"wordfence:98c4192c-cf2c-46af-8c7b-02b59372f410","source":"wordfence","cve":"CVE-2025-60070","title":"Molla <= 1.5.13 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c4192c-cf2c-46af-8c7b-02b59372f410?source=api-prod","affected":[{"type":"theme","slug":"molla","name":"Molla - eCommerce HTML5 Template","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":true,"patched_in":""}],"published":"2025-08-02T00:00:00Z","updated":"2025-12-20T20:31:59Z"},{"id":"wordfence:98c4cecd-97e8-4f40-bd70-c05d9c85f3c2","source":"wordfence","cve":"CVE-2025-54734","title":"B Slider <= 1.1.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c4cecd-97e8-4f40-bd70-c05d9c85f3c2?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:43:23Z"},{"id":"wordfence:98c546dd-6a63-4aaf-9e50-59419dd37e16","source":"wordfence","cve":"CVE-2025-28936","title":"Lunar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c546dd-6a63-4aaf-9e50-59419dd37e16?source=api-prod","affected":[{"type":"plugin","slug":"lunar-sell-photos-online","name":"Lunar \u2013 Sell photos online","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:20:20Z"},{"id":"wordfence:98c9c9cb-ca35-461e-9ca6-733012332fd6","source":"wordfence","cve":"","title":"MakeStories (for Web Stories) <= 2.6.4 - Cross-Ste Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98c9c9cb-ca35-461e-9ca6-733012332fd6?source=api-prod","affected":[{"type":"plugin","slug":"makestories-helper","name":"MakeStories (for Google Web Stories)","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98ca009b-0e15-4945-a5c3-b08c081e7577","source":"wordfence","cve":"CVE-2025-62023","title":"s2Member <= 250905 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ca009b-0e15-4945-a5c3-b08c081e7577?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"250905","to_inclusive":true,"patched_in":"251005"}],"published":"2025-10-01T00:00:00Z","updated":"2025-10-29T16:20:15Z"},{"id":"wordfence:98cb9fdd-d01d-4ad2-a617-6c0da702e8fd","source":"wordfence","cve":"CVE-2024-37501","title":"Advanced Classifieds & Directory Pro <= 3.1.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98cb9fdd-d01d-4ad2-a617-6c0da702e8fd?source=api-prod","affected":[{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:17:29Z"},{"id":"wordfence:98ccc604-79c6-4be9-acb0-23fc82a31dfa","source":"wordfence","cve":"CVE-2024-3806","title":"Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ccc604-79c6-4be9-acb0-23fc82a31dfa?source=api-prod","affected":[{"type":"theme","slug":"porto","name":"Porto","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:34Z"},{"id":"wordfence:98cf2a10-cc53-4479-87d1-71489f6a8c51","source":"wordfence","cve":"CVE-2021-4434","title":"Social Warfare <= 3.5.2 - Remote Code Execution","severity":"critical","cvss":10.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98cf2a10-cc53-4479-87d1-71489f6a8c51?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2021-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98cf616d-6c9a-4a86-937d-535211e32bf1","source":"wordfence","cve":"CVE-2026-24949","title":"PhotoMe <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98cf616d-6c9a-4a86-937d-535211e32bf1?source=api-prod","affected":[{"type":"theme","slug":"photome","name":"PhotoMe | Photography Portfolio WordPress","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:02:32Z"},{"id":"wordfence:98d008a4-5dbf-410f-8753-d5aeb28b4447","source":"wordfence","cve":"CVE-2015-5471","title":"Swim Team < 1.45.1085 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98d008a4-5dbf-410f-8753-d5aeb28b4447?source=api-prod","affected":[{"type":"plugin","slug":"wp-swimteam","name":"Swim Team","from":"*","from_inclusive":true,"to":"1.44.1077","to_inclusive":true,"patched_in":"1.45.1085"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98d33b73-9c4b-477c-9a1c-17c792df3b1b","source":"wordfence","cve":"CVE-2025-23968","title":"AiBud WP <= 1.8.5 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98d33b73-9c4b-477c-9a1c-17c792df3b1b?source=api-prod","affected":[{"type":"plugin","slug":"aibuddy-openai-chatgpt","name":"AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T00:00:00Z","updated":"2026-06-09T11:07:06Z"},{"id":"wordfence:98d3aa11-346e-4e1f-9c52-3b21b77b52e6","source":"wordfence","cve":"CVE-2026-18501","title":"UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98d3aa11-346e-4e1f-9c52-3b21b77b52e6?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.69","to_inclusive":true,"patched_in":"1.2.70"}],"published":"2026-08-06T00:53:00Z","updated":"2026-08-06T13:27:13Z"},{"id":"wordfence:98d9b95f-7ea5-4650-8a19-0b257efdf776","source":"wordfence","cve":"CVE-2026-85572","title":"Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98d9b95f-7ea5-4650-8a19-0b257efdf776?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:56:17Z"},{"id":"wordfence:98dcf0a0-7310-41b4-b622-092ed689159a","source":"wordfence","cve":"CVE-2025-22262","title":"Bonjour Bar <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98dcf0a0-7310-41b4-b622-092ed689159a?source=api-prod","affected":[{"type":"plugin","slug":"bonjour-bar","name":"bonjour-bar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T15:06:29Z"},{"id":"wordfence:98dd1333-81ee-4036-a738-03a3f0a0022d","source":"wordfence","cve":"CVE-2026-110002","title":"Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98dd1333-81ee-4036-a738-03a3f0a0022d?source=api-prod","affected":[{"type":"plugin","slug":"snazzy-cacheable-facebook-feed","name":"Snazzy Social Media Feed","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T13:49:30Z","updated":"2026-10-14T02:27:37Z"},{"id":"wordfence:98de0a50-8464-4ea6-bf55-add9aab2d716","source":"wordfence","cve":"CVE-2024-12451","title":"HTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98de0a50-8464-4ea6-bf55-add9aab2d716?source=api-prod","affected":[{"type":"plugin","slug":"html5-chat","name":"HTML5 Chat","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":"1.08"}],"published":"2025-01-30T00:40:39Z","updated":"2026-01-23T20:40:26Z"},{"id":"wordfence:98df88f8-5aeb-4f57-8525-6a9357173b1d","source":"wordfence","cve":"CVE-2024-13353","title":"Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98df88f8-5aeb-4f57-8525-6a9357173b1d?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-02-20T21:19:13Z","updated":"2025-02-21T09:21:07Z"},{"id":"wordfence:98df8fbb-51c3-4b6c-8f99-56abfe11447e","source":"wordfence","cve":"CVE-2016-10950","title":"Image Optimizer, Resizer and CDN \u2013 Sirv < 1.3.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98df8fbb-51c3-4b6c-8f99-56abfe11447e?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2016-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98df96ad-32ef-44e2-8dc1-e7c38e3f9c74","source":"wordfence","cve":"CVE-2025-31797","title":"Sprout Clients <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98df96ad-32ef-44e2-8dc1-e7c38e3f9c74?source=api-prod","affected":[{"type":"plugin","slug":"sprout-clients","name":"Sprout Clients \u2013 CRM and Lead Management","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-07T14:04:29Z"},{"id":"wordfence:98dffc17-ac45-4ccd-ae57-96b36bd02be3","source":"wordfence","cve":"CVE-2023-34028","title":"WOLF <= 1.0.7 - Cross-Site Request Forgery via create_profile","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98dffc17-ac45-4ccd-ae57-96b36bd02be3?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.7.1"}],"published":"2023-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98e0d103-2369-4c6a-93ae-6be2a1770bae","source":"wordfence","cve":"","title":"Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log_verbosity","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e0d103-2369-4c6a-93ae-6be2a1770bae?source=api-prod","affected":[{"type":"plugin","slug":"integration-dynamics","name":"Dynamics 365 Integration","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98e1468e-b36a-426c-aa9e-f086c052d645","source":"wordfence","cve":"CVE-2024-37958","title":"Meks Smart Author Widget <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e1468e-b36a-426c-aa9e-f086c052d645?source=api-prod","affected":[{"type":"plugin","slug":"meks-smart-author-widget","name":"Meks Smart Author Widget","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-01T20:10:13Z"},{"id":"wordfence:98e22884-f7d6-47df-9b1b-9232c48e3685","source":"wordfence","cve":"CVE-2023-0274","title":"URL Params <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e22884-f7d6-47df-9b1b-9232c48e3685?source=api-prod","affected":[{"type":"plugin","slug":"url-params","name":"URL Params","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98e47920-fb99-478d-9d6c-1612e8b4aca1","source":"wordfence","cve":"CVE-2017-18492","title":"Contact Form to DB <= 1.5.6 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e47920-fb99-478d-9d6c-1612e8b4aca1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98e74a23-b586-4d6a-b1ab-78838b0eed61","source":"wordfence","cve":"CVE-2024-3990","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e74a23-b586-4d6a-b1ab-78838b0eed61?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:35Z"},{"id":"wordfence:98e82ea8-3d92-4ce3-a280-2def3ab5430f","source":"wordfence","cve":"CVE-2026-57327","title":"MainWP Dashboard: Self-hosted WordPress Management for Agencies <= 6.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e82ea8-3d92-4ce3-a280-2def3ab5430f?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:12:33Z"},{"id":"wordfence:98e883a5-4178-4f24-ba28-73760038d277","source":"wordfence","cve":"CVE-2025-58821","title":"WP Notification Bell <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e883a5-4178-4f24-ba28-73760038d277?source=api-prod","affected":[{"type":"plugin","slug":"wp-notification-bell","name":"WP Notification Bell","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-09-05T00:00:00Z","updated":"2026-03-17T21:25:18Z"},{"id":"wordfence:98e8e09c-f2fe-40ab-b1ce-62a1627b6b65","source":"wordfence","cve":"CVE-2023-47241","title":"CoCart \u2013 Headless ecommerce <= 3.11.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e8e09c-f2fe-40ab-b1ce-62a1627b6b65?source=api-prod","affected":[{"type":"plugin","slug":"cart-rest-api-for-woocommerce","name":"CoCart \u2013 Headless REST API for WooCommerce","from":"*","from_inclusive":true,"to":"3.11.2","to_inclusive":true,"patched_in":"3.12.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-28T23:37:48Z"},{"id":"wordfence:98e9c18b-5118-41cf-b6b9-e8c8a62a8f87","source":"wordfence","cve":"CVE-2026-32506","title":"Archicon < 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98e9c18b-5118-41cf-b6b9-e8c8a62a8f87?source=api-prod","affected":[{"type":"theme","slug":"archicon","name":"Archicon - Architecture and Construction WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:55:15Z"},{"id":"wordfence:98ebcc70-58c3-4c9d-a1cd-776c159647ed","source":"wordfence","cve":"CVE-2023-22688","title":"WP Tabs Slides <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ebcc70-58c3-4c9d-a1cd-776c159647ed?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-tabs-slides","name":"WP Tabs Slides","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98ed4279-6ceb-427a-8b8c-08fc9cf39125","source":"wordfence","cve":"CVE-2026-110132","title":"Sync Post With Other Site <= 1.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ed4279-6ceb-427a-8b8c-08fc9cf39125?source=api-prod","affected":[{"type":"plugin","slug":"sync-post-with-other-site","name":"Sync Post With Other Site","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:13:32Z"},{"id":"wordfence:98ef6eeb-9fd5-4ecc-a75a-e17884b9d41a","source":"wordfence","cve":"CVE-2025-13533","title":"CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ef6eeb-9fd5-4ecc-a75a-e17884b9d41a?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"12.0.6","to_inclusive":true,"patched_in":"12.0.7"}],"published":"2026-09-17T19:51:27Z","updated":"2026-09-18T08:28:31Z"},{"id":"wordfence:98ef80a3-4d57-45ae-87cf-d5768b26c27e","source":"wordfence","cve":"CVE-2023-4252","title":"EventPrime <= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98ef80a3-4d57-45ae-87cf-d5768b26c27e?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80","source":"wordfence","cve":"CVE-2026-9848","title":"WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2026-06-12T14:23:52Z","updated":"2026-06-13T02:29:03Z"},{"id":"wordfence:98f33f02-a46e-4578-a46b-0f355329aff8","source":"wordfence","cve":"CVE-2024-10637","title":"Kadence Blocks <= 3.2.53 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f33f02-a46e-4578-a46b-0f355329aff8?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.53","to_inclusive":true,"patched_in":"3.2.54"}],"published":"2024-11-21T00:00:00Z","updated":"2025-01-17T13:02:17Z"},{"id":"wordfence:98f71c32-9453-4598-acb5-242818508c74","source":"wordfence","cve":"CVE-2025-12450","title":"LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f71c32-9453-4598-acb5-242818508c74?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.5.0.1","to_inclusive":true,"patched_in":"7.6"}],"published":"2025-10-28T00:00:00Z","updated":"2025-10-29T09:28:00Z"},{"id":"wordfence:98f80608-f24f-4019-a757-de71cba9902f","source":"wordfence","cve":"CVE-2023-5665","title":"Payment Forms for Paystack <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f80608-f24f-4019-a757-de71cba9902f?source=api-prod","affected":[{"type":"plugin","slug":"payment-forms-for-paystack","name":"Payment Forms for Paystack","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-02-07T00:00:00Z","updated":"2024-10-18T13:53:10Z"},{"id":"wordfence:98f87769-d4e4-4e27-9acf-a4e52bdbf734","source":"wordfence","cve":"CVE-2021-24525","title":"WordPress Shortcodes Plugin \u2014 Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f87769-d4e4-4e27-9acf-a4e52bdbf734?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":false,"patched_in":"5.10.2"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:98f8a524-b0b8-4e11-b789-bed3bd257a10","source":"wordfence","cve":"CVE-2025-8902","title":"Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=api-prod","affected":[{"type":"plugin","slug":"extended-widget-options","name":"Widget Options - Extended","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-23T03:34:35Z"},{"id":"wordfence:98fe007e-5a14-4a8b-9aa7-6ce836a3411e","source":"wordfence","cve":"CVE-2025-22546","title":"jQuery TwentyTwenty <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/98fe007e-5a14-4a8b-9aa7-6ce836a3411e?source=api-prod","affected":[{"type":"plugin","slug":"js-twentytwenty","name":"TwentyTwenty Compare","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-07T00:00:00Z","updated":"2026-08-14T15:13:02Z"},{"id":"wordfence:9901b35b-86af-4b1a-9a43-73db9de559e4","source":"wordfence","cve":"CVE-2026-94235","title":"Simple User Registration <= 6.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9901b35b-86af-4b1a-9a43-73db9de559e4?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T14:45:39Z"},{"id":"wordfence:99051b12-5a24-4108-9ea4-81f37a1c1b35","source":"wordfence","cve":"CVE-2026-2595","title":"Quads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99051b12-5a24-4108-9ea4-81f37a1c1b35?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"2.0.98.1","to_inclusive":true,"patched_in":"2.0.99"}],"published":"2026-03-27T23:01:01Z","updated":"2026-03-28T11:26:35Z"},{"id":"wordfence:9905517f-236c-4e98-8026-8d54bf64c7c9","source":"wordfence","cve":"CVE-2023-23871","title":"Button <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9905517f-236c-4e98-8026-8d54bf64c7c9?source=api-prod","affected":[{"type":"plugin","slug":"button","name":"Button","from":"*","from_inclusive":true,"to":"1.1.22","to_inclusive":true,"patched_in":"1.1.23"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9909b7e3-4c6b-478e-8775-99779b21b0c1","source":"wordfence","cve":"CVE-2026-23978","title":"Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9909b7e3-4c6b-478e-8775-99779b21b0c1?source=api-prod","affected":[{"type":"plugin","slug":"gyan-elements","name":"Gyan Elements","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-02-01T00:00:00Z","updated":"2026-02-03T20:44:12Z"},{"id":"wordfence:990b3318-e3e1-4a19-875c-80d5d639ca4a","source":"wordfence","cve":"CVE-2022-2574","title":"Meks Easy Social Share <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/990b3318-e3e1-4a19-875c-80d5d639ca4a?source=api-prod","affected":[{"type":"plugin","slug":"meks-easy-social-share","name":"Meks Easy Social Share","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:990d62fd-dc55-446e-b3ff-52c7c121aeb8","source":"wordfence","cve":"CVE-2024-43272","title":"Icegram <= 3.1.24 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/990d62fd-dc55-446e-b3ff-52c7c121aeb8?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":"3.1.25"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:31:38Z"},{"id":"wordfence:990e04ed-ff17-4e10-9224-64a674a40416","source":"wordfence","cve":"CVE-2026-76053","title":"TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/990e04ed-ff17-4e10-9224-64a674a40416?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2026-08-27T14:13:27Z","updated":"2026-08-28T02:26:57Z"},{"id":"wordfence:9911e99e-0b3b-4be1-b8cd-28593b6d12ad","source":"wordfence","cve":"CVE-2024-9220","title":"LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9911e99e-0b3b-4be1-b8cd-28593b6d12ad?source=api-prod","affected":[{"type":"plugin","slug":"lh-copy-media-file","name":"LH Copy Media File","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":true,"patched_in":"1.09"}],"published":"2024-09-30T19:31:03Z","updated":"2024-10-04T12:33:45Z"},{"id":"wordfence:991327f0-8bb9-4fdf-9c2a-b266ead962a3","source":"wordfence","cve":"CVE-2025-58673","title":"WP User Frontend <= 4.1.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/991327f0-8bb9-4fdf-9c2a-b266ead962a3?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"4.1.13"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T21:12:01Z"},{"id":"wordfence:99140d47-88bb-48a1-863a-93a558541800","source":"wordfence","cve":"CVE-2023-31071","title":"Modal Dialog <= 3.5.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99140d47-88bb-48a1-863a-93a558541800?source=api-prod","affected":[{"type":"plugin","slug":"modal-dialog","name":"Modal Dialog","from":"*","from_inclusive":true,"to":"3.5.15","to_inclusive":false,"patched_in":"3.5.15"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9915758a-47f0-4fa7-8885-311b2f75a7b6","source":"wordfence","cve":"CVE-2026-22400","title":"Holmes <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9915758a-47f0-4fa7-8885-311b2f75a7b6?source=api-prod","affected":[{"type":"theme","slug":"holmes","name":"Holmes - Digital Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:27:46Z"},{"id":"wordfence:9915bd52-d77f-4c3f-92ef-8526d547e2f7","source":"wordfence","cve":"CVE-2024-53796","title":"Themesflat Addons For Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9915bd52-d77f-4c3f-92ef-8526d547e2f7?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:48:15Z"},{"id":"wordfence:9916af89-4b12-47eb-adb2-56267f077d2f","source":"wordfence","cve":"CVE-2022-4363","title":"Wholesale Market for WooCommerce <= 2.0.0 & Wholesale Market <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9916af89-4b12-47eb-adb2-56267f077d2f?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market","name":"Wholesale Market","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"},{"type":"plugin","slug":"wholesale-market-for-woocommerce","name":"Wholesale Market for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-12-08T00:00:00Z","updated":"2025-05-23T15:02:28Z"},{"id":"wordfence:9918ffe1-5911-48d7-84ba-8e6568d6f50c","source":"wordfence","cve":"CVE-2021-24304","title":"Newsmag < 5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9918ffe1-5911-48d7-84ba-8e6568d6f50c?source=api-prod","affected":[{"type":"theme","slug":"newsmag","name":"Newsmag - Newspaper & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:991a9271-f6cb-4d33-b853-21b927ac4ad1","source":"wordfence","cve":"CVE-2025-49953","title":"ShareBang, Ultimate Social Share Buttons for WordPress <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/991a9271-f6cb-4d33-b853-21b927ac4ad1?source=api-prod","affected":[{"type":"plugin","slug":"sharebang","name":"ShareBang, Ultimate Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-10-29T19:13:36Z"},{"id":"wordfence:991ab188-869c-4875-80f3-940000a1717b","source":"wordfence","cve":"CVE-2024-4039","title":"Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/991ab188-869c-4875-80f3-940000a1717b?source=api-prod","affected":[{"type":"plugin","slug":"woo-orders-tracking","name":"Trakoo \u2013 Orders Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-05-09T20:59:24Z","updated":"2024-05-10T09:32:09Z"},{"id":"wordfence:991aefb4-2e6b-48e6-bd19-98b21a57f6db","source":"wordfence","cve":"CVE-2023-0376","title":"Quebely <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Option","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/991aefb4-2e6b-48e6-bd19-98b21a57f6db?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:991d63da-ca6c-400e-beb7-b44cf629abc9","source":"wordfence","cve":"CVE-2025-9985","title":"Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/991d63da-ca6c-400e-beb7-b44cf629abc9?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T04:25:18Z"},{"id":"wordfence:9921f4d0-0aa2-457e-afb2-7ecafb605948","source":"wordfence","cve":"CVE-2026-40783","title":"Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution","severity":"medium","cvss":4.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9921f4d0-0aa2-457e-afb2-7ecafb605948?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion-pro","name":"Blocksy Companion Pro","from":"*","from_inclusive":true,"to":"2.1.37","to_inclusive":true,"patched_in":"2.1.38"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T14:58:37Z"},{"id":"wordfence:99235898-127a-4f44-99e2-d60d37d3b85a","source":"wordfence","cve":"CVE-2025-62110","title":"Rescue Shortcodes <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99235898-127a-4f44-99e2-d60d37d3b85a?source=api-prod","affected":[{"type":"plugin","slug":"rescue-shortcodes","name":"Rescue Shortcodes","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:37:48Z"},{"id":"wordfence:992474da-39c8-4299-bc6b-f1a967304afb","source":"wordfence","cve":"CVE-2025-68977","title":"DesignThemes Portfolio Addon <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992474da-39c8-4299-bc6b-f1a967304afb?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-portfolio-addon","name":"DesignThemes Portfolio Addon","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-06T15:04:03Z"},{"id":"wordfence:99258980-2be8-4590-bf47-576bd1ae4535","source":"wordfence","cve":"CVE-2025-23743","title":"Social Analytics <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99258980-2be8-4590-bf47-576bd1ae4535?source=api-prod","affected":[{"type":"plugin","slug":"social-analytics","name":"Social Analytics","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:41:53Z"},{"id":"wordfence:99277269-e7e7-4445-a901-fc4f1bec778d","source":"wordfence","cve":"CVE-2025-28949","title":"Mediabay - WordPress Media Library Folders <= 1.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99277269-e7e7-4445-a901-fc4f1bec778d?source=api-prod","affected":[{"type":"plugin","slug":"mediabay","name":"Mediabay - WordPress Media Library Folders","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-21T20:50:14Z"},{"id":"wordfence:992836dd-4a76-450f-930c-a41e3065d05a","source":"wordfence","cve":"CVE-2026-121775","title":"CURCY \u2013 Multi Currency for WooCommerce <= 2.2.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992836dd-4a76-450f-930c-a41e3065d05a?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.20","to_inclusive":true,"patched_in":"2.2.21"}],"published":"2026-11-07T12:34:00Z","updated":"2026-11-10T19:48:16Z"},{"id":"wordfence:992a5062-48f9-4028-9b4b-88cd6bf1bfd5","source":"wordfence","cve":"CVE-2026-39638","title":"Qubely <= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992a5062-48f9-4028-9b4b-88cd6bf1bfd5?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-14T00:00:00Z","updated":"2026-11-10T09:47:17Z"},{"id":"wordfence:992a91da-724f-40cc-b552-113d62fe20c1","source":"wordfence","cve":"CVE-2012-6651","title":"Vitamin < 1.1.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992a91da-724f-40cc-b552-113d62fe20c1?source=api-prod","affected":[{"type":"plugin","slug":"vitamin","name":"Vitamin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2012-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:992abd72-2a8e-4bda-94c2-4a7f88487906","source":"wordfence","cve":"CVE-2023-2919","title":"Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992abd72-2a8e-4bda-94c2-4a7f88487906?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T09:30:19Z"},{"id":"wordfence:992b362b-b01f-4c91-83ac-dd612b93ee03","source":"wordfence","cve":"","title":"Woocommerce Customers Manager <= 26.5 - Cross-Site Request Forgery to Account Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992b362b-b01f-4c91-83ac-dd612b93ee03?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"26.6","to_inclusive":false,"patched_in":"26.6"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:992d3ed0-2df9-44f4-a36b-434bd89aa4ea","source":"wordfence","cve":"CVE-2025-58856","title":"Woocommerce Notify Updated Product <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992d3ed0-2df9-44f4-a36b-434bd89aa4ea?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-notify-updated-product","name":"Woocommerce Notify Updated Product","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:24:28Z"},{"id":"wordfence:992f9f08-82c1-4bbd-bbd2-543ad8affe53","source":"wordfence","cve":"CVE-2024-32528","title":"WP Dynamic Keywords Injector <= 2.3.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992f9f08-82c1-4bbd-bbd2-543ad8affe53?source=api-prod","affected":[{"type":"plugin","slug":"wp-dynamic-keywords-injector","name":"WP Dynamic Keywords Injector","from":"*","from_inclusive":true,"to":"2.3.21","to_inclusive":true,"patched_in":"2.3.22"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:55:01Z"},{"id":"wordfence:992fc98f-4b23-4596-81fb-5543d82fd615","source":"wordfence","cve":"CVE-2023-5416","title":"Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/992fc98f-4b23-4596-81fb-5543d82fd615?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99304234-101d-408b-b463-67b8e2c8f679","source":"wordfence","cve":"CVE-2025-62080","title":"Live Shopping & Shoppable Videos For WooCommerce <= 2.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99304234-101d-408b-b463-67b8e2c8f679?source=api-prod","affected":[{"type":"plugin","slug":"live-shopping-video-streams","name":"Live Shopping & Shoppable Videos For WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-07-28T18:42:22Z"},{"id":"wordfence:993175b7-832d-4d08-8056-1ab2b0b0f3f6","source":"wordfence","cve":"CVE-2026-28004","title":"Business Directory <= 6.4.25 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/993175b7-832d-4d08-8056-1ab2b0b0f3f6?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.25","to_inclusive":true,"patched_in":"6.4.26"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T21:47:46Z"},{"id":"wordfence:9933ca13-32fd-4481-a18f-21e9a11c423c","source":"wordfence","cve":"","title":"Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URI","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9933ca13-32fd-4481-a18f-21e9a11c423c?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:993670b7-a3ea-497d-ad46-881bd47b9346","source":"wordfence","cve":"CVE-2024-12299","title":"System Dashboard <= 2.8.17 - Reflected Cross-Site Scripting via Filename Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/993670b7-a3ea-497d-ad46-881bd47b9346?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.17","to_inclusive":true,"patched_in":"2.8.18"}],"published":"2025-01-30T00:41:49Z","updated":"2025-02-11T20:56:11Z"},{"id":"wordfence:9937bb50-1a84-4284-a848-bc32b45db69d","source":"wordfence","cve":"CVE-2025-62142","title":"Post Video Players <= 1.163 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9937bb50-1a84-4284-a848-bc32b45db69d?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.163","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:30:43Z"},{"id":"wordfence:9939f297-e3ca-4d7d-9acd-c416ee2014c9","source":"wordfence","cve":"CVE-2023-47179","title":"WooODT Lite <= 2.4.6 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9939f297-e3ca-4d7d-9acd-c416ee2014c9?source=api-prod","affected":[{"type":"plugin","slug":"byconsole-woo-order-delivery-time","name":"Delivery Date Time & Pickup for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:993f6505-918c-45fd-8afa-4d567cc79e9e","source":"wordfence","cve":"CVE-2021-24888","title":"ImageBoss \u2013 Images Up To 60% Smaller & CDN < 3.0.6 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/993f6505-918c-45fd-8afa-4d567cc79e9e?source=api-prod","affected":[{"type":"plugin","slug":"imageboss","name":"ImageBoss \u2013 Image Optimization & CDN","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2020-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:993fe12e-2b22-4ff8-bc31-f4d6a2f1ac07","source":"wordfence","cve":"CVE-2026-96823","title":"Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/993fe12e-2b22-4ff8-bc31-f4d6a2f1ac07?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.120.0","to_inclusive":true,"patched_in":"5.121.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:55:07Z"},{"id":"wordfence:99418bd5-041a-4210-9571-fee6842fb692","source":"wordfence","cve":"","title":"Tracking Code Manager < 1.11.5 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99418bd5-041a-4210-9571-fee6842fb692?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2017-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99433521-721b-41c3-8736-fd2943901b4f","source":"wordfence","cve":"CVE-2014-10390","title":"WP Support Plus Responsive Ticket System <= 4.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99433521-721b-41c3-8736-fd2943901b4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2014-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9945c85b-a97a-4ad0-9d0a-69faf157563a","source":"wordfence","cve":"","title":"Simple 301 Redirects <= 2.0.7 - Cross-Site Request Forgery via 'clicked'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9945c85b-a97a-4ad0-9d0a-69faf157563a?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2023-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99467820-9caf-466c-8421-d6521699e6d6","source":"wordfence","cve":"CVE-2025-68529","title":"Email Capture <= 3.12.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99467820-9caf-466c-8421-d6521699e6d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.12.5","to_inclusive":true,"patched_in":"3.12.6"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-06T14:01:13Z"},{"id":"wordfence:99489cc0-2e73-4d55-b95f-46d574897fac","source":"wordfence","cve":"CVE-2021-4409","title":"WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99489cc0-2e73-4d55-b95f-46d574897fac?source=api-prod","affected":[{"type":"plugin","slug":"exportfeed-for-woocommerce-product-to-etsy","name":"Etsy Integration For WooCommerce","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:994a044d-db69-4f2d-9027-cf3665446ed3","source":"wordfence","cve":"CVE-2024-2296","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.21 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/994a044d-db69-4f2d-9027-cf3665446ed3?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-24T15:21:18Z"},{"id":"wordfence:994a5862-8855-42d4-94f9-0f65f552441d","source":"wordfence","cve":"CVE-2025-58266","title":"Gianism <= 6.0.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/994a5862-8855-42d4-94f9-0f65f552441d?source=api-prod","affected":[{"type":"plugin","slug":"gianism","name":"Gianism","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-07-08T20:44:21Z"},{"id":"wordfence:9952c734-2ca3-4eb0-8bf0-3f07c7825bc5","source":"wordfence","cve":"CVE-2026-73388","title":"Nikstore Core <= 1.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9952c734-2ca3-4eb0-8bf0-3f07c7825bc5?source=api-prod","affected":[{"type":"plugin","slug":"nikstore-core","name":"Nikstore Core","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:36:25Z"},{"id":"wordfence:9954c283-4dd5-4b78-8c86-97b93a1880b4","source":"wordfence","cve":"CVE-2013-4693","title":"Xorbin Digital Flash Clock < 1.0 - DOM Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9954c283-4dd5-4b78-8c86-97b93a1880b4?source=api-prod","affected":[{"type":"plugin","slug":"xorbin-digital-flash-clock","name":"Xorbin Digital Flash Clock","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9954ef37-bae0-48fb-9654-ff54750c46c2","source":"wordfence","cve":"CVE-2026-2839","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9954ef37-bae0-48fb-9654-ff54750c46c2?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-27T00:00:00Z","updated":"2026-10-28T06:45:17Z"},{"id":"wordfence:99555021-68f4-4395-978d-ff1bbae9ebd4","source":"wordfence","cve":"CVE-2022-4212","title":"Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99555021-68f4-4395-978d-ff1bbae9ebd4?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.2.1"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9956e04c-ff59-40c0-a8ab-3e2ed2c52d7f","source":"wordfence","cve":"CVE-2023-48755","title":"teachPress <= 9.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9956e04c-ff59-40c0-a8ab-3e2ed2c52d7f?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.4","to_inclusive":true,"patched_in":"9.0.5"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9958d7d7-ddeb-42f4-a5bd-6dd55ec9b6e0","source":"wordfence","cve":"CVE-2023-37996","title":"GTmetrix for WordPress <= 0.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9958d7d7-ddeb-42f4-a5bd-6dd55ec9b6e0?source=api-prod","affected":[{"type":"plugin","slug":"gtmetrix-for-wordpress","name":"GTmetrix for WordPress","from":"*","from_inclusive":true,"to":"0.4.7","to_inclusive":true,"patched_in":"0.4.8"}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:995a086a-4795-4092-823c-b941445dc361","source":"wordfence","cve":"CVE-2023-51511","title":"Booster Elite for WooCommerce <= 7.1.2 - Authenticated(Subscriber+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/995a086a-4795-4092-823c-b941445dc361?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":false,"patched_in":"7.1.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:995a6c1d-fb49-4953-9828-f6594ac45fa7","source":"wordfence","cve":"CVE-2024-3870","title":"Contact Form 7 Database Addon \u2013 CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/995a6c1d-fb49-4953-9828-f6594ac45fa7?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-cfdb7","name":"Database Addon for Contact Form 7 \u2013 CFDB7","from":"*","from_inclusive":true,"to":"1.2.6.8","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:26Z"},{"id":"wordfence:995ce1f8-dee8-418b-bcdc-5e5915bfc848","source":"wordfence","cve":"CVE-2025-47602","title":"Calculate Prices based on Distance For WooCommerce <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/995ce1f8-dee8-418b-bcdc-5e5915bfc848?source=api-prod","affected":[{"type":"plugin","slug":"calculate-prices-based-on-distance-for-woocommerce","name":"Calculate Prices based on Distance For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-05-07T00:00:00Z","updated":"2026-01-06T18:20:40Z"},{"id":"wordfence:9960bae9-6f19-49eb-8f24-fdde4933671e","source":"wordfence","cve":"CVE-2024-3214","title":"Relevanssi \u2013 A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection","severity":"medium","cvss":5.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9960bae9-6f19-49eb-8f24-fdde4933671e?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.22.1","to_inclusive":true,"patched_in":"4.22.2"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:08Z"},{"id":"wordfence:99623228-e199-44a9-b20f-b1d351720a8d","source":"wordfence","cve":"CVE-2026-22461","title":"CTX Feed <= 6.6.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99623228-e199-44a9-b20f-b1d351720a8d?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.18","to_inclusive":true,"patched_in":"6.6.19"}],"published":"2026-01-04T00:00:00Z","updated":"2026-02-25T14:39:35Z"},{"id":"wordfence:99625a3e-b8a4-42f8-8996-f7c5c0ff2d5f","source":"wordfence","cve":"CVE-2024-13153","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99625a3e-b8a4-42f8-8996-f7c5c0ff2d5f?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.135","to_inclusive":true,"patched_in":"1.5.136"}],"published":"2025-01-08T19:32:13Z","updated":"2025-02-19T19:02:38Z"},{"id":"wordfence:9963e055-17f8-4cd9-b896-4506408257eb","source":"wordfence","cve":"CVE-2026-22421","title":"Quantum <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9963e055-17f8-4cd9-b896-4506408257eb?source=api-prod","affected":[{"type":"theme","slug":"quantum","name":"quantum","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:38:46Z"},{"id":"wordfence:9963e0f8-600c-4b1f-935d-4ac1f967698f","source":"wordfence","cve":"CVE-2026-2827","title":"Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9963e0f8-600c-4b1f-935d-4ac1f967698f?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map-pro","name":"Open User Map PRO","from":"*","from_inclusive":true,"to":"1.4.31","to_inclusive":true,"patched_in":"1.4.32"}],"published":"2026-06-10T13:18:50Z","updated":"2026-06-11T01:27:56Z"},{"id":"wordfence:99643669-373e-4bee-9588-e3dd04e43c01","source":"wordfence","cve":"CVE-2026-27075","title":"Belfort <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99643669-373e-4bee-9588-e3dd04e43c01?source=api-prod","affected":[{"type":"theme","slug":"belfort","name":"Belfort - Single Property and Apartment WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.2"}],"published":"2026-03-10T00:00:00Z","updated":"2026-04-15T13:41:13Z"},{"id":"wordfence:99650c4d-d8ef-4970-af65-b22b7fdf3543","source":"wordfence","cve":"CVE-2024-43289","title":"wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99650c4d-d8ef-4970-af65-b22b7fdf3543?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:48:39Z"},{"id":"wordfence:99656d69-6fb6-45d6-bd62-9849e5dead7b","source":"wordfence","cve":"CVE-2024-51666","title":"Tours <= 1.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99656d69-6fb6-45d6-bd62-9849e5dead7b?source=api-prod","affected":[{"type":"plugin","slug":"tours","name":"Tours","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-05-15T00:00:00Z","updated":"2025-05-20T20:19:20Z"},{"id":"wordfence:9965ea42-56c4-4ec9-9159-d971e913469e","source":"wordfence","cve":"CVE-2021-24391","title":"Cashtomer <= 1.0.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9965ea42-56c4-4ec9-9159-d971e913469e?source=api-prod","affected":[{"type":"plugin","slug":"cashtomer","name":"Cashtomer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:996697c7-39a9-411e-a1cf-c9bb7c34b258","source":"wordfence","cve":"CVE-2026-66458","title":"RealPress \u2013 Real Estate Plugin <= 1.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996697c7-39a9-411e-a1cf-c9bb7c34b258?source=api-prod","affected":[{"type":"plugin","slug":"realpress","name":"RealPress \u2013 Real Estate Plugin","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-08-07T00:00:00Z","updated":"2026-10-28T21:12:50Z"},{"id":"wordfence:9967a945-8ea2-4b6c-a15e-1bcbca4c6490","source":"wordfence","cve":"CVE-2025-12835","title":"WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9967a945-8ea2-4b6c-a15e-1bcbca4c6490?source=api-prod","affected":[{"type":"plugin","slug":"woomulti","name":"WooMulti","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-11T00:00:00Z","updated":"2025-12-19T20:29:19Z"},{"id":"wordfence:996843e5-4fbc-4606-a383-2a5825fae89c","source":"wordfence","cve":"CVE-2025-49318","title":"WPtouch <= 4.3.60 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996843e5-4fbc-4606-a383-2a5825fae89c?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"4.3.60","to_inclusive":true,"patched_in":"4.3.61"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T21:14:25Z"},{"id":"wordfence:996ade9c-2531-4f43-87f6-eddb2ce98a12","source":"wordfence","cve":"CVE-2025-1510","title":"Custom Post Type Date Archives <= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996ade9c-2531-4f43-87f6-eddb2ce98a12?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-date-archives","name":"Custom Post Type Date Archives","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T15:00:41Z","updated":"2025-02-22T03:21:01Z"},{"id":"wordfence:996b2671-be25-4821-b0b8-b88f0ed112bc","source":"wordfence","cve":"CVE-2026-14184","title":"Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996b2671-be25-4821-b0b8-b88f0ed112bc?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-30T17:12:35Z"},{"id":"wordfence:996b44bb-d1e0-4f82-b8ee-a98b0ae994f9","source":"wordfence","cve":"CVE-2024-0617","title":"Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996b44bb-d1e0-4f82-b8ee-a98b0ae994f9?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-category-discount","name":"Simple Discount Rules for Woocommerce","from":"*","from_inclusive":true,"to":"4.12","to_inclusive":true,"patched_in":"4.13"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:36:56Z"},{"id":"wordfence:996b5e29-beea-4678-8596-04e96a343584","source":"wordfence","cve":"CVE-2022-3937","title":"Easy Video Player <= 1.2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996b5e29-beea-4678-8596-04e96a343584?source=api-prod","affected":[{"type":"plugin","slug":"easy-video-player","name":"Easy Video Player","from":"*","from_inclusive":true,"to":"1.2.2.2","to_inclusive":true,"patched_in":"1.2.2.3"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:996c2843-158c-475a-874e-c5af00347d8c","source":"wordfence","cve":"CVE-2025-22300","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) Manager <= 10.0.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996c2843-158c-475a-874e-c5af00347d8c?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"10.0.1.2","to_inclusive":true,"patched_in":"10.0.2"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:26:30Z"},{"id":"wordfence:996c7433-dd82-4216-86b9-005f43c06c3a","source":"wordfence","cve":"CVE-2024-0766","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996c7433-dd82-4216-86b9-005f43c06c3a?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:56Z"},{"id":"wordfence:996cb291-692d-4892-a3ab-ffad960ba732","source":"wordfence","cve":"CVE-2024-13596","title":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996cb291-692d-4892-a3ab-ffad960ba732?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-poll","name":"WordPress Survey & Poll \u2013 Quiz, Survey and Poll Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:48:29Z","updated":"2025-01-30T13:42:07Z"},{"id":"wordfence:996d1514-2c1f-4888-ac2f-bc58e926d3ef","source":"wordfence","cve":"CVE-2024-33570","title":"Metform Elementor Contact Form Builder <= 3.8.3 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996d1514-2c1f-4888-ac2f-bc58e926d3ef?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:59:50Z"},{"id":"wordfence:996dc1d7-12f8-467d-bf48-a7a82f1c0a41","source":"wordfence","cve":"","title":"Brands for WooCommerce <= 3.8.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996dc1d7-12f8-467d-bf48-a7a82f1c0a41?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2.3","to_inclusive":false,"patched_in":"3.8.2.3"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:996e0432-e795-4c01-8182-603a47f4f341","source":"wordfence","cve":"CVE-2025-5924","title":"WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996e0432-e795-4c01-8182-603a47f4f341?source=api-prod","affected":[{"type":"plugin","slug":"wp-push-notification-firebase","name":"WP Firebase Push Notification","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:22:35Z","updated":"2025-07-04T01:44:05Z"},{"id":"wordfence:996e0bca-70cb-45ab-bb94-b41250e252fc","source":"wordfence","cve":"CVE-2024-7133","title":"My Sticky Bar <= 2.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996e0bca-70cb-45ab-bb94-b41250e252fc?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-23T00:00:00Z","updated":"2026-09-04T17:39:08Z"},{"id":"wordfence:996e5952-6462-4afd-81ab-afdc626fcc05","source":"wordfence","cve":"CVE-2025-63010","title":"Hercules Core <= 7.4 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996e5952-6462-4afd-81ab-afdc626fcc05?source=api-prod","affected":[{"type":"plugin","slug":"hercules-core","name":"Hercules Core","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-11T16:23:48Z"},{"id":"wordfence:9970f9e5-ca20-4424-a501-9c8186ede497","source":"wordfence","cve":"CVE-2009-2383","title":"Related Sites <= 2.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9970f9e5-ca20-4424-a501-9c8186ede497?source=api-prod","affected":[{"type":"plugin","slug":"related-sites","name":"Related Sites","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2009-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99711f41-d21b-4725-acc8-9542283daf12","source":"wordfence","cve":"CVE-2023-1915","title":"Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99711f41-d21b-4725-acc8-9542283daf12?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99721c3e-cddf-4709-aef9-92bb42e43f83","source":"wordfence","cve":"CVE-2015-2218","title":"WonderPlugin Audio Player < 2.1 - Multiple Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99721c3e-cddf-4709-aef9-92bb42e43f83?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-audio","name":"WonderPlugin Audio Player","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2015-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99736b2d-c8f3-4da8-bd11-cfaf32bd53ef","source":"wordfence","cve":"CVE-2024-44041","title":"IdeaPush <= 8.66 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99736b2d-c8f3-4da8-bd11-cfaf32bd53ef?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.66","to_inclusive":true,"patched_in":"8.69"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T19:53:40Z"},{"id":"wordfence:99746867-597b-49df-aa9e-548456a58542","source":"wordfence","cve":"","title":"Photocrati (Unknown Versions) - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99746867-597b-49df-aa9e-548456a58542?source=api-prod","affected":[{"type":"theme","slug":"photocrati-theme","name":"Photocrati","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99747020-80a4-4ce0-85a2-cc8cdbd9a676","source":"wordfence","cve":"CVE-2026-25429","title":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99747020-80a4-4ce0-85a2-cc8cdbd9a676?source=api-prod","affected":[{"type":"plugin","slug":"nexa-blocks","name":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:33:07Z"},{"id":"wordfence:99772f4b-4152-42dc-8bde-697bba3d031f","source":"wordfence","cve":"CVE-2025-9878","title":"Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99772f4b-4152-42dc-8bde-697bba3d031f?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.21","to_inclusive":true,"patched_in":"1.9.22"}],"published":"2026-08-24T13:29:00Z","updated":"2026-08-25T02:26:50Z"},{"id":"wordfence:99778d0b-1909-4075-8b80-531b67e7ed79","source":"wordfence","cve":"CVE-2026-25333","title":"Shopwell <= 1.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99778d0b-1909-4075-8b80-531b67e7ed79?source=api-prod","affected":[{"type":"theme","slug":"shopwell","name":"Shopwell","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2026-02-07T00:00:00Z","updated":"2026-05-04T15:28:10Z"},{"id":"wordfence:9978a072-9f6c-4fa2-b414-b18e0c10ee61","source":"wordfence","cve":"CVE-2026-57347","title":"MotoPress Hotel Booking <= 6.0.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9978a072-9f6c-4fa2-b414-b18e0c10ee61?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-09T13:45:22Z"},{"id":"wordfence:997918b9-2ccd-413e-9df2-d24bc3820ba1","source":"wordfence","cve":"CVE-2024-13611","title":"Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/997918b9-2ccd-413e-9df2-d24bc3820ba1?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-02-28T19:31:16Z","updated":"2025-03-01T08:23:21Z"},{"id":"wordfence:9979381e-711d-42c8-bfdf-4ee99e2e556f","source":"wordfence","cve":"CVE-2024-9024","title":"Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9979381e-711d-42c8-bfdf-4ee99e2e556f?source=api-prod","affected":[{"type":"plugin","slug":"material-design-icons","name":"Material Design Icons","from":"*","from_inclusive":true,"to":"0.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:16:49Z","updated":"2024-09-25T02:05:21Z"},{"id":"wordfence:9979bce7-4c9f-473d-b751-621b68300c28","source":"wordfence","cve":"CVE-2024-43149","title":"CM Tooltip Glossary <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9979bce7-4c9f-473d-b751-621b68300c28?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.9"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:06:33Z"},{"id":"wordfence:997b028c-8131-4579-8157-caecf099d7ec","source":"wordfence","cve":"","title":"Knowledge Base <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/997b028c-8131-4579-8157-caecf099d7ec?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:997e5fdb-cece-4850-a0e4-49343d9c415d","source":"wordfence","cve":"CVE-2025-49920","title":"Web Accessibility By accessiBe <= 2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/997e5fdb-cece-4850-a0e4-49343d9c415d?source=api-prod","affected":[{"type":"plugin","slug":"accessibe","name":"Web Accessibility by accessiBe","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"2.11"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-04T14:45:33Z"},{"id":"wordfence:9980ec20-60ae-42eb-a2cd-146e57435398","source":"wordfence","cve":"CVE-2025-13369","title":"Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9980ec20-60ae-42eb-a2cd-146e57435398?source=api-prod","affected":[{"type":"plugin","slug":"woo-customers-manager","name":"Premmerce WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2026-01-06T18:36:11Z","updated":"2026-02-25T15:59:00Z"},{"id":"wordfence:9980f60b-2e0b-4eb1-9d63-1657b0f9d677","source":"wordfence","cve":"CVE-2026-62110","title":"Bold Page Builder <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9980f60b-2e0b-4eb1-9d63-1657b0f9d677?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:25:40Z"},{"id":"wordfence:9984bdef-a9e8-489d-9912-12de57c6920d","source":"wordfence","cve":"CVE-2026-28043","title":"Healer - Doctor, Clinic & Medical WordPress <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9984bdef-a9e8-489d-9912-12de57c6920d?source=api-prod","affected":[{"type":"theme","slug":"healer","name":"Healer WordPress Themes, Plugins & Template Kits.","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:05:44Z"},{"id":"wordfence:998542fd-dc5d-4a11-b41f-d94be697eda0","source":"wordfence","cve":"CVE-2026-28107","title":"Muzicon <= 1.9.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/998542fd-dc5d-4a11-b41f-d94be697eda0?source=api-prod","affected":[{"type":"theme","slug":"muzicon","name":"Muzicon - Music Festival & Concert WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:15:34Z"},{"id":"wordfence:9985627d-9ba4-4a5b-94fb-06bcc769acfd","source":"wordfence","cve":"CVE-2025-1672","title":"Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9985627d-9ba4-4a5b-94fb-06bcc769acfd?source=api-prod","affected":[{"type":"plugin","slug":"notibar","name":"Notibar \u2013 Notification Bar for WordPress","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-03-05T21:11:50Z","updated":"2025-03-06T09:21:20Z"},{"id":"wordfence:9985cac5-30bf-4e8b-91d5-0b3da36ed851","source":"wordfence","cve":"CVE-2023-6456","title":"WP Review Slider <= 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9985cac5-30bf-4e8b-91d5-0b3da36ed851?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"12.8","to_inclusive":true,"patched_in":"13.0"}],"published":"2023-12-26T00:00:00Z","updated":"2024-02-06T00:46:02Z"},{"id":"wordfence:9987b5b4-33d8-4446-acbe-58c6cb5604df","source":"wordfence","cve":"CVE-2026-2840","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9987b5b4-33d8-4446-acbe-58c6cb5604df?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-04-15T18:24:03Z","updated":"2026-04-16T14:10:29Z"},{"id":"wordfence:998d3485-97c2-4aa6-ba0c-693f5fd6af07","source":"wordfence","cve":"CVE-2026-6174","title":"CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/998d3485-97c2-4aa6-ba0c-693f5fd6af07?source=api-prod","affected":[{"type":"plugin","slug":"cc-child-pages","name":"CC Child Pages","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-05-13T19:50:53Z","updated":"2026-05-14T08:24:28Z"},{"id":"wordfence:998e545c-2ad5-48ec-bad1-d346170af408","source":"wordfence","cve":"CVE-2026-10023","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/998e545c-2ad5-48ec-bad1-d346170af408?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-06-17T14:54:38Z","updated":"2026-06-18T03:41:39Z"},{"id":"wordfence:99908c52-b236-494f-aeb6-3b1dfaae1305","source":"wordfence","cve":"CVE-2026-15233","title":"Nested Pages <= 3.2.14 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99908c52-b236-494f-aeb6-3b1dfaae1305?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.14","to_inclusive":true,"patched_in":"3.2.15"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:27:08Z"},{"id":"wordfence:9990d487-d0be-4b8a-b791-ca1faa90b619","source":"wordfence","cve":"CVE-2026-119483","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9990d487-d0be-4b8a-b791-ca1faa90b619?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.50","to_inclusive":true,"patched_in":"1.15.51"}],"published":"2026-11-07T09:44:42Z","updated":"2026-11-10T19:26:29Z"},{"id":"wordfence:999115b1-8bac-4323-ba55-4e8a6df632e8","source":"wordfence","cve":"CVE-2025-23915","title":"FAT Event Lite <= 1.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999115b1-8bac-4323-ba55-4e8a6df632e8?source=api-prod","affected":[{"type":"plugin","slug":"fat-event-lite","name":"FAT Event Lite","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:49:59Z"},{"id":"wordfence:9992c6ac-8e29-4c99-8439-663cc7c190b9","source":"wordfence","cve":"CVE-2024-43337","title":"Brave Popup Builder <= 0.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9992c6ac-8e29-4c99-8439-663cc7c190b9?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":"0.7.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:12:05Z"},{"id":"wordfence:99938cd0-7251-491e-ac79-61210ae57963","source":"wordfence","cve":"CVE-2026-32329","title":"Advanced Related Posts <= 1.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99938cd0-7251-491e-ac79-61210ae57963?source=api-prod","affected":[{"type":"plugin","slug":"advanced-related-posts","name":"Advanced Related Posts","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-02-08T00:00:00Z","updated":"2026-04-15T20:59:39Z"},{"id":"wordfence:9993bdab-3fd9-42f3-b16a-d92512c6573d","source":"wordfence","cve":"CVE-2024-44025","title":"NiceJob <= 3.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9993bdab-3fd9-42f3-b16a-d92512c6573d?source=api-prod","affected":[{"type":"plugin","slug":"nicejob","name":"NiceJob","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:20:22Z"},{"id":"wordfence:9993d84e-7337-4eda-af3c-039b6d8c8fe6","source":"wordfence","cve":"CVE-2023-48281","title":"Broken Link Checker for YouTube <= 1.3 - Cross-Site Request Forgery via plugin_settings_page()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9993d84e-7337-4eda-af3c-039b6d8c8fe6?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker-for-youtube","name":"Broken Link Checker for YouTube","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:999475c5-5f17-47fa-a0d0-47cb5a8a0eb4","source":"wordfence","cve":"CVE-2023-6744","title":"Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999475c5-5f17-47fa-a0d0-47cb5a8a0eb4?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.23.1","to_inclusive":true,"patched_in":"4.23.2"}],"published":"2023-12-22T00:00:00Z","updated":"2024-07-29T21:36:56Z"},{"id":"wordfence:9995df77-5ccf-4734-ad96-234c82d50a02","source":"wordfence","cve":"CVE-2024-6797","title":"DL Robots.txt <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9995df77-5ccf-4734-ad96-234c82d50a02?source=api-prod","affected":[{"type":"plugin","slug":"dl-robotstxt","name":"DL Robots.txt","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-14T17:57:17Z"},{"id":"wordfence:99960ff7-62e1-4c44-ae8e-ebda3e075781","source":"wordfence","cve":"CVE-2024-3923","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99960ff7-62e1-4c44-ae8e-ebda3e075781?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.1.1","to_inclusive":true,"patched_in":"2.8.1.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:35Z"},{"id":"wordfence:999692ee-8bd4-4e7c-89a8-fba9d6f88bc2","source":"wordfence","cve":"CVE-2024-51781","title":"Firework Shoppable Live Video <= 6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999692ee-8bd4-4e7c-89a8-fba9d6f88bc2?source=api-prod","affected":[{"type":"plugin","slug":"firework-videos","name":"Firework Shoppable Live Video","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T19:58:45Z"},{"id":"wordfence:9996cdc7-4d97-4b27-b697-09bbdbcd865d","source":"wordfence","cve":"CVE-2025-12025","title":"YouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9996cdc7-4d97-4b27-b697-09bbdbcd865d?source=api-prod","affected":[{"type":"plugin","slug":"easy-youtube-subscribe","name":"YouTube Subscribe","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:13:57Z","updated":"2025-11-25T07:28:24Z"},{"id":"wordfence:99984fff-94e3-46fb-8241-88fcda556054","source":"wordfence","cve":"CVE-2023-35091","title":"Stock Manager for WooCommerce <= 2.10.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99984fff-94e3-46fb-8241-88fcda556054?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-stock-manager","name":"Stock Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":false,"patched_in":"2.11.0"}],"published":"2023-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9999301a-002d-441b-bd66-6b7f4c46a8bf","source":"wordfence","cve":"CVE-2023-39165","title":"Sign-up Sheets <= 2.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9999301a-002d-441b-bd66-6b7f4c46a8bf?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:999b036e-e660-4466-9fa1-e4645c57e5bc","source":"wordfence","cve":"CVE-2026-110523","title":"User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999b036e-e660-4466-9fa1-e4645c57e5bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"2.9.21","from_inclusive":true,"to":"2.9.25","to_inclusive":true,"patched_in":"2.9.26"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:36:25Z"},{"id":"wordfence:999b2249-5bfb-4add-b955-e82ab0308d2f","source":"wordfence","cve":"CVE-2026-12256","title":"Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999b2249-5bfb-4add-b955-e82ab0308d2f?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-10T19:21:43Z"},{"id":"wordfence:999c2207-6d45-4b46-8fe1-03682a949c5c","source":"wordfence","cve":"CVE-2026-7659","title":"Advanced Social Media Icons <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999c2207-6d45-4b46-8fe1-03682a949c5c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-social-media-icons","name":"Advanced Social Media Icons","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:03:01Z","updated":"2026-05-12T07:48:24Z"},{"id":"wordfence:999cf54e-2ea8-474d-984c-1c4f729198aa","source":"wordfence","cve":"CVE-2018-5668","title":"Read and Understood < 2.2 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999cf54e-2ea8-474d-984c-1c4f729198aa?source=api-prod","affected":[{"type":"plugin","slug":"read-and-understood","name":"Read and Understood","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":false,"patched_in":"2.2"}],"published":"2018-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:999d1df5-9c8e-46bd-bf95-9240cd6594ed","source":"wordfence","cve":"CVE-2024-50451","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999d1df5-9c8e-46bd-bf95-9240cd6594ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.4","to_inclusive":true,"patched_in":"1.3.3.5"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:53:58Z"},{"id":"wordfence:999d8168-b4be-492e-8f25-9df104711341","source":"wordfence","cve":"CVE-2024-54305","title":"J&T Express Malaysia <= 2.0.13 - Reflected Cross-Site Scripting via [placeholder]","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999d8168-b4be-492e-8f25-9df104711341?source=api-prod","affected":[{"type":"plugin","slug":"jt-express","name":"J&T Express Malaysia","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:52:05Z"},{"id":"wordfence:999e3483-a882-4beb-8c16-6426487a7851","source":"wordfence","cve":"CVE-2026-24946","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/999e3483-a882-4beb-8c16-6426487a7851?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:41:17Z"},{"id":"wordfence:99a088c5-866e-4a7c-aa82-8ad3123918d6","source":"wordfence","cve":"CVE-2026-120530","title":"WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography","severity":"medium","cvss":5.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a088c5-866e-4a7c-aa82-8ad3123918d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-11-06T18:36:17Z","updated":"2026-11-07T06:39:39Z"},{"id":"wordfence:99a21d91-e17a-400e-9013-c074e76bbf6e","source":"wordfence","cve":"CVE-2024-32604","title":"WP-Recall \u2013 Registration, Profile, Commerce & More  <= 16.26.5 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a21d91-e17a-400e-9013-c074e76bbf6e?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.5","to_inclusive":true,"patched_in":"16.26.6"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:25:00Z"},{"id":"wordfence:99a24c92-b6e5-4bbd-8cd8-1f95f47d3675","source":"wordfence","cve":"CVE-2024-50516","title":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a24c92-b6e5-4bbd-8cd8-1f95f47d3675?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2025-05-05T18:36:01Z"},{"id":"wordfence:99a51d1f-35eb-4fe9-967e-c723b47393ea","source":"wordfence","cve":"CVE-2025-23443","title":"Author Showcase <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a51d1f-35eb-4fe9-967e-c723b47393ea?source=api-prod","affected":[{"type":"plugin","slug":"author-showcase","name":"Author Showcase","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T21:54:56Z"},{"id":"wordfence:99a8b48b-2967-4179-a0eb-626bbe273f03","source":"wordfence","cve":"CVE-2026-4072","title":"WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a8b48b-2967-4179-a0eb-626bbe273f03?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-paypal-donation","name":"WordPress PayPal Donation","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:36Z","updated":"2026-03-21T03:26:56Z"},{"id":"wordfence:99a9d844-305d-445d-947d-060920e8a229","source":"wordfence","cve":"CVE-2024-56290","title":"Multiple Shipping And Billing Address For Woocommerce <= 1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99a9d844-305d-445d-947d-060920e8a229?source=api-prod","affected":[{"type":"plugin","slug":"different-shipping-and-billing-address-for-woocommerce","name":"Multiple Shipping And Billing Address For WooCommerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:38:52Z"},{"id":"wordfence:99afde73-3f2b-4ba4-a82b-a6df42462384","source":"wordfence","cve":"CVE-2013-2287","title":"Uploader <= 1.0.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99afde73-3f2b-4ba4-a82b-a6df42462384?source=api-prod","affected":[{"type":"plugin","slug":"uploader","name":"Uploader","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99affe0c-ff93-41d9-b83f-60ac63d0f0d7","source":"wordfence","cve":"CVE-2026-48884","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99affe0c-ff93-41d9-b83f-60ac63d0f0d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-10-29T14:13:00Z","updated":"2026-11-03T20:00:46Z"},{"id":"wordfence:99b268a7-fd96-4fed-82e7-cfc651126f1f","source":"wordfence","cve":"CVE-2025-22323","title":"Image Hover Effects for Elementor <= 1.0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99b268a7-fd96-4fed-82e7-cfc651126f1f?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-elementor-addon","name":"Image Hover Effects for Elementor","from":"*","from_inclusive":true,"to":"1.0.2.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-01-03T00:00:00Z","updated":"2026-05-26T18:14:51Z"},{"id":"wordfence:99b2e3c3-b5e5-4648-81c8-da2f42ceec66","source":"wordfence","cve":"CVE-2023-4861","title":"File Manager Pro \u2013 Filester <=  1.8 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99b2e3c3-b5e5-4648-81c8-da2f42ceec66?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99b3309d-be3f-427a-883f-8d3d47e141fe","source":"wordfence","cve":"CVE-2025-58918","title":"Entrada <= 5.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99b3309d-be3f-427a-883f-8d3d47e141fe?source=api-prod","affected":[{"type":"theme","slug":"entrada","name":"Entrada","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-17T00:00:00Z","updated":"2025-09-22T14:13:03Z"},{"id":"wordfence:99b47856-502e-4e9d-b0ea-62c57509b46a","source":"wordfence","cve":"CVE-2025-9082","title":"WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99b47856-502e-4e9d-b0ea-62c57509b46a?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-01-27T17:39:23Z","updated":"2026-01-28T06:43:45Z"},{"id":"wordfence:99b91fb6-9e60-447d-ab43-2be231052140","source":"wordfence","cve":"CVE-2026-1044","title":"Tennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99b91fb6-9e60-447d-ab43-2be231052140?source=api-prod","affected":[{"type":"plugin","slug":"tennis-court-bookings","name":"Tennis Court Bookings","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T16:00:01Z","updated":"2026-02-19T04:36:20Z"},{"id":"wordfence:99bc930e-8232-4c8e-b6c0-982650c7f407","source":"wordfence","cve":"CVE-2025-62736","title":"Image Cleanup <= 1.9.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99bc930e-8232-4c8e-b6c0-982650c7f407?source=api-prod","affected":[{"type":"plugin","slug":"image-cleanup","name":"Image Cleanup","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-10T15:54:26Z"},{"id":"wordfence:99be8703-b462-4589-9918-76c0ebbb3bcf","source":"wordfence","cve":"CVE-2024-29130","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99be8703-b462-4589-9918-76c0ebbb3bcf?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:16:24Z"},{"id":"wordfence:99c07c94-39c1-4d13-9abe-78cf88daca2f","source":"wordfence","cve":"CVE-2025-47527","title":"Icegram Collect \u2013 Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c07c94-39c1-4d13-9abe-78cf88daca2f?source=api-prod","affected":[{"type":"plugin","slug":"icegram-rainmaker","name":"Icegram Collect \u2013 Easy Contact Form, Subscription Form & Lead Collection Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-10T15:07:56Z"},{"id":"wordfence:99c13de3-e040-4c11-b9c0-bd6a337c4769","source":"wordfence","cve":"CVE-2020-36384","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via Color Settings","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c13de3-e040-4c11-b9c0-bd6a337c4769?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"}],"published":"2020-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99c24e6f-396a-45bd-b16e-cb3b30aff25c","source":"wordfence","cve":"CVE-2026-109988","title":"Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c24e6f-396a-45bd-b16e-cb3b30aff25c?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-product-addons","name":"Product Addons for Woocommerce \u2013 Product Options with Custom Fields","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2026-10-27T17:50:33Z","updated":"2026-10-28T06:45:18Z"},{"id":"wordfence:99c31538-e500-4597-af3f-8505abf79e69","source":"wordfence","cve":"CVE-2025-49976","title":"WANotifier <= 2.7.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c31538-e500-4597-af3f-8505abf79e69?source=api-prod","affected":[{"type":"plugin","slug":"notifier","name":"WANotifier for Forms and Actions","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.7.13"}],"published":"2025-06-19T00:00:00Z","updated":"2026-03-17T21:24:26Z"},{"id":"wordfence:99c71994-baf5-43e7-986c-8bcb7e365567","source":"wordfence","cve":"CVE-2026-34893","title":"Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c71994-baf5-43e7-986c-8bcb7e365567?source=api-prod","affected":[{"type":"plugin","slug":"thegov-core","name":"TheGov Core","from":"*","from_inclusive":true,"to":"2.0.23","to_inclusive":false,"patched_in":"2.0.23"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:31:57Z"},{"id":"wordfence:99c7eead-2cf2-4663-9328-671274f3c436","source":"wordfence","cve":"CVE-2024-10671","title":"Button Block \u2013 Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c7eead-2cf2-4663-9328-671274f3c436?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T05:33:51Z"},{"id":"wordfence:99c89e29-a21d-4c32-9459-18c7b08b9ff0","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.5.68 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99c89e29-a21d-4c32-9459-18c7b08b9ff0?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":true,"patched_in":"1.5.69"}],"published":"2021-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99ca1d6b-820d-412e-82c8-ac9647765086","source":"wordfence","cve":"CVE-2026-32397","title":"Filter & Grids <= 3.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ca1d6b-820d-412e-82c8-ac9647765086?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T20:57:21Z"},{"id":"wordfence:99caa0fe-de80-4363-b7ed-d4324ac08e4e","source":"wordfence","cve":"CVE-2026-25021","title":"Mizan Demo Importer <= 0.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99caa0fe-de80-4363-b7ed-d4324ac08e4e?source=api-prod","affected":[{"type":"plugin","slug":"mizan-demo-importer","name":"Mizan Demo Importer","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":"0.1.4"}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-10T19:57:28Z"},{"id":"wordfence:99cd7a8f-1d4b-4d9f-a08b-ec955842394b","source":"wordfence","cve":"CVE-2025-59132","title":"Duplicate Content Cure <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99cd7a8f-1d4b-4d9f-a08b-ec955842394b?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-content-cure","name":"Duplicate Content Cure","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-10T15:51:52Z"},{"id":"wordfence:99ce64cf-3f7a-4bc0-aa06-00f0fb3bfc4c","source":"wordfence","cve":"CVE-2024-12717","title":"Aklamator INfeed <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ce64cf-3f7a-4bc0-aa06-00f0fb3bfc4c?source=api-prod","affected":[{"type":"plugin","slug":"aklamator-infeed","name":"Aklamator INfeed","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:42:59Z"},{"id":"wordfence:99d1e0cc-1fd0-47f7-8b73-33663ed72eea","source":"wordfence","cve":"CVE-2026-109191","title":"Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d1e0cc-1fd0-47f7-8b73-33663ed72eea?source=api-prod","affected":[{"type":"plugin","slug":"image-hub","name":"Image Hub \u2013 Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-15T15:48:52Z","updated":"2026-10-16T04:27:02Z"},{"id":"wordfence:99d3d5aa-dd82-415a-bc40-9d2c677d9248","source":"wordfence","cve":"CVE-2023-6809","title":"Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d3d5aa-dd82-415a-bc40-9d2c677d9248?source=api-prod","affected":[{"type":"plugin","slug":"custom-fields-shortcode","name":"Custom fields shortcode","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:36:56Z"},{"id":"wordfence:99d62147-f1bf-4146-a22d-d7d8486ed9e7","source":"wordfence","cve":"CVE-2025-23690","title":"Book a Place <= 0.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d62147-f1bf-4146-a22d-d7d8486ed9e7?source=api-prod","affected":[{"type":"plugin","slug":"book-a-place","name":"Book a Place","from":"*","from_inclusive":true,"to":"0.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:43:12Z"},{"id":"wordfence:99d72d71-ff0a-45ea-8126-279baa8bbf3c","source":"wordfence","cve":"CVE-2025-60073","title":"Responsive Sidebar <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d72d71-ff0a-45ea-8126-279baa8bbf3c?source=api-prod","affected":[{"type":"plugin","slug":"responsive-sidebar","name":"Responsive Sidebar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-11-11T18:23:34Z"},{"id":"wordfence:99d73781-d0e8-4730-9ec1-ff2151982006","source":"wordfence","cve":"CVE-2024-5074","title":"WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'login_pwd'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d73781-d0e8-4730-9ec1-ff2151982006?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T19:45:05Z"},{"id":"wordfence:99d7ea62-3a2b-4c29-99aa-a279bda84092","source":"wordfence","cve":"CVE-2026-97299","title":"Razorpay Payment Links for WooCommerce <= 2.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d7ea62-3a2b-4c29-99aa-a279bda84092?source=api-prod","affected":[{"type":"plugin","slug":"rzp-woocommerce","name":"Razorpay Payment Links for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:42:33Z"},{"id":"wordfence:99d90610-490f-44a5-8e87-63927410c804","source":"wordfence","cve":"CVE-2018-7422","title":"Site Editor <= 1.1.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99d90610-490f-44a5-8e87-63927410c804?source=api-prod","affected":[{"type":"plugin","slug":"site-editor","name":"Site Editor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2018-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99db7ac5-b7ac-4a4f-bd05-e563a3dfb839","source":"wordfence","cve":"CVE-2025-12171","title":"RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99db7ac5-b7ac-4a4f-bd05-e563a3dfb839?source=api-prod","affected":[{"type":"plugin","slug":"restful-syndication","name":"RESTful Content Syndication","from":"1.1.0","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T06:40:39Z"},{"id":"wordfence:99dcb6c4-b9c6-4d3d-942f-b3877cc3efa7","source":"wordfence","cve":"CVE-2024-11366","title":"SEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99dcb6c4-b9c6-4d3d-942f-b3877cc3efa7?source=api-prod","affected":[{"type":"plugin","slug":"seo-landing-page-generator","name":"SEO Landing Page Generator","from":"*","from_inclusive":true,"to":"1.66.2","to_inclusive":true,"patched_in":"1.66.3"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:21Z"},{"id":"wordfence:99df25b9-cd58-4a42-8bbd-bc243558c227","source":"wordfence","cve":"CVE-2026-76555","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99df25b9-cd58-4a42-8bbd-bc243558c227?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:27:06Z"},{"id":"wordfence:99df8839-caad-4568-9b05-cb2aea38a051","source":"wordfence","cve":"","title":"TownHub <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99df8839-caad-4568-9b05-cb2aea38a051?source=api-prod","affected":[{"type":"theme","slug":"townhub","name":"TownHub - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2020-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99dfacb4-f784-4e8d-b411-7cab7683c7c8","source":"wordfence","cve":"CVE-2015-9430","title":"Crazy Bone < 0.6.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99dfacb4-f784-4e8d-b411-7cab7683c7c8?source=api-prod","affected":[{"type":"plugin","slug":"crazy-bone","name":"Crazy Bone","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":false,"patched_in":"0.6.0"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99dfce3b-2b47-41bf-8b20-b53fb9f061a7","source":"wordfence","cve":"CVE-2026-2374","title":"Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99dfce3b-2b47-41bf-8b20-b53fb9f061a7?source=api-prod","affected":[{"type":"plugin","slug":"login-recaptcha","name":"Login No Captcha reCAPTCHA","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-05-27T14:54:36Z","updated":"2026-05-28T03:27:27Z"},{"id":"wordfence:99e001f2-9fed-4674-b150-01612d8a74d8","source":"wordfence","cve":"CVE-2025-5921","title":"SureForms <= 1.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e001f2-9fed-4674-b150-01612d8a74d8?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-21T13:24:40Z"},{"id":"wordfence:99e0a243-3e0e-4e2b-82fd-95c3cfde8a1b","source":"wordfence","cve":"CVE-2014-5203","title":"WordPress Core < 3.9.2 - Deserialization via Widgets","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e0a243-3e0e-4e2b-82fd-95c3cfde8a1b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99e1f537-2c50-4115-9cf3-5a8809f45e54","source":"wordfence","cve":"CVE-2026-39442","title":"PressMart <= 1.2.26 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e1f537-2c50-4115-9cf3-5a8809f45e54?source=api-prod","affected":[{"type":"theme","slug":"presssmart","name":"PressMart - Modern Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.26","to_inclusive":true,"patched_in":"1.2.27"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:03:39Z"},{"id":"wordfence:99e24496-0e3b-4bff-ba14-dc535be10633","source":"wordfence","cve":"CVE-2024-2841","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e24496-0e3b-4bff-ba14-dc535be10633?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T04:31:35Z"},{"id":"wordfence:99e332d8-92a4-4643-a63c-3642bab0b007","source":"wordfence","cve":"CVE-2024-31267","title":"Flexible Checkout Fields for WooCommerce <= 4.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e332d8-92a4-4643-a63c-3642bab0b007?source=api-prod","affected":[{"type":"plugin","slug":"flexible-checkout-fields","name":"Flexible Checkout Fields for WooCommerce \u2013 WooCommerce Checkout Manager","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:54:36Z"},{"id":"wordfence:99e34600-7eba-473f-91c0-82e45a48c419","source":"wordfence","cve":"CVE-2026-25360","title":"Vex < 1.2.9 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e34600-7eba-473f-91c0-82e45a48c419?source=api-prod","affected":[{"type":"theme","slug":"vex","name":"Vex","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:54:47Z"},{"id":"wordfence:99e43091-7699-4746-b6da-ab60a15175ce","source":"wordfence","cve":"CVE-2024-11636","title":"Email Subscribers by Icegram Express \u2013 Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e43091-7699-4746-b6da-ab60a15175ce?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.44","to_inclusive":true,"patched_in":"5.7.45"}],"published":"2024-12-23T00:00:00Z","updated":"2025-01-17T12:29:50Z"},{"id":"wordfence:99e4b38c-f81d-4578-a623-ea62495e934d","source":"wordfence","cve":"CVE-2026-15292","title":"Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e4b38c-f81d-4578-a623-ea62495e934d?source=api-prod","affected":[{"type":"plugin","slug":"sudoku-shortcode","name":"Sudoku Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:07:53Z","updated":"2026-07-10T04:31:24Z"},{"id":"wordfence:99e61ed1-df56-4e95-b4f9-3027ee7b7793","source":"wordfence","cve":"CVE-2023-25702","title":"Quick Paypal Payments <= 5.7.25 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e61ed1-df56-4e95-b4f9-3027ee7b7793?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.25","to_inclusive":true,"patched_in":"5.7.26"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99e64e62-d09e-4b94-a982-12630fd2e946","source":"wordfence","cve":"","title":"KONTXT Improves WordPress Search <= 1.4.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e64e62-d09e-4b94-a982-12630fd2e946?source=api-prod","affected":[{"type":"plugin","slug":"kontxt-semantic-engine","name":"KONTXT Improves WordPress Search","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99e6787e-c543-4f41-8aec-52694702dfab","source":"wordfence","cve":"CVE-2026-61997","title":"Legal Stone | Lawyers & Attorneys WordPress Theme <= 1.2.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e6787e-c543-4f41-8aec-52694702dfab?source=api-prod","affected":[{"type":"theme","slug":"legal-stone","name":"Legal Stone | Lawyers & Attorneys WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:38:30Z"},{"id":"wordfence:99e6cc7b-7e65-4b8d-a927-1329ed6c1954","source":"wordfence","cve":"CVE-2026-6431","title":"User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e6cc7b-7e65-4b8d-a927-1329ed6c1954?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.15.7","to_inclusive":true,"patched_in":"3.15.8"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-07T12:29:05Z"},{"id":"wordfence:99e8017a-346e-42d8-b9c1-29ed15da1156","source":"wordfence","cve":"CVE-2021-24271","title":"Ultimate Addons for Elementor < 1.30.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e8017a-346e-42d8-b9c1-29ed15da1156?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":false,"patched_in":"1.30.0"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99e922ec-d40a-47e7-a10f-d966a351d182","source":"wordfence","cve":"CVE-2025-5528","title":"Social Sharing Plugin \u2013 Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99e922ec-d40a-47e7-a10f-d966a351d182?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.75","to_inclusive":true,"patched_in":"3.3.76"}],"published":"2025-06-06T21:59:19Z","updated":"2025-06-07T11:17:53Z"},{"id":"wordfence:99ec0876-881c-4dfe-a870-b7f58635fd3d","source":"wordfence","cve":"CVE-2025-58211","title":"Chatbox Manager <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ec0876-881c-4dfe-a870-b7f58635fd3d?source=api-prod","affected":[{"type":"plugin","slug":"wa-chatbox-manager","name":"Chatbox Manager","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:19:54Z"},{"id":"wordfence:99ed360a-5729-46ff-85ae-d5f9a2effe71","source":"wordfence","cve":"CVE-2025-27328","title":"WP-PostRatings Cheater <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ed360a-5729-46ff-85ae-d5f9a2effe71?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings-cheater","name":"WP-PostRatings Cheater","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:44:05Z"},{"id":"wordfence:99ed4989-6c30-4eb3-aba7-b7bbfb69a5c0","source":"wordfence","cve":"CVE-2024-56271","title":"WP SecureSubmit <= 1.5.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ed4989-6c30-4eb3-aba7-b7bbfb69a5c0?source=api-prod","affected":[{"type":"plugin","slug":"securesubmit","name":"WP SecureSubmit","from":"*","from_inclusive":true,"to":"1.5.18","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-03-13T20:15:24Z"},{"id":"wordfence:99edd858-5e2c-4cc5-adda-d8e70ddc86f6","source":"wordfence","cve":"CVE-2024-10897","title":"Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99edd858-5e2c-4cc5-adda-d8e70ddc86f6?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-elementor-addons","name":"Tutor LMS Elementor Addons","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-11-14T16:28:25Z","updated":"2024-11-15T04:29:05Z"},{"id":"wordfence:99f4f1dc-13a9-4fa0-bdb1-77a0d416c80f","source":"wordfence","cve":"CVE-2023-51481","title":"Local Delivery Drivers for WooCommerce <= 1.9.0 - Missing Authorization to Driver Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99f4f1dc-13a9-4fa0-bdb1-77a0d416c80f?source=api-prod","affected":[{"type":"plugin","slug":"local-delivery-drivers-for-woocommerce","name":"Local Delivery Drivers for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1","source":"wordfence","cve":"CVE-2023-24395","title":"Contact Form 7 Redirect & Thank You Page <= 1.0.3 - Cross-Site Request Forgery via cf7rl_admin_table","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99f831f2-fb96-4dc8-ba3d-6015fbc7e2e1?source=api-prod","affected":[{"type":"plugin","slug":"cf7-redirect-thank-you-page","name":"Business Essentials for Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99f876e0-8f13-468b-b5fa-ca61e3cf57b4","source":"wordfence","cve":"CVE-2026-116763","title":"LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99f876e0-8f13-468b-b5fa-ca61e3cf57b4?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.1","to_inclusive":true,"patched_in":"7.9.2"}],"published":"2026-10-28T21:04:19Z","updated":"2026-10-29T09:25:36Z"},{"id":"wordfence:99fa7f41-f3ac-435c-af1b-4a965291de37","source":"wordfence","cve":"","title":"RokIntroScroller <= 1.8 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99fa7f41-f3ac-435c-af1b-4a965291de37?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokintroscroller","name":"RokIntroScroller","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2013-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:99fc02ea-5399-4ff2-a5f9-27878cadf40d","source":"wordfence","cve":"CVE-2025-9517","title":"atec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99fc02ea-5399-4ff2-a5f9-27878cadf40d?source=api-prod","affected":[{"type":"plugin","slug":"atec-debug","name":"atec Debug","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":"1.2.23"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-04T04:23:48Z"},{"id":"wordfence:99fe886b-efc3-4133-98e7-8ceccf89a99b","source":"wordfence","cve":"CVE-2025-32501","title":"RentSyst <= 2.0.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99fe886b-efc3-4133-98e7-8ceccf89a99b?source=api-prod","affected":[{"type":"plugin","slug":"rentsyst","name":"RentSyst \u2013 CRM solution for fleet management","from":"*","from_inclusive":true,"to":"2.0.92","to_inclusive":true,"patched_in":"2.0.93"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-12T18:28:54Z"},{"id":"wordfence:99ffffae-85a8-4562-838d-4e952bb0d76e","source":"wordfence","cve":"CVE-2025-22311","title":"Private Messages for UserPro <= 4.10.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/99ffffae-85a8-4562-838d-4e952bb0d76e?source=api-prod","affected":[{"type":"plugin","slug":"userpro-messaging","name":"Private Messages for UserPro","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:29:48Z"},{"id":"wordfence:9a02ada3-94c0-4f5f-94f9-e5a9b02f202f","source":"wordfence","cve":"CVE-2026-32555","title":"Boost <= 2.0.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a02ada3-94c0-4f5f-94f9-e5a9b02f202f?source=api-prod","affected":[{"type":"plugin","slug":"boost","name":"Boost","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T10:42:57Z","updated":"2026-09-10T19:11:00Z"},{"id":"wordfence:9a03f2dc-21c4-44e9-b7bf-8d4420430466","source":"wordfence","cve":"CVE-2011-5051","title":"WP Symposium < 11.12.24 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a03f2dc-21c4-44e9-b7bf-8d4420430466?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"11.12.24","to_inclusive":false,"patched_in":"11.12.24"}],"published":"2011-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a047577-d5eb-425b-9318-4473d052a223","source":"wordfence","cve":"CVE-2024-47350","title":"YITH WooCommerce Ajax Search <= 2.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a047577-d5eb-425b-9318-4473d052a223?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:14:36Z"},{"id":"wordfence:9a077f41-ff1d-4c86-8f39-5e2f795abc3e","source":"wordfence","cve":"CVE-2025-23978","title":"FlashCounter <= 1.1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a077f41-ff1d-4c86-8f39-5e2f795abc3e?source=api-prod","affected":[{"type":"plugin","slug":"flashcounter","name":"FlashCounter","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:30:19Z"},{"id":"wordfence:9a09102c-391e-4057-b883-3d2eef1671ce","source":"wordfence","cve":"CVE-2023-31090","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.60 - Arbitrary File Upload in File Manager","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09102c-391e-4057-b883-3d2eef1671ce?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.60","to_inclusive":true,"patched_in":"1.5.61"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a09425f-f18d-40c3-888d-0845e4ebdc77","source":"wordfence","cve":"CVE-2025-39595","title":"Quentn WP <= 1.2.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09425f-f18d-40c3-888d-0845e4ebdc77?source=api-prod","affected":[{"type":"plugin","slug":"quentn-wp","name":"Quentn WP","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:25:22Z"},{"id":"wordfence:9a09af8e-8da6-46e4-90e5-6ce1f8bfd36b","source":"wordfence","cve":"CVE-2016-10939","title":"Xtreme Locator Dealer Locator Plugin <= 3.0.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09af8e-8da6-46e4-90e5-6ce1f8bfd36b?source=api-prod","affected":[{"type":"plugin","slug":"xtremelocator","name":"Xtreme Locator","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2016-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a09ec65-32e4-4841-a365-f67c15b80bf9","source":"wordfence","cve":"CVE-2026-3829","title":"WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09ec65-32e4-4841-a365-f67c15b80bf9?source=api-prod","affected":[{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"7.8.5.10","to_inclusive":true,"patched_in":"7.8.5.11"}],"published":"2026-05-13T17:14:25Z","updated":"2026-05-14T05:30:32Z"},{"id":"wordfence:9a0bc461-d4fa-46d5-8725-9ab4c540b80e","source":"wordfence","cve":"CVE-2024-32574","title":"WordPress Simple HTML Sitemap <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0bc461-d4fa-46d5-8725-9ab4c540b80e?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:51:16Z"},{"id":"wordfence:9a0dc62c-786d-40f3-b9c9-bd199a176192","source":"wordfence","cve":"CVE-2025-11254","title":"Contest Gallery \u2013 Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection","severity":"medium","cvss":4.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"27.0.3","to_inclusive":true,"patched_in":"28.0.0"}],"published":"2025-10-10T19:47:00Z","updated":"2025-10-11T08:29:17Z"},{"id":"wordfence:9a0f1006-8015-4e67-9b03-16d3ad3c0e77","source":"wordfence","cve":"CVE-2023-52192","title":"Keap Official Opt-in Forms <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0f1006-8015-4e67-9b03-16d3ad3c0e77?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-official-opt-in-forms","name":"Keap Official Opt-in Forms","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2025-04-21T14:38:30Z"},{"id":"wordfence:9a0fc036-5fd1-4cc2-b7e0-2830feb66355","source":"wordfence","cve":"CVE-2025-30565","title":"banner-manager <= 16.04.19 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0fc036-5fd1-4cc2-b7e0-2830feb66355?source=api-prod","affected":[{"type":"plugin","slug":"banner-manager","name":"banner-manager","from":"*","from_inclusive":true,"to":"16.04.19","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T13:20:03Z"},{"id":"wordfence:9a129b7d-2732-4e4e-b168-98934f1c6ffe","source":"wordfence","cve":"CVE-2025-66069","title":"PPOM for WooCommerce <= 33.0.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a129b7d-2732-4e4e-b168-98934f1c6ffe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"33.0.16","to_inclusive":true,"patched_in":"33.0.17"}],"published":"2025-11-17T00:00:00Z","updated":"2025-11-25T15:55:54Z"},{"id":"wordfence:9a1317bb-90fe-493c-9061-9597b3dd5534","source":"wordfence","cve":"CVE-2025-67625","title":"Trade Runner <= 3.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a1317bb-90fe-493c-9061-9597b3dd5534?source=api-prod","affected":[{"type":"plugin","slug":"traderunner","name":"Trade Runner","from":"*","from_inclusive":true,"to":"3.14","to_inclusive":true,"patched_in":""}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-05T18:43:12Z"},{"id":"wordfence:9a13cbc7-fd51-43e6-bf22-4d0510c5a1c7","source":"wordfence","cve":"CVE-2015-9534","title":"Easy Digital Downloads - Quota < 1.2.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a13cbc7-fd51-43e6-bf22-4d0510c5a1c7?source=api-prod","affected":[{"type":"theme","slug":"quota","name":"Easy Digital Downloads - Quota","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a15946b-c4df-43e8-9e1d-7a8367cfda6b","source":"wordfence","cve":"CVE-2023-32515","title":"Custom Field Suite <= 2.6.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a15946b-c4df-43e8-9e1d-7a8367cfda6b?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.2.1","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a184384-9162-4509-957b-d97dd4089856","source":"wordfence","cve":"CVE-2024-23506","title":"InstaWP Connect <= 0.1.0.9 - Missing Authorization to Sensitive Information Dislcosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a184384-9162-4509-957b-d97dd4089856?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.9","to_inclusive":true,"patched_in":"0.1.0.10"}],"published":"2024-01-24T00:00:00Z","updated":"2024-01-26T15:09:55Z"},{"id":"wordfence:9a190909-4b0f-4a44-8371-d79f64d323c2","source":"wordfence","cve":"CVE-2023-29097","title":"a3 Portfolio <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a190909-4b0f-4a44-8371-d79f64d323c2?source=api-prod","affected":[{"type":"plugin","slug":"a3-portfolio","name":"a3 Portfolio","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a1aa28f-0e8b-4961-abdd-c46b7fb3dceb","source":"wordfence","cve":"CVE-2025-49295","title":"MediClinic <= 2.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a1aa28f-0e8b-4961-abdd-c46b7fb3dceb?source=api-prod","affected":[{"type":"theme","slug":"mediclinic","name":"MediClinic - Medical Healthcare WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:30:28Z"},{"id":"wordfence:9a214f35-7e6b-4bed-b777-99b60e9988d0","source":"wordfence","cve":"CVE-2026-81809","title":"Paytm Payment Gateway <= 2.8.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a214f35-7e6b-4bed-b777-99b60e9988d0?source=api-prod","affected":[{"type":"plugin","slug":"paytm-payments","name":"Paytm Payment Gateway","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:40:12Z"},{"id":"wordfence:9a268550-af65-405a-a16a-9083533e4acc","source":"wordfence","cve":"CVE-2024-30505","title":"Church Admin <= 4.1.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a268550-af65-405a-a16a-9083533e4acc?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"4.1.19"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T15:02:59Z"},{"id":"wordfence:9a2782de-3ce2-4626-84c4-58c1ff454753","source":"wordfence","cve":"CVE-2023-0167","title":"GetResponse for WordPress <= 5.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a2782de-3ce2-4626-84c4-58c1ff454753?source=api-prod","affected":[{"type":"plugin","slug":"getresponse-integration","name":"GetResponse for WordPress","from":"*","from_inclusive":true,"to":"5.5.31","to_inclusive":true,"patched_in":"5.5.32"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a279832-64d8-4e0b-8eba-b7b89c80069d","source":"wordfence","cve":"","title":"Survey And Quiz Tool <= 2.9.2 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a279832-64d8-4e0b-8eba-b7b89c80069d?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-quiz-tool","name":"WP Survey And Quiz Tool","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a29aea7-9e22-4edb-80d9-266843a416a5","source":"wordfence","cve":"CVE-2020-7048","title":"WP Database Reset <= 3.1 - Unauthenticated Database Reset","severity":"critical","cvss":9.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a29aea7-9e22-4edb-80d9-266843a416a5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-database-reset","name":"Database Reset","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.15"}],"published":"2020-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a2c6c4a-15ac-40ab-9571-64a355a89e0c","source":"wordfence","cve":"CVE-2026-28029","title":"EmojiNation <= 1.0.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a2c6c4a-15ac-40ab-9571-64a355a89e0c?source=api-prod","affected":[{"type":"theme","slug":"emojination","name":"EmojiNation","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:31:47Z"},{"id":"wordfence:9a2ece36-0be8-4a1e-bd86-3f48f02c13f0","source":"wordfence","cve":"CVE-2026-81794","title":"Shirt Product Designer for WooCommerce  1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a2ece36-0be8-4a1e-bd86-3f48f02c13f0?source=api-prod","affected":[{"type":"plugin","slug":"woo-shirt-product-designer","name":"Shirt Product Designer for WooCommerce","from":"1.0.4","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:19:26Z"},{"id":"wordfence:9a2ee9bb-ae20-47ae-b792-438bf7be6cc4","source":"wordfence","cve":"CVE-2021-24860","title":"BSK PDF Manager <= 3.1.1 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a2ee9bb-ae20-47ae-b792-438bf7be6cc4?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a30c6c2-fd90-421b-b4d7-ebe2605a96a0","source":"wordfence","cve":"CVE-2025-26949","title":"Team Section Block <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a30c6c2-fd90-421b-b4d7-ebe2605a96a0?source=api-prod","affected":[{"type":"plugin","slug":"team-section","name":"Team Section Block \u2013 Showcase Team Members with Layout Options","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:22:33Z"},{"id":"wordfence:9a31190f-e2ed-46ee-a224-85a0a003738d","source":"wordfence","cve":"CVE-2025-13750","title":"Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a31190f-e2ed-46ee-a224-85a0a003738d?source=api-prod","affected":[{"type":"plugin","slug":"webp-converter-for-media","name":"Converter for Media \u2013 Optimize images | Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2025-12-16T18:33:57Z","updated":"2025-12-17T06:37:00Z"},{"id":"wordfence:9a322b84-93cf-4793-956f-c2e53574041c","source":"wordfence","cve":"CVE-2025-24623","title":"Really Simple SSL <= 9.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a322b84-93cf-4793-956f-c2e53574041c?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.1.4","to_inclusive":true,"patched_in":"9.2.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:15:30Z"},{"id":"wordfence:9a349509-a9b3-4fbb-8a2f-6a2c2d9b42ae","source":"wordfence","cve":"CVE-2026-66661","title":"Directories Pro <= 2.0.5 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a349509-a9b3-4fbb-8a2f-6a2c2d9b42ae?source=api-prod","affected":[{"type":"plugin","slug":"directories-pro","name":"Directories Pro - Directory plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-14T13:06:14Z"},{"id":"wordfence:9a34ec54-7629-4c14-b5e0-d47f5d3a72ce","source":"wordfence","cve":"CVE-2026-75018","title":"Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a34ec54-7629-4c14-b5e0-d47f5d3a72ce?source=api-prod","affected":[{"type":"plugin","slug":"custom-contact-forms","name":"Custom Contact Forms","from":"*","from_inclusive":true,"to":"7.16","to_inclusive":true,"patched_in":"7.16.1"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-08T13:43:47Z"},{"id":"wordfence:9a353364-73a9-428c-b702-0183b29c7e3d","source":"wordfence","cve":"CVE-2017-18575","title":"NewStatPress < 1.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a353364-73a9-428c-b702-0183b29c7e3d?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a35cff6-f80c-47ce-9eef-ba56e38b7a12","source":"wordfence","cve":"CVE-2026-115609","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a35cff6-f80c-47ce-9eef-ba56e38b7a12?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.62","to_inclusive":true,"patched_in":"2.8.63"}],"published":"2026-10-26T12:03:48Z","updated":"2026-11-03T19:27:51Z"},{"id":"wordfence:9a371489-031e-483e-9fde-3901b55710c6","source":"wordfence","cve":"CVE-2022-46849","title":"Coming Soon Page <= 1.5.9 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a371489-031e-483e-9fde-3901b55710c6?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a3ba904-d0b7-4df1-a36a-3a36cc252641","source":"wordfence","cve":"CVE-2026-14596","title":"DynamicKit for Elementor < 1.0.3 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a3ba904-d0b7-4df1-a36a-3a36cc252641?source=api-prod","affected":[{"type":"plugin","slug":"dynamickit-elementor","name":"DynamicKit for Elementor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:24:39Z"},{"id":"wordfence:9a3c3b3b-7fc9-4586-9a51-33642654dc9f","source":"wordfence","cve":"CVE-2014-8363","title":"WordPress Spreadsheet <= 0.62 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a3c3b3b-7fc9-4586-9a51-33642654dc9f?source=api-prod","affected":[{"type":"plugin","slug":"wpSS","name":"WordPress Spreadsheet","from":"*","from_inclusive":true,"to":"0.62","to_inclusive":true,"patched_in":""}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a41bc0e-0ab9-4cee-b3ca-d730c828782c","source":"wordfence","cve":"CVE-2025-14509","title":"Lucky Wheel for WooCommerce \u2013 Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a41bc0e-0ab9-4cee-b3ca-d730c828782c?source=api-prod","affected":[{"type":"plugin","slug":"woo-lucky-wheel","name":"Lucky Wheel for WooCommerce \u2013 Spin a Sale","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2025-12-29T23:11:45Z","updated":"2025-12-30T11:14:26Z"},{"id":"wordfence:9a423266-89e1-422d-b1e3-6368051eb2fe","source":"wordfence","cve":"CVE-2023-49149","title":"Currency Converter Calculator <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a423266-89e1-422d-b1e3-6368051eb2fe?source=api-prod","affected":[{"type":"plugin","slug":"currency-converter-calculator","name":"Currency Converter Calculator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-14T13:16:41Z"},{"id":"wordfence:9a446fe7-c97a-436e-b494-b924e6518297","source":"wordfence","cve":"CVE-2024-6823","title":"Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a446fe7-c97a-436e-b494-b924e6518297?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.18","to_inclusive":true,"patched_in":"3.19"}],"published":"2024-08-12T16:35:37Z","updated":"2024-08-13T05:30:56Z"},{"id":"wordfence:9a4488c8-7138-4046-88ea-84f9462eec93","source":"wordfence","cve":"CVE-2021-24813","title":"Events Made Easy <= 2.2.23 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4488c8-7138-4046-88ea-84f9462eec93?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"2.2.24","to_inclusive":false,"patched_in":"2.2.24"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a455340-4d07-4f02-9dcb-835fcd43985d","source":"wordfence","cve":"CVE-2025-47657","title":"Productive Commerce <= 1.1.53 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a455340-4d07-4f02-9dcb-835fcd43985d?source=api-prod","affected":[{"type":"plugin","slug":"productive-commerce","name":"Productive Commerce \u2013 Wishlist, Compare & MiniCart","from":"*","from_inclusive":true,"to":"1.1.53","to_inclusive":true,"patched_in":"1.1.54"}],"published":"2025-05-07T00:00:00Z","updated":"2026-11-10T23:17:47Z"},{"id":"wordfence:9a475017-ef45-4614-bdc6-ddd619b8caf3","source":"wordfence","cve":"CVE-2024-1385","title":"WP-Stateless \u2013 Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a475017-ef45-4614-bdc6-ddd619b8caf3?source=api-prod","affected":[{"type":"plugin","slug":"wp-stateless","name":"WP-Stateless \u2013 Google Cloud Storage","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T03:32:05Z"},{"id":"wordfence:9a47708e-c8b4-4eab-a960-4abaa831ca42","source":"wordfence","cve":"CVE-2024-53731","title":"Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a47708e-c8b4-4eab-a960-4abaa831ca42?source=api-prod","affected":[{"type":"plugin","slug":"fintelligence-calculator","name":"Fintelligence Calculator","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:30:48Z"},{"id":"wordfence:9a47e6ff-a1d2-40f0-b4d2-8ee8394ce603","source":"wordfence","cve":"CVE-2026-7529","title":"wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a47e6ff-a1d2-40f0-b4d2-8ee8394ce603?source=api-prod","affected":[{"type":"plugin","slug":"wisecampaign","name":"wiseCampaign \u2013 WooCommerce Side Cart, BOGO Discounts, Countdown Timer & Exit Intent Popup","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2026-08-04T17:32:31Z","updated":"2026-08-05T13:26:42Z"},{"id":"wordfence:9a485314-cd68-400c-b398-2f8529c6a3ab","source":"wordfence","cve":"CVE-2024-8922","title":"Product Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a485314-cd68-400c-b398-2f8529c6a3ab?source=api-prod","affected":[{"type":"plugin","slug":"enquiry-quotation-for-woocommerce","name":"PiWeb Product Enquiry or product catalog for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.33.33","to_inclusive":true,"patched_in":"2.2.33.34"}],"published":"2024-09-26T00:00:00Z","updated":"2024-09-27T05:31:03Z"},{"id":"wordfence:9a49b72f-9ad9-4338-aeeb-d81be58e1c15","source":"wordfence","cve":"CVE-2024-43235","title":"Meta Box \u2013 WordPress Custom Fields Framework <= 5.9.10 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a49b72f-9ad9-4338-aeeb-d81be58e1c15?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":"5.9.11"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:03:37Z"},{"id":"wordfence:9a4a2b01-450d-46fb-9de5-0de40b590201","source":"wordfence","cve":"CVE-2024-43940","title":"Zynith SEO <= 7.4.9 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4a2b01-450d-46fb-9de5-0de40b590201?source=api-prod","affected":[{"type":"plugin","slug":"zynith-seo","name":"Zynith SEO","from":"*","from_inclusive":true,"to":"7.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:42:44Z"},{"id":"wordfence:9a4a2c6c-81f5-4812-8226-73a27782d78e","source":"wordfence","cve":"CVE-2025-26558","title":"Aparat Responsive <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4a2c6c-81f5-4812-8226-73a27782d78e?source=api-prod","affected":[{"type":"plugin","slug":"aparat-responsive","name":"Aparat Responsive","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:40:03Z"},{"id":"wordfence:9a4bcfc8-7f6f-4039-9712-016f34a5ed76","source":"wordfence","cve":"CVE-2025-32557","title":"WP Featured Screenshot <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4bcfc8-7f6f-4039-9712-016f34a5ed76?source=api-prod","affected":[{"type":"plugin","slug":"wp-featured-screenshot","name":"WP Featured Screenshot","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:09:17Z"},{"id":"wordfence:9a4c327c-f756-4f50-8121-363791c6bd8c","source":"wordfence","cve":"CVE-2021-24618","title":"Donate With QRCode <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4c327c-f756-4f50-8121-363791c6bd8c?source=api-prod","affected":[{"type":"plugin","slug":"donate-with-qrcode","name":"\u535a\u5ba2\u793e\u4ea4\u5206\u4eab\u7ec4\u4ef6","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2021-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a4f28bb-7669-483a-b93a-276b7a10826a","source":"wordfence","cve":"CVE-2026-28134","title":"JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a4f28bb-7669-483a-b93a-276b7a10826a?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.8.1.2"}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:37:09Z"},{"id":"wordfence:9a5474de-f805-4d4d-abe7-45f1571d4581","source":"wordfence","cve":"CVE-2025-68553","title":"Lendiz < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a5474de-f805-4d4d-abe7-45f1571d4581?source=api-prod","affected":[{"type":"theme","slug":"lendiz","name":"Lendiz - Loan & Funding Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:30:44Z"},{"id":"wordfence:9a547cd3-1282-466e-90a4-ef980a9e06a4","source":"wordfence","cve":"CVE-2026-119165","title":"WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a547cd3-1282-466e-90a4-ef980a9e06a4?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":true,"patched_in":"9.1"}],"published":"2026-11-06T14:02:14Z","updated":"2026-11-07T02:29:16Z"},{"id":"wordfence:9a552f81-b222-46f0-b318-702e09d249c1","source":"wordfence","cve":"CVE-2024-13637","title":"Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a552f81-b222-46f0-b318-702e09d249c1?source=api-prod","affected":[{"type":"plugin","slug":"demo-awesome","name":"Demo Awesome","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:30:16Z","updated":"2025-04-02T09:22:07Z"},{"id":"wordfence:9a573740-cdfe-4b58-b33b-5e50bcbc4779","source":"wordfence","cve":"CVE-2024-3136","title":"MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a573740-cdfe-4b58-b33b-5e50bcbc4779?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-18T21:05:19Z"},{"id":"wordfence:9a57bd92-c819-436f-b7ea-727c9b9f45e5","source":"wordfence","cve":"CVE-2026-10724","title":"Reviews Feed <= 2.6.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a57bd92-c819-436f-b7ea-727c9b9f45e5?source=api-prod","affected":[{"type":"plugin","slug":"reviews-feed","name":"Reviews Feed \u2013 Google Reviews, Yelp, Trustpilot & Tripadvisor Reviews Widget","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T21:53:42Z"},{"id":"wordfence:9a5bbbc9-7e69-45fd-a0dd-9b4faa026f95","source":"wordfence","cve":"CVE-2025-39570","title":"WPCOM Member <= 1.7.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a5bbbc9-7e69-45fd-a0dd-9b4faa026f95?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:49:48Z"},{"id":"wordfence:9a5c2cb6-827f-442d-b510-8f0ddcaaaca3","source":"wordfence","cve":"CVE-2026-32430","title":"PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a5c2cb6-827f-442d-b510-8f0ddcaaaca3?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"2.9.10"}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:18:23Z"},{"id":"wordfence:9a5ce873-e90b-4bdc-b428-426818ff9a86","source":"wordfence","cve":"CVE-2022-36386","title":"WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a5ce873-e90b-4bdc-b428-426818ff9a86?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a5eb090-2dfb-4b30-bfc6-38061b94b87a","source":"wordfence","cve":"CVE-2024-11419","title":"Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a5eb090-2dfb-4b30-bfc6-38061b94b87a?source=api-prod","affected":[{"type":"plugin","slug":"password-for-wp","name":"Password for WP","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-12-11T15:10:43Z","updated":"2025-01-20T21:47:28Z"},{"id":"wordfence:9a61ccdc-a681-4084-bc42-df7e989fdbb1","source":"wordfence","cve":"CVE-2025-58706","title":"Woo Hoo <= 1.25 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a61ccdc-a681-4084-bc42-df7e989fdbb1?source=api-prod","affected":[{"type":"theme","slug":"woohoo","name":"WooHoo Newspaper Magazine Theme","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-19T21:56:32Z"},{"id":"wordfence:9a63a4ec-80e6-48cc-a778-97fa3917817e","source":"wordfence","cve":"CVE-2025-8492","title":"Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a63a4ec-80e6-48cc-a778-97fa3917817e?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.22","to_inclusive":true,"patched_in":"10.24"}],"published":"2025-09-10T18:46:11Z","updated":"2025-11-05T19:39:23Z"},{"id":"wordfence:9a68e014-69df-4498-9cc2-618d966e5ed6","source":"wordfence","cve":"CVE-2024-53751","title":"Build App Online <= 1.0.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a68e014-69df-4498-9cc2-618d966e5ed6?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:31:47Z"},{"id":"wordfence:9a68e2ab-fe2f-43f8-bb1b-b46a483bd06f","source":"wordfence","cve":"CVE-2026-16146","title":"Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a68e2ab-fe2f-43f8-bb1b-b46a483bd06f?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliant-recaptcha-for-all-forms","name":"Invisible Anti-Spam & CAPTCHA \u2014 reCAPTCHA Alternative for All Forms","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-08-14T15:07:35Z","updated":"2026-08-15T03:26:00Z"},{"id":"wordfence:9a6921b3-a0a1-4392-ba8d-d3fb6892c639","source":"wordfence","cve":"CVE-2026-66692","title":"Colissimo shipping methods for WooCommerce <= 2.10.0 - Authenticated (Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a6921b3-a0a1-4392-ba8d-d3fb6892c639?source=api-prod","affected":[{"type":"plugin","slug":"colissimo-shipping-methods-for-woocommerce","name":"Colissimo shipping methods for WooCommerce","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:28:01Z"},{"id":"wordfence:9a6b05b1-c649-4b72-b884-11fb83ec77f2","source":"wordfence","cve":"CVE-2024-7032","title":"Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a6b05b1-c649-4b72-b884-11fb83ec77f2?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-08-20T17:25:26Z","updated":"2024-08-28T16:33:01Z"},{"id":"wordfence:9a6dce54-8d60-458c-90cd-e636413a388b","source":"wordfence","cve":"CVE-2024-52410","title":"Referrer Detector <= 4.2.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a6dce54-8d60-458c-90cd-e636413a388b?source=api-prod","affected":[{"type":"plugin","slug":"referrer-detector","name":"Referrer Detector","from":"*","from_inclusive":true,"to":"4.2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:26:59Z"},{"id":"wordfence:9a70e291-1bc9-44ad-91a2-cf0624bb8d88","source":"wordfence","cve":"CVE-2023-1330","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a70e291-1bc9-44ad-91a2-cf0624bb8d88?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a714afd-2840-4301-a2b8-1ca9b6774698","source":"wordfence","cve":"CVE-2025-31734","title":"Simple Post Expiration <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a714afd-2840-4301-a2b8-1ca9b6774698?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-expiration","name":"Simple Post Expiration","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-07-29T06:39:25Z"},{"id":"wordfence:9a724287-5b9c-45cb-ab83-28d73ddc39ec","source":"wordfence","cve":"CVE-2026-42679","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a724287-5b9c-45cb-ab83-28d73ddc39ec?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2026-05-17T00:00:00Z","updated":"2026-05-19T16:23:35Z"},{"id":"wordfence:9a7709fd-bb53-47a6-9fae-d5a6be513b39","source":"wordfence","cve":"CVE-2019-16521","title":"Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7709fd-bb53-47a6-9fae-d5a6be513b39?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.11.9","to_inclusive":false,"patched_in":"1.11.9"}],"published":"2019-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a7737b3-d85b-471f-8252-3ee6b598786d","source":"wordfence","cve":"CVE-2009-4168","title":"WP-Cumulus <= 1.22 - Cross-Site Scripting via tagcloud","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7737b3-d85b-471f-8252-3ee6b598786d?source=api-prod","affected":[{"type":"plugin","slug":"wp-cumulus","name":"WP Cumulus","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2009-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a77672b-340e-4f10-abe7-461c2db537b8","source":"wordfence","cve":"CVE-2024-3287","title":"SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a77672b-340e-4f10-abe7-461c2db537b8?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.10.2","to_inclusive":true,"patched_in":"3.10.3"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:52:26Z"},{"id":"wordfence:9a79ac89-b3b4-4e84-b6a9-0f4695bf48ff","source":"wordfence","cve":"CVE-2026-16289","title":"ProfileGrid <= 5.0.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a79ac89-b3b4-4e84-b6a9-0f4695bf48ff?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.0.0.0","to_inclusive":true,"patched_in":"6.0.0.0"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:39:37Z"},{"id":"wordfence:9a7ad642-ace5-41c9-bd33-44e532326f25","source":"wordfence","cve":"CVE-2025-28982","title":"WP Pipes <= 1.4.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7ad642-ace5-41c9-bd33-44e532326f25?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2026-02-04T03:25:32Z"},{"id":"wordfence:9a7ca5f6-89c0-49ce-9aef-2208365c6151","source":"wordfence","cve":"CVE-2026-7209","title":"Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7ca5f6-89c0-49ce-9aef-2208365c6151?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"8.9.4"}],"published":"2026-05-01T14:45:40Z","updated":"2026-05-02T03:36:43Z"},{"id":"wordfence:9a7cbd2e-79c9-4be7-b458-e4e5f0376a22","source":"wordfence","cve":"CVE-2021-25067","title":"Landing Page Builder <= 1.4.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7cbd2e-79c9-4be7-b458-e4e5f0376a22?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.4.9.5","to_inclusive":true,"patched_in":"1.4.9.6"}],"published":"2021-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a7f738e-21f3-42f3-bf33-1d93ff0d1364","source":"wordfence","cve":"CVE-2022-2823","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Responsive WordPress Plugin <= 3.27.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a7f738e-21f3-42f3-bf33-1d93ff0d1364?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"3.27.8","from_inclusive":true,"to":"3.27.8","to_inclusive":true,"patched_in":"3.27.9"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a812aad-d769-4c28-8035-471bd3a50faa","source":"wordfence","cve":"CVE-2026-66476","title":"Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a812aad-d769-4c28-8035-471bd3a50faa?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.9.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:53:12Z"},{"id":"wordfence:9a81cc87-cd77-4b86-a8aa-12aa03ab18d6","source":"wordfence","cve":"CVE-2025-24763","title":"bbPress API <= 1.0.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a81cc87-cd77-4b86-a8aa-12aa03ab18d6?source=api-prod","affected":[{"type":"plugin","slug":"bbp-api","name":"bbPress API","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:00:27Z"},{"id":"wordfence:9a825b7b-118d-4c34-905b-0cf7cfa00ad7","source":"wordfence","cve":"CVE-2025-30843","title":"bizcalendar-web <= 1.1.0.34 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a825b7b-118d-4c34-905b-0cf7cfa00ad7?source=api-prod","affected":[{"type":"plugin","slug":"bizcalendar-web","name":"BizCalendar Web","from":"*","from_inclusive":true,"to":"1.1.0.34","to_inclusive":true,"patched_in":"1.1.0.35"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:11:34Z"},{"id":"wordfence:9a83f381-a8ce-472d-a202-f7d7f22fd650","source":"wordfence","cve":"","title":"Simple SEO <= 1.7.91 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a83f381-a8ce-472d-a202-f7d7f22fd650?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"1.7.91","to_inclusive":true,"patched_in":"1.7.92"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a841e14-c96f-43ec-a1bf-42d5672c9e34","source":"wordfence","cve":"CVE-2025-48298","title":"SEOPress for MainWP <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a841e14-c96f-43ec-a1bf-42d5672c9e34?source=api-prod","affected":[{"type":"plugin","slug":"seopress-for-mainwp","name":"SEOPress for MainWP","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-07-25T00:00:00Z","updated":"2025-07-28T20:50:43Z"},{"id":"wordfence:9a85b549-f6a4-4dc3-9f2a-35d783099f96","source":"wordfence","cve":"CVE-2023-24005","title":"Inline Tweet Sharer <= 2.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a85b549-f6a4-4dc3-9f2a-35d783099f96?source=api-prod","affected":[{"type":"plugin","slug":"inline-tweet-sharer","name":"Inline Tweet Sharer \u2013 Twitter Sharing Plugin","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.6"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a85cad9-bcb8-417d-a80b-3334a3ef77a2","source":"wordfence","cve":"CVE-2025-23732","title":"Easy Filtering <= 2.5.0 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a85cad9-bcb8-417d-a80b-3334a3ef77a2?source=api-prod","affected":[{"type":"plugin","slug":"easy-filtering","name":"Easy Filtering","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:33:33Z"},{"id":"wordfence:9a860fc9-3ee6-4eb6-9cb3-a14e5de5bb3b","source":"wordfence","cve":"CVE-2026-83533","title":"Express Checkout <= 2.4.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a860fc9-3ee6-4eb6-9cb3-a14e5de5bb3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-express-checkout","name":"WP Express Checkout (Fast Payments via PayPal & Stripe)","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-10T19:20:17Z"},{"id":"wordfence:9a866dfd-2374-4a66-9dee-b8bda47d1cc7","source":"wordfence","cve":"CVE-2026-15056","title":"StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a866dfd-2374-4a66-9dee-b8bda47d1cc7?source=api-prod","affected":[{"type":"plugin","slug":"storeengine","name":"StoreEngine \u2014 Complete eCommerce Solution with Memberships, Licensing, Affiliates & More","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-16T05:27:29Z"},{"id":"wordfence:9a87a18b-814b-4b94-959e-a9aafe5015bc","source":"wordfence","cve":"CVE-2024-13486","title":"Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a87a18b-814b-4b94-959e-a9aafe5015bc?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-22T14:34:06Z"},{"id":"wordfence:9a87f0a2-42b0-4536-b4d1-83a9f6ed4262","source":"wordfence","cve":"CVE-2024-6879","title":"Quiz and Survey Master (QSM) <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a87f0a2-42b0-4536-b4d1-83a9f6ed4262?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-28T22:49:47Z"},{"id":"wordfence:9a88330e-fbeb-4ac7-a143-a59766accbeb","source":"wordfence","cve":"CVE-2024-0653","title":"Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a88330e-fbeb-4ac7-a143-a59766accbeb?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-06-10T00:00:00Z","updated":"2024-07-29T21:36:57Z"},{"id":"wordfence:9a8a3607-4f2e-44fb-8141-75f7620508d4","source":"wordfence","cve":"CVE-2025-6989","title":"Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a8a3607-4f2e-44fb-8141-75f7620508d4?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.21.0","to_inclusive":true,"patched_in":"4.22.0"}],"published":"2025-07-25T19:04:17Z","updated":"2025-07-26T07:23:51Z"},{"id":"wordfence:9a8c2d1f-b744-4e4f-80d3-64f7c46e4395","source":"wordfence","cve":"CVE-2026-78293","title":"WP w3all phpBB <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a8c2d1f-b744-4e4f-80d3-64f7c46e4395?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:50:46Z"},{"id":"wordfence:9a8e6313-97df-45bf-840b-97002f368235","source":"wordfence","cve":"CVE-2025-23564","title":"WP FixTag <= v2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a8e6313-97df-45bf-840b-97002f368235?source=api-prod","affected":[{"type":"plugin","slug":"wp-fixtag","name":"WP FixTag","from":"*","from_inclusive":true,"to":"v2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:10:26Z"},{"id":"wordfence:9a92c682-b8b3-4d23-bd84-97d7440ee525","source":"wordfence","cve":"CVE-2026-1582","title":"WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92c682-b8b3-4d23-bd84-97d7440ee525?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.4.14","to_inclusive":true,"patched_in":"1.4.15"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T12:28:37Z"},{"id":"wordfence:9a92f44b-6f2b-439c-8245-ace189740425","source":"wordfence","cve":"CVE-2024-1697","title":"Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a92f44b-6f2b-439c-8245-ace189740425?source=api-prod","affected":[{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T01:57:40Z"},{"id":"wordfence:9a932e25-f7ff-4765-b827-c9e7dd9e30bd","source":"wordfence","cve":"CVE-2024-4856","title":"FS Product Inquiry <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a932e25-f7ff-4765-b827-c9e7dd9e30bd?source=api-prod","affected":[{"type":"plugin","slug":"fs-product-inquiry","name":"FS Product Inquiry","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-30T21:02:39Z"},{"id":"wordfence:9a93313d-a5d7-4109-93c5-b2da26e7a486","source":"wordfence","cve":"CVE-2025-2512","title":"File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a93313d-a5d7-4109-93c5-b2da26e7a486?source=api-prod","affected":[{"type":"plugin","slug":"file-away","name":"File Away","from":"*","from_inclusive":true,"to":"3.9.9.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T23:14:34Z","updated":"2025-03-24T19:50:05Z"},{"id":"wordfence:9a93ecaf-582d-4689-ba1f-52731c4b1ab7","source":"wordfence","cve":"","title":"Edit Comments <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a93ecaf-582d-4689-ba1f-52731c4b1ab7?source=api-prod","affected":[{"type":"plugin","slug":"edit-comments","name":"Edit Comments","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a96ac4c-9c29-4649-a756-d258f1db26e5","source":"wordfence","cve":"CVE-2025-32493","title":"BP Social Connect <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a96ac4c-9c29-4649-a756-d258f1db26e5?source=api-prod","affected":[{"type":"plugin","slug":"bp-social-connect","name":"BP Social Connect","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:14:01Z"},{"id":"wordfence:9a999044-5d4a-4415-a3b9-28c564e63a25","source":"wordfence","cve":"","title":"Responsive Vertical Icon Menu <= 1.5.8 - Reflected Cross-Site Scripting via 'id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a999044-5d4a-4415-a3b9-28c564e63a25?source=api-prod","affected":[{"type":"plugin","slug":"wpdevart-vertical-menu","name":"Responsive Vertical Icon Menu","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a9bd007-5d0a-401a-b0a5-4dca8e383b1d","source":"wordfence","cve":"CVE-2018-25308","title":"Buddypress Xprofile Custom Fields Type <= 2.6.3 - Authenticated (Custom+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9bd007-5d0a-401a-b0a5-4dca8e383b1d?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-xprofile-custom-fields-type","name":"BuddyPress Xprofile Custom Fields Type","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":""}],"published":"2018-08-04T00:00:00Z","updated":"2026-11-04T21:10:28Z"},{"id":"wordfence:9a9c8c4f-ce07-4fe5-a573-ece675d51441","source":"wordfence","cve":"","title":"Pricing Table by Supsystic <= 1.8.8 - Boolean-Based Blind SQL Injections","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9c8c4f-ce07-4fe5-a573-ece675d51441?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-by-supsystic","name":"Pricing Table by Supsystic \u2013 Responsive Pricing Plans & Comparison Tables","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a9d6c71-98ce-4fa7-817a-43e4f3dc0602","source":"wordfence","cve":"CVE-2024-10340","title":"Shortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9d6c71-98ce-4fa7-817a-43e4f3dc0602?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-shortcodes-creator","name":"Shortcodes Blocks Creator Ultimate","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-05T02:04:04Z"},{"id":"wordfence:9a9f4fb7-92f5-4136-9ca3-cf7bf5c0b717","source":"wordfence","cve":"CVE-2023-40670","title":"ReviewX <= 1.6.17 - Missing Authorization in rx_coupon_from_submit","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9f4fb7-92f5-4136-9ca3-cf7bf5c0b717?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.17","to_inclusive":true,"patched_in":"1.6.18"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9a9f93b1-aeb5-431e-b671-a3841a9cb70d","source":"wordfence","cve":"CVE-2025-53269","title":"My Wp Brand <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9f93b1-aeb5-431e-b671-a3841a9cb70d?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-brand","name":"My Wp Brand \u2013 Hide menu & Hide Plugin","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-06-27T00:00:00Z","updated":"2025-10-08T21:12:58Z"},{"id":"wordfence:9aa23288-141b-47d9-b83b-8ec36d96c968","source":"wordfence","cve":"CVE-2026-48202","title":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content <= 0.8.8 - Unauthenticated Arbitrary Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa23288-141b-47d9-b83b-8ec36d96c968?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.8.8","to_inclusive":true,"patched_in":"0.8.9"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:57:17Z"},{"id":"wordfence:9aa2d91f-0524-4bf1-8274-bbd35370ba67","source":"wordfence","cve":"CVE-2026-65580","title":"Agrion <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa2d91f-0524-4bf1-8274-bbd35370ba67?source=api-prod","affected":[{"type":"theme","slug":"agrion","name":"Agrion - Agriculture Farm & Farmers Template Kit","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:57:53Z"},{"id":"wordfence:9aa4bcc1-3c9e-451e-81ed-2059882b2ef1","source":"wordfence","cve":"CVE-2026-120531","title":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa4bcc1-3c9e-451e-81ed-2059882b2ef1?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.47","to_inclusive":true,"patched_in":"10.48"}],"published":"2026-11-07T08:27:42Z","updated":"2026-11-07T21:24:12Z"},{"id":"wordfence:9aa5247a-b85b-4a0d-ac3e-4b4ef8ccd8ed","source":"wordfence","cve":"CVE-2024-30440","title":"Themify Event Post <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa5247a-b85b-4a0d-ac3e-4b4ef8ccd8ed?source=api-prod","affected":[{"type":"plugin","slug":"themify-event-post","name":"Themify Event Post","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T23:59:41Z"},{"id":"wordfence:9aa92b37-9b79-4b8f-931c-3f462c77ae2a","source":"wordfence","cve":"CVE-2026-103325","title":"TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa92b37-9b79-4b8f-931c-3f462c77ae2a?source=api-prod","affected":[{"type":"plugin","slug":"tienda-crypto-woo","name":"TiendaCrypto para WooCommerce","from":"1.0.1","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-24T00:00:00Z","updated":"2026-10-28T15:01:12Z"},{"id":"wordfence:9aa98012-1c0c-402d-9e4f-89b2d45f71e1","source":"wordfence","cve":"CVE-2025-23864","title":"WCS QR Code Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aa98012-1c0c-402d-9e4f-89b2d45f71e1?source=api-prod","affected":[{"type":"plugin","slug":"wcs-qr-code-generator","name":"WCS QR Code Generator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:37:39Z"},{"id":"wordfence:9aad7539-071e-474b-a2db-0f496aac2995","source":"wordfence","cve":"CVE-2026-23798","title":"PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aad7539-071e-474b-a2db-0f496aac2995?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.15.10","to_inclusive":true,"patched_in":"11.15.11"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:59:15Z"},{"id":"wordfence:9aaea0a2-3ec4-4c67-8c81-7ec7a879bbfe","source":"wordfence","cve":"CVE-2025-58891","title":"Sanger <= 1.24.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aaea0a2-3ec4-4c67-8c81-7ec7a879bbfe?source=api-prod","affected":[{"type":"theme","slug":"sanger","name":"Sanger - Freelance WordPress Theme","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:30:21Z"},{"id":"wordfence:9aaf2188-966d-43f3-a359-44ebdccaf6d8","source":"wordfence","cve":"CVE-2025-47537","title":"PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 5.3.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aaf2188-966d-43f3-a359-44ebdccaf6d8?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-woocommerce","name":"PDF Invoice for WooCommerce + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:20:30Z"},{"id":"wordfence:9aafc9a8-db81-4ba3-a0e3-1bf23df8bf31","source":"wordfence","cve":"CVE-2024-52443","title":"Geolocator <= 1.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aafc9a8-db81-4ba3-a0e3-1bf23df8bf31?source=api-prod","affected":[{"type":"plugin","slug":"geolocator","name":"Geolocator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:38:13Z"},{"id":"wordfence:9ab0526c-47d1-4780-99f3-61634b4af816","source":"wordfence","cve":"CVE-2026-119502","title":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder <= 4.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab0526c-47d1-4780-99f3-61634b4af816?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-11-07T09:14:00Z","updated":"2026-11-10T19:30:30Z"},{"id":"wordfence:9ab22aa8-399f-449b-83cf-25583c057cff","source":"wordfence","cve":"","title":"SP Project & Document Manager <= 4.59 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab22aa8-399f-449b-83cf-25583c057cff?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.59","to_inclusive":true,"patched_in":"4.62"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ab28410-76c5-43cb-b87a-c99f8867167c","source":"wordfence","cve":"CVE-2023-40204","title":"Folders <= 2.9.2 - Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab28410-76c5-43cb-b87a-c99f8867167c?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ab380db-5c5e-4185-8da1-8e0f0363bbcf","source":"wordfence","cve":"CVE-2025-26948","title":"Pie Register Premium <= 3.8.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab380db-5c5e-4185-8da1-8e0f0363bbcf?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.3.2","to_inclusive":true,"patched_in":"3.8.3.3"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:20:35Z"},{"id":"wordfence:9ab55dea-84d5-4ed6-a693-8c8de9b7c7dd","source":"wordfence","cve":"CVE-2009-2853","title":"WordPress Core < 2.8.3 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab55dea-84d5-4ed6-a693-8c8de9b7c7dd?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2009-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ab5890f-2657-4a35-9dfd-a4b9f7ad28d3","source":"wordfence","cve":"CVE-2026-88827","title":"Disable Users <= 1.0.5 - Disabled Account Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab5890f-2657-4a35-9dfd-a4b9f7ad28d3?source=api-prod","affected":[{"type":"plugin","slug":"disable-users","name":"Disable Users","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:32:04Z"},{"id":"wordfence:9ab883bf-d6b4-4b0e-b8f4-69e6c0f90c70","source":"wordfence","cve":"CVE-2021-24125","title":"Contact Form Submissions <= 1.7 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ab883bf-d6b4-4b0e-b8f4-69e6c0f90c70?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-submissions","name":"Contact Form Submissions","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2021-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9abae49f-b396-4684-8dd5-0b5593069861","source":"wordfence","cve":"CVE-2022-2392","title":"Lana Downloads Manager <= 1.7.1 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.4,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9abae49f-b396-4684-8dd5-0b5593069861?source=api-prod","affected":[{"type":"plugin","slug":"lana-downloads-manager","name":"Lana Downloads Manager","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2022-08-01T00:00:00Z","updated":"2025-07-10T19:47:48Z"},{"id":"wordfence:9abb2f0a-413f-4632-9b05-3bb0e7c2bb85","source":"wordfence","cve":"CVE-2024-50517","title":"ID-SK Toolkit <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9abb2f0a-413f-4632-9b05-3bb0e7c2bb85?source=api-prod","affected":[{"type":"plugin","slug":"idsk-toolkit","name":"ID-SK Toolkit","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-10-30T00:00:00Z","updated":"2025-04-21T14:41:57Z"},{"id":"wordfence:9abfd0f5-f665-4745-9756-8445ddbdc29d","source":"wordfence","cve":"CVE-2025-14068","title":"WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9abfd0f5-f665-4745-9756-8445ddbdc29d?source=api-prod","affected":[{"type":"plugin","slug":"wpnakama","name":"WPNakama \u2013 Editorial Workflow & Content Planning for WP","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":"0.6.4"}],"published":"2025-12-11T18:31:59Z","updated":"2025-12-12T06:32:58Z"},{"id":"wordfence:9ac2559a-c622-417c-a655-e92e8ac96770","source":"wordfence","cve":"CVE-2021-24881","title":"Passster <= 3.5.5.8 - Missing Authentication leading to Sensitive Information Disclosure (Private Post Leakage)","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac2559a-c622-417c-a655-e92e8ac96770?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"3.5.5.8","to_inclusive":true,"patched_in":"3.5.5.9"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ac2c929-2188-4818-880d-8793984e8df1","source":"wordfence","cve":"CVE-2023-4725","title":"Simple Posts Ticker <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac2c929-2188-4818-880d-8793984e8df1?source=api-prod","affected":[{"type":"plugin","slug":"simple-posts-ticker","name":"Simple Posts Ticker \u2013 Easy, Lightweight & Flexible","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-09-25T00:00:00Z","updated":"2026-10-01T23:34:31Z"},{"id":"wordfence:9ac33fd5-602b-4810-96e1-850ea6ee739d","source":"wordfence","cve":"CVE-2025-1784","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac33fd5-602b-4810-96e1-850ea6ee739d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.0","to_inclusive":true,"patched_in":"2.19.1"}],"published":"2025-03-25T16:21:36Z","updated":"2025-07-02T13:15:40Z"},{"id":"wordfence:9ac50927-e3e3-41db-9dd0-3e22361b497a","source":"wordfence","cve":"CVE-2025-39518","title":"BMA Lite <= 1.4.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac50927-e3e3-41db-9dd0-3e22361b497a?source=api-prod","affected":[{"type":"plugin","slug":"bma-lite-appointment-booking-and-scheduling","name":"BMA Lite \u2013 Appointment Booking and Scheduling","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-04-16T00:00:00Z","updated":"2026-02-03T19:54:10Z"},{"id":"wordfence:9ac6817e-5794-4ecb-ab3c-58b09a4e52c0","source":"wordfence","cve":"CVE-2025-26907","title":"Estatik Mortgage Calculator <= 2.0.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac6817e-5794-4ecb-ab3c-58b09a4e52c0?source=api-prod","affected":[{"type":"plugin","slug":"estatik-mortgage-calculator","name":"Estatik Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-02-23T00:00:00Z","updated":"2026-03-23T15:44:42Z"},{"id":"wordfence:9ac9c146-5065-46fc-b2ae-20b820a8016b","source":"wordfence","cve":"CVE-2023-22685","title":"Category Specific RSS feed Subscription <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ac9c146-5065-46fc-b2ae-20b820a8016b?source=api-prod","affected":[{"type":"plugin","slug":"category-specific-rss-feed-menu","name":"Category Specific RSS feed Subscription","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9aca80f2-61ab-4b7e-955e-d57f0cf5fb24","source":"wordfence","cve":"CVE-2024-50531","title":"RSVPMaker for Toastmasters <= 6.2.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aca80f2-61ab-4b7e-955e-d57f0cf5fb24?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker-for-toastmasters","name":"RSVPMaker for Toastmasters","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T13:25:51Z"},{"id":"wordfence:9acb6e7d-990d-4ed7-93ab-79ba94aa9016","source":"wordfence","cve":"CVE-2022-4622","title":"Login Logout Menu <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acb6e7d-990d-4ed7-93ab-79ba94aa9016?source=api-prod","affected":[{"type":"plugin","slug":"baw-login-logout-menu","name":"Login Logout Menu","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9acc923b-f2c6-4fac-a75d-6097286fb9ae","source":"wordfence","cve":"CVE-2025-30872","title":"Product Author for WooCommerce <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acc923b-f2c6-4fac-a75d-6097286fb9ae?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-author","name":"Product Author for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:19:51Z"},{"id":"wordfence:9acdbd48-8d38-4d75-b2b1-c993e25cf92a","source":"wordfence","cve":"","title":"Levo Slideshow <= 2.3 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acdbd48-8d38-4d75-b2b1-c993e25cf92a?source=api-prod","affected":[{"type":"plugin","slug":"wp-levoslideshow","name":"Levo Slideshow","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2013-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9acec3df-84d6-4cea-8756-64fbb468e5e0","source":"wordfence","cve":"CVE-2025-11824","title":"Cinza Grid <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acec3df-84d6-4cea-8756-64fbb468e5e0?source=api-prod","affected":[{"type":"plugin","slug":"cinza-grid","name":"Cinza Grid","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-10-21T20:22:59Z","updated":"2025-10-23T20:14:12Z"},{"id":"wordfence:9acf80aa-8354-4430-9836-18fa17854521","source":"wordfence","cve":"CVE-2026-5247","title":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acf80aa-8354-4430-9836-18fa17854521?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2026-05-04T14:02:32Z","updated":"2026-05-05T02:26:56Z"},{"id":"wordfence:9acfe32c-b7f7-4bd4-8ec7-32f65398737e","source":"wordfence","cve":"CVE-2026-39776","title":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension <= 2.5 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9acfe32c-b7f7-4bd4-8ec7-32f65398737e?source=api-prod","affected":[{"type":"plugin","slug":"tabs-responsive","name":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:38:53Z","updated":"2026-10-08T23:29:42Z"},{"id":"wordfence:9ad00419-e9fa-4f78-b0d9-02cfb412a04d","source":"wordfence","cve":"CVE-2022-47607","title":"Usersnap <= 4.16 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ad00419-e9fa-4f78-b0d9-02cfb412a04d?source=api-prod","affected":[{"type":"plugin","slug":"usersnap","name":"Usersnap","from":"*","from_inclusive":true,"to":"4.16","to_inclusive":true,"patched_in":"4.17"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ad2acce-1285-46e6-9bb0-64f215698373","source":"wordfence","cve":"CVE-2023-3666","title":"Sticky Side Buttons < 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ad2acce-1285-46e6-9bb0-64f215698373?source=api-prod","affected":[{"type":"plugin","slug":"sticky-side-buttons","name":"Sticky Side Buttons","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2025-08-13T00:00:00Z","updated":"2025-09-10T20:51:43Z"},{"id":"wordfence:9ad96faa-cbc2-46c3-a8e6-afa6744ada86","source":"wordfence","cve":"CVE-2024-13566","title":"WP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ad96faa-cbc2-46c3-a8e6-afa6744ada86?source=api-prod","affected":[{"type":"plugin","slug":"wp-datatable","name":"WP DataTable","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":"0.2.7"}],"published":"2025-01-30T20:02:23Z","updated":"2025-01-31T08:21:26Z"},{"id":"wordfence:9adbe55e-f1a1-4fa8-b28d-539d90d81c68","source":"wordfence","cve":"CVE-2026-93757","title":"Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adbe55e-f1a1-4fa8-b28d-539d90d81c68?source=api-prod","affected":[{"type":"plugin","slug":"wild-apricot-login","name":"Wild Apricot Login","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T14:44:24Z","updated":"2026-10-29T03:39:16Z"},{"id":"wordfence:9adc6f3e-2360-480c-9f91-f47474e66c78","source":"wordfence","cve":"CVE-2018-5656","title":"Weblizar Pin Feeds < 1.1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adc6f3e-2360-480c-9f91-f47474e66c78?source=api-prod","affected":[{"type":"plugin","slug":"weblizar-pinterest-feeds","name":"Weblizar Pin Feeds","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2018-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9addaa26-46b3-4fbf-8986-0b8c8f2dd286","source":"wordfence","cve":"CVE-2024-31114","title":"Shortcode Addons <= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9addaa26-46b3-4fbf-8986-0b8c8f2dd286?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-addons","name":"Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T14:55:54Z"},{"id":"wordfence:9ade8a32-cbaa-4020-8227-de67588f2de0","source":"wordfence","cve":"","title":"WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity Script Module Data Shadowing","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ade8a32-cbaa-4020-8227-de67588f2de0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T18:49:57Z"},{"id":"wordfence:9adf94ac-30ef-4c24-afa6-04248c25bd7f","source":"wordfence","cve":"CVE-2026-9228","title":"Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adf94ac-30ef-4c24-afa6-04248c25bd7f?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"2.4.17"}],"published":"2026-05-27T14:55:48Z","updated":"2026-05-28T03:27:27Z"},{"id":"wordfence:9adfc632-2e47-4fea-ad87-41840cdab225","source":"wordfence","cve":"CVE-2024-35162","title":"Download Plugins and Themes from Dashboard <= 1.8.5 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adfc632-2e47-4fea-ad87-41840cdab225?source=api-prod","affected":[{"type":"plugin","slug":"download-plugins-dashboard","name":"Download Plugins and Themes in ZIP from Dashboard","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2024-05-17T00:00:00Z","updated":"2024-06-06T13:44:04Z"},{"id":"wordfence:9adfe6f3-5ecb-4d5d-b104-4d6d7367b0e3","source":"wordfence","cve":"CVE-2026-27084","title":"Buisson <= 1.1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9adfe6f3-5ecb-4d5d-b104-4d6d7367b0e3?source=api-prod","affected":[{"type":"theme","slug":"buisson","name":"Buisson - Gardening WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:42:45Z"},{"id":"wordfence:9ae076e4-ad15-4069-be10-f0f4aced4132","source":"wordfence","cve":"CVE-2025-5286","title":"Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae076e4-ad15-4069-be10-f0f4aced4132?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.3.7"}],"published":"2025-05-28T19:53:34Z","updated":"2025-05-29T08:22:04Z"},{"id":"wordfence:9ae10993-4365-434e-b1e4-b20f2398c2e1","source":"wordfence","cve":"CVE-2026-22510","title":"Melody <= 1.6.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae10993-4365-434e-b1e4-b20f2398c2e1?source=api-prod","affected":[{"type":"theme","slug":"melodyschool","name":"Melody - Arts Courses & Music School WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-09T00:00:00Z","updated":"2026-03-19T13:58:30Z"},{"id":"wordfence:9ae135c3-2b2b-4cd2-a17b-3b1e9de9dbac","source":"wordfence","cve":"CVE-2010-4637","title":"FeedList <= 2.61.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae135c3-2b2b-4cd2-a17b-3b1e9de9dbac?source=api-prod","affected":[{"type":"plugin","slug":"feedlist","name":"FeedList","from":"*","from_inclusive":true,"to":"2.61.03","to_inclusive":true,"patched_in":"2.70.00"}],"published":"2010-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae490b5-7181-45d1-8e3b-8ff244de2bec","source":"wordfence","cve":"CVE-2026-22425","title":"Sweet Jane - Delightful Cake Shop Theme <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae490b5-7181-45d1-8e3b-8ff244de2bec?source=api-prod","affected":[{"type":"theme","slug":"sweetjane","name":"Sweet Jane - Delightful Cake Shop Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:38:17Z"},{"id":"wordfence:9ae4bf8c-c9be-4737-81b8-62ebb9717796","source":"wordfence","cve":"CVE-2025-49416","title":"FW Gallery <= 8.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae4bf8c-c9be-4737-81b8-62ebb9717796?source=api-prod","affected":[{"type":"plugin","slug":"fw-gallery","name":"FW Gallery \u2013 Photo, video, audio media presentation and management system with players and slideshow","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:47:08Z"},{"id":"wordfence:9ae5b5f1-77a7-4626-a9b5-6f146c32a6db","source":"wordfence","cve":"","title":"WordPress File Uploader <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae5b5f1-77a7-4626-a9b5-6f146c32a6db?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-uploader","name":"File Uploader","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2013-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae63e7d-c5a2-4e8d-96e8-5d3c9c9ea1bf","source":"wordfence","cve":"CVE-2022-41995","title":"Gallery Images Ape <= 2.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae63e7d-c5a2-4e8d-96e8-5d3c9c9ea1bf?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images-ape","name":"Gallery Images Ape","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae771d1-9c4e-4123-9221-146e7ba2c2ac","source":"wordfence","cve":"","title":"WordPress Firewall 2 <= 1.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae771d1-9c4e-4123-9221-146e7ba2c2ac?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-firewall-2","name":"WordPress Firewall 2","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2017-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae7b6fc-2120-4573-8b1b-d5422d435fa5","source":"wordfence","cve":"CVE-2025-1661","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae7b6fc-2120-4573-8b1b-d5422d435fa5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6.5","to_inclusive":true,"patched_in":"1.3.6.6"}],"published":"2025-03-10T14:30:20Z","updated":"2025-03-11T03:22:20Z"},{"id":"wordfence:9ae8de00-ba4c-48d2-a566-13dac0bc4312","source":"wordfence","cve":"CVE-2020-36669","title":"JetBackup \u2013 WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae8de00-ba4c-48d2-a566-13dac0bc4312?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2020-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae9307c-680c-43c7-8246-a3e6149c1fb6","source":"wordfence","cve":"CVE-2024-0866","title":"Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-26T03:18:08Z"},{"id":"wordfence:9ae9b5c7-0d76-4772-973b-be48e520c837","source":"wordfence","cve":"CVE-2021-24598","title":"Testimonial < 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9b5c7-0d76-4772-973b-be48e520c837?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-builder","name":"Testimonial \u2013 WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ae9c422-8f5b-4ee4-ac3a-828c8230bf7b","source":"wordfence","cve":"CVE-2025-28916","title":"Docpro <= 2.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9c422-8f5b-4ee4-ac3a-828c8230bf7b?source=api-prod","affected":[{"type":"plugin","slug":"docpro","name":"Docpro","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-23T00:00:00Z","updated":"2025-03-25T17:47:52Z"},{"id":"wordfence:9aeb996c-723a-402a-a0f8-4212391c64eb","source":"wordfence","cve":"CVE-2022-2092","title":"WooCommerce PDF Invoices & Packing Slips <= 2.15.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aeb996c-723a-402a-a0f8-4212391c64eb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.16.0"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9aeeb92f-26f8-44b5-a523-abc33043efff","source":"wordfence","cve":"CVE-2016-10944","title":"Multisite Post Duplicator <= 1.7.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aeeb92f-26f8-44b5-a523-abc33043efff?source=api-prod","affected":[{"type":"plugin","slug":"multisite-post-duplicator","name":"Multisite Post Duplicator","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2016-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9aeef004-1b87-457b-81c9-4951fb8cbbe3","source":"wordfence","cve":"CVE-2026-125763","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aeef004-1b87-457b-81c9-4951fb8cbbe3?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:37Z"},{"id":"wordfence:9aef779b-b1fc-4504-bba5-0d2698b52427","source":"wordfence","cve":"CVE-2025-54704","title":"Easy Elementor Addons <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aef779b-b1fc-4504-bba5-0d2698b52427?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:56:20Z"},{"id":"wordfence:9af247aa-430d-4a88-953e-0dbda6f9f21f","source":"wordfence","cve":"CVE-2026-109892","title":"ACF Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af247aa-430d-4a88-953e-0dbda6f9f21f?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.13","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2026-10-13T12:52:01Z","updated":"2026-10-23T18:27:49Z"},{"id":"wordfence:9af36edd-4520-4afc-8d3a-c9a96659ddf8","source":"wordfence","cve":"CVE-2023-26524","title":"Quiz And Survey Master <= 8.0.10 - Cross-Site Request Forgery to Quiz Restoration","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af36edd-4520-4afc-8d3a-c9a96659ddf8?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.10","to_inclusive":true,"patched_in":"8.1.0"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9af6c319-7660-4368-b2f8-1ed1d01ee73a","source":"wordfence","cve":"CVE-2024-0623","title":"VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af6c319-7660-4368-b2f8-1ed1d01ee73a?source=api-prod","affected":[{"type":"plugin","slug":"vk-block-patterns","name":"VK Block Patterns","from":"*","from_inclusive":true,"to":"1.31.1.1","to_inclusive":true,"patched_in":"1.31.2.0"}],"published":"2024-01-19T00:00:00Z","updated":"2024-07-29T21:36:57Z"},{"id":"wordfence:9af6d311-a72e-4c86-8ecb-70fa83e5a240","source":"wordfence","cve":"CVE-2024-7647","title":"OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af6d311-a72e-4c86-8ecb-70fa83e5a240?source=api-prod","affected":[{"type":"plugin","slug":"ota-sync-booking-engine-widget","name":"OTA Sync Booking Engine Widget","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-08-20T00:00:00Z","updated":"2024-12-06T12:57:49Z"},{"id":"wordfence:9af8267f-48b1-4537-8985-6af1245ceed5","source":"wordfence","cve":"CVE-2024-12920","title":"FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple Functions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af8267f-48b1-4537-8985-6af1245ceed5?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-03-18T00:00:00Z","updated":"2026-04-24T15:27:55Z"},{"id":"wordfence:9af929a3-6e17-40c7-9fce-1ce0eb72bc7b","source":"wordfence","cve":"CVE-2023-31237","title":"Zephyr Project Manager <= 3.3.9 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af929a3-6e17-40c7-9fce-1ce0eb72bc7b?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.10"}],"published":"2023-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9af963ed-8bc5-4b5e-bacd-30a2ef429ce8","source":"wordfence","cve":"CVE-2023-47245","title":"ANAC XML Viewer <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9af963ed-8bc5-4b5e-bacd-30a2ef429ce8?source=api-prod","affected":[{"type":"plugin","slug":"anac-xml-viewer","name":"ANAC XML Viewer","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-11-07T00:00:00Z","updated":"2024-05-31T18:47:49Z"},{"id":"wordfence:9afe4620-2d23-438e-9b8e-003a3c132c85","source":"wordfence","cve":"CVE-2026-27436","title":"Five Star Business Profile and Schema <= 2.3.19 - Authenticated (Editor+) Arbitrary Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9afe4620-2d23-438e-9b8e-003a3c132c85?source=api-prod","affected":[{"type":"plugin","slug":"business-profile","name":"Five Star Business Profile and Schema","from":"*","from_inclusive":true,"to":"2.3.19","to_inclusive":true,"patched_in":"2.3.20"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-16T18:38:18Z"},{"id":"wordfence:9aff1e5b-2f16-43d0-b75a-c07e59a9c15f","source":"wordfence","cve":"CVE-2024-9830","title":"Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff1e5b-2f16-43d0-b75a-c07e59a9c15f?source=api-prod","affected":[{"type":"theme","slug":"bard","name":"Bard","from":"*","from_inclusive":true,"to":"2.216","to_inclusive":true,"patched_in":"2.217"}],"published":"2024-11-18T23:46:49Z","updated":"2024-11-19T12:45:32Z"},{"id":"wordfence:9aff585b-b2ee-46ff-8558-ded4ece9a3eb","source":"wordfence","cve":"CVE-2025-62122","title":"Trash Duplicate and 301 Redirect <= 1.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff585b-b2ee-46ff-8558-ded4ece9a3eb?source=api-prod","affected":[{"type":"plugin","slug":"trash-duplicate-and-301-redirect","name":"Trash Duplicate and 301 Redirect","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:27:10Z"},{"id":"wordfence:9aff7b03-4f03-434c-be87-b10ceeb4e625","source":"wordfence","cve":"CVE-2026-7761","title":"Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff7b03-4f03-434c-be87-b10ceeb4e625?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.4","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-24T06:49:41Z"},{"id":"wordfence:9affd2b9-9576-435e-931d-f60816af0b91","source":"wordfence","cve":"CVE-2024-32132","title":"CBX Bookmark & Favorite <= 1.7.20 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9affd2b9-9576-435e-931d-f60816af0b91?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"1.7.20","to_inclusive":true,"patched_in":"1.7.21"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-17T13:46:20Z"},{"id":"wordfence:9b004132-b2a6-422d-882e-5122708d9709","source":"wordfence","cve":"CVE-2023-40673","title":"Cartpauj Register Captcha <= 1.0.02 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b004132-b2a6-422d-882e-5122708d9709?source=api-prod","affected":[{"type":"plugin","slug":"cartpauj-register-captcha","name":"Cartpauj Register Captcha","from":"*","from_inclusive":true,"to":"1.0.02","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b00da60-7d2d-467e-ab58-0bb4af0cbda5","source":"wordfence","cve":"CVE-2026-15006","title":"Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b00da60-7d2d-467e-ab58-0bb4af0cbda5?source=api-prod","affected":[{"type":"plugin","slug":"bit-integrations","name":"Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2026-07-31T12:28:06Z","updated":"2026-08-01T01:29:57Z"},{"id":"wordfence:9b05ffc8-3f28-424b-aa3d-4132994b7376","source":"wordfence","cve":"CVE-2025-23665","title":"RSV GMaps <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b05ffc8-3f28-424b-aa3d-4132994b7376?source=api-prod","affected":[{"type":"plugin","slug":"rsv-google-maps","name":"RSV GMaps","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:33:54Z"},{"id":"wordfence:9b0737b6-c30b-4244-bf17-4ade1991af6a","source":"wordfence","cve":"CVE-2025-32264","title":"UltraAddons <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0737b6-c30b-4244-bf17-4ade1991af6a?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-10-28T21:06:45Z"},{"id":"wordfence:9b09338c-a28f-4950-b0c1-98ab85e58c0a","source":"wordfence","cve":"CVE-2022-4548","title":"Optimize images ALT Text <= 2.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b09338c-a28f-4950-b0c1-98ab85e58c0a?source=api-prod","affected":[{"type":"plugin","slug":"imageseo","name":"Image SEO \u2013 AI-Driven Image SEO Optimizer","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b09bf42-a85d-4a5b-9acc-609e0a5d7748","source":"wordfence","cve":"CVE-2018-7586","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b09bf42-a85d-4a5b-9acc-609e0a5d7748?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.2.46","to_inclusive":true,"patched_in":"2.2.50"}],"published":"2018-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b09e0dc-b394-4c74-a89d-8cd4379adb73","source":"wordfence","cve":"CVE-2025-48232","title":"Xpro Addons For Beaver Builder &#8211; Lite <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b09e0dc-b394-4c74-a89d-8cd4379adb73?source=api-prod","affected":[{"type":"plugin","slug":"xpro-addons-beaver-builder-elementor","name":"Xpro Addons For Beaver Builder \u2013 Lite","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:55:05Z"},{"id":"wordfence:9b09f4de-f67d-4d15-a3e3-0cc78cfe7fe8","source":"wordfence","cve":"CVE-2024-53789","title":"Advanced What should we write next about <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b09f4de-f67d-4d15-a3e3-0cc78cfe7fe8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-what-should-we-write-about-next","name":"Advanced What should we write next about","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:04:37Z"},{"id":"wordfence:9b0b11bb-5da0-4582-b57c-991f11959e9a","source":"wordfence","cve":"CVE-2025-68044","title":"Five Star Restaurant Reservations <= 2.7.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0b11bb-5da0-4582-b57c-991f11959e9a?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-27T20:52:25Z"},{"id":"wordfence:9b0b6433-5651-4a9d-8356-5d02d51830f4","source":"wordfence","cve":"CVE-2025-12665","title":"Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0b6433-5651-4a9d-8356-5d02d51830f4?source=api-prod","affected":[{"type":"plugin","slug":"ninja-countdown","name":"Ninja Countdown | Fastest Countdown Builder","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:01:22Z","updated":"2025-11-11T03:30:46Z"},{"id":"wordfence:9b0cc3a0-5a80-4a56-abeb-13046d9eaf3f","source":"wordfence","cve":"CVE-2022-1335","title":"Slideshow CK <= 1.4.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0cc3a0-5a80-4a56-abeb-13046d9eaf3f?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-ck","name":"Slideshow CK","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b0d1174-b94f-4b44-8b88-bc4355f0d165","source":"wordfence","cve":"CVE-2025-53586","title":"WeMusic <= 1.9.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0d1174-b94f-4b44-8b88-bc4355f0d165?source=api-prod","affected":[{"type":"theme","slug":"noo-wemusic","name":"WeMusic - Music Band Event WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-08-02T00:00:00Z","updated":"2025-11-12T13:37:09Z"},{"id":"wordfence:9b0e973b-f0bf-44d1-b964-e259f68291aa","source":"wordfence","cve":"CVE-2026-13161","title":"TrueBooker <= 1.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0e973b-f0bf-44d1-b964-e259f68291aa?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-07-27T20:17:19Z","updated":"2026-07-28T08:34:36Z"},{"id":"wordfence:9b0f6653-471b-4cee-9c92-f24dbe2c2dbd","source":"wordfence","cve":"CVE-2026-2020","title":"JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0f6653-471b-4cee-9c92-f24dbe2c2dbd?source=api-prod","affected":[{"type":"plugin","slug":"jquery-archive-list-widget","name":"JS Archive List","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-03-06T11:46:38Z","updated":"2026-03-07T01:21:22Z"},{"id":"wordfence:9b1329b6-ae1f-4a46-8435-5023c5c130f5","source":"wordfence","cve":"","title":"Contentboxes <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b1329b6-ae1f-4a46-8435-5023c5c130f5?source=api-prod","affected":[{"type":"plugin","slug":"contentboxes","name":"Contentboxes","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b19240c-d143-4360-9696-47358983178f","source":"wordfence","cve":"CVE-2026-25034","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b19240c-d143-4360-9696-47358983178f?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:53:47Z"},{"id":"wordfence:9b192a54-fe49-4bdf-bd91-0e88eb228cc4","source":"wordfence","cve":"CVE-2026-65470","title":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b192a54-fe49-4bdf-bd91-0e88eb228cc4?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:52:35Z"},{"id":"wordfence:9b1cdce5-e88c-40b5-b7c9-308b7303422b","source":"wordfence","cve":"CVE-2026-27081","title":"Rosebud - Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b1cdce5-e88c-40b5-b7c9-308b7303422b?source=api-prod","affected":[{"type":"theme","slug":"rosebud","name":"Rosebud - Flower Shop and Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-12T16:11:11Z"},{"id":"wordfence:9b1dc818-75c6-45b7-9f0f-88275cc6e946","source":"wordfence","cve":"CVE-2018-7433","title":"iThemes Security <= 6.9.0 - Cross-Site Scripting","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b1dc818-75c6-45b7-9f0f-88275cc6e946?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2018-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b203694-e18a-4262-bf58-f1dcd0358890","source":"wordfence","cve":"CVE-2023-6532","title":"WP Blogs' Planetarium <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b203694-e18a-4262-bf58-f1dcd0358890?source=api-prod","affected":[{"type":"plugin","slug":"wp-blogs-planetarium","name":"WP Blogs&#039; Planetarium","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b2083f9-79d0-43f6-b7ae-a5817dc561b0","source":"wordfence","cve":"CVE-2024-6283","title":"DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2083f9-79d0-43f6-b7ae-a5817dc561b0?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-06-26T16:37:22Z","updated":"2024-06-27T04:38:49Z"},{"id":"wordfence:9b261abb-0af2-4a06-ae79-7661bab1b727","source":"wordfence","cve":"CVE-2025-68859","title":"Syntax Highlighter Compress <= 3.0.83.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b261abb-0af2-4a06-ae79-7661bab1b727?source=api-prod","affected":[{"type":"plugin","slug":"syntax-highlighter-compress","name":"Syntax Highlighter Compress","from":"*","from_inclusive":true,"to":"3.0.83.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:53:11Z"},{"id":"wordfence:9b26604b-2423-4130-b0ef-8f63a392c760","source":"wordfence","cve":"CVE-2023-0719","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b26604b-2423-4130-b0ef-8f63a392c760?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b27cf00-bc1f-4c91-b5ee-debba9f361ed","source":"wordfence","cve":"CVE-2026-57689","title":"Werkstatt - Creative Portfolio WordPress Theme <= 4.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b27cf00-bc1f-4c91-b5ee-debba9f361ed?source=api-prod","affected":[{"type":"theme","slug":"werkstatt","name":"Werkstatt - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-06-29T18:30:46Z"},{"id":"wordfence:9b28924e-8d4b-4eb4-8564-10bde2c82d69","source":"wordfence","cve":"CVE-2024-53825","title":"Filebird <= 6.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b28924e-8d4b-4eb4-8564-10bde2c82d69?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.3.4"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T19:26:06Z"},{"id":"wordfence:9b28b0f5-8157-40a7-8661-c8ba0b8eba1b","source":"wordfence","cve":"CVE-2024-4004","title":"Advanced Cron Manager \u2013 debug & control <= 2.5.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b28b0f5-8157-40a7-8661-c8ba0b8eba1b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cron-manager","name":"Advanced Cron Manager \u2013 debug & control","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2024-10-30T00:00:00Z","updated":"2025-05-29T22:03:36Z"},{"id":"wordfence:9b2a9f5c-c9a0-4366-91ea-bec7839e951f","source":"wordfence","cve":"CVE-2025-58849","title":"Hide Real Download Path <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2a9f5c-c9a0-4366-91ea-bec7839e951f?source=api-prod","affected":[{"type":"plugin","slug":"hide-real-download-path","name":"Hide Real Download Path","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:12:34Z"},{"id":"wordfence:9b2ab63d-1fd5-4de5-9c77-e704cde887c9","source":"wordfence","cve":"CVE-2025-32267","title":"Post to Social Media \u2013 WordPress to Hootsuite <= 1.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2ab63d-1fd5-4de5-9c77-e704cde887c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-to-hootsuite","name":"Social Media Auto Poster \u2013 Schedule & Publish to Hootsuite","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T20:42:15Z"},{"id":"wordfence:9b2b1500-04b6-40fb-8d1f-9c210f95788b","source":"wordfence","cve":"CVE-2025-7683","title":"LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2b1500-04b6-40fb-8d1f-9c210f95788b?source=api-prod","affected":[{"type":"plugin","slug":"latestcheckins","name":"LatestCheckins","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:46:11Z","updated":"2025-08-16T03:38:51Z"},{"id":"wordfence:9b2f01fe-ea54-4b64-9e48-ccf4681c42f8","source":"wordfence","cve":"CVE-2025-32650","title":"Accessibility Suite by Online ADA <= 4.18 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2f01fe-ea54-4b64-9e48-ccf4681c42f8?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.18","to_inclusive":true,"patched_in":"4.19"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-16T14:15:48Z"},{"id":"wordfence:9b2fecbc-9afa-445b-a702-546cf343a67e","source":"wordfence","cve":"CVE-2025-53572","title":"WP Easy Contact <= 4.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b2fecbc-9afa-445b-a702-546cf343a67e?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T21:04:09Z"},{"id":"wordfence:9b3201e0-df2a-471e-875b-4ca2c3a659f3","source":"wordfence","cve":"CVE-2014-10383","title":"Memphis Documents Library <= 2.6.16 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b3201e0-df2a-471e-875b-4ca2c3a659f3?source=api-prod","affected":[{"type":"plugin","slug":"memphis-documents-library","name":"Memphis Documents Library","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2015-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b320755-1255-4331-8176-ee67d8d4873e","source":"wordfence","cve":"","title":"Top 10 \u2013 Popular posts plugin for WordPress <= 2.4.3 - SQL Injection","severity":"high","cvss":7.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b320755-1255-4331-8176-ee67d8d4873e?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2017-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b343533-8690-4167-8de8-7be2d2b2e44a","source":"wordfence","cve":"CVE-2024-37544","title":"Get Better Reviews for WooCommerce <= 4.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b343533-8690-4167-8de8-7be2d2b2e44a?source=api-prod","affected":[{"type":"plugin","slug":"more-better-reviews-for-woocommerce","name":"Get Better Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2025-10-29T20:50:17Z"},{"id":"wordfence:9b34929a-7244-4e14-8637-cbfc29ce6083","source":"wordfence","cve":"CVE-2026-66469","title":"Arvow AI SEO Writer <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b34929a-7244-4e14-8637-cbfc29ce6083?source=api-prod","affected":[{"type":"plugin","slug":"journalist-ai","name":"Arvow AI SEO Writer","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:51:55Z"},{"id":"wordfence:9b350b48-05ba-4054-895f-36d7ad71459d","source":"wordfence","cve":"CVE-2026-5231","title":"WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b350b48-05ba-4054-895f-36d7ad71459d?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.4","to_inclusive":true,"patched_in":"14.16.5"}],"published":"2026-04-16T13:20:16Z","updated":"2026-04-17T01:24:37Z"},{"id":"wordfence:9b359cdd-840f-4a9b-9a2f-a28e64d73819","source":"wordfence","cve":"CVE-2026-6170","title":"Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b359cdd-840f-4a9b-9a2f-a28e64d73819?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-29T19:34:36Z","updated":"2026-09-30T07:41:06Z"},{"id":"wordfence:9b378df7-b182-4a56-a7fa-3228c06f960f","source":"wordfence","cve":"CVE-2023-50846","title":"RegistrationMagic Plugin <= 5.2.4.5 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b378df7-b182-4a56-a7fa-3228c06f960f?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.4.6","to_inclusive":false,"patched_in":"5.2.4.6"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b37f945-a464-405a-a421-cef122bbb7e4","source":"wordfence","cve":"CVE-2026-121863","title":"Knowledge Building < 0.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b37f945-a464-405a-a421-cef122bbb7e4?source=api-prod","affected":[{"type":"plugin","slug":"knowledge-building","name":"Knowledge Building","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":false,"patched_in":"0.7.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:39Z"},{"id":"wordfence:9b38d892-6797-43ae-9f17-f8f90222911e","source":"wordfence","cve":"CVE-2021-24593","title":"Business Hours Indicator <= 2.3.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b38d892-6797-43ae-9f17-f8f90222911e?source=api-prod","affected":[{"type":"plugin","slug":"business-hours-indicator","name":"Business Hours Indicator","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12","source":"wordfence","cve":"CVE-2025-15526","title":"Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39b4ce-3885-4ea4-8cf0-84e66e7f6a12?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-16T04:44:34Z"},{"id":"wordfence:9b39c360-f267-4f9a-8d9d-fa0d7e300129","source":"wordfence","cve":"CVE-2024-29140","title":"MJM Clinic <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b39c360-f267-4f9a-8d9d-fa0d7e300129?source=api-prod","affected":[{"type":"plugin","slug":"mjm-clinic","name":"MJM Clinic","from":"*","from_inclusive":true,"to":"1.1.22","to_inclusive":true,"patched_in":"1.1.23"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:48:13Z"},{"id":"wordfence:9b3a6e01-cb4a-4e8f-b981-cf95af541366","source":"wordfence","cve":"CVE-2024-9831","title":"Taskbuilder <= 3.0.8 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b3a6e01-cb4a-4e8f-b981-cf95af541366?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-30T19:03:32Z"},{"id":"wordfence:9b3c7359-4de3-485f-b1b4-9e83b95c7f7c","source":"wordfence","cve":"CVE-2024-31099","title":"Shortcodes and extra features for Phlox theme <= 2.15.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b3c7359-4de3-485f-b1b4-9e83b95c7f7c?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.5","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-08-01T21:11:14Z"},{"id":"wordfence:9b3d7dfc-d181-4717-a881-e0d04f047a0b","source":"wordfence","cve":"CVE-2026-104812","title":"Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b3d7dfc-d181-4717-a881-e0d04f047a0b?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-11-04T16:13:01Z","updated":"2026-11-05T04:48:07Z"},{"id":"wordfence:9b409e3f-51e0-4d66-a04c-a0d54259bd2e","source":"wordfence","cve":"CVE-2024-30452","title":"Landing Page Builder <= 1.5.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b409e3f-51e0-4d66-a04c-a0d54259bd2e?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.1.7","to_inclusive":true,"patched_in":"1.5.1.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:54:40Z"},{"id":"wordfence:9b41efbd-bd47-415f-8de7-f30b3a7cf326","source":"wordfence","cve":"","title":"Imperial Fairytale Theme (All Versions) - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b41efbd-bd47-415f-8de7-f30b3a7cf326?source=api-prod","affected":[{"type":"theme","slug":"imperial-fairytale","name":"Imperial Themes Fairytale","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b448712-b989-453f-9acb-5556e01e41a4","source":"wordfence","cve":"CVE-2026-1074","title":"WP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b448712-b989-453f-9acb-5556e01e41a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-app-bar","name":"WP App Bar","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:49:21Z","updated":"2026-03-07T07:22:06Z"},{"id":"wordfence:9b45051a-5e57-47f5-977b-b5f5bd894aea","source":"wordfence","cve":"CVE-2026-104402","title":"Mindio Magic MCP <= 0.5.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b45051a-5e57-47f5-977b-b5f5bd894aea?source=api-prod","affected":[{"type":"plugin","slug":"mindio-magic-mcp","name":"Mindio Magic MCP","from":"*","from_inclusive":true,"to":"0.5.6","to_inclusive":true,"patched_in":"0.7.1"}],"published":"2026-10-02T14:48:00Z","updated":"2026-10-08T23:09:49Z"},{"id":"wordfence:9b458323-5fca-4fed-8c98-dfe69fd7a997","source":"wordfence","cve":"CVE-2008-3362","title":"Downloads Manager <= 0.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b458323-5fca-4fed-8c98-dfe69fd7a997?source=api-prod","affected":[{"type":"plugin","slug":"downloads-manager","name":"Downloads Manager","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2008-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b487949-c52d-43ec-b660-2d4057bf3c08","source":"wordfence","cve":"CVE-2022-4449","title":"Page scroll to id <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b487949-c52d-43ec-b660-2d4057bf3c08?source=api-prod","affected":[{"type":"plugin","slug":"page-scroll-to-id","name":"Page scroll to id","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b4946b7-9421-4e3c-807d-8799c957be2c","source":"wordfence","cve":"CVE-2026-115223","title":"Customer Engagement System \u2013 Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4946b7-9421-4e3c-807d-8799c957be2c?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:14:58Z"},{"id":"wordfence:9b4a1529-ddc5-42f2-9e50-7f45851fca4b","source":"wordfence","cve":"CVE-2026-39536","title":"RSVP and Event Management <= 2.7.16 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4a1529-ddc5-42f2-9e50-7f45851fca4b?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":true,"patched_in":"2.7.17"}],"published":"2026-03-12T00:00:00Z","updated":"2026-05-05T15:19:26Z"},{"id":"wordfence:9b4b517c-d605-4370-ae12-7c198c82b1d9","source":"wordfence","cve":"CVE-2023-47694","title":"Mini Cart Drawer For WooCommerce <= 4.0.0 - Missing Authorization via AJAX","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4b517c-d605-4370-ae12-7c198c82b1d9?source=api-prod","affected":[{"type":"plugin","slug":"woo-mini-cart-drawer","name":"Mini Cart Drawer for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2023-11-09T00:00:00Z","updated":"2024-08-16T18:32:26Z"},{"id":"wordfence:9b4bb70a-ee8e-4e1a-9989-7658307bedc1","source":"wordfence","cve":"CVE-2022-0189","title":"WP RSS Aggregator <= 4.19.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4bb70a-ee8e-4e1a-9989-7658307bedc1?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.19.3","to_inclusive":true,"patched_in":"4.20"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b4d2561-34aa-493e-9dc7-50406dd7f9a4","source":"wordfence","cve":"CVE-2026-66448","title":"Gallery PhotoBlocks <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4d2561-34aa-493e-9dc7-50406dd7f9a4?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:26:33Z"},{"id":"wordfence:9b4de243-d337-4f29-a766-bcafb3848d1c","source":"wordfence","cve":"CVE-2025-1707","title":"Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4de243-d337-4f29-a766-bcafb3848d1c?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-11T21:21:13Z"},{"id":"wordfence:9b4ea9ae-6a76-4dcb-ae3a-329bfb1ba547","source":"wordfence","cve":"CVE-2025-47653","title":"WP-Recall <= 16.26.14 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4ea9ae-6a76-4dcb-ae3a-329bfb1ba547?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.14","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:53:39Z"},{"id":"wordfence:9b4eba78-29f2-4357-ab3c-7bc3c20e0e75","source":"wordfence","cve":"CVE-2024-10962","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4eba78-29f2-4357-ab3c-7bc3c20e0e75?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.107","to_inclusive":true,"patched_in":"0.9.108"}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-14T13:54:09Z"},{"id":"wordfence:9b4f6b93-ecfe-4298-a744-21a4bb403366","source":"wordfence","cve":"CVE-2025-67629","title":"Basticom Framework <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4f6b93-ecfe-4298-a744-21a4bb403366?source=api-prod","affected":[{"type":"plugin","slug":"basticom-framework","name":"Basticom Framework","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-13T16:56:50Z"},{"id":"wordfence:9b508a74-d61a-4837-a18b-c1d12c3acb80","source":"wordfence","cve":"CVE-2025-67933","title":"Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b508a74-d61a-4837-a18b-c1d12c3acb80?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-13T17:33:59Z"},{"id":"wordfence:9b51f7b2-f33c-4b2d-bc50-56792fa04902","source":"wordfence","cve":"CVE-2026-62116","title":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b51f7b2-f33c-4b2d-bc50-56792fa04902?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:39:46Z"},{"id":"wordfence:9b53cdb8-e207-4a7a-bc7c-9d8669df1143","source":"wordfence","cve":"CVE-2025-68499","title":"JetTabs <= 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b53cdb8-e207-4a7a-bc7c-9d8669df1143?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.12.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:00:54Z"},{"id":"wordfence:9b5618b1-99fe-422a-9485-d51342e178b3","source":"wordfence","cve":"CVE-2026-31917","title":"ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5618b1-99fe-422a-9485-d51342e178b3?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.16.10","to_inclusive":true,"patched_in":"1.16.11"}],"published":"2026-02-05T00:00:00Z","updated":"2026-04-15T20:58:32Z"},{"id":"wordfence:9b57fbe8-0c8d-4ddb-8768-03ed354b2d21","source":"wordfence","cve":"CVE-2014-4529","title":"Flash Photo Gallery <= 0.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b57fbe8-0c8d-4ddb-8768-03ed354b2d21?source=api-prod","affected":[{"type":"plugin","slug":"flash-photo-gallery","name":"flash-photo-gallery","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2014-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b5952d1-e3ee-430c-a200-0c5bb551a100","source":"wordfence","cve":"CVE-2025-24713","title":"Button Generator \u2013 easily Button Builder <= 3.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5952d1-e3ee-430c-a200-0c5bb551a100?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:01:31Z"},{"id":"wordfence:9b5bc030-7739-4eb4-b85d-99e5d0f2643a","source":"wordfence","cve":"CVE-2023-28618","title":"Enhanced Plugin Admin <= 1.16 - Cross-Site Request Forgery via epa_options_page","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5bc030-7739-4eb4-b85d-99e5d0f2643a?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-plugin-admin","name":"Enhanced Plugin Admin","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":"1.17"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b5bdeb8-d5ee-4e30-8aaf-88893abf4145","source":"wordfence","cve":"","title":"Woocommerce Wordpress Auctions <= 2.0.1.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5bdeb8-d5ee-4e30-8aaf-88893abf4145?source=api-prod","affected":[{"type":"plugin","slug":"auctionPlugin","name":"Woocommerce Wordpress Auctions","from":"*","from_inclusive":true,"to":"2.0.1.3","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2012-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b5c2fb2-4274-460e-bb2b-567a0c3a7865","source":"wordfence","cve":"CVE-2024-55988","title":"Navayan CSV Export <= 1.0.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5c2fb2-4274-460e-bb2b-567a0c3a7865?source=api-prod","affected":[{"type":"plugin","slug":"navayan-csv-export","name":"Navayan CSV Export","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:08:05Z"},{"id":"wordfence:9b5c5e2b-aa1b-4360-95c7-cb6473013c8d","source":"wordfence","cve":"CVE-2025-39553","title":"Church Admin <= 5.0.9 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5c5e2b-aa1b-4360-95c7-cb6473013c8d?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:29:13Z"},{"id":"wordfence:9b5e37b4-4a7e-41a1-b1ef-0c69c8658c58","source":"wordfence","cve":"CVE-2022-43461","title":"Slideshow SE <= 2.5.5 - Authenticated (Subscriber+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b5e37b4-4a7e-41a1-b1ef-0c69c8658c58?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-se","name":"Slideshow SE","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b6175e7-0cfc-4049-bcfe-2c57cfb24fdb","source":"wordfence","cve":"CVE-2025-26591","title":"WP fancybox <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6175e7-0cfc-4049-bcfe-2c57cfb24fdb?source=api-prod","affected":[{"type":"plugin","slug":"wp-fancybox","name":"WP fancybox","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:55:15Z"},{"id":"wordfence:9b61d656-427a-4a7b-9c8f-ecf7e9546c23","source":"wordfence","cve":"CVE-2025-67580","title":"Constant Contact + WooCommerce <= 2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b61d656-427a-4a7b-9c8f-ecf7e9546c23?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-woocommerce","name":"Constant Contact + WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-11T15:55:37Z"},{"id":"wordfence:9b620481-8f45-4616-9b22-2dd14733325c","source":"wordfence","cve":"CVE-2025-12033","title":"Simple Banner <= 3.0.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b620481-8f45-4616-9b22-2dd14733325c?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-10-21T17:34:27Z","updated":"2025-10-22T06:40:59Z"},{"id":"wordfence:9b633f24-4818-43cb-89f7-7d6caf84499b","source":"wordfence","cve":"","title":"Animation Addons for Elementor \u2013 GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b633f24-4818-43cb-89f7-7d6caf84499b?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:29:27Z"},{"id":"wordfence:9b63dc2f-0d2b-43c8-9dc1-9d202cc92767","source":"wordfence","cve":"CVE-2024-43125","title":"WP Table Builder \u2013 WordPress Table Plugin <= 1.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b63dc2f-0d2b-43c8-9dc1-9d202cc92767?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:58:44Z"},{"id":"wordfence:9b6be9c5-0142-458e-bf7e-2d4ae169e555","source":"wordfence","cve":"CVE-2024-4289","title":"Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6be9c5-0142-458e-bf7e-2d4ae169e555?source=api-prod","affected":[{"type":"plugin","slug":"sailthru-triggermail","name":"Sailthru Triggermail","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-09T15:02:13Z"},{"id":"wordfence:9b6cf4ab-9e4d-4fd7-9e9e-c678ccc4d810","source":"wordfence","cve":"CVE-2022-2717","title":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6cf4ab-9e4d-4fd7-9e9e-c678ccc4d810?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b6f004c-aaf4-4f44-8f59-0e9168d4d921","source":"wordfence","cve":"CVE-2025-27313","title":"Google Maps GPX Viewer <= 3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6f004c-aaf4-4f44-8f59-0e9168d4d921?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-gpx-viewer","name":"Google Maps GPX Viewer","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:35:43Z"},{"id":"wordfence:9b6f21ce-8601-425f-bd44-6a1af31c67de","source":"wordfence","cve":"CVE-2025-2478","title":"Code Clone <= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b6f21ce-8601-425f-bd44-6a1af31c67de?source=api-prod","affected":[{"type":"plugin","slug":"code-clone","name":"Code Clone","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T17:52:29Z","updated":"2025-03-22T06:41:13Z"},{"id":"wordfence:9b726e21-ff76-43ea-beb1-f68e94d3b7a4","source":"wordfence","cve":"CVE-2023-45608","title":"Smart Cookie Kit <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b726e21-ff76-43ea-beb1-f68e94d3b7a4?source=api-prod","affected":[{"type":"plugin","slug":"smart-cookie-kit","name":"Smart Cookie Kit","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b780e28-3254-49d8-9b62-ade1c0a42d8a","source":"wordfence","cve":"","title":"Rating Widget Plugin < 2.9.0 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b780e28-3254-49d8-9b62-ade1c0a42d8a?source=api-prod","affected":[{"type":"plugin","slug":"rating-widget","name":"Rating-Widget: Star Review System","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":false,"patched_in":"2.9.0"}],"published":"2017-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b787a46-b887-4eb8-834a-456b7f495c5e","source":"wordfence","cve":"CVE-2025-25136","title":"Optimate Ads \u2013 Advance Ad Inserter AdSense & Ad Manager <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b787a46-b887-4eb8-834a-456b7f495c5e?source=api-prod","affected":[{"type":"plugin","slug":"optimate-ads","name":"Optimate Ads \u2013 Advance Ad Inserter AdSense & Ad Manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-24T15:44:16Z"},{"id":"wordfence:9b78834c-cb13-4698-aa19-65f8c6874c8f","source":"wordfence","cve":"CVE-2023-30499","title":"FV Flowplayer Video Player <= 7.5.32.7212 - Reflected Cross-Site Scripting via id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b78834c-cb13-4698-aa19-65f8c6874c8f?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.32.7212","to_inclusive":true,"patched_in":"7.5.35.7212"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b7a7780-0f61-4541-bcde-dbf64fd23320","source":"wordfence","cve":"CVE-2024-43214","title":"myCred <= 2.7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b7a7780-0f61-4541-bcde-dbf64fd23320?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:05:39Z"},{"id":"wordfence:9b7bb2a2-60b2-49c2-9fba-d8ea17a00617","source":"wordfence","cve":"CVE-2026-16612","title":"FiboSearch \u2013 Ajax Search for WooCommerce < 1.34.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b7bb2a2-60b2-49c2-9fba-d8ea17a00617?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.34.1","to_inclusive":false,"patched_in":"1.34.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T21:05:31Z"},{"id":"wordfence:9b7be8e8-264c-4c28-a419-3bbfea744f3a","source":"wordfence","cve":"CVE-2026-27043","title":"Photography <= 7.7.5 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b7be8e8-264c-4c28-a419-3bbfea744f3a?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.7.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:57:09Z"},{"id":"wordfence:9b7c3932-a52f-468d-af4e-e8bd53b14a1b","source":"wordfence","cve":"CVE-2026-14857","title":"WP Crowdfunding < 2.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b7c3932-a52f-468d-af4e-e8bd53b14a1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:47:06Z"},{"id":"wordfence:9b8042b0-83d3-417f-a5e0-43ff4f7648fb","source":"wordfence","cve":"CVE-2022-2448","title":"reSmush.it Image Optimizer <= 0.4.5 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b8042b0-83d3-417f-a5e0-43ff4f7648fb?source=api-prod","affected":[{"type":"plugin","slug":"resmushit-image-optimizer","name":"reSmush.it : The original free image compressor and optimizer plugin","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":"0.4.6"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b821fb6-abc5-411f-ad6b-00b20954142c","source":"wordfence","cve":"CVE-2021-24348","title":"Side Menu \u2013 add fixed side buttons <= 3.1.3 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b821fb6-abc5-411f-ad6b-00b20954142c?source=api-prod","affected":[{"type":"plugin","slug":"side-menu","name":"Side Menu \u2013 add fixed side buttons","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2021-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b85c78c-da02-4871-a397-1d00a321a3c0","source":"wordfence","cve":"CVE-2016-1000137","title":"Hero Maps Pro <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b85c78c-da02-4871-a397-1d00a321a3c0?source=api-prod","affected":[{"type":"plugin","slug":"hero-maps-pro","name":"Hero Maps Pro","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b86a259-b102-411a-8d4c-c131737b90d8","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth <= 3.9.1 - Sensitive Information Disclosure","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86a259-b102-411a-8d4c-c131737b90d8?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2016-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b86d26e-cda0-4558-9967-3ec6f5eff510","source":"wordfence","cve":"CVE-2026-1254","title":"Modula Image Gallery \u2013 Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d26e-cda0-4558-9967-3ec6f5eff510?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.13.6","to_inclusive":true,"patched_in":"2.13.7"}],"published":"2026-02-13T19:48:39Z","updated":"2026-02-14T08:26:51Z"},{"id":"wordfence:9b86d9ea-b842-4492-82e4-dd979fbe70cf","source":"wordfence","cve":"CVE-2024-9648","title":"WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload","severity":"medium","cvss":6.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b86d9ea-b842-4492-82e4-dd979fbe70cf?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike-pro","name":"WP ULike Pro","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-08-27T15:20:47Z","updated":"2025-08-28T03:42:44Z"},{"id":"wordfence:9b871957-a2b3-492f-b461-7040d9098b2b","source":"wordfence","cve":"CVE-2024-10028","title":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log","severity":"high","cvss":7.5,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b871957-a2b3-492f-b461-7040d9098b2b?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"}],"published":"2024-11-05T10:40:39Z","updated":"2024-11-05T23:28:42Z"},{"id":"wordfence:9b888f0c-5547-4ff7-9721-50166e3f0117","source":"wordfence","cve":"CVE-2023-2843","title":"MultiParcels Shipping For WooCommerce <= 1.14.12 - Authenticated(Subscriber+) SQL Injection via id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b888f0c-5547-4ff7-9721-50166e3f0117?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.14.12","to_inclusive":true,"patched_in":"1.14.15"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b8aef59-8d7a-4ffd-9619-9684a6e51e5a","source":"wordfence","cve":"CVE-2019-13414","title":"Rencontre \u2013 Dating Site <= 3.1.2 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b8aef59-8d7a-4ffd-9619-9684a6e51e5a?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2019-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b8b5363-2450-42b5-8295-78ced3682b14","source":"wordfence","cve":"","title":"RokStories <= 1.25 - Abuse of Functionality","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b8b5363-2450-42b5-8295-78ced3682b14?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokstories","name":"RokStories","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b8cc6bf-4b30-459f-824b-9b5ccec41804","source":"wordfence","cve":"CVE-2025-60236","title":"Creatify <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b8cc6bf-4b30-459f-824b-9b5ccec41804?source=api-prod","affected":[{"type":"theme","slug":"creatify","name":"Creatify","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2026-07-10T19:04:53Z"},{"id":"wordfence:9b8dc6f3-0ffc-4317-a32f-14dd7c301d30","source":"wordfence","cve":"CVE-2024-32451","title":"Legal Pages <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b8dc6f3-0ffc-4317-a32f-14dd7c301d30?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:01:33Z"},{"id":"wordfence:9b90bf09-639c-497c-a58e-3972250db1e4","source":"wordfence","cve":"CVE-2023-27432","title":"Manage Upload Limit <= 1.0.4 - Reflected Cross-Site Scripting via upload_limit","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b90bf09-639c-497c-a58e-3972250db1e4?source=api-prod","affected":[{"type":"plugin","slug":"wpsimpletools-upload-limit","name":"Manage Upload Limit","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b95fe0e-4677-4667-9a84-96801b547088","source":"wordfence","cve":"CVE-2021-24717","title":"AutomatorWP <= 1.7.5 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b95fe0e-4677-4667-9a84-96801b547088?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b97404f-c34d-483d-b11c-03a706306270","source":"wordfence","cve":"CVE-2023-28687","title":"Cream Blog, Fascinate, Glaze Blog Lite, & Everest News (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b97404f-c34d-483d-b11c-03a706306270?source=api-prod","affected":[{"type":"theme","slug":"everest-news","name":"Everest News","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"glaze-blog-lite","name":"Glaze Blog Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"cream-blog","name":"Cream Blog","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"},{"type":"theme","slug":"fascinate","name":"Fascinate","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b9bd42f-cb24-483a-ae91-add4378067d9","source":"wordfence","cve":"CVE-2023-1273","title":"ND Shortcodes <= 6.9 - Authenticated (Subscriber+) Local File Inclusion","severity":"medium","cvss":6.4,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9bd42f-cb24-483a-ae91-add4378067d9?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9b9d66db-53a8-4d93-9222-6f9649a7d842","source":"wordfence","cve":"CVE-2026-12231","title":"Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9d66db-53a8-4d93-9222-6f9649a7d842?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.9.9"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-02T08:33:00Z"},{"id":"wordfence:9b9e0302-b981-4885-822f-063247bec4b2","source":"wordfence","cve":"CVE-2026-13203","title":"Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9e0302-b981-4885-822f-063247bec4b2?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2026-08-31T15:53:35Z","updated":"2026-09-01T04:27:51Z"},{"id":"wordfence:9b9e0cd2-ed09-4c27-a931-f492bdb3ca3a","source":"wordfence","cve":"CVE-2026-78289","title":"CozyStay - Hotel Booking WordPress Theme <= 1.10.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9e0cd2-ed09-4c27-a931-f492bdb3ca3a?source=api-prod","affected":[{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:53:05Z"},{"id":"wordfence:9b9f609b-7b07-454a-b2e6-973f712b619d","source":"wordfence","cve":"CVE-2026-105067","title":"Modern Events Calendar Lite < 7.37.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b9f609b-7b07-454a-b2e6-973f712b619d?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.37.0","to_inclusive":false,"patched_in":"7.37.0"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:51:22Z"},{"id":"wordfence:9ba07137-f834-4f56-bcd5-0f6fde756681","source":"wordfence","cve":"CVE-2024-5177","title":"Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba07137-f834-4f56-bcd5-0f6fde756681?source=api-prod","affected":[{"type":"plugin","slug":"hash-elements","name":"Hash Elements","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-05-22T16:54:55Z","updated":"2024-05-23T05:32:17Z"},{"id":"wordfence:9ba40bde-7926-4aa5-a282-8543aea23381","source":"wordfence","cve":"CVE-2025-22260","title":"Meta Tag Manager <= 3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba40bde-7926-4aa5-a282-8543aea23381?source=api-prod","affected":[{"type":"plugin","slug":"meta-tag-manager","name":"Meta Tag Manager","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-25T14:28:05Z"},{"id":"wordfence:9ba4e993-bf75-4570-bd9d-003339f4e214","source":"wordfence","cve":"CVE-2021-39319","title":"duoFAQ - Responsive, Flat, Simple FAQ  <= 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba4e993-bf75-4570-bd9d-003339f4e214?source=api-prod","affected":[{"type":"plugin","slug":"duofaq-responsive-flat-simple-faq","name":"duoFAQ - Responsive, Flat, Simple FAQ ","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T12:43:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ba74e58-0647-4283-9fa3-428976c54474","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress < 3.7.40 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba74e58-0647-4283-9fa3-428976c54474?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"3.7.40","to_inclusive":false,"patched_in":"3.7.40"}],"published":"2015-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9baa8bbf-a318-4bc5-8bfd-2bd64536965e","source":"wordfence","cve":"CVE-2024-2695","title":"Shariff Wrapper <= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9baa8bbf-a318-4bc5-8bfd-2bd64536965e?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"4.6.14"}],"published":"2024-06-14T19:57:09Z","updated":"2024-06-17T14:39:43Z"},{"id":"wordfence:9babb946-4033-4e66-8f59-b73185ffcd49","source":"wordfence","cve":"CVE-2025-12545","title":"Pixel Manager for WooCommerce \u2013 Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9babb946-4033-4e66-8f59-b73185ffcd49?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.49.2","to_inclusive":true,"patched_in":"1.49.3"}],"published":"2025-11-18T01:18:04Z","updated":"2025-11-18T13:54:54Z"},{"id":"wordfence:9bac82ee-55bf-4381-b441-115a675e4834","source":"wordfence","cve":"CVE-2026-5063","title":"NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bac82ee-55bf-4381-b441-115a675e4834?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.11","to_inclusive":true,"patched_in":"9.1.12"}],"published":"2026-05-02T15:41:51Z","updated":"2026-05-03T04:25:52Z"},{"id":"wordfence:9baea072-2c07-40b6-8410-2ebe752b0874","source":"wordfence","cve":"CVE-2026-75807","title":"SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9baea072-2c07-40b6-8410-2ebe752b0874?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2026-08-29T05:01:46Z","updated":"2026-08-29T17:25:48Z"},{"id":"wordfence:9baf0a14-600b-4c0e-9121-71c28653e530","source":"wordfence","cve":"CVE-2024-53807","title":"WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) SQL Injection via orderby","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9baf0a14-600b-4c0e-9121-71c28653e530?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:46:46Z"},{"id":"wordfence:9bb026a4-02b1-4422-8c78-9983c49df43e","source":"wordfence","cve":"","title":"The Events Calendar < 4.1.1.1 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb026a4-02b1-4422-8c78-9983c49df43e?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.1.1"}],"published":"2016-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bb22acd-ffdb-4897-a657-538969aa6f41","source":"wordfence","cve":"CVE-2024-54370","title":"Video & Photo Gallery for Ultimate Member <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb22acd-ffdb-4897-a657-538969aa6f41?source=api-prod","affected":[{"type":"plugin","slug":"gallery-for-ultimate-member","name":"Video & Photo Gallery for Ultimate Member","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:09:56Z"},{"id":"wordfence:9bb2ae16-7886-4e66-83e0-59806dd67450","source":"wordfence","cve":"CVE-2021-34622","title":"ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb2ae16-7886-4e66-83e0-59806dd67450?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"3.0.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-06-28T19:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bb3c2a9-3307-422d-83b5-a2fe16b7f2bb","source":"wordfence","cve":"CVE-2025-53261","title":"WP YouTube Live <= 1.10.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb3c2a9-3307-422d-83b5-a2fe16b7f2bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-live","name":"WP YouTube Live","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2025-06-27T00:00:00Z","updated":"2026-01-06T19:28:19Z"},{"id":"wordfence:9bb430e6-0c30-4c23-874a-f91e25622857","source":"wordfence","cve":"CVE-2015-1000000","title":"MailCWP <= 1.100 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb430e6-0c30-4c23-874a-f91e25622857?source=api-prod","affected":[{"type":"plugin","slug":"mailcwp","name":"MailCWP","from":"*","from_inclusive":true,"to":"1.100","to_inclusive":true,"patched_in":"1.110"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bb50e66-2849-458b-9e2d-fc3f487d47cb","source":"wordfence","cve":"CVE-2025-63033","title":"Make Section & Column Clickable For Elementor <= 2.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb50e66-2849-458b-9e2d-fc3f487d47cb?source=api-prod","affected":[{"type":"plugin","slug":"make-section-column-clickable-elementor","name":"Make Section & Column Clickable For Elementor","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-12-07T00:00:00Z","updated":"2026-01-15T18:19:00Z"},{"id":"wordfence:9bb520df-e838-4335-bd4f-97026082a204","source":"wordfence","cve":"CVE-2026-13352","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb520df-e838-4335-bd4f-97026082a204?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.18","to_inclusive":true,"patched_in":"4.16.19"}],"published":"2026-07-16T14:43:52Z","updated":"2026-07-17T03:43:42Z"},{"id":"wordfence:9bb5e60d-f7c9-4b47-ba6f-0f2d1d060263","source":"wordfence","cve":"CVE-2025-12160","title":"Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb5e60d-f7c9-4b47-ba6f-0f2d1d060263?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":"6.7"}],"published":"2025-11-20T00:00:00Z","updated":"2025-11-21T09:27:03Z"},{"id":"wordfence:9bb6683a-b8e6-4776-880f-5b48966fc5c6","source":"wordfence","cve":"CVE-2024-4400","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb6683a-b8e6-4776-880f-5b48966fc5c6?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.26.4","to_inclusive":true,"patched_in":"1.26.5"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T11:05:29Z"},{"id":"wordfence:9bb9bab2-4f47-41ed-b42e-5272981927a8","source":"wordfence","cve":"","title":"Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber \u2013 MailOptin <= 1.2.35.1 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bb9bab2-4f47-41ed-b42e-5272981927a8?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.35.1","to_inclusive":true,"patched_in":"1.2.35.2"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bbabf5e-dbfc-4b01-94ae-0e8fd6b3cc26","source":"wordfence","cve":"CVE-2023-45110","title":"Bold Timeline Lite <= 1.1.9 - Missing Authorization to Admin Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbabf5e-dbfc-4b01-94ae-0e8fd6b3cc26?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-10-06T00:00:00Z","updated":"2024-04-17T13:00:39Z"},{"id":"wordfence:9bbb3c65-f02c-4d6d-bd4e-b3232af5e21b","source":"wordfence","cve":"CVE-2024-4318","title":"Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbb3c65-f02c-4d6d-bd4e-b3232af5e21b?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T05:33:28Z"},{"id":"wordfence:9bbcd280-25c3-4bc3-88bf-d109cfd1e855","source":"wordfence","cve":"CVE-2021-24301","title":"Hotjar Connecticator <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbcd280-25c3-4bc3-88bf-d109cfd1e855?source=api-prod","affected":[{"type":"plugin","slug":"hotjar-connecticator","name":"Hotjar Connecticator","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2021-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bbd528a-94fe-4979-b30f-02c6872db086","source":"wordfence","cve":"CVE-2023-29440","title":"Simple Job Board <= 2.10.3 - Cross-Site Request Forgery via sjb_save_settings_section","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbd528a-94fe-4979-b30f-02c6872db086?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bbd8616-e160-4e1c-8c2c-be38f7768194","source":"wordfence","cve":"CVE-2025-60078","title":"Task Manager <= 3.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbd8616-e160-4e1c-8c2c-be38f7768194?source=api-prod","affected":[{"type":"plugin","slug":"task-manager","name":"Task Manager","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T00:00:00Z","updated":"2025-12-19T16:42:22Z"},{"id":"wordfence:9bbd9ea4-8b5b-4497-a178-94eaec0b8211","source":"wordfence","cve":"CVE-2026-22406","title":"Overton <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbd9ea4-8b5b-4497-a178-94eaec0b8211?source=api-prod","affected":[{"type":"theme","slug":"overton","name":"Overton - Creative WordPress Theme for Agencies and Freelancers","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:53:14Z"},{"id":"wordfence:9bbe89d0-4b0a-40d6-b1a0-3faf9550ec5c","source":"wordfence","cve":"CVE-2025-9859","title":"Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbe89d0-4b0a-40d6-b1a0-3faf9550ec5c?source=api-prod","affected":[{"type":"plugin","slug":"fintelligence-calculator","name":"Fintelligence Calculator","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:14:45Z","updated":"2025-10-03T11:17:19Z"},{"id":"wordfence:9bc2a04c-7b7c-483f-b81b-97a7caac179c","source":"wordfence","cve":"CVE-2023-44235","title":"WP Captcha <= 2.0.0 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc2a04c-7b7c-483f-b81b-97a7caac179c?source=api-prod","affected":[{"type":"plugin","slug":"wp-captcha","name":"WP Captcha","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bc3039c-8e96-42e9-a28d-d3204f3e84f7","source":"wordfence","cve":"CVE-2021-24218","title":"Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc3039c-8e96-42e9-a28d-d3204f3e84f7?source=api-prod","affected":[{"type":"plugin","slug":"official-facebook-pixel","name":"Meta pixel for WordPress","from":"3.0.0","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"}],"published":"2021-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bc3c8c4-9f56-467b-a772-743f007d6bef","source":"wordfence","cve":"CVE-2025-68569","title":"Time Slots Booking Form <= 1.2.39 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc3c8c4-9f56-467b-a772-743f007d6bef?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.39","to_inclusive":true,"patched_in":"1.2.40"}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-06T14:41:09Z"},{"id":"wordfence:9bc66669-ee38-408a-9dea-e6421cc6f75c","source":"wordfence","cve":"CVE-2022-1393","title":"WP Subtitle <= 3.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc66669-ee38-408a-9dea-e6421cc6f75c?source=api-prod","affected":[{"type":"plugin","slug":"wp-subtitle","name":"WP Subtitle","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bc6d516-7636-45b2-ade1-c8f2297f0ea1","source":"wordfence","cve":"CVE-2026-15906","title":"Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc6d516-7636-45b2-ade1-c8f2297f0ea1?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"7.0.5"}],"published":"2026-07-22T20:29:48Z","updated":"2026-07-23T08:34:40Z"},{"id":"wordfence:9bc832fa-9845-4157-b7a6-54d8c3794085","source":"wordfence","cve":"","title":"Spryng Payments for WooCommerce <= 1.6.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc832fa-9845-4157-b7a6-54d8c3794085?source=api-prod","affected":[{"type":"plugin","slug":"spryng-payments-woocommerce","name":"Spryng Payments for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2019-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bc9e382-9902-4b2d-ac50-ecb2b94a2803","source":"wordfence","cve":"CVE-2024-35765","title":"Greenshift \u2013 animation and page builder blocks <= 8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc9e382-9902-4b2d-ac50-ecb2b94a2803?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"8.9.3","to_inclusive":true,"patched_in":"8.9.4"}],"published":"2024-06-17T00:00:00Z","updated":"2024-06-21T17:10:41Z"},{"id":"wordfence:9bcbc0cf-69e5-4d6e-8987-a0fbbaf41740","source":"wordfence","cve":"CVE-2025-12005","title":"WP VR \u2013 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcbc0cf-69e5-4d6e-8987-a0fbbaf41740?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.41","to_inclusive":true,"patched_in":"8.5.42"}],"published":"2025-10-24T16:51:14Z","updated":"2025-10-25T05:31:25Z"},{"id":"wordfence:9bcc1965-c409-40ba-a942-175646ad8fda","source":"wordfence","cve":"","title":"No CAPTCHA reCAPTCHA for WooCommerce <= 1.2.6 - Authenticated(Admin+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcc1965-c409-40ba-a942-175646ad8fda?source=api-prod","affected":[{"type":"plugin","slug":"no-captcha-recaptcha-for-woocommerce","name":"No CAPTCHA reCAPTCHA for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bcd18bd-032e-4a97-83aa-a377f9b1f435","source":"wordfence","cve":"CVE-2025-6025","title":"Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts","severity":"high","cvss":7.5,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcd18bd-032e-4a97-83aa-a377f9b1f435?source=api-prod","affected":[{"type":"plugin","slug":"order-tip-woo","name":"Order Tip for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-08-14T13:51:21Z","updated":"2025-08-15T02:24:23Z"},{"id":"wordfence:9bcdcaa4-c492-4d79-8d18-44802abd02e7","source":"wordfence","cve":"CVE-2025-10040","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure","severity":"high","cvss":7.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcdcaa4-c492-4d79-8d18-44802abd02e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.27","to_inclusive":true,"patched_in":"7.28"}],"published":"2025-09-09T17:59:47Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:9bce7b25-fb64-44ac-b48f-00ef871610c6","source":"wordfence","cve":"CVE-2015-9389","title":"mTouch Quiz <= 3.1.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bce7b25-fb64-44ac-b48f-00ef871610c6?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2015-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bcfb08a-e4f3-4cfe-bbd1-5bb8542e6f90","source":"wordfence","cve":"CVE-2026-94079","title":"WP User Manager \u2013 User Profile Builder & Membership <= 2.9.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bcfb08a-e4f3-4cfe-bbd1-5bb8542e6f90?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.19","to_inclusive":true,"patched_in":"2.9.20"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-23T14:10:04Z"},{"id":"wordfence:9bd04f78-0b9c-4985-b450-007bb5cc9e26","source":"wordfence","cve":"CVE-2024-9889","title":"ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd04f78-0b9c-4985-b450-007bb5cc9e26?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-18T18:21:19Z","updated":"2024-10-19T06:42:02Z"},{"id":"wordfence:9bd1a15d-4be6-4367-b6e9-9ddb45675b82","source":"wordfence","cve":"CVE-2026-100514","title":"REST API Log <= 1.7.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd1a15d-4be6-4367-b6e9-9ddb45675b82?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-log","name":"REST API Log","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-10-01T12:07:28Z","updated":"2026-10-08T22:54:05Z"},{"id":"wordfence:9bd1fe45-8518-429b-94d3-cc0ea06ca1b4","source":"wordfence","cve":"CVE-2024-6335","title":"Tracking Code Manager <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd1fe45-8518-429b-94d3-cc0ea06ca1b4?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-06-03T00:00:00Z","updated":"2024-09-10T17:08:20Z"},{"id":"wordfence:9bd3b7d6-7ad1-44f4-b28d-fdcb81692a8f","source":"wordfence","cve":"CVE-2024-50503","title":"User Toolkit <= 1.2.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd3b7d6-7ad1-44f4-b28d-fdcb81692a8f?source=api-prod","affected":[{"type":"plugin","slug":"user-toolkit","name":"User Toolkit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-10-28T00:00:00Z","updated":"2026-05-04T14:24:42Z"},{"id":"wordfence:9bd63003-d1d6-480a-8df7-878bcc89f1ee","source":"wordfence","cve":"CVE-2024-2793","title":"Visual Website Collaboration, Feedback & Project Management \u2013 Atarim <= 3.30 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd63003-d1d6-480a-8df7-878bcc89f1ee?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.30","to_inclusive":true,"patched_in":"3.31"}],"published":"2024-05-30T00:00:00Z","updated":"2024-05-31T04:31:43Z"},{"id":"wordfence:9bd6c6f7-a535-4e3a-8d72-01007d00d6be","source":"wordfence","cve":"CVE-2024-2101","title":"Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd6c6f7-a535-4e3a-8d72-01007d00d6be?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.6.2","to_inclusive":true,"patched_in":"9.6.3"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-25T13:01:24Z"},{"id":"wordfence:9bd873e5-fd65-48c3-a71d-aaf6d8372606","source":"wordfence","cve":"CVE-2024-10628","title":"Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd873e5-fd65-48c3-a71d-aaf6d8372606?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Developer","from":"20.0.0","from_inclusive":true,"to":"21.8.0","to_inclusive":true,"patched_in":"21.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"7.0.0","from_inclusive":true,"to":"8.8.0","to_inclusive":true,"patched_in":"8.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Agency","from":"30.0.0","from_inclusive":true,"to":"31.8.0","to_inclusive":true,"patched_in":"31.8.0.100"}],"published":"2025-01-25T00:00:00Z","updated":"2025-04-03T16:33:30Z"},{"id":"wordfence:9bd8c4e5-ef53-47e8-8658-291509e9b987","source":"wordfence","cve":"CVE-2023-47819","title":"Easy Call Now by ThikShare <= 1.1.0 - Cross-Site Request Forgery via settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd8c4e5-ef53-47e8-8658-291509e9b987?source=api-prod","affected":[{"type":"plugin","slug":"easy-call-now","name":"Easy Call Now by ThikShare","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bd9c9db-d279-4de2-b5e4-ac7d8c919f2a","source":"wordfence","cve":"CVE-2026-4883","title":"Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bd9c9db-d279-4de2-b5e4-ac7d8c919f2a?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms-pro","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"2.1.40","to_inclusive":true,"patched_in":""}],"published":"2026-05-18T18:28:36Z","updated":"2026-05-19T11:18:48Z"},{"id":"wordfence:9bdc292b-73bb-4d27-8771-147ffc3c5a67","source":"wordfence","cve":"CVE-2025-69095","title":"Reservation <= 1.7 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bdc292b-73bb-4d27-8771-147ffc3c5a67?source=api-prod","affected":[{"type":"plugin","slug":"dt-reservation-plugin","name":"Reservation Plugin","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:45:56Z"},{"id":"wordfence:9bdf7b10-6a3e-47aa-86ae-479b4cd29c49","source":"wordfence","cve":"CVE-2017-16815","title":"Duplicator <= 1.2.28 \u2013 Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bdf7b10-6a3e-47aa-86ae-479b4cd29c49?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.2.28","to_inclusive":true,"patched_in":"1.2.30"}],"published":"2017-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bdfa6e8-0bf6-4ca5-b145-af66d99dbf6c","source":"wordfence","cve":"CVE-2026-11969","title":"WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bdfa6e8-0bf6-4ca5-b145-af66d99dbf6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"14.3","to_inclusive":true,"patched_in":"14.4"}],"published":"2026-08-04T18:44:00Z","updated":"2026-08-05T07:39:22Z"},{"id":"wordfence:9be389b4-0f76-4f58-806e-dfba531934ea","source":"wordfence","cve":"CVE-2025-14852","title":"MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be389b4-0f76-4f58-806e-dfba531934ea?source=api-prod","affected":[{"type":"plugin","slug":"mdirector-newsletter","name":"MDirector Newsletter WordPress Plugin","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2026-02-13T18:29:09Z","updated":"2026-02-24T19:13:00Z"},{"id":"wordfence:9be4ad83-14da-499e-b216-e5f26016fa35","source":"wordfence","cve":"CVE-2008-6811","title":"Instinct WP e-Commerce <= 3.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be4ad83-14da-499e-b216-e5f26016fa35?source=api-prod","affected":[{"type":"plugin","slug":"wp-shopping-cart","name":"WP e-Commerce","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.6.8 RC1"}],"published":"2008-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9be5e54c-286a-4fec-95fb-27e3517f3eb8","source":"wordfence","cve":"CVE-2024-1746","title":"Testimonial Slider <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be5e54c-286a-4fec-95fb-27e3517f3eb8?source=api-prod","affected":[{"type":"plugin","slug":"testimonial","name":"Testimonial \u2013 Testimonial Slider, Reviews Slider, Testimonial By AI","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-25T12:56:18Z"},{"id":"wordfence:9be5e7e5-2d0e-462a-bc47-aa920c46ac28","source":"wordfence","cve":"CVE-2026-111400","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be5e7e5-2d0e-462a-bc47-aa920c46ac28?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-16T12:54:00Z","updated":"2026-10-23T18:41:53Z"},{"id":"wordfence:9be6089f-a4ca-447c-b3fa-6917b1383512","source":"wordfence","cve":"CVE-2024-49251","title":"Maan Addons For Elementor <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be6089f-a4ca-447c-b3fa-6917b1383512?source=api-prod","affected":[{"type":"plugin","slug":"maan-elementor-addons","name":"Maan Addons For Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:15:13Z"},{"id":"wordfence:9be6c569-4832-4b57-9123-0b2a26dac3a6","source":"wordfence","cve":"CVE-2025-30996","title":"Multiple Themify Themes <= Various Versions - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be6c569-4832-4b57-9123-0b2a26dac3a6?source=api-prod","affected":[{"type":"theme","slug":"rezo","name":"rezo","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wigi","name":"wigi","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"edmin","name":"edmin","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"folo","name":"Folo","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bloggie","name":"bloggie","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"newsy","name":"newsy","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"sidepane","name":"sidepane","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"slide","name":"slide","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"photobox","name":"photobox","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T13:56:46Z"},{"id":"wordfence:9be8c202-56f0-449f-84fa-375d239b5654","source":"wordfence","cve":"CVE-2016-4812","title":"Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be8c202-56f0-449f-84fa-375d239b5654?source=api-prod","affected":[{"type":"plugin","slug":"markdown-on-save-improved","name":"Markdown on Save Improved","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2016-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9be94d63-f027-4988-ab41-673658c1fa5f","source":"wordfence","cve":"CVE-2022-4328","title":"WooCommerce Checkout Field Manager <= 17.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9be94d63-f027-4988-ab41-673658c1fa5f?source=api-prod","affected":[{"type":"plugin","slug":"n-media-woocommerce-checkout-fields","name":"WooCommerce Checkout Field Manager","from":"*","from_inclusive":true,"to":"17.3","to_inclusive":true,"patched_in":"18.0"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bed2e86-1cc0-4fed-a44f-0c495c423e22","source":"wordfence","cve":"","title":"BuddyPress <= 2.3.4 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bed2e86-1cc0-4fed-a44f-0c495c423e22?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2015-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9beed2ac-939e-4aa3-b4ac-e21ae56504f7","source":"wordfence","cve":"CVE-2026-109930","title":"MAIO <= 7.3.21 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9beed2ac-939e-4aa3-b4ac-e21ae56504f7?source=api-prod","affected":[{"type":"plugin","slug":"maio-the-new-ai-geo-seo-tool","name":"MAIO \u2013 ChatGPT SEO Tracking & AI Search Optimization","from":"*","from_inclusive":true,"to":"7.3.21","to_inclusive":true,"patched_in":"7.3.22"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:13:47Z"},{"id":"wordfence:9bf472f1-5980-48ee-aa10-aad19b6f2456","source":"wordfence","cve":"CVE-2023-2736","title":"Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf472f1-5980-48ee-aa10-aad19b6f2456?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bf5b60b-5a4f-4227-97ac-a952019f46d9","source":"wordfence","cve":"CVE-2026-1869","title":"User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf5b60b-5a4f-4227-97ac-a952019f46d9?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2026-06-25T19:44:32Z","updated":"2026-06-26T07:54:20Z"},{"id":"wordfence:9bf6b196-6dd8-41b7-9838-287be16559fd","source":"wordfence","cve":"CVE-2022-3986","title":"WP Stripe Checkout <= 1.2.2.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf6b196-6dd8-41b7-9838-287be16559fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-checkout","name":"WP Stripe Checkout","from":"*","from_inclusive":true,"to":"1.2.2.20","to_inclusive":true,"patched_in":"1.2.2.21"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bf771b7-6c94-4c4e-8a89-5300f21aad4d","source":"wordfence","cve":"CVE-2024-53712","title":"Kevin's <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf771b7-6c94-4c4e-8a89-5300f21aad4d?source=api-prod","affected":[{"type":"plugin","slug":"kevins-plugin","name":"Kevin's Plugin","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-11-22T00:00:00Z","updated":"2026-05-26T18:14:38Z"},{"id":"wordfence:9bf772ee-ea54-47b7-a492-42b8bd9fab54","source":"wordfence","cve":"CVE-2026-93507","title":"WC Fields Factory <= 4.1.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf772ee-ea54-47b7-a492-42b8bd9fab54?source=api-prod","affected":[{"type":"plugin","slug":"wc-fields-factory","name":"WC Fields Factory","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:46:01Z"},{"id":"wordfence:9bf83028-df6d-448e-a841-1da98a3a43d5","source":"wordfence","cve":"CVE-2025-32619","title":"KeyCAPTCHA <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf83028-df6d-448e-a841-1da98a3a43d5?source=api-prod","affected":[{"type":"plugin","slug":"keycaptcha","name":"KeyCAPTCHA \u2013 Social WordPress CAPTCHA","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:39:55Z"},{"id":"wordfence:9bf8485b-a363-44a3-93c7-a6fba034b48f","source":"wordfence","cve":"CVE-2018-5369","title":"SrbTransLatin \u2013 SrbTransLatin <= 1.46 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf8485b-a363-44a3-93c7-a6fba034b48f?source=api-prod","affected":[{"type":"plugin","slug":"srbtranslatin","name":"SrbTransLatin \u2013 Serbian Latinisation","from":"*","from_inclusive":true,"to":"1.46","to_inclusive":true,"patched_in":"1.47"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9bf94803-1ddf-4b9b-9624-497db455aab2","source":"wordfence","cve":"CVE-2025-10901","title":"Originality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bf94803-1ddf-4b9b-9624-497db455aab2?source=api-prod","affected":[{"type":"plugin","slug":"originality-ai","name":"Originality.ai AI Checker","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T19:37:43Z","updated":"2025-11-07T16:47:26Z"},{"id":"wordfence:9bfaff5c-25b0-470a-b1ef-fce5976ce205","source":"wordfence","cve":"CVE-2024-11335","title":"UltraEmbed \u2013 Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfaff5c-25b0-470a-b1ef-fce5976ce205?source=api-prod","affected":[{"type":"plugin","slug":"ultraembed-advanced-iframe","name":"UltraEmbed \u2013 Advanced Iframe Plugin For WordPress with Gutenberg Block Included","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:27:10Z","updated":"2025-02-19T07:32:11Z"},{"id":"wordfence:9bfcc607-9fbc-4d36-858d-a0f763597a3b","source":"wordfence","cve":"CVE-2025-47568","title":"ZoomSounds <= 6.91 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfcc607-9fbc-4d36-858d-a0f763597a3b?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T15:40:05Z"},{"id":"wordfence:9bfcfc13-ccfb-4319-99a7-7d7510a11cfe","source":"wordfence","cve":"CVE-2026-15984","title":"QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfcfc13-ccfb-4319-99a7-7d7510a11cfe?source=api-prod","affected":[{"type":"plugin","slug":"quickcal","name":"QuickCal","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":""}],"published":"2026-09-04T17:55:56Z","updated":"2026-09-05T06:37:58Z"},{"id":"wordfence:9bfd6ec9-51e1-41a3-9db1-3b44d6eba958","source":"wordfence","cve":"CVE-2025-68996","title":"Responsive Posts Carousel Pro <= 15.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfd6ec9-51e1-41a3-9db1-3b44d6eba958?source=api-prod","affected":[{"type":"plugin","slug":"responsive-posts-carousel-pro","name":"Responsive Posts Carousel WordPress Plugin","from":"*","from_inclusive":true,"to":"15.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T19:02:34Z"},{"id":"wordfence:9bff2532-802c-4bb1-a0a2-7f5f928deb23","source":"wordfence","cve":"CVE-2026-6709","title":"Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bff2532-802c-4bb1-a0a2-7f5f928deb23?source=api-prod","affected":[{"type":"plugin","slug":"coinbase-commerce-for-contact-form-7","name":"Coinbase Business for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-05-11T19:04:04Z","updated":"2026-07-08T20:38:11Z"},{"id":"wordfence:9bff5293-fcb3-4968-972b-8f38052a877b","source":"wordfence","cve":"CVE-2026-94168","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9bff5293-fcb3-4968-972b-8f38052a877b?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.105","to_inclusive":true,"patched_in":"4.11.106"}],"published":"2026-09-23T14:36:00Z","updated":"2026-09-29T20:04:53Z"},{"id":"wordfence:9c025807-d4b7-405d-8e49-e2e6b3beba00","source":"wordfence","cve":"CVE-2026-14816","title":"The GDPR Framework <= 2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c025807-d4b7-405d-8e49-e2e6b3beba00?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-framework","name":"The GDPR Framework By Data443","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T14:08:33Z"},{"id":"wordfence:9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf","source":"wordfence","cve":"CVE-2026-2633","title":"Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c06e0a9-a13a-4cee-a1a5-c43c114b2dbf?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-02-17T17:43:19Z","updated":"2026-02-18T06:42:43Z"},{"id":"wordfence:9c07a512-b5ca-4370-b244-7d0b07c30801","source":"wordfence","cve":"CVE-2025-13504","title":"Real Estate Pro <= 2.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c07a512-b5ca-4370-b244-7d0b07c30801?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-pro","name":"Real Estate Pro - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:38:03Z"},{"id":"wordfence:9c08b8ac-83e7-4117-a5a7-021fdd4a25d8","source":"wordfence","cve":"CVE-2026-66459","title":"SOOZ \u2013 AI for SEO \u2013 Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot) <= 2.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c08b8ac-83e7-4117-a5a7-021fdd4a25d8?source=api-prod","affected":[{"type":"plugin","slug":"ai-for-seo","name":"SOOZ \u2013 AI for SEO \u2013 Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:53:28Z"},{"id":"wordfence:9c0c3932-bdb0-4edb-bfec-2ed52cbc5cb6","source":"wordfence","cve":"CVE-2025-2836","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c0c3932-bdb0-4edb-bfec-2ed52cbc5cb6?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.4.3","to_inclusive":true,"patched_in":"6.0.4.4"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-04T05:22:46Z"},{"id":"wordfence:9c0d229d-b80c-4c73-a14e-253f382d87a2","source":"wordfence","cve":"CVE-2026-24988","title":"The Events Calendar Shortcode & Block <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c0d229d-b80c-4c73-a14e-253f382d87a2?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar-shortcode","name":"The Events Calendar Shortcode & Block","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:16:21Z"},{"id":"wordfence:9c0df52e-f0c9-4ea5-aec7-d1075fd9668a","source":"wordfence","cve":"CVE-2025-47493","title":"Ultimate Blocks <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c0df52e-f0c9-4ea5-aec7-d1075fd9668a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:32:52Z"},{"id":"wordfence:9c0f1916-53a1-4867-8fd9-96f3180b9693","source":"wordfence","cve":"CVE-2026-61996","title":"MLS On The Fly <= 1.8.1.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c0f1916-53a1-4867-8fd9-96f3180b9693?source=api-prod","affected":[{"type":"plugin","slug":"mls-on-the-fly","name":"MLS On The Fly","from":"*","from_inclusive":true,"to":"1.8.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-04T21:43:20Z"},{"id":"wordfence:9c101fca-037c-4bed-9dc7-baa021a8b59c","source":"wordfence","cve":"CVE-2024-9707","title":"Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c101fca-037c-4bed-9dc7-baa021a8b59c?source=api-prod","affected":[{"type":"plugin","slug":"hunk-companion","name":"Hunk Companion","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:19Z"},{"id":"wordfence:9c105a36-452e-4fa7-9c8b-f142e1eb27aa","source":"wordfence","cve":"CVE-2026-94539","title":"SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c105a36-452e-4fa7-9c8b-f142e1eb27aa?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2026-10-02T14:05:45Z","updated":"2026-10-03T02:25:36Z"},{"id":"wordfence:9c14d918-daf9-46e8-9f96-4215e4645c62","source":"wordfence","cve":"CVE-2025-30985","title":"GNUCommerce <= 1.5.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c14d918-daf9-46e8-9f96-4215e4645c62?source=api-prod","affected":[{"type":"plugin","slug":"gnucommerce","name":"GNUCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-10T12:52:50Z"},{"id":"wordfence:9c159237-1a3a-4d42-9a2e-fbd6ca98f38e","source":"wordfence","cve":"CVE-2025-12881","title":"Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c159237-1a3a-4d42-9a2e-fbd6ca98f38e?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-11-20T18:56:54Z","updated":"2025-11-21T07:31:54Z"},{"id":"wordfence:9c17d18a-090f-4b35-a257-cfc0a16d5459","source":"wordfence","cve":"CVE-2024-1685","title":"Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c17d18a-090f-4b35-a257-cfc0a16d5459?source=api-prod","affected":[{"type":"plugin","slug":"social-media-builder","name":"Social Media Share Buttons","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-22T15:06:34Z"},{"id":"wordfence:9c1814b0-b421-4957-b3e5-ac7415ee6108","source":"wordfence","cve":"CVE-2025-49955","title":"Smart Flexslider <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c1814b0-b421-4957-b3e5-ac7415ee6108?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-flexslider","name":"SlideCraft \u2013 Responsive Slider & Carousel","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-07-14T00:00:00Z","updated":"2026-10-28T21:07:42Z"},{"id":"wordfence:9c1ac689-329a-4459-8b67-176e959cc02d","source":"wordfence","cve":"CVE-2026-6725","title":"WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c1ac689-329a-4459-8b67-176e959cc02d?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-messages","name":"WPC Smart Messages for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2026-04-27T15:55:16Z","updated":"2026-04-28T04:28:22Z"},{"id":"wordfence:9c1c5c1d-45a8-492d-9047-f8fcfe420dc6","source":"wordfence","cve":"CVE-2026-78532","title":"LMS <= 8.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c1c5c1d-45a8-492d-9047-f8fcfe420dc6?source=api-prod","affected":[{"type":"theme","slug":"lms","name":"LMS - Education WordPress Theme","from":"*","from_inclusive":true,"to":"8.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:19:43Z"},{"id":"wordfence:9c1d8ec3-de01-4496-8d8b-b9604f952b1e","source":"wordfence","cve":"CVE-2026-76801","title":"FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c1d8ec3-de01-4496-8d8b-b9604f952b1e?source=api-prod","affected":[{"type":"plugin","slug":"firebox","name":"FireBox \u2013 WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment","from":"*","from_inclusive":true,"to":"3.1.10","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2026-09-08T13:51:53Z","updated":"2026-09-09T02:27:36Z"},{"id":"wordfence:9c226d83-2886-4b7c-978c-ad723709145f","source":"wordfence","cve":"CVE-2014-8799","title":"DukaPress < 2.5.4 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c226d83-2886-4b7c-978c-ad723709145f?source=api-prod","affected":[{"type":"plugin","slug":"dukapress","name":"DukaPress","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2014-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c237580-360b-4c0a-b107-344484c06b7a","source":"wordfence","cve":"CVE-2026-24970","title":"Energox <= 1.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c237580-360b-4c0a-b107-344484c06b7a?source=api-prod","affected":[{"type":"theme","slug":"energox","name":"Energox | EV Charging Station WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:29:30Z"},{"id":"wordfence:9c238f06-a485-4516-81c8-76e32d83159c","source":"wordfence","cve":"","title":"WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image and Playlist Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c238f06-a485-4516-81c8-76e32d83159c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.4.14"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.4.14"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T18:42:27Z"},{"id":"wordfence:9c2465b8-09d2-4895-bc97-6f6f2e349d50","source":"wordfence","cve":"CVE-2008-0197","title":"WP-ContactForm <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2465b8-09d2-4895-bc97-6f6f2e349d50?source=api-prod","affected":[{"type":"plugin","slug":"wp-contactform","name":"WP-ContactForm","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2008-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c269233-f2dc-42ef-98be-78600f90e87d","source":"wordfence","cve":"CVE-2023-23649","title":"MainWP Links Manager Extension <= 2.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c269233-f2dc-42ef-98be-78600f90e87d?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-links-manager-extension","name":"MainWP Links Manager Extension","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c26a76d-a104-4ea6-be9f-9e8dfc3b5cd5","source":"wordfence","cve":"CVE-2025-12173","title":"WP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c26a76d-a104-4ea6-be9f-9e8dfc3b5cd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-microblog","name":"WP Admin Microblog","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:10:34Z","updated":"2025-11-18T08:27:34Z"},{"id":"wordfence:9c285682-6e8c-449e-8e43-4ca96fc64b55","source":"wordfence","cve":"CVE-2025-58656","title":"Estonian Shipping Methods for WooCommerce <= 1.7.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c285682-6e8c-449e-8e43-4ca96fc64b55?source=api-prod","affected":[{"type":"plugin","slug":"estonian-shipping-methods-for-woocommerce","name":"Estonian Shipping Methods for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:24:38Z"},{"id":"wordfence:9c2883e6-2a90-46c7-ba42-cc078e4d1670","source":"wordfence","cve":"","title":"Quiz and Survey Master <= 7.1.13 - SQL Injection","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2883e6-2a90-46c7-ba42-cc078e4d1670?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.1.13","to_inclusive":true,"patched_in":"7.1.14"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c28de1b-85b1-450b-afc3-6aff4aa70872","source":"wordfence","cve":"CVE-2026-85304","title":"Unlimited Elements For Elementor <= 2.0.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c28de1b-85b1-450b-afc3-6aff4aa70872?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:11:07Z"},{"id":"wordfence:9c29c110-87ed-47e3-919f-f6e98f703805","source":"wordfence","cve":"CVE-2022-4764","title":"Simple File Downloader <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c29c110-87ed-47e3-919f-f6e98f703805?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-downloader","name":"Simple File Downloader","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c2c11a3-ef42-4587-aea1-aa8f70b85953","source":"wordfence","cve":"CVE-2025-30912","title":"Float menu <= 6.1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2c11a3-ef42-4587-aea1-aa8f70b85953?source=api-prod","affected":[{"type":"plugin","slug":"float-menu","name":"Float menu \u2013 awesome floating side menu","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:47:51Z"},{"id":"wordfence:9c2c3022-b0a0-4c1c-83da-8efe8ae935e4","source":"wordfence","cve":"CVE-2025-23637","title":"\u65b0\u6dd8\u5ba2WordPress\u63d2\u4ef6 <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2c3022-b0a0-4c1c-83da-8efe8ae935e4?source=api-prod","affected":[{"type":"plugin","slug":"wp-xintaoke","name":"\u65b0\u6dd8\u5ba2WordPress\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-12T21:03:45Z"},{"id":"wordfence:9c2d97c4-b166-4d1f-8042-d0362e650c62","source":"wordfence","cve":"CVE-2025-3491","title":"Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2d97c4-b166-4d1f-8042-d0362e650c62?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-page-template","name":"Add custom page template","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T16:49:44Z","updated":"2025-04-26T05:34:24Z"},{"id":"wordfence:9c2de78e-8530-416b-adef-e2e8ff322802","source":"wordfence","cve":"CVE-2026-3034","title":"OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2de78e-8530-416b-adef-e2e8ff322802?source=api-prod","affected":[{"type":"plugin","slug":"ooohboi-steroids-for-elementor","name":"OoohBoi Steroids for Elementor","from":"*","from_inclusive":true,"to":"2.1.24","to_inclusive":true,"patched_in":"2.1.25"}],"published":"2026-03-04T14:44:34Z","updated":"2026-03-05T03:23:41Z"},{"id":"wordfence:9c2e8932-f207-40f2-85c9-5d1f28f859f2","source":"wordfence","cve":"CVE-2024-51615","title":"WordPress Auction Plugin <= 3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2e8932-f207-40f2-85c9-5d1f28f859f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-auctions","name":"WordPress Auction Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:38:19Z"},{"id":"wordfence:9c2f884b-3b5e-41ab-a291-3562c4b5a732","source":"wordfence","cve":"CVE-2025-54032","title":"Real Estate Manager Pro <= 12.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c2f884b-3b5e-41ab-a291-3562c4b5a732?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager-pro","name":"Real Estate Manager Pro","from":"*","from_inclusive":true,"to":"12.7.3","to_inclusive":true,"patched_in":"12.7.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:19:12Z"},{"id":"wordfence:9c32d183-c397-4e9e-9b91-6eda99c44d0b","source":"wordfence","cve":"CVE-2025-69068","title":"Muji <= 1.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c32d183-c397-4e9e-9b91-6eda99c44d0b?source=api-prod","affected":[{"type":"theme","slug":"muji","name":"Muji | Beauty Shop & Spa Salon WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:32:48Z"},{"id":"wordfence:9c32e105-5945-49a4-b8c0-7a3076cc58c4","source":"wordfence","cve":"CVE-2025-53304","title":"Contact Form &#8211; 7 : Hide Success Message <= 1.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c32e105-5945-49a4-b8c0-7a3076cc58c4?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-hide-success-message","name":"Contact Form \u2013 7 : Hide Success Message","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:35:51Z"},{"id":"wordfence:9c32fcaf-afc3-4493-8cd8-6f49bbe40c7b","source":"wordfence","cve":"CVE-2025-12095","title":"Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c32fcaf-afc3-4493-8cd8-6f49bbe40c7b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-simple-registration","name":"Simple Registration for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T05:31:25Z"},{"id":"wordfence:9c3557a6-aa72-496c-8515-2f6055de6b22","source":"wordfence","cve":"CVE-2026-12426","title":"Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3557a6-aa72-496c-8515-2f6055de6b22?source=api-prod","affected":[{"type":"plugin","slug":"members","name":"Members \u2013 Membership & User Role Editor Plugin","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.23"}],"published":"2026-07-10T14:07:51Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:9c35ca72-6ce9-40de-a413-12455bfb610e","source":"wordfence","cve":"CVE-2025-46454","title":"Meta Keywords & Description <= 0.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c35ca72-6ce9-40de-a413-12455bfb610e?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-keywords-meta-description","name":"Meta Keywords & Description","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-28T00:00:00Z","updated":"2025-05-05T18:12:06Z"},{"id":"wordfence:9c3724f3-ebd9-4804-88e0-804fd423af3a","source":"wordfence","cve":"CVE-2026-93885","title":"Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3724f3-ebd9-4804-88e0-804fd423af3a?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-donation-box","name":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:34:30Z","updated":"2026-10-14T03:40:01Z"},{"id":"wordfence:9c397428-7f4e-4775-b520-e47328cbe753","source":"wordfence","cve":"CVE-2025-23872","title":"PayForm <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c397428-7f4e-4775-b520-e47328cbe753?source=api-prod","affected":[{"type":"plugin","slug":"payform","name":"Stripe and PayPal Payment Forms for WordPress \u2013 PayForm","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:31:12Z"},{"id":"wordfence:9c3a047f-be12-4308-a4a5-fbbbc37f674d","source":"wordfence","cve":"CVE-2023-27606","title":"WP Reroute Email <= 1.4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3a047f-be12-4308-a4a5-fbbbc37f674d?source=api-prod","affected":[{"type":"plugin","slug":"wp-reroute-email","name":"WP Reroute Email","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c3a7ca0-9325-4b50-a844-8eeb4047de1a","source":"wordfence","cve":"CVE-2024-12610","title":"School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3a7ca0-9325-4b50-a844-8eeb4047de1a?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:26Z"},{"id":"wordfence:9c3c5632-444e-45d8-b0e0-347591c8db98","source":"wordfence","cve":"CVE-2026-123418","title":"Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3c5632-444e-45d8-b0e0-347591c8db98?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-11-06T21:48:33Z","updated":"2026-11-07T11:26:32Z"},{"id":"wordfence:9c3dc5fe-b1c8-4581-8100-68d313c3ac20","source":"wordfence","cve":"CVE-2021-36833","title":"MC4WP: Mailchimp for WordPress <= 4.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3dc5fe-b1c8-4581-8100-68d313c3ac20?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2022-03-02T07:15:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c3df12d-e526-4a23-89d3-bfdcea9f7b2d","source":"wordfence","cve":"CVE-2024-9862","title":"Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3df12d-e526-4a23-89d3-bfdcea9f7b2d?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-firebase-sms-otp-verification","name":"Miniorange OTP Verification with Firebase","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T02:06:03Z"},{"id":"wordfence:9c40773d-3a2f-46b6-861e-608d662250da","source":"wordfence","cve":"","title":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.3.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c40773d-3a2f-46b6-861e-608d662250da?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c42095d-c5b5-448a-8c6e-9a6c0e15a660","source":"wordfence","cve":"","title":"Usernoise modal feedback / contact form < 3.7.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c42095d-c5b5-448a-8c6e-9a6c0e15a660?source=api-prod","affected":[{"type":"plugin","slug":"usernoise","name":"Usernoise modal feedback / contact form","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":false,"patched_in":"3.7.9"}],"published":"2013-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c44b6e5-7fb2-402e-8c8c-79d811ff0e9a","source":"wordfence","cve":"CVE-2022-47428","title":"Booking calendar, Appointment Booking System <= 3.2.6 - Authenticated (Administrator+) SQL Injection via *_selected","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c44b6e5-7fb2-402e-8c8c-79d811ff0e9a?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c4a5bdd-4b4b-49a0-90d6-9f72c0a662d1","source":"wordfence","cve":"CVE-2026-93928","title":"E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4a5bdd-4b4b-49a0-90d6-9f72c0a662d1?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2026-09-19T00:00:00Z","updated":"2026-09-30T14:24:11Z"},{"id":"wordfence:9c4b2568-11b3-4fd8-a270-0ab4a29b3055","source":"wordfence","cve":"CVE-2025-60111","title":"Javo Core <= 3.0.0.266 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4b2568-11b3-4fd8-a270-0ab4a29b3055?source=api-prod","affected":[{"type":"plugin","slug":"javo-core","name":"Javo Core","from":"*","from_inclusive":true,"to":"3.0.0.266","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:21:15Z"},{"id":"wordfence:9c4cb6fa-986d-4765-a9e5-6e7c0a66f9a9","source":"wordfence","cve":"CVE-2025-52808","title":"RealtyElite <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4cb6fa-986d-4765-a9e5-6e7c0a66f9a9?source=api-prod","affected":[{"type":"theme","slug":"realtyelite","name":"RealtyElite - Real Estate & Property Sales WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T19:03:30Z"},{"id":"wordfence:9c4e5c12-6f12-40cb-ac0a-389ad3715503","source":"wordfence","cve":"CVE-2022-2450","title":"reSmush.it <= 0.4.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4e5c12-6f12-40cb-ac0a-389ad3715503?source=api-prod","affected":[{"type":"plugin","slug":"resmushit-image-optimizer","name":"reSmush.it : The original free image compressor and optimizer plugin","from":"*","from_inclusive":true,"to":"0.4.3","to_inclusive":true,"patched_in":"0.4.4"}],"published":"2022-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c5067e5-90e0-44a1-a263-99f93db004c9","source":"wordfence","cve":"CVE-2026-22504","title":"ProLingua <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c5067e5-90e0-44a1-a263-99f93db004c9?source=api-prod","affected":[{"type":"theme","slug":"prolingua","name":"ProLingua | Translation Bureau & Interpreting Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:55:12Z"},{"id":"wordfence:9c50e962-30ad-4717-bac2-913b60916307","source":"wordfence","cve":"CVE-2026-73354","title":"SimplyRETS Real Estate IDX <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c50e962-30ad-4717-bac2-913b60916307?source=api-prod","affected":[{"type":"plugin","slug":"simply-rets","name":"SimplyRETS Real Estate IDX","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:13:55Z"},{"id":"wordfence:9c538318-4c6f-4610-b4d4-a20005148d23","source":"wordfence","cve":"","title":"Gallery Categories by BestWebSoft < 1.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c538318-4c6f-4610-b4d4-a20005148d23?source=api-prod","affected":[{"type":"plugin","slug":"gallery-categories","name":"Gallery Categories by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c53faf5-a6a6-4eb9-ad82-31873c0a6282","source":"wordfence","cve":"CVE-2024-49687","title":"Smart Manager <= 8.45.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c53faf5-a6a6-4eb9-ad82-31873c0a6282?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.45.0","to_inclusive":true,"patched_in":"8.46.0"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:29:17Z"},{"id":"wordfence:9c5a4705-1bad-4ea9-9102-dc2780a61ac7","source":"wordfence","cve":"","title":"Essential Real Estate  <= 1.7.1 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c5a4705-1bad-4ea9-9102-dc2780a61ac7?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2019-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c5c1ec8-e03a-45ef-a9b0-f31f038e749a","source":"wordfence","cve":"CVE-2026-118167","title":"MC4WP: Mailchimp for WordPress <= 4.14.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c5c1ec8-e03a-45ef-a9b0-f31f038e749a?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:20:43Z"},{"id":"wordfence:9c5dfda6-a19b-46cb-8e8f-f3a84ea30809","source":"wordfence","cve":"CVE-2026-107862","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c5dfda6-a19b-46cb-8e8f-f3a84ea30809?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.7","to_inclusive":true,"patched_in":"11.2.8"}],"published":"2026-10-12T17:13:00Z","updated":"2026-10-13T13:46:34Z"},{"id":"wordfence:9c640bcb-b6bf-4865-b713-32ca846e4ed9","source":"wordfence","cve":"CVE-2023-1259","title":"Hotjar <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c640bcb-b6bf-4865-b713-32ca846e4ed9?source=api-prod","affected":[{"type":"plugin","slug":"hotjar","name":"Hotjar","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2023-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c641d50-51ac-47ca-beaf-3e79f436e091","source":"wordfence","cve":"CVE-2025-11819","title":"WP-Thumbnail <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c641d50-51ac-47ca-beaf-3e79f436e091?source=api-prod","affected":[{"type":"plugin","slug":"wp-thumbnail","name":"WP-Thumbnail","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:18:18Z","updated":"2025-10-22T08:27:09Z"},{"id":"wordfence:9c6577a2-6722-4d3b-958d-1143dca414cd","source":"wordfence","cve":"CVE-2022-4940","title":"WCFM Membership <= 2.10.0 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6577a2-6722-4d3b-958d-1143dca414cd?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c657ea2-ff7b-4ef2-a7dd-a330484dd821","source":"wordfence","cve":"CVE-2024-4290","title":"Sailthru Triggermail <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c657ea2-ff7b-4ef2-a7dd-a330484dd821?source=api-prod","affected":[{"type":"plugin","slug":"sailthru-triggermail","name":"Sailthru Triggermail","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-09T15:01:28Z"},{"id":"wordfence:9c6b570b-2b9d-44d2-8352-59c417393d8a","source":"wordfence","cve":"CVE-2025-66110","title":"Tiktok Feed <= 1.0.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b570b-2b9d-44d2-8352-59c417393d8a?source=api-prod","affected":[{"type":"plugin","slug":"b-tiktok-feed","name":"Feeds for TikTok \u2013 Keep Your Site Fresh with Your Latest Videos","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2025-12-02T00:00:00Z","updated":"2026-01-06T17:04:57Z"},{"id":"wordfence:9c6b747e-d267-4fd3-a4fd-022aa657c796","source":"wordfence","cve":"CVE-2025-13737","title":"Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"3.1.21","to_inclusive":true,"patched_in":"3.1.22"}],"published":"2025-11-27T14:54:41Z","updated":"2025-11-28T03:27:06Z"},{"id":"wordfence:9c6cbe4e-ee14-4361-9db3-d6e820ee7171","source":"wordfence","cve":"CVE-2024-45456","title":"WP Meta SEO <= 4.5.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6cbe4e-ee14-4361-9db3-d6e820ee7171?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T16:00:08Z"},{"id":"wordfence:9c6f9a3d-54a6-4405-b42b-37fc8342af96","source":"wordfence","cve":"CVE-2025-8891","title":"OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6f9a3d-54a6-4405-b42b-37fc8342af96?source=api-prod","affected":[{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"4.0.9","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-21T17:25:01Z"},{"id":"wordfence:9c732ea2-0263-4b18-9aa4-29e387b26362","source":"wordfence","cve":"CVE-2025-11707","title":"Login Lockdown & Protection <= 2.14 - IP Block Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.14","to_inclusive":true,"patched_in":"2.15"}],"published":"2025-12-12T15:27:33Z","updated":"2025-12-13T04:31:31Z"},{"id":"wordfence:9c77f6f3-f3de-44ca-b0e1-9281559c40db","source":"wordfence","cve":"CVE-2024-13574","title":"XV Random Quotes <= 1.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c77f6f3-f3de-44ca-b0e1-9281559c40db?source=api-prod","affected":[{"type":"plugin","slug":"xv-random-quotes","name":"XV Random Quotes","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T15:55:43Z"},{"id":"wordfence:9c78e0b6-bf24-4a23-8501-b26e681a7a4a","source":"wordfence","cve":"","title":"Author Chat <= 1.9.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c78e0b6-bf24-4a23-8501-b26e681a7a4a?source=api-prod","affected":[{"type":"plugin","slug":"author-chat","name":"Author Chat","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c7aeef5-b87e-4cd0-9374-93b7f67a9187","source":"wordfence","cve":"CVE-2024-9828","title":"Taskbuilder \u2013 WordPress Project & Task Management plugin <= 3.0.4 - Authenticated (Admin+) SQL injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c7aeef5-b87e-4cd0-9374-93b7f67a9187?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-10-31T00:00:00Z","updated":"2024-12-12T19:09:49Z"},{"id":"wordfence:9c7cf6f9-6fd0-487f-93cf-516b52736512","source":"wordfence","cve":"CVE-2015-9498","title":"WPS Hide Login <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c7cf6f9-6fd0-487f-93cf-516b52736512?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2015-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c7d2321-735a-4b5f-a36d-16375c994d2d","source":"wordfence","cve":"CVE-2023-23488","title":"Paid Memberships Pro < 2.9.8 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c7d2321-735a-4b5f-a36d-16375c994d2d?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c7edcbd-83b8-405b-892a-c404947990b3","source":"wordfence","cve":"","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 Persian WooCommerce SMS <= 4.4.0 - Cross-Site Scripting and SQL Injection","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c7edcbd-83b8-405b-892a-c404947990b3?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c819a98-033e-4ef8-a295-bf1a3518f63a","source":"wordfence","cve":"CVE-2026-48874","title":"GamiPress \u2013 Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c819a98-033e-4ef8-a295-bf1a3518f63a?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.8.7","to_inclusive":true,"patched_in":"7.8.8"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:36:45Z"},{"id":"wordfence:9c839d07-c496-46cc-8024-742f44cd3638","source":"wordfence","cve":"CVE-2016-10952","title":"Quotes Collection < 2.0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c839d07-c496-46cc-8024-742f44cd3638?source=api-prod","affected":[{"type":"plugin","slug":"quotes-collection","name":"Quotes Collection","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":false,"patched_in":"2.0.6"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c865d60-9e9f-450a-a3c4-43d991bf2478","source":"wordfence","cve":"CVE-2013-10029","title":"WordPress Exit Box Lite <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c865d60-9e9f-450a-a3c4-43d991bf2478?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-exit-box-lite","name":"WordPress Exit Box Lite","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":"1.10"}],"published":"2013-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c8ab916-240d-43c3-92d4-7efd75862a5e","source":"wordfence","cve":"CVE-2024-4733","title":"ShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c8ab916-240d-43c3-92d4-7efd75862a5e?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.57","to_inclusive":true,"patched_in":"4.9.58"}],"published":"2024-05-16T07:20:34Z","updated":"2024-05-16T19:33:31Z"},{"id":"wordfence:9c8add72-396b-4610-a75f-178a62b01fcb","source":"wordfence","cve":"CVE-2026-42718","title":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c8add72-396b-4610-a75f-178a62b01fcb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2026-10-08T13:11:57Z","updated":"2026-10-13T14:07:33Z"},{"id":"wordfence:9c8b0de4-e3ee-4711-8f27-097dee843dd8","source":"wordfence","cve":"","title":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer <= 2.13.44 - Missing Authorization in Settings Import to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c8b0de4-e3ee-4711-8f27-097dee843dd8?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.13.44","to_inclusive":true,"patched_in":"2.13.45"}],"published":"2023-02-21T00:00:00Z","updated":"2024-06-17T18:46:01Z"},{"id":"wordfence:9c8ff308-712b-4cf6-98ea-200d2fed9c43","source":"wordfence","cve":"","title":"Comments - wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c8ff308-712b-4cf6-98ea-200d2fed9c43?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2016-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9c90eb14-7f57-4d14-b485-7eb4a7fa6770","source":"wordfence","cve":"CVE-2025-62143","title":"Post Video Players <= 1.163 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c90eb14-7f57-4d14-b485-7eb4a7fa6770?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-and-gallery-plugin","name":"Cincopa video and media plug-in","from":"*","from_inclusive":true,"to":"1.163","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:25:09Z"},{"id":"wordfence:9c92dbe9-faeb-4ea9-9657-ed7accf63cc1","source":"wordfence","cve":"CVE-2025-48273","title":"WP Job Portal <= 2.3.2 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c92dbe9-faeb-4ea9-9657-ed7accf63cc1?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-05-24T00:00:00Z","updated":"2025-12-10T15:03:33Z"},{"id":"wordfence:9c935ec2-c51e-4760-bccc-3a6988bd4262","source":"wordfence","cve":"CVE-2024-31086","title":"Change default login logo,url and title <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c935ec2-c51e-4760-bccc-3a6988bd4262?source=api-prod","affected":[{"type":"plugin","slug":"change-default-login-logo-url-and-title","name":"Change default login logo,url and title","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T17:05:21Z"},{"id":"wordfence:9c97283b-404d-4138-b8a1-057f068e3564","source":"wordfence","cve":"CVE-2025-32141","title":"MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c97283b-404d-4138-b8a1-057f068e3564?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.5.28","to_inclusive":true,"patched_in":"3.5.29"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:03:23Z"},{"id":"wordfence:9c9ade2d-b9a4-4397-95ed-2035242cb946","source":"wordfence","cve":"CVE-2026-89214","title":"WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c9ade2d-b9a4-4397-95ed-2035242cb946?source=api-prod","affected":[{"type":"plugin","slug":"wpcues-basic-quiz","name":"WpCues Basic Quiz","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:20:27Z"},{"id":"wordfence:9c9b6214-8109-4b7e-8075-e6fce5ea11ad","source":"wordfence","cve":"CVE-2025-31758","title":"Free Woocommerce Product Table View <= 1.78 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c9b6214-8109-4b7e-8075-e6fce5ea11ad?source=api-prod","affected":[{"type":"plugin","slug":"free-product-table-for-woocommerce","name":"Free Woocommerce Product Table View \u2013 Woo Table Pro","from":"*","from_inclusive":true,"to":"1.78","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T13:37:05Z"},{"id":"wordfence:9c9feabc-6a8d-4367-8ea2-cc5284dbc041","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c9feabc-6a8d-4367-8ea2-cc5284dbc041?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"6.46","to_inclusive":false,"patched_in":"6.46"}],"published":"2017-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ca12315-380b-4251-b637-4e9d29df35e0","source":"wordfence","cve":"CVE-2025-15380","title":"NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca12315-380b-4251-b637-4e9d29df35e0?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-01-20T01:49:23Z","updated":"2026-01-20T14:26:34Z"},{"id":"wordfence:9ca26f8b-795c-4d3b-b79c-1109e65a9e7f","source":"wordfence","cve":"CVE-2025-47487","title":"MC Woocommerce Wishlist <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca26f8b-795c-4d3b-b79c-1109e65a9e7f?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-11T20:20:34Z"},{"id":"wordfence:9ca2c966-cea4-426b-9c70-5cb98fc1d125","source":"wordfence","cve":"CVE-2026-28040","title":"E-cab Taxi Booking Manager for Woocommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca2c966-cea4-426b-9c70-5cb98fc1d125?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:53:16Z"},{"id":"wordfence:9ca6f612-a777-4962-848b-2a81bf35ae4c","source":"wordfence","cve":"CVE-2026-42669","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca6f612-a777-4962-848b-2a81bf35ae4c?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.2.0","to_inclusive":true,"patched_in":"4.3.2.1"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-19T13:35:19Z"},{"id":"wordfence:9ca8e4ca-0ddf-492a-99c0-158ebdd7f86f","source":"wordfence","cve":"CVE-2025-15635","title":"Smart Online Order for Clover <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ca8e4ca-0ddf-492a-99c0-158ebdd7f86f?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-04-15T00:00:00Z","updated":"2026-09-09T16:06:31Z"},{"id":"wordfence:9caaa8f9-b04c-4522-97e8-323f38b38bb3","source":"wordfence","cve":"CVE-2024-52389","title":"WP Job Portal <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9caaa8f9-b04c-4522-97e8-323f38b38bb3?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:56:29Z"},{"id":"wordfence:9cac5c66-d366-4a67-b29b-4efed67ab55b","source":"wordfence","cve":"CVE-2024-43288","title":"wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cac5c66-d366-4a67-b29b-4efed67ab55b?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:49:48Z"},{"id":"wordfence:9cac974f-a7d7-47d0-8472-9df7e09e02ca","source":"wordfence","cve":"CVE-2024-54302","title":"VForm <= 3.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cac974f-a7d7-47d0-8472-9df7e09e02ca?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:55:44Z"},{"id":"wordfence:9cacf087-c501-47b2-ab9b-a395e95ae245","source":"wordfence","cve":"CVE-2026-40727","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cacf087-c501-47b2-ab9b-a395e95ae245?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:28:35Z"},{"id":"wordfence:9cad27cd-b4cc-4f34-8588-130e1ba997f9","source":"wordfence","cve":"CVE-2025-10191","title":"Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad27cd-b4cc-4f34-8588-130e1ba997f9?source=api-prod","affected":[{"type":"plugin","slug":"woo-bigpost-shipping","name":"Big Post Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-09-29T15:21:25Z","updated":"2025-10-10T20:43:47Z"},{"id":"wordfence:9cad3174-b1af-4e23-be72-6afb2d6cea84","source":"wordfence","cve":"CVE-2026-28039","title":"wpDataTables (Premium) <= 6.5.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cad3174-b1af-4e23-be72-6afb2d6cea84?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"6.5.0.1","to_inclusive":true,"patched_in":"6.5.0.2"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-17T21:34:09Z"},{"id":"wordfence:9cae7702-e531-45b9-9131-42edbc073a07","source":"wordfence","cve":"CVE-2024-7770","title":"Bit File Manager \u2013 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cae7702-e531-45b9-9131-42edbc073a07?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2024-09-09T00:00:00Z","updated":"2024-09-10T10:59:07Z"},{"id":"wordfence:9cb25cc5-b8d3-4dbc-b0d3-2a824e34db4f","source":"wordfence","cve":"CVE-2026-57378","title":"Advanced Forms for ACF <= 1.9.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cb25cc5-b8d3-4dbc-b0d3-2a824e34db4f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-forms","name":"Advanced Forms for ACF","from":"*","from_inclusive":true,"to":"1.9.3.7","to_inclusive":true,"patched_in":"1.9.3.8"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:34:40Z"},{"id":"wordfence:9cb3a665-8a3a-4261-b84c-0f4c90ee7664","source":"wordfence","cve":"CVE-2025-50006","title":"xSmart <= 1.2.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cb3a665-8a3a-4261-b84c-0f4c90ee7664?source=api-prod","affected":[{"type":"theme","slug":"xsmart","name":"xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency","from":"*","from_inclusive":true,"to":"1.2.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:00:17Z"},{"id":"wordfence:9cb6384a-f9dc-454c-be39-c2c681e57d36","source":"wordfence","cve":"CVE-2023-3645","title":"Contact Form Builder by Bit Form <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cb6384a-f9dc-454c-be39-c2c681e57d36?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cb7bc91-b2e9-4ede-80cf-6b961ac6dcb9","source":"wordfence","cve":"CVE-2019-9880","title":"WPGraphQL <= 0.2.3 - Information Exposure","severity":"critical","cvss":9.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cb7bc91-b2e9-4ede-80cf-6b961ac6dcb9?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":"0.3.0"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cb96b56-82cb-4429-b645-dfe8a14931e5","source":"wordfence","cve":"CVE-2021-24948","title":"The Plus Addons for Elementor Pro <= 5.0.6 - Sensitive Data Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cb96b56-82cb-4429-b645-dfe8a14931e5?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":false,"patched_in":"5.0.7"}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cbba523-8f9f-421d-9305-4b52e8eef726","source":"wordfence","cve":"CVE-2025-68857","title":"Paid Downloads <= 3.15 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbba523-8f9f-421d-9305-4b52e8eef726?source=api-prod","affected":[{"type":"plugin","slug":"paid-downloads","name":"Paid Downloads","from":"*","from_inclusive":true,"to":"3.15","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:14:05Z"},{"id":"wordfence:9cbbbb51-d770-429a-8256-c83ad71560ba","source":"wordfence","cve":"CVE-2024-6852","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbbbb51-d770-429a-8256-c83ad71560ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-15T20:17:01Z"},{"id":"wordfence:9cbc3383-f30e-46a1-a606-5b31082b0696","source":"wordfence","cve":"CVE-2025-30631","title":"Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbc3383-f30e-46a1-a606-5b31082b0696?source=api-prod","affected":[{"type":"plugin","slug":"azon-addon-js-composer","name":"Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-21T21:29:00Z"},{"id":"wordfence:9cbce69a-53d0-4b83-9b7a-893a6b9c39c4","source":"wordfence","cve":"CVE-2024-13429","title":"WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbce69a-53d0-4b83-9b7a-893a6b9c39c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:38Z"},{"id":"wordfence:9cc1627c-2eb7-4817-a7ce-eaa9097fd5f8","source":"wordfence","cve":"CVE-2025-50001","title":"tagDiv Composer <= 5.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cc1627c-2eb7-4817-a7ce-eaa9097fd5f8?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:43:03Z"},{"id":"wordfence:9ccb47c2-5f4b-45ea-9c48-0a9042a2fce6","source":"wordfence","cve":"CVE-2024-11854","title":"Listdom \u2013 Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ccb47c2-5f4b-45ea-9c48-0a9042a2fce6?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2024-12-03T21:33:25Z","updated":"2024-12-04T11:08:27Z"},{"id":"wordfence:9ccdf08b-8b74-4b58-8779-3b07ef2d7b2f","source":"wordfence","cve":"CVE-2026-6147","title":"LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ccdf08b-8b74-4b58-8779-3b07ef2d7b2f?source=api-prod","affected":[{"type":"plugin","slug":"lightsyncpro","name":"LightSync Pro \u2013 Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-08-04T18:22:40Z","updated":"2026-08-05T06:37:59Z"},{"id":"wordfence:9cceca0e-5411-4b8c-a261-91098a8bc7fa","source":"wordfence","cve":"CVE-2021-24723","title":"WP Reactions Lite <= 1.3.3 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cceca0e-5411-4b8c-a261-91098a8bc7fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-reactions-lite","name":"WP Reactions Lite","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ccf2b56-0355-43e6-a616-d06196e90972","source":"wordfence","cve":"CVE-2025-2314","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ccf2b56-0355-43e6-a616-d06196e90972?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.13.6","to_inclusive":true,"patched_in":"3.13.7"}],"published":"2025-04-15T12:34:28Z","updated":"2025-04-16T01:45:02Z"},{"id":"wordfence:9cd12b8a-2033-4236-abcd-2a8d08e7f099","source":"wordfence","cve":"CVE-2026-5395","title":"Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter","severity":"high","cvss":8.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd12b8a-2033-4236-abcd-2a8d08e7f099?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-05-13T18:08:24Z","updated":"2026-05-14T06:44:12Z"},{"id":"wordfence:9cd2b3fd-1bca-4611-9753-ccb57b0e36a4","source":"wordfence","cve":"CVE-2026-4979","title":"UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd2b3fd-1bca-4611-9753-ccb57b0e36a4?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.58","to_inclusive":true,"patched_in":"1.2.59"}],"published":"2026-04-10T12:14:59Z","updated":"2026-04-11T01:25:00Z"},{"id":"wordfence:9cd2ca03-e644-4bcd-b4b1-a547494fed7d","source":"wordfence","cve":"","title":"Booked <= 2.2.5 - Missing Authorization on AJAX Actions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd2ca03-e644-4bcd-b4b1-a547494fed7d?source=api-prod","affected":[{"type":"plugin","slug":"booked","name":"Booked - Appointment Booking for WordPress","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2020-02-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cd544ed-493e-4d4a-9eb8-ea83c47f3857","source":"wordfence","cve":"CVE-2026-105701","title":"ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd544ed-493e-4d4a-9eb8-ea83c47f3857?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-post-type","name":"ACPT (Premium)","from":"*","from_inclusive":true,"to":"2.0.66","to_inclusive":true,"patched_in":"2.0.67"}],"published":"2026-10-05T17:59:08Z","updated":"2026-10-06T06:42:04Z"},{"id":"wordfence:9cd819c2-45ab-4e0d-b29a-d92722db7164","source":"wordfence","cve":"CVE-2025-8392","title":"Mitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=api-prod","affected":[{"type":"plugin","slug":"mitfahrgelegenheit","name":"Mitfahrgelegenheit","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:45:55Z","updated":"2025-09-11T07:24:57Z"},{"id":"wordfence:9cd8338c-9987-4a7b-bd10-757a2595aaad","source":"wordfence","cve":"CVE-2026-111828","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 6.1.5 - Authenticated (Subscriber+) Arbitrary PHP Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd8338c-9987-4a7b-bd10-757a2595aaad?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:27:25Z"},{"id":"wordfence:9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513","source":"wordfence","cve":"CVE-2023-4596","title":"Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.24.6","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cd92993-1cda-46dc-8318-f2e938bff262","source":"wordfence","cve":"CVE-2015-9472","title":"Incoming Links < 0.9.10b - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd92993-1cda-46dc-8318-f2e938bff262?source=api-prod","affected":[{"type":"plugin","slug":"incoming-links","name":"Incoming Links","from":"*","from_inclusive":true,"to":"0.9.10b","to_inclusive":false,"patched_in":"0.9.10b"}],"published":"2015-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cdf1b24-95fd-45e2-b303-36e033ed6ed4","source":"wordfence","cve":"CVE-2025-22558","title":"mcjh button shortcode <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cdf1b24-95fd-45e2-b303-36e033ed6ed4?source=api-prod","affected":[{"type":"plugin","slug":"mcjh-button-shortcode","name":"mcjh button shortcode","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:41:19Z"},{"id":"wordfence:9ce0cc7a-c5ab-4a65-9f1b-7b2f83e36bdd","source":"wordfence","cve":"CVE-2025-53220","title":"XmasB Quotes <= 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ce0cc7a-c5ab-4a65-9f1b-7b2f83e36bdd?source=api-prod","affected":[{"type":"plugin","slug":"xmasb-quotes","name":"XmasB Quotes","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:21:28Z"},{"id":"wordfence:9ce1e9ee-09f7-4ebc-a907-0a30600df330","source":"wordfence","cve":"CVE-2026-107431","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ce1e9ee-09f7-4ebc-a907-0a30600df330?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.6.1"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:51:34Z"},{"id":"wordfence:9ce6b1fe-637b-4e2d-99e1-d23873d8f53f","source":"wordfence","cve":"CVE-2025-23580","title":"BizLibrary <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ce6b1fe-637b-4e2d-99e1-d23873d8f53f?source=api-prod","affected":[{"type":"plugin","slug":"bizlibrary","name":"BizLibrary","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:05:06Z"},{"id":"wordfence:9ce819fa-5c94-4116-9361-1de24619c27b","source":"wordfence","cve":"CVE-2024-54255","title":"Login Widget With Shortcode <= 6.1.2 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ce819fa-5c94-4116-9361-1de24619c27b?source=api-prod","affected":[{"type":"plugin","slug":"login-sidebar-widget","name":"Login Widget With Shortcode","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:58:45Z"},{"id":"wordfence:9ce8ad5f-05e8-4279-915a-1c94559d4e56","source":"wordfence","cve":"CVE-2023-52226","title":"Advanced Flamingo <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ce8ad5f-05e8-4279-915a-1c94559d4e56?source=api-prod","affected":[{"type":"plugin","slug":"advanced-flamingo","name":"Advanced Flamingo","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cebd25f-d2de-40d9-b2ab-a746c817b3ce","source":"wordfence","cve":"CVE-2025-39431","title":"Amazon Showcase WordPress Plugin <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cebd25f-d2de-40d9-b2ab-a746c817b3ce?source=api-prod","affected":[{"type":"plugin","slug":"amazon-showcase-wordpress-widget","name":"Amazon Showcase WordPress Plugin","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:32:54Z"},{"id":"wordfence:9cec4d7a-81e0-489a-b549-5848ed9a8449","source":"wordfence","cve":"CVE-2014-5368","title":"WP Source Control < 3.1.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cec4d7a-81e0-489a-b549-5848ed9a8449?source=api-prod","affected":[{"type":"plugin","slug":"wp-source-control","name":"WP Source Control","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2014-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cec5880-214b-4a35-9b36-e3a9e54e8f3b","source":"wordfence","cve":"CVE-2024-49252","title":"Leyka <= 3.31.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cec5880-214b-4a35-9b36-e3a9e54e8f3b?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.31.6","to_inclusive":true,"patched_in":"3.31.7"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:14:19Z"},{"id":"wordfence:9cecce4d-5d4a-4286-97dc-88a379e21b60","source":"wordfence","cve":"CVE-2025-11704","title":"Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=api-prod","affected":[{"type":"plugin","slug":"elegance-menu","name":"Elegance Menu","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-11-03T15:34:04Z","updated":"2025-12-04T17:42:29Z"},{"id":"wordfence:9cedd6bc-4629-46e1-998b-3713025ab428","source":"wordfence","cve":"CVE-2025-32234","title":"AdMail \u2013 Multilingual Back in-Stock Notifier for WooCommerce <= 1.7.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cedd6bc-4629-46e1-998b-3713025ab428?source=api-prod","affected":[{"type":"plugin","slug":"admail","name":"AdMail \u2013 Multilingual Back in-Stock Notifier for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T14:07:41Z"},{"id":"wordfence:9cf10ed7-7248-4dfd-b7ee-13cea3ee2154","source":"wordfence","cve":"CVE-2012-4226","title":"Quick Post Widget <= 1.9.1 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf10ed7-7248-4dfd-b7ee-13cea3ee2154?source=api-prod","affected":[{"type":"plugin","slug":"quick-post-widget","name":"quick-post-widget","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2012-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cf1230e-759e-4892-8de8-1adb3a0e48a1","source":"wordfence","cve":"CVE-2026-76063","title":"FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf1230e-759e-4892-8de8-1adb3a0e48a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-08-24T14:32:08Z","updated":"2026-08-25T03:27:06Z"},{"id":"wordfence:9cf12dc1-7b66-4c6e-8c3e-5915e1032303","source":"wordfence","cve":"","title":"Jock on air now <= 5.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf12dc1-7b66-4c6e-8c3e-5915e1032303?source=api-prod","affected":[{"type":"plugin","slug":"joan","name":"Jock On Air Now (JOAN)","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cf17c08-25b7-450d-acd9-963a1f79e495","source":"wordfence","cve":"CVE-2023-39920","title":"Redirection for Contact Form 7 <= 2.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf17c08-25b7-450d-acd9-963a1f79e495?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cf1f9ad-8870-43f7-bde0-b00773a9b435","source":"wordfence","cve":"CVE-2026-78283","title":"Music Player for WooCommerce <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf1f9ad-8870-43f7-bde0-b00773a9b435?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-woocommerce","name":"Music Player for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T21:06:22Z"},{"id":"wordfence:9cf27806-e521-40b5-8ab6-1f90f3957d06","source":"wordfence","cve":"CVE-2026-97066","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf27806-e521-40b5-8ab6-1f90f3957d06?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.9","to_inclusive":true,"patched_in":"4.17.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:55:40Z"},{"id":"wordfence:9cf2d3bd-359c-4334-ad28-b6b9722edd1c","source":"wordfence","cve":"CVE-2026-11818","title":"WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf2d3bd-359c-4334-ad28-b6b9722edd1c?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2026-07-09T14:47:22Z","updated":"2026-07-10T03:31:16Z"},{"id":"wordfence:9cf4a11e-ad28-4a93-9278-1d2d113a4859","source":"wordfence","cve":"CVE-2024-6544","title":"Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf4a11e-ad28-4a93-9278-1d2d113a4859?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-limits","name":"Custom Post Limits","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:26:40Z","updated":"2024-09-13T15:10:40Z"},{"id":"wordfence:9cfa4cb3-0f16-40be-9e78-ea378c3f535f","source":"wordfence","cve":"CVE-2018-20982","title":"Media Library Assistant <= 2.73 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfa4cb3-0f16-40be-9e78-ea378c3f535f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":false,"patched_in":"2.74"}],"published":"2018-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cfa753b-dbf5-4fe7-be69-fd8972a45e44","source":"wordfence","cve":"CVE-2021-24500","title":"Workreap < 2.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfa753b-dbf5-4fe7-be69-fd8972a45e44?source=api-prod","affected":[{"type":"theme","slug":"workreap","name":"Workreap - Freelance Marketplace and Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2021-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cfbafce-ba3b-477f-ad8d-ca4e57332f0b","source":"wordfence","cve":"","title":"WangGuard < 1.7.2 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfbafce-ba3b-477f-ad8d-ca4e57332f0b?source=api-prod","affected":[{"type":"plugin","slug":"wangguard","name":"WangGuard","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2016-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9cfd5cfa-9075-4408-bfb1-fb0c3494f61e","source":"wordfence","cve":"CVE-2025-22305","title":"Hero Banner Ultimate <= 1.4.4 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfd5cfa-9075-4408-bfb1-fb0c3494f61e?source=api-prod","affected":[{"type":"plugin","slug":"hero-banner-ultimate","name":"Hero Banner Ultimate","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-06-25T13:41:01Z"},{"id":"wordfence:9cfe91e6-238b-4652-892c-0016c1330088","source":"wordfence","cve":"CVE-2024-30432","title":"B Slider - Slider for your block editor <= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cfe91e6-238b-4652-892c-0016c1330088?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:13:24Z"},{"id":"wordfence:9cff616c-fd2e-4c92-a284-87ce38e45934","source":"wordfence","cve":"CVE-2025-53331","title":"RSS Digest <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9cff616c-fd2e-4c92-a284-87ce38e45934?source=api-prod","affected":[{"type":"plugin","slug":"rss-digest","name":"RSS Digest","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:24:26Z"},{"id":"wordfence:9d0154fd-0cab-4445-a92e-c44ae9931479","source":"wordfence","cve":"CVE-2025-12648","title":"WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0154fd-0cab-4445-a92e-c44ae9931479?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4.4","to_inclusive":true,"patched_in":"3.5.4.5"}],"published":"2026-01-06T14:17:16Z","updated":"2026-01-07T02:21:46Z"},{"id":"wordfence:9d04d8c1-75c0-447c-a26a-c2724c0a6618","source":"wordfence","cve":"CVE-2024-5601","title":"Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d04d8c1-75c0-447c-a26a-c2724c0a6618?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-06-26T19:03:48Z","updated":"2024-06-27T07:44:27Z"},{"id":"wordfence:9d0782ef-b74e-4540-a11d-280e432fc127","source":"wordfence","cve":"CVE-2013-10026","title":"Mail Subscribe List <= 2.0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0782ef-b74e-4540-a11d-280e432fc127?source=api-prod","affected":[{"type":"plugin","slug":"mail-subscribe-list","name":"Mail Subscribe List","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d09bdab-ffab-44cc-bba2-821b21a8e343","source":"wordfence","cve":"CVE-2023-3998","title":"wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d09bdab-ffab-44cc-bba2-821b21a8e343?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3","source":"wordfence","cve":"CVE-2020-36716","title":"WP Activity Log <= 4.0.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0a8be3-6630-4cf7-b6cb-cdc86b99acb3?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":false,"patched_in":"4.0.2"}],"published":"2020-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d0af9d0-eed7-44de-8c2f-2fe6a04d6d0e","source":"wordfence","cve":"CVE-2026-54839","title":"Trinity Backup \u2013 Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0af9d0-eed7-44de-8c2f-2fe6a04d6d0e?source=api-prod","affected":[{"type":"plugin","slug":"trinity-backup","name":"Trinity Backup \u2013 Backup, Migrate, Restore, Clone & Schedule Backups","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-25T13:34:42Z"},{"id":"wordfence:9d0b1e05-0e28-4cf5-a278-ea91b6c9d253","source":"wordfence","cve":"CVE-2023-25451","title":"CPO Content Types <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0b1e05-0e28-4cf5-a278-ea91b6c9d253?source=api-prod","affected":[{"type":"plugin","slug":"cpo-content-types","name":"CPO Content Types","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2023-03-03T00:00:00Z","updated":"2025-01-30T14:56:24Z"},{"id":"wordfence:9d0c144b-609b-4b4a-bfb2-de38b5969a9e","source":"wordfence","cve":"","title":"BP Profile Search <= 4.5.3 - PHP Object Injection","severity":"critical","cvss":9.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0c144b-609b-4b4a-bfb2-de38b5969a9e?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-search","name":"BP Profile Search","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.6"}],"published":"2016-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d0eb69a-3c94-40c2-acdf-6310190197a6","source":"wordfence","cve":"CVE-2012-2913","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0eb69a-3c94-40c2-acdf-6310190197a6?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d0f1227-cb60-4973-95a6-6272f5173bf4","source":"wordfence","cve":"CVE-2024-32529","title":"Yoga Schedule Momoyoga <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0f1227-cb60-4973-95a6-6272f5173bf4?source=api-prod","affected":[{"type":"plugin","slug":"momoyoga-integration","name":"Yoga Schedule Momoyoga","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-03T19:33:08Z"},{"id":"wordfence:9d11c022-9938-4a9e-be16-db986fdfa1c8","source":"wordfence","cve":"CVE-2023-47688","title":"Youtube SpeedLoad <= 0.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d11c022-9938-4a9e-be16-db986fdfa1c8?source=api-prod","affected":[{"type":"plugin","slug":"youtube-speedload","name":"Youtube SpeedLoad","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d15e418-36bb-4f53-ac67-8f6122591dd2","source":"wordfence","cve":"CVE-2024-7423","title":"Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d15e418-36bb-4f53-ac67-8f6122591dd2?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T15:10:43Z"},{"id":"wordfence:9d164f5e-c313-4e45-a17b-61460b10204e","source":"wordfence","cve":"CVE-2026-15009","title":"Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d164f5e-c313-4e45-a17b-61460b10204e?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.4.12","to_inclusive":true,"patched_in":"5.4.13"}],"published":"2026-08-15T15:25:35Z","updated":"2026-08-16T04:24:57Z"},{"id":"wordfence:9d17a3a0-3c09-4d67-96d6-d97bde92f100","source":"wordfence","cve":"CVE-2025-0311","title":"Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d17a3a0-3c09-4d67-96d6-d97bde92f100?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.43","to_inclusive":true,"patched_in":"2.10.44"}],"published":"2025-01-09T18:25:20Z","updated":"2025-01-10T06:43:16Z"},{"id":"wordfence:9d17f26b-e8b7-480d-bf03-2cfdb261fa28","source":"wordfence","cve":"CVE-2022-0989","title":"NS WooCommerce Watermark <= 2.11.3 - Abuse of Functionality","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d17f26b-e8b7-480d-bf03-2cfdb261fa28?source=api-prod","affected":[{"type":"plugin","slug":"ns-woocommerce-watermark","name":"NS Watermark For WooCommerce","from":"*","from_inclusive":true,"to":"2.11.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-03-15T00:00:00Z","updated":"2024-05-31T15:30:49Z"},{"id":"wordfence:9d19be8b-3e0b-4d74-97e0-f17132d2d34c","source":"wordfence","cve":"CVE-2023-2114","title":"NEX-Forms <= 8.3.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d19be8b-3e0b-4d74-97e0-f17132d2d34c?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.3.3","to_inclusive":true,"patched_in":"8.4"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d1c5877-4fd9-4762-b962-35a176f3b75b","source":"wordfence","cve":"CVE-2026-105196","title":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1c5877-4fd9-4762-b962-35a176f3b75b?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":false,"patched_in":"5.6.9"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:34:40Z"},{"id":"wordfence:9d1cb486-f461-4a06-ae9a-39669109b2c0","source":"wordfence","cve":"CVE-2025-8444","title":"Animation Addons for Elementor \u2013 GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1cb486-f461-4a06-ae9a-39669109b2c0?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2026-06-09T00:00:00Z","updated":"2026-10-30T17:34:15Z"},{"id":"wordfence:9d1e498a-ddcb-4c67-bf0d-bb45b6fe0e9d","source":"wordfence","cve":"CVE-2023-1023","title":"WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings'","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1e498a-ddcb-4c67-bf0d-bb45b6fe0e9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d1e8703-4ad3-42c5-a20d-f1bd31522a8b","source":"wordfence","cve":"","title":"Change WordPress Login Logo <= 1.1.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1e8703-4ad3-42c5-a20d-f1bd31522a8b?source=api-prod","affected":[{"type":"plugin","slug":"change-login-logo","name":"Change WordPress Login Logo","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2020-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d1fcdb9-215c-415b-bd47-4cbf9258685b","source":"wordfence","cve":"CVE-2022-32776","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 1.31.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d1fcdb9-215c-415b-bd47-4cbf9258685b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"1.31.1","to_inclusive":true,"patched_in":"1.32.0"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d21191c-32ef-4de6-8e95-ad66779e42f9","source":"wordfence","cve":"CVE-2024-35762","title":"Serious Slider <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d21191c-32ef-4de6-8e95-ad66779e42f9?source=api-prod","affected":[{"type":"plugin","slug":"cryout-serious-slider","name":"Serious Slider","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-02T12:51:34Z"},{"id":"wordfence:9d2345d2-0bcf-46fc-a857-0ec10a1b1c26","source":"wordfence","cve":"","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.4 - Path Traversal to Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d2345d2-0bcf-46fc-a857-0ec10a1b1c26?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2016-12-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d272148-0c05-49c7-ab86-22a3bc622bcf","source":"wordfence","cve":"CVE-2017-18528","title":"Download PDF & Print by BestWebSoft \u2013 WordPress Posts and Pages PDF Generator Plugin <= 1.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d272148-0c05-49c7-ab86-22a3bc622bcf?source=api-prod","affected":[{"type":"plugin","slug":"pdf-print","name":"PDF & Print by BestWebSoft \u2013 WordPress Posts and Pages PDF Generator Plugin","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":false,"patched_in":"1.9.4"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d28bd7d-ad3f-4720-9e09-466169fc672b","source":"wordfence","cve":"CVE-2025-7732","title":"Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d28bd7d-ad3f-4720-9e09-466169fc672b?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load-for-videos","name":"Lazy Load for Videos","from":"*","from_inclusive":true,"to":"2.18.7","to_inclusive":true,"patched_in":"2.18.8"}],"published":"2025-08-26T12:22:01Z","updated":"2025-08-27T01:46:48Z"},{"id":"wordfence:9d2a238f-7192-49f0-be2e-3a35fca651d9","source":"wordfence","cve":"CVE-2022-45837","title":"\u5fae\u4fe1\u673a\u5668\u4eba\u9ad8\u7ea7\u7248 <= 6.2.1 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d2a238f-7192-49f0-be2e-3a35fca651d9?source=api-prod","affected":[{"type":"plugin","slug":"weixin-robot-advanced","name":"\u5fae\u4fe1\u673a\u5668\u4eba\u9ad8\u7ea7\u7248","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d2dde9f-c3c3-4e6e-a7e2-a0e511bff010","source":"wordfence","cve":"","title":"School Management System for Wordpress <= 56.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d2dde9f-c3c3-4e6e-a7e2-a0e511bff010?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"57.0","to_inclusive":false,"patched_in":"57.0"}],"published":"2019-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d2df49d-0276-403d-9fe8-00fdf7262818","source":"wordfence","cve":"","title":"NextScripts: Social Networks Auto-Poster <= 3.4.17 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d2df49d-0276-403d-9fe8-00fdf7262818?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"3.4.18","to_inclusive":false,"patched_in":"3.4.18"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d32bda7-2d2d-4364-8ac9-e32950f889ed","source":"wordfence","cve":"CVE-2023-50878","title":"MStore API <= 4.10.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d32bda7-2d2d-4364-8ac9-e32950f889ed?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.10.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d37b7d7-ca79-4bf9-8e3a-00d4b0c5565f","source":"wordfence","cve":"CVE-2026-27759","title":"Featured Image from Content \u2013 AI Featured Image Generator <= 1.6 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d37b7d7-ca79-4bf9-8e3a-00d4b0c5565f?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-content","name":"Featured Image from Content \u2013 AI Featured Image Generator","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-02-27T00:00:00Z","updated":"2026-07-30T12:22:18Z"},{"id":"wordfence:9d387a5c-717c-4383-af7d-5a5f48628cb7","source":"wordfence","cve":"CVE-2021-24189","title":"Captchinoo Captcha <= 2.3 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d387a5c-717c-4383-af7d-5a5f48628cb7?source=api-prod","affected":[{"type":"plugin","slug":"captchinoo-captcha-for-login-form-protection","name":"Captchinoo, admin login page protection with Google recaptcha","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d389098-d428-48f2-b012-207b55497b0b","source":"wordfence","cve":"CVE-2022-4042","title":"Paytium <= 4.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d389098-d428-48f2-b012-207b55497b0b?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d38ac39-1005-495f-8947-81da35ff4092","source":"wordfence","cve":"CVE-2026-19093","title":"Tutor LMS \u2013 eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d38ac39-1005-495f-8947-81da35ff4092?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:53:48Z"},{"id":"wordfence:9d3b4315-05cd-4349-8dd9-ea6792048a9d","source":"wordfence","cve":"CVE-2021-24637","title":"Google Fonts Typography <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d3b4315-05cd-4349-8dd9-ea6792048a9d?source=api-prod","affected":[{"type":"plugin","slug":"olympus-google-fonts","name":"Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d3b6448-14cc-4146-9a93-98150031fcb6","source":"wordfence","cve":"","title":"Wibar | Wine and Vineyard WooCommerce WordPress Theme < 1.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d3b6448-14cc-4146-9a93-98150031fcb6?source=api-prod","affected":[{"type":"theme","slug":"wibar","name":"Wibar | Wine and Vineyard WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2020-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d3ca31a-a21f-4e38-91bb-5fabdb4440a5","source":"wordfence","cve":"CVE-2025-23656","title":"Donate visa <= 1.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d3ca31a-a21f-4e38-91bb-5fabdb4440a5?source=api-prod","affected":[{"type":"plugin","slug":"donate-visa","name":"Donate visa","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:44:12Z"},{"id":"wordfence:9d40e58d-98a7-4ae3-8497-9b8dd5399b60","source":"wordfence","cve":"CVE-2026-40731","title":"ChapterOne <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d40e58d-98a7-4ae3-8497-9b8dd5399b60?source=api-prod","affected":[{"type":"theme","slug":"chapterone","name":"ChapterOne - Bookstore and Publisher WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:16:07Z"},{"id":"wordfence:9d429b0d-ad85-4822-abf5-7e35012b0c3e","source":"wordfence","cve":"CVE-2025-30586","title":"cTabs <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d429b0d-ad85-4822-abf5-7e35012b0c3e?source=api-prod","affected":[{"type":"plugin","slug":"ctabs","name":"cTabs","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:17:45Z"},{"id":"wordfence:9d431b21-10df-485b-9d6d-b72363681fd5","source":"wordfence","cve":"CVE-2024-10107","title":"Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d431b21-10df-485b-9d6d-b72363681fd5?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.16","to_inclusive":true,"patched_in":"1.12.17"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-15T15:06:22Z"},{"id":"wordfence:9d453688-0bd4-4c4f-a422-8e4d67361c9a","source":"wordfence","cve":"CVE-2026-104403","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d453688-0bd4-4c4f-a422-8e4d67361c9a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.4.9.1"}],"published":"2026-10-02T09:55:00Z","updated":"2026-10-08T23:25:02Z"},{"id":"wordfence:9d4546b9-f974-4fe9-b981-9fe0c84f6a8b","source":"wordfence","cve":"CVE-2025-25165","title":"Staff Directory Plugin: Company Directory <= 4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4546b9-f974-4fe9-b981-9fe0c84f6a8b?source=api-prod","affected":[{"type":"plugin","slug":"staff-directory-pro","name":"Staff Directory Plugin: Company Directory","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-13T22:14:51Z"},{"id":"wordfence:9d47df99-cff5-4be7-ab8e-ef333cf3755b","source":"wordfence","cve":"CVE-2024-8102","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d47df99-cff5-4be7-ab8e-ef333cf3755b?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-06T22:12:22Z"},{"id":"wordfence:9d49e28b-8b5e-4c67-a36d-c78ee33ffc6e","source":"wordfence","cve":"CVE-2023-31080","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.65 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d49e28b-8b5e-4c67-a36d-c78ee33ffc6e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.65","to_inclusive":true,"patched_in":"1.5.66"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d4b53bd-d684-45d6-9924-e3e2d203ef03","source":"wordfence","cve":"CVE-2026-96539","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4b53bd-d684-45d6-9924-e3e2d203ef03?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-02T07:37:06Z","updated":"2026-10-13T14:50:09Z"},{"id":"wordfence:9d4bbf48-6525-4569-98a6-412f2bfe7628","source":"wordfence","cve":"CVE-2016-10956","title":"Mail Masta <= 1.0 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4bbf48-6525-4569-98a6-412f2bfe7628?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-08-23T00:00:00Z","updated":"2024-08-09T14:37:52Z"},{"id":"wordfence:9d4cede0-133f-487f-9b4d-7a9ffd2133ea","source":"wordfence","cve":"CVE-2025-27002","title":"CountDown With Image or Video Background <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4cede0-133f-487f-9b4d-7a9ffd2133ea?source=api-prod","affected":[{"type":"plugin","slug":"countdown-with-background","name":"CountDown With Image or Video Background","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:09:05Z"},{"id":"wordfence:9d4df759-1d5a-478a-aab1-f728fe909b5e","source":"wordfence","cve":"CVE-2021-25035","title":"Backup and Staging by WP Time Capsule <= 1.22.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4df759-1d5a-478a-aab1-f728fe909b5e?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.6","to_inclusive":true,"patched_in":"1.22.7"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d4f47af-294a-4c3a-accd-9ae674916a38","source":"wordfence","cve":"CVE-2018-25019","title":"LearnDash LMS <= 2.5.3 - Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4f47af-294a-4c3a-accd-9ae674916a38?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":false,"patched_in":"2.5.4"}],"published":"2018-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d4f6085-39c8-4f2e-83e1-adb27de46af3","source":"wordfence","cve":"CVE-2025-58237","title":"LC Wizard <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4f6085-39c8-4f2e-83e1-adb27de46af3?source=api-prod","affected":[{"type":"plugin","slug":"ghl-wizard","name":"Connector Wizard (formerly LC Wizard)","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:51:53Z"},{"id":"wordfence:9d4ff5ed-8857-46b8-942b-ac0f47880a95","source":"wordfence","cve":"CVE-2024-5598","title":"Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing","severity":"high","cvss":7.5,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4ff5ed-8857-46b8-942b-ac0f47880a95?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T04:33:30Z"},{"id":"wordfence:9d50c9e5-d7c3-46d6-b01b-0a8f0e6f019e","source":"wordfence","cve":"CVE-2025-31861","title":"Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d50c9e5-d7c3-46d6-b01b-0a8f0e6f019e?source=api-prod","affected":[{"type":"plugin","slug":"perfect-font-awesome-integration","name":"Perfect Font Awesome Integration","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:04:01Z"},{"id":"wordfence:9d51c4d8-b8c2-4883-9a0a-77ad525ca7aa","source":"wordfence","cve":"CVE-2026-109147","title":"Booking System <= 2.1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d51c4d8-b8c2-4883-9a0a-77ad525ca7aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.2","to_inclusive":true,"patched_in":"2.1.0.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:25:30Z"},{"id":"wordfence:9d534a1e-280d-418d-b497-1f3e6f3a20fb","source":"wordfence","cve":"CVE-2021-24396","title":"GSEOR \u2013 WordPress SEO Plugin <= 1.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d534a1e-280d-418d-b497-1f3e6f3a20fb?source=api-prod","affected":[{"type":"plugin","slug":"gseor","name":"GSEOR \u2013 WordPress SEO Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d56c960-004d-4dde-b0f5-ba32e397e9c3","source":"wordfence","cve":"CVE-2024-35725","title":"LA-Studio Element Kit for Elementor <= 1.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d56c960-004d-4dde-b0f5-ba32e397e9c3?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:58:27Z"},{"id":"wordfence:9d5a4b8f-22b7-437c-9f14-5c32539e2294","source":"wordfence","cve":"CVE-2026-114700","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d5a4b8f-22b7-437c-9f14-5c32539e2294?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-22T08:54:00Z","updated":"2026-10-23T18:40:47Z"},{"id":"wordfence:9d5ed6cf-ae12-4da5-809f-6a8c61eeb4f6","source":"wordfence","cve":"CVE-2023-5798","title":"Assistant <= 1.4.3 -  Authenticated (Editor+) Server Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d5ed6cf-ae12-4da5-809f-6a8c61eeb4f6?source=api-prod","affected":[{"type":"plugin","slug":"assistant","name":"Assistant \u2013 Every Day Productivity Apps","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d5f9d2e-6719-4ce7-bbdd-afaf437bd080","source":"wordfence","cve":"CVE-2024-24879","title":"Link Library <= 7.5.13 - Reflected Cross-Site Scripting via 'link_price' and 'link_tags'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d5f9d2e-6719-4ce7-bbdd-afaf437bd080?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.5.13","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:31:08Z"},{"id":"wordfence:9d5fc7a7-8461-4bd3-9d4e-1f5c98827d83","source":"wordfence","cve":"CVE-2025-64189","title":"XStore Core < 5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d5fc7a7-8461-4bd3-9d4e-1f5c98827d83?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":false,"patched_in":"5.6"}],"published":"2025-10-17T00:00:00Z","updated":"2025-12-20T20:32:21Z"},{"id":"wordfence:9d604200-91b0-4885-8fe2-1323b9d6fed5","source":"wordfence","cve":"","title":"WooCommerce Payments <= 4.5.0 - Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-233","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d604200-91b0-4885-8fe2-1323b9d6fed5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"3.9.0","from_inclusive":true,"to":"3.9.4","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.0.0","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.1.0","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.2.0","from_inclusive":true,"to":"4.2.2","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.3.0","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.4.0","from_inclusive":true,"to":"4.4.1","to_inclusive":false,"patched_in":"3.9.4"},{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"4.5.0","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d619314-88c2-4c42-863d-46f99a4aaa73","source":"wordfence","cve":"CVE-2024-6855","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to  Exit Popup Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d619314-88c2-4c42-863d-46f99a4aaa73?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-15T20:16:49Z"},{"id":"wordfence:9d6379b6-9a55-45a5-8308-988b1ee13f52","source":"wordfence","cve":"CVE-2026-57782","title":"Universal Clocks <= 1.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d6379b6-9a55-45a5-8308-988b1ee13f52?source=api-prod","affected":[{"type":"plugin","slug":"universal-clocks","name":"Universal Clocks","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:37:37Z"},{"id":"wordfence:9d637d7b-7a47-40db-a931-ec7ca723dfab","source":"wordfence","cve":"CVE-2026-15444","title":"Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d637d7b-7a47-40db-a931-ec7ca723dfab?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-07-27T23:25:41Z","updated":"2026-07-28T11:32:49Z"},{"id":"wordfence:9d64d711-f2d9-4447-9ac1-80c5ea51c23e","source":"wordfence","cve":"CVE-2023-47556","title":"Plugin Name: Device Theme Switcher <= 3.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d64d711-f2d9-4447-9ac1-80c5ea51c23e?source=api-prod","affected":[{"type":"plugin","slug":"device-theme-switcher","name":"Plugin Name: Device Theme Switcher","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d67965c-f8f3-4868-a261-81cfc80dbcb3","source":"wordfence","cve":"CVE-2024-12423","title":"Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d67965c-f8f3-4868-a261-81cfc80dbcb3?source=api-prod","affected":[{"type":"plugin","slug":"cf7-redirect-thank-you-page","name":"Business Essentials for Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T09:25:55Z"},{"id":"wordfence:9d682596-c32d-4abd-ba39-b57fc45c9ce0","source":"wordfence","cve":"CVE-2021-4410","title":"Qtranslate Slug <= 1.1.18 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d682596-c32d-4abd-ba39-b57fc45c9ce0?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-slug","name":"Qtranslate Slug","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":""}],"published":"2021-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d68ab8b-38c8-47aa-8b69-8cebe0a8d24e","source":"wordfence","cve":"CVE-2021-24700","title":"Forminator <= 1.15.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d68ab8b-38c8-47aa-8b69-8cebe0a8d24e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.15.4","to_inclusive":false,"patched_in":"1.15.4"}],"published":"2021-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d691974-6876-44f2-93a3-64f568bbebeb","source":"wordfence","cve":"CVE-2025-49510","title":"Min Max Step Quantity Limits Manager for WooCommerce <= 5.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d691974-6876-44f2-93a3-64f568bbebeb?source=api-prod","affected":[{"type":"plugin","slug":"product-quantity-for-woocommerce","name":"Min Max Step Quantity Limits Manager for WooCommerce","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T14:53:07Z"},{"id":"wordfence:9d69213f-a730-46bd-b1ae-3940fa463f97","source":"wordfence","cve":"CVE-2026-18216","title":"Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d69213f-a730-46bd-b1ae-3940fa463f97?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-08-13T00:00:00Z","updated":"2026-09-02T21:32:34Z"},{"id":"wordfence:9d692aff-8bb2-45bb-9caf-bc33d3ed5b10","source":"wordfence","cve":"CVE-2026-16144","title":"Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d692aff-8bb2-45bb-9caf-bc33d3ed5b10?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.20","to_inclusive":true,"patched_in":"2.4.21"}],"published":"2026-07-31T19:40:39Z","updated":"2026-08-01T07:49:50Z"},{"id":"wordfence:9d6a2238-eca4-4189-a6fe-dd605cd47703","source":"wordfence","cve":"CVE-2026-73401","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d6a2238-eca4-4189-a6fe-dd605cd47703?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.3.7","to_inclusive":true,"patched_in":"0.1.3.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T18:59:28Z"},{"id":"wordfence:9d6a7230-07c7-43f3-a844-77d2bb19545d","source":"wordfence","cve":"CVE-2023-1373","title":"W4 Post List <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d6a7230-07c7-43f3-a844-77d2bb19545d?source=api-prod","affected":[{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d6dd532-008b-4ce9-beca-baf5b3678a0b","source":"wordfence","cve":"CVE-2023-5610","title":"Seraphinite Accelerator <= 2.20.28 - Arbitrary Redirect via 'redir'","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d6dd532-008b-4ce9-beca-baf5b3678a0b?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.28","to_inclusive":true,"patched_in":"2.20.29"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d70294c-e2a4-4a34-8341-fb2361cb0819","source":"wordfence","cve":"CVE-2024-7879","title":"WP ULike <= 4.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d70294c-e2a4-4a34-8341-fb2361cb0819?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-15T17:35:08Z"},{"id":"wordfence:9d70b2c7-37be-467a-800a-ac9e6ebebff6","source":"wordfence","cve":"CVE-2026-123705","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d70b2c7-37be-467a-800a-ac9e6ebebff6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:03:26Z"},{"id":"wordfence:9d720d66-9a2c-4bb7-9be0-341eb0e24193","source":"wordfence","cve":"CVE-2026-32543","title":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d720d66-9a2c-4bb7-9be0-341eb0e24193?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-03-11T00:00:00Z","updated":"2026-03-19T15:41:25Z"},{"id":"wordfence:9d72604e-23ef-4a69-8839-cf8ff4aef3bc","source":"wordfence","cve":"","title":"Download Manager <= 3.2.43 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d72604e-23ef-4a69-8839-cf8ff4aef3bc?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.43","to_inclusive":true,"patched_in":"3.2.44"}],"published":"2022-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d72a965-5d81-4619-ad8b-46960a89bf1b","source":"wordfence","cve":"CVE-2023-23490","title":"Survey Maker < 3.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d72a965-5d81-4619-ad8b-46960a89bf1b?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d72ad35-a16e-40a1-8d91-2a9a798e83df","source":"wordfence","cve":"CVE-2025-23498","title":"Translation.Pro <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d72ad35-a16e-40a1-8d91-2a9a798e83df?source=api-prod","affected":[{"type":"plugin","slug":"translation-pro","name":"Translation.Pro","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:35:07Z"},{"id":"wordfence:9d7838c8-938f-487a-9120-4cb13f0e6f6b","source":"wordfence","cve":"CVE-2026-34892","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7838c8-938f-487a-9120-4cb13f0e6f6b?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.271","to_inclusive":true,"patched_in":"1.0.271.1"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:48:10Z"},{"id":"wordfence:9d79ce22-33ef-4dfb-a842-591cd7cedc94","source":"wordfence","cve":"","title":"Web Accessibility By accessiBe <= 1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d79ce22-33ef-4dfb-a842-591cd7cedc94?source=api-prod","affected":[{"type":"plugin","slug":"accessibe","name":"Web Accessibility by accessiBe","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.16"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d7a0f2f-a0f6-4a78-abc9-13364cac8490","source":"wordfence","cve":"CVE-2025-26568","title":"Easy Amazon Product Information <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7a0f2f-a0f6-4a78-abc9-13364cac8490?source=api-prod","affected":[{"type":"plugin","slug":"easy-amazon-product-information","name":"Easy Amazon Product Information","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:34:38Z"},{"id":"wordfence:9d7b7f4b-6acb-4ccb-8f2e-951012996ac7","source":"wordfence","cve":"CVE-2024-13807","title":"Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7b7f4b-6acb-4ccb-8f2e-951012996ac7?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.5","to_inclusive":true,"patched_in":"7.1.0.6"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T05:24:53Z"},{"id":"wordfence:9d7bc423-8722-4c3a-9149-488bdeea3a5f","source":"wordfence","cve":"CVE-2026-103086","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.74 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7bc423-8722-4c3a-9149-488bdeea3a5f?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.74","to_inclusive":true,"patched_in":"1.2.76"}],"published":"2026-10-03T17:33:07Z","updated":"2026-10-08T23:16:52Z"},{"id":"wordfence:9d7cd3eb-3ab7-44b3-8568-ce145977dfab","source":"wordfence","cve":"","title":"WordPress Appointment Schedule Booking System <=1.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7cd3eb-3ab7-44b3-8568-ce145977dfab?source=api-prod","affected":[{"type":"plugin","slug":"wp-appointment-schedule-booking-system","name":"wp-appointment-schedule-booking-system","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d7ea5b7-a4d5-4d1d-943e-3ba9635f24a1","source":"wordfence","cve":"CVE-2026-25348","title":"Download Alt Text AI <= 1.10.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7ea5b7-a4d5-4d1d-943e-3ba9635f24a1?source=api-prod","affected":[{"type":"plugin","slug":"alttext-ai","name":"Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility","from":"*","from_inclusive":true,"to":"1.10.15","to_inclusive":true,"patched_in":"1.10.18"}],"published":"2026-02-14T00:00:00Z","updated":"2026-02-24T19:27:25Z"},{"id":"wordfence:9d7f48a9-07f9-4add-bfa2-7ddbcf2f866f","source":"wordfence","cve":"CVE-2017-18612","title":"WP Whois Domain <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7f48a9-07f9-4add-bfa2-7ddbcf2f866f?source=api-prod","affected":[{"type":"plugin","slug":"wp-whois-domain","name":"WP Whois Domain","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2017-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d821dd2-ce97-4240-b5d6-f6e974a681a3","source":"wordfence","cve":"CVE-2026-22411","title":"Dolcino <= 1.6 - Authenticated (subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d821dd2-ce97-4240-b5d6-f6e974a681a3?source=api-prod","affected":[{"type":"theme","slug":"dolcino","name":"Dolcino - Pastry and Cake Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:24:39Z"},{"id":"wordfence:9d8304bf-bec2-4fcf-9fe2-46b626b3dae9","source":"wordfence","cve":"CVE-2025-13320","title":"WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter","severity":"medium","cvss":6.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8304bf-bec2-4fcf-9fe2-46b626b3dae9?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2025-12-11T15:08:20Z","updated":"2026-05-30T08:54:29Z"},{"id":"wordfence:9d83c085-b33a-4003-9e0a-8457669d6634","source":"wordfence","cve":"CVE-2024-10367","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d83c085-b33a-4003-9e0a-8457669d6634?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-10-31T22:04:45Z","updated":"2024-11-01T11:01:55Z"},{"id":"wordfence:9d847027-0b22-4310-b60e-3bd2ad1940f5","source":"wordfence","cve":"CVE-2026-48868","title":"Simple Shopping Cart <= 5.2.9 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d847027-0b22-4310-b60e-3bd2ad1940f5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.2.9","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-11T13:46:25Z"},{"id":"wordfence:9d8551b8-67b9-45a8-9357-9e42fb451606","source":"wordfence","cve":"","title":"Ya'aburnee <= 1.0.7 and Dignitas <= 1.1.9 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8551b8-67b9-45a8-9357-9e42fb451606?source=api-prod","affected":[{"type":"theme","slug":"yaaburnee-themes","name":"Ya'aburnee - Magazine & E-Commerce Theme | News / Editorial","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"dignitas-themes","name":"Dignitas - Hotel & Apartment Responsive Theme | Travel","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2015-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d86642a-3c11-43a2-8423-ca1cae058458","source":"wordfence","cve":"CVE-2025-49046","title":"xPromoter <= 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d86642a-3c11-43a2-8423-ca1cae058458?source=api-prod","affected":[{"type":"plugin","slug":"top_bar_promoter","name":"xPromoter","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:01:07Z"},{"id":"wordfence:9d866870-dff4-44c0-b1ee-781370f7e8ae","source":"wordfence","cve":"CVE-2025-47494","title":"EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d866870-dff4-44c0-b1ee-781370f7e8ae?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:42:01Z"},{"id":"wordfence:9d879fc6-97ec-4ecb-99c8-7fc0b91692ef","source":"wordfence","cve":"CVE-2024-9589","title":"Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d879fc6-97ec-4ecb-99c8-7fc0b91692ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-taxonomy-meta","name":"Category and Taxonomy Meta Fields","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T07:36:34Z"},{"id":"wordfence:9d87fd94-8a64-4b9b-9e51-025a689fa87b","source":"wordfence","cve":"CVE-2022-4657","title":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation <= 2.3.5 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d87fd94-8a64-4b9b-9e51-025a689fa87b?source=api-prod","affected":[{"type":"plugin","slug":"menu-ordering-reservations","name":"Restaurant Menu \u2013 Food Ordering System \u2013 Table Reservation","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d8a03f7-a028-401c-9088-77e75dd365f6","source":"wordfence","cve":"CVE-2025-8195","title":"JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8a03f7-a028-401c-9088-77e75dd365f6?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-13T08:21:14Z"},{"id":"wordfence:9d8b985c-c25b-4fad-ad58-2c4ef57712d0","source":"wordfence","cve":"CVE-2025-69116","title":"Iona <= 1.0.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8b985c-c25b-4fad-ad58-2c4ef57712d0?source=api-prod","affected":[{"type":"theme","slug":"iona","name":"Iona - Handmade & Crafts Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:39:00Z"},{"id":"wordfence:9d8c7e79-00c4-4667-9ef6-e988901bb6a0","source":"wordfence","cve":"CVE-2026-17149","title":"myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8c7e79-00c4-4667-9ef6-e988901bb6a0?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2026-09-08T19:36:26Z","updated":"2026-09-09T07:40:56Z"},{"id":"wordfence:9d8e0ad2-3cfb-443f-9958-9639d0745dd7","source":"wordfence","cve":"CVE-2023-25783","title":"Peadig's Like & Share Button <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8e0ad2-3cfb-443f-9958-9639d0745dd7?source=api-prod","affected":[{"type":"plugin","slug":"facebook-like-send-button","name":"FireCask Like & Share Button","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d8eae69-722a-45ea-a3ca-d4a39a63c4b3","source":"wordfence","cve":"CVE-2015-9314","title":"NewStatPress <= 1.0.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8eae69-722a-45ea-a3ca-d4a39a63c4b3?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2015-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d8f2aaf-43db-412b-947c-ca1eb946c3aa","source":"wordfence","cve":"CVE-2024-11459","title":"Country Blocker <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8f2aaf-43db-412b-947c-ca1eb946c3aa?source=api-prod","affected":[{"type":"plugin","slug":"country-blocker","name":"Country Blocker","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:36:32Z","updated":"2024-12-12T04:23:15Z"},{"id":"wordfence:9d91ffee-6902-4553-af3b-8ef4e5199367","source":"wordfence","cve":"CVE-2026-97668","title":"Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d91ffee-6902-4553-af3b-8ef4e5199367?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.8.0","to_inclusive":true,"patched_in":"10.8.1"}],"published":"2026-10-13T13:53:38Z","updated":"2026-10-14T02:27:37Z"},{"id":"wordfence:9d922a8f-611f-4586-b8ba-72d18d11a975","source":"wordfence","cve":"CVE-2026-103911","title":"Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.1","to_inclusive":true,"patched_in":"1.58.2"}],"published":"2026-10-15T16:03:07Z","updated":"2026-10-16T04:27:02Z"},{"id":"wordfence:9d979950-d365-4750-a4f1-df9335d3452d","source":"wordfence","cve":"CVE-2023-47679","title":"Qi Addons For Elementor <= 1.6.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d979950-d365-4750-a4f1-df9335d3452d?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d979d09-a019-420e-b46e-b1d1f5e430ae","source":"wordfence","cve":"CVE-2026-42731","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.4.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d979d09-a019-420e-b46e-b1d1f5e430ae?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2026-05-24T00:00:00Z","updated":"2026-05-26T19:55:15Z"},{"id":"wordfence:9d986739-d6a5-491d-948f-4c58af75369a","source":"wordfence","cve":"","title":"Restaurant & Cafe Addon for Elementor <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d986739-d6a5-491d-948f-4c58af75369a?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d98946e-864f-434e-8f45-85d663bbefee","source":"wordfence","cve":"CVE-2024-6168","title":"Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d98946e-864f-434e-8f45-85d663bbefee?source=api-prod","affected":[{"type":"plugin","slug":"just-custom-fields","name":"Just Custom Fields","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T08:33:09Z"},{"id":"wordfence:9d990802-a964-493a-8f34-4b5784f52e60","source":"wordfence","cve":"CVE-2022-0426","title":"Product Feed PRO for WooCommerce <= 11.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d990802-a964-493a-8f34-4b5784f52e60?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"11.2.3","to_inclusive":false,"patched_in":"11.2.3"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d9997f2-df58-4f6d-99ed-0f3060eb9976","source":"wordfence","cve":"CVE-2025-32597","title":"WordPress Events Calendar Plugin \u2013 connectDaily <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d9997f2-df58-4f6d-99ed-0f3060eb9976?source=api-prod","affected":[{"type":"plugin","slug":"connect-daily-web-calendar","name":"connectDaily Events Calendar Plugin","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-04-09T00:00:00Z","updated":"2026-02-26T15:06:10Z"},{"id":"wordfence:9d9cf724-9ae7-4414-88d1-10640491df34","source":"wordfence","cve":"CVE-2021-24427","title":"W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d9cf724-9ae7-4414-88d1-10640491df34?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":false,"patched_in":"2.1.3"}],"published":"2021-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9d9d6433-94c1-4e31-b16a-88b6ae6330c5","source":"wordfence","cve":"CVE-2025-23618","title":"Twitter Shortcode <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9d9d6433-94c1-4e31-b16a-88b6ae6330c5?source=api-prod","affected":[{"type":"plugin","slug":"twitter-shortcode","name":"Twitter Shortcode","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:46:18Z"},{"id":"wordfence:9da38075-2268-4f98-b02c-0c7c34e16d85","source":"wordfence","cve":"CVE-2026-32519","title":"Bit SMTP \u2013 Easy SMTP Solution with Email Logs <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9da38075-2268-4f98-b02c-0c7c34e16d85?source=api-prod","affected":[{"type":"plugin","slug":"bit-smtp","name":"Bit SMTP \u2013 Easy SMTP Solution with Email Logs","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:13:03Z"},{"id":"wordfence:9da6adf9-7219-4766-8cad-b8fff230a5e9","source":"wordfence","cve":"CVE-2025-30861","title":"Five Star Restaurant Reservations <= 2.6.29 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9da6adf9-7219-4766-8cad-b8fff230a5e9?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.6.29","to_inclusive":true,"patched_in":"2.6.30"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:28:22Z"},{"id":"wordfence:9da7c252-b0d4-4d91-bfc4-fd3c7f667108","source":"wordfence","cve":"CVE-2024-5059","title":"Event Management Tickets Booking <= 1.4.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9da7c252-b0d4-4d91-bfc4-fd3c7f667108?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-06-19T00:00:00Z","updated":"2024-12-24T16:23:47Z"},{"id":"wordfence:9daa4874-da77-43f2-8efa-70753cced5b3","source":"wordfence","cve":"CVE-2026-85010","title":"RestroPress <= 3.4.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9daa4874-da77-43f2-8efa-70753cced5b3?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:39:41Z"},{"id":"wordfence:9dac1d91-b9a9-47e0-86cb-2000659196c5","source":"wordfence","cve":"CVE-2018-17586","title":"WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via rules[0][content] parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dac1d91-b9a9-47e0-86cb-2000659196c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.8.5","to_inclusive":true,"patched_in":"0.8.8.6"}],"published":"2018-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dad1be5-ea6c-40fa-bb21-862e7fd8804a","source":"wordfence","cve":"CVE-2024-9670","title":"2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dad1be5-ea6c-40fa-bb21-862e7fd8804a?source=api-prod","affected":[{"type":"plugin","slug":"2d-tag-cloud-widget-by-sujin","name":"2D Tag Cloud","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-11T16:36:13Z","updated":"2024-10-12T05:39:42Z"},{"id":"wordfence:9db178cb-dd83-4bec-9bc0-0e5c4430ba34","source":"wordfence","cve":"CVE-2026-39605","title":"Super Custom Login <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9db178cb-dd83-4bec-9bc0-0e5c4430ba34?source=api-prod","affected":[{"type":"plugin","slug":"super-custom-login","name":"Super Custom Login","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T00:00:00Z","updated":"2026-04-15T21:16:24Z"},{"id":"wordfence:9db1dfde-0cba-41b2-ab7a-a1640e5fd96b","source":"wordfence","cve":"CVE-2025-13192","title":"Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints","severity":"high","cvss":8.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9db1dfde-0cba-41b2-ab7a-a1640e5fd96b?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-02-04T11:20:00Z","updated":"2026-02-04T23:22:57Z"},{"id":"wordfence:9db30856-7541-4647-9e10-3855230b7efe","source":"wordfence","cve":"CVE-2025-49257","title":"Zota <= 1.3.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9db30856-7541-4647-9e10-3855230b7efe?source=api-prod","affected":[{"type":"theme","slug":"zota","name":"Zota - Elementor Multi-Purpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:51:44Z"},{"id":"wordfence:9db8756a-a177-4d39-b169-dc874cac2b3b","source":"wordfence","cve":"CVE-2025-14070","title":"Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9db8756a-a177-4d39-b169-dc874cac2b3b?source=api-prod","affected":[{"type":"plugin","slug":"review-for-discount","name":"Reviewify \u2014 Review Discounts & Photo/Video Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-01-06T20:33:33Z","updated":"2026-01-08T21:49:30Z"},{"id":"wordfence:9dbaafbb-ab7b-41d8-a8f7-178b9d42b4c5","source":"wordfence","cve":"CVE-2026-2931","title":"Amelia Booking 8.3 - 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbaafbb-ab7b-41d8-a8f7-178b9d42b4c5?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"8.3","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.2"}],"published":"2026-03-25T15:31:53Z","updated":"2026-05-26T17:31:22Z"},{"id":"wordfence:9dbb5ce8-0afb-43f5-93b6-0b11939f4a93","source":"wordfence","cve":"CVE-2026-49062","title":"Faust.js <= 1.8.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbb5ce8-0afb-43f5-93b6-0b11939f4a93?source=api-prod","affected":[{"type":"plugin","slug":"faustwp","name":"Faust.js","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:27:52Z"},{"id":"wordfence:9dbc1f95-0f21-4a37-b1f7-eba03f29f021","source":"wordfence","cve":"CVE-2024-29914","title":"Stratum <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbc1f95-0f21-4a37-b1f7-eba03f29f021?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:04:09Z"},{"id":"wordfence:9dbd26f5-b75e-41a3-aefb-d6c8cc2cec7b","source":"wordfence","cve":"CVE-2024-5330","title":"Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbd26f5-b75e-41a3-aefb-d6c8cc2cec7b?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-07-31T17:54:10Z","updated":"2026-05-15T13:16:45Z"},{"id":"wordfence:9dbdb6cc-2a00-4d34-9c11-62f3d1b51c73","source":"wordfence","cve":"CVE-2024-12116","title":"Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbdb6cc-2a00-4d34-9c11-62f3d1b51c73?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-theme-addons","name":"Unlimited Theme Addon For Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-01-10T19:00:14Z","updated":"2025-01-30T16:25:45Z"},{"id":"wordfence:9dbfa5b6-9d8a-4874-8586-0581272ccc40","source":"wordfence","cve":"CVE-2026-19085","title":"Duplicate Post < 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dbfa5b6-9d8a-4874-8586-0581272ccc40?source=api-prod","affected":[{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T15:53:45Z"},{"id":"wordfence:9dc20703-9d7d-498f-a531-4539b7848249","source":"wordfence","cve":"CVE-2025-62076","title":"Simple Payment <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc20703-9d7d-498f-a531-4539b7848249?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-10-29T00:00:00Z","updated":"2025-11-03T18:23:20Z"},{"id":"wordfence:9dc23817-f5fe-420a-8204-8440935f0bd7","source":"wordfence","cve":"CVE-2026-3297","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc23817-f5fe-420a-8204-8440935f0bd7?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-06-12T19:06:17Z","updated":"2026-06-13T07:51:22Z"},{"id":"wordfence:9dc3c8e7-464e-4742-bc96-5a1dc8b27ae3","source":"wordfence","cve":"CVE-2024-45455","title":"WP Meta SEO <= 4.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc3c8e7-464e-4742-bc96-5a1dc8b27ae3?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T15:59:09Z"},{"id":"wordfence:9dc49d44-d4ba-49d8-96eb-547832fe4b5e","source":"wordfence","cve":"CVE-2024-6651","title":"WordPress File Upload <= 4.24.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc49d44-d4ba-49d8-96eb-547832fe4b5e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.7","to_inclusive":true,"patched_in":"4.24.8"}],"published":"2024-07-16T00:00:00Z","updated":"2024-08-09T19:22:01Z"},{"id":"wordfence:9dc4a6f9-b663-4573-9a6d-0c96ee25308d","source":"wordfence","cve":"CVE-2026-17087","title":"WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc4a6f9-b663-4573-9a6d-0c96ee25308d?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.8.4","to_inclusive":true,"patched_in":"6.8.5"}],"published":"2026-08-15T17:28:48Z","updated":"2026-08-16T06:38:08Z"},{"id":"wordfence:9dc5452d-41e4-4b28-bb89-fe5ef9c10cb7","source":"wordfence","cve":"CVE-2025-8212","title":"Medical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc5452d-41e4-4b28-bb89-fe5ef9c10cb7?source=api-prod","affected":[{"type":"plugin","slug":"medical-addon-for-elementor","name":"Medical Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-08-01T18:51:31Z","updated":"2025-08-22T15:25:20Z"},{"id":"wordfence:9dc5861b-9181-45f9-abf5-6eea36edbda7","source":"wordfence","cve":"CVE-2025-53576","title":"Ovatheme Events <= 1.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc5861b-9181-45f9-abf5-6eea36edbda7?source=api-prod","affected":[{"type":"plugin","slug":"ova-events","name":"Ovatheme Events","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:19:50Z"},{"id":"wordfence:9dc640c8-3740-4770-b729-fb45ecec2b45","source":"wordfence","cve":"CVE-2023-32578","title":"Column-Matic <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc640c8-3740-4770-b729-fb45ecec2b45?source=api-prod","affected":[{"type":"plugin","slug":"column-matic","name":"Column-Matic","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dc6b822-356f-4af3-898f-7ebe97a35a68","source":"wordfence","cve":"CVE-2025-58953","title":"Joly <= 1.22.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc6b822-356f-4af3-898f-7ebe97a35a68?source=api-prod","affected":[{"type":"theme","slug":"joly","name":"Joly \u2013 Hairdresser & Beauty Salon WordPress Theme","from":"*","from_inclusive":true,"to":"1.22.0","to_inclusive":true,"patched_in":"1.23.0"}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T15:23:16Z"},{"id":"wordfence:9dc90b13-2f36-45bc-991c-f1927ae9253d","source":"wordfence","cve":"CVE-2023-5609","title":"Seraphinite Accelerator <= 2.20.28 - Reflected Cross-Site Scripting via 'rt'","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc90b13-2f36-45bc-991c-f1927ae9253d?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.28","to_inclusive":true,"patched_in":"2.20.29"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dc9907d-9820-478e-80dc-3155b1621c88","source":"wordfence","cve":"CVE-2024-13098","title":"WP Email Newsletter <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc9907d-9820-478e-80dc-3155b1621c88?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-newsletter","name":"WordPress Email Newsletter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-25T16:44:27Z"},{"id":"wordfence:9dca436d-d5ac-4cb8-ab05-df9b8e38ae35","source":"wordfence","cve":"CVE-2026-115230","title":"WHIZZ <= 1.1.8 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dca436d-d5ac-4cb8-ab05-df9b8e38ae35?source=api-prod","affected":[{"type":"plugin","slug":"whizz","name":"WHIZZ","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:17:52Z"},{"id":"wordfence:9dcd480e-71c5-4933-8627-914881776e13","source":"wordfence","cve":"CVE-2024-44035","title":"Gum Elementor Addon <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dcd480e-71c5-4933-8627-914881776e13?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T19:50:30Z"},{"id":"wordfence:9dcd48b8-ec9e-44b4-b531-95940adbd100","source":"wordfence","cve":"CVE-2023-6807","title":"GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dcd48b8-ec9e-44b4-b531-95940adbd100?source=api-prod","affected":[{"type":"plugin","slug":"generatepress-premium","name":"GeneratePress Premium","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-01-18T00:00:00Z","updated":"2024-07-29T21:36:58Z"},{"id":"wordfence:9dcfe9e4-d526-44f0-8c64-969866f9e6eb","source":"wordfence","cve":"CVE-2026-28142","title":"Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dcfe9e4-d526-44f0-8c64-969866f9e6eb?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T21:48:11Z"},{"id":"wordfence:9dd1e52c-83b7-4b3e-a791-a2c0ccd856bc","source":"wordfence","cve":"","title":"wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd1e52c-83b7-4b3e-a791-a2c0ccd856bc?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.6","to_inclusive":false,"patched_in":"7.6.6"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dd38406-0e67-4bd6-b9a3-0bc69f99148f","source":"wordfence","cve":"CVE-2025-31821","title":"Integration of Zoho CRM and Contact Form 7 <= 1.0.6 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd38406-0e67-4bd6-b9a3-0bc69f99148f?source=api-prod","affected":[{"type":"plugin","slug":"integration-of-zoho-crm-and-contact-form-7","name":"Integration of Zoho CRM and Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:52:51Z"},{"id":"wordfence:9dd3c464-601f-4dd5-86d1-500ac1946d39","source":"wordfence","cve":"CVE-2026-109934","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 3.1.1 - 3.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd3c464-601f-4dd5-86d1-500ac1946d39?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"3.1.1","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:09:16Z"},{"id":"wordfence:9dd48d0f-00c2-4f76-923b-eb5c7a2b4468","source":"wordfence","cve":"CVE-2014-4604","title":"Your Text Manager <= 0.3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd48d0f-00c2-4f76-923b-eb5c7a2b4468?source=api-prod","affected":[{"type":"plugin","slug":"your-text-manager","name":"your-text-manager","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dd6433f-cc12-47c7-a641-3da8a6b0f15b","source":"wordfence","cve":"CVE-2026-8894","title":"iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd6433f-cc12-47c7-a641-3da8a6b0f15b?source=api-prod","affected":[{"type":"plugin","slug":"iwr-tooltip","name":"iWR Tooltip","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:27:16Z","updated":"2026-05-27T05:31:29Z"},{"id":"wordfence:9dd6828b-6235-4284-bce6-be23b79ac70e","source":"wordfence","cve":"CVE-2024-6264","title":"Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd6828b-6235-4284-bce6-be23b79ac70e?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T11:01:36Z"},{"id":"wordfence:9dd71a06-b3b5-431a-b6da-3b7db3a3907c","source":"wordfence","cve":"","title":"Plugin Central < 2.5.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd71a06-b3b5-431a-b6da-3b7db3a3907c?source=api-prod","affected":[{"type":"plugin","slug":"plugin-central","name":"Plugin Central","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dd75955-3c9e-4cac-b952-f705a2129707","source":"wordfence","cve":"CVE-2024-11140","title":"Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd75955-3c9e-4cac-b952-f705a2129707?source=api-prod","affected":[{"type":"plugin","slug":"real-wp-shop-lite","name":"Real WP Shop Lite Ajax eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T00:00:00Z","updated":"2024-12-12T19:23:42Z"},{"id":"wordfence:9dd7babf-6a0d-443d-b034-7d206e1ee98f","source":"wordfence","cve":"CVE-2025-69373","title":"VidoRev <= 2.9.9.9.9.9.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd7babf-6a0d-443d-b034-7d206e1ee98f?source=api-prod","affected":[{"type":"theme","slug":"vidorev","name":"VidoRev - Video WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.9.9.9.9.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:37:02Z"},{"id":"wordfence:9dd7d56a-4316-412e-b48f-894d8d31e154","source":"wordfence","cve":"CVE-2026-107869","title":"Flexible Subscriptions <= 1.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd7d56a-4316-412e-b48f-894d8d31e154?source=api-prod","affected":[{"type":"plugin","slug":"flexible-subscriptions","name":"Flexible Subscriptions","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2026-10-12T08:25:00Z","updated":"2026-10-13T14:03:01Z"},{"id":"wordfence:9dd85315-fb4d-40fa-9478-4b09154c688a","source":"wordfence","cve":"CVE-2025-27327","title":"Live Streaming Video Player \u2013 by SRS Player <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dd85315-fb4d-40fa-9478-4b09154c688a?source=api-prod","affected":[{"type":"plugin","slug":"srs-player","name":"Live Streaming Video Player \u2013 by SRS Player","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:21:12Z"},{"id":"wordfence:9dda0b0a-234c-46bb-950a-2b7a5ef3227b","source":"wordfence","cve":"CVE-2025-39360","title":"Grace Mag <= 1.1.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dda0b0a-234c-46bb-950a-2b7a5ef3227b?source=api-prod","affected":[{"type":"theme","slug":"grace-mag","name":"Grace Mag","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:07:24Z"},{"id":"wordfence:9ddc2f44-e53f-45c2-b293-ad4abc8cff8f","source":"wordfence","cve":"","title":"Geo Magazine Theme <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ddc2f44-e53f-45c2-b293-ad4abc8cff8f?source=api-prod","affected":[{"type":"theme","slug":"geomagazine","name":"Geo Magazine Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2020-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ddcdc04-d381-4870-bc57-af76e0b5185a","source":"wordfence","cve":"CVE-2025-67586","title":"Highlight and Share <= 5.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ddcdc04-d381-4870-bc57-af76e0b5185a?source=api-prod","affected":[{"type":"plugin","slug":"highlight-and-share","name":"Highlight and Share \u2013 Unobtrusive and Lightweight Content Sharing","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:36:19Z"},{"id":"wordfence:9de09daa-a3e0-4563-bdc9-79cb5e4b039b","source":"wordfence","cve":"","title":"SEO Redirection Plugin \u2013 301 Redirect Manager <= 7.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9de09daa-a3e0-4563-bdc9-79cb5e4b039b?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":"7.9"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9de3dd8e-8529-496c-99ff-aa13d484135c","source":"wordfence","cve":"CVE-2026-56009","title":"Bricksable for Bricks Builder <= 1.6.83 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9de3dd8e-8529-496c-99ff-aa13d484135c?source=api-prod","affected":[{"type":"plugin","slug":"bricksable","name":"Bricksable for Bricks Builder","from":"*","from_inclusive":true,"to":"1.6.83","to_inclusive":true,"patched_in":"1.6.84"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:37:15Z"},{"id":"wordfence:9de42bd9-a1d2-48f2-a594-4013a9490e25","source":"wordfence","cve":"CVE-2025-14078","title":"PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9de42bd9-a1d2-48f2-a594-4013a9490e25?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-paygent-payment-main","name":"PAYGENT for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-01-16T19:57:52Z","updated":"2026-01-17T08:24:32Z"},{"id":"wordfence:9df00907-c95e-445c-b424-78a1e5e00e4f","source":"wordfence","cve":"CVE-2025-1291","title":"Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df00907-c95e-445c-b424-78a1e5e00e4f?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T08:23:21Z"},{"id":"wordfence:9df0d33d-6b07-4e5c-bfa0-6f618a969f23","source":"wordfence","cve":"CVE-2026-82851","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates 1.14.0 - 3.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df0d33d-6b07-4e5c-bfa0-6f618a969f23?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"1.14.0","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:17:26Z"},{"id":"wordfence:9df24b5e-109e-43ae-b55b-8514281a631f","source":"wordfence","cve":"CVE-2024-7863","title":"Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df24b5e-109e-43ae-b55b-8514281a631f?source=api-prod","affected":[{"type":"plugin","slug":"favicon-generator","name":"Favicon Generator (CLOSED)","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-27T12:59:16Z"},{"id":"wordfence:9df43aa5-e355-4936-a366-baa77654166b","source":"wordfence","cve":"CVE-2026-24989","title":"SUMO Affiliates Pro < 11.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df43aa5-e355-4936-a366-baa77654166b?source=api-prod","affected":[{"type":"plugin","slug":"affs","name":"SUMO Affiliates Pro","from":"*","from_inclusive":true,"to":"11.4.0","to_inclusive":false,"patched_in":"11.4.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T20:05:28Z"},{"id":"wordfence:9df45c8e-c040-4031-9c51-4c43d12f08b0","source":"wordfence","cve":"CVE-2021-29447","title":"WordPress Core < 5.7.1 - XXE Injection","severity":"high","cvss":7.1,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df45c8e-c040-4031-9c51-4c43d12f08b0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.20","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.16","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.17","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.12","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.9","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.10","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.7","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.5","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.4","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.3","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.1","to_inclusive":false,"patched_in":"4.7.20"}],"published":"2021-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9df6a2b4-2dc4-43dd-8282-5c05b0fa13f6","source":"wordfence","cve":"CVE-2025-1764","title":"LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df6a2b4-2dc4-43dd-8282-5c05b0fa13f6?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T05:24:02Z"},{"id":"wordfence:9df6d75b-a141-41a8-b965-6be7acee582d","source":"wordfence","cve":"CVE-2023-7228","title":"illi Link Party! <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df6d75b-a141-41a8-b965-6be7acee582d?source=api-prod","affected":[{"type":"plugin","slug":"link-party","name":"illi Link Party!","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:48:07Z"},{"id":"wordfence:9df75a5c-b70b-452e-a280-29a5005fe60b","source":"wordfence","cve":"CVE-2023-36381","title":"Zippy <= 1.6.5 - Authenticated(Author+) PHP Object Injection via unzipPosts","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df75a5c-b70b-452e-a280-29a5005fe60b?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9df7f70f-0374-46b7-a3aa-a84a6aea2f86","source":"wordfence","cve":"CVE-2025-22720","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment plugin for WordPress <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df7f70f-0374-46b7-a3aa-a84a6aea2f86?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-25T15:00:26Z"},{"id":"wordfence:9df827b1-e42f-4957-b59c-f6d6a9d997a8","source":"wordfence","cve":"CVE-2025-31062","title":"Wishlist <= 2.1.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df827b1-e42f-4957-b59c-f6d6a9d997a8?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-04-30T03:17:42Z"},{"id":"wordfence:9df97805-b425-49b1-86c1-e66213dacd2b","source":"wordfence","cve":"CVE-2023-2811","title":"AI ChatBot <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9df97805-b425-49b1-86c1-e66213dacd2b?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dfa4679-79d6-4444-9372-0753509ae93f","source":"wordfence","cve":"CVE-2025-39526","title":"Hotel Booking <= 3.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfa4679-79d6-4444-9372-0753509ae93f?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-25T14:54:25Z"},{"id":"wordfence:9dfc5868-1215-465f-8a4e-3703c18d7dca","source":"wordfence","cve":"CVE-2024-44047","title":"IMPress for IDX Broker <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfc5868-1215-465f-8a4e-3703c18d7dca?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-09-16T00:00:00Z","updated":"2024-10-28T15:58:52Z"},{"id":"wordfence:9dfca4cb-71dc-4b2d-bcf3-0ca9f88f88df","source":"wordfence","cve":"CVE-2023-2996","title":"Jetpack <= 12.1 - Authenticated (Author+) Arbitrary File Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfca4cb-71dc-4b2d-bcf3-0ca9f88f88df?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.0","from_inclusive":true,"to":"10.0","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.1","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.2","from_inclusive":true,"to":"10.2.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.3","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.4","from_inclusive":true,"to":"10.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.5","from_inclusive":true,"to":"10.5.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.6","from_inclusive":true,"to":"10.6.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.7","from_inclusive":true,"to":"10.7","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.8","from_inclusive":true,"to":"10.8","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"10.9","from_inclusive":true,"to":"10.9.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.0","from_inclusive":true,"to":"11.0","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.1","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.2","from_inclusive":true,"to":"11.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.3","from_inclusive":true,"to":"11.3.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.4","from_inclusive":true,"to":"11.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.5","from_inclusive":true,"to":"11.5.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.6","from_inclusive":true,"to":"11.6","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.7","from_inclusive":true,"to":"11.7.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.8","from_inclusive":true,"to":"11.8.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"11.9","from_inclusive":true,"to":"11.9.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.0","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"12.1","from_inclusive":true,"to":"12.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.0","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.1","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.2","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.3","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.4","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.5","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.6","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.7","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.8","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.9","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.0","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.1","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.2","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.3","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.4","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.5","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.6","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.9","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.0","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.1","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.3","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.5","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"4.9","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.0","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.5","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.6","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.8","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"5.9","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.2","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.3","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.4","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.5","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.6","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.7","from_inclusive":true,"to":"6.7.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"6.9","from_inclusive":true,"to":"6.9.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.0","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.1","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.2","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.3","from_inclusive":true,"to":"7.3.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.4","from_inclusive":true,"to":"7.4.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.5","from_inclusive":true,"to":"7.5.5","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.6","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.7","from_inclusive":true,"to":"7.7.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.8","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"7.9","from_inclusive":true,"to":"7.9.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.0","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.1","from_inclusive":true,"to":"8.1.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.2","from_inclusive":true,"to":"8.2.4","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.3","from_inclusive":true,"to":"8.3.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.4","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.5","from_inclusive":true,"to":"8.5.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.6","from_inclusive":true,"to":"8.6.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.7","from_inclusive":true,"to":"8.7.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.8","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"8.9","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.0","from_inclusive":true,"to":"9.0.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.1","from_inclusive":true,"to":"9.1.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.2","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.3","from_inclusive":true,"to":"9.3.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.4","from_inclusive":true,"to":"9.4.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.5","from_inclusive":true,"to":"9.5.3","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.6","from_inclusive":true,"to":"9.6.2","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.7","from_inclusive":true,"to":"9.7.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.8","from_inclusive":true,"to":"9.8.1","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"9.9","from_inclusive":true,"to":"9.9.1","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dfee325-9001-4483-b3eb-846da0314529","source":"wordfence","cve":"CVE-2023-25700","title":"Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfee325-9001-4483-b3eb-846da0314529?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9dffc99e-6dbc-415b-91d1-a85a30168526","source":"wordfence","cve":"CVE-2025-62969","title":"NextMove Lite <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9dffc99e-6dbc-415b-91d1-a85a30168526?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.24.0"}],"published":"2025-10-18T00:00:00Z","updated":"2026-03-17T21:42:33Z"},{"id":"wordfence:9e008a72-c948-48eb-814d-52ec6bc9f8d2","source":"wordfence","cve":"CVE-2025-32186","title":"Turbo Addons for Elementor <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e008a72-c948-48eb-814d-52ec6bc9f8d2?source=api-prod","affected":[{"type":"plugin","slug":"turbo-addons-elementor","name":"Turbo Addons Elementor","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-04-04T00:00:00Z","updated":"2025-07-16T15:26:22Z"},{"id":"wordfence:9e013542-8a8c-440d-9130-61057d97990d","source":"wordfence","cve":"CVE-2019-6029","title":"Custom Body Class <= 0.6.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e013542-8a8c-440d-9130-61057d97990d?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-body-class","name":"Custom Body Class","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":"0.7.0"}],"published":"2019-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e04a2f8-5071-4c85-b4f8-cb914ee509b5","source":"wordfence","cve":"CVE-2023-30490","title":"Easing Slider  <= 3.0.8 - Missing Authorization to Unauthenticated Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e04a2f8-5071-4c85-b4f8-cb914ee509b5?source=api-prod","affected":[{"type":"plugin","slug":"easing-slider","name":"Easing Slider","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e052577-185b-485e-8b7c-a4e7802025c5","source":"wordfence","cve":"CVE-2026-48837","title":"Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e052577-185b-485e-8b7c-a4e7802025c5?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:46:13Z"},{"id":"wordfence:9e0c6f83-f4ca-4891-b2db-e2ac49d96ee5","source":"wordfence","cve":"CVE-2026-16582","title":"Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0c6f83-f4ca-4891-b2db-e2ac49d96ee5?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-09-17T09:08:03Z","updated":"2026-09-17T21:28:49Z"},{"id":"wordfence:9e0cba5b-5833-4c02-ac17-830994b0f207","source":"wordfence","cve":"CVE-2025-2238","title":"Vikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0cba5b-5833-4c02-ac17-830994b0f207?source=api-prod","affected":[{"type":"theme","slug":"vikinger","name":"Vikinger","from":"*","from_inclusive":true,"to":"1.9.30","to_inclusive":true,"patched_in":"1.9.31"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T06:45:28Z"},{"id":"wordfence:9e0d441d-1da5-45e7-8a14-ce178099c0cc","source":"wordfence","cve":"CVE-2025-4796","title":"Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0d441d-1da5-45e7-8a14-ce178099c0cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.34","to_inclusive":true,"patched_in":"4.0.35"}],"published":"2025-08-08T00:00:00Z","updated":"2025-08-08T18:26:26Z"},{"id":"wordfence:9e0e3b81-55fe-46b2-bae1-d7321d74c485","source":"wordfence","cve":"CVE-2025-2252","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e0e3b81-55fe-46b2-bae1-d7321d74c485?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.6.1","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T07:04:55Z"},{"id":"wordfence:9e104e84-5b2c-4111-8950-54030950a790","source":"wordfence","cve":"CVE-2025-31449","title":"The Visitor Counter <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e104e84-5b2c-4111-8950-54030950a790?source=api-prod","affected":[{"type":"plugin","slug":"the-visitor-counter","name":"The Visitor Counter Plugin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:14:39Z"},{"id":"wordfence:9e105e89-3884-465e-8565-2fec7cc894da","source":"wordfence","cve":"CVE-2026-32349","title":"Embed PDF Viewer <= 2.4.7 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e105e89-3884-465e-8565-2fec7cc894da?source=api-prod","affected":[{"type":"plugin","slug":"embed-pdf-viewer","name":"Embed PDF Viewer","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T13:35:49Z"},{"id":"wordfence:9e10e625-c444-487a-b0c3-1730fa727c89","source":"wordfence","cve":"CVE-2024-5807","title":"Business Card <= 1.0.0 - Authenticated (Admin+) Arbitrary File Uplaod","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e10e625-c444-487a-b0c3-1730fa727c89?source=api-prod","affected":[{"type":"plugin","slug":"business-card-by-esterox-100","name":"Business Card","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:50:34Z"},{"id":"wordfence:9e11e1b5-dbba-4920-a65c-210600878861","source":"wordfence","cve":"CVE-2023-31089","title":"Video XML Sitemap Generator <= 1.0.0 - Cross-Site Request Forgery via video_sitemap_generate","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e11e1b5-dbba-4920-a65c-210600878861?source=api-prod","affected":[{"type":"plugin","slug":"video-xml-sitemap-generator","name":"Video XML Sitemap Generator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e13703d-f9cd-47d8-84e1-248bade4f717","source":"wordfence","cve":"CVE-2026-16265","title":"Maps <= 4.9.6 - Authenticated (Subscriber+) Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e13703d-f9cd-47d8-84e1-248bade4f717?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:38:38Z"},{"id":"wordfence:9e1514c8-3752-4d0a-87a3-3f245a7cb914","source":"wordfence","cve":"CVE-2024-2842","title":"Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1514c8-3752-4d0a-87a3-3f245a7cb914?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.11.18","to_inclusive":true,"patched_in":"3.11.19"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T05:35:36Z"},{"id":"wordfence:9e15727a-35c4-42c0-9997-cdcd40ac8e5f","source":"wordfence","cve":"CVE-2022-23975","title":"AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e15727a-35c4-42c0-9997-cdcd40ac8e5f?source=api-prod","affected":[{"type":"theme","slug":"the-monday","name":"The Monday","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"doko","name":"Doko","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.1.0"},{"type":"theme","slug":"eight-sec","name":"Eight Sec","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"revolve","name":"Revolve","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bingle","name":"Bingle","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"parallaxsome","name":"ParallaxSome","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"},{"type":"theme","slug":"uncode-lite","name":"Uncode Lite","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightlaw-lite","name":"EightLaw Lite","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"},{"type":"theme","slug":"accesspress-lite","name":"AccessPress Lite","from":"*","from_inclusive":true,"to":"2.92","to_inclusive":true,"patched_in":"2.93"},{"type":"theme","slug":"fotography","name":"FotoGraphy","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"},{"type":"theme","slug":"arrival","name":"Arrival","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"theme","slug":"vmag","name":"VMag","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"theme","slug":"accesspress-mag","name":"AccessPress Mag","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"},{"type":"theme","slug":"sakala","name":"Sakala","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"vmagazine-lite","name":"VMagazine Lite","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"digital-agency-lite","name":"Digital Agency Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"theme","slug":"the-launcher","name":"The Launcher","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"theme","slug":"zigcy-lite","name":"Zigcy Lite","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"},{"type":"theme","slug":"brovy","name":"Brovy","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"eightmedi-lite","name":"Eightmedi Lite","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"},{"type":"theme","slug":"wpparallax","name":"WPparallax","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"enlighten","name":"Enlighten","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"},{"type":"theme","slug":"eightstore-lite","name":"EightStore Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"accesspress-store","name":"AccessPress Store","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"},{"type":"theme","slug":"swing-lite","name":"Swing Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"ripple","name":"Ripple","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"access-demo-importer","name":"Access Demo Importer","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"punte","name":"Punte","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"},{"type":"theme","slug":"accesspress-basic","name":"Accesspress Basic","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"},{"type":"theme","slug":"zigcy-baby","name":"Zigcy Baby","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"scrollme","name":"ScrollMe","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"zigcy-cosmetics","name":"Zigcy Cosmetics","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"construction-lite","name":"Construction Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"theme","slug":"vmagazine-news","name":"Vmagazine News","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"accesspress-parallax-new","name":"AccessPress Parallax","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"},{"type":"theme","slug":"accesspress-root","name":"AccessPress Root","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6.0"},{"type":"theme","slug":"storevilla","name":"StoreVilla","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"theme","slug":"ultra-seven","name":"Ultra Seven","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"the100","name":"The100","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"edict-lite","name":"Edict Lite","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wp-store","name":"WP Store","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"theme","slug":"opstore","name":"Opstore","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"theme","slug":"bloger","name":"Bloger","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e164966-457f-45a0-acba-4cf12bf08352","source":"wordfence","cve":"CVE-2026-40797","title":"WebinarIgnition < 4.09.86 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e164966-457f-45a0-acba-4cf12bf08352?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"4.09.86","to_inclusive":false,"patched_in":"4.09.86"}],"published":"2026-05-04T00:00:00Z","updated":"2026-06-18T18:25:11Z"},{"id":"wordfence:9e169776-0475-45b8-8e8f-ac98cee558a3","source":"wordfence","cve":"CVE-2025-49992","title":"LearnPress Export Import <= 4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e169776-0475-45b8-8e8f-ac98cee558a3?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-07-22T00:00:00Z","updated":"2026-02-26T15:30:17Z"},{"id":"wordfence:9e1a2de1-f153-40fb-81b6-4b7c1c374839","source":"wordfence","cve":"CVE-2025-28943","title":"DP ALTerminator - Missing ALT manager <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1a2de1-f153-40fb-81b6-4b7c1c374839?source=api-prod","affected":[{"type":"plugin","slug":"dp-alterminator-missing-alt-manager","name":"DP ALTerminator \u2013 Missing ALT manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:59:05Z"},{"id":"wordfence:9e1ae8f2-dd2e-46f9-bef1-aaaee26435a1","source":"wordfence","cve":"CVE-2024-5578","title":"Table of Contents Plus <= 2411 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1ae8f2-dd2e-46f9-bef1-aaaee26435a1?source=api-prod","affected":[{"type":"plugin","slug":"table-of-contents-plus","name":"Table of Contents Plus \u2013 Automatic Table of Contents for Posts & Pages","from":"*","from_inclusive":true,"to":"2411","to_inclusive":true,"patched_in":"2411.1"}],"published":"2024-10-15T00:00:00Z","updated":"2026-09-04T17:35:40Z"},{"id":"wordfence:9e1f94d9-8be6-4174-90a5-820c0207a2fa","source":"wordfence","cve":"CVE-2023-6876","title":"Clever Fox \u2013 One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1f94d9-8be6-4174-90a5-820c0207a2fa?source=api-prod","affected":[{"type":"plugin","slug":"clever-fox","name":"Clever Fox","from":"*","from_inclusive":true,"to":"25.2.0","to_inclusive":true,"patched_in":"25.2.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-07-29T21:36:58Z"},{"id":"wordfence:9e1fa691-3934-4e15-b339-e679976d6d5c","source":"wordfence","cve":"CVE-2021-24843","title":"SupportCandy <= 2.2.6 - Cross-Site Request Forgery to Arbitrary Ticket Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e1fa691-3934-4e15-b339-e679976d6d5c?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e20afee-9336-458e-ab5c-b320c6887b83","source":"wordfence","cve":"CVE-2024-31116","title":"10Web Map Builder for Google Maps <= 1.0.74 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e20afee-9336-458e-ab5c-b320c6887b83?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.74","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T01:03:48Z"},{"id":"wordfence:9e21d279-aa83-42ff-9906-bc61dc4aba52","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 2.00 - Arbitrary File Modification","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e21d279-aa83-42ff-9906-bc61dc4aba52?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.00","to_inclusive":true,"patched_in":"2.10"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e2214d8-b22d-4e51-a0cf-cca1af8e761c","source":"wordfence","cve":"","title":"Responsive Starter Templates \u2013 Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2214d8-b22d-4e51-a0cf-cca1af8e761c?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e2543be-e84f-424f-92cc-3a5d7e0a33b9","source":"wordfence","cve":"CVE-2024-51639","title":"Naver Blog <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2543be-e84f-424f-92cc-3a5d7e0a33b9?source=api-prod","affected":[{"type":"plugin","slug":"naver-blog-api","name":"Naver Blog","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:52:02Z"},{"id":"wordfence:9e283a5a-98b7-464e-9426-cb414f3e3abf","source":"wordfence","cve":"CVE-2015-9295","title":"Contact Form by BestWebSoft <= 3.95 - ReflectedCross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e283a5a-98b7-464e-9426-cb414f3e3abf?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.96","to_inclusive":false,"patched_in":"3.96"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e29b833-6af3-4240-8ce1-6ea2a0d3bad9","source":"wordfence","cve":"CVE-2026-22343","title":"Dating <= 11.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e29b833-6af3-4240-8ce1-6ea2a0d3bad9?source=api-prod","affected":[{"type":"theme","slug":"DA10","name":"Dating","from":"*","from_inclusive":true,"to":"11.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:49:29Z"},{"id":"wordfence:9e2afd66-c896-47c8-bf56-84a086087d55","source":"wordfence","cve":"CVE-2025-3302","title":"Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2afd66-c896-47c8-bf56-84a086087d55?source=api-prod","affected":[{"type":"plugin","slug":"xagio-seo","name":"Xagio SEO & AEO \u2013 AI SEO for Google Rankings & AI Visibility","from":"*","from_inclusive":true,"to":"7.1.0.16","to_inclusive":true,"patched_in":"7.1.0.17"}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-11T11:18:39Z"},{"id":"wordfence:9e2cc3b5-8eb7-42ef-be25-f778560b6e58","source":"wordfence","cve":"CVE-2026-65483","title":"HashThemes Demo Importer <= 1.4.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2cc3b5-8eb7-42ef-be25-f778560b6e58?source=api-prod","affected":[{"type":"plugin","slug":"hashthemes-demo-importer","name":"HashThemes Demo Importer","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:20:53Z"},{"id":"wordfence:9e2ed2b1-487b-4178-9bfa-4dfd2777b625","source":"wordfence","cve":"CVE-2026-18366","title":"Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2ed2b1-487b-4178-9bfa-4dfd2777b625?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:48:42Z"},{"id":"wordfence:9e345e3a-a3d4-4533-b8bb-90795f991cbc","source":"wordfence","cve":"CVE-2022-3604","title":"Contact Form Entries <= 1.2.9 - CSV Injection","severity":"high","cvss":7.2,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e345e3a-a3d4-4533-b8bb-90795f991cbc?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e34b3df-ac18-4409-b8fe-b27c931f3aa3","source":"wordfence","cve":"CVE-2024-12515","title":"Muslim Prayer Time-Salah/Iqamah <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34b3df-ac18-4409-b8fe-b27c931f3aa3?source=api-prod","affected":[{"type":"plugin","slug":"masjidal","name":"Muslim Prayer Time-Salah/Iqamah","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2025-01-08T22:01:17Z","updated":"2025-03-13T20:00:04Z"},{"id":"wordfence:9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd","source":"wordfence","cve":"CVE-2019-25145","title":"Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=api-prod","affected":[{"type":"plugin","slug":"pirate-forms","name":"Contact Form & SMTP Plugin for WordPress by PirateForms","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e37c664-76ed-4ede-88fd-e41b9969685f","source":"wordfence","cve":"CVE-2025-8562","title":"Custom Query Shortcode <= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e37c664-76ed-4ede-88fd-e41b9969685f?source=api-prod","affected":[{"type":"plugin","slug":"custom-query-shortcode","name":"Custom Query Shortcode","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":"0.5.0"}],"published":"2025-08-24T21:19:23Z","updated":"2025-08-25T09:23:52Z"},{"id":"wordfence:9e3899d8-170e-481f-8c80-90addc66eb41","source":"wordfence","cve":"CVE-2022-46864","title":"Woocommerce Custom Checkout Fields Editor With Drag & Drop <= 0.1 - Reflected Cross-Site Scripting via 'tab'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3899d8-170e-481f-8c80-90addc66eb41?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-checkout-fields","name":"Woocommerce Custom Checkout Fields Editor With Drag & Drop","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e394bb2-d505-4bf1-b672-fea3504bf936","source":"wordfence","cve":"CVE-2024-8519","title":"Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e394bb2-d505-4bf1-b672-fea3504bf936?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:32:23Z"},{"id":"wordfence:9e3a118f-4321-4579-a986-05ce077dc6b9","source":"wordfence","cve":"CVE-2025-5927","title":"Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3a118f-4321-4579-a986-05ce077dc6b9?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms-pro","name":"Everest Forms Pro","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2025-06-24T20:22:24Z","updated":"2025-06-25T09:21:47Z"},{"id":"wordfence:9e3ab274-73ea-4486-960a-de97267e9658","source":"wordfence","cve":"CVE-2026-113584","title":"Real Estate Website Builder <= 1.4.3 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3ab274-73ea-4486-960a-de97267e9658?source=api-prod","affected":[{"type":"plugin","slug":"placester","name":"placester","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:15:15Z"},{"id":"wordfence:9e3e009d-85bc-4ed3-a298-fa1484cb4694","source":"wordfence","cve":"CVE-2025-53575","title":"Primer MyData for Woocommerce <= 4.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3e009d-85bc-4ed3-a298-fa1484cb4694?source=api-prod","affected":[{"type":"plugin","slug":"primer-mydata","name":"Primer MyData for Woocommerce","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:34:49Z"},{"id":"wordfence:9e3e698e-0f98-43ca-b4c1-d45fe3c9b284","source":"wordfence","cve":"CVE-2025-22531","title":"Urdu Formatter \u2013 Shamil <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3e698e-0f98-43ca-b4c1-d45fe3c9b284?source=api-prod","affected":[{"type":"plugin","slug":"urdu-formatter-shamil","name":"Urdu Formatter \u2013 Shamil","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:47:38Z"},{"id":"wordfence:9e3e996b-6988-42ab-9766-ddc070243c1f","source":"wordfence","cve":"CVE-2022-2355","title":"Easy Username Updater <= 1.0.3 - Cross-Site Request Forgery to Username Change","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3e996b-6988-42ab-9766-ddc070243c1f?source=api-prod","affected":[{"type":"plugin","slug":"username-updater","name":"Easy Username Updater","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e3f199b-b75d-43a2-a20c-957fb1b512e1","source":"wordfence","cve":"CVE-2022-1765","title":"Hot Linked Image Cacher <= 1.16 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e3f199b-b75d-43a2-a20c-957fb1b512e1?source=api-prod","affected":[{"type":"plugin","slug":"hot-linked-image-cacher","name":"Hot Linked Image Cacher","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e42e279-1017-4ffb-a9e4-198e55718d97","source":"wordfence","cve":"CVE-2026-80517","title":"Ultimate CSV Importer 7.17 - 9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e42e279-1017-4ffb-a9e4-198e55718d97?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"7.17","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:22:02Z"},{"id":"wordfence:9e43cf06-8356-40cd-a0d8-b9f7ab95d793","source":"wordfence","cve":"CVE-2016-10948","title":"Post Indexer <= 3.0.6.1 - PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e43cf06-8356-40cd-a0d8-b9f7ab95d793?source=api-prod","affected":[{"type":"plugin","slug":"post-indexer","name":"Post Indexer","from":"*","from_inclusive":true,"to":"3.0.6.2","to_inclusive":false,"patched_in":"3.0.6.2"}],"published":"2016-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e44d85d-6bde-4194-8f33-5db6dacf544c","source":"wordfence","cve":"CVE-2024-47635","title":"TinyPNG <= 3.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e44d85d-6bde-4194-8f33-5db6dacf544c?source=api-prod","affected":[{"type":"plugin","slug":"tiny-compress-images","name":"TinyPNG Image Optimization \u2013 Image Compression JPEG & PNG | Convert to WebP & AVIF","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:16:28Z"},{"id":"wordfence:9e45feb6-5ffa-4ad3-9549-4414988f040e","source":"wordfence","cve":"CVE-2025-10303","title":"Library Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e45feb6-5ffa-4ad3-9549-4414988f040e?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-10-14T19:59:53Z","updated":"2025-10-23T20:16:07Z"},{"id":"wordfence:9e465c41-97fa-4a7f-ac84-d270d1721940","source":"wordfence","cve":"CVE-2026-28125","title":"Midi - Sound & Music WordPress Theme <= 1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e465c41-97fa-4a7f-ac84-d270d1721940?source=api-prod","affected":[{"type":"theme","slug":"midi","name":"Midi - Sound & Music WordPress Theme","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:34:34Z"},{"id":"wordfence:9e47a2d3-ab79-417d-b36b-2f8a8c515bc3","source":"wordfence","cve":"CVE-2021-24433","title":"Simple Sort&Search <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e47a2d3-ab79-417d-b36b-2f8a8c515bc3?source=api-prod","affected":[{"type":"plugin","slug":"simple-sortsearch","name":"simple sort&search","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2021-06-21T00:00:00Z","updated":"2024-02-06T15:59:41Z"},{"id":"wordfence:9e4a0d10-c798-4bff-9cfe-c9bc6201950e","source":"wordfence","cve":"CVE-2026-57802","title":"Struktur - Creative Agency WordPress Theme <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4a0d10-c798-4bff-9cfe-c9bc6201950e?source=api-prod","affected":[{"type":"theme","slug":"struktur","name":"Struktur - Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:34:52Z"},{"id":"wordfence:9e4a1671-56aa-4003-bed7-b793d14522d7","source":"wordfence","cve":"CVE-2025-66063","title":"Google Review Slider <= 17.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4a1671-56aa-4003-bed7-b793d14522d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"17.4","to_inclusive":true,"patched_in":"17.6"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-25T15:39:44Z"},{"id":"wordfence:9e4a2ba2-16e3-473e-a5fc-6a6437eae55e","source":"wordfence","cve":"CVE-2026-59526","title":"MapSVG <= 8.14.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4a2ba2-16e3-473e-a5fc-6a6437eae55e?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:09:52Z"},{"id":"wordfence:9e4cff1c-6a01-4725-9e37-f48b5de16d9b","source":"wordfence","cve":"CVE-2026-15951","title":"Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4cff1c-6a01-4725-9e37-f48b5de16d9b?source=api-prod","affected":[{"type":"plugin","slug":"icegram-mailer","name":"Icegram Mailer \u2013 Reliable Email Deliverability, No-Code SMTP Replacement & Email Logs for WordPress","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2026-07-31T19:33:07Z","updated":"2026-08-01T07:49:50Z"},{"id":"wordfence:9e4d84ad-ab02-45b1-aecb-dc2c08c097fe","source":"wordfence","cve":"CVE-2022-3915","title":"Dokan <= 3.7.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e4d84ad-ab02-45b1-aecb-dc2c08c097fe?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e51c8b5-cbb9-48aa-9c99-69f1b39fb0b4","source":"wordfence","cve":"CVE-2024-12024","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e51c8b5-cbb9-48aa-9c99-69f1b39fb0b4?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.7.3","to_inclusive":true,"patched_in":"4.0.7.4"}],"published":"2024-12-16T20:40:44Z","updated":"2025-03-06T12:16:08Z"},{"id":"wordfence:9e56e1fe-bb53-422c-9219-b79e24f0f915","source":"wordfence","cve":"CVE-2016-10940","title":"ZM Gallery <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e56e1fe-bb53-422c-9219-b79e24f0f915?source=api-prod","affected":[{"type":"plugin","slug":"zm-gallery","name":"ZM Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e57a85b-3ea8-46df-ab60-ce835268b1f6","source":"wordfence","cve":"CVE-2025-0350","title":"Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e57a85b-3ea8-46df-ab60-ce835268b1f6?source=api-prod","affected":[{"type":"plugin","slug":"wow-carousel-for-divi-lite","name":"Divi Carousel Lite \u2013 Make Carousels for Divi 5","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-01-24T20:40:22Z","updated":"2025-01-25T09:22:46Z"},{"id":"wordfence:9e5a3d9a-8114-450a-b101-3cd5a7b694e1","source":"wordfence","cve":"CVE-2026-104739","title":"JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e5a3d9a-8114-450a-b101-3cd5a7b694e1?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-10-30T16:05:12Z","updated":"2026-10-30T17:15:28Z"},{"id":"wordfence:9e5a6158-03d4-4ac7-8a4b-666cedabb433","source":"wordfence","cve":"CVE-2025-11265","title":"VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e5a6158-03d4-4ac7-8a4b-666cedabb433?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.112.1","to_inclusive":true,"patched_in":"9.112.2"}],"published":"2025-11-17T19:13:14Z","updated":"2025-11-18T07:30:38Z"},{"id":"wordfence:9e60428e-1641-470f-a6f1-7c2b4140a6bf","source":"wordfence","cve":"CVE-2022-27851","title":"Use Any Font <= 6.1.7 - Cross-Site Request Forgery to API Key Deactivation","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e60428e-1641-470f-a6f1-7c2b4140a6bf?source=api-prod","affected":[{"type":"plugin","slug":"use-any-font","name":"Use Any Font | Custom Font Uploader","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2022-03-30T11:53:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e6365ab-30c5-4bec-a5f3-b0812ae8a609","source":"wordfence","cve":"CVE-2022-1625","title":"New User Approve <= 2.4 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6365ab-30c5-4bec-a5f3-b0812ae8a609?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e63fb84-a16b-447f-be73-e01f30881445","source":"wordfence","cve":"CVE-2024-2871","title":"Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e63fb84-a16b-447f-be73-e01f30881445?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":true,"patched_in":"3.14"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:59:08Z"},{"id":"wordfence:9e6434fb-390d-439d-bf3e-9afe8644fd58","source":"wordfence","cve":"CVE-2024-9462","title":"Poll Maker \u2013 Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6434fb-390d-439d-bf3e-9afe8644fd58?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2024-10-25T11:53:39Z","updated":"2024-10-26T01:58:37Z"},{"id":"wordfence:9e661d3c-8acf-48c2-9e54-6913c65a46aa","source":"wordfence","cve":"CVE-2024-35768","title":"Page Builder: Live Composer <= 1.5.47 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e661d3c-8acf-48c2-9e54-6913c65a46aa?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.47","to_inclusive":true,"patched_in":"1.5.48"}],"published":"2024-06-18T00:00:00Z","updated":"2024-08-22T23:13:07Z"},{"id":"wordfence:9e6837ad-576f-4c25-9540-6144ddc8630e","source":"wordfence","cve":"CVE-2026-2582","title":"Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6837ad-576f-4c25-9540-6144ddc8630e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-germanized","name":"Germanized for WooCommerce","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":"3.20.6"}],"published":"2026-04-13T17:42:17Z","updated":"2026-04-14T06:43:52Z"},{"id":"wordfence:9e693751-24eb-469c-956a-750e8f82d717","source":"wordfence","cve":"CVE-2025-30591","title":"Music Press Pro <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e693751-24eb-469c-956a-750e8f82d717?source=api-prod","affected":[{"type":"plugin","slug":"music-press-pro","name":"Music Press Pro","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:10:08Z"},{"id":"wordfence:9e6a1af3-d53c-4e23-95d2-3b799bc10827","source":"wordfence","cve":"CVE-2022-3463","title":"Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6a1af3-d53c-4e23-95d2-3b799bc10827?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"4.3.12","to_inclusive":true,"patched_in":"4.3.13"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e6abc4e-7f21-47ac-95ff-b6d997c70e23","source":"wordfence","cve":"CVE-2026-19573","title":"Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via \u2018doCommentShortcode\u2019 function","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6abc4e-7f21-47ac-95ff-b6d997c70e23?source=api-prod","affected":[{"type":"plugin","slug":"amazonsimpleadmin","name":"Affiliate Super Assistent","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-08-31T15:58:47Z","updated":"2026-09-01T04:27:52Z"},{"id":"wordfence:9e6b58b5-6c47-4a83-84be-6c000a218446","source":"wordfence","cve":"CVE-2025-9697","title":"Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6b58b5-6c47-4a83-84be-6c000a218446?source=api-prod","affected":[{"type":"plugin","slug":"ajax-woosearch","name":"Ajax WooSearch","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T00:00:00Z","updated":"2025-10-16T15:13:34Z"},{"id":"wordfence:9e6eec31-0603-40ab-9ed1-eedb163de1d6","source":"wordfence","cve":"CVE-2024-7817","title":"Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Album Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6eec31-0603-40ab-9ed1-eedb163de1d6?source=api-prod","affected":[{"type":"plugin","slug":"misiek-photo-album","name":"Misiek Photo Album","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:27:08Z"},{"id":"wordfence:9e77c433-ed79-4f43-a2b0-9bfee895d4b6","source":"wordfence","cve":"CVE-2026-66676","title":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments <= 2.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e77c433-ed79-4f43-a2b0-9bfee895d4b6?source=api-prod","affected":[{"type":"plugin","slug":"easy-invoice","name":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-09-16T18:18:00Z","updated":"2026-09-22T18:33:28Z"},{"id":"wordfence:9e7a1116-2bf1-4d36-a091-e0d4a9d6e1c9","source":"wordfence","cve":"","title":"InfiniteWP Client <= 1.3.7 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e7a1116-2bf1-4d36-a091-e0d4a9d6e1c9?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2014-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e7e3763-4606-4fc4-aa0f-b67e6087bdc2","source":"wordfence","cve":"CVE-2026-4659","title":"Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e7e3763-4606-4fc4-aa0f-b67e6087bdc2?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2026-04-16T17:54:33Z","updated":"2026-04-24T14:07:17Z"},{"id":"wordfence:9e7f858c-945c-4d12-a2a6-113449ad890a","source":"wordfence","cve":"CVE-2024-9642","title":"Editor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e7f858c-945c-4d12-a2a6-113449ad890a?source=api-prod","affected":[{"type":"plugin","slug":"editor-custom-color-palette","name":"Editor Custom Color Palette","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2024-10-25T20:08:26Z","updated":"2024-11-01T20:47:33Z"},{"id":"wordfence:9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.1","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"16.1.3"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-15T20:43:38Z"},{"id":"wordfence:9e8346a4-4077-469f-9182-d6cf12f60776","source":"wordfence","cve":"CVE-2025-53296","title":"EC Stars Rating <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e8346a4-4077-469f-9182-d6cf12f60776?source=api-prod","affected":[{"type":"plugin","slug":"ec-stars-rating","name":"EC Stars Rating","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:34:10Z"},{"id":"wordfence:9e860c60-b330-4a6c-8d15-947451af62fc","source":"wordfence","cve":"CVE-2024-56226","title":"Royal Elementor Addons <= 1.7.1001 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e860c60-b330-4a6c-8d15-947451af62fc?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1001","to_inclusive":true,"patched_in":"1.7.1002"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:12:48Z"},{"id":"wordfence:9e87d556-6282-48f0-acd2-15540345da97","source":"wordfence","cve":"CVE-2026-102797","title":"ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e87d556-6282-48f0-acd2-15540345da97?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.46.0","to_inclusive":true,"patched_in":"2.47.0"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T12:53:22Z"},{"id":"wordfence:9e89ecbd-77f9-43bb-b057-1dfb704446af","source":"wordfence","cve":"CVE-2025-31051","title":"Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e89ecbd-77f9-43bb-b057-1dfb704446af?source=api-prod","affected":[{"type":"theme","slug":"plant","name":"Plant | Gardening & Houseplants WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:27:30Z"},{"id":"wordfence:9e8e239a-0ddf-479e-b94b-7844ff6e9e81","source":"wordfence","cve":"CVE-2025-12536","title":"SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e8e239a-0ddf-479e-b94b-7844ff6e9e81?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2025-11-12T15:01:21Z","updated":"2026-05-05T13:36:48Z"},{"id":"wordfence:9e8eb7e0-7724-4563-851a-87cd79b7d48f","source":"wordfence","cve":"CVE-2026-93930","title":"Tantra | Yoga Studio and Fitness Club WordPress Theme <= 2.9.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e8eb7e0-7724-4563-851a-87cd79b7d48f?source=api-prod","affected":[{"type":"theme","slug":"tantra","name":"Tantra | Yoga Studio and Fitness Club WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:46:03Z","updated":"2026-10-13T14:25:58Z"},{"id":"wordfence:9e925592-cabe-4384-a179-a24ca2b6bddf","source":"wordfence","cve":"CVE-2026-105976","title":"Portfolio Filter Gallery <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e925592-cabe-4384-a179-a24ca2b6bddf?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-filter-gallery","name":"Portfolio Filter Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:56:15Z"},{"id":"wordfence:9e932f7a-7012-499c-922f-29ed567d4bc4","source":"wordfence","cve":"CVE-2025-47590","title":"WPSpeed <= 2.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e932f7a-7012-499c-922f-29ed567d4bc4?source=api-prod","affected":[{"type":"plugin","slug":"wpspeed","name":"WPSpeed \u2013 WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100)","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2025-05-07T00:00:00Z","updated":"2025-07-01T13:42:51Z"},{"id":"wordfence:9e972356-e0bc-4902-9d3c-81a534bc8e19","source":"wordfence","cve":"CVE-2026-13694","title":"Bit Form <= 3.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e972356-e0bc-4902-9d3c-81a534bc8e19?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-29T23:16:35Z"},{"id":"wordfence:9e9823e6-bcd4-4c1e-bf86-caf472748b12","source":"wordfence","cve":"CVE-2021-24282","title":"Redirection for Contact Form 7 <= 2.3.3 - Unprotected AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9823e6-bcd4-4c1e-bf86-caf472748b12?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e991342-b0d1-486c-a24d-e4d3f2be9b91","source":"wordfence","cve":"CVE-2025-39507","title":"Nasa Core < 6.4.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e991342-b0d1-486c-a24d-e4d3f2be9b91?source=api-prod","affected":[{"type":"plugin","slug":"nasa-core","name":"Nasa Core","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":false,"patched_in":"6.4.4"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:08:38Z"},{"id":"wordfence:9e9a5b7e-db74-4c66-a659-85b2509fded4","source":"wordfence","cve":"CVE-2024-10537","title":"WP User Manager \u2013 User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9a5b7e-db74-4c66-a659-85b2509fded4?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":true,"patched_in":"2.9.12"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:9e9a8383-7044-484d-8e4a-e9e4171da385","source":"wordfence","cve":"","title":"Prolisting - Directory Listing <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9a8383-7044-484d-8e4a-e9e4171da385?source=api-prod","affected":[{"type":"theme","slug":"prolist","name":"Prolisting - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.27"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e9c03af-4d4d-4de6-97a7-416ce22ab2aa","source":"wordfence","cve":"CVE-2026-27366","title":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9c03af-4d4d-4de6-97a7-416ce22ab2aa?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-29T19:07:36Z"},{"id":"wordfence:9e9c2893-8156-4f85-962f-d6974fbb960a","source":"wordfence","cve":"CVE-2026-116849","title":"StreamCast \u2013 bring live radio to your site with a sleek player <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9c2893-8156-4f85-962f-d6974fbb960a?source=api-prod","affected":[{"type":"plugin","slug":"streamcast","name":"StreamCast \u2013 bring live radio to your site with a sleek player","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-10-29T14:25:00Z","updated":"2026-11-03T19:33:10Z"},{"id":"wordfence:9e9cfb9b-6951-4246-9cd6-dd64fee3a1bc","source":"wordfence","cve":"CVE-2026-6456","title":"Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9cfb9b-6951-4246-9cd6-dd64fee3a1bc?source=api-prod","affected":[{"type":"plugin","slug":"account-switcher","name":"Account Switcher","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:05:45Z","updated":"2026-05-20T01:25:51Z"},{"id":"wordfence:9e9d876d-1dd2-4090-9ccf-ed00c3286050","source":"wordfence","cve":"CVE-2026-8386","title":"Go Maps <= 10.0.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9d876d-1dd2-4090-9ccf-ed00c3286050?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.0.9","to_inclusive":true,"patched_in":"10.0.10"}],"published":"2026-05-25T00:00:00Z","updated":"2026-08-21T14:11:52Z"},{"id":"wordfence:9e9e0214-b88e-4125-8c10-850ca736e920","source":"wordfence","cve":"CVE-2024-2956","title":"Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9e0214-b88e-4125-8c10-850ca736e920?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20231101","to_inclusive":true,"patched_in":"20240216"}],"published":"2024-03-26T00:00:00Z","updated":"2026-02-25T18:23:57Z"},{"id":"wordfence:9e9e4d07-d78f-4bb9-ac7a-286115ed6c34","source":"wordfence","cve":"CVE-2026-10526","title":"EmbedPress <= 4.6.0 - Unauthenticated Blind Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9e4d07-d78f-4bb9-ac7a-286115ed6c34?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-17T15:51:53Z"},{"id":"wordfence:9e9ef3dd-9055-4f9f-b3af-6bf34c06292a","source":"wordfence","cve":"CVE-2022-0953","title":"Anti-Malware Security and Brute-Force Firewall <= 4.20.95 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9ef3dd-9055-4f9f-b3af-6bf34c06292a?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.20.96","to_inclusive":false,"patched_in":"4.20.96"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9e9fcaf5-d531-4b14-b8b1-d8090243cf0c","source":"wordfence","cve":"CVE-2021-24686","title":"SVG Support <= 2.3.19 Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9fcaf5-d531-4b14-b8b1-d8090243cf0c?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.3.19","to_inclusive":true,"patched_in":"2.3.20"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ea21bf9-9e2a-45d1-8cb7-db821ca13e70","source":"wordfence","cve":"CVE-2024-3410","title":"DN Footer Contacts <= 1.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea21bf9-9e2a-45d1-8cb7-db821ca13e70?source=api-prod","affected":[{"type":"plugin","slug":"dn-footer-contacts","name":"Footer Contacts D","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-01T14:00:49Z"},{"id":"wordfence:9ea2964f-9e3a-450b-9724-5a520c73d306","source":"wordfence","cve":"","title":"AMP for WP <= 0.9.97.19 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea2964f-9e3a-450b-9724-5a520c73d306?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"0.9.97.19","to_inclusive":true,"patched_in":"0.9.97.20"}],"published":"2018-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ea2dfc5-0dcc-4ea1-9ade-d59021e078fa","source":"wordfence","cve":"CVE-2025-13110","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea2dfc5-0dcc-4ea1-9ade-d59021e078fa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.7.3","to_inclusive":true,"patched_in":"1.3.7.4"}],"published":"2025-12-17T23:25:18Z","updated":"2025-12-18T12:22:30Z"},{"id":"wordfence:9ea32791-edd3-4495-893e-668f42dcf5e9","source":"wordfence","cve":"CVE-2014-4558","title":"SwipeHQ Payment Gateway WooCommerce <= 2.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea32791-edd3-4495-893e-668f42dcf5e9?source=api-prod","affected":[{"type":"plugin","slug":"swipehq-payment-gateway-woocommerce","name":"swipehq-payment-gateway-woocommerce","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ea42fbc-ec08-4f67-90d0-506fc474a4a6","source":"wordfence","cve":"CVE-2022-3335","title":"Kadence WooCommerce Email Designer <= 1.5.6 - PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea42fbc-ec08-4f67-90d0-506fc474a4a6?source=api-prod","affected":[{"type":"plugin","slug":"kadence-woocommerce-email-designer","name":"Kadence WooCommerce Email Designer","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ea49a07-022e-4c9a-b1d3-ff900b337067","source":"wordfence","cve":"CVE-2024-32435","title":"AffiEasy <= 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea49a07-022e-4c9a-b1d3-ff900b337067?source=api-prod","affected":[{"type":"plugin","slug":"affieasy","name":"AffiEasy","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:58:05Z"},{"id":"wordfence:9ea7ccb0-c0fb-4ef3-8041-9bf5abe36e3f","source":"wordfence","cve":"CVE-2023-52223","title":"MailerLite \u2013 WooCommerce integration <= 2.0.8 - Cross-Site Request Forgery via Multiple AJAX Functions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ea7ccb0-c0fb-4ef3-8041-9bf5abe36e3f?source=api-prod","affected":[{"type":"plugin","slug":"woo-mailerlite","name":"MailerLite \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9eaa2a20-c436-44a2-9b17-75a3c96025bb","source":"wordfence","cve":"CVE-2026-28089","title":"Daiquiri <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eaa2a20-c436-44a2-9b17-75a3c96025bb?source=api-prod","affected":[{"type":"theme","slug":"daiquiri","name":"Daiquiri","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:01:28Z"},{"id":"wordfence:9eacc280-c254-487b-9ec7-c1e8cbb5bd4d","source":"wordfence","cve":"CVE-2026-57788","title":"Aalto <= 1.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eacc280-c254-487b-9ec7-c1e8cbb5bd4d?source=api-prod","affected":[{"type":"theme","slug":"aalto","name":"Aalto - Architecture and Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:00:08Z"},{"id":"wordfence:9eb14563-7aa6-4703-96ef-95708f08beff","source":"wordfence","cve":"CVE-2017-18554","title":"Analytics Tracker <= 1.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb14563-7aa6-4703-96ef-95708f08beff?source=api-prod","affected":[{"type":"plugin","slug":"analytics-tracker","name":"Analytics Tracker","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2017-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9eb1c2b3-527c-45b6-a1bd-dc9c553b8aa8","source":"wordfence","cve":"CVE-2025-31627","title":"Media Library Assistant <= 3.24 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb1c2b3-527c-45b6-a1bd-dc9c553b8aa8?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.24","to_inclusive":true,"patched_in":"3.25"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:45:53Z"},{"id":"wordfence:9eb34cb2-ebf8-4913-b8e0-152a436963ee","source":"wordfence","cve":"CVE-2022-3982","title":"Booking calendar, Appointment Booking System <= 3.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb34cb2-ebf8-4913-b8e0-152a436963ee?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9eb7fc3a-6575-42ed-9304-d8ce02a849c2","source":"wordfence","cve":"CVE-2025-31800","title":"Publitio <= 2.2.1 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb7fc3a-6575-42ed-9304-d8ce02a849c2?source=api-prod","affected":[{"type":"plugin","slug":"publitio","name":"Publitio","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-04-03T00:00:00Z","updated":"2025-09-11T14:45:46Z"},{"id":"wordfence:9eb829f2-c05f-4f81-85d0-2429fb515d33","source":"wordfence","cve":"CVE-2018-5662","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via counter_title parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb829f2-c05f-4f81-85d0-2429fb515d33?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9eb835fd-6ebf-4162-856c-0366b663a07e","source":"wordfence","cve":"CVE-2020-36847","title":"Simple File List < 4.2.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eb835fd-6ebf-4162-856c-0366b663a07e?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2020-11-02T00:00:00Z","updated":"2025-07-12T09:24:28Z"},{"id":"wordfence:9ebaed4f-b06f-4918-a909-3a9fc5169806","source":"wordfence","cve":"CVE-2026-119472","title":"Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ebaed4f-b06f-4918-a909-3a9fc5169806?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-11-04T07:31:41Z","updated":"2026-11-10T19:26:01Z"},{"id":"wordfence:9ebc263e-ff60-4e6f-8d93-02d99583447d","source":"wordfence","cve":"CVE-2025-23652","title":"Add custom content after post <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ebc263e-ff60-4e6f-8d93-02d99583447d?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-content-after-post","name":"Add custom content after post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:25:50Z"},{"id":"wordfence:9ebd4586-bddc-4669-957b-2bab7a35adee","source":"wordfence","cve":"CVE-2025-63052","title":"SimpLy Gallery <= 3.3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ebd4586-bddc-4669-957b-2bab7a35adee?source=api-prod","affected":[{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.3.2.1","to_inclusive":true,"patched_in":"3.3.2.2"}],"published":"2025-10-26T00:00:00Z","updated":"2026-03-06T18:19:14Z"},{"id":"wordfence:9ebeba9e-bda9-4cdd-bb59-fd7265f49c50","source":"wordfence","cve":"CVE-2025-67594","title":"Thim Elementor Kit <= 1.3.3 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ebeba9e-bda9-4cdd-bb59-fd7265f49c50?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:59:16Z"},{"id":"wordfence:9ec17c72-6426-4e7e-840d-f8c050a25460","source":"wordfence","cve":"CVE-2026-32524","title":"Photo Engine (Media Organizer & Lightroom) <= 6.4.9 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec17c72-6426-4e7e-840d-f8c050a25460?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.4.9","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:06:26Z"},{"id":"wordfence:9ec1aed2-d299-4fa9-add6-10b63ed6aa30","source":"wordfence","cve":"CVE-2024-1770","title":"Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1aed2-d299-4fa9-add6-10b63ed6aa30?source=api-prod","affected":[{"type":"plugin","slug":"meta-tag-manager","name":"Meta Tag Manager","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-03-27T00:00:00Z","updated":"2024-03-28T02:04:10Z"},{"id":"wordfence:9ec1d3e0-eb30-4f46-b533-f57fd9a8510f","source":"wordfence","cve":"CVE-2025-27324","title":"17TRACK for WooCommerce <= 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1d3e0-eb30-4f46-b533-f57fd9a8510f?source=api-prod","affected":[{"type":"plugin","slug":"17track","name":"17TRACK for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:29:39Z"},{"id":"wordfence:9ec307de-600c-4fb2-b474-db9b674d4ead","source":"wordfence","cve":"CVE-2026-2280","title":"rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec307de-600c-4fb2-b474-db9b674d4ead?source=api-prod","affected":[{"type":"plugin","slug":"rexcrawler","name":"rexCrawler","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T20:44:31Z","updated":"2026-05-27T09:27:30Z"},{"id":"wordfence:9ec4bd64-f13f-4e13-9829-8ccf2b8fd196","source":"wordfence","cve":"CVE-2022-4828","title":"Bold Timeline Lite <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec4bd64-f13f-4e13-9829-8ccf2b8fd196?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ec52096-27c8-4c42-bc89-4aef8239ec6e","source":"wordfence","cve":"CVE-2025-22359","title":"SyncFields < 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec52096-27c8-4c42-bc89-4aef8239ec6e?source=api-prod","affected":[{"type":"plugin","slug":"syncfields","name":"SyncFields","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1"}],"published":"2025-01-03T00:00:00Z","updated":"2026-06-08T16:11:50Z"},{"id":"wordfence:9ec72ac5-1851-4074-bea4-ccfd684b9c8d","source":"wordfence","cve":"CVE-2025-15508","title":"Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec72ac5-1851-4074-bea4-ccfd684b9c8d?source=api-prod","affected":[{"type":"plugin","slug":"magic-import-document-extractor","name":"Magic Import Document Extractor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:32:16Z","updated":"2026-02-06T17:29:01Z"},{"id":"wordfence:9ec83425-c756-450e-ac46-c897ad72714c","source":"wordfence","cve":"CVE-2023-28783","title":"Woocommerce Tip/Donation <= 1.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec83425-c756-450e-ac46-c897ad72714c?source=api-prod","affected":[{"type":"plugin","slug":"woo-tipdonation","name":"Woocommerce Tip/Donation","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ecaaa86-9de1-4b90-b6cf-885621cffb19","source":"wordfence","cve":"","title":"Ultimate Membership Pro <= 8.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ecaaa86-9de1-4b90-b6cf-885621cffb19?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":false,"patched_in":"8.7"}],"published":"2020-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ecd4231-d1b7-420e-a8af-1508fed11d1f","source":"wordfence","cve":"CVE-2024-49293","title":"WP VR <= 8.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ecd4231-d1b7-420e-a8af-1508fed11d1f?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:46:07Z"},{"id":"wordfence:9ece0e43-8354-4f3b-973a-330e0af553ff","source":"wordfence","cve":"CVE-2026-119368","title":"The Events Calendar <= 6.18.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ece0e43-8354-4f3b-973a-330e0af553ff?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.2","to_inclusive":true,"patched_in":"6.18.3"}],"published":"2026-10-30T15:02:00Z","updated":"2026-11-03T19:50:19Z"},{"id":"wordfence:9ed0d4b6-f553-4aa5-9dfa-49df78f4269d","source":"wordfence","cve":"CVE-2025-48247","title":"Shortlinks by Pretty Links <= 3.6.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed0d4b6-f553-4aa5-9dfa-49df78f4269d?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":true,"patched_in":"3.6.16"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:28:34Z"},{"id":"wordfence:9ed23152-30bd-40ab-947b-f773eb2a6b4f","source":"wordfence","cve":"CVE-2026-27539","title":"Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed23152-30bd-40ab-947b-f773eb2a6b4f?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.31","to_inclusive":true,"patched_in":"2.11.32"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:02:02Z"},{"id":"wordfence:9ed24d24-e899-4850-8552-4f6cf45fa467","source":"wordfence","cve":"CVE-2026-61945","title":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist <= 3.0.6 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed24d24-e899-4850-8552-4f6cf45fa467?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-stock-alert","name":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-23T20:49:35Z"},{"id":"wordfence:9ed25de7-f002-4108-b2c6-f790acbbe27b","source":"wordfence","cve":"CVE-2011-5082","title":"s2Member\u00ae Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) < 111220 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed25de7-f002-4108-b2c6-f790acbbe27b?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"111220","to_inclusive":false,"patched_in":"111220"}],"published":"2012-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ed80507-f3e5-45a8-9498-8cebf97155ff","source":"wordfence","cve":"CVE-2024-6340","title":"Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed80507-f3e5-45a8-9498-8cebf97155ff?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.36","to_inclusive":true,"patched_in":"4.10.37"}],"published":"2024-07-02T18:52:03Z","updated":"2024-07-11T20:06:50Z"},{"id":"wordfence:9ed8e24d-6bd0-4638-9031-997ce2228fad","source":"wordfence","cve":"CVE-2020-36720","title":"Kali Forms <= 2.1.1 - Missing Authorization to Settings Update","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed8e24d-6bd0-4638-9031-997ce2228fad?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2020-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ed9c59c-191f-4219-8701-ce2f088b3b6d","source":"wordfence","cve":"CVE-2024-1306","title":"Smart Forms <= 2.6.93 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ed9c59c-191f-4219-8701-ce2f088b3b6d?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.93","to_inclusive":true,"patched_in":"2.6.94"}],"published":"2024-04-15T00:00:00Z","updated":"2024-06-19T17:06:35Z"},{"id":"wordfence:9edc25d5-10a0-4d5c-aa29-41fad5e29ae9","source":"wordfence","cve":"CVE-2026-107648","title":"WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9edc25d5-10a0-4d5c-aa29-41fad5e29ae9?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-10-15T21:30:05Z","updated":"2026-10-16T11:28:51Z"},{"id":"wordfence:9edd869c-c1b2-4d56-92c1-bdf76b01a5ce","source":"wordfence","cve":"CVE-2026-24525","title":"CLP Varnish Cache <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9edd869c-c1b2-4d56-92c1-bdf76b01a5ce?source=api-prod","affected":[{"type":"plugin","slug":"clp-varnish-cache","name":"CLP Varnish Cache","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-17T15:21:14Z"},{"id":"wordfence:9ee11e19-21a6-45df-a118-f6dec3b55bc1","source":"wordfence","cve":"CVE-2026-6864","title":"CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee11e19-21a6-45df-a118-f6dec3b55bc1?source=api-prod","affected":[{"type":"plugin","slug":"cbxscratingreview","name":"CBX 5 Star Rating & Review","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-05-21T14:51:34Z","updated":"2026-05-22T03:39:21Z"},{"id":"wordfence:9ee14f5f-c558-43d3-8aae-6ea50933759a","source":"wordfence","cve":"CVE-2026-32539","title":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.7.23 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee14f5f-c558-43d3-8aae-6ea50933759a?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:49:40Z"},{"id":"wordfence:9ee19a8e-5204-4577-ab0d-ca8c13247c49","source":"wordfence","cve":"CVE-2026-87771","title":"Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee19a8e-5204-4577-ab0d-ca8c13247c49?source=api-prod","affected":[{"type":"plugin","slug":"product-question-and-answer","name":"Product Question and Answer","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:44:07Z"},{"id":"wordfence:9ee26828-fa3c-4014-bcf0-8e262c39a5dc","source":"wordfence","cve":"CVE-2025-62975","title":"Raychat <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee26828-fa3c-4014-bcf0-8e262c39a5dc?source=api-prod","affected":[{"type":"plugin","slug":"raychat","name":"Raychat","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-10-29T14:40:10Z"},{"id":"wordfence:9ee272f2-f0ec-42fb-884e-f523bf1100d0","source":"wordfence","cve":"CVE-2026-87963","title":"Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee272f2-f0ec-42fb-884e-f523bf1100d0?source=api-prod","affected":[{"type":"plugin","slug":"yo","name":"Yo","from":"1.1","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:58:53Z"},{"id":"wordfence:9ee4e021-946f-42e2-bae1-d73fdd34749d","source":"wordfence","cve":"CVE-2024-38711","title":"Link Library <= 7.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee4e021-946f-42e2-bae1-d73fdd34749d?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:23:57Z"},{"id":"wordfence:9ee9b2e9-e3fe-43b2-9caf-7246a4201fe9","source":"wordfence","cve":"CVE-2024-13521","title":"MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee9b2e9-e3fe-43b2-9caf-7246a4201fe9?source=api-prod","affected":[{"type":"plugin","slug":"mailup-auto-subscribtion","name":"MailUp Auto Subscription","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-01-27T18:48:10Z","updated":"2025-01-28T07:21:41Z"},{"id":"wordfence:9eee9bec-609a-468b-8b44-ac4af409df93","source":"wordfence","cve":"CVE-2022-2718","title":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authenticated (Admin+) SQL Injection via orderby","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eee9bec-609a-468b-8b44-ac4af409df93?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9eeec949-e440-4df3-8c26-db92498cada3","source":"wordfence","cve":"CVE-2024-1787","title":"Contests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_key","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eeec949-e440-4df3-8c26-db92498cada3?source=api-prod","affected":[{"type":"plugin","slug":"contests-from-rewards-fuel","name":"Contests by Rewards Fuel","from":"*","from_inclusive":true,"to":"2.0.64","to_inclusive":true,"patched_in":"2.0.65"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T01:58:05Z"},{"id":"wordfence:9eeee18d-a035-4de6-a2fc-19479387c4df","source":"wordfence","cve":"CVE-2024-33918","title":"AJAX Login and Registration modal popup + inline form <= 2.23 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eeee18d-a035-4de6-a2fc-19479387c4df?source=api-prod","affected":[{"type":"plugin","slug":"ajax-login-and-registration-modal-popup","name":"AJAX Login and Registration modal popup + inline form","from":"*","from_inclusive":true,"to":"2.23","to_inclusive":true,"patched_in":"2.24"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-20T19:14:34Z"},{"id":"wordfence:9eef053c-16a1-4624-8393-08e78b221d4f","source":"wordfence","cve":"CVE-2024-22143","title":"WP Spell Check <= 9.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9eef053c-16a1-4624-8393-08e78b221d4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"9.17","to_inclusive":true,"patched_in":"9.18"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ef01973-c6f7-447b-933c-ae8bc3ebac5d","source":"wordfence","cve":"CVE-2025-26930","title":"Home Services <= 1.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef01973-c6f7-447b-933c-ae8bc3ebac5d?source=api-prod","affected":[{"type":"theme","slug":"home-services","name":"Home Services","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T13:30:33Z"},{"id":"wordfence:9ef081fa-429d-41fa-baba-96f0820dd1f0","source":"wordfence","cve":"CVE-2024-51872","title":"Luzuk Testimonials <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef081fa-429d-41fa-baba-96f0820dd1f0?source=api-prod","affected":[{"type":"plugin","slug":"luzuk-testimonials","name":"Luzuk Testimonials","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:41:36Z"},{"id":"wordfence:9ef3297d-8686-44aa-ac73-793b644be3f2","source":"wordfence","cve":"CVE-2023-22720","title":"WP Links Page <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef3297d-8686-44aa-ac73-793b644be3f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-links-page","name":"WP Links Page","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ef3e6c7-b75a-4afc-b1c7-6e74b0c894a9","source":"wordfence","cve":"CVE-2026-56030","title":"Paytium: Mollie payment forms & donations <= 5.0.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef3e6c7-b75a-4afc-b1c7-6e74b0c894a9?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T13:59:02Z"},{"id":"wordfence:9ef3f7a2-4ed2-4235-8a6b-f2a5cf288029","source":"wordfence","cve":"CVE-2020-26596","title":"Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef3f7a2-4ed2-4235-8a6b-f2a5cf288029?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2020-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ef53514-1ac5-447c-ba53-b650c7413cf6","source":"wordfence","cve":"CVE-2026-78529","title":"Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef53514-1ac5-447c-ba53-b650c7413cf6?source=api-prod","affected":[{"type":"theme","slug":"alliance","name":"Alliance | Intranet & Extranet BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"3.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:54:11Z","updated":"2026-10-13T14:06:25Z"},{"id":"wordfence:9ef5f88e-0bdd-475f-a0d3-2e71bd13fccf","source":"wordfence","cve":"CVE-2026-73362","title":"URL Shortify \u2013 Simple and Easy URL Shortener <= 2.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef5f88e-0bdd-475f-a0d3-2e71bd13fccf?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:35:11Z"},{"id":"wordfence:9ef6272a-19f5-45eb-8083-f439b20119d1","source":"wordfence","cve":"CVE-2024-51885","title":"Browsing History <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef6272a-19f5-45eb-8083-f439b20119d1?source=api-prod","affected":[{"type":"plugin","slug":"browsing-history","name":"Browsing History","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:50:10Z"},{"id":"wordfence:9ef8906b-be0a-45d2-b1ec-6f480306d9f0","source":"wordfence","cve":"CVE-2015-4617","title":"Easy2map-photos <= 1.0.9 - Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef8906b-be0a-45d2-b1ec-6f480306d9f0?source=api-prod","affected":[{"type":"plugin","slug":"easy2map-photos","name":"Easy2Map Photos","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2015-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ef89bd0-e1f6-4818-a5e6-857fae7cf231","source":"wordfence","cve":"CVE-2026-18653","title":"WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef89bd0-e1f6-4818-a5e6-857fae7cf231?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:20:45Z"},{"id":"wordfence:9ef8f39e-6e5d-4ef6-a81d-0b2be3506ec1","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_script_add","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef8f39e-6e5d-4ef6-a81d-0b2be3506ec1?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ef9b22f-a0dc-43e5-9597-5dcc6ca3fc23","source":"wordfence","cve":"CVE-2023-38521","title":"Exifography <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ef9b22f-a0dc-43e5-9597-5dcc6ca3fc23?source=api-prod","affected":[{"type":"plugin","slug":"thesography","name":"Exifography","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9efa04ca-68c8-4221-a3d9-cf75010d2266","source":"wordfence","cve":"CVE-2025-9539","title":"AutomatorWP \u2013 Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation","severity":"high","cvss":8.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efa04ca-68c8-4221-a3d9-cf75010d2266?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.3.7"}],"published":"2025-09-08T17:53:28Z","updated":"2025-09-09T06:40:36Z"},{"id":"wordfence:9efa43c6-1ec9-4380-9c53-eca47cdc9ec9","source":"wordfence","cve":"CVE-2025-48340","title":"User Profile Meta Manager <= 1.02 - Cross-Site Request Forgery to Privilege Escalation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efa43c6-1ec9-4380-9c53-eca47cdc9ec9?source=api-prod","affected":[{"type":"plugin","slug":"user-profile-meta","name":"User Profile Meta Manager","from":"*","from_inclusive":true,"to":"1.02","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:59:46Z"},{"id":"wordfence:9efac984-21ef-4e02-8ead-bf4205ddb38d","source":"wordfence","cve":"CVE-2017-18586","title":"Insert Pages < 3.2.4 - Authenticated Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efac984-21ef-4e02-8ead-bf4205ddb38d?source=api-prod","affected":[{"type":"plugin","slug":"insert-pages","name":"Insert Pages","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"3.2.4"}],"published":"2017-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9efb7dc8-d0a1-4707-a465-6a55b2d4a426","source":"wordfence","cve":"CVE-2024-2335","title":"Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efb7dc8-d0a1-4707-a465-6a55b2d4a426?source=api-prod","affected":[{"type":"plugin","slug":"elements-plus","name":"Elements Plus!","from":"*","from_inclusive":true,"to":"2.16.2","to_inclusive":true,"patched_in":"2.16.3"}],"published":"2024-03-14T00:00:00Z","updated":"2024-04-09T18:59:09Z"},{"id":"wordfence:9efb88e2-381f-4e26-80bb-1b034ffc1c91","source":"wordfence","cve":"CVE-2024-31388","title":"Table & Contact Form 7 Database \u2013 Tablesome <= 1.0.25 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efb88e2-381f-4e26-80bb-1b034ffc1c91?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.0.25","to_inclusive":true,"patched_in":"1.0.26"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:24:05Z"},{"id":"wordfence:9efbbb82-8127-4f11-84d4-2ce27f2cbefe","source":"wordfence","cve":"CVE-2022-36383","title":"Word Search Puzzles game <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efbbb82-8127-4f11-84d4-2ce27f2cbefe?source=api-prod","affected":[{"type":"plugin","slug":"wha-wordsearch","name":"Word Search Puzzles game","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9efc782a-ec61-4741-81fd-a263a2739e16","source":"wordfence","cve":"CVE-2023-2086","title":"Essential Blocks <= 4.0.6 - Missing Authorization via template_count","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efc782a-ec61-4741-81fd-a263a2739e16?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9efce080-9f7a-40a0-b084-513e07afe1c9","source":"wordfence","cve":"CVE-2025-8624","title":"Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efce080-9f7a-40a0-b084-513e07afe1c9?source=api-prod","affected":[{"type":"plugin","slug":"nexa-blocks","name":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-09-29T15:26:23Z","updated":"2025-11-13T16:00:18Z"},{"id":"wordfence:9efd645d-817c-4148-b62f-86be90c543b4","source":"wordfence","cve":"CVE-2026-6243","title":"Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efd645d-817c-4148-b62f-86be90c543b4?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.36","to_inclusive":true,"patched_in":"3.29.1"}],"published":"2026-10-09T17:51:02Z","updated":"2026-10-10T06:40:14Z"},{"id":"wordfence:9efea864-544d-4c13-a5a8-68d21ce6f762","source":"wordfence","cve":"CVE-2025-62999","title":"Litho Addons <= 3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9efea864-544d-4c13-a5a8-68d21ce6f762?source=api-prod","affected":[{"type":"plugin","slug":"litho-addons","name":"Litho Addons","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-11T16:20:48Z"},{"id":"wordfence:9effa526-7454-4490-9bf4-0605254d6625","source":"wordfence","cve":"CVE-2024-13794","title":"Hide My WP Ghost \u2013 Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9effa526-7454-4490-9bf4-0605254d6625?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.3.02","to_inclusive":true,"patched_in":"5.4.01"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-27T15:48:09Z"},{"id":"wordfence:9effc186-c225-4b3b-9b8c-c453505a41de","source":"wordfence","cve":"CVE-2025-13109","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9effc186-c225-4b3b-9b8c-c453505a41de?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.7.2","to_inclusive":true,"patched_in":"1.3.7.3"}],"published":"2025-12-03T00:25:34Z","updated":"2025-12-03T12:29:59Z"},{"id":"wordfence:9f00b763-1b8a-4a20-96c6-7a93adf806e4","source":"wordfence","cve":"CVE-2024-38724","title":"Contact Form 7 Summary and Print <= 1.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f00b763-1b8a-4a20-96c6-7a93adf806e4?source=api-prod","affected":[{"type":"plugin","slug":"cf7-summary-and-print","name":"Contact Form 7 Submission Summary & PDF Print","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-07-11T00:00:00Z","updated":"2024-11-25T19:19:20Z"},{"id":"wordfence:9f02170f-873b-4c22-ba29-8bb52f9951c2","source":"wordfence","cve":"CVE-2026-101160","title":"Ultimate Review <= 2.4.3 - Unauthenticated Persistent Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f02170f-873b-4c22-ba29-8bb52f9951c2?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:49:09Z"},{"id":"wordfence:9f0294c2-40ac-48aa-8377-e724e9cfc6c9","source":"wordfence","cve":"CVE-2024-47632","title":"DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f0294c2-40ac-48aa-8377-e724e9cfc6c9?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:38:45Z"},{"id":"wordfence:9f06b745-8968-41cb-96b0-ff0f42af114d","source":"wordfence","cve":"CVE-2026-61970","title":"Auto Featured Image (Auto Post Thumbnail) <= 5.0.4 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f06b745-8968-41cb-96b0-ff0f42af114d?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:34:11Z"},{"id":"wordfence:9f07d76e-1973-4ea7-b448-666466cd688f","source":"wordfence","cve":"CVE-2023-1381","title":"WP Meta SEO <= 4.5.4 - Authenticated (Author+) PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f07d76e-1973-4ea7-b448-666466cd688f?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f09788d-7f1a-4c3c-9d25-17e7456cee20","source":"wordfence","cve":"CVE-2025-60057","title":"DJ Rainflow <= 1.3.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f09788d-7f1a-4c3c-9d25-17e7456cee20?source=api-prod","affected":[{"type":"theme","slug":"dj-rainflow","name":"DJ Rainflow | Music Band & Musician PSD Template","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:40:20Z"},{"id":"wordfence:9f0c2d65-a9b1-4ac4-8518-b5ba7dea25c8","source":"wordfence","cve":"CVE-2025-48333","title":"eForm - WordPress Form Builder < 4.19.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f0c2d65-a9b1-4ac4-8518-b5ba7dea25c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-fsqm-pro","name":"eForm - WordPress Form Builder","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":false,"patched_in":"4.19.1"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T15:18:07Z"},{"id":"wordfence:9f0cc8da-5377-4e1a-85d0-d8b6f314818f","source":"wordfence","cve":"CVE-2026-24542","title":"Term Order <= 2.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f0cc8da-5377-4e1a-85d0-d8b6f314818f?source=api-prod","affected":[{"type":"plugin","slug":"wp-term-order","name":"WP Term Order","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-01-24T00:00:00Z","updated":"2026-02-10T20:14:42Z"},{"id":"wordfence:9f0fa6a7-43d8-4fc9-a2a3-7586d2bd986b","source":"wordfence","cve":"CVE-2025-31594","title":"Auto scroll for reading <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f0fa6a7-43d8-4fc9-a2a3-7586d2bd986b?source=api-prod","affected":[{"type":"plugin","slug":"auto-scroll-for-reading","name":"Auto scroll for reading","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:40:24Z"},{"id":"wordfence:9f1078b8-f458-46a6-9982-e8d2d1d1b73b","source":"wordfence","cve":"CVE-2024-8801","title":"Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f1078b8-f458-46a6-9982-e8d2d1d1b73b?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.12.2","to_inclusive":true,"patched_in":"3.12.3"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T11:00:45Z"},{"id":"wordfence:9f123ac9-1473-482d-b52a-a7d837e61f55","source":"wordfence","cve":"CVE-2026-75797","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f123ac9-1473-482d-b52a-a7d837e61f55?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"3.3.3","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:58:22Z"},{"id":"wordfence:9f130158-8c68-4a39-a94b-1f0ce81b1799","source":"wordfence","cve":"CVE-2025-23952","title":"Custom Field List Widget <= 1.5.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f130158-8c68-4a39-a94b-1f0ce81b1799?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-list-widget","name":"Custom Field List Widget","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:09:29Z"},{"id":"wordfence:9f16c098-3e99-4506-b517-ae4b838a0925","source":"wordfence","cve":"CVE-2026-0679","title":"Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f16c098-3e99-4506-b517-ae4b838a0925?source=api-prod","affected":[{"type":"plugin","slug":"fortis-for-woocommerce","name":"Fortis for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-03T19:44:54Z","updated":"2026-02-16T22:01:01Z"},{"id":"wordfence:9f17d266-e64f-4721-9c8d-5bc72791ef01","source":"wordfence","cve":"CVE-2026-100316","title":"European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f17d266-e64f-4721-9c8d-5bc72791ef01?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-eu-vat-compliance","name":"European VAT Compliance Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.36.10","to_inclusive":true,"patched_in":"1.36.11"}],"published":"2026-10-16T19:37:34Z","updated":"2026-10-17T07:51:25Z"},{"id":"wordfence:9f1902e7-66e9-417f-97ba-4db766cf29f1","source":"wordfence","cve":"CVE-2023-32592","title":"Sunny Search <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f1902e7-66e9-417f-97ba-4db766cf29f1?source=api-prod","affected":[{"type":"plugin","slug":"fast-search-powered-by-solr","name":"Sunny Search","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f19030c-bee2-4d04-a45f-517783cece5e","source":"wordfence","cve":"CVE-2024-30481","title":"JCH Optimize <= 4.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f19030c-bee2-4d04-a45f-517783cece5e?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2024-03-28T00:00:00Z","updated":"2026-05-07T13:43:35Z"},{"id":"wordfence:9f1ed762-81f1-4a24-9b40-4389d7eb7405","source":"wordfence","cve":"CVE-2026-100144","title":"IVPAY payments <= 1.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f1ed762-81f1-4a24-9b40-4389d7eb7405?source=api-prod","affected":[{"type":"plugin","slug":"ivendpay-payments","name":"IVPAY payments","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:07:22Z"},{"id":"wordfence:9f1fb33e-38d7-44eb-a536-1f4268659a13","source":"wordfence","cve":"CVE-2025-46226","title":"MPL-Publisher <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f1fb33e-38d7-44eb-a536-1f4268659a13?source=api-prod","affected":[{"type":"plugin","slug":"mpl-publisher","name":"MPL-Publisher \u2014 Ebook & Audiobook Creator","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:15:15Z"},{"id":"wordfence:9f200526-890c-4a2a-9d8e-334443ef7e0b","source":"wordfence","cve":"CVE-2024-10038","title":"WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f200526-890c-4a2a-9d8e-334443ef7e0b?source=api-prod","affected":[{"type":"plugin","slug":"wp-strava","name":"WP-Strava","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T13:25:27Z","updated":"2024-11-13T02:02:33Z"},{"id":"wordfence:9f21f4a4-4b50-4396-8d94-26d68c0eb3a3","source":"wordfence","cve":"CVE-2025-12691","title":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f21f4a4-4b50-4396-8d94-26d68c0eb3a3?source=api-prod","affected":[{"type":"plugin","slug":"photonic","name":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","from":"*","from_inclusive":true,"to":"3.21","to_inclusive":true,"patched_in":"3.22"}],"published":"2025-11-17T20:47:30Z","updated":"2025-11-18T09:27:40Z"},{"id":"wordfence:9f23bf62-6008-4a9c-a7ae-a2e513699684","source":"wordfence","cve":"","title":"ShortPixel Image Optimizer <= 5.4.1 - Authenticated(Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f23bf62-6008-4a9c-a7ae-a2e513699684?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":false,"patched_in":"5.4.2"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f2731fd-1647-4429-91ac-d69ccfe22704","source":"wordfence","cve":"CVE-2026-85307","title":"KP Agent Ready <= 1.1.99 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2731fd-1647-4429-91ac-d69ccfe22704?source=api-prod","affected":[{"type":"plugin","slug":"kp-agent-ready","name":"KP Agent Ready","from":"*","from_inclusive":true,"to":"1.1.99","to_inclusive":true,"patched_in":"1.2.08"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:25:37Z"},{"id":"wordfence:9f2774e8-8b55-4c25-93c3-e0806208b1f3","source":"wordfence","cve":"CVE-2026-15008","title":"Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2774e8-8b55-4c25-93c3-e0806208b1f3?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.3.1.4","to_inclusive":true,"patched_in":"7.4.0"}],"published":"2026-07-15T19:43:41Z","updated":"2026-07-16T07:51:04Z"},{"id":"wordfence:9f2ae1ff-c76e-4997-b860-f1e0b94a437d","source":"wordfence","cve":"CVE-2024-25936","title":"SoundCloud Shortcode <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2ae1ff-c76e-4997-b860-f1e0b94a437d?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-shortcode","name":"SoundCloud Shortcode","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-02-26T00:00:00Z","updated":"2024-03-08T19:42:56Z"},{"id":"wordfence:9f2d8a68-4cb9-44bc-b4ae-43a8e8468634","source":"wordfence","cve":"CVE-2025-9519","title":"Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2d8a68-4cb9-44bc-b4ae-43a8e8468634?source=api-prod","affected":[{"type":"plugin","slug":"easy-timer","name":"Easy Timer","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-04T04:23:49Z"},{"id":"wordfence:9f2e0427-c000-4536-8639-b5f0c8f2b19f","source":"wordfence","cve":"CVE-2025-26874","title":"MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f2e0427-c000-4536-8639-b5f0c8f2b19f?source=api-prod","affected":[{"type":"plugin","slug":"memberspace","name":"MemberSpace \u2013 Sell community access, content, online courses, memberships and paid subscriptions","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:15:32Z"},{"id":"wordfence:9f301908-d491-492f-9347-432c462de286","source":"wordfence","cve":"CVE-2019-14801","title":"FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f301908-d491-492f-9347-432c462de286?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.15.727","to_inclusive":false,"patched_in":"7.3.15.727"}],"published":"2019-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f33096a-dfd5-48c1-84d8-30a0faa2a7f5","source":"wordfence","cve":"CVE-2025-12821","title":"NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f33096a-dfd5-48c1-84d8-30a0faa2a7f5?source=api-prod","affected":[{"type":"theme","slug":"newsblogger","name":"NewsBlogger","from":"0.2.5.6","from_inclusive":true,"to":"0.2.5.9","to_inclusive":true,"patched_in":"0.2.6"}],"published":"2026-02-18T15:08:47Z","updated":"2026-09-14T22:25:48Z"},{"id":"wordfence:9f34a917-1c96-4f2a-b496-8ff848cdc314","source":"wordfence","cve":"CVE-2026-8825","title":"Elementor <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f34a917-1c96-4f2a-b496-8ff848cdc314?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-30T12:55:40Z"},{"id":"wordfence:9f35a407-a7dd-4b6b-8c77-9a20ba797429","source":"wordfence","cve":"CVE-2023-47837","title":"ARMember <= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f35a407-a7dd-4b6b-8c77-9a20ba797429?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"}],"published":"2023-11-16T00:00:00Z","updated":"2024-06-18T15:00:58Z"},{"id":"wordfence:9f3619d9-7572-439e-a284-d59ef5de08f3","source":"wordfence","cve":"CVE-2025-12370","title":"Takeads <= 1.0.13 - Missing Authorization to Plugin Settings Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3619d9-7572-439e-a284-d59ef5de08f3?source=api-prod","affected":[{"type":"plugin","slug":"monetize-link","name":"Takeads","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:20:48Z","updated":"2025-12-05T05:31:27Z"},{"id":"wordfence:9f36e16a-d8e1-4315-ab7a-4d55373a7537","source":"wordfence","cve":"CVE-2026-14962","title":"ELEX WooCommerce Request a Quote <= 2.4.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f36e16a-d8e1-4315-ab7a-4d55373a7537?source=api-prod","affected":[{"type":"plugin","slug":"elex-request-a-quote","name":"ELEX WooCommerce Request a Quote","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:23:22Z"},{"id":"wordfence:9f376b14-bdb4-4c4d-b464-328d269c9654","source":"wordfence","cve":"CVE-2026-76562","title":"Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f376b14-bdb4-4c4d-b464-328d269c9654?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-manager-light","name":"Sidebar Manager Light","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:27Z","updated":"2026-09-10T03:40:42Z"},{"id":"wordfence:9f395100-cf1f-4a3e-a353-1aec6b4e7448","source":"wordfence","cve":"CVE-2023-29172","title":"PropertyHive <= 1.5.46 - Reflected Cross-Site Scripting via 'merge_ids'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f395100-cf1f-4a3e-a353-1aec6b4e7448?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"1.5.46","to_inclusive":true,"patched_in":"1.5.47"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f397671-0b59-4049-95af-3087e07685f0","source":"wordfence","cve":"CVE-2024-3917","title":"Pet Manager <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f397671-0b59-4049-95af-3087e07685f0?source=api-prod","affected":[{"type":"plugin","slug":"pet-manager","name":"Pet Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-09T15:04:39Z"},{"id":"wordfence:9f3a4258-2f45-4617-a5ca-9b28835ef405","source":"wordfence","cve":"CVE-2026-15464","title":"WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3a4258-2f45-4617-a5ca-9b28835ef405?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-07-23T18:03:42Z","updated":"2026-07-24T06:52:01Z"},{"id":"wordfence:9f3b0637-b1ee-4e0b-95cd-11ac377805a7","source":"wordfence","cve":"CVE-2024-13908","title":"SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3b0637-b1ee-4e0b-95cd-11ac377805a7?source=api-prod","affected":[{"type":"plugin","slug":"bws-smtp","name":"SMTP by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-03-07T17:30:30Z","updated":"2025-03-08T07:04:55Z"},{"id":"wordfence:9f3ccf43-dad2-445b-8e65-7d972249dc0b","source":"wordfence","cve":"CVE-2025-23540","title":"WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f3ccf43-dad2-445b-8e65-7d972249dc0b?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-login-and-register","name":"WP Front-end login and register","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:41:43Z"},{"id":"wordfence:9f402aa7-24d6-448b-a1d3-5ee7c90b39bc","source":"wordfence","cve":"CVE-2026-8839","title":"MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f402aa7-24d6-448b-a1d3-5ee7c90b39bc?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.96.6","to_inclusive":true,"patched_in":"2.97.1"}],"published":"2026-06-05T14:37:12Z","updated":"2026-06-06T03:28:25Z"},{"id":"wordfence:9f4052ab-ff9e-48a6-8406-72e9b6237668","source":"wordfence","cve":"CVE-2012-1834","title":"CMS Tree Page View < 0.8.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4052ab-ff9e-48a6-8406-72e9b6237668?source=api-prod","affected":[{"type":"plugin","slug":"cms-tree-page-view","name":"CMS Tree Page View \u2013 Reorder Pages with a Drag-and-Drop Tree","from":"*","from_inclusive":true,"to":"0.8.9","to_inclusive":false,"patched_in":"0.8.9"}],"published":"2012-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f4210a0-5448-4ff6-876a-37db4ad9b23a","source":"wordfence","cve":"CVE-2024-13504","title":"Shared Files \u2013 Frontend File Upload Form & Secure File Sharing <= 1.7.42 - Limited Unauthenticated Stored Cross-Site Scripting via File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4210a0-5448-4ff6-876a-37db4ad9b23a?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.42","to_inclusive":true,"patched_in":"1.7.43"}],"published":"2025-01-30T17:22:13Z","updated":"2025-01-31T05:22:35Z"},{"id":"wordfence:9f4302f8-e9da-436f-9b4b-d01d3dbe9f31","source":"wordfence","cve":"CVE-2025-5841","title":"ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4302f8-e9da-436f-9b4b-d01d3dbe9f31?source=api-prod","affected":[{"type":"plugin","slug":"acf-onyx-poll","name":"Onyx Poll","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-06-12T13:07:25Z","updated":"2025-06-13T01:47:48Z"},{"id":"wordfence:9f432ed8-7b99-44ad-a847-90236e977347","source":"wordfence","cve":"CVE-2025-9462","title":"WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f432ed8-7b99-44ad-a847-90236e977347?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.12"}],"published":"2026-10-30T19:02:07Z","updated":"2026-10-31T07:46:50Z"},{"id":"wordfence:9f4344d6-7679-499a-8086-9ae34b29a913","source":"wordfence","cve":"CVE-2026-56072","title":"Woodmart <= 8.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4344d6-7679-499a-8086-9ae34b29a913?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.5.3","to_inclusive":true,"patched_in":"8.5.4"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:57:47Z"},{"id":"wordfence:9f47c6c4-2d74-4f37-8232-d54d5f0c24cf","source":"wordfence","cve":"CVE-2022-36343","title":"Enable SVG, WebP & ICO Upload <= 1.0.2 - Authenticated  (Author+) Stored Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f47c6c4-2d74-4f37-8232-d54d5f0c24cf?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f48e35e-12fd-4f75-bcb1-6820846298a2","source":"wordfence","cve":"CVE-2022-36375","title":"Tabs \u2013 Responsive Tabs with WooCommerce Product Tab Extension <= 3.6.0 - Authenticated (Admin+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f48e35e-12fd-4f75-bcb1-6820846298a2?source=api-prod","affected":[{"type":"plugin","slug":"vc-tabs","name":"Tabs \u2013 Responsive Tabs with WooCommerce Product Tab Extension","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f49e727-cac4-4a46-b649-5ca48d5e2402","source":"wordfence","cve":"CVE-2023-50873","title":"Add Any Extension to Pages <= 1.4 - Cross-Site Request Forgery via aaetp_options_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f49e727-cac4-4a46-b649-5ca48d5e2402?source=api-prod","affected":[{"type":"plugin","slug":"add-any-extension-to-pages","name":"Add Any Extension to Pages","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f4a3d17-d9fd-4ff4-a4b2-43030cdc7739","source":"wordfence","cve":"CVE-2023-36384","title":"Booking Calendar Contact Form <= 1.2.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4a3d17-d9fd-4ff4-a4b2-43030cdc7739?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.40","to_inclusive":true,"patched_in":"1.2.41"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f4a939c-ba6c-4401-8139-a57e727ceb0f","source":"wordfence","cve":"CVE-2023-0143","title":"Send PDF for Contact Form 7 <= 0.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4a939c-ba6c-4401-8139-a57e727ceb0f?source=api-prod","affected":[{"type":"plugin","slug":"send-pdf-for-contact-form-7","name":"Send PDF for Contact Form 7","from":"*","from_inclusive":true,"to":"0.9.9.1","to_inclusive":true,"patched_in":"0.9.9.2"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f4fe2b2-c7a6-4e88-ac2e-2201072c4dac","source":"wordfence","cve":"CVE-2024-50497","title":"Advanced Online Ordering and Delivery Platform <= 2.0.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4fe2b2-c7a6-4e88-ac2e-2201072c4dac?source=api-prod","affected":[{"type":"plugin","slug":"advanced-online-ordering-and-delivery-platform","name":"Advanced Online Ordering and Delivery Platform","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:34:27Z"},{"id":"wordfence:9f51258a-e228-412f-9d97-28ab679136d7","source":"wordfence","cve":"CVE-2024-4160","title":"Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51258a-e228-412f-9d97-28ab679136d7?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.90","to_inclusive":true,"patched_in":"3.2.91"}],"published":"2024-05-30T20:30:54Z","updated":"2024-06-21T13:50:27Z"},{"id":"wordfence:9f51ea60-7bda-4627-9b65-d1ff402dfc88","source":"wordfence","cve":"CVE-2024-22287","title":"Better Anchor Links <= 1.7.5 - Cross-Site Request Forgery via admin/options.php","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51ea60-7bda-4627-9b65-d1ff402dfc88?source=api-prod","affected":[{"type":"plugin","slug":"better-anchor-links","name":"Better Anchor Links","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f51f514-7a8b-4f2b-a365-93c932253bdb","source":"wordfence","cve":"CVE-2026-65573","title":"Abelle <= 1.22 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51f514-7a8b-4f2b-a365-93c932253bdb?source=api-prod","affected":[{"type":"theme","slug":"abelle","name":"Abelle","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:58:13Z"},{"id":"wordfence:9f521875-6b4a-44a6-b810-c13b73891e20","source":"wordfence","cve":"CVE-2024-35692","title":"GDPR/CCPA Cookie Consent Banner <= 3.2 - Missing Authorization via handle_consent_toggle()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f521875-6b4a-44a6-b810-c13b73891e20?source=api-prod","affected":[{"type":"plugin","slug":"uk-cookie-consent","name":"Termly \u2013 GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:18:17Z"},{"id":"wordfence:9f52ec39-18d8-41eb-8712-7369680b8a58","source":"wordfence","cve":"CVE-2022-2046","title":"Directorist <= 7.2.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f52ec39-18d8-41eb-8712-7369680b8a58?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":"7.2.3"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f57ce91-52f9-47a6-8ed8-815dd55cb92b","source":"wordfence","cve":"CVE-2025-46253","title":"GutenKit <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f57ce91-52f9-47a6-8ed8-815dd55cb92b?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:13:06Z"},{"id":"wordfence:9f58a5eb-53cb-4a25-b693-bcd2b7a1cd00","source":"wordfence","cve":"CVE-2023-2117","title":"Image Optimizer by 10web <= 1.0.26 - Authenticated(Administator+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f58a5eb-53cb-4a25-b693-bcd2b7a1cd00?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer-wd","name":"Image Optimizer by 10web \u2013 Image Optimizer and Compression plugin","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f5a77d1-b575-4e7c-bf27-fc78260de302","source":"wordfence","cve":"CVE-2024-13848","title":"Reaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5a77d1-b575-4e7c-bf27-fc78260de302?source=api-prod","affected":[{"type":"plugin","slug":"reaction-buttons","name":"Reaction Buttons","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:48:02Z","updated":"2025-02-18T04:21:18Z"},{"id":"wordfence:9f5cc779-c7de-42e6-a812-5c0539067b8c","source":"wordfence","cve":"CVE-2022-4033","title":"Quiz and Survey Master <= 8.0.4 - Improper Input Validation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5cc779-c7de-42e6-a812-5c0539067b8c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.4","to_inclusive":true,"patched_in":"8.0.5"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f5cdb47-205a-4c03-a8a9-f39d1b4fc769","source":"wordfence","cve":"","title":"Agency Toolkit <= 1.0.23 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5cdb47-205a-4c03-a8a9-f39d1b4fc769?source=api-prod","affected":[{"type":"plugin","slug":"agency-toolkit","name":"Agency Toolkit","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:15:27Z"},{"id":"wordfence:9f606fba-f779-42ea-a160-6c3b20dc5e79","source":"wordfence","cve":"CVE-2026-15826","title":"User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-704","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.16.4","to_inclusive":true,"patched_in":"3.16.5"}],"published":"2026-08-14T18:24:03Z","updated":"2026-08-15T06:38:09Z"},{"id":"wordfence:9f617682-85f2-497f-a83a-f5a06b384d91","source":"wordfence","cve":"CVE-2024-51707","title":"WP Visual Adverts <= 2.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f617682-85f2-497f-a83a-f5a06b384d91?source=api-prod","affected":[{"type":"plugin","slug":"wp-visual-adverts","name":"WP Visual Adverts","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:22:12Z"},{"id":"wordfence:9f6329a7-0baf-4e07-8541-b342e5007014","source":"wordfence","cve":"CVE-2025-25169","title":"Authors Autocomplete Meta Box <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6329a7-0baf-4e07-8541-b342e5007014?source=api-prod","affected":[{"type":"plugin","slug":"authors-autocomplete-meta-box","name":"Authors Autocomplete Meta Box","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:25:17Z"},{"id":"wordfence:9f64a450-c280-4197-8ef6-e5828c52c1f1","source":"wordfence","cve":"CVE-2025-22714","title":"MDJM Event Management  <= 1.7.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f64a450-c280-4197-8ef6-e5828c52c1f1?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.5.6","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2025-01-15T00:00:00Z","updated":"2025-03-25T19:12:53Z"},{"id":"wordfence:9f65661b-be33-4a84-9432-7f1ff7fd722c","source":"wordfence","cve":"CVE-2026-57431","title":"Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f65661b-be33-4a84-9432-7f1ff7fd722c?source=api-prod","affected":[{"type":"plugin","slug":"featured-image","name":"Featured Image","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:47:46Z"},{"id":"wordfence:9f65baee-11fa-4592-9170-5057faee544e","source":"wordfence","cve":"CVE-2024-5076","title":"Wp EMember <= 10.6.5 - Cross-Site Request Forgery to Bulk Delete","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f65baee-11fa-4592-9170-5057faee544e?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T20:03:55Z"},{"id":"wordfence:9f662888-c388-4191-bda9-b8a22d63cb3f","source":"wordfence","cve":"CVE-2026-12230","title":"LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f662888-c388-4191-bda9-b8a22d63cb3f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.9.1","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:30:00Z"},{"id":"wordfence:9f665099-d1c3-43a9-b37b-c9f42c9172ad","source":"wordfence","cve":"CVE-2024-2847","title":"WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f665099-d1c3-43a9-b37b-c9f42c9172ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.5","to_inclusive":true,"patched_in":"4.24.6"}],"published":"2024-03-29T00:00:00Z","updated":"2024-05-31T15:30:49Z"},{"id":"wordfence:9f66de2d-623d-4009-b05e-c764cecb5d91","source":"wordfence","cve":"CVE-2026-115498","title":"Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f66de2d-623d-4009-b05e-c764cecb5d91?source=api-prod","affected":[{"type":"plugin","slug":"slimjetpack","name":"Slim Jetpack","from":"*","from_inclusive":true,"to":"2.7.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T21:10:54Z","updated":"2026-11-04T09:26:07Z"},{"id":"wordfence:9f678700-f266-4740-a98d-19f8e9734563","source":"wordfence","cve":"CVE-2023-46823","title":"ImageLinks <= 1.5.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f678700-f266-4740-a98d-19f8e9734563?source=api-prod","affected":[{"type":"plugin","slug":"imagelinks-interactive-image-builder-lite","name":"ImageLinks \u2013 Interactive Image Builder with Hotspots","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f684a1f-dc47-4200-8537-85eb3da0e235","source":"wordfence","cve":"CVE-2026-28157","title":"Do Lasso <= 358 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f684a1f-dc47-4200-8537-85eb3da0e235?source=api-prod","affected":[{"type":"plugin","slug":"lasso","name":"ToneDen Shortcode","from":"*","from_inclusive":true,"to":"358","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-21T15:36:01Z"},{"id":"wordfence:9f699d49-738f-49f0-ab1a-f43645a32c90","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f699d49-738f-49f0-ab1a-f43645a32c90?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f6a358a-333c-4eb7-9149-348bf3713943","source":"wordfence","cve":"CVE-2022-4169","title":"Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6a358a-333c-4eb7-9149-348bf3713943?source=api-prod","affected":[{"type":"plugin","slug":"theme-translation-for-polylang","name":"Theme and plugin translation for Polylang (TTfP)","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":true,"patched_in":"3.2.17"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f6b9a90-4fa8-4cd0-bec8-6fa69a1b4681","source":"wordfence","cve":"CVE-2013-2199","title":"WordPress Core < 3.5.2 -  Server Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6b9a90-4fa8-4cd0-bec8-6fa69a1b4681?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f6df8cf-6f64-46b9-ab83-3898484c2679","source":"wordfence","cve":"CVE-2023-7199","title":"Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6df8cf-6f64-46b9-ab83-3898484c2679?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25.0","to_inclusive":false,"patched_in":"2.25.0"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.21.2","to_inclusive":true,"patched_in":"4.22.0"}],"published":"2024-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f6f0322-98ef-4523-b105-fd89c7efcf67","source":"wordfence","cve":"CVE-2025-60198","title":"Saxon - Viral Content Blog & Magazine Marketing WordPress <= 1.9.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6f0322-98ef-4523-b105-fd89c7efcf67?source=api-prod","affected":[{"type":"theme","slug":"saxon","name":"Saxon - Viral Content Blog & Magazine Marketing WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T00:00:00Z","updated":"2025-11-11T17:25:59Z"},{"id":"wordfence:9f6fd068-3f72-4015-b2d8-a47cd86df073","source":"wordfence","cve":"CVE-2024-29096","title":"MJM Clinic <= 1.1.22 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6fd068-3f72-4015-b2d8-a47cd86df073?source=api-prod","affected":[{"type":"plugin","slug":"mjm-clinic","name":"MJM Clinic","from":"*","from_inclusive":true,"to":"1.1.22","to_inclusive":true,"patched_in":"1.1.23"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:51:56Z"},{"id":"wordfence:9f70377f-5b9d-4595-b22c-88aa30900a6f","source":"wordfence","cve":"CVE-2026-32399","title":"Media LIbrary Assistant <= 3.32 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f70377f-5b9d-4595-b22c-88aa30900a6f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.32","to_inclusive":true,"patched_in":"3.33"}],"published":"2026-02-20T00:00:00Z","updated":"2026-04-15T21:12:39Z"},{"id":"wordfence:9f70f3d2-c267-4802-9a54-4f64c4507dba","source":"wordfence","cve":"","title":"Urban City (All Versions) - Arbitrary File Download","severity":"medium","cvss":6.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f70f3d2-c267-4802-9a54-4f64c4507dba?source=api-prod","affected":[{"type":"theme","slug":"urbancity","name":"Urban City","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f73d5b3-8d7c-43d1-84e4-f8a3976eab8f","source":"wordfence","cve":"CVE-2022-0214","title":"Popup | Custom Popup Builder <= 1.3 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f73d5b3-8d7c-43d1-84e4-f8a3976eab8f?source=api-prod","affected":[{"type":"plugin","slug":"m-wp-popup","name":"Popup | Custom Popup Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f740cfa-7163-4634-9705-0e01ee571a11","source":"wordfence","cve":"CVE-2024-0619","title":"Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f740cfa-7163-4634-9705-0e01ee571a11?source=api-prod","affected":[{"type":"plugin","slug":"payflex-payment-gateway","name":"Payflex Payment Gateway","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-06T19:24:20Z"},{"id":"wordfence:9f7469ec-cbd5-4f13-8455-b907f2542836","source":"wordfence","cve":"CVE-2007-1599","title":"WordPress Core < 2.0.10 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f7469ec-cbd5-4f13-8455-b907f2542836?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":false,"patched_in":"2.0.10"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f76e294-1b17-4125-b85c-af7957de1c13","source":"wordfence","cve":"CVE-2022-0598","title":"Login with phone number <= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f76e294-1b17-4125-b85c-af7957de1c13?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f770bc3-8ccc-4160-9e79-e1c0dee42b73","source":"wordfence","cve":"CVE-2024-32834","title":"WooCommerce Shipping Label <= 2.3.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f770bc3-8ccc-4160-9e79-e1c0dee42b73?source=api-prod","affected":[{"type":"plugin","slug":"shipping-labels-for-woo","name":"WooCommerce Shipping Label","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:38:12Z"},{"id":"wordfence:9f77755a-9b28-4e31-8a01-42e96b5698bf","source":"wordfence","cve":"CVE-2023-47508","title":"Master Slider Pro <= 3.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f77755a-9b28-4e31-8a01-42e96b5698bf?source=api-prod","affected":[{"type":"plugin","slug":"masterslider","name":"Master Slider Pro","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f79fe15-65a1-44ab-a43e-1410ce1f1d77","source":"wordfence","cve":"CVE-2024-34413","title":"WordPress Affiliates Plugin \u2014 SliceWP Affiliates <= 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f79fe15-65a1-44ab-a43e-1410ce1f1d77?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T18:55:59Z"},{"id":"wordfence:9f805982-1141-4e28-b28c-93483646cf99","source":"wordfence","cve":"CVE-2024-11352","title":"TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f805982-1141-4e28-b28c-93483646cf99?source=api-prod","affected":[{"type":"plugin","slug":"twentytwenty","name":"TwentyTwenty","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:53:26Z","updated":"2024-12-06T08:24:56Z"},{"id":"wordfence:9f82ec7c-72a0-4c3b-8041-c6ad080a48f1","source":"wordfence","cve":"CVE-2023-41867","title":"AcyMailing SMTP Newsletter <= 8.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f82ec7c-72a0-4c3b-8041-c6ad080a48f1?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"8.6.2","to_inclusive":true,"patched_in":"8.6.3"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f850644-4923-46c1-90f6-d29088c9cb1a","source":"wordfence","cve":"CVE-2023-47514","title":"Star CloudPRNT for WooCommerce <= 2.0.3 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f850644-4923-46c1-90f6-d29088c9cb1a?source=api-prod","affected":[{"type":"plugin","slug":"star-cloudprnt-for-woocommerce","name":"Star CloudPRNT for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f8568f2-a33e-4e05-b26b-fbaea37e2c2c","source":"wordfence","cve":"CVE-2026-57797","title":"EduMall - Professional LMS Education Center WordPress Theme <= 4.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8568f2-a33e-4e05-b26b-fbaea37e2c2c?source=api-prod","affected":[{"type":"theme","slug":"edumall","name":"EduMall - Professional LMS Education Center WordPress Theme","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:35:47Z"},{"id":"wordfence:9f857556-76fc-407a-8dd3-a248a566232a","source":"wordfence","cve":"CVE-2025-22766","title":"Zarinpal Paid Download <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f857556-76fc-407a-8dd3-a248a566232a?source=api-prod","affected":[{"type":"plugin","slug":"zarinpal-paid-downloads","name":"Zarinpal Paid Download","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:48:23Z"},{"id":"wordfence:9f8575cb-0620-4db8-a5e9-0a7f115ee8fe","source":"wordfence","cve":"CVE-2025-32647","title":"Question Answer <= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8575cb-0620-4db8-a5e9-0a7f115ee8fe?source=api-prod","affected":[{"type":"plugin","slug":"question-answer","name":"PickPlugins Question Answer","from":"*","from_inclusive":true,"to":"1.2.70","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:57:37Z"},{"id":"wordfence:9f85a44f-d2c7-4990-9dd3-9f5de78b3458","source":"wordfence","cve":"CVE-2025-23862","title":"Contact Form 7 Anti Spambot <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f85a44f-d2c7-4990-9dd3-9f5de78b3458?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-anti-spambot","name":"Contact Form 7 Anti Spambot","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:10:59Z"},{"id":"wordfence:9f86bb77-7194-4a8d-b862-6f04d850017b","source":"wordfence","cve":"CVE-2024-13622","title":"File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f86bb77-7194-4a8d-b862-6f04d850017b?source=api-prod","affected":[{"type":"plugin","slug":"woo-addon-uploads","name":"File Uploads Addon for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-02-17T15:46:44Z","updated":"2025-03-13T19:46:56Z"},{"id":"wordfence:9f86ec30-7a9d-4c36-8559-bde331c8b958","source":"wordfence","cve":"CVE-2023-6696","title":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f86ec30-7a9d-4c36-8559-bde331c8b958?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2024-06-14T00:00:00Z","updated":"2024-07-29T21:36:59Z"},{"id":"wordfence:9f8a5514-cf26-480c-a94f-754b1cc24da6","source":"wordfence","cve":"CVE-2026-14603","title":"WowOptin <= 1.4.37 - Missing Authorization to Unauthenticated Opt-In Deactivation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8a5514-cf26-480c-a94f-754b1cc24da6?source=api-prod","affected":[{"type":"plugin","slug":"optin","name":"WowOptin: Next-Gen Popup Maker \u2013 Create Stunning Popups and Optins for Lead Generation","from":"*","from_inclusive":true,"to":"1.4.37","to_inclusive":true,"patched_in":"1.4.38"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-30T17:22:11Z"},{"id":"wordfence:9f8b1103-71b2-421e-bcbe-f2716b59e367","source":"wordfence","cve":"CVE-2022-47134","title":"Gallery Metabox <= 1.5 - Cross-Site Request Forgery via gallery_remove","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8b1103-71b2-421e-bcbe-f2716b59e367?source=api-prod","affected":[{"type":"plugin","slug":"gallery-metabox","name":"Gallery Metabox","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f8b9b63-e858-44f1-bbb6-b2011bd08691","source":"wordfence","cve":"CVE-2026-86449","title":"LearnPress <= 4.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8b9b63-e858-44f1-bbb6-b2011bd08691?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:57:29Z"},{"id":"wordfence:9f8c5853-6e21-4a70-a547-e3f0f4b1d7d0","source":"wordfence","cve":"CVE-2023-45641","title":"Caret Country Access Limit <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8c5853-6e21-4a70-a547-e3f0f4b1d7d0?source=api-prod","affected":[{"type":"plugin","slug":"caret-country-access-limit","name":"Caret Country Access Limit","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-25T16:36:38Z"},{"id":"wordfence:9f8de5a9-2279-4b84-b1f6-fdb293aa6017","source":"wordfence","cve":"CVE-2024-12257","title":"CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8de5a9-2279-4b84-b1f6-fdb293aa6017?source=api-prod","affected":[{"type":"plugin","slug":"cardgate","name":"CardGate Payments for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-07T01:45:51Z"},{"id":"wordfence:9f8e32a0-c67c-41cc-97ba-920f3ea5ea93","source":"wordfence","cve":"CVE-2024-32562","title":"Zynith SEO <= 7.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8e32a0-c67c-41cc-97ba-920f3ea5ea93?source=api-prod","affected":[{"type":"plugin","slug":"zynith-seo","name":"Zynith SEO","from":"*","from_inclusive":true,"to":"7.4.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:05:20Z"},{"id":"wordfence:9f9015fa-b3f0-4312-8acd-02b715e26f33","source":"wordfence","cve":"CVE-2026-4654","title":"Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-08T07:43:02Z"},{"id":"wordfence:9f92219a-e07e-422d-a9f2-dbe4fbcd5f55","source":"wordfence","cve":"CVE-2022-1206","title":"AdRotate \u2013 Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f92219a-e07e-422d-a9f2-dbe4fbcd5f55?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.13.2","to_inclusive":true,"patched_in":"5.13.3"}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-20T17:43:09Z"},{"id":"wordfence:9f93ee42-c21d-47cf-b140-65809da75653","source":"wordfence","cve":"CVE-2025-12631","title":"Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f93ee42-c21d-47cf-b140-65809da75653?source=api-prod","affected":[{"type":"plugin","slug":"squirrels-auto-inventory","name":"Squirrels Auto Inventory","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:00:22Z","updated":"2025-11-11T03:30:47Z"},{"id":"wordfence:9f959e61-16cf-4260-b21b-8edb95a3cd65","source":"wordfence","cve":"CVE-2024-47354","title":"Simple Membership After Login Redirection <= 1.6 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f959e61-16cf-4260-b21b-8edb95a3cd65?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership-after-login-redirection","name":"Simple Membership After Login Redirection","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:08:29Z"},{"id":"wordfence:9f96a607-a655-413d-9faf-304249edefe8","source":"wordfence","cve":"CVE-2024-11778","title":"CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f96a607-a655-413d-9faf-304249edefe8?source=api-prod","affected":[{"type":"plugin","slug":"embedded-cdn","name":"CanadaHelps Embedded Donation Form","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-02-18T19:22:43Z","updated":"2025-03-25T19:23:35Z"},{"id":"wordfence:9f97bad7-6044-4727-a229-2890e02e36b0","source":"wordfence","cve":"CVE-2015-1581","title":"Mobile Domain <= 1.5.2 - Cross-Site Request Forgery and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f97bad7-6044-4727-a229-2890e02e36b0?source=api-prod","affected":[{"type":"plugin","slug":"mobile-domain","name":"Mobile Domain","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2015-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f97bc19-c600-4819-ae75-d80b119a7575","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f97bc19-c600-4819-ae75-d80b119a7575?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:04:11Z"},{"id":"wordfence:9f98cdc5-813b-4ed0-98be-c288c1654087","source":"wordfence","cve":"CVE-2025-66149","title":"UnGrabber <= 3.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f98cdc5-813b-4ed0-98be-c288c1654087?source=api-prod","affected":[{"type":"plugin","slug":"ungrabber","name":"UnGrabber","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:39:45Z"},{"id":"wordfence:9f999f89-29eb-4871-a304-0ba6954e7e5b","source":"wordfence","cve":"CVE-2015-9329","title":"Import any XML or CSV File to WordPress <= 3.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f999f89-29eb-4871-a304-0ba6954e7e5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2015-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f9bbe9a-faac-4f41-b2be-ddf6ff80d9c7","source":"wordfence","cve":"CVE-2009-3891","title":"WordPress Core <= 2.8.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9bbe9a-faac-4f41-b2be-ddf6ff80d9c7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2009-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f9d6da5-1598-4df4-8efc-306370446443","source":"wordfence","cve":"CVE-2026-1075","title":"ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9d6da5-1598-4df4-8efc-306370446443?source=api-prod","affected":[{"type":"plugin","slug":"zt-captcha","name":"ZT Captcha","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:19:50Z","updated":"2026-01-24T07:26:45Z"},{"id":"wordfence:9f9e5212-caed-46db-bbf2-81c4df88439f","source":"wordfence","cve":"","title":"LearnPress \u2013 WordPress LMS Plugin <= 3.2.7.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9e5212-caed-46db-bbf2-81c4df88439f?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.7.2","to_inclusive":true,"patched_in":"3.2.7.3"}],"published":"2020-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9f9e5bf6-c988-4bd5-9328-69a2034ab1c4","source":"wordfence","cve":"CVE-2026-24959","title":"JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9e5bf6-c988-4bd5-9328-69a2034ab1c4?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:56:56Z"},{"id":"wordfence:9f9ea566-7492-4616-bd67-e6b7449370f1","source":"wordfence","cve":"CVE-2025-23583","title":"Explara Membership <= 0.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9ea566-7492-4616-bd67-e6b7449370f1?source=api-prod","affected":[{"type":"plugin","slug":"explara-membership","name":"Explara Membership","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:41:40Z"},{"id":"wordfence:9f9fd9e1-c4b8-420e-a4d3-30c934853a98","source":"wordfence","cve":"CVE-2019-13275","title":"WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9fd9e1-c4b8-420e-a4d3-30c934853a98?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.6.6.1","to_inclusive":true,"patched_in":"12.6.7"}],"published":"2019-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fa05058-3c16-4e61-bd6a-a1a09d2f56cc","source":"wordfence","cve":"CVE-2026-121792","title":"GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa05058-3c16-4e61-bd6a-a1a09d2f56cc?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.1.2"}],"published":"2026-11-06T18:13:56Z","updated":"2026-11-07T06:39:39Z"},{"id":"wordfence:9fa0a652-f5d1-4671-a9c1-21e6fd1ad46c","source":"wordfence","cve":"CVE-2025-39546","title":"ElementsReady Addons for Elementor <= 6.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa0a652-f5d1-4671-a9c1-21e6fd1ad46c?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":true,"patched_in":"6.6.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:40:08Z"},{"id":"wordfence:9fa1a551-36d4-488c-898a-3c13b509b8c9","source":"wordfence","cve":"CVE-2017-15375","title":"WPJobBoard <= 4.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa1a551-36d4-488c-898a-3c13b509b8c9?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"5.0"}],"published":"2017-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fa30fa2-6c42-4e5f-a0b5-8711ce5d8121","source":"wordfence","cve":"CVE-2024-13365","title":"Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa30fa2-6c42-4e5f-a0b5-8711ce5d8121?source=api-prod","affected":[{"type":"plugin","slug":"security-malware-firewall","name":"Security Plugin, Firewall & Malware Scanner with Auto Removal","from":"*","from_inclusive":true,"to":"2.149","to_inclusive":true,"patched_in":"2.150"}],"published":"2025-02-11T20:29:00Z","updated":"2025-02-12T09:22:51Z"},{"id":"wordfence:9fa3f24e-3e28-4e50-8801-e4f0a089e3a1","source":"wordfence","cve":"CVE-2015-9409","title":"ALO EasyMail Newsletter <= 2.6.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa3f24e-3e28-4e50-8801-e4f0a089e3a1?source=api-prod","affected":[{"type":"plugin","slug":"alo-easymail","name":"ALO EasyMail Newsletter","from":"*","from_inclusive":true,"to":"2.6.01","to_inclusive":false,"patched_in":"2.6.01"}],"published":"2015-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fa3fa60-4352-4685-b131-e27bf5904fec","source":"wordfence","cve":"CVE-2026-11870","title":"WP Ghost (Hide My WP Ghost) \u2013 Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa3fa60-4352-4685-b131-e27bf5904fec?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.05","to_inclusive":false,"patched_in":"7.0.05"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:33:07Z"},{"id":"wordfence:9fa47d2b-e9a9-4d1b-b933-fd4aa453ba1a","source":"wordfence","cve":"CVE-2026-100152","title":"All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa47d2b-e9a9-4d1b-b933-fd4aa453ba1a?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.2.1"}],"published":"2026-10-02T16:33:28Z","updated":"2026-10-03T05:29:17Z"},{"id":"wordfence:9fa5f9c2-47f3-4280-ac92-facbeb4816ec","source":"wordfence","cve":"CVE-2025-30855","title":"Ads by WPQuads <= 2.0.87.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa5f9c2-47f3-4280-ac92-facbeb4816ec?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"2.0.87.1","to_inclusive":true,"patched_in":"2.0.88"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:26:00Z"},{"id":"wordfence:9fa82247-8f24-433d-993b-0a0465a32c6b","source":"wordfence","cve":"CVE-2025-62945","title":"Did Prestashop Display <= 1.0.30 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa82247-8f24-433d-993b-0a0465a32c6b?source=api-prod","affected":[{"type":"plugin","slug":"did-prestashop-display","name":"Did Prestashop Display \u2013 Show Prestashop products in your WordPress","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:50:48Z"},{"id":"wordfence:9faa9bd1-c7a8-4d8b-9f92-3a0aa9adbc03","source":"wordfence","cve":"CVE-2016-1000133","title":"Forget About Shortcode Buttons <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9faa9bd1-c7a8-4d8b-9f92-3a0aa9adbc03?source=api-prod","affected":[{"type":"plugin","slug":"forget-about-shortcode-buttons","name":"Forget About Shortcode Buttons","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2016-02-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9facb02c-2bd5-457e-ab55-5ccfb289984a","source":"wordfence","cve":"CVE-2026-91047","title":"ElementsReady Addons for Elementor <= 6.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9facb02c-2bd5-457e-ab55-5ccfb289984a?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:44:38Z"},{"id":"wordfence:9fad85ef-5ab7-47d9-b4a6-9e1a1f1ff3bb","source":"wordfence","cve":"CVE-2026-22850","title":"Koko Analytics <= 2.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fad85ef-5ab7-47d9-b4a6-9e1a1f1ff3bb?source=api-prod","affected":[{"type":"plugin","slug":"koko-analytics","name":"Koko Analytics \u2013 Privacy-Friendly WordPress Analytics","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:19:52Z"},{"id":"wordfence:9fae8288-898a-4acd-bbdf-c2fd4f1be1c6","source":"wordfence","cve":"CVE-2024-33627","title":"Absolutely Glamorous Custom Admin <= 7.2.3 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fae8288-898a-4acd-bbdf-c2fd4f1be1c6?source=api-prod","affected":[{"type":"plugin","slug":"ag-custom-admin","name":"AGCA \u2013 Custom Dashboard & Login Page","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.2.4"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-03T19:58:32Z"},{"id":"wordfence:9faee46e-f43f-4af6-81f4-500933ffd01f","source":"wordfence","cve":"CVE-2026-18035","title":"User Access Manager <= 2.3.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9faee46e-f43f-4af6-81f4-500933ffd01f?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:53:46Z"},{"id":"wordfence:9faf3293-191c-48fb-a932-d61325d6c2e0","source":"wordfence","cve":"CVE-2024-54265","title":"Barcode Scanner with Inventory & Order Manager <= 1.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9faf3293-191c-48fb-a932-d61325d6c2e0?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-19T08:07:16Z"},{"id":"wordfence:9fafe21a-a942-4356-90b3-1b6a45535949","source":"wordfence","cve":"CVE-2025-60114","title":"YayCurrency <= 3.2 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fafe21a-a942-4356-90b3-1b6a45535949?source=api-prod","affected":[{"type":"plugin","slug":"yaycurrency","name":"YayCurrency \u2013 WooCommerce Multi-Currency Switcher","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-09-26T00:00:00Z","updated":"2026-01-15T18:27:58Z"},{"id":"wordfence:9fb09a77-aba1-422c-961b-dc2c7ce82320","source":"wordfence","cve":"CVE-2022-3900","title":"Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fb09a77-aba1-422c-961b-dc2c7ce82320?source=api-prod","affected":[{"type":"plugin","slug":"cooked-pro","name":"Cooked Pro","from":"*","from_inclusive":true,"to":"1.7.5.7","to_inclusive":false,"patched_in":"1.7.5.7"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fb4ad52-a0b2-4645-bf0d-132b4ce8a0a1","source":"wordfence","cve":"CVE-2023-48287","title":"TextMe SMS <= 1.9.0 - Missing Authorization via tetxme_update_option_page()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fb4ad52-a0b2-4645-bf0d-132b4ce8a0a1?source=api-prod","affected":[{"type":"plugin","slug":"textme-sms-integration","name":"TextMe SMS","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fb4c58d-321d-453f-92b9-ae409541911b","source":"wordfence","cve":"CVE-2024-33560","title":"XStore <= 9.3.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fb4c58d-321d-453f-92b9-ae409541911b?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:49:14Z"},{"id":"wordfence:9fb9fc24-3331-45c8-98ca-0ad0efb5d3c6","source":"wordfence","cve":"CVE-2026-110964","title":"Essential Real Estate 4.4.3 - 5.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fb9fc24-3331-45c8-98ca-0ad0efb5d3c6?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"4.4.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:33:17Z"},{"id":"wordfence:9fbb31a5-9ed2-445a-b309-a9835128eb44","source":"wordfence","cve":"CVE-2024-4608","title":"SellKit \u2013 Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbb31a5-9ed2-445a-b309-a9835128eb44?source=api-prod","affected":[{"type":"plugin","slug":"sellkit","name":"SellKit \u2013 Funnel builder and checkout optimizer for WooCommerce to sell more, faster","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-06-05T15:30:45Z","updated":"2024-07-01T17:01:19Z"},{"id":"wordfence:9fbb4f9a-4c68-4ddb-8e49-9629114b11ec","source":"wordfence","cve":"CVE-2024-13485","title":"LTL Freight Quotes \u2013 ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbb4f9a-4c68-4ddb-8e49-9629114b11ec?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-abf-freight-edition","name":"LTL Freight Quotes \u2013 ABF Freight Edition","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:40Z"},{"id":"wordfence:9fbb5ed0-ed76-44fe-88c4-eb05ad87e510","source":"wordfence","cve":"CVE-2023-49173","title":"10to8 Online Appointment Booking System <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbb5ed0-ed76-44fe-88c4-eb05ad87e510?source=api-prod","affected":[{"type":"plugin","slug":"10to8-online-booking","name":"Sign In Scheduling Online Appointment Booking System","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-11-29T00:00:00Z","updated":"2026-02-26T14:52:49Z"},{"id":"wordfence:9fbbdbba-ac65-4714-bc36-6d4831ca177d","source":"wordfence","cve":"CVE-2024-51605","title":"Genoo <= 6.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbbdbba-ac65-4714-bc36-6d4831ca177d?source=api-prod","affected":[{"type":"plugin","slug":"genoo","name":"Genoo","from":"*","from_inclusive":true,"to":"6.0.10","to_inclusive":true,"patched_in":"6.0.13"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-27T13:41:08Z"},{"id":"wordfence:9fbe8eb9-ff84-42cc-a303-c34798906340","source":"wordfence","cve":"CVE-2026-32465","title":"Essential Real Estate <= 5.3.3 - Authenticated (Customer+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbe8eb9-ff84-42cc-a303-c34798906340?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2026-08-14T00:00:00Z","updated":"2026-10-28T21:13:22Z"},{"id":"wordfence:9fbee4da-ec75-4bb2-8431-7ab088661d23","source":"wordfence","cve":"CVE-2026-24612","title":"Orchid Store <= 1.5.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbee4da-ec75-4bb2-8431-7ab088661d23?source=api-prod","affected":[{"type":"theme","slug":"orchid-store","name":"Orchid Store","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T13:03:21Z","updated":"2026-02-03T13:45:27Z"},{"id":"wordfence:9fc18fee-5813-4134-8c4d-44710665857a","source":"wordfence","cve":"CVE-2023-34377","title":"My Content Management <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc18fee-5813-4134-8c4d-44710665857a?source=api-prod","affected":[{"type":"plugin","slug":"my-content-management","name":"My Content Management","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fc1e720-46ba-4f57-8694-551936371e2c","source":"wordfence","cve":"CVE-2021-24439","title":"Browser Screenshots < 1.7.6 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc1e720-46ba-4f57-8694-551936371e2c?source=api-prod","affected":[{"type":"plugin","slug":"browser-shots","name":"Browser Screenshots","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fc3355f-a3e3-4f30-885a-90d4982f699e","source":"wordfence","cve":"CVE-2024-37485","title":"bbPress Notify <= 2.18.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc3355f-a3e3-4f30-885a-90d4982f699e?source=api-prod","affected":[{"type":"plugin","slug":"bbpress-notify-nospam","name":"bbPress Notify (No-Spam)","from":"*","from_inclusive":true,"to":"2.18.3","to_inclusive":true,"patched_in":"2.18.4"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:27:38Z"},{"id":"wordfence:9fc46de4-af1c-4e38-9caa-55b7b18a69ae","source":"wordfence","cve":"CVE-2023-5940","title":"WP Not Login Hide <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc46de4-af1c-4e38-9caa-55b7b18a69ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-not-login-hide-wpnlh","name":"WP Not Login Hide (WPNLH)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fc4b26a-cb76-4b2c-adad-62e21263b957","source":"wordfence","cve":"CVE-2025-60082","title":"PDF for WPForms <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc4b26a-cb76-4b2c-adad-62e21263b957?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2025-08-23T00:00:00Z","updated":"2026-01-30T20:41:58Z"},{"id":"wordfence:9fc6d947-4b6e-4dcb-9f20-02e39b4e730e","source":"wordfence","cve":"CVE-2021-24880","title":"SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fc6d947-4b6e-4dcb-9f20-02e39b4e730e?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fcb65a0-4218-4728-9c29-0d1a03f438a6","source":"wordfence","cve":"CVE-2024-2846","title":"Visual Footer Credit Remover <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcb65a0-4218-4728-9c29-0d1a03f438a6?source=api-prod","affected":[{"type":"plugin","slug":"visual-footer-credit-remover","name":"Visual Footer Credit Remover","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:36Z"},{"id":"wordfence:9fcd21a6-ca6b-491c-8736-cf6d81883378","source":"wordfence","cve":"CVE-2025-13958","title":"YaMaps <= 0.6.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcd21a6-ca6b-491c-8736-cf6d81883378?source=api-prod","affected":[{"type":"plugin","slug":"yamaps","name":"YaMaps for WordPress Plugin","from":"*","from_inclusive":true,"to":"0.6.39","to_inclusive":true,"patched_in":"0.6.40"}],"published":"2025-12-08T00:00:00Z","updated":"2026-01-06T16:14:46Z"},{"id":"wordfence:9fcdc458-783b-4ad5-8484-fdef4d814d71","source":"wordfence","cve":"CVE-2025-47521","title":"Robo Gallery <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcdc458-783b-4ad5-8484-fdef4d814d71?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:24:05Z"},{"id":"wordfence:9fcf7936-8a28-45b9-a9dc-fd7257a83a84","source":"wordfence","cve":"CVE-2025-8294","title":"Download Counter <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcf7936-8a28-45b9-a9dc-fd7257a83a84?source=api-prod","affected":[{"type":"plugin","slug":"download-counter","name":"Download Counter","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-08-04T18:57:59Z","updated":"2025-08-05T07:24:16Z"},{"id":"wordfence:9fcf8baf-502f-4e72-b217-e80f7ca136df","source":"wordfence","cve":"CVE-2024-56208","title":"NewsDaily <= 1.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcf8baf-502f-4e72-b217-e80f7ca136df?source=api-prod","affected":[{"type":"theme","slug":"newsdaily","name":"NewsDaily","from":"*","from_inclusive":true,"to":"1.0.64","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-14T15:26:34Z"},{"id":"wordfence:9fd15c0b-cd3b-45e7-8379-b0e64e64d6b1","source":"wordfence","cve":"CVE-2023-4318","title":"Herd Effects <= 5.2.3 - Cross-Site Request Forgery to Effect Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd15c0b-cd3b-45e7-8379-b0e64e64d6b1?source=api-prod","affected":[{"type":"plugin","slug":"mwp-herd-effect","name":"Social Proof Popups & Real-Time Notifications \u2013 Herd Effects","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fd3610c-cce4-420c-85c1-0b71679df650","source":"wordfence","cve":"CVE-2024-12592","title":"Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd3610c-cce4-420c-85c1-0b71679df650?source=api-prod","affected":[{"type":"plugin","slug":"sellsy","name":"Sellsy","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-01-06T15:05:25Z","updated":"2025-01-22T21:43:24Z"},{"id":"wordfence:9fd38e86-6448-47fd-a8a7-f571158e3599","source":"wordfence","cve":"CVE-2022-45826","title":"Sunshine Photo Cart <= 2.9.13 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd38e86-6448-47fd-a8a7-f571158e3599?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fd517d9-4966-4cb6-86c2-4881de3d1d53","source":"wordfence","cve":"CVE-2025-58823","title":"Get Cash <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd517d9-4966-4cb6-86c2-4881de3d1d53?source=api-prod","affected":[{"type":"plugin","slug":"get-cash","name":"Get Cash","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-09-05T00:00:00Z","updated":"2026-10-13T16:56:05Z"},{"id":"wordfence:9fd58c6b-2ed5-4f6c-bb49-bc0151f72f73","source":"wordfence","cve":"CVE-2024-49319","title":"Awesome Contact Form7 for Elementor <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd58c6b-2ed5-4f6c-bb49-bc0151f72f73?source=api-prod","affected":[{"type":"plugin","slug":"awesome-contact-form7-for-elementor","name":"Awesome Contact Form7 for Elementor","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:44:23Z"},{"id":"wordfence:9fd615cc-dc7f-4d46-bae3-3c9862083881","source":"wordfence","cve":"CVE-2026-61982","title":"SiteGuard WP Plugin <= 1.8.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd615cc-dc7f-4d46-bae3-3c9862083881?source=api-prod","affected":[{"type":"plugin","slug":"siteguard","name":"SiteGuard WP Plugin","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-13T18:53:04Z"},{"id":"wordfence:9fd84f6c-2a24-4e0c-b388-0edc5d56a431","source":"wordfence","cve":"CVE-2026-57705","title":"Event Tickets and Registration <= 5.28.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd84f6c-2a24-4e0c-b388-0edc5d56a431?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.28.5","to_inclusive":true,"patched_in":"5.28.5.1"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:37:08Z"},{"id":"wordfence:9fd92310-085a-40f8-a857-89b45bcce20a","source":"wordfence","cve":"CVE-2026-119507","title":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.3.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd92310-085a-40f8-a857-89b45bcce20a?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:54:38Z"},{"id":"wordfence:9fd9c076-d36c-4cda-b636-aa65195956d2","source":"wordfence","cve":"CVE-2023-49741","title":"Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd9c076-d36c-4cda-b636-aa65195956d2?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-page","name":"Coming soon and Maintenance mode","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2023-12-01T00:00:00Z","updated":"2024-06-05T19:49:56Z"},{"id":"wordfence:9fda5e15-fdf9-4b67-93d3-2dbfa94aefe9","source":"wordfence","cve":"CVE-2017-14990","title":"WordPress Core - All Known Versions - Cleartext Storage of wp_signups.activation_key","severity":"medium","cvss":5.3,"cwe":"CWE-312","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fda5e15-fdf9-4b67-93d3-2dbfa94aefe9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fda8379-0bed-4eae-b3e3-06e35c541323","source":"wordfence","cve":"CVE-2026-39677","title":"Emphires <= 3.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fda8379-0bed-4eae-b3e3-06e35c541323?source=api-prod","affected":[{"type":"theme","slug":"emphires","name":"Emphires - Human Resources & Recruiting Theme","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T15:40:39Z"},{"id":"wordfence:9fdb6e4d-a94d-448c-aaea-0f38eeafd033","source":"wordfence","cve":"CVE-2023-0232","title":"WooLentor <= 2.5.3 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fdb6e4d-a94d-448c-aaea-0f38eeafd033?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2023-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fdc9d20-a1cf-4a58-b250-4f3f56b77b69","source":"wordfence","cve":"","title":"WP OAuth Server (OAuth Authentication) <= 4.2.5 -Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fdc9d20-a1cf-4a58-b250-4f3f56b77b69?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fdf6c97-6fc4-4840-b96d-e194149861e4","source":"wordfence","cve":"CVE-2024-1438","title":"Rolo Slider <= 1.0.9 - Missing Authorization to Authenticated(Subscriber+) Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fdf6c97-6fc4-4840-b96d-e194149861e4?source=api-prod","affected":[{"type":"plugin","slug":"rolo-slider","name":"Rolo Slider","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T20:02:51Z"},{"id":"wordfence:9fe1178e-aca3-4f52-85e1-7d04b866a073","source":"wordfence","cve":"CVE-2010-5295","title":"WordPress Core < 3.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe1178e-aca3-4f52-85e1-7d04b866a073?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2010-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fe2a19a-b6ed-409f-a496-a005f87d06e6","source":"wordfence","cve":"CVE-2025-53241","title":"Simplified <= 1.0.11 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe2a19a-b6ed-409f-a496-a005f87d06e6?source=api-prod","affected":[{"type":"plugin","slug":"simplified","name":"Simplified Plugin","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-08-14T00:00:00Z","updated":"2026-02-16T22:11:34Z"},{"id":"wordfence:9fe3d648-d6b3-4363-b449-bfc0f5b9c1ea","source":"wordfence","cve":"CVE-2025-49940","title":"Fusion Builder <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe3d648-d6b3-4363-b449-bfc0f5b9c1ea?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2025-10-03T00:00:00Z","updated":"2025-10-29T15:26:49Z"},{"id":"wordfence:9fe455dc-8138-49d0-97a1-b0dce111d23b","source":"wordfence","cve":"CVE-2026-109998","title":"Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe455dc-8138-49d0-97a1-b0dce111d23b?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-15T16:10:03Z","updated":"2026-10-16T04:27:03Z"},{"id":"wordfence:9fe625bd-6050-4c74-b310-8dce05c1f4a5","source":"wordfence","cve":"CVE-2025-28901","title":"Members page only for logged in users <= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe625bd-6050-4c74-b310-8dce05c1f4a5?source=api-prod","affected":[{"type":"plugin","slug":"members-page-only-for-logged-in-users","name":"Members page only for logged in users","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:24:39Z"},{"id":"wordfence:9fe78766-0beb-4d6d-a2e6-92f79f117f50","source":"wordfence","cve":"CVE-2015-9475","title":"Pont <= 1.5 - Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-276","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe78766-0beb-4d6d-a2e6-92f79f117f50?source=api-prod","affected":[{"type":"theme","slug":"pont","name":"Pont - Multipurpose Wordpress Theme | Business","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2015-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9fe7f4e4-3774-408b-8a2a-0db67bc34fcf","source":"wordfence","cve":"CVE-2024-2964","title":"Pocket News Generator <= 0.2.0 -  Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe7f4e4-3774-408b-8a2a-0db67bc34fcf?source=api-prod","affected":[{"type":"plugin","slug":"pocket-news-generator","name":"Pocket News Generator","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T06:44:02Z"},{"id":"wordfence:9fe7fca1-9e6e-48b5-9818-793fe1045334","source":"wordfence","cve":"CVE-2026-39627","title":"Ashe <= 2.267 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe7fca1-9e6e-48b5-9818-793fe1045334?source=api-prod","affected":[{"type":"theme","slug":"ashe","name":"Ashe","from":"*","from_inclusive":true,"to":"2.267","to_inclusive":true,"patched_in":"2.268"}],"published":"2026-02-12T00:00:00Z","updated":"2026-05-04T14:39:15Z"},{"id":"wordfence:9fe9fe85-bcb5-4e12-b879-31bc73074eed","source":"wordfence","cve":"CVE-2024-7136","title":"JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fe9fe85-bcb5-4e12-b879-31bc73074eed?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.2.1"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T10:59:55Z"},{"id":"wordfence:9feb44e1-eb19-40eb-85d6-fae56afe90ee","source":"wordfence","cve":"CVE-2022-37339","title":"Meet My Team <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9feb44e1-eb19-40eb-85d6-fae56afe90ee?source=api-prod","affected":[{"type":"plugin","slug":"meet-my-team","name":"Meet My Team","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2022-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9febd85f-a063-4ee5-8481-0d97133157d0","source":"wordfence","cve":"CVE-2025-31854","title":"Simple Sticky Add To Cart For WooCommerce <= 1.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9febd85f-a063-4ee5-8481-0d97133157d0?source=api-prod","affected":[{"type":"plugin","slug":"sticky-add-to-cart-woo","name":"Simple Sticky Add To Cart For WooCommerce","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:27:33Z"},{"id":"wordfence:9fec8d09-6114-49cc-a2fe-7c7b09d13237","source":"wordfence","cve":"CVE-2025-62944","title":"MSTW CSV EXPORTER <= 1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9fec8d09-6114-49cc-a2fe-7c7b09d13237?source=api-prod","affected":[{"type":"plugin","slug":"mstw-csv-exporter","name":"MSTW CSV EXPORTER","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:51:01Z"},{"id":"wordfence:9ff499b1-eaf2-4637-9290-9a930256a9d2","source":"wordfence","cve":"CVE-2025-62738","title":"Formstack Online Forms <= 2.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ff499b1-eaf2-4637-9290-9a930256a9d2?source=api-prod","affected":[{"type":"plugin","slug":"formstack","name":"Formstack Online Forms","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-10T15:54:41Z"},{"id":"wordfence:9ff51513-309c-49d5-a03a-11224e404a94","source":"wordfence","cve":"CVE-2025-22698","title":"Accessibility Suite by Ability, Inc <= 4.18 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ff51513-309c-49d5-a03a-11224e404a94?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.18","to_inclusive":true,"patched_in":"4.19"}],"published":"2025-01-31T00:00:00Z","updated":"2025-05-16T14:15:39Z"},{"id":"wordfence:9ff5a900-9e4d-4bd0-bd19-cad96e62f973","source":"wordfence","cve":"CVE-2021-24796","title":"My Tickets <= 1.8.30 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ff5a900-9e4d-4bd0-bd19-cad96e62f973?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"1.8.31","to_inclusive":false,"patched_in":"1.8.31"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:9ff74fee-ba89-46fb-adb0-47fbe07c2a5c","source":"wordfence","cve":"CVE-2025-53207","title":"WP Travel Gutenberg Blocks <= 3.9.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ff74fee-ba89-46fb-adb0-47fbe07c2a5c?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-blocks","name":"WP Travel Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:43:23Z"},{"id":"wordfence:9ffb0980-75f8-4f6b-a0ed-2f65bc5aa103","source":"wordfence","cve":"CVE-2025-9623","title":"Admin in English with Switch <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ffb0980-75f8-4f6b-a0ed-2f65bc5aa103?source=api-prod","affected":[{"type":"plugin","slug":"admin-in-english-with-switch","name":"Admin in English with Switch","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:51:57Z","updated":"2025-09-11T07:24:57Z"},{"id":"wordfence:9ffc69f0-125d-4800-a21d-755219b7eb91","source":"wordfence","cve":"CVE-2026-39637","title":"Mogi <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ffc69f0-125d-4800-a21d-755219b7eb91?source=api-prod","affected":[{"type":"theme","slug":"mogi","name":"Mogi - A Creative Portfolio / Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-05T15:36:30Z"},{"id":"wordfence:9ffdc255-1b39-4e08-b75a-a155f8156fb4","source":"wordfence","cve":"CVE-2024-33938","title":"Sliding Widgets <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9ffdc255-1b39-4e08-b75a-a155f8156fb4?source=api-prod","affected":[{"type":"plugin","slug":"sliding-widgets","name":"Sliding Widgets","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:40:46Z"},{"id":"wordfence:a0010ee3-1016-479f-ae60-5d5900862489","source":"wordfence","cve":"CVE-2026-2427","title":"itsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0010ee3-1016-479f-ae60-5d5900862489?source=api-prod","affected":[{"type":"plugin","slug":"itsukaita","name":"itsukaita","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:38Z","updated":"2026-03-21T03:26:57Z"},{"id":"wordfence:a00147db-2ca5-4290-ae13-27be6119b751","source":"wordfence","cve":"CVE-2023-3936","title":"Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a00147db-2ca5-4290-ae13-27be6119b751?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":false,"patched_in":"7.2.1"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a00222f4-6f41-4a88-a50a-1e25b11a2ffc","source":"wordfence","cve":"CVE-2025-49254","title":"Nika <= 1.2.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a00222f4-6f41-4a88-a50a-1e25b11a2ffc?source=api-prod","affected":[{"type":"theme","slug":"nika","name":"Nika - Medical Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:32:05Z"},{"id":"wordfence:a003129b-4a31-40f8-a9b2-9d3a3286cabe","source":"wordfence","cve":"CVE-2024-8716","title":"XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a003129b-4a31-40f8-a9b2-9d3a3286cabe?source=api-prod","affected":[{"type":"plugin","slug":"xt-woo-ajax-add-to-cart","name":"XT Ajax Add To Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T01:56:47Z"},{"id":"wordfence:a003e922-d6c6-4f99-9b94-a3232d311677","source":"wordfence","cve":"CVE-2025-26909","title":"Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a003e922-d6c6-4f99-9b94-a3232d311677?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.4.01","to_inclusive":true,"patched_in":"5.4.02"}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:39:47Z"},{"id":"wordfence:a00997d4-f242-4d49-8542-0738efa66222","source":"wordfence","cve":"CVE-2026-12134","title":"JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a00997d4-f242-4d49-8542-0738efa66222?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.8","to_inclusive":true,"patched_in":"5.7.9"}],"published":"2026-07-01T19:58:08Z","updated":"2026-07-02T08:33:06Z"},{"id":"wordfence:a0099f55-651c-4997-bf6d-97125c4260e1","source":"wordfence","cve":"CVE-2015-9485","title":"Accio | Responsive Onepage Parallax Site Template < 1.1.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0099f55-651c-4997-bf6d-97125c4260e1?source=api-prod","affected":[{"type":"theme","slug":"accio-one-page","name":"Accio | Responsive Onepage Parallax Site Template","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a00a5c41-b211-45e4-acf8-01fd8e64b1c0","source":"wordfence","cve":"CVE-2024-4703","title":"One Page Express Companion <= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a00a5c41-b211-45e4-acf8-01fd8e64b1c0?source=api-prod","affected":[{"type":"plugin","slug":"one-page-express-companion","name":"One Page Express Companion","from":"*","from_inclusive":true,"to":"1.6.37","to_inclusive":true,"patched_in":"1.6.38"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T07:35:28Z"},{"id":"wordfence:a0101dd1-a9cb-4b9c-8299-9b808d7e1912","source":"wordfence","cve":"CVE-2024-8318","title":"Attributes for Blocks <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0101dd1-a9cb-4b9c-8299-9b808d7e1912?source=api-prod","affected":[{"type":"plugin","slug":"attributes-for-blocks","name":"Attributes for Blocks","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-09-03T19:27:16Z","updated":"2024-09-04T07:31:29Z"},{"id":"wordfence:a010d1a2-b848-4d62-b176-a2c8e2027656","source":"wordfence","cve":"CVE-2026-4806","title":"Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a010d1a2-b848-4d62-b176-a2c8e2027656?source=api-prod","affected":[{"type":"plugin","slug":"custom-thank-you-page","name":"Custom Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-09-23T21:35:03Z","updated":"2026-09-24T11:31:09Z"},{"id":"wordfence:a01141ed-9b9c-426f-96b3-c6ceade4d35c","source":"wordfence","cve":"CVE-2023-49818","title":"Webflow Pages <= 1.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a01141ed-9b9c-426f-96b3-c6ceade4d35c?source=api-prod","affected":[{"type":"plugin","slug":"webflow-pages","name":"Webflow Pages","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-09-23T18:33:00Z"},{"id":"wordfence:a013106b-4e2a-4dd9-a0ab-7e6c91e715dd","source":"wordfence","cve":"CVE-2024-24839","title":"Structured Content <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Classic Editor Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a013106b-4e2a-4dd9-a0ab-7e6c91e715dd?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T21:26:51Z"},{"id":"wordfence:a0146f17-35bd-45cf-b9c6-c4fce688efc2","source":"wordfence","cve":"CVE-2025-7697","title":"Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0146f17-35bd-45cf-b9c6-c4fce688efc2?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-contact-form-7-and-google-sheets","name":"Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-07-18T16:22:54Z","updated":"2025-07-19T04:23:03Z"},{"id":"wordfence:a0164123-11b0-4b3b-bc76-c6aee8ca9d34","source":"wordfence","cve":"CVE-2023-45657","title":"Nexter <= 2.0.3 - Authenticated (Subscriber+) SQL Injection via 'to' and 'from'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0164123-11b0-4b3b-bc76-c6aee8ca9d34?source=api-prod","affected":[{"type":"theme","slug":"nexter","name":"Nexter","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a016b6b3-3a3f-4f25-9207-2460798044f0","source":"wordfence","cve":"CVE-2022-23982","title":"Perfect Brands for WooCommerce <= 2.0.4 - Server Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a016b6b3-3a3f-4f25-9207-2460798044f0?source=api-prod","affected":[{"type":"plugin","slug":"perfect-woocommerce-brands","name":"Perfect Brands for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-01-28T09:33:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a018ba2b-8188-41f9-bdab-64cae3362e0e","source":"wordfence","cve":"CVE-2022-3906","title":"Easy Form Builder <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a018ba2b-8188-41f9-bdab-64cae3362e0e?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a018fcb1-b7a6-456f-ab0b-59ccc1fd5b67","source":"wordfence","cve":"CVE-2024-13680","title":"Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a018fcb1-b7a6-456f-ab0b-59ccc1fd5b67?source=api-prod","affected":[{"type":"plugin","slug":"cp-easy-form-builder","name":"Form Builder CP","from":"*","from_inclusive":true,"to":"1.2.41","to_inclusive":true,"patched_in":"1.2.42"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T07:04:08Z"},{"id":"wordfence:a01cdc31-3cab-43b0-a5ef-75fb11eeb621","source":"wordfence","cve":"CVE-2015-9407","title":"XPinner Lite <= 2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a01cdc31-3cab-43b0-a5ef-75fb11eeb621?source=api-prod","affected":[{"type":"plugin","slug":"xpinner-lite","name":"xPinner Lite","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2015-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a01e7b21-f3ff-42a8-b78a-ad69973eda01","source":"wordfence","cve":"CVE-2026-3649","title":"Katalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a01e7b21-f3ff-42a8-b78a-ad69973eda01?source=api-prod","affected":[{"type":"plugin","slug":"katalogportal-pdf-sync","name":"Katalogportal-pdf-sync Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:45:57Z","updated":"2026-04-15T08:28:16Z"},{"id":"wordfence:a0214cf8-59f7-4928-bf27-547f3b7790ae","source":"wordfence","cve":"CVE-2024-35763","title":"Excellent <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0214cf8-59f7-4928-bf27-547f3b7790ae?source=api-prod","affected":[{"type":"theme","slug":"excellent","name":"Excellent","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-06-17T00:00:00Z","updated":"2024-07-02T12:53:18Z"},{"id":"wordfence:a021cc48-502d-4418-99dc-06d7d3cb310e","source":"wordfence","cve":"CVE-2026-82127","title":"Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a021cc48-502d-4418-99dc-06d7d3cb310e?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.66","to_inclusive":true,"patched_in":"1.67"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:07:13Z"},{"id":"wordfence:a022860a-07d1-44f8-8c5b-965c855822fd","source":"wordfence","cve":"CVE-2025-22577","title":"Able Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a022860a-07d1-44f8-8c5b-965c855822fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-able-player","name":"Able Player for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:49:03Z"},{"id":"wordfence:a023cdc5-3814-4120-86b2-6a60d385f898","source":"wordfence","cve":"CVE-2020-9455","title":"RegistrationMagic \u2013 Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Email Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a023cdc5-3814-4120-86b2-6a60d385f898?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.3","to_inclusive":true,"patched_in":"4.6.0.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0247ba6-d193-4b7d-969d-0cd239c57faa","source":"wordfence","cve":"CVE-2024-24866","title":"Biteship <= 2.2.24 - Reflected Cross-Site Scripting via biteship_error and biteship_message","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0247ba6-d193-4b7d-969d-0cd239c57faa?source=api-prod","affected":[{"type":"plugin","slug":"biteship","name":"Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship","from":"*","from_inclusive":true,"to":"2.2.24","to_inclusive":true,"patched_in":"2.2.25"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T22:09:37Z"},{"id":"wordfence:a0262f25-39f4-458c-b18e-ec8a0c03110d","source":"wordfence","cve":"CVE-2026-81740","title":"Paytm Payment Gateway <= 2.8.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0262f25-39f4-458c-b18e-ec8a0c03110d?source=api-prod","affected":[{"type":"plugin","slug":"paytm-payments","name":"Paytm Payment Gateway","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:40:01Z"},{"id":"wordfence:a0289458-7ffb-4e9c-a685-7d38664fe701","source":"wordfence","cve":"CVE-2025-39370","title":"iCafe Library <= 1.8.3 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0289458-7ffb-4e9c-a685-7d38664fe701?source=api-prod","affected":[{"type":"plugin","slug":"icafe-library","name":"iCafe Library","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:08:24Z"},{"id":"wordfence:a0297cab-8b6f-4e09-b552-4772c6f72c04","source":"wordfence","cve":"","title":"Elementor Addon Elements <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0297cab-8b6f-4e09-b552-4772c6f72c04?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0299b95-abbf-43c4-81d0-7c383d92cffe","source":"wordfence","cve":"CVE-2022-3923","title":"ActiveCampaign for WooCommerce <= 1.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0299b95-abbf-43c4-81d0-7c383d92cffe?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-for-woocommerce","name":"ActiveCampaign for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a02d9a01-1104-4935-8074-af4367c66278","source":"wordfence","cve":"CVE-2026-5459","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a02d9a01-1104-4935-8074-af4367c66278?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2026-07-07T23:49:15Z","updated":"2026-07-08T12:33:16Z"},{"id":"wordfence:a02ec9a2-6449-4975-9a68-2c8df5e28b31","source":"wordfence","cve":"CVE-2024-35752","title":"Stellissimo Text Box <= 1.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a02ec9a2-6449-4975-9a68-2c8df5e28b31?source=api-prod","affected":[{"type":"plugin","slug":"stellissimo-text-box","name":"Stellissimo Text Box","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:07:40Z"},{"id":"wordfence:a02f0a23-0b2b-4e16-9f6d-ec6302a0d23b","source":"wordfence","cve":"CVE-2024-2507","title":"JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a02f0a23-0b2b-4e16-9f6d-ec6302a0d23b?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2024-03-20T00:00:00Z","updated":"2024-05-31T15:30:50Z"},{"id":"wordfence:a02f4fc4-42ca-4f8e-9c28-bfa69644e7b6","source":"wordfence","cve":"","title":"Booking calendar, Appointment Booking System <= 3.2.8 - Multiple Authenticated(Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a02f4fc4-42ca-4f8e-9c28-bfa69644e7b6?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":false,"patched_in":"3.2.9"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0320c16-de32-484f-b17c-5acf0144a373","source":"wordfence","cve":"CVE-2024-33956","title":"Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0320c16-de32-484f-b17c-5acf0144a373?source=api-prod","affected":[{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T20:30:21Z"},{"id":"wordfence:a0336e35-eb3c-4613-b8a2-fac7b837eb6f","source":"wordfence","cve":"CVE-2022-4483","title":"Insert Pages <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0336e35-eb3c-4613-b8a2-fac7b837eb6f?source=api-prod","affected":[{"type":"plugin","slug":"insert-pages","name":"Insert Pages","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a033ea44-8084-44c1-8e24-bdb1b61c3566","source":"wordfence","cve":"CVE-2026-3831","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 -  Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a033ea44-8084-44c1-8e24-bdb1b61c3566?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-03-31T12:23:38Z","updated":"2026-04-01T01:24:20Z"},{"id":"wordfence:a0349613-d212-49a9-870d-42aa1ec3f975","source":"wordfence","cve":"CVE-2026-57706","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0349613-d212-49a9-870d-42aa1ec3f975?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:33:27Z"},{"id":"wordfence:a035f385-5e96-4d6c-8bcf-7db282b40e2d","source":"wordfence","cve":"CVE-2025-26739","title":"newseqo <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a035f385-5e96-4d6c-8bcf-7db282b40e2d?source=api-prod","affected":[{"type":"theme","slug":"newseqo","name":"newseqo","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:38:45Z"},{"id":"wordfence:a03641f2-fc2b-41df-ad67-0048308273e0","source":"wordfence","cve":"CVE-2026-81799","title":"Return Refund and Exchange For WooCommerce <= 4.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a03641f2-fc2b-41df-ad67-0048308273e0?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2026-09-08T00:00:00Z","updated":"2026-10-23T17:25:08Z"},{"id":"wordfence:a0365d52-8817-4b69-9df3-ac4c5bb6f4f3","source":"wordfence","cve":"","title":"HTML5 jQuery Audio Player <= 2.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0365d52-8817-4b69-9df3-ac4c5bb6f4f3?source=api-prod","affected":[{"type":"plugin","slug":"html5-jquery-audio-player","name":"HTML5 jQuery Audio Player","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a03aef95-dbc8-40c6-aec6-0c7ba289b0e8","source":"wordfence","cve":"CVE-2026-112847","title":"ZenSoul <= 1.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a03aef95-dbc8-40c6-aec6-0c7ba289b0e8?source=api-prod","affected":[{"type":"theme","slug":"zensoul","name":"ZenSoul - Spa Salon & Wellness WordPress Theme + Shop & AI","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T16:58:56Z"},{"id":"wordfence:a03b4c19-85fa-47ad-b9ae-b466f8e5ca96","source":"wordfence","cve":"CVE-2024-2797","title":"MailerLite \u2013 Signup forms (official) <= 1.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a03b4c19-85fa-47ad-b9ae-b466f8e5ca96?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:27Z"},{"id":"wordfence:a03e825f-bccf-4e1a-b3f5-86b0c6958b79","source":"wordfence","cve":"CVE-2025-58974","title":"WPComplete <= 2.9.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a03e825f-bccf-4e1a-b3f5-86b0c6958b79?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.2","to_inclusive":true,"patched_in":"2.9.5.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:02:23Z"},{"id":"wordfence:a03f0780-796c-41a3-8f06-04f76e0da2da","source":"wordfence","cve":"CVE-2023-31219","title":"Download Monitor <= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a03f0780-796c-41a3-8f06-04f76e0da2da?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0413f69-7251-4c01-b2e0-c8638d797652","source":"wordfence","cve":"","title":"AMP ToolBox <= 2.1.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0413f69-7251-4c01-b2e0-c8638d797652?source=api-prod","affected":[{"type":"plugin","slug":"amp-toolbox","name":"AMP Toolbox","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2017-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a041f15c-0e30-459b-8df7-0465c0bc268a","source":"wordfence","cve":"CVE-2026-15991","title":"File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a041f15c-0e30-459b-8df7-0465c0bc268a?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"6.0","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2026-08-05T15:03:47Z","updated":"2026-08-13T14:21:34Z"},{"id":"wordfence:a042b1be-d39f-4d28-8566-d9974becdd40","source":"wordfence","cve":"CVE-2022-1585","title":"Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download","severity":"critical","cvss":9.8,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a042b1be-d39f-4d28-8566-d9974becdd40?source=api-prod","affected":[{"type":"plugin","slug":"project-source-code-download","name":"WordPress project source code download","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a04652bc-f815-4840-b791-3fb12d3b4f7c","source":"wordfence","cve":"CVE-2024-33697","title":"CF7 File Download \u2013 File Download for CF7 <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04652bc-f815-4840-b791-3fb12d3b4f7c?source=api-prod","affected":[{"type":"plugin","slug":"cf7-file-download","name":"CF7 File Download \u2013 File Download for CF7","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:39:57Z"},{"id":"wordfence:a04870e0-41c8-464b-b30e-0bf7900e1433","source":"wordfence","cve":"CVE-2019-19980","title":"Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization to Test Email","severity":"medium","cvss":4.3,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04870e0-41c8-464b-b30e-0bf7900e1433?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0489172-279c-4397-a937-bca4840a196f","source":"wordfence","cve":"CVE-2025-4965","title":"WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0489172-279c-4397-a937-bca4840a196f?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.5"}],"published":"2025-06-18T00:00:00Z","updated":"2025-07-22T05:26:55Z"},{"id":"wordfence:a04db024-5198-490f-bf5f-d5bad1b21ce4","source":"wordfence","cve":"CVE-2025-2289","title":"Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04db024-5198-490f-bf5f-d5bad1b21ce4?source=api-prod","affected":[{"type":"theme","slug":"zegen","name":"Zegen - Church WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T16:37:52Z","updated":"2025-03-14T05:24:02Z"},{"id":"wordfence:a04e5086-1ddc-4618-90fe-2cd6e6d232c4","source":"wordfence","cve":"CVE-2025-58216","title":"WP Thumbtack Review Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04e5086-1ddc-4618-90fe-2cd6e6d232c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-thumbtack-review-slider","name":"WP Thumbtack Review Slider","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:20:28Z"},{"id":"wordfence:a04e6a18-c1ce-4204-b9ca-31ea4106bd7c","source":"wordfence","cve":"CVE-2026-57772","title":"WP Inventory Manager <= 2.5.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04e6a18-c1ce-4204-b9ca-31ea4106bd7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-07-02T00:00:00Z","updated":"2026-09-16T17:31:08Z"},{"id":"wordfence:a04f074c-448d-4c5f-ae46-0ad1a3effdb4","source":"wordfence","cve":"CVE-2024-13350","title":"SearchIQ \u2013 The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a04f074c-448d-4c5f-ae46-0ad1a3effdb4?source=api-prod","affected":[{"type":"plugin","slug":"searchiq","name":"SearchIQ \u2013 The Search Solution","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-03-04T19:17:17Z","updated":"2025-03-10T14:15:42Z"},{"id":"wordfence:a051d96a-fe82-4223-839b-24cbb5b300d1","source":"wordfence","cve":"CVE-2026-40791","title":"WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a051d96a-fe82-4223-839b-24cbb5b300d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.46","to_inclusive":true,"patched_in":"1.2.47"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:51:49Z"},{"id":"wordfence:a054394c-07fa-4961-89f0-1d0fceac736b","source":"wordfence","cve":"CVE-2025-30959","title":"Product XML Feed Manager for WooCommerce <= 2.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a054394c-07fa-4961-89f0-1d0fceac736b?source=api-prod","affected":[{"type":"plugin","slug":"product-xml-feeds-for-woocommerce","name":"Product XML Feed Manager for WooCommerce \u2013 Google Shopping, Social Sites, Skroutz & More","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T16:00:21Z"},{"id":"wordfence:a055e6ca-6ef0-4c40-80f4-14a5a19a6db6","source":"wordfence","cve":"CVE-2025-57930","title":"Double the Donation <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a055e6ca-6ef0-4c40-80f4-14a5a19a6db6?source=api-prod","affected":[{"type":"plugin","slug":"double-the-donation","name":"Double the Donation \u2013 A workplace giving tool","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:23:38Z"},{"id":"wordfence:a057ad05-0ed7-48c4-9dc1-0e7b1d3cb270","source":"wordfence","cve":"CVE-2023-46195","title":"Headline Analyzer <= 1.3.1 - Missing Authorization via REST APIs","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a057ad05-0ed7-48c4-9dc1-0e7b1d3cb270?source=api-prod","affected":[{"type":"plugin","slug":"headline-analyzer","name":"Headline Analyzer","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a05815dc-f4e7-4aa5-a4a0-db11c79f744e","source":"wordfence","cve":"CVE-2026-86796","title":"Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a05815dc-f4e7-4aa5-a4a0-db11c79f744e?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:46:07Z"},{"id":"wordfence:a058e6bf-109f-4985-8aad-08858553c4c3","source":"wordfence","cve":"CVE-2025-2158","title":"WordPress Review Plugin: The Ultimate Solution for Building a Review Website <= 5.3.5 - Authenticated (Contributor+) Local File Inclusion via Post Custom Fields","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a058e6bf-109f-4985-8aad-08858553c4c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-review","name":"WordPress Review Plugin: The Ultimate Solution for Building a Review Website","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-09T00:00:00Z","updated":"2025-05-10T09:23:01Z"},{"id":"wordfence:a0598208-bfaf-40da-8e83-15c22a87fa06","source":"wordfence","cve":"CVE-2025-22635","title":"Eventer <= 3.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0598208-bfaf-40da-8e83-15c22a87fa06?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T22:41:23Z"},{"id":"wordfence:a05b1d00-386f-4914-80e6-92d3e9721dc5","source":"wordfence","cve":"CVE-2018-11366","title":"Loginizer 1.3.8-1.3.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a05b1d00-386f-4914-80e6-92d3e9721dc5?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"1.3.8","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2018-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a06147c7-a96e-4f12-9a67-23ca82b09942","source":"wordfence","cve":"CVE-2024-32142","title":"Ovic Responsive WPBakery <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a06147c7-a96e-4f12-9a67-23ca82b09942?source=api-prod","affected":[{"type":"plugin","slug":"ovic-vc-addon","name":"Ovic Responsive WPBakery","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T14:22:45Z"},{"id":"wordfence:a063fab3-6d52-4f2a-b51f-b76fa2d4711c","source":"wordfence","cve":"CVE-2025-12577","title":"Listar \u2013 Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a063fab3-6d52-4f2a-b51f-b76fa2d4711c?source=api-prod","affected":[{"type":"plugin","slug":"listar-directory-listing","name":"Listar \u2013 Directory Listing & Classifieds WordPress Plugin","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:36:30Z","updated":"2025-12-06T05:49:31Z"},{"id":"wordfence:a06812c5-43db-4c32-a9fb-f7b86900a741","source":"wordfence","cve":"","title":"Contact Form DB <= 2.8.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a06812c5-43db-4c32-a9fb-f7b86900a741?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-to-database-extension","name":"Contact Form DB","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":false,"patched_in":"2.8.18"}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a068c493-8c2e-4f5c-bc68-772b2c79c528","source":"wordfence","cve":"CVE-2026-28190","title":"ProLancer Element <= 1.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a068c493-8c2e-4f5c-bc68-772b2c79c528?source=api-prod","affected":[{"type":"plugin","slug":"prolancer-element","name":"Prolancer Element","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:18:54Z"},{"id":"wordfence:a068e411-d81f-4162-84e9-f1e9868963f9","source":"wordfence","cve":"","title":"Supreme Directory < 1.1.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a068e411-d81f-4162-84e9-f1e9868963f9?source=api-prod","affected":[{"type":"theme","slug":"supreme-directory","name":"Supreme Directory","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2018-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0695f66-5932-4ca4-86d3-ef53f1a669b5","source":"wordfence","cve":"","title":"Oberliga Theme (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0695f66-5932-4ca4-86d3-ef53f1a669b5?source=api-prod","affected":[{"type":"theme","slug":"oberliga_theme","name":"Oberliga Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a06bba7f-0259-4b87-b3fe-6ad8318fda7d","source":"wordfence","cve":"CVE-2024-8120","title":"ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a06bba7f-0259-4b87-b3fe-6ad8318fda7d?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-24T02:32:19Z"},{"id":"wordfence:a06e1a22-f660-401b-bfbf-0064a9220c26","source":"wordfence","cve":"CVE-2026-97020","title":"PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a06e1a22-f660-401b-bfbf-0064a9220c26?source=api-prod","affected":[{"type":"plugin","slug":"pomo-editor","name":"PO/MO Editor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:34:55Z","updated":"2026-10-14T03:40:01Z"},{"id":"wordfence:a07070b6-37d2-4ccf-ae81-a08ac7b76241","source":"wordfence","cve":"CVE-2026-15402","title":"Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07070b6-37d2-4ccf-ae81-a08ac7b76241?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T17:12:36Z","updated":"2026-09-15T06:07:32Z"},{"id":"wordfence:a0707c92-96e9-444a-8a13-52d49c9e3f5c","source":"wordfence","cve":"CVE-2024-3956","title":"Pods \u2013 Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0707c92-96e9-444a-8a13-52d49c9e3f5c?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.1.1"}],"published":"2024-05-09T20:29:15Z","updated":"2024-05-10T08:32:34Z"},{"id":"wordfence:a070f19e-9f65-499d-87c0-65be12d4be84","source":"wordfence","cve":"CVE-2026-3574","title":"Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a070f19e-9f65-499d-87c0-65be12d4be84?source=api-prod","affected":[{"type":"plugin","slug":"experto-custom-dashboard","name":"Experto Dashboard for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T02:25:06Z"},{"id":"wordfence:a073c2f1-88d3-4410-b9f5-45b04becbfcb","source":"wordfence","cve":"CVE-2023-2743","title":"WP ERP <= 1.12.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a073c2f1-88d3-4410-b9f5-45b04becbfcb?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":false,"patched_in":"1.12.4"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a077e95f-7912-4b94-89f3-54f37adfcd8e","source":"wordfence","cve":"CVE-2023-36691","title":"WebwinkelKeur <= 3.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a077e95f-7912-4b94-89f3-54f37adfcd8e?source=api-prod","affected":[{"type":"plugin","slug":"webwinkelkeur","name":"WebwinkelKeur: Webshop keurmerk & reviews for WordPress","from":"*","from_inclusive":true,"to":"3.25","to_inclusive":false,"patched_in":"3.25"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a07a643e-1a4b-47fe-9e4a-b4cc070bce74","source":"wordfence","cve":"CVE-2016-10978","title":"Tag Miner (Automatic Tag Extraction) < 1.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07a643e-1a4b-47fe-9e4a-b4cc070bce74?source=api-prod","affected":[{"type":"plugin","slug":"fossura-tag-miner","name":"Tag Miner (Automatic Tag Extraction)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2015-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a07a8cd6-8b01-4f65-abbd-7c93560aa437","source":"wordfence","cve":"CVE-2025-25142","title":"WP Less Compiler <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07a8cd6-8b01-4f65-abbd-7c93560aa437?source=api-prod","affected":[{"type":"plugin","slug":"wp-less-compiler","name":"WP Less Compiler","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-14T17:11:35Z"},{"id":"wordfence:a07bc541-2113-43db-acdf-9ecb00dd50e9","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling","severity":"low","cvss":3.7,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07bc541-2113-43db-acdf-9ecb00dd50e9?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a07bd233-902c-402c-9055-f3085246da78","source":"wordfence","cve":"CVE-2022-3892","title":"WP OAuth Server (OAuth Authentication) <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07bd233-902c-402c-9055-f3085246da78?source=api-prod","affected":[{"type":"plugin","slug":"oauth2-provider","name":"WP OAuth Server (OAuth Authentication)","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a07ca145-9349-4961-9e66-4c59ea9b5069","source":"wordfence","cve":"CVE-2022-0661","title":"Ad Injection <= 1.2.0.19 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07ca145-9349-4961-9e66-4c59ea9b5069?source=api-prod","affected":[{"type":"plugin","slug":"ad-injection","name":"Ad Injection","from":"*","from_inclusive":true,"to":"1.2.0.19","to_inclusive":true,"patched_in":""}],"published":"2022-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a07df12c-375d-4a98-b5f6-aa14cfd432a4","source":"wordfence","cve":"CVE-2026-19711","title":"Premium Packages \u2013 Sell Digital Products Securely < 7.0.7 - Authenticated (Subscriber+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07df12c-375d-4a98-b5f6-aa14cfd432a4?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.0.7","to_inclusive":false,"patched_in":"7.0.7"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:25:01Z"},{"id":"wordfence:a07e05b8-590e-41fa-acf7-bcaac4ee8615","source":"wordfence","cve":"CVE-2026-120659","title":"Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07e05b8-590e-41fa-acf7-bcaac4ee8615?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.14","to_inclusive":true,"patched_in":"3.2.15"}],"published":"2026-11-05T20:45:36Z","updated":"2026-11-06T09:38:14Z"},{"id":"wordfence:a07ebb3a-d670-4339-a0a8-82ce661e2552","source":"wordfence","cve":"CVE-2024-11719","title":"tarteaucitron.js for WordPress < 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a07ebb3a-d670-4339-a0a8-82ce661e2552?source=api-prod","affected":[{"type":"plugin","slug":"tarteaucitron-wp","name":"tarteaucitron.js for WordPress","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":false,"patched_in":"0.3.0"}],"published":"2025-03-03T00:00:00Z","updated":"2026-02-25T19:06:34Z"},{"id":"wordfence:a08046a5-69ac-430d-af0a-592305543ffb","source":"wordfence","cve":"CVE-2024-12282","title":"WordPress\u8fde\u63a5\u5fae\u535a <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08046a5-69ac-430d-af0a-592305543ffb?source=api-prod","affected":[{"type":"plugin","slug":"wp-connect","name":"WordPress\u8fde\u63a5\u5fae\u535a","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T18:46:35Z"},{"id":"wordfence:a0829035-7782-456d-acd5-639051d7ebc3","source":"wordfence","cve":"CVE-2024-32591","title":"Backend Designer <= 1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0829035-7782-456d-acd5-639051d7ebc3?source=api-prod","affected":[{"type":"plugin","slug":"backend-designer","name":"Backend Designer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T15:48:20Z"},{"id":"wordfence:a082a8bc-1dcc-4a5c-9a12-26a020c344ce","source":"wordfence","cve":"CVE-2025-31445","title":"Pages Order <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a082a8bc-1dcc-4a5c-9a12-26a020c344ce?source=api-prod","affected":[{"type":"plugin","slug":"pages-order","name":"Pages Order","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:01:33Z"},{"id":"wordfence:a0831971-3862-4774-8375-fe5870ef82d9","source":"wordfence","cve":"CVE-2021-25034","title":"WP User \u2013 Custom Registration Forms, Login and User Profile < 7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0831971-3862-4774-8375-fe5870ef82d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-user","name":"WP User \u2013 Custom Registration Forms, Login and User Profile","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":false,"patched_in":"7.0"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0850b88-09f0-4da8-a9be-1b4aacf610e0","source":"wordfence","cve":"","title":"Contact Form Email < 1.0.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0850b88-09f0-4da8-a9be-1b4aacf610e0?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2014-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a089026a-5da9-467c-a1e4-622bb74363e2","source":"wordfence","cve":"CVE-2024-11069","title":"WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a089026a-5da9-467c-a1e4-622bb74363e2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gdpr","name":"WordPress GDPR","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-11-17T00:00:00Z","updated":"2024-11-19T07:35:26Z"},{"id":"wordfence:a08d9118-3615-4f8e-a1cc-ba7e7873b7e5","source":"wordfence","cve":"CVE-2026-12241","title":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08d9118-3615-4f8e-a1cc-ba7e7873b7e5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.51","to_inclusive":true,"patched_in":"2.52"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-01T04:27:35Z"},{"id":"wordfence:a08e4147-9a57-4936-9a18-02110c79a8bb","source":"wordfence","cve":"CVE-2026-8942","title":"MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08e4147-9a57-4936-9a18-02110c79a8bb?source=api-prod","affected":[{"type":"plugin","slug":"metamagic","name":"MetaMagic SEO Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T18:57:11Z","updated":"2026-05-27T07:45:56Z"},{"id":"wordfence:a08ea797-a836-4a21-bfca-2c05810d25cd","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 2.00 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08ea797-a836-4a21-bfca-2c05810d25cd?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":false,"patched_in":"2.10"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a08f7429-af93-4fc7-b147-3d42eced564a","source":"wordfence","cve":"CVE-2026-52710","title":"GIFTiT \u2013 Free Gifts for WooCommerce <= 4.5 - Unauthenticated Arbitrary Shortcode Injection","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08f7429-af93-4fc7-b147-3d42eced564a?source=api-prod","affected":[{"type":"plugin","slug":"ithemeland-free-gifts-for-woo","name":"GIFTiT \u2013 Free Gifts for WooCommerce","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:57:58Z"},{"id":"wordfence:a08fa649-3092-4c26-a009-2dd576b9b1ac","source":"wordfence","cve":"CVE-2020-36719","title":"ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a08fa649-3092-4c26-a009-2dd576b9b1ac?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0906540-46fc-4f76-9265-cb87c6340fad","source":"wordfence","cve":"CVE-2025-5813","title":"Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0906540-46fc-4f76-9265-cb87c6340fad?source=api-prod","affected":[{"type":"plugin","slug":"import-products-to-wc","name":"Amazon Products to WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T14:07:55Z","updated":"2025-06-26T02:22:23Z"},{"id":"wordfence:a09113d3-8be0-45fa-b1d7-4eb6ebb1780e","source":"wordfence","cve":"CVE-2024-9060","title":"AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a09113d3-8be0-45fa-b1d7-4eb6ebb1780e?source=api-prod","affected":[{"type":"plugin","slug":"avif-support","name":"AVIF Uploader \u2013 Upload, Display and Fix AVIF Images","from":"1.1.0","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-09-30T21:14:05Z","updated":"2025-05-30T18:57:27Z"},{"id":"wordfence:a092266b-bd7f-424d-b8c4-d79e4811e6c9","source":"wordfence","cve":"CVE-2023-45762","title":"Responsive Column Widgets <= 1.2.7 - Open Redirect via responsive_column_widgets_link","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a092266b-bd7f-424d-b8c4-d79e4811e6c9?source=api-prod","affected":[{"type":"plugin","slug":"responsive-column-widgets","name":"Responsive Column Widgets","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a09298b3-3b5c-4a92-9332-79ff83234479","source":"wordfence","cve":"CVE-2024-12811","title":"Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a09298b3-3b5c-4a92-9332-79ff83234479?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-02-27T00:00:00Z","updated":"2025-04-09T05:05:54Z"},{"id":"wordfence:a09659bc-e42b-4f08-a1a1-23e226be1be9","source":"wordfence","cve":"CVE-2025-8483","title":"Discussion Board \u2013 WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a09659bc-e42b-4f08-a1a1-23e226be1be9?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:a0975cfd-c3d3-4198-a3ee-6bdb40970104","source":"wordfence","cve":"CVE-2026-121862","title":"Knowledge Building < 0.7.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0975cfd-c3d3-4198-a3ee-6bdb40970104?source=api-prod","affected":[{"type":"plugin","slug":"knowledge-building","name":"Knowledge Building","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":false,"patched_in":"0.7.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:31Z"},{"id":"wordfence:a09771da-a423-42ba-8f59-5c3bd189d9d3","source":"wordfence","cve":"CVE-2021-24241","title":"Advanced Custom Fields Pro <= 5.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a09771da-a423-42ba-8f59-5c3bd189d9d3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":false,"patched_in":"5.9.1"}],"published":"2021-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a098e357-d93d-4063-9309-7cf1bf493552","source":"wordfence","cve":"CVE-2026-94229","title":"TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a098e357-d93d-4063-9309-7cf1bf493552?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"1.1.9","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:01:57Z"},{"id":"wordfence:a0998721-7b5e-4657-894c-52dfadde5d4a","source":"wordfence","cve":"CVE-2025-68027","title":"Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0998721-7b5e-4657-894c-52dfadde5d4a?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T16:00:35Z"},{"id":"wordfence:a09d45fd-13e7-4180-bb3b-bd5ede21324b","source":"wordfence","cve":"CVE-2026-24977","title":"Organici Library <= 2.1.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a09d45fd-13e7-4180-bb3b-bd5ede21324b?source=api-prod","affected":[{"type":"plugin","slug":"noo-organici-library","name":"Organici Library","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:07:05Z"},{"id":"wordfence:a0a43e7c-f1c1-4b29-86d9-64d4c2e8b8aa","source":"wordfence","cve":"CVE-2024-12400","title":"Tour Master - Tour Booking, Travel, Hotel <= 5.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a43e7c-f1c1-4b29-86d9-64d4c2e8b8aa?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:37:10Z"},{"id":"wordfence:a0a5259d-7340-48b5-a0cf-f68abdb21156","source":"wordfence","cve":"CVE-2026-9766","title":"Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a5259d-7340-48b5-a0cf-f68abdb21156?source=api-prod","affected":[{"type":"plugin","slug":"empik-for-woocommerce","name":"Empik for Woocommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-09-18T19:57:52Z","updated":"2026-09-21T18:44:59Z"},{"id":"wordfence:a0a5ebb4-319b-421e-bf69-a9403ca96e85","source":"wordfence","cve":"CVE-2025-49433","title":"Supermalink <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a5ebb4-319b-421e-bf69-a9403ca96e85?source=api-prod","affected":[{"type":"plugin","slug":"supermalink","name":"Supermalink","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T19:32:40Z"},{"id":"wordfence:a0a63fce-aeb6-4325-9185-eb4b17268a5a","source":"wordfence","cve":"CVE-2026-89303","title":"Post Voting System <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a63fce-aeb6-4325-9185-eb4b17268a5a?source=api-prod","affected":[{"type":"plugin","slug":"post-voting-system","name":"Post Voting System","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:42:54Z"},{"id":"wordfence:a0aa2a10-da05-41e4-bbfa-938341919b5d","source":"wordfence","cve":"","title":"Easy Digital Downloads <= 2.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0aa2a10-da05-41e4-bbfa-938341919b5d?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2021-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0ac8a41-553e-473b-82a7-226de17e472d","source":"wordfence","cve":"CVE-2024-13860","title":"BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ac8a41-553e-473b-82a7-226de17e472d?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.8.50","to_inclusive":true,"patched_in":"2.8.51"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-09T17:53:57Z"},{"id":"wordfence:a0acd462-2f0b-4ced-8a1a-960f9527d47e","source":"wordfence","cve":"CVE-2026-62134","title":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0acd462-2f0b-4ced-8a1a-960f9527d47e?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:30:21Z"},{"id":"wordfence:a0adfd13-a9f1-4bec-96ec-6a51cd08e4ea","source":"wordfence","cve":"CVE-2024-11945","title":"Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0adfd13-a9f1-4bec-96ec-6a51cd08e4ea?source=api-prod","affected":[{"type":"plugin","slug":"email-reminders","name":"Email Reminders","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-12-09T20:57:27Z","updated":"2024-12-10T09:24:26Z"},{"id":"wordfence:a0af6cea-a667-4339-bc9f-e4c0d0e36848","source":"wordfence","cve":"CVE-2025-49959","title":"bbPress Move Topics <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0af6cea-a667-4339-bc9f-e4c0d0e36848?source=api-prod","affected":[{"type":"plugin","slug":"bbp-move-topics","name":"bbPress Move Topics","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-07-16T00:00:00Z","updated":"2025-11-04T18:44:08Z"},{"id":"wordfence:a0b14d91-f8f9-41df-b2eb-12792fb3a197","source":"wordfence","cve":"","title":"Tutor LMS <= 1.9.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b14d91-f8f9-41df-b2eb-12792fb3a197?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0b1e907-0c31-4b40-b3f9-0ac665f3394a","source":"wordfence","cve":"","title":"Smartkit <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b1e907-0c31-4b40-b3f9-0ac665f3394a?source=api-prod","affected":[{"type":"plugin","slug":"smartkit","name":"Smartkit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0b37050-b320-4c59-8d93-db611aa55283","source":"wordfence","cve":"CVE-2025-67953","title":"Booking Activities <= 1.16.44 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b37050-b320-4c59-8d93-db611aa55283?source=api-prod","affected":[{"type":"plugin","slug":"booking-activities","name":"Booking Activities","from":"*","from_inclusive":true,"to":"1.16.44","to_inclusive":true,"patched_in":"1.16.45"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T15:55:20Z"},{"id":"wordfence:a0b5b6bc-5f4f-4cf8-987e-b20e8354d863","source":"wordfence","cve":"CVE-2026-7796","title":"EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5b6bc-5f4f-4cf8-987e-b20e8354d863?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-06-05T14:17:32Z","updated":"2026-06-06T02:28:36Z"},{"id":"wordfence:a0b5f2ae-8cd9-4363-9d68-8a59f81a061b","source":"wordfence","cve":"CVE-2026-122041","title":"Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5f2ae-8cd9-4363-9d68-8a59f81a061b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-field-editor-pro","name":"Checkout Field Editor for WooCommerce (Pro)","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-11-06T23:43:27Z","updated":"2026-11-07T12:27:06Z"},{"id":"wordfence:a0b9499b-3017-46a6-80d5-104d203b77f0","source":"wordfence","cve":"CVE-2024-11380","title":"Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b9499b-3017-46a6-80d5-104d203b77f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-mini-program","name":"Mini Program API","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:27:24Z","updated":"2024-12-07T11:09:53Z"},{"id":"wordfence:a0bb1036-3e45-4ac9-b920-3b9629a3a724","source":"wordfence","cve":"CVE-2024-5970","title":"MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0bb1036-3e45-4ac9-b920-3b9629a3a724?source=api-prod","affected":[{"type":"plugin","slug":"maxgalleria","name":"MaxGalleria","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2024-06-18T08:45:26Z","updated":"2024-06-18T21:36:57Z"},{"id":"wordfence:a0bc1909-5002-44ab-9a5e-694c4ef946e2","source":"wordfence","cve":"CVE-2021-24392","title":"WordPress Membership SwiftCloud.io <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0bc1909-5002-44ab-9a5e-694c4ef946e2?source=api-prod","affected":[{"type":"plugin","slug":"club-management-software","name":"WordPress Membership SwiftCloud.io","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0c04f12-7602-4d57-aa0c-54ecbf7f8875","source":"wordfence","cve":"CVE-2023-5911","title":"WP Custom Cursors | WordPress Cursor <= 3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c04f12-7602-4d57-aa0c-54ecbf7f8875?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-07T00:00:00Z","updated":"2024-02-06T17:52:17Z"},{"id":"wordfence:a0c14e4e-9437-4e98-b720-72d6aab9e05f","source":"wordfence","cve":"CVE-2024-4530","title":"Business Card <= 1.0.0 - Cross-Site Request Forgery to Category Edit","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c14e4e-9437-4e98-b720-72d6aab9e05f?source=api-prod","affected":[{"type":"plugin","slug":"business-card-by-esterox-100","name":"Business Card","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T00:27:53Z"},{"id":"wordfence:a0c2ba36-8eb0-4a49-9304-2922f248a89d","source":"wordfence","cve":"CVE-2025-69352","title":"The Events Calendar <= 6.15.12.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c2ba36-8eb0-4a49-9304-2922f248a89d?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.12.2","to_inclusive":true,"patched_in":"6.15.13"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-14T15:09:42Z"},{"id":"wordfence:a0c4ef62-1274-4cf3-88fc-ccabedbbe26c","source":"wordfence","cve":"CVE-2022-2094","title":"Yellow Yard Searchbar <= 2.7.27 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c4ef62-1274-4cf3-88fc-ccabedbbe26c?source=api-prod","affected":[{"type":"plugin","slug":"yellow-yard","name":"Yellow Yard Searchbar","from":"*","from_inclusive":true,"to":"2.7.27","to_inclusive":true,"patched_in":"2.8.12"}],"published":"2022-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0c67346-534a-4b67-a904-fa148703707a","source":"wordfence","cve":"CVE-2026-78006","title":"The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c67346-534a-4b67-a904-fa148703707a?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.4","to_inclusive":true,"patched_in":"6.17.4.1"}],"published":"2026-09-11T18:39:45Z","updated":"2026-09-14T15:12:17Z"},{"id":"wordfence:a0c68bb6-77a2-4232-923a-37f2c0327743","source":"wordfence","cve":"CVE-2024-11353","title":"SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c68bb6-77a2-4232-923a-37f2c0327743?source=api-prod","affected":[{"type":"plugin","slug":"clicksend-lead-capture-form","name":"SMS for Lead Capture Forms","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T11:57:31Z","updated":"2024-12-07T01:45:51Z"},{"id":"wordfence:a0c68e1e-5255-4e79-a6d9-a2021836e584","source":"wordfence","cve":"CVE-2026-1843","title":"Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c68e1e-5255-4e79-a6d9-a2021836e584?source=api-prod","affected":[{"type":"plugin","slug":"wp-cloudflare-page-cache","name":"Super Page Cache \u2013 Cloudflare Cache, Page Speed & Core Web Vitals","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-02-13T19:48:00Z","updated":"2026-02-14T08:26:51Z"},{"id":"wordfence:a0c74807-b85c-478e-bebf-1f0b46a21c11","source":"wordfence","cve":"CVE-2024-6872","title":"Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! \u2013 TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c74807-b85c-478e-bebf-1f0b46a21c11?source=api-prod","affected":[{"type":"plugin","slug":"templatespare","name":"TemplateSpare \u2013 No-Code Website Templates, Demo Importer & Site Migration for News, Magazine & Blog","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-03T11:37:38Z"},{"id":"wordfence:a0c962ba-43ef-4713-acd9-1e499f857df8","source":"wordfence","cve":"CVE-2024-2579","title":"Tracking Code Manager <= 2.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c962ba-43ef-4713-acd9-1e499f857df8?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T15:03:39Z"},{"id":"wordfence:a0caefd6-b54f-4318-81e2-0b71f2cf5019","source":"wordfence","cve":"CVE-2026-119514","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1234 - Authenticated (Technician+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0caefd6-b54f-4318-81e2-0b71f2cf5019?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1234","to_inclusive":true,"patched_in":"4.1235"}],"published":"2026-11-07T09:43:36Z","updated":"2026-11-10T19:33:00Z"},{"id":"wordfence:a0cb0970-7e21-44ff-bbca-4b3e18f4466e","source":"wordfence","cve":"CVE-2012-3576","title":"IDB Ecommerce (wpStoreCart 5) < 2.5.30 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0cb0970-7e21-44ff-bbca-4b3e18f4466e?source=api-prod","affected":[{"type":"plugin","slug":"wpstorecart","name":"IDB Ecommerce (wpStoreCart 5)","from":"*","from_inclusive":true,"to":"2.5.29","to_inclusive":true,"patched_in":"2.5.30"}],"published":"2012-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0ccb39b-faf1-428b-bfa7-c30d402bd34d","source":"wordfence","cve":"CVE-2020-35012","title":"Events Manager <= 5.9.7.3 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ccb39b-faf1-428b-bfa7-c30d402bd34d?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.7.3","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2020-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0cd4441-7e25-46dd-82ff-91d10b8eacd8","source":"wordfence","cve":"CVE-2024-54331","title":"I Plant A Tree <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0cd4441-7e25-46dd-82ff-91d10b8eacd8?source=api-prod","affected":[{"type":"plugin","slug":"i-plant-a-tree","name":"I Plant A Tree","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:10:09Z"},{"id":"wordfence:a0d38788-5f90-4ab1-8df1-1c67c1052e6d","source":"wordfence","cve":"CVE-2026-15651","title":"WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0d38788-5f90-4ab1-8df1-1c67c1052e6d?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"14.6","to_inclusive":true,"patched_in":"14.7"}],"published":"2026-07-15T19:43:21Z","updated":"2026-07-16T07:51:04Z"},{"id":"wordfence:a0d434ed-7ced-4a13-aa41-3be0abaebdd8","source":"wordfence","cve":"CVE-2026-39802","title":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.13 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0d434ed-7ced-4a13-aa41-3be0abaebdd8?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.13","to_inclusive":true,"patched_in":"2.3.14"}],"published":"2026-10-06T00:00:00Z","updated":"2026-11-10T23:20:55Z"},{"id":"wordfence:a0d44294-be44-4e80-9974-9074807a421f","source":"wordfence","cve":"CVE-2026-27073","title":"Addi \u2013 Cuotas que se adaptan a ti <= 2.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0d44294-be44-4e80-9974-9074807a421f?source=api-prod","affected":[{"type":"plugin","slug":"buy-now-pay-later-addi","name":"Addi \u2013 Cuotas que se adaptan a ti","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-07-08T20:46:48Z"},{"id":"wordfence:a0d8ec3e-b16c-416f-ac18-93ecb5a63313","source":"wordfence","cve":"CVE-2024-13619","title":"LifterLMS <= 8.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0d8ec3e-b16c-416f-ac18-93ecb5a63313?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":"8.0.1"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:43:00Z"},{"id":"wordfence:a0d93ee4-63e1-4fa7-9346-f56354124b9a","source":"wordfence","cve":"CVE-2023-28992","title":"Coupon Affiliates <= 5.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0d93ee4-63e1-4fa7-9346-f56354124b9a?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0da1ed2-3ffc-4da8-a8b4-8f5544ed157b","source":"wordfence","cve":"CVE-2024-32811","title":"USPS Shipping for WooCommerce \u2013 Live Rates <= 1.9.4 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0da1ed2-3ffc-4da8-a8b4-8f5544ed157b?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping-usps","name":"Shipping Live Rates for USPS for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:18:56Z"},{"id":"wordfence:a0da53ab-c750-4ff4-b3d1-49b6603182ae","source":"wordfence","cve":"CVE-2026-86707","title":"Private Feed Key <= 0.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0da53ab-c750-4ff4-b3d1-49b6603182ae?source=api-prod","affected":[{"type":"plugin","slug":"private-feed-key","name":"Private Feed Key","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:42:15Z"},{"id":"wordfence:a0db9693-df56-44d3-9167-c21e868c3f88","source":"wordfence","cve":"CVE-2026-5924","title":"Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0db9693-df56-44d3-9167-c21e868c3f88?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"2.1.3","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-09-15T15:12:09Z","updated":"2026-09-23T06:42:04Z"},{"id":"wordfence:a0de0b28-fbad-4fcf-a7ab-35c545c19a4a","source":"wordfence","cve":"CVE-2025-13977","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0de0b28-fbad-4fcf-a7ab-35c545c19a4a?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2025-12-16T15:08:24Z","updated":"2025-12-17T03:20:19Z"},{"id":"wordfence:a0de486b-1ad9-440f-b2f8-b0a2a9af4d0f","source":"wordfence","cve":"","title":"WPTouch < 3.7 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0de486b-1ad9-440f-b2f8-b0a2a9af4d0f?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"}],"published":"2015-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0e28aca-b95f-4041-a1ea-4be84dc55923","source":"wordfence","cve":"CVE-2020-35748","title":"FV Flowplayer Video Player <= 7.4.37.727 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e28aca-b95f-4041-a1ea-4be84dc55923?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.4.37.727","to_inclusive":true,"patched_in":"7.4.38.727"}],"published":"2021-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0e3668a-b76a-40b6-8697-c62a00904b7a","source":"wordfence","cve":"CVE-2025-60139","title":"Sendle Shipping <= 6.02 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e3668a-b76a-40b6-8697-c62a00904b7a?source=api-prod","affected":[{"type":"plugin","slug":"official-sendle-shipping-method","name":"Sendle Shipping Plugin","from":"*","from_inclusive":true,"to":"6.02","to_inclusive":true,"patched_in":"6.03"}],"published":"2025-09-26T00:00:00Z","updated":"2025-12-19T15:08:34Z"},{"id":"wordfence:a0e54185-a917-49cd-b99d-5b773a7ed06a","source":"wordfence","cve":"CVE-2022-44589","title":"miniOrange's Google Authenticator <= 5.6.1 - Sensitive Data Exposure of Multifactor Backup Codes","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e54185-a917-49cd-b99d-5b773a7ed06a?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f","source":"wordfence","cve":"CVE-2024-10900","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.3.6","to_inclusive":true,"patched_in":"5.9.3.7"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:54Z"},{"id":"wordfence:a0e80e63-f4f7-44cc-ae29-72e7847d7448","source":"wordfence","cve":"CVE-2024-3243","title":"Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e80e63-f4f7-44cc-ae29-72e7847d7448?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.46.0","to_inclusive":true,"patched_in":"5.47.0"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-16T12:51:46Z"},{"id":"wordfence:a0e9e803-8f52-4210-9c28-fe0438487a4b","source":"wordfence","cve":"CVE-2026-28078","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e9e803-8f52-4210-9c28-fe0438487a4b?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:26:23Z"},{"id":"wordfence:a0ea0d46-a6aa-4704-8e4e-051bedd4994e","source":"wordfence","cve":"CVE-2014-9311","title":"WordPress Social Sharing, Related Posts & Analytics \u2013 Shareaholic < 7.6.1.0 - Authenticated (Subscriber+) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ea0d46-a6aa-4704-8e4e-051bedd4994e?source=api-prod","affected":[{"type":"plugin","slug":"shareaholic","name":"Professional Social Sharing Buttons, Icons & Related Posts \u2013 Shareaholic","from":"*","from_inclusive":true,"to":"7.6.1.0","to_inclusive":false,"patched_in":"7.6.1.0"}],"published":"2015-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0ebe940-4524-4ede-b130-241c0dd15b14","source":"wordfence","cve":"CVE-2026-119034","title":"Schema & Structured Data for WP & AMP < 1.70 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ebe940-4524-4ede-b130-241c0dd15b14?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.70","to_inclusive":false,"patched_in":"1.70"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:54Z"},{"id":"wordfence:a0ee9b26-4e7f-475f-b42b-5af40b78cbca","source":"wordfence","cve":"CVE-2023-28696","title":"I Recommend This <= 3.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ee9b26-4e7f-475f-b42b-5af40b78cbca?source=api-prod","affected":[{"type":"plugin","slug":"i-recommend-this","name":"I Recommend This \u2013 Love/Like Button for WordPress Posts","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2023-03-22T00:00:00Z","updated":"2024-07-08T20:12:44Z"},{"id":"wordfence:a0eed0fd-8841-41d1-80fb-dd02f2a1edf3","source":"wordfence","cve":"CVE-2021-25062","title":"Orders Tracking for WooCommerce <= 1.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0eed0fd-8841-41d1-80fb-dd02f2a1edf3?source=api-prod","affected":[{"type":"plugin","slug":"woo-orders-tracking","name":"Trakoo \u2013 Orders Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0f0bc3e-24d6-48da-8398-42b9abb10f56","source":"wordfence","cve":"CVE-2024-44021","title":"Truepush <= 1.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f0bc3e-24d6-48da-8398-42b9abb10f56?source=api-prod","affected":[{"type":"plugin","slug":"truepush-free-web-push-notifications","name":"Truepush \u2013 Most Affordable Web Push Notifications","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:07:38Z"},{"id":"wordfence:a0f2e2f4-6575-4f00-9417-3b5a19c3de40","source":"wordfence","cve":"CVE-2023-40209","title":"Highcompress Image Compressor <= 5.0.0 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f2e2f4-6575-4f00-9417-3b5a19c3de40?source=api-prod","affected":[{"type":"plugin","slug":"high-compress","name":"Highcompress Image Compressor","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0f38af7-7753-4dbe-a4fd-e9a01785dd13","source":"wordfence","cve":"CVE-2023-41133","title":"Secure Admin IP <= 2.0 - Missing Authorization via 'saveSettings'","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f38af7-7753-4dbe-a4fd-e9a01785dd13?source=api-prod","affected":[{"type":"plugin","slug":"secure-admin-ip","name":"Secure Admin IP","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0f47bf8-8dba-4b0b-94e5-fa4aaa61d6c9","source":"wordfence","cve":"CVE-2024-51844","title":"Location Click Map <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f47bf8-8dba-4b0b-94e5-fa4aaa61d6c9?source=api-prod","affected":[{"type":"plugin","slug":"location-click-map","name":"Location Click Map","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:40:42Z"},{"id":"wordfence:a0f55f3e-9a9a-42a7-91b5-0d515519d545","source":"wordfence","cve":"CVE-2023-1427","title":"Photo Gallery by 10Web <= 1.8.14 - Authenticated (Administrator+) Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f55f3e-9a9a-42a7-91b5-0d515519d545?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a0f701d4-8cae-4771-8233-bb94a87a770e","source":"wordfence","cve":"CVE-2024-37442","title":"Photo Gallery by Ays <= 5.7.0 - Authenticated (Administrator+) HTML Injection","severity":"medium","cvss":4.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f701d4-8cae-4771-8233-bb94a87a770e?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":false,"patched_in":"5.7.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:43:55Z"},{"id":"wordfence:a0f877c3-cb51-4b82-ae7a-a30c90d593f7","source":"wordfence","cve":"CVE-2025-48341","title":"Form Maker by 10Web <= 1.15.33 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0f877c3-cb51-4b82-ae7a-a30c90d593f7?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.33","to_inclusive":true,"patched_in":"1.15.34"}],"published":"2025-05-19T00:00:00Z","updated":"2025-06-12T18:35:15Z"},{"id":"wordfence:a0fa6d9f-7243-4349-9c79-00199ee84c25","source":"wordfence","cve":"CVE-2025-48241","title":"Verge3D <= 4.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0fa6d9f-7243-4349-9c79-00199ee84c25?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2025-05-29T00:00:00Z","updated":"2025-05-30T20:18:22Z"},{"id":"wordfence:a102478c-c704-47d4-8b2b-492f75ec38b9","source":"wordfence","cve":"CVE-2015-9464","title":"S3 Bubble Amazon S3 HTML5 Video with Adverts <= 0.7 - Directory Traversal to Arbitrary File Access","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a102478c-c704-47d4-8b2b-492f75ec38b9?source=api-prod","affected":[{"type":"plugin","slug":"s3bubble-amazon-s3-html-5-video-with-adverts","name":"S3 Bubble Amazon S3 HTML5 Video with Adverts","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":"0.8"}],"published":"2015-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a10278f1-3229-46c8-9da5-1fa8e34eef83","source":"wordfence","cve":"CVE-2025-64241","title":"Coupons and Deals <= 3.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10278f1-3229-46c8-9da5-1fa8e34eef83?source=api-prod","affected":[{"type":"plugin","slug":"wp-coupons-and-deals","name":"WP Coupons and Deals \u2013 WordPress Coupon Plugin","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-12-11T00:00:00Z","updated":"2026-01-06T20:42:07Z"},{"id":"wordfence:a104e206-25cd-40f0-8da0-6d5444675476","source":"wordfence","cve":"CVE-2026-94671","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a104e206-25cd-40f0-8da0-6d5444675476?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-09-23T08:45:00Z","updated":"2026-09-29T20:06:33Z"},{"id":"wordfence:a104f88b-deae-465d-b4c1-9a1fc78e5ee9","source":"wordfence","cve":"CVE-2024-5939","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-20T02:03:17Z"},{"id":"wordfence:a1050801-a2d9-46f1-8b56-bacf24d77722","source":"wordfence","cve":"CVE-2025-52816","title":"Zita <= 1.6.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1050801-a2d9-46f1-8b56-bacf24d77722?source=api-prod","affected":[{"type":"theme","slug":"zita","name":"Zita","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-06-23T00:00:00Z","updated":"2026-08-14T15:14:18Z"},{"id":"wordfence:a1069b36-3e9a-43ef-8ea1-9a77daf71dcc","source":"wordfence","cve":"CVE-2026-42629","title":"PowerPack Pro for Elementor < v2.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1069b36-3e9a-43ef-8ea1-9a77daf71dcc?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"v2.13.0","to_inclusive":false,"patched_in":"2.13.0"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:53:26Z"},{"id":"wordfence:a107839e-b79b-4868-9232-eca050eb1551","source":"wordfence","cve":"CVE-2021-24680","title":"WP Travel Engine <= 5.3.0 - Editor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a107839e-b79b-4868-9232-eca050eb1551?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a108d88f-bbba-4e6e-8000-977e32c370a1","source":"wordfence","cve":"CVE-2026-42722","title":"Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a108d88f-bbba-4e6e-8000-977e32c370a1?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.13","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-28T21:18:50Z"},{"id":"wordfence:a108f8bf-a77c-4f29-a63b-c535a054dcaf","source":"wordfence","cve":"CVE-2024-32722","title":"Coupon & Discount Code Reveal Button <= 1.2.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a108f8bf-a77c-4f29-a63b-c535a054dcaf?source=api-prod","affected":[{"type":"plugin","slug":"coupon-reveal-button","name":"Coupon & Discount Code Reveal Button","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:55:34Z"},{"id":"wordfence:a10965ef-472f-4e8b-a061-58854ce46f05","source":"wordfence","cve":"CVE-2026-6370","title":"Mini Ajax Cart for WooCommerce <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10965ef-472f-4e8b-a061-58854ce46f05?source=api-prod","affected":[{"type":"plugin","slug":"mini-ajax-woo-cart","name":"Mini Ajax Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-04-15T00:00:00Z","updated":"2026-04-21T15:02:00Z"},{"id":"wordfence:a10a3f01-082d-4a94-89c6-b5b46891aa4d","source":"wordfence","cve":"CVE-2023-28662","title":"Gift Cards (Gift Vouchers and Packages) <= 4.3.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10a3f01-082d-4a94-89c6-b5b46891aa4d?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a10ab4d6-318e-4dd6-9f81-ed25f181d074","source":"wordfence","cve":"CVE-2026-93031","title":"WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media Import","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10ab4d6-318e-4dd6-9f81-ed25f181d074?source=api-prod","affected":[{"type":"plugin","slug":"use-your-drive","name":"Use-your-Drive | Google Drive plugin for WordPress","from":"2.0","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"},{"type":"plugin","slug":"share-one-drive","name":"Share-one-Drive | OneDrive & SharePoint plugin for WordPress","from":"2.0","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"},{"type":"plugin","slug":"lets-box","name":"WP Cloud Plugins - Box (Lets-Box)","from":"2.0","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"},{"type":"plugin","slug":"out-of-the-box","name":"WP Cloud Plugins - Dropbox (Out-of-the-Box)","from":"2.0","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-18T19:36:30Z"},{"id":"wordfence:a10ba041-ded4-41d4-93ba-7fa7389acd54","source":"wordfence","cve":"","title":"WordPress OpenID Connect Client <= 2.1.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10ba041-ded4-41d4-93ba-7fa7389acd54?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-openid-connect-client","name":"WordPress OpenID Connect Client","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2022-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a10cb85d-65f1-4e34-8614-f161d4746797","source":"wordfence","cve":"CVE-2025-58004","title":"DriCub <= 2.9 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10cb85d-65f1-4e34-8614-f161d4746797?source=api-prod","affected":[{"type":"theme","slug":"dricub-driving-school","name":"DriCub - Driving School WordPress Theme","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:28:01Z"},{"id":"wordfence:a10cf70e-bc66-4888-b88d-c1c4847389c9","source":"wordfence","cve":"CVE-2024-29807","title":"DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10cf70e-bc66-4888-b88d-c1c4847389c9?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.2.26","to_inclusive":true,"patched_in":"2.2.27"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:34:18Z"},{"id":"wordfence:a10da173-9b88-4599-928d-71fc42b35c50","source":"wordfence","cve":"","title":"WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10da173-9b88-4599-928d-71fc42b35c50?source=api-prod","affected":[{"type":"plugin","slug":"wpify-woo","name":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a10dc207-eb41-407e-a85c-ae5ea4c5d972","source":"wordfence","cve":"CVE-2026-39474","title":"Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10dc207-eb41-407e-a85c-ae5ea4c5d972?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":"3.0.11"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:04:30Z"},{"id":"wordfence:a10ee67a-7f5f-43dd-8f5c-c0e92706c453","source":"wordfence","cve":"CVE-2024-9304","title":"LocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10ee67a-7f5f-43dd-8f5c-c0e92706c453?source=api-prod","affected":[{"type":"plugin","slug":"locateandfilter","name":"LocateAndFilter","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"1.6.16"}],"published":"2024-09-30T19:27:18Z","updated":"2024-11-22T18:58:38Z"},{"id":"wordfence:a10ee756-1b71-4232-817c-1ba6ead7f0f0","source":"wordfence","cve":"CVE-2023-24401","title":"Mobile Call Now & Map Buttons < 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a10ee756-1b71-4232-817c-1ba6ead7f0f0?source=api-prod","affected":[{"type":"plugin","slug":"mobile-call-now-map-buttons","name":"Mobile Call Now & Map Buttons","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2023-07-04T00:00:00Z","updated":"2026-05-19T12:41:34Z"},{"id":"wordfence:a11083dd-7a5f-483b-a854-2697ddc54262","source":"wordfence","cve":"CVE-2024-6571","title":"Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a11083dd-7a5f-483b-a854-2697ddc54262?source=api-prod","affected":[{"type":"plugin","slug":"imageseo","name":"Image SEO \u2013 AI-Driven Image SEO Optimizer","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T06:42:23Z"},{"id":"wordfence:a110bc69-ecf6-424d-9e2b-898a452d2dd1","source":"wordfence","cve":"CVE-2024-37215","title":"Transition Slider \u2013 Responsive Image Slider and Gallery <= 2.20.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a110bc69-ecf6-424d-9e2b-898a452d2dd1?source=api-prod","affected":[{"type":"plugin","slug":"transition-slider-lite","name":"Transition Slider \u2013 Responsive Image Slider and Gallery","from":"*","from_inclusive":true,"to":"2.20.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T17:00:46Z"},{"id":"wordfence:a114faf9-cada-4132-abe3-c0137b66e276","source":"wordfence","cve":"CVE-2025-2008","title":"Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a114faf9-cada-4132-abe3-c0137b66e276?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.19","to_inclusive":true,"patched_in":"7.19.1"},{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"7.20","from_inclusive":true,"to":"7.20","to_inclusive":true,"patched_in":"7.19.1"}],"published":"2025-03-31T15:56:17Z","updated":"2025-04-04T16:30:46Z"},{"id":"wordfence:a116c846-72df-4701-893a-744a26b191d6","source":"wordfence","cve":"CVE-2024-12696","title":"Picture Gallery \u2013 Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a116c846-72df-4701-893a-744a26b191d6?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.5.22","to_inclusive":true,"patched_in":"1.5.23"}],"published":"2025-01-17T18:02:02Z","updated":"2025-01-18T07:05:10Z"},{"id":"wordfence:a1192c12-a898-46d9-9eee-6f611e644676","source":"wordfence","cve":"CVE-2026-2949","title":"Xpro Addons \u2014 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1192c12-a898-46d9-9eee-6f611e644676?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.24","to_inclusive":true,"patched_in":"1.4.25"}],"published":"2026-04-03T13:35:46Z","updated":"2026-04-04T02:26:21Z"},{"id":"wordfence:a11db06c-32dc-456a-a5ea-5eded1f42a56","source":"wordfence","cve":"CVE-2026-111966","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a11db06c-32dc-456a-a5ea-5eded1f42a56?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:08:36Z"},{"id":"wordfence:a11f264a-24fe-44da-b325-3fbdc4cd81d0","source":"wordfence","cve":"CVE-2021-24848","title":"Mediamatic \u2013 Media Library Folders <= 2.8.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a11f264a-24fe-44da-b325-3fbdc4cd81d0?source=api-prod","affected":[{"type":"plugin","slug":"mediamatic","name":"Mediamatic \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a120b36e-cb8c-49db-a348-4790052073db","source":"wordfence","cve":"CVE-2026-119524","title":"WP Customer Area <= 8.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a120b36e-cb8c-49db-a348-4790052073db?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2026-11-07T10:40:00Z","updated":"2026-11-10T19:35:10Z"},{"id":"wordfence:a1211a41-3ab5-4ae9-84eb-0079ac54b28d","source":"wordfence","cve":"CVE-2025-23552","title":"Texteller <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1211a41-3ab5-4ae9-84eb-0079ac54b28d?source=api-prod","affected":[{"type":"plugin","slug":"texteller","name":"Texteller","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:55:35Z"},{"id":"wordfence:a121b74d-8f4d-43c4-9dbc-fba489242ede","source":"wordfence","cve":"CVE-2026-27348","title":"Photography <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a121b74d-8f4d-43c4-9dbc-fba489242ede?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:44:17Z"},{"id":"wordfence:a124da63-01a4-44d8-985b-cacef58ea9a3","source":"wordfence","cve":"CVE-2025-12133","title":"EPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a124da63-01a4-44d8-985b-cacef58ea9a3?source=api-prod","affected":[{"type":"plugin","slug":"eprolo-dropshipping","name":"EPROLO-Dropshipping","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-12-04T17:23:45Z","updated":"2025-12-09T22:04:16Z"},{"id":"wordfence:a125bbf1-8ff6-4f3d-a4fb-caaaefe1df2a","source":"wordfence","cve":"CVE-2024-4346","title":"Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a125bbf1-8ff6-4f3d-a4fb-caaaefe1df2a?source=api-prod","affected":[{"type":"plugin","slug":"startklar-elmentor-forms-extwidgets","name":"Startklar Elementor Addons","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"1.7.14"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T08:31:07Z"},{"id":"wordfence:a1264108-6b96-4e17-bac8-4957a615f0b9","source":"wordfence","cve":"CVE-2025-49307","title":"WP Multilang <= 2.4.19 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1264108-6b96-4e17-bac8-4957a615f0b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-multilang","name":"WP Multilang \u2013 Translation and Multilingual Plugin","from":"*","from_inclusive":true,"to":"2.4.19","to_inclusive":true,"patched_in":"2.4.19.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T14:09:39Z"},{"id":"wordfence:a127f1dc-9343-46d4-8ce2-7d0d2a7a960c","source":"wordfence","cve":"CVE-2026-16577","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy < 5.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a127f1dc-9343-46d4-8ce2-7d0d2a7a960c?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.14","to_inclusive":false,"patched_in":"5.0.14"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:09:10Z"},{"id":"wordfence:a128018b-f19b-4b18-a53c-cf1310d3d0e7","source":"wordfence","cve":"CVE-2023-5975","title":"ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a128018b-f19b-4b18-a53c-cf1310d3d0e7?source=api-prod","affected":[{"type":"plugin","slug":"imagemapper","name":"ImageMapper","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a12bd0c0-d303-4e15-9891-623eaf74d106","source":"wordfence","cve":"CVE-2026-121784","title":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a12bd0c0-d303-4e15-9891-623eaf74d106?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-11-07T12:32:00Z","updated":"2026-11-10T19:50:29Z"},{"id":"wordfence:a12ccd08-ee29-4fb9-9075-cf71dc488ffc","source":"wordfence","cve":"CVE-2022-27860","title":"Footer Text <= 2.0.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a12ccd08-ee29-4fb9-9075-cf71dc488ffc?source=api-prod","affected":[{"type":"plugin","slug":"footer-text","name":"Footer Text","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2022-04-28T09:52:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a12d2c25-7701-4928-a875-c94656b7f7f3","source":"wordfence","cve":"CVE-2025-69192","title":"Real Estate Pro <= 2.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a12d2c25-7701-4928-a875-c94656b7f7f3?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-pro","name":"Real Estate Pro - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:55:12Z"},{"id":"wordfence:a12f1061-3720-4e99-892d-68c850aa524c","source":"wordfence","cve":"CVE-2025-39428","title":"Gravity Forms CSS Themes with Fontawesome and Placeholders <= 8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a12f1061-3720-4e99-892d-68c850aa524c?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-css-themes-with-fontawesome-and-placeholder-support","name":"Gravity Forms CSS Themes with Fontawesome and Placeholders","from":"*","from_inclusive":true,"to":"8.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:26:00Z"},{"id":"wordfence:a13176f9-fe6d-4487-86d4-99dbdc55721e","source":"wordfence","cve":"CVE-2026-94058","title":"Treck <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a13176f9-fe6d-4487-86d4-99dbdc55721e?source=api-prod","affected":[{"type":"theme","slug":"treck","name":"Treck - Immigration and Visa Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:19:27Z"},{"id":"wordfence:a1325f47-5bcc-42cb-8eb1-c11075b5da42","source":"wordfence","cve":"CVE-2025-26917","title":"WP Templata <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1325f47-5bcc-42cb-8eb1-c11075b5da42?source=api-prod","affected":[{"type":"plugin","slug":"wptemplata","name":"WP Templata \u2013 WordPress Template Library for Elementor","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:20:52Z"},{"id":"wordfence:a13322b6-782b-425d-a214-cd7780aa3375","source":"wordfence","cve":"CVE-2026-24961","title":"Grand Blog < 3.1.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a13322b6-782b-425d-a214-cd7780aa3375?source=api-prod","affected":[{"type":"theme","slug":"grandblog","name":"Grand Blog WordPress","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2026-01-02T00:00:00Z","updated":"2026-02-10T19:30:13Z"},{"id":"wordfence:a135a298-0c8f-40d1-ad38-b55f81db0481","source":"wordfence","cve":"CVE-2025-32572","title":"Kata Plus <= 1.5.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a135a298-0c8f-40d1-ad38-b55f81db0481?source=api-prod","affected":[{"type":"plugin","slug":"kata-plus","name":"Kata Plus \u2013 Addons for Elementor \u2013 Widgets, Extensions and Templates","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-04-15T00:00:00Z","updated":"2025-07-03T12:14:29Z"},{"id":"wordfence:a1373d87-cc75-4f53-8293-eebc5a0ace95","source":"wordfence","cve":"CVE-2026-54829","title":"WP Photo Album Plus <= 9.1.13.005 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1373d87-cc75-4f53-8293-eebc5a0ace95?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.1.13.005","to_inclusive":true,"patched_in":"9.2.01.001"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:54:13Z"},{"id":"wordfence:a139f0fc-f3e0-4759-aa8d-ba138e5ccc87","source":"wordfence","cve":"CVE-2024-13888","title":"WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a139f0fc-f3e0-4759-aa8d-ba138e5ccc87?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.56","to_inclusive":true,"patched_in":"11.57"}],"published":"2025-02-19T19:45:56Z","updated":"2025-02-20T08:22:06Z"},{"id":"wordfence:a13c364f-bf86-41a9-b56e-949af38c01c6","source":"wordfence","cve":"CVE-2026-54807","title":"Registration Form for WooCommerce <= 1.0.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a13c364f-bf86-41a9-b56e-949af38c01c6?source=api-prod","affected":[{"type":"plugin","slug":"registration-form-for-woocommerce","name":"Registration Form for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:02:26Z"},{"id":"wordfence:a1426809-b245-4868-be87-c96b3c5c05f9","source":"wordfence","cve":"CVE-2023-40002","title":"Booster for WooCommerce <= 7.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1426809-b245-4868-be87-c96b3c5c05f9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2023-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a143d611-9e22-49d1-9a9f-12f1c45685c4","source":"wordfence","cve":"CVE-2024-13530","title":"Custom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a143d611-9e22-49d1-9a9f-12f1c45685c4?source=api-prod","affected":[{"type":"plugin","slug":"login-page-styler","name":"Login Page Styler \u2013 Custom WordPress Login Page Customizer & Security","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T07:23:40Z"},{"id":"wordfence:a143eb71-d039-441b-871e-d1c5cefb0529","source":"wordfence","cve":"CVE-2024-11377","title":"Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a143eb71-d039-441b-871e-d1c5cefb0529?source=api-prod","affected":[{"type":"plugin","slug":"automate-hub-free-by-sperse-io","name":"Automate Hub Free by Sperse.IO","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:40:21Z","updated":"2025-01-07T04:22:19Z"},{"id":"wordfence:a144c9ae-dfdb-4ea2-8c27-84d59439c72a","source":"wordfence","cve":"CVE-2026-3646","title":"LTL Freight Quotes \u2013 R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a144c9ae-dfdb-4ea2-8c27-84d59439c72a?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-rl-edition","name":"LTL Freight Quotes \u2013 R+L Carriers Edition","from":"*","from_inclusive":true,"to":"3.3.13","to_inclusive":true,"patched_in":"3.3.14"}],"published":"2026-04-07T15:25:04Z","updated":"2026-04-08T03:36:10Z"},{"id":"wordfence:a145ea3d-a367-4e42-8a47-cfea49634412","source":"wordfence","cve":"CVE-2026-78152","title":"SureRank SEO \u2013 Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph 1.6.2 - 1.10.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a145ea3d-a367-4e42-8a47-cfea49634412?source=api-prod","affected":[{"type":"plugin","slug":"surerank","name":"SureRank SEO \u2013 Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph","from":"1.6.2","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:18:09Z"},{"id":"wordfence:a145f3ca-2c38-4058-9aa9-e2dcc43c029a","source":"wordfence","cve":"CVE-2024-47352","title":"WP Bulk Delete <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a145f3ca-2c38-4058-9aa9-e2dcc43c029a?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulk-delete","name":"WP Bulk Delete","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:21:18Z"},{"id":"wordfence:a14639eb-a63b-477f-af2c-12ea23d99df8","source":"wordfence","cve":"CVE-2026-94174","title":"Email Log <= 2.63 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14639eb-a63b-477f-af2c-12ea23d99df8?source=api-prod","affected":[{"type":"plugin","slug":"email-log","name":"Email Log","from":"*","from_inclusive":true,"to":"2.63","to_inclusive":true,"patched_in":"2.64"}],"published":"2026-09-23T10:17:00Z","updated":"2026-09-29T20:05:03Z"},{"id":"wordfence:a146ea86-52a8-4488-b904-965409ec02ad","source":"wordfence","cve":"CVE-2026-66665","title":"Type Hub <= 2.0.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a146ea86-52a8-4488-b904-965409ec02ad?source=api-prod","affected":[{"type":"plugin","slug":"typehub","name":"Type Hub","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T22:39:03Z"},{"id":"wordfence:a147956c-a4d8-4945-997a-9b7cea60f926","source":"wordfence","cve":"CVE-2026-22448","title":"PitchPrint <= 11.1.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a147956c-a4d8-4945-997a-9b7cea60f926?source=api-prod","affected":[{"type":"plugin","slug":"pitchprint","name":"PitchPrint","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"11.2.0"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:55:30Z"},{"id":"wordfence:a14b0f3d-7c18-4468-88f7-cc070c4cea4e","source":"wordfence","cve":"CVE-2025-12184","title":"MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14b0f3d-7c18-4468-88f7-cc070c4cea4e?source=api-prod","affected":[{"type":"plugin","slug":"meeting-list","name":"MeetingList","from":"*","from_inclusive":true,"to":"0.11","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:32:07Z","updated":"2025-11-04T14:25:04Z"},{"id":"wordfence:a14c04e8-72cc-4415-a95c-e26f6335b485","source":"wordfence","cve":"CVE-2014-8810","title":"WP Symposium < 14.11 - Authenticated SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14c04e8-72cc-4415-a95c-e26f6335b485?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"14.11","to_inclusive":false,"patched_in":"14.11"}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a14cce74-6432-4b92-85c8-8b899e4248fd","source":"wordfence","cve":"CVE-2024-0615","title":"Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14cce74-6432-4b92-85c8-8b899e4248fd?source=api-prod","affected":[{"type":"plugin","slug":"content-control","name":"Content Control \u2013 The Ultimate Content Restriction Solution! Restrict Content, Create Conditional Blocks & More","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:36:59Z"},{"id":"wordfence:a14cf955-e354-49c3-a685-d5bd51c79ba9","source":"wordfence","cve":"CVE-2024-0399","title":"WooCommerce Customers Manager <= 29.6 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14cf955-e354-49c3-a685-d5bd51c79ba9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"29.6","to_inclusive":true,"patched_in":"29.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-25T12:31:40Z"},{"id":"wordfence:a14e110f-0850-44f4-8de3-95a654096ae8","source":"wordfence","cve":"CVE-2024-13425","title":"WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14e110f-0850-44f4-8de3-95a654096ae8?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:39Z"},{"id":"wordfence:a14eaed7-68e0-42bd-ae67-495720743cd5","source":"wordfence","cve":"CVE-2024-13876","title":"mEintopf <= 0.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14eaed7-68e0-42bd-ae67-495720743cd5?source=api-prod","affected":[{"type":"plugin","slug":"meintopf","name":"mEintopf","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:11:37Z"},{"id":"wordfence:a14fe294-e6e3-42ca-9388-ea632bbc0ec7","source":"wordfence","cve":"CVE-2024-30425","title":"Beaver Builder <= 2.7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14fe294-e6e3-42ca-9388-ea632bbc0ec7?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.4","to_inclusive":true,"patched_in":"2.7.4.5"}],"published":"2024-03-28T00:00:00Z","updated":"2026-04-15T20:48:28Z"},{"id":"wordfence:a14ff78b-e475-4cb0-aa23-c76392af8d7c","source":"wordfence","cve":"CVE-2024-52484","title":"Wc Recently viewed products <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a14ff78b-e475-4cb0-aa23-c76392af8d7c?source=api-prod","affected":[{"type":"plugin","slug":"wc-recently-viewed-products","name":"Wc Recently viewed products","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:47:49Z"},{"id":"wordfence:a1510984-571b-49ce-9e10-129e2a1aca7b","source":"wordfence","cve":"CVE-2026-3896","title":"Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1510984-571b-49ce-9e10-129e2a1aca7b?source=api-prod","affected":[{"type":"plugin","slug":"livemesh-siteorigin-widgets","name":"Livemesh SiteOrigin Widgets","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:33:59Z","updated":"2026-05-27T06:46:17Z"},{"id":"wordfence:a1513296-f7f6-468c-ac96-5f55812d943e","source":"wordfence","cve":"","title":"Ivory Search <= 5.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1513296-f7f6-468c-ac96-5f55812d943e?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a151c680-2bcf-4b36-aa6e-9694c6d3d0c7","source":"wordfence","cve":"CVE-2026-81777","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets <= 6.8.0 - Unauthenticated Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a151c680-2bcf-4b36-aa6e-9694c6d3d0c7?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T15:11:37Z"},{"id":"wordfence:a1525119-732d-4948-9c33-75e9f3517c0d","source":"wordfence","cve":"CVE-2026-42656","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1525119-732d-4948-9c33-75e9f3517c0d?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.6","to_inclusive":true,"patched_in":"29.0.0"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:56:26Z"},{"id":"wordfence:a1529c89-5c5e-4a2d-be31-b55d2907c9b6","source":"wordfence","cve":"CVE-2026-1860","title":"Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1529c89-5c5e-4a2d-be31-b55d2907c9b6?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-02-17T18:55:25Z","updated":"2026-02-18T07:25:43Z"},{"id":"wordfence:a152a280-fc36-4211-a4fe-79365b55cae6","source":"wordfence","cve":"CVE-2026-34888","title":"Bricksforge <= 3.1.8.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a152a280-fc36-4211-a4fe-79365b55cae6?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"3.1.8.4","to_inclusive":true,"patched_in":"3.1.8.5"}],"published":"2026-04-06T00:00:00Z","updated":"2026-04-15T19:39:32Z"},{"id":"wordfence:a153d6b2-e3fd-42db-90ba-d899a07d60c1","source":"wordfence","cve":"CVE-2023-5566","title":"Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a153d6b2-e3fd-42db-90ba-d899a07d60c1?source=api-prod","affected":[{"type":"plugin","slug":"smpl-shortcodes","name":"Simple Shortcodes","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":""}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1549c84-bba0-4b55-9b82-5b98ac4465c0","source":"wordfence","cve":"CVE-2025-23735","title":"Infugrator <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1549c84-bba0-4b55-9b82-5b98ac4465c0?source=api-prod","affected":[{"type":"plugin","slug":"infugrator","name":"Infugrator \u2013 Infusionsoft + WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:14:42Z"},{"id":"wordfence:a155c289-558c-4209-8d9a-bf085fecaf8a","source":"wordfence","cve":"CVE-2024-37922","title":"Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a155c289-558c-4209-8d9a-bf085fecaf8a?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.34","to_inclusive":true,"patched_in":"4.10.35"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-02T18:20:11Z"},{"id":"wordfence:a156234f-2644-4d17-aaa5-4f088cf48f73","source":"wordfence","cve":"CVE-2026-4335","title":"ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a156234f-2644-4d17-aaa5-4f088cf48f73?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T02:25:20Z"},{"id":"wordfence:a159485d-ce5b-46e7-8e63-a72012ccc180","source":"wordfence","cve":"CVE-2026-90438","title":"Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a159485d-ce5b-46e7-8e63-a72012ccc180?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.4","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-10-01T17:13:05Z","updated":"2026-10-02T05:30:18Z"},{"id":"wordfence:a15a6cf2-aa7d-454c-83d2-9d74ce4505be","source":"wordfence","cve":"CVE-2026-104735","title":"RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15a6cf2-aa7d-454c-83d2-9d74ce4505be?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":true,"patched_in":"5.2.11"}],"published":"2026-10-09T15:41:09Z","updated":"2026-10-10T04:26:47Z"},{"id":"wordfence:a15cc96b-2af2-4a7d-af61-633d13b71b49","source":"wordfence","cve":"CVE-2024-4756","title":"WP Backpack <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15cc96b-2af2-4a7d-af61-633d13b71b49?source=api-prod","affected":[{"type":"plugin","slug":"wp-backpack","name":"WP Backpack","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T19:05:22Z"},{"id":"wordfence:a15e917f-f46a-4006-a4cb-3d55331ccb5b","source":"wordfence","cve":"CVE-2023-3155","title":"NextGEN Gallery <= 3.37 - Authenticated (Admininistrator+) Arbitrary File Read and Deletion in gallery_edit","severity":"medium","cvss":6.5,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15e917f-f46a-4006-a4cb-3d55331ccb5b?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.37","to_inclusive":true,"patched_in":"3.39"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a15e9c3d-d881-4795-a43a-c4afa6f785a6","source":"wordfence","cve":"CVE-2025-53286","title":"Dropify <= 4.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15e9c3d-d881-4795-a43a-c4afa6f785a6?source=api-prod","affected":[{"type":"plugin","slug":"wc-dropi-integration","name":"Dropify","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-11-11T17:13:14Z"},{"id":"wordfence:a15ee50d-ee64-49b4-bbd2-2d0f3683a4c5","source":"wordfence","cve":"","title":"Shapeless <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15ee50d-ee64-49b4-bbd2-2d0f3683a4c5?source=api-prod","affected":[{"type":"theme","slug":"shapeless","name":"Shapeless","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a15f8a5a-dccf-476e-9a40-e9ea11dc46f6","source":"wordfence","cve":"CVE-2024-29772","title":"MyBookTable Bookstore <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15f8a5a-dccf-476e-9a40-e9ea11dc46f6?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:19:02Z"},{"id":"wordfence:a15fd2da-5897-4eb8-81c3-79e800e94122","source":"wordfence","cve":"CVE-2022-3934","title":"Flat PM <= 2.661 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a15fd2da-5897-4eb8-81c3-79e800e94122?source=api-prod","affected":[{"type":"plugin","slug":"flatpm-wp","name":"FlatPM \u2013 Ad Manager, AdSense and Custom Code","from":"*","from_inclusive":true,"to":"2.661","to_inclusive":true,"patched_in":"2.662"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1603dc9-7f5e-47e1-8a81-27bb4df1aa4f","source":"wordfence","cve":"CVE-2023-24385","title":"Media Library Assistant <= 3.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1603dc9-7f5e-47e1-8a81-27bb4df1aa4f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.11","to_inclusive":true,"patched_in":"3.12"}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a161858b-dd88-4643-b735-a7b21577b3ba","source":"wordfence","cve":"CVE-2025-69157","title":"Gamic <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a161858b-dd88-4643-b735-a7b21577b3ba?source=api-prod","affected":[{"type":"theme","slug":"gamic","name":"Gamic - Gaming Metaverse Game & Crypto WordPress Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:49:20Z"},{"id":"wordfence:a161bd23-0b82-49ef-b3cc-a117823ec8a7","source":"wordfence","cve":"","title":"Gmedia Photo Gallery <= 1.6.4 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a161bd23-0b82-49ef-b3cc-a117823ec8a7?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"}],"published":"2015-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a162132a-f893-42fa-85f1-b42f738891a4","source":"wordfence","cve":"CVE-2023-5352","title":"Awesome Support <= 6.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a162132a-f893-42fa-85f1-b42f738891a4?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1629e77-0a98-4cb1-a36d-d9ff3f4bfaf1","source":"wordfence","cve":"CVE-2025-26912","title":"Easy Elementor Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1629e77-0a98-4cb1-a36d-d9ff3f4bfaf1?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:57:11Z"},{"id":"wordfence:a1640612-1516-42d7-9fdc-ed4eaa2f0eeb","source":"wordfence","cve":"CVE-2024-37466","title":"Mega Elements <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1640612-1516-42d7-9fdc-ed4eaa2f0eeb?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:04:33Z"},{"id":"wordfence:a1652672-a429-4aac-8931-993de4079114","source":"wordfence","cve":"CVE-2025-32494","title":"reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1652672-a429-4aac-8931-993de4079114?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-jetpack","name":"reCAPTCHA Jetpack","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:49:48Z"},{"id":"wordfence:a169934d-17ce-4d34-be00-c5ac0b488066","source":"wordfence","cve":"CVE-2023-33318","title":"WooCommerce Follow-Up Emails <= 4.9.40 - Authenticated Arbitrary File Upload in Template Editing","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a169934d-17ce-4d34-be00-c5ac0b488066?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-follow-up-emails","name":"Woocommerce Follow-ups","from":"*","from_inclusive":true,"to":"4.9.40","to_inclusive":true,"patched_in":"4.9.50"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a16b8075-1b09-47b9-8447-8b424ffaa5aa","source":"wordfence","cve":"CVE-2025-31852","title":"Bulk Product Sync <= 8.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a16b8075-1b09-47b9-8447-8b424ffaa5aa?source=api-prod","affected":[{"type":"plugin","slug":"sync-wc-google","name":"Bulk Product Sync \u2013 Bulk Product Editor for WooCommerce with Google Sheets\u2122","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"9.0"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-23T17:51:35Z"},{"id":"wordfence:a16c8b5d-fd93-49b4-b1d7-f4cd9248aef3","source":"wordfence","cve":"CVE-2024-13648","title":"Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a16c8b5d-fd93-49b4-b1d7-f4cd9248aef3?source=api-prod","affected":[{"type":"plugin","slug":"maps-for-wp","name":"Maps for WP","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-02-20T00:00:00Z","updated":"2025-02-21T09:21:07Z"},{"id":"wordfence:a16eef7a-51c5-408a-b0b7-ebb00580c9fb","source":"wordfence","cve":"CVE-2026-107422","title":"WP w3all phpBB <= 3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a16eef7a-51c5-408a-b0b7-ebb00580c9fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:35:17Z"},{"id":"wordfence:a16ef2b8-071b-440b-9d24-9755d2c4bb93","source":"wordfence","cve":"CVE-2025-64286","title":"Rentals <= 3.13.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a16ef2b8-071b-440b-9d24-9755d2c4bb93?source=api-prod","affected":[{"type":"theme","slug":"wprentals","name":"WP Rentals - Booking Accommodation WordPress Theme","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-23T00:00:00Z","updated":"2025-11-04T15:32:51Z"},{"id":"wordfence:a1702bdd-1409-42f7-b7b8-cfd44505ecd6","source":"wordfence","cve":"CVE-2025-24740","title":"LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1702bdd-1409-42f7-b7b8-cfd44505ecd6?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.1","to_inclusive":true,"patched_in":"4.2.7.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:05:29Z"},{"id":"wordfence:a1708d6e-14f5-418f-81eb-f9269159b5b1","source":"wordfence","cve":"CVE-2024-12428","title":"WP Data Access \u2013 App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1708d6e-14f5-418f-81eb-f9269159b5b1?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"5.5.23"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T04:22:05Z"},{"id":"wordfence:a1743b26-861e-4a61-80de-b8cc82308228","source":"wordfence","cve":"CVE-2023-1922","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1743b26-861e-4a61-80de-b8cc82308228?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a175d2b2-0a35-4c5a-b05b-4d334e444e85","source":"wordfence","cve":"","title":"Conditional Fields for Contact Form 7 <= 2.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a175d2b2-0a35-4c5a-b05b-4d334e444e85?source=api-prod","affected":[{"type":"plugin","slug":"cf7-conditional-fields","name":"Conditional Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a175e103-ab89-404b-8736-94d0d93d6cf3","source":"wordfence","cve":"CVE-2021-4367","title":"Flo Forms \u2013 Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a175e103-ab89-404b-8736-94d0d93d6cf3?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.35","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a176f206-eb96-4902-8355-eec3c9ff6809","source":"wordfence","cve":"CVE-2022-3490","title":"Checkout Field Editor <= 1.7.2 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":8.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a176f206-eb96-4902-8355-eec3c9ff6809?source=api-prod","affected":[{"type":"plugin","slug":"woo-checkout-field-editor-pro","name":"Checkout Field Editor (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a177573d-8beb-46ca-aa49-a23f231dbd8a","source":"wordfence","cve":"CVE-2026-103356","title":"TMDS \u2013 Dropshipping for TEMU and Woo <= 1.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a177573d-8beb-46ca-aa49-a23f231dbd8a?source=api-prod","affected":[{"type":"plugin","slug":"tmds-dropshipping-for-temu-and-woo","name":"TMDS \u2013 Dropshipping for TEMU and Woo","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2026-10-12T07:45:00Z","updated":"2026-10-13T13:50:13Z"},{"id":"wordfence:a178115e-b719-4c7f-9164-a44bdd0fdd4b","source":"wordfence","cve":"CVE-2025-27278","title":"AcuGIS Leaflet Maps <= 5.1.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a178115e-b719-4c7f-9164-a44bdd0fdd4b?source=api-prod","affected":[{"type":"plugin","slug":"mapfig-premium-leaflet-map-maker","name":"AcuGIS Leaflet Maps","from":"*","from_inclusive":true,"to":"5.1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:37:37Z"},{"id":"wordfence:a1800241-802b-4c6a-a9d8-a7cf78450346","source":"wordfence","cve":"CVE-2015-9466","title":"WTI Like Post < 1.4.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1800241-802b-4c6a-a9d8-a7cf78450346?source=api-prod","affected":[{"type":"plugin","slug":"wti-like-post","name":"WTI Like Post","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2015-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a18089d8-32f1-4827-af14-c45055892fb2","source":"wordfence","cve":"CVE-2021-24543","title":"jQuery Reply to Comment <= 1.31 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a18089d8-32f1-4827-af14-c45055892fb2?source=api-prod","affected":[{"type":"plugin","slug":"jquery-reply-to-comment","name":"jQuery Reply to Comment","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1817c58-e807-4ef2-a382-28ca2fd5239e","source":"wordfence","cve":"CVE-2026-5294","title":"GeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1817c58-e807-4ef2-a382-28ca2fd5239e?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-05-04T15:26:29Z","updated":"2026-05-05T03:37:37Z"},{"id":"wordfence:a1818e80-e580-45d4-88ab-018cb1723947","source":"wordfence","cve":"CVE-2019-15643","title":"Ultimate Faqs <= 1.8.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1818e80-e580-45d4-88ab-018cb1723947?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"1.8.22","to_inclusive":false,"patched_in":"1.8.22"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1825e57-b59f-4c57-8008-640717e05eb3","source":"wordfence","cve":"CVE-2025-58616","title":"Frisbii Pay <= 1.8.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1825e57-b59f-4c57-8008-640717e05eb3?source=api-prod","affected":[{"type":"plugin","slug":"reepay-checkout-gateway","name":"Frisbii Pay","from":"*","from_inclusive":true,"to":"1.8.2.1","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:44:07Z"},{"id":"wordfence:a184090c-0281-4d8d-bd4d-256b4ed826dc","source":"wordfence","cve":"CVE-2023-25475","title":"Smart YouTube PRO <= 4.3 - Cross-Site Request Forgery via handle_colorbox_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a184090c-0281-4d8d-bd4d-256b4ed826dc?source=api-prod","affected":[{"type":"plugin","slug":"smart-youtube","name":"Smart YouTube PRO","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a184ee1a-5fe2-47d5-8db1-a226c73e5bb1","source":"wordfence","cve":"CVE-2026-92174","title":"SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a184ee1a-5fe2-47d5-8db1-a226c73e5bb1?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.73.2","to_inclusive":true,"patched_in":"1.74.0"}],"published":"2026-10-01T16:32:57Z","updated":"2026-10-02T05:30:18Z"},{"id":"wordfence:a1859dca-d771-470c-ae4a-48246977212c","source":"wordfence","cve":"CVE-2023-27431","title":"Big Store <= 1.9.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1859dca-d771-470c-ae4a-48246977212c?source=api-prod","affected":[{"type":"theme","slug":"big-store","name":"Big Store","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2023-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1867c79-29d7-46a4-bfaf-c65e8a44c2ed","source":"wordfence","cve":"CVE-2026-1980","title":"WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-03-03T12:28:50Z","updated":"2026-03-04T01:21:58Z"},{"id":"wordfence:a186ca14-5cfd-4ce8-b73e-3881445069d7","source":"wordfence","cve":"CVE-2024-44003","title":"Spice Starter Sites <= 1.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a186ca14-5cfd-4ce8-b73e-3881445069d7?source=api-prod","affected":[{"type":"plugin","slug":"spice-starter-sites","name":"Spice Starter Sites","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T17:21:36Z"},{"id":"wordfence:a1877e8a-0ae1-4277-93ac-7bc56fd8c3ce","source":"wordfence","cve":"CVE-2025-31063","title":"Wishlist <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1877e8a-0ae1-4277-93ac-7bc56fd8c3ce?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2026-04-30T03:17:42Z"},{"id":"wordfence:a187fa8b-daf1-4955-92b3-2937d0f6a159","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a187fa8b-daf1-4955-92b3-2937d0f6a159?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:04:21Z"},{"id":"wordfence:a1887469-f362-405b-b171-1900c0846aa0","source":"wordfence","cve":"CVE-2025-30998","title":"WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1887469-f362-405b-b171-1900c0846aa0?source=api-prod","affected":[{"type":"plugin","slug":"wp-links-page","name":"WP Links Page","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-07-22T00:00:00Z","updated":"2025-12-09T17:03:29Z"},{"id":"wordfence:a188c615-513b-4d65-8351-d70848696297","source":"wordfence","cve":"CVE-2024-11199","title":"Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a188c615-513b-4d65-8351-d70848696297?source=api-prod","affected":[{"type":"plugin","slug":"rescue-shortcodes","name":"Rescue Shortcodes","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-11-22T21:34:33Z","updated":"2024-11-23T09:39:10Z"},{"id":"wordfence:a18963cb-24c7-45b4-987d-5a8789b1ab0a","source":"wordfence","cve":"CVE-2021-24501","title":"Workreap Theme < 2.2.2 - Authorization Bypass","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a18963cb-24c7-45b4-987d-5a8789b1ab0a?source=api-prod","affected":[{"type":"theme","slug":"workreap","name":"Workreap - Freelance Marketplace and Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a189e436-e8af-4379-aa6e-2d1a4a2d4bfa","source":"wordfence","cve":"CVE-2024-9361","title":"Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a189e436-e8af-4379-aa6e-2d1a4a2d4bfa?source=api-prod","affected":[{"type":"plugin","slug":"bulk-image-resizer","name":"Bulk images optimizer: Resize, optimize, convert to webp, rename \u2026","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:44:23Z","updated":"2024-10-18T04:32:55Z"},{"id":"wordfence:a18baa1d-2400-496d-8e8b-1c3983484706","source":"wordfence","cve":"CVE-2024-2972","title":"Floating Chat Widget <= 3.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a18baa1d-2400-496d-8e8b-1c3983484706?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-18T11:57:43Z"},{"id":"wordfence:a18fa7e6-813d-4b48-bd4e-5232fb8382d1","source":"wordfence","cve":"CVE-2024-10800","title":"WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a18fa7e6-813d-4b48-bd4e-5232fb8382d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.6","to_inclusive":true,"patched_in":"16.7"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T04:29:06Z"},{"id":"wordfence:a192d097-79f8-42ce-8941-5a7b9f2b2df6","source":"wordfence","cve":"CVE-2026-77000","title":"WP Social Media Login <= 1.0.6 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a192d097-79f8-42ce-8941-5a7b9f2b2df6?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-media-login","name":"WP Social Media Login","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-02T15:20:50Z"},{"id":"wordfence:a193392a-ef6d-4232-a8c9-c980bd369d5e","source":"wordfence","cve":"","title":"Brightbox <= (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a193392a-ef6d-4232-a8c9-c980bd369d5e?source=api-prod","affected":[{"type":"theme","slug":"brightbox","name":"Brightbox","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a195892b-75d3-4a5d-86e1-4eb4b9f62624","source":"wordfence","cve":"CVE-2021-25071","title":"Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a195892b-75d3-4a5d-86e1-4eb4b9f62624?source=api-prod","affected":[{"type":"plugin","slug":"akismet-privacy-policies","name":"Akismet Privacy Policies","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a195af52-62f7-46a1-b161-280d455b71f4","source":"wordfence","cve":"CVE-2025-23452","title":"EditionGuard for WooCommerce \u2013 eBook Sales with DRM <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a195af52-62f7-46a1-b161-280d455b71f4?source=api-prod","affected":[{"type":"plugin","slug":"editionguard-for-woocommerce-ebook-sales-with-drm","name":"EditionGuard for WooCommerce \u2013 eBook Sales with DRM","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:15:56Z"},{"id":"wordfence:a195dc44-4047-4c80-817a-cd5e267c0b55","source":"wordfence","cve":"CVE-2025-48119","title":"RS WP Book Showcase <= 6.7.70 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a195dc44-4047-4c80-817a-cd5e267c0b55?source=api-prod","affected":[{"type":"plugin","slug":"rs-wp-books-showcase","name":"RS WP Book Showcase \u2013 A Complete Book Catalogue & Library System","from":"*","from_inclusive":true,"to":"6.7.70","to_inclusive":true,"patched_in":"6.7.71"}],"published":"2025-05-16T00:00:00Z","updated":"2026-09-09T15:52:26Z"},{"id":"wordfence:a1985eb5-bfb5-4220-a4f8-fcfa84beae6a","source":"wordfence","cve":"CVE-2025-14945","title":"Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1985eb5-bfb5-4220-a4f8-fcfa84beae6a?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.3.3","to_inclusive":true,"patched_in":"7.3.4"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T05:30:55Z"},{"id":"wordfence:a199e16a-80a7-4471-afc6-4942c7de31bf","source":"wordfence","cve":"CVE-2024-9233","title":"Logo Slider <= 3.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a199e16a-80a7-4471-afc6-4942c7de31bf?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2024-10-03T00:00:00Z","updated":"2024-11-06T18:41:57Z"},{"id":"wordfence:a19bdf2c-d348-4c3e-9dc4-dfd54f77c973","source":"wordfence","cve":"CVE-2024-51627","title":"Audio Comparison Lite <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19bdf2c-d348-4c3e-9dc4-dfd54f77c973?source=api-prod","affected":[{"type":"plugin","slug":"audio-comparison-lite","name":"Audio Comparison Lite","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-11T15:16:53Z"},{"id":"wordfence:a19bff99-b680-40a6-8a5c-7a0233b293ac","source":"wordfence","cve":"CVE-2023-5211","title":"Fattura24 <= 6.2.7 - Reflected Cross-Site Scripting via 'id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19bff99-b680-40a6-8a5c-7a0233b293ac?source=api-prod","affected":[{"type":"plugin","slug":"fattura24","name":"Fattura24","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a19c70d1-30d6-4d87-92a7-46841951e1c7","source":"wordfence","cve":"CVE-2026-62104","title":"Migratico Lite <= 2.6.8 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19c70d1-30d6-4d87-92a7-46841951e1c7?source=api-prod","affected":[{"type":"plugin","slug":"migratico-lite","name":"Migratico Lite","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-09-15T10:57:56Z","updated":"2026-09-22T18:29:31Z"},{"id":"wordfence:a19e11e7-faa1-4e4d-87de-2454c4ad70f8","source":"wordfence","cve":"CVE-2024-12443","title":"CRM Perks \u2013 WordPress HelpDesk Integration \u2013 Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19e11e7-faa1-4e4d-87de-2454c4ad70f8?source=api-prod","affected":[{"type":"plugin","slug":"support-x","name":"CRM Perks \u2013 WordPress HelpDesk Integration \u2013 Zendesk, Freshdesk, HelpScout","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-12-16T09:47:01Z","updated":"2024-12-16T22:24:37Z"},{"id":"wordfence:a19e1713-1a64-46dc-8b30-b53045b2e01d","source":"wordfence","cve":"CVE-2024-9117","title":"Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19e1713-1a64-46dc-8b30-b53045b2e01d?source=api-prod","affected":[{"type":"plugin","slug":"mapplic-lite","name":"Mapplic Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T21:22:47Z","updated":"2024-09-26T09:29:42Z"},{"id":"wordfence:a19ef0d7-fd44-45ea-8fb1-b99c270072c4","source":"wordfence","cve":"CVE-2010-5296","title":"WordPress Core < 3.0.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a19ef0d7-fd44-45ea-8fb1-b99c270072c4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2010-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1a00374-e9d6-46f9-a28c-cb7768505787","source":"wordfence","cve":"CVE-2026-5821","title":"Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a00374-e9d6-46f9-a28c-cb7768505787?source=api-prod","affected":[{"type":"plugin","slug":"image-optimization","name":"Image Optimizer \u2013 Compress Images and Convert to WebP or AVIF","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-07-01T17:26:17Z","updated":"2026-10-28T00:43:37Z"},{"id":"wordfence:a1a1c5e7-75a4-4ca5-9707-4076b92e0c33","source":"wordfence","cve":"CVE-2024-8726","title":"MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a1c5e7-75a4-4ca5-9707-4076b92e0c33?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:55Z"},{"id":"wordfence:a1a2b205-9330-4296-9411-58f2f91e1f5e","source":"wordfence","cve":"CVE-2025-32172","title":"YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a2b205-9330-4296-9411-58f2f91e1f5e?source=api-prod","affected":[{"type":"plugin","slug":"yamaps","name":"YaMaps for WordPress Plugin","from":"*","from_inclusive":true,"to":"0.6.40","to_inclusive":true,"patched_in":"0.6.41"}],"published":"2025-04-04T00:00:00Z","updated":"2026-01-19T16:44:24Z"},{"id":"wordfence:a1a2dbec-a21d-4520-b14a-3cb77e867a1c","source":"wordfence","cve":"CVE-2026-116396","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a2dbec-a21d-4520-b14a-3cb77e867a1c?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2026-10-26T16:38:00Z","updated":"2026-10-28T01:26:47Z"},{"id":"wordfence:a1a3c767-465b-4307-b114-7144ff9ef47b","source":"wordfence","cve":"CVE-2025-53193","title":"Burst Statistics <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a3c767-465b-4307-b114-7144ff9ef47b?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:22:49Z"},{"id":"wordfence:a1ab02c0-e083-4f0e-b6d4-1a10ade2c688","source":"wordfence","cve":"CVE-2023-27442","title":"Leyka <= 3.29.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ab02c0-e083-4f0e-b6d4-1a10ade2c688?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.29.2","to_inclusive":true,"patched_in":"3.30"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1ad32fb-929e-4181-8789-df50a77a71ef","source":"wordfence","cve":"CVE-2025-12884","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ad32fb-929e-4181-8789-df50a77a71ef?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-02-18T15:11:38Z","updated":"2026-02-19T03:25:17Z"},{"id":"wordfence:a1ada4cc-aded-4592-b0e7-f70f845c858e","source":"wordfence","cve":"CVE-2025-54721","title":"Resca <= 3.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ada4cc-aded-4592-b0e7-f70f845c858e?source=api-prod","affected":[{"type":"theme","slug":"resca","name":"Resca - Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2025-09-10T00:00:00Z","updated":"2025-11-12T13:41:56Z"},{"id":"wordfence:a1adaf1f-df0a-4793-805f-879f91acbd16","source":"wordfence","cve":"CVE-2026-24354","title":"Penci Shortcodes & Performance <= 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1adaf1f-df0a-4793-805f-879f91acbd16?source=api-prod","affected":[{"type":"plugin","slug":"penci-shortcodes","name":"Penci Shortcodes & Performance","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2026-01-10T23:40:52Z","updated":"2026-02-03T13:43:20Z"},{"id":"wordfence:a1ae2060-5eca-47c9-a196-0ff75c3f523e","source":"wordfence","cve":"CVE-2013-3256","title":"SexyBookmarks <= 6.1.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ae2060-5eca-47c9-a196-0ff75c3f523e?source=api-prod","affected":[{"type":"plugin","slug":"sexybookmarks","name":"sexybookmarks","from":"*","from_inclusive":true,"to":"6.1.4.0","to_inclusive":true,"patched_in":"6.1.5.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1af63f6-329e-40b6-b786-302c608ac577","source":"wordfence","cve":"","title":"Social Media Share Buttons | MashShare < 2.3.1 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1af63f6-329e-40b6-b786-302c608ac577?source=api-prod","affected":[{"type":"plugin","slug":"mashsharer","name":"MashShare \u2013 Social Media Share Buttons, Social Share Icons","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2015-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1af9757-23e9-41d2-bbcd-15b0610b6538","source":"wordfence","cve":"CVE-2026-3523","title":"Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1af9757-23e9-41d2-bbcd-15b0610b6538?source=api-prod","affected":[{"type":"plugin","slug":"apocalypse-meow","name":"Apocalypse Meow","from":"*","from_inclusive":true,"to":"22.1.0","to_inclusive":true,"patched_in":"23.0.0"}],"published":"2026-03-04T16:06:27Z","updated":"2026-03-05T04:21:53Z"},{"id":"wordfence:a1b043a1-7bee-4ef0-86d9-19cf202cfc71","source":"wordfence","cve":"CVE-2025-3862","title":"Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf202cfc71?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"26.0.6","to_inclusive":true,"patched_in":"26.0.7"}],"published":"2025-05-07T22:33:58Z","updated":"2025-05-08T11:13:45Z"},{"id":"wordfence:a1b0d129-1070-4399-8a1e-3d3ad34dc1a2","source":"wordfence","cve":"CVE-2025-23661","title":"NV Slider <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b0d129-1070-4399-8a1e-3d3ad34dc1a2?source=api-prod","affected":[{"type":"plugin","slug":"nv-slider","name":"NV Slider","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:29:41Z"},{"id":"wordfence:a1b3430b-c502-47f9-bbca-69da1545d221","source":"wordfence","cve":"CVE-2025-22737","title":"WpTravelly <= 1.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b3430b-c502-47f9-bbca-69da1545d221?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:21:48Z"},{"id":"wordfence:a1b3bcad-4bee-4848-8d68-0aacaf199910","source":"wordfence","cve":"CVE-2024-38706","title":"HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b3bcad-4bee-4848-8d68-0aacaf199910?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:00:42Z"},{"id":"wordfence:a1b4b36e-c1d1-4a49-88a9-36a59b6265fb","source":"wordfence","cve":"CVE-2024-51637","title":"Admin SMS Alert<=1.1.0 - Cross-Site Request Forgery to Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b4b36e-c1d1-4a49-88a9-36a59b6265fb?source=api-prod","affected":[{"type":"plugin","slug":"admin-sms-alert","name":"Admin SMS Alert","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:32:49Z"},{"id":"wordfence:a1b8ac82-4c2d-44bf-ac9e-1c1abead0613","source":"wordfence","cve":"CVE-2020-25378","title":"WP Floating Menu <= 1.4.0 - Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b8ac82-4c2d-44bf-ac9e-1c1abead0613?source=api-prod","affected":[{"type":"plugin","slug":"wp-floating-menu","name":"WP Floating Menu \u2013 One page navigator, sticky menu for WordPress","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2020-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1b99ea1-109e-4632-9439-3ffbb10f0839","source":"wordfence","cve":"CVE-2025-62099","title":"Signature Add-On for Gravity Forms <= 1.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b99ea1-109e-4632-9439-3ffbb10f0839?source=api-prod","affected":[{"type":"plugin","slug":"gravity-signature-forms-add-on","name":"Signature Add-On for Gravity Forms","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:15:00Z"},{"id":"wordfence:a1bb2b06-9a3b-4428-8624-26a1202fe3b0","source":"wordfence","cve":"CVE-2025-8489","title":"King Addons for Elementor \u2013 Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1bb2b06-9a3b-4428-8624-26a1202fe3b0?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"24.12.92","from_inclusive":true,"to":"51.1.14","to_inclusive":true,"patched_in":"51.1.35"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-24T16:48:44Z"},{"id":"wordfence:a1bf7283-2ad7-4a4e-b5b7-7b944c5001a0","source":"wordfence","cve":"CVE-2025-63014","title":"Gmedia Photo Gallery <= 1.25.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1bf7283-2ad7-4a4e-b5b7-7b944c5001a0?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.25.1","to_inclusive":true,"patched_in":"1.25.2"}],"published":"2025-12-31T00:00:00Z","updated":"2026-10-28T21:09:58Z"},{"id":"wordfence:a1c29af8-f298-4efa-b5a2-fd48ba9613ee","source":"wordfence","cve":"CVE-2026-80491","title":"SAMO Forms <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c29af8-f298-4efa-b5a2-fd48ba9613ee?source=api-prod","affected":[{"type":"plugin","slug":"samo-forms","name":"SAMO Forms","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:55:39Z"},{"id":"wordfence:a1c2dc9d-99a2-4276-b968-50601afd85c3","source":"wordfence","cve":"CVE-2026-14203","title":"Smart Manager <= 8.91.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c2dc9d-99a2-4276-b968-50601afd85c3?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.91.0","to_inclusive":true,"patched_in":"8.92.0"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:02:35Z"},{"id":"wordfence:a1c2e4e5-472f-4517-90f0-8f7057d24ef8","source":"wordfence","cve":"CVE-2016-1000126","title":"Admin Font Editor <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c2e4e5-472f-4517-90f0-8f7057d24ef8?source=api-prod","affected":[{"type":"plugin","slug":"admin-font-editor","name":"Admin Font Editor","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1c4c632-66f2-4987-b7da-048dbe4a3044","source":"wordfence","cve":"CVE-2024-9018","title":"WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c4c632-66f2-4987-b7da-048dbe4a3044?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:33:55Z","updated":"2024-10-01T08:30:19Z"},{"id":"wordfence:a1c6ad5a-bc76-4012-acc6-35f742e0869e","source":"wordfence","cve":"CVE-2023-3707","title":"ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c6ad5a-bc76-4012-acc6-35f742e0869e?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"0.17.0","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1c6eed6-7b3f-4b37-85f8-6613527daa54","source":"wordfence","cve":"CVE-2024-10828","title":"Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c6eed6-7b3f-4b37-85f8-6613527daa54?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2024-11-12T14:44:29Z","updated":"2024-11-13T03:20:07Z"},{"id":"wordfence:a1c731b9-8862-4140-b5e8-58132113e22c","source":"wordfence","cve":"","title":"Jetpack <= 3.7.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c731b9-8862-4140-b5e8-58132113e22c?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2015-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1c755aa-5f68-4f55-be88-094b0828ebec","source":"wordfence","cve":"CVE-2026-13726","title":"Multiple Page Generator Plugin \u2013 MPG <= 4.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1c755aa-5f68-4f55-be88-094b0828ebec?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:16:49Z"},{"id":"wordfence:a1cb99dc-31a7-4d0f-afee-ca8c04cee5fe","source":"wordfence","cve":"CVE-2022-2537","title":"WooCommerce PDF Invoices & Packing Slips 2.14.0 - 3.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cb99dc-31a7-4d0f-afee-ca8c04cee5fe?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"2.14.0","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1cbe205-1858-4561-a87a-c3908c91370f","source":"wordfence","cve":"CVE-2026-31922","title":"Fox LMS <= 1.0.6.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cbe205-1858-4561-a87a-c3908c91370f?source=api-prod","affected":[{"type":"plugin","slug":"fox-lms","name":"Fox LMS \u2013 eLearning & Course Builder","from":"*","from_inclusive":true,"to":"1.0.6.3","to_inclusive":true,"patched_in":"1.0.6.4"}],"published":"2026-02-07T00:00:00Z","updated":"2026-04-15T20:59:13Z"},{"id":"wordfence:a1ce59bf-2d59-4c15-8be1-0d733526d1eb","source":"wordfence","cve":"CVE-2024-49626","title":"Shipyaari Shipping Management <= 1.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ce59bf-2d59-4c15-8be1-0d733526d1eb?source=api-prod","affected":[{"type":"plugin","slug":"shipyaari-shipping-managment","name":"Shipyaari Shipping Management","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T15:16:18Z"},{"id":"wordfence:a1cec715-d19b-48b4-a924-5fb3f9a269ee","source":"wordfence","cve":"CVE-2024-47625","title":"Enter Addons <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cec715-d19b-48b4-a924-5fb3f9a269ee?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:41:44Z"},{"id":"wordfence:a1cf42f7-77c6-4594-a6a4-cebf5c3558d7","source":"wordfence","cve":"CVE-2026-100155","title":"Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cf42f7-77c6-4594-a6a4-cebf5c3558d7?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-10-30T17:25:47Z","updated":"2026-10-31T05:33:08Z"},{"id":"wordfence:a1cf8b8f-bf74-444c-88cc-cc836ee45f26","source":"wordfence","cve":"CVE-2024-37255","title":"Elements kit Elementor addons <= 3.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1cf8b8f-bf74-444c-88cc-cc836ee45f26?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:32:40Z"},{"id":"wordfence:a1d07e86-e870-4978-a240-4c3e8050c5d6","source":"wordfence","cve":"CVE-2026-42684","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d07e86-e870-4978-a240-4c3e8050c5d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2026-05-23T00:00:00Z","updated":"2026-05-26T19:30:04Z"},{"id":"wordfence:a1d0e3be-4f3e-4f33-8511-a15d9183e878","source":"wordfence","cve":"CVE-2025-23685","title":"RomanCart On WordPress <= 0.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d0e3be-4f3e-4f33-8511-a15d9183e878?source=api-prod","affected":[{"type":"plugin","slug":"romancart-on-wordpress","name":"RomanCart On WordPress","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:29:50Z"},{"id":"wordfence:a1d42f09-8a2b-47a3-ba35-14c55844f133","source":"wordfence","cve":"CVE-2025-69193","title":"Membership <= 1.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d42f09-8a2b-47a3-ba35-14c55844f133?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:54:52Z"},{"id":"wordfence:a1d48bf9-5457-4f17-8081-bad01decbf6a","source":"wordfence","cve":"CVE-2025-11154","title":"IDonate < 2.1.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d48bf9-5457-4f17-8081-bad01decbf6a?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":false,"patched_in":"2.1.13"}],"published":"2025-10-28T00:00:00Z","updated":"2025-10-29T15:30:53Z"},{"id":"wordfence:a1d4df4b-ec7a-43f6-8617-161b1600d6d2","source":"wordfence","cve":"CVE-2024-5792","title":"Houzez CRM <= 1.4.2 - Authenticated (Seller+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d4df4b-ec7a-43f6-8617-161b1600d6d2?source=api-prod","affected":[{"type":"plugin","slug":"houzez-crm","name":"Houzez CRM","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-10T02:02:48Z"},{"id":"wordfence:a1d5c661-ebaf-4752-8263-ce6dc2f355cd","source":"wordfence","cve":"CVE-2026-57414","title":"AI ChatBot for eCommerce \u2013 WoowBot <= 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d5c661-ebaf-4752-8263-ce6dc2f355cd?source=api-prod","affected":[{"type":"plugin","slug":"woowbot-woocommerce-chatbot","name":"AI ChatBot for WooCommerce \u2013 WoowBot","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:25:36Z"},{"id":"wordfence:a1d72530-cfbb-4dfa-9acb-501f0c3a9651","source":"wordfence","cve":"CVE-2024-43324","title":"Clever Addons for Elementor <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d72530-cfbb-4dfa-9acb-501f0c3a9651?source=api-prod","affected":[{"type":"plugin","slug":"cafe-lite","name":"Clever Addons for Elementor","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-03T16:38:24Z"},{"id":"wordfence:a1d8adf9-a529-45eb-9c59-8f43049de460","source":"wordfence","cve":"CVE-2024-7690","title":"DN Popup <= 1.2.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1d8adf9-a529-45eb-9c59-8f43049de460?source=api-prod","affected":[{"type":"plugin","slug":"dn-popup","name":"DN Popup","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-15T17:54:07Z"},{"id":"wordfence:a1da201f-47e3-4f39-9c8b-cd842e8f7ca5","source":"wordfence","cve":"CVE-2026-39500","title":"themesflat-addons-for-elementor <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1da201f-47e3-4f39-9c8b-cd842e8f7ca5?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-15T21:11:08Z"},{"id":"wordfence:a1db940b-6cfc-4109-aa02-37ddadcc1f8b","source":"wordfence","cve":"CVE-2023-38391","title":"Onepage Builder \u2013 Easiest Landing Page Builder For WordPress <= 2.4.1 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1db940b-6cfc-4109-aa02-37ddadcc1f8b?source=api-prod","affected":[{"type":"plugin","slug":"tx-onepager","name":"Onepage Builder \u2013 Easiest Landing Page Builder For WordPress","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1dbc2ca-eb3f-4c0f-a5c0-28579f694237","source":"wordfence","cve":"CVE-2026-16092","title":"Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1dbc2ca-eb3f-4c0f-a5c0-28579f694237?source=api-prod","affected":[{"type":"plugin","slug":"improved-save-button","name":"Improved Save Button","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-29T14:37:05Z","updated":"2026-07-30T03:03:23Z"},{"id":"wordfence:a1dbd87e-2449-4d59-9f08-f708b93d41cb","source":"wordfence","cve":"CVE-2024-50419","title":"Greenshift \u2013 animation and page builder blocks <=9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1dbd87e-2449-4d59-9f08-f708b93d41cb?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"9.7","to_inclusive":true,"patched_in":"9.8"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T18:26:22Z"},{"id":"wordfence:a1deef30-a6c3-466c-8eaa-93f26adc64bc","source":"wordfence","cve":"CVE-2026-111960","title":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP 1.4.38 - 1.5.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1deef30-a6c3-466c-8eaa-93f26adc64bc?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"1.4.38","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:17:08Z"},{"id":"wordfence:a1e02c2d-a38a-495c-9c37-098049297be2","source":"wordfence","cve":"CVE-2026-6405","title":"Anomify AI <= 0.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e02c2d-a38a-495c-9c37-098049297be2?source=api-prod","affected":[{"type":"plugin","slug":"anomify","name":"Anomify AI \u2013 Anomaly Detection and Alerting","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T17:36:30Z","updated":"2026-05-20T06:46:03Z"},{"id":"wordfence:a1e07c9c-7d35-41b4-aaa1-f37c4f10f7ac","source":"wordfence","cve":"CVE-2026-15411","title":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e07c9c-7d35-41b4-aaa1-f37c4f10f7ac?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-07-27T23:23:32Z","updated":"2026-07-28T11:32:49Z"},{"id":"wordfence:a1e2d370-a716-4d6b-8e23-74db2fbd0760","source":"wordfence","cve":"CVE-2024-8277","title":"WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e2d370-a716-4d6b-8e23-74db2fbd0760?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-photo-reviews","name":"WooCommerce Photo Reviews Premium","from":"*","from_inclusive":true,"to":"1.3.13.2","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2024-09-10T20:00:49Z","updated":"2024-09-11T08:31:05Z"},{"id":"wordfence:a1e34a47-b025-469e-83da-ec6e1ea40d4d","source":"wordfence","cve":"CVE-2026-57731","title":"Flatsome <= 3.20.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e34a47-b025-469e-83da-ec6e1ea40d4d?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:42:49Z"},{"id":"wordfence:a1e42e9a-918d-42b4-a8bc-11acdbaac91e","source":"wordfence","cve":"CVE-2026-76585","title":"Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e42e9a-918d-42b4-a8bc-11acdbaac91e?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.118.0","to_inclusive":false,"patched_in":"5.118.0"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:47:16Z"},{"id":"wordfence:a1e51a99-f5d4-47d4-bead-00ca1f5f72c2","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via delete_expired_used_coupon_code","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e51a99-f5d4-47d4-bead-00ca1f5f72c2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.14.2","to_inclusive":false,"patched_in":"5.14.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1e820d0-7d94-43d3-98db-db2b249b0a63","source":"wordfence","cve":"CVE-2026-104404","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e820d0-7d94-43d3-98db-db2b249b0a63?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-05T08:31:00Z","updated":"2026-10-08T23:25:12Z"},{"id":"wordfence:a1eda885-7e10-4294-9748-5359efd51754","source":"wordfence","cve":"CVE-2022-4501","title":"Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1eda885-7e10-4294-9748-5359efd51754?source=api-prod","affected":[{"type":"plugin","slug":"mega-addons-for-visual-composer","name":"Mega Addons For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-12-05T16:43:28Z"},{"id":"wordfence:a1ee5b10-1694-4991-b3fb-4b3b365fbca6","source":"wordfence","cve":"CVE-2025-39598","title":"Administrator Z <= 2025.03.28 - Authenticated (Admin+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ee5b10-1694-4991-b3fb-4b3b365fbca6?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2025.03.28","to_inclusive":true,"patched_in":"2025.03.30"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:34:40Z"},{"id":"wordfence:a1eec01c-7f54-4e90-a943-c50b8ab79b22","source":"wordfence","cve":"CVE-2021-24882","title":"Slideshow Gallery < 1.7.4 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1eec01c-7f54-4e90-a943-c50b8ab79b22?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1eed70b-d12e-4b7f-afc1-7037f5c406b8","source":"wordfence","cve":"CVE-2025-52753","title":"Contact Form by Supsystic <= 1.7.36 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1eed70b-d12e-4b7f-afc1-7037f5c406b8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.36","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-08-18T00:00:00Z","updated":"2026-04-15T13:50:15Z"},{"id":"wordfence:a1f153bb-87b0-4dc7-b014-776ab20ad8c3","source":"wordfence","cve":"CVE-2025-23465","title":"Vampire Character Manager <= 2.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f153bb-87b0-4dc7-b014-776ab20ad8c3?source=api-prod","affected":[{"type":"plugin","slug":"vampire-character","name":"Vampire Character Manager","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":"2.14"}],"published":"2025-01-16T00:00:00Z","updated":"2026-06-23T17:32:32Z"},{"id":"wordfence:a1f258b0-041e-4795-95a4-66431f8c84b2","source":"wordfence","cve":"CVE-2025-39395","title":"WPAMS <= 44.0 (17-08-2023) - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f258b0-041e-4795-95a4-66431f8c84b2?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:47:08Z"},{"id":"wordfence:a1f2925e-033e-46aa-9a61-bddc0f350d5c","source":"wordfence","cve":"CVE-2025-23844","title":"Custom Widget Classes <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f2925e-033e-46aa-9a61-bddc0f350d5c?source=api-prod","affected":[{"type":"plugin","slug":"custom-widget-classes","name":"Custom Widget Classes","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:54:44Z"},{"id":"wordfence:a1f62cda-262b-46d9-a839-0a573813cfa1","source":"wordfence","cve":"CVE-2025-2470","title":"Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f62cda-262b-46d9-a839-0a573813cfa1?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"6.0"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T11:12:53Z"},{"id":"wordfence:a1f90282-ca24-4f4b-91ea-9f26fda2bcc5","source":"wordfence","cve":"CVE-2026-86815","title":"BackWPup \u2013 WordPress Backup & Restore Plugin 5.2.2 - 5.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f90282-ca24-4f4b-91ea-9f26fda2bcc5?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"5.2.2","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:12:28Z"},{"id":"wordfence:a1fa4293-2291-4273-93c4-404770a9c560","source":"wordfence","cve":"CVE-2025-62118","title":"AdWords Conversion Tracking Code <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fa4293-2291-4273-93c4-404770a9c560?source=api-prod","affected":[{"type":"plugin","slug":"adwords-conversion-tracking-code","name":"AdWords Conversion Tracking Code","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:26:17Z"},{"id":"wordfence:a1fa6b6b-c49f-4ad5-8b56-6c122af94a11","source":"wordfence","cve":"CVE-2025-52754","title":"Sello ChannelConnector <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fa6b6b-c49f-4ad5-8b56-6c122af94a11?source=api-prod","affected":[{"type":"plugin","slug":"sello-channelconnector","name":"Sello ChannelConnector","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-10-29T20:20:29Z"},{"id":"wordfence:a1fadba1-674f-4f3d-997f-d29d3a887414","source":"wordfence","cve":"CVE-2023-3132","title":"MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fadba1-674f-4f3d-997f-d29d3a887414?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"4.4.1.1","to_inclusive":true,"patched_in":"4.4.1.2"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1fbb3a6-fcc2-47c5-a086-331e69292add","source":"wordfence","cve":"CVE-2021-4411","title":"WP EasyPay \u2013 Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fbb3a6-fcc2-47c5-a086-331e69292add?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a1fc4ce9-ae96-4d8e-bf1c-941ed15d7d1a","source":"wordfence","cve":"CVE-2024-43954","title":"Droip < 2.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1fc4ce9-ae96-4d8e-bf1c-941ed15d7d1a?source=api-prod","affected":[{"type":"plugin","slug":"droip","name":"Droip","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2024-08-26T00:00:00Z","updated":"2025-12-18T17:37:34Z"},{"id":"wordfence:a1ffb318-41b4-4b31-b170-387c368ae686","source":"wordfence","cve":"CVE-2024-47309","title":"Cities Shipping Zones for WooCommerce <= 1.2.7 - Authenticated (Shop Manager+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a1ffb318-41b4-4b31-b170-387c368ae686?source=api-prod","affected":[{"type":"plugin","slug":"cities-shipping-zones-for-woocommerce","name":"Cities Shipping Zones for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:25:37Z"},{"id":"wordfence:a200bb51-09bd-4eaa-8a57-93c3515f720c","source":"wordfence","cve":"CVE-2022-2669","title":"WP Taxonomy Import <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a200bb51-09bd-4eaa-8a57-93c3515f720c?source=api-prod","affected":[{"type":"plugin","slug":"wp-taxonomy-import","name":"WP Taxonomy Import","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2018255-b0c7-4982-9df0-7ce722c0112b","source":"wordfence","cve":"CVE-2026-78146","title":"Simple Newsletter Plugin \u2013 Noptin < 4.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2018255-b0c7-4982-9df0-7ce722c0112b?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T20:48:29Z"},{"id":"wordfence:a201aa76-8849-47a8-bc67-86a08a4159ea","source":"wordfence","cve":"CVE-2025-68088","title":"Huger for Elementor <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a201aa76-8849-47a8-bc67-86a08a4159ea?source=api-prod","affected":[{"type":"plugin","slug":"huger-elementor","name":"Huger for Elementor","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:27:25Z"},{"id":"wordfence:a201e33b-bec2-4d84-8d05-9860bc37203d","source":"wordfence","cve":"CVE-2025-23627","title":"Comment-Emailer <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a201e33b-bec2-4d84-8d05-9860bc37203d?source=api-prod","affected":[{"type":"plugin","slug":"comment-emailer","name":"Comment-Emailer","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:49:23Z"},{"id":"wordfence:a20288de-5f89-4ca3-ae6b-44ab6e1e18c3","source":"wordfence","cve":"CVE-2025-27326","title":"Video Gallery Block \u2013 Display your videos as a gallery in a professional way <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a20288de-5f89-4ca3-ae6b-44ab6e1e18c3?source=api-prod","affected":[{"type":"plugin","slug":"video-gallery-block","name":"Video Gallery Block \u2013 showcase your videos in a filterable gallery","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-07-04T00:00:00Z","updated":"2025-08-15T14:04:35Z"},{"id":"wordfence:a203b90d-b982-44ed-8dd8-d80b892206e6","source":"wordfence","cve":"CVE-2026-121760","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a203b90d-b982-44ed-8dd8-d80b892206e6?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-11-07T09:40:00Z","updated":"2026-11-10T19:46:00Z"},{"id":"wordfence:a204698b-5def-44d9-a7f4-6ac55be06551","source":"wordfence","cve":"CVE-2026-118422","title":"Stape Conversion Tracking < 2.3.11 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a204698b-5def-44d9-a7f4-6ac55be06551?source=api-prod","affected":[{"type":"plugin","slug":"gtm-server-side","name":"Stape Conversion Tracking","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":false,"patched_in":"2.3.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:33:06Z"},{"id":"wordfence:a205cad5-c81e-4a96-91bd-c77a26eab882","source":"wordfence","cve":"CVE-2026-104747","title":"Haaken <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a205cad5-c81e-4a96-91bd-c77a26eab882?source=api-prod","affected":[{"type":"theme","slug":"haaken","name":"Haaken - Fashion Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:41:15Z"},{"id":"wordfence:a2072bac-4ca1-4342-beb7-abd145aeef48","source":"wordfence","cve":"CVE-2024-3032","title":"Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2072bac-4ca1-4342-beb7-abd145aeef48?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.5.7","to_inclusive":true,"patched_in":"7.5.8"}],"published":"2024-05-23T00:00:00Z","updated":"2024-06-18T15:32:21Z"},{"id":"wordfence:a2096af8-1a09-4839-a9db-ce7ddd552b06","source":"wordfence","cve":"CVE-2025-23557","title":"Find Your Reps <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2096af8-1a09-4839-a9db-ce7ddd552b06?source=api-prod","affected":[{"type":"plugin","slug":"find-your-reps","name":"Find Your Reps","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:15:09Z"},{"id":"wordfence:a20b4870-2ef0-4932-a0e3-39876ce4b10c","source":"wordfence","cve":"CVE-2025-68910","title":"Blogzee <= 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a20b4870-2ef0-4932-a0e3-39876ce4b10c?source=api-prod","affected":[{"type":"theme","slug":"blogzee","name":"Blogzee","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:05:21Z"},{"id":"wordfence:a20c9a22-53a8-4885-8840-2788934e1a05","source":"wordfence","cve":"CVE-2025-62050","title":"Blogmatic <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a20c9a22-53a8-4885-8840-2788934e1a05?source=api-prod","affected":[{"type":"theme","slug":"blogmatic","name":"Blogmatic","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-29T15:54:49Z"},{"id":"wordfence:a20ef41d-7f01-4ef2-aae0-0b254ea78bc5","source":"wordfence","cve":"CVE-2026-1823","title":"Consensus Embed <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a20ef41d-7f01-4ef2-aae0-0b254ea78bc5?source=api-prod","affected":[{"type":"plugin","slug":"consensus-embed","name":"Consensus Embed","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:45:53Z","updated":"2026-03-07T07:22:06Z"},{"id":"wordfence:a2110d13-d6d3-43f8-b1bf-8958d4f39ef5","source":"wordfence","cve":"CVE-2024-9674","title":"Debrandify \u00b7 Remove or Replace WordPress Branding <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2110d13-d6d3-43f8-b1bf-8958d4f39ef5?source=api-prod","affected":[{"type":"plugin","slug":"debrandify","name":"Debrandify \u00b7 Remove or Replace WordPress Branding","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-10-17T21:32:45Z","updated":"2024-10-18T11:02:55Z"},{"id":"wordfence:a2121e1a-88f4-41b9-9a72-fe263b4739ef","source":"wordfence","cve":"CVE-2024-3921","title":"Gianism <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2121e1a-88f4-41b9-9a72-fe263b4739ef?source=api-prod","affected":[{"type":"plugin","slug":"gianism","name":"Gianism","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2024-05-08T00:00:00Z","updated":"2025-10-02T22:20:50Z"},{"id":"wordfence:a213e844-a0d3-4123-9f72-caef7702804c","source":"wordfence","cve":"CVE-2026-4880","title":"Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2026-04-15T11:13:44Z","updated":"2026-04-15T23:25:49Z"},{"id":"wordfence:a217794b-9da3-4286-a851-79b33c6b7e99","source":"wordfence","cve":"CVE-2025-22704","title":"WordPress Signature <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a217794b-9da3-4286-a851-79b33c6b7e99?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-signature","name":"WordPress Signature","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:44:29Z"},{"id":"wordfence:a219a232-5ff4-4855-8f29-437ed26b4f34","source":"wordfence","cve":"CVE-2023-0422","title":"Article Directory <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'publish_terms_text'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a219a232-5ff4-4855-8f29-437ed26b4f34?source=api-prod","affected":[{"type":"plugin","slug":"article-directory","name":"Article Directory","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2022-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a21b5306-e6b3-4186-a001-eb280c8d104c","source":"wordfence","cve":"CVE-2024-51624","title":"J\u00e1-J\u00e1 Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a21b5306-e6b3-4186-a001-eb280c8d104c?source=api-prod","affected":[{"type":"plugin","slug":"wc-ja-ja-pagamentos-multicaixa-express","name":"J\u00e1-J\u00e1 Pagamentos for WooCommerce \u2013 Payment with MULTICAIXA Express","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:06:41Z"},{"id":"wordfence:a21b7c40-2090-4262-9105-346db2325612","source":"wordfence","cve":"CVE-2024-10548","title":"WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a21b7c40-2090-4262-9105-346db2325612?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.15","to_inclusive":true,"patched_in":"2.6.16"}],"published":"2024-12-18T00:00:00Z","updated":"2024-12-19T01:45:14Z"},{"id":"wordfence:a21df06c-4e56-4625-ae8b-89c9fc046939","source":"wordfence","cve":"CVE-2020-8658","title":"Htaccess <= 1.8.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a21df06c-4e56-4625-ae8b-89c9fc046939?source=api-prod","affected":[{"type":"plugin","slug":"htaccess","name":"Htaccess by BestWebSoft \u2013 WordPress Website Access Control Plugin","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2020-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a222c714-7c54-4c86-b6af-abdfeb966250","source":"wordfence","cve":"CVE-2024-0672","title":"Pz-LinkCard <= 2.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a222c714-7c54-4c86-b6af-abdfeb966250?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-03-07T00:00:00Z","updated":"2024-04-24T14:46:20Z"},{"id":"wordfence:a223c8b4-6657-40f0-a040-9867595dbf64","source":"wordfence","cve":"CVE-2024-5595","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a223c8b4-6657-40f0-a040-9867595dbf64?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2024-07-12T00:00:00Z","updated":"2024-08-09T20:02:33Z"},{"id":"wordfence:a2248ba8-b7d7-4691-bf7c-8b23c24417f7","source":"wordfence","cve":"CVE-2023-2221","title":"WP Custom Cursors <= 3.1 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2248ba8-b7d7-4691-bf7c-8b23c24417f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-05-24T00:00:00Z","updated":"2024-08-09T21:03:28Z"},{"id":"wordfence:a224ba43-ee27-426a-9cd3-33c70a33d3a7","source":"wordfence","cve":"CVE-2026-32466","title":"Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a224ba43-ee27-426a-9cd3-33c70a33d3a7?source=api-prod","affected":[{"type":"plugin","slug":"gf-bookings-premium","name":"Gravity Bookings","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T12:38:02Z","updated":"2026-10-21T08:42:58Z"},{"id":"wordfence:a224e745-f9c7-4ca6-b656-e94862b1dc57","source":"wordfence","cve":"CVE-2017-20193","title":"Product Vendors <= 2.0.35 - Reflected Cross Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a224e745-f9c7-4ca6-b656-e94862b1dc57?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.0.36","to_inclusive":false,"patched_in":"2.0.36"}],"published":"2017-08-22T00:00:00Z","updated":"2024-10-16T07:31:51Z"},{"id":"wordfence:a22802aa-e8a4-47eb-9cd7-8663feb5f823","source":"wordfence","cve":"CVE-2026-84901","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22802aa-e8a4-47eb-9cd7-8663feb5f823?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":false,"patched_in":"4.1.22"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:18:59Z"},{"id":"wordfence:a228e60c-c91b-4a82-8b05-a0ffaed82524","source":"wordfence","cve":"CVE-2023-6492","title":"Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_notices","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a228e60c-c91b-4a82-8b05-a0ffaed82524?source=api-prod","affected":[{"type":"plugin","slug":"simple-sitemap","name":"Simple Sitemap \u2013 Responsive HTML Sitemap for WordPress","from":"*","from_inclusive":true,"to":"3.5.13","to_inclusive":true,"patched_in":"3.5.14"}],"published":"2024-06-13T00:00:00Z","updated":"2024-07-29T21:37:00Z"},{"id":"wordfence:a22932d8-14d4-43a1-86ba-7afadc0bec1a","source":"wordfence","cve":"","title":"Woopra Analytics Plugin < 1.4.3.2 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22932d8-14d4-43a1-86ba-7afadc0bec1a?source=api-prod","affected":[{"type":"plugin","slug":"woopra","name":"Woopra Analytics Plugin","from":"*","from_inclusive":true,"to":"1.4.3.2","to_inclusive":false,"patched_in":"1.4.3.2"}],"published":"2013-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a22ae719-4eb8-41fa-8763-05f56cdf313f","source":"wordfence","cve":"CVE-2026-91832","title":"Mobile Menu 2.7.4 - 2.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22ae719-4eb8-41fa-8763-05f56cdf313f?source=api-prod","affected":[{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"2.7.4","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.9"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:19:02Z"},{"id":"wordfence:a22b2724-2541-4345-bd42-e8a5844f3f0a","source":"wordfence","cve":"CVE-2025-12845","title":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22b2724-2541-4345-bd42-e8a5844f3f0a?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"0.5.4","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:17Z"},{"id":"wordfence:a22bba3e-423a-4231-833b-c0be57a3bf7b","source":"wordfence","cve":"CVE-2026-0741","title":"Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22bba3e-423a-4231-833b-c0be57a3bf7b?source=api-prod","affected":[{"type":"plugin","slug":"electric-studio-download-counter","name":"Electric Studio Download Counter","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:29:14Z","updated":"2026-01-14T06:40:06Z"},{"id":"wordfence:a22c7b45-752c-482d-8812-888d5bc3d630","source":"wordfence","cve":"CVE-2024-2289","title":"PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22c7b45-752c-482d-8812-888d5bc3d630?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.0.1"}],"published":"2024-03-18T00:00:00Z","updated":"2024-07-31T15:48:39Z"},{"id":"wordfence:a22fa7f8-f5d0-4007-8e4e-0185659a95d6","source":"wordfence","cve":"CVE-2024-54394","title":"Mandrill WP <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a22fa7f8-f5d0-4007-8e4e-0185659a95d6?source=api-prod","affected":[{"type":"plugin","slug":"email-form-under-post","name":"Mandrill WP \u2013 Email Form Under Post","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:01:03Z"},{"id":"wordfence:a234c996-3716-47b8-abab-8be9cb870997","source":"wordfence","cve":"CVE-2025-39462","title":"Smart Agreements <= 1.0.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a234c996-3716-47b8-abab-8be9cb870997?source=api-prod","affected":[{"type":"plugin","slug":"smart-agreements","name":"Smart Agreements","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:45:20Z"},{"id":"wordfence:a2362dea-8c4a-426f-9482-b7e19b8f5f4e","source":"wordfence","cve":"CVE-2023-35878","title":"Extra User Details <= 0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2362dea-8c4a-426f-9482-b7e19b8f5f4e?source=api-prod","affected":[{"type":"plugin","slug":"extra-user-details","name":"Extra User Details","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.5.1"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2363a40-b627-44da-af8e-98821685c3ea","source":"wordfence","cve":"","title":"Eshop Magic < 0.2 - Arbitrary File Read","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2363a40-b627-44da-af8e-98821685c3ea?source=api-prod","affected":[{"type":"plugin","slug":"eshop-magic","name":"Eshop Magic","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":false,"patched_in":"0.2"}],"published":"2012-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2399535-c293-4b06-8ef4-1706bbe12bf7","source":"wordfence","cve":"CVE-2026-5062","title":"PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2399535-c293-4b06-8ef4-1706bbe12bf7?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":"3.6.21"}],"published":"2026-08-04T16:56:59Z","updated":"2026-08-05T05:27:38Z"},{"id":"wordfence:a23bb496-06f0-4c4b-91db-c82b07824213","source":"wordfence","cve":"CVE-2026-54849","title":"Premmerce Wishlist for WooCommerce <= 1.1.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a23bb496-06f0-4c4b-91db-c82b07824213?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:35:20Z"},{"id":"wordfence:a23d9eaa-403a-4130-bc12-f4c2489d65ce","source":"wordfence","cve":"CVE-2026-125434","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1235 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a23d9eaa-403a-4130-bc12-f4c2489d65ce?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1235","to_inclusive":true,"patched_in":"4.1236"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:45Z"},{"id":"wordfence:a241252d-684d-4edd-acd1-91a46a5e35fb","source":"wordfence","cve":"CVE-2025-68564","title":"Sendy <= 3.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a241252d-684d-4edd-acd1-91a46a5e35fb?source=api-prod","affected":[{"type":"plugin","slug":"sendy","name":"Sendy","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-01-28T00:00:00Z","updated":"2026-04-15T13:36:16Z"},{"id":"wordfence:a2417c2d-65a0-4014-b8c7-79c8f2fda6b6","source":"wordfence","cve":"CVE-2026-111962","title":"WP Remote Users Sync < 2.2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2417c2d-65a0-4014-b8c7-79c8f2fda6b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-remote-users-sync","name":"WP Remote Users Sync","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:36:08Z"},{"id":"wordfence:a241db4e-bd13-461f-9603-d3a28ba9e018","source":"wordfence","cve":"CVE-2025-69305","title":"Crete Core <= 1.4.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a241db4e-bd13-461f-9603-d3a28ba9e018?source=api-prod","affected":[{"type":"plugin","slug":"crete-core","name":"Crete Core","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:22:52Z"},{"id":"wordfence:a2423bdc-71ea-4328-a6a4-f79a0a446f26","source":"wordfence","cve":"CVE-2026-25349","title":"Loobek < 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2423bdc-71ea-4328-a6a4-f79a0a446f26?source=api-prod","affected":[{"type":"theme","slug":"loobek","name":"Loobek - Elementor Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:41:47Z"},{"id":"wordfence:a2432a0a-d262-4460-bd2d-2cb200d51f6f","source":"wordfence","cve":"CVE-2024-0852","title":"coreActivity <= 1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2432a0a-d262-4460-bd2d-2cb200d51f6f?source=api-prod","affected":[{"type":"plugin","slug":"coreactivity","name":"coreActivity: Activity Logging for WordPress","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-01-26T00:00:00Z","updated":"2024-01-29T12:58:20Z"},{"id":"wordfence:a243fbde-951b-43e0-a432-c92ae4b04c26","source":"wordfence","cve":"CVE-2023-50892","title":"TheGem <= 5.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a243fbde-951b-43e0-a432-c92ae4b04c26?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2447cf4-0261-4ef2-98ec-98fa02dc8b87","source":"wordfence","cve":"CVE-2025-4179","title":"Flynax Bridge <= 2.2.0 - Unauthenticated Limited Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2447cf4-0261-4ef2-98ec-98fa02dc8b87?source=api-prod","affected":[{"type":"plugin","slug":"flynax-bridge","name":"Flynax Bridge","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-05-01T00:00:00Z","updated":"2025-11-05T21:25:36Z"},{"id":"wordfence:a2452dd7-2bb9-4a0c-81db-6699a9b049ae","source":"wordfence","cve":"CVE-2025-3715","title":"Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2452dd7-2bb9-4a0c-81db-6699a9b049ae?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2025-05-17T16:21:31Z","updated":"2025-05-18T05:22:41Z"},{"id":"wordfence:a246227c-89c1-46c3-a74c-b5de260d8a19","source":"wordfence","cve":"CVE-2021-24428","title":"Rss for Yandex Turbo <= 1.30 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a246227c-89c1-46c3-a74c-b5de260d8a19?source=api-prod","affected":[{"type":"plugin","slug":"rss-for-yandex-turbo","name":"RSS for Yandex Turbo","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2021-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2495fd6-5a36-4bdf-b4e0-68095072d820","source":"wordfence","cve":"CVE-2024-11424","title":"Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2495fd6-5a36-4bdf-b4e0-68095072d820?source=api-prod","affected":[{"type":"plugin","slug":"slick-sitemap","name":"Slick Sitemap","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:35:16Z","updated":"2024-11-21T02:06:39Z"},{"id":"wordfence:a24acd18-c94d-4fde-bf6c-7f6b839336d1","source":"wordfence","cve":"CVE-2026-110533","title":"FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24acd18-c94d-4fde-bf6c-7f6b839336d1?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.55.7212","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-10-30T17:05:24Z","updated":"2026-10-30T17:15:29Z"},{"id":"wordfence:a24af0ad-3204-4442-9e3e-8e57ab72e607","source":"wordfence","cve":"CVE-2025-39379","title":"Capturly <= 2.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24af0ad-3204-4442-9e3e-8e57ab72e607?source=api-prod","affected":[{"type":"plugin","slug":"capturly-optimize-your-website","name":"Capturly","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-04-21T00:00:00Z","updated":"2026-03-17T21:22:15Z"},{"id":"wordfence:a24c2d7d-8df8-4a3a-a538-09e11ebc6dd5","source":"wordfence","cve":"CVE-2024-4667","title":"Blog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24c2d7d-8df8-4a3a-a538-09e11ebc6dd5?source=api-prod","affected":[{"type":"plugin","slug":"blog-posts-and-category-for-elementor","name":"Blog, Posts and Category Filter for Elementor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-07-08T15:42:29Z","updated":"2024-07-09T04:32:56Z"},{"id":"wordfence:a24e0a05-e387-44be-9a4c-ae59ee65a06a","source":"wordfence","cve":"CVE-2025-49913","title":"CoSchedule <= 3.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24e0a05-e387-44be-9a4c-ae59ee65a06a?source=api-prod","affected":[{"type":"plugin","slug":"coschedule-by-todaymade","name":"CoSchedule","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-04T16:10:15Z"},{"id":"wordfence:a24ed885-557b-4f3e-b3d0-345d2ebc8cc5","source":"wordfence","cve":"CVE-2024-2470","title":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box <= 20240318 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a24ed885-557b-4f3e-b3d0-345d2ebc8cc5?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20240318","to_inclusive":true,"patched_in":"20240412"}],"published":"2024-05-14T00:00:00Z","updated":"2024-06-06T13:30:13Z"},{"id":"wordfence:a250f678-1ec7-48ea-8b81-e5ef89992155","source":"wordfence","cve":"CVE-2023-1093","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.24.1- Cross-Site Request Forgery via 'discard' in mooauth_client_applist_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a250f678-1ec7-48ea-8b81-e5ef89992155?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.24.1","to_inclusive":true,"patched_in":"6.24.2"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a251bcbf-68ec-4833-b21c-7a823ce65279","source":"wordfence","cve":"CVE-2022-4356","title":"LetsRecover <= 1.1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a251bcbf-68ec-4833-b21c-7a823ce65279?source=api-prod","affected":[{"type":"plugin","slug":"letsrecover-woocommerce-abandoned-cart","name":"LetsRecover \u2013 WooCommerce Abandoned Cart Notifications","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2520d98-3cee-4431-bf9c-b2fd01a584ce","source":"wordfence","cve":"CVE-2025-1703","title":"Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2520d98-3cee-4431-bf9c-b2fd01a584ce?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-03-25T21:03:13Z","updated":"2025-03-26T09:21:51Z"},{"id":"wordfence:a2552407-0b32-4129-b131-792305ed023e","source":"wordfence","cve":"CVE-2026-25440","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2552407-0b32-4129-b131-792305ed023e?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.0","to_inclusive":false,"patched_in":"6.6.0"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T14:54:34Z"},{"id":"wordfence:a25528b1-28e0-4ac7-a7ab-2568b8349990","source":"wordfence","cve":"","title":"Famous (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25528b1-28e0-4ac7-a7ab-2568b8349990?source=api-prod","affected":[{"type":"theme","slug":"famous","name":"Famous","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a256e11e-b59d-4ce1-ac52-da89789e97a9","source":"wordfence","cve":"CVE-2024-37562","title":"Simple Post Notes <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a256e11e-b59d-4ce1-ac52-da89789e97a9?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-notes","name":"Simple Post Notes","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-30T20:08:37Z"},{"id":"wordfence:a25a00b5-baf3-4175-b242-857c1f79b9a2","source":"wordfence","cve":"CVE-2024-7818","title":"Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25a00b5-baf3-4175-b242-857c1f79b9a2?source=api-prod","affected":[{"type":"plugin","slug":"misiek-photo-album","name":"Misiek Photo Album","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:26:16Z"},{"id":"wordfence:a25ad405-a97e-4821-b57a-0f39d5ce5e70","source":"wordfence","cve":"CVE-2024-5937","title":"Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25ad405-a97e-4821-b57a-0f39d5ce5e70?source=api-prod","affected":[{"type":"plugin","slug":"simple-alert-boxes","name":"Simple Alert Boxes","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T20:02:07Z","updated":"2024-07-09T08:33:09Z"},{"id":"wordfence:a25b2187-2ba8-4332-9f96-a003edd97ff6","source":"wordfence","cve":"CVE-2024-12098","title":"ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25b2187-2ba8-4332-9f96-a003edd97ff6?source=api-prod","affected":[{"type":"plugin","slug":"ars-affiliate-page","name":"ARS Affiliate Page Plugin","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-30T22:33:52Z"},{"id":"wordfence:a25e5882-829e-4759-9c71-1d69ce4cf317","source":"wordfence","cve":"CVE-2025-30818","title":"jAlbum Bridge <= 2.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25e5882-829e-4759-9c71-1d69ce4cf317?source=api-prod","affected":[{"type":"plugin","slug":"jalbum-bridge","name":"jAlbum Bridge","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:58:14Z"},{"id":"wordfence:a25fbc55-12b8-4074-a5be-195b8ecc01fd","source":"wordfence","cve":"CVE-2024-51812","title":"Pro Addons For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a25fbc55-12b8-4074-a5be-195b8ecc01fd?source=api-prod","affected":[{"type":"plugin","slug":"pro-addons-for-elementor","name":"Pro Addons For Elementor | Premium Addons","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:56:09Z"},{"id":"wordfence:a260c173-9d3f-4b2d-b443-86488bd26292","source":"wordfence","cve":"CVE-2022-0658","title":"CommonsBooking < 2.6.8 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a260c173-9d3f-4b2d-b443-86488bd26292?source=api-prod","affected":[{"type":"plugin","slug":"commonsbooking","name":"CommonsBooking","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":false,"patched_in":"2.6.8"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a263e79e-b1d4-4f04-8a93-aad6ca76eaf8","source":"wordfence","cve":"CVE-2025-27294","title":"WP-Asambleas <= 2.85.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a263e79e-b1d4-4f04-8a93-aad6ca76eaf8?source=api-prod","affected":[{"type":"plugin","slug":"wp-asambleas","name":"WP-Asambleas","from":"*","from_inclusive":true,"to":"2.85.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:25:05Z"},{"id":"wordfence:a26473b9-8cc1-47e6-a3d3-4ebf1f9e902a","source":"wordfence","cve":"CVE-2022-0141","title":"Visual Form Builder <= 3.0.7 - Cross-Site Request Forgery to Data Modification","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26473b9-8cc1-47e6-a3d3-4ebf1f9e902a?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a264eb8a-bf56-4b05-b360-0dd450c70c6b","source":"wordfence","cve":"CVE-2024-49235","title":"Contact Forms, Live Support, CRM, Video Messages <= 1.10.3 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a264eb8a-bf56-4b05-b360-0dd450c70c6b?source=api-prod","affected":[{"type":"plugin","slug":"live-support-tickets","name":"Contact Forms, Live Support, CRM, Video Messages","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-11-08T16:19:46Z"},{"id":"wordfence:a266e003-3a0a-4832-a88b-60c2a26b387c","source":"wordfence","cve":"CVE-2025-2635","title":"Digital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg Function","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a266e003-3a0a-4832-a88b-60c2a26b387c?source=api-prod","affected":[{"type":"plugin","slug":"digital-license-manager","name":"Digital License Manager","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-03-24T20:55:16Z","updated":"2025-03-25T09:22:03Z"},{"id":"wordfence:a26a6f28-4a7f-421d-a69e-2afbe1367106","source":"wordfence","cve":"CVE-2023-35880","title":"WooCommerce Brands <= 1.6.49 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26a6f28-4a7f-421d-a69e-2afbe1367106?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-brands","name":"WooCommerce Brands","from":"*","from_inclusive":true,"to":"1.6.49","to_inclusive":true,"patched_in":"1.6.50"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a26c71d6-9840-450e-90cd-c20de53f5cb5","source":"wordfence","cve":"CVE-2025-11928","title":"CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26c71d6-9840-450e-90cd-c20de53f5cb5?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"12.0.5","to_inclusive":true,"patched_in":"12.0.6"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T03:34:37Z"},{"id":"wordfence:a26c9171-54d3-41fb-a3a7-95729437323b","source":"wordfence","cve":"CVE-2025-32559","title":"REVE Chat <= 6.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26c9171-54d3-41fb-a3a7-95729437323b?source=api-prod","affected":[{"type":"plugin","slug":"revechat","name":"REVE Chat \u2013 AI Chatbot, Live Chat, Helpdesk, Campaigns & More","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:51:00Z"},{"id":"wordfence:a26da53c-4be0-4c9f-9caf-05f054a6d5e7","source":"wordfence","cve":"CVE-2024-10717","title":"Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26da53c-4be0-4c9f-9caf-05f054a6d5e7?source=api-prod","affected":[{"type":"plugin","slug":"styler-for-ninja-forms-lite","name":"Styler for Ninja Forms","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T13:26:45Z","updated":"2024-11-13T02:02:34Z"},{"id":"wordfence:a26e35a5-d93a-49fb-8a70-d32a7624ffc1","source":"wordfence","cve":"CVE-2025-60178","title":"Gravity Forms HubSpot <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26e35a5-d93a-49fb-8a70-d32a7624ffc1?source=api-prod","affected":[{"type":"plugin","slug":"gf-hubspot","name":"WP Gravity Forms HubSpot","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-08-08T00:00:00Z","updated":"2025-12-20T15:48:53Z"},{"id":"wordfence:a26f4bb7-fe61-4343-82ee-19639c16d978","source":"wordfence","cve":"CVE-2021-24641","title":"Images to WebP < 1.9 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26f4bb7-fe61-4343-82ee-19639c16d978?source=api-prod","affected":[{"type":"plugin","slug":"images-to-webp","name":"Images to WebP","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a26f5a05-5fca-4eaf-a309-dc3bb419e212","source":"wordfence","cve":"CVE-2026-19842","title":"SAML Single Sign On \u2013 SSO Login  4.8.85-5.4.6 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a26f5a05-5fca-4eaf-a309-dc3bb419e212?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"4.8.85","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:28:35Z"},{"id":"wordfence:a272e12b-97a2-421a-a703-3acce2ed8313","source":"wordfence","cve":"CVE-2023-3320","title":"WP Sticky Social <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a272e12b-97a2-421a-a703-3acce2ed8313?source=api-prod","affected":[{"type":"plugin","slug":"wp-sticky-social","name":"WP Sticky Social","from":"1.0.1","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2749208-281f-419e-bfb4-5519f2b26130","source":"wordfence","cve":"CVE-2026-110889","title":"Gantry 5 Framework <= 5.6.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2749208-281f-419e-bfb4-5519f2b26130?source=api-prod","affected":[{"type":"plugin","slug":"gantry5","name":"Gantry 5 Framework","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2026-10-15T10:27:21Z","updated":"2026-10-23T18:23:07Z"},{"id":"wordfence:a276d70d-3ad7-49e0-a25c-8089cdd581da","source":"wordfence","cve":"","title":"AddThis <= 5.0.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a276d70d-3ad7-49e0-a25c-8089cdd581da?source=api-prod","affected":[{"type":"plugin","slug":"addthis","name":"WordPress Share Buttons Plugin \u2013 AddThis","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"5.0.3"}],"published":"2015-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2791f48-895f-4099-87ec-41aaac2494a2","source":"wordfence","cve":"CVE-2023-5233","title":"Font Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2791f48-895f-4099-87ec-41aaac2494a2?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome-integration","name":"Font Awesome Integration","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a27aa8f5-9662-4e31-abc1-c8e71bb791db","source":"wordfence","cve":"CVE-2025-69019","title":"FlippingBook <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27aa8f5-9662-4e31-abc1-c8e71bb791db?source=api-prod","affected":[{"type":"plugin","slug":"flippingbook","name":"FlippingBook","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-27T21:43:06Z"},{"id":"wordfence:a27b8d53-7229-4c88-9bda-5db31b0f8d92","source":"wordfence","cve":"CVE-2025-6719","title":"Terms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27b8d53-7229-4c88-9bda-5db31b0f8d92?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2025-07-17T16:23:32Z","updated":"2025-11-08T02:16:17Z"},{"id":"wordfence:a27c0dc8-a6bf-45a4-af48-ccc375720a4a","source":"wordfence","cve":"CVE-2026-73997","title":"Kadence Starter Templates \u2014 Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27c0dc8-a6bf-45a4-af48-ccc375720a4a?source=api-prod","affected":[{"type":"plugin","slug":"kadence-starter-templates","name":"Kadence Starter Templates \u2014 Predesigned Website Templates","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T13:40:59Z"},{"id":"wordfence:a27c6935-adad-47c7-a387-9a4d297c383f","source":"wordfence","cve":"CVE-2025-23527","title":"WC Wallet <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27c6935-adad-47c7-a387-9a4d297c383f?source=api-prod","affected":[{"type":"plugin","slug":"wc-wallet","name":"WC Wallet","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T15:43:10Z"},{"id":"wordfence:a27cfa5a-e02a-4c92-8503-2c7cd32fb1f1","source":"wordfence","cve":"CVE-2022-1889","title":"Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27cfa5a-e02a-4c92-8503-2c7cd32fb1f1?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"7.4.6","to_inclusive":false,"patched_in":"7.4.6"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a27d7c0b-81d4-4e7a-a7b4-96c0a02b6264","source":"wordfence","cve":"CVE-2025-32533","title":"Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27d7c0b-81d4-4e7a-a7b4-96c0a02b6264?source=api-prod","affected":[{"type":"plugin","slug":"wc-shipos-delivery","name":"Deliver via Shipos for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:56:17Z"},{"id":"wordfence:a27da737-d925-471f-b0e0-25bc27a95714","source":"wordfence","cve":"CVE-2021-44760","title":"WP-DownloadManager plugin <= 1.68.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27da737-d925-471f-b0e0-25bc27a95714?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.6","to_inclusive":true,"patched_in":"1.68.7"}],"published":"2021-12-28T08:23:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a27dfc37-81cf-4e95-a331-02fc952e34af","source":"wordfence","cve":"CVE-2026-1905","title":"Sphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27dfc37-81cf-4e95-a331-02fc952e34af?source=api-prod","affected":[{"type":"plugin","slug":"sphere-manager","name":"Sphere Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:26:00Z","updated":"2026-02-14T06:42:31Z"},{"id":"wordfence:a27eb4f9-3e8e-42bc-8808-fd47a17d5cd7","source":"wordfence","cve":"CVE-2025-54011","title":"SMTP2GO <= 1.12.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a27eb4f9-3e8e-42bc-8808-fd47a17d5cd7?source=api-prod","affected":[{"type":"plugin","slug":"smtp2go","name":"SMTP2GO for WordPress \u2013 Email Made Easy","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:09:38Z"},{"id":"wordfence:a284a028-90e8-4f6e-9ba1-a3a890705894","source":"wordfence","cve":"CVE-2026-32553","title":"OttoKit: All-in-One Automation Platform <= 1.1.35 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a284a028-90e8-4f6e-9ba1-a3a890705894?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:43:38Z"},{"id":"wordfence:a2871261-3231-4a52-9a38-bb3caf461e7d","source":"wordfence","cve":"CVE-2020-36718","title":"GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2871261-3231-4a52-9a38-bb3caf461e7d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-gdpr-compliance","name":"GDPR CCPA Compliance & Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2020-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2874a5f-71f4-4bcd-87e8-a20bb19a5847","source":"wordfence","cve":"CVE-2025-5949","title":"Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2025-10-31T16:21:08Z","updated":"2025-11-01T04:27:42Z"},{"id":"wordfence:a2887dbf-7d88-45da-afa5-e89dfa8bae21","source":"wordfence","cve":"CVE-2025-48238","title":"AWcode Toolkit <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2887dbf-7d88-45da-afa5-e89dfa8bae21?source=api-prod","affected":[{"type":"plugin","slug":"awcode-toolkit","name":"AWcode Toolkit","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T16:48:31Z"},{"id":"wordfence:a288b1e1-a5b3-4818-bff3-77f54ca02d28","source":"wordfence","cve":"CVE-2025-49409","title":"Portfolio Manager Pro  3.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a288b1e1-a5b3-4818-bff3-77f54ca02d28?source=api-prod","affected":[{"type":"plugin","slug":"otw-portfolio-manager","name":"Portfolio Manager Pro - WordPress Responsive Portfolio & Gallery","from":"3.8","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:22:28Z"},{"id":"wordfence:a28e3f3b-6f8d-4745-bb56-a7c9e973a4ca","source":"wordfence","cve":"CVE-2026-24357","title":"Recipe Maker <= 10.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a28e3f3b-6f8d-4745-bb56-a7c9e973a4ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.2.4","to_inclusive":true,"patched_in":"10.3.0"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:31:08Z"},{"id":"wordfence:a28f9860-395d-4087-9e0d-cf0332aba39f","source":"wordfence","cve":"CVE-2026-49770","title":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a28f9860-395d-4087-9e0d-cf0332aba39f?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.7.12","to_inclusive":true,"patched_in":"6.8.0"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:44:57Z"},{"id":"wordfence:a2919bbc-c4c2-4b52-90ec-2471218cd7d1","source":"wordfence","cve":"CVE-2025-14073","title":"WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2919bbc-c4c2-4b52-90ec-2471218cd7d1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-paypal-payments","name":"WooCommerce PayPal Payments","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-07-31T19:56:35Z","updated":"2026-08-01T08:32:28Z"},{"id":"wordfence:a292239a-0848-4770-8993-2cff5ef16eaa","source":"wordfence","cve":"CVE-2025-23718","title":"Mancx AskMe Widget <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a292239a-0848-4770-8993-2cff5ef16eaa?source=api-prod","affected":[{"type":"plugin","slug":"mancx-askme-widget","name":"Mancx AskMe Widget","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:28:19Z"},{"id":"wordfence:a292579c-9755-4bd4-996c-23d19ca1c197","source":"wordfence","cve":"CVE-2024-3167","title":"Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a292579c-9755-4bd4-996c-23d19ca1c197?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-09T18:59:11Z"},{"id":"wordfence:a2926c11-c6a2-4988-89ed-42d9e0791b95","source":"wordfence","cve":"CVE-2025-58246","title":"WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2926c11-c6a2-4988-89ed-42d9e0791b95?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.30","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.26","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.27","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.23","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.20","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.22","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.19","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.17","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.16","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.15","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.13","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.11","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.10","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.8","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.3","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.2","to_inclusive":true,"patched_in":"4.7.31"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:25:10Z"},{"id":"wordfence:a2935561-6c26-4c22-ab91-a13358a3c978","source":"wordfence","cve":"CVE-2025-67974","title":"WPLegalPages <= 3.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2935561-6c26-4c22-ab91-a13358a3c978?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:29:23Z"},{"id":"wordfence:a295004a-8206-401c-8130-4d9b37f36fb8","source":"wordfence","cve":"CVE-2026-77783","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a295004a-8206-401c-8130-4d9b37f36fb8?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:39:08Z"},{"id":"wordfence:a29832db-f85f-475b-8671-3d2115f33f19","source":"wordfence","cve":"CVE-2024-43129","title":"BetterDocs <= 3.5.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a29832db-f85f-475b-8671-3d2115f33f19?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:16:44Z"},{"id":"wordfence:a298955e-c8e2-4732-a38e-4f7338a088bc","source":"wordfence","cve":"CVE-2026-13173","title":"Eventin <= 4.1.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a298955e-c8e2-4732-a38e-4f7338a088bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T19:49:42Z"},{"id":"wordfence:a29959ea-af64-4a80-b46e-1e3b3cddc531","source":"wordfence","cve":"CVE-2025-12828","title":"Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a29959ea-af64-4a80-b46e-1e3b3cddc531?source=api-prod","affected":[{"type":"plugin","slug":"ut-elementor-addons-lite","name":"Ultra Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-10-02T17:14:10Z","updated":"2026-10-03T05:29:16Z"},{"id":"wordfence:a29b18d4-7b9b-48c9-aea8-88f6a6fc4b29","source":"wordfence","cve":"CVE-2017-17059","title":"amtyThumb posts <= 8.2.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a29b18d4-7b9b-48c9-aea8-88f6a6fc4b29?source=api-prod","affected":[{"type":"plugin","slug":"amty-thumb-recent-post","name":"amtyThumb posts","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":""}],"published":"2017-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a29b5972-36c9-4477-ad16-d89a2e9bd9f7","source":"wordfence","cve":"CVE-2025-64231","title":"Contact Form 7 PDF, Google Sheet & Database <= 3.0.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a29b5972-36c9-4477-ad16-d89a2e9bd9f7?source=api-prod","affected":[{"type":"plugin","slug":"rtwwcfp-wordpress-contact-form-7-pdf","name":"WordPress Contact Form 7 PDF, Google Sheet & Database","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-10-28T00:00:00Z","updated":"2025-12-20T19:11:41Z"},{"id":"wordfence:a29ebdcb-3b03-4504-b553-6f7633c68f3f","source":"wordfence","cve":"CVE-2024-53786","title":"Cowidgets \u2013 Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a29ebdcb-3b03-4504-b553-6f7633c68f3f?source=api-prod","affected":[{"type":"plugin","slug":"cowidgets-elementor-addons","name":"Cowidgets \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:06:13Z"},{"id":"wordfence:a2a0940a-8a53-49bc-820b-bfbbfc408121","source":"wordfence","cve":"CVE-2024-52354","title":"Web Stories Widgets For Elementor <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a0940a-8a53-49bc-820b-bfbbfc408121?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-for-amp-web-stories-and-elementor-widget","name":"Web Stories Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:03:54Z"},{"id":"wordfence:a2a41a15-0743-48cc-8c92-7cb839fa5847","source":"wordfence","cve":"CVE-2025-14944","title":"Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a41a15-0743-48cc-8c92-7cb839fa5847?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-04-06T00:00:00Z","updated":"2026-04-07T16:26:24Z"},{"id":"wordfence:a2a4b5bb-d3c9-42e0-8714-ae75069c7c3a","source":"wordfence","cve":"CVE-2022-31090","title":"Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure","severity":"high","cvss":7.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a4b5bb-d3c9-42e0-8714-ae75069c7c3a?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2a58fab-d4a3-4333-8495-e094ed85bb61","source":"wordfence","cve":"CVE-2023-0038","title":"Survey Maker \u2013 Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a58fab-d4a3-4333-8495-e094ed85bb61?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2a66d58-ee72-49f7-b76b-f8a0f625652c","source":"wordfence","cve":"CVE-2025-69093","title":"ShopMagic <= 4.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a66d58-ee72-49f7-b76b-f8a0f625652c?source=api-prod","affected":[{"type":"plugin","slug":"shopmagic-for-woocommerce","name":"ShopMagic \u2013 email automation for WordPress","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T14:40:26Z"},{"id":"wordfence:a2a697f5-4888-438e-89b5-9355b9b06194","source":"wordfence","cve":"CVE-2025-31453","title":"YouTube SimpleGallery <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a697f5-4888-438e-89b5-9355b9b06194?source=api-prod","affected":[{"type":"plugin","slug":"youtube-simplegallery","name":"YouTube SimpleGallery","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T13:33:08Z"},{"id":"wordfence:a2a892ed-930a-49c8-a11f-3ba408d1b3aa","source":"wordfence","cve":"CVE-2025-62733","title":"Custom Sidebars by ProteusThemes <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a892ed-930a-49c8-a11f-3ba408d1b3aa?source=api-prod","affected":[{"type":"plugin","slug":"custom-sidebars-by-proteusthemes","name":"Custom Sidebars by ProteusThemes","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-12-04T00:00:00Z","updated":"2026-10-13T16:57:23Z"},{"id":"wordfence:a2abbc26-d228-45eb-bd2e-727f9ec606d7","source":"wordfence","cve":"CVE-2025-24765","title":"Image Shadow <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2abbc26-d228-45eb-bd2e-727f9ec606d7?source=api-prod","affected":[{"type":"plugin","slug":"image-shadow","name":"Image Shadow","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T14:22:10Z"},{"id":"wordfence:a2ac27b5-88d5-43d5-a4bb-c2948ffc50f0","source":"wordfence","cve":"","title":"Clipta Video Informer <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ac27b5-88d5-43d5-a4bb-c2948ffc50f0?source=api-prod","affected":[{"type":"plugin","slug":"clipta-video-informer","name":"Clipta Video Informer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2ad2c0d-542e-4b40-91a8-19b27297545e","source":"wordfence","cve":"","title":"Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ad2c0d-542e-4b40-91a8-19b27297545e?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.7.5.3","to_inclusive":true,"patched_in":"1.7.5.5"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2b03615-13e2-4673-9544-3795fc5ee78e","source":"wordfence","cve":"CVE-2026-118404","title":"Premium Packages \u2013 Sell Digital Products Securely < 7.3.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b03615-13e2-4673-9544-3795fc5ee78e?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":false,"patched_in":"7.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:34:29Z"},{"id":"wordfence:a2b173e8-5bdd-4048-8201-2d66ce2f2eca","source":"wordfence","cve":"CVE-2023-0370","title":"WPB Advanced FAQ <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b173e8-5bdd-4048-8201-2d66ce2f2eca?source=api-prod","affected":[{"type":"plugin","slug":"wpb-advanced-faq","name":"WPB Advanced FAQ","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2b2dd36-eca8-4d80-80f5-783f9402dd3c","source":"wordfence","cve":"CVE-2026-12409","title":"Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b2dd36-eca8-4d80-80f5-783f9402dd3c?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":"1.5.3.7"}],"published":"2026-07-15T13:45:17Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:a2b317f7-b7b6-45d0-b8bf-29f70669db51","source":"wordfence","cve":"CVE-2024-47347","title":"Chartify <= 2.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b317f7-b7b6-45d0-b8bf-29f70669db51?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:19:55Z"},{"id":"wordfence:a2b36fb7-ec94-4364-b962-23723b728b6d","source":"wordfence","cve":"CVE-2026-105262","title":"Falang multilanguage for WordPress <= 1.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b36fb7-ec94-4364-b962-23723b728b6d?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:04:02Z"},{"id":"wordfence:a2b6ecc1-8957-49b4-941a-a327ae21dd05","source":"wordfence","cve":"CVE-2026-11781","title":"Adminify <= 4.2.9 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b6ecc1-8957-49b4-941a-a327ae21dd05?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.2.10"}],"published":"2026-06-11T00:00:00Z","updated":"2026-08-21T13:57:50Z"},{"id":"wordfence:a2b809f5-0384-43f5-8839-67bf059360eb","source":"wordfence","cve":"CVE-2022-4004","title":"Donation Button <= 4.0.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b809f5-0384-43f5-8839-67bf059360eb?source=api-prod","affected":[{"type":"plugin","slug":"donation-button","name":"Donation Button","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2b8d0f9-3fe1-4588-b81f-13d7db47afea","source":"wordfence","cve":"CVE-2025-47504","title":"Multiple Plugins by wpcodefactory <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b8d0f9-3fe1-4588-b81f-13d7db47afea?source=api-prod","affected":[{"type":"plugin","slug":"eu-vat-for-woocommerce","name":"EU/UK VAT Validation Manager for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"},{"type":"plugin","slug":"product-quantity-for-woocommerce","name":"Min Max Step Quantity Limits Manager for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"},{"type":"plugin","slug":"custom-checkout-fields-for-woocommerce","name":"Custom Checkout Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.9.0"},{"type":"plugin","slug":"products-per-page-for-woocommerce","name":"Number of Products per Page \u2013 Pagination Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-02T19:43:34Z"},{"id":"wordfence:a2b8e295-4183-4f84-801f-da9ffa6efce2","source":"wordfence","cve":"CVE-2023-0148","title":"Gallery Factory Lite <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b8e295-4183-4f84-801f-da9ffa6efce2?source=api-prod","affected":[{"type":"plugin","slug":"gallery-factory-lite","name":"Gallery Factory Lite","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2b9d080-489d-40e4-bb6f-c4209e5f4fad","source":"wordfence","cve":"CVE-2024-29934","title":"Piotnet Addons For Elementor <= 2.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2b9d080-489d-40e4-bb6f-c4209e5f4fad?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.25","to_inclusive":true,"patched_in":"2.4.26"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-10T18:58:17Z"},{"id":"wordfence:a2ba21cd-d8f3-402a-b067-1758937d9eb4","source":"wordfence","cve":"CVE-2022-47447","title":"WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ba21cd-d8f3-402a-b067-1758937d9eb4?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2bb5f83-f331-49d4-b26c-6307d305572e","source":"wordfence","cve":"CVE-2026-22379","title":"Netmix <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bb5f83-f331-49d4-b26c-6307d305572e?source=api-prod","affected":[{"type":"theme","slug":"netmix","name":"Netmix | Broadband & Telecom Internet Provider  WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:28:51Z"},{"id":"wordfence:a2bbaeb6-7a63-4dbc-b8af-a323dc8fe66f","source":"wordfence","cve":"CVE-2026-77017","title":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bbaeb6-7a63-4dbc-b8af-a323dc8fe66f?source=api-prod","affected":[{"type":"plugin","slug":"workeera-remote-tech-job-board","name":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS)","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:43:31Z"},{"id":"wordfence:a2bd106e-03b2-4b91-8c44-c0f9ff6f1097","source":"wordfence","cve":"CVE-2025-69125","title":"Food Drop <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bd106e-03b2-4b91-8c44-c0f9ff6f1097?source=api-prod","affected":[{"type":"theme","slug":"food-drop","name":"Food Drop | Meal Ordering & Delivery Mobile App WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:34:45Z"},{"id":"wordfence:a2bda5d0-9589-4925-baa6-6e207e6fc978","source":"wordfence","cve":"CVE-2024-32599","title":"WP Dummy Content Generator <= 3.2.1 - Unauthenticated Code Injection","severity":"critical","cvss":10.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bda5d0-9589-4925-baa6-6e207e6fc978?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T13:26:46Z"},{"id":"wordfence:a2bf2f05-67bb-485e-a478-a72962d96647","source":"wordfence","cve":"CVE-2026-115954","title":"Geo Mashup <= 1.13.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf2f05-67bb-485e-a478-a72962d96647?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.22","to_inclusive":true,"patched_in":"1.13.23"}],"published":"2026-10-26T10:27:00Z","updated":"2026-10-28T01:25:05Z"},{"id":"wordfence:a2bf482a-fea3-40a1-b97a-3b45ed1f81fb","source":"wordfence","cve":"CVE-2026-80514","title":"wpForo Forum 3.0.0 - 3.1.5 -  Unauthenticated AI Credit Exhaustion","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf482a-fea3-40a1-b97a-3b45ed1f81fb?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"3.0.0","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:01:55Z"},{"id":"wordfence:a2bf5c47-11e6-462d-a671-3f5e94e9e7e5","source":"wordfence","cve":"CVE-2025-13960","title":"GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf5c47-11e6-462d-a671-3f5e94e9e7e5?source=api-prod","affected":[{"type":"plugin","slug":"gpxpress","name":"GPXpress","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:39:04Z","updated":"2025-12-12T03:20:51Z"},{"id":"wordfence:a2bf6102-458f-4930-8880-baa96afb1c15","source":"wordfence","cve":"CVE-2024-8786","title":"Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf6102-458f-4930-8880-baa96afb1c15?source=api-prod","affected":[{"type":"plugin","slug":"auto-featured-image-from-title","name":"Auto Featured Image from Title","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-12-02T18:51:29Z"},{"id":"wordfence:a2c3a01c-af77-4abc-b33c-b637d55e0be2","source":"wordfence","cve":"CVE-2026-25322","title":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.7.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2c3a01c-af77-4abc-b33c-b637d55e0be2?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"3.7.22","to_inclusive":true,"patched_in":"3.7.23"}],"published":"2026-01-29T00:00:00Z","updated":"2026-05-04T15:39:48Z"},{"id":"wordfence:a2c4b389-4a43-4b6d-ad19-1d6c201580cc","source":"wordfence","cve":"CVE-2025-53257","title":"Gmedia Photo Gallery <= 1.23.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2c4b389-4a43-4b6d-ad19-1d6c201580cc?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.23.0","to_inclusive":true,"patched_in":"1.24.0"}],"published":"2025-06-27T00:00:00Z","updated":"2025-10-02T22:28:39Z"},{"id":"wordfence:a2c5e232-3561-43a1-bdfa-4a68f20b5889","source":"wordfence","cve":"","title":"Frontend File Manager & Sharing \u2013 User Private Files <= 1.1.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2c5e232-3561-43a1-bdfa-4a68f20b5889?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2022-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2c6aa0f-874b-40fa-aa7a-4c15fa162f6a","source":"wordfence","cve":"CVE-2025-47534","title":"Wordpress Auto Spinner <= 3.25.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2c6aa0f-874b-40fa-aa7a-4c15fa162f6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-spinner","name":"Wordpress Auto Spinner","from":"*","from_inclusive":true,"to":"3.25.0","to_inclusive":true,"patched_in":"3.26.0"}],"published":"2025-05-16T00:00:00Z","updated":"2026-04-15T13:49:07Z"},{"id":"wordfence:a2c9b82a-b63c-4647-a561-d567b6e9ff0a","source":"wordfence","cve":"","title":"Discounts Manager for Products <= 3.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2c9b82a-b63c-4647-a561-d567b6e9ff0a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-discounts-plus","name":"Discounts & Promotions Automation","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"3.4.5"}],"published":"2021-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2cd027b-fbaa-41ce-8822-2fa16aa93eb5","source":"wordfence","cve":"CVE-2021-23227","title":"PHP Everywhere <= 2.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2cd027b-fbaa-41ce-8822-2fa16aa93eb5?source=api-prod","affected":[{"type":"plugin","slug":"php-everywhere","name":"PHP Everywhere","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-01-13T10:26:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2cdf6d8-8f7b-4ed1-b5c6-16bdd1211237","source":"wordfence","cve":"CVE-2025-30531","title":"WP Ride Booking <= 2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2cdf6d8-8f7b-4ed1-b5c6-16bdd1211237?source=api-prod","affected":[{"type":"plugin","slug":"wp-ride-booking","name":"WP Ride Booking \u2013 Best Taxi Booking Solution for WordPress","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:38:53Z"},{"id":"wordfence:a2ce2e2a-dde7-4b30-b5cf-6bb5063c982c","source":"wordfence","cve":"CVE-2026-39718","title":"Wallstreet <= 2.8.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ce2e2a-dde7-4b30-b5cf-6bb5063c982c?source=api-prod","affected":[{"type":"theme","slug":"wallstreet","name":"Wallstreet","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-02T19:16:00Z","updated":"2026-10-08T23:22:34Z"},{"id":"wordfence:a2d22c5d-5ef5-4920-a1b5-e8284394c7e8","source":"wordfence","cve":"CVE-2024-3729","title":"Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation","severity":"critical","cvss":9.8,"cwe":"CWE-636","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d22c5d-5ef5-4920-a1b5-e8284394c7e8?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.19.4","to_inclusive":true,"patched_in":"3.19.5"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-02T16:52:28Z"},{"id":"wordfence:a2d6e595-0682-4a41-a432-afbcb50144e8","source":"wordfence","cve":"CVE-2025-4607","title":"PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function","severity":"critical","cvss":9.8,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d6e595-0682-4a41-a432-afbcb50144e8?source=api-prod","affected":[{"type":"plugin","slug":"psw-login-and-registration","name":"PSW Front-end Login & Registration","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T18:09:43Z","updated":"2025-05-31T06:40:56Z"},{"id":"wordfence:a2d7165b-1290-4032-8fbc-75ec1ab34a08","source":"wordfence","cve":"CVE-2025-12676","title":"KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-259","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d7165b-1290-4032-8fbc-75ec1ab34a08?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T18:55:04Z","updated":"2025-11-05T07:28:17Z"},{"id":"wordfence:a2d87a05-81a7-40d9-a60f-94a4d88bf87a","source":"wordfence","cve":"CVE-2023-23645","title":"MainWP Code Snippets Extension <= 4.0.2 - Authenticated (Subscriber+) PHP Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d87a05-81a7-40d9-a60f-94a4d88bf87a?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-code-snippets-extension","name":"MainWP Code Snippets Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2d96212-f485-48c5-b8d5-d1d25eb65236","source":"wordfence","cve":"CVE-2026-32429","title":"Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d96212-f485-48c5-b8d5-d1d25eb65236?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:18:09Z"},{"id":"wordfence:a2d9a568-9a0a-48bb-97ae-6f6920c67eec","source":"wordfence","cve":"CVE-2024-52496","title":"Absolute Addons For Elementor <= 1.0.14 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2d9a568-9a0a-48bb-97ae-6f6920c67eec?source=api-prod","affected":[{"type":"plugin","slug":"absolute-addons","name":"Absolute Addons For Elementor","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:23:22Z"},{"id":"wordfence:a2dab9d3-a890-4c66-a825-e30329e37a60","source":"wordfence","cve":"CVE-2025-9205","title":"MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dab9d3-a890-4c66-a825-e30329e37a60?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-23T14:29:42Z","updated":"2026-07-24T02:32:01Z"},{"id":"wordfence:a2dc1a04-5503-412b-92e7-ed86910abd92","source":"wordfence","cve":"","title":"GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dc1a04-5503-412b-92e7-ed86910abd92?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.2","to_inclusive":true,"patched_in":"2.25.3"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2e05094-8344-4388-a703-518daf3d2948","source":"wordfence","cve":"CVE-2023-3204","title":"Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e05094-8344-4388-a703-518daf3d2948?source=api-prod","affected":[{"type":"theme","slug":"materialis","name":"Materialis","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.30"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T02:08:26Z"},{"id":"wordfence:a2e0c425-91d2-4adc-8a3b-71ad2be54f5a","source":"wordfence","cve":"CVE-2025-31016","title":"JetWooBuilder <= 2.1.18 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e0c425-91d2-4adc-8a3b-71ad2be54f5a?source=api-prod","affected":[{"type":"plugin","slug":"jet-woo-builder","name":"JetWooBuilder","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.1.18.1"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-10T12:44:37Z"},{"id":"wordfence:a2e1948a-9513-43e4-aadd-369a7f4dc137","source":"wordfence","cve":"","title":"Ultimate Member <= 2.0.32 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e1948a-9513-43e4-aadd-369a7f4dc137?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.32","to_inclusive":true,"patched_in":"2.0.33"}],"published":"2018-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2e2bd61-3187-4992-a3ae-1b5d88d1b90f","source":"wordfence","cve":"CVE-2026-13174","title":"Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e2bd61-3187-4992-a3ae-1b5d88d1b90f?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"4.1.21"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T19:49:29Z"},{"id":"wordfence:a2e2cde5-f5e0-420c-8c0e-27206884eff9","source":"wordfence","cve":"CVE-2025-15488","title":"Responsive Plus \u2013 Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e2cde5-f5e0-420c-8c0e-27206884eff9?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":false,"patched_in":"3.4.3"}],"published":"2026-03-30T00:00:00Z","updated":"2026-04-09T16:30:43Z"},{"id":"wordfence:a2e35679-278e-4e7d-b366-fe7d8cba7930","source":"wordfence","cve":"CVE-2015-9328","title":"Profile Builder \u2013 User Profile & User Registration Forms <= 2.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e35679-278e-4e7d-b366-fe7d8cba7930?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.2.5"}],"published":"2015-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2e493cf-d022-404d-a501-a6671e6116f4","source":"wordfence","cve":"CVE-2024-1501","title":"Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e493cf-d022-404d-a501-a6671e6116f4?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-database-reset","name":"Database Reset","from":"*","from_inclusive":true,"to":"3.22","to_inclusive":true,"patched_in":"3.23"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-21T03:36:00Z"},{"id":"wordfence:a2e70691-4de9-4b12-babf-bebe267a780b","source":"wordfence","cve":"CVE-2026-11592","title":"Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e70691-4de9-4b12-babf-bebe267a780b?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.27","to_inclusive":true,"patched_in":"5.9.28"}],"published":"2026-07-01T17:17:38Z","updated":"2026-10-28T00:41:35Z"},{"id":"wordfence:a2e7a86b-8c5d-46d1-a51e-1368c6a880fd","source":"wordfence","cve":"CVE-2026-59549","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e7a86b-8c5d-46d1-a51e-1368c6a880fd?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.10","to_inclusive":true,"patched_in":"4.7.11"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:22:38Z"},{"id":"wordfence:a2e802a6-d2f1-47cc-883a-89110e569168","source":"wordfence","cve":"CVE-2026-6692","title":"Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e802a6-d2f1-47cc-883a-89110e569168?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0.0","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-05-06T16:15:58Z","updated":"2026-05-07T04:27:34Z"},{"id":"wordfence:a2e847fd-0932-4d65-a201-b86e39a33588","source":"wordfence","cve":"CVE-2024-11225","title":"Premium Packages \u2013 Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e847fd-0932-4d65-a201-b86e39a33588?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.4"}],"published":"2024-11-21T17:16:14Z","updated":"2024-11-25T19:27:37Z"},{"id":"wordfence:a2e9fa74-5501-4429-a500-1d4199571a34","source":"wordfence","cve":"CVE-2026-109236","title":"Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter","severity":"medium","cvss":4.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e9fa74-5501-4429-a500-1d4199571a34?source=api-prod","affected":[{"type":"plugin","slug":"customer-email-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce \u2013 OTP Verification, Block Fake Signups","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-10-27T17:31:47Z","updated":"2026-10-28T05:33:31Z"},{"id":"wordfence:a2ed23e2-11cc-47b9-bdc7-376c91bc37e9","source":"wordfence","cve":"CVE-2025-62100","title":"ThemeRain Core <= 1.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ed23e2-11cc-47b9-bdc7-376c91bc37e9?source=api-prod","affected":[{"type":"plugin","slug":"themerain-core","name":"ThemeRain Core","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-24T00:00:00Z","updated":"2025-12-10T15:52:51Z"},{"id":"wordfence:a2ed28cd-44e6-416a-a252-8341104f5ef3","source":"wordfence","cve":"CVE-2020-24699","title":"Chamber Dashboard Business Directory < 3.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2ed28cd-44e6-416a-a252-8341104f5ef3?source=api-prod","affected":[{"type":"plugin","slug":"chamber-dashboard-business-directory","name":"Chamber Dashboard Business Directory","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":false,"patched_in":"3.3.1"}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2edfda3-7c60-424e-bcf7-384958a4eaa9","source":"wordfence","cve":"CVE-2025-53317","title":"WPShapere - WordPress admin theme <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2edfda3-7c60-424e-bcf7-384958a4eaa9?source=api-prod","affected":[{"type":"plugin","slug":"wpshapere-lite","name":"WPShapere Lite","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:32:25Z"},{"id":"wordfence:a2eed24e-2ec7-4b0c-8add-276d77064179","source":"wordfence","cve":"CVE-2026-115958","title":"Discussion Board \u2013 WordPress Forum Plugin <= 2.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2eed24e-2ec7-4b0c-8add-276d77064179?source=api-prod","affected":[{"type":"plugin","slug":"wp-discussion-board","name":"Discussion Board \u2013 WordPress Forum Plugin","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-10-26T09:53:00Z","updated":"2026-10-28T01:25:30Z"},{"id":"wordfence:a2eed959-398f-4812-90fb-aab424987c18","source":"wordfence","cve":"CVE-2026-81571","title":"Brave Popup Builder <= 0.8.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2eed959-398f-4812-90fb-aab424987c18?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.8.7","to_inclusive":true,"patched_in":"0.8.8"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T16:08:31Z"},{"id":"wordfence:a2f0e910-40e2-4ad0-a3de-fe8dd8a38652","source":"wordfence","cve":"CVE-2025-50036","title":"Mailing Group Listserv <= 3.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f0e910-40e2-4ad0-a3de-fe8dd8a38652?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailing-group","name":"Mailing Group Listserv","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:02:47Z"},{"id":"wordfence:a2f118fc-d99a-4713-865e-2da7a9e20db5","source":"wordfence","cve":"CVE-2025-10499","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f118fc-d99a-4713-865e-2da7a9e20db5?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2025-09-26T14:16:01Z","updated":"2025-09-27T02:25:13Z"},{"id":"wordfence:a2f31475-363e-4e94-ad9b-a428453fb1e8","source":"wordfence","cve":"CVE-2026-62011","title":"Bonbon <= 1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f31475-363e-4e94-ad9b-a428453fb1e8?source=api-prod","affected":[{"type":"theme","slug":"bonbon","name":"Bonbon","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:37:28Z"},{"id":"wordfence:a2f378dd-d8de-445e-9c54-d07627e9c0e9","source":"wordfence","cve":"CVE-2024-13120","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f378dd-d8de-445e-9c54-d07627e9c0e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.19","to_inclusive":true,"patched_in":"4.15.20"}],"published":"2025-01-23T00:00:00Z","updated":"2025-02-21T19:38:56Z"},{"id":"wordfence:a2f3fcd1-6dff-409b-b8c1-46c5485980ee","source":"wordfence","cve":"CVE-2023-23731","title":"WishSuite <= 1.3.3 - Cross-Site Request Forgery via plugin_activation()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f3fcd1-6dff-409b-b8c1-46c5485980ee?source=api-prod","affected":[{"type":"plugin","slug":"wishsuite","name":"WishSuite \u2013 Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2f508f1-45a0-4cb4-9d67-51edd3d74abe","source":"wordfence","cve":"CVE-2024-7485","title":"Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f508f1-45a0-4cb4-9d67-51edd3d74abe?source=api-prod","affected":[{"type":"plugin","slug":"traffic-manager","name":"Traffic Manager","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-08-03T00:00:00Z","updated":"2024-08-06T01:49:58Z"},{"id":"wordfence:a2f646fb-b089-492d-9d90-0f43b18e1a90","source":"wordfence","cve":"CVE-2022-1170","title":"Noo JobMonster < 4.5.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f646fb-b089-492d-9d90-0f43b18e1a90?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.5.2.9","to_inclusive":false,"patched_in":"4.5.2.9"}],"published":"2019-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2f7cce4-bb0e-4d71-bb70-75d9b298384e","source":"wordfence","cve":"CVE-2025-62103","title":"Media Library File Download <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f7cce4-bb0e-4d71-bb70-75d9b298384e?source=api-prod","affected":[{"type":"plugin","slug":"media-download","name":"Media Library File Download","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-10-27T00:00:00Z","updated":"2026-09-16T17:30:34Z"},{"id":"wordfence:a2f8b6b3-fb5a-4244-8b97-56375c2f2ff1","source":"wordfence","cve":"CVE-2024-54222","title":"Seraphinite Accelerator <= 2.22.15 (2.21.13 PRO) - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f8b6b3-fb5a-4244-8b97-56375c2f2ff1?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.22.15","to_inclusive":true,"patched_in":"2.22.16"},{"type":"plugin","slug":"seraphinite-accelerator-ext","name":"Seraphinite Accelerator (Full, premium)","from":"*","from_inclusive":true,"to":"2.21.13","to_inclusive":true,"patched_in":"2.22.16"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:26:52Z"},{"id":"wordfence:a2f8c71d-ad19-4265-8d33-3b0e7dbbf4c2","source":"wordfence","cve":"","title":"Monsters Editor for WP Super Edit <= 1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f8c71d-ad19-4265-8d33-3b0e7dbbf4c2?source=api-prod","affected":[{"type":"plugin","slug":"monsters-editor-10-for-wp-super-edit","name":"Monsters Editor for WP Super Edit","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2012-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a2f9d282-1bba-48d2-8f12-a5a4a58c77f6","source":"wordfence","cve":"CVE-2025-28963","title":"URL Shortener <= 3.0.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f9d282-1bba-48d2-8f12-a5a4a58c77f6?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:59:47Z"},{"id":"wordfence:a2f9da0c-aff8-4b48-901c-1199c95afdeb","source":"wordfence","cve":"CVE-2025-32550","title":"Click & Pledge Connect Plugin <= 2.24080000-WP6.6.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f9da0c-aff8-4b48-901c-1199c95afdeb?source=api-prod","affected":[{"type":"plugin","slug":"click-pledge-connect","name":"Click & Pledge CONNECT","from":"*","from_inclusive":true,"to":"2.24080000-WP6.6.1","to_inclusive":true,"patched_in":"2.24120000-WP6.7.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:58:05Z"},{"id":"wordfence:a2f9eed8-9656-48a2-9414-2cfdd3ebb059","source":"wordfence","cve":"CVE-2024-4234","title":"Filterable Portfolio <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f9eed8-9656-48a2-9414-2cfdd3ebb059?source=api-prod","affected":[{"type":"plugin","slug":"jungbillig-portfolio-gallery","name":"Filterable Portfolio","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:45:47Z"},{"id":"wordfence:a2f9fec5-d6d8-4317-bd40-810cd37a3158","source":"wordfence","cve":"CVE-2025-23835","title":"Legal + <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2f9fec5-d6d8-4317-bd40-810cd37a3158?source=api-prod","affected":[{"type":"plugin","slug":"legal-plus","name":"Legal +","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:55:37Z"},{"id":"wordfence:a2fc40ed-a6af-4069-be63-cb75e98cc98a","source":"wordfence","cve":"CVE-2025-13619","title":"Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=api-prod","affected":[{"type":"plugin","slug":"flex-store-user","name":"Flex Store Users","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T18:05:13Z","updated":"2025-12-20T06:22:02Z"},{"id":"wordfence:a2fe3ef1-2bd0-482a-b873-b373caaa75a4","source":"wordfence","cve":"CVE-2025-30976","title":"Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fe3ef1-2bd0-482a-b873-b373caaa75a4?source=api-prod","affected":[{"type":"plugin","slug":"nexa-blocks","name":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:06:05Z"},{"id":"wordfence:a2fe6b69-7a89-4cd4-8a8c-f7e1e587fbbe","source":"wordfence","cve":"CVE-2022-29415","title":"Ravpage <= 2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fe6b69-7a89-4cd4-8a8c-f7e1e587fbbe?source=api-prod","affected":[{"type":"plugin","slug":"ravpage","name":"ravpage","from":"*","from_inclusive":true,"to":"2.16","to_inclusive":true,"patched_in":"2.18"}],"published":"2022-04-28T11:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a301c969-3f62-4377-926a-d36e47e833f0","source":"wordfence","cve":"CVE-2025-47659","title":"WPBakery Visual Composer WHMCS Elements <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a301c969-3f62-4377-926a-d36e47e833f0?source=api-prod","affected":[{"type":"plugin","slug":"void-visual-whmcs-element","name":"Innovs WPBakery Visual Composer WHMCS Elements","from":"*","from_inclusive":true,"to":"1.0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:33:31Z"},{"id":"wordfence:a303c798-c206-426a-9a96-263c8c069bdb","source":"wordfence","cve":"CVE-2024-2086","title":"Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export","severity":"critical","cvss":10.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a303c798-c206-426a-9a96-263c8c069bdb?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T04:31:10Z"},{"id":"wordfence:a3084a40-2b0b-402a-abd8-86bff47c9a0c","source":"wordfence","cve":"CVE-2025-29009","title":"Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3084a40-2b0b-402a-abd8-86bff47c9a0c?source=api-prod","affected":[{"type":"plugin","slug":"medical-prescription-attachment-plugin-for-woocommerce","name":"Medical Prescription Attachment Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-08-11T17:58:15Z"},{"id":"wordfence:a30863c5-2e94-4952-b360-856394262023","source":"wordfence","cve":"","title":"Ultimate Product Catalog < 4.2.22 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a30863c5-2e94-4952-b360-856394262023?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.2.22","to_inclusive":false,"patched_in":"4.2.22"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a309d8d3-bc1c-4301-8da9-ce7df7c2f76f","source":"wordfence","cve":"","title":"Encrypted Blog <= 0.0.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a309d8d3-bc1c-4301-8da9-ce7df7c2f76f?source=api-prod","affected":[{"type":"plugin","slug":"encrypted-blog","name":"Encrypted Blog","from":"*","from_inclusive":true,"to":"0.0.6.2","to_inclusive":true,"patched_in":"0.0.6.6"}],"published":"2013-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a30b3774-df88-49a6-89ec-2e771abed11c","source":"wordfence","cve":"CVE-2024-35722","title":"Slider Responsive Slideshow \u2013 Image slider, Gallery slideshow <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a30b3774-df88-49a6-89ec-2e771abed11c?source=api-prod","affected":[{"type":"plugin","slug":"slider-responsive-slideshow","name":"Responsive Slideshow \u2013 Photo Carousel","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:13:38Z"},{"id":"wordfence:a30f141b-2fd0-448e-88b1-8a334efdfcc7","source":"wordfence","cve":"CVE-2026-25437","title":"GZSEO <= 2.0.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a30f141b-2fd0-448e-88b1-8a334efdfcc7?source=api-prod","affected":[{"type":"plugin","slug":"gzseo","name":"GZSEO","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-03-18T00:00:00Z","updated":"2026-09-30T14:23:38Z"},{"id":"wordfence:a313f4d0-fd9e-47f1-99eb-351a2aff9bea","source":"wordfence","cve":"CVE-2022-40632","title":"wpForo Forum <= 2.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a313f4d0-fd9e-47f1-99eb-351a2aff9bea?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3157123-2eea-4f8b-bfc1-07633ad84c2b","source":"wordfence","cve":"CVE-2026-28173","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3157123-2eea-4f8b-bfc1-07633ad84c2b?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.19","to_inclusive":true,"patched_in":"4.1.20"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:34:14Z"},{"id":"wordfence:a3160602-6522-478d-8a99-d097472d10ac","source":"wordfence","cve":"","title":"Sandbox <= 1.6.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3160602-6522-478d-8a99-d097472d10ac?source=api-prod","affected":[{"type":"theme","slug":"sandbox","name":"Sandbox","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2013-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3171015-227d-420a-ba3a-e6e2dc17ba8c","source":"wordfence","cve":"CVE-2023-52135","title":"WS Form LITE <= 1.9.170 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3171015-227d-420a-ba3a-e6e2dc17ba8c?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.9.171","to_inclusive":false,"patched_in":"1.9.171"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a317395b-32ab-4a00-9568-b87d7c4f69a6","source":"wordfence","cve":"CVE-2023-6620","title":"POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.6 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a317395b-32ab-4a00-9568-b87d7c4f69a6?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3178ed8-568c-4439-9e4b-975fc60e591b","source":"wordfence","cve":"CVE-2025-25171","title":"WP SmartPay <= 2.7.13 - Authenticated (Subscriber+) Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3178ed8-568c-4439-9e4b-975fc60e591b?source=api-prod","affected":[{"type":"plugin","slug":"smartpay","name":"WPSmartPay \u2013 Payment Forms, Invoices, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-06-24T00:00:00Z","updated":"2025-10-21T21:03:07Z"},{"id":"wordfence:a3187d3e-e1da-4af7-a1fa-9657389f9e22","source":"wordfence","cve":"CVE-2025-13728","title":"FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3187d3e-e1da-4af7-a1fa-9657389f9e22?source=api-prod","affected":[{"type":"plugin","slug":"fluent-security","name":"FluentAuth \u2013 Login Security, Two-Factor Authentication, Passkeys & Social Login","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-12-15T02:19:04Z","updated":"2025-12-15T14:25:12Z"},{"id":"wordfence:a319136f-fb89-485b-8b07-d8badb7b8cb4","source":"wordfence","cve":"CVE-2026-90972","title":"Fusion Lite <= 3.47.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a319136f-fb89-485b-8b07-d8badb7b8cb4?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"*","from_inclusive":true,"to":"3.47.0","to_inclusive":true,"patched_in":"3.48.0"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T00:01:21Z"},{"id":"wordfence:a31ab564-48b7-44f7-a1da-226222c3fd7b","source":"wordfence","cve":"","title":"Cookie Params <=  0.2 - Reflected Cross-Site Scripting and Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a31ab564-48b7-44f7-a1da-226222c3fd7b?source=api-prod","affected":[{"type":"plugin","slug":"cookie-params","name":"Cookie Params","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a31af69d-f783-4d43-a14c-e153be3ee57c","source":"wordfence","cve":"CVE-2025-60243","title":"Selling Commander for WooCommerce <= 1.2.46 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a31af69d-f783-4d43-a14c-e153be3ee57c?source=api-prod","affected":[{"type":"plugin","slug":"selling-commander-connector","name":"Selling Commander for WooCommerce \u2013 connector plugin","from":"*","from_inclusive":true,"to":"1.2.46","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-11-12T13:50:45Z"},{"id":"wordfence:a31cf5d0-1c37-46bf-bf0c-ca820a281bfc","source":"wordfence","cve":"CVE-2025-53330","title":"WP Rentals <= 3.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a31cf5d0-1c37-46bf-bf0c-ca820a281bfc?source=api-prod","affected":[{"type":"theme","slug":"wprentals","name":"WP Rentals - Booking Accommodation WordPress Theme","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2025-08-14T00:00:00Z","updated":"2026-02-26T15:15:57Z"},{"id":"wordfence:a321b112-ce37-4a0e-800f-f3feef6ac799","source":"wordfence","cve":"CVE-2021-4450","title":"Post Grid <= 2.1.12 - Contributor+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a321b112-ce37-4a0e-800f-f3feef6ac799?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":false,"patched_in":"2.1.13"}],"published":"2021-12-15T00:00:00Z","updated":"2024-10-16T06:43:37Z"},{"id":"wordfence:a3232aaa-189d-42cd-8eec-c167c6aa65f4","source":"wordfence","cve":"CVE-2024-32430","title":"ActiveCampaign <= 8.1.14 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3232aaa-189d-42cd-8eec-c167c6aa65f4?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-subscription-forms","name":"ActiveCampaign \u2013 The autonomous marketing platform","from":"*","from_inclusive":true,"to":"8.1.14","to_inclusive":true,"patched_in":"8.1.15"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T15:00:31Z"},{"id":"wordfence:a3233f6f-7488-43ed-a626-b2150c5516fc","source":"wordfence","cve":"CVE-2024-32569","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3233f6f-7488-43ed-a626-b2150c5516fc?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T11:46:42Z"},{"id":"wordfence:a323ccb8-c461-4203-a590-3785594b90f5","source":"wordfence","cve":"CVE-2025-24001","title":"PPO Call To Actions <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a323ccb8-c461-4203-a590-3785594b90f5?source=api-prod","affected":[{"type":"plugin","slug":"ppo-call-to-actions","name":"PPO Call To Actions","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-28T16:07:52Z"},{"id":"wordfence:a3271d69-fa4a-42db-8bea-dd54d5a9bc6b","source":"wordfence","cve":"CVE-2025-24643","title":"One to one user Chat by WPGuppy <= 1.1.0 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3271d69-fa4a-42db-8bea-dd54d5a9bc6b?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-24T15:51:28Z"},{"id":"wordfence:a32842ff-8d5c-4467-acd2-7beeb933fb0d","source":"wordfence","cve":"CVE-2025-53243","title":"Employee Directory \u2013 Staff Listing &amp; Team Directory Plugin for WordPress <= 4.5.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32842ff-8d5c-4467-acd2-7beeb933fb0d?source=api-prod","affected":[{"type":"plugin","slug":"employee-directory","name":"Employee Directory \u2013 Staff & Team Directory","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-08-25T00:00:00Z","updated":"2026-08-14T15:14:54Z"},{"id":"wordfence:a328643a-ab12-427e-9bcd-2d40738afb61","source":"wordfence","cve":"CVE-2023-50847","title":"Welcart e-Commerce <= 2.9.3 - Authenticated(Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a328643a-ab12-427e-9bcd-2d40738afb61?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":false,"patched_in":"2.9.4"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3294f40-799a-45b1-8a74-cb5182ba7375","source":"wordfence","cve":"CVE-2026-94245","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3294f40-799a-45b1-8a74-cb5182ba7375?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:32:28Z"},{"id":"wordfence:a329cf0a-8800-470a-9657-452f26112956","source":"wordfence","cve":"CVE-2024-9896","title":"BBP Core \u2013 Expand bbPress powered forums with useful features <= 1.2.5 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a329cf0a-8800-470a-9657-452f26112956?source=api-prod","affected":[{"type":"plugin","slug":"bbp-core","name":"Forumax \u2013 AI Powered Advanced Community Forum Plugin","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-11-01T19:19:24Z","updated":"2024-11-02T07:34:03Z"},{"id":"wordfence:a32a6ea3-4473-4075-b660-9bba083ae0bf","source":"wordfence","cve":"CVE-2026-8502","title":"LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32a6ea3-4473-4075-b660-9bba083ae0bf?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-06-05T14:23:22Z","updated":"2026-06-06T02:28:36Z"},{"id":"wordfence:a32c6c0c-4a4a-44c7-9724-153467699b3a","source":"wordfence","cve":"CVE-2010-3977","title":"CformsII <=11.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32c6c0c-4a4a-44c7-9724-153467699b3a?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"11.5","to_inclusive":true,"patched_in":"11.6.1"}],"published":"2010-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a32dcf96-ec75-46b1-8f1d-608411ad5147","source":"wordfence","cve":"CVE-2025-5570","title":"AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32dcf96-ec75-46b1-8f1d-608411ad5147?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2025-07-07T12:13:01Z","updated":"2025-07-08T01:43:47Z"},{"id":"wordfence:a32f4dda-f22e-488e-b57a-efc8de8da036","source":"wordfence","cve":"CVE-2026-65554","title":"AnsPress \u2013 Question and answer  4.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32f4dda-f22e-488e-b57a-efc8de8da036?source=api-prod","affected":[{"type":"plugin","slug":"anspress-question-answer","name":"AnsPress \u2013 Question and answer","from":"4.4.4","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:27:40Z"},{"id":"wordfence:a32f50f7-d271-45f6-9a73-838a8dcb901f","source":"wordfence","cve":"CVE-2023-46146","title":"Themify Ultra <= 7.3.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a32f50f7-d271-45f6-9a73-838a8dcb901f?source=api-prod","affected":[{"type":"theme","slug":"themify-ultra","name":"Themify Ultra","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-04-22T14:16:24Z"},{"id":"wordfence:a3302110-60ae-4ad1-8a8c-3511027da3a8","source":"wordfence","cve":"CVE-2016-10985","title":"Echo Sign < 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3302110-60ae-4ad1-8a8c-3511027da3a8?source=api-prod","affected":[{"type":"plugin","slug":"echosign","name":"Echo Sign","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a330336e-82ad-41f4-b1b1-d93d9905aabd","source":"wordfence","cve":"CVE-2026-6286","title":"Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a330336e-82ad-41f4-b1b1-d93d9905aabd?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T06:39:50Z"},{"id":"wordfence:a330f907-37d5-484c-94c5-b8d191796cd5","source":"wordfence","cve":"CVE-2015-1000001","title":"Fast Image Adder < 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a330f907-37d5-484c-94c5-b8d191796cd5?source=api-prod","affected":[{"type":"plugin","slug":"fast-image-adder","name":"Fast Image Adder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2017-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3311097-d477-441e-9bf3-3f991a9b6af9","source":"wordfence","cve":"CVE-2024-5325","title":"Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3311097-d477-441e-9bf3-3f991a9b6af9?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-12T12:47:02Z"},{"id":"wordfence:a3313795-fe3b-4947-aa06-606934d435c3","source":"wordfence","cve":"CVE-2026-77753","title":"Temporary Login Without Password < 1.9.9 - Authenticated (Custom Role+) Persistent Access After Login Revocation","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3313795-fe3b-4947-aa06-606934d435c3?source=api-prod","affected":[{"type":"plugin","slug":"temporary-login-without-password","name":"Temporary Login Without Password","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":false,"patched_in":"1.9.9"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:10:13Z"},{"id":"wordfence:a331c3c7-3d78-4973-919c-066ad1658a29","source":"wordfence","cve":"CVE-2025-30845","title":"The Pack Elementor addons <= 2.1.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a331c3c7-3d78-4973-919c-066ad1658a29?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:48:09Z"},{"id":"wordfence:a3335613-1206-4555-8e48-748a336548d4","source":"wordfence","cve":"","title":"Animate It! < 2.4.0 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3335613-1206-4555-8e48-748a336548d4?source=api-prod","affected":[{"type":"plugin","slug":"animate-it","name":"Animate It!","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a333d5b4-cedf-40ac-8da9-f4965d2a397a","source":"wordfence","cve":"CVE-2023-0439","title":"NEX-Forms - Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a333d5b4-cedf-40ac-8da9-f4965d2a397a?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a335c917-3fff-4079-bb38-64cd665c5c38","source":"wordfence","cve":"CVE-2026-9236","title":"CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a335c917-3fff-4079-bb38-64cd665c5c38?source=api-prod","affected":[{"type":"plugin","slug":"cm-ad-changer","name":"CM Ad Changer \u2013 A simple tool to control and optimize your site\u2019s banners","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-05-26T16:01:12Z","updated":"2026-05-27T04:29:03Z"},{"id":"wordfence:a3374f89-ae63-45bb-b6a6-9689e2513e69","source":"wordfence","cve":"CVE-2024-10688","title":"Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3374f89-ae63-45bb-b6a6-9689e2513e69?source=api-prod","affected":[{"type":"plugin","slug":"attesa-extra","name":"Attesa Extra","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T06:41:30Z"},{"id":"wordfence:a33a7ba5-c6f8-4cf4-8011-8312e9c5da8f","source":"wordfence","cve":"CVE-2025-3468","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33a7ba5-c6f8-4cf4-8011-8312e9c5da8f?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.9.1","to_inclusive":true,"patched_in":"8.9.2"}],"published":"2025-05-07T21:30:27Z","updated":"2025-05-08T11:13:45Z"},{"id":"wordfence:a33a846c-6489-4337-b59e-b969ff03dbcd","source":"wordfence","cve":"CVE-2026-40770","title":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce <= 7.5.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33a846c-6489-4337-b59e-b969ff03dbcd?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"7.5.3","to_inclusive":true,"patched_in":"7.6.0"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:42:33Z"},{"id":"wordfence:a33af8c8-09a7-4f2d-9af3-c0c49a53a0e9","source":"wordfence","cve":"CVE-2026-39613","title":"Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33af8c8-09a7-4f2d-9af3-c0c49a53a0e9?source=api-prod","affected":[{"type":"theme","slug":"kute-boutique","name":"Boutique - Kute Fashion WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T00:00:00Z","updated":"2026-04-15T21:18:06Z"},{"id":"wordfence:a33c0e7e-42d3-442e-886e-e0a71cdbf628","source":"wordfence","cve":"CVE-2024-54224","title":"ElementsReady Addons for Elementor <= 6.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33c0e7e-42d3-442e-886e-e0a71cdbf628?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.4.7","to_inclusive":true,"patched_in":"6.4.8"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:45:03Z"},{"id":"wordfence:a33c4524-6584-43a1-a523-6ea26eadda3d","source":"wordfence","cve":"CVE-2024-38687","title":"Sky Addons for Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33c4524-6584-43a1-a523-6ea26eadda3d?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-01T16:45:23Z"},{"id":"wordfence:a33c5bf1-386f-42ba-88aa-e9206d943ea8","source":"wordfence","cve":"CVE-2024-54237","title":"Ni CRM Lead <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33c5bf1-386f-42ba-88aa-e9206d943ea8?source=api-prod","affected":[{"type":"plugin","slug":"ni-crm-lead","name":"Ni CRM Lead","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-05T00:00:00Z","updated":"2025-01-17T13:28:26Z"},{"id":"wordfence:a33c8a80-e11e-403d-9eb0-e1c5b59204b0","source":"wordfence","cve":"CVE-2023-36513","title":"AutomateWoo <= 5.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33c8a80-e11e-403d-9eb0-e1c5b59204b0?source=api-prod","affected":[{"type":"plugin","slug":"automatewoo","name":"AutomateWoo","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.7.6"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a33cc275-aa0d-4b8b-863a-6a32fac37512","source":"wordfence","cve":"CVE-2023-36501","title":"teachPress <= 9.0.2 - Reflected Cross-Site Scripting via meta_field_id  and cite_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33cc275-aa0d-4b8b-863a-6a32fac37512?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.3","to_inclusive":false,"patched_in":"9.0.3"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a33de35f-1c9d-4fc9-9be8-0a1c7d9352ec","source":"wordfence","cve":"CVE-2024-0631","title":"Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_response","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a33de35f-1c9d-4fc9-9be8-0a1c7d9352ec?source=api-prod","affected":[{"type":"plugin","slug":"duitku-social-payment-gateway","name":"Duitku Payment Gateway","from":"*","from_inclusive":true,"to":"2.11.6","to_inclusive":true,"patched_in":"2.11.7"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:37:00Z"},{"id":"wordfence:a341a264-0b1a-47a2-8c7e-9a6e10c5ad0a","source":"wordfence","cve":"CVE-2022-4114","title":"Superio - Job Board <= 1.2.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a341a264-0b1a-47a2-8c7e-9a6e10c5ad0a?source=api-prod","affected":[{"type":"theme","slug":"superio","name":"Superio - Job Board","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.2.33"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a341bcc4-fe5b-452d-aa93-4e3dd8d42403","source":"wordfence","cve":"CVE-2007-3239","title":"AndyBlue Theme < 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a341bcc4-fe5b-452d-aa93-4e3dd8d42403?source=api-prod","affected":[{"type":"theme","slug":"andyblue","name":"andyblue","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2007-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3425d78-1e24-4224-bfdc-a3e11735384f","source":"wordfence","cve":"CVE-2025-8669","title":"Customify <= 0.4.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3425d78-1e24-4224-bfdc-a3e11735384f?source=api-prod","affected":[{"type":"theme","slug":"customify","name":"Customify","from":"*","from_inclusive":true,"to":"0.4.11","to_inclusive":true,"patched_in":"0.4.12"}],"published":"2025-10-02T00:00:00Z","updated":"2025-10-31T14:28:38Z"},{"id":"wordfence:a3442c4b-d6af-4dd4-a7a3-4bc4ceb2812a","source":"wordfence","cve":"CVE-2026-118201","title":"Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3442c4b-d6af-4dd4-a7a3-4bc4ceb2812a?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-security","name":"Limit Login Attempts Security","from":"3.0.0","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:46:29Z"},{"id":"wordfence:a3473b5e-2f50-4845-9cfa-d19129f2a430","source":"wordfence","cve":"CVE-2023-46080","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3473b5e-2f50-4845-9cfa-d19129f2a430?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3494e39-b4dc-46c1-9e8f-2c04fa3df940","source":"wordfence","cve":"CVE-2023-0153","title":"Vimeo Video Autoplay Automute <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3494e39-b4dc-46c1-9e8f-2c04fa3df940?source=api-prod","affected":[{"type":"plugin","slug":"vimeo-video-autoplay-automute","name":"Vimeo Video Autoplay Automute","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a349b220-5b42-4b98-869f-ce8399fe7ec9","source":"wordfence","cve":"CVE-2025-8491","title":"Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a349b220-5b42-4b98-869f-ce8399fe7ec9?source=api-prod","affected":[{"type":"plugin","slug":"easy-pdf-restaurant-menu-upload","name":"Easy restaurant menu manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-08-12T15:10:56Z","updated":"2025-08-13T03:42:04Z"},{"id":"wordfence:a34ba31b-3106-4d46-955a-83f005f7226f","source":"wordfence","cve":"CVE-2026-28010","title":"Scientia <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a34ba31b-3106-4d46-955a-83f005f7226f?source=api-prod","affected":[{"type":"theme","slug":"scientia","name":"Scientia | Public Library & Book Store Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:53:32Z"},{"id":"wordfence:a351c250-f9c8-408d-8013-58996d7cbddf","source":"wordfence","cve":"CVE-2026-28063","title":"Asia Garden <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a351c250-f9c8-408d-8013-58996d7cbddf?source=api-prod","affected":[{"type":"theme","slug":"asia-garden","name":"asia-garden","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T14:29:01Z"},{"id":"wordfence:a353133d-0b36-40cc-a4f8-d5083e6e67df","source":"wordfence","cve":"CVE-2022-2180","title":"GREYD.SUITE <= 1.2.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a353133d-0b36-40cc-a4f8-d5083e6e67df?source=api-prod","affected":[{"type":"plugin","slug":"greyd_suite","name":"GREYD.SUITE","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3536958-5e11-4dc5-98bc-01fd09ef3090","source":"wordfence","cve":"CVE-2026-16608","title":"Download Monitor <= 5.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3536958-5e11-4dc5-98bc-01fd09ef3090?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:46:46Z"},{"id":"wordfence:a35419ff-a342-4480-9288-e98dee5afabc","source":"wordfence","cve":"CVE-2026-104995","title":"BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35419ff-a342-4480-9288-e98dee5afabc?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-search","name":"BP Profile Search","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":true,"patched_in":"6.0"}],"published":"2026-10-13T12:24:52Z","updated":"2026-10-14T01:27:17Z"},{"id":"wordfence:a35499cd-9849-4b1f-816b-3e71a7b1bbeb","source":"wordfence","cve":"CVE-2024-13224","title":"SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35499cd-9849-4b1f-816b-3e71a7b1bbeb?source=api-prod","affected":[{"type":"plugin","slug":"slidedeck-lite-for-wordpress","name":"SlideDeck 1 Lite Content Slider","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:56:17Z"},{"id":"wordfence:a35a66c6-2a86-4f6e-b28e-d79e13489a49","source":"wordfence","cve":"CVE-2025-0748","title":"Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T01:44:54Z"},{"id":"wordfence:a35aa722-041f-4126-b742-bcf5219424ed","source":"wordfence","cve":"CVE-2025-8559","title":"All in One Music Player <= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35aa722-041f-4126-b742-bcf5219424ed?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-music-player","name":"All in One Music Player","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:29:49Z","updated":"2025-09-30T03:35:29Z"},{"id":"wordfence:a35b5dbd-6d29-404f-9363-a5787d35169c","source":"wordfence","cve":"CVE-2025-23908","title":"Pastebin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35b5dbd-6d29-404f-9363-a5787d35169c?source=api-prod","affected":[{"type":"plugin","slug":"pastebin-embed","name":"Pastebin","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:07:56Z"},{"id":"wordfence:a35fb3c5-7a22-4954-9b4c-eea94fc0fcd4","source":"wordfence","cve":"CVE-2025-23504","title":"Felan Framework <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a35fb3c5-7a22-4954-9b4c-eea94fc0fcd4?source=api-prod","affected":[{"type":"plugin","slug":"felan-framework","name":"Felan Framework","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-05-04T14:34:49Z"},{"id":"wordfence:a360fede-338c-470f-8130-d5984c7b598b","source":"wordfence","cve":"CVE-2026-94678","title":"Go Live Update Urls <= 7.0.8 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a360fede-338c-470f-8130-d5984c7b598b?source=api-prod","affected":[{"type":"plugin","slug":"go-live-update-urls","name":"Go Live Update Urls","from":"*","from_inclusive":true,"to":"7.0.8","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:41:32Z"},{"id":"wordfence:a362e60d-e4ab-4f19-9e18-5473d8e13d80","source":"wordfence","cve":"CVE-2024-29911","title":"Master Addons for Elementor <= 2.0.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a362e60d-e4ab-4f19-9e18-5473d8e13d80?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.4.1","to_inclusive":true,"patched_in":"2.0.5.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:10:02Z"},{"id":"wordfence:a3647a25-999f-44c0-9eeb-54f143e77b0c","source":"wordfence","cve":"CVE-2025-28939","title":"WP Google Calendar Manager <= 2.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3647a25-999f-44c0-9eeb-54f143e77b0c?source=api-prod","affected":[{"type":"plugin","slug":"wp-gcalendar","name":"WP Google Calendar Manager \u2013 Google Calendar Plugin","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T17:48:11Z"},{"id":"wordfence:a3659c4d-3a19-4f74-9f6d-26d7b24ebe56","source":"wordfence","cve":"CVE-2025-5568","title":"WpEvently <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3659c4d-3a19-4f74-9f6d-26d7b24ebe56?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2025-06-06T21:50:06Z","updated":"2025-06-07T11:17:53Z"},{"id":"wordfence:a369dff6-feca-47cf-8511-dc75c4ffdd29","source":"wordfence","cve":"CVE-2026-89406","title":"Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a369dff6-feca-47cf-8511-dc75c4ffdd29?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2026-09-24T18:51:29Z","updated":"2026-09-25T07:40:29Z"},{"id":"wordfence:a36c9a7e-830d-4a92-a330-29279387b3be","source":"wordfence","cve":"CVE-2026-3599","title":"Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36c9a7e-830d-4a92-a330-29279387b3be?source=api-prod","affected":[{"type":"plugin","slug":"riaxe-product-customizer","name":"Riaxe Product Customizer","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T16:45:40Z","updated":"2026-04-16T05:29:54Z"},{"id":"wordfence:a36d1bb1-9446-4042-a1ec-08a3ffdcb744","source":"wordfence","cve":"CVE-2023-0403","title":"Social Warfare <= 4.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36d1bb1-9446-4042-a1ec-08a3ffdcb744?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a36dedad-da5e-440e-b626-95df0d154870","source":"wordfence","cve":"CVE-2024-12767","title":"BuddyBoss Platform < 2.7.60 - Insecure Direct Object Reference to Private Post Comment Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36dedad-da5e-440e-b626-95df0d154870?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.7.60","to_inclusive":false,"patched_in":"2.7.60"}],"published":"2025-01-14T00:00:00Z","updated":"2025-05-29T18:01:30Z"},{"id":"wordfence:a36e599a-c8fb-42e2-acc0-d76a77dce336","source":"wordfence","cve":"CVE-2025-49450","title":"SEPA Girocode <= 0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36e599a-c8fb-42e2-acc0-d76a77dce336?source=api-prod","affected":[{"type":"plugin","slug":"sepa-girocode","name":"SEPA Girocode","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:16:45Z"},{"id":"wordfence:a36e7b70-dd2e-4846-bad2-aa225cb60a8e","source":"wordfence","cve":"CVE-2025-23648","title":"AdsMiddle <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36e7b70-dd2e-4846-bad2-aa225cb60a8e?source=api-prod","affected":[{"type":"plugin","slug":"adsmiddle","name":"AdsMiddle","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:07:13Z"},{"id":"wordfence:a36eb269-c917-4763-86cf-6d533dd906ad","source":"wordfence","cve":"CVE-2026-52694","title":"Digital Signature Add-on for WooCommerce <= 2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36eb269-c917-4763-86cf-6d533dd906ad?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-digital-signature","name":"Digital Signature Add-on for WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-18T13:23:11Z"},{"id":"wordfence:a36f813c-97c5-466d-92e0-7341c12b5a46","source":"wordfence","cve":"CVE-2026-102905","title":"Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a36f813c-97c5-466d-92e0-7341c12b5a46?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.19","to_inclusive":true,"patched_in":"2.8.20"}],"published":"2026-10-30T16:13:18Z","updated":"2026-10-30T17:15:29Z"},{"id":"wordfence:a37478a1-3e3e-4be0-aa96-ddafac0ff6c1","source":"wordfence","cve":"","title":"DejaVu <= 2.4 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a37478a1-3e3e-4be0-aa96-ddafac0ff6c1?source=api-prod","affected":[{"type":"theme","slug":"dejavu","name":"DejaVu","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a375da2f-f074-4b03-af5b-2a4c2853cc58","source":"wordfence","cve":"CVE-2025-1621","title":"GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a375da2f-f074-4b03-af5b-2a4c2853cc58?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.6","to_inclusive":true,"patched_in":"4.15.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-12T15:43:27Z"},{"id":"wordfence:a376cafb-656c-4fe1-b5c1-c7e38dc5040e","source":"wordfence","cve":"CVE-2025-12814","title":"SiteSEO \u2013 SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a376cafb-656c-4fe1-b5c1-c7e38dc5040e?source=api-prod","affected":[{"type":"plugin","slug":"siteseo","name":"SiteSEO \u2013 SEO Simplified","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-11-18T17:31:00Z","updated":"2025-11-19T05:45:16Z"},{"id":"wordfence:a3779501-4ac7-4b76-8b2b-9852c6467f16","source":"wordfence","cve":"CVE-2017-6816","title":"WordPress Core < 4.7.3 - Arbitrary File Deletion","severity":"medium","cvss":4.9,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3779501-4ac7-4b76-8b2b-9852c6467f16?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.18","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.16","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.12","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"3.7.19"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"3.7.19"}],"published":"2017-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3798336-e63b-4ede-9e4d-09a28249ea46","source":"wordfence","cve":"CVE-2026-9644","title":"LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3798336-e63b-4ede-9e4d-09a28249ea46?source=api-prod","affected":[{"type":"plugin","slug":"new-dev-livesmart-video-chat","name":"LiveSmart Video Chat Live Video Chat","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-05-27T17:15:20Z","updated":"2026-05-28T05:30:40Z"},{"id":"wordfence:a37e2106-1590-4a40-ae68-172d3817b063","source":"wordfence","cve":"CVE-2026-32530","title":"Creator LMS \u2013 Online Courses and eLearning Plugin <= 1.1.18 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a37e2106-1590-4a40-ae68-172d3817b063?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:34:03Z"},{"id":"wordfence:a37f049d-e704-4139-b311-51acbd373df7","source":"wordfence","cve":"CVE-2025-53469","title":"BMI Adult & Kid Calculator <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a37f049d-e704-4139-b311-51acbd373df7?source=api-prod","affected":[{"type":"plugin","slug":"bmi-adultkid-calculator","name":"BMI Adult & Kid Calculator","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-28T21:08:56Z"},{"id":"wordfence:a38004fe-828f-40bb-9ae7-583642e41dfd","source":"wordfence","cve":"CVE-2024-34428","title":"AWSOM News Announcement <= 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38004fe-828f-40bb-9ae7-583642e41dfd?source=api-prod","affected":[{"type":"plugin","slug":"awsom-news-announcement","name":"AWSOM News Announcement","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:27:25Z"},{"id":"wordfence:a3808160-7291-4833-ade6-c60b7feef81a","source":"wordfence","cve":"CVE-2025-68886","title":"Cookiteer <= 1.4.8 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3808160-7291-4833-ade6-c60b7feef81a?source=api-prod","affected":[{"type":"theme","slug":"cookiteer","name":"Cookiteer","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:10:32Z"},{"id":"wordfence:a382aaa3-2acb-4ede-8f6d-438fd96a97e5","source":"wordfence","cve":"CVE-2026-108491","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a382aaa3-2acb-4ede-8f6d-438fd96a97e5?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-10-13T10:57:04Z","updated":"2026-10-23T18:24:37Z"},{"id":"wordfence:a38386f1-5d5c-4ab4-b3b7-60bceb04730d","source":"wordfence","cve":"CVE-2026-1631","title":"Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38386f1-5d5c-4ab4-b3b7-60bceb04730d?source=api-prod","affected":[{"type":"plugin","slug":"feeds-for-youtube","name":"Feeds for YouTube (YouTube video, channel, and gallery plugin)","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:35:27Z"},{"id":"wordfence:a3839c47-5fd0-48e7-9637-d40bd237e122","source":"wordfence","cve":"CVE-2023-25485","title":"JSON Content Importer <= 1.3.15 - Authenticated (Admin+) Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3839c47-5fd0-48e7-9637-d40bd237e122?source=api-prod","affected":[{"type":"plugin","slug":"json-content-importer","name":"Get Use APIs \u2013 JSON Content Importer","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3845b4f-47c2-4b0b-af14-2d63bd74459c","source":"wordfence","cve":"CVE-2025-26982","title":"DSGVO Youtube <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3845b4f-47c2-4b0b-af14-2d63bd74459c?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-youtube","name":"DSGVO Youtube","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T14:24:58Z"},{"id":"wordfence:a385415d-ec00-4cac-962c-8462c8bb13f1","source":"wordfence","cve":"CVE-2025-25132","title":"Visitor Details <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a385415d-ec00-4cac-962c-8462c8bb13f1?source=api-prod","affected":[{"type":"plugin","slug":"visitors-details","name":"Visitor Details","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:41:38Z"},{"id":"wordfence:a385d286-c15c-4e95-b360-fec1ec455b47","source":"wordfence","cve":"CVE-2013-3526","title":"Traffic Analyzer < 3.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a385d286-c15c-4e95-b360-fec1ec455b47?source=api-prod","affected":[{"type":"plugin","slug":"trafficanalyzer","name":"Traffic Analyzer","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2013-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a388b406-1640-443d-9656-6a87588ce201","source":"wordfence","cve":"CVE-2024-22141","title":"Profile Builder Pro <= 3.10.0 - Authenticated (Subscriber+) Time-Based One-Time Password Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a388b406-1640-443d-9656-6a87588ce201?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3895b45-b103-4ba0-905c-611f5d1ba9a6","source":"wordfence","cve":"CVE-2025-30556","title":"Fix Rss Feeds <= 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3895b45-b103-4ba0-905c-611f5d1ba9a6?source=api-prod","affected":[{"type":"plugin","slug":"fix-rss-feed","name":"Fix Rss Feeds","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:58:49Z"},{"id":"wordfence:a38a58de-5f7d-4033-9a65-41b590b7d510","source":"wordfence","cve":"CVE-2024-8350","title":"Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38a58de-5f7d-4033-9a65-41b590b7d510?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-groups","name":"Uncanny Groups for LearnDash","from":"*","from_inclusive":true,"to":"6.1.0.1","to_inclusive":true,"patched_in":"6.1.1"}],"published":"2024-09-24T14:24:19Z","updated":"2024-09-25T02:32:27Z"},{"id":"wordfence:a38c13a9-346d-4e03-9e11-d2eb294ec959","source":"wordfence","cve":"CVE-2026-93509","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation","severity":"medium","cvss":6.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38c13a9-346d-4e03-9e11-d2eb294ec959?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T16:05:59Z"},{"id":"wordfence:a38e649d-00ad-4198-a96a-e280bc810cff","source":"wordfence","cve":"CVE-2024-31303","title":"Sign-up Sheets <= 2.2.11.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38e649d-00ad-4198-a96a-e280bc810cff?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.2.11.1","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:56:42Z"},{"id":"wordfence:a38ebdeb-6ab8-4f1d-9c13-39211a9e97b6","source":"wordfence","cve":"CVE-2026-9187","title":"Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a38ebdeb-6ab8-4f1d-9c13-39211a9e97b6?source=api-prod","affected":[{"type":"plugin","slug":"abandoned-contact-form-7","name":"Abandoned Contact Form 7","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T16:26:44Z","updated":"2026-06-16T04:30:21Z"},{"id":"wordfence:a3902a32-2bb9-44bb-9dbd-3887f0b5be81","source":"wordfence","cve":"CVE-2026-49769","title":"wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3902a32-2bb9-44bb-9dbd-3887f0b5be81?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:44:44Z"},{"id":"wordfence:a3936c4b-2326-41dc-b7d6-a8cf43752ddb","source":"wordfence","cve":"CVE-2023-35096","title":"myCred <= 2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3936c4b-2326-41dc-b7d6-a8cf43752ddb?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2023-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a394019f-ff2d-4058-8001-b6d25228e1f9","source":"wordfence","cve":"CVE-2022-4997","title":"JetFormBuilder Stripe Gateway <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a394019f-ff2d-4058-8001-b6d25228e1f9?source=api-prod","affected":[{"type":"plugin","slug":"jet-form-builder-stripe-gateway","name":"JetFormBuilder Stripe Gateway","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T13:42:49Z"},{"id":"wordfence:a39679a6-21f1-41e2-aaf8-23f03b79ef33","source":"wordfence","cve":"CVE-2024-34826","title":"Design for Contact Form 7 Style WordPress Plugin \u2013 CF7 WOW Styler <= 1.6.4 - Missing Authorization via Several AJAX Action","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a39679a6-21f1-41e2-aaf8-23f03b79ef33?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T19:41:49Z"},{"id":"wordfence:a3977d10-239d-4b83-ab0c-ad165485498d","source":"wordfence","cve":"CVE-2026-6810","title":"Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3977d10-239d-4b83-ab0c-ad165485498d?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":"1.2.64"}],"published":"2026-04-23T16:30:20Z","updated":"2026-04-24T05:29:41Z"},{"id":"wordfence:a397a7f0-2f6a-48aa-9646-ae2abd410c48","source":"wordfence","cve":"CVE-2024-54354","title":"Termin-Kalender <= 0.99.47 - Missing Authorization to Authenticated (Subscriber+)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a397a7f0-2f6a-48aa-9646-ae2abd410c48?source=api-prod","affected":[{"type":"plugin","slug":"termin-kalender","name":"Termin-Kalender","from":"*","from_inclusive":true,"to":"0.99.47","to_inclusive":true,"patched_in":"1.00.04"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:06:50Z"},{"id":"wordfence:a39ca182-981b-4636-acd5-4c8a269858dd","source":"wordfence","cve":"","title":"WOLF <= 1.0.6 - Cross-Site Request Forgery via wpbe_update_page_field","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a39ca182-981b-4636-acd5-4c8a269858dd?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a39dccb6-b635-44af-b0e0-c3010b719773","source":"wordfence","cve":"CVE-2026-6403","title":"Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a39dccb6-b635-44af-b0e0-c3010b719773?source=api-prod","affected":[{"type":"plugin","slug":"quick-playground","name":"Quick Playground","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-05-14T19:01:30Z","updated":"2026-05-15T07:46:38Z"},{"id":"wordfence:a39e9b54-6beb-4dbd-a4cf-ba05e73a58a0","source":"wordfence","cve":"CVE-2022-2375","title":"WP Sticky Button <= 1.4 - Missing Authorization to Arbitrary Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a39e9b54-6beb-4dbd-a4cf-ba05e73a58a0?source=api-prod","affected":[{"type":"plugin","slug":"wa-sticky-button","name":"WP Sticky Button \u2013 Click to Chat","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3a37e6a-659b-4a40-9051-9e8b3ca1ad42","source":"wordfence","cve":"CVE-2014-9179","title":"SupportEzzy Ticket System Plugin <= 1.2.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a37e6a-659b-4a40-9051-9e8b3ca1ad42?source=api-prod","affected":[{"type":"plugin","slug":"supportezzy","name":"supportezzy","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2014-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3a3d97d-c01a-485b-80cd-f3195599e159","source":"wordfence","cve":"CVE-2025-49875","title":"If-So Dynamic Content Personalization <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a3d97d-c01a-485b-80cd-f3195599e159?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.9.3.1","to_inclusive":true,"patched_in":"1.9.3.2"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:02:16Z"},{"id":"wordfence:a3a402f4-3b4d-4397-807b-c5f1c33d52aa","source":"wordfence","cve":"","title":"RokIntroScroller <= 1.8 - Abuse of Functionality","severity":"high","cvss":7.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a402f4-3b4d-4397-807b-c5f1c33d52aa?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokintroscroller","name":"RokIntroScroller","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2013-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3a5c4f2-22f6-45df-bf76-9dfa1d2f5f41","source":"wordfence","cve":"CVE-2023-24407","title":"Booking calendar, Appointment Booking System <= 3.2.3 - Missing Authorization","severity":"medium","cvss":4.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a5c4f2-22f6-45df-bf76-9dfa1d2f5f41?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-01-27T00:00:00Z","updated":"2024-12-12T19:02:10Z"},{"id":"wordfence:a3a6143d-051d-4a21-9ef7-4ecb2e9e187a","source":"wordfence","cve":"CVE-2026-14357","title":"DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a6143d-051d-4a21-9ef7-4ecb2e9e187a?source=api-prod","affected":[{"type":"plugin","slug":"devkit","name":"DevKit Pro","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-09-01T16:47:43Z","updated":"2026-09-02T05:29:51Z"},{"id":"wordfence:a3a715b9-85df-46dd-9207-2066b6da9c43","source":"wordfence","cve":"CVE-2020-10195","title":"Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export","severity":"medium","cvss":6.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a715b9-85df-46dd-9207-2066b6da9c43?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"3.63","to_inclusive":true,"patched_in":"3.64.1"}],"published":"2020-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3a9d62b-5143-4a6b-a6de-ba88b9db8b87","source":"wordfence","cve":"CVE-2026-115950","title":"Better Post & Filter Widgets for Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3a9d62b-5143-4a6b-a6de-ba88b9db8b87?source=api-prod","affected":[{"type":"plugin","slug":"better-post-filter-widgets-for-elementor","name":"Better Post & Filter Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-10-26T10:26:00Z","updated":"2026-10-28T01:24:34Z"},{"id":"wordfence:a3aa680f-4ce2-43b2-81fb-c664e398c868","source":"wordfence","cve":"CVE-2026-13010","title":"JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3aa680f-4ce2-43b2-81fb-c664e398c868?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.7.10"}],"published":"2026-07-09T20:51:51Z","updated":"2026-07-10T09:32:43Z"},{"id":"wordfence:a3ad7383-613b-4286-b1d3-ee12dc80fbe2","source":"wordfence","cve":"CVE-2025-62746","title":"Featured Video for WordPress \u2013 VideographyWP <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ad7383-613b-4286-b1d3-ee12dc80fbe2?source=api-prod","affected":[{"type":"plugin","slug":"videographywp","name":"Featured Video for WordPress \u2013 VideographyWP","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T18:33:28Z"},{"id":"wordfence:a3ae55ad-b192-4dde-8a7c-3a4fd71d3475","source":"wordfence","cve":"CVE-2023-0157","title":"All-In-One Security (AIOS) <= 5.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ae55ad-b192-4dde-8a7c-3a4fd71d3475?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3b07f91-c96a-49a5-8ffc-90f34d93aa91","source":"wordfence","cve":"CVE-2024-32544","title":"Netgsm <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b07f91-c96a-49a5-8ffc-90f34d93aa91?source=api-prod","affected":[{"type":"plugin","slug":"netgsm","name":"Netgsm","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-24T16:22:32Z"},{"id":"wordfence:a3b164e0-de2e-40d5-935e-31f5bebd87cf","source":"wordfence","cve":"","title":"WP-FormAssembly <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b164e0-de2e-40d5-935e-31f5bebd87cf?source=api-prod","affected":[{"type":"plugin","slug":"formassembly-web-forms","name":"WP-FormAssembly","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3b1b581-eb22-4a45-9f3d-55f0b1d3b5d8","source":"wordfence","cve":"CVE-2025-68519","title":"Brands for WooCommerce <= 3.8.6.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b1b581-eb22-4a45-9f3d-55f0b1d3b5d8?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.6.3","to_inclusive":true,"patched_in":"3.8.6.4"}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:02:39Z"},{"id":"wordfence:a3b2f3e0-4a91-42d4-b8a6-e0500fe30761","source":"wordfence","cve":"CVE-2025-23937","title":"LinkedIn Lite <= 1.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b2f3e0-4a91-42d4-b8a6-e0500fe30761?source=api-prod","affected":[{"type":"plugin","slug":"linkedin-lite","name":"LinkedIn Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-17T00:00:00Z","updated":"2025-03-25T13:11:05Z"},{"id":"wordfence:a3b459e0-4bd9-443e-96e4-91663a35c26e","source":"wordfence","cve":"CVE-2026-1852","title":"Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-pricing-tables","name":"Product Pricing Table by WooBeWoo","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-04-14T23:28:32Z","updated":"2026-04-15T11:30:31Z"},{"id":"wordfence:a3b5c7ec-eb6a-492e-962f-6ed47ee7f1f2","source":"wordfence","cve":"CVE-2025-58031","title":"Nextend Facebook Connect  <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b5c7ec-eb6a-492e-962f-6ed47ee7f1f2?source=api-prod","affected":[{"type":"plugin","slug":"nextend-facebook-connect","name":"Nextend Social Login and Register","from":"*","from_inclusive":true,"to":"3.1.19","to_inclusive":true,"patched_in":"3.1.20"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-13T16:33:21Z"},{"id":"wordfence:a3b89d04-8a67-4744-a590-3b4dec830906","source":"wordfence","cve":"CVE-2025-31574","title":"Custom Content Scrollbar <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b89d04-8a67-4744-a590-3b4dec830906?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-scrollbar","name":"Custom Content Scrollbar","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-11-10T23:17:24Z"},{"id":"wordfence:a3ba495f-787a-4a9a-ada7-d3c5670aa14e","source":"wordfence","cve":"CVE-2024-51703","title":"WP-Basics <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ba495f-787a-4a9a-ada7-d3c5670aa14e?source=api-prod","affected":[{"type":"plugin","slug":"wp-basics","name":"WP-Basics","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:07:21Z"},{"id":"wordfence:a3ba745a-f13e-4d50-af31-110d8a4eb0e2","source":"wordfence","cve":"CVE-2025-58613","title":"Posts Table with Search & Sort <= 1.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ba745a-f13e-4d50-af31-110d8a4eb0e2?source=api-prod","affected":[{"type":"plugin","slug":"posts-data-table","name":"Posts Table with Search & Sort","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:43:25Z"},{"id":"wordfence:a3bb387c-3f4c-450e-bc3f-4524378bac93","source":"wordfence","cve":"CVE-2025-26908","title":"Kargo Entegrat\u00f6r <= 1.1.14 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3bb387c-3f4c-450e-bc3f-4524378bac93?source=api-prod","affected":[{"type":"plugin","slug":"kargo-entegrator","name":"Kargo Entegrat\u00f6r \u2013 Gurmehub Kargo Entegrasyon Eklentisi","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:59:56Z"},{"id":"wordfence:a3bb454c-ac0e-4915-8c6e-070596f7595a","source":"wordfence","cve":"CVE-2026-12123","title":"All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3bb454c-ac0e-4915-8c6e-070596f7595a?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2026-07-09T16:59:54Z","updated":"2026-07-10T05:34:04Z"},{"id":"wordfence:a3bdccfd-6b82-4a76-81f1-eb0f6d62d413","source":"wordfence","cve":"","title":"Slideoptinprox (Unspecified Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3bdccfd-6b82-4a76-81f1-eb0f6d62d413?source=api-prod","affected":[{"type":"plugin","slug":"slideoptinprox","name":"Slideoptinprox","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c2cda1-af8c-491c-b376-b39f274fed95","source":"wordfence","cve":"CVE-2024-8009","title":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning <= 4.19.2 - Authenticated (Teacher+) User Email Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c2cda1-af8c-491c-b376-b39f274fed95?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.19.2","to_inclusive":true,"patched_in":"4.20.0"}],"published":"2024-08-20T00:00:00Z","updated":"2025-05-30T18:31:33Z"},{"id":"wordfence:a3c323d5-59bc-4ecc-8211-2104fd22639f","source":"wordfence","cve":"CVE-2023-50825","title":"iframe Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c323d5-59bc-4ecc-8211-2104fd22639f?source=api-prod","affected":[{"type":"plugin","slug":"iframe-shortcode","name":"iframe Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c36821-f780-4944-95c9-bcf3bbb73da5","source":"wordfence","cve":"CVE-2015-9462","title":"Awesome Filterable Portfolio < 1.9 - Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c36821-f780-4944-95c9-bcf3bbb73da5?source=api-prod","affected":[{"type":"plugin","slug":"awesome-filterable-portfolio","name":"Awesome Filterable Portfolio","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c3c740-8ebe-44b2-a0ba-6beffe970cf1","source":"wordfence","cve":"CVE-2014-5187","title":"Tom M8te <= 1.5.3 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c3c740-8ebe-44b2-a0ba-6beffe970cf1?source=api-prod","affected":[{"type":"plugin","slug":"tom-m8te","name":"Tom M8te","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c515e2-dc69-4686-b60f-413542bf2118","source":"wordfence","cve":"CVE-2018-19487","title":"JobCareer | Job Board Responsive WordPress Theme < 2.4 - User Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c515e2-dc69-4686-b60f-413542bf2118?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2018-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c5d4ed-7a17-4158-b039-322f729dbdde","source":"wordfence","cve":"","title":"Captcha <= 3.8.1 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c5d4ed-7a17-4158-b039-322f729dbdde?source=api-prod","affected":[{"type":"plugin","slug":"captcha","name":"Captcha","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3c5e30e-a2d4-47cf-b00e-54c007ce5ec3","source":"wordfence","cve":"CVE-2025-68536","title":"Zota <= 1.3.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3c5e30e-a2d4-47cf-b00e-54c007ce5ec3?source=api-prod","affected":[{"type":"theme","slug":"zota","name":"Zota - Elementor Multi-Purpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:45:43Z"},{"id":"wordfence:a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77","source":"wordfence","cve":"CVE-2025-6038","title":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3cd1c3e-5bb0-4653-8764-2ca38d9a7c77?source=api-prod","affected":[{"type":"plugin","slug":"lisfinity-core","name":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-10-08T15:16:05Z","updated":"2025-10-09T03:23:30Z"},{"id":"wordfence:a3d14467-0c1d-4741-b533-37b9605c5fde","source":"wordfence","cve":"CVE-2024-51585","title":"Sales Page Addon \u2013 Elementor & Beaver Builder <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3d14467-0c1d-4741-b533-37b9605c5fde?source=api-prod","affected":[{"type":"plugin","slug":"sales-page-addon","name":"Sales Page Addon \u2013 Elementor & Beaver Builder","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2025-01-30T16:12:27Z"},{"id":"wordfence:a3d14d8f-61f4-4942-9eff-42264bb036bb","source":"wordfence","cve":"CVE-2023-5672","title":"WP Mail Log <= 1.1.2 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3d14d8f-61f4-4942-9eff-42264bb036bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-28T00:00:00Z","updated":"2024-02-06T15:50:00Z"},{"id":"wordfence:a3d4cae6-bf29-4edf-8941-ee40df24a4e0","source":"wordfence","cve":"CVE-2026-97072","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3d4cae6-bf29-4edf-8941-ee40df24a4e0?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:03Z"},{"id":"wordfence:a3d4e7bb-9e9b-4a0e-ab6d-c769dd957748","source":"wordfence","cve":"CVE-2025-48304","title":"Google XML News Sitemap plugin <= 0.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3d4e7bb-9e9b-4a0e-ab6d-c769dd957748?source=api-prod","affected":[{"type":"plugin","slug":"gn-xml-sitemap","name":"Google XML News Sitemap plugin","from":"*","from_inclusive":true,"to":"0.02","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T17:38:04Z"},{"id":"wordfence:a3deedc4-b939-4c54-8376-95d3728872d4","source":"wordfence","cve":"CVE-2024-9511","title":"FluentSMTP \u2013 WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3deedc4-b939-4c54-8376-95d3728872d4?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.2.82","to_inclusive":true,"patched_in":"2.2.83"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T07:38:06Z"},{"id":"wordfence:a3df87b0-5ee2-475a-bf55-5594a47b47dc","source":"wordfence","cve":"CVE-2026-79630","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Product Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3df87b0-5ee2-475a-bf55-5594a47b47dc?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":false,"patched_in":"3.13.0"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:08:11Z"},{"id":"wordfence:a3e095b5-9c0b-45ac-a78d-e50feda348cb","source":"wordfence","cve":"CVE-2024-13422","title":"SEO Blogger to WordPress Migration using 301 Redirection <= 0.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e095b5-9c0b-45ac-a78d-e50feda348cb?source=api-prod","affected":[{"type":"plugin","slug":"seo-blogger-to-wordpress-301-redirector","name":"SEO Blogger to WordPress Migration using 301 Redirection","from":"*","from_inclusive":true,"to":"0.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-22T22:54:18Z","updated":"2025-01-23T11:13:28Z"},{"id":"wordfence:a3e33a5c-df7c-4ef5-a59c-1c31abcda6d1","source":"wordfence","cve":"CVE-2024-0681","title":"Page Restriction WordPress (WP) \u2013 Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e33a5c-df7c-4ef5-a59c-1c31abcda6d1?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:01Z"},{"id":"wordfence:a3e34ec7-eeb2-4966-bac3-c7d4723355d7","source":"wordfence","cve":"CVE-2022-36389","title":"Better Messages <= 1.9.9.148 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e34ec7-eeb2-4966-bac3-c7d4723355d7?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.9.148","to_inclusive":true,"patched_in":"1.9.9.149"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3e54f9b-db12-42ef-a0fa-2d40c0f7908c","source":"wordfence","cve":"CVE-2023-51418","title":"JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e54f9b-db12-42ef-a0fa-2d40c0f7908c?source=api-prod","affected":[{"type":"plugin","slug":"jvm-rich-text-icons","name":"JVM Rich Text Icons","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3e61538-0bd9-4319-ba71-a72c9039f4d8","source":"wordfence","cve":"CVE-2021-24965","title":"Five Star Restaurant Reservations <= 2.4.7 - Subscriber+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e61538-0bd9-4319-ba71-a72c9039f4d8?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3e7460b-1ed4-4ff7-89c7-0bd2658a800d","source":"wordfence","cve":"CVE-2023-0176","title":"Giveaways and Contests by RafflePress <= 1.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e7460b-1ed4-4ff7-89c7-0bd2658a800d?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.11.3"}],"published":"2023-01-12T00:00:00Z","updated":"2024-10-23T08:39:10Z"},{"id":"wordfence:a3e8e42f-8ee5-40ff-934f-b7d580bc5548","source":"wordfence","cve":"CVE-2022-1169","title":"Careerfy < 3.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e8e42f-8ee5-40ff-934f-b7d580bc5548?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":false,"patched_in":"3.9.0"}],"published":"2020-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3eab593-df1e-468b-8755-f56c90fcc654","source":"wordfence","cve":"CVE-2026-97283","title":"Advanced Post Manager <= 4.5.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3eab593-df1e-468b-8755-f56c90fcc654?source=api-prod","affected":[{"type":"plugin","slug":"advanced-post-manager","name":"Advanced Post Manager","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-10-03T17:44:56Z","updated":"2026-10-09T00:00:58Z"},{"id":"wordfence:a3ec7c80-2f49-4b2a-b675-7f40a7d31719","source":"wordfence","cve":"CVE-2026-73359","title":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ec7c80-2f49-4b2a-b675-7f40a7d31719?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.9","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:19:22Z"},{"id":"wordfence:a3ecc238-1f84-47fd-96b9-753d4b528c47","source":"wordfence","cve":"","title":"WooCommerce - Store Exporter <= 2.3.1 - CSV Injection","severity":"medium","cvss":6.0,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ecc238-1f84-47fd-96b9-753d4b528c47?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4"}],"published":"2020-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3ed1a2a-f9d5-4f34-8a8e-583ea7226df8","source":"wordfence","cve":"CVE-2026-107710","title":"Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ed1a2a-f9d5-4f34-8a8e-583ea7226df8?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.14.3","to_inclusive":true,"patched_in":"7.8.14.4"}],"published":"2026-10-27T18:04:55Z","updated":"2026-10-28T06:45:18Z"},{"id":"wordfence:a3ed9841-eecb-4d27-9ed2-44d3100d241d","source":"wordfence","cve":"CVE-2026-73356","title":"Breeze Cache <= 2.5.12 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ed9841-eecb-4d27-9ed2-44d3100d241d?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.5.12","to_inclusive":true,"patched_in":"2.5.13"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T13:29:13Z"},{"id":"wordfence:a3ee01da-218a-421d-8f9c-1dc6c056ef74","source":"wordfence","cve":"CVE-2025-4524","title":"Madara \u2013 Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ee01da-218a-421d-8f9c-1dc6c056ef74?source=api-prod","affected":[{"type":"theme","slug":"madara","name":"Madara \u2013 Responsive and modern WordPress theme for manga sites","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.2.1"}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-21T06:39:46Z"},{"id":"wordfence:a3f0556e-a875-4f88-b96c-a924f8fe01da","source":"wordfence","cve":"CVE-2026-40788","title":"WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f0556e-a875-4f88-b96c-a924f8fe01da?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"7.9.7","to_inclusive":true,"patched_in":"7.9.9"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:53:34Z"},{"id":"wordfence:a3f0e97c-f41f-47ed-93c7-cff5915e9d01","source":"wordfence","cve":"CVE-2024-5034","title":"SULly <= 4.3.0 - Cross-Site Request Forgery to Plugin Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f0e97c-f41f-47ed-93c7-cff5915e9d01?source=api-prod","affected":[{"type":"plugin","slug":"sully","name":"SULly","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:21:07Z"},{"id":"wordfence:a3f0f224-f1e6-4706-9db1-d9ee59b24fc8","source":"wordfence","cve":"CVE-2025-26589","title":"IE CSS3 Support <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f0f224-f1e6-4706-9db1-d9ee59b24fc8?source=api-prod","affected":[{"type":"plugin","slug":"ie-css3-support","name":"IE CSS3 Support","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:06:22Z"},{"id":"wordfence:a3f173b6-f039-4865-8882-8ef7d1f88413","source":"wordfence","cve":"CVE-2022-4059","title":"Cryptocurrency Widgets Pack <= 2.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f173b6-f039-4865-8882-8ef7d1f88413?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-widgets-pack","name":"Cryptocurrency Widgets Pack","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3f1d836-da32-414f-9f2b-d485c44b2486","source":"wordfence","cve":"CVE-2023-6630","title":"Contact Form 7 \u2013 Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-01-10T00:00:00Z","updated":"2024-07-29T21:37:01Z"},{"id":"wordfence:a3f22e95-4b2f-47d5-bb99-0c6497fed893","source":"wordfence","cve":"CVE-2025-5730","title":"Easy Contact Form Lite <= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f22e95-4b2f-47d5-bb99-0c6497fed893?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-lite","name":"Contact Form Plugin","from":"*","from_inclusive":true,"to":"1.1.28","to_inclusive":true,"patched_in":"1.1.29"}],"published":"2025-06-09T00:00:00Z","updated":"2025-07-09T15:26:02Z"},{"id":"wordfence:a3f791dd-7c24-45e3-b4f6-b8d7e594c568","source":"wordfence","cve":"CVE-2026-2426","title":"WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f791dd-7c24-45e3-b4f6-b8d7e594c568?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.69","to_inclusive":true,"patched_in":"1.69.1"}],"published":"2026-02-17T21:55:19Z","updated":"2026-09-16T18:12:33Z"},{"id":"wordfence:a3f7e1a4-88b2-4069-adb8-d51278b48234","source":"wordfence","cve":"CVE-2023-40561","title":"WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking <= 3.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f7e1a4-88b2-4069-adb8-d51278b48234?source=api-prod","affected":[{"type":"plugin","slug":"woo-ecommerce-tracking-for-google-and-facebook","name":"Enhanced Ecommerce Google Analytics for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a3f9ed8b-598e-4fac-9ed1-14ad79680f86","source":"wordfence","cve":"CVE-2026-24623","title":"Neoforum <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f9ed8b-598e-4fac-9ed1-14ad79680f86?source=api-prod","affected":[{"type":"plugin","slug":"neoforum","name":"Neoforum","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T14:48:28Z","updated":"2026-02-03T13:47:26Z"},{"id":"wordfence:a3fbf26b-c7d8-4c44-b3c1-c4e028465a9e","source":"wordfence","cve":"CVE-2025-7644","title":"Pixel Gallery Addons for Elementor \u2013 Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3fbf26b-c7d8-4c44-b3c1-c4e028465a9e?source=api-prod","affected":[{"type":"plugin","slug":"pixel-gallery","name":"Pixel Gallery Addons for Elementor","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-22T04:25:08Z"},{"id":"wordfence:a3fc4131-9cbe-4fb9-93bf-285701411aa7","source":"wordfence","cve":"CVE-2025-30632","title":"Global Translator <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3fc4131-9cbe-4fb9-93bf-285701411aa7?source=api-prod","affected":[{"type":"plugin","slug":"global-translator","name":"Global Translator","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:58:32Z"},{"id":"wordfence:a3fc4bac-9be0-4a1c-b4bb-4384d80e22f7","source":"wordfence","cve":"CVE-2023-51409","title":"AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a3fc4bac-9be0-4a1c-b4bb-4384d80e22f7?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"1.9.98","to_inclusive":true,"patched_in":"1.9.99"}],"published":"2024-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4000749-b25f-43a7-95a0-14b4410f2301","source":"wordfence","cve":"CVE-2025-23551","title":"SexBundle <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4000749-b25f-43a7-95a0-14b4410f2301?source=api-prod","affected":[{"type":"plugin","slug":"sexbundle","name":"SexBundle","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:29:42Z"},{"id":"wordfence:a401a2dd-9b31-47d9-b841-f2e7042b8333","source":"wordfence","cve":"CVE-2024-7146","title":"JetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a401a2dd-9b31-47d9-b841-f2e7042b8333?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.3.1"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T10:59:55Z"},{"id":"wordfence:a401db3e-2cf2-4283-bfbe-d4a9587966e1","source":"wordfence","cve":"","title":"Jock on air now <= 5.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a401db3e-2cf2-4283-bfbe-d4a9587966e1?source=api-prod","affected":[{"type":"plugin","slug":"joan","name":"Jock On Air Now (JOAN)","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4059a0b-1446-4711-a47d-eb0107d58900","source":"wordfence","cve":"CVE-2024-38793","title":"Best Restaurant Menu by PriceListo <= 1.4.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4059a0b-1446-4711-a47d-eb0107d58900?source=api-prod","affected":[{"type":"plugin","slug":"best-restaurant-menu-by-pricelisto","name":"Great Restaurant Menu WP","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:29:30Z"},{"id":"wordfence:a407d8b1-1d21-4b23-a8d6-a977544a19b4","source":"wordfence","cve":"CVE-2024-11409","title":"Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a407d8b1-1d21-4b23-a8d6-a977544a19b4?source=api-prod","affected":[{"type":"plugin","slug":"grid-view-gallery","name":"Grid View Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:41:04Z","updated":"2024-11-21T02:06:40Z"},{"id":"wordfence:a40944fa-9729-4d34-adc0-857bf00d6666","source":"wordfence","cve":"","title":"VDZ CallBack Plugin < 1.14.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a40944fa-9729-4d34-adc0-857bf00d6666?source=api-prod","affected":[{"type":"plugin","slug":"vdz-call-back","name":"VDZ CallBack Plugin","from":"*","from_inclusive":true,"to":"1.14.6","to_inclusive":false,"patched_in":"1.14.6"}],"published":"2021-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a40cb2da-dc13-4e20-9602-a4e6c2eade43","source":"wordfence","cve":"CVE-2023-2010","title":"Forminator <= 1.23.3 - Race Condition to Multiple Poll Voting","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a40cb2da-dc13-4e20-9602-a4e6c2eade43?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":"1.24.1"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a40e7a88-11f2-4fa8-856b-bda3ebcbae56","source":"wordfence","cve":"CVE-2026-4246","title":"ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a40e7a88-11f2-4fa8-856b-bda3ebcbae56?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.10.2"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T05:30:45Z"},{"id":"wordfence:a410fd9b-f3e8-4a5d-a360-10c6586b951e","source":"wordfence","cve":"CVE-2025-23516","title":"Sale with Razorpay <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a410fd9b-f3e8-4a5d-a360-10c6586b951e?source=api-prod","affected":[{"type":"plugin","slug":"sell-with-razorpay","name":"Sale with Razorpay","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:01:49Z"},{"id":"wordfence:a41226ab-9732-4de2-843b-284c011c9224","source":"wordfence","cve":"CVE-2025-4966","title":"WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a41226ab-9732-4de2-843b-284c011c9224?source=api-prod","affected":[{"type":"plugin","slug":"wp-online-users-stats","name":"WP Online Users Stats","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:51:31Z","updated":"2025-06-06T06:42:51Z"},{"id":"wordfence:a412e682-869a-46ba-a2d0-d84ed542adc9","source":"wordfence","cve":"CVE-2024-0445","title":"The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a412e682-869a-46ba-a2d0-d84ed542adc9?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-05-06T00:00:00Z","updated":"2024-07-29T21:37:01Z"},{"id":"wordfence:a4149783-ffa3-4efd-af55-5aa1c0e44443","source":"wordfence","cve":"CVE-2025-2594","title":"User Registration & Membership <= 4.1.2 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4149783-ffa3-4efd-af55-5aa1c0e44443?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-01T13:54:43Z"},{"id":"wordfence:a414de0a-ae44-4955-bd25-ec6ad7860835","source":"wordfence","cve":"CVE-2024-3242","title":"Brizy \u2013 Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a414de0a-ae44-4955-bd25-ec6ad7860835?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.44","to_inclusive":true,"patched_in":"2.4.45"}],"published":"2024-07-17T19:38:09Z","updated":"2024-07-18T08:33:04Z"},{"id":"wordfence:a41684e4-574a-4adc-8627-de6040043198","source":"wordfence","cve":"CVE-2025-49432","title":"Ultimate Video Player <= 10.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a41684e4-574a-4adc-8627-de6040043198?source=api-prod","affected":[{"type":"plugin","slug":"fwduvp","name":"Ultimate Video Player WordPress & WooCommerce Plugin","from":"*","from_inclusive":true,"to":"10.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:03:42Z"},{"id":"wordfence:a4178271-c09e-4094-a616-5a00d28f39a3","source":"wordfence","cve":"CVE-2024-0515","title":"Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4178271-c09e-4094-a616-5a00d28f39a3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:02Z"},{"id":"wordfence:a41c2ee9-2c9a-4b01-8594-fe608f9d2bf2","source":"wordfence","cve":"CVE-2026-28141","title":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery <= 4.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a41c2ee9-2c9a-4b01-8594-fe608f9d2bf2?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:24:22Z"},{"id":"wordfence:a41d78b9-9bdb-48dd-b3ec-2559e79fa251","source":"wordfence","cve":"CVE-2023-28421","title":"WordPress Email Marketing Plugin \u2013 WP Email Capture <= 3.10 - Missing Authorization to Email Capture List Download","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a41d78b9-9bdb-48dd-b3ec-2559e79fa251?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4204099-1065-4167-8b42-3da25945236c","source":"wordfence","cve":"CVE-2026-5465","title":"Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4204099-1065-4167-8b42-3da25945236c?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-04-06T18:13:11Z","updated":"2026-04-07T06:43:42Z"},{"id":"wordfence:a420a8b5-e43e-4c0d-86f3-b35f11efdf46","source":"wordfence","cve":"CVE-2026-2916","title":"Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a420a8b5-e43e-4c0d-86f3-b35f11efdf46?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-07-31T18:39:25Z","updated":"2026-08-01T06:48:48Z"},{"id":"wordfence:a4216919-784f-47ec-8bdf-59705d783341","source":"wordfence","cve":"CVE-2026-118188","title":"PublishPress Revisions 3.9.0 - 4.2.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4216919-784f-47ec-8bdf-59705d783341?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"3.9.0","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:21:48Z"},{"id":"wordfence:a4219c10-9d2a-429d-9ac7-61efc02bd4cf","source":"wordfence","cve":"CVE-2024-1205","title":"Management App for WooCommerce \u2013 Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4219c10-9d2a-429d-9ac7-61efc02bd4cf?source=api-prod","affected":[{"type":"plugin","slug":"wemanage-app-worker","name":"Management App for WooCommerce \u2013 Order notifications, Order management, Lead management, Uptime Monitoring","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-29T14:58:14Z"},{"id":"wordfence:a4246181-d331-46b0-ad48-e2ece11b2f5f","source":"wordfence","cve":"CVE-2026-10089","title":"Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4246181-d331-46b0-ad48-e2ece11b2f5f?source=api-prod","affected":[{"type":"plugin","slug":"insert-pages","name":"Insert Pages","from":"*","from_inclusive":true,"to":"3.11.4","to_inclusive":true,"patched_in":"3.11.5"}],"published":"2026-07-01T17:21:08Z","updated":"2026-07-02T05:35:13Z"},{"id":"wordfence:a427c798-f546-4ca1-98ab-32b433ee5b59","source":"wordfence","cve":"CVE-2024-3245","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a427c798-f546-4ca1-98ab-32b433ee5b59?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.9.15"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T02:32:04Z"},{"id":"wordfence:a4294f5f-d989-4b97-88ee-4e94f4f7845a","source":"wordfence","cve":"CVE-2024-9501","title":"Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4294f5f-d989-4b97-88ee-4e94f4f7845a?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2024-10-25T23:52:39Z","updated":"2025-02-19T17:43:35Z"},{"id":"wordfence:a42dce68-0e64-46a6-926e-b676071744b9","source":"wordfence","cve":"","title":"My Calendar <= 2.5.16 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a42dce68-0e64-46a6-926e-b676071744b9?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"2.5.17","to_inclusive":false,"patched_in":"2.5.17"}],"published":"2018-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a437e3ac-5428-4820-8037-8592b86e0dd5","source":"wordfence","cve":"CVE-2011-0759","title":"WP-reCAPTCHA <= 2.9.8.2 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a437e3ac-5428-4820-8037-8592b86e0dd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-recaptcha","name":"WP-reCAPTCHA","from":"*","from_inclusive":true,"to":"2.9.8.2","to_inclusive":true,"patched_in":"3.0"}],"published":"2011-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a438d058-ccca-4a36-a2e6-40c2b33f2389","source":"wordfence","cve":"CVE-2025-30524","title":"Product Catalog \u2013 Catalog for WordPress <= 1.0.4 - Unauthenticated SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a438d058-ccca-4a36-a2e6-40c2b33f2389?source=api-prod","affected":[{"type":"plugin","slug":"displayproduct","name":"Product Catalog \u2013 Catalog for WordPress","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-03T14:51:51Z"},{"id":"wordfence:a438ec56-8ddc-4cea-8d93-c8f79b46f47e","source":"wordfence","cve":"CVE-2023-25994","title":"Publish to Schedule <= 4.4.2 - Cross-Site Request Forgery leading to Plugin Option Changes","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a438ec56-8ddc-4cea-8d93-c8f79b46f47e?source=api-prod","affected":[{"type":"plugin","slug":"publish-to-schedule","name":"Publish to Schedule","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a43adbf2-0e85-4e70-a18f-8001a86b224e","source":"wordfence","cve":"CVE-2021-24807","title":"Support Board <= 3.3.4 - Agent+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a43adbf2-0e85-4e70-a18f-8001a86b224e?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a43c685b-28d4-425c-984a-f8410c07a469","source":"wordfence","cve":"CVE-2025-31864","title":"Beam me up Scotty \u2013 Back to Top Button <= 1.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a43c685b-28d4-425c-984a-f8410c07a469?source=api-prod","affected":[{"type":"plugin","slug":"beam-me-up-scotty","name":"Beam me up Scotty \u2013 Back to Top Button","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:41:53Z"},{"id":"wordfence:a43dd1a8-4710-4cbc-920b-582e29d7ce98","source":"wordfence","cve":"CVE-2024-35743","title":"SC filechecker <= 0.6 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a43dd1a8-4710-4cbc-920b-582e29d7ce98?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-checker","name":"SC filechecker","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:41:40Z"},{"id":"wordfence:a43ffb6e-8044-4496-9496-11fa8e52a044","source":"wordfence","cve":"CVE-2015-9300","title":"Events Manager < 5.5.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a43ffb6e-8044-4496-9496-11fa8e52a044?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":false,"patched_in":"5.5.7"}],"published":"2015-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a440c03b-e626-4e24-9770-7f8e515e2905","source":"wordfence","cve":"CVE-2026-27388","title":"DesignThemes Booking Manager <= 2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a440c03b-e626-4e24-9770-7f8e515e2905?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-booking-manager","name":"DT Booking - WordPress Ultimate Booking Plugin","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T17:56:56Z"},{"id":"wordfence:a4420935-4952-4460-afc2-1c6df6965b3d","source":"wordfence","cve":"CVE-2026-1206","title":"Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.35.7","to_inclusive":true,"patched_in":"3.35.8"}],"published":"2026-03-25T17:26:49Z","updated":"2026-03-26T05:29:35Z"},{"id":"wordfence:a443b20e-1686-4519-890d-e6f1838fb05c","source":"wordfence","cve":"CVE-2023-0268","title":"Mega Addons For WPBakery Page Builder <= 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a443b20e-1686-4519-890d-e6f1838fb05c?source=api-prod","affected":[{"type":"plugin","slug":"mega-addons-for-visual-composer","name":"Mega Addons For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a443e857-a915-4aa4-9879-1465d50544cc","source":"wordfence","cve":"CVE-2026-42660","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a443e857-a915-4aa4-9879-1465d50544cc?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.7","to_inclusive":true,"patched_in":"29.0.0"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T14:03:30Z"},{"id":"wordfence:a449d1eb-badb-41ca-a4b1-ae230a46dcde","source":"wordfence","cve":"CVE-2025-32686","title":"Team Members <= 3.4.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a449d1eb-badb-41ca-a4b1-ae230a46dcde?source=api-prod","affected":[{"type":"plugin","slug":"wps-team","name":"Team Members Showcase","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2025-04-15T00:00:00Z","updated":"2025-07-10T14:55:23Z"},{"id":"wordfence:a44cde91-2f4d-40f1-98a1-ee6ed94c0155","source":"wordfence","cve":"CVE-2023-23652","title":"MainWP Google Analytics Extension <= 4.0.4 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a44cde91-2f4d-40f1-98a1-ee6ed94c0155?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-google-analytics-extension","name":"MainWP Google Analytics Extension","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a44ce6a3-0a9d-4bce-9251-f3a38b000645","source":"wordfence","cve":"CVE-2023-1575","title":"Mega Main Menu <=  2.2.2 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a44ce6a3-0a9d-4bce-9251-f3a38b000645?source=api-prod","affected":[{"type":"plugin","slug":"mega_main_menu","name":"Mega Main Menu","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4522102-5997-449e-81fe-446a5dac6e71","source":"wordfence","cve":"CVE-2022-2753","title":"Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4522102-5997-449e-81fe-446a5dac6e71?source=api-prod","affected":[{"type":"plugin","slug":"ketchup-restaurant-reservations","name":"Ketchup Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a452cb6f-8381-4f23-b808-3473db159894","source":"wordfence","cve":"CVE-2023-0372","title":"EmbedStories <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a452cb6f-8381-4f23-b808-3473db159894?source=api-prod","affected":[{"type":"plugin","slug":"embedstories","name":"EmbedStories \u2013 Display social media stories","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":"0.7.5"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4531261-d76e-4419-b915-749c72830608","source":"wordfence","cve":"CVE-2023-1021","title":"Amr Ical Events Lists <= 6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4531261-d76e-4419-b915-749c72830608?source=api-prod","affected":[{"type":"plugin","slug":"amr-ical-events-list","name":"amr ical events lists","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a453a38f-0ef5-446b-886f-c208c1baa648","source":"wordfence","cve":"CVE-2022-2565","title":"Simple Payment Donations <= 4.2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a453a38f-0ef5-446b-886f-c208c1baa648?source=api-prod","affected":[{"type":"plugin","slug":"wp-payment-form","name":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a45417ce-d5dd-4706-adbb-d44670de6eb7","source":"wordfence","cve":"CVE-2025-5235","title":"OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a45417ce-d5dd-4706-adbb-d44670de6eb7?source=api-prod","affected":[{"type":"plugin","slug":"opensheetmusicdisplay","name":"OpenSheetMusicDisplay","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-05-29T21:20:31Z","updated":"2025-05-30T09:22:07Z"},{"id":"wordfence:a4541890-4c0d-4348-91df-42cf4b575514","source":"wordfence","cve":"CVE-2024-3517","title":"Shortcodes and extra features for Phlox theme <= 2.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4541890-4c0d-4348-91df-42cf4b575514?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.5","to_inclusive":true,"patched_in":"2.15.6"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:18:25Z"},{"id":"wordfence:a4562535-ef69-4337-b03e-0b7c869cb042","source":"wordfence","cve":"","title":"Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4562535-ef69-4337-b03e-0b7c869cb042?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":false,"patched_in":"3.1.11"}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4572874-afd4-4e46-8a28-76a0a6cc8acb","source":"wordfence","cve":"","title":"Pagination by BestWebSoft < 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4572874-afd4-4e46-8a28-76a0a6cc8acb?source=api-prod","affected":[{"type":"plugin","slug":"pagination","name":"Pagination by BestWebSoft \u2013 Customizable WordPress Content Splitter and Navigation Plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4573514-d56d-4b23-a844-d0ca003d10e6","source":"wordfence","cve":"CVE-2026-94668","title":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4573514-d56d-4b23-a844-d0ca003d10e6?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.5","to_inclusive":true,"patched_in":"10.31.6"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:33:19Z"},{"id":"wordfence:a458f290-f934-45ea-a796-c5c068d10a48","source":"wordfence","cve":"CVE-2026-89190","title":"Robin Image Optimizer <= 2.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a458f290-f934-45ea-a796-c5c068d10a48?source=api-prod","affected":[{"type":"plugin","slug":"robin-image-optimizer","name":"Robin Image Optimizer \u2013 Unlimited Image Optimization, WebP & AVIF","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:00:15Z"},{"id":"wordfence:a459bc57-0442-42bc-b60c-6eaf43aac7a6","source":"wordfence","cve":"CVE-2025-26934","title":"Glossy Blog <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a459bc57-0442-42bc-b60c-6eaf43aac7a6?source=api-prod","affected":[{"type":"theme","slug":"glossy-blog","name":"Glossy Blog","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T13:27:37Z"},{"id":"wordfence:a45a6b3d-49e1-4e25-aa66-15b396da8986","source":"wordfence","cve":"CVE-2023-35914","title":"WooCommerce Subscriptions <= 5.1.2 - Missing Authorization to Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a45a6b3d-49e1-4e25-aa66-15b396da8986?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a45ca208-744b-4e14-86d4-5d68719b9ac6","source":"wordfence","cve":"CVE-2026-115962","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a45ca208-744b-4e14-86d4-5d68719b9ac6?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:34:49Z"},{"id":"wordfence:a4601d9e-02bb-4b27-b16e-7cfc0fc19919","source":"wordfence","cve":"CVE-2025-8609","title":"RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4601d9e-02bb-4b27-b16e-7cfc0fc19919?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-11-17T19:39:20Z","updated":"2025-11-18T08:27:35Z"},{"id":"wordfence:a462789a-d311-47d7-9f54-190eaf5da03f","source":"wordfence","cve":"CVE-2022-45830","title":"Analytify <= 4.2.3 - Missing Authorization & Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a462789a-d311-47d7-9f54-190eaf5da03f?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a46364f4-9258-4f5e-9d53-dcbaf726f2f0","source":"wordfence","cve":"","title":"WP RSS Aggregator \u2013 News Feeds, Autoblogging, Youtube Video Feeds and More <= 4.6.3 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46364f4-9258-4f5e-9d53-dcbaf726f2f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2014-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a463c5be-13d9-45d8-b43e-54ab188c151a","source":"wordfence","cve":"CVE-2024-9378","title":"YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a463c5be-13d9-45d8-b43e-54ab188c151a?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T08:31:51Z"},{"id":"wordfence:a4647210-ba7e-4233-83d6-12572213f5fb","source":"wordfence","cve":"","title":"Checkout Field Editor (Premium) < 1.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647210-ba7e-4233-83d6-12572213f5fb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-field-editor","name":"woocommerce-checkout-field-editor","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4647620-e06a-49d5-8f9d-a59cb5a999b1","source":"wordfence","cve":"CVE-2026-6453","title":"CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4647620-e06a-49d5-8f9d-a59cb5a999b1?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2026-07-31T20:01:04Z","updated":"2026-08-01T08:32:28Z"},{"id":"wordfence:a467ad30-8271-421c-8af4-8165fd60c03e","source":"wordfence","cve":"CVE-2023-45656","title":"Lazy Load for Videos <= 2.18.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a467ad30-8271-421c-8af4-8165fd60c03e?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load-for-videos","name":"Lazy Load for Videos","from":"*","from_inclusive":true,"to":"2.18.2","to_inclusive":true,"patched_in":"2.18.3"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a469a2cb-1011-4d47-95d2-0b895f24ae8f","source":"wordfence","cve":"CVE-2024-37946","title":"ReCaptcha Integration for WordPress <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a469a2cb-1011-4d47-95d2-0b895f24ae8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-recaptcha-integration","name":"ReCaptcha Integration for WordPress","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-07-10T00:00:00Z","updated":"2025-10-30T14:33:42Z"},{"id":"wordfence:a46c09a5-5127-4970-a009-b5fdc9414e81","source":"wordfence","cve":"CVE-2022-3853","title":"Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46c09a5-5127-4970-a009-b5fdc9414e81?source=api-prod","affected":[{"type":"plugin","slug":"supra-csv-parser","name":"Supra CSV","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a46c37f4-245d-423f-bdad-296fdf377ecc","source":"wordfence","cve":"CVE-2026-77871","title":"Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46c37f4-245d-423f-bdad-296fdf377ecc?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2026-10-27T17:42:22Z","updated":"2026-10-28T06:45:19Z"},{"id":"wordfence:a46cd288-5272-4e6c-b01a-f26eb7081168","source":"wordfence","cve":"CVE-2025-32652","title":"Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46cd288-5272-4e6c-b01a-f26eb7081168?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-25T14:53:22Z"},{"id":"wordfence:a46f270f-d9cb-4bc1-8e10-3fc6646e1d78","source":"wordfence","cve":"CVE-2026-18027","title":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a46f270f-d9cb-4bc1-8e10-3fc6646e1d78?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-08-22T10:37:45Z","updated":"2026-08-24T10:16:58Z"},{"id":"wordfence:a4701003-26b9-4ed2-bc5a-e160af2b7664","source":"wordfence","cve":"CVE-2025-49048","title":"Inspectlet - User Session Recording and Heatmaps <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4701003-26b9-4ed2-bc5a-e160af2b7664?source=api-prod","affected":[{"type":"plugin","slug":"inspectlet-heatmaps-and-user-session-recording","name":"Inspectlet \u2013 AI-Powered Session Replay, Heatmaps & Analytics","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-08-14T00:00:00Z","updated":"2026-04-15T13:34:57Z"},{"id":"wordfence:a472e78c-ebd7-4ab8-9b47-96c526754387","source":"wordfence","cve":"CVE-2023-25789","title":"Tapfiliate <= 3.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a472e78c-ebd7-4ab8-9b47-96c526754387?source=api-prod","affected":[{"type":"plugin","slug":"tapfiliate","name":"Tapfiliate","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.0.13"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a472f78c-b3e2-4b75-8eb6-73dd1016f58f","source":"wordfence","cve":"CVE-2026-111971","title":"Photo Engine <= 6.5.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a472f78c-b3e2-4b75-8eb6-73dd1016f58f?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:48:27Z"},{"id":"wordfence:a4766651-92a6-42c9-81bc-7ea25350f561","source":"wordfence","cve":"CVE-2023-3714","title":"ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4766651-92a6-42c9-81bc-7ea25350f561?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a47a8d0e-598e-4674-bba7-41582481025d","source":"wordfence","cve":"CVE-2025-52758","title":"Zippy <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a47a8d0e-598e-4674-bba7-41582481025d?source=api-prod","affected":[{"type":"plugin","slug":"zippy","name":"Zippy","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2025-11-04T16:16:24Z"},{"id":"wordfence:a47c5496-2647-47f0-a772-b4e406a51c09","source":"wordfence","cve":"CVE-2024-33640","title":"Pretty Google Calendar <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a47c5496-2647-47f0-a772-b4e406a51c09?source=api-prod","affected":[{"type":"plugin","slug":"pretty-google-calendar","name":"Pretty Google Calendar","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-08T14:09:13Z"},{"id":"wordfence:a47d79c1-ff14-4185-a088-25a65990a993","source":"wordfence","cve":"CVE-2024-37959","title":"Power BI Embedded for WordPress <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a47d79c1-ff14-4185-a088-25a65990a993?source=api-prod","affected":[{"type":"plugin","slug":"embed-power-bi","name":"Power BI Embedded for WordPress","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:19:43Z"},{"id":"wordfence:a47df134-21e1-4e36-b1b7-ea3e3115f0b6","source":"wordfence","cve":"CVE-2025-62971","title":"Attesa Extra <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a47df134-21e1-4e36-b1b7-ea3e3115f0b6?source=api-prod","affected":[{"type":"plugin","slug":"attesa-extra","name":"Attesa Extra","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-10-19T00:00:00Z","updated":"2026-02-25T13:06:55Z"},{"id":"wordfence:a4806327-46f9-4e84-8886-c9065e1a0ceb","source":"wordfence","cve":"CVE-2025-27312","title":"WP Sitemap <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4806327-46f9-4e84-8886-c9065e1a0ceb?source=api-prod","affected":[{"type":"plugin","slug":"wp-sitemap","name":"WP Sitemap","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:42:07Z"},{"id":"wordfence:a482f6bb-5277-480b-8ec9-230dd4135f7c","source":"wordfence","cve":"CVE-2026-1250","title":"Court Reservation \u2013 Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a482f6bb-5277-480b-8ec9-230dd4135f7c?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.10.11","to_inclusive":true,"patched_in":"1.10.12"}],"published":"2026-05-12T10:05:08Z","updated":"2026-05-12T22:24:24Z"},{"id":"wordfence:a48634d7-30c9-4124-87dd-93a303a969eb","source":"wordfence","cve":"CVE-2025-2168","title":"Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-04-30T14:30:59Z","updated":"2025-05-01T03:23:40Z"},{"id":"wordfence:a4879ad0-8999-4856-bfbf-28c89092b4e2","source":"wordfence","cve":"CVE-2026-22522","title":"Block Slider <= 2.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4879ad0-8999-4856-bfbf-28c89092b4e2?source=api-prod","affected":[{"type":"plugin","slug":"block-slider","name":"Block Slider \u2013 Responsive Image Slider, Video Slider & Post Slider","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:23:25Z"},{"id":"wordfence:a48dcada-aafe-4af0-9d27-8ae2e86232a8","source":"wordfence","cve":"CVE-2025-39422","title":"WP Social Bookmarking <= 3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a48dcada-aafe-4af0-9d27-8ae2e86232a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-bookmarking","name":"WP Social Bookmarking","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:57:33Z"},{"id":"wordfence:a49398c7-a9f4-407a-b1ee-5358c1d13dcc","source":"wordfence","cve":"CVE-2026-118081","title":"10WebSocial <= 1.5.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49398c7-a9f4-407a-b1ee-5358c1d13dcc?source=api-prod","affected":[{"type":"plugin","slug":"wd-instagram-feed","name":"10WebSocial","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:22:42Z","updated":"2026-11-03T19:42:17Z"},{"id":"wordfence:a4953b95-e013-482c-bcc7-1a95f8941624","source":"wordfence","cve":"CVE-2021-25039","title":"Multisite Content Copier/Updater <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4953b95-e013-482c-bcc7-1a95f8941624?source=api-prod","affected":[{"type":"plugin","slug":"wp-multisite-content-copier","name":"WP Multisite Content Copier/Updater","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4962c61-9059-4fb9-9ddf-5e6aa1d2675a","source":"wordfence","cve":"CVE-2026-120560","title":"Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4962c61-9059-4fb9-9ddf-5e6aa1d2675a?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-11-06T15:16:25Z","updated":"2026-11-07T03:28:06Z"},{"id":"wordfence:a496d065-5821-4128-9363-79f388fdd246","source":"wordfence","cve":"CVE-2024-29103","title":"Database for Contact Form 7 <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a496d065-5821-4128-9363-79f388fdd246?source=api-prod","affected":[{"type":"plugin","slug":"cf7-database","name":"Database for Contact Form 7","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:57:02Z"},{"id":"wordfence:a49773ea-981a-4667-a56f-577db0fbf9c7","source":"wordfence","cve":"CVE-2025-23802","title":"WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49773ea-981a-4667-a56f-577db0fbf9c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-revive-adserver","name":"WP-Revive Adserver","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:45:44Z"},{"id":"wordfence:a4997290-c7d5-48cb-92e1-b84b42bd213e","source":"wordfence","cve":"CVE-2025-62046","title":"TheGem Demo Import (for WPBakery) <= 5.10.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4997290-c7d5-48cb-92e1-b84b42bd213e?source=api-prod","affected":[{"type":"plugin","slug":"thegem-importer","name":"TheGem Demo Import (for WPBakery)","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-29T16:01:03Z"},{"id":"wordfence:a4999de1-07b7-49ef-8897-267b836bc469","source":"wordfence","cve":"CVE-2019-12826","title":"Widget Logic < 5.10.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4999de1-07b7-49ef-8897-267b836bc469?source=api-prod","affected":[{"type":"plugin","slug":"widget-logic","name":"Widget Logic","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":false,"patched_in":"5.10.2"}],"published":"2019-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a49ba7e1-ef85-43d6-8685-4cb4e6b7208e","source":"wordfence","cve":"CVE-2025-63055","title":"Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49ba7e1-ef85-43d6-8685-4cb4e6b7208e?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.9.9.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-12-05T00:00:00Z","updated":"2026-01-27T20:40:44Z"},{"id":"wordfence:a49d5e93-754d-4543-8066-911746fe6aee","source":"wordfence","cve":"CVE-2024-52479","title":"Jobify - Job Board WordPress Theme < 4.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49d5e93-754d-4543-8066-911746fe6aee?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2024-11-18T00:00:00Z","updated":"2026-02-26T15:02:11Z"},{"id":"wordfence:a49dd64b-6ae8-49ed-9e8a-e5b73c2acf4b","source":"wordfence","cve":"CVE-2026-1782","title":"MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49dd64b-6ae8-49ed-9e8a-e5b73c2acf4b?source=api-prod","affected":[{"type":"plugin","slug":"metform-pro","name":"MetForm Pro","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-04-14T19:59:33Z","updated":"2026-04-15T08:28:16Z"},{"id":"wordfence:a49e4f5a-ac9d-4f9b-8de2-c7871da8de35","source":"wordfence","cve":"CVE-2024-1074","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49e4f5a-ac9d-4f9b-8de2-c7871da8de35?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.2","to_inclusive":true,"patched_in":"2.7.4.3"}],"published":"2024-02-28T00:00:00Z","updated":"2024-05-31T15:30:49Z"},{"id":"wordfence:a49eaeb9-1395-4ec3-b030-1de898ad0769","source":"wordfence","cve":"CVE-2025-54708","title":"B Blocks <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49eaeb9-1395-4ec3-b030-1de898ad0769?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T21:01:43Z"},{"id":"wordfence:a49f8150-a27d-4801-8923-31af335c3cbd","source":"wordfence","cve":"CVE-2025-4776","title":"Phlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a49f8150-a27d-4801-8923-31af335c3cbd?source=api-prod","affected":[{"type":"theme","slug":"phlox","name":"Phlox","from":"*","from_inclusive":true,"to":"2.17.7","to_inclusive":true,"patched_in":"2.17.11"}],"published":"2026-01-05T17:35:55Z","updated":"2026-01-06T06:36:26Z"},{"id":"wordfence:a4a0bf16-1a13-4955-8198-fa195fb65905","source":"wordfence","cve":"CVE-2022-0837","title":"Appointment and Event Booking Calendar for WordPress \u2013 Amelia <= 1.0.47 - Information Disclosure and SMS Spam","severity":"medium","cvss":6.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a0bf16-1a13-4955-8198-fa195fb65905?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.48","to_inclusive":false,"patched_in":"1.0.48"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4a1be5d-ebd0-4c69-a4d0-303c7b38b6fd","source":"wordfence","cve":"CVE-2025-58949","title":"Spock <= 1.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a1be5d-ebd0-4c69-a4d0-303c7b38b6fd?source=api-prod","affected":[{"type":"theme","slug":"spock","name":"Spock - Medical Doctor Dentist & Beauty WordPress Theme","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-19T16:36:27Z"},{"id":"wordfence:a4a1fb57-84b2-4849-a4d5-9381baf43ff5","source":"wordfence","cve":"CVE-2026-15323","title":"Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a1fb57-84b2-4849-a4d5-9381baf43ff5?source=api-prod","affected":[{"type":"plugin","slug":"lumise","name":"Product Designer for WooCommerce WordPress | Lumise","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-27T16:39:02Z","updated":"2026-10-28T05:33:32Z"},{"id":"wordfence:a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff","source":"wordfence","cve":"CVE-2024-6624","title":"JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a26f60-5912-4d4a-8ef8-e4357c1fb1ff?source=api-prod","affected":[{"type":"plugin","slug":"json-api-user","name":"JSON API User","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-29T19:00:22Z"},{"id":"wordfence:a4a273e7-eb8a-4cfa-80c2-f87d04a6a33e","source":"wordfence","cve":"CVE-2023-45769","title":"WP Report Post <= 2.1.2 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a273e7-eb8a-4cfa-80c2-f87d04a6a33e?source=api-prod","affected":[{"type":"plugin","slug":"wp-report-post","name":"WP Report Post","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4a3bc4b-bc0c-47ac-9f60-e05b300311b4","source":"wordfence","cve":"CVE-2026-93756","title":"Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a3bc4b-bc0c-47ac-9f60-e05b300311b4?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.14.0"}],"published":"2026-10-01T18:58:03Z","updated":"2026-10-02T07:39:27Z"},{"id":"wordfence:a4a4b064-4a93-4aa4-8052-f168302a0a9b","source":"wordfence","cve":"CVE-2025-23555","title":"Ui Slider Filter By Price <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a4b064-4a93-4aa4-8052-f168302a0a9b?source=api-prod","affected":[{"type":"plugin","slug":"ui-slider-filter-by-price","name":"Ui Slider Filter By Price","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T13:57:11Z"},{"id":"wordfence:a4a67ec6-ee13-4532-8213-d17dbf5f2c55","source":"wordfence","cve":"CVE-2023-50898","title":"Sirv <= 7.1.2 - Missing Authorization via sirv_disconnect","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a67ec6-ee13-4532-8213-d17dbf5f2c55?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4a79c36-8371-4035-8c21-4bc0296fa12a","source":"wordfence","cve":"CVE-2015-9306","title":"Easy Drag And drop All Import : WP Ultimate CSV Importer < 3.8.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a79c36-8371-4035-8c21-4bc0296fa12a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":false,"patched_in":"3.8.1"}],"published":"2015-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4a885e0-84fb-4f5a-8ef5-6a0a8108d26f","source":"wordfence","cve":"CVE-2024-35633","title":"Blocksy Companion <= 2.0.42 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4a885e0-84fb-4f5a-8ef5-6a0a8108d26f?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.0.42","to_inclusive":true,"patched_in":"2.0.43"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T15:08:05Z"},{"id":"wordfence:a4ac5738-0ebe-480a-b2b7-f0568d668fa6","source":"wordfence","cve":"CVE-2021-24767","title":"Redirect 404 Error Page to Homepage or Custom Page with Logs <= 1.7.8 - Log Deletion via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ac5738-0ebe-480a-b2b7-f0568d668fa6?source=api-prod","affected":[{"type":"plugin","slug":"redirect-404-error-page-to-homepage-or-custom-page","name":"Redirect 404 Error Page to Homepage or Custom Page with Logs","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4ac8a33-1b04-4ac5-b482-b0a791e84543","source":"wordfence","cve":"CVE-2026-105888","title":"Event Tickets and Registration <= 5.30.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ac8a33-1b04-4ac5-b482-b0a791e84543?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.0.1","to_inclusive":true,"patched_in":"5.30.0.2"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:58Z"},{"id":"wordfence:a4aea6ac-0b36-481c-aa22-db96665404f6","source":"wordfence","cve":"CVE-2022-1396","title":"Donorbox \u2013 Free Recurring Donation Form <= 7.1.6 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4aea6ac-0b36-481c-aa22-db96665404f6?source=api-prod","affected":[{"type":"plugin","slug":"donorbox-donation-form","name":"Donorbox \u2013 Free Recurring Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2022-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4aed6ba-23a2-46b6-b7e1-7b7e462b1f5b","source":"wordfence","cve":"CVE-2023-25039","title":"Google Maps CP <= 1.0.43 - Cross-Site Request Forgery via feedback_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4aed6ba-23a2-46b6-b7e1-7b7e462b1f5b?source=api-prod","affected":[{"type":"plugin","slug":"codepeople-post-map","name":"CodePeople Post Map for Google Maps","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":"1.0.44"}],"published":"2023-02-06T00:00:00Z","updated":"2024-10-15T18:46:59Z"},{"id":"wordfence:a4afee53-9bce-4534-aa7e-119504cadc8a","source":"wordfence","cve":"CVE-2026-39675","title":"Court Reservation <= 1.11.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4afee53-9bce-4534-aa7e-119504cadc8a?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-02-19T00:00:00Z","updated":"2026-10-28T21:10:43Z"},{"id":"wordfence:a4b18a09-408d-4b67-b44c-5a3a814f2f55","source":"wordfence","cve":"CVE-2026-108486","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b18a09-408d-4b67-b44c-5a3a814f2f55?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.58.0","to_inclusive":true,"patched_in":"1.58.1"}],"published":"2026-10-12T17:12:00Z","updated":"2026-10-13T14:05:51Z"},{"id":"wordfence:a4b205ab-f042-46d9-a331-f18809477384","source":"wordfence","cve":"CVE-2024-12561","title":"Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b205ab-f042-46d9-a331-f18809477384?source=api-prod","affected":[{"type":"plugin","slug":"wecantrack","name":"Affiliate Sales in Google Analytics and other tools","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-20T20:30:45Z","updated":"2025-07-03T12:39:15Z"},{"id":"wordfence:a4b353bf-f9be-465a-8723-9ea721b5baab","source":"wordfence","cve":"CVE-2024-56062","title":"Royal Elementor Addons <= 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b353bf-f9be-465a-8723-9ea721b5baab?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.987","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:14:37Z"},{"id":"wordfence:a4b44d89-6f1e-4a23-91ea-e79fc3221183","source":"wordfence","cve":"CVE-2024-2500","title":"ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b44d89-6f1e-4a23-91ea-e79fc3221183?source=api-prod","affected":[{"type":"theme","slug":"colormag","name":"ColorMag","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-03-21T00:00:00Z","updated":"2024-03-22T01:59:59Z"},{"id":"wordfence:a4b46cb3-766f-4524-be04-e10dea3e5bfa","source":"wordfence","cve":"CVE-2026-57704","title":"Smart Manager \u2013 Advanced WooCommerce Bulk Edit & Inventory Management <= 8.90.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b46cb3-766f-4524-be04-e10dea3e5bfa?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.90.0","to_inclusive":true,"patched_in":"8.91.0"}],"published":"2026-07-20T00:00:00Z","updated":"2026-07-27T15:42:19Z"},{"id":"wordfence:a4b71893-b0fd-476e-aa93-5f0b239e8301","source":"wordfence","cve":"","title":"ColdFusion Responsive Fullscreen Video Image Audio Theme < 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b71893-b0fd-476e-aa93-5f0b239e8301?source=api-prod","affected":[{"type":"theme","slug":"coldfusion","name":"coldfusion","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2013-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4b847b5-9deb-41c4-b976-725249e0098e","source":"wordfence","cve":"CVE-2025-8488","title":"Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b847b5-9deb-41c4-b976-725249e0098e?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-08-01T20:50:41Z","updated":"2025-08-02T09:23:32Z"},{"id":"wordfence:a4b89902-5616-443f-b67d-bf3330308ef9","source":"wordfence","cve":"CVE-2022-27859","title":"Travel Management <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b89902-5616-443f-b67d-bf3330308ef9?source=api-prod","affected":[{"type":"plugin","slug":"nd-travel","name":"Travel Management","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-14T09:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4be6550-39a8-47b4-93a2-aa86e9a01a7b","source":"wordfence","cve":"CVE-2026-103693","title":"Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4be6550-39a8-47b4-93a2-aa86e9a01a7b?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"6.0.0.4","to_inclusive":true,"patched_in":"6.0.0.5"},{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:12:52Z"},{"id":"wordfence:a4c0180e-e3f0-42a3-9f97-735b22c1260c","source":"wordfence","cve":"CVE-2024-56049","title":"WPLMS < 1.9.9.5.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":7.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c0180e-e3f0-42a3-9f97-735b22c1260c?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.2","to_inclusive":false,"patched_in":"1.9.9.5.2"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:53:40Z"},{"id":"wordfence:a4c0b14a-d039-4008-a433-ab3605e2612c","source":"wordfence","cve":"CVE-2026-3347","title":"Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=api-prod","affected":[{"type":"plugin","slug":"multi-functional-flexi-lightbox","name":"Multi Functional Flexi Lightbox","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:13:42Z","updated":"2026-03-21T03:26:57Z"},{"id":"wordfence:a4c1f966-aa10-45cc-9fb0-2e703dd3098e","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 2.00 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c1f966-aa10-45cc-9fb0-2e703dd3098e?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.00","to_inclusive":true,"patched_in":"2.10"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4c21c56-c424-4667-a281-fa9e7241d8ad","source":"wordfence","cve":"","title":"Better Click To Tweet <= 5.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c21c56-c424-4667-a281-fa9e7241d8ad?source=api-prod","affected":[{"type":"plugin","slug":"better-click-to-tweet","name":"Better Click To Share \u2013 Shareable Quote Boxes for X (Twitter)","from":"*","from_inclusive":true,"to":"5.10.1","to_inclusive":true,"patched_in":"5.10.2"}],"published":"2022-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4c32896-bd0d-4bdb-845d-ca5a9aa5d5c0","source":"wordfence","cve":"CVE-2025-59005","title":"Categorify <= 1.0.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c32896-bd0d-4bdb-845d-ca5a9aa5d5c0?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-08T00:00:00Z","updated":"2025-09-15T20:00:53Z"},{"id":"wordfence:a4c480be-0987-4ce2-ac6c-c08d02786398","source":"wordfence","cve":"CVE-2025-59587","title":"Penci Shortcodes & Performance < 6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c480be-0987-4ce2-ac6c-c08d02786398?source=api-prod","affected":[{"type":"plugin","slug":"penci-shortcodes","name":"Penci Shortcodes & Performance","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":false,"patched_in":"6.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:42:23Z"},{"id":"wordfence:a4c604ec-6b91-4dbe-bce0-145851019113","source":"wordfence","cve":"CVE-2026-84817","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c604ec-6b91-4dbe-bce0-145851019113?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.1","to_inclusive":true,"patched_in":"3.6.5.2"}],"published":"2026-09-07T13:20:17Z","updated":"2026-09-10T19:36:02Z"},{"id":"wordfence:a4c6d924-c741-4044-b6e2-a95793c606e2","source":"wordfence","cve":"CVE-2025-57909","title":"Editor Custom Color Palette <= 3.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c6d924-c741-4044-b6e2-a95793c606e2?source=api-prod","affected":[{"type":"plugin","slug":"editor-custom-color-palette","name":"Editor Custom Color Palette","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:47:18Z"},{"id":"wordfence:a4c7c448-fe9d-496d-84f2-0da8d1e13d64","source":"wordfence","cve":"CVE-2024-11290","title":"Member Access <= 1.1.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c7c448-fe9d-496d-84f2-0da8d1e13d64?source=api-prod","affected":[{"type":"plugin","slug":"member-access","name":"Member Access","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:05:18Z","updated":"2025-01-07T04:22:17Z"},{"id":"wordfence:a4c7c932-5955-4fce-a64d-3b5c5de95356","source":"wordfence","cve":"CVE-2024-4551","title":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c7c932-5955-4fce-a64d-3b5c5de95356?source=api-prod","affected":[{"type":"plugin","slug":"yotuwp-easy-youtube-embed","name":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2024-06-14T20:13:25Z","updated":"2024-07-03T14:48:06Z"},{"id":"wordfence:a4c8cf71-e9b0-4241-b975-f52aeb823318","source":"wordfence","cve":"CVE-2026-8901","title":"Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c8cf71-e9b0-4241-b975-f52aeb823318?source=api-prod","affected":[{"type":"plugin","slug":"crm-integration-freshworks-any-form","name":"Integration for Freshsales \u2013 Contact Form 7, WPForms, Elementor, Gravity Forms and More","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2026-06-05T12:22:17Z","updated":"2026-06-06T01:26:10Z"},{"id":"wordfence:a4c8d390-145a-4926-99e9-b386dfe5e6ac","source":"wordfence","cve":"CVE-2023-52177","title":"Integrate Google Drive <= 1.3.3 - Missing Authorization via save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c8d390-145a-4926-99e9-b386dfe5e6ac?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4cad5b2-eb0f-41f8-b43b-fcb70d185c25","source":"wordfence","cve":"CVE-2025-50033","title":"Fitness Park <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cad5b2-eb0f-41f8-b43b-fcb70d185c25?source=api-prod","affected":[{"type":"theme","slug":"fitness-park","name":"Fitness Park","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:06:58Z"},{"id":"wordfence:a4cbc0e7-4328-451f-a595-1ce17e9d0031","source":"wordfence","cve":"CVE-2025-6388","title":"Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc0e7-4328-451f-a595-1ce17e9d0031?source=api-prod","affected":[{"type":"plugin","slug":"spirit-framework","name":"Spirit Framework","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2025-10-02T19:26:25Z","updated":"2025-10-03T08:23:52Z"},{"id":"wordfence:a4cbc1b4-edaa-4a55-b9ed-82b72d19eec0","source":"wordfence","cve":"CVE-2026-119479","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.7.1 -  Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cbc1b4-edaa-4a55-b9ed-82b72d19eec0?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.7.1","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:50:33Z"},{"id":"wordfence:a4ccc7f8-c8e0-457a-b437-2a23530a9df4","source":"wordfence","cve":"CVE-2023-49168","title":"BP Better Messages <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ccc7f8-c8e0-457a-b437-2a23530a9df4?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4cd49b2-ff93-4582-906b-b690d8472c38","source":"wordfence","cve":"CVE-2023-4796","title":"Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cd49b2-ff93-4582-906b-b690d8472c38?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4ce7dc7-30f5-4629-ad14-acbfb000ee6d","source":"wordfence","cve":"CVE-2025-23606","title":"Calendi <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ce7dc7-30f5-4629-ad14-acbfb000ee6d?source=api-prod","affected":[{"type":"plugin","slug":"calendi","name":"Calendi","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T18:12:04Z"},{"id":"wordfence:a4ce881f-43cb-47f0-a375-628134c6a884","source":"wordfence","cve":"CVE-2026-107432","title":"Event Post <= 6.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ce881f-43cb-47f0-a375-628134c6a884?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-10-12T07:46:00Z","updated":"2026-10-13T13:45:51Z"},{"id":"wordfence:a4cf3ab0-7215-43f2-8ad7-c587d3376c26","source":"wordfence","cve":"CVE-2026-32485","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cf3ab0-7215-43f2-8ad7-c587d3376c26?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:49:02Z"},{"id":"wordfence:a4d16ccd-149a-4f70-84b4-59429827baa5","source":"wordfence","cve":"CVE-2026-3492","title":"Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d16ccd-149a-4f70-84b4-59429827baa5?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.28","to_inclusive":true,"patched_in":"2.9.29"}],"published":"2026-03-10T21:09:42Z","updated":"2026-03-11T09:25:45Z"},{"id":"wordfence:a4d4532c-f29f-44e2-9aab-beab915efd3c","source":"wordfence","cve":"CVE-2025-32663","title":"FAT Cooming Soon <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d4532c-f29f-44e2-9aab-beab915efd3c?source=api-prod","affected":[{"type":"plugin","slug":"fat-coming-soon","name":"FAT Cooming Soon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:25:40Z"},{"id":"wordfence:a4d54e48-3a7f-4add-b842-6948377f2a73","source":"wordfence","cve":"CVE-2026-102918","title":"Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d54e48-3a7f-4add-b842-6948377f2a73?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"4.5.16"}],"published":"2026-10-30T13:52:46Z","updated":"2026-10-30T17:15:29Z"},{"id":"wordfence:a4d6dcb5-a97a-4e80-b0dc-5649c9867374","source":"wordfence","cve":"CVE-2024-56251","title":"Event Espresso 4 Decaf <= 5.0.28.decaf - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d6dcb5-a97a-4e80-b0dc-5649c9867374?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-decaf","name":"Event Espresso \u2013 Event Registration & Ticketing Sales","from":"*","from_inclusive":true,"to":"5.0.28.decaf","to_inclusive":true,"patched_in":"5.0.31.decaf"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T19:08:14Z"},{"id":"wordfence:a4d7cab5-1641-4ed3-92c7-ad7594dcb74b","source":"wordfence","cve":"CVE-2023-38474","title":"Campaign Monitor for WordPress <= 2.8.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d7cab5-1641-4ed3-92c7-ad7594dcb74b?source=api-prod","affected":[{"type":"plugin","slug":"forms-for-campaign-monitor","name":"Campaign Monitor for WordPress","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":"2.8.14"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4d91b01-5034-42b5-857f-c66c875dd562","source":"wordfence","cve":"CVE-2026-9838","title":"ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d91b01-5034-42b5-857f-c66c875dd562?source=api-prod","affected":[{"type":"plugin","slug":"ics-calendar","name":"ICS Calendar","from":"*","from_inclusive":true,"to":"12.0.9","to_inclusive":true,"patched_in":"12.0.9.2"}],"published":"2026-07-09T19:52:56Z","updated":"2026-07-10T08:30:40Z"},{"id":"wordfence:a4d94570-6652-4614-b686-a6591873889f","source":"wordfence","cve":"CVE-2024-13382","title":"Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d94570-6652-4614-b686-a6591873889f?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.2.63","to_inclusive":true,"patched_in":"5.2.64"}],"published":"2025-03-02T00:00:00Z","updated":"2025-04-02T15:55:02Z"},{"id":"wordfence:a4e1315b-31e5-428c-9a48-6185b4eeb2fc","source":"wordfence","cve":"CVE-2022-4118","title":"Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e1315b-31e5-428c-9a48-6185b4eeb2fc?source=api-prod","affected":[{"type":"plugin","slug":"woo-altcoin-payment-gateway","name":"Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2023-04-17T00:00:00Z","updated":"2024-04-18T19:40:18Z"},{"id":"wordfence:a4e24622-5ff7-4261-a07b-4c096b77fb13","source":"wordfence","cve":"CVE-2025-39472","title":"WooCommerce Social Login <= 2.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e24622-5ff7-4261-a07b-4c096b77fb13?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2025-04-16T00:00:00Z","updated":"2025-10-17T15:07:44Z"},{"id":"wordfence:a4e26035-ce4e-4b4b-aa3c-cd86b29b199a","source":"wordfence","cve":"CVE-2023-3052","title":"Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e26035-ce4e-4b4b-aa3c-cd86b29b199a?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-by-azexo","name":"Page Builder with Image Map by AZEXO","from":"*","from_inclusive":true,"to":"1.27.133","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4e343eb-b83d-43bf-a26d-db10dac18099","source":"wordfence","cve":"CVE-2021-24512","title":"Video Posts Webcam Recorder < 3.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e343eb-b83d-43bf-a26d-db10dac18099?source=api-prod","affected":[{"type":"plugin","slug":"video-posts-webcam-recorder","name":"Webcam Microphone Screen Recorder \u2013 Media Capture","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"3.2.4"}],"published":"2021-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4e542e0-98cc-46af-bedf-a33b133b6de1","source":"wordfence","cve":"CVE-2025-67585","title":"Flexmls\u00ae IDX <= 3.15.7 - Unauthenticated Open Redirect","severity":"low","cvss":3.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e542e0-98cc-46af-bedf-a33b133b6de1?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.15.7","to_inclusive":true,"patched_in":"3.15.8"}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-11T16:52:11Z"},{"id":"wordfence:a4e7f51c-5f44-4d01-8865-9d86067374ec","source":"wordfence","cve":"CVE-2022-38140","title":"SEO Plugin by Squirrly SEO <= 12.1.10 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e7f51c-5f44-4d01-8865-9d86067374ec?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.1.10","to_inclusive":true,"patched_in":"12.1.11"}],"published":"2022-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4e982d1-7ad9-490e-b606-695cafbc7f0b","source":"wordfence","cve":"CVE-2021-24476","title":"Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e982d1-7ad9-490e-b606-695cafbc7f0b?source=api-prod","affected":[{"type":"plugin","slug":"steam-group-viewer","name":"Steam Group Viewer","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4e9eabe-21da-4a1a-8896-74020ecb0369","source":"wordfence","cve":"CVE-2017-1002000","title":"How to Create an App for Android iPhone Easytouch <= 3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e9eabe-21da-4a1a-8896-74020ecb0369?source=api-prod","affected":[{"type":"plugin","slug":"mobile-friendly-app-builder-by-easytouch","name":"How to Create an App for Android iPhone Easytouch","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4ea53bd-2ce7-4dce-8c57-51ba81838f1a","source":"wordfence","cve":"CVE-2023-47765","title":"CodeBard's Patron Button and Widgets for Patreon <= 2.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ea53bd-2ce7-4dce-8c57-51ba81838f1a?source=api-prod","affected":[{"type":"plugin","slug":"patron-button-and-widgets-by-codebard","name":"CodeBard\u2019s Patron Button and Widgets for Patreon","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4eca8f3-0b5d-4449-ba89-37c1b497c4d3","source":"wordfence","cve":"CVE-2024-12872","title":"Zalomen\u00ed  < 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4eca8f3-0b5d-4449-ba89-37c1b497c4d3?source=api-prod","affected":[{"type":"plugin","slug":"zalomeni","name":"Zalomen\u00ed","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2025-01-10T00:00:00Z","updated":"2026-10-13T16:53:49Z"},{"id":"wordfence:a4edf216-1ee2-41cf-b9dd-6b2b9f96ec0e","source":"wordfence","cve":"CVE-2024-51704","title":"imPress <= 0.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4edf216-1ee2-41cf-b9dd-6b2b9f96ec0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-js-impress","name":"imPress","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:19:34Z"},{"id":"wordfence:a4eeaf05-ec86-4d99-bc00-81f7f99e88ce","source":"wordfence","cve":"CVE-2025-7400","title":"Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4eeaf05-ec86-4d99-bc00-81f7f99e88ce?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-10-06T00:00:00Z","updated":"2025-10-07T07:22:41Z"},{"id":"wordfence:a4f2112f-d5dc-4045-ac58-3895d6ac7179","source":"wordfence","cve":"CVE-2023-23879","title":"PHP Execution <= 1.0.0 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f2112f-d5dc-4045-ac58-3895d6ac7179?source=api-prod","affected":[{"type":"plugin","slug":"php-execution-plugin","name":"PHP Execution","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4f4605c-d3e4-4f6e-ba47-413049a27455","source":"wordfence","cve":"CVE-2025-47664","title":"WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f4605c-d3e4-4f6e-ba47-413049a27455?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-04T03:25:32Z"},{"id":"wordfence:a4f6ce4d-6ca5-4a62-ae84-9dd190fc0392","source":"wordfence","cve":"CVE-2025-2573","title":"Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f6ce4d-6ca5-4a62-ae84-9dd190fc0392?source=api-prod","affected":[{"type":"plugin","slug":"amazing-service-box-visual-composer-addons","name":"Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-25T14:11:30Z","updated":"2025-03-26T02:23:48Z"},{"id":"wordfence:a4f6df09-a677-44bc-a2bb-88a7f14c7426","source":"wordfence","cve":"CVE-2025-24638","title":"Create with Code <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f6df09-a677-44bc-a2bb-88a7f14c7426?source=api-prod","affected":[{"type":"plugin","slug":"create-with-code","name":"Create with Code","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:34:07Z"},{"id":"wordfence:a4f7211b-0ff0-406e-9a0a-2dd7b1314d6d","source":"wordfence","cve":"CVE-2023-47667","title":"WP Full Stripe Free <= 7.0.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f7211b-0ff0-406e-9a0a-2dd7b1314d6d?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"7.0.17","to_inclusive":true,"patched_in":"7.0.18"}],"published":"2023-11-08T00:00:00Z","updated":"2024-05-23T14:01:37Z"},{"id":"wordfence:a4f8585b-5d69-4ef9-a49c-70f59a392ef9","source":"wordfence","cve":"CVE-2026-25404","title":"WP Job Manager <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f8585b-5d69-4ef9-a49c-70f59a392ef9?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-01-29T00:00:00Z","updated":"2026-05-04T15:46:26Z"},{"id":"wordfence:a4f8df3a-f247-4365-a9f6-6124065b4883","source":"wordfence","cve":"CVE-2024-3551","title":"Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4f8df3a-f247-4365-a9f6-6124065b4883?source=api-prod","affected":[{"type":"plugin","slug":"penci-data-migrator","name":"Penci Soledad Data Migrator","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-05-16T13:59:53Z","updated":"2024-05-17T02:03:11Z"},{"id":"wordfence:a4fa8aa9-0af8-4202-b219-863bbef8d02c","source":"wordfence","cve":"CVE-2023-51403","title":"Restaurant Reservations <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4fa8aa9-0af8-4202-b219-863bbef8d02c?source=api-prod","affected":[{"type":"plugin","slug":"nd-restaurant-reservations","name":"Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4fd7e76-4d8b-4e4d-9ae9-c7f9933f8324","source":"wordfence","cve":"CVE-2024-10530","title":"Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4fd7e76-4d8b-4e4d-9ae9-c7f9933f8324?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:18Z"},{"id":"wordfence:a4fdfc83-cce9-4c87-88f2-331be081b32c","source":"wordfence","cve":"CVE-2024-43977","title":"The Plus Addons for Elementor Page Builder Lite <= 5.6.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4fdfc83-cce9-4c87-88f2-331be081b32c?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:09:17Z"},{"id":"wordfence:a4ffb3ef-9d77-463f-92c4-4bc799ac16aa","source":"wordfence","cve":"CVE-2023-48740","title":"Easy Social Feed <= 6.5.1 - Missing Authorization via hide_free_sidebar()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ffb3ef-9d77-463f-92c4-4bc799ac16aa?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a4ffc179-f3ab-4ae1-b7e9-13535d104593","source":"wordfence","cve":"CVE-2017-18574","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection","severity":"medium","cvss":6.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a4ffc179-f3ab-4ae1-b7e9-13535d104593?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.0.31","to_inclusive":false,"patched_in":"3.0.31"}],"published":"2017-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a501c2d6-cdcc-4003-99df-245f5253e20f","source":"wordfence","cve":"CVE-2025-3914","title":"Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a501c2d6-cdcc-4003-99df-245f5253e20f?source=api-prod","affected":[{"type":"plugin","slug":"aeropage-sync-for-airtable","name":"Aeropage Sync for Airtable","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-26T05:34:24Z"},{"id":"wordfence:a50531df-e876-463c-a06b-16b2f30aeefe","source":"wordfence","cve":"CVE-2019-9787","title":"WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50531df-e876-463c-a06b-16b2f30aeefe?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.28","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.28","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.26","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.25","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.22","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.18","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.17","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.12","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"3.7.29"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"3.7.29"}],"published":"2019-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a506ad5b-e88d-4264-84d7-fa6c41026c36","source":"wordfence","cve":"CVE-2015-10092","title":"Qtranslate Slug <= 1.1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a506ad5b-e88d-4264-84d7-fa6c41026c36?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-slug","name":"Qtranslate Slug","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2015-08-05T00:00:00Z","updated":"2024-02-07T14:20:58Z"},{"id":"wordfence:a5082982-e605-4ab3-a5b8-785c1850da98","source":"wordfence","cve":"CVE-2024-49222","title":"WPGuppy <= 1.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5082982-e605-4ab3-a5b8-785c1850da98?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:31:23Z"},{"id":"wordfence:a50b3304-d55b-487a-8137-d5083c704cf4","source":"wordfence","cve":"CVE-2024-13421","title":"Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:15Z"},{"id":"wordfence:a50b8e5c-d7f2-45d9-ba24-ea7a3d807deb","source":"wordfence","cve":"CVE-2026-15406","title":"Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b8e5c-d7f2-45d9-ba24-ea7a3d807deb?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"4.1.23"}],"published":"2026-09-08T13:48:13Z","updated":"2026-09-09T02:27:37Z"},{"id":"wordfence:a50c882f-4149-48ae-ae75-8ee340b5368e","source":"wordfence","cve":"CVE-2026-84757","title":"WP Compress \u2013 Instant Performance & Speed Optimization <= 7.21.28 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50c882f-4149-48ae-ae75-8ee340b5368e?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.21.28","to_inclusive":true,"patched_in":"7.22.0"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:49:25Z"},{"id":"wordfence:a50e2df0-b45e-4a0a-b6dc-f05b4286132a","source":"wordfence","cve":"CVE-2026-24937","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50e2df0-b45e-4a0a-b6dc-f05b4286132a?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":false,"patched_in":"7.1.3"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T20:09:01Z"},{"id":"wordfence:a50e7042-bf7b-49d8-8e62-d01ecdd769fd","source":"wordfence","cve":"CVE-2026-5111","title":"Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50e7042-bf7b-49d8-8e62-d01ecdd769fd?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:a50f0b34-fce7-4bae-b3da-c2f521d15444","source":"wordfence","cve":"CVE-2026-61954","title":"PayU CommercePro Plugin <= 3.8.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a50f0b34-fce7-4bae-b3da-c2f521d15444?source=api-prod","affected":[{"type":"plugin","slug":"payu-india","name":"PayU India","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:36:39Z"},{"id":"wordfence:a5121436-f3cc-4298-8ae6-bfebaac960c3","source":"wordfence","cve":"CVE-2025-10636","title":"NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5121436-f3cc-4298-8ae6-bfebaac960c3?source=api-prod","affected":[{"type":"plugin","slug":"ns-maintenance-mode-for-wp","name":"NS Maintenance Mode for WP","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-03T18:07:46Z"},{"id":"wordfence:a514558c-4ccc-42cf-920e-7c73c80df28e","source":"wordfence","cve":"","title":"CarePlus - Health & Medical Responsive WordPress Theme <= 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a514558c-4ccc-42cf-920e-7c73c80df28e?source=api-prod","affected":[{"type":"theme","slug":"careplus","name":"CarePlus \u2013 Health & Medical Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2020-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5155cee-df51-4da3-be86-38df2ab9908f","source":"wordfence","cve":"CVE-2022-45807","title":"WP Mail Log <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5155cee-df51-4da3-be86-38df2ab9908f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a51d081b-344d-4a07-b069-473548b7edbb","source":"wordfence","cve":"CVE-2025-69344","title":"Oneline Lite <= 6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a51d081b-344d-4a07-b069-473548b7edbb?source=api-prod","affected":[{"type":"theme","slug":"oneline-lite","name":"Oneline Lite","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":"6.7"}],"published":"2026-01-04T00:00:00Z","updated":"2026-01-14T20:17:08Z"},{"id":"wordfence:a52015fe-c4df-46a6-8f23-b33730797f4c","source":"wordfence","cve":"","title":"Participants Database <= 2.4.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52015fe-c4df-46a6-8f23-b33730797f4c?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":false,"patched_in":"2.5"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5205717-af90-4d55-b812-38ded2b0f700","source":"wordfence","cve":"","title":"Kindeditor For WordPress < 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5205717-af90-4d55-b812-38ded2b0f700?source=api-prod","affected":[{"type":"plugin","slug":"kindeditor-for-wordpress","name":"Kindeditor For WordPress","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.4"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a521b6a4-1a4f-4433-9163-8de71e1976dd","source":"wordfence","cve":"CVE-2026-39583","title":"Datalogics Ecommerce Delivery \u2013 Datalogics <= 2.6.62 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a521b6a4-1a4f-4433-9163-8de71e1976dd?source=api-prod","affected":[{"type":"plugin","slug":"datalogics","name":"Datalogics Ecommerce Delivery \u2013 Datalogics","from":"*","from_inclusive":true,"to":"2.6.62","to_inclusive":true,"patched_in":"2.6.63"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:19:22Z"},{"id":"wordfence:a52213e4-e13f-4324-b5ef-8371b0e62bfe","source":"wordfence","cve":"CVE-2026-96809","title":"EduAdmin Booking < 6.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52213e4-e13f-4324-b5ef-8371b0e62bfe?source=api-prod","affected":[{"type":"plugin","slug":"eduadmin-booking","name":"EduAdmin Booking","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:34:51Z"},{"id":"wordfence:a522fb0b-ce75-4593-90dd-f7c04d2ba9e0","source":"wordfence","cve":"CVE-2021-24463","title":"Image Slider by Ays- Responsive Slider and Carousel < 2.5.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a522fb0b-ce75-4593-90dd-f7c04d2ba9e0?source=api-prod","affected":[{"type":"plugin","slug":"ays-slider","name":"Image Slider by Ays- Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a52325f9-51b5-469c-865e-73a22002d46f","source":"wordfence","cve":"CVE-2023-1337","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52325f9-51b5-469c-865e-73a22002d46f?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a524591b-633e-44c2-9a29-534b612d4ec7","source":"wordfence","cve":"CVE-2025-24735","title":"Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a524591b-633e-44c2-9a29-534b612d4ec7?source=api-prod","affected":[{"type":"plugin","slug":"chatra-live-chat","name":"Chatra Live Chat + ChatBot + Cart Saver","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-07-04T00:00:00Z","updated":"2026-09-09T15:52:50Z"},{"id":"wordfence:a5276227-9bd4-4ad8-a6b7-ac7d05e8b056","source":"wordfence","cve":"CVE-2024-1719","title":"Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5276227-9bd4-4ad8-a6b7-ac7d05e8b056?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T09:33:35Z"},{"id":"wordfence:a528a2b5-55e5-46e4-8f04-0d2b49f2f683","source":"wordfence","cve":"CVE-2022-0384","title":"Video Conferencing with Zoom <= 3.8.16 - E-mail Address Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a528a2b5-55e5-46e4-8f04-0d2b49f2f683?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"3.8.17","to_inclusive":false,"patched_in":"3.8.17"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a52bad85-5895-4f42-8aab-897fe7acac74","source":"wordfence","cve":"CVE-2026-116387","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52bad85-5895-4f42-8aab-897fe7acac74?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.12.9","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-10-29T14:22:00Z","updated":"2026-11-03T19:29:30Z"},{"id":"wordfence:a52d6222-688f-4300-b53d-db2cc31f924a","source":"wordfence","cve":"CVE-2026-100386","title":"Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52d6222-688f-4300-b53d-db2cc31f924a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.54","to_inclusive":true,"patched_in":"3.5.55"}],"published":"2026-11-09T18:10:48Z","updated":"2026-11-10T06:47:03Z"},{"id":"wordfence:a52dc13f-50b3-4aa3-9924-beb75351673e","source":"wordfence","cve":"CVE-2013-5711","title":"Design Approval System <= 3.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52dc13f-50b3-4aa3-9924-beb75351673e?source=api-prod","affected":[{"type":"plugin","slug":"design-approval-system","name":"Design Approval System","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2013-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a52e048d-6aec-4e97-8272-748aaee76b57","source":"wordfence","cve":"CVE-2025-49947","title":"WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52e048d-6aec-4e97-8272-748aaee76b57?source=api-prod","affected":[{"type":"plugin","slug":"extendons-registration-fields","name":"WooCommerce Registration Fields Plugin - Custom Signup Fields","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-11-04T18:20:18Z"},{"id":"wordfence:a52e43dd-46b4-445b-b350-a2fd76315869","source":"wordfence","cve":"CVE-2024-11192","title":"Spotify Play Button for WordPress <= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52e43dd-46b4-445b-b350-a2fd76315869?source=api-prod","affected":[{"type":"plugin","slug":"spotify-play-button-for-wordpress","name":"Sp*tify Play Button for WordPress","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2024-11-25T19:39:45Z","updated":"2024-11-26T08:31:56Z"},{"id":"wordfence:a52e6242-33b4-4981-932f-d825b4fc9941","source":"wordfence","cve":"CVE-2025-14892","title":"Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52e6242-33b4-4981-932f-d825b4fc9941?source=api-prod","affected":[{"type":"plugin","slug":"prime-listing-manager","name":"Prime Listing Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-02-25T15:43:14Z"},{"id":"wordfence:a52ed75b-07ce-46dc-8321-d10074ce0f61","source":"wordfence","cve":"","title":"WordPress Classifieds Plugin \u2013 Ad Directory & Listings by AWP Classifieds <= 3.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52ed75b-07ce-46dc-8321-d10074ce0f61?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a52fb5f4-60ba-4077-95cd-e160a6d9a419","source":"wordfence","cve":"CVE-2023-40211","title":"Post Grid <= 2.2.50 -  Missing Authorization to Sensitive Information Exposure via REST API","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a52fb5f4-60ba-4077-95cd-e160a6d9a419?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.50","to_inclusive":true,"patched_in":"2.2.51"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a531730a-8505-4461-aeff-94b04778c8b9","source":"wordfence","cve":"CVE-2025-31809","title":"Labinator Content Types Duplicator <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a531730a-8505-4461-aeff-94b04778c8b9?source=api-prod","affected":[{"type":"plugin","slug":"labinator-content-types-duplicator","name":"Labinator Content Types Duplicator","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-10-28T21:06:19Z"},{"id":"wordfence:a53291f9-632c-4b0b-b5f9-d247134f2a5c","source":"wordfence","cve":"CVE-2024-29770","title":"Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a53291f9-632c-4b0b-b5f9-d247134f2a5c?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-27T20:55:17Z"},{"id":"wordfence:a533ddd4-cf89-4bf9-981e-2fdd4ff4d414","source":"wordfence","cve":"CVE-2024-34809","title":"EmpowerWP <= 1.0.21 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a533ddd4-cf89-4bf9-981e-2fdd4ff4d414?source=api-prod","affected":[{"type":"theme","slug":"empowerwp","name":"EmpowerWP","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-19T12:18:47Z"},{"id":"wordfence:a5341bbd-55bd-41ad-b5d1-d6b56c141277","source":"wordfence","cve":"CVE-2020-36832","title":"Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5341bbd-55bd-41ad-b5d1-d6b56c141277?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"7.3","from_inclusive":true,"to":"8.6.1","to_inclusive":false,"patched_in":"8.6.1"}],"published":"2020-02-06T00:00:00Z","updated":"2024-10-16T06:43:38Z"},{"id":"wordfence:a53430c1-7a2d-4c05-94ee-691e06759797","source":"wordfence","cve":"CVE-2022-41616","title":"Export Users Data CSV <= 2.1 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":6.0,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a53430c1-7a2d-4c05-94ee-691e06759797?source=api-prod","affected":[{"type":"plugin","slug":"export-users-data-csv","name":"Export Users Data CSV","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a534d51d-2bf8-40ab-a043-88c5f14542b9","source":"wordfence","cve":"CVE-2024-43958","title":"IntoTheDark <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a534d51d-2bf8-40ab-a043-88c5f14542b9?source=api-prod","affected":[{"type":"theme","slug":"intothedark","name":"IntoTheDark","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:04:44Z"},{"id":"wordfence:a535eb7f-5ec7-4b3b-b46f-4f09434d04b6","source":"wordfence","cve":"CVE-2024-9706","title":"Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a535eb7f-5ec7-4b3b-b46f-4f09434d04b6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-coming-soon","name":"Ultimate Coming Soon Page, Maintenance Mode & Under Construction \u2013 Gutenberg Block Builder & Landing Page","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-12-05T19:35:12Z","updated":"2024-12-16T10:16:47Z"},{"id":"wordfence:a5368894-3277-47d0-8fad-adfb8df4fa93","source":"wordfence","cve":"","title":"WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5368894-3277-47d0-8fad-adfb8df4fa93?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"5.6.12"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"5.6.12"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a537f82c-5139-439e-817f-7fd0ece958bd","source":"wordfence","cve":"","title":"Chocolate WP \u2013 Responsive Photography Theme (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a537f82c-5139-439e-817f-7fd0ece958bd?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5381944-f12c-41e6-be47-bd258da5600b","source":"wordfence","cve":"","title":"Search and Share <= 0.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5381944-f12c-41e6-be47-bd258da5600b?source=api-prod","affected":[{"type":"plugin","slug":"search-and-share","name":"Search and Share","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2013-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a539ba27-ad9b-4fe6-8df4-71e262c7b158","source":"wordfence","cve":"CVE-2026-12483","title":"LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a539ba27-ad9b-4fe6-8df4-71e262c7b158?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.5.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-04T13:29:27Z"},{"id":"wordfence:a53a1178-7267-4d7f-ad9e-2906c05b8fe0","source":"wordfence","cve":"","title":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress <= 5.3.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a53a1178-7267-4d7f-ad9e-2906c05b8fe0?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2015-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a53c1462-38da-4444-84ae-610fa6d3ddec","source":"wordfence","cve":"CVE-2026-28054","title":"Legal Stone <= 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a53c1462-38da-4444-84ae-610fa6d3ddec?source=api-prod","affected":[{"type":"theme","slug":"legal-stone","name":"Legal Stone | Lawyers & Attorneys WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:11:17Z"},{"id":"wordfence:a53da4a1-5679-4d60-8ab0-4a656a27dca2","source":"wordfence","cve":"CVE-2026-103081","title":"Salevo Boost Sales for WooCommerce \u2013 Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a53da4a1-5679-4d60-8ab0-4a656a27dca2?source=api-prod","affected":[{"type":"plugin","slug":"woo-boost-sales","name":"Salevo Boost Sales for WooCommerce \u2013 Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-23T19:39:44Z"},{"id":"wordfence:a54038e1-e9e4-48aa-b368-e8d9ec687e85","source":"wordfence","cve":"CVE-2021-24790","title":"Contact Form Advanced Database <= 1.0.8 - Missing Authorization","severity":"high","cvss":8.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54038e1-e9e4-48aa-b368-e8d9ec687e85?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-advanced-database","name":"Contact Form Advanced Database","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a541f0db-d41f-4827-b311-815cab9f9bf8","source":"wordfence","cve":"CVE-2021-24496","title":"Community Events <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a541f0db-d41f-4827-b311-815cab9f9bf8?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2021-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5436d14-cbb5-420f-9f3a-698ce59c1e1e","source":"wordfence","cve":"","title":"Formilla Chat and Marketing Automation <= 1.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaToolsID'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5436d14-cbb5-420f-9f3a-698ce59c1e1e?source=api-prod","affected":[{"type":"plugin","slug":"formilla-chat-and-marketing","name":"Customer Support Software, Live Chat, & Marketing Automation","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5454bc2-0581-45bd-8dbc-5a2819202690","source":"wordfence","cve":"","title":"Custom Contact Forms Plugin <= 5.1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5454bc2-0581-45bd-8dbc-5a2819202690?source=api-prod","affected":[{"type":"plugin","slug":"custom-contact-forms","name":"Custom Contact Forms","from":"*","from_inclusive":true,"to":"5.1.0.3","to_inclusive":false,"patched_in":"5.1.0.3"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5462bc3-1c7c-40b4-bab9-c895231d76e0","source":"wordfence","cve":"CVE-2025-60063","title":"Rosalinda <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5462bc3-1c7c-40b4-bab9-c895231d76e0?source=api-prod","affected":[{"type":"theme","slug":"rosalinda","name":"Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2025-12-20T21:07:02Z"},{"id":"wordfence:a54841af-65ce-4434-a67e-79ea673ec8f9","source":"wordfence","cve":"CVE-2023-47787","title":"WooCommerce Bookings <= 2.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54841af-65ce-4434-a67e-79ea673ec8f9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bookings","name":"WooCommerce Bookings","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a548e71f-4f36-4a29-8293-474e119f09cc","source":"wordfence","cve":"CVE-2023-3356","title":"Subscribers Text Counter <= 1.7 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a548e71f-4f36-4a29-8293-474e119f09cc?source=api-prod","affected":[{"type":"plugin","slug":"subscribers-text-counter","name":"Subscribers Text Counter","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a54ad0b4-b6e7-4eac-843e-261ec6c83d84","source":"wordfence","cve":"CVE-2023-49849","title":"Shortcoder <= 6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54ad0b4-b6e7-4eac-843e-261ec6c83d84?source=api-prod","affected":[{"type":"plugin","slug":"shortcoder","name":"Shortcoder \u2014 Create Shortcodes for Anything","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a54c2a89-4297-48f5-bbff-e5c20c26a632","source":"wordfence","cve":"CVE-2024-0837","title":"Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Custom Gallery' Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54c2a89-4297-48f5-bbff-e5c20c26a632?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T07:34:56Z"},{"id":"wordfence:a54dd9e5-59e7-4655-9f64-e198deda1383","source":"wordfence","cve":"CVE-2026-104022","title":"Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint","severity":"medium","cvss":5.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54dd9e5-59e7-4655-9f64-e198deda1383?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-10T02:26:33Z"},{"id":"wordfence:a54e9aa6-943d-4f76-81af-3424a23f9313","source":"wordfence","cve":"CVE-2024-56266","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a54e9aa6-943d-4f76-81af-3424a23f9313?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:49:46Z"},{"id":"wordfence:a550e489-904b-4785-b6f3-992b7dfe5bd2","source":"wordfence","cve":"CVE-2021-24341","title":"Xllentech English Islamic Calendar <= 2.6.7 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a550e489-904b-4785-b6f3-992b7dfe5bd2?source=api-prod","affected":[{"type":"plugin","slug":"xllentech-english-islamic-calendar","name":"Xllentech English Islamic Calendar","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2021-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a554b365-b54b-4696-87f6-df5099e15708","source":"wordfence","cve":"CVE-2023-49760","title":"WPsoonOnlinePage <= 1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a554b365-b54b-4696-87f6-df5099e15708?source=api-prod","affected":[{"type":"plugin","slug":"wp-soononline-page","name":"WPsoonOnlinePage","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a555da8f-586a-4fb8-9230-9238df73cba4","source":"wordfence","cve":"CVE-2024-36082","title":"Music Store - WordPress eCommerce <= 1.1.13 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a555da8f-586a-4fb8-9230-9238df73cba4?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-18T15:04:51Z"},{"id":"wordfence:a55af7fd-5f45-4978-b2b9-636b33297deb","source":"wordfence","cve":"CVE-2024-52435","title":"Premium Packages <= 6.0.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a55af7fd-5f45-4978-b2b9-636b33297deb?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2024-11-15T00:00:00Z","updated":"2025-10-08T21:03:18Z"},{"id":"wordfence:a55cfeb3-7632-4a88-ac71-8e119b060721","source":"wordfence","cve":"CVE-2024-4359","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a55cfeb3-7632-4a88-ac71-8e119b060721?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-08-08T00:00:00Z","updated":"2026-02-03T08:25:03Z"},{"id":"wordfence:a55e0d63-b844-41a4-bc16-9fd10dfbe9a1","source":"wordfence","cve":"CVE-2025-68556","title":"HAPPY <= 1.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a55e0d63-b844-41a4-bc16-9fd10dfbe9a1?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-06T14:36:16Z"},{"id":"wordfence:a5612c16-9629-4869-8ec1-8fba788b7d7c","source":"wordfence","cve":"CVE-2026-119160","title":"Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5612c16-9629-4869-8ec1-8fba788b7d7c?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2026-10-30T20:12:18Z","updated":"2026-10-31T08:30:46Z"},{"id":"wordfence:a562a213-9c63-4236-8c2c-c7fadffb5ac4","source":"wordfence","cve":"CVE-2019-14231","title":"Viral Quiz Maker - OnionBuzz < 1.2.2 - SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a562a213-9c63-4236-8c2c-c7fadffb5ac4?source=api-prod","affected":[{"type":"plugin","slug":"onionbuzz-viral-quiz","name":"OnionBuzz","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2019-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a56772fd-f77f-4ba5-b5c4-79ac8204b599","source":"wordfence","cve":"CVE-2024-0898","title":"Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56772fd-f77f-4ba5-b5c4-79ac8204b599?source=api-prod","affected":[{"type":"plugin","slug":"chat-bubble","name":"Chat Bubble \u2013 Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:02Z"},{"id":"wordfence:a567b932-7984-400b-bca0-8d2b0e4b1cb7","source":"wordfence","cve":"CVE-2025-9083","title":"Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a567b932-7984-400b-bca0-8d2b0e4b1cb7?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.11.1"}],"published":"2025-08-28T00:00:00Z","updated":"2025-09-09T13:48:00Z"},{"id":"wordfence:a568162a-5a2d-47ab-9dfe-2f2f5f324f0d","source":"wordfence","cve":"CVE-2026-1831","title":"YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a568162a-5a2d-47ab-9dfe-2f2f5f324f0d?source=api-prod","affected":[{"type":"plugin","slug":"yaymail","name":"YayMail \u2013 WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-02-17T18:55:15Z","updated":"2026-02-18T07:25:42Z"},{"id":"wordfence:a56874fe-cb2b-4024-a8db-9cf6c4d0012a","source":"wordfence","cve":"CVE-2015-9484","title":"Accio | Responsive Onepage Parallax Agency WordPress Theme <= 1.1.0 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56874fe-cb2b-4024-a8db-9cf6c4d0012a?source=api-prod","affected":[{"type":"theme","slug":"accio","name":"Accio | Responsive Onepage Parallax Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a56a2910-0aa7-4a8c-921d-ed7bb817846b","source":"wordfence","cve":"CVE-2025-48097","title":"WSAnalytics <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56a2910-0aa7-4a8c-921d-ed7bb817846b?source=api-prod","affected":[{"type":"plugin","slug":"wsanalytics-google-analytics-and-dashboards","name":"WSAnalytics \u2013 Google Analytics And Dashboards","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:55:22Z"},{"id":"wordfence:a56b59ce-29c2-4172-b703-a06d7bb28da0","source":"wordfence","cve":"CVE-2026-12761","title":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.7.0","to_inclusive":true,"patched_in":"7.8.0"}],"published":"2026-07-10T07:45:14Z","updated":"2026-07-10T20:31:39Z"},{"id":"wordfence:a56d1a9e-7564-41b0-af03-c272ffbbbb97","source":"wordfence","cve":"CVE-2026-17089","title":"Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d1a9e-7564-41b0-af03-c272ffbbbb97?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.0.1","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-08-24T14:30:28Z","updated":"2026-08-25T03:27:07Z"},{"id":"wordfence:a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0","source":"wordfence","cve":"CVE-2018-25105","title":"File Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2018-09-17T00:00:00Z","updated":"2024-10-16T06:43:38Z"},{"id":"wordfence:a56df440-a1ed-4c5a-ac9c-5ddeffb28e60","source":"wordfence","cve":"CVE-2022-25602","title":"Responsive Menu <= 4.1.7 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56df440-a1ed-4c5a-ac9c-5ddeffb28e60?source=api-prod","affected":[{"type":"plugin","slug":"responsive-menu","name":"Responsive Menu \u2013 Mobile Menu & Hamburger Menu Builder","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":false,"patched_in":"4.1.8"}],"published":"2022-03-16T11:48:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a56eae11-578e-40d3-8a89-72af7d4d42e1","source":"wordfence","cve":"CVE-2026-66683","title":"Custom CSS and JavaScript <= 2.0.16 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a56eae11-578e-40d3-8a89-72af7d4d42e1?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-and-javascript","name":"Custom CSS and JavaScript","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:00:09Z"},{"id":"wordfence:a5706025-962f-47e2-8d1d-16bafd937c92","source":"wordfence","cve":"","title":"Amoveo Multipurpose Wordpress Theme <= 2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5706025-962f-47e2-8d1d-16bafd937c92?source=api-prod","affected":[{"type":"theme","slug":"amoveo","name":"Amoveo Multipurpose Wordpress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2013-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5719af3-b2d0-42c4-a509-8f4fbcd8eb2d","source":"wordfence","cve":"CVE-2025-10357","title":"Simple SEO <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5719af3-b2d0-42c4-a509-8f4fbcd8eb2d?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2025-09-23T00:00:00Z","updated":"2025-10-16T15:12:10Z"},{"id":"wordfence:a571f1c4-bc83-45fe-9c24-6712d8c3ec5a","source":"wordfence","cve":"CVE-2026-40735","title":"Reina <= 2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a571f1c4-bc83-45fe-9c24-6712d8c3ec5a?source=api-prod","affected":[{"type":"theme","slug":"reina","name":"Reina - Spa and Wellness WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:09:35Z"},{"id":"wordfence:a57426d2-0ca4-405b-bfbf-0685e2c744a0","source":"wordfence","cve":"CVE-2021-29450","title":"WordPress Core < 5.7.1 - Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57426d2-0ca4-405b-bfbf-0685e2c744a0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.20","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.16","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.17","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.12","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.9","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.10","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.7","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.5","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.4","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.3","to_inclusive":false,"patched_in":"4.7.20"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.1","to_inclusive":false,"patched_in":"4.7.20"}],"published":"2021-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a57509c5-6535-4a73-a138-a03805746754","source":"wordfence","cve":"CVE-2025-52781","title":"TinyNav <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57509c5-6535-4a73-a138-a03805746754?source=api-prod","affected":[{"type":"plugin","slug":"tinynav","name":"TinyNav","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:58:35Z"},{"id":"wordfence:a5763e3b-01b3-4541-8fef-80fcb7e7e88e","source":"wordfence","cve":"CVE-2014-4725","title":"MailPoet Newsletters <= 2.6.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5763e3b-01b3-4541-8fef-80fcb7e7e88e?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a57675f0-d840-4954-b86e-a9fbc1483bc7","source":"wordfence","cve":"","title":"Name Directory <= 1.25.4 - Unauthorized Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57675f0-d840-4954-b86e-a9fbc1483bc7?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.25.4","to_inclusive":true,"patched_in":"1.25.5"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a576f39e-42de-4881-a490-000850ea1d2d","source":"wordfence","cve":"CVE-2025-5767","title":"Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a576f39e-42de-4881-a490-000850ea1d2d?source=api-prod","affected":[{"type":"plugin","slug":"crowdfunding-for-woocommerce","name":"Crowdfunding for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:28:34Z","updated":"2025-07-18T05:24:00Z"},{"id":"wordfence:a57b2afa-b943-419f-9819-d7b6835c4d10","source":"wordfence","cve":"CVE-2024-12822","title":"Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57b2afa-b943-419f-9819-d7b6835c4d10?source=api-prod","affected":[{"type":"plugin","slug":"userpro-mediamanager","name":"Media Manager for UserPro","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:49:51Z","updated":"2025-01-30T13:42:07Z"},{"id":"wordfence:a57d218c-0aee-4764-9496-065e71448a9b","source":"wordfence","cve":"CVE-2026-54191","title":"Pods \u2013 Custom Content Types and Fields <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57d218c-0aee-4764-9496-065e71448a9b?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T15:45:19Z"},{"id":"wordfence:a57d6585-bffb-41c4-9301-5f9e2f16eb2c","source":"wordfence","cve":"CVE-2025-53424","title":"WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a57d6585-bffb-41c4-9301-5f9e2f16eb2c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-orders-ei","name":"WooCommerce Orders & Customers Exporter","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T00:00:00Z","updated":"2025-10-29T19:15:19Z"},{"id":"wordfence:a58080ca-8b07-42ce-8bed-10ad1c028833","source":"wordfence","cve":"CVE-2026-42644","title":"BetterDocs <= 4.3.10 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58080ca-8b07-42ce-8bed-10ad1c028833?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"4.3.11"}],"published":"2026-03-18T00:00:00Z","updated":"2026-05-12T14:05:31Z"},{"id":"wordfence:a5862e5e-8506-41d0-9ed3-960548bac3e0","source":"wordfence","cve":"CVE-2024-51656","title":"Flash Show And Hide Box <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5862e5e-8506-41d0-9ed3-960548bac3e0?source=api-prod","affected":[{"type":"plugin","slug":"flash-show-and-hide-box","name":"Flash Show And Hide Box","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:47:12Z"},{"id":"wordfence:a58685a5-d57a-42c9-86c7-344015952885","source":"wordfence","cve":"CVE-2013-7481","title":"Contact Form By BestWebSoft<= 3.34 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58685a5-d57a-42c9-86c7-344015952885?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.34","to_inclusive":true,"patched_in":"3.35"}],"published":"2013-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a589dedc-059d-4d23-8ee7-67b024bae269","source":"wordfence","cve":"CVE-2026-97264","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a589dedc-059d-4d23-8ee7-67b024bae269?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-10-08T13:13:04Z","updated":"2026-10-13T14:51:09Z"},{"id":"wordfence:a58a859d-0274-4d2f-80e3-ff30022842c4","source":"wordfence","cve":"CVE-2026-39698","title":"The Publisher Desk ads.txt <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58a859d-0274-4d2f-80e3-ff30022842c4?source=api-prod","affected":[{"type":"plugin","slug":"the-publisher-desk-ads-txt","name":"The Publisher Desk ads.txt","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-04-15T21:31:46Z"},{"id":"wordfence:a58aa621-e1be-436f-8069-e84a81e55865","source":"wordfence","cve":"CVE-2026-119490","title":"Customize WordPress Emails and Alerts \u2013 Better Notifications for WP <= 1.10.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58aa621-e1be-436f-8069-e84a81e55865?source=api-prod","affected":[{"type":"plugin","slug":"bnfw","name":"Customize WordPress Emails and Alerts \u2013 Better Notifications for WP","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:49:47Z"},{"id":"wordfence:a58bdc25-6171-47d5-bdcc-b4fe89b906f1","source":"wordfence","cve":"CVE-2025-9992","title":"Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58bdc25-6171-47d5-bdcc-b4fe89b906f1?source=api-prod","affected":[{"type":"plugin","slug":"ghostkit","name":"Block Animations, Motion & Scroll Effects \u2013 Ghost Kit","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-09-17T20:48:21Z","updated":"2025-09-18T09:31:32Z"},{"id":"wordfence:a58cba26-a57e-4170-95bb-54ea7cfdb10c","source":"wordfence","cve":"CVE-2024-1051","title":"List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a58cba26-a57e-4170-95bb-54ea7cfdb10c?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.89.6","to_inclusive":true,"patched_in":"0.89.7"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T04:31:10Z"},{"id":"wordfence:a590ed63-ccec-4f20-961d-62c1f08781b0","source":"wordfence","cve":"CVE-2024-34807","title":"Fast Custom Social Share by CodeBard <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a590ed63-ccec-4f20-961d-62c1f08781b0?source=api-prod","affected":[{"type":"plugin","slug":"fast-custom-social-share-by-codebard","name":"Fast Custom Social Share by CodeBard","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-19T12:27:45Z"},{"id":"wordfence:a59148b3-2c04-4083-b037-89b33a621e8f","source":"wordfence","cve":"CVE-2026-91023","title":"Motors \u2013 Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a59148b3-2c04-4083-b037-89b33a621e8f?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.123","to_inclusive":true,"patched_in":"1.4.124"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T00:02:02Z"},{"id":"wordfence:a594ae11-3e8f-4cb6-b0c6-65f4e68d8b90","source":"wordfence","cve":"CVE-2025-68067","title":"Stockholm Core <= 2.4.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a594ae11-3e8f-4cb6-b0c6-65f4e68d8b90?source=api-prod","affected":[{"type":"plugin","slug":"stockholm-core","name":"Stockholm Core","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-18T00:00:00Z","updated":"2025-12-20T20:27:38Z"},{"id":"wordfence:a595f862-64af-4055-aa13-5e8f4eb3f721","source":"wordfence","cve":"CVE-2021-25102","title":"All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a595f862-64af-4055-aa13-5e8f4eb3f721?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":false,"patched_in":"4.4.11"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a596c9c4-ceb4-470c-8ad5-986cd62da91e","source":"wordfence","cve":"","title":"Ad Inserter < 2.7.11 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a596c9c4-ceb4-470c-8ad5-986cd62da91e?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":false,"patched_in":"2.7.11"}],"published":"2022-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a597d36c-72ce-44f0-af7b-2b9aad46957c","source":"wordfence","cve":"CVE-2022-1574","title":"HTML2WP <= 1.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a597d36c-72ce-44f0-af7b-2b9aad46957c?source=api-prod","affected":[{"type":"plugin","slug":"html2wp","name":"HTML2WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5985318-2ce6-4ecb-a92f-362bc5909bd5","source":"wordfence","cve":"CVE-2022-4242","title":"WP Google Review Slider <= 11.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5985318-2ce6-4ecb-a92f-362bc5909bd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"11.5","to_inclusive":true,"patched_in":"11.6"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5991df2-1aab-4d07-9e30-1257aa9ec884","source":"wordfence","cve":"CVE-2024-22138","title":"Seraphinite Accelerator <= 2.20.47 - Unauthenticated Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5991df2-1aab-4d07-9e30-1257aa9ec884?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.47","to_inclusive":true,"patched_in":"2.20.48"}],"published":"2024-01-08T00:00:00Z","updated":"2024-02-01T23:58:52Z"},{"id":"wordfence:a59ddc3b-5ef8-4438-81be-af7cd49660e8","source":"wordfence","cve":"CVE-2025-64379","title":"Booster for WooCommerce <= 7.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a59ddc3b-5ef8-4438-81be-af7cd49660e8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-17T19:13:33Z"},{"id":"wordfence:a59f7a1b-ae58-4015-bb77-814707579847","source":"wordfence","cve":"CVE-2024-30222","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a59f7a1b-ae58-4015-bb77-814707579847?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"4.0.27"}],"published":"2024-03-26T00:00:00Z","updated":"2024-10-24T19:25:40Z"},{"id":"wordfence:a5a03e67-f36f-441a-a2fd-a545efa06c00","source":"wordfence","cve":"CVE-2021-24969","title":"WordPress Download Manager <= 3.2.21 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a03e67-f36f-441a-a2fd-a545efa06c00?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":false,"patched_in":"3.2.22"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5a1251c-5f70-4432-953a-cad2ee18b98e","source":"wordfence","cve":"CVE-2025-47525","title":"Bold Page Builder <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a1251c-5f70-4432-953a-cad2ee18b98e?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:04:44Z"},{"id":"wordfence:a5a1ccb2-4f78-4855-a01d-b15f73407822","source":"wordfence","cve":"CVE-2026-2356","title":"User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a1ccb2-4f78-4855-a01d-b15f73407822?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-02-25T13:29:35Z","updated":"2026-02-26T02:23:55Z"},{"id":"wordfence:a5a21b3a-a60f-4083-a474-ec9fedd9b8cb","source":"wordfence","cve":"CVE-2024-12165","title":"Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a21b3a-a60f-4083-a474-ec9fedd9b8cb?source=api-prod","affected":[{"type":"plugin","slug":"cf7-mollie","name":"Mollie for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T12:00:09Z","updated":"2024-12-07T01:45:52Z"},{"id":"wordfence:a5a2a74a-6c6b-4a3c-94b8-894c689dbb60","source":"wordfence","cve":"CVE-2026-28036","title":"Ratatouille <= 1.2.6 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a2a74a-6c6b-4a3c-94b8-894c689dbb60?source=api-prod","affected":[{"type":"theme","slug":"ratatouille","name":"Restaurant WordPress Theme | Ratatouille","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:46:08Z"},{"id":"wordfence:a5a34838-fdc5-4954-9576-abf81cbaac2e","source":"wordfence","cve":"","title":"MainWP Child <= 2.0.27 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a34838-fdc5-4954-9576-abf81cbaac2e?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.0.27","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2015-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5a5f8c2-3fd6-4d31-a3b5-60bdb8c18491","source":"wordfence","cve":"CVE-2022-33974","title":"Custom Twitter Feeds (Tweets Widget) <= 1.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a5f8c2-3fd6-4d31-a3b5-60bdb8c18491?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5a739d5-648f-4d79-ac37-335e89127d90","source":"wordfence","cve":"CVE-2017-18015","title":"Share This Image < 1.04 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a739d5-648f-4d79-ac37-335e89127d90?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":false,"patched_in":"1.04"}],"published":"2017-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5a84999-bd1b-4b86-9fa1-09c20b50ce37","source":"wordfence","cve":"CVE-2024-13733","title":"SKT Blocks \u2013 Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a84999-bd1b-4b86-9fa1-09c20b50ce37?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-02-03T20:32:38Z","updated":"2025-02-18T21:09:47Z"},{"id":"wordfence:a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a","source":"wordfence","cve":"CVE-2025-12641","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"6.3.7"}],"published":"2026-01-15T15:56:56Z","updated":"2026-01-16T04:44:35Z"},{"id":"wordfence:a5a93e3f-54c6-4970-96fd-fab0e81f7034","source":"wordfence","cve":"CVE-2025-12389","title":"Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a93e3f-54c6-4970-96fd-fab0e81f7034?source=api-prod","affected":[{"type":"plugin","slug":"import-export-for-woocommerce","name":"Import Export For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T16:00:23Z","updated":"2025-11-04T04:27:21Z"},{"id":"wordfence:a5a9fb50-8ab1-43e3-b618-d92fa50b3e07","source":"wordfence","cve":"CVE-2024-47623","title":"Gallery Lightbox <= 1.0.0.39 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a9fb50-8ab1-43e3-b618-d92fa50b3e07?source=api-prod","affected":[{"type":"plugin","slug":"gallery-lightbox-slider","name":"Gallery Lightbox","from":"*","from_inclusive":true,"to":"1.0.0.39","to_inclusive":true,"patched_in":"1.0.0.41"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:44:36Z"},{"id":"wordfence:a5ad6de2-b14e-4aaf-855f-f71c324edd68","source":"wordfence","cve":"CVE-2024-50528","title":"Stacks Mobile App Builder <= 5.2.3 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ad6de2-b14e-4aaf-855f-f71c324edd68?source=api-prod","affected":[{"type":"plugin","slug":"stacks-mobile-app-builder","name":"Stacks Mobile App Builder \u2013 The most powerful Mobile Applications Drag and Drop builder","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T20:43:04Z"},{"id":"wordfence:a5b05e9e-c9d2-4107-9575-a04ed9287c06","source":"wordfence","cve":"CVE-2026-88800","title":"MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5b05e9e-c9d2-4107-9575-a04ed9287c06?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:32:34Z"},{"id":"wordfence:a5b247a7-50f4-4d35-b24a-2c788ba0b051","source":"wordfence","cve":"CVE-2024-13735","title":"HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5b247a7-50f4-4d35-b24a-2c788ba0b051?source=api-prod","affected":[{"type":"plugin","slug":"hurrytimer","name":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2025-02-13T21:00:19Z","updated":"2025-02-14T09:21:32Z"},{"id":"wordfence:a5b6a66f-06fc-4b89-9f2e-9830664910f8","source":"wordfence","cve":"CVE-2026-24943","title":"Grand Conference <= 5.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5b6a66f-06fc-4b89-9f2e-9830664910f8?source=api-prod","affected":[{"type":"theme","slug":"grandconference","name":"Grand Conference | Event WordPress","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:43:07Z"},{"id":"wordfence:a5b7538f-891a-423f-97d1-b0212efcdb98","source":"wordfence","cve":"CVE-2020-35950","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.152 - Cross-Site Request Forgery","severity":"critical","cvss":9.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5b7538f-891a-423f-97d1-b0212efcdb98?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"4.2.153","to_inclusive":false,"patched_in":"4.2.153"}],"published":"2020-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5ba7b53-5af7-4250-a0ec-e26672300683","source":"wordfence","cve":"CVE-2024-51912","title":"IntelliWidget Elements <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ba7b53-5af7-4250-a0ec-e26672300683?source=api-prod","affected":[{"type":"plugin","slug":"intelliwidget-elements","name":"IntelliWidget Elements","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:34:46Z"},{"id":"wordfence:a5ba9285-9f41-44dd-83c7-e9c377d9de51","source":"wordfence","cve":"","title":"WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ba9285-9f41-44dd-83c7-e9c377d9de51?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2019-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5bb8804-0b90-44c3-bf74-bbc6b4baf229","source":"wordfence","cve":"CVE-2012-2371","title":"WP-FaceThumb < 0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5bb8804-0b90-44c3-bf74-bbc6b4baf229?source=api-prod","affected":[{"type":"plugin","slug":"wp-facethumb","name":"WP-FaceThumb","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"0.2"}],"published":"2012-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5bc4cad-d227-47f8-a739-d64410f8c05e","source":"wordfence","cve":"CVE-2026-62137","title":"bbPress <= 2.6.14 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5bc4cad-d227-47f8-a739-d64410f8c05e?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.14","to_inclusive":true,"patched_in":"2.6.15"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:04:13Z"},{"id":"wordfence:a5bc6097-d6ed-4598-b3c8-9159d5ce04ee","source":"wordfence","cve":"","title":"WP Custom Admin Interface <= 7.32 - Cross-Site Request Forgery to Transients Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5bc6097-d6ed-4598-b3c8-9159d5ce04ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.33","to_inclusive":false,"patched_in":"7.33"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5bcf040-cc43-4b3d-a6fc-d41973725af6","source":"wordfence","cve":"","title":"WordPress Bitcoin Payments \u2013 Blockonomics <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5bcf040-cc43-4b3d-a6fc-d41973725af6?source=api-prod","affected":[{"type":"plugin","slug":"blockonomics-bitcoin-payments","name":"Bitcoin Payments \u2013 Blockonomics","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5bcf456-f991-4775-8c3e-a3c0212a5765","source":"wordfence","cve":"CVE-2020-36717","title":"Kali Forms <= 2.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5bcf456-f991-4775-8c3e-a3c0212a5765?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2020-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5be103f-e174-47f9-8a1b-bb0d073c54e4","source":"wordfence","cve":"CVE-2024-32772","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5be103f-e174-47f9-8a1b-bb0d073c54e4?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T13:55:13Z"},{"id":"wordfence:a5c0ae44-18e5-4fd1-a1a8-b70fc15a8c26","source":"wordfence","cve":"CVE-2021-24597","title":"\u6709\u8d4f You Shang <= 1.0.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c0ae44-18e5-4fd1-a1a8-b70fc15a8c26?source=api-prod","affected":[{"type":"plugin","slug":"you-shang","name":"\u6709\u8d4f You Shang","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5c290a1-b58a-4b5c-8112-076d5b17d940","source":"wordfence","cve":"CVE-2007-4894","title":"WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c290a1-b58a-4b5c-8112-076d5b17d940?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2007-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5c7a019-953f-441e-b4d5-26f406f9853d","source":"wordfence","cve":"","title":"aDirectory \u2013 WordPress Directory Listing Plugin <= 1.6.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c7a019-953f-441e-b4d5-26f406f9853d?source=api-prod","affected":[{"type":"plugin","slug":"adirectory","name":"aDirectory \u2013 WP Business Directory Plugin and Classified Ads Listings Directory","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-20T16:24:24Z"},{"id":"wordfence:a5c83c1a-fe16-410a-9418-ac2a3a9d6017","source":"wordfence","cve":"CVE-2026-77794","title":"RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c83c1a-fe16-410a-9418-ac2a3a9d6017?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.8","to_inclusive":true,"patched_in":"6.0.9.9"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T16:01:51Z"},{"id":"wordfence:a5c8d361-698b-4abd-bcdd-0361d3fd10c5","source":"wordfence","cve":"CVE-2024-5149","title":"BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness","severity":"medium","cvss":6.5,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5c8d361-698b-4abd-bcdd-0361d3fd10c5?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":true,"patched_in":"2.8.10"}],"published":"2024-06-04T00:00:00Z","updated":"2024-07-01T14:56:17Z"},{"id":"wordfence:a5cb1fea-134f-4c81-8f2f-76ee42df7f77","source":"wordfence","cve":"CVE-2026-1083","title":"Appointment Hour Booking \u2013 Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5cb1fea-134f-4c81-8f2f-76ee42df7f77?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.60","to_inclusive":true,"patched_in":"1.5.61"}],"published":"2026-01-27T17:18:41Z","updated":"2026-01-28T05:30:19Z"},{"id":"wordfence:a5cb5ab0-2110-49be-bc09-6847065a9dd9","source":"wordfence","cve":"CVE-2025-2799","title":"WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5cb5ab0-2110-49be-bc09-6847065a9dd9?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.49","to_inclusive":true,"patched_in":"3.1.50"}],"published":"2025-06-10T00:00:00Z","updated":"2025-07-16T05:23:53Z"},{"id":"wordfence:a5d19abc-4a11-4845-b41b-a7169983ca7d","source":"wordfence","cve":"CVE-2025-62120","title":"OpenHook <= 4.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5d19abc-4a11-4845-b41b-a7169983ca7d?source=api-prod","affected":[{"type":"plugin","slug":"thesis-openhook","name":"OpenHook","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:26:43Z"},{"id":"wordfence:a5d421d0-4658-4203-8c74-2eb744ea34be","source":"wordfence","cve":"CVE-2026-104728","title":"AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5d421d0-4658-4203-8c74-2eb744ea34be?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"5.8.5"}],"published":"2026-10-09T19:31:43Z","updated":"2026-10-10T07:41:46Z"},{"id":"wordfence:a5d495c0-9b06-4de8-b673-b2552780d5d1","source":"wordfence","cve":"CVE-2025-54709","title":"Sala <= 1.1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5d495c0-9b06-4de8-b673-b2552780d5d1?source=api-prod","affected":[{"type":"theme","slug":"sala","name":"Sala - Startup & SaaS WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:20:12Z"},{"id":"wordfence:a5da021c-3835-4251-a3e5-3b5aaa11ea14","source":"wordfence","cve":"CVE-2024-0700","title":"Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5da021c-3835-4251-a3e5-3b5aaa11ea14?source=api-prod","affected":[{"type":"plugin","slug":"simple-tweet","name":"Simple Tweet","from":"*","from_inclusive":true,"to":"1.4.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:03Z"},{"id":"wordfence:a5da47f6-4cfe-480e-9472-bd5efc8bac71","source":"wordfence","cve":"CVE-2024-11460","title":"Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5da47f6-4cfe-480e-9472-bd5efc8bac71?source=api-prod","affected":[{"type":"plugin","slug":"verowa-connect","name":"Verowa Connect","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-12-05T21:14:54Z","updated":"2024-12-06T09:23:00Z"},{"id":"wordfence:a5da4de0-249f-4983-9263-85c0ef731765","source":"wordfence","cve":"CVE-2026-28013","title":"Kratz <= 1.0.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5da4de0-249f-4983-9263-85c0ef731765?source=api-prod","affected":[{"type":"theme","slug":"kratz","name":"Kratz","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:58:03Z"},{"id":"wordfence:a5dbb126-e8a1-42d0-9a05-c2e5d5da4ee1","source":"wordfence","cve":"CVE-2025-22589","title":"Quote Tweet <= 0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5dbb126-e8a1-42d0-9a05-c2e5d5da4ee1?source=api-prod","affected":[{"type":"plugin","slug":"quote-tweet","name":"Quote Tweet","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:24:07Z"},{"id":"wordfence:a5dbcc22-ab2e-4114-a7d7-bac01a5c5b3f","source":"wordfence","cve":"CVE-2023-24391","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5dbcc22-ab2e-4114-a7d7-bac01a5c5b3f?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2023-06-26T00:00:00Z","updated":"2025-02-11T16:23:27Z"},{"id":"wordfence:a5dd354f-080f-4be9-837e-eed48037f140","source":"wordfence","cve":"CVE-2025-9889","title":"ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5dd354f-080f-4be9-837e-eed48037f140?source=api-prod","affected":[{"type":"plugin","slug":"contentmx-content-publisher","name":"ContentMX Content Publisher","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-10-02T22:17:44Z","updated":"2025-10-14T19:16:18Z"},{"id":"wordfence:a5de7f19-ecf8-4eb5-b048-9050edb7a27a","source":"wordfence","cve":"CVE-2025-31559","title":"Custom Database Applications by Caspio <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5de7f19-ecf8-4eb5-b048-9050edb7a27a?source=api-prod","affected":[{"type":"plugin","slug":"custom-database-applications-by-caspio","name":"Custom Database Applications by Caspio","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:16:01Z"},{"id":"wordfence:a5deac61-031f-452a-a478-d5d0c7953817","source":"wordfence","cve":"CVE-2023-33207","title":"Stop Referrer Spam <= 1.3.0 - Cross-Site Request Forgery via processParameters","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5deac61-031f-452a-a478-d5d0c7953817?source=api-prod","affected":[{"type":"plugin","slug":"stop-referrer-spam","name":"Stop Referrer Spam","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5df5298-21a2-4dbc-b5d5-d7871d77d19e","source":"wordfence","cve":"CVE-2026-52711","title":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce <= 1.8.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5df5298-21a2-4dbc-b5d5-d7871d77d19e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pos","name":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T15:46:44Z"},{"id":"wordfence:a5e0acda-b76e-4290-8546-5da7e7758968","source":"wordfence","cve":"CVE-2025-30939","title":"IFrame Widget <= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e0acda-b76e-4290-8546-5da7e7758968?source=api-prod","affected":[{"type":"plugin","slug":"iframe-widget","name":"IFrame Widget","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:00:37Z"},{"id":"wordfence:a5e14205-d31d-414b-aff2-22f589dbf04c","source":"wordfence","cve":"CVE-2021-38318","title":"3D Cover Carousel <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e14205-d31d-414b-aff2-22f589dbf04c?source=api-prod","affected":[{"type":"plugin","slug":"3d-cover-carousel","name":"3D Cover Carousel","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T20:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5e45e96-3cfb-42a9-b8b7-519489bc03ad","source":"wordfence","cve":"CVE-2014-1907","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Arbitrary File Read/Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e45e96-3cfb-42a9-b8b7-519489bc03ad?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.29.5","to_inclusive":false,"patched_in":"4.29.5"}],"published":"2014-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5e4f40b-c028-4283-ba02-c77408136713","source":"wordfence","cve":"CVE-2024-8871","title":"Pricing Tables WordPress Plugin \u2013 Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e4f40b-c028-4283-ba02-c77408136713?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-10-29T16:31:31Z","updated":"2024-10-30T05:32:15Z"},{"id":"wordfence:a5e6817c-02e7-4d28-9446-c316a9ff8cbe","source":"wordfence","cve":"CVE-2016-10920","title":"GNUCommerce < 0.5.7-BETA - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e6817c-02e7-4d28-9446-c316a9ff8cbe?source=api-prod","affected":[{"type":"plugin","slug":"gnucommerce","name":"GNUCommerce","from":"*","from_inclusive":true,"to":"0.5.7-beta","to_inclusive":false,"patched_in":"0.5.7-beta"}],"published":"2016-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5e6b508-35ef-45da-bf17-c038d3b7ce52","source":"wordfence","cve":"CVE-2023-50832","title":"Multi Step Form <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e6b508-35ef-45da-bf17-c038d3b7ce52?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.16","to_inclusive":true,"patched_in":"1.7.17"}],"published":"2023-12-19T00:00:00Z","updated":"2024-02-08T17:13:04Z"},{"id":"wordfence:a5e7a994-c489-4aea-a9bb-898bc92cae4e","source":"wordfence","cve":"CVE-2024-1362","title":"Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e7a994-c489-4aea-a9bb-898bc92cae4e?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.253","to_inclusive":true,"patched_in":"1.0.260"}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T11:03:46Z"},{"id":"wordfence:a5e803ed-6dfb-4845-8efe-addaea89029f","source":"wordfence","cve":"CVE-2025-24658","title":"Auction Nudge \u2013 Your eBay on Your Site <= 7.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e803ed-6dfb-4845-8efe-addaea89029f?source=api-prod","affected":[{"type":"plugin","slug":"auction-nudge","name":"Auction Nudge \u2013 Your eBay Listings","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:28:47Z"},{"id":"wordfence:a5e9cfd3-8066-4d75-8bb3-151815850870","source":"wordfence","cve":"CVE-2025-57905","title":"AgreeMe Checkboxes For WooCommerce <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e9cfd3-8066-4d75-8bb3-151815850870?source=api-prod","affected":[{"type":"plugin","slug":"agreeme-checkboxes-for-woocommerce","name":"AgreeMe Checkboxes For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:10:36Z"},{"id":"wordfence:a5ed3612-68c8-49a9-915d-c54e002506a4","source":"wordfence","cve":"CVE-2026-94377","title":"Verified Reviews (Avis V\u00e9rifi\u00e9s) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ed3612-68c8-49a9-915d-c54e002506a4?source=api-prod","affected":[{"type":"plugin","slug":"netreviews","name":"Verified Reviews (Avis V\u00e9rifi\u00e9s)","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:34:38Z","updated":"2026-10-14T03:40:02Z"},{"id":"wordfence:a5ef4d74-aa5d-4d6d-af2c-bda506fb394d","source":"wordfence","cve":"CVE-2008-2146","title":"WordPress Core < 2.2.3 - Restriction Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5ef4d74-aa5d-4d6d-af2c-bda506fb394d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2007-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5f0cb99-99e1-4c10-9d06-0c10df5f2581","source":"wordfence","cve":"CVE-2025-58028","title":"Designil PDPA Thailand <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f0cb99-99e1-4c10-9d06-0c10df5f2581?source=api-prod","affected":[{"type":"plugin","slug":"pdpa-thailand","name":"Designil PDPA Thailand","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-05-26T18:17:27Z"},{"id":"wordfence:a5f24902-1336-4fcd-b42d-e29526e61b71","source":"wordfence","cve":"CVE-2016-20073","title":"Answer My Question <= 1.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f24902-1336-4fcd-b42d-e29526e61b71?source=api-prod","affected":[{"type":"plugin","slug":"answer-my-question","name":"Answer My Question","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2016-11-11T00:00:00Z","updated":"2026-07-29T16:37:53Z"},{"id":"wordfence:a5f29f35-da79-4389-a0a5-a1be0b0b8996","source":"wordfence","cve":"CVE-2023-1602","title":"Short URL <=  1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f29f35-da79-4389-a0a5-a1be0b0b8996?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"1.6.4","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a5f3fbd2-6152-4a89-8fe9-982120d1a640","source":"wordfence","cve":"CVE-2025-11723","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f3fbd2-6152-4a89-8fe9-982120d1a640?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.5","to_inclusive":true,"patched_in":"1.6.9.6"}],"published":"2026-01-05T15:10:45Z","updated":"2026-01-06T03:21:38Z"},{"id":"wordfence:a5f4ed55-4e6c-48a3-acea-909e5a9d1a06","source":"wordfence","cve":"CVE-2024-43988","title":"Mystique <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f4ed55-4e6c-48a3-acea-909e5a9d1a06?source=api-prod","affected":[{"type":"theme","slug":"mystique","name":"Mystique","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:30:19Z"},{"id":"wordfence:a5f847d8-323f-47f9-ba10-df8173ff3018","source":"wordfence","cve":"CVE-2024-6931","title":"The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f847d8-323f-47f9-ba10-df8173ff3018?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"6.6.4"}],"published":"2024-07-23T19:02:11Z","updated":"2024-09-27T08:49:21Z"},{"id":"wordfence:a5f8fb20-7465-403e-af3a-4063bf5bc6ae","source":"wordfence","cve":"CVE-2025-30852","title":"Oracle Cards Lite <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5f8fb20-7465-403e-af3a-4063bf5bc6ae?source=api-prod","affected":[{"type":"plugin","slug":"oracle-cards","name":"Oracle Cards Lite \u2013 Interactive Card Deck Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:00:53Z"},{"id":"wordfence:a5fb289e-bd38-42ea-86a4-7816b59bd0b2","source":"wordfence","cve":"CVE-2024-2254","title":"RT Easy Builder \u2013 Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a5fb289e-bd38-42ea-86a4-7816b59bd0b2?source=api-prod","affected":[{"type":"plugin","slug":"rt-easy-builder-advanced-addons-for-elementor","name":"RT Easy Builder \u2013 Advanced addons for Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-23T14:07:07Z","updated":"2024-09-24T14:11:52Z"},{"id":"wordfence:a600f164-7255-4590-8239-2d3e0b445e79","source":"wordfence","cve":"CVE-2023-44266","title":"WP Adminify <= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a600f164-7255-4590-8239-2d3e0b445e79?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a601d0de-2f09-4f5c-8937-dfa20f1c64ec","source":"wordfence","cve":"CVE-2025-6717","title":"B1.lt for WooCommerce <= 2.2.56 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a601d0de-2f09-4f5c-8937-dfa20f1c64ec?source=api-prod","affected":[{"type":"plugin","slug":"b1-accounting","name":"Site.pro for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.56","to_inclusive":true,"patched_in":"2.2.57"}],"published":"2025-07-17T16:36:36Z","updated":"2025-11-05T21:45:03Z"},{"id":"wordfence:a604df5d-92b3-4df8-a7ef-00f0ee95cf0f","source":"wordfence","cve":"CVE-2023-3199","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a604df5d-92b3-4df8-a7ef-00f0ee95cf0f?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6072f47-91b3-4c5d-b16e-61bcd7760604","source":"wordfence","cve":"CVE-2021-24185","title":"Tutor LMS \u2013 eLearning and online course solution <=1.7.6 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6072f47-91b3-4c5d-b16e-61bcd7760604?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6074c97-619d-4f47-97c7-781c7a38019d","source":"wordfence","cve":"CVE-2007-1622","title":"WordPress Core <= 2.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6074c97-619d-4f47-97c7-781c7a38019d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.1","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6090c3d-e4ee-4c9d-9605-e18000f283c5","source":"wordfence","cve":"CVE-2024-37484","title":"Zephyr Project Manager <= 3.3.97 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6090c3d-e4ee-4c9d-9605-e18000f283c5?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.97","to_inclusive":true,"patched_in":"3.3.99"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:29:27Z"},{"id":"wordfence:a6096b9a-f7bb-454a-8203-50ac99d37100","source":"wordfence","cve":"CVE-2022-3898","title":"WP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6096b9a-f7bb-454a-8203-50ac99d37100?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2022-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a609f18a-eb53-46bb-a3a0-dd9f94a468b5","source":"wordfence","cve":"CVE-2026-84734","title":"Mindstien Quick Login <= 1.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a609f18a-eb53-46bb-a3a0-dd9f94a468b5?source=api-prod","affected":[{"type":"plugin","slug":"mindstien-quick-login","name":"Mindstien Quick Login","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:21:32Z"},{"id":"wordfence:a60a9981-c945-4438-a844-f7942b86c4c0","source":"wordfence","cve":"CVE-2023-31095","title":"Integration for Contact Form 7 HubSpot <= 1.2.8 - Open Redirect via state parameter","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a60a9981-c945-4438-a844-f7942b86c4c0?source=api-prod","affected":[{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a60a9c14-d14e-469a-9cc5-681ca25db37c","source":"wordfence","cve":"CVE-2024-52372","title":"Easy CSV Importer BETA <= 7.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a60a9c14-d14e-469a-9cc5-681ca25db37c?source=api-prod","affected":[{"type":"plugin","slug":"easy-csv-importer","name":"Easy CSV Importer BETA","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:42:16Z"},{"id":"wordfence:a60bb585-3c71-4381-8ba7-28ee63abdb14","source":"wordfence","cve":"CVE-2012-20004","title":"Knews Multilingual Newsletters <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a60bb585-3c71-4381-8ba7-28ee63abdb14?source=api-prod","affected":[{"type":"plugin","slug":"knews","name":"Knews Multilingual Newsletters","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2018-04-13T00:00:00Z","updated":"2026-10-28T14:49:47Z"},{"id":"wordfence:a60d8102-1f15-4e61-b715-81e2111651a4","source":"wordfence","cve":"","title":"Add Link to Facebook <= 1.215 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a60d8102-1f15-4e61-b715-81e2111651a4?source=api-prod","affected":[{"type":"plugin","slug":"add-link-to-facebook","name":"Add Link to Facebook","from":"*","from_inclusive":true,"to":"1.216","to_inclusive":false,"patched_in":"1.216"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a61335cb-024d-4f58-8e58-c5b2064d8b51","source":"wordfence","cve":"CVE-2026-32413","title":"Permalink Manager Lite < 2.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61335cb-024d-4f58-8e58-c5b2064d8b51?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":false,"patched_in":"2.5.3"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:15:18Z"},{"id":"wordfence:a616cee1-2aee-40bb-ab79-3bebb3438582","source":"wordfence","cve":"CVE-2025-69045","title":"FooEvents for WooCommerce <= 1.20.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a616cee1-2aee-40bb-ab79-3bebb3438582?source=api-prod","affected":[{"type":"plugin","slug":"fooevents","name":"FooEvents for WooCommerce","from":"*","from_inclusive":true,"to":"1.20.4","to_inclusive":true,"patched_in":"1.20.5"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:27:05Z"},{"id":"wordfence:a6196b07-a2fc-45ac-8700-a1ce2713a960","source":"wordfence","cve":"CVE-2013-2011","title":"WP Super Cache < 1.3.2 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6196b07-a2fc-45ac-8700-a1ce2713a960?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a61a8d8b-f22f-4a16-95f6-6cf52cf545ad","source":"wordfence","cve":"CVE-2024-0597","title":"SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61a8d8b-f22f-4a16-95f6-6cf52cf545ad?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.3.15","to_inclusive":true,"patched_in":"12.3.16"}],"published":"2024-01-29T00:00:00Z","updated":"2024-07-29T21:37:03Z"},{"id":"wordfence:a61b2ecc-d4e1-4e71-9187-ddc3d3616a29","source":"wordfence","cve":"CVE-2026-12793","title":"JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.2.1"}],"published":"2026-09-15T15:08:34Z","updated":"2026-09-16T03:28:21Z"},{"id":"wordfence:a61bfa95-96bc-45b8-a7b3-d356a5423097","source":"wordfence","cve":"CVE-2025-22660","title":"Include Mastodon Feed <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61bfa95-96bc-45b8-a7b3-d356a5423097?source=api-prod","affected":[{"type":"plugin","slug":"include-mastodon-feed","name":"Include Mastodon Feed","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.10"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:21:15Z"},{"id":"wordfence:a61c5999-6e7f-4ff9-8ed9-e3e2df9ceb6b","source":"wordfence","cve":"CVE-2025-24591","title":"GDPR CCPA Compliance Support <= 2.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61c5999-6e7f-4ff9-8ed9-e3e2df9ceb6b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-gdpr-compliance","name":"GDPR CCPA Compliance & Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:34:24Z"},{"id":"wordfence:a61cce43-0df7-4ca9-8897-24c7d131b505","source":"wordfence","cve":"CVE-2025-3811","title":"WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61cce43-0df7-4ca9-8897-24c7d131b505?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T01:42:35Z"},{"id":"wordfence:a61d8d2a-742f-45f1-9146-f733b80ef195","source":"wordfence","cve":"CVE-2026-0702","title":"VidShop \u2013 Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a61d8d2a-742f-45f1-9146-f733b80ef195?source=api-prod","affected":[{"type":"plugin","slug":"vidshop-for-woocommerce","name":"VidShop \u2013 Shoppable Videos for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T08:26:56Z"},{"id":"wordfence:a6202c51-c976-4e32-8846-43ac1aae9331","source":"wordfence","cve":"CVE-2024-4924","title":"Sassy Social Share <= 3.3.62 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6202c51-c976-4e32-8846-43ac1aae9331?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.62","to_inclusive":true,"patched_in":"3.3.63"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-24T11:53:56Z"},{"id":"wordfence:a620810d-1b2a-4f2e-943c-aacc493f0c5b","source":"wordfence","cve":"","title":"Event Easy Calendar <= 1.0.0 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a620810d-1b2a-4f2e-943c-aacc493f0c5b?source=api-prod","affected":[{"type":"plugin","slug":"event-easy-calendar","name":"Event Easy Calendar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6213e09-8a97-44cf-85ef-83179d79206c","source":"wordfence","cve":"","title":"LeagueManager < 4.0.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6213e09-8a97-44cf-85ef-83179d79206c?source=api-prod","affected":[{"type":"plugin","slug":"leaguemanager","name":"LeagueManager","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"}],"published":"2015-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a62186aa-19aa-445b-8fdc-b029bdafd58f","source":"wordfence","cve":"CVE-2026-8420","title":"BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a62186aa-19aa-445b-8fdc-b029bdafd58f?source=api-prod","affected":[{"type":"plugin","slug":"blogchat-chat-system","name":"BLOGCHAT Chat System","from":"*","from_inclusive":true,"to":"1.3.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:06:51Z","updated":"2026-05-20T01:25:51Z"},{"id":"wordfence:a621cd24-d012-40f0-bfac-29268751f772","source":"wordfence","cve":"CVE-2024-6888","title":"Secure Copy Content Protection and Content Locking <= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a621cd24-d012-40f0-bfac-29268751f772?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2024-08-13T00:00:00Z","updated":"2024-09-12T14:40:30Z"},{"id":"wordfence:a6240290-4b6c-46ba-9f78-e6bba3504f17","source":"wordfence","cve":"CVE-2023-31220","title":"WP Categories Widget <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6240290-4b6c-46ba-9f78-e6bba3504f17?source=api-prod","affected":[{"type":"plugin","slug":"wp-categories-widget","name":"WP Categories Widget","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6258be3-2f9e-476d-84d5-5014818ef3ab","source":"wordfence","cve":"CVE-2026-25397","title":"File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6258be3-2f9e-476d-84d5-5014818ef3ab?source=api-prod","affected":[{"type":"plugin","slug":"file-uploader-for-woocommerce","name":"File Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:10:08Z"},{"id":"wordfence:a6264dbb-81a9-43fe-908d-86e532d4b848","source":"wordfence","cve":"CVE-2025-24621","title":"Arconix Shortcodes <= 2.1.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6264dbb-81a9-43fe-908d-86e532d4b848?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2024-12-30T00:00:00Z","updated":"2025-04-22T21:44:47Z"},{"id":"wordfence:a626dfd4-d8c3-4cd1-a624-bae719bea93a","source":"wordfence","cve":"","title":"Music Player for WooCommerce <= 1.0.172 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a626dfd4-d8c3-4cd1-a624-bae719bea93a?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-woocommerce","name":"Music Player for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.172","to_inclusive":true,"patched_in":"1.0.173"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a627f10a-1463-4e4b-98a9-2008fa76e25a","source":"wordfence","cve":"CVE-2023-7194","title":"Meris <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a627f10a-1463-4e4b-98a9-2008fa76e25a?source=api-prod","affected":[{"type":"theme","slug":"meris","name":"Meris","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6298192-2afa-4468-86d5-8487321a0ff6","source":"wordfence","cve":"CVE-2022-29489","title":"Sucuri Security <= 1.8.33 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6298192-2afa-4468-86d5-8487321a0ff6?source=api-prod","affected":[{"type":"plugin","slug":"sucuri-scanner","name":"Sucuri Security \u2013 Auditing, Malware Scanner and Security Hardening","from":"*","from_inclusive":true,"to":"1.8.33","to_inclusive":true,"patched_in":"1.8.34"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a62a3a71-0dbb-48d6-ba1a-f218fefac871","source":"wordfence","cve":"CVE-2021-24793","title":"WPeMatico RSS Feed Fetcher <= 2.6.11 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a62a3a71-0dbb-48d6-ba1a-f218fefac871?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":false,"patched_in":"2.6.12"}],"published":"2021-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a62abdcb-d9a1-444e-90eb-aadeda4e94f9","source":"wordfence","cve":"CVE-2026-78530","title":"FoodBakery <= 4.6 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a62abdcb-d9a1-444e-90eb-aadeda4e94f9?source=api-prod","affected":[{"type":"theme","slug":"foodbakery","name":"FoodBakery | Food Delivery Single & Multiple Restaurant Template","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:18:03Z"},{"id":"wordfence:a62df5f6-64b0-4489-9dde-0d472040ee12","source":"wordfence","cve":"CVE-2024-10544","title":"Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a62df5f6-64b0-4489-9dde-0d472040ee12?source=api-prod","affected":[{"type":"plugin","slug":"woo-manage-fraud-orders","name":"Woo Manage Fraud Orders","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-14T17:22:47Z"},{"id":"wordfence:a62e499d-6520-4bad-963a-ff7619daa5f8","source":"wordfence","cve":"CVE-2026-109592","title":"OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a62e499d-6520-4bad-963a-ff7619daa5f8?source=api-prod","affected":[{"type":"plugin","slug":"desktop-mode","name":"OpenStation \u2013 Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2026-10-30T14:45:40Z","updated":"2026-10-30T17:15:30Z"},{"id":"wordfence:a63023e4-56f7-4652-aa04-dc27033dbfd6","source":"wordfence","cve":"CVE-2026-114702","title":"ND Shortcodes <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63023e4-56f7-4652-aa04-dc27033dbfd6?source=api-prod","affected":[{"type":"plugin","slug":"nd-shortcodes","name":"ND Shortcodes","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-22T08:58:00Z","updated":"2026-10-23T18:41:08Z"},{"id":"wordfence:a6320203-2ee8-4316-96bc-0a8e1dd6b66a","source":"wordfence","cve":"CVE-2024-10518","title":"ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via \"Product Files\"","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6320203-2ee8-4316-96bc-0a8e1dd6b66a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.14","to_inclusive":true,"patched_in":"4.15.15"}],"published":"2024-11-21T00:00:00Z","updated":"2024-12-12T16:50:01Z"},{"id":"wordfence:a636adc6-c358-4199-bb56-c5e30d2bba5e","source":"wordfence","cve":"CVE-2026-103344","title":"Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a636adc6-c358-4199-bb56-c5e30d2bba5e?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-10-02T07:16:56Z","updated":"2026-10-08T23:19:07Z"},{"id":"wordfence:a636bc83-e41f-4620-a0f2-1de17ab64f52","source":"wordfence","cve":"CVE-2025-23483","title":"Universal Analytics Injector <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a636bc83-e41f-4620-a0f2-1de17ab64f52?source=api-prod","affected":[{"type":"plugin","slug":"universal-analytics-injector","name":"Universal Analytics Injector","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:47:22Z"},{"id":"wordfence:a636e865-9556-4afb-8726-4537a160f379","source":"wordfence","cve":"CVE-2025-10742","title":"Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a636e865-9556-4afb-8726-4537a160f379?source=api-prod","affected":[{"type":"plugin","slug":"truelysell-core","name":"Truelysell Core","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-10-15T17:59:00Z","updated":"2025-11-25T05:42:55Z"},{"id":"wordfence:a6381d4c-1cb6-42b6-bda3-7656400deae9","source":"wordfence","cve":"CVE-2025-24617","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6381d4c-1cb6-42b6-bda3-7656400deae9?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"9.11.0","to_inclusive":true,"patched_in":"9.11.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-02-20T16:33:05Z"},{"id":"wordfence:a6382ebd-f836-4f39-8113-1475163d6b81","source":"wordfence","cve":"CVE-2026-39700","title":"WowOptin <= 1.4.37 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6382ebd-f836-4f39-8113-1475163d6b81?source=api-prod","affected":[{"type":"plugin","slug":"optin","name":"WowOptin: Next-Gen Popup Maker \u2013 Create Stunning Popups and Optins for Lead Generation","from":"*","from_inclusive":true,"to":"1.4.37","to_inclusive":true,"patched_in":"1.4.38"}],"published":"2026-03-01T00:00:00Z","updated":"2026-06-08T16:14:11Z"},{"id":"wordfence:a63a41d1-b9b0-43a9-a6e0-761f3b8d9d4a","source":"wordfence","cve":"CVE-2024-13525","title":"Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63a41d1-b9b0-43a9-a6e0-761f3b8d9d4a?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-02-14T20:00:38Z","updated":"2025-02-15T08:25:06Z"},{"id":"wordfence:a63b2091-1502-4d9f-98c4-ce9d2f923dc4","source":"wordfence","cve":"CVE-2024-1951","title":"Logo Showcase Ultimate \u2013 Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63b2091-1502-4d9f-98c4-ce9d2f923dc4?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-ultimate","name":"Logo Showcase Ultimate \u2013 Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-03-05T00:00:00Z","updated":"2024-07-31T15:37:41Z"},{"id":"wordfence:a63bf106-78cf-441b-a1b3-77ec1cf6c22b","source":"wordfence","cve":"CVE-2025-13704","title":"Autogen Headers Menu <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63bf106-78cf-441b-a1b3-77ec1cf6c22b?source=api-prod","affected":[{"type":"plugin","slug":"autogen-headers-menu","name":"Autogen Headers Menu","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:56:23Z","updated":"2026-01-09T11:15:34Z"},{"id":"wordfence:a63d6a64-aaba-4744-a372-89e1c0ce00df","source":"wordfence","cve":"CVE-2024-47357","title":"Happy Addons for Elementor <= 3.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63d6a64-aaba-4744-a372-89e1c0ce00df?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:45:12Z"},{"id":"wordfence:a63f0b4b-ad8f-4daf-9450-133bf08c2de1","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Sensitive Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a63f0b4b-ad8f-4daf-9450-133bf08c2de1?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6407792-2c76-4149-a9f9-d53002135bec","source":"wordfence","cve":"CVE-2023-5250","title":"Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6407792-2c76-4149-a9f9-d53002135bec?source=api-prod","affected":[{"type":"plugin","slug":"grid-plus","name":"Grid Plus \u2013 Unlimited grid layout","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a641fdd8-27d9-41e1-bc41-372dda4b2cf5","source":"wordfence","cve":"CVE-2024-3635","title":"The Post Grid <= 7.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a641fdd8-27d9-41e1-bc41-372dda4b2cf5?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.4.3","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2024-09-09T00:00:00Z","updated":"2024-10-03T20:24:22Z"},{"id":"wordfence:a6425d39-cc8b-4130-8f67-2d6de7954934","source":"wordfence","cve":"CVE-2023-50903","title":"Metform Elementor Contact Form Builder <= 3.4.0 - Missing Authorization via submit","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6425d39-cc8b-4130-8f67-2d6de7954934?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a644ac90-6cc4-495c-b880-4ebbc237bb57","source":"wordfence","cve":"","title":"Chocolate WP \u2013 Responsive Photography Theme (All Versions) - Denial of Service and Abuse of Functionality","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a644ac90-6cc4-495c-b880-4ebbc237bb57?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a646a582-7174-4172-a193-c1606c43e6a5","source":"wordfence","cve":"","title":"Responsive Poll < 1.7.6 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a646a582-7174-4172-a193-c1606c43e6a5?source=api-prod","affected":[{"type":"plugin","slug":"responsive-poll","name":"Responsive Poll","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2017-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a646da21-9ccb-427b-9d06-7d295c8b5d18","source":"wordfence","cve":"CVE-2025-23819","title":"WP Cloud <= 1.4.3 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a646da21-9ccb-427b-9d06-7d295c8b5d18?source=api-prod","affected":[{"type":"plugin","slug":"cloud","name":"WP Cloud","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:53:01Z"},{"id":"wordfence:a646ebe5-3445-4e9b-99a9-23761d4fba9c","source":"wordfence","cve":"","title":"Comment Fields <= 1.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a646ebe5-3445-4e9b-99a9-23761d4fba9c?source=api-prod","affected":[{"type":"plugin","slug":"modify-comment-fields","name":"Comment Fields [Modify/Disable/Remove]","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a647f60b-233d-46f2-8837-b7c9bacd9958","source":"wordfence","cve":"CVE-2024-37233","title":"Play.ht <= 3.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a647f60b-233d-46f2-8837-b7c9bacd9958?source=api-prod","affected":[{"type":"plugin","slug":"play-ht","name":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:32:45Z"},{"id":"wordfence:a6484a7c-449d-40ea-a5aa-ca033ee0ba95","source":"wordfence","cve":"CVE-2024-37418","title":"Church Admin <=  4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6484a7c-449d-40ea-a5aa-ca033ee0ba95?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:29:17Z"},{"id":"wordfence:a649fbea-65cf-45c9-b853-2733f27518af","source":"wordfence","cve":"CVE-2024-0903","title":"User Feedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a649fbea-65cf-45c9-b853-2733f27518af?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2024-02-21T00:00:00Z","updated":"2024-02-22T05:32:50Z"},{"id":"wordfence:a64c67de-1c16-4dcb-a3e4-81341b37c3e3","source":"wordfence","cve":"CVE-2024-43267","title":"Mega Addons For Elementor <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a64c67de-1c16-4dcb-a3e4-81341b37c3e3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-elementor","name":"Mega Addons For Elementor","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:42:04Z"},{"id":"wordfence:a6505b91-ffca-4ec4-9fd5-a9a5adbd2b0e","source":"wordfence","cve":"CVE-2025-54707","title":"MDTF <= 1.3.3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6505b91-ffca-4ec4-9fd5-a9a5adbd2b0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.7","to_inclusive":true,"patched_in":"1.3.3.8"}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-25T17:41:39Z"},{"id":"wordfence:a654ee62-8742-49bc-95fd-bfab14750b50","source":"wordfence","cve":"CVE-2025-4588","title":"360 Photo Spheres <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a654ee62-8742-49bc-95fd-bfab14750b50?source=api-prod","affected":[{"type":"plugin","slug":"360-sphere-images","name":"360 Photo Spheres","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T18:50:38Z","updated":"2025-08-02T07:24:22Z"},{"id":"wordfence:a656312d-1ddf-48d5-81bf-180c67b32e39","source":"wordfence","cve":"CVE-2026-102251","title":"Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a656312d-1ddf-48d5-81bf-180c67b32e39?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.8.0","to_inclusive":true,"patched_in":"10.8.1"}],"published":"2026-10-13T13:53:15Z","updated":"2026-10-14T02:27:38Z"},{"id":"wordfence:a658d150-bcd5-4334-b07a-e09b3995169d","source":"wordfence","cve":"CVE-2023-23794","title":"Semalt Blocker <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a658d150-bcd5-4334-b07a-e09b3995169d?source=api-prod","affected":[{"type":"plugin","slug":"semalt","name":"Semalt Blocker","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a659866a-65d0-42b3-be39-b600a065d5bf","source":"wordfence","cve":"CVE-2025-46461","title":"RRSSB <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a659866a-65d0-42b3-be39-b600a065d5bf?source=api-prod","affected":[{"type":"plugin","slug":"rrssb","name":"RRSSB","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:37:19Z"},{"id":"wordfence:a65a1f25-04e5-4ca3-9b2d-1b78254a8871","source":"wordfence","cve":"CVE-2023-46644","title":"WordPress CTA <= 1.5.8 - Missing Authorization via Multiple AJAX Actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65a1f25-04e5-4ca3-9b2d-1b78254a8871?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-10-25T00:00:00Z","updated":"2024-03-29T17:32:12Z"},{"id":"wordfence:a65cc674-a0ea-46b9-b609-b184e1f7ca8e","source":"wordfence","cve":"CVE-2026-4281","title":"FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65cc674-a0ea-46b9-b609-b184e1f7ca8e?source=api-prod","affected":[{"type":"plugin","slug":"formlift","name":"FormLift for Keap (Legacy) Web Forms","from":"*","from_inclusive":true,"to":"7.5.21","to_inclusive":true,"patched_in":"7.5.22"}],"published":"2026-03-25T14:51:55Z","updated":"2026-03-26T03:37:28Z"},{"id":"wordfence:a65ce746-c356-4879-b348-688b2256fc67","source":"wordfence","cve":"CVE-2024-3642","title":"Newsletter Popup <= 1.2 - Cross-Site Request Forgery to Subscriber Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65ce746-c356-4879-b348-688b2256fc67?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-06T13:05:31Z"},{"id":"wordfence:a65e820d-afb7-4e1c-b690-5948447af59a","source":"wordfence","cve":"CVE-2016-10977","title":"Nelio AB Testing < 4.5.0 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65e820d-afb7-4e1c-b690-5948447af59a?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2016-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a65eb62d-847b-4f3a-848b-1290e3118c01","source":"wordfence","cve":"CVE-2026-5032","title":"W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2026-04-01T19:07:11Z","updated":"2026-04-03T18:25:51Z"},{"id":"wordfence:a65fe73b-6bcb-4856-a76c-fbcb6cf3c3bd","source":"wordfence","cve":"CVE-2025-22827","title":"WP Joomag <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a65fe73b-6bcb-4856-a76c-fbcb6cf3c3bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-joomag","name":"WP Joomag","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:07:14Z"},{"id":"wordfence:a660b7b8-550e-42d7-b15a-0ab2aa501623","source":"wordfence","cve":"","title":"Donorbox <= 7.1.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a660b7b8-550e-42d7-b15a-0ab2aa501623?source=api-prod","affected":[{"type":"plugin","slug":"donorbox-donation-form","name":"Donorbox \u2013 Free Recurring Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":false,"patched_in":"7.1.2"}],"published":"2019-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6627f96-63d6-4f22-9eb7-fb42e748ae38","source":"wordfence","cve":"CVE-2023-47510","title":"WPDBSpringClean <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6627f96-63d6-4f22-9eb7-fb42e748ae38?source=api-prod","affected":[{"type":"plugin","slug":"wpdbspringclean","name":"WPDBSpringClean","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a662c904-ba2e-494c-a603-b22eeeddf43d","source":"wordfence","cve":"CVE-2024-9821","title":"Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a662c904-ba2e-494c-a603-b22eeeddf43d?source=api-prod","affected":[{"type":"plugin","slug":"bot-for-telegram-on-woocommerce","name":"Bot for Telegram on WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-11T00:00:00Z","updated":"2025-05-16T14:53:50Z"},{"id":"wordfence:a6635a04-b5fa-4cae-9567-b1d6ed688670","source":"wordfence","cve":"CVE-2025-22324","title":"OZ Canonical <= 0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6635a04-b5fa-4cae-9567-b1d6ed688670?source=api-prod","affected":[{"type":"plugin","slug":"oz-canonical","name":"OZ Canonical","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:00:32Z"},{"id":"wordfence:a66388d6-cf78-48b2-9363-53d1f72d1ff0","source":"wordfence","cve":"CVE-2021-24749","title":"URL Shortify <= 1.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a66388d6-cf78-48b2-9363-53d1f72d1ff0?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2021-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6664039-554b-43bf-8925-00c1e62e28f5","source":"wordfence","cve":"CVE-2024-22139","title":"WordPress Manuten\u00e7\u00e3o <= 1.0.6 - IP Spoofing to Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6664039-554b-43bf-8925-00c1e62e28f5?source=api-prod","affected":[{"type":"plugin","slug":"wp-manutencao","name":"WordPress Manuten\u00e7\u00e3o","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-20T16:27:12Z"},{"id":"wordfence:a666d0e4-4fa7-4794-b270-afbccf5036c6","source":"wordfence","cve":"CVE-2025-13840","title":"BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a666d0e4-4fa7-4794-b270-afbccf5036c6?source=api-prod","affected":[{"type":"plugin","slug":"bukazu-search-widget","name":"Bukazu Search Widget","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.5"}],"published":"2025-12-11T14:31:53Z","updated":"2026-01-06T19:02:54Z"},{"id":"wordfence:a6689ddc-91df-44d4-aff2-9453978c5ff6","source":"wordfence","cve":"CVE-2025-1625","title":"Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6689ddc-91df-44d4-aff2-9453978c5ff6?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-04-28T00:00:00Z","updated":"2025-05-23T15:09:30Z"},{"id":"wordfence:a66904db-8f6a-4a77-86fe-1c95d3697f0d","source":"wordfence","cve":"CVE-2025-48279","title":"WC MyParcel Belgium <= 4.5.5-beta - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a66904db-8f6a-4a77-86fe-1c95d3697f0d?source=api-prod","affected":[{"type":"plugin","slug":"wc-myparcel-belgium","name":"WC MyParcel Belgium","from":"*","from_inclusive":true,"to":"4.5.5-beta","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T21:04:30Z"},{"id":"wordfence:a669f05d-67c7-45ac-ae56-e7c637ece880","source":"wordfence","cve":"CVE-2026-18328","title":"Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a669f05d-67c7-45ac-ae56-e7c637ece880?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0","to_inclusive":true,"patched_in":"1.57.0.1"}],"published":"2026-08-24T18:48:11Z","updated":"2026-08-25T07:39:50Z"},{"id":"wordfence:a669f42d-aed7-41a8-8069-f778c5fa48d4","source":"wordfence","cve":"CVE-2025-46249","title":"Simple calendar for Elementor <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a669f42d-aed7-41a8-8069-f778c5fa48d4?source=api-prod","affected":[{"type":"plugin","slug":"simple-calendar-for-elementor","name":"Simple calendar for Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:38:11Z"},{"id":"wordfence:a669f6ef-0cf1-4fdb-855a-1d6aaa7d8f6c","source":"wordfence","cve":"CVE-2024-32825","title":"Simply Static <= 3.1.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a669f6ef-0cf1-4fdb-855a-1d6aaa7d8f6c?source=api-prod","affected":[{"type":"plugin","slug":"simply-static","name":"Simply Static \u2013 The Static Site Generator","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:36:47Z"},{"id":"wordfence:a66b55e0-1b31-4d5f-bcc1-cfd38b613905","source":"wordfence","cve":"CVE-2026-8882","title":"WP ApplicantStack Jobs Display <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a66b55e0-1b31-4d5f-bcc1-cfd38b613905?source=api-prod","affected":[{"type":"plugin","slug":"wp-applicantstack-jobs-display","name":"WP ApplicantStack Jobs Display","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:06:55Z","updated":"2026-06-09T03:41:22Z"},{"id":"wordfence:a66bc196-e5f8-46b4-a81c-c888eb64021c","source":"wordfence","cve":"CVE-2023-2305","title":"Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a66bc196-e5f8-46b4-a81c-c888eb64021c?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.70","to_inclusive":true,"patched_in":"3.2.71"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a66c2e1e-fd59-424b-bd11-0991a5c32dce","source":"wordfence","cve":"CVE-2021-24607","title":"Storefront Footer Text <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a66c2e1e-fd59-424b-bd11-0991a5c32dce?source=api-prod","affected":[{"type":"plugin","slug":"storefront-footer-text","name":"Storefront Footer Text","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6702470-8ad3-45f0-9e90-9819e6a5b6dc","source":"wordfence","cve":"CVE-2024-53726","title":"RealtyCandy IDX Broker Extended <= 1.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6702470-8ad3-45f0-9e90-9819e6a5b6dc?source=api-prod","affected":[{"type":"plugin","slug":"realtycandy-idx-broker-extended","name":"RealtyCandy IDX Broker Extended","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:23:58Z"},{"id":"wordfence:a671128a-74e6-4f92-94af-9e5e37ed7b7a","source":"wordfence","cve":"CVE-2023-29429","title":"User Registration <= 2.3.2.1 - Missing Authorization via send_test_email","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a671128a-74e6-4f92-94af-9e5e37ed7b7a?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"2.3.2.1","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a671a264-81f6-4856-b48c-78f417e4ea0b","source":"wordfence","cve":"CVE-2026-62103","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a671a264-81f6-4856-b48c-78f417e4ea0b?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:23:53Z"},{"id":"wordfence:a672c18b-1426-49fd-9590-eab8204afd5f","source":"wordfence","cve":"CVE-2019-10692","title":"WP Go Maps (formerly WP Google Maps) <= 7.11.17 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a672c18b-1426-49fd-9590-eab8204afd5f?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"7.11.17","to_inclusive":true,"patched_in":"7.11.18"}],"published":"2020-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a673f9f9-ad32-4dcf-bbbb-115a5339c415","source":"wordfence","cve":"CVE-2025-62013","title":"UiChemy <= 4.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a673f9f9-ad32-4dcf-bbbb-115a5339c415?source=api-prod","affected":[{"type":"plugin","slug":"uichemy","name":"UiChemy \u2013 Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:32:56Z"},{"id":"wordfence:a67562c0-56e9-4b75-b0cf-ed408f4bfa2b","source":"wordfence","cve":"CVE-2025-69327","title":"Car Rental Manager <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67562c0-56e9-4b75-b0cf-ed408f4bfa2b?source=api-prod","affected":[{"type":"plugin","slug":"car-rental-manager","name":"Car Rental Manager \u2013 Online Vehicle Booking System","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-14T14:40:57Z"},{"id":"wordfence:a67972d7-abfd-4ce3-9e47-30736ab32af5","source":"wordfence","cve":"CVE-2023-46068","title":"Maileon <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67972d7-abfd-4ce3-9e47-30736ab32af5?source=api-prod","affected":[{"type":"plugin","slug":"xqueue-maileon","name":"Maileon for WordPress","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a67ab966-c179-4ea6-bf8c-bc22f9b4644b","source":"wordfence","cve":"CVE-2026-25324","title":"Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67ab966-c179-4ea6-bf8c-bc22f9b4644b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.4","to_inclusive":true,"patched_in":"10.3.5"}],"published":"2026-02-01T00:00:00Z","updated":"2026-05-04T15:25:54Z"},{"id":"wordfence:a67b4ec2-b337-478f-aaaa-2ce19c4deb4c","source":"wordfence","cve":"CVE-2025-12717","title":"List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67b4ec2-b337-478f-aaaa-2ce19c4deb4c?source=api-prod","affected":[{"type":"plugin","slug":"list-attachments-shortcode","name":"List Attachments Shortcode","from":"*","from_inclusive":true,"to":"0.4.1a","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:35:12Z","updated":"2025-12-08T18:39:30Z"},{"id":"wordfence:a67df40b-7179-47a7-9cde-1c512ecc2253","source":"wordfence","cve":"CVE-2022-4464","title":"Themify Portfolio Post <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67df40b-7179-47a7-9cde-1c512ecc2253?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a67e4e4f-0d0f-40bd-9fa6-2c865cfab3d0","source":"wordfence","cve":"CVE-2025-67547","title":"Konte <= 2.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67e4e4f-0d0f-40bd-9fa6-2c865cfab3d0?source=api-prod","affected":[{"type":"theme","slug":"konte","name":"Konte - Minimal & Modern WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T19:45:48Z"},{"id":"wordfence:a67eb1fc-4762-4bdc-b0a0-c043c36659d0","source":"wordfence","cve":"","title":"NextGen Gallery <= 3.1.5 - PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a67eb1fc-4762-4bdc-b0a0-c043c36659d0?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2019-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6811f19-07fb-4c05-977f-90f9c5d89bb4","source":"wordfence","cve":"CVE-2025-6462","title":"EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6811f19-07fb-4c05-977f-90f9c5d89bb4?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"*","from_inclusive":true,"to":"5.25.11","to_inclusive":true,"patched_in":"5.25.25"}],"published":"2025-06-28T16:21:52Z","updated":"2025-06-29T04:24:07Z"},{"id":"wordfence:a681cb2f-8ccf-43d1-9626-f259caedacf6","source":"wordfence","cve":"CVE-2026-118078","title":"Product Catalog Feed by PixelYourSite <= 3.1.4 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a681cb2f-8ccf-43d1-9626-f259caedacf6?source=api-prod","affected":[{"type":"plugin","slug":"product-catalog-feed","name":"Product Catalog Feed by PixelYourSite","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:25:26Z","updated":"2026-11-03T19:41:20Z"},{"id":"wordfence:a683eeac-70a1-449c-b0ae-b28b3ef4c795","source":"wordfence","cve":"CVE-2026-24605","title":"X Addons for Elementor <= 1.0.23 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a683eeac-70a1-449c-b0ae-b28b3ef4c795?source=api-prod","affected":[{"type":"plugin","slug":"x-addons-elementor","name":"X Addons for Elementor \u2013 20+ Widgets, Templates & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2026-01-14T06:04:35Z","updated":"2026-02-03T13:44:42Z"},{"id":"wordfence:a684bf5f-7cf6-43b1-b457-fdc2ba74852d","source":"wordfence","cve":"CVE-2026-3011","title":"Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a684bf5f-7cf6-43b1-b457-fdc2ba74852d?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.4.13","to_inclusive":true,"patched_in":"3.4.14"}],"published":"2026-06-07T00:00:00Z","updated":"2026-06-08T11:25:33Z"},{"id":"wordfence:a684f597-da72-4697-9e37-ca45a30ca64d","source":"wordfence","cve":"CVE-2024-12520","title":"Dominion \u2013 Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a684f597-da72-4697-9e37-ca45a30ca64d?source=api-prod","affected":[{"type":"plugin","slug":"dominion-domain-checker-wpbakery-addon","name":"Dominion \u2013 Domain Checker for WPBakery","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T19:03:16Z","updated":"2025-05-23T14:20:50Z"},{"id":"wordfence:a68b8df9-9b50-4617-9308-76a2a9036d7a","source":"wordfence","cve":"CVE-2023-2894","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_deactivate_product","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68b8df9-9b50-4617-9308-76a2a9036d7a?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a68c9151-9e1d-41d1-ae50-b59d1c833b29","source":"wordfence","cve":"CVE-2025-23900","title":"Genki Announcement <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68c9151-9e1d-41d1-ae50-b59d1c833b29?source=api-prod","affected":[{"type":"plugin","slug":"genki-announcement","name":"Genki Announcement","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:17:05Z"},{"id":"wordfence:a68ca792-6870-4e28-b118-ee1125842955","source":"wordfence","cve":"CVE-2025-9952","title":"Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68ca792-6870-4e28-b118-ee1125842955?source=api-prod","affected":[{"type":"plugin","slug":"trinity-audio","name":"Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio","from":"*","from_inclusive":true,"to":"5.20.2","to_inclusive":true,"patched_in":"5.21.0"}],"published":"2025-10-03T14:29:21Z","updated":"2025-10-04T03:33:31Z"},{"id":"wordfence:a68cb059-972f-473d-90cb-41ccda052b08","source":"wordfence","cve":"CVE-2025-14035","title":"DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68cb059-972f-473d-90cb-41ccda052b08?source=api-prod","affected":[{"type":"plugin","slug":"debatemaster","name":"DebateMaster","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:29:16Z","updated":"2025-12-12T03:20:52Z"},{"id":"wordfence:a68d283b-7d3a-4df0-a936-a8aec2b778b7","source":"wordfence","cve":"CVE-2026-28139","title":"Ajax Search Lite \u2013 Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68d283b-7d3a-4df0-a936-a8aec2b778b7?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.14.5"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:21:48Z"},{"id":"wordfence:a68dac5d-b07b-40c1-aad1-73e2c8d0f927","source":"wordfence","cve":"CVE-2024-43118","title":"Hummingbird <= 3.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68dac5d-b07b-40c1-aad1-73e2c8d0f927?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:42:48Z"},{"id":"wordfence:a68f024d-b80d-4e6c-8420-5e0dde87d8f0","source":"wordfence","cve":"","title":"ALO EasyMail Newsletter <= 2.6.01 - Cross-Site Request Forgery","severity":"medium","cvss":5.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a68f024d-b80d-4e6c-8420-5e0dde87d8f0?source=api-prod","affected":[{"type":"plugin","slug":"alo-easymail","name":"ALO EasyMail Newsletter","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2016-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a691a44d-0a33-4f13-9afe-255c557ee10f","source":"wordfence","cve":"CVE-2011-5225","title":"WordPress Sentinel <= 1.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a691a44d-0a33-4f13-9afe-255c557ee10f?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-sentinel","name":"WordPress Sentinel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2011-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a69236d1-2164-4702-96e3-abd80fb5ffbb","source":"wordfence","cve":"CVE-2022-42497","title":"Api2Cart Bridge Connector <= 1.1.0 - Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69236d1-2164-4702-96e3-abd80fb5ffbb?source=api-prod","affected":[{"type":"plugin","slug":"api2cart-bridge-connector","name":"Api2Cart Bridge Connector","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a692d9c4-66e0-4461-ad13-65e1446106c5","source":"wordfence","cve":"CVE-2024-13809","title":"Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a692d9c4-66e0-4461-ad13-65e1446106c5?source=api-prod","affected":[{"type":"plugin","slug":"hslide","name":"Hero Slider - WordPress Slider Plugin","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:48Z"},{"id":"wordfence:a69782f0-aa61-4049-8339-7f27f4b6c36b","source":"wordfence","cve":"CVE-2026-3906","title":"WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69782f0-aa61-4049-8339-7f27f4b6c36b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.9.2"}],"published":"2026-03-10T00:00:00Z","updated":"2026-04-06T15:54:47Z"},{"id":"wordfence:a697aef0-5236-464f-aea3-40d93efaba82","source":"wordfence","cve":"CVE-2026-15361","title":"Content Views <= 4.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a697aef0-5236-464f-aea3-40d93efaba82?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:30:00Z"},{"id":"wordfence:a69a5249-f9ab-4489-a032-33dd482fdc96","source":"wordfence","cve":"CVE-2023-47506","title":"Master Slider Pro <= 3.6.5 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69a5249-f9ab-4489-a032-33dd482fdc96?source=api-prod","affected":[{"type":"plugin","slug":"masterslider","name":"Master Slider Pro","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a69a99af-3d1d-4ad2-b6b5-e4fcea56be51","source":"wordfence","cve":"CVE-2024-13459","title":"FuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69a99af-3d1d-4ad2-b6b5-e4fcea56be51?source=api-prod","affected":[{"type":"plugin","slug":"fusedesk","name":"FuseDesk","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":true,"patched_in":"6.7"}],"published":"2025-02-11T21:06:40Z","updated":"2025-02-14T22:42:52Z"},{"id":"wordfence:a69e6ca8-efd6-4b89-ae63-b320f9936842","source":"wordfence","cve":"CVE-2024-24878","title":"Portugal CTT Tracking for WooCommerce <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69e6ca8-efd6-4b89-ae63-b320f9936842?source=api-prod","affected":[{"type":"plugin","slug":"portugal-ctt-tracking-woocommerce","name":"Portugal CTT Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:34:12Z"},{"id":"wordfence:a69e9802-9087-4cd9-86eb-b64a82bc7c0b","source":"wordfence","cve":"CVE-2024-2122","title":"FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a69e9802-9087-4cd9-86eb-b64a82bc7c0b?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2024-06-13T17:03:24Z","updated":"2024-06-14T05:39:18Z"},{"id":"wordfence:a6a1e7c1-0ff1-4d59-ac60-35790bf0318e","source":"wordfence","cve":"CVE-2014-4525","title":"WP eBay Product Feeds < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6a1e7c1-0ff1-4d59-ac60-35790bf0318e?source=api-prod","affected":[{"type":"plugin","slug":"ebay-feeds-for-wordpress","name":"WP eBay Product Feeds","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2014-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6a22af6-055c-4495-9246-1cb7caaf47b8","source":"wordfence","cve":"CVE-2026-28082","title":"JetEngine <= 3.8.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6a22af6-055c-4495-9246-1cb7caaf47b8?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.13.1","to_inclusive":true,"patched_in":"3.8.13.2"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:24:07Z"},{"id":"wordfence:a6ae2701-4fd6-475b-a589-65d314981807","source":"wordfence","cve":"CVE-2026-13158","title":"Everest Toolkit <= 1.2.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6ae2701-4fd6-475b-a589-65d314981807?source=api-prod","affected":[{"type":"plugin","slug":"everest-toolkit","name":"Everest Toolkit","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-14T12:42:38Z"},{"id":"wordfence:a6aeafd3-15be-49a3-be60-e33e909f32ca","source":"wordfence","cve":"CVE-2026-86709","title":"The Pressengine <= 1.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6aeafd3-15be-49a3-be60-e33e909f32ca?source=api-prod","affected":[{"type":"plugin","slug":"the-pressengine","name":"The Pressengine","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:42:05Z"},{"id":"wordfence:a6b02846-61be-4571-921d-53df5493f856","source":"wordfence","cve":"CVE-2026-4057","title":"Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b02846-61be-4571-921d-53df5493f856?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.51","to_inclusive":true,"patched_in":"3.3.52"}],"published":"2026-04-09T12:00:41Z","updated":"2026-04-10T01:24:58Z"},{"id":"wordfence:a6b0b516-af5c-474a-a674-b52cf80207ec","source":"wordfence","cve":"","title":"Re:amaze Helpdesk & Live Chat <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b0b516-af5c-474a-a674-b52cf80207ec?source=api-prod","affected":[{"type":"plugin","slug":"reamaze","name":"Re:amaze Helpdesk & Live Chat","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"2.0"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6b133dc-e133-4b87-8fcb-941b125e6e48","source":"wordfence","cve":"CVE-2026-32575","title":"SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b133dc-e133-4b87-8fcb-941b125e6e48?source=api-prod","affected":[{"type":"plugin","slug":"affs","name":"SUMO Affiliates Pro","from":"*","from_inclusive":true,"to":"11.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:27:13Z","updated":"2026-10-08T23:20:04Z"},{"id":"wordfence:a6b16ffe-1c65-49d3-9e30-407bc75d7d49","source":"wordfence","cve":"CVE-2022-46799","title":"Easy Testimonial Slider and Form <= 1.0.15 - Unauthenticated Reflected Cross-Site Scripting via search_term","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b16ffe-1c65-49d3-9e30-407bc75d7d49?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonial-rotator","name":"Easy Testimonial Slider and Form","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6b46c65-b81c-4d3a-b0c8-b661745a9580","source":"wordfence","cve":"CVE-2026-46697","title":"Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b46c65-b81c-4d3a-b0c8-b661745a9580?source=api-prod","affected":[{"type":"plugin","slug":"fediverse-embeds","name":"Fediverse Embeds","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:16:01Z"},{"id":"wordfence:a6b5cca3-7911-4bb0-b54b-ae19ce570c5c","source":"wordfence","cve":"CVE-2026-24626","title":"Logo Slider <= 5.5.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b5cca3-7911-4bb0-b54b-ae19ce570c5c?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"5.5.3","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2026-01-10T05:40:49Z","updated":"2026-07-16T19:21:12Z"},{"id":"wordfence:a6b91ec6-c669-4a92-ae12-b6829f349687","source":"wordfence","cve":"CVE-2025-54735","title":"CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6b91ec6-c669-4a92-ae12-b6829f349687?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.24","to_inclusive":true,"patched_in":"1.1.25"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:33:37Z"},{"id":"wordfence:a6bb97fa-c8cd-44bc-90ba-dd3b6a3a78da","source":"wordfence","cve":"CVE-2024-51820","title":"L Squared Hub WP <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6bb97fa-c8cd-44bc-90ba-dd3b6a3a78da?source=api-prod","affected":[{"type":"plugin","slug":"l-squared-hub-wp-virtual-device","name":"L Squared Hub WP \u2013 Virtual Device Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:25:31Z"},{"id":"wordfence:a6be4565-d5e6-43f8-bdd2-e6dce66bdad2","source":"wordfence","cve":"CVE-2024-38720","title":"EazyDocs <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6be4565-d5e6-43f8-bdd2-e6dce66bdad2?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-01T19:51:08Z"},{"id":"wordfence:a6be4aaa-f8a1-42d6-95c1-062c5ca51004","source":"wordfence","cve":"CVE-2025-6068","title":"FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6be4aaa-f8a1-42d6-95c1-062c5ca51004?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.31","to_inclusive":true,"patched_in":"2.4.32"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-11T07:23:01Z"},{"id":"wordfence:a6bef410-8706-4440-b50f-08824ef754f6","source":"wordfence","cve":"CVE-2024-23520","title":"PopupAlly <= 2.1.0 - Cross-Site Request Forgery via optin_submit_callback","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6bef410-8706-4440-b50f-08824ef754f6?source=api-prod","affected":[{"type":"plugin","slug":"popupally","name":"PopupAlly","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-02T18:13:42Z"},{"id":"wordfence:a6bf60cc-4a07-4d5d-bff3-20d0115a5bd3","source":"wordfence","cve":"","title":"Gravityforms <= 1.8.19 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6bf60cc-4a07-4d5d-bff3-20d0115a5bd3?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"1.8.20","to_inclusive":false,"patched_in":"1.8.20"}],"published":"2015-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6c1c73b-76e3-4cb9-ad53-9d5d4e7519c9","source":"wordfence","cve":"CVE-2026-4121","title":"Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c1c73b-76e3-4cb9-ad53-9d5d4e7519c9?source=api-prod","affected":[{"type":"plugin","slug":"kcaptcha","name":"Kcaptcha","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:07:38Z","updated":"2026-04-22T07:45:40Z"},{"id":"wordfence:a6c6e8ab-a5d8-470c-b9b3-9dea09016e54","source":"wordfence","cve":"CVE-2025-50039","title":"VG WORT METIS <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c6e8ab-a5d8-470c-b9b3-9dea09016e54?source=api-prod","affected":[{"type":"plugin","slug":"vgw-metis","name":"VG WORT METIS","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-28T20:21:14Z"},{"id":"wordfence:a6c83a27-92fd-4b3e-9776-b0d110b5cb74","source":"wordfence","cve":"CVE-2025-58005","title":"DriCub <= 2.9 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c83a27-92fd-4b3e-9776-b0d110b5cb74?source=api-prod","affected":[{"type":"theme","slug":"dricub-driving-school","name":"DriCub - Driving School WordPress Theme","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:11:32Z"},{"id":"wordfence:a6c842bb-914a-47c1-aaac-e748f58e12ef","source":"wordfence","cve":"CVE-2025-8105","title":"Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c842bb-914a-47c1-aaac-e748f58e12ef?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.7","to_inclusive":true,"patched_in":"8.6.8"}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T11:11:24Z"},{"id":"wordfence:a6c976fd-c35c-40ac-8151-565a7dd746ca","source":"wordfence","cve":"CVE-2026-102402","title":"Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c976fd-c35c-40ac-8151-565a7dd746ca?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2026-10-09T17:44:32Z","updated":"2026-10-10T06:40:14Z"},{"id":"wordfence:a6ca0a45-cbb3-419b-a2fd-7427935524d8","source":"wordfence","cve":"CVE-2024-12129","title":"Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6ca0a45-cbb3-419b-a2fd-7427935524d8?source=api-prod","affected":[{"type":"plugin","slug":"royal-core","name":"Royal Core","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:56:23Z","updated":"2025-01-30T13:42:10Z"},{"id":"wordfence:a6cee2c1-cdfb-419a-8900-bc9d921d610e","source":"wordfence","cve":"CVE-2024-47642","title":"Keap Official Opt-in Forms <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6cee2c1-cdfb-419a-8900-bc9d921d610e?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-official-opt-in-forms","name":"Keap Official Opt-in Forms","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2025-04-21T14:38:36Z"},{"id":"wordfence:a6cefbdb-a453-4858-af7f-386a75ec592c","source":"wordfence","cve":"CVE-2025-26751","title":"Alphabetic Pagination <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6cefbdb-a453-4858-af7f-386a75ec592c?source=api-prod","affected":[{"type":"plugin","slug":"alphabetic-pagination","name":"Alphabetic Pagination","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-02-14T00:00:00Z","updated":"2025-03-03T21:13:16Z"},{"id":"wordfence:a6d12f0a-dd53-4e0d-9e27-49be5eb1e78e","source":"wordfence","cve":"CVE-2026-28104","title":"Site Suggest <= 1.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d12f0a-dd53-4e0d-9e27-49be5eb1e78e?source=api-prod","affected":[{"type":"plugin","slug":"site-suggest","name":"Site Suggest","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:31:31Z"},{"id":"wordfence:a6d22101-06ef-4492-8ba9-8cf2ca1f4474","source":"wordfence","cve":"CVE-2025-9899","title":"Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d22101-06ef-4492-8ba9-8cf2ca1f4474?source=api-prod","affected":[{"type":"plugin","slug":"trust-reviews","name":"Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:34:01Z","updated":"2025-09-27T06:47:14Z"},{"id":"wordfence:a6d43f93-0315-4060-a8a6-7e9cdd8447af","source":"wordfence","cve":"CVE-2025-67558","title":"Rencontre <= 3.13.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d43f93-0315-4060-a8a6-7e9cdd8447af?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.13.7","to_inclusive":true,"patched_in":"3.13.8"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:01:38Z"},{"id":"wordfence:a6d474cb-36ca-4a99-82de-2e154b3ae6ac","source":"wordfence","cve":"CVE-2024-6460","title":"Grow by Tradedoubler <= 2.0.21 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d474cb-36ca-4a99-82de-2e154b3ae6ac?source=api-prod","affected":[{"type":"plugin","slug":"tradedoubler-affiliate-tracker","name":"Grow by Tradedoubler \u2013 Advertiser Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2024-07-26T00:00:00Z","updated":"2024-08-06T19:22:58Z"},{"id":"wordfence:a6d4e207-9751-4c97-b004-e97c69af81dd","source":"wordfence","cve":"CVE-2022-0411","title":"Asgaros Forum < 2.0.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d4e207-9751-4c97-b004-e97c69af81dd?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6d59ed7-a25e-4b96-a8de-9364aafdf72a","source":"wordfence","cve":"CVE-2024-52374","title":"Do That Task <= 1.5.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d59ed7-a25e-4b96-a8de-9364aafdf72a?source=api-prod","affected":[{"type":"plugin","slug":"do-that-task","name":"Do That Task","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:41:23Z"},{"id":"wordfence:a6d5c2be-e4d3-4751-9a49-195270129095","source":"wordfence","cve":"CVE-2026-24619","title":"PopCash.Net Code Integration Tool <= 1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d5c2be-e4d3-4751-9a49-195270129095?source=api-prod","affected":[{"type":"plugin","slug":"popcashnet-code-integration-tool","name":"PopCash Code Integration Tool","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-01-11T08:26:20Z","updated":"2026-03-17T21:30:50Z"},{"id":"wordfence:a6d5dcdc-f9db-4eb9-aac5-8ec79eb46bcf","source":"wordfence","cve":"CVE-2024-38762","title":"Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d5dcdc-f9db-4eb9-aac5-8ec79eb46bcf?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.11.0.4","to_inclusive":true,"patched_in":"5.11.0.5"}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-15T18:11:26Z"},{"id":"wordfence:a6d636a6-108c-40c5-b7c9-e3dee6bcaa0b","source":"wordfence","cve":"CVE-2026-59538","title":"GamiPress \u2013 Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d636a6-108c-40c5-b7c9-e3dee6bcaa0b?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.7","to_inclusive":true,"patched_in":"7.9.8"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:22:57Z"},{"id":"wordfence:a6d663a9-3185-4c36-b9d1-878297965379","source":"wordfence","cve":"CVE-2023-5049","title":"Giveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d663a9-3185-4c36-b9d1-878297965379?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6d9d093-1e31-4d36-ac55-79cf82b231bb","source":"wordfence","cve":"CVE-2021-32789","title":"WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d9d093-1e31-4d36-ac55-79cf82b231bb?source=api-prod","affected":[{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"*","from_inclusive":true,"to":"2.5.15","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"2.6","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"2.7","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"2.8","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"2.9","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.0","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.1","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.2","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.3","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.4","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.5","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.6","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.7","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.8","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"3.9","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.1","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.2","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.3","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.4","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.6","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.7","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.8","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"4.9","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.1","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.2","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.3","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"2.5.16"},{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"5.5","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"2.5.16"}],"published":"2021-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6da4cf6-4b3b-4015-9106-b2a4467f34f7","source":"wordfence","cve":"CVE-2020-11516","title":"Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6da4cf6-4b3b-4015-9106-b2a4467f34f7?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-datepicker","name":"Contact Form 7 Datepicker","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2020-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6dadbb0-1ebe-43ff-b220-0c93d0f51d87","source":"wordfence","cve":"CVE-2024-25930","title":"Custom Order Statuses for WooCommerce <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6dadbb0-1ebe-43ff-b220-0c93d0f51d87?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-statuses-for-woocommerce","name":"Custom Order Statuses for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-23T17:04:01Z"},{"id":"wordfence:a6dc7c65-894d-4b3e-a774-717330dd1dad","source":"wordfence","cve":"CVE-2026-22423","title":"SetSail <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6dc7c65-894d-4b3e-a774-717330dd1dad?source=api-prod","affected":[{"type":"theme","slug":"setsail","name":"SetSail - Travel Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:30:19Z"},{"id":"wordfence:a6dde21f-f747-4a80-a5eb-c4af847fbfc7","source":"wordfence","cve":"CVE-2021-47965","title":"WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6dde21f-f747-4a80-a5eb-c4af847fbfc7?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-edit","name":"WP Super Edit","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-15T00:00:00Z","updated":"2026-07-29T20:58:28Z"},{"id":"wordfence:a6df96a3-d56b-4eac-af33-92f4a76e3902","source":"wordfence","cve":"CVE-2024-56274","title":"Astra Widgets <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6df96a3-d56b-4eac-af33-92f4a76e3902?source=api-prod","affected":[{"type":"plugin","slug":"astra-widgets","name":"Astra Widgets","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:59:07Z"},{"id":"wordfence:a6e3645d-ed1b-4c51-a463-c2691cb7168d","source":"wordfence","cve":"CVE-2025-11241","title":"Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3645d-ed1b-4c51-a463-c2691cb7168d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo-premium","name":"Yoast SEO Premium","from":"25.7","from_inclusive":true,"to":"25.9","to_inclusive":true,"patched_in":"26.0"}],"published":"2025-10-02T00:00:00Z","updated":"2025-10-03T01:56:44Z"},{"id":"wordfence:a6e3d62c-c959-4352-bec7-57855c4f4547","source":"wordfence","cve":"CVE-2026-66598","title":"B2Bking <= 5.6.07 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e3d62c-c959-4352-bec7-57855c4f4547?source=api-prod","affected":[{"type":"plugin","slug":"b2bking","name":"B2Bking","from":"*","from_inclusive":true,"to":"5.6.07","to_inclusive":true,"patched_in":"5.6.08"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:20:55Z"},{"id":"wordfence:a6e41dee-bb4a-404d-9aed-608f8f69ee94","source":"wordfence","cve":"CVE-2025-23814","title":"CRUDLab Like Box <= 2.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e41dee-bb4a-404d-9aed-608f8f69ee94?source=api-prod","affected":[{"type":"plugin","slug":"crudlab-facebook-like-box","name":"CRUDLab Like Box","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:39:39Z"},{"id":"wordfence:a6e513cc-5008-4f59-87c1-2a1b42d98850","source":"wordfence","cve":"CVE-2025-47460","title":"TrackShip for WooCommerce <= 1.9.1 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e513cc-5008-4f59-87c1-2a1b42d98850?source=api-prod","affected":[{"type":"plugin","slug":"trackship-for-woocommerce","name":"TrackShip for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:21:56Z"},{"id":"wordfence:a6e687e9-6ffe-4457-8d57-3c03f657eb74","source":"wordfence","cve":"CVE-2023-5507","title":"ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e687e9-6ffe-4457-8d57-3c03f657eb74?source=api-prod","affected":[{"type":"plugin","slug":"imagemapper","name":"ImageMapper","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6e70e5f-6b4b-40c1-b43c-957ca97e162a","source":"wordfence","cve":"CVE-2024-29091","title":"WP Armour \u2013 Honeypot Anti Spam <= 2.1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6e70e5f-6b4b-40c1-b43c-957ca97e162a?source=api-prod","affected":[{"type":"plugin","slug":"honeypot","name":"WP Armour \u2013 Honeypot Anti Spam","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:45:25Z"},{"id":"wordfence:a6ede290-a6c4-4c13-872b-60c9601d39db","source":"wordfence","cve":"CVE-2023-6091","title":"Theme Editor <= 2.7.1 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6ede290-a6c4-4c13-872b-60c9601d39db?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6eed2c5-43e8-40b6-814f-ddf5967d52bc","source":"wordfence","cve":"CVE-2025-68504","title":"JetSearch <= 3.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6eed2c5-43e8-40b6-814f-ddf5967d52bc?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.5.16","to_inclusive":true,"patched_in":"3.5.16.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:01:21Z"},{"id":"wordfence:a6f1233b-55d6-488a-8667-b5454f71020c","source":"wordfence","cve":"CVE-2023-7198","title":"WP Dashboard Notes <= 1.0.10 - Insecure Direct Object References to Authenticated Private Note Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6f1233b-55d6-488a-8667-b5454f71020c?source=api-prod","affected":[{"type":"plugin","slug":"wp-dashboard-notes","name":"WP Dashboard Notes","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2023-12-19T00:00:00Z","updated":"2024-03-22T17:46:06Z"},{"id":"wordfence:a6f362c1-fe64-4be1-9713-14c0561a59ce","source":"wordfence","cve":"CVE-2025-11456","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6f362c1-fe64-4be1-9713-14c0561a59ce?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-11-20T18:41:00Z","updated":"2025-11-21T07:31:54Z"},{"id":"wordfence:a6f9a9c2-4ef6-4004-afc3-e08cb7f03255","source":"wordfence","cve":"CVE-2024-34820","title":"If-So Dynamic Content Personalization <= 1.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6f9a9c2-4ef6-4004-afc3-e08cb7f03255?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.1.1"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T19:44:22Z"},{"id":"wordfence:a6fa6c56-f0bb-46ba-9c9e-0fc26a8c7450","source":"wordfence","cve":"CVE-2025-58942","title":"Dwell <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6fa6c56-f0bb-46ba-9c9e-0fc26a8c7450?source=api-prod","affected":[{"type":"theme","slug":"dwell","name":"Dwell - Building, Construction & Renovation Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:34:58Z"},{"id":"wordfence:a6fda35d-8b82-4a7a-8db6-21dc38a841f4","source":"wordfence","cve":"CVE-2023-47846","title":"WP Githuber MD <= 1.16.2 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6fda35d-8b82-4a7a-8db6-21dc38a841f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-githuber-md","name":"WP Githuber MD \u2013 WordPress Markdown Editor","from":"*","from_inclusive":true,"to":"1.16.2","to_inclusive":true,"patched_in":"1.16.3"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a6ff3028-07bb-49c2-b1e4-0f5910a53bd6","source":"wordfence","cve":"CVE-2024-37504","title":"FileBird Document Library <= 2.0.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a6ff3028-07bb-49c2-b1e4-0f5910a53bd6?source=api-prod","affected":[{"type":"plugin","slug":"filebird-document-library","name":"FileBird Document Library","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:33:30Z"},{"id":"wordfence:a7021586-16e8-41d2-8337-b700ce0b2d1d","source":"wordfence","cve":"CVE-2024-5004","title":"CM Popup Plugin for WordPress \u2013 Popup Maker <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7021586-16e8-41d2-8337-b700ce0b2d1d?source=api-prod","affected":[{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2024-07-01T00:00:00Z","updated":"2024-08-09T18:37:08Z"},{"id":"wordfence:a7041a2a-24d0-46c4-bf0d-f0447dac8c4b","source":"wordfence","cve":"CVE-2024-51592","title":"Meta Store Elements <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7041a2a-24d0-46c4-bf0d-f0447dac8c4b?source=api-prod","affected":[{"type":"plugin","slug":"meta-store-elements","name":"Meta Store Elements","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:58:21Z"},{"id":"wordfence:a7041b6c-b76d-46ee-a2d5-68378ee7f7b6","source":"wordfence","cve":"CVE-2026-39608","title":"iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7041b6c-b76d-46ee-a2d5-68378ee7f7b6?source=api-prod","affected":[{"type":"plugin","slug":"ipospays-gateways-wc","name":"iPOSpays Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-02-07T00:00:00Z","updated":"2026-05-19T12:42:08Z"},{"id":"wordfence:a7063046-6bce-4b31-81f8-06eaec122317","source":"wordfence","cve":"CVE-2025-53571","title":"HAPPY \u2013 Helpdesk Support Ticket System <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7063046-6bce-4b31-81f8-06eaec122317?source=api-prod","affected":[{"type":"plugin","slug":"happy-helpdesk-support-ticket-system","name":"HAPPY \u2013 Helpdesk Support Ticket System","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-08-19T00:00:00Z","updated":"2025-09-25T20:59:09Z"},{"id":"wordfence:a706e4eb-cd27-44b1-a023-5e4e075c768d","source":"wordfence","cve":"CVE-2024-49256","title":"Htaccess File Editor <= 1.0.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a706e4eb-cd27-44b1-a023-5e4e075c768d?source=api-prod","affected":[{"type":"plugin","slug":"htaccess-file-editor","name":"Htaccess File Editor \u2013 Easily Edit, Backup, Restore .htaccess file","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:29:00Z"},{"id":"wordfence:a70757f7-63a0-452a-a078-0fb7f82844b6","source":"wordfence","cve":"CVE-2026-12954","title":"Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a70757f7-63a0-452a-a078-0fb7f82844b6?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.23.0","to_inclusive":true,"patched_in":"1.24.0"}],"published":"2026-09-17T19:14:56Z","updated":"2026-09-18T07:40:03Z"},{"id":"wordfence:a70a91f3-ec87-472a-9cb0-98c874b7825f","source":"wordfence","cve":"CVE-2008-0615","title":"DMSGuestbook <= 1.8.0 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a70a91f3-ec87-472a-9cb0-98c874b7825f?source=api-prod","affected":[{"type":"plugin","slug":"dmsguestbook","name":"DMSGuestbook","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a71191f3-1151-4f8c-b6fe-86983b034557","source":"wordfence","cve":"CVE-2024-8617","title":"Quiz Maker <= 6.5.9.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71191f3-1151-4f8c-b6fe-86983b034557?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.9.8","to_inclusive":true,"patched_in":"6.5.9.9"}],"published":"2024-09-16T00:00:00Z","updated":"2025-05-30T18:35:41Z"},{"id":"wordfence:a712c529-b69d-4acf-b55a-64fb3a45b990","source":"wordfence","cve":"CVE-2025-22730","title":"Ksher <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a712c529-b69d-4acf-b55a-64fb3a45b990?source=api-prod","affected":[{"type":"plugin","slug":"ksher-payment","name":"Ksher","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-24T15:47:16Z"},{"id":"wordfence:a7131704-4803-492a-aae7-17a8ab33282f","source":"wordfence","cve":"CVE-2025-64275","title":"Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7131704-4803-492a-aae7-17a8ab33282f?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-17T18:14:36Z"},{"id":"wordfence:a713c7d3-06ce-4d65-9766-2b0331656ae6","source":"wordfence","cve":"","title":"Popup Like box \u2013 Page Plugin <= 3.5.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a713c7d3-06ce-4d65-9766-2b0331656ae6?source=api-prod","affected":[{"type":"plugin","slug":"ays-facebook-popup-likebox","name":"Popup Like box \u2013 Page Plugin","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a713d897-c549-4e0d-9cb3-7002ef2b127f","source":"wordfence","cve":"CVE-2023-6801","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a713d897-c549-4e0d-9cb3-7002ef2b127f?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:03Z"},{"id":"wordfence:a713e54b-524a-451f-b17a-a2c47e087bdc","source":"wordfence","cve":"CVE-2024-44053","title":"Opor Ayam <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a713e54b-524a-451f-b17a-a2c47e087bdc?source=api-prod","affected":[{"type":"theme","slug":"opor-ayam","name":"Opor Ayam","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:55:30Z"},{"id":"wordfence:a7147719-17cf-4381-b371-6d9162ef3e35","source":"wordfence","cve":"CVE-2025-47522","title":"AWEOS WP Lock <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7147719-17cf-4381-b371-6d9162ef3e35?source=api-prod","affected":[{"type":"plugin","slug":"aweos-wp-lock","name":"AWEOS WP Lock","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:58:52Z"},{"id":"wordfence:a714b35e-776d-42f4-bb7c-7865bf2b7637","source":"wordfence","cve":"CVE-2024-26019","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a714b35e-776d-42f4-bb7c-7865bf2b7637?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-07T19:19:53Z"},{"id":"wordfence:a717fea9-088c-4b65-9624-a1ba66028f4e","source":"wordfence","cve":"CVE-2025-69020","title":"Newsletters <= 4.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a717fea9-088c-4b65-9624-a1ba66028f4e?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.12","to_inclusive":true,"patched_in":"4.13"}],"published":"2025-12-28T00:00:00Z","updated":"2026-02-06T17:10:49Z"},{"id":"wordfence:a7181056-d2ee-4c0f-b9a8-fdb7ad042a6b","source":"wordfence","cve":"CVE-2023-29439","title":"FooGallery <= 2.2.35 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7181056-d2ee-4c0f-b9a8-fdb7ad042a6b?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.2.35","to_inclusive":true,"patched_in":"2.2.41"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a71992e2-fdac-4e89-8867-4b771d9b4374","source":"wordfence","cve":"CVE-2026-4329","title":"Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71992e2-fdac-4e89-8867-4b771d9b4374?source=api-prod","affected":[{"type":"plugin","slug":"blackhole-bad-bots","name":"Blackhole for Bad Bots","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T03:37:28Z"},{"id":"wordfence:a71a1a7b-6299-44c5-b686-65f214986c27","source":"wordfence","cve":"","title":"InfiniteWP Client <= 1.3.7 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71a1a7b-6299-44c5-b686-65f214986c27?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2014-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a71a9aa0-ffe3-418d-ad18-285773ee01c1","source":"wordfence","cve":"CVE-2025-25130","title":"Delete Comments By Status <= 2.1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71a9aa0-ffe3-418d-ad18-285773ee01c1?source=api-prod","affected":[{"type":"plugin","slug":"delete-comments-by-status","name":"Delete Comments By Status","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:50:00Z"},{"id":"wordfence:a71c8e8d-6883-4ec5-a3b3-f4bf9eda7b4d","source":"wordfence","cve":"CVE-2026-14215","title":"Booking for Appointments and Events Calendar \u2013 Amelia < 2.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71c8e8d-6883-4ec5-a3b3-f4bf9eda7b4d?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":false,"patched_in":"2.4.9"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:18:27Z"},{"id":"wordfence:a71cbe66-4187-4260-bb87-8579bc6e75f5","source":"wordfence","cve":"CVE-2024-1421","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71cbe66-4187-4260-bb87-8579bc6e75f5?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T22:32:27Z"},{"id":"wordfence:a71d13b2-5c0b-4e19-b1b3-b97a996d4019","source":"wordfence","cve":"CVE-2022-1846","title":"Tiny Contact Form <= 0.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71d13b2-5c0b-4e19-b1b3-b97a996d4019?source=api-prod","affected":[{"type":"plugin","slug":"tiny-contact-form","name":"Tiny Contact Form","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a71e330e-8673-49b4-8c31-63771533476f","source":"wordfence","cve":"CVE-2026-78478","title":"M\u00e5ne <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71e330e-8673-49b4-8c31-63771533476f?source=api-prod","affected":[{"type":"theme","slug":"mane","name":"Mane","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-25T05:31:28Z"},{"id":"wordfence:a71e72dd-574c-41fc-a000-7a4cf658f3d7","source":"wordfence","cve":"CVE-2024-12112","title":"Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a71e72dd-574c-41fc-a000-7a4cf658f3d7?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T03:18:12Z"},{"id":"wordfence:a720ad0e-6194-4df4-951e-e818518e79b5","source":"wordfence","cve":"CVE-2023-36507","title":"BookingPress <= 1.0.64 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a720ad0e-6194-4df4-951e-e818518e79b5?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.64","to_inclusive":true,"patched_in":"1.0.65"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a720b38c-37f0-4edf-9868-de3a105551ee","source":"wordfence","cve":"CVE-2025-39361","title":"Royal Elementor Addons <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a720b38c-37f0-4edf-9868-de3a105551ee?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1017","to_inclusive":true,"patched_in":"1.7.1018"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:24:32Z"},{"id":"wordfence:a720fce1-25d6-4cab-96e2-99365b2148b5","source":"wordfence","cve":"CVE-2024-51692","title":"Bing Search API Integration <= 0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a720fce1-25d6-4cab-96e2-99365b2148b5?source=api-prod","affected":[{"type":"plugin","slug":"abbs-bing-search","name":"Bing Search API Integration","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:39:25Z"},{"id":"wordfence:a72261e5-7376-4a34-9264-27bd4f27e938","source":"wordfence","cve":"CVE-2026-93367","title":"Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a72261e5-7376-4a34-9264-27bd4f27e938?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics-pro","name":"Visitor Traffic Real Time Statistics pro","from":"*","from_inclusive":true,"to":"11.22","to_inclusive":true,"patched_in":"11.23"}],"published":"2026-10-01T14:53:24Z","updated":"2026-10-02T03:38:48Z"},{"id":"wordfence:a72639df-fa05-414c-b30c-eb285f59d945","source":"wordfence","cve":"CVE-2026-11896","title":"My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a72639df-fa05-414c-b30c-eb285f59d945?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2026-07-01T20:04:38Z","updated":"2026-07-02T08:33:06Z"},{"id":"wordfence:a7287c26-82c7-40d9-92a2-5102b65ba432","source":"wordfence","cve":"CVE-2025-23651","title":"Scroll Top \u2013 WordPress Scroll to Top <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7287c26-82c7-40d9-92a2-5102b65ba432?source=api-prod","affected":[{"type":"plugin","slug":"scroll-to-top-builder","name":"Scroll Top \u2013 WordPress Scroll to Top plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:23:31Z"},{"id":"wordfence:a72ce900-7999-45ee-a46a-6dd0a8f5931d","source":"wordfence","cve":"","title":"WP Live Chat Support <= 8.1.9 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a72ce900-7999-45ee-a46a-6dd0a8f5931d?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.1.9","to_inclusive":true,"patched_in":"8.2.0"}],"published":"2020-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a72d5e61-e3af-4ad8-bd38-5ded81741fc1","source":"wordfence","cve":"CVE-2026-77689","title":"Booking for Appointments and Events Calendar \u2013 Amelia 9.0 - 9.8.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a72d5e61-e3af-4ad8-bd38-5ded81741fc1?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"9.0","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:23:49Z"},{"id":"wordfence:a72e60d7-6019-4d88-88f4-22ec4dedbdd8","source":"wordfence","cve":"CVE-2014-4549","title":"WooCommerce SagePay Direct Payment Gateway < 0.1.6.7 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a72e60d7-6019-4d88-88f4-22ec4dedbdd8?source=api-prod","affected":[{"type":"plugin","slug":"sagepay-direct-for-woocommerce-payment-gateway","name":"WooCommerce SagePay Direct Payment Gateway","from":"*","from_inclusive":true,"to":"0.1.6.7","to_inclusive":false,"patched_in":"0.1.6.7"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a73089ab-a6df-4e3e-8d50-4add718e8c9d","source":"wordfence","cve":"CVE-2025-31061","title":"Wishlist <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73089ab-a6df-4e3e-8d50-4add718e8c9d?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"WordPress Wishlist Collection & Bookmark Plugin","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-16T15:33:11Z"},{"id":"wordfence:a7372314-fff1-42c4-99b6-10d7541d1a29","source":"wordfence","cve":"","title":"Wholesale Suite <= 2.1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7372314-fff1-42c4-99b6-10d7541d1a29?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.5.1"}],"published":"2022-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a739b805-e631-461e-802f-196e4117d403","source":"wordfence","cve":"","title":"WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a739b805-e631-461e-802f-196e4117d403?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"6.3.14","to_inclusive":true,"patched_in":"6.3.15"}],"published":"2016-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a739cb9a-0b09-4303-8d4a-16fca1152adf","source":"wordfence","cve":"CVE-2026-118205","title":"Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision","severity":"high","cvss":7.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a739cb9a-0b09-4303-8d4a-16fca1152adf?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":true,"patched_in":"6.8.8"}],"published":"2026-10-30T14:51:24Z","updated":"2026-10-30T17:15:30Z"},{"id":"wordfence:a73b425c-9777-4238-be3c-4667f0ea09d8","source":"wordfence","cve":"CVE-2026-92437","title":"Mailchimp for WooCommerce <= 6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73b425c-9777-4238-be3c-4667f0ea09d8?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-woocommerce","name":"Mailchimp for WooCommerce","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:47:56Z"},{"id":"wordfence:a73c2502-2bac-47b0-baf4-645314b2048b","source":"wordfence","cve":"CVE-2025-23684","title":"Debug Tool <= 2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73c2502-2bac-47b0-baf4-645314b2048b?source=api-prod","affected":[{"type":"plugin","slug":"debug-tool","name":"Debug Tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:12:26Z"},{"id":"wordfence:a73f3d93-198c-484c-bed5-59e477f3833e","source":"wordfence","cve":"CVE-2022-4677","title":"Leaflet Maps Marker < 3.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73f3d93-198c-484c-bed5-59e477f3833e?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"3.12.6","to_inclusive":true,"patched_in":"3.12.7"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a73f7812-771d-4d9f-9a7c-e4e01ec05023","source":"wordfence","cve":"CVE-2023-39307","title":"Avada <= 7.11.1 - Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73f7812-771d-4d9f-9a7c-e4e01ec05023?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.1","to_inclusive":true,"patched_in":"7.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a73f806d-5d64-4df5-b032-3d3a149036ff","source":"wordfence","cve":"CVE-2025-7813","title":"Event Manager, Events Calendar, Booking, Registrations and Tickets \u2013 Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a73f806d-5d64-4df5-b032-3d3a149036ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.37","to_inclusive":true,"patched_in":"4.0.38"}],"published":"2025-08-22T17:41:53Z","updated":"2025-08-23T05:48:21Z"},{"id":"wordfence:a741446e-8600-4e02-af76-0d34a491bcfd","source":"wordfence","cve":"CVE-2022-1320","title":"Slider by 10Web <= 1.2.51 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a741446e-8600-4e02-af76-0d34a491bcfd?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.51","to_inclusive":true,"patched_in":"1.2.52"}],"published":"2022-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7427a8e-df7c-4a9f-ab6f-b856afef003a","source":"wordfence","cve":"CVE-2024-49654","title":"Extra Privacy for Elementor <= 0.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7427a8e-df7c-4a9f-ab6f-b856afef003a?source=api-prod","affected":[{"type":"plugin","slug":"extra-privacy-for-elementor","name":"Extra Privacy for Elementor","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:58:31Z"},{"id":"wordfence:a743a2c5-61ba-43d4-bbc3-0f82969be78f","source":"wordfence","cve":"CVE-2025-39542","title":"Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a743a2c5-61ba-43d4-bbc3-0f82969be78f?source=api-prod","affected":[{"type":"plugin","slug":"xelion-webchat","name":"Xelion Webchat","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.2.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-30T13:34:45Z"},{"id":"wordfence:a7446251-ddd8-4d68-a5b3-67c6bb276eeb","source":"wordfence","cve":"CVE-2026-115596","title":"eCommerce Product Catalog <= 3.6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7446251-ddd8-4d68-a5b3-67c6bb276eeb?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2026-10-26T12:21:42Z","updated":"2026-11-03T19:26:55Z"},{"id":"wordfence:a745ce1b-13fd-470d-9685-62dfc11c9bd5","source":"wordfence","cve":"CVE-2025-49039","title":"Link View <= 0.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a745ce1b-13fd-470d-9685-62dfc11c9bd5?source=api-prod","affected":[{"type":"plugin","slug":"link-view","name":"Link View","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:07:19Z"},{"id":"wordfence:a748da73-9489-46f7-baf0-8c4ccc847dcf","source":"wordfence","cve":"CVE-2024-2697","title":"Swift Framework < 2024.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a748da73-9489-46f7-baf0-8c4ccc847dcf?source=api-prod","affected":[{"type":"plugin","slug":"socialdriver-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2024.0.0","to_inclusive":false,"patched_in":"2024.0.0"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-21T10:21:28Z"},{"id":"wordfence:a74d6b36-e0f1-4cfb-b1e9-0573081ed975","source":"wordfence","cve":"CVE-2023-46090","title":"Spider Facebook <= 1.0.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a74d6b36-e0f1-4cfb-b1e9-0573081ed975?source=api-prod","affected":[{"type":"plugin","slug":"spider-facebook","name":"WDSocialWidgets","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a74ef04c-6fa3-45c6-bab1-b3c730e4898d","source":"wordfence","cve":"CVE-2026-78193","title":"JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a74ef04c-6fa3-45c6-bab1-b3c730e4898d?source=api-prod","affected":[{"type":"plugin","slug":"woo-jtl-connector","name":"JTL-Connector for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:34:47Z","updated":"2026-10-14T03:40:02Z"},{"id":"wordfence:a74ef781-bf07-42b3-8cfd-c856be4f7859","source":"wordfence","cve":"CVE-2026-85347","title":"FV Player <= 7.5.56.7211 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a74ef781-bf07-42b3-8cfd-c856be4f7859?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7211","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:07:11Z"},{"id":"wordfence:a75020c0-8286-449a-9c51-0b1488350f09","source":"wordfence","cve":"CVE-2022-29442","title":"Private Messages For WordPress <= 2.1.10 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75020c0-8286-449a-9c51-0b1488350f09?source=api-prod","affected":[{"type":"plugin","slug":"private-messages-for-wordpress","name":"Private Messages For WordPress","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T12:13:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7519c43-d8d1-4412-b2f3-77f59736924c","source":"wordfence","cve":"CVE-2022-2597","title":"Visual Portfolio, Photo Gallery & Post Grid <= 2.18.0 - Contributor+ CSS Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7519c43-d8d1-4412-b2f3-77f59736924c?source=api-prod","affected":[{"type":"plugin","slug":"visual-portfolio","name":"Gallery by Visual Portfolio","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.19.0"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a752e211-5ae2-4b85-ac01-872dc829d84c","source":"wordfence","cve":"CVE-2024-29127","title":"Advanced Access Manager <= 6.9.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a752e211-5ae2-4b85-ac01-872dc829d84c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.9.20","to_inclusive":true,"patched_in":"6.9.21"}],"published":"2024-03-20T00:00:00Z","updated":"2024-03-20T18:46:54Z"},{"id":"wordfence:a753823a-1f95-430b-8b74-cc33f2ab018e","source":"wordfence","cve":"CVE-2024-2262","title":"Themify \u2013 WooCommerce Product Filter <= 1.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a753823a-1f95-430b-8b74-cc33f2ab018e?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-03-11T00:00:00Z","updated":"2024-04-24T15:19:20Z"},{"id":"wordfence:a753b4ba-9223-4eff-95e3-da7a1b2830a6","source":"wordfence","cve":"CVE-2019-9914","title":"YOP Poll <= 6.0.2 - Reflected Cross-Site Scripting via poll_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a753b4ba-9223-4eff-95e3-da7a1b2830a6?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":false,"patched_in":"6.0.3"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7566ac1-9ae2-44d2-8ad1-029957870992","source":"wordfence","cve":"CVE-2024-8792","title":"Subscribe to Comments <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7566ac1-9ae2-44d2-8ad1-029957870992?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-10-29T14:20:48Z","updated":"2024-10-30T02:32:19Z"},{"id":"wordfence:a756f7cd-d44a-49b6-af60-5f85d82c3ade","source":"wordfence","cve":"CVE-2026-93621","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.84 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a756f7cd-d44a-49b6-af60-5f85d82c3ade?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.84","to_inclusive":true,"patched_in":"5.5.85"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T16:49:56Z"},{"id":"wordfence:a758fcbe-1be0-4845-9ce9-795f3e5c4bd8","source":"wordfence","cve":"CVE-2015-9448","title":"SendPress Newsletters < 1.2 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a758fcbe-1be0-4845-9ce9-795f3e5c4bd8?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2015-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a759f4f4-6e0b-4754-b5b5-d110a050d0ba","source":"wordfence","cve":"CVE-2019-15829","title":"Gallery PhotoBlocks <= 1.1.42 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a759f4f4-6e0b-4754-b5b5-d110a050d0ba?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.1.43","to_inclusive":false,"patched_in":"1.1.43"}],"published":"2019-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a75b8e3a-6ce2-4257-beb7-6cf94e5285c4","source":"wordfence","cve":"CVE-2025-15657","title":"School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75b8e3a-6ce2-4257-beb7-6cf94e5285c4?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-15T00:00:00Z","updated":"2026-08-21T13:28:10Z"},{"id":"wordfence:a75c179f-236b-4a1b-8566-b74e0c5fda27","source":"wordfence","cve":"CVE-2021-25119","title":"AGIL(Automatic Grid Image Listing) <= 1.0 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75c179f-236b-4a1b-8566-b74e0c5fda27?source=api-prod","affected":[{"type":"plugin","slug":"automatic-grid-image-listing","name":"AGIL(Automatic Grid Image Listing)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a75e16dd-298e-4b7e-bd03-f1b6ac6521c7","source":"wordfence","cve":"CVE-2026-93342","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75e16dd-298e-4b7e-bd03-f1b6ac6521c7?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.71","to_inclusive":true,"patched_in":"2.1.72"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:04:49Z"},{"id":"wordfence:a75e2086-6857-42e9-bf35-176d6f17f173","source":"wordfence","cve":"CVE-2026-28090","title":"Gamezone <= 1.1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75e2086-6857-42e9-bf35-176d6f17f173?source=api-prod","affected":[{"type":"theme","slug":"gamezone","name":"gamezone","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T14:30:13Z"},{"id":"wordfence:a75f030b-8678-4de0-ae72-42a7d1eed456","source":"wordfence","cve":"CVE-2025-46511","title":"BeerXML Shortcode <= 0.7.1 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a75f030b-8678-4de0-ae72-42a7d1eed456?source=api-prod","affected":[{"type":"plugin","slug":"beerxml-shortcode","name":"BeerXML Shortcode","from":"*","from_inclusive":true,"to":"0.7.1","to_inclusive":true,"patched_in":"0.8"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-02T11:39:35Z"},{"id":"wordfence:a76077c6-700a-4d21-a930-b0d6455d959c","source":"wordfence","cve":"CVE-2023-3452","title":"Canto <= 3.0.4 - Unauthenticated Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76077c6-700a-4d21-a930-b0d6455d959c?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a763da69-47d2-4aad-842b-ce12f62af179","source":"wordfence","cve":"CVE-2025-46480","title":"Nepali Post Date <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a763da69-47d2-4aad-842b-ce12f62af179?source=api-prod","affected":[{"type":"plugin","slug":"nepali-post-date","name":"Nepali Post Date","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:36:19Z"},{"id":"wordfence:a7650da8-816d-4beb-a0e1-6ebd27bff7dd","source":"wordfence","cve":"CVE-2025-69059","title":"DiveIt <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7650da8-816d-4beb-a0e1-6ebd27bff7dd?source=api-prod","affected":[{"type":"theme","slug":"diveit","name":"DiveIt -  Scuba Diving School Travel WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:34:08Z"},{"id":"wordfence:a767f65e-bc7d-4576-af78-b77bd23dc089","source":"wordfence","cve":"CVE-2024-3492","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a767f65e-bc7d-4576-af78-b77bd23dc089?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.7.3","to_inclusive":true,"patched_in":"6.4.8"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-12T11:05:08Z"},{"id":"wordfence:a7689a95-7f63-46e1-b5fd-4279be66e0f0","source":"wordfence","cve":"CVE-2026-24954","title":"WpEvently <= 5.0.8 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7689a95-7f63-46e1-b5fd-4279be66e0f0?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2025-12-25T00:00:00Z","updated":"2026-02-10T19:41:04Z"},{"id":"wordfence:a76a6800-61ae-47e8-9659-47c08535516d","source":"wordfence","cve":"CVE-2026-32533","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76a6800-61ae-47e8-9659-47c08535516d?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:26:18Z"},{"id":"wordfence:a76a8e36-635a-48a3-8683-c24a0395212e","source":"wordfence","cve":"CVE-2025-11759","title":"Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76a8e36-635a-48a3-8683-c24a0395212e?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2025-12-04T13:31:53Z","updated":"2025-12-05T01:55:21Z"},{"id":"wordfence:a76dcb33-4c6b-44dc-9b27-6daf4f0a1376","source":"wordfence","cve":"CVE-2024-7561","title":"The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76dcb33-4c6b-44dc-9b27-6daf4f0a1376?source=api-prod","affected":[{"type":"theme","slug":"the-next","name":"The Next","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T01:50:32Z"},{"id":"wordfence:a76ded81-4c78-4054-9a26-7e215285a2b6","source":"wordfence","cve":"CVE-2024-43306","title":"WP-Lister Lite for eBay <= 3.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a76ded81-4c78-4054-9a26-7e215285a2b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:18:54Z"},{"id":"wordfence:a7701dd2-8452-4529-a931-db2553ca1ae5","source":"wordfence","cve":"","title":"Yoast SEO <= 3.2.4 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7701dd2-8452-4529-a931-db2553ca1ae5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2016-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a770204d-d89f-4c3e-a667-06ec1d96dbf7","source":"wordfence","cve":"CVE-2025-69307","title":"Medinik Core <= 1.3.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a770204d-d89f-4c3e-a667-06ec1d96dbf7?source=api-prod","affected":[{"type":"plugin","slug":"medinik-core","name":"Medinik Core","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:19:43Z"},{"id":"wordfence:a770ab37-127a-4018-9ffa-1b326d5a016e","source":"wordfence","cve":"CVE-2025-13884","title":"Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a770ab37-127a-4018-9ffa-1b326d5a016e?source=api-prod","affected":[{"type":"plugin","slug":"bg-hide-email-address","name":"Hide Email Address","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:24:22Z","updated":"2025-12-12T03:20:52Z"},{"id":"wordfence:a772041e-015e-48e8-9fab-79f1fcdb265c","source":"wordfence","cve":"CVE-2026-9860","title":"Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a772041e-015e-48e8-9fab-79f1fcdb265c?source=api-prod","affected":[{"type":"plugin","slug":"cf-images","name":"Offload, AI & Optimize with Cloudflare Images","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-06-17T16:18:12Z","updated":"2026-06-18T04:31:09Z"},{"id":"wordfence:a7764ea4-6c4b-47cf-a711-b92e56e03d3a","source":"wordfence","cve":"CVE-2026-39487","title":"Amelia <= 2.1.1 - Authenticated (Custom role+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7764ea4-6c4b-47cf-a711-b92e56e03d3a?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-03-25T00:00:00Z","updated":"2026-04-15T21:25:02Z"},{"id":"wordfence:a777c79e-a3ff-4f9d-90da-3a67a0176584","source":"wordfence","cve":"CVE-2024-39644","title":"Black Widgets For Elementor <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a777c79e-a3ff-4f9d-90da-3a67a0176584?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-08-01T00:00:00Z","updated":"2024-09-03T16:38:33Z"},{"id":"wordfence:a7795c3c-17fc-48aa-ae22-cbf6e241275e","source":"wordfence","cve":"CVE-2024-54439","title":"Amazon Product Price <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7795c3c-17fc-48aa-ae22-cbf6e241275e?source=api-prod","affected":[{"type":"plugin","slug":"amazon-product-price","name":"Amazon Product Price","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:51:52Z"},{"id":"wordfence:a77bc126-4dbd-4a26-b98c-946341d4282f","source":"wordfence","cve":"CVE-2026-3568","title":"MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a77bc126-4dbd-4a26-b98c-946341d4282f?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.18.3","to_inclusive":true,"patched_in":"4.18.4"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T02:25:06Z"},{"id":"wordfence:a77c8c09-5216-4190-89b7-28da4917295b","source":"wordfence","cve":"CVE-2025-53997","title":"Houzez <= 4.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a77c8c09-5216-4190-89b7-28da4917295b?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:57:19Z"},{"id":"wordfence:a77d0fb5-8829-407d-a40a-169cf0c5f837","source":"wordfence","cve":"CVE-2023-4242","title":"FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a77f8a2b-c61b-4942-93b5-202ebce4cf96","source":"wordfence","cve":"CVE-2010-4630","title":"WP Survey And Quiz Tool < 1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a77f8a2b-c61b-4942-93b5-202ebce4cf96?source=api-prod","affected":[{"type":"plugin","slug":"wp-survey-and-quiz-tool","name":"WP Survey And Quiz Tool","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2010-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a780ce1b-0758-42ef-88e7-ff8d921eca6e","source":"wordfence","cve":"CVE-2024-2618","title":"Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a780ce1b-0758-42ef-88e7-ff8d921eca6e?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.26.1"}],"published":"2024-05-23T15:59:44Z","updated":"2024-05-24T04:29:59Z"},{"id":"wordfence:a7826d47-8799-446f-af3c-df2724fb26ef","source":"wordfence","cve":"CVE-2024-32707","title":"Image Slider <= 1.1.125 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7826d47-8799-446f-af3c-df2724fb26ef?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.125","to_inclusive":true,"patched_in":"1.1.127"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:52:16Z"},{"id":"wordfence:a782d975-74ce-4265-9312-435b3585a5c6","source":"wordfence","cve":"CVE-2026-12385","title":"Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a782d975-74ce-4265-9312-435b3585a5c6?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.37","to_inclusive":true,"patched_in":"3.5.1.38"}],"published":"2026-07-13T06:13:11Z","updated":"2026-07-13T19:33:57Z"},{"id":"wordfence:a78321b7-b62b-40ab-a15d-037ebd905d8b","source":"wordfence","cve":"CVE-2023-52196","title":"CPT Bootstrap Carousel <= 1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78321b7-b62b-40ab-a15d-037ebd905d8b?source=api-prod","affected":[{"type":"plugin","slug":"cpt-bootstrap-carousel","name":"CPT Bootstrap Carousel","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7839847-2637-4a0d-bfc1-5f80b8433e24","source":"wordfence","cve":"CVE-2024-1053","title":"Event Tickets and Registration <= 5.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7839847-2637-4a0d-bfc1-5f80b8433e24?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.8.2"}],"published":"2024-02-21T00:00:00Z","updated":"2024-02-22T05:32:50Z"},{"id":"wordfence:a783ce82-a963-47c5-9c45-b5f3e25e0cc0","source":"wordfence","cve":"CVE-2026-115614","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a783ce82-a963-47c5-9c45-b5f3e25e0cc0?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-10-26T10:05:00Z","updated":"2026-10-28T01:24:03Z"},{"id":"wordfence:a7840931-4146-4618-bd6c-050225bd9e54","source":"wordfence","cve":"CVE-2026-62055","title":"Event Tickets and Registration <= 5.30.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7840931-4146-4618-bd6c-050225bd9e54?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.2","to_inclusive":true,"patched_in":"5.30.3"}],"published":"2026-10-30T16:11:00Z","updated":"2026-11-03T20:08:15Z"},{"id":"wordfence:a7856d0f-bc7d-436c-968c-631fd6a686ab","source":"wordfence","cve":"CVE-2026-0683","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7856d0f-bc7d-436c-968c-631fd6a686ab?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-01-30T00:00:00Z","updated":"2026-01-31T05:52:48Z"},{"id":"wordfence:a78998da-1cb1-4991-95a8-a551bde04064","source":"wordfence","cve":"CVE-2025-3431","title":"ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78998da-1cb1-4991-95a8-a551bde04064?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.91","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:29:44Z"},{"id":"wordfence:a78b76d6-4068-4141-9726-7db439aa6a9f","source":"wordfence","cve":"CVE-2023-6925","title":"Unlimited Addons for WPBakery Page Builder <= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78b76d6-4068-4141-9726-7db439aa6a9f?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-addons-for-wpbakery-page-builder","name":"Unlimited Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.0.42","to_inclusive":true,"patched_in":""}],"published":"2024-01-17T00:00:00Z","updated":"2024-02-05T21:21:56Z"},{"id":"wordfence:a78c2621-afff-40b4-ae45-831b2b847756","source":"wordfence","cve":"CVE-2026-2486","title":"Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78c2621-afff-40b4-ae45-831b2b847756?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-02-19T23:25:04Z","updated":"2026-02-20T11:26:39Z"},{"id":"wordfence:a78c46ac-22dd-48f2-a10b-016205f7e7fa","source":"wordfence","cve":"CVE-2023-49767","title":"Biteship <= 2.2.27 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78c46ac-22dd-48f2-a10b-016205f7e7fa?source=api-prod","affected":[{"type":"plugin","slug":"biteship","name":"Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo \u2013 Biteship","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2023-12-04T00:00:00Z","updated":"2024-03-29T17:24:32Z"},{"id":"wordfence:a78da5c5-fb12-4fc9-8c51-6d9f6f7a4043","source":"wordfence","cve":"CVE-2023-51488","title":"Crowdsignal Dashboard \u2013 Polls, Surveys & more <= 3.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78da5c5-fb12-4fc9-8c51-6d9f6f7a4043?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a78fced7-8c8c-4e98-8f06-2eea845cfb26","source":"wordfence","cve":"CVE-2024-31278","title":"Premium Addons for Elementor <= 4.10.22 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a78fced7-8c8c-4e98-8f06-2eea845cfb26?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.22","to_inclusive":true,"patched_in":"4.10.23"}],"published":"2024-04-05T00:00:00Z","updated":"2024-10-24T19:26:16Z"},{"id":"wordfence:a793b24f-979e-4209-93f7-cff8d3867a7d","source":"wordfence","cve":"CVE-2025-13404","title":"atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a793b24f-979e-4209-93f7-cff8d3867a7d?source=api-prod","affected":[{"type":"plugin","slug":"atec-duplicate-page-post","name":"atec Duplicate Page & Post","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":"1.2.21"}],"published":"2025-11-24T19:06:44Z","updated":"2025-11-25T07:28:23Z"},{"id":"wordfence:a7961bcc-eae7-40e1-8838-9755c7655500","source":"wordfence","cve":"CVE-2026-18547","title":"Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7961bcc-eae7-40e1-8838-9755c7655500?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-08-24T22:59:21Z","updated":"2026-08-25T11:27:12Z"},{"id":"wordfence:a7967b44-a3a1-48e5-a873-527348e2a88a","source":"wordfence","cve":"CVE-2024-47628","title":"LA-Studio Element Kit for Elementor <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7967b44-a3a1-48e5-a873-527348e2a88a?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.9.3","to_inclusive":true,"patched_in":"1.3.9.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:48:35Z"},{"id":"wordfence:a7975ee9-5482-4b1b-b88f-6eb5fc5d446d","source":"wordfence","cve":"CVE-2026-27091","title":"UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7975ee9-5482-4b1b-b88f-6eb5fc5d446d?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.09","to_inclusive":true,"patched_in":"3.5.10"}],"published":"2026-03-10T00:00:00Z","updated":"2026-09-09T16:06:06Z"},{"id":"wordfence:a7982828-bc67-48ee-be80-3203b081e29b","source":"wordfence","cve":"CVE-2015-9453","title":"Broken Link Manager < 0.6.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7982828-bc67-48ee-be80-3203b081e29b?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-manager","name":"Broken Link Manager","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":false,"patched_in":"0.6.0"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a798fa9b-ddac-4c03-9221-bbccbab1b39b","source":"wordfence","cve":"CVE-2026-48193","title":"Uminex - Multipurpose WooCommerce Theme <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a798fa9b-ddac-4c03-9221-bbccbab1b39b?source=api-prod","affected":[{"type":"theme","slug":"uminex","name":"Uminex - Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T13:35:21Z","updated":"2026-10-13T13:52:51Z"},{"id":"wordfence:a798ffe0-b81d-4c5f-a864-ed72a5312a16","source":"wordfence","cve":"CVE-2024-32723","title":"Advanced Floating Content Lite <= 1.2.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a798ffe0-b81d-4c5f-a864-ed72a5312a16?source=api-prod","affected":[{"type":"plugin","slug":"advanced-floating-content-lite","name":"Advanced Floating Content Lite","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:59:15Z"},{"id":"wordfence:a79b37b0-e5b1-4018-a0ef-97aa22f37599","source":"wordfence","cve":"CVE-2025-53232","title":"WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a79b37b0-e5b1-4018-a0ef-97aa22f37599?source=api-prod","affected":[{"type":"plugin","slug":"wp-gmail-smtp","name":"WP Gmail SMTP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-15T15:51:24Z"},{"id":"wordfence:a79bc789-ee03-4b7b-9835-5e20a4a70714","source":"wordfence","cve":"CVE-2025-29002","title":"Simen <= 4.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a79bc789-ee03-4b7b-9835-5e20a4a70714?source=api-prod","affected":[{"type":"theme","slug":"snssimen","name":"Simen - MultiPurpose WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:49:11Z"},{"id":"wordfence:a79c783f-9581-449d-a431-022b30af0d39","source":"wordfence","cve":"CVE-2025-24637","title":"Beacon Lead Magnets and Lead Capture <= 1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a79c783f-9581-449d-a431-022b30af0d39?source=api-prod","affected":[{"type":"plugin","slug":"beacon-by","name":"Beacon Lead Magnets and Lead Capture","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2025-01-06T00:00:00Z","updated":"2025-04-22T22:14:57Z"},{"id":"wordfence:a79f6657-31b1-48d5-99a9-fc39cc4d572a","source":"wordfence","cve":"CVE-2026-5776","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a79f6657-31b1-48d5-99a9-fc39cc4d572a?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":false,"patched_in":"2.4.7"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:19:14Z"},{"id":"wordfence:a7a39309-f066-4d4c-9fe1-f6d3c268b51e","source":"wordfence","cve":"CVE-2025-23956","title":"WP Easy Post Mailer <= 0.64 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7a39309-f066-4d4c-9fe1-f6d3c268b51e?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailer","name":"WP Easy Post Mailer","from":"*","from_inclusive":true,"to":"0.64","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-14T17:01:57Z"},{"id":"wordfence:a7a53ba2-e983-4821-b3de-105a96b7cb0e","source":"wordfence","cve":"CVE-2026-6415","title":"Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7a53ba2-e983-4821-b3de-105a96b7cb0e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-font-awesome","name":"Advanced Custom Fields: Font Awesome Field","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-15T07:46:38Z"},{"id":"wordfence:a7a61446-a5ef-44e4-bd64-9c2e844953fb","source":"wordfence","cve":"CVE-2022-1788","title":"Change Uploaded File Permissions <= 4.0.0 - Cross-Site Request Forgery to Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7a61446-a5ef-44e4-bd64-9c2e844953fb?source=api-prod","affected":[{"type":"plugin","slug":"change-uploaded-file-permissions","name":"Change Uploaded File Permissions","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7a877d3-69b2-427b-9b5c-fb3ca93b4c09","source":"wordfence","cve":"CVE-2023-38516","title":"Audio Player with Playlist Ultimate <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7a877d3-69b2-427b-9b5c-fb3ca93b4c09?source=api-prod","affected":[{"type":"plugin","slug":"audio-player-with-playlist-ultimate","name":"Audio Player with Playlist Ultimate","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7aa2246-aee9-4992-b030-97e78e3b7d22","source":"wordfence","cve":"CVE-2026-7618","title":"Env\u00edaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7aa2246-aee9-4992-b030-97e78e3b7d22?source=api-prod","affected":[{"type":"plugin","slug":"envialosimple-email-marketing-y-newsletters-gratis","name":"Env\u00edaloSimple: Email Marketing y Newsletters","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-05-26T17:33:11Z","updated":"2026-07-08T20:53:39Z"},{"id":"wordfence:a7ab6992-25be-44b3-9308-8a6faaa3cb5b","source":"wordfence","cve":"CVE-2026-87839","title":"Tripzzy <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ab6992-25be-44b3-9308-8a6faaa3cb5b?source=api-prod","affected":[{"type":"plugin","slug":"tripzzy","name":"Tripzzy \u2013 Travel Engine System","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:45:17Z"},{"id":"wordfence:a7ac96db-2d9a-4eaf-8916-a02e3e64ca4a","source":"wordfence","cve":"CVE-2024-1893","title":"Easy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ac96db-2d9a-4eaf-8916-a02e3e64ca4a?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2024-03-21T00:00:00Z","updated":"2024-07-31T15:44:21Z"},{"id":"wordfence:a7ad5c95-f092-4951-b87c-9a29b21b7a6e","source":"wordfence","cve":"CVE-2025-32242","title":"Hive Support <= 1.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ad5c95-f092-4951-b87c-9a29b21b7a6e?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-04-07T00:00:00Z","updated":"2025-06-17T14:14:51Z"},{"id":"wordfence:a7adba0a-2f3b-43d8-b00a-8521dd0c6a2d","source":"wordfence","cve":"CVE-2021-24747","title":"SEO Booster <= 3.7 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7adba0a-2f3b-43d8-b00a-8521dd0c6a2d?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7ae4294-3f20-4f97-ae74-858121280c01","source":"wordfence","cve":"","title":"Source (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ae4294-3f20-4f97-ae74-858121280c01?source=api-prod","affected":[{"type":"theme","slug":"source","name":"Source","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7af1a03-8382-4593-a41f-8cdb1bb9e53b","source":"wordfence","cve":"CVE-2024-3518","title":"Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7af1a03-8382-4593-a41f-8cdb1bb9e53b?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.15","to_inclusive":true,"patched_in":"3.16"}],"published":"2024-05-21T11:12:32Z","updated":"2024-05-21T23:30:41Z"},{"id":"wordfence:a7af6721-4886-4bec-8931-992881310f26","source":"wordfence","cve":"CVE-2021-25081","title":"WP Google Map <= 1.8.3 - Arbitrary Post Deletion and Plugin Settings Update via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7af6721-4886-4bec-8931-992881310f26?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2022-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7b1871d-9d26-4bdc-bd20-0535143902d4","source":"wordfence","cve":"CVE-2023-32297","title":"LWS Affiliation <= 2.2.6 - Unauthenticated Remote/Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7b1871d-9d26-4bdc-bd20-0535143902d4?source=api-prod","affected":[{"type":"plugin","slug":"lws-affiliation","name":"LWS Affiliation","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7b25b66-e9d1-448d-8367-cce4c0dec635","source":"wordfence","cve":"CVE-2024-1109","title":"Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7b25b66-e9d1-448d-8367-cce4c0dec635?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T11:02:39Z"},{"id":"wordfence:a7b370e1-0b6f-49bd-89ec-794f0a404c31","source":"wordfence","cve":"CVE-2024-50518","title":"Pricer Ninja <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7b370e1-0b6f-49bd-89ec-794f0a404c31?source=api-prod","affected":[{"type":"plugin","slug":"pricer-ninja-pricing-tables","name":"Pricer Ninja: Create and add responsive Pricing Tables to your website on-the-fly","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T20:08:53Z"},{"id":"wordfence:a7bc0a91-a2b0-46e2-b961-368881cc1074","source":"wordfence","cve":"CVE-2025-15674","title":"Content Protector (Passster) <= 4.3.6 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7bc0a91-a2b0-46e2-b961-368881cc1074?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-17T15:51:13Z"},{"id":"wordfence:a7bd173c-dc61-4cc6-b42f-311acf728080","source":"wordfence","cve":"CVE-2023-0329","title":"Elementor <= 3.12.1 - Authenticated(Administrator+) SQL Injection via 'replace_urls'","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7bd173c-dc61-4cc6-b42f-311acf728080?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.12.2","to_inclusive":false,"patched_in":"3.12.2"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7beb9b3-3e4e-4aa2-b174-ecd9307cb3d0","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadRedirectSettings' function","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7beb9b3-3e4e-4aa2-b174-ecd9307cb3d0?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7beba4f-7704-4b98-9391-de85f86219aa","source":"wordfence","cve":"CVE-2024-37483","title":"The Post Grid <= 7.7.4 - Missing Authorization via save_block_css","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7beba4f-7704-4b98-9391-de85f86219aa?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.4","to_inclusive":true,"patched_in":"7.7.5"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:51:39Z"},{"id":"wordfence:a7c10b81-bdbb-4089-8d89-42ad2a1fa78f","source":"wordfence","cve":"CVE-2026-32469","title":"CAPTCHA 4WP \u2013 Antispam CAPTCHA solution for WordPress <= 7.6.0 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c10b81-bdbb-4089-8d89-42ad2a1fa78f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-nocaptcha-recaptcha","name":"CAPTCHA 4WP \u2013 Antispam CAPTCHA solution for WordPress","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2026-08-06T00:00:00Z","updated":"2026-09-09T16:09:39Z"},{"id":"wordfence:a7c19095-3c21-440f-aa28-0117aea29d97","source":"wordfence","cve":"CVE-2023-45829","title":"Newsletter & Bulk Email Sender <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c19095-3c21-440f-aa28-0117aea29d97?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-bulk-email","name":"Newsletter & Bulk Email Sender \u2013 Email Newsletter Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7c31409-c84a-4197-b08c-b70df5e66a80","source":"wordfence","cve":"CVE-2024-2694","title":"Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c31409-c84a-4197-b08c-b70df5e66a80?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"27.5.6","to_inclusive":true,"patched_in":"27.5.7"}],"published":"2024-08-29T16:01:16Z","updated":"2024-10-29T12:43:08Z"},{"id":"wordfence:a7c32efa-1872-4302-a947-dc0005080e55","source":"wordfence","cve":"","title":"Citizen Space <= 1.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c32efa-1872-4302-a947-dc0005080e55?source=api-prod","affected":[{"type":"plugin","slug":"citizen-space","name":"Citizen Space","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2015-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7c7267e-81b2-4a03-b1fc-254b8233d6d0","source":"wordfence","cve":"CVE-2024-5727","title":"Widget4Call <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c7267e-81b2-4a03-b1fc-254b8233d6d0?source=api-prod","affected":[{"type":"plugin","slug":"widget4call","name":"Widget4Call","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-13T15:01:27Z"},{"id":"wordfence:a7c786fe-898e-4478-97b9-c1fb41c9081c","source":"wordfence","cve":"CVE-2024-13428","title":"WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c786fe-898e-4478-97b9-c1fb41c9081c?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:39Z"},{"id":"wordfence:a7c949f0-fcd1-4984-95a2-b19fb72f04bb","source":"wordfence","cve":"CVE-2024-0381","title":"WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c949f0-fcd1-4984-95a2-b19fb72f04bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:37:04Z"},{"id":"wordfence:a7ce9573-eda5-45c0-8775-966f2fbe9496","source":"wordfence","cve":"CVE-2023-31235","title":"Participants Database <= 2.4.9 - Cross-Site Request Forgery via _process_general","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ce9573-eda5-45c0-8775-966f2fbe9496?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7cf1c70-9778-4b50-b494-d0b1d0277b35","source":"wordfence","cve":"","title":"EmbedPress <= 3.9.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7cf1c70-9778-4b50-b494-d0b1d0277b35?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.5"}],"published":"2023-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7d0811b-0097-4e8e-b585-a83fb807fa74","source":"wordfence","cve":"CVE-2026-110510","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.8.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d0811b-0097-4e8e-b585-a83fb807fa74?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":false,"patched_in":"6.8.7"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:09:00Z"},{"id":"wordfence:a7d0deb3-3d04-4f85-b769-0894d7c6ee7c","source":"wordfence","cve":"","title":"Easy Forms for Mailchimp <= 6.6.2 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d0deb3-3d04-4f85-b769-0894d7c6ee7c?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.6.3","to_inclusive":false,"patched_in":"6.6.3"}],"published":"2020-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7d13d78-4d3f-476a-ba67-b47d0195a1ed","source":"wordfence","cve":"CVE-2024-29927","title":"WishSuite <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d13d78-4d3f-476a-ba67-b47d0195a1ed?source=api-prod","affected":[{"type":"plugin","slug":"wishsuite","name":"WishSuite \u2013 Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-10T18:58:00Z"},{"id":"wordfence:a7d340b9-6a77-481c-983c-f4774ecff285","source":"wordfence","cve":"CVE-2024-9271","title":"Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d340b9-6a77-481c-983c-f4774ecff285?source=api-prod","affected":[{"type":"plugin","slug":"rewp","name":"Re:WP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-10-03T21:12:17Z","updated":"2024-10-04T09:30:42Z"},{"id":"wordfence:a7d3e6ce-e6d7-455b-a43d-a14189b30491","source":"wordfence","cve":"CVE-2026-15550","title":"Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d3e6ce-e6d7-455b-a43d-a14189b30491?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-save-progress","name":"Ninja Forms - Save Progress","from":"*","from_inclusive":true,"to":"3.0.30","to_inclusive":true,"patched_in":"3.0.31"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T11:28:48Z"},{"id":"wordfence:a7d5e21e-8046-42bd-9c11-998d0d1bd822","source":"wordfence","cve":"CVE-2025-39405","title":"WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d5e21e-8046-42bd-9c11-998d0d1bd822?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:44:45Z"},{"id":"wordfence:a7d5edee-04fb-41e0-be5e-ca3681956d2d","source":"wordfence","cve":"CVE-2023-47545","title":"Forms for Mailchimp by Optin Cat <= 2.5.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d5edee-04fb-41e0-be5e-ca3681956d2d?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-wp","name":"Forms for Mailchimp by Optin Cat \u2013 Grow Your MailChimp List","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7d60b45-409f-430d-9ab0-2dcb7dafb02a","source":"wordfence","cve":"CVE-2026-92411","title":"Delicious <= 1.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d60b45-409f-430d-9ab0-2dcb7dafb02a?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.10.7","to_inclusive":true,"patched_in":"1.10.8"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:59:45Z"},{"id":"wordfence:a7da2b5d-8e0c-492a-a6a6-7302cd277d0b","source":"wordfence","cve":"CVE-2022-29923","title":"Quick Restaurant Reservations <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7da2b5d-8e0c-492a-a6a6-7302cd277d0b?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-reservations","name":"Quick Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2022-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7dc19a6-1d3e-4648-9b68-16d75e80b00b","source":"wordfence","cve":"CVE-2026-16264","title":"Newsletters <= 4.18.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7dc19a6-1d3e-4648-9b68-16d75e80b00b?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.0","to_inclusive":true,"patched_in":"4.18.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:46:00Z"},{"id":"wordfence:a7dd1215-af79-45db-9893-a5f4299e1343","source":"wordfence","cve":"CVE-2026-22209","title":"Comments \u2013 wpDiscuz <= 7.6.46 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7dd1215-af79-45db-9893-a5f4299e1343?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.46","to_inclusive":true,"patched_in":"7.6.47"}],"published":"2026-03-12T00:00:00Z","updated":"2026-07-30T12:35:12Z"},{"id":"wordfence:a7dee387-06fc-43c1-88e8-a8ffd9c5718e","source":"wordfence","cve":"CVE-2026-110384","title":"Fancy Comments WordPress <= 1.2.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7dee387-06fc-43c1-88e8-a8ffd9c5718e?source=api-prod","affected":[{"type":"plugin","slug":"fancy-facebook-comments","name":"Fancy Comments WordPress","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":""}],"published":"2026-10-15T06:24:39Z","updated":"2026-10-23T18:21:02Z"},{"id":"wordfence:a7e1fd8f-548e-4fb2-9ee4-b24c412aaa8e","source":"wordfence","cve":"CVE-2026-19797","title":"User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e1fd8f-548e-4fb2-9ee4-b24c412aaa8e?source=api-prod","affected":[{"type":"plugin","slug":"user-access-manager","name":"User Access Manager","from":"*","from_inclusive":true,"to":"2.3.18","to_inclusive":true,"patched_in":"2.3.19"}],"published":"2026-09-08T15:00:03Z","updated":"2026-09-09T03:28:49Z"},{"id":"wordfence:a7e24341-b085-4412-aa7b-42712cd94f35","source":"wordfence","cve":"","title":"Simple Slider < 1.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e24341-b085-4412-aa7b-42712cd94f35?source=api-prod","affected":[{"type":"plugin","slug":"simple-slider","name":"Simple Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7e27a6c-8b14-459b-aba2-044f311edf9e","source":"wordfence","cve":"CVE-2024-12448","title":"Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e27a6c-8b14-459b-aba2-044f311edf9e?source=api-prod","affected":[{"type":"plugin","slug":"posts-and-products-views","name":"Posts and Products Views for WooCommerce","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-12-13T15:49:08Z","updated":"2025-01-15T15:03:33Z"},{"id":"wordfence:a7e35f18-7659-4b97-b99f-b57ac941cb22","source":"wordfence","cve":"CVE-2026-15293","title":"WP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification","severity":"high","cvss":8.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e35f18-7659-4b97-b99f-b57ac941cb22?source=api-prod","affected":[{"type":"plugin","slug":"wp-business-intelligence-lite","name":"WP Business Intelligence Lite","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:06:15Z","updated":"2026-07-10T04:31:25Z"},{"id":"wordfence:a7e3818c-883f-4633-a460-a8c0446edffc","source":"wordfence","cve":"CVE-2023-33314","title":"BEAR <= 1.1.3.1 - Cross-Site Request Forgery via Multiple Functions","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e3818c-883f-4633-a460-a8c0446edffc?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.1","to_inclusive":true,"patched_in":"1.1.3.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7e58c6d-5b95-4b22-a7fc-e5e8324ed52a","source":"wordfence","cve":"CVE-2022-1338","title":"Easily Generate Rest API Url <= 1.0.0 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e58c6d-5b95-4b22-a7fc-e5e8324ed52a?source=api-prod","affected":[{"type":"plugin","slug":"easily-generate-rest-api-url","name":"Easily Generate Rest API Url","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7e6acce-ba76-488d-8dde-5b5895c30872","source":"wordfence","cve":"CVE-2026-81285","title":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e6acce-ba76-488d-8dde-5b5895c30872?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:57:56Z"},{"id":"wordfence:a7e8eb75-ba48-4385-9ddd-800d9bb907f1","source":"wordfence","cve":"CVE-2016-5839","title":"WordPress Core < 4.5.3 - Bypass sanitize_file_name Protection","severity":"high","cvss":7.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e8eb75-ba48-4385-9ddd-800d9bb907f1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7ea99e7-2502-42a2-b037-2040114a8055","source":"wordfence","cve":"CVE-2014-9523","title":"Our Team Showcase < 1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ea99e7-2502-42a2-b037-2040114a8055?source=api-prod","affected":[{"type":"plugin","slug":"our-team-enhanced","name":"Our Team Showcase","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7ec331c-51ea-466a-ab7b-4234df47114a","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'liveSearch' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ec331c-51ea-466a-ab7b-4234df47114a?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7ed1cbd-1dd0-4996-8255-91a9131934c0","source":"wordfence","cve":"CVE-2024-37446","title":"Chained Quiz <= 1.3.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ed1cbd-1dd0-4996-8255-91a9131934c0?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.8","to_inclusive":true,"patched_in":"1.3.2.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:43:37Z"},{"id":"wordfence:a7eda2c1-4c1b-41e1-a4e7-fd1aeca3f508","source":"wordfence","cve":"CVE-2025-39541","title":"WP Simple Booking Calendar <= 2.0.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7eda2c1-4c1b-41e1-a4e7-fd1aeca3f508?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-booking-calendar","name":"WP Simple Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.13","to_inclusive":true,"patched_in":"2.0.14"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:24:55Z"},{"id":"wordfence:a7eeb557-0528-422a-aae7-3f99154953df","source":"wordfence","cve":"CVE-2025-12122","title":"Popup Box \u2013 Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7eeb557-0528-422a-aae7-3f99154953df?source=api-prod","affected":[{"type":"plugin","slug":"popup-box","name":"Popup Box \u2013 Easily Create WordPress Popups","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2026-02-17T16:37:54Z","updated":"2026-02-18T05:29:18Z"},{"id":"wordfence:a7ef66cf-ddf1-42be-82b1-cb6edcbf253c","source":"wordfence","cve":"CVE-2025-4964","title":"WP Online Users Stats <= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ef66cf-ddf1-42be-82b1-cb6edcbf253c?source=api-prod","affected":[{"type":"plugin","slug":"wp-online-users-stats","name":"WP Online Users Stats","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:51:20Z","updated":"2025-06-06T06:42:52Z"},{"id":"wordfence:a7efbdb1-989f-4171-ab55-aff66014337a","source":"wordfence","cve":"CVE-2021-4412","title":"WP Prayer <= 1.6.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7efbdb1-989f-4171-ab55-aff66014337a?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2021-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3","source":"wordfence","cve":"CVE-2024-5992","title":"Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=api-prod","affected":[{"type":"plugin","slug":"cliengo","name":"Cliengo \u2013 Chatbot","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-07-08T19:56:10Z","updated":"2024-08-01T20:17:48Z"},{"id":"wordfence:a7f1a21c-2de0-4f41-b61e-7c4742900762","source":"wordfence","cve":"CVE-2025-8719","title":"Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f1a21c-2de0-4f41-b61e-7c4742900762?source=api-prod","affected":[{"type":"plugin","slug":"translate-this-google-translate-web-element-shortcode","name":"Translate This gTranslate Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T19:50:51Z","updated":"2025-08-16T08:27:07Z"},{"id":"wordfence:a7f22854-049a-4b4f-a448-13c416e0a6b7","source":"wordfence","cve":"CVE-2026-9184","title":"24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f22854-049a-4b4f-a448-13c416e0a6b7?source=api-prod","affected":[{"type":"plugin","slug":"24liveblog","name":"24liveblog \u2013 live blog tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:39:07Z","updated":"2026-06-24T05:33:28Z"},{"id":"wordfence:a7f2a3b2-868a-4297-a609-73cb189e8cfc","source":"wordfence","cve":"CVE-2025-53336","title":"My Resume Builder <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f2a3b2-868a-4297-a609-73cb189e8cfc?source=api-prod","affected":[{"type":"plugin","slug":"my-resume-builder","name":"My Resume Builder","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:37:14Z"},{"id":"wordfence:a7f82847-433d-49b1-815d-b0d9e70068c2","source":"wordfence","cve":"","title":"Instantio \u2013 WooCommerce Quick Checkout | Instant Checkout, Side Cart & Popup Cart <= 1.2.5 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f82847-433d-49b1-815d-b0d9e70068c2?source=api-prod","affected":[{"type":"plugin","slug":"instantio","name":"Instantio \u2014 Side Cart & One-Page Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7f947ee-6bb0-455f-9824-effa1164c7b8","source":"wordfence","cve":"CVE-2020-15536","title":"Online Hotel Booking System Pro <= 1.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f947ee-6bb0-455f-9824-effa1164c7b8?source=api-prod","affected":[{"type":"plugin","slug":"bsi-hotel-pro","name":"Online Hotel Booking System Pro","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a7faa800-3b29-4b79-8b94-1e7985acb50d","source":"wordfence","cve":"CVE-2024-11038","title":"WPB Popup for Contact Form 7 \u2013 Showing The Contact Form 7 Popup on Button Click \u2013 CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7faa800-3b29-4b79-8b94-1e7985acb50d?source=api-prod","affected":[{"type":"plugin","slug":"wpb-popup-for-contact-form-7","name":"WPB Popup for Contact Form 7 \u2013 Showing Contact Form 7 Popup on Button Click","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2024-11-18T23:01:41Z","updated":"2024-11-19T11:02:28Z"},{"id":"wordfence:a7ffc02d-190b-4494-a43f-1825914145ff","source":"wordfence","cve":"CVE-2024-49283","title":"CURCY <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a7ffc02d-190b-4494-a43f-1825914145ff?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-11T15:50:52Z"},{"id":"wordfence:a80007be-fb94-4460-91e8-f09b537580ca","source":"wordfence","cve":"CVE-2026-25346","title":"FAQ Builder AYS <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80007be-fb94-4460-91e8-f09b537580ca?source=api-prod","affected":[{"type":"plugin","slug":"faq-builder-ays","name":"FAQ Builder AYS","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:48:41Z"},{"id":"wordfence:a8059995-55cb-49ee-add1-f5364d0772eb","source":"wordfence","cve":"CVE-2026-3516","title":"Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8059995-55cb-49ee-add1-f5364d0772eb?source=api-prod","affected":[{"type":"plugin","slug":"contact-list","name":"Contact List \u2013 Online Staff Directory & Address Book","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":true,"patched_in":"3.0.19"}],"published":"2026-03-20T10:58:51Z","updated":"2026-03-20T23:25:12Z"},{"id":"wordfence:a807658d-cdfc-48cc-8dfe-1dd2773fcbcf","source":"wordfence","cve":"CVE-2024-38786","title":"CoziPress <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a807658d-cdfc-48cc-8dfe-1dd2773fcbcf?source=api-prod","affected":[{"type":"theme","slug":"cozipress","name":"CoziPress","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":""}],"published":"2024-07-19T00:00:00Z","updated":"2024-12-20T20:58:06Z"},{"id":"wordfence:a8077d07-acaf-40f2-bc0f-e28a44ead94c","source":"wordfence","cve":"CVE-2022-45810","title":"Icegram Express <= 5.5.2 - Unauthenticated CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8077d07-acaf-40f2-bc0f-e28a44ead94c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8082c60-436d-42e3-8aa5-cd2cb8ce6355","source":"wordfence","cve":"CVE-2019-17230","title":"OneTone <= 3.0.6 & OneTone Companion <= 1.1.1 - Unauthenticated Settings Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8082c60-436d-42e3-8aa5-cd2cb8ce6355?source=api-prod","affected":[{"type":"theme","slug":"onetone","name":"OneTone","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"onetone-companion","name":"OneTone Companion","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a809de9f-e552-4ed0-914a-a37992dcab4b","source":"wordfence","cve":"CVE-2025-69180","title":"Ultra Portfolio <= 6.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a809de9f-e552-4ed0-914a-a37992dcab4b?source=api-prod","affected":[{"type":"plugin","slug":"ultra-portfolio","name":"Ultra Portfolio","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:33:51Z"},{"id":"wordfence:a80a3108-c685-4e26-9ecd-a0fe6ad4860c","source":"wordfence","cve":"CVE-2024-5553","title":"Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80a3108-c685-4e26-9ecd-a0fe6ad4860c?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.33","to_inclusive":true,"patched_in":"4.10.34"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-12T03:18:16Z"},{"id":"wordfence:a80c306e-323b-4ab4-955b-4e264625731c","source":"wordfence","cve":"","title":"Fancy Product Designer <= 4.5.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80c306e-323b-4ab4-955b-4e264625731c?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2020-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a80d13c7-21e4-4cb5-b28d-340668732c0a","source":"wordfence","cve":"CVE-2008-7321","title":"TubePress < 1.6.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80d13c7-21e4-4cb5-b28d-340668732c0a?source=api-prod","affected":[{"type":"plugin","slug":"tubepress","name":"TubePress","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2008-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a80d9d77-75f6-4db4-bf35-b51bac1b4a0e","source":"wordfence","cve":"CVE-2025-62958","title":"Simple Content Templates for Blog Posts & Pages <= 2.2.61 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80d9d77-75f6-4db4-bf35-b51bac1b4a0e?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-template","name":"Simple Content Templates for Blog Posts & Pages","from":"*","from_inclusive":true,"to":"2.2.61","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:45:35Z"},{"id":"wordfence:a80f3c4c-1aa3-441a-9058-65ba4c7ccaef","source":"wordfence","cve":"CVE-2026-27543","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80f3c4c-1aa3-441a-9058-65ba4c7ccaef?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.20.0","to_inclusive":true,"patched_in":"4.21.0"}],"published":"2026-08-11T00:00:00Z","updated":"2026-09-17T15:02:02Z"},{"id":"wordfence:a80fe2bf-9c4f-41ca-8ac9-2752ed8304fd","source":"wordfence","cve":"CVE-2026-95607","title":"WPLMS Learning Management System for WordPress, WordPress LMS <= 4.973 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a80fe2bf-9c4f-41ca-8ac9-2752ed8304fd?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"4.973","to_inclusive":true,"patched_in":"4.974"}],"published":"2026-10-02T08:55:41Z","updated":"2026-10-13T14:31:57Z"},{"id":"wordfence:a81029fe-db29-4dd4-8450-65d1764855f1","source":"wordfence","cve":"CVE-2026-118267","title":"WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert","severity":"high","cvss":8.1,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.89","to_inclusive":true,"patched_in":"5.5.90"}],"published":"2026-11-06T21:37:24Z","updated":"2026-11-07T11:26:32Z"},{"id":"wordfence:a813251b-a4c1-4b23-ad03-dcc1f4f19eb9","source":"wordfence","cve":"CVE-2023-3213","title":"WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a813251b-a4c1-4b23-ad03-dcc1f4f19eb9?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-smtp-pro","name":"WP Mail SMTP Pro","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a813ede7-2660-4dbb-80e0-68b22e5a116c","source":"wordfence","cve":"CVE-2025-27345","title":"Booking Ultra Pro <= 1.1.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a813ede7-2660-4dbb-80e0-68b22e5a116c?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-12T13:21:28Z"},{"id":"wordfence:a815496c-cd68-4ab4-a3bd-5fdcf59d02a6","source":"wordfence","cve":"CVE-2025-31002","title":"Squeeze <= 1.6 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a815496c-cd68-4ab4-a3bd-5fdcf59d02a6?source=api-prod","affected":[{"type":"plugin","slug":"squeeze","name":"Squeeze \u2013 Browser-Based Image Compression & WebP Converter (No API, No Limits)","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:00:43Z"},{"id":"wordfence:a815be9a-94dd-4f25-a480-d933752cd856","source":"wordfence","cve":"CVE-2025-62144","title":"Core Web Vitals & PageSpeed Booster <= 1.0.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a815be9a-94dd-4f25-a480-d933752cd856?source=api-prod","affected":[{"type":"plugin","slug":"core-web-vitals-pagespeed-booster","name":"Core Web Vitals & PageSpeed Booster","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:31:00Z"},{"id":"wordfence:a8161eb7-d854-4f5c-a9f9-9f8163f79222","source":"wordfence","cve":"CVE-2025-54689","title":"Urna <= 2.5.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8161eb7-d854-4f5c-a9f9-9f8163f79222?source=api-prod","affected":[{"type":"theme","slug":"urna","name":"Urna - All-in-one WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:43:31Z"},{"id":"wordfence:a8163dc0-e380-4a0b-bd18-34a3e80ca3dd","source":"wordfence","cve":"","title":"VR Calendar <= 2.4.4 - Authenticated (Administrator+) Local File Inclusion","severity":"medium","cvss":6.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8163dc0-e380-4a0b-bd18-34a3e80ca3dd?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2022-07-28T00:00:00Z","updated":"2024-10-04T13:08:45Z"},{"id":"wordfence:a816e5a8-2494-4bcf-869d-5214b21f7791","source":"wordfence","cve":"CVE-2025-4601","title":"RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a816e5a8-2494-4bcf-869d-5214b21f7791?source=api-prod","affected":[{"type":"theme","slug":"realhomes","name":"RH - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2025-06-09T14:53:33Z","updated":"2026-05-04T14:42:10Z"},{"id":"wordfence:a817c960-37e9-4f72-a2ef-845d9b898d48","source":"wordfence","cve":"CVE-2021-26256","title":"Survey Maker <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a817c960-37e9-4f72-a2ef-845d9b898d48?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-12-03T10:28:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a818abe9-5520-4c63-9b41-52865ebd1820","source":"wordfence","cve":"CVE-2025-22825","title":"Flexible PDF Coupons <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a818abe9-5520-4c63-9b41-52865ebd1820?source=api-prod","affected":[{"type":"plugin","slug":"flexible-coupons","name":"Flexible PDF Coupons \u2013 Gift Cards & Vouchers for WooCommerce","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T16:43:59Z"},{"id":"wordfence:a81b1d68-022d-4513-ba62-fb353d0147af","source":"wordfence","cve":"CVE-2026-27085","title":"Astra <= 4.13.12 - Authenticated (Shop Manager+) Arbitrary CSS Injection","severity":"high","cvss":7.2,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a81b1d68-022d-4513-ba62-fb353d0147af?source=api-prod","affected":[{"type":"theme","slug":"astra","name":"Astra","from":"*","from_inclusive":true,"to":"4.13.12","to_inclusive":true,"patched_in":"4.14.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T17:48:51Z"},{"id":"wordfence:a81d3b09-b8dd-4697-ab43-c863e8d1e1d5","source":"wordfence","cve":"CVE-2022-47590","title":"Maintenance Switch <= 1.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a81d3b09-b8dd-4697-ab43-c863e8d1e1d5?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-switch","name":"Maintenance Switch","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-04-28T00:00:00Z","updated":"2025-10-02T22:28:12Z"},{"id":"wordfence:a81d5615-0b96-4d89-a525-7e80a10a9317","source":"wordfence","cve":"CVE-2023-1869","title":"YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a81d5615-0b96-4d89-a525-7e80a10a9317?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8208866-2bac-41e4-8a88-ae32520ff208","source":"wordfence","cve":"CVE-2025-30589","title":"Flickr set slideshows <= 0.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8208866-2bac-41e4-8a88-ae32520ff208?source=api-prod","affected":[{"type":"plugin","slug":"flickr-set-slideshows","name":"Flickr set slideshows","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:17:37Z"},{"id":"wordfence:a821d61c-e3c8-4a1b-8a52-a63adcb6c127","source":"wordfence","cve":"CVE-2025-24605","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.5 - Authenticated (Editor+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a821d61c-e3c8-4a1b-8a52-a63adcb6c127?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.5","to_inclusive":true,"patched_in":"1.0.8.6"}],"published":"2024-12-27T00:00:00Z","updated":"2025-02-25T17:01:51Z"},{"id":"wordfence:a823a21e-78b5-4186-bb67-88799509970d","source":"wordfence","cve":"CVE-2023-30473","title":"Yml for Yandex Market <= 3.10.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a823a21e-78b5-4186-bb67-88799509970d?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":false,"patched_in":"3.10.8"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a826dff8-60ae-4e25-9d3e-be93f192aaca","source":"wordfence","cve":"CVE-2024-2474","title":"Standout Color Boxes and Buttons <= 0.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a826dff8-60ae-4e25-9d3e-be93f192aaca?source=api-prod","affected":[{"type":"plugin","slug":"standout-color-boxes-and-buttons","name":"Standout Color Boxes and Buttons","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T04:32:15Z"},{"id":"wordfence:a82769ae-84b2-45e3-a637-c98e0c0e77a9","source":"wordfence","cve":"CVE-2025-31420","title":"wpForo Forum <= 2.4.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82769ae-84b2-45e3-a637-c98e0c0e77a9?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-10T13:00:45Z"},{"id":"wordfence:a827cea5-e8c2-47dd-81d7-e3700c19c8da","source":"wordfence","cve":"CVE-2024-11443","title":"de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a827cea5-e8c2-47dd-81d7-e3700c19c8da?source=api-prod","affected":[{"type":"plugin","slug":"debranding","name":"de:branding","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:22:35Z","updated":"2024-12-12T03:23:08Z"},{"id":"wordfence:a82820ec-b36a-4fed-b42d-17bf26a25a4c","source":"wordfence","cve":"CVE-2025-23491","title":"VSTEMPLATE Creator <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82820ec-b36a-4fed-b42d-17bf26a25a4c?source=api-prod","affected":[{"type":"plugin","slug":"vstemplate-creator","name":"VSTEMPLATE Creator","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:09:07Z"},{"id":"wordfence:a8290783-9eb5-4fae-8b00-e3b5a5a0ed35","source":"wordfence","cve":"CVE-2021-34652","title":"Media Usage <= 0.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8290783-9eb5-4fae-8b00-e3b5a5a0ed35?source=api-prod","affected":[{"type":"plugin","slug":"media-usage","name":"Media Usage","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8292a1f-1d26-4efa-9ead-5309965bdb8c","source":"wordfence","cve":"CVE-2015-4063","title":"NewStatPress <= 0.9.8 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8292a1f-1d26-4efa-9ead-5309965bdb8c?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":"0.9.9"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a82ac1c9-e037-4afa-b433-2efef2e61403","source":"wordfence","cve":"CVE-2022-0919","title":"Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82ac1c9-e037-4afa-b433-2efef2e61403?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a82bffab-77c3-48e8-af84-39709bf0353b","source":"wordfence","cve":"CVE-2021-24964","title":"LiteSpeed Cache <= 4.4.3 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82bffab-77c3-48e8-af84-39709bf0353b?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"1.0.15","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2021-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a82c5ca7-5fe5-4817-bf5c-ee7779eb4427","source":"wordfence","cve":"CVE-2018-16204","title":"XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82c5ca7-5fe5-4817-bf5c-ee7779eb4427?source=api-prod","affected":[{"type":"plugin","slug":"google-sitemap-generator","name":"XML Sitemap Generator for Google","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2018-12-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a82c8a9e-5af8-45df-bbd4-7bec9ddd1668","source":"wordfence","cve":"CVE-2026-62021","title":"Angio <= 1.1.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82c8a9e-5af8-45df-bbd4-7bec9ddd1668?source=api-prod","affected":[{"type":"theme","slug":"angio","name":"Angio - Creative Music Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:31:08Z"},{"id":"wordfence:a82debfe-e346-491f-a6dc-1bbf1a363999","source":"wordfence","cve":"CVE-2024-6766","title":"Shortcodes Ultimate Pro <= 7.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82debfe-e346-491f-a6dc-1bbf1a363999?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate-pro","name":"Shortcodes Ultimate Pro","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2024-07-16T00:00:00Z","updated":"2026-09-04T17:21:52Z"},{"id":"wordfence:a82fd49e-6e95-4743-900a-fa53b870ec0b","source":"wordfence","cve":"CVE-2024-4271","title":"SVGator \u2013 Add Animated SVG Easily <= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a82fd49e-6e95-4743-900a-fa53b870ec0b?source=api-prod","affected":[{"type":"plugin","slug":"svgator","name":"SVGator","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-05-24T00:00:00Z","updated":"2024-12-05T18:51:19Z"},{"id":"wordfence:a83061c0-d8d3-4dbe-bf2a-65350d17094b","source":"wordfence","cve":"CVE-2023-47225","title":"Short URL <= 1.6.8 - Missing Authorization via multiple AJAX functions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83061c0-d8d3-4dbe-bf2a-65350d17094b?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a831d5ae-cf20-4f6b-bc3c-214295ec8e2d","source":"wordfence","cve":"CVE-2026-65448","title":"Anti Spam and list cleaner \u2013 AcyChecker <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a831d5ae-cf20-4f6b-bc3c-214295ec8e2d?source=api-prod","affected":[{"type":"plugin","slug":"acychecker","name":"Anti Spam and list cleaner \u2013 AcyChecker","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:09:21Z"},{"id":"wordfence:a832cd41-c7be-43b5-bee3-4489170cad79","source":"wordfence","cve":"CVE-2021-36889","title":"tarteaucitron.js \u2013 Cookies legislation & GDPR (WordPress plugin) <= 1.6 - Cross-Site Scripting","severity":"low","cvss":3.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a832cd41-c7be-43b5-bee3-4489170cad79?source=api-prod","affected":[{"type":"plugin","slug":"tarteaucitronjs","name":"tarteaucitron.io \u2013 Cookie Banner & GDPR Consent Management","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2021-12-17T14:06:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a833fe01-caf5-434a-82f9-8d3ac755a66f","source":"wordfence","cve":"CVE-2023-31092","title":"Easy Bet <= 1.0.7 - Authenticated(Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a833fe01-caf5-434a-82f9-8d3ac755a66f?source=api-prod","affected":[{"type":"plugin","slug":"easy-bet","name":"Easy Bet","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2023-04-26T00:00:00Z","updated":"2024-07-15T16:07:26Z"},{"id":"wordfence:a8341ff1-9515-4999-9fd7-c8fe7a29bf6f","source":"wordfence","cve":"CVE-2026-15254","title":"Simply Schedule Appointments <= 1.6.12.10 - Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8341ff1-9515-4999-9fd7-c8fe7a29bf6f?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.10","to_inclusive":true,"patched_in":"1.6.12.11"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-21T15:36:43Z"},{"id":"wordfence:a8360ce3-6885-418c-9950-4a5f888c703b","source":"wordfence","cve":"CVE-2026-25003","title":"Client Portal \u2013 Private user pages and login <= 1.2.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8360ce3-6885-418c-9950-4a5f888c703b?source=api-prod","affected":[{"type":"plugin","slug":"client-portal","name":"Client Portal \u2013 Private user pages and login","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-01-16T00:00:00Z","updated":"2026-05-04T15:22:03Z"},{"id":"wordfence:a837ed04-7643-4efe-aefc-62911b465ba9","source":"wordfence","cve":"CVE-2024-11402","title":"Block Editor Bootstrap Blocks <= 6.6.1 - Reflected Cross-Site Scripting via tab","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a837ed04-7643-4efe-aefc-62911b465ba9?source=api-prod","affected":[{"type":"plugin","slug":"block-editor-bootstrap-blocks","name":"Block Editor Bootstrap Blocks","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":true,"patched_in":"6.6.2"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:07:57Z"},{"id":"wordfence:a8382051-ae17-4719-94b5-3cfb0b5e82b1","source":"wordfence","cve":"CVE-2023-45069","title":"Video Gallery \u2013 YouTube Gallery <= 2.1.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8382051-ae17-4719-94b5-3cfb0b5e82b1?source=api-prod","affected":[{"type":"plugin","slug":"gallery-videos","name":"Video Gallery \u2013 YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8394cec-7921-40a7-816e-b3875d4adb6d","source":"wordfence","cve":"CVE-2025-57955","title":"Post Carousel Slider for Elementor <= 1.7.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8394cec-7921-40a7-816e-b3875d4adb6d?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel-slider-for-elementor","name":"Post Carousel Slider for Elementor","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:00:38Z"},{"id":"wordfence:a83c438b-ce08-42d8-b3b2-8ab12dedcf3e","source":"wordfence","cve":"CVE-2024-5730","title":"Pagerank Tools <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83c438b-ce08-42d8-b3b2-8ab12dedcf3e?source=api-prod","affected":[{"type":"plugin","slug":"pagerank-tools","name":"Pagerank tools","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-13T14:58:17Z"},{"id":"wordfence:a83c88c8-3aed-4c97-9c4c-28a79a1e8c80","source":"wordfence","cve":"CVE-2025-31826","title":"Ni WooCommerce Cost Of Goods <= 3.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83c88c8-3aed-4c97-9c4c-28a79a1e8c80?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-cost-of-goods","name":"Ni Cost of Goods for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-15T12:22:46Z"},{"id":"wordfence:a83def40-27fa-4141-bebf-f86944e4c618","source":"wordfence","cve":"CVE-2022-1763","title":"Static Page eXtended <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83def40-27fa-4141-bebf-f86944e4c618?source=api-prod","affected":[{"type":"plugin","slug":"jp-staticpagex","name":"Static Page eXtended","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a83e68e0-1b5b-4fd5-be00-37b8f11144c4","source":"wordfence","cve":"CVE-2024-9385","title":"Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83e68e0-1b5b-4fd5-be00-37b8f11144c4?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2024-10-04T12:23:33Z","updated":"2024-10-05T01:59:41Z"},{"id":"wordfence:a83e7d8b-a93a-4347-bb59-de1e2fd954a5","source":"wordfence","cve":"CVE-2026-39512","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a83e7d8b-a93a-4347-bb59-de1e2fd954a5?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.152","to_inclusive":true,"patched_in":"2.8.154"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:05:32Z"},{"id":"wordfence:a841456c-2a01-4caf-bebe-e018b92697d8","source":"wordfence","cve":"CVE-2022-38468","title":"NextGEN Gallery <= 3.28 - Cross-Site Request Forgery leading to  Post Thumbnail Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a841456c-2a01-4caf-bebe-e018b92697d8?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.28","to_inclusive":true,"patched_in":"3.29"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8447fa0-f994-4de3-b6e7-2fe61e06bed1","source":"wordfence","cve":"CVE-2022-1165","title":"Blackhole for Bad Bots <= 3.3.1 - Arbitrary IP Address Blocking via IP Spoofing","severity":"critical","cvss":9.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8447fa0-f994-4de3-b6e7-2fe61e06bed1?source=api-prod","affected":[{"type":"plugin","slug":"blackhole-bad-bots","name":"Blackhole for Bad Bots","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a846b773-82b6-47c2-aa2d-af6b1a178788","source":"wordfence","cve":"CVE-2025-69003","title":"KenthaRadio <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a846b773-82b6-47c2-aa2d-af6b1a178788?source=api-prod","affected":[{"type":"theme","slug":"qt-kentharadio","name":"KenthaRadio - Addon for Kentha Music WordPress Theme To Add Radio Station and Schedule Functionality","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:51:45Z"},{"id":"wordfence:a847aea8-5e15-4c0e-bc16-27198e83c171","source":"wordfence","cve":"CVE-2025-63044","title":"Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a847aea8-5e15-4c0e-bc16-27198e83c171?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.19.1","to_inclusive":true,"patched_in":"1.4.20"}],"published":"2025-12-06T00:00:00Z","updated":"2026-02-26T15:37:14Z"},{"id":"wordfence:a84a4c56-a44e-450d-91fc-024f8ddeedee","source":"wordfence","cve":"CVE-2024-13371","title":"WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84a4c56-a44e-450d-91fc-024f8ddeedee?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:40Z"},{"id":"wordfence:a84aa4fd-9df2-43c7-aa2c-28d41623b6dd","source":"wordfence","cve":"CVE-2025-32164","title":"m1.DownloadList <= 0.23 - Authenticated (Contributor+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84aa4fd-9df2-43c7-aa2c-28d41623b6dd?source=api-prod","affected":[{"type":"plugin","slug":"m1downloadlist","name":"m1.DownloadList","from":"*","from_inclusive":true,"to":"0.23","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-05T18:41:45Z"},{"id":"wordfence:a84afab9-83a2-40fc-99e4-cc332a8ab74a","source":"wordfence","cve":"CVE-2026-61964","title":"Ninja Tables \u2013 Easy Data Table Builder <= 5.2.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84afab9-83a2-40fc-99e4-cc332a8ab74a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.9","to_inclusive":true,"patched_in":"5.2.10"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:21:36Z"},{"id":"wordfence:a84bd9c8-97bd-4572-8bfa-5191d98c9523","source":"wordfence","cve":"CVE-2024-22137","title":"Constant Contact Forms by MailMunch <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84bd9c8-97bd-4572-8bfa-5191d98c9523?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms-by-mailmunch","name":"Constant Contact Forms by MailMunch","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-01-10T00:00:00Z","updated":"2024-11-25T16:08:33Z"},{"id":"wordfence:a84d6f64-9ebb-4773-a9c1-8f23fb2801a9","source":"wordfence","cve":"CVE-2024-22300","title":"Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84d6f64-9ebb-4773-a9c1-8f23fb2801a9?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.11","to_inclusive":true,"patched_in":"5.7.12"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-29T18:47:56Z"},{"id":"wordfence:a84da684-17b3-43d7-b8dd-2570ee44851e","source":"wordfence","cve":"CVE-2026-54194","title":"Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a84da684-17b3-43d7-b8dd-2570ee44851e?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.4","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-25T17:24:14Z"},{"id":"wordfence:a851172f-3b27-4bc2-adc7-6863c2fd1c0a","source":"wordfence","cve":"CVE-2026-3355","title":"Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a851172f-3b27-4bc2-adc7-6863c2fd1c0a?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.101.0","to_inclusive":true,"patched_in":"5.102.0"}],"published":"2026-04-15T17:40:07Z","updated":"2026-04-16T06:44:53Z"},{"id":"wordfence:a8526106-847a-420f-9275-f759a8dd4dfb","source":"wordfence","cve":"CVE-2024-5204","title":"Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8526106-847a-420f-9275-f759a8dd4dfb?source=api-prod","affected":[{"type":"plugin","slug":"swiss-toolkit-for-wp","name":"Swiss Toolkit For WP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-29T02:00:36Z"},{"id":"wordfence:a853bbb4-9866-4bc4-94da-d7826863d23b","source":"wordfence","cve":"CVE-2024-27968","title":"Super Page Cache for Cloudflare <= 4.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a853bbb4-9866-4bc4-94da-d7826863d23b?source=api-prod","affected":[{"type":"plugin","slug":"wp-cloudflare-page-cache","name":"Super Page Cache \u2013 Cloudflare Cache, Page Speed & Core Web Vitals","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:39:31Z"},{"id":"wordfence:a8540a39-87e4-4a78-abf2-c7e09dbfa4f9","source":"wordfence","cve":"CVE-2022-36417","title":"3D Tag Cloud <= 3.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8540a39-87e4-4a78-abf2-c7e09dbfa4f9?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-3d-tag-cloud","name":"3D Tag Cloud","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a85461b7-6d16-435c-a149-ad25419a1585","source":"wordfence","cve":"CVE-2025-3878","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85461b7-6d16-435c-a149-ad25419a1585?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2025-05-09T21:58:48Z","updated":"2025-05-10T11:22:46Z"},{"id":"wordfence:a8546d5d-3ac0-4eb6-9502-07f2590a943b","source":"wordfence","cve":"CVE-2022-1090","title":"Good & Bad Comments <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8546d5d-3ac0-4eb6-9502-07f2590a943b?source=api-prod","affected":[{"type":"plugin","slug":"good-bad-comments","name":"Good & Bad comments","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a856a96a-68d2-462d-b523-840668980807","source":"wordfence","cve":"CVE-2025-13539","title":"FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=api-prod","affected":[{"type":"plugin","slug":"findall-membership","name":"FindAll Membership","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-11-26T16:16:27Z","updated":"2025-11-27T04:36:46Z"},{"id":"wordfence:a858e370-a7b4-4247-9e79-548833e09ec0","source":"wordfence","cve":"CVE-2025-28964","title":"Personal Favicon <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a858e370-a7b4-4247-9e79-548833e09ec0?source=api-prod","affected":[{"type":"plugin","slug":"personal-favicon","name":"Personal Favicon","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:32:33Z"},{"id":"wordfence:a859505e-87ba-49f0-910b-de6141976f86","source":"wordfence","cve":"","title":"CMS Commander \u2013 Manage Multiple Sites Plugin <= 2.21 - PHP Object Injection","severity":"high","cvss":8.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a859505e-87ba-49f0-910b-de6141976f86?source=api-prod","affected":[{"type":"plugin","slug":"cms-commander-client","name":"CMS Commander \u2013 Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":false,"patched_in":"2.22"}],"published":"2016-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a85caa9f-1c69-41ea-a237-dcb6b4f297bb","source":"wordfence","cve":"CVE-2025-47500","title":"Stackable <= 3.19.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85caa9f-1c69-41ea-a237-dcb6b4f297bb?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.19.5","to_inclusive":true,"patched_in":"3.19.6"}],"published":"2026-01-07T12:46:20Z","updated":"2026-02-02T20:56:34Z"},{"id":"wordfence:a85d6b73-1e78-49bd-9530-c9d65a202c50","source":"wordfence","cve":"CVE-2025-23753","title":"DN Sitemap Control <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85d6b73-1e78-49bd-9530-c9d65a202c50?source=api-prod","affected":[{"type":"plugin","slug":"dn-sitemap-control","name":"DN Sitemap Control","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:36:42Z"},{"id":"wordfence:a85eec18-49cc-44c0-ac86-ccc192a621a0","source":"wordfence","cve":"CVE-2014-125110","title":"WordPress File Upload <= 2.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85eec18-49cc-44c0-ac86-ccc192a621a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2014-08-20T00:00:00Z","updated":"2024-04-24T14:10:51Z"},{"id":"wordfence:a85f7ddb-b784-45d4-9d2f-a636c12e7f85","source":"wordfence","cve":"CVE-2024-49630","title":"WP Education <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via text_html_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85f7ddb-b784-45d4-9d2f-a636c12e7f85?source=api-prod","affected":[{"type":"plugin","slug":"wp-education","name":"WP Education \u2013 Education WordPress Plugin for Elementor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-10-18T00:00:00Z","updated":"2024-11-12T16:54:50Z"},{"id":"wordfence:a85fbaff-d566-4ed2-8943-c174e0c4d2d8","source":"wordfence","cve":"CVE-2024-8289","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a85fbaff-d566-4ed2-8943-c174e0c4d2d8?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T08:30:39Z"},{"id":"wordfence:a8604854-380a-4fd9-aaed-85387c0e3046","source":"wordfence","cve":"CVE-2025-30545","title":"issuuPress <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8604854-380a-4fd9-aaed-85387c0e3046?source=api-prod","affected":[{"type":"plugin","slug":"issuupress","name":"issuupress","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:35:27Z"},{"id":"wordfence:a86301cd-1268-4168-a8e7-6946711dc256","source":"wordfence","cve":"CVE-2022-3688","title":"WPQA < 5.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86301cd-1268-4168-a8e7-6946711dc256?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":false,"patched_in":"5.9"}],"published":"2022-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a864cddc-b627-46e3-a9b2-f0e051221728","source":"wordfence","cve":"CVE-2026-25011","title":"Custom Admin Interface <= 7.41 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a864cddc-b627-46e3-a9b2-f0e051221728?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.41","to_inclusive":true,"patched_in":"7.42"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-02T20:41:21Z"},{"id":"wordfence:a868226f-4ca1-4ec1-b55e-3029e3ed2d5b","source":"wordfence","cve":"CVE-2022-3852","title":"VR Calendar <= 2.3.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a868226f-4ca1-4ec1-b55e-3029e3ed2d5b?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a869248a-a3ff-4a5b-b980-ecd2c2aafa98","source":"wordfence","cve":"CVE-2025-23720","title":"Web Push <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a869248a-a3ff-4a5b-b980-ecd2c2aafa98?source=api-prod","affected":[{"type":"plugin","slug":"web-push","name":"Web Push","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:52:01Z"},{"id":"wordfence:a86a694b-5e45-4e94-a22c-2c5faa7172a2","source":"wordfence","cve":"CVE-2023-45011","title":"WP Power Stats <= 2.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86a694b-5e45-4e94-a22c-2c5faa7172a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-power-stats","name":"WP Power Stats","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a86d196f-9613-4352-8a96-87ea147eb1c8","source":"wordfence","cve":"CVE-2021-24642","title":"Scroll Baner <= 1.0 - Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86d196f-9613-4352-8a96-87ea147eb1c8?source=api-prod","affected":[{"type":"plugin","slug":"scroll-baner","name":"Scroll Baner","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a86d8f97-54dc-4c6b-92c0-05a8625cc073","source":"wordfence","cve":"CVE-2023-31236","title":"Scripts n Styles <= 3.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86d8f97-54dc-4c6b-92c0-05a8625cc073?source=api-prod","affected":[{"type":"plugin","slug":"scripts-n-styles","name":"Scripts n Styles","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a86e95d8-e413-4c9a-a60b-d8a23f93baae","source":"wordfence","cve":"CVE-2026-89232","title":"RecordBrowser <= 1.1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86e95d8-e413-4c9a-a60b-d8a23f93baae?source=api-prod","affected":[{"type":"plugin","slug":"recordbrowser","name":"Recordbrowser","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:20:46Z"},{"id":"wordfence:a86fab4a-71ec-4006-96f0-46202de2f389","source":"wordfence","cve":"CVE-2026-108123","title":"WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86fab4a-71ec-4006-96f0-46202de2f389?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.3","to_inclusive":true,"patched_in":"2.1.0.4"}],"published":"2026-10-16T14:38:40Z","updated":"2026-10-17T03:43:29Z"},{"id":"wordfence:a86fc949-6caf-48b7-beda-ca0c653c9b29","source":"wordfence","cve":"CVE-2024-31296","title":"BookingPress <= 1.0.81 - Authenticated (Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a86fc949-6caf-48b7-beda-ca0c653c9b29?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.81","to_inclusive":true,"patched_in":"1.0.82"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:52:46Z"},{"id":"wordfence:a8742e30-e49c-46c9-92d5-216d32d00d51","source":"wordfence","cve":"CVE-2022-36388","title":"YDS Support Ticket System <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8742e30-e49c-46c9-92d5-216d32d00d51?source=api-prod","affected":[{"type":"plugin","slug":"yds-support-ticket-system","name":"YDS Support Ticket System","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a87498c5-167f-4871-9c2f-4ada82c2b727","source":"wordfence","cve":"CVE-2026-81297","title":"Fluent Forms Pro Add On Pack <= 6.2.12 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a87498c5-167f-4871-9c2f-4ada82c2b727?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.12","to_inclusive":true,"patched_in":"6.2.13"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:02:24Z"},{"id":"wordfence:a8790df5-7228-4854-870c-1e6d3d0cfbaa","source":"wordfence","cve":"CVE-2024-12609","title":"School Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8790df5-7228-4854-870c-1e6d3d0cfbaa?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":"93.0.0"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:27Z"},{"id":"wordfence:a879b624-1670-40f5-832a-63c9c850a953","source":"wordfence","cve":"CVE-2025-23689","title":"Blogger Image Import  2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a879b624-1670-40f5-832a-63c9c850a953?source=api-prod","affected":[{"type":"plugin","slug":"blogger-image-import","name":"Blogger Image Import","from":"2.1","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:41:56Z"},{"id":"wordfence:a87d0966-3fd4-46f8-acd5-1cf0cb18af42","source":"wordfence","cve":"CVE-2025-1450","title":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp \u2013 Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a87d0966-3fd4-46f8-acd5-1cf0cb18af42?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T09:21:50Z"},{"id":"wordfence:a87d7770-2974-4764-a026-933850cb5173","source":"wordfence","cve":"CVE-2026-27359","title":"Awa Plugins <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a87d7770-2974-4764-a026-933850cb5173?source=api-prod","affected":[{"type":"plugin","slug":"awa-plugins","name":"Portfolio Awa","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:43:41Z"},{"id":"wordfence:a87f610a-c1ef-4365-bd74-569989587d41","source":"wordfence","cve":"CVE-2023-1924","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a87f610a-c1ef-4365-bd74-569989587d41?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a881ca02-cef9-4f4b-8a62-e241c4c80004","source":"wordfence","cve":"CVE-2025-3921","title":"PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function","severity":"high","cvss":8.2,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a881ca02-cef9-4f4b-8a62-e241c4c80004?source=api-prod","affected":[{"type":"plugin","slug":"peprodev-ups","name":"PeproDev Ultimate Profile Solutions","from":"1.9.1","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2025-05-06T13:27:00Z","updated":"2025-11-05T19:48:17Z"},{"id":"wordfence:a881e912-b815-4a74-957e-79fd42cea364","source":"wordfence","cve":"CVE-2026-32563","title":"ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a881e912-b815-4a74-957e-79fd42cea364?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-post-type","name":"ACPT (Premium)","from":"*","from_inclusive":true,"to":"2.0.63","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T12:21:27Z","updated":"2026-09-10T19:11:45Z"},{"id":"wordfence:a882c3d9-b4c1-4743-b930-382ca1081bab","source":"wordfence","cve":"","title":"WowShipping Pro 1.0.6 - Injected Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a882c3d9-b4c1-4743-b930-382ca1081bab?source=api-prod","affected":[{"type":"plugin","slug":"table-rate-shipping-pro","name":"WowShipping Pro","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2026-04-17T00:00:00Z","updated":"2026-04-21T15:08:11Z"},{"id":"wordfence:a8839665-8f98-4c81-b234-9201236e0194","source":"wordfence","cve":"CVE-2025-13652","title":"CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8839665-8f98-4c81-b234-9201236e0194?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-01-05T15:12:02Z","updated":"2026-01-06T03:21:39Z"},{"id":"wordfence:a885e5db-dc84-46db-960e-63f62709e1b1","source":"wordfence","cve":"CVE-2024-3752","title":"Crelly Slider <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a885e5db-dc84-46db-960e-63f62709e1b1?source=api-prod","affected":[{"type":"plugin","slug":"crelly-slider","name":"Crelly Slider","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-31T18:49:27Z"},{"id":"wordfence:a886bec4-acd6-4a15-aa42-7c31270ae1e0","source":"wordfence","cve":"CVE-2024-34574","title":"Table Maker <= 1.9.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a886bec4-acd6-4a15-aa42-7c31270ae1e0?source=api-prod","affected":[{"type":"plugin","slug":"table-maker","name":"Table Maker","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:24:35Z"},{"id":"wordfence:a888a861-0028-4650-9c80-0d3ec91ba099","source":"wordfence","cve":"CVE-2024-52417","title":"ReConstruction <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a888a861-0028-4650-9c80-0d3ec91ba099?source=api-prod","affected":[{"type":"theme","slug":"reconstruction","name":"reconstruction","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:24:16Z"},{"id":"wordfence:a88b527c-8b2d-44a3-addd-7de3bfa5f9b2","source":"wordfence","cve":"CVE-2024-51653","title":"UPDATE NOTIFICATIONS <= 0.3.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a88b527c-8b2d-44a3-addd-7de3bfa5f9b2?source=api-prod","affected":[{"type":"plugin","slug":"update-notifications","name":"UPDATE NOTIFICATIONS","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:24:50Z"},{"id":"wordfence:a88daa7b-dd50-4037-b354-bdabdac7bfbd","source":"wordfence","cve":"CVE-2026-97642","title":"Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a88daa7b-dd50-4037-b354-bdabdac7bfbd?source=api-prod","affected":[{"type":"plugin","slug":"wp-parsidate","name":"Parsi Date | \u0628\u0633\u062a\u0647 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u067e\u0627\u0631\u0633\u06cc \u062f\u06cc\u062a","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2026-11-05T20:42:33Z","updated":"2026-11-06T09:38:14Z"},{"id":"wordfence:a88e43ac-d571-46b0-aace-970e113e799e","source":"wordfence","cve":"CVE-2025-47523","title":"Seznam Webmaster <= 1.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a88e43ac-d571-46b0-aace-970e113e799e?source=api-prod","affected":[{"type":"plugin","slug":"seznam-webmaster","name":"Seznam Webmaster","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:40:43Z"},{"id":"wordfence:a88e8853-3a52-462b-bde8-658a794545dc","source":"wordfence","cve":"CVE-2022-1957","title":"Comment License <= 1.3.0 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a88e8853-3a52-462b-bde8-658a794545dc?source=api-prod","affected":[{"type":"plugin","slug":"comment-license","name":"Comment License","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a88fd2b0-1bd3-495a-9432-2f1b1034c4e4","source":"wordfence","cve":"CVE-2026-22441","title":"Zentrum <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a88fd2b0-1bd3-495a-9432-2f1b1034c4e4?source=api-prod","affected":[{"type":"theme","slug":"zentrum","name":"Zentrum - Property & Apartment Showcase WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:25:25Z"},{"id":"wordfence:a8931773-b656-4d04-9a38-5d10ce050311","source":"wordfence","cve":"CVE-2025-53277","title":"IS-theme-companion <= 1.57 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8931773-b656-4d04-9a38-5d10ce050311?source=api-prod","affected":[{"type":"plugin","slug":"weblizar-companion","name":"IS-theme-companion","from":"*","from_inclusive":true,"to":"1.57","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:28:01Z"},{"id":"wordfence:a895e2cf-9eba-4c46-b19f-d008e1058f64","source":"wordfence","cve":"CVE-2026-3614","title":"AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a895e2cf-9eba-4c46-b19f-d008e1058f64?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"9.11.0","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-04-15T16:43:55Z","updated":"2026-04-16T05:29:56Z"},{"id":"wordfence:a8971d54-b54e-4e62-9db2-fa87d2564599","source":"wordfence","cve":"CVE-2023-6884","title":"Plugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8971d54-b54e-4e62-9db2-fa87d2564599?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-01-12T00:00:00Z","updated":"2024-07-29T21:37:04Z"},{"id":"wordfence:a89f795d-246d-4a3c-a7a7-5c9867d7a01e","source":"wordfence","cve":"CVE-2023-51493","title":"Custom Post Carousels with Owl <= 1.4.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a89f795d-246d-4a3c-a7a7-5c9867d7a01e?source=api-prod","affected":[{"type":"plugin","slug":"dd-post-carousel","name":"Custom Post Carousels with Owl","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8a05986-46e2-49eb-b196-d5c36b03a394","source":"wordfence","cve":"CVE-2024-50425","title":"WP Booking System <= 2.0.19.10 - Missing Authorization via wpbs_refresh_calendar_editor","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a05986-46e2-49eb-b196-d5c36b03a394?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.19.10","to_inclusive":true,"patched_in":"2.0.19.11"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T19:34:04Z"},{"id":"wordfence:a8a0fca4-b308-4f17-85b4-22ac111d6207","source":"wordfence","cve":"CVE-2025-47519","title":"Easy PayPal Events <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a0fca4-b308-4f17-85b4-22ac111d6207?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-events-tickets","name":"Easy PayPal Events & Tickets","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:25:21Z"},{"id":"wordfence:a8a31080-c124-49be-b9d1-7bc5abe7cbda","source":"wordfence","cve":"CVE-2026-5753","title":"All-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a31080-c124-49be-b9d1-7bc5abe7cbda?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration-unlimited-extension","name":"All-in-One WP Migration Unlimited Extension","from":"*","from_inclusive":true,"to":"2.83","to_inclusive":true,"patched_in":"2.84"}],"published":"2026-05-05T14:37:19Z","updated":"2026-05-06T03:27:21Z"},{"id":"wordfence:a8a3ba35-3cc0-4a6b-bb96-6ae5a83e5ad6","source":"wordfence","cve":"","title":"MainWP Dashboard <= 4.2.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a3ba35-3cc0-4a6b-bb96-6ae5a83e5ad6?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"4.2.4.1","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8a5a78e-a8c2-44bd-8e91-9a03228ab079","source":"wordfence","cve":"CVE-2025-30577","title":"Browser Address Bar Color <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a5a78e-a8c2-44bd-8e91-9a03228ab079?source=api-prod","affected":[{"type":"plugin","slug":"browser-address-bar-color","name":"Browser Address Bar Color","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2025-03-24T00:00:00Z","updated":"2025-05-16T14:30:42Z"},{"id":"wordfence:a8a5b5ce-9975-449b-bdd1-d139f1360297","source":"wordfence","cve":"CVE-2025-11808","title":"Shortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a5b5ce-9975-449b-bdd1-d139f1360297?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-street-view-shortcode","name":"Shortcode for Google Street View","from":"*","from_inclusive":true,"to":"0.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:32:51Z","updated":"2025-11-21T08:28:16Z"},{"id":"wordfence:a8a67cad-b52d-4294-9c27-13b1dc1f2e59","source":"wordfence","cve":"CVE-2022-44740","title":"Creative Mail <= 1.5.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a67cad-b52d-4294-9c27-13b1dc1f2e59?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8a7936e-5ca8-4055-a23c-c9d39e9b92d5","source":"wordfence","cve":"CVE-2025-66145","title":"Worker for WPBakery <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a7936e-5ca8-4055-a23c-c9d39e9b92d5?source=api-prod","affected":[{"type":"plugin","slug":"worker-wpbakery","name":"Business Hours for WPBakery \u2013 Worker","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:35:09Z"},{"id":"wordfence:a8ada876-4a8b-494f-9132-d88a71b42c44","source":"wordfence","cve":"CVE-2023-5666","title":"Accordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ada876-4a8b-494f-9132-d88a71b42c44?source=api-prod","affected":[{"type":"plugin","slug":"accordions-wp","name":"Accordions \u2013 Responsive Accordion & FAQ Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8ae5712-09a8-45a4-9f79-3e5b7786e652","source":"wordfence","cve":"CVE-2023-50858","title":"Anti Hacker <= 4.34 - Cross-Site Request Forgery via antihacker_ajax_scan","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ae5712-09a8-45a4-9f79-3e5b7786e652?source=api-prod","affected":[{"type":"plugin","slug":"antihacker","name":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan","from":"*","from_inclusive":true,"to":"4.35","to_inclusive":false,"patched_in":"4.35"}],"published":"2023-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8ae901a-c32a-43d8-b23b-088e695a5823","source":"wordfence","cve":"CVE-2026-16788","title":"Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ae901a-c32a-43d8-b23b-088e695a5823?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2026-08-31T20:53:53Z","updated":"2026-09-01T09:28:21Z"},{"id":"wordfence:a8af7c85-977f-41aa-acbe-293dfa913577","source":"wordfence","cve":"CVE-2019-15817","title":"Easy Property Listings <= 3.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8af7c85-977f-41aa-acbe-293dfa913577?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2019-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8b09c95-c145-41be-9eb7-9e418dc03305","source":"wordfence","cve":"CVE-2026-19861","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b09c95-c145-41be-9eb7-9e418dc03305?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.5.2","to_inclusive":false,"patched_in":"3.6.5.2"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:47:53Z"},{"id":"wordfence:a8b0bad8-7ee6-4c7c-95da-7adf37c9cb1f","source":"wordfence","cve":"","title":"WooCommerce Products Vendor <= 2.1.68 - Insecure Direct Object Reference to Vendor Commission Percentage Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b0bad8-7ee6-4c7c-95da-7adf37c9cb1f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.68","to_inclusive":true,"patched_in":"2.1.69"}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8b0d708-4f74-4e6d-9581-f65caf976d45","source":"wordfence","cve":"CVE-2023-44995","title":"WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b0d708-4f74-4e6d-9581-f65caf976d45?source=api-prod","affected":[{"type":"plugin","slug":"woo-login-redirect","name":"WooCommerce Login Redirect","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8b10d0c-e2fc-47a3-9df9-8df58eee964c","source":"wordfence","cve":"CVE-2023-45055","title":"MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b10d0c-e2fc-47a3-9df9-8df58eee964c?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8b1feee-431f-4406-b7c0-a7e71cb5f179","source":"wordfence","cve":"CVE-2024-37956","title":"VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b1feee-431f-4406-b7c0-a7e71cb5f179?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.99.1.0","to_inclusive":true,"patched_in":"9.99.2.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-09-05T15:35:28Z"},{"id":"wordfence:a8b319be-f312-4d02-840f-e2a91c16b67a","source":"wordfence","cve":"CVE-2024-27956","title":"Automatic <= 3.92.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b319be-f312-4d02-840f-e2a91c16b67a?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.92.0","to_inclusive":true,"patched_in":"3.92.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:31:41Z"},{"id":"wordfence:a8b42a6a-d6b5-46b2-9149-2abd9389a1d2","source":"wordfence","cve":"CVE-2025-52759","title":"Accordion FAQ <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b42a6a-d6b5-46b2-9149-2abd9389a1d2?source=api-prod","affected":[{"type":"plugin","slug":"pressapps-accordion-faq","name":"pressapps-accordion-faq","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-28T00:00:00Z","updated":"2026-09-18T14:34:30Z"},{"id":"wordfence:a8b4f132-0a90-4d54-9ba6-36610bccafad","source":"wordfence","cve":"CVE-2026-54869","title":"IMPress for IDX Broker <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b4f132-0a90-4d54-9ba6-36610bccafad?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:33:22Z"},{"id":"wordfence:a8b5b389-85f4-4cc5-9796-55b611af7916","source":"wordfence","cve":"CVE-2026-102774","title":"SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b5b389-85f4-4cc5-9796-55b611af7916?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2026-10-09T19:23:30Z","updated":"2026-10-10T07:41:47Z"},{"id":"wordfence:a8b6dafb-7b2f-4459-95bd-eb7e147a4466","source":"wordfence","cve":"CVE-2024-1070","title":"SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b6dafb-7b2f-4459-95bd-eb7e147a4466?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.58.2","to_inclusive":true,"patched_in":"1.58.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-05-31T15:30:50Z"},{"id":"wordfence:a8b7621a-54bf-4c38-824c-4aff49a988f9","source":"wordfence","cve":"CVE-2025-28930","title":"List Mixcloud <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8b7621a-54bf-4c38-824c-4aff49a988f9?source=api-prod","affected":[{"type":"plugin","slug":"list-mixcloud","name":"List MixCloud","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-03-11T00:00:00Z","updated":"2026-06-23T17:32:59Z"},{"id":"wordfence:a8be9c76-08aa-4d41-8599-cc3494be7e58","source":"wordfence","cve":"CVE-2023-40212","title":"WooCommerce Product Attachment <= 2.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8be9c76-08aa-4d41-8599-cc3494be7e58?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-attachment","name":"Product Attachment for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8bfdf39-2387-4a6f-ab85-6756a1e67305","source":"wordfence","cve":"CVE-2024-10623","title":"ForumEngine <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8bfdf39-2387-4a6f-ab85-6756a1e67305?source=api-prod","affected":[{"type":"theme","slug":"forumengine","name":"ForumEngine","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T04:24:26Z"},{"id":"wordfence:a8c08878-0f9f-4203-8110-a3772eb8de63","source":"wordfence","cve":"CVE-2015-7670","title":"Support Ticket System < 1.2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c08878-0f9f-4203-8110-a3772eb8de63?source=api-prod","affected":[{"type":"plugin","slug":"simple-support-ticket-system","name":"Support Ticket System","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2015-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8c24278-c392-43c7-b50a-241d5d6fc2d9","source":"wordfence","cve":"CVE-2025-30550","title":"CallPhone'r <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c24278-c392-43c7-b50a-241d5d6fc2d9?source=api-prod","affected":[{"type":"plugin","slug":"callphoner","name":"CallPhone&#039;r","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:15:03Z"},{"id":"wordfence:a8c29cbd-6c39-4a54-a2a2-bc4c8feeeb70","source":"wordfence","cve":"CVE-2024-10780","title":"Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c29cbd-6c39-4a54-a2a2-bc4c8feeeb70?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:47:13Z"},{"id":"wordfence:a8c547cc-2820-4138-b042-a0ec2e7f2fca","source":"wordfence","cve":"CVE-2024-5332","title":"Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c547cc-2820-4138-b042-a0ec2e7f2fca?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.8","to_inclusive":true,"patched_in":"2.6.9.9"}],"published":"2024-06-25T00:00:00Z","updated":"2024-06-26T05:40:25Z"},{"id":"wordfence:a8c676a0-287f-479c-aaa1-ba638b340e11","source":"wordfence","cve":"CVE-2025-8200","title":"Mega Elements \u2013 Addons for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c676a0-287f-479c-aaa1-ba638b340e11?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T01:47:27Z"},{"id":"wordfence:a8c6c17a-9eaa-445b-b7ec-c36e15fc5b1b","source":"wordfence","cve":"CVE-2025-31040","title":"WP Food ordering and Restaurant Menu <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c6c17a-9eaa-445b-b7ec-c36e15fc5b1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-food","name":"WP Food ordering and Restaurant Menu","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:37:07Z"},{"id":"wordfence:a8c8d839-d2a4-4b2a-ad61-a3cda7826636","source":"wordfence","cve":"","title":"Duplicate Post <= 1.4.1 - Cross-Site Request Forgery via 'cdp_action_handling' AJAX action","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c8d839-d2a4-4b2a-ad61-a3cda7826636?source=api-prod","affected":[{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8c9b57b-d60d-4197-a9f9-66206518733f","source":"wordfence","cve":"CVE-2026-104769","title":"Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>","severity":"medium","cvss":5.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8c9b57b-d60d-4197-a9f9-66206518733f?source=api-prod","affected":[{"type":"plugin","slug":"debloat","name":"Debloat \u2013 Remove Unused CSS, Optimize JS","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-10-15T15:25:13Z","updated":"2026-10-16T03:38:42Z"},{"id":"wordfence:a8ca195d-312b-41d2-a9d7-4d306fc800ce","source":"wordfence","cve":"CVE-2018-17585","title":"WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ca195d-312b-41d2-a9d7-4d306fc800ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.8.5","to_inclusive":true,"patched_in":"0.8.8.6"}],"published":"2018-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8ca1ead-1bc5-4ccc-9034-559db27f5e82","source":"wordfence","cve":"CVE-2025-2839","title":"WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ca1ead-1bc5-4ccc-9034-559db27f5e82?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.9.28"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-22T05:27:26Z"},{"id":"wordfence:a8cce50c-2409-431d-80f4-13b8266a33a5","source":"wordfence","cve":"CVE-2025-58235","title":"Front End Users <= 3.2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8cce50c-2409-431d-80f4-13b8266a33a5?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.33","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-17T16:29:20Z"},{"id":"wordfence:a8cdde8d-db43-4702-81c3-ea2d867baa8d","source":"wordfence","cve":"CVE-2024-13827","title":"Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8cdde8d-db43-4702-81c3-ea2d867baa8d?source=api-prod","affected":[{"type":"plugin","slug":"razorpay-subscription-button-elementor","name":"Razorpay Subscription Button Elementor Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-03-04T19:18:29Z","updated":"2025-03-18T18:08:06Z"},{"id":"wordfence:a8d0f29a-7c79-4e2b-8b59-44cc47293e4e","source":"wordfence","cve":"CVE-2025-22636","title":"VR-Frases <= 4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d0f29a-7c79-4e2b-8b59-44cc47293e4e?source=api-prod","affected":[{"type":"plugin","slug":"vr-frases","name":"VR-Frases","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-02-03T00:00:00Z","updated":"2026-04-15T20:38:03Z"},{"id":"wordfence:a8d396fe-225d-47c5-be86-261f73eb08a1","source":"wordfence","cve":"CVE-2025-30629","title":"Bitly URL Shortener <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d396fe-225d-47c5-be86-261f73eb08a1?source=api-prod","affected":[{"type":"plugin","slug":"codehaveli-bitly-url-shortener","name":"Bitly URL Shortener","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-06-05T00:00:00Z","updated":"2026-02-03T19:15:57Z"},{"id":"wordfence:a8d4dc12-ae17-477f-a8d2-da9747672a26","source":"wordfence","cve":"CVE-2016-10872","title":"Ultimate Member <= 1.3.39 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d4dc12-ae17-477f-a8d2-da9747672a26?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.40","to_inclusive":false,"patched_in":"1.3.40"}],"published":"2016-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8d5628e-b5d6-4f2f-b270-0fed1c7b34fa","source":"wordfence","cve":"CVE-2025-31801","title":"MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d5628e-b5d6-4f2f-b270-0fed1c7b34fa?source=api-prod","affected":[{"type":"plugin","slug":"mx-time-zone-clocks","name":"MX Time Zone Clocks","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2025-04-01T00:00:00Z","updated":"2026-09-09T15:50:58Z"},{"id":"wordfence:a8d67bc0-8c21-43e8-bdcc-1235eca94fa7","source":"wordfence","cve":"CVE-2014-4521","title":"dsIDXpress < 2.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d67bc0-8c21-43e8-bdcc-1235eca94fa7?source=api-prod","affected":[{"type":"plugin","slug":"dsidxpress","name":"Diverse Solutions IDX Real Estate Listings & MLS Search","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8d9f6ba-1c41-4933-8eb2-8f27b9e87574","source":"wordfence","cve":"CVE-2025-7845","title":"Stratum \u2013 Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d9f6ba-1c41-4933-8eb2-8f27b9e87574?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-07-31T16:22:45Z","updated":"2025-08-01T04:24:32Z"},{"id":"wordfence:a8db1624-e391-4b74-ad15-668b700b367d","source":"wordfence","cve":"CVE-2025-66108","title":"TNC Toolbox: Web Performance <= 2.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8db1624-e391-4b74-ad15-668b700b367d?source=api-prod","affected":[{"type":"plugin","slug":"tnc-toolbox","name":"TNC Toolbox: Web Performance","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-11T16:51:44Z"},{"id":"wordfence:a8dc0712-f78e-46c5-a0d1-2db752498d54","source":"wordfence","cve":"CVE-2024-11135","title":"Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8dc0712-f78e-46c5-a0d1-2db752498d54?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2025-01-27T00:00:00Z","updated":"2025-04-21T04:54:19Z"},{"id":"wordfence:a8de8a0b-0b70-4e8a-8cc4-06cc50d06a02","source":"wordfence","cve":"CVE-2024-9993","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8de8a0b-0b70-4e8a-8cc4-06cc50d06a02?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.1.12","to_inclusive":true,"patched_in":"6.1.13"}],"published":"2025-06-06T21:37:20Z","updated":"2025-06-07T11:17:53Z"},{"id":"wordfence:a8e222d1-cb03-4498-9776-e050eb501e9f","source":"wordfence","cve":"CVE-2026-0552","title":"Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e222d1-cb03-4498-9776-e050eb501e9f?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2026-04-03T19:30:41Z","updated":"2026-04-04T07:42:01Z"},{"id":"wordfence:a8e2bff6-3d2a-43d7-b26d-b520e3b4c709","source":"wordfence","cve":"CVE-2025-43835","title":"wp-cyr-cho <= 0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e2bff6-3d2a-43d7-b26d-b520e3b4c709?source=api-prod","affected":[{"type":"plugin","slug":"wp-cyr-cho","name":"wp-cyr-cho | \u041a\u043e\u043d\u0432\u0435\u0440\u0442\u0438\u0440\u0430 \u043a\u0438\u0440\u0438\u043b\u0441\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0438 \u0432 \u043b\u0430\u0442\u0438\u043d\u0438\u0441\u043a\u0438","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:00:11Z"},{"id":"wordfence:a8e34c05-7431-4acd-91f3-aab5e66f61ad","source":"wordfence","cve":"CVE-2025-0393","title":"Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e34c05-7431-4acd-91f3-aab5e66f61ad?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1006","to_inclusive":true,"patched_in":"1.7.1007"}],"published":"2025-01-13T19:52:46Z","updated":"2025-01-14T14:13:03Z"},{"id":"wordfence:a8e39f0b-eb4c-4568-9f5a-60a0dc3eb6ba","source":"wordfence","cve":"CVE-2024-9668","title":"Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e39f0b-eb4c-4568-9f5a-60a0dc3eb6ba?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1001","to_inclusive":true,"patched_in":"1.7.1002"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T08:29:34Z"},{"id":"wordfence:a8e40f0a-9296-4113-8fff-0aea3c365c1a","source":"wordfence","cve":"CVE-2023-6294","title":"Popup Builder <= 4.2.5 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e40f0a-9296-4113-8fff-0aea3c365c1a?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2024-01-17T00:00:00Z","updated":"2024-03-22T17:21:27Z"},{"id":"wordfence:a8e57528-010f-4ec6-917b-4cd8c3fdbd58","source":"wordfence","cve":"CVE-2025-11164","title":"Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e57528-010f-4ec6-917b-4cd8c3fdbd58?source=api-prod","affected":[{"type":"theme","slug":"mavix-education","name":"Mavix Education","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-12-12T15:29:59Z","updated":"2025-12-13T04:31:31Z"},{"id":"wordfence:a8e6f2fe-25f7-46e4-871e-e6770d5fb00b","source":"wordfence","cve":"CVE-2024-52381","title":"ZIJ KART <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e6f2fe-25f7-46e4-871e-e6770d5fb00b?source=api-prod","affected":[{"type":"plugin","slug":"zij-kart","name":"ZIJ KART","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:58:02Z"},{"id":"wordfence:a8e744b3-0c4a-492a-9102-5dff10f850b0","source":"wordfence","cve":"CVE-2024-56238","title":"Floating Action Buttons <= 0.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e744b3-0c4a-492a-9102-5dff10f850b0?source=api-prod","affected":[{"type":"plugin","slug":"floating-action-buttons","name":"Floating Action Buttons","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:47:17Z"},{"id":"wordfence:a8e8d724-60fe-4333-8c55-cb7df0d4345d","source":"wordfence","cve":"CVE-2022-3911","title":"iubenda <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e8d724-60fe-4333-8c55-cb7df0d4345d?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8ea0559-dec7-4c20-956d-dbfe7bc67634","source":"wordfence","cve":"CVE-2024-5859","title":"Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ea0559-dec7-4c20-956d-dbfe7bc67634?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-06-20T20:02:07Z","updated":"2024-06-21T08:39:46Z"},{"id":"wordfence:a8eab201-04a5-43df-bb9b-2964c50a1833","source":"wordfence","cve":"CVE-2026-0703","title":"NextMove Lite - Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8eab201-04a5-43df-bb9b-2964c50a1833?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":true,"patched_in":"2.24.0"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T13:26:13Z"},{"id":"wordfence:a8eb3ec8-0784-4702-86bf-a621b288e7a0","source":"wordfence","cve":"CVE-2025-11993","title":"WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8eb3ec8-0784-4702-86bf-a621b288e7a0?source=api-prod","affected":[{"type":"plugin","slug":"sb-woocommerce-infinite-scrol","name":"WooCommerce Infinite Scroll and Ajax Pagination","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-28T16:45:07Z","updated":"2026-10-22T05:29:50Z"},{"id":"wordfence:a8ecc765-ae00-4091-81dc-e93f91bbd86e","source":"wordfence","cve":"CVE-2025-11365","title":"WP Google Map Plugin <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ecc765-ae00-4091-81dc-e93f91bbd86e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map","name":"WP Google Map Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:47:58Z","updated":"2025-10-15T08:25:59Z"},{"id":"wordfence:a8f093bc-5cd3-41a0-b86b-d00338334d2e","source":"wordfence","cve":"CVE-2024-13820","title":"Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f093bc-5cd3-41a0-b86b-d00338334d2e?source=api-prod","affected":[{"type":"plugin","slug":"melhor-envio-cotacao","name":"Melhor Envio","from":"*","from_inclusive":true,"to":"2.15.11","to_inclusive":true,"patched_in":"2.15.12"}],"published":"2025-04-07T15:53:14Z","updated":"2025-04-17T13:23:22Z"},{"id":"wordfence:a8f1e411-3060-4f1a-8a73-db33557aa3c6","source":"wordfence","cve":"CVE-2026-25455","title":"Product Slider, Product Grid, Product Masonry <= 1.13.61 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f1e411-3060-4f1a-8a73-db33557aa3c6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-slider","name":"Product Slider, Product Grid, Product Masonry","from":"*","from_inclusive":true,"to":"1.13.61","to_inclusive":true,"patched_in":"1.13.62"}],"published":"2026-03-17T00:00:00Z","updated":"2026-04-15T13:42:33Z"},{"id":"wordfence:a8f31b4b-c8d8-4028-b419-f8396a5cb2a9","source":"wordfence","cve":"CVE-2021-24311","title":"External Media <= 1.0.33 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f31b4b-c8d8-4028-b419-f8396a5cb2a9?source=api-prod","affected":[{"type":"plugin","slug":"external-media","name":"External Media","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":false,"patched_in":"1.0.34"}],"published":"2021-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8f45c31-6e35-4f28-8f49-74cb08ff65bd","source":"wordfence","cve":"CVE-2021-24902","title":"Typebot | Build beautiful conversational forms < 1.4.3 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f45c31-6e35-4f28-8f49-74cb08ff65bd?source=api-prod","affected":[{"type":"plugin","slug":"typebot","name":"Typebot","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a8f6cbfc-f5f2-4035-84bd-0e7a00cda194","source":"wordfence","cve":"CVE-2025-63060","title":"Kallyas <= 4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f6cbfc-f5f2-4035-84bd-0e7a00cda194?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"kallyas","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2025-12-10T16:02:05Z"},{"id":"wordfence:a8f91e58-942c-417f-ad82-5bd99ab5e81a","source":"wordfence","cve":"CVE-2018-6466","title":"flickrRSS <= 5.3.1 - Cross-Site Scripting via flickrRSS_set","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f91e58-942c-417f-ad82-5bd99ab5e81a?source=api-prod","affected":[{"type":"plugin","slug":"flickr-rss","name":"flickrRSS","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":""}],"published":"2018-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9000c52-fdd7-43e2-ae6a-9f127c4a9fcd","source":"wordfence","cve":"CVE-2022-4972","title":"Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9000c52-fdd7-43e2-ae6a-9f127c4a9fcd?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.7.51","to_inclusive":true,"patched_in":"4.7.52"}],"published":"2022-11-26T00:00:00Z","updated":"2024-10-16T06:43:39Z"},{"id":"wordfence:a902e759-c55a-4c24-a0db-d1a49f3dee5a","source":"wordfence","cve":"CVE-2024-37456","title":"Noptin <= 3.4.2 - Missing Authorization to Unauthenticated Form Submission","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a902e759-c55a-4c24-a0db-d1a49f3dee5a?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T13:54:51Z"},{"id":"wordfence:a903c260-5872-4c2a-ac77-037985880c24","source":"wordfence","cve":"CVE-2026-115598","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a903c260-5872-4c2a-ac77-037985880c24?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2026-10-26T16:44:00Z","updated":"2026-10-28T01:23:19Z"},{"id":"wordfence:a9057fc2-f346-47e5-964a-f3c5b1653c03","source":"wordfence","cve":"CVE-2021-24562","title":"LMS by LifterLMS \u2013 Online Course, Membership & Learning Management System Plugin for WordPress < 4.21.2 - Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9057fc2-f346-47e5-964a-f3c5b1653c03?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"4.21.2","to_inclusive":false,"patched_in":"4.21.2"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9077714-bddd-4b94-b01d-054f55f18da1","source":"wordfence","cve":"CVE-2024-49332","title":"Giveaway Boost <= 2.1.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9077714-bddd-4b94-b01d-054f55f18da1?source=api-prod","affected":[{"type":"plugin","slug":"giveaway-boost","name":"Giveaway Boost","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:53:38Z"},{"id":"wordfence:a908ac17-666f-4725-86f4-c9af4589fb69","source":"wordfence","cve":"CVE-2023-43610","title":"Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a908ac17-666f-4725-86f4-c9af4589fb69?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.22","to_inclusive":false,"patched_in":"2.8.22"}],"published":"2023-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a90c51d9-c89a-4164-a732-89434a6e0b8e","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting in post_oxi_settings function","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90c51d9-c89a-4164-a732-89434a6e0b8e?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a90c5f00-76a0-42d6-a0e6-e2abba9230a9","source":"wordfence","cve":"CVE-2026-62004","title":"Motorix <= 1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90c5f00-76a0-42d6-a0e6-e2abba9230a9?source=api-prod","affected":[{"type":"theme","slug":"motorix","name":"Motorix","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:42Z"},{"id":"wordfence:a90e1628-3490-4aac-9e82-b3b9692813f0","source":"wordfence","cve":"CVE-2015-9321","title":"Shortcode Factory <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90e1628-3490-4aac-9e82-b3b9692813f0?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-factory","name":"Shortcode Factory","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a90e5607-2c9a-4f3f-9f20-0ff1b8963a13","source":"wordfence","cve":"CVE-2025-58804","title":"WooCommerce Single Page Checkout <= 1.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90e5607-2c9a-4f3f-9f20-0ff1b8963a13?source=api-prod","affected":[{"type":"plugin","slug":"woo-single-page-checkout","name":"WooCommerce Single Page Checkout","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:23:48Z"},{"id":"wordfence:a90ea845-9f7f-4a89-887d-cf4337f8471f","source":"wordfence","cve":"CVE-2023-25712","title":"Google Analytics Opt-Out <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90ea845-9f7f-4a89-887d-cf4337f8471f?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-opt-out","name":"Google Analytics Opt-Out","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a90fce5c-8bb5-4cc4-8fcd-abc15e0c3e1d","source":"wordfence","cve":"CVE-2026-62014","title":"EmojiNation <= 1.0.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a90fce5c-8bb5-4cc4-8fcd-abc15e0c3e1d?source=api-prod","affected":[{"type":"theme","slug":"emojination","name":"EmojiNation","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:36:56Z"},{"id":"wordfence:a910fd44-4de1-41e8-8da2-d72a2f835797","source":"wordfence","cve":"CVE-2014-9414","title":"W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a910fd44-4de1-41e8-8da2-d72a2f835797?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.4.1"}],"published":"2014-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9113601-7833-4d7a-8567-97e99b54200a","source":"wordfence","cve":"CVE-2024-51702","title":"SrcSet Responsive Images for WordPress <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9113601-7833-4d7a-8567-97e99b54200a?source=api-prod","affected":[{"type":"plugin","slug":"truenorth-srcset","name":"SrcSet Responsive Images for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:02:29Z"},{"id":"wordfence:a9137397-f6fe-45bb-82a2-d1dc63f4cbd2","source":"wordfence","cve":"CVE-2026-94666","title":"Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9137397-f6fe-45bb-82a2-d1dc63f4cbd2?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:32:47Z"},{"id":"wordfence:a913ca7e-8f61-4615-b7fb-863b111fe22e","source":"wordfence","cve":"CVE-2019-15827","title":"OneSignal Web Push Notifications <=1.17.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a913ca7e-8f61-4615-b7fb-863b111fe22e?source=api-prod","affected":[{"type":"plugin","slug":"onesignal-free-web-push-notifications","name":"OneSignal \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"1.17.7","to_inclusive":true,"patched_in":"1.17.8"}],"published":"2019-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9162c2e-e765-4bda-b09f-982603b5797a","source":"wordfence","cve":"CVE-2007-1230","title":"WordPress Core <= 2.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9162c2e-e765-4bda-b09f-982603b5797a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2007-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a916d3d1-71c4-4443-b6cf-0c3a8b56feee","source":"wordfence","cve":"CVE-2026-28155","title":"Do Lasso <= 358 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a916d3d1-71c4-4443-b6cf-0c3a8b56feee?source=api-prod","affected":[{"type":"plugin","slug":"lasso","name":"ToneDen Shortcode","from":"*","from_inclusive":true,"to":"358","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:49:18Z"},{"id":"wordfence:a917a24b-09cc-48e9-844a-e1ed573a708f","source":"wordfence","cve":"CVE-2025-12778","title":"Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a917a24b-09cc-48e9-844a-e1ed573a708f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member-widgets-for-elementor","name":"MemberKits \u2013 Ultimate Member for Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2025-11-19T16:28:08Z","updated":"2025-11-20T04:37:15Z"},{"id":"wordfence:a919c252-c468-48be-a4e4-f5524419d8f9","source":"wordfence","cve":"CVE-2025-48299","title":"YayExtra <= 1.5.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a919c252-c468-48be-a4e4-f5524419d8f9?source=api-prod","affected":[{"type":"plugin","slug":"yayextra","name":"YayExtra \u2013 WooCommerce Extra Product Options","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:57:05Z"},{"id":"wordfence:a91a95c5-c7df-4972-b722-fe2cb4bc356f","source":"wordfence","cve":"CVE-2026-61967","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a91a95c5-c7df-4972-b722-fe2cb4bc356f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T13:09:45Z"},{"id":"wordfence:a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e","source":"wordfence","cve":"CVE-2025-8446","title":"Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a91bd1cf-ac63-4d65-b9fc-3fa2507cc27e?source=api-prod","affected":[{"type":"plugin","slug":"blaze-demo-importer","name":"Blaze Demo Importer","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-09-15T00:00:00Z","updated":"2025-09-16T11:17:09Z"},{"id":"wordfence:a91e20c4-86f2-42d4-9c65-4eccf3a24e3f","source":"wordfence","cve":"CVE-2026-23545","title":"Aruba HiSpeed Cache <= 3.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a91e20c4-86f2-42d4-9c65-4eccf3a24e3f?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-24T19:21:17Z"},{"id":"wordfence:a91e8713-a760-4acd-9987-2a6b11dbdd56","source":"wordfence","cve":"CVE-2023-45607","title":"WordPress Popular Posts <= 6.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a91e8713-a760-4acd-9987-2a6b11dbdd56?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"6.3.3","to_inclusive":false,"patched_in":"6.3.3"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a920a77a-681a-4309-bce2-1f77c11c8b29","source":"wordfence","cve":"CVE-2024-6479","title":"SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a920a77a-681a-4309-bce2-1f77c11c8b29?source=api-prod","affected":[{"type":"plugin","slug":"sip-reviews-shortcode-woocommerce","name":"SIP Reviews Shortcode for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-10-31T00:00:00Z","updated":"2025-12-09T17:07:35Z"},{"id":"wordfence:a920d8c0-fb6b-40dc-ae61-ac004b0dfccd","source":"wordfence","cve":"CVE-2026-2500","title":"Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a920d8c0-fb6b-40dc-ae61-ac004b0dfccd?source=api-prod","affected":[{"type":"plugin","slug":"quick-playground","name":"Quick Playground","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-06-05T14:22:06Z","updated":"2026-06-06T02:28:37Z"},{"id":"wordfence:a922bf72-192e-457f-9c33-59835e9aff2a","source":"wordfence","cve":"CVE-2022-4426","title":"Mautic Integration for WooCommerce < 1.0.3 - Cross-Site Request Forgery leading to Arbitrary Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a922bf72-192e-457f-9c33-59835e9aff2a?source=api-prod","affected":[{"type":"plugin","slug":"mautic-integration-for-woocommerce","name":"Mautic Integration for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a922c2ad-77ec-4fa8-b997-fa7e85d96590","source":"wordfence","cve":"CVE-2026-1647","title":"Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a922c2ad-77ec-4fa8-b997-fa7e85d96590?source=api-prod","affected":[{"type":"plugin","slug":"comment-genius","name":"Comment Genius","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:45Z","updated":"2026-03-21T03:26:58Z"},{"id":"wordfence:a923c84e-3641-45ec-970e-faea803897bf","source":"wordfence","cve":"","title":"Imediapixel Themes (Various Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a923c84e-3641-45ec-970e-faea803897bf?source=api-prod","affected":[{"type":"theme","slug":"avanix","name":"Avanix - Responsive Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"ecobiz","name":"ECOBIZ - Business WordPress Theme","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"ebiz","name":"EBIZ - Corporate and Business Wordpress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"ovum","name":"ovum - Clean and Minimalist Business Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a928247a-3eb5-4889-bd42-b0263f4cd140","source":"wordfence","cve":"CVE-2021-25051","title":"Modal Window \u2013 create popup modal window <= 5.2.1 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a928247a-3eb5-4889-bd42-b0263f4cd140?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":false,"patched_in":"5.2.2"}],"published":"2021-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9295e78-b45d-4738-b14e-1a16d5915920","source":"wordfence","cve":"CVE-2026-92826","title":"EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9295e78-b45d-4738-b14e-1a16d5915920?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.7","to_inclusive":true,"patched_in":"8.8.0"}],"published":"2026-10-02T14:29:02Z","updated":"2026-10-03T03:25:45Z"},{"id":"wordfence:a929efaf-80a1-45c1-9426-6c5b45a66530","source":"wordfence","cve":"CVE-2026-14270","title":"Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a929efaf-80a1-45c1-9426-6c5b45a66530?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-tm-extra-checkout-options-addon","name":"Extra Checkout Options - addon for Extra Product Options plugin","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-07-28T23:02:15Z","updated":"2026-07-29T11:34:19Z"},{"id":"wordfence:a92ade02-4625-4f6a-a9e2-07546b2c20fc","source":"wordfence","cve":"CVE-2026-84096","title":"Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a92ade02-4625-4f6a-a9e2-07546b2c20fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.7.11","to_inclusive":true,"patched_in":"12.7.12"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T14:07:16Z"},{"id":"wordfence:a92beff1-3bc6-459e-aeca-5cbdf2152388","source":"wordfence","cve":"CVE-2023-7289","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a92beff1-3bc6-459e-aeca-5cbdf2152388?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:39Z"},{"id":"wordfence:a92d5176-4cf0-4a31-9dcc-a2dc3259d29b","source":"wordfence","cve":"CVE-2023-34030","title":"Complianz | GDPR/CCPA Cookie Consent <= 6.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a92d5176-4cf0-4a31-9dcc-a2dc3259d29b?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.6","to_inclusive":false,"patched_in":"6.4.6"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a92d53ab-9c59-4c9c-93e5-32dd05246249","source":"wordfence","cve":"CVE-2025-9378","title":"Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a92d53ab-9c59-4c9c-93e5-32dd05246249?source=api-prod","affected":[{"type":"plugin","slug":"vayu-blocks","name":"Vayu Blocks \u2013 Website Builder for the Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2025-09-02T00:00:00Z","updated":"2025-09-03T06:43:10Z"},{"id":"wordfence:a92e307d-b3c0-441a-abac-580a60dd44cf","source":"wordfence","cve":"CVE-2024-22147","title":"PDF Invoices & Packing Slips for WooCommerce <= 3.7.6 - Authenticated (Shop Manager+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a92e307d-b3c0-441a-abac-580a60dd44cf?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":true,"patched_in":"3.7.7"}],"published":"2024-01-12T00:00:00Z","updated":"2024-02-01T23:36:33Z"},{"id":"wordfence:a931436c-102e-414a-9c1d-64c768be7b93","source":"wordfence","cve":"CVE-2025-31054","title":"Bloggie <= 2.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a931436c-102e-414a-9c1d-64c768be7b93?source=api-prod","affected":[{"type":"theme","slug":"bloggie","name":"bloggie","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T20:57:08Z"},{"id":"wordfence:a9384e78-fc46-4a3d-9a10-6d4fda17c698","source":"wordfence","cve":"CVE-2026-57325","title":"NanoMag <= 1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9384e78-fc46-4a3d-9a10-6d4fda17c698?source=api-prod","affected":[{"type":"theme","slug":"nanomag","name":"NanoMag - Responsive WordPress Magazine Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:20:11Z"},{"id":"wordfence:a939be31-7475-4626-ba1b-af9a9d6d5eda","source":"wordfence","cve":"CVE-2024-13389","title":"Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a939be31-7475-4626-ba1b-af9a9d6d5eda?source=api-prod","affected":[{"type":"plugin","slug":"cliptakes","name":"Cliptakes","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-01-22T21:32:31Z","updated":"2025-01-23T11:13:29Z"},{"id":"wordfence:a93c0dd4-8341-438d-8730-470e9a230d97","source":"wordfence","cve":"CVE-2023-33332","title":"WooCommerce Product Vendors <= 2.1.76 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a93c0dd4-8341-438d-8730-470e9a230d97?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.76","to_inclusive":true,"patched_in":"2.1.77"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a93f6dce-56e0-4131-ba26-65a0c6b2e9c5","source":"wordfence","cve":"","title":"Yampi Checkout < = 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a93f6dce-56e0-4131-ba26-65a0c6b2e9c5?source=api-prod","affected":[{"type":"plugin","slug":"yampi-checkout","name":"Yampi Checkout","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a94177d5-ad49-4143-9e51-8be4ff99d936","source":"wordfence","cve":"CVE-2026-12980","title":"Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a94177d5-ad49-4143-9e51-8be4ff99d936?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-15T08:41:12Z"},{"id":"wordfence:a9455a51-3f3a-40a6-9ab1-ebfe8ebde05b","source":"wordfence","cve":"CVE-2026-39774","title":"Tourfic Pro <= 1.17.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9455a51-3f3a-40a6-9ab1-ebfe8ebde05b?source=api-prod","affected":[{"type":"plugin","slug":"tourfic-pro","name":"Tourfic Pro","from":"*","from_inclusive":true,"to":"1.17.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:59:40Z"},{"id":"wordfence:a9461354-0e69-47d9-a11c-838cfa94be67","source":"wordfence","cve":"CVE-2014-3210","title":"Pinpoint Booking System \u2013 #1 WordPress Booking Plugin < 1.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9461354-0e69-47d9-a11c-838cfa94be67?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2014-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a946cca6-670b-4baf-a941-43d0a0261c0d","source":"wordfence","cve":"CVE-2012-6506","title":"Zingiri Web Shop Plugin <= 2.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a946cca6-670b-4baf-a941-43d0a0261c0d?source=api-prod","affected":[{"type":"plugin","slug":"zingiri-web-shop","name":"zingiri-web-shop","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2012-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a94708ec-ab09-4604-80ec-5bd85799c6e4","source":"wordfence","cve":"CVE-2018-10363","title":"Booking calendar, Appointment Booking System < 2.2.3 - Unauthenticated Parameter Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a94708ec-ab09-4604-80ec-5bd85799c6e4?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2018-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9498085-87c7-47e7-aac8-c0397264a7eb","source":"wordfence","cve":"CVE-2016-5834","title":"WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9498085-87c7-47e7-aac8-c0397264a7eb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a94accad-27c7-462b-b26f-0dde2036a7ba","source":"wordfence","cve":"CVE-2023-46619","title":"Spider Facebook <= 1.0.15 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a94accad-27c7-462b-b26f-0dde2036a7ba?source=api-prod","affected":[{"type":"plugin","slug":"spider-facebook","name":"WDSocialWidgets","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a94dfee0-217f-4c83-8ec5-660fb174a5c5","source":"wordfence","cve":"CVE-2025-49412","title":"Page Transition <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a94dfee0-217f-4c83-8ec5-660fb174a5c5?source=api-prod","affected":[{"type":"plugin","slug":"page-transition","name":"Page Transition","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:08:29Z"},{"id":"wordfence:a9511f60-b07d-4601-aa2f-25083b24d9aa","source":"wordfence","cve":"CVE-2024-30453","title":"Brave Popup Builder <= 0.6.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9511f60-b07d-4601-aa2f-25083b24d9aa?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":true,"patched_in":"0.6.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:38:07Z"},{"id":"wordfence:a9521ae8-e20e-49dd-a402-5521f8d2d98e","source":"wordfence","cve":"CVE-2026-3617","title":"Paypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9521ae8-e20e-49dd-a402-5521f8d2d98e?source=api-prod","affected":[{"type":"plugin","slug":"paypal-shortcodes","name":"Paypal Shortcodes","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:07Z","updated":"2026-03-21T03:26:58Z"},{"id":"wordfence:a9565693-fd0b-4412-944c-81b3cd79492e","source":"wordfence","cve":"CVE-2024-0371","title":"Views for WPForms <= 3.2.2 - Missing Authorization via create_view","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9565693-fd0b-4412-944c-81b3cd79492e?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T22:49:59Z"},{"id":"wordfence:a9576cee-2375-437e-9dc8-713209a96a73","source":"wordfence","cve":"CVE-2026-14955","title":"Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9576cee-2375-437e-9dc8-713209a96a73?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-field-editor-pro","name":"Checkout Field Editor for WooCommerce (Pro)","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2026-07-24T17:26:59Z","updated":"2026-07-25T05:34:55Z"},{"id":"wordfence:a95cbc9e-146a-4b6d-bfb7-9f7ea5ec394e","source":"wordfence","cve":"","title":"Wr Age Verification <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95cbc9e-146a-4b6d-bfb7-9f7ea5ec394e?source=api-prod","affected":[{"type":"plugin","slug":"wr-age-verification","name":"Wr Age Verification","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a95d7ff6-55ce-4d63-8433-60cece306628","source":"wordfence","cve":"CVE-2023-47811","title":"Anywhere Flash Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95d7ff6-55ce-4d63-8433-60cece306628?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-flash-embed","name":"Anywhere Flash Embed","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a95e1164-2c48-4265-818d-4ee4e894532b","source":"wordfence","cve":"CVE-2025-23734","title":"Gigaom Sphinx <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95e1164-2c48-4265-818d-4ee4e894532b?source=api-prod","affected":[{"type":"plugin","slug":"go-sphinx","name":"Gigaom Sphinx","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:23:22Z"},{"id":"wordfence:a95e98e4-97a7-436f-9ceb-6ff6fecd860f","source":"wordfence","cve":"CVE-2025-53428","title":"Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95e98e4-97a7-436f-9ceb-6ff6fecd860f?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-20T00:00:00Z","updated":"2026-05-19T14:55:50Z"},{"id":"wordfence:a95f16ae-286d-474c-b85e-8d47a14d7533","source":"wordfence","cve":"CVE-2025-26992","title":"Landing Page Cat <= 1.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95f16ae-286d-474c-b85e-8d47a14d7533?source=api-prod","affected":[{"type":"plugin","slug":"landing-page-cat","name":"Landing Page Cat \u2013 Coming Soon & Maintenance Pages","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:30:02Z"},{"id":"wordfence:a95f5aa7-6ff1-4ebf-9b5a-17ad784eefe7","source":"wordfence","cve":"CVE-2025-46539","title":"Fable Extra <= 1.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a95f5aa7-6ff1-4ebf-9b5a-17ad784eefe7?source=api-prod","affected":[{"type":"plugin","slug":"fable-extra","name":"Fable Extra","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:06:55Z"},{"id":"wordfence:a961d30e-f2cb-458d-8f1a-18f6e769efbc","source":"wordfence","cve":"","title":"WP Discord Invite <= 2.4.1 - Reflected Cross-Site Scripting via webhook","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a961d30e-f2cb-458d-8f1a-18f6e769efbc?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-invite","name":"WP Discord Invite","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a963679f-f64e-4f85-b375-b4edd49d2008","source":"wordfence","cve":"CVE-2026-66609","title":"TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme <= 5.12.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a963679f-f64e-4f85-b375-b4edd49d2008?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"5.12.3","to_inclusive":true,"patched_in":"5.12.3.1"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:09:33Z"},{"id":"wordfence:a9636b15-1259-4c6e-8691-b1d573ef0417","source":"wordfence","cve":"CVE-2022-1538","title":"Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9636b15-1259-4c6e-8691-b1d573ef0417?source=api-prod","affected":[{"type":"plugin","slug":"theme-demo-import","name":"Theme Demo Import","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-11-08T00:00:00Z","updated":"2024-07-08T16:48:00Z"},{"id":"wordfence:a963cd9b-9f8f-4bd2-92cd-74c5e85e1d96","source":"wordfence","cve":"CVE-2025-0810","title":"Read More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a963cd9b-9f8f-4bd2-92cd-74c5e85e1d96?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2025-04-04T13:09:44Z","updated":"2025-07-24T19:14:13Z"},{"id":"wordfence:a96ac71f-3dae-40eb-9268-d56688a5aa64","source":"wordfence","cve":"CVE-2023-5467","title":"GEO my WordPress <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96ac71f-3dae-40eb-9268-d56688a5aa64?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a96c9047-9dea-4bc7-8982-8983930f7cfa","source":"wordfence","cve":"","title":"Augmented reality plugin <= 1.2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96c9047-9dea-4bc7-8982-8983930f7cfa?source=api-prod","affected":[{"type":"plugin","slug":"augmented-reality","name":"Augmented reality plugin","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2020-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a96d0979-a40b-4ced-872f-c5a8116471a1","source":"wordfence","cve":"CVE-2025-31422","title":"Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96d0979-a40b-4ced-872f-c5a8116471a1?source=api-prod","affected":[{"type":"theme","slug":"visual-arts","name":"Visual Art | Gallery WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-21T20:49:15Z"},{"id":"wordfence:a96da08b-f43d-4432-8c47-c86a1a1299ae","source":"wordfence","cve":"CVE-2014-4569","title":"Broadcast Live Video \u2013 Live Streaming < 4.27.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96da08b-f43d-4432-8c47-c86a1a1299ae?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.27.4","to_inclusive":false,"patched_in":"4.27.4"}],"published":"2014-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a96e58e6-7340-42e9-bdc3-585c46cb2104","source":"wordfence","cve":"CVE-2025-69077","title":"Hobo <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96e58e6-7340-42e9-bdc3-585c46cb2104?source=api-prod","affected":[{"type":"theme","slug":"hobo","name":"Hobo | Travel Lifestyle Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:31:27Z"},{"id":"wordfence:a96f99ba-982b-4dac-a9ce-e75af85cd5d5","source":"wordfence","cve":"CVE-2025-22785","title":"Course Booking System <= 6.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a96f99ba-982b-4dac-a9ce-e75af85cd5d5?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-system","name":"Course Booking System","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2025-01-13T00:00:00Z","updated":"2025-03-06T20:59:18Z"},{"id":"wordfence:a971c80b-c71a-4c58-8291-c8918af034d9","source":"wordfence","cve":"CVE-2021-24354","title":"Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a971c80b-c71a-4c58-8291-c8918af034d9?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"2.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a973dd0a-1a36-4ea2-a300-0f8bb277dfaa","source":"wordfence","cve":"CVE-2014-0166","title":"WordPress Core < 3.8.2 - Authentication Cookie Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a973dd0a-1a36-4ea2-a300-0f8bb277dfaa?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2014-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9743351-9f28-49bf-8b08-85ffbdcfa5f0","source":"wordfence","cve":"","title":"Co-Authors Plus 3.5 - 3.5.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9743351-9f28-49bf-8b08-85ffbdcfa5f0?source=api-prod","affected":[{"type":"plugin","slug":"co-authors-plus","name":"Co-Authors Plus","from":"3.5","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9747cda-735c-4087-8c4d-9c445c6d1596","source":"wordfence","cve":"CVE-2023-1905","title":"WP Popups \u2013 WordPress Popup builder <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9747cda-735c-4087-8c4d-9c445c6d1596?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.5.1"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a979e885-f7dd-4616-a881-64f3d97c309d","source":"wordfence","cve":"CVE-2023-3342","title":"User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a979e885-f7dd-4616-a881-64f3d97c309d?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.2.1"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a97b3cf1-e7b7-41c6-8b7a-e06bda77f7f7","source":"wordfence","cve":"CVE-2024-29768","title":"Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97b3cf1-e7b7-41c6-8b7a-e06bda77f7f7?source=api-prod","affected":[{"type":"theme","slug":"astra","name":"Astra","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:44:31Z"},{"id":"wordfence:a97d5ca2-a11f-4417-8447-9aa9d7108aa4","source":"wordfence","cve":"CVE-2025-39512","title":"Bulk Term Editor <= 1.1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97d5ca2-a11f-4417-8447-9aa9d7108aa4?source=api-prod","affected":[{"type":"plugin","slug":"bulk-term-editor","name":"Bulk Term Editor","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:36:05Z"},{"id":"wordfence:a97de342-5802-4ad7-b255-635a5776a126","source":"wordfence","cve":"CVE-2025-31840","title":"Simple Fixed Notice <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97de342-5802-4ad7-b255-635a5776a126?source=api-prod","affected":[{"type":"plugin","slug":"dn-cookie-notice","name":"Simple Fixed Notice","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:08:41Z"},{"id":"wordfence:a97df03d-a927-4745-b7ed-3a8402a21298","source":"wordfence","cve":"CVE-2024-13836","title":"WP Login Control <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97df03d-a927-4745-b7ed-3a8402a21298?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-control","name":"WP Login Control","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T16:00:05Z"},{"id":"wordfence:a97f72f6-86f7-45dc-908a-292ba735071d","source":"wordfence","cve":"CVE-2024-4361","title":"Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97f72f6-86f7-45dc-908a-292ba735071d?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.29.15","to_inclusive":true,"patched_in":"2.29.16"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-21T11:02:29Z"},{"id":"wordfence:a97f74bf-c3a5-4bb3-a7fd-d3f43af6ec42","source":"wordfence","cve":"CVE-2024-27958","title":"Visualizer <= 3.10.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a97f74bf-c3a5-4bb3-a7fd-d3f43af6ec42?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.10.5","to_inclusive":true,"patched_in":"3.10.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T20:59:46Z"},{"id":"wordfence:a981e454-32ba-494d-b47f-769a1e544e16","source":"wordfence","cve":"CVE-2024-35659","title":"KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a981e454-32ba-494d-b47f-769a1e544e16?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2024-06-03T00:00:00Z","updated":"2025-01-30T16:13:28Z"},{"id":"wordfence:a98498b8-9397-42e9-9c99-a576975c9ac9","source":"wordfence","cve":"CVE-2023-5234","title":"Related Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a98498b8-9397-42e9-9c99-a576975c9ac9?source=api-prod","affected":[{"type":"plugin","slug":"woo-related-products-refresh-on-reload","name":"Related Products for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.15","to_inclusive":true,"patched_in":"3.3.16"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9892dd1-3939-41a9-a828-fa1bf7d96eb8","source":"wordfence","cve":"CVE-2021-4366","title":"PWA for WP & AMP < = 1.7.32 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=api-prod","affected":[{"type":"plugin","slug":"pwa-for-wp","name":"PWA for WP \u2013 Progressive Web Apps Made Simple","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.7.33"}],"published":"2021-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a98b31a5-2aac-439f-a081-445dba4522e2","source":"wordfence","cve":"CVE-2026-77002","title":"SmilePass Selfie Login <= 1.0.2 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a98b31a5-2aac-439f-a081-445dba4522e2?source=api-prod","affected":[{"type":"plugin","slug":"selfie-login","name":"SmilePass Selfie Login","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:18:37Z"},{"id":"wordfence:a98e61f8-1891-4c19-b8d7-ca3c82a75eed","source":"wordfence","cve":"CVE-2026-54850","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a98e61f8-1891-4c19-b8d7-ca3c82a75eed?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-10-30T07:08:06Z","updated":"2026-11-03T20:01:40Z"},{"id":"wordfence:a98f6a68-5863-4147-86c4-8c19af469be3","source":"wordfence","cve":"CVE-2021-4413","title":"Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a98f6a68-5863-4147-86c4-8c19af469be3?source=api-prod","affected":[{"type":"plugin","slug":"process-steps-template-designer","name":"Process Steps Template Designer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a991921e-04cb-4704-8a6a-948fa6be97bf","source":"wordfence","cve":"CVE-2026-73361","title":"Recipe Card Blocks Lite <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a991921e-04cb-4704-8a6a-948fa6be97bf?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.4.18","to_inclusive":true,"patched_in":"3.4.19"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:35:23Z"},{"id":"wordfence:a992dd59-ac56-4da0-9be7-fe32df440e5b","source":"wordfence","cve":"CVE-2022-4580","title":"Twenty20 Image Before-After <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a992dd59-ac56-4da0-9be7-fe32df440e5b?source=api-prod","affected":[{"type":"plugin","slug":"twenty20","name":"Twenty20 Image Before-After","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9939ffe-a5d5-45cb-b673-665acf1ff09d","source":"wordfence","cve":"","title":"GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9939ffe-a5d5-45cb-b673-665acf1ff09d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a99456c4-c828-4dc9-9375-8981eafbeb15","source":"wordfence","cve":"CVE-2025-4659","title":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99456c4-c828-4dc9-9375-8981eafbeb15?source=api-prod","affected":[{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-05-29T00:00:00Z","updated":"2025-05-30T05:23:22Z"},{"id":"wordfence:a9992d0d-7c6e-4184-8f48-1515d50cc028","source":"wordfence","cve":"CVE-2023-6222","title":"Quttera Web Malware Scanner <= 3.4.1.48 - Authenticated (Administrator+) Directory Traversal via ShowFile","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9992d0d-7c6e-4184-8f48-1515d50cc028?source=api-prod","affected":[{"type":"plugin","slug":"quttera-web-malware-scanner","name":"Quttera ThreatSign \u2013 Web Malware Scanner for WordPress","from":"*","from_inclusive":true,"to":"3.4.1.48","to_inclusive":true,"patched_in":"3.4.2.1"}],"published":"2023-11-21T00:00:00Z","updated":"2026-09-04T00:32:14Z"},{"id":"wordfence:a99a64f7-1ea8-4de6-b24f-1f69bf25c1f5","source":"wordfence","cve":"CVE-2024-5416","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99a64f7-1ea8-4de6-b24f-1f69bf25c1f5?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.23.4","to_inclusive":true,"patched_in":"3.24.0"}],"published":"2024-09-10T23:03:06Z","updated":"2024-09-11T11:32:03Z"},{"id":"wordfence:a99b8eb9-1511-4ec0-98f4-c0e0c989fa28","source":"wordfence","cve":"CVE-2024-4581","title":"Slider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99b8eb9-1511-4ec0-98f4-c0e0c989fa28?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.7.11"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-04T08:31:21Z"},{"id":"wordfence:a99c48fa-ba01-4ef1-96c3-5bd82bfda2c1","source":"wordfence","cve":"CVE-2026-84778","title":"Migrate Guru \u2013 Site Migration & Cloning <= 6.65 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99c48fa-ba01-4ef1-96c3-5bd82bfda2c1?source=api-prod","affected":[{"type":"plugin","slug":"migrate-guru","name":"Migrate Guru \u2013 Site Migration & Cloning","from":"*","from_inclusive":true,"to":"6.65","to_inclusive":true,"patched_in":"6.72"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:19:01Z"},{"id":"wordfence:a99d0220-38af-40fe-8b9f-af173fc41248","source":"wordfence","cve":"CVE-2025-12407","title":"Events Manager \u2013 Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99d0220-38af-40fe-8b9f-af173fc41248?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.2.2.2","to_inclusive":true,"patched_in":"7.2.2.3"}],"published":"2025-12-11T21:40:07Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:a99ec547-63b5-474b-b6d0-e4ef9c2b4445","source":"wordfence","cve":"CVE-2026-32362","title":"Sessions Time Monitoring Full Automatic <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a99ec547-63b5-474b-b6d0-e4ef9c2b4445?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:05:58Z"},{"id":"wordfence:a9a02910-5674-4266-ab6e-7926bf6adecc","source":"wordfence","cve":"CVE-2025-7665","title":"Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a02910-5674-4266-ab6e-7926bf6adecc?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-firebase-sms-otp-verification","name":"Miniorange OTP Verification with Firebase","from":"3.1.0","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-09-19T00:13:56Z","updated":"2025-10-29T20:50:53Z"},{"id":"wordfence:a9a48769-94d9-459f-b34b-fdfe4c10b36c","source":"wordfence","cve":"CVE-2024-4265","title":"Master Addons \u2013 Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a48769-94d9-459f-b34b-fdfe4c10b36c?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.5.9","to_inclusive":true,"patched_in":"2.0.6.0"}],"published":"2024-04-29T00:00:00Z","updated":"2024-06-13T13:48:22Z"},{"id":"wordfence:a9a52097-0d85-4036-9b74-f35fea549607","source":"wordfence","cve":"CVE-2026-7509","title":"KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a52097-0d85-4036-9b74-f35fea549607?source=api-prod","affected":[{"type":"plugin","slug":"kia-subtitle","name":"KIA Subtitle","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-05-21T14:37:59Z","updated":"2026-05-22T03:39:21Z"},{"id":"wordfence:a9a9bec8-7a76-4819-91c7-d9fdae3d94de","source":"wordfence","cve":"CVE-2025-5538","title":"BNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a9bec8-7a76-4819-91c7-d9fdae3d94de?source=api-prod","affected":[{"type":"plugin","slug":"bns-featured-category","name":"BNS Featured Category","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:47:26Z","updated":"2025-06-06T06:42:53Z"},{"id":"wordfence:a9af1429-32c5-4907-acf4-83efc6727bb8","source":"wordfence","cve":"CVE-2023-23672","title":"GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9af1429-32c5-4907-acf4-83efc6727bb8?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9af78cf-8a04-47a9-8cb5-c276bc504b0f","source":"wordfence","cve":"CVE-2026-56035","title":"BitFire Security \u2013 Firewall, Malware Scanner, Bot Blocker, Login Protection <= 5.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9af78cf-8a04-47a9-8cb5-c276bc504b0f?source=api-prod","affected":[{"type":"plugin","slug":"bitfire","name":"BitFire Security \u2013 Firewall, Malware Scanner, Bot Blocker, Login Protection","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T14:09:42Z"},{"id":"wordfence:a9af89a7-7d02-4656-a7b1-89f7a3555334","source":"wordfence","cve":"CVE-2025-62016","title":"Kallyas <= 4.22.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9af89a7-7d02-4656-a7b1-89f7a3555334?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2025-09-06T00:00:00Z","updated":"2025-11-12T13:52:38Z"},{"id":"wordfence:a9b074ed-2edd-4774-b0b2-dc08c9647094","source":"wordfence","cve":"CVE-2021-24503","title":"Popular Brand Icons - Simple Icons <= 2.7.7 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b074ed-2edd-4774-b0b2-dc08c9647094?source=api-prod","affected":[{"type":"plugin","slug":"simple-icons","name":"Popular Brand Icons \u2013 Simple Icons","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9b1445f-3b6b-40fa-9a12-f55d63668dda","source":"wordfence","cve":"CVE-2016-15041","title":"MainWP Dashboard \u2013 The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b1445f-3b6b-40fa-9a12-f55d63668dda?source=api-prod","affected":[{"type":"plugin","slug":"mainwp","name":"MainWP Dashboard: Self-hosted WordPress Management for Agencies","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2016-04-29T00:00:00Z","updated":"2024-10-16T06:43:40Z"},{"id":"wordfence:a9b2b094-9a2d-4c73-be5f-b2a6f3da9233","source":"wordfence","cve":"CVE-2023-32582","title":"Don8 <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b2b094-9a2d-4c73-be5f-b2a6f3da9233?source=api-prod","affected":[{"type":"plugin","slug":"don8","name":"Don8","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9b3b5ae-b086-4068-aa05-a732f1a8f508","source":"wordfence","cve":"CVE-2025-25137","title":"Social Links <= 1.0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b3b5ae-b086-4068-aa05-a732f1a8f508?source=api-prod","affected":[{"type":"plugin","slug":"social-links","name":"Social Links","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T15:31:12Z"},{"id":"wordfence:a9b3b6cc-faaa-46c2-ab82-00c7138a8f27","source":"wordfence","cve":"CVE-2025-10582","title":"WP Dispatcher <= 1.3.0 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b3b6cc-faaa-46c2-ab82-00c7138a8f27?source=api-prod","affected":[{"type":"plugin","slug":"wp-dispatcher","name":"WP Dispatcher","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:17:58Z","updated":"2026-09-11T15:14:09Z"},{"id":"wordfence:a9b45e9b-57a6-4bfd-b9e4-d07780370f02","source":"wordfence","cve":"CVE-2023-52120","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b45e9b-57a6-4bfd-b9e4-d07780370f02?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.2","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9b58681-6ef4-4f3f-97b7-02b192fc641f","source":"wordfence","cve":"CVE-2026-123145","title":"WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Insecure Storage of Password","severity":"medium","cvss":4.3,"cwe":"CWE-256","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b58681-6ef4-4f3f-97b7-02b192fc641f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"10.9.0","from_inclusive":true,"to":"11.0.1","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:19:25Z"},{"id":"wordfence:a9b5bf28-14fc-4a9f-909b-3374aca0f402","source":"wordfence","cve":"CVE-2025-69104","title":"Qreatix <= 1.9.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b5bf28-14fc-4a9f-909b-3374aca0f402?source=api-prod","affected":[{"type":"theme","slug":"qreatix","name":"Qreatix \u2013 Interactive Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:25:04Z"},{"id":"wordfence:a9b6b136-50f3-4c82-8a6c-23277aef0b92","source":"wordfence","cve":"CVE-2026-110360","title":"Ajax Search Lite \u2013 Live Search & Filter <= 4.14.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b6b136-50f3-4c82-8a6c-23277aef0b92?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.14.5","to_inclusive":true,"patched_in":"4.14.6"}],"published":"2026-10-15T18:12:00Z","updated":"2026-10-23T18:32:20Z"},{"id":"wordfence:a9b6f7a3-83eb-4352-9db6-ab4b03241702","source":"wordfence","cve":"CVE-2024-13480","title":"LTL Freight Quotes \u2013 For Customers of FedEx Freight  <= 3.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b6f7a3-83eb-4352-9db6-ab4b03241702?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-fedex-freight-edition","name":"LTL Freight Quotes \u2013 For Customers of FedEx Freight","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T11:11:18Z"},{"id":"wordfence:a9b7a73c-6fba-4b5d-9f82-c3710cc8555d","source":"wordfence","cve":"CVE-2022-0479","title":"Popup Builder <= 4.1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b7a73c-6fba-4b5d-9f82-c3710cc8555d?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e","source":"wordfence","cve":"CVE-2026-12736","title":"WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint","severity":"high","cvss":8.0,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e?source=api-prod","affected":[{"type":"plugin","slug":"wpify-woo","name":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.16","to_inclusive":true,"patched_in":"5.4.17"}],"published":"2026-07-23T14:23:21Z","updated":"2026-07-24T02:32:01Z"},{"id":"wordfence:a9bbcb41-d604-45ec-a36a-4b41e8f7a508","source":"wordfence","cve":"CVE-2026-15295","title":"Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-692","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9bbcb41-d604-45ec-a36a-4b41e8f7a508?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2024-03-28T00:00:00Z","updated":"2026-07-10T19:44:08Z"},{"id":"wordfence:a9bd9617-254a-40b3-a1ec-00d30b75e1b8","source":"wordfence","cve":"CVE-2022-3539","title":"Testimonials (Free <= 2.6, Pro < 1.0.7) - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9bd9617-254a-40b3-a1ec-00d30b75e1b8?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"},{"type":"plugin","slug":"super-testimonial-pro","name":"Testimonials Pro","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9bffba4-5bcd-4ef7-a8d8-84ba452827ab","source":"wordfence","cve":"CVE-2014-8606","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9bffba4-5bcd-4ef7-a8d8-84ba452827ab?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c0677a-9e2e-4342-be04-cd7c5cae3b18","source":"wordfence","cve":"CVE-2025-47596","title":"Beacon Lead Magnets and Lead Capture <= 1.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c0677a-9e2e-4342-be04-cd7c5cae3b18?source=api-prod","affected":[{"type":"plugin","slug":"beacon-by","name":"Beacon Lead Magnets and Lead Capture","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2025-05-07T00:00:00Z","updated":"2025-12-19T14:52:36Z"},{"id":"wordfence:a9c08f2e-bffd-40a6-89f3-559cb34f4395","source":"wordfence","cve":"CVE-2024-13359","title":"Product Input Fields for WooCommerce  <= 1.12.0 - Unauthenticated Limited File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c08f2e-bffd-40a6-89f3-559cb34f4395?source=api-prod","affected":[{"type":"plugin","slug":"product-input-fields-for-woocommerce","name":"Product Input Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-13T14:08:36Z"},{"id":"wordfence:a9c0d256-7e7e-4608-ac2d-aa888a57493a","source":"wordfence","cve":"CVE-2026-97242","title":"WEBO MCP <= 3.0.18 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c0d256-7e7e-4608-ac2d-aa888a57493a?source=api-prod","affected":[{"type":"plugin","slug":"webo-mcp","name":"WEBO MCP","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":true,"patched_in":"3.0.22"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T13:24:33Z"},{"id":"wordfence:a9c1231c-b12f-40ef-8ecb-54505c97aa2d","source":"wordfence","cve":"CVE-2025-62061","title":"Product Catalog Simple <= 1.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c1231c-b12f-40ef-8ecb-54505c97aa2d?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:11:59Z"},{"id":"wordfence:a9c41797-b256-47de-a783-18df36dd2234","source":"wordfence","cve":"","title":"Injection Guard <= 1.2.1 - Missing Authorization to Whitelist Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c41797-b256-47de-a783-18df36dd2234?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c4d444-0f55-44b2-b12e-5abc2a30c3fe","source":"wordfence","cve":"CVE-2024-35173","title":"Serial Numbers for WooCommerce \u2013 License Manager <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c4d444-0f55-44b2-b12e-5abc2a30c3fe?source=api-prod","affected":[{"type":"plugin","slug":"wc-serial-numbers","name":"Serial Numbers \u2013 Ultimate License Manager for Selling, Licensing & Securely Delivering Digital Content with WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-05-10T00:00:00Z","updated":"2024-12-06T12:18:26Z"},{"id":"wordfence:a9c4e296-f98a-4018-980d-173d5e7ade7b","source":"wordfence","cve":"CVE-2023-40207","title":"Donations Made Easy \u2013 Smart Donations <= 4.0.12 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c4e296-f98a-4018-980d-173d5e7ade7b?source=api-prod","affected":[{"type":"plugin","slug":"smart-donations","name":"Donations Made Easy \u2013 Smart Donations","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":""}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c500fc-0d85-41b1-a2b8-9c8ba372a6e3","source":"wordfence","cve":"CVE-2023-46775","title":"Original texts Yandex WebMaster <= 1.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c500fc-0d85-41b1-a2b8-9c8ba372a6e3?source=api-prod","affected":[{"type":"plugin","slug":"original-texts-yandex-webmaster","name":"Original texts Yandex WebMaster","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c6c35f-1095-4897-b4a6-e7b295c187de","source":"wordfence","cve":"CVE-2024-2140","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c6c35f-1095-4897-b4a6-e7b295c187de?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-03-30T06:44:46Z"},{"id":"wordfence:a9c7d539-2ea7-4f72-b0d2-6082e26918ce","source":"wordfence","cve":"","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.3.58 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c7d539-2ea7-4f72-b0d2-6082e26918ce?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.3.58","to_inclusive":true,"patched_in":"1.3.59"}],"published":"2014-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c82154-d390-44ba-a54a-89f4bb69cdce","source":"wordfence","cve":"CVE-2021-4365","title":"Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c82154-d390-44ba-a54a-89f4bb69cdce?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9c8c5e8-e345-460a-b6ba-5d5cbb018e6b","source":"wordfence","cve":"CVE-2026-42723","title":"CleanSkin <= 1.5.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c8c5e8-e345-460a-b6ba-5d5cbb018e6b?source=api-prod","affected":[{"type":"theme","slug":"cleanskin","name":"CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:20:43Z"},{"id":"wordfence:a9ca2479-10ce-42ec-a9f3-0f91119d9525","source":"wordfence","cve":"CVE-2024-29775","title":"Frontend Dashboard <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ca2479-10ce-42ec-a9f3-0f91119d9525?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T12:55:36Z"},{"id":"wordfence:a9ca2bc8-8ec3-4fd2-a1ab-ee0982182623","source":"wordfence","cve":"CVE-2025-23493","title":"Google Transliteration <= 1.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ca2bc8-8ec3-4fd2-a1ab-ee0982182623?source=api-prod","affected":[{"type":"plugin","slug":"google-transliteration","name":"Google Transliteration","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T18:52:06Z"},{"id":"wordfence:a9cc4dcf-7485-458c-8376-a19b2c32f8d6","source":"wordfence","cve":"CVE-2024-49675","title":"iBryl Switch User <= 1.0.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc4dcf-7485-458c-8376-a19b2c32f8d6?source=api-prod","affected":[{"type":"plugin","slug":"ibryl-switch-user","name":"Plugin Name: iBryl Switch User","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:35:12Z"},{"id":"wordfence:a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc","source":"wordfence","cve":"CVE-2019-25152","title":"Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cc5c6d-4396-4ebf-8788-f01dd9e9cfbc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"7.12.0","to_inclusive":true,"patched_in":"7.13.0"},{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":false,"patched_in":"5.2.0"}],"published":"2019-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9cf7103-e644-4328-bd14-e8fd53f9489b","source":"wordfence","cve":"CVE-2025-64291","title":"Premmerce User Roles <= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9cf7103-e644-4328-bd14-e8fd53f9489b?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-05-10T00:00:00Z","updated":"2026-02-25T12:53:22Z"},{"id":"wordfence:a9d11f3a-eb28-4a80-8970-8ad05284a5b4","source":"wordfence","cve":"CVE-2024-43236","title":"Easy PayPal Buy Now Button <= 1.9 - Unauthenticated Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d11f3a-eb28-4a80-8970-8ad05284a5b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-paypal","name":"Easy PayPal & Stripe Buy Now Button","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:31:36Z"},{"id":"wordfence:a9d32b7d-4218-4db3-93e2-246573b47dfc","source":"wordfence","cve":"CVE-2024-51916","title":"Multifox Plus <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d32b7d-4218-4db3-93e2-246573b47dfc?source=api-prod","affected":[{"type":"plugin","slug":"multifox-plus","name":"Multifox Plus","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:45:06Z"},{"id":"wordfence:a9d61a72-cced-457d-b6ca-d5b9f9936c5a","source":"wordfence","cve":"CVE-2025-31754","title":"DobsonDev Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d61a72-cced-457d-b6ca-d5b9f9936c5a?source=api-prod","affected":[{"type":"plugin","slug":"dobsondev-shortcodes","name":"DobsonDev Shortcodes","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-12T15:37:54Z"},{"id":"wordfence:a9d7aa30-421f-4d25-8e01-460069ef857d","source":"wordfence","cve":"CVE-2026-39481","title":"Modula Image Gallery \u2013 Photo Grid & Video Gallery <= 2.14.18 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d7aa30-421f-4d25-8e01-460069ef857d?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.14.18","to_inclusive":true,"patched_in":"2.14.19"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:00:21Z"},{"id":"wordfence:a9d95af5-96da-4259-98c6-e2c4c574a896","source":"wordfence","cve":"CVE-2023-5360","title":"Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9d95af5-96da-4259-98c6-e2c4c574a896?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.78","to_inclusive":true,"patched_in":"1.3.79"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9db002f-ff41-493a-87b1-5f0b4b07cfc2","source":"wordfence","cve":"CVE-2023-5533","title":"AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"},{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"4.9.2","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9dc828d-3b18-48fe-a0db-af26d3c1fa97","source":"wordfence","cve":"CVE-2025-58021","title":"List Child Pages Shortcode <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9dc828d-3b18-48fe-a0db-af26d3c1fa97?source=api-prod","affected":[{"type":"plugin","slug":"list-child-pages-shortcode","name":"List Child Pages Shortcode","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:03:49Z"},{"id":"wordfence:a9ddbb9c-c2c9-4e34-ac22-2afe8050e15b","source":"wordfence","cve":"CVE-2012-1067","title":"WP-RecentComments <= 2.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ddbb9c-c2c9-4e34-ac22-2afe8050e15b?source=api-prod","affected":[{"type":"plugin","slug":"wp-recentcomments","name":"WP-RecentComments","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.1"}],"published":"2011-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9ddc932-7d82-4e3f-b8e1-8442fe23822e","source":"wordfence","cve":"CVE-2026-96827","title":"Admin Notices Manager <= 1.6.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ddc932-7d82-4e3f-b8e1-8442fe23822e?source=api-prod","affected":[{"type":"plugin","slug":"admin-notices-manager","name":"Admin Notices Manager","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:57:33Z"},{"id":"wordfence:a9e18f26-ddc2-4ed4-89e7-20c7c086f446","source":"wordfence","cve":"CVE-2024-37925","title":"BuddyBoss Theme <= 2.4.61 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e18f26-ddc2-4ed4-89e7-20c7c086f446?source=api-prod","affected":[{"type":"theme","slug":"buddyboss-theme","name":"BuddyBoss Theme","from":"*","from_inclusive":true,"to":"2.4.61","to_inclusive":true,"patched_in":"2.5.01"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:47:28Z"},{"id":"wordfence:a9e4b14f-0f55-47bc-8e40-19b262e50561","source":"wordfence","cve":"CVE-2024-3598","title":"ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ekit_btn_id'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4b14f-0f55-47bc-8e40-19b262e50561?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T01:57:11Z"},{"id":"wordfence:a9e4e989-8e55-4ea7-8f42-9f67cfab1168","source":"wordfence","cve":"CVE-2020-36721","title":"Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4e989-8e55-4ea7-8f42-9f67cfab1168?source=api-prod","affected":[{"type":"theme","slug":"newspaper-x","name":"Newspaper X","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"},{"type":"theme","slug":"brilliance","name":"Brilliance","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.3.0"},{"type":"theme","slug":"activello","name":"Activello","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2020-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9e67057-7086-4108-a629-87610a12ec19","source":"wordfence","cve":"CVE-2022-2395","title":"weForms <= 1.6.13 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e67057-7086-4108-a629-87610a12ec19?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.13","to_inclusive":true,"patched_in":"1.6.14"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9ea90e1-62db-4fcf-9390-fb66b3ae44b9","source":"wordfence","cve":"CVE-2026-104397","title":"Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ea90e1-62db-4fcf-9390-fb66b3ae44b9?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.34.2","to_inclusive":true,"patched_in":"1.34.3"}],"published":"2026-10-05T08:49:00Z","updated":"2026-10-08T23:24:14Z"},{"id":"wordfence:a9ed2943-e108-49e3-ba16-f74ce3136bde","source":"wordfence","cve":"CVE-2026-4025","title":"PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ed2943-e108-49e3-ba16-f74ce3136bde?source=api-prod","affected":[{"type":"plugin","slug":"privatecontent-free","name":"PrivateContent Free","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-04-07T21:05:38Z","updated":"2026-04-08T09:25:49Z"},{"id":"wordfence:a9ed9a77-5a51-4664-a8a5-579824f8eae7","source":"wordfence","cve":"CVE-2021-24811","title":"Shop Page WP <= 1.2.7 - Authenticated Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ed9a77-5a51-4664-a8a5-579824f8eae7?source=api-prod","affected":[{"type":"plugin","slug":"shop-page-wp","name":"Shop Page WP","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9ee519a-f50a-48fd-829f-5b4ea61f90ed","source":"wordfence","cve":"CVE-2026-103308","title":"Visma Pay for Woocommerce < 1.2.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ee519a-f50a-48fd-829f-5b4ea61f90ed?source=api-prod","affected":[{"type":"plugin","slug":"visma-pay-payment-gateway","name":"Visma Pay for Woocommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:05:56Z"},{"id":"wordfence:a9ee709d-6590-4c07-9788-6150733c1691","source":"wordfence","cve":"CVE-2023-1977","title":"Booking Manager <= 2.0.28 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ee709d-6590-4c07-9788-6150733c1691?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.0.28","to_inclusive":true,"patched_in":"2.0.29"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9ee90c4-e9ab-426e-8b92-217de43bd2e4","source":"wordfence","cve":"CVE-2022-4239","title":"Workreap <= 2.6.3 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ee90c4-e9ab-426e-8b92-217de43bd2e4?source=api-prod","affected":[{"type":"theme","slug":"workreap","name":"Workreap - Freelance Marketplace and Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:a9eed9ee-2a84-4500-8ec9-86036c257659","source":"wordfence","cve":"CVE-2025-47680","title":"xili-tidy-tags <= 1.12.06 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9eed9ee-2a84-4500-8ec9-86036c257659?source=api-prod","affected":[{"type":"plugin","slug":"xili-tidy-tags","name":"xili-tidy-tags","from":"*","from_inclusive":true,"to":"1.12.06","to_inclusive":true,"patched_in":""}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-13T14:37:18Z"},{"id":"wordfence:a9ef7742-e6f8-4350-90e9-242d9d1b12a0","source":"wordfence","cve":"CVE-2024-3215","title":"Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ef7742-e6f8-4350-90e9-242d9d1b12a0?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:52:29Z"},{"id":"wordfence:a9f17d4a-62b2-433e-bbba-551081a72fcb","source":"wordfence","cve":"CVE-2025-68064","title":"Goya Core < 1.0.9.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9f17d4a-62b2-433e-bbba-551081a72fcb?source=api-prod","affected":[{"type":"plugin","slug":"goya-core","name":"Goya Core","from":"*","from_inclusive":true,"to":"1.0.9.4","to_inclusive":false,"patched_in":"1.0.9.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T11:43:19Z"},{"id":"wordfence:a9f5eab2-09d9-4d8e-8024-abf02b0f6b86","source":"wordfence","cve":"CVE-2025-67963","title":"Movie Booking <= 1.1.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9f5eab2-09d9-4d8e-8024-abf02b0f6b86?source=api-prod","affected":[{"type":"plugin","slug":"movie-booking","name":"Movie Booking","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:36:11Z"},{"id":"wordfence:a9f6ab26-f4e4-4774-8663-d003efe27762","source":"wordfence","cve":"CVE-2026-65510","title":"PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9f6ab26-f4e4-4774-8663-d003efe27762?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:43:37Z"},{"id":"wordfence:a9f8ab73-8c2a-4551-bad9-4e5cc67231e5","source":"wordfence","cve":"CVE-2025-13537","title":"Live Composer \u2013 Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9f8ab73-8c2a-4551-bad9-4e5cc67231e5?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-12-16T00:00:00Z","updated":"2025-12-17T18:21:35Z"},{"id":"wordfence:a9ff662b-35e8-4a9d-8d74-3304ab976280","source":"wordfence","cve":"CVE-2024-50538","title":"Show Visitor IP Address <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ff662b-35e8-4a9d-8d74-3304ab976280?source=api-prod","affected":[{"type":"plugin","slug":"show-visitor-ip-address","name":"Show Visitor IP Address","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:14:22Z"},{"id":"wordfence:aa00fe53-dc65-4200-80bb-9167b4230194","source":"wordfence","cve":"CVE-2026-12433","title":"Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa00fe53-dc65-4200-80bb-9167b4230194?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-07-08T20:27:39Z","updated":"2026-07-09T08:31:35Z"},{"id":"wordfence:aa07f48f-370f-4985-a6fc-a94ed5c59ed4","source":"wordfence","cve":"CVE-2024-12071","title":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa07f48f-370f-4985-a6fc-a94ed5c59ed4?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T03:21:13Z"},{"id":"wordfence:aa080b36-01ce-496a-9938-9715f0131e29","source":"wordfence","cve":"CVE-2024-25096","title":"Canto <= 3.0.6 - Remote File Inclusion to Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa080b36-01ce-496a-9938-9715f0131e29?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-02-12T00:00:00Z","updated":"2024-04-12T19:00:18Z"},{"id":"wordfence:aa105250-7d19-49c9-af20-6d5e033314e6","source":"wordfence","cve":"CVE-2016-10936","title":"WP-Polls <= 2.73 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa105250-7d19-49c9-af20-6d5e033314e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.73","to_inclusive":true,"patched_in":"2.73.1"}],"published":"2016-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa107267-2e67-48bf-968c-7f741ecbd786","source":"wordfence","cve":"CVE-2025-13113","title":"Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa107267-2e67-48bf-968c-7f741ecbd786?source=api-prod","affected":[{"type":"plugin","slug":"accessibe","name":"Web Accessibility by accessiBe","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T03:25:18Z"},{"id":"wordfence:aa13426a-2d4e-4268-bc0d-e496bc9e6f33","source":"wordfence","cve":"CVE-2023-2254","title":"Ko-fi Button <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa13426a-2d4e-4268-bc0d-e496bc9e6f33?source=api-prod","affected":[{"type":"plugin","slug":"ko-fi-button","name":"Ko-fi Button","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa13c293-0530-478c-acfc-f7d69edae318","source":"wordfence","cve":"","title":"ansi-regex >=2.1.1 <3.0.1 >=4.0.0 <4.1.1 >=5.0.0 <5.0.1 >=6.0.0 <6.0.1 - Regular Expression Denial of Service (ReDoS)","severity":"high","cvss":7.5,"cwe":"CWE-1333","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa13c293-0530-478c-acfc-f7d69edae318?source=api-prod","affected":[{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa14909c-58f6-40f1-af50-eb1a0d2333de","source":"wordfence","cve":"CVE-2017-14760","title":"Event Espresso Free/Lite <= 3.1.37.12.L - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa14909c-58f6-40f1-af50-eb1a0d2333de?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-free","name":"Event Expresso Free","from":"*","from_inclusive":true,"to":"3.1.37.12","to_inclusive":true,"patched_in":"3.1.37.14L"},{"type":"plugin","slug":"event-espresso-free","name":"Event Expresso Free","from":"*","from_inclusive":true,"to":"3.1.37.12.L","to_inclusive":true,"patched_in":"3.1.37.14L"}],"published":"2019-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa14cc6f-aeea-4be3-888b-8d4542b66309","source":"wordfence","cve":"CVE-2025-57895","title":"JobWP <= 2.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa14cc6f-aeea-4be3-888b-8d4542b66309?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:53:04Z"},{"id":"wordfence:aa1542f6-2ba5-4e64-a138-fabc5e4e2578","source":"wordfence","cve":"CVE-2026-93580","title":"InPost for WooCommerce 1.7.5 - 1.9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1542f6-2ba5-4e64-a138-fabc5e4e2578?source=api-prod","affected":[{"type":"plugin","slug":"inpost-for-woocommerce","name":"InPost PL","from":"1.7.5","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:48:52Z"},{"id":"wordfence:aa154536-9f9f-48c3-96c7-4091991e4f6c","source":"wordfence","cve":"CVE-2023-36531","title":"LiquidPoll \u2013 Advanced Polls for Creators and Brands <= 3.3.68 - Missing Authorization via activate_addon","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa154536-9f9f-48c3-96c7-4091991e4f6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-poll","name":"LiquidPoll \u2013 Polls, Surveys, NPS and Feedback Reviews","from":"*","from_inclusive":true,"to":"3.3.68","to_inclusive":true,"patched_in":"3.3.69"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa157c80-447f-4406-9e49-9cc6208b7b19","source":"wordfence","cve":"CVE-2023-2916","title":"InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa157c80-447f-4406-9e49-9cc6208b7b19?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa15df6a-3411-4d69-8337-a3944ceae9ee","source":"wordfence","cve":"CVE-2024-31301","title":"Multiple Page Generator Plugin \u2013 MPG <= 3.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa15df6a-3411-4d69-8337-a3944ceae9ee?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:42:22Z"},{"id":"wordfence:aa16ab9f-4fb1-43de-bfbb-bd6caf6a68dc","source":"wordfence","cve":"CVE-2022-47180","title":"Kopa Framework <= 1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa16ab9f-4fb1-43de-bfbb-bd6caf6a68dc?source=api-prod","affected":[{"type":"plugin","slug":"kopatheme","name":"Kopa Framework","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa16cbeb-b3ba-4ef4-83ef-69d8ebd3738f","source":"wordfence","cve":"","title":"Simple Flash Video <= 1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa16cbeb-b3ba-4ef4-83ef-69d8ebd3738f?source=api-prod","affected":[{"type":"plugin","slug":"simple-flash-video","name":"simple-flash-video","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa174135-d7aa-44f1-8924-44313fc70a75","source":"wordfence","cve":"CVE-2023-37871","title":"WooCommerce GoCardless Gateway <= 2.5.6 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa174135-d7aa-44f1-8924-44313fc70a75?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-gocardless","name":"WooCommerce GoCardless Gateway","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa178e13-b4a5-4847-ac0e-9f14f8c9b446","source":"wordfence","cve":"CVE-2014-4593","title":"WP Plugin Manager (wppm) <= 1.6.4.b - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa178e13-b4a5-4847-ac0e-9f14f8c9b446?source=api-prod","affected":[{"type":"plugin","slug":"wppm","name":"wppm","from":"*","from_inclusive":true,"to":"1.6.4.b","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa18de7f-e645-4d1b-90d5-d47ee7e1d52d","source":"wordfence","cve":"CVE-2024-34804","title":"Tagembed <= 5.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa18de7f-e645-4d1b-90d5-d47ee7e1d52d?source=api-prod","affected":[{"type":"plugin","slug":"tagembed-widget","name":"Tagembed: Social Media Feeds and Customer Reviews Widget","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":true,"patched_in":"5.9"}],"published":"2024-05-17T00:00:00Z","updated":"2024-07-03T15:28:31Z"},{"id":"wordfence:aa197b6b-be18-48c2-a7e3-d921b4ef1c54","source":"wordfence","cve":"CVE-2024-33562","title":"XStore <= 9.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa197b6b-be18-48c2-a7e3-d921b4ef1c54?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.3.8","to_inclusive":true,"patched_in":"9.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:49:35Z"},{"id":"wordfence:aa19eb88-b47a-4438-accf-d98241b927af","source":"wordfence","cve":"CVE-2024-10558","title":"Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa19eb88-b47a-4438-accf-d98241b927af?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.29","to_inclusive":true,"patched_in":"1.15.30"}],"published":"2025-03-02T00:00:00Z","updated":"2025-03-24T19:56:32Z"},{"id":"wordfence:aa1bac80-4927-4fee-942c-c23d51b18abd","source":"wordfence","cve":"CVE-2026-65440","title":"GetGenie <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1bac80-4927-4fee-942c-c23d51b18abd?source=api-prod","affected":[{"type":"plugin","slug":"getgenie","name":"GetGenie \u2013 AI SEO Assistant & Content Writer with Keyword Research, AEO & GEO","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:23:19Z"},{"id":"wordfence:aa1eaac2-a23b-4ef6-803a-15f7ec7e5728","source":"wordfence","cve":"CVE-2025-11740","title":"wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1eaac2-a23b-4ef6-803a-15f7ec7e5728?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T05:40:24Z"},{"id":"wordfence:aa1ed81c-04cb-4ccd-8c30-b1d943730909","source":"wordfence","cve":"CVE-2026-6854","title":"My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1ed81c-04cb-4ccd-8c30-b1d943730909?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2026-07-07T23:19:29Z","updated":"2026-07-08T11:30:33Z"},{"id":"wordfence:aa2035ef-5251-49cc-a480-b6c167b5ef8c","source":"wordfence","cve":"CVE-2025-9489","title":"WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names","severity":"medium","cvss":5.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2035ef-5251-49cc-a480-b6c167b5ef8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.4.2","to_inclusive":true,"patched_in":"3.5.4.3"}],"published":"2025-09-08T16:23:22Z","updated":"2025-09-09T04:25:56Z"},{"id":"wordfence:aa2507db-5efc-4468-803a-34c9c400f841","source":"wordfence","cve":"CVE-2025-31747","title":"WP Chrono <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2507db-5efc-4468-803a-34c9c400f841?source=api-prod","affected":[{"type":"plugin","slug":"wp-chrono","name":"WP Chrono","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:49:41Z"},{"id":"wordfence:aa262ff5-2b6c-421b-b155-a75d01005534","source":"wordfence","cve":"CVE-2025-39588","title":"Ultimate Store Kit Elementor Addons <= 2.4.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa262ff5-2b6c-421b-b155-a75d01005534?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:32:34Z"},{"id":"wordfence:aa26e595-947c-4327-bbe1-c347688f1209","source":"wordfence","cve":"CVE-2024-5768","title":"MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa26e595-947c-4327-bbe1-c347688f1209?source=api-prod","affected":[{"type":"plugin","slug":"mimo-woocommerce-order-tracking","name":"MIMO Woocommerce Order Tracking","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-18T14:42:48Z","updated":"2024-06-19T03:20:12Z"},{"id":"wordfence:aa26e958-4850-451b-88eb-d48fc0c7feb7","source":"wordfence","cve":"CVE-2024-1322","title":"Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa26e958-4850-451b-88eb-d48fc0c7feb7?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.8.4","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:39Z"},{"id":"wordfence:aa27c758-f02b-4120-bf66-b310720161b4","source":"wordfence","cve":"CVE-2026-75959","title":"GoPay for WooCommerce <= 1.0.34 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa27c758-f02b-4120-bf66-b310720161b4?source=api-prod","affected":[{"type":"plugin","slug":"gopay-gateway","name":"GoPay for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2026-09-18T19:09:45Z","updated":"2026-10-01T12:51:31Z"},{"id":"wordfence:aa290a4b-06b6-4057-ae56-1c0b74b2ee5a","source":"wordfence","cve":"CVE-2024-32107","title":"Finale Lite <= 2.18.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa290a4b-06b6-4057-ae56-1c0b74b2ee5a?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:44:36Z"},{"id":"wordfence:aa2a2399-d795-4b1b-87a0-a80bb23856e0","source":"wordfence","cve":"CVE-2026-14182","title":"Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-697","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2a2399-d795-4b1b-87a0-a80bb23856e0?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-20T14:05:15Z"},{"id":"wordfence:aa2bd74a-563a-4a2d-b1d7-b3678db82b00","source":"wordfence","cve":"CVE-2021-4452","title":"Google Language Translator <= 6.0.9 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2bd74a-563a-4a2d-b1d7-b3678db82b00?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.10","to_inclusive":false,"patched_in":"6.0.10"}],"published":"2021-07-21T00:00:00Z","updated":"2024-10-16T07:31:51Z"},{"id":"wordfence:aa309da6-6552-43e4-aeea-f822493dd029","source":"wordfence","cve":"CVE-2020-9466","title":"Export Users to CSV < 1.4 - CSV Injection","severity":"high","cvss":7.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa309da6-6552-43e4-aeea-f822493dd029?source=api-prod","affected":[{"type":"plugin","slug":"export-users","name":"Export Users to CSV","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2019-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa30b959-cdf2-4b3b-9c65-d52e1d839a79","source":"wordfence","cve":"CVE-2026-25006","title":"XStore <= 9.6.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa30b959-cdf2-4b3b-9c65-d52e1d839a79?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6.4","to_inclusive":true,"patched_in":"9.6.5"}],"published":"2026-01-18T00:00:00Z","updated":"2026-05-04T15:08:54Z"},{"id":"wordfence:aa32a790-242f-4142-9f4d-e1b2a07045bb","source":"wordfence","cve":"CVE-2023-5740","title":"Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa32a790-242f-4142-9f4d-e1b2a07045bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-messenger","name":"Live Chat with Facebook Messenger","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa337eec-62de-4782-a477-fa09a48a296e","source":"wordfence","cve":"CVE-2026-108685","title":"Post Author <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa337eec-62de-4782-a477-fa09a48a296e?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T19:21:30Z"},{"id":"wordfence:aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b","source":"wordfence","cve":"CVE-2025-0939","title":"MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=api-prod","affected":[{"type":"plugin","slug":"magicform","name":"MagicForm","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T18:12:29Z","updated":"2025-02-01T06:41:51Z"},{"id":"wordfence:aa34fdd1-5a04-43c6-a005-17be1256b09e","source":"wordfence","cve":"CVE-2015-9361","title":"Related Posts <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa34fdd1-5a04-43c6-a005-17be1256b09e?source=api-prod","affected":[{"type":"plugin","slug":"related-posts","name":"Related Posts","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa355718-c08f-4a22-bf6e-697af267ad12","source":"wordfence","cve":"CVE-2018-17947","title":"Snazzy Maps <= 1.1.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa355718-c08f-4a22-bf6e-697af267ad12?source=api-prod","affected":[{"type":"plugin","slug":"snazzy-maps","name":"Snazzy Maps","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2018-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa385a1f-1623-4f0a-bb2f-d4564b8f91bf","source":"wordfence","cve":"CVE-2025-4606","title":"Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa385a1f-1623-4f0a-bb2f-d4564b8f91bf?source=api-prod","affected":[{"type":"theme","slug":"sala","name":"Sala - Startup & SaaS WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-09T03:22:04Z"},{"id":"wordfence:aa3909f6-fd2f-44e7-83b5-51c8cda4b20f","source":"wordfence","cve":"CVE-2024-12438","title":"WooCommerce Digital Content Delivery (incl. DRM) \u2013 FlickRocket <= 4.75 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3909f6-fd2f-44e7-83b5-51c8cda4b20f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-digital-content-delivery-with-drm-flickrocket","name":"Digital Content Delivery (incl. DRM) by Flickrocket for WooCommerce","from":"*","from_inclusive":true,"to":"4.75","to_inclusive":true,"patched_in":"4.76"}],"published":"2025-01-06T16:27:49Z","updated":"2025-07-24T19:02:17Z"},{"id":"wordfence:aa3e030b-8ef1-4dbc-940d-6c2ab2683620","source":"wordfence","cve":"CVE-2025-11171","title":"Chartify \u2013 WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3e030b-8ef1-4dbc-940d-6c2ab2683620?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-10-07T16:43:39Z","updated":"2025-10-08T05:24:50Z"},{"id":"wordfence:aa3e27ca-8837-4cd8-a233-ad1eed365f7c","source":"wordfence","cve":"CVE-2013-7482","title":"ReFlex Gallery < 1.4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3e27ca-8837-4cd8-a233-ad1eed365f7c?source=api-prod","affected":[{"type":"plugin","slug":"reflex-gallery","name":"ReFlex Gallery \u00bb WordPress Photo Gallery","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa3ff74a-a38e-4cb3-b0b8-99fb16185f42","source":"wordfence","cve":"","title":"Zedity \u2013 The Layout-Free Content Editor < 2.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3ff74a-a38e-4cb3-b0b8-99fb16185f42?source=api-prod","affected":[{"type":"plugin","slug":"zedity","name":"Zedity \u2013 The Layout-Free Content Editor","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa4244d3-a611-416d-8159-2f6a8cf61b30","source":"wordfence","cve":"CVE-2023-51422","title":"WebinarIgnition <= 3.05.0 - Authenticated(Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa4244d3-a611-416d-8159-2f6a8cf61b30?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"3.05.4","to_inclusive":true,"patched_in":"3.05.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-09T17:25:06Z"},{"id":"wordfence:aa4377a8-bcf4-45ba-824b-3505bd8e8c61","source":"wordfence","cve":"CVE-2024-0612","title":"Content Views <= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa4377a8-bcf4-45ba-824b-3505bd8e8c61?source=api-prod","affected":[{"type":"plugin","slug":"content-views-query-and-display-post-page","name":"Content Views \u2013 Post Grid & Filter (Shortcode, Blocks, Elementor Widgets)","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-01-22T00:00:00Z","updated":"2024-07-29T21:37:05Z"},{"id":"wordfence:aa441e45-9c33-483e-8332-49ac4dc7eaa3","source":"wordfence","cve":"CVE-2022-4716","title":"WP Popups <= 2.1.4.7 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa441e45-9c33-483e-8332-49ac4dc7eaa3?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.1.4.7","to_inclusive":true,"patched_in":"2.1.4.8"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa464547-0380-4b91-a5ea-0cd9a66da7a7","source":"wordfence","cve":"CVE-2024-8680","title":"MailChimp for Wordpress <= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa464547-0380-4b91-a5ea-0cd9a66da7a7?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.9.16","to_inclusive":true,"patched_in":"4.9.17"}],"published":"2024-09-20T20:24:42Z","updated":"2024-09-21T08:35:55Z"},{"id":"wordfence:aa46842f-ed07-4f72-aedb-aa27baecd79c","source":"wordfence","cve":"CVE-2024-9507","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa46842f-ed07-4f72-aedb-aa27baecd79c?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.15.2","to_inclusive":true,"patched_in":"2.15.3"}],"published":"2024-10-10T19:11:18Z","updated":"2024-10-11T07:37:48Z"},{"id":"wordfence:aa46bdb3-6bbe-4f2f-8e1a-fbb54c5b39fd","source":"wordfence","cve":"CVE-2025-9243","title":"Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa46bdb3-6bbe-4f2f-8e1a-fbb54c5b39fd?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.5.32","to_inclusive":true,"patched_in":"3.5.33"}],"published":"2025-10-03T14:11:08Z","updated":"2025-11-07T17:19:38Z"},{"id":"wordfence:aa4e18b0-f871-4476-af92-42e55aabdf93","source":"wordfence","cve":"CVE-2026-3876","title":"Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa4e18b0-f871-4476-af92-42e55aabdf93?source=api-prod","affected":[{"type":"plugin","slug":"prismatic","name":"Prismatic","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2026-04-15T18:26:27Z","updated":"2026-04-16T06:44:54Z"},{"id":"wordfence:aa5075a8-1da1-4738-ad4b-b6c323d772ee","source":"wordfence","cve":"CVE-2024-6894","title":"RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5075a8-1da1-4738-ad4b-b6c323d772ee?source=api-prod","affected":[{"type":"plugin","slug":"integracao-rd-station","name":"RD Station","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2024-09-04T21:25:30Z","updated":"2024-09-06T17:21:18Z"},{"id":"wordfence:aa5505b7-2d9e-4a03-9655-75d004f53259","source":"wordfence","cve":"CVE-2023-47240","title":"CBX Map for Google Map & OpenStreetMap <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5505b7-2d9e-4a03-9655-75d004f53259?source=api-prod","affected":[{"type":"plugin","slug":"cbxgooglemap","name":"CBX Map for Google Map & OpenStreetMap","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-08T19:09:06Z"},{"id":"wordfence:aa55dfe1-7ee8-4d25-a9f6-cbefeebb1376","source":"wordfence","cve":"CVE-2024-7827","title":"Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa55dfe1-7ee8-4d25-a9f6-cbefeebb1376?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-08-19T11:55:18Z","updated":"2024-08-20T02:03:18Z"},{"id":"wordfence:aa56cbb5-a01a-4feb-a57e-30b8a3832d32","source":"wordfence","cve":"CVE-2026-19454","title":"JetBackup \u2013 Backup, Restore & Migrate 3.1.18.8 - 3.1.23.3 - Authenticated (Admin+) Backup Download","severity":"medium","cvss":4.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa56cbb5-a01a-4feb-a57e-30b8a3832d32?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"3.1.18.8","from_inclusive":true,"to":"3.1.23.3","to_inclusive":true,"patched_in":"3.1.23.5"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T15:27:35Z"},{"id":"wordfence:aa5b6311-d9ca-4736-a6e3-56c6746b2470","source":"wordfence","cve":"CVE-2026-39497","title":"FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5b6311-d9ca-4736-a6e3-56c6746b2470?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-15T21:25:56Z"},{"id":"wordfence:aa5bdaf9-fbde-40d4-a72a-fd24489818b3","source":"wordfence","cve":"CVE-2024-3333","title":"Essential Addons for Elementor <= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5bdaf9-fbde-40d4-a72a-fd24489818b3?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.14","to_inclusive":true,"patched_in":"5.9.15"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-17T11:34:23Z"},{"id":"wordfence:aa5c20ff-1c8d-484e-977e-65be2a6c57e5","source":"wordfence","cve":"CVE-2025-39554","title":"AI Text to Speech <= 3.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c20ff-1c8d-484e-977e-65be2a6c57e5?source=api-prod","affected":[{"type":"plugin","slug":"ai-text-to-speech","name":"AI Text to Speech \u2013 TTS Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:58:56Z"},{"id":"wordfence:aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8","source":"wordfence","cve":"CVE-2024-5784","title":"Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c23ed-7239-40e1-a795-1ae8d4c2d6c8?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-08-29T00:00:00Z","updated":"2024-08-30T03:37:46Z"},{"id":"wordfence:aa5c2d05-f6cb-4f97-b174-653ad3577b02","source":"wordfence","cve":"CVE-2024-12491","title":"SimplyRETS Real Estate IDX <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c2d05-f6cb-4f97-b174-653ad3577b02?source=api-prod","affected":[{"type":"plugin","slug":"simply-rets","name":"SimplyRETS Real Estate IDX","from":"*","from_inclusive":true,"to":"2.11.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-08T00:00:00Z","updated":"2025-01-23T19:37:17Z"},{"id":"wordfence:aa5d75a4-7602-4fed-ab28-99aa18102c6c","source":"wordfence","cve":"CVE-2025-69064","title":"Pets Land <= 1.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5d75a4-7602-4fed-ab28-99aa18102c6c?source=api-prod","affected":[{"type":"theme","slug":"petsland","name":"Pets Land | Domestic Animals Shop & Veterinary WP","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:46:19Z"},{"id":"wordfence:aa5ee133-e38a-4dfe-975c-f194aa6e90b8","source":"wordfence","cve":"CVE-2023-5802","title":"WP Knowledgebase <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5ee133-e38a-4dfe-975c-f194aa6e90b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-knowledgebase","name":"WordPress Knowledge base & Documentation Plugin \u2013 WP Knowledgebase","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa5f7f2a-c7b7-4339-a608-51fd684c18bf","source":"wordfence","cve":"CVE-2023-4838","title":"Simple Download Counter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5f7f2a-c7b7-4339-a608-51fd684c18bf?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-counter","name":"Simple Download Counter","from":"1.6","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa60ed7c-baf3-4308-b4bf-1baa928d8e37","source":"wordfence","cve":"CVE-2014-5346","title":"Disqus Comment System < 2.79 - Multiple Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa60ed7c-baf3-4308-b4bf-1baa928d8e37?source=api-prod","affected":[{"type":"plugin","slug":"disqus-comment-system","name":"Disqus Comment System","from":"*","from_inclusive":true,"to":"2.79","to_inclusive":false,"patched_in":"2.79"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa60f16f-bd25-4b8b-9e3c-0996b9e3de42","source":"wordfence","cve":"CVE-2026-48835","title":"WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa60f16f-bd25-4b8b-9e3c-0996b9e3de42?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.10.0.4","to_inclusive":true,"patched_in":"1.10.0.5"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:21:02Z"},{"id":"wordfence:aa64d6b4-5673-4d88-b5c7-d3441eaa0706","source":"wordfence","cve":"CVE-2023-28661","title":"WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection via 'value'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa64d6b4-5673-4d88-b5c7-d3441eaa0706?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-banners","name":"WP Popup Banners","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa657530-7c85-4399-94bb-feaa7d21a47a","source":"wordfence","cve":"CVE-2022-45351","title":"Betheme <= 26.6.2 - Missing Authorization to Post Status Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa657530-7c85-4399-94bb-feaa7d21a47a?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.2","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa65bced-a449-4ba5-accf-40a824ee464d","source":"wordfence","cve":"CVE-2026-83625","title":"Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa65bced-a449-4ba5-accf-40a824ee464d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2026-09-04T19:31:56Z","updated":"2026-09-05T07:38:14Z"},{"id":"wordfence:aa66da82-8733-41cb-a276-620577d79e44","source":"wordfence","cve":"CVE-2024-32136","title":"BWL Advanced FAQ Manager <= 2.0.3 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa66da82-8733-41cb-a276-620577d79e44?source=api-prod","affected":[{"type":"plugin","slug":"bwl-advanced-faq-manager","name":"BWL Advanced FAQ Manager","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:49:06Z"},{"id":"wordfence:aa6874e5-d99d-4d20-aaf7-897fe8f05292","source":"wordfence","cve":"CVE-2026-25418","title":"Bit Form <= 2.21.10 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa6874e5-d99d-4d20-aaf7-897fe8f05292?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.21.10","to_inclusive":true,"patched_in":"2.21.11"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-26T20:10:25Z"},{"id":"wordfence:aa690c4d-15c4-43bc-b8f7-017b7741c5cd","source":"wordfence","cve":"CVE-2026-8875","title":"Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa690c4d-15c4-43bc-b8f7-017b7741c5cd?source=api-prod","affected":[{"type":"plugin","slug":"easy-prism-syntax-highlighter","name":"Easy Prism Syntax Highlighter","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:26:15Z","updated":"2026-05-27T05:31:29Z"},{"id":"wordfence:aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80","source":"wordfence","cve":"CVE-2021-4332","title":"The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"},{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"4.0","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa6adda7-5eba-483c-a759-6f8a92da75e3","source":"wordfence","cve":"CVE-2023-23643","title":"MainWP iThemes Security Extension <= 4.1.1 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa6adda7-5eba-483c-a759-6f8a92da75e3?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-ithemes-security-extension","name":"MainWP iThemes Security Extension","from":"4.1.1.","from_inclusive":true,"to":"4.1.1.","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa6b63bc-6e5f-498e-83e1-45e8e6c72df4","source":"wordfence","cve":"","title":"Task Manager Pro <= 1.3.1 - Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa6b63bc-6e5f-498e-83e1-45e8e6c72df4?source=api-prod","affected":[{"type":"plugin","slug":"task-manager-pro","name":"Task Manager Pro - Task Management Plugin For Wordpress","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2017-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa6c0dc9-0fcc-4d7d-8263-6e924ebabc48","source":"wordfence","cve":"CVE-2024-52454","title":"GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa6c0dc9-0fcc-4d7d-8263-6e924ebabc48?source=api-prod","affected":[{"type":"plugin","slug":"goqmieruca","name":"GoQMieruca","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:13:00Z"},{"id":"wordfence:aa6d82f7-cee4-4640-a736-26e3a35712e1","source":"wordfence","cve":"CVE-2025-32138","title":"Easy Google Maps <= 1.11.18 - Authenticated (Author+) XML Entity Injection","severity":"medium","cvss":6.3,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa6d82f7-cee4-4640-a736-26e3a35712e1?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.11.18","to_inclusive":true,"patched_in":"1.11.19"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:14:18Z"},{"id":"wordfence:aa70238b-530e-4c90-82f4-c3113887d0e1","source":"wordfence","cve":"CVE-2024-5189","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa70238b-530e-4c90-82f4-c3113887d0e1?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.23","to_inclusive":true,"patched_in":"5.9.24"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-11T13:54:00Z"},{"id":"wordfence:aa705a51-3051-4049-90c7-df8fd45bea32","source":"wordfence","cve":"CVE-2026-111401","title":"Tailored Tools <= 3.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa705a51-3051-4049-90c7-df8fd45bea32?source=api-prod","affected":[{"type":"plugin","slug":"tailored-tools","name":"Tailored Tools","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-10-21T18:02:00Z","updated":"2026-10-23T18:27:03Z"},{"id":"wordfence:aa7276bb-6a9b-4cbd-8333-14c4dfac4108","source":"wordfence","cve":"CVE-2024-24798","title":"Debug <= 1.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7276bb-6a9b-4cbd-8333-14c4dfac4108?source=api-prod","affected":[{"type":"plugin","slug":"debug","name":"Debug","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.11"}],"published":"2024-01-31T00:00:00Z","updated":"2024-04-01T20:39:59Z"},{"id":"wordfence:aa72e120-9b8c-4e2f-8808-6ef8a957ec23","source":"wordfence","cve":"CVE-2026-61980","title":"OMGF Pro <= 5.2.7 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa72e120-9b8c-4e2f-8808-6ef8a957ec23?source=api-prod","affected":[{"type":"plugin","slug":"host-google-fonts-pro","name":"OMGF Pro","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:40:24Z"},{"id":"wordfence:aa735320-f7fe-4e51-9f9a-f4c8f3ddc2e7","source":"wordfence","cve":"","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa735320-f7fe-4e51-9f9a-f4c8f3ddc2e7?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.14","to_inclusive":false,"patched_in":"3.3.14"}],"published":"2018-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa75a836-cbbd-4f56-a4f3-a1be4e4baa65","source":"wordfence","cve":"CVE-2024-51589","title":"Bigmart Elements <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa75a836-cbbd-4f56-a4f3-a1be4e4baa65?source=api-prod","affected":[{"type":"plugin","slug":"bigmart-elements","name":"Bigmart Elements","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:44:00Z"},{"id":"wordfence:aa769d51-8718-42e9-9070-0b878442dbc7","source":"wordfence","cve":"CVE-2024-4102","title":"Pricing Table <= 2.0.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa769d51-8718-42e9-9070-0b878442dbc7?source=api-prod","affected":[{"type":"plugin","slug":"elfsight-pricing-table","name":"Pricing Table","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T20:06:55Z","updated":"2024-07-09T08:33:10Z"},{"id":"wordfence:aa7aad43-54b4-4b9f-9584-292e40be71bc","source":"wordfence","cve":"CVE-2023-25787","title":"WP\u8d44\u6e90\u4e0b\u8f7d\u7ba1\u7406 <= 1.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7aad43-54b4-4b9f-9584-292e40be71bc?source=api-prod","affected":[{"type":"plugin","slug":"download-info-page","name":"WP\u8d44\u6e90\u4e0b\u8f7d\u7ba1\u7406","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa7b7474-c170-42a2-be88-0fe410a2e71b","source":"wordfence","cve":"","title":"WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload","severity":"medium","cvss":6.5,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7b7474-c170-42a2-be88-0fe410a2e71b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.3","to_inclusive":true,"patched_in":"6.8.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"6.8.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-10T20:38:44Z"},{"id":"wordfence:aa7be3a9-8a11-46c7-9fa0-7c5bda7a9846","source":"wordfence","cve":"CVE-2025-60110","title":"AllInOne - Banner Rotator <= 3.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7be3a9-8a11-46c7-9fa0-7c5bda7a9846?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-bannerRotator","name":"AllInOne - Banner Rotator","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:21:28Z"},{"id":"wordfence:aa7c3513-cef2-4f8d-b3e2-1bb8e52e76df","source":"wordfence","cve":"CVE-2026-22383","title":"PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7c3513-cef2-4f8d-b3e2-1bb8e52e76df?source=api-prod","affected":[{"type":"theme","slug":"pawfriends","name":"PawFriends - Pet Shop and Veterinary WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:19:28Z"},{"id":"wordfence:aa7d798e-a9f0-445a-8776-b849d2d7cc5c","source":"wordfence","cve":"CVE-2026-28091","title":"Coleo <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7d798e-a9f0-445a-8776-b849d2d7cc5c?source=api-prod","affected":[{"type":"theme","slug":"coleo","name":"Coleo","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:02:04Z"},{"id":"wordfence:aa7ec0a8-b5b2-456e-be5c-05e63502fb9a","source":"wordfence","cve":"CVE-2025-30607","title":"Quick Localization <= 0.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7ec0a8-b5b2-456e-be5c-05e63502fb9a?source=api-prod","affected":[{"type":"plugin","slug":"quick-localization","name":"Quick Localization (Quick Localisation)","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:14:14Z"},{"id":"wordfence:aa7fe608-55cf-4299-993e-cb262dd74880","source":"wordfence","cve":"CVE-2024-37491","title":"Rife Free <= 2.4.18 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa7fe608-55cf-4299-993e-cb262dd74880?source=api-prod","affected":[{"type":"theme","slug":"rife-free","name":"Rife Free","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:11:55Z"},{"id":"wordfence:aa830c67-2860-489f-aa67-c7cc74437709","source":"wordfence","cve":"CVE-2025-58597","title":"wpForo Forum <= 2.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa830c67-2860-489f-aa67-c7cc74437709?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:06:46Z"},{"id":"wordfence:aa857dd6-be6b-45d6-a7f2-ffc2012332e7","source":"wordfence","cve":"CVE-2026-85574","title":"Unbounce Landing Pages <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa857dd6-be6b-45d6-a7f2-ffc2012332e7?source=api-prod","affected":[{"type":"plugin","slug":"unbounce","name":"Unbounce Landing Pages","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:26:56Z"},{"id":"wordfence:aa85abba-e13f-42cd-8f13-432ed375fb37","source":"wordfence","cve":"CVE-2023-40669","title":"Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa85abba-e13f-42cd-8f13-432ed375fb37?source=api-prod","affected":[{"type":"plugin","slug":"jquery-collapse-o-matic","name":"Collapse-O-Matic","from":"*","from_inclusive":true,"to":"1.8.5.5","to_inclusive":true,"patched_in":""}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa85e614-b0e0-4d54-a9f0-27c99e898b7d","source":"wordfence","cve":"CVE-2026-73379","title":"Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa85e614-b0e0-4d54-a9f0-27c99e898b7d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":false,"patched_in":"1.10.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:57:17Z"},{"id":"wordfence:aa8673fc-6fb3-4c1b-ae7c-3551ad63720a","source":"wordfence","cve":"CVE-2026-97076","title":"WP Rocket < 3.23.5 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8673fc-6fb3-4c1b-ae7c-3551ad63720a?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"*","from_inclusive":true,"to":"3.23.5","to_inclusive":false,"patched_in":"3.23.5"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:39:23Z"},{"id":"wordfence:aa8a095b-abda-4a12-a4b9-246cda41fb4e","source":"wordfence","cve":"CVE-2017-17093","title":"WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8a095b-abda-4a12-a4b9-246cda41fb4e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.21","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2017-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa8bd71f-3aae-4734-ab6e-921b112b452b","source":"wordfence","cve":"CVE-2024-53735","title":"iPhone Webclip Manager <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8bd71f-3aae-4734-ab6e-921b112b452b?source=api-prod","affected":[{"type":"plugin","slug":"iphone-webclip-manager","name":"iPhone Webclip Manager","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:27:53Z"},{"id":"wordfence:aa8c5c44-235a-4839-9dc4-064ef25abfac","source":"wordfence","cve":"CVE-2024-47300","title":"CubeWP Forms \u2013 All-in-One Form Builder <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8c5c44-235a-4839-9dc4-064ef25abfac?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-forms","name":"CubeWP Forms","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:46:37Z"},{"id":"wordfence:aa8d5feb-2ae9-44b8-90b5-9fc67226855a","source":"wordfence","cve":"CVE-2025-13382","title":"Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d5feb-2ae9-44b8-90b5-9fc67226855a?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.4","to_inclusive":true,"patched_in":"23.5"}],"published":"2025-11-24T19:15:11Z","updated":"2025-12-19T14:32:08Z"},{"id":"wordfence:aa8d746f-82e2-4615-92bb-35d20124dc56","source":"wordfence","cve":"CVE-2025-11692","title":"Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8d746f-82e2-4615-92bb-35d20124dc56?source=api-prod","affected":[{"type":"plugin","slug":"zip-attachments","name":"Zip Attachments","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:35:25Z","updated":"2025-10-15T08:25:59Z"},{"id":"wordfence:aa8daa65-dc64-4cbf-9b49-2db08b64b02e","source":"wordfence","cve":"CVE-2026-32367","title":"Modal Dialog <= 3.5.16 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8daa65-dc64-4cbf-9b49-2db08b64b02e?source=api-prod","affected":[{"type":"plugin","slug":"modal-dialog","name":"Modal Dialog","from":"*","from_inclusive":true,"to":"3.5.16","to_inclusive":true,"patched_in":"3.5.17"}],"published":"2026-02-16T00:00:00Z","updated":"2026-05-05T14:24:11Z"},{"id":"wordfence:aa8df7ee-5308-4993-ac49-e2e58f3eaf60","source":"wordfence","cve":"CVE-2018-7747","title":"Caldera Forms <= 1.5.9.1 - Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8df7ee-5308-4993-ac49-e2e58f3eaf60?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.5.9.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2018-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa8f75dc-7ecd-498d-b41a-e788b4d4bcdd","source":"wordfence","cve":"CVE-2016-0769","title":"eShop <= 6.3.14 - Multiple SQL Injections","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa8f75dc-7ecd-498d-b41a-e788b4d4bcdd?source=api-prod","affected":[{"type":"plugin","slug":"eshop","name":"eShop","from":"*","from_inclusive":true,"to":"6.3.14","to_inclusive":true,"patched_in":""}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa916029-b526-4ff3-ba70-2875b62d33a6","source":"wordfence","cve":"CVE-2022-1792","title":"Quick Subscribe <= 1.7.1 - Cross-Site Request Forgery to Arbitrary Settings Update and Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa916029-b526-4ff3-ba70-2875b62d33a6?source=api-prod","affected":[{"type":"plugin","slug":"quick-subscribe","name":"Quick Subscribe","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa93a0a1-8f49-42e0-b074-c7afa2494042","source":"wordfence","cve":"CVE-2026-118801","title":"aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa93a0a1-8f49-42e0-b074-c7afa2494042?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.20.0"}],"published":"2026-11-06T18:12:29Z","updated":"2026-11-07T06:39:41Z"},{"id":"wordfence:aa93cf13-0578-447e-8b03-24f5f48fc782","source":"wordfence","cve":"CVE-2026-24987","title":"Activity Log for WordPress <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa93cf13-0578-447e-8b03-24f5f48fc782?source=api-prod","affected":[{"type":"plugin","slug":"winterlock","name":"Activity Log for WordPress","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:25:37Z"},{"id":"wordfence:aa94e231-456f-4ccb-9eeb-aec9ba29694c","source":"wordfence","cve":"CVE-2025-69074","title":"Pearson Specter <= 1.11.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa94e231-456f-4ccb-9eeb-aec9ba29694c?source=api-prod","affected":[{"type":"theme","slug":"pearsonspecter","name":"Pearson Specter | Counsellor, Advocate Law WordPress Theme","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:44:04Z"},{"id":"wordfence:aa972bbc-2123-45d4-b313-1e53397a5dc1","source":"wordfence","cve":"CVE-2025-64374","title":"Motors <= 5.6.82 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa972bbc-2123-45d4-b313-1e53397a5dc1?source=api-prod","affected":[{"type":"theme","slug":"motors","name":"Motors - Car Dealer, Rental & Listing WordPress theme","from":"*","from_inclusive":true,"to":"5.6.82","to_inclusive":true,"patched_in":"5.6.83"}],"published":"2025-10-21T00:00:00Z","updated":"2025-12-05T20:21:35Z"},{"id":"wordfence:aa98b83d-5c1f-4fce-b1b8-3d1796fdaef7","source":"wordfence","cve":"CVE-2025-23798","title":"Mass Messaging in BuddyPress <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa98b83d-5c1f-4fce-b1b8-3d1796fdaef7?source=api-prod","affected":[{"type":"plugin","slug":"mass-messaging-in-buddypress","name":"Mass Messaging in BuddyPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:00:04Z"},{"id":"wordfence:aa9ba135-3b08-4ee9-9a06-3c9880bfdd18","source":"wordfence","cve":"CVE-2025-31634","title":"Insurance <= 3.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9ba135-3b08-4ee9-9a06-3c9880bfdd18?source=api-prod","affected":[{"type":"theme","slug":"insurance","name":"Insurance WordPress Theme","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T16:45:51Z"},{"id":"wordfence:aa9c2a67-e254-4dde-9f58-81281e98cdb2","source":"wordfence","cve":"CVE-2022-2383","title":"Feed Them Social \u2013 for Twitter feed, Youtube and more <= 2.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9c2a67-e254-4dde-9f58-81281e98cdb2?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aa9d2f76-8bd4-4ad0-9291-b63aac53b0cf","source":"wordfence","cve":"CVE-2026-121866","title":"Exsile SMS Gateway <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9d2f76-8bd4-4ad0-9291-b63aac53b0cf?source=api-prod","affected":[{"type":"plugin","slug":"exsile-sms-gateway","name":"iLeads SMS Gateway by Exsile","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:50:59Z"},{"id":"wordfence:aa9e0489-effd-4235-a6a9-2bece0fe2abf","source":"wordfence","cve":"CVE-2026-84279","title":"Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9e0489-effd-4235-a6a9-2bece0fe2abf?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-25T06:39:54Z"},{"id":"wordfence:aa9edf84-7ba0-488c-93ca-ed0b2ee435d5","source":"wordfence","cve":"CVE-2024-12411","title":"WP Ad Guru \u2013 Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9edf84-7ba0-488c-93ca-ed0b2ee435d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-ad-guru","name":"WP Ad Guru \u2013 Banner ad, Responsive popup, Popup maker, Ad rotator & More","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T04:23:44Z"},{"id":"wordfence:aa9efe66-43e3-4711-bbe6-2a7bb383983e","source":"wordfence","cve":"CVE-2025-64263","title":"Content Pilot <= 2.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9efe66-43e3-4711-bbe6-2a7bb383983e?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-pilot","name":"Content Pilot \u2013 Autoblogging & Affiliate Marketing Suite","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2025-11-08T00:00:00Z","updated":"2025-11-17T19:03:42Z"},{"id":"wordfence:aaa041a3-d8e5-4637-b8da-5f07c498685a","source":"wordfence","cve":"CVE-2023-50373","title":"Alt Manager <= 1.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa041a3-d8e5-4637-b8da-5f07c498685a?source=api-prod","affected":[{"type":"plugin","slug":"alt-manager","name":"Image Alt Text Manager \u2013 Bulk & Dynamic Alt Tags For image SEO Optimization + AI","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2023-12-07T00:00:00Z","updated":"2024-03-25T17:56:34Z"},{"id":"wordfence:aaa08907-55a1-4702-93d3-4360ccd40312","source":"wordfence","cve":"CVE-2026-123470","title":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin <= 1.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa08907-55a1-4702-93d3-4360ccd40312?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-11-07T10:41:00Z","updated":"2026-11-10T20:00:42Z"},{"id":"wordfence:aaa2f738-4764-467c-9544-889ca8ba73d1","source":"wordfence","cve":"CVE-2019-25146","title":"DELUCKS SEO < 2.1.8 -  Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa2f738-4764-467c-9544-889ca8ba73d1?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2019-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aaa8c1df-d908-4ab5-8194-d9451d8efe31","source":"wordfence","cve":"CVE-2025-22679","title":"Job Board Manager <= 2.1.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa8c1df-d908-4ab5-8194-d9451d8efe31?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:21:37Z"},{"id":"wordfence:aaa938a6-812b-4693-8f59-0f54b35023a3","source":"wordfence","cve":"CVE-2025-31778","title":"Donate Me <= 1.2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa938a6-812b-4693-8f59-0f54b35023a3?source=api-prod","affected":[{"type":"plugin","slug":"donate-me","name":"Donate Me","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-05-11T19:38:46Z"},{"id":"wordfence:aaab0d67-1cb4-426b-b6d9-c1b54fc1779f","source":"wordfence","cve":"CVE-2026-39552","title":"Blueprint < 1.1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaab0d67-1cb4-426b-b6d9-c1b54fc1779f?source=api-prod","affected":[{"type":"theme","slug":"blueprint","name":"blueprint","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-13T20:54:40Z"},{"id":"wordfence:aaacd8be-448f-4020-943c-9ba442ba9730","source":"wordfence","cve":"CVE-2024-52375","title":"Datasets Manager by Arttia Creative <= 1.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaacd8be-448f-4020-943c-9ba442ba9730?source=api-prod","affected":[{"type":"plugin","slug":"datasets-manager-by-arttia-creative","name":"Datasets Manager by Arttia Creative","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:39:38Z"},{"id":"wordfence:aaad8b81-d08b-4346-9167-defb6bc01ead","source":"wordfence","cve":"CVE-2025-53259","title":"Hotel Booking <= 3.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaad8b81-d08b-4346-9167-defb6bc01ead?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:44:45Z"},{"id":"wordfence:aab0bb92-5474-429d-b6ff-2a7662183a27","source":"wordfence","cve":"CVE-2024-34551","title":"Stockholm <= 9.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab0bb92-5474-429d-b6ff-2a7662183a27?source=api-prod","affected":[{"type":"theme","slug":"stockholm","name":"Stockholm","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":true,"patched_in":"9.7"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T21:15:14Z"},{"id":"wordfence:aab16b6f-4daf-4eb1-9526-dd05b2b41dee","source":"wordfence","cve":"CVE-2023-26015","title":"MapPress Maps for WordPress <= 2.85.4 - Authenticated (Contributor+) SQL Injection via get_maps","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab16b6f-4daf-4eb1-9526-dd05b2b41dee?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.85.4","to_inclusive":true,"patched_in":"2.85.5"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aab18839-6edc-4f8f-8e1f-ae305a4ed6b3","source":"wordfence","cve":"CVE-2025-31823","title":"WPoperation Elementor Addons <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab18839-6edc-4f8f-8e1f-ae305a4ed6b3?source=api-prod","affected":[{"type":"plugin","slug":"wpop-elementor-addons","name":"WPoperation Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:55:02Z"},{"id":"wordfence:aab3016d-5834-4b4a-a206-0b626884b335","source":"wordfence","cve":"CVE-2023-4703","title":"All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab3016d-5834-4b4a-a206-0b626884b335?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-b2b-for-woocommerce","name":"All in One B2B for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aab33299-f02d-44a1-9522-5309eed6fd38","source":"wordfence","cve":"CVE-2024-11895","title":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab33299-f02d-44a1-9522-5309eed6fd38?source=api-prod","affected":[{"type":"plugin","slug":"paypal-payment-button-by-vcita","name":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe","from":"*","from_inclusive":true,"to":"3.20.0","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:13Z"},{"id":"wordfence:aab42989-b928-492f-a610-d2a5546751e0","source":"wordfence","cve":"","title":"Persuasion <= 2.4 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab42989-b928-492f-a610-d2a5546751e0?source=api-prod","affected":[{"type":"theme","slug":"persuasion","name":"Persuasion","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aab54795-31e7-4ef4-8a80-7443abaa3f21","source":"wordfence","cve":"CVE-2024-29143","title":"Passwordless Login <= 1.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab54795-31e7-4ef4-8a80-7443abaa3f21?source=api-prod","affected":[{"type":"plugin","slug":"passwordless-login","name":"Passwordless Login","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:55:42Z"},{"id":"wordfence:aab5879b-82e7-45c3-8b0e-25bf699f7276","source":"wordfence","cve":"CVE-2024-51718","title":"Simple Modal <= 0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab5879b-82e7-45c3-8b0e-25bf699f7276?source=api-prod","affected":[{"type":"plugin","slug":"simplemodal","name":"Simple Modal","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:52:46Z"},{"id":"wordfence:aab8f2ae-993b-4893-81cc-1b8a1a4ef84b","source":"wordfence","cve":"CVE-2026-89294","title":"Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aab8f2ae-993b-4893-81cc-1b8a1a4ef84b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.27","to_inclusive":true,"patched_in":"1.6.12.33"}],"published":"2026-09-29T18:05:39Z","updated":"2026-09-30T06:40:23Z"},{"id":"wordfence:aabf1911-5c6f-4486-a750-d5c95f5815ba","source":"wordfence","cve":"CVE-2025-10140","title":"Quick Social Login <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aabf1911-5c6f-4486-a750-d5c95f5815ba?source=api-prod","affected":[{"type":"plugin","slug":"quick-login","name":"Quick Social Login","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:35:02Z","updated":"2025-10-15T08:26:00Z"},{"id":"wordfence:aabf80d4-e7fe-413d-bb7d-9064c0a0a16d","source":"wordfence","cve":"CVE-2026-66463","title":"iCARRY <= 2.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aabf80d4-e7fe-413d-bb7d-9064c0a0a16d?source=api-prod","affected":[{"type":"plugin","slug":"icarry","name":"iCARRY","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:52:50Z"},{"id":"wordfence:aac15273-0a5d-4107-8249-7fff7f503005","source":"wordfence","cve":"CVE-2026-9756","title":"GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac15273-0a5d-4107-8249-7fff7f503005?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-03T07:53:09Z"},{"id":"wordfence:aac2b2a3-5d4f-449f-876c-d1bec295e088","source":"wordfence","cve":"CVE-2026-1908","title":"Integration with Hubspot Forms <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac2b2a3-5d4f-449f-876c-d1bec295e088?source=api-prod","affected":[{"type":"plugin","slug":"integration-with-hubspot-forms","name":"Integration with Hubspot Forms","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:04Z","updated":"2026-03-21T03:26:59Z"},{"id":"wordfence:aac33311-86bb-4e1b-a75a-aaf26aaedfec","source":"wordfence","cve":"CVE-2025-31404","title":"AF Tell a Friend <= 1.4 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac33311-86bb-4e1b-a75a-aaf26aaedfec?source=api-prod","affected":[{"type":"plugin","slug":"af-tell-a-friend","name":"AF Tell a Friend","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:16:34Z"},{"id":"wordfence:aac382a7-0548-4c5a-b82b-f173ff449d23","source":"wordfence","cve":"","title":"JS Multi Hotel <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac382a7-0548-4c5a-b82b-f173ff449d23?source=api-prod","affected":[{"type":"plugin","slug":"js-multihotel","name":"JS Multi Hotel","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2014-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aac3ef07-f9b1-4f92-8d0a-8597c4eb8d94","source":"wordfence","cve":"CVE-2025-39568","title":"StoreContrl Woocommerce <= 4.1.3 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac3ef07-f9b1-4f92-8d0a-8597c4eb8d94?source=api-prod","affected":[{"type":"plugin","slug":"storecontrl-wp-connection","name":"StoreContrl Woocommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:34:55Z"},{"id":"wordfence:aac3fb8e-9b92-4ed1-ac9f-50870d4c5c9f","source":"wordfence","cve":"CVE-2024-8719","title":"Flexmls\u00ae IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac3fb8e-9b92-4ed1-ac9f-50870d4c5c9f?source=api-prod","affected":[{"type":"plugin","slug":"flexmls-idx","name":"Flexmls\u00ae IDX Plugin","from":"*","from_inclusive":true,"to":"3.14.22","to_inclusive":true,"patched_in":"3.14.23"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T03:32:50Z"},{"id":"wordfence:aac6fcee-cb8b-4862-a1f1-9af692ae741f","source":"wordfence","cve":"","title":"Bulk change of posts terms and post types <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac6fcee-cb8b-4862-a1f1-9af692ae741f?source=api-prod","affected":[{"type":"plugin","slug":"bulk-change","name":"Bulk change of posts terms and post types","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aac9569e-d33d-45b3-bd03-2e7f48536ae5","source":"wordfence","cve":"CVE-2024-5173","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9569e-d33d-45b3-bd03-2e7f48536ae5?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2024-06-25T13:45:59Z","updated":"2024-06-26T02:08:04Z"},{"id":"wordfence:aac9be6c-7498-482e-8c38-da17a2c7f00a","source":"wordfence","cve":"CVE-2023-7170","title":"RSVP Events <= 2.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9be6c-7498-482e-8c38-da17a2c7f00a?source=api-prod","affected":[{"type":"plugin","slug":"eventon-rsvp","name":"RSVP Events","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aac9db5d-24fe-4136-b73d-8098c3dd4965","source":"wordfence","cve":"CVE-2025-60094","title":"Stackable <= 3.18.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9db5d-24fe-4136-b73d-8098c3dd4965?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.18.1","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-02T22:20:00Z"},{"id":"wordfence:aac9e0cb-cc1e-4041-bb92-21f94c8d35fd","source":"wordfence","cve":"CVE-2021-24558","title":"Project Status <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9e0cb-cc1e-4041-bb92-21f94c8d35fd?source=api-prod","affected":[{"type":"plugin","slug":"project-status","name":"Project Status","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aacd4a33-499d-4630-a0fb-8a1acfcfb7dd","source":"wordfence","cve":"","title":"WP Code Highlight.js <= 0.6.3 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aacd4a33-499d-4630-a0fb-8a1acfcfb7dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-code-highlightjs","name":"WP Code Highlight.js","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":""}],"published":"2019-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aace327b-7091-48e2-9e02-ec48a08b129b","source":"wordfence","cve":"CVE-2025-11270","title":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aace327b-7091-48e2-9e02-ec48a08b129b?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2025-10-17T00:00:00Z","updated":"2025-10-18T06:42:48Z"},{"id":"wordfence:aacfbc61-83a0-4876-80da-3b78e0ac6f31","source":"wordfence","cve":"CVE-2024-37555","title":"Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aacfbc61-83a0-4876-80da-3b78e0ac6f31?source=api-prod","affected":[{"type":"plugin","slug":"generate-pdf-using-contact-form-7","name":"Generate PDF using Contact Form 7","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-07-09T00:00:00Z","updated":"2026-04-15T20:35:48Z"},{"id":"wordfence:aad053ac-d01f-4f89-abca-28b9fce4f249","source":"wordfence","cve":"CVE-2026-84222","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad053ac-d01f-4f89-abca-28b9fce4f249?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.2.1","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:37:50Z"},{"id":"wordfence:aad4b58f-71ed-4192-a936-0fe3bd721b45","source":"wordfence","cve":"CVE-2025-30809","title":"Live Forms <= 4.8.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad4b58f-71ed-4192-a936-0fe3bd721b45?source=api-prod","affected":[{"type":"plugin","slug":"liveforms","name":"Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:30:39Z"},{"id":"wordfence:aad57a68-c385-491f-a5a2-32906df4b52b","source":"wordfence","cve":"CVE-2025-14081","title":"Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad57a68-c385-491f-a5a2-32906df4b52b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2025-12-16T00:00:00Z","updated":"2025-12-17T18:21:35Z"},{"id":"wordfence:aad58ed3-9efc-450a-8f19-07ae4b0d7ca7","source":"wordfence","cve":"CVE-2025-48327","title":"WP Mailgun SMTP <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad58ed3-9efc-450a-8f19-07ae4b0d7ca7?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailgun-smtp","name":"WP Mailgun SMTP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T13:41:33Z"},{"id":"wordfence:aad59fea-03fe-426a-ba50-b9b2ffefdd9b","source":"wordfence","cve":"CVE-2026-105990","title":"Accept PayPal Payments Using Contact Form 7 <= 4.0.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad59fea-03fe-426a-ba50-b9b2ffefdd9b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-extension","name":"Accept PayPal Payments using Contact Form 7","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T13:41:01Z"},{"id":"wordfence:aad6151a-6897-4d0c-9dfb-0f424c683111","source":"wordfence","cve":"CVE-2025-8720","title":"Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad6151a-6897-4d0c-9dfb-0f424c683111?source=api-prod","affected":[{"type":"plugin","slug":"wp-readme-parser","name":"Plugin README Parser","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:11:54Z","updated":"2025-08-15T08:25:40Z"},{"id":"wordfence:aad65aa5-b928-463b-a287-ea0dc8da7c80","source":"wordfence","cve":"CVE-2026-49067","title":"Advanced 301 and 302 Redirect <= 1.6.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad65aa5-b928-463b-a287-ea0dc8da7c80?source=api-prod","affected":[{"type":"plugin","slug":"advanced-301-and-302-redirect","name":"Advanced 301 and 302 Redirect","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:38:03Z"},{"id":"wordfence:aad697c4-7bdf-4343-9200-147d47b7a553","source":"wordfence","cve":"CVE-2026-22443","title":"Alliance <= 3.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad697c4-7bdf-4343-9200-147d47b7a553?source=api-prod","affected":[{"type":"theme","slug":"alliance","name":"Alliance | Intranet & Extranet BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T17:24:16Z"},{"id":"wordfence:aad6afb6-0098-4bdd-b002-9798547d27e4","source":"wordfence","cve":"CVE-2025-68077","title":"Stockholm <= 9.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad6afb6-0098-4bdd-b002-9798547d27e4?source=api-prod","affected":[{"type":"theme","slug":"stockholm","name":"Stockholm","from":"*","from_inclusive":true,"to":"9.14.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-18T00:00:00Z","updated":"2025-12-19T17:06:32Z"},{"id":"wordfence:aad7ddac-ed12-4263-8e68-64b1fca8dfad","source":"wordfence","cve":"CVE-2026-104759","title":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad7ddac-ed12-4263-8e68-64b1fca8dfad?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"44.1","to_inclusive":true,"patched_in":"45.0"}],"published":"2026-10-09T19:11:01Z","updated":"2026-10-10T07:41:47Z"},{"id":"wordfence:aade0d5c-0fca-4477-8dae-6a43cd3c2edc","source":"wordfence","cve":"CVE-2025-23598","title":"Recip.ly Plugin <= 1.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aade0d5c-0fca-4477-8dae-6a43cd3c2edc?source=api-prod","affected":[{"type":"plugin","slug":"reciply","name":"Recip.ly Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:39:06Z"},{"id":"wordfence:aade1230-bc25-4391-a85b-7bcf661f8213","source":"wordfence","cve":"CVE-2017-6097","title":"Mail Masta <= 1.0 - SQL Injection via camp_id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aade1230-bc25-4391-a85b-7bcf661f8213?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aade146b-029e-40c8-852f-879b6b57ee90","source":"wordfence","cve":"CVE-2024-56242","title":"Arconix Shortcodes <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aade146b-029e-40c8-852f-879b6b57ee90?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T19:57:08Z"},{"id":"wordfence:aadf1d59-60ba-4da2-adbb-4e84d587a34d","source":"wordfence","cve":"CVE-2024-8195","title":"Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aadf1d59-60ba-4da2-adbb-4e84d587a34d?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.4.1"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T13:54:28Z"},{"id":"wordfence:aadf1f4c-c852-4167-9b09-7e679a953725","source":"wordfence","cve":"CVE-2026-3464","title":"WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aadf1f4c-c852-4167-9b09-7e679a953725?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2026-04-17T04:24:04Z","updated":"2026-04-17T16:26:50Z"},{"id":"wordfence:aae57fed-1003-4b3a-8489-cfc85c250a04","source":"wordfence","cve":"","title":"Videos on Admin Dashboard < 1.1.4 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aae57fed-1003-4b3a-8489-cfc85c250a04?source=api-prod","affected":[{"type":"plugin","slug":"videos-on-admin-dashboard","name":"Videos on Admin Dashboard","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2020-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aae6058c-1a0c-48dd-9aca-9a44f06d27e5","source":"wordfence","cve":"CVE-2024-47394","title":"JobSearch <= 2.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aae6058c-1a0c-48dd-9aca-9a44f06d27e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:10:45Z"},{"id":"wordfence:aae70da2-fcd8-4e33-8f38-5e19e0c14733","source":"wordfence","cve":"CVE-2022-46797","title":"All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 5.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aae70da2-fcd8-4e33-8f38-5e19e0c14733?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aae9018c-eef9-4d1b-b510-446db1644e78","source":"wordfence","cve":"CVE-2024-54340","title":"Simple Presenter <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aae9018c-eef9-4d1b-b510-446db1644e78?source=api-prod","affected":[{"type":"plugin","slug":"simple-presenter","name":"Simple Presenter","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:09:32Z"},{"id":"wordfence:aae94aa1-a7a9-43df-b958-4fcf0392335b","source":"wordfence","cve":"CVE-2024-54206","title":"Z-Downloads <= 1.11.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aae94aa1-a7a9-43df-b958-4fcf0392335b?source=api-prod","affected":[{"type":"plugin","slug":"z-downloads","name":"Z-Downloads","from":"*","from_inclusive":true,"to":"1.11.7","to_inclusive":true,"patched_in":"1.11.8"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:09:09Z"},{"id":"wordfence:aaece360-25b0-4a35-bd23-57c6591623eb","source":"wordfence","cve":"CVE-2025-23499","title":"Board Election <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaece360-25b0-4a35-bd23-57c6591623eb?source=api-prod","affected":[{"type":"plugin","slug":"board-election","name":"Board Election","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:42:32Z"},{"id":"wordfence:aaef655c-cd6d-446b-a1f5-7ec48108faf0","source":"wordfence","cve":"CVE-2026-88799","title":"MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaef655c-cd6d-446b-a1f5-7ec48108faf0?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:32:15Z"},{"id":"wordfence:aaef8d31-52e5-4bda-b2d6-e8df31c2c16a","source":"wordfence","cve":"CVE-2024-54241","title":"Elite Notification \u2013 Sales Popup, Social Proof, FOMO & WooCommerce <= 1.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaef8d31-52e5-4bda-b2d6-e8df31c2c16a?source=api-prod","affected":[{"type":"plugin","slug":"elite-notification","name":"Elite Notification \u2013 Sales Popup, Social Proof, FOMO Notification for WooCommerce","from":"1.5","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-12-05T00:00:00Z","updated":"2025-04-10T15:10:42Z"},{"id":"wordfence:aaf0e58c-0430-44fe-980f-8ea469802c86","source":"wordfence","cve":"CVE-2023-27616","title":"RSVPMaker  <= 10.6.5 - Unauthenticated Stored Cross-Site Scripting via 'email'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf0e58c-0430-44fe-980f-8ea469802c86?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aaf38354-f95a-4bc5-a63e-3774eadf4fcb","source":"wordfence","cve":"CVE-2015-9483","title":"Invento | Architecture Building Agency Template <= 2015-05-15 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf38354-f95a-4bc5-a63e-3774eadf4fcb?source=api-prod","affected":[{"type":"theme","slug":"invento","name":"Invento | Architecture Building Agency Template","from":"*","from_inclusive":true,"to":"2015-05-15","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aaf62045-b9ce-40d7-92b3-7ab683e5a08c","source":"wordfence","cve":"CVE-2024-1214","title":"Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf62045-b9ce-40d7-92b3-7ab683e5a08c?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T23:33:53Z"},{"id":"wordfence:aaf7107c-1e9f-4020-aed3-a6a687a0cf6c","source":"wordfence","cve":"CVE-2023-37894","title":"Variation Images Gallery for WooCommerce <= 2.3.3 - Reflected Cross-Site Scripting via style","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf7107c-1e9f-4020-aed3-a6a687a0cf6c?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-variation-gallery","name":"Variation Images Gallery for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aaf71daa-2130-47ce-a8b1-85321df954b2","source":"wordfence","cve":"CVE-2025-31870","title":"WP AutoKeyword <= 1.0 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf71daa-2130-47ce-a8b1-85321df954b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-autokeyword","name":"WP AutoKeyword","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:33:44Z"},{"id":"wordfence:aaf9eb5b-4847-4cfc-9c5f-ec6c75271b68","source":"wordfence","cve":"CVE-2026-16542","title":"Import and export users and customers <= 2.4.4 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aaf9eb5b-4847-4cfc-9c5f-ec6c75271b68?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:43:53Z"},{"id":"wordfence:aafa8eb8-73e6-48b5-a94e-85730d6250f3","source":"wordfence","cve":"CVE-2022-0864","title":"UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aafa8eb8-73e6-48b5-a94e-85730d6250f3?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.22.9","to_inclusive":false,"patched_in":"1.22.9"}],"published":"2022-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aafb5402-3553-4c89-86e0-4dd556d86074","source":"wordfence","cve":"CVE-2023-6808","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aafb5402-3553-4c89-86e0-4dd556d86074?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.93","to_inclusive":true,"patched_in":"1.0.94"}],"published":"2024-01-18T00:00:00Z","updated":"2024-07-29T21:37:06Z"},{"id":"wordfence:aafbdd50-c78b-4aad-a3e2-f1339d698e77","source":"wordfence","cve":"CVE-2023-40552","title":"Fitness calculators plugin <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aafbdd50-c78b-4aad-a3e2-f1339d698e77?source=api-prod","affected":[{"type":"plugin","slug":"fitness-calculators","name":"fitness calculators","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-08-16T00:00:00Z","updated":"2024-03-25T16:38:31Z"},{"id":"wordfence:aafe218d-a0c4-4346-b2cd-4beb0d1fc010","source":"wordfence","cve":"CVE-2025-23500","title":"Simple Custom post type custom field <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aafe218d-a0c4-4346-b2cd-4beb0d1fc010?source=api-prod","affected":[{"type":"plugin","slug":"simple-content-construction-kit","name":"Simple Custom post type custom field","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:31:22Z"},{"id":"wordfence:ab004836-8362-46d6-acfc-80f582605b43","source":"wordfence","cve":"CVE-2026-11356","title":"Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab004836-8362-46d6-acfc-80f582605b43?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.15","to_inclusive":true,"patched_in":"5.5.16"}],"published":"2026-06-26T12:57:58Z","updated":"2026-06-27T01:27:22Z"},{"id":"wordfence:ab015cb4-0b1e-40ff-ab9b-6c03eed3142f","source":"wordfence","cve":"CVE-2023-38398","title":"Taboola <= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab015cb4-0b1e-40ff-ab9b-6c03eed3142f?source=api-prod","affected":[{"type":"plugin","slug":"taboola","name":"Taboola","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"20.2"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab01f5a9-7732-4cf4-8c2a-16013b78f0f8","source":"wordfence","cve":"CVE-2026-115613","title":"Image Gallery Block \u2013 Showcase Photos in Stunning Responsive Grids <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab01f5a9-7732-4cf4-8c2a-16013b78f0f8?source=api-prod","affected":[{"type":"plugin","slug":"3d-image-gallery","name":"Image Gallery Block \u2013 Showcase Photos in Stunning Responsive Grids","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-10-26T09:54:00Z","updated":"2026-10-28T01:23:52Z"},{"id":"wordfence:ab051f4a-030a-44aa-8cbf-665c6c6d31a7","source":"wordfence","cve":"CVE-2026-1920","title":"Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab051f4a-030a-44aa-8cbf-665c6c6d31a7?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-03-09T13:22:01Z","updated":"2026-03-10T02:21:49Z"},{"id":"wordfence:ab059000-56ab-4f73-8daa-b3d54e457742","source":"wordfence","cve":"CVE-2025-67992","title":"PatioTime < 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab059000-56ab-4f73-8daa-b3d54e457742?source=api-prod","affected":[{"type":"theme","slug":"patiotime","name":"PatioTime - Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:09:42Z"},{"id":"wordfence:ab07e612-b561-41fc-8195-22d22fe06acd","source":"wordfence","cve":"CVE-2025-23958","title":"Editor Wysiwyg Background Color <= 1.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab07e612-b561-41fc-8195-22d22fe06acd?source=api-prod","affected":[{"type":"plugin","slug":"editor-wysiwyg-background-color","name":"Editor Wysiwyg Background Color","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T21:30:28Z"},{"id":"wordfence:ab0a61e7-6814-4773-af44-e42cffb1f480","source":"wordfence","cve":"CVE-2024-38751","title":"Google Adsense & Banner Ads by AdsforWP <= 1.9.28 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab0a61e7-6814-4773-af44-e42cffb1f480?source=api-prod","affected":[{"type":"plugin","slug":"ads-for-wp","name":"Easy Google Adsense and Banner Ads Manager \u2013 AdsforWP","from":"*","from_inclusive":true,"to":"1.9.28","to_inclusive":true,"patched_in":"1.9.29"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-30T20:11:52Z"},{"id":"wordfence:ab0cc008-be18-4703-8156-acb00c1ac9a7","source":"wordfence","cve":"CVE-2008-0508","title":"Dean's Permalinks Migration <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab0cc008-be18-4703-8156-acb00c1ac9a7?source=api-prod","affected":[{"type":"plugin","slug":"permalinks-migration-plugin-for-wordpress","name":"Dean's Permalinks Migration","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2008-01-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab1053e4-5135-49cc-a81b-9cf66e93bfef","source":"wordfence","cve":"CVE-2026-1394","title":"WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1053e4-5135-49cc-a81b-9cf66e93bfef?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-contact-us","name":"WP Quick Contact Us","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:28:31Z","updated":"2026-02-14T06:42:31Z"},{"id":"wordfence:ab15e532-406d-4e6f-ab5e-ae3631acc073","source":"wordfence","cve":"CVE-2025-23510","title":"WordPress Logging Service <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab15e532-406d-4e6f-ab5e-ae3631acc073?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-logging-service","name":"WordPress Logging Service","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:54:38Z"},{"id":"wordfence:ab15fa8b-4072-435a-8a1c-ca6fd964a260","source":"wordfence","cve":"CVE-2025-14726","title":"Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab15fa8b-4072-435a-8a1c-ca6fd964a260?source=api-prod","affected":[{"type":"plugin","slug":"social-photo-feed-widget","name":"Widgets for Social Photo Feed","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-05-01T15:55:19Z","updated":"2026-05-02T04:27:46Z"},{"id":"wordfence:ab15fe2b-974c-41b0-ab6b-68322d2d3396","source":"wordfence","cve":"CVE-2024-3199","title":"The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab15fe2b-974c-41b0-ab6b-68322d2d3396?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:52:30Z"},{"id":"wordfence:ab19f79b-0cf6-4a5d-9e7e-a248728b4566","source":"wordfence","cve":"CVE-2024-37089","title":"Consulting Elementor Widgets <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab19f79b-0cf6-4a5d-9e7e-a248728b4566?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T20:38:19Z"},{"id":"wordfence:ab19f7b1-2b1e-43bc-9843-ddee0fc74f50","source":"wordfence","cve":"CVE-2024-5485","title":"SureTriggers \u2013 Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab19f7b1-2b1e-43bc-9843-ddee0fc74f50?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.0.47","to_inclusive":true,"patched_in":"1.0.48"}],"published":"2024-06-03T18:02:24Z","updated":"2024-06-04T06:41:47Z"},{"id":"wordfence:ab1bd64b-8575-4ab4-bca5-8d5ce6f476d1","source":"wordfence","cve":"CVE-2023-41132","title":"Category Slider for WooCommerce <= 1.4.15 - Missing Authorization via notice dismissal functionality","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1bd64b-8575-4ab4-bca5-8d5ce6f476d1?source=api-prod","affected":[{"type":"plugin","slug":"woo-category-slider-grid","name":"Product Category Slider & Grid for WooCommerce \u2013 Reno Product Category","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":true,"patched_in":"1.4.16"}],"published":"2023-08-24T00:00:00Z","updated":"2024-04-17T13:01:22Z"},{"id":"wordfence:ab1c21dd-793c-4530-8c09-e1e8fed4a014","source":"wordfence","cve":"CVE-2025-69083","title":"Frapp\u00e9 <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1c21dd-793c-4530-8c09-e1e8fed4a014?source=api-prod","affected":[{"type":"theme","slug":"frappe","name":"Frapp\u00e9 - Smoothie, Juice Bar and Organic Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:38:10Z"},{"id":"wordfence:ab1cc1ef-d0e0-491d-91a8-eaa0605fc1da","source":"wordfence","cve":"CVE-2020-36833","title":"Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1cc1ef-d0e0-491d-91a8-eaa0605fc1da?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"7.3","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2020-02-06T00:00:00Z","updated":"2024-10-16T06:43:40Z"},{"id":"wordfence:ab1d8bcb-688a-4763-970a-c960925cf0b6","source":"wordfence","cve":"CVE-2026-109207","title":"RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1d8bcb-688a-4763-970a-c960925cf0b6?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.11","to_inclusive":true,"patched_in":"5.2.12"}],"published":"2026-10-15T15:31:40Z","updated":"2026-10-16T03:38:44Z"},{"id":"wordfence:ab233ceb-270c-4694-9cf9-2de8ddfcbbfd","source":"wordfence","cve":"CVE-2023-41798","title":"Directorist <= 7.7.1 - CSV Injection","severity":"low","cvss":3.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab233ceb-270c-4694-9cf9-2de8ddfcbbfd?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab248283-e331-4159-9fe4-249243772c9b","source":"wordfence","cve":"CVE-2021-24688","title":"Orange Form <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab248283-e331-4159-9fe4-249243772c9b?source=api-prod","affected":[{"type":"plugin","slug":"orange-form","name":"Orange Form","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab25bc80-60b9-4ca8-93ef-49c8731e8128","source":"wordfence","cve":"CVE-2025-67934","title":"Wellspring < 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab25bc80-60b9-4ca8-93ef-49c8731e8128?source=api-prod","affected":[{"type":"theme","slug":"wellspring","name":"WellSpring | Aqua Filters & Drinking Water Delivery WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":false,"patched_in":"2.8"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-13T17:34:14Z"},{"id":"wordfence:ab29af00-587b-45ab-8be2-4a03d8039427","source":"wordfence","cve":"CVE-2025-54006","title":"Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab29af00-587b-45ab-8be2-4a03d8039427?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:29:25Z"},{"id":"wordfence:ab2a011e-73c5-4fb9-a8d2-aaa2756d93f9","source":"wordfence","cve":"CVE-2025-31768","title":"Widget Manager Light <= 1.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2a011e-73c5-4fb9-a8d2-aaa2756d93f9?source=api-prod","affected":[{"type":"plugin","slug":"widget-manager-light","name":"Widget Manager Light","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T15:32:33Z"},{"id":"wordfence:ab2a4903-2c69-48da-bd4a-79b39b78806c","source":"wordfence","cve":"","title":"Custom Order Status for WooCommerce <= 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2a4903-2c69-48da-bd4a-79b39b78806c?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-statuses-woocommerce","name":"Custom Order Status for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-06T13:03:00Z"},{"id":"wordfence:ab2b2a9d-fadd-4056-bb66-f1a070eb0361","source":"wordfence","cve":"CVE-2026-57720","title":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2b2a9d-fadd-4056-bb66-f1a070eb0361?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes","name":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.3.3"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:43:41Z"},{"id":"wordfence:ab2c5cf1-f372-42d7-9a15-9148a3b4012c","source":"wordfence","cve":"CVE-2025-69040","title":"Bfres <= 1.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab2c5cf1-f372-42d7-9a15-9148a3b4012c?source=api-prod","affected":[{"type":"theme","slug":"bfres","name":"Bfres - Organic Food WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:43:34Z"},{"id":"wordfence:ab3033c5-95c3-44eb-8602-410288fc423f","source":"wordfence","cve":"CVE-2018-5363","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[enabled_languages]","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3033c5-95c3-44eb-8602-410288fc423f?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab3176b5-fa24-4e06-9c0f-f4b0db4998ef","source":"wordfence","cve":"CVE-2024-51898","title":"Semantic Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3176b5-fa24-4e06-9c0f-f4b0db4998ef?source=api-prod","affected":[{"type":"plugin","slug":"semantic-shortcode","name":"Semantic Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:59:27Z"},{"id":"wordfence:ab340c65-35eb-4a85-8150-3119b46c7f35","source":"wordfence","cve":"CVE-2024-6028","title":"Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab340c65-35eb-4a85-8150-3119b46c7f35?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.5.8.3","to_inclusive":true,"patched_in":"6.5.8.4"}],"published":"2024-06-24T20:09:26Z","updated":"2024-06-25T08:35:30Z"},{"id":"wordfence:ab346cea-2d33-4ec5-b985-86a65fbe12e2","source":"wordfence","cve":"CVE-2023-23648","title":"MainWP Rocket Extension <= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab346cea-2d33-4ec5-b985-86a65fbe12e2?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-rocket-extension","name":"MainWP Rocket Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2023-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab376512-f60a-4931-8459-0e9f9caa2f15","source":"wordfence","cve":"CVE-2025-52747","title":"Themebox - Digital Products Ecommerce <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab376512-f60a-4931-8459-0e9f9caa2f15?source=api-prod","affected":[{"type":"theme","slug":"themebox","name":"Themebox - Digital Products, Marketplace Ecommerce Template","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-10T00:00:00Z","updated":"2026-09-18T14:33:53Z"},{"id":"wordfence:ab382c09-667b-42b9-b373-834a5f5ae9e2","source":"wordfence","cve":"CVE-2024-37503","title":"Lawyer Landing Page <= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab382c09-667b-42b9-b373-834a5f5ae9e2?source=api-prod","affected":[{"type":"theme","slug":"lawyer-landing-page","name":"Lawyer Landing Page","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:03:39Z"},{"id":"wordfence:ab395e85-6d50-4bc3-8471-f7911967408c","source":"wordfence","cve":"CVE-2025-69181","title":"Lawyer Directory <= 1.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab395e85-6d50-4bc3-8471-f7911967408c?source=api-prod","affected":[{"type":"plugin","slug":"lawyer-directory","name":"Lawyer Directory","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T15:23:04Z"},{"id":"wordfence:ab3b52f7-e2c3-44f7-8e19-b6c51ccd50e0","source":"wordfence","cve":"CVE-2026-2381","title":"WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3b52f7-e2c3-44f7-8e19-b6c51ccd50e0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-stripe","name":"WooCommerce Stripe Payment Gateway","from":"*","from_inclusive":true,"to":"10.7.0","to_inclusive":true,"patched_in":"10.8.0"}],"published":"2026-06-15T21:08:36Z","updated":"2026-09-22T18:44:12Z"},{"id":"wordfence:ab3baeb6-8728-46af-89ad-33811ead84b0","source":"wordfence","cve":"CVE-2026-57739","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3baeb6-8728-46af-89ad-33811ead84b0?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.0","to_inclusive":true,"patched_in":"10.11.1"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:54:47Z"},{"id":"wordfence:ab3c1740-aaf4-4e14-baff-bc4769d94305","source":"wordfence","cve":"CVE-2026-22508","title":"Dentalux | Dentist & Healthcare Site Template <= 3.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3c1740-aaf4-4e14-baff-bc4769d94305?source=api-prod","affected":[{"type":"theme","slug":"dentalux","name":"Dentalux | Dentist & Healthcare Site Template","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:13:30Z"},{"id":"wordfence:ab3ea93a-521a-45af-ac67-9f4417f3db59","source":"wordfence","cve":"CVE-2017-18559","title":"cformsII <= 14.13.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab3ea93a-521a-45af-ac67-9f4417f3db59?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"14.13.2","to_inclusive":true,"patched_in":"14.13.3"}],"published":"2017-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab40146d-9b49-4214-af73-41c5b5512542","source":"wordfence","cve":"CVE-2025-8678","title":"WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.9,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542?source=api-prod","affected":[{"type":"plugin","slug":"wp-crontrol","name":"WP Crontrol","from":"1.17.0","from_inclusive":true,"to":"1.19.1","to_inclusive":true,"patched_in":"1.19.2"}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-25T14:38:23Z"},{"id":"wordfence:ab4149e1-8378-4007-bbf2-1ac3c479e7ea","source":"wordfence","cve":"CVE-2024-8804","title":"Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4149e1-8378-4007-bbf2-1ac3c479e7ea?source=api-prod","affected":[{"type":"plugin","slug":"simple-embed-code","name":"Code Embed","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T05:30:18Z"},{"id":"wordfence:ab4175d7-6898-4f09-bd17-51a726130662","source":"wordfence","cve":"CVE-2026-116402","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.9 -Unauthenticated Arbitrary HTML Injection","severity":"medium","cvss":4.7,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4175d7-6898-4f09-bd17-51a726130662?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.12.9","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:36:38Z"},{"id":"wordfence:ab46b494-e7c5-42fd-9906-2a7a529e2794","source":"wordfence","cve":"CVE-2022-0785","title":"Daily Prayer Time < 2022.03.01 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab46b494-e7c5-42fd-9906-2a7a529e2794?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2022.03.01","to_inclusive":false,"patched_in":"2022.03.01"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab478a98-3f76-4712-9a0f-99bfe27043e1","source":"wordfence","cve":"CVE-2026-57617","title":"SeedProd Pro < 6.19.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab478a98-3f76-4712-9a0f-99bfe27043e1?source=api-prod","affected":[{"type":"plugin","slug":"seedprod-coming-soon-pro-5","name":"SeedProd Pro","from":"*","from_inclusive":true,"to":"6.19.5","to_inclusive":false,"patched_in":"6.19.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:47:34Z"},{"id":"wordfence:ab4bfd2f-6277-47d6-80ac-957b93476ed1","source":"wordfence","cve":"CVE-2026-12402","title":"OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4bfd2f-6277-47d6-80ac-957b93476ed1?source=api-prod","affected":[{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2026-09-18T19:17:18Z","updated":"2026-09-19T07:43:18Z"},{"id":"wordfence:ab4c7656-544c-4f2f-a42f-264ac90e3b61","source":"wordfence","cve":"CVE-2025-10850","title":"Felan Framework <= 1.1.4 - Hardcoded Credentials","severity":"critical","cvss":9.8,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=api-prod","affected":[{"type":"plugin","slug":"felan-framework","name":"Felan Framework","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-10-15T18:07:35Z","updated":"2026-01-13T22:07:17Z"},{"id":"wordfence:ab4e8423-9169-4ea3-b519-522e858e8374","source":"wordfence","cve":"CVE-2025-12117","title":"Renden <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4e8423-9169-4ea3-b519-522e858e8374?source=api-prod","affected":[{"type":"theme","slug":"renden","name":"Renden","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:22:33Z","updated":"2026-09-21T19:14:11Z"},{"id":"wordfence:ab518a1b-304d-4b93-b807-65ef3941dd47","source":"wordfence","cve":"CVE-2025-4126","title":"EG-Series <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab518a1b-304d-4b93-b807-65ef3941dd47?source=api-prod","affected":[{"type":"plugin","slug":"eg-series","name":"EG-Series","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T14:24:40Z","updated":"2025-05-15T03:21:39Z"},{"id":"wordfence:ab520bcb-5739-4b99-ad93-73416ab39084","source":"wordfence","cve":"","title":"WP Frontend Profile <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab520bcb-5739-4b99-ad93-73416ab39084?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2020-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab573de3-e05a-4946-8734-8cb18d05ad69","source":"wordfence","cve":"CVE-2025-68031","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u062d\u0631\u0641\u0647 \u0627\u06cc \u0641\u0631\u0627\u0632 \u0627\u0633 \u0627\u0645 \u0627\u0633 <= 2.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab573de3-e05a-4946-8734-8cb18d05ad69?source=api-prod","affected":[{"type":"plugin","slug":"farazsms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u062d\u0631\u0641\u0647 \u0627\u06cc \u0641\u0631\u0627\u0632 \u0627\u0633 \u0627\u0645 \u0627\u0633","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:22:08Z"},{"id":"wordfence:ab57f010-4fd2-40c2-950f-c03888521c8f","source":"wordfence","cve":"CVE-2020-36751","title":"Coupon Creator <= 3.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab57f010-4fd2-40c2-950f-c03888521c8f?source=api-prod","affected":[{"type":"plugin","slug":"coupon-creator","name":"Coupon Creator","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab58a6e8-624b-4268-a95a-0e004f8e8c86","source":"wordfence","cve":"CVE-2018-9864","title":"WP Live Chat Support <= 8.0.05 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab58a6e8-624b-4268-a95a-0e004f8e8c86?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.05","to_inclusive":true,"patched_in":"8.0.06"}],"published":"2018-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab58cd01-2d69-4711-a678-e15e9de7f616","source":"wordfence","cve":"CVE-2026-86780","title":"Featured Image with URL < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab58cd01-2d69-4711-a678-e15e9de7f616?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-with-url","name":"Featured Image with URL","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:13:32Z"},{"id":"wordfence:ab5a88a9-55ff-428d-9ce2-3247f5d48266","source":"wordfence","cve":"CVE-2024-43277","title":"UsersWP <= 1.2.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5a88a9-55ff-428d-9ce2-3247f5d48266?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:35:15Z"},{"id":"wordfence:ab5a9850-8990-4e24-9ac3-5b92564c4ad9","source":"wordfence","cve":"CVE-2026-95670","title":"No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5a9850-8990-4e24-9ac3-5b92564c4ad9?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-no-external-links","name":"No External Links","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-01T19:17:12Z","updated":"2026-10-02T07:39:28Z"},{"id":"wordfence:ab5b7dc4-113d-4f58-956e-2a9284e1e25e","source":"wordfence","cve":"CVE-2023-48765","title":"Email Address Encoder 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5b7dc4-113d-4f58-956e-2a9284e1e25e?source=api-prod","affected":[{"type":"plugin","slug":"email-address-encoder","name":"Email Address Encoder","from":"1.0.22","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab5c50e8-9dd7-4192-9e9d-341fafac07bf","source":"wordfence","cve":"CVE-2026-28081","title":"Windsor <= 2.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5c50e8-9dd7-4192-9e9d-341fafac07bf?source=api-prod","affected":[{"type":"theme","slug":"windsor","name":"Windsor - Apartment Complex Single Property WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:48:49Z"},{"id":"wordfence:ab5d87d2-f3cb-4926-9cbf-acdbe9169f64","source":"wordfence","cve":"CVE-2021-4414","title":"Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5d87d2-f3cb-4926-9cbf-acdbe9169f64?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"5.8.6"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab5e09d8-6fa3-4a5b-bee1-6648df4f4b3b","source":"wordfence","cve":"CVE-2024-4363","title":"Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5e09d8-6fa3-4a5b-bee1-6648df4f4b3b?source=api-prod","affected":[{"type":"plugin","slug":"visual-portfolio","name":"Gallery by Visual Portfolio","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-05-14T11:31:11Z","updated":"2024-05-14T23:31:46Z"},{"id":"wordfence:ab5e166e-12a4-4359-8b27-d5272d4bbd1c","source":"wordfence","cve":"CVE-2026-40809","title":"Metro Magazine <= 1.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5e166e-12a4-4359-8b27-d5272d4bbd1c?source=api-prod","affected":[{"type":"theme","slug":"metro-magazine","name":"Metro Magazine","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:39:02Z"},{"id":"wordfence:ab5e4b3b-dc08-422f-b67c-2a01a55e4fb7","source":"wordfence","cve":"CVE-2026-39737","title":"JetElements <= 2.9.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5e4b3b-dc08-422f-b67c-2a01a55e4fb7?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.6","to_inclusive":true,"patched_in":"2.9.2.7"}],"published":"2026-10-29T14:24:00Z","updated":"2026-11-03T19:55:50Z"},{"id":"wordfence:ab5f43c0-83d3-4d09-becd-a3552bebd609","source":"wordfence","cve":"CVE-2024-4570","title":"Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5f43c0-83d3-4d09-becd-a3552bebd609?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2024-06-26T00:00:00Z","updated":"2024-06-27T04:04:33Z"},{"id":"wordfence:ab606a75-e3d6-43b2-a7c1-81bbaf9442e5","source":"wordfence","cve":"CVE-2026-84254","title":"click5 CRM add-on to Contact Form 7 <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab606a75-e3d6-43b2-a7c1-81bbaf9442e5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-add-on-by-click5","name":"click5 CRM add-on to Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:11:36Z"},{"id":"wordfence:ab60edf0-0912-48d5-ae02-18b366c1d72b","source":"wordfence","cve":"CVE-2025-29007","title":"LMSACE Connect <= 3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab60edf0-0912-48d5-ae02-18b366c1d72b?source=api-prod","affected":[{"type":"plugin","slug":"lmsace-connect","name":"LMSACE Connect \u2013 WooCommerce Moodle\u2122 LMS Integration","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:50:22Z"},{"id":"wordfence:ab62ea47-6ecb-40e3-82f8-3f35d738ece8","source":"wordfence","cve":"CVE-2026-39611","title":"KuteShop <= 4.2.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab62ea47-6ecb-40e3-82f8-3f35d738ece8?source=api-prod","affected":[{"type":"theme","slug":"kuteshop","name":"kuteshop","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-08T00:00:00Z","updated":"2026-04-15T21:17:41Z"},{"id":"wordfence:ab633506-63a1-4be1-b402-c7f0bcc4ea7a","source":"wordfence","cve":"CVE-2023-4926","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab633506-63a1-4be1-b402-c7f0bcc4ea7a?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab63f507-6288-48e2-81c8-52b8a8c0c28c","source":"wordfence","cve":"CVE-2024-30559","title":"Spin 360 deg and 3D Model Viewer <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab63f507-6288-48e2-81c8-52b8a8c0c28c?source=api-prod","affected":[{"type":"plugin","slug":"spin360","name":"Spin 360 deg and 3D Model Viewer","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T21:05:42Z"},{"id":"wordfence:ab650b99-ab15-4ddc-a622-cb43ab554ba7","source":"wordfence","cve":"CVE-2024-5582","title":"Schema & Structured Data for WP & AMP <= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab650b99-ab15-4ddc-a622-cb43ab554ba7?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.33","to_inclusive":true,"patched_in":"1.34.1"}],"published":"2024-07-16T18:46:17Z","updated":"2024-07-17T07:32:20Z"},{"id":"wordfence:ab664bc5-ef3c-4e5a-99d5-e3f1bb240a70","source":"wordfence","cve":"CVE-2025-8199","title":"MarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab664bc5-ef3c-4e5a-99d5-e3f1bb240a70?source=api-prod","affected":[{"type":"plugin","slug":"marquee-addons-for-elementor","name":"Marquee Addons for Elementor \u2013 Essential Motion Widgets & Templates","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-12-12T19:49:30Z","updated":"2025-12-13T08:21:14Z"},{"id":"wordfence:ab66ac69-0617-4f9f-8ad3-4ab1502892bd","source":"wordfence","cve":"CVE-2013-0236","title":"WordPress Core < 3.5.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab66ac69-0617-4f9f-8ad3-4ab1502892bd?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":false,"patched_in":"3.5.1"}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab68a08d-a6d4-4424-a7bf-219951f752fa","source":"wordfence","cve":"CVE-2024-4427","title":"Comparison Slider <= 1.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab68a08d-a6d4-4424-a7bf-219951f752fa?source=api-prod","affected":[{"type":"plugin","slug":"comparison-slider","name":"Comparison Slider","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T19:51:30Z","updated":"2024-05-30T08:30:13Z"},{"id":"wordfence:ab68a6b2-e9b0-4efa-bd01-c6e3e11011db","source":"wordfence","cve":"CVE-2026-92619","title":"Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab68a6b2-e9b0-4efa-bd01-c6e3e11011db?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.8.2","to_inclusive":true,"patched_in":"11.8.3"}],"published":"2026-09-17T18:25:01Z","updated":"2026-09-18T06:38:55Z"},{"id":"wordfence:ab693b1f-2842-4101-99f3-eaf5b7bf5d83","source":"wordfence","cve":"CVE-2022-27235","title":"Social Share Buttons by Supsystic <= 2.2.3 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab693b1f-2842-4101-99f3-eaf5b7bf5d83?source=api-prod","affected":[{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2022-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab6b9d89-cccc-4a95-9cd1-80725187974f","source":"wordfence","cve":"CVE-2026-91072","title":"EWWW Image Optimizer <= 8.7.0 - Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename","severity":"medium","cvss":4.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab6b9d89-cccc-4a95-9cd1-80725187974f?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.0","to_inclusive":true,"patched_in":"8.8.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:29:06Z"},{"id":"wordfence:ab6dd645-8831-49bc-b6b1-bb153ef79204","source":"wordfence","cve":"CVE-2024-13415","title":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab6dd645-8831-49bc-b6b1-bb153ef79204?source=api-prod","affected":[{"type":"plugin","slug":"tlp-food-menu","name":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T05:22:35Z"},{"id":"wordfence:ab6ebd66-c7a4-402e-b51e-3f1f3183bd97","source":"wordfence","cve":"CVE-2026-115806","title":"Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab6ebd66-c7a4-402e-b51e-3f1f3183bd97?source=api-prod","affected":[{"type":"plugin","slug":"prime-mover","name":"Prime Mover \u2013 Backup and Migration","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-10-22T20:18:57Z","updated":"2026-10-27T17:32:07Z"},{"id":"wordfence:ab710963-64e2-476e-9a60-0a18b64b7550","source":"wordfence","cve":"CVE-2017-5612","title":"WordPress Core < 4.7.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab710963-64e2-476e-9a60-0a18b64b7550?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.17","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.15","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.14","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"3.7.18"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"3.7.18"}],"published":"2017-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab721099-677d-48f4-83ba-f4c409374e80","source":"wordfence","cve":"CVE-2025-30835","title":"Accounting for WooCommerce <= 1.6.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab721099-677d-48f4-83ba-f4c409374e80?source=api-prod","affected":[{"type":"plugin","slug":"accounting-for-woocommerce","name":"Accounting for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:35:45Z"},{"id":"wordfence:ab747c34-219d-40c8-a73d-5b0dffba003b","source":"wordfence","cve":"CVE-2025-10295","title":"Angel \u2013 Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab747c34-219d-40c8-a73d-5b0dffba003b?source=api-prod","affected":[{"type":"theme","slug":"angel","name":"Angel \u2013 Fashion Model Agency WordPress CMS Theme","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-12T20:19:15Z","updated":"2025-11-13T08:27:47Z"},{"id":"wordfence:ab770acd-9420-4201-9e67-dfea86dba168","source":"wordfence","cve":"CVE-2023-0260","title":"WP Review Slider <= 12.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab770acd-9420-4201-9e67-dfea86dba168?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"12.1","to_inclusive":true,"patched_in":"12.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab777672-6eef-4078-932d-24bb784107fa","source":"wordfence","cve":"CVE-2023-6645","title":"Post Grid Combo \u2013 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab777672-6eef-4078-932d-24bb784107fa?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.64","to_inclusive":true,"patched_in":"2.2.65"}],"published":"2023-12-15T00:00:00Z","updated":"2024-07-29T21:37:07Z"},{"id":"wordfence:ab779713-7004-47f6-af16-2db2c7c1013b","source":"wordfence","cve":"CVE-2023-0423","title":"WordPress Amazon S3 Plugin <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab779713-7004-47f6-af16-2db2c7c1013b?source=api-prod","affected":[{"type":"plugin","slug":"wp-s3","name":"WordPress Amazon S3 Plugin","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab77ca73-725e-4681-8bc6-54d95b871342","source":"wordfence","cve":"CVE-2026-92465","title":"WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab77ca73-725e-4681-8bc6-54d95b871342?source=api-prod","affected":[{"type":"plugin","slug":"wp-megamenu","name":"WP Mega Menu","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T11:27:00Z","updated":"2026-11-10T09:55:12Z"},{"id":"wordfence:ab78f245-ab2d-4e9a-bd43-caa3afd1366b","source":"wordfence","cve":"CVE-2022-0833","title":"Church Admin <= 3.4.134 - Cross-Site Request Forgery leading to Plugin Backup Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab78f245-ab2d-4e9a-bd43-caa3afd1366b?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"3.4.135","to_inclusive":false,"patched_in":"3.4.135"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab795923-2ec0-49eb-a911-56a74d90ca3f","source":"wordfence","cve":"CVE-2023-47230","title":"Contact Forms by Cimatti <= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab795923-2ec0-49eb-a911-56a74d90ca3f?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab796de7-2bc6-4e25-be00-25d0941045fb","source":"wordfence","cve":"CVE-2024-54352","title":"Sogrid <= 1.5.2 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab796de7-2bc6-4e25-be00-25d0941045fb?source=api-prod","affected":[{"type":"plugin","slug":"sogrid","name":"WordPress Post Grid Layouts with Pagination \u2013 Sogrid","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:20:26Z"},{"id":"wordfence:ab7c8926-c762-49b1-bc97-4b7a2f4f97fc","source":"wordfence","cve":"CVE-2023-3977","title":"Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab7c8926-c762-49b1-bc97-4b7a2f4f97fc?source=api-prod","affected":[{"type":"plugin","slug":"http-https-remover","name":"SSL Mixed Content Fix","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"},{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"},{"type":"plugin","slug":"ultimate-posts-widget","name":"Ultimate Posts Widget","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"},{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"pop-up-pop-up","name":"Pop-up","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"},{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"},{"type":"plugin","slug":"feedburner-alternative-and-rss-redirect","name":"RSS Redirect & Feedburner Alternative","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"},{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab807beb-0e20-47e4-be3e-9e8f50b84c7b","source":"wordfence","cve":"CVE-2024-10862","title":"NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab807beb-0e20-47e4-be3e-9e8f50b84c7b?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.7.15","to_inclusive":true,"patched_in":"8.7.16"}],"published":"2024-12-24T00:00:00Z","updated":"2025-01-20T19:40:38Z"},{"id":"wordfence:ab81622e-430f-415d-b3ab-41edd5436131","source":"wordfence","cve":"CVE-2024-34422","title":"Viet Affiliate Link <=1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab81622e-430f-415d-b3ab-41edd5436131?source=api-prod","affected":[{"type":"plugin","slug":"viet-affiliate-link","name":"Viet Affiliate Link","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:15:57Z"},{"id":"wordfence:ab82c0ca-7728-4fae-a180-046f76d670f7","source":"wordfence","cve":"CVE-2024-44060","title":"Filmix <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab82c0ca-7728-4fae-a180-046f76d670f7?source=api-prod","affected":[{"type":"theme","slug":"filmix","name":"Filmix","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:53:39Z"},{"id":"wordfence:ab844a05-80e0-42c7-981c-dea3a18cf4d5","source":"wordfence","cve":"CVE-2025-12175","title":"The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab844a05-80e0-42c7-981c-dea3a18cf4d5?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.9","to_inclusive":true,"patched_in":"6.15.10"}],"published":"2025-10-30T00:00:00Z","updated":"2025-10-31T08:25:57Z"},{"id":"wordfence:ab856722-e954-49de-a93f-46664da6e3e8","source":"wordfence","cve":"CVE-2023-5116","title":"Live updates from Excel <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab856722-e954-49de-a93f-46664da6e3e8?source=api-prod","affected":[{"type":"plugin","slug":"ipushpull","name":"Live updates from Excel","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab8659e1-5880-4738-99ed-e671449c6878","source":"wordfence","cve":"CVE-2024-9540","title":"Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8659e1-5880-4738-99ed-e671449c6878?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T07:31:52Z"},{"id":"wordfence:ab86ddc9-9b43-4949-b150-7b944bc40558","source":"wordfence","cve":"CVE-2023-23654","title":"SparkPost <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab86ddc9-9b43-4949-b150-7b944bc40558?source=api-prod","affected":[{"type":"plugin","slug":"sparkpost","name":"SparkPost","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab870fc4-1651-414e-8702-cbe9829a4e75","source":"wordfence","cve":"CVE-2022-1658","title":"Jupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab870fc4-1651-414e-8702-cbe9829a4e75?source=api-prod","affected":[{"type":"theme","slug":"jupiter","name":"Jupiter","from":"*","from_inclusive":true,"to":"6.10.1","to_inclusive":true,"patched_in":"6.10.2"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab87210f-1f21-4208-ab50-4f62ec8e02fb","source":"wordfence","cve":"CVE-2023-5845","title":"Simple Social Media Share Buttons <= 5.1.0 - Unauthenticated Password Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab87210f-1f21-4208-ab50-4f62ec8e02fb?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab87321b-d326-498d-9a75-44692258cae6","source":"wordfence","cve":"CVE-2024-32788","title":"FG Joomla to WordPress <= 4.20.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab87321b-d326-498d-9a75-44692258cae6?source=api-prod","affected":[{"type":"plugin","slug":"fg-joomla-to-wordpress","name":"FG Joomla to WordPress","from":"*","from_inclusive":true,"to":"4.20.2","to_inclusive":true,"patched_in":"4.21.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:16:24Z"},{"id":"wordfence:ab888ee1-bdc2-4b8b-9b16-a7d146f123df","source":"wordfence","cve":"CVE-2023-48336","title":"Easy Social Icons <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab888ee1-bdc2-4b8b-9b16-a7d146f123df?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab88b12a-177d-45e2-a384-7b44f09bc605","source":"wordfence","cve":"CVE-2024-51652","title":"Skip To <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab88b12a-177d-45e2-a384-7b44f09bc605?source=api-prod","affected":[{"type":"plugin","slug":"skip-to","name":"Skip To","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:20:42Z"},{"id":"wordfence:ab88f0cf-971f-43e1-b6b7-4eb55188ecc8","source":"wordfence","cve":"CVE-2025-13194","title":"SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab88f0cf-971f-43e1-b6b7-4eb55188ecc8?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-01-23T20:33:35Z","updated":"2026-02-03T19:02:51Z"},{"id":"wordfence:ab890935-d59a-4d4e-9c02-c4eceea270a9","source":"wordfence","cve":"CVE-2025-31466","title":"Duplicate Page and Post <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab890935-d59a-4d4e-9c02-c4eceea270a9?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post-and-page","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:16:45Z"},{"id":"wordfence:ab8a13d5-911a-4c25-8d5a-391146971c0c","source":"wordfence","cve":"CVE-2019-17239","title":"Download Plugins and Themes from Dashboard <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8a13d5-911a-4c25-8d5a-391146971c0c?source=api-prod","affected":[{"type":"plugin","slug":"download-plugins-dashboard","name":"Download Plugins and Themes in ZIP from Dashboard","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2019-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab8bb8b3-59a6-424a-bc7b-b8740c936637","source":"wordfence","cve":"CVE-2024-1526","title":"Hubbub Lite <= 1.31.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8bb8b3-59a6-424a-bc7b-b8740c936637?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.33.0","to_inclusive":true,"patched_in":"1.33.1"}],"published":"2024-03-11T00:00:00Z","updated":"2024-04-24T15:10:45Z"},{"id":"wordfence:ab8bd8c8-d9aa-4223-9400-4d500446b598","source":"wordfence","cve":"CVE-2026-84960","title":"WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8bd8c8-d9aa-4223-9400-4d500446b598?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2026-09-10T14:47:48Z","updated":"2026-09-11T03:39:37Z"},{"id":"wordfence:ab8bf2d1-1af4-4ea0-bba9-e65ea1ed5978","source":"wordfence","cve":"CVE-2024-6928","title":"Opti Marketing <= 2.0.9 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8bf2d1-1af4-4ea0-bba9-e65ea1ed5978?source=api-prod","affected":[{"type":"plugin","slug":"opti-marketing","name":"Opti Marketing","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2024-08-10T00:00:00Z","updated":"2025-01-30T22:32:47Z"},{"id":"wordfence:ab8cc5d1-8ea2-4590-90c4-6541f336b057","source":"wordfence","cve":"CVE-2023-25471","title":"WCP OpenWeather <= 2.5.0 - Reflected Cross-Site Scripting via 'tab'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8cc5d1-8ea2-4590-90c4-6541f336b057?source=api-prod","affected":[{"type":"plugin","slug":"wcp-openweather","name":"WCP OpenWeather","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab8ce4cf-9085-49d2-a889-9d53272032c1","source":"wordfence","cve":"CVE-2021-24584","title":"Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Update","severity":"medium","cvss":6.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8ce4cf-9085-49d2-a889-9d53272032c1?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab8dfdd8-820c-4066-8014-2cb5b9f935a4","source":"wordfence","cve":"CVE-2025-5292","title":"Element Pack Addons for Elementor \u2013 Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8dfdd8-820c-4066-8014-2cb5b9f935a4?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.11.2","to_inclusive":true,"patched_in":"5.11.3"}],"published":"2025-05-30T00:00:00Z","updated":"2025-05-31T06:40:57Z"},{"id":"wordfence:ab8ed134-651e-458a-9151-ee41634d01ea","source":"wordfence","cve":"CVE-2025-32199","title":"Contact Form Builder by vcita <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8ed134-651e-458a-9151-ee41634d01ea?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-a-meeting-scheduler-by-vcita","name":"Contact Form Builder by vcita","from":"*","from_inclusive":true,"to":"4.10.4","to_inclusive":true,"patched_in":"4.10.5"}],"published":"2025-04-04T00:00:00Z","updated":"2025-10-30T14:06:17Z"},{"id":"wordfence:ab8f2a05-4bc9-4f8d-b5bf-efbbeb5818d6","source":"wordfence","cve":"CVE-2026-78139","title":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist < 3.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8f2a05-4bc9-4f8d-b5bf-efbbeb5818d6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-stock-alert","name":"Notifima \u2013 WooCommerce Stock Manager, Inventory Management, Waitlist","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:44:59Z"},{"id":"wordfence:ab8f8370-50bd-48c8-89e1-8b19b51f78b5","source":"wordfence","cve":"CVE-2021-24281","title":"Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8f8370-50bd-48c8-89e1-8b19b51f78b5?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab922406-4af8-4ef2-bcc8-c326212546b1","source":"wordfence","cve":"CVE-2023-49746","title":"SpeedyCache <= 1.1.2 -  Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab922406-4af8-4ef2-bcc8-c326212546b1?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab96123e-17aa-461f-b460-e8eba82c78e1","source":"wordfence","cve":"CVE-2023-41244","title":"Localize Remote Images <= 1.0.9 - Cross-Site Request Forgery via admin menu","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab96123e-17aa-461f-b460-e8eba82c78e1?source=api-prod","affected":[{"type":"plugin","slug":"localize-remote-images","name":"Localize Remote Images","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab97f125-3a4a-4293-b218-07586c1c021c","source":"wordfence","cve":"CVE-2025-12709","title":"Interactions \u2013 Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab97f125-3a4a-4293-b218-07586c1c021c?source=api-prod","affected":[{"type":"plugin","slug":"interactions","name":"Interactions \u2013 Animations for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-01-27T17:57:39Z","updated":"2026-01-28T06:43:44Z"},{"id":"wordfence:ab9a5d89-16be-4dc7-9361-2b1be2324239","source":"wordfence","cve":"CVE-2022-0846","title":"SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab9a5d89-16be-4dc7-9361-2b1be2324239?source=api-prod","affected":[{"type":"plugin","slug":"speakout","name":"SpeakOut! Email Petitions","from":"*","from_inclusive":true,"to":"2.14.15.1","to_inclusive":false,"patched_in":"2.14.15.1"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab9d3fa4-f2b1-4f38-b928-a1220cfeca75","source":"wordfence","cve":"CVE-2021-25097","title":"LabTools <= 1.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab9d3fa4-f2b1-4f38-b928-a1220cfeca75?source=api-prod","affected":[{"type":"plugin","slug":"labtools","name":"LabTools","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ab9dd831-9dee-4dae-958d-2952f73627cd","source":"wordfence","cve":"CVE-2026-81739","title":"Paytm Payment Gateway <= 2.8.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab9dd831-9dee-4dae-958d-2952f73627cd?source=api-prod","affected":[{"type":"plugin","slug":"paytm-payments","name":"Paytm Payment Gateway","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:39:51Z"},{"id":"wordfence:ab9f69ce-8589-47a8-80b1-6829c5a5bad1","source":"wordfence","cve":"CVE-2024-9838","title":"Auto Affiliate Links <= 6.4.6 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ab9f69ce-8589-47a8-80b1-6829c5a5bad1?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.6","to_inclusive":true,"patched_in":"6.4.7"}],"published":"2024-09-18T00:00:00Z","updated":"2025-05-29T22:34:03Z"},{"id":"wordfence:aba1ca3a-a937-400b-b175-2ca4e67a107d","source":"wordfence","cve":"CVE-2023-32517","title":"MailChimp Subscribe Forms  <= 4.0.9.3 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba1ca3a-a937-400b-b175-2ca4e67a107d?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.0.9.3","to_inclusive":true,"patched_in":"4.0.9.4"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aba2ad9a-9cf7-4406-a984-8c647d75a67e","source":"wordfence","cve":"CVE-2025-25144","title":"Theasys <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba2ad9a-9cf7-4406-a984-8c647d75a67e?source=api-prod","affected":[{"type":"plugin","slug":"theasys","name":"Theasys","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:35:04Z"},{"id":"wordfence:aba33487-f6c5-41e9-9500-73bef37381e6","source":"wordfence","cve":"CVE-2015-5732","title":"WordPress Core < 4.2.4 - Cross-Site Scripting via Widget Title","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba33487-f6c5-41e9-9500-73bef37381e6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aba36c3b-beae-4c47-8aa8-5012a7a838ce","source":"wordfence","cve":"CVE-2024-0656","title":"Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba36c3b-beae-4c47-8aa8-5012a7a838ce?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2024-02-19T00:00:00Z","updated":"2024-07-29T21:37:07Z"},{"id":"wordfence:aba393f5-c8e4-485f-b488-70b26ffb5698","source":"wordfence","cve":"CVE-2025-64355","title":"JetElements For Elementor <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba393f5-c8e4-485f-b488-70b26ffb5698?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":true,"patched_in":"2.7.12.1"}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-19T17:05:11Z"},{"id":"wordfence:aba54af1-732a-49e6-a8c4-76f276a5581a","source":"wordfence","cve":"CVE-2021-24338","title":"Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba54af1-732a-49e6-a8c4-76f276a5581a?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.4.4.1","from_inclusive":true,"to":"2.7.27","to_inclusive":false,"patched_in":"2.7.27"}],"published":"2021-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aba673c8-694f-4ae7-96cb-3624e3cc0ed2","source":"wordfence","cve":"CVE-2025-22530","title":"\uc544\uc784\ud3ec\ud2b8 \uacb0\uc81c\ubc84\ud2bc \uc0dd\uc131 \ud50c\ub7ec\uadf8\uc778 <= 1.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba673c8-694f-4ae7-96cb-3624e3cc0ed2?source=api-prod","affected":[{"type":"plugin","slug":"iamport-payment","name":"\uc544\uc784\ud3ec\ud2b8 \uacb0\uc81c\ubc84\ud2bc \uc0dd\uc131 \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:36:21Z"},{"id":"wordfence:aba88c4c-93a4-4c1c-b239-68b5fec87146","source":"wordfence","cve":"CVE-2024-5309","title":"Form Vibes \u2013 Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aba88c4c-93a4-4c1c-b239-68b5fec87146?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.4.13"}],"published":"2024-09-04T00:00:00Z","updated":"2024-09-06T16:58:43Z"},{"id":"wordfence:abab29c7-88a9-4c6f-9691-ed9087cde2ff","source":"wordfence","cve":"CVE-2024-13184","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abab29c7-88a9-4c6f-9691-ed9087cde2ff?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.0.13"}],"published":"2025-01-17T19:59:11Z","updated":"2025-01-18T08:26:40Z"},{"id":"wordfence:abac57e7-2256-4592-a85d-89b71c444fe2","source":"wordfence","cve":"CVE-2026-57625","title":"Admin and Site Enhancements (ASE) Pro <= 8.8.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abac57e7-2256-4592-a85d-89b71c444fe2?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements-pro","name":"Admin and Site Enhancements (ASE) Pro","from":"*","from_inclusive":true,"to":"8.8.5","to_inclusive":true,"patched_in":"8.8.6"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T13:48:26Z"},{"id":"wordfence:abaebd3b-69ab-4e9b-a528-c9d846e62238","source":"wordfence","cve":"CVE-2024-9685","title":"Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abaebd3b-69ab-4e9b-a528-c9d846e62238?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:10Z"},{"id":"wordfence:abb10680-6208-44c8-8cf0-8d2531465a04","source":"wordfence","cve":"","title":"WP-Matomo Integration (WP-Piwik) <= 1.0.26 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb10680-6208-44c8-8cf0-8d2531465a04?source=api-prod","affected":[{"type":"plugin","slug":"wp-piwik","name":"Connect Matomo \u2013 Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":false,"patched_in":"1.0.27"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abb19c71-71c6-487d-b7b2-114459535af8","source":"wordfence","cve":"CVE-2025-25113","title":"Implied Cookie Consent <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb19c71-71c6-487d-b7b2-114459535af8?source=api-prod","affected":[{"type":"plugin","slug":"implied-cookie-consent","name":"Implied Cookie Consent","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:20:27Z"},{"id":"wordfence:abb1a758-5c16-4841-b1c7-0705ab16b328","source":"wordfence","cve":"CVE-2023-2280","title":"WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb1a758-5c16-4841-b1c7-0705ab16b328?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abb362f1-8782-4217-a231-c9b258da6964","source":"wordfence","cve":"CVE-2026-56050","title":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb362f1-8782-4217-a231-c9b258da6964?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"33.0.18","to_inclusive":true,"patched_in":"34.0.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:00:43Z"},{"id":"wordfence:abb41236-d711-41d3-a1cd-2c23467e269a","source":"wordfence","cve":"","title":"Aspose Cloud eBook Generator <= 1.0 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb41236-d711-41d3-a1cd-2c23467e269a?source=api-prod","affected":[{"type":"plugin","slug":"aspose-cloud-ebook-generator","name":"Aspose Cloud eBook Generator (Discontinued)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2015-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abb4af63-37fe-49b7-8f70-ac9c7e47e939","source":"wordfence","cve":"CVE-2022-46850","title":"Easy Media Replace <= 0.1.3 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb4af63-37fe-49b7-8f70-ac9c7e47e939?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-replace","name":"Easy Media Replace","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":"0.2.0"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abb4b617-884b-4e72-812f-5f23a0976ab6","source":"wordfence","cve":"CVE-2024-1463","title":"LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb4b617-884b-4e72-812f-5f23a0976ab6?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.3","to_inclusive":true,"patched_in":"4.2.6.4"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:12Z"},{"id":"wordfence:abb64c22-f16e-4b4e-ac4f-86fde8a51bc6","source":"wordfence","cve":"CVE-2025-59585","title":"Penci Recipe <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb64c22-f16e-4b4e-ac4f-86fde8a51bc6?source=api-prod","affected":[{"type":"plugin","slug":"penci-recipe","name":"Penci Recipe","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:44:16Z"},{"id":"wordfence:abb66687-d0d1-466b-8552-a40bd21a2918","source":"wordfence","cve":"CVE-2026-16983","title":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor < 4.0.6 - Authenticated (Subscriber+) Password-Protected Post Password Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb66687-d0d1-466b-8552-a40bd21a2918?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:04:13Z"},{"id":"wordfence:abb7def7-df32-4901-b8ea-068ff1af664b","source":"wordfence","cve":"","title":"Master Addons for Elementor <= 2.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abb7def7-df32-4901-b8ea-068ff1af664b?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abbdf198-b6f3-41dd-ada1-b14fc9946142","source":"wordfence","cve":"CVE-2023-0378","title":"Greenshift \u2013 animation and page builder blocks <= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abbdf198-b6f3-41dd-ada1-b14fc9946142?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abbeb5c9-930b-4786-81da-133d10f54900","source":"wordfence","cve":"CVE-2026-14334","title":"Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abbeb5c9-930b-4786-81da-133d10f54900?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T22:29:52Z"},{"id":"wordfence:abbf1bb8-16db-48b6-b2ff-d828fcb7f7c7","source":"wordfence","cve":"CVE-2021-24436","title":"W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abbf1bb8-16db-48b6-b2ff-d828fcb7f7c7?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abc056b0-55a2-439c-b7f6-4a2fc48c9823","source":"wordfence","cve":"CVE-2023-46153","title":"User Feedback <= 1.0.9 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc056b0-55a2-439c-b7f6-4a2fc48c9823?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abc0d9c0-ed5a-4bb8-9ff1-d2833dd04d31","source":"wordfence","cve":"CVE-2026-3075","title":"Simple Ajax Chat <= 20251121 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc0d9c0-ed5a-4bb8-9ff1-d2833dd04d31?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20251121","to_inclusive":true,"patched_in":"20260217"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-25T15:13:41Z"},{"id":"wordfence:abc13da0-8d1e-4ecd-80c8-d7fe5fb31a6d","source":"wordfence","cve":"CVE-2025-64371","title":"Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc13da0-8d1e-4ecd-80c8-d7fe5fb31a6d?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2025-11-07T00:00:00Z","updated":"2025-12-19T17:05:30Z"},{"id":"wordfence:abc14a00-5560-440b-a5ba-4ff41a6c54c3","source":"wordfence","cve":"","title":"Visualizer <= 3.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc14a00-5560-440b-a5ba-4ff41a6c54c3?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":true,"patched_in":"3.7.7"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abc3f352-8568-4649-bf3c-dd0ce0295589","source":"wordfence","cve":"CVE-2023-52148","title":"Affiliates Manager <= 2.9.30 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc3f352-8568-4649-bf3c-dd0ce0295589?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.30","to_inclusive":true,"patched_in":"2.9.31"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8","source":"wordfence","cve":"CVE-2026-4062","title":"Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-05T13:48:06Z"},{"id":"wordfence:abc75a73-f515-42eb-ad4a-79e8900057c0","source":"wordfence","cve":"CVE-2026-118067","title":"Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc75a73-f515-42eb-ad4a-79e8900057c0?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.50","to_inclusive":true,"patched_in":"1.15.51"}],"published":"2026-11-06T13:47:40Z","updated":"2026-11-07T02:29:16Z"},{"id":"wordfence:abc8ee11-c149-4a2b-a388-7bd234c2cc64","source":"wordfence","cve":"CVE-2023-4821","title":"Drag and Drop Multiple File Upload for WooCommerce <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc8ee11-c149-4a2b-a388-7bd234c2cc64?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-for-woocommerce","name":"Drag and Drop Multiple File Upload for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abc983c6-aa30-4d1b-b6af-99b5ba1c8481","source":"wordfence","cve":"CVE-2022-41155","title":"iQ Block Country <= 1.2.18 - Country Blocking Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abc983c6-aa30-4d1b-b6af-99b5ba1c8481?source=api-prod","affected":[{"type":"plugin","slug":"iq-block-country","name":"iQ Block Country","from":"*","from_inclusive":true,"to":"1.2.18","to_inclusive":true,"patched_in":"1.2.19"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abcb2e9f-a6f1-40c3-b419-e2f65ec5dd41","source":"wordfence","cve":"CVE-2023-45749","title":"AGP Font Awesome Collection <= 3.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abcb2e9f-a6f1-40c3-b419-e2f65ec5dd41?source=api-prod","affected":[{"type":"plugin","slug":"agp-font-awesome-collection","name":"AGP Font Awesome Collection","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abcbb84c-6c2d-40c1-8c64-7d4866fa9503","source":"wordfence","cve":"CVE-2026-1786","title":"Twitter posts to Blog <= 1.11.25 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abcbb84c-6c2d-40c1-8c64-7d4866fa9503?source=api-prod","affected":[{"type":"plugin","slug":"twitter-posts-to-blog","name":"Twitter posts to Blog","from":"*","from_inclusive":true,"to":"1.11.25","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:03:18Z","updated":"2026-02-11T08:26:28Z"},{"id":"wordfence:abcc1ed6-1871-4e8c-9469-c44dbfca5a17","source":"wordfence","cve":"CVE-2023-51476","title":"WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abcc1ed6-1871-4e8c-9469-c44dbfca5a17?source=api-prod","affected":[{"type":"plugin","slug":"wp-mlm","name":"WP MLM SOFTWARE PLUGIN","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abcebcdb-e22a-4b6c-86db-f95b00260446","source":"wordfence","cve":"CVE-2024-11687","title":"Next-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abcebcdb-e22a-4b6c-86db-f95b00260446?source=api-prod","affected":[{"type":"plugin","slug":"nextcart-woocommerce-migration","name":"Next-Cart Store to WooCommerce Migration","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:24:56Z"},{"id":"wordfence:abd59d7a-e7f6-440d-9c2a-00266c0dcbff","source":"wordfence","cve":"CVE-2026-14279","title":"Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abd59d7a-e7f6-440d-9c2a-00266c0dcbff?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market","name":"Wholesale Market","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T18:09:21Z","updated":"2026-08-15T06:38:10Z"},{"id":"wordfence:abd6eeac-0a7e-4762-809f-593cd85f303d","source":"wordfence","cve":"CVE-2023-2688","title":"WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abd6eeac-0a7e-4762-809f-593cd85f303d?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"},{"type":"plugin","slug":"wordpress-file-upload-pro","name":"WordPress File Upload Pro","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abd70095-7549-41f8-913b-528e2b215929","source":"wordfence","cve":"CVE-2025-23489","title":"WP-Announcements <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abd70095-7549-41f8-913b-528e2b215929?source=api-prod","affected":[{"type":"plugin","slug":"wp-announcements","name":"WP-Announcements","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:40:52Z"},{"id":"wordfence:abd92465-9f61-4170-9676-e90bbd962c0c","source":"wordfence","cve":"CVE-2024-51909","title":"audioCase <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abd92465-9f61-4170-9676-e90bbd962c0c?source=api-prod","affected":[{"type":"plugin","slug":"audiocase","name":"audioCase","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:38:39Z"},{"id":"wordfence:abda182f-411c-4c77-a1eb-23475e725ba2","source":"wordfence","cve":"CVE-2025-58624","title":"Exchange Rates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abda182f-411c-4c77-a1eb-23475e725ba2?source=api-prod","affected":[{"type":"plugin","slug":"exchange-rates","name":"Exchange Rates","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:39:42Z"},{"id":"wordfence:abdb6632-d579-4650-b058-da10201cca8c","source":"wordfence","cve":"CVE-2024-13465","title":"aBlocks \u2013 WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdb6632-d579-4650-b058-da10201cca8c?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:14Z"},{"id":"wordfence:abdbee50-b8c3-4254-a828-37629a798c92","source":"wordfence","cve":"CVE-2023-27627","title":"Woocommerce Email Report <= 2.4 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdbee50-b8c3-4254-a828-37629a798c92?source=api-prod","affected":[{"type":"plugin","slug":"wooemailreport","name":"Woocommerce Email Report","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abdca93e-f68d-4a96-8bd7-443ee46ccb5a","source":"wordfence","cve":"CVE-2025-2004","title":"Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdca93e-f68d-4a96-8bd7-443ee46ccb5a?source=api-prod","affected":[{"type":"plugin","slug":"simple-wp-events","name":"Simple WP Events","from":"*","from_inclusive":true,"to":"1.8.17","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-04-07T15:52:56Z","updated":"2025-05-23T14:28:29Z"},{"id":"wordfence:abdd0f26-906f-43ac-9524-d072bb7bbf48","source":"wordfence","cve":"CVE-2025-5804","title":"Case Theme User < 1.0.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdd0f26-906f-43ac-9524-d072bb7bbf48?source=api-prod","affected":[{"type":"plugin","slug":"case-theme-user","name":"Case Theme User","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:51:47Z"},{"id":"wordfence:abdd2653-d50c-4eee-9cab-36519fd2b209","source":"wordfence","cve":"CVE-2024-31428","title":"The Conference <= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdd2653-d50c-4eee-9cab-36519fd2b209?source=api-prod","affected":[{"type":"theme","slug":"the-conference","name":"The Conference","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:57:35Z"},{"id":"wordfence:abdd6aaa-830e-4a79-acfb-93dc4a26f599","source":"wordfence","cve":"","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 2.0.14 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abdd6aaa-830e-4a79-acfb-93dc4a26f599?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":false,"patched_in":"2.0.15"}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abe1b727-cd92-43aa-8b6e-e02befa53195","source":"wordfence","cve":"CVE-2025-32254","title":"WPBookit <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe1b727-cd92-43aa-8b6e-e02befa53195?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-04-04T00:00:00Z","updated":"2026-01-07T14:33:43Z"},{"id":"wordfence:abe2de9c-4044-4b52-9ec8-c66691313cf0","source":"wordfence","cve":"CVE-2014-100023","title":"mTouch Quiz < 3.0.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe2de9c-4044-4b52-9ec8-c66691313cf0?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abe2f596-b2c3-49d3-b646-0f4b64f15674","source":"wordfence","cve":"CVE-2023-5337","title":"Contact form Form For All <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe2f596-b2c3-49d3-b646-0f4b64f15674?source=api-prod","affected":[{"type":"plugin","slug":"formforall","name":"Contact form Form For All \u2013 Easy to use, fast, 37 languages.","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abe3cedb-53f3-48ff-a731-df6a83f0da1a","source":"wordfence","cve":"CVE-2024-30422","title":"Elementor Addon Elements <= 1.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe3cedb-53f3-48ff-a731-df6a83f0da1a?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:06:53Z"},{"id":"wordfence:abe50539-f6a9-476a-a408-4f94f7f31fcc","source":"wordfence","cve":"CVE-2023-32503","title":"GTmetrix for WordPress <= 0.4.6 - Reflected Cross-Site Scripting via 'report_id' and 'event_id'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe50539-f6a9-476a-a408-4f94f7f31fcc?source=api-prod","affected":[{"type":"plugin","slug":"gtmetrix-for-wordpress","name":"GTmetrix for WordPress","from":"*","from_inclusive":true,"to":"0.4.6","to_inclusive":true,"patched_in":"0.4.7"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abe6366a-3729-474f-8920-b5ed2eeab906","source":"wordfence","cve":"CVE-2026-12002","title":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe6366a-3729-474f-8920-b5ed2eeab906?source=api-prod","affected":[{"type":"plugin","slug":"instagram-feed","name":"Smash Balloon Social Photo Feed \u2013 Easy Social Feeds Plugin","from":"*","from_inclusive":true,"to":"6.11.1","to_inclusive":true,"patched_in":"6.11.2"}],"published":"2026-07-08T00:00:58Z","updated":"2026-07-08T12:33:16Z"},{"id":"wordfence:abe73ecd-1325-4d6d-8545-d27f6116ca43","source":"wordfence","cve":"CVE-2025-2232","title":"Realteo - Real Estate Plugin by Purethemes <= 1.2.8 - Authentication Bypass via 'do_register_user'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe73ecd-1325-4d6d-8545-d27f6116ca43?source=api-prod","affected":[{"type":"plugin","slug":"realteo","name":"Realteo","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-03-13T22:09:34Z","updated":"2025-03-14T11:15:52Z"},{"id":"wordfence:abe8133e-1407-43b5-a1fc-be800bd2aaca","source":"wordfence","cve":"CVE-2025-23899","title":"Bookalet <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8133e-1407-43b5-a1fc-be800bd2aaca?source=api-prod","affected":[{"type":"plugin","slug":"bookalet","name":"Bookalet","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:06:51Z"},{"id":"wordfence:abe8c6b0-b16b-4391-88b4-dca507c973fc","source":"wordfence","cve":"CVE-2024-12240","title":"Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8c6b0-b16b-4391-88b4-dca507c973fc?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.31.0","to_inclusive":true,"patched_in":"2.31.1"}],"published":"2025-01-13T21:46:56Z","updated":"2025-01-14T11:08:37Z"},{"id":"wordfence:abe8efec-8f00-40bc-bc28-98435d11ebd3","source":"wordfence","cve":"CVE-2022-0376","title":"User Meta <= 2.4.2 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8efec-8f00-40bc-bc28-98435d11ebd3?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abe8fa49-cf09-4738-b449-28a398d869ff","source":"wordfence","cve":"CVE-2026-118241","title":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN < 4.3.6 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe8fa49-cf09-4738-b449-28a398d869ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":false,"patched_in":"4.3.6"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:47Z"},{"id":"wordfence:abe9a8bb-01d6-4291-9dff-4b8a0e744b2e","source":"wordfence","cve":"CVE-2026-121794","title":"Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abe9a8bb-01d6-4291-9dff-4b8a0e744b2e?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2026-11-05T20:35:01Z","updated":"2026-11-06T08:38:08Z"},{"id":"wordfence:abeb13ac-d835-4e02-baaf-30e8dc4bd86b","source":"wordfence","cve":"CVE-2025-69325","title":"Primer MyData for Woocommerce <= 4.2.8 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abeb13ac-d835-4e02-baaf-30e8dc4bd86b?source=api-prod","affected":[{"type":"plugin","slug":"primer-mydata","name":"Primer MyData for Woocommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:10:38Z"},{"id":"wordfence:abebfbc4-37ed-44d5-a35d-d6ad87346f3a","source":"wordfence","cve":"CVE-2026-23546","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.3.4 - Authenticated (Subscriber+) Sensitive Data Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abebfbc4-37ed-44d5-a35d-d6ad87346f3a?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:16:03Z"},{"id":"wordfence:abee822e-b929-435a-86c2-57901424f1a0","source":"wordfence","cve":"CVE-2024-3474","title":"Wow Skype Buttons <= 4.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abee822e-b929-435a-86c2-57901424f1a0?source=api-prod","affected":[{"type":"plugin","slug":"mwp-skype","name":"Wow Skype Buttons","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:07:57Z"},{"id":"wordfence:abef988c-1fd2-45dc-8eac-447b0baad5aa","source":"wordfence","cve":"CVE-2024-49701","title":"Mags <= 1.1.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abef988c-1fd2-45dc-8eac-447b0baad5aa?source=api-prod","affected":[{"type":"theme","slug":"mags","name":"Mags","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:17:59Z"},{"id":"wordfence:abf1ace3-e066-4f28-9f37-3e9fa79aef7d","source":"wordfence","cve":"CVE-2024-2429","title":"Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abf1ace3-e066-4f28-9f37-3e9fa79aef7d?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.6.5","to_inclusive":true,"patched_in":"9.6.6"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:56:35Z"},{"id":"wordfence:abf30bd9-68ad-4204-9b70-8a6766d49ad5","source":"wordfence","cve":"CVE-2025-32169","title":"Showeblogin Social <= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abf30bd9-68ad-4204-9b70-8a6766d49ad5?source=api-prod","affected":[{"type":"plugin","slug":"showeblogin-facebook-page-like-box","name":"Showeblogin Social Plugin","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T14:15:03Z"},{"id":"wordfence:abf422ce-fa03-4bed-a4ec-b31d36de7633","source":"wordfence","cve":"CVE-2023-7306","title":"Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abf422ce-fa03-4bed-a4ec-b31d36de7633?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"21.5","to_inclusive":true,"patched_in":"22.0"}],"published":"2025-07-24T00:00:00Z","updated":"2025-08-05T20:12:35Z"},{"id":"wordfence:abf4cfb9-745a-4b4f-8862-54ef561904d6","source":"wordfence","cve":"CVE-2023-27430","title":"Mass Delete Unused Tags <= 2.0.0 - Cross-Site Request Forgery via plugin_mass_delete_unused_tags_init","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abf4cfb9-745a-4b4f-8862-54ef561904d6?source=api-prod","affected":[{"type":"plugin","slug":"mass-delete-unused-tags","name":"Mass Delete Unused Tags","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:abfa93e3-c07c-409f-87ea-28397af46fac","source":"wordfence","cve":"CVE-2024-11644","title":"WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abfa93e3-c07c-409f-87ea-28397af46fac?source=api-prod","affected":[{"type":"plugin","slug":"wp-svg","name":"WP-SVG","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-10T15:49:45Z"},{"id":"wordfence:abfaa4a6-92b0-4233-b08d-e668090d3fc2","source":"wordfence","cve":"CVE-2026-1321","title":"Membership Plugin \u2013 Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/abfaa4a6-92b0-4233-b08d-e668090d3fc2?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.20","to_inclusive":true,"patched_in":"3.2.21"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-05T07:30:56Z"},{"id":"wordfence:ac004fb0-e178-4e9b-9aa3-b14eab43f22d","source":"wordfence","cve":"CVE-2024-5879","title":"HubSpot \u2013 CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac004fb0-e178-4e9b-9aa3-b14eab43f22d?source=api-prod","affected":[{"type":"plugin","slug":"leadin","name":"HubSpot All-In-One Marketing \u2013 Forms, Popups, Live Chat","from":"*","from_inclusive":true,"to":"11.1.22","to_inclusive":true,"patched_in":"11.1.34"}],"published":"2024-08-29T15:39:03Z","updated":"2024-08-30T04:29:59Z"},{"id":"wordfence:ac005402-0bac-453e-918d-b8a44abeff06","source":"wordfence","cve":"CVE-2022-4757","title":"List Pages Shortcode <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac005402-0bac-453e-918d-b8a44abeff06?source=api-prod","affected":[{"type":"plugin","slug":"list-pages-shortcode","name":"List Pages Shortcode","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac00d82b-4095-4c0c-8b5c-ecff9fa67067","source":"wordfence","cve":"CVE-2025-58233","title":"SQL Chart Builder <= 2.3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac00d82b-4095-4c0c-8b5c-ecff9fa67067?source=api-prod","affected":[{"type":"plugin","slug":"sql-chart-builder","name":"SQL Chart Builder","from":"*","from_inclusive":true,"to":"2.3.7.2","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2025-09-22T00:00:00Z","updated":"2026-07-08T20:44:30Z"},{"id":"wordfence:ac038d9d-f894-4856-affa-8993cf9e0bd3","source":"wordfence","cve":"CVE-2025-59565","title":"Upsell Order Bump Offer for WooCommerce <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac038d9d-f894-4856-affa-8993cf9e0bd3?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:14:37Z"},{"id":"wordfence:ac0455a2-1fa8-4a37-a72f-9ed5cca1d9ee","source":"wordfence","cve":"CVE-2025-14541","title":"Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0455a2-1fa8-4a37-a72f-9ed5cca1d9ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-lucky-wheel","name":"Lucky Wheel Giveaway","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2026-02-10T11:56:58Z","updated":"2026-02-11T01:23:34Z"},{"id":"wordfence:ac05441d-137e-433a-86bd-a702ec664db0","source":"wordfence","cve":"CVE-2026-25311","title":"Autoshare for Twitter <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac05441d-137e-433a-86bd-a702ec664db0?source=api-prod","affected":[{"type":"plugin","slug":"autoshare-for-twitter","name":"Autopost for X (formerly Autoshare for Twitter)","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-01-22T00:00:00Z","updated":"2026-05-04T15:18:53Z"},{"id":"wordfence:ac064674-35da-4a25-ad7e-96a7370c175f","source":"wordfence","cve":"CVE-2026-84027","title":"Directorist 8.9.1 - 8.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac064674-35da-4a25-ad7e-96a7370c175f?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"8.9.1","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:49:35Z"},{"id":"wordfence:ac06b9d9-51de-4f7a-87b8-c7b46a8475ee","source":"wordfence","cve":"CVE-2022-1580","title":"Site Offline <= 1.4.9 - Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac06b9d9-51de-4f7a-87b8-c7b46a8475ee?source=api-prod","affected":[{"type":"plugin","slug":"site-offline","name":"Site Offline Or Coming Soon Or Maintenance Mode","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac07cc53-311d-465e-a00f-8aa37fec2ad9","source":"wordfence","cve":"CVE-2025-24653","title":"Admin and Site Enhancements (ASE) Pro <= 7.6.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac07cc53-311d-465e-a00f-8aa37fec2ad9?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements-pro","name":"Admin and Site Enhancements (ASE) Pro","from":"*","from_inclusive":true,"to":"7.6.1.1","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:24:41Z"},{"id":"wordfence:ac08bd5c-3bcf-44e8-8555-d30fdf073dba","source":"wordfence","cve":"CVE-2025-49413","title":"Terms of Service & Privacy Policy Generator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac08bd5c-3bcf-44e8-8555-d30fdf073dba?source=api-prod","affected":[{"type":"plugin","slug":"terms-of-service-and-privacy-policy","name":"Terms of Service & Privacy Policy Generator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:10:21Z"},{"id":"wordfence:ac09bf3e-49cf-4f11-92ba-d1fbf6f587d7","source":"wordfence","cve":"CVE-2026-19807","title":"ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac09bf3e-49cf-4f11-92ba-d1fbf6f587d7?source=api-prod","affected":[{"type":"plugin","slug":"bcs-mcp-manager","name":"ByteCoreStack \u2013 MCP Connector for AI Tools","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-30T19:31:11Z","updated":"2026-10-01T07:40:24Z"},{"id":"wordfence:ac0abf8e-6efd-4cf5-ad03-8442d892a35f","source":"wordfence","cve":"CVE-2026-6640","title":"Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0abf8e-6efd-4cf5-ad03-8442d892a35f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"3.36"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-11T07:39:08Z"},{"id":"wordfence:ac0b8c10-50d5-428c-8bce-0d9912a6c46d","source":"wordfence","cve":"CVE-2025-25135","title":"Custom Links On Admin Dashboard Toolbar <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0b8c10-50d5-428c-8bce-0d9912a6c46d?source=api-prod","affected":[{"type":"plugin","slug":"customize-wpadmin","name":"Custom Links On Admin Dashboard Toolbar","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:15:15Z"},{"id":"wordfence:ac0dfaac-cce6-45f7-ad5b-d7dcb66453bd","source":"wordfence","cve":"CVE-2024-2305","title":"Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0dfaac-cce6-45f7-ad5b-d7dcb66453bd?source=api-prod","affected":[{"type":"plugin","slug":"bb-bootstrap-cards","name":"Cards for Beaver Builder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-03-21T00:00:00Z","updated":"2024-07-31T15:54:10Z"},{"id":"wordfence:ac1037b7-f822-447a-a4b5-d02ed6b70176","source":"wordfence","cve":"CVE-2025-49882","title":"CubeWP Framework <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1037b7-f822-447a-a4b5-d02ed6b70176?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.24"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:59:42Z"},{"id":"wordfence:ac106300-c351-483d-8877-502a4b02941c","source":"wordfence","cve":"CVE-2026-27060","title":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac106300-c351-483d-8877-502a4b02941c?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2026-06-30T00:00:00Z","updated":"2026-08-17T04:09:37Z"},{"id":"wordfence:ac10b30d-1fe3-46f4-a4fc-fa2acd7f9db4","source":"wordfence","cve":"CVE-2023-37968","title":"Falang multilanguage <= 1.3.39 - Cross-Site Request Forgery via add_language","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac10b30d-1fe3-46f4-a4fc-fa2acd7f9db4?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.39","to_inclusive":true,"patched_in":"1.3.40"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac111175-2059-41dc-afa2-a659da3adaca","source":"wordfence","cve":"CVE-2023-49164","title":"Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac111175-2059-41dc-afa2-a659da3adaca?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac11bd41-d6bf-47e7-87a7-b45d7cb80639","source":"wordfence","cve":"CVE-2026-57753","title":"Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac11bd41-d6bf-47e7-87a7-b45d7cb80639?source=api-prod","affected":[{"type":"plugin","slug":"convertkit-for-woocommerce","name":"Kit (formerly ConvertKit) for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-17T20:28:26Z"},{"id":"wordfence:ac1239c9-72a6-44d8-911f-70a528c66c62","source":"wordfence","cve":"CVE-2023-23682","title":"EZP Maintenance Mode <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1239c9-72a6-44d8-911f-70a528c66c62?source=api-prod","affected":[{"type":"plugin","slug":"easy-pie-maintenance-mode","name":"EZP Maintenance Mode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2025-07-29T06:39:25Z"},{"id":"wordfence:ac1254a4-93c5-43a4-bac5-efe462139b4e","source":"wordfence","cve":"CVE-2026-94246","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1254a4-93c5-43a4-bac5-efe462139b4e?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:32:40Z"},{"id":"wordfence:ac1257a9-7c8e-43aa-b21a-93a77b456aa4","source":"wordfence","cve":"CVE-2026-8778","title":"MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1257a9-7c8e-43aa-b21a-93a77b456aa4?source=api-prod","affected":[{"type":"plugin","slug":"mipl-wc-checkout-fields","name":"MIPL Checkout Fields Manager for WooCommerce \u2013 Customize, Organize & Group Checkout Fields.","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-09-10T14:37:18Z","updated":"2026-09-11T03:39:37Z"},{"id":"wordfence:ac13f402-8a36-448f-87d4-48179a9699c6","source":"wordfence","cve":"CVE-2024-1288","title":"Schema & Structured Data for WP & AMP <= 1.26 - Missing Authorization to reCaptcha Key Modification","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac13f402-8a36-448f-87d4-48179a9699c6?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.27"}],"published":"2024-02-19T00:00:00Z","updated":"2024-07-31T15:40:44Z"},{"id":"wordfence:ac1493dc-a90a-4427-a631-af5da65e1d6c","source":"wordfence","cve":"CVE-2026-2030","title":"WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1493dc-a90a-4427-a631-af5da65e1d6c?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:34:39Z","updated":"2026-09-11T13:16:24Z"},{"id":"wordfence:ac167257-c34e-45a2-8647-ed5cdb8dd64d","source":"wordfence","cve":"CVE-2024-43918","title":"WBW Product Table Pro <= 1.9.4 - Unauthenticated Arbitrary SQL Execution","severity":"critical","cvss":10.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac167257-c34e-45a2-8647-ed5cdb8dd64d?source=api-prod","affected":[{"type":"plugin","slug":"woo-producttables-pro","name":"WBW Product Table Pro","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-28T23:31:30Z"},{"id":"wordfence:ac176fdf-3ebc-47b3-8404-c2423d141029","source":"wordfence","cve":"CVE-2025-28952","title":"CubePoints <= 3.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac176fdf-3ebc-47b3-8404-c2423d141029?source=api-prod","affected":[{"type":"plugin","slug":"cubepoints","name":"CubePoints","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:03:38Z"},{"id":"wordfence:ac18b418-ac7d-4cc3-b377-43e5a23b39ed","source":"wordfence","cve":"CVE-2025-23865","title":"Winning Portfolio <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac18b418-ac7d-4cc3-b377-43e5a23b39ed?source=api-prod","affected":[{"type":"plugin","slug":"winning-portfolio","name":"Winning Portfolio","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:38:45Z"},{"id":"wordfence:ac1c4818-6384-48cf-a1e3-a8ced6884749","source":"wordfence","cve":"CVE-2022-1653","title":"Social Share Buttons by Supsystic <= 2.2.3 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1c4818-6384-48cf-a1e3-a8ced6884749?source=api-prod","affected":[{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac1f9d9c-4d4e-4036-95b1-50d09b5cac7c","source":"wordfence","cve":"","title":"ThisWay <= 1.7.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1f9d9c-4d4e-4036-95b1-50d09b5cac7c?source=api-prod","affected":[{"type":"theme","slug":"thisway","name":"ThisWay","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2013-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac1fb279-df40-467e-a336-fa67468c2b78","source":"wordfence","cve":"CVE-2024-43148","title":"StreamCast <= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac1fb279-df40-467e-a336-fa67468c2b78?source=api-prod","affected":[{"type":"plugin","slug":"streamcast","name":"StreamCast \u2013 bring live radio to your site with a sleek player","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:52:05Z"},{"id":"wordfence:ac200da9-6a02-416a-aeb2-344eba4fcc3e","source":"wordfence","cve":"CVE-2025-48138","title":"BERTHA AI <= 1.12.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac200da9-6a02-416a-aeb2-344eba4fcc3e?source=api-prod","affected":[{"type":"plugin","slug":"bertha-ai-free","name":"BERTHA AI. Your AI co-pilot for WordPress and Chrome","from":"*","from_inclusive":true,"to":"1.12.11","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:45:37Z"},{"id":"wordfence:ac20b454-a5e5-4ff6-a5bf-9c3c339321d8","source":"wordfence","cve":"CVE-2023-44259","title":"Mediavine Control Panel <= 2.10.2 - Cross-Site Request Forgery via render_settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac20b454-a5e5-4ff6-a5bf-9c3c339321d8?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-control-panel","name":"Mediavine Control Panel","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0","source":"wordfence","cve":"CVE-2025-9898","title":"cForms \u2013 Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0?source=api-prod","affected":[{"type":"plugin","slug":"cforms-plugin","name":"cForms \u2013 Light speed fast Form Builder","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:34:41Z","updated":"2025-09-27T06:47:15Z"},{"id":"wordfence:ac23c688-b3d7-4844-ac94-0cbd798bce4c","source":"wordfence","cve":"CVE-2024-12716","title":"Simple Basic Contact Form <= 20240511 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23c688-b3d7-4844-ac94-0cbd798bce4c?source=api-prod","affected":[{"type":"plugin","slug":"simple-basic-contact-form","name":"Simple Basic Contact Form","from":"*","from_inclusive":true,"to":"20240511","to_inclusive":true,"patched_in":"20250114"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T17:58:16Z"},{"id":"wordfence:ac23cd7d-193d-4fa1-8c1c-79ca92da98d7","source":"wordfence","cve":"CVE-2025-22736","title":"User Management <= 1.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23cd7d-193d-4fa1-8c1c-79ca92da98d7?source=api-prod","affected":[{"type":"plugin","slug":"user-management","name":"User Management","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2025-01-14T00:00:00Z","updated":"2026-08-14T15:13:15Z"},{"id":"wordfence:ac245316-228e-4508-b3fe-f7071fb1bc8e","source":"wordfence","cve":"CVE-2025-8680","title":"B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-08-14T14:02:06Z","updated":"2025-08-15T02:24:23Z"},{"id":"wordfence:ac247d3a-9e60-431e-ac98-2601e9907758","source":"wordfence","cve":"CVE-2024-7574","title":"Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac247d3a-9e60-431e-ac98-2601e9907758?source=api-prod","affected":[{"type":"plugin","slug":"christmasify","name":"Christmasify!","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-10T05:37:27Z"},{"id":"wordfence:ac24a4ea-8cc6-4aa0-b9e4-7d95a10186a4","source":"wordfence","cve":"CVE-2026-120532","title":"wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac24a4ea-8cc6-4aa0-b9e4-7d95a10186a4?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-11-06T21:20:24Z","updated":"2026-11-07T09:25:48Z"},{"id":"wordfence:ac27f20a-2048-46f3-b84f-43e2d4a345d2","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac27f20a-2048-46f3-b84f-43e2d4a345d2?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac2b2862-a56c-456e-a621-8b10b30235be","source":"wordfence","cve":"CVE-2026-18943","title":"WPC Admin Columns <= 2.3.3 - Information Exposure to Authenticated (Subscriber+) Arbitrary User/Post/Term Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac2b2862-a56c-456e-a621-8b10b30235be?source=api-prod","affected":[{"type":"plugin","slug":"wpc-admin-columns","name":"WPC Admin Columns","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:49:42Z"},{"id":"wordfence:ac2f6549-016f-494d-99a4-52a1527f1fd2","source":"wordfence","cve":"CVE-2025-8604","title":"WP Table Builder \u2013 WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac2f6549-016f-494d-99a4-52a1527f1fd2?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2025-08-14T19:13:09Z","updated":"2025-08-15T07:24:41Z"},{"id":"wordfence:ac34e369-de9e-4b13-8858-0b4300aef5f8","source":"wordfence","cve":"CVE-2025-5930","title":"WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac34e369-de9e-4b13-8858-0b4300aef5f8?source=api-prod","affected":[{"type":"plugin","slug":"wp2html","name":"WP2HTML","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-06-12T13:08:43Z","updated":"2025-10-21T21:09:02Z"},{"id":"wordfence:ac352bb2-f624-4c31-951a-988a0b420635","source":"wordfence","cve":"","title":"Simple Social Media Share Buttons <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac352bb2-f624-4c31-951a-988a0b420635?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2020-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac37afa3-c841-44b5-9722-952c4258841d","source":"wordfence","cve":"CVE-2024-4533","title":"KKProgressbar2 Free <= 1.1.4.2 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac37afa3-c841-44b5-9722-952c4258841d?source=api-prod","affected":[{"type":"plugin","slug":"kkprogressbar","name":"KKProgressbar2 Free \u2013 advanced progress bars","from":"*","from_inclusive":true,"to":"1.1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:29:55Z"},{"id":"wordfence:ac381ed7-ff6a-4fbc-965b-80f3804b3c5f","source":"wordfence","cve":"CVE-2022-29416","title":"Afterpay Gateway for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac381ed7-ff6a-4fbc-965b-80f3804b3c5f?source=api-prod","affected":[{"type":"plugin","slug":"afterpay-gateway-for-woocommerce","name":"Afterpay Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac3a359c-bdcf-42c5-9e54-c704a358b561","source":"wordfence","cve":"CVE-2015-4010","title":"Encrypted Contact Form < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3a359c-bdcf-42c5-9e54-c704a358b561?source=api-prod","affected":[{"type":"plugin","slug":"encrypted-contact-form","name":"Encrypted Contact Form","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2015-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac3a7732-c076-4418-b44a-748cc5668107","source":"wordfence","cve":"","title":"Discount Rules for WooCommerce <= 2.2.0 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3a7732-c076-4418-b44a-748cc5668107?source=api-prod","affected":[{"type":"plugin","slug":"woo-discount-rules","name":"Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2020-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac3e048d-9ebd-41c2-9dbd-751adae10380","source":"wordfence","cve":"CVE-2026-118050","title":"Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3e048d-9ebd-41c2-9dbd-751adae10380?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.13.5","to_inclusive":true,"patched_in":"2.13.6"}],"published":"2026-11-06T21:47:05Z","updated":"2026-11-07T11:26:33Z"},{"id":"wordfence:ac3fbecc-43c5-42da-85c9-8a732be71503","source":"wordfence","cve":"CVE-2026-56053","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac3fbecc-43c5-42da-85c9-8a732be71503?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.4.1","to_inclusive":true,"patched_in":"4.3.4.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:00:15Z"},{"id":"wordfence:ac402867-baa3-412c-b5de-c01e6a790ded","source":"wordfence","cve":"CVE-2013-0721","title":"WP PHP Widget <= 1.0.2 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac402867-baa3-412c-b5de-c01e6a790ded?source=api-prod","affected":[{"type":"plugin","slug":"wp-php-widget","name":"WP PHP widget","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac41a122-9a17-45a0-9ba7-2790a07ac466","source":"wordfence","cve":"CVE-2024-47298","title":"Bold Page Builder <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac41a122-9a17-45a0-9ba7-2790a07ac466?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:43:45Z"},{"id":"wordfence:ac41d3a8-130a-4f29-915f-e797697f9fba","source":"wordfence","cve":"CVE-2026-100510","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.27.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac41d3a8-130a-4f29-915f-e797697f9fba?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.14","to_inclusive":true,"patched_in":"1.27.15"}],"published":"2026-09-30T13:23:09Z","updated":"2026-10-08T23:08:33Z"},{"id":"wordfence:ac422162-be05-4420-9877-d6d41b83e881","source":"wordfence","cve":"CVE-2025-1312","title":"Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T11:22:11Z"},{"id":"wordfence:ac45cc6c-b5e8-4ef5-960b-8c89ca092a6c","source":"wordfence","cve":"CVE-2026-120858","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac45cc6c-b5e8-4ef5-960b-8c89ca092a6c?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.16","to_inclusive":true,"patched_in":"6.2.17"}],"published":"2026-11-06T15:26:36Z","updated":"2026-11-10T19:42:09Z"},{"id":"wordfence:ac45d8fe-4b79-4b2c-998e-e51da7a37e40","source":"wordfence","cve":"","title":"Custom Community 2.0 - 2.0.24 - Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac45d8fe-4b79-4b2c-998e-e51da7a37e40?source=api-prod","affected":[{"type":"theme","slug":"custom-community","name":"Custom Community","from":"2.0","from_inclusive":true,"to":"2.0.25","to_inclusive":false,"patched_in":"2.0.25"}],"published":"2015-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac47ccff-6e36-4bc2-b7f3-70deb3d8b3b7","source":"wordfence","cve":"CVE-2025-47674","title":"Credova_Financial <= 2.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac47ccff-6e36-4bc2-b7f3-70deb3d8b3b7?source=api-prod","affected":[{"type":"plugin","slug":"credova-financial","name":"Credova Financial","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-29T21:44:57Z"},{"id":"wordfence:ac48e900-1e3e-4e97-8351-da1923fc1809","source":"wordfence","cve":"CVE-2025-59130","title":"Appointify <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac48e900-1e3e-4e97-8351-da1923fc1809?source=api-prod","affected":[{"type":"plugin","slug":"appointify","name":"Appointify","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:20:04Z"},{"id":"wordfence:ac4a026b-ed1c-4864-8900-1d70d95af6f4","source":"wordfence","cve":"CVE-2024-13424","title":"Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4a026b-ed1c-4864-8900-1d70d95af6f4?source=api-prod","affected":[{"type":"plugin","slug":"ni-woo-sales-commission","name":"Ni Sales Commission For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T16:50:47Z","updated":"2025-01-31T05:22:38Z"},{"id":"wordfence:ac4c6bd8-179f-4553-b1b4-549300bae374","source":"wordfence","cve":"CVE-2007-3543","title":"WordPress Core <= 2.2 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4c6bd8-179f-4553-b1b4-549300bae374?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac4de440-a446-4b96-ba9b-115e3186ce1c","source":"wordfence","cve":"CVE-2019-1010104","title":"Quick Chat <= 4.14 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4de440-a446-4b96-ba9b-115e3186ce1c?source=api-prod","affected":[{"type":"plugin","slug":"quick-chat","name":"Quick Chat","from":"*","from_inclusive":true,"to":"4.14","to_inclusive":true,"patched_in":""}],"published":"2018-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac4ebdd1-f28a-4b88-bd92-5d0e9cce6790","source":"wordfence","cve":"CVE-2026-32368","title":"Geo to Lat <= 1.0.19 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4ebdd1-f28a-4b88-bd92-5d0e9cce6790?source=api-prod","affected":[{"type":"plugin","slug":"geo-to-lat","name":"Geo to Lat","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-02-16T00:00:00Z","updated":"2026-04-15T20:51:57Z"},{"id":"wordfence:ac4f9453-f3d9-4ef5-8c4e-1d51ad194342","source":"wordfence","cve":"CVE-2024-38744","title":"Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4f9453-f3d9-4ef5-8c4e-1d51ad194342?source=api-prod","affected":[{"type":"plugin","slug":"qodeblock","name":"Plum: Spin Wheel & Email Pop-up","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:28:15Z"},{"id":"wordfence:ac5012f2-3518-41c0-befe-597008f22152","source":"wordfence","cve":"CVE-2024-13855","title":"Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5012f2-3518-41c0-befe-597008f22152?source=api-prod","affected":[{"type":"plugin","slug":"prime-addons-for-elementor","name":"Prime Addons for Elementor","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-02-19T21:08:18Z","updated":"2025-03-13T19:48:15Z"},{"id":"wordfence:ac532bb8-9190-4091-898e-fe23c855164d","source":"wordfence","cve":"CVE-2025-57942","title":"Emergency Password Reset <= 9.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac532bb8-9190-4091-898e-fe23c855164d?source=api-prod","affected":[{"type":"plugin","slug":"emergency-password-reset","name":"Emergency password reset","from":"*","from_inclusive":true,"to":"9.3","to_inclusive":true,"patched_in":"9.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-24T19:38:25Z"},{"id":"wordfence:ac53ade6-b654-4169-a50a-96b3de3d108d","source":"wordfence","cve":"CVE-2026-18881","title":"TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac53ade6-b654-4169-a50a-96b3de3d108d?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-08-04T18:28:30Z","updated":"2026-08-05T06:37:59Z"},{"id":"wordfence:ac53af7e-0c50-413c-90de-0d50d5c17463","source":"wordfence","cve":"CVE-2025-27010","title":"Tastyc < 2.5.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac53af7e-0c50-413c-90de-0d50d5c17463?source=api-prod","affected":[{"type":"theme","slug":"tastyc","name":"Tastyc - Cafe Restaurant Theme","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T18:47:14Z"},{"id":"wordfence:ac53f2b6-85fe-4475-975f-6dbd15fa87f4","source":"wordfence","cve":"CVE-2025-32583","title":"PDF 2 Post <= 2.4.0 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac53f2b6-85fe-4475-975f-6dbd15fa87f4?source=api-prod","affected":[{"type":"plugin","slug":"pdf2post","name":"PDF 2 Post","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-22T19:13:24Z"},{"id":"wordfence:ac5549ec-f931-4b13-b5f9-0d6f3e53aae4","source":"wordfence","cve":"CVE-2022-4171","title":"demon image annotation <= 5.0 - Improper Input Restriction Validation","severity":"medium","cvss":6.5,"cwe":"CWE-1284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5549ec-f931-4b13-b5f9-0d6f3e53aae4?source=api-prod","affected":[{"type":"plugin","slug":"demon-image-annotation","name":"demon image annotation","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2022-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac55e988-2b41-459b-9ab1-e5f9fdca203f","source":"wordfence","cve":"CVE-2024-12560","title":"Button Block \u2013 Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac55e988-2b41-459b-9ab1-e5f9fdca203f?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-12-18T00:00:00Z","updated":"2024-12-19T07:05:47Z"},{"id":"wordfence:ac5d941c-f16c-4ba0-9981-65c527302c46","source":"wordfence","cve":"CVE-2024-51926","title":"GreenCon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5d941c-f16c-4ba0-9981-65c527302c46?source=api-prod","affected":[{"type":"plugin","slug":"greencon","name":"GreenCon \u2013 Table, Listing, Marketing builder for Gutenberg","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:30:53Z"},{"id":"wordfence:ac5f5093-a0c6-43bd-8e89-7fe5d90a779b","source":"wordfence","cve":"CVE-2026-57377","title":"Product Addons and Product Options With Custom Fields \u2013 WowAddons <= 1.6.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5f5093-a0c6-43bd-8e89-7fe5d90a779b?source=api-prod","affected":[{"type":"plugin","slug":"product-addons","name":"WowAddons \u2013 Product Addons and Product Options With Custom Fields","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:50:05Z"},{"id":"wordfence:ac6201a1-7ca9-461b-b9ad-16407120dfae","source":"wordfence","cve":"CVE-2023-6497","title":"WordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6201a1-7ca9-461b-b9ad-16407120dfae?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:37:08Z"},{"id":"wordfence:ac63e451-2ab3-4ca9-bb69-a0ef04fef3a9","source":"wordfence","cve":"CVE-2014-9395","title":"Simplelife Plugin <= 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac63e451-2ab3-4ca9-bb69-a0ef04fef3a9?source=api-prod","affected":[{"type":"plugin","slug":"simplelife","name":"Simplelife","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac6432a4-6597-4d1e-b63d-c007a301d1b2","source":"wordfence","cve":"CVE-2025-12640","title":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6432a4-6597-4d1e-b63d-c007a301d1b2?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-01-07T14:21:03Z","updated":"2026-01-08T02:21:17Z"},{"id":"wordfence:ac64371c-9f91-4875-a5e3-9b0f4460acd9","source":"wordfence","cve":"CVE-2026-94267","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac64371c-9f91-4875-a5e3-9b0f4460acd9?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.8","to_inclusive":false,"patched_in":"0.9.2.8"},{"type":"plugin","slug":"acf-extended-pro","name":"Advanced Custom Fields: Extended PRO","from":"*","from_inclusive":true,"to":"0.9.2.8","to_inclusive":false,"patched_in":"0.9.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:49:52Z"},{"id":"wordfence:ac646ea3-f5e5-4fe9-8e43-ceabbf3f3cc5","source":"wordfence","cve":"CVE-2024-2739","title":"Advance Search <= 1.1.6 - Cross-Site Request Forgery to Shortcode Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac646ea3-f5e5-4fe9-8e43-ceabbf3f3cc5?source=api-prod","affected":[{"type":"plugin","slug":"advance-search","name":"Advanced Search","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-23T15:34:47Z"},{"id":"wordfence:ac6c6ce4-9944-4c8e-89aa-6a2e870ef205","source":"wordfence","cve":"CVE-2022-4710","title":"Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6c6ce4-9944-4c8e-89aa-6a2e870ef205?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac6e587c-59b2-4f93-ab88-5e548b52db45","source":"wordfence","cve":"CVE-2024-0611","title":"Master Slider \u2013 Responsive Touch Slider <= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6e587c-59b2-4f93-ab88-5e548b52db45?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.10"}],"published":"2024-03-01T00:00:00Z","updated":"2024-09-30T14:45:27Z"},{"id":"wordfence:ac6e7029-c0eb-45b1-b8c0-135d5db84ace","source":"wordfence","cve":"CVE-2025-22695","title":"Nirweb support <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6e7029-c0eb-45b1-b8c0-135d5db84ace?source=api-prod","affected":[{"type":"plugin","slug":"nirweb-support","name":"Nirweb support","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:40:36Z"},{"id":"wordfence:ac6f78a9-8fb0-4ea0-b02e-a0748723dca8","source":"wordfence","cve":"CVE-2026-32562","title":"PPWP \u2013 Password Protect Pages <= 1.9.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6f78a9-8fb0-4ea0-b02e-a0748723dca8?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.15","to_inclusive":true,"patched_in":"1.9.16"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:05:31Z"},{"id":"wordfence:ac6f7b03-6527-4d10-9320-4f94ed386f54","source":"wordfence","cve":"CVE-2015-2062","title":"Responsive Slider \u2013 Image Slider \u2013 Slideshow for WordPress < 2.7.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6f7b03-6527-4d10-9320-4f94ed386f54?source=api-prod","affected":[{"type":"plugin","slug":"slider-image","name":"Responsive Slider \u2013 Image Slider \u2013 Slideshow for WordPress","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2015-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac702c3b-01d6-40ef-a18c-380185667a98","source":"wordfence","cve":"CVE-2025-48145","title":"Track, Analyze &amp; Optimize by WP Tao <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac702c3b-01d6-40ef-a18c-380185667a98?source=api-prod","affected":[{"type":"plugin","slug":"wp-tao","name":"Track, Analyze & Optimize by WP Tao","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-25T14:10:14Z"},{"id":"wordfence:ac709779-36f1-4f66-8db3-95a514a5ea59","source":"wordfence","cve":"CVE-2023-6583","title":"Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.24.2","to_inclusive":true,"patched_in":"1.24.3"}],"published":"2023-12-08T00:00:00Z","updated":"2024-07-29T21:37:08Z"},{"id":"wordfence:ac7263c6-1c87-4747-869d-1aaeffa00d54","source":"wordfence","cve":"CVE-2025-26980","title":"Wired Impact Volunteer Management <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7263c6-1c87-4747-869d-1aaeffa00d54?source=api-prod","affected":[{"type":"plugin","slug":"wired-impact-volunteer-management","name":"Wired Impact Volunteer Management","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:16:52Z"},{"id":"wordfence:ac763936-7147-4100-8a46-4c6d2f2224b4","source":"wordfence","cve":"CVE-2023-5114","title":"idbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac763936-7147-4100-8a46-4c6d2f2224b4?source=api-prod","affected":[{"type":"plugin","slug":"idbbee","name":"idbbee","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-30T00:00:00Z","updated":"2025-12-02T14:27:59Z"},{"id":"wordfence:ac799e11-2f7b-43c2-88da-e77c075a958f","source":"wordfence","cve":"CVE-2024-39664","title":"Filter & Grids <= 2.8.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac799e11-2f7b-43c2-88da-e77c075a958f?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"2.8.33","to_inclusive":true,"patched_in":"2.8.34"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:08:04Z"},{"id":"wordfence:ac7a9adb-4ba1-4194-8218-e81a0fc9b93b","source":"wordfence","cve":"CVE-2021-34627","title":"WP Upload Restriction <= 2.2.4 - Missing Authorization Checks","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7a9adb-4ba1-4194-8218-e81a0fc9b93b?source=api-prod","affected":[{"type":"plugin","slug":"wp-upload-restriction","name":"WP Upload Restriction","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2021-07-02T15:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac7aca5f-657d-45a9-bb10-f3e75dc3eeba","source":"wordfence","cve":"CVE-2021-24294","title":"DSGVO All in one for WP <= 3.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7aca5f-657d-45a9-bb10-f3e75dc3eeba?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac7aeb6a-4e41-4301-8e79-ffe1468c0940","source":"wordfence","cve":"CVE-2025-13961","title":"Data Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7aeb6a-4e41-4301-8e79-ffe1468c0940?source=api-prod","affected":[{"type":"plugin","slug":"data-visualizer","name":"Data Visualizer","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:23:45Z","updated":"2025-12-12T03:20:53Z"},{"id":"wordfence:ac7af0d3-ccd3-4657-a7f2-0974286f0f73","source":"wordfence","cve":"CVE-2026-94078","title":"Site Reviews <= 8.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7af0d3-ccd3-4657-a7f2-0974286f0f73?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":true,"patched_in":"8.3.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:36:37Z"},{"id":"wordfence:ac7c0dde-5299-4938-beed-eb2fe227a812","source":"wordfence","cve":"","title":"SpeedyCache <= 1.1.2 - Missing Authorization via speedycache_create_test_cache","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7c0dde-5299-4938-beed-eb2fe227a812?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac7d08e6-b04d-4b8c-af43-1abe8b531f7c","source":"wordfence","cve":"CVE-2026-15930","title":"Simple Membership <= 4.7.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7d08e6-b04d-4b8c-af43-1abe8b531f7c?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:31:39Z"},{"id":"wordfence:ac7d6023-335c-45ce-a87b-0bd476b251d9","source":"wordfence","cve":"CVE-2024-54404","title":"MDC Comment Toolbar <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7d6023-335c-45ce-a87b-0bd476b251d9?source=api-prod","affected":[{"type":"plugin","slug":"mdc-comment-toolbar","name":"MDC Comment Toolbar","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:41:02Z"},{"id":"wordfence:ac7f95c7-2159-4327-ba09-da7721f1312e","source":"wordfence","cve":"CVE-2024-8317","title":"WP AdCenter \u2013 Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7f95c7-2159-4327-ba09-da7721f1312e?source=api-prod","affected":[{"type":"plugin","slug":"wpadcenter","name":"WP AdCenter \u2013 Ad Manager & Adsense Ads","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2024-09-05T18:12:07Z","updated":"2024-09-06T06:50:54Z"},{"id":"wordfence:ac805f12-a7fc-4a04-8779-09e6096f4400","source":"wordfence","cve":"CVE-2026-16977","title":"Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac805f12-a7fc-4a04-8779-09e6096f4400?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.44","to_inclusive":true,"patched_in":"1.15.45"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:50:06Z"},{"id":"wordfence:ac817587-1403-46e2-84bf-be5fcadc5425","source":"wordfence","cve":"CVE-2026-104899","title":"GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac817587-1403-46e2-84bf-be5fcadc5425?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.187","to_inclusive":true,"patched_in":"2.8.188"}],"published":"2026-10-09T17:09:20Z","updated":"2026-10-10T05:31:03Z"},{"id":"wordfence:ac8214af-00d0-4dde-a3e7-f657decc4b93","source":"wordfence","cve":"CVE-2021-24339","title":"Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac8214af-00d0-4dde-a3e7-f657decc4b93?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.4.4.2","from_inclusive":true,"to":"2.7.26","to_inclusive":true,"patched_in":"2.7.27"}],"published":"2021-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac856b65-2ac5-4627-b12d-86aec62e58d6","source":"wordfence","cve":"CVE-2024-49655","title":"ARPrice <= 4.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac856b65-2ac5-4627-b12d-86aec62e58d6?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-03T00:00:00Z","updated":"2026-03-17T21:20:37Z"},{"id":"wordfence:ac86043d-caf9-4c25-86b2-0e063c21b2d7","source":"wordfence","cve":"CVE-2021-44777","title":"Email Tracker <= 5.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac86043d-caf9-4c25-86b2-0e063c21b2d7?source=api-prod","affected":[{"type":"plugin","slug":"email-tracker","name":"Email Tracker","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2021-11-01T20:42:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac877f4f-d99c-4cd0-b438-916255a11b8a","source":"wordfence","cve":"CVE-2024-35638","title":"ActiveDEMAND <= 0.2.43 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac877f4f-d99c-4cd0-b438-916255a11b8a?source=api-prod","affected":[{"type":"plugin","slug":"activedemand","name":"ActiveDEMAND","from":"*","from_inclusive":true,"to":"0.2.43","to_inclusive":true,"patched_in":"0.2.44"}],"published":"2024-05-30T00:00:00Z","updated":"2024-07-01T14:57:06Z"},{"id":"wordfence:ac87819d-0ba3-4c30-ae35-e933f7e250a4","source":"wordfence","cve":"CVE-2024-29793","title":"MailChimp Forms by MailMunch <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac87819d-0ba3-4c30-ae35-e933f7e250a4?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:08:32Z"},{"id":"wordfence:ac897ade-1bf0-41f2-b304-456817e66ce5","source":"wordfence","cve":"CVE-2025-60101","title":"Woostify <= 2.4.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac897ade-1bf0-41f2-b304-456817e66ce5?source=api-prod","affected":[{"type":"theme","slug":"woostify","name":"Woostify","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-06-01T20:35:38Z"},{"id":"wordfence:ac8a06f5-4560-401c-b762-5422b624ba84","source":"wordfence","cve":"CVE-2024-47377","title":"BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac8a06f5-4560-401c-b762-5422b624ba84?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":"2.8.13"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:33:13Z"},{"id":"wordfence:ac8a8698-0f8d-4204-8539-ce129d98b2b4","source":"wordfence","cve":"CVE-2021-24443","title":"Youzify <= 1.0.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac8a8698-0f8d-4204-8539-ce129d98b2b4?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac909a4b-d949-42eb-871a-963bc6242c12","source":"wordfence","cve":"CVE-2026-2948","title":"Gutenverse \u2013 Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac909a4b-d949-42eb-871a-963bc6242c12?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-05-04T14:51:49Z","updated":"2026-05-05T03:37:37Z"},{"id":"wordfence:ac92ef52-964a-4c42-8d78-f9907f1adeee","source":"wordfence","cve":"CVE-2026-119503","title":"Welcart e-Commerce <= 2.12.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac92ef52-964a-4c42-8d78-f9907f1adeee?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":true,"patched_in":"2.12.7"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:54:01Z"},{"id":"wordfence:ac96d3c5-1409-47f7-9e8e-0c35aa8199ce","source":"wordfence","cve":"CVE-2023-27421","title":"Everest News <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac96d3c5-1409-47f7-9e8e-0c35aa8199ce?source=api-prod","affected":[{"type":"theme","slug":"everest-news","name":"Everest News","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ac97c729-4c75-429b-bbf2-27ca322be1cf","source":"wordfence","cve":"CVE-2026-0604","title":"FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac97c729-4c75-429b-bbf2-27ca322be1cf?source=api-prod","affected":[{"type":"plugin","slug":"fastdup","name":"FastDup \u2013 Fastest WordPress Migration & Duplicator","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-01-05T14:50:03Z","updated":"2026-01-06T03:21:39Z"},{"id":"wordfence:ac9a3848-f486-475b-b2c7-ea1007bb30d3","source":"wordfence","cve":"CVE-2025-3766","title":"Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9a3848-f486-475b-b2c7-ea1007bb30d3?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2025-05-06T16:12:15Z","updated":"2025-05-07T04:22:55Z"},{"id":"wordfence:ac9c676b-e15b-4052-9d93-e4185a49afe5","source":"wordfence","cve":"CVE-2026-24624","title":"Neoforum <= 1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9c676b-e15b-4052-9d93-e4185a49afe5?source=api-prod","affected":[{"type":"plugin","slug":"neoforum","name":"Neoforum","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T14:46:46Z","updated":"2026-02-03T13:47:39Z"},{"id":"wordfence:ac9c78bb-840e-49bd-96c0-a46cebb39c03","source":"wordfence","cve":"CVE-2026-57746","title":"Booked - Appointment Booking for WordPress <= 3.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9c78bb-840e-49bd-96c0-a46cebb39c03?source=api-prod","affected":[{"type":"plugin","slug":"booked","name":"Booked - Appointment Booking for WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:06:45Z"},{"id":"wordfence:ac9d2b64-aff6-418a-bfe7-ec91b177ad6b","source":"wordfence","cve":"CVE-2025-12973","title":"S2B AI Assistant \u2013 ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9d2b64-aff6-418a-bfe7-ec91b177ad6b?source=api-prod","affected":[{"type":"plugin","slug":"s2b-ai-assistant","name":"S2B AI Assistant \u2013 ChatBot, Chatbot Inspector, Image Generator","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-11-20T16:50:38Z","updated":"2025-11-21T16:28:13Z"},{"id":"wordfence:ac9ea266-d3a5-4140-9bee-86de031ca4e7","source":"wordfence","cve":"CVE-2025-48092","title":"Fix Multiple Redirects <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9ea266-d3a5-4140-9bee-86de031ca4e7?source=api-prod","affected":[{"type":"plugin","slug":"fix-multiple-redirects","name":"Fix Multiple Redirects","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T14:54:26Z"},{"id":"wordfence:ac9ed78b-a09d-46b0-871e-db5208b28ccf","source":"wordfence","cve":"CVE-2025-58921","title":"Tactical Popup <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ac9ed78b-a09d-46b0-871e-db5208b28ccf?source=api-prod","affected":[{"type":"plugin","slug":"wp-tactical-popup","name":"WP Tactical Popup","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-16T00:00:00Z","updated":"2025-10-29T21:05:27Z"},{"id":"wordfence:aca092cf-9482-468e-8dd4-af04e25bcf33","source":"wordfence","cve":"CVE-2024-11809","title":"Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aca092cf-9482-468e-8dd4-af04e25bcf33?source=api-prod","affected":[{"type":"plugin","slug":"primer-mydata","name":"Primer MyData for Woocommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2024-12-12T16:14:36Z","updated":"2024-12-13T04:23:27Z"},{"id":"wordfence:aca48ddf-4256-4a55-bff5-1718110147dd","source":"wordfence","cve":"CVE-2025-4168","title":"Subpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5-1718110147dd?source=api-prod","affected":[{"type":"plugin","slug":"subpage-view","name":"Subpage List","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:32:33Z","updated":"2025-05-03T01:43:06Z"},{"id":"wordfence:aca7db69-e65c-4a51-9e45-69ab8c95ec0c","source":"wordfence","cve":"CVE-2026-87841","title":"UnitechPay <= 1.0.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aca7db69-e65c-4a51-9e45-69ab8c95ec0c?source=api-prod","affected":[{"type":"plugin","slug":"unitechpay-paiements-mobile-money","name":"UnitechPay \u2013 Wave & Orange Money Payments","from":"*","from_inclusive":true,"to":"1.0.6.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:17:36Z"},{"id":"wordfence:aca8482e-7a5b-4f2d-965c-a1184fb6a374","source":"wordfence","cve":"CVE-2025-62007","title":"Voice Feedback \u2013 Voice Recorder for Audio Feedback <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aca8482e-7a5b-4f2d-965c-a1184fb6a374?source=api-prod","affected":[{"type":"plugin","slug":"voice-feedback","name":"Voice Feedback \u2013 Audio Feedback Form, Voice Recorder & Voice Testimonials","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:48:18Z"},{"id":"wordfence:acaa3142-2bbc-43d3-8ecc-05e8edb931ec","source":"wordfence","cve":"CVE-2025-5092","title":"Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.5.1","to_inclusive":true,"patched_in":"1.2.5.2"},{"type":"plugin","slug":"tp-woocommerce-product-gallery","name":"TP WooCommerce Product Gallery","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1031","to_inclusive":true,"patched_in":"1.7.1032"},{"type":"theme","slug":"onepress","name":"OnePress","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"lightgallerywp","name":"LightGallery WP","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.10.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"portfolio-wp","name":"Portfolio, Gallery, Product Catalog \u2013 Grid KIT Portfolio","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"},{"type":"plugin","slug":"gallery-with-thumbnail-slider","name":"Gallery with thumbnail slider","from":"*","from_inclusive":true,"to":"7.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-19T00:00:00Z","updated":"2025-11-24T19:44:44Z"},{"id":"wordfence:acaad554-4094-4b52-a695-cb1e775495a5","source":"wordfence","cve":"CVE-2024-34759","title":"Picture Gallery <= 1.5.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acaad554-4094-4b52-a695-cb1e775495a5?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.5.11","to_inclusive":true,"patched_in":"1.5.12"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:52:31Z"},{"id":"wordfence:acaadf62-08ff-4d2b-b998-47079cce4cd6","source":"wordfence","cve":"CVE-2025-62898","title":"Links shortcode <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acaadf62-08ff-4d2b-b998-47079cce4cd6?source=api-prod","affected":[{"type":"plugin","slug":"links-shortcode","name":"Links shortcode","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-27T00:00:00Z","updated":"2025-10-29T15:06:16Z"},{"id":"wordfence:acb239c2-a105-4430-8451-a6ae852a690f","source":"wordfence","cve":"CVE-2018-20981","title":"Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests","severity":"critical","cvss":9.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb239c2-a105-4430-8451-a6ae852a690f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2018-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acb417ba-d16d-4dab-901a-d7cc48b43129","source":"wordfence","cve":"CVE-2026-57639","title":"WP Booking System \u2013 Booking Calendar <= 2.1.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb417ba-d16d-4dab-901a-d7cc48b43129?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.6","to_inclusive":true,"patched_in":"2.1.0.7"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:43:17Z"},{"id":"wordfence:acb44af7-2fa9-49d7-8e87-80b93c2db005","source":"wordfence","cve":"CVE-2025-24548","title":"Autoglot <= 2.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb44af7-2fa9-49d7-8e87-80b93c2db005?source=api-prod","affected":[{"type":"plugin","slug":"autoglot","name":"Automatic Multilingual AI Translation by Autoglot","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-11-11T00:00:00Z","updated":"2025-04-22T21:36:59Z"},{"id":"wordfence:acb4d5e7-25bf-4c06-ba0b-2404062dfbb8","source":"wordfence","cve":"CVE-2025-32632","title":"Automatic Ban IP <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb4d5e7-25bf-4c06-ba0b-2404062dfbb8?source=api-prod","affected":[{"type":"plugin","slug":"automatic-ban-ip","name":"Automatic Ban IP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:13:23Z"},{"id":"wordfence:acb5b0e2-7a12-4c7e-b316-b03ae9b605fc","source":"wordfence","cve":"CVE-2026-17012","title":"Restore PayPal Standard for WooCommerce <= 3.1.2 - Unauthenticated Payment Verification Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb5b0e2-7a12-4c7e-b316-b03ae9b605fc?source=api-prod","affected":[{"type":"plugin","slug":"restore-paypal-standard-for-woocommerce","name":"Accept PayPal & Stripe with Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-28T22:11:16Z"},{"id":"wordfence:acb8c11f-e175-4361-b016-e1ebc1713be0","source":"wordfence","cve":"CVE-2023-0334","title":"ShortPixel Adaptive Images <= 3.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb8c11f-e175-4361-b016-e1ebc1713be0?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acb8f2eb-24e8-46e9-8ba8-15c00bf28395","source":"wordfence","cve":"CVE-2025-58995","title":"Leblix <= 2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acb8f2eb-24e8-46e9-8ba8-15c00bf28395?source=api-prod","affected":[{"type":"theme","slug":"leblix","name":"Leblix - Laboratory & Research WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-09-17T00:00:00Z","updated":"2025-09-22T14:12:02Z"},{"id":"wordfence:acba11a8-6313-4043-9ffd-6208228a7e7c","source":"wordfence","cve":"CVE-2025-68071","title":"Essential Real Estate <= 5.3.4 - Authenticated (ERE Customer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acba11a8-6313-4043-9ffd-6208228a7e7c?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2025-12-14T00:00:00Z","updated":"2026-11-03T22:45:17Z"},{"id":"wordfence:acbe0ccd-f814-4cdd-ab70-6b8d29166e25","source":"wordfence","cve":"CVE-2021-24519","title":"VikRentCar Car Rental Management System < 1.1.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acbe0ccd-f814-4cdd-ab70-6b8d29166e25?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acbe1c36-04e7-49af-90fa-d8acbe351b57","source":"wordfence","cve":"CVE-2019-14947","title":"Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acbe1c36-04e7-49af-90fa-d8acbe351b57?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.51","to_inclusive":true,"patched_in":"2.0.52"}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acbea2eb-fa87-4117-b347-049c819599c7","source":"wordfence","cve":"CVE-2018-19488","title":"JobCareer | Job Board Responsive WordPress Theme < 2.4 - Unauthenticated Arbitrary Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acbea2eb-fa87-4117-b347-049c819599c7?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"},{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2018-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acc063a4-e1fe-491e-be54-f784cc87f08a","source":"wordfence","cve":"CVE-2025-49417","title":"WooCommerce Product Multi-Action <= 1.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc063a4-e1fe-491e-be54-f784cc87f08a?source=api-prod","affected":[{"type":"plugin","slug":"Woo-product-multiaction","name":"WooCommerce Product Multi-Action","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:34:06Z"},{"id":"wordfence:acc073ed-e5fb-4cc4-90b3-03c37123cff2","source":"wordfence","cve":"CVE-2026-120850","title":"Elementor Website Builder \u2013 more than just a page builder <= 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc073ed-e5fb-4cc4-90b3-03c37123cff2?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:58:18Z"},{"id":"wordfence:acc0bb09-5114-413c-9b24-bb00cbce99c5","source":"wordfence","cve":"CVE-2026-28124","title":"Notarius - Legal Advisor WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc0bb09-5114-413c-9b24-bb00cbce99c5?source=api-prod","affected":[{"type":"theme","slug":"notarius","name":"Notarius - Legal Advisor WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:34:21Z"},{"id":"wordfence:acc0cb26-1199-4e71-91a5-340d80fafc24","source":"wordfence","cve":"CVE-2022-45072","title":"WPML  <= 4.5.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc0cb26-1199-4e71-91a5-340d80fafc24?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acc22313-3a56-4571-98d6-73ea3fc5532c","source":"wordfence","cve":"CVE-2026-18232","title":"Directory Kit < 1.6.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc22313-3a56-4571-98d6-73ea3fc5532c?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-11-10T23:20:12Z"},{"id":"wordfence:acc261eb-fafa-4e9d-b7ab-a449f14a7638","source":"wordfence","cve":"CVE-2024-0872","title":"Watu Quiz <= 3.4.1 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc261eb-fafa-4e9d-b7ab-a449f14a7638?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.1.1"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:13Z"},{"id":"wordfence:acc88688-76e0-4477-8b7c-eeff541881ab","source":"wordfence","cve":"CVE-2025-12355","title":"Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acc88688-76e0-4477-8b7c-eeff541881ab?source=api-prod","affected":[{"type":"plugin","slug":"payaza","name":"Payaza","from":"*","from_inclusive":true,"to":"0.3.8","to_inclusive":true,"patched_in":"0.3.9"}],"published":"2025-12-04T17:31:41Z","updated":"2026-07-31T19:43:26Z"},{"id":"wordfence:acca5aad-9029-452d-8701-34387202784e","source":"wordfence","cve":"CVE-2024-13326","title":"iBuildApp <= 0.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acca5aad-9029-452d-8701-34387202784e?source=api-prod","affected":[{"type":"plugin","slug":"ibuildapp","name":"iBuildApp","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:18:48Z"},{"id":"wordfence:accac3da-0318-4e79-a163-ed9ff2af692b","source":"wordfence","cve":"CVE-2026-75962","title":"Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration \u2192 Failed Email Log)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/accac3da-0318-4e79-a163-ed9ff2af692b?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-10-05T16:28:40Z","updated":"2026-10-06T05:30:48Z"},{"id":"wordfence:acccc6ae-553d-4ed5-8ba9-06a9061d725c","source":"wordfence","cve":"CVE-2024-1652","title":"Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acccc6ae-553d-4ed5-8ba9-06a9061d725c?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:52:13Z"},{"id":"wordfence:accd4f34-4e10-4c83-96c3-c2a078ecd5cc","source":"wordfence","cve":"CVE-2024-12037","title":"Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/accd4f34-4e10-4c83-96c3-c2a078ecd5cc?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.13","to_inclusive":true,"patched_in":"2.8.14"}],"published":"2025-01-30T00:00:00Z","updated":"2025-01-31T11:11:12Z"},{"id":"wordfence:accdcff0-f361-4632-b0b7-e55975adeebb","source":"wordfence","cve":"CVE-2023-32746","title":"WooCommerce Brands <= 1.6.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/accdcff0-f361-4632-b0b7-e55975adeebb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-brands","name":"WooCommerce Brands","from":"*","from_inclusive":true,"to":"1.6.45","to_inclusive":true,"patched_in":"1.6.46"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acd0349b-7864-4e4e-84ba-6f0ec5b585f3","source":"wordfence","cve":"CVE-2023-0824","title":"UserPlus <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd0349b-7864-4e4e-84ba-6f0ec5b585f3?source=api-prod","affected":[{"type":"plugin","slug":"userplus","name":"User registration & user profile \u2013 UserPlus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acd1d5c9-70fb-43e8-94de-6ddcf4612cea","source":"wordfence","cve":"CVE-2014-3843","title":"Search Everything <= 8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd1d5c9-70fb-43e8-94de-6ddcf4612cea?source=api-prod","affected":[{"type":"plugin","slug":"search-everything","name":"Search Everything","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":false,"patched_in":"8.1.1"}],"published":"2014-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acd22b79-1354-4dc8-9475-ac5312b057e9","source":"wordfence","cve":"CVE-2026-118041","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.3 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd22b79-1354-4dc8-9475-ac5312b057e9?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"34.0.3","to_inclusive":false,"patched_in":"34.0.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:03:08Z"},{"id":"wordfence:acd55f15-43b6-481c-a3d2-3c29943caf69","source":"wordfence","cve":"CVE-2024-49698","title":"Best Restaurant Menu by PriceListo <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd55f15-43b6-481c-a3d2-3c29943caf69?source=api-prod","affected":[{"type":"plugin","slug":"best-restaurant-menu-by-pricelisto","name":"Great Restaurant Menu WP","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:22:41Z"},{"id":"wordfence:acd61330-eba8-4311-8b60-30c3124067f0","source":"wordfence","cve":"CVE-2021-24372","title":"WP Hardening \u2013 Fix Your WordPress Security <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd61330-eba8-4311-8b60-30c3124067f0?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-hardening","name":"WP Hardening (discontinued)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acd6b604-45dd-4688-a9b9-fabb12c418e2","source":"wordfence","cve":"CVE-2023-7229","title":"illi Link Party! <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd6b604-45dd-4688-a9b9-fabb12c418e2?source=api-prod","affected":[{"type":"plugin","slug":"link-party","name":"illi Link Party!","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:48:19Z"},{"id":"wordfence:acd7b1b5-9618-4e8a-b320-bb65978d2c92","source":"wordfence","cve":"CVE-2026-85575","title":"The ShopEngine Elementor WooCommerce Builder Addon \u2013 All in One WooCommerce Solution with eCommerce Templates & Woo Widgets  <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd7b1b5-9618-4e8a-b320-bb65978d2c92?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-09-14T11:05:47Z","updated":"2026-09-15T01:03:08Z"},{"id":"wordfence:acd85c0c-7f48-4b09-a44f-7f0858c68616","source":"wordfence","cve":"CVE-2025-68582","title":"Funnelforms Free <= 3.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acd85c0c-7f48-4b09-a44f-7f0858c68616?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-12-25T00:00:00Z","updated":"2026-10-28T21:09:19Z"},{"id":"wordfence:acda3276-7830-42c0-bc6e-0bc5510325e2","source":"wordfence","cve":"CVE-2025-59559","title":"Payrexx Payment Gateway for WooCommerce <= 3.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acda3276-7830-42c0-bc6e-0bc5510325e2?source=api-prod","affected":[{"type":"plugin","slug":"woo-payrexx-gateway","name":"Payrexx Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:20:18Z"},{"id":"wordfence:acdac8a7-6ac5-481d-a636-dd791fda89a3","source":"wordfence","cve":"CVE-2023-37988","title":"Contact Form Generator <= 2.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acdac8a7-6ac5-481d-a636-dd791fda89a3?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-generator","name":"Contact Form Generator : Creative form builder for WordPress","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acde42e4-7445-427a-b4fa-9ef225049bb8","source":"wordfence","cve":"CVE-2016-1000154","title":"WHIZZ < 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acde42e4-7445-427a-b4fa-9ef225049bb8?source=api-prod","affected":[{"type":"plugin","slug":"whizz","name":"WHIZZ","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acde5693-53fe-47b8-ad0b-6799ab63d0c1","source":"wordfence","cve":"CVE-2016-10983","title":"Ghost <= 0.5.5 - Missing Authorization Checks","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acde5693-53fe-47b8-ad0b-6799ab63d0c1?source=api-prod","affected":[{"type":"plugin","slug":"ghost","name":"Ghost","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":"0.5.6"}],"published":"2016-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ace0e441-97e1-46d9-85c4-010381fc94f6","source":"wordfence","cve":"CVE-2026-62115","title":"KuteShop <= 4.2.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace0e441-97e1-46d9-85c4-010381fc94f6?source=api-prod","affected":[{"type":"theme","slug":"kuteshop","name":"kuteshop","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:22:08Z"},{"id":"wordfence:ace194b6-c794-417c-9870-db8ebaa4cf7a","source":"wordfence","cve":"CVE-2026-95816","title":"Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace194b6-c794-417c-9870-db8ebaa4cf7a?source=api-prod","affected":[{"type":"plugin","slug":"smart-forms","name":"Smart Forms \u2013 when you need more than just a contact form","from":"*","from_inclusive":true,"to":"2.6.104","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:36:54Z","updated":"2026-10-14T03:40:04Z"},{"id":"wordfence:ace265dd-0ef4-4fda-bc70-c74e10daae7c","source":"wordfence","cve":"CVE-2026-87838","title":"Wava Payment 0.3.1 - 0.3.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace265dd-0ef4-4fda-bc70-c74e10daae7c?source=api-prod","affected":[{"type":"plugin","slug":"wava-payment","name":"Wava Payment Plugin","from":"0.3.1","from_inclusive":true,"to":"0.3.9","to_inclusive":true,"patched_in":"0.3.10"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:43:43Z"},{"id":"wordfence:ace46bae-5dfb-4cdf-bd9e-d68282be16d0","source":"wordfence","cve":"CVE-2023-52188","title":"Footer Putter <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace46bae-5dfb-4cdf-bd9e-d68282be16d0?source=api-prod","affected":[{"type":"plugin","slug":"footer-putter","name":"Footer Putter","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-08-02T18:28:42Z"},{"id":"wordfence:ace7ab05-799a-412c-8c0b-3429852f0263","source":"wordfence","cve":"CVE-2025-23970","title":"Service Finder Booking <= 6.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace7ab05-799a-412c-8c0b-3429852f0263?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:57:00Z"},{"id":"wordfence:ace85b25-251b-4549-8f6e-1a1494cbabb6","source":"wordfence","cve":"CVE-2023-50823","title":"CSS & JavaScript Toolbox <= 11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ace85b25-251b-4549-8f6e-1a1494cbabb6?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"11.8","to_inclusive":true,"patched_in":"11.9"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-24T01:06:13Z"},{"id":"wordfence:acebc874-5853-405c-adb3-c6582d8c5e42","source":"wordfence","cve":"CVE-2025-48332","title":"Gutenberg Blocks <= 3.3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acebc874-5853-405c-adb3-c6582d8c5e42?source=api-prod","affected":[{"type":"plugin","slug":"advanced-gutenberg","name":"PublishPress Blocks \u2013 Block Controls, Block Visibility, Block Permissions","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T19:33:04Z"},{"id":"wordfence:acf1ce69-0bf9-4329-973f-3796c8bb8895","source":"wordfence","cve":"CVE-2025-22664","title":"Survey Maker <= 5.1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf1ce69-0bf9-4329-973f-3796c8bb8895?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.3.5","to_inclusive":true,"patched_in":"5.1.3.6"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:39:10Z"},{"id":"wordfence:acf1e98a-9e9d-453d-afce-6e47fce3a2d2","source":"wordfence","cve":"CVE-2016-10876","title":"WP Database Backup <= 4.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf1e98a-9e9d-453d-afce-6e47fce3a2d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2016-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acf2906b-1ee5-4272-bf6d-36a02023f658","source":"wordfence","cve":"CVE-2026-3534","title":"Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf2906b-1ee5-4272-bf6d-36a02023f658?source=api-prod","affected":[{"type":"theme","slug":"astra","name":"Astra","from":"*","from_inclusive":true,"to":"4.12.3","to_inclusive":true,"patched_in":"4.12.4"}],"published":"2026-03-10T17:27:37Z","updated":"2026-03-11T13:29:01Z"},{"id":"wordfence:acf36244-e12c-4b1b-90b0-801e26ac6232","source":"wordfence","cve":"CVE-2026-118533","title":"Directorist <= 8.10 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf36244-e12c-4b1b-90b0-801e26ac6232?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:23:41Z"},{"id":"wordfence:acf52d3f-2dca-48a5-8dbb-22cf43f2de98","source":"wordfence","cve":"CVE-2025-59558","title":"Billey < 2.1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf52d3f-2dca-48a5-8dbb-22cf43f2de98?source=api-prod","affected":[{"type":"theme","slug":"billey","name":"Billey - Creative Portfolio & Agency Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2025-07-08T00:00:00Z","updated":"2025-10-29T19:15:49Z"},{"id":"wordfence:acf69e07-884c-4eaf-8b58-c1fd3810e086","source":"wordfence","cve":"CVE-2025-10182","title":"dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf69e07-884c-4eaf-8b58-c1fd3810e086?source=api-prod","affected":[{"type":"plugin","slug":"dbview","name":"dbview","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:23:22Z","updated":"2025-09-30T03:35:30Z"},{"id":"wordfence:acf93d4f-9105-4d6e-b89e-08c29188c77b","source":"wordfence","cve":"CVE-2025-31802","title":"Shiptimize for WooCommerce <= 3.1.86 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf93d4f-9105-4d6e-b89e-08c29188c77b?source=api-prod","affected":[{"type":"plugin","slug":"shiptimize-for-woocommerce","name":"Shiptimize for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.86","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T13:28:56Z"},{"id":"wordfence:acf9dfaf-4a4e-4ff1-8276-94b1ffb76ab1","source":"wordfence","cve":"CVE-2024-6226","title":"WpStickyBar \u2013 Sticky Bar, Sticky Header <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acf9dfaf-4a4e-4ff1-8276-94b1ffb76ab1?source=api-prod","affected":[{"type":"plugin","slug":"wpstickybar-sticky-bar-sticky-header","name":"WpStickyBar \u2013 Sticky Bar, Sticky Header","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:18:38Z"},{"id":"wordfence:acfdd579-0be9-476b-90cd-07f417712691","source":"wordfence","cve":"CVE-2025-13812","title":"GamiPress \u2013 Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acfdd579-0be9-476b-90cd-07f417712691?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2026-01-05T18:53:15Z","updated":"2026-01-06T07:22:15Z"},{"id":"wordfence:acfdda37-dfeb-41ef-b873-fdcd8c1417d1","source":"wordfence","cve":"CVE-2026-109685","title":"Link Whisper Free <= 0.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acfdda37-dfeb-41ef-b873-fdcd8c1417d1?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2026-10-13T12:53:21Z","updated":"2026-10-23T18:25:40Z"},{"id":"wordfence:acff00f2-586d-474c-8dec-f27c488e9045","source":"wordfence","cve":"CVE-2019-15238","title":"CformsII <= 15.0.1 - Unauthenticated HTML Injection & Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acff00f2-586d-474c-8dec-f27c488e9045?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.0.2","to_inclusive":false,"patched_in":"15.0.2"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:acff618e-1fed-49c6-8713-c58d32b73382","source":"wordfence","cve":"CVE-2025-22554","title":"Video Embed Optimizer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/acff618e-1fed-49c6-8713-c58d32b73382?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-optimizer","name":"Video Embed Optimizer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:47:56Z"},{"id":"wordfence:ad003d57-a573-473e-80a9-5bf60d42a707","source":"wordfence","cve":"CVE-2023-47826","title":"Restaurant & Cafe Addon for Elementor <= 1.5.3 - Missing Authorization via multiple AJAX functions","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad003d57-a573-473e-80a9-5bf60d42a707?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad01d01a-d1d9-4c4e-9818-52298c2df89c","source":"wordfence","cve":"CVE-2024-13466","title":"Automatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad01d01a-d1d9-4c4e-9818-52298c2df89c?source=api-prod","affected":[{"type":"plugin","slug":"automatically-hierarchic-categories-in-menu","name":"Automatically Hierarchic Categories in Menu","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2025-01-30T00:22:20Z","updated":"2025-01-30T12:22:28Z"},{"id":"wordfence:ad021954-83ec-4f56-8c4d-79751eda94b0","source":"wordfence","cve":"CVE-2025-28959","title":"URL Shortener <= 3.0.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad021954-83ec-4f56-8c4d-79751eda94b0?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T18:01:41Z"},{"id":"wordfence:ad05b088-977e-4f24-b843-dc65f1aa60e9","source":"wordfence","cve":"CVE-2024-8675","title":"Soumettre.fr <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad05b088-977e-4f24-b843-dc65f1aa60e9?source=api-prod","affected":[{"type":"plugin","slug":"soumettre-fr","name":"Soumettre.fr","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-07T20:27:22Z"},{"id":"wordfence:ad07299f-8cff-4bc7-9953-2cea08f3d29c","source":"wordfence","cve":"CVE-2025-28989","title":"Read More Login <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad07299f-8cff-4bc7-9953-2cea08f3d29c?source=api-prod","affected":[{"type":"plugin","slug":"read-more-login","name":"Read More Login","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:12:04Z"},{"id":"wordfence:ad09e91d-8ef8-49b2-84e8-fdbf28d65a8a","source":"wordfence","cve":"CVE-2015-10125","title":"Import CSV or XML Datafeed With Ease <= 3.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad09e91d-8ef8-49b2-84e8-fdbf28d65a8a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2015-05-05T00:00:00Z","updated":"2024-02-07T14:02:35Z"},{"id":"wordfence:ad0a9daf-d59b-4db0-add9-dbf87fb4708e","source":"wordfence","cve":"CVE-2026-16256","title":"POUCO Import Users <= 1.0.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0a9daf-d59b-4db0-add9-dbf87fb4708e?source=api-prod","affected":[{"type":"plugin","slug":"pouco-import-users","name":"POUCO Import Users","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:27:23Z"},{"id":"wordfence:ad0bd82d-db0e-440e-9cea-d3843525b0f0","source":"wordfence","cve":"CVE-2023-44471","title":"Backend Localization <= 2.1.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0bd82d-db0e-440e-9cea-d3843525b0f0?source=api-prod","affected":[{"type":"plugin","slug":"kau-boys-backend-localization","name":"Backend Localization","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad0d60f2-6354-4c2c-aaab-23fc9b8065fe","source":"wordfence","cve":"CVE-2025-32658","title":"HelpGent <= 2.2.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0d60f2-6354-4c2c-aaab-23fc9b8065fe?source=api-prod","affected":[{"type":"plugin","slug":"helpgent","name":"HelpGent \u2013 Video Funnels and Conversational Forms for WordPress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-10-13T14:30:35Z"},{"id":"wordfence:ad0e4292-d890-499b-b70a-ed638d5b8ee9","source":"wordfence","cve":"CVE-2024-4481","title":"Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0e4292-d890-499b-b70a-ed638d5b8ee9?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":"3.2.37"}],"published":"2024-05-09T18:38:48Z","updated":"2024-05-10T06:44:58Z"},{"id":"wordfence:ad0e5a96-903b-4de4-be57-6236dcebaa94","source":"wordfence","cve":"CVE-2024-12715","title":"Asgard Security Scanner <= 0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0e5a96-903b-4de4-be57-6236dcebaa94?source=api-prod","affected":[{"type":"plugin","slug":"asgard","name":"Asgard Security Scanner","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:45:20Z"},{"id":"wordfence:ad0e684a-6bae-44cb-a43c-6bc402217f20","source":"wordfence","cve":"CVE-2025-53279","title":"Popup addon for Ninja Forms <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0e684a-6bae-44cb-a43c-6bc402217f20?source=api-prod","affected":[{"type":"plugin","slug":"popup-addon-for-ninja-forms","name":"Popup addon for Ninja Forms","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:38:45Z"},{"id":"wordfence:ad0ed141-3d17-4fff-b788-7ff43f79d04c","source":"wordfence","cve":"CVE-2022-3935","title":"Welcart e-Commerce <= 2.8.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad0ed141-3d17-4fff-b788-7ff43f79d04c?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad10c59d-c8bc-48d4-99ce-569d84e7e23b","source":"wordfence","cve":"CVE-2025-60090","title":"Gravity Forms Insightly <= 1.1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad10c59d-c8bc-48d4-99ce-569d84e7e23b?source=api-prod","affected":[{"type":"plugin","slug":"gf-insightly","name":"WP Gravity Forms Insightly","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-08-09T00:00:00Z","updated":"2026-01-07T14:27:06Z"},{"id":"wordfence:ad12941f-8cbf-41c6-a261-b47075198d26","source":"wordfence","cve":"","title":"Sandbox <= 1.6.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad12941f-8cbf-41c6-a261-b47075198d26?source=api-prod","affected":[{"type":"theme","slug":"sandbox","name":"Sandbox","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2013-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad159b18-0ad1-4cab-932e-6850cf7a867f","source":"wordfence","cve":"CVE-2025-11262","title":"Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad159b18-0ad1-4cab-932e-6850cf7a867f?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.0","to_inclusive":true,"patched_in":"0.9.1"}],"published":"2026-05-28T18:06:26Z","updated":"2026-05-29T06:43:44Z"},{"id":"wordfence:ad177f89-2cc0-4ab3-a787-3b0bd3bf3e47","source":"wordfence","cve":"CVE-2021-25040","title":"Booking Calendar <= 8.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad177f89-2cc0-4ab3-a787-3b0bd3bf3e47?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"8.9.1","to_inclusive":true,"patched_in":"8.9.2"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad19205d-d355-45d8-be5b-f8005459a8c7","source":"wordfence","cve":"CVE-2025-5287","title":"Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad19205d-d355-45d8-be5b-f8005459a8c7?source=api-prod","affected":[{"type":"plugin","slug":"inprosysmedia-likes-dislikes-post","name":"Likes and Dislikes Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-27T00:00:00Z","updated":"2025-06-13T17:09:42Z"},{"id":"wordfence:ad1a79f3-274f-4a33-a752-669c09c2d47d","source":"wordfence","cve":"CVE-2023-27624","title":"Redirect After Login <= 0.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad1a79f3-274f-4a33-a752-669c09c2d47d?source=api-prod","affected":[{"type":"plugin","slug":"redirect-after-login","name":"Redirect After Login","from":"*","from_inclusive":true,"to":"0.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad1ba8df-a15b-426b-8b45-63f2441313c1","source":"wordfence","cve":"CVE-2026-39568","title":"Mr. SEO <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad1ba8df-a15b-426b-8b45-63f2441313c1?source=api-prod","affected":[{"type":"theme","slug":"mrseo","name":"Mr. SEO - Social Media Marketing Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:12:35Z"},{"id":"wordfence:ad20d235-26e1-4071-89ea-21e721ec9505","source":"wordfence","cve":"CVE-2025-67526","title":"Sailing < 4.4.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad20d235-26e1-4071-89ea-21e721ec9505?source=api-prod","affected":[{"type":"theme","slug":"sailing","name":"Sailing","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":false,"patched_in":"4.4.6"}],"published":"2025-12-15T00:00:00Z","updated":"2026-04-24T15:21:46Z"},{"id":"wordfence:ad20ddd2-33d0-4d49-bca0-ea2a829da6c8","source":"wordfence","cve":"CVE-2023-37976","title":"Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad20ddd2-33d0-4d49-bca0-ea2a829da6c8?source=api-prod","affected":[{"type":"plugin","slug":"radio-forge","name":"Radio Forge Muses Player with Skins","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad22cb24-e6a0-456f-afe8-88a39acd97d3","source":"wordfence","cve":"CVE-2026-8760","title":"Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force","severity":"critical","cvss":9.8,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad22cb24-e6a0-456f-afe8-88a39acd97d3?source=api-prod","affected":[{"type":"plugin","slug":"otp-login","name":"Login with OTP","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2026-05-26T17:20:31Z","updated":"2026-09-18T15:02:54Z"},{"id":"wordfence:ad24e14c-a5b1-4c45-8b00-2625f32ad6ce","source":"wordfence","cve":"CVE-2025-22631","title":"Marketing Automation <= 1.2.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad24e14c-a5b1-4c45-8b00-2625f32ad6ce?source=api-prod","affected":[{"type":"plugin","slug":"marketing-automation","name":"Marketing Automation","from":"*","from_inclusive":true,"to":"1.2.6.8","to_inclusive":true,"patched_in":"1.2.6.9"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-26T22:39:48Z"},{"id":"wordfence:ad254899-983b-42bc-a248-7dbf9003d06c","source":"wordfence","cve":"CVE-2013-7279","title":"S3 Video <= 0.982 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad254899-983b-42bc-a248-7dbf9003d06c?source=api-prod","affected":[{"type":"plugin","slug":"s3-video","name":"S3 Video Plugin","from":"*","from_inclusive":true,"to":"0.982","to_inclusive":true,"patched_in":"0.983"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad266e0f-fc69-4550-b89c-c32ce1221ee4","source":"wordfence","cve":"CVE-2026-77193","title":"eesy_ID2WP \u2013 Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad266e0f-fc69-4550-b89c-c32ce1221ee4?source=api-prod","affected":[{"type":"plugin","slug":"eesy-id2wp-publish-indesign-html5","name":"eesy_ID2WP \u2013 Publish InDesign HTML5","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-09-23T20:16:46Z","updated":"2026-09-24T08:27:31Z"},{"id":"wordfence:ad276108-f87f-423f-8c08-1869da499432","source":"wordfence","cve":"CVE-2026-22507","title":"Beelove | Honey Production and Sweets Online Store WordPress Theme <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad276108-f87f-423f-8c08-1869da499432?source=api-prod","affected":[{"type":"theme","slug":"beelove","name":"Beelove | Honey Production and Sweets Online Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-09T00:00:00Z","updated":"2026-03-19T13:59:42Z"},{"id":"wordfence:ad28946f-43a1-44a1-b758-2074cbe1b4eb","source":"wordfence","cve":"CVE-2026-118239","title":"AutomatorWP <= 6.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad28946f-43a1-44a1-b758-2074cbe1b4eb?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:22:07Z"},{"id":"wordfence:ad2abd5b-3067-4dcd-a650-b543fa03437b","source":"wordfence","cve":"CVE-2024-13368","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2abd5b-3067-4dcd-a650-b543fa03437b?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-01-24T18:53:33Z","updated":"2025-03-20T14:44:21Z"},{"id":"wordfence:ad2af511-a038-47bf-b9ec-b464cb28593d","source":"wordfence","cve":"CVE-2025-60247","title":"Bux Woocommerce <= 1.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2af511-a038-47bf-b9ec-b464cb28593d?source=api-prod","affected":[{"type":"plugin","slug":"bux-woocommerce","name":"Bux Woocommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-18T00:00:00Z","updated":"2025-11-11T18:24:02Z"},{"id":"wordfence:ad2b053b-12c0-42fa-b3da-31c824f04848","source":"wordfence","cve":"CVE-2025-22306","title":"Link Whisper Free <= 0.7.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2b053b-12c0-42fa-b3da-31c824f04848?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.7.8","to_inclusive":true,"patched_in":"0.7.9"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-30T16:21:06Z"},{"id":"wordfence:ad2c1ab6-5c78-4317-b5e7-c86e2eebeb4f","source":"wordfence","cve":"CVE-2023-2085","title":"Essential Blocks <= 4.0.6 - Missing Authorization via templates","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2c1ab6-5c78-4317-b5e7-c86e2eebeb4f?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad2d5070-ddc6-4478-abe5-776e197a4507","source":"wordfence","cve":"CVE-2023-47668","title":"Restrict Content <= 3.2.7 - Information Exposure via legacy log file","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2d5070-ddc6-4478-abe5-776e197a4507?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad2e1d91-03bd-4e47-b679-81c42414238b","source":"wordfence","cve":"CVE-2025-12957","title":"All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2e1d91-03bd-4e47-b679-81c42414238b?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.5.7","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-01-15T16:28:18Z","updated":"2026-01-16T04:44:35Z"},{"id":"wordfence:ad2f240b-39b1-4fe9-9e49-1c88d2bfee38","source":"wordfence","cve":"CVE-2026-14554","title":"Check & Log Email <= 2.0.14 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad2f240b-39b1-4fe9-9e49-1c88d2bfee38?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-15T21:06:11Z"},{"id":"wordfence:ad306c2b-5fc7-49c2-9ee0-777c7e6014e5","source":"wordfence","cve":"CVE-2025-23980","title":"Full Circle <= 0.5.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad306c2b-5fc7-49c2-9ee0-777c7e6014e5?source=api-prod","affected":[{"type":"plugin","slug":"full-circle","name":"Full Circle","from":"*","from_inclusive":true,"to":"0.5.7.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:30:59Z"},{"id":"wordfence:ad32fdd9-d1b5-4591-851f-889a7e3db047","source":"wordfence","cve":"CVE-2026-31920","title":"Product Rearrange for WooCommerce <= 1.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad32fdd9-d1b5-4591-851f-889a7e3db047?source=api-prod","affected":[{"type":"plugin","slug":"products-rearrange-woocommerce","name":"Product Rearrange for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:39:17Z"},{"id":"wordfence:ad34d657-da59-46ff-a54a-64e6c8974b69","source":"wordfence","cve":"CVE-2023-4549","title":"DoLogin Security <= 3.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad34d657-da59-46ff-a54a-64e6c8974b69?source=api-prod","affected":[{"type":"plugin","slug":"dologin","name":"DoLogin Security","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad359327-9d53-4c8e-bd09-7a337711cfbd","source":"wordfence","cve":"CVE-2021-24724","title":"Timetable and Event Schedule by MotoPress <= 2.3.18 - Author+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad359327-9d53-4c8e-bd09-7a337711cfbd?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.3.18","to_inclusive":true,"patched_in":"2.3.19"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad3644a7-3999-49f8-822c-9e3b22bf7b8f","source":"wordfence","cve":"CVE-2025-22282","title":"ez Form Calculator - WordPress plugin <= 2.14.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad3644a7-3999-49f8-822c-9e3b22bf7b8f?source=api-prod","affected":[{"type":"plugin","slug":"ez-form-calculator-premium","name":"ez Form Calculator Premium","from":"*","from_inclusive":true,"to":"2.14.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:24:06Z"},{"id":"wordfence:ad374338-2bf4-4322-be5e-b4fe07acf80d","source":"wordfence","cve":"CVE-2024-32598","title":"BA Book Everything <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad374338-2bf4-4322-be5e-b4fe07acf80d?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T15:45:30Z"},{"id":"wordfence:ad382ec2-55c8-4d6c-b318-db199f812493","source":"wordfence","cve":"CVE-2026-10753","title":"Site Kit by Google \u2013 Analytics, Search Console, AdSense, Speed < 1.176.0 - Missing Authorization to Authenticated (Editor+) Settings Update","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad382ec2-55c8-4d6c-b318-db199f812493?source=api-prod","affected":[{"type":"plugin","slug":"google-site-kit","name":"Site Kit by Google \u2013 Analytics, Search Console, AdSense, Speed","from":"*","from_inclusive":true,"to":"1.176.0","to_inclusive":false,"patched_in":"1.176.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:46:15Z"},{"id":"wordfence:ad39a3b0-5434-4595-a052-4b6e4adb2247","source":"wordfence","cve":"CVE-2025-6460","title":"Display During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad39a3b0-5434-4595-a052-4b6e4adb2247?source=api-prod","affected":[{"type":"plugin","slug":"display-during-conditional-shortcode","name":"Display During Conditional Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-02-17T15:37:04Z","updated":"2026-02-18T04:35:44Z"},{"id":"wordfence:ad39d797-9230-41d9-a335-864845b56aa0","source":"wordfence","cve":"CVE-2024-11150","title":"WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad39d797-9230-41d9-a335-864845b56aa0?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.6","to_inclusive":true,"patched_in":"16.7"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T04:29:07Z"},{"id":"wordfence:ad3b9040-05ed-452d-9b3f-26d1a93c62ba","source":"wordfence","cve":"CVE-2025-1325","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad3b9040-05ed-452d-9b3f-26d1a93c62ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.10","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-03-07T20:52:18Z","updated":"2025-03-08T09:22:55Z"},{"id":"wordfence:ad3de7e6-a080-4ce8-aa27-21e7f8fdb2c7","source":"wordfence","cve":"CVE-2022-1386","title":"Fusion Builder <= 3.6.1 & Avada <= 7.6.1  - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad3de7e6-a080-4ce8-aa27-21e7f8fdb2c7?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":false,"patched_in":"3.6.2"},{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":false,"patched_in":"7.6.2"}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad40de6a-744c-4a78-912a-4fd76ae75dc1","source":"wordfence","cve":"CVE-2025-39408","title":"BruteGuard \u2013 Brute Force Login Protection <= 0.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad40de6a-744c-4a78-912a-4fd76ae75dc1?source=api-prod","affected":[{"type":"plugin","slug":"bruteguard","name":"BruteGuard \u2013 Brute Force Login Protection","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:16:32Z"},{"id":"wordfence:ad427bea-1b0e-46bb-85fc-53c51fb40a17","source":"wordfence","cve":"CVE-2023-27438","title":"WP Translitera <= p1.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad427bea-1b0e-46bb-85fc-53c51fb40a17?source=api-prod","affected":[{"type":"plugin","slug":"wp-translitera","name":"WP Translitera","from":"*","from_inclusive":true,"to":"p1.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad430706-749f-4582-af07-6c543b8d5aad","source":"wordfence","cve":"","title":"Checkout Field Editor <= 1.7.4 - Cross-Site Request Forgery to Checkout Fields Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad430706-749f-4582-af07-6c543b8d5aad?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-field-editor","name":"Checkout Field Editor","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad4784ce-38f2-49b7-8323-ce08a16a311b","source":"wordfence","cve":"CVE-2015-4704","title":"Download ZIP Attachments <= 1.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4784ce-38f2-49b7-8323-ce08a16a311b?source=api-prod","affected":[{"type":"plugin","slug":"download-zip-attachments","name":"download-zip-attachments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad48145b-24c5-49ac-a192-08c496e08e00","source":"wordfence","cve":"CVE-2025-15386","title":"Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad48145b-24c5-49ac-a192-08c496e08e00?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2026-02-03T00:00:00Z","updated":"2026-05-04T14:57:01Z"},{"id":"wordfence:ad48182f-9ad0-49d9-a3c5-805830dca530","source":"wordfence","cve":"CVE-2025-62149","title":"Add Custom Codes <= 4.80 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad48182f-9ad0-49d9-a3c5-805830dca530?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-codes","name":"Add Custom Codes \u2013 Insert Header, Footer, Custom PHP Snippets, CSS, Javascript","from":"*","from_inclusive":true,"to":"4.80","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:30:08Z"},{"id":"wordfence:ad4878fb-dd0f-473b-9887-d993a89fedd2","source":"wordfence","cve":"CVE-2022-0747","title":"Infographic Maker \u2013 iList <= 4.3.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4878fb-dd0f-473b-9887-d993a89fedd2?source=api-prod","affected":[{"type":"plugin","slug":"infographic-and-list-builder-ilist","name":"AI Infographic Maker","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad4884f6-27b1-4fed-b724-e14c0312d089","source":"wordfence","cve":"CVE-2026-73999","title":"Cooked \u2013 Recipe Management <= 1.16.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4884f6-27b1-4fed-b724-e14c0312d089?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"}],"published":"2026-09-16T18:17:00Z","updated":"2026-09-22T18:33:39Z"},{"id":"wordfence:ad4acbcb-5044-4752-9db0-74bd6f99a963","source":"wordfence","cve":"CVE-2026-56033","title":"Dokan Pro <= 5.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4acbcb-5044-4752-9db0-74bd6f99a963?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-02T14:10:55Z"},{"id":"wordfence:ad4d181c-592f-4d3c-a39f-e82046b6155a","source":"wordfence","cve":"CVE-2026-110370","title":"GS Pinterest Portfolio \u2013 Pins Grid, Masonry, User Profile, Popup & Board Widgets <= 1.9.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4d181c-592f-4d3c-a39f-e82046b6155a?source=api-prod","affected":[{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2026-10-19T08:09:30Z","updated":"2026-10-23T18:18:55Z"},{"id":"wordfence:ad4e5243-e41a-4624-b9cd-47ab79637560","source":"wordfence","cve":"CVE-2026-25406","title":"Tutor LMS Pro <= 3.9.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4e5243-e41a-4624-b9cd-47ab79637560?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T18:32:56Z"},{"id":"wordfence:ad4ff78b-a870-4ce2-a3c8-53f4bc64a837","source":"wordfence","cve":"CVE-2026-96532","title":"Testimonials Widget <= 4.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad4ff78b-a870-4ce2-a3c8-53f4bc64a837?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-widget","name":"Testimonials Widget","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:55:51Z"},{"id":"wordfence:ad50e216-f522-4294-a4dc-7f3bd52820b3","source":"wordfence","cve":"CVE-2023-51678","title":"Doofinder for WooCommerce <= 2.0.33 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad50e216-f522-4294-a4dc-7f3bd52820b3?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"2.0.33","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad52baf6-5b35-4701-abff-018679ae9e92","source":"wordfence","cve":"CVE-2025-67941","title":"The Aisle < 2.9.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad52baf6-5b35-4701-abff-018679ae9e92?source=api-prod","affected":[{"type":"theme","slug":"theaisle","name":"The Aisle - Elegant Wedding WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:52:05Z"},{"id":"wordfence:ad5782d6-f36b-4b7d-b6c0-b9329fb8725c","source":"wordfence","cve":"CVE-2024-39625","title":"Icegram <= 3.1.24 - Missing Authorization to Unauthenticated Message Duplication","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5782d6-f36b-4b7d-b6c0-b9329fb8725c?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.24","to_inclusive":true,"patched_in":"3.1.25"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:03:20Z"},{"id":"wordfence:ad5a13d9-5ba4-4e66-8374-f45bcd6c716f","source":"wordfence","cve":"CVE-2022-2152","title":"Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5a13d9-5ba4-4e66-8374-f45bcd6c716f?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-wp-page-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad5aeea0-ba5a-488a-9087-9b7567f31c70","source":"wordfence","cve":"CVE-2022-4745","title":"WP Customer Area <= 8.1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5aeea0-ba5a-488a-9087-9b7567f31c70?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.1.3","to_inclusive":true,"patched_in":"8.1.4"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad5bbf98-e7df-430d-8a02-ad252bf61b02","source":"wordfence","cve":"CVE-2025-31880","title":"Pearl <= 1.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5bbf98-e7df-430d-8a02-ad252bf61b02?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2025-04-01T00:00:00Z","updated":"2025-08-22T15:32:11Z"},{"id":"wordfence:ad5c8eb8-8e58-4bed-a39c-b54e2cfd9cd3","source":"wordfence","cve":"CVE-2020-36510","title":"15Zine | Magazine Newspaper Blog News WordPress Theme < 3.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5c8eb8-8e58-4bed-a39c-b54e2cfd9cd3?source=api-prod","affected":[{"type":"theme","slug":"15zine","name":"15Zine | Magazine Newspaper Blog News WordPress Theme","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"}],"published":"2020-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad5ca2a1-06ac-4f26-9ecb-bb861c035f57","source":"wordfence","cve":"CVE-2022-1418","title":"Social Stickers <= 2.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5ca2a1-06ac-4f26-9ecb-bb861c035f57?source=api-prod","affected":[{"type":"plugin","slug":"social-stickers","name":"Social Stickers","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":""}],"published":"2022-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad5f2123-4cbc-4bec-807e-3bd72dd4a626","source":"wordfence","cve":"CVE-2026-125850","title":"Appointment Dark <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad5f2123-4cbc-4bec-807e-3bd72dd4a626?source=api-prod","affected":[{"type":"theme","slug":"appointment-dark","name":"Appointment Dark","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:16Z"},{"id":"wordfence:ad62fd9b-fbd5-4e3d-b910-29143c6813b7","source":"wordfence","cve":"CVE-2024-30554","title":"DD Rating <= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad62fd9b-fbd5-4e3d-b910-29143c6813b7?source=api-prod","affected":[{"type":"plugin","slug":"dd-rating","name":"DD Rating","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:30:13Z"},{"id":"wordfence:ad66015d-7831-4590-9583-3abf7ca43c3b","source":"wordfence","cve":"CVE-2023-48757","title":"JetEngine <= 3.2.4 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad66015d-7831-4590-9583-3abf7ca43c3b?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad66d4ec-02ee-4b56-91ce-29f336df9410","source":"wordfence","cve":"CVE-2025-54051","title":"LightBox Block <= 1.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad66d4ec-02ee-4b56-91ce-29f336df9410?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-block","name":"All In One Lightbox \u2013 show any media in beautiful popups","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:39:45Z"},{"id":"wordfence:ad6747da-394a-4f63-864d-bd52813fad69","source":"wordfence","cve":"CVE-2021-24557","title":"M-vSlider <= 2.1.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad6747da-394a-4f63-864d-bd52813fad69?source=api-prod","affected":[{"type":"plugin","slug":"m-vslider","name":"M-vSlider","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad68e8bf-9980-4fe8-a00e-1cca088d2150","source":"wordfence","cve":"CVE-2026-42414","title":"ListingPro Plugin <= 2.9.12 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad68e8bf-9980-4fe8-a00e-1cca088d2150?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:12:16Z","updated":"2026-10-08T23:34:19Z"},{"id":"wordfence:ad6b8346-6bc1-4d6b-9d4f-9b25fbe3962f","source":"wordfence","cve":"CVE-2024-54246","title":"FAQs <= 1.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad6b8346-6bc1-4d6b-9d4f-9b25fbe3962f?source=api-prod","affected":[{"type":"plugin","slug":"faqs","name":"FAQs","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2025-01-17T13:33:05Z"},{"id":"wordfence:ad7047f8-2005-4767-a6c9-c06c2d9cff39","source":"wordfence","cve":"CVE-2024-54359","title":"Banner System <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7047f8-2005-4767-a6c9-c06c2d9cff39?source=api-prod","affected":[{"type":"plugin","slug":"banner-system","name":"Banner System","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T15:06:20Z"},{"id":"wordfence:ad73f105-fea8-4bbe-946b-97e61b4b9e57","source":"wordfence","cve":"CVE-2024-10853","title":"Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Order Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad73f105-fea8-4bbe-946b-97e61b4b9e57?source=api-prod","affected":[{"type":"plugin","slug":"buy-one-click-woocommerce","name":"Buy one click for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-11-12T13:28:14Z","updated":"2026-09-24T14:46:33Z"},{"id":"wordfence:ad74d5d0-270e-41d3-9596-2f71b05af276","source":"wordfence","cve":"CVE-2025-13801","title":"Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad74d5d0-270e-41d3-9596-2f71b05af276?source=api-prod","affected":[{"type":"plugin","slug":"yoco-payment-gateway","name":"Yoco Payments","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-01-06T20:31:52Z","updated":"2026-01-13T16:40:15Z"},{"id":"wordfence:ad77a2a3-e24b-43f0-b066-1774ab20e2cd","source":"wordfence","cve":"CVE-2025-59593","title":"Colibri Page Builder < 1.0.334 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad77a2a3-e24b-43f0-b066-1774ab20e2cd?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.334","to_inclusive":false,"patched_in":"1.0.334"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:38:00Z"},{"id":"wordfence:ad78e202-4f6c-4af2-b30a-4a0160303d5e","source":"wordfence","cve":"CVE-2025-69076","title":"Modern Housewife <= 1.0.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad78e202-4f6c-4af2-b30a-4a0160303d5e?source=api-prod","affected":[{"type":"theme","slug":"modernhousewife","name":"Modern Housewife","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:43:00Z"},{"id":"wordfence:ad7c56bf-44e5-4eaf-8342-10e66ee49092","source":"wordfence","cve":"CVE-2026-14556","title":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms < 1.26.15 - Unauthenticated HTML Injection","severity":"medium","cvss":5.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7c56bf-44e5-4eaf-8342-10e66ee49092?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.15","to_inclusive":false,"patched_in":"1.26.15"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:39:19Z"},{"id":"wordfence:ad7e3fe0-561e-40d8-b22c-bf8e7675b87f","source":"wordfence","cve":"CVE-2021-25100","title":"GiveWP <= 2.17.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7e3fe0-561e-40d8-b22c-bf8e7675b87f?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":false,"patched_in":"2.17.3"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad7eee97-332a-4f3c-bba1-d108a769599d","source":"wordfence","cve":"CVE-2021-25017","title":"Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7eee97-332a-4f3c-bba1-d108a769599d?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad7f7459-943f-42de-b14a-34c8c24763e1","source":"wordfence","cve":"CVE-2026-109370","title":"Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7f7459-943f-42de-b14a-34c8c24763e1?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-27T17:36:22Z","updated":"2026-10-28T06:45:19Z"},{"id":"wordfence:ad7fd987-02f3-40a7-8718-fbbb20f67b59","source":"wordfence","cve":"CVE-2026-83546","title":"CoolClock <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7fd987-02f3-40a7-8718-fbbb20f67b59?source=api-prod","affected":[{"type":"plugin","slug":"coolclock","name":"CoolClock","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T18:01:12Z"},{"id":"wordfence:ad81c6b6-dbf5-40a3-894d-e2fbab69d38a","source":"wordfence","cve":"CVE-2022-1218","title":"Domain Replace <= 1.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad81c6b6-dbf5-40a3-894d-e2fbab69d38a?source=api-prod","affected":[{"type":"plugin","slug":"domain-replace","name":"Domain Replace","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":""}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad830a69-fce7-46fc-bec9-da861efca9f3","source":"wordfence","cve":"CVE-2026-103064","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad830a69-fce7-46fc-bec9-da861efca9f3?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-10-01T12:32:00Z","updated":"2026-10-08T23:14:52Z"},{"id":"wordfence:ad8311d4-b07d-4e74-ab14-69faa3e409c8","source":"wordfence","cve":"CVE-2024-43220","title":"Form Maker by 10Web <= 1.15.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8311d4-b07d-4e74-ab14-69faa3e409c8?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.26","to_inclusive":true,"patched_in":"1.15.27"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-16T16:23:57Z"},{"id":"wordfence:ad854478-37b5-4dbd-9517-73fdbd5d023e","source":"wordfence","cve":"CVE-2025-58883","title":"Search Cloud One <= 2.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad854478-37b5-4dbd-9517-73fdbd5d023e?source=api-prod","affected":[{"type":"plugin","slug":"search-cloud-one","name":"Search Cloud One","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:29:29Z"},{"id":"wordfence:ad85b322-204a-4d74-8dde-38571fb68dd0","source":"wordfence","cve":"CVE-2021-24777","title":"Hotscot Contact Form < 1.3 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad85b322-204a-4d74-8dde-38571fb68dd0?source=api-prod","affected":[{"type":"plugin","slug":"hotscot-contact-form","name":"Hotscot Contact Form","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2021-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad862fff-4195-4aac-8fe4-8e7b9b49294a","source":"wordfence","cve":"CVE-2025-60104","title":"Gallery Custom Links <= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad862fff-4195-4aac-8fe4-8e7b9b49294a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-custom-links","name":"Gallery Custom Links","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-09-26T00:00:00Z","updated":"2025-11-05T15:37:15Z"},{"id":"wordfence:ad870543-2179-4022-be6b-01d7c7b80f3e","source":"wordfence","cve":"CVE-2025-50012","title":"Inventory Presser <= 15.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad870543-2179-4022-be6b-01d7c7b80f3e?source=api-prod","affected":[{"type":"plugin","slug":"inventory-presser","name":"Inventory Presser \u2013 Car Dealer Listings","from":"*","from_inclusive":true,"to":"15.2.6","to_inclusive":true,"patched_in":"15.2.7"}],"published":"2025-06-19T00:00:00Z","updated":"2026-02-26T15:13:08Z"},{"id":"wordfence:ad88c661-601c-411f-9495-2c3b8a568c6b","source":"wordfence","cve":"CVE-2023-32957","title":"Team Members Showcase <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad88c661-601c-411f-9495-2c3b8a568c6b?source=api-prod","affected":[{"type":"plugin","slug":"dazzlersoft-teams","name":"Team Members Showcase","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad896d7d-2c75-466c-9a79-b6a9cfb0bc15","source":"wordfence","cve":"CVE-2023-44230","title":"Popup contact form <= 7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad896d7d-2c75-466c-9a79-b6a9cfb0bc15?source=api-prod","affected":[{"type":"plugin","slug":"popup-contact-form","name":"Popup contact form","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad898303-dc7c-4904-a5cf-ea9ffceb5996","source":"wordfence","cve":"CVE-2026-39784","title":"Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad898303-dc7c-4904-a5cf-ea9ffceb5996?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:41:23Z","updated":"2026-10-08T23:30:36Z"},{"id":"wordfence:ad8b5fd2-ba92-4afa-9b4a-a95936b9a18d","source":"wordfence","cve":"","title":"Kaya QR Code Generator <= 1.5.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8b5fd2-ba92-4afa-9b4a-a95936b9a18d?source=api-prod","affected":[{"type":"plugin","slug":"kaya-qr-code-generator","name":"Kaya QR Code Generator","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad8bae39-1531-4224-8ff7-65d5f60078da","source":"wordfence","cve":"CVE-2026-22404","title":"Innovio <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8bae39-1531-4224-8ff7-65d5f60078da?source=api-prod","affected":[{"type":"theme","slug":"innovio","name":"Innovio - Multipurpose Landing Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T21:18:43Z"},{"id":"wordfence:ad8dff1e-b9f8-4383-8efb-8bceaa8c86c6","source":"wordfence","cve":"CVE-2022-47142","title":"Mediamatic \u2013 Media Library Folders <= 2.8.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8dff1e-b9f8-4383-8efb-8bceaa8c86c6?source=api-prod","affected":[{"type":"plugin","slug":"mediamatic","name":"Mediamatic \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-01-13T00:00:00Z","updated":"2026-07-28T19:18:17Z"},{"id":"wordfence:ad8f8c41-a3b9-4287-b6b2-489fb77b7553","source":"wordfence","cve":"CVE-2023-28750","title":"Albo Pretorio Online <= 4.6 - Reflected Cross-Site Scripting via 'Errore'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8f8c41-a3b9-4287-b6b2-489fb77b7553?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad8fc5c1-78f1-4ab4-8fe4-707f4c46a388","source":"wordfence","cve":"CVE-2024-35665","title":"Insert Post Ads <= 1.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad8fc5c1-78f1-4ab4-8fe4-707f4c46a388?source=api-prod","affected":[{"type":"plugin","slug":"insert-post-ads","name":"Insert Post Ads","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:39:52Z"},{"id":"wordfence:ad9272e3-fa81-440e-8d77-207145123ad2","source":"wordfence","cve":"CVE-2021-24413","title":"Easy Twitter Feed < 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad9272e3-fa81-440e-8d77-207145123ad2?source=api-prod","affected":[{"type":"plugin","slug":"easy-twitter-feeds","name":"Easy Feeds for X/Twitter \u2013 keep your site fresh with live social posts","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad943111-24c1-4ff9-b34a-aa4e1ee8ee75","source":"wordfence","cve":"CVE-2014-5205","title":"WordPress Core < 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad943111-24c1-4ff9-b34a-aa4e1ee8ee75?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad945b6f-7405-4ef7-acb2-5ee698b4a3ca","source":"wordfence","cve":"CVE-2025-31586","title":"Gallery \u2013 Photo Albums Plugin <= 1.3.170 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad945b6f-7405-4ef7-acb2-5ee698b4a3ca?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-gallery","name":"Gallery \u2013 Photo Albums Plugin","from":"*","from_inclusive":true,"to":"1.3.170","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:18:25Z"},{"id":"wordfence:ad953bc7-5747-4936-b702-37386299369e","source":"wordfence","cve":"","title":"Pop-up <= 1.1.1 - Missing authorization to Settings Change","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad953bc7-5747-4936-b702-37386299369e?source=api-prod","affected":[{"type":"plugin","slug":"pop-up-pop-up","name":"Pop-up","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad95f0b2-4d96-4f62-b495-050a89539177","source":"wordfence","cve":"CVE-2023-7086","title":"SVG Uploads Support <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad95f0b2-4d96-4f62-b495-050a89539177?source=api-prod","affected":[{"type":"plugin","slug":"svg-uploads-support","name":"SVG Uploads Support","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:43:52Z"},{"id":"wordfence:ad979f36-319f-48ce-a620-5ea9ae5401eb","source":"wordfence","cve":"CVE-2022-1562","title":"Enable SVG <= 1.3.1 - Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad979f36-319f-48ce-a620-5ea9ae5401eb?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg","name":"Enable SVG","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ad98db62-4253-4fd5-90b3-c28a563c7697","source":"wordfence","cve":"CVE-2024-1274","title":"My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad98db62-4253-4fd5-90b3-c28a563c7697?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.4.23","to_inclusive":true,"patched_in":"3.4.24"}],"published":"2024-02-11T00:00:00Z","updated":"2024-04-24T14:48:08Z"},{"id":"wordfence:ad993a62-457a-494f-a7c8-256b808d18c0","source":"wordfence","cve":"CVE-2025-12804","title":"Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad993a62-457a-494f-a7c8-256b808d18c0?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.6","to_inclusive":true,"patched_in":"10.14.7"}],"published":"2025-12-04T13:08:08Z","updated":"2025-12-05T01:55:22Z"},{"id":"wordfence:ada2e0f5-1214-4356-944c-655c5561e97e","source":"wordfence","cve":"CVE-2025-48137","title":"Interview <= 1.01 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ada2e0f5-1214-4356-944c-655c5561e97e?source=api-prod","affected":[{"type":"plugin","slug":"interview","name":"Interview","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:12:51Z"},{"id":"wordfence:ada3a69c-d113-4f92-b716-641bd5d20940","source":"wordfence","cve":"CVE-2022-25599","title":"Spiffy Calendar <= 4.9.0 - Event deletion via Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ada3a69c-d113-4f92-b716-641bd5d20940?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2022-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ada488fa-26d3-405f-8f89-edd8d10e8cc8","source":"wordfence","cve":"CVE-2026-115820","title":"Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ada488fa-26d3-405f-8f89-edd8d10e8cc8?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-10-30T17:08:50Z","updated":"2026-10-30T17:15:30Z"},{"id":"wordfence:ada52ae9-7d14-405d-9efc-b993ea273a26","source":"wordfence","cve":"CVE-2026-25366","title":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ada52ae9-7d14-405d-9efc-b993ea273a26?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-05T14:54:19Z"},{"id":"wordfence:ada8f195-ae5f-4f45-83b4-dd5b89e26ac9","source":"wordfence","cve":"CVE-2026-25330","title":"PublishPress Authors <= 4.10.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ada8f195-ae5f-4f45-83b4-dd5b89e26ac9?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.10.1","to_inclusive":true,"patched_in":"4.11.0"}],"published":"2026-02-06T00:00:00Z","updated":"2026-05-04T15:42:22Z"},{"id":"wordfence:adab6dd8-3054-42ca-99ae-1fc65108f823","source":"wordfence","cve":"CVE-2017-12977","title":"Photo Gallery by 10Web <= 1.3.50 - Authenticated SQL Injection via tag_id Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adab6dd8-3054-42ca-99ae-1fc65108f823?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.3.51","to_inclusive":false,"patched_in":"1.3.51"}],"published":"2017-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adadac1e-3d92-41a5-90d4-b2028c8c40c0","source":"wordfence","cve":"CVE-2024-3235","title":"Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adadac1e-3d92-41a5-90d4-b2028c8c40c0?source=api-prod","affected":[{"type":"plugin","slug":"essential-grid","name":"Essential Grid Gallery WordPress Plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-04-09T00:00:00Z","updated":"2024-05-03T13:12:06Z"},{"id":"wordfence:adb1d8b0-b1d6-40df-b591-f1062ee744fb","source":"wordfence","cve":"CVE-2021-4368","title":"Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb1d8b0-b1d6-40df-b591-f1062ee744fb?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adb4644c-6ef6-4899-b0f1-2629ffacd19c","source":"wordfence","cve":"","title":"Gmedia Photo Gallery <= 1.6.4 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb4644c-6ef6-4899-b0f1-2629ffacd19c?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"}],"published":"2015-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adb4d326-7089-4292-bf0a-4a21e6928a2d","source":"wordfence","cve":"CVE-2026-18391","title":"WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection","severity":"medium","cvss":5.3,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb4d326-7089-4292-bf0a-4a21e6928a2d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":false,"patched_in":"9.1.0"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T17:04:16Z"},{"id":"wordfence:adb54754-2994-47ad-99f8-e8d2d235da3d","source":"wordfence","cve":"CVE-2024-50552","title":"Hover Video Preview <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb54754-2994-47ad-99f8-e8d2d235da3d?source=api-prod","affected":[{"type":"plugin","slug":"hover-video-preview","name":"Hover Video Preview","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:48:20Z"},{"id":"wordfence:adb70798-2ef9-4384-bcca-8862afa044ed","source":"wordfence","cve":"CVE-2023-36693","title":"WP RSS Images <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb70798-2ef9-4384-bcca-8862afa044ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-images","name":"WP RSS Images","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adb7155b-c520-4ede-ab4f-9735b9ff0815","source":"wordfence","cve":"CVE-2025-62996","title":"Custom Layouts \u2013 Post + Product grids made easy <= 1.4.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb7155b-c520-4ede-ab4f-9735b9ff0815?source=api-prod","affected":[{"type":"plugin","slug":"custom-layouts","name":"Custom Layouts \u2013 Post + Product grids made easy","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-18T18:51:58Z"},{"id":"wordfence:adb730d0-1394-4716-bddd-efa55d6e4bf3","source":"wordfence","cve":"CVE-2025-11455","title":"Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb730d0-1394-4716-bddd-efa55d6e4bf3?source=api-prod","affected":[{"type":"plugin","slug":"wp-retina-2x","name":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2026-10-30T18:55:09Z","updated":"2026-10-31T07:46:51Z"},{"id":"wordfence:adb84461-6675-497f-ac53-cf72bd4c17bc","source":"wordfence","cve":"CVE-2021-24564","title":"WPFront Scroll Top <= 2.0.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb84461-6675-497f-ac53-cf72bd4c17bc?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-scroll-top","name":"WPFront Scroll Top","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adb87ef2-8741-4144-b414-56e82dd35c89","source":"wordfence","cve":"","title":"Event Registration <= 6.02.02 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb87ef2-8741-4144-b414-56e82dd35c89?source=api-prod","affected":[{"type":"plugin","slug":"event-registration","name":"Event Registration","from":"*","from_inclusive":true,"to":"6.02.02","to_inclusive":true,"patched_in":"6.03.01"}],"published":"2016-05-09T00:00:00Z","updated":"2024-10-23T12:43:47Z"},{"id":"wordfence:adb9e8e6-dceb-4d4b-b069-7f7479ab6b22","source":"wordfence","cve":"CVE-2025-62906","title":"Referral Link Tracker <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb9e8e6-dceb-4d4b-b069-7f7479ab6b22?source=api-prod","affected":[{"type":"plugin","slug":"referral-link-tracker","name":"Referral Link Tracker","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2025-10-29T15:04:23Z"},{"id":"wordfence:adba7d0c-29ca-49c5-ac75-bb79d62f6107","source":"wordfence","cve":"CVE-2025-11895","title":"Binary MLM Plan <= 5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adba7d0c-29ca-49c5-ac75-bb79d62f6107?source=api-prod","affected":[{"type":"plugin","slug":"binary-mlm-plan","name":"Binary MLM Plan","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T20:57:56Z","updated":"2026-09-18T19:06:30Z"},{"id":"wordfence:adbc23b3-fa9d-4303-8283-1cabb2a6bb71","source":"wordfence","cve":"CVE-2024-3715","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adbc23b3-fa9d-4303-8283-1cabb2a6bb71?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-31T15:30:51Z"},{"id":"wordfence:adbc8d10-4088-4918-b01e-86554512c7a4","source":"wordfence","cve":"CVE-2025-23554","title":"Off Page SEO <= 3.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adbc8d10-4088-4918-b01e-86554512c7a4?source=api-prod","affected":[{"type":"plugin","slug":"off-page-seo","name":"Off Page SEO","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:08:53Z"},{"id":"wordfence:adbebe61-3adc-4ba1-8767-863dc2310cad","source":"wordfence","cve":"CVE-2025-2483","title":"Gift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adbebe61-3adc-4ba1-8767-863dc2310cad?source=api-prod","affected":[{"type":"plugin","slug":"gift-certificate-creator","name":"Gift Certificate Creator","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:30:31Z","updated":"2025-04-02T09:21:45Z"},{"id":"wordfence:adbf25c2-b572-4a83-811e-3a5dda1ad8cd","source":"wordfence","cve":"CVE-2017-18599","title":"Pinfinity <= 1.9.2 - Reflected Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adbf25c2-b572-4a83-811e-3a5dda1ad8cd?source=api-prod","affected":[{"type":"theme","slug":"pinfinity","name":"Pinfinity","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"2.0"}],"published":"2017-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adc2ce12-6be2-447d-a05d-da36ce7f5727","source":"wordfence","cve":"CVE-2025-23905","title":"Admin Options Pages <= 0.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adc2ce12-6be2-447d-a05d-da36ce7f5727?source=api-prod","affected":[{"type":"plugin","slug":"admin-options-pages","name":"Admin Options Pages","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-15T12:29:39Z"},{"id":"wordfence:adc7e02f-aa95-417f-8778-d9a75beeaf13","source":"wordfence","cve":"CVE-2018-20462","title":"JSmol2WP <= 1.07 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adc7e02f-aa95-417f-8778-d9a75beeaf13?source=api-prod","affected":[{"type":"plugin","slug":"jsmol2wp","name":"JSmol2WP","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":""}],"published":"2019-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adc8926d-267e-49d5-83b2-68b390ca2d0a","source":"wordfence","cve":"CVE-2025-24618","title":"ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adc8926d-267e-49d5-83b2-68b390ca2d0a?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:37:09Z"},{"id":"wordfence:adc90b32-f973-4c8e-b419-0614d4642b7f","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adc90b32-f973-4c8e-b419-0614d4642b7f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:51:19Z"},{"id":"wordfence:adca3f1e-3e1a-4047-863b-bf254cb2ad3f","source":"wordfence","cve":"CVE-2026-105877","title":"QA Assistants \u2013 Driven by data <= 5.3.0.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adca3f1e-3e1a-4047-863b-bf254cb2ad3f?source=api-prod","affected":[{"type":"plugin","slug":"qa-heatmap-analytics","name":"QA Assistants \u2013 Driven by data","from":"*","from_inclusive":true,"to":"5.3.0.0","to_inclusive":true,"patched_in":"5.3.0.1"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:26:09Z"},{"id":"wordfence:adcab262-08ca-448d-b1fd-295d421b82a3","source":"wordfence","cve":"CVE-2024-11764","title":"Solar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adcab262-08ca-448d-b1fd-295d421b82a3?source=api-prod","affected":[{"type":"plugin","slug":"solar-wizard-lite","name":"Solar Wizard Lite","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T06:40:58Z"},{"id":"wordfence:adcaf2db-2026-46bb-8fbc-0400d7c1e296","source":"wordfence","cve":"CVE-2023-31094","title":"Stock Sync for WooCommerce <= 2.4.0 - Reflected Cross-Site Scripting via page parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adcaf2db-2026-46bb-8fbc-0400d7c1e296?source=api-prod","affected":[{"type":"plugin","slug":"stock-sync-for-woocommerce","name":"Stock Sync for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adcbb70e-c99f-4f05-8869-50cf16f6de79","source":"wordfence","cve":"CVE-2022-4298","title":"Wholesale Market <= 2.2.0 - Information Disclosure via Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adcbb70e-c99f-4f05-8869-50cf16f6de79?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-market","name":"Wholesale Market","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:add0ef7c-a9a7-4f02-abde-5ca3504b7a19","source":"wordfence","cve":"CVE-2026-73992","title":"Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add0ef7c-a9a7-4f02-abde-5ca3504b7a19?source=api-prod","affected":[{"type":"plugin","slug":"query-wrangler","name":"Query Wrangler","from":"*","from_inclusive":true,"to":"1.5.57","to_inclusive":true,"patched_in":"1.5.58"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:22:31Z"},{"id":"wordfence:add12281-7c2b-4b79-a744-36e9fd923611","source":"wordfence","cve":"CVE-2024-49285","title":"SSV MailChimp <= 3.1.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add12281-7c2b-4b79-a744-36e9fd923611?source=api-prod","affected":[{"type":"plugin","slug":"ssv-mailchimp","name":"SSV MailChimp","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T18:07:25Z"},{"id":"wordfence:add32c06-90d0-466f-b176-aaae55cf03fb","source":"wordfence","cve":"CVE-2026-6391","title":"Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add32c06-90d0-466f-b176-aaae55cf03fb?source=api-prod","affected":[{"type":"plugin","slug":"sentence-to-seo","name":"Sentence To SEO (keywords, description and tags)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:03:36Z","updated":"2026-05-20T01:25:51Z"},{"id":"wordfence:add39d28-4070-44e2-8dff-0371e0c58453","source":"wordfence","cve":"CVE-2024-13699","title":"Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add39d28-4070-44e2-8dff-0371e0c58453?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T12:22:21Z"},{"id":"wordfence:add568d4-d615-40ff-9320-89869f825f81","source":"wordfence","cve":"CVE-2020-12070","title":"Advanced Woo Search <= 2.00 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add568d4-d615-40ff-9320-89869f825f81?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-search","name":"Advanced Woo Search \u2013 Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.99","to_inclusive":true,"patched_in":"2.00"}],"published":"2020-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:add71a12-60e2-4c56-bc88-849261c13f6a","source":"wordfence","cve":"CVE-2025-58214","title":"Indutri < 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add71a12-60e2-4c56-bc88-849261c13f6a?source=api-prod","affected":[{"type":"theme","slug":"indutri","name":"Indutri","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2025-08-30T00:00:00Z","updated":"2025-09-25T20:53:15Z"},{"id":"wordfence:add7e759-5c8f-41a1-a4ae-29b154df61ed","source":"wordfence","cve":"CVE-2025-58270","title":"NIX Anti-Spam Light <= 0.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add7e759-5c8f-41a1-a4ae-29b154df61ed?source=api-prod","affected":[{"type":"plugin","slug":"nix-anti-spam-light","name":"NIX Anti-Spam Light","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:15Z"},{"id":"wordfence:add85b9b-3a4d-4c46-a90f-10c9645e249d","source":"wordfence","cve":"CVE-2025-13841","title":"Smart App Banners <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add85b9b-3a4d-4c46-a90f-10c9645e249d?source=api-prod","affected":[{"type":"plugin","slug":"smart-app-banners","name":"Smart App Banners","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:30:56Z","updated":"2026-01-07T09:21:02Z"},{"id":"wordfence:add8f740-536f-4a30-b857-37be9a250cd9","source":"wordfence","cve":"CVE-2026-125448","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.31 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/add8f740-536f-4a30-b857-37be9a250cd9?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.31","to_inclusive":true,"patched_in":"2.4.32"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:20Z"},{"id":"wordfence:adda0c06-80c7-4e2b-af18-8b2e6258e39a","source":"wordfence","cve":"CVE-2026-12106","title":"Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adda0c06-80c7-4e2b-af18-8b2e6258e39a?source=api-prod","affected":[{"type":"plugin","slug":"auto-upload-images","name":"Auto Upload Images","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-18T06:38:55Z"},{"id":"wordfence:addae413-1fc5-427f-a5ef-3da705cbeb5b","source":"wordfence","cve":"CVE-2022-2117","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/addae413-1fc5-427f-a5ef-3da705cbeb5b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.20.2","to_inclusive":true,"patched_in":"2.21.0"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:addf264e-e23c-4bb6-a898-0fbb4ec28189","source":"wordfence","cve":"CVE-2025-6977","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/addf264e-e23c-4bb6-a898-0fbb4ec28189?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.4","to_inclusive":true,"patched_in":"5.9.5.5"}],"published":"2025-07-15T16:14:28Z","updated":"2025-07-16T04:24:03Z"},{"id":"wordfence:ade06c00-43b7-48b3-9c9d-4921fb52cc66","source":"wordfence","cve":"CVE-2017-6571","title":"Mail Masta <= 1.0 - SQL Injection via id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade06c00-43b7-48b3-9c9d-4921fb52cc66?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ade1eddf-cfcc-4956-8015-8d9a592cc252","source":"wordfence","cve":"CVE-2024-2348","title":"Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade1eddf-cfcc-4956-8015-8d9a592cc252?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-09T18:59:13Z"},{"id":"wordfence:ade27af2-bc3d-45b1-a881-9e0e1182feee","source":"wordfence","cve":"CVE-2025-60163","title":"bbp topic count <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade27af2-bc3d-45b1-a881-9e0e1182feee?source=api-prod","affected":[{"type":"plugin","slug":"bbp-topic-count","name":"bbP topic count","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:10:54Z"},{"id":"wordfence:ade346fc-d158-4485-85a8-d14d5e059554","source":"wordfence","cve":"CVE-2024-8983","title":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget <= 2.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade346fc-d158-4485-85a8-d14d5e059554?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-09-17T00:00:00Z","updated":"2024-10-18T13:00:16Z"},{"id":"wordfence:ade377c4-c7aa-428d-b763-6e6fb6caee0c","source":"wordfence","cve":"CVE-2024-31252","title":"Responsive Lightbox <= 2.4.6 - Missing Authorization via Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade377c4-c7aa-428d-b763-6e6fb6caee0c?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:58:17Z"},{"id":"wordfence:ade63ab0-8625-4f2a-ba7f-03ac7312577a","source":"wordfence","cve":"CVE-2026-39748","title":"EduMall - Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade63ab0-8625-4f2a-ba7f-03ac7312577a?source=api-prod","affected":[{"type":"theme","slug":"edumall","name":"EduMall - Professional LMS Education Center WordPress Theme","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:55:13Z"},{"id":"wordfence:ade64c1d-65e6-4424-b2da-dc63b49f08aa","source":"wordfence","cve":"CVE-2025-11172","title":"Check Plagiarism <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade64c1d-65e6-4424-b2da-dc63b49f08aa?source=api-prod","affected":[{"type":"plugin","slug":"check-plagiarism","name":"Check Plagiarism","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T19:57:54Z","updated":"2025-10-24T08:24:03Z"},{"id":"wordfence:ade6f9f2-2a35-4bb0-ab13-33b84394d965","source":"wordfence","cve":"CVE-2023-4691","title":"Bookly <= 22.3.1 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade6f9f2-2a35-4bb0-ab13-33b84394d965?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"22.3.1","to_inclusive":true,"patched_in":"22.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ade73ae0-4193-47e3-a545-2563fd19fb54","source":"wordfence","cve":"CVE-2026-61965","title":"Geeky Bot \u2013 AI Sales Assistant for WooCommerce <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade73ae0-4193-47e3-a545-2563fd19fb54?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:11:34Z"},{"id":"wordfence:ade7da50-49f3-4026-a2c0-5c23c9b0f0cb","source":"wordfence","cve":"CVE-2020-24316","title":"Admin Menu Plugin <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade7da50-49f3-4026-a2c0-5c23c9b0f0cb?source=api-prod","affected":[{"type":"plugin","slug":"admin-menu","name":"Admin Menu","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2020-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ade7f391-3824-4d0b-8718-f7995170a43d","source":"wordfence","cve":"CVE-2024-3891","title":"Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ade7f391-3824-4d0b-8718-f7995170a43d?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.5","to_inclusive":true,"patched_in":"3.10.6"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:52:31Z"},{"id":"wordfence:adea27d5-093d-4c66-ab0f-69b4ab8dc261","source":"wordfence","cve":"CVE-2024-52345","title":"ra_qrcode <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adea27d5-093d-4c66-ab0f-69b4ab8dc261?source=api-prod","affected":[{"type":"plugin","slug":"ra-qrcode","name":"ra_qrcode","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:57:02Z"},{"id":"wordfence:adeb4e0b-13fe-4f80-9b24-62bf2a057ead","source":"wordfence","cve":"CVE-2025-31019","title":"Password Policy Manager <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adeb4e0b-13fe-4f80-9b24-62bf2a057ead?source=api-prod","affected":[{"type":"plugin","slug":"password-policy-manager","name":"Password Policy Manager","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:34:34Z"},{"id":"wordfence:adeb6e25-8f31-4250-ab1d-ddeae19181be","source":"wordfence","cve":"CVE-2026-125845","title":"vdequator <= 1.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adeb6e25-8f31-4250-ab1d-ddeae19181be?source=api-prod","affected":[{"type":"theme","slug":"vdequator","name":"vdequator","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:31Z"},{"id":"wordfence:adebcf1c-bb22-4a25-b79b-b76eb3b3023f","source":"wordfence","cve":"","title":"Gutenberg Template Library & Redux Framework <= 4.1.23 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adebcf1c-bb22-4a25-b79b-b76eb3b3023f?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.1.24","to_inclusive":false,"patched_in":"4.1.24"}],"published":"2020-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adecdae5-2cb9-42f3-befb-3f5dc73ed5dc","source":"wordfence","cve":"CVE-2026-66696","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.7.8 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adecdae5-2cb9-42f3-befb-3f5dc73ed5dc?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.8.1"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:43:23Z"},{"id":"wordfence:adee74ec-7a3c-4519-bea8-23c92e89d484","source":"wordfence","cve":"CVE-2014-4543","title":"Pay Per Media Player <= 1.24 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adee74ec-7a3c-4519-bea8-23c92e89d484?source=api-prod","affected":[{"type":"plugin","slug":"pay-per-media-player","name":"Pay Per Media Player","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adf03af6-f454-41c6-bb65-87c7f5d7c465","source":"wordfence","cve":"CVE-2026-39674","title":"MK Google Directions <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf03af6-f454-41c6-bb65-87c7f5d7c465?source=api-prod","affected":[{"type":"plugin","slug":"google-distance-calculator","name":"MK Google Directions","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-15T21:27:43Z"},{"id":"wordfence:adf10688-834c-4922-89a3-0048dde5f210","source":"wordfence","cve":"CVE-2024-56246","title":"Nexter Blocks <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf10688-834c-4922-89a3-0048dde5f210?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:54:27Z"},{"id":"wordfence:adf10ad4-38b2-44be-bdc6-ba6b62e9fbe6","source":"wordfence","cve":"CVE-2024-2499","title":"Squelch Tabs and Accordions Shortcodes <= 0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf10ad4-38b2-44be-bdc6-ba6b62e9fbe6?source=api-prod","affected":[{"type":"plugin","slug":"squelch-tabs-and-accordions-shortcodes","name":"Squelch Tabs and Accordions Shortcodes","from":"*","from_inclusive":true,"to":"0.4.3","to_inclusive":true,"patched_in":"0.4.4"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-05T12:52:40Z"},{"id":"wordfence:adf1db6d-4344-4c42-ae8a-1059fada3eb2","source":"wordfence","cve":"CVE-2025-69170","title":"Eventicity <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf1db6d-4344-4c42-ae8a-1059fada3eb2?source=api-prod","affected":[{"type":"theme","slug":"eventicity","name":"Eventicity","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:38:19Z"},{"id":"wordfence:adf3fb57-b080-4cda-b78b-14d94bad21a9","source":"wordfence","cve":"CVE-2020-11025","title":"WordPress Core < 5.4.1 - Authenticated Cross-Site Scripting via Customizer","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf3fb57-b080-4cda-b78b-14d94bad21a9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adf40b81-c013-4abc-9b99-4eb96a536385","source":"wordfence","cve":"CVE-2025-58662","title":"Awesome Support <= 6.3.5 - Authenticated (Support Manager+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf40b81-c013-4abc-9b99-4eb96a536385?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-27T20:37:38Z"},{"id":"wordfence:adf51c03-b0bb-4864-b64d-6b0cba4b0130","source":"wordfence","cve":"CVE-2026-7467","title":"Read More & Accordion <= 3.5.7 - Privilege Escalation via importData","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:12:39Z","updated":"2026-05-20T01:25:52Z"},{"id":"wordfence:adf5b377-f4b6-4859-a5a2-2cb8f61b7e81","source":"wordfence","cve":"CVE-2025-22703","title":"Forge \u2013 Front-End Page Builder <= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf5b377-f4b6-4859-a5a2-2cb8f61b7e81?source=api-prod","affected":[{"type":"plugin","slug":"forge","name":"Forge \u2013 Front-End Page Builder","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:42:33Z"},{"id":"wordfence:adf6b34b-a362-4cfe-b062-8bbe11584581","source":"wordfence","cve":"CVE-2024-6262","title":"Portfolio Gallery \u2013 Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf6b34b-a362-4cfe-b062-8bbe11584581?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-filter-gallery","name":"Portfolio Filter Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-06-26T00:00:00Z","updated":"2024-06-27T11:03:35Z"},{"id":"wordfence:adf8c50a-c657-4452-8c6b-23c2a56b7b78","source":"wordfence","cve":"CVE-2025-23577","title":"Word Freshener <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf8c50a-c657-4452-8c6b-23c2a56b7b78?source=api-prod","affected":[{"type":"plugin","slug":"word-freshener","name":"Word Freshener","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:52:54Z"},{"id":"wordfence:adf95bcc-49de-448e-bb6e-3c9cde4732d5","source":"wordfence","cve":"CVE-2026-83547","title":"Xpro Elementor Addons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adf95bcc-49de-448e-bb6e-3c9cde4732d5?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-16T16:16:45Z"},{"id":"wordfence:adfba556-6a96-4836-af0f-39c214099481","source":"wordfence","cve":"CVE-2024-12622","title":"WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adfba556-6a96-4836-af0f-39c214099481?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:45Z"},{"id":"wordfence:adfc5084-ed33-4600-bd34-d3516f1a1b96","source":"wordfence","cve":"CVE-2023-45636","title":"WordPress Backup & Migration <= 1.4.1 - Missing Authorization to Settings and Schedule Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adfc5084-ed33-4600-bd34-d3516f1a1b96?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:adfd506e-7b47-4aeb-a21e-034624210574","source":"wordfence","cve":"CVE-2025-39402","title":"WPAMS <= 44.0 (17-08-2023) - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adfd506e-7b47-4aeb-a21e-034624210574?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:36:30Z"},{"id":"wordfence:adfd97cf-8f61-463d-a535-1a61e3c2e134","source":"wordfence","cve":"CVE-2026-108587","title":"10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adfd97cf-8f61-463d-a535-1a61e3c2e134?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.34.10","to_inclusive":true,"patched_in":"2.34.11"}],"published":"2026-10-14T15:49:30Z","updated":"2026-10-15T04:26:51Z"},{"id":"wordfence:adfe66d7-5402-447f-bca2-8de5b6447cbb","source":"wordfence","cve":"CVE-2024-54386","title":"Push Monkey Pro \u2013 Web Push Notifications and WooCommerce Abandoned Cart <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adfe66d7-5402-447f-bca2-8de5b6447cbb?source=api-prod","affected":[{"type":"plugin","slug":"push-monkey-desktop-push-notifications","name":"Push Monkey Pro \u2013 Web Push Notifications and WooCommerce Abandoned Cart","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:56:41Z"},{"id":"wordfence:adff1d97-84d7-4407-9eed-dd81177b5898","source":"wordfence","cve":"CVE-2025-59135","title":"Behance Portfolio Manager <= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adff1d97-84d7-4407-9eed-dd81177b5898?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-12-31T00:00:00Z","updated":"2026-03-17T21:30:17Z"},{"id":"wordfence:adffa925-0d91-4c8a-b9ec-1af10cb882ca","source":"wordfence","cve":"CVE-2025-49037","title":"Authentication and xmlrpc log writer <= 1.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adffa925-0d91-4c8a-b9ec-1af10cb882ca?source=api-prod","affected":[{"type":"plugin","slug":"authentication-and-xmlrpc-log-writer","name":"Authentication and xmlrpc log writer","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T20:46:13Z"},{"id":"wordfence:ae000d8a-802d-440e-9fbf-8c3b0a4a7f02","source":"wordfence","cve":"CVE-2026-18048","title":"Photo Album Plus <= 9.2.07.1 - Arbitrary File Deletion to Unauthenticated Arbitrary ZIP File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae000d8a-802d-440e-9fbf-8c3b0a4a7f02?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.07.1","to_inclusive":true,"patched_in":"9.2.07.002"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:47:56Z"},{"id":"wordfence:ae007dc0-9ac7-459d-bfe6-bcde87028b14","source":"wordfence","cve":"CVE-2023-51357","title":"Conversios.io <= 6.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae007dc0-9ac7-459d-bfe6-bcde87028b14?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae039144-2c02-4a00-9fff-f4e90a6a8236","source":"wordfence","cve":"CVE-2026-16775","title":"Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae039144-2c02-4a00-9fff-f4e90a6a8236?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"4.10.0"}],"published":"2026-08-15T16:27:31Z","updated":"2026-08-16T05:27:30Z"},{"id":"wordfence:ae048156-f6a0-41c3-8853-ea439eac10a4","source":"wordfence","cve":"","title":"Power BI Embedded for WordPress <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae048156-f6a0-41c3-8853-ea439eac10a4?source=api-prod","affected":[{"type":"plugin","slug":"embed-power-bi","name":"Power BI Embedded for WordPress","from":"1.1.3","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae04e9f2-0260-44bd-9439-cabf9d00fc2c","source":"wordfence","cve":"CVE-2026-15644","title":"Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae04e9f2-0260-44bd-9439-cabf9d00fc2c?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-07-31T19:55:01Z","updated":"2026-08-01T08:32:28Z"},{"id":"wordfence:ae058c5b-b90b-4a1e-9f56-d56dbd2d3607","source":"wordfence","cve":"CVE-2019-25147","title":"Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae058c5b-b90b-4a1e-9f56-d56dbd2d3607?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":false,"patched_in":"2.1.10"}],"published":"2019-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae06f636-30ef-4c18-8d9d-3340a7856331","source":"wordfence","cve":"CVE-2026-9271","title":"KeepInMind - Dashboard Notes <= 0.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae06f636-30ef-4c18-8d9d-3340a7856331?source=api-prod","affected":[{"type":"plugin","slug":"keepinmind-dashboard-notes","name":"KeepInMind Dashboard Notes","from":"*","from_inclusive":true,"to":"0.8.4.1","to_inclusive":true,"patched_in":"0.8.4.2"}],"published":"2026-05-22T00:00:00Z","updated":"2026-09-18T14:50:55Z"},{"id":"wordfence:ae07af10-e5fc-4f28-a343-f56c0e2bc324","source":"wordfence","cve":"CVE-2024-13545","title":"Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae07af10-e5fc-4f28-a343-f56c0e2bc324?source=api-prod","affected":[{"type":"theme","slug":"bootstrap-ultimate","name":"Bootstrap Ultimate","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-23T19:34:21Z","updated":"2025-01-24T08:23:41Z"},{"id":"wordfence:ae07ca12-e827-43f9-8cbb-275b9abbd4c3","source":"wordfence","cve":"CVE-2024-50498","title":"WP Query Console <= 1.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae07ca12-e827-43f9-8cbb-275b9abbd4c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-query-console","name":"WP Query Console","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:40:14Z"},{"id":"wordfence:ae08900f-9e08-4297-a450-7174d0e3579a","source":"wordfence","cve":"CVE-2025-53300","title":"Podcast Feed Player Widget and Shortcode <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae08900f-9e08-4297-a450-7174d0e3579a?source=api-prod","affected":[{"type":"plugin","slug":"podcast-feed-player-widget","name":"Podcast Feed Player Widget and Shortcode","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:38:09Z"},{"id":"wordfence:ae0a001b-0792-4a32-8f49-5d4b1550f4be","source":"wordfence","cve":"CVE-2024-12589","title":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0a001b-0792-4a32-8f49-5d4b1550f4be?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.19.0","to_inclusive":true,"patched_in":"2.20.0"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T07:00:22Z"},{"id":"wordfence:ae0abace-9bf6-4ef9-a9b8-7efffbf25628","source":"wordfence","cve":"CVE-2025-13380","title":"AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0abace-9bf6-4ef9-a9b8-7efffbf25628?source=api-prod","affected":[{"type":"plugin","slug":"liquid-chatgpt","name":"AI Engine for WordPress: ChatGPT, GPT Content Generator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:08:21Z","updated":"2025-11-25T07:28:24Z"},{"id":"wordfence:ae0dd6b0-9028-456e-9843-d45754c01c53","source":"wordfence","cve":"CVE-2025-10637","title":"Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0dd6b0-9028-456e-9843-d45754c01c53?source=api-prod","affected":[{"type":"plugin","slug":"insta-gallery","name":"Social Feed Gallery","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2025-10-24T18:01:24Z","updated":"2025-10-25T06:49:24Z"},{"id":"wordfence:ae1161f4-89a0-45c7-ab7f-7255673e63cd","source":"wordfence","cve":"CVE-2026-18470","title":"Login & Register Forms <= 4.0.1 - Unauthenticated Registered User Email Address Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1161f4-89a0-45c7-ab7f-7255673e63cd?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-21T15:45:56Z"},{"id":"wordfence:ae12f71d-0f53-4942-83a7-856633e665ca","source":"wordfence","cve":"","title":"Plg Novana Plugin (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae12f71d-0f53-4942-83a7-856633e665ca?source=api-prod","affected":[{"type":"plugin","slug":"plg_novana","name":"Plg Novana","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae13dc61-c4bf-4b17-8055-98c80a853a2a","source":"wordfence","cve":"CVE-2025-7359","title":"Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block","severity":"high","cvss":8.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=api-prod","affected":[{"type":"plugin","slug":"counter-visitor-for-woocommerce","name":"Counter live visitors for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-07-15T18:17:09Z","updated":"2025-11-05T21:05:29Z"},{"id":"wordfence:ae13e0eb-b77c-4e9f-a5aa-caf2c67db7bc","source":"wordfence","cve":"CVE-2024-51785","title":"Responsive Filterable Portfolio <= 1.0.22 - Server-Side Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13e0eb-b77c-4e9f-a5aa-caf2c67db7bc?source=api-prod","affected":[{"type":"plugin","slug":"responsive-filterable-portfolio","name":"Responsive Filterable Portfolio Gallery \u2013 Media Grid & Video Portfolio","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:37:28Z"},{"id":"wordfence:ae14423e-7f39-44e4-bbf6-0d975e3f8345","source":"wordfence","cve":"CVE-2025-39580","title":"Dashi <= 3.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae14423e-7f39-44e4-bbf6-0d975e3f8345?source=api-prod","affected":[{"type":"plugin","slug":"dashi","name":"Dashi","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:05:24Z"},{"id":"wordfence:ae1820ab-6a24-45b3-801c-34c5515c8868","source":"wordfence","cve":"CVE-2015-9503","title":"Modern <= 1.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1820ab-6a24-45b3-801c-34c5515c8868?source=api-prod","affected":[{"type":"theme","slug":"modern","name":"Modern","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2015-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae1e198b-0c0d-47aa-8a56-ec4e790c8022","source":"wordfence","cve":"CVE-2026-3445","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae1e198b-0c0d-47aa-8a56-ec4e790c8022?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.11","to_inclusive":true,"patched_in":"4.16.12"}],"published":"2026-04-03T19:47:09Z","updated":"2026-04-04T08:25:21Z"},{"id":"wordfence:ae201118-bacf-4849-92f5-569cef57ee30","source":"wordfence","cve":"CVE-2023-25995","title":"AI Mortgage Calculator <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae201118-bacf-4849-92f5-569cef57ee30?source=api-prod","affected":[{"type":"plugin","slug":"ai-mortgage-calculator","name":"AI Mortgage Calculator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:17:41Z"},{"id":"wordfence:ae21be88-494f-4b24-95e1-97367d252cf7","source":"wordfence","cve":"CVE-2026-92767","title":"Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae21be88-494f-4b24-95e1-97367d252cf7?source=api-prod","affected":[{"type":"plugin","slug":"twenty20","name":"Twenty20 Image Before-After","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-10-02T18:40:29Z","updated":"2026-10-03T07:39:17Z"},{"id":"wordfence:ae23f287-e4bb-4f97-aebe-18b6d7ad4e58","source":"wordfence","cve":"CVE-2025-11373","title":"Popup and Slider Builder by Depicter \u2013 Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae23f287-e4bb-4f97-aebe-18b6d7ad4e58?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2025-11-04T17:49:44Z","updated":"2025-11-05T06:35:03Z"},{"id":"wordfence:ae243741-d402-489f-9044-9457baa4d61c","source":"wordfence","cve":"CVE-2026-93618","title":"JetTricks <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae243741-d402-489f-9044-9457baa4d61c?source=api-prod","affected":[{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-09-23T16:43:00Z","updated":"2026-09-29T20:02:28Z"},{"id":"wordfence:ae24c5d8-4171-4768-a2b7-444d81bc76c9","source":"wordfence","cve":"CVE-2025-46510","title":"Contact Form 7 Calendar <= 3.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae24c5d8-4171-4768-a2b7-444d81bc76c9?source=api-prod","affected":[{"type":"plugin","slug":"cf7-calendar","name":"Contact Form 7 Calendar","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:51:32Z"},{"id":"wordfence:ae25e3ad-0a9e-4688-8c2a-8f949a846211","source":"wordfence","cve":"CVE-2026-52714","title":"GEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae25e3ad-0a9e-4688-8c2a-8f949a846211?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.4.16","to_inclusive":true,"patched_in":"12.4.17"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T16:01:31Z"},{"id":"wordfence:ae2ac493-e6df-4083-8601-65635ad342b2","source":"wordfence","cve":"CVE-2025-12169","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae2ac493-e6df-4083-8601-65635ad342b2?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-11-20T16:58:00Z","updated":"2025-11-21T05:32:08Z"},{"id":"wordfence:ae2b6c4c-7dd6-41e7-8b8d-c09aa7fa660b","source":"wordfence","cve":"CVE-2026-97337","title":"Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae2b6c4c-7dd6-41e7-8b8d-c09aa7fa660b?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.8.4"}],"published":"2026-10-02T16:42:12Z","updated":"2026-10-03T05:29:17Z"},{"id":"wordfence:ae2e044e-444e-4328-8783-319cd01981b7","source":"wordfence","cve":"CVE-2024-13057","title":"Dyn Business Panel <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae2e044e-444e-4328-8783-319cd01981b7?source=api-prod","affected":[{"type":"plugin","slug":"dyn-business-panel","name":"Dyn Business Panel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:36:08Z"},{"id":"wordfence:ae302109-11fe-47f3-a972-54af39b0e1f7","source":"wordfence","cve":"CVE-2026-61984","title":"WPMobile.App <= 11.77 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae302109-11fe-47f3-a972-54af39b0e1f7?source=api-prod","affected":[{"type":"plugin","slug":"wpappninja","name":"WPMobile.App \u2013 Android and iOS App Builder","from":"*","from_inclusive":true,"to":"11.77","to_inclusive":true,"patched_in":"11.78"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:56:15Z"},{"id":"wordfence:ae31fb73-de38-4c30-9348-80373ed6e5cd","source":"wordfence","cve":"CVE-2015-9444","title":"Altos Connect <= 1.3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae31fb73-de38-4c30-9348-80373ed6e5cd?source=api-prod","affected":[{"type":"plugin","slug":"altos-connect","name":"Altos Connect","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2015-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae32cbbb-6903-44c7-9c54-82dadd2b4d9b","source":"wordfence","cve":"CVE-2026-92400","title":"Payment Gateway for PayPal on WooCommerce <= 9.2.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae32cbbb-6903-44c7-9c54-82dadd2b4d9b?source=api-prod","affected":[{"type":"plugin","slug":"woo-paypal-gateway","name":"Payment Gateway for PayPal on WooCommerce","from":"*","from_inclusive":true,"to":"9.2.0","to_inclusive":true,"patched_in":"9.2.1"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:51:32Z"},{"id":"wordfence:ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316","source":"wordfence","cve":"CVE-2023-2897","title":"Brizy Page Builder <= 2.4.18 - IP Address Spoofing to Protection Mechanism Bypass","severity":"low","cvss":3.7,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae342dd9-2f5f-4356-8fb4-9a3e5f4f8316?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.18","to_inclusive":true,"patched_in":"2.4.19"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae35a02c-ba33-478d-a054-98b486e2192a","source":"wordfence","cve":"CVE-2017-2168","title":"WP Booking System \u2013 Booking Calendar < 1.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae35a02c-ba33-478d-a054-98b486e2192a?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"},{"type":"plugin","slug":"wp-booking-system-premium","name":"WP Booking System \u2013 Booking Calendar Premium","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae363511-8a1f-476a-9851-61f7763428c2","source":"wordfence","cve":"CVE-2025-13964","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae363511-8a1f-476a-9851-61f7763428c2?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.2.1"}],"published":"2026-01-05T19:55:08Z","updated":"2026-01-06T08:21:49Z"},{"id":"wordfence:ae38ad06-1c8c-4454-b37a-40157f30eef9","source":"wordfence","cve":"CVE-2026-112825","title":"Car Rental Manager \u2013 Online Vehicle Booking System <= 1.5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae38ad06-1c8c-4454-b37a-40157f30eef9?source=api-prod","affected":[{"type":"plugin","slug":"car-rental-manager","name":"Car Rental Manager \u2013 Online Vehicle Booking System","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:35Z"},{"id":"wordfence:ae3974e6-cba1-4976-a6af-9e60557cfde8","source":"wordfence","cve":"CVE-2023-49184","title":"Parallax Slider Block <= 1.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae3974e6-cba1-4976-a6af-9e60557cfde8?source=api-prod","affected":[{"type":"plugin","slug":"parallax-slider-block","name":"Parallax Slider Block","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-11-29T00:00:00Z","updated":"2024-04-18T19:49:33Z"},{"id":"wordfence:ae397949-12d2-4323-871e-4fd4f14f35c6","source":"wordfence","cve":"CVE-2021-24936","title":"WP Extra File Types <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae397949-12d2-4323-871e-4fd4f14f35c6?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra-file-types","name":"WP Extra File Types","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.5.1"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae39fac4-6b65-42a6-bd34-c364922ef675","source":"wordfence","cve":"CVE-2024-29135","title":"Tourfic <= 2.11.15 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae39fac4-6b65-42a6-bd34-c364922ef675?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.11.15","to_inclusive":true,"patched_in":"2.11.16"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T15:01:54Z"},{"id":"wordfence:ae3d33dd-2591-4c4e-9769-77575e57ac49","source":"wordfence","cve":"CVE-2021-24515","title":"Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae3d33dd-2591-4c4e-9769-77575e57ac49?source=api-prod","affected":[{"type":"plugin","slug":"smart-grid-gallery","name":"Video Gallery \u2013 Vimeo and YouTube Gallery","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2021-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae3dd251-3415-4a7f-93d9-c0fe23b5ed31","source":"wordfence","cve":"CVE-2026-39491","title":"Jupiter X Core <= 4.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae3dd251-3415-4a7f-93d9-c0fe23b5ed31?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:05:01Z"},{"id":"wordfence:ae40fd4a-8448-48ea-9b31-067643972b44","source":"wordfence","cve":"CVE-2023-29437","title":"Connections Business Directory <= 10.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae40fd4a-8448-48ea-9b31-067643972b44?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"10.4.36","to_inclusive":true,"patched_in":"10.4.37"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae411d4f-1a23-47ac-8b84-fe7c01618bae","source":"wordfence","cve":"CVE-2025-22317","title":"Gallery Images Ape <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae411d4f-1a23-47ac-8b84-fe7c01618bae?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images-ape","name":"Gallery Images Ape","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:05:41Z"},{"id":"wordfence:ae42395f-703c-4cdb-9aa5-35ce9dfaeb16","source":"wordfence","cve":"CVE-2025-32183","title":"Video Playlist For YouTube <= 6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae42395f-703c-4cdb-9aa5-35ce9dfaeb16?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-for-youtube","name":"Video Playlist for YouTube","from":"*","from_inclusive":true,"to":"6.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T19:15:32Z"},{"id":"wordfence:ae42c063-3889-42e1-a5d6-1dc3f17bb2c9","source":"wordfence","cve":"CVE-2026-97257","title":"Simple Event Planner <= 1.5.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae42c063-3889-42e1-a5d6-1dc3f17bb2c9?source=api-prod","affected":[{"type":"plugin","slug":"simple-event-planner","name":"Simple Event Planner","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-10-03T18:40:06Z","updated":"2026-10-08T23:58:10Z"},{"id":"wordfence:ae42d8bf-d32e-4a95-a800-096ae7df1282","source":"wordfence","cve":"CVE-2026-96534","title":"Modern Events Calendar < 7.37.0 - Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae42d8bf-d32e-4a95-a800-096ae7df1282?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.37.0","to_inclusive":false,"patched_in":"7.37.0"},{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.37.0","to_inclusive":false,"patched_in":"7.37.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T17:13:28Z"},{"id":"wordfence:ae44ad5c-de2a-4217-978f-3c52c0bac55b","source":"wordfence","cve":"CVE-2025-30787","title":"EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.08 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae44ad5c-de2a-4217-978f-3c52c0bac55b?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"*","from_inclusive":true,"to":"5.25.08","to_inclusive":true,"patched_in":"5.25.10"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:43:12Z"},{"id":"wordfence:ae46be82-570f-4172-9c3f-746b894b84b9","source":"wordfence","cve":"CVE-2025-14998","title":"Branda \u2013 White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae46be82-570f-4172-9c3f-746b894b84b9?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.24","to_inclusive":true,"patched_in":"3.4.29"}],"published":"2026-01-01T13:29:04Z","updated":"2026-01-02T01:48:20Z"},{"id":"wordfence:ae46d949-eca0-4cd2-b458-229c027a6c3f","source":"wordfence","cve":"CVE-2025-22547","title":"JK Html To Pdf <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae46d949-eca0-4cd2-b458-229c027a6c3f?source=api-prod","affected":[{"type":"plugin","slug":"jk-html-to-pdf","name":"JK Html To Pdf","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:19:58Z"},{"id":"wordfence:ae46eea5-4b7a-4cf5-97ff-c65b7e8e3261","source":"wordfence","cve":"CVE-2021-24136","title":"Testimonials Widget <= 3.5.1 - Multiple Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae46eea5-4b7a-4cf5-97ff-c65b7e8e3261?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-widget","name":"Testimonials Widget","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae4a8e70-6b94-428f-8672-407dc4cd2f3f","source":"wordfence","cve":"CVE-2022-1761","title":"Peter\u2019s Collaboration E-mails <= 2.2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae4a8e70-6b94-428f-8672-407dc4cd2f3f?source=api-prod","affected":[{"type":"plugin","slug":"peters-collaboration-e-mails","name":"Peter\u2019s Collaboration E-mails","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae4c7354-b179-43d7-8a41-0f54dc855fd3","source":"wordfence","cve":"CVE-2026-25001","title":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae4c7354-b179-43d7-8a41-0f54dc855fd3?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":"4.0.13"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:10:28Z"},{"id":"wordfence:ae4d47b3-59c3-46d1-80c2-d11c98fb9b1e","source":"wordfence","cve":"CVE-2024-49242","title":"Digital Lottery <= 3.0.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae4d47b3-59c3-46d1-80c2-d11c98fb9b1e?source=api-prod","affected":[{"type":"plugin","slug":"digital-lottery","name":"Digital Lottery","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:19:50Z"},{"id":"wordfence:ae50aa5d-95e3-4650-9dbf-118b4ba3abda","source":"wordfence","cve":"CVE-2019-25296","title":"WP Cost Estimation <= 9.642 - Missing Authorization to Arbitrary File Upload/Delete","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae50aa5d-95e3-4650-9dbf-118b4ba3abda?source=api-prod","affected":[{"type":"plugin","slug":"wp-estimation-form","name":"WP Cost Estimation & Payment Forms Builder","from":"*","from_inclusive":true,"to":"9.644","to_inclusive":false,"patched_in":"9.644"}],"published":"2019-02-14T00:00:00Z","updated":"2026-01-08T02:21:17Z"},{"id":"wordfence:ae5121bd-2f3f-4d87-a2fd-d11bb9f8dc2c","source":"wordfence","cve":"CVE-2023-0500","title":"WP Film Studio <= 1.3.4 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5121bd-2f3f-4d87-a2fd-d11bb9f8dc2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-film-studio","name":"WP Film Studio \u2013 WordPress Movie Maker/Production Plugin","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae539ae0-c82a-4cee-8c1d-2d53a4deb7e9","source":"wordfence","cve":"CVE-2025-58947","title":"Athos <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae539ae0-c82a-4cee-8c1d-2d53a4deb7e9?source=api-prod","affected":[{"type":"theme","slug":"athos","name":"Athos - Orthodox Christian Church WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:36:02Z"},{"id":"wordfence:ae53b67a-1df9-499a-a232-cf7560a3cf02","source":"wordfence","cve":"CVE-2016-1000138","title":"Indexisto <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae53b67a-1df9-499a-a232-cf7560a3cf02?source=api-prod","affected":[{"type":"plugin","slug":"indexisto","name":"indexisto","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae5779cc-b55b-4b8f-ae66-8607a689ef72","source":"wordfence","cve":"CVE-2024-34382","title":"Robo Gallery <= 3.2.18 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5779cc-b55b-4b8f-ae66-8607a689ef72?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.18","to_inclusive":true,"patched_in":"3.2.19"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:29:20Z"},{"id":"wordfence:ae58e5b0-b587-4503-8519-c5a50245891a","source":"wordfence","cve":"CVE-2026-5957","title":"EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae58e5b0-b587-4503-8519-c5a50245891a?source=api-prod","affected":[{"type":"plugin","slug":"emailkit","name":"EmailKit \u2013 Email Customizer for WooCommerce & WP","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2026-05-04T14:47:21Z","updated":"2026-05-05T03:37:38Z"},{"id":"wordfence:ae5a3f77-dd89-411a-ae9c-ed25352db9bc","source":"wordfence","cve":"CVE-2026-84742","title":"The Events Calendar 6.15.0 - 6.17.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5a3f77-dd89-411a-ae9c-ed25352db9bc?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"6.15.0","from_inclusive":true,"to":"6.17.4.1","to_inclusive":true,"patched_in":"6.17.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:51:24Z"},{"id":"wordfence:ae5b4d81-c2f1-4d0d-b7b0-5556bf0451f5","source":"wordfence","cve":"CVE-2025-1323","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae5b4d81-c2f1-4d0d-b7b0-5556bf0451f5?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.10","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-03-07T20:57:25Z","updated":"2025-03-08T09:22:55Z"},{"id":"wordfence:ae603b13-dc09-4f83-8741-943d62615b3c","source":"wordfence","cve":"CVE-2025-13692","title":"Unlimited Elements For Elementor and  Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae603b13-dc09-4f83-8741-943d62615b3c?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor-premium","name":"Unlimited Elements for Elementor (Premium)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"},{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T13:53:15Z"},{"id":"wordfence:ae603d27-aea5-49d9-beab-db18746ffe87","source":"wordfence","cve":"CVE-2024-0236","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae603d27-aea5-49d9-beab-db18746ffe87?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:04:53Z"},{"id":"wordfence:ae643666-70cb-4eb4-a183-e1649264ded4","source":"wordfence","cve":"CVE-2023-1375","title":"WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae643666-70cb-4eb4-a183-e1649264ded4?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae66228e-d086-44fd-8acb-5a99482cedfb","source":"wordfence","cve":"CVE-2026-7493","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66228e-d086-44fd-8acb-5a99482cedfb?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.5","to_inclusive":true,"patched_in":"1.6.11.7"}],"published":"2026-05-26T13:07:06Z","updated":"2026-05-27T01:26:17Z"},{"id":"wordfence:ae66f460-ca84-49fb-9ef0-46bcca77996b","source":"wordfence","cve":"CVE-2024-9881","title":"LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66f460-ca84-49fb-9ef0-46bcca77996b?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.1","to_inclusive":true,"patched_in":"4.2.7.2"}],"published":"2024-11-21T00:00:00Z","updated":"2025-01-17T13:06:19Z"},{"id":"wordfence:ae66f4e3-b9ca-4b76-9ada-ee8500cee5b1","source":"wordfence","cve":"CVE-2025-53568","title":"Radio Station <= 2.5.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66f4e3-b9ca-4b76-9ada-ee8500cee5b1?source=api-prod","affected":[{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"*","from_inclusive":true,"to":"2.5.12","to_inclusive":true,"patched_in":"2.5.13"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:04:49Z"},{"id":"wordfence:ae67f620-81d8-4f5f-93cb-153cd5c2bd90","source":"wordfence","cve":"CVE-2011-4595","title":"Pretty Links \u2013 Link Management, Branding, Tracking & Sharing Plugin < 1.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae67f620-81d8-4f5f-93cb-153cd5c2bd90?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2011-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae68ab4f-d3a5-4287-9fe6-f8b1dfa59e77","source":"wordfence","cve":"CVE-2024-51598","title":"Selar.co Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68ab4f-d3a5-4287-9fe6-f8b1dfa59e77?source=api-prod","affected":[{"type":"plugin","slug":"selar-co-widget","name":"Selar.co Widget","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:14:04Z"},{"id":"wordfence:ae68d083-b6e2-409b-8c91-d4eb7e62dba9","source":"wordfence","cve":"CVE-2024-0624","title":"Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae68d083-b6e2-409b-8c91-d4eb7e62dba9?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.7","to_inclusive":true,"patched_in":"2.12.8"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:37:10Z"},{"id":"wordfence:ae6a00ef-1a3f-47cd-9e55-f28b74999198","source":"wordfence","cve":"CVE-2023-6048","title":"Estatik Real Estate Plugin <= 4.1.0 - Missing Authorization to Limited Arbitrary Options Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae6a00ef-1a3f-47cd-9e55-f28b74999198?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-12-25T00:00:00Z","updated":"2024-02-06T15:32:12Z"},{"id":"wordfence:ae6d07eb-3e64-45ee-ad5d-92b41ef11e43","source":"wordfence","cve":"CVE-2026-4790","title":"Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae6d07eb-3e64-45ee-ad5d-92b41ef11e43?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.70","to_inclusive":true,"patched_in":"4.11.71"}],"published":"2026-05-01T21:53:57Z","updated":"2026-05-02T11:16:11Z"},{"id":"wordfence:ae721d65-1593-4c73-b5cf-c13641927a56","source":"wordfence","cve":"CVE-2026-12517","title":"Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae721d65-1593-4c73-b5cf-c13641927a56?source=api-prod","affected":[{"type":"plugin","slug":"fediverse-embeds","name":"Fediverse Embeds","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:49:40Z"},{"id":"wordfence:ae735117-e68b-448e-ad41-258d1be3aebc","source":"wordfence","cve":"CVE-2024-1208","title":"LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae735117-e68b-448e-ad41-258d1be3aebc?source=api-prod","affected":[{"type":"plugin","slug":"sfwd-lms","name":"LearnDash LMS","from":"*","from_inclusive":true,"to":"4.10.2","to_inclusive":true,"patched_in":"4.10.3"}],"published":"2024-02-02T00:00:00Z","updated":"2026-03-10T16:30:07Z"},{"id":"wordfence:ae74048a-ea29-46cc-913b-86094640e88d","source":"wordfence","cve":"CVE-2015-9486","title":"Axioma Premium Responsive < 1.1.2 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae74048a-ea29-46cc-913b-86094640e88d?source=api-prod","affected":[{"type":"theme","slug":"axioma","name":"Axioma Premium Responsive","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae741363-b0aa-4263-bb49-d3baa213167a","source":"wordfence","cve":"CVE-2019-15832","title":"Visitor Traffic Real Time Statistics <= 1.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae741363-b0aa-4263-bb49-d3baa213167a?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae75196d-2128-4da8-a90b-a62454dcdbe9","source":"wordfence","cve":"CVE-2026-75977","title":"Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae75196d-2128-4da8-a90b-a62454dcdbe9?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2026-08-25T00:00:00Z","updated":"2026-08-26T07:42:01Z"},{"id":"wordfence:ae7549db-9a4b-4dee-8023-d7863dc3b4c8","source":"wordfence","cve":"CVE-2023-0708","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7549db-9a4b-4dee-8023-d7863dc3b4c8?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae768e43-9a77-4b00-bdac-f82c5dae5dd8","source":"wordfence","cve":"CVE-2025-47443","title":"Widget Countdown <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae768e43-9a77-4b00-bdac-f82c5dae5dd8?source=api-prod","affected":[{"type":"plugin","slug":"widget-countdown","name":"Countdown Timer \u2013 Widget Countdown","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:33:55Z"},{"id":"wordfence:ae77b00e-bbcf-4fe2-ab7f-d2e21ef54d3e","source":"wordfence","cve":"CVE-2018-6194","title":"Splashing Images < 2.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae77b00e-bbcf-4fe2-ab7f-d2e21ef54d3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-splashing-images","name":"Splashing Images","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2018-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae7c41fd-6ad6-49da-a213-686157e029d4","source":"wordfence","cve":"CVE-2023-25977","title":"CPT \u2013 Speakers <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7c41fd-6ad6-49da-a213-686157e029d4?source=api-prod","affected":[{"type":"plugin","slug":"cpt-speakers","name":"CPT \u2013 Speakers","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae7c5000-b816-4981-8953-ae053a41342b","source":"wordfence","cve":"CVE-2026-109688","title":"Link Whisper Free <= 0.9.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7c5000-b816-4981-8953-ae053a41342b?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2026-10-13T12:43:45Z","updated":"2026-10-23T18:26:02Z"},{"id":"wordfence:ae7d54a5-3952-4206-a5f4-be60aac27767","source":"wordfence","cve":"","title":"External Links <= 2.57 - Cross-Site Request Forgery via action_admin_action_wpel_dismiss_notice","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7d54a5-3952-4206-a5f4-be60aac27767?source=api-prod","affected":[{"type":"plugin","slug":"wp-external-links","name":"External Links \u2013 nofollow, noopener & new window","from":"*","from_inclusive":true,"to":"2.57","to_inclusive":true,"patched_in":"2.58"}],"published":"2023-03-08T00:00:00Z","updated":"2024-04-17T13:02:28Z"},{"id":"wordfence:ae7f76ef-3f97-4889-8902-f13a4a298475","source":"wordfence","cve":"CVE-2025-8867","title":"Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7f76ef-3f97-4889-8902-f13a4a298475?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-15T02:24:23Z"},{"id":"wordfence:ae7fa018-c87f-463b-84a3-bbe71b73d3dd","source":"wordfence","cve":"CVE-2024-47639","title":"VdoCipher <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7fa018-c87f-463b-84a3-bbe71b73d3dd?source=api-prod","affected":[{"type":"plugin","slug":"vdocipher","name":"VdoCipher: Secure Video Player and Hosting","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.30"}],"published":"2024-09-30T00:00:00Z","updated":"2024-11-25T20:39:44Z"},{"id":"wordfence:ae81917e-0367-4c64-9254-fd74751ada48","source":"wordfence","cve":"CVE-2022-45845","title":"Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae81917e-0367-4c64-9254-fd74751ada48?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.9","to_inclusive":true,"patched_in":"3.5.1.11"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae86441d-5a95-45a7-869a-9e7872365a1f","source":"wordfence","cve":"CVE-2026-111114","title":"Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae86441d-5a95-45a7-869a-9e7872365a1f?source=api-prod","affected":[{"type":"plugin","slug":"nexter-extension","name":"Nexter Extension \u2013 Security, Performance, Code Snippets & Site Toolkit","from":"*","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"4.7.12"}],"published":"2026-10-15T16:22:16Z","updated":"2026-10-16T04:27:03Z"},{"id":"wordfence:ae865f91-4c2a-4a6b-84a8-bd45c1febdb1","source":"wordfence","cve":"CVE-2022-47424","title":"ARMember <= 4.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae865f91-4c2a-4a6b-84a8-bd45c1febdb1?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae87b5fc-0fe5-4bc0-a18d-ea219865a0f3","source":"wordfence","cve":"CVE-2026-27375","title":"Gecko 6.0 - Responsive Shopify Theme - RTL support <= 1.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae87b5fc-0fe5-4bc0-a18d-ea219865a0f3?source=api-prod","affected":[{"type":"theme","slug":"gecko","name":"Gecko 6.0 - Responsive Shopify Theme - RTL support","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T14:45:58Z"},{"id":"wordfence:ae88e065-4601-4f0e-80a4-0f011bb0d347","source":"wordfence","cve":"CVE-2018-5661","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via logo_width parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae88e065-4601-4f0e-80a4-0f011bb0d347?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae8a316f-a9ad-451a-9892-cf5068072a78","source":"wordfence","cve":"","title":"Master Slider <= 2.7.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8a316f-a9ad-451a-9892-cf5068072a78?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2016-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae8c1d8e-8a87-4dd8-b7f5-c6655d3f6451","source":"wordfence","cve":"CVE-2026-86406","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 - 5.2.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8c1d8e-8a87-4dd8-b7f5-c6655d3f6451?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"4.4.6","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T20:12:17Z"},{"id":"wordfence:ae8c888e-46ed-468f-a5d5-74a7f9d01a36","source":"wordfence","cve":"CVE-2023-4820","title":"PowerPress <= 11.0.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Media URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8c888e-46ed-468f-a5d5-74a7f9d01a36?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.0.12","to_inclusive":false,"patched_in":"11.0.12"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae8dbf54-ea62-4901-b34f-079b708ca0b5","source":"wordfence","cve":"CVE-2023-0729","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8dbf54-ea62-4901-b34f-079b708ca0b5?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae8e245f-2458-4ffe-8e73-bed61331f39d","source":"wordfence","cve":"CVE-2022-0431","title":"Google Pagespeed Insights <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8e245f-2458-4ffe-8e73-bed61331f39d?source=api-prod","affected":[{"type":"plugin","slug":"google-pagespeed-insights","name":"Insights from Google PageSpeed","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":false,"patched_in":"4.0.4"}],"published":"2022-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae8f1852-2d67-4ed9-ab3d-5b3bf4083e06","source":"wordfence","cve":"CVE-2025-1662","title":"URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8f1852-2d67-4ed9-ab3d-5b3bf4083e06?source=api-prod","affected":[{"type":"plugin","slug":"url-media-uploader","name":"URL Media Uploader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-02-27T20:10:52Z","updated":"2025-03-03T15:29:44Z"},{"id":"wordfence:ae910382-cc5d-41e3-b2f4-e91367a5d086","source":"wordfence","cve":"CVE-2025-26975","title":"Strong Testimonials <= 3.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae910382-cc5d-41e3-b2f4-e91367a5d086?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:23:44Z"},{"id":"wordfence:ae920b3b-6c6f-46c5-b64f-c075a53b4c39","source":"wordfence","cve":"CVE-2024-3710","title":"Image Photo Gallery Final Tiles Grid <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae920b3b-6c6f-46c5-b64f-c075a53b4c39?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-08T13:18:40Z"},{"id":"wordfence:ae92bd0c-936c-4fae-8c0c-c94706568527","source":"wordfence","cve":"CVE-2013-5739","title":"WordPress Core < 3.6.1 - .swf and .exe File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae92bd0c-936c-4fae-8c0c-c94706568527?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":false,"patched_in":"3.6.1"}],"published":"2013-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae946184-5584-43d7-a493-022586e14312","source":"wordfence","cve":"CVE-2026-125781","title":"Event Post <= 6.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae946184-5584-43d7-a493-022586e14312?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:02Z"},{"id":"wordfence:ae970655-10a3-4917-a6d2-e9f8681c024f","source":"wordfence","cve":"CVE-2025-24560","title":"Awesome Event Booking <= 2.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae970655-10a3-4917-a6d2-e9f8681c024f?source=api-prod","affected":[{"type":"plugin","slug":"awesome-event-booking","name":"Awesome Event Booking","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-11-27T00:00:00Z","updated":"2025-02-20T16:04:18Z"},{"id":"wordfence:ae98e3bd-f663-4609-92ed-ed0431047d85","source":"wordfence","cve":"CVE-2023-25043","title":"Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae98e3bd-f663-4609-92ed-ed0431047d85?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.10.25","to_inclusive":true,"patched_in":"1.10.26"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae9b4d1f-d403-42e2-aaa0-be5459fba7a8","source":"wordfence","cve":"CVE-2024-51701","title":"MG Post Contributors <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9b4d1f-d403-42e2-aaa0-be5459fba7a8?source=api-prod","affected":[{"type":"plugin","slug":"mg-post-contributors","name":"MG Post Contributors","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:55:50Z"},{"id":"wordfence:ae9b5d77-32e8-4205-8f0a-5e53788674f0","source":"wordfence","cve":"CVE-2024-4005","title":"Social Pixel <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9b5d77-32e8-4205-8f0a-5e53788674f0?source=api-prod","affected":[{"type":"plugin","slug":"social-pixel","name":"Social Pixel","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:25:55Z"},{"id":"wordfence:ae9c421c-925b-4c2d-b3f5-781c54a85c2e","source":"wordfence","cve":"CVE-2025-46519","title":"Media Library Downloader <= 1.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9c421c-925b-4c2d-b3f5-781c54a85c2e?source=api-prod","affected":[{"type":"plugin","slug":"media-library-downloader","name":"Media Library Downloader","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:45:09Z"},{"id":"wordfence:ae9cd51f-e6c8-4aec-a044-376075e9540a","source":"wordfence","cve":"CVE-2021-24865","title":"Advanced Custom Fields: Extended <= 0.8.8.6 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9cd51f-e6c8-4aec-a044-376075e9540a?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.8.8.6","to_inclusive":true,"patched_in":"0.8.8.7"}],"published":"2021-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae9df4e5-b1d2-400b-89c7-eac5fbf2a8d5","source":"wordfence","cve":"CVE-2021-24350","title":"Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9df4e5-b1d2-400b-89c7-eac5fbf2a8d5?source=api-prod","affected":[{"type":"plugin","slug":"visitors-app","name":"Visitors","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ae9f4ca2-f138-452f-8311-a949177a9614","source":"wordfence","cve":"CVE-2026-107128","title":"Uncanny Toolkit for LearnDash <= 3.8.1 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9f4ca2-f138-452f-8311-a949177a9614?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:21:49Z"},{"id":"wordfence:ae9ff893-9a56-4e3b-805a-76ce48fb718f","source":"wordfence","cve":"CVE-2024-52426","title":"Linear <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ae9ff893-9a56-4e3b-805a-76ce48fb718f?source=api-prod","affected":[{"type":"plugin","slug":"linear","name":"Linear","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-11-13T00:00:00Z","updated":"2025-11-05T19:10:22Z"},{"id":"wordfence:aea03b8f-5779-430c-b081-79af314d0cda","source":"wordfence","cve":"CVE-2024-54332","title":"WP Currency Exchange Rates <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aea03b8f-5779-430c-b081-79af314d0cda?source=api-prod","affected":[{"type":"plugin","slug":"wp-currency-exchange-rates","name":"WP Currency Exchange Rates","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:10:57Z"},{"id":"wordfence:aea25da3-5d5b-4cee-ac96-466e30d21534","source":"wordfence","cve":"CVE-2026-110882","title":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aea25da3-5d5b-4cee-ac96-466e30d21534?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-10-15T18:20:00Z","updated":"2026-10-23T18:37:10Z"},{"id":"wordfence:aea5f970-243f-4642-83e1-34db11c4ca63","source":"wordfence","cve":"CVE-2024-10799","title":"Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aea5f970-243f-4642-83e1-34db11c4ca63?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T05:29:30Z"},{"id":"wordfence:aea8b35a-9a30-4ce6-b79c-2e0a079ac939","source":"wordfence","cve":"CVE-2025-32684","title":"MapSVG Lite <= 8.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aea8b35a-9a30-4ce6-b79c-2e0a079ac939?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":"8.6.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-12T18:27:50Z"},{"id":"wordfence:aeac9c4a-0754-4fb1-bf11-0cd8483451b6","source":"wordfence","cve":"CVE-2024-3216","title":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeac9c4a-0754-4fb1-bf11-0cd8483451b6?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T03:32:05Z"},{"id":"wordfence:aeacc3e5-020f-44b9-b412-c5a9114e0178","source":"wordfence","cve":"CVE-2018-5654","title":"Weblizar Pin Feeds < 1.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeacc3e5-020f-44b9-b412-c5a9114e0178?source=api-prod","affected":[{"type":"plugin","slug":"weblizar-pinterest-feeds","name":"Weblizar Pin Feeds","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aead557d-aec9-4218-9e5f-01b58432486f","source":"wordfence","cve":"CVE-2026-14280","title":"Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aead557d-aec9-4218-9e5f-01b58432486f?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.3.7.4","to_inclusive":true,"patched_in":"7.4"}],"published":"2026-08-24T14:29:48Z","updated":"2026-08-25T03:27:07Z"},{"id":"wordfence:aeada6dc-0851-45e8-ada9-ff0427b7f17a","source":"wordfence","cve":"CVE-2026-5711","title":"Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeada6dc-0851-45e8-ada9-ff0427b7f17a?source=api-prod","affected":[{"type":"plugin","slug":"bnm-blocks","name":"Post Blocks & Tools","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-04-08T09:11:09Z","updated":"2026-04-08T21:25:26Z"},{"id":"wordfence:aeaf4844-1ca4-45c1-847b-a06bf7202426","source":"wordfence","cve":"CVE-2025-23424","title":"Marquee Style RSS News Ticker <= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeaf4844-1ca4-45c1-847b-a06bf7202426?source=api-prod","affected":[{"type":"plugin","slug":"marquee-style-rss-news-ticker","name":"Marquee Style RSS News Ticker","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:23:03Z"},{"id":"wordfence:aeb57757-9f48-43cc-a8a8-787f0af1974c","source":"wordfence","cve":"CVE-2024-54276","title":"Poll Builder <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeb57757-9f48-43cc-a8a8-787f0af1974c?source=api-prod","affected":[{"type":"plugin","slug":"poll-builder","name":"Poll, Poll Forms \u2013 WordPress Poll plugin by Poll Builder","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:32:32Z"},{"id":"wordfence:aebdd464-10b9-4d43-bf38-f0e8ae25625f","source":"wordfence","cve":"CVE-2026-1667","title":"SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aebdd464-10b9-4d43-bf38-f0e8ae25625f?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"14.0.0","to_inclusive":true,"patched_in":"14.0.1"}],"published":"2026-07-10T04:12:19Z","updated":"2026-07-10T16:32:14Z"},{"id":"wordfence:aec279e9-0469-45c7-a332-2d7151e11639","source":"wordfence","cve":"CVE-2025-47595","title":"Color Your Bar <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aec279e9-0469-45c7-a332-2d7151e11639?source=api-prod","affected":[{"type":"plugin","slug":"color-your-bar","name":"Color Your Bar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:07:42Z"},{"id":"wordfence:aec4559a-4d96-49d3-8dc3-0210c78a798e","source":"wordfence","cve":"CVE-2026-27056","title":"Solid Central \u2013 Site Management, Backups, Security, and Reporting <= 3.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aec4559a-4d96-49d3-8dc3-0210c78a798e?source=api-prod","affected":[{"type":"plugin","slug":"ithemes-sync","name":"Kadence Central \u2013 Site Management, Backups, Security, and Reporting","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2026-01-11T00:00:00Z","updated":"2026-05-04T15:51:37Z"},{"id":"wordfence:aec4d370-58c0-466f-b3bb-9676fc744d96","source":"wordfence","cve":"CVE-2023-45275","title":"Contact Form builder with drag & drop - Kali Forms <= 2.3.28 - Missing Authorization via get_log","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aec4d370-58c0-466f-b3bb-9676fc744d96?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.3.28","to_inclusive":true,"patched_in":"2.3.29"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aec57fbd-83c5-4080-9372-66500c299afc","source":"wordfence","cve":"CVE-2023-23972","title":"Social Like Box and Page by WpDevArt <= 0.8.39 - Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aec57fbd-83c5-4080-9372-66500c299afc?source=api-prod","affected":[{"type":"plugin","slug":"like-box","name":"Social Like Box and Page by WpDevArt","from":"*","from_inclusive":true,"to":"0.8.39","to_inclusive":true,"patched_in":"0.8.40"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aec7b59f-1c8a-4403-b33b-c119bd96ad9d","source":"wordfence","cve":"CVE-2022-4533","title":"Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aec7b59f-1c8a-4403-b33b-c119bd96ad9d?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-plus","name":"Limit Login Attempts Plus \u2013 WordPress Limit Login Attempts By Felix","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-18T00:00:00Z","updated":"2024-09-19T03:59:15Z"},{"id":"wordfence:aeceaf36-824e-45bf-a7c8-6ed13e2435dd","source":"wordfence","cve":"CVE-2025-58973","title":"Easy Elementor Addons <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeceaf36-824e-45bf-a7c8-6ed13e2435dd?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:02:36Z"},{"id":"wordfence:aecf2d55-b174-4b28-b762-962b60c62ea7","source":"wordfence","cve":"CVE-2025-53564","title":"HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aecf2d55-b174-4b28-b762-962b60c62ea7?source=api-prod","affected":[{"type":"plugin","slug":"lbg_radio_player_addon_visual_composer","name":"HTML5 Radio Player - WPBakery Page Builder Addon","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:37:23Z"},{"id":"wordfence:aecf61bc-4d89-41ba-b99f-669193be64d1","source":"wordfence","cve":"CVE-2024-38719","title":"Auto Featured Image (Auto Post Thumbnail) <= 4.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aecf61bc-4d89-41ba-b99f-669193be64d1?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-07-11T00:00:00Z","updated":"2025-09-25T18:24:44Z"},{"id":"wordfence:aecfea73-97fc-48c3-bf1b-5314077739b5","source":"wordfence","cve":"CVE-2026-75891","title":"Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aecfea73-97fc-48c3-bf1b-5314077739b5?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-10-26T18:03:23Z","updated":"2026-10-27T06:40:42Z"},{"id":"wordfence:aed02958-9397-4116-a46a-babc43997afd","source":"wordfence","cve":"CVE-2024-10858","title":"Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed02958-9397-4116-a46a-babc43997afd?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"13.0","from_inclusive":true,"to":"14.0","to_inclusive":true,"patched_in":"14.1"}],"published":"2024-12-04T00:00:00Z","updated":"2025-01-17T13:22:40Z"},{"id":"wordfence:aed2ec57-2475-4e77-8219-399cf769ba5a","source":"wordfence","cve":"","title":"Watu Quiz 3.1.2.1 - 3.1.2.5 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed2ec57-2475-4e77-8219-399cf769ba5a?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"3.1.2.1","from_inclusive":true,"to":"3.1.2.5","to_inclusive":true,"patched_in":"3.1.2.6"}],"published":"2019-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aed40456-43c3-4647-9bce-e7c6139c84cd","source":"wordfence","cve":"CVE-2025-6381","title":"BeeTeam368 Extensions <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed40456-43c3-4647-9bce-e7c6139c84cd?source=api-prod","affected":[{"type":"plugin","slug":"beeteam368-extensions","name":"BeeTeam368 Extensions","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-06-27T14:26:26Z","updated":"2025-06-28T03:21:59Z"},{"id":"wordfence:aed52b9a-c94b-4928-b865-fd490aeec099","source":"wordfence","cve":"CVE-2026-107126","title":"WP Booking System \u2013 Booking Calendar < 2.1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed52b9a-c94b-4928-b865-fd490aeec099?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.1","to_inclusive":false,"patched_in":"2.1.0.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:37:27Z"},{"id":"wordfence:aed630d4-7f8b-4b42-8209-aa8a536349da","source":"wordfence","cve":"CVE-2025-49344","title":"SensitiveTagCloud <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed630d4-7f8b-4b42-8209-aa8a536349da?source=api-prod","affected":[{"type":"plugin","slug":"sensitive-tag-cloud","name":"SensitiveTagCloud","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:16:44Z"},{"id":"wordfence:aed90a59-9b66-4332-bb71-d738b1469156","source":"wordfence","cve":"CVE-2024-3996","title":"Post Grid, Post Carousel, & List Category Posts <= 2.4.27 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aed90a59-9b66-4332-bb71-d738b1469156?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2024-04-04T00:00:00Z","updated":"2024-07-17T11:45:10Z"},{"id":"wordfence:aeda43bc-eeee-463d-80b7-dec7975b4d19","source":"wordfence","cve":"CVE-2024-11825","title":"Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeda43bc-eeee-463d-80b7-dec7975b4d19?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.51.0","to_inclusive":true,"patched_in":"1.51.1"}],"published":"2025-01-24T18:41:57Z","updated":"2025-01-30T15:34:36Z"},{"id":"wordfence:aedb424a-9346-4bf9-8ce2-50f12bfc1fb7","source":"wordfence","cve":"CVE-2025-69366","title":"Emerce Core <= 1.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aedb424a-9346-4bf9-8ce2-50f12bfc1fb7?source=api-prod","affected":[{"type":"plugin","slug":"emerce-core","name":"Emerce - Multipurpose WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:06:22Z"},{"id":"wordfence:aedde7a7-018d-45f9-8f67-f4ea01be894e","source":"wordfence","cve":"CVE-2026-6962","title":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aedde7a7-018d-45f9-8f67-f4ea01be894e?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-05-12T15:52:09Z","updated":"2026-05-13T04:26:44Z"},{"id":"wordfence:aee08b01-ca5d-464d-94ed-66a05261670d","source":"wordfence","cve":"CVE-2025-22526","title":"PHP/MySQL CPU performance statistics <= 1.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee08b01-ca5d-464d-94ed-66a05261670d?source=api-prod","affected":[{"type":"plugin","slug":"mywebtonet-performancestats","name":"PHP/MySQL CPU performance statistics","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-14T00:00:00Z","updated":"2025-03-25T19:42:25Z"},{"id":"wordfence:aee1d4ea-a740-4015-9167-200ed1e2564c","source":"wordfence","cve":"CVE-2025-24674","title":"ShMapper by Teplitsa <= 1.5.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee1d4ea-a740-4015-9167-200ed1e2564c?source=api-prod","affected":[{"type":"plugin","slug":"shmapper-by-teplitsa","name":"ShMapper by Teplitsa","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:53:25Z"},{"id":"wordfence:aee4fb6f-8ee6-4d6e-8167-876c9453f78f","source":"wordfence","cve":"CVE-2016-10885","title":"WP Editor < 1.2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee4fb6f-8ee6-4d6e-8167-876c9453f78f?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2016-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aee587cf-83c6-46ab-89a2-20d7e76e1e8b","source":"wordfence","cve":"CVE-2026-25014","title":"Enter Addons <= 2.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee587cf-83c6-46ab-89a2-20d7e76e1e8b?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:02:46Z"},{"id":"wordfence:aee59a8f-7f21-4572-b146-ab1b6350ddb1","source":"wordfence","cve":"","title":"WP Hide & Security Enhancer <= 1.3.9.2 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee59a8f-7f21-4572-b146-ab1b6350ddb1?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-security-enhancer","name":"WP Hide & Security Enhancer","from":"*","from_inclusive":true,"to":"1.3.9.2","to_inclusive":true,"patched_in":"1.4"}],"published":"2017-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aee6fea2-dbf6-4155-ba3f-f85ea3520504","source":"wordfence","cve":"","title":"Beautiful Cookie Consent Banner <= 2.10.0 - Missing Authorization to Settings Update","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee6fea2-dbf6-4155-ba3f-f85ea3520504?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-and-responsive-cookie-consent","name":"Beautiful Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aee79aa4-cb40-4a9c-a5f5-c22c5be509c0","source":"wordfence","cve":"CVE-2025-23592","title":"dForms <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee79aa4-cb40-4a9c-a5f5-c22c5be509c0?source=api-prod","affected":[{"type":"plugin","slug":"dforms","name":"dForms","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:12:58Z"},{"id":"wordfence:aee900ab-fbb4-461f-90a9-c01c8d1a5f35","source":"wordfence","cve":"CVE-2024-51572","title":"LH QR Codes <= 1.06 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee900ab-fbb4-461f-90a9-c01c8d1a5f35?source=api-prod","affected":[{"type":"plugin","slug":"lh-qr-codes","name":"LH QR Codes","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:54:21Z"},{"id":"wordfence:aee963fa-26b5-4bf0-b52f-095c67fb4834","source":"wordfence","cve":"CVE-2024-13555","title":"1 Click WordPress Migration Plugin \u2013 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aee963fa-26b5-4bf0-b52f-095c67fb4834?source=api-prod","affected":[{"type":"plugin","slug":"1-click-migration","name":"1-Click WordPress Migration Plugin \u2013 Backup, Migrate & Clone","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-02-17T15:40:14Z","updated":"2025-11-06T15:32:53Z"},{"id":"wordfence:aeeaa3ef-02b8-46aa-a479-543b01a82a83","source":"wordfence","cve":"CVE-2026-103319","title":"OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeeaa3ef-02b8-46aa-a479-543b01a82a83?source=api-prod","affected":[{"type":"plugin","slug":"opay-payment-gateway-for-woocommerce","name":"OPay Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:13:32Z"},{"id":"wordfence:aeee2aa6-060e-4f4e-8547-44b2bd4e823e","source":"wordfence","cve":"CVE-2025-48155","title":"Residential Address Detection <= 2.5.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aeee2aa6-060e-4f4e-8547-44b2bd4e823e?source=api-prod","affected":[{"type":"plugin","slug":"residential-address-detection","name":"Residential Address Detection","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:23:32Z"},{"id":"wordfence:aef312be-85d6-45e7-a34f-7f7cc415df3b","source":"wordfence","cve":"CVE-2022-3849","title":"WP User Merger <= 1.5.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aef312be-85d6-45e7-a34f-7f7cc415df3b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-merger","name":"WP User Merger","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aef36e3c-90a0-4e88-8f36-13f56e9a5cec","source":"wordfence","cve":"CVE-2025-46263","title":"Author Box After Posts <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aef36e3c-90a0-4e88-8f36-13f56e9a5cec?source=api-prod","affected":[{"type":"plugin","slug":"author-box-after-posts","name":"Author Box After Posts","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:00:28Z"},{"id":"wordfence:aef56a34-b98e-4759-bd3f-37fb6f8b18e9","source":"wordfence","cve":"CVE-2025-23745","title":"Call me Now <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aef56a34-b98e-4759-bd3f-37fb6f8b18e9?source=api-prod","affected":[{"type":"plugin","slug":"call-me-now","name":"WordPress Call me Now","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:46:12Z"},{"id":"wordfence:aef584bd-60a5-4bf2-b8d3-58e3b45e785e","source":"wordfence","cve":"CVE-2024-7031","title":"File Manager Pro \u2013 Filester <= 1.8.2 - Authenticated Plugin Settings Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aef584bd-60a5-4bf2-b8d3-58e3b45e785e?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-03T08:36:58Z"},{"id":"wordfence:aefa868e-64ee-4852-bdbc-2de118b9e991","source":"wordfence","cve":"CVE-2025-22684","title":"WP BASE Booking <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aefa868e-64ee-4852-bdbc-2de118b9e991?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:48:00Z"},{"id":"wordfence:aefb192a-ed42-44a9-bbd1-5906909a419c","source":"wordfence","cve":"CVE-2025-2935","title":"Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aefb192a-ed42-44a9-bbd1-5906909a419c?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2024.7","to_inclusive":true,"patched_in":"2025"}],"published":"2025-06-05T17:43:52Z","updated":"2025-10-17T19:44:27Z"},{"id":"wordfence:aefb7e34-ec48-4e29-b3aa-85901e12d21c","source":"wordfence","cve":"CVE-2022-41980","title":"Mantenimiento web <= 0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aefb7e34-ec48-4e29-b3aa-85901e12d21c?source=api-prod","affected":[{"type":"plugin","slug":"mantenimiento-web","name":"Mantenimiento web","from":"*","from_inclusive":true,"to":"0.13","to_inclusive":true,"patched_in":"0.14"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aefbebce-9433-455d-b27c-93088b0c8494","source":"wordfence","cve":"","title":"LeadSnap <= 1.23 - Unauthenticated PHP Object Injection via AJAX","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aefbebce-9433-455d-b27c-93088b0c8494?source=api-prod","affected":[{"type":"plugin","slug":"leadsnap","name":"LeadSnap","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.24"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aefbf8d9-093b-4aaf-8a38-148a0b74ca1a","source":"wordfence","cve":"CVE-2026-22462","title":"Add Polylang support for Customizer <= 1.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aefbf8d9-093b-4aaf-8a38-148a0b74ca1a?source=api-prod","affected":[{"type":"plugin","slug":"add-polylang-support-for-customizer","name":"Add Polylang support for Customizer","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-04T00:00:00Z","updated":"2026-01-14T19:28:25Z"},{"id":"wordfence:af008739-3b75-4e79-ac4a-3829986b7bf0","source":"wordfence","cve":"CVE-2025-48129","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af008739-3b75-4e79-ac4a-3829986b7bf0?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-09-18T14:34:58Z"},{"id":"wordfence:af01964f-018d-4d19-8627-8889877db105","source":"wordfence","cve":"CVE-2026-12472","title":"Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af01964f-018d-4d19-8627-8889877db105?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-07-01T19:59:21Z","updated":"2026-07-02T08:33:07Z"},{"id":"wordfence:af01cba6-40df-4eb9-beec-4716909a671b","source":"wordfence","cve":"CVE-2026-42411","title":"CloudSecure WP Security <= 1.4.7 - Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af01cba6-40df-4eb9-beec-4716909a671b?source=api-prod","affected":[{"type":"plugin","slug":"cloudsecure-wp-security","name":"CloudSecure WP Security","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:29:13Z"},{"id":"wordfence:af053fdc-e40c-4dfa-8d16-09c72d839031","source":"wordfence","cve":"CVE-2023-6067","title":"WP User Profile Avatar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af053fdc-e40c-4dfa-8d16-09c72d839031?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profile-avatar","name":"WP User Profile Avatar","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-09-10T19:32:31Z"},{"id":"wordfence:af0579f3-09f8-46cc-9ba8-647a8ec83076","source":"wordfence","cve":"CVE-2023-23865","title":"Stripe Payments For WooCommerce by Checkout Plugins <= 1.4.10 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af0579f3-09f8-46cc-9ba8-647a8ec83076?source=api-prod","affected":[{"type":"plugin","slug":"checkout-plugins-stripe-woo","name":"Stripe Payments For WooCommerce by Checkout Plugins","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af063570-43f7-4bf4-850c-21c3bff40ac1","source":"wordfence","cve":"CVE-2025-7782","title":"WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'","severity":"high","cvss":7.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af063570-43f7-4bf4-850c-21c3bff40ac1?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T01:30:15Z","updated":"2025-12-20T13:47:44Z"},{"id":"wordfence:af06ed29-00a0-4741-be69-44554156615b","source":"wordfence","cve":"CVE-2024-52451","title":"Post Ideas <= 2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af06ed29-00a0-4741-be69-44554156615b?source=api-prod","affected":[{"type":"plugin","slug":"post-ideas","name":"Post Ideas","from":"*","from_inclusive":true,"to":"2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T15:37:27Z"},{"id":"wordfence:af075ffe-553a-4351-a696-5c678788f3b9","source":"wordfence","cve":"","title":"Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af075ffe-553a-4351-a696-5c678788f3b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.9.3.3","to_inclusive":true,"patched_in":"4.9.3.4"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af076acb-f0a8-4f47-bfa6-74e20759f764","source":"wordfence","cve":"CVE-2025-54673","title":"Chartify <= 3.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af076acb-f0a8-4f47-bfa6-74e20759f764?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:01:29Z"},{"id":"wordfence:af08532a-c269-4568-b673-9f66d4384e35","source":"wordfence","cve":"","title":"MailPoet \u2013 Newsletters, Email Marketing, and Automation < 5.14.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af08532a-c269-4568-b673-9f66d4384e35?source=api-prod","affected":[{"type":"plugin","slug":"mailpoet","name":"MailPoet \u2013 Newsletters, Email Marketing, and Automation","from":"*","from_inclusive":true,"to":"5.14.2","to_inclusive":false,"patched_in":"5.14.2"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T18:20:11Z"},{"id":"wordfence:af085fb0-fdad-4a60-aa15-6d0fe19c2074","source":"wordfence","cve":"CVE-2026-83592","title":"Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af085fb0-fdad-4a60-aa15-6d0fe19c2074?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-db-for-enfold","name":"Contact Form DB for Enfold","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:18:46Z","updated":"2026-10-14T03:40:05Z"},{"id":"wordfence:af0c1007-faeb-4341-ba55-4c337f274992","source":"wordfence","cve":"CVE-2026-10083","title":"APCu Manager <= 4.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af0c1007-faeb-4341-ba55-4c337f274992?source=api-prod","affected":[{"type":"plugin","slug":"apcu-manager","name":"APCu Manager","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-06-08T00:00:00Z","updated":"2026-09-18T14:54:57Z"},{"id":"wordfence:af0cc02a-b6dd-4058-b686-9c9a3a4a5962","source":"wordfence","cve":"CVE-2024-11331","title":"isee-products-extractor <= 2.1.3 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af0cc02a-b6dd-4058-b686-9c9a3a4a5962?source=api-prod","affected":[{"type":"plugin","slug":"isee-products-extractor","name":"\u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0628\u0631\u0627\u06cc \u0622\u06cc\u0633\u06cc","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-12-19T18:34:32Z","updated":"2024-12-24T16:03:58Z"},{"id":"wordfence:af0e3e7c-580c-4367-bda5-e94c1f7e8e65","source":"wordfence","cve":"CVE-2026-25305","title":"XStore <= 9.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af0e3e7c-580c-4367-bda5-e94c1f7e8e65?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6.4","to_inclusive":true,"patched_in":"9.6.5"}],"published":"2026-01-18T00:00:00Z","updated":"2026-05-04T15:10:06Z"},{"id":"wordfence:af0eae51-fb94-4e2e-a9a6-8ba323bb3314","source":"wordfence","cve":"CVE-2019-15773","title":"Travel Management <= 1.6.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af0eae51-fb94-4e2e-a9a6-8ba323bb3314?source=api-prod","affected":[{"type":"plugin","slug":"nd-travel","name":"Travel Management","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.7"}],"published":"2019-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af1060c6-9247-4059-ad6e-993fb7cee6d4","source":"wordfence","cve":"CVE-2026-100196","title":"LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af1060c6-9247-4059-ad6e-993fb7cee6d4?source=api-prod","affected":[{"type":"plugin","slug":"rocket-lazy-load","name":"LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-09T17:33:54Z","updated":"2026-10-10T06:40:14Z"},{"id":"wordfence:af1075a5-9efa-4b86-9798-6dbafcba4db5","source":"wordfence","cve":"CVE-2024-2258","title":"Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af1075a5-9efa-4b86-9798-6dbafcba4db5?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.24","to_inclusive":true,"patched_in":"1.15.25"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-27T03:44:32Z"},{"id":"wordfence:af12c836-a0ab-4d64-8921-61980edf47e7","source":"wordfence","cve":"CVE-2025-22826","title":"Sell Digital Downloads <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af12c836-a0ab-4d64-8921-61980edf47e7?source=api-prod","affected":[{"type":"plugin","slug":"sell-digital-downloads","name":"Sell Digital Downloads","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:03:46Z"},{"id":"wordfence:af138d3c-9f43-4346-bcb5-cb408f10b253","source":"wordfence","cve":"CVE-2025-64214","title":"MasterStudy LMS Pro < 4.7.16 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af138d3c-9f43-4346-bcb5-cb408f10b253?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.16","to_inclusive":false,"patched_in":"4.7.16"}],"published":"2025-10-12T00:00:00Z","updated":"2025-12-20T19:05:16Z"},{"id":"wordfence:af141e60-5b21-4343-8fac-e489844816cb","source":"wordfence","cve":"CVE-2026-94271","title":"Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af141e60-5b21-4343-8fac-e489844816cb?source=api-prod","affected":[{"type":"plugin","slug":"deema-payment-gateway","name":"Deema Payment Gateway","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:50:25Z"},{"id":"wordfence:af14ed79-f92d-4573-88ba-d2ef7b2e0a05","source":"wordfence","cve":"CVE-2026-40745","title":"Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af14ed79-f92d-4573-88ba-d2ef7b2e0a05?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.4.2","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-05-07T14:02:19Z"},{"id":"wordfence:af15ae80-dbce-4899-9604-82fdca222bf5","source":"wordfence","cve":"CVE-2025-4337","title":"AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=api-prod","affected":[{"type":"plugin","slug":"ahathat","name":"AHAthat Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-05T15:46:13Z","updated":"2025-05-06T04:24:12Z"},{"id":"wordfence:af1796b7-64b4-4198-9ba4-8a77a0f1cf02","source":"wordfence","cve":"CVE-2014-4540","title":"Oleggo LiveStream <= 0.2.6 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af1796b7-64b4-4198-9ba4-8a77a0f1cf02?source=api-prod","affected":[{"type":"plugin","slug":"oleggo-livestream","name":"Oleggo LiveStream","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af181085-0a6b-4e87-b250-1fb4574d808d","source":"wordfence","cve":"CVE-2025-11867","title":"Bg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af181085-0a6b-4e87-b250-1fb4574d808d?source=api-prod","affected":[{"type":"plugin","slug":"bg-book-publisher","name":"Bg Book Publisher","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:20:51Z","updated":"2025-10-22T08:27:09Z"},{"id":"wordfence:af187180-0f10-4fc0-8376-0e224a44d7eb","source":"wordfence","cve":"CVE-2026-59517","title":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder <= 4.0.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af187180-0f10-4fc0-8376-0e224a44d7eb?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":"4.0.13"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:41:10Z"},{"id":"wordfence:af18f38a-f3cb-46ae-9409-80e35c34df83","source":"wordfence","cve":"CVE-2026-19800","title":"Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af18f38a-f3cb-46ae-9409-80e35c34df83?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2026-09-08T14:34:11Z","updated":"2026-09-09T03:28:49Z"},{"id":"wordfence:af19fab8-e7d3-4b63-ba8d-c8ce7c173793","source":"wordfence","cve":"CVE-2026-101159","title":"Ultimate Review <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af19fab8-e7d3-4b63-ba8d-c8ce7c173793?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:09:48Z"},{"id":"wordfence:af1e638d-9fc8-4584-a138-8d6316fbfcad","source":"wordfence","cve":"CVE-2026-12037","title":"Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af1e638d-9fc8-4584-a138-8d6316fbfcad?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.4.0.5","to_inclusive":true,"patched_in":"1.4.0.6"}],"published":"2026-09-24T19:03:35Z","updated":"2026-09-25T07:40:29Z"},{"id":"wordfence:af2115ba-5573-41ce-8d5a-58c57c65c75a","source":"wordfence","cve":"CVE-2026-78088","title":"Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload  via 'baseUrlForFacebook' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af2115ba-5573-41ce-8d5a-58c57c65c75a?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"32.0.1","to_inclusive":true,"patched_in":"33.0.0"}],"published":"2026-09-15T15:10:45Z","updated":"2026-09-16T03:28:19Z"},{"id":"wordfence:af22365c-7d4b-48f3-b33d-d627169fda6f","source":"wordfence","cve":"CVE-2022-3609","title":"GetYourGuide Ticketing <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af22365c-7d4b-48f3-b33d-d627169fda6f?source=api-prod","affected":[{"type":"plugin","slug":"getyourguide-ticketing","name":"GetYourGuide Ticketing","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2022-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af229339-3e4a-4fd9-84b8-2b7d9bb09806","source":"wordfence","cve":"CVE-2026-57321","title":"Interactive Content \u2013 H5P <= 1.17.7 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af229339-3e4a-4fd9-84b8-2b7d9bb09806?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.17.7","to_inclusive":true,"patched_in":"1.17.8"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:35:54Z"},{"id":"wordfence:af25ba65-31bd-4836-a7fd-e229094c2c73","source":"wordfence","cve":"CVE-2026-96345","title":"Estatik Real Estate Plugin <= 4.3.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af25ba65-31bd-4836-a7fd-e229094c2c73?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:58:03Z"},{"id":"wordfence:af2645cc-aa96-45b4-8f22-16d02224cb3b","source":"wordfence","cve":"CVE-2026-27344","title":"Scientific and Interactive Blocks \u2013 inseri core <= 1.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af2645cc-aa96-45b4-8f22-16d02224cb3b?source=api-prod","affected":[{"type":"plugin","slug":"inseri-core","name":"Scientific and Interactive Blocks \u2013 inseri core","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:41:31Z"},{"id":"wordfence:af287dc4-a82a-4ccf-8878-6f9591fa5d33","source":"wordfence","cve":"CVE-2025-69026","title":"PopupKit <= 2.1.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af287dc4-a82a-4ccf-8878-6f9591fa5d33?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-12-29T00:00:00Z","updated":"2026-05-05T18:30:23Z"},{"id":"wordfence:af29ec92-5b07-4f57-a25f-19f3a894a193","source":"wordfence","cve":"CVE-2025-4566","title":"Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af29ec92-5b07-4f57-a25f-19f3a894a193?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.30.2","to_inclusive":true,"patched_in":"3.30.3"}],"published":"2025-07-28T16:22:11Z","updated":"2025-07-29T04:23:46Z"},{"id":"wordfence:af2b7eac-a3f5-408f-b139-643e70b3f27a","source":"wordfence","cve":"CVE-2023-6220","title":"Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af2b7eac-a3f5-408f-b139-643e70b3f27a?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2023-12-04T00:00:00Z","updated":"2024-02-23T15:54:22Z"},{"id":"wordfence:af2d004f-fa9e-4e26-a1e3-03fb31cb95c4","source":"wordfence","cve":"","title":"Ultimate Membership Pro <= 8.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af2d004f-fa9e-4e26-a1e3-03fb31cb95c4?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"8.6.2","to_inclusive":false,"patched_in":"8.6.2"}],"published":"2020-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af3105ed-d383-4ce6-9317-5762f97b14e3","source":"wordfence","cve":"CVE-2024-33652","title":"Client Dash <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af3105ed-d383-4ce6-9317-5762f97b14e3?source=api-prod","affected":[{"type":"plugin","slug":"client-dash","name":"Client Dash","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:43:24Z"},{"id":"wordfence:af343eab-8327-4b13-91b9-f58535014d47","source":"wordfence","cve":"CVE-2025-1203","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider <= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af343eab-8327-4b13-91b9-f58535014d47?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.94.0","to_inclusive":true,"patched_in":"3.95.0"}],"published":"2025-03-02T00:00:00Z","updated":"2025-04-07T20:22:45Z"},{"id":"wordfence:af343f4d-8e0f-463f-bc5f-e48c6d6d11f7","source":"wordfence","cve":"CVE-2026-57805","title":"Tonda <= 2.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af343f4d-8e0f-463f-bc5f-e48c6d6d11f7?source=api-prod","affected":[{"type":"theme","slug":"tonda","name":"Tonda - Elegant Shop WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:52:19Z"},{"id":"wordfence:af36719a-8f7d-46dc-a697-cfcbb08e45e2","source":"wordfence","cve":"CVE-2026-4070","title":"Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af36719a-8f7d-46dc-a697-cfcbb08e45e2?source=api-prod","affected":[{"type":"plugin","slug":"alfie-the-productfeedtool-wp-plugin","name":"Alfie \u2013 Feed Plugin","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-21T16:12:35Z","updated":"2026-05-22T04:29:04Z"},{"id":"wordfence:af3675c9-3a6b-4139-85e8-2fc57f290e82","source":"wordfence","cve":"CVE-2025-0958","title":"Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af3675c9-3a6b-4139-85e8-2fc57f290e82?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-03-03T20:35:04Z","updated":"2025-03-04T09:22:52Z"},{"id":"wordfence:af37b5ab-e7ff-4a2a-98c3-decdf238a13f","source":"wordfence","cve":"CVE-2024-35674","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af37b5ab-e7ff-4a2a-98c3-decdf238a13f?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.109","to_inclusive":true,"patched_in":"1.5.110"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-13T14:47:53Z"},{"id":"wordfence:af37f301-d97f-47d3-b6a8-88cb41344541","source":"wordfence","cve":"CVE-2021-34646","title":"Booster for WooCommerce <= 5.4.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af37f301-d97f-47d3-b6a8-88cb41344541?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2021-08-24T15:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af387cb8-583f-4bc6-9de7-fc03fd12d01a","source":"wordfence","cve":"CVE-2025-53990","title":"JetFormBuilder <= 3.5.1.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af387cb8-583f-4bc6-9de7-fc03fd12d01a?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.5.1.2","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:07:48Z"},{"id":"wordfence:af39e563-5d88-460d-b02d-1aaa111c89dd","source":"wordfence","cve":"CVE-2024-2460","title":"GamiPress \u2013 Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af39e563-5d88-460d-b02d-1aaa111c89dd?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-button","name":"GamiPress \u2013 Button","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T02:35:42Z"},{"id":"wordfence:af3c8ea5-0af8-492b-920d-858bf23ca6f0","source":"wordfence","cve":"CVE-2024-25923","title":"Community by PeepSo <= 6.2.7.0 - Unauthenticated Sensitive Information Disclosure via Log file","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af3c8ea5-0af8-492b-920d-858bf23ca6f0?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.2.7.0","to_inclusive":true,"patched_in":"6.2.7.1"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T19:52:02Z"},{"id":"wordfence:af3ee18f-187f-4205-956b-74dacfd1ea3d","source":"wordfence","cve":"CVE-2025-31395","title":"Easy Custom CSS <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af3ee18f-187f-4205-956b-74dacfd1ea3d?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-css","name":"Easy custom css by webriti","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:29:52Z"},{"id":"wordfence:af4058cd-79bc-433c-96e1-fb0aad12969c","source":"wordfence","cve":"","title":"WP OER <= 0.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4058cd-79bc-433c-96e1-fb0aad12969c?source=api-prod","affected":[{"type":"plugin","slug":"wp-oer","name":"WP OER","from":"*","from_inclusive":true,"to":"0.9.0","to_inclusive":true,"patched_in":"0.9.1"}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af40f0e4-96cf-4eac-842b-6df6279cab44","source":"wordfence","cve":"CVE-2026-28163","title":"New User Approve <= 3.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af40f0e4-96cf-4eac-842b-6df6279cab44?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:17:34Z"},{"id":"wordfence:af420213-039b-41a4-b177-4035fc727867","source":"wordfence","cve":"CVE-2013-4340","title":"WordPress Core < 3.6.1 - Spoof Post Authorship","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af420213-039b-41a4-b177-4035fc727867?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2013-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af453072-5fc6-44c8-885d-735e5ce30da4","source":"wordfence","cve":"CVE-2026-97319","title":"PowerPress <= 11.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af453072-5fc6-44c8-885d-735e5ce30da4?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.17.1","to_inclusive":true,"patched_in":"11.17.2"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T20:12:02Z"},{"id":"wordfence:af45560e-2e75-42fd-9f34-74ed9d150a3c","source":"wordfence","cve":"CVE-2026-112854","title":"Holistic Center <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af45560e-2e75-42fd-9f34-74ed9d150a3c?source=api-prod","affected":[{"type":"theme","slug":"holistic-center","name":"Holistic Center | Wellness & Spa Salon PSD Template","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T16:57:50Z"},{"id":"wordfence:af455697-59da-488e-82fe-bb0fad65a810","source":"wordfence","cve":"CVE-2019-25060","title":"WPGraphQL <= 0.3.4 - Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af455697-59da-488e-82fe-bb0fad65a810?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":"0.3.5"}],"published":"2019-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af459f28-a058-42d3-8818-43603c6a14eb","source":"wordfence","cve":"CVE-2026-77233","title":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af459f28-a058-42d3-8818-43603c6a14eb?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.13.4","to_inclusive":true,"patched_in":"3.13.5"}],"published":"2026-09-04T17:22:50Z","updated":"2026-09-05T05:30:56Z"},{"id":"wordfence:af468138-c10a-4f9b-b714-0425d52f0210","source":"wordfence","cve":"CVE-2024-12042","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)","severity":"medium","cvss":5.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af468138-c10a-4f9b-b714-0425d52f0210?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.16.4","to_inclusive":true,"patched_in":"4.16.5"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:51Z"},{"id":"wordfence:af468f83-d6ad-474c-bf7f-c4eeb6df1b54","source":"wordfence","cve":"CVE-2023-4386","title":"Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af468f83-d6ad-474c-bf7f-c4eeb6df1b54?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks-pro","name":"Essential Blocks Pro","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af478e73-a2b8-468a-9075-9c1db1a97d7c","source":"wordfence","cve":"CVE-2023-36503","title":"MaxButtons <= 9.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af478e73-a2b8-468a-9075-9c1db1a97d7c?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.5.3","to_inclusive":true,"patched_in":"9.6"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af48906b-f7b2-45ec-b0c1-1ac521106759","source":"wordfence","cve":"CVE-2023-4290","title":"WP Matterport Shortcode <= 2.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af48906b-f7b2-45ec-b0c1-1ac521106759?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-gallery-for-matterport-showcase","name":"Matterport Shortcode","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af4a21b4-9032-4c57-a762-6ad8ba772c63","source":"wordfence","cve":"CVE-2025-22543","title":"ST Gallery WP <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4a21b4-9032-4c57-a762-6ad8ba772c63?source=api-prod","affected":[{"type":"plugin","slug":"st-gallery-wp","name":"ST Gallery WP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:57:59Z"},{"id":"wordfence:af4b659b-6a14-46bc-9ffe-6f118c6b1e8d","source":"wordfence","cve":"CVE-2024-5630","title":"Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4b659b-6a14-46bc-9ffe-6f118c6b1e8d?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000023","to_inclusive":true,"patched_in":"4.3000000024"}],"published":"2024-06-24T00:00:00Z","updated":"2024-08-02T13:59:45Z"},{"id":"wordfence:af4bd5f6-4f0e-4035-8544-48154a05cef1","source":"wordfence","cve":"CVE-2026-6674","title":"Plugin: CMS f\u00fcr Motorrad Werkst\u00e4tten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4bd5f6-4f0e-4035-8544-48154a05cef1?source=api-prod","affected":[{"type":"plugin","slug":"cms-fuer-motorrad-werkstaetten","name":"Plugin: CMS f\u00fcr Motorrad Werkst\u00e4tten","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-20T14:05:55Z","updated":"2026-04-21T02:25:40Z"},{"id":"wordfence:af4f513e-5e28-429c-972c-7e1e4637916d","source":"wordfence","cve":"CVE-2024-49667","title":"Local Business Addons For Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4f513e-5e28-429c-972c-7e1e4637916d?source=api-prod","affected":[{"type":"plugin","slug":"map-addons-for-elementor-waze-map","name":"Local Business Addons For Elementor (Formally Waze Map)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:03:14Z"},{"id":"wordfence:af4fdab3-18d1-4dc4-991c-24c4fdb6cb2a","source":"wordfence","cve":"CVE-2025-62038","title":"MeetingHub <= 1.23.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af4fdab3-18d1-4dc4-991c-24c4fdb6cb2a?source=api-prod","affected":[{"type":"plugin","slug":"meetinghub","name":"Booking for Appointments and Events Calendar with Zoom, Google Meet, Microsoft Teams, Webex, Jitsi \u2013 MeetingHub","from":"*","from_inclusive":true,"to":"1.23.9","to_inclusive":true,"patched_in":"1.23.10"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:03:37Z"},{"id":"wordfence:af54654b-60af-446d-b170-ee0a1ebed22c","source":"wordfence","cve":"CVE-2025-12362","title":"myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af54654b-60af-446d-b170-ee0a1ebed22c?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.7.1"}],"published":"2025-12-12T17:05:13Z","updated":"2025-12-13T05:42:41Z"},{"id":"wordfence:af55c470-b94d-49ee-8b72-44652dcccd73","source":"wordfence","cve":"CVE-2023-7290","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af55c470-b94d-49ee-8b72-44652dcccd73?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:41Z"},{"id":"wordfence:af55ea6c-01f6-4c87-91bb-a0ff98e92256","source":"wordfence","cve":"CVE-2024-53818","title":"PostX <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af55ea6c-01f6-4c87-91bb-a0ff98e92256?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.16"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:04:08Z"},{"id":"wordfence:af568eea-59ce-467e-ba03-625d04d3db6e","source":"wordfence","cve":"CVE-2025-0215","title":"UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af568eea-59ce-467e-ba03-625d04d3db6e?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.24.12","to_inclusive":true,"patched_in":"1.25.1"}],"published":"2025-01-15T09:43:13Z","updated":"2025-01-15T22:23:32Z"},{"id":"wordfence:af580e5a-a9da-4516-b612-b544dc73cf23","source":"wordfence","cve":"CVE-2025-14278","title":"HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af580e5a-a9da-4516-b612-b544dc73cf23?source=api-prod","affected":[{"type":"plugin","slug":"ht-slider-for-elementor","name":"HT Slider For Elementor","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-12-12T14:55:22Z","updated":"2025-12-13T03:20:25Z"},{"id":"wordfence:af59102e-f029-4c7d-95ee-16b9dcef4827","source":"wordfence","cve":"","title":"Broadscope (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af59102e-f029-4c7d-95ee-16b9dcef4827?source=api-prod","affected":[{"type":"theme","slug":"broadscope","name":"Broadscope","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af59eb6d-1ffa-4593-9bfc-f910d907f6e0","source":"wordfence","cve":"CVE-2022-47164","title":"Event Manager for WooCommerce <= 3.7.7 - Cross-Site Request Forgery leading to Uninstall Form Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af59eb6d-1ffa-4593-9bfc-f910d907f6e0?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.7.7","to_inclusive":true,"patched_in":"3.7.8"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af59fcf6-4435-45f0-8904-ff520ea86157","source":"wordfence","cve":"CVE-2023-27615","title":"WP Super Minify <= 1.5.1 - Cross-Site Request Forgery via 'wpsmy_admin_options'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af59fcf6-4435-45f0-8904-ff520ea86157?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-minify","name":"WP Super Minify \u2022 Minify, Compress and Cache HTML, CSS & JavaScript","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af5a58d1-946a-451b-bc8b-a397345ae89a","source":"wordfence","cve":"","title":"Ecwid Ecommerce Shopping Cart <= 4.4.3 - Unauthenticated PHP Object injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af5a58d1-946a-451b-bc8b-a397345ae89a?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2016-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af5eb3cd-f527-4b4e-a02e-699155f27b0d","source":"wordfence","cve":"CVE-2024-52444","title":"Opal Woo Custom Product Variation <= 1.1.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af5eb3cd-f527-4b4e-a02e-699155f27b0d?source=api-prod","affected":[{"type":"plugin","slug":"opal-woo-custom-product-variation","name":"Opal Woo Custom Product Variation","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:51:28Z"},{"id":"wordfence:af5ed47e-f183-4e72-a916-15020e2bc91e","source":"wordfence","cve":"CVE-2024-9314","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af5ed47e-f183-4e72-a916-15020e2bc91e?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.228","to_inclusive":true,"patched_in":"1.0.229"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T11:21:20Z"},{"id":"wordfence:af650c7a-c413-4f4a-9e4b-8ddcd8da5397","source":"wordfence","cve":"CVE-2024-3197","title":"The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af650c7a-c413-4f4a-9e4b-8ddcd8da5397?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:52:31Z"},{"id":"wordfence:af67a544-daff-469f-a66b-e998b79b7845","source":"wordfence","cve":"CVE-2025-10647","title":"Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af67a544-daff-469f-a66b-e998b79b7845?source=api-prod","affected":[{"type":"plugin","slug":"embed-pdf-wpforms","name":"Embed PDF for WPForms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-09-18T19:35:54Z","updated":"2025-09-19T08:23:58Z"},{"id":"wordfence:af695224-24e7-4d5b-b472-dee53eb6073f","source":"wordfence","cve":"CVE-2023-25481","title":"Podlove Subscribe button <= 1.3.7 - Cross-Site Request Forgery via process_form function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af695224-24e7-4d5b-b472-dee53eb6073f?source=api-prod","affected":[{"type":"plugin","slug":"podlove-subscribe-button","name":"Podlove Subscribe button","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af6a7052-6dab-42f0-a2af-0cf459d309d7","source":"wordfence","cve":"CVE-2026-7693","title":"Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af6a7052-6dab-42f0-a2af-0cf459d309d7?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.5.2"}],"published":"2026-08-04T18:04:28Z","updated":"2026-08-05T06:37:59Z"},{"id":"wordfence:af6b7cba-56cc-4e78-a3c1-228eecb98120","source":"wordfence","cve":"CVE-2024-32517","title":"Custom Thank You Page Customize For WooCommerce by Binary Carpenter <= 1.4.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af6b7cba-56cc-4e78-a3c1-228eecb98120?source=api-prod","affected":[{"type":"plugin","slug":"bc-woo-custom-thank-you-pages","name":"Custom Thank You Page Customize For WooCommerce by Binary Carpenter","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T13:36:32Z"},{"id":"wordfence:af6bd2db-47a4-4381-a881-d5f97a159f8d","source":"wordfence","cve":"CVE-2023-4153","title":"BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af6bd2db-47a4-4381-a881-d5f97a159f8d?source=api-prod","affected":[{"type":"plugin","slug":"ban-users","name":"BAN Users","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af6c1d79-b33e-4f5e-a6c6-9827cba5dda6","source":"wordfence","cve":"CVE-2025-67472","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af6c1d79-b33e-4f5e-a6c6-9827cba5dda6?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-11-12T00:00:00Z","updated":"2025-12-11T16:42:58Z"},{"id":"wordfence:af6c82e7-3161-47e6-b22e-c931d2126428","source":"wordfence","cve":"CVE-2025-62748","title":"Web and WooCommerce Addons for WPBakery Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af6c82e7-3161-47e6-b22e-c931d2126428?source=api-prod","affected":[{"type":"plugin","slug":"vc-addons-by-bit14","name":"Web and WooCommerce Addons for WPBakery Builder","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:33:55Z"},{"id":"wordfence:af7062ef-c8a8-4d3e-bc59-8451b2e89fb2","source":"wordfence","cve":"CVE-2024-51840","title":"Wd-image-magnifier-xoss <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7062ef-c8a8-4d3e-bc59-8451b2e89fb2?source=api-prod","affected":[{"type":"plugin","slug":"wd-image-magnifier-xoss","name":"Wd-image-magnifier-xoss","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:20:45Z"},{"id":"wordfence:af70b4ed-fe6f-4baa-aa29-45dcd95ca25d","source":"wordfence","cve":"CVE-2026-22496","title":"Hypnotherapy - Psychologist Theme <= 1.2.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af70b4ed-fe6f-4baa-aa29-45dcd95ca25d?source=api-prod","affected":[{"type":"theme","slug":"hypnotherapy","name":"Hypnotherapy - Psychologist Theme","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:14:28Z"},{"id":"wordfence:af7163da-79b3-45df-a33c-01367205bb6f","source":"wordfence","cve":"CVE-2015-4615","title":"Easy2Map Photos <= 1.0.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7163da-79b3-45df-a33c-01367205bb6f?source=api-prod","affected":[{"type":"plugin","slug":"easy2map-photos","name":"Easy2Map Photos","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2015-06-08T00:00:00Z","updated":"2024-02-07T13:59:49Z"},{"id":"wordfence:af718d65-9f8f-4ed8-80ed-e7ed34169016","source":"wordfence","cve":"CVE-2023-23701","title":"Easy Sign Up <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af718d65-9f8f-4ed8-80ed-e7ed34169016?source=api-prod","affected":[{"type":"plugin","slug":"easy-sign-up","name":"Easy Sign Up","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af71ca13-781d-49ca-948c-03d52d91d11b","source":"wordfence","cve":"CVE-2013-10021","title":"Debug Bar  <= 0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af71ca13-781d-49ca-948c-03d52d91d11b?source=api-prod","affected":[{"type":"plugin","slug":"debug-bar","name":"Debug Bar","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":"0.8.1"}],"published":"2013-05-15T00:00:00Z","updated":"2024-02-07T14:47:21Z"},{"id":"wordfence:af73240c-b711-4e91-9998-5f7e6a9a4fb9","source":"wordfence","cve":"CVE-2023-2717","title":"Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af73240c-b711-4e91-9998-5f7e6a9a4fb9?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.9.8","to_inclusive":true,"patched_in":"2.7.10"}],"published":"2023-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af7345f9-6f62-424b-b02d-c145a90508ae","source":"wordfence","cve":"","title":"WordPress Zero Spam <= 2.1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7345f9-6f62-424b-b02d-c145a90508ae?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2016-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af742451-b2d6-445a-9a10-e950490f6c7c","source":"wordfence","cve":"CVE-2024-4656","title":"Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af742451-b2d6-445a-9a10-e950490f6c7c?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.6.1","to_inclusive":true,"patched_in":"1.26.7"}],"published":"2024-05-14T12:07:47Z","updated":"2024-05-15T01:56:55Z"},{"id":"wordfence:af757e6b-cbb3-4efd-8c83-99a03dee2311","source":"wordfence","cve":"CVE-2026-115346","title":"Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af757e6b-cbb3-4efd-8c83-99a03dee2311?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.16.2","to_inclusive":true,"patched_in":"7.16.4"}],"published":"2026-10-30T16:12:57Z","updated":"2026-10-30T17:15:31Z"},{"id":"wordfence:af76e32b-ba7d-4eaa-97c8-ed6a25e8f387","source":"wordfence","cve":"CVE-2024-24931","title":"Before After Image Slider WP <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af76e32b-ba7d-4eaa-97c8-ed6a25e8f387?source=api-prod","affected":[{"type":"plugin","slug":"before-after-image-slider","name":"Before After Image Slider WP","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T17:07:41Z"},{"id":"wordfence:af77d642-d383-48f2-a59a-3a9c738cd47f","source":"wordfence","cve":"","title":"WordPress Core 6.3 - 6.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af77d642-d383-48f2-a59a-3a9c738cd47f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af78ee37-17e8-4e03-a0dc-fc779e718e78","source":"wordfence","cve":"CVE-2025-50048","title":"Automatically Hierarchic Categories in Menu <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af78ee37-17e8-4e03-a0dc-fc779e718e78?source=api-prod","affected":[{"type":"plugin","slug":"automatically-hierarchic-categories-in-menu","name":"Automatically Hierarchic Categories in Menu","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-10T15:00:35Z"},{"id":"wordfence:af7adacf-7189-401f-b7c9-845eb328ca76","source":"wordfence","cve":"","title":"WPvivid Backup 0.9.76 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7adacf-7189-401f-b7c9-845eb328ca76?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"0.9.76","from_inclusive":true,"to":"0.9.76","to_inclusive":true,"patched_in":"0.9.77"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af7d2a1a-963d-416d-a0ec-21fa49e255ea","source":"wordfence","cve":"CVE-2026-110179","title":"affiliate-toolkit <= 3.8.8 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7d2a1a-963d-416d-a0ec-21fa49e255ea?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:31:58Z"},{"id":"wordfence:af7d935b-05a2-4eaa-af98-4e6a88abab46","source":"wordfence","cve":"CVE-2018-6357","title":"Social Media Widget by Acurax <= 3.2.5 - Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7d935b-05a2-4eaa-af98-4e6a88abab46?source=api-prod","affected":[{"type":"plugin","slug":"acurax-social-media-widget","name":"Social Media Widget by Acurax","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"}],"published":"2018-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af7dbb61-90b1-4a61-819e-bcef88b12b7f","source":"wordfence","cve":"CVE-2025-9515","title":"Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7dbb61-90b1-4a61-819e-bcef88b12b7f?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.25","to_inclusive":true,"patched_in":"1.7.26"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T02:24:17Z"},{"id":"wordfence:af7dc118-775f-471a-a2f9-49d6d77bd84c","source":"wordfence","cve":"CVE-2026-39510","title":"Image Photo Gallery Final Tiles Grid <= 3.6.11 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7dc118-775f-471a-a2f9-49d6d77bd84c?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.11","to_inclusive":true,"patched_in":"3.6.12"}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T15:12:57Z"},{"id":"wordfence:af7f5e86-3e88-4fb1-942d-f755ae60f088","source":"wordfence","cve":"CVE-2025-39594","title":"Arigato Autoresponder and Newsletter <= 2.7.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af7f5e86-3e88-4fb1-942d-f755ae60f088?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.2.4","to_inclusive":true,"patched_in":"2.7.2.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:15:27Z"},{"id":"wordfence:af803612-96ae-41ee-8ad3-8f9319b147e8","source":"wordfence","cve":"CVE-2023-25443","title":"Button Generator \u2013 easily Button Builder <= 2.3.5 - Cross-Site Request Forgery in tools-data-base.php","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af803612-96ae-41ee-8ad3-8f9319b147e8?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af830ff1-5906-4765-a136-aef39caf7469","source":"wordfence","cve":"CVE-2025-26998","title":"SKT Blocks \u2013 Gutenberg based Page Builder <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af830ff1-5906-4765-a136-aef39caf7469?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:45:54Z"},{"id":"wordfence:af838653-d575-48fc-bded-f0068a6c6ebf","source":"wordfence","cve":"CVE-2013-6342","title":"Tweet Blender <= 4.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af838653-d575-48fc-bded-f0068a6c6ebf?source=api-prod","affected":[{"type":"plugin","slug":"tweet-blender","name":"Tweet Blender","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af870e80-ad9e-4f45-952f-9ffb07ceca9c","source":"wordfence","cve":"CVE-2024-32686","title":"Backup Migration <= 1.4.3 - Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af870e80-ad9e-4f45-952f-9ffb07ceca9c?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-24T13:27:42Z"},{"id":"wordfence:af871d3d-2dc0-49c3-a697-2635e4aa8f70","source":"wordfence","cve":"CVE-2025-62039","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.6.6 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af871d3d-2dc0-49c3-a697-2635e4aa8f70?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:16:56Z"},{"id":"wordfence:af88a631-c4ec-47ec-ad9b-1ef38ea1be09","source":"wordfence","cve":"CVE-2026-2719","title":"Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af88a631-c4ec-47ec-ad9b-1ef38ea1be09?source=api-prod","affected":[{"type":"plugin","slug":"private-wp-suite","name":"Private WP suite","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:15:55Z","updated":"2026-04-22T07:45:40Z"},{"id":"wordfence:af89b15f-d920-4245-aa91-acdc2e8f4a0f","source":"wordfence","cve":"CVE-2026-22457","title":"Wanderland - Travel Blog <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af89b15f-d920-4245-aa91-acdc2e8f4a0f?source=api-prod","affected":[{"type":"theme","slug":"wanderland","name":"Wanderland - Travel Blog","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-05T14:20:34Z"},{"id":"wordfence:af8bee01-15bc-485e-8b01-8b68b199b34d","source":"wordfence","cve":"CVE-2024-1276","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af8bee01-15bc-485e-8b01-8b68b199b34d?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"5.9.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-05-31T15:30:52Z"},{"id":"wordfence:af90aef0-fd96-43ff-8400-09bd5cebed28","source":"wordfence","cve":"","title":"WP-EMail < 2.67.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af90aef0-fd96-43ff-8400-09bd5cebed28?source=api-prod","affected":[{"type":"plugin","slug":"wp-email","name":"WP-EMail","from":"*","from_inclusive":true,"to":"2.67.2","to_inclusive":false,"patched_in":"2.67.2"}],"published":"2016-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af913bb1-eff6-47cd-9471-f74bafda1e52","source":"wordfence","cve":"CVE-2026-16587","title":"Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af913bb1-eff6-47cd-9471-f74bafda1e52?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2026-07-27T16:35:52Z","updated":"2026-07-28T05:39:44Z"},{"id":"wordfence:af933be6-0a9c-4744-9de9-b70a07f037d5","source":"wordfence","cve":"CVE-2026-19722","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af933be6-0a9c-4744-9de9-b70a07f037d5?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.133","to_inclusive":false,"patched_in":"0.9.133"}],"published":"2026-08-30T00:00:00Z","updated":"2026-09-01T20:32:48Z"},{"id":"wordfence:af93f4f5-4c6d-4178-b7f7-c66c341bde87","source":"wordfence","cve":"CVE-2023-46608","title":"DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af93f4f5-4c6d-4178-b7f7-c66c341bde87?source=api-prod","affected":[{"type":"plugin","slug":"dologin","name":"DoLogin Security","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.8"}],"published":"2023-10-24T00:00:00Z","updated":"2024-03-22T15:21:16Z"},{"id":"wordfence:af955f69-b18c-446e-b05e-6a57a5f16dfa","source":"wordfence","cve":"CVE-2023-2159","title":"CMP \u2013 Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af955f69-b18c-446e-b05e-6a57a5f16dfa?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:af96119c-e542-4922-bf5e-b063449ec587","source":"wordfence","cve":"CVE-2025-58922","title":"Avada < 7.13.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af96119c-e542-4922-bf5e-b063449ec587?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.13.2","to_inclusive":false,"patched_in":"7.13.2"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T14:54:49Z"},{"id":"wordfence:af97a8aa-f42b-46c8-b79b-d1c3220fdf58","source":"wordfence","cve":"CVE-2026-39570","title":"12 Step Meeting List <= 3.19.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af97a8aa-f42b-46c8-b79b-d1c3220fdf58?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.19.9","to_inclusive":true,"patched_in":"3.19.10"}],"published":"2026-03-22T00:00:00Z","updated":"2026-05-05T15:10:31Z"},{"id":"wordfence:af99651a-2975-4985-a7de-bdd8ab0d92d0","source":"wordfence","cve":"CVE-2025-31623","title":"Rich Text Editor <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af99651a-2975-4985-a7de-bdd8ab0d92d0?source=api-prod","affected":[{"type":"plugin","slug":"richtexteditor","name":"Rich Text Editor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:15:47Z"},{"id":"wordfence:af9ad801-3c5c-4fb2-9fd7-a4eafae5012c","source":"wordfence","cve":"CVE-2025-46491","title":"Multi-Column Taxonomy List <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af9ad801-3c5c-4fb2-9fd7-a4eafae5012c?source=api-prod","affected":[{"type":"plugin","slug":"multi-column-taxonomy-list","name":"Multi-Column Taxonomy List","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:36:00Z"},{"id":"wordfence:af9adb6b-f726-4b74-be5c-82fdab0ae1f2","source":"wordfence","cve":"CVE-2024-1449","title":"Master Slider \u2013 Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af9adb6b-f726-4b74-be5c-82fdab0ae1f2?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2024-03-01T00:00:00Z","updated":"2024-09-30T14:40:24Z"},{"id":"wordfence:af9ce573-88e7-488c-92c6-faae685c7035","source":"wordfence","cve":"CVE-2025-58869","title":"SimaCookie <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af9ce573-88e7-488c-92c6-faae685c7035?source=api-prod","affected":[{"type":"plugin","slug":"simasicher-dsgvo-cookie","name":"SimaCookie","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:18:32Z"},{"id":"wordfence:af9e9e8e-2a07-477e-b840-8f7dd8883caa","source":"wordfence","cve":"CVE-2024-44039","title":"WP Travel <= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/af9e9e8e-2a07-477e-b840-8f7dd8883caa?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"9.3.1","to_inclusive":true,"patched_in":"9.4.0"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T20:02:38Z"},{"id":"wordfence:afa44a28-2368-4c52-b234-309476526290","source":"wordfence","cve":"CVE-2024-54248","title":"eewee admin custom <= 1.8.2.4 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afa44a28-2368-4c52-b234-309476526290?source=api-prod","affected":[{"type":"plugin","slug":"eewee-admincustom","name":"eewee admin custom","from":"*","from_inclusive":true,"to":"1.8.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:34:23Z"},{"id":"wordfence:afa90746-2932-44fe-baf0-c251b5a063f3","source":"wordfence","cve":"CVE-2026-24974","title":"Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afa90746-2932-44fe-baf0-c251b5a063f3?source=api-prod","affected":[{"type":"theme","slug":"noo-citilights","name":"Support for CitiLights - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:09:57Z"},{"id":"wordfence:afb032da-11cc-4272-be68-60b6ca6e6ca3","source":"wordfence","cve":"","title":"Image Slider by Ays- Responsive Slider and Carousel <= 2.4.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb032da-11cc-4272-be68-60b6ca6e6ca3?source=api-prod","affected":[{"type":"plugin","slug":"ays-slider","name":"Image Slider by Ays- Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afb2bef8-a9aa-46a2-8966-85b35ea9cfa6","source":"wordfence","cve":"CVE-2026-84927","title":"EmbedPress \u2013 PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb2bef8-a9aa-46a2-8966-85b35ea9cfa6?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"4.6.0","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:55:20Z"},{"id":"wordfence:afb3e0e0-68c7-43f6-981f-59c3f3507429","source":"wordfence","cve":"CVE-2025-6585","title":"WP JobHunt <= 7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Account Deletion","severity":"high","cvss":8.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e0e0-68c7-43f6-981f-59c3f3507429?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T15:58:03Z","updated":"2025-10-31T16:40:14Z"},{"id":"wordfence:afb3e2f8-ba44-48fc-9882-d9bcd39676ee","source":"wordfence","cve":"","title":"Upscale (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e2f8-ba44-48fc-9882-d9bcd39676ee?source=api-prod","affected":[{"type":"theme","slug":"upscale","name":"Upscale","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afb3e68e-6f79-4c46-b41e-8fd6eb43c755","source":"wordfence","cve":"CVE-2024-2287","title":"Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e68e-6f79-4c46-b41e-8fd6eb43c755?source=api-prod","affected":[{"type":"plugin","slug":"knight-lab-timelinejs","name":"Knight Lab Timeline","from":"*","from_inclusive":true,"to":"3.9.3.3","to_inclusive":true,"patched_in":"3.9.3.4"}],"published":"2024-03-15T00:00:00Z","updated":"2024-05-31T15:30:52Z"},{"id":"wordfence:afb5206a-9019-4de4-89b4-adffd11d1466","source":"wordfence","cve":"CVE-2024-10562","title":"Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb5206a-9019-4de4-89b4-adffd11d1466?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.30","to_inclusive":true,"patched_in":"1.15.31"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-17T12:44:03Z"},{"id":"wordfence:afb53b31-c179-4d11-845f-8acd18638038","source":"wordfence","cve":"CVE-2022-0210","title":"Random Banner <= 4.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb53b31-c179-4d11-845f-8acd18638038?source=api-prod","affected":[{"type":"plugin","slug":"random-banner","name":"Random Banner","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afb58149-cff0-4911-8322-c608fc00adf4","source":"wordfence","cve":"CVE-2026-66664","title":"GEO Plugin by Squirrly SEO <= 14.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb58149-cff0-4911-8322-c608fc00adf4?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"14.2.0","to_inclusive":true,"patched_in":"14.2.1"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-17T04:14:56Z"},{"id":"wordfence:afb5b791-0bc7-466f-87f6-f6c5ebed576b","source":"wordfence","cve":"CVE-2024-54262","title":"Import Export For WooCommerce <= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afb5b791-0bc7-466f-87f6-f6c5ebed576b?source=api-prod","affected":[{"type":"plugin","slug":"import-export-for-woocommerce","name":"Import Export For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2025-05-07T14:15:49Z"},{"id":"wordfence:afbb1f20-188b-4874-98dd-ab1fa43bb276","source":"wordfence","cve":"CVE-2025-30778","title":"VForm <= 3.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbb1f20-188b-4874-98dd-ab1fa43bb276?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T19:15:19Z"},{"id":"wordfence:afbcee72-fe0c-4288-bcf7-e2eaea8029d6","source":"wordfence","cve":"CVE-2025-39460","title":"Eduma <= 5.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbcee72-fe0c-4288-bcf7-e2eaea8029d6?source=api-prod","affected":[{"type":"theme","slug":"eduma","name":"Eduma","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:06:23Z"},{"id":"wordfence:afbd5080-8a25-4230-8836-20ffeca3f39d","source":"wordfence","cve":"CVE-2025-48274","title":"WP Job Portal <= 2.3.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbd5080-8a25-4230-8836-20ffeca3f39d?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T15:06:41Z"},{"id":"wordfence:afbf1813-9023-4e3d-989a-19ddd6f6d358","source":"wordfence","cve":"CVE-2022-2695","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbf1813-9023-4e3d-989a-19ddd6f6d358?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.5.5.2","to_inclusive":true,"patched_in":"2.5.5.3"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afbf555a-1b70-4966-9b05-46e9de04e660","source":"wordfence","cve":"CVE-2021-24737","title":"Comments - wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbf555a-1b70-4966-9b05-46e9de04e660?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afbfabfc-b923-4fe9-9e8f-0cf159f488db","source":"wordfence","cve":"CVE-2025-15055","title":"SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbfabfc-b923-4fe9-9e8f-0cf159f488db?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-01-08T17:59:23Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:afbfef8e-cdea-4ca0-bd28-08cc30eeec6e","source":"wordfence","cve":"CVE-2025-24570","title":"Atarim <= 4.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afbfef8e-cdea-4ca0-bd28-08cc30eeec6e?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:28:07Z"},{"id":"wordfence:afc00118-e87e-475a-8ad6-b68d09ee2e44","source":"wordfence","cve":"CVE-2024-3561","title":"Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc00118-e87e-475a-8ad6-b68d09ee2e44?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-19T13:02:39Z","updated":"2024-06-20T02:08:28Z"},{"id":"wordfence:afc0884e-2f37-44a7-a57c-83d8df65023b","source":"wordfence","cve":"CVE-2026-77765","title":"Better Payment <= 2.3.3 - Unauthenticated Payment Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc0884e-2f37-44a7-a57c-83d8df65023b?source=api-prod","affected":[{"type":"plugin","slug":"better-payment","name":"Better Payment \u2013 Instant Payments, Donations, Fundraising with Subscriptions & More","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:00:57Z"},{"id":"wordfence:afc20673-5665-4058-9d77-ebe9c03df46f","source":"wordfence","cve":"CVE-2025-39488","title":"MagOne <= 8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc20673-5665-4058-9d77-ebe9c03df46f?source=api-prod","affected":[{"type":"theme","slug":"magone","name":"MagOne","from":"*","from_inclusive":true,"to":"8.8","to_inclusive":true,"patched_in":"8.9"}],"published":"2025-06-23T00:00:00Z","updated":"2026-02-26T15:13:49Z"},{"id":"wordfence:afc22a4f-7fb8-428a-974d-e80065a36254","source":"wordfence","cve":"CVE-2025-58704","title":"WP Delete User Accounts <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc22a4f-7fb8-428a-974d-e80065a36254?source=api-prod","affected":[{"type":"plugin","slug":"wp-delete-user-accounts","name":"WP Delete User Accounts","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:54:42Z"},{"id":"wordfence:afc3531d-6134-4b45-b532-37430d96a8fb","source":"wordfence","cve":"CVE-2026-5693","title":"Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc3531d-6134-4b45-b532-37430d96a8fb?source=api-prod","affected":[{"type":"plugin","slug":"smart-appointment-booking","name":"Smart Appointment & Booking","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-05-11T19:03:39Z","updated":"2026-06-10T14:21:47Z"},{"id":"wordfence:afc6aec8-e486-4c35-9e58-da6e04d88c25","source":"wordfence","cve":"CVE-2020-6753","title":"Login by Auth0 <= 3.11.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc6aec8-e486-4c35-9e58-da6e04d88c25?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afc7be69-5823-441a-8a0e-1a0cfdd2ce4d","source":"wordfence","cve":"CVE-2024-49325","title":"Photo Gallery Builder <= 3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc7be69-5823-441a-8a0e-1a0cfdd2ce4d?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery-builder","name":"Photo Gallery Builder","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:44:35Z"},{"id":"wordfence:afc82959-35a3-41a3-ae72-f9184b7c331d","source":"wordfence","cve":"CVE-2025-27319","title":"User List <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc82959-35a3-41a3-ae72-f9184b7c331d?source=api-prod","affected":[{"type":"plugin","slug":"user-list","name":"User List","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:40:09Z"},{"id":"wordfence:afc85535-962d-479d-8580-9d02f7412930","source":"wordfence","cve":"CVE-2026-2830","title":"WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'","severity":"medium","cvss":6.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc85535-962d-479d-8580-9d02f7412930?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-06T07:22:54Z"},{"id":"wordfence:afc9114b-80b7-4caf-ab6b-35747ff5057b","source":"wordfence","cve":"","title":"Frontend File Manager & Sharing \u2013 User Private Files <= 1.1.0 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afc9114b-80b7-4caf-ab6b-35747ff5057b?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2022-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afca7b14-f3bb-4612-b81c-bde120b380ba","source":"wordfence","cve":"CVE-2026-9731","title":"Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afca7b14-f3bb-4612-b81c-bde120b380ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-js-detect","name":"Wp Js Detect","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:31:16Z","updated":"2026-07-08T05:34:09Z"},{"id":"wordfence:afcb5fc3-8e53-4a0e-b4b3-26786d2f67d3","source":"wordfence","cve":"CVE-2026-4559","title":"Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afcb5fc3-8e53-4a0e-b4b3-26786d2f67d3?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.12","to_inclusive":true,"patched_in":"3.6.13"}],"published":"2026-08-22T00:37:28Z","updated":"2026-08-22T13:27:16Z"},{"id":"wordfence:afcbad6d-90ca-42cb-a69c-4e0bcc4606e0","source":"wordfence","cve":"CVE-2024-9529","title":"Advanced Custom Fields <= 6.3.8 - Authenticated (Admin+) Limited Arbitrary Function Call","severity":"medium","cvss":5.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afcbad6d-90ca-42cb-a69c-4e0bcc4606e0?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.3.6.2","to_inclusive":true,"patched_in":"6.3.6.3"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"6.3.7","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"6.3.8","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-16T19:04:02Z"},{"id":"wordfence:afcccbd2-8f84-4d46-a8c4-8d83266d51f9","source":"wordfence","cve":"CVE-2026-42672","title":"WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afcccbd2-8f84-4d46-a8c4-8d83266d51f9?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-05-14T00:00:00Z","updated":"2026-05-19T13:33:43Z"},{"id":"wordfence:afceaa5e-9098-449e-a1af-7dbd36461f6a","source":"wordfence","cve":"CVE-2025-62933","title":"Awesome Testimonials <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afceaa5e-9098-449e-a1af-7dbd36461f6a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-testimonials","name":"Awesome Testimonials","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-07T00:00:00Z","updated":"2025-10-29T14:56:42Z"},{"id":"wordfence:afcfacab-4847-4394-9f85-83dbaeed0857","source":"wordfence","cve":"CVE-2025-52828","title":"Red Art <= 3.8 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afcfacab-4847-4394-9f85-83dbaeed0857?source=api-prod","affected":[{"type":"theme","slug":"redart","name":"Red Art | Artist Portfolio WordPress","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2025-06-26T00:00:00Z","updated":"2026-02-26T15:14:27Z"},{"id":"wordfence:afd05b33-a347-49f6-81f0-879606819ca6","source":"wordfence","cve":"CVE-2014-2340","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd05b33-a347-49f6-81f0-879606819ca6?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2014-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afd2f09c-4bd5-47a5-8d4f-7345aa8925f8","source":"wordfence","cve":"CVE-2024-11905","title":"Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd2f09c-4bd5-47a5-8d4f-7345aa8925f8?source=api-prod","affected":[{"type":"plugin","slug":"animated-counters","name":"Animated Counters","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T10:46:33Z","updated":"2024-12-16T23:24:17Z"},{"id":"wordfence:afd35195-0f4f-4306-a125-6f81207e10ca","source":"wordfence","cve":"CVE-2025-49855","title":"Meks Flexible Shortcodes <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd35195-0f4f-4306-a125-6f81207e10ca?source=api-prod","affected":[{"type":"plugin","slug":"meks-flexible-shortcodes","name":"Meks Flexible Shortcodes","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:03:27Z"},{"id":"wordfence:afd48bc8-d490-4a3e-97fc-70cf008cbf66","source":"wordfence","cve":"CVE-2025-4855","title":"Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd48bc8-d490-4a3e-97fc-70cf008cbf66?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-07-08T10:43:20Z","updated":"2025-07-08T23:22:49Z"},{"id":"wordfence:afd4f2ca-9c27-4de0-ac82-3cd107b6a092","source":"wordfence","cve":"CVE-2025-5014","title":"Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd4f2ca-9c27-4de0-ac82-3cd107b6a092?source=api-prod","affected":[{"type":"theme","slug":"homevillas-real-estate","name":"Home Villas | Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:57:19Z","updated":"2025-07-02T03:47:25Z"},{"id":"wordfence:afd58164-8d33-4f93-a904-443b1df8b66b","source":"wordfence","cve":"CVE-2017-18533","title":"Rimons Twitter Widget <= 1.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd58164-8d33-4f93-a904-443b1df8b66b?source=api-prod","affected":[{"type":"plugin","slug":"rimons-twitter-widget","name":"Rimons Twitter Widget","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.3"}],"published":"2017-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afd67c36-31ec-4e44-bad5-a018834ccfbc","source":"wordfence","cve":"","title":"qTranslate X <= 3.4.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd67c36-31ec-4e44-bad5-a018834ccfbc?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-x","name":"qTranslate X","from":"*","from_inclusive":true,"to":"3.4.6.8","to_inclusive":true,"patched_in":""}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afd7aeb7-2c6f-4b23-b8b1-52fb010e5aac","source":"wordfence","cve":"CVE-2025-12775","title":"WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd7aeb7-2c6f-4b23-b8b1-52fb010e5aac?source=api-prod","affected":[{"type":"plugin","slug":"wp-dropzone","name":"WP Dropzone","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-11-17T20:11:41Z","updated":"2025-11-18T08:27:36Z"},{"id":"wordfence:afd7fe73-1f24-4e47-a0c4-5a08662c4dbe","source":"wordfence","cve":"CVE-2024-12458","title":"Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd7fe73-1f24-4e47-a0c4-5a08662c4dbe?source=api-prod","affected":[{"type":"plugin","slug":"smart-popup-blaster","name":"Smart PopUp Blaster","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T16:13:46Z","updated":"2024-12-14T04:23:46Z"},{"id":"wordfence:afd9046c-5b6a-411e-8e66-ff1ba60d7f9d","source":"wordfence","cve":"","title":"MultiVendorX <= 4.0.25 - Improper Authorization on REST Routes via 'save_settings_permission'","severity":"high","cvss":8.6,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afd9046c-5b6a-411e-8e66-ff1ba60d7f9d?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":false,"patched_in":"4.0.26"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afdcc676-dcfa-4d88-b55f-72aa5ba0ed7c","source":"wordfence","cve":"CVE-2026-81022","title":"SupportCandy \u2013 AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afdcc676-dcfa-4d88-b55f-72aa5ba0ed7c?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"3.3.6","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:39:01Z"},{"id":"wordfence:afe10c10-cace-4ce4-a813-6fda04c8d3dd","source":"wordfence","cve":"CVE-2026-14365","title":"TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe10c10-cace-4ce4-a813-6fda04c8d3dd?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-08-06T16:23:19Z","updated":"2026-08-07T04:25:54Z"},{"id":"wordfence:afe275b4-edc0-4b19-a91f-5099a085e8ce","source":"wordfence","cve":"CVE-2025-11518","title":"WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe275b4-edc0-4b19-a91f-5099a085e8ce?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2025-10-10T19:41:35Z","updated":"2025-10-11T08:29:17Z"},{"id":"wordfence:afe2b2e5-601f-4b6b-940a-b82f723b8776","source":"wordfence","cve":"CVE-2024-8668","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +12 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe2b2e5-601f-4b6b-940a-b82f723b8776?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T04:30:29Z"},{"id":"wordfence:afe37170-dc5e-498a-ac6a-4edcfd946897","source":"wordfence","cve":"CVE-2024-51833","title":"Easy Social Sharebar <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe37170-dc5e-498a-ac6a-4edcfd946897?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-sharebar","name":"Easy Social Sharebar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:18:32Z"},{"id":"wordfence:afe6d4ac-1712-415e-9995-cb7c8fe4e1a0","source":"wordfence","cve":"CVE-2026-1273","title":"PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe6d4ac-1712-415e-9995-cb7c8fe4e1a0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-03-03T12:22:12Z","updated":"2026-03-04T01:21:59Z"},{"id":"wordfence:afe79a23-3364-4daf-9575-93f2561d159d","source":"wordfence","cve":"CVE-2026-28120","title":"Dr.Patterson <= 1.3.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe79a23-3364-4daf-9575-93f2561d159d?source=api-prod","affected":[{"type":"theme","slug":"dr-patterson","name":"Dr.Patterson | Medical & Healthcare Doctor WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:16:20Z"},{"id":"wordfence:afe894b0-5e91-4aa2-bbd1-1f74274701cf","source":"wordfence","cve":"CVE-2024-11015","title":"Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afe894b0-5e91-4aa2-bbd1-1f74274701cf?source=api-prod","affected":[{"type":"plugin","slug":"sign-in-with-google","name":"Sign In With Google","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:18:40Z","updated":"2024-12-12T03:23:08Z"},{"id":"wordfence:afec4c8c-a18d-4907-8879-2412f8a1abed","source":"wordfence","cve":"CVE-2026-5234","title":"LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afec4c8c-a18d-4907-8879-2412f8a1abed?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-04-16T15:19:09Z","updated":"2026-04-17T03:36:44Z"},{"id":"wordfence:afec9b5b-da37-4e12-935e-9d3bb3ca01f0","source":"wordfence","cve":"CVE-2025-8427","title":"Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afec9b5b-da37-4e12-935e-9d3bb3ca01f0?source=api-prod","affected":[{"type":"plugin","slug":"bb-plugin","name":"Beaver Builder Plugin (Starter Version)","from":"*","from_inclusive":true,"to":"2.9.2.1","to_inclusive":true,"patched_in":"2.9.3.1"}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-23T12:32:34Z"},{"id":"wordfence:afefe8fd-0078-4fd8-bdae-03e60fc33e87","source":"wordfence","cve":"CVE-2025-39394","title":"AnalyticsWP <= 2.1.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afefe8fd-0078-4fd8-bdae-03e60fc33e87?source=api-prod","affected":[{"type":"plugin","slug":"analyticswp","name":"AnalyticsWP","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T19:00:13Z"},{"id":"wordfence:aff013d9-9e0d-42e8-a351-f1278060e649","source":"wordfence","cve":"CVE-2024-31429","title":"Sarada Lite <= 1.1.2 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff013d9-9e0d-42e8-a351-f1278060e649?source=api-prod","affected":[{"type":"theme","slug":"sarada-lite","name":"Sarada Lite","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:56:06Z"},{"id":"wordfence:aff10d5a-a2d0-461a-b52b-a25b647eaab4","source":"wordfence","cve":"CVE-2024-1387","title":"Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff10d5a-a2d0-461a-b52b-a25b647eaab4?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:14Z"},{"id":"wordfence:aff42473-63c6-41ca-8312-058f213e2302","source":"wordfence","cve":"CVE-2026-85655","title":"Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-10-27T18:45:07Z","updated":"2026-10-28T07:48:29Z"},{"id":"wordfence:aff495c6-b4b6-4389-8acf-f59676f12e1f","source":"wordfence","cve":"CVE-2024-13853","title":"SEO Tools <= 4.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff495c6-b4b6-4389-8acf-f59676f12e1f?source=api-prod","affected":[{"type":"plugin","slug":"seo-automatic-seo-tools","name":"SEO Tools","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-14T15:58:50Z"},{"id":"wordfence:aff4d42c-133e-4ca8-9664-6878a22f7058","source":"wordfence","cve":"CVE-2017-18511","title":"Custom Sidebars <= 3.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff4d42c-133e-4ca8-9664-6878a22f7058?source=api-prod","affected":[{"type":"plugin","slug":"custom-sidebars","name":"Custom Sidebars \u2013 Dynamic Sidebar Classic Widget Area Manager","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.8.1"}],"published":"2017-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aff4f695-3c3b-48ee-8de1-674b588f332f","source":"wordfence","cve":"","title":"Evarisk <= 5.1.5.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff4f695-3c3b-48ee-8de1-674b588f332f?source=api-prod","affected":[{"type":"plugin","slug":"evarisk","name":"Evarisk","from":"*","from_inclusive":true,"to":"5.1.5.4","to_inclusive":true,"patched_in":"5.1.5.5"}],"published":"2012-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aff636ac-5bb5-4804-adf4-358ef3158d2d","source":"wordfence","cve":"","title":"MailPoet Newsletters <= 2.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff636ac-5bb5-4804-adf4-358ef3158d2d?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2016-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:aff754d6-8624-4068-8e31-738f6041d3a6","source":"wordfence","cve":"CVE-2018-17207","title":"Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aff754d6-8624-4068-8e31-738f6041d3a6?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.2.40","to_inclusive":true,"patched_in":"1.2.42"}],"published":"2018-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:affa8b39-94b8-474d-9310-a93ebdb7c1b8","source":"wordfence","cve":"CVE-2024-3066","title":"Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affa8b39-94b8-474d-9310-a93ebdb7c1b8?source=api-prod","affected":[{"type":"plugin","slug":"elegant-addons-for-elementor","name":"Elegant Addons for elementor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T16:54:30Z","updated":"2024-05-22T05:32:51Z"},{"id":"wordfence:affac906-cd40-45b3-a165-42d6ff70a969","source":"wordfence","cve":"CVE-2026-113501","title":"LiteSpeed Cache < 7.9.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affac906-cd40-45b3-a165-42d6ff70a969?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":false,"patched_in":"7.9.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:08:00Z"},{"id":"wordfence:affb5746-0af7-488e-872d-5c78e517897b","source":"wordfence","cve":"CVE-2025-28969","title":"Gallery Widget <= 1.2.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affb5746-0af7-488e-872d-5c78e517897b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-widget","name":"Gallery Widget","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:58:11Z"},{"id":"wordfence:affc9dff-75a1-4cb3-8465-55254db6441b","source":"wordfence","cve":"CVE-2023-47521","title":"Q2W3 Post Order <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affc9dff-75a1-4cb3-8465-55254db6441b?source=api-prod","affected":[{"type":"plugin","slug":"q2w3-post-order","name":"Q2W3 Post Order","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:affdaf63-2098-4ad6-b15b-990d1941fecb","source":"wordfence","cve":"CVE-2024-5087","title":"Minimal Coming Soon \u2013 Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affdaf63-2098-4ad6-b15b-990d1941fecb?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.38","to_inclusive":true,"patched_in":"2.39"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T05:44:30Z"},{"id":"wordfence:affe1bab-e534-4c79-a057-6b1268437575","source":"wordfence","cve":"CVE-2026-59554","title":"Ziina <= 1.2.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/affe1bab-e534-4c79-a057-6b1268437575?source=api-prod","affected":[{"type":"plugin","slug":"ziina","name":"Ziina","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":"1.2.22"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:45:34Z"},{"id":"wordfence:afff64c5-ed38-4aef-9ed6-4a44589b025c","source":"wordfence","cve":"CVE-2017-12948","title":"PressForward <= 5.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afff64c5-ed38-4aef-9ed6-4a44589b025c?source=api-prod","affected":[{"type":"plugin","slug":"pressforward","name":"PressForward","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":false,"patched_in":"5.2.4"}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:afff886c-92e6-41fc-9a88-befc158ad403","source":"wordfence","cve":"CVE-2024-33928","title":"CodeBard's Patron Button and Widgets for Patreon <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afff886c-92e6-41fc-9a88-befc158ad403?source=api-prod","affected":[{"type":"plugin","slug":"patron-button-and-widgets-by-codebard","name":"CodeBard\u2019s Patron Button and Widgets for Patreon","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:47:30Z"},{"id":"wordfence:afffd5e2-798b-42b5-b0b9-ac7d6d06edbb","source":"wordfence","cve":"CVE-2025-6042","title":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to Editor","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/afffd5e2-798b-42b5-b0b9-ac7d6d06edbb?source=api-prod","affected":[{"type":"plugin","slug":"lisfinity-core","name":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-10-14T16:29:07Z","updated":"2025-10-15T05:23:50Z"},{"id":"wordfence:b00290ee-ad63-4544-818a-c0d7471e60fa","source":"wordfence","cve":"CVE-2022-4953","title":"Elementor <= 3.5.4 - DOM-Based iFrame Injection","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b00290ee-ad63-4544-818a-c0d7471e60fa?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b002d1a1-a536-4865-b263-594390941ed4","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b002d1a1-a536-4865-b263-594390941ed4?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.7.3","to_inclusive":true,"patched_in":"0.9.7.4"}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b004955a-7580-4dc8-beee-e55785026fed","source":"wordfence","cve":"CVE-2019-16117","title":"Photo Gallery by 10Web <= 1.5.34 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b004955a-7580-4dc8-beee-e55785026fed?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.35","to_inclusive":false,"patched_in":"1.5.35"}],"published":"2019-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0086de8-448f-452f-89d1-84b77b2e25a8","source":"wordfence","cve":"CVE-2024-22308","title":"Simple Membership <= 4.4.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0086de8-448f-452f-89d1-84b77b2e25a8?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:56:49Z"},{"id":"wordfence:b00f98fd-2c6e-4e4d-baa2-1eca3f41a56f","source":"wordfence","cve":"CVE-2025-62872","title":"Social Photo Fetcher <= 3.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b00f98fd-2c6e-4e4d-baa2-1eca3f41a56f?source=api-prod","affected":[{"type":"plugin","slug":"facebook-photo-fetcher","name":"Social Photo Fetcher","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-12T20:58:33Z"},{"id":"wordfence:b011448b-0598-4b9a-b558-d7be13802ebf","source":"wordfence","cve":"CVE-2026-92538","title":"LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b011448b-0598-4b9a-b558-d7be13802ebf?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2026-10-02T14:37:50Z","updated":"2026-10-03T03:25:47Z"},{"id":"wordfence:b0121ef5-4b0b-47c5-8d3d-7d32c8e67c27","source":"wordfence","cve":"CVE-2021-24913","title":"Logo Showcase with Slick Slider <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0121ef5-4b0b-47c5-8d3d-7d32c8e67c27?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b019bd50-eaf3-48f3-a0b3-f730d463ccd2","source":"wordfence","cve":"CVE-2026-32491","title":"WP Review Slider <= 13.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b019bd50-eaf3-48f3-a0b3-f730d463ccd2?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"13.9","to_inclusive":true,"patched_in":"14.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:30:04Z"},{"id":"wordfence:b01ad77f-2349-48bb-b4e9-f7cbce435de9","source":"wordfence","cve":"CVE-2023-6964","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ad77f-2349-48bb-b4e9-f7cbce435de9?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.1.26","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2024-04-09T00:00:00Z","updated":"2024-07-29T21:37:10Z"},{"id":"wordfence:b01be0e9-832f-4aa5-a082-b82e0cfe4518","source":"wordfence","cve":"CVE-2025-22340","title":"Data Dash <= 1.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01be0e9-832f-4aa5-a082-b82e0cfe4518?source=api-prod","affected":[{"type":"plugin","slug":"data-dash","name":"Data Dash","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-04-22T21:22:10Z"},{"id":"wordfence:b01ce091-7d5a-43f4-bfb1-20e7502ca57b","source":"wordfence","cve":"CVE-2026-66686","title":"Plugins Garbage Collector (Database Cleanup) <= 0.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ce091-7d5a-43f4-bfb1-20e7502ca57b?source=api-prod","affected":[{"type":"plugin","slug":"plugins-garbage-collector","name":"Plugins Garbage Collector (Database Cleanup)","from":"*","from_inclusive":true,"to":"0.14","to_inclusive":true,"patched_in":"0.15"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:00:20Z"},{"id":"wordfence:b01ce539-08f4-48f7-9ddc-56e87a2c91cc","source":"wordfence","cve":"CVE-2021-36873","title":"WordPress iQ Block Country <= 1.2.11 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ce539-08f4-48f7-9ddc-56e87a2c91cc?source=api-prod","affected":[{"type":"plugin","slug":"iq-block-country","name":"iQ Block Country","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2021-09-22T23:26:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b01ed5e4-2685-417e-a0db-3607d68f7cef","source":"wordfence","cve":"CVE-2026-112856","title":"Vagabonds - Travel Blog Elementor Template Kit <= 1.3.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ed5e4-2685-417e-a0db-3607d68f7cef?source=api-prod","affected":[{"type":"theme","slug":"vagabonds","name":"Vagabonds - Travel Blog Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:25Z"},{"id":"wordfence:b01ee276-baed-4678-894d-1407e538a0a3","source":"wordfence","cve":"CVE-2019-15645","title":"Zoho SalesIQ <= 1.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b01ee276-baed-4678-894d-1407e538a0a3?source=api-prod","affected":[{"type":"plugin","slug":"zoho-salesiq","name":"Zoho SalesIQ \u2013 Live chat, chatbots, and visitor tracking","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b02198f5-10df-4c4c-beed-aec8acacaec9","source":"wordfence","cve":"CVE-2025-9630","title":"WP SinoType <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02198f5-10df-4c4c-beed-aec8acacaec9?source=api-prod","affected":[{"type":"plugin","slug":"wp-sinotype","name":"WP SinoType","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:12:10Z","updated":"2025-10-03T11:17:19Z"},{"id":"wordfence:b0224760-b492-4a00-bdf8-24a8db3ea3df","source":"wordfence","cve":"CVE-2026-25410","title":"WP-CORS <= 0.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0224760-b492-4a00-bdf8-24a8db3ea3df?source=api-prod","affected":[{"type":"plugin","slug":"wp-cors","name":"WP-CORS","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-26T19:54:43Z"},{"id":"wordfence:b024f6ce-c3ec-4ed9-a8ea-54f926e38443","source":"wordfence","cve":"","title":"WooCommerce Email Test <= 1.5 - Sensitive Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b024f6ce-c3ec-4ed9-a8ea-54f926e38443?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-email-test","name":"WooCommerce Email Test","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2016-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b02613dc-8c31-4c86-b800-eb1039381e1f","source":"wordfence","cve":"CVE-2024-43327","title":"Invite Anyone <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02613dc-8c31-4c86-b800-eb1039381e1f?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:07:53Z"},{"id":"wordfence:b027c9f9-3144-4783-b646-ee1e02cd27ef","source":"wordfence","cve":"CVE-2025-8572","title":"Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=api-prod","affected":[{"type":"plugin","slug":"truelysell-core","name":"Truelysell Core","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2026-02-13T20:06:58Z","updated":"2026-02-14T08:26:47Z"},{"id":"wordfence:b028a70d-f103-4232-b854-17b88d4dc7d9","source":"wordfence","cve":"CVE-2022-3119","title":"OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) <= 3.0.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b028a70d-f103-4232-b854-17b88d4dc7d9?source=api-prod","affected":[{"type":"plugin","slug":"oauth-client-for-user-authentication","name":"OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO )","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2022-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0297b3a-a180-428a-9716-6ecfa5a4de94","source":"wordfence","cve":"CVE-2017-18609","title":"Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via custom-write-panel-id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0297b3a-a180-428a-9716-6ecfa5a4de94?source=api-prod","affected":[{"type":"plugin","slug":"magic-fields","name":"Magic Fields","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b02ab0cf-8bdf-4415-bae3-2193c3d75741","source":"wordfence","cve":"CVE-2021-24497","title":"Giveaway <= 1.2.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02ab0cf-8bdf-4415-bae3-2193c3d75741?source=api-prod","affected":[{"type":"plugin","slug":"giveaway","name":"Giveaway","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b02b5ea6-e112-4255-833c-87ee939986b0","source":"wordfence","cve":"CVE-2024-11685","title":"Kudos Donations \u2013 Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02b5ea6-e112-4255-833c-87ee939986b0?source=api-prod","affected":[{"type":"plugin","slug":"kudos-donations","name":"Kudos Donations \u2013 Donation Forms for Mollie & Stripe","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:21Z"},{"id":"wordfence:b02bdf2a-1d99-4cc3-8f75-822ff0792e44","source":"wordfence","cve":"CVE-2026-10738","title":"jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02bdf2a-1d99-4cc3-8f75-822ff0792e44?source=api-prod","affected":[{"type":"plugin","slug":"jquery-hover-footnotes","name":"jQuery Hover Footnotes","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:07:26Z","updated":"2026-06-09T03:41:22Z"},{"id":"wordfence:b02ca3a1-4e85-4bc3-a5f6-a02bec6bddef","source":"wordfence","cve":"CVE-2021-24356","title":"Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b02ca3a1-4e85-4bc3-a5f6-a02bec6bddef?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"2.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0301aa6-bfbd-4b68-bf4c-e69878df57cf","source":"wordfence","cve":"CVE-2026-115965","title":"BuddyPress <= 14.5.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0301aa6-bfbd-4b68-bf4c-e69878df57cf?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.5.2","to_inclusive":true,"patched_in":"14.5.3"}],"published":"2026-10-27T10:20:35Z","updated":"2026-11-03T19:29:02Z"},{"id":"wordfence:b0302a75-217f-4be9-876e-10ede3e3c20d","source":"wordfence","cve":"","title":"Adblocker Blocker <= 0.0.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0302a75-217f-4be9-876e-10ede3e3c20d?source=api-prod","affected":[{"type":"plugin","slug":"addblockblocker","name":"Adblock Blocker","from":"0.0.1","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b030aa28-5310-4f69-8b86-7e0b0bae741b","source":"wordfence","cve":"CVE-2025-8097","title":"WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2025-07-25T00:00:00Z","updated":"2025-07-26T06:43:22Z"},{"id":"wordfence:b03125e6-689b-46d7-8a39-3260d46fb17d","source":"wordfence","cve":"CVE-2024-54220","title":"FAT Services Booking <= 5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03125e6-689b-46d7-8a39-3260d46fb17d?source=api-prod","affected":[{"type":"plugin","slug":"fat-services-booking","name":"FAT Services Booking","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:17:52Z"},{"id":"wordfence:b0315b53-46a1-46b4-a53e-0d914866ca50","source":"wordfence","cve":"CVE-2024-6313","title":"Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0315b53-46a1-46b4-a53e-0d914866ca50?source=api-prod","affected":[{"type":"plugin","slug":"forms-gutenberg","name":"Gutenberg Forms \u2013 WordPress Form Builder Plugin","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:46Z"},{"id":"wordfence:b03409ee-37bd-4c61-8a74-11fedac1d10f","source":"wordfence","cve":"CVE-2025-66526","title":"Tablesome <= 1.1.34 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03409ee-37bd-4c61-8a74-11fedac1d10f?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":true,"patched_in":"1.1.35.1"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-11T15:48:06Z"},{"id":"wordfence:b034605b-284c-478a-baec-224c4533b2e0","source":"wordfence","cve":"CVE-2026-57399","title":"Proxy & VPN Blocker <= 3.5.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b034605b-284c-478a-baec-224c4533b2e0?source=api-prod","affected":[{"type":"plugin","slug":"proxy-vpn-blocker","name":"Proxy & VPN Blocker","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:29:15Z"},{"id":"wordfence:b0382227-48eb-4a97-8f3c-5c8fc4bcc0b6","source":"wordfence","cve":"CVE-2014-5266","title":"WordPress Core < 3.9.2 - Denial of Service via XML #2","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0382227-48eb-4a97-8f3c-5c8fc4bcc0b6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0399b60-6e40-4f35-985f-845a32f69d64","source":"wordfence","cve":"CVE-2023-51473","title":"TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0399b60-6e40-4f35-985f-845a32f69d64?source=api-prod","affected":[{"type":"plugin","slug":"terraclassifieds","name":"TerraClassifieds \u2013 Simple Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b039eee2-767d-459e-9d7d-7a63eac12017","source":"wordfence","cve":"CVE-2025-62915","title":"SMS Contact Form 7 Notifications by ClickSend <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b039eee2-767d-459e-9d7d-7a63eac12017?source=api-prod","affected":[{"type":"plugin","slug":"clicksend-contactform7","name":"SMS Contact Form 7 Notifications by ClickSend","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:02:38Z"},{"id":"wordfence:b03a9aaa-ce9a-47bf-8574-0eba92fcf0c5","source":"wordfence","cve":"CVE-2023-26514","title":"XML Sitemap Generator for Google <= 1.3.3 - Cross-Site Request Forgery to Plugin Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03a9aaa-ce9a-47bf-8574-0eba92fcf0c5?source=api-prod","affected":[{"type":"plugin","slug":"xml-sitemap-generator-for-google","name":"Dynamic XML Sitemaps Generator for Google","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b03b0096-61f5-4886-80ea-108f6a4c4c49","source":"wordfence","cve":"CVE-2025-60091","title":"Gravity Forms Zoho CRM and Bigin <= 1.2.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03b0096-61f5-4886-80ea-108f6a4c4c49?source=api-prod","affected":[{"type":"plugin","slug":"gf-zoho","name":"WP Gravity Forms Zoho CRM and Bigin","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-08-08T00:00:00Z","updated":"2026-01-07T14:27:02Z"},{"id":"wordfence:b03b7ea8-6485-495d-b815-2b7b882a75a2","source":"wordfence","cve":"CVE-2026-18550","title":"Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03b7ea8-6485-495d-b815-2b7b882a75a2?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-08-31T21:31:50Z","updated":"2026-09-01T11:31:08Z"},{"id":"wordfence:b03cabc6-1cbe-4aa2-8eae-cea30d01b811","source":"wordfence","cve":"CVE-2026-107711","title":"FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b03cabc6-1cbe-4aa2-8eae-cea30d01b811?source=api-prod","affected":[{"type":"plugin","slug":"stock-sync-with-google-sheet-for-woocommerce","name":"FlexStock \u2013 Product Stock Sync with Google Sheets for WooCommerce","from":"*","from_inclusive":true,"to":"3.17.2","to_inclusive":true,"patched_in":"3.17.3"}],"published":"2026-10-30T21:11:02Z","updated":"2026-10-31T09:29:27Z"},{"id":"wordfence:b0403adb-08c4-4697-a7d9-50e39d46cd43","source":"wordfence","cve":"CVE-2023-22694","title":"BigContact <= 1.5.8 - Cross-Site Request Forgery leading to Plugin Settings Updates","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0403adb-08c4-4697-a7d9-50e39d46cd43?source=api-prod","affected":[{"type":"plugin","slug":"bigcontact","name":"BigContact Contact Page","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b043197c-4477-4663-abb8-5840173c574d","source":"wordfence","cve":"CVE-2024-3073","title":"Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI","severity":"low","cvss":2.7,"cwe":"CWE-257","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b043197c-4477-4663-abb8-5840173c574d?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-06-12T20:02:54Z","updated":"2024-07-10T13:11:23Z"},{"id":"wordfence:b046d84e-63a4-4b8c-8824-9ef8ad7a5859","source":"wordfence","cve":"CVE-2026-9570","title":"Taskbuilder <= 5.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b046d84e-63a4-4b8c-8824-9ef8ad7a5859?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2026-05-27T00:00:00Z","updated":"2026-09-18T14:51:56Z"},{"id":"wordfence:b0485897-4d1d-442d-9c81-4b4bb40e3983","source":"wordfence","cve":"CVE-2015-9509","title":"Easy Digital Downloads \u2013 Content Restriction <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0485897-4d1d-442d-9c81-4b4bb40e3983?source=api-prod","affected":[{"type":"plugin","slug":"edd-content-restriction","name":"Easy Digital Downloads \u2013 Content Restriction","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b04a5a8e-17ec-48e7-85b8-a14bd2222583","source":"wordfence","cve":"CVE-2024-50495","title":"Plugin Propagator <= 0.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b04a5a8e-17ec-48e7-85b8-a14bd2222583?source=api-prod","affected":[{"type":"plugin","slug":"wp-propagator","name":"Plugin Propagator","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:25:31Z"},{"id":"wordfence:b04a7ef8-13bb-455e-8ca8-22f3eec15bcb","source":"wordfence","cve":"CVE-2026-1867","title":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit < 5.0.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b04a7ef8-13bb-455e-8ca8-22f3eec15bcb?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":false,"patched_in":"5.0.6"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T13:33:23Z"},{"id":"wordfence:b04aaf8f-c02a-4fa9-a2fc-96c224a3c1ef","source":"wordfence","cve":"CVE-2026-39646","title":"Leaflet Map <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b04aaf8f-c02a-4fa9-a2fc-96c224a3c1ef?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-map","name":"Leaflet Map","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-02-15T00:00:00Z","updated":"2026-05-04T14:39:26Z"},{"id":"wordfence:b04ba117-da4b-445e-99c2-69a5e4f34a65","source":"wordfence","cve":"CVE-2026-9013","title":"Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b04ba117-da4b-445e-99c2-69a5e4f34a65?source=api-prod","affected":[{"type":"plugin","slug":"bogo","name":"Bogo","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-06-18T16:00:47Z","updated":"2026-06-19T04:31:33Z"},{"id":"wordfence:b050fa45-05b7-49ff-bb24-179150f3f959","source":"wordfence","cve":"CVE-2023-23875","title":"Binge Site Verification using Meta Tag <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b050fa45-05b7-49ff-bb24-179150f3f959?source=api-prod","affected":[{"type":"plugin","slug":"bing-site-verification-using-meta-tag","name":"Bing Site Verification plugin using Meta Tag","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0520601-7e5c-412d-a8da-df1bf8ce28df","source":"wordfence","cve":"CVE-2023-2275","title":"WooCommerce Multivendor Marketplace \u2013 REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0520601-7e5c-412d-a8da-df1bf8ce28df?source=api-prod","affected":[{"type":"plugin","slug":"wcfm-marketplace-rest-api","name":"WCFM \u2013 Multivendor Marketplace REST API for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b052b334-751e-4d70-9713-0c214cf932c2","source":"wordfence","cve":"CVE-2025-24728","title":"Bug Library <= 2.1.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b052b334-751e-4d70-9713-0c214cf932c2?source=api-prod","affected":[{"type":"plugin","slug":"bug-library","name":"Bug Library","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:05:53Z"},{"id":"wordfence:b0567ccb-14fa-4e5d-9125-a8b1d6b600c0","source":"wordfence","cve":"CVE-2026-97354","title":"PowerPress 11.13.12 - 11.17.9 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0567ccb-14fa-4e5d-9125-a8b1d6b600c0?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"11.13.12","from_inclusive":true,"to":"11.17.9","to_inclusive":true,"patched_in":"11.17.11"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T00:19:20Z"},{"id":"wordfence:b056cc98-3bd8-493a-bbf4-9bcee2e52d24","source":"wordfence","cve":"CVE-2024-10789","title":"WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b056cc98-3bd8-493a-bbf4-9bcee2e52d24?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profile-avatar","name":"WP User Profile Avatar","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-01-15T15:23:04Z","updated":"2025-01-16T03:27:24Z"},{"id":"wordfence:b0590adf-acd0-42d7-9aa6-cf9b41a150ee","source":"wordfence","cve":"CVE-2026-114194","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0590adf-acd0-42d7-9aa6-cf9b41a150ee?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-22T08:47:00Z","updated":"2026-10-28T01:19:35Z"},{"id":"wordfence:b05b0f6d-ffa4-40f4-b969-1153192c52d6","source":"wordfence","cve":"CVE-2025-13441","title":"Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b05b0f6d-ffa4-40f4-b969-1153192c52d6?source=api-prod","affected":[{"type":"plugin","slug":"hide-category-by-user-role-for-woocommerce","name":"Hide Category by User Role for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-11-26T17:45:34Z","updated":"2025-11-27T06:42:13Z"},{"id":"wordfence:b05b42d8-057b-4889-add9-e2830633023c","source":"wordfence","cve":"CVE-2025-23879","title":"Easy Automatic Newsletter Lite <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b05b42d8-057b-4889-add9-e2830633023c?source=api-prod","affected":[{"type":"plugin","slug":"easy-automatic-newsletter","name":"Easy Automatic Newsletter Lite","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:45:28Z"},{"id":"wordfence:b05ece19-ba0d-456e-bdab-86abe9a13e70","source":"wordfence","cve":"","title":"Newsletter Meenews <= 5.1.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b05ece19-ba0d-456e-bdab-86abe9a13e70?source=api-prod","affected":[{"type":"plugin","slug":"meenews","name":"Newsletter Meenews","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b05f4ef4-aa64-4cf4-a278-604df8407d12","source":"wordfence","cve":"CVE-2025-11799","title":"Affiliate AI Lite <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b05f4ef4-aa64-4cf4-a278-604df8407d12?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-ai-lite","name":"Affiliate AI Lite","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-11-20T18:41:13Z","updated":"2025-11-21T07:31:57Z"},{"id":"wordfence:b0603621-4521-4eb0-b4dd-e2257c133cee","source":"wordfence","cve":"CVE-2024-0709","title":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List 2.0 - 2.6.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0603621-4521-4eb0-b4dd-e2257c133cee?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-price-ticker-widget","name":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List","from":"2.0","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-01-19T00:00:00Z","updated":"2025-07-08T13:43:09Z"},{"id":"wordfence:b061facb-0411-4b81-adbd-b1419b7210df","source":"wordfence","cve":"","title":"Advanced Custom Fields (ACF\u00ae) <= 6.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b061facb-0411-4b81-adbd-b1419b7210df?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.8.2"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:12:41Z"},{"id":"wordfence:b061fbf2-4bb3-4ccc-ba90-1e947365435e","source":"wordfence","cve":"CVE-2024-12383","title":"Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b061fbf2-4bb3-4ccc-ba90-1e947365435e?source=api-prod","affected":[{"type":"plugin","slug":"woo-binary-mlm","name":"Binary MLM For WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-01-06T16:22:27Z","updated":"2025-12-19T14:29:41Z"},{"id":"wordfence:b06201bd-4f8e-41e5-89e1-b1f47757799b","source":"wordfence","cve":"CVE-2026-42650","title":"AutomatorWP \u2013 Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06201bd-4f8e-41e5-89e1-b1f47757799b?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"5.6.8"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:41:57Z"},{"id":"wordfence:b062f72a-542c-4212-af83-4faefbf69bd7","source":"wordfence","cve":"CVE-2025-14793","title":"DK PDF \u2013 WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b062f72a-542c-4212-af83-4faefbf69bd7?source=api-prod","affected":[{"type":"plugin","slug":"dk-pdf","name":"DK PDF \u2013 WordPress PDF Generator","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-01-15T18:31:31Z","updated":"2026-01-19T16:48:41Z"},{"id":"wordfence:b0660d9a-9f36-42a6-bffa-15ac1afcfaf3","source":"wordfence","cve":"CVE-2025-32171","title":"Table Block by Tableberg <= 0.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0660d9a-9f36-42a6-bffa-15ac1afcfaf3?source=api-prod","affected":[{"type":"plugin","slug":"tableberg","name":"Tableberg \u2013 Simple Gutenberg Table Block","from":"*","from_inclusive":true,"to":"0.6.10","to_inclusive":true,"patched_in":"0.6.12"}],"published":"2025-04-04T00:00:00Z","updated":"2025-12-05T18:07:02Z"},{"id":"wordfence:b066da10-f842-4ff2-a4da-2d469169f423","source":"wordfence","cve":"CVE-2024-8283","title":"Slider by 10Web <= 1.2.58 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b066da10-f842-4ff2-a4da-2d469169f423?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.58","to_inclusive":true,"patched_in":"1.2.59"}],"published":"2024-09-09T00:00:00Z","updated":"2024-10-03T20:02:24Z"},{"id":"wordfence:b066f1fe-b416-4fe8-891d-b9c33664df89","source":"wordfence","cve":"CVE-2024-37551","title":"Simple Social Share <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b066f1fe-b416-4fe8-891d-b9c33664df89?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-share","name":"Simple Social Share","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T14:01:15Z"},{"id":"wordfence:b0696cbe-70e0-402d-bcfd-40907a973785","source":"wordfence","cve":"CVE-2025-13089","title":"WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0696cbe-70e0-402d-bcfd-40907a973785?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-12-12T15:19:40Z","updated":"2025-12-13T03:20:26Z"},{"id":"wordfence:b06a1b66-9057-4f16-878c-4fa66489f0ff","source":"wordfence","cve":"CVE-2023-41801","title":"AWP Classifieds <= 4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06a1b66-9057-4f16-878c-4fa66489f0ff?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b06cb3cf-e2da-4e18-9a09-c30cebddf5c2","source":"wordfence","cve":"CVE-2024-10878","title":"Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06cb3cf-e2da-4e18-9a09-c30cebddf5c2?source=api-prod","affected":[{"type":"plugin","slug":"sugar-calendar-lite","name":"Sugar Calendar \u2013 Events Calendar, Event Tickets, and Events Management Platform","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-11-19T17:26:57Z","updated":"2024-11-26T17:32:11Z"},{"id":"wordfence:b06ce1e4-5cfb-415d-ad09-db194d6b4354","source":"wordfence","cve":"CVE-2025-3607","title":"Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06ce1e4-5cfb-415d-ad09-db194d6b4354?source=api-prod","affected":[{"type":"plugin","slug":"frontend-login-and-registration-blocks","name":"Login, Registration and Lost Password Blocks","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-04-23T19:45:40Z","updated":"2025-07-24T17:32:57Z"},{"id":"wordfence:b06d4731-111d-43b5-a0ca-afc877c37001","source":"wordfence","cve":"CVE-2025-39501","title":"Goodlayers Hostel <= 3.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06d4731-111d-43b5-a0ca-afc877c37001?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hostel","name":"Goodlayers Hostel","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:38:07Z"},{"id":"wordfence:b06f09e6-6bc2-4638-b8a4-c5689fe4693a","source":"wordfence","cve":"CVE-2026-94169","title":"The Grid <= 2.8.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b06f09e6-6bc2-4638-b8a4-c5689fe4693a?source=api-prod","affected":[{"type":"plugin","slug":"the-grid","name":"The Grid","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-10-14T06:53:44Z","updated":"2026-10-27T18:09:23Z"},{"id":"wordfence:b07194ee-3e2c-4fcc-933b-1b49e982b927","source":"wordfence","cve":"CVE-2025-48085","title":"Simple Stripe <= 0.9.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b07194ee-3e2c-4fcc-933b-1b49e982b927?source=api-prod","affected":[{"type":"plugin","slug":"simple-stripe","name":"Simple Stripe","from":"*","from_inclusive":true,"to":"0.9.17","to_inclusive":true,"patched_in":""}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-22T20:42:55Z"},{"id":"wordfence:b073edd0-3f40-423e-976e-996b29caf66e","source":"wordfence","cve":"CVE-2026-8073","title":"Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP","severity":"high","cvss":7.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b073edd0-3f40-423e-976e-996b29caf66e?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2026-05-19T06:24:51Z","updated":"2026-05-19T18:33:52Z"},{"id":"wordfence:b075e806-4833-44cb-9a51-108ed79faae4","source":"wordfence","cve":"CVE-2024-54440","title":"WP-Ban-User <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b075e806-4833-44cb-9a51-108ed79faae4?source=api-prod","affected":[{"type":"plugin","slug":"wp-ban-user","name":"WP-Ban-User","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T11:02:27Z"},{"id":"wordfence:b0781264-ed26-4e4b-a7ab-40e65bc71571","source":"wordfence","cve":"CVE-2022-40699","title":"Yet Another Stars Rating <= 3.1.2 - Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0781264-ed26-4e4b-a7ab-40e65bc71571?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b078e446-61e7-4ce1-b9a9-480ccc388c72","source":"wordfence","cve":"CVE-2023-47874","title":"Perfmatters <= 2.1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b078e446-61e7-4ce1-b9a9-480ccc388c72?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b07b46a6-8a5d-40cb-8af9-baf0f1722736","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in widgets_watch_data function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b07b46a6-8a5d-40cb-8af9-baf0f1722736?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b07c507e-9fab-426d-998e-ab557d1f1b1a","source":"wordfence","cve":"CVE-2024-54284","title":"SeedProd Pro <= 6.18.12 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b07c507e-9fab-426d-998e-ab557d1f1b1a?source=api-prod","affected":[{"type":"plugin","slug":"seedprod-coming-soon-pro-5","name":"SeedProd Pro","from":"*","from_inclusive":true,"to":"6.18.12","to_inclusive":true,"patched_in":"6.18.13"}],"published":"2024-12-11T00:00:00Z","updated":"2025-02-27T16:54:31Z"},{"id":"wordfence:b07dc6ff-f88d-4c5a-8cd5-7c20f1755ece","source":"wordfence","cve":"CVE-2026-8611","title":"Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b07dc6ff-f88d-4c5a-8cd5-7c20f1755ece?source=api-prod","affected":[{"type":"plugin","slug":"klamra-paycal-for-aspaclaria","name":"Klamra Paycal for Aspaclaria","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-06-05T14:28:53Z","updated":"2026-06-06T03:28:25Z"},{"id":"wordfence:b07f3ade-5f10-4621-99a2-18eeab993403","source":"wordfence","cve":"CVE-2024-12045","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b07f3ade-5f10-4621-99a2-18eeab993403?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T07:18:39Z"},{"id":"wordfence:b08194e9-6e6e-484c-bc5b-87235379d3b1","source":"wordfence","cve":"CVE-2024-34808","title":"JCH Optimize <= 4.2.0 - Authenticated (Subscriber+) Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08194e9-6e6e-484c-bc5b-87235379d3b1?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-20T15:23:22Z"},{"id":"wordfence:b08198a6-10e8-44ca-a1c5-8d987d85c469","source":"wordfence","cve":"CVE-2025-15027","title":"JAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08198a6-10e8-44ca-a1c5-8d987d85c469?source=api-prod","affected":[{"type":"plugin","slug":"jay-login-register","name":"JAY Login & Register","from":"*","from_inclusive":true,"to":"2.6.03","to_inclusive":true,"patched_in":"2.6.04"}],"published":"2026-02-07T12:43:54Z","updated":"2026-02-08T01:22:56Z"},{"id":"wordfence:b082176c-9486-416c-8215-cdba4d6e5260","source":"wordfence","cve":"CVE-2025-10498","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b082176c-9486-416c-8215-cdba4d6e5260?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2025-09-26T14:15:46Z","updated":"2025-09-27T02:25:14Z"},{"id":"wordfence:b08284ad-717f-4bdb-8eaa-f44e9447ff25","source":"wordfence","cve":"CVE-2026-2362","title":"WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08284ad-717f-4bdb-8eaa-f44e9447ff25?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility","name":"WP Accessibility","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-02-26T19:26:02Z","updated":"2026-02-27T08:24:23Z"},{"id":"wordfence:b083cf9d-bcfe-4234-a816-2d216da28b57","source":"wordfence","cve":"CVE-2025-12535","title":"SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b083cf9d-bcfe-4234-a816-2d216da28b57?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2025-11-18T17:53:21Z","updated":"2025-11-19T06:45:26Z"},{"id":"wordfence:b084ba1c-0910-44f0-ad77-41552ec25589","source":"wordfence","cve":"CVE-2023-0177","title":"Social Like Box and Page by WpDevArt <= 0.8.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b084ba1c-0910-44f0-ad77-41552ec25589?source=api-prod","affected":[{"type":"plugin","slug":"like-box","name":"Social Like Box and Page by WpDevArt","from":"*","from_inclusive":true,"to":"0.8.40","to_inclusive":true,"patched_in":"0.8.41"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b08531b2-968e-4a00-ad7a-7abfe8cf0bd3","source":"wordfence","cve":"CVE-2024-2749","title":"VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08531b2-968e-4a00-ad7a-7abfe8cf0bd3?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-16T13:34:11Z"},{"id":"wordfence:b086b0cb-bff7-4c04-9cee-15063acf430c","source":"wordfence","cve":"CVE-2025-58708","title":"777 <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b086b0cb-bff7-4c04-9cee-15063acf430c?source=api-prod","affected":[{"type":"theme","slug":"triple-seven","name":"777","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-20T20:30:17Z"},{"id":"wordfence:b088ac09-bb14-45d8-9771-9be4cf580c1c","source":"wordfence","cve":"CVE-2025-49028","title":"Zoho ZeptoMail <= 3.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b088ac09-bb14-45d8-9771-9be4cf580c1c?source=api-prod","affected":[{"type":"plugin","slug":"transmail","name":"Zoho ZeptoMail","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T17:50:29Z"},{"id":"wordfence:b08b8a3a-3acd-41e7-b6e4-aa8c61a5f80c","source":"wordfence","cve":"CVE-2026-25353","title":"Nooni < 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08b8a3a-3acd-41e7-b6e4-aa8c61a5f80c?source=api-prod","affected":[{"type":"theme","slug":"nooni","name":"nooni","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:40:03Z"},{"id":"wordfence:b08ebc3b-ee89-4a4d-8a4c-8513e13b32b6","source":"wordfence","cve":"CVE-2026-25036","title":"Passster <= 4.2.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b08ebc3b-ee89-4a4d-8a4c-8513e13b32b6?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.25","to_inclusive":true,"patched_in":"4.2.26"}],"published":"2026-02-12T00:00:00Z","updated":"2026-02-16T22:32:05Z"},{"id":"wordfence:b0907cb0-b101-4c88-9a8b-b35133e1d0a2","source":"wordfence","cve":"","title":"MiwoFTP < 1.0.6 - Cross-Site Request Forgery leading to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0907cb0-b101-4c88-9a8b-b35133e1d0a2?source=api-prod","affected":[{"type":"plugin","slug":"miwoftp","name":"miwoftp","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2015-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0925ceb-581c-4748-abfb-9962e53b7db9","source":"wordfence","cve":"CVE-2024-4623","title":"Blogmentor \u2013 Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0925ceb-581c-4748-abfb-9962e53b7db9?source=api-prod","affected":[{"type":"plugin","slug":"blogmentor","name":"Blogmentor \u2013 Blog Layouts for Elementor","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-06-18T14:31:02Z","updated":"2026-09-16T17:13:50Z"},{"id":"wordfence:b092bee4-3e33-48cb-a88d-05231b1d4905","source":"wordfence","cve":"CVE-2026-27404","title":"LMS <= 9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b092bee4-3e33-48cb-a88d-05231b1d4905?source=api-prod","affected":[{"type":"theme","slug":"lms","name":"LMS - Education WordPress Theme","from":"*","from_inclusive":true,"to":"9.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:49:16Z"},{"id":"wordfence:b0955689-43a0-442c-974b-5db5e4171f6a","source":"wordfence","cve":"CVE-2024-0514","title":"Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0955689-43a0-442c-974b-5db5e4171f6a?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:11Z"},{"id":"wordfence:b097aade-fdfa-4fb0-9921-67b0fc544490","source":"wordfence","cve":"CVE-2025-49907","title":"MDTF <= 1.3.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b097aade-fdfa-4fb0-9921-67b0fc544490?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.9","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-29T15:52:04Z"},{"id":"wordfence:b09a3b74-a359-456a-b945-f6173f579e9b","source":"wordfence","cve":"CVE-2024-35167","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09a3b74-a359-456a-b945-f6173f579e9b?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:20:15Z"},{"id":"wordfence:b09a8d0a-6940-4244-b116-25a1e82cccf7","source":"wordfence","cve":"CVE-2024-10815","title":"PostLists <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09a8d0a-6940-4244-b116-25a1e82cccf7?source=api-prod","affected":[{"type":"plugin","slug":"postlists","name":"PostLists","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:27:32Z"},{"id":"wordfence:b09c6da0-14d8-4e44-95bd-b5b6b0df97e9","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure","severity":"high","cvss":8.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09c6da0-14d8-4e44-95bd-b5b6b0df97e9?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b09c98f2-6492-41e1-8d87-e10ed2ef5f9f","source":"wordfence","cve":"","title":"Social Media Share Buttons & Social Sharing Icons <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09c98f2-6492-41e1-8d87-e10ed2ef5f9f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2019-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b09d26ac-8f10-458f-8a97-8fdbdff4d833","source":"wordfence","cve":"CVE-2025-46242","title":"Watu Quiz <= 3.4.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09d26ac-8f10-458f-8a97-8fdbdff4d833?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:33:22Z"},{"id":"wordfence:b09dc4dc-d2b9-452a-b005-b69feffdbecf","source":"wordfence","cve":"CVE-2024-12395","title":"WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09dc4dc-d2b9-452a-b005-b69feffdbecf?source=api-prod","affected":[{"type":"plugin","slug":"woo-additional-fees-on-checkout-wordpress","name":"Additional Fees For WooCommerce Checkout","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T11:10:21Z"},{"id":"wordfence:b09f50b7-6d2d-4de0-8a31-6e03d54d188b","source":"wordfence","cve":"CVE-2025-53205","title":"Radio Player Shoutcast & Icecast <= 4.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09f50b7-6d2d-4de0-8a31-6e03d54d188b?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio4-html5-shoutcast","name":"lbg-audio4-html5-shoutcast","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:43:31Z"},{"id":"wordfence:b09f97df-ee69-43aa-97b5-efc8ba16ef87","source":"wordfence","cve":"CVE-2025-7828","title":"WP Filter & Combine RSS Feeds <= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b09f97df-ee69-43aa-97b5-efc8ba16ef87?source=api-prod","affected":[{"type":"plugin","slug":"wp-filter-combine-rss-feeds","name":"WP Filter & Combine RSS Feeds","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:52:59Z","updated":"2025-08-23T04:25:48Z"},{"id":"wordfence:b0a48c91-7e2c-4708-b5af-dfbcfea08f83","source":"wordfence","cve":"CVE-2024-10356","title":"ElementsReady Addons for Elementor <= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a48c91-7e2c-4708-b5af-dfbcfea08f83?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.4.9"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T12:43:39Z"},{"id":"wordfence:b0a5fdb9-4e36-43ce-88ce-cd75bb1d1e25","source":"wordfence","cve":"CVE-2024-6896","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a5fdb9-4e36-43ce-88ce-cd75bb1d1e25?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.96.1","to_inclusive":true,"patched_in":"1.0.97"}],"published":"2024-07-23T21:41:54Z","updated":"2024-07-24T11:00:09Z"},{"id":"wordfence:b0a9f3d2-aa7f-4fc2-9cfd-b69ec3f63160","source":"wordfence","cve":"CVE-2024-1516","title":"WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a9f3d2-aa7f-4fc2-9cfd-b69ec3f63160?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:12Z"},{"id":"wordfence:b0aa5027-3e13-48f4-b6fd-f93ba5ea6963","source":"wordfence","cve":"CVE-2026-84046","title":"Directorist <= 8.9.4 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0aa5027-3e13-48f4-b6fd-f93ba5ea6963?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:49:45Z"},{"id":"wordfence:b0ab311f-26c1-4165-80bc-512348fcc0c0","source":"wordfence","cve":"CVE-2022-4552","title":"FL3R FeelBox <= 8.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ab311f-26c1-4165-80bc-512348fcc0c0?source=api-prod","affected":[{"type":"plugin","slug":"fl3r-feelbox","name":"FL3R FeelBox","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0ab9274-35c8-473b-accb-602e53816528","source":"wordfence","cve":"CVE-2024-13514","title":"B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ab9274-35c8-473b-accb-602e53816528?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":true,"patched_in":"1.1.24"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T07:21:02Z"},{"id":"wordfence:b0ac43ba-cc49-4688-9efa-585551f3c40c","source":"wordfence","cve":"CVE-2023-37873","title":"WooCommerce Ship to Multiple Addresses <= 3.8.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ac43ba-cc49-4688-9efa-585551f3c40c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-multiple-addresses","name":"WooCommerce Ship to Multiple Addresses","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0ace1a3-81e2-4887-be27-606b49f77357","source":"wordfence","cve":"CVE-2022-4758","title":"10WebMapBuilder <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ace1a3-81e2-4887-be27-606b49f77357?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.71","to_inclusive":true,"patched_in":"1.0.72"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0ad4949-b7e8-4c50-af64-c59e053cfd0e","source":"wordfence","cve":"CVE-2024-23501","title":"Ebook Store <= 5.8001 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ad4949-b7e8-4c50-af64-c59e053cfd0e?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8001","to_inclusive":true,"patched_in":"5.8002"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-25T16:27:02Z"},{"id":"wordfence:b0add190-5f7e-4153-9896-3584773fdd4c","source":"wordfence","cve":"CVE-2025-53256","title":"YaySMTP <= 2.6.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0add190-5f7e-4153-9896-3584773fdd4c?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2025-06-27T00:00:00Z","updated":"2025-10-14T19:18:53Z"},{"id":"wordfence:b0ae27c4-0381-4622-90e8-f4fee29767a3","source":"wordfence","cve":"CVE-2018-7204","title":"Bit File Manager <= 5.0.0 - Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ae27c4-0381-4622-90e8-f4fee29767a3?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2018-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0aec8f4-9c22-4e44-989b-359442c1e6c7","source":"wordfence","cve":"CVE-2025-49267","title":"Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0aec8f4-9c22-4e44-989b-359442c1e6c7?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.28.3","to_inclusive":true,"patched_in":"3.28.5"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-19T14:15:26Z"},{"id":"wordfence:b0b1fbb1-fc2c-4eb9-89c6-364ca8c385db","source":"wordfence","cve":"CVE-2025-13966","title":"Paypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b1fbb1-fc2c-4eb9-89c6-364ca8c385db?source=api-prod","affected":[{"type":"plugin","slug":"paypal-payments-shortcode","name":"Paypal Payment Shortcode","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:25:13Z","updated":"2025-12-12T03:20:53Z"},{"id":"wordfence:b0b223e8-7659-4220-acb6-70dfd4c101f4","source":"wordfence","cve":"","title":"WooCommerce Menu Cart <= 2.11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b223e8-7659-4220-acb6-70dfd4c101f4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-menu-bar-cart","name":"Menu Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0b2bdb3-713c-47c6-8907-ac0f86038dc2","source":"wordfence","cve":"CVE-2023-47669","title":"Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b2bdb3-713c-47c6-8907-ac0f86038dc2?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0b6677e-eeae-4456-b139-c63894b6304e","source":"wordfence","cve":"CVE-2025-28864","title":"Builder for Contact Form 7 by Webconstruct <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b6677e-eeae-4456-b139-c63894b6304e?source=api-prod","affected":[{"type":"plugin","slug":"cf7-builder","name":"Builder for Contact Form 7 by Webconstruct \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:47:45Z"},{"id":"wordfence:b0b68f4f-654b-4f28-a2d7-2ce657151d57","source":"wordfence","cve":"CVE-2025-1288","title":"WOOEXIM \u2013 WooCommerce Export Import Plugin <= 5.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b68f4f-654b-4f28-a2d7-2ce657151d57?source=api-prod","affected":[{"type":"plugin","slug":"wooexim","name":"WOOEXIM \u2013 WooCommerce Export Import Plugin","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-05-30T19:07:55Z"},{"id":"wordfence:b0b71f57-a641-4320-bec1-670bbbfbc708","source":"wordfence","cve":"CVE-2016-10911","title":"Profile Builder \u2013 User Profile & User Registration Forms < 2.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b71f57-a641-4320-bec1-670bbbfbc708?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0b84c2a-7297-4d96-8fa7-638b2b9953f4","source":"wordfence","cve":"CVE-2025-14851","title":"YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b84c2a-7297-4d96-8fa7-638b2b9953f4?source=api-prod","affected":[{"type":"plugin","slug":"yamaps","name":"YaMaps for WordPress Plugin","from":"*","from_inclusive":true,"to":"0.6.40","to_inclusive":true,"patched_in":"0.6.41"}],"published":"2026-02-18T16:26:48Z","updated":"2026-02-19T04:36:20Z"},{"id":"wordfence:b0b8c4c3-eba2-4c20-b790-48eceeba898e","source":"wordfence","cve":"CVE-2023-30484","title":"Enable Accessibility <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b8c4c3-eba2-4c20-b790-48eceeba898e?source=api-prod","affected":[{"type":"plugin","slug":"enable-accessibility","name":"Enable Accessibility","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0bc4476-bf6a-4af4-8da0-7df65226fbf2","source":"wordfence","cve":"CVE-2025-31837","title":"WP Proposals <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0bc4476-bf6a-4af4-8da0-7df65226fbf2?source=api-prod","affected":[{"type":"plugin","slug":"wp-proposals","name":"WP Proposals","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:52:25Z"},{"id":"wordfence:b0bce89d-6b1d-4e7f-bd7f-6143a3b622de","source":"wordfence","cve":"CVE-2020-26876","title":"WP Courses <= 2.0.28 - Improper Access Controls","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0bce89d-6b1d-4e7f-bd7f-6143a3b622de?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"2.0.28","to_inclusive":true,"patched_in":"2.0.29"}],"published":"2020-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0bd0377-8242-426d-a115-53157a8c57a1","source":"wordfence","cve":"CVE-2026-75964","title":"User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0bd0377-8242-426d-a115-53157a8c57a1?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-08-31T17:04:24Z","updated":"2026-09-01T05:30:41Z"},{"id":"wordfence:b0bfe80d-f9d5-4fc0-a8dd-717c31020b8d","source":"wordfence","cve":"CVE-2021-24729","title":"Logo Showcase with Slick Slider \u2013 Logo Carousel, Logo Slider & Logo Grid <= 1.2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0bfe80d-f9d5-4fc0-a8dd-717c31020b8d?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0c01e62-7a31-49de-851c-f52ce578bd95","source":"wordfence","cve":"CVE-2021-25115","title":"WP Photo Album Plus <= 8.0.10 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c01e62-7a31-49de-851c-f52ce578bd95?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.0.10","to_inclusive":false,"patched_in":"8.1.00"}],"published":"2022-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0c12678-1d91-4916-aa11-20292d9e384b","source":"wordfence","cve":"CVE-2026-66705","title":"Meta pixel for WordPress <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c12678-1d91-4916-aa11-20292d9e384b?source=api-prod","affected":[{"type":"plugin","slug":"official-facebook-pixel","name":"Meta pixel for WordPress","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-04T19:20:32Z"},{"id":"wordfence:b0c232b2-f7c8-4a8d-b282-72f61ecfc5da","source":"wordfence","cve":"CVE-2025-14153","title":"Page Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c232b2-f7c8-4a8d-b282-72f61ecfc5da?source=api-prod","affected":[{"type":"plugin","slug":"page-expire-popup","name":"Page Expire Popup/Redirection for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-01-05T14:51:37Z","updated":"2026-01-06T03:21:39Z"},{"id":"wordfence:b0c646b7-8f4d-4966-b866-8764ca98af35","source":"wordfence","cve":"CVE-2022-44627","title":"Simple SEO  <= 1.8.12 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c646b7-8f4d-4966-b866-8764ca98af35?source=api-prod","affected":[{"type":"plugin","slug":"cds-simple-seo","name":"Simple SEO","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.13"}],"published":"2022-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0c80f18-5319-436d-b989-e6f5e6ab58ea","source":"wordfence","cve":"CVE-2026-66689","title":"Anti Spam and list cleaner \u2013 AcyChecker <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c80f18-5319-436d-b989-e6f5e6ab58ea?source=api-prod","affected":[{"type":"plugin","slug":"acychecker","name":"Anti Spam and list cleaner \u2013 AcyChecker","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:49:31Z"},{"id":"wordfence:b0c8b586-784e-43a4-8bb8-c7cb771476a4","source":"wordfence","cve":"CVE-2026-93779","title":"Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-11-06T15:56:29Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:b0cde64f-2533-46e0-9268-b9d100fb0a82","source":"wordfence","cve":"CVE-2024-12412","title":"Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration \u2013 WpRently | WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0cde64f-2533-46e0-9268-b9d100fb0a82?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-01-10T19:06:05Z","updated":"2025-01-31T14:45:59Z"},{"id":"wordfence:b0ce06d3-491e-4565-8b26-f33937aee3e8","source":"wordfence","cve":"CVE-2024-3672","title":"BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ce06d3-491e-4565-8b26-f33937aee3e8?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:46:25Z"},{"id":"wordfence:b0ceff94-e312-41da-acec-15d550aba792","source":"wordfence","cve":"CVE-2023-36519","title":"SW Product Bundles <= 2.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ceff94-e312-41da-acec-15d550aba792?source=api-prod","affected":[{"type":"plugin","slug":"sw-product-bundles","name":"SW Product Bundles","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":""}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0cf3015-cdc9-4ac9-82f3-e9b4d1203e22","source":"wordfence","cve":"CVE-2023-4890","title":"JQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0cf3015-cdc9-4ac9-82f3-e9b4d1203e22?source=api-prod","affected":[{"type":"plugin","slug":"jquery-vertical-accordion-menu","name":"JQuery Accordion Menu Widget","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-11T00:00:00Z","updated":"2024-10-24T18:08:07Z"},{"id":"wordfence:b0d1cf3b-5631-49bd-a7aa-86de2ee4b5b9","source":"wordfence","cve":"CVE-2024-3030","title":"Announce from the Dashboard <= 1.5.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d1cf3b-5631-49bd-a7aa-86de2ee4b5b9?source=api-prod","affected":[{"type":"plugin","slug":"announce-from-the-dashboard","name":"Announce from the Dashboard","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T01:56:57Z"},{"id":"wordfence:b0d4c009-d969-49bb-a56b-a704e5f89a86","source":"wordfence","cve":"CVE-2026-13110","title":"StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d4c009-d969-49bb-a56b-a704e5f89a86?source=api-prod","affected":[{"type":"plugin","slug":"storegrowth-sales-booster","name":"StoreGrowth \u2013 Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-07-27T23:27:41Z","updated":"2026-07-28T11:32:50Z"},{"id":"wordfence:b0d60991-0675-4efa-9427-380e6b59fe28","source":"wordfence","cve":"CVE-2026-4843","title":"GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d60991-0675-4efa-9427-380e6b59fe28?source=api-prod","affected":[{"type":"plugin","slug":"import-products-from-gsheet-for-woo-importer","name":"GSheet For Woo Importer","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-05-21T06:40:29Z","updated":"2026-05-21T19:29:12Z"},{"id":"wordfence:b0d7e56d-453f-4df0-8cf5-32d8bafc60d5","source":"wordfence","cve":"CVE-2021-24467","title":"Leaflet Map < 3.0.0 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d7e56d-453f-4df0-8cf5-32d8bafc60d5?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-map","name":"Leaflet Map","from":"*","from_inclusive":true,"to":"2.23.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2021-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0d8499a-a630-4c2b-9381-78ac83da119d","source":"wordfence","cve":"","title":"WordPress Download Manager <= 3.2.12 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d8499a-a630-4c2b-9381-78ac83da119d?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.13","to_inclusive":false,"patched_in":"3.2.13"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0d8a530-53fd-4e2f-aa57-d75c89dc2a51","source":"wordfence","cve":"CVE-2021-24768","title":"WP RSS Aggregator <= 4.19.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d8a530-53fd-4e2f-aa57-d75c89dc2a51?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.2"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0d9362f-3f34-4602-b19f-2d283e4fe22d","source":"wordfence","cve":"CVE-2019-15713","title":"My Calendar <= 3.1.9 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d9362f-3f34-4602-b19f-2d283e4fe22d?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2019-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0e1546b-c8cc-4d57-9909-153209e3a9c6","source":"wordfence","cve":"CVE-2025-3743","title":"Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e1546b-c8cc-4d57-9909-153209e3a9c6?source=api-prod","affected":[{"type":"plugin","slug":"upsell-order-bump-offer-for-woocommerce","name":"Upsell Funnel Builder for WooCommerce \u2013 Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups.","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T06:45:30Z"},{"id":"wordfence:b0e19fc5-5e79-4383-827d-edd16443e596","source":"wordfence","cve":"CVE-2026-61962","title":"WP BASE Booking of Appointments, Services and Events <= 6.3.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e19fc5-5e79-4383-827d-edd16443e596?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T12:55:26Z"},{"id":"wordfence:b0e340d7-72ad-4a48-8c7c-e5ca61108007","source":"wordfence","cve":"CVE-2024-37953","title":"MBE eShip <= 2.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e340d7-72ad-4a48-8c7c-e5ca61108007?source=api-prod","affected":[{"type":"plugin","slug":"mail-boxes-etc","name":"MBE eShip","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-07-10T00:00:00Z","updated":"2025-01-30T16:33:07Z"},{"id":"wordfence:b0e35280-0c2a-4fe1-bfbe-3321338ff1a5","source":"wordfence","cve":"CVE-2023-0280","title":"Ultimate Carousel For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e35280-0c2a-4fe1-bfbe-3321338ff1a5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-carousel-for-elementor","name":"Ultimate Carousel For Elementor","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0e582e3-9ca3-4601-81f2-cb6ef827a468","source":"wordfence","cve":"CVE-2023-36508","title":"Contact Form to DB by BestWebSoft <= 1.7.1 - Authenticated (Administrator+) SQL Injection via 's'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e582e3-9ca3-4601-81f2-cb6ef827a468?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0e62351-bb73-4319-80f6-a1fa49e3dce2","source":"wordfence","cve":"CVE-2025-57885","title":"Fluent Support <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e62351-bb73-4319-80f6-a1fa49e3dce2?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:04:29Z"},{"id":"wordfence:b0e63d48-8749-4c10-a086-425e81df6920","source":"wordfence","cve":"CVE-2026-28024","title":"Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e63d48-8749-4c10-a086-425e81df6920?source=api-prod","affected":[{"type":"theme","slug":"helion","name":"Helion | Personal Portfolio & Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:26:18Z"},{"id":"wordfence:b0e73380-6eab-47d9-b328-f0eb5c7e763d","source":"wordfence","cve":"CVE-2025-32548","title":"Hamburger Icon Menu Lite <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0e73380-6eab-47d9-b328-f0eb5c7e763d?source=api-prod","affected":[{"type":"plugin","slug":"hamburger-icon-menu-lite","name":"Hamburger Icon Menu Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T18:54:29Z"},{"id":"wordfence:b0ea041b-f09d-4c62-aada-26afbc60b6f2","source":"wordfence","cve":"CVE-2024-3587","title":"Premium Portfolio Features for Phlox theme <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ea041b-f09d-4c62-aada-26afbc60b6f2?source=api-prod","affected":[{"type":"plugin","slug":"auxin-portfolio","name":"Premium Portfolio Features for Phlox theme","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T08:32:32Z"},{"id":"wordfence:b0eb165f-c979-4318-8362-ca47500ed845","source":"wordfence","cve":"","title":"Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization on multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0eb165f-c979-4318-8362-ca47500ed845?source=api-prod","affected":[{"type":"plugin","slug":"image-regenerate-select-crop","name":"Image Regenerate & Select Crop","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":false,"patched_in":"7.2.0"}],"published":"2023-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0eba1e2-d34e-4164-a7cb-55148d308439","source":"wordfence","cve":"CVE-2021-36877","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0eba1e2-d34e-4164-a7cb-55148d308439?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T04:34:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0eedeba-cdff-4e84-8182-1bebf48c76e0","source":"wordfence","cve":"CVE-2023-0150","title":"Cloak Front End Email <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0eedeba-cdff-4e84-8182-1bebf48c76e0?source=api-prod","affected":[{"type":"plugin","slug":"cloak-front-end-email","name":"Cloak Front End Email","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0ef885f-fd62-4513-83cb-65381b99a172","source":"wordfence","cve":"CVE-2022-21661","title":"WordPress Core < 5.8.3 - SQL Injection via WP_Query","severity":"high","cvss":8.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ef885f-fd62-4513-83cb-65381b99a172?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.35","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":false,"patched_in":"3.7.37"}],"published":"2021-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b0f2bdbf-96a5-4f3a-88c1-455b938eba03","source":"wordfence","cve":"CVE-2025-49044","title":"Simple Poll <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f2bdbf-96a5-4f3a-88c1-455b938eba03?source=api-prod","affected":[{"type":"plugin","slug":"simple-poll","name":"Simple Poll","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:35:35Z"},{"id":"wordfence:b0f2c7f0-ff24-4489-9fb4-8a98ac6dc09a","source":"wordfence","cve":"CVE-2025-9044","title":"Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f2c7f0-ff24-4489-9fb4-8a98ac6dc09a?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":"1.21.0"}],"published":"2025-09-25T14:31:06Z","updated":"2025-09-26T03:25:34Z"},{"id":"wordfence:b0f3cdce-e239-4c2f-83e3-e8d0b528d39e","source":"wordfence","cve":"CVE-2024-13481","title":"LTL Freight Quotes \u2013 R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f3cdce-e239-4c2f-83e3-e8d0b528d39e?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-rl-edition","name":"LTL Freight Quotes \u2013 R+L Carriers Edition","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:41Z"},{"id":"wordfence:b0f62d05-84fb-4cd6-9e5f-0dcfa305ce68","source":"wordfence","cve":"CVE-2025-10646","title":"Search Exclude <= 2.5.7 \u2013 Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f62d05-84fb-4cd6-9e5f-0dcfa305ce68?source=api-prod","affected":[{"type":"plugin","slug":"search-exclude","name":"Search Exclude","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2025-11-24T15:08:06Z","updated":"2025-11-25T03:27:43Z"},{"id":"wordfence:b0f9242c-88da-4d94-9c32-26cce745b48b","source":"wordfence","cve":"CVE-2026-16268","title":"Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f9242c-88da-4d94-9c32-26cce745b48b?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-21T15:38:50Z"},{"id":"wordfence:b0fd2ffa-efbe-40ad-adef-e212819b3793","source":"wordfence","cve":"CVE-2026-120845","title":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fd2ffa-efbe-40ad-adef-e212819b3793?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:58:05Z"},{"id":"wordfence:b0fd8e7b-1985-4265-8e15-5b3988bb0225","source":"wordfence","cve":"CVE-2026-76057","title":"AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fd8e7b-1985-4265-8e15-5b3988bb0225?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"5.8.5"}],"published":"2026-08-21T15:09:12Z","updated":"2026-08-24T13:22:51Z"},{"id":"wordfence:b0fdad22-5aee-468f-885c-f65c068cf413","source":"wordfence","cve":"CVE-2023-47833","title":"Theater for WordPress <= 0.18.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fdad22-5aee-468f-885c-f65c068cf413?source=api-prod","affected":[{"type":"plugin","slug":"theatre","name":"Theater for WordPress","from":"*","from_inclusive":true,"to":"0.18.3","to_inclusive":true,"patched_in":"0.18.4"}],"published":"2023-11-16T00:00:00Z","updated":"2024-04-25T18:56:09Z"},{"id":"wordfence:b0fe7d29-118f-42fb-9e48-6217faaa689b","source":"wordfence","cve":"CVE-2026-120561","title":"JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0fe7d29-118f-42fb-9e48-6217faaa689b?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.2.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-11-03T04:43:09Z"},{"id":"wordfence:b0ff9652-1b45-43d6-949a-92bfeaee96d3","source":"wordfence","cve":"CVE-2026-107764","title":"SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ff9652-1b45-43d6-949a-92bfeaee96d3?source=api-prod","affected":[{"type":"plugin","slug":"so-css","name":"SiteOrigin CSS","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2026-10-15T16:56:49Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:b100ba5a-8aad-4aa1-98bf-a09c5bde7bc1","source":"wordfence","cve":"","title":"Resume Submissions & Job Postings Plugin <= 2.5.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b100ba5a-8aad-4aa1-98bf-a09c5bde7bc1?source=api-prod","affected":[{"type":"plugin","slug":"resume-submissions-job-postings","name":"Resume Submissions & Job Postings","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":""}],"published":"2016-03-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b102af8f-2bc3-4548-9a90-d1280b058173","source":"wordfence","cve":"CVE-2024-24845","title":"Post Thumbnail Editor <= 2.4.8 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b102af8f-2bc3-4548-9a90-d1280b058173?source=api-prod","affected":[{"type":"plugin","slug":"post-thumbnail-editor","name":"Post Thumbnail Editor","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:19:17Z"},{"id":"wordfence:b10303e0-c864-4088-91d1-d38c24094812","source":"wordfence","cve":"CVE-2023-30500","title":"Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10303e0-c864-4088-91d1-d38c24094812?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.8.1.2","to_inclusive":true,"patched_in":"1.8.1.3"},{"type":"plugin","slug":"wpforms","name":"WPForms Pro","from":"*","from_inclusive":true,"to":"1.8.1.2","to_inclusive":true,"patched_in":"1.8.1.3"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b10333f8-fd90-43a7-8404-71954ee29e47","source":"wordfence","cve":"CVE-2025-5237","title":"Target Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10333f8-fd90-43a7-8404-71954ee29e47?source=api-prod","affected":[{"type":"plugin","slug":"brid-video-easy-publish","name":"Target Video Easy Publish","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2025-06-17T20:30:21Z","updated":"2025-06-18T09:21:31Z"},{"id":"wordfence:b1043c80-e1fc-4264-8e51-218f89fdd162","source":"wordfence","cve":"CVE-2024-50426","title":"Survey Maker <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1043c80-e1fc-4264-8e51-218f89fdd162?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:48:59Z"},{"id":"wordfence:b105fe2a-b1fd-42d4-ab16-b80115e22531","source":"wordfence","cve":"CVE-2020-35773","title":"Site Offline Or Coming Soon Or Maintenance Mode <= 1.4.2 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"high","cvss":8.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b105fe2a-b1fd-42d4-ab16-b80115e22531?source=api-prod","affected":[{"type":"plugin","slug":"site-offline","name":"Site Offline Or Coming Soon Or Maintenance Mode","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2020-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b108ba89-56c4-44a8-af61-ccd6f7f73562","source":"wordfence","cve":"","title":"AA-Team Premium SEO Pack <= 1.8.0 - Local File Disclosure and Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b108ba89-56c4-44a8-af61-ccd6f7f73562?source=api-prod","affected":[{"type":"plugin","slug":"premium-seo-pack-light-version","name":"Premium Seo Pack \u2013 Light Version","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2015-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b108e2e9-e5af-464a-98d9-bb40a2b65c14","source":"wordfence","cve":"CVE-2024-4627","title":"Rank Math SEO <= 1.0.218 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b108e2e9-e5af-464a-98d9-bb40a2b65c14?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.218","to_inclusive":true,"patched_in":"1.0.219"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-26T19:32:24Z"},{"id":"wordfence:b10941c7-40f1-4157-a9d9-40844d25b22b","source":"wordfence","cve":"CVE-2023-22680","title":"No API Amazon Affiliate <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10941c7-40f1-4157-a9d9-40844d25b22b?source=api-prod","affected":[{"type":"plugin","slug":"no-api-amazon-affiliate","name":"No API Amazon Affiliate","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b10a4561-1724-4e98-bff2-ca5416b217dc","source":"wordfence","cve":"","title":"Finalist (All Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10a4561-1724-4e98-bff2-ca5416b217dc?source=api-prod","affected":[{"type":"plugin","slug":"finalist","name":"Finalist","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b10c0b70-5aa7-4ec6-9041-6ca7b714905b","source":"wordfence","cve":"CVE-2025-48308","title":"Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10c0b70-5aa7-4ec6-9041-6ca7b714905b?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-subscription-widget-for-sendblaster","name":"Newsletter subscription optin module","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T19:56:28Z"},{"id":"wordfence:b10c7619-85b0-4d06-b48c-248fa3f66229","source":"wordfence","cve":"CVE-2025-68974","title":"Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10c7619-85b0-4d06-b48c-248fa3f66229?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon","from":"*","from_inclusive":true,"to":"7.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2026-01-06T14:54:24Z"},{"id":"wordfence:b10d01ec-54ef-456b-9410-ed013343a962","source":"wordfence","cve":"CVE-2023-2027","title":"ZM Ajax Login & Register <= 2.0.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d01ec-54ef-456b-9410-ed013343a962?source=api-prod","affected":[{"type":"plugin","slug":"zm-ajax-login-register","name":"ZM Ajax Login & Register","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-06-17T17:26:41Z"},{"id":"wordfence:b10d8f8a-517f-4286-b501-0ca040529362","source":"wordfence","cve":"CVE-2024-1206","title":"WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d8f8a-517f-4286-b501-0ca040529362?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.2.0"}],"published":"2024-02-07T00:00:00Z","updated":"2024-02-20T18:56:41Z"},{"id":"wordfence:b1106654-a36d-47a5-9db8-a897a0a45ef3","source":"wordfence","cve":"CVE-2025-31568","title":"LeadLab by wiredminds <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1106654-a36d-47a5-9db8-a897a0a45ef3?source=api-prod","affected":[{"type":"plugin","slug":"wiredminds-leadlab","name":"LeadLab by wiredminds","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-04-01T00:00:00Z","updated":"2025-07-11T15:56:30Z"},{"id":"wordfence:b1117f36-a8a2-4ed5-89be-ed0215fda0b1","source":"wordfence","cve":"CVE-2026-28092","title":"Sounder | Internet Radio & Streaming Elementor Template Kit <= 1.3.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1117f36-a8a2-4ed5-89be-ed0215fda0b1?source=api-prod","affected":[{"type":"theme","slug":"sounder","name":"Sounder | Internet Radio & Streaming Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T14:30:30Z"},{"id":"wordfence:b111bfd5-3eff-4255-9123-cae38bfb73c3","source":"wordfence","cve":"CVE-2026-12801","title":"Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b111bfd5-3eff-4255-9123-cae38bfb73c3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.43","to_inclusive":true,"patched_in":"3.5.44"}],"published":"2026-08-06T16:21:57Z","updated":"2026-08-07T04:25:55Z"},{"id":"wordfence:b113f475-3133-4ea3-9152-03bb84d79307","source":"wordfence","cve":"CVE-2025-13563","title":"Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b113f475-3133-4ea3-9152-03bb84d79307?source=api-prod","affected":[{"type":"plugin","slug":"lizza-lms-pro","name":"Lizza LMS Pro","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-02-18T15:49:30Z","updated":"2026-02-19T04:36:20Z"},{"id":"wordfence:b1146350-4491-4fa0-8b78-6dbc00903160","source":"wordfence","cve":"CVE-2026-0559","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1146350-4491-4fa0-8b78-6dbc00903160?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.11","to_inclusive":true,"patched_in":"3.7.12"}],"published":"2026-02-13T18:22:45Z","updated":"2026-02-14T06:42:34Z"},{"id":"wordfence:b117d77b-2c11-451c-b236-b55e8af68a9a","source":"wordfence","cve":"CVE-2025-14147","title":"Easy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b117d77b-2c11-451c-b236-b55e8af68a9a?source=api-prod","affected":[{"type":"plugin","slug":"easy-github-gist-shortcodes","name":"Easy GitHub Gist Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:33:54Z","updated":"2026-01-07T09:21:03Z"},{"id":"wordfence:b11b886e-72a7-4b27-a4ac-f4586c3ef722","source":"wordfence","cve":"CVE-2025-68018","title":"Order Listener for WooCommerce <= 3.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b11b886e-72a7-4b27-a4ac-f4586c3ef722?source=api-prod","affected":[{"type":"plugin","slug":"woc-order-alert","name":"StackWC Order Notification for WooCommerce \u2013 Get Instant Audio Alert on new Orders","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-01-19T00:00:00Z","updated":"2026-03-06T18:40:30Z"},{"id":"wordfence:b11babc0-285e-4ea3-a3cc-21938af5d83c","source":"wordfence","cve":"CVE-2025-23902","title":"Error Notification <= 0.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b11babc0-285e-4ea3-a3cc-21938af5d83c?source=api-prod","affected":[{"type":"plugin","slug":"error-notification","name":"Error Notification","from":"*","from_inclusive":true,"to":"0.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:59:25Z"},{"id":"wordfence:b11ccbbd-c909-4160-af36-8f0b50fb1285","source":"wordfence","cve":"CVE-2024-43967","title":"WP Testimonial Widget <= 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b11ccbbd-c909-4160-af36-8f0b50fb1285?source=api-prod","affected":[{"type":"plugin","slug":"wp-testimonial-widget","name":"WP Testimonial Widget","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-11-07T21:42:35Z"},{"id":"wordfence:b11ed628-f736-4262-80a2-62b32948a3a4","source":"wordfence","cve":"CVE-2024-13315","title":"Shopwarden \u2013 Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b11ed628-f736-4262-80a2-62b32948a3a4?source=api-prod","affected":[{"type":"plugin","slug":"shopwarden","name":"Shopwarden \u2013 Automated WooCommerce monitoring & testing","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T05:22:29Z"},{"id":"wordfence:b11f2ad4-5a89-4387-a307-350cead20491","source":"wordfence","cve":"CVE-2022-3753","title":"Evaluate <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b11f2ad4-5a89-4387-a307-350cead20491?source=api-prod","affected":[{"type":"plugin","slug":"evaluate","name":"Evaluate","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b120d99e-5906-4c7f-b10a-1f915a8ff6d6","source":"wordfence","cve":"CVE-2025-32173","title":"B Blocks - The ultimate block collection <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b120d99e-5906-4c7f-b10a-1f915a8ff6d6?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-15T12:30:59Z"},{"id":"wordfence:b121fdb4-93a8-400c-89c2-3195cb40e03c","source":"wordfence","cve":"CVE-2025-9967","title":"Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b121fdb4-93a8-400c-89c2-3195cb40e03c?source=api-prod","affected":[{"type":"plugin","slug":"orion-sms-otp-verification","name":"Orion SMS OTP Verification.","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-10-14T20:00:13Z","updated":"2026-02-06T17:22:05Z"},{"id":"wordfence:b1256966-0b0f-43d1-a168-20b8851e4aae","source":"wordfence","cve":"CVE-2026-97289","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker <= 11.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1256966-0b0f-43d1-a168-20b8851e4aae?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.6","to_inclusive":true,"patched_in":"11.2.7"}],"published":"2026-09-30T09:48:07Z","updated":"2026-10-09T00:01:20Z"},{"id":"wordfence:b12692f4-3530-4f1c-8f67-1cefe3035fd7","source":"wordfence","cve":"CVE-2026-103075","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12692f4-3530-4f1c-8f67-1cefe3035fd7?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.14.2","to_inclusive":true,"patched_in":"7.8.14.3"}],"published":"2026-10-07T09:12:00Z","updated":"2026-10-08T23:15:46Z"},{"id":"wordfence:b1278291-9fef-40f5-a432-d96f4bed31fe","source":"wordfence","cve":"CVE-2023-51425","title":"Rencontre \u2013 Dating Site <= 3.10.1 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1278291-9fef-40f5-a432-d96f4bed31fe?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1280aec-f253-404e-b03c-d1b8416a6e7d","source":"wordfence","cve":"CVE-2022-3862","title":"Livemesh Addons for Elementor <= 7.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1280aec-f253-404e-b03c-d1b8416a6e7d?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.2.4"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1282482-3b41-423a-bff5-a82471fafc23","source":"wordfence","cve":"CVE-2026-86446","title":"LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1282482-3b41-423a-bff5-a82471fafc23?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"4.4.3","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:43:47Z"},{"id":"wordfence:b128ecb7-325d-43c1-8187-c5949242e760","source":"wordfence","cve":"CVE-2025-31035","title":"WP Editor.md \u2013 The Perfect WordPress Markdown Editor <= 10.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b128ecb7-325d-43c1-8187-c5949242e760?source=api-prod","affected":[{"type":"plugin","slug":"wp-editormd","name":"WP Editor.md \u2013 The Perfect WordPress Markdown Editor","from":"*","from_inclusive":true,"to":"10.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:08:26Z"},{"id":"wordfence:b128fa23-090e-4449-9202-a1db572e242d","source":"wordfence","cve":"CVE-2022-47425","title":"ARMember <= 3.4.10 - Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b128fa23-090e-4449-9202-a1db572e242d?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":"3.4.11"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b12a25e1-98a7-427b-85b0-8503f74687d5","source":"wordfence","cve":"CVE-2024-52498","title":"SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12a25e1-98a7-427b-85b0-8503f74687d5?source=api-prod","affected":[{"type":"plugin","slug":"sp-blog-designer","name":"SP Blog Designer","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:33:15Z"},{"id":"wordfence:b12a7e57-a45f-407a-9dd9-843a628d73ac","source":"wordfence","cve":"CVE-2023-32101","title":"Library Viewer <= 2.0.6 - Open Redirect via 'redirect_to'","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12a7e57-a45f-407a-9dd9-843a628d73ac?source=api-prod","affected":[{"type":"plugin","slug":"library-viewer","name":"Library Viewer","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.6.1"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b12b0a2a-3c3c-4d9c-a404-c8f170638e31","source":"wordfence","cve":"CVE-2022-3402","title":"Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12b0a2a-3c3c-4d9c-a404-c8f170638e31?source=api-prod","affected":[{"type":"plugin","slug":"log-http-requests","name":"Log HTTP Requests","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2022-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b12c0524-d991-4f96-8646-f4203880558c","source":"wordfence","cve":"CVE-2024-2953","title":"LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12c0524-d991-4f96-8646-f4203880558c?source=api-prod","affected":[{"type":"plugin","slug":"luckywp-table-of-contents","name":"LuckyWP Table of Contents","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-05-21T00:00:00Z","updated":"2024-09-24T18:35:03Z"},{"id":"wordfence:b12deaa4-246e-4502-8091-fcbe5a2eae15","source":"wordfence","cve":"CVE-2019-12240","title":"Virim <= 0.4 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12deaa4-246e-4502-8091-fcbe5a2eae15?source=api-prod","affected":[{"type":"plugin","slug":"virim","name":"Virim","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b12efe6c-63e9-4d5c-9437-7c0b6abe2ee5","source":"wordfence","cve":"CVE-2014-9339","title":"Spnbabble <= 1.4.1 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12efe6c-63e9-4d5c-9437-7c0b6abe2ee5?source=api-prod","affected":[{"type":"plugin","slug":"spnbabble","name":"spnbabble","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b12f1aaf-fb0d-4f90-bd07-5b7b422b61e7","source":"wordfence","cve":"CVE-2026-114432","title":"Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b12f1aaf-fb0d-4f90-bd07-5b7b422b61e7?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"6.2","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:17:07Z"},{"id":"wordfence:b1305be5-8267-475f-b962-62e3930116e1","source":"wordfence","cve":"CVE-2024-8236","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1305be5-8267-475f-b962-62e3930116e1?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.25.7","to_inclusive":true,"patched_in":"3.25.8"}],"published":"2024-11-25T00:00:00Z","updated":"2024-11-26T13:56:55Z"},{"id":"wordfence:b1312c34-45c6-41e5-b6fc-a45ac2c8a0ca","source":"wordfence","cve":"CVE-2024-12616","title":"Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1312c34-45c6-41e5-b6fc-a45ac2c8a0ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-bitly","name":"Bitly's WordPress Plugin","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2025-01-08T00:00:00Z","updated":"2025-04-17T13:10:01Z"},{"id":"wordfence:b133888c-7673-4796-917c-486bff1b6b12","source":"wordfence","cve":"CVE-2020-36854","title":"Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b133888c-7673-4796-917c-486bff1b6b12?source=api-prod","affected":[{"type":"plugin","slug":"async-javascript","name":"Async JavaScript","from":"*","from_inclusive":true,"to":"2.20.02.27","to_inclusive":false,"patched_in":"2.20.02.27"}],"published":"2020-02-27T00:00:00Z","updated":"2025-10-18T03:33:24Z"},{"id":"wordfence:b133d48c-3a42-43ba-8049-05e745b96501","source":"wordfence","cve":"CVE-2025-32528","title":"iCal Feeds <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b133d48c-3a42-43ba-8049-05e745b96501?source=api-prod","affected":[{"type":"plugin","slug":"ical-feeds","name":"iCal Feeds","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:08:00Z"},{"id":"wordfence:b1351915-5f00-48d0-a768-cd9aea533b60","source":"wordfence","cve":"CVE-2025-22555","title":"Smoothness Slider Shortcode <= v1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1351915-5f00-48d0-a768-cd9aea533b60?source=api-prod","affected":[{"type":"plugin","slug":"smoothness-slider-shortcode","name":"Smoothness Slider Shortcode","from":"*","from_inclusive":true,"to":"v1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-15T14:05:02Z"},{"id":"wordfence:b1355e9f-fa3a-439a-a13f-49b10dd4473a","source":"wordfence","cve":"CVE-2023-4757","title":"Staff / Employee Business Directory for Active Directory <= 1.2.1 - Insufficient Escaping of Stored LDAP Values","severity":"medium","cvss":5.4,"cwe":"CWE-116","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1355e9f-fa3a-439a-a13f-49b10dd4473a?source=api-prod","affected":[{"type":"plugin","slug":"ldap-ad-staff-employee-directory-search","name":"Staff/Employee Business Directory for Active Directory","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1376596-571a-48d2-bbb7-e6bc69de00ac","source":"wordfence","cve":"CVE-2026-66657","title":"Biagiotti Core <= 2.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1376596-571a-48d2-bbb7-e6bc69de00ac?source=api-prod","affected":[{"type":"plugin","slug":"biagiotti-core","name":"Biagiotti Core","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-17T04:31:25Z"},{"id":"wordfence:b139260b-7741-4e35-b23f-896f23719739","source":"wordfence","cve":"","title":"Spectra <= 2.6.6 - Authenticated (Contributor+) Server-Side Request Forgery in template_importer","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b139260b-7741-4e35-b23f-896f23719739?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b13e1916-2a02-4a91-acf1-6e5d7c55bd57","source":"wordfence","cve":"CVE-2023-1196","title":"Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b13e1916-2a02-4a91-acf1-6e5d7c55bd57?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.12.4","to_inclusive":true,"patched_in":"5.12.5"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"6.0.0","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"5.12.5"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b13ee51b-9f23-428f-9cef-4a9b9b06b0c4","source":"wordfence","cve":"CVE-2023-1374","title":"Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b13ee51b-9f23-428f-9cef-4a9b9b06b0c4?source=api-prod","affected":[{"type":"plugin","slug":"solidres","name":"Solidres \u2013 Hotel booking plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b13f1fb2-5dbc-4d7d-b4cc-b6dc6804531a","source":"wordfence","cve":"","title":"SEO Redirection Plugin \u2013 301 Redirect Manager <= 7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b13f1fb2-5dbc-4d7d-b4cc-b6dc6804531a?source=api-prod","affected":[{"type":"plugin","slug":"seo-redirection","name":"SEO Redirection Plugin \u2013 301 Redirect Manager","from":"*","from_inclusive":true,"to":"7.3","to_inclusive":true,"patched_in":"7.4"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b13f6a3f-cab6-4aff-a96e-58250fcf655a","source":"wordfence","cve":"CVE-2020-28037","title":"WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation","severity":"medium","cvss":4.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b13f6a3f-cab6-4aff-a96e-58250fcf655a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b140d228-cd74-4d78-8b9d-9a69e5a89bfb","source":"wordfence","cve":"CVE-2023-27441","title":"New Adman <= 1.6.8 - Cross-Site Request Forgery via plugin_menu","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b140d228-cd74-4d78-8b9d-9a69e5a89bfb?source=api-prod","affected":[{"type":"plugin","slug":"new-adman","name":"New Adman","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b142859d-780f-47f8-aaed-000bdd0aaaa7","source":"wordfence","cve":"CVE-2026-49780","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b142859d-780f-47f8-aaed-000bdd0aaaa7?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-10T18:18:03Z"},{"id":"wordfence:b1446daf-662d-479c-8fc5-80b27b04d6c4","source":"wordfence","cve":"CVE-2007-0262","title":"WordPress Core < 2.0.7 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1446daf-662d-479c-8fc5-80b27b04d6c4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2007-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1469b02-c52d-4a02-a974-81dd1e2c1f97","source":"wordfence","cve":"CVE-2024-56044","title":"WPLMS <= 1.9.9 - Missing Authorization to Unauthenticated User Token Generation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1469b02-c52d-4a02-a974-81dd1e2c1f97?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.9.1"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:00:12Z"},{"id":"wordfence:b148926d-090d-4fab-991c-89105078a263","source":"wordfence","cve":"CVE-2025-4055","title":"Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b148926d-090d-4fab-991c-89105078a263?source=api-prod","affected":[{"type":"plugin","slug":"multiple-post-type-order","name":"Multiple Post Type Order","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-06T13:28:57Z","updated":"2025-05-07T01:57:47Z"},{"id":"wordfence:b148ad4e-afed-4f91-9dd6-343aff13945b","source":"wordfence","cve":"CVE-2025-67967","title":"Lawyer Directory <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b148ad4e-afed-4f91-9dd6-343aff13945b?source=api-prod","affected":[{"type":"plugin","slug":"lawyer-directory","name":"Lawyer Directory","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T15:24:13Z"},{"id":"wordfence:b14945a5-c5e7-45cb-b2cc-8d1a265b6c52","source":"wordfence","cve":"CVE-2026-107742","title":"10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14945a5-c5e7-45cb-b2cc-8d1a265b6c52?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.34.8","to_inclusive":true,"patched_in":"2.34.10"}],"published":"2026-10-09T17:45:10Z","updated":"2026-10-10T06:40:15Z"},{"id":"wordfence:b14aa8bd-b58b-4af2-9b37-6bafa44cc98f","source":"wordfence","cve":"CVE-2026-105975","title":"CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Arbitrary Payment Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14aa8bd-b58b-4af2-9b37-6bafa44cc98f?source=api-prod","affected":[{"type":"plugin","slug":"campay-shortcode-payment-gateway","name":"CamPay Shortcode Payment Gateway","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:20:06Z"},{"id":"wordfence:b14acbc6-a6af-43f0-8371-c85e5abcf8eb","source":"wordfence","cve":"CVE-2025-49991","title":"WP-Recall <= 16.26.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14acbc6-a6af-43f0-8371-c85e5abcf8eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:20:05Z"},{"id":"wordfence:b14af68e-960f-4817-bab4-881f2720cb82","source":"wordfence","cve":"CVE-2021-24585","title":"Timetable and Event Schedule by MotoPress <= 2.3.19 - Arbitrary User's Hashed Password/Email/Username Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14af68e-960f-4817-bab4-881f2720cb82?source=api-prod","affected":[{"type":"plugin","slug":"mp-timetable","name":"Timetable and Event Schedule by MotoPress","from":"*","from_inclusive":true,"to":"2.3.19","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b14bc75a-0bfb-4d46-89db-c31fb6bfa7cf","source":"wordfence","cve":"CVE-2023-0220","title":"Pinpoint Booking System  <= 2.9.9.2.8 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14bc75a-0bfb-4d46-89db-c31fb6bfa7cf?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.2.8","to_inclusive":true,"patched_in":"2.9.9.2.9"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b14c6f65-b697-43a7-a5d6-a928cec0df43","source":"wordfence","cve":"CVE-2026-120838","title":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos <= 5.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14c6f65-b697-43a7-a5d6-a928cec0df43?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-11-07T10:01:04Z","updated":"2026-11-10T19:38:08Z"},{"id":"wordfence:b14cada2-5d04-47a1-b648-048fcbabd2b5","source":"wordfence","cve":"CVE-2021-24437","title":"Favicon by RealFaviconGenerator <= 1.3.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14cada2-5d04-47a1-b648-048fcbabd2b5?source=api-prod","affected":[{"type":"plugin","slug":"favicon-by-realfavicongenerator","name":"Favicon by RealFaviconGenerator","from":"*","from_inclusive":true,"to":"1.3.21","to_inclusive":false,"patched_in":"1.3.21"}],"published":"2021-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b14dec28-41f9-460f-aa6c-3e6baf2498d8","source":"wordfence","cve":"CVE-2021-24239","title":"Pie Register \u2013 User Registration Forms <= 3.7.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14dec28-41f9-460f-aa6c-3e6baf2498d8?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.7.0.1","to_inclusive":false,"patched_in":"3.7.0.1"}],"published":"2021-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b14f574d-1490-423e-9ef3-ce8f844cb8f0","source":"wordfence","cve":"CVE-2026-78471","title":"Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b14f574d-1490-423e-9ef3-ce8f844cb8f0?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.15.1","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2026-10-01T16:42:10Z","updated":"2026-10-02T05:30:19Z"},{"id":"wordfence:b150f90a-ccb7-4c19-a4b3-eaf9ec264ba8","source":"wordfence","cve":"CVE-2024-1505","title":"Academy LMS \u2013 eLearning and online course solution for WordPress <= 1.9.19 -  Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b150f90a-ccb7-4c19-a4b3-eaf9ec264ba8?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"1.9.19","to_inclusive":true,"patched_in":"1.9.20"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:27:10Z"},{"id":"wordfence:b1524363-fe00-4351-b98e-e46651bc2176","source":"wordfence","cve":"CVE-2026-112832","title":"Rootblox \u2013 Header & Footer Builder for Full Site Editing (FSE) <= 1.0.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1524363-fe00-4351-b98e-e46651bc2176?source=api-prod","affected":[{"type":"plugin","slug":"rootblox","name":"Rootblox \u2013 Header & Footer Builder for Full Site Editing (FSE)","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-10-20T10:29:56Z","updated":"2026-10-23T18:37:00Z"},{"id":"wordfence:b152b6fa-66f3-4a43-9d6a-4f6c0b85acc7","source":"wordfence","cve":"CVE-2026-97293","title":"Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b152b6fa-66f3-4a43-9d6a-4f6c0b85acc7?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.41","to_inclusive":true,"patched_in":"3.42"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:43:58Z"},{"id":"wordfence:b1541aaf-9f35-44b5-a985-1b8d33228f0a","source":"wordfence","cve":"CVE-2024-11910","title":"WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1541aaf-9f35-44b5-a985-1b8d33228f0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2024-12-12T20:17:16Z","updated":"2025-06-05T19:36:45Z"},{"id":"wordfence:b155f8ca-9d09-47d7-a7c2-7744df029c19","source":"wordfence","cve":"CVE-2024-4779","title":"Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b155f8ca-9d09-47d7-a7c2-7744df029c19?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.107","to_inclusive":true,"patched_in":"1.5.108"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T09:32:33Z"},{"id":"wordfence:b156379a-fbb8-4fc0-9cc0-534b131bf785","source":"wordfence","cve":"CVE-2023-40201","title":"Futurio Extra <= 1.9.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b156379a-fbb8-4fc0-9cc0-534b131bf785?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b157356c-a4be-48d6-8c58-ad1a9c96cda3","source":"wordfence","cve":"CVE-2020-5766","title":"SRS Simple Hits Counter Plugin for WordPress 1.03 - 1.04 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b157356c-a4be-48d6-8c58-ad1a9c96cda3?source=api-prod","affected":[{"type":"plugin","slug":"srs-simple-hits-counter","name":"SRS Simple Hits Counter","from":"1.0.3","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2020-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b157faa9-0d43-4ac6-ab4d-19a5911aecbd","source":"wordfence","cve":"CVE-2024-54411","title":"WP Controller <= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b157faa9-0d43-4ac6-ab4d-19a5911aecbd?source=api-prod","affected":[{"type":"plugin","slug":"wp-management-controller","name":"WP Controller","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:33:24Z"},{"id":"wordfence:b15a2ddb-ed74-4ac3-8cfb-e8553dad90d6","source":"wordfence","cve":"CVE-2022-0313","title":"Float Menu <= 4.3 - Arbitrary Menu Deletion via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b15a2ddb-ed74-4ac3-8cfb-e8553dad90d6?source=api-prod","affected":[{"type":"plugin","slug":"float-menu","name":"Float menu \u2013 awesome floating side menu","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b15b08e1-0aa7-49a3-9a08-bbc48f13260c","source":"wordfence","cve":"CVE-2025-9034","title":"Wp Edit Password Protected <= 1.3.4 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b15b08e1-0aa7-49a3-9a08-bbc48f13260c?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-password-protected","name":"WPEPP \u2013 All In One WordPress Security, Firewall, Malware Scanner & Login Protection","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-08-21T00:00:00Z","updated":"2025-09-25T19:38:04Z"},{"id":"wordfence:b15b10a4-04fd-4860-9cc9-cefcdbbbf507","source":"wordfence","cve":"","title":"User Rights Access Manager <= 1.0.7 - Access Restriction Bypass","severity":"high","cvss":7.2,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b15b10a4-04fd-4860-9cc9-cefcdbbbf507?source=api-prod","affected":[{"type":"plugin","slug":"user-rights-access-manager","name":"User Rights Access Manager","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2021-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b15d1992-ecf9-4253-b832-056b34f42b48","source":"wordfence","cve":"CVE-2025-13157","title":"QODE Wishlist for WooCommerce <= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b15d1992-ecf9-4253-b832-056b34f42b48?source=api-prod","affected":[{"type":"plugin","slug":"qode-wishlist-for-woocommerce","name":"QODE Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T06:42:13Z"},{"id":"wordfence:b1613961-48ba-4f68-8f4f-36dd9d8861e4","source":"wordfence","cve":"CVE-2025-24682","title":"Super Block Slider <= 2.7.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1613961-48ba-4f68-8f4f-36dd9d8861e4?source=api-prod","affected":[{"type":"plugin","slug":"super-block-slider","name":"Super block slider \u2013 Image/video background & content slider","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:41:08Z"},{"id":"wordfence:b1623bef-09c8-43e0-a6a1-f5b9aa3ba7eb","source":"wordfence","cve":"CVE-2024-43139","title":"Football Pool <= 2.11.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1623bef-09c8-43e0-a6a1-f5b9aa3ba7eb?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.11.9","to_inclusive":true,"patched_in":"2.11.10"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:08:04Z"},{"id":"wordfence:b168f54a-fcc3-4832-bbb8-01b571ef0e4a","source":"wordfence","cve":"CVE-2025-30894","title":"WP Fast Total Search <= 1.79.262 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b168f54a-fcc3-4832-bbb8-01b571ef0e4a?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.79.262","to_inclusive":true,"patched_in":"1.79.264"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:16:11Z"},{"id":"wordfence:b1695816-0f54-4095-8884-bc9856b4dac1","source":"wordfence","cve":"CVE-2015-9487","title":"Almera Responsive Portfolio Site Template < 1.1.8 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1695816-0f54-4095-8884-bc9856b4dac1?source=api-prod","affected":[{"type":"theme","slug":"almera","name":"Almera Responsive Portfolio Site Template","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b16a9a96-9be2-40cd-95d4-e3ce118ce2e1","source":"wordfence","cve":"CVE-2024-3940","title":"reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b16a9a96-9be2-40cd-95d4-e3ce118ce2e1?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-jetpack","name":"reCAPTCHA Jetpack","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-16T13:09:43Z"},{"id":"wordfence:b16d675f-1b62-4e3e-b91b-7bdb1e70a221","source":"wordfence","cve":"CVE-2007-1049","title":"WordPress Core < 2.09 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b16d675f-1b62-4e3e-b91b-7bdb1e70a221?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.1","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2007-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1703f90-17ad-4988-a60c-e56f88f3a317","source":"wordfence","cve":"CVE-2024-25101","title":"Maspik \u2013 Spam blacklist <= 0.10.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1703f90-17ad-4988-a60c-e56f88f3a317?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"0.10.6","to_inclusive":true,"patched_in":"0.10.7"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T18:02:10Z"},{"id":"wordfence:b170ac00-5d5c-46ef-95f3-e98ef4528999","source":"wordfence","cve":"CVE-2024-31211","title":"WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b170ac00-5d5c-46ef-95f3-e98ef4528999?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.1","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2023-12-06T00:00:00Z","updated":"2024-05-07T12:25:31Z"},{"id":"wordfence:b1715959-532a-4dd7-b384-0bd5f2673e2b","source":"wordfence","cve":"CVE-2026-17021","title":"Salon Booking System \u2013 Free Version <= 10.30.33 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1715959-532a-4dd7-b384-0bd5f2673e2b?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.33","to_inclusive":true,"patched_in":"10.30.34"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-15T21:37:14Z"},{"id":"wordfence:b173523a-e79d-4d2d-af67-5372576df220","source":"wordfence","cve":"CVE-2023-39306","title":"Fusion Builder <= 3.11.1 - Reflected Cross-Site Scripting via User Register Element","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b173523a-e79d-4d2d-af67-5372576df220?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b174204a-30d3-406c-a405-1670bcdab39d","source":"wordfence","cve":"CVE-2024-48049","title":"Mighty Builder <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b174204a-30d3-406c-a405-1670bcdab39d?source=api-prod","affected":[{"type":"plugin","slug":"mighty-builder","name":"Mighty Builder \u2013 Drag & Drop WordPress Page Builder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:05:42Z"},{"id":"wordfence:b1749bef-0952-4530-b607-4574765d2700","source":"wordfence","cve":"CVE-2026-5077","title":"Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1749bef-0952-4530-b607-4574765d2700?source=api-prod","affected":[{"type":"theme","slug":"total","name":"Total","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-05-01T20:29:33Z","updated":"2026-05-02T09:26:16Z"},{"id":"wordfence:b1782c82-bfdb-4104-a3f5-b1a07aede555","source":"wordfence","cve":"CVE-2017-1002004","title":"DTracker <= 1.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1782c82-bfdb-4104-a3f5-b1a07aede555?source=api-prod","affected":[{"type":"plugin","slug":"dtracker","name":"DTracker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1791d41-cdfe-4918-8351-2108302241c1","source":"wordfence","cve":"CVE-2020-5579","title":"Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection","severity":"medium","cvss":4.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1791d41-cdfe-4918-8351-2108302241c1?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2020-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b17b522d-997f-443e-a39f-2da0ebf14aaa","source":"wordfence","cve":"CVE-2024-37480","title":"Apollo13 Framework Extensions <= 1.9.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b17b522d-997f-443e-a39f-2da0ebf14aaa?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2024-07-04T00:00:00Z","updated":"2024-09-03T16:38:42Z"},{"id":"wordfence:b17c5b5e-26d9-485d-881e-bd4414f29f1a","source":"wordfence","cve":"CVE-2015-9521","title":"Easy Digital Downloads \u2013 Pushover notifications <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b17c5b5e-26d9-485d-881e-bd4414f29f1a?source=api-prod","affected":[{"type":"plugin","slug":"edd-pushover-notifications","name":"Easy Digital Downloads \u2013 Pushover notifications","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b17d1280-2bae-4c45-b2e1-fbfcb2c7c15b","source":"wordfence","cve":"CVE-2020-5642","title":"Live Chat \u2013 Live support <= 3.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b17d1280-2bae-4c45-b2e1-fbfcb2c7c15b?source=api-prod","affected":[{"type":"plugin","slug":"onwebchat","name":"AI Chatbot for WooCommerce & Live Chat \u2013 onWebChat","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2020-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b17fe3fe-1242-4109-93ad-cb654da1e6ca","source":"wordfence","cve":"CVE-2025-31746","title":"Clients <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b17fe3fe-1242-4109-93ad-cb654da1e6ca?source=api-prod","affected":[{"type":"plugin","slug":"clients","name":"Clients","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T14:13:04Z"},{"id":"wordfence:b1800f37-f9ab-454b-84f7-4d5eb5ed3acf","source":"wordfence","cve":"CVE-2026-8617","title":"SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1800f37-f9ab-454b-84f7-4d5eb5ed3acf?source=api-prod","affected":[{"type":"plugin","slug":"searchplus","name":"SearchPlus","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-06-23T16:38:17Z","updated":"2026-09-18T19:24:50Z"},{"id":"wordfence:b1833500-8e36-4266-8826-a64b01cbc087","source":"wordfence","cve":"CVE-2026-93942","title":"Dwell - Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1833500-8e36-4266-8826-a64b01cbc087?source=api-prod","affected":[{"type":"theme","slug":"dwell","name":"Dwell - Building, Construction & Renovation Theme","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:51:40Z","updated":"2026-10-13T14:29:09Z"},{"id":"wordfence:b183587b-95bd-4e82-bfc7-db5a8fbd58f9","source":"wordfence","cve":"CVE-2024-8737","title":"PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b183587b-95bd-4e82-bfc7-db5a8fbd58f9?source=api-prod","affected":[{"type":"plugin","slug":"pdf-thumbnail-generator","name":"PDF Thumbnail Generator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-09-12T20:29:18Z","updated":"2024-09-13T15:10:43Z"},{"id":"wordfence:b18477b2-7b59-4ca2-aa26-d107f83df5a9","source":"wordfence","cve":"CVE-2025-32118","title":"CMP \u2013 Coming Soon & Maintenance <= 4.1.13 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b18477b2-7b59-4ca2-aa26-d107f83df5a9?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"4.1.15"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-30T15:25:18Z"},{"id":"wordfence:b1850e16-6fac-4d72-9346-ea6280fe84d0","source":"wordfence","cve":"CVE-2025-10005","title":"Password Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1850e16-6fac-4d72-9346-ea6280fe84d0?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.20","to_inclusive":true,"patched_in":"1.9.21"}],"published":"2026-08-15T16:07:23Z","updated":"2026-08-16T04:24:55Z"},{"id":"wordfence:b1853c88-277b-4955-b042-aeed1cffb49b","source":"wordfence","cve":"CVE-2026-1560","title":"Custom Block Builder \u2013 Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1853c88-277b-4955-b042-aeed1cffb49b?source=api-prod","affected":[{"type":"plugin","slug":"lazy-blocks","name":"Custom Block Builder \u2013 Lazy Blocks","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-11T08:26:28Z"},{"id":"wordfence:b186c98e-6a8d-4675-aaaa-c6748319dec1","source":"wordfence","cve":"CVE-2023-32108","title":"Albo Pretorio Online <= 4.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b186c98e-6a8d-4675-aaaa-c6748319dec1?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1886db3-e01d-4cb1-8134-8cddff6503ac","source":"wordfence","cve":"CVE-2025-6488","title":"isMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1886db3-e01d-4cb1-8134-8cddff6503ac?source=api-prod","affected":[{"type":"plugin","slug":"ismobile","name":"isMobile() Shortcode for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-06-26T16:18:52Z","updated":"2025-06-27T04:25:30Z"},{"id":"wordfence:b1892207-0e51-4b2e-bc71-d6a0111b7041","source":"wordfence","cve":"CVE-2026-75027","title":"Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1892207-0e51-4b2e-bc71-d6a0111b7041?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":true,"patched_in":"7.8.1"}],"published":"2026-08-21T15:10:25Z","updated":"2026-08-22T03:37:48Z"},{"id":"wordfence:b18abec6-c2e7-4c84-93c8-c19422ce5d1c","source":"wordfence","cve":"CVE-2025-52777","title":"Pay with Contact Form 7 <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b18abec6-c2e7-4c84-93c8-c19422ce5d1c?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-contact-form-7","name":"Pay with Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T12:53:45Z"},{"id":"wordfence:b18f6817-86db-4a72-a2e9-a9e047e05bc5","source":"wordfence","cve":"CVE-2024-13664","title":"WP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b18f6817-86db-4a72-a2e9-a9e047e05bc5?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-list-table","name":"WP Post List Table","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T13:42:10Z"},{"id":"wordfence:b191a337-ec45-4357-9b37-6ca0af9cb2f9","source":"wordfence","cve":"CVE-2022-1424","title":"Ask Me <= 6.8.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b191a337-ec45-4357-9b37-6ca0af9cb2f9?source=api-prod","affected":[{"type":"theme","slug":"ask-me","name":"Ask Me - Responsive Questions & Answers WordPress","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"6.8.2"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b191abdc-cb60-4ec7-81dc-fc4fcb2cd9fe","source":"wordfence","cve":"CVE-2026-93938","title":"Hogwords | School, University Education WordPress Theme <= 1.2.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b191abdc-cb60-4ec7-81dc-fc4fcb2cd9fe?source=api-prod","affected":[{"type":"theme","slug":"hogwords","name":"Hogwords | School, University Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:49:05Z","updated":"2026-10-13T14:28:07Z"},{"id":"wordfence:b1922b16-e76c-4ee6-83ad-77970c8c25c0","source":"wordfence","cve":"CVE-2025-9202","title":"ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1922b16-e76c-4ee6-83ad-77970c8c25c0?source=api-prod","affected":[{"type":"theme","slug":"colormag","name":"ColorMag","from":"*","from_inclusive":true,"to":"4.0.19","to_inclusive":true,"patched_in":"4.0.20"}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-20T06:39:50Z"},{"id":"wordfence:b192d5d5-3bb9-4600-849e-2bb3c06009af","source":"wordfence","cve":"CVE-2022-40694","title":"News Announcement Scroll <= 8.8.8 - Authenticated (Admininstrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b192d5d5-3bb9-4600-849e-2bb3c06009af?source=api-prod","affected":[{"type":"plugin","slug":"news-announcement-scroll","name":"News Announcement Scroll","from":"*","from_inclusive":true,"to":"8.8.8","to_inclusive":true,"patched_in":"9.0.0"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b192dd62-477d-463d-a284-9f3232db27ca","source":"wordfence","cve":"CVE-2026-65498","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 7.5.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b192dd62-477d-463d-a284-9f3232db27ca?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-17T04:14:06Z"},{"id":"wordfence:b1938ba4-ced7-455b-8772-a192d9cb0897","source":"wordfence","cve":"CVE-2026-3488","title":"WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1938ba4-ced7-455b-8772-a192d9cb0897?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.4","to_inclusive":true,"patched_in":"14.16.5"}],"published":"2026-04-16T13:23:33Z","updated":"2026-04-17T01:24:38Z"},{"id":"wordfence:b194b241-d8f4-430c-b00c-d84190026bad","source":"wordfence","cve":"CVE-2025-15020","title":"Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b194b241-d8f4-430c-b00c-d84190026bad?source=api-prod","affected":[{"type":"plugin","slug":"gotham-block-extra-light","name":"Gotham Block Extra Light","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-01-13T17:17:11Z","updated":"2026-01-15T17:59:48Z"},{"id":"wordfence:b1954340-397c-4cc0-ba9d-d698d94ea608","source":"wordfence","cve":"CVE-2023-46066","title":"Mediabay <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1954340-397c-4cc0-ba9d-d698d94ea608?source=api-prod","affected":[{"type":"plugin","slug":"mediabay-lite","name":"Mediabay \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1954372-ea9b-44c0-b84b-5fa49efc9fb4","source":"wordfence","cve":"CVE-2026-84223","title":"Kirki 6.0.0 - 6.3.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1954372-ea9b-44c0-b84b-5fa49efc9fb4?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"6.0.0","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:34:31Z"},{"id":"wordfence:b1971bb8-fb24-40f6-bbd8-60b5dc1f0822","source":"wordfence","cve":"","title":"WP Business Intelligence Lite <= 3.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1971bb8-fb24-40f6-bbd8-60b5dc1f0822?source=api-prod","affected":[{"type":"plugin","slug":"wp-business-intelligence-lite","name":"WP Business Intelligence Lite","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-05T00:00:00Z","updated":"2026-05-11T20:15:42Z"},{"id":"wordfence:b1977c26-ae70-43ce-92c4-9d61ffd4e116","source":"wordfence","cve":"CVE-2025-22702","title":"Photography <= 7.5.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1977c26-ae70-43ce-92c4-9d61ffd4e116?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"Photography","from":"*","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-21T00:00:00Z","updated":"2025-02-24T15:40:54Z"},{"id":"wordfence:b1978b8f-d207-44e5-8ec0-f2c047192d02","source":"wordfence","cve":"CVE-2025-2203","title":"Funnel Builder for WordPress by FunnelKit <= 3.10.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1978b8f-d207-44e5-8ec0-f2c047192d02?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2025-04-07T00:00:00Z","updated":"2025-05-30T19:09:34Z"},{"id":"wordfence:b19794de-b623-4017-bd91-73986383c58b","source":"wordfence","cve":"CVE-2025-6993","title":"Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19794de-b623-4017-bd91-73986383c58b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"1.0.17","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-07-15T20:41:32Z","updated":"2025-07-16T09:22:57Z"},{"id":"wordfence:b19aa8ca-0ce8-4a9a-8f71-7d7e67e8f99b","source":"wordfence","cve":"CVE-2024-9219","title":"WordPress Social Share Buttons <= 1.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19aa8ca-0ce8-4a9a-8f71-7d7e67e8f99b?source=api-prod","affected":[{"type":"plugin","slug":"share-button","name":"Social Share Buttons","from":"*","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":"1.20"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-19T03:09:51Z"},{"id":"wordfence:b19af06d-7262-4d21-ac39-7d4ce8e75d71","source":"wordfence","cve":"CVE-2024-29915","title":"Podlove Podcast Publisher <= 4.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19af06d-7262-4d21-ac39-7d4ce8e75d71?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.0.10"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:27:22Z"},{"id":"wordfence:b19c81c9-d4ea-4a62-ba37-7904cc3ca95a","source":"wordfence","cve":"CVE-2026-22377","title":"Saveo <= 1.1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19c81c9-d4ea-4a62-ba37-7904cc3ca95a?source=api-prod","affected":[{"type":"theme","slug":"saveo","name":"Saveo | In-home Care & Private Nursing Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:29:17Z"},{"id":"wordfence:b19ce745-2cc4-48eb-b5f3-5011be7cceec","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.7.3 - Server Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19ce745-2cc4-48eb-b5f3-5011be7cceec?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.7.3","to_inclusive":true,"patched_in":"0.9.7.4"}],"published":"2019-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b19d0156-1fd9-4c18-be47-bce633b2f704","source":"wordfence","cve":"","title":"Intuitive Custom Post Order <= 3.1.3 - Missing Authorization to Authenticated Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b19d0156-1fd9-4c18-be47-bce633b2f704?source=api-prod","affected":[{"type":"plugin","slug":"intuitive-custom-post-order","name":"Intuitive Custom Post Order","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1a12f7a-0f0d-47df-9266-4680d86f7e02","source":"wordfence","cve":"CVE-2025-30923","title":"Gift Message for WooCommerce <= 1.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a12f7a-0f0d-47df-9266-4680d86f7e02?source=api-prod","affected":[{"type":"plugin","slug":"gift-message-for-woocommerce","name":"Gift Message for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:53:27Z"},{"id":"wordfence:b1a193b7-21e5-4f57-aaa6-e55c79f8e957","source":"wordfence","cve":"CVE-2023-32245","title":"Essential Addons for Elementor Pro <= 5.4.8 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a193b7-21e5-4f57-aaa6-e55c79f8e957?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-elementor","name":"Essential Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1a29180-901d-447e-8f82-63161b9e11e0","source":"wordfence","cve":"CVE-2023-49778","title":"Sayfa Saya\u00e7 <= 2.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a29180-901d-447e-8f82-63161b9e11e0?source=api-prod","affected":[{"type":"plugin","slug":"sayfa-sayac","name":"Sayfa Sayac","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1a3666b-2329-49c3-b017-9b495d90415e","source":"wordfence","cve":"CVE-2016-10945","title":"Platform 4 <= 1.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a3666b-2329-49c3-b017-9b495d90415e?source=api-prod","affected":[{"type":"theme","slug":"platform","name":"Platform","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2016-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1a82073-ab63-42dd-9bc0-d21f53a5af25","source":"wordfence","cve":"CVE-2026-1981","title":"Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a82073-ab63-42dd-9bc0-d21f53a5af25?source=api-prod","affected":[{"type":"plugin","slug":"winston-ai-wp","name":"HUMN-1 AI Website Scanner & Human Certification by Winston AI","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":"0.0.4"}],"published":"2026-03-06T11:14:38Z","updated":"2026-03-06T23:22:59Z"},{"id":"wordfence:b1a85bc2-0b00-4635-86f6-26e96cc0616e","source":"wordfence","cve":"CVE-2023-46777","title":"Feather Login Page <= 1.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a85bc2-0b00-4635-86f6-26e96cc0616e?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1a97776-03c7-403d-b803-023647b9d0f2","source":"wordfence","cve":"CVE-2024-24713","title":"Auto Listings <= 2.6.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a97776-03c7-403d-b803-023647b9d0f2?source=api-prod","affected":[{"type":"plugin","slug":"auto-listings","name":"Auto Listings \u2013 Car Listings & Car Dealership Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T20:27:22Z"},{"id":"wordfence:b1a9a274-fc42-4fca-a4f1-aa2834aa748d","source":"wordfence","cve":"CVE-2025-49357","title":"Audiomack <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9a274-fc42-4fca-a4f1-aa2834aa748d?source=api-prod","affected":[{"type":"plugin","slug":"audiomack","name":"Audiomack","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:18:32Z"},{"id":"wordfence:b1a9d042-c0c0-477a-8cdf-9fb9d2239059","source":"wordfence","cve":"CVE-2026-84909","title":"Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9d042-c0c0-477a-8cdf-9fb9d2239059?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-18T06:38:56Z"},{"id":"wordfence:b1a9ec33-75da-4165-819d-16b658b42ea9","source":"wordfence","cve":"CVE-2026-110537","title":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets < 6.8.7 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1a9ec33-75da-4165-819d-16b658b42ea9?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":false,"patched_in":"6.8.7"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T16:51:58Z"},{"id":"wordfence:b1acadaa-1211-4b0c-99e2-a137f77c198b","source":"wordfence","cve":"CVE-2026-84813","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1acadaa-1211-4b0c-99e2-a137f77c198b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.174","to_inclusive":true,"patched_in":"2.8.175"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:31:56Z"},{"id":"wordfence:b1acaf41-76b1-40d7-af6d-d512234986f6","source":"wordfence","cve":"CVE-2025-48349","title":"Video Gallery \u2013 Vimeo and YouTube Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1acaf41-76b1-40d7-af6d-d512234986f6?source=api-prod","affected":[{"type":"plugin","slug":"smart-grid-gallery","name":"Video Gallery \u2013 Vimeo and YouTube Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:03:31Z"},{"id":"wordfence:b1acc5f8-bd77-42e0-96d5-636039a533a1","source":"wordfence","cve":"CVE-2024-11388","title":"Dino Game \u2013 Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1acc5f8-bd77-42e0-96d5-636039a533a1?source=api-prod","affected":[{"type":"plugin","slug":"dino-game","name":"Dino Game \u2013 Embed Google Chrome Dinosaur Game in your website","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-11-20T13:37:17Z","updated":"2024-11-22T15:34:08Z"},{"id":"wordfence:b1adb414-8945-4e11-8770-dab3285d608e","source":"wordfence","cve":"CVE-2025-10146","title":"Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1adb414-8945-4e11-8770-dab3285d608e?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.23","to_inclusive":true,"patched_in":"3.3.24"}],"published":"2025-09-18T16:25:25Z","updated":"2025-09-19T04:27:05Z"},{"id":"wordfence:b1ae1b28-ea9e-4446-8b03-b5a8eaac1042","source":"wordfence","cve":"CVE-2023-48748","title":"Salient Core <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ae1b28-ea9e-4446-8b03-b5a8eaac1042?source=api-prod","affected":[{"type":"plugin","slug":"salient-core","name":"Salient | Creative Multipurpose & WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1af4be1-a9d6-4f44-91b3-22cf3130cc34","source":"wordfence","cve":"CVE-2023-3178","title":"POST SMTP Mailer <= 2.5.6 - Cross-Site Request Forgery to Arbitrary Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1af4be1-a9d6-4f44-91b3-22cf3130cc34?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1b3edcf-c089-4bb8-b1e8-05e00abca1a5","source":"wordfence","cve":"CVE-2022-4830","title":"Paid Memberships Pro <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b3edcf-c089-4bb8-b1e8-05e00abca1a5?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1b3f067-467f-4d8f-87bc-ee4a238b4019","source":"wordfence","cve":"CVE-2025-58799","title":"Custom WooCommerce Checkout Fields Editor <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b3f067-467f-4d8f-87bc-ee4a238b4019?source=api-prod","affected":[{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-09-05T00:00:00Z","updated":"2026-11-10T23:18:21Z"},{"id":"wordfence:b1b7b653-496f-467a-9513-4be1891f38ae","source":"wordfence","cve":"CVE-2023-2706","title":"OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b7b653-496f-467a-9513-4be1891f38ae?source=api-prod","affected":[{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1bc2300-bd8d-4e4a-8ab5-a541f62133ca","source":"wordfence","cve":"CVE-2024-10704","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.30 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc2300-bd8d-4e4a-8ab5-a541f62133ca?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.30","to_inclusive":true,"patched_in":"1.8.31"}],"published":"2024-11-14T00:00:00Z","updated":"2026-09-04T17:28:04Z"},{"id":"wordfence:b1bc4a87-d5de-4d66-9cc5-802ef11f886c","source":"wordfence","cve":"CVE-2026-3772","title":"WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1bc4a87-d5de-4d66-9cc5-802ef11f886c?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.9.2","to_inclusive":true,"patched_in":"1.2.9.3"}],"published":"2026-04-30T00:00:00Z","updated":"2026-05-01T11:18:50Z"},{"id":"wordfence:b1be1928-a278-48d5-beb2-00e3c8df3fa9","source":"wordfence","cve":"","title":"Ultimate Member <= 2.0.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1be1928-a278-48d5-beb2-00e3c8df3fa9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":false,"patched_in":"2.0.22"}],"published":"2018-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1be4b6c-ce48-49a2-8d2c-89c9611c8750","source":"wordfence","cve":"CVE-2026-10029","title":"Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1be4b6c-ce48-49a2-8d2c-89c9611c8750?source=api-prod","affected":[{"type":"plugin","slug":"eventkoi-lite","name":"Event Koi Lite \u2013 Events Calendar, Event Tickets, RSVP & Registration","from":"*","from_inclusive":true,"to":"1.3.13.1","to_inclusive":true,"patched_in":"1.3.14.0"}],"published":"2026-06-17T16:08:57Z","updated":"2026-06-18T04:31:09Z"},{"id":"wordfence:b1beb4ab-aa1d-47bb-8031-6e2974b844f5","source":"wordfence","cve":"CVE-2024-56234","title":"VW Automobile Lite <= 2.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1beb4ab-aa1d-47bb-8031-6e2974b844f5?source=api-prod","affected":[{"type":"theme","slug":"vw-automobile-lite","name":"VW Automobile Lite","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-24T18:56:35Z"},{"id":"wordfence:b1c0f8f3-22fe-4139-93bb-0e9bacf9dafb","source":"wordfence","cve":"CVE-2023-32601","title":"Booking Ultra Pro <= 1.1.6 - Missing Authorization via save_fields_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c0f8f3-22fe-4139-93bb-0e9bacf9dafb?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1c2712d-0865-4759-98da-1e11a26f2466","source":"wordfence","cve":"CVE-2024-1910","title":"Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c2712d-0865-4759-98da-1e11a26f2466?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:52:44Z"},{"id":"wordfence:b1c27c27-f597-4867-a8d8-a83a3a1bf5f6","source":"wordfence","cve":"","title":"PPC Tracker WordPress <= 2.0 - Stored Cross-Site Scripting via IP","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c27c27-f597-4867-a8d8-a83a3a1bf5f6?source=api-prod","affected":[{"type":"plugin","slug":"ppc-fraud-detctor","name":"PPC Tracker WordPress Plugin","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1c3e480-0221-4913-bcce-f34ded9edca8","source":"wordfence","cve":"CVE-2026-4302","title":"WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c3e480-0221-4913-bcce-f34ded9edca8?source=api-prod","affected":[{"type":"plugin","slug":"optin","name":"WowOptin: Next-Gen Popup Maker \u2013 Create Stunning Popups and Optins for Lead Generation","from":"*","from_inclusive":true,"to":"1.4.29","to_inclusive":true,"patched_in":"1.4.30"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-21T01:24:38Z"},{"id":"wordfence:b1c44ad9-e61e-4f29-9c0b-7c0a89b0c8da","source":"wordfence","cve":"CVE-2024-2803","title":"ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c44ad9-e61e-4f29-9c0b-7c0a89b0c8da?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T01:56:58Z"},{"id":"wordfence:b1c450d9-42d8-40f5-84fc-1bc0c8cfcf9b","source":"wordfence","cve":"CVE-2025-9191","title":"Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search","severity":"medium","cvss":6.3,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c450d9-42d8-40f5-84fc-1bc0c8cfcf9b?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2025-11-26T00:01:46Z","updated":"2025-11-26T12:30:04Z"},{"id":"wordfence:b1c609fc-f719-4e2a-aaa6-80dc34025142","source":"wordfence","cve":"CVE-2025-53274","title":"WP Permalink Translator <= 1.7.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c609fc-f719-4e2a-aaa6-80dc34025142?source=api-prod","affected":[{"type":"plugin","slug":"wp-permalink-translator","name":"WP Permalink Translator","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:31:16Z"},{"id":"wordfence:b1c6261f-4657-4e6e-ae23-5fa44790aa12","source":"wordfence","cve":"CVE-2015-9390","title":"Admin Management Xtended <= 2.4.0 - Missing Authorization Checks","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c6261f-4657-4e6e-ae23-5fa44790aa12?source=api-prod","affected":[{"type":"plugin","slug":"admin-management-xtended","name":"Admin Management Xtended","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.0.1"}],"published":"2015-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1c8aa41-0362-47b8-afb0-80b6194b9bc3","source":"wordfence","cve":"CVE-2024-35721","title":"Image Gallery \u2013 Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1c8aa41-0362-47b8-afb0-80b6194b9bc3?source=api-prod","affected":[{"type":"plugin","slug":"new-image-gallery","name":"Image Gallery","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:06:35Z"},{"id":"wordfence:b1cdd6c6-f354-48d6-9493-08c67aaef9bd","source":"wordfence","cve":"CVE-2010-2924","title":"myLinksDump <= 1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1cdd6c6-f354-48d6-9493-08c67aaef9bd?source=api-prod","affected":[{"type":"plugin","slug":"mylinksdump","name":"myLinksDump","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2010-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1ced926-e5af-4dda-9aa3-2e92a33d6782","source":"wordfence","cve":"CVE-2026-88929","title":"Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ced926-e5af-4dda-9aa3-2e92a33d6782?source=api-prod","affected":[{"type":"plugin","slug":"easy-sale-badges-for-woocommerce","name":"Product Badge, Label, Countdown Timer for WooCommerce \u2013 Sale Booster","from":"7.0.0","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:40:56Z"},{"id":"wordfence:b1d571a0-5db2-4132-9b6c-9ffead418776","source":"wordfence","cve":"CVE-2025-22361","title":"Opentracker Analytics <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1d571a0-5db2-4132-9b6c-9ffead418776?source=api-prod","affected":[{"type":"plugin","slug":"opentracker-analytics","name":"Opentracker Analytics","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T18:48:57Z"},{"id":"wordfence:b1d7f2f5-0685-4be0-bd3b-93c39d9bb7ee","source":"wordfence","cve":"CVE-2024-43957","title":"Animated Number Counters <= 2.1 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1d7f2f5-0685-4be0-bd3b-93c39d9bb7ee?source=api-prod","affected":[{"type":"plugin","slug":"animated-number-counters","name":"Animated Number Counters","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-08-26T00:00:00Z","updated":"2025-02-19T21:21:29Z"},{"id":"wordfence:b1d8a9b5-e833-4810-a13a-fd360752e711","source":"wordfence","cve":"","title":"CataBlog < 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1d8a9b5-e833-4810-a13a-fd360752e711?source=api-prod","affected":[{"type":"plugin","slug":"catablog","name":"CataBlog","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1db421d-d935-4441-ae5e-cc01123e80e8","source":"wordfence","cve":"CVE-2023-25031","title":"Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1db421d-d935-4441-ae5e-cc01123e80e8?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.1.1"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1dd3845-a88d-41aa-acf4-66fd1a6819ff","source":"wordfence","cve":"CVE-2023-48745","title":"Captcha Code <= 2.9 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1dd3845-a88d-41aa-acf4-66fd1a6819ff?source=api-prod","affected":[{"type":"plugin","slug":"captcha-code-authentication","name":"Captcha Code","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-11-24T00:00:00Z","updated":"2024-02-02T00:07:06Z"},{"id":"wordfence:b1dd83e6-ea48-459b-84ac-3c6fff9cd940","source":"wordfence","cve":"CVE-2026-103997","title":"Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1dd83e6-ea48-459b-84ac-3c6fff9cd940?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"4.5.16"}],"published":"2026-10-30T19:19:09Z","updated":"2026-10-31T07:46:51Z"},{"id":"wordfence:b1de31ae-4095-4863-9971-9de45c36f5a0","source":"wordfence","cve":"CVE-2026-15963","title":"Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1de31ae-4095-4863-9971-9de45c36f5a0?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.1","to_inclusive":true,"patched_in":"11.2.2"}],"published":"2026-08-15T16:20:47Z","updated":"2026-08-16T04:24:55Z"},{"id":"wordfence:b1dea93c-437b-45ac-9dc3-07d3aa3f1c9f","source":"wordfence","cve":"CVE-2026-57408","title":"Peach Payments Gateway <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1dea93c-437b-45ac-9dc3-07d3aa3f1c9f?source=api-prod","affected":[{"type":"plugin","slug":"wc-peach-payments-gateway","name":"Peach Payments Gateway","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:27:11Z"},{"id":"wordfence:b1e1db3f-1ebc-4f16-b2d8-8bce9c51b3db","source":"wordfence","cve":"CVE-2023-25478","title":"Weather Station <= 3.8.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e1db3f-1ebc-4f16-b2d8-8bce9c51b3db?source=api-prod","affected":[{"type":"plugin","slug":"live-weather-station","name":"Weather Station","from":"*","from_inclusive":true,"to":"3.8.12","to_inclusive":true,"patched_in":"3.8.13"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1e24114-2993-42bd-9711-45e24853feec","source":"wordfence","cve":"CVE-2025-24758","title":"CM Map Locations <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e24114-2993-42bd-9711-45e24853feec?source=api-prod","affected":[{"type":"plugin","slug":"cm-map-locations","name":"CM Map Locations \u2013 Visualize and share your locations in a few clicks","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-18T20:26:34Z"},{"id":"wordfence:b1e35b98-4b0b-4aac-a082-da709d8bb9c3","source":"wordfence","cve":"CVE-2026-110887","title":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin <= 1.7.32 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e35b98-4b0b-4aac-a082-da709d8bb9c3?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-17T08:45:57Z","updated":"2026-10-23T18:37:46Z"},{"id":"wordfence:b1e421fb-4839-4e2d-911f-e2fa8c756744","source":"wordfence","cve":"CVE-2024-8123","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e421fb-4839-4e2d-911f-e2fa8c756744?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T06:49:06Z"},{"id":"wordfence:b1e45860-16c4-4d13-aad9-c742a8eced37","source":"wordfence","cve":"CVE-2024-8735","title":"MailMunch \u2013 Grow your Email List <= 3.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e45860-16c4-4d13-aad9-c742a8eced37?source=api-prod","affected":[{"type":"plugin","slug":"mailmunch","name":"MailMunch \u2013 Grow your Email List","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-11-21T00:00:00Z","updated":"2024-11-22T05:33:43Z"},{"id":"wordfence:b1e51951-0e4c-44f3-a11b-13c0be984a7f","source":"wordfence","cve":"CVE-2024-37502","title":"WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e51951-0e4c-44f3-a11b-13c0be984a7f?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-11T13:21:47Z"},{"id":"wordfence:b1e7bb04-28b4-407c-910b-e37a7e26682e","source":"wordfence","cve":"CVE-2023-38479","title":"Simple Googlebot Visit <= 1.2.4 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e7bb04-28b4-407c-910b-e37a7e26682e?source=api-prod","affected":[{"type":"plugin","slug":"simple-googlebot-visit","name":"Simple Googlebot Visit","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-07-24T00:00:00Z","updated":"2024-02-08T17:16:24Z"},{"id":"wordfence:b1e98d2d-20b1-4fff-96d4-0fb8e0d2615a","source":"wordfence","cve":"CVE-2016-15033","title":"Delete All Comments <= 2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e98d2d-20b1-4fff-96d4-0fb8e0d2615a?source=api-prod","affected":[{"type":"plugin","slug":"delete-all-comments","name":"Delete All Comments","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2016-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1e9c2c9-b306-44a5-9919-9b5f13fa3fcc","source":"wordfence","cve":"CVE-2025-68531","title":"ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e9c2c9-b306-44a5-9919-9b5f13fa3fcc?source=api-prod","affected":[{"type":"plugin","slug":"modeltheme-addons-for-wpbakery","name":"ModelTheme Addons for WPBakery and Elementor","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:25:45Z"},{"id":"wordfence:b1ea7e04-d3b3-43fa-be9a-a2d5ac3e34c3","source":"wordfence","cve":"CVE-2023-36688","title":"Simple Site Verify <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ea7e04-d3b3-43fa-be9a-a2d5ac3e34c3?source=api-prod","affected":[{"type":"plugin","slug":"simple-site-verify","name":"Simple Site Verify","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1eae4fc-85d1-49ff-9f3b-bf0a3f424ee1","source":"wordfence","cve":"CVE-2017-6578","title":"Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1eae4fc-85d1-49ff-9f3b-bf0a3f424ee1?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1eb6896-2de3-4d4d-9b5f-253aaffd193b","source":"wordfence","cve":"CVE-2024-7304","title":"Ninja Tables \u2013 Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1eb6896-2de3-4d4d-9b5f-253aaffd193b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.12","to_inclusive":true,"patched_in":"5.0.13"}],"published":"2024-08-26T18:30:02Z","updated":"2024-08-27T06:48:04Z"},{"id":"wordfence:b1ec9dce-d0fb-4b7b-a8e4-4ccb474c9d57","source":"wordfence","cve":"CVE-2024-13396","title":"Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ec9dce-d0fb-4b7b-a8e4-4ccb474c9d57?source=api-prod","affected":[{"type":"plugin","slug":"frictionless","name":"Frictionless","from":"*","from_inclusive":true,"to":"0.0.23","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T14:11:27Z","updated":"2025-01-31T02:24:18Z"},{"id":"wordfence:b1ecfa60-9b43-4b70-bd60-278dfb0e7dbb","source":"wordfence","cve":"CVE-2017-20053","title":"Contact Form Manager <= 1.4.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ecfa60-9b43-4b70-bd60-278dfb0e7dbb?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-manager","name":"Contact Form Manager","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1ed1ef4-8867-499b-8f73-296280573462","source":"wordfence","cve":"CVE-2024-10147","title":"Steel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ed1ef4-8867-499b-8f73-296280573462?source=api-prod","affected":[{"type":"plugin","slug":"steel","name":"Steel","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:00:13Z","updated":"2024-11-16T03:20:49Z"},{"id":"wordfence:b1ef6f6a-04bf-4f9d-b6ed-21eed8c389e2","source":"wordfence","cve":"CVE-2024-12595","title":"AHAthat <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ef6f6a-04bf-4f9d-b6ed-21eed8c389e2?source=api-prod","affected":[{"type":"plugin","slug":"ahathat","name":"AHAthat Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2025-01-08T19:56:35Z"},{"id":"wordfence:b1f17a83-1df0-44fe-bd86-243cff6ec91b","source":"wordfence","cve":"CVE-2022-2441","title":"ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=api-prod","affected":[{"type":"plugin","slug":"imagemagick-engine","name":"ImageMagick Engine","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1f323a3-78ee-42e6-ae14-81ec9b332379","source":"wordfence","cve":"CVE-2026-54855","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f323a3-78ee-42e6-ae14-81ec9b332379?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-10-30T07:27:20Z","updated":"2026-11-03T20:02:53Z"},{"id":"wordfence:b1f482d3-d2f6-4161-8bcf-3d43d5ac10ee","source":"wordfence","cve":"CVE-2024-29763","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f482d3-d2f6-4161-8bcf-3d43d5ac10ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.3.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:29:50Z"},{"id":"wordfence:b1f4f428-93b1-4a29-9ac5-55d2020ab3c5","source":"wordfence","cve":"CVE-2025-66101","title":"CBX Bookmark & Favorite <= 2.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f4f428-93b1-4a29-9ac5-55d2020ab3c5?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-11-18T00:00:00Z","updated":"2025-11-25T15:56:12Z"},{"id":"wordfence:b1faa178-e4b1-4d2e-85f1-b852fbf3ab17","source":"wordfence","cve":"CVE-2024-9587","title":"Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1faa178-e4b1-4d2e-85f1-b852fbf3ab17?source=api-prod","affected":[{"type":"plugin","slug":"linkz-ai","name":"Linkz.ai \u2013 Automatic link previews on hover","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-18T14:07:14Z"},{"id":"wordfence:b1faf343-1859-4bee-a2d5-f494f44c70ad","source":"wordfence","cve":"CVE-2021-24166","title":"Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1faf343-1859-4bee-a2d5-f494f44c70ad?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.34","to_inclusive":false,"patched_in":"3.4.34"}],"published":"2021-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b1fca523-36cd-497b-9d53-3aa1b29e1af5","source":"wordfence","cve":"CVE-2026-12965","title":"Super Store Finder <= 7.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b1fca523-36cd-497b-9d53-3aa1b29e1af5?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.10","to_inclusive":true,"patched_in":"7.11"}],"published":"2026-07-24T00:00:00Z","updated":"2026-09-09T14:38:45Z"},{"id":"wordfence:b2066728-4f6a-49b3-8958-714cf0bf2e90","source":"wordfence","cve":"CVE-2026-107788","title":"SmartyParcel (WC Ukr Shipping) <= 1.23.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2066728-4f6a-49b3-8958-714cf0bf2e90?source=api-prod","affected":[{"type":"plugin","slug":"wc-ukr-shipping","name":"SmartyParcel Shipping \u2013 DHL Express, GLS, InPost & Nova Post for WooCommerce","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":"1.23.4"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:07:51Z"},{"id":"wordfence:b20a11c1-9aa0-4f5d-af3d-89fb9bf4e1d0","source":"wordfence","cve":"CVE-2024-12598","title":"MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20a11c1-9aa0-4f5d-af3d-89fb9bf4e1d0?source=api-prod","affected":[{"type":"plugin","slug":"mybookprogress","name":"MyBookProgress by Stormhill Media","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T18:23:57Z","updated":"2025-01-17T07:01:29Z"},{"id":"wordfence:b20a793a-82ff-41ba-95a2-3c3b4f98617d","source":"wordfence","cve":"CVE-2025-22784","title":"Background Control <= 1.0.5 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20a793a-82ff-41ba-95a2-3c3b4f98617d?source=api-prod","affected":[{"type":"plugin","slug":"background-control","name":"Background Control","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-21T16:40:13Z"},{"id":"wordfence:b20b4eba-54df-4e08-ba4c-96f8bb463125","source":"wordfence","cve":"","title":"Mercado Pago payments for WooCommerce <= 6.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20b4eba-54df-4e08-ba4c-96f8bb463125?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mercadopago","name":"Mercado Pago payments for WooCommerce","from":"*","from_inclusive":true,"to":"6.6.0","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b20e0787-4514-475f-9ed2-a63857ee59a1","source":"wordfence","cve":"CVE-2024-51924","title":"WP Agenda <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20e0787-4514-475f-9ed2-a63857ee59a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-agenda","name":"WP Agenda","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:21:54Z"},{"id":"wordfence:b20e5257-1fb7-40b4-8ad8-798372b60972","source":"wordfence","cve":"CVE-2022-1395","title":"Easy FAQ with Expanding Text <= 3.2.8.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20e5257-1fb7-40b4-8ad8-798372b60972?source=api-prod","affected":[{"type":"plugin","slug":"easy-faq-with-expanding-text","name":"Easy FAQ with Expanding Text","from":"*","from_inclusive":true,"to":"3.2.8.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b20e71d3-627e-49e0-a2f7-20cdbb8622e7","source":"wordfence","cve":"CVE-2025-14814","title":"CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20e71d3-627e-49e0-a2f7-20cdbb8622e7?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"12.0.6","to_inclusive":true,"patched_in":"12.0.7"}],"published":"2026-09-24T15:10:12Z","updated":"2026-09-25T03:38:45Z"},{"id":"wordfence:b20ec769-822a-4d9b-9824-6e29d3677ac3","source":"wordfence","cve":"CVE-2024-43216","title":"Filr \u2013 Secure document library <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20ec769-822a-4d9b-9824-6e29d3677ac3?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-19T13:42:54Z"},{"id":"wordfence:b20f94c6-4e97-4fe8-a2a5-ce825bb120d3","source":"wordfence","cve":"CVE-2025-39349","title":"CiyaShop <= 4.18.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20f94c6-4e97-4fe8-a2a5-ce825bb120d3?source=api-prod","affected":[{"type":"theme","slug":"ciyashop","name":"CiyaShop - Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"4.18.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:10:39Z"},{"id":"wordfence:b20fa367-a12f-402a-a74a-2bb5fe090036","source":"wordfence","cve":"CVE-2022-2376","title":"Directorist <= 7.3.0 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b20fa367-a12f-402a-a74a-2bb5fe090036?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b211f05e-fc6a-4aaf-b75e-b044243f9176","source":"wordfence","cve":"CVE-2024-38709","title":"GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b211f05e-fc6a-4aaf-b75e-b044243f9176?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:56:18Z"},{"id":"wordfence:b2136a08-93be-4611-9eff-6a9258401b96","source":"wordfence","cve":"CVE-2025-9111","title":"AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2136a08-93be-4611-9eff-6a9258401b96?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2025-08-19T00:00:00Z","updated":"2025-09-25T20:15:02Z"},{"id":"wordfence:b2143edf-5423-4e79-8638-a5b98490d292","source":"wordfence","cve":"CVE-2024-12877","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2143edf-5423-4e79-8638-a5b98490d292?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.19.2","to_inclusive":true,"patched_in":"3.19.3"}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-11T07:21:53Z"},{"id":"wordfence:b2181c89-4f40-45b9-8c12-448ca263a2f2","source":"wordfence","cve":"CVE-2024-9207","title":"BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2181c89-4f40-45b9-8c12-448ca263a2f2?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-docs","name":"BuddyPress Docs","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-10-07T00:00:00Z","updated":"2025-05-23T13:54:55Z"},{"id":"wordfence:b21f9cfa-8113-42bc-a9dc-4d891bd9821b","source":"wordfence","cve":"CVE-2024-13455","title":"igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b21f9cfa-8113-42bc-a9dc-4d891bd9821b?source=api-prod","affected":[{"type":"plugin","slug":"igumbi-online-booking","name":"igumbi Online Booking","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":"1.41"}],"published":"2025-02-20T00:00:00Z","updated":"2025-02-21T11:09:34Z"},{"id":"wordfence:b22179cc-4dae-4f0e-8788-a52bab72471a","source":"wordfence","cve":"CVE-2025-69120","title":"Dazzle <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b22179cc-4dae-4f0e-8788-a52bab72471a?source=api-prod","affected":[{"type":"theme","slug":"dazzle","name":"Dazzle - Manufacturing & Factory Elementor Pro template Kit","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:32:30Z"},{"id":"wordfence:b221a1f4-bd2f-47a6-bbd4-be41e0cb9e1f","source":"wordfence","cve":"CVE-2026-96347","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 28.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b221a1f4-bd2f-47a6-bbd4-be41e0cb9e1f?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:51:58Z"},{"id":"wordfence:b2247896-3d74-476a-9ee4-f42fc73509e8","source":"wordfence","cve":"CVE-2026-115299","title":"Contact Form by Supsystic <= 1.11.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2247896-3d74-476a-9ee4-f42fc73509e8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T21:32:38Z"},{"id":"wordfence:b2251afd-7c0c-444f-b458-aaeeb48b8a6a","source":"wordfence","cve":"CVE-2025-39492","title":"WHMpress <= 6.2-revision-9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2251afd-7c0c-444f-b458-aaeeb48b8a6a?source=api-prod","affected":[{"type":"plugin","slug":"whmpress","name":"WHMpress - WHMCS WordPress Integration Plugin","from":"*","from_inclusive":true,"to":"6.2-revision-9","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:05:15Z"},{"id":"wordfence:b2253753-f1ba-4cca-9e83-7532add6a077","source":"wordfence","cve":"CVE-2025-47594","title":"Soccer Live Scores <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2253753-f1ba-4cca-9e83-7532add6a077?source=api-prod","affected":[{"type":"plugin","slug":"soccer-live-scores","name":"Soccer Live Scores","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:43:35Z"},{"id":"wordfence:b226d010-27fb-44b8-8079-be3120defe33","source":"wordfence","cve":"CVE-2026-100511","title":"VK Google Job Posting Manager <= 1.3.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b226d010-27fb-44b8-8079-be3120defe33?source=api-prod","affected":[{"type":"plugin","slug":"vk-google-job-posting-manager","name":"VK Google Job Posting Manager","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-10-03T18:41:01Z","updated":"2026-10-08T22:53:43Z"},{"id":"wordfence:b2286e96-59e1-465a-b600-8a88e9e97418","source":"wordfence","cve":"CVE-2024-32706","title":"ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2286e96-59e1-465a-b600-8a88e9e97418?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:04:13Z"},{"id":"wordfence:b228f8b1-dd68-41ee-bc49-6a62e5267233","source":"wordfence","cve":"CVE-2023-1346","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_page_cache'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b228f8b1-dd68-41ee-bc49-6a62e5267233?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2296800-93d6-48fa-aa09-3d28fa6371d7","source":"wordfence","cve":"CVE-2023-1336","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2296800-93d6-48fa-aa09-3d28fa6371d7?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b22aaac4-39f1-482b-9fc7-79825cf2e818","source":"wordfence","cve":"CVE-2014-10391","title":"WP Support Plus Responsive Ticket System <= 4.0 - JavaScript Injection","severity":"medium","cvss":6.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b22aaac4-39f1-482b-9fc7-79825cf2e818?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2014-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2340ae3-3b22-4b14-9fce-4b845f2866b1","source":"wordfence","cve":"CVE-2021-24260","title":"Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2340ae3-3b22-4b14-9fce-4b845f2866b1?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"6.7.1","to_inclusive":true,"patched_in":"6.8"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2371b84-bb56-4e5d-afce-cd33f2ee9316","source":"wordfence","cve":"CVE-2026-15324","title":"SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2371b84-bb56-4e5d-afce-cd33f2ee9316?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"4.4.14","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-15T20:00:09Z","updated":"2026-07-16T08:26:51Z"},{"id":"wordfence:b239185f-c368-4768-8f6a-ef9bc593929d","source":"wordfence","cve":"CVE-2023-32300","title":"Yoast SEO: Local <= 14.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b239185f-c368-4768-8f6a-ef9bc593929d?source=api-prod","affected":[{"type":"plugin","slug":"wpseo-local","name":"Yoast SEO: Local","from":"*","from_inclusive":true,"to":"14.8","to_inclusive":true,"patched_in":"14.9"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b23989c2-6cd7-4e55-b019-324644e7521a","source":"wordfence","cve":"CVE-2024-0427","title":"ARForms - Premium WordPress Form Builder <= 6.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23989c2-6cd7-4e55-b019-324644e7521a?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-08-28T23:16:13Z"},{"id":"wordfence:b23ab054-11c9-4229-9adc-6eef6f81c3f9","source":"wordfence","cve":"CVE-2024-31233","title":"Rehub <= 19.6.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23ab054-11c9-4229-9adc-6eef6f81c3f9?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.6.1","to_inclusive":true,"patched_in":"19.6.2"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-06T17:26:37Z"},{"id":"wordfence:b23afc11-c31d-4569-8f4b-8141eef7b3d9","source":"wordfence","cve":"CVE-2023-49858","title":"Custom Login <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23afc11-c31d-4569-8f4b-8141eef7b3d9?source=api-prod","affected":[{"type":"plugin","slug":"custom-login","name":"Custom Login","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b23b6df6-e723-4b25-aa5d-6b3be05c6f98","source":"wordfence","cve":"CVE-2025-31067","title":"Seven Stars <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23b6df6-e723-4b25-aa5d-6b3be05c6f98?source=api-prod","affected":[{"type":"theme","slug":"sevenstars","name":"Seven Stars - Modern Responsive MultiPurpose Theme","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:31:00Z"},{"id":"wordfence:b23bdba3-8947-47e4-b208-55e42865ab72","source":"wordfence","cve":"CVE-2024-13451","title":"Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23bdba3-8947-47e4-b208-55e42865ab72?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.17.5","to_inclusive":true,"patched_in":"2.17.6"}],"published":"2025-07-01T17:24:34Z","updated":"2025-07-02T05:29:18Z"},{"id":"wordfence:b23d20d2-d9d0-4d3b-a23c-4c079705472b","source":"wordfence","cve":"CVE-2026-114709","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23d20d2-d9d0-4d3b-a23c-4c079705472b?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-26T10:07:00Z","updated":"2026-10-28T01:21:35Z"},{"id":"wordfence:b23d276c-69c5-47e0-99bd-f20ff1d45904","source":"wordfence","cve":"CVE-2023-25992","title":"CM Answers <= 3.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23d276c-69c5-47e0-99bd-f20ff1d45904?source=api-prod","affected":[{"type":"plugin","slug":"cm-answers","name":"CM Answers \u2013 Discussion Forum Plugin for WordPress Q&A","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b23d4868-068a-4ee9-8253-8f7063cdb03e","source":"wordfence","cve":"CVE-2019-9912","title":"WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23d4868-068a-4ee9-8253-8f7063cdb03e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"7.10.41","to_inclusive":true,"patched_in":"7.10.43"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b23de3eb-ae2a-4165-9251-7a135bc34b73","source":"wordfence","cve":"CVE-2026-27409","title":"Advanced Booking & Appointment System \u2013 Webba Booking Calendar <= 6.4.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23de3eb-ae2a-4165-9251-7a135bc34b73?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"6.4.14"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:43:54Z"},{"id":"wordfence:b23dec43-ad7d-45d9-910e-b024b3c750c9","source":"wordfence","cve":"CVE-2026-59534","title":"Post My CF7 Form <= 6.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23dec43-ad7d-45d9-910e-b024b3c750c9?source=api-prod","affected":[{"type":"plugin","slug":"post-my-contact-form-7","name":"Post My CF7 Form","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:23:38Z"},{"id":"wordfence:b23e36f7-ee44-42c6-94b7-e943c6c4a3ad","source":"wordfence","cve":"CVE-2022-3131","title":"Search Logger <= 0.9 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b23e36f7-ee44-42c6-94b7-e943c6c4a3ad?source=api-prod","affected":[{"type":"plugin","slug":"search-logger","name":"Search Logger \u2013 Know What Your Visitors Search","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2401dd1-d132-4899-80fc-9281280806a2","source":"wordfence","cve":"","title":"Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results <= 1.1.0 - Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2401dd1-d132-4899-80fc-9281280806a2?source=api-prod","affected":[{"type":"plugin","slug":"hub2word","name":"Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2413083-262c-4646-91fa-f9b51010f3e3","source":"wordfence","cve":"CVE-2014-4578","title":"WP App Maker <= 1.0.16.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2413083-262c-4646-91fa-f9b51010f3e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-app-maker","name":"WP App Maker","from":"*","from_inclusive":true,"to":"1.0.16.4","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b24245ef-4c4a-4dda-9bd0-b03a24980e0d","source":"wordfence","cve":"CVE-2025-58994","title":"Greenify <= 2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b24245ef-4c4a-4dda-9bd0-b03a24980e0d?source=api-prod","affected":[{"type":"theme","slug":"greenify","name":"Greenify | Solar & Renewable Energy WordPress Theme","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-09-28T00:00:00Z","updated":"2025-10-29T15:28:46Z"},{"id":"wordfence:b2436028-9ac2-4232-bccf-26019a26e186","source":"wordfence","cve":"CVE-2024-30513","title":"ProfileGrid  <= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2436028-9ac2-4232-bccf-26019a26e186?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:25:38Z"},{"id":"wordfence:b243722e-6510-48bd-be26-95ccbe79fa57","source":"wordfence","cve":"","title":"Customer Reviews for WooCommerce <= 5.38.1 - Cross-Site Request Forgery via manual review reminders","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b243722e-6510-48bd-be26-95ccbe79fa57?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.38.2","to_inclusive":false,"patched_in":"5.38.2"}],"published":"2023-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2438f64-2318-4345-99dd-f2266b2a5ca4","source":"wordfence","cve":"CVE-2025-29001","title":"WooCommerce Shop Page Builder <= 2.27.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2438f64-2318-4345-99dd-f2266b2a5ca4?source=api-prod","affected":[{"type":"plugin","slug":"dzs-wootable","name":"WooCommerce Shop Page Builder","from":"*","from_inclusive":true,"to":"2.27.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:28:43Z"},{"id":"wordfence:b243beac-1d8e-494d-8009-173a0a6c4d97","source":"wordfence","cve":"CVE-2025-47548","title":"Wbcom Designs - Activity Link Preview For BuddyPress <= 1.4.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b243beac-1d8e-494d-8009-173a0a6c4d97?source=api-prod","affected":[{"type":"plugin","slug":"activity-link-preview-for-buddypress","name":"Activity Link Preview For BuddyPress","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:28:07Z"},{"id":"wordfence:b24506c2-bf5e-4c71-94a5-c557a09f9f0d","source":"wordfence","cve":"CVE-2025-13988","title":"\u8bc4\u8bba\u5c0f\u79d8\u4e66 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b24506c2-bf5e-4c71-94a5-c557a09f9f0d?source=api-prod","affected":[{"type":"plugin","slug":"comments-secretary","name":"\u8bc4\u8bba\u5c0f\u79d8\u4e66","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:08:36Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:b24625d7-2a38-451b-ab79-a1d9c5b8822a","source":"wordfence","cve":"CVE-2022-4159","title":"Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b24625d7-2a38-451b-ab79-a1d9c5b8822a?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b249d628-a6aa-4fc6-b1f7-91b674054fc8","source":"wordfence","cve":"CVE-2025-28935","title":"FancyBox <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b249d628-a6aa-4fc6-b1f7-91b674054fc8?source=api-prod","affected":[{"type":"plugin","slug":"fancy-box","name":"FancyBox","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T19:34:51Z"},{"id":"wordfence:b249ec90-a364-4644-94fb-d42eb6cc4d9a","source":"wordfence","cve":"CVE-2025-14800","title":"Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b249ec90-a364-4644-94fb-d42eb6cc4d9a?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2025-12-20T18:43:20Z","updated":"2025-12-21T07:31:11Z"},{"id":"wordfence:b24bd192-c45b-479c-9e5a-7b83799f8f99","source":"wordfence","cve":"CVE-2026-15990","title":"Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b24bd192-c45b-479c-9e5a-7b83799f8f99?source=api-prod","affected":[{"type":"plugin","slug":"formidable-charts","name":"Formidable Charts","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-08-26T00:38:43Z","updated":"2026-08-26T13:28:08Z"},{"id":"wordfence:b250f32b-373c-45e3-9dd9-832bb2066723","source":"wordfence","cve":"CVE-2026-116855","title":"My auctions allegro <= 4.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b250f32b-373c-45e3-9dd9-832bb2066723?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:14:47Z"},{"id":"wordfence:b251cc43-155a-4f73-9819-4805de3686bc","source":"wordfence","cve":"CVE-2024-52431","title":"WordPress Video Robot - The Ultimate Video Importer <= 1.20.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b251cc43-155a-4f73-9819-4805de3686bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-robot","name":"WordPress Video Robot - The Ultimate Video Importer","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:34:30Z"},{"id":"wordfence:b252e2a7-f037-43a1-828f-10b3172548cd","source":"wordfence","cve":"CVE-2025-31762","title":"Sheet2Site <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b252e2a7-f037-43a1-828f-10b3172548cd?source=api-prod","affected":[{"type":"plugin","slug":"sheet2site","name":"Sheet2Site","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:12:48Z"},{"id":"wordfence:b256c288-07ea-46a2-ae76-0f90b4a33b6e","source":"wordfence","cve":"CVE-2026-120533","title":"Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b256c288-07ea-46a2-ae76-0f90b4a33b6e?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-11-04T15:51:44Z","updated":"2026-11-05T04:48:07Z"},{"id":"wordfence:b258b76c-abb1-413e-a7b9-b9b0b71c1f82","source":"wordfence","cve":"CVE-2026-28044","title":"Rocket <= 3.19.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b258b76c-abb1-413e-a7b9-b9b0b71c1f82?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"*","from_inclusive":true,"to":"3.19.4","to_inclusive":true,"patched_in":"3.20.0.2"}],"published":"2025-10-20T00:00:00Z","updated":"2026-05-04T15:08:36Z"},{"id":"wordfence:b258d827-2490-486c-9128-dc866a079aeb","source":"wordfence","cve":"CVE-2026-66586","title":"WP Cafe Pro  <= 3.0.14 - Authenticated (Author+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b258d827-2490-486c-9128-dc866a079aeb?source=api-prod","affected":[{"type":"plugin","slug":"wpcafe-pro","name":"WP Cafe Pro","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:50:09Z"},{"id":"wordfence:b258e85e-eb1d-441a-ab99-c9604fb53656","source":"wordfence","cve":"CVE-2026-17011","title":"Nexter Blocks <= 5.0.1 - Payment Bypass to Authenticated (Contributor+) Stored CSS Injection","severity":"medium","cvss":4.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b258e85e-eb1d-441a-ab99-c9604fb53656?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:45:32Z"},{"id":"wordfence:b258fa40-4e76-4c84-b32f-e6c46fee770a","source":"wordfence","cve":"CVE-2024-29134","title":"Tourfic <= 2.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b258fa40-4e76-4c84-b32f-e6c46fee770a?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.11.8","to_inclusive":true,"patched_in":"2.11.9"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T15:02:47Z"},{"id":"wordfence:b2594fcc-ae07-4f3f-a4fe-0c19524b0193","source":"wordfence","cve":"","title":"Survey Maker \u2013 Best WordPress Survey Plugin <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2594fcc-ae07-4f3f-a4fe-0c19524b0193?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2599d30-7ce5-4a25-b46c-e743d9d88dc6","source":"wordfence","cve":"CVE-2025-54055","title":"Druco <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2599d30-7ce5-4a25-b46c-e743d9d88dc6?source=api-prod","affected":[{"type":"theme","slug":"druco","name":"Druco - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-08-02T00:00:00Z","updated":"2025-08-04T19:28:12Z"},{"id":"wordfence:b25b4aed-94b2-4c16-8e4e-39aec4e5e22a","source":"wordfence","cve":"CVE-2026-97657","title":"Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25b4aed-94b2-4c16-8e4e-39aec4e5e22a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.8.0","to_inclusive":true,"patched_in":"10.8.1"}],"published":"2026-10-13T13:52:13Z","updated":"2026-10-14T02:27:38Z"},{"id":"wordfence:b25c27ee-0d50-4b1e-ac07-469c99e601d1","source":"wordfence","cve":"CVE-2026-57656","title":"Hester Core <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25c27ee-0d50-4b1e-ac07-469c99e601d1?source=api-prod","affected":[{"type":"plugin","slug":"hester-core","name":"Hester Core","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:35:15Z"},{"id":"wordfence:b25cc768-3377-41c9-acf5-8f6c993287c9","source":"wordfence","cve":"CVE-2026-116557","title":"WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25cc768-3377-41c9-acf5-8f6c993287c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.1.0.5","to_inclusive":true,"patched_in":"2.1.0.6"}],"published":"2026-10-30T18:25:33Z","updated":"2026-10-31T06:44:22Z"},{"id":"wordfence:b25efc5b-406a-47a5-995c-c2b85e34a8f2","source":"wordfence","cve":"CVE-2024-10639","title":"Auto Prune Posts <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25efc5b-406a-47a5-995c-c2b85e34a8f2?source=api-prod","affected":[{"type":"plugin","slug":"auto-prune-posts","name":"Auto Prune Posts","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T15:08:24Z"},{"id":"wordfence:b25f939c-1dfe-4d4f-a27a-1f9022da6965","source":"wordfence","cve":"CVE-2025-5700","title":"Simple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b25f939c-1dfe-4d4f-a27a-1f9022da6965?source=api-prod","affected":[{"type":"plugin","slug":"simple-logo-carousel","name":"Simple Logo Carousel","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-06-16T21:35:35Z","updated":"2025-06-17T11:23:36Z"},{"id":"wordfence:b2642726-a878-46d1-9c17-a4c8f4d5e315","source":"wordfence","cve":"CVE-2011-5226","title":"WordPress Sentinel <= 1.0.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2642726-a878-46d1-9c17-a4c8f4d5e315?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-sentinel","name":"WordPress Sentinel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2011-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b266bd10-dbc6-4058-a5b2-1578c0814cb4","source":"wordfence","cve":"CVE-2023-4238","title":"Prevent files / folders access <= 2.5.1 - Authenticated (Administrator+) Arbitrary File Upload in mo_media_restrict_page","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b266bd10-dbc6-4058-a5b2-1578c0814cb4?source=api-prod","affected":[{"type":"plugin","slug":"prevent-file-access","name":"Prevent Files / Folders Access","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2670e15-a71a-4800-882d-5d04faeaeee1","source":"wordfence","cve":"CVE-2020-5651","title":"Simple Download Monitor <= 3.8.8 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2670e15-a71a-4800-882d-5d04faeaeee1?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2020-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b267f163-966a-43f7-8a7c-67d34c2c7e9d","source":"wordfence","cve":"CVE-2026-10818","title":"WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b267f163-966a-43f7-8a7c-67d34c2c7e9d?source=api-prod","affected":[{"type":"plugin","slug":"wpforms","name":"WPForms Pro","from":"*","from_inclusive":true,"to":"1.10.1.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-07-24T17:42:04Z","updated":"2026-07-25T06:50:06Z"},{"id":"wordfence:b2683b4e-b993-4c84-b7cc-a2cb511b4097","source":"wordfence","cve":"CVE-2026-1395","title":"Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2683b4e-b993-4c84-b7cc-a2cb511b4097?source=api-prod","affected":[{"type":"plugin","slug":"gutentools","name":"Gutentools","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-04-21T20:38:53Z","updated":"2026-04-22T09:27:22Z"},{"id":"wordfence:b2694fd0-0ad6-4b64-b332-aa7bc2f74cd5","source":"wordfence","cve":"CVE-2017-17744","title":"Custom Map <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2694fd0-0ad6-4b64-b332-aa7bc2f74cd5?source=api-prod","affected":[{"type":"plugin","slug":"custom-map","name":"Custom Map","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b26996cf-acea-41fb-ad2f-167f41d31cea","source":"wordfence","cve":"CVE-2024-25902","title":"Malware Scanner <= 4.7.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b26996cf-acea-41fb-ad2f-167f41d31cea?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-malware-protection","name":"Malware Scanner","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-03-29T16:37:39Z"},{"id":"wordfence:b269a5c9-9f0e-4dba-a06e-2d8dd94643b4","source":"wordfence","cve":"","title":"WP Ultimate Exporter < 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b269a5c9-9f0e-4dba-a06e-2d8dd94643b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-exporter","name":"Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2016-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b26d61de-651c-43de-ba90-33ef170755e0","source":"wordfence","cve":"CVE-2017-1002018","title":"eventr <= 1.02.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b26d61de-651c-43de-ba90-33ef170755e0?source=api-prod","affected":[{"type":"plugin","slug":"eventr","name":"Eventr","from":"*","from_inclusive":true,"to":"1.02.2","to_inclusive":true,"patched_in":""}],"published":"2017-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b27201c7-453b-4953-b364-42ca7bf012f0","source":"wordfence","cve":"CVE-2024-31349","title":"MailMunch \u2013 Grow your Email List <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27201c7-453b-4953-b364-42ca7bf012f0?source=api-prod","affected":[{"type":"plugin","slug":"mailmunch","name":"MailMunch \u2013 Grow your Email List","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:30:24Z"},{"id":"wordfence:b27338c7-2fbc-4985-a25e-8e2a9fdef8c3","source":"wordfence","cve":"","title":"Customer Service Software & Support Ticket System <= 5.12.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27338c7-2fbc-4985-a25e-8e2a9fdef8c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"5.13","to_inclusive":false,"patched_in":"5.13"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b274af9b-071c-4f8d-a2e0-7f02b631c19a","source":"wordfence","cve":"CVE-2021-34640","title":"Securimage-WP-Fixed <= 3.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b274af9b-071c-4f8d-a2e0-7f02b631c19a?source=api-prod","affected":[{"type":"plugin","slug":"securimage-wp-fixed","name":"Securimage-WP-Fixed","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":""}],"published":"2021-08-11T14:40:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b274b118-cf2d-4b03-b39a-fa2806d3bd8a","source":"wordfence","cve":"CVE-2026-19712","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates < 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b274b118-cf2d-4b03-b39a-fa2806d3bd8a?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:20:24Z"},{"id":"wordfence:b276acdf-7372-4d08-a40b-f5a46a3d3b28","source":"wordfence","cve":"CVE-2025-24691","title":"People Lists <= 1.3.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b276acdf-7372-4d08-a40b-f5a46a3d3b28?source=api-prod","affected":[{"type":"plugin","slug":"people-lists","name":"People Lists","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:36:31Z"},{"id":"wordfence:b276b1f7-e618-491f-beb4-675228632fa0","source":"wordfence","cve":"CVE-2025-5285","title":"Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b276b1f7-e618-491f-beb4-675228632fa0?source=api-prod","affected":[{"type":"plugin","slug":"product-subtitle-for-woocommerce","name":"Product Subtitle for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-05-30T18:05:33Z","updated":"2025-06-02T18:56:54Z"},{"id":"wordfence:b2780bc1-e044-4396-9f6e-de9e0a8ef841","source":"wordfence","cve":"CVE-2025-69084","title":"Photo Gallery <= 2.7.7.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2780bc1-e044-4396-9f6e-de9e0a8ef841?source=api-prod","affected":[{"type":"plugin","slug":"gt3-photo-video-gallery","name":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery","from":"*","from_inclusive":true,"to":"2.7.7.26","to_inclusive":true,"patched_in":"2.7.7.27"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-20T15:08:51Z"},{"id":"wordfence:b27995b1-3321-4997-8a25-80c9488b8405","source":"wordfence","cve":"CVE-2022-0949","title":"WP Block and Stop Bad Bots <= 6.92 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27995b1-3321-4997-8a25-80c9488b8405?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.930","to_inclusive":false,"patched_in":"6.930"}],"published":"2022-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b27b2e40-c703-4fa0-bff0-788e7a0351c6","source":"wordfence","cve":"CVE-2022-3946","title":"Welcart e-Commerce <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27b2e40-c703-4fa0-bff0-788e7a0351c6?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b27b4687-d3c0-4dbc-a706-26d6c3dc3604","source":"wordfence","cve":"CVE-2026-122087","title":"Event Tickets and Registration < 5.30.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27b4687-d3c0-4dbc-a706-26d6c3dc3604?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.3.1","to_inclusive":false,"patched_in":"5.30.3.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:53Z"},{"id":"wordfence:b27c7002-985c-4de9-b46a-440adf2a1662","source":"wordfence","cve":"","title":"Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27c7002-985c-4de9-b46a-440adf2a1662?source=api-prod","affected":[{"type":"plugin","slug":"sudoku-shortcode","name":"Sudoku Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-16T21:46:35Z"},{"id":"wordfence:b27cd8ca-b892-4f91-990e-c6761cbf2c91","source":"wordfence","cve":"CVE-2026-111738","title":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin < 7.8.5 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27cd8ca-b892-4f91-990e-c6761cbf2c91?source=api-prod","affected":[{"type":"plugin","slug":"sg-cachepress","name":"Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":false,"patched_in":"7.8.5"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T20:53:44Z"},{"id":"wordfence:b27ecbf7-e97d-42c0-98d4-c235edf40669","source":"wordfence","cve":"CVE-2026-1275","title":"Multi Post Carousel by Category <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b27ecbf7-e97d-42c0-98d4-c235edf40669?source=api-prod","affected":[{"type":"plugin","slug":"multi-post-carousel","name":"Multi Post Carousel by Category","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:20:23Z","updated":"2026-03-21T03:26:59Z"},{"id":"wordfence:b280155e-6d07-448d-922c-4a0ea21f4992","source":"wordfence","cve":"","title":"Biometric Login for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b280155e-6d07-448d-922c-4a0ea21f4992?source=api-prod","affected":[{"type":"plugin","slug":"biometric-login-for-woocommerce","name":"Biometric Login For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2833265-f1e5-4cfd-ad2f-ca28a59de82f","source":"wordfence","cve":"CVE-2024-13834","title":"Responsive Plus \u2013 Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2833265-f1e5-4cfd-ad2f-ca28a59de82f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-15T14:21:22Z"},{"id":"wordfence:b2839fdc-5904-4c3b-894f-7bf7e8b2986a","source":"wordfence","cve":"CVE-2023-0538","title":"Campaign URL Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2839fdc-5904-4c3b-894f-7bf7e8b2986a?source=api-prod","affected":[{"type":"plugin","slug":"campaign-url-builder","name":"Campaign URL Builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2840b9e-1baf-460c-ba11-43e4279ece27","source":"wordfence","cve":"CVE-2024-6824","title":"Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2840b9e-1baf-460c-ba11-43e4279ece27?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.38","to_inclusive":true,"patched_in":"4.10.39"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T05:31:47Z"},{"id":"wordfence:b2849cb5-9277-460d-a429-6253c98c1554","source":"wordfence","cve":"CVE-2021-24254","title":"College publisher Import <= 0.1 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2849cb5-9277-460d-a429-6253c98c1554?source=api-prod","affected":[{"type":"plugin","slug":"college-publisher-import","name":"College publisher Import","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2021-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b28634d1-6489-4ac2-9d64-2b7409fd462e","source":"wordfence","cve":"CVE-2025-68497","title":"Astra Widgets <= 1.2.16 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b28634d1-6489-4ac2-9d64-2b7409fd462e?source=api-prod","affected":[{"type":"plugin","slug":"astra-widgets","name":"Astra Widgets","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-05T18:45:32Z"},{"id":"wordfence:b288386c-709c-49a6-9b46-28bf46c3c303","source":"wordfence","cve":"CVE-2026-12800","title":"Premium Packages <= 6.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b288386c-709c-49a6-9b46-28bf46c3c303?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2026-07-27T19:51:50Z","updated":"2026-07-28T08:34:36Z"},{"id":"wordfence:b28a0818-4732-45e8-b47c-9f2ce1ef9ddc","source":"wordfence","cve":"CVE-2026-24388","title":"WPMasterToolKit <= 2.14.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b28a0818-4732-45e8-b47c-9f2ce1ef9ddc?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.14.1"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-28T18:36:51Z"},{"id":"wordfence:b28ad91f-40fa-476e-b41f-da4dd2372e21","source":"wordfence","cve":"CVE-2026-3694","title":"Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b28ad91f-40fa-476e-b41f-da4dd2372e21?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"5.6.9"}],"published":"2026-05-13T18:18:34Z","updated":"2026-05-14T06:44:12Z"},{"id":"wordfence:b28ba929-d057-43f9-b839-62347c06c1bd","source":"wordfence","cve":"","title":"WP Spell Check <= 9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b28ba929-d057-43f9-b839-62347c06c1bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"9.3","to_inclusive":false,"patched_in":"9.3"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b28e313a-3527-468f-8e86-6e51962af950","source":"wordfence","cve":"CVE-2025-53999","title":"Altair <= 5.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b28e313a-3527-468f-8e86-6e51962af950?source=api-prod","affected":[{"type":"theme","slug":"altair","name":"Altair","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T20:20:36Z"},{"id":"wordfence:b290e792-2473-4ba5-b66c-b6ca65445c0e","source":"wordfence","cve":"","title":"Responsive Starter Templates \u2013 Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b290e792-2473-4ba5-b66c-b6ca65445c0e?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b29113d6-7a9a-4e10-a446-147ec146ac93","source":"wordfence","cve":"CVE-2023-5663","title":"News Announcement Scroll <= 9.0.0 -  Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29113d6-7a9a-4e10-a446-147ec146ac93?source=api-prod","affected":[{"type":"plugin","slug":"news-announcement-scroll","name":"News Announcement Scroll","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:27:11Z"},{"id":"wordfence:b29144f7-08cb-4703-a977-4fece763abbd","source":"wordfence","cve":"CVE-2024-33920","title":"Democracy Poll <= 6.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29144f7-08cb-4703-a977-4fece763abbd?source=api-prod","affected":[{"type":"plugin","slug":"democracy-poll","name":"Democracy Poll","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-04-29T00:00:00Z","updated":"2026-06-18T14:18:33Z"},{"id":"wordfence:b2916405-bcb0-47e5-a077-ad13cefa208e","source":"wordfence","cve":"CVE-2026-73187","title":"Sticky Chat Widget \u2013 Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2916405-bcb0-47e5-a077-ad13cefa208e?source=api-prod","affected":[{"type":"plugin","slug":"sticky-chat-widget","name":"Sticky Chat Widget \u2013 Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:22:53Z"},{"id":"wordfence:b291ed6f-0998-40fc-a628-4df6416c9fc4","source":"wordfence","cve":"CVE-2012-6652","title":"A Page Flip Book < 3.0 - Directory Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b291ed6f-0998-40fc-a628-4df6416c9fc4?source=api-prod","affected":[{"type":"plugin","slug":"wppageflip","name":"A Page Flip Book","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2012-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2941cb4-57dc-425e-8ed7-d82096c73b44","source":"wordfence","cve":"CVE-2025-69145","title":"Gat <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2941cb4-57dc-425e-8ed7-d82096c73b44?source=api-prod","affected":[{"type":"theme","slug":"gat","name":"Gat","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:10:44Z"},{"id":"wordfence:b2971aa0-8287-4142-bd04-7aec1ed92e7b","source":"wordfence","cve":"CVE-2025-14478","title":"Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload","severity":"high","cvss":7.5,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2971aa0-8287-4142-bd04-7aec1ed92e7b?source=api-prod","affected":[{"type":"plugin","slug":"demo-importer-plus","name":"Demo Importer Plus","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-17T07:27:37Z"},{"id":"wordfence:b297a6f3-7743-4b86-bd72-93ea0cd85bfa","source":"wordfence","cve":"CVE-2024-4900","title":"SEOPress <= 7.7.2 - Authenticated (Contributor+) Open Redirect","severity":"medium","cvss":6.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b297a6f3-7743-4b86-bd72-93ea0cd85bfa?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.7.2","to_inclusive":true,"patched_in":"7.8"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-17T14:07:18Z"},{"id":"wordfence:b2983797-7c8d-4107-945f-67ca63ac6a06","source":"wordfence","cve":"CVE-2026-85642","title":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder < 7.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2983797-7c8d-4107-945f-67ca63ac6a06?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":false,"patched_in":"7.0"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:50Z"},{"id":"wordfence:b29918de-22a2-424f-ad86-ad83874ca81a","source":"wordfence","cve":"CVE-2026-104014","title":"Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29918de-22a2-424f-ad86-ad83874ca81a?source=api-prod","affected":[{"type":"plugin","slug":"naimur-email-otp-for-woocommerce","name":"Naimur Email OTP Verification for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-11-06T21:32:13Z","updated":"2026-11-07T11:26:33Z"},{"id":"wordfence:b2992b29-5f48-4389-ae27-6cb6b54d2ba5","source":"wordfence","cve":"CVE-2026-22463","title":"Form to Chat App <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2992b29-5f48-4389-ae27-6cb6b54d2ba5?source=api-prod","affected":[{"type":"plugin","slug":"form-to-chat","name":"Form to Chat App \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-04T00:00:00Z","updated":"2026-01-14T19:28:13Z"},{"id":"wordfence:b299a932-8167-4547-845b-637c4971360d","source":"wordfence","cve":"CVE-2024-11642","title":"Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b299a932-8167-4547-845b-637c4971360d?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.12","to_inclusive":true,"patched_in":"3.4.13"}],"published":"2025-01-08T22:10:09Z","updated":"2025-09-11T14:40:42Z"},{"id":"wordfence:b29dbd24-6c63-46d8-b245-7194cab17624","source":"wordfence","cve":"CVE-2026-24547","title":"SiteGround Email Marketing <= 1.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29dbd24-6c63-46d8-b245-7194cab17624?source=api-prod","affected":[{"type":"plugin","slug":"siteground-email-marketing","name":"SiteGround Email Marketing","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:48:41Z"},{"id":"wordfence:b29dcd7a-a0bc-4983-85ba-6ebf2c405ceb","source":"wordfence","cve":"CVE-2023-28787","title":"Quiz and Survey Master <= 8.1.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29dcd7a-a0bc-4983-85ba-6ebf2c405ceb?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.1.4","to_inclusive":true,"patched_in":"8.1.5"}],"published":"2023-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b29f0fea-a2db-4b2e-b7b8-d15b2395e9e6","source":"wordfence","cve":"CVE-2025-14893","title":"IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b29f0fea-a2db-4b2e-b7b8-d15b2395e9e6?source=api-prod","affected":[{"type":"plugin","slug":"indieweb","name":"IndieWeb","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-01-08T17:50:29Z","updated":"2026-01-09T06:34:55Z"},{"id":"wordfence:b2a01ccc-c98e-4fcc-8eaf-721ec46584fc","source":"wordfence","cve":"CVE-2025-11003","title":"UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a01ccc-c98e-4fcc-8eaf-721ec46584fc?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.09","to_inclusive":true,"patched_in":"3.5.10"}],"published":"2025-11-20T19:18:03Z","updated":"2026-09-14T19:57:42Z"},{"id":"wordfence:b2a0b560-3f5a-4d09-9cc1-e22b2a19dfe6","source":"wordfence","cve":"CVE-2026-8910","title":"WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a0b560-3f5a-4d09-9cc1-e22b2a19dfe6?source=api-prod","affected":[{"type":"plugin","slug":"wp-emoticon-rating","name":"WP Emoticon Rating","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:06:05Z","updated":"2026-06-09T03:41:22Z"},{"id":"wordfence:b2a4a34f-4fc1-4bcd-b70b-8fa7d119f9e7","source":"wordfence","cve":"CVE-2025-69151","title":"Grand Car Rental | Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a4a34f-4fc1-4bcd-b70b-8fa7d119f9e7?source=api-prod","affected":[{"type":"theme","slug":"grandcarrental","name":"Grand Car Rental | Limousine HTML Template","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:06:47Z"},{"id":"wordfence:b2a537a9-a1db-465e-8e04-2306e0d6998c","source":"wordfence","cve":"CVE-2021-24421","title":"WP JobSearch <= 1.7.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a537a9-a1db-465e-8e04-2306e0d6998c?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2021-05-19T00:00:00Z","updated":"2025-06-30T13:38:52Z"},{"id":"wordfence:b2a54178-1ba2-4769-884d-3346ffc0a6df","source":"wordfence","cve":"CVE-2026-16570","title":"NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a54178-1ba2-4769-884d-3346ffc0a6df?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":false,"patched_in":"4.4.8"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-02T14:45:01Z"},{"id":"wordfence:b2a825e4-3ffc-4412-81f4-6992dbbe756b","source":"wordfence","cve":"CVE-2021-24825","title":"Custom Content Shortcode <= 4.0.1 - Authenticated Arbitrary File Access / Local File Inclusion","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a825e4-3ffc-4412-81f4-6992dbbe756b?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-shortcode","name":"Custom Content Shortcode","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2a8c307-2430-4ea9-afe0-e5e758eabdd1","source":"wordfence","cve":"CVE-2026-1947","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a8c307-2430-4ea9-afe0-e5e758eabdd1?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.9","to_inclusive":true,"patched_in":"9.1.10"}],"published":"2026-03-14T13:14:22Z","updated":"2026-03-15T01:19:06Z"},{"id":"wordfence:b2a98c69-5f76-41f4-8a12-0523285647fb","source":"wordfence","cve":"CVE-2021-24307","title":"All in One SEO <= 4.1.0.1 - Authenticated Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a98c69-5f76-41f4-8a12-0523285647fb?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.1.0.2","to_inclusive":false,"patched_in":"4.1.0.2"}],"published":"2021-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ab2178-7438-43ef-961e-b54d0d230f4a","source":"wordfence","cve":"CVE-2023-2545","title":"Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Authentication Bypass and Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ab2178-7438-43ef-961e-b54d0d230f4a?source=api-prod","affected":[{"type":"plugin","slug":"feather-login-page","name":"Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha","from":"1.0.7","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ac2e50-1eef-46e6-8d57-c9d2dc04f933","source":"wordfence","cve":"CVE-2015-8350","title":"WordPress Calls to Action < 2.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ac2e50-1eef-46e6-8d57-c9d2dc04f933?source=api-prod","affected":[{"type":"plugin","slug":"cta","name":"WordPress Calls to Action","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2015-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ac9211-c21b-4bb9-9069-0c2cc10fb70f","source":"wordfence","cve":"CVE-2025-58825","title":"Comment Form WP &#8211; Customize Default Comment Form <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ac9211-c21b-4bb9-9069-0c2cc10fb70f?source=api-prod","affected":[{"type":"plugin","slug":"comment-form-wp","name":"Comment Form WP \u2013 Customize Default Comment Form","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:31:35Z"},{"id":"wordfence:b2acd36d-013b-4833-95ea-27d6b6db64a0","source":"wordfence","cve":"CVE-2024-47630","title":"ElementInvader Addons for Elementor <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2acd36d-013b-4833-95ea-27d6b6db64a0?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:39:40Z"},{"id":"wordfence:b2ad5698-4299-48a4-bcc1-5f4436dfab27","source":"wordfence","cve":"CVE-2025-11501","title":"Dynamically Display Posts <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ad5698-4299-48a4-bcc1-5f4436dfab27?source=api-prod","affected":[{"type":"plugin","slug":"dynamically-display-posts","name":"Dynamically Display Posts","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:17:11Z","updated":"2025-10-15T07:23:56Z"},{"id":"wordfence:b2ae4226-0089-47fb-87b9-94e9faf764e4","source":"wordfence","cve":"CVE-2024-3337","title":"Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ae4226-0089-47fb-87b9-94e9faf764e4?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.272","to_inclusive":true,"patched_in":"1.0.274"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:52:32Z"},{"id":"wordfence:b2af416b-4510-468f-81ef-aa09f2fd51ac","source":"wordfence","cve":"","title":"Post to CSV by BestWebSoft < 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2af416b-4510-468f-81ef-aa09f2fd51ac?source=api-prod","affected":[{"type":"plugin","slug":"post-to-csv","name":"Post to CSV by BestWebSoft","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2afcc67-ac33-4482-868a-af729dca857e","source":"wordfence","cve":"CVE-2026-39792","title":"Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2afcc67-ac33-4482-868a-af729dca857e?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:15:49Z"},{"id":"wordfence:b2b0c5f9-b734-41e6-8ecb-4cf3d891ddb7","source":"wordfence","cve":"CVE-2023-23869","title":"Google XML Sitemap for Mobile <= 1.6.1 - Cross-Site Request Forgery via mobile_sitemap_generate","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b0c5f9-b734-41e6-8ecb-4cf3d891ddb7?source=api-prod","affected":[{"type":"plugin","slug":"google-mobile-sitemap","name":"Google XML Sitemap for Mobile","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2b1db53-227c-4887-b24d-37c0d2bedf69","source":"wordfence","cve":"CVE-2022-2372","title":"YaySMTP \u2013 Simple WP SMTP Mail <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b1db53-227c-4887-b24d-37c0d2bedf69?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2b62226-cf9b-4713-9734-67bf1c48895b","source":"wordfence","cve":"CVE-2014-4519","title":"Conversador <= 2.61 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b62226-cf9b-4713-9734-67bf1c48895b?source=api-prod","affected":[{"type":"plugin","slug":"conversador","name":"Conversador","from":"*","from_inclusive":true,"to":"2.61","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2b973fe-1209-43dc-b2a3-74086b12fe97","source":"wordfence","cve":"CVE-2026-104748","title":"SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2b973fe-1209-43dc-b2a3-74086b12fe97?source=api-prod","affected":[{"type":"plugin","slug":"simple-form","name":"SimpleForm \u2013 Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2026-10-13T19:40:33Z","updated":"2026-10-14T07:43:35Z"},{"id":"wordfence:b2bb2d4c-eaba-45be-a86f-8acde02c946b","source":"wordfence","cve":"CVE-2025-31619","title":"Actionwear products sync < 3.1.13 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2bb2d4c-eaba-45be-a86f-8acde02c946b?source=api-prod","affected":[{"type":"plugin","slug":"actionwear-products-sync","name":"Actionwear products sync","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":false,"patched_in":"3.1.13"}],"published":"2025-03-31T00:00:00Z","updated":"2026-06-23T17:33:11Z"},{"id":"wordfence:b2bdb698-3a07-4e8b-a498-b156accadc0a","source":"wordfence","cve":"CVE-2023-23793","title":"Read More Without Refresh <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2bdb698-3a07-4e8b-a498-b156accadc0a?source=api-prod","affected":[{"type":"plugin","slug":"read-more-without-refresh","name":"Read More Without Refresh","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2020-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2c03142-be30-4173-a140-14d73a16dd2b","source":"wordfence","cve":"CVE-2023-6316","title":"MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c03142-be30-4173-a140-14d73a16dd2b?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2c2110d-e07c-4e1e-90e1-7272c7039170","source":"wordfence","cve":"CVE-2024-54384","title":"Falcon \u2013 WordPress Optimizations & Tweaks <= 2.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c2110d-e07c-4e1e-90e1-7272c7039170?source=api-prod","affected":[{"type":"plugin","slug":"falcon","name":"Falcon \u2013 Cache, Performance, Security, Cleanup, and Tweaks","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T08:33:32Z"},{"id":"wordfence:b2c44c95-6a00-4c56-967b-003ce307f90c","source":"wordfence","cve":"CVE-2026-6932","title":"Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c44c95-6a00-4c56-967b-003ce307f90c?source=api-prod","affected":[{"type":"plugin","slug":"woo-commerce-min-weight","name":"Woo Commerce Minimum Weight","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:07:02Z","updated":"2026-05-12T07:48:26Z"},{"id":"wordfence:b2c702a5-8677-49f3-8824-1e8345ff54ed","source":"wordfence","cve":"CVE-2013-10027","title":"Blogger Importer <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c702a5-8677-49f3-8824-1e8345ff54ed?source=api-prod","affected":[{"type":"plugin","slug":"blogger-importer","name":"Blogger Importer","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.6"}],"published":"2013-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2c7fb39-d128-4285-8bc3-1e192e1e1196","source":"wordfence","cve":"CVE-2025-15513","title":"Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=api-prod","affected":[{"type":"plugin","slug":"float-gateway","name":"Float Payment Gateway","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2026-01-13T17:33:22Z","updated":"2026-01-23T19:13:07Z"},{"id":"wordfence:b2c83287-13ca-4fdc-95b6-97da150b0c09","source":"wordfence","cve":"CVE-2023-0875","title":"WP Meta SEO <= 4.5.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c83287-13ca-4fdc-95b6-97da150b0c09?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ca838d-165d-4670-94ad-652eedf512ea","source":"wordfence","cve":"CVE-2025-58668","title":"WPLMS  <= 4.970 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ca838d-165d-4670-94ad-652eedf512ea?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"4.970","to_inclusive":true,"patched_in":"4.971"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:17:53Z"},{"id":"wordfence:b2ca965b-0d0c-4785-9666-69829e4cb1a4","source":"wordfence","cve":"CVE-2024-30439","title":"Limit Attempts by BestWebSoft <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ca965b-0d0c-4785-9666-69829e4cb1a4?source=api-prod","affected":[{"type":"plugin","slug":"limit-attempts","name":"Limit Attempts by BestWebSoft \u2013 WordPress Anti-Bot and Security Plugin for Login and Forms","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:45:21Z"},{"id":"wordfence:b2cb4af8-4cb5-4f79-93c1-21dbdc7c406f","source":"wordfence","cve":"CVE-2025-24671","title":"Save as PDF Plugin by Pdfcrowd <= 4.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2cb4af8-4cb5-4f79-93c1-21dbdc7c406f?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2025-01-21T00:00:00Z","updated":"2025-02-24T16:14:55Z"},{"id":"wordfence:b2ccf80e-83a1-4a98-a849-e0cedb6608fc","source":"wordfence","cve":"CVE-2025-59554","title":"Advanced Ads \u2013 Tracking < 3.0.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ccf80e-83a1-4a98-a849-e0cedb6608fc?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads-tracking","name":"Advanced Ads \u2013 Tracking","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2025-09-04T00:00:00Z","updated":"2026-09-18T14:35:18Z"},{"id":"wordfence:b2ce5eb3-7a3f-4309-8263-23af334dd1d0","source":"wordfence","cve":"CVE-2026-57411","title":"CF7 Views \u2013 Complete Entry Management for Contact Form 7 <= 3.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ce5eb3-7a3f-4309-8263-23af334dd1d0?source=api-prod","affected":[{"type":"plugin","slug":"cf7-views","name":"CF7 Views \u2013 Complete Entry Management for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:26:19Z"},{"id":"wordfence:b2ce9854-06df-44a8-b998-de21bf52a5d8","source":"wordfence","cve":"CVE-2022-4747","title":"Post Category Image With Grid and Slider <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ce9854-06df-44a8-b998-de21bf52a5d8?source=api-prod","affected":[{"type":"plugin","slug":"post-category-image-with-grid-and-slider","name":"Post Category Image With Grid and Slider","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2cea890-b131-47cd-9050-a484fb1895f6","source":"wordfence","cve":"","title":"5 Star <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2cea890-b131-47cd-9050-a484fb1895f6?source=api-prod","affected":[{"type":"theme","slug":"5star","name":"5 Star Hotel","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2014-03-31T00:00:00Z","updated":"2026-02-26T14:51:42Z"},{"id":"wordfence:b2cf3b85-2e2d-43dc-9877-9a740d4fd2fb","source":"wordfence","cve":"CVE-2025-0394","title":"Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2cf3b85-2e2d-43dc-9877-9a740d4fd2fb?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"3.7.3.5","to_inclusive":true,"patched_in":"3.7.3.6"}],"published":"2025-01-13T20:19:33Z","updated":"2025-01-14T08:23:15Z"},{"id":"wordfence:b2d20052-184e-473d-8e5b-46b7dd270c52","source":"wordfence","cve":"CVE-2024-32091","title":"Sangar Slider <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2d20052-184e-473d-8e5b-46b7dd270c52?source=api-prod","affected":[{"type":"plugin","slug":"sangar-slider-lite","name":"Responsive Slider \u2013 Sangar Slider","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T19:16:23Z"},{"id":"wordfence:b2d26156-b88c-4cae-a830-be765e1f1473","source":"wordfence","cve":"CVE-2020-12832","title":"Simple File List <= 4.2.7 - Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2d26156-b88c-4cae-a830-be765e1f1473?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.8"}],"published":"2020-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2d31521-5fe1-48ce-881c-4cacdbe08f21","source":"wordfence","cve":"CVE-2013-4241","title":"HMS Testimonials < 2.0.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2d31521-5fe1-48ce-881c-4cacdbe08f21?source=api-prod","affected":[{"type":"plugin","slug":"hms-testimonials","name":"HMS Testimonials","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2013-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2d75e43-cd46-4c23-bea4-3564e0334a32","source":"wordfence","cve":"CVE-2026-6287","title":"ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2d75e43-cd46-4c23-bea4-3564e0334a32?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-05-26T16:17:03Z","updated":"2026-05-27T04:29:03Z"},{"id":"wordfence:b2dbf510-d99f-4918-8462-66696b68003c","source":"wordfence","cve":"CVE-2024-13452","title":"Contact Form by Supsystic <= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2dbf510-d99f-4918-8462-66696b68003c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2025-04-15T14:00:54Z","updated":"2025-04-16T02:14:52Z"},{"id":"wordfence:b2dee8d2-e1ab-455c-b922-92881f62fc5c","source":"wordfence","cve":"CVE-2023-39990","title":"Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2dee8d2-e1ab-455c-b922-92881f62fc5c?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-courses","name":"Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2e336d3-edd9-4664-bfa5-deec4064ee0b","source":"wordfence","cve":"CVE-2024-3276","title":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox (Free and Premium) <= 2.7.27 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2e336d3-edd9-4664-bfa5-deec4064ee0b?source=api-prod","affected":[{"type":"plugin","slug":"foobox-image-lightbox-premium","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox Premium","from":"*","from_inclusive":true,"to":"2.7.27","to_inclusive":true,"patched_in":"2.7.28"},{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.27","to_inclusive":true,"patched_in":"2.7.28"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-30T20:44:44Z"},{"id":"wordfence:b2e76535-b97e-4104-8e90-ac21348b34ef","source":"wordfence","cve":"CVE-2021-24859","title":"User meta shortcodes <= 0.5 - Improper Access Control","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2e76535-b97e-4104-8e90-ac21348b34ef?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-shortcodes","name":"User meta shortcodes","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2e8f9b7-1fce-46be-8198-eeff58a563c6","source":"wordfence","cve":"CVE-2023-23789","title":"Premmerce Redirect Manager <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2e8f9b7-1fce-46be-8198-eeff58a563c6?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-redirect-manager","name":"Premmerce Redirect Manager","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ea3a9e-2a9a-4628-8ea1-e18e756f915f","source":"wordfence","cve":"CVE-2025-10050","title":"Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ea3a9e-2a9a-4628-8ea1-e18e756f915f?source=api-prod","affected":[{"type":"plugin","slug":"developer-loggers-for-simple-history","name":"Developer Loggers for Simple History","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.5.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T01:49:16Z"},{"id":"wordfence:b2ea5e77-335a-4f40-9a04-9e1d4f3e1017","source":"wordfence","cve":"CVE-2026-84171","title":"WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ea5e77-335a-4f40-9a04-9e1d4f3e1017?source=api-prod","affected":[{"type":"plugin","slug":"wp-images-upload-on-piclect","name":"WP images upload on piclect","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:57:38Z"},{"id":"wordfence:b2ec4c4e-5252-4feb-88b5-c52ce3c2e057","source":"wordfence","cve":"CVE-2025-59009","title":"Listify <= 3.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ec4c4e-5252-4feb-88b5-c52ce3c2e057?source=api-prod","affected":[{"type":"theme","slug":"listify","name":"Listify","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-22T00:00:00Z","updated":"2025-12-19T22:05:54Z"},{"id":"wordfence:b2ec7d77-fe50-4bb2-a57b-6ee4246805f9","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadSettings' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ec7d77-fe50-4bb2-a57b-6ee4246805f9?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ed8026-bcce-4f93-a721-e9af522f2c39","source":"wordfence","cve":"CVE-2025-58843","title":"Auto Last Youtube Video <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ed8026-bcce-4f93-a721-e9af522f2c39?source=api-prod","affected":[{"type":"plugin","slug":"auto-last-youtube-video","name":"Auto Last Youtube Video","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:42:39Z"},{"id":"wordfence:b2ef036e-14a5-40df-93c3-ab1a1d9accc0","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ef036e-14a5-40df-93c3-ab1a1d9accc0?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2ef0410-3f8d-40e1-9188-43ec4e7077cd","source":"wordfence","cve":"CVE-2024-32135","title":"Disable Comments | WPZest <= 1.51 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ef0410-3f8d-40e1-9188-43ec4e7077cd?source=api-prod","affected":[{"type":"plugin","slug":"disable-comments-wpz","name":"Disable Comments | WPZest","from":"*","from_inclusive":true,"to":"1.51","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:50:40Z"},{"id":"wordfence:b2efcf06-14e7-48d2-aa5a-4b623b81c193","source":"wordfence","cve":"CVE-2025-31611","title":"Auto Post After Image Upload <= 1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2efcf06-14e7-48d2-aa5a-4b623b81c193?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-after-image-upload","name":"Auto Post After Image Upload","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T14:10:10Z"},{"id":"wordfence:b2f16704-6c96-4ff1-b1b1-75c4f16df039","source":"wordfence","cve":"","title":"WP Mobile Detector <= 3.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2f16704-6c96-4ff1-b1b1-75c4f16df039?source=api-prod","affected":[{"type":"plugin","slug":"wp-mobile-detector","name":"WP Mobile Detector","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3"}],"published":"2015-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2f3c007-6ecc-4003-87ed-352984b9a83c","source":"wordfence","cve":"CVE-2020-20633","title":"GDPR Cookie Consent & Compliance Notice <= 1.8.2 - Authenticated Stored Cross-Site Scripting and Authorization Bypass","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2f3c007-6ecc-4003-87ed-352984b9a83c?source=api-prod","affected":[{"type":"plugin","slug":"cookie-law-info","name":"CookieYes \u2013 Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2020-02-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2f4efa2-ddf6-46a7-9bde-aa1bcbbd2999","source":"wordfence","cve":"CVE-2021-36829","title":"Launcher: Coming Soon & Maintenance Mode <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2f4efa2-ddf6-46a7-9bde-aa1bcbbd2999?source=api-prod","affected":[{"type":"plugin","slug":"launcher","name":"Launcher: Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b2f9203f-15c7-4179-86ef-44b0e2788b3c","source":"wordfence","cve":"CVE-2025-60155","title":"WP Virtual Assistant <= 3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2f9203f-15c7-4179-86ef-44b0e2788b3c?source=api-prod","affected":[{"type":"plugin","slug":"VirtualAssistant","name":"WP Virtual Assistant","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:12:30Z"},{"id":"wordfence:b2fad930-8dae-4feb-a9c7-a2fb801cef51","source":"wordfence","cve":"CVE-2024-37469","title":"Blocksy <= 2.0.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2fad930-8dae-4feb-a9c7-a2fb801cef51?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2024-07-01T00:00:00Z","updated":"2026-04-15T20:49:58Z"},{"id":"wordfence:b2fc119c-6545-48a5-aa27-852edce50b39","source":"wordfence","cve":"CVE-2026-32427","title":"VW Education Lite <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2fc119c-6545-48a5-aa27-852edce50b39?source=api-prod","affected":[{"type":"theme","slug":"vw-education-lite","name":"VW Education Lite","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-03-01T00:00:00Z","updated":"2026-05-05T14:51:37Z"},{"id":"wordfence:b2fe5315-37b7-4009-b2e5-909e6b5ed1da","source":"wordfence","cve":"CVE-2024-12542","title":"linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2fe5315-37b7-4009-b2e5-909e6b5ed1da?source=api-prod","affected":[{"type":"plugin","slug":"linkid","name":"linkID","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-08T22:07:52Z","updated":"2025-01-09T11:11:04Z"},{"id":"wordfence:b2ff2954-f494-4cd7-9f29-ee0e8551e339","source":"wordfence","cve":"CVE-2024-0512","title":"Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ff2954-f494-4cd7-9f29-ee0e8551e339?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:12Z"},{"id":"wordfence:b3011679-51e8-4a13-8364-1d0723656d08","source":"wordfence","cve":"CVE-2026-2410","title":"Disable Admin Notices \u2013 Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3011679-51e8-4a13-8364-1d0723656d08?source=api-prod","affected":[{"type":"plugin","slug":"disable-admin-notices","name":"Disable Admin Notices \u2013 Hide Dashboard Notifications","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-02-24T20:56:18Z","updated":"2026-02-25T09:26:53Z"},{"id":"wordfence:b3023fda-d6ed-417f-b668-1cc63114805a","source":"wordfence","cve":"CVE-2025-23521","title":"Goodlayers Blocks <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3023fda-d6ed-417f-b668-1cc63114805a?source=api-prod","affected":[{"type":"plugin","slug":"goodlayers-blocks","name":"Goodlayers Blocks","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-28T18:36:09Z"},{"id":"wordfence:b30261e0-1fa1-4794-98f6-851532b7615c","source":"wordfence","cve":"CVE-2022-40211","title":"GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30261e0-1fa1-4794-98f6-851532b7615c?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b303034f-6ef2-4679-be2c-39e1472b30eb","source":"wordfence","cve":"CVE-2025-22570","title":"Inline Tweets <= 2.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b303034f-6ef2-4679-be2c-39e1472b30eb?source=api-prod","affected":[{"type":"plugin","slug":"inline-tweets","name":"Inline Tweets","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:38:29Z"},{"id":"wordfence:b3052631-4034-4235-b228-bb919777915a","source":"wordfence","cve":"CVE-2025-23744","title":"Random Posts, Mp3 Player + ShareButton <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3052631-4034-4235-b228-bb919777915a?source=api-prod","affected":[{"type":"plugin","slug":"random-posts-mp3-player-sharebutton","name":"Random Posts, Mp3 Player + ShareButton","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-17T14:36:53Z"},{"id":"wordfence:b306873d-de30-4f5a-b4c8-ba3bf2bc27e1","source":"wordfence","cve":"CVE-2025-39538","title":"WP-Advanced-Search <= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b306873d-de30-4f5a-b4c8-ba3bf2bc27e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T18:54:20Z"},{"id":"wordfence:b3075193-41ae-4e3d-acf7-b94105b67456","source":"wordfence","cve":"CVE-2025-22363","title":"Allada T-shirt Designer for Woocommerce <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3075193-41ae-4e3d-acf7-b94105b67456?source=api-prod","affected":[{"type":"plugin","slug":"allada-tshirt-designer-for-woocommerce","name":"Allada T-shirt Designer for Woocommerce \u2013 Custom Product Designer for T-shirt personalization and design","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T18:41:34Z"},{"id":"wordfence:b3083afd-ca84-4088-8e72-95254d56a0c0","source":"wordfence","cve":"CVE-2014-5199","title":"WordPress File Upload < 2.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3083afd-ca84-4088-8e72-95254d56a0c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2014-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b308bddf-a153-4d5b-936f-2170a1a494a5","source":"wordfence","cve":"CVE-2024-11179","title":"MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b308bddf-a153-4d5b-936f-2170a1a494a5?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.15.7","to_inclusive":true,"patched_in":"4.15.8"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T09:31:54Z"},{"id":"wordfence:b308c032-14a1-42f7-866c-adacc7d9402e","source":"wordfence","cve":"CVE-2025-39536","title":"JobHunt Job Alerts <= 3.6 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b308c032-14a1-42f7-866c-adacc7d9402e?source=api-prod","affected":[{"type":"plugin","slug":"jobhunt-notifications","name":"JobHunt Job Alerts","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-23T00:00:00Z","updated":"2025-05-28T15:11:04Z"},{"id":"wordfence:b30ab159-ff3c-4d46-b182-f8938097b837","source":"wordfence","cve":"CVE-2024-13499","title":"GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30ab159-ff3c-4d46-b182-f8938097b837?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2025-01-21T22:51:27Z","updated":"2025-01-22T11:07:58Z"},{"id":"wordfence:b30ac1b0-eae2-4194-bf8e-ae73b4236965","source":"wordfence","cve":"CVE-2023-3869","title":"wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30ac1b0-eae2-4194-bf8e-ae73b4236965?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b30b28a9-b6f0-432c-b2c5-39c8a962def5","source":"wordfence","cve":"CVE-2026-94228","title":"TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30b28a9-b6f0-432c-b2c5-39c8a962def5?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"1.1.9","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:01:45Z"},{"id":"wordfence:b30c9414-0a9b-47b5-bc57-ec79f182fc9d","source":"wordfence","cve":"CVE-2026-49051","title":"WP Meta and Date Remover <= 2.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30c9414-0a9b-47b5-bc57-ec79f182fc9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-and-date-remover","name":"WP Meta and Date Remover","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:08:58Z"},{"id":"wordfence:b30e84db-c73f-4df2-9c88-c37a7e14c95b","source":"wordfence","cve":"CVE-2025-15266","title":"GeekyBot \u2014 Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b30e84db-c73f-4df2-9c88-c37a7e14c95b?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-01-13T17:20:05Z","updated":"2026-01-23T19:00:25Z"},{"id":"wordfence:b311b404-f808-40fc-9f09-4eac05bce798","source":"wordfence","cve":"CVE-2025-11532","title":"Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b311b404-f808-40fc-9f09-4eac05bce798?source=api-prod","affected":[{"type":"plugin","slug":"wisly","name":"Wisly","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:57:28Z","updated":"2025-11-11T03:30:47Z"},{"id":"wordfence:b3146b41-27d5-465d-a9ec-af4c50a0d612","source":"wordfence","cve":"CVE-2026-49047","title":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.4.29 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3146b41-27d5-465d-a9ec-af4c50a0d612?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-18T18:28:58Z"},{"id":"wordfence:b316094a-0d69-4712-a395-037ce6f2e59b","source":"wordfence","cve":"CVE-2024-44052","title":"HelloAsso <= 1.1.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b316094a-0d69-4712-a395-037ce6f2e59b?source=api-prod","affected":[{"type":"plugin","slug":"helloasso","name":"HelloAsso","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:52:11Z"},{"id":"wordfence:b319eab0-29af-45b9-a6fd-608bce552837","source":"wordfence","cve":"CVE-2025-64247","title":"Read More & Accordion <= 3.5.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b319eab0-29af-45b9-a6fd-608bce552837?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.5.5.1","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2025-12-15T00:00:00Z","updated":"2026-01-19T17:04:38Z"},{"id":"wordfence:b31a54f1-de87-49ac-bce1-e0ea295af325","source":"wordfence","cve":"CVE-2022-2413","title":"Slide Anything \u2013 Responsive Content / HTML Slider and Carousel <= 2.3.46 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b31a54f1-de87-49ac-bce1-e0ea295af325?source=api-prod","affected":[{"type":"plugin","slug":"slide-anything","name":"Slide Anything \u2013 Responsive Content / HTML Slider and Carousel","from":"*","from_inclusive":true,"to":"2.3.46","to_inclusive":true,"patched_in":"2.3.47"}],"published":"2022-07-06T00:00:00Z","updated":"2024-02-06T16:06:18Z"},{"id":"wordfence:b31d1d82-d0ee-465c-b56b-381df3b6fcfc","source":"wordfence","cve":"CVE-2024-43994","title":"Kahuna <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b31d1d82-d0ee-465c-b56b-381df3b6fcfc?source=api-prod","affected":[{"type":"theme","slug":"kahuna","name":"Kahuna","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.0.1"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-23T18:39:49Z"},{"id":"wordfence:b31fcf67-61c7-43b2-a068-136b13965ca0","source":"wordfence","cve":"CVE-2025-23784","title":"Contact Form 7 Round Robin Lead Distribution <= 1.2.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b31fcf67-61c7-43b2-a068-136b13965ca0?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-round-robin-lead-distribution","name":"Contact Form 7 Round Robin Lead Distribution","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:57:54Z"},{"id":"wordfence:b320c501-ed90-470b-a46f-d6dbe649bbd8","source":"wordfence","cve":"CVE-2025-22792","title":"Js O3 Lite <= 1.5.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b320c501-ed90-470b-a46f-d6dbe649bbd8?source=api-prod","affected":[{"type":"theme","slug":"js-o3-lite","name":"Js O3 Lite","from":"*","from_inclusive":true,"to":"1.5.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T16:55:36Z"},{"id":"wordfence:b3219b17-03b8-44c3-bf35-36b8b7457f8a","source":"wordfence","cve":"CVE-2026-1096","title":"Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3219b17-03b8-44c3-bf35-36b8b7457f8a?source=api-prod","affected":[{"type":"plugin","slug":"best-wp-google-map","name":"Best-wp-google-map","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-02-14T06:42:32Z"},{"id":"wordfence:b323d910-23f6-41e2-9d64-d60398994996","source":"wordfence","cve":"CVE-2021-24652","title":"PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b323d910-23f6-41e2-9d64-d60398994996?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":false,"patched_in":"2.4.10"}],"published":"2021-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3243fe4-9d11-49f0-884b-0162cd776993","source":"wordfence","cve":"CVE-2026-89334","title":"Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3243fe4-9d11-49f0-884b-0162cd776993?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.33","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-09-18T13:52:39Z","updated":"2026-09-19T02:27:11Z"},{"id":"wordfence:b3247bb3-3d9a-49b5-99ec-f4b305d37ae5","source":"wordfence","cve":"","title":"WordPress Download Manager <= 2.7.94 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3247bb3-3d9a-49b5-99ec-f4b305d37ae5?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.7.94","to_inclusive":true,"patched_in":"2.7.95"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3267339-2f28-40b9-b6ff-fdfe0d67bdc8","source":"wordfence","cve":"CVE-2023-44263","title":"Social Metrics <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3267339-2f28-40b9-b6ff-fdfe0d67bdc8?source=api-prod","affected":[{"type":"plugin","slug":"social-metrics","name":"Social Metrics","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3273950-e772-4373-bfeb-8750cd9eda5b","source":"wordfence","cve":"CVE-2026-106097","title":"Code Snippets <= 3.9.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3273950-e772-4373-bfeb-8750cd9eda5b?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T13:57:12Z"},{"id":"wordfence:b328d8e0-46ad-4f05-8e26-21313fc7b1dd","source":"wordfence","cve":"CVE-2026-28146","title":"Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b328d8e0-46ad-4f05-8e26-21313fc7b1dd?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-14T12:37:11Z"},{"id":"wordfence:b3297d5c-bf18-418f-838f-8e8319087b84","source":"wordfence","cve":"CVE-2026-110982","title":"AI Engine <= 3.8.5 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3297d5c-bf18-418f-838f-8e8319087b84?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:40:58Z"},{"id":"wordfence:b329c9f9-e71b-4738-89f9-ea2761afeb0c","source":"wordfence","cve":"CVE-2025-47626","title":"Submission DOM tracking for Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b329c9f9-e71b-4738-89f9-ea2761afeb0c?source=api-prod","affected":[{"type":"plugin","slug":"cf7-submission-dom-tracking","name":"Submission DOM tracking for Contact Form 7","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-03T19:20:46Z"},{"id":"wordfence:b32bf1cb-3722-41fc-be51-dabe80416b14","source":"wordfence","cve":"CVE-2026-2412","title":"Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.5","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-03-23T10:09:13Z","updated":"2026-03-23T22:25:39Z"},{"id":"wordfence:b32c1b63-564c-4c38-a149-d5adabda8a8b","source":"wordfence","cve":"CVE-2024-13394","title":"ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b32c1b63-564c-4c38-a149-d5adabda8a8b?source=api-prod","affected":[{"type":"plugin","slug":"viewmedica","name":"ViewMedica 9","from":"*","from_inclusive":true,"to":"1.4.18","to_inclusive":true,"patched_in":"1.4.19"}],"published":"2025-01-14T16:50:48Z","updated":"2025-11-05T19:05:56Z"},{"id":"wordfence:b331c32e-7341-458b-80be-574cfa915159","source":"wordfence","cve":"CVE-2023-49854","title":"Caddy <= 1.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b331c32e-7341-458b-80be-574cfa915159?source=api-prod","affected":[{"type":"plugin","slug":"caddy","name":"Caddy \u2013 WooCommerce Side Cart & Free Shipping Bar","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3325317-4ce7-468d-aee7-9b40fdf61d3c","source":"wordfence","cve":"","title":"FV Flowplayer Video Player <= 6.0.3.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3325317-4ce7-468d-aee7-9b40fdf61d3c?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"6.0.3.3","to_inclusive":true,"patched_in":"6.0.3.4"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b335bd15-7af7-4d8b-ad01-b1d9e76beb53","source":"wordfence","cve":"CVE-2025-4683","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b335bd15-7af7-4d8b-ad01-b1d9e76beb53?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.17.5","to_inclusive":true,"patched_in":"4.17.6"}],"published":"2025-05-26T11:27:54Z","updated":"2025-05-27T01:53:37Z"},{"id":"wordfence:b335fc19-2998-4711-8813-6cb68d7447bd","source":"wordfence","cve":"CVE-2023-3403","title":"ProfileGrid <= 5.5.1 - Missing Authorization to User Import","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b335fc19-2998-4711-8813-6cb68d7447bd?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3365102-20f1-46e4-960f-d5986af9014d","source":"wordfence","cve":"CVE-2024-51621","title":"Download-Mirror-Counter <= 1.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3365102-20f1-46e4-960f-d5986af9014d?source=api-prod","affected":[{"type":"plugin","slug":"wp-download-mirror-counter","name":"Download-Mirror-Counter","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:41:40Z"},{"id":"wordfence:b33760d8-323a-4d0b-9a54-b84152bd4367","source":"wordfence","cve":"","title":"YOP Poll <= 5.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b33760d8-323a-4d0b-9a54-b84152bd4367?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.7.4"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b33978d0-2680-44ab-9bdf-e0db1910fb6a","source":"wordfence","cve":"CVE-2026-111981","title":"GiveWP <= 4.19.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b33978d0-2680-44ab-9bdf-e0db1910fb6a?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:06:25Z"},{"id":"wordfence:b33bf55c-0397-44a2-8c18-ea5f8f1e2ec9","source":"wordfence","cve":"","title":"AI ChatBot <= 4.4.7 - Missing Authorization on openai_settings_option_callback","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b33bf55c-0397-44a2-8c18-ea5f8f1e2ec9?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.7","to_inclusive":true,"patched_in":"4.4.8"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b33f655a-ad13-45d8-bad9-e7c2599c2490","source":"wordfence","cve":"CVE-2026-4791","title":"PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b33f655a-ad13-45d8-bad9-e7c2599c2490?source=api-prod","affected":[{"type":"plugin","slug":"peprodev-ups","name":"PeproDev Ultimate Profile Solutions","from":"*","from_inclusive":true,"to":"8.2.36","to_inclusive":true,"patched_in":"8.2.37"}],"published":"2026-10-09T19:48:38Z","updated":"2026-10-10T08:26:39Z"},{"id":"wordfence:b33fd509-1cc3-48de-bd4a-7c9749da1cf8","source":"wordfence","cve":"CVE-2024-47388","title":"SliceWP <= 1.1.18 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b33fd509-1cc3-48de-bd4a-7c9749da1cf8?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:04:10Z"},{"id":"wordfence:b340eda1-e9d2-40b6-89f9-41d995ce3555","source":"wordfence","cve":"CVE-2023-4283","title":"EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b340eda1-e9d2-40b6-89f9-41d995ce3555?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b34194de-6b6e-4aaa-908e-85c424207c51","source":"wordfence","cve":"CVE-2025-58014","title":"Quiz Maker <= 6.7.0.64 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34194de-6b6e-4aaa-908e-85c424207c51?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.64","to_inclusive":true,"patched_in":"6.7.0.65"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T13:27:11Z"},{"id":"wordfence:b343269f-35f2-4cba-b539-3a4d8fd4baf4","source":"wordfence","cve":"CVE-2026-14919","title":"ShopMonitor.io \u2013 Automated Checkout & Form Monitoring < 1.2.0 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b343269f-35f2-4cba-b539-3a4d8fd4baf4?source=api-prod","affected":[{"type":"plugin","slug":"shopmonitorio","name":"ShopMonitor.io \u2013 Automated Checkout & Form Monitoring","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:23:34Z"},{"id":"wordfence:b3439710-1159-4677-93c9-14bacfbf0b55","source":"wordfence","cve":"CVE-2024-5425","title":"WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3439710-1159-4677-93c9-14bacfbf0b55?source=api-prod","affected":[{"type":"plugin","slug":"wp-jquery-lightbox","name":"LightPress Lightbox","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-06-06T15:00:26Z","updated":"2024-06-07T03:29:46Z"},{"id":"wordfence:b34478a9-6eb6-4482-adfe-bd9e770c9a5d","source":"wordfence","cve":"CVE-2024-50535","title":"Step by Step <= 0.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34478a9-6eb6-4482-adfe-bd9e770c9a5d?source=api-prod","affected":[{"type":"plugin","slug":"step-by-step","name":"Step by Step","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T20:17:34Z"},{"id":"wordfence:b3451ed9-9a9a-443f-b1ce-dcd07bd3e6ce","source":"wordfence","cve":"CVE-2023-51475","title":"WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3451ed9-9a9a-443f-b1ce-dcd07bd3e6ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-mlm","name":"WP MLM SOFTWARE PLUGIN","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3461327-9195-48ed-b9c3-7b33198e9438","source":"wordfence","cve":"CVE-2024-7090","title":"LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3461327-9195-48ed-b9c3-7b33198e9438?source=api-prod","affected":[{"type":"plugin","slug":"lh-add-media-from-url","name":"LH Add Media From Url","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.30"}],"published":"2024-08-20T17:25:05Z","updated":"2024-08-27T16:35:47Z"},{"id":"wordfence:b3498ebe-5e13-4ced-b92d-4908b8775996","source":"wordfence","cve":"CVE-2022-4653","title":"Greenshift \u2013 animation and page builder blocks <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3498ebe-5e13-4ced-b92d-4908b8775996?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b34a82c5-4d70-47d3-9a02-7eeaa13ff677","source":"wordfence","cve":"","title":"Ajax Search Pro <= 4.18.7 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34a82c5-4d70-47d3-9a02-7eeaa13ff677?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-pro","name":"Ajax Search Pro","from":"*","from_inclusive":true,"to":"4.18.7","to_inclusive":true,"patched_in":"4.19"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b34db1a8-13ee-45dd-9d05-90410bc3604d","source":"wordfence","cve":"CVE-2025-22514","title":"KNR Author List Widget <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34db1a8-13ee-45dd-9d05-90410bc3604d?source=api-prod","affected":[{"type":"plugin","slug":"knr-author-list-widget","name":"Axact Author List Widget","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:39:30Z"},{"id":"wordfence:b34e3be3-78d5-4e61-a8e9-05d4b06d630b","source":"wordfence","cve":"CVE-2026-19775","title":"OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b34e3be3-78d5-4e61-a8e9-05d4b06d630b?source=api-prod","affected":[{"type":"plugin","slug":"desktop-mode","name":"OpenStation \u2013 Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-09-24T18:15:16Z","updated":"2026-09-25T06:39:54Z"},{"id":"wordfence:b350a20e-6f86-4760-9092-27a4b365b590","source":"wordfence","cve":"CVE-2024-31248","title":"All-in-One Video Gallery <= 3.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b350a20e-6f86-4760-9092-27a4b365b590?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:26:54Z"},{"id":"wordfence:b3523535-6938-4922-8126-8386861ca512","source":"wordfence","cve":"CVE-2023-23872","title":"GMAce <= 1.5.2 - Authenticated(Admin+) Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3523535-6938-4922-8126-8386861ca512?source=api-prod","affected":[{"type":"plugin","slug":"gmace","name":"GMAce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b352994f-13f9-4139-94a9-0abdb52125a9","source":"wordfence","cve":"CVE-2026-14444","title":"WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b352994f-13f9-4139-94a9-0abdb52125a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion","name":"WP Fusion (Pro)","from":"*","from_inclusive":true,"to":"3.47.13","to_inclusive":true,"patched_in":"3.47.14"}],"published":"2026-09-07T00:46:31Z","updated":"2026-09-07T13:28:30Z"},{"id":"wordfence:b352b2e4-8d72-4ebd-8dcd-8e2740759f3e","source":"wordfence","cve":"CVE-2022-1014","title":"WP Contacts Manager <= 2.2.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b352b2e4-8d72-4ebd-8dcd-8e2740759f3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-contacts-manager","name":"WP Contacts Manager","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b352be87-ea61-4666-a4d0-cf93fef40e33","source":"wordfence","cve":"CVE-2022-46853","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 5.0.4 - Cross-Site Request Forgery in rttpg_spare_me","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b352be87-ea61-4666-a4d0-cf93fef40e33?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3533123-a141-4a15-b8cd-46a2870ecbd6","source":"wordfence","cve":"CVE-2024-43298","title":"Clone <= 2.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3533123-a141-4a15-b8cd-46a2870ecbd6?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:49:43Z"},{"id":"wordfence:b3552de0-3e0b-4529-a757-a31c69a06122","source":"wordfence","cve":"CVE-2024-49593","title":"Advanced Custom Fields <= 6.3.8 & Secure Custom Fields <= 6.3.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3552de0-3e0b-4529-a757-a31c69a06122?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.3.6.2","to_inclusive":true,"patched_in":"6.3.6.3"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"*","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"6.3.7","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields","from":"6.3.8","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T12:56:45Z"},{"id":"wordfence:b3574182-1bda-49b2-aac7-60f862891b46","source":"wordfence","cve":"CVE-2026-85682","title":"YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route","severity":"high","cvss":8.8,"cwe":"CWE-346","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3574182-1bda-49b2-aac7-60f862891b46?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-09-23T20:25:19Z","updated":"2026-09-24T08:27:32Z"},{"id":"wordfence:b359ef59-4c2e-4d4e-b000-1845525131de","source":"wordfence","cve":"CVE-2026-109218","title":"Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b359ef59-4c2e-4d4e-b000-1845525131de?source=api-prod","affected":[{"type":"plugin","slug":"contact-manager","name":"Contact Manager","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":"9.1.3"}],"published":"2026-10-27T18:42:18Z","updated":"2026-10-28T06:45:19Z"},{"id":"wordfence:b35e5228-7f1a-43e1-b65d-d13bdd6bcfaf","source":"wordfence","cve":"CVE-2022-4005","title":"Donation Button <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b35e5228-7f1a-43e1-b65d-d13bdd6bcfaf?source=api-prod","affected":[{"type":"plugin","slug":"donation-button","name":"Donation Button","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b35ee801-f04d-4b22-8238-053b02a6ee0c","source":"wordfence","cve":"CVE-2023-1469","title":"WP Express Checkout <= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon[code]","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c?source=api-prod","affected":[{"type":"plugin","slug":"wp-express-checkout","name":"WP Express Checkout (Fast Payments via PayPal & Stripe)","from":"2.2.8","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3603994-b12e-4360-a3aa-b93e80ac927b","source":"wordfence","cve":"CVE-2024-37410","title":"PowerPack Lite for Beaver Builder <= 1.3.0.3 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3603994-b12e-4360-a3aa-b93e80ac927b?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.3.0.3","to_inclusive":true,"patched_in":"1.3.0.4"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:20:14Z"},{"id":"wordfence:b360f121-449f-43a8-b5e4-1cffddbaac77","source":"wordfence","cve":"CVE-2026-57623","title":"W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b360f121-449f-43a8-b5e4-1cffddbaac77?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T14:35:09Z"},{"id":"wordfence:b3621a53-0e31-4245-96c0-08b5f4faf116","source":"wordfence","cve":"CVE-2025-25096","title":"RSS in Page <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3621a53-0e31-4245-96c0-08b5f4faf116?source=api-prod","affected":[{"type":"plugin","slug":"rss-in-page","name":"RSS in Page","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:29:29Z"},{"id":"wordfence:b36303d6-ad28-4354-9f60-acc7df15f468","source":"wordfence","cve":"CVE-2023-23889","title":"Quick Paypal Payments <= 5.7.25 - Authenticated (Contributor+) Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b36303d6-ad28-4354-9f60-acc7df15f468?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.25","to_inclusive":true,"patched_in":"5.7.26"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3669af4-06b4-4088-ae23-c167ba65f79c","source":"wordfence","cve":"CVE-2010-4518","title":"WP Safe Search <= 0.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3669af4-06b4-4088-ae23-c167ba65f79c?source=api-prod","affected":[{"type":"plugin","slug":"wp-safe-search","name":"WP Safe Search","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2010-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3678907-c781-4fb4-9add-daf395eb53f4","source":"wordfence","cve":"CVE-2025-39418","title":"RSS Manager <= 0.06 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3678907-c781-4fb4-9add-daf395eb53f4?source=api-prod","affected":[{"type":"plugin","slug":"rss-manager","name":"RSS Manager","from":"*","from_inclusive":true,"to":"0.06","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:50:51Z"},{"id":"wordfence:b36b9b8a-41b0-4b57-92c7-5acebe2b0bae","source":"wordfence","cve":"CVE-2024-3944","title":"WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b36b9b8a-41b0-4b57-92c7-5acebe2b0bae?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-08-28T00:00:00Z","updated":"2025-11-06T15:01:24Z"},{"id":"wordfence:b36e94e4-b1e8-4803-9377-c4d710b029de","source":"wordfence","cve":"CVE-2023-2892","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b36e94e4-b1e8-4803-9377-c4d710b029de?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b37087a4-83b2-4355-89f0-6ff0aa8d0013","source":"wordfence","cve":"CVE-2024-6667","title":"KBucket: Your Curated Content in WordPress <= 4.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37087a4-83b2-4355-89f0-6ff0aa8d0013?source=api-prod","affected":[{"type":"plugin","slug":"kbucket","name":"KBucket: Your Curated Content in WordPress","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2024-08-17T00:00:00Z","updated":"2024-08-23T15:40:57Z"},{"id":"wordfence:b37099ed-153e-4df9-8141-9242ed36859d","source":"wordfence","cve":"CVE-2025-23511","title":"WP-BlackCheck <= 2.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37099ed-153e-4df9-8141-9242ed36859d?source=api-prod","affected":[{"type":"plugin","slug":"wp-blackcheck","name":"WP-BlackCheck","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:55:34Z"},{"id":"wordfence:b372ad3a-0056-45fb-9a0e-7604f4fdf240","source":"wordfence","cve":"CVE-2024-11753","title":"UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b372ad3a-0056-45fb-9a0e-7604f4fdf240?source=api-prod","affected":[{"type":"plugin","slug":"umich-oidc-login","name":"UMich OIDC Login","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:26:17Z","updated":"2025-02-19T07:32:12Z"},{"id":"wordfence:b3758f06-2b69-458f-a7c8-f604f0fbda31","source":"wordfence","cve":"CVE-2021-24727","title":"WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.60 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3758f06-2b69-458f-a7c8-f604f0fbda31?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.60","to_inclusive":false,"patched_in":"6.60"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b37766e2-95d2-4a95-9381-ed65ce09b3d6","source":"wordfence","cve":"CVE-2022-3846","title":"Workreap < 2.6.3 - Insecure Direct Objection Reference to Private Message Disclosure","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37766e2-95d2-4a95-9381-ed65ce09b3d6?source=api-prod","affected":[{"type":"theme","slug":"workreap","name":"Workreap - Freelance Marketplace and Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":false,"patched_in":"2.6.3"}],"published":"2022-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b37a2260-0791-435d-8413-2bf68c388906","source":"wordfence","cve":"CVE-2022-40193","title":"Awesome Filterable Portfolio <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37a2260-0791-435d-8413-2bf68c388906?source=api-prod","affected":[{"type":"plugin","slug":"awesome-filterable-portfolio","name":"Awesome Filterable Portfolio","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b37e0d20-56c8-41dc-8cc0-d75d03e70198","source":"wordfence","cve":"CVE-2026-121796","title":"Add From Server Reloaded <= 5.0.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37e0d20-56c8-41dc-8cc0-d75d03e70198?source=api-prod","affected":[{"type":"plugin","slug":"add-from-server-reloaded","name":"Add From Server Lite","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:12:35Z"},{"id":"wordfence:b37e326a-f7bd-43e9-a0b1-d6da2bc5bc45","source":"wordfence","cve":"CVE-2026-39795","title":"SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37e326a-f7bd-43e9-a0b1-d6da2bc5bc45?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.26.1.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:53:05Z","updated":"2026-10-08T23:32:02Z"},{"id":"wordfence:b37e6b44-810a-49c8-8903-30a9e228027d","source":"wordfence","cve":"CVE-2014-4717","title":"Simple Share Buttons Adder <= 4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37e6b44-810a-49c8-8903-30a9e228027d?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2014-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b37ee395-aad8-4908-b3f7-c9f68ed4a4e6","source":"wordfence","cve":"CVE-2026-12275","title":"Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37ee395-aad8-4908-b3f7-c9f68ed4a4e6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:19:16Z"},{"id":"wordfence:b37fc473-d71e-47d6-b0fe-e323868244f1","source":"wordfence","cve":"CVE-2015-6738","title":"iFrame <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b37fc473-d71e-47d6-b0fe-e323868244f1?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"4.0"}],"published":"2015-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b380283c-0dbb-4d67-9f66-cb7c400c0427","source":"wordfence","cve":"CVE-2023-6971","title":"Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"1.0.8","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-12-22T00:00:00Z","updated":"2024-07-29T21:37:12Z"},{"id":"wordfence:b380b053-9847-48a8-ba12-d07db9df2baf","source":"wordfence","cve":"CVE-2024-12617","title":"WC Price History for Omnibus <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b380b053-9847-48a8-ba12-d07db9df2baf?source=api-prod","affected":[{"type":"plugin","slug":"wc-price-history","name":"WC Price History","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T04:22:47Z"},{"id":"wordfence:b38a69c7-91d4-43be-8650-eb1f0029bd44","source":"wordfence","cve":"CVE-2024-2919","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b38a69c7-91d4-43be-8650-eb1f0029bd44?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.31","to_inclusive":true,"patched_in":"3.2.32"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-23T20:51:40Z"},{"id":"wordfence:b3900e4f-4ae4-4026-89df-b63bd869a763","source":"wordfence","cve":"CVE-2024-1335","title":"ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3900e4f-4ae4-4026-89df-b63bd869a763?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:53:10Z"},{"id":"wordfence:b391f7ca-655b-4028-9711-5bd41f694de3","source":"wordfence","cve":"CVE-2025-60221","title":"Captivate Sync <= 3.0.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b391f7ca-655b-4028-9711-5bd41f694de3?source=api-prod","affected":[{"type":"plugin","slug":"captivatesync-trade","name":"Captivate Sync","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-05-05T00:00:00Z","updated":"2025-11-04T18:12:43Z"},{"id":"wordfence:b3940953-fdd4-4759-8476-a421cfbbbd30","source":"wordfence","cve":"CVE-2025-67581","title":"TrueBooker <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3940953-fdd4-4759-8476-a421cfbbbd30?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:20:32Z"},{"id":"wordfence:b394ee3e-fc1c-40b5-b3c5-a9b5e44a7a14","source":"wordfence","cve":"CVE-2026-108092","title":"Social Media Auto Post & Scheduler <=  9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b394ee3e-fc1c-40b5-b3c5-a9b5e44a7a14?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"9.1.4","to_inclusive":true,"patched_in":"9.1.5"}],"published":"2026-10-14T18:54:10Z","updated":"2026-10-15T07:42:37Z"},{"id":"wordfence:b3992176-1eca-480a-9c80-039346addb7d","source":"wordfence","cve":"CVE-2025-49859","title":"WP Views Counter <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3992176-1eca-480a-9c80-039346addb7d?source=api-prod","affected":[{"type":"plugin","slug":"wpecounter","name":"WP Views Counter","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:20:14Z"},{"id":"wordfence:b399929a-db33-419f-9218-b86ee88a9f1a","source":"wordfence","cve":"CVE-2022-2101","title":"Download Manager <= 3.2.46 - Contributor+ Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.46","to_inclusive":true,"patched_in":"3.2.47"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b39d66de-6d83-4fb5-a78c-c46e4540c48c","source":"wordfence","cve":"CVE-2024-37201","title":"Woocommerce Customers Order History <= 5.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b39d66de-6d83-4fb5-a78c-c46e4540c48c?source=api-prod","affected":[{"type":"plugin","slug":"woo-customers-order-history","name":"Woocommerce Customers Order History","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:39:28Z"},{"id":"wordfence:b39e17c5-711f-4229-90f4-213ea65a190d","source":"wordfence","cve":"CVE-2024-5531","title":"Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b39e17c5-711f-4229-90f4-213ea65a190d?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2024-06-10T20:23:54Z","updated":"2024-06-11T08:32:40Z"},{"id":"wordfence:b39f4467-4764-4850-bdcc-b359a6544b42","source":"wordfence","cve":"CVE-2020-6008","title":"LifterLMS Wordpress Plugin <= 3.37.14 - Arbitrary File Write","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b39f4467-4764-4850-bdcc-b359a6544b42?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"3.37.15","to_inclusive":false,"patched_in":"3.37.15"}],"published":"2020-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3a058d6-ca9e-4241-b6dd-307efa7689ab","source":"wordfence","cve":"CVE-2024-13604","title":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a058d6-ca9e-4241-b6dd-307efa7689ab?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T13:14:41Z","updated":"2025-04-05T01:44:44Z"},{"id":"wordfence:b3a3fe11-76cc-4304-91b7-b9bc61f0ff70","source":"wordfence","cve":"CVE-2024-10847","title":"Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a3fe11-76cc-4304-91b7-b9bc61f0ff70?source=api-prod","affected":[{"type":"theme","slug":"storely","name":"Storely","from":"*","from_inclusive":true,"to":"18","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:54:29Z","updated":"2025-03-18T18:41:32Z"},{"id":"wordfence:b3a4a017-8a1d-400c-940b-f188513d23c2","source":"wordfence","cve":"CVE-2026-81759","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a4a017-8a1d-400c-940b-f188513d23c2?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:59:06Z"},{"id":"wordfence:b3a4ff32-52a8-4bb0-8bf6-536a89d338e9","source":"wordfence","cve":"CVE-2026-120563","title":"WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a4ff32-52a8-4bb0-8bf6-536a89d338e9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.8"}],"published":"2026-09-30T00:00:00Z","updated":"2026-11-03T04:43:09Z"},{"id":"wordfence:b3a58e68-d1f1-4d4f-ac64-bc6cb7dbdbfc","source":"wordfence","cve":"CVE-2026-14782","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a58e68-d1f1-4d4f-ac64-bc6cb7dbdbfc?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-07-16T08:56:49Z","updated":"2026-07-17T12:17:02Z"},{"id":"wordfence:b3a670f7-7eca-4e66-9bc9-3c1e92b0c8d7","source":"wordfence","cve":"CVE-2023-25713","title":"Quick Paypal Payments <= 5.7.25 - Unauthenticated Stored Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a670f7-7eca-4e66-9bc9-3c1e92b0c8d7?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.26","to_inclusive":false,"patched_in":"5.7.26"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3a77b7a-65ad-4334-99c9-92cc79e60bee","source":"wordfence","cve":"CVE-2022-4034","title":"Appointment Hour Booking <= 1.3.72 - CSV Injection","severity":"medium","cvss":5.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a77b7a-65ad-4334-99c9-92cc79e60bee?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.72","to_inclusive":true,"patched_in":"1.3.73"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3a83683-c159-4af1-b3ba-881a107d9ad6","source":"wordfence","cve":"CVE-2022-46820","title":"Joli Table of Contents <= 1.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a83683-c159-4af1-b3ba-881a107d9ad6?source=api-prod","affected":[{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3a84201-6cd8-4528-ae7a-7fd813c8da18","source":"wordfence","cve":"CVE-2024-13801","title":"BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a84201-6cd8-4528-ae7a-7fd813c8da18?source=api-prod","affected":[{"type":"plugin","slug":"bwl-advanced-faq-manager","name":"BWL Advanced FAQ Manager","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T08:21:52Z"},{"id":"wordfence:b3a8f482-3d4d-4a40-8e60-5264a5c71139","source":"wordfence","cve":"CVE-2026-85129","title":"Hoo Companion  1.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a8f482-3d4d-4a40-8e60-5264a5c71139?source=api-prod","affected":[{"type":"plugin","slug":"hoo-companion","name":"Hoo Companion","from":"1.0.2","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:54:09Z"},{"id":"wordfence:b3aa7b27-a335-4f82-a50a-45becdd5ef4e","source":"wordfence","cve":"CVE-2021-24147","title":"Modern Events Calendar Lite <= 5.16.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3aa7b27-a335-4f82-a50a-45becdd5ef4e?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2021-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3abd265-f1b0-49e5-ba50-5af91e855f5f","source":"wordfence","cve":"CVE-2014-4601","title":"Wu-Rating <= 1.0 12319 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3abd265-f1b0-49e5-ba50-5af91e855f5f?source=api-prod","affected":[{"type":"plugin","slug":"wu-rating","name":"Wu-Rating","from":"*","from_inclusive":true,"to":"1.0 12319","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3adfe9e-ebdf-4a50-b60f-03a606a84ec0","source":"wordfence","cve":"CVE-2025-6190","title":"Realty Portal \u2013 Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3adfe9e-ebdf-4a50-b60f-03a606a84ec0?source=api-prod","affected":[{"type":"plugin","slug":"realty-portal-agent","name":"Realty Portal \u2013 Agent","from":"*","from_inclusive":true,"to":"0.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T14:03:27Z","updated":"2025-07-23T02:24:39Z"},{"id":"wordfence:b3ae0e08-5cdc-47ff-b094-3920d56a50f7","source":"wordfence","cve":"CVE-2024-13790","title":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ae0e08-5cdc-47ff-b094-3920d56a50f7?source=api-prod","affected":[{"type":"theme","slug":"minimog","name":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T08:21:59Z"},{"id":"wordfence:b3ae17c3-9f65-4855-aed6-64d3ccb2ff0b","source":"wordfence","cve":"CVE-2026-14197","title":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System < 2.3.1 - Authenticated (Custom role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ae17c3-9f65-4855-aed6-64d3ccb2ff0b?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:29:38Z"},{"id":"wordfence:b3ae93da-57ee-4966-83af-b8c57f9ad7d9","source":"wordfence","cve":"CVE-2026-2324","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ae93da-57ee-4966-83af-b8c57f9ad7d9?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-03-10T11:29:15Z","updated":"2026-03-11T01:22:04Z"},{"id":"wordfence:b3ae99bb-03c3-4869-9314-0dbd76ca25c0","source":"wordfence","cve":"CVE-2024-32505","title":"ElementsKit Elementor addons Lite <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ae99bb-03c3-4869-9314-0dbd76ca25c0?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-04-15T00:00:00Z","updated":"2026-04-15T20:48:43Z"},{"id":"wordfence:b3af900c-4048-4f4f-93e9-c60ca34d015b","source":"wordfence","cve":"CVE-2019-25148","title":"WP HTML Mail < 2.9.1 - HTML Injection","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3af900c-4048-4f4f-93e9-c60ca34d015b?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-mail","name":"Email Template Designer \u2013 WP HTML Mail","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":false,"patched_in":"2.9.1"}],"published":"2019-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3b0fa3c-ec17-49a3-a00c-a2b22df16964","source":"wordfence","cve":"CVE-2024-54209","title":"Awesome Shortcodes <= 1.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b0fa3c-ec17-49a3-a00c-a2b22df16964?source=api-prod","affected":[{"type":"plugin","slug":"awesome-shortcodes","name":"Awesome Shortcodes","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-12-02T00:00:00Z","updated":"2025-03-10T14:26:08Z"},{"id":"wordfence:b3b23544-71de-4da8-9fd5-6d9ef995ad7b","source":"wordfence","cve":"CVE-2024-2235","title":"Himer <= 2.1.0 - Cross-Site Request Forgery to Poll Voting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b23544-71de-4da8-9fd5-6d9ef995ad7b?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T18:33:07Z"},{"id":"wordfence:b3b39055-aa2a-4db8-838b-e4baaea105b4","source":"wordfence","cve":"CVE-2021-39310","title":"Real WYSIWYG <= 0.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b39055-aa2a-4db8-838b-e4baaea105b4?source=api-prod","affected":[{"type":"plugin","slug":"real-wysiwyg","name":"Real WYSIWYG","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3b40b73-4dec-4a96-a634-3bd3d74616ba","source":"wordfence","cve":"CVE-2024-11766","title":"WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b40b73-4dec-4a96-a634-3bd3d74616ba?source=api-prod","affected":[{"type":"plugin","slug":"gs-books-showcase","name":"GS Books Showcase \u2013 Book Library, Book Grid & Book Slider for Authors","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:b3b62264-35f2-49a5-8abe-ec5d6c8d2c2c","source":"wordfence","cve":"CVE-2024-54401","title":"Advanced Fancybox <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b62264-35f2-49a5-8abe-ec5d6c8d2c2c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-fancybox","name":"Advanced Fancybox","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:40:58Z"},{"id":"wordfence:b3b658f0-b9d8-4b7f-8d40-39ce185ef797","source":"wordfence","cve":"CVE-2025-2010","title":"JobWP \u2013 Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b658f0-b9d8-4b7f-8d40-39ce185ef797?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T02:22:35Z"},{"id":"wordfence:b3b9ccb1-3854-4aa6-9f03-ff7f861ecc14","source":"wordfence","cve":"CVE-2012-0934","title":"Theme Tuner < 0.8 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b9ccb1-3854-4aa6-9f03-ff7f861ecc14?source=api-prod","affected":[{"type":"plugin","slug":"theme-tuner","name":"Theme Tuner","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":false,"patched_in":"0.8"}],"published":"2012-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3bae191-9395-481c-93bf-b17cf5f87271","source":"wordfence","cve":"","title":"Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3bae191-9395-481c-93bf-b17cf5f87271?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.9.1"}],"published":"2020-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3bb31c8-b1d9-4189-a27f-ac62d19532b2","source":"wordfence","cve":"CVE-2025-47559","title":"MapSVG < 8.7.4 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3bb31c8-b1d9-4189-a27f-ac62d19532b2?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.7.4","to_inclusive":false,"patched_in":"8.7.4"}],"published":"2025-06-12T00:00:00Z","updated":"2026-02-26T15:12:40Z"},{"id":"wordfence:b3c070be-e955-4076-9878-0b1044766397","source":"wordfence","cve":"CVE-2024-0703","title":"Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c070be-e955-4076-9878-0b1044766397?source=api-prod","affected":[{"type":"plugin","slug":"sticky-buttons","name":"Sticky Buttons \u2013 Floating Buttons Builder","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-22T00:00:00Z","updated":"2024-07-29T21:37:13Z"},{"id":"wordfence:b3c12fdf-347c-4cec-b98c-a29ec8c0aff7","source":"wordfence","cve":"CVE-2026-57686","title":"Product Addons and Product Options With Custom Fields \u2013 WowAddons <= 1.6.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c12fdf-347c-4cec-b98c-a29ec8c0aff7?source=api-prod","affected":[{"type":"plugin","slug":"product-addons","name":"WowAddons \u2013 Product Addons and Product Options With Custom Fields","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"1.6.15"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:03:25Z"},{"id":"wordfence:b3c13c92-0354-436f-ab41-9d8caddd3f4f","source":"wordfence","cve":"CVE-2026-81279","title":"Push Notification for Post and BuddyPress <= 3.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c13c92-0354-436f-ab41-9d8caddd3f4f?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"3.20","to_inclusive":true,"patched_in":"3.21"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T20:46:13Z"},{"id":"wordfence:b3c15924-d430-48e3-9804-fa83605b9c24","source":"wordfence","cve":"CVE-2025-12898","title":"Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c15924-d430-48e3-9804-fa83605b9c24?source=api-prod","affected":[{"type":"plugin","slug":"pretty-google-calendar","name":"Pretty Google Calendar","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-12-19T15:06:58Z","updated":"2026-01-06T17:03:31Z"},{"id":"wordfence:b3c17ba3-4fc8-439c-8ce3-bd95d7ed2474","source":"wordfence","cve":"CVE-2024-0868","title":"coreActivity <= 2.0.1 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c17ba3-4fc8-439c-8ce3-bd95d7ed2474?source=api-prod","affected":[{"type":"plugin","slug":"coreactivity","name":"coreActivity: Activity Logging for WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-25T13:46:07Z"},{"id":"wordfence:b3c1edd7-2421-4dfa-8775-ca0497759d52","source":"wordfence","cve":"CVE-2026-2296","title":"Product Addons for Woocommerce \u2013 Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c1edd7-2421-4dfa-8775-ca0497759d52?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-product-addons","name":"Product Addons for Woocommerce \u2013 Product Options with Custom Fields","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-02-17T18:40:15Z","updated":"2026-02-18T06:42:43Z"},{"id":"wordfence:b3c232b4-7c30-413b-83ff-49f47dc28117","source":"wordfence","cve":"CVE-2025-58198","title":"Xpro Theme Builder <= 1.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c232b4-7c30-413b-83ff-49f47dc28117?source=api-prod","affected":[{"type":"plugin","slug":"xpro-theme-builder","name":"Xpro Theme Builder For Elementor \u2013 FREE","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:35:35Z"},{"id":"wordfence:b3c3115b-8921-429d-b517-b946edab1cd5","source":"wordfence","cve":"CVE-2023-6697","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c3115b-8921-429d-b517-b946edab1cd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.28","to_inclusive":true,"patched_in":"9.0.29"}],"published":"2024-01-23T00:00:00Z","updated":"2024-07-29T21:37:13Z"},{"id":"wordfence:b3c511a5-3c2b-40c0-b3d1-bb7c83c67513","source":"wordfence","cve":"CVE-2017-15810","title":"PopCash Code Integration Tool < 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c511a5-3c2b-40c0-b3d1-bb7c83c67513?source=api-prod","affected":[{"type":"plugin","slug":"popcashnet-code-integration-tool","name":"PopCash Code Integration Tool","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2017-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3c5fe0b-8a22-4df2-9adf-b6a7fe1a8a8c","source":"wordfence","cve":"CVE-2026-6831","title":"Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c5fe0b-8a22-4df2-9adf-b6a7fe1a8a8c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-09-22T17:36:08Z","updated":"2026-09-23T06:42:05Z"},{"id":"wordfence:b3c65619-e96c-47e1-b42a-a85d0b5237d9","source":"wordfence","cve":"CVE-2019-19110","title":"wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c65619-e96c-47e1-b42a-a85d0b5237d9?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2020-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3c6ba21-7631-4bbd-b08e-926d2f129cc3","source":"wordfence","cve":"CVE-2024-34383","title":"SEOPress <= 7.6.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c6ba21-7631-4bbd-b08e-926d2f129cc3?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.7"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:20:22Z"},{"id":"wordfence:b3c84ad1-10c7-4b2f-82f3-7546fc8e337d","source":"wordfence","cve":"CVE-2025-7660","title":"Map My Locations <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c84ad1-10c7-4b2f-82f3-7546fc8e337d?source=api-prod","affected":[{"type":"plugin","slug":"map-my-locations","name":"Map My Locations","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:20:11Z","updated":"2025-07-18T04:23:02Z"},{"id":"wordfence:b3c96e57-0300-4ea7-a0c6-5d060b6e979d","source":"wordfence","cve":"CVE-2026-6700","title":"DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c96e57-0300-4ea7-a0c6-5d060b6e979d?source=api-prod","affected":[{"type":"plugin","slug":"dx-sources","name":"DX Sources","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:06:52Z","updated":"2026-05-05T02:26:56Z"},{"id":"wordfence:b3cc372f-7696-48a6-9664-c43d9c07fb2c","source":"wordfence","cve":"CVE-2024-51695","title":"Fabrica Synced Pattern Instances <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cc372f-7696-48a6-9664-c43d9c07fb2c?source=api-prod","affected":[{"type":"plugin","slug":"fabrica-reusable-block-instances","name":"Fabrica Synced Pattern Instances","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-15T15:39:39Z"},{"id":"wordfence:b3cc3835-25f5-43b3-82be-397b8b3bd369","source":"wordfence","cve":"CVE-2025-9987","title":"Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cc3835-25f5-43b3-82be-397b8b3bd369?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.53.1","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-05-12T15:29:58Z","updated":"2026-05-13T04:26:45Z"},{"id":"wordfence:b3ce53e5-8666-4227-83d3-58f35db0ce68","source":"wordfence","cve":"CVE-2024-11816","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ce53e5-8666-4227-83d3-58f35db0ce68?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T14:13:59Z"},{"id":"wordfence:b3cf9f38-c20e-40dc-a7a1-65b0c6ba7925","source":"wordfence","cve":"CVE-2023-2437","title":"UserPro <= 5.1.1 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3cf9f38-c20e-40dc-a7a1-65b0c6ba7925?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3d27929-1955-4700-95b3-a6d399bf7cee","source":"wordfence","cve":"CVE-2024-51686","title":"Manage User Columns <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d27929-1955-4700-95b3-a6d399bf7cee?source=api-prod","affected":[{"type":"plugin","slug":"manage-user-columns","name":"Manage User Columns","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:49:57Z"},{"id":"wordfence:b3d48aca-3db5-4585-bd71-5548f3b36ea1","source":"wordfence","cve":"CVE-2023-50845","title":"GeoDirectory <= 2.3.28 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d48aca-3db5-4585-bd71-5548f3b36ea1?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.29","to_inclusive":false,"patched_in":"2.3.29"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3d4f658-e9ce-490b-bcaa-1061a463dbb2","source":"wordfence","cve":"","title":"Premmerce Redirect Manager <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d4f658-e9ce-490b-bcaa-1061a463dbb2?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-redirect-manager","name":"Premmerce Redirect Manager","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":false,"patched_in":"1.0.12"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3d71289-e5a3-4145-817f-c2cac8405202","source":"wordfence","cve":"CVE-2024-29776","title":"EventPrime <= 3.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d71289-e5a3-4145-817f-c2cac8405202?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:57:09Z"},{"id":"wordfence:b3d9549d-4d75-4b6a-90e2-4d403731d78f","source":"wordfence","cve":"CVE-2016-1000217","title":"Zotpress < 6.1.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d9549d-4d75-4b6a-90e2-4d403731d78f?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":false,"patched_in":"6.1.3"}],"published":"2016-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3d9af8b-1168-462d-a767-d16ee660f646","source":"wordfence","cve":"CVE-2024-11688","title":"LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d9af8b-1168-462d-a767-d16ee660f646?source=api-prod","affected":[{"type":"plugin","slug":"latex2html","name":"LaTeX2HTML","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-12-20T20:38:22Z","updated":"2025-01-14T15:20:53Z"},{"id":"wordfence:b3d9b755-1e6e-44ac-989a-201237f6dc9f","source":"wordfence","cve":"CVE-2024-10854","title":"Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3d9b755-1e6e-44ac-989a-201237f6dc9f?source=api-prod","affected":[{"type":"plugin","slug":"buy-one-click-woocommerce","name":"Buy one click for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-11-12T00:00:00Z","updated":"2026-09-24T14:47:01Z"},{"id":"wordfence:b3da58a5-3b07-4c53-ae20-35b3d7750023","source":"wordfence","cve":"CVE-2024-34434","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3da58a5-3b07-4c53-ae20-35b3d7750023?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.2","to_inclusive":true,"patched_in":"1.3.3.3"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:11:49Z"},{"id":"wordfence:b3db2be5-a9d2-4bc0-a8cf-d67da024c0e6","source":"wordfence","cve":"CVE-2024-51578","title":"3D Presentation <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3db2be5-a9d2-4bc0-a8cf-d67da024c0e6?source=api-prod","affected":[{"type":"plugin","slug":"3d-presentation","name":"3D Presentation","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:32:00Z"},{"id":"wordfence:b3dbe34e-7961-4a08-b5d9-86b727cbf5f5","source":"wordfence","cve":"CVE-2026-27412","title":"Pearl - Corporate Business <= 3.4.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3dbe34e-7961-4a08-b5d9-86b727cbf5f5?source=api-prod","affected":[{"type":"theme","slug":"pearl","name":"pearl","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:52:57Z"},{"id":"wordfence:b3e00e40-cdbb-469f-89ec-6a28bf2014fd","source":"wordfence","cve":"CVE-2026-59553","title":"Product Feed Manager For WooCommerce \u2013 Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e00e40-cdbb-469f-89ec-6a28bf2014fd?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.6.2"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-27T15:36:30Z"},{"id":"wordfence:b3e03668-c9ee-4c4b-8240-998ef45a5326","source":"wordfence","cve":"CVE-2023-6113","title":"WP STAGING WordPress Backup Plugin Free <= 3.1.2 and Pro <= 5.1.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e03668-c9ee-4c4b-8240-998ef45a5326?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"},{"type":"plugin","slug":"wp-staging-pro","name":"WP STAGING Pro WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":false,"patched_in":"5.1.3"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3e12653-ddfe-4e02-9d9e-0263b9f71def","source":"wordfence","cve":"CVE-2022-4708","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3e149dd-636e-47ce-9ade-e1ae337612da","source":"wordfence","cve":"CVE-2022-38067","title":"Event Calendar <= 1.4.6 - Missing Authorization to Event Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e149dd-636e-47ce-9ade-e1ae337612da?source=api-prod","affected":[{"type":"plugin","slug":"calendar-event","name":"Event Calendar \u2013 Calendar","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3e20ad5-6279-4585-924f-c7289e7dc753","source":"wordfence","cve":"CVE-2026-19050","title":"ProSolution WP Client <= 2.0.8 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e20ad5-6279-4585-924f-c7289e7dc753?source=api-prod","affected":[{"type":"plugin","slug":"prosolution-wp-client","name":"ProSolution WP Client","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:35:16Z"},{"id":"wordfence:b3e45a17-cb41-41ba-ab6c-c83202f0ecfd","source":"wordfence","cve":"CVE-2026-4038","title":"Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e45a17-cb41-41ba-ab6c-c83202f0ecfd?source=api-prod","affected":[{"type":"plugin","slug":"aimogen-pro","name":"Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-03-19T15:13:07Z","updated":"2026-03-20T03:37:02Z"},{"id":"wordfence:b3e89a1c-7606-4391-a389-fa18d0967046","source":"wordfence","cve":"CVE-2025-13595","title":"CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e89a1c-7606-4391-a389-fa18d0967046?source=api-prod","affected":[{"type":"plugin","slug":"cibeles-ai","name":"CIBELES AI","from":"*","from_inclusive":true,"to":"1.10.8","to_inclusive":true,"patched_in":"1.10.9"}],"published":"2025-11-25T09:39:40Z","updated":"2025-11-25T22:28:36Z"},{"id":"wordfence:b3e95dc2-0f50-4009-9cc0-a02f9977ce58","source":"wordfence","cve":"CVE-2026-5717","title":"VI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e95dc2-0f50-4009-9cc0-a02f9977ce58?source=api-prod","affected":[{"type":"plugin","slug":"vi-include-post-by","name":"VI: Include Post By","from":"*","from_inclusive":true,"to":"0.4.200706","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:45:02Z","updated":"2026-04-15T07:45:29Z"},{"id":"wordfence:b3ea0b6a-000c-48cc-bee6-df14edb3672e","source":"wordfence","cve":"CVE-2026-81282","title":"Product Variations Swatches for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ea0b6a-000c-48cc-bee6-df14edb3672e?source=api-prod","affected":[{"type":"plugin","slug":"product-variations-swatches-for-woocommerce","name":"Choosly \u2013 Product Variations Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:33:19Z"},{"id":"wordfence:b3ea5e75-9b6a-4710-bb2c-458c2a924bb0","source":"wordfence","cve":"","title":"ThinkIT WP Contact Form < 0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ea5e75-9b6a-4710-bb2c-458c2a924bb0?source=api-prod","affected":[{"type":"plugin","slug":"thinkit-wp-contact-form","name":"ThinkIT WP Contact Form","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":false,"patched_in":"0.3"}],"published":"2013-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3ece4c3-1f05-4f2d-ba2a-50327106f0fa","source":"wordfence","cve":"CVE-2025-25070","title":"Album Reviewer <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ece4c3-1f05-4f2d-ba2a-50327106f0fa?source=api-prod","affected":[{"type":"plugin","slug":"albumreviewer","name":"Album Reviewer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:12:16Z"},{"id":"wordfence:b3ecec49-9185-409e-8dd8-1363bdbfdd04","source":"wordfence","cve":"CVE-2025-30913","title":"Access Areas <= 1.5.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ecec49-9185-409e-8dd8-1363bdbfdd04?source=api-prod","affected":[{"type":"plugin","slug":"wp-access-areas","name":"Access Areas for WordPress","from":"*","from_inclusive":true,"to":"1.5.19","to_inclusive":true,"patched_in":"1.5.20"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:48:59Z"},{"id":"wordfence:b3eee437-e65e-461e-9350-c89f21171e3c","source":"wordfence","cve":"CVE-2014-10021","title":"WP Symposium <= 14.11 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3eee437-e65e-461e-9350-c89f21171e3c?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"14.11","to_inclusive":true,"patched_in":"15.1"}],"published":"2014-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3f2c4c3-73d6-4b3b-8eb3-c494f52dc183","source":"wordfence","cve":"CVE-2023-3125","title":"B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f2c4c3-73d6-4b3b-8eb3-c494f52dc183?source=api-prod","affected":[{"type":"plugin","slug":"b2bking-wholesale-for-woocommerce","name":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More","from":"*","from_inclusive":true,"to":"4.6.00","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3f49046-d438-4c1b-803b-dba77dc28e95","source":"wordfence","cve":"CVE-2025-31030","title":"Ray Enterprise Translation <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f49046-d438-4c1b-803b-dba77dc28e95?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-04-10T00:00:00Z","updated":"2025-08-05T13:04:45Z"},{"id":"wordfence:b3f666a3-6287-4c9b-94d3-7bc457701af2","source":"wordfence","cve":"CVE-2024-12466","title":"Proofreading <= 1.2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f666a3-6287-4c9b-94d3-7bc457701af2?source=api-prod","affected":[{"type":"plugin","slug":"proofreading","name":"Proofreading","from":"*","from_inclusive":true,"to":"1.2.1.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-01-16T18:27:35Z","updated":"2025-01-17T07:01:29Z"},{"id":"wordfence:b3f75424-b9f3-42ee-a96c-ff0ed30cbd2f","source":"wordfence","cve":"","title":"WPS Limit Login < 1.4.6.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f75424-b9f3-42ee-a96c-ff0ed30cbd2f?source=api-prod","affected":[{"type":"plugin","slug":"wps-limit-login","name":"WPS Limit Login","from":"*","from_inclusive":true,"to":"1.4.6.1","to_inclusive":false,"patched_in":"1.4.6.1"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3f7a88c-a09b-46ac-b345-139c2d20a3d2","source":"wordfence","cve":"CVE-2023-6114","title":"Duplicator <= 1.5.7 AND Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Information Exposure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f7a88c-a09b-46ac-b345-139c2d20a3d2?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"4.5.14.2","to_inclusive":false,"patched_in":"4.5.14.2"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.7.1"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3f87bd6-b432-4bf8-9046-8d66b45f6a85","source":"wordfence","cve":"CVE-2023-50886","title":"Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f87bd6-b432-4bf8-9046-8d66b45f6a85?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":false,"patched_in":"1.3.8"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b3fd57f3-f168-4a21-b6cd-f5214f047578","source":"wordfence","cve":"CVE-2025-47513","title":"Infocob CRM Forms <= 2.4.0 - Authenticated (Editor+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3fd57f3-f168-4a21-b6cd-f5214f047578?source=api-prod","affected":[{"type":"plugin","slug":"infocob-crm-forms","name":"Infocob CRM Forms","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-28T15:13:54Z"},{"id":"wordfence:b3fef149-a087-4ce3-9802-cf0c12f13885","source":"wordfence","cve":"CVE-2025-39600","title":"Integration for WooCommerce and QuickBooks <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3fef149-a087-4ce3-9802-cf0c12f13885?source=api-prod","affected":[{"type":"plugin","slug":"wp-woocommerce-quickbooks","name":"Integration for WooCommerce and QuickBooks","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:00:42Z"},{"id":"wordfence:b3ff4379-81f6-4c58-8658-2bd2a26883d1","source":"wordfence","cve":"CVE-2026-27358","title":"Architecturer < 3.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3ff4379-81f6-4c58-8658-2bd2a26883d1?source=api-prod","affected":[{"type":"theme","slug":"architecturer","name":"Architecturer WordPress for Interior Designer","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.5"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:38:44Z"},{"id":"wordfence:b40070af-3f2c-4bd1-bd33-1a0aa37c6e62","source":"wordfence","cve":"CVE-2024-29774","title":"WP Directory Kit <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b40070af-3f2c-4bd1-bd33-1a0aa37c6e62?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:33:46Z"},{"id":"wordfence:b40177a3-e4d1-4025-9071-856537dc78eb","source":"wordfence","cve":"CVE-2025-49036","title":"Premium Addons for KingComposer <= 1.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b40177a3-e4d1-4025-9071-856537dc78eb?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-kingcomposer","name":"Premium Addons for KingComposer","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-18T15:58:00Z"},{"id":"wordfence:b403b1f3-cc04-48fb-b2ae-c6c234fad29f","source":"wordfence","cve":"CVE-2020-25033","title":"Subscribe Sidebar plugin by Blubrry <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b403b1f3-cc04-48fb-b2ae-c6c234fad29f?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-sidebar","name":"Subscribe Sidebar plugin by Blubrry","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b404c6c4-cc05-4040-b96a-7be750020acc","source":"wordfence","cve":"","title":"SW Ajax WooCommerce Search <= 1.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b404c6c4-cc05-4040-b96a-7be750020acc?source=api-prod","affected":[{"type":"plugin","slug":"sw_ajax_woocommerce_search","name":"SW Ajax WooCommerce Search","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2020-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b405b5cb-b330-4bd6-87bd-fa97ded58460","source":"wordfence","cve":"CVE-2025-7431","title":"Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b405b5cb-b330-4bd6-87bd-fa97ded58460?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-07-17T11:39:27Z","updated":"2025-07-18T01:44:06Z"},{"id":"wordfence:b406f0b8-16b5-49ca-88d8-7717bef1ae61","source":"wordfence","cve":"CVE-2024-8989","title":"Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b406f0b8-16b5-49ca-88d8-7717bef1ae61?source=api-prod","affected":[{"type":"plugin","slug":"stars-testimonials-with-slider-and-masonry-grid","name":"Stars Testimonials \u2014 Responsive Reviews & Star Ratings","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2024-09-30T19:04:16Z","updated":"2024-10-01T07:30:20Z"},{"id":"wordfence:b4080bb7-9197-4c93-bcb1-cf7b5833771a","source":"wordfence","cve":"","title":"Dean's FCKEditor <= 1.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4080bb7-9197-4c93-bcb1-cf7b5833771a?source=api-prod","affected":[{"type":"plugin","slug":"deans-fckeditor-with-pwwangs-code-plugin-for-wordpress","name":"Dean's FCKEditor","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2012-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4085834-3865-4b9e-9497-f14e6e32554b","source":"wordfence","cve":"CVE-2026-120658","title":"Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4085834-3865-4b9e-9497-f14e6e32554b?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"6.0.0","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2026-11-12T20:48:27Z","updated":"2026-11-13T09:35:14Z"},{"id":"wordfence:b409d2a5-3c4c-4a1e-b222-e2df7257b81f","source":"wordfence","cve":"CVE-2023-4797","title":"Newsletter Lite <= 4.9.2 - Authenticated (Admin+) Command Injection","severity":"medium","cvss":6.6,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b409d2a5-3c4c-4a1e-b222-e2df7257b81f?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2023-10-05T00:00:00Z","updated":"2024-02-07T13:40:26Z"},{"id":"wordfence:b409ef44-18fa-4ea0-90a4-69e03fa0116e","source":"wordfence","cve":"CVE-2024-13676","title":"Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b409ef44-18fa-4ea0-90a4-69e03fa0116e?source=api-prod","affected":[{"type":"plugin","slug":"categorized-gallery","name":"Categorized Gallery Plugin","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:22:55Z","updated":"2025-02-19T07:32:12Z"},{"id":"wordfence:b40a40d1-d12f-4fe6-b155-83a1f1a5a494","source":"wordfence","cve":"CVE-2022-4571","title":"Seriously Simple Podcasting <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b40a40d1-d12f-4fe6-b155-83a1f1a5a494?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"2.19.0","to_inclusive":true,"patched_in":"2.19.1"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b40c89e5-d291-45b7-b84a-6fee75e5b7eb","source":"wordfence","cve":"","title":"Ajax Store Locator <= 1.2 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b40c89e5-d291-45b7-b84a-6fee75e5b7eb?source=api-prod","affected":[{"type":"plugin","slug":"ajax-store-locator","name":"AJAX Store Locator","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b40e70ed-cdcb-4999-92a9-45bbd2515a3d","source":"wordfence","cve":"CVE-2024-32712","title":"Podlove Podcast Publisher <= 4.0.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b40e70ed-cdcb-4999-92a9-45bbd2515a3d?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"4.0.15"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:56:56Z"},{"id":"wordfence:b411a97b-2f1c-4feb-b1c7-bc5a1aab7f33","source":"wordfence","cve":"CVE-2024-1777","title":"Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b411a97b-2f1c-4feb-b1c7-bc5a1aab7f33?source=api-prod","affected":[{"type":"plugin","slug":"admin-side-data-storage-for-contact-form-7","name":"Admin side data storage for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T06:48:18Z"},{"id":"wordfence:b412f60f-61ea-47b1-a3ef-17275f7951df","source":"wordfence","cve":"CVE-2026-15981","title":"SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b412f60f-61ea-47b1-a3ef-17275f7951df?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2026-07-23T08:24:20Z","updated":"2026-07-23T20:33:51Z"},{"id":"wordfence:b415f998-b0e5-4f22-817c-02bfdc0c405d","source":"wordfence","cve":"CVE-2025-28895","title":"Custom top bar <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b415f998-b0e5-4f22-817c-02bfdc0c405d?source=api-prod","affected":[{"type":"plugin","slug":"custom-top-bar","name":"Custom top bar","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:54:25Z"},{"id":"wordfence:b41a91fc-86ee-4795-acb6-2ffd22c4f7af","source":"wordfence","cve":"CVE-2022-4321","title":"PDF Generator for Wordpress <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b41a91fc-86ee-4795-acb6-2ffd22c4f7af?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-for-wp","name":"PDF Generator for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b42178a9-2f73-48d2-a912-50efe0bec76e","source":"wordfence","cve":"CVE-2025-26977","title":"Filebird <= 6.4.2.1 - Authenticated (Author+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42178a9-2f73-48d2-a912-50efe0bec76e?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.4.2.1","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:24:56Z"},{"id":"wordfence:b421d80f-408e-4fb0-9894-b7e5707d8d5f","source":"wordfence","cve":"CVE-2024-54212","title":"Magical Addons For Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b421d80f-408e-4fb0-9894-b7e5707d8d5f?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-12-02T00:00:00Z","updated":"2025-05-08T18:14:23Z"},{"id":"wordfence:b424f25d-66c7-4c1b-9712-7b857806f7e4","source":"wordfence","cve":"CVE-2026-14943","title":"Password Protected <= 2.8.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b424f25d-66c7-4c1b-9712-7b857806f7e4?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:33:02Z"},{"id":"wordfence:b4279f8e-133a-40ef-ad28-3688b949201d","source":"wordfence","cve":"CVE-2026-125849","title":"Shk Corporate <= 2.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4279f8e-133a-40ef-ad28-3688b949201d?source=api-prod","affected":[{"type":"theme","slug":"shk-corporate","name":"Shk Corporate","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:08Z"},{"id":"wordfence:b42882f6-ccea-4d8f-940b-1ad95b1ab760","source":"wordfence","cve":"CVE-2022-1470","title":"Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42882f6-ccea-4d8f-940b-1ad95b1ab760?source=api-prod","affected":[{"type":"plugin","slug":"simple-woocommerce-csv-loader","name":"Ultimate WooCommerce CSV Importer","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b42be363-30b4-487b-9ffc-bfa3efbd1250","source":"wordfence","cve":"CVE-2022-0710","title":"Header Footer Code Manager <= 1.1.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42be363-30b4-487b-9ffc-bfa3efbd1250?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-code-manager","name":"Header Footer Code Manager","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2022-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b42c0e51-676f-4f06-9e5c-b6b74bea89b5","source":"wordfence","cve":"","title":"WP-TopBar <= 3.04 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42c0e51-676f-4f06-9e5c-b6b74bea89b5?source=api-prod","affected":[{"type":"plugin","slug":"wp-topbar","name":"WP-TopBar","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b42f1f71-e272-48d4-9b3f-4360b287e16f","source":"wordfence","cve":"CVE-2026-19798","title":"WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42f1f71-e272-48d4-9b3f-4360b287e16f?source=api-prod","affected":[{"type":"plugin","slug":"wp-map-block","name":"WP Map Block \u2013 Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-10-15T17:37:39Z","updated":"2026-10-16T06:41:06Z"},{"id":"wordfence:b4309271-f93a-46ac-8b0b-d6193487ac98","source":"wordfence","cve":"CVE-2015-2069","title":"WooCommerce <= 2.2.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4309271-f93a-46ac-8b0b-d6193487ac98?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":false,"patched_in":"2.2.11"}],"published":"2015-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4334a69-5e50-4efe-8386-f61b5f2af4b6","source":"wordfence","cve":"CVE-2026-12395","title":"Job Portal <= 2.5.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4334a69-5e50-4efe-8386-f61b5f2af4b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T22:37:45Z"},{"id":"wordfence:b43371a6-bcb5-4418-b5a5-85879775010c","source":"wordfence","cve":"CVE-2024-7651","title":"App Builder \u2013 Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search","severity":"medium","cvss":5.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b43371a6-bcb5-4418-b5a5-85879775010c?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2024-08-20T17:24:24Z","updated":"2024-08-23T14:26:54Z"},{"id":"wordfence:b4347123-83a9-46be-9216-759906531d73","source":"wordfence","cve":"CVE-2025-62749","title":"User Specific Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4347123-83a9-46be-9216-759906531d73?source=api-prod","affected":[{"type":"plugin","slug":"user-specific-content","name":"User Specific Content","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:34:09Z"},{"id":"wordfence:b4363600-666a-4a75-a817-4af679ab400c","source":"wordfence","cve":"CVE-2023-39994","title":"ARMember Premium <= 5.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4363600-666a-4a75-a817-4af679ab400c?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"5.9.2","to_inclusive":true,"patched_in":"5.9.3"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b437020c-31a3-413e-a1da-b4781da34f10","source":"wordfence","cve":"CVE-2024-0239","title":"Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b437020c-31a3-413e-a1da-b4781da34f10?source=api-prod","affected":[{"type":"plugin","slug":"ari-cf7-connector","name":"Contact Form 7 Connector","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T00:49:54Z"},{"id":"wordfence:b43a61f4-2d1c-47ce-ae0d-a5969bdb43f1","source":"wordfence","cve":"CVE-2024-49302","title":"WordPress Portfolio Builder \u2013 Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b43a61f4-2d1c-47ce-ae0d-a5969bdb43f1?source=api-prod","affected":[{"type":"plugin","slug":"uber-grid","name":"WordPress Portfolio Builder \u2013 Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T18:01:42Z"},{"id":"wordfence:b43ab8c8-8462-406d-9c06-49e2092f73e4","source":"wordfence","cve":"CVE-2026-76557","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b43ab8c8-8462-406d-9c06-49e2092f73e4?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:28:02Z"},{"id":"wordfence:b43d0a35-c167-4c23-9a7e-2f7e2adef5e2","source":"wordfence","cve":"CVE-2026-108168","title":"Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b43d0a35-c167-4c23-9a7e-2f7e2adef5e2?source=api-prod","affected":[{"type":"plugin","slug":"post-type-archive-mapping","name":"Custom Query Blocks","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-10-12T08:22:00Z","updated":"2026-10-13T14:03:23Z"},{"id":"wordfence:b44a4d74-5c2b-454a-992a-74a3a71fa5dd","source":"wordfence","cve":"CVE-2007-4483","title":"Classic <= 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b44a4d74-5c2b-454a-992a-74a3a71fa5dd?source=api-prod","affected":[{"type":"theme","slug":"classic","name":"Classic","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2007-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b44b3cf5-a976-407f-b23b-4b7448a18263","source":"wordfence","cve":"CVE-2025-22315","title":"Typing Text <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b44b3cf5-a976-407f-b23b-4b7448a18263?source=api-prod","affected":[{"type":"plugin","slug":"typing-text","name":"Typing Text","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-01-06T00:00:00Z","updated":"2026-09-09T15:50:28Z"},{"id":"wordfence:b44e6c52-9b17-4d4c-910f-20f49262afde","source":"wordfence","cve":"CVE-2025-23968","title":"Graphina <= 3.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b44e6c52-9b17-4d4c-910f-20f49262afde?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-11T13:52:00Z"},{"id":"wordfence:b44ef21f-464e-487a-ba5a-fe889e4c488c","source":"wordfence","cve":"CVE-2023-47505","title":"Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b44ef21f-464e-487a-ba5a-fe889e4c488c?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.16.4","to_inclusive":true,"patched_in":"3.16.5"}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4503e2c-0d0d-45de-a597-baace44a98a7","source":"wordfence","cve":"CVE-2024-12633","title":"JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4503e2c-0d0d-45de-a597-baace44a98a7?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"5.6.18"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T05:23:58Z"},{"id":"wordfence:b4521959-416e-4ff5-96c0-bc4dbb0187b7","source":"wordfence","cve":"CVE-2024-11823","title":"Folder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4521959-416e-4ff5-96c0-bc4dbb0187b7?source=api-prod","affected":[{"type":"plugin","slug":"folder-gallery","name":"Folder Gallery","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:50:30Z","updated":"2024-12-06T08:25:00Z"},{"id":"wordfence:b452fcc8-1359-439c-a255-91054c83d6aa","source":"wordfence","cve":"CVE-2024-53814","title":"Analytify <= 5.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b452fcc8-1359-439c-a255-91054c83d6aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T19:44:10Z"},{"id":"wordfence:b4533554-52e4-44b4-9230-b6e3feb2e4a1","source":"wordfence","cve":"CVE-2023-34375","title":"Seo By 10Web <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4533554-52e4-44b4-9230-b6e3feb2e4a1?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-10web","name":"SEO by 10Web","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4540b21-ef63-4cd2-b605-c66a7b76934f","source":"wordfence","cve":"CVE-2024-53745","title":"\uc18c\uc15c \uacf5\uc720 \ubc84\ud2bc By \ucf54\uc2a4\ubaa8\uc2a4\ud31c <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4540b21-ef63-4cd2-b605-c66a7b76934f?source=api-prod","affected":[{"type":"plugin","slug":"cosmosfarm-share-buttons","name":"\uc18c\uc15c \uacf5\uc720 \ubc84\ud2bc By \ucf54\uc2a4\ubaa8\uc2a4\ud31c","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:42:39Z"},{"id":"wordfence:b4570948-1625-44b3-8af6-73765d9710ee","source":"wordfence","cve":"CVE-2023-28421","title":"WordPress Email Marketing Plugin \u2013 WP Email Capture <= 3.10 - Information Exposure via wp_email_capture_options_process","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4570948-1625-44b3-8af6-73765d9710ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-capture","name":"Email Marketing Plugin \u2013 WP Email Capture","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b457db06-84c8-4b7b-b7c1-091771a11a35","source":"wordfence","cve":"CVE-2025-32537","title":"Lock Your Updates <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b457db06-84c8-4b7b-b7c1-091771a11a35?source=api-prod","affected":[{"type":"plugin","slug":"lock-your-updates","name":"Lock Your Updates Plugins/Themes Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:11:52Z"},{"id":"wordfence:b4595eed-ce5d-42f1-979e-cc37350d15d5","source":"wordfence","cve":"CVE-2026-22342","title":"Dating <= 11.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4595eed-ce5d-42f1-979e-cc37350d15d5?source=api-prod","affected":[{"type":"theme","slug":"DA10","name":"Dating","from":"*","from_inclusive":true,"to":"11.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-15T16:33:10Z"},{"id":"wordfence:b4599c7f-5e5d-4571-97d9-54d6fd0c9c63","source":"wordfence","cve":"CVE-2024-13653","title":"ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4599c7f-5e5d-4571-97d9-54d6fd0c9c63?source=api-prod","affected":[{"type":"theme","slug":"zoxpress","name":"ZoxPress - The All-In-One WordPress News Theme","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-14T22:07:35Z"},{"id":"wordfence:b45ba98f-4cd1-406a-8661-e19d5b4c3ba8","source":"wordfence","cve":"CVE-2024-9210","title":"MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b45ba98f-4cd1-406a-8661-e19d5b4c3ba8?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-top-bar","name":"MC4WP: Mailchimp Top Bar \u2013 Email Subscribe Notification Bar","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T07:35:29Z"},{"id":"wordfence:b4603b58-0972-4e04-91ac-ffc846964722","source":"wordfence","cve":"CVE-2024-1497","title":"Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4603b58-0972-4e04-91ac-ffc846964722?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.30","to_inclusive":true,"patched_in":"2.10.31"}],"published":"2024-02-26T00:00:00Z","updated":"2024-05-31T15:30:52Z"},{"id":"wordfence:b4658546-bf57-414b-a3c9-bf7a5692c5fe","source":"wordfence","cve":"CVE-2025-6691","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4658546-bf57-414b-a3c9-bf7a5692c5fe?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"0.0","from_inclusive":true,"to":"0.0.13","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.0","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.1","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.2","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.3","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.4","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.5","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.6","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"0.0.14"},{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"1.7","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"0.0.14"}],"published":"2025-07-08T17:20:33Z","updated":"2025-07-09T05:23:41Z"},{"id":"wordfence:b467fc26-242f-47c4-bcfd-38980489a0c3","source":"wordfence","cve":"CVE-2024-7689","title":"Snapshot Backup <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b467fc26-242f-47c4-bcfd-38980489a0c3?source=api-prod","affected":[{"type":"plugin","slug":"snapshot-backup","name":"Snapshot Backup","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-19T14:00:28Z"},{"id":"wordfence:b46b5299-2c14-4eb7-872c-f43518e1d31d","source":"wordfence","cve":"CVE-2014-4538","title":"Malware Finder <= 1.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46b5299-2c14-4eb7-872c-f43518e1d31d?source=api-prod","affected":[{"type":"plugin","slug":"malware-finder","name":"Malware Finder","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b46c3f25-6879-47b1-9026-4297fdd003b0","source":"wordfence","cve":"CVE-2025-8440","title":"Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46c3f25-6879-47b1-9026-4297fdd003b0?source=api-prod","affected":[{"type":"plugin","slug":"team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2025-09-26T13:33:24Z","updated":"2025-09-27T01:46:23Z"},{"id":"wordfence:b46cd71f-046a-45b8-be8d-4a71e97586b4","source":"wordfence","cve":"CVE-2024-35658","title":"Checkout Field Editor for WooCommerce (Pro) <= 3.6.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46cd71f-046a-45b8-be8d-4a71e97586b4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-field-editor-pro","name":"Checkout Field Editor for WooCommerce (Pro)","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T18:36:55Z"},{"id":"wordfence:b46d23d5-e53a-40ac-ad2e-e3459a208228","source":"wordfence","cve":"CVE-2026-14835","title":"SOGO Add Script to Individual Pages Header Footer <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46d23d5-e53a-40ac-ad2e-e3459a208228?source=api-prod","affected":[{"type":"plugin","slug":"oh-add-script-header-footer","name":"SOGO Add Script to Individual Pages Header Footer","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2026-08-30T00:00:00Z","updated":"2026-09-01T20:32:59Z"},{"id":"wordfence:b46e2755-24df-4569-bf38-968bf890431e","source":"wordfence","cve":"CVE-2025-32512","title":"Revamp CRM for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46e2755-24df-4569-bf38-968bf890431e?source=api-prod","affected":[{"type":"plugin","slug":"revampcrm-woocommerce","name":"Revamp CRM for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:22:18Z"},{"id":"wordfence:b46e9771-37ff-4825-9af9-02ecde424653","source":"wordfence","cve":"CVE-2024-1042","title":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b46e9771-37ff-4825-9af9-02ecde424653?source=api-prod","affected":[{"type":"plugin","slug":"wp-radio","name":"WP Radio \u2013 Worldwide Online Radio Stations Directory for WordPress","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:21Z"},{"id":"wordfence:b472ffba-4bb8-4b46-9c6b-e80e286babd5","source":"wordfence","cve":"CVE-2025-1452","title":"Favorites <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b472ffba-4bb8-4b46-9c6b-e80e286babd5?source=api-prod","affected":[{"type":"plugin","slug":"favorites","name":"Favorites","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-03-04T00:00:00Z","updated":"2025-04-21T15:56:23Z"},{"id":"wordfence:b4737bb2-1bb4-4986-9df5-5978fc46f2ec","source":"wordfence","cve":"CVE-2024-5925","title":"Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4737bb2-1bb4-4986-9df5-5978fc46f2ec?source=api-prod","affected":[{"type":"theme","slug":"theron-lite","name":"Theron Lite","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-27T20:13:12Z","updated":"2024-06-28T08:33:28Z"},{"id":"wordfence:b47505a5-fb7f-4e41-a6de-6f0b330aa495","source":"wordfence","cve":"CVE-2024-13672","title":"Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b47505a5-fb7f-4e41-a6de-6f0b330aa495?source=api-prod","affected":[{"type":"plugin","slug":"mini-course-generator","name":"Mini Course Generator | Embed mini-courses and interactive content","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-02-20T14:52:41Z","updated":"2025-02-21T03:21:21Z"},{"id":"wordfence:b4764fe2-7bdf-4b08-ae9f-ccb46929c50a","source":"wordfence","cve":"CVE-2024-9934","title":"Wp-ImageZoom <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4764fe2-7bdf-4b08-ae9f-ccb46929c50a?source=api-prod","affected":[{"type":"plugin","slug":"wp-imagezoom","name":"Wp-ImageZoom","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-16T00:00:00Z","updated":"2024-12-12T17:54:10Z"},{"id":"wordfence:b4772ab0-41cd-4b35-bda9-d72e0fd7b7a5","source":"wordfence","cve":"CVE-2024-12131","title":"WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4772ab0-41cd-4b35-bda9-d72e0fd7b7a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T12:43:41Z"},{"id":"wordfence:b478d88d-1423-4a33-b8ef-08b9e66a5d98","source":"wordfence","cve":"CVE-2024-4001","title":"Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b478d88d-1423-4a33-b8ef-08b9e66a5d98?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.93","to_inclusive":true,"patched_in":"3.2.94"}],"published":"2024-06-04T00:00:00Z","updated":"2024-06-05T11:01:58Z"},{"id":"wordfence:b47b1230-bf08-4960-9fc9-56a5b37da8b5","source":"wordfence","cve":"CVE-2025-49944","title":"WPCode Content Ratio <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b47b1230-bf08-4960-9fc9-56a5b37da8b5?source=api-prod","affected":[{"type":"plugin","slug":"wpcode-content-ratio","name":"WPCode Content Ratio","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-10-29T18:51:50Z"},{"id":"wordfence:b47edd57-cac7-463f-88cc-8922f1b34612","source":"wordfence","cve":"CVE-2023-1889","title":"Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b47edd57-cac7-463f-88cc-8922f1b34612?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":"7.5.5"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b47f9624-1829-42b7-8afb-fe25b234df72","source":"wordfence","cve":"CVE-2020-14959","title":"Easy Testimonials <= 3.5.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b47f9624-1829-42b7-8afb-fe25b234df72?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.6"}],"published":"2020-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4827732-41ff-4a14-bb5e-4f7888ffd733","source":"wordfence","cve":"CVE-2024-43949","title":"GHActivity <= 2.0.0-alpha - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4827732-41ff-4a14-bb5e-4f7888ffd733?source=api-prod","affected":[{"type":"plugin","slug":"ghactivity","name":"GHActivity","from":"*","from_inclusive":true,"to":"2.0.0-alpha","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:03:13Z"},{"id":"wordfence:b483e274-94e6-4b22-8431-d3a7638218db","source":"wordfence","cve":"CVE-2025-26563","title":"Mobile Plugin <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b483e274-94e6-4b22-8431-d3a7638218db?source=api-prod","affected":[{"type":"plugin","slug":"rocket-wp-mobile","name":"Mobile Plugin","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-11T00:00:00Z","updated":"2025-03-11T14:06:42Z"},{"id":"wordfence:b4862cb6-110b-48ec-80fb-c25ab080838c","source":"wordfence","cve":"CVE-2025-30805","title":"Flexible Cookies <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4862cb6-110b-48ec-80fb-c25ab080838c?source=api-prod","affected":[{"type":"plugin","slug":"flexible-cookies","name":"Flexible Cookies","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:47:05Z"},{"id":"wordfence:b4865576-9929-4ce2-a220-935f1f3e0485","source":"wordfence","cve":"CVE-2023-32120","title":"Hostel <= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Manage Bookings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4865576-9929-4ce2-a220-935f1f3e0485?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.1","to_inclusive":true,"patched_in":"1.1.5.2"}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b489427e-f925-4058-8924-7a9557fc4ebf","source":"wordfence","cve":"","title":"Gravity PDF <= 6.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b489427e-f925-4058-8924-7a9557fc4ebf?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-pdf-extended","name":"Gravity PDF","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b48b9170-4dd9-4004-a081-488cafbc7597","source":"wordfence","cve":"CVE-2023-51688","title":"eCommerce Product Catalog <= 3.3.26 - Sensitive Information Exposure via CSV Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b48b9170-4dd9-4004-a081-488cafbc7597?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.27","to_inclusive":false,"patched_in":"3.3.27"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b48bc632-c825-48e0-8766-3ac59e5b87c6","source":"wordfence","cve":"CVE-2023-1524","title":"Download Manager <= 3.2.70 - Insufficient Authorization to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b48bc632-c825-48e0-8766-3ac59e5b87c6?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.70","to_inclusive":true,"patched_in":"3.2.71"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b48df04d-1f96-44fb-96d7-122597da2efa","source":"wordfence","cve":"CVE-2024-50547","title":"Themedy Toolbox <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b48df04d-1f96-44fb-96d7-122597da2efa?source=api-prod","affected":[{"type":"plugin","slug":"themedy-toolbox","name":"Themedy Toolbox","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:18:24Z"},{"id":"wordfence:b48e5973-6923-47cc-a660-ecc989f540f8","source":"wordfence","cve":"CVE-2024-1769","title":"JM Twitter Cards <= 14 - Information Exposure via Meta Description","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b48e5973-6923-47cc-a660-ecc989f540f8?source=api-prod","affected":[{"type":"plugin","slug":"jm-twitter-cards","name":"JM Twitter Cards","from":"*","from_inclusive":true,"to":"14","to_inclusive":true,"patched_in":"14.1.0"}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-11T08:14:52Z"},{"id":"wordfence:b4905ca1-3096-45c5-838b-1237888fb969","source":"wordfence","cve":"CVE-2025-13906","title":"WP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4905ca1-3096-45c5-838b-1237888fb969?source=api-prod","affected":[{"type":"plugin","slug":"wp-flot","name":"WP Flot","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:31:37Z","updated":"2025-12-12T03:20:54Z"},{"id":"wordfence:b492ccac-9cdc-42e1-9f0b-4612622d4266","source":"wordfence","cve":"CVE-2025-59580","title":"Goodlayers Core < 2.1.7 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":4.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b492ccac-9cdc-42e1-9f0b-4612622d4266?source=api-prod","affected":[{"type":"plugin","slug":"goodlayers-core","name":"Goodlayers Core","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"}],"published":"2025-09-23T00:00:00Z","updated":"2025-11-04T15:41:16Z"},{"id":"wordfence:b4939efc-889a-4d1d-b916-dcf3b064dc81","source":"wordfence","cve":"CVE-2018-1002000","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4939efc-889a-4d1d-b916-dcf3b064dc81?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4956173-b306-401c-b966-df884e8979e0","source":"wordfence","cve":"CVE-2022-0188","title":"CMP - Coming Soon & Maintenance Plugin <= 4.0.18 - Unauthenticated Arbitrary CSS Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4956173-b306-401c-b966-df884e8979e0?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.0.19","to_inclusive":false,"patched_in":"4.0.19"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b495914d-d8f2-4592-8461-1ae1056a0855","source":"wordfence","cve":"CVE-2026-5486","title":"Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b495914d-d8f2-4592-8461-1ae1056a0855?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-05-13T14:22:12Z","updated":"2026-05-14T02:26:40Z"},{"id":"wordfence:b495d7e4-09fd-4e38-9912-bed3f6a7a745","source":"wordfence","cve":"CVE-2025-32177","title":"Embed Chessboard <= 3.07.00 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b495d7e4-09fd-4e38-9912-bed3f6a7a745?source=api-prod","affected":[{"type":"plugin","slug":"embed-chessboard","name":"Embed Chessboard","from":"*","from_inclusive":true,"to":"3.07.00","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:20:20Z"},{"id":"wordfence:b4967c95-8eb6-4c9b-ae6e-082dbc6af7f5","source":"wordfence","cve":"CVE-2023-26525","title":"Dokan <= 3.7.12 - Authenticated (Vendor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4967c95-8eb6-4c9b-ae6e-082dbc6af7f5?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.7.13"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4971d77-1312-43ac-ab14-970bd4ec5688","source":"wordfence","cve":"CVE-2025-32115","title":"Popping Content Light <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4971d77-1312-43ac-ab14-970bd4ec5688?source=api-prod","affected":[{"type":"plugin","slug":"popping-content-light","name":"Popping Content Light","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:46:02Z"},{"id":"wordfence:b4983c2f-f9f6-4bd9-9c38-0ad3756f92b6","source":"wordfence","cve":"CVE-2020-12054","title":"Catch Breadcrumb <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4983c2f-f9f6-4bd9-9c38-0ad3756f92b6?source=api-prod","affected":[{"type":"plugin","slug":"catch-breadcrumb","name":"Catch Breadcrumb","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2020-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b498e274-db8c-438f-8e19-43f3018d1663","source":"wordfence","cve":"CVE-2022-4297","title":"WP AutoComplete Search <= 1.0.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b498e274-db8c-438f-8e19-43f3018d1663?source=api-prod","affected":[{"type":"plugin","slug":"wp-autosearch","name":"WP AutoComplete Search","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b49978c1-9254-4229-8d32-e12896301f3d","source":"wordfence","cve":"CVE-2025-12825","title":"User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49978c1-9254-4229-8d32-e12896301f3d?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-using-contact-form-7","name":"User Registration Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-17T04:34:02Z"},{"id":"wordfence:b49ae7fc-e860-4387-b596-12640ec7277f","source":"wordfence","cve":"","title":"WPCafe \u2013 Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ae7fc-e860-4387-b596-12640ec7277f?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2022-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b49bb71b-1cdd-4341-9288-d33c74bc9426","source":"wordfence","cve":"CVE-2025-31757","title":"Free Woocommerce Product Table View <= 1.78 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49bb71b-1cdd-4341-9288-d33c74bc9426?source=api-prod","affected":[{"type":"plugin","slug":"free-product-table-for-woocommerce","name":"Free Woocommerce Product Table View \u2013 Woo Table Pro","from":"*","from_inclusive":true,"to":"1.78","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T13:37:40Z"},{"id":"wordfence:b49c1e95-7ef4-45d7-9fdf-dd5adffd2eb0","source":"wordfence","cve":"CVE-2024-45454","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49c1e95-7ef4-45d7-9fdf-dd5adffd2eb0?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.121","to_inclusive":true,"patched_in":"1.5.122"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:12:26Z"},{"id":"wordfence:b49ce4a2-52ad-4824-86fc-5edd2e33802d","source":"wordfence","cve":"CVE-2025-12788","title":"Hydra Booking \u2013 All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2025-11-10T22:39:28Z","updated":"2025-11-11T11:03:46Z"},{"id":"wordfence:b49d166f-4df0-4997-a078-0be8fcd92576","source":"wordfence","cve":"CVE-2024-4376","title":"Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b49d166f-4df0-4997-a078-0be8fcd92576?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.31","to_inclusive":true,"patched_in":"4.10.32"}],"published":"2024-05-30T17:20:28Z","updated":"2024-05-31T05:32:00Z"},{"id":"wordfence:b4a229be-2991-40f3-a0e7-e322009a3ed2","source":"wordfence","cve":"CVE-2024-49662","title":"Simple Load More <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a229be-2991-40f3-a0e7-e322009a3ed2?source=api-prod","affected":[{"type":"plugin","slug":"simple-load-more","name":"Simple Load More","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:09:03Z"},{"id":"wordfence:b4a44a8a-740b-45dd-962c-945238f6ddee","source":"wordfence","cve":"CVE-2023-25026","title":"PayPal Brasil para WooCommerce <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a44a8a-740b-45dd-962c-945238f6ddee?source=api-prod","affected":[{"type":"plugin","slug":"paypal-brasil-para-woocommerce","name":"PayPal Brasil para WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4a63360-01eb-491e-b25d-501adb83f57f","source":"wordfence","cve":"CVE-2015-9433","title":"WP Social Bookmarking Light < 1.7.10 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a63360-01eb-491e-b25d-501adb83f57f?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-bookmarking-light","name":"WP Social Bookmarking Light","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":false,"patched_in":"1.7.10"}],"published":"2015-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4a6e380-bec0-455f-8c80-9fd4cf7b7d0a","source":"wordfence","cve":"CVE-2026-74926","title":"MultiVendorX <= 5.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a6e380-bec0-455f-8c80-9fd4cf7b7d0a?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.15","to_inclusive":true,"patched_in":"5.0.16"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:23:35Z"},{"id":"wordfence:b4a82562-1368-4071-bedf-8a84d82e88ef","source":"wordfence","cve":"CVE-2021-24559","title":"Qyrr \u2013 simply and modern QR-Code creation <= 0.7 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a82562-1368-4071-bedf-8a84d82e88ef?source=api-prod","affected":[{"type":"plugin","slug":"qyrr-code","name":"Qyrr \u2013 simply and modern QR-Code creation","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":"0.8"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4a87db1-ac50-48e5-af6d-831d77b6f359","source":"wordfence","cve":"CVE-2025-39442","title":"Review Wave \u2013 Google Places Reviews <=  1.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a87db1-ac50-48e5-af6d-831d77b6f359?source=api-prod","affected":[{"type":"plugin","slug":"review-wave-google-places-reviews","name":"Review Wave \u2013 Google Places Reviews","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:48:27Z"},{"id":"wordfence:b4a88c2f-12d2-46c5-a14a-dfec6382a81b","source":"wordfence","cve":"CVE-2025-52802","title":"Import YouTube videos as WP Posts <= 2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4a88c2f-12d2-46c5-a14a-dfec6382a81b?source=api-prod","affected":[{"type":"plugin","slug":"import-youtube-videos-as-wp-post","name":"Import YouTube videos as WP Posts","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:55:46Z"},{"id":"wordfence:b4aa1dce-de3d-4049-a24d-cadb59912ad1","source":"wordfence","cve":"CVE-2026-32357","title":"Simple Blog Card <= 2.37 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4aa1dce-de3d-4049-a24d-cadb59912ad1?source=api-prod","affected":[{"type":"plugin","slug":"simple-blog-card","name":"Simple Blog Card","from":"*","from_inclusive":true,"to":"2.37","to_inclusive":true,"patched_in":"2.38"}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-05T14:06:21Z"},{"id":"wordfence:b4accf10-710e-4cba-8d61-04e422324f9d","source":"wordfence","cve":"CVE-2023-5437","title":"WP fade in text news <= 12.0 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4accf10-710e-4cba-8d61-04e422324f9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-fade-in-text-news","name":"WP fade in text news","from":"*","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":"12.1"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ad6f96-22a3-420c-9ccb-a7b118fa2810","source":"wordfence","cve":"CVE-2024-54274","title":"WordPress HelpDesk & Support Ticket System Plugin \u2013 Octrace Support <= 1.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ad6f96-22a3-420c-9ccb-a7b118fa2810?source=api-prod","affected":[{"type":"plugin","slug":"octrace-support","name":"WordPress HelpDesk & Support Ticket System Plugin \u2013 Octrace Support","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:32:02Z"},{"id":"wordfence:b4aebb45-b47b-4b5a-8281-400a4b786689","source":"wordfence","cve":"CVE-2026-3998","title":"WM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4aebb45-b47b-4b5a-8281-400a4b786689?source=api-prod","affected":[{"type":"plugin","slug":"wm-jqmath","name":"WM JqMath","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:46:51Z","updated":"2026-04-15T08:28:16Z"},{"id":"wordfence:b4b2587a-e84e-4149-b9ac-ecf36451f815","source":"wordfence","cve":"CVE-2023-28781","title":"WordPress Contact Forms by Cimatti <= 1.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b2587a-e84e-4149-b9ac-ecf36451f815?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4b33226-59b8-4445-9f7f-ba788e8f6dbe","source":"wordfence","cve":"CVE-2025-32148","title":"Daisycon prijsvergelijkers <= 4.8.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b33226-59b8-4445-9f7f-ba788e8f6dbe?source=api-prod","affected":[{"type":"plugin","slug":"daisycon","name":"Daisycon prijsvergelijkers","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.9.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-07-25T19:22:28Z"},{"id":"wordfence:b4b3b4a4-9a56-49b8-b3d3-7e50954b4487","source":"wordfence","cve":"CVE-2019-11886","title":"Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b3b4a4-9a56-49b8-b3d3-7e50954b4487?source=api-prod","affected":[{"type":"plugin","slug":"yellow-pencil-visual-theme-customizer","name":"Visual CSS Style Editor","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":false,"patched_in":"7.2.1"}],"published":"2019-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4b4ca5b-c806-4b68-acb8-6b63d6ca5728","source":"wordfence","cve":"CVE-2024-9586","title":"Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b4ca5b-c806-4b68-acb8-6b63d6ca5728?source=api-prod","affected":[{"type":"plugin","slug":"linkz-ai","name":"Linkz.ai \u2013 Automatic link previews on hover","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-18T14:06:47Z"},{"id":"wordfence:b4b5cc5e-af82-49e0-a0b5-d27c3631a102","source":"wordfence","cve":"CVE-2025-14270","title":"OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b5cc5e-af82-49e0-a0b5-d27c3631a102?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-02-18T16:05:27Z","updated":"2026-02-19T04:36:21Z"},{"id":"wordfence:b4b61b5b-e5e8-41d4-bf37-d9427a204ea6","source":"wordfence","cve":"CVE-2023-46626","title":"FLOWFACT WP Connector <= 2.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b61b5b-e5e8-41d4-bf37-d9427a204ea6?source=api-prod","affected":[{"type":"plugin","slug":"flowfact-wp-connector","name":"FLOWFACT WP Connector","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4b6cbb5-d82d-4035-b0c8-5c1aaee31993","source":"wordfence","cve":"CVE-2026-3361","title":"WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b6cbb5-d82d-4035-b0c8-5c1aaee31993?source=api-prod","affected":[{"type":"plugin","slug":"wp-store-locator","name":"WP Store Locator","from":"*","from_inclusive":true,"to":"2.2.261","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-04-22T14:42:31Z","updated":"2026-04-23T03:26:36Z"},{"id":"wordfence:b4b7adcf-c58b-4019-89ff-a69ebf8262bc","source":"wordfence","cve":"CVE-2024-49682","title":"Simple Membership <= 4.5.3 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b7adcf-c58b-4019-89ff-a69ebf8262bc?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:55:43Z"},{"id":"wordfence:b4b82bb0-8d8a-42eb-a142-1d9af34b2c66","source":"wordfence","cve":"CVE-2024-50522","title":"WeChat Subscribers Lite  <= 1.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b82bb0-8d8a-42eb-a142-1d9af34b2c66?source=api-prod","affected":[{"type":"plugin","slug":"wechat-subscribers-lite","name":"WeChat Subscribers Lite \u5fae\u4fe1\u516c\u4f17\u8ba2\u9605\u53f7\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T20:20:06Z"},{"id":"wordfence:b4bb2d72-ff31-4220-acb3-ed17bb9229b5","source":"wordfence","cve":"CVE-2023-1931","title":"WP Fastest Cache <= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4bb2d72-ff31-4220-acb3-ed17bb9229b5?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4bb3067-7953-466d-a469-8a101450f133","source":"wordfence","cve":"CVE-2026-6394","title":"Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4bb3067-7953-466d-a469-8a101450f133?source=api-prod","affected":[{"type":"plugin","slug":"nexa-blocks","name":"Nexa Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:03:46Z","updated":"2026-05-20T01:25:52Z"},{"id":"wordfence:b4bfd3d4-8454-4db2-b6fc-570bc7f99f36","source":"wordfence","cve":"CVE-2026-25402","title":"Echo Knowledge Base \u2013 Documentation, FAQs, AI Chat & AI Search <= 16.011.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4bfd3d4-8454-4db2-b6fc-570bc7f99f36?source=api-prod","affected":[{"type":"plugin","slug":"echo-knowledge-base","name":"Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Search","from":"*","from_inclusive":true,"to":"16.011.0","to_inclusive":true,"patched_in":"16.20.0"}],"published":"2026-01-29T00:00:00Z","updated":"2026-05-04T15:31:03Z"},{"id":"wordfence:b4c06548-238d-4b75-8f20-d7de6fc21539","source":"wordfence","cve":"CVE-2025-13220","title":"Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c06548-238d-4b75-8f20-d7de6fc21539?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2025-12-20T14:20:39Z","updated":"2025-12-21T03:20:06Z"},{"id":"wordfence:b4c13600-0791-4ade-9c28-f43f164aedae","source":"wordfence","cve":"CVE-2024-10055","title":"Click to Chat \u2013 WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c13600-0791-4ade-9c28-f43f164aedae?source=api-prod","affected":[{"type":"plugin","slug":"support-chat","name":"WP Click to Chat \u2013 Email, Live Chat, Call & Book Now Buttons","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-10-17T19:22:48Z","updated":"2024-10-18T18:00:59Z"},{"id":"wordfence:b4c17377-a634-47ad-828b-2ed1f3b188f0","source":"wordfence","cve":"CVE-2026-15386","title":"Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c17377-a634-47ad-828b-2ed1f3b188f0?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:31:12Z"},{"id":"wordfence:b4c29cff-0926-4e65-b439-6fc098a0fac8","source":"wordfence","cve":"CVE-2026-66637","title":"Featured Video Plus <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c29cff-0926-4e65-b439-6fc098a0fac8?source=api-prod","affected":[{"type":"plugin","slug":"featured-video-plus","name":"Featured Video Plus","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:21:34Z"},{"id":"wordfence:b4c35e6a-a1f4-49f1-8024-6abb2486b5e8","source":"wordfence","cve":"CVE-2024-51938","title":"Charity Addon for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c35e6a-a1f4-49f1-8024-6abb2486b5e8?source=api-prod","affected":[{"type":"plugin","slug":"charity-addon-for-elementor","name":"Charity Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-12T19:49:17Z"},{"id":"wordfence:b4c36899-3c7b-41b6-a38d-86c8834b4c03","source":"wordfence","cve":"CVE-2025-15021","title":"Gotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c36899-3c7b-41b6-a38d-86c8834b4c03?source=api-prod","affected":[{"type":"plugin","slug":"gotham-block-extra-light","name":"Gotham Block Extra Light","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-01-13T17:17:36Z","updated":"2026-01-15T18:00:41Z"},{"id":"wordfence:b4c61072-5480-43f3-ad9f-ed3f0d577ebc","source":"wordfence","cve":"CVE-2025-4369","title":"Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c61072-5480-43f3-ad9f-ed3f0d577ebc?source=api-prod","affected":[{"type":"plugin","slug":"companion-auto-update","name":"Companion Auto Update","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2025-07-14T20:39:43Z","updated":"2025-07-15T09:22:53Z"},{"id":"wordfence:b4c6930a-b413-4acc-a0a4-9940bb8474cc","source":"wordfence","cve":"","title":"Newsletter <= 3.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c6930a-b413-4acc-a0a4-9940bb8474cc?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2013-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4c9b125-4cea-448b-8b31-c033857346b3","source":"wordfence","cve":"CVE-2026-42750","title":"WPComplete <= 2.9.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c9b125-4cea-448b-8b31-c033857346b3?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.4","to_inclusive":true,"patched_in":"2.9.5.5"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-01T16:19:46Z"},{"id":"wordfence:b4ca985e-cae1-4e26-ad2d-413724cfd45d","source":"wordfence","cve":"CVE-2023-3435","title":"User Activity Log <= 1.6.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ca985e-cae1-4e26-ad2d-413724cfd45d?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4cb5ec6-34f5-419d-a1eb-3a75dd63cb60","source":"wordfence","cve":"CVE-2026-66462","title":"WooCommerce Appointments <= 5.3.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cb5ec6-34f5-419d-a1eb-3a75dd63cb60?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-appointments","name":"WooCommerce Appointments","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-14T13:08:47Z"},{"id":"wordfence:b4cc839c-de7a-43eb-a7fa-b1049419bfa3","source":"wordfence","cve":"CVE-2024-2023","title":"Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_upload","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cc839c-de7a-43eb-a7fa-b1049419bfa3?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"},{"type":"plugin","slug":"folders-pro","name":"Folders Pro","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-06-13T15:33:57Z","updated":"2024-06-14T12:51:02Z"},{"id":"wordfence:b4cd5c42-bba2-4900-b450-a575c0007402","source":"wordfence","cve":"","title":"Easy Digital Downloads <= 2.5.7 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cd5c42-bba2-4900-b450-a575c0007402?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2016-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ce2353-e4ec-4f55-a341-c1b11be86642","source":"wordfence","cve":"CVE-2014-4588","title":"Hot Files: File Sharing and Download Manager Plugin <= 1.0.0 - Cross-Site scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ce2353-e4ec-4f55-a341-c1b11be86642?source=api-prod","affected":[{"type":"plugin","slug":"wphotfiles","name":"Hot Files: File Sharing and Download Manager Plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ce6cb2-a02a-4b4c-8887-22ee6115509f","source":"wordfence","cve":"CVE-2021-24226","title":"AccessAlly <= 3.5.6 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ce6cb2-a02a-4b4c-8887-22ee6115509f?source=api-prod","affected":[{"type":"plugin","slug":"accessally","name":"AccessAlly","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":true,"patched_in":"3.5.7"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4cf2331-ec19-488a-9d72-ec54fb9a82c9","source":"wordfence","cve":"CVE-2024-38781","title":"CopySafe Web Protection <= 3.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cf2331-ec19-488a-9d72-ec54fb9a82c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-copysafe-web","name":"CopySafe Web Protection \u2013 Copy Protect Images","from":"*","from_inclusive":true,"to":"3.15","to_inclusive":true,"patched_in":"4.0"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:08:56Z"},{"id":"wordfence:b4cfca91-c897-4499-8ba3-7c45fe3e9005","source":"wordfence","cve":"CVE-2026-119747","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cfca91-c897-4499-8ba3-7c45fe3e9005?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.62","to_inclusive":true,"patched_in":"2.8.63"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:55:53Z"},{"id":"wordfence:b4d171a1-5de8-4981-b655-affa1c6438e5","source":"wordfence","cve":"CVE-2026-111830","title":"WP Mailster <= 1.9.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d171a1-5de8-4981-b655-affa1c6438e5?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.9.1.0","to_inclusive":true,"patched_in":"1.9.2.0"}],"published":"2026-10-20T07:13:31Z","updated":"2026-10-23T18:29:15Z"},{"id":"wordfence:b4d33e69-3620-42d9-adb3-267a5ed02a58","source":"wordfence","cve":"","title":"WP Maintenance Mode & Site Under Construction <= 1.8.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d33e69-3620-42d9-adb3-267a5ed02a58?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode-site-under-construction","name":"WP Maintenance Mode & Site Under Construction","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.9"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4d6728b-7c2f-4902-9e40-298382aa732c","source":"wordfence","cve":"CVE-2026-118095","title":"Media Library Assistant <= 3.42 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d6728b-7c2f-4902-9e40-298382aa732c?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:40:06Z"},{"id":"wordfence:b4d73a55-c5fc-4a28-bcde-497051ac893b","source":"wordfence","cve":"CVE-2025-53253","title":"WP Edit <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d73a55-c5fc-4a28-bcde-497051ac893b?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit","name":"WP Edit","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-10-21T17:38:07Z"},{"id":"wordfence:b4d9acfb-bb9d-4b00-b439-c7ccea751f8d","source":"wordfence","cve":"CVE-2025-2331","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d9acfb-bb9d-4b00-b439-c7ccea751f8d?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.22.1","to_inclusive":true,"patched_in":"3.22.2"}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-22T11:18:42Z"},{"id":"wordfence:b4da6327-9ad1-4a53-b2c4-a4c31f56d0e5","source":"wordfence","cve":"CVE-2024-33954","title":"Pliska <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4da6327-9ad1-4a53-b2c4-a4c31f56d0e5?source=api-prod","affected":[{"type":"theme","slug":"pliska","name":"Pliska","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":"0.3.6"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:46:46Z"},{"id":"wordfence:b4de2c22-4d8f-45b1-bccb-c536eefd58a8","source":"wordfence","cve":"CVE-2024-52407","title":"BasePress Migration Tools <= 1.0.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4de2c22-4d8f-45b1-bccb-c536eefd58a8?source=api-prod","affected":[{"type":"plugin","slug":"basepress-migration-tools","name":"WordPress BasePress Migration Tools","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:05:36Z"},{"id":"wordfence:b4df1fc3-ea7e-4f41-a5f0-d3928f8add70","source":"wordfence","cve":"CVE-2023-30481","title":"AGP Font Awesome Collection <= 3.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4df1fc3-ea7e-4f41-a5f0-d3928f8add70?source=api-prod","affected":[{"type":"plugin","slug":"agp-font-awesome-collection","name":"AGP Font Awesome Collection","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4df93a3-4366-4759-87d5-d4a648ea3b8b","source":"wordfence","cve":"CVE-2026-23804","title":"Better Business Reviews <= 0.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4df93a3-4366-4759-87d5-d4a648ea3b8b?source=api-prod","affected":[{"type":"plugin","slug":"better-business-reviews","name":"Better Business Reviews","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":"0.1.2"}],"published":"2026-01-06T00:00:00Z","updated":"2026-05-04T15:47:26Z"},{"id":"wordfence:b4dfeb49-38d3-495d-af96-d67a29b339fa","source":"wordfence","cve":"CVE-2024-4045","title":"Popup Builder by OptinMonster \u2013 WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4dfeb49-38d3-495d-af96-d67a29b339fa?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"2.16.1","to_inclusive":true,"patched_in":"2.16.2"}],"published":"2024-05-24T16:30:44Z","updated":"2024-05-25T05:36:44Z"},{"id":"wordfence:b4e01402-f866-43b9-9fef-7e9b156a9e0d","source":"wordfence","cve":"CVE-2026-118191","title":"Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e01402-f866-43b9-9fef-7e9b156a9e0d?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-11-12T20:54:54Z","updated":"2026-11-13T09:35:15Z"},{"id":"wordfence:b4e0df34-1947-4b63-a489-83d9d3f1e7ca","source":"wordfence","cve":"CVE-2026-24938","title":"Better Search <= 4.2.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e0df34-1947-4b63-a489-83d9d3f1e7ca?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-11-22T13:00:37Z","updated":"2026-02-09T22:00:58Z"},{"id":"wordfence:b4e0ee4f-fc45-4682-9ed4-aa1301205bb4","source":"wordfence","cve":"CVE-2022-40671","title":"Rate my Post \u2013 WP Rating System <= 3.3.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e0ee4f-fc45-4682-9ed4-aa1301205bb4?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4e1638a-ddfb-44e5-951e-3e779971a3a7","source":"wordfence","cve":"CVE-2024-29142","title":"Better Search <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e1638a-ddfb-44e5-951e-3e779971a3a7?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:46:30Z"},{"id":"wordfence:b4e1fe83-678f-4368-9810-16d9cd50b15c","source":"wordfence","cve":"CVE-2022-4832","title":"Store Locator WordPress <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e1fe83-678f-4368-9810-16d9cd50b15c?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2022-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4e3abaf-be4d-4405-9dbe-f62f038c5a69","source":"wordfence","cve":"CVE-2026-62135","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.24 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e3abaf-be4d-4405-9dbe-f62f038c5a69?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:31:05Z"},{"id":"wordfence:b4e61162-dba8-4cb8-b953-031b963de208","source":"wordfence","cve":"CVE-2026-61947","title":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e61162-dba8-4cb8-b953-031b963de208?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:02:46Z"},{"id":"wordfence:b4e7786c-a447-4a77-9f66-702db53773dc","source":"wordfence","cve":"CVE-2025-58208","title":"PDF for Elementor Forms + Drag And Drop Template Builder <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e7786c-a447-4a77-9f66-702db53773dc?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-elementor-forms","name":"PDF for Elementor Forms + Drag And Drop Template Builder","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:13:06Z"},{"id":"wordfence:b4e812f2-78f2-4dde-96ec-2ee114ebaa60","source":"wordfence","cve":"CVE-2018-14071","title":"Geo Mashup - < 1.10.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e812f2-78f2-4dde-96ec-2ee114ebaa60?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":false,"patched_in":"1.10.4"}],"published":"2018-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4e9f1d7-9b80-4903-80dd-6b74f847c018","source":"wordfence","cve":"CVE-2025-26579","title":"MicroPayments <= 3.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4e9f1d7-9b80-4903-80dd-6b74f847c018?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-03-12T00:00:00Z","updated":"2026-02-26T15:04:42Z"},{"id":"wordfence:b4eb5833-25cd-4a6c-9240-37a9f8c1b120","source":"wordfence","cve":"CVE-2023-2601","title":"WP Brutal AI < 2.0.0 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4eb5833-25cd-4a6c-9240-37a9f8c1b120?source=api-prod","affected":[{"type":"plugin","slug":"wpbrutalai","name":"WP Brutal AI","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ec9001-c4aa-4db3-b7d7-29afa243f78a","source":"wordfence","cve":"CVE-2023-32800","title":"Rank Math SEO PRO <= 3.0.35 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ec9001-c4aa-4db3-b7d7-29afa243f78a?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math-pro","name":"Rank Math SEO PRO","from":"*","from_inclusive":true,"to":"3.0.35","to_inclusive":true,"patched_in":"3.0.36"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ecf437-b9f5-47d3-85b2-c8159c937473","source":"wordfence","cve":"CVE-2022-4010","title":"Image Hover Effects <= 5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ecf437-b9f5-47d3-85b2-c8159c937473?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects","name":"Image Hover Effects \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2022-11-20T00:00:00Z","updated":"2024-05-10T18:20:26Z"},{"id":"wordfence:b4f2554d-c047-4be2-a4e6-2ae51f077376","source":"wordfence","cve":"CVE-2023-34179","title":"Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f2554d-c047-4be2-a4e6-2ae51f077376?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.7.11.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4f32ec5-c744-45ca-a7a2-3d4a241f82c1","source":"wordfence","cve":"CVE-2025-64294","title":"Snow Effect <= 1.1.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f32ec5-c744-45ca-a7a2-3d4a241f82c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-snow-effect","name":"WP Snow Effect","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T00:00:00Z","updated":"2025-11-04T15:32:12Z"},{"id":"wordfence:b4f4fcaa-4c66-49f6-b13f-da112ae26e21","source":"wordfence","cve":"CVE-2019-18854","title":"Safe SVG <= 1.9.4 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f4fcaa-4c66-49f6-b13f-da112ae26e21?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2019-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4f56e27-7d1a-43ae-b507-16b5bc5e9898","source":"wordfence","cve":"CVE-2026-32585","title":"Airano MCP Bridge <= 2.11.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f56e27-7d1a-43ae-b507-16b5bc5e9898?source=api-prod","affected":[{"type":"plugin","slug":"airano-mcp-bridge","name":"Airano MCP Bridge","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-02T14:41:00Z","updated":"2026-10-08T23:21:32Z"},{"id":"wordfence:b4f77508-b1e6-4a13-b384-f086ec64fe85","source":"wordfence","cve":"","title":"Easy Table <= 1.5.2 - Authenticated Stored Cross-Site Scripting via easy-table-test-area parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f77508-b1e6-4a13-b384-f086ec64fe85?source=api-prod","affected":[{"type":"plugin","slug":"easy-table","name":"Easy Table","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4f8c1a4-a309-4852-a066-0644ce175abc","source":"wordfence","cve":"CVE-2025-54012","title":"Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4f8c1a4-a309-4852-a066-0644ce175abc?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.16","to_inclusive":true,"patched_in":"2.11.17"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-19T14:00:39Z"},{"id":"wordfence:b4fc93e3-09fe-427c-a21c-d952a05902d1","source":"wordfence","cve":"CVE-2026-15149","title":"Hotel Booking <= 2.3.2 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4fc93e3-09fe-427c-a21c-d952a05902d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-07-21T00:00:00Z","updated":"2026-08-21T15:33:46Z"},{"id":"wordfence:b4fc9628-b254-405b-a7cc-bb955618bc35","source":"wordfence","cve":"CVE-2023-49186","title":"Machic Core <= 1.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4fc9628-b254-405b-a7cc-bb955618bc35?source=api-prod","affected":[{"type":"theme","slug":"machic-core","name":"Machic - Electronics Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4fe5d61-2607-48a1-938b-f008c18c7c81","source":"wordfence","cve":"CVE-2025-23856","title":"Simple Vertical Timeline <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4fe5d61-2607-48a1-938b-f008c18c7c81?source=api-prod","affected":[{"type":"plugin","slug":"simple-vertical-timeline","name":"Simple Vertical Timeline","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:31:47Z"},{"id":"wordfence:b4fe8b1f-da1c-4f94-9ab4-272766b488c3","source":"wordfence","cve":"CVE-2023-4141","title":"WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Execution","severity":"high","cvss":8.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4fe8b1f-da1c-4f94-9ab4-272766b488c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.9.8","to_inclusive":true,"patched_in":"7.9.9"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b4ff715e-056e-48d8-bb82-d4f89047384f","source":"wordfence","cve":"CVE-2021-24149","title":"Modern Events Calendar Lite <= 5.16.5 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b4ff715e-056e-48d8-bb82-d4f89047384f?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.16.5","to_inclusive":true,"patched_in":"5.16.6"}],"published":"2021-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5018aac-59fb-4d95-bbdd-8ceaa4f8fad1","source":"wordfence","cve":"CVE-2022-1334","title":"WP YouTube Live <= 1.8.2 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5018aac-59fb-4d95-bbdd-8ceaa4f8fad1?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-live","name":"WP YouTube Live","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5023e07-9976-44f3-81de-2eb4ba86b0ca","source":"wordfence","cve":"CVE-2019-15025","title":"Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5023e07-9976-44f3-81de-2eb4ba86b0ca?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.3.21.1","to_inclusive":true,"patched_in":"3.3.21.2"}],"published":"2019-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5023e2a-19d5-4014-86ed-fb375300a6bf","source":"wordfence","cve":"","title":"WordPress Core 4.9.6 - 7.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Personal Data Erasure Request Email Addresses","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5023e2a-19d5-4014-86ed-fb375300a6bf?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.6","from_inclusive":true,"to":"4.9.34","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.27","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.29","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.26","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.24","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.23","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.22","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.20","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.18","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.19","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.17","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.15","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.14","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.13","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"4.9.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"4.9.35"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T19:27:31Z"},{"id":"wordfence:b5031140-9a48-43da-b946-00ce9c70258b","source":"wordfence","cve":"CVE-2023-41856","title":"Click To Tweet <= 2.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5031140-9a48-43da-b946-00ce9c70258b?source=api-prod","affected":[{"type":"plugin","slug":"click-to-tweet","name":"Click To Tweet","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5068daf-9baa-45e1-bf87-76630dede323","source":"wordfence","cve":"CVE-2025-48313","title":"Tripadvisor Shortcode <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5068daf-9baa-45e1-bf87-76630dede323?source=api-prod","affected":[{"type":"plugin","slug":"tripadvisor-shortcode","name":"Tripadvisor Shortcode","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:18:11Z"},{"id":"wordfence:b507462d-1ce2-4463-93bf-635ee78274f6","source":"wordfence","cve":"CVE-2026-1909","title":"WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b507462d-1ce2-4463-93bf-635ee78274f6?source=api-prod","affected":[{"type":"plugin","slug":"wavesurfer-wp","name":"WaveSurfer-WP","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2026-02-05T18:34:33Z","updated":"2026-02-06T06:46:32Z"},{"id":"wordfence:b50772e5-5142-4f50-b5c0-6116a8821cba","source":"wordfence","cve":"CVE-2024-1037","title":"All-In-One Security (AIOS) \u2013 Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50772e5-5142-4f50-b5c0-6116a8821cba?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T06:46:57Z"},{"id":"wordfence:b5086b8d-6c74-4970-9937-5ddc5b528495","source":"wordfence","cve":"CVE-2022-46794","title":"WooCommerce Weight Based Shipping <= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5086b8d-6c74-4970-9937-5ddc5b528495?source=api-prod","affected":[{"type":"plugin","slug":"weight-based-shipping-for-woocommerce","name":"Weight Based Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b50bdf83-d6e1-46bd-be6c-4fcb77ef94db","source":"wordfence","cve":"CVE-2019-15320","title":"Option Tree <= 2.7.2 - Object Injection Bypass","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50bdf83-d6e1-46bd-be6c-4fcb77ef94db?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2019-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b50c9427-203a-49b6-8157-685aff606490","source":"wordfence","cve":"CVE-2026-106004","title":"DT LMS \u2013 elearning,  WordPress LMS Plugin <= 1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50c9427-203a-49b6-8157-685aff606490?source=api-prod","affected":[{"type":"plugin","slug":"dt-lms-lite","name":"DT LMS \u2013 elearning,  WordPress LMS Plugin","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:41:25Z"},{"id":"wordfence:b50d6fd0-3698-4e16-aa76-0344306bc705","source":"wordfence","cve":"CVE-2023-5203","title":"WP Sessions Time Monitoring Full Automatic <= 1.0.8 - Unauthenticated SQL injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50d6fd0-3698-4e16-aa76-0344306bc705?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2023-09-11T00:00:00Z","updated":"2024-02-06T18:02:51Z"},{"id":"wordfence:b50db670-856a-43d1-811e-4dc297137dc0","source":"wordfence","cve":"CVE-2025-67915","title":"Timetics <= 1.0.46 - Incorrect Authorization to Authenticated (Timetics Customer+) User Creation","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50db670-856a-43d1-811e-4dc297137dc0?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.48"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:16:18Z"},{"id":"wordfence:b50f98ca-6a51-4de8-9e89-004532ba8f96","source":"wordfence","cve":"","title":"Colormix (All Versions) - Multiple Vulnerabilities","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b50f98ca-6a51-4de8-9e89-004532ba8f96?source=api-prod","affected":[{"type":"theme","slug":"colormix","name":"Colormix","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5111eb6-b4b3-4b18-9de3-577c323eaab8","source":"wordfence","cve":"","title":"Advanced Menu Manager <= 3.0.6 - Authenticated (Subscriber+) Menu Creation/Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5111eb6-b4b3-4b18-9de3-577c323eaab8?source=api-prod","affected":[{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b512f9a9-6c83-416c-bacc-ee3bba8dfe29","source":"wordfence","cve":"CVE-2023-28789","title":"Contact Forms by Cimatti <= 1.5.4 - Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b512f9a9-6c83-416c-bacc-ee3bba8dfe29?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5136409-d843-4774-afe7-211a23f65da9","source":"wordfence","cve":"CVE-2022-2551","title":"Duplicator \u2013 WordPress Migration Plugin <= 1.4.7 - Unauthenticated Backup Download","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5136409-d843-4774-afe7-211a23f65da9?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.7.1"}],"published":"2022-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5137bc2-912b-4e25-966e-515e8d9fc21c","source":"wordfence","cve":"CVE-2025-12094","title":"OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5137bc2-912b-4e25-966e-515e8d9fc21c?source=api-prod","affected":[{"type":"plugin","slug":"oopspam-anti-spam","name":"oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)","from":"*","from_inclusive":true,"to":"1.2.53","to_inclusive":true,"patched_in":"1.2.54"}],"published":"2025-10-30T00:00:00Z","updated":"2025-10-31T08:25:57Z"},{"id":"wordfence:b515782a-d7ec-41a6-92f8-91823f2c0dcf","source":"wordfence","cve":"CVE-2023-32962","title":"WishSuite <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b515782a-d7ec-41a6-92f8-91823f2c0dcf?source=api-prod","affected":[{"type":"plugin","slug":"wishsuite","name":"WishSuite \u2013 Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5165f60-6515-4a2c-a124-cc88155eaf01","source":"wordfence","cve":"CVE-2024-11635","title":"WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.12","to_inclusive":true,"patched_in":"4.24.14"}],"published":"2025-01-07T18:43:07Z","updated":"2025-03-24T15:03:52Z"},{"id":"wordfence:b51a7670-9fa6-4df9-bef6-c7ebe6b09c5c","source":"wordfence","cve":"CVE-2019-20210","title":"CTHthemes CityBook Theme < 2.3.4, TownHub Theme < 1.0.6, EasyBook Theme < 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b51a7670-9fa6-4df9-bef6-c7ebe6b09c5c?source=api-prod","affected":[{"type":"theme","slug":"easybook","name":"EasyBook \u2013 Hotel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"},{"type":"theme","slug":"townhub","name":"TownHub - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"},{"type":"theme","slug":"citybook","name":"CityBook - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2019-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b51ea91f-247c-4ea6-b60c-7ad49b676cb1","source":"wordfence","cve":"CVE-2017-18531","title":"Raygun4WP <= 1.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b51ea91f-247c-4ea6-b60c-7ad49b676cb1?source=api-prod","affected":[{"type":"plugin","slug":"raygun4wp","name":"Raygun","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2017-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5226241-dbf4-42e5-b9f4-77da125fa810","source":"wordfence","cve":"","title":"Easy Digital Downloads <= 2.10.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5226241-dbf4-42e5-b9f4-77da125fa810?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":false,"patched_in":"2.10.3"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b52427e6-dfe2-42be-af2a-6ee5a1e22bf5","source":"wordfence","cve":"CVE-2026-81766","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) < 9.8.0 - Authenticated (Custom Role+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b52427e6-dfe2-42be-af2a-6ee5a1e22bf5?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":false,"patched_in":"9.8.0"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:32:24Z"},{"id":"wordfence:b524e239-0a7c-4515-8126-4fd298e43bdd","source":"wordfence","cve":"","title":"OneLogin SAML SSO <= 2.4.2 - Use of Vulnerable Component","severity":"high","cvss":7.3,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b524e239-0a7c-4515-8126-4fd298e43bdd?source=api-prod","affected":[{"type":"plugin","slug":"onelogin-saml-sso","name":"OneLogin SAML SSO","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2016-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b526b331-8c02-44b1-9555-156afe7ad45a","source":"wordfence","cve":"CVE-2014-6059","title":"Advanced Access Manager <= 2.8.2 - Arbitrary File Overwrite","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b526b331-8c02-44b1-9555-156afe7ad45a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":false,"patched_in":"2.8.3"}],"published":"2014-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc","source":"wordfence","cve":"CVE-2024-1125","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-03-08T00:00:00Z","updated":"2024-10-24T18:58:30Z"},{"id":"wordfence:b52ae51d-7b9a-4047-82bf-723ea87d2375","source":"wordfence","cve":"CVE-2017-20207","title":"Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b52ae51d-7b9a-4047-82bf-723ea87d2375?source=api-prod","affected":[{"type":"plugin","slug":"flickr-gallery","name":"Flickr Gallery","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2017-10-02T00:00:00Z","updated":"2025-10-18T03:33:24Z"},{"id":"wordfence:b52e0207-4314-49f9-9c67-9b33f1ee31bc","source":"wordfence","cve":"CVE-2025-31793","title":"Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b52e0207-4314-49f9-9c67-9b33f1ee31bc?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:07:06Z"},{"id":"wordfence:b52fe73f-3e90-40d6-bccc-d535c3b426d0","source":"wordfence","cve":"CVE-2025-30849","title":"Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b52fe73f-3e90-40d6-bccc-d535c3b426d0?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:36:06Z"},{"id":"wordfence:b53066d3-2ff3-4460-896a-facd77455914","source":"wordfence","cve":"CVE-2024-8485","title":"REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b53066d3-2ff3-4460-896a-facd77455914?source=api-prod","affected":[{"type":"plugin","slug":"rest-api-to-miniprogram","name":"REST API TO MiniProgram","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2024-09-24T12:22:54Z","updated":"2024-12-05T15:54:00Z"},{"id":"wordfence:b530d1a3-dd3c-4efb-9cff-39b6908f11c9","source":"wordfence","cve":"CVE-2014-2550","title":"Disable Comments \u2013 Remove Comments & Stop Spam [Multi-Site Support] < 1.0.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b530d1a3-dd3c-4efb-9cff-39b6908f11c9?source=api-prod","affected":[{"type":"plugin","slug":"disable-comments","name":"Disable Comments","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5318c2d-7b58-4830-bbc0-6d160968290f","source":"wordfence","cve":"CVE-2023-5653","title":"WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored Cross-Site Scripting via IP","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5318c2d-7b58-4830-bbc0-6d160968290f?source=api-prod","affected":[{"type":"plugin","slug":"wassup","name":"WassUp Real Time Analytics","from":"*","from_inclusive":true,"to":"1.9.4.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b535d4b1-3e57-49e3-b208-be0a64855017","source":"wordfence","cve":"CVE-2025-57991","title":"Clariti <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b535d4b1-3e57-49e3-b208-be0a64855017?source=api-prod","affected":[{"type":"plugin","slug":"clariti","name":"Clariti","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:24:55Z"},{"id":"wordfence:b536028d-4e11-4bda-8097-b37857a28309","source":"wordfence","cve":"","title":"Thumbnail For Excerpts <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b536028d-4e11-4bda-8097-b37857a28309?source=api-prod","affected":[{"type":"plugin","slug":"thumbnail-for-excerpts","name":"Thumbnail For Excerpts","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b536563f-b978-4ba6-8a28-d8ee6b87964a","source":"wordfence","cve":"CVE-2019-14682","title":"ACF Better Search <= 3.3.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b536563f-b978-4ba6-8a28-d8ee6b87964a?source=api-prod","affected":[{"type":"plugin","slug":"acf-better-search","name":"ACF: Better Search","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":false,"patched_in":"3.3.1"}],"published":"2019-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b537637b-32c0-405e-94fa-c7c2d0c80658","source":"wordfence","cve":"CVE-2024-1976","title":"Marketing Optimizer <= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b537637b-32c0-405e-94fa-c7c2d0c80658?source=api-prod","affected":[{"type":"plugin","slug":"marketing-optimizer","name":"Marketing Optimizer","from":"*","from_inclusive":true,"to":"20200925","to_inclusive":true,"patched_in":""}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T05:32:23Z"},{"id":"wordfence:b53bccdd-ed92-4831-bc63-3b96c9aee6e2","source":"wordfence","cve":"CVE-2015-1000010","title":"Simple Image Manipulator <= 1.0 - Remote File Download","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b53bccdd-ed92-4831-bc63-3b96c9aee6e2?source=api-prod","affected":[{"type":"plugin","slug":"simple-image-manipulator","name":"Simple Image Manipulator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b53c66f6-337b-426d-a471-03c4ebadd5cf","source":"wordfence","cve":"CVE-2025-23630","title":"Cyber Slider <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b53c66f6-337b-426d-a471-03c4ebadd5cf?source=api-prod","affected":[{"type":"plugin","slug":"cyber-new-slider","name":"Cyber Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:05:18Z"},{"id":"wordfence:b53ce9a7-bc88-4940-8397-6eb0012ac276","source":"wordfence","cve":"CVE-2025-53434","title":"ChildHope <= 1.1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b53ce9a7-bc88-4940-8397-6eb0012ac276?source=api-prod","affected":[{"type":"theme","slug":"childhope","name":"ChildHope | Child Adoption Services & Nonprofit Theme","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:25:18Z"},{"id":"wordfence:b53e6c9e-f78f-44e8-ad0f-8cfaaac8b53f","source":"wordfence","cve":"CVE-2021-24673","title":"Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b53e6c9e-f78f-44e8-ad0f-8cfaaac8b53f?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b54307fb-ecbc-4742-9deb-59dbb85b4a7c","source":"wordfence","cve":"CVE-2023-50879","title":"WordPress.com Editing Toolkit <= 3.78784 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54307fb-ecbc-4742-9deb-59dbb85b4a7c?source=api-prod","affected":[{"type":"plugin","slug":"full-site-editing","name":"WordPress.com Editing Toolkit","from":"*","from_inclusive":true,"to":"3.78784","to_inclusive":true,"patched_in":"3.79150"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5451529-2e3f-414e-884e-cc6761431262","source":"wordfence","cve":"CVE-2024-39648","title":"Eventin <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5451529-2e3f-414e-884e-cc6761431262?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:22:11Z"},{"id":"wordfence:b54682f6-914e-4c16-b8fb-63b5dcb14933","source":"wordfence","cve":"CVE-2026-103882","title":"Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54682f6-914e-4c16-b8fb-63b5dcb14933?source=api-prod","affected":[{"type":"plugin","slug":"acadlix","name":"Acadlix LMS \u2013 AI Quiz Maker, Online Exam & Course Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-10-30T20:09:07Z","updated":"2026-10-31T08:30:46Z"},{"id":"wordfence:b5490dd9-20d5-4cd6-bc09-5da94d3e702f","source":"wordfence","cve":"CVE-2021-25037","title":"All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection","severity":"critical","cvss":9.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5490dd9-20d5-4cd6-bc09-5da94d3e702f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"4.1.3.1","from_inclusive":true,"to":"4.1.5.2","to_inclusive":true,"patched_in":"4.1.5.3"}],"published":"2021-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b54af5b0-d79a-4fb2-965f-d3ff4956dc5a","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54af5b0-d79a-4fb2-965f-d3ff4956dc5a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:52:37Z"},{"id":"wordfence:b54f38b6-5f98-469c-802a-a4c1e1f2ab0e","source":"wordfence","cve":"CVE-2022-1654","title":"Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 - Authenticated Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54f38b6-5f98-469c-802a-a4c1e1f2ab0e?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"},{"type":"theme","slug":"jupiter","name":"Jupiter","from":"*","from_inclusive":true,"to":"6.10.1","to_inclusive":true,"patched_in":"6.10.2"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b54f5a6b-54fa-4bac-8943-fc75fe215c6e","source":"wordfence","cve":"CVE-2026-114697","title":"QA Assistants \u2013 Driven by data <= 5.3.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54f5a6b-54fa-4bac-8943-fc75fe215c6e?source=api-prod","affected":[{"type":"plugin","slug":"qa-heatmap-analytics","name":"QA Assistants \u2013 Driven by data","from":"*","from_inclusive":true,"to":"5.3.0.1","to_inclusive":true,"patched_in":"5.3.0.2"}],"published":"2026-10-22T07:38:36Z","updated":"2026-10-28T01:20:39Z"},{"id":"wordfence:b54fa719-0ac2-4017-b312-4b4a9bced16d","source":"wordfence","cve":"CVE-2024-47363","title":"Blockspare <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b54fa719-0ac2-4017-b312-4b4a9bced16d?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:28:32Z"},{"id":"wordfence:b550a140-0bdc-4840-806a-3eaceee7e42f","source":"wordfence","cve":"CVE-2024-47636","title":"JobSearch <= 2.5.9 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b550a140-0bdc-4840-806a-3eaceee7e42f?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T14:10:09Z"},{"id":"wordfence:b55128e9-f79f-4872-931f-c6f4d1d12032","source":"wordfence","cve":"CVE-2016-10962","title":"Icegram <= 1.9.18 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55128e9-f79f-4872-931f-c6f4d1d12032?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"1.9.19","to_inclusive":false,"patched_in":"1.9.19"}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5541170-fd01-4d6d-934c-bfce446b3b55","source":"wordfence","cve":"","title":"WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5541170-fd01-4d6d-934c-bfce446b3b55?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.37","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.32","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.33","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.26","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.28","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.25","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.23","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.21","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.18","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.16","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"4.7.38"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:04:06Z"},{"id":"wordfence:b55567e9-24e6-4738-b7f7-b95b541e6067","source":"wordfence","cve":"CVE-2025-1307","title":"Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55567e9-24e6-4738-b7f7-b95b541e6067?source=api-prod","affected":[{"type":"theme","slug":"newscrunch","name":"Newscrunch","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.4.1"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-04T04:26:09Z"},{"id":"wordfence:b556bb3b-0fea-48a9-a893-3ad015559f3d","source":"wordfence","cve":"CVE-2023-46821","title":"GD Security Headers <= 1.7 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b556bb3b-0fea-48a9-a893-3ad015559f3d?source=api-prod","affected":[{"type":"plugin","slug":"gd-security-headers","name":"GD Security Headers","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b55722f9-a0b9-4484-bd3b-c21dbe5716ee","source":"wordfence","cve":"CVE-2024-13695","title":"Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55722f9-a0b9-4484-bd3b-c21dbe5716ee?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"7.0"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T09:21:33Z"},{"id":"wordfence:b5582e89-83e6-4898-b9fe-09eddeb5f7ae","source":"wordfence","cve":"CVE-2022-4973","title":"WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5582e89-83e6-4898-b9fe-09eddeb5f7ae?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.38","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.36","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.35","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.32","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.28","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.27","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.26","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.23","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.19","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.20","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.16","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.13","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.12","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.9","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"3.7.39"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"3.7.39"}],"published":"2022-08-30T00:00:00Z","updated":"2024-10-16T06:43:41Z"},{"id":"wordfence:b55853e1-2f20-417f-b07e-eda758eaed32","source":"wordfence","cve":"CVE-2023-22695","title":"Custom Field Template <= 2.5.8 - Cross-Site Request Forgery via Plugin Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55853e1-2f20-417f-b07e-eda758eaed32?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b559017c-f1d2-4f18-bfb6-e52f05910e34","source":"wordfence","cve":"CVE-2025-0801","title":"RateMyAgent Official <= 1.4.0 - Cross-Site Request Forgery to API Key Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b559017c-f1d2-4f18-bfb6-e52f05910e34?source=api-prod","affected":[{"type":"plugin","slug":"ratemyagent-official","name":"RateMyAgent Official","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-02-27T16:15:48Z","updated":"2025-02-28T04:21:57Z"},{"id":"wordfence:b55a80ed-5e27-4087-a792-e78066a41399","source":"wordfence","cve":"CVE-2022-41635","title":"Advanced Shipment Tracking for WooCommerce <= 3.5.2 - Cross-Site Request Forgery via paginate_shipping_provider_list and filter_shipping_provider_list","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55a80ed-5e27-4087-a792-e78066a41399?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-shipment-tracking","name":"Advanced Shipment Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b55e573d-209c-4039-afe5-b3c135c1ba54","source":"wordfence","cve":"","title":"Oxygen 6.0 - 6.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b55e573d-209c-4039-afe5-b3c135c1ba54?source=api-prod","affected":[{"type":"plugin","slug":"oxygen","name":"Oxygen","from":"6.0","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-02T13:29:20Z"},{"id":"wordfence:b56076bd-4a15-4857-9443-b36eed66d5c2","source":"wordfence","cve":"CVE-2024-34388","title":"GDPR Compliance <= 1.2.5 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b56076bd-4a15-4857-9443-b36eed66d5c2?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliance","name":"GDPR Compliance","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-07T19:02:00Z"},{"id":"wordfence:b5635423-d17a-4f04-a164-64bf141b6bb4","source":"wordfence","cve":"","title":"IP Blacklist Cloud < 3.43 - Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5635423-d17a-4f04-a164-64bf141b6bb4?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":false,"patched_in":"3.43"}],"published":"2015-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5639c00-f34c-45e3-8ff1-dfde7856a80e","source":"wordfence","cve":"","title":"WPML <= 4.6.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5639c00-f34c-45e3-8ff1-dfde7856a80e?source=api-prod","affected":[{"type":"plugin","slug":"wpml","name":"wpml","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b563f0a0-4d9e-4b6c-baeb-437f9c48b557","source":"wordfence","cve":"CVE-2024-43329","title":"Allegiant <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b563f0a0-4d9e-4b6c-baeb-437f9c48b557?source=api-prod","affected":[{"type":"theme","slug":"allegiant","name":"Allegiant","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2025-11-06T14:36:28Z"},{"id":"wordfence:b564eacd-1561-4c42-8a9e-395d4e951723","source":"wordfence","cve":"CVE-2025-7810","title":"StreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b564eacd-1561-4c42-8a9e-395d4e951723?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-kick-integration","name":"StreamWeasels Kick Integration","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-07-28T00:00:00Z","updated":"2025-07-29T03:41:22Z"},{"id":"wordfence:b5675962-7d7f-46f4-b588-e46af212e9c8","source":"wordfence","cve":"CVE-2022-0230","title":"Better WordPress Google XML Sitemaps <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5675962-7d7f-46f4-b588-e46af212e9c8?source=api-prod","affected":[{"type":"plugin","slug":"bwp-google-xml-sitemaps","name":"Better WordPress Google XML Sitemaps (support Sitemap Index, Multi-site and Google News)","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b56a3e53-ae1a-4bec-8350-3df157c4ab3c","source":"wordfence","cve":"CVE-2026-17019","title":"JetEngine <= 3.8.13.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b56a3e53-ae1a-4bec-8350-3df157c4ab3c?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.13.0","to_inclusive":true,"patched_in":"3.8.13.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-15T21:51:50Z"},{"id":"wordfence:b56a5ff2-10cb-4eee-9409-7f8a22d00358","source":"wordfence","cve":"","title":"WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b56a5ff2-10cb-4eee-9409-7f8a22d00358?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b56abce9-82f8-4d73-bf97-cb1e2b65515b","source":"wordfence","cve":"CVE-2026-24359","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b56abce9-82f8-4d73-bf97-cb1e2b65515b?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:14:26Z"},{"id":"wordfence:b56cef33-057b-4c40-945f-68306597b00b","source":"wordfence","cve":"CVE-2025-13405","title":"Ace Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b56cef33-057b-4c40-945f-68306597b00b?source=api-prod","affected":[{"type":"plugin","slug":"ace-post-type-builder","name":"Ace Post Type Builder","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-11-24T19:07:20Z","updated":"2025-12-09T22:02:54Z"},{"id":"wordfence:b5715acd-62e6-4cd8-8fe8-4b1412f287c9","source":"wordfence","cve":"CVE-2026-11983","title":"Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5715acd-62e6-4cd8-8fe8-4b1412f287c9?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.16","to_inclusive":true,"patched_in":"2.8.17"}],"published":"2026-08-05T22:18:05Z","updated":"2026-08-06T11:29:20Z"},{"id":"wordfence:b57749db-0a47-44f8-8607-d0d962c5ced2","source":"wordfence","cve":"CVE-2025-13971","title":"TWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b57749db-0a47-44f8-8607-d0d962c5ced2?source=api-prod","affected":[{"type":"plugin","slug":"twwc-protein","name":"TWW Protein Calculator","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:33:26Z","updated":"2025-12-12T03:20:54Z"},{"id":"wordfence:b579dd6a-6bbe-4302-b1d5-6624537f874c","source":"wordfence","cve":"CVE-2025-62900","title":"Popular Posts by Webline <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b579dd6a-6bbe-4302-b1d5-6624537f874c?source=api-prod","affected":[{"type":"plugin","slug":"popular-posts-by-webline","name":"Popular Posts by Webline","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-27T00:00:00Z","updated":"2025-10-29T15:05:49Z"},{"id":"wordfence:b57c9e58-64a6-48e8-8ef6-25608e4131e6","source":"wordfence","cve":"CVE-2024-9769","title":"Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b57c9e58-64a6-48e8-8ef6-25608e4131e6?source=api-prod","affected":[{"type":"plugin","slug":"gallery-videos","name":"Video Gallery \u2013 YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-12-05T14:36:35Z","updated":"2024-12-06T03:25:41Z"},{"id":"wordfence:b57d3d1d-dcdb-4f11-82d8-183778baa075","source":"wordfence","cve":"CVE-2023-7019","title":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b57d3d1d-dcdb-4f11-82d8-183778baa075?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:13Z"},{"id":"wordfence:b57dc78f-b28e-449e-8993-72836babc12e","source":"wordfence","cve":"CVE-2025-32582","title":"WP AutoKeyword <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b57dc78f-b28e-449e-8993-72836babc12e?source=api-prod","affected":[{"type":"plugin","slug":"wp-autokeyword","name":"WP AutoKeyword","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:01:30Z"},{"id":"wordfence:b57dd8e3-e3e1-4d6b-b9dd-b5a24c4886b4","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirectRule' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b57dd8e3-e3e1-4d6b-b9dd-b5a24c4886b4?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5818587-0a52-4734-8f75-263b4ab5020e","source":"wordfence","cve":"CVE-2024-8428","title":"ForumWP \u2013 Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5818587-0a52-4734-8f75-263b4ab5020e?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-09-06T01:21:28Z","updated":"2024-10-03T13:30:34Z"},{"id":"wordfence:b581e866-2b3b-4d6f-8bd3-d370c6482d12","source":"wordfence","cve":"CVE-2021-24654","title":"User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b581e866-2b3b-4d6f-8bd3-d370c6482d12?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b58403df-af09-4d74-88e6-140e3f2f291b","source":"wordfence","cve":"CVE-2023-3412","title":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images \u2013 Lite <= 1.0.0 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58403df-af09-4d74-88e6-140e3f2f291b?source=api-prod","affected":[{"type":"plugin","slug":"image-map-pro-lite","name":"Image Map Pro \u2013 Drag-and-drop Builder for Interactive Images \u2013 Lite","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5847c98-7880-4dda-a5d9-9597763fde6b","source":"wordfence","cve":"CVE-2026-39600","title":"Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects","severity":"high","cvss":7.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5847c98-7880-4dda-a5d9-9597763fde6b?source=api-prod","affected":[{"type":"plugin","slug":"aculect-ai-companion","name":"Aculect AI Companion","from":"*","from_inclusive":true,"to":"0.8.2","to_inclusive":true,"patched_in":"0.8.3"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-13T17:01:17Z"},{"id":"wordfence:b588b8d0-5d71-4e95-ad97-821e47b013c8","source":"wordfence","cve":"CVE-2024-12162","title":"Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b588b8d0-5d71-4e95-ad97-821e47b013c8?source=api-prod","affected":[{"type":"plugin","slug":"gallery-for-ultimate-member","name":"Video & Photo Gallery for Ultimate Member","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:15Z"},{"id":"wordfence:b5891b39-5ab6-4002-97c2-ae6a5e4d8d5f","source":"wordfence","cve":"CVE-2025-69136","title":"Wanium <= 1.9.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5891b39-5ab6-4002-97c2-ae6a5e4d8d5f?source=api-prod","affected":[{"type":"theme","slug":"wanium","name":"Wanium - A Elegant Multi-Concept Theme","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:16:40Z"},{"id":"wordfence:b5892b38-b46b-4aab-89d4-ba70369b8526","source":"wordfence","cve":"CVE-2026-82023","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5892b38-b46b-4aab-89d4-ba70369b8526?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-16T16:11:16Z"},{"id":"wordfence:b58a9e6a-f12e-46d2-ab0d-75bc2e3a00b2","source":"wordfence","cve":"CVE-2025-58262","title":"Sweet Energy Efficiency <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58a9e6a-f12e-46d2-ab0d-75bc2e3a00b2?source=api-prod","affected":[{"type":"plugin","slug":"sweet-energy-efficiency","name":"Sweet Energy Efficiency","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-27T21:06:40Z"},{"id":"wordfence:b58ab962-955d-4c77-93f7-40b9845b05c8","source":"wordfence","cve":"CVE-2025-22356","title":"Stencies <= 0.58 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58ab962-955d-4c77-93f7-40b9845b05c8?source=api-prod","affected":[{"type":"plugin","slug":"stencies","name":"Stencies","from":"*","from_inclusive":true,"to":"0.58","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:05:27Z"},{"id":"wordfence:b58b0c43-8564-4aa4-8c30-8d3e1839c0e6","source":"wordfence","cve":"CVE-2025-23769","title":"Content Mirror <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58b0c43-8564-4aa4-8c30-8d3e1839c0e6?source=api-prod","affected":[{"type":"plugin","slug":"content-mirror","name":"Content Mirror","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:10:15Z"},{"id":"wordfence:b58d905b-302e-47c3-8abb-354e7ff28a8f","source":"wordfence","cve":"CVE-2024-43929","title":"JobSearch <= 2.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58d905b-302e-47c3-8abb-354e7ff28a8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:26:25Z"},{"id":"wordfence:b58e7192-2159-4f77-baba-05a57a545c7b","source":"wordfence","cve":"CVE-2025-30796","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58e7192-2159-4f77-baba-05a57a545c7b?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:32:19Z"},{"id":"wordfence:b58f6681-800e-4ae1-8f89-2160c4446064","source":"wordfence","cve":"CVE-2025-60213","title":"Scape <= 1.5.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b58f6681-800e-4ae1-8f89-2160c4446064?source=api-prod","affected":[{"type":"theme","slug":"scape","name":"Scape - Multipurpose WordPress theme","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-07T00:00:00Z","updated":"2025-11-04T16:24:49Z"},{"id":"wordfence:b591b7df-8492-4f66-8884-b4b27c0f0a11","source":"wordfence","cve":"CVE-2026-32414","title":"Advanced Woo Labels <= 2.36 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b591b7df-8492-4f66-8884-b4b27c0f0a11?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.36","to_inclusive":true,"patched_in":"2.37"}],"published":"2026-02-25T00:00:00Z","updated":"2026-05-05T14:38:35Z"},{"id":"wordfence:b5930612-e37f-4886-bc47-ecc35821f4a2","source":"wordfence","cve":"CVE-2024-51644","title":"Addressbook <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5930612-e37f-4886-bc47-ecc35821f4a2?source=api-prod","affected":[{"type":"plugin","slug":"addressbook","name":"Addressbook","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:31:38Z"},{"id":"wordfence:b594b771-4d0b-46e1-b4c6-751c994992af","source":"wordfence","cve":"CVE-2023-0499","title":"QuickSwish <= 1.0.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b594b771-4d0b-46e1-b4c6-751c994992af?source=api-prod","affected":[{"type":"plugin","slug":"quickswish","name":"QuickSwish \u2013 WooCommerce Product Quick View","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b594d0e9-d805-48b9-bfd4-4cc77dd3a70e","source":"wordfence","cve":"CVE-2026-6101","title":"AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b594d0e9-d805-48b9-bfd4-4cc77dd3a70e?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-07T13:32:10Z"},{"id":"wordfence:b597e8a5-043e-440e-aaa2-38fb3eeb0731","source":"wordfence","cve":"","title":"WP SMS \u2013 Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b597e8a5-043e-440e-aaa2-38fb3eeb0731?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":true,"patched_in":"5.4.9.1"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b59ac36c-41b7-46eb-9677-639e45187992","source":"wordfence","cve":"CVE-2021-24577","title":"Coming soon and Maintenance mode <= 3.5.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59ac36c-41b7-46eb-9677-639e45187992?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-page","name":"Coming soon and Maintenance mode","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b59b5c41-6173-485e-869d-4165dc18e2bd","source":"wordfence","cve":"CVE-2023-5105","title":"Frontend File Manager Plugin <= 22.5 - Authenticated (Editor+) Directory Traversal","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59b5c41-6173-485e-869d-4165dc18e2bd?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"22.5","to_inclusive":true,"patched_in":"22.6"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b59decf5-938c-4a5f-a839-47e19e978c84","source":"wordfence","cve":"CVE-2024-43293","title":"Recipe Card Blocks for Gutenberg & Elementor <= 3.3.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59decf5-938c-4a5f-a839-47e19e978c84?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:29:57Z"},{"id":"wordfence:b59e2773-31f0-4c19-b066-30982761bc44","source":"wordfence","cve":"CVE-2026-15407","title":"Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59e2773-31f0-4c19-b066-30982761bc44?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.7.7","to_inclusive":true,"patched_in":"7.7.8"}],"published":"2026-07-15T00:00:00Z","updated":"2026-07-16T07:51:05Z"},{"id":"wordfence:b59ef0f8-3186-48f8-ade3-a7afe9e4f8ff","source":"wordfence","cve":"CVE-2026-40750","title":"Kids Online Store <= 0.8.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59ef0f8-3186-48f8-ade3-a7afe9e4f8ff?source=api-prod","affected":[{"type":"theme","slug":"kids-online-store","name":"Kids Online Store","from":"*","from_inclusive":true,"to":"0.8.9","to_inclusive":true,"patched_in":"0.9.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:24:55Z"},{"id":"wordfence:b59f13b9-8ad3-44a7-90a0-1f959ba55700","source":"wordfence","cve":"","title":"WooCommerce Store Exporter <= 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b59f13b9-8ad3-44a7-90a0-1f959ba55700?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2014-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5a065d7-54de-46b4-ba88-9467d0724d33","source":"wordfence","cve":"CVE-2024-13332","title":"TransFinanz <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a065d7-54de-46b4-ba88-9467d0724d33?source=api-prod","affected":[{"type":"plugin","slug":"transfinanz","name":"TransFinanz","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:24:34Z"},{"id":"wordfence:b5a07a44-98f9-4795-8615-c73a9b161c74","source":"wordfence","cve":"CVE-2024-30506","title":"All In One Redirection <=  2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a07a44-98f9-4795-8615-c73a9b161c74?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-redirection","name":"All In One Redirection","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:11:04Z"},{"id":"wordfence:b5a1baaa-d593-4559-953c-9393bde8d711","source":"wordfence","cve":"CVE-2014-4663","title":"Ajax Search Lite < 3.11 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a1baaa-d593-4559-953c-9393bde8d711?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"3.11","to_inclusive":false,"patched_in":"3.11"}],"published":"2014-06-24T00:00:00Z","updated":"2024-10-15T18:24:45Z"},{"id":"wordfence:b5a24a4a-654c-487e-af68-13db63961896","source":"wordfence","cve":"CVE-2025-8290","title":"List Subpages <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a24a4a-654c-487e-af68-13db63961896?source=api-prod","affected":[{"type":"plugin","slug":"list-sub-pages","name":"List Sub Pages","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-08-28T15:44:49Z","updated":"2025-10-21T20:59:44Z"},{"id":"wordfence:b5a45b0d-aa47-45ac-80a9-0a30af3f91ce","source":"wordfence","cve":"CVE-2014-8815","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a45b0d-aa47-45ac-80a9-0a30af3f91ce?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2014-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5a6e427-d46c-4ed9-b149-101d9d87a7c5","source":"wordfence","cve":"CVE-2026-57743","title":"RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a6e427-d46c-4ed9-b149-101d9d87a7c5?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:38:35Z"},{"id":"wordfence:b5a7ddea-76db-4009-83a0-92d9ccfe1da4","source":"wordfence","cve":"CVE-2024-5975","title":"CZ Loan Management <= 1.1 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a7ddea-76db-4009-83a0-92d9ccfe1da4?source=api-prod","affected":[{"type":"plugin","slug":"cz-loan-management","name":"CZ Loan Management","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T20:36:54Z"},{"id":"wordfence:b5a99c97-19a4-41ab-a24f-3cc8f4be7073","source":"wordfence","cve":"CVE-2022-1673","title":"WooCommerce Green Wallet Gateway <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a99c97-19a4-41ab-a24f-3cc8f4be7073?source=api-prod","affected":[{"type":"plugin","slug":"greenwallet-gateway","name":"WooCommerce Green Wallet Gateway","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2022-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5aa0222-1e70-4c06-860f-77643da4356c","source":"wordfence","cve":"CVE-2024-6573","title":"Intelligence <= 1.4.0 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5aa0222-1e70-4c06-860f-77643da4356c?source=api-prod","affected":[{"type":"plugin","slug":"intelligence","name":"Intelligence","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:05:57Z","updated":"2024-07-27T01:51:06Z"},{"id":"wordfence:b5aa18ef-999c-439a-82b3-fd7f416a2e3e","source":"wordfence","cve":"CVE-2026-94177","title":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5aa18ef-999c-439a-82b3-fd7f416a2e3e?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":true,"patched_in":"8.0.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T16:34:45Z"},{"id":"wordfence:b5ab022c-c16c-488b-b004-a7351f8fa3d3","source":"wordfence","cve":"CVE-2024-5757","title":"Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ab022c-c16c-488b-b004-a7351f8fa3d3?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.35","to_inclusive":true,"patched_in":"1.6.36"}],"published":"2024-06-12T17:22:17Z","updated":"2024-06-13T05:34:47Z"},{"id":"wordfence:b5abfc19-dc34-4458-a0af-5587b7d5a6b9","source":"wordfence","cve":"CVE-2022-29426","title":"Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5abfc19-dc34-4458-a0af-5587b7d5a6b9?source=api-prod","affected":[{"type":"plugin","slug":"2j-slideshow","name":"Slideshow, Image Slider by 2J","from":"*","from_inclusive":true,"to":"1.3.54","to_inclusive":true,"patched_in":""}],"published":"2022-05-04T07:18:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5aeab8b-86f7-4453-9070-632dceaf137d","source":"wordfence","cve":"CVE-2026-104913","title":"Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5aeab8b-86f7-4453-9070-632dceaf137d?source=api-prod","affected":[{"type":"plugin","slug":"interactive-real-estate","name":"Interactive Real Estate \u2013 Floor Plan & Building Visualizer","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-11-06T13:55:37Z","updated":"2026-11-07T02:29:16Z"},{"id":"wordfence:b5b1d979-e366-454e-af90-4f5523a11e24","source":"wordfence","cve":"CVE-2026-27385","title":"DesignThemes Portfolio <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5b1d979-e366-454e-af90-4f5523a11e24?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-portfolio","name":"designthemes-portfolio","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T17:54:59Z"},{"id":"wordfence:b5b24f80-d3a4-452b-bc83-3576bdc62829","source":"wordfence","cve":"CVE-2014-6243","title":"EWWW Image Optimizer <= 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5b24f80-d3a4-452b-bc83-3576bdc62829?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2014-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5b2c17a-60e8-4960-bec5-e0c4d58df16b","source":"wordfence","cve":"CVE-2025-63012","title":"Hotel Booking <= 2.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5b2c17a-60e8-4960-bec5-e0c4d58df16b?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-11-05T00:00:00Z","updated":"2026-02-26T15:26:07Z"},{"id":"wordfence:b5b5d36d-02de-4569-b2cf-addc122ebe34","source":"wordfence","cve":"CVE-2015-4694","title":"Zip Attachments <= 1.5 - Directory Traversal","severity":"high","cvss":8.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5b5d36d-02de-4569-b2cf-addc122ebe34?source=api-prod","affected":[{"type":"plugin","slug":"zip-attachments","name":"Zip Attachments","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2015-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5b6b0fe-ccaf-4ec3-97d2-4aa972ad6833","source":"wordfence","cve":"CVE-2026-57660","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5b6b0fe-ccaf-4ec3-97d2-4aa972ad6833?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:34:30Z"},{"id":"wordfence:b5ba2813-56ff-45d0-966a-f83da862ec13","source":"wordfence","cve":"","title":"Slideshow Gallery <= 1.6.5 - Cross-Site Scripting via method","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ba2813-56ff-45d0-966a-f83da862ec13?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5baecfe-ce0b-4cec-8462-bfd7eadd41e9","source":"wordfence","cve":"CVE-2026-15780","title":"WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5baecfe-ce0b-4cec-8462-bfd7eadd41e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.8","to_inclusive":true,"patched_in":"14.16.9"}],"published":"2026-08-18T17:50:58Z","updated":"2026-08-19T06:37:54Z"},{"id":"wordfence:b5bb14c1-8713-4aa1-b50a-53bed07a5f80","source":"wordfence","cve":"CVE-2025-11994","title":"Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bb14c1-8713-4aa1-b50a-53bed07a5f80?source=api-prod","affected":[{"type":"plugin","slug":"email-subscription-with-secure-captcha","name":"Easy Email Subscription","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-11-11T21:45:38Z","updated":"2025-11-12T11:05:39Z"},{"id":"wordfence:b5bd19ba-cca0-463b-84f2-3bb9a378dee1","source":"wordfence","cve":"CVE-2025-23433","title":"vcOS <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bd19ba-cca0-463b-84f2-3bb9a378dee1?source=api-prod","affected":[{"type":"plugin","slug":"vcos","name":"vcOS","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:38:04Z"},{"id":"wordfence:b5bd3852-c1a5-4d7d-b4fb-59911fba4873","source":"wordfence","cve":"CVE-2023-32794","title":"WooCommerce Product Add-ons <= 6.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bd3852-c1a5-4d7d-b4fb-59911fba4873?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addons","name":"WooCommerce Product Add-ons","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5bdf526-8378-413f-b51e-24351dd0774b","source":"wordfence","cve":"CVE-2021-34648","title":"Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection","severity":"medium","cvss":6.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5bdf526-8378-413f-b51e-24351dd0774b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2021-09-22T15:21:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5be7952-77cb-4b69-a41d-58edf80b24bb","source":"wordfence","cve":"CVE-2025-31907","title":"Team Builder <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5be7952-77cb-4b69-a41d-58edf80b24bb?source=api-prod","affected":[{"type":"plugin","slug":"team-display","name":"Team Builder \u2013 Meet the Team","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-09T14:24:32Z"},{"id":"wordfence:b5c171fb-5053-455d-8aa0-db51b80f7a65","source":"wordfence","cve":"CVE-2022-1469","title":"FiboSearch <= 1.17.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c171fb-5053-455d-8aa0-db51b80f7a65?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5c4064b-6cfa-455c-9193-3d863be34f27","source":"wordfence","cve":"CVE-2024-3992","title":"Amen <= 3.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c4064b-6cfa-455c-9193-3d863be34f27?source=api-prod","affected":[{"type":"plugin","slug":"amen","name":"Amen","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:36:34Z"},{"id":"wordfence:b5c43d68-8f6d-486e-8bb3-7de282fe96b3","source":"wordfence","cve":"CVE-2025-24717","title":"Modal Window <= 6.1.4 - Cross-Site Request Forgery to Settings Ipdate","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c43d68-8f6d-486e-8bb3-7de282fe96b3?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:10:22Z"},{"id":"wordfence:b5c600b4-10d6-4b0b-9ca0-7c629d383d33","source":"wordfence","cve":"CVE-2024-49264","title":"Events Addon for Elementor <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c600b4-10d6-4b0b-9ca0-7c629d383d33?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-21T17:51:44Z"},{"id":"wordfence:b5c61212-e68e-4198-b078-18121576b767","source":"wordfence","cve":"CVE-2023-1978","title":"ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c61212-e68e-4198-b078-18121576b767?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.25","to_inclusive":true,"patched_in":"4.9.26"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5c6f351-477b-4384-9863-fe3b45ddf21d","source":"wordfence","cve":"CVE-2024-0702","title":"Oliver POS \u2013 A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c6f351-477b-4384-9863-fe3b45ddf21d?source=api-prod","affected":[{"type":"plugin","slug":"oliver-pos","name":"Oliver POS \u2013 WooCommerce POS for iPhone, iPad & Android","from":"*","from_inclusive":true,"to":"2.4.2.0","to_inclusive":true,"patched_in":"2.4.2.1"}],"published":"2024-02-19T00:00:00Z","updated":"2024-07-29T21:37:14Z"},{"id":"wordfence:b5c715f9-8655-448e-a8d2-71f24c9d48ba","source":"wordfence","cve":"CVE-2022-4330","title":"WP Attachments <= 5.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c715f9-8655-448e-a8d2-71f24c9d48ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachments","name":"WP Attachments \u2013 Smarter File Management & Download Lists","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5c88472-0bb1-4bd9-9a72-154f0e95d104","source":"wordfence","cve":"CVE-2024-47305","title":"Use Any Font <= 6.3.08 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c88472-0bb1-4bd9-9a72-154f0e95d104?source=api-prod","affected":[{"type":"plugin","slug":"use-any-font","name":"Use Any Font | Custom Font Uploader","from":"*","from_inclusive":true,"to":"6.3.08","to_inclusive":true,"patched_in":"6.3.09"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:05:07Z"},{"id":"wordfence:b5c8ffc7-3b32-410f-94df-75279d668220","source":"wordfence","cve":"CVE-2026-39564","title":"Sunshine Photo Cart < 3.6.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5c8ffc7-3b32-410f-94df-75279d668220?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":false,"patched_in":"3.6.2"}],"published":"2026-03-26T00:00:00Z","updated":"2026-05-12T13:45:57Z"},{"id":"wordfence:b5d08207-9480-42ef-b7b4-b7d01a839c85","source":"wordfence","cve":"CVE-2026-15150","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred < 3.2.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d08207-9480-42ef-b7b4-b7d01a839c85?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:41:36Z"},{"id":"wordfence:b5d4ef88-9cc6-4dd1-b232-c0d08387a328","source":"wordfence","cve":"CVE-2026-32389","title":"NanoCare < 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d4ef88-9cc6-4dd1-b232-c0d08387a328?source=api-prod","affected":[{"type":"theme","slug":"nanocare","name":"Home Health Care, Medical Care WordPress Theme - NanoCare","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:45:02Z"},{"id":"wordfence:b5d5d6ec-bb23-4619-b5d9-9bd965b049b5","source":"wordfence","cve":"CVE-2025-11806","title":"Qzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d5d6ec-bb23-4619-b5d9-9bd965b049b5?source=api-prod","affected":[{"type":"plugin","slug":"qzzr-shortcode","name":"Qzzr Shortcode Plugin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-30T14:01:25Z","updated":"2025-10-31T02:26:04Z"},{"id":"wordfence:b5d5fa87-3cac-46ac-b802-dd9acf3f1fd2","source":"wordfence","cve":"CVE-2025-31857","title":"Directorist AddonsKit for Elementor <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d5fa87-3cac-46ac-b802-dd9acf3f1fd2?source=api-prod","affected":[{"type":"plugin","slug":"addonskit-for-elementor","name":"Directorist AddonsKit for Elementor","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-17T13:17:44Z"},{"id":"wordfence:b5d69895-2fe6-40cf-8d4d-aa274067495a","source":"wordfence","cve":"CVE-2015-9350","title":"Feed Them Social <= 1.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d69895-2fe6-40cf-8d4d-aa274067495a?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5d787e9-b8b7-4ac1-a278-074afabc0239","source":"wordfence","cve":"CVE-2025-54745","title":"miniOrange's Google Authenticator <= 6.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d787e9-b8b7-4ac1-a278-074afabc0239?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T21:57:58Z"},{"id":"wordfence:b5da9901-7bad-4fae-9232-46438ab32ed8","source":"wordfence","cve":"CVE-2026-74016","title":"Smart Cleaning <= 4.8.6 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5da9901-7bad-4fae-9232-46438ab32ed8?source=api-prod","affected":[{"type":"theme","slug":"smart-cleaning","name":"Smart Cleaning","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:06:11Z"},{"id":"wordfence:b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c","source":"wordfence","cve":"CVE-2024-9944","title":"WooCommerce <= 9.0.2 - Unauthenticated HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"9.0.2","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2024-10-14T17:07:11Z","updated":"2024-10-15T05:31:31Z"},{"id":"wordfence:b5e0af52-3e38-4ff4-b53c-c7c35f1b956a","source":"wordfence","cve":"CVE-2026-9235","title":"DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e0af52-3e38-4ff4-b53c-c7c35f1b956a?source=api-prod","affected":[{"type":"plugin","slug":"dhlpwc","name":"DHL eCommerce (Benelux) for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-07-08T20:45:56Z","updated":"2026-07-09T09:31:22Z"},{"id":"wordfence:b5e0b875-ba8c-438f-b2b1-6c713ef604e5","source":"wordfence","cve":"CVE-2014-6412","title":"WordPress Core < 4.4 - Brute Force Password Recovery Tokens","severity":"high","cvss":7.5,"cwe":"CWE-261","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e0b875-ba8c-438f-b2b1-6c713ef604e5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":false,"patched_in":"4.4"}],"published":"2015-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5e64a33-6165-4257-b324-0bbab4129e54","source":"wordfence","cve":"CVE-2026-15296","title":"affiliate-toolkit \u2013 WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e64a33-6165-4257-b324-0bbab4129e54?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-01-23T21:34:28Z","updated":"2026-07-10T04:31:26Z"},{"id":"wordfence:b5e6b059-773a-463f-83c4-28b95bfd6182","source":"wordfence","cve":"CVE-2026-57413","title":"Instant AI Image Generator \u2013 Create & Import Images <= 2.1.4 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e6b059-773a-463f-83c4-28b95bfd6182?source=api-prod","affected":[{"type":"plugin","slug":"ai-image","name":"Instant AI Image Generator \u2013 Create & Import Images","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:10:14Z"},{"id":"wordfence:b5e6d73c-0fa7-4ae2-be3b-5ab8f1721aa6","source":"wordfence","cve":"CVE-2011-5329","title":"Redirection <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e6d73c-0fa7-4ae2-be3b-5ab8f1721aa6?source=api-prod","affected":[{"type":"plugin","slug":"redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5e7edef-65c3-40ff-a773-13439c31f890","source":"wordfence","cve":"CVE-2026-87829","title":"Checkout Field Manager <= 7.9.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5e7edef-65c3-40ff-a773-13439c31f890?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.9.6","to_inclusive":true,"patched_in":"7.9.7"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:44:52Z"},{"id":"wordfence:b5ea849a-2017-4354-96e7-18fd309046f2","source":"wordfence","cve":"CVE-2026-14839","title":"Mapster WP Maps < 1.24.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ea849a-2017-4354-96e7-18fd309046f2?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":false,"patched_in":"1.24.0"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:27:38Z"},{"id":"wordfence:b5ebc99d-b82a-452b-8f53-bd96135aeecb","source":"wordfence","cve":"CVE-2022-21663","title":"WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ebc99d-b82a-452b-8f53-bd96135aeecb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.35","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":false,"patched_in":"3.7.37"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5ec03e9-06bb-4677-b480-4ebdb33acd08","source":"wordfence","cve":"CVE-2023-2330","title":"Caldera Forms Google Sheets Connector <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ec03e9-06bb-4677-b480-4ebdb33acd08?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-caldera-forms","name":"Caldera Forms Google Sheets Connector","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5ed8a39-50b0-4acf-9054-ba389c49f345","source":"wordfence","cve":"CVE-2025-6389","title":"Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ed8a39-50b0-4acf-9054-ba389c49f345?source=api-prod","affected":[{"type":"plugin","slug":"sneeit-framework","name":"Sneeit Framework","from":"*","from_inclusive":true,"to":"8.3","to_inclusive":true,"patched_in":"8.4"}],"published":"2025-11-24T14:03:11Z","updated":"2025-11-25T02:26:49Z"},{"id":"wordfence:b5ef15c4-c96b-4e88-a941-e34d23a0e06a","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in exec_admin_widget function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ef15c4-c96b-4e88-a941-e34d23a0e06a?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5ef3a8e-9027-4d65-a694-a7a3f4327e35","source":"wordfence","cve":"CVE-2025-30562","title":"Navigation Tree Elementor <= 1.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ef3a8e-9027-4d65-a694-a7a3f4327e35?source=api-prod","affected":[{"type":"plugin","slug":"navigation-tree-elementor","name":"Navigation Tree Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-03T14:55:52Z"},{"id":"wordfence:b5f06850-6312-4e87-9b2e-a1421efc91e6","source":"wordfence","cve":"CVE-2025-48256","title":"Import Social Events <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f06850-6312-4e87-9b2e-a1421efc91e6?source=api-prod","affected":[{"type":"plugin","slug":"import-facebook-events","name":"Import Social Events","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:48:43Z"},{"id":"wordfence:b5f07017-e2b6-4051-8df8-3d0cfa59c7d9","source":"wordfence","cve":"CVE-2023-2518","title":"Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f07017-e2b6-4051-8df8-3d0cfa59c7d9?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.8.9"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b5f09c7a-a8f5-4885-97fe-9347d20b8817","source":"wordfence","cve":"CVE-2026-15032","title":"wpDiscuz <= 7.6.59 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f09c7a-a8f5-4885-97fe-9347d20b8817?source=api-prod","affected":[{"type":"plugin","slug":"advanced-comments","name":"Comments","from":"*","from_inclusive":true,"to":"7.6.59","to_inclusive":true,"patched_in":"7.6.60"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:10:00Z"},{"id":"wordfence:b5f0dc1a-6b6a-4370-a368-3687cffb43fc","source":"wordfence","cve":"CVE-2026-4006","title":"Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f0dc1a-6b6a-4370-a368-3687cffb43fc?source=api-prod","affected":[{"type":"plugin","slug":"simple-draft-list","name":"Draft List","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2026-03-18T18:13:45Z","updated":"2026-03-19T06:46:15Z"},{"id":"wordfence:b5f4e9bf-b452-4425-8bf2-73be7857b3ef","source":"wordfence","cve":"CVE-2024-31265","title":"Sumo <= 1.34 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f4e9bf-b452-4425-8bf2-73be7857b3ef?source=api-prod","affected":[{"type":"plugin","slug":"sumome","name":"Website Pop-up Builder by BDOW! (formerly Sumo): Pop-ups + forms for email opt-ins and lead generation","from":"*","from_inclusive":true,"to":"1.34","to_inclusive":true,"patched_in":"1.35"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:59:47Z"},{"id":"wordfence:b5f6d2a2-ad3e-4afc-b6fd-745881d85b6b","source":"wordfence","cve":"CVE-2026-5073","title":"ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f6d2a2-ad3e-4afc-b6fd-745881d85b6b?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-06-02T05:30:40Z","updated":"2026-06-02T18:30:47Z"},{"id":"wordfence:b5f8659a-fb3f-4df3-85a6-979751627a9c","source":"wordfence","cve":"CVE-2024-9661","title":"WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f8659a-fb3f-4df3-85a6-979751627a9c?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2025-02-07T03:06:52Z","updated":"2025-02-07T15:21:05Z"},{"id":"wordfence:b5fa86d0-8900-489c-b40f-d3d792c97f84","source":"wordfence","cve":"CVE-2026-107421","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.2 - Unauthenticated Session Hijacking","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fa86d0-8900-489c-b40f-d3d792c97f84?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":true,"patched_in":"7.3.3"}],"published":"2026-10-12T00:00:00Z","updated":"2026-11-03T19:37:37Z"},{"id":"wordfence:b5fd2163-b8ef-4dd1-a12b-cd9187145134","source":"wordfence","cve":"CVE-2025-5537","title":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd2163-b8ef-4dd1-a12b-cd9187145134?source=api-prod","affected":[{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.34","to_inclusive":true,"patched_in":"2.7.35"}],"published":"2025-07-07T16:14:43Z","updated":"2025-07-08T04:22:59Z"},{"id":"wordfence:b5fd4a47-0549-4d03-b81a-ad97d3d5d390","source":"wordfence","cve":"CVE-2025-13529","title":"Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd4a47-0549-4d03-b81a-ad97d3d5d390?source=api-prod","affected":[{"type":"plugin","slug":"unify","name":"Unify","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2026-01-06T19:46:16Z","updated":"2026-02-03T18:53:43Z"},{"id":"wordfence:b5fd4dbe-6f44-45ef-9d49-4bc624fdcc57","source":"wordfence","cve":"CVE-2024-1999","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd4dbe-6f44-45ef-9d49-4bc624fdcc57?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.25","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2024-03-21T00:00:00Z","updated":"2024-05-31T15:30:52Z"},{"id":"wordfence:b5fd7bca-7754-4f83-8e51-5278e6e8cc78","source":"wordfence","cve":"CVE-2024-9658","title":"School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd7bca-7754-4f83-8e51-5278e6e8cc78?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:27Z"},{"id":"wordfence:b5ff1f14-c31e-450f-88d0-0a2bbe637d29","source":"wordfence","cve":"CVE-2026-59518","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ff1f14-c31e-450f-88d0-0a2bbe637d29?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.8.2","to_inclusive":true,"patched_in":"8.8.3"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:35:28Z"},{"id":"wordfence:b6008237-e4a8-4757-ae14-ac20c6f1b0af","source":"wordfence","cve":"CVE-2023-48283","title":"Simple Testimonials Showcase <= 1.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6008237-e4a8-4757-ae14-ac20c6f1b0af?source=api-prod","affected":[{"type":"plugin","slug":"simple-testimonials-showcase","name":"Simple Testimonials Showcase","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-05-29T21:10:26Z"},{"id":"wordfence:b6048088-c11c-4741-8dde-da707f8f84f2","source":"wordfence","cve":"","title":"Wordpress File Upload 4.24.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6048088-c11c-4741-8dde-da707f8f84f2?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.0","to_inclusive":true,"patched_in":"4.24.1"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b605027a-4d65-4bfe-9daa-5b2f88811bc7","source":"wordfence","cve":"CVE-2015-20124","title":"Aspose Importer & Exporter (Discontinued) < 3.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b605027a-4d65-4bfe-9daa-5b2f88811bc7?source=api-prod","affected":[{"type":"plugin","slug":"aspose-importer-exporter","name":"Aspose Importer & Exporter (Discontinued)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2015-04-06T00:00:00Z","updated":"2026-10-28T15:13:50Z"},{"id":"wordfence:b6056cc5-1848-4c0c-8de2-9c6310687902","source":"wordfence","cve":"CVE-2026-12968","title":"Product Addons \u2013 WowAddons <= 1.6.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6056cc5-1848-4c0c-8de2-9c6310687902?source=api-prod","affected":[{"type":"plugin","slug":"product-addons","name":"WowAddons \u2013 Product Addons and Product Options With Custom Fields","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"1.6.15"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-29T23:14:24Z"},{"id":"wordfence:b6066883-20e0-440d-9a96-7f4b06c670d2","source":"wordfence","cve":"CVE-2017-14726","title":"WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6066883-20e0-440d-9a96-7f4b06c670d2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b606c7eb-39ce-40a0-b642-6f240f7c8c42","source":"wordfence","cve":"CVE-2015-9488","title":"Almera Responsive Portfolio Site Template < 2015-05-15 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b606c7eb-39ce-40a0-b642-6f240f7c8c42?source=api-prod","affected":[{"type":"theme","slug":"almera","name":"Almera Responsive Portfolio Site Template","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b60ab23c-5dfc-4504-bb3a-98a9f891760d","source":"wordfence","cve":"CVE-2025-62956","title":"Reloadly <= 2.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b60ab23c-5dfc-4504-bb3a-98a9f891760d?source=api-prod","affected":[{"type":"plugin","slug":"reloadly-topup-widget","name":"Reloadly Plugin","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-29T14:46:07Z"},{"id":"wordfence:b60cb1af-c9f3-4cea-9699-d66a52eb87eb","source":"wordfence","cve":"CVE-2023-46620","title":"DeepL Pro API translation <= 2.4.1.1 - Cross-Site Request Forgery via wpdeepl_prune_logs","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b60cb1af-c9f3-4cea-9699-d66a52eb87eb?source=api-prod","affected":[{"type":"plugin","slug":"wpdeepl","name":"Translation with DeepL API","from":"*","from_inclusive":true,"to":"2.4.1.1","to_inclusive":true,"patched_in":"2.4.1.2"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6119481-f399-4bba-a824-1d7346e7e155","source":"wordfence","cve":"CVE-2022-0994","title":"Hummingbird <= 3.3.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6119481-f399-4bba-a824-1d7346e7e155?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2022-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b611f3ba-ac36-49fc-a75f-10003c5ca955","source":"wordfence","cve":"CVE-2023-49152","title":"Credit Tracker <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b611f3ba-ac36-49fc-a75f-10003c5ca955?source=api-prod","affected":[{"type":"plugin","slug":"credit-tracker","name":"Credit Tracker","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b611fc1e-9567-4008-ab8c-55db52783d64","source":"wordfence","cve":"CVE-2025-24684","title":"Media Downloader <= 0.4.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b611fc1e-9567-4008-ab8c-55db52783d64?source=api-prod","affected":[{"type":"plugin","slug":"media-downloader","name":"Media Downloader","from":"*","from_inclusive":true,"to":"0.4.7.5","to_inclusive":true,"patched_in":"0.4.7.6"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-25T17:13:08Z"},{"id":"wordfence:b612267c-a125-4153-9de7-bb12a7646021","source":"wordfence","cve":"CVE-2026-3222","title":"WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b612267c-a125-4153-9de7-bb12a7646021?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2026-03-10T17:22:45Z","updated":"2026-03-11T05:27:20Z"},{"id":"wordfence:b613d4ab-6e96-428b-b853-bda5950a6027","source":"wordfence","cve":"CVE-2026-24941","title":"WP Job Portal <= 2.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b613d4ab-6e96-428b-b853-bda5950a6027?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:43:39Z"},{"id":"wordfence:b614aab2-a3e3-410a-917b-cc33634503ce","source":"wordfence","cve":"CVE-2024-43255","title":"MyBookTable Bookstore <= 3.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b614aab2-a3e3-410a-917b-cc33634503ce?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-08-12T00:00:00Z","updated":"2024-09-12T18:50:12Z"},{"id":"wordfence:b6155327-ac4a-4c97-9a41-e0c5311379bc","source":"wordfence","cve":"CVE-2025-25168","title":"BookPress \u2013 For Book Authors <= 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6155327-ac4a-4c97-9a41-e0c5311379bc?source=api-prod","affected":[{"type":"plugin","slug":"book-press","name":"BookPress \u2013 For Book Authors","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:12:51Z"},{"id":"wordfence:b616bb6c-0861-4920-a589-f2c5bb819164","source":"wordfence","cve":"CVE-2024-8729","title":"Easy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b616bb6c-0861-4920-a589-f2c5bb819164?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons","name":"Easy Social Share Buttons","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:32:40Z","updated":"2024-10-10T02:06:11Z"},{"id":"wordfence:b616e275-855d-461e-8fcb-c96098e41dfd","source":"wordfence","cve":"CVE-2024-9451","title":"Embed PDF Viewer <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b616e275-855d-461e-8fcb-c96098e41dfd?source=api-prod","affected":[{"type":"plugin","slug":"embed-pdf-viewer","name":"Embed PDF Viewer","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-10-08T18:54:11Z","updated":"2024-10-09T07:33:37Z"},{"id":"wordfence:b61ced52-30a2-407a-8659-1ae4a4d99aab","source":"wordfence","cve":"CVE-2026-15101","title":"WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b61ced52-30a2-407a-8659-1ae4a4d99aab?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.7.4","to_inclusive":true,"patched_in":"9.0"}],"published":"2026-08-31T21:00:06Z","updated":"2026-09-01T09:28:21Z"},{"id":"wordfence:b61eb8b7-0d89-47ef-831c-1772d01e2c85","source":"wordfence","cve":"CVE-2024-1377","title":"Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b61eb8b7-0d89-47ef-831c-1772d01e2c85?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T05:32:40Z"},{"id":"wordfence:b61f0137-2ef0-4808-ae9b-d6714c245331","source":"wordfence","cve":"CVE-2025-53435","title":"Plan My Day <= 1.1.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b61f0137-2ef0-4808-ae9b-d6714c245331?source=api-prod","affected":[{"type":"theme","slug":"planmyday","name":"Plan My Day | Wedding / Event Planning Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-20T20:29:58Z"},{"id":"wordfence:b6208023-23d7-43e8-b4c5-748a1504c173","source":"wordfence","cve":"CVE-2024-13633","title":"Simple catalogue <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6208023-23d7-43e8-b4c5-748a1504c173?source=api-prod","affected":[{"type":"plugin","slug":"simple-catalogue","name":"Simple catalogue","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:31:55Z"},{"id":"wordfence:b620b10c-0d76-4ecf-9ab9-9bc5f9687a4a","source":"wordfence","cve":"CVE-2025-52707","title":"Firelight Lightbox <= 2.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b620b10c-0d76-4ecf-9ab9-9bc5f9687a4a?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.16","to_inclusive":true,"patched_in":"2.3.17"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:02:20Z"},{"id":"wordfence:b623af30-9c45-47cf-998f-be6409561b62","source":"wordfence","cve":"CVE-2025-49402","title":"Houzez CRM <= 1.4.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b623af30-9c45-47cf-998f-be6409561b62?source=api-prod","affected":[{"type":"plugin","slug":"houzez-crm","name":"Houzez CRM","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:29:54Z"},{"id":"wordfence:b6287051-69c2-4305-93e4-b38ff42b475f","source":"wordfence","cve":"CVE-2026-96829","title":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6287051-69c2-4305-93e4-b38ff42b475f?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:54:55Z"},{"id":"wordfence:b62949fd-d73f-4c42-82c7-c29986bca1da","source":"wordfence","cve":"CVE-2024-4417","title":"Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b62949fd-d73f-4c42-82c7-c29986bca1da?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.49","to_inclusive":true,"patched_in":"1.3.50"}],"published":"2024-05-10T08:52:17Z","updated":"2024-05-10T21:32:43Z"},{"id":"wordfence:b62b8619-4348-4cf7-a572-aa6df20bdc3a","source":"wordfence","cve":"CVE-2026-1256","title":"YS LeadGen \u2013 Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b62b8619-4348-4cf7-a572-aa6df20bdc3a?source=api-prod","affected":[{"type":"plugin","slug":"ysleadgen","name":"YS LeadGen \u2013 Popup Builder, Contact Form Builder, Exit Intent, Optin Forms & Lead Generation","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-09-18T19:47:41Z","updated":"2026-09-19T08:27:23Z"},{"id":"wordfence:b62fb1a8-d62d-4d1f-bcce-a081432b9e61","source":"wordfence","cve":"CVE-2023-0768","title":"Avirato hotels online booking engine <= 5.0.5 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b62fb1a8-d62d-4d1f-bcce-a081432b9e61?source=api-prod","affected":[{"type":"plugin","slug":"avirato-calendar","name":"Avirato hotels online booking engine","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6306222-8b0c-4060-ade8-f4797d41ebc3","source":"wordfence","cve":"CVE-2025-66066","title":"Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6306222-8b0c-4060-ade8-f4797d41ebc3?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-10T16:04:44Z"},{"id":"wordfence:b630d7fa-8a6a-473a-82df-fce8393a7401","source":"wordfence","cve":"CVE-2024-52473","title":"HTML5 Lyrics Karaoke Player <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b630d7fa-8a6a-473a-82df-fce8393a7401?source=api-prod","affected":[{"type":"plugin","slug":"html5-lyrics-karaoke-player","name":"HTML5 Lyrics Karaoke Player","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:14:49Z"},{"id":"wordfence:b6310a0c-5a96-4dbc-940e-025c9b907c7d","source":"wordfence","cve":"CVE-2026-6169","title":"affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6310a0c-5a96-4dbc-940e-025c9b907c7d?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:32:53Z","updated":"2026-10-22T07:47:12Z"},{"id":"wordfence:b631ba7f-105d-4fe4-9173-4f7eade92d54","source":"wordfence","cve":"CVE-2017-18517","title":"BestWebSoft's Pinterest <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b631ba7f-105d-4fe4-9173-4f7eade92d54?source=api-prod","affected":[{"type":"plugin","slug":"bws-pinterest","name":"BestWebSoft\u2019s Pinterest","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6364415-da02-4236-b635-d8fbd27faa33","source":"wordfence","cve":"CVE-2025-5760","title":"Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode","severity":"medium","cvss":4.9,"cwe":"CWE-256","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6364415-da02-4236-b635-d8fbd27faa33?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.8.2"}],"published":"2025-06-05T21:58:10Z","updated":"2025-06-06T11:13:18Z"},{"id":"wordfence:b6369b41-d93f-4959-8fad-be69ef724b24","source":"wordfence","cve":"CVE-2023-32094","title":"Extended Post Status <= 1.0.19 - Missing Authorization via wp_insert_post_data","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6369b41-d93f-4959-8fad-be69ef724b24?source=api-prod","affected":[{"type":"plugin","slug":"extended-post-status","name":"Extended Post Status","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b637ebfd-c273-428b-985c-6f5b6a03f263","source":"wordfence","cve":"CVE-2023-48318","title":"Contact Form Email <= 1.3.41 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b637ebfd-c273-428b-985c-6f5b6a03f263?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.41","to_inclusive":true,"patched_in":"1.3.42"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6395439-da45-4b64-8e30-b106dffd46c1","source":"wordfence","cve":"CVE-2025-12974","title":"Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6395439-da45-4b64-8e30-b106dffd46c1?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.9.21.1","to_inclusive":true,"patched_in":"2.9.22"}],"published":"2025-11-17T14:26:45Z","updated":"2025-11-18T03:27:08Z"},{"id":"wordfence:b63a8253-b6cc-4cca-baec-4d0e32e1b8d5","source":"wordfence","cve":"CVE-2024-32536","title":"WP TradingView <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63a8253-b6cc-4cca-baec-4d0e32e1b8d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-tradingview","name":"WP TradingView","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T12:52:38Z"},{"id":"wordfence:b63bc2b6-1abc-4cfa-a7e5-3995640f66a7","source":"wordfence","cve":"CVE-2025-1361","title":"IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63bc2b6-1abc-4cfa-a7e5-3995640f66a7?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.38.8","to_inclusive":true,"patched_in":"2.38.9"}],"published":"2025-02-21T19:56:54Z","updated":"2025-02-22T08:22:07Z"},{"id":"wordfence:b63c9a5a-fa3e-46c7-9d9c-7c209fc5713a","source":"wordfence","cve":"CVE-2026-0693","title":"Allow HTML in Category Descriptions <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63c9a5a-fa3e-46c7-9d9c-7c209fc5713a?source=api-prod","affected":[{"type":"plugin","slug":"allow-html-in-category-descriptions","name":"Allow HTML in Category Descriptions","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2026-02-13T18:18:44Z","updated":"2026-07-08T17:46:04Z"},{"id":"wordfence:b63ccc9a-222d-4119-909b-d04bab78d663","source":"wordfence","cve":"CVE-2023-46070","title":"EG-Attachments <= 2.1.3 - Reflected Cross-Site Scripting via 'paged'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63ccc9a-222d-4119-909b-d04bab78d663?source=api-prod","affected":[{"type":"plugin","slug":"eg-attachments","name":"EG-Attachments","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b63d8238-267f-4a40-9af0-37ae8b9ba26b","source":"wordfence","cve":"CVE-2023-47665","title":"Plainview Protect Passwords <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63d8238-267f-4a40-9af0-37ae8b9ba26b?source=api-prod","affected":[{"type":"plugin","slug":"plainview-protect-passwords","name":"Plainview Protect Passwords","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b63f0862-d817-49c6-8ac2-6143d21abc32","source":"wordfence","cve":"CVE-2024-29141","title":"PDF Embedder <= 4.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63f0862-d817-49c6-8ac2-6143d21abc32?source=api-prod","affected":[{"type":"plugin","slug":"pdf-embedder","name":"PDF Embedder \u2013 PDF Viewer & Embed PDF Files for WordPress","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2024-03-18T00:00:00Z","updated":"2024-03-22T14:56:32Z"},{"id":"wordfence:b63f4de2-32e1-4c5e-a64d-fb66d2e2b3a8","source":"wordfence","cve":"CVE-2023-41670","title":"Use Memcached <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b63f4de2-32e1-4c5e-a64d-fb66d2e2b3a8?source=api-prod","affected":[{"type":"plugin","slug":"use-memcached","name":"Use Memcached","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6422375-a819-4e92-92af-a0a4591dea26","source":"wordfence","cve":"","title":"Portfolio Gallery <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6422375-a819-4e92-92af-a0a4591dea26?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-gallery","name":"Portfolio Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2016-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b644e61a-5842-43a6-9525-97e1339dcc94","source":"wordfence","cve":"CVE-2022-3069","title":"Wordlift <= 3.37.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b644e61a-5842-43a6-9525-97e1339dcc94?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.37.1","to_inclusive":true,"patched_in":"3.37.2"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b645eb46-108b-4b24-8d31-a88a4242d6ca","source":"wordfence","cve":"CVE-2026-16738","title":"Conekta Payment Gateway <= 6.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b645eb46-108b-4b24-8d31-a88a4242d6ca?source=api-prod","affected":[{"type":"plugin","slug":"conekta-payment-gateway","name":"Conekta Payment Gateway","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-02T21:32:22Z"},{"id":"wordfence:b64635f4-abc0-4e69-89e4-357840c5e776","source":"wordfence","cve":"CVE-2025-8484","title":"Code Quality Control Tool <= 2.1 - Unauthenticated Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b64635f4-abc0-4e69-89e4-357840c5e776?source=api-prod","affected":[{"type":"plugin","slug":"code-quality-control-tool","name":"Code Quality Control Tool","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-10-10T20:31:38Z","updated":"2025-10-30T14:26:36Z"},{"id":"wordfence:b647a6c5-3710-43ec-bf31-87b5a26d54b3","source":"wordfence","cve":"CVE-2023-24419","title":"Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b647a6c5-3710-43ec-bf31-87b5a26d54b3?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b64921fe-1b09-49e7-b2ec-f708fba99c2a","source":"wordfence","cve":"CVE-2021-24324","title":"404 SEO Redirection <= 1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b64921fe-1b09-49e7-b2ec-f708fba99c2a?source=api-prod","affected":[{"type":"plugin","slug":"404-redirection-manager","name":"404 SEO Redirection","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2021-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b649266a-6a9a-4d2e-9a82-2335e96bfe0d","source":"wordfence","cve":"CVE-2025-12128","title":"Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b649266a-6a9a-4d2e-9a82-2335e96bfe0d?source=api-prod","affected":[{"type":"plugin","slug":"hide-categories-or-products-on-shop-page","name":"Hide Categories Or Products On Shop Page","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:29:19Z","updated":"2025-12-05T05:31:28Z"},{"id":"wordfence:b64b589d-ff37-444b-a040-f4ff80d5a382","source":"wordfence","cve":"CVE-2025-28976","title":"Email Address Security by WebEmailProtector <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b64b589d-ff37-444b-a040-f4ff80d5a382?source=api-prod","affected":[{"type":"plugin","slug":"webemailprotector","name":"Email Address Security by WebEmailProtector","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-08T18:33:13Z"},{"id":"wordfence:b64bd2b9-56d5-47d4-9532-3718bf2381a7","source":"wordfence","cve":"","title":"MainWP Broken Link Checker <= 4.0 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b64bd2b9-56d5-47d4-9532-3718bf2381a7?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-broken-links-checker-extension","name":"MainWP Broken Link Checker","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b64fc9d8-ea02-49e7-add1-8d83f0f41431","source":"wordfence","cve":"CVE-2025-0821","title":"Bit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b64fc9d8-ea02-49e7-add1-8d83f0f41431?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-02-13T22:13:48Z","updated":"2025-02-14T11:10:58Z"},{"id":"wordfence:b65184e6-8072-4dd7-8291-c92817e55beb","source":"wordfence","cve":"CVE-2023-30871","title":"Stock Exporter for WooCommerce <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65184e6-8072-4dd7-8291-c92817e55beb?source=api-prod","affected":[{"type":"plugin","slug":"stock-exporter-for-woocommerce","name":"Stock Exporter for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6572733-3b3a-49c5-9ee3-52a7ab61c98d","source":"wordfence","cve":"CVE-2021-36854","title":"Booking Ultra Pro <= 1.1.8 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6572733-3b3a-49c5-9ee3-52a7ab61c98d?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b65902ab-71c6-482d-95d0-fa6af8e05f82","source":"wordfence","cve":"CVE-2026-28169","title":"YITH WooCommerce Zoom Magnifier <= 2.52.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65902ab-71c6-482d-95d0-fa6af8e05f82?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-zoom-magnifier","name":"YITH WooCommerce Product Gallery & Image Zoom","from":"*","from_inclusive":true,"to":"2.52.0","to_inclusive":true,"patched_in":"2.52.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-15T21:51:12Z"},{"id":"wordfence:b65ab6a1-8f94-4437-b54f-97a044b4960c","source":"wordfence","cve":"CVE-2025-28928","title":"Are you robot google recaptcha for wordpress <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65ab6a1-8f94-4437-b54f-97a044b4960c?source=api-prod","affected":[{"type":"plugin","slug":"are-you-robot-recaptcha","name":"Are you robot google recaptcha for wordpress","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-22T00:00:00Z","updated":"2025-03-25T17:46:08Z"},{"id":"wordfence:b65acc28-1f4c-47c1-a6cc-dedef58c2e3e","source":"wordfence","cve":"CVE-2025-67517","title":"ArtPlacer Widget <= 2.22.9.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65acc28-1f4c-47c1-a6cc-dedef58c2e3e?source=api-prod","affected":[{"type":"plugin","slug":"artplacer-widget","name":"ArtPlacer Widget","from":"*","from_inclusive":true,"to":"2.22.9.2","to_inclusive":true,"patched_in":"2.23"}],"published":"2025-11-23T00:00:00Z","updated":"2025-12-10T16:06:25Z"},{"id":"wordfence:b65cdbe0-e258-4bb5-9a36-cbf57b75ce77","source":"wordfence","cve":"","title":"Custom Background <= 3.2.2.67929 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65cdbe0-e258-4bb5-9a36-cbf57b75ce77?source=api-prod","affected":[{"type":"plugin","slug":"custom-background","name":"Custom Background","from":"*","from_inclusive":true,"to":"3.2.2.67929","to_inclusive":true,"patched_in":""}],"published":"2014-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b65e3a9f-55b7-458c-81ef-0e29fc8733d9","source":"wordfence","cve":"CVE-2025-49861","title":"Kama Click Counter <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b65e3a9f-55b7-458c-81ef-0e29fc8733d9?source=api-prod","affected":[{"type":"plugin","slug":"kama-clic-counter","name":"Kama Click Counter","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:02:47Z"},{"id":"wordfence:b6616c4b-6021-42c8-afe1-bfd789b895ca","source":"wordfence","cve":"CVE-2021-24715","title":"WP Sitemap Page <= 1.6.6 - Admin+ Stored Cross Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6616c4b-6021-42c8-afe1-bfd789b895ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-sitemap-page","name":"WP Sitemap Page","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2021-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b661e8d7-c50e-4cbf-86a8-3e44d7b61871","source":"wordfence","cve":"CVE-2026-109231","title":"Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change","severity":"medium","cvss":4.3,"cwe":"CWE-841","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b661e8d7-c50e-4cbf-86a8-3e44d7b61871?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-germanized","name":"Germanized for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2026-10-30T21:04:17Z","updated":"2026-10-31T09:29:27Z"},{"id":"wordfence:b6623d07-9716-49e2-a883-7eebabf3ea58","source":"wordfence","cve":"CVE-2025-30906","title":"Plugin Oficial \u2013 Getnet para WooCommerce <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6623d07-9716-49e2-a883-7eebabf3ea58?source=api-prod","affected":[{"type":"plugin","slug":"wc-checkout-getnet","name":"CoffeeCode \u2013 Checkout for Getnet and WooCommerce","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T19:19:33Z"},{"id":"wordfence:b6635ab1-4e9e-49dd-9aa1-c23b7f356a5e","source":"wordfence","cve":"CVE-2026-96332","title":"Simple Payment <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6635ab1-4e9e-49dd-9aa1-c23b7f356a5e?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:47:59Z"},{"id":"wordfence:b66540ec-7a01-431c-a8bf-dbced505bf1e","source":"wordfence","cve":"CVE-2021-24743","title":"Podcast Subscribe Buttons < 1.4.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66540ec-7a01-431c-a8bf-dbced505bf1e?source=api-prod","affected":[{"type":"plugin","slug":"podcast-subscribe-buttons","name":"Podcast Subscribe Buttons","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b665be9b-51e2-4ed8-9ebd-5180ae5350f1","source":"wordfence","cve":"CVE-2024-12708","title":"Bulk Me Now! <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b665be9b-51e2-4ed8-9ebd-5180ae5350f1?source=api-prod","affected":[{"type":"plugin","slug":"bulk-me-now","name":"Bulk Me Now!","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:39:19Z"},{"id":"wordfence:b6675c48-43d4-4394-a4a3-f753bdaa5c4e","source":"wordfence","cve":"CVE-2023-6953","title":"PDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6675c48-43d4-4394-a4a3-f753bdaa5c4e?source=api-prod","affected":[{"type":"plugin","slug":"fluentforms-pdf","name":"Fluent PDF Generator","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-01-22T00:00:00Z","updated":"2024-07-29T21:37:14Z"},{"id":"wordfence:b669fb8c-74a8-44a3-b7fd-6bb17f0eeb7a","source":"wordfence","cve":"CVE-2026-66590","title":"Tagembed: Social Media Feeds and Customer Reviews Widget <= 7.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b669fb8c-74a8-44a3-b7fd-6bb17f0eeb7a?source=api-prod","affected":[{"type":"plugin","slug":"tagembed-widget","name":"Tagembed: Social Media Feeds and Customer Reviews Widget","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.5"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:10:15Z"},{"id":"wordfence:b66ab7c4-7963-424f-afec-0e52b987c6b3","source":"wordfence","cve":"CVE-2025-11859","title":"Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66ab7c4-7963-424f-afec-0e52b987c6b3?source=api-prod","affected":[{"type":"plugin","slug":"paypal-donation-shortcode","name":"Paypal Donation Shortcode","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:54:33Z","updated":"2025-11-11T03:30:47Z"},{"id":"wordfence:b66bb56c-4953-473c-b1cc-c843447d8d76","source":"wordfence","cve":"CVE-2024-51847","title":"WP PagSeguro Payments <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66bb56c-4953-473c-b1cc-c843447d8d76?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagseguro-payments","name":"WP PagSeguro Payments","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:23:28Z"},{"id":"wordfence:b66e2537-f187-4237-b248-f8a361f9cb00","source":"wordfence","cve":"","title":"Elementor <= 3.13.1 - Missing Authorization to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66e2537-f187-4237-b248-f8a361f9cb00?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b66ef488-0efe-43dd-8938-a1881ed2560a","source":"wordfence","cve":"CVE-2024-33695","title":"Fan Page Widget by ThemeNcode <= 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66ef488-0efe-43dd-8938-a1881ed2560a?source=api-prod","affected":[{"type":"plugin","slug":"facebook-fan-page-widget","name":"Fan Page Widget by ThemeNcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-10T18:28:04Z"},{"id":"wordfence:b66faf40-94d1-4972-a518-9baca69e7af8","source":"wordfence","cve":"CVE-2025-30768","title":"jAlbum Bridge <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b66faf40-94d1-4972-a518-9baca69e7af8?source=api-prod","affected":[{"type":"plugin","slug":"jalbum-bridge","name":"jAlbum Bridge","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":true,"patched_in":"2.0.19"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-02T19:58:40Z"},{"id":"wordfence:b6740514-6975-4ab2-8b08-0f13ae4ab618","source":"wordfence","cve":"CVE-2026-109982","title":"MB Custom Post Types & Custom Taxonomies <= 2.12.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6740514-6975-4ab2-8b08-0f13ae4ab618?source=api-prod","affected":[{"type":"plugin","slug":"mb-custom-post-type","name":"MB Custom Post Types & Custom Taxonomies","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:14:24Z"},{"id":"wordfence:b6763ece-d914-487c-8ad5-befa2e64e7e8","source":"wordfence","cve":"CVE-2025-53443","title":"Smash <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6763ece-d914-487c-8ad5-befa2e64e7e8?source=api-prod","affected":[{"type":"theme","slug":"smash","name":"Smash - Tennis WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:26:29Z"},{"id":"wordfence:b67710d7-976b-4a65-bad3-091a97aceb00","source":"wordfence","cve":"CVE-2024-13697","title":"Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.7.4 - Unauthenticated Limited Server-Side Request Forgery in nice_links","severity":"medium","cvss":4.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b67710d7-976b-4a65-bad3-091a97aceb00?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T08:23:21Z"},{"id":"wordfence:b677ad8b-4f01-4147-bcf6-ae769046be48","source":"wordfence","cve":"CVE-2025-1320","title":"teachPress <= 9.0.9 - Cross-Site Request Forgery to Import Delete","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b677ad8b-4f01-4147-bcf6-ae769046be48?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.9","to_inclusive":true,"patched_in":"9.0.10"}],"published":"2025-03-24T18:00:42Z","updated":"2025-07-24T19:16:20Z"},{"id":"wordfence:b67a677a-0425-40cd-b7c7-3c1d2a6a4b8e","source":"wordfence","cve":"CVE-2024-34570","title":"140+ Widgets | Best Addons For Elementor \u2013 FREE <= 1.4.3 - Authenticated (Admin+) Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b67a677a-0425-40cd-b7c7-3c1d2a6a4b8e?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.3.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T21:22:04Z"},{"id":"wordfence:b67c9137-4368-4ecf-9091-8ae0773c47e8","source":"wordfence","cve":"CVE-2025-30559","title":"Kento WordPress Stats <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b67c9137-4368-4ecf-9091-8ae0773c47e8?source=api-prod","affected":[{"type":"plugin","slug":"kento-wp-stats","name":"Kento WordPress Stats","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T19:59:30Z"},{"id":"wordfence:b680132a-f397-4636-98b2-bcd8c168e822","source":"wordfence","cve":"CVE-2025-12077","title":"WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b680132a-f397-4636-98b2-bcd8c168e822?source=api-prod","affected":[{"type":"plugin","slug":"linkedin-auto-publish","name":"WP to LinkedIn Auto Publish","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2025-12-12T15:28:07Z","updated":"2025-12-13T04:31:31Z"},{"id":"wordfence:b6840637-9b0f-4f3d-bb73-9e4527a5f326","source":"wordfence","cve":"CVE-2024-4666","title":"Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6840637-9b0f-4f3d-bb73-9e4527a5f326?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-05-14T10:06:52Z","updated":"2024-05-14T22:31:39Z"},{"id":"wordfence:b6846688-5716-4b22-8a1d-b96b230b0742","source":"wordfence","cve":"CVE-2023-46610","title":"Quill Forms <= 3.3.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6846688-5716-4b22-8a1d-b96b230b0742?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6851bb9-f15a-4d37-8a15-f4677bd5d62e","source":"wordfence","cve":"CVE-2024-50461","title":"EmbedPress <= 4.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6851bb9-f15a-4d37-8a15-f4677bd5d62e?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:24:26Z"},{"id":"wordfence:b68a067f-91b0-413a-a164-c8d6a7c45d18","source":"wordfence","cve":"CVE-2024-10638","title":"Product Labels For Woocommerce (Sale Badges) <= 1.5.10 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b68a067f-91b0-413a-a164-c8d6a7c45d18?source=api-prod","affected":[{"type":"plugin","slug":"aco-product-labels-for-woocommerce","name":"Product Labels For Woocommerce (Sale Badges)","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:36:50Z"},{"id":"wordfence:b68b6736-6552-4115-9702-bd178846544c","source":"wordfence","cve":"CVE-2024-30455","title":"GamiPress <= 6.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b68b6736-6552-4115-9702-bd178846544c?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"6.8.5","to_inclusive":true,"patched_in":"6.8.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T19:34:43Z"},{"id":"wordfence:b68daf12-f84b-4a77-9376-7a4c3ff16c72","source":"wordfence","cve":"CVE-2026-57679","title":"GeekyBot \u2014 AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b68daf12-f84b-4a77-9376-7a4c3ff16c72?source=api-prod","affected":[{"type":"plugin","slug":"geeky-bot","name":"Geeky Bot \u2013 AI Chatbot & Sales Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:06:40Z"},{"id":"wordfence:b69122e2-1af6-4425-9c25-48d7682417f3","source":"wordfence","cve":"CVE-2024-32805","title":"Social Snap <= 1.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b69122e2-1af6-4425-9c25-48d7682417f3?source=api-prod","affected":[{"type":"plugin","slug":"socialsnap","name":"Social Snap \u2014 Social Share Buttons & Click to Tweet","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:15:25Z"},{"id":"wordfence:b691560e-e285-467c-9d52-1620c63de1f0","source":"wordfence","cve":"CVE-2024-8795","title":"BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b691560e-e285-467c-9d52-1620c63de1f0?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T01:56:47Z"},{"id":"wordfence:b6926c2c-79d4-477c-a2eb-ba62545f2e2b","source":"wordfence","cve":"CVE-2025-14843","title":"Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6926c2c-79d4-477c-a2eb-ba62545f2e2b?source=api-prod","affected":[{"type":"plugin","slug":"wizit-gateway-for-woocommerce","name":"Wizit Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-01-23T19:23:49Z","updated":"2026-08-06T16:26:32Z"},{"id":"wordfence:b6950932-e7f7-47ed-a91d-b1976cb25077","source":"wordfence","cve":"CVE-2025-64257","title":"My Tickets <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6950932-e7f7-47ed-a91d-b1976cb25077?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:46:05Z"},{"id":"wordfence:b6986569-a273-4aea-bc74-ef7277781661","source":"wordfence","cve":"CVE-2024-33558","title":"XStore Core <= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6986569-a273-4aea-bc74-ef7277781661?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:44:53Z"},{"id":"wordfence:b69a79cf-d838-4a82-acfa-c1c6f82cc931","source":"wordfence","cve":"CVE-2025-52713","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.27.8 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b69a79cf-d838-4a82-acfa-c1c6f82cc931?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.8","to_inclusive":true,"patched_in":"1.27.9"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T19:40:12Z"},{"id":"wordfence:b69b1343-9a0b-42d9-b8f6-1ba3e216e2bf","source":"wordfence","cve":"CVE-2026-78257","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b69b1343-9a0b-42d9-b8f6-1ba3e216e2bf?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:51:47Z"},{"id":"wordfence:b69c86f4-d81d-4e14-baff-3402008bb9c6","source":"wordfence","cve":"CVE-2024-13824","title":"CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b69c86f4-d81d-4e14-baff-3402008bb9c6?source=api-prod","affected":[{"type":"theme","slug":"ciyashop","name":"CiyaShop - Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"4.19.0","to_inclusive":true,"patched_in":"4.19.1"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T06:43:18Z"},{"id":"wordfence:b6a16d30-9f22-4b44-b748-cb0c5c32c039","source":"wordfence","cve":"CVE-2025-39421","title":"WP Sticky Side Buttons <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a16d30-9f22-4b44-b748-cb0c5c32c039?source=api-prod","affected":[{"type":"plugin","slug":"wp-sticky-side-buttons","name":"WP Sticky Side Buttons","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:59:49Z"},{"id":"wordfence:b6a228f6-5c72-4c26-8b02-61158b96bd8e","source":"wordfence","cve":"CVE-2025-48240","title":"Cost of Goods for WooCommerce <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a228f6-5c72-4c26-8b02-61158b96bd8e?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:41:37Z"},{"id":"wordfence:b6a54470-fc66-43c5-a523-ddbefd47ee1f","source":"wordfence","cve":"CVE-2015-10130","title":"Team Circle Image Slider With Lightbox 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a54470-fc66-43c5-a523-ddbefd47ee1f?source=api-prod","affected":[{"type":"plugin","slug":"circle-image-slider-with-lightbox","name":"Team Circle Image Slider With Lightbox","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T02:34:52Z"},{"id":"wordfence:b6a54d91-da79-43a3-affd-e8026e342d95","source":"wordfence","cve":"CVE-2026-1834","title":"Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a54d91-da79-43a3-affd-e8026e342d95?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.5.7","to_inclusive":true,"patched_in":"1.2.5.8"}],"published":"2026-03-30T16:30:19Z","updated":"2026-03-31T05:28:52Z"},{"id":"wordfence:b6a706ce-da98-4bad-a5a7-5e579bf60b25","source":"wordfence","cve":"CVE-2025-27284","title":"Flagged Content <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a706ce-da98-4bad-a5a7-5e579bf60b25?source=api-prod","affected":[{"type":"plugin","slug":"flagged-content","name":"Flagged Content","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:34:02Z"},{"id":"wordfence:b6a8dcdc-88ab-4e8e-b631-8849e10be9ba","source":"wordfence","cve":"CVE-2025-52719","title":"ProfileGrid  <= 5.9.5.2 - Authenticated (Subscriber+) Full Path Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a8dcdc-88ab-4e8e-b631-8849e10be9ba?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.2","to_inclusive":true,"patched_in":"5.9.5.3"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T18:05:56Z"},{"id":"wordfence:b6a99135-c12e-435c-bd81-ddd3414d178a","source":"wordfence","cve":"CVE-2025-3703","title":"CSS & JavaScript Toolbox < 12.0.3 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a99135-c12e-435c-bd81-ddd3414d178a?source=api-prod","affected":[{"type":"plugin","slug":"css-javascript-toolbox","name":"CSS & JavaScript Toolbox","from":"*","from_inclusive":true,"to":"12.0.3","to_inclusive":false,"patched_in":"12.0.3"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:50:23Z"},{"id":"wordfence:b6a99d7f-f5b1-4bdc-ad67-353fea94d649","source":"wordfence","cve":"CVE-2021-24912","title":"Transposh WordPress Translation <= 1.0.9.1 -  Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a99d7f-f5b1-4bdc-ad67-353fea94d649?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.1","to_inclusive":true,"patched_in":"1.0.9.2"}],"published":"2022-07-22T00:00:00Z","updated":"2025-07-21T13:48:01Z"},{"id":"wordfence:b6aa3b1b-458a-4b7c-8ef8-2d434eaa80c9","source":"wordfence","cve":"CVE-2025-58705","title":"Crafti - Handmade Store WordPress Theme <= 1.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6aa3b1b-458a-4b7c-8ef8-2d434eaa80c9?source=api-prod","affected":[{"type":"theme","slug":"crafti","name":"Crafti - Handmade Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:18:43Z"},{"id":"wordfence:b6aa4ad3-a0f0-4917-acaf-2f683aecba3e","source":"wordfence","cve":"CVE-2026-22483","title":"teachPress <= 9.0.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6aa4ad3-a0f0-4917-acaf-2f683aecba3e?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.12","to_inclusive":true,"patched_in":"9.0.13"}],"published":"2026-01-06T00:00:00Z","updated":"2026-04-15T13:33:17Z"},{"id":"wordfence:b6ad08fb-d029-4f84-818c-911ae2d97f33","source":"wordfence","cve":"CVE-2023-2472","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.60 - Reflected Cross-Site Scripting via 'lang'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ad08fb-d029-4f84-818c-911ae2d97f33?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.60","to_inclusive":true,"patched_in":"3.1.61"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6ad38a3-adb1-4c82-8e8c-f5883ba0f10e","source":"wordfence","cve":"CVE-2025-3860","title":"CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ad38a3-adb1-4c82-8e8c-f5883ba0f10e?source=api-prod","affected":[{"type":"plugin","slug":"cardealerpress","name":"CarDealerPress","from":"*","from_inclusive":true,"to":"6.8.2505.00","to_inclusive":true,"patched_in":"6.8.2505.01"}],"published":"2025-05-06T13:29:47Z","updated":"2025-05-14T14:22:45Z"},{"id":"wordfence:b6af015f-f954-4afb-9d65-56176f73672f","source":"wordfence","cve":"CVE-2026-89063","title":"Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6af015f-f954-4afb-9d65-56176f73672f?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.1","to_inclusive":true,"patched_in":"28.2"}],"published":"2026-09-15T15:39:44Z","updated":"2026-09-16T04:28:04Z"},{"id":"wordfence:b6b0bb48-eb61-4236-a03f-19d5d2084a75","source":"wordfence","cve":"CVE-2024-1350","title":"Honeypot for WP Comment <= 2.2.3 - Directory Traversal to Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b0bb48-eb61-4236-a03f-19d5d2084a75?source=api-prod","affected":[{"type":"plugin","slug":"honeypot-for-wp-comment","name":"Honeypot for WP Comment","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-08T00:00:00Z","updated":"2024-02-12T18:48:43Z"},{"id":"wordfence:b6b0dc03-3715-41f8-8888-1cccddb39c0b","source":"wordfence","cve":"CVE-2024-13677","title":"GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b0dc03-3715-41f8-8888-1cccddb39c0b?source=api-prod","affected":[{"type":"plugin","slug":"get-bookings-wp","name":"GetBookingsWP \u2013 Appointments Booking Calendar Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:46:10Z","updated":"2025-02-18T04:21:19Z"},{"id":"wordfence:b6b349f2-24c9-4921-bb5f-a7726ebc5c2a","source":"wordfence","cve":"CVE-2026-6145","title":"User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b349f2-24c9-4921-bb5f-a7726ebc5c2a?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2026-05-13T19:52:48Z","updated":"2026-05-14T08:24:28Z"},{"id":"wordfence:b6b43503-e6f0-4097-9e41-eaae7011b17b","source":"wordfence","cve":"","title":"Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b43503-e6f0-4097-9e41-eaae7011b17b?source=api-prod","affected":[{"type":"theme","slug":"nexos","name":"Nexos - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2020-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6b61731-ded2-4ac1-83f6-686daf92441e","source":"wordfence","cve":"CVE-2024-12468","title":"WP Datepicker <= 2.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b61731-ded2-4ac1-83f6-686daf92441e?source=api-prod","affected":[{"type":"plugin","slug":"wp-datepicker","name":"WP Datepicker","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-12-23T20:08:50Z","updated":"2024-12-24T08:22:04Z"},{"id":"wordfence:b6b68e35-ecfb-4876-8fee-c389077b2b4a","source":"wordfence","cve":"","title":"Zlick Paywall < 2.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b68e35-ecfb-4876-8fee-c389077b2b4a?source=api-prod","affected":[{"type":"plugin","slug":"zlick-paywall","name":"Zlick Paywall","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":false,"patched_in":"2.2.2"}],"published":"2021-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6b6fb24-f70b-44b0-a1e8-12ebc0e0c105","source":"wordfence","cve":"CVE-2020-11028","title":"WordPress Core < 5.4.1 - Private Post Disclosure","severity":"medium","cvss":5.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b6fb24-f70b-44b0-a1e8-12ebc0e0c105?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.32","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.29","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.26","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.22","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.20","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.17","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.16","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"3.7.33"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"3.7.33"}],"published":"2020-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6ba3ce1-7c50-4e9d-b9e0-bcefc9ca74fe","source":"wordfence","cve":"CVE-2024-30232","title":"Exclusive Addons Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ba3ce1-7c50-4e9d-b9e0-bcefc9ca74fe?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-01T12:15:53Z"},{"id":"wordfence:b6bb8fea-8b2c-42da-a224-0719a584d92b","source":"wordfence","cve":"CVE-2022-4215","title":"Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bb8fea-8b2c-42da-a224-0719a584d92b?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.3","to_inclusive":true,"patched_in":"1.3.2.4"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6bb9df2-cf6e-4357-b75c-afdab55f90d4","source":"wordfence","cve":"CVE-2026-54840","title":"Newsletters <= 4.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bb9df2-cf6e-4357-b75c-afdab55f90d4?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.13","to_inclusive":true,"patched_in":"4.14"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:51:46Z"},{"id":"wordfence:b6bbd7bd-e787-41aa-a4b2-004eaba07f50","source":"wordfence","cve":"CVE-2024-35297","title":"WP Booking <= 2.4.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bbd7bd-e787-41aa-a4b2-004eaba07f50?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-booking","name":"WP Booking","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-05-24T00:00:00Z","updated":"2024-06-06T13:40:23Z"},{"id":"wordfence:b6bd6979-858a-446b-a8d9-d30869e73ed5","source":"wordfence","cve":"CVE-2026-27387","title":"DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.26 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bd6979-858a-446b-a8d9-d30869e73ed5?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.26","to_inclusive":true,"patched_in":"3.6.27"}],"published":"2025-12-18T00:00:00Z","updated":"2026-03-06T15:04:31Z"},{"id":"wordfence:b6bfe229-88a9-45bf-8321-0afe52797c46","source":"wordfence","cve":"","title":"TrustMate.io integration for WooCommerce < 1.8.12 - Authenticated (Subscriber+) Arbitrary Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bfe229-88a9-45bf-8321-0afe52797c46?source=api-prod","affected":[{"type":"plugin","slug":"trustmate-io-integration-for-woocommerce","name":"TrustMate.io \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6bff35f-f881-4c60-9611-4a04727bac36","source":"wordfence","cve":"","title":"WooCommerce Eway Gateway <= 3.5.0 - Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6bff35f-f881-4c60-9611-4a04727bac36?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-gateway-eway","name":"Eway Payments for Woo","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6c08ff0-1f36-4b39-80b1-5b6d7ac9e96e","source":"wordfence","cve":"CVE-2025-68852","title":"Court Reservation <= 1.11.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c08ff0-1f36-4b39-80b1-5b6d7ac9e96e?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-02-05T00:00:00Z","updated":"2026-10-28T21:10:31Z"},{"id":"wordfence:b6c3daf6-2225-4929-8e76-169d680118ba","source":"wordfence","cve":"CVE-2022-36284","title":"Affiliate For WooCommerce premium <= 4.7.0 - Authenticated Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c3daf6-2225-4929-8e76-169d680118ba?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-for-woocommerce","name":"Affiliate For WooCommerce","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6c5cc05-b147-46f6-aaa9-4c82aae1b544","source":"wordfence","cve":"CVE-2024-3070","title":"Last Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c5cc05-b147-46f6-aaa9-4c82aae1b544?source=api-prod","affected":[{"type":"plugin","slug":"last-viewed-posts","name":"Last Viewed Posts by WPBeginner","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-09T20:03:37Z"},{"id":"wordfence:b6c5f933-b71b-4475-abdf-4cffff2a1a6c","source":"wordfence","cve":"","title":"ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c5f933-b71b-4475-abdf-4cffff2a1a6c?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6c69a25-8986-4976-8753-ce8e5be311e2","source":"wordfence","cve":"","title":"Absolute Privacy <= 2.0.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c69a25-8986-4976-8753-ce8e5be311e2?source=api-prod","affected":[{"type":"plugin","slug":"absolute-privacy","name":"Absolute Privacy","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2011-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6c82a71-3a67-4716-9a50-d0d32e2f465d","source":"wordfence","cve":"CVE-2025-22691","title":"WP Travel <= 10.1.3 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c82a71-3a67-4716-9a50-d0d32e2f465d?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"10.1.3","to_inclusive":true,"patched_in":"10.1.4"}],"published":"2025-01-31T00:00:00Z","updated":"2025-04-25T14:49:39Z"},{"id":"wordfence:b6c9814e-e854-4420-9ec1-d843187bd9e7","source":"wordfence","cve":"CVE-2021-24587","title":"Splash Header < 1.20.8 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c9814e-e854-4420-9ec1-d843187bd9e7?source=api-prod","affected":[{"type":"plugin","slug":"splash-header","name":"Splash Header","from":"*","from_inclusive":true,"to":"1.20.8","to_inclusive":false,"patched_in":"1.20.8"}],"published":"2021-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6ca5856-9010-4bb3-a024-92b3b4d500b4","source":"wordfence","cve":"CVE-2026-3652","title":"ARForms <= 7.1.1 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ca5856-9010-4bb3-a024-92b3b4d500b4?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2026-06-23T13:57:39Z","updated":"2026-08-25T13:55:00Z"},{"id":"wordfence:b6cab377-0a8a-45d2-a966-4c7f100b9409","source":"wordfence","cve":"","title":"Portfolio Slideshow Pro <= 3.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cab377-0a8a-45d2-a966-4c7f100b9409?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-slideshow-pro","name":"Portfolio Slideshow Pro","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6cc2898-5dea-4f3d-892a-580ec374c630","source":"wordfence","cve":"CVE-2025-62081","title":"Live Shopping & Shoppable Videos For WooCommerce <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cc2898-5dea-4f3d-892a-580ec374c630?source=api-prod","affected":[{"type":"plugin","slug":"live-shopping-video-streams","name":"Live Shopping & Shoppable Videos For WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:21:46Z"},{"id":"wordfence:b6cf27d9-c0be-4cff-8867-19297f6d79d7","source":"wordfence","cve":"CVE-2024-7027","title":"WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor","severity":"high","cvss":7.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf27d9-c0be-4cff-8867-19297f6d79d7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:58Z"},{"id":"wordfence:b6cf6390-480f-44e2-ae36-67e3398add33","source":"wordfence","cve":"CVE-2026-13492","title":"UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf6390-480f-44e2-ae36-67e3398add33?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.65","to_inclusive":true,"patched_in":"1.2.66"}],"published":"2026-07-09T06:04:53Z","updated":"2026-07-09T18:33:17Z"},{"id":"wordfence:b6d054e4-0ef7-401d-9d81-24cc0f875432","source":"wordfence","cve":"CVE-2019-13344","title":"WP Like Button <= 1.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d054e4-0ef7-401d-9d81-24cc0f875432?source=api-prod","affected":[{"type":"plugin","slug":"wp-like-button","name":"WP Like Button","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2019-07-05T00:00:00Z","updated":"2024-08-15T18:19:28Z"},{"id":"wordfence:b6d448c2-5acc-47f8-8e86-9ef10fa01513","source":"wordfence","cve":"CVE-2024-13899","title":"Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d448c2-5acc-47f8-8e86-9ef10fa01513?source=api-prod","affected":[{"type":"plugin","slug":"mambo-joomla-importer","name":"Mambo Importer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T15:00:11Z","updated":"2025-02-22T03:21:00Z"},{"id":"wordfence:b6d51dc3-b695-4e9d-b25a-d1b302be1fec","source":"wordfence","cve":"CVE-2026-5167","title":"Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d51dc3-b695-4e9d-b25a-d1b302be1fec?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-04-07T17:55:41Z","updated":"2026-04-08T06:43:41Z"},{"id":"wordfence:b6d8212d-7e72-487d-a4e8-0582fa72f602","source":"wordfence","cve":"CVE-2024-1057","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +10 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8212d-7e72-487d-a4e8-0582fa72f602?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-20T01:56:41Z"},{"id":"wordfence:b6d84682-6966-47fd-a04c-7f4c5b914fc6","source":"wordfence","cve":"CVE-2026-39477","title":"CartFlows <= 2.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d84682-6966-47fd-a04c-7f4c5b914fc6?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-03-27T00:00:00Z","updated":"2026-04-15T21:23:38Z"},{"id":"wordfence:b6d874a2-f0cd-49d2-b531-5d780db7d25d","source":"wordfence","cve":"CVE-2024-25920","title":"WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d874a2-f0cd-49d2-b531-5d780db7d25d?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"6.4"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T16:22:04Z"},{"id":"wordfence:b6d8ea0b-3c54-4d9d-8f14-2055510f3119","source":"wordfence","cve":"CVE-2026-6804","title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8ea0b-3c54-4d9d-8f14-2055510f3119?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-07-10T15:18:07Z","updated":"2026-07-11T03:44:25Z"},{"id":"wordfence:b6d9539f-1f75-49ca-b7b8-a400e948d6b5","source":"wordfence","cve":"CVE-2026-86475","title":"Appointment Hour Booking <= 1.5.94 -  Unauthenticated Appointment Slot Capacity Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d9539f-1f75-49ca-b7b8-a400e948d6b5?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.94","to_inclusive":true,"patched_in":"1.5.95"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:44:24Z"},{"id":"wordfence:b6da046f-a16f-4a93-b3c6-04270538b7a9","source":"wordfence","cve":"CVE-2024-2951","title":"RegistrationMagic <= 5.3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6da046f-a16f-4a93-b3c6-04270538b7a9?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.3.0.0","to_inclusive":true,"patched_in":"5.3.1.0"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-01T16:41:38Z"},{"id":"wordfence:b6db6736-4629-47b7-976a-f81335430119","source":"wordfence","cve":"CVE-2025-4223","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6db6736-4629-47b7-976a-f81335430119?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-05-23T15:53:03Z","updated":"2025-05-24T04:25:19Z"},{"id":"wordfence:b6de66ee-08f6-47f6-b6d1-edbf7bea70d8","source":"wordfence","cve":"CVE-2014-4724","title":"Custom Banners < 2.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6de66ee-08f6-47f6-b6d1-edbf7bea70d8?source=api-prod","affected":[{"type":"plugin","slug":"custom-banners","name":"Custom Banners","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2014-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6de97ac-127d-47ec-8b74-03e7fa4932f6","source":"wordfence","cve":"CVE-2023-47790","title":"Pz-LinkCard <= 2.5.2 - Cross-Site Request Forgery via page_cacheman","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6de97ac-127d-47ec-8b74-03e7fa4932f6?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-03-25T17:10:29Z"},{"id":"wordfence:b6e02a2b-9033-4022-a7d7-1c81a7f02f83","source":"wordfence","cve":"CVE-2025-7035","title":"Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e02a2b-9033-4022-a7d7-1c81a7f02f83?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.26","to_inclusive":true,"patched_in":"3.27"}],"published":"2025-07-15T20:30:10Z","updated":"2025-07-16T09:22:58Z"},{"id":"wordfence:b6e106a7-2b7d-4d9d-aa0a-01e6a2b1a88b","source":"wordfence","cve":"CVE-2025-47610","title":"WooCommerce Fortnox Integration <= 4.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e106a7-2b7d-4d9d-aa0a-01e6a2b1a88b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-fortnox-integration","name":"Fortnox for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2025-09-11T00:00:00Z","updated":"2025-09-16T15:00:54Z"},{"id":"wordfence:b6e26846-9fcf-4078-9b45-660463ec5b04","source":"wordfence","cve":"","title":"GdeSlon Affiliate Shop <= 1.5.5 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e26846-9fcf-4078-9b45-660463ec5b04?source=api-prod","affected":[{"type":"plugin","slug":"gdeslon-affiliate-shop","name":"GdeSlon Affiliate Shop","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"2.0"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6e3d724-3296-4975-8191-ee41effb7a87","source":"wordfence","cve":"CVE-2026-66573","title":"JetTabs <= 2.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3d724-3296-4975-8191-ee41effb7a87?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.3.3.1","to_inclusive":true,"patched_in":"2.3.3.2"}],"published":"2026-09-17T11:58:00Z","updated":"2026-09-22T18:45:12Z"},{"id":"wordfence:b6e3e59b-837b-4058-b7bc-a22cff22afb4","source":"wordfence","cve":"CVE-2025-6975","title":"Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.6.4.4","to_inclusive":true,"patched_in":"6.6.5"},{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"7.0.1","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"6.6.5"}],"published":"2025-07-09T09:58:10Z","updated":"2025-07-09T22:22:47Z"},{"id":"wordfence:b6e3fb4d-985f-4fb7-bcf1-523792d8dac6","source":"wordfence","cve":"CVE-2021-36863","title":"Quiz And Survey Master <= 7.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3fb4d-985f-4fb7-bcf1-523792d8dac6?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":true,"patched_in":"7.3.5"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6e4d8c3-f3ab-40f9-a8d2-77b53a8dba72","source":"wordfence","cve":"CVE-2022-4230","title":"WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e4d8c3-f3ab-40f9-a8d2-77b53a8dba72?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.8","to_inclusive":true,"patched_in":"13.2.9"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6e587fb-118b-44b6-a2bb-1d621f02845c","source":"wordfence","cve":"CVE-2022-4125","title":"Popup Manager <= 1.6.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e587fb-118b-44b6-a2bb-1d621f02845c?source=api-prod","affected":[{"type":"plugin","slug":"popup-manager","name":"Popup Manager","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6ead872-76a7-49c3-af07-d87a4c68183f","source":"wordfence","cve":"CVE-2024-6705","title":"RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ead872-76a7-49c3-af07-d87a4c68183f?source=api-prod","affected":[{"type":"plugin","slug":"reglevel","name":"RegLevel","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-17T14:02:16Z","updated":"2024-07-18T02:03:58Z"},{"id":"wordfence:b6ec05f2-5a85-41ca-8bd0-ca6d1d8a5da5","source":"wordfence","cve":"CVE-2024-51687","title":"Platform.ly Official <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ec05f2-5a85-41ca-8bd0-ca6d1d8a5da5?source=api-prod","affected":[{"type":"plugin","slug":"platformly","name":"Platform.ly Official","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.14"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:54:59Z"},{"id":"wordfence:b6ecbc9c-308f-45c6-950e-9609b6f8bb7d","source":"wordfence","cve":"CVE-2026-94081","title":"Persistent Login <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ecbc9c-308f-45c6-950e-9609b6f8bb7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-persistent-login","name":"Persistent Login","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-09-30T10:20:55Z","updated":"2026-10-08T23:49:26Z"},{"id":"wordfence:b6ed0344-bdc7-4259-97a4-0b9e87537180","source":"wordfence","cve":"CVE-2026-123477","title":"JetEngine <= 3.9.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ed0344-bdc7-4259-97a4-0b9e87537180?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.9.0.2","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-11-07T12:31:00Z","updated":"2026-11-10T20:02:04Z"},{"id":"wordfence:b6ee571d-8db6-4e21-9a62-44e562b9a5fc","source":"wordfence","cve":"","title":"Pie Register 2.0.14-2.0.15 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ee571d-8db6-4e21-9a62-44e562b9a5fc?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"2.0.14","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2015-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6eea36b-e80a-4b21-8997-d828cc8da6a3","source":"wordfence","cve":"CVE-2025-32211","title":"Broadstreet <= 1.52.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6eea36b-e80a-4b21-8997-d828cc8da6a3?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.52.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2025-04-07T00:00:00Z","updated":"2026-01-27T21:01:28Z"},{"id":"wordfence:b6efe739-713b-4620-b78f-a8ec7b164cd1","source":"wordfence","cve":"CVE-2025-49422","title":"Support Ticket <= 1.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6efe739-713b-4620-b78f-a8ec7b164cd1?source=api-prod","affected":[{"type":"plugin","slug":"support-ticket","name":"Support Ticket","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:33:13Z"},{"id":"wordfence:b6f0fe85-1b70-49b4-9c89-d00584362459","source":"wordfence","cve":"CVE-2026-57732","title":"tagDiv Opt-In Builder <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f0fe85-1b70-49b4-9c89-d00584362459?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-23T22:45:29Z"},{"id":"wordfence:b6f16178-1aa3-4af2-a125-74467bc57e70","source":"wordfence","cve":"CVE-2026-6723","title":"Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f16178-1aa3-4af2-a125-74467bc57e70?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.11","to_inclusive":true,"patched_in":"1.6.12.0"}],"published":"2026-10-09T15:56:16Z","updated":"2026-10-10T04:26:47Z"},{"id":"wordfence:b6f51a8e-4a59-4b64-b0c6-2ce3933a1df5","source":"wordfence","cve":"CVE-2025-1028","title":"Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f51a8e-4a59-4b64-b0c6-2ce3933a1df5?source=api-prod","affected":[{"type":"plugin","slug":"contact-manager","name":"Contact Manager","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":"8.6.5"}],"published":"2025-02-04T00:00:00Z","updated":"2025-08-13T17:22:25Z"},{"id":"wordfence:b6f54ca4-297f-44e8-8bb3-25cdc52f94ff","source":"wordfence","cve":"CVE-2026-3645","title":"Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f54ca4-297f-44e8-8bb3-25cdc52f94ff?source=api-prod","affected":[{"type":"plugin","slug":"punnel-landing-page-builder","name":"Punnel \u2013 Landing Page Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:24Z","updated":"2026-03-21T03:27:00Z"},{"id":"wordfence:b6f6b29e-1678-486c-a955-23d9247af0b5","source":"wordfence","cve":"CVE-2026-104730","title":"Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2026-10-15T18:30:58Z","updated":"2026-10-16T06:41:06Z"},{"id":"wordfence:b6f7c4c8-210f-4bbb-8352-5c2e550e44c3","source":"wordfence","cve":"CVE-2025-32223","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f7c4c8-210f-4bbb-8352-5c2e550e44c3?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:15:47Z"},{"id":"wordfence:b6f7c956-16ce-4739-845b-15f426968808","source":"wordfence","cve":"","title":"WP Affiliate Platform <= 6.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f7c956-16ce-4739-845b-15f426968808?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"6.3.9"}],"published":"2014-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6fe2905-c667-4e10-89d6-387eb233f33b","source":"wordfence","cve":"CVE-2024-38718","title":"Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6fe2905-c667-4e10-89d6-387eb233f33b?source=api-prod","affected":[{"type":"plugin","slug":"download-button-for-elementor","name":"Download Button for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:18:59Z"},{"id":"wordfence:b6fe5f1a-787e-4662-915f-c6f04961e194","source":"wordfence","cve":"CVE-2023-1372","title":"WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6fe5f1a-787e-4662-915f-c6f04961e194?source=api-prod","affected":[{"type":"plugin","slug":"wh-testimonials","name":"WH Testimonials","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b6ff0437-5e0d-4b14-a16e-1c2ad5459b80","source":"wordfence","cve":"CVE-2026-116406","title":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar <= 6.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b6ff0437-5e0d-4b14-a16e-1c2ad5459b80?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2026-10-29T14:16:00Z","updated":"2026-11-03T19:31:16Z"},{"id":"wordfence:b702f507-475a-4d45-8bb1-635f5f377c88","source":"wordfence","cve":"CVE-2023-0542","title":"Custom Post Type List Shortcode <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b702f507-475a-4d45-8bb1-635f5f377c88?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-list-shortcode","name":"Custom Post Type List Shortcode","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7034792-4e5e-4745-a873-3c4ef854a65e","source":"wordfence","cve":"CVE-2026-32547","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7034792-4e5e-4745-a873-3c4ef854a65e?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.22","to_inclusive":true,"patched_in":"2.15.23"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:36:41Z"},{"id":"wordfence:b7039206-a25a-4aa0-87e2-be11dd1f12eb","source":"wordfence","cve":"CVE-2024-0836","title":"WordPress Review & Structure Data Schema Plugin \u2013 Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7039206-a25a-4aa0-87e2-be11dd1f12eb?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-01-30T00:00:00Z","updated":"2024-07-29T21:37:15Z"},{"id":"wordfence:b7084498-2918-4cb4-856e-aec818de79b7","source":"wordfence","cve":"CVE-2025-66092","title":"Accordion Slider <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7084498-2918-4cb4-856e-aec818de79b7?source=api-prod","affected":[{"type":"plugin","slug":"accordion-slider","name":"Accordion Slider","from":"*","from_inclusive":true,"to":"1.9.13","to_inclusive":true,"patched_in":"1.9.14"}],"published":"2025-11-23T00:00:00Z","updated":"2025-12-01T16:58:06Z"},{"id":"wordfence:b7085f08-5c60-4d8f-a765-95f379c3a37c","source":"wordfence","cve":"CVE-2025-30623","title":"wA11y \u2013 The Web Accessibility Toolbox <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7085f08-5c60-4d8f-a765-95f379c3a37c?source=api-prod","affected":[{"type":"plugin","slug":"wa11y","name":"wA11y \u2013 The Web Accessibility Toolbox","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:45:01Z"},{"id":"wordfence:b708b72f-d906-47c9-9bf7-a9397956db3d","source":"wordfence","cve":"CVE-2022-4209","title":"Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b708b72f-d906-47c9-9bf7-a9397956db3d?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.2.1"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b709f1f5-e89f-4d67-9460-2c65c138dc8f","source":"wordfence","cve":"CVE-2024-4757","title":"Logo Manager For Enamad <= 0.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b709f1f5-e89f-4d67-9460-2c65c138dc8f?source=api-prod","affected":[{"type":"plugin","slug":"logo-manager-for-enamad","name":"Logo Manager For Enamad \u2013  \u0644\u0648\u06af\u0648\u06cc \u0646\u0645\u0627\u062f \u0627\u0644\u06a9\u062a\u0631\u0648\u0646\u06cc\u06a9\u06cc","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":"0.7.1"}],"published":"2024-06-04T00:00:00Z","updated":"2024-07-15T16:15:32Z"},{"id":"wordfence:b70a1344-2b55-40c9-a314-80d581e0b019","source":"wordfence","cve":"CVE-2024-13467","title":"WP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b70a1344-2b55-40c9-a314-80d581e0b019?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form7-email-spam-blocker","name":"WP Contact Form7 Email Spam Blocker","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:41:10Z","updated":"2025-01-25T07:24:17Z"},{"id":"wordfence:b70a57ae-4033-4e68-b806-83422d2ab68c","source":"wordfence","cve":"CVE-2025-22696","title":"Document Block \u2013 Upload & Embed Docs <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b70a57ae-4033-4e68-b806-83422d2ab68c?source=api-prod","affected":[{"type":"plugin","slug":"document","name":"Document Block \u2013 Upload & Embed Docs, PDF, PPT, XLS or Any Documents","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T17:26:38Z"},{"id":"wordfence:b70b04bc-8c33-4108-afed-3fcf74e9e948","source":"wordfence","cve":"CVE-2025-60040","title":"wp-mpdf <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b70b04bc-8c33-4108-afed-3fcf74e9e948?source=api-prod","affected":[{"type":"plugin","slug":"wp-mpdf","name":"wp-mpdf","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:25:04Z"},{"id":"wordfence:b70e8bce-1793-40f0-bdb1-100cf5f431e9","source":"wordfence","cve":"CVE-2023-5882","title":"Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b70e8bce-1793-40f0-bdb1-100cf5f431e9?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"},{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b70f5416-06e0-4b6f-b61d-b7c23575a171","source":"wordfence","cve":"CVE-2015-9310","title":"All In One WP Security & Firewall <= 3.9.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b70f5416-06e0-4b6f-b61d-b7c23575a171?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":false,"patched_in":"3.9.1"}],"published":"2015-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b710538a-e9b2-4c3e-a4de-84685df302ee","source":"wordfence","cve":"CVE-2025-32189","title":"BWD Elementor Addons <= 4.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b710538a-e9b2-4c3e-a4de-84685df302ee?source=api-prod","affected":[{"type":"plugin","slug":"bwd-elementor-addons","name":"BWD Elementor Addons","from":"*","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T18:46:14Z"},{"id":"wordfence:b7112840-f190-4867-9408-c96408f28b7a","source":"wordfence","cve":"CVE-2024-12417","title":"Simple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7112840-f190-4867-9408-c96408f28b7a?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"8.4.5","to_inclusive":true,"patched_in":"8.4.6"}],"published":"2024-12-12T19:48:27Z","updated":"2025-01-31T15:30:43Z"},{"id":"wordfence:b7115070-b84d-4d69-993a-f512b9f9c081","source":"wordfence","cve":"CVE-2025-13393","title":"Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7115070-b84d-4d69-993a-f512b9f9c081?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T13:47:37Z"},{"id":"wordfence:b712250f-4315-4188-bbe1-c2991a10ad3f","source":"wordfence","cve":"CVE-2025-62078","title":"Easy Upload Files During Checkout <= 3.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b712250f-4315-4188-bbe1-c2991a10ad3f?source=api-prod","affected":[{"type":"plugin","slug":"easy-upload-files-during-checkout","name":"Easy Upload Files During Checkout","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-06T17:33:34Z"},{"id":"wordfence:b71348c8-9e86-432e-b05e-96884344cef6","source":"wordfence","cve":"CVE-2023-6030","title":"LogDash Activity Log <= 1.1.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b71348c8-9e86-432e-b05e-96884344cef6?source=api-prod","affected":[{"type":"plugin","slug":"logdash-activity-log","name":"LogDash Activity Log","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-10-26T00:00:00Z","updated":"2024-03-11T08:36:16Z"},{"id":"wordfence:b7162b78-65b7-4f80-83f0-47d9afc2ed65","source":"wordfence","cve":"CVE-2018-6944","title":"Ultimate Member <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7162b78-65b7-4f80-83f0-47d9afc2ed65?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2018-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b71706a7-e101-4d50-a2da-1aeeaf07cf4b","source":"wordfence","cve":"CVE-2024-9488","title":"Comments \u2013 wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b71706a7-e101-4d50-a2da-1aeeaf07cf4b?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.24","to_inclusive":true,"patched_in":"7.6.25"}],"published":"2024-10-24T00:00:00Z","updated":"2025-02-19T17:43:36Z"},{"id":"wordfence:b71958cc-6438-4a0c-af49-f1fd4932ad24","source":"wordfence","cve":"CVE-2025-32542","title":"Eazy Plugin Manager <= 4.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b71958cc-6438-4a0c-af49-f1fd4932ad24?source=api-prod","affected":[{"type":"plugin","slug":"plugins-on-steroids","name":"Eazy Plugin Manager","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2025-04-09T00:00:00Z","updated":"2026-01-08T21:38:12Z"},{"id":"wordfence:b71bc259-d800-4f32-96a9-21da71472a6d","source":"wordfence","cve":"CVE-2024-35652","title":"Event Tickets with Ticket Scanner <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b71bc259-d800-4f32-96a9-21da71472a6d?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-11T19:00:38Z"},{"id":"wordfence:b71e6219-09cc-484e-8c48-536797d974ce","source":"wordfence","cve":"","title":"WordPress WP-Advanced-Search <= 3.3.3 - Unauthenticated Database Export","severity":"high","cvss":8.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b71e6219-09cc-484e-8c48-536797d974ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b720704d-41f1-4ea5-8b0c-21d1071f9619","source":"wordfence","cve":"CVE-2025-69066","title":"Indoor Plants <= 1.2.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b720704d-41f1-4ea5-8b0c-21d1071f9619?source=api-prod","affected":[{"type":"theme","slug":"indoor-plants","name":"Indoor Plants | Houseplants Store & Gardening WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:33:12Z"},{"id":"wordfence:b7210fd7-0812-47bc-bc62-d69280253e0a","source":"wordfence","cve":"CVE-2025-9883","title":"Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7210fd7-0812-47bc-bc62-d69280253e0a?source=api-prod","affected":[{"type":"plugin","slug":"browser-sniff","name":"Browser Sniff","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T18:22:59Z","updated":"2025-09-20T06:43:19Z"},{"id":"wordfence:b721bbe2-22ef-48b5-9acc-a8e868fbeff3","source":"wordfence","cve":"CVE-2025-30950","title":"All Currencies for WooCommerce <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b721bbe2-22ef-48b5-9acc-a8e868fbeff3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-all-currencies","name":"All Currencies for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-06-05T00:00:00Z","updated":"2025-11-20T19:01:20Z"},{"id":"wordfence:b722bf4e-1e04-4d80-b359-7d43596751a8","source":"wordfence","cve":"","title":"Flashlight <= 2.8.4 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b722bf4e-1e04-4d80-b359-7d43596751a8?source=api-prod","affected":[{"type":"theme","slug":"flashlight","name":"Flashlight","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7240711-e575-41ff-ba39-0255ca2aa9f5","source":"wordfence","cve":"","title":"Comment Extra Fields <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7240711-e575-41ff-ba39-0255ca2aa9f5?source=api-prod","affected":[{"type":"plugin","slug":"comment-extra-field","name":"Comment Extra Fields","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2013-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7290317-418d-4e5c-85fa-f931cc4a865b","source":"wordfence","cve":"CVE-2025-4194","title":"AlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7290317-418d-4e5c-85fa-f931cc4a865b?source=api-prod","affected":[{"type":"plugin","slug":"alt-monitoring","name":"AlT Monitoring","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T03:24:50Z"},{"id":"wordfence:b72a26dd-0d20-462e-bb71-ed83eae6766e","source":"wordfence","cve":"CVE-2021-24386","title":"WP SVG Images <= 3.3 - Authenticated (author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72a26dd-0d20-462e-bb71-ed83eae6766e?source=api-prod","affected":[{"type":"plugin","slug":"wp-svg-images","name":"WP SVG Images","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b72c746a-0975-4acf-bcf3-caddb95b73c3","source":"wordfence","cve":"CVE-2024-51892","title":"Sell Media File with Stripe <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72c746a-0975-4acf-bcf3-caddb95b73c3?source=api-prod","affected":[{"type":"plugin","slug":"sell-media-file","name":"Sell Media File with Stripe","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:59:05Z"},{"id":"wordfence:b72cfc20-b133-4682-91e1-497236aba035","source":"wordfence","cve":"CVE-2023-23824","title":"WP-TopBar <= 5.36 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72cfc20-b133-4682-91e1-497236aba035?source=api-prod","affected":[{"type":"plugin","slug":"wp-topbar","name":"WP-TopBar","from":"*","from_inclusive":true,"to":"5.36","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b72dcc68-df81-47ac-bd73-6aee87611b90","source":"wordfence","cve":"CVE-2021-24953","title":"Advanced iFrame <= 2021.9 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72dcc68-df81-47ac-bd73-6aee87611b90?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2021.9","to_inclusive":true,"patched_in":"2022"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b72e0a4c-5de5-4396-b515-8c0f2f4de5ed","source":"wordfence","cve":"CVE-2025-31925","title":"SHOUT <= 3.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72e0a4c-5de5-4396-b515-8c0f2f4de5ed?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio8-html5-radio_ads","name":"SHOUT","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T20:01:44Z"},{"id":"wordfence:b72fe40f-8dfc-4f1c-ae52-b8fd111685db","source":"wordfence","cve":"CVE-2026-57744","title":"RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b72fe40f-8dfc-4f1c-ae52-b8fd111685db?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:38:59Z"},{"id":"wordfence:b73198e8-2b00-4ed3-9f6d-a5dc12856059","source":"wordfence","cve":"CVE-2025-30612","title":"Replace Default Words <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73198e8-2b00-4ed3-9f6d-a5dc12856059?source=api-prod","affected":[{"type":"plugin","slug":"replace-default-words","name":"Replace Default Words","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:06:14Z"},{"id":"wordfence:b73320e0-0751-4b0a-bc18-00f70c4ad5aa","source":"wordfence","cve":"CVE-2025-49369","title":"Lettuce <= 1.1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73320e0-0751-4b0a-bc18-00f70c4ad5aa?source=api-prod","affected":[{"type":"theme","slug":"lettuce","name":"Lettuce | Organic Food & Eco Online Store Products WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:22:31Z"},{"id":"wordfence:b73364ea-acec-49d1-bb43-9c3b90ac281b","source":"wordfence","cve":"CVE-2026-16981","title":"DHL for WooCommerce <= 4.0.0 - Insecure Direct Object Reference to Unauthenticated Shipping Label Download","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73364ea-acec-49d1-bb43-9c3b90ac281b?source=api-prod","affected":[{"type":"plugin","slug":"dhl-for-woocommerce","name":"DHL Shipping Germany for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:29:47Z"},{"id":"wordfence:b73467de-fb0c-45e3-b3ae-5158b261907b","source":"wordfence","cve":"CVE-2023-49155","title":"Button Generator \u2013 easily Button Builder <= 2.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73467de-fb0c-45e3-b3ae-5158b261907b?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-24T14:09:16Z"},{"id":"wordfence:b7384260-96cd-4451-84ec-ce0fb7d38a9f","source":"wordfence","cve":"CVE-2026-3717","title":"CV Builder \u2013 Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7384260-96cd-4451-84ec-ce0fb7d38a9f?source=api-prod","affected":[{"type":"plugin","slug":"cv-builder","name":"WP CV Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-10-09T17:49:55Z","updated":"2026-10-10T06:40:15Z"},{"id":"wordfence:b738a4fe-6724-4216-be77-ea67843f89d1","source":"wordfence","cve":"CVE-2026-16064","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b738a4fe-6724-4216-be77-ea67843f89d1?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.7","to_inclusive":false,"patched_in":"5.3.7"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:25:58Z"},{"id":"wordfence:b73923c9-4b2e-413f-bf6d-698d0d0e5231","source":"wordfence","cve":"CVE-2026-88782","title":"Kubio AI Page Builder <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73923c9-4b2e-413f-bf6d-698d0d0e5231?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-08T23:59:27Z"},{"id":"wordfence:b73bbe27-a162-4518-b09a-c69f82150994","source":"wordfence","cve":"CVE-2025-22655","title":"CWD \u2013 Stealth Links <= 1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73bbe27-a162-4518-b09a-c69f82150994?source=api-prod","affected":[{"type":"plugin","slug":"cwd-stealth-links","name":"CWD \u2013 Stealth Links","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:58:11Z"},{"id":"wordfence:b73ca36d-c6cc-482d-a9b8-dd76327aef08","source":"wordfence","cve":"CVE-2025-67548","title":"WP Delicious <= 1.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73ca36d-c6cc-482d-a9b8-dd76327aef08?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-11T16:46:27Z"},{"id":"wordfence:b73edf8f-7017-4239-8ddc-038481d3f65f","source":"wordfence","cve":"CVE-2026-27407","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73edf8f-7017-4239-8ddc-038481d3f65f?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:42:37Z"},{"id":"wordfence:b73fd138-5565-4c80-a061-be8e970c7ea6","source":"wordfence","cve":"CVE-2024-49645","title":"Affiliate Platform <= 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b73fd138-5565-4c80-a061-be8e970c7ea6?source=api-prod","affected":[{"type":"plugin","slug":"smdp-affiliate-platform","name":"Affiliate Platform","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:09:49Z"},{"id":"wordfence:b7413d90-aed1-4f78-a17c-bed76efb48f8","source":"wordfence","cve":"CVE-2025-1669","title":"School Management System \u2013 WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":"2.2.18"}],"published":"2025-03-14T14:22:45Z","updated":"2025-11-05T19:39:04Z"},{"id":"wordfence:b7413f09-14d5-4cb6-9bcd-c36a14a13e88","source":"wordfence","cve":"CVE-2025-53309","title":"Accept Stripe Payments Using Contact Form 7 <= 3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413f09-14d5-4cb6-9bcd-c36a14a13e88?source=api-prod","affected":[{"type":"plugin","slug":"accept-stripe-payments-using-contact-form-7","name":"Accept Stripe Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-07T13:34:48Z"},{"id":"wordfence:b7417e25-be35-4134-9d38-f8ee91f0d1cf","source":"wordfence","cve":"CVE-2024-4085","title":"Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7417e25-be35-4134-9d38-f8ee91f0d1cf?source=api-prod","affected":[{"type":"plugin","slug":"docollipics-faustball-de","name":"Tabellen von faustball.com","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:32Z"},{"id":"wordfence:b74a5a4c-250a-46bc-bf08-2dd720de41ae","source":"wordfence","cve":"CVE-2024-24884","title":"Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b74a5a4c-250a-46bc-bf08-2dd720de41ae?source=api-prod","affected":[{"type":"plugin","slug":"ari-cf7-connector","name":"Contact Form 7 Connector","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:17:52Z"},{"id":"wordfence:b74c99e7-e7e4-4bb6-a1e5-3ff7047400cd","source":"wordfence","cve":"CVE-2026-25391","title":"WP Wand \u2013 Unlimited Content Generation using AI \u2013 for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b74c99e7-e7e4-4bb6-a1e5-3ff7047400cd?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-generation","name":"WP Wand \u2013 AI Content Writer for OpenAI, Claude, Gemini, OpenRouter and Deepseek","from":"*","from_inclusive":true,"to":"1.3.07","to_inclusive":true,"patched_in":""}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-26T19:52:51Z"},{"id":"wordfence:b751191b-35a8-4331-ac3f-f6090221c65f","source":"wordfence","cve":"CVE-2024-24848","title":"PT Sign Ups <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b751191b-35a8-4331-ac3f-f6090221c65f?source=api-prod","affected":[{"type":"plugin","slug":"ptoffice-sign-ups","name":"PT Sign Ups \u2013 Beautiful volunteer sign ups and management made easy","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T21:01:19Z"},{"id":"wordfence:b754bab8-a16f-41f0-a3c9-2adc0f572c97","source":"wordfence","cve":"CVE-2026-115303","title":"Contact Form by Supsystic <= 1.11.0 - Unauthenticated Arbitrary Email Header Injection","severity":"medium","cvss":5.3,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b754bab8-a16f-41f0-a3c9-2adc0f572c97?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T21:33:28Z"},{"id":"wordfence:b75696a4-fc07-4ab4-b108-6425c050de50","source":"wordfence","cve":"CVE-2025-49445","title":"Interactive UK Regional Map <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75696a4-fc07-4ab4-b108-6425c050de50?source=api-prod","affected":[{"type":"plugin","slug":"interactive-uk-regional-map","name":"Interactive UK Regional Map","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:27:53Z"},{"id":"wordfence:b7570c97-4eb7-4614-af8f-1a2a9695de08","source":"wordfence","cve":"CVE-2025-48253","title":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7570c97-4eb7-4614-af8f-1a2a9695de08?source=api-prod","affected":[{"type":"plugin","slug":"amount-left-free-shipping-woocommerce","name":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T20:56:05Z"},{"id":"wordfence:b75789ff-6050-4044-a3ff-d071591b4ec6","source":"wordfence","cve":"CVE-2026-14310","title":"Tutor LMS \u2013 eLearning and online course solution < 4.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75789ff-6050-4044-a3ff-d071591b4ec6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:36:45Z"},{"id":"wordfence:b758c8a7-6220-4b54-af88-7933a530b5ba","source":"wordfence","cve":"","title":"ARI Stream Quiz <= 1.2.32 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b758c8a7-6220-4b54-af88-7933a530b5ba?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b75c5458-c496-49dd-a621-d93321cec29e","source":"wordfence","cve":"CVE-2026-103085","title":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75c5458-c496-49dd-a621-d93321cec29e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.20","to_inclusive":true,"patched_in":"2.9.21"}],"published":"2026-10-03T17:37:23Z","updated":"2026-10-08T23:16:41Z"},{"id":"wordfence:b75c9f57-d08e-4dd8-a541-92d5ed5de19b","source":"wordfence","cve":"CVE-2026-111955","title":"WholesaleX \u2013 All-in-One B2B Solution with Wholesale Pricing < 3.0.9 - Unauthenticated Account Activation Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75c9f57-d08e-4dd8-a541-92d5ed5de19b?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:31:51Z"},{"id":"wordfence:b75dc285-bc85-44b4-92b5-f6035632e8e6","source":"wordfence","cve":"CVE-2026-9061","title":"Agile Store Locator <= 1.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75dc285-bc85-44b4-92b5-f6035632e8e6?source=api-prod","affected":[{"type":"plugin","slug":"agile-store-locator","name":"Agile Store Locator","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2026-05-23T00:00:00Z","updated":"2026-09-18T14:49:44Z"},{"id":"wordfence:b75dd9fe-0cc9-496a-8c47-ffd98bc63d10","source":"wordfence","cve":"CVE-2026-16568","title":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b75dd9fe-0cc9-496a-8c47-ffd98bc63d10?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-for-woocommerce","name":"Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce","from":"*","from_inclusive":true,"to":"0.4.62","to_inclusive":true,"patched_in":"0.4.63"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:45:28Z"},{"id":"wordfence:b761292e-375c-4657-a7a8-e11af28f45fa","source":"wordfence","cve":"CVE-2015-9379","title":"iThemes Builder Style Manager < 0.7.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b761292e-375c-4657-a7a8-e11af28f45fa?source=api-prod","affected":[{"type":"plugin","slug":"builder-style-manager","name":"iThemes Builder Style Manager","from":"*","from_inclusive":true,"to":"0.7.7","to_inclusive":false,"patched_in":"0.7.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b762f8ed-2231-4c47-acda-721edfa5cc06","source":"wordfence","cve":"CVE-2025-30600","title":"WP Hotjar <= 0.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b762f8ed-2231-4c47-acda-721edfa5cc06?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotjar","name":"WP Hotjar","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:46:49Z"},{"id":"wordfence:b764f232-6638-4866-b48c-1f89efac76c6","source":"wordfence","cve":"CVE-2025-31459","title":"Login Alert <= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b764f232-6638-4866-b48c-1f89efac76c6?source=api-prod","affected":[{"type":"plugin","slug":"login-alert","name":"Login Alert","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:04:45Z"},{"id":"wordfence:b765a5b2-268a-4dcd-9290-274e28c02830","source":"wordfence","cve":"CVE-2026-13146","title":"Travel <= 12.0.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b765a5b2-268a-4dcd-9290-274e28c02830?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":true,"patched_in":"12.0.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:08:08Z"},{"id":"wordfence:b766971c-c966-4ce1-814d-95efc988cfd9","source":"wordfence","cve":"CVE-2024-4217","title":"Shortcodes Ultimate Pro <= 7.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b766971c-c966-4ce1-814d-95efc988cfd9?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate-pro","name":"Shortcodes Ultimate Pro","from":"*","from_inclusive":true,"to":"7.1.4","to_inclusive":true,"patched_in":"7.1.5"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:32:43Z"},{"id":"wordfence:b7676362-4373-4c9a-b3cd-73fad9ff5477","source":"wordfence","cve":"CVE-2026-89278","title":"GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7676362-4373-4c9a-b3cd-73fad9ff5477?source=api-prod","affected":[{"type":"plugin","slug":"gptranslate","name":"GPTranslate \u2013 Multilingual AI Translation Agent for WordPress: Translate Your Site with AI","from":"*","from_inclusive":true,"to":"2.34.6","to_inclusive":true,"patched_in":"2.34.7"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-18T06:38:56Z"},{"id":"wordfence:b7690157-53de-40da-a161-5b6ebe3e4e64","source":"wordfence","cve":"CVE-2026-105874","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7690157-53de-40da-a161-5b6ebe3e4e64?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:50:38Z"},{"id":"wordfence:b76b12ed-1bb4-4aa9-ab9f-06084c667f40","source":"wordfence","cve":"CVE-2024-1780","title":"BizCalendar Web <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b76b12ed-1bb4-4aa9-ab9f-06084c667f40?source=api-prod","affected":[{"type":"plugin","slug":"bizcalendar-web","name":"BizCalendar Web","from":"*","from_inclusive":true,"to":"1.1.0.25","to_inclusive":true,"patched_in":"1.1.0.26"}],"published":"2024-04-09T00:00:00Z","updated":"2024-08-07T13:21:41Z"},{"id":"wordfence:b76b3dd2-bf6b-4b18-9666-2ecbf628437c","source":"wordfence","cve":"CVE-2015-9463","title":"S3Bubble Cloud Video with Adverts and Analytics < 4.8  - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b76b3dd2-bf6b-4b18-9666-2ecbf628437c?source=api-prod","affected":[{"type":"plugin","slug":"s3bubble-amazon-s3-audio-streaming","name":"S3Bubble Cloud Video with Adverts and Analytics","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":false,"patched_in":"4.8"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b76bddf3-96ad-4bb0-a37b-33b451da6713","source":"wordfence","cve":"CVE-2024-1278","title":"Easy Social Feed \u2013 Social Photos Gallery \u2013 Post Feed \u2013 Like Box <= 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b76bddf3-96ad-4bb0-a37b-33b451da6713?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T23:33:53Z"},{"id":"wordfence:b76de574-2627-46cd-9817-134a009ac3bd","source":"wordfence","cve":"CVE-2024-13426","title":"WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b76de574-2627-46cd-9817-134a009ac3bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.77.2","to_inclusive":true,"patched_in":"2.77.3"}],"published":"2025-01-21T14:08:11Z","updated":"2025-01-22T02:20:24Z"},{"id":"wordfence:b770224d-1146-449e-919c-b04350e828e2","source":"wordfence","cve":"CVE-2025-1624","title":"GDPR Cookie Compliance <= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b770224d-1146-449e-919c-b04350e828e2?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.8","to_inclusive":true,"patched_in":"4.15.9"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-24T20:02:46Z"},{"id":"wordfence:b771199e-937f-46d5-9906-4cbbbcd748cd","source":"wordfence","cve":"CVE-2025-22504","title":"4ECPS Web Forms <= 0.2.18 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b771199e-937f-46d5-9906-4cbbbcd748cd?source=api-prod","affected":[{"type":"plugin","slug":"4ecps-webforms","name":"4ECPS Web Forms","from":"*","from_inclusive":true,"to":"0.2.18","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:12:46Z"},{"id":"wordfence:b772a695-658f-41aa-b40e-b5a91a6d01a4","source":"wordfence","cve":"CVE-2025-31381","title":"Booking Calendar and Notification <= 4.0.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b772a695-658f-41aa-b40e-b5a91a6d01a4?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-and-notification","name":"Booking Calendar and Notification","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T15:45:36Z"},{"id":"wordfence:b778048c-22e8-42ea-9d60-6e58b31a3035","source":"wordfence","cve":"CVE-2022-1336","title":"Carousel CK <= 1.1.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b778048c-22e8-42ea-9d60-6e58b31a3035?source=api-prod","affected":[{"type":"plugin","slug":"carousel-ck","name":"Carousel CK","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7787311-df2a-4229-b8c5-935b103dfd17","source":"wordfence","cve":"CVE-2025-62135","title":"Responsive Block Control <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7787311-df2a-4229-b8c5-935b103dfd17?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-control","name":"Responsive Block Control \u2013 Hide blocks based on display width","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-15T17:53:41Z"},{"id":"wordfence:b77b064d-ab8c-4e84-b5cc-efbdeefbf502","source":"wordfence","cve":"CVE-2024-13488","title":"LTL Freight Quotes \u2013 Estes Edition <= 3.3.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77b064d-ab8c-4e84-b5cc-efbdeefbf502?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-estes-edition","name":"LTL Freight Quotes \u2013 Estes Edition","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-15T11:26:49Z"},{"id":"wordfence:b77b0802-2efe-45d1-b338-d6d020f2bb05","source":"wordfence","cve":"CVE-2025-2247","title":"WP-PManager <= 1.2 - Cross-Site Request Forgery to Category Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77b0802-2efe-45d1-b338-d6d020f2bb05?source=api-prod","affected":[{"type":"plugin","slug":"wp-programmmanager","name":"WP-PManager","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-05-23T15:05:11Z"},{"id":"wordfence:b77c3d65-23c0-4bda-afea-9cad00fc04d6","source":"wordfence","cve":"","title":"Invite Anyone <= 1.3.18 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77c3d65-23c0-4bda-afea-9cad00fc04d6?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.3.18","to_inclusive":true,"patched_in":"1.3.19"}],"published":"2017-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b77c4471-57a2-4655-9ff5-41057702f381","source":"wordfence","cve":"CVE-2025-68572","title":"BBP Core <= 1.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77c4471-57a2-4655-9ff5-41057702f381?source=api-prod","affected":[{"type":"plugin","slug":"bbp-core","name":"Forumax \u2013 AI Powered Advanced Community Forum Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-06T14:28:22Z"},{"id":"wordfence:b77e2abd-ad9c-4c0a-a467-c52767a6a97d","source":"wordfence","cve":"CVE-2026-27045","title":"WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77e2abd-ad9c-4c0a-a467-c52767a6a97d?source=api-prod","affected":[{"type":"plugin","slug":"sb-woocommerce-infinite-scroll","name":"sb-woocommerce-infinite-scroll","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T20:58:50Z"},{"id":"wordfence:b77e31cf-f5fd-4ae4-84bd-e92fe34690da","source":"wordfence","cve":"CVE-2025-22701","title":"Traveler Layout Essential For Elementor < 1.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77e31cf-f5fd-4ae4-84bd-e92fe34690da?source=api-prod","affected":[{"type":"plugin","slug":"traveler-layout-essential-for-elementor","name":"Traveler Layout Essential For Elementor","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2025-01-31T00:00:00Z","updated":"2025-03-05T14:22:15Z"},{"id":"wordfence:b77ea258-dced-4c36-bd0d-8977a347d1c9","source":"wordfence","cve":"CVE-2024-10057","title":"RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b77ea258-dced-4c36-bd0d-8977a347d1c9?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-10-17T21:09:44Z","updated":"2024-10-18T09:32:17Z"},{"id":"wordfence:b7832d37-19a9-491b-879e-4a22f2ba46ec","source":"wordfence","cve":"CVE-2024-10674","title":"Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7832d37-19a9-491b-879e-4a22f2ba46ec?source=api-prod","affected":[{"type":"theme","slug":"th-shop-mania","name":"Th Shop Mania","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:18:14Z"},{"id":"wordfence:b7850e73-8ffd-46d4-97c6-5343486a31dc","source":"wordfence","cve":"CVE-2026-11776","title":"Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7850e73-8ffd-46d4-97c6-5343486a31dc?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.43","to_inclusive":true,"patched_in":"1.15.44"}],"published":"2026-06-17T16:13:22Z","updated":"2026-06-18T04:31:10Z"},{"id":"wordfence:b786ad61-eed7-4be7-9204-f440570916ea","source":"wordfence","cve":"CVE-2026-24613","title":"Ecwid Shopping Cart <= 7.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b786ad61-eed7-4be7-9204-f440570916ea?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"7.0.7"}],"published":"2026-01-12T00:00:00Z","updated":"2026-02-03T21:02:42Z"},{"id":"wordfence:b7886d0a-941d-4bb3-850e-84ed09e83f05","source":"wordfence","cve":"CVE-2025-31032","title":"Pagopar &#8211; WooCommerce Gateway <= 2.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7886d0a-941d-4bb3-850e-84ed09e83f05?source=api-prod","affected":[{"type":"plugin","slug":"pagopar-woocommerce-gateway","name":"Pagopar \u2013 WooCommerce Gateway","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-14T14:14:32Z"},{"id":"wordfence:b788e59a-4796-4ad9-8098-01b84908f97c","source":"wordfence","cve":"CVE-2025-48127","title":"Push notification for Mobile and Web app <= 2.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b788e59a-4796-4ad9-8098-01b84908f97c?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-mobile-and-web-app","name":"Push notification for Mobile and Web app","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-05-16T00:00:00Z","updated":"2025-12-09T21:47:15Z"},{"id":"wordfence:b78985ad-37e5-4eb3-b3aa-716972423848","source":"wordfence","cve":"CVE-2024-47304","title":"Fluent Support <= 1.8.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b78985ad-37e5-4eb3-b3aa-716972423848?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:35:12Z"},{"id":"wordfence:b78a0c28-5121-4d07-b6ee-ada752688e56","source":"wordfence","cve":"CVE-2026-12582","title":"Library Management System <= 3.5.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b78a0c28-5121-4d07-b6ee-ada752688e56?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-29T22:23:41Z"},{"id":"wordfence:b78ea0d4-e2af-4fe8-9165-b7e709165f6d","source":"wordfence","cve":"CVE-2026-77013","title":"\u7231\u91c7\u96c6\u6570\u636e\u91c7\u96c6\u548c\u53d1\u5e03\u63d2\u4ef6 <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b78ea0d4-e2af-4fe8-9165-b7e709165f6d?source=api-prod","affected":[{"type":"plugin","slug":"icollect","name":"\u7231\u91c7\u96c6\u6570\u636e\u91c7\u96c6\u548c\u53d1\u5e03\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-09-02T13:34:22Z"},{"id":"wordfence:b78eb275-bede-44f0-bf72-6931c37d78bf","source":"wordfence","cve":"CVE-2020-11673","title":"TS Poll \u2013 Best Poll Plugin for WordPress <1.3.4 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b78eb275-bede-44f0-bf72-6931c37d78bf?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2020-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b790db69-cccd-4adf-a7fa-f7db4dd96be6","source":"wordfence","cve":"CVE-2018-21002","title":"JS Help Desk \u2013 Best Help Desk & Support Plugin <= 2.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b790db69-cccd-4adf-a7fa-f7db4dd96be6?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2018-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b79179d5-a964-4a3f-a4de-69d1260d3949","source":"wordfence","cve":"CVE-2026-103752","title":"Authorizer <= 3.15.3 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b79179d5-a964-4a3f-a4de-69d1260d3949?source=api-prod","affected":[{"type":"plugin","slug":"authorizer","name":"Authorizer","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.16.0"}],"published":"2026-10-01T13:39:16Z","updated":"2026-10-08T23:21:29Z"},{"id":"wordfence:b7925df5-140a-4fc5-84f4-faafe73423d2","source":"wordfence","cve":"CVE-2026-28119","title":"Nirvana <= 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7925df5-140a-4fc5-84f4-faafe73423d2?source=api-prod","affected":[{"type":"theme","slug":"nirvana","name":"Nirvana","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:33:48Z"},{"id":"wordfence:b7926ec6-3441-4062-93b2-6c2120c9f406","source":"wordfence","cve":"CVE-2024-4362","title":"SiteOrigin Widgets Bundle <= 1.60.0 -  - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7926ec6-3441-4062-93b2-6c2120c9f406?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.60.0","to_inclusive":true,"patched_in":"1.61.0"}],"published":"2024-05-21T19:57:22Z","updated":"2024-05-22T08:31:23Z"},{"id":"wordfence:b793a4cb-3130-428e-9b61-8ce29fcdaf70","source":"wordfence","cve":"CVE-2023-1926","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCacheToolbar'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b793a4cb-3130-428e-9b61-8ce29fcdaf70?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b796b514-b6ca-4a22-9340-df02fec97075","source":"wordfence","cve":"CVE-2023-41851","title":"WP Custom Post Template <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b796b514-b6ca-4a22-9340-df02fec97075?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-post-template","name":"WP Custom Post Template","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b797e141-a9d2-48c4-a44e-a59a80a90a5b","source":"wordfence","cve":"CVE-2025-11726","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b797e141-a9d2-48c4-a44e-a59a80a90a5b?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.4.1"}],"published":"2025-12-01T18:42:40Z","updated":"2025-12-02T07:24:31Z"},{"id":"wordfence:b7981f40-7f55-40cb-977b-000323119a22","source":"wordfence","cve":"CVE-2026-95531","title":"WPBot \u2013 ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7981f40-7f55-40cb-977b-000323119a22?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-09-29T09:44:55Z","updated":"2026-10-08T23:52:50Z"},{"id":"wordfence:b798cd27-03c3-495e-aa94-743d80a493e0","source":"wordfence","cve":"CVE-2025-67939","title":"Tickera <= 3.5.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b798cd27-03c3-495e-aa94-743d80a493e0?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.6.2","to_inclusive":true,"patched_in":"3.5.6.3"}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T20:24:21Z"},{"id":"wordfence:b79ade88-335b-40ac-a20f-d73823eabbf4","source":"wordfence","cve":"CVE-2025-48105","title":"Easy Flash Embed <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b79ade88-335b-40ac-a20f-d73823eabbf4?source=api-prod","affected":[{"type":"plugin","slug":"easy-flash-embed","name":"Easy Flash Embed","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-09-09T22:38:09Z"},{"id":"wordfence:b79b9d79-d22b-421b-b355-35d95a0820b2","source":"wordfence","cve":"CVE-2025-23762","title":"DsgnWrks Twitter Importer <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b79b9d79-d22b-421b-b355-35d95a0820b2?source=api-prod","affected":[{"type":"plugin","slug":"dsgnwrks-twitter-importer","name":"DsgnWrks Twitter Importer","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:37:47Z"},{"id":"wordfence:b79d5483-eaa3-4fc8-97d1-4c883d4ea480","source":"wordfence","cve":"CVE-2025-47662","title":"Woobox <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b79d5483-eaa3-4fc8-97d1-4c883d4ea480?source=api-prod","affected":[{"type":"plugin","slug":"woobox","name":"Woobox","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-06-27T19:48:17Z"},{"id":"wordfence:b79e0723-9e6f-44e9-ba85-393cea134f94","source":"wordfence","cve":"CVE-2025-62086","title":"\u042f\u043d\u0434\u0435\u043a\u0441 \u0414\u043e\u0441\u0442\u0430\u0432\u043a\u0430 (Boxberry) <= 2.32 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b79e0723-9e6f-44e9-ba85-393cea134f94?source=api-prod","affected":[{"type":"plugin","slug":"boxberry","name":"\u042f\u043d\u0434\u0435\u043a\u0441 \u0414\u043e\u0441\u0442\u0430\u0432\u043a\u0430 (Boxberry)","from":"*","from_inclusive":true,"to":"2.32","to_inclusive":true,"patched_in":""}],"published":"2025-10-28T00:00:00Z","updated":"2025-12-10T15:52:25Z"},{"id":"wordfence:b7a07827-74bd-45ef-8035-277c35565d54","source":"wordfence","cve":"CVE-2024-43351","title":"Bravada <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7a07827-74bd-45ef-8035-277c35565d54?source=api-prod","affected":[{"type":"theme","slug":"bravada","name":"Bravada","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-23T21:14:41Z"},{"id":"wordfence:b7a0e7d3-de99-4854-9320-f0e3dc34056e","source":"wordfence","cve":"CVE-2026-94391","title":"Ultimate FAQ Accordion Plugin <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7a0e7d3-de99-4854-9320-f0e3dc34056e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-09-23T13:43:00Z","updated":"2026-09-29T20:05:35Z"},{"id":"wordfence:b7a185d3-1042-4505-917c-222714795047","source":"wordfence","cve":"CVE-2026-77766","title":"Directorist 8.5 - 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7a185d3-1042-4505-917c-222714795047?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"8.5","from_inclusive":true,"to":"8.9.4","to_inclusive":true,"patched_in":"8.9.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:47:07Z"},{"id":"wordfence:b7a57c3b-0d1b-40ad-9e55-6a1eab4e0380","source":"wordfence","cve":"","title":"User Role Editor <= 4.24 - Authenticated Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7a57c3b-0d1b-40ad-9e55-6a1eab4e0380?source=api-prod","affected":[{"type":"plugin","slug":"user-role-editor","name":"User Role Editor","from":"*","from_inclusive":true,"to":"4.25","to_inclusive":false,"patched_in":"4.25"}],"published":"2016-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7abcbad-6c10-4af0-a900-62df79505360","source":"wordfence","cve":"CVE-2026-118530","title":"Directorist <= 8.10 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7abcbad-6c10-4af0-a900-62df79505360?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:23:25Z"},{"id":"wordfence:b7ac9097-b02b-4f0a-8bc3-6c6af0bdab89","source":"wordfence","cve":"CVE-2021-24742","title":"Logo Slider and Showcase <= 1.3.36 - Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7ac9097-b02b-4f0a-8bc3-6c6af0bdab89?source=api-prod","affected":[{"type":"plugin","slug":"wp-logo-showcase","name":"Logo Slider and Showcase","from":"*","from_inclusive":true,"to":"1.3.37","to_inclusive":false,"patched_in":"1.3.37"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7b0d55b-00c5-44ee-99a3-9d4d2b400f71","source":"wordfence","cve":"CVE-2026-16596","title":"WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b0d55b-00c5-44ee-99a3-9d4d2b400f71?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-09-29T19:39:00Z","updated":"2026-09-30T07:41:07Z"},{"id":"wordfence:b7b1620e-a26b-454d-890c-37dfa90abfad","source":"wordfence","cve":"CVE-2025-39359","title":"CWW Portfolio <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b1620e-a26b-454d-890c-37dfa90abfad?source=api-prod","affected":[{"type":"theme","slug":"cww-portfolio","name":"CWW Portfolio","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:06:41Z"},{"id":"wordfence:b7b29589-804b-4d37-a3f4-919f0c1126c2","source":"wordfence","cve":"CVE-2019-20141","title":"Neon - Bootstrap Admin Theme <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b29589-804b-4d37-a3f4-919f0c1126c2?source=api-prod","affected":[{"type":"theme","slug":"neon","name":"Neon - Bootstrap Admin Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2019-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7b86b0b-84df-4b58-b50a-d61af6e3c1d3","source":"wordfence","cve":"CVE-2024-43953","title":"Classic Addons \u2013 WPBakery Page Builder <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b86b0b-84df-4b58-b50a-d61af6e3c1d3?source=api-prod","affected":[{"type":"plugin","slug":"classic-addons-wpbakery-page-builder-addons","name":"Classic Addons \u2013 WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2024-08-26T00:00:00Z","updated":"2025-07-10T14:07:55Z"},{"id":"wordfence:b7b9d981-d4de-48fe-a0e6-52e359a8ccd4","source":"wordfence","cve":"CVE-2026-81660","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation < 4.5.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7b9d981-d4de-48fe-a0e6-52e359a8ccd4?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":false,"patched_in":"4.5.13"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T20:46:18Z"},{"id":"wordfence:b7bbeeea-3888-42a6-8d14-f5c39f5dcb70","source":"wordfence","cve":"CVE-2026-89055","title":"Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7bbeeea-3888-42a6-8d14-f5c39f5dcb70?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.120.0","to_inclusive":true,"patched_in":"5.121.0"}],"published":"2026-09-24T18:14:15Z","updated":"2026-09-25T06:39:54Z"},{"id":"wordfence:b7beaa9e-517b-4717-b896-3e37424e27a3","source":"wordfence","cve":"CVE-2022-0205","title":"YOP Poll <= 6.3.4 - Author+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7beaa9e-517b-4717-b896-3e37424e27a3?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"6.3.5"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7c0efd8-08c0-4283-a0bf-2f6ca3998668","source":"wordfence","cve":"CVE-2022-0680","title":"Plezi < 1.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c0efd8-08c0-4283-a0bf-2f6ca3998668?source=api-prod","affected":[{"type":"plugin","slug":"plezi","name":"Plezi","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7c37c4e-7a01-447c-a1d5-595c2012eb8c","source":"wordfence","cve":"CVE-2018-1000505","title":"Tooltipy < 5.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c37c4e-7a01-447c-a1d5-595c2012eb8c?source=api-prod","affected":[{"type":"plugin","slug":"bluet-keywords-tooltip-generator","name":"Tooltipy (tooltips for WP)","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":false,"patched_in":"5.1"}],"published":"2018-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7c39952-d179-4b40-9762-7815e881a560","source":"wordfence","cve":"CVE-2024-38753","title":"Dynamic Word Spinner: CSS3 Animated Rotation <= 5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c39952-d179-4b40-9762-7815e881a560?source=api-prod","affected":[{"type":"plugin","slug":"css3-rotating-words","name":"SmartText Rotator \u2013 Add Motion to Your Words","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-31T21:07:53Z"},{"id":"wordfence:b7c54b5d-ad73-44f1-afdb-01136ec0b9ae","source":"wordfence","cve":"CVE-2025-13361","title":"Web to SugarCRM Lead <= 1.0.0 - Cross-Site Request Forgery to Custom Field Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c54b5d-ad73-44f1-afdb-01136ec0b9ae?source=api-prod","affected":[{"type":"plugin","slug":"web-to-sugarcrm-lead","name":"Web to SugarCRM Lead","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-12-20T14:22:10Z","updated":"2025-12-21T03:20:06Z"},{"id":"wordfence:b7c630c0-b37f-48d5-a87c-8e7c60103a30","source":"wordfence","cve":"CVE-2023-46088","title":"WP Full Stripe Free <= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c630c0-b37f-48d5-a87c-8e7c60103a30?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"7.0.5","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-03-14T13:13:13Z"},{"id":"wordfence:b7c70db1-5058-45e5-bd12-3e2cab0338ad","source":"wordfence","cve":"CVE-2012-2400","title":"WordPress Core < 3.3.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c70db1-5058-45e5-bd12-3e2cab0338ad?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2012-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7c7e45a-581e-4cf0-83ac-cbca816701f1","source":"wordfence","cve":"CVE-2026-11907","title":"Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c7e45a-581e-4cf0-83ac-cbca816701f1?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-08-06T16:25:31Z","updated":"2026-08-07T04:25:55Z"},{"id":"wordfence:b7c808ff-546b-445e-af38-0b45cab3f307","source":"wordfence","cve":"","title":"Ultimate Addons for Beaver Builder \u2013 Lite <= 1.5.4 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7c808ff-546b-445e-af38-0b45cab3f307?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder-lite","name":"Ultimate Addons for Beaver Builder (UABB)","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7cc5b51-5fb4-470b-8d2d-581eceadde7b","source":"wordfence","cve":"CVE-2014-9033","title":"WordPress Core < 4.0.1 - Cross-Site Request Forgery to Authentication Takeover","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7cc5b51-5fb4-470b-8d2d-581eceadde7b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.7.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2014-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7d109b6-47fb-4cda-9067-96e31d3b4308","source":"wordfence","cve":"CVE-2025-52763","title":"Nifty Backups <= 1.08 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d109b6-47fb-4cda-9067-96e31d3b4308?source=api-prod","affected":[{"type":"plugin","slug":"nifty-backups","name":"Nifty Backups \u2013 WordPress Backup & Restore","from":"*","from_inclusive":true,"to":"1.08","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T00:00:00Z","updated":"2025-10-29T19:14:06Z"},{"id":"wordfence:b7d1c57c-7aa2-4317-94ac-3fc48f87b98c","source":"wordfence","cve":"CVE-2024-29794","title":"Conversios.io <= 6.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d1c57c-7aa2-4317-94ac-3fc48f87b98c?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"6.9.1","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T19:00:27Z"},{"id":"wordfence:b7d2e351-6ee2-4865-b1d2-909e76e1ecb5","source":"wordfence","cve":"CVE-2025-22752","title":"GSheetConnector for Forminator Forms <= 1.0.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d2e351-6ee2-4865-b1d2-909e76e1ecb5?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-forminator","name":"GSheetConnector \u2013 Forminator Google Sheets Connector, Export Forminator Submissions","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-01-14T00:00:00Z","updated":"2025-03-04T20:40:45Z"},{"id":"wordfence:b7d46e8e-0f90-4379-98d0-13d0bd1f2e66","source":"wordfence","cve":"CVE-2025-64284","title":"Majestic Support <= 1.0.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d46e8e-0f90-4379-98d0-13d0bd1f2e66?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-04-22T00:00:00Z","updated":"2026-03-17T21:37:30Z"},{"id":"wordfence:b7d475d5-9c00-409c-ac07-276242540123","source":"wordfence","cve":"CVE-2014-7959","title":"BulletProof Security < .51.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d475d5-9c00-409c-ac07-276242540123?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".51.1","to_inclusive":false,"patched_in":".51.1"}],"published":"2014-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7d820c4-0cf6-4201-84c2-eda8ccd5411c","source":"wordfence","cve":"CVE-2026-87782","title":"Koinonia Link 1.1.2 - 1.1.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d820c4-0cf6-4201-84c2-eda8ccd5411c?source=api-prod","affected":[{"type":"plugin","slug":"koinonia-link","name":"Koinonia Link","from":"1.1.2","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:43:59Z"},{"id":"wordfence:b7d84cb9-175f-433c-ab5c-d89621847b4d","source":"wordfence","cve":"","title":"Photo Gallery by 10Web <= 1.5.78 - Stored Cross-Site Scripting via Uploaded SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d84cb9-175f-433c-ab5c-d89621847b4d?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.78","to_inclusive":true,"patched_in":"1.5.79"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7d85921-9d70-4812-9c5f-11ee1d0821be","source":"wordfence","cve":"CVE-2024-21747","title":"WP ERP <= 1.12.8 - Authenticated (Accounting manager+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d85921-9d70-4812-9c5f-11ee1d0821be?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.8","to_inclusive":true,"patched_in":"1.12.9"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7d9200b-af1c-4cd2-9d34-eaff97d56967","source":"wordfence","cve":"CVE-2022-4562","title":"Meks Flexible Shortcodes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d9200b-af1c-4cd2-9d34-eaff97d56967?source=api-prod","affected":[{"type":"plugin","slug":"meks-flexible-shortcodes","name":"Meks Flexible Shortcodes","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-01-17T00:00:00Z","updated":"2024-10-23T08:40:01Z"},{"id":"wordfence:b7d9a50f-695c-4fed-b472-4a37a1ee7f42","source":"wordfence","cve":"CVE-2025-32174","title":"Tockify Events Calendar <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7d9a50f-695c-4fed-b472-4a37a1ee7f42?source=api-prod","affected":[{"type":"plugin","slug":"tockify-events-calendar","name":"Tockify Events Calendar","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:16:45Z"},{"id":"wordfence:b7dac90c-d84a-4e93-a4c0-baaa5fee11c9","source":"wordfence","cve":"CVE-2017-1002011","title":"Image Gallery with Slideshow Plugin <= 1.5.2 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7dac90c-d84a-4e93-a4c0-baaa5fee11c9?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-with-slideshow","name":"Image Gallery with Slideshow Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7db3bf3-25df-4e16-9aed-dd544a8435d3","source":"wordfence","cve":"CVE-2024-51798","title":"Surbma | Font Awesome <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7db3bf3-25df-4e16-9aed-dd544a8435d3?source=api-prod","affected":[{"type":"plugin","slug":"surbma-font-awesome","name":"Surbma | Font Awesome","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-11-08T00:00:00Z","updated":"2025-01-06T21:03:24Z"},{"id":"wordfence:b7db3d45-2b96-4ba4-b258-08ee5e0b947b","source":"wordfence","cve":"CVE-2023-32502","title":"Pro Mime Types <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7db3d45-2b96-4ba4-b258-08ee5e0b947b?source=api-prod","affected":[{"type":"plugin","slug":"pro-mime-types","name":"Pro Mime Types \u2013 Manage file media types","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7dce0db-792f-4be2-a55d-b4fb7442b548","source":"wordfence","cve":"CVE-2024-43241","title":"Indeed Membership Pro <= 12.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7dce0db-792f-4be2-a55d-b4fb7442b548?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":true,"patched_in":"12.8"}],"published":"2024-08-12T00:00:00Z","updated":"2024-11-13T21:41:46Z"},{"id":"wordfence:b7df753a-5399-45ff-894f-8f35868fe072","source":"wordfence","cve":"CVE-2021-25063","title":"Contact Form 7 Skins <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7df753a-5399-45ff-894f-8f35868fe072?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-skins","name":"CF7 Skins for Contact Form 7","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7e2ca2e-c495-47f8-9c18-da5ba73d9e70","source":"wordfence","cve":"CVE-2022-2442","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.74","to_inclusive":true,"patched_in":"0.9.75"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7e417c2-bf9c-4c88-be2b-9c2324897b07","source":"wordfence","cve":"","title":"Laposta Signup Basic <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e417c2-bf9c-4c88-be2b-9c2324897b07?source=api-prod","affected":[{"type":"plugin","slug":"laposta-signup-basic","name":"Laposta Signup Basic","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7e504ef-9989-468f-9bd0-dd8416f16d85","source":"wordfence","cve":"CVE-2022-4777","title":"BootStrap Shortcode < 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e504ef-9989-468f-9bd0-dd8416f16d85?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-shortcodes","name":"Bootstrap Shortcodes","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":false,"patched_in":"3.4.6"}],"published":"2023-01-27T00:00:00Z","updated":"2026-10-28T21:04:33Z"},{"id":"wordfence:b7e599b1-20fb-4260-bdc3-ef0653719b26","source":"wordfence","cve":"CVE-2024-29773","title":"BizPrint <= 4.5.4 - Cross-Site Request Forgery to Cross-Site Scripting via process.php","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e599b1-20fb-4260-bdc3-ef0653719b26?source=api-prod","affected":[{"type":"plugin","slug":"print-google-cloud-print-gcp-woocommerce","name":"Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:29:47Z"},{"id":"wordfence:b7e7222e-93ea-42d5-9749-deb6b1d920af","source":"wordfence","cve":"CVE-2026-25439","title":"Booknetic <= 4.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e7222e-93ea-42d5-9749-deb6b1d920af?source=api-prod","affected":[{"type":"plugin","slug":"booknetic","name":"Booknetic","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T00:00:00Z","updated":"2026-07-14T15:01:42Z"},{"id":"wordfence:b7ea6312-2703-47d1-909e-8c5fd05d9929","source":"wordfence","cve":"CVE-2024-47379","title":"Web Directory Free <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7ea6312-2703-47d1-909e-8c5fd05d9929?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:20:42Z"},{"id":"wordfence:b7eaca63-8bc6-41c5-abf1-57d2885fcd90","source":"wordfence","cve":"CVE-2025-48352","title":"Yandex Site search pinger <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7eaca63-8bc6-41c5-abf1-57d2885fcd90?source=api-prod","affected":[{"type":"plugin","slug":"yandex-pinger","name":"\u042f\u043d\u0434\u0435\u043a\u0441.\u041f\u0414\u0421 \u041f\u0438\u043d\u0433\u0435\u0440 / Yandex Site search pinger","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:10:28Z"},{"id":"wordfence:b7eb185f-3958-4bc4-b904-8f26a71d8953","source":"wordfence","cve":"CVE-2025-32163","title":"Xpro Elementor Addons <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7eb185f-3958-4bc4-b904-8f26a71d8953?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-25T15:04:21Z"},{"id":"wordfence:b7eb4cac-cf16-438e-81cc-516646e77cdc","source":"wordfence","cve":"CVE-2026-19943","title":"Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7eb4cac-cf16-438e-81cc-516646e77cdc?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-08-24T14:33:15Z","updated":"2026-08-25T03:27:07Z"},{"id":"wordfence:b7eb9e6e-52d7-41d2-b51f-5cc5b7f3dd40","source":"wordfence","cve":"CVE-2025-11307","title":"Google Maps <= 9.0.47 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7eb9e6e-52d7-41d2-b51f-5cc5b7f3dd40?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.47","to_inclusive":true,"patched_in":"9.0.48"}],"published":"2025-10-21T00:00:00Z","updated":"2025-11-17T18:37:01Z"},{"id":"wordfence:b7edc69b-363d-49df-b82b-a9ad4fe9224a","source":"wordfence","cve":"CVE-2026-2520","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7edc69b-363d-49df-b82b-a9ad4fe9224a?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.2","to_inclusive":true,"patched_in":"27.3"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-08T11:30:01Z"},{"id":"wordfence:b7f0f6f6-31c2-4a04-a911-d3eb6fac3d20","source":"wordfence","cve":"CVE-2026-121014","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f0f6f6-31c2-4a04-a911-d3eb6fac3d20?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:54Z"},{"id":"wordfence:b7f373a8-30e6-4150-a890-5ebb702d97ee","source":"wordfence","cve":"CVE-2026-27360","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f373a8-30e6-4150-a890-5ebb702d97ee?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.38","to_inclusive":true,"patched_in":"1.8.39"}],"published":"2025-12-25T00:00:00Z","updated":"2026-03-17T21:28:20Z"},{"id":"wordfence:b7f3b469-9a6c-4cc1-bb27-bd57bbae7208","source":"wordfence","cve":"CVE-2026-12585","title":"Abandoned Cart Lite for WooCommerce <= 6.8.1 - Unauthenticated Privilege Escalation via Weak Recovery Link","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f3b469-9a6c-4cc1-bb27-bd57bbae7208?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.8.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-30T13:15:16Z"},{"id":"wordfence:b7f52e71-da35-4b46-b658-d293f81b5dc9","source":"wordfence","cve":"CVE-2023-47827","title":"Events Addon for Elementor <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f52e71-da35-4b46-b658-d293f81b5dc9?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7f6436f-60b7-4b9b-a071-93a5b95a9075","source":"wordfence","cve":"CVE-2026-39495","title":"Simply Schedule Appointments <= 1.6.9.27 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7f6436f-60b7-4b9b-a071-93a5b95a9075?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.27","to_inclusive":true,"patched_in":"1.6.9.29"}],"published":"2026-03-26T00:00:00Z","updated":"2026-04-15T21:25:30Z"},{"id":"wordfence:b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c","source":"wordfence","cve":"CVE-2025-10746","title":"Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb23e8-dabb-4d6e-a2b2-2b27d6a38b3c?source=api-prod","affected":[{"type":"plugin","slug":"integrate-dynamics-365-crm","name":"Integrate Dynamics 365 CRM","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-10-03T14:18:24Z","updated":"2025-10-04T02:24:36Z"},{"id":"wordfence:b7fb851b-dcf0-4074-82f3-dd2e57429a70","source":"wordfence","cve":"CVE-2025-64240","title":"Freshchat <= 2.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fb851b-dcf0-4074-82f3-dd2e57429a70?source=api-prod","affected":[{"type":"plugin","slug":"freshchat","name":"Freshchat","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T16:47:26Z"},{"id":"wordfence:b7fca965-86f8-4ee4-a9d6-cb18fe5f098e","source":"wordfence","cve":"CVE-2023-7251","title":"User Submitted Posts <= 20230901 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fca965-86f8-4ee4-a9d6-cb18fe5f098e?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20230901","to_inclusive":true,"patched_in":"20230902"}],"published":"2023-09-06T00:00:00Z","updated":"2024-04-24T14:59:41Z"},{"id":"wordfence:b7fcaf39-bf37-4229-89ff-8e6e819017dc","source":"wordfence","cve":"CVE-2025-23599","title":"Online Marksheet Creator : eMarksheet <= 5.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fcaf39-bf37-4229-89ff-8e6e819017dc?source=api-prod","affected":[{"type":"plugin","slug":"emarksheet","name":"Online Marksheet Creator : eMarksheet","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-04T12:58:41Z"},{"id":"wordfence:b7fe772a-542e-4c3e-b1cb-05cce3b2ec3f","source":"wordfence","cve":"","title":"wordpress vertical image slider plugin < 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7fe772a-542e-4c3e-b1cb-05cce3b2ec3f?source=api-prod","affected":[{"type":"plugin","slug":"wp-vertical-image-slider","name":"Vertical Image Slider \u2013 Responsive Thumbnail Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2015-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b7feee88-6853-48a9-b16f-b70cdd376e7a","source":"wordfence","cve":"CVE-2026-89296","title":"Pro Like Button <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7feee88-6853-48a9-b16f-b70cdd376e7a?source=api-prod","affected":[{"type":"plugin","slug":"prolike-button","name":"Pro Like Button","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:45:56Z"},{"id":"wordfence:b801e7d9-0ca0-471e-a524-af19ea0d85be","source":"wordfence","cve":"CVE-2021-39201","title":"WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b801e7d9-0ca0-471e-a524-af19ea0d85be?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.7","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.6","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.5","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.3","to_inclusive":false,"patched_in":"5.4.7"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.1","to_inclusive":false,"patched_in":"5.4.7"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b802b6bf-e70f-47ab-a72d-35f6341920eb","source":"wordfence","cve":"","title":"Widget Control Powered By Everyblock <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b802b6bf-e70f-47ab-a72d-35f6341920eb?source=api-prod","affected":[{"type":"plugin","slug":"widget-control-powered-by-everyblock","name":"Widget Control Powered By Everyblock","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8034a3b-9a25-479d-b0d8-30ed4fd76333","source":"wordfence","cve":"CVE-2026-57716","title":"Broadcast Live Video <= 7.2.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8034a3b-9a25-479d-b0d8-30ed4fd76333?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-30T12:42:54Z"},{"id":"wordfence:b803ee40-733a-49bf-a134-406747541eb6","source":"wordfence","cve":"CVE-2015-9467","title":"Broken Link Manager < 0.5.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b803ee40-733a-49bf-a134-406747541eb6?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-manager","name":"Broken Link Manager","from":"*","from_inclusive":true,"to":"0.5.0","to_inclusive":false,"patched_in":"0.5.0"}],"published":"2015-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b804bc7a-20e7-4e31-a5e9-daddfc891ba4","source":"wordfence","cve":"CVE-2025-23643","title":"ReadMe Creator <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b804bc7a-20e7-4e31-a5e9-daddfc891ba4?source=api-prod","affected":[{"type":"plugin","slug":"readme-creator","name":"ReadMe Creator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:06:55Z"},{"id":"wordfence:b805b1d1-7f3f-4bd8-9f88-eced0b2556f8","source":"wordfence","cve":"CVE-2024-32831","title":"Accessibility Widget <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b805b1d1-7f3f-4bd8-9f88-eced0b2556f8?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-widget","name":"AccessiYes Accessibility Widget for ADA, EAA & WCAG Readiness","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:00:42Z"},{"id":"wordfence:b80802cd-6fcc-4cdb-b6d7-a9171cadcc83","source":"wordfence","cve":"CVE-2024-53754","title":"Out Of Stock Badge <= 2.0 - Cross-Site Request Forgery to Stored Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80802cd-6fcc-4cdb-b6d7-a9171cadcc83?source=api-prod","affected":[{"type":"plugin","slug":"out-of-stock-badge","name":"Out Of Stock Badge","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-11-28T00:00:00Z","updated":"2026-09-09T15:50:16Z"},{"id":"wordfence:b808450f-0ebf-4c49-a9e3-f1c1f2b1f632","source":"wordfence","cve":"CVE-2023-2067","title":"Announcement & Notification Banner \u2013 Bulletin <= 3.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b808450f-0ebf-4c49-a9e3-f1c1f2b1f632?source=api-prod","affected":[{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8085c94-5aa9-447a-bd79-41168d279040","source":"wordfence","cve":"CVE-2026-56057","title":"Uncanny Automator Pro <= 7.3.0.6 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8085c94-5aa9-447a-bd79-41168d279040?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator-pro","name":"Uncanny Automator Pro","from":"*","from_inclusive":true,"to":"7.3.0.6","to_inclusive":true,"patched_in":"7.3.0.7"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:00:19Z"},{"id":"wordfence:b809ca97-ea82-4d56-a90a-e1ea9e7235ff","source":"wordfence","cve":"CVE-2024-8056","title":"MM-Breaking News <= 0.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b809ca97-ea82-4d56-a90a-e1ea9e7235ff?source=api-prod","affected":[{"type":"plugin","slug":"mm-breaking-news","name":"MM-Breaking News","from":"*","from_inclusive":true,"to":"0.7.9","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T23:37:05Z"},{"id":"wordfence:b809d705-a08f-45f2-8d4d-bc50ab89cc3a","source":"wordfence","cve":"CVE-2026-28136","title":"SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b809d705-a08f-45f2-8d4d-bc50ab89cc3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.9.12","to_inclusive":true,"patched_in":"7.0"}],"published":"2025-06-14T00:00:00Z","updated":"2026-04-15T20:57:38Z"},{"id":"wordfence:b80b35c2-73c1-4dd6-9404-e191a9a00526","source":"wordfence","cve":"CVE-2026-85415","title":"Audio Player Block 1.1.0 - 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80b35c2-73c1-4dd6-9404-e191a9a00526?source=api-prod","affected":[{"type":"plugin","slug":"audio-player-block","name":"Audio Player Block \u2013 Advanced Block for Embedding Audio Files","from":"1.1.0","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:57:05Z"},{"id":"wordfence:b80b7152-be95-4737-b324-be0a3ff7c354","source":"wordfence","cve":"CVE-2026-16968","title":"GeoDirectory <= 2.8.167 - Information Exposure to Authenticated (Contributor+) User Email Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80b7152-be95-4737-b324-be0a3ff7c354?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.167","to_inclusive":true,"patched_in":"2.8.168"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:44:37Z"},{"id":"wordfence:b80c2a5a-49f2-4b93-a1eb-a0be53aa921d","source":"wordfence","cve":"CVE-2021-24285","title":"Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80c2a5a-49f2-4b93-a1eb-a0be53aa921d?source=api-prod","affected":[{"type":"plugin","slug":"cars-seller-auto-classifieds-script","name":"Car Seller \u2013 Auto Classifieds Script","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b80c8888-e8d6-4458-ae93-8e4182060590","source":"wordfence","cve":"CVE-2024-1861","title":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80c8888-e8d6-4458-ae93-8e4182060590?source=api-prod","affected":[{"type":"plugin","slug":"antihacker","name":"Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan","from":"*","from_inclusive":true,"to":"4.52","to_inclusive":true,"patched_in":"4.53"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T09:33:35Z"},{"id":"wordfence:b80eb9fd-81f6-4bbf-ada1-125977a2ac01","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b80eb9fd-81f6-4bbf-ada1-125977a2ac01?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b811f085-9374-41e7-a9ab-fecff0b9e19d","source":"wordfence","cve":"CVE-2021-24375","title":"Motor \u2013 Cars, Parts, Service, Equipments and Accessories WooCommerce Store < 3.1.0 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b811f085-9374-41e7-a9ab-fecff0b9e19d?source=api-prod","affected":[{"type":"theme","slug":"motor","name":"Motor \u2013 Cars, Parts, Service, Equipments and Accessories WooCommerce Store","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2021-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b812a0d7-99a1-4f61-b78a-78cea6a2ada1","source":"wordfence","cve":"CVE-2025-13615","title":"StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b812a0d7-99a1-4f61-b78a-78cea6a2ada1?source=api-prod","affected":[{"type":"plugin","slug":"streamtube-core","name":"StreamTube Core","from":"*","from_inclusive":true,"to":"4.78","to_inclusive":true,"patched_in":"4.79"}],"published":"2025-11-29T12:14:32Z","updated":"2025-11-30T01:53:13Z"},{"id":"wordfence:b8133d84-e28c-4132-9eb5-941800320f84","source":"wordfence","cve":"CVE-2023-25714","title":"Quick Paypal Payments <= 5.7.25 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8133d84-e28c-4132-9eb5-941800320f84?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.25","to_inclusive":true,"patched_in":"5.7.26"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8139f3d-6e92-43aa-b161-f374875adc18","source":"wordfence","cve":"CVE-2025-23722","title":"Mind3doM RyeBread Widgets <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8139f3d-6e92-43aa-b161-f374875adc18?source=api-prod","affected":[{"type":"plugin","slug":"mind3dom-ryebread-widgets","name":"Mind3doM RyeBread Widgets","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:51:25Z"},{"id":"wordfence:b813f3d8-b765-4cf5-aec0-786140e2a0ce","source":"wordfence","cve":"CVE-2024-32683","title":"Wp Ultimate Review <= 2.2.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b813f3d8-b765-4cf5-aec0-786140e2a0ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:31:40Z"},{"id":"wordfence:b81b06b4-559f-4b69-9fdd-e09e66525867","source":"wordfence","cve":"CVE-2024-32446","title":"Wallet System for WooCommerce <= 2.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b81b06b4-559f-4b69-9fdd-e09e66525867?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.10"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T20:55:19Z"},{"id":"wordfence:b81c2990-68d1-4d45-9724-262ec017caf1","source":"wordfence","cve":"CVE-2024-9235","title":"Mapster WP Maps <= 1.5.0 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b81c2990-68d1-4d45-9724-262ec017caf1?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T06:51:25Z"},{"id":"wordfence:b81c8bca-ba80-4beb-aa51-6505c76a424e","source":"wordfence","cve":"CVE-2025-49897","title":"Vertical scroll slideshow gallery v2 <= 9.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b81c8bca-ba80-4beb-aa51-6505c76a424e?source=api-prod","affected":[{"type":"plugin","slug":"vertical-scroll-slideshow-gallery-v2","name":"Vertical scroll slideshow gallery v2","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:08:55Z"},{"id":"wordfence:b81e12f9-0e04-4cbf-829f-fa3edfa8ecdf","source":"wordfence","cve":"CVE-2025-26984","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b81e12f9-0e04-4cbf-829f-fa3edfa8ecdf?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:20:32Z"},{"id":"wordfence:b81ec608-e0c8-410a-b7ea-af5bfd9ee601","source":"wordfence","cve":"CVE-2026-40738","title":"Eldon - Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b81ec608-e0c8-410a-b7ea-af5bfd9ee601?source=api-prod","affected":[{"type":"theme","slug":"eldon","name":"Eldon - Artist Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:43:56Z"},{"id":"wordfence:b8205bfe-4586-42e9-b4f7-e46947396b6b","source":"wordfence","cve":"","title":"I LOVE IT! < 2.4 - Multiple Vulnerabilities","severity":"critical","cvss":10.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8205bfe-4586-42e9-b4f7-e46947396b6b?source=api-prod","affected":[{"type":"theme","slug":"iloveit","name":"I LOVE IT!","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b820a342-3aaa-4782-9d82-afe53028b72c","source":"wordfence","cve":"CVE-2026-91153","title":"Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b820a342-3aaa-4782-9d82-afe53028b72c?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2026-10-28T20:44:11Z","updated":"2026-10-29T09:25:36Z"},{"id":"wordfence:b824cab6-d340-487d-90ba-5b554db1da14","source":"wordfence","cve":"CVE-2023-50880","title":"BuddyPress <= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b824cab6-d340-487d-90ba-5b554db1da14?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"11.3.1","to_inclusive":true,"patched_in":"11.3.2"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b825f4c2-8373-4aba-ab01-880cf0553b54","source":"wordfence","cve":"CVE-2024-37259","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b825f4c2-8373-4aba-ab01-880cf0553b54?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:02:05Z"},{"id":"wordfence:b8261317-462b-49c5-9526-20b695895e49","source":"wordfence","cve":"CVE-2023-51406","title":"FastDup <= 2.1.7 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8261317-462b-49c5-9526-20b695895e49?source=api-prod","affected":[{"type":"plugin","slug":"fastdup","name":"FastDup \u2013 Fastest WordPress Migration & Duplicator","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b827f0e1-b8ee-4015-a608-45505f43b324","source":"wordfence","cve":"CVE-2026-3620","title":"Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b827f0e1-b8ee-4015-a608-45505f43b324?source=api-prod","affected":[{"type":"plugin","slug":"word-replacer","name":"Word Replacer","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:45:02Z","updated":"2026-06-02T07:48:32Z"},{"id":"wordfence:b829b7a1-2891-402b-a48f-a7fb1202448e","source":"wordfence","cve":"CVE-2019-15322","title":"Shortcode Factory <= 2.7 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b829b7a1-2891-402b-a48f-a7fb1202448e?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-factory","name":"Shortcode Factory","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2019-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b82a0f71-29d7-469a-8c69-5ab68d599cb9","source":"wordfence","cve":"CVE-2025-13677","title":"Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b82a0f71-29d7-469a-8c69-5ab68d599cb9?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-counter","name":"Simple Download Counter","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-12-09T00:00:00Z","updated":"2025-12-10T03:23:51Z"},{"id":"wordfence:b82a9ae8-ff82-40bf-a5d4-5175daab9146","source":"wordfence","cve":"CVE-2023-38483","title":"Instant CSS <= 1.1.4 - Missing Authorization via AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b82a9ae8-ff82-40bf-a5d4-5175daab9146?source=api-prod","affected":[{"type":"plugin","slug":"instant-css","name":"Instant CSS","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b82e6dce-b130-4025-b6e3-bde2350a6362","source":"wordfence","cve":"CVE-2025-14721","title":"Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b82e6dce-b130-4025-b6e3-bde2350a6362?source=api-prod","affected":[{"type":"plugin","slug":"responsive-and-swipe-slider","name":"RESPONSIVE AND SWIPE SLIDER!","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:07:18Z","updated":"2025-12-20T03:20:22Z"},{"id":"wordfence:b82eb487-2519-4944-808f-a89f4576d276","source":"wordfence","cve":"CVE-2026-118093","title":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels <= 7.14.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b82eb487-2519-4944-808f-a89f4576d276?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.14.1","to_inclusive":true,"patched_in":"7.14.2"}],"published":"2026-10-29T12:57:00Z","updated":"2026-11-03T19:45:52Z"},{"id":"wordfence:b8347b4e-a5ba-49c5-9ae6-690a1a5c9aac","source":"wordfence","cve":"CVE-2022-3477","title":"tagDiv Composer < 3.5 - Unauthorized Account Access and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8347b4e-a5ba-49c5-9ae6-690a1a5c9aac?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"12","to_inclusive":true,"patched_in":"12.1"},{"type":"theme","slug":"newsmag","name":"Newsmag - Newspaper & Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"},{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":false,"patched_in":"3.5"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b839c597-5230-4702-b4ac-b4c127d0b6d2","source":"wordfence","cve":"CVE-2025-48113","title":"Broadstreet <= 1.51.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b839c597-5230-4702-b4ac-b4c127d0b6d2?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.51.2","to_inclusive":true,"patched_in":"1.51.3"}],"published":"2025-05-16T00:00:00Z","updated":"2026-01-27T21:02:07Z"},{"id":"wordfence:b83abce2-077e-4892-908b-8de88cd0a298","source":"wordfence","cve":"CVE-2024-3631","title":"HL Twitter <= 2014.1.18 - Cross-Site Request Forgery to Twitter Account Unlink","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b83abce2-077e-4892-908b-8de88cd0a298?source=api-prod","affected":[{"type":"plugin","slug":"hl-twitter","name":"HL Twitter","from":"*","from_inclusive":true,"to":"2014.1.18","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:00:55Z"},{"id":"wordfence:b83db6c7-09af-4707-a96b-ee551f27e3b7","source":"wordfence","cve":"CVE-2025-14613","title":"GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b83db6c7-09af-4707-a96b-ee551f27e3b7?source=api-prod","affected":[{"type":"plugin","slug":"getcontentfromurl","name":"GetContentFromURL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:19:31Z","updated":"2026-01-14T05:28:12Z"},{"id":"wordfence:b83e3fdc-6d16-48c5-8773-f2d053944584","source":"wordfence","cve":"CVE-2026-49064","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b83e3fdc-6d16-48c5-8773-f2d053944584?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.49","to_inclusive":true,"patched_in":"2.8.50"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:40:56Z"},{"id":"wordfence:b83fe2b8-1579-48a6-b288-3b4dd0a1565f","source":"wordfence","cve":"CVE-2026-66706","title":"Subscribe to Comments <= 2.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b83fe2b8-1579-48a6-b288-3b4dd0a1565f?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:15:49Z"},{"id":"wordfence:b841531b-8728-4933-b3c4-d4e10cbdca79","source":"wordfence","cve":"CVE-2023-7337","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b841531b-8728-4933-b3c4-d4e10cbdca79?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-03-03T20:36:25Z","updated":"2026-03-04T09:24:29Z"},{"id":"wordfence:b8415e5f-17a4-425c-ac28-5dd886d1bcf1","source":"wordfence","cve":"CVE-2025-14757","title":"Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8415e5f-17a4-425c-ac28-5dd886d1bcf1?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2026-01-15T20:25:52Z","updated":"2026-01-16T08:38:30Z"},{"id":"wordfence:b8428a92-8b0a-4a9a-8f7e-571c252973c2","source":"wordfence","cve":"CVE-2023-6694","title":"Beaver Themer <= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8428a92-8b0a-4a9a-8f7e-571c252973c2?source=api-prod","affected":[{"type":"plugin","slug":"beaver-themer","name":"Beaver Themer","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.9.1"}],"published":"2024-04-06T00:00:00Z","updated":"2024-07-29T21:37:15Z"},{"id":"wordfence:b843e8f7-e854-4572-9b1f-b1b27f752f07","source":"wordfence","cve":"CVE-2025-69021","title":"Popup box <= 6.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b843e8f7-e854-4572-9b1f-b1b27f752f07?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-06T15:53:33Z"},{"id":"wordfence:b8440c1d-2a02-42b4-8fc5-42e5a107c0af","source":"wordfence","cve":"CVE-2026-15671","title":"SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8440c1d-2a02-42b4-8fc5-42e5a107c0af?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-28T06:54:35Z"},{"id":"wordfence:b844b6a4-77e3-423e-9dcd-9d2227886de0","source":"wordfence","cve":"CVE-2025-58901","title":"Takeout <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b844b6a4-77e3-423e-9dcd-9d2227886de0?source=api-prod","affected":[{"type":"theme","slug":"takeout","name":"Takeout - Cafe & Fast Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:31:26Z"},{"id":"wordfence:b8464cd2-eef0-419b-b368-6f86af4e8dd5","source":"wordfence","cve":"CVE-2022-0363","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 -  Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8464cd2-eef0-419b-b368-6f86af4e8dd5?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2022-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b847d10d-254b-40e5-b5f9-1391834d63b4","source":"wordfence","cve":"CVE-2022-0621","title":"dTabs <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b847d10d-254b-40e5-b5f9-1391834d63b4?source=api-prod","affected":[{"type":"plugin","slug":"dtabs","name":"dTabs","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b847f463-2837-4f91-bae6-a8058f36a7db","source":"wordfence","cve":"CVE-2024-49277","title":"UltraAddons Elementor Lite <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b847f463-2837-4f91-bae6-a8058f36a7db?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2025-04-21T14:33:26Z"},{"id":"wordfence:b8486d1d-8a76-446e-867b-8db32499ebf8","source":"wordfence","cve":"CVE-2026-85658","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8486d1d-8a76-446e-867b-8db32499ebf8?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.2","to_inclusive":true,"patched_in":"4.17.3"}],"published":"2026-09-18T18:58:39Z","updated":"2026-09-19T07:43:19Z"},{"id":"wordfence:b84ae3e0-de4f-41d6-8944-fadaf6fdcf79","source":"wordfence","cve":"CVE-2026-5348","title":"Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b84ae3e0-de4f-41d6-8944-fadaf6fdcf79?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-02T05:35:14Z"},{"id":"wordfence:b84b5bc9-27eb-40b0-abe4-42959b033afb","source":"wordfence","cve":"CVE-2026-22518","title":"X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b84b5bc9-27eb-40b0-abe4-42959b033afb?source=api-prod","affected":[{"type":"plugin","slug":"x-addons-elementor","name":"X Addons for Elementor \u2013 20+ Widgets, Templates & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:23:53Z"},{"id":"wordfence:b84c0f8c-25a7-47c7-93cf-9b5060c07c72","source":"wordfence","cve":"CVE-2019-14948","title":"PPOM for WooCommerce <= 18.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b84c0f8c-25a7-47c7-93cf-9b5060c07c72?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"18.4","to_inclusive":false,"patched_in":"18.4"}],"published":"2019-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b84d88af-62b7-4f82-94c6-24c1513bfd57","source":"wordfence","cve":"CVE-2025-22333","title":"Piotnet Addons For Elementor <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b84d88af-62b7-4f82-94c6-24c1513bfd57?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.31","to_inclusive":true,"patched_in":"2.4.32"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-17T17:00:41Z"},{"id":"wordfence:b8520d91-9c31-413e-a7ac-f03cb48cb992","source":"wordfence","cve":"CVE-2024-43217","title":"Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8520d91-9c31-413e-a7ac-f03cb48cb992?source=api-prod","affected":[{"type":"plugin","slug":"kodex-posts-likes","name":"Kodex Posts likes","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:20:37Z"},{"id":"wordfence:b853d615-e62f-4365-9f07-bfba60b3a030","source":"wordfence","cve":"CVE-2026-16993","title":"DHL for WooCommerce <= 4.0.0 - Unauthenticated Shipping Label Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b853d615-e62f-4365-9f07-bfba60b3a030?source=api-prod","affected":[{"type":"plugin","slug":"dhl-for-woocommerce","name":"DHL Shipping Germany for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:42:15Z"},{"id":"wordfence:b854d8ba-2dc4-45f7-8128-8d2737fbb7d4","source":"wordfence","cve":"CVE-2024-53707","title":"Ahmeti Wp G\u00fczel S\u00f6zler <= 4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b854d8ba-2dc4-45f7-8128-8d2737fbb7d4?source=api-prod","affected":[{"type":"plugin","slug":"ahmeti-wp-guzel-sozler","name":"Ahmeti Wp G\u00fczel S\u00f6zler","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T18:44:15Z"},{"id":"wordfence:b8564dbb-6be8-4999-be65-d28609e05451","source":"wordfence","cve":"CVE-2024-1379","title":"Website Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8564dbb-6be8-4999-be65-d28609e05451?source=api-prod","affected":[{"type":"plugin","slug":"website-article-monetization-by-magenet","name":"Website Article Monetization By MageNet","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-12T19:24:26Z"},{"id":"wordfence:b857e64c-a345-4ed3-b690-5b9d1a0cae15","source":"wordfence","cve":"CVE-2024-12449","title":"Video Share VOD \u2013 Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b857e64c-a345-4ed3-b690-5b9d1a0cae15?source=api-prod","affected":[{"type":"plugin","slug":"video-share-vod","name":"Video Share VOD \u2013 Turnkey Video Site Builder Script","from":"*","from_inclusive":true,"to":"2.6.30","to_inclusive":true,"patched_in":"2.6.31"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T03:22:06Z"},{"id":"wordfence:b8580107-bbc1-4d6e-bb72-f1efc404d7b3","source":"wordfence","cve":"","title":"Latest Posts by BestWebSoft < 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8580107-bbc1-4d6e-bb72-f1efc404d7b3?source=api-prod","affected":[{"type":"plugin","slug":"bws-latest-posts","name":"Latest Posts by BestWebSoft","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":false,"patched_in":"0.3"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b85a7724-6484-4af7-9847-df8730e2d9a1","source":"wordfence","cve":"CVE-2026-110884","title":"Live Summary for Gravity Forms <= 1.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85a7724-6484-4af7-9847-df8730e2d9a1?source=api-prod","affected":[{"type":"plugin","slug":"live-summary-for-gravity-forms","name":"Live Summary for Gravity Forms","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-10-19T08:09:07Z","updated":"2026-10-23T18:22:22Z"},{"id":"wordfence:b85b314d-a155-4cec-95c9-0db4b9d8e59b","source":"wordfence","cve":"CVE-2025-2579","title":"Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85b314d-a155-4cec-95c9-0db4b9d8e59b?source=api-prod","affected":[{"type":"plugin","slug":"embed-lottie-player","name":"Embed Lottie Player \u2013 bring your pages to life with animation","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-04-23T19:57:53Z","updated":"2025-04-30T13:36:18Z"},{"id":"wordfence:b85b44ed-94cd-4d85-bcc5-60b50cdb94f1","source":"wordfence","cve":"CVE-2014-9262","title":"Duplicator < 0.5.10 - Arbitrary Backup Creation and Download","severity":"high","cvss":8.2,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85b44ed-94cd-4d85-bcc5-60b50cdb94f1?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"0.5.10","to_inclusive":false,"patched_in":"0.5.10"}],"published":"2015-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b85d8451-5283-4a76-8565-c667a3d2d917","source":"wordfence","cve":"CVE-2021-24938","title":"WooCommerce Currency Switcher <= 1.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85d8451-5283-4a76-8565-c667a3d2d917?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.7.1"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b85e9bf4-0006-402a-ae46-a02fa854d995","source":"wordfence","cve":"","title":"Corner Ad <= 1.0.53 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85e9bf4-0006-402a-ae46-a02fa854d995?source=api-prod","affected":[{"type":"plugin","slug":"corner-ad","name":"Corner Ad","from":"*","from_inclusive":true,"to":"1.0.53","to_inclusive":true,"patched_in":"1.0.54"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b85fc103-20e5-4599-8ed5-5bd5d9c447ee","source":"wordfence","cve":"CVE-2025-14365","title":"Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b85fc103-20e5-4599-8ed5-5bd5d9c447ee?source=api-prod","affected":[{"type":"plugin","slug":"eyewear-prescription-form","name":"Eyewear prescription form","from":"*","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2025-12-12T16:04:36Z","updated":"2026-07-09T19:15:47Z"},{"id":"wordfence:b8613acf-d6e8-434f-820b-d854ed1f6299","source":"wordfence","cve":"CVE-2022-1800","title":"Export any WordPress data to XML/CSV <= 1.3.4 - Authenticated SQL Injection","severity":"critical","cvss":9.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8613acf-d6e8-434f-820b-d854ed1f6299?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2022-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b86170aa-e21d-4841-be82-e7727ca10da5","source":"wordfence","cve":"CVE-2024-49647","title":"Simple Custom Admin <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b86170aa-e21d-4841-be82-e7727ca10da5?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-admin","name":"Simple Custom Admin","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:06:49Z"},{"id":"wordfence:b86171d2-444b-4db7-95f4-742fd325b04f","source":"wordfence","cve":"CVE-2026-101147","title":"Featured Image from URL (FIFU) Free & Premium <= 6.0.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b86171d2-444b-4db7-95f4-742fd325b04f?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T12:48:34Z"},{"id":"wordfence:b861e82a-dbff-491d-8a0a-1bfb9a7798ad","source":"wordfence","cve":"CVE-2026-6800","title":"FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b861e82a-dbff-491d-8a0a-1bfb9a7798ad?source=api-prod","affected":[{"type":"plugin","slug":"fastbots-ai-chatbots","name":"FastBots","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2026-05-11T20:37:29Z","updated":"2026-07-09T19:16:57Z"},{"id":"wordfence:b8634a78-e0d3-4e2e-87d8-4277f56511c6","source":"wordfence","cve":"CVE-2026-77365","title":"Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8634a78-e0d3-4e2e-87d8-4277f56511c6?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"4.2.11"}],"published":"2026-08-27T14:09:18Z","updated":"2026-08-28T02:26:57Z"},{"id":"wordfence:b8652b40-480c-4d53-b1c8-e1dcfbd8a4a4","source":"wordfence","cve":"","title":"AREA53 <= 1.0.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8652b40-480c-4d53-b1c8-e1dcfbd8a4a4?source=api-prod","affected":[{"type":"theme","slug":"area53","name":"AREA53","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2013-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b865df96-335c-4856-a5e5-e728fb0645d3","source":"wordfence","cve":"CVE-2024-13586","title":"Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b865df96-335c-4856-a5e5-e728fb0645d3?source=api-prod","affected":[{"type":"plugin","slug":"masy-gallery","name":"Masy Gallery","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:54:39Z","updated":"2025-01-25T07:24:17Z"},{"id":"wordfence:b8672fd2-dc7a-4717-9d25-84180ad9b134","source":"wordfence","cve":"CVE-2020-8771","title":"Backup and Staging by WP Time Capsule <= 1.21.15 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8672fd2-dc7a-4717-9d25-84180ad9b134?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.21.16","to_inclusive":false,"patched_in":"1.21.16"}],"published":"2020-01-14T00:00:00Z","updated":"2026-07-29T20:42:20Z"},{"id":"wordfence:b86d26e7-5879-444d-b191-6332de46428a","source":"wordfence","cve":"CVE-2025-69135","title":"Events Schedule - WordPress Events Calendar <= 2.7.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b86d26e7-5879-444d-b191-6332de46428a?source=api-prod","affected":[{"type":"plugin","slug":"weekly-class","name":"Events Schedule - WordPress Events Calendar Plugin","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:28:43Z"},{"id":"wordfence:b86e1f97-e5be-4f4a-9caa-6180fe677bcd","source":"wordfence","cve":"CVE-2026-84023","title":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b86e1f97-e5be-4f4a-9caa-6180fe677bcd?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:16:51Z"},{"id":"wordfence:b86ff40d-45dd-4cb6-9a4e-16aaf1d35196","source":"wordfence","cve":"CVE-2017-14530","title":"Crony Cronjob Manager < 0.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b86ff40d-45dd-4cb6-9a4e-16aaf1d35196?source=api-prod","affected":[{"type":"plugin","slug":"crony","name":"Crony Cronjob Manager","from":"*","from_inclusive":true,"to":"0.4.7","to_inclusive":false,"patched_in":"0.4.7"}],"published":"2015-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b871883c-509b-4776-b550-349b3f5aa365","source":"wordfence","cve":"CVE-2024-31342","title":"WordPress Gallery Exporter <= 1.3 - Authenticated (Administrator+) Arbitrary File Download","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b871883c-509b-4776-b550-349b3f5aa365?source=api-prod","affected":[{"type":"plugin","slug":"wp-gallery-exporter","name":"WordPress Gallery Exporter \u2013 Export your NextGen, Envira and FooGallery galleries to your computer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:12:41Z"},{"id":"wordfence:b871ac5e-a62a-499e-9ef2-a38d105ed020","source":"wordfence","cve":"CVE-2025-32265","title":"JobWP <= 2.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b871ac5e-a62a-499e-9ef2-a38d105ed020?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T21:04:27Z"},{"id":"wordfence:b8721c4d-d89b-4e97-af01-20327013cfb6","source":"wordfence","cve":"CVE-2023-0295","title":"Launchpad \u2013 Coming Soon & Maintenance Mode Plugin <= 1.0.13 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8721c4d-d89b-4e97-af01-20327013cfb6?source=api-prod","affected":[{"type":"plugin","slug":"launchpad-by-obox","name":"Launchpad \u2013 Coming Soon & Maintenance Mode Plugin","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b876ed30-66f5-4cad-a60c-104a0a793033","source":"wordfence","cve":"CVE-2021-34644","title":"Multiplayer Games <= 3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b876ed30-66f5-4cad-a60c-104a0a793033?source=api-prod","affected":[{"type":"plugin","slug":"multiplayer-plugin","name":"Multiplayer Games","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b879d6a9-dd75-4c53-867b-dd36a9afe4b3","source":"wordfence","cve":"CVE-2026-57809","title":"AffiliateWP <= 2.34.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b879d6a9-dd75-4c53-867b-dd36a9afe4b3?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-wp","name":"AffiliateWP","from":"*","from_inclusive":true,"to":"2.34.0","to_inclusive":true,"patched_in":"2.34.1"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-29T13:25:49Z"},{"id":"wordfence:b87f8bd6-d00d-4062-bf27-b698a1d7e757","source":"wordfence","cve":"CVE-2023-25454","title":"Protected Posts Logout Button <= 1.4.5 - Missing Authorization on pplb_options_save","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b87f8bd6-d00d-4062-bf27-b698a1d7e757?source=api-prod","affected":[{"type":"plugin","slug":"protected-posts-logout-button","name":"Protected Posts Logout Button","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2023-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8807275-bd44-43e0-9016-031e863a83d0","source":"wordfence","cve":"CVE-2026-28098","title":"Save Life <= 1.2.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8807275-bd44-43e0-9016-031e863a83d0?source=api-prod","affected":[{"type":"theme","slug":"save-life","name":"Save Life | Non-Profit, Charity & Donations WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:07:36Z"},{"id":"wordfence:b8812c90-b485-45dc-bae7-086dd9473903","source":"wordfence","cve":"CVE-2026-109890","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8812c90-b485-45dc-bae7-086dd9473903?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.110","to_inclusive":true,"patched_in":"4.11.111"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:43:58Z"},{"id":"wordfence:b882ba6d-47c0-401a-bf50-5cf0bf0f3d5b","source":"wordfence","cve":"CVE-2026-3773","title":"Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b882ba6d-47c0-401a-bf50-5cf0bf0f3d5b?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"4.20","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T16:46:04Z","updated":"2026-04-16T05:29:56Z"},{"id":"wordfence:b883681e-5e14-4100-989b-4776456246bf","source":"wordfence","cve":"CVE-2024-49286","title":"SSV Events <= 3.2.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b883681e-5e14-4100-989b-4776456246bf?source=api-prod","affected":[{"type":"plugin","slug":"ssv-events","name":"SSV Events","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T18:06:59Z"},{"id":"wordfence:b884cb04-feab-4579-9a38-6d5654525372","source":"wordfence","cve":"CVE-2025-59582","title":"Ajax Load More <= 7.6.0.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b884cb04-feab-4579-9a38-6d5654525372?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.6.0.2","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:48:53Z"},{"id":"wordfence:b884d3c9-7d84-44eb-9e94-b415625b479d","source":"wordfence","cve":"","title":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio <= 0.59 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b884d3c9-7d84-44eb-9e94-b415625b479d?source=api-prod","affected":[{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"0.59","to_inclusive":true,"patched_in":"0.60"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8877261-c60c-4433-9a4d-f1a99cac66c0","source":"wordfence","cve":"CVE-2014-7152","title":"Easy Forms for Mailchimp 3.0 - 5.0.6 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8877261-c60c-4433-9a4d-f1a99cac66c0?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"3.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2014-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b88787ca-314d-4750-897b-8bf3f5374c5c","source":"wordfence","cve":"CVE-2026-14229","title":"ECS <= 4.3.7 - Missing Authorization to Unauthenticated Private Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b88787ca-314d-4750-897b-8bf3f5374c5c?source=api-prod","affected":[{"type":"plugin","slug":"ele-custom-skin","name":"ECS \u2013 Ele Custom Skin for Elementor","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T20:52:35Z"},{"id":"wordfence:b889440b-33f9-410b-b3d5-f41e08bcee82","source":"wordfence","cve":"CVE-2025-32147","title":"Easy WP Optimizer <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b889440b-33f9-410b-b3d5-f41e08bcee82?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-optimizer","name":"Easy WP Optimizer \u2013 Optimize DB & WordPress","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T14:18:56Z"},{"id":"wordfence:b88efc1b-dc2d-4fe2-ba2b-e29898ed1bc4","source":"wordfence","cve":"CVE-2021-24554","title":"Paytm \u2013 Donation Plugin <= 1.3.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b88efc1b-dc2d-4fe2-ba2b-e29898ed1bc4?source=api-prod","affected":[{"type":"plugin","slug":"wp-paytm-pay","name":"Paytm \u2013 Donation Plugin","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b890bab7-768f-433c-b8f0-9d2a5231ffb3","source":"wordfence","cve":"CVE-2026-74007","title":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b890bab7-768f-433c-b8f0-9d2a5231ffb3?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.16.20","to_inclusive":true,"patched_in":"1.16.21"}],"published":"2026-08-17T17:11:00Z","updated":"2026-09-10T19:13:36Z"},{"id":"wordfence:b890d168-9ea7-49c0-b628-71c76c0c2c9c","source":"wordfence","cve":"CVE-2021-24574","title":"Simple Banner <= 2.10.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b890d168-9ea7-49c0-b628-71c76c0c2c9c?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2021-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b89185c1-f7f9-47fb-ae8b-ba4c9f4e1d3e","source":"wordfence","cve":"CVE-2023-25968","title":"Client Portal \u2013 Private user pages and login <= 1.1.8 - Cross-Site Request Forgery via cp_create_private_pages_for_all_users function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b89185c1-f7f9-47fb-ae8b-ba4c9f4e1d3e?source=api-prod","affected":[{"type":"plugin","slug":"client-portal","name":"Client Portal \u2013 Private user pages and login","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b894473b-b2ed-475b-892e-603db609f88a","source":"wordfence","cve":"CVE-2023-38389","title":"JupiterX Core <= 3.3.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b894473b-b2ed-475b-892e-603db609f88a?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8954061-cb8f-49fc-84d9-50851f7f48a2","source":"wordfence","cve":"CVE-2025-9622","title":"WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8954061-cb8f-49fc-84d9-50851f7f48a2?source=api-prod","affected":[{"type":"plugin","slug":"wpblast","name":"WP Blast | SEO & Performance Booster","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-09-09T17:58:25Z","updated":"2025-09-10T06:38:49Z"},{"id":"wordfence:b897b16a-7580-47e2-a5cc-b4a08bc05ad2","source":"wordfence","cve":"CVE-2024-45452","title":"Septera <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b897b16a-7580-47e2-a5cc-b4a08bc05ad2?source=api-prod","affected":[{"type":"theme","slug":"septera","name":"Septera","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T17:15:09Z"},{"id":"wordfence:b899296a-01df-45af-b966-2b80685c6853","source":"wordfence","cve":"CVE-2024-35730","title":"Active Products Tables for WooCommerce. Use constructor to create tables  <= 1.0.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b899296a-01df-45af-b966-2b80685c6853?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.3","to_inclusive":true,"patched_in":"1.0.6.4"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:54:09Z"},{"id":"wordfence:b899ca76-d6f4-4369-8f66-738b144433b7","source":"wordfence","cve":"","title":"Analytify \u2013 Google Analytics Dashboard For WordPress <= 4.2.2 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b899ca76-d6f4-4369-8f66-738b144433b7?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b899d06f-a4e3-4cc5-a610-43372511b7da","source":"wordfence","cve":"CVE-2024-34566","title":"Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b899d06f-a4e3-4cc5-a610-43372511b7da?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:38:55Z"},{"id":"wordfence:b89a1265-6e26-498c-a2b4-da12d38463c9","source":"wordfence","cve":"CVE-2023-34175","title":"Login Configurator <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b89a1265-6e26-498c-a2b4-da12d38463c9?source=api-prod","affected":[{"type":"plugin","slug":"login-configurator","name":"Login Configurator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b89c51fe-c056-4d85-a6e3-6678ed93b9d8","source":"wordfence","cve":"CVE-2023-35781","title":"LWS Cleaner <= 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b89c51fe-c056-4d85-a6e3-6678ed93b9d8?source=api-prod","affected":[{"type":"plugin","slug":"lws-cleaner","name":"LWS Cleaner","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b89cf8ef-9fa0-4ede-8ec9-c166d0db74fe","source":"wordfence","cve":"CVE-2023-47828","title":"wpMandrill <= 1.33 - Missing Authorization via getAjaxStats","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b89cf8ef-9fa0-4ede-8ec9-c166d0db74fe?source=api-prod","affected":[{"type":"plugin","slug":"wpmandrill","name":"wpMandrill","from":"*","from_inclusive":true,"to":"1.33","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b89e7783-e13e-4f5d-80b4-7bb64f7bffd2","source":"wordfence","cve":"CVE-2026-112851","title":"HotLock | Locksmith & Security Systems WordPress Theme + RTL <= 1.3.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b89e7783-e13e-4f5d-80b4-7bb64f7bffd2?source=api-prod","affected":[{"type":"theme","slug":"hotlock","name":"HotLock | Locksmith & Security Systems WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:03Z"},{"id":"wordfence:b8a26695-4793-418b-9a23-6709fe79ea4f","source":"wordfence","cve":"","title":"Constant Contact Forms <= 2.0.2 - Missing Authorization via constant_contact_privacy_ajax_handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a26695-4793-418b-9a23-6709fe79ea4f?source=api-prod","affected":[{"type":"plugin","slug":"constant-contact-forms","name":"Constant Contact Forms","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8a2bbfe-eb87-4e26-ba20-bc406d681124","source":"wordfence","cve":"CVE-2026-3581","title":"Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a2bbfe-eb87-4e26-ba20-bc406d681124?source=api-prod","affected":[{"type":"plugin","slug":"basic-google-maps-placemarks","name":"Basic Google Maps Placemarks","from":"*","from_inclusive":true,"to":"1.10.7","to_inclusive":true,"patched_in":"1.10.8"}],"published":"2026-04-15T16:47:25Z","updated":"2026-04-16T05:29:56Z"},{"id":"wordfence:b8a41eb6-8fb2-4274-a50b-571e85ac87f8","source":"wordfence","cve":"CVE-2019-15329","title":"Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a41eb6-8fb2-4274-a50b-571e85ac87f8?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.14.0.3","to_inclusive":false,"patched_in":"1.14.0.3"}],"published":"2019-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8a4ec9b-218a-4811-ad8b-236fc8e960fa","source":"wordfence","cve":"CVE-2025-46458","title":"occupancyplan <= 1.0.3.0 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a4ec9b-218a-4811-ad8b-236fc8e960fa?source=api-prod","affected":[{"type":"plugin","slug":"occupancyplan","name":"occupancyplan","from":"*","from_inclusive":true,"to":"1.0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:17:45Z"},{"id":"wordfence:b8a598cf-bdd6-4249-a367-e3e8c6e3ef15","source":"wordfence","cve":"CVE-2018-6469","title":"flickrRSS <= 5.3.1 - Cross-Site Scripting via flickrRSS_tags","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a598cf-bdd6-4249-a367-e3e8c6e3ef15?source=api-prod","affected":[{"type":"plugin","slug":"flickr-rss","name":"flickrRSS","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":""}],"published":"2018-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8a7a925-2b9e-43bc-b649-c7ec518e063c","source":"wordfence","cve":"CVE-2026-120534","title":"Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a7a925-2b9e-43bc-b649-c7ec518e063c?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended-pro","name":"Advanced Custom Fields: Extended PRO","from":"*","from_inclusive":true,"to":"0.9.2.6","to_inclusive":true,"patched_in":"0.9.2.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-11-03T04:43:09Z"},{"id":"wordfence:b8a82989-e7e7-484a-b619-3897d88872b9","source":"wordfence","cve":"CVE-2025-9944","title":"Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a82989-e7e7-484a-b619-3897d88872b9?source=api-prod","affected":[{"type":"plugin","slug":"professional-contact-form","name":"Professional Contact Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:37:18Z","updated":"2025-09-27T06:47:15Z"},{"id":"wordfence:b8aa8208-e897-4c08-9253-76bbe159bee8","source":"wordfence","cve":"CVE-2026-25370","title":"Compress <= 6.60.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8aa8208-e897-4c08-9253-76bbe159bee8?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.60.28","to_inclusive":true,"patched_in":"6.60.29"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T19:24:17Z"},{"id":"wordfence:b8ab6dfa-3764-470f-aa49-1964f42d93de","source":"wordfence","cve":"CVE-2026-5513","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8ab6dfa-3764-470f-aa49-1964f42d93de?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.2","to_inclusive":true,"patched_in":"27.3"}],"published":"2026-06-12T22:03:33Z","updated":"2026-06-13T11:25:26Z"},{"id":"wordfence:b8acccc1-ddc9-4daa-8aaa-71efc5ef2f04","source":"wordfence","cve":"CVE-2026-88824","title":"Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8acccc1-ddc9-4daa-8aaa-71efc5ef2f04?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks-for-gutenberg","name":"Master Blocks \u2013 Ultimate Blocks for Marketers","from":"1.4.1","from_inclusive":true,"to":"1.4.1.4","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:14:57Z"},{"id":"wordfence:b8ad763e-838a-483d-b080-f956a229188c","source":"wordfence","cve":"CVE-2025-30838","title":"Cozy Blocks <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8ad763e-838a-483d-b080-f956a229188c?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:30:23Z"},{"id":"wordfence:b8add6b9-8d53-4239-bbbc-d32a562fd9b9","source":"wordfence","cve":"CVE-2024-32104","title":"NextMove Lite <= 2.18.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8add6b9-8d53-4239-bbbc-d32a562fd9b9?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-nextmove-lite","name":"NextMove Lite \u2013 Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"2.18.1","to_inclusive":true,"patched_in":"2.18.2"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T15:33:56Z"},{"id":"wordfence:b8ae2ede-4288-48ef-9fc9-09ef80363a3b","source":"wordfence","cve":"CVE-2026-12966","title":"Direct Payments for WooCommerce \u2013 Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments < 2.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8ae2ede-4288-48ef-9fc9-09ef80363a3b?source=api-prod","affected":[{"type":"plugin","slug":"direct-payments-for-woocommerce","name":"Direct Payments for WooCommerce \u2013 Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":false,"patched_in":"2.5.3"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-14T12:27:11Z"},{"id":"wordfence:b8b07ce8-d6ee-4ede-8394-4aae24c610b2","source":"wordfence","cve":"CVE-2026-25339","title":"WPForms \u2013 Easy Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b07ce8-d6ee-4ede-8394-4aae24c610b2?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.8.7","to_inclusive":true,"patched_in":"1.9.9.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:19:52Z"},{"id":"wordfence:b8b1a124-ad3a-4f17-9913-88bfda26dca9","source":"wordfence","cve":"CVE-2017-1002017","title":"Gift Certificate Creator <= 1.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b1a124-ad3a-4f17-9913-88bfda26dca9?source=api-prod","affected":[{"type":"plugin","slug":"gift-certificate-creator","name":"Gift Certificate Creator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2017-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8b3419e-23c7-48de-898f-133a52ae286a","source":"wordfence","cve":"CVE-2023-5530","title":"Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b3419e-23c7-48de-898f-133a52ae286a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.33","to_inclusive":true,"patched_in":"3.6.34"}],"published":"2023-10-16T00:00:00Z","updated":"2024-06-06T16:08:41Z"},{"id":"wordfence:b8b443bb-4b23-48a1-9859-953b3cd84ca6","source":"wordfence","cve":"CVE-2026-42680","title":"Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b443bb-4b23-48a1-9859-953b3cd84ca6?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"29.0.1","to_inclusive":true,"patched_in":"29.0.2"}],"published":"2026-05-17T00:00:00Z","updated":"2026-05-19T16:07:04Z"},{"id":"wordfence:b8b684f7-d99f-4d73-9256-e39c5a203262","source":"wordfence","cve":"CVE-2026-75873","title":"Zella <= 2.6.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b684f7-d99f-4d73-9256-e39c5a203262?source=api-prod","affected":[{"type":"theme","slug":"zella-theme","name":"zella-theme","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:06:25Z"},{"id":"wordfence:b8b8af19-e6d7-425d-896d-ecae63b549e2","source":"wordfence","cve":"CVE-2026-27438","title":"Kingler <= 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b8af19-e6d7-425d-896d-ecae63b549e2?source=api-prod","affected":[{"type":"theme","slug":"kingler","name":"Kingler","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:05:32Z"},{"id":"wordfence:b8bbb54d-7607-4d19-bf2d-2d52a6de1287","source":"wordfence","cve":"CVE-2014-5189","title":"Lead Octopus Power < 1.1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8bbb54d-7607-4d19-bf2d-2d52a6de1287?source=api-prod","affected":[{"type":"plugin","slug":"Lead-Octopus-Power","name":"Lead-Octopus-Power","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2014-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8bd08d0-5c78-40a8-abc1-de387908df9d","source":"wordfence","cve":"CVE-2023-5124","title":"Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8bd08d0-5c78-40a8-abc1-de387908df9d?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-03-07T18:04:01Z"},{"id":"wordfence:b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0","source":"wordfence","cve":"CVE-2026-2888","title":"Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8be3b6e-a035-4e6f-ba2b-ce9e59ebf2e0?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.28","to_inclusive":true,"patched_in":"6.29"}],"published":"2026-03-12T19:24:45Z","updated":"2026-03-13T08:25:19Z"},{"id":"wordfence:b8c18081-1ee3-4072-89f1-b6eb1518916e","source":"wordfence","cve":"CVE-2021-24943","title":"Registrations for the Events Calendar <= 2.7.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c18081-1ee3-4072-89f1-b6eb1518916e?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":false,"patched_in":"2.7.6"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8c3e536-6942-4cea-a36b-cdbe8251d54b","source":"wordfence","cve":"CVE-2026-116392","title":"Accordions <= 2.3.25 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c3e536-6942-4cea-a36b-cdbe8251d54b?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.3.25","to_inclusive":true,"patched_in":""}],"published":"2026-10-26T12:55:06Z","updated":"2026-11-03T19:30:05Z"},{"id":"wordfence:b8c66ddd-8a01-40e0-8893-668551b527d1","source":"wordfence","cve":"CVE-2013-7276","title":"Recommend to a friend <= 2.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c66ddd-8a01-40e0-8893-668551b527d1?source=api-prod","affected":[{"type":"plugin","slug":"recommend-a-friend","name":"Recommend to a friend","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2013-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8c7cca2-94d2-4a86-bc69-d7b2b0f068ba","source":"wordfence","cve":"CVE-2025-9277","title":"SiteSEO \u2013 SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c7cca2-94d2-4a86-bc69-d7b2b0f068ba?source=api-prod","affected":[{"type":"plugin","slug":"siteseo","name":"SiteSEO \u2013 SEO Simplified","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-08-26T10:21:52Z","updated":"2025-08-26T22:26:50Z"},{"id":"wordfence:b8c87463-76fe-4687-92c2-4bcdbdaf374f","source":"wordfence","cve":"CVE-2024-51828","title":"Beacon For Help Scout <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c87463-76fe-4687-92c2-4bcdbdaf374f?source=api-prod","affected":[{"type":"plugin","slug":"beacon-for-helpscout","name":"Beacon For Help Scout","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:44:25Z"},{"id":"wordfence:b8c89d80-0ae5-4849-b739-0881fec188bf","source":"wordfence","cve":"CVE-2026-1575","title":"Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c89d80-0ae5-4849-b739-0881fec188bf?source=api-prod","affected":[{"type":"plugin","slug":"schema-shortcode","name":"Schema Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:18:55Z","updated":"2026-03-21T03:27:00Z"},{"id":"wordfence:b8cbd521-f2d4-4cf6-a50f-ed42f4d21989","source":"wordfence","cve":"","title":"PHP Shell (All Versions) - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8cbd521-f2d4-4cf6-a50f-ed42f4d21989?source=api-prod","affected":[{"type":"plugin","slug":"php-shell","name":"php-shell","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2008-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8cdd8b4-52e6-431b-b2f0-bfe1d0c1dd91","source":"wordfence","cve":"CVE-2014-8603","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8cdd8b4-52e6-431b-b2f0-bfe1d0c1dd91?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8ce34dc-b509-476a-8960-a0c9369a6d72","source":"wordfence","cve":"CVE-2024-35170","title":"Sticky banner <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8ce34dc-b509-476a-8960-a0c9369a6d72?source=api-prod","affected":[{"type":"plugin","slug":"sticky-banner","name":"Sticky Banner","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:23:48Z"},{"id":"wordfence:b8cf9350-d207-49ae-865a-b2e016b41b55","source":"wordfence","cve":"","title":"Dropdown and scrollable Text <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8cf9350-d207-49ae-865a-b2e016b41b55?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-and-scrollable-text","name":"Dropdown and scrollable Text","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8d0638e-06c5-4884-a14d-4b28ae3ef3f3","source":"wordfence","cve":"CVE-2025-23776","title":"Cache Sniper for Nginx <= 1.0.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d0638e-06c5-4884-a14d-4b28ae3ef3f3?source=api-prod","affected":[{"type":"plugin","slug":"snipe-nginx-cache","name":"Cache Sniper for Nginx","from":"*","from_inclusive":true,"to":"1.0.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:19:41Z"},{"id":"wordfence:b8d399f3-5517-4c5d-b792-94eb8b0cc0f4","source":"wordfence","cve":"CVE-2024-9618","title":"Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d399f3-5517-4c5d-b792-94eb8b0cc0f4?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.7.2","to_inclusive":true,"patched_in":"2.0.7.3"}],"published":"2025-03-03T20:06:07Z","updated":"2025-03-04T08:23:42Z"},{"id":"wordfence:b8d4c4d2-1d86-4ee2-9ac1-240ed2aa7f72","source":"wordfence","cve":"CVE-2019-25746","title":"Sliced Invoices \u2013 WordPress Invoice Plugin <= 3.8.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d4c4d2-1d86-4ee2-9ac1-240ed2aa7f72?source=api-prod","affected":[{"type":"plugin","slug":"sliced-invoices","name":"Sliced Invoices \u2013 WordPress Invoice Plugin","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-06-15T00:00:00Z","updated":"2026-10-01T12:19:11Z"},{"id":"wordfence:b8d5bb6c-2021-4fc0-bede-8da1c3fb591a","source":"wordfence","cve":"CVE-2026-8176","title":"LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-06-15T20:57:10Z","updated":"2026-06-16T09:31:35Z"},{"id":"wordfence:b8d5fa2d-07ee-46ef-bbcf-e7e45a4bbf69","source":"wordfence","cve":"CVE-2026-28164","title":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder <= 2.3.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5fa2d-07ee-46ef-bbcf-e7e45a4bbf69?source=api-prod","affected":[{"type":"plugin","slug":"easy-elementor-addons","name":"Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:17:23Z"},{"id":"wordfence:b8d63789-16b3-443b-8dcb-67b1e5e25d20","source":"wordfence","cve":"","title":"Cloudflare < 1.3.21 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d63789-16b3-443b-8dcb-67b1e5e25d20?source=api-prod","affected":[{"type":"plugin","slug":"cloudflare","name":"Cloudflare","from":"*","from_inclusive":true,"to":"1.3.21","to_inclusive":false,"patched_in":"1.3.21"}],"published":"2016-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8d73c3d-e8b1-400d-8fed-d26a045026c2","source":"wordfence","cve":"CVE-2025-58857","title":"Table of content <= 1.5.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d73c3d-e8b1-400d-8fed-d26a045026c2?source=api-prod","affected":[{"type":"plugin","slug":"content-table","name":"Table of content","from":"*","from_inclusive":true,"to":"1.5.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:08:30Z"},{"id":"wordfence:b8d77b41-f535-4e60-a850-881be8dee458","source":"wordfence","cve":"CVE-2026-109991","title":"FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d77b41-f535-4e60-a850-881be8dee458?source=api-prod","affected":[{"type":"plugin","slug":"funnelkit-stripe-woo-payment-gateway","name":"FunnelKit Payment Gateway for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"1.15.0.2","to_inclusive":true,"patched_in":"1.16.0"}],"published":"2026-11-06T22:51:01Z","updated":"2026-11-07T11:26:33Z"},{"id":"wordfence:b8d88cc2-91e4-4e53-8c46-93d6ce8bc320","source":"wordfence","cve":"CVE-2026-9616","title":"Generate Security.txt <= 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d88cc2-91e4-4e53-8c46-93d6ce8bc320?source=api-prod","affected":[{"type":"plugin","slug":"generate-security-txt","name":"Generate Security.txt","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2026-06-23T16:40:38Z","updated":"2026-07-10T15:58:40Z"},{"id":"wordfence:b8d8aa73-2e68-4353-a603-6fb61ab3406b","source":"wordfence","cve":"CVE-2026-81543","title":"Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d8aa73-2e68-4353-a603-6fb61ab3406b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.7.1","to_inclusive":true,"patched_in":"10.7.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T07:38:15Z"},{"id":"wordfence:b8da640d-8965-45bb-be68-57d4eb598759","source":"wordfence","cve":"CVE-2024-13749","title":"StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8da640d-8965-45bb-be68-57d4eb598759?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T03:21:39Z"},{"id":"wordfence:b8daa685-d366-4b08-9f30-b14700fdee03","source":"wordfence","cve":"CVE-2018-10300","title":"WD Instagram Feed <= 1.3.0 - Cross-site scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8daa685-d366-4b08-9f30-b14700fdee03?source=api-prod","affected":[{"type":"plugin","slug":"wd-instagram-feed","name":"10WebSocial","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2018-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2","source":"wordfence","cve":"CVE-2026-1233","title":"Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access","severity":"high","cvss":7.5,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dc0b5e-87b9-4831-a92a-bbf6eb1346e2?source=api-prod","affected":[{"type":"plugin","slug":"text-to-speech-tts","name":"Text to Speech \u2013 TTSWP","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2026-04-03T22:10:19Z","updated":"2026-04-04T11:16:16Z"},{"id":"wordfence:b8dd6008-e9b8-4a87-b1c7-0dc272850cbd","source":"wordfence","cve":"CVE-2025-10294","title":"OwnID Passwordless Login <= 1.3.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8dd6008-e9b8-4a87-b1c7-0dc272850cbd?source=api-prod","affected":[{"type":"plugin","slug":"ownid-passwordless-login","name":"OwnID Passwordless Login","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:34:27Z","updated":"2025-10-15T08:26:02Z"},{"id":"wordfence:b8e3a111-6327-47a0-becd-d7e2d9166118","source":"wordfence","cve":"CVE-2023-26537","title":"WP No External Links <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scritping","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8e3a111-6327-47a0-becd-d7e2d9166118?source=api-prod","affected":[{"type":"plugin","slug":"no-external-links","name":"WP No External Links","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8e3f779-9d25-4525-a827-8ce743bd889e","source":"wordfence","cve":"","title":"New User Approve <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8e3f779-9d25-4525-a827-8ce743bd889e?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8e64950-4f01-4391-8c65-2f25ff5bcc06","source":"wordfence","cve":"CVE-2024-43280","title":"Salon booking system <= 10.8.1 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8e64950-4f01-4391-8c65-2f25ff5bcc06?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.9"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:34:32Z"},{"id":"wordfence:b8e921f4-d889-490f-a817-53d132a56f83","source":"wordfence","cve":"CVE-2023-51541","title":"Stock Ticker <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scritping","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8e921f4-d889-490f-a817-53d132a56f83?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.23.4","to_inclusive":true,"patched_in":"3.23.5"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8eb3aa9-fe60-48b6-aa24-7873dd68b47e","source":"wordfence","cve":"CVE-2024-9634","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eb3aa9-fe60-48b6-aa24-7873dd68b47e?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.16.3","to_inclusive":true,"patched_in":"3.16.4"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:09Z"},{"id":"wordfence:b8eeb072-0727-4de9-a5e8-b92d018a1d8a","source":"wordfence","cve":"CVE-2026-110383","title":"Electronic Signature Add-on for Fluent Forms <= 2.0.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eeb072-0727-4de9-a5e8-b92d018a1d8a?source=api-prod","affected":[{"type":"plugin","slug":"signature-fluent-contract-forms-add-on","name":"Electronic Signature Add-on for Fluent Forms","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-10-16T10:37:22Z","updated":"2026-10-23T18:20:51Z"},{"id":"wordfence:b8eec2f0-1b6f-45cf-8291-019bc1d08f9b","source":"wordfence","cve":"CVE-2022-45356","title":"Betheme <= 26.6.2 - Missing Authorization Check on Core Functionality","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eec2f0-1b6f-45cf-8291-019bc1d08f9b?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.1","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8eeeed6-bb8c-47d3-afa5-84eb7ed2c971","source":"wordfence","cve":"CVE-2013-7102","title":"OptimizePress < 1.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eeeed6-bb8c-47d3-afa5-84eb7ed2c971?source=api-prod","affected":[{"type":"theme","slug":"optimizepress","name":"OptimizePress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2013-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8ef40bf-e33f-4e62-8ad6-724657138d4b","source":"wordfence","cve":"CVE-2026-8379","title":"Frontend File Manager Plugin <= 23.6 - Missing Authorization to Unauthenticated File Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8ef40bf-e33f-4e62-8ad6-724657138d4b?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:56:25Z"},{"id":"wordfence:b8f24fae-6a8b-4c67-a204-c085ae43552f","source":"wordfence","cve":"CVE-2021-25087","title":"Download Manager <= 3.2.34 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f24fae-6a8b-4c67-a204-c085ae43552f?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.35","to_inclusive":false,"patched_in":"3.2.35"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8f30220-4f6e-458b-a053-8d8277150237","source":"wordfence","cve":"","title":"MZ Mindbody API <= 2.8.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f30220-4f6e-458b-a053-8d8277150237?source=api-prod","affected":[{"type":"plugin","slug":"mz-mindbody-api","name":"MZ Mindbody API","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8f31f8e-03a0-436c-bfa3-bc41d70e8e2a","source":"wordfence","cve":"CVE-2025-8481","title":"Blog Designer For Elementor \u2013 Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f31f8e-03a0-436c-bfa3-bc41d70e8e2a?source=api-prod","affected":[{"type":"plugin","slug":"blog-designer-for-elementor","name":"Blog Designer For Elementor \u2013 Post Slider, Post Carousel, Post Grid","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:55:20Z","updated":"2025-09-11T07:24:57Z"},{"id":"wordfence:b8f53053-5150-4fba-b8d6-3d6c9df32c69","source":"wordfence","cve":"CVE-2023-6981","title":"WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f53053-5150-4fba-b8d6-3d6c9df32c69?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.5.1"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:37:16Z"},{"id":"wordfence:b8f53282-740e-4ac3-a2e1-7a97893e3355","source":"wordfence","cve":"CVE-2026-0551","title":"PPWP \u2013 Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f53282-740e-4ac3-a2e1-7a97893e3355?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.18","to_inclusive":true,"patched_in":"1.9.19"}],"published":"2026-08-22T10:47:09Z","updated":"2026-08-22T23:27:20Z"},{"id":"wordfence:b8f55759-78d5-4c90-87b9-934a4f4d9365","source":"wordfence","cve":"CVE-2025-68054","title":"CountDown With Image or Video Background <= 1.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f55759-78d5-4c90-87b9-934a4f4d9365?source=api-prod","affected":[{"type":"plugin","slug":"countdown_with_background","name":"CountDown With Image or Video Background","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-14T00:00:00Z","updated":"2025-12-19T17:23:15Z"},{"id":"wordfence:b8f82dad-cba6-484e-8e30-6370ec2ba2d8","source":"wordfence","cve":"CVE-2026-32492","title":"My Tickets \u2013 Accessible Event Ticketing <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f82dad-cba6-484e-8e30-6370ec2ba2d8?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:51:38Z"},{"id":"wordfence:b8f870a6-26a5-4f98-9bd6-12736c561265","source":"wordfence","cve":"CVE-2024-5607","title":"GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8f870a6-26a5-4f98-9bd6-12736c561265?source=api-prod","affected":[{"type":"plugin","slug":"ninja-gdpr-compliance","name":"GDPR CCPA Compliance & Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T02:39:29Z"},{"id":"wordfence:b8faa34a-17fd-4a2e-b8bf-ed40fc7a88d9","source":"wordfence","cve":"CVE-2022-46807","title":"Stock Sync for WooCommerce <= 2.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8faa34a-17fd-4a2e-b8bf-ed40fc7a88d9?source=api-prod","affected":[{"type":"plugin","slug":"stock-sync-for-woocommerce","name":"Stock Sync for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8fbede5-95b5-4630-bc7f-f24fddf006ec","source":"wordfence","cve":"CVE-2025-52730","title":"WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8fbede5-95b5-4630-bc7f-f24fddf006ec?source=api-prod","affected":[{"type":"plugin","slug":"eventin-pro","name":"WordPress Event Manager, Event Calendar and Booking Plugin","from":"*","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"4.0.25"}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-18T15:50:41Z"},{"id":"wordfence:b8fc89c0-292d-47b4-90b3-79edf3a9e76d","source":"wordfence","cve":"CVE-2022-45813","title":"BeRocket Plugins <= (Various Versions) - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8fc89c0-292d-47b4-90b3-79edf3a9e76d?source=api-prod","affected":[{"type":"plugin","slug":"sales-report-for-woocommerce","name":"Sales Report for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"load-more-products-for-woocommerce","name":"Load More Products for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9.7","to_inclusive":true,"patched_in":"1.1.9.8"},{"type":"plugin","slug":"pagination-styler-for-woocommerce","name":"Pagination Styler for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"product-of-the-day-for-woocommerce","name":"Product of the Day for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"splash-popup-for-woocommerce","name":"Splash Popup for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"terms-and-conditions-popup-for-woocommerce","name":"Terms and Conditions Popup for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"force-sell-for-woocommerce","name":"Force Sell for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"cart-products-suggestions-for-woocommerce","name":"Products Suggestions for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"cart-notices-for-woocommerce","name":"Cart Notices for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"sequential-order-numbers-for-woocommerce","name":"Sequential Order Numbers for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"gridlist-view-for-woocommerce","name":"Grid/List View for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3.6","to_inclusive":true,"patched_in":"1.1.3.7"},{"type":"plugin","slug":"currency-exchange-for-woocommerce","name":"Currency Exchange for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.7","to_inclusive":true,"patched_in":"3.5.7.8"},{"type":"plugin","slug":"product-tabs-manager-for-woocommerce","name":"Product Tabs Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.5.7","to_inclusive":true,"patched_in":"1.1.5.8"},{"type":"plugin","slug":"wish-wait-list-for-woocommerce","name":"Wishlist and Waitlist for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"},{"type":"plugin","slug":"advanced-product-labels-for-woocommerce","name":"Advanced Product Labels for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.4.1"},{"type":"plugin","slug":"minmax-quantity-for-woocommerce","name":"Min and Max Quantity for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.2.6","to_inclusive":true,"patched_in":"1.3.2.7"},{"type":"plugin","slug":"products-compare-for-woocommerce","name":"Products Compare for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.7","to_inclusive":true,"patched_in":"3.5.7.8"},{"type":"plugin","slug":"product-watermark-for-woocommerce","name":"Product Watermark for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5.6","to_inclusive":true,"patched_in":"1.3.5.7"},{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.0.5","to_inclusive":true,"patched_in":"3.7.0.6"},{"type":"plugin","slug":"product-preview-for-woocommerce","name":"Product Preview for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7.6","to_inclusive":true,"patched_in":"3.5.7.7"}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b8fcf1fb-c7ed-4a02-bb03-7f0a89f4c4e1","source":"wordfence","cve":"CVE-2024-49295","title":"Simple Testimonials Showcase <= 1.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8fcf1fb-c7ed-4a02-bb03-7f0a89f4c4e1?source=api-prod","affected":[{"type":"plugin","slug":"simple-testimonials-showcase","name":"Simple Testimonials Showcase","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:59:50Z"},{"id":"wordfence:b8fe4fe5-2b13-4001-a177-0d182aa2af30","source":"wordfence","cve":"CVE-2024-37204","title":"PropertyHive <= 2.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b8fe4fe5-2b13-4001-a177-0d182aa2af30?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:35:53Z"},{"id":"wordfence:b9002f6e-4345-4908-9cb8-9841a2458eb7","source":"wordfence","cve":"","title":"CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion","severity":"low","cvss":2.7,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9002f6e-4345-4908-9cb8-9841a2458eb7?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.11.12","to_inclusive":false,"patched_in":"1.11.12"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b901b3f8-8bbd-42ef-8e0c-de6d09c4950f","source":"wordfence","cve":"CVE-2022-4032","title":"Quiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b901b3f8-8bbd-42ef-8e0c-de6d09c4950f?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.4","to_inclusive":true,"patched_in":"8.0.5"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b901f593-3691-4ea1-8ab6-1ddd68fa2e36","source":"wordfence","cve":"CVE-2025-12017","title":"VNPAY for Woocommerce <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b901f593-3691-4ea1-8ab6-1ddd68fa2e36?source=api-prod","affected":[{"type":"plugin","slug":"vnpay-for-woocommerce","name":"VNPAY Payment gateway","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T19:56:37Z","updated":"2025-10-24T08:24:04Z"},{"id":"wordfence:b90267c6-e6b4-4ca0-8779-c20f62016eeb","source":"wordfence","cve":"","title":"VDZ Google Analytics or Google Tag Manager / GTM <= 1.5.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90267c6-e6b4-4ca0-8779-c20f62016eeb?source=api-prod","affected":[{"type":"plugin","slug":"vdz-google-analytics","name":"VDZ Google Analytics or Google Tag Manager / GTM","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b902a1b6-981d-481d-8009-fe4a9655148d","source":"wordfence","cve":"CVE-2026-119504","title":"ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b902a1b6-981d-481d-8009-fe4a9655148d?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.30.2"}],"published":"2026-11-07T09:42:43Z","updated":"2026-11-10T19:30:55Z"},{"id":"wordfence:b9047775-2d72-4eb5-9339-419f95aa19b2","source":"wordfence","cve":"CVE-2023-47793","title":"Acme Fix Images <= 1.0.0 - Missing Authorization via acme_fix_images_ajax_callback","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9047775-2d72-4eb5-9339-419f95aa19b2?source=api-prod","affected":[{"type":"plugin","slug":"acme-fix-images","name":"Acme Fix Images \u2013 Regenerate Thumbnails","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-11-15T00:00:00Z","updated":"2024-04-01T17:06:28Z"},{"id":"wordfence:b905b8ec-d13d-4455-9c5f-61aaa09d75ba","source":"wordfence","cve":"CVE-2023-40010","title":"HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 - Unauthenticated SQL Injection via search terms","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b905b8ec-d13d-4455-9c5f-61aaa09d75ba?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.4.2","to_inclusive":true,"patched_in":"1.3.4.3"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b90640d2-d6f4-4c3b-8e9b-038d57f5fd6f","source":"wordfence","cve":"CVE-2021-24638","title":"OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90640d2-d6f4-4c3b-8e9b-038d57f5fd6f?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b907400c-4d90-4f53-b800-f82f6c4768ba","source":"wordfence","cve":"CVE-2025-49050","title":"Lead Capturing Pages <= 2.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b907400c-4d90-4f53-b800-f82f6c4768ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-lead-capture","name":"WP Lead Capturing Pages","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:00:36Z"},{"id":"wordfence:b9083f58-bbb3-4ef2-96a4-cd61aae0f14a","source":"wordfence","cve":"CVE-2026-48876","title":"Stop Spammers Classic <= 2026.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9083f58-bbb3-4ef2-96a4-cd61aae0f14a?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2026.3","to_inclusive":true,"patched_in":"2026.4"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:37:28Z"},{"id":"wordfence:b90b7f6c-df7f-48a5-b283-cf5facbd71e5","source":"wordfence","cve":"CVE-2023-0584","title":"VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90b7f6c-df7f-48a5-b283-cf5facbd71e5?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.57.0.5","to_inclusive":true,"patched_in":"1.58.0.0"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b90c1a07-2a6d-4c9c-a2a7-e515a1556163","source":"wordfence","cve":"CVE-2025-53290","title":"WP Visual Sitemap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90c1a07-2a6d-4c9c-a2a7-e515a1556163?source=api-prod","affected":[{"type":"plugin","slug":"wp-visual-sitemap","name":"WP Visual Sitemap","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:42:47Z"},{"id":"wordfence:b90d8b14-8f98-498a-89d2-71f47aceb9c3","source":"wordfence","cve":"CVE-2025-30962","title":"FS Poster <= 6.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90d8b14-8f98-498a-89d2-71f47aceb9c3?source=api-prod","affected":[{"type":"plugin","slug":"fs-poster","name":"FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]","from":"*","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"6.5.9"}],"published":"2025-04-10T00:00:00Z","updated":"2026-02-26T15:06:31Z"},{"id":"wordfence:b90dc8f1-3f02-41e0-933c-8d9b8e7dc103","source":"wordfence","cve":"CVE-2026-23801","title":"The Issue <= 1.6.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90dc8f1-3f02-41e0-933c-8d9b8e7dc103?source=api-prod","affected":[{"type":"theme","slug":"theissue","name":"The Issue - Versatile Magazine WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.6.12"}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:41:16Z"},{"id":"wordfence:b90f76d9-3eb3-4ffe-aac7-95953de9972d","source":"wordfence","cve":"CVE-2025-32273","title":"Freetobook Responsive Widget <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b90f76d9-3eb3-4ffe-aac7-95953de9972d?source=api-prod","affected":[{"type":"plugin","slug":"freetobook-responsive-widget","name":"Freetobook Responsive Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-30T14:28:06Z"},{"id":"wordfence:b910b678-5869-43e6-8993-fcf53fe4c66f","source":"wordfence","cve":"","title":"BuddyPress Customer.io Analytics Integration <= 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b910b678-5869-43e6-8993-fcf53fe4c66f?source=api-prod","affected":[{"type":"plugin","slug":"bpcustomerio","name":"BuddyPress Customer.io Analytics Integration","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9119e20-8615-4447-9eb8-4a0259319eb4","source":"wordfence","cve":"CVE-2025-47581","title":"WordPress Events Calendar Registration & Tickets <= 2.6.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9119e20-8615-4447-9eb8-4a0259319eb4?source=api-prod","affected":[{"type":"plugin","slug":"wpeventplus","name":"WordPress Events Calendar Registration & Tickets","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:06:20Z"},{"id":"wordfence:b91364fa-7046-427f-84ee-6a36d49bb80f","source":"wordfence","cve":"CVE-2025-13697","title":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91364fa-7046-427f-84ee-6a36d49bb80f?source=api-prod","affected":[{"type":"plugin","slug":"blockart-blocks","name":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library","from":"*","from_inclusive":true,"to":"2.2.13","to_inclusive":true,"patched_in":"2.2.14"}],"published":"2025-12-01T11:37:01Z","updated":"2025-12-02T01:51:56Z"},{"id":"wordfence:b9137087-f7f0-412c-a78e-e7a0aa92d45d","source":"wordfence","cve":"CVE-2026-104673","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9137087-f7f0-412c-a78e-e7a0aa92d45d?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.14.2","to_inclusive":true,"patched_in":"5.15"}],"published":"2026-10-05T08:47:00Z","updated":"2026-10-08T23:12:21Z"},{"id":"wordfence:b913ad87-4d49-4cb6-82f4-5d953cbabd96","source":"wordfence","cve":"CVE-2025-58682","title":"Kama Click Counter <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b913ad87-4d49-4cb6-82f4-5d953cbabd96?source=api-prod","affected":[{"type":"plugin","slug":"kama-clic-counter","name":"Kama Click Counter","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T14:07:37Z"},{"id":"wordfence:b9174903-5394-475b-b90f-66f97548e424","source":"wordfence","cve":"CVE-2026-10081","title":"Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9174903-5394-475b-b90f-66f97548e424?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T21:30:37Z"},{"id":"wordfence:b917c16f-cd0b-400a-b0e8-48ae32d18339","source":"wordfence","cve":"CVE-2025-68021","title":"ConveyThis <= 270.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b917c16f-cd0b-400a-b0e8-48ae32d18339?source=api-prod","affected":[{"type":"plugin","slug":"conveythis-translate","name":"ConveyThis AI Multilingual Translation","from":"*","from_inclusive":true,"to":"270.4","to_inclusive":true,"patched_in":"270.5"}],"published":"2026-01-27T00:00:00Z","updated":"2026-06-18T13:40:18Z"},{"id":"wordfence:b919f11b-c57f-4511-8fd6-9e83d2855266","source":"wordfence","cve":"CVE-2024-38700","title":"WPCS <= 1.2.0.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b919f11b-c57f-4511-8fd6-9e83d2855266?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.2.0.3","to_inclusive":true,"patched_in":"1.2.0.4"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-30T20:03:55Z"},{"id":"wordfence:b91b189d-c159-45c2-a75a-933a72706c47","source":"wordfence","cve":"CVE-2025-27300","title":"ADFO \u2013 Custom data in admin dashboard  <= 1.9.1 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91b189d-c159-45c2-a75a-933a72706c47?source=api-prod","affected":[{"type":"plugin","slug":"admin-form","name":"ADFO \u2013 Custom data in admin dashboard","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-26T22:52:00Z"},{"id":"wordfence:b91cd230-7e84-4dbf-8aad-18b54bfdc4e7","source":"wordfence","cve":"CVE-2024-5767","title":"sitetweet <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91cd230-7e84-4dbf-8aad-18b54bfdc4e7?source=api-prod","affected":[{"type":"plugin","slug":"sitetweet-tweets-user-behaviors-on-your-site-on-twitter","name":"sitetweet","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-13T16:10:48Z"},{"id":"wordfence:b91d979f-4043-4d55-9d01-6eda967b0a37","source":"wordfence","cve":"CVE-2025-22595","title":"Mailing Group Listserv <= 2.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91d979f-4043-4d55-9d01-6eda967b0a37?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailing-group","name":"Mailing Group Listserv","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-01-07T00:00:00Z","updated":"2025-04-10T15:09:06Z"},{"id":"wordfence:b91ec428-8444-4304-8901-4bc3ef146e3e","source":"wordfence","cve":"CVE-2024-9267","title":"Easy WordPress Subscribe \u2013 Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91ec428-8444-4304-8901-4bc3ef146e3e?source=api-prod","affected":[{"type":"plugin","slug":"opt-in-hound","name":"Easy WordPress Subscribe \u2013 Optin Hound","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T07:30:21Z"},{"id":"wordfence:b91f3db6-5331-48d4-9c79-9ecba0870be2","source":"wordfence","cve":"CVE-2016-10918","title":"Photo Gallery by Supsystic <= 1.8.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b91f3db6-5331-48d4-9c79-9ecba0870be2?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"}],"published":"2016-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9216875-8cb6-45a7-b23b-19d13f8b49dc","source":"wordfence","cve":"CVE-2026-6292","title":"MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9216875-8cb6-45a7-b23b-19d13f8b49dc?source=api-prod","affected":[{"type":"plugin","slug":"mp-customize-login-page","name":"MP Customize Login Page","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:37:47Z","updated":"2026-06-24T05:33:28Z"},{"id":"wordfence:b924261f-1e1a-4565-a22e-ba592912d270","source":"wordfence","cve":"","title":"YITH WooCommerce Multi Vendor <= 3.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b924261f-1e1a-4565-a22e-ba592912d270?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-vendors","name":"YITH WooCommerce Multi Vendor","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":false,"patched_in":"3.8.1"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b926243c-ed12-4afe-ac72-932d4d871019","source":"wordfence","cve":"CVE-2023-1604","title":"Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_page","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b926243c-ed12-4afe-ac72-932d4d871019?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:24Z"},{"id":"wordfence:b92913fa-aa1e-40a0-9a48-d730b2102217","source":"wordfence","cve":"CVE-2025-1440","title":"Advanced iFrame <= 2024.5 - Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b92913fa-aa1e-40a0-9a48-d730b2102217?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2024.5","to_inclusive":true,"patched_in":"2025.0"}],"published":"2025-03-25T00:00:00Z","updated":"2025-03-26T09:21:51Z"},{"id":"wordfence:b92c3d68-2e3e-4500-8da9-f89373126445","source":"wordfence","cve":"CVE-2024-24865","title":"Scroll Triggered Box <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b92c3d68-2e3e-4500-8da9-f89373126445?source=api-prod","affected":[{"type":"plugin","slug":"dreamgrow-scroll-triggered-box","name":"Scroll Triggered Box","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T20:43:51Z"},{"id":"wordfence:b92deadd-a50c-406d-afdf-301453967880","source":"wordfence","cve":"CVE-2024-37441","title":"NewsMash <= 1.0.34 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b92deadd-a50c-406d-afdf-301453967880?source=api-prod","affected":[{"type":"theme","slug":"newsmash","name":"NewsMash","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:54:07Z"},{"id":"wordfence:b92ebcd6-8508-4fcd-a6e6-da16063324ed","source":"wordfence","cve":"CVE-2026-14841","title":"King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b92ebcd6-8508-4fcd-a6e6-da16063324ed?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.75","to_inclusive":true,"patched_in":"51.1.76"}],"published":"2026-07-20T00:00:00Z","updated":"2026-08-12T00:08:21Z"},{"id":"wordfence:b930ddd7-a2a3-4b83-a1a6-ea08bbcb07a3","source":"wordfence","cve":"CVE-2023-25035","title":"Quick Contact Form <= 8.0.3.1 - Cross-Site Request Forgery to Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b930ddd7-a2a3-4b83-a1a6-ea08bbcb07a3?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.0.3.1","to_inclusive":true,"patched_in":"8.0.4"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9321431-c401-49f7-b421-807830aa0391","source":"wordfence","cve":"CVE-2026-39801","title":"AI Copilot \u2013 Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9321431-c401-49f7-b421-807830aa0391?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:30:23Z"},{"id":"wordfence:b93214ec-5738-4f10-b48c-1d74aad52acb","source":"wordfence","cve":"CVE-2025-2544","title":"AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93214ec-5738-4f10-b48c-1d74aad52acb?source=api-prod","affected":[{"type":"plugin","slug":"ai-content-pipelines","name":"AI Content Pipelines: Content Engine + Analytics","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T13:14:24Z","updated":"2025-04-05T01:44:45Z"},{"id":"wordfence:b9371b37-53c5-4a4f-a500-c6d58d4d3c5a","source":"wordfence","cve":"CVE-2024-10820","title":"WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9371b37-53c5-4a4f-a500-c6d58d4d3c5a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-upload-files","name":"WooCommerce Upload Files","from":"*","from_inclusive":true,"to":"84.3","to_inclusive":true,"patched_in":"84.4"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T03:20:07Z"},{"id":"wordfence:b937940c-a3e0-49d3-b066-550b78351b54","source":"wordfence","cve":"CVE-2023-1938","title":"WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b937940c-a3e0-49d3-b066-550b78351b54?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b937cbfb-d43c-4cda-b247-921661cbc0ad","source":"wordfence","cve":"CVE-2024-2392","title":"Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b937cbfb-d43c-4cda-b247-921661cbc0ad?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2024-03-21T00:00:00Z","updated":"2024-10-24T19:27:22Z"},{"id":"wordfence:b939377b-276c-4612-9687-4e1b77e104cd","source":"wordfence","cve":"CVE-2025-52722","title":"Classiera <= 4.0.34 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b939377b-276c-4612-9687-4e1b77e104cd?source=api-prod","affected":[{"type":"theme","slug":"classiera","name":"Classiera \u2013 Classified Ads WordPress Theme","from":"*","from_inclusive":true,"to":"4.0.34","to_inclusive":true,"patched_in":"4.0.35"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:52:19Z"},{"id":"wordfence:b9394801-4a74-4327-9afd-35f4166c2abb","source":"wordfence","cve":"CVE-2022-0684","title":"WP Home Page Menu < 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9394801-4a74-4327-9afd-35f4166c2abb?source=api-prod","affected":[{"type":"plugin","slug":"wp-home-page-menu","name":"WP Home Page Menu","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b939ec4c-10c0-4c57-be6a-db443e59e22c","source":"wordfence","cve":"CVE-2025-69379","title":"Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b939ec4c-10c0-4c57-be6a-db443e59e22c?source=api-prod","affected":[{"type":"plugin","slug":"wp-upload-files-anywhere","name":"WordPress Upload Files Anywhere","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:19:38Z"},{"id":"wordfence:b93af9cc-cd9a-4bbb-8cb1-bf45c59e469c","source":"wordfence","cve":"CVE-2024-2325","title":"Link Library <= 7.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93af9cc-cd9a-4bbb-8cb1-bf45c59e469c?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.6.6","to_inclusive":true,"patched_in":"7.6.7"}],"published":"2024-03-13T00:00:00Z","updated":"2024-05-31T15:30:52Z"},{"id":"wordfence:b93e9e84-1675-4128-a018-03833ff75943","source":"wordfence","cve":"CVE-2024-4565","title":"Advanced Custom Fields <= 6.2.10 - Authenticated (Contributor+) Arbitrary Custom Field Access","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93e9e84-1675-4128-a018-03833ff75943?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.2.10","to_inclusive":true,"patched_in":"6.3.0"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.2.10","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-08-29T18:29:20Z"},{"id":"wordfence:b93f4595-b4b5-46ef-8a50-45c0e3ff0212","source":"wordfence","cve":"CVE-2025-67542","title":"Multi-Step Checkout for WooCommerce <= 2.33 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93f4595-b4b5-46ef-8a50-45c0e3ff0212?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-step-checkout","name":"Multi-Step Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.33","to_inclusive":true,"patched_in":"2.34"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:00:56Z"},{"id":"wordfence:b93f66ac-5c9b-483a-a7ad-0a404d3935e0","source":"wordfence","cve":"CVE-2023-32802","title":"WooCommerce Pre-Orders <= 1.9.0 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93f66ac-5c9b-483a-a7ad-0a404d3935e0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pre-orders","name":"WooCommerce Pre-Orders","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b93f8036-4a89-45e6-b86f-9d57e1662a35","source":"wordfence","cve":"CVE-2023-25048","title":"Fantastic Content Protector Free <= 2.6 - Missing Authorization via update_setting_fantastic_content_protector","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b93f8036-4a89-45e6-b86f-9d57e1662a35?source=api-prod","affected":[{"type":"plugin","slug":"fantastic-content-protector-free","name":"Fantastic Content Protector Free","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9412cb1-54b5-4544-8571-0a1185e7f456","source":"wordfence","cve":"CVE-2015-9403","title":"Neuvoo Jobroll <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9412cb1-54b5-4544-8571-0a1185e7f456?source=api-prod","affected":[{"type":"plugin","slug":"neuvoo-jobroll","name":"neuvoo-jobroll","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2015-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b94202ef-75d6-4b6f-96b5-f9760cc0a628","source":"wordfence","cve":"CVE-2021-24840","title":"Squaretype - Modern Blog WordPress Theme < 3.0.4 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94202ef-75d6-4b6f-96b5-f9760cc0a628?source=api-prod","affected":[{"type":"theme","slug":"squaretype","name":"Squaretype - Modern Blog WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b94303b5-2ee6-4549-ae59-74e0a0b00fa3","source":"wordfence","cve":"CVE-2025-24657","title":"Wishlist for WooCommerce <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94303b5-2ee6-4549-ae59-74e0a0b00fa3?source=api-prod","affected":[{"type":"plugin","slug":"wt-woocommerce-wishlist","name":"Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:00:13Z"},{"id":"wordfence:b9438d01-a5a4-414a-a9b9-a93e6ebd34f0","source":"wordfence","cve":"CVE-2026-112852","title":"Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9438d01-a5a4-414a-a9b9-a93e6ebd34f0?source=api-prod","affected":[{"type":"theme","slug":"helion","name":"Helion | Personal Portfolio & Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:56:13Z"},{"id":"wordfence:b9453b2f-216b-4aaf-a010-45c84e747092","source":"wordfence","cve":"CVE-2026-61988","title":"Auction Nudge \u2013 Your eBay Listings <= 8.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9453b2f-216b-4aaf-a010-45c84e747092?source=api-prod","affected":[{"type":"plugin","slug":"auction-nudge","name":"Auction Nudge \u2013 Your eBay Listings","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:34:07Z"},{"id":"wordfence:b9458918-beaf-4bad-8abd-521547df9497","source":"wordfence","cve":"CVE-2026-3348","title":"MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9458918-beaf-4bad-8abd-521547df9497?source=api-prod","affected":[{"type":"plugin","slug":"minhnhut-link-gateway","name":"MinhNhut Link Gateway","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T20:48:50Z","updated":"2026-05-27T09:27:31Z"},{"id":"wordfence:b946ee73-4cf9-48c8-b456-285b118c6b05","source":"wordfence","cve":"CVE-2024-6069","title":"Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.3.4","to_inclusive":true,"patched_in":"3.8.3.5"}],"published":"2024-07-08T19:39:26Z","updated":"2024-08-01T17:30:02Z"},{"id":"wordfence:b947bd68-2dfa-4637-8f10-39c283fdac70","source":"wordfence","cve":"CVE-2023-5343","title":"Popup Box \u2013 Best WordPress Popup Plugin <= 3.7.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b947bd68-2dfa-4637-8f10-39c283fdac70?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.7.8","to_inclusive":true,"patched_in":"3.7.9"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b948574a-0aab-4596-83e6-04be21f78bc1","source":"wordfence","cve":"","title":"YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b948574a-0aab-4596-83e6-04be21f78bc1?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-bulk-product-editing","name":"YITH WooCommerce Bulk Product Editing","from":"*","from_inclusive":true,"to":"1.2.27","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-zoom-magnifier","name":"YITH WooCommerce Product Gallery & Image Zoom","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"},{"type":"plugin","slug":"yith-woocommerce-popup","name":"YITH WooCommerce Popup","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-badges-management","name":"YITH WooCommerce Badge Management","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"},{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.16.0"},{"type":"plugin","slug":"yith-woocommerce-tab-manager","name":"YITH WooCommerce Tab Manager","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.17.1"},{"type":"plugin","slug":"yith-woocommerce-questions-and-answers","name":"YITH WooCommerce Questions and Answers","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-authorizenet-payment-gateway","name":"YITH WooCommerce Authorize.net Payment Gateway","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-name-your-price","name":"YITH WooCommerce Name Your Price","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-order-tracking","name":"YITH WooCommerce Order & Shipment Tracking","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"yith-woocommerce-cart-messages","name":"YITH WooCommerce Cart Messages","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-subscription","name":"YITH WooCommerce Subscription","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"},{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":"1.20.1"},{"type":"plugin","slug":"yith-woocommerce-ajax-navigation","name":"YITH WooCommerce Ajax Product Filter","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.16.0"},{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"3.14.0","to_inclusive":true,"patched_in":"3.15.0"},{"type":"plugin","slug":"yith-woocommerce-stripe","name":"YITH WooCommerce Stripe","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-custom-thank-you-page-for-woocommerce","name":"YITH Custom Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-donations-for-woocommerce","name":"YITH Donations for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":"2.20.1"},{"type":"plugin","slug":"yith-color-and-label-variations-for-woocommerce","name":"YITH Color and Label Variations for WooCommerce","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":true,"patched_in":"1.25.1"},{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":true,"patched_in":"1.25.1"},{"type":"plugin","slug":"yith-essential-kit-for-woocommerce-1","name":"YITH Essential Kit for WooCommerce #1","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.14.0"},{"type":"plugin","slug":"yith-woocommerce-mailchimp","name":"YITH WooCommerce Mailchimp","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-infinite-scrolling","name":"YITH Infinite Scrolling","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"},{"type":"plugin","slug":"yith-woocommerce-product-vendors","name":"YITH WooCommerce Multi Vendor","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-pre-order-for-woocommerce","name":"YITH Pre-Order for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"yith-woocommerce-product-bundles","name":"YITH WooCommerce Product Bundles","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.17.0"},{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"},{"type":"plugin","slug":"yith-woocommerce-waiting-list","name":"YITH WooCommerce Waitlist","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-pdf-invoice","name":"YITH WooCommerce PDF Invoice and Shipping List","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-category-accordion","name":"YITH WooCommerce Category Accordion","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-brands-add-on","name":"YITH WooCommerce Brands Add-On","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"yith-woocommerce-gift-cards","name":"YITH WooCommerce Gift Cards","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"},{"type":"plugin","slug":"yith-paypal-payments-for-woocommerce","name":"YITH PayPal Payments for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-points-and-rewards","name":"YITH WooCommerce Points and Rewards","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-multi-step-checkout","name":"YITH WooCommerce Multi-step Checkout","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-added-to-cart-popup","name":"YITH WooCommerce Added to Cart Popup","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-product-slider-carousel","name":"YITH WooCommerce Product Slider Carousel","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"},{"type":"plugin","slug":"yith-woocommerce-catalog-mode","name":"YITH WooCommerce Catalog Mode","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"},{"type":"plugin","slug":"yith-woocommerce-affiliates","name":"YITH WooCommerce Affiliates","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"yith-woocommerce-quick-view","name":"YITH WooCommerce Quick View","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-advanced-reviews","name":"YITH WooCommerce Advanced Reviews","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-frequently-bought-together","name":"YITH Frequently Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.19.1"},{"type":"plugin","slug":"yith-woocommerce-featured-video","name":"YITH WooCommerce Featured Video","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"},{"type":"plugin","slug":"yith-woocommerce-social-login","name":"YITH WooCommerce Social Login","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b949d563-3d1d-469d-9793-c2613efbfaa8","source":"wordfence","cve":"CVE-2025-30552","title":"WordPress Admin Bar Improved <= 3.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b949d563-3d1d-469d-9793-c2613efbfaa8?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-admin-bar-improved","name":"WordPress Admin Bar Improved","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:26:16Z"},{"id":"wordfence:b94d4e13-c093-4143-b011-8a89a7477e1e","source":"wordfence","cve":"CVE-2025-23770","title":"Fast Tube <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94d4e13-c093-4143-b011-8a89a7477e1e?source=api-prod","affected":[{"type":"plugin","slug":"fast-tube","name":"Fast Tube","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:11:13Z"},{"id":"wordfence:b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.1","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"16.1.3"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:17:58Z"},{"id":"wordfence:b94de6d5-5234-4702-811e-a81c6bae52f2","source":"wordfence","cve":"CVE-2026-123148","title":"The Innovative Form Builder \u2013 IvyForms <= 1.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94de6d5-5234-4702-811e-a81c6bae52f2?source=api-prod","affected":[{"type":"plugin","slug":"ivyforms","name":"The Innovative Form Builder \u2013 IvyForms","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-11-07T10:38:00Z","updated":"2026-11-10T19:57:39Z"},{"id":"wordfence:b94f388a-c4af-4d3a-bd41-9b2d5d990672","source":"wordfence","cve":"CVE-2026-0609","title":"Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94f388a-c4af-4d3a-bd41-9b2d5d990672?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.9.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-03-20T15:20:04Z","updated":"2026-10-15T17:07:19Z"},{"id":"wordfence:b94facce-975f-4080-ad67-95d282b28d0d","source":"wordfence","cve":"","title":"WPBakery Page Builder for WordPress (formerly Visual Composer) <= 4.7.3 - Multiple Cross-Site Scripting Issues","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b94facce-975f-4080-ad67-95d282b28d0d?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":false,"patched_in":"4.7.4"}],"published":"2015-02-10T00:00:00Z","updated":"2025-07-15T13:27:50Z"},{"id":"wordfence:b9502669-ddbb-40c3-9d98-95c862f47a9a","source":"wordfence","cve":"CVE-2022-0783","title":"Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9502669-ddbb-40c3-9d98-95c862f47a9a?source=api-prod","affected":[{"type":"plugin","slug":"multiple-shipping-address-woocommerce","name":"Multiple Shipping Address Woocommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b950faf9-2122-42af-9f05-ec850767be32","source":"wordfence","cve":"CVE-2024-9943","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b950faf9-2122-42af-9f05-ec850767be32?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2024-10-23T19:21:58Z","updated":"2024-10-24T07:35:57Z"},{"id":"wordfence:b9567f63-9161-49a3-9b94-dd6dee5a5628","source":"wordfence","cve":"CVE-2017-18521","title":"Democracy Poll <= 5.3.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9567f63-9161-49a3-9b94-dd6dee5a5628?source=api-prod","affected":[{"type":"plugin","slug":"democracy-poll","name":"Democracy Poll","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.4"}],"published":"2017-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b957eb0d-882d-4646-ad84-9c64f957be14","source":"wordfence","cve":"CVE-2025-3813","title":"Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b957eb0d-882d-4646-ad84-9c64f957be14?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1020","to_inclusive":true,"patched_in":"1.7.1021"}],"published":"2025-05-30T00:00:00Z","updated":"2025-05-31T07:22:13Z"},{"id":"wordfence:b9583959-39d6-4c2b-bd0c-2c07fc46fe59","source":"wordfence","cve":"CVE-2026-84043","title":"ePayco plugin for WooCommerce < 8.4.7 - Unauthenticated Unauthorized Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9583959-39d6-4c2b-bd0c-2c07fc46fe59?source=api-prod","affected":[{"type":"plugin","slug":"epayco-gateway","name":"ePayco plugin for WooCommerce","from":"*","from_inclusive":true,"to":"8.4.7","to_inclusive":false,"patched_in":"8.4.7"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:43:55Z"},{"id":"wordfence:b95af878-f324-44ae-a4bf-0c1e994bb3c1","source":"wordfence","cve":"CVE-2026-5651","title":"Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b95af878-f324-44ae-a4bf-0c1e994bb3c1?source=api-prod","affected":[{"type":"plugin","slug":"askeet","name":"Askeet \u2014 Talk to Your WooCommerce Data","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-08-04T17:49:48Z","updated":"2026-08-05T06:38:00Z"},{"id":"wordfence:b95b6c12-df45-4ef0-9312-81798346fd64","source":"wordfence","cve":"CVE-2025-60181","title":"Silencesoft RSS Reader <= 0.6 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b95b6c12-df45-4ef0-9312-81798346fd64?source=api-prod","affected":[{"type":"plugin","slug":"external-rss-reader","name":"Silencesoft RSS Reader","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T12:44:04Z"},{"id":"wordfence:b95baf58-bd99-4682-b2eb-46a402c62c03","source":"wordfence","cve":"CVE-2024-44010","title":"Full frame <= 2.7.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b95baf58-bd99-4682-b2eb-46a402c62c03?source=api-prod","affected":[{"type":"theme","slug":"full-frame","name":"Full Frame","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:43:22Z"},{"id":"wordfence:b95c1bf7-bb05-44d3-a185-7e38e62b7201","source":"wordfence","cve":"CVE-2023-5291","title":"Blog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b95c1bf7-bb05-44d3-a185-7e38e62b7201?source=api-prod","affected":[{"type":"plugin","slug":"blog-filter","name":"Blog Filter \u2013 Post Grid Filter by Category or Tag","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b95ec70c-ac76-48fa-9d9d-01cf1983e504","source":"wordfence","cve":"CVE-2026-15962","title":"Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b95ec70c-ac76-48fa-9d9d-01cf1983e504?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":true,"patched_in":"6.2.7"}],"published":"2026-07-25T12:00:48Z","updated":"2026-07-26T01:28:40Z"},{"id":"wordfence:b96273e8-29a8-4802-8c83-1ce5ab9600b6","source":"wordfence","cve":"CVE-2024-43355","title":"JoomSport <= 5.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b96273e8-29a8-4802-8c83-1ce5ab9600b6?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:10:26Z"},{"id":"wordfence:b9632e3b-1df4-46b2-92e8-8ed29ff2bf89","source":"wordfence","cve":"CVE-2026-118523","title":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI < 4.3.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9632e3b-1df4-46b2-92e8-8ed29ff2bf89?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.6.1","to_inclusive":false,"patched_in":"4.3.6.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:33:48Z"},{"id":"wordfence:b96349da-e2b4-4b29-94b4-1039427bce8e","source":"wordfence","cve":"","title":"WooCommerce PDF Invoices & Packing Slips <=  2.14.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b96349da-e2b4-4b29-94b4-1039427bce8e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"2.14.5","from_inclusive":true,"to":"2.14.5","to_inclusive":true,"patched_in":"2.15"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b964df21-5648-4fe1-b2a7-99f8a0f02026","source":"wordfence","cve":"CVE-2021-24157","title":"Orbit Fox by ThemeIsle <= 2.10.2 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b964df21-5648-4fe1-b2a7-99f8a0f02026?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":false,"patched_in":"2.10.3"}],"published":"2021-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b967eb98-69f8-41c5-a19a-9d20979accb0","source":"wordfence","cve":"CVE-2025-1565","title":"Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b967eb98-69f8-41c5-a19a-9d20979accb0?source=api-prod","affected":[{"type":"plugin","slug":"mayosis-core","name":"Mayosis Core","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2025-04-24T20:29:52Z","updated":"2025-04-25T09:21:41Z"},{"id":"wordfence:b9690fc8-cd0c-42e4-aa21-5c71243565f0","source":"wordfence","cve":"CVE-2026-75800","title":"Frontegg SAML SSO <= 1.0.1 - Authentication Bypass to Admin","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9690fc8-cd0c-42e4-aa21-5c71243565f0?source=api-prod","affected":[{"type":"plugin","slug":"frontegg-saml-sso","name":"Frontegg SAML SSO","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:13:53Z"},{"id":"wordfence:b96c5ba8-e0a6-42b9-8ba1-637d52476d64","source":"wordfence","cve":"CVE-2014-8758","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin < 3.0.70 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b96c5ba8-e0a6-42b9-8ba1-637d52476d64?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"3.0.70","to_inclusive":false,"patched_in":"3.0.70"}],"published":"2014-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b96d71cb-3af4-4d67-a4af-41bab79a7f61","source":"wordfence","cve":"CVE-2023-22679","title":"WP Better Emails <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b96d71cb-3af4-4d67-a4af-41bab79a7f61?source=api-prod","affected":[{"type":"plugin","slug":"wp-better-emails","name":"WP Better Emails","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b96f40fe-3ffa-4fc5-b51a-ff3771224bd5","source":"wordfence","cve":"","title":"WP Job Manager <= 1.31.2 - PHP Object Injection via PHAR Deserialization","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b96f40fe-3ffa-4fc5-b51a-ff3771224bd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"1.31.3","to_inclusive":false,"patched_in":"1.31.3"}],"published":"2019-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b972626c-6374-4084-a0e1-1ea4a3062228","source":"wordfence","cve":"CVE-2024-12850","title":"Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b972626c-6374-4084-a0e1-1ea4a3062228?source=api-prod","affected":[{"type":"plugin","slug":"database-backup","name":"Database Backup and Table Integrity Check with Automated Scheduling","from":"*","from_inclusive":true,"to":"2.32","to_inclusive":true,"patched_in":"2.33"}],"published":"2024-12-23T21:07:32Z","updated":"2024-12-24T09:22:23Z"},{"id":"wordfence:b9738054-058f-47be-9973-f119fbfd4396","source":"wordfence","cve":"CVE-2023-25705","title":"WP Prayer <= 1.9.6 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9738054-058f-47be-9973-f119fbfd4396?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b973eaec-94dd-4c38-85ec-60993bc5fb09","source":"wordfence","cve":"CVE-2026-115591","title":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics <= 1.10.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b973eaec-94dd-4c38-85ec-60993bc5fb09?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.10.5","to_inclusive":true,"patched_in":"1.10.7"}],"published":"2026-10-26T12:30:08Z","updated":"2026-11-03T19:26:29Z"},{"id":"wordfence:b973f244-37eb-4e60-ae02-ddca3e988af1","source":"wordfence","cve":"CVE-2025-31549","title":"Fusion <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b973f244-37eb-4e60-ae02-ddca3e988af1?source=api-prod","affected":[{"type":"plugin","slug":"fusion","name":"Fusion Page Builder","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:27:17Z"},{"id":"wordfence:b9769bc3-236f-4c9d-a4ce-544e49eee2ec","source":"wordfence","cve":"CVE-2023-49830","title":"Astra Pro <= 4.3.1 - Authenticated(Contributor+) Remote Code Execution via Metabox","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9769bc3-236f-4c9d-a4ce-544e49eee2ec?source=api-prod","affected":[{"type":"plugin","slug":"astra-addon","name":"Astra Pro Addon","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b977e3f8-46e7-4294-ab5c-e42e81c900e0","source":"wordfence","cve":"CVE-2023-32595","title":"Sunny Search <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b977e3f8-46e7-4294-ab5c-e42e81c900e0?source=api-prod","affected":[{"type":"plugin","slug":"fast-search-powered-by-solr","name":"Sunny Search","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b97805de-1b47-4c9f-baae-2e37c1b78570","source":"wordfence","cve":"CVE-2026-1555","title":"WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97805de-1b47-4c9f-baae-2e37c1b78570?source=api-prod","affected":[{"type":"theme","slug":"webstack","name":"WebStack","from":"*","from_inclusive":true,"to":"1.2024","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T14:52:49Z","updated":"2026-04-15T03:37:20Z"},{"id":"wordfence:b97819de-4919-46b1-b0f9-ac09e1caa031","source":"wordfence","cve":"CVE-2026-66697","title":"Colissimo shipping methods for WooCommerce <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97819de-4919-46b1-b0f9-ac09e1caa031?source=api-prod","affected":[{"type":"plugin","slug":"colissimo-shipping-methods-for-woocommerce","name":"Colissimo shipping methods for WooCommerce","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:49:55Z"},{"id":"wordfence:b978fbe2-ac89-4054-96bc-1f3d452170d9","source":"wordfence","cve":"CVE-2026-39708","title":"UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b978fbe2-ac89-4054-96bc-1f3d452170d9?source=api-prod","affected":[{"type":"plugin","slug":"uicore-elements","name":"UiCore Elements \u2013 Free widgets and templates for Elementor","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2026-03-01T00:00:00Z","updated":"2026-06-18T18:24:13Z"},{"id":"wordfence:b9790543-f4db-46a7-ad0d-3276dcf3a64a","source":"wordfence","cve":"CVE-2026-57376","title":"ElementInvader Addons for Elementor <= 1.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9790543-f4db-46a7-ad0d-3276dcf3a64a?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:50:22Z"},{"id":"wordfence:b9793793-44d5-4628-a57b-c1254645e648","source":"wordfence","cve":"CVE-2021-25076","title":"WP User Frontend <= 3.5.25 - SQL Injection & Reflected Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9793793-44d5-4628-a57b-c1254645e648?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.5.25","to_inclusive":true,"patched_in":"3.5.26"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b97a555a-1eeb-4fc4-9338-bad8b9a0585d","source":"wordfence","cve":"CVE-2024-9442","title":"F4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97a555a-1eeb-4fc4-9338-bad8b9a0585d?source=api-prod","affected":[{"type":"plugin","slug":"f4-improvements","name":"F4 Improvements","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:40:42Z","updated":"2024-11-21T02:06:43Z"},{"id":"wordfence:b97b1c86-22a4-462b-9140-55139cf02c7a","source":"wordfence","cve":"CVE-2024-25600","title":"Bricks <= 1.9.6 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97b1c86-22a4-462b-9140-55139cf02c7a?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.6.1"}],"published":"2024-02-13T00:00:00Z","updated":"2025-04-28T13:39:55Z"},{"id":"wordfence:b97b84a8-cf4e-4648-8d58-b81a71b7988c","source":"wordfence","cve":"CVE-2023-41869","title":"WP Accessibility Helper (WAH) <= 0.6.2.4 - Missing Authorization via AJAX action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97b84a8-cf4e-4648-8d58-b81a71b7988c?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.2.4","to_inclusive":true,"patched_in":"0.6.2.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b97c6171-3842-4f2b-adf5-28fc4c0b24bf","source":"wordfence","cve":"CVE-2017-6573","title":"Mail Masta <= 1.0 - SQL Injection via id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97c6171-3842-4f2b-adf5-28fc4c0b24bf?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-08-15T18:21:19Z"},{"id":"wordfence:b97d2b63-7eaa-4518-b838-35d4b993743d","source":"wordfence","cve":"CVE-2026-0974","title":"Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97d2b63-7eaa-4518-b838-35d4b993743d?source=api-prod","affected":[{"type":"plugin","slug":"orderable","name":"Orderable \u2013 Restaurant & Food Ordering System","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":"1.20.1"}],"published":"2026-02-18T15:44:21Z","updated":"2026-05-16T00:50:25Z"},{"id":"wordfence:b97e41a7-dd0a-41cf-ba74-84b117192088","source":"wordfence","cve":"CVE-2024-32681","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.2 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b97e41a7-dd0a-41cf-ba74-84b117192088?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.2","to_inclusive":true,"patched_in":"3.13.3"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T13:41:14Z"},{"id":"wordfence:b980b8e2-73e6-4afc-a24c-c7c98283e85b","source":"wordfence","cve":"","title":"Translate WordPress with GTranslate <= 2.8.10 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b980b8e2-73e6-4afc-a24c-c7c98283e85b?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"2.8.11","to_inclusive":false,"patched_in":"2.8.11"}],"published":"2017-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b980bcd6-5ae3-4fa8-843b-652bd94d1dc6","source":"wordfence","cve":"CVE-2024-3641","title":"Newsletter Popup <= 1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b980bcd6-5ae3-4fa8-843b-652bd94d1dc6?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-06T13:08:08Z"},{"id":"wordfence:b9815a47-dc71-4dd0-8645-f52408ecb20f","source":"wordfence","cve":"CVE-2025-47624","title":"DoFollow Case by Case <= 3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9815a47-dc71-4dd0-8645-f52408ecb20f?source=api-prod","affected":[{"type":"plugin","slug":"dofollow-case-by-case","name":"DoFollow Case by Case","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-03T19:17:46Z"},{"id":"wordfence:b98179c3-8b32-4d75-9f3f-2367215a740b","source":"wordfence","cve":"CVE-2024-4544","title":"Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b98179c3-8b32-4d75-9f3f-2367215a740b?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-social-site","name":"Pie Register - Social Sites Login (Add on)","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T03:30:34Z"},{"id":"wordfence:b98367ee-e9fd-4ba8-bbb8-4a03a832e4a6","source":"wordfence","cve":"CVE-2026-78285","title":"Like Button Rating \u2665 LikeBtn <= 2.6.61 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b98367ee-e9fd-4ba8-bbb8-4a03a832e4a6?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.61","to_inclusive":true,"patched_in":"2.6.62"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:53:16Z"},{"id":"wordfence:b983d22b-6cd2-4450-99e2-88bb149091fe","source":"wordfence","cve":"CVE-2024-0660","title":"Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b983d22b-6cd2-4450-99e2-88bb149091fe?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.7.2","to_inclusive":true,"patched_in":"6.8"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:37:16Z"},{"id":"wordfence:b9842421-93da-4535-9d48-fd591cd5e80f","source":"wordfence","cve":"CVE-2025-64269","title":"WooCommerce PDF Invoice Builder <= 1.2.150 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9842421-93da-4535-9d48-fd591cd5e80f?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.150","to_inclusive":true,"patched_in":"1.2.151"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-17T19:07:45Z"},{"id":"wordfence:b9852f61-6502-4e27-9de4-ff1a79accd71","source":"wordfence","cve":"CVE-2026-24541","title":"Download After Email <= 2.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9852f61-6502-4e27-9de4-ff1a79accd71?source=api-prod","affected":[{"type":"plugin","slug":"download-after-email","name":"Download After Email \u2013 Subscribe & Download Form Plugin","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2026-01-24T00:00:00Z","updated":"2026-04-15T13:36:00Z"},{"id":"wordfence:b9860e0e-e330-42fc-8a74-336ceb787f39","source":"wordfence","cve":"CVE-2025-66533","title":"GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9860e0e-e330-42fc-8a74-336ceb787f39?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.13.1","to_inclusive":true,"patched_in":"4.13.2"}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:31:11Z"},{"id":"wordfence:b987822d-2b1b-4f79-988b-4bd731864b63","source":"wordfence","cve":"CVE-2023-4773","title":"WordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b987822d-2b1b-4f79-988b-4bd731864b63?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-social-login","name":"WordPress Social Login","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b988a8bb-0def-4469-8f97-d329967cb11b","source":"wordfence","cve":"CVE-2024-54221","title":"FAT Services Booking <= 5.6 - Unauthenticated SQL Injection","severity":"high","cvss":8.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b988a8bb-0def-4469-8f97-d329967cb11b?source=api-prod","affected":[{"type":"plugin","slug":"fat-services-booking","name":"FAT Services Booking","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:16:40Z"},{"id":"wordfence:b988f424-f649-4bf0-9f7f-88faa41c0029","source":"wordfence","cve":"CVE-2021-24861","title":"Quotes Collection <= 2.5.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b988f424-f649-4bf0-9f7f-88faa41c0029?source=api-prod","affected":[{"type":"plugin","slug":"quotes-collection","name":"Quotes Collection","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b98c5623-15fe-4937-9a0e-770aa0ab06f3","source":"wordfence","cve":"CVE-2023-41672","title":"Hide admin notices \u2013 Admin Notification Center <= 2.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b98c5623-15fe-4937-9a0e-770aa0ab06f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-notification-center","name":"Hide admin notices \u2013 Admin Notification Center","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b98f2a85-9535-4bf5-900c-f4f630c7b502","source":"wordfence","cve":"CVE-2025-0918","title":"SMTP for SendGrid \u2013 YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logs","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=api-prod","affected":[{"type":"plugin","slug":"smtp-sendgrid","name":"SMTP for SendGrid \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-02-22T00:00:00Z","updated":"2025-04-10T22:27:31Z"},{"id":"wordfence:b990915d-219b-4329-b7a8-e0c13cad7530","source":"wordfence","cve":"CVE-2024-37930","title":"SmartMag < 10.1.0 - Unauthenticated Sensitive Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b990915d-219b-4329-b7a8-e0c13cad7530?source=api-prod","affected":[{"type":"theme","slug":"smartmag-responsive-retina-wordpress-magazine","name":"SmartMag","from":"*","from_inclusive":true,"to":"10.1.0","to_inclusive":false,"patched_in":"10.1.0"}],"published":"2024-07-09T00:00:00Z","updated":"2026-03-17T21:20:08Z"},{"id":"wordfence:b9909373-48d7-425b-a20b-bb8bf2a80e9b","source":"wordfence","cve":"CVE-2025-12658","title":"Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9909373-48d7-425b-a20b-bb8bf2a80e9b?source=api-prod","affected":[{"type":"plugin","slug":"preload-current-images","name":"Preload Current Images","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:59:24Z","updated":"2025-11-11T03:30:48Z"},{"id":"wordfence:b9922431-fc88-4c3d-8193-4313588d0935","source":"wordfence","cve":"CVE-2026-42382","title":"Audrey <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9922431-fc88-4c3d-8193-4313588d0935?source=api-prod","affected":[{"type":"theme","slug":"audrey","name":"Audrey - Fashion WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-09T13:53:07Z"},{"id":"wordfence:b99248e9-b34f-4f99-9db1-a4dc2dd45b9c","source":"wordfence","cve":"CVE-2021-24528","title":"FluentSMTP <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b99248e9-b34f-4f99-9db1-a4dc2dd45b9c?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2021-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b992bdd4-7abf-436e-b123-aaedbf33cffc","source":"wordfence","cve":"CVE-2026-77695","title":"Return Refund and Exchange For WooCommerce < 4.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b992bdd4-7abf-436e-b123-aaedbf33cffc?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":false,"patched_in":"4.6.4"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:52:36Z"},{"id":"wordfence:b9942c7b-f51f-471d-ad80-5c658e177b21","source":"wordfence","cve":"CVE-2026-90989","title":"Tainacan < 1.4.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9942c7b-f51f-471d-ad80-5c658e177b21?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:40:22Z"},{"id":"wordfence:b994bb62-436f-4edc-8891-281483428ac0","source":"wordfence","cve":"CVE-2022-4117","title":"IWS - Geo Form Fields <= 1.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b994bb62-436f-4edc-8891-281483428ac0?source=api-prod","affected":[{"type":"plugin","slug":"iws-geo-form-fields","name":"IWS \u2013 Geo Form Fields","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b994f9ee-b59b-4bcd-9057-4cfbb5f22694","source":"wordfence","cve":"CVE-2024-56203","title":"Wayne Audio Player <= 1.0 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b994f9ee-b59b-4bcd-9057-4cfbb5f22694?source=api-prod","affected":[{"type":"plugin","slug":"wayne-audio-player","name":"Wayne Audio Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:27:42Z"},{"id":"wordfence:b9959526-9ca8-42c2-8486-32ce7a4a162c","source":"wordfence","cve":"CVE-2012-20003","title":"Custom Tables <= 3.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9959526-9ca8-42c2-8486-32ce7a4a162c?source=api-prod","affected":[{"type":"plugin","slug":"custom-tables","name":"custom-tables","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2026-10-23T17:59:46Z"},{"id":"wordfence:b9961347-7c47-4fa1-af35-609c39a6cd8b","source":"wordfence","cve":"CVE-2026-2295","title":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9961347-7c47-4fa1-af35-609c39a6cd8b?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-02-10T21:12:39Z","updated":"2026-02-11T09:27:19Z"},{"id":"wordfence:b9982ccd-e9b3-46e3-90ed-1ae6ff59bb62","source":"wordfence","cve":"CVE-2025-31545","title":"Safe Ai Malware Protection for WP <= 1.0.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9982ccd-e9b3-46e3-90ed-1ae6ff59bb62?source=api-prod","affected":[{"type":"plugin","slug":"safe-ai-malware-protection-for-wp","name":"Safe Ai Malware Protection for WP","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:16:20Z"},{"id":"wordfence:b9985992-e64c-4292-9738-cd38fb44a6f0","source":"wordfence","cve":"","title":"Dexs PM System <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9985992-e64c-4292-9738-cd38fb44a6f0?source=api-prod","affected":[{"type":"plugin","slug":"dexs-pm-system","name":"Dexs PM System","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2013-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b99ba627-1d24-4be1-a4db-ff39354526f2","source":"wordfence","cve":"CVE-2026-9734","title":"W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b99ba627-1d24-4be1-a4db-ff39354526f2?source=api-prod","affected":[{"type":"plugin","slug":"w3sc-elementor-to-zoho","name":"W3SC Elementor to Zoho CRM","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-17T16:13:50Z","updated":"2026-07-18T04:31:44Z"},{"id":"wordfence:b99e9fc4-a028-4616-9f6d-aad1972151b0","source":"wordfence","cve":"CVE-2025-26976","title":"Private Content  <= 8.11.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b99e9fc4-a028-4616-9f6d-aad1972151b0?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"Private Content","from":"*","from_inclusive":true,"to":"8.11.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:29:12Z"},{"id":"wordfence:b9a2d413-ac7d-4385-a429-2bfa7abe6777","source":"wordfence","cve":"CVE-2024-54351","title":"Fancy Roller Scroller <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a2d413-ac7d-4385-a429-2bfa7abe6777?source=api-prod","affected":[{"type":"plugin","slug":"fancy-roller-scroller","name":"Fancy Roller Scroller","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:27:44Z"},{"id":"wordfence:b9a4d8f9-7b25-4c31-8457-2cb45bd17150","source":"wordfence","cve":"CVE-2026-110251","title":"Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4d8f9-7b25-4c31-8457-2cb45bd17150?source=api-prod","affected":[{"type":"plugin","slug":"woo-photo-reviews","name":"Revopic \u2013 Photo Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.31","to_inclusive":true,"patched_in":"1.2.32"}],"published":"2026-10-30T18:17:17Z","updated":"2026-10-31T06:44:22Z"},{"id":"wordfence:b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe","source":"wordfence","cve":"CVE-2025-9948","title":"Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a4e0c1-7bbb-4ab0-948c-3d172717e5fe?source=api-prod","affected":[{"type":"plugin","slug":"chatwee","name":"Chat by Chatwee","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:21:45Z","updated":"2025-09-30T03:35:30Z"},{"id":"wordfence:b9a603ee-183d-4130-8e03-12deb86466ce","source":"wordfence","cve":"CVE-2014-4556","title":"eShop Swipe plugin <= 3.7.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a603ee-183d-4130-8e03-12deb86466ce?source=api-prod","affected":[{"type":"plugin","slug":"swipe-hq-checkout-for-eshop","name":"swipe-hq-checkout-for-eshop","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9a73bcf-cd20-4081-83d4-4bcfe0482f59","source":"wordfence","cve":"CVE-2024-52424","title":"wp-login customizer <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9a73bcf-cd20-4081-83d4-4bcfe0482f59?source=api-prod","affected":[{"type":"plugin","slug":"wp-login-customizer","name":"wp-login customizer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:22:10Z"},{"id":"wordfence:b9aacc69-aa46-4cdb-a301-c0bf2836d441","source":"wordfence","cve":"CVE-2023-0769","title":"hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9aacc69-aa46-4cdb-a301-c0bf2836d441?source=api-prod","affected":[{"type":"plugin","slug":"hiweb-migration-simple","name":"hiWeb Migration Simple","from":"*","from_inclusive":true,"to":"2.0.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9b18739-67ed-4cb0-9577-eb60bc84bbeb","source":"wordfence","cve":"CVE-2025-9888","title":"Maspik <= 2.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b18739-67ed-4cb0-9577-eb60bc84bbeb?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-09-09T17:27:05Z","updated":"2025-09-10T06:38:52Z"},{"id":"wordfence:b9b21f8e-8d66-4d3e-a383-bea20a3c4498","source":"wordfence","cve":"CVE-2020-36723","title":"ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b21f8e-8d66-4d3e-a383-bea20a3c4498?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9b8b08d-821b-41dd-aab3-c9f3423e0cc1","source":"wordfence","cve":"CVE-2025-49905","title":"Range Slider Addon for Gravity Forms <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b8b08d-821b-41dd-aab3-c9f3423e0cc1?source=api-prod","affected":[{"type":"plugin","slug":"range-slider-addon-for-gravity-forms","name":"Range Slider Addon for Gravity Forms","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-03T18:09:06Z"},{"id":"wordfence:b9b92a1f-19d5-4aaa-b196-043f26e4614f","source":"wordfence","cve":"CVE-2025-62021","title":"Acknowledgify <= 1.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9b92a1f-19d5-4aaa-b196-043f26e4614f?source=api-prod","affected":[{"type":"plugin","slug":"acknowledgify","name":"Acknowledgify","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:15:58Z"},{"id":"wordfence:b9be3401-43c9-4a7f-bcb1-fd6c184dca67","source":"wordfence","cve":"CVE-2026-113499","title":"LiteSpeed Cache < 7.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9be3401-43c9-4a7f-bcb1-fd6c184dca67?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9.2","to_inclusive":false,"patched_in":"7.9.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:07:12Z"},{"id":"wordfence:b9c273a3-c8b5-4f00-8daa-76fa486df0f2","source":"wordfence","cve":"CVE-2023-5877","title":"affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9c273a3-c8b5-4f00-8daa-76fa486df0f2?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2023-12-11T00:00:00Z","updated":"2024-02-06T18:04:55Z"},{"id":"wordfence:b9c501a3-e092-453a-900f-60967b12c928","source":"wordfence","cve":"CVE-2024-39682","title":"Cooked \u2013 Recipe Management <= 1.7.15.4 - Authenticated (Contributor+) HTML Injection","severity":"medium","cvss":5.0,"cwe":"CWE-116","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9c501a3-e092-453a-900f-60967b12c928?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-07-17T00:00:00Z","updated":"2024-08-09T13:55:42Z"},{"id":"wordfence:b9cc0348-396e-4be1-92f5-851d20804ef5","source":"wordfence","cve":"CVE-2021-24962","title":"WordPress File Upload / WordPress File Upload Pro <= 4.16.2 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9cc0348-396e-4be1-92f5-851d20804ef5?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.16.2","to_inclusive":true,"patched_in":"4.16.3"},{"type":"plugin","slug":"wordpress-file-upload-pro","name":"WordPress File Upload Pro","from":"*","from_inclusive":true,"to":"4.16.2","to_inclusive":true,"patched_in":"4.16.3"}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9cf68a4-0c0c-4b1b-82da-1df8c6ebb30d","source":"wordfence","cve":"CVE-2025-47630","title":"Ajax Load More <= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9cf68a4-0c0c-4b1b-82da-1df8c6ebb30d?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.3.1.2","to_inclusive":true,"patched_in":"7.3.1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-16T14:28:39Z"},{"id":"wordfence:b9cf99e9-47fa-4ca0-8f6c-4b0e75d44008","source":"wordfence","cve":"CVE-2025-68508","title":"Brave <= 0.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9cf99e9-47fa-4ca0-8f6c-4b0e75d44008?source=api-prod","affected":[{"type":"plugin","slug":"brave-popup-builder","name":"Brave \u2013 Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content","from":"*","from_inclusive":true,"to":"0.8.3","to_inclusive":true,"patched_in":"0.8.4"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T21:51:41Z"},{"id":"wordfence:b9d11eb9-5e18-459f-a9d4-cccb1d593402","source":"wordfence","cve":"CVE-2026-18080","title":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d11eb9-5e18-459f-a9d4-cccb1d593402?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.8","to_inclusive":true,"patched_in":"1.17.9"}],"published":"2026-08-25T21:59:23Z","updated":"2026-08-26T11:05:44Z"},{"id":"wordfence:b9d161a3-eb9f-447f-b2d2-b8b193678d20","source":"wordfence","cve":"CVE-2023-49843","title":"First Order Discount Woocommerce <= 1.21 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d161a3-eb9f-447f-b2d2-b8b193678d20?source=api-prod","affected":[{"type":"plugin","slug":"first-order-discount-woocommerce","name":"First Order Discount Woocommerce","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2023-12-06T00:00:00Z","updated":"2024-02-01T23:30:37Z"},{"id":"wordfence:b9d288b8-a0de-493b-b677-3f9bf8211504","source":"wordfence","cve":"CVE-2026-24967","title":"Amelia <= 1.2.38 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d288b8-a0de-493b-b677-3f9bf8211504?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.38","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-01-11T00:00:00Z","updated":"2026-02-10T20:06:48Z"},{"id":"wordfence:b9d39796-ad51-4b52-af8a-f3334e6ca68d","source":"wordfence","cve":"CVE-2024-47382","title":"Page-list <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d39796-ad51-4b52-af8a-f3334e6ca68d?source=api-prod","affected":[{"type":"plugin","slug":"page-list","name":"Page-list","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:56:12Z"},{"id":"wordfence:b9d54437-8766-478f-8ab1-282ca8ca4dc4","source":"wordfence","cve":"CVE-2026-103372","title":"Payconiq <= 1.0.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d54437-8766-478f-8ab1-282ca8ca4dc4?source=api-prod","affected":[{"type":"plugin","slug":"wc-payconiq","name":"Payconiq","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:20:00Z"},{"id":"wordfence:b9d63462-04ec-4b46-91cf-25b7dd098fc7","source":"wordfence","cve":"CVE-2021-24725","title":"Comment Link Remove and Other Comment Tools <= 2.1.4 - Arbitrary Comment Deletion via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d63462-04ec-4b46-91cf-25b7dd098fc7?source=api-prod","affected":[{"type":"plugin","slug":"comment-link-remove","name":"Comment Link Remove and Other Comment Tools","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9d67773-518e-4293-8d5f-3df29d96730c","source":"wordfence","cve":"CVE-2025-23634","title":"Youtube Video Grid | Youmax <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d67773-518e-4293-8d5f-3df29d96730c?source=api-prod","affected":[{"type":"plugin","slug":"youmax-channel-embeds-for-youtube-businesses","name":"Youtube Video Grid | Youmax","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:48:44Z"},{"id":"wordfence:b9d77b08-3a4a-441b-8725-fd93744de73c","source":"wordfence","cve":"CVE-2024-12817","title":"Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d77b08-3a4a-441b-8725-fd93744de73c?source=api-prod","affected":[{"type":"plugin","slug":"etsy-importer","name":"Etsy Importer","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:41:40Z","updated":"2025-01-25T07:24:18Z"},{"id":"wordfence:b9d96ebe-fc20-4b0e-bba2-4853459cf74e","source":"wordfence","cve":"CVE-2024-37214","title":"Ali2Woo Lite <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d96ebe-fc20-4b0e-bba2-4853459cf74e?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2024-06-20T00:00:00Z","updated":"2024-08-01T20:27:05Z"},{"id":"wordfence:b9d9d05f-0de7-473f-ae33-a97967c6fcf7","source":"wordfence","cve":"CVE-2024-49287","title":"PDF-Rechnungsverwaltung <= 0.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d9d05f-0de7-473f-ae33-a97967c6fcf7?source=api-prod","affected":[{"type":"plugin","slug":"pdf-rechnungsverwaltung","name":"PDF-Rechnungsverwaltung","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T18:06:40Z"},{"id":"wordfence:b9da31ff-4173-4aee-a3a6-8eebaa0d71ab","source":"wordfence","cve":"CVE-2023-0152","title":"WP Multi Store Locator <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9da31ff-4173-4aee-a3a6-8eebaa0d71ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator","name":"WP Multistore Locator \u2014 WP Store Locator Plugin: Effortless Integration With Snazzy Maps","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-05-12T00:00:00Z","updated":"2025-02-14T22:38:24Z"},{"id":"wordfence:b9db221b-facd-4808-b5d0-3e26b509def1","source":"wordfence","cve":"CVE-2025-52746","title":"Restaurante <= 3.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9db221b-facd-4808-b5d0-3e26b509def1?source=api-prod","affected":[{"type":"theme","slug":"restaurante","name":"Restaurante","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-08-10T02:02:04Z","updated":"2026-02-02T20:57:11Z"},{"id":"wordfence:b9de8d95-4e07-4c52-912b-1a4e2d7e5ed0","source":"wordfence","cve":"CVE-2023-32296","title":"Kangu para WooCommerce <= 2.2.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9de8d95-4e07-4c52-912b-1a4e2d7e5ed0?source=api-prod","affected":[{"type":"plugin","slug":"kangu","name":"Kangu para WooCommerce","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9dfdc04-fb43-42a9-8ced-25ea0623e657","source":"wordfence","cve":"CVE-2026-102379","title":"BuildKit \u2013 Product Builder for WooCommerce \u2013 Custom PC Builder <= 1.0.28 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9dfdc04-fb43-42a9-8ced-25ea0623e657?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-builder","name":"BuildKit \u2013 Product Builder for WooCommerce \u2013 Custom PC Builder","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2026-10-01T12:33:00Z","updated":"2026-10-08T23:11:07Z"},{"id":"wordfence:b9e0e5bd-d87e-48bd-8ee2-9c1cf63632c6","source":"wordfence","cve":"CVE-2025-32190","title":"Musician's Pack for Elementor <= 1.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e0e5bd-d87e-48bd-8ee2-9c1cf63632c6?source=api-prod","affected":[{"type":"plugin","slug":"music-pack-for-elementor","name":"Musician\u2019s Pack for Elementor \u2013 Music Website Widgets & Templates","from":"*","from_inclusive":true,"to":"1.8.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-25T14:53:40Z"},{"id":"wordfence:b9e25fd7-848d-4d33-9c49-72f4698856e2","source":"wordfence","cve":"CVE-2026-25460","title":"Ave Core <= 2.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e25fd7-848d-4d33-9c49-72f4698856e2?source=api-prod","affected":[{"type":"plugin","slug":"ave-core","name":"Ave Core","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:13:37Z"},{"id":"wordfence:b9e3e417-d8a8-4e32-99aa-650e0a25a415","source":"wordfence","cve":"CVE-2023-47229","title":"Download Top 25 Social Icons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e3e417-d8a8-4e32-99aa-650e0a25a415?source=api-prod","affected":[{"type":"plugin","slug":"top-25-social-icons","name":"Top 25 Social Icons","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9e4933a-ea03-4dcd-bbb1-b8e571191598","source":"wordfence","cve":"CVE-2026-15004","title":"FileBird \u2013 WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e4933a-ea03-4dcd-bbb1-b8e571191598?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2026-09-17T19:13:01Z","updated":"2026-09-18T07:40:03Z"},{"id":"wordfence:b9e499c4-e683-4587-b0ab-7f4ecde94e41","source":"wordfence","cve":"CVE-2025-7812","title":"Video Share VOD \u2013 Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e499c4-e683-4587-b0ab-7f4ecde94e41?source=api-prod","affected":[{"type":"plugin","slug":"video-share-vod","name":"Video Share VOD \u2013 Turnkey Video Site Builder Script","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T01:46:29Z"},{"id":"wordfence:b9e64c54-a78f-454a-a9ee-02f64b6ae83d","source":"wordfence","cve":"CVE-2025-10583","title":"WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery","severity":"low","cvss":3.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e64c54-a78f-454a-a9ee-02f64b6ae83d?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache-premium","name":"WP Fastest Cache Premium","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-12-11T19:17:52Z","updated":"2026-02-04T20:03:17Z"},{"id":"wordfence:b9e67e3e-188c-4ca9-b846-d318859aeaf8","source":"wordfence","cve":"CVE-2021-24145","title":"Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e67e3e-188c-4ca9-b846-d318859aeaf8?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2021-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9e844c1-38c1-4b3c-98a4-71d87ca6293b","source":"wordfence","cve":"CVE-2013-4454","title":"Portable phpMyAdmin <= 1.4.1 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e844c1-38c1-4b3c-98a4-71d87ca6293b?source=api-prod","affected":[{"type":"plugin","slug":"portable-phpmyadmin","name":"Portable phpMyAdmin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9e998fd-aae7-4e1e-8134-a28670a4704b","source":"wordfence","cve":"CVE-2022-3983","title":"Checkout for PayPal <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e998fd-aae7-4e1e-8134-a28670a4704b?source=api-prod","affected":[{"type":"plugin","slug":"checkout-for-paypal","name":"Checkout for PayPal","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9ea24b5-ef7d-4bd5-bddb-46082a4a0763","source":"wordfence","cve":"CVE-2022-42461","title":"miniOrange's Google Authenticator <= 5.6.1 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ea24b5-ef7d-4bd5-bddb-46082a4a0763?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9ead8f1-f2d7-4087-bb6c-de15bf8318a3","source":"wordfence","cve":"CVE-2018-1000506","title":"Metronet Tag Manager < 1.2.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ead8f1-f2d7-4087-bb6c-de15bf8318a3?source=api-prod","affected":[{"type":"plugin","slug":"metronet-tag-manager","name":"Metronet Tag Manager","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2018-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9ebeb96-2f39-488e-aef6-d5af0a37c24a","source":"wordfence","cve":"CVE-2024-12409","title":"Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ebeb96-2f39-488e-aef6-d5af0a37c24a?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.10.11","to_inclusive":true,"patched_in":"6.10.12"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T11:10:21Z"},{"id":"wordfence:b9ed7e26-34f0-4e5d-b560-03b1de9c5c95","source":"wordfence","cve":"CVE-2019-7412","title":"PS PHPCaptcha <= 1.1.0 - Authenticated Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ed7e26-34f0-4e5d-b560-03b1de9c5c95?source=api-prod","affected":[{"type":"plugin","slug":"ps-phpcaptcha","name":"PS PHPCaptcha WP","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2019-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9edcbdc-5b01-4880-95ec-57d87ccbb472","source":"wordfence","cve":"CVE-2025-5812","title":"VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9edcbdc-5b01-4880-95ec-57d87ccbb472?source=api-prod","affected":[{"type":"plugin","slug":"vgw-metis","name":"VG WORT METIS","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-06-25T14:05:47Z","updated":"2025-07-28T20:21:58Z"},{"id":"wordfence:b9ef344d-cd56-43f9-b185-de83a92800de","source":"wordfence","cve":"CVE-2024-7624","title":"Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ef344d-cd56-43f9-b185-de83a92800de?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.101","to_inclusive":true,"patched_in":"3.3.102"}],"published":"2024-08-14T00:00:00Z","updated":"2024-08-15T02:30:37Z"},{"id":"wordfence:b9ef419c-3546-489b-b841-b12b8918abdd","source":"wordfence","cve":"CVE-2022-3237","title":"WP Contact Slider <= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ef419c-3546-489b-b841-b12b8918abdd?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-slider","name":"WP Contact Slider \u2013 Contact Form Slider Widget","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9f199a1-2f45-43c3-b457-ff57032f7ab6","source":"wordfence","cve":"CVE-2026-118407","title":"Premium Packages \u2013 Sell Digital Products Securely < 7.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f199a1-2f45-43c3-b457-ff57032f7ab6?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":false,"patched_in":"7.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:33:58Z"},{"id":"wordfence:b9f2be74-fedd-4844-95a4-a84318489e58","source":"wordfence","cve":"CVE-2026-32425","title":"Payment Gateway Pix For GiveWP <= 2.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f2be74-fedd-4844-95a4-a84318489e58?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-pix-for-givewp","name":"Payment Gateway Pix For GiveWP","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-02-28T00:00:00Z","updated":"2026-04-15T21:17:36Z"},{"id":"wordfence:b9f34195-fc03-4c3d-b25e-c9b9cf8ded3c","source":"wordfence","cve":"CVE-2024-2801","title":"Shopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f34195-fc03-4c3d-b25e-c9b9cf8ded3c?source=api-prod","affected":[{"type":"plugin","slug":"shopkeeper-extender","name":"Shopkeeper Extender","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2024-04-11T00:00:00Z","updated":"2024-08-01T17:37:44Z"},{"id":"wordfence:b9f5b68f-bf81-4157-920a-f14eb29390a6","source":"wordfence","cve":"","title":"Multiple Domain <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f5b68f-bf81-4157-920a-f14eb29390a6?source=api-prod","affected":[{"type":"plugin","slug":"multiple-domain","name":"Multiple Domain","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2020-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:b9f627f0-779c-4d57-a471-ce742e3a5dd5","source":"wordfence","cve":"CVE-2024-33594","title":"Leaky Paywall <= 4.20.8 - Missing Authorization to Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f627f0-779c-4d57-a471-ce742e3a5dd5?source=api-prod","affected":[{"type":"plugin","slug":"leaky-paywall","name":"Leaky Paywall","from":"*","from_inclusive":true,"to":"4.20.8","to_inclusive":true,"patched_in":"4.20.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:53:40Z"},{"id":"wordfence:b9f75a13-76be-45b5-8ec3-a89cbb6e0256","source":"wordfence","cve":"CVE-2026-77826","title":"RegistrationMagic <= 6.0.9.8 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f75a13-76be-45b5-8ec3-a89cbb6e0256?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.8","to_inclusive":true,"patched_in":"6.0.9.9"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-16T16:02:49Z"},{"id":"wordfence:b9f8c600-d62d-4f27-ba73-1a77a63859bc","source":"wordfence","cve":"CVE-2025-1043","title":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f8c600-d62d-4f27-ba73-1a77a63859bc?source=api-prod","affected":[{"type":"plugin","slug":"embed-any-document","name":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T11:10:29Z"},{"id":"wordfence:b9f99b51-e1b1-4cd3-a9f7-24e4b59811a7","source":"wordfence","cve":"CVE-2024-8252","title":"Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9f99b51-e1b1-4cd3-a9f7-24e4b59811a7?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.14.5","to_inclusive":true,"patched_in":"1.14.6"}],"published":"2024-08-29T21:08:00Z","updated":"2024-08-30T09:29:50Z"},{"id":"wordfence:b9fa5c83-3701-4017-97c1-75f57e762c4e","source":"wordfence","cve":"CVE-2025-52737","title":"Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9fa5c83-3701-4017-97c1-75f57e762c4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-store-locator","name":"WP Store Locator","from":"*","from_inclusive":true,"to":"2.2.260","to_inclusive":true,"patched_in":"2.2.261"}],"published":"2025-07-31T00:00:00Z","updated":"2025-11-04T16:10:44Z"},{"id":"wordfence:b9ffb0ac-84cf-4a82-b89b-05e43608db52","source":"wordfence","cve":"CVE-2019-9573","title":"WP Human Resource Management Plugin < 2.2.6 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ffb0ac-84cf-4a82-b89b-05e43608db52?source=api-prod","affected":[{"type":"plugin","slug":"hrm","name":"WP Human Resource Management","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":false,"patched_in":"2.2.6"}],"published":"2019-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba027271-b7f9-4bdb-a62b-801fd07f28fd","source":"wordfence","cve":"CVE-2021-24978","title":"OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba027271-b7f9-4bdb-a62b-801fd07f28fd?source=api-prod","affected":[{"type":"plugin","slug":"osmapper","name":"OSMapper","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba035b43-7459-47a9-bbc4-981cc847bd7a","source":"wordfence","cve":"CVE-2024-5626","title":"Inline Related Posts <= 3.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba035b43-7459-47a9-bbc4-981cc847bd7a?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-06-21T00:00:00Z","updated":"2024-07-02T15:04:32Z"},{"id":"wordfence:ba03ee30-6da7-42fc-9cc9-2408bfbb09ce","source":"wordfence","cve":"CVE-2023-28692","title":"WP Abstracts <= 2.6.2  - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba03ee30-6da7-42fc-9cc9-2408bfbb09ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba06e298-308d-4378-96b8-5ac4e7cc63c0","source":"wordfence","cve":"CVE-2024-6020","title":"Sign-up Sheets <= 2.2.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba06e298-308d-4378-96b8-5ac4e7cc63c0?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2024-08-13T00:00:00Z","updated":"2024-09-12T15:09:29Z"},{"id":"wordfence:ba08695e-009e-434a-9db0-06aa1dd6d57a","source":"wordfence","cve":"CVE-2024-24841","title":"Add Customer for WooCommerce <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba08695e-009e-434a-9db0-06aa1dd6d57a?source=api-prod","affected":[{"type":"plugin","slug":"add-customer-for-woocommerce","name":"Add Customer for WooCommerce","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-05T20:37:33Z"},{"id":"wordfence:ba08dbad-15f9-43cf-b0d7-a2a4604cb4af","source":"wordfence","cve":"CVE-2024-7388","title":"WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba08dbad-15f9-43cf-b0d7-a2a4604cb4af?source=api-prod","affected":[{"type":"plugin","slug":"wp-bannerize-pro","name":"WP Bannerize Pro","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-13T01:59:27Z"},{"id":"wordfence:ba0a1b59-90c2-4bdd-9594-5866df96cfb8","source":"wordfence","cve":"CVE-2024-56013","title":"Wovax IDX <= 1.2.2 - Missing Authorization to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba0a1b59-90c2-4bdd-9594-5866df96cfb8?source=api-prod","affected":[{"type":"plugin","slug":"wovax-idx","name":"Wovax IDX","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:06:38Z"},{"id":"wordfence:ba0de040-5906-4a67-9306-7e6e65cca78f","source":"wordfence","cve":"CVE-2015-7683","title":"Font <= 7.5 - Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba0de040-5906-4a67-9306-7e6e65cca78f?source=api-prod","affected":[{"type":"plugin","slug":"font","name":"Font \u2013 official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.5.1"}],"published":"2015-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba0efad3-1364-4b71-9d4d-522cb6381dfd","source":"wordfence","cve":"CVE-2024-54421","title":"Floating Video Player <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba0efad3-1364-4b71-9d4d-522cb6381dfd?source=api-prod","affected":[{"type":"plugin","slug":"floating-player","name":"Floating Video Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:28:45Z"},{"id":"wordfence:ba0f166f-87ef-4b5d-ada4-16529d93e10f","source":"wordfence","cve":"CVE-2024-13328","title":"Giga Messenger \u2013 Express <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba0f166f-87ef-4b5d-ada4-16529d93e10f?source=api-prod","affected":[{"type":"plugin","slug":"giga-messenger-bots","name":"Giga Messenger \u2013 Express","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:16:49Z"},{"id":"wordfence:ba0fdd81-767a-4858-acdb-e60fd5e15aab","source":"wordfence","cve":"","title":"Active Directory Integration <= 1.1.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba0fdd81-767a-4858-acdb-e60fd5e15aab?source=api-prod","affected":[{"type":"plugin","slug":"active-directory-integration","name":"Active Directory Integration","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2017-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba1004c7-52f4-4fea-b820-dd11b2264e15","source":"wordfence","cve":"","title":"MoneyTheme (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba1004c7-52f4-4fea-b820-dd11b2264e15?source=api-prod","affected":[{"type":"theme","slug":"moneytheme","name":"MoneyTheme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba111255-3b91-4ef6-8d57-10ff08363c48","source":"wordfence","cve":"CVE-2026-39489","title":"Download Monitor <= 5.1.9 - Authenticated (Author+) Arbitrary File Download","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba111255-3b91-4ef6-8d57-10ff08363c48?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":"5.1.10"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:38:28Z"},{"id":"wordfence:ba16b100-6ee7-46ec-8868-4467a29048ad","source":"wordfence","cve":"CVE-2018-16175","title":"LearnPress <= 3.0.12 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba16b100-6ee7-46ec-8868-4467a29048ad?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2018-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba18bd0c-ba6c-4f98-ac29-660a79affa6c","source":"wordfence","cve":"CVE-2023-52215","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba18bd0c-ba6c-4f98-ac29-660a79affa6c?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba1a25e9-bac3-4f76-8324-3035be94da4c","source":"wordfence","cve":"CVE-2020-11514","title":"Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba1a25e9-bac3-4f76-8324-3035be94da4c?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":false,"patched_in":"1.0.41"}],"published":"2020-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba20a30c-7dd2-4cb7-b055-9a105461f7d1","source":"wordfence","cve":"CVE-2022-0779","title":"User Meta \u2013 User Profile Builder and User management plugin <= 2.4.3 - Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba20a30c-7dd2-4cb7-b055-9a105461f7d1?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba22205d-5c09-4901-ba8b-0ffe2f4a09e0","source":"wordfence","cve":"CVE-2025-58649","title":"All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba22205d-5c09-4901-ba8b-0ffe2f4a09e0?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.8.7.1","to_inclusive":true,"patched_in":"4.8.7.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T16:51:07Z"},{"id":"wordfence:ba236f86-0434-4030-8e14-4db3919226eb","source":"wordfence","cve":"CVE-2026-76579","title":"LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba236f86-0434-4030-8e14-4db3919226eb?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.9","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2026-09-18T19:46:10Z","updated":"2026-09-19T08:27:23Z"},{"id":"wordfence:ba240854-3246-4c79-91fb-7c8a61ef3c84","source":"wordfence","cve":"CVE-2026-94176","title":"Mang Board <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba240854-3246-4c79-91fb-7c8a61ef3c84?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-09-23T11:39:36Z","updated":"2026-09-29T20:05:14Z"},{"id":"wordfence:ba2515d9-ced0-4b49-87c4-04c8391c2608","source":"wordfence","cve":"CVE-2023-3947","title":"Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure","severity":"low","cvss":3.7,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2515d9-ced0-4b49-87c4-04c8391c2608?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba2623b6-69b4-4596-a1af-cf37083706e8","source":"wordfence","cve":"CVE-2025-68578","title":"Addonify <= 2.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2623b6-69b4-4596-a1af-cf37083706e8?source=api-prod","affected":[{"type":"plugin","slug":"addonify-quick-view","name":"Addonify \u2013 Quick View For WooCommerce","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-12-22T00:00:00Z","updated":"2026-02-16T22:08:15Z"},{"id":"wordfence:ba27d52e-e43a-4f03-ad99-632c18279413","source":"wordfence","cve":"CVE-2022-36422","title":"WP-PostRatings <= 1.89 - Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba27d52e-e43a-4f03-ad99-632c18279413?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings","name":"WP-PostRatings","from":"*","from_inclusive":true,"to":"1.89","to_inclusive":true,"patched_in":"1.90"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba2b384e-e938-4d3d-84f1-6449a3b168e3","source":"wordfence","cve":"CVE-2026-93548","title":"FooSales <= 1.43.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2b384e-e938-4d3d-84f1-6449a3b168e3?source=api-prod","affected":[{"type":"plugin","slug":"foosales","name":"FooSales \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"1.43.2","to_inclusive":true,"patched_in":"1.43.3"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T14:25:04Z"},{"id":"wordfence:ba2ff1ab-f981-417d-b400-13750c9320ad","source":"wordfence","cve":"CVE-2024-32689","title":"WP Social Comments <= 1.7.3 - Missing Authorization via wpfc_allow_comments()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2ff1ab-f981-417d-b400-13750c9320ad?source=api-prod","affected":[{"type":"plugin","slug":"gs-facebook-comments","name":"Genial Comments","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T14:18:38Z"},{"id":"wordfence:ba311865-be4b-4c56-a761-409582e981b5","source":"wordfence","cve":"CVE-2024-13491","title":"Small Package Quotes \u2013 For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba311865-be4b-4c56-a761-409582e981b5?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-fedex-edition","name":"Small Package Quotes \u2013 For Customers of FedEx","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:41Z"},{"id":"wordfence:ba317acb-d45c-42c0-b5fb-b163bcd59340","source":"wordfence","cve":"CVE-2023-29096","title":"Contact Form to DB by BestWebSoft <= 1.7.0 - Authenticated (Contributor+) SQL Injection via cntctfrmtdb_department","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba317acb-d45c-42c0-b5fb-b163bcd59340?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba326241-46a3-4891-a180-d7977f4e83ed","source":"wordfence","cve":"CVE-2025-9085","title":"User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T02:24:17Z"},{"id":"wordfence:ba351515-d984-42da-9530-5e7afad3df29","source":"wordfence","cve":"CVE-2025-68583","title":"Fast User Switching <= 1.4.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba351515-d984-42da-9530-5e7afad3df29?source=api-prod","affected":[{"type":"plugin","slug":"fast-user-switching","name":"Fast User Switching","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-05T18:54:37Z"},{"id":"wordfence:ba385261-bee2-491d-9b31-a1624d740dff","source":"wordfence","cve":"CVE-2022-4295","title":"Show All Comments <= 7.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba385261-bee2-491d-9b31-a1624d740dff?source=api-prod","affected":[{"type":"plugin","slug":"show-all-comments-in-one-page","name":"Show All Comments","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba3d59a1-d0f6-4fe8-bf79-35b35b2a2fee","source":"wordfence","cve":"CVE-2026-59528","title":"ShipTime: Discount Shipping <= 1.1.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba3d59a1-d0f6-4fe8-bf79-35b35b2a2fee?source=api-prod","affected":[{"type":"plugin","slug":"shiptime-discount-shipping","name":"ShipTime: Discount Shipping","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:06:21Z"},{"id":"wordfence:ba40115a-4a77-4b71-8f76-734e8db90d1b","source":"wordfence","cve":"CVE-2026-80072","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Unauthenticated Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba40115a-4a77-4b71-8f76-734e8db90d1b?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":false,"patched_in":"5.2.8"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-16T14:33:53Z"},{"id":"wordfence:ba4180a5-90b9-4e8b-8b2f-5debc46b67e2","source":"wordfence","cve":"CVE-2024-51710","title":"Responsive Data Table <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4180a5-90b9-4e8b-8b2f-5debc46b67e2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-data-table","name":"Responsive Data Table","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:30:36Z"},{"id":"wordfence:ba426d2f-aa05-4316-86ca-228f21785f63","source":"wordfence","cve":"CVE-2017-18558","title":"Testimonials by BestWebSoft <= 0.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba426d2f-aa05-4316-86ca-228f21785f63?source=api-prod","affected":[{"type":"plugin","slug":"bws-testimonials","name":"Testimonials by BestWebSoft","from":"*","from_inclusive":true,"to":"0.1.8","to_inclusive":true,"patched_in":"0.1.9"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba435b26-a6f1-41cf-acb8-fffd8a18fea7","source":"wordfence","cve":"CVE-2024-8800","title":"RabbitLoader \u2013 Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more <= 2.21.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba435b26-a6f1-41cf-acb8-fffd8a18fea7?source=api-prod","affected":[{"type":"plugin","slug":"rabbit-loader","name":"RabbitLoader","from":"*","from_inclusive":true,"to":"2.21.0","to_inclusive":true,"patched_in":"2.21.1"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T07:35:30Z"},{"id":"wordfence:ba44ec7c-7c71-4c19-8b1e-5d78bb3a3a03","source":"wordfence","cve":"CVE-2022-0186","title":"Image Photo Gallery Final Tiles Grid <= 3.5.2 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba44ec7c-7c71-4c19-8b1e-5d78bb3a3a03?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba4638be-29d3-4638-84d3-6a9d540bfa33","source":"wordfence","cve":"CVE-2023-35097","title":"WP Affiliate Links <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4638be-29d3-4638-84d3-6a9d540bfa33?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-links","name":"WP Affiliate Links","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba465ba0-70c2-4b34-9b55-96725e3ce5a4","source":"wordfence","cve":"CVE-2024-49284","title":"WP SendFox <= 1.3.1 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba465ba0-70c2-4b34-9b55-96725e3ce5a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-sendfox","name":"WP SendFox","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T18:10:35Z"},{"id":"wordfence:ba49bbf9-649b-456e-bab8-9f0f74bdbaee","source":"wordfence","cve":"CVE-2026-15451","title":"MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49bbf9-649b-456e-bab8-9f0f74bdbaee?source=api-prod","affected":[{"type":"plugin","slug":"memberpress-corporate","name":"MemberPress Corporate Accounts","from":"*","from_inclusive":true,"to":"1.5.39","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-12T12:30:04Z"},{"id":"wordfence:ba49d38d-2838-4b8c-98f9-37e0c7d8f060","source":"wordfence","cve":"CVE-2025-23508","title":"Extra Options \u2013 Favicons <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49d38d-2838-4b8c-98f9-37e0c7d8f060?source=api-prod","affected":[{"type":"plugin","slug":"extra-options-favicons","name":"Extra Options \u2013 Favicons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:14:38Z"},{"id":"wordfence:ba4aabcc-9db8-4385-90c2-58ed93df8f9d","source":"wordfence","cve":"CVE-2021-39202","title":"WordPress Core 5.8 beta -  Stored Cross-Site Scripting in Custom HTML Block","severity":"high","cvss":7.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4aabcc-9db8-4385-90c2-58ed93df8f9d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8 beta 1","from_inclusive":true,"to":"5.8 beta 2","to_inclusive":true,"patched_in":"5.8"}],"published":"2021-09-09T00:00:00Z","updated":"2024-02-12T15:01:38Z"},{"id":"wordfence:ba4ab6fc-340c-442b-9b8e-b5534fd9c3be","source":"wordfence","cve":"CVE-2023-0068","title":"Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4ab6fc-340c-442b-9b8e-b5534fd9c3be?source=api-prod","affected":[{"type":"plugin","slug":"product-gtin-ean-upc-isbn-for-woocommerce","name":"Product GTIN (EAN, UPC, ISBN) for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba4b58ad-97b3-482a-bf24-1fa85d6ef93d","source":"wordfence","cve":"CVE-2026-15001","title":"bLoyal: Loyalty & Promotions by bLoyal <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4b58ad-97b3-482a-bf24-1fa85d6ef93d?source=api-prod","affected":[{"type":"plugin","slug":"bloyal","name":"bLoyal: Loyalty & Promotions by bLoyal","from":"*","from_inclusive":true,"to":"3.1.611.78","to_inclusive":true,"patched_in":"3.1.611.90"}],"published":"2026-08-14T14:02:02Z","updated":"2026-09-18T18:49:25Z"},{"id":"wordfence:ba4da955-7651-42e5-aefa-72c70a7b1035","source":"wordfence","cve":"","title":"Strong Testimonials <= 2.51.2 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4da955-7651-42e5-aefa-72c70a7b1035?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"2.51.2","to_inclusive":true,"patched_in":"2.51.3"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba4e982d-b8ac-4407-97b0-c725b8f43bbd","source":"wordfence","cve":"CVE-2022-1832","title":"CaPa Protect <= 0.5.8.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba4e982d-b8ac-4407-97b0-c725b8f43bbd?source=api-prod","affected":[{"type":"plugin","slug":"capa","name":"CaPa Protect","from":"*","from_inclusive":true,"to":"0.5.8.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba502aac-13f7-40e2-9672-bf26a0fefef7","source":"wordfence","cve":"CVE-2024-33553","title":"XStore Core <= 5.3.8 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba502aac-13f7-40e2-9672-bf26a0fefef7?source=api-prod","affected":[{"type":"plugin","slug":"et-core-plugin","name":"XStore Core","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-28T12:45:23Z"},{"id":"wordfence:ba52c97e-9f2a-4e48-a133-79ed31cfbf3a","source":"wordfence","cve":"","title":"HC Custom WP-Admin URL <= 1.4 - Missing Authorization to Login URL Change","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba52c97e-9f2a-4e48-a133-79ed31cfbf3a?source=api-prod","affected":[{"type":"plugin","slug":"hc-custom-wp-admin-url","name":"HC Custom WP-Admin URL","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba534b5f-668e-4f4f-9bec-7cce9eb48b7a","source":"wordfence","cve":"CVE-2026-96820","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.3.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba534b5f-668e-4f4f-9bec-7cce9eb48b7a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:48:26Z"},{"id":"wordfence:ba5485be-7612-406d-870d-6827f6c7ea71","source":"wordfence","cve":"CVE-2024-30551","title":"Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5485be-7612-406d-870d-6827f6c7ea71?source=api-prod","affected":[{"type":"plugin","slug":"toast-stick-anything","name":"Sticky Anything","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:00:48Z"},{"id":"wordfence:ba551103-f373-40b0-831f-a1c59bb874ca","source":"wordfence","cve":"CVE-2022-2371","title":"YaySMTP \u2013 Simple WP SMTP Mail <= 2.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba551103-f373-40b0-831f-a1c59bb874ca?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba5656b9-615d-4764-974a-301d3dd748e8","source":"wordfence","cve":"CVE-2021-24752","title":"CatchThemes Plugins (Various Versions) - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5656b9-615d-4764-974a-301d3dd748e8?source=api-prod","affected":[{"type":"plugin","slug":"header-enhancement","name":"Header Enhancement","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"},{"type":"plugin","slug":"generate-child-theme","name":"Generate Child Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"},{"type":"plugin","slug":"catch-instagram-feed-gallery-widget","name":"Social Gallery and Widget","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"},{"type":"plugin","slug":"catch-import-export","name":"Catch Import Export","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"},{"type":"plugin","slug":"catch-under-construction","name":"Catch Under Construction","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"},{"type":"plugin","slug":"catch-duplicate-switcher","name":"Catch Duplicate Switcher","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"},{"type":"plugin","slug":"catch-ids","name":"Catch IDs","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"},{"type":"plugin","slug":"catch-sticky-menu","name":"Catch Sticky Menu","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"},{"type":"plugin","slug":"essential-widgets","name":"Essential Widgets","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"},{"type":"plugin","slug":"catch-infinite-scroll","name":"Catch Infinite Scroll","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"},{"type":"plugin","slug":"to-top","name":"To Top","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"},{"type":"plugin","slug":"catch-themes-demo-import","name":"Catch Themes Demo Import","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"},{"type":"plugin","slug":"catch-breadcrumb","name":"Catch Breadcrumb","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"},{"type":"plugin","slug":"essential-content-types","name":"Essential Content Types","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"},{"type":"plugin","slug":"catch-gallery","name":"Catch Gallery","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"},{"type":"plugin","slug":"catch-web-tools","name":"Catch Web Tools","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"},{"type":"plugin","slug":"catch-scroll-progress-bar","name":"Catch Scroll Progress Bar","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba56821e-7557-4bf8-b41f-b5240a1f5789","source":"wordfence","cve":"CVE-2025-48269","title":"WPAdverts <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba56821e-7557-4bf8-b41f-b5240a1f5789?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:54:35Z"},{"id":"wordfence:ba584e02-5242-4869-a452-21e6b8995bd8","source":"wordfence","cve":"CVE-2024-8623","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba584e02-5242-4869-a452-21e6b8995bd8?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.3","to_inclusive":true,"patched_in":"1.3.3.4"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T02:31:03Z"},{"id":"wordfence:ba5b7e1f-7479-47bd-99ed-3d57eb209464","source":"wordfence","cve":"CVE-2016-4833","title":"Nofollow Links <= 1.0.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5b7e1f-7479-47bd-99ed-3d57eb209464?source=api-prod","affected":[{"type":"plugin","slug":"nofollow-links","name":"Nofollow Links","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2016-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba5cca24-514b-4f8b-911f-8d138287fce2","source":"wordfence","cve":"CVE-2023-24414","title":"Robo Gallery Plugin <= 3.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5cca24-514b-4f8b-911f-8d138287fce2?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba5d1bd4-da0d-43f4-b28f-4a4a2702b3b0","source":"wordfence","cve":"","title":"Post, Registration and Profile Form Builder \u2013 FrontEnd Editor BuddyForms \u2013 Easy WordPress Forms <= 2.6.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5d1bd4-da0d-43f4-b28f-4a4a2702b3b0?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"}],"published":"2022-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba5e93a2-8f42-4747-86fa-297ba709be8f","source":"wordfence","cve":"CVE-2023-3410","title":"Bricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba5e93a2-8f42-4747-86fa-297ba709be8f?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-14T08:37:20Z"},{"id":"wordfence:ba60fb73-9056-4163-9874-f0f4af35f5b3","source":"wordfence","cve":"CVE-2019-14798","title":"Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion","severity":"medium","cvss":4.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba60fb73-9056-4163-9874-f0f4af35f5b3?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.24","to_inclusive":true,"patched_in":"1.5.25"}],"published":"2019-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba619587-21d2-48b2-984a-210b43b0d87b","source":"wordfence","cve":"CVE-2025-31448","title":"Simple Trackback Disabler <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba619587-21d2-48b2-984a-210b43b0d87b?source=api-prod","affected":[{"type":"plugin","slug":"simple-trackback-disabler","name":"Simple Trackback Disabler","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:11:48Z"},{"id":"wordfence:ba62b804-f101-4e29-8304-fb2b7dad333c","source":"wordfence","cve":"CVE-2026-1404","title":"Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2026-02-17T00:00:00Z","updated":"2026-05-12T14:39:48Z"},{"id":"wordfence:ba6312b9-1b66-4b4f-a78d-515fa4aab63b","source":"wordfence","cve":"CVE-2024-7351","title":"Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6312b9-1b66-4b4f-a78d-515fa4aab63b?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.12.3","to_inclusive":true,"patched_in":"2.12.4"}],"published":"2024-08-23T18:53:16Z","updated":"2024-08-24T07:33:44Z"},{"id":"wordfence:ba65d429-ca10-45e3-b2f2-9035fd972016","source":"wordfence","cve":"CVE-2026-97244","title":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba65d429-ca10-45e3-b2f2-9035fd972016?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2026-09-29T09:58:11Z","updated":"2026-10-09T00:12:29Z"},{"id":"wordfence:ba670636-4b83-4915-969e-f02b9786b7d5","source":"wordfence","cve":"CVE-2024-34763","title":"Builder for WooCommerce reviews shortcodes \u2013 ReviewShort <= 1.01.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba670636-4b83-4915-969e-f02b9786b7d5?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-reviews-shortcode","name":"Builder for WooCommerce product reviews shortcodes \u2013 ReviewShort","from":"*","from_inclusive":true,"to":"1.01.5","to_inclusive":true,"patched_in":"1.01.6"}],"published":"2024-05-16T00:00:00Z","updated":"2024-05-20T20:31:30Z"},{"id":"wordfence:ba677822-a588-484e-a0aa-a9eda2954d01","source":"wordfence","cve":"CVE-2018-1002006","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba677822-a588-484e-a0aa-a9eda2954d01?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba67cfbc-8bdf-4ca1-acee-0d1bb0348c60","source":"wordfence","cve":"CVE-2026-57762","title":"Simple URLs \u2013 Link Cloaking, Product Displays, and Affiliate Link Management <= 152 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba67cfbc-8bdf-4ca1-acee-0d1bb0348c60?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"152","to_inclusive":true,"patched_in":"153"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-15T18:16:58Z"},{"id":"wordfence:ba6b0143-429f-4c20-a3d4-622b58605ca1","source":"wordfence","cve":"CVE-2026-94663","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6b0143-429f-4c20-a3d4-622b58605ca1?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"6.0.0.2","to_inclusive":true,"patched_in":"6.0.0.3"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:48:56Z"},{"id":"wordfence:ba6d8be6-e7a6-4275-b5f1-86e2ea85ff76","source":"wordfence","cve":"CVE-2024-56283","title":"Locatoraid Store Locator <= 3.9.50 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6d8be6-e7a6-4275-b5f1-86e2ea85ff76?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.50","to_inclusive":true,"patched_in":"3.9.51"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:30:50Z"},{"id":"wordfence:ba6e0223-66d4-4fe7-8c15-6b37990a2f8a","source":"wordfence","cve":"CVE-2026-115821","title":"NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6e0223-66d4-4fe7-8c15-6b37990a2f8a?source=api-prod","affected":[{"type":"plugin","slug":"newsmanapp","name":"NewsmanApp","from":"*","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.32"}],"published":"2026-10-28T21:32:54Z","updated":"2026-10-29T11:27:16Z"},{"id":"wordfence:ba6e897e-8f6a-418a-98ec-7bb645aa2630","source":"wordfence","cve":"CVE-2025-23907","title":"SOCIAL.NINJA <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6e897e-8f6a-418a-98ec-7bb645aa2630?source=api-prod","affected":[{"type":"plugin","slug":"seo-meta","name":"SOCIAL.NINJA","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:15:46Z"},{"id":"wordfence:ba6f8837-813c-4e16-9adb-fdc90ccaf0ca","source":"wordfence","cve":"CVE-2024-53768","title":"Content Audit Exporter <= 1.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6f8837-813c-4e16-9adb-fdc90ccaf0ca?source=api-prod","affected":[{"type":"plugin","slug":"content-audit-exporter","name":"Content Audit Exporter","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-11-28T00:00:00Z","updated":"2026-11-03T22:43:14Z"},{"id":"wordfence:ba708a4f-d987-4d63-a218-2ed1c6daa010","source":"wordfence","cve":"CVE-2025-0952","title":"Eco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba708a4f-d987-4d63-a218-2ed1c6daa010?source=api-prod","affected":[{"type":"theme","slug":"eco-nature","name":"Eco Nature - Environment & Ecology WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T05:24:03Z"},{"id":"wordfence:ba70f811-543f-4da4-ba45-715dbd6be6be","source":"wordfence","cve":"CVE-2023-5979","title":"eCommerce Product Catalog for WordPress <= 3.3.25 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba70f811-543f-4da4-ba45-715dbd6be6be?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.26","to_inclusive":false,"patched_in":"3.3.26"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba747152-d6a0-4bf5-a321-ede24490594a","source":"wordfence","cve":"CVE-2025-62063","title":"WP Travel Gutenberg Blocks <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba747152-d6a0-4bf5-a321-ede24490594a?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-blocks","name":"WP Travel Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:49:04Z"},{"id":"wordfence:ba751f98-f86c-451b-8a12-a2e9e76768e5","source":"wordfence","cve":"CVE-2025-14785","title":"Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba751f98-f86c-451b-8a12-a2e9e76768e5?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.20.2","to_inclusive":true,"patched_in":"6.20.3"}],"published":"2026-07-07T23:10:49Z","updated":"2026-07-08T11:30:34Z"},{"id":"wordfence:ba779595-2674-4d84-bc41-889ae60bd6a4","source":"wordfence","cve":"CVE-2026-1127","title":"Timeline Event History <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba779595-2674-4d84-bc41-889ae60bd6a4?source=api-prod","affected":[{"type":"plugin","slug":"timeline-event-history","name":"Timeline Event History","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T20:32:22Z","updated":"2026-01-24T09:08:15Z"},{"id":"wordfence:ba796adc-db76-4b9d-a6f9-f0f51f070240","source":"wordfence","cve":"CVE-2024-9375","title":"WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba796adc-db76-4b9d-a6f9-f0f51f070240?source=api-prod","affected":[{"type":"plugin","slug":"captcha-bank","name":"WordPress Captcha Plugin by Captcha Bank","from":"*","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":""}],"published":"2024-10-03T13:32:16Z","updated":"2024-10-04T02:04:56Z"},{"id":"wordfence:ba798567-4a6e-4bbc-bd79-e1351af2ad4e","source":"wordfence","cve":"CVE-2025-49068","title":"Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba798567-4a6e-4bbc-bd79-e1351af2ad4e?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2025-06-02T00:00:00Z","updated":"2025-07-09T14:37:25Z"},{"id":"wordfence:ba79bf95-08f8-4aa6-968b-f76a09ce52b8","source":"wordfence","cve":"CVE-2024-6589","title":"LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba79bf95-08f8-4aa6-968b-f76a09ce52b8?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.8.2","to_inclusive":true,"patched_in":"4.2.6.9"}],"published":"2024-07-24T00:00:00Z","updated":"2024-07-25T10:59:51Z"},{"id":"wordfence:ba79c58c-2048-4759-a096-c0ce05003a2e","source":"wordfence","cve":"CVE-2025-26565","title":"GNUPress <= 0.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba79c58c-2048-4759-a096-c0ce05003a2e?source=api-prod","affected":[{"type":"plugin","slug":"gnupress","name":"GNUPress","from":"*","from_inclusive":true,"to":"0.2.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:14:11Z"},{"id":"wordfence:ba7ae7c1-a7af-4222-972e-4ca7cfebbb52","source":"wordfence","cve":"CVE-2026-18776","title":"TrueBooker \u2013 Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7ae7c1-a7af-4222-972e-4ca7cfebbb52?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:14:10Z"},{"id":"wordfence:ba7b8fe5-aa49-4a70-89c9-1b95a30b1142","source":"wordfence","cve":"CVE-2026-5428","title":"Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7b8fe5-aa49-4a70-89c9-1b95a30b1142?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-04-23T16:35:20Z","updated":"2026-08-14T19:07:46Z"},{"id":"wordfence:ba7d0ab4-55a5-47f4-b66e-27e963ab2268","source":"wordfence","cve":"CVE-2023-45008","title":"Comment Reply Email <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7d0ab4-55a5-47f4-b66e-27e963ab2268?source=api-prod","affected":[{"type":"plugin","slug":"comment-reply-email","name":"Comment Reply Email","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba7d527b-00cc-46b7-afc0-732362ba7953","source":"wordfence","cve":"CVE-2026-103084","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7d527b-00cc-46b7-afc0-732362ba7953?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.109","to_inclusive":true,"patched_in":"4.11.110"}],"published":"2026-10-05T08:49:00Z","updated":"2026-10-08T23:16:32Z"},{"id":"wordfence:ba7f7c7e-9779-4bd1-9412-dc0c81f4872c","source":"wordfence","cve":"CVE-2025-57898","title":"WP Frontend Admin <= 1.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7f7c7e-9779-4bd1-9412-dc0c81f4872c?source=api-prod","affected":[{"type":"plugin","slug":"display-admin-page-on-frontend","name":"WP Frontend Admin \u2013 Display WP Admin Pages in the Frontend","from":"*","from_inclusive":true,"to":"1.22.7","to_inclusive":true,"patched_in":"1.22.8"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T14:02:28Z"},{"id":"wordfence:ba7ff5b1-ef17-4bfb-9bed-e12c143b760d","source":"wordfence","cve":"CVE-2025-1436","title":"Limit Bio <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba7ff5b1-ef17-4bfb-9bed-e12c143b760d?source=api-prod","affected":[{"type":"plugin","slug":"limit-bio","name":"Limit Bio","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T21:59:37Z"},{"id":"wordfence:ba819703-e00b-484d-b26a-21a43073bdac","source":"wordfence","cve":"CVE-2026-112842","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba819703-e00b-484d-b26a-21a43073bdac?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-10-20T10:29:43Z","updated":"2026-10-23T18:52:53Z"},{"id":"wordfence:ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a","source":"wordfence","cve":"CVE-2024-6365","title":"Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba84711f-bdbe-46d3-a9a3-cc2b1dcefd1a?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-tables","name":"Product Table for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T03:33:07Z"},{"id":"wordfence:ba8625eb-b710-4dd5-b08f-d212e2fd9013","source":"wordfence","cve":"","title":"Gallery - Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8625eb-b710-4dd5-b08f-d212e2fd9013?source=api-prod","affected":[{"type":"plugin","slug":"gallery-video","name":"Gallery - Video Gallery and YouTube Gallery","from":"*","from_inclusive":true,"to":"1.7.01","to_inclusive":false,"patched_in":"1.7.02"}],"published":"2016-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba86268a-7bd6-40ed-9af6-29409245675d","source":"wordfence","cve":"CVE-2025-3880","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba86268a-7bd6-40ed-9af6-29409245675d?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.9.0","to_inclusive":true,"patched_in":"19.10.0"}],"published":"2025-06-16T00:00:00Z","updated":"2025-06-17T11:23:42Z"},{"id":"wordfence:ba8824a2-624d-47ab-9ffa-e485d0e60dd0","source":"wordfence","cve":"CVE-2026-22451","title":"Handyman <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8824a2-624d-47ab-9ffa-e485d0e60dd0?source=api-prod","affected":[{"type":"theme","slug":"handyman-services","name":"Handyman - Home Services Booking App, Website & Admin Panel","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:07:28Z"},{"id":"wordfence:ba886cec-7c0c-40dd-a6eb-bc770d571974","source":"wordfence","cve":"CVE-2026-39657","title":"leadlovers forms <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba886cec-7c0c-40dd-a6eb-bc770d571974?source=api-prod","affected":[{"type":"plugin","slug":"leadlovers-forms","name":"leadlovers forms","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-16T00:00:00Z","updated":"2026-04-15T21:24:28Z"},{"id":"wordfence:ba88964e-7487-4cd5-ab3e-bd33d14a61df","source":"wordfence","cve":"CVE-2023-5949","title":"Simple Social Media Share Buttons <= 3.8.2 - Unauthenticated Password Protected Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba88964e-7487-4cd5-ab3e-bd33d14a61df?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":false,"patched_in":"3.8.3"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba88a1f5-9ebf-4899-81b3-e65587ae2fe2","source":"wordfence","cve":"","title":"WP Statistics <= 13.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba88a1f5-9ebf-4899-81b3-e65587ae2fe2?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.0.9","to_inclusive":true,"patched_in":"13.1"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba8c5db5-48d4-4ce1-84b9-5743c7444a3a","source":"wordfence","cve":"CVE-2023-32965","title":"Jazz Popups <= 1.8.7 - Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8c5db5-48d4-4ce1-84b9-5743c7444a3a?source=api-prod","affected":[{"type":"plugin","slug":"jazz-popups","name":"Jazz Popups","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba8c88e9-e84c-4fe7-a3b1-ee77c49d5590","source":"wordfence","cve":"CVE-2024-8032","title":"Smooth Gallery Replacement <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8c88e9-e84c-4fe7-a3b1-ee77c49d5590?source=api-prod","affected":[{"type":"plugin","slug":"smooth-gallery-replacement","name":"Smooth Gallery Replacement","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-16T14:36:57Z"},{"id":"wordfence:ba8d377f-d216-40e4-97f2-ed3eac0ec33e","source":"wordfence","cve":"CVE-2017-14766","title":"Student Result or Employee Database <= 1.6.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8d377f-d216-40e4-97f2-ed3eac0ec33e?source=api-prod","affected":[{"type":"plugin","slug":"simple-student-result","name":"Student Result or Employee Database","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2017-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba8de7af-6167-4aa8-8222-481b04e6fcb2","source":"wordfence","cve":"CVE-2025-62048","title":"SmartCrawl <= 3.14.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba8de7af-6167-4aa8-8222-481b04e6fcb2?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.14.3","to_inclusive":true,"patched_in":"3.14.4"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:28:15Z"},{"id":"wordfence:ba965a6a-68ed-4383-93a7-593418df34a5","source":"wordfence","cve":"CVE-2024-11893","title":"Spoki \u2013 Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba965a6a-68ed-4383-93a7-593418df34a5?source=api-prod","affected":[{"type":"plugin","slug":"spoki","name":"Spoki \u2013 Chat Buttons and WooCommerce Notifications","from":"*","from_inclusive":true,"to":"2.15.15","to_inclusive":true,"patched_in":"2.15.16"}],"published":"2024-12-19T18:08:35Z","updated":"2025-01-10T14:02:04Z"},{"id":"wordfence:ba98a282-39ee-4a84-b988-ecfc0c4cd297","source":"wordfence","cve":"","title":"Brizy - Page Builder < 1.0.114 - Missing Authorization to Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba98a282-39ee-4a84-b988-ecfc0c4cd297?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"1.0.114","to_inclusive":false,"patched_in":"1.0.114"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ba998993-4e89-45f8-9598-fc1f8b88d147","source":"wordfence","cve":"CVE-2025-64356","title":"Insert PHP Code Snippet <= 1.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba998993-4e89-45f8-9598-fc1f8b88d147?source=api-prod","affected":[{"type":"plugin","slug":"insert-php-code-snippet","name":"Insert PHP Code Snippet","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-10-27T00:00:00Z","updated":"2025-11-04T14:41:00Z"},{"id":"wordfence:ba9a08b2-91ee-4bdc-8686-77f6c9f0131f","source":"wordfence","cve":"CVE-2026-75133","title":"Keep Backup Daily <= 2.1.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba9a08b2-91ee-4bdc-8686-77f6c9f0131f?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T15:59:56Z"},{"id":"wordfence:ba9b2d34-c1a3-47c2-9eee-51592faa8805","source":"wordfence","cve":"CVE-2025-49916","title":"MultiVendorX <= 4.2.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba9b2d34-c1a3-47c2-9eee-51592faa8805?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"4.2.24"}],"published":"2025-06-12T00:00:00Z","updated":"2025-11-04T16:28:32Z"},{"id":"wordfence:ba9d12c5-fe3a-4958-8d35-c63bb05b6d5a","source":"wordfence","cve":"CVE-2024-9888","title":"ElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ba9d12c5-fe3a-4958-8d35-c63bb05b6d5a?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T05:31:56Z"},{"id":"wordfence:baa063b7-8b79-4de3-84b1-6dec024fa395","source":"wordfence","cve":"","title":"Event Management Tickets Booking By Event Monster Plugin < 1.0.6 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa063b7-8b79-4de3-84b1-6dec024fa395?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2019-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baa15567-78cd-40ac-99ac-c1ad77914420","source":"wordfence","cve":"CVE-2025-53202","title":"Responsive Blocks <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa15567-78cd-40ac-99ac-c1ad77914420?source=api-prod","affected":[{"type":"plugin","slug":"responsive-block-editor-addons","name":"Responsive Blocks \u2013 Page Builder for Blocks & Patterns","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:39:57Z"},{"id":"wordfence:baa16b34-760f-4033-a9ee-e14b35e79542","source":"wordfence","cve":"CVE-2025-66078","title":"Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa16b34-760f-4033-a9ee-e14b35e79542?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2025-11-25T00:00:00Z","updated":"2025-12-20T19:55:07Z"},{"id":"wordfence:baa20290-9c01-4f8d-adeb-fbfb15b9d6a9","source":"wordfence","cve":"CVE-2024-5153","title":"Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa20290-9c01-4f8d-adeb-fbfb15b9d6a9?source=api-prod","affected":[{"type":"plugin","slug":"startklar-elmentor-forms-extwidgets","name":"Startklar Elementor Addons","from":"*","from_inclusive":true,"to":"1.7.15","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T15:40:56Z","updated":"2024-06-06T03:53:10Z"},{"id":"wordfence:baa720d6-1891-4557-a744-830be56862e9","source":"wordfence","cve":"","title":"WordPress Shortcodes Plugin \u2014 Shortcodes Ultimate <= 4.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa720d6-1891-4557-a744-830be56862e9?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2015-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baa766b7-25cb-471d-9b48-5671ec67099d","source":"wordfence","cve":"CVE-2026-39727","title":"WC Fields Factory <= 4.1.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa766b7-25cb-471d-9b48-5671ec67099d?source=api-prod","affected":[{"type":"plugin","slug":"wc-fields-factory","name":"WC Fields Factory","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T13:09:09Z","updated":"2026-10-08T23:24:05Z"},{"id":"wordfence:baa8b5ce-7ef8-4ca8-9957-2c3469f55dda","source":"wordfence","cve":"CVE-2023-47690","title":"Additional Order Filters for WooCommerce <= 1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa8b5ce-7ef8-4ca8-9957-2c3469f55dda?source=api-prod","affected":[{"type":"plugin","slug":"additional-order-filters-for-woocommerce","name":"Additional Order Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.12"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-24T00:51:17Z"},{"id":"wordfence:baa8e48f-769a-4f48-bc47-d55c179d1ca1","source":"wordfence","cve":"CVE-2023-41689","title":"Post to Google My Business <= 3.1.14 - Cross-Site Request Forgery to Dismiss Notification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa8e48f-769a-4f48-bc47-d55c179d1ca1?source=api-prod","affected":[{"type":"plugin","slug":"post-to-google-my-business","name":"Post to Google My Business (Google Business Profile)","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":false,"patched_in":"3.1.15"}],"published":"2023-07-24T00:00:00Z","updated":"2024-04-17T13:01:42Z"},{"id":"wordfence:baa92aee-a0a0-45d4-aa12-1449a829930c","source":"wordfence","cve":"CVE-2024-2623","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baa92aee-a0a0-45d4-aa12-1449a829930c?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"5.9.12"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:59:17Z"},{"id":"wordfence:baaa9688-dfdc-4ab2-b033-fe2b13a42e77","source":"wordfence","cve":"CVE-2026-74015","title":"Readabler < 2.0.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baaa9688-dfdc-4ab2-b033-fe2b13a42e77?source=api-prod","affected":[{"type":"plugin","slug":"readabler","name":"Readabler","from":"*","from_inclusive":true,"to":"2.0.18","to_inclusive":false,"patched_in":"2.0.18"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-01T13:24:10Z"},{"id":"wordfence:baab325d-58c2-446b-af70-6951eeef3bb1","source":"wordfence","cve":"CVE-2018-17866","title":"Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baab325d-58c2-446b-af70-6951eeef3bb1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.27","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2018-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baab579f-2d77-4dbe-979a-54956dfdcb77","source":"wordfence","cve":"CVE-2022-2840","title":"Zephyr Project Manager <= 3.2.42 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baab579f-2d77-4dbe-979a-54956dfdcb77?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"3.2.41","from_inclusive":true,"to":"3.2.41","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"3.2.42","from_inclusive":true,"to":"3.2.42","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2022-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baac847b-3c5e-44c4-bccf-fcbde1adf37f","source":"wordfence","cve":"CVE-2025-14132","title":"Category Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baac847b-3c5e-44c4-bccf-fcbde1adf37f?source=api-prod","affected":[{"type":"plugin","slug":"dropdown-category-list","name":"Category Dropdown List","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:32:30Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:baad17ba-4ea0-44d7-8665-91d7fc63678f","source":"wordfence","cve":"CVE-2025-22267","title":"Weaver Themes Shortcode Compatibility <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baad17ba-4ea0-44d7-8665-91d7fc63678f?source=api-prod","affected":[{"type":"plugin","slug":"weaver-themes-shortcode-compatibility","name":"Weaver Themes Shortcode Compatibility","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:37:59Z"},{"id":"wordfence:baae8fb9-b87c-4f61-88da-871c4c83615b","source":"wordfence","cve":"CVE-2024-8978","title":"Essential Addons for Elementor \u2013 Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":5.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baae8fb9-b87c-4f61-88da-871c4c83615b?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"6.0.10"}],"published":"2024-11-14T00:00:00Z","updated":"2024-11-15T09:29:39Z"},{"id":"wordfence:baafd001-144d-4ee4-b7e6-28c0931e6e10","source":"wordfence","cve":"CVE-2026-4248","title":"Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag","severity":"high","cvss":8.0,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baafd001-144d-4ee4-b7e6-28c0931e6e10?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":true,"patched_in":"2.11.3"}],"published":"2026-03-27T09:48:30Z","updated":"2026-03-27T22:26:22Z"},{"id":"wordfence:bab07bc7-d428-4ef9-91e8-4203fc8a32dd","source":"wordfence","cve":"CVE-2025-62065","title":"RTMKit <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bab07bc7-d428-4ef9-91e8-4203fc8a32dd?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-10-18T00:00:00Z","updated":"2025-10-29T15:49:31Z"},{"id":"wordfence:bab18ef7-69a8-4dc2-babf-07a390c1270c","source":"wordfence","cve":"CVE-2026-118165","title":"Firelight Lightbox <= 2.3.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bab18ef7-69a8-4dc2-babf-07a390c1270c?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.22","to_inclusive":true,"patched_in":"2.3.23"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:47:32Z"},{"id":"wordfence:bab22f2e-0998-4401-ae9f-45bdce658c4f","source":"wordfence","cve":"CVE-2024-13802","title":"Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bab22f2e-0998-4401-ae9f-45bdce658c4f?source=api-prod","affected":[{"type":"plugin","slug":"bandsintown","name":"Bandsintown Events","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-02-19T21:09:14Z","updated":"2025-03-10T14:17:43Z"},{"id":"wordfence:bab67a5c-3390-4423-8fa9-b5ffbc98324d","source":"wordfence","cve":"","title":"Ultimate Member <= 1.3.83 - Shortcode Injection","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bab67a5c-3390-4423-8fa9-b5ffbc98324d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.83","to_inclusive":true,"patched_in":"1.3.84"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bab68830-5ac5-4aa3-929a-ba2bca03b1ca","source":"wordfence","cve":"CVE-2024-3406","title":"WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Email Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bab68830-5ac5-4aa3-929a-ba2bca03b1ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T12:49:27Z"},{"id":"wordfence:babbe506-3abd-462a-b5b8-5979696eb6e6","source":"wordfence","cve":"CVE-2023-45603","title":"User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/babbe506-3abd-462a-b5b8-5979696eb6e6?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20230902","to_inclusive":true,"patched_in":"20230914"}],"published":"2023-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:babc2e50-27a5-413b-8611-0e9e9db33deb","source":"wordfence","cve":"CVE-2025-6539","title":"Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/babc2e50-27a5-413b-8611-0e9e9db33deb?source=api-prod","affected":[{"type":"plugin","slug":"voltax-video-player","name":"Minute Video","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:38:14Z","updated":"2025-07-24T09:22:20Z"},{"id":"wordfence:babcd8a8-c64d-4a71-b7ed-92ef497ef63d","source":"wordfence","cve":"CVE-2025-22329","title":"Free Google Maps <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/babcd8a8-c64d-4a71-b7ed-92ef497ef63d?source=api-prod","affected":[{"type":"plugin","slug":"wp-map","name":"Free Google Maps","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:04:18Z"},{"id":"wordfence:babf88c4-6328-4ba2-97e4-e1eaaa549dbb","source":"wordfence","cve":"CVE-2024-6569","title":"Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/babf88c4-6328-4ba2-97e4-e1eaaa549dbb?source=api-prod","affected":[{"type":"plugin","slug":"forms-for-campaign-monitor","name":"Campaign Monitor for WordPress","from":"*","from_inclusive":true,"to":"2.8.15","to_inclusive":true,"patched_in":"2.8.16"}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T08:36:22Z"},{"id":"wordfence:bac57319-3b0c-4b83-af9e-7b5539ef087a","source":"wordfence","cve":"CVE-2016-10960","title":"wSecure Lite < 2.4 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bac57319-3b0c-4b83-af9e-7b5539ef087a?source=api-prod","affected":[{"type":"plugin","slug":"wsecure","name":"wsecure lite","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2016-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bac8245c-292a-4b16-950f-fa3d06e41a09","source":"wordfence","cve":"CVE-2014-10388","title":"Support Plus Responsive Ticket System <= 4.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bac8245c-292a-4b16-950f-fa3d06e41a09?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2014-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bac8c35b-2afa-4347-b86e-2f16db19a4d3","source":"wordfence","cve":"CVE-2024-8943","title":"LatePoint <= 5.0.12 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bac8c35b-2afa-4347-b86e-2f16db19a4d3?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"LatePoint Plugin","from":"*","from_inclusive":true,"to":"5.0.12","to_inclusive":true,"patched_in":"5.0.13"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-08T08:33:19Z"},{"id":"wordfence:bac9b912-668b-4f0d-a9a4-6c0ae2e6818e","source":"wordfence","cve":"CVE-2024-55996","title":"Dreamfox Media Payment gateway per Product for Woocommerce <= 3.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bac9b912-668b-4f0d-a9a4-6c0ae2e6818e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-payments","name":"Dreamfoxmedia Payment Gateway per Product for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2024-12-14T00:00:00Z","updated":"2025-01-30T16:15:07Z"},{"id":"wordfence:baca279b-0c42-48a9-930a-8d0525066e0a","source":"wordfence","cve":"CVE-2026-17605","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baca279b-0c42-48a9-930a-8d0525066e0a?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.56","to_inclusive":true,"patched_in":"2.8.57"}],"published":"2026-07-31T19:44:03Z","updated":"2026-08-01T07:49:51Z"},{"id":"wordfence:bacc29c3-a1fc-4e75-a3e2-cd3d6aac9554","source":"wordfence","cve":"CVE-2021-24287","title":"Select All Categories and Taxonomies, Change Checkbox to Radio Buttons < 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bacc29c3-a1fc-4e75-a3e2-cd3d6aac9554?source=api-prod","affected":[{"type":"plugin","slug":"select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons","name":"Select All Categories and Taxonomies, Change Checkbox to Radio Buttons","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2021-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bacd7942-99f6-46e0-85ef-863ab1bdfa6a","source":"wordfence","cve":"CVE-2015-9234","title":"CP Contact Form with PayPal < 1.1.6 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bacd7942-99f6-46e0-85ef-863ab1bdfa6a?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"}],"published":"2015-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bacf8ad8-4de4-414c-b664-85cdf33074e0","source":"wordfence","cve":"CVE-2026-66650","title":"FreightCo \u2013 Free Transportation & Logistics WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bacf8ad8-4de4-414c-b664-85cdf33074e0?source=api-prod","affected":[{"type":"theme","slug":"freightco","name":"FreightCo \u2013 Free Transportation & Logistics WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:03:33Z"},{"id":"wordfence:bacfa993-2fc1-43bc-b4f0-f463ba28b4ed","source":"wordfence","cve":"CVE-2024-43345","title":"Landing Page Builder <= 1.5.2.0 - Authenticated (Editor+) Local File Inlcusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bacfa993-2fc1-43bc-b4f0-f463ba28b4ed?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.2.0","to_inclusive":true,"patched_in":"1.5.2.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:31:25Z"},{"id":"wordfence:bad00612-d98e-4b5e-88e8-664064588bdd","source":"wordfence","cve":"CVE-2024-29102","title":"Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad00612-d98e-4b5e-88e8-664064588bdd?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:39:03Z"},{"id":"wordfence:bad0bd6b-9c88-4d31-90b5-92d3ceb8c0af","source":"wordfence","cve":"CVE-2023-4637","title":"WPvivid <= 0.9.94 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0bd6b-9c88-4d31-90b5-92d3ceb8c0af?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.94","to_inclusive":true,"patched_in":"0.9.95"}],"published":"2024-01-19T00:00:00Z","updated":"2024-02-05T21:22:01Z"},{"id":"wordfence:bad0cd3f-88ea-4a1d-b400-0a450b07a546","source":"wordfence","cve":"CVE-2024-11036","title":"GamiPress \u2013 The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0cd3f-88ea-4a1d-b400-0a450b07a546?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.1.5","to_inclusive":true,"patched_in":"7.1.6"}],"published":"2024-11-18T22:31:51Z","updated":"2024-11-19T11:02:29Z"},{"id":"wordfence:bad56a95-abe5-464b-adc4-b2e5b82ac5ca","source":"wordfence","cve":"CVE-2026-108041","title":"SEOPress \u2013 AI SEO Plugin & On-site SEO < 10.4 - Authenticated (Custom Role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad56a95-abe5-464b-adc4-b2e5b82ac5ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.4","to_inclusive":false,"patched_in":"10.4"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:37:01Z"},{"id":"wordfence:bad5c03c-5f07-4fdc-b762-4dd6e3345d59","source":"wordfence","cve":"CVE-2025-62033","title":"Togo \u2013 Travel & Tour Booking WordPress Theme theme < 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad5c03c-5f07-4fdc-b762-4dd6e3345d59?source=api-prod","affected":[{"type":"theme","slug":"togo","name":"Togo \u2013 Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-23T14:44:49Z"},{"id":"wordfence:bad7e5c9-f413-43ce-9ab8-e700002f2f3a","source":"wordfence","cve":"CVE-2021-24883","title":"Popup Anything <= 2.0.3 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bad7e5c9-f413-43ce-9ab8-e700002f2f3a?source=api-prod","affected":[{"type":"plugin","slug":"popup-anything-on-click","name":"Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bada2872-aa45-41a7-aa52-c0be1c3f2b59","source":"wordfence","cve":"CVE-2025-39567","title":"Web Directory Free <= 1.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bada2872-aa45-41a7-aa52-c0be1c3f2b59?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:23:54Z"},{"id":"wordfence:bada73df-8dfb-4f88-a623-cf98173b25c8","source":"wordfence","cve":"CVE-2024-38682","title":"Post Layouts for Gutenberg <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bada73df-8dfb-4f88-a623-cf98173b25c8?source=api-prod","affected":[{"type":"plugin","slug":"post-layouts","name":"Post Layouts","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-07-10T00:00:00Z","updated":"2026-05-11T19:38:27Z"},{"id":"wordfence:bae06fa8-546c-4daf-8335-a5e24f6704d4","source":"wordfence","cve":"CVE-2013-2706","title":"Stream Video Player <= 1.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bae06fa8-546c-4daf-8335-a5e24f6704d4?source=api-prod","affected":[{"type":"plugin","slug":"stream-video-player","name":"Stream Video Player","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bae2bcb6-9d63-4d0b-a1b6-541d2888d110","source":"wordfence","cve":"CVE-2026-25386","title":"Ally <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bae2bcb6-9d63-4d0b-a1b6-541d2888d110?source=api-prod","affected":[{"type":"plugin","slug":"pojo-accessibility","name":"Web Accessibility (formally known as Ally) \u2013 WCAG Scanning, Guided Fixes, Usability Widget","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-02-19T00:00:00Z","updated":"2026-02-24T19:19:43Z"},{"id":"wordfence:bae36712-f400-4965-9885-de9f7fbfd9b1","source":"wordfence","cve":"CVE-2025-62871","title":"Just TinyMCE Custom Styles <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bae36712-f400-4965-9885-de9f7fbfd9b1?source=api-prod","affected":[{"type":"plugin","slug":"just-tinymce-styles","name":"Just TinyMCE Custom Styles","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-12T20:58:23Z"},{"id":"wordfence:bae5f22d-5085-4230-a7fc-5db85aa6fbdb","source":"wordfence","cve":"CVE-2024-9942","title":"WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bae5f22d-5085-4230-a7fc-5db85aa6fbdb?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.1.0","to_inclusive":true,"patched_in":"67.2.0"}],"published":"2024-11-22T19:12:49Z","updated":"2024-11-23T07:38:06Z"},{"id":"wordfence:bae67a68-4bd1-4b52-b3dd-af0eef014028","source":"wordfence","cve":"CVE-2023-1930","title":"WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bae67a68-4bd1-4b52-b3dd-af0eef014028?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baebd08b-1f40-4cb2-8158-c4421af68c06","source":"wordfence","cve":"CVE-2024-30561","title":"Appointment Calendar <= 2.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baebd08b-1f40-4cb2-8158-c4421af68c06?source=api-prod","affected":[{"type":"plugin","slug":"appointment-calendar","name":"Appointment Calendar","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:12:24Z"},{"id":"wordfence:baecb227-08c4-4de7-a725-db6639587f13","source":"wordfence","cve":"CVE-2022-46842","title":"JS Help Desk <= 2.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baecb227-08c4-4de7-a725-db6639587f13?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baee1462-9538-4fba-b3d8-d825d43597e7","source":"wordfence","cve":"CVE-2026-62002","title":"Meals & Wheels <= 1.1.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baee1462-9538-4fba-b3d8-d825d43597e7?source=api-prod","affected":[{"type":"theme","slug":"meals-wheels","name":"Meals & Wheels","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:39:01Z"},{"id":"wordfence:baee1bba-c531-4a6a-8e4d-5c44e3d7e84f","source":"wordfence","cve":"CVE-2026-25008","title":"Ninja Tables \u2013 Easy Data Table Builder <= 5.2.5 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baee1bba-c531-4a6a-8e4d-5c44e3d7e84f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-01-18T00:00:00Z","updated":"2026-05-04T15:24:37Z"},{"id":"wordfence:baee7e34-0ed0-4702-9ccc-94177b6284c3","source":"wordfence","cve":"CVE-2022-4460","title":"Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baee7e34-0ed0-4702-9ccc-94177b6284c3?source=api-prod","affected":[{"type":"plugin","slug":"codelights-shortcodes-and-widgets","name":"Sidebar Widgets by CodeLights","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baeefcc4-ecbe-4300-9b50-35ea7a0b64cd","source":"wordfence","cve":"CVE-2026-110227","title":"Restricted Site Access <= 7.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baeefcc4-ecbe-4300-9b50-35ea7a0b64cd?source=api-prod","affected":[{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:38:44Z"},{"id":"wordfence:baf12413-eb45-44c3-a6c9-f5a048d6500d","source":"wordfence","cve":"CVE-2025-3832","title":"FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baf12413-eb45-44c3-a6c9-f5a048d6500d?source=api-prod","affected":[{"type":"plugin","slug":"fusedesk","name":"FuseDesk","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.8"}],"published":"2025-04-23T19:47:53Z","updated":"2025-04-30T13:37:46Z"},{"id":"wordfence:baf138c1-44ab-4ebf-8963-4ce807a16f40","source":"wordfence","cve":"CVE-2024-54345","title":"Bicycleshop <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baf138c1-44ab-4ebf-8963-4ce807a16f40?source=api-prod","affected":[{"type":"theme","slug":"bicycleshop","name":"Bicycleshop","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:15:49Z"},{"id":"wordfence:baf2af6b-277e-4613-b066-1f2acda56602","source":"wordfence","cve":"CVE-2025-54698","title":"Classified Listing <= 5.0.0 - Authenticated (Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baf2af6b-277e-4613-b066-1f2acda56602?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:45:16Z"},{"id":"wordfence:baf54eb2-0b29-4718-a994-f722cefd7317","source":"wordfence","cve":"CVE-2023-33325","title":"Leyka <= 3.30.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baf54eb2-0b29-4718-a994-f722cefd7317?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.30.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:baf55ce7-8a33-426c-a6a4-158a95a13a5c","source":"wordfence","cve":"CVE-2026-4328","title":"Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baf55ce7-8a33-426c-a6a4-158a95a13a5c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-import","name":"Advanced Import","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-06-18T15:57:02Z","updated":"2026-06-19T04:31:33Z"},{"id":"wordfence:bafacfba-b5a0-44f2-bd43-6be58e936a99","source":"wordfence","cve":"CVE-2026-93624","title":"Music Player for WooCommerce <= 1.9.1 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bafacfba-b5a0-44f2-bd43-6be58e936a99?source=api-prod","affected":[{"type":"plugin","slug":"music-player-for-woocommerce","name":"Music Player for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-09-29T09:53:05Z","updated":"2026-10-09T00:04:16Z"},{"id":"wordfence:bafadafe-4aa5-4349-8a9c-89b21ada47ba","source":"wordfence","cve":"CVE-2021-39351","title":"WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection via id Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bafadafe-4aa5-4349-8a9c-89b21ada47ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-bannerize","name":"WP Bannerize","from":"2.0.0","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T20:14:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bafce0db-7663-4eb2-a5b2-884e5b74b7ec","source":"wordfence","cve":"CVE-2026-107791","title":"Comment Cleaner 6.1 - 7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bafce0db-7663-4eb2-a5b2-884e5b74b7ec?source=api-prod","affected":[{"type":"plugin","slug":"delete-all-comments-of-website","name":"WP Comment Cleaner \u2013 Delete All Comments, Disable Comments, Bulk Delete & Remove Comments","from":"6.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.2"}],"published":"2026-10-10T00:00:00Z","updated":"2026-10-13T13:46:20Z"},{"id":"wordfence:baff5795-f164-489e-8f57-536174867ec5","source":"wordfence","cve":"CVE-2025-68002","title":"Open User Map <= 1.4.16 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/baff5795-f164-489e-8f57-536174867ec5?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.4.17"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-25T15:49:45Z"},{"id":"wordfence:bb00eae9-645d-4827-b691-2408fd24aa75","source":"wordfence","cve":"CVE-2024-38770","title":"Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb00eae9-645d-4827-b691-2408fd24aa75?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.20","to_inclusive":true,"patched_in":"1.22.21"}],"published":"2024-07-13T00:00:00Z","updated":"2024-08-09T21:17:00Z"},{"id":"wordfence:bb02a55d-8d53-463d-ac29-94a69647b539","source":"wordfence","cve":"CVE-2025-49281","title":"Magways <= 1.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb02a55d-8d53-463d-ac29-94a69647b539?source=api-prod","affected":[{"type":"theme","slug":"magways","name":"Magways","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:54:16Z"},{"id":"wordfence:bb036338-abd7-4061-835d-038b765c68a6","source":"wordfence","cve":"CVE-2026-2899","title":"Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb036338-abd7-4061-835d-038b765c68a6?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.1.17","to_inclusive":true,"patched_in":"6.1.18"}],"published":"2026-03-04T14:34:39Z","updated":"2026-03-05T03:23:41Z"},{"id":"wordfence:bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf","source":"wordfence","cve":"CVE-2025-10001","title":"Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb03aeb8-32ab-4962-bc95-b10fb7bd7fcf?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-10T06:38:52Z"},{"id":"wordfence:bb0625ec-5ac9-4896-ac11-87fc9287f68a","source":"wordfence","cve":"CVE-2025-4522","title":"IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0625ec-5ac9-4896-ac11-87fc9287f68a?source=api-prod","affected":[{"type":"plugin","slug":"idonate","name":"IDonate \u2013 Blood Donation, Request And Donor Management System","from":"2.0.0","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2025-11-06T15:39:16Z","updated":"2025-11-07T04:28:55Z"},{"id":"wordfence:bb06d1ac-e436-40ec-8d3f-f336fcb3e3ec","source":"wordfence","cve":"CVE-2024-51824","title":"Advanced Video Player with Analytics <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb06d1ac-e436-40ec-8d3f-f336fcb3e3ec?source=api-prod","affected":[{"type":"plugin","slug":"advanced-video-player-with-analytics","name":"Advanced Video Player with Analytics","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:34:26Z"},{"id":"wordfence:bb0888d6-30e6-4957-b270-1968eace462e","source":"wordfence","cve":"CVE-2024-1393","title":"Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0888d6-30e6-4957-b270-1968eace462e?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.12","to_inclusive":true,"patched_in":"1.13"}],"published":"2024-02-21T00:00:00Z","updated":"2024-03-13T15:27:12Z"},{"id":"wordfence:bb0dca75-af56-404f-856c-41edd76b72a1","source":"wordfence","cve":"CVE-2024-44026","title":"Charity Addon for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0dca75-af56-404f-856c-41edd76b72a1?source=api-prod","affected":[{"type":"plugin","slug":"charity-addon-for-elementor","name":"Charity Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-25T17:43:59Z"},{"id":"wordfence:bb0e77e1-7e9f-4f7e-8953-c86ab0e5ae7a","source":"wordfence","cve":"CVE-2026-0844","title":"Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0e77e1-7e9f-4f7e-8953-c86ab0e5ae7a?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.8"}],"published":"2026-01-27T21:50:50Z","updated":"2026-05-19T14:55:53Z"},{"id":"wordfence:bb0e99c7-003a-4795-8acb-e6dafca34b8c","source":"wordfence","cve":"","title":"CO2ok: carbon offsetting for e-commerce <= 1.0.9.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0e99c7-003a-4795-8acb-e6dafca34b8c?source=api-prod","affected":[{"type":"plugin","slug":"co2ok-for-woocommerce","name":"ClimateClick: Climate Action for all","from":"*","from_inclusive":true,"to":"1.0.9.21","to_inclusive":true,"patched_in":"1.0.9.22"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb0f8a0c-d02f-46e2-8808-3ffada105d13","source":"wordfence","cve":"CVE-2023-23726","title":"Tickera <= 3.5.1.0 - Cross-Site Request Forgery to Ticket Post Status Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0f8a0c-d02f-46e2-8808-3ffada105d13?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.1.0","to_inclusive":true,"patched_in":"3.5.1.1"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb1095e8-41f0-4cce-8381-0ef79c3c73de","source":"wordfence","cve":"CVE-2025-23567","title":"GDReseller <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1095e8-41f0-4cce-8381-0ef79c3c73de?source=api-prod","affected":[{"type":"plugin","slug":"gdreseller","name":"GDReseller","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:16:53Z"},{"id":"wordfence:bb14a79a-32ba-4d7a-b706-4e602a25e9cf","source":"wordfence","cve":"CVE-2022-34154","title":"Enable SVG, WebP & ICO Upload <= 1.1.0 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb14a79a-32ba-4d7a-b706-4e602a25e9cf?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2022-08-01T00:00:00Z","updated":"2024-11-21T14:38:19Z"},{"id":"wordfence:bb15316c-2414-40c0-97e7-0b4d1b8293a4","source":"wordfence","cve":"CVE-2024-56206","title":"gap-hub-user-role <= 3.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb15316c-2414-40c0-97e7-0b4d1b8293a4?source=api-prod","affected":[{"type":"plugin","slug":"gap-hub-user-role","name":"gap-hub-user-role.","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:24:25Z"},{"id":"wordfence:bb1742fd-7f0c-4a14-aa9c-f2863fcccd17","source":"wordfence","cve":"","title":"Revive Old Posts \u2013 Social Media Auto Post and Scheduling Plugin < 8.0.0 - Authorization Bypass","severity":"high","cvss":8.6,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1742fd-7f0c-4a14-aa9c-f2863fcccd17?source=api-prod","affected":[{"type":"plugin","slug":"tweet-old-post","name":"Revive Social \u2013 Social Media Auto Post and Scheduling Automation Plugin","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":false,"patched_in":"8.0.0"}],"published":"2015-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb175149-05b5-4e8e-8437-9a07762c7269","source":"wordfence","cve":"CVE-2026-14224","title":"Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb175149-05b5-4e8e-8437-9a07762c7269?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.28","to_inclusive":false,"patched_in":"3.12.28"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-14T15:21:48Z"},{"id":"wordfence:bb1ae910-c562-48a7-b81d-3bc5dd7913e1","source":"wordfence","cve":"CVE-2024-54419","title":"Ui Slider Filter By Price <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1ae910-c562-48a7-b81d-3bc5dd7913e1?source=api-prod","affected":[{"type":"plugin","slug":"ui-slider-filter-by-price","name":"Ui Slider Filter By Price","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T13:58:03Z"},{"id":"wordfence:bb1b93ee-8641-4ddb-8b6b-2e9d30fe338d","source":"wordfence","cve":"CVE-2025-5585","title":"SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1b93ee-8641-4ddb-8b6b-2e9d30fe338d?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.68.5","to_inclusive":true,"patched_in":"1.69.0"}],"published":"2025-06-24T13:56:20Z","updated":"2025-06-25T02:22:10Z"},{"id":"wordfence:bb1def67-ad83-4ad5-bb11-fbd1c02ece47","source":"wordfence","cve":"CVE-2024-4747","title":"Propovoice CRM <= 1.7.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1def67-ad83-4ad5-bb11-fbd1c02ece47?source=api-prod","affected":[{"type":"plugin","slug":"propovoice","name":"Propovoice: All-in-One Client Management System","from":"*","from_inclusive":true,"to":"1.7.6.2","to_inclusive":true,"patched_in":"1.7.6.3"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-22T13:00:27Z"},{"id":"wordfence:bb1f7b09-9159-429b-be5b-8f1244d85a7b","source":"wordfence","cve":"CVE-2025-49988","title":"Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1f7b09-9159-429b-be5b-8f1244d85a7b?source=api-prod","affected":[{"type":"plugin","slug":"integrate-contact-form-7-and-aweber","name":"Connect Contact Form 7 and AWeber","from":"*","from_inclusive":true,"to":"0.1.42","to_inclusive":true,"patched_in":"0.1.43"}],"published":"2025-06-19T00:00:00Z","updated":"2025-11-07T17:35:09Z"},{"id":"wordfence:bb1fe70b-80f8-408f-8f4b-4eca57c6ade8","source":"wordfence","cve":"CVE-2026-25020","title":"WP Sync for Notion <= 1.7.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb1fe70b-80f8-408f-8f4b-4eca57c6ade8?source=api-prod","affected":[{"type":"plugin","slug":"wp-sync-for-notion","name":"WP Sync for Notion \u2013 Notion to WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-10T19:57:02Z"},{"id":"wordfence:bb20452b-7049-4567-8288-6d24350e2143","source":"wordfence","cve":"CVE-2025-10486","title":"Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb20452b-7049-4567-8288-6d24350e2143?source=api-prod","affected":[{"type":"plugin","slug":"content-writer","name":"Content Writer","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2025-10-14T20:02:33Z","updated":"2025-10-17T19:42:34Z"},{"id":"wordfence:bb228bda-5094-4e54-a197-3b66376e2216","source":"wordfence","cve":"CVE-2023-47680","title":"Qi Addons For Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb228bda-5094-4e54-a197-3b66376e2216?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb23bc2e-4484-46d5-b46e-5e43e5a1bf12","source":"wordfence","cve":"CVE-2026-15403","title":"Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb23bc2e-4484-46d5-b46e-5e43e5a1bf12?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.6.9","to_inclusive":true,"patched_in":"2.9.9.7.0"}],"published":"2026-07-31T12:40:41Z","updated":"2026-10-15T18:42:18Z"},{"id":"wordfence:bb267bbd-cd62-49f7-9abc-c6734b23be22","source":"wordfence","cve":"CVE-2024-2890","title":"Tumult Hype Animations <= 1.9.12 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb267bbd-cd62-49f7-9abc-c6734b23be22?source=api-prod","affected":[{"type":"plugin","slug":"tumult-hype-animations","name":"Tumult Hype Animations","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T21:27:41Z"},{"id":"wordfence:bb26c029-a138-4b82-afe4-a35ec71b97ed","source":"wordfence","cve":"CVE-2026-90953","title":"Image Optimizer by Elementor <= 1.7.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb26c029-a138-4b82-afe4-a35ec71b97ed?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer","name":"Image Optimizer","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:46:10Z"},{"id":"wordfence:bb2778ee-f875-4494-ad42-fccc7b38d692","source":"wordfence","cve":"CVE-2026-76128","title":"eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2778ee-f875-4494-ad42-fccc7b38d692?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.5.10","to_inclusive":true,"patched_in":"3.5.11"}],"published":"2026-08-24T20:51:06Z","updated":"2026-08-25T09:27:52Z"},{"id":"wordfence:bb279479-b5d5-4baa-b90b-9e36db38aa28","source":"wordfence","cve":"CVE-2026-94179","title":"Razorpay Payment Button Plugin <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb279479-b5d5-4baa-b90b-9e36db38aa28?source=api-prod","affected":[{"type":"plugin","slug":"razorpay-payment-button","name":"Razorpay Payment Button Plugin","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-09-23T12:45:17Z","updated":"2026-09-29T19:50:25Z"},{"id":"wordfence:bb27da72-ba3e-4578-9b2b-c716019c20ed","source":"wordfence","cve":"CVE-2024-51616","title":"AwesomePress <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb27da72-ba3e-4578-9b2b-c716019c20ed?source=api-prod","affected":[{"type":"plugin","slug":"awesomepress","name":"AwesomePress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:42:57Z"},{"id":"wordfence:bb280004-e0ba-44c8-a205-8fec30900d86","source":"wordfence","cve":"CVE-2025-12189","title":"Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb280004-e0ba-44c8-a205-8fec30900d86?source=api-prod","affected":[{"type":"plugin","slug":"bread-butter","name":"Bread & Butter \u2013 Identify Website Visitors, Score Leads & Gate Content","from":"*","from_inclusive":true,"to":"7.11.1374","to_inclusive":true,"patched_in":"8.0.1398"}],"published":"2025-12-04T16:31:43Z","updated":"2025-12-09T17:02:27Z"},{"id":"wordfence:bb2897fc-c38b-419f-8651-0620a31b50ec","source":"wordfence","cve":"CVE-2024-33924","title":"Realtyna Organic IDX plugin <= 4.14.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2897fc-c38b-419f-8651-0620a31b50ec?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.14.8"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-17T13:47:43Z"},{"id":"wordfence:bb2a67ff-a452-4ecb-9fd7-bf05fe43a2f7","source":"wordfence","cve":"","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.22.5 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2a67ff-a452-4ecb-9fd7-bf05fe43a2f7?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.22.5","to_inclusive":true,"patched_in":"6.23.0"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb2a8a6f-fe97-4588-a084-64f502a40c51","source":"wordfence","cve":"CVE-2025-10008","title":"Translate WordPress and go Multilingual \u2013 Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2a8a6f-fe97-4588-a084-64f502a40c51?source=api-prod","affected":[{"type":"plugin","slug":"weglot","name":"Translate WordPress with Weglot 2.0 \u2013 Multilingual AI Translation","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.2"}],"published":"2025-10-29T00:00:00Z","updated":"2025-10-30T05:28:28Z"},{"id":"wordfence:bb2df482-30bf-49e5-b1e2-06e102d2dd1b","source":"wordfence","cve":"CVE-2015-9459","title":"searchterms-tagging-2 <= 1.535 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb2df482-30bf-49e5-b1e2-06e102d2dd1b?source=api-prod","affected":[{"type":"plugin","slug":"searchterms-tagging-2","name":"SEO SearchTerms Tagging 2","from":"*","from_inclusive":true,"to":"1.535","to_inclusive":true,"patched_in":""}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb302392-bde0-4c29-adae-649110d032a7","source":"wordfence","cve":"CVE-2025-23558","title":"Geotagged Media <= 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb302392-bde0-4c29-adae-649110d032a7?source=api-prod","affected":[{"type":"plugin","slug":"geotagged-media","name":"Geotagged Media","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:17:33Z"},{"id":"wordfence:bb302539-97e7-4b2c-865d-bd81919647ae","source":"wordfence","cve":"CVE-2026-1922","title":"The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb302539-97e7-4b2c-865d-bd81919647ae?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar-shortcode","name":"The Events Calendar Shortcode & Block","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-02-09T20:37:43Z","updated":"2026-03-16T19:19:12Z"},{"id":"wordfence:bb35a0cf-e606-4ef9-8973-8a9b233696d4","source":"wordfence","cve":"CVE-2025-48361","title":"Hesabfa Accounting <= 2.2.4 - Unauthenticated Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb35a0cf-e606-4ef9-8973-8a9b233696d4?source=api-prod","affected":[{"type":"plugin","slug":"hesabfa-accounting","name":"Hesabfa Accounting","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:34:41Z"},{"id":"wordfence:bb36fd27-bcea-481c-a7aa-815dc684ed8b","source":"wordfence","cve":"CVE-2025-12670","title":"wp-twitpic <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb36fd27-bcea-481c-a7aa-815dc684ed8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-twitpic","name":"wp-twitpic","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:19:16Z","updated":"2025-11-27T02:26:14Z"},{"id":"wordfence:bb3859eb-5a1f-408c-84aa-acfc68bd0bb5","source":"wordfence","cve":"CVE-2022-0493","title":"String Locator <= 2.4.2 - Authenticated Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3859eb-5a1f-408c-84aa-acfc68bd0bb5?source=api-prod","affected":[{"type":"plugin","slug":"string-locator","name":"String locator","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb386ab5-1fb9-4649-99a6-0e3f971a02f8","source":"wordfence","cve":"CVE-2024-11892","title":"Accordion Slider Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb386ab5-1fb9-4649-99a6-0e3f971a02f8?source=api-prod","affected":[{"type":"plugin","slug":"accordion-slider-lite","name":"Accordion Slider Lite","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T19:04:12Z","updated":"2025-01-11T07:21:53Z"},{"id":"wordfence:bb39990d-6d9d-413d-9c1d-582902ecdc5a","source":"wordfence","cve":"CVE-2026-39707","title":"Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb39990d-6d9d-413d-9c1d-582902ecdc5a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-extension","name":"Accept PayPal Payments using Contact Form 7","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-03-01T00:00:00Z","updated":"2026-10-13T16:58:33Z"},{"id":"wordfence:bb3aa613-8f34-4d96-8ddf-41fcdcf65c59","source":"wordfence","cve":"CVE-2024-6497","title":"SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3aa613-8f34-4d96-8ddf-41fcdcf65c59?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.3.19","to_inclusive":true,"patched_in":"12.3.20"}],"published":"2024-07-19T20:19:09Z","updated":"2024-08-22T13:39:44Z"},{"id":"wordfence:bb3b0a0e-9f2a-47b1-b2ba-7bb96e581e26","source":"wordfence","cve":"CVE-2024-3236","title":"Popup Builder <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3b0a0e-9f2a-47b1-b2ba-7bb96e581e26?source=api-prod","affected":[{"type":"plugin","slug":"easy-notify-lite","name":"Easy Notify Lite","from":"*","from_inclusive":true,"to":"1.1.32","to_inclusive":true,"patched_in":"1.1.33"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-18T15:23:37Z"},{"id":"wordfence:bb3b8d0b-4e58-408c-9527-dc17f62d3167","source":"wordfence","cve":"CVE-2024-34372","title":"Post Grid Master <= 3.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3b8d0b-4e58-408c-9527-dc17f62d3167?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:18:44Z"},{"id":"wordfence:bb3be09d-6f65-48cc-b692-f4231d3f6858","source":"wordfence","cve":"CVE-2024-49614","title":"SermonAudio Widgets <= 1.9.3 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3be09d-6f65-48cc-b692-f4231d3f6858?source=api-prod","affected":[{"type":"plugin","slug":"sermonaudio-widgets","name":"SermonAudio Widgets","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:03:30Z"},{"id":"wordfence:bb3f2af4-b5cc-43c0-8425-224281300d66","source":"wordfence","cve":"CVE-2025-39348","title":"Grand Restaurant WordPress <= 7.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3f2af4-b5cc-43c0-8425-224281300d66?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:12:43Z"},{"id":"wordfence:bb41862a-0cde-46f0-bd86-5a04e76f7345","source":"wordfence","cve":"CVE-2024-11196","title":"Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb41862a-0cde-46f0-bd86-5a04e76f7345?source=api-prod","affected":[{"type":"plugin","slug":"multi-column-tag-map","name":"Multi-column Tag Map","from":"*","from_inclusive":true,"to":"17.0.33","to_inclusive":true,"patched_in":"17.0.34"}],"published":"2024-12-20T18:46:20Z","updated":"2025-03-13T20:06:08Z"},{"id":"wordfence:bb420557-110b-47af-b88a-dbe6f0c6f393","source":"wordfence","cve":"CVE-2026-14563","title":"Advanced Customized Prompts <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb420557-110b-47af-b88a-dbe6f0c6f393?source=api-prod","affected":[{"type":"plugin","slug":"advanced-customized-prompts","name":"Advanced Customized Prompts","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-16T14:28:51Z"},{"id":"wordfence:bb4abe41-fb18-46f4-9fd8-90bb1996b241","source":"wordfence","cve":"CVE-2019-14787","title":"Newsletters <= 4.6.18 - Cross-Site Scripting via contentarea Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4abe41-fb18-46f4-9fd8-90bb1996b241?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":false,"patched_in":"4.6.19"}],"published":"2019-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb4b3778-7211-4a56-a2e5-1f455f356dd5","source":"wordfence","cve":"CVE-2026-3567","title":"RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4b3778-7211-4a56-a2e5-1f455f356dd5?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1132","to_inclusive":true,"patched_in":"4.1133"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-20T23:25:13Z"},{"id":"wordfence:bb4c2021-c4b0-4283-9022-a2a6a76bbce8","source":"wordfence","cve":"","title":"WP Rocket 3.23.1 - 3.23.3.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4c2021-c4b0-4283-9022-a2a6a76bbce8?source=api-prod","affected":[{"type":"plugin","slug":"wp-rocket","name":"WP Rocket","from":"3.23.1","from_inclusive":true,"to":"3.23.3.2","to_inclusive":true,"patched_in":"3.23.3.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T15:01:30Z"},{"id":"wordfence:bb4d6d2c-a69d-492e-a2d5-fabfaef82f68","source":"wordfence","cve":"CVE-2022-3631","title":"OAuth Client by DigitialPixies <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4d6d2c-a69d-492e-a2d5-fabfaef82f68?source=api-prod","affected":[{"type":"plugin","slug":"dpt-oauth-client","name":"OAuth Client by DigitialPixies","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb4f8066-1185-41c7-a901-6c585fea0499","source":"wordfence","cve":"CVE-2025-27329","title":"EZ InLinkz linkup <= 0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4f8066-1185-41c7-a901-6c585fea0499?source=api-prod","affected":[{"type":"plugin","slug":"inlinkz-scripter","name":"EZ InLinkz linkup","from":"*","from_inclusive":true,"to":"0.18","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:11:32Z"},{"id":"wordfence:bb51676b-4b5b-4cac-934b-b8b12af9dc81","source":"wordfence","cve":"CVE-2026-45442","title":"The Ultimate Video Player For WordPress \u2013 by Presto Player <= 4.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb51676b-4b5b-4cac-934b-b8b12af9dc81?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-05-19T00:00:00Z","updated":"2026-05-19T13:30:22Z"},{"id":"wordfence:bb5178f4-356b-4352-96ca-500e49006f8a","source":"wordfence","cve":"","title":"ThemeBlvd Themes/Plugins (Various Versions) - Missing Authorization Checks","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5178f4-356b-4352-96ca-500e49006f8a?source=api-prod","affected":[{"type":"theme","slug":"swagger","name":"Swagger","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"},{"type":"theme","slug":"alyeska","name":"Alyeska","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"},{"type":"plugin","slug":"theme-blvd-shortcodes","name":"Theme Blvd Shortcodes","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"},{"type":"theme","slug":"jumpstart","name":"WP Jump Start","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"},{"type":"theme","slug":"commodore","name":"Commodore","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"},{"type":"theme","slug":"barelycorporate","name":"Barely Corporate","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"},{"type":"plugin","slug":"theme-blvd-sliders","name":"Theme Blvd Sliders","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"theme","slug":"arcadian","name":"Arcadian Responsive","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"},{"type":"plugin","slug":"theme-blvd-widget-areas","name":"Theme Blvd Widget Areas","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"},{"type":"theme","slug":"akita","name":"Akita","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"},{"type":"plugin","slug":"theme-blvd-layout-builder","name":"Theme Blvd Layout Builder","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2014-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb53b541-1c7a-4265-ba7a-18be976a01d7","source":"wordfence","cve":"CVE-2025-53587","title":"Findgo <= 1.3.57 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb53b541-1c7a-4265-ba7a-18be976a01d7?source=api-prod","affected":[{"type":"theme","slug":"findgo","name":"Findgo - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.57","to_inclusive":true,"patched_in":"1.3.58"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T19:53:41Z"},{"id":"wordfence:bb545a42-6c66-412b-a686-e486b0a58dc5","source":"wordfence","cve":"","title":"Stripe Payment Plugin for WooCommerce <= 3.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb545a42-6c66-412b-a686-e486b0a58dc5?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb581a8a-8e68-4f5a-8f05-d5b91b0f70d4","source":"wordfence","cve":"CVE-2020-11731","title":"Media Library Assistant <= 2.81 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb581a8a-8e68-4f5a-8f05-d5b91b0f70d4?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"2.82","to_inclusive":false,"patched_in":"2.82"}],"published":"2019-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb5b64d1-8e13-44aa-b158-4cb6fd50e7cd","source":"wordfence","cve":"CVE-2026-81284","title":"Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5b64d1-8e13-44aa-b158-4cb6fd50e7cd?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.6","to_inclusive":true,"patched_in":"0.9.2.7"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:59:40Z"},{"id":"wordfence:bb5c765d-2d80-42fd-823c-070777348f62","source":"wordfence","cve":"CVE-2025-27277","title":"Add Linked Images To Gallery <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5c765d-2d80-42fd-823c-070777348f62?source=api-prod","affected":[{"type":"plugin","slug":"add-linked-images-to-gallery-v01","name":"Add Linked Images To Gallery","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:27:50Z"},{"id":"wordfence:bb5c8cb3-df67-4f2c-869a-48e34f5619ff","source":"wordfence","cve":"CVE-2026-15450","title":"NEX-Forms <= 9.2.3 -  Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5c8cb3-df67-4f2c-869a-48e34f5619ff?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.3","to_inclusive":true,"patched_in":"9.2.4"}],"published":"2026-07-31T19:42:18Z","updated":"2026-08-01T07:49:51Z"},{"id":"wordfence:bb5e6767-d0a9-4ac4-816f-6fb57b1e5f9b","source":"wordfence","cve":"CVE-2023-51515","title":"Uncode Core <= 2.8.8 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5e6767-d0a9-4ac4-816f-6fb57b1e5f9b?source=api-prod","affected":[{"type":"plugin","slug":"uncode-core","name":"Uncode Core","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb5e6ff6-e70c-4b46-80fc-498becca6158","source":"wordfence","cve":"CVE-2024-33926","title":"GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5e6ff6-e70c-4b46-80fc-498becca6158?source=api-prod","affected":[{"type":"plugin","slug":"gwp-histats","name":"GWP-Histats","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:54:57Z"},{"id":"wordfence:bb5f73c3-f40b-45d5-9947-c1a514d230f7","source":"wordfence","cve":"CVE-2024-1937","title":"Brizy \u2013 Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.44","to_inclusive":true,"patched_in":"2.4.45"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T08:32:32Z"},{"id":"wordfence:bb606a30-2f7c-41e9-9ebc-9f1b0b84fff8","source":"wordfence","cve":"CVE-2023-0942","title":"Japanized For WooCommerce <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb606a30-2f7c-41e9-9ebc-9f1b0b84fff8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb6182e8-ba5c-4873-aa18-45a79191c8c5","source":"wordfence","cve":"CVE-2017-16510","title":"WordPress Core < 4.8.3 - SQL Injection due to Double Prepare approach","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6182e8-ba5c-4873-aa18-45a79191c8c5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.22","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.22","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.20","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.19","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.19","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.16","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.12","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.10","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.7","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.6","to_inclusive":true,"patched_in":"3.7.23"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"3.7.23"}],"published":"2017-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb621eb8-4404-4a21-b96e-e5871c8a769b","source":"wordfence","cve":"CVE-2026-111370","title":"WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb621eb8-4404-4a21-b96e-e5871c8a769b?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2026-11-06T23:04:50Z","updated":"2026-11-07T11:26:34Z"},{"id":"wordfence:bb62772b-ac8e-48ea-9d72-1b2e7996de42","source":"wordfence","cve":"CVE-2024-8090","title":"JavaScript Logic <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb62772b-ac8e-48ea-9d72-1b2e7996de42?source=api-prod","affected":[{"type":"plugin","slug":"javascript-logic","name":"JavaScript Logic","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-04T00:00:00Z","updated":"2025-05-30T18:32:26Z"},{"id":"wordfence:bb65d916-7d9e-4562-ab9b-c7ba012a08fb","source":"wordfence","cve":"CVE-2024-11643","title":"Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb65d916-7d9e-4562-ab9b-c7ba012a08fb?source=api-prod","affected":[{"type":"plugin","slug":"allaccessible","name":"Accessibility by AllAccessible","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T15:22:21Z"},{"id":"wordfence:bb671c8f-9e14-4f79-adfa-72f48ec02449","source":"wordfence","cve":"CVE-2026-4245","title":"Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb671c8f-9e14-4f79-adfa-72f48ec02449?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T11:30:40Z"},{"id":"wordfence:bb68a0df-0d0c-44e5-9efb-b5787ef1f89c","source":"wordfence","cve":"CVE-2026-89193","title":"Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb68a0df-0d0c-44e5-9efb-b5787ef1f89c?source=api-prod","affected":[{"type":"plugin","slug":"robin-image-optimizer","name":"Robin Image Optimizer \u2013 Unlimited Image Optimization, WebP & AVIF","from":"2.0.0","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:00:27Z"},{"id":"wordfence:bb697a3f-2ce5-4897-bee4-3e81fd97fa5e","source":"wordfence","cve":"CVE-2026-65485","title":"Content Control \u2013 The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb697a3f-2ce5-4897-bee4-3e81fd97fa5e?source=api-prod","affected":[{"type":"plugin","slug":"content-control","name":"Content Control \u2013 The Ultimate Content Restriction Solution! Restrict Content, Create Conditional Blocks & More","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-09-18T00:44:47Z"},{"id":"wordfence:bb6c82b0-d9c7-4777-829d-885f24da4f36","source":"wordfence","cve":"CVE-2026-109414","title":"Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c82b0-d9c7-4777-829d-885f24da4f36?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-10-15T17:16:45Z","updated":"2026-10-16T05:30:26Z"},{"id":"wordfence:bb6c977f-6ab3-4c94-83b1-968dafca4a8e","source":"wordfence","cve":"CVE-2024-37506","title":"Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6c977f-6ab3-4c94-83b1-968dafca4a8e?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.1.7","to_inclusive":true,"patched_in":"1.8.1.8"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:43:08Z"},{"id":"wordfence:bb6cd3a6-565e-4acf-82f0-25e85f0678bb","source":"wordfence","cve":"","title":"User Control <= 2.1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6cd3a6-565e-4acf-82f0-25e85f0678bb?source=api-prod","affected":[{"type":"plugin","slug":"user-control","name":"User Control","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2018-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb6ecb74-b337-4930-a737-f70799607d89","source":"wordfence","cve":"CVE-2016-1000128","title":"Anti Plagiarism <= 3.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6ecb74-b337-4930-a737-f70799607d89?source=api-prod","affected":[{"type":"plugin","slug":"anti-plagiarism","name":"anti-plagiarism","from":"*","from_inclusive":true,"to":"3.60","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb6f3607-d44f-452a-b3ad-55f036033480","source":"wordfence","cve":"CVE-2024-7129","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.7.42 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb6f3607-d44f-452a-b3ad-55f036033480?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.42","to_inclusive":true,"patched_in":"1.6.7.43"}],"published":"2024-08-23T00:00:00Z","updated":"2024-10-04T15:57:24Z"},{"id":"wordfence:bb70ad52-b964-4c56-98a2-06be375a79af","source":"wordfence","cve":"CVE-2025-14630","title":"AdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb70ad52-b964-4c56-98a2-06be375a79af?source=api-prod","affected":[{"type":"plugin","slug":"adminquickbar","name":"AdminQuickbar","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:27:12Z","updated":"2026-01-24T08:26:35Z"},{"id":"wordfence:bb74a917-2dfb-4229-a72a-9c3d1f9a6324","source":"wordfence","cve":"","title":"GamiPress \u2013 Youtube integration <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb74a917-2dfb-4229-a72a-9c3d1f9a6324?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-youtube-integration","name":"GamiPress \u2013 Youtube integration","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb762cd0-1925-4161-bd12-9e781de60c9c","source":"wordfence","cve":"CVE-2022-2083","title":"Simple Single Sign On <= 4.1.1 - Insecure OAuth Implementation to Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb762cd0-1925-4161-bd12-9e781de60c9c?source=api-prod","affected":[{"type":"plugin","slug":"single-sign-on-client","name":"Simple Single Sign On","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb7d99a7-1e7d-43e1-839c-286b454c8276","source":"wordfence","cve":"CVE-2024-9364","title":"SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb7d99a7-1e7d-43e1-839c-286b454c8276?source=api-prod","affected":[{"type":"plugin","slug":"wp-sendgrid-mailer","name":"SendGrid for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:43:25Z","updated":"2024-10-18T04:32:55Z"},{"id":"wordfence:bb7deb6b-d601-47c8-a27c-bf0348b8a807","source":"wordfence","cve":"CVE-2026-24366","title":"YITH WooCommerce Request A Quote <= 2.46.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb7deb6b-d601-47c8-a27c-bf0348b8a807?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"2.46.0","to_inclusive":true,"patched_in":"2.46.1"}],"published":"2026-01-09T00:00:00Z","updated":"2026-02-03T20:56:49Z"},{"id":"wordfence:bb7e9ea4-c450-491f-b924-47ed4abec64a","source":"wordfence","cve":"CVE-2023-4269","title":"User Activity Log <= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb7e9ea4-c450-491f-b924-47ed4abec64a?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb80d586-1f49-4497-93e4-f27b3c26c53c","source":"wordfence","cve":"CVE-2026-118634","title":"Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb80d586-1f49-4497-93e4-f27b3c26c53c?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-10-29T17:01:14Z","updated":"2026-10-30T05:35:52Z"},{"id":"wordfence:bb81b2ce-583b-411c-b0f5-a233e0d1986b","source":"wordfence","cve":"CVE-2024-12201","title":"Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:34Z"},{"id":"wordfence:bb81e90f-8da4-483c-9bc1-18b6c016df5e","source":"wordfence","cve":"CVE-2023-49748","title":"WPS Hide Login <= 1.9.11 - Hidden Login Page Location Disclosure","severity":"low","cvss":3.7,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81e90f-8da4-483c-9bc1-18b6c016df5e?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-24T01:30:27Z"},{"id":"wordfence:bb8232cd-4fd5-4e0f-90d0-91e5eb7e70c8","source":"wordfence","cve":"CVE-2008-1646","title":"WP-Download <= 1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8232cd-4fd5-4e0f-90d0-91e5eb7e70c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-download","name":"WP-Download","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2008-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb85341a-0253-41b2-992e-9202cb3e0f2d","source":"wordfence","cve":"CVE-2014-8375","title":"GB Gallery Slideshow <= 1.5 - SQL Injection","severity":"high","cvss":8.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb85341a-0253-41b2-992e-9202cb3e0f2d?source=api-prod","affected":[{"type":"plugin","slug":"gb-gallery-slideshow","name":"GB Gallery Slideshow","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2014-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb8640f2-d3cc-4a4a-8dfb-adaa8b77264c","source":"wordfence","cve":"CVE-2018-6001","title":"Soundy Audio Playlist <= 4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8640f2-d3cc-4a4a-8dfb-adaa8b77264c?source=api-prod","affected":[{"type":"plugin","slug":"soundy-audio-playlist","name":"Soundy Audio Playlist","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2018-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb865548-4074-4d0b-a222-ab5328a1db40","source":"wordfence","cve":"CVE-2026-15368","title":"Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb865548-4074-4d0b-a222-ab5328a1db40?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.16.3","to_inclusive":true,"patched_in":"3.16.4"}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-21T15:37:07Z"},{"id":"wordfence:bb88a0e9-b282-454c-8ac8-c54f5d8d6121","source":"wordfence","cve":"CVE-2025-3704","title":"Volunteer Sign Up Sheets <= 5.5.4 - Authenticated (Admin+) Stored Cross-site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb88a0e9-b282-454c-8ac8-c54f5d8d6121?source=api-prod","affected":[{"type":"plugin","slug":"pta-volunteer-sign-up-sheets","name":"Volunteer Sign Up Sheets","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2025-05-27T00:00:00Z","updated":"2025-05-30T20:33:28Z"},{"id":"wordfence:bb8aca3a-e4f7-41d6-9ea9-d189817c2c04","source":"wordfence","cve":"CVE-2022-47169","title":"Visibility Logic for Elementor <= 2.3.4 - Cross-Site Request Forgery via toggle_option","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8aca3a-e4f7-41d6-9ea9-d189817c2c04?source=api-prod","affected":[{"type":"plugin","slug":"visibility-logic-elementor","name":"Visibility Logic for Elementor","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb8b0b77-1d3d-47f4-9e1a-1388521143f7","source":"wordfence","cve":"CVE-2026-78392","title":"Link Library <= 7.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8b0b77-1d3d-47f4-9e1a-1388521143f7?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:57:18Z"},{"id":"wordfence:bb8bbfdb-c2a2-49b6-8a24-b788427d72b6","source":"wordfence","cve":"CVE-2025-31635","title":"CLEVER <= 2.6 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8bbfdb-c2a2-49b6-8a24-b788427d72b6?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio11-html5-shoutcast_history","name":"CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-17T14:28:59Z"},{"id":"wordfence:bb8d81c3-4a5b-491f-9868-3bb7b431f8e4","source":"wordfence","cve":"CVE-2022-36347","title":"Alpine PhotoTile for Pinterest <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8d81c3-4a5b-491f-9868-3bb7b431f8e4?source=api-prod","affected":[{"type":"plugin","slug":"alpine-photo-tile-for-pinterest","name":"Alpine PhotoTile for Pinterest","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb8f7748-8268-4a38-b794-495c5f6eb5ca","source":"wordfence","cve":"CVE-2026-57773","title":"Advanced Shipment Tracking for WooCommerce <= 4.0 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb8f7748-8268-4a38-b794-495c5f6eb5ca?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-shipment-tracking","name":"Advanced Shipment Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:37:12Z"},{"id":"wordfence:bb927aba-a96d-47b9-ba35-60945ea5cfe5","source":"wordfence","cve":"CVE-2025-0429","title":"AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb927aba-a96d-47b9-ba35-60945ea5cfe5?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.96","to_inclusive":true,"patched_in":"1.8.97"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:29:41Z"},{"id":"wordfence:bb929679-85bb-4d5b-9a99-e6081d55019f","source":"wordfence","cve":"","title":"miniOrange's Google Authenticator <= 5.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb929679-85bb-4d5b-9a99-e6081d55019f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.75"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb93853b-a6e0-42d1-8b10-b391984603f2","source":"wordfence","cve":"CVE-2024-2789","title":"Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb93853b-a6e0-42d1-8b10-b391984603f2?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:17Z"},{"id":"wordfence:bb967453-59d6-4b03-8c75-1906b99bff80","source":"wordfence","cve":"CVE-2023-41235","title":"Everest News Pro <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb967453-59d6-4b03-8c75-1906b99bff80?source=api-prod","affected":[{"type":"theme","slug":"everest-news-pro","name":"Everest News Pro","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb979c91-6795-4365-a61b-2cf67a9c8223","source":"wordfence","cve":"","title":"thecotton <= 1.14 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb979c91-6795-4365-a61b-2cf67a9c8223?source=api-prod","affected":[{"type":"theme","slug":"thecotton_v114","name":"thecotton","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2014-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb98b2ee-5c51-453f-9e55-52027237e732","source":"wordfence","cve":"CVE-2023-0545","title":"Hostel <= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb98b2ee-5c51-453f-9e55-52027237e732?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.1","to_inclusive":true,"patched_in":"1.1.5.2"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb991940-b4ed-4b64-be59-afe37eaf3a2c","source":"wordfence","cve":"CVE-2024-11502","title":"Planning Center Online Giving <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb991940-b4ed-4b64-be59-afe37eaf3a2c?source=api-prod","affected":[{"type":"plugin","slug":"planning-center-online-giving","name":"Planning Center Online Giving","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-03T00:00:00Z","updated":"2024-12-12T15:22:56Z"},{"id":"wordfence:bb995311-8837-4db5-a25d-37e41d932774","source":"wordfence","cve":"CVE-2025-49273","title":"WP Tools <= 5.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb995311-8837-4db5-a25d-37e41d932774?source=api-prod","affected":[{"type":"plugin","slug":"wptools","name":"WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log","from":"*","from_inclusive":true,"to":"5.24","to_inclusive":true,"patched_in":"5.25"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:33:58Z"},{"id":"wordfence:bb9ae252-7e5f-4dc0-a162-100493b81980","source":"wordfence","cve":"CVE-2026-1302","title":"Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb9ae252-7e5f-4dc0-a162-100493b81980?source=api-prod","affected":[{"type":"plugin","slug":"meta-box-gallerymeta","name":"Meta-box GalleryMeta","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-01-23T20:03:37Z","updated":"2026-02-03T18:51:59Z"},{"id":"wordfence:bb9aedc6-42ef-4fd9-a9d5-2a79214be472","source":"wordfence","cve":"CVE-2026-2389","title":"Complianz \u2013 GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb9aedc6-42ef-4fd9-a9d5-2a79214be472?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.4.4.2","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T13:26:09Z"},{"id":"wordfence:bb9bce29-9842-4d8a-ac9b-24432a28851c","source":"wordfence","cve":"CVE-2022-4752","title":"Opening Hours <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb9bce29-9842-4d8a-ac9b-24432a28851c?source=api-prod","affected":[{"type":"plugin","slug":"wp-opening-hours","name":"Opening Hours","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bb9fc87e-b376-49ce-ba69-5acef9deda4d","source":"wordfence","cve":"CVE-2024-9240","title":"ReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bb9fc87e-b376-49ce-ba69-5acef9deda4d?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"24.0902","to_inclusive":true,"patched_in":"24.1015"}],"published":"2024-10-16T13:30:51Z","updated":"2024-10-17T02:06:04Z"},{"id":"wordfence:bba1152f-acdf-4482-8054-03f5d3668f1a","source":"wordfence","cve":"CVE-2026-62121","title":"Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba1152f-acdf-4482-8054-03f5d3668f1a?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2026-10-30T18:06:00Z","updated":"2026-11-03T20:08:50Z"},{"id":"wordfence:bba19523-8b8e-4e91-b16b-8c9d5c410efa","source":"wordfence","cve":"CVE-2025-58836","title":"FW Anker <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba19523-8b8e-4e91-b16b-8c9d5c410efa?source=api-prod","affected":[{"type":"plugin","slug":"fw-anker","name":"FW Anker","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:40:02Z"},{"id":"wordfence:bba22270-de9b-4651-8180-c077ef113112","source":"wordfence","cve":"CVE-2025-14633","title":"F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba22270-de9b-4651-8180-c077ef113112?source=api-prod","affected":[{"type":"plugin","slug":"f70-lead-document-download","name":"F70 Lead Document Download","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:02:53Z","updated":"2025-12-20T03:20:23Z"},{"id":"wordfence:bba2eb67-70a9-438b-8d18-774fcf557469","source":"wordfence","cve":"CVE-2024-43961","title":"azurecurve Toggle Show/Hide <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba2eb67-70a9-438b-8d18-774fcf557469?source=api-prod","affected":[{"type":"plugin","slug":"azurecurve-toggle-showhide","name":"azurecurve Toggle Show/Hide","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:54:48Z"},{"id":"wordfence:bba3eeeb-5e7e-4ec3-9db0-02c44585647a","source":"wordfence","cve":"","title":"WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba3eeeb-5e7e-4ec3-9db0-02c44585647a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1.38","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.6","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"4.1.38"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bba4286b-acce-4dff-b809-dbd04d59702b","source":"wordfence","cve":"CVE-2019-15895","title":"Search Exclude <= 1.2.3 - Arbitrary Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba4286b-acce-4dff-b809-dbd04d59702b?source=api-prod","affected":[{"type":"plugin","slug":"search-exclude","name":"Search Exclude","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2019-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bba4f30f-fc21-4387-a29e-4e4a115d7c3c","source":"wordfence","cve":"","title":"Apocalypse Meow 21.1.3 - 21.2.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-261","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba4f30f-fc21-4387-a29e-4e4a115d7c3c?source=api-prod","affected":[{"type":"plugin","slug":"apocalypse-meow","name":"Apocalypse Meow","from":"21.1.3","from_inclusive":true,"to":"21.2.7","to_inclusive":true,"patched_in":"21.2.8"}],"published":"2017-12-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bba5f363-8d75-4c73-b8ae-eccf06dd1979","source":"wordfence","cve":"CVE-2025-67469","title":"PDF Thumbnail Generator <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba5f363-8d75-4c73-b8ae-eccf06dd1979?source=api-prod","affected":[{"type":"plugin","slug":"pdf-thumbnail-generator","name":"PDF Thumbnail Generator","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:50:00Z"},{"id":"wordfence:bba6567f-457b-44fd-993a-3f5380a2c3fb","source":"wordfence","cve":"CVE-2023-4388","title":"EventON <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba6567f-457b-44fd-993a-3f5380a2c3fb?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bba6762f-0ea9-46ce-be05-e6c4ce1d1b5a","source":"wordfence","cve":"CVE-2026-32471","title":"ProLancer Element <= 1.4.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba6762f-0ea9-46ce-be05-e6c4ce1d1b5a?source=api-prod","affected":[{"type":"plugin","slug":"prolancer-element","name":"Prolancer Element","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:19:55Z"},{"id":"wordfence:bba7fde9-0718-4681-9a1b-7c77bc0affbd","source":"wordfence","cve":"CVE-2022-0627","title":"Amelia <= 1.0.46 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba7fde9-0718-4681-9a1b-7c77bc0affbd?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.47"}],"published":"2022-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bba8007f-7254-4201-8f94-7bf921a33a27","source":"wordfence","cve":"CVE-2026-13360","title":"Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba8007f-7254-4201-8f94-7bf921a33a27?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-15T03:26:00Z"},{"id":"wordfence:bba90659-09a8-470a-91d3-d1986562672a","source":"wordfence","cve":"CVE-2024-10176","title":"Compact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba90659-09a8-470a-91d3-d1986562672a?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.13","to_inclusive":true,"patched_in":"1.9.14"}],"published":"2024-10-23T21:58:05Z","updated":"2024-10-24T11:03:16Z"},{"id":"wordfence:bba9d5ef-5aac-4dbf-8f4c-18f1675f3b02","source":"wordfence","cve":"CVE-2025-31018","title":"FireDrum Email Marketing <= 1.64 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bba9d5ef-5aac-4dbf-8f4c-18f1675f3b02?source=api-prod","affected":[{"type":"plugin","slug":"firedrum-email-marketing","name":"FireDrum Email Marketing","from":"*","from_inclusive":true,"to":"1.64","to_inclusive":true,"patched_in":"1.65"}],"published":"2025-04-10T00:00:00Z","updated":"2025-10-14T19:03:06Z"},{"id":"wordfence:bbaac6b6-0871-4745-b981-55d7e9219467","source":"wordfence","cve":"CVE-2025-30618","title":"Rapyd Payment Extension for WooCommerce <= 1.2.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbaac6b6-0871-4745-b981-55d7e9219467?source=api-prod","affected":[{"type":"theme","slug":"rapyd-payments","name":"rapyd-payments","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2026-02-26T15:05:04Z"},{"id":"wordfence:bbaae72c-b5a6-4fa3-9268-94c0e6a59d1c","source":"wordfence","cve":"CVE-2017-2284","title":"Popup Maker < 1.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbaae72c-b5a6-4fa3-9268-94c0e6a59d1c?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"}],"published":"2017-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbaba6cb-a829-4c07-b068-bdcb6a646450","source":"wordfence","cve":"CVE-2022-0595","title":"Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbaba6cb-a829-4c07-b068-bdcb6a646450?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.6.2","to_inclusive":true,"patched_in":"1.3.6.3"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbacdde1-87e0-4b3a-8580-f1d37c130a1c","source":"wordfence","cve":"CVE-2016-1000150","title":"Simplified Content < 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbacdde1-87e0-4b3a-8580-f1d37c130a1c?source=api-prod","affected":[{"type":"plugin","slug":"simplified-content","name":"Simplified Content","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbade634-cd81-41c0-8976-f5cb251da3f2","source":"wordfence","cve":"CVE-2024-25903","title":"Frontend File Manager <= 22.7 - Sensitive Information Exposure via user uploads","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbade634-cd81-41c0-8976-f5cb251da3f2?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"22.7","to_inclusive":true,"patched_in":"22.8"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:43:50Z"},{"id":"wordfence:bbadef9e-1e2d-4bd2-800a-f9369b795728","source":"wordfence","cve":"CVE-2026-6173","title":"Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbadef9e-1e2d-4bd2-800a-f9369b795728?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-09-29T19:35:18Z","updated":"2026-09-30T07:41:07Z"},{"id":"wordfence:bbae9c33-becb-4c9d-917f-0d8fe8312d0c","source":"wordfence","cve":"CVE-2026-1929","title":"Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbae9c33-becb-4c9d-917f-0d8fe8312d0c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"2.36","to_inclusive":true,"patched_in":"2.37"}],"published":"2026-02-24T19:54:05Z","updated":"2026-02-25T08:25:33Z"},{"id":"wordfence:bbafaa1b-bd90-42b5-b262-27ca4797b468","source":"wordfence","cve":"CVE-2025-54736","title":"Savoy <= 3.0.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbafaa1b-bd90-42b5-b262-27ca4797b468?source=api-prod","affected":[{"type":"theme","slug":"savoy","name":"Savoy","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:18:28Z"},{"id":"wordfence:bbb19be3-8783-4474-a258-285e3b90f1e0","source":"wordfence","cve":"CVE-2024-38733","title":"Meks Video Importer <= 1.0.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb19be3-8783-4474-a258-285e3b90f1e0?source=api-prod","affected":[{"type":"plugin","slug":"meks-video-importer","name":"Meks Video Importer","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2024-07-11T00:00:00Z","updated":"2026-02-26T15:00:46Z"},{"id":"wordfence:bbb24ae0-41d6-4d8f-917c-dfd058a7a49d","source":"wordfence","cve":"CVE-2025-2169","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb24ae0-41d6-4d8f-917c-dfd058a7a49d?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.2.0.4","to_inclusive":true,"patched_in":"1.2.0.5"}],"published":"2025-03-10T00:00:00Z","updated":"2025-03-11T03:22:20Z"},{"id":"wordfence:bbb32c81-1311-42ba-ba7b-d8c8793133a7","source":"wordfence","cve":"CVE-2025-28958","title":"Bg Orthodox Calendar <= 0.13.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb32c81-1311-42ba-ba7b-d8c8793133a7?source=api-prod","affected":[{"type":"plugin","slug":"bg-orthodox-calendar","name":"Bg Orthodox Calendar","from":"*","from_inclusive":true,"to":"0.13.10","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:00:28Z"},{"id":"wordfence:bbb3ee94-e631-47ee-9f16-6bf7c23abab1","source":"wordfence","cve":"CVE-2024-1506","title":"Prime Slider \u2013 Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb3ee94-e631-47ee-9f16-6bf7c23abab1?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T06:59:47Z"},{"id":"wordfence:bbb40038-75ea-4f09-b852-d90b087f1802","source":"wordfence","cve":"CVE-2025-30605","title":"sourceplay-navermap <= 0.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb40038-75ea-4f09-b852-d90b087f1802?source=api-prod","affected":[{"type":"plugin","slug":"sourceplay-navermap","name":"sourceplay-navermap","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:10:48Z"},{"id":"wordfence:bbb47f29-7a70-462d-913c-7af9c7b8709a","source":"wordfence","cve":"CVE-2025-54046","title":"Cost Calculator <= 7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb47f29-7a70-462d-913c-7af9c7b8709a?source=api-prod","affected":[{"type":"plugin","slug":"ql-cost-calculator","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.5"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:39:22Z"},{"id":"wordfence:bbb50bc9-5ad7-402e-a624-90f3302e1b0c","source":"wordfence","cve":"CVE-2024-11106","title":"Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb50bc9-5ad7-402e-a624-90f3302e1b0c?source=api-prod","affected":[{"type":"plugin","slug":"simple-restrict","name":"Simple Restrict","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-12-09T00:00:00Z","updated":"2024-12-10T11:09:15Z"},{"id":"wordfence:bbb57de9-210e-4983-965b-9a74ca10c494","source":"wordfence","cve":"CVE-2015-6965","title":"Contact Form Generator : Creative form builder for WordPress <= 2.1.86 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb57de9-210e-4983-965b-9a74ca10c494?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-generator","name":"Contact Form Generator : Creative form builder for WordPress","from":"*","from_inclusive":true,"to":"2.1.86","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2015-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbb65d61-c7e1-4884-8b10-a26df504724c","source":"wordfence","cve":"CVE-2024-31344","title":"Easy Login Styler \u2013 White Label Admin Login Page for WordPress <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb65d61-c7e1-4884-8b10-a26df504724c?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-styler","name":"Easy Login Styler \u2013 White Label Admin Login Page for WordPress","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:16:24Z"},{"id":"wordfence:bbb67f02-87e8-4ca3-8a9d-6663a700ab5b","source":"wordfence","cve":"CVE-2023-5532","title":"ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb67f02-87e8-4ca3-8a9d-6663a700ab5b?source=api-prod","affected":[{"type":"plugin","slug":"imagemapper","name":"ImageMapper","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbb9483b-ee00-4e40-8fa3-eefbbfeb9516","source":"wordfence","cve":"CVE-2026-1910","title":"UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb9483b-ee00-4e40-8fa3-eefbbfeb9516?source=api-prod","affected":[{"type":"plugin","slug":"upmenu","name":"UpMenu \u2013 Online ordering for restaurants","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2026-02-13T18:33:21Z","updated":"2026-07-10T16:31:13Z"},{"id":"wordfence:bbba83c2-4dc3-4850-8bbf-f9c700247b49","source":"wordfence","cve":"CVE-2015-3325","title":"WP Symposium < 15.4 - SQL Injection","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbba83c2-4dc3-4850-8bbf-f9c700247b49?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"15.4","to_inclusive":false,"patched_in":"15.4"}],"published":"2015-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbbb41de-8853-41d1-8801-1eb86867e4ba","source":"wordfence","cve":"CVE-2025-48239","title":"Product Notes Tab & Private Admin Notes for WooCommerce <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbb41de-8853-41d1-8801-1eb86867e4ba?source=api-prod","affected":[{"type":"plugin","slug":"product-notes-for-woocommerce","name":"Product Notes Tab & Private Admin Notes for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:53:44Z"},{"id":"wordfence:bbbd989c-4d69-45c9-bcb9-44f9ab98b969","source":"wordfence","cve":"CVE-2026-7660","title":"Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbd989c-4d69-45c9-bcb9-44f9ab98b969?source=api-prod","affected":[{"type":"plugin","slug":"stops-core-theme-and-plugin-updates","name":"Easy Updates Manager","from":"*","from_inclusive":true,"to":"9.0.20","to_inclusive":true,"patched_in":"9.0.21"}],"published":"2026-05-27T18:13:25Z","updated":"2026-06-08T16:37:55Z"},{"id":"wordfence:bbbf3d43-69df-4beb-963d-5c483486cfeb","source":"wordfence","cve":"CVE-2026-95605","title":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbf3d43-69df-4beb-963d-5c483486cfeb?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.82","to_inclusive":true,"patched_in":"5.5.83"}],"published":"2026-10-02T09:04:58Z","updated":"2026-10-09T00:09:03Z"},{"id":"wordfence:bbc00c4b-c360-4614-b9bc-30d899b812f1","source":"wordfence","cve":"CVE-2025-52756","title":"WP Last Modified Info <= 1.9.4 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc00c4b-c360-4614-b9bc-30d899b812f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified-info","name":"WP Last Modified Info","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2025-08-24T00:00:00Z","updated":"2025-11-12T21:08:13Z"},{"id":"wordfence:bbc1b46e-139a-4e1a-a0c7-e45e10adada5","source":"wordfence","cve":"CVE-2021-24484","title":"Secure Copy Content Protection and Content Locking <= 2.6.6 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc1b46e-139a-4e1a-a0c7-e45e10adada5?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":false,"patched_in":"2.6.7"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbc2a1f7-4c3c-4f37-a187-572f40e9b792","source":"wordfence","cve":"CVE-2022-0513","title":"WP Statistics <= 13.1.4 - Unauthenticated Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc2a1f7-4c3c-4f37-a187-572f40e9b792?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.4","to_inclusive":true,"patched_in":"13.1.5"}],"published":"2022-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbc41888-35e5-483b-b048-7a504d2e5566","source":"wordfence","cve":"CVE-2026-11866","title":"LatePoint <= 5.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc41888-35e5-483b-b048-7a504d2e5566?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T22:35:57Z"},{"id":"wordfence:bbc60271-5f22-48fe-8f56-a66549daf638","source":"wordfence","cve":"CVE-2026-32417","title":"Pochipp < 1.18.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc60271-5f22-48fe-8f56-a66549daf638?source=api-prod","affected":[{"type":"plugin","slug":"pochipp","name":"Pochipp","from":"*","from_inclusive":true,"to":"1.18.9","to_inclusive":false,"patched_in":"1.18.9"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:00:53Z"},{"id":"wordfence:bbc7704b-8a28-4daf-8b83-bccc3783c43c","source":"wordfence","cve":"CVE-2025-62019","title":"Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization","severity":"high","cvss":7.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc7704b-8a28-4daf-8b83-bccc3783c43c?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2025-09-11T00:00:00Z","updated":"2025-11-04T16:27:06Z"},{"id":"wordfence:bbc8ccc1-7b72-44fb-8bf5-e7cb46081ed5","source":"wordfence","cve":"CVE-2015-5461","title":"StageShow < 5.0.9 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc8ccc1-7b72-44fb-8bf5-e7cb46081ed5?source=api-prod","affected":[{"type":"plugin","slug":"stageshow","name":"StageShow","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":false,"patched_in":"5.0.9"}],"published":"2015-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbc8e925-878a-42e2-ae78-35ec95e07526","source":"wordfence","cve":"CVE-2022-23983","title":"WP Content Copy Protection <= 3.4.4  - Cross-Site Request Forgery to Setting Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc8e925-878a-42e2-ae78-35ec95e07526?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-copy-protection","name":"WP Content Copy Protection","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2022-02-16T08:04:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbc91abd-d865-45a2-bc37-f34cb10f1863","source":"wordfence","cve":"CVE-2015-9388","title":"mTouch Quiz <= 3.1.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbc91abd-d865-45a2-bc37-f34cb10f1863?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2015-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbcb648a-4a3e-4645-bd62-4415b1cf6516","source":"wordfence","cve":"CVE-2024-7573","title":"Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection","severity":"medium","cvss":5.3,"cwe":"CWE-88","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcb648a-4a3e-4645-bd62-4415b1cf6516?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-live-ajax-search","name":"Relevanssi Live Ajax Search","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T02:05:46Z"},{"id":"wordfence:bbcd1f31-4952-4c96-9080-804fc7d70c28","source":"wordfence","cve":"CVE-2026-13597","title":"QRcode Login for WeChat <= 1.3 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcd1f31-4952-4c96-9080-804fc7d70c28?source=api-prod","affected":[{"type":"plugin","slug":"qrcode-login-for-weixin","name":"\u5fae\u4fe1\u4e8c\u7ef4\u7801\u767b\u9646","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T16:53:04Z"},{"id":"wordfence:bbcdb70f-77db-48ab-ae23-c46caecdd3be","source":"wordfence","cve":"CVE-2026-3140","title":"Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcdb70f-77db-48ab-ae23-c46caecdd3be?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.8.15"}],"published":"2026-04-30T00:00:00Z","updated":"2026-05-01T11:18:50Z"},{"id":"wordfence:bbce4588-fbd2-4b75-8f67-51c7d02892be","source":"wordfence","cve":"CVE-2024-9615","title":"BulkPress <= 0.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbce4588-fbd2-4b75-8f67-51c7d02892be?source=api-prod","affected":[{"type":"plugin","slug":"bulkpress","name":"BulkPress","from":"*","from_inclusive":true,"to":"0.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:06:44Z","updated":"2024-11-16T03:20:49Z"},{"id":"wordfence:bbcefb55-f712-47a5-885a-b0feceaf20fd","source":"wordfence","cve":"CVE-2026-81782","title":"WP Docs <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbcefb55-f712-47a5-885a-b0feceaf20fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-09-09T00:00:00Z","updated":"2026-11-03T22:46:26Z"},{"id":"wordfence:bbd0fb22-a39c-43f5-a93c-976b7e49967b","source":"wordfence","cve":"CVE-2024-30470","title":"YITH WooCommerce Account Funds Premium <= 1.33.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd0fb22-a39c-43f5-a93c-976b7e49967b?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-account-funds-premium","name":"YITH WooCommerce Account Funds Premium","from":"*","from_inclusive":true,"to":"1.33.0","to_inclusive":true,"patched_in":"1.34.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:53:43Z"},{"id":"wordfence:bbd1e68f-1f84-40d6-9ecd-34280c3c5099","source":"wordfence","cve":"","title":"Yet Another Stars Rating <= 1.8.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd1e68f-1f84-40d6-9ecd-34280c3c5099?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2019-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbd48a92-dc8f-4f51-b799-f7cedac34661","source":"wordfence","cve":"CVE-2026-27363","title":"Bakery Autoresponder Addon <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd48a92-dc8f-4f51-b799-f7cedac34661?source=api-prod","affected":[{"type":"plugin","slug":"vc-autoresponder-addon","name":"Bakery Autoresponder Addon","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:47:09Z"},{"id":"wordfence:bbd580fe-dba4-4662-b7d5-cf0298279079","source":"wordfence","cve":"CVE-2026-57320","title":"BEAR \u2013 Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd580fe-dba4-4662-b7d5-cf0298279079?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:11:20Z"},{"id":"wordfence:bbd5e24f-2934-422e-a3bd-452e916c2ffb","source":"wordfence","cve":"CVE-2025-27274","title":"GPX Viewer <= 2.2.11 - Authenticated (Editor+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd5e24f-2934-422e-a3bd-452e916c2ffb?source=api-prod","affected":[{"type":"plugin","slug":"gpx-viewer","name":"GPX Viewer","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-10T14:19:07Z"},{"id":"wordfence:bbd641a4-a8cf-4e51-8675-53d867740ded","source":"wordfence","cve":"CVE-2021-42547","title":"Out-of-the-Box <= 1.20.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd641a4-a8cf-4e51-8675-53d867740ded?source=api-prod","affected":[{"type":"plugin","slug":"out-of-the-box","name":"Out-of-the-Box","from":"*","from_inclusive":true,"to":"1.20.3","to_inclusive":false,"patched_in":"1.20.3"}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbd7bce1-c447-4c47-a364-f2ffbff8c812","source":"wordfence","cve":"CVE-2025-52805","title":"Leyka <= 3.31.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd7bce1-c447-4c47-a364-f2ffbff8c812?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.31.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:40:36Z"},{"id":"wordfence:bbd7dcff-8a9f-40bd-b350-ad8dd7a85574","source":"wordfence","cve":"CVE-2025-58609","title":"Latest Post Shortcode <= 14.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd7dcff-8a9f-40bd-b350-ad8dd7a85574?source=api-prod","affected":[{"type":"plugin","slug":"latest-post-shortcode","name":"Latest Post Shortcode","from":"*","from_inclusive":true,"to":"14.0.3","to_inclusive":true,"patched_in":"14.10"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:25:21Z"},{"id":"wordfence:bbd8dc5f-7a62-4258-a13e-e5cec911fdc4","source":"wordfence","cve":"CVE-2024-38716","title":"Events Calendar for Google <= 2.1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbd8dc5f-7a62-4258-a13e-e5cec911fdc4?source=api-prod","affected":[{"type":"plugin","slug":"events-calendar-for-google","name":"Events Calendar for Google","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-07-11T00:00:00Z","updated":"2025-01-06T15:17:34Z"},{"id":"wordfence:bbda67a3-0413-4d8e-8157-84c9c87b8695","source":"wordfence","cve":"CVE-2026-4804","title":"Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695?source=api-prod","affected":[{"type":"theme","slug":"zakra","name":"Zakra","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-07-02T19:01:25Z","updated":"2026-07-03T07:53:10Z"},{"id":"wordfence:bbdca292-89b6-4e62-bc68-4fdcd57fd504","source":"wordfence","cve":"CVE-2018-18069","title":"WPML <= 3.6.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbdca292-89b6-4e62-bc68-4fdcd57fd504?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2018-10-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbdeaa77-72c9-4afc-8913-7a1e44cdeb82","source":"wordfence","cve":"CVE-2023-49754","title":"Bulk Edit Post Titles <= 5.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbdeaa77-72c9-4afc-8913-7a1e44cdeb82?source=api-prod","affected":[{"type":"plugin","slug":"bulk-edit-post-titles","name":"Bulk Edit Post Titles","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbe51f96-82b2-4091-acd8-a8131a47eb07","source":"wordfence","cve":"CVE-2024-11153","title":"Content Control \u2013 The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe51f96-82b2-4091-acd8-a8131a47eb07?source=api-prod","affected":[{"type":"plugin","slug":"content-control","name":"Content Control \u2013 The Ultimate Content Restriction Solution! Restrict Content, Create Conditional Blocks & More","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-03-04T21:25:08Z","updated":"2025-03-18T18:33:57Z"},{"id":"wordfence:bbe52266-9ee1-47a8-a6df-7057b29e8098","source":"wordfence","cve":"CVE-2025-14123","title":"Redux Framework <= 4.5.11 \u2013 Authenticated (Subscriber+) Privilege Escalation via Users Extension","severity":"medium","cvss":6.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe52266-9ee1-47a8-a6df-7057b29e8098?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"4.5.13"}],"published":"2026-10-08T19:22:12Z","updated":"2026-10-09T07:41:48Z"},{"id":"wordfence:bbe5d631-8f2a-49a9-aeb8-b9965a5875ca","source":"wordfence","cve":"CVE-2026-27095","title":"Bus Ticket Booking with Seat Reservation <= 5.6.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe5d631-8f2a-49a9-aeb8-b9965a5875ca?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2026-03-05T00:00:00Z","updated":"2026-07-31T12:15:56Z"},{"id":"wordfence:bbe64cd3-c5ca-4867-90de-4784510a1126","source":"wordfence","cve":"CVE-2026-86596","title":"s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"260927","to_inclusive":true,"patched_in":"261001"}],"published":"2026-11-02T08:59:41Z","updated":"2026-11-02T21:30:23Z"},{"id":"wordfence:bbe7beae-2803-463c-83ad-5a58c4a55a65","source":"wordfence","cve":"CVE-2026-6256","title":"Credits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe7beae-2803-463c-83ad-5a58c4a55a65?source=api-prod","affected":[{"type":"plugin","slug":"source-shortcode","name":"Credits Shortcode & Block","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2026-05-11T19:02:35Z","updated":"2026-09-10T15:13:04Z"},{"id":"wordfence:bbe87391-735a-48e3-be7f-024644c35e8c","source":"wordfence","cve":"CVE-2025-13835","title":"Arconix Shortcodes <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe87391-735a-48e3-be7f-024644c35e8c?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-12-01T00:00:00Z","updated":"2026-09-09T16:08:46Z"},{"id":"wordfence:bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5","source":"wordfence","cve":"CVE-2025-6213","title":"Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5?source=api-prod","affected":[{"type":"plugin","slug":"fastcgi-cache-purge-and-preload-nginx","name":"Nginx Cache Purge Preload","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-07-21T20:50:46Z","updated":"2025-07-25T14:58:14Z"},{"id":"wordfence:bbe92b43-ae83-408b-962d-4867d032e8dc","source":"wordfence","cve":"CVE-2025-3201","title":"Contact Form builder with drag & drop for WordPress \u2013 Kali Forms <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe92b43-ae83-408b-962d-4867d032e8dc?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2025-04-25T00:00:00Z","updated":"2025-06-13T17:25:09Z"},{"id":"wordfence:bbe973a3-a8bf-4037-9067-7cc0987291fe","source":"wordfence","cve":"CVE-2023-29431","title":"qTranslate X Cleanup and WPML Import <= 3.0.1 - Missing Authorization via clean_ajx","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe973a3-a8bf-4037-9067-7cc0987291fe?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate-to-wpml-export","name":"qTranslate X Cleanup and WPML Import","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbe99411-ba74-4e97-8d14-659897942906","source":"wordfence","cve":"CVE-2026-9172","title":"Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe99411-ba74-4e97-8d14-659897942906?source=api-prod","affected":[{"type":"plugin","slug":"devs-accounting","name":"Devs Accounting \u2013 Simple Accounting and Invoicing Solution","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-06-23T16:39:47Z","updated":"2026-07-22T20:40:52Z"},{"id":"wordfence:bbe9eed9-9a96-47da-95fa-b942817a9d4f","source":"wordfence","cve":"CVE-2017-14722","title":"WordPress Core < 4.8.2 - Directory Traversal via Customizer","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe9eed9-9a96-47da-95fa-b942817a9d4f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbeb32a8-5acf-4a68-859d-98652e8ff5d1","source":"wordfence","cve":"","title":"Email Before Download <= 3.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbeb32a8-5acf-4a68-859d-98652e8ff5d1?source=api-prod","affected":[{"type":"plugin","slug":"email-before-download","name":"Email Before Download","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2017-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a","source":"wordfence","cve":"CVE-2023-0814","title":"Profile Builder \u2013 User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bbf9a765-3718-4957-aa18-562654824fbf","source":"wordfence","cve":"CVE-2021-34636","title":"Countdown and CountUp, WooCommerce Sales Timers <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbf9a765-3718-4957-aa18-562654824fbf?source=api-prod","affected":[{"type":"plugin","slug":"countdown-wpdevart-extended","name":"Countdown and CountUp, WooCommerce Sales Timer","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2021-09-27T13:41:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc028a1f-00d2-42b7-bb89-68a2ef88435d","source":"wordfence","cve":"CVE-2026-115603","title":"Advanced Ads \u2013 Tracking < 4.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc028a1f-00d2-42b7-bb89-68a2ef88435d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads-tracking","name":"Advanced Ads \u2013 Tracking","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-04T21:33:47Z"},{"id":"wordfence:bc045440-a8ca-40d3-b198-421b197e6928","source":"wordfence","cve":"CVE-2022-29444","title":"Breeze \u2013 WordPress Cache Plugin <= 2.0.2 - Unprotected AJAX Actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc045440-a8ca-40d3-b198-421b197e6928?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-05-02T13:12:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc07432e-0f3b-411d-9e38-61e4ed1a854b","source":"wordfence","cve":"CVE-2025-68537","title":"Zota <= 1.3.14 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc07432e-0f3b-411d-9e38-61e4ed1a854b?source=api-prod","affected":[{"type":"theme","slug":"zota","name":"Zota - Elementor Multi-Purpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2025-12-27T00:00:00Z","updated":"2026-01-05T18:49:15Z"},{"id":"wordfence:bc0983d7-6c7e-41cb-8997-578d362d9c9f","source":"wordfence","cve":"CVE-2025-7654","title":"Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library","severity":"high","cvss":8.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0983d7-6c7e-41cb-8997-578d362d9c9f?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"},{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.11.0.2","to_inclusive":true,"patched_in":"3.11.1"}],"published":"2025-08-18T18:57:21Z","updated":"2025-08-19T07:26:28Z"},{"id":"wordfence:bc098f5d-3c59-4046-bce8-ac2586e6da19","source":"wordfence","cve":"CVE-2026-100108","title":"Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc098f5d-3c59-4046-bce8-ac2586e6da19?source=api-prod","affected":[{"type":"plugin","slug":"share-button","name":"Social Share Buttons","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2026-10-15T19:41:23Z","updated":"2026-10-16T07:44:03Z"},{"id":"wordfence:bc0d36f8-6569-49a1-b722-5cf57c4bb32a","source":"wordfence","cve":"CVE-2024-6307","title":"WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0d36f8-6569-49a1-b722-5cf57c4bb32a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.9","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"5.9.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"5.9.10"}],"published":"2024-06-24T00:00:00Z","updated":"2024-06-28T12:28:03Z"},{"id":"wordfence:bc0f883f-a6d7-4b23-9284-1a5e46ef396e","source":"wordfence","cve":"CVE-2025-6234","title":"Hostel <= 1.1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0f883f-a6d7-4b23-9284-1a5e46ef396e?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5.7","to_inclusive":true,"patched_in":"1.1.5.8"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T14:06:07Z"},{"id":"wordfence:bc112db6-fb80-4edd-be36-4aae81a656e4","source":"wordfence","cve":"CVE-2025-25143","title":"GlobalQuran <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc112db6-fb80-4edd-be36-4aae81a656e4?source=api-prod","affected":[{"type":"plugin","slug":"globalquran","name":"GlobalQuran","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:18:20Z"},{"id":"wordfence:bc11d6bc-d0e6-4ec8-9e7f-ca8a88b2a726","source":"wordfence","cve":"CVE-2026-65579","title":"Agricola - Agriculture & Organic Farm Theme <= 1.21.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc11d6bc-d0e6-4ec8-9e7f-ca8a88b2a726?source=api-prod","affected":[{"type":"theme","slug":"agricola","name":"Agricola - Agriculture & Organic Farm Theme","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:10Z"},{"id":"wordfence:bc121ed0-4cb3-4ba4-b693-413b1c25e4ca","source":"wordfence","cve":"CVE-2024-4939","title":"Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc121ed0-4cb3-4ba4-b693-413b1c25e4ca?source=api-prod","affected":[{"type":"plugin","slug":"weaverx-theme-support","name":"Weaver Xtreme Theme Support","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2024-06-04T19:18:53Z","updated":"2024-06-05T07:34:57Z"},{"id":"wordfence:bc1600b9-b590-47ca-b2d9-d521381da541","source":"wordfence","cve":"CVE-2026-15979","title":"Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1600b9-b590-47ca-b2d9-d521381da541?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"11.3.0","to_inclusive":true,"patched_in":"11.4.0"}],"published":"2026-08-04T16:45:36Z","updated":"2026-08-05T13:26:43Z"},{"id":"wordfence:bc17284e-65ea-4e67-aba9-3475f0174657","source":"wordfence","cve":"CVE-2024-12471","title":"Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc17284e-65ea-4e67-aba9-3475f0174657?source=api-prod","affected":[{"type":"plugin","slug":"post-saint","name":"Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T05:23:58Z"},{"id":"wordfence:bc176920-04c4-42c7-ab9c-683788e998dd","source":"wordfence","cve":"CVE-2024-47334","title":"Zoho Flow for WordPress <= 2.8.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc176920-04c4-42c7-ab9c-683788e998dd?source=api-prod","affected":[{"type":"plugin","slug":"zoho-flow","name":"Zoho Flow \u2013 No-Code Workflow Automation","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-09-26T00:00:00Z","updated":"2024-10-03T13:13:44Z"},{"id":"wordfence:bc1a233e-ea62-4fb0-98eb-6b2aa893555d","source":"wordfence","cve":"CVE-2026-104799","title":"Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1a233e-ea62-4fb0-98eb-6b2aa893555d?source=api-prod","affected":[{"type":"plugin","slug":"mobile-builder","name":"Mobile builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T21:31:34Z","updated":"2026-11-04T11:26:23Z"},{"id":"wordfence:bc1ab4f8-dccf-4d1b-90b8-828a7c6100c7","source":"wordfence","cve":"CVE-2025-69301","title":"PhotoMe <= 5.6.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1ab4f8-dccf-4d1b-90b8-828a7c6100c7?source=api-prod","affected":[{"type":"theme","slug":"photome","name":"PhotoMe | Photography Portfolio WordPress","from":"*","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:51:57Z"},{"id":"wordfence:bc1abdd7-d563-44af-86d3-58005706d624","source":"wordfence","cve":"CVE-2024-32520","title":"WPC Grouped Product for WooCommerce <= 4.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1abdd7-d563-44af-86d3-58005706d624?source=api-prod","affected":[{"type":"plugin","slug":"wpc-grouped-product","name":"WPC Grouped Product for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:20:56Z"},{"id":"wordfence:bc1dfd50-aeac-465a-a402-ba85c50fdfc5","source":"wordfence","cve":"CVE-2025-53288","title":"PlatiOnline Payments <= 7.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1dfd50-aeac-465a-a402-ba85c50fdfc5?source=api-prod","affected":[{"type":"plugin","slug":"plationline","name":"PlatiOnline Payments","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2025-06-27T00:00:00Z","updated":"2026-01-13T17:09:45Z"},{"id":"wordfence:bc1e657e-b35e-481e-9eb0-1ff6207f682c","source":"wordfence","cve":"CVE-2026-62081","title":"Flexible PDF Coupons \u2013 Gift Cards & Vouchers for WooCommerce <= 1.14.11 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc1e657e-b35e-481e-9eb0-1ff6207f682c?source=api-prod","affected":[{"type":"plugin","slug":"flexible-coupons","name":"Flexible PDF Coupons \u2013 Gift Cards & Vouchers for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.11","to_inclusive":true,"patched_in":"1.14.12"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:26:03Z"},{"id":"wordfence:bc200f72-072d-407d-9114-201241c244f2","source":"wordfence","cve":"CVE-2025-66155","title":"Questionar for Elementor <= 1.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc200f72-072d-407d-9114-201241c244f2?source=api-prod","affected":[{"type":"plugin","slug":"questionar-elementor","name":"Questionar \u2013 FAQ Accordions for Elementor","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:55:43Z"},{"id":"wordfence:bc20f303-cac3-4517-9c45-153c410a13af","source":"wordfence","cve":"CVE-2023-4941","title":"BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc20f303-cac3-4517-9c45-153c410a13af?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc22a8df-44be-477e-a3b6-67960bf442d3","source":"wordfence","cve":"CVE-2024-5224","title":"Easy Social Like Box \u2013 Popup \u2013 Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc22a8df-44be-477e-a3b6-67960bf442d3?source=api-prod","affected":[{"type":"plugin","slug":"cardoza-facebook-like-box","name":"Easy Social Like Box \u2013 Popup \u2013 Sidebar Widget","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2024-06-05T12:59:33Z","updated":"2024-07-08T20:35:41Z"},{"id":"wordfence:bc22ffe3-bd2a-4af8-84e7-5a53b68de141","source":"wordfence","cve":"CVE-2013-10024","title":"WordPress Exit Strategy <= 1.55 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc22ffe3-bd2a-4af8-84e7-5a53b68de141?source=api-prod","affected":[{"type":"plugin","slug":"exit-strategy","name":"WordPress Exit Strategy","from":"*","from_inclusive":true,"to":"1.55","to_inclusive":true,"patched_in":"1.59"}],"published":"2013-05-28T00:00:00Z","updated":"2024-08-09T15:52:31Z"},{"id":"wordfence:bc26ce1b-2427-4320-8363-f635ea02aece","source":"wordfence","cve":"CVE-2023-37393","title":"Atarim <= 3.9.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc26ce1b-2427-4320-8363-f635ea02aece?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"3.9.4"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc271261-8f9d-4c34-b2a0-298f8ced29f5","source":"wordfence","cve":"CVE-2026-28103","title":"Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc271261-8f9d-4c34-b2a0-298f8ced29f5?source=api-prod","affected":[{"type":"plugin","slug":"lbg_zoominoutslider","name":"Responsive Zoom In/Out Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"5.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:31:15Z"},{"id":"wordfence:bc2a66cb-ad13-428f-a25a-b2807450aa16","source":"wordfence","cve":"CVE-2024-9864","title":"EventPrime \u2013 Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2a66cb-ad13-428f-a25a-b2807450aa16?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.0.4.7","to_inclusive":true,"patched_in":"4.0.4.8"}],"published":"2024-10-23T00:00:00Z","updated":"2024-10-24T06:50:24Z"},{"id":"wordfence:bc2af96c-09c5-4ddf-a910-04291aeeef49","source":"wordfence","cve":"CVE-2018-0587","title":"Ultimate Member < 2.0.4 - Authenticated Unrestricted File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2af96c-09c5-4ddf-a910-04291aeeef49?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2018-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc2c3bdb-65b9-4e0b-899f-bd08077bc8ba","source":"wordfence","cve":"CVE-2023-34172","title":"WordPress Social Login <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2c3bdb-65b9-4e0b-899f-bd08077bc8ba?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-social-login","name":"WordPress Social Login","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc2cbf43-3e8a-4364-9355-6d6587204c1c","source":"wordfence","cve":"CVE-2023-47243","title":"MSHOP MY SITE <= 1.1.7 - Missing Authorization via update_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2cbf43-3e8a-4364-9355-6d6587204c1c?source=api-prod","affected":[{"type":"plugin","slug":"mshop-mysite","name":"\ucf54\ub4dc\uc5e0\uc0f5 \ub9c8\uc774\uc0ac\uc774\ud2b8 \u2013 MSHOP MY SITE","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2023-11-07T00:00:00Z","updated":"2025-08-15T14:30:39Z"},{"id":"wordfence:bc2db74d-61b9-498a-a0d8-e43466b06f37","source":"wordfence","cve":"CVE-2025-12934","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2db74d-61b9-498a-a0d8-e43466b06f37?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.4.1","to_inclusive":true,"patched_in":"2.9.4.2"}],"published":"2025-12-22T00:00:00Z","updated":"2025-12-23T09:20:03Z"},{"id":"wordfence:bc2e883b-fb91-425c-a779-89a34eed2ba8","source":"wordfence","cve":"CVE-2022-4103","title":"Royal Elementor Addons <=1.3.55 - Missing Authorization to Subscriber+ Arbitrary Post Creation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2e883b-fb91-425c-a779-89a34eed2ba8?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.56"}],"published":"2022-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc2ee795-39e5-48c2-ac2a-cfc520bdd857","source":"wordfence","cve":"CVE-2021-24854","title":"QR Redirector < 1.6.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2ee795-39e5-48c2-ac2a-cfc520bdd857?source=api-prod","affected":[{"type":"plugin","slug":"qr-redirector","name":"QR Redirector","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc308993-7fc5-41db-a396-f05e95fe47b8","source":"wordfence","cve":"CVE-2026-5436","title":"MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc308993-7fc5-41db-a396-f05e95fe47b8?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-04-08T07:57:15Z","updated":"2026-04-15T13:45:06Z"},{"id":"wordfence:bc36c9e4-5f6d-4cb8-85b3-f02e00b6d3cb","source":"wordfence","cve":"CVE-2026-39663","title":"TrueBooker <= 1.1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc36c9e4-5f6d-4cb8-85b3-f02e00b6d3cb?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-24T19:44:28Z"},{"id":"wordfence:bc38990f-0079-46de-8197-0187189d90d9","source":"wordfence","cve":"CVE-2023-29424","title":"ShiftController Employee Shift Scheduling <= 4.9.23 - Unauthenticated Stored Cross-Site Scripting via 'hc-title'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc38990f-0079-46de-8197-0187189d90d9?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.9.24"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc38d7ac-916a-4d6c-ad53-24c6dadc5436","source":"wordfence","cve":"CVE-2025-32645","title":"Custom Posts Order <= 4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc38d7ac-916a-4d6c-ad53-24c6dadc5436?source=api-prod","affected":[{"type":"plugin","slug":"custom-posts-order","name":"Custom Posts Order","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2025-04-09T00:00:00Z","updated":"2026-05-26T18:15:50Z"},{"id":"wordfence:bc3910e4-649f-45ab-876a-a4b04afac8d2","source":"wordfence","cve":"CVE-2024-1134","title":"SEOPress \u2013 On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3910e4-649f-45ab-876a-a4b04afac8d2?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.5.2.1","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-05-23T17:02:51Z","updated":"2024-05-24T05:31:00Z"},{"id":"wordfence:bc3b2645-7b57-4884-99c5-e37dbd4a9600","source":"wordfence","cve":"CVE-2026-3177","title":"Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3b2645-7b57-4884-99c5-e37dbd4a9600?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.9.7","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2026-04-06T18:46:47Z","updated":"2026-04-07T07:40:14Z"},{"id":"wordfence:bc3b5faa-1a29-4fa7-9146-d782adce0b1f","source":"wordfence","cve":"CVE-2026-1672","title":"BEAR \u2013 Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3b5faa-1a29-4fa7-9146-d782adce0b1f?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-04-07T00:00:00Z","updated":"2026-07-16T18:10:56Z"},{"id":"wordfence:bc3bc600-7d5e-4a4a-be09-461492cbbb50","source":"wordfence","cve":"CVE-2026-91049","title":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3bc600-7d5e-4a4a-be09-461492cbbb50?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"8.7.4","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:10:51Z"},{"id":"wordfence:bc3bc6e8-aae7-451e-b26a-cc5e8fcd0a33","source":"wordfence","cve":"CVE-2015-9307","title":"WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3bc6e8-aae7-451e-b26a-cc5e8fcd0a33?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc3efc42-7cf5-4dcd-9653-891deaae19c3","source":"wordfence","cve":"CVE-2020-24186","title":"Comments - wpDiscuz 7.0 - 7.0.4 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3efc42-7cf5-4dcd-9653-891deaae19c3?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"7.0.5"}],"published":"2021-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc3f1d4e-84f7-4878-8b06-10444caa7dcf","source":"wordfence","cve":"CVE-2023-41853","title":"WP iCal Availability <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3f1d4e-84f7-4878-8b06-10444caa7dcf?source=api-prod","affected":[{"type":"plugin","slug":"wp-ical-availability","name":"WP iCal Availability","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc406e8a-c4eb-45c3-a53c-37644e0dabfa","source":"wordfence","cve":"CVE-2025-4203","title":"wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc406e8a-c4eb-45c3-a53c-37644e0dabfa?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T06:49:25Z"},{"id":"wordfence:bc41039e-20cc-47d7-ab8e-da0d9168de22","source":"wordfence","cve":"CVE-2025-69098","title":"Hide My WP <= 6.2.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc41039e-20cc-47d7-ab8e-da0d9168de22?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"6.2.12","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:43:32Z"},{"id":"wordfence:bc425c4a-cb4e-4f50-b85b-8c4c7778c073","source":"wordfence","cve":"CVE-2026-1396","title":"Magic Conversation For Gravity Forms <= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc425c4a-cb4e-4f50-b85b-8c4c7778c073?source=api-prod","affected":[{"type":"plugin","slug":"magic-conversation-for-gravity-forms","name":"Magic Conversation For Gravity Forms","from":"*","from_inclusive":true,"to":"3.0.97","to_inclusive":true,"patched_in":"3.0.98"}],"published":"2026-04-07T19:53:11Z","updated":"2026-04-08T08:23:44Z"},{"id":"wordfence:bc42d879-9df5-4cbd-85a8-964213fd513e","source":"wordfence","cve":"CVE-2025-39423","title":"Add to Header <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc42d879-9df5-4cbd-85a8-964213fd513e?source=api-prod","affected":[{"type":"plugin","slug":"add-to-header","name":"Add to Header","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:30:20Z"},{"id":"wordfence:bc442f79-f682-4311-89fd-f447da1a2ab8","source":"wordfence","cve":"CVE-2025-66059","title":"Seriously Simple Podcasting <= 3.13.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc442f79-f682-4311-89fd-f447da1a2ab8?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2025-11-09T00:00:00Z","updated":"2025-11-25T15:37:14Z"},{"id":"wordfence:bc44c95e-9ca0-46d0-8315-72612ef3f855","source":"wordfence","cve":"CVE-2023-2556","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc44c95e-9ca0-46d0-8315-72612ef3f855?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc491c2b-0ae2-4002-a745-435a183d8e01","source":"wordfence","cve":"CVE-2022-2655","title":"Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc491c2b-0ae2-4002-a745-435a183d8e01?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing-pro","name":"Classified Listing Pro - Classified ads & Business Directory Plugin","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":false,"patched_in":"2.0.20"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc4bfa81-c781-42df-91c7-3daed1e6a6f4","source":"wordfence","cve":"CVE-2014-4606","title":"Zeenshare <= 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc4bfa81-c781-42df-91c7-3daed1e6a6f4?source=api-prod","affected":[{"type":"plugin","slug":"zeenshare","name":"zeenshare","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc50237f-5e47-4ab7-bd51-02e93a15dd90","source":"wordfence","cve":"CVE-2026-119484","title":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox <= 1.21.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc50237f-5e47-4ab7-bd51-02e93a15dd90?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.21.6","to_inclusive":true,"patched_in":"1.21.7"}],"published":"2026-11-07T09:11:00Z","updated":"2026-11-10T19:26:48Z"},{"id":"wordfence:bc503fac-1ae6-400a-b19d-d88f0016b8aa","source":"wordfence","cve":"CVE-2026-119059","title":"Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc503fac-1ae6-400a-b19d-d88f0016b8aa?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"12.0.0","to_inclusive":true,"patched_in":"12.1.0"}],"published":"2026-10-29T17:02:37Z","updated":"2026-10-30T05:35:52Z"},{"id":"wordfence:bc509aa6-b2e3-4589-8a26-a494c4be31f4","source":"wordfence","cve":"CVE-2026-65531","title":"Qubely \u2013 Advanced Gutenberg Blocks <= 1.8.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc509aa6-b2e3-4589-8a26-a494c4be31f4?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-11-10T09:47:17Z"},{"id":"wordfence:bc51ccec-558c-4155-a309-badf99202ce1","source":"wordfence","cve":"CVE-2026-32352","title":"Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc51ccec-558c-4155-a309-badf99202ce1?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.35.5","to_inclusive":true,"patched_in":"3.35.6"}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:04:22Z"},{"id":"wordfence:bc524e3e-9b7c-47ae-ab44-c327b287b81a","source":"wordfence","cve":"CVE-2025-12426","title":"Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.80","to_inclusive":true,"patched_in":"6.7.0.81"}],"published":"2025-11-18T15:41:24Z","updated":"2025-11-19T04:28:20Z"},{"id":"wordfence:bc53ad70-d630-4d4a-bcca-79732134e6a6","source":"wordfence","cve":"CVE-2022-1581","title":"WP-Polls <= 2.75.6 - IP Validation Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc53ad70-d630-4d4a-bcca-79732134e6a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.75.6","to_inclusive":true,"patched_in":"2.76.0"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc547d3d-9b08-472a-937d-d9c815c33087","source":"wordfence","cve":"CVE-2025-32592","title":"TableOn \u2013 WordPress Posts Table Filterable <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc547d3d-9b08-472a-937d-d9c815c33087?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:37:47Z"},{"id":"wordfence:bc552d46-79ca-4540-8620-5a031238cd62","source":"wordfence","cve":"CVE-2026-1236","title":"Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc552d46-79ca-4540-8620-5a031238cd62?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-03-03T20:19:00Z","updated":"2026-03-04T08:24:03Z"},{"id":"wordfence:bc56fe18-f0f4-4f7b-96c2-40d376e0fd74","source":"wordfence","cve":"","title":"Daily Inspiration Generator <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc56fe18-f0f4-4f7b-96c2-40d376e0fd74?source=api-prod","affected":[{"type":"plugin","slug":"daily-inspiration-generator","name":"Daily Inspiration Generator","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc5886e8-a520-48e4-9976-2e92b37e4bdf","source":"wordfence","cve":"","title":"WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details","severity":"medium","cvss":4.3,"cwe":"CWE-835","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5886e8-a520-48e4-9976-2e92b37e4bdf?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.37","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.32","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.33","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.26","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.28","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.25","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.23","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.21","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.18","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.16","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"4.7.38"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:05:07Z"},{"id":"wordfence:bc590a99-0c9d-4c38-b7ec-b8a0dc7f6f0a","source":"wordfence","cve":"CVE-2014-4546","title":"Rezgo Online Booking < 1.4.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc590a99-0c9d-4c38-b7ec-b8a0dc7f6f0a?source=api-prod","affected":[{"type":"plugin","slug":"rezgo","name":"Rezgo Online Booking","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc59b997-a8e2-4c75-aa5f-36cc5a66326e","source":"wordfence","cve":"CVE-2023-47664","title":"Plainview Protect Passwords <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc59b997-a8e2-4c75-aa5f-36cc5a66326e?source=api-prod","affected":[{"type":"plugin","slug":"plainview-protect-passwords","name":"Plainview Protect Passwords","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc5c7974-4c10-4880-8823-2accee3c0da4","source":"wordfence","cve":"CVE-2025-1785","title":"Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5c7974-4c10-4880-8823-2accee3c0da4?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.08","to_inclusive":true,"patched_in":"3.3.09"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T07:31:39Z"},{"id":"wordfence:bc5cd81b-3182-45fb-a93a-471ecf770e42","source":"wordfence","cve":"CVE-2024-52385","title":"Team Member <= 7.4 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5cd81b-3182-45fb-a93a-471ecf770e42?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-supreme","name":"Team Members \u2013 Multi Language Supported Team Plugin","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.5"}],"published":"2024-11-11T00:00:00Z","updated":"2025-01-22T22:56:08Z"},{"id":"wordfence:bc5da189-838d-4c0b-a734-283c4da36473","source":"wordfence","cve":"CVE-2024-2222","title":"Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5da189-838d-4c0b-a734-283c4da36473?source=api-prod","affected":[{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-09T18:59:18Z"},{"id":"wordfence:bc5e3932-809c-46d7-bb8d-1dffac9877a4","source":"wordfence","cve":"CVE-2020-12077","title":"MapPress Maps for WordPress <=2.53.8 - Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5e3932-809c-46d7-bb8d-1dffac9877a4?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.53.9","to_inclusive":false,"patched_in":"2.53.9"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc5ef2cf-8b97-4aca-8e90-bb0a19788e4e","source":"wordfence","cve":"CVE-2024-43316","title":"Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5ef2cf-8b97-4aca-8e90-bb0a19788e4e?source=api-prod","affected":[{"type":"plugin","slug":"checkout-plugins-stripe-woo","name":"Stripe Payments For WooCommerce by Checkout Plugins","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:13:37Z"},{"id":"wordfence:bc5f1b00-acee-4dc8-acd7-2d3f3493f253","source":"wordfence","cve":"CVE-2023-5538","title":"MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5f1b00-acee-4dc8-acd7-2d3f3493f253?source=api-prod","affected":[{"type":"plugin","slug":"mpoperationlogs","name":"mpOperationLogs","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc611a4b-f3eb-48ed-8904-27124775ed29","source":"wordfence","cve":"CVE-2025-30821","title":"SNORDIAN's H5PxAPIkatchu <= 0.4.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc611a4b-f3eb-48ed-8904-27124775ed29?source=api-prod","affected":[{"type":"plugin","slug":"h5pxapikatchu","name":"SNORDIAN's H5PxAPIkatchu","from":"*","from_inclusive":true,"to":"0.4.14","to_inclusive":true,"patched_in":"0.4.15"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:17:37Z"},{"id":"wordfence:bc643a55-be6a-4a59-a267-be613ca4a55d","source":"wordfence","cve":"CVE-2025-53458","title":"Goracash <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc643a55-be6a-4a59-a267-be613ca4a55d?source=api-prod","affected":[{"type":"plugin","slug":"goracash","name":"Goracash","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T13:53:36Z"},{"id":"wordfence:bc656765-1eac-4a96-99e9-c22d64984923","source":"wordfence","cve":"CVE-2026-9701","title":"Eventer <= 4.4.4 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc656765-1eac-4a96-99e9-c22d64984923?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2026-07-07T16:30:46Z","updated":"2026-08-18T20:33:34Z"},{"id":"wordfence:bc65d760-a060-4ff2-b3fd-663c2f9ab4ed","source":"wordfence","cve":"CVE-2026-42697","title":"Social Share Icons & Social Share Buttons <= 3.7.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc65d760-a060-4ff2-b3fd-663c2f9ab4ed?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T17:02:54Z"},{"id":"wordfence:bc660a2d-9f9b-4ec1-b27a-74a41b528afa","source":"wordfence","cve":"CVE-2026-18443","title":"Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc660a2d-9f9b-4ec1-b27a-74a41b528afa?source=api-prod","affected":[{"type":"plugin","slug":"smart-manager-for-wp-e-commerce","name":"Smart Manager \u2013 WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)","from":"*","from_inclusive":true,"to":"8.97.0","to_inclusive":true,"patched_in":"8.98.0"}],"published":"2026-10-02T17:34:31Z","updated":"2026-10-03T06:38:25Z"},{"id":"wordfence:bc67ff08-b660-477a-9457-b681cf0381f5","source":"wordfence","cve":"CVE-2022-3128","title":"Donation Thermometer <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc67ff08-b660-477a-9457-b681cf0381f5?source=api-prod","affected":[{"type":"plugin","slug":"donation-thermometer","name":"Donation Thermometer","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2022-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc684cd2-f01a-4c2d-b979-a47b83d01bd2","source":"wordfence","cve":"CVE-2019-12566","title":"WP Statistics <= 12.6.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc684cd2-f01a-4c2d-b979-a47b83d01bd2?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.6.5","to_inclusive":true,"patched_in":"12.6.6.1"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc698c40-4a2b-4dab-93f0-647e4db79d2c","source":"wordfence","cve":"CVE-2023-40333","title":"Bridge Core <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc698c40-4a2b-4dab-93f0-647e4db79d2c?source=api-prod","affected":[{"type":"plugin","slug":"bridge-core","name":"Bridge Core","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-08-29T00:00:00Z","updated":"2024-08-07T14:22:33Z"},{"id":"wordfence:bc69ec54-b30f-402e-ad3b-24fd680ea72b","source":"wordfence","cve":"","title":"Groundhogg <= 1.3.11.13 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc69ec54-b30f-402e-ad3b-24fd680ea72b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"1.3.11.13","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2019-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc6a8c0e-1136-41ff-bfc2-450434aa6326","source":"wordfence","cve":"CVE-2020-4048","title":"WordPress Core < 5.4.2 - Open Redirect","severity":"medium","cvss":5.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc6a8c0e-1136-41ff-bfc2-450434aa6326?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.33","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.31","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.30","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.27","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.23","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.22","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.21","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.18","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.17","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.13","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.14","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"3.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"3.7.34"}],"published":"2020-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc6cfad1-d23a-4a96-9d6c-841b6d795a01","source":"wordfence","cve":"CVE-2023-41802","title":"Super Socializer <= 7.13.54 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc6cfad1-d23a-4a96-9d6c-841b6d795a01?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.54","to_inclusive":true,"patched_in":"7.13.55"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc6fce33-af42-466e-8e76-1e027d5d52ec","source":"wordfence","cve":"CVE-2024-48032","title":"Featured Posts with Multiple Custom Groups (FPMCG) <= 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc6fce33-af42-466e-8e76-1e027d5d52ec?source=api-prod","affected":[{"type":"plugin","slug":"featured-posts-with-multiple-custom-groups-fpmcg","name":"Featured Posts with Multiple Custom Groups (FPMCG)","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:48:28Z"},{"id":"wordfence:bc72fc26-c291-4e57-8038-babaa51c1b73","source":"wordfence","cve":"CVE-2024-52382","title":"Matix Popup Builder <= 1.0.0 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc72fc26-c291-4e57-8038-babaa51c1b73?source=api-prod","affected":[{"type":"plugin","slug":"medma-matix","name":"Matix Popup Builder","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T14:02:11Z"},{"id":"wordfence:bc7384d7-c2fd-4d63-9b80-bb5bde9a23d5","source":"wordfence","cve":"CVE-2023-6990","title":"Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7384d7-c2fd-4d63-9b80-bb5bde9a23d5?source=api-prod","affected":[{"type":"theme","slug":"weaver-xtreme","name":"Weaver Xtreme","from":"*","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.4"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:17Z"},{"id":"wordfence:bc743651-cfbc-487b-9d1b-9aab6d3a57b7","source":"wordfence","cve":"CVE-2026-96766","title":"GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc743651-cfbc-487b-9d1b-9aab6d3a57b7?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.183","to_inclusive":true,"patched_in":"2.8.184"}],"published":"2026-09-24T18:21:29Z","updated":"2026-09-25T06:39:55Z"},{"id":"wordfence:bc74d1a3-5066-4b06-bfed-3b018e844126","source":"wordfence","cve":"CVE-2026-22484","title":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme <= 1.5.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc74d1a3-5066-4b06-bfed-3b018e844126?source=api-prod","affected":[{"type":"plugin","slug":"lisfinity-core","name":"Lisfinity Core - Lisfinity Core plugin used for pebas\u00ae Lisfinity WordPress theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:21:32Z"},{"id":"wordfence:bc79e104-47c0-4f4a-9a7b-dc0d6337ea05","source":"wordfence","cve":"CVE-2022-44736","title":"Chameleon <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc79e104-47c0-4f4a-9a7b-dc0d6337ea05?source=api-prod","affected":[{"type":"plugin","slug":"chameleon","name":"Chameleon","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc7d57d0-8e7f-4be8-9e8d-3e300122c355","source":"wordfence","cve":"CVE-2026-97241","title":"BackupEase \u2013 Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7d57d0-8e7f-4be8-9e8d-3e300122c355?source=api-prod","affected":[{"type":"plugin","slug":"backupease","name":"BackupEase \u2013 Scheduled Backup, Restore & Site Migration","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2026-09-29T10:02:42Z","updated":"2026-10-08T23:57:04Z"},{"id":"wordfence:bc7e6844-23e2-4523-8261-21d4cba87db3","source":"wordfence","cve":"CVE-2023-52181","title":"Theme per user <= 1.0.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7e6844-23e2-4523-8261-21d4cba87db3?source=api-prod","affected":[{"type":"plugin","slug":"theme-per-user","name":"Theme per user","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc7f0a74-332d-40d2-8021-4d1bf90d0d0e","source":"wordfence","cve":"CVE-2026-19075","title":"All-in-One Video Gallery <= 4.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7f0a74-332d-40d2-8021-4d1bf90d0d0e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-21T15:50:40Z"},{"id":"wordfence:bc7fab0a-78bc-4ca8-86f9-19785b00ba65","source":"wordfence","cve":"CVE-2026-4357","title":"Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7fab0a-78bc-4ca8-86f9-19785b00ba65?source=api-prod","affected":[{"type":"plugin","slug":"embed-html5-game","name":"Embed HTML5 Game","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T00:00:00Z","updated":"2026-09-16T15:32:50Z"},{"id":"wordfence:bc82745a-f1d3-48fc-ba7b-3ff726edae34","source":"wordfence","cve":"CVE-2024-31243","title":"Bricksforge <= 2.0.17 - Missing Authorization to Unauthenticated WordPress Settings Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc82745a-f1d3-48fc-ba7b-3ff726edae34?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:42:37Z"},{"id":"wordfence:bc84ca1f-747d-444e-b997-a79731b7ab51","source":"wordfence","cve":"CVE-2026-32392","title":"Greenly <= 8.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc84ca1f-747d-444e-b997-a79731b7ab51?source=api-prod","affected":[{"type":"theme","slug":"greenly","name":"Greenly - Ecology & Solar Energy WordPress Theme","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T15:52:46Z"},{"id":"wordfence:bc860f44-c8ee-4b32-9702-7214e213790b","source":"wordfence","cve":"CVE-2022-0679","title":"Narnoo Distributor <= 2.5.1 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc860f44-c8ee-4b32-9702-7214e213790b?source=api-prod","affected":[{"type":"plugin","slug":"narnoo-distributor","name":"Narnoo Distributor","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2022-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc883e7e-af82-47e1-a0c0-122e6abd6b52","source":"wordfence","cve":"CVE-2024-13447","title":"WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc883e7e-af82-47e1-a0c0-122e6abd6b52?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-01-21T22:18:16Z","updated":"2025-01-22T11:07:59Z"},{"id":"wordfence:bc8ccaee-058b-476f-9d92-08db23df024b","source":"wordfence","cve":"CVE-2025-4652","title":"Broadstreet Ads <= 1.51.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc8ccaee-058b-476f-9d92-08db23df024b?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.51.7","to_inclusive":true,"patched_in":"1.51.8"}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-17T14:59:15Z"},{"id":"wordfence:bc8ccdd2-062e-4413-bede-c73b8e2a7f70","source":"wordfence","cve":"CVE-2026-91830","title":"Subscribe to Comments <= 2.3.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc8ccdd2-062e-4413-bede-c73b8e2a7f70?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:44:59Z"},{"id":"wordfence:bc8dffc2-ae5b-4482-9eba-adc439a52c26","source":"wordfence","cve":"CVE-2026-14805","title":"Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc8dffc2-ae5b-4482-9eba-adc439a52c26?source=api-prod","affected":[{"type":"theme","slug":"consulting","name":"Consulting - Business, Finance WordPress Theme","from":"*","from_inclusive":true,"to":"6.7.16","to_inclusive":true,"patched_in":"6.7.17"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T13:03:44Z"},{"id":"wordfence:bc903082-1047-4272-9ab8-3341b61d0378","source":"wordfence","cve":"CVE-2025-30537","title":"Upload Quota per User <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc903082-1047-4272-9ab8-3341b61d0378?source=api-prod","affected":[{"type":"plugin","slug":"upload-quota-per-user","name":"Upload Quota per User","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:44:37Z"},{"id":"wordfence:bc91449a-7013-430d-bf7c-70175ea45114","source":"wordfence","cve":"","title":"LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc91449a-7013-430d-bf7c-70175ea45114?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.2.7.3","to_inclusive":false,"patched_in":"3.2.7.3"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc927a93-0cb2-4211-9f93-c0671039011e","source":"wordfence","cve":"CVE-2025-12197","title":"The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc927a93-0cb2-4211-9f93-c0671039011e?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"6.15.1.1","from_inclusive":true,"to":"6.15.9","to_inclusive":true,"patched_in":"6.15.10"}],"published":"2025-11-04T16:25:23Z","updated":"2025-11-05T04:37:00Z"},{"id":"wordfence:bc96bbc5-b4ad-4076-a0dd-13e3407b9d76","source":"wordfence","cve":"CVE-2025-62952","title":"ChatBot <= 7.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc96bbc5-b4ad-4076-a0dd-13e3407b9d76?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"7.7.3","to_inclusive":true,"patched_in":"7.7.4"}],"published":"2025-10-13T00:00:00Z","updated":"2026-02-03T20:04:15Z"},{"id":"wordfence:bc972855-6bd5-43cd-96e6-3b1aa1c6255b","source":"wordfence","cve":"CVE-2022-3334","title":"Easy WP SMTP <= 1.4.9 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc972855-6bd5-43cd-96e6-3b1aa1c6255b?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-smtp","name":"Easy WP SMTP \u2013 WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc9883b7-ea99-41e4-adf6-a3988f616a3f","source":"wordfence","cve":"CVE-2026-107746","title":"FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.16.0.6","to_inclusive":true,"patched_in":"3.17.0"}],"published":"2026-10-15T15:40:24Z","updated":"2026-10-16T04:27:04Z"},{"id":"wordfence:bc9a2639-cec8-408e-9ba2-ffb6c8c7da21","source":"wordfence","cve":"CVE-2023-25039","title":"Google Maps CP <= 1.0.43 - Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9a2639-cec8-408e-9ba2-ffb6c8c7da21?source=api-prod","affected":[{"type":"plugin","slug":"codepeople-post-map","name":"CodePeople Post Map for Google Maps","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":"1.0.44"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bc9c450b-c762-4955-b782-784594552ab9","source":"wordfence","cve":"CVE-2026-42719","title":"Dynamic User Directory <= 2.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9c450b-c762-4955-b782-784594552ab9?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-user-directory","name":"Dynamic User Directory","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:25:25Z"},{"id":"wordfence:bc9e728a-5aae-487c-bd17-e78141084f10","source":"wordfence","cve":"CVE-2025-10124","title":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9e728a-5aae-487c-bd17-e78141084f10?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2025-09-19T00:00:00Z","updated":"2025-10-16T14:03:16Z"},{"id":"wordfence:bc9efc98-7815-4b9b-a180-71f1095c9b0a","source":"wordfence","cve":"CVE-2021-34663","title":"jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9efc98-7815-4b9b-a180-71f1095c9b0a?source=api-prod","affected":[{"type":"plugin","slug":"jquery-tagline-rotator","name":"jQuery Tagline Rotator","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bca0bc1d-c373-4ccf-928e-14f3bd4bc53c","source":"wordfence","cve":"CVE-2025-32309","title":"Healsoul <= 2.2.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca0bc1d-c373-4ccf-928e-14f3bd4bc53c?source=api-prod","affected":[{"type":"theme","slug":"healsoul","name":"Healsoul - Medical Care, Home Healthcare Service WP Theme","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-26T15:11:32Z"},{"id":"wordfence:bca0e8a0-d837-42d8-a9d3-35e0c820eb43","source":"wordfence","cve":"CVE-2023-7029","title":"WordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca0e8a0-d837-42d8-a9d3-35e0c820eb43?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.7.6","to_inclusive":true,"patched_in":"9.7.7"}],"published":"2024-01-23T00:00:00Z","updated":"2024-07-29T21:37:17Z"},{"id":"wordfence:bca16579-d852-4c68-932e-44b69a01b8ce","source":"wordfence","cve":"CVE-2026-31914","title":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.26 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca16579-d852-4c68-932e-44b69a01b8ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-courses","name":"WP Courses LMS \u2013 Online Courses Builder, eLearning Courses, Courses Solution, Education Courses","from":"*","from_inclusive":true,"to":"3.2.26","to_inclusive":true,"patched_in":"3.2.27"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:26:40Z"},{"id":"wordfence:bca1664e-5911-4c06-8ae2-1830b0c376fa","source":"wordfence","cve":"CVE-2025-67579","title":"User Extra Fields <= 16.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca1664e-5911-4c06-8ae2-1830b0c376fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.8","to_inclusive":true,"patched_in":"16.9"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:19:02Z"},{"id":"wordfence:bca37dc1-64a7-4265-bd38-d58844140336","source":"wordfence","cve":"CVE-2025-32238","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.2 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca37dc1-64a7-4265-bd38-d58844140336?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-20T19:48:38Z"},{"id":"wordfence:bca41dd8-5bd3-4fee-9f3f-feb8f1a4c687","source":"wordfence","cve":"CVE-2025-1502","title":"IP2Location Redirection <= 1.33.3 - Missing Authorization to Unauthenticated Settings Export","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca41dd8-5bd3-4fee-9f3f-feb8f1a4c687?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-redirection","name":"IP2Location Redirection","from":"*","from_inclusive":true,"to":"1.33.3","to_inclusive":true,"patched_in":"1.33.4"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T06:39:29Z"},{"id":"wordfence:bca8b173-8e7c-41ad-9316-b38cc2ce0e66","source":"wordfence","cve":"CVE-2022-45355","title":"WP Pipes <= 1.33 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca8b173-8e7c-41ad-9316-b38cc2ce0e66?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.1","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.10","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.11","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.12","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.13","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.14","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.15","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.16","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.17","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.18","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.19","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.2","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.20","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.21","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.22","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.23","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.24","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.25","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.26","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.27","from_inclusive":true,"to":"1.27","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.28","from_inclusive":true,"to":"1.28","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.29","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.3","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.30","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.31","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.32","from_inclusive":true,"to":"1.32","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.33","from_inclusive":true,"to":"1.33","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.4","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.5","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.6","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.7","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.8","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"1.9","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bca9d9a2-6c96-4653-9408-2e20f4a9d5f4","source":"wordfence","cve":"CVE-2026-39626","title":"Armania <= 1.4.8 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bca9d9a2-6c96-4653-9408-2e20f4a9d5f4?source=api-prod","affected":[{"type":"theme","slug":"armania","name":"Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T15:26:03Z"},{"id":"wordfence:bcaa19b0-2d55-4a0c-98e7-9a38488dd922","source":"wordfence","cve":"CVE-2023-24412","title":"Image Social Feed Plugin <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaa19b0-2d55-4a0c-98e7-9a38488dd922?source=api-prod","affected":[{"type":"plugin","slug":"add-instagram","name":"Image Social Feed Plugin","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcaa5d0e-b764-4566-bd46-2d41dc391c36","source":"wordfence","cve":"CVE-2021-4372","title":"WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaa5d0e-b764-4566-bd46-2d41dc391c36?source=api-prod","affected":[{"type":"plugin","slug":"wc-dynamic-pricing-and-discounts","name":"WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2021-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcac3b4e-b80f-4201-9e56-8990013c4ab9","source":"wordfence","cve":"CVE-2018-15876","title":"Ajax BootModal Login <= 1.4.3 - CAPTCHA Reuse","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcac3b4e-b80f-4201-9e56-8990013c4ab9?source=api-prod","affected":[{"type":"plugin","slug":"ajax-bootmodal-login","name":"Ajax BootModal Login","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2018-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcad1d05-96a1-4559-9957-fce93c287c07","source":"wordfence","cve":"CVE-2025-58265","title":"Events Manager &#8211; OpenStreetMaps <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcad1d05-96a1-4559-9957-fce93c287c07?source=api-prod","affected":[{"type":"plugin","slug":"stonehenge-em-osm","name":"Events Manager \u2013 OpenStreetMaps","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:41:25Z"},{"id":"wordfence:bcad7322-a5d9-4d72-9983-276f9c05c27d","source":"wordfence","cve":"CVE-2019-14799","title":"FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcad7322-a5d9-4d72-9983-276f9c05c27d?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.3.13.727","to_inclusive":true,"patched_in":"7.3.14.727"}],"published":"2019-05-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcae549f-6a10-4b0d-a8d1-5dcc83e1f2e5","source":"wordfence","cve":"CVE-2026-15670","title":"SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcae549f-6a10-4b0d-a8d1-5dcc83e1f2e5?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-07-27T18:24:07Z","updated":"2026-07-28T06:54:35Z"},{"id":"wordfence:bcaf9b92-5e59-47c5-a04e-3ef5c53a2640","source":"wordfence","cve":"","title":"Tutor LMS \u2013 eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaf9b92-5e59-47c5-a04e-3ef5c53a2640?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"2.0.0","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcaff8ab-2db9-4d91-9b7a-f7f49f5952b9","source":"wordfence","cve":"CVE-2026-1706","title":"All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaff8ab-2db9-4d91-9b7a-f7f49f5952b9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2026-03-03T20:24:19Z","updated":"2026-03-04T09:24:33Z"},{"id":"wordfence:bcb68038-96a6-40b6-a37c-757fc19cbe0c","source":"wordfence","cve":"CVE-2022-25306","title":"WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via browser","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcb68038-96a6-40b6-a37c-757fc19cbe0c?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcb756d0-425e-48ae-bd7f-ec9404679aea","source":"wordfence","cve":"","title":"Feedweb <= 3.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcb756d0-425e-48ae-bd7f-ec9404679aea?source=api-prod","affected":[{"type":"plugin","slug":"feedweb","name":"Feedweb","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2014-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcb82472-e18c-447e-acad-796724188515","source":"wordfence","cve":"","title":"WP Private Content Plus <= 3.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcb82472-e18c-447e-acad-796724188515?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2023-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcbb65eb-28f8-4b09-abc9-0f8b7d050f2f","source":"wordfence","cve":"CVE-2025-30789","title":"Clearout Email Validator <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbb65eb-28f8-4b09-abc9-0f8b7d050f2f?source=api-prod","affected":[{"type":"plugin","slug":"clearout-email-validator","name":"Clearout Email Validator \u2013 Real-Time Email Verification on WordPress Forms","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:29:31Z"},{"id":"wordfence:bcbb6614-09fc-4f41-81f7-d70aa92101bf","source":"wordfence","cve":"CVE-2022-0590","title":"BulletProof Security <= 5.7 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbb6614-09fc-4f41-81f7-d70aa92101bf?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":"5.8","to_inclusive":false,"patched_in":"5.8"}],"published":"2022-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcbb7d4d-5b4c-47d3-a815-bd9e026fc03d","source":"wordfence","cve":"CVE-2025-49962","title":"bbPress Notify <= 2.19.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbb7d4d-5b4c-47d3-a815-bd9e026fc03d?source=api-prod","affected":[{"type":"plugin","slug":"bbpress-notify-nospam","name":"bbPress Notify (No-Spam)","from":"*","from_inclusive":true,"to":"2.19.5","to_inclusive":true,"patched_in":"2.20"}],"published":"2025-07-19T00:00:00Z","updated":"2025-11-24T19:34:47Z"},{"id":"wordfence:bcbbbd31-3205-4466-96f5-f9cd7e7cf083","source":"wordfence","cve":"CVE-2025-60220","title":"CouponXxL <= 3.0.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbbbd31-3205-4466-96f5-f9cd7e7cf083?source=api-prod","affected":[{"type":"theme","slug":"couponxxl","name":"CouponXxL","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-11-04T16:52:09Z"},{"id":"wordfence:bcbc8ce6-5eb7-4599-b844-72eb2ff3093c","source":"wordfence","cve":"CVE-2024-5878","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbc8ce6-5eb7-4599-b844-72eb2ff3093c?source=api-prod","affected":[{"type":"plugin","slug":"simplelightbox","name":"Simplelightbox","from":"*","from_inclusive":true,"to":"2.14.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.4","to_inclusive":true,"patched_in":"3.59.5"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-20T07:22:31Z"},{"id":"wordfence:bcbcad73-ce2a-4eb2-9b7f-91d47a93e16d","source":"wordfence","cve":"CVE-2025-12668","title":"WP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbcad73-ce2a-4eb2-9b7f-91d47a93e16d?source=api-prod","affected":[{"type":"plugin","slug":"wp-count-down-timer","name":"WP Count Down Timer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:08:07Z","updated":"2025-11-11T03:30:48Z"},{"id":"wordfence:bcc10e91-4810-4a0d-919c-de3e87137f76","source":"wordfence","cve":"CVE-2024-1368","title":"Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc10e91-4810-4a0d-919c-de3e87137f76?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-duplicator","name":"Page Duplicator","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:14Z"},{"id":"wordfence:bcc1f2bf-4dd6-42cd-af05-52b73654aca2","source":"wordfence","cve":"CVE-2025-12820","title":"Pure WC Variation Swatches <= 1.1.7 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc1f2bf-4dd6-42cd-af05-52b73654aca2?source=api-prod","affected":[{"type":"plugin","slug":"pure-wc-variations-swatches","name":"Pure WC Variation Swatches","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-28T00:00:00Z","updated":"2026-01-06T15:56:37Z"},{"id":"wordfence:bcc59efb-5ecd-4822-998c-6c79fbeb4c3a","source":"wordfence","cve":"CVE-2009-2144","title":"FireStats <1.6.2 - SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc59efb-5ecd-4822-998c-6c79fbeb4c3a?source=api-prod","affected":[{"type":"plugin","slug":"firestats","name":"firestats","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2009-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcc6a4a5-b133-4ee1-a345-a7c812624b03","source":"wordfence","cve":"CVE-2024-0629","title":"2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc6a4a5-b133-4ee1-a345-a7c812624b03?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-2checkout-payment","name":"2Checkout Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-07-29T21:37:18Z"},{"id":"wordfence:bcc7f142-b330-492f-9855-10b443a98b63","source":"wordfence","cve":"CVE-2026-24582","title":"FlexTable \u2013 Data Table Sync with Google Sheets <= 3.24.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc7f142-b330-492f-9855-10b443a98b63?source=api-prod","affected":[{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"3.24.0","to_inclusive":true,"patched_in":"3.24.1"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-08T16:14:30Z"},{"id":"wordfence:bcc8b381-0909-443f-a8e0-9b85b27597aa","source":"wordfence","cve":"CVE-2026-61989","title":"Easy Property Listings <= 3.5.25 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc8b381-0909-443f-a8e0-9b85b27597aa?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.25","to_inclusive":true,"patched_in":"3.5.26"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:49:17Z"},{"id":"wordfence:bcca7ade-8b35-4ba1-a8b4-b1e815b025e3","source":"wordfence","cve":"CVE-2023-2891","title":"WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcca7ade-8b35-4ba1-a8b4-b1e815b025e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bccceb2d-2087-4ee6-8118-eb3fb53654dc","source":"wordfence","cve":"CVE-2023-47548","title":"Integrate Google Drive <= 1.3.2 - Open Redirect via state","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bccceb2d-2087-4ee6-8118-eb3fb53654dc?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bccdff52-e20c-49d5-9d82-ae7a16133793","source":"wordfence","cve":"CVE-2025-62902","title":"WP Popup Builder <= 1.3.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bccdff52-e20c-49d5-9d82-ae7a16133793?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-builder","name":"WP Popup Builder \u2013 Popup Forms and Marketing Lead Generation","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2025-09-27T00:00:00Z","updated":"2026-04-15T13:31:17Z"},{"id":"wordfence:bcd12bf2-0fbe-4c9e-b6f7-43c10798eadc","source":"wordfence","cve":"CVE-2021-39337","title":"job-portal <= 0.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd12bf2-0fbe-4c9e-b6f7-43c10798eadc?source=api-prod","affected":[{"type":"plugin","slug":"job-portal","name":"job-portal","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcd25ec7-e594-4261-a743-174ceb130cf5","source":"wordfence","cve":"CVE-2025-58858","title":"WPB Image Widget <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd25ec7-e594-4261-a743-174ceb130cf5?source=api-prod","affected":[{"type":"plugin","slug":"wpb-image-widget","name":"WPB Image Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:03:46Z"},{"id":"wordfence:bcd28bc3-f893-4eb7-946f-34a2e9c7ff27","source":"wordfence","cve":"CVE-2023-51399","title":"Back Button Widget <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd28bc3-f893-4eb7-946f-34a2e9c7ff27?source=api-prod","affected":[{"type":"plugin","slug":"back-button-widget","name":"Back Button Widget","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcd40c75-9c27-46b3-9ab8-dc8aad45c74c","source":"wordfence","cve":"CVE-2024-55974","title":"Mimoos <= 1.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd40c75-9c27-46b3-9ab8-dc8aad45c74c?source=api-prod","affected":[{"type":"plugin","slug":"devoluciones-packback","name":"Mimoos","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:02:01Z"},{"id":"wordfence:bcd50211-447c-4097-9281-551a3caad1a6","source":"wordfence","cve":"CVE-2017-20177","title":"WangGuard < 1.8.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd50211-447c-4097-9281-551a3caad1a6?source=api-prod","affected":[{"type":"plugin","slug":"wangguard","name":"WangGuard","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2017-01-18T00:00:00Z","updated":"2024-02-07T13:51:24Z"},{"id":"wordfence:bcd5b83a-7d51-455b-bb31-dd776264fc6b","source":"wordfence","cve":"CVE-2026-6710","title":"Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd5b83a-7d51-455b-bb31-dd776264fc6b?source=api-prod","affected":[{"type":"plugin","slug":"skysa-text-ticker-app","name":"Skysa Text Ticker App","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:04:42Z","updated":"2026-05-12T07:48:27Z"},{"id":"wordfence:bcd6a860-3f60-474c-a5bf-e0ed4ca574be","source":"wordfence","cve":"CVE-2024-3824","title":"Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd6a860-3f60-474c-a5bf-e0ed4ca574be?source=api-prod","affected":[{"type":"plugin","slug":"base64-encoderdecoder","name":"Base64 Encoder/Decoder","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:12:35Z"},{"id":"wordfence:bcd6c085-9fd8-43d9-b244-ab91146f610f","source":"wordfence","cve":"CVE-2025-8687","title":"Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd6c085-9fd8-43d9-b244-ab91146f610f?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-12-12T19:38:05Z","updated":"2025-12-13T08:21:14Z"},{"id":"wordfence:bcd7932d-8298-43d2-bc03-932e551a2ec6","source":"wordfence","cve":"CVE-2024-49607","title":"WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd7932d-8298-43d2-bc03-932e551a2ec6?source=api-prod","affected":[{"type":"plugin","slug":"wp-dropbox-dropins","name":"WP Dropbox Dropins","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T17:10:48Z"},{"id":"wordfence:bcd9384c-5af3-4544-8179-c2f5550dd152","source":"wordfence","cve":"CVE-2024-4374","title":"DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd9384c-5af3-4544-8179-c2f5550dd152?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-05-17T16:25:38Z","updated":"2024-05-18T04:30:52Z"},{"id":"wordfence:bcd981fb-ef75-4ed3-a18f-4ad9eaa148f4","source":"wordfence","cve":"CVE-2017-2136","title":"WP Statistics <= 12.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd981fb-ef75-4ed3-a18f-4ad9eaa148f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.0.4","to_inclusive":true,"patched_in":"12.0.5"}],"published":"2017-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcd9df9c-e1f8-467a-8f1c-ab5c402004da","source":"wordfence","cve":"CVE-2023-25062","title":"Pinpoint Booking System  <= 2.9.9.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcd9df9c-e1f8-467a-8f1c-ab5c402004da?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.2.9","to_inclusive":false,"patched_in":"2.9.9.2.9"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcdbd108-5e17-4e67-a2a2-0f1464c1ba6c","source":"wordfence","cve":"CVE-2024-30530","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcdbd108-5e17-4e67-a2a2-0f1464c1ba6c?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:50:14Z"},{"id":"wordfence:bcdc73d4-f47d-4bbf-a47c-1028021fb5a4","source":"wordfence","cve":"CVE-2025-54018","title":"CM Pop-Up banners <= 1.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcdc73d4-f47d-4bbf-a47c-1028021fb5a4?source=api-prod","affected":[{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:55:11Z"},{"id":"wordfence:bcde21fd-8a2b-482d-91a0-7c8578055b61","source":"wordfence","cve":"CVE-2025-67540","title":"Animation Addons for Elementor <= 2.4.5 - Authenticated (Contributor+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcde21fd-8a2b-482d-91a0-7c8578055b61?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:27:13Z"},{"id":"wordfence:bcde42fb-6f61-4174-a44a-bb28e4855062","source":"wordfence","cve":"CVE-2025-13048","title":"Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcde42fb-6f61-4174-a44a-bb28e4855062?source=api-prod","affected":[{"type":"plugin","slug":"official-statcounter-plugin-for-wordpress","name":"StatCounter \u2013 Real Time Visitor Stats, Session Replay & Heatmaps","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-02-18T00:00:00Z","updated":"2026-05-21T20:15:15Z"},{"id":"wordfence:bce54eb6-1c41-4922-a9b2-a7b77cda29b3","source":"wordfence","cve":"CVE-2026-28038","title":"Ultimate Addons for WPBakery Page Builder <= 3.21.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce54eb6-1c41-4922-a9b2-a7b77cda29b3?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.1","to_inclusive":true,"patched_in":"3.21.2"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T13:39:36Z"},{"id":"wordfence:bce55014-848d-4a51-ae49-75dd66dce44d","source":"wordfence","cve":"CVE-2026-85309","title":"Ultimate Maps by Supsystic <= 1.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce55014-848d-4a51-ae49-75dd66dce44d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:25:24Z"},{"id":"wordfence:bce8b43a-a69e-44d1-adab-98253e86cb33","source":"wordfence","cve":"CVE-2022-1093","title":"WP Meta SEO <= 4.4.6 - Admin+ Stored Cross-Site Scripting via breadcrumbs","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce8b43a-a69e-44d1-adab-98253e86cb33?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bce8dc07-e790-481d-8b4f-9d61d3b6b941","source":"wordfence","cve":"CVE-2026-73353","title":"Revolut Gateway for WooCommerce < 4.22.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce8dc07-e790-481d-8b4f-9d61d3b6b941?source=api-prod","affected":[{"type":"plugin","slug":"revolut-gateway-for-woocommerce","name":"Revolut Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.22.10","to_inclusive":false,"patched_in":"4.22.10"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-13T18:45:48Z"},{"id":"wordfence:bce942af-db4f-4b73-83e3-6bb6520f3543","source":"wordfence","cve":"CVE-2025-49057","title":"WP Voting <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce942af-db4f-4b73-83e3-6bb6520f3543?source=api-prod","affected":[{"type":"plugin","slug":"wp-voting","name":"WP Voting","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-19T13:52:19Z"},{"id":"wordfence:bce9ba42-f574-47c1-9ea5-1e56f9da8e71","source":"wordfence","cve":"CVE-2024-5902","title":"UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bce9ba42-f574-47c1-9ea5-1e56f9da8e71?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2024-07-12T08:32:15Z","updated":"2024-07-12T21:30:46Z"},{"id":"wordfence:bcec59c3-dccc-4ddf-920c-76cc7b9685ac","source":"wordfence","cve":"CVE-2025-69295","title":"Coven Core <= 1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcec59c3-dccc-4ddf-920c-76cc7b9685ac?source=api-prod","affected":[{"type":"plugin","slug":"coven-core","name":"Coven - Furniture Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-28T13:45:35Z"},{"id":"wordfence:bced4547-3264-43dc-8bb1-89a06f74ccbd","source":"wordfence","cve":"CVE-2024-13418","title":"Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bced4547-3264-43dc-8bb1-89a06f74ccbd?source=api-prod","affected":[{"type":"plugin","slug":"beyot-framework","name":"Beyot Framework","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"benaa-framework","name":"Benaa Framework","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"g5plus-auteur","name":"Auteur Framework","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"april-framework","name":"April Framework","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:21Z"},{"id":"wordfence:bced99cc-89db-4e42-9336-b83721826680","source":"wordfence","cve":"CVE-2025-31099","title":"Slider by BestWebSoft <= 1.1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bced99cc-89db-4e42-9336-b83721826680?source=api-prod","affected":[{"type":"plugin","slug":"slider-bws","name":"Slider by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T14:19:40Z"},{"id":"wordfence:bcf121a0-1bcc-42ba-abb1-780136228c6d","source":"wordfence","cve":"CVE-2026-62063","title":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf121a0-1bcc-42ba-abb1-780136228c6d?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-10-01T12:38:00Z","updated":"2026-10-08T23:37:55Z"},{"id":"wordfence:bcf205a3-be7b-49e7-ba02-3f69632ed65f","source":"wordfence","cve":"CVE-2023-5167","title":"User Activity Log Pro <= 2.3.3 - Unauthenticated Stored Cross-Site Scripting via User-Agent header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf205a3-be7b-49e7-ba02-3f69632ed65f?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log-pro","name":"User Activity Log Pro","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bcf37d4e-e94a-4046-9949-c208e4e70197","source":"wordfence","cve":"CVE-2024-10400","title":"Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf37d4e-e94a-4046-9949-c208e4e70197?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T07:35:37Z"},{"id":"wordfence:bcf4e969-82de-4505-8406-8638217b5cb7","source":"wordfence","cve":"CVE-2025-32136","title":"ActiveCampaign <= 8.1.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf4e969-82de-4505-8406-8638217b5cb7?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-subscription-forms","name":"ActiveCampaign \u2013 The autonomous marketing platform","from":"*","from_inclusive":true,"to":"8.1.16","to_inclusive":true,"patched_in":"8.1.17"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:19:48Z"},{"id":"wordfence:bcf6a12e-969b-4627-80c8-b51bb9b710cf","source":"wordfence","cve":"CVE-2024-27996","title":"Survey Maker <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf6a12e-969b-4627-80c8-b51bb9b710cf?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:48:59Z"},{"id":"wordfence:bcf7af0d-6df8-4f90-a244-f942f678434f","source":"wordfence","cve":"CVE-2026-27416","title":"PDF Poster \u2013 Display PDF Files with Custom Viewer <= 2.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf7af0d-6df8-4f90-a244-f942f678434f?source=api-prod","affected":[{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:28:27Z"},{"id":"wordfence:bcf7c4ad-7d8a-491c-b401-8b02af4a21c3","source":"wordfence","cve":"CVE-2025-49285","title":"WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 3.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf7c4ad-7d8a-491c-b401-8b02af4a21c3?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:26:07Z"},{"id":"wordfence:bcf8fa7c-0d9e-41ef-af60-0c33328fc5cc","source":"wordfence","cve":"CVE-2025-47677","title":"Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf8fa7c-0d9e-41ef-af60-0c33328fc5cc?source=api-prod","affected":[{"type":"plugin","slug":"gt3-photo-video-gallery","name":"Photo Gallery \u2013 GT3 Image Gallery & Gutenberg Block Gallery","from":"*","from_inclusive":true,"to":"2.7.7.25","to_inclusive":true,"patched_in":"2.7.7.26"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-29T19:59:18Z"},{"id":"wordfence:bcfb8a13-1320-4187-ba4c-887c66f0fc1e","source":"wordfence","cve":"CVE-2025-68059","title":"Hotel Listing <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcfb8a13-1320-4187-ba4c-887c66f0fc1e?source=api-prod","affected":[{"type":"plugin","slug":"hotel-listing","name":"Hotel Listings","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:03:04Z"},{"id":"wordfence:bcfbce25-af5f-45dc-a7e1-922d3a549359","source":"wordfence","cve":"CVE-2026-12747","title":"Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcfbce25-af5f-45dc-a7e1-922d3a549359?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.11","to_inclusive":true,"patched_in":"3.29.12"}],"published":"2026-08-31T15:50:35Z","updated":"2026-09-01T04:27:52Z"},{"id":"wordfence:bcff5496-5fa7-4e74-8082-d143e8dbfbba","source":"wordfence","cve":"CVE-2026-113673","title":"GeoDirectory <= 2.8.193 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bcff5496-5fa7-4e74-8082-d143e8dbfbba?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:18:28Z"},{"id":"wordfence:bd004e84-88e5-4eb5-903f-0fe20ddd395e","source":"wordfence","cve":"CVE-2025-68523","title":"Spiffy Calendar <= 5.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd004e84-88e5-4eb5-903f-0fe20ddd395e?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:35:19Z"},{"id":"wordfence:bd034f43-370c-4ad9-ad02-4cae0f48d781","source":"wordfence","cve":"CVE-2026-4078","title":"ITERAS <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd034f43-370c-4ad9-ad02-4cae0f48d781?source=api-prod","affected":[{"type":"plugin","slug":"iteras","name":"ITERAS","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-04-23T19:20:52Z","updated":"2026-04-24T07:45:08Z"},{"id":"wordfence:bd073b97-b9b3-417c-ad82-e07a75cee3c4","source":"wordfence","cve":"CVE-2026-57346","title":"Embed Privacy <= 1.12.3 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd073b97-b9b3-417c-ad82-e07a75cee3c4?source=api-prod","affected":[{"type":"plugin","slug":"embed-privacy","name":"Embed Privacy","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-02T11:40:41Z"},{"id":"wordfence:bd087d06-5395-4dfd-a288-2c3271a62842","source":"wordfence","cve":"CVE-2026-60137","title":"WordPress Core 6.8 -  7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd087d06-5395-4dfd-a288-2c3271a62842?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.5","to_inclusive":false,"patched_in":"6.8.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.5","to_inclusive":false,"patched_in":"6.8.6"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.2","to_inclusive":false,"patched_in":"6.8.6"}],"published":"2026-07-17T00:00:00Z","updated":"2026-07-17T23:13:07Z"},{"id":"wordfence:bd0ac7bf-e786-47b8-ab3b-ca59cdb3c19e","source":"wordfence","cve":"CVE-2026-32346","title":"Travel Agency <= 1.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd0ac7bf-e786-47b8-ab3b-ca59cdb3c19e?source=api-prod","affected":[{"type":"theme","slug":"travel-agency","name":"Travel Agency","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:48:11Z"},{"id":"wordfence:bd0cfbc6-051b-44f4-9400-fa638bea50b9","source":"wordfence","cve":"CVE-2025-23809","title":"Blue Wrench Video Widget <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd0cfbc6-051b-44f4-9400-fa638bea50b9?source=api-prod","affected":[{"type":"plugin","slug":"blue-wrench-videos-widget","name":"Blue Wrench Video Widget","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:14:13Z"},{"id":"wordfence:bd0d8661-4725-41dd-88ce-8e94e285d5b8","source":"wordfence","cve":"","title":"Uncanny Automator <= 4.14 - Cross-Site Request Forgery via update_automator_connect","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd0d8661-4725-41dd-88ce-8e94e285d5b8?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":false,"patched_in":"4.15"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd1838c4-00df-4177-84be-1f8c19ceae4e","source":"wordfence","cve":"CVE-2022-1967","title":"wp-championship <= 9.2 - Multiple Cross-Site Request Forgery Vulnerabilities","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1838c4-00df-4177-84be-1f8c19ceae4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-championship","name":"wp-championship","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd184c80-e785-4e9b-961d-9c3378688f91","source":"wordfence","cve":"CVE-2026-2429","title":"Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd184c80-e785-4e9b-961d-9c3378688f91?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-03-06T11:49:54Z","updated":"2026-03-07T01:21:23Z"},{"id":"wordfence:bd191d42-f41b-45c3-81b6-3d4eeea0f3fa","source":"wordfence","cve":"CVE-2026-45436","title":"WPBakery Page Builder <= 8.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd191d42-f41b-45c3-81b6-3d4eeea0f3fa?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.7.2","to_inclusive":true,"patched_in":"8.7.3"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-19T13:33:46Z"},{"id":"wordfence:bd1a98d4-bf67-4678-b30b-ca13e63c665a","source":"wordfence","cve":"CVE-2015-5528","title":"Floating Social Bar < 1.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1a98d4-bf67-4678-b30b-ca13e63c665a?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-bar","name":"Floating Social Bar","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd1cc121-65c2-4e6f-8b07-91fe75bca9db","source":"wordfence","cve":"CVE-2026-32457","title":"Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1cc121-65c2-4e6f-8b07-91fe75bca9db?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-fields-for-woocommerce","name":"Advanced Product Fields (Product Addons) for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":"1.6.19"}],"published":"2026-03-11T00:00:00Z","updated":"2026-03-19T15:56:02Z"},{"id":"wordfence:bd1f12ac-86ac-4be9-9575-98381c3b4291","source":"wordfence","cve":"CVE-2022-2462","title":"Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2025-07-21T13:52:11Z"},{"id":"wordfence:bd20e40c-cfec-4de6-a8a6-02850185003b","source":"wordfence","cve":"CVE-2021-25064","title":"Wow Countdowns <= 3.1.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd20e40c-cfec-4de6-a8a6-02850185003b?source=api-prod","affected":[{"type":"plugin","slug":"mwp-countdown","name":"Wow Countdowns \u2013 easily create any countdowns, counters and timers","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd22eaa1-e76d-4192-8d08-9bb984b08439","source":"wordfence","cve":"CVE-2021-24317","title":"Listeo - Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd22eaa1-e76d-4192-8d08-9bb984b08439?source=api-prod","affected":[{"type":"theme","slug":"listeo","name":"Listeo - Directory & Listings With Booking - WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":false,"patched_in":"1.6.11"}],"published":"2021-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd240932-ad50-40b3-94c7-6e885f96c5df","source":"wordfence","cve":"CVE-2024-43945","title":"LatePoint <= 4.9.91 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd240932-ad50-40b3-94c7-6e885f96c5df?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"LatePoint Plugin","from":"*","from_inclusive":true,"to":"4.9.91","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:54:10Z"},{"id":"wordfence:bd248252-4329-4b3c-acf1-3b3d8cc9887c","source":"wordfence","cve":"CVE-2022-0728","title":"Easy Smooth Scroll Links <= 2.23.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd248252-4329-4b3c-acf1-3b3d8cc9887c?source=api-prod","affected":[{"type":"plugin","slug":"scrolling-anchors","name":"Easy Smooth Scroll Links","from":"*","from_inclusive":true,"to":"2.23.1","to_inclusive":true,"patched_in":""}],"published":"2022-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd2754f9-11f7-4690-99dd-2204e69bf14b","source":"wordfence","cve":"CVE-2025-11870","title":"Simple Business Data <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2754f9-11f7-4690-99dd-2204e69bf14b?source=api-prod","affected":[{"type":"plugin","slug":"simple-business-data","name":"Simple Business Data","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:20:12Z","updated":"2025-10-22T08:27:10Z"},{"id":"wordfence:bd28f7f0-ed52-45d0-8d97-5ff95d17eb26","source":"wordfence","cve":"CVE-2023-51689","title":"Easy Video Player <= 1.2.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd28f7f0-ed52-45d0-8d97-5ff95d17eb26?source=api-prod","affected":[{"type":"plugin","slug":"easy-video-player","name":"Easy Video Player","from":"*","from_inclusive":true,"to":"1.2.2.10","to_inclusive":true,"patched_in":"1.2.2.11"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd2ad909-a254-461d-a24f-e9803353bae4","source":"wordfence","cve":"CVE-2025-32648","title":"Projectopia <= 5.1.25.2 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2ad909-a254-461d-a24f-e9803353bae4?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.25.2","to_inclusive":true,"patched_in":"5.1.26"}],"published":"2025-04-14T00:00:00Z","updated":"2026-10-28T21:06:54Z"},{"id":"wordfence:bd2bc2e7-960e-40db-9dcc-a6a60117bd83","source":"wordfence","cve":"CVE-2023-5381","title":"Elementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2bc2e7-960e-40db-9dcc-a6a60117bd83?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.7","to_inclusive":true,"patched_in":"1.12.8"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd2e5e99-d4fb-4d64-ad44-58bb98bd906b","source":"wordfence","cve":"CVE-2026-97238","title":"JetEngine <= 3.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2e5e99-d4fb-4d64-ad44-58bb98bd906b?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14.3","to_inclusive":true,"patched_in":"3.8.15"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:57Z"},{"id":"wordfence:bd2ea430-48ce-43c3-ba3d-8ef5f91460ce","source":"wordfence","cve":"CVE-2024-1587","title":"Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2ea430-48ce-43c3-ba3d-8ef5f91460ce?source=api-prod","affected":[{"type":"theme","slug":"newsmatic","name":"Newsmatic","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:59:18Z"},{"id":"wordfence:bd2f0997-8373-4304-ad60-3a98f48ec530","source":"wordfence","cve":"CVE-2025-53986","title":"Hestia <= 3.2.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2f0997-8373-4304-ad60-3a98f48ec530?source=api-prod","affected":[{"type":"theme","slug":"hestia","name":"Hestia","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:56:44Z"},{"id":"wordfence:bd2f495e-63fd-49e4-9d6b-320ed007dacb","source":"wordfence","cve":"CVE-2022-2593","title":"Better Search Replace <= 1.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2f495e-63fd-49e4-9d6b-320ed007dacb?source=api-prod","affected":[{"type":"plugin","slug":"better-search-replace","name":"Better Search Replace","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd2f7567-a438-417b-bf0f-dec7a9f098b2","source":"wordfence","cve":"CVE-2021-24609","title":"Mapa Politico Espa\u00f1a < 3.7.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2f7567-a438-417b-bf0f-dec7a9f098b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-mapa-politico-spain","name":"WP Mapa Politico Espa\u00f1a","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":false,"patched_in":"3.7.0"}],"published":"2021-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd302d8e-bba1-4fa1-bcbc-591d894ca1d6","source":"wordfence","cve":"","title":"Simple Link Directory <= 5.6.0 - PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd302d8e-bba1-4fa1-bcbc-591d894ca1d6?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2018-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd31e8b0-6089-4521-a80f-e65e61ad062f","source":"wordfence","cve":"CVE-2023-52229","title":"Word Replacer Pro <= 1.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd31e8b0-6089-4521-a80f-e65e61ad062f?source=api-prod","affected":[{"type":"plugin","slug":"word-replacer-ultra","name":"Word Replacer Pro","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd331eb2-9ec2-4105-ae79-01c9c772de35","source":"wordfence","cve":"","title":"Cars4Rent <= 1.4.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd331eb2-9ec2-4105-ae79-01c9c772de35?source=api-prod","affected":[{"type":"theme","slug":"cars4rent","name":"Cars4Rent | Auto Rental & Taxi WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T20:37:20Z"},{"id":"wordfence:bd332f49-5aa9-4207-89db-84692a6430e0","source":"wordfence","cve":"CVE-2026-8809","title":"Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd332f49-5aa9-4207-89db-84692a6430e0?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.5","to_inclusive":true,"patched_in":"0.9.2.6"}],"published":"2026-05-28T10:09:02Z","updated":"2026-05-28T22:27:27Z"},{"id":"wordfence:bd34f257-d373-424e-830a-fe3cc56447f7","source":"wordfence","cve":"CVE-2025-32216","title":"Spider Elements \u2013 Addons for Elementor <= 1.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd34f257-d373-424e-830a-fe3cc56447f7?source=api-prod","affected":[{"type":"plugin","slug":"spider-elements","name":"Spider Elements \u2013 Premium Elementor Widgets & Addons Library","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2025-04-07T00:00:00Z","updated":"2025-11-13T15:56:20Z"},{"id":"wordfence:bd352c95-6e76-478f-943b-938a96b372f4","source":"wordfence","cve":"CVE-2025-5233","title":"Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd352c95-6e76-478f-943b-938a96b372f4?source=api-prod","affected":[{"type":"plugin","slug":"color-palette","name":"Color Palette","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:10:25Z","updated":"2025-06-13T01:47:49Z"},{"id":"wordfence:bd387fe3-ffc5-4981-93d7-2b0b14cc11d5","source":"wordfence","cve":"CVE-2026-1877","title":"Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd387fe3-ffc5-4981-93d7-2b0b14cc11d5?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-scheduler","name":"Auto Post Scheduler","from":"*","from_inclusive":true,"to":"1.84","to_inclusive":true,"patched_in":""}],"published":"2026-03-30T16:31:15Z","updated":"2026-03-31T05:28:55Z"},{"id":"wordfence:bd38b5f2-f13e-4433-9a8a-2f42cc1782c6","source":"wordfence","cve":"CVE-2024-10591","title":"MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd38b5f2-f13e-4433-9a8a-2f42cc1782c6?source=api-prod","affected":[{"type":"plugin","slug":"makewebbetter-hubspot-for-woocommerce","name":"MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-01-30T00:42:05Z","updated":"2025-01-31T14:50:10Z"},{"id":"wordfence:bd38d97d-db93-42ed-9d52-f70641fba442","source":"wordfence","cve":"CVE-2024-3261","title":"Strong Testimonials <= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd38d97d-db93-42ed-9d52-f70641fba442?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.12"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-17T14:54:24Z"},{"id":"wordfence:bd3a2aaa-f911-43ec-9d49-2c04f74e5e8d","source":"wordfence","cve":"","title":"Add Link to Facebook  < 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3a2aaa-f911-43ec-9d49-2c04f74e5e8d?source=api-prod","affected":[{"type":"plugin","slug":"add-link-to-facebook","name":"Add Link to Facebook","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":false,"patched_in":"2.2.8"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd3c1e65-fcb2-4e31-973b-8271a833c6ba","source":"wordfence","cve":"CVE-2022-0410","title":"WP Visitor Statistics (Real Time Traffic) <= 5.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3c1e65-fcb2-4e31-973b-8271a833c6ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":false,"patched_in":"5.6"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd3d3fe1-8fdd-404c-a8f7-2b9893ff6c0d","source":"wordfence","cve":"CVE-2022-2189","title":"WP Video Lightbox <= 1.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3d3fe1-8fdd-404c-a8f7-2b9893ff6c0d?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd3dbc56-4833-4b5d-bd6c-facc3e1878ea","source":"wordfence","cve":"CVE-2025-8215","title":"Responsive Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3dbc56-4833-4b5d-bd6c-facc3e1878ea?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-09-10T18:49:24Z","updated":"2025-10-21T21:05:08Z"},{"id":"wordfence:bd3e30ea-8f58-4895-b78c-fb18c94d5253","source":"wordfence","cve":"CVE-2019-25223","title":"Team Circle Image Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3e30ea-8f58-4895-b78c-fb18c94d5253?source=api-prod","affected":[{"type":"plugin","slug":"circle-image-slider-with-lightbox","name":"Team Circle Image Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:01:03Z"},{"id":"wordfence:bd3ee85a-324d-4991-bffc-db28ce374bbe","source":"wordfence","cve":"CVE-2026-2579","title":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3ee85a-324d-4991-bffc-db28ce374bbe?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-03-16T11:29:16Z","updated":"2026-03-17T01:24:28Z"},{"id":"wordfence:bd42c89e-57db-458f-910c-404a5615f280","source":"wordfence","cve":"CVE-2025-0959","title":"Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id","severity":"high","cvss":8.8,"cwe":"CWE-564","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd42c89e-57db-458f-910c-404a5615f280?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer - WordPress Event & Booking Manager Plugin","from":"*","from_inclusive":true,"to":"3.9.9.2","to_inclusive":true,"patched_in":"3.9.9.3"}],"published":"2025-03-06T19:34:20Z","updated":"2025-03-07T08:21:27Z"},{"id":"wordfence:bd43628d-1320-44a8-a397-37455096e191","source":"wordfence","cve":"CVE-2025-67930","title":"eHive Search <= 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd43628d-1320-44a8-a397-37455096e191?source=api-prod","affected":[{"type":"plugin","slug":"ehive-search","name":"eHive Search","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-01-06T00:00:00Z","updated":"2026-01-13T17:33:26Z"},{"id":"wordfence:bd4517bb-2fc3-4765-ad97-7cdf8e72fa9b","source":"wordfence","cve":"CVE-2026-104639","title":"Razorpay for WooCommerce <= 4.8.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd4517bb-2fc3-4765-ad97-7cdf8e72fa9b?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:09:01Z"},{"id":"wordfence:bd46352a-5428-467d-9456-772ef816efb1","source":"wordfence","cve":"CVE-2026-24603","title":"Universal Google Adsense and Ads manager <= 1.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd46352a-5428-467d-9456-772ef816efb1?source=api-prod","affected":[{"type":"plugin","slug":"universal-google-adsense-and-ads-manager","name":"Universal Google Adsense and Ads manager","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-14T08:24:46Z","updated":"2026-02-03T13:44:17Z"},{"id":"wordfence:bd46a2c3-f24d-4dff-b899-a95acb6310f7","source":"wordfence","cve":"CVE-2020-36170","title":"Ultimate Member <= 2.1.12 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd46a2c3-f24d-4dff-b899-a95acb6310f7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":false,"patched_in":"2.1.13"}],"published":"2020-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd478bb7-f0d7-4a29-8236-96ad69b5ae67","source":"wordfence","cve":"CVE-2025-13156","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd478bb7-f0d7-4a29-8236-96ad69b5ae67?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-11-20T19:52:48Z","updated":"2025-11-21T08:28:16Z"},{"id":"wordfence:bd49d77c-d552-47ae-b680-4ab0e4a8a906","source":"wordfence","cve":"CVE-2024-43310","title":"Print Barcode Labels for your WooCommerce products/orders <= 3.4.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd49d77c-d552-47ae-b680-4ab0e4a8a906?source=api-prod","affected":[{"type":"plugin","slug":"a4-barcode-generator","name":"Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:02:01Z"},{"id":"wordfence:bd4a1fd2-8831-482d-8ae3-fb78c2657b86","source":"wordfence","cve":"","title":"WP DoNotTrack <= 0.8.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd4a1fd2-8831-482d-8ae3-fb78c2657b86?source=api-prod","affected":[{"type":"plugin","slug":"wp-donottrack","name":"WP DoNotTrack","from":"*","from_inclusive":true,"to":"0.8.8","to_inclusive":true,"patched_in":""}],"published":"2021-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd50d7bf-33a9-4a35-855b-7278080695a5","source":"wordfence","cve":"CVE-2025-50014","title":"PDPA Consent for Thailand <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd50d7bf-33a9-4a35-855b-7278080695a5?source=api-prod","affected":[{"type":"plugin","slug":"pdpa-consent","name":"PDPA Consent for Thailand","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:48:23Z"},{"id":"wordfence:bd520915-2605-450a-9abd-423f1c226eb6","source":"wordfence","cve":"CVE-2026-17092","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd520915-2605-450a-9abd-423f1c226eb6?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10.2.1","to_inclusive":true,"patched_in":"8.10.3"}],"published":"2026-10-13T12:39:51Z","updated":"2026-10-14T01:27:17Z"},{"id":"wordfence:bd53bc57-b10e-47a7-8c10-96bf1f1e82a5","source":"wordfence","cve":"CVE-2023-3547","title":"All in One B2B for WooCommerce <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd53bc57-b10e-47a7-8c10-96bf1f1e82a5?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-b2b-for-woocommerce","name":"All in One B2B for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd54a50b-13ce-43ce-bce1-8fe132abc07e","source":"wordfence","cve":"CVE-2024-13752","title":"WP Project Manager  <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd54a50b-13ce-43ce-bce1-8fe132abc07e?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.17","to_inclusive":true,"patched_in":"2.6.18"}],"published":"2025-02-14T20:28:29Z","updated":"2025-02-15T09:24:24Z"},{"id":"wordfence:bd55ce27-7d38-4d55-9b31-5b986edc7f1d","source":"wordfence","cve":"CVE-2025-28870","title":"amoCRM WebForm <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd55ce27-7d38-4d55-9b31-5b986edc7f1d?source=api-prod","affected":[{"type":"plugin","slug":"amocrm-webform","name":"Plugin Name: amoCRM WebForm","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:34:48Z"},{"id":"wordfence:bd563af4-b97f-4746-a5e9-8dc5dfda272e","source":"wordfence","cve":"","title":"Authentic <= 2.0.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd563af4-b97f-4746-a5e9-8dc5dfda272e?source=api-prod","affected":[{"type":"theme","slug":"authentic","name":"Authentic","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd57edf5-a75e-4677-a51e-9dd262eeba4a","source":"wordfence","cve":"","title":"MC4WP: Mailchimp for WordPress < 4.8.7 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd57edf5-a75e-4677-a51e-9dd262eeba4a?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":false,"patched_in":"4.8.7"}],"published":"2022-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd581604-e2f6-42c4-81ef-10873683526b","source":"wordfence","cve":"CVE-2025-6061","title":"kk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd581604-e2f6-42c4-81ef-10873683526b?source=api-prod","affected":[{"type":"plugin","slug":"kk-youtube-video","name":"kk Youtube Video","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:38:19Z","updated":"2025-06-14T08:23:26Z"},{"id":"wordfence:bd5a1ab9-8d59-464a-a227-9f6ee768e35c","source":"wordfence","cve":"CVE-2023-6082","title":"Chartjs <= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting via chart","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd5a1ab9-8d59-464a-a227-9f6ee768e35c?source=api-prod","affected":[{"type":"plugin","slug":"enigma-chartjs","name":"enigma-chartjs","from":"*","from_inclusive":true,"to":"2023.2","to_inclusive":true,"patched_in":""}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd5a7bf6-5c9d-4c0f-a7fd-738c0d7f90bd","source":"wordfence","cve":"CVE-2025-22692","title":"Sponsered Link <= 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd5a7bf6-5c9d-4c0f-a7fd-738c0d7f90bd?source=api-prod","affected":[{"type":"plugin","slug":"sponsered-link","name":"Sponsered Link","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"6.0"}],"published":"2025-01-18T00:00:00Z","updated":"2025-04-22T22:09:34Z"},{"id":"wordfence:bd5bfa76-eb14-4fab-8497-782353342af5","source":"wordfence","cve":"CVE-2025-23653","title":"Form To Online Booking <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd5bfa76-eb14-4fab-8497-782353342af5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-calendly-integration","name":"Form To Online Booking","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:08:08Z"},{"id":"wordfence:bd5d212e-c672-4fa8-afe7-baeac06e2e7d","source":"wordfence","cve":"CVE-2024-1279","title":"Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd5d212e-c672-4fa8-afe7-baeac06e2e7d?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.8","to_inclusive":true,"patched_in":"2.12.9"}],"published":"2024-02-16T00:00:00Z","updated":"2024-04-24T14:37:28Z"},{"id":"wordfence:bd619c85-4804-4c19-b37b-fdfbd8266760","source":"wordfence","cve":"CVE-2025-62024","title":"Pie Calendar <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd619c85-4804-4c19-b37b-fdfbd8266760?source=api-prod","affected":[{"type":"plugin","slug":"pie-calendar","name":"Pie Calendar \u2013 Events Calendar Made Simple","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:51:33Z"},{"id":"wordfence:bd625d24-c1e9-465d-896a-bff75d8c534f","source":"wordfence","cve":"CVE-2023-49860","title":"WP Project Manager <= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd625d24-c1e9-465d-896a-bff75d8c534f?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2023-12-07T00:00:00Z","updated":"2024-11-13T15:48:45Z"},{"id":"wordfence:bd650510-2d1c-48a1-a5fa-d4c26f3d030c","source":"wordfence","cve":"CVE-2022-23987","title":"WS Form LITE and Pro < 1.8.176 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd650510-2d1c-48a1-a5fa-d4c26f3d030c?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.8.176","to_inclusive":false,"patched_in":"1.8.176"},{"type":"plugin","slug":"ws-form-pro","name":"WS Form Pro","from":"*","from_inclusive":true,"to":"1.8.176","to_inclusive":false,"patched_in":"1.8.176"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd652388-ab0d-406a-99d1-6d1d0cbb54dd","source":"wordfence","cve":"CVE-2024-51713","title":"HQ60 Fidelity Card <= 1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd652388-ab0d-406a-99d1-6d1d0cbb54dd?source=api-prod","affected":[{"type":"plugin","slug":"hq60-fidelity-card","name":"HQ60 Fidelity Card","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:22:18Z"},{"id":"wordfence:bd67a8e7-6ccc-4c76-9baa-f5dac225d789","source":"wordfence","cve":"CVE-2026-27386","title":"DesignThemes Directory Addon <= 1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd67a8e7-6ccc-4c76-9baa-f5dac225d789?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-directory-addon","name":"DT - Directory WordPress Plugin","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T17:55:12Z"},{"id":"wordfence:bd6cc95c-451b-4ad7-bb5b-bbb9bc3c89c2","source":"wordfence","cve":"CVE-2024-30447","title":"Creative Image Slider \u2013 Responsive Slider Plugin <= 2.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd6cc95c-451b-4ad7-bb5b-bbb9bc3c89c2?source=api-prod","affected":[{"type":"plugin","slug":"creative-image-slider","name":"Creative Image Slider \u2013 Responsive Slider Plugin","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:27:36Z"},{"id":"wordfence:bd6cddeb-c812-4496-9377-cc8832842c51","source":"wordfence","cve":"CVE-2021-24930","title":"Bookly <= 20.3 - Staff Member Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd6cddeb-c812-4496-9377-cc8832842c51?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"20.3","to_inclusive":true,"patched_in":"20.3.1"}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd715375-6bf8-4602-9554-b1f81aa5afa2","source":"wordfence","cve":"CVE-2007-3140","title":"WordPress Core <= 2.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd715375-6bf8-4602-9554-b1f81aa5afa2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2007-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd718f4a-bad4-4e6a-ab4b-b0fb6bd25da3","source":"wordfence","cve":"CVE-2025-31390","title":"Social Crowd <= 0.9.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd718f4a-bad4-4e6a-ab4b-b0fb6bd25da3?source=api-prod","affected":[{"type":"plugin","slug":"social-crowd","name":"Social Crowd","from":"*","from_inclusive":true,"to":"0.9.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:58:15Z"},{"id":"wordfence:bd72ce7e-027c-49bd-8bcf-3ccda2c9b184","source":"wordfence","cve":"CVE-2012-6653","title":"All Video Gallery  <= 1.1 - SQL Injection","severity":"high","cvss":7.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd72ce7e-027c-49bd-8bcf-3ccda2c9b184?source=api-prod","affected":[{"type":"plugin","slug":"all-video-gallery","name":"All Video Gallery Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2012-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd748b6c-110a-46b6-a609-64d093dfc3e5","source":"wordfence","cve":"CVE-2024-12160","title":"Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd748b6c-110a-46b6-a609-64d093dfc3e5?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-discount-for-woocommerce","name":"Seraphinite Bulk Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T08:22:35Z"},{"id":"wordfence:bd7784dc-c450-4ce2-86ac-adaf9e2b61ad","source":"wordfence","cve":"CVE-2025-53982","title":"JetElements For Elementor <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7784dc-c450-4ce2-86ac-adaf9e2b61ad?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.7.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:51:02Z"},{"id":"wordfence:bd788e9c-223c-432f-9369-d9af380324e9","source":"wordfence","cve":"CVE-2025-46498","title":"Zalo Official Live Chat <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd788e9c-223c-432f-9369-d9af380324e9?source=api-prod","affected":[{"type":"plugin","slug":"zalo-official-live-chat","name":"Zalo Official Live Chat","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:23:56Z"},{"id":"wordfence:bd7bf023-4a18-4918-9600-12720c1b4ad8","source":"wordfence","cve":"CVE-2024-52388","title":"Hebrew Date <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7bf023-4a18-4918-9600-12720c1b4ad8?source=api-prod","affected":[{"type":"plugin","slug":"hebrewdates","name":"Hebrew Dates","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:53:06Z"},{"id":"wordfence:bd7bf797-fa51-444b-9252-f004e9116fd5","source":"wordfence","cve":"CVE-2024-54417","title":"PixProof <= 2.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7bf797-fa51-444b-9252-f004e9116fd5?source=api-prod","affected":[{"type":"plugin","slug":"pixproof","name":"PixProof \u2013 Easy Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:13:37Z"},{"id":"wordfence:bd7c442f-5c91-4c52-933a-8a6fb7adca8c","source":"wordfence","cve":"","title":"Download Manager <= 2.5.8 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7c442f-5c91-4c52-933a-8a6fb7adca8c?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2013-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd7ee2d7-4588-4cb9-86ca-0daef421dd86","source":"wordfence","cve":"","title":"Hungred Post Thumbnail <= 2.1.9 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd7ee2d7-4588-4cb9-86ca-0daef421dd86?source=api-prod","affected":[{"type":"plugin","slug":"hungred-post-thumbnail","name":"Hungred Post Thumbnail","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2012-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd84a7b1-76f3-4c01-a935-ffec4a48b61b","source":"wordfence","cve":"CVE-2026-66445","title":"Open User Map <= 1.4.46 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd84a7b1-76f3-4c01-a935-ffec4a48b61b?source=api-prod","affected":[{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.46","to_inclusive":true,"patched_in":"1.4.47"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:26:23Z"},{"id":"wordfence:bd861a13-4215-4a69-adb5-cd28dce4509b","source":"wordfence","cve":"CVE-2021-25000","title":"Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in General Module","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd861a13-4215-4a69-adb5-cd28dce4509b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"5.4.9"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd879bd9-d195-4146-b9dc-3ba7252645de","source":"wordfence","cve":"","title":"10WebFAQ <= 1.0.14 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd879bd9-d195-4146-b9dc-3ba7252645de?source=api-prod","affected":[{"type":"plugin","slug":"faq-wd","name":"10WebFAQ","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2016-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd88ebd2-5584-4886-9c85-39a225cd00e9","source":"wordfence","cve":"CVE-2026-7527","title":"WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd88ebd2-5584-4886-9c85-39a225cd00e9?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.02","to_inclusive":true,"patched_in":"7.0.03"}],"published":"2026-09-18T19:00:36Z","updated":"2026-09-19T07:43:19Z"},{"id":"wordfence:bd8a61d1-904d-4027-8f27-6e3018862d9b","source":"wordfence","cve":"CVE-2021-24720","title":"GeoDirectory <= 2.1.1.2 - Authenticated (admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8a61d1-904d-4027-8f27-6e3018862d9b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.1.1.2","to_inclusive":true,"patched_in":"2.1.1.3"}],"published":"2021-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd8a9b92-8ef5-44bc-a977-58875fc4079b","source":"wordfence","cve":"CVE-2025-59007","title":"TF Woo Product Grid Addon For Elementor <= 1.0.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8a9b92-8ef5-44bc-a977-58875fc4079b?source=api-prod","affected":[{"type":"plugin","slug":"tf-woo-product-grid","name":"tf-woo-product-grid","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T12:38:56Z"},{"id":"wordfence:bd8e86b0-5e06-44e0-a94c-b05581f46e5a","source":"wordfence","cve":"CVE-2026-2936","title":"Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8e86b0-5e06-44e0-a94c-b05581f46e5a?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"8.4","to_inclusive":true,"patched_in":"8.5"}],"published":"2026-04-03T22:10:48Z","updated":"2026-04-04T11:16:18Z"},{"id":"wordfence:bd8fbe0d-0709-4fa2-9294-393ddcd05b22","source":"wordfence","cve":"CVE-2026-1263","title":"Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd8fbe0d-0709-4fa2-9294-393ddcd05b22?source=api-prod","affected":[{"type":"plugin","slug":"webling","name":"Webling","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2026-04-09T12:32:40Z","updated":"2026-04-10T01:24:59Z"},{"id":"wordfence:bd90b85e-22a9-4c08-b2cf-4f75406e7ca3","source":"wordfence","cve":"CVE-2024-9682","title":"Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd90b85e-22a9-4c08-b2cf-4f75406e7ca3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1001","to_inclusive":true,"patched_in":"1.7.1002"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T08:29:35Z"},{"id":"wordfence:bd90e443-bedf-483b-84eb-3a447d79530e","source":"wordfence","cve":"CVE-2025-30781","title":"Scheduled &amp; Automatic Order Status Controller for WooCommerce <= 3.7.1 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd90e443-bedf-483b-84eb-3a447d79530e?source=api-prod","affected":[{"type":"plugin","slug":"order-status-rules-for-woocommerce","name":"Scheduled & Automatic Order Status Controller for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:55:17Z"},{"id":"wordfence:bd91f58e-8804-4b66-861b-525f4dd9436d","source":"wordfence","cve":"CVE-2025-31923","title":"CSS3 Accordions for WordPress <= 3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd91f58e-8804-4b66-861b-525f4dd9436d?source=api-prod","affected":[{"type":"plugin","slug":"css3_accordions","name":"CSS3 Accordions for WordPress","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:09:36Z"},{"id":"wordfence:bd92a11a-7442-4689-95cc-9e22fdd2c4fd","source":"wordfence","cve":"CVE-2026-73185","title":"NGG Smart Image Search < 4.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd92a11a-7442-4689-95cc-9e22fdd2c4fd?source=api-prod","affected":[{"type":"plugin","slug":"ngg-smart-image-search","name":"NGG Smart Image Search","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:14:22Z"},{"id":"wordfence:bd9336ba-0a91-4fe5-b564-1adf739f4193","source":"wordfence","cve":"CVE-2026-34886","title":"Simple Membership <= 4.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9336ba-0a91-4fe5-b564-1adf739f4193?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-03-31T00:00:00Z","updated":"2026-04-09T16:23:22Z"},{"id":"wordfence:bd933aa8-756f-460f-8d83-a626a6ed43b1","source":"wordfence","cve":"CVE-2026-57391","title":"Loops & Logic <= 4.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd933aa8-756f-460f-8d83-a626a6ed43b1?source=api-prod","affected":[{"type":"plugin","slug":"tangible-loops-and-logic","name":"Tangible: Loops & Logic","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:30:41Z"},{"id":"wordfence:bd9b6575-f49b-4586-a716-69d39242423d","source":"wordfence","cve":"CVE-2025-10570","title":"Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9b6575-f49b-4586-a716-69d39242423d?source=api-prod","affected":[{"type":"plugin","slug":"flexible-refund-and-return-order-for-woocommerce","name":"Flexible Refund for WooCommerce \u2013 EU One Click Return","from":"*","from_inclusive":true,"to":"1.0.38","to_inclusive":true,"patched_in":"1.0.39"}],"published":"2025-10-21T17:57:53Z","updated":"2025-10-22T06:40:59Z"},{"id":"wordfence:bd9b77fa-6de5-493e-978a-9957f44e32a1","source":"wordfence","cve":"CVE-2025-50047","title":"Sitekit <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9b77fa-6de5-493e-978a-9957f44e32a1?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:53:11Z"},{"id":"wordfence:bd9e5654-387e-4fc3-a6eb-2eface298a9c","source":"wordfence","cve":"","title":"Amazon Product in a Post Plugin < 3.5.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9e5654-387e-4fc3-a6eb-2eface298a9c?source=api-prod","affected":[{"type":"plugin","slug":"amazon-product-in-a-post-plugin","name":"Amazon Product in a Post Plugin","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2015-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bd9e97df-2082-45d2-aa26-65383522de7d","source":"wordfence","cve":"CVE-2025-46452","title":"Google News <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9e97df-2082-45d2-aa26-65383522de7d?source=api-prod","affected":[{"type":"plugin","slug":"google-news","name":"Google News","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:57:11Z"},{"id":"wordfence:bd9ef48f-b501-4fca-a6a5-78452c316497","source":"wordfence","cve":"CVE-2026-7464","title":"WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9ef48f-b501-4fca-a6a5-78452c316497?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps-integration","name":"WP Google Maps Integration","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:06:36Z","updated":"2026-05-12T07:48:28Z"},{"id":"wordfence:bd9f4105-0300-4031-9755-349939184735","source":"wordfence","cve":"CVE-2025-46436","title":"SCSS-Library <= 0.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9f4105-0300-4031-9755-349939184735?source=api-prod","affected":[{"type":"plugin","slug":"scss-library","name":"SCSS-Library","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:18:12Z"},{"id":"wordfence:bda01b23-1759-433a-971d-73b8458ad9ce","source":"wordfence","cve":"CVE-2025-22807","title":"Responsive Flickr Slideshow <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda01b23-1759-433a-971d-73b8458ad9ce?source=api-prod","affected":[{"type":"plugin","slug":"mobile-friendly-flickr-slideshow","name":"Responsive Flickr Slideshow","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:01:15Z"},{"id":"wordfence:bda0d24c-b1c9-4ae4-93b3-46568982d718","source":"wordfence","cve":"CVE-2022-25612","title":"Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting","severity":"medium","cvss":4.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda0d24c-b1c9-4ae4-93b3-46568982d718?source=api-prod","affected":[{"type":"plugin","slug":"simple-event-planner","name":"Simple Event Planner","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2022-03-23T10:38:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bda1f4a6-a15a-4ac9-9649-b7fbf6021776","source":"wordfence","cve":"CVE-2026-62112","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.9 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda1f4a6-a15a-4ac9-9649-b7fbf6021776?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:26:23Z"},{"id":"wordfence:bda249f7-07a9-47ba-bba4-85abd8f8a207","source":"wordfence","cve":"CVE-2025-7507","title":"elink \u2013 Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda249f7-07a9-47ba-bba4-85abd8f8a207?source=api-prod","affected":[{"type":"plugin","slug":"elink-embed-content","name":"elink \u2013 Embed Content","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:11:39Z","updated":"2025-08-15T08:25:40Z"},{"id":"wordfence:bda2f3f6-b036-4feb-bb38-1d4eaf965c24","source":"wordfence","cve":"CVE-2023-0579","title":"YARPP - Yet Another Related Posts Plugin <= 5.30.2 - Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda2f3f6-b036-4feb-bb38-1d4eaf965c24?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.3","to_inclusive":false,"patched_in":"5.30.3"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bda326b0-9049-496a-a600-fa65151ce98f","source":"wordfence","cve":"CVE-2024-13724","title":"Wallet System for WooCommerce \u2013 Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda326b0-9049-496a-a600-fa65151ce98f?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-03-03T20:17:55Z","updated":"2025-03-04T08:23:42Z"},{"id":"wordfence:bda3c8f8-fd0f-432d-a382-e8ac55d34bb9","source":"wordfence","cve":"CVE-2017-9337","title":"Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda3c8f8-fd0f-432d-a382-e8ac55d34bb9?source=api-prod","affected":[{"type":"plugin","slug":"markdown-on-save-improved","name":"Markdown on Save Improved","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2016-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bda44801-6599-459d-a70c-164f563bf158","source":"wordfence","cve":"CVE-2023-36514","title":"WooCommerce Ship to Multiple Addresses <= 3.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda44801-6599-459d-a70c-164f563bf158?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-multiple-addresses","name":"WooCommerce Ship to Multiple Addresses","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bda5e0a5-1b85-419d-ab59-997757c5dca3","source":"wordfence","cve":"CVE-2026-94120","title":"GravityExport Lite for Gravity Forms <= 2.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bda5e0a5-1b85-419d-ab59-997757c5dca3?source=api-prod","affected":[{"type":"plugin","slug":"gf-entries-in-excel","name":"GravityExport Lite for Gravity Forms","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:34:20Z"},{"id":"wordfence:bdaa32cd-a148-4554-9fd5-f5b0a5b2d1c3","source":"wordfence","cve":"CVE-2026-7652","title":"LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism","severity":"medium","cvss":5.3,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdaa32cd-a148-4554-9fd5-f5b0a5b2d1c3?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2026-05-08T14:16:05Z","updated":"2026-05-09T02:25:39Z"},{"id":"wordfence:bdab3d77-1cec-4f16-8240-c9c5227b7178","source":"wordfence","cve":"CVE-2026-110899","title":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdab3d77-1cec-4f16-8240-c9c5227b7178?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.5","to_inclusive":true,"patched_in":"3.15.6"}],"published":"2026-10-19T07:48:49Z","updated":"2026-10-23T18:39:44Z"},{"id":"wordfence:bdaf7575-0f72-4436-8a37-b3001890b710","source":"wordfence","cve":"CVE-2022-4542","title":"Compact WP Audio Player <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdaf7575-0f72-4436-8a37-b3001890b710?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdb35f31-60a6-40b5-aed3-102a1c8c4fd1","source":"wordfence","cve":"CVE-2022-45073","title":"WordPress REST API Authentication <= 2.4.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb35f31-60a6-40b5-aed3-102a1c8c4fd1?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-authentication","name":"JWT Authentication for WP REST APIs","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdb40f51-dac2-40e7-beb1-154d982f7af3","source":"wordfence","cve":"CVE-2025-11196","title":"External Login <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb40f51-dac2-40e7-beb1-154d982f7af3?source=api-prod","affected":[{"type":"plugin","slug":"external-login","name":"External Login","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:58:25Z","updated":"2025-10-15T08:26:02Z"},{"id":"wordfence:bdb4468a-cd01-4f4c-9353-d77fcf7a558f","source":"wordfence","cve":"CVE-2026-12513","title":"Shared Files Pro < 1.7.68 & Shared Files Free  < 1.7.67 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb4468a-cd01-4f4c-9353-d77fcf7a558f?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.67","to_inclusive":false,"patched_in":"1.7.67"},{"type":"plugin","slug":"shared-files-pro","name":"Shared Files Pro","from":"*","from_inclusive":true,"to":"1.7.68","to_inclusive":false,"patched_in":"1.7.68"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-22T18:42:10Z"},{"id":"wordfence:bdb5ae36-6ce2-4c26-8047-6bbbdce530c6","source":"wordfence","cve":"CVE-2021-36832","title":"Icegram <= 2.0.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb5ae36-6ce2-4c26-8047-6bbbdce530c6?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2021-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdb619c5-967c-4b8c-8a93-bcdb49137d56","source":"wordfence","cve":"CVE-2026-5742","title":"UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb619c5-967c-4b8c-8a93-bcdb49137d56?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.60","to_inclusive":true,"patched_in":"1.2.61"}],"published":"2026-04-08T14:42:18Z","updated":"2026-04-09T03:25:58Z"},{"id":"wordfence:bdb7e239-75c4-480e-a283-dc2354fe3375","source":"wordfence","cve":"","title":"All In One Slider <= 1.2.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb7e239-75c4-480e-a283-dc2354fe3375?source=api-prod","affected":[{"type":"plugin","slug":"all_in_one_carousel","name":"All In One Slider","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":"1.2.21"}],"published":"2014-02-10T00:00:00Z","updated":"2026-02-26T14:50:43Z"},{"id":"wordfence:bdb8cb7f-38fc-41d7-aa78-abe11c6402b6","source":"wordfence","cve":"","title":"Mihdan: Public Post Preview <= 1.9.9 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb8cb7f-38fc-41d7-aa78-abe11c6402b6?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-public-post-preview","name":"Mihdan: Public Post Preview","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.10"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdba8dee-f831-4316-a18e-d177762a7df4","source":"wordfence","cve":"CVE-2025-53272","title":"Image Cleanup <= 1.9.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdba8dee-f831-4316-a18e-d177762a7df4?source=api-prod","affected":[{"type":"plugin","slug":"image-cleanup","name":"Image Cleanup","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T20:32:13Z"},{"id":"wordfence:bdbb660b-19aa-4c68-865c-0a51b85d1e5a","source":"wordfence","cve":"CVE-2025-14846","title":"SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdbb660b-19aa-4c68-865c-0a51b85d1e5a?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-to-social-media-wp-to-social-champ","name":"Auto Post to Social Media from Social Champ","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-01-13T17:28:56Z","updated":"2026-02-25T15:52:24Z"},{"id":"wordfence:bdbb9f2b-dbfa-4f6a-b7df-97e47683a80e","source":"wordfence","cve":"CVE-2025-62070","title":"WowRevenue <= 1.2.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdbb9f2b-dbfa-4f6a-b7df-97e47683a80e?source=api-prod","affected":[{"type":"plugin","slug":"revenue","name":"WowRevenue \u2013 Product Bundles & Bulk Discounts","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:10:31Z"},{"id":"wordfence:bdbd3a1a-a206-4e50-893d-1b2d6c8d153a","source":"wordfence","cve":"CVE-2022-0142","title":"Visual Form Builder <= 3.0.5 - CSV Injection","severity":"medium","cvss":5.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdbd3a1a-a206-4e50-893d-1b2d6c8d153a?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdc21e2e-288e-459b-86d3-739aa4acb32d","source":"wordfence","cve":"CVE-2025-23593","title":"EmailPress <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc21e2e-288e-459b-86d3-739aa4acb32d?source=api-prod","affected":[{"type":"plugin","slug":"emailpress","name":"EmailPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-25T16:52:00Z"},{"id":"wordfence:bdc330ea-e490-43a5-93eb-a434a0e02868","source":"wordfence","cve":"CVE-2026-101923","title":"Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc330ea-e490-43a5-93eb-a434a0e02868?source=api-prod","affected":[{"type":"plugin","slug":"woo-photo-reviews","name":"Revopic \u2013 Photo Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.30","to_inclusive":true,"patched_in":"1.2.31"}],"published":"2026-10-02T17:19:45Z","updated":"2026-10-03T05:29:17Z"},{"id":"wordfence:bdc33ecc-da54-4852-8426-bfafe0dca41b","source":"wordfence","cve":"CVE-2025-5082","title":"WP Attachments <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc33ecc-da54-4852-8426-bfafe0dca41b?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachments","name":"WP Attachments \u2013 Smarter File Management & Download Lists","from":"*","from_inclusive":true,"to":"5.0.12","to_inclusive":true,"patched_in":"5.1"}],"published":"2025-05-27T19:16:07Z","updated":"2025-05-28T07:23:59Z"},{"id":"wordfence:bdc39e21-f39c-4581-895a-04e352e9b383","source":"wordfence","cve":"","title":"Wordfence < 3.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc39e21-f39c-4581-895a-04e352e9b383?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":false,"patched_in":"3.3.7"}],"published":"2012-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdc46d3e-dfb7-4586-86d2-8e4b3805ec22","source":"wordfence","cve":"CVE-2018-18919","title":"WP Editor.md \u2013 The Perfect WordPress Markdown Editor < 10.0.4 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc46d3e-dfb7-4586-86d2-8e4b3805ec22?source=api-prod","affected":[{"type":"plugin","slug":"wp-editormd","name":"WP Editor.md \u2013 The Perfect WordPress Markdown Editor","from":"*","from_inclusive":true,"to":"10.0.4","to_inclusive":false,"patched_in":"10.0.4"}],"published":"2018-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdc6db8e-9d26-4bfb-9f76-6273eaf79609","source":"wordfence","cve":"CVE-2025-62012","title":"TheGem (Elementor) <= 5.10.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc6db8e-9d26-4bfb-9f76-6273eaf79609?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.5.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-11-11T18:26:12Z"},{"id":"wordfence:bdc84664-2a04-4cc6-ac3f-48bfd432691f","source":"wordfence","cve":"","title":"WordPress Core 4.7.0-6.3.1 - Denial of Service via Cache Poisoning","severity":"medium","cvss":5.3,"cwe":"CWE-1250","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc84664-2a04-4cc6-ac3f-48bfd432691f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"4.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"4.7.27"}],"published":"2023-10-12T00:00:00Z","updated":"2024-02-06T19:52:31Z"},{"id":"wordfence:bdc8f6e2-ee2a-4a8e-9c6f-2c69b0b597e5","source":"wordfence","cve":"CVE-2025-28917","title":"Custom Smilies <= 2.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc8f6e2-ee2a-4a8e-9c6f-2c69b0b597e5?source=api-prod","affected":[{"type":"plugin","slug":"custom-smilies-se","name":"Custom Smilies","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-23T00:00:00Z","updated":"2025-03-25T17:46:39Z"},{"id":"wordfence:bdc946ed-8891-4f97-af7e-2034760eef5b","source":"wordfence","cve":"CVE-2021-24620","title":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdc946ed-8891-4f97-af7e-2034760eef5b?source=api-prod","affected":[{"type":"plugin","slug":"simple-e-commerce-shopping-cart","name":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdcab7d4-90c5-499f-85aa-91f08a1020a4","source":"wordfence","cve":"CVE-2025-31083","title":"Leaky Paywall <= 4.21.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdcab7d4-90c5-499f-85aa-91f08a1020a4?source=api-prod","affected":[{"type":"plugin","slug":"leaky-paywall","name":"Leaky Paywall","from":"*","from_inclusive":true,"to":"4.21.7","to_inclusive":true,"patched_in":"4.21.8"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:00:51Z"},{"id":"wordfence:bdcb0402-1489-441b-a2ba-51c79e0328db","source":"wordfence","cve":"CVE-2025-62060","title":"Tab Ultimate <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdcb0402-1489-441b-a2ba-51c79e0328db?source=api-prod","affected":[{"type":"plugin","slug":"tabs-pro","name":"Tab Ultimate \u2013 Responsive Tabs Plugin with Block, Shortcode & Widget","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:49:23Z"},{"id":"wordfence:bdcd9e73-ed37-4a5b-8dfa-6ef5cd6f47e2","source":"wordfence","cve":"CVE-2025-47671","title":"Binary MLM Plan <= 3.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdcd9e73-ed37-4a5b-8dfa-6ef5cd6f47e2?source=api-prod","affected":[{"type":"plugin","slug":"binary-mlm-plan","name":"Binary MLM Plan","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-05-21T00:00:00Z","updated":"2025-11-06T15:20:01Z"},{"id":"wordfence:bdce01f2-7c79-4b1d-8da2-f6ce118856a1","source":"wordfence","cve":"","title":"ARI Stream Quiz \u2013 WordPress Quizzes Builder <= 1.2.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdce01f2-7c79-4b1d-8da2-f6ce118856a1?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.2.26","to_inclusive":true,"patched_in":"1.2.27"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdceb07a-87d2-4708-b76b-5a8fcfff0818","source":"wordfence","cve":"CVE-2024-1989","title":"Social Sharing Plugin \u2013 Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdceb07a-87d2-4708-b76b-5a8fcfff0818?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.58","to_inclusive":true,"patched_in":"3.3.59"}],"published":"2024-03-05T00:00:00Z","updated":"2024-03-06T05:33:26Z"},{"id":"wordfence:bdd03b29-daeb-43bb-b54d-6d7a053a051c","source":"wordfence","cve":"CVE-2024-12773","title":"Altra Side Menu <= 2.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd03b29-daeb-43bb-b54d-6d7a053a051c?source=api-prod","affected":[{"type":"plugin","slug":"altra-side-menu","name":"Altra Side Menu","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-14T18:30:15Z"},{"id":"wordfence:bdd07160-721b-4807-a227-72cd91faef39","source":"wordfence","cve":"CVE-2024-12523","title":"States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd07160-721b-4807-a227-72cd91faef39?source=api-prod","affected":[{"type":"plugin","slug":"ymc-states-map","name":"States Map US","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:48:02Z","updated":"2024-12-14T04:23:46Z"},{"id":"wordfence:bdd0ba4b-56f1-4f4b-95f7-28c911c8de09","source":"wordfence","cve":"CVE-2026-14987","title":"GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd0ba4b-56f1-4f4b-95f7-28c911c8de09?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":true,"patched_in":"4.16.4"}],"published":"2026-07-15T13:43:51Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:bdd0bdf3-6952-4b87-a3e8-156757d22e74","source":"wordfence","cve":"","title":"WooCommerce Affiliate Plugin \u2013 Coupon Affiliates <= 4.11.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd0bdf3-6952-4b87-a3e8-156757d22e74?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"4.11.0.1","to_inclusive":true,"patched_in":"4.11.0.2"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdd1bb49-5a0f-434c-bb05-03c4a548dec1","source":"wordfence","cve":"CVE-2025-31866","title":"ShipDepot for WooCommerce <= 1.2.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd1bb49-5a0f-434c-bb05-03c4a548dec1?source=api-prod","affected":[{"type":"plugin","slug":"ship-depot","name":"ShipDepot for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:18:56Z"},{"id":"wordfence:bdd35d61-0777-4e64-8a51-55fe928e75ba","source":"wordfence","cve":"CVE-2023-35095","title":"Flo Forms <= 1.0.40 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd35d61-0777-4e64-8a51-55fe928e75ba?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":"1.0.41"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdd3868a-d741-42b4-bc7f-6fb5d33bb71b","source":"wordfence","cve":"CVE-2024-4875","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd3868a-d741-42b4-bc7f-6fb5d33bb71b?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-05-20T19:51:49Z","updated":"2024-05-21T08:31:05Z"},{"id":"wordfence:bdd4022f-b038-4351-9798-77e7c24f1173","source":"wordfence","cve":"CVE-2025-39543","title":"Royal Elementor Addons <= 1.3.977 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd4022f-b038-4351-9798-77e7c24f1173?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.977","to_inclusive":true,"patched_in":"1.3.979"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:44:16Z"},{"id":"wordfence:bdd70819-57dd-4a60-9398-68d6b87da3ca","source":"wordfence","cve":"CVE-2022-0687","title":"Appointment and Event Booking Calendar - Amelia < 1.0.47 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd70819-57dd-4a60-9398-68d6b87da3ca?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.47","to_inclusive":false,"patched_in":"1.0.47"}],"published":"2022-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdd9045e-5869-446b-9a6e-4c6766b91d05","source":"wordfence","cve":"CVE-2025-32579","title":"Sync Posts <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd9045e-5869-446b-9a6e-4c6766b91d05?source=api-prod","affected":[{"type":"plugin","slug":"sync-posts","name":"Sync Posts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-30T05:24:33Z"},{"id":"wordfence:bddad1db-3acc-4c0f-a3af-1625ec704d2f","source":"wordfence","cve":"CVE-2026-120409","title":"All-in-One Video Gallery <= 5.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bddad1db-3acc-4c0f-a3af-1625ec704d2f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:37:09Z"},{"id":"wordfence:bddba0a8-03cf-441f-9411-f770766b4f63","source":"wordfence","cve":"CVE-2021-36911","title":"Comment Engine Pro <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bddba0a8-03cf-441f-9411-f770766b4f63?source=api-prod","affected":[{"type":"plugin","slug":"comment-engine-pro","name":"Comment Engine Pro","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T10:22:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bddbbcdf-dfcb-47dd-97e7-8563eaf70cbd","source":"wordfence","cve":"CVE-2024-31105","title":"Tax Rate Upload <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bddbbcdf-dfcb-47dd-97e7-8563eaf70cbd?source=api-prod","affected":[{"type":"plugin","slug":"tax-rate-upload","name":"Tax Rate Upload","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T23:56:59Z"},{"id":"wordfence:bdddb715-4c49-419f-a599-51ff0857393a","source":"wordfence","cve":"CVE-2026-100185","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdddb715-4c49-419f-a599-51ff0857393a?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10.2.1","to_inclusive":true,"patched_in":"8.10.3"}],"published":"2026-10-13T15:09:17Z","updated":"2026-10-16T15:24:47Z"},{"id":"wordfence:bdde01aa-2d38-4085-b11a-ef8633ee928a","source":"wordfence","cve":"CVE-2025-6290","title":"Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdde01aa-2d38-4085-b11a-ef8633ee928a?source=api-prod","affected":[{"type":"plugin","slug":"tournament-bracket-generator","name":"Tournament Bracket Generator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:45:35Z","updated":"2025-06-26T02:06:34Z"},{"id":"wordfence:bdde4399-af90-4528-92a4-5176dfa5e453","source":"wordfence","cve":"CVE-2025-13717","title":"Contact Form vCard Generator <= 2.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdde4399-af90-4528-92a4-5176dfa5e453?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-vcard-generator","name":"Contact Form vCard Generator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:36:46Z","updated":"2026-01-09T11:15:34Z"},{"id":"wordfence:bde00f73-853a-420e-9c6c-0205bf371ff3","source":"wordfence","cve":"CVE-2025-69162","title":"Grecko <= 5.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde00f73-853a-420e-9c6c-0205bf371ff3?source=api-prod","affected":[{"type":"theme","slug":"grecko","name":"Grecko |  Business WordPress Theme","from":"*","from_inclusive":true,"to":"5.17","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:42:44Z"},{"id":"wordfence:bde0aef3-aa61-4ee7-9cbf-9f51cb5ac700","source":"wordfence","cve":"CVE-2026-4801","title":"Page Builder Gutenberg Blocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde0aef3-aa61-4ee7-9cbf-9f51cb5ac700?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2026-04-17T14:48:43Z","updated":"2026-04-18T03:37:03Z"},{"id":"wordfence:bde2a8a5-2d18-4659-bb35-dff4f521dbb4","source":"wordfence","cve":"CVE-2024-33913","title":"Xserver Migrator <= 1.6.2 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde2a8a5-2d18-4659-bb35-dff4f521dbb4?source=api-prod","affected":[{"type":"plugin","slug":"xserver-migrator","name":"XServer Migrator","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.2.1"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-22T13:21:09Z"},{"id":"wordfence:bde3ef64-ee36-464c-affc-95d904575499","source":"wordfence","cve":"CVE-2025-49311","title":"The Events Calendar Countdown Addon <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde3ef64-ee36-464c-affc-95d904575499?source=api-prod","affected":[{"type":"plugin","slug":"countdown-for-the-events-calendar","name":"Event Countdown for The Events Calendar","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.4.10"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:52:51Z"},{"id":"wordfence:bde748a3-0c00-4104-91ac-bc1a44dbca86","source":"wordfence","cve":"CVE-2026-96330","title":"tagDiv Opt-In Builder <= 1.7.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde748a3-0c00-4104-91ac-bc1a44dbca86?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:57:05Z"},{"id":"wordfence:bde75c5a-b0b7-4f26-91e9-dd4816e276c9","source":"wordfence","cve":"CVE-2023-5821","title":"Thumbnail carousel slider <= 1.0 - Cross-Site Request Forgery to Mass Slider Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde75c5a-b0b7-4f26-91e9-dd4816e276c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bde8b267-2bfe-4ec2-a489-6edd6269ba6e","source":"wordfence","cve":"CVE-2025-64200","title":"Email Template Customizer for WooCommerce <= 1.2.17 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde8b267-2bfe-4ec2-a489-6edd6269ba6e?source=api-prod","affected":[{"type":"plugin","slug":"email-template-customizer-for-woo","name":"Mailonix \u2013 Email Template Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2025-09-15T00:00:00Z","updated":"2025-11-04T15:47:34Z"},{"id":"wordfence:bde90d33-b36f-4ca9-87c2-f0dab723ed06","source":"wordfence","cve":"CVE-2022-36427","title":"About Rentals <= 1.5 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bde90d33-b36f-4ca9-87c2-f0dab723ed06?source=api-prod","affected":[{"type":"plugin","slug":"about-rentals","name":"About Rentals","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdeb5494-3239-417c-86dc-488e35f1b7f9","source":"wordfence","cve":"CVE-2026-25357","title":"Indeed Membership Pro <= 13.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdeb5494-3239-417c-86dc-488e35f1b7f9?source=api-prod","affected":[{"type":"plugin","slug":"indeed-membership-pro","name":"Indeed Membership Pro","from":"*","from_inclusive":true,"to":"13.7","to_inclusive":true,"patched_in":"13.7.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:07:37Z"},{"id":"wordfence:bdeba3c8-fd78-40c1-8d76-75ff927c97e4","source":"wordfence","cve":"CVE-2024-53736","title":"Custom Shortcode Sidebars <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdeba3c8-fd78-40c1-8d76-75ff927c97e4?source=api-prod","affected":[{"type":"plugin","slug":"custom-shortcode-sidebars","name":"Custom Shortcode Sidebars","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:18:32Z"},{"id":"wordfence:bdebb4a6-1bf8-4a61-b690-cf933215216a","source":"wordfence","cve":"CVE-2025-8689","title":"Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdebb4a6-1bf8-4a61-b690-cf933215216a?source=api-prod","affected":[{"type":"plugin","slug":"elements-plus","name":"Elements Plus!","from":"*","from_inclusive":true,"to":"2.16.4","to_inclusive":true,"patched_in":"2.16.5"}],"published":"2025-09-10T18:55:00Z","updated":"2025-11-25T13:54:06Z"},{"id":"wordfence:bded6765-e994-46a4-8c88-c324a4fd6ee6","source":"wordfence","cve":"CVE-2024-12527","title":"Perfect Portal Widgets <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bded6765-e994-46a4-8c88-c324a4fd6ee6?source=api-prod","affected":[{"type":"plugin","slug":"perfect-portal-widgets","name":"Perfect Portal Widgets","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-01-10T19:03:31Z","updated":"2025-01-16T14:55:30Z"},{"id":"wordfence:bdf00861-e31e-485c-a562-12dba56af1c7","source":"wordfence","cve":"CVE-2024-5221","title":"Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf00861-e31e-485c-a562-12dba56af1c7?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-06-05T20:11:18Z","updated":"2024-06-06T08:33:05Z"},{"id":"wordfence:bdf534bc-43a9-4f1b-9705-b367fbf870ac","source":"wordfence","cve":"CVE-2024-37940","title":"Seraphinite Accelerator Premium <= 2.21.13 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf534bc-43a9-4f1b-9705-b367fbf870ac?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator-ext","name":"Seraphinite Accelerator Pro","from":"*","from_inclusive":true,"to":"2.21.13","to_inclusive":true,"patched_in":"2.21.13.1"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:41:18Z"},{"id":"wordfence:bdf63cff-a159-42a3-a5b5-24a3623bfc1e","source":"wordfence","cve":"CVE-2023-2921","title":"Short URL <= 1.6.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf63cff-a159-42a3-a5b5-24a3623bfc1e?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-07-09T14:33:11Z"},{"id":"wordfence:bdf8d5c2-dbb1-47d5-b858-da6f6e1989f4","source":"wordfence","cve":"CVE-2026-11989","title":"Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdf8d5c2-dbb1-47d5-b858-da6f6e1989f4?source=api-prod","affected":[{"type":"plugin","slug":"bit-integrations","name":"Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2026-06-18T15:58:38Z","updated":"2026-06-19T04:31:34Z"},{"id":"wordfence:bdfabd43-0ffa-4c25-aa72-0572e7007a01","source":"wordfence","cve":"CVE-2022-4140","title":"Welcart e-Commerce 2.6.10-2.8.4 - Information Disclosure via Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdfabd43-0ffa-4c25-aa72-0572e7007a01?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"2.6.10","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bdfc1f2c-ee3b-4c62-854f-2ab153c2496d","source":"wordfence","cve":"CVE-2026-110014","title":"Salon Booking System <= 10.31.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdfc1f2c-ee3b-4c62-854f-2ab153c2496d?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.8","to_inclusive":true,"patched_in":"10.31.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:15:13Z"},{"id":"wordfence:be004002-a3ac-46e9-b0c1-258f05f97b2a","source":"wordfence","cve":"CVE-2023-5567","title":"QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be004002-a3ac-46e9-b0c1-258f05f97b2a?source=api-prod","affected":[{"type":"plugin","slug":"qr-code-tag","name":"QR Code Tag","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be01ffb6-9ef0-41a1-870c-fbeee48d886f","source":"wordfence","cve":"CVE-2026-18357","title":"WPC Order Tip for WooCommerce <= 3.3.0 - Information Exposure to Unauthenticated Order Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be01ffb6-9ef0-41a1-870c-fbeee48d886f?source=api-prod","affected":[{"type":"plugin","slug":"wpc-order-tip","name":"WPC Order Tip for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:48:33Z"},{"id":"wordfence:be021942-c4d2-4255-aa3f-b2cbf106cde0","source":"wordfence","cve":"CVE-2026-97302","title":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO <= 4.2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be021942-c4d2-4255-aa3f-b2cbf106cde0?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:42:23Z"},{"id":"wordfence:be03bf77-69ec-466b-bad1-22174e0d5e89","source":"wordfence","cve":"CVE-2025-31642","title":"WPCHURCH <= 2.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be03bf77-69ec-466b-bad1-22174e0d5e89?source=api-prod","affected":[{"type":"plugin","slug":"church-management","name":"WPCHURCH - Church Management System for Wordpress","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T10:40:25Z"},{"id":"wordfence:be054481-89b4-47d8-ad06-8622edea367f","source":"wordfence","cve":"CVE-2023-2558","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be054481-89b4-47d8-ad06-8622edea367f?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be071489-8de4-4a27-8d90-f41a86e02683","source":"wordfence","cve":"CVE-2024-38714","title":"WP Fast Total Search <= 1.68.232 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be071489-8de4-4a27-8d90-f41a86e02683?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.68.232","to_inclusive":true,"patched_in":"1.69.234"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T12:55:55Z"},{"id":"wordfence:be07fa12-7c2a-48f6-9792-17d8b2f5d209","source":"wordfence","cve":"CVE-2025-31842","title":"Viral Loops WP Integration <= 3.8.1 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be07fa12-7c2a-48f6-9792-17d8b2f5d209?source=api-prod","affected":[{"type":"plugin","slug":"viral-loops-wp-integration","name":"Viral Loops WP Integration","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-29T20:12:31Z"},{"id":"wordfence:be091637-0fcb-4d30-8eaa-2fe18d8eb42c","source":"wordfence","cve":"CVE-2016-10763","title":"CampTix Event Ticketing < 1.5 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be091637-0fcb-4d30-8eaa-2fe18d8eb42c?source=api-prod","affected":[{"type":"plugin","slug":"camptix","name":"CampTix Event Ticketing","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2016-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be098ee9-b749-4908-85e8-e717d019609a","source":"wordfence","cve":"CVE-2021-4447","title":"Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2021-05-05T00:00:00Z","updated":"2024-10-16T06:43:42Z"},{"id":"wordfence:be0a5922-e7ca-448e-aceb-d27002484bea","source":"wordfence","cve":"CVE-2025-48338","title":"Abstracts <= 2.7.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0a5922-e7ca-448e-aceb-d27002484bea?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-09-03T00:00:00Z","updated":"2025-10-29T21:00:04Z"},{"id":"wordfence:be0a6471-a78e-4fab-8ef5-93d16859bff4","source":"wordfence","cve":"CVE-2022-3481","title":"WooCommerce Dropshipping Premium <= 4.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0a6471-a78e-4fab-8ef5-93d16859bff4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-dropshipping","name":"WooCommerce Dropshipping Premium","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be0ab40f-cff7-48bd-8dae-cc50af047151","source":"wordfence","cve":"CVE-2023-7048","title":"My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure","severity":"low","cvss":3.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0ab40f-cff7-48bd-8dae-cc50af047151?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:37:18Z"},{"id":"wordfence:be0b26bc-ed97-42d8-985a-edb275dabfd5","source":"wordfence","cve":"CVE-2025-48100","title":"bidorbuy Store Integrator <= 2.12.0 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0b26bc-ed97-42d8-985a-edb275dabfd5?source=api-prod","affected":[{"type":"plugin","slug":"bidorbuystoreintegrator","name":"bidorbuy Store Integrator","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:53:58Z"},{"id":"wordfence:be0c29a3-0b78-4259-a514-c3674d9d5d55","source":"wordfence","cve":"CVE-2025-0169","title":"DWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0c29a3-0b78-4259-a514-c3674d9d5d55?source=api-prod","affected":[{"type":"theme","slug":"dwt-listing","name":"DWT - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-02-08T00:00:00Z","updated":"2025-02-08T22:21:30Z"},{"id":"wordfence:be0d4cf1-db98-4388-9d88-27746ef239ee","source":"wordfence","cve":"CVE-2025-32642","title":"Vite Coupon <= 1.0.9 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0d4cf1-db98-4388-9d88-27746ef239ee?source=api-prod","affected":[{"type":"plugin","slug":"vite-coupon","name":"Vite Coupon","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-04-09T00:00:00Z","updated":"2025-07-21T20:45:23Z"},{"id":"wordfence:be0db9ff-dc95-4c92-8dc4-472c5df9c0dd","source":"wordfence","cve":"CVE-2025-7387","title":"Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0db9ff-dc95-4c92-8dc4-472c5df9c0dd?source=api-prod","affected":[{"type":"plugin","slug":"lana-downloads-manager","name":"Lana Downloads Manager","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2025-07-09T00:00:00Z","updated":"2025-07-10T05:24:14Z"},{"id":"wordfence:be0dc9be-f597-46d8-badd-452e442a6d1a","source":"wordfence","cve":"CVE-2023-25792","title":"WP Open Social <= 5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0dc9be-f597-46d8-badd-452e442a6d1a?source=api-prod","affected":[{"type":"plugin","slug":"open-social","name":"WP Open Social","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be0e0e79-00c3-4237-ac65-9c5df625dd89","source":"wordfence","cve":"CVE-2014-9391","title":"gSlideShow <= 0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0e0e79-00c3-4237-ac65-9c5df625dd89?source=api-prod","affected":[{"type":"plugin","slug":"gslideshow","name":"gSlideShow","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be0e9463-359a-4db5-ba76-5d9995adceee","source":"wordfence","cve":"CVE-2026-24621","title":"Terms descriptions <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0e9463-359a-4db5-ba76-5d9995adceee?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2026-01-10T14:56:44Z","updated":"2026-02-03T14:02:02Z"},{"id":"wordfence:be0e9e67-efc1-4a21-ba32-4a963166350d","source":"wordfence","cve":"CVE-2025-8046","title":"Injection Guard <= 1.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0e9e67-efc1-4a21-ba32-4a963166350d?source=api-prod","affected":[{"type":"plugin","slug":"injection-guard","name":"Injection Guard","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-07-24T00:00:00Z","updated":"2025-08-25T15:39:15Z"},{"id":"wordfence:be0ef9d4-abb0-4801-b847-b84912bc6677","source":"wordfence","cve":"","title":"BCS BatchLine Book Importer <= 1.5.7 - Arbitrary Product Import/Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be0ef9d4-abb0-4801-b847-b84912bc6677?source=api-prod","affected":[{"type":"plugin","slug":"bcs-bertline-book-importer","name":"BCS BatchLine Book Importer","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2021-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be10894d-2a86-4f07-8119-e6eac8c9c950","source":"wordfence","cve":"CVE-2023-36687","title":"Menubar <= 5.8.2 - Cross-Site Request Forgery in wpm-admin.php","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be10894d-2a86-4f07-8119-e6eac8c9c950?source=api-prod","affected":[{"type":"plugin","slug":"menubar","name":"Menubar","from":"*","from_inclusive":true,"to":"5.8.2","to_inclusive":true,"patched_in":"5.9"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be151552-827c-43a6-a0e0-da19884448fd","source":"wordfence","cve":"CVE-2024-9607","title":"10Web Social Post Feed <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be151552-827c-43a6-a0e0-da19884448fd?source=api-prod","affected":[{"type":"plugin","slug":"wd-facebook-feed","name":"10Web Social Post Feed","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T18:29:21Z","updated":"2024-10-25T06:51:26Z"},{"id":"wordfence:be16349f-31aa-41b8-a4fa-95db3141ba9b","source":"wordfence","cve":"CVE-2026-97019","title":"AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be16349f-31aa-41b8-a4fa-95db3141ba9b?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":"1.1.18"}],"published":"2026-10-27T14:18:12Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:be16c229-1092-4090-83bc-38e42f6377b6","source":"wordfence","cve":"CVE-2014-4530","title":"Flog <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be16c229-1092-4090-83bc-38e42f6377b6?source=api-prod","affected":[{"type":"plugin","slug":"flog","name":"flog","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be1ab218-37bd-407a-8cb9-66f761849c21","source":"wordfence","cve":"CVE-2020-36724","title":"Wordable <= 3.1.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be1ab218-37bd-407a-8cb9-66f761849c21?source=api-prod","affected":[{"type":"plugin","slug":"wordable","name":"Wordable \u2013 Export Google Docs to WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2020-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be1bc322-1d42-4e33-adff-dbe706bb9f58","source":"wordfence","cve":"CVE-2026-59512","title":"PiWeb Product Enquiry or product catalog for WooCommerce <= 2.2.34.43 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be1bc322-1d42-4e33-adff-dbe706bb9f58?source=api-prod","affected":[{"type":"plugin","slug":"enquiry-quotation-for-woocommerce","name":"PiWeb Product Enquiry or product catalog for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.34.43","to_inclusive":true,"patched_in":"2.2.34.44"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:41:35Z"},{"id":"wordfence:be1d9d2b-cbdf-4d62-85fe-2616eaf02848","source":"wordfence","cve":"CVE-2024-10402","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be1d9d2b-cbdf-4d62-85fe-2616eaf02848?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.35.1","to_inclusive":true,"patched_in":"1.36.0"}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T11:38:03Z"},{"id":"wordfence:be1e0216-d9de-45e9-837c-0cccb78729a6","source":"wordfence","cve":"CVE-2024-9445","title":"Display Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be1e0216-d9de-45e9-837c-0cccb78729a6?source=api-prod","affected":[{"type":"plugin","slug":"display-medium-posts","name":"Display Medium Posts","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-03T13:32:45Z","updated":"2024-10-04T02:04:57Z"},{"id":"wordfence:be224599-ab12-4fb3-9ab4-eecbbc33445b","source":"wordfence","cve":"CVE-2025-49371","title":"Strux <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be224599-ab12-4fb3-9ab4-eecbbc33445b?source=api-prod","affected":[{"type":"theme","slug":"strux","name":"Strux - Architecture & Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:22:55Z"},{"id":"wordfence:be23388e-9371-4ea0-974b-80f76de90012","source":"wordfence","cve":"CVE-2023-51407","title":"Split Test For Elementor <= 1.6.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be23388e-9371-4ea0-974b-80f76de90012?source=api-prod","affected":[{"type":"plugin","slug":"split-test-for-elementor","name":"Split Test For Elementor","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be23d61f-1e7f-40fb-88ca-dd0ed226a7c5","source":"wordfence","cve":"CVE-2026-42736","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be23d61f-1e7f-40fb-88ca-dd0ed226a7c5?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.14.16","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T12:07:01Z"},{"id":"wordfence:be24d47e-4880-4d7f-9be2-cf8eb1afe888","source":"wordfence","cve":"CVE-2021-24332","title":"Autoptimize <= 2.8.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be24d47e-4880-4d7f-9be2-cf8eb1afe888?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.8.4"}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be2579e3-8e40-4603-9ec1-38f43dc1aa29","source":"wordfence","cve":"CVE-2026-15000","title":"Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be2579e3-8e40-4603-9ec1-38f43dc1aa29?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-mailchimp-extension","name":"Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend","from":"*","from_inclusive":true,"to":"0.9.78.06","to_inclusive":true,"patched_in":"0.9.78.07"}],"published":"2026-07-08T18:10:09Z","updated":"2026-07-09T06:52:48Z"},{"id":"wordfence:be2ba063-140e-4c92-a57d-79f366631b3d","source":"wordfence","cve":"CVE-2026-2418","title":"Login with Salesforce <= 1.0.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be2ba063-140e-4c92-a57d-79f366631b3d?source=api-prod","affected":[{"type":"plugin","slug":"login-with-salesforce","name":"Login with Salesforce","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-12T00:00:00Z","updated":"2026-05-04T14:52:24Z"},{"id":"wordfence:be2c1555-4616-4759-bd9b-12f8b3c3a3d4","source":"wordfence","cve":"CVE-2018-21013","title":"Swape - App Showcase & App Store WordPress Theme < 1.2.1 - Missing Authorization to Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be2c1555-4616-4759-bd9b-12f8b3c3a3d4?source=api-prod","affected":[{"type":"theme","slug":"swape","name":"Swape - App Showcase & App Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2018-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be2d005f-a056-4c53-91a6-7de422cdec89","source":"wordfence","cve":"CVE-2024-12769","title":"Simple Banner <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be2d005f-a056-4c53-91a6-7de422cdec89?source=api-prod","affected":[{"type":"plugin","slug":"simple-banner","name":"Simple Banner \u2013 Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-18T15:35:15Z"},{"id":"wordfence:be30e951-7c8d-4baf-9288-0d12dacc0dc2","source":"wordfence","cve":"CVE-2026-9237","title":"Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be30e951-7c8d-4baf-9288-0d12dacc0dc2?source=api-prod","affected":[{"type":"plugin","slug":"hr-management","name":"Employee, Leave and Recruitment Management System \u2013 Crew HRM","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-07-08T20:53:08Z","updated":"2026-07-09T09:31:22Z"},{"id":"wordfence:be31866c-7490-4be2-9a4d-2a3771c6fea1","source":"wordfence","cve":"CVE-2015-2220","title":"Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be31866c-7490-4be2-9a4d-2a3771c6fea1?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":false,"patched_in":"2.8.9"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be320456-acab-478b-a4b5-807feb7fb9b4","source":"wordfence","cve":"CVE-2024-10145","title":"Hubbub Lite <= 1.34.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be320456-acab-478b-a4b5-807feb7fb9b4?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.34.3","to_inclusive":true,"patched_in":"1.34.4"}],"published":"2025-03-02T00:00:00Z","updated":"2025-05-27T14:54:55Z"},{"id":"wordfence:be3208c8-aceb-4ac9-91e1-d5de5a85f74d","source":"wordfence","cve":"CVE-2023-49177","title":"which template file <= 5.0.0 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3208c8-aceb-4ac9-91e1-d5de5a85f74d?source=api-prod","affected":[{"type":"plugin","slug":"which-template-file","name":"which template file","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2023-11-29T00:00:00Z","updated":"2025-02-03T15:00:52Z"},{"id":"wordfence:be33065e-dae8-44cf-9f8a-f9971f2743ff","source":"wordfence","cve":"CVE-2024-31284","title":"EmbedPress <= 3.9.8 - Missing Authorization via handle_calendly_data","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be33065e-dae8-44cf-9f8a-f9971f2743ff?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:47:01Z"},{"id":"wordfence:be3411ec-0e34-4b0b-a04c-98ac94396989","source":"wordfence","cve":"CVE-2025-13381","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3411ec-0e34-4b0b-a04c-98ac94396989?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T09:27:49Z"},{"id":"wordfence:be374684-bb02-4d2c-b8a0-ed435c7c8569","source":"wordfence","cve":"CVE-2022-2170","title":"Microsoft Advertising Universal Event Tracking (UET) <= 1.0.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be374684-bb02-4d2c-b8a0-ed435c7c8569?source=api-prod","affected":[{"type":"plugin","slug":"microsoft-advertising-universal-event-tracking-uet","name":"Microsoft Advertising Universal Event Tracking (UET)","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be3869a9-f72d-4bbb-ba51-d2761ca761f2","source":"wordfence","cve":"CVE-2024-8434","title":"Easy Mega Menu Plugin for WordPress \u2013 ThemeHunk <= 1.0.9 -  Missing Authorization to Authenticated (Subscriber+) Settings Updates","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3869a9-f72d-4bbb-ba51-d2761ca761f2?source=api-prod","affected":[{"type":"plugin","slug":"themehunk-megamenu-plus","name":"Easy Mega Menu for WordPress \u2013 ThemeHunk","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:24Z"},{"id":"wordfence:be398def-e887-4188-9a21-419f11b1a5b0","source":"wordfence","cve":"CVE-2024-35719","title":"RestroPress \u2013 Online Food Ordering System <= 3.1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be398def-e887-4188-9a21-419f11b1a5b0?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.1.2.1","to_inclusive":true,"patched_in":"3.1.2.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:59:13Z"},{"id":"wordfence:be39e24f-d7d7-44db-9ffd-a4605de8e577","source":"wordfence","cve":"CVE-2025-8268","title":"Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be39e24f-d7d7-44db-9ffd-a4605de8e577?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2025-09-03T07:55:41Z","updated":"2025-09-03T20:24:15Z"},{"id":"wordfence:be3a0b4b-cce5-4d78-99d5-697f2cf04427","source":"wordfence","cve":"CVE-2024-11082","title":"Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3a0b4b-cce5-4d78-99d5-697f2cf04427?source=api-prod","affected":[{"type":"plugin","slug":"tumult-hype-animations","name":"Tumult Hype Animations","from":"*","from_inclusive":true,"to":"1.9.15","to_inclusive":true,"patched_in":"1.9.16"}],"published":"2024-11-27T20:52:51Z","updated":"2024-11-28T09:47:14Z"},{"id":"wordfence:be3a1bff-c20a-43c6-9f7f-3190d5b9c563","source":"wordfence","cve":"CVE-2025-58982","title":"Pixeline's Email Protector <= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3a1bff-c20a-43c6-9f7f-3190d5b9c563?source=api-prod","affected":[{"type":"plugin","slug":"pixelines-email-protector","name":"Pixeline\u2019s Email Protector","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:11:00Z"},{"id":"wordfence:be3a3bc2-ce36-42b3-8295-c2f2642df006","source":"wordfence","cve":"CVE-2026-93343","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3a3bc2-ce36-42b3-8295-c2f2642df006?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.71","to_inclusive":true,"patched_in":"2.1.72"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:07:16Z"},{"id":"wordfence:be3bd1f2-092c-47c4-a4e4-3365e107c57f","source":"wordfence","cve":"CVE-2024-2294","title":"Backuply \u2013 Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3bd1f2-092c-47c4-a4e4-3365e107c57f?source=api-prod","affected":[{"type":"plugin","slug":"backuply","name":"Backuply \u2013 Backup, Restore, Migrate and Clone","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T01:55:44Z"},{"id":"wordfence:be3c8800-cbef-4d85-a1f3-b5c70ba955b5","source":"wordfence","cve":"CVE-2024-13527","title":"Philantro \u2013 Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be3c8800-cbef-4d85-a1f3-b5c70ba955b5?source=api-prod","affected":[{"type":"plugin","slug":"philantro","name":"Philantro \u2013 Donations and Donor Management","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-28T08:21:35Z"},{"id":"wordfence:be4061ef-849a-4797-aeee-07da2afc1a40","source":"wordfence","cve":"CVE-2022-29451","title":"Rara One Click Demo Import <= 1.2.9 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4061ef-849a-4797-aeee-07da2afc1a40?source=api-prod","affected":[{"type":"plugin","slug":"rara-one-click-demo-import","name":"Rara One Click Demo Import","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-04-21T13:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be41bf79-8cc3-41fa-856a-1b6c06e647c7","source":"wordfence","cve":"CVE-2026-28074","title":"Pizza House <= 1.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be41bf79-8cc3-41fa-856a-1b6c06e647c7?source=api-prod","affected":[{"type":"theme","slug":"pizzahouse","name":"Pizza House - Restaurant / Cafe / Bistro WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T15:57:19Z"},{"id":"wordfence:be436047-6bea-465b-8de1-b0a081a85ed6","source":"wordfence","cve":"CVE-2026-57747","title":"Booked - Appointment Booking for WordPress <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be436047-6bea-465b-8de1-b0a081a85ed6?source=api-prod","affected":[{"type":"plugin","slug":"booked","name":"Booked - Appointment Booking for WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:06:58Z"},{"id":"wordfence:be44a7e0-f0e0-4e2e-ac1e-0550d8e5d994","source":"wordfence","cve":"","title":"SpeakOut! Email Petitions <= 2.13.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be44a7e0-f0e0-4e2e-ac1e-0550d8e5d994?source=api-prod","affected":[{"type":"plugin","slug":"speakout","name":"SpeakOut! Email Petitions","from":"*","from_inclusive":true,"to":"2.13.1.1","to_inclusive":true,"patched_in":"2.13.3"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be4515d8-0d5d-4925-a9a4-64ba9d51fe02","source":"wordfence","cve":"CVE-2006-6017","title":"WordPress Core <= 2.0.4 - Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4515d8-0d5d-4925-a9a4-64ba9d51fe02?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2006-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be4566c9-d003-4dc3-91f4-ff6cb6f1069a","source":"wordfence","cve":"CVE-2025-31744","title":"Lightweight and Responsive Youtube Embed <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4566c9-d003-4dc3-91f4-ff6cb6f1069a?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-and-responsive-youtube-embed","name":"Lightweight and Responsive Youtube Embed","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:38:29Z"},{"id":"wordfence:be4743d5-e4ca-4579-84e2-5eb3ef0e274d","source":"wordfence","cve":"CVE-2026-12923","title":"Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4743d5-e4ca-4579-84e2-5eb3ef0e274d?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-06-30T15:01:25Z","updated":"2026-07-01T03:43:37Z"},{"id":"wordfence:be4c0d73-9816-4e04-bcf8-a3be0488de7f","source":"wordfence","cve":"CVE-2026-25465","title":"CP Multi View Events Calendar <= 1.4.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4c0d73-9816-4e04-bcf8-a3be0488de7f?source=api-prod","affected":[{"type":"plugin","slug":"cp-multi-view-calendar","name":"CP Multi View Events Calendar","from":"*","from_inclusive":true,"to":"1.4.39","to_inclusive":true,"patched_in":"1.4.40"}],"published":"2026-03-17T00:00:00Z","updated":"2026-09-09T16:06:18Z"},{"id":"wordfence:be4ce3e6-8baa-419f-a48e-4256c306fbc1","source":"wordfence","cve":"CVE-2024-2042","title":"ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4ce3e6-8baa-419f-a48e-4256c306fbc1?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-16T02:34:28Z"},{"id":"wordfence:be4f5da0-77ec-41eb-85bd-c019e71d4c9d","source":"wordfence","cve":"CVE-2015-9354","title":"GigPress <= 2.3.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4f5da0-77ec-41eb-85bd-c019e71d4c9d?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be4fac77-93f3-4c5d-b139-66e799143533","source":"wordfence","cve":"CVE-2025-52803","title":"Sala <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be4fac77-93f3-4c5d-b139-66e799143533?source=api-prod","affected":[{"type":"theme","slug":"sala","name":"Sala - Startup & SaaS WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-16T18:39:26Z"},{"id":"wordfence:be5142f6-36da-4715-91d2-7d6665c0efa6","source":"wordfence","cve":"CVE-2024-12272","title":"WP Travel Engine \u2013 Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5142f6-36da-4715-91d2-7d6665c0efa6?source=api-prod","affected":[{"type":"plugin","slug":"wte-elementor-widgets","name":"WP Travel Engine \u2013 Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T03:21:35Z"},{"id":"wordfence:be51c54d-b0f7-42b2-b9b3-1b5832e10a6b","source":"wordfence","cve":"CVE-2024-8324","title":"XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be51c54d-b0f7-42b2-b9b3-1b5832e10a6b?source=api-prod","affected":[{"type":"plugin","slug":"xo-liteslider","name":"XO Slider","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T08:30:19Z"},{"id":"wordfence:be53bdbd-e797-4198-8ef9-bc01b5da68f4","source":"wordfence","cve":"CVE-2014-3870","title":"bib2html <= 0.9.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be53bdbd-e797-4198-8ef9-bc01b5da68f4?source=api-prod","affected":[{"type":"plugin","slug":"bib2html","name":"bib2html","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be5be40f-89da-4b97-9a85-527602d84c4d","source":"wordfence","cve":"CVE-2024-5969","title":"AIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5be40f-89da-4b97-9a85-527602d84c4d?source=api-prod","affected":[{"type":"plugin","slug":"aiomatic-automatic-ai-content-writer","name":"Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-06-14T00:00:00Z","updated":"2024-07-27T07:33:48Z"},{"id":"wordfence:be5cc744-e88e-4a8b-81d1-3e05abba19d8","source":"wordfence","cve":"CVE-2026-32387","title":"Checkout for PayPal <= 1.0.46 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5cc744-e88e-4a8b-81d1-3e05abba19d8?source=api-prod","affected":[{"type":"plugin","slug":"checkout-for-paypal","name":"Checkout for PayPal","from":"*","from_inclusive":true,"to":"1.0.46","to_inclusive":true,"patched_in":"1.0.47"}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-15T20:55:49Z"},{"id":"wordfence:be5d86ad-f94b-4fcb-9b74-ecddde2bf29d","source":"wordfence","cve":"CVE-2025-3438","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation","severity":"medium","cvss":6.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5d86ad-f94b-4fcb-9b74-ecddde2bf29d?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.17.4","to_inclusive":true,"patched_in":"4.17.5"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T05:22:36Z"},{"id":"wordfence:be5dada1-7ca0-4451-b567-1c6c6ca3e847","source":"wordfence","cve":"CVE-2026-84743","title":"The Events Calendar 6.15.16.1 - 6.17.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5dada1-7ca0-4451-b567-1c6c6ca3e847?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"6.15.16.1","from_inclusive":true,"to":"6.17.4.1","to_inclusive":true,"patched_in":"6.17.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:51:33Z"},{"id":"wordfence:be5eb703-8dcb-4e54-b81a-0c0e35dc29b0","source":"wordfence","cve":"CVE-2025-31885","title":"Hyperlink Group Block <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be5eb703-8dcb-4e54-b81a-0c0e35dc29b0?source=api-prod","affected":[{"type":"plugin","slug":"hyperlink-group-block","name":"Hyperlink Group Block","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-12T14:08:35Z"},{"id":"wordfence:be60027e-9d6a-4740-b20c-6be3e115d9fe","source":"wordfence","cve":"CVE-2015-9505","title":"Easy Digital Downloads \u2013 Simple eCommerce for Selling Digital Files <= 2.3.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be60027e-9d6a-4740-b20c-6be3e115d9fe?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":false,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"1.9","from_inclusive":true,"to":"1.9.10","to_inclusive":false,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.0","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.1","from_inclusive":true,"to":"2.1.11","to_inclusive":false,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.2","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"1.8.7"},{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"2.3","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"1.8.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be60b765-3bd6-43dd-8cdc-d9c493a503e5","source":"wordfence","cve":"CVE-2015-9443","title":"WP Accurate Form Data <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be60b765-3bd6-43dd-8cdc-d9c493a503e5?source=api-prod","affected":[{"type":"plugin","slug":"accurate-form-data-real-time-form-validation","name":"WP Accurate Form Data","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2015-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be60b94f-d7bc-46e1-b47b-42d044597cc6","source":"wordfence","cve":"CVE-2024-10703","title":"Registrations for the Events Calendar <= 2.13.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be60b94f-d7bc-46e1-b47b-42d044597cc6?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.13.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:09:51Z"},{"id":"wordfence:be61e0ab-bcd9-4e8d-b6b6-ab1663f064a4","source":"wordfence","cve":"CVE-2025-67530","title":"Besa <= 2.3.15 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be61e0ab-bcd9-4e8d-b6b6-ab1663f064a4?source=api-prod","affected":[{"type":"theme","slug":"besa","name":"Besa - Elementor Marketplace WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T16:59:41Z"},{"id":"wordfence:be62e2ea-0861-4815-b98a-1ea508df952d","source":"wordfence","cve":"CVE-2025-52786","title":"Media Folder <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be62e2ea-0861-4815-b98a-1ea508df952d?source=api-prod","affected":[{"type":"plugin","slug":"media-folder","name":"Media Folder","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T12:52:06Z"},{"id":"wordfence:be6592b8-d60f-48c3-bda3-8fd69dcf1d0b","source":"wordfence","cve":"CVE-2025-69395","title":"Gable <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6592b8-d60f-48c3-bda3-8fd69dcf1d0b?source=api-prod","affected":[{"type":"theme","slug":"gable","name":"Gable - Structure & Building Franework WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:37:03Z"},{"id":"wordfence:be6afae1-621a-4291-ae2c-793a60268fbf","source":"wordfence","cve":"CVE-2013-6880","title":"Time Sheets <= 2.1.3 - Use of Known Vulnerable Component","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6afae1-621a-4291-ae2c-793a60268fbf?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:30:21Z","updated":"2026-10-22T05:29:50Z"},{"id":"wordfence:be6c08b9-bba7-4780-99b9-4b80e6b4872a","source":"wordfence","cve":"CVE-2015-7791","title":"Welcart e-Commerce < 1.5.3 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6c08b9-bba7-4780-99b9-4b80e6b4872a?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2015-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be6c9176-6ace-4570-8b3c-2508d1937478","source":"wordfence","cve":"CVE-2024-52351","title":"BU Slideshow <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6c9176-6ace-4570-8b3c-2508d1937478?source=api-prod","affected":[{"type":"plugin","slug":"bu-slideshow","name":"BU Slideshow","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:50:42Z"},{"id":"wordfence:be6db702-43bc-4d1f-a222-d323c70c6bb3","source":"wordfence","cve":"CVE-2026-28135","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1052 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6db702-43bc-4d1f-a222-d323c70c6bb3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1052","to_inclusive":true,"patched_in":"1.7.1053"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-14T14:14:08Z"},{"id":"wordfence:be6f660f-041a-42f2-ab5b-72aedf75727d","source":"wordfence","cve":"CVE-2023-3369","title":"About Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be6f660f-041a-42f2-ab5b-72aedf75727d?source=api-prod","affected":[{"type":"plugin","slug":"about-me-3000","name":"About Me 3000 widget","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be700f83-248f-4d22-b53d-7cc61e1f7d7d","source":"wordfence","cve":"","title":"Wordfence <= 5.2.3 - Multiple Protection Mechanism Bypasses","severity":"medium","cvss":6.5,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be700f83-248f-4d22-b53d-7cc61e1f7d7d?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":false,"patched_in":"5.2.4"}],"published":"2014-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be70f816-14b1-4c7b-8529-146bcd5d4cf3","source":"wordfence","cve":"CVE-2013-2501","title":"Terillion Reviews < 1.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be70f816-14b1-4c7b-8529-146bcd5d4cf3?source=api-prod","affected":[{"type":"plugin","slug":"terillion-reviews","name":"Terillion Reviews","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2013-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be71a324-2bf9-4257-947d-6998d59ad7cc","source":"wordfence","cve":"CVE-2025-22788","title":"CoDesigner WooCommerce Builder for Elementor <= 4.21 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be71a324-2bf9-4257-947d-6998d59ad7cc?source=api-prod","affected":[{"type":"plugin","slug":"woolementor","name":"CoDesigner \u2013 All in One Elementor WooCommerce Builder","from":"*","from_inclusive":true,"to":"4.21","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-05-29T19:58:06Z"},{"id":"wordfence:be71d0ad-8306-451d-8276-321ca7ce088b","source":"wordfence","cve":"CVE-2026-14550","title":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System < 3.0.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be71d0ad-8306-451d-8276-321ca7ce088b?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":false,"patched_in":"3.0.18"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:05:12Z"},{"id":"wordfence:be73e45a-ce00-4a1f-b722-32a94c5beadc","source":"wordfence","cve":"CVE-2024-43157","title":"FormCraft <= 1.2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be73e45a-ce00-4a1f-b722-32a94c5beadc?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:40:22Z"},{"id":"wordfence:be759c83-a9df-4858-a724-28006a595404","source":"wordfence","cve":"CVE-2024-0683","title":"Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be759c83-a9df-4858-a724-28006a595404?source=api-prod","affected":[{"type":"plugin","slug":"bulgarisation-for-woocommerce","name":"Bulgarisation for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:37:19Z"},{"id":"wordfence:be76a310-d99f-43d8-a845-6bf20eb9a11d","source":"wordfence","cve":"CVE-2025-24614","title":"Post Timeline <= 2.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be76a310-d99f-43d8-a845-6bf20eb9a11d?source=api-prod","affected":[{"type":"plugin","slug":"post-timeline","name":"Post Timeline","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2024-12-29T00:00:00Z","updated":"2025-03-03T20:53:59Z"},{"id":"wordfence:be78b7d5-3f99-46de-b2b8-14254ee1ab71","source":"wordfence","cve":"CVE-2026-13710","title":"Jeg Kit for Elementor <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_body_description' Parameter via 'jkit_image_box' Shortcode/Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be78b7d5-3f99-46de-b2b8-14254ee1ab71?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2026-07-09T20:51:09Z","updated":"2026-07-10T09:32:44Z"},{"id":"wordfence:be7c6cfa-6cac-46d2-8eb9-9fef8049f6e7","source":"wordfence","cve":"CVE-2024-6521","title":"Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be7c6cfa-6cac-46d2-8eb9-9fef8049f6e7?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.19","to_inclusive":true,"patched_in":"5.1.20"}],"published":"2024-07-26T23:10:10Z","updated":"2024-07-29T14:17:56Z"},{"id":"wordfence:be7ec812-ee9e-4b19-bb99-27e8016b8013","source":"wordfence","cve":"CVE-2024-6272","title":"SpiderContacts <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be7ec812-ee9e-4b19-bb99-27e8016b8013?source=api-prod","affected":[{"type":"plugin","slug":"spider-contacts","name":"SpiderContacts","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-09T20:27:40Z"},{"id":"wordfence:be7f8b73-801d-46e8-81c1-8bb0bb576700","source":"wordfence","cve":"CVE-2023-5335","title":"Buzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be7f8b73-801d-46e8-81c1-8bb0bb576700?source=api-prod","affected":[{"type":"plugin","slug":"buzzsprout-podcasting","name":"Buzzsprout Podcasting","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be82095d-2b15-432e-a667-523286fa9629","source":"wordfence","cve":"CVE-2024-12452","title":"Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be82095d-2b15-432e-a667-523286fa9629?source=api-prod","affected":[{"type":"plugin","slug":"ziggeo","name":"Ziggeo","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-02-20T00:00:00Z","updated":"2025-02-21T09:21:07Z"},{"id":"wordfence:be826d7f-6f8e-4942-81d5-2b00debd56fc","source":"wordfence","cve":"CVE-2026-48970","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be826d7f-6f8e-4942-81d5-2b00debd56fc?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.5.10","to_inclusive":true,"patched_in":"9.5.10.1"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-11T13:25:49Z"},{"id":"wordfence:be837a77-9b25-43af-aaba-94a8aa59e7e3","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be837a77-9b25-43af-aaba-94a8aa59e7e3?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.15","to_inclusive":false,"patched_in":"4.6.15"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be83c6be-fb6c-462f-b54a-ca12d6d2581f","source":"wordfence","cve":"CVE-2024-7778","title":"Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be83c6be-fb6c-462f-b54a-ca12d6d2581f?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.36","to_inclusive":true,"patched_in":"2.10.37"}],"published":"2024-08-21T20:32:11Z","updated":"2024-08-22T09:29:30Z"},{"id":"wordfence:be841d6b-e3b6-46d2-aba8-fee20c21e933","source":"wordfence","cve":"CVE-2023-25063","title":"Quick Page/Post Redirect <= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be841d6b-e3b6-46d2-aba8-fee20c21e933?source=api-prod","affected":[{"type":"plugin","slug":"quick-pagepost-redirect-plugin","name":"Quick Page/Post Redirect Plugin","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be860b7c-f0ac-4c28-8d7b-dc19f495476b","source":"wordfence","cve":"CVE-2024-51786","title":"Realty by BestWebSoft <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be860b7c-f0ac-4c28-8d7b-dc19f495476b?source=api-prod","affected":[{"type":"plugin","slug":"realty","name":"Realty by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:15:46Z"},{"id":"wordfence:be86c751-499b-4772-a457-14427fa56c39","source":"wordfence","cve":"CVE-2026-14549","title":"Ray Enterprise Translation <= 1.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be86c751-499b-4772-a457-14427fa56c39?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-08-11T00:00:00Z","updated":"2026-11-06T15:21:04Z"},{"id":"wordfence:be88566d-fc84-442d-bb34-834ad9f4465b","source":"wordfence","cve":"CVE-2024-4636","title":"Image Optimization by Optimole \u2013 Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be88566d-fc84-442d-bb34-834ad9f4465b?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"3.12.10","to_inclusive":true,"patched_in":"3.13.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T06:51:59Z"},{"id":"wordfence:be8afa0c-af65-46d7-af07-de67353eddb5","source":"wordfence","cve":"CVE-2026-61951","title":"TrueBooker \u2013 Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be8afa0c-af65-46d7-af07-de67353eddb5?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-07-17T00:00:00Z","updated":"2026-07-30T17:04:48Z"},{"id":"wordfence:be8dcff9-1626-4919-b297-c423891f3d02","source":"wordfence","cve":"CVE-2023-23897","title":"Simple Mobile URL Redirect <= 1.7.2 - Cross-Site Request Forgery leading to Mobile Redirect Updates","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be8dcff9-1626-4919-b297-c423891f3d02?source=api-prod","affected":[{"type":"plugin","slug":"simple-mobile-url-redirect","name":"Simple Mobile URL Redirect","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be8ec147-1469-449b-b51b-f1c328b1922f","source":"wordfence","cve":"CVE-2024-37929","title":"User Activity Log Pro <= 2.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be8ec147-1469-449b-b51b-f1c328b1922f?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log-pro","name":"User Activity Log Pro","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T19:32:26Z"},{"id":"wordfence:be8f5771-6ef4-4e5c-8684-5ae9a3a0b9db","source":"wordfence","cve":"CVE-2026-93000","title":"SPS-Suite <= 1.4.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be8f5771-6ef4-4e5c-8684-5ae9a3a0b9db?source=api-prod","affected":[{"type":"plugin","slug":"sps-suite-121","name":"SPS-Suite","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:45:37Z"},{"id":"wordfence:be913494-f4a7-4718-ac2b-da4baf2b0a21","source":"wordfence","cve":"CVE-2024-12073","title":"Meteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be913494-f4a7-4718-ac2b-da4baf2b0a21?source=api-prod","affected":[{"type":"plugin","slug":"meteor-slides","name":"Meteor Slides","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:22:06Z","updated":"2025-01-07T05:23:58Z"},{"id":"wordfence:be94ba55-24e3-4d61-9f2b-e2a4699bc6f6","source":"wordfence","cve":"CVE-2025-27309","title":"flickr-slideshow-wrapper <= 5.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be94ba55-24e3-4d61-9f2b-e2a4699bc6f6?source=api-prod","affected":[{"type":"plugin","slug":"flickr-slideshow-wrapper","name":"flickr-slideshow-wrapper","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:34:46Z"},{"id":"wordfence:be9522c8-3561-48fe-89ef-62e0fcb085b0","source":"wordfence","cve":"CVE-2023-44993","title":"ChatBot <= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9522c8-3561-48fe-89ef-62e0fcb085b0?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be964722-2080-4289-a960-a460a8d09c9e","source":"wordfence","cve":"CVE-2026-25416","title":"News Kit Addons For Elementor <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be964722-2080-4289-a960-a460a8d09c9e?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-01-28T00:00:00Z","updated":"2026-06-23T17:34:26Z"},{"id":"wordfence:be976b54-2418-440c-9f27-667a4156ef08","source":"wordfence","cve":"CVE-2026-39560","title":"Hiroshi <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be976b54-2418-440c-9f27-667a4156ef08?source=api-prod","affected":[{"type":"theme","slug":"hiroshi","name":"Hiroshi - Architecture and Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:04:10Z"},{"id":"wordfence:be97aad7-4f74-4e6b-9a2b-19aaf8483ef3","source":"wordfence","cve":"CVE-2026-123703","title":"Security For WooCommerce <= 1.0.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be97aad7-4f74-4e6b-9a2b-19aaf8483ef3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:03:43Z"},{"id":"wordfence:be97e1ca-6c9c-4641-ba7c-bbb14a58d99e","source":"wordfence","cve":"","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.2 - Arbitary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be97e1ca-6c9c-4641-ba7c-bbb14a58d99e?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"}],"published":"2016-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:be9811b8-602f-4525-bc15-75e5efe794f6","source":"wordfence","cve":"CVE-2026-78279","title":"Fluent Support Pro <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9811b8-602f-4525-bc15-75e5efe794f6?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support-pro","name":"Fluent Support Pro","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:29:14Z"},{"id":"wordfence:be9a0345-fb78-4cde-8d20-002e97825c4e","source":"wordfence","cve":"CVE-2025-67525","title":"ekommart < 4.3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9a0345-fb78-4cde-8d20-002e97825c4e?source=api-prod","affected":[{"type":"theme","slug":"ekommart","name":"ekommart - All-in-one eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":false,"patched_in":"4.3.1"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:16:49Z"},{"id":"wordfence:be9abb15-f375-4dca-a998-e621d50fa273","source":"wordfence","cve":"CVE-2025-5752","title":"Vertical scroll image slideshow gallery <= 11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9abb15-f375-4dca-a998-e621d50fa273?source=api-prod","affected":[{"type":"plugin","slug":"vertical-scroll-image-slideshow-gallery","name":"Vertical scroll image slideshow gallery","from":"*","from_inclusive":true,"to":"11.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:29:59Z","updated":"2025-07-18T05:24:00Z"},{"id":"wordfence:be9d977d-d7b2-4946-b107-35df176fbdf3","source":"wordfence","cve":"CVE-2024-5662","title":"Ultimate Post Kit Addons For Elementor \u2013 (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9d977d-d7b2-4946-b107-35df176fbdf3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post-kit","name":"Ultimate Post Kit \u2013 Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets","from":"*","from_inclusive":true,"to":"3.11.7","to_inclusive":true,"patched_in":"3.11.8"}],"published":"2024-06-27T19:59:55Z","updated":"2024-06-28T08:33:30Z"},{"id":"wordfence:be9e498b-acad-4909-87c0-e8693af15108","source":"wordfence","cve":"CVE-2025-24585","title":"Event post <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be9e498b-acad-4909-87c0-e8693af15108?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:37:38Z"},{"id":"wordfence:bea0e939-788d-4dd6-aa68-bd464c075f19","source":"wordfence","cve":"CVE-2026-91833","title":"WX Subscribe <= 1.2.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea0e939-788d-4dd6-aa68-bd464c075f19?source=api-prod","affected":[{"type":"plugin","slug":"wx-subscribe","name":"WX Subscribe  \u5fae\u4fe1\u652f\u4ed8\u4ed8\u8d39\u8ba2\u9605","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:45:13Z"},{"id":"wordfence:bea1f918-d966-4214-8331-e389e4080ca5","source":"wordfence","cve":"CVE-2015-9461","title":"Awesome Filterable Portfolio < 1.9 - Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea1f918-d966-4214-8331-e389e4080ca5?source=api-prod","affected":[{"type":"plugin","slug":"awesome-filterable-portfolio","name":"Awesome Filterable Portfolio","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2015-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bea33fd8-47ee-47ae-a6b4-5aa44f417b1e","source":"wordfence","cve":"CVE-2026-111837","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea33fd8-47ee-47ae-a6b4-5aa44f417b1e?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"34.0.1","to_inclusive":true,"patched_in":"34.0.2"}],"published":"2026-10-19T13:25:23Z","updated":"2026-10-23T18:45:23Z"},{"id":"wordfence:bea4b2c6-f078-4b47-b4d3-16216a54c0ab","source":"wordfence","cve":"CVE-2026-14923","title":"Sync Post With Other Site < 1.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea4b2c6-f078-4b47-b4d3-16216a54c0ab?source=api-prod","affected":[{"type":"plugin","slug":"sync-post-with-other-site","name":"Sync Post With Other Site","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":false,"patched_in":"1.9.3"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:26:13Z"},{"id":"wordfence:bea5ebdd-8353-4345-af2d-798de8b4871f","source":"wordfence","cve":"CVE-2026-111852","title":"Ajax Search Lite \u2013 Live Search & Filter <= 4.14.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea5ebdd-8353-4345-af2d-798de8b4871f?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.14.6","to_inclusive":true,"patched_in":"4.14.7"}],"published":"2026-10-19T13:23:19Z","updated":"2026-10-23T18:47:30Z"},{"id":"wordfence:bea7a4d0-d589-420b-a4ff-eaccf12e623b","source":"wordfence","cve":"CVE-2024-9444","title":"ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bea7a4d0-d589-420b-a4ff-eaccf12e623b?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2024-10-15T21:26:07Z","updated":"2024-10-16T09:32:20Z"},{"id":"wordfence:bead5edb-402a-44bc-9e2b-89201fa4603c","source":"wordfence","cve":"CVE-2021-24261","title":"HT Mega - Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bead5edb-402a-44bc-9e2b-89201fa4603c?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:beadd35b-2bce-431e-8347-2d1a87d02f01","source":"wordfence","cve":"","title":"Users To CSV <= 1.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beadd35b-2bce-431e-8347-2d1a87d02f01?source=api-prod","affected":[{"type":"plugin","slug":"users-to-csv","name":"Users To CSV","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2015-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:beae9073-5293-4a89-8c9a-8c5276891684","source":"wordfence","cve":"CVE-2026-57375","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beae9073-5293-4a89-8c9a-8c5276891684?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.18.4","to_inclusive":true,"patched_in":"4.19.0"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:51:19Z"},{"id":"wordfence:beaea592-5eb5-4400-a4a8-b73f9b94198b","source":"wordfence","cve":"CVE-2024-7860","title":"Simple Headline Rotator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beaea592-5eb5-4400-a4a8-b73f9b94198b?source=api-prod","affected":[{"type":"plugin","slug":"simple-headline-rotator","name":"Simple Headline Rotator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T16:32:42Z"},{"id":"wordfence:beb0eade-405b-429b-b7a5-0f9c09f8374e","source":"wordfence","cve":"CVE-2024-32590","title":"Kattene <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb0eade-405b-429b-b7a5-0f9c09f8374e?source=api-prod","affected":[{"type":"plugin","slug":"kattene","name":"Kattene","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-24T13:56:20Z"},{"id":"wordfence:beb1268c-b680-4ebe-8fe2-65f656390038","source":"wordfence","cve":"CVE-2026-11358","title":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb1268c-b680-4ebe-8fe2-65f656390038?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-06-17T16:48:45Z","updated":"2026-06-18T05:34:28Z"},{"id":"wordfence:beb28e9e-bf6a-4eed-afbc-ca85ec489df7","source":"wordfence","cve":"CVE-2024-4697","title":"Cowidgets \u2013 Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb28e9e-bf6a-4eed-afbc-ca85ec489df7?source=api-prod","affected":[{"type":"plugin","slug":"cowidgets-elementor-addons","name":"Cowidgets \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-06-03T17:08:40Z","updated":"2024-07-01T17:03:07Z"},{"id":"wordfence:beb47081-ad9c-4ecb-bbcd-2ae916e55baf","source":"wordfence","cve":"","title":"Media File Renamer \u2013 Auto & Manual Rename <= 5.2.5 - Missing Authorization Checks","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb47081-ad9c-4ecb-bbcd-2ae916e55baf?source=api-prod","affected":[{"type":"plugin","slug":"media-file-renamer","name":"Media File Renamer: Rename Images & Files for SEO (AI-Powered)","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2012-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:beb489d3-2c1b-4af5-b73e-126d2526e0a3","source":"wordfence","cve":"CVE-2025-14050","title":"Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb489d3-2c1b-4af5-b73e-126d2526e0a3?source=api-prod","affected":[{"type":"plugin","slug":"design-import-export","name":"Design Import/Export \u2013 Styles, Templates, Template Parts and Patterns","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-12-12T14:51:11Z","updated":"2025-12-13T03:20:26Z"},{"id":"wordfence:beb6b26a-3fe1-44e0-9fda-97b288abf735","source":"wordfence","cve":"CVE-2025-9856","title":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb6b26a-3fe1-44e0-9fda-97b288abf735?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2025-12-12T19:31:21Z","updated":"2025-12-13T08:21:15Z"},{"id":"wordfence:beb70eb8-9a9c-4116-832c-337fc2a03329","source":"wordfence","cve":"CVE-2020-28039","title":"WordPress Core < 5.5.2 - Arbitrary File Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb70eb8-9a9c-4116-832c-337fc2a03329?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:beb85268-a6c2-4bb1-9d3d-57be613fb289","source":"wordfence","cve":"CVE-2026-119745","title":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.11.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb85268-a6c2-4bb1-9d3d-57be613fb289?source=api-prod","affected":[{"type":"plugin","slug":"sender-net-automated-emails","name":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":true,"patched_in":"2.11.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:55:20Z"},{"id":"wordfence:beb8ea66-3cd7-452f-9e64-8439de0ddc55","source":"wordfence","cve":"CVE-2024-8756","title":"Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beb8ea66-3cd7-452f-9e64-8439de0ddc55?source=api-prod","affected":[{"type":"plugin","slug":"quform","name":"Quform - WordPress Form Builder","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":"2.21.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T05:40:23Z"},{"id":"wordfence:bebedaa9-6689-4863-91c6-2ab52a9353db","source":"wordfence","cve":"CVE-2023-0074","title":"WP Social Widget <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bebedaa9-6689-4863-91c6-2ab52a9353db?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-widget","name":"WP Social Widget","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bec19d80-ba51-4ff8-a111-c2e45928fb51","source":"wordfence","cve":"CVE-2026-78278","title":"Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec19d80-ba51-4ff8-a111-c2e45928fb51?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards-pro","name":"Fluent Boards Pro","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-26T16:40:25Z"},{"id":"wordfence:bec50640-a550-49a8-baf6-2dd53995f90b","source":"wordfence","cve":"CVE-2024-6314","title":"IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec50640-a550-49a8-baf6-2dd53995f90b?source=api-prod","affected":[{"type":"plugin","slug":"iq-testimonials","name":"IQ Testimonials","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:47Z"},{"id":"wordfence:bec7d613-b1cd-4a4e-bbd9-62bca3a864a2","source":"wordfence","cve":"","title":"WPJobBoard <= 5.6.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec7d613-b1cd-4a4e-bbd9-62bca3a864a2?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2020-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bec86d1a-cdae-41f6-bee8-db518141b310","source":"wordfence","cve":"CVE-2026-115242","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.137 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec86d1a-cdae-41f6-bee8-db518141b310?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.137","to_inclusive":false,"patched_in":"0.9.137"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:35:38Z"},{"id":"wordfence:bec89b35-8cf2-4afa-8f3e-92ee6420ae28","source":"wordfence","cve":"CVE-2025-66525","title":"Elastic Email Sender <= 1.2.20 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec89b35-8cf2-4afa-8f3e-92ee6420ae28?source=api-prod","affected":[{"type":"plugin","slug":"elastic-email-sender","name":"Elastic Email Sender","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":"1.2.21"}],"published":"2025-10-28T00:00:00Z","updated":"2025-12-11T16:38:01Z"},{"id":"wordfence:bec97055-ebe1-4529-9f3b-db2745300f69","source":"wordfence","cve":"CVE-2025-22337","title":"Order Audit Log for WooCommerce <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bec97055-ebe1-4529-9f3b-db2745300f69?source=api-prod","affected":[{"type":"plugin","slug":"order-audit-log-for-woocommerce","name":"Order Audit Log for WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-20T19:00:36Z"},{"id":"wordfence:becbf49b-0384-4c78-a983-2effbfac8dd1","source":"wordfence","cve":"CVE-2025-53314","title":"WP Optimizer <= 2.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/becbf49b-0384-4c78-a983-2effbfac8dd1?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimizer","name":"WP Optimizer \u2013 PageSpeed, Cache, Minify & Core Web Vitals","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:30:38Z"},{"id":"wordfence:beceb191-654b-48ea-9b8f-3f4ca974160e","source":"wordfence","cve":"CVE-2022-25600","title":"WP MAPS \u2013 Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beceb191-654b-48ea-9b8f-3f4ca974160e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":false,"patched_in":"4.2.4"}],"published":"2022-02-22T14:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:beceb218-34bf-4571-a07b-939abc7ead8e","source":"wordfence","cve":"CVE-2026-9643","title":"WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beceb218-34bf-4571-a07b-939abc7ead8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:46:28Z","updated":"2026-07-22T17:39:00Z"},{"id":"wordfence:becee157-8519-4f1f-b369-5f932773f282","source":"wordfence","cve":"CVE-2015-9396","title":"Auto ThickBox Plus <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/becee157-8519-4f1f-b369-5f932773f282?source=api-prod","affected":[{"type":"plugin","slug":"auto-thickbox-plus","name":"Auto Thickbox Plus","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2015-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bed25977-040e-4427-b1e3-e9be9733b31f","source":"wordfence","cve":"CVE-2024-22134","title":"Contact Form 7 Extension For Mailchimp <= 0.5.70 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed25977-040e-4427-b1e3-e9be9733b31f?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-mailchimp-extension","name":"Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend","from":"*","from_inclusive":true,"to":"0.5.70","to_inclusive":true,"patched_in":"0.9.19"}],"published":"2024-01-08T00:00:00Z","updated":"2025-10-02T22:38:48Z"},{"id":"wordfence:bed2ada9-af3d-479e-8ae4-11eaad0b3842","source":"wordfence","cve":"CVE-2026-16811","title":"ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed2ada9-af3d-479e-8ae4-11eaad0b3842?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-07-27T16:43:29Z","updated":"2026-07-28T05:39:44Z"},{"id":"wordfence:bed6b603-c811-4624-9053-1e12029ba73b","source":"wordfence","cve":"CVE-2021-38315","title":"SP Project & Document Manager <= 4.25 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed6b603-c811-4624-9053-1e12029ba73b?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.25","to_inclusive":true,"patched_in":"4.26"}],"published":"2021-08-16T16:45:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bed8347e-9d89-4484-ae2a-a949feee552e","source":"wordfence","cve":"CVE-2026-28079","title":"Conquerors | American Football & NFL PSD Template <= 1.2.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed8347e-9d89-4484-ae2a-a949feee552e?source=api-prod","affected":[{"type":"theme","slug":"conquerors","name":"Conquerors | American Football & NFL PSD Template","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T14:29:37Z"},{"id":"wordfence:bed93040-a843-417e-89b4-5ab3cba788aa","source":"wordfence","cve":"CVE-2026-102291","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'","severity":"medium","cvss":5.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed93040-a843-417e-89b4-5ab3cba788aa?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-10-09T18:47:02Z","updated":"2026-10-10T07:41:48Z"},{"id":"wordfence:bed9355d-1592-4eb3-8342-df6ec6d67bba","source":"wordfence","cve":"CVE-2026-79632","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bed9355d-1592-4eb3-8342-df6ec6d67bba?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":false,"patched_in":"3.13.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:24:42Z"},{"id":"wordfence:bedad627-0ccb-41c1-be8d-753f57be618f","source":"wordfence","cve":"CVE-2024-4624","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bedad627-0ccb-41c1-be8d-753f57be618f?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.20","to_inclusive":true,"patched_in":"5.9.21"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-14T11:33:10Z"},{"id":"wordfence:bedbe508-e879-4989-89a6-db909ecd35a8","source":"wordfence","cve":"CVE-2025-5843","title":"Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bedbe508-e879-4989-89a6-db909ecd35a8?source=api-prod","affected":[{"type":"plugin","slug":"brandfolder","name":"Brandfolder \u2013 Digital Asset Management Simplified.","from":"*","from_inclusive":true,"to":"5.0.19","to_inclusive":true,"patched_in":"5.0.20"}],"published":"2025-07-15T18:16:10Z","updated":"2026-01-23T20:03:03Z"},{"id":"wordfence:bedc2254-29aa-46c5-8f85-47dd6affb42b","source":"wordfence","cve":"CVE-2024-12117","title":"Stackable \u2013 Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bedc2254-29aa-46c5-8f85-47dd6affb42b?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.13.11","to_inclusive":true,"patched_in":"3.13.12"}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-22T07:03:53Z"},{"id":"wordfence:bede3241-6383-4bdb-ac28-cd9781b608d1","source":"wordfence","cve":"CVE-2022-25605","title":"WP-DownloadManager plugin <= 1.68.6 -  Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bede3241-6383-4bdb-ac28-cd9781b608d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.7","to_inclusive":false,"patched_in":"1.68.7"}],"published":"2022-01-12T13:42:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bedfb712-faf6-4131-b254-e6d7c367f49f","source":"wordfence","cve":"CVE-2025-14947","title":"All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bedfb712-faf6-4131-b254-e6d7c367f49f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-23T17:26:06Z"},{"id":"wordfence:bee2245b-d039-48a7-a9dc-bd6ceac6cac6","source":"wordfence","cve":"CVE-2026-40769","title":"Contact Form Extender for Divi \u2013 Submissions DB & Extra Fields <= 1.0.6 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bee2245b-d039-48a7-a9dc-bd6ceac6cac6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-extender-for-divi-builder","name":"Contact Form Extender for Divi \u2013 Submissions DB & Extra Fields","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T15:08:01Z"},{"id":"wordfence:bee2d981-c6b4-4f2b-af4e-90e997257743","source":"wordfence","cve":"CVE-2024-51886","title":"Posts Filter <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bee2d981-c6b4-4f2b-af4e-90e997257743?source=api-prod","affected":[{"type":"plugin","slug":"posts-filter","name":"Posts Filter","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:55:19Z"},{"id":"wordfence:bee2e520-46cc-4b54-9849-fafb9b37ba19","source":"wordfence","cve":"CVE-2026-0909","title":"WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bee2e520-46cc-4b54-9849-fafb9b37ba19?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.8.3.1","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-02-02T14:51:27Z","updated":"2026-02-03T03:24:35Z"},{"id":"wordfence:bee43fe3-d39a-475e-90c5-24fa569c646a","source":"wordfence","cve":"CVE-2023-6037","title":"WP TripAdvisor Review Slider  <= 11.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bee43fe3-d39a-475e-90c5-24fa569c646a?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"11.8","to_inclusive":true,"patched_in":"11.9"}],"published":"2023-12-11T00:00:00Z","updated":"2024-02-06T16:41:56Z"},{"id":"wordfence:bee4760e-8a81-4771-b177-4a8e7869eccc","source":"wordfence","cve":"CVE-2026-89269","title":"WP Testimonials <= 1.4.13 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bee4760e-8a81-4771-b177-4a8e7869eccc?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-widgets","name":"WP Testimonials","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:47:51Z"},{"id":"wordfence:beea6ca0-5982-436e-959e-6761f05d4675","source":"wordfence","cve":"CVE-2025-58002","title":"GD bbPress Tools <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beea6ca0-5982-436e-959e-6761f05d4675?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-tools","name":"GD bbPress Tools","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-04-25T15:34:49Z"},{"id":"wordfence:beeb129e-1838-4f2b-b936-06f7c26ee587","source":"wordfence","cve":"CVE-2026-24370","title":"The Grid < 2.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/beeb129e-1838-4f2b-b936-06f7c26ee587?source=api-prod","affected":[{"type":"plugin","slug":"the-grid","name":"The Grid","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:28:36Z"},{"id":"wordfence:bef0eeb8-ed6d-46a3-91c5-84bdd88922b4","source":"wordfence","cve":"CVE-2026-65461","title":"Really Simple CSV Importer <= 1.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bef0eeb8-ed6d-46a3-91c5-84bdd88922b4?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-csv-importer","name":"Really Simple CSV Importer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:59:34Z"},{"id":"wordfence:bef1d842-5e04-47ea-b318-55f94c941be0","source":"wordfence","cve":"CVE-2024-31929","title":"Intagrate Lite <= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bef1d842-5e04-47ea-b318-55f94c941be0?source=api-prod","affected":[{"type":"plugin","slug":"instagrate-to-wordpress","name":"Intagrate Lite","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:56:15Z"},{"id":"wordfence:bef34ef0-ce0a-46af-9bc2-228dd5e80717","source":"wordfence","cve":"CVE-2025-58607","title":"Cookie Notice &amp; Consent Banner for GDPR &amp; CCPA Compliance <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bef34ef0-ce0a-46af-9bc2-228dd5e80717?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice-and-consent-banner","name":"Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)","from":"*","from_inclusive":true,"to":"1.7.11","to_inclusive":true,"patched_in":"1.7.12"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:34:32Z"},{"id":"wordfence:bef61f05-a2dc-4f61-a5da-7161a9912196","source":"wordfence","cve":"CVE-2026-12598","title":"LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bef61f05-a2dc-4f61-a5da-7161a9912196?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-07-09T11:13:50Z","updated":"2026-07-09T23:30:11Z"},{"id":"wordfence:bef84287-cbff-41c8-8cf8-3e0e12b0311b","source":"wordfence","cve":"CVE-2025-58629","title":"Miraculous < 2.0.9 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bef84287-cbff-41c8-8cf8-3e0e12b0311b?source=api-prod","affected":[{"type":"theme","slug":"miraculous","name":"Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2025-09-01T00:00:00Z","updated":"2025-11-12T13:44:37Z"},{"id":"wordfence:befa92c2-7761-44df-a162-10f3deb9439e","source":"wordfence","cve":"CVE-2025-22685","title":"Tags to Keywords <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befa92c2-7761-44df-a162-10f3deb9439e?source=api-prod","affected":[{"type":"plugin","slug":"tags-to-meta-keywords","name":"Tags to Keywords","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:43:18Z"},{"id":"wordfence:befc1787-7617-410a-b897-7089c2d9b413","source":"wordfence","cve":"CVE-2026-14924","title":"Tablesome <= 1.1.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befc1787-7617-410a-b897-7089c2d9b413?source=api-prod","affected":[{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T23:03:53Z"},{"id":"wordfence:befc411f-8c50-44a2-b1af-10a507230df9","source":"wordfence","cve":"CVE-2025-68865","title":"Infility Global <= 2.15.36 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befc411f-8c50-44a2-b1af-10a507230df9?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.15.36","to_inclusive":true,"patched_in":"2.15.37"}],"published":"2025-12-31T00:00:00Z","updated":"2026-09-09T16:04:47Z"},{"id":"wordfence:befc6373-1833-4e5b-9500-19fbc3aa110e","source":"wordfence","cve":"CVE-2024-38756","title":"Coming Soon <= 1.6.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befc6373-1833-4e5b-9500-19fbc3aa110e?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:17:25Z"},{"id":"wordfence:befd6971-29e1-477e-95b8-e7385fbd247d","source":"wordfence","cve":"CVE-2018-20966","title":"Booster for WooCommerce <= 3.7.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befd6971-29e1-477e-95b8-e7385fbd247d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":false,"patched_in":"3.8.0"}],"published":"2018-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:befe5e99-204e-470e-bbbb-285b5ba0b1fb","source":"wordfence","cve":"CVE-2024-6405","title":"Floating Social Buttons <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/befe5e99-204e-470e-bbbb-285b5ba0b1fb?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-buttons","name":"Floating Social Buttons","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T02:02:57Z"},{"id":"wordfence:bf02edc9-2bb6-4ceb-b2a1-63f95c8becb3","source":"wordfence","cve":"CVE-2025-14767","title":"WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf02edc9-2bb6-4ceb-b2a1-63f95c8becb3?source=api-prod","affected":[{"type":"plugin","slug":"wpc-badge-management","name":"WPC Badge Management for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T07:44:11Z"},{"id":"wordfence:bf037e4a-2dd7-4296-b86b-635901d2d68f","source":"wordfence","cve":"CVE-2024-12264","title":"PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf037e4a-2dd7-4296-b86b-635901d2d68f?source=api-prod","affected":[{"type":"plugin","slug":"payu-india","name":"PayU India","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2025-01-06T16:09:55Z","updated":"2025-03-13T20:25:18Z"},{"id":"wordfence:bf03a656-7a3b-4227-9493-88f522d7bc13","source":"wordfence","cve":"CVE-2024-44061","title":"EU/UK VAT Manager for WooCommerce <= 2.12.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf03a656-7a3b-4227-9493-88f522d7bc13?source=api-prod","affected":[{"type":"plugin","slug":"eu-vat-for-woocommerce","name":"EU/UK VAT Validation Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.12.14","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-08-29T00:00:00Z","updated":"2024-10-25T17:45:18Z"},{"id":"wordfence:bf04f458-7900-4dd3-84fb-169b74db97ab","source":"wordfence","cve":"CVE-2024-13772","title":"Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass","severity":"medium","cvss":5.6,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf04f458-7900-4dd3-84fb-169b74db97ab?source=api-prod","affected":[{"type":"theme","slug":"civi","name":"Civi - Job Board & Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.6.1","to_inclusive":true,"patched_in":"2.1.6.3"}],"published":"2025-03-13T00:00:00Z","updated":"2025-06-17T18:05:33Z"},{"id":"wordfence:bf05a79a-0375-4c9d-bbf0-a87484327b87","source":"wordfence","cve":"CVE-2023-2869","title":"WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf05a79a-0375-4c9d-bbf0-a87484327b87?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.7.3","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf0871e7-7dc4-4acb-868f-7dc32016582e","source":"wordfence","cve":"CVE-2025-23962","title":"Goldstar <= 2.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0871e7-7dc4-4acb-868f-7dc32016582e?source=api-prod","affected":[{"type":"plugin","slug":"goldstar","name":"Goldstar","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:13:58Z"},{"id":"wordfence:bf0a1568-e97c-41ea-b2c3-ba335f0b4360","source":"wordfence","cve":"CVE-2023-25711","title":"WPGlobus Translate Options <= 2.1.0 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0a1568-e97c-41ea-b2c3-ba335f0b4360?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus-translate-options","name":"WPGlobus Translate Options","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf0ad697-159f-4466-aa7e-d7c60b737cd8","source":"wordfence","cve":"CVE-2024-49689","title":"HD Quiz \u2013 Save Results Light <= 0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0ad697-159f-4466-aa7e-d7c60b737cd8?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz-save-results-light","name":"HD Quiz \u2013 Save Results Light","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.6"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:24:29Z"},{"id":"wordfence:bf0bbd5e-0fec-445e-9baa-e383524da648","source":"wordfence","cve":"CVE-2024-29123","title":"Link Library <= 7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0bbd5e-0fec-445e-9baa-e383524da648?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.6","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:50:04Z"},{"id":"wordfence:bf0eab48-ef8b-4578-8a9a-c48e09cb29f7","source":"wordfence","cve":"CVE-2026-5097","title":"wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0eab48-ef8b-4578-8a9a-c48e09cb29f7?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.17","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T06:39:50Z"},{"id":"wordfence:bf0f549d-1d88-415a-81f3-b50f977e2c17","source":"wordfence","cve":"CVE-2013-2696","title":"WP Webmaster < 8.2.4 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0f549d-1d88-415a-81f3-b50f977e2c17?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-webmaster","name":"WP Webmaster","from":"*","from_inclusive":true,"to":"8.2.4","to_inclusive":false,"patched_in":"8.2.4"}],"published":"2013-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf0f87fe-d318-4f49-993c-3255f4e77ef1","source":"wordfence","cve":"CVE-2019-14949","title":"WP Database Backup <= 5.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf0f87fe-d318-4f49-993c-3255f4e77ef1?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2019-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf11aed9-8782-4579-95a5-e88b19641ae8","source":"wordfence","cve":"CVE-2026-54805","title":"Falang multilanguage for WordPress <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf11aed9-8782-4579-95a5-e88b19641ae8?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:03:45Z"},{"id":"wordfence:bf152269-73e1-473f-8d97-ce94e9b885d0","source":"wordfence","cve":"CVE-2025-15096","title":"Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf152269-73e1-473f-8d97-ce94e9b885d0?source=api-prod","affected":[{"type":"plugin","slug":"videospirecore","name":"Videospirecore Theme Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T21:29:59Z","updated":"2026-02-11T09:49:23Z"},{"id":"wordfence:bf16617d-cec2-4943-bd20-7ade31878714","source":"wordfence","cve":"CVE-2023-25799","title":"Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf16617d-cec2-4943-bd20-7ade31878714?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf169c9c-26f6-4af7-926e-1be34e638fd6","source":"wordfence","cve":"CVE-2023-5644","title":"WP Mail Log <= 1.1.2 - Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion","severity":"medium","cvss":6.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf169c9c-26f6-4af7-926e-1be34e638fd6?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-log","name":"WP Mail Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-11-28T00:00:00Z","updated":"2024-10-24T19:28:03Z"},{"id":"wordfence:bf16e980-7cee-4f62-8a2d-0cf73fc2ca26","source":"wordfence","cve":"CVE-2026-104764","title":"Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf16e980-7cee-4f62-8a2d-0cf73fc2ca26?source=api-prod","affected":[{"type":"plugin","slug":"post-export-import-with-media","name":"Post Export Import with Media","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.17.2"}],"published":"2026-10-13T19:37:00Z","updated":"2026-10-14T07:43:36Z"},{"id":"wordfence:bf172a41-31dc-4864-9385-53decdc70aeb","source":"wordfence","cve":"CVE-2023-50856","title":"Funnel Builder for WordPress by FunnelKit <= 2.14.3 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf172a41-31dc-4864-9385-53decdc70aeb?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"2.14.4","to_inclusive":false,"patched_in":"2.14.4"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf173ccd-23bc-49ec-92e0-032feae0fa4a","source":"wordfence","cve":"CVE-2024-12440","title":"Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf173ccd-23bc-49ec-92e0-032feae0fa4a?source=api-prod","affected":[{"type":"plugin","slug":"candifly","name":"Candifly","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:22:56Z","updated":"2025-01-07T05:23:58Z"},{"id":"wordfence:bf1f402d-98d7-42d7-8d8d-ff74a65e5293","source":"wordfence","cve":"CVE-2023-45103","title":"Permalinks Customizer <= 2.8.2 - Cross-Site Request Forgery via post_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf1f402d-98d7-42d7-8d8d-ff74a65e5293?source=api-prod","affected":[{"type":"plugin","slug":"permalinks-customizer","name":"Permalinks Customizer","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf1ffbbb-6a08-4be1-837e-7c6be3b2ac74","source":"wordfence","cve":"CVE-2026-59514","title":"BuddyBoss Platform <= 3.0.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf1ffbbb-6a08-4be1-837e-7c6be3b2ac74?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-16T17:34:00Z"},{"id":"wordfence:bf203cb9-db7c-4794-b9b7-c054fe7fc0d2","source":"wordfence","cve":"CVE-2025-31631","title":"Fish House <= 1.2.7 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf203cb9-db7c-4794-b9b7-c054fe7fc0d2?source=api-prod","affected":[{"type":"theme","slug":"fish-house","name":"Fish House | A Stylish Seafood Restaurant / Cafe / Bar WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:42:17Z"},{"id":"wordfence:bf20b6c2-6c6a-4feb-9d52-87b7f214f1f7","source":"wordfence","cve":"CVE-2025-46238","title":"List Last Changes <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf20b6c2-6c6a-4feb-9d52-87b7f214f1f7?source=api-prod","affected":[{"type":"plugin","slug":"list-last-changes","name":"List Last Changes","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T22:12:52Z"},{"id":"wordfence:bf214d08-0079-40f2-8beb-6f5e4953bb95","source":"wordfence","cve":"CVE-2024-39662","title":"Black Widgets For Elementor <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf214d08-0079-40f2-8beb-6f5e4953bb95?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-08T14:34:06Z"},{"id":"wordfence:bf22affe-13b9-4f88-aaff-24eaa8df7e5d","source":"wordfence","cve":"CVE-2026-49081","title":"User Registration Stripe <= 1.3.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf22affe-13b9-4f88-aaff-24eaa8df7e5d?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-stripe","name":"User Registration Stripe","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:27:09Z"},{"id":"wordfence:bf238e9d-be91-4c9a-8506-ee01927f5173","source":"wordfence","cve":"CVE-2019-14946","title":"Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf238e9d-be91-4c9a-8506-ee01927f5173?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.51","to_inclusive":true,"patched_in":"2.0.52"}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf26fc68-9fd4-4e4e-b34f-c947d95891f9","source":"wordfence","cve":"CVE-2024-3054","title":"WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf26fc68-9fd4-4e4e-b34f-c947d95891f9?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.99","to_inclusive":true,"patched_in":"0.9.100"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-12T09:30:15Z"},{"id":"wordfence:bf297cd8-3d67-4750-b856-38ded4daf4ad","source":"wordfence","cve":"CVE-2024-10856","title":"Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf297cd8-3d67-4750-b856-38ded4daf4ad?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2024-12-23T21:34:02Z","updated":"2024-12-24T11:09:52Z"},{"id":"wordfence:bf29bc2a-876a-484a-983f-a751cf2070c0","source":"wordfence","cve":"CVE-2025-49434","title":"Laposta WooCommerce <= 1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf29bc2a-876a-484a-983f-a751cf2070c0?source=api-prod","affected":[{"type":"plugin","slug":"laposta-woocommerce","name":"Laposta WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-26T14:47:03Z"},{"id":"wordfence:bf2a57fa-28f8-4fd0-814b-a4c9ae77817a","source":"wordfence","cve":"CVE-2022-2314","title":"VR Calendar <= 2.3.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf2a57fa-28f8-4fd0-814b-a4c9ae77817a?source=api-prod","affected":[{"type":"plugin","slug":"vr-calendar-sync","name":"VR Calendar","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf2b8b9e-755f-4b24-99c8-0d221c9c19a7","source":"wordfence","cve":"CVE-2025-54692","title":"Membership For WooCommerce <= 2.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf2b8b9e-755f-4b24-99c8-0d221c9c19a7?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-18T18:48:43Z"},{"id":"wordfence:bf2ddc42-9910-40e5-9546-89f229b852da","source":"wordfence","cve":"CVE-2023-44998","title":"Category Meta <= 1.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf2ddc42-9910-40e5-9546-89f229b852da?source=api-prod","affected":[{"type":"plugin","slug":"wp-category-meta","name":"Category Meta plugin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf2ffdb1-fe10-475b-9c05-553a95d7b3bc","source":"wordfence","cve":"CVE-2024-11221","title":"Full Screen (Page) Background Image Slideshow <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf2ffdb1-fe10-475b-9c05-553a95d7b3bc?source=api-prod","affected":[{"type":"plugin","slug":"full-screen-page-background-image-slideshow","name":"Full Screen (Page) Background Image Slideshow","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-12-12T19:26:04Z"},{"id":"wordfence:bf332c0d-5481-412d-b44a-b3de346d7b60","source":"wordfence","cve":"CVE-2026-0742","title":"Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf332c0d-5481-412d-b44a-b3de346d7b60?source=api-prod","affected":[{"type":"plugin","slug":"smart-appointment-booking","name":"Smart Appointment & Booking","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-02-03T19:43:03Z","updated":"2026-02-04T08:25:32Z"},{"id":"wordfence:bf356066-fb25-4f6a-8600-91c7f1d098bf","source":"wordfence","cve":"CVE-2015-9508","title":"Easy Digital Downloads \u2013 Commissions <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf356066-fb25-4f6a-8600-91c7f1d098bf?source=api-prod","affected":[{"type":"plugin","slug":"edd-commissions","name":"Easy Digital Downloads \u2013 Commissions","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf36c00f-e6a2-4630-b5ef-9015365be436","source":"wordfence","cve":"CVE-2024-29112","title":"WooCommerce Google Feed Manager <= 2.2.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf36c00f-e6a2-4630-b5ef-9015365be436?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T21:10:18Z"},{"id":"wordfence:bf37762d-d7b0-4241-9ed1-f969042d7452","source":"wordfence","cve":"CVE-2025-49454","title":"TinySalt < 3.10.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf37762d-d7b0-4241-9ed1-f969042d7452?source=api-prod","affected":[{"type":"theme","slug":"tinysalt","name":"TinySalt - Personal Food Blog WordPress Theme","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":false,"patched_in":"3.10.0"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T15:00:03Z"},{"id":"wordfence:bf3874b1-f67a-4013-ae17-0e516af99b2d","source":"wordfence","cve":"CVE-2026-78271","title":"FluentCRM Pro <= 3.1.12 - Authenticated (Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3874b1-f67a-4013-ae17-0e516af99b2d?source=api-prod","affected":[{"type":"plugin","slug":"fluentcampaign-pro","name":"FluentCRM PRO","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-08-25T00:00:00Z","updated":"2026-10-01T15:25:12Z"},{"id":"wordfence:bf391432-d569-4458-947f-fe4a2ebcf8f1","source":"wordfence","cve":"CVE-2024-5613","title":"Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf391432-d569-4458-947f-fe4a2ebcf8f1?source=api-prod","affected":[{"type":"theme","slug":"formula","name":"Formula","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":"0.5.2"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T05:44:30Z"},{"id":"wordfence:bf3aa158-37b9-4575-a9ea-716385ae6cc6","source":"wordfence","cve":"CVE-2026-77764","title":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 7.9.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3aa158-37b9-4575-a9ea-716385ae6cc6?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.9.6","to_inclusive":false,"patched_in":"7.9.9.6"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:14:58Z"},{"id":"wordfence:bf3b9e43-ca89-4931-950c-b73a0bac81b8","source":"wordfence","cve":"CVE-2025-28981","title":"WP Mail Options <= 0.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3b9e43-ca89-4931-950c-b73a0bac81b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-options","name":"WP Mail Options","from":"*","from_inclusive":true,"to":"0.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:08:46Z"},{"id":"wordfence:bf3c6dd5-498e-4aff-90fb-15ede66f5e3e","source":"wordfence","cve":"CVE-2025-6690","title":"WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf3c6dd5-498e-4aff-90fb-15ede66f5e3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-tournament-registration","name":"WP Tournament Registration","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-05T13:00:45Z","updated":"2025-08-06T01:45:12Z"},{"id":"wordfence:bf41b5e1-610e-4159-9325-f7a694380050","source":"wordfence","cve":"CVE-2025-0804","title":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf41b5e1-610e-4159-9325-f7a694380050?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-01-28T00:00:00Z","updated":"2025-09-05T08:26:43Z"},{"id":"wordfence:bf43d81f-2d34-4343-8b2a-e3288b1e21c5","source":"wordfence","cve":"CVE-2025-47552","title":"DZS Video Gallery <= 12.39 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf43d81f-2d34-4343-8b2a-e3288b1e21c5?source=api-prod","affected":[{"type":"plugin","slug":"dzs-videogallery","name":"DZS Video Gallery","from":"*","from_inclusive":true,"to":"12.39","to_inclusive":true,"patched_in":"12.40"}],"published":"2025-05-20T00:00:00Z","updated":"2026-02-26T15:09:52Z"},{"id":"wordfence:bf464e16-f5cf-4b3e-a9ee-b3df9aa38c9e","source":"wordfence","cve":"CVE-2022-4791","title":"Product Slider and Carousel with Category for WooCommerce <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf464e16-f5cf-4b3e-a9ee-b3df9aa38c9e?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-slider-and-carousel-with-category","name":"Product Slider and Carousel with Category for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf48087a-f729-488a-8e40-f4e010ccd5a7","source":"wordfence","cve":"CVE-2005-2110","title":"WordPress Core < 1.5.1.3 - Sensitive Information Disclosure","severity":"high","cvss":7.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf48087a-f729-488a-8e40-f4e010ccd5a7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.2","to_inclusive":true,"patched_in":"1.5.1.3"}],"published":"2005-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf4cb79e-e62b-4991-8ee5-493dafe38b80","source":"wordfence","cve":"CVE-2026-15297","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4cb79e-e62b-4991-8ee5-493dafe38b80?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.77","to_inclusive":true,"patched_in":"3.1.78"}],"published":"2024-03-22T00:00:00Z","updated":"2026-07-10T04:31:26Z"},{"id":"wordfence:bf4dcdab-6c74-4c0e-bdda-67e60025a873","source":"wordfence","cve":"CVE-2023-0071","title":"WP Tabs <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4dcdab-6c74-4c0e-bdda-67e60025a873?source=api-prod","affected":[{"type":"plugin","slug":"wp-expand-tabs-free","name":"Custom Product Tabs for WooCommerce & WordPress Tabs Builder \u2013 Smart Tabs","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.1.17"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf4e3fc3-b9f4-4ae5-ad48-2f764879360a","source":"wordfence","cve":"CVE-2020-15092","title":"TimelineJS3 < 3.7.0 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4e3fc3-b9f4-4ae5-ad48-2f764879360a?source=api-prod","affected":[{"type":"plugin","slug":"knight-lab-timelinejs","name":"Knight Lab Timeline","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":false,"patched_in":"3.7.0"}],"published":"2020-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf4eca37-066f-428c-a4f7-061ce06e1142","source":"wordfence","cve":"CVE-2025-2789","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf4eca37-066f-428c-a4f7-061ce06e1142?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"4.2.20"}],"published":"2025-04-04T16:21:21Z","updated":"2025-04-05T05:32:15Z"},{"id":"wordfence:bf50922a-58a6-4ca4-80b7-cafb37b87216","source":"wordfence","cve":"CVE-2023-4999","title":"Horizontal scrolling announcement <= 9.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf50922a-58a6-4ca4-80b7-cafb37b87216?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-scrolling-announcement","name":"Horizontal scrolling announcement","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf51e9ef-7a4b-4f5b-82ae-0de6bcd90758","source":"wordfence","cve":"CVE-2025-49269","title":"Market Exporter <= 2.0.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf51e9ef-7a4b-4f5b-82ae-0de6bcd90758?source=api-prod","affected":[{"type":"plugin","slug":"market-exporter","name":"Market Exporter","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:30:02Z"},{"id":"wordfence:bf527307-185b-4808-a3fc-d3ecafbd34e7","source":"wordfence","cve":"CVE-2024-51661","title":"Media Library Assistant <= 3.19 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf527307-185b-4808-a3fc-d3ecafbd34e7?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.19","to_inclusive":true,"patched_in":"3.20"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:31:52Z"},{"id":"wordfence:bf539c01-596a-44dd-9587-6be6978ab0fa","source":"wordfence","cve":"CVE-2026-3058","title":"Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf539c01-596a-44dd-9587-6be6978ab0fa?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.28.14","to_inclusive":true,"patched_in":"2.28.15"}],"published":"2026-03-03T22:00:52Z","updated":"2026-03-04T11:22:36Z"},{"id":"wordfence:bf542a1c-1a4a-4ebc-a26c-0ee0f8a28855","source":"wordfence","cve":"CVE-2026-121576","title":"MCP Server for WordPress \u2013 Connect Claude, ChatGPT & Gemini | AtlasMCP <= 2.0.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf542a1c-1a4a-4ebc-a26c-0ee0f8a28855?source=api-prod","affected":[{"type":"plugin","slug":"ai-workflow-automation-ai-agent-hub","name":"MCP Server for WordPress \u2013 Connect Claude, ChatGPT & Gemini | AtlasMCP","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-11-07T16:39:00Z","updated":"2026-11-10T19:44:21Z"},{"id":"wordfence:bf5904b4-a2a5-4cbc-9e38-b41459cedb45","source":"wordfence","cve":"CVE-2025-30961","title":"Trackserver <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5904b4-a2a5-4cbc-9e38-b41459cedb45?source=api-prod","affected":[{"type":"plugin","slug":"trackserver","name":"Trackserver","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-17T12:43:06Z"},{"id":"wordfence:bf5dab26-6674-49d9-bc14-13430f4d644f","source":"wordfence","cve":"CVE-2025-49989","title":"App Builder <= 5.5.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5dab26-6674-49d9-bc14-13430f4d644f?source=api-prod","affected":[{"type":"plugin","slug":"app-builder","name":"App Builder \u2013 Create Native Android & iOS Apps On The Flight","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.8"}],"published":"2025-06-19T00:00:00Z","updated":"2025-12-09T21:47:45Z"},{"id":"wordfence:bf5dadc2-cae1-49d4-a433-c1deb43abfda","source":"wordfence","cve":"CVE-2026-97258","title":"Aruba Migration Tool <= 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5dadc2-cae1-49d4-a433-c1deb43abfda?source=api-prod","affected":[{"type":"plugin","slug":"aruba-wp-migration-tool","name":"Aruba Migration Tool","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-10-01T13:27:00Z","updated":"2026-10-08T23:58:21Z"},{"id":"wordfence:bf5e2ff9-a293-4e42-8e43-b3a347cdfe6e","source":"wordfence","cve":"CVE-2025-53991","title":"JetTricks <= 1.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5e2ff9-a293-4e42-8e43-b3a347cdfe6e?source=api-prod","affected":[{"type":"plugin","slug":"jet-tricks","name":"JetTricks","from":"*","from_inclusive":true,"to":"1.5.4.1","to_inclusive":true,"patched_in":"1.5.4.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:57:23Z"},{"id":"wordfence:bf5e5eaf-b42d-49b9-8f55-6025e64748c9","source":"wordfence","cve":"CVE-2023-28620","title":"Cyberus Key <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'uid' in 'cyberkey_settings' Plugin Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5e5eaf-b42d-49b9-8f55-6025e64748c9?source=api-prod","affected":[{"type":"plugin","slug":"cyberus-key","name":"Cyberus Key","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf5fe4c5-0a18-4efb-b492-fad2ae3ca3da","source":"wordfence","cve":"","title":"Google Adsense & Banner Ads by AdsforWP < 1.6 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf5fe4c5-0a18-4efb-b492-fad2ae3ca3da?source=api-prod","affected":[{"type":"plugin","slug":"ads-for-wp","name":"Easy Google Adsense and Banner Ads Manager \u2013 AdsforWP","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2019-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf658b2c-9c98-47af-abfc-9689cdbfcda3","source":"wordfence","cve":"CVE-2015-9489","title":"Goodnex Responsive HTML5/CSS3 Site Template < 1.1.3 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf658b2c-9c98-47af-abfc-9689cdbfcda3?source=api-prod","affected":[{"type":"theme","slug":"goodnex","name":"Goodnex Responsive HTML5/CSS3 Site Template","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf682127-4b97-44ce-a94d-3a237c5af1cc","source":"wordfence","cve":"CVE-2024-13665","title":"Admire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf682127-4b97-44ce-a94d-3a237c5af1cc?source=api-prod","affected":[{"type":"plugin","slug":"admire-extra","name":"Admire Extra","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:16Z"},{"id":"wordfence:bf68dec8-9cb9-4eff-9c1a-4c227de30cf2","source":"wordfence","cve":"CVE-2025-29011","title":"YouTube Simple Gallery <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf68dec8-9cb9-4eff-9c1a-4c227de30cf2?source=api-prod","affected":[{"type":"plugin","slug":"youtube-simple-gallery","name":"YouTube Simple Gallery","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:14:28Z"},{"id":"wordfence:bf6b7d8d-fb13-4eb4-b0b4-d0a10ad2a21e","source":"wordfence","cve":"CVE-2024-13513","title":"Oliver POS \u2013 A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf6b7d8d-fb13-4eb4-b0b4-d0a10ad2a21e?source=api-prod","affected":[{"type":"plugin","slug":"oliver-pos","name":"Oliver POS \u2013 WooCommerce POS for iPhone, iPad & Android","from":"*","from_inclusive":true,"to":"2.4.2.3","to_inclusive":true,"patched_in":"2.4.2.4"}],"published":"2025-02-14T19:04:34Z","updated":"2025-02-15T07:33:41Z"},{"id":"wordfence:bf6fc554-8e15-4a9e-ba12-354200ba5351","source":"wordfence","cve":"CVE-2025-48141","title":"Multi CryptoCurrency Payments <= 3.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf6fc554-8e15-4a9e-ba12-354200ba5351?source=api-prod","affected":[{"type":"plugin","slug":"multi-crypto-currency-payment","name":"Multi CryptoCurrency Payments","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-06-03T00:00:00Z","updated":"2026-09-16T17:29:25Z"},{"id":"wordfence:bf707d9b-2b96-4d1b-b798-38f7fe958eaf","source":"wordfence","cve":"CVE-2024-10388","title":"WordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf707d9b-2b96-4d1b-b798-38f7fe958eaf?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gdpr","name":"WordPress GDPR","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-11-17T00:00:00Z","updated":"2024-11-19T07:35:27Z"},{"id":"wordfence:bf70f652-5244-421c-8ee6-75719315ed64","source":"wordfence","cve":"","title":"Advanced Contact form 7 DB <= 1.6.0 - SQL Injection","severity":"high","cvss":8.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf70f652-5244-421c-8ee6-75719315ed64?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2019-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf722bba-902b-44d3-bea4-b331ecacd579","source":"wordfence","cve":"CVE-2026-81295","title":"Under Construction <= 5.82 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf722bba-902b-44d3-bea4-b331ecacd579?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-page","name":"Under Construction","from":"*","from_inclusive":true,"to":"5.82","to_inclusive":true,"patched_in":"5.83"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:31:29Z"},{"id":"wordfence:bf766ede-d64a-4891-a9c9-fe42c378642d","source":"wordfence","cve":"CVE-2026-109896","title":"Download Monitor integration for WooCommerce <= 1.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf766ede-d64a-4891-a9c9-fe42c378642d?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor-integration-for-woocommerce","name":"Download Monitor integration for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:43:49Z"},{"id":"wordfence:bf77908d-2469-449b-abab-f8411ee42f65","source":"wordfence","cve":"CVE-2025-67559","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf77908d-2469-449b-abab-f8411ee42f65?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2025-11-12T00:00:00Z","updated":"2025-12-11T16:47:11Z"},{"id":"wordfence:bf798142-4daf-41f5-8416-701d03476520","source":"wordfence","cve":"CVE-2023-52217","title":"WooCommerce Conversion Tracking <= 2.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf798142-4daf-41f5-8416-701d03476520?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-conversion-tracking","name":"Conversion Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-24T01:33:36Z"},{"id":"wordfence:bf79cc31-5dd4-4b4f-9c5d-5adaea7689a5","source":"wordfence","cve":"CVE-2024-38787","title":"Import and export users and customers <= 1.26.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf79cc31-5dd4-4b4f-9c5d-5adaea7689a5?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.8","to_inclusive":true,"patched_in":"1.26.9"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:42:19Z"},{"id":"wordfence:bf7b0f1b-a6d3-4a96-adaa-0adeb6ea2efd","source":"wordfence","cve":"CVE-2024-3550","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7b0f1b-a6d3-4a96-adaa-0adeb6ea2efd?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:33Z"},{"id":"wordfence:bf7c500e-311f-4db5-8a54-de7b02fb11dd","source":"wordfence","cve":"CVE-2026-12918","title":"Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7c500e-311f-4db5-8a54-de7b02fb11dd?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.24.1","to_inclusive":true,"patched_in":"1.24.2"}],"published":"2026-07-09T20:55:55Z","updated":"2026-07-10T09:32:44Z"},{"id":"wordfence:bf7f8954-53bf-49fa-b91b-f968a734027a","source":"wordfence","cve":"CVE-2025-48086","title":"Ajax Search Lite <= 4.13.3 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf7f8954-53bf-49fa-b91b-f968a734027a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.13.3","to_inclusive":true,"patched_in":"4.13.4"}],"published":"2025-10-21T00:00:00Z","updated":"2025-10-29T15:57:55Z"},{"id":"wordfence:bf801042-5cd5-424f-a25a-858302285170","source":"wordfence","cve":"CVE-2023-25480","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.24.1 - Cross-Site Request Forgery via submitDefaultEditor","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf801042-5cd5-424f-a25a-858302285170?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.24.1","to_inclusive":true,"patched_in":"1.24.2"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf808fec-8d84-43ab-85bc-b3b60ab4df31","source":"wordfence","cve":"CVE-2014-4564","title":"Validated <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf808fec-8d84-43ab-85bc-b3b60ab4df31?source=api-prod","affected":[{"type":"plugin","slug":"validated","name":"Validated","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf852d93-6d56-46a2-aebc-b222b1b73fb1","source":"wordfence","cve":"","title":"GD Star Rating < 1.9.17 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf852d93-6d56-46a2-aebc-b222b1b73fb1?source=api-prod","affected":[{"type":"plugin","slug":"gd-star-rating","name":"GD Star Rating","from":"*","from_inclusive":true,"to":"1.9.17","to_inclusive":false,"patched_in":"1.9.17"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf88b1db-ca99-4bca-857d-fdc39aa81758","source":"wordfence","cve":"CVE-2025-68056","title":"LBG Zoominoutslider <= 5.4.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf88b1db-ca99-4bca-857d-fdc39aa81758?source=api-prod","affected":[{"type":"plugin","slug":"lbg_zoominoutslider","name":"Responsive Zoom In/Out Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2025-09-28T00:00:00Z","updated":"2026-02-26T15:20:13Z"},{"id":"wordfence:bf88e79b-262e-4fee-9cef-85d96d300972","source":"wordfence","cve":"","title":"BePro Listings <= 2.2.0020 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf88e79b-262e-4fee-9cef-85d96d300972?source=api-prod","affected":[{"type":"plugin","slug":"bepro-listings","name":"BePro Listings","from":"*","from_inclusive":true,"to":"2.2.0020","to_inclusive":true,"patched_in":"2.2.0021"}],"published":"2016-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf893b1e-9fcf-4a3a-862e-4f050617acc6","source":"wordfence","cve":"CVE-2021-24192","title":"Tree Sitemap (Pages, Posts & Categories list) <= 2.9 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf893b1e-9fcf-4a3a-862e-4f050617acc6?source=api-prod","affected":[{"type":"plugin","slug":"tree-website-map","name":"Tree Sitemap (Pages, Posts & Categories list)","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf89b453-af9b-4eb1-9ae9-2f5112d3498c","source":"wordfence","cve":"CVE-2026-42704","title":"Kids Care <= 3.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf89b453-af9b-4eb1-9ae9-2f5112d3498c?source=api-prod","affected":[{"type":"theme","slug":"kidscare","name":"Kids Care | Children & Child Care WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T15:59:26Z"},{"id":"wordfence:bf8aa169-df51-46db-8c65-f1543d4f75f9","source":"wordfence","cve":"CVE-2024-10393","title":"Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf8aa169-df51-46db-8c65-f1543d4f75f9?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T06:49:54Z"},{"id":"wordfence:bf8d34ea-cf05-4b20-9d1c-8cf0c608dfc3","source":"wordfence","cve":"CVE-2024-49271","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf8d34ea-cf05-4b20-9d1c-8cf0c608dfc3?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.121","to_inclusive":true,"patched_in":"1.5.122"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:27:48Z"},{"id":"wordfence:bf90b42c-28d2-4d37-a027-fb7f0523e096","source":"wordfence","cve":"CVE-2026-19856","title":"All in One SEO <= 5.0.2.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf90b42c-28d2-4d37-a027-fb7f0523e096?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"5.0.2.0","to_inclusive":true,"patched_in":"5.0.2.1"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-08T23:33:33Z"},{"id":"wordfence:bf90d284-9db8-464b-ae01-f1979408b351","source":"wordfence","cve":"CVE-2017-2216","title":"WordPress Download Manager <= 2.9.49 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf90d284-9db8-464b-ae01-f1979408b351?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.50","to_inclusive":false,"patched_in":"2.9.50"}],"published":"2017-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bf92c64b-ca76-4af7-a1e4-585a60b03153","source":"wordfence","cve":"CVE-2026-2127","title":"SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf92c64b-ca76-4af7-a1e4-585a60b03153?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.70.4","to_inclusive":true,"patched_in":"1.71.0"}],"published":"2026-02-17T20:23:18Z","updated":"2026-02-18T08:26:05Z"},{"id":"wordfence:bf9d2008-a397-413d-868d-23afb55a8947","source":"wordfence","cve":"CVE-2021-24605","title":"Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bf9d2008-a397-413d-868d-23afb55a8947?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-view-generator","name":"Custom Post View Generator","from":"*","from_inclusive":true,"to":"0.4.6","to_inclusive":true,"patched_in":""}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfa03994-3a5a-4e8f-91e4-5564afa76559","source":"wordfence","cve":"CVE-2025-31614","title":"Terms Before Download <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa03994-3a5a-4e8f-91e4-5564afa76559?source=api-prod","affected":[{"type":"plugin","slug":"terms-before-download","name":"Terms Before Download","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:25:20Z"},{"id":"wordfence:bfa1192b-34f5-4b71-8fff-14f2d4ac4aca","source":"wordfence","cve":"CVE-2024-9878","title":"Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa1192b-34f5-4b71-8fff-14f2d4ac4aca?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.30","to_inclusive":true,"patched_in":"1.8.31"}],"published":"2024-11-04T21:24:54Z","updated":"2024-11-05T09:30:58Z"},{"id":"wordfence:bfa12bf7-5056-4d65-885c-36fcb37c017c","source":"wordfence","cve":"CVE-2024-43210","title":"LA-Studio Element Kit for Elementor <= 1.3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa12bf7-5056-4d65-885c-36fcb37c017c?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.9.2","to_inclusive":true,"patched_in":"1.3.9.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-19T13:28:45Z"},{"id":"wordfence:bfa20f77-c508-4eb9-9040-257949aa6266","source":"wordfence","cve":"CVE-2026-97297","title":"Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program <= 4.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa20f77-c508-4eb9-9040-257949aa6266?source=api-prod","affected":[{"type":"plugin","slug":"gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce","name":"Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-10-01T12:26:43Z","updated":"2026-10-09T00:02:03Z"},{"id":"wordfence:bfa62776-0502-49b4-8beb-74bbf7f20633","source":"wordfence","cve":"CVE-2024-29115","title":"Smart Online Order for Clover <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa62776-0502-49b4-8beb-74bbf7f20633?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:14:37Z"},{"id":"wordfence:bfa62b92-e712-416c-a7f9-634cf3db307e","source":"wordfence","cve":"CVE-2025-50026","title":"Spoki <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa62b92-e712-416c-a7f9-634cf3db307e?source=api-prod","affected":[{"type":"plugin","slug":"spoki","name":"Spoki \u2013 Chat Buttons and WooCommerce Notifications","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:54:39Z"},{"id":"wordfence:bfa7ae6c-6bc8-4787-b95b-c12243d0a45c","source":"wordfence","cve":"CVE-2026-54842","title":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa7ae6c-6bc8-4787-b95b-c12243d0a45c?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"*","from_inclusive":true,"to":"1.4.25","to_inclusive":true,"patched_in":"1.4.26"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:36:29Z"},{"id":"wordfence:bfa8328b-5932-4396-b0ef-e16a7ec3b365","source":"wordfence","cve":"CVE-2023-37891","title":"Exit Popups & Onsite Retargeting by OptiMonk <= 2.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa8328b-5932-4396-b0ef-e16a7ec3b365?source=api-prod","affected":[{"type":"plugin","slug":"exit-intent-popups-by-optimonk","name":"AI Popup Builder & Popup Maker by OptiMonk","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2023-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfa9a9f6-dfbb-442c-af2c-af3d44e7b0f1","source":"wordfence","cve":"CVE-2024-37270","title":"TrustedLogin Vendor < 1.1.1 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfa9a9f6-dfbb-442c-af2c-af3d44e7b0f1?source=api-prod","affected":[{"type":"plugin","slug":"vendor","name":"TrustedLogin Vendor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:14:22Z"},{"id":"wordfence:bfaf2047-23a4-4cd2-93bf-d98c8fa960c0","source":"wordfence","cve":"CVE-2026-86839","title":"Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfaf2047-23a4-4cd2-93bf-d98c8fa960c0?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:12:21Z"},{"id":"wordfence:bfb07058-3781-4456-8595-2edf92ef391a","source":"wordfence","cve":"CVE-2026-81803","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb07058-3781-4456-8595-2edf92ef391a?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1224","to_inclusive":true,"patched_in":"4.1225"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:34:51Z"},{"id":"wordfence:bfb104b0-049e-4889-b43c-d7f724e07abf","source":"wordfence","cve":"CVE-2026-39726","title":"Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb104b0-049e-4889-b43c-d7f724e07abf?source=api-prod","affected":[{"type":"plugin","slug":"lumise","name":"Product Designer for WooCommerce WordPress | Lumise","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:31:53Z","updated":"2026-10-08T23:23:54Z"},{"id":"wordfence:bfb329da-00df-4178-ad40-9b0b718dc30e","source":"wordfence","cve":"","title":"Add Custom Post Type into Post Query <= 1.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb329da-00df-4178-ad40-9b0b718dc30e?source=api-prod","affected":[{"type":"plugin","slug":"post-type-modifier-simple","name":"Add Custom Post Type into Post Query","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfb473a6-08ba-4b23-877d-4aa661c0053f","source":"wordfence","cve":"CVE-2023-46083","title":"Contact Form builder with drag & drop - Kali Forms <= 2.3.27 - Missing Authorization via Contact Form","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb473a6-08ba-4b23-877d-4aa661c0053f?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.3.27","to_inclusive":true,"patched_in":"2.3.28"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfb53b61-f476-4b92-b87a-de10e18428a3","source":"wordfence","cve":"CVE-2016-10903","title":"GoDaddy Email Marketing < 1.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb53b61-f476-4b92-b87a-de10e18428a3?source=api-prod","affected":[{"type":"plugin","slug":"godaddy-email-marketing-sign-up-forms","name":"GoDaddy Email Marketing","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2016-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfb63667-6a47-4308-83c5-3d763ea69e13","source":"wordfence","cve":"CVE-2024-51696","title":"Content Syndication Toolkit Reader <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb63667-6a47-4308-83c5-3d763ea69e13?source=api-prod","affected":[{"type":"plugin","slug":"content-syndication-toolkit-reader","name":"Content Syndication Toolkit Reader","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:52:47Z"},{"id":"wordfence:bfb77432-e58d-466e-a366-8b8d7f1b6982","source":"wordfence","cve":"CVE-2024-0595","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb77432-e58d-466e-a366-8b8d7f1b6982?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2024-02-09T00:00:00Z","updated":"2024-08-06T13:16:16Z"},{"id":"wordfence:bfba1c2c-6679-4c6c-95fd-bae391e6aa0b","source":"wordfence","cve":"CVE-2026-39610","title":"WpXmas-Snow <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfba1c2c-6679-4c6c-95fd-bae391e6aa0b?source=api-prod","affected":[{"type":"plugin","slug":"wpxmas-snow","name":"WpXmas Snow","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2026-02-07T00:00:00Z","updated":"2026-06-18T15:00:05Z"},{"id":"wordfence:bfba9979-44a2-4ad4-bb6a-f54f73b628d4","source":"wordfence","cve":"CVE-2023-32103","title":"TP Education <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfba9979-44a2-4ad4-bb6a-f54f73b628d4?source=api-prod","affected":[{"type":"plugin","slug":"tp-education","name":"TP Education","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfbc406b-49af-419e-adeb-0510794b7e3f","source":"wordfence","cve":"CVE-2023-2548","title":"RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change","severity":"medium","cvss":6.6,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfbc406b-49af-419e-adeb-0510794b7e3f?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.2.0.5","to_inclusive":true,"patched_in":"5.2.1.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfc01e65-fbfa-4639-93e6-7b045b0e2ec4","source":"wordfence","cve":"CVE-2025-53588","title":"UPC/EAN/GTIN Code Generator <= 2.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc01e65-fbfa-4639-93e6-7b045b0e2ec4?source=api-prod","affected":[{"type":"plugin","slug":"upc-ean-barcode-generator","name":"UPC/EAN/GTIN Barcode Generator/Importer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T17:16:49Z"},{"id":"wordfence:bfc04273-0d72-4b18-bcb5-eb1530aefcc0","source":"wordfence","cve":"CVE-2024-1290","title":"Formidable Registration <= 2.11 - Authenticated (Contributor+) Arbitrary User Password Reset To Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc04273-0d72-4b18-bcb5-eb1530aefcc0?source=api-prod","affected":[{"type":"plugin","slug":"formidable-registration","name":"WordPress User Registration Forms by Formidable Forms","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2024-02-19T00:00:00Z","updated":"2024-03-12T08:51:45Z"},{"id":"wordfence:bfc4863a-1b8c-4b13-9df1-18f221b40b26","source":"wordfence","cve":"CVE-2023-40555","title":"Flatsome <= 3.17.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc4863a-1b8c-4b13-9df1-18f221b40b26?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.17.5","to_inclusive":true,"patched_in":"3.17.6"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfc4ab58-2117-42e7-b367-ee47e28c69ca","source":"wordfence","cve":"CVE-2024-47383","title":"The Pack Elementor addons <= 2.0.8.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc4ab58-2117-42e7-b367-ee47e28c69ca?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.0.8.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:11:02Z"},{"id":"wordfence:bfc5d53b-272a-4b66-8460-2134087535eb","source":"wordfence","cve":"CVE-2026-3852","title":"Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc5d53b-272a-4b66-8460-2134087535eb?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.6","to_inclusive":true,"patched_in":"4.27.7"}],"published":"2026-09-02T19:51:21Z","updated":"2026-09-03T08:28:09Z"},{"id":"wordfence:bfc62289-9ac0-4aeb-96ac-010af6f437a6","source":"wordfence","cve":"CVE-2024-56054","title":"WPLMS < 1.9.9.5.2 - Authenticated (Instructor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc62289-9ac0-4aeb-96ac-010af6f437a6?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.2","to_inclusive":false,"patched_in":"1.9.9.5.2"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:49:22Z"},{"id":"wordfence:bfc7c214-8d76-453c-a05d-682aa425b06e","source":"wordfence","cve":"CVE-2023-0554","title":"Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-menu","name":"Quick Restaurant Menu","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfc8c34c-3a1d-486e-96ca-ff50a1148813","source":"wordfence","cve":"CVE-2024-49703","title":"Event Manager for WooCommerce <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc8c34c-3a1d-486e-96ca-ff50a1148813?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:02:47Z"},{"id":"wordfence:bfcb0b1f-50fb-4cd8-8ca3-4338c0014cc7","source":"wordfence","cve":"CVE-2019-25297","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.6.25 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcb0b1f-50fb-4cd8-8ca3-4338c0014cc7?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.6.25","to_inclusive":false,"patched_in":"19.6.25"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-19T18:18:29Z"},{"id":"wordfence:bfcbd6fb-f599-4a85-aabb-d03d2716ba00","source":"wordfence","cve":"CVE-2026-27422","title":"YT Player \u2013 Embed and Customize Video Players <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcbd6fb-f599-4a85-aabb-d03d2716ba00?source=api-prod","affected":[{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-28T21:11:47Z"},{"id":"wordfence:bfcbf652-6cb4-4f3e-9032-ad262e8c8480","source":"wordfence","cve":"CVE-2019-16218","title":"WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcbf652-6cb4-4f3e-9032-ad262e8c8480?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.12","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfccbf41-c861-4bf1-b400-7858cb255b9a","source":"wordfence","cve":"CVE-2025-15345","title":"MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfccbf41-c861-4bf1-b400-7858cb255b9a?source=api-prod","affected":[{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.6.27","to_inclusive":true,"patched_in":"1.6.28"}],"published":"2026-05-13T17:15:30Z","updated":"2026-05-14T05:30:31Z"},{"id":"wordfence:bfcd914c-3c12-4e6a-bb05-38d42ce411d4","source":"wordfence","cve":"CVE-2026-8682","title":"3D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfcd914c-3c12-4e6a-bb05-38d42ce411d4?source=api-prod","affected":[{"type":"plugin","slug":"ar-vr-3d-model-try-on","name":"3D Viewer \u2013 3D Model Viewer \u2013 Augmented Reality \u2013 Virtual Try On","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-05-27T00:00:00Z","updated":"2026-05-28T06:45:42Z"},{"id":"wordfence:bfd158b2-c6a4-441a-b611-bf06e197d13d","source":"wordfence","cve":"CVE-2024-33639","title":"PopupAlly <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd158b2-c6a4-441a-b611-bf06e197d13d?source=api-prod","affected":[{"type":"plugin","slug":"popupally","name":"PopupAlly","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-21T16:46:48Z"},{"id":"wordfence:bfd16372-9173-4168-8604-5c117d05c349","source":"wordfence","cve":"","title":"Health Check & Troubleshooting <= 1.2.3 - Cross-Site Request Forgery","severity":"high","cvss":8.0,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd16372-9173-4168-8604-5c117d05c349?source=api-prod","affected":[{"type":"plugin","slug":"health-check","name":"Health Check & Troubleshooting","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2019-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfd1e244-27c2-4c3e-9d82-a7ffefd4eab6","source":"wordfence","cve":"CVE-2021-24762","title":"Perfect Survey <= 1.5.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd1e244-27c2-4c3e-9d82-a7ffefd4eab6?source=api-prod","affected":[{"type":"plugin","slug":"perfect-survey","name":"Perfect Survey","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfd3926e-cdb6-44a6-bada-cb83458ca172","source":"wordfence","cve":"CVE-2018-12426","title":"WP Live Chat Support Pro <= 8.0.06 - Remote Code Execution via unrestricted file upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd3926e-cdb6-44a6-bada-cb83458ca172?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support-pro","name":"wp-live-chat-support-pro","from":"*","from_inclusive":true,"to":"8.0.06","to_inclusive":true,"patched_in":"8.0.07"}],"published":"2019-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfd59736-1223-4e6c-8915-162d0898ae99","source":"wordfence","cve":"CVE-2025-32623","title":"PlainInventory <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd59736-1223-4e6c-8915-162d0898ae99?source=api-prod","affected":[{"type":"plugin","slug":"z-inventory-manager","name":"Zintory \u2013 Inventory Manager","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-04-09T00:00:00Z","updated":"2026-07-08T20:43:09Z"},{"id":"wordfence:bfd59e66-d9f2-4e45-af90-e78950860f96","source":"wordfence","cve":"CVE-2025-57933","title":"Piotnet Forms <= 1.0.30 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd59e66-d9f2-4e45-af90-e78950860f96?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:38:27Z"},{"id":"wordfence:bfd92ce0-1017-488c-9418-1e739868c4d5","source":"wordfence","cve":"CVE-2026-57430","title":"SEOPress PRO <= 9.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd92ce0-1017-488c-9418-1e739868c4d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress-pro","name":"SEOPress PRO","from":"*","from_inclusive":true,"to":"9.1.1","to_inclusive":true,"patched_in":"9.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:12:38Z"},{"id":"wordfence:bfd93c33-4672-4914-b052-7bea283ef60c","source":"wordfence","cve":"CVE-2020-35949","title":"Quiz and Survey Master <= 7.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfd93c33-4672-4914-b052-7bea283ef60c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":false,"patched_in":"7.0.1"}],"published":"2020-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfdea511-b4f5-44a3-b5d0-ec83aa709fd5","source":"wordfence","cve":"CVE-2026-32559","title":"UltimateAI <= 3.1.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfdea511-b4f5-44a3-b5d0-ec83aa709fd5?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_AI","name":"Ultimate AI","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:29:51Z"},{"id":"wordfence:bfe10de1-1c1f-437b-8851-7024fce753be","source":"wordfence","cve":"","title":"WP-Mon <= 0.5.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe10de1-1c1f-437b-8851-7024fce753be?source=api-prod","affected":[{"type":"plugin","slug":"wp-mon","name":"wp-mon","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":""}],"published":"2015-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfe1d122-610a-47c1-944d-bf7352e9ff38","source":"wordfence","cve":"CVE-2017-18592","title":"WC Catalog Enquiry <= 3.0.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe1d122-610a-47c1-944d-bf7352e9ff38?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2017-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfe35762-2cb1-4b62-8865-ab217ff29450","source":"wordfence","cve":"CVE-2024-11417","title":"dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe35762-2cb1-4b62-8865-ab217ff29450?source=api-prod","affected":[{"type":"plugin","slug":"dejureorg-vernetzungsfunktion","name":"dejure.org Vernetzungsfunktion","from":"*","from_inclusive":true,"to":"1.97.5","to_inclusive":true,"patched_in":"1.98.0"}],"published":"2024-12-11T15:17:38Z","updated":"2024-12-13T17:04:06Z"},{"id":"wordfence:bfe48948-7fc9-4806-b1b5-9fac5a6c7d96","source":"wordfence","cve":"CVE-2020-24141","title":"WP-DownloadManager <= 1.68.4 - Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe48948-7fc9-4806-b1b5-9fac5a6c7d96?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.5","to_inclusive":false,"patched_in":"1.68.5"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfe8d13b-f387-4c82-ba9f-efadda18c882","source":"wordfence","cve":"CVE-2023-30748","title":"Easy Appointments <= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe8d13b-f387-4c82-ba9f-efadda18c882?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":"3.11.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfe92082-4944-43dc-b06c-3c3d22e93213","source":"wordfence","cve":"CVE-2025-39550","title":"FluentCommunity <= 1.2.15 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfe92082-4944-43dc-b06c-3c3d22e93213?source=api-prod","affected":[{"type":"plugin","slug":"fluent-community","name":"FluentCommunity \u2013 Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:55:14Z"},{"id":"wordfence:bfeb5a08-4aad-421b-9e50-68dd84adc396","source":"wordfence","cve":"CVE-2025-47462","title":"Challan <= 3.7.58 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfeb5a08-4aad-421b-9e50-68dd84adc396?source=api-prod","affected":[{"type":"plugin","slug":"webappick-pdf-invoice-for-woocommerce","name":"PDF Invoices & Packing Slips for WooCommerce \u2013 Challan Invoice Plugin","from":"*","from_inclusive":true,"to":"3.7.58","to_inclusive":true,"patched_in":"3.7.59"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:47:33Z"},{"id":"wordfence:bfeee1b9-2490-40ad-a49c-f18ed7b11070","source":"wordfence","cve":"CVE-2021-24536","title":"Custom Login Redirect <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfeee1b9-2490-40ad-a49c-f18ed7b11070?source=api-prod","affected":[{"type":"plugin","slug":"custom-login-redirect","name":"Custom Login Redirect","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bfef0be2-b73d-43f9-a3bc-f61846fa0704","source":"wordfence","cve":"CVE-2026-66473","title":"Xendit Payment <= 7.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfef0be2-b73d-43f9-a3bc-f61846fa0704?source=api-prod","affected":[{"type":"plugin","slug":"woo-xendit-virtual-accounts","name":"Xendit Payment","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2026-07-27T00:00:00Z","updated":"2026-09-09T16:08:25Z"},{"id":"wordfence:bfef57b6-26b1-433b-9037-46f908422f72","source":"wordfence","cve":"CVE-2024-13437","title":"Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfef57b6-26b1-433b-9037-46f908422f72?source=api-prod","affected":[{"type":"plugin","slug":"book-a-room","name":"Book a Room","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-11T21:10:47Z","updated":"2025-02-12T09:22:51Z"},{"id":"wordfence:bff16371-51a9-44c9-ba6f-3680f84b880a","source":"wordfence","cve":"CVE-2022-2361","title":"WP Social Chat \u2013 Click To Chat App <= 6.0.4 - Administrator+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff16371-51a9-44c9-ba6f-3680f84b880a?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp-chat","name":"Social Chat \u2013 Click To Chat App Button","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bff1af96-c60e-4c1e-a793-31cd23ec635e","source":"wordfence","cve":"CVE-2026-112365","title":"easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff1af96-c60e-4c1e-a793-31cd23ec635e?source=api-prod","affected":[{"type":"plugin","slug":"easyjobs","name":"easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2026-10-30T16:19:54Z","updated":"2026-10-30T17:15:31Z"},{"id":"wordfence:bff3a160-5238-4478-ab11-3300cac51cf2","source":"wordfence","cve":"CVE-2023-6373","title":"ArtPlacer Widget <= 2.20.6 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff3a160-5238-4478-ab11-3300cac51cf2?source=api-prod","affected":[{"type":"plugin","slug":"artplacer-widget","name":"ArtPlacer Widget","from":"*","from_inclusive":true,"to":"2.20.6","to_inclusive":true,"patched_in":"2.20.7"}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:bff60dda-30e2-4660-931e-4bb9acae0396","source":"wordfence","cve":"CVE-2025-22347","title":"BSK Forms Blacklist <= 3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff60dda-30e2-4660-931e-4bb9acae0396?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravityforms-blacklist","name":"BSK Forms Blacklist","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-01-03T00:00:00Z","updated":"2025-04-25T14:47:25Z"},{"id":"wordfence:bff6fc62-9022-4a3b-9339-5b5d3205d671","source":"wordfence","cve":"CVE-2024-51930","title":"Custom URL Shortener <= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff6fc62-9022-4a3b-9339-5b5d3205d671?source=api-prod","affected":[{"type":"plugin","slug":"custom-url-shorter","name":"Custom URL Shortener","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:16:58Z"},{"id":"wordfence:bff9866e-3967-426e-9b8d-17b317aac7a3","source":"wordfence","cve":"CVE-2024-56057","title":"WPLMS < 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff9866e-3967-426e-9b8d-17b317aac7a3?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5.2","to_inclusive":false,"patched_in":"1.9.9.5.2"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:48:53Z"},{"id":"wordfence:bff9e7d2-b9ad-403e-a361-3e95e2c7909f","source":"wordfence","cve":"CVE-2026-39463","title":"ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bff9e7d2-b9ad-403e-a361-3e95e2c7909f?source=api-prod","affected":[{"type":"plugin","slug":"worker","name":"ManageWP Worker","from":"*","from_inclusive":true,"to":"4.9.31","to_inclusive":true,"patched_in":"4.9.32"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T14:51:09Z"},{"id":"wordfence:bffceead-b659-4836-b2ed-98411667a3b4","source":"wordfence","cve":"CVE-2026-104407","title":"PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bffceead-b659-4836-b2ed-98411667a3b4?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.17.9","to_inclusive":true,"patched_in":"11.17.11"}],"published":"2026-10-05T08:34:00Z","updated":"2026-10-08T23:25:44Z"},{"id":"wordfence:bfffed4d-dacb-4591-840c-45105a58362a","source":"wordfence","cve":"CVE-2023-39922","title":"Avada <= 7.11.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bfffed4d-dacb-4591-840c-45105a58362a?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.1","to_inclusive":true,"patched_in":"7.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c000a424-4060-4dcc-bae3-fa8cfc00ddda","source":"wordfence","cve":"CVE-2021-24586","title":"Per Page Add To Head <= 1.4.3 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c000a424-4060-4dcc-bae3-fa8cfc00ddda?source=api-prod","affected":[{"type":"plugin","slug":"per-page-add-to","name":"Per page add to head","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2021-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0038682-1b42-4c3d-a9e5-08840fd91aee","source":"wordfence","cve":"CVE-2026-104406","title":"picu \u2013 Online Photo Proofing Gallery <= 3.10.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0038682-1b42-4c3d-a9e5-08840fd91aee?source=api-prod","affected":[{"type":"plugin","slug":"picu","name":"picu \u2013 Online Photo Proofing Gallery","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2026-10-05T10:48:09Z","updated":"2026-10-08T23:10:33Z"},{"id":"wordfence:c006109a-206e-47f0-9f7b-fc8ac4c8c1d5","source":"wordfence","cve":"CVE-2025-60205","title":"ThemeREX Addons <= 2.36.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c006109a-206e-47f0-9f7b-fc8ac4c8c1d5?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.36.1.1","to_inclusive":true,"patched_in":"2.36.2"}],"published":"2025-08-27T00:00:00Z","updated":"2026-09-18T14:50:50Z"},{"id":"wordfence:c006b85d-fc05-41e7-93b2-5a09a21bec1a","source":"wordfence","cve":"","title":"Row Seats Core < 2.68 - PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c006b85d-fc05-41e7-93b2-5a09a21bec1a?source=api-prod","affected":[{"type":"plugin","slug":"row-seats","name":"Row Seats Core","from":"*","from_inclusive":true,"to":"2.68","to_inclusive":false,"patched_in":"2.68"}],"published":"2017-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c00c735a-8c49-436b-9740-329b5c754712","source":"wordfence","cve":"CVE-2024-51914","title":"drop in image slideshow gallery <= 12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c00c735a-8c49-436b-9740-329b5c754712?source=api-prod","affected":[{"type":"plugin","slug":"drop-in-image-slideshow-gallery","name":"drop in image slideshow gallery","from":"*","from_inclusive":true,"to":"12.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:17:21Z"},{"id":"wordfence:c00d83a7-dd7a-407d-b44e-7ee0a2a1492a","source":"wordfence","cve":"CVE-2024-12140","title":"Elementor AI Addons \u2013 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c00d83a7-dd7a-407d-b44e-7ee0a2a1492a?source=api-prod","affected":[{"type":"plugin","slug":"ai-addons-for-elementor","name":"Elementor Addons AI Addons \u2013 70 Widgets, Premium Templates, Ultimate Elements","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:08:19Z","updated":"2025-01-07T04:22:19Z"},{"id":"wordfence:c00ff4bd-d846-4e3f-95ed-2a6430c47ebf","source":"wordfence","cve":"CVE-2024-0586","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c00ff4bd-d846-4e3f-95ed-2a6430c47ebf?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"5.9.5"}],"published":"2024-01-17T00:00:00Z","updated":"2024-10-24T19:28:59Z"},{"id":"wordfence:c0163382-9b53-4c74-b9bd-c3baa14faee1","source":"wordfence","cve":"CVE-2025-47564","title":"EventON (Pro) <= 4.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0163382-9b53-4c74-b9bd-c3baa14faee1?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:48:24Z"},{"id":"wordfence:c0170668-65bc-4d65-a88b-9398391c98d9","source":"wordfence","cve":"CVE-2024-12127","title":"Learning Management System, eLearning, Course Builder, WordPress LMS Plugin \u2013 Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0170668-65bc-4d65-a88b-9398391c98d9?source=api-prod","affected":[{"type":"plugin","slug":"sikshya","name":"Sikshya LMS \u2013 LMS Course Builder, Online Courses & eLearning","from":"*","from_inclusive":true,"to":"0.0.21","to_inclusive":true,"patched_in":"0.0.22"}],"published":"2024-12-16T21:00:42Z","updated":"2024-12-17T09:22:42Z"},{"id":"wordfence:c0179947-9346-4411-a946-09d58b556b9c","source":"wordfence","cve":"CVE-2024-49258","title":"WordPress Gallery Plugin \u2013 Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0179947-9346-4411-a946-09d58b556b9c?source=api-prod","affected":[{"type":"plugin","slug":"limb-gallery","name":"Limb Gallery | Create Beautiful Image & Video Galleries","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:27:07Z"},{"id":"wordfence:c017b6c0-f078-4fc3-919a-8bf61dd8b4de","source":"wordfence","cve":"CVE-2026-111982","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c017b6c0-f078-4fc3-919a-8bf61dd8b4de?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":false,"patched_in":"4.0.5"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:08:27Z"},{"id":"wordfence:c017bd52-5548-4461-a6ab-336ab45a9e3e","source":"wordfence","cve":"CVE-2025-23561","title":"MLL Audio Player MP3 Ajax <= 0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c017bd52-5548-4461-a6ab-336ab45a9e3e?source=api-prod","affected":[{"type":"plugin","slug":"music-let-loose-mp3-audio-player","name":"MLL Audio Player MP3 Ajax","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T15:57:56Z"},{"id":"wordfence:c01a06ca-ba3f-4e61-a17c-86d5e9f53ebf","source":"wordfence","cve":"CVE-2026-11601","title":"WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01a06ca-ba3f-4e61-a17c-86d5e9f53ebf?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.19","to_inclusive":true,"patched_in":"3.0.20"}],"published":"2026-10-02T17:36:16Z","updated":"2026-10-03T06:38:25Z"},{"id":"wordfence:c01a8fbc-c16a-40e2-b628-f874cd3b21e4","source":"wordfence","cve":"CVE-2024-32780","title":"VikRentCar Car Rental Management System <= 1.3.2 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01a8fbc-c16a-40e2-b628-f874cd3b21e4?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:42:03Z"},{"id":"wordfence:c01bce24-3563-40bd-83c5-8d54bd622151","source":"wordfence","cve":"","title":"Ultimate WordPress Auction Plugin < 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01bce24-3563-40bd-83c5-8d54bd622151?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2013-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c01cbc25-bdf7-4525-8c7b-194bd0aeb32b","source":"wordfence","cve":"CVE-2023-29099","title":"Divi <= 4.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01cbc25-bdf7-4525-8c7b-194bd0aeb32b?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.20.2","to_inclusive":true,"patched_in":"4.20.3"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c01e3a86-8a2a-4200-b328-fb71afb2b196","source":"wordfence","cve":"CVE-2023-50850","title":"WooCommerce Subscriptions < 5.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01e3a86-8a2a-4200-b328-fb71afb2b196?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":false,"patched_in":"5.8.0"}],"published":"2024-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c01f1947-6a15-4742-bb2d-b68669b02aa2","source":"wordfence","cve":"CVE-2026-40721","title":"Element Pack Pro <= 9.0.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01f1947-6a15-4742-bb2d-b68669b02aa2?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack","name":"Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin","from":"*","from_inclusive":true,"to":"9.0.6","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2026-01-14T00:00:00Z","updated":"2026-09-18T14:46:08Z"},{"id":"wordfence:c01f7892-5ca2-4bc8-91c2-dfebb685aff8","source":"wordfence","cve":"CVE-2025-7496","title":"WPC Smart Compare for WooCommerce <= 6.4.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01f7892-5ca2-4bc8-91c2-dfebb685aff8?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-compare","name":"WPC Smart Compare for WooCommerce","from":"*","from_inclusive":true,"to":"6.4.7","to_inclusive":true,"patched_in":"6.4.8"}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-19T03:39:04Z"},{"id":"wordfence:c01f98a4-c349-4cb2-b09a-5cbadfcad830","source":"wordfence","cve":"CVE-2026-89427","title":"Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c01f98a4-c349-4cb2-b09a-5cbadfcad830?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-09-30T20:28:37Z","updated":"2026-10-01T08:28:45Z"},{"id":"wordfence:c022c434-6a77-4ef8-8665-127f54f743cd","source":"wordfence","cve":"CVE-2026-56036","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778 <= 5.5.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c022c434-6a77-4ef8-8665-127f54f743cd?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-29T18:51:32Z"},{"id":"wordfence:c023b91e-f633-41a6-b2d7-bcb3f1d026b7","source":"wordfence","cve":"CVE-2026-0808","title":"Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c023b91e-f633-41a6-b2d7-bcb3f1d026b7?source=api-prod","affected":[{"type":"plugin","slug":"spin-wheel","name":"Spin Wheel \u2013 Interactive spinning wheel that offers coupons","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-01-16T18:09:30Z","updated":"2026-01-17T06:42:21Z"},{"id":"wordfence:c0248af2-f9f3-4652-bf6d-b46aa91b66f3","source":"wordfence","cve":"CVE-2024-12332","title":"School Management System \u2013 WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0248af2-f9f3-4652-bf6d-b46aa91b66f3?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.15"}],"published":"2025-01-06T16:09:37Z","updated":"2025-07-25T19:42:32Z"},{"id":"wordfence:c025e94e-023e-41d5-a2c2-18c9940af8b8","source":"wordfence","cve":"CVE-2025-50010","title":"Zapier for WordPress <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c025e94e-023e-41d5-a2c2-18c9940af8b8?source=api-prod","affected":[{"type":"plugin","slug":"zapier","name":"Zapier for WordPress","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T15:53:20Z"},{"id":"wordfence:c028005d-f5cb-49e2-87d9-399b0d6530be","source":"wordfence","cve":"CVE-2025-62988","title":"Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c028005d-f5cb-49e2-87d9-399b0d6530be?source=api-prod","affected":[{"type":"plugin","slug":"slider-templates","name":"Slider Templates","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-29T15:35:45Z"},{"id":"wordfence:c0290595-d74d-404e-9d28-75abc9055031","source":"wordfence","cve":"CVE-2025-14121","title":"EDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0290595-d74d-404e-9d28-75abc9055031?source=api-prod","affected":[{"type":"plugin","slug":"edd-download-info","name":"EDD Download Info","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:33:14Z","updated":"2026-01-07T09:21:03Z"},{"id":"wordfence:c0294278-581d-4c1e-b77e-a598ea6c816b","source":"wordfence","cve":"CVE-2024-12736","title":"BU Section Editing <= 0.9.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0294278-581d-4c1e-b77e-a598ea6c816b?source=api-prod","affected":[{"type":"plugin","slug":"bu-section-editing","name":"BU Section Editing","from":"*","from_inclusive":true,"to":"0.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:46:40Z"},{"id":"wordfence:c02a9639-525c-4e63-8ca0-2452667bbfd5","source":"wordfence","cve":"CVE-2024-38710","title":"Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c02a9639-525c-4e63-8ca0-2452667bbfd5?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.2","to_inclusive":true,"patched_in":"2.0.6.3"}],"published":"2024-07-11T00:00:00Z","updated":"2024-09-03T16:38:52Z"},{"id":"wordfence:c02c824a-dc6e-4329-8e1b-0519b6c4e4c0","source":"wordfence","cve":"CVE-2025-39545","title":"WordPress REST API Authentication <= 3.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c02c824a-dc6e-4329-8e1b-0519b6c4e4c0?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-api-authentication","name":"JWT Authentication for WP REST APIs","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:39:24Z"},{"id":"wordfence:c031d2a4-d009-4422-a751-b8476e15a808","source":"wordfence","cve":"CVE-2022-4216","title":"Chained Quiz <= 1.3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c031d2a4-d009-4422-a751-b8476e15a808?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.2","to_inclusive":true,"patched_in":"1.3.2.3"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c033171a-d81f-4cae-830b-8bdc4017b85e","source":"wordfence","cve":"CVE-2024-5791","title":"Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c033171a-d81f-4cae-830b-8bdc4017b85e?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-06-21T12:35:46Z","updated":"2024-06-22T02:01:07Z"},{"id":"wordfence:c034d2a2-20c4-4c32-8cfe-b80a62bdfdeb","source":"wordfence","cve":"CVE-2012-4332","title":"ShareYourCart < 1.7.1 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c034d2a2-20c4-4c32-8cfe-b80a62bdfdeb?source=api-prod","affected":[{"type":"plugin","slug":"shareyourcart","name":"ShareYourCart","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2012-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c035ac71-54f9-471b-93f3-6bd6a5b86ab2","source":"wordfence","cve":"CVE-2015-2065","title":"Wordpress Video Gallery <= 2.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c035ac71-54f9-471b-93f3-6bd6a5b86ab2?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":false,"patched_in":"2.8"}],"published":"2015-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0363732-0a67-4a58-9b54-6315328c70ec","source":"wordfence","cve":"CVE-2021-24626","title":"Chameleon CSS <= 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0363732-0a67-4a58-9b54-6315328c70ec?source=api-prod","affected":[{"type":"plugin","slug":"chameleon-css","name":"Chameleon CSS","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0377d27-0439-46d3-a02c-a693b1ed0bfd","source":"wordfence","cve":"","title":"Persuasion <= 2.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0377d27-0439-46d3-a02c-a693b1ed0bfd?source=api-prod","affected":[{"type":"theme","slug":"persuasion","name":"Persuasion","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0382ab4-6d2f-476b-a78f-cfabbfe2df43","source":"wordfence","cve":"CVE-2026-9066","title":"Compress <= 7.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0382ab4-6d2f-476b-a78f-cfabbfe2df43?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"7.10.3","to_inclusive":true,"patched_in":"7.10.04"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-29T23:12:31Z"},{"id":"wordfence:c0383bc6-919d-4858-a5b7-abe8a4a6c684","source":"wordfence","cve":"CVE-2021-24208","title":"WP Page Builder <= 1.2.3 - Multiple Stored Cross-Site scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0383bc6-919d-4858-a5b7-abe8a4a6c684?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagebuilder","name":"WP Page Builder","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2021-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0390885-d380-400f-832d-2a75fd3b94ee","source":"wordfence","cve":"CVE-2025-1303","title":"Plugin Oficial \u2013 Getnet para WooCommerce <= 1.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0390885-d380-400f-832d-2a75fd3b94ee?source=api-prod","affected":[{"type":"plugin","slug":"wc-checkout-getnet","name":"CoffeeCode \u2013 Checkout for Getnet and WooCommerce","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-03-07T00:00:00Z","updated":"2025-07-08T15:16:45Z"},{"id":"wordfence:c039d2fe-7518-4724-a025-6380a53fb58c","source":"wordfence","cve":"CVE-2024-3606","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c039d2fe-7518-4724-a025-6380a53fb58c?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"5.8.4"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:33Z"},{"id":"wordfence:c03a3604-3bd5-4bd8-9294-92a8f9fcdd5e","source":"wordfence","cve":"CVE-2025-26963","title":"ClickWhale <= 2.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03a3604-3bd5-4bd8-9294-92a8f9fcdd5e?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-02-13T00:00:00Z","updated":"2025-03-03T16:33:07Z"},{"id":"wordfence:c03b5670-9f7e-4001-ba90-197559b794a1","source":"wordfence","cve":"CVE-2023-47553","title":"UserHeat Plugin <= 1.1.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03b5670-9f7e-4001-ba90-197559b794a1?source=api-prod","affected":[{"type":"plugin","slug":"userheat","name":"UserHeat Plugin","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2023-11-07T00:00:00Z","updated":"2025-01-17T12:17:30Z"},{"id":"wordfence:c03cf3a2-3be9-44da-a050-a5978eb3eadc","source":"wordfence","cve":"CVE-2020-28978","title":"Canto <= 1.9.0 - Blind Server-Side Request Forgery via tree.php","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03cf3a2-3be9-44da-a050-a5978eb3eadc?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2020-03-12T00:00:00Z","updated":"2026-01-21T20:55:42Z"},{"id":"wordfence:c03ddcf0-6955-4645-b311-c3833ca61455","source":"wordfence","cve":"CVE-2026-7332","title":"LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03ddcf0-6955-4645-b311-c3833ca61455?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2026-05-05T18:41:45Z","updated":"2026-05-08T12:38:08Z"},{"id":"wordfence:c03e74c5-ad32-4651-a55a-cc8d89b8a991","source":"wordfence","cve":"CVE-2025-24777","title":"Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c03e74c5-ad32-4651-a55a-cc8d89b8a991?source=api-prod","affected":[{"type":"theme","slug":"hillter","name":"Hillter - Responsive Hotel Booking for WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:03:00Z"},{"id":"wordfence:c042b347-2884-436d-abd3-6931548f18d6","source":"wordfence","cve":"CVE-2025-3063","title":"Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c042b347-2884-436d-abd3-6931548f18d6?source=api-prod","affected":[{"type":"plugin","slug":"shopperapproved-reviews","name":"Shopper Approved Reviews","from":"2.0","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-04-01T20:28:58Z","updated":"2025-04-04T13:11:28Z"},{"id":"wordfence:c043510b-6aeb-4e91-80f0-a62970c01b1d","source":"wordfence","cve":"CVE-2021-4415","title":"Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c043510b-6aeb-4e91-80f0-a62970c01b1d?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"2.8.28","to_inclusive":true,"patched_in":"2.8.29"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c04449a1-24ac-4dca-932b-fc8c62b53ce6","source":"wordfence","cve":"CVE-2026-65530","title":"TemplateSpare \u2013 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c04449a1-24ac-4dca-932b-fc8c62b53ce6?source=api-prod","affected":[{"type":"plugin","slug":"templatespare","name":"TemplateSpare \u2013 No-Code Website Templates, Demo Importer & Site Migration for News, Magazine & Blog","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-07-23T00:00:00Z","updated":"2026-11-03T22:45:44Z"},{"id":"wordfence:c045b31f-b4d6-470e-8f93-36eb70bb75f8","source":"wordfence","cve":"CVE-2023-4935","title":"BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c045b31f-b4d6-470e-8f93-36eb70bb75f8?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0467322-7fbc-40be-ad0f-23139de9d59e","source":"wordfence","cve":"CVE-2026-87916","title":"WPBot <= 8.5.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0467322-7fbc-40be-ad0f-23139de9d59e?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.9","to_inclusive":true,"patched_in":"8.6.0"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T18:45:59Z"},{"id":"wordfence:c0469ece-6f5f-4774-8094-f7f67702a775","source":"wordfence","cve":"CVE-2025-10313","title":"Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0469ece-6f5f-4774-8094-f7f67702a775?source=api-prod","affected":[{"type":"plugin","slug":"find-and-replace-content","name":"Find And Replace content for WordPress","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T20:02:51Z","updated":"2025-10-15T08:26:03Z"},{"id":"wordfence:c04a0f82-97f6-44ff-999d-08a8c106f889","source":"wordfence","cve":"CVE-2023-0367","title":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c04a0f82-97f6-44ff-999d-08a8c106f889?source=api-prod","affected":[{"type":"plugin","slug":"pricing-tables-for-wpbakery-page-builder","name":"Pricing Tables For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c04d19fb-57b3-4361-bad3-eed98f693939","source":"wordfence","cve":"CVE-2023-49151","title":"Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c04d19fb-57b3-4361-bad3-eed98f693939?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0519729-fbe5-4c47-9160-c4f4ecd3ecf7","source":"wordfence","cve":"CVE-2026-39599","title":"WDS MCP Content Manager <= 3.10.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0519729-fbe5-4c47-9160-c4f4ecd3ecf7?source=api-prod","affected":[{"type":"plugin","slug":"wds-mcp-content-manager","name":"WDS MCP Content Manager","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-02T14:46:00Z","updated":"2026-10-08T23:22:05Z"},{"id":"wordfence:c0538999-0a09-4d24-a530-a32fb5b4e5e6","source":"wordfence","cve":"CVE-2024-2110","title":"Events Manager <= 6.4.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0538999-0a09-4d24-a530-a32fb5b4e5e6?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.4.7.1","to_inclusive":true,"patched_in":"6.4.7.2"}],"published":"2024-03-27T00:00:00Z","updated":"2024-03-28T02:04:11Z"},{"id":"wordfence:c05548e4-024b-467e-9d15-8baccd017668","source":"wordfence","cve":"CVE-2026-114176","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c05548e4-024b-467e-9d15-8baccd017668?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-10-21T17:59:00Z","updated":"2026-10-23T18:54:06Z"},{"id":"wordfence:c05575ef-3140-4340-9b4b-1803a8045ce0","source":"wordfence","cve":"CVE-2025-6941","title":"LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c05575ef-3140-4340-9b4b-1803a8045ce0?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.94","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-09-29T16:24:40Z","updated":"2025-09-30T04:27:07Z"},{"id":"wordfence:c05687f4-5ea2-4226-982f-c3499f204685","source":"wordfence","cve":"CVE-2024-5439","title":"Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c05687f4-5ea2-4226-982f-c3499f204685?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.50","to_inclusive":true,"patched_in":"2.0.51"}],"published":"2024-06-04T19:06:12Z","updated":"2024-06-05T07:34:56Z"},{"id":"wordfence:c06207da-d15d-4540-84be-218fa9055fd5","source":"wordfence","cve":"CVE-2025-13624","title":"Overstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c06207da-d15d-4540-84be-218fa9055fd5?source=api-prod","affected":[{"type":"plugin","slug":"overstock-affiliate-links","name":"Overstock Affiliate Links","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:07:52Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:c062d60b-eda8-4039-8655-64f32e70839a","source":"wordfence","cve":"CVE-2021-24188","title":"WP Copy Protection & No Right Click <= 3.1.4 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c062d60b-eda8-4039-8655-64f32e70839a?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-copy-protector","name":"WP Content Copy Protection & No Right Click","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c064227f-6332-40c8-9e96-337c608da832","source":"wordfence","cve":"CVE-2023-4514","title":"Mmm Simple File List <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c064227f-6332-40c8-9e96-337c608da832?source=api-prod","affected":[{"type":"plugin","slug":"mmm-file-list","name":"Mmm Simple File List","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0680c2e-5983-4866-ad53-b35bed384d00","source":"wordfence","cve":"CVE-2025-60238","title":"UNIVERSAM < 9.08 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0680c2e-5983-4866-ad53-b35bed384d00?source=api-prod","affected":[{"type":"plugin","slug":"universam-demo","name":"UNIVERSAM","from":"*","from_inclusive":true,"to":"9.08","to_inclusive":false,"patched_in":"9.08"}],"published":"2025-07-06T00:00:00Z","updated":"2026-08-14T15:14:42Z"},{"id":"wordfence:c0693caa-2c7e-4e9f-8829-1883876d6966","source":"wordfence","cve":"CVE-2024-45460","title":"Flipping Cards <= 1.30 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0693caa-2c7e-4e9f-8829-1883876d6966?source=api-prod","affected":[{"type":"plugin","slug":"flipping-cards","name":"Flipping Cards","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-18T15:55:24Z"},{"id":"wordfence:c06d7abc-c3dd-428f-b7dc-b2abc077435c","source":"wordfence","cve":"CVE-2024-35709","title":"The Plus Addons for Elementor Page Builder Lite <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c06d7abc-c3dd-428f-b7dc-b2abc077435c?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2024-06-06T00:00:00Z","updated":"2026-04-15T20:49:44Z"},{"id":"wordfence:c06db4a6-fb17-4fcc-95df-f84ac59cc42c","source":"wordfence","cve":"CVE-2025-57936","title":"Subresource Integrity (SRI) Manager <= 0.4.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c06db4a6-fb17-4fcc-95df-f84ac59cc42c?source=api-prod","affected":[{"type":"plugin","slug":"wp-sri","name":"Subresource Integrity (SRI) Manager","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:39:23Z"},{"id":"wordfence:c06f21f7-3552-4de2-89e7-ed331f61235d","source":"wordfence","cve":"CVE-2026-24569","title":"Media Library File Size <= 1.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c06f21f7-3552-4de2-89e7-ed331f61235d?source=api-prod","affected":[{"type":"plugin","slug":"media-library-file-size","name":"Media Library File Size","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:32:01Z"},{"id":"wordfence:c06f9f6d-3cd0-4700-834b-435a99983453","source":"wordfence","cve":"CVE-2023-35037","title":"Surfer <= 1.3.2.357 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c06f9f6d-3cd0-4700-834b-435a99983453?source=api-prod","affected":[{"type":"plugin","slug":"surferseo","name":"Surfer \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.3.2.357","to_inclusive":true,"patched_in":"1.3.3.379"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0701e57-0771-48a2-ae1b-6429b27ce98f","source":"wordfence","cve":"CVE-2025-32920","title":"TI WooCommerce Wishlist <= 2.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0701e57-0771-48a2-ae1b-6429b27ce98f?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2025-05-15T00:00:00Z","updated":"2025-12-05T16:50:14Z"},{"id":"wordfence:c07054e1-b6c9-4e70-aece-09f81bb418ef","source":"wordfence","cve":"CVE-2025-6383","title":"WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c07054e1-b6c9-4e70-aece-09f81bb418ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-photonav","name":"WP-PhotoNav","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:51:44Z","updated":"2025-06-26T02:06:34Z"},{"id":"wordfence:c0706234-f672-4db1-8dea-e4cd9d881f68","source":"wordfence","cve":"CVE-2025-26989","title":"Zigaform \u2013 Form Builder Lite <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0706234-f672-4db1-8dea-e4cd9d881f68?source=api-prod","affected":[{"type":"plugin","slug":"zigaform-form-builder-lite","name":"Zigaform \u2013 Form Builder Lite","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-03T20:21:59Z"},{"id":"wordfence:c0754c1d-378c-47d4-9b67-0916d89bb327","source":"wordfence","cve":"CVE-2025-46473","title":"Social Counter <= 2.0.5 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0754c1d-378c-47d4-9b67-0916d89bb327?source=api-prod","affected":[{"type":"plugin","slug":"social-counter","name":"Social Counter & Sharer","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-16T15:11:26Z"},{"id":"wordfence:c0793db6-5a9b-4726-935e-c8d614443611","source":"wordfence","cve":"CVE-2021-24719","title":"Enfold - Responsive Multi-Purpose Theme < 4.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0793db6-5a9b-4726-935e-c8d614443611?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c07a052d-5c04-48bc-82a7-4d50a5433290","source":"wordfence","cve":"CVE-2025-32196","title":"News Kit Elementor Addons <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c07a052d-5c04-48bc-82a7-4d50a5433290?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-10-14T10:52:34Z"},{"id":"wordfence:c07ea205-5a05-43f5-993e-c6e30f660ac8","source":"wordfence","cve":"CVE-2022-3912","title":"User Registration <= 2.2.4  - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c07ea205-5a05-43f5-993e-c6e30f660ac8?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.41"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c080df50-1113-484b-80ed-09515982c585","source":"wordfence","cve":"CVE-2025-8359","title":"AdForest <= 6.0.9 - Authentication Bypass to Admin","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c080df50-1113-484b-80ed-09515982c585?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"6.0.10"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T02:24:18Z"},{"id":"wordfence:c083992b-a0dd-4709-b152-08f5b7ca55dc","source":"wordfence","cve":"CVE-2025-39426","title":"illow \u2013 Cookies Consent <= 0.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c083992b-a0dd-4709-b152-08f5b7ca55dc?source=api-prod","affected":[{"type":"plugin","slug":"lgpd-compliant-cookie-banner","name":"illow \u2013 Cookies Consent","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:45:52Z"},{"id":"wordfence:c08444ef-77bc-4e9d-8d94-04b90cc99ded","source":"wordfence","cve":"CVE-2025-11991","title":"JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c08444ef-77bc-4e9d-8d94-04b90cc99ded?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-12-15T18:47:07Z","updated":"2025-12-16T07:21:06Z"},{"id":"wordfence:c0856920-5463-4dd3-a4fd-e56901a89b83","source":"wordfence","cve":"CVE-2023-4521","title":"Import XML and RSS Feeds <= 2.1.4 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0856920-5463-4dd3-a4fd-e56901a89b83?source=api-prod","affected":[{"type":"plugin","slug":"import-xml-feed","name":"Import XML and RSS Feeds","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c08d420d-d521-4215-9ef7-b5d1c44a19d3","source":"wordfence","cve":"CVE-2025-12372","title":"The Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c08d420d-d521-4215-9ef7-b5d1c44a19d3?source=api-prod","affected":[{"type":"plugin","slug":"the-permalinks-cascade","name":"The Permalinks Cascade","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:12:09Z","updated":"2025-11-18T08:27:36Z"},{"id":"wordfence:c08ffe26-23a0-40d8-91ad-19be59cf38a3","source":"wordfence","cve":"CVE-2025-48358","title":"Risk Free Cash On Delivery (COD) - WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c08ffe26-23a0-40d8-91ad-19be59cf38a3?source=api-prod","affected":[{"type":"plugin","slug":"risk-free-cash-on-delivery-cod-woocommerce","name":"Risk Free Cash On Delivery (COD) \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:02:30Z"},{"id":"wordfence:c0915660-fcc9-451f-a6bc-60b6fd86ec63","source":"wordfence","cve":"CVE-2025-67474","title":"ForumWP <= 2.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0915660-fcc9-451f-a6bc-60b6fd86ec63?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-11T16:58:28Z"},{"id":"wordfence:c092629f-177c-4201-9fdd-defe47f85811","source":"wordfence","cve":"CVE-2024-9689","title":"Post From Frontend <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c092629f-177c-4201-9fdd-defe47f85811?source=api-prod","affected":[{"type":"plugin","slug":"post-from-frontend","name":"Post From Frontend","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T14:46:39Z"},{"id":"wordfence:c09318f1-04b2-44e5-a184-c07942ae5778","source":"wordfence","cve":"CVE-2026-27042","title":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c09318f1-04b2-44e5-a184-c07942ae5778?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-01-15T00:00:00Z","updated":"2026-05-04T15:50:19Z"},{"id":"wordfence:c093ed6a-0f3d-4ad9-a57c-cec1c2e7bd8e","source":"wordfence","cve":"CVE-2024-12015","title":"WP Project Manager <= 2.6.31 - Authenticated (Project Manager+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c093ed6a-0f3d-4ad9-a57c-cec1c2e7bd8e?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.31","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-12-02T00:00:00Z","updated":"2026-05-05T18:30:12Z"},{"id":"wordfence:c09536b3-9f8d-4b11-b69a-684b65078870","source":"wordfence","cve":"CVE-2018-5364","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c09536b3-9f8d-4b11-b69a-684b65078870?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0979a15-5fa9-4024-81a8-3555d6f73e61","source":"wordfence","cve":"CVE-2023-23663","title":"MainWP Comments Extension <= 4.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0979a15-5fa9-4024-81a8-3555d6f73e61?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-comments-extension","name":"MainWP Comments Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c098c975-3a9b-4b6c-81e7-c66ca9e3d09c","source":"wordfence","cve":"CVE-2024-11385","title":"Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c098c975-3a9b-4b6c-81e7-c66ca9e3d09c?source=api-prod","affected":[{"type":"plugin","slug":"pure-css-circle-progress-bar","name":"Pure CSS Circle Progress bar","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T02:06:44Z"},{"id":"wordfence:c099f401-4b05-4532-8e31-af1b1dea7eca","source":"wordfence","cve":"CVE-2024-9265","title":"Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c099f401-4b05-4532-8e31-af1b1dea7eca?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-post-generator-echo","name":"Echo RSS Feed Post Generator","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T08:30:20Z"},{"id":"wordfence:c09b634f-1d36-4454-8e2a-f12d7711d64f","source":"wordfence","cve":"CVE-2024-37241","title":"WP Job Manager - Resume Manager <= 2.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c09b634f-1d36-4454-8e2a-f12d7711d64f?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager-resumes","name":"WP Job Manager - Resume Manager","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-26T20:36:24Z"},{"id":"wordfence:c09d5743-e7d0-4017-9037-401d683395ed","source":"wordfence","cve":"CVE-2025-31570","title":"Related Posts Widget with Thumbnails <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c09d5743-e7d0-4017-9037-401d683395ed?source=api-prod","affected":[{"type":"plugin","slug":"advanced-css3-related-posts-widget","name":"Stunning Related for Posts, Products, Pages and widgets","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-03-31T00:00:00Z","updated":"2026-09-09T15:50:49Z"},{"id":"wordfence:c09f9f61-c25f-49dc-a97c-8e145e1141b6","source":"wordfence","cve":"CVE-2025-26967","title":"Events Calendar for GeoDirectory <= 2.3.14 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c09f9f61-c25f-49dc-a97c-8e145e1141b6?source=api-prod","affected":[{"type":"plugin","slug":"events-for-geodirectory","name":"Events Calendar for GeoDirectory","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:33:44Z"},{"id":"wordfence:c0a2a379-bd33-4c7d-8b79-e48a2df7e281","source":"wordfence","cve":"CVE-2021-24461","title":"FAQ Builder AYS <= 1.3.5 - Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a2a379-bd33-4c7d-8b79-e48a2df7e281?source=api-prod","affected":[{"type":"plugin","slug":"faq-builder-ays","name":"FAQ Builder AYS","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0a42af0-72da-49f3-a2c5-e76a9e918446","source":"wordfence","cve":"CVE-2026-10755","title":"All in One SEO < 4.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a42af0-72da-49f3-a2c5-e76a9e918446?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":false,"patched_in":"4.9.9"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T21:55:22Z"},{"id":"wordfence:c0a43f7f-1314-4894-aaf1-b7ef0f3e6217","source":"wordfence","cve":"CVE-2026-107616","title":"Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a43f7f-1314-4894-aaf1-b7ef0f3e6217?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"9.0","from_inclusive":true,"to":"9.9.1","to_inclusive":true,"patched_in":"9.9.2"}],"published":"2026-11-06T21:22:01Z","updated":"2026-11-07T09:25:48Z"},{"id":"wordfence:c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695","source":"wordfence","cve":"CVE-2025-12371","title":"Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a5e6b9-4da1-4d95-9fb1-aabb0d21b695?source=api-prod","affected":[{"type":"plugin","slug":"nari-accountant","name":"Nari Accountant","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:32:24Z","updated":"2025-11-04T04:27:21Z"},{"id":"wordfence:c0a617fc-da3d-4828-b027-44093dd11769","source":"wordfence","cve":"CVE-2026-12417","title":"SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a617fc-da3d-4828-b027-44093dd11769?source=api-prod","affected":[{"type":"plugin","slug":"signup-signin","name":"SignUp & SignIn","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:37:27Z","updated":"2026-06-24T05:33:29Z"},{"id":"wordfence:c0a61e11-1137-4da0-8580-0a44300b1542","source":"wordfence","cve":"CVE-2024-13689","title":"Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a61e11-1137-4da0-8580-0a44300b1542?source=api-prod","affected":[{"type":"plugin","slug":"uncode-core","name":"Uncode Core","from":"*","from_inclusive":true,"to":"2.9.1.6","to_inclusive":true,"patched_in":"2.9.1.7"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T14:22:17Z"},{"id":"wordfence:c0b3662d-e369-4978-aa7a-debbb3ee37e4","source":"wordfence","cve":"CVE-2024-25093","title":"GD Rating System <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting via IP","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0b3662d-e369-4978-aa7a-debbb3ee37e4?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2024-01-08T00:00:00Z","updated":"2024-03-22T17:25:12Z"},{"id":"wordfence:c0b3911c-a960-4f28-b289-389b26282741","source":"wordfence","cve":"CVE-2023-5469","title":"Drop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0b3911c-a960-4f28-b289-389b26282741?source=api-prod","affected":[{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"1.7.14"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0b50597-18c1-4cbc-aebb-348f4d786ad9","source":"wordfence","cve":"CVE-2024-10589","title":"Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0b50597-18c1-4cbc-aebb-348f4d786ad9?source=api-prod","affected":[{"type":"plugin","slug":"leopard-wordpress-offload-media","name":"Leopard - WordPress Offload Media","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T07:35:06Z"},{"id":"wordfence:c0b86c45-c346-4df7-844e-01de027bbc1e","source":"wordfence","cve":"CVE-2024-1054","title":"Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0b86c45-c346-4df7-844e-01de027bbc1e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:43Z"},{"id":"wordfence:c0ba19a2-0a30-4346-88a2-d1166ab13388","source":"wordfence","cve":"CVE-2022-1113","title":"Flower Delivery by Florist One <= 3.5.8 - (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ba19a2-0a30-4346-88a2-d1166ab13388?source=api-prod","affected":[{"type":"plugin","slug":"flower-delivery-by-florist-one","name":"Flower Delivery by Florist One","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2022-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0ba6392-e6f7-479a-8b9b-9cea4b140c71","source":"wordfence","cve":"CVE-2026-18056","title":"HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ba6392-e6f7-479a-8b9b-9cea4b140c71?source=api-prod","affected":[{"type":"plugin","slug":"hivepress-authentication","name":"HivePress Authentication","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-05T14:06:18Z","updated":"2026-09-06T02:26:52Z"},{"id":"wordfence:c0bac46d-dbee-416b-9515-89d542352c36","source":"wordfence","cve":"CVE-2026-42720","title":"Dynamic User Directory <= 2.4 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0bac46d-dbee-416b-9515-89d542352c36?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-user-directory","name":"Dynamic User Directory","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T09:57:00Z","updated":"2026-10-08T23:36:37Z"},{"id":"wordfence:c0bba475-b498-4c2d-a3f2-f4766a2b8616","source":"wordfence","cve":"CVE-2013-2173","title":"WordPress Core <= 3.5.1 - Denial of Service via wp-postpass cookie","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0bba475-b498-4c2d-a3f2-f4766a2b8616?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":false,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0bdc5d7-b8ca-4765-91bd-dd3fa475c6d9","source":"wordfence","cve":"CVE-2025-58605","title":"WP Delicious <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0bdc5d7-b8ca-4765-91bd-dd3fa475c6d9?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:36:32Z"},{"id":"wordfence:c0c13b83-6885-46db-bf33-0b2b63ff06db","source":"wordfence","cve":"CVE-2023-24405","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 1.9.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c13b83-6885-46db-bf33-0b2b63ff06db?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0c293db-5526-4600-838a-6e88586926c4","source":"wordfence","cve":"CVE-2024-37266","title":"Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c293db-5526-4600-838a-6e88586926c4?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:09:02Z"},{"id":"wordfence:c0c3d504-8e45-42e8-a6e1-27848c347dae","source":"wordfence","cve":"CVE-2026-28084","title":"Bazinga <= 1.1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c3d504-8e45-42e8-a6e1-27848c347dae?source=api-prod","affected":[{"type":"theme","slug":"bazinga","name":"Bazinga | Viral Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:50:17Z"},{"id":"wordfence:c0c4028d-24b5-4293-8969-66e199556d73","source":"wordfence","cve":"CVE-2025-68496","title":"User Feedback <= 1.10.0 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c4028d-24b5-4293-8969-66e199556d73?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.10.1"}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-05T19:00:21Z"},{"id":"wordfence:c0c44335-5d05-48cb-a3a2-574d65f02866","source":"wordfence","cve":"CVE-2024-37425","title":"Newspack Blocks <= 3.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c44335-5d05-48cb-a3a2-574d65f02866?source=api-prod","affected":[{"type":"plugin","slug":"newspack-blocks","name":"Newspack Blocks","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:29:29Z"},{"id":"wordfence:c0c57743-9fdd-4fc0-9a27-787834b64846","source":"wordfence","cve":"CVE-2023-2624","title":"KiviCare <= 3.2.0 - Reflected Cross-Site Scripting via 'filterType'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c57743-9fdd-4fc0-9a27-787834b64846?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0c60ee5-65e4-45a7-a4b5-53de7dd6a65b","source":"wordfence","cve":"CVE-2025-67969","title":"UPI QR Code Payment Gateway for WooCommerce <= 1.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c60ee5-65e4-45a7-a4b5-53de7dd6a65b?source=api-prod","affected":[{"type":"plugin","slug":"upi-qr-code-payment-for-woocommerce","name":"UPI QR Code Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-28T13:47:34Z"},{"id":"wordfence:c0c63447-c101-441f-95b9-137b181be8fa","source":"wordfence","cve":"CVE-2026-108175","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c63447-c101-441f-95b9-137b181be8fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-10-15T17:48:00Z","updated":"2026-10-23T18:23:43Z"},{"id":"wordfence:c0c74d48-6cfc-4899-bd2c-4a80b1f6e05f","source":"wordfence","cve":"CVE-2026-5617","title":"Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c74d48-6cfc-4899-bd2c-4a80b1f6e05f?source=api-prod","affected":[{"type":"plugin","slug":"one-click-login-as-user","name":"Login as User \u2013 Switch User & WooCommerce Login as Customer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:44:50Z","updated":"2026-04-15T07:45:30Z"},{"id":"wordfence:c0c78156-627c-422f-acc4-e5a707ee3946","source":"wordfence","cve":"CVE-2025-31749","title":"HMH Footer Builder For Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c78156-627c-422f-acc4-e5a707ee3946?source=api-prod","affected":[{"type":"plugin","slug":"hmh-footer-builder-for-elementor","name":"HMH Footer Builder For Elementor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:30:12Z"},{"id":"wordfence:c0c8d882-32e7-4aa5-8428-f3ce7924ab54","source":"wordfence","cve":"CVE-2025-48310","title":"Table Editor <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c8d882-32e7-4aa5-8428-f3ce7924ab54?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-editor","name":"Table Editor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:01:09Z"},{"id":"wordfence:c0ca284d-1d03-46d6-94a4-7cc72e4bbf87","source":"wordfence","cve":"CVE-2024-3231","title":"Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ca284d-1d03-46d6-94a4-7cc72e4bbf87?source=api-prod","affected":[{"type":"plugin","slug":"popup4phone","name":"Popup4Phone","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-20T21:09:09Z"},{"id":"wordfence:c0ce3a76-5e16-4772-a802-9e5ce1345f95","source":"wordfence","cve":"CVE-2016-10982","title":"Kento Post View Counter <= 2.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ce3a76-5e16-4772-a802-9e5ce1345f95?source=api-prod","affected":[{"type":"plugin","slug":"kento-post-view-counter","name":"Kento Post View Counter","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2016-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0ceea54-924a-41c1-a157-8eba24b5f666","source":"wordfence","cve":"CVE-2026-111314","title":"affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ceea54-924a-41c1-a157-8eba24b5f666?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2026-10-27T14:15:21Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:c0d06c02-fad7-4d2f-a230-03723ba828b3","source":"wordfence","cve":"CVE-2024-6897","title":"aThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d06c02-fad7-4d2f-a230-03723ba828b3?source=api-prod","affected":[{"type":"plugin","slug":"athemes-starter-sites","name":"aThemes Starter Sites","from":"*","from_inclusive":true,"to":"1.0.53","to_inclusive":true,"patched_in":"1.0.54"}],"published":"2024-07-26T21:43:39Z","updated":"2024-07-27T11:13:39Z"},{"id":"wordfence:c0d0c31e-1641-48e6-bd3e-47d8afb1b3b8","source":"wordfence","cve":"CVE-2024-13436","title":"Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d0c31e-1641-48e6-bd3e-47d8afb1b3b8?source=api-prod","affected":[{"type":"plugin","slug":"appsero-helper","name":"Appsero Helper","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-03-10T00:00:00Z","updated":"2025-03-11T03:22:20Z"},{"id":"wordfence:c0d0c903-da4b-4be3-ac2c-35a57615ef0b","source":"wordfence","cve":"CVE-2024-52348","title":"AA Audio Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d0c903-da4b-4be3-ac2c-35a57615ef0b?source=api-prod","affected":[{"type":"plugin","slug":"aa-audio-player","name":"AA Audio Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:25:21Z"},{"id":"wordfence:c0d1145d-f888-4217-963c-c058a6a56f74","source":"wordfence","cve":"CVE-2026-59524","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.6.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d1145d-f888-4217-963c-c058a6a56f74?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:03:15Z"},{"id":"wordfence:c0d5f034-fd8b-456a-b44a-7d82db3a16a0","source":"wordfence","cve":"CVE-2024-1445","title":"Page scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d5f034-fd8b-456a-b44a-7d82db3a16a0?source=api-prod","affected":[{"type":"plugin","slug":"page-scroll-to-id","name":"Page scroll to id","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-02-16T00:00:00Z","updated":"2024-02-20T18:56:43Z"},{"id":"wordfence:c0d68506-ee5c-4b01-a0d2-caf2482106e0","source":"wordfence","cve":"CVE-2015-9343","title":"Rollback < 1.2.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d68506-ee5c-4b01-a0d2-caf2482106e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-rollback","name":"WP Rollback \u2013 Rollback Plugins and Themes","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2015-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0d79ae1-e9e4-4798-aa29-519b80759be6","source":"wordfence","cve":"","title":"Social Media Share Buttons & Social Sharing Icons < 1.1.1.12 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d79ae1-e9e4-4798-aa29-519b80759be6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"1.1.1.11","to_inclusive":true,"patched_in":"1.1.1.12"}],"published":"2015-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0d8ac01-ac73-47ea-839b-edc820436f27","source":"wordfence","cve":"CVE-2024-2844","title":"Easy Appointments <= 3.11.18 - Insufficient Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d8ac01-ac73-47ea-839b-edc820436f27?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.11.18","to_inclusive":true,"patched_in":"3.11.19"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T05:35:36Z"},{"id":"wordfence:c0da4d55-5025-47cf-9f45-377d8943fc94","source":"wordfence","cve":"CVE-2024-5654","title":"CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0da4d55-5025-47cf-9f45-377d8943fc94?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-sheets-connector","name":"GSheetConnector \u2013 CF7 Google Sheets Connector & Save CF7 Entries to Database","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T08:39:39Z"},{"id":"wordfence:c0daeb94-1028-4163-af9d-0a6d7a00269f","source":"wordfence","cve":"CVE-2021-25060","title":"Five Star Business Profile and Schema <= 2.1.6 - Subscriber+ Page Creation & Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0daeb94-1028-4163-af9d-0a6d7a00269f?source=api-prod","affected":[{"type":"plugin","slug":"business-profile","name":"Five Star Business Profile and Schema","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0dc5349-139a-4bf3-8503-0e75b132c68c","source":"wordfence","cve":"CVE-2026-6702","title":"Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dc5349-139a-4bf3-8503-0e75b132c68c?source=api-prod","affected":[{"type":"plugin","slug":"publish-2-pingfm","name":"Publish 2 Ping.fm","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:07:17Z","updated":"2026-05-05T02:26:57Z"},{"id":"wordfence:c0dd70b9-6f8a-41fc-ab4f-f6cdfee8dfb8","source":"wordfence","cve":"CVE-2023-5362","title":"Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dd70b9-6f8a-41fc-ab4f-f6cdfee8dfb8?source=api-prod","affected":[{"type":"plugin","slug":"spice-post-slider","name":"Carousel, Recent Post Slider and Banner Slider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0dfa035-78fe-426f-a018-7bb2f22f0dd7","source":"wordfence","cve":"CVE-2021-24533","title":"Maintenance <= 4.02 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0dfa035-78fe-426f-a018-7bb2f22f0dd7?source=api-prod","affected":[{"type":"plugin","slug":"maintenance","name":"Maintenance","from":"*","from_inclusive":true,"to":"4.03","to_inclusive":false,"patched_in":"4.03"}],"published":"2021-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0e2ff94-e95a-485f-a736-0cd2b45e4069","source":"wordfence","cve":"CVE-2025-53278","title":"WP AdCenter <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e2ff94-e95a-485f-a736-0cd2b45e4069?source=api-prod","affected":[{"type":"plugin","slug":"wpadcenter","name":"WP AdCenter \u2013 Ad Manager & Adsense Ads","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:43:22Z"},{"id":"wordfence:c0e53aa4-9acf-4501-9b5e-b7694851fc63","source":"wordfence","cve":"CVE-2022-29445","title":"Popup Box <= 2.1.2 - Authenticated Local File Inclusion","severity":"medium","cvss":6.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e53aa4-9acf-4501-9b5e-b7694851fc63?source=api-prod","affected":[{"type":"plugin","slug":"popup-box","name":"Popup Box \u2013 Easily Create WordPress Popups","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2"}],"published":"2022-05-17T11:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0e53afe-c039-4d2a-b5f1-c032b3d408a6","source":"wordfence","cve":"CVE-2026-110900","title":"Bookit \u2014 Booking & Appointment Calendar <= 2.6.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e53afe-c039-4d2a-b5f1-c032b3d408a6?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.5","to_inclusive":true,"patched_in":"2.6.0.6"}],"published":"2026-10-16T12:50:00Z","updated":"2026-10-23T18:39:55Z"},{"id":"wordfence:c0e58807-bccc-469f-82c3-a4bbf088a626","source":"wordfence","cve":"","title":"Yoast SEO <= 20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e58807-bccc-469f-82c3-a4bbf088a626?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"20.2","to_inclusive":true,"patched_in":"20.2.1"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0e6f20a-3a5c-4782-9852-9891b93d765f","source":"wordfence","cve":"","title":"Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e6f20a-3a5c-4782-9852-9891b93d765f?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.05.03","to_inclusive":false,"patched_in":"2.05.03"}],"published":"2017-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0e7bcae-fcb9-4802-b5f5-9c07a2038baa","source":"wordfence","cve":"CVE-2025-10168","title":"Any News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e7bcae-fcb9-4802-b5f5-9c07a2038baa?source=api-prod","affected":[{"type":"plugin","slug":"any-news-ticker","name":"Any News Ticker","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:27:29Z","updated":"2025-09-30T03:35:31Z"},{"id":"wordfence:c0e9726f-45cc-4759-909d-3de2ae9b2334","source":"wordfence","cve":"CVE-2025-31387","title":"InstaWP Connect <= 0.1.0.82 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0e9726f-45cc-4759-909d-3de2ae9b2334?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.82","to_inclusive":true,"patched_in":"0.1.0.83"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-10T12:44:11Z"},{"id":"wordfence:c0eae97c-d7e5-4dde-a323-d90a20826341","source":"wordfence","cve":"CVE-2018-20967","title":"Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0eae97c-d7e5-4dde-a323-d90a20826341?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2019-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0ed0cfc-9360-42e3-bd96-1d439ee2a8d4","source":"wordfence","cve":"CVE-2025-69309","title":"Saasplate Core <= 1.2.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed0cfc-9360-42e3-bd96-1d439ee2a8d4?source=api-prod","affected":[{"type":"plugin","slug":"saasplate-core","name":"Saasplate Core","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:09:33Z"},{"id":"wordfence:c0ed27b8-dbdc-4927-8019-52a622bfbff6","source":"wordfence","cve":"CVE-2026-9613","title":"Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed27b8-dbdc-4927-8019-52a622bfbff6?source=api-prod","affected":[{"type":"plugin","slug":"datalogics","name":"Datalogics Ecommerce Delivery \u2013 Datalogics","from":"*","from_inclusive":true,"to":"2.6.65","to_inclusive":true,"patched_in":"2.6.66"}],"published":"2026-09-18T19:54:22Z","updated":"2026-09-19T08:27:24Z"},{"id":"wordfence:c0ed65f8-a2af-476e-a3f5-51f7b01724f2","source":"wordfence","cve":"CVE-2025-68522","title":"WpStream <= 4.9.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed65f8-a2af-476e-a3f5-51f7b01724f2?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-06T14:00:30Z"},{"id":"wordfence:c0eef272-4e17-4bc9-aa9f-90da55795aea","source":"wordfence","cve":"CVE-2026-57638","title":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0eef272-4e17-4bc9-aa9f-90da55795aea?source=api-prod","affected":[{"type":"plugin","slug":"fluent-booking","name":"Fluent Booking \u2013 The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:54:25Z"},{"id":"wordfence:c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f","source":"wordfence","cve":"CVE-2025-1326","title":"Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-02T03:21:20Z"},{"id":"wordfence:c0f1d229-a4c1-478c-a736-c3f0ea699e63","source":"wordfence","cve":"CVE-2024-51690","title":"Wp Slide Categorywise <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0f1d229-a4c1-478c-a736-c3f0ea699e63?source=api-prod","affected":[{"type":"plugin","slug":"wp-slide-categorywise","name":"Wp Slide Categorywise","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:21:29Z"},{"id":"wordfence:c0f671be-758e-4b10-ae1f-b18822ab633f","source":"wordfence","cve":"CVE-2025-23700","title":"yCyclista <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0f671be-758e-4b10-ae1f-b18822ab633f?source=api-prod","affected":[{"type":"plugin","slug":"ycyclista","name":"yCyclista","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:09:27Z"},{"id":"wordfence:c0f899c6-cce2-4534-9b97-3783648cba09","source":"wordfence","cve":"CVE-2022-4626","title":"PPWP \u2013 WordPress Password Protect Page <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0f899c6-cce2-4534-9b97-3783648cba09?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c0faf1ac-fb26-4991-a8f6-f08e71fcd657","source":"wordfence","cve":"CVE-2026-97305","title":"Hyve Lite \u2013 AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0faf1ac-fb26-4991-a8f6-f08e71fcd657?source=api-prod","affected":[{"type":"plugin","slug":"hyve-lite","name":"Hyve Lite \u2013 AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-10-03T17:41:05Z","updated":"2026-10-09T00:17:47Z"},{"id":"wordfence:c0fff84c-afe9-446e-96f8-17c4d383978e","source":"wordfence","cve":"CVE-2026-57801","title":"SetSail - Travel Agency WordPress Theme <= 2.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c0fff84c-afe9-446e-96f8-17c4d383978e?source=api-prod","affected":[{"type":"theme","slug":"setsail","name":"SetSail - Travel Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:35:04Z"},{"id":"wordfence:c1001b2b-395a-44ee-827e-6e57f7a50218","source":"wordfence","cve":"CVE-2025-9321","title":"WPCasa <= 1.4.1 - Unauthenticated Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218?source=api-prod","affected":[{"type":"plugin","slug":"wpcasa","name":"WPCasa \u2013 Real Estate for WordPress","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-23T04:26:14Z"},{"id":"wordfence:c1005616-f3b5-45fa-97f8-784429a4a168","source":"wordfence","cve":"CVE-2024-5627","title":"WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1005616-f3b5-45fa-97f8-784429a4a168?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:02:05Z"},{"id":"wordfence:c1010470-63d4-49c5-9811-0e86fbeb57d5","source":"wordfence","cve":"CVE-2025-9991","title":"Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=api-prod","affected":[{"type":"plugin","slug":"tiny-bootstrap-elements-light","name":"Tiny Bootstrap Elements Light","from":"*","from_inclusive":true,"to":"4.3.34","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:27:14Z","updated":"2025-09-30T03:35:31Z"},{"id":"wordfence:c101b579-de72-4f33-8fd2-7fcd7c25044c","source":"wordfence","cve":"CVE-2022-2423","title":"DW Promobar <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c101b579-de72-4f33-8fd2-7fcd7c25044c?source=api-prod","affected":[{"type":"plugin","slug":"dw-promobar","name":"DW Promobar","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c101b69d-02c2-4075-8de7-0988ba3c74cc","source":"wordfence","cve":"CVE-2023-0231","title":"WooLentor <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c101b69d-02c2-4075-8de7-0988ba3c74cc?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2023-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1022ac4-869e-415a-a7c8-3650421608ea","source":"wordfence","cve":"CVE-2023-3996","title":"ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1022ac4-869e-415a-a7c8-3650421608ea?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.16","to_inclusive":true,"patched_in":"4.0.17"}],"published":"2023-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c10286fe-2fdf-4946-b7bb-a2b16f93abb0","source":"wordfence","cve":"CVE-2025-11167","title":"CM Registration \u2013 Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10286fe-2fdf-4946-b7bb-a2b16f93abb0?source=api-prod","affected":[{"type":"plugin","slug":"cm-invitation-codes","name":"CM Registration \u2013 Tailored tool for seamless login and invitation-based registrations","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T08:29:17Z"},{"id":"wordfence:c1033b4d-82a0-4484-aebf-f35d6a2a9a13","source":"wordfence","cve":"CVE-2023-3371","title":"EmbedPress <= 3.7.3 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1033b4d-82a0-4484-aebf-f35d6a2a9a13?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c10600ae-1ff0-4f12-ae53-39d9342640f4","source":"wordfence","cve":"CVE-2025-12449","title":"aBlocks \u2013 WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10600ae-1ff0-4f12-ae53-39d9342640f4?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-01-06T19:05:15Z","updated":"2026-09-15T15:05:17Z"},{"id":"wordfence:c107674d-173f-49cf-b329-e7bffaee841d","source":"wordfence","cve":"CVE-2026-3129","title":"LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c107674d-173f-49cf-b329-e7bffaee841d?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2026-08-27T15:15:48Z","updated":"2026-08-28T23:18:47Z"},{"id":"wordfence:c1089958-a481-47b1-9dc6-799a1a7930c8","source":"wordfence","cve":"CVE-2024-5884","title":"Beauty <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1089958-a481-47b1-9dc6-799a1a7930c8?source=api-prod","affected":[{"type":"theme","slug":"beauty","name":"Beauty","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:28:57Z","updated":"2024-09-13T15:10:41Z"},{"id":"wordfence:c10917f9-f0e0-40af-84e3-38f588051186","source":"wordfence","cve":"CVE-2025-31470","title":"Page Takeover <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10917f9-f0e0-40af-84e3-38f588051186?source=api-prod","affected":[{"type":"plugin","slug":"page-takeover","name":"Page Takeover","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-03-28T00:00:00Z","updated":"2025-05-23T13:29:57Z"},{"id":"wordfence:c10993bd-b4f3-44b6-bb0f-cb783dbcf314","source":"wordfence","cve":"CVE-2024-10232","title":"AtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10993bd-b4f3-44b6-bb0f-cb783dbcf314?source=api-prod","affected":[{"type":"plugin","slug":"atomchat","name":"Group Chat & Video Chat by AtomChat","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-10-31T20:30:52Z","updated":"2024-11-01T09:29:24Z"},{"id":"wordfence:c10a5583-5273-4b94-8e2e-e3d24ea941b0","source":"wordfence","cve":"CVE-2025-57889","title":"InPost Gallery <= 2.1.4.5 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10a5583-5273-4b94-8e2e-e3d24ea941b0?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.4.5","to_inclusive":true,"patched_in":"2.1.4.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:23:03Z"},{"id":"wordfence:c10abc34-28e8-4e1d-8da7-e3cde5527e83","source":"wordfence","cve":"CVE-2026-121773","title":"GenerateBlocks <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10abc34-28e8-4e1d-8da7-e3cde5527e83?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:00:19Z"},{"id":"wordfence:c10c2256-4ffd-489a-afae-b455bf45c3ca","source":"wordfence","cve":"CVE-2014-9310","title":"WordPress Backup to Dropbox < 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10c2256-4ffd-489a-afae-b455bf45c3ca?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-backup-to-dropbox","name":"wordpress-backup-to-dropbox","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":false,"patched_in":"4.1"}],"published":"2014-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c10c447a-6743-4b84-933d-2ea1d76c7e01","source":"wordfence","cve":"CVE-2025-25076","title":"Graceful Email Obfuscation <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c10c447a-6743-4b84-933d-2ea1d76c7e01?source=api-prod","affected":[{"type":"plugin","slug":"graceful-email-obfuscation","name":"Graceful Email Obfuscation","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:19:51Z"},{"id":"wordfence:c11456bb-dde3-4ab8-b00b-a6cdcc68a760","source":"wordfence","cve":"CVE-2024-13774","title":"Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c11456bb-dde3-4ab8-b00b-a6cdcc68a760?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce","name":"Wishlist for WooCommerce: Multiple Wishlists per Customer","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2025-03-07T14:14:32Z","updated":"2025-03-10T14:25:20Z"},{"id":"wordfence:c115da4f-02f1-40b6-ba47-337b279de3e0","source":"wordfence","cve":"CVE-2021-24828","title":"Mortgage Calculator / Loan Calculator < 1.5.17 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c115da4f-02f1-40b6-ba47-337b279de3e0?source=api-prod","affected":[{"type":"plugin","slug":"mortgage-loan-calculator","name":"Mortgage Calculator","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":false,"patched_in":"1.5.17"}],"published":"2021-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1184b8d-259f-4713-a61d-9ca9985d55ab","source":"wordfence","cve":"CVE-2025-48292","title":"Tourmaster <= 5.3.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1184b8d-259f-4713-a61d-9ca9985d55ab?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:20:50Z"},{"id":"wordfence:c1197d19-e49f-4d44-8efe-ef8d7e91bce0","source":"wordfence","cve":"CVE-2022-1112","title":"Autolinks <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1197d19-e49f-4d44-8efe-ef8d7e91bce0?source=api-prod","affected":[{"type":"plugin","slug":"autolinks","name":"Autolinks","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c11a561a-c798-46e7-bf2d-12933978aa29","source":"wordfence","cve":"CVE-2024-8874","title":"AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c11a561a-c798-46e7-bf2d-12933978aa29?source=api-prod","affected":[{"type":"plugin","slug":"ajax-login-and-registration-modal-popup","name":"AJAX Login and Registration modal popup + inline form","from":"*","from_inclusive":true,"to":"2.24","to_inclusive":true,"patched_in":"2.25"}],"published":"2024-11-12T13:26:21Z","updated":"2024-12-20T20:40:49Z"},{"id":"wordfence:c11a5f07-de89-47ec-a92e-2adc75965648","source":"wordfence","cve":"CVE-2025-13900","title":"WP Popup Magic <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c11a5f07-de89-47ec-a92e-2adc75965648?source=api-prod","affected":[{"type":"plugin","slug":"wppopupmagic","name":"WP Popup Magic","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:19:37Z","updated":"2026-01-09T09:19:47Z"},{"id":"wordfence:c11ab6ef-90c4-4091-8025-b182cf40f61c","source":"wordfence","cve":"CVE-2025-58016","title":"CF7 Submissions <= 0.26 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c11ab6ef-90c4-4091-8025-b182cf40f61c?source=api-prod","affected":[{"type":"plugin","slug":"cf7-submissions","name":"CF7 Submissions \u2013 Securely Store Contact Form 7 Data and Attachments, Reply to the Sender and more","from":"*","from_inclusive":true,"to":"0.26","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:29:29Z"},{"id":"wordfence:c11be4ba-1bed-4234-b475-468394b7be90","source":"wordfence","cve":"CVE-2023-23676","title":"File Gallery <= 1.8.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_gallery_shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c11be4ba-1bed-4234-b475-468394b7be90?source=api-prod","affected":[{"type":"plugin","slug":"file-gallery","name":"File Gallery","from":"*","from_inclusive":true,"to":"1.8.5.3","to_inclusive":true,"patched_in":"1.8.5.4"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1204614-395a-4226-9d45-c334eaba090d","source":"wordfence","cve":"CVE-2026-49107","title":"Thrive Apprentice < 10.8.10.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1204614-395a-4226-9d45-c334eaba090d?source=api-prod","affected":[{"type":"plugin","slug":"thrive-apprentice","name":"Thrive Apprentice","from":"*","from_inclusive":true,"to":"10.8.10.2","to_inclusive":false,"patched_in":"10.8.10.2"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:36:41Z"},{"id":"wordfence:c120871a-8f56-42ea-b5ab-44d0f8233e66","source":"wordfence","cve":"CVE-2025-60062","title":"tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c120871a-8f56-42ea-b5ab-44d0f8233e66?source=api-prod","affected":[{"type":"plugin","slug":"tplayer-html5-audio-player-with-playlist","name":"tplayer-html5-audio-player-with-playlist","from":"*","from_inclusive":true,"to":"1.2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-12-19T16:41:24Z"},{"id":"wordfence:c12094bd-aa23-4f9b-92e1-d1d4284fb2a0","source":"wordfence","cve":"CVE-2023-1807","title":"Elementor Addons, Widgets and Enhancements \u2013 Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12094bd-aa23-4f9b-92e1-d1d4284fb2a0?source=api-prod","affected":[{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1233f6c-102e-42a7-9c73-9dec712743d6","source":"wordfence","cve":"CVE-2026-77001","title":"Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Authentication Bypass to Administrator","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1233f6c-102e-42a7-9c73-9dec712743d6?source=api-prod","affected":[{"type":"plugin","slug":"social-login-sharing-buttons-with-analytics-by-soclever","name":"Social Login & Sharing buttons with Analytics By SoClever","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-02T15:19:43Z"},{"id":"wordfence:c12538bc-6e7d-4d47-8e5b-65574ed26ec4","source":"wordfence","cve":"","title":"Easy Coming Soon < 1.8.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12538bc-6e7d-4d47-8e5b-65574ed26ec4?source=api-prod","affected":[{"type":"plugin","slug":"easy-coming-soon","name":"Easy Coming Soon","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c127c6e3-a6ac-433e-8278-5fcc675c5dc1","source":"wordfence","cve":"CVE-2025-32617","title":"Multiple Location Google Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c127c6e3-a6ac-433e-8278-5fcc675c5dc1?source=api-prod","affected":[{"type":"plugin","slug":"multiple-location-google-map","name":"Multiple Location Google Map","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:44:19Z"},{"id":"wordfence:c12802d5-cbd8-4df6-9bc0-89bd9309c9a8","source":"wordfence","cve":"CVE-2025-15701","title":"Easy Social Icons <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12802d5-cbd8-4df6-9bc0-89bd9309c9a8?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-11T12:30:27Z"},{"id":"wordfence:c1280ceb-9ce8-47fc-8fd3-6af80015dea9","source":"wordfence","cve":"CVE-2024-8853","title":"Webo-facto <= 1.40 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1280ceb-9ce8-47fc-8fd3-6af80015dea9?source=api-prod","affected":[{"type":"plugin","slug":"webo-facto-connector","name":"Webo-facto","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":"1.41"}],"published":"2024-09-17T00:00:00Z","updated":"2024-09-20T07:33:36Z"},{"id":"wordfence:c12b74ed-69e7-4d78-8d23-814054476441","source":"wordfence","cve":"CVE-2026-111739","title":"Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) <= 5.4.0 - Authenticated (Subscriber+) Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12b74ed-69e7-4d78-8d23-814054476441?source=api-prod","affected":[{"type":"plugin","slug":"tokenizer-two-factor-authentication","name":"Two Factor Authentication","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"},{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:23:35Z"},{"id":"wordfence:c12ba39f-03bc-4a45-b2f4-368f48c0a57b","source":"wordfence","cve":"CVE-2023-45046","title":"Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12ba39f-03bc-4a45-b2f4-368f48c0a57b?source=api-prod","affected":[{"type":"plugin","slug":"pressference-exporter","name":"Pressference Exporter","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c12c046a-2ee4-4daa-9b2e-807d31041188","source":"wordfence","cve":"CVE-2026-57383","title":"JobSearch WP Job Board <= 3.2.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12c046a-2ee4-4daa-9b2e-807d31041188?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:48:30Z"},{"id":"wordfence:c12c7f08-5132-4209-ae4e-fb67bf885e57","source":"wordfence","cve":"CVE-2024-8860","title":"Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12c7f08-5132-4209-ae4e-fb67bf885e57?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.14.5","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2024-09-13T00:00:00Z","updated":"2025-08-26T07:06:03Z"},{"id":"wordfence:c12cca1e-2d6a-4946-bff7-bb71e570e9d5","source":"wordfence","cve":"CVE-2026-19717","title":"CatFolders Document Gallery & PDF Library < 2.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12cca1e-2d6a-4946-bff7-bb71e570e9d5?source=api-prod","affected":[{"type":"plugin","slug":"catfolders-document-gallery","name":"CatFolders Document Gallery & PDF Library","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:05:15Z"},{"id":"wordfence:c12da0cd-ee45-4c25-9023-390f4650a0df","source":"wordfence","cve":"CVE-2026-87791","title":"Design Scuole Italia <= 2.18.1 - Unauthenticated Arbitrary File Donwload","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12da0cd-ee45-4c25-9023-390f4650a0df?source=api-prod","affected":[{"type":"plugin","slug":"design-scuole-wordpress-theme","name":"design-scuole-wordpress-theme","from":"2.6.0","from_inclusive":true,"to":"2.18.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-16T17:56:20Z"},{"id":"wordfence:c12e6063-2db7-4f8b-a7c3-3e40bc9ff2a4","source":"wordfence","cve":"CVE-2015-4140","title":"WP Smiley <= 1.4.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12e6063-2db7-4f8b-a7c3-3e40bc9ff2a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-smiley","name":"wp-smiley","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2015-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c12f7927-e5c3-4186-ba65-3cd4ac22c976","source":"wordfence","cve":"CVE-2025-62887","title":"King Addons for Elementor <= 51.1.62 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c12f7927-e5c3-4186-ba65-3cd4ac22c976?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.62","to_inclusive":true,"patched_in":"51.1.63"}],"published":"2025-08-18T00:00:00Z","updated":"2026-05-26T18:16:30Z"},{"id":"wordfence:c131c746-3029-4791-b564-f6e530e63ea9","source":"wordfence","cve":"CVE-2015-9386","title":"mTouch Quiz <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c131c746-3029-4791-b564-f6e530e63ea9?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2015-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c132cfc1-03b3-4616-9a66-871e88c857cb","source":"wordfence","cve":"CVE-2024-3947","title":"WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c132cfc1-03b3-4616-9a66-871e88c857cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-05-29T15:53:53Z","updated":"2025-11-06T15:01:55Z"},{"id":"wordfence:c133c31e-e80a-4293-b19d-22e8bc8f677b","source":"wordfence","cve":"","title":"WordPress to Buffer <= 3.8.1 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c133c31e-e80a-4293-b19d-22e8bc8f677b?source=api-prod","affected":[{"type":"plugin","slug":"wp-to-buffer","name":"Social Media Auto Poster \u2013 Schedule & Publish to Buffer","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c13549f8-67b7-47ef-bdf7-fcbe5e966341","source":"wordfence","cve":"CVE-2024-9227","title":"PowerPress Podcasting <= 11.9.17 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c13549f8-67b7-47ef-bdf7-fcbe5e966341?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.9.17","to_inclusive":true,"patched_in":"11.9.18"}],"published":"2025-03-02T00:00:00Z","updated":"2025-05-30T18:47:44Z"},{"id":"wordfence:c13ba1df-25fa-4cc8-9745-2d6f6168788a","source":"wordfence","cve":"CVE-2024-0613","title":"Delete Custom Fields <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c13ba1df-25fa-4cc8-9745-2d6f6168788a?source=api-prod","affected":[{"type":"plugin","slug":"delete-custom-fields","name":"Delete Custom Fields","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-07-29T21:37:20Z"},{"id":"wordfence:c13bb699-f065-4065-9ea5-bb86d24e09ab","source":"wordfence","cve":"CVE-2025-14895","title":"PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c13bb699-f065-4065-9ea5-bb86d24e09ab?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-02-09T20:31:47Z","updated":"2026-02-10T09:26:07Z"},{"id":"wordfence:c13f370b-c9f6-4e58-b6a7-6aa03a0ed5cd","source":"wordfence","cve":"CVE-2025-47649","title":"Open Close WooCommerce Store <= 4.9.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c13f370b-c9f6-4e58-b6a7-6aa03a0ed5cd?source=api-prod","affected":[{"type":"plugin","slug":"woc-open-close","name":"Open Close Store for WooCommerce \u2013 Business Hours & Order Scheduling","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:48:44Z"},{"id":"wordfence:c1403f01-6f09-4577-b906-058437b249f5","source":"wordfence","cve":"CVE-2025-25094","title":"Breaking News Ticker <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1403f01-6f09-4577-b906-058437b249f5?source=api-prod","affected":[{"type":"plugin","slug":"breaking-news-ticker","name":"Breaking News Ticker","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:15:13Z"},{"id":"wordfence:c1405e4f-06d3-409c-b61e-d8b693aa926a","source":"wordfence","cve":"CVE-2026-61991","title":"AjaxLoadMore Cache <= 3.1.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1405e4f-06d3-409c-b61e-d8b693aa926a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more-cache","name":"AjaxLoadMore Cache","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-04T22:01:39Z"},{"id":"wordfence:c141af66-ebf6-4a80-8dfd-47a586342676","source":"wordfence","cve":"CVE-2025-9858","title":"Auto Bulb Finder for WordPress <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c141af66-ebf6-4a80-8dfd-47a586342676?source=api-prod","affected":[{"type":"plugin","slug":"auto-bulb-finder-for-wp-wc","name":"Auto Bulb Finder for WordPress","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2025-10-02T21:29:52Z","updated":"2025-12-11T14:18:02Z"},{"id":"wordfence:c143afd2-020f-40de-9480-bf27f1c50327","source":"wordfence","cve":"CVE-2025-53231","title":"Easy Taxonomy Images <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c143afd2-020f-40de-9480-bf27f1c50327?source=api-prod","affected":[{"type":"plugin","slug":"easy-taxonomy-images","name":"Easy Taxonomy Images","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2026-02-26T19:48:47Z"},{"id":"wordfence:c1441e68-5c41-4c90-ba99-1656af87a29d","source":"wordfence","cve":"CVE-2024-24933","title":"Honeypot for WP Comment <= 2.2.3 - Reflected Cross-Site Scripting via page","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1441e68-5c41-4c90-ba99-1656af87a29d?source=api-prod","affected":[{"type":"plugin","slug":"honeypot-for-wp-comment","name":"Honeypot for WP Comment","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T18:36:50Z"},{"id":"wordfence:c1466b0c-0476-48f7-8817-f2951a8fe78b","source":"wordfence","cve":"CVE-2025-32213","title":"Flo Forms <= 1.0.43 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1466b0c-0476-48f7-8817-f2951a8fe78b?source=api-prod","affected":[{"type":"plugin","slug":"flo-forms","name":"Flo Forms \u2013 Easy Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.0.43","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:37:33Z"},{"id":"wordfence:c146f89c-5df3-4aaf-b880-0ce6016dfb6d","source":"wordfence","cve":"","title":"GS Team Members <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c146f89c-5df3-4aaf-b880-0ce6016dfb6d?source=api-prod","affected":[{"type":"plugin","slug":"gs-team-members","name":"Team Members \u2013 Team Showcase, Team Slider, Grid, Table & Staff Directory","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c14783d3-68de-49c6-9c54-eb7fc4a7bf94","source":"wordfence","cve":"CVE-2024-5664","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c14783d3-68de-49c6-9c54-eb7fc4a7bf94?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.6"}],"published":"2024-07-09T19:09:44Z","updated":"2024-07-10T07:36:45Z"},{"id":"wordfence:c148372b-e0d2-4164-b7e7-91921720adcf","source":"wordfence","cve":"CVE-2016-10904","title":"Olimometer < 2.57 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c148372b-e0d2-4164-b7e7-91921720adcf?source=api-prod","affected":[{"type":"plugin","slug":"olimometer","name":"Olimometer","from":"*","from_inclusive":true,"to":"2.57","to_inclusive":false,"patched_in":"2.57"}],"published":"2016-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c14b1d49-efea-4c09-9448-533223c6d2e8","source":"wordfence","cve":"CVE-2022-27856","title":"Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c14b1d49-efea-4c09-9448-533223c6d2e8?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2022-05-27T12:58:00Z","updated":"2024-08-09T17:50:48Z"},{"id":"wordfence:c14b948f-129d-4223-b3ee-0bef1f9fc703","source":"wordfence","cve":"CVE-2023-29101","title":"Betheme <= 26.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c14b948f-129d-4223-b3ee-0bef1f9fc703?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.7.5","to_inclusive":true,"patched_in":"26.8"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c14e6411-20de-4cfe-96b5-20e71718610e","source":"wordfence","cve":"CVE-2024-47626","title":"RomethemeKit For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c14e6411-20de-4cfe-96b5-20e71718610e?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:01:11Z"},{"id":"wordfence:c14f473f-ca49-4610-b5df-9eb0e064ece5","source":"wordfence","cve":"CVE-2018-5292","title":"GD Rating System <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c14f473f-ca49-4610-b5df-9eb0e064ece5?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1520cce-4ed7-4815-9023-4a994200601a","source":"wordfence","cve":"CVE-2022-2080","title":"Sensei LMS <= 4.5.1 -  Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1520cce-4ed7-4815-9023-4a994200601a?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2022-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1528125-9d26-40a2-9591-4220c18cef37","source":"wordfence","cve":"CVE-2024-35736","title":"Visualizer <= 3.11.1 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1528125-9d26-40a2-9591-4220c18cef37?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T19:07:28Z"},{"id":"wordfence:c1532e12-b786-4b87-ae19-951297c47a6c","source":"wordfence","cve":"CVE-2021-25108","title":"IP2Location Country Blocker <= 2.26.5 - Arbitrary Country Ban via Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1532e12-b786-4b87-ae19-951297c47a6c?source=api-prod","affected":[{"type":"plugin","slug":"ip2location-country-blocker","name":"IP2Location Country Blocker","from":"*","from_inclusive":true,"to":"2.26.5","to_inclusive":true,"patched_in":"2.26.6"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c154cc4b-f0b9-4c3e-8e74-9bfa6de62d2f","source":"wordfence","cve":"","title":"Counter Box \u2013 WordPress plugin for countdown, timer, counter <= 1.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c154cc4b-f0b9-4c3e-8e74-9bfa6de62d2f?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1558b08-a33b-4cf2-bacb-c88065f513cc","source":"wordfence","cve":"CVE-2024-11088","title":"Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1558b08-a33b-4cf2-bacb-c88065f513cc?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T13:55:32Z"},{"id":"wordfence:c1586542-a487-4cbb-b1dc-f3a1970da340","source":"wordfence","cve":"CVE-2026-107426","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1586542-a487-4cbb-b1dc-f3a1970da340?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.5.12","to_inclusive":true,"patched_in":"7.5.13"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:49:29Z"},{"id":"wordfence:c15e111f-7e37-4ff5-bf1e-e472a05990a9","source":"wordfence","cve":"CVE-2025-52822","title":"WP Roadmap <= 2.1.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c15e111f-7e37-4ff5-bf1e-e472a05990a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-roadmap","name":"WP Roadmap \u2013 Product Feedback Board","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-06-19T00:00:00Z","updated":"2026-01-07T14:38:29Z"},{"id":"wordfence:c15eda1f-dc9f-4601-a337-ad3e66baf3b2","source":"wordfence","cve":"CVE-2021-24566","title":"WOOCS \u2013 Currency Switcher for WooCommerce Professional Free <= 1.3.7 - Authenticated Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c15eda1f-dc9f-4601-a337-ad3e66baf3b2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.7.1"}],"published":"2021-07-22T00:00:00Z","updated":"2024-06-17T17:04:22Z"},{"id":"wordfence:c15f171f-e9e0-42dc-9701-e14e6c42af78","source":"wordfence","cve":"CVE-2026-32431","title":"Astra Bulk Edit <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c15f171f-e9e0-42dc-9701-e14e6c42af78?source=api-prod","affected":[{"type":"plugin","slug":"astra-bulk-edit","name":"Astra Bulk Edit","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:03:36Z"},{"id":"wordfence:c1621cd2-78d3-4429-862a-b425f5436f38","source":"wordfence","cve":"CVE-2014-8948","title":"iMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1621cd2-78d3-4429-862a-b425f5436f38?source=api-prod","affected":[{"type":"plugin","slug":"imember360","name":"iMember360is","from":"3.8.012","from_inclusive":true,"to":"3.9.001","to_inclusive":false,"patched_in":"3.9.001"}],"published":"2014-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c16230cb-e53f-4e2a-a555-1dfdda825c45","source":"wordfence","cve":"CVE-2025-58655","title":"Category Featured Images <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16230cb-e53f-4e2a-a555-1dfdda825c45?source=api-prod","affected":[{"type":"plugin","slug":"category-featured-images","name":"Category Featured Images","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:47:20Z"},{"id":"wordfence:c16543db-2f8c-4266-9fb2-fc429f5647b6","source":"wordfence","cve":"CVE-2021-24466","title":"Verse-O-Matic <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16543db-2f8c-4266-9fb2-fc429f5647b6?source=api-prod","affected":[{"type":"plugin","slug":"verse-o-matic","name":"Verse-O-Matic","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1690fe3-f03f-4640-9948-2109d73a841c","source":"wordfence","cve":"","title":"WP Support Plus Responsive Ticket System <= 7.1.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1690fe3-f03f-4640-9948-2109d73a841c?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"7.1.4","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2016-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c16918a9-7b73-418d-adbd-aa17cb1d8cf8","source":"wordfence","cve":"CVE-2026-1084","title":"Cookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16918a9-7b73-418d-adbd-aa17cb1d8cf8?source=api-prod","affected":[{"type":"plugin","slug":"cookie-consent-for-developers","name":"Cookie consent for developers","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:20:26Z","updated":"2026-01-24T07:26:46Z"},{"id":"wordfence:c16a6846-a02e-4192-9149-fbfaa8635dd9","source":"wordfence","cve":"CVE-2026-104744","title":"Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16a6846-a02e-4192-9149-fbfaa8635dd9?source=api-prod","affected":[{"type":"plugin","slug":"independent-analytics-pro","name":"Independent Analytics Pro","from":"*","from_inclusive":true,"to":"2.15.5","to_inclusive":true,"patched_in":"2.16.0"}],"published":"2026-10-30T17:03:26Z","updated":"2026-10-30T17:15:31Z"},{"id":"wordfence:c16b299e-a300-4d02-9ffe-52166d3791f4","source":"wordfence","cve":"CVE-2025-3471","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16b299e-a300-4d02-9ffe-52166d3791f4?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-04-09T00:00:00Z","updated":"2025-06-05T19:38:24Z"},{"id":"wordfence:c16b6063-03b0-42c3-8e45-36ad3fe2760b","source":"wordfence","cve":"CVE-2026-105397","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16b6063-03b0-42c3-8e45-36ad3fe2760b?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.9.1","to_inclusive":true,"patched_in":"4.4.10"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-23T18:17:50Z"},{"id":"wordfence:c16b6a15-9f15-44a6-8663-201f64af81cc","source":"wordfence","cve":"CVE-2011-5224","title":"WordPress Sentinel < 1.0.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16b6a15-9f15-44a6-8663-201f64af81cc?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-sentinel","name":"WordPress Sentinel","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2011-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c16c3a8d-bae1-4729-86c8-ec13481ff187","source":"wordfence","cve":"CVE-2025-14632","title":"Filr \u2013 Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload","severity":"medium","cvss":4.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16c3a8d-bae1-4729-86c8-ec13481ff187?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2026-01-16T14:11:18Z","updated":"2026-01-17T02:22:32Z"},{"id":"wordfence:c16c8f50-4fb6-4fe6-aa35-ad5105dee8d9","source":"wordfence","cve":"CVE-2026-49077","title":"Wp EMember <= v10.2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16c8f50-4fb6-4fe6-aa35-ad5105dee8d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"v10.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:55:40Z"},{"id":"wordfence:c16cd71e-a09e-4d34-99be-b632a3e64253","source":"wordfence","cve":"CVE-2022-45814","title":"WP Calendar <= 1.5.3 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16cd71e-a09e-4d34-99be-b632a3e64253?source=api-prod","affected":[{"type":"plugin","slug":"wp-calendar","name":"WP Calendar","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c16e16dc-8888-4222-862f-a57a9f14e7f4","source":"wordfence","cve":"CVE-2023-6844","title":"iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":5.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16e16dc-8888-4222-862f-a57a9f14e7f4?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-07-29T21:37:20Z"},{"id":"wordfence:c16e1fdc-63b3-4af0-8327-23175191f4ee","source":"wordfence","cve":"CVE-2025-30803","title":"Just Writing Statistics <= 5.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16e1fdc-63b3-4af0-8327-23175191f4ee?source=api-prod","affected":[{"type":"plugin","slug":"just-writing-statistics","name":"Just Writing Statistics","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:23:08Z"},{"id":"wordfence:c16efcb1-ed1f-4370-9013-e5dfb64fc1c2","source":"wordfence","cve":"CVE-2026-78150","title":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16efcb1-ed1f-4370-9013-e5dfb64fc1c2?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"4.0.0","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:21:33Z"},{"id":"wordfence:c16fab08-6b2c-433a-9105-fc15f5c52575","source":"wordfence","cve":"CVE-2015-10143","title":"Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c16fab08-6b2c-433a-9105-fc15f5c52575?source=api-prod","affected":[{"type":"theme","slug":"platform","name":"Platform","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2015-01-21T00:00:00Z","updated":"2025-07-25T02:23:58Z"},{"id":"wordfence:c170a228-4abd-4ee6-ba37-bdcde1cb7fc5","source":"wordfence","cve":"CVE-2025-4800","title":"MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c170a228-4abd-4ee6-ba37-bdcde1cb7fc5?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2025-05-27T16:26:38Z","updated":"2025-05-28T05:24:22Z"},{"id":"wordfence:c170ab8e-e578-49af-80c3-82ff21057262","source":"wordfence","cve":"CVE-2025-58234","title":"JS Job Manager <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c170ab8e-e578-49af-80c3-82ff21057262?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:36:05Z"},{"id":"wordfence:c1710f84-e3c1-4fbc-841e-c7c9ccf3a2e5","source":"wordfence","cve":"CVE-2024-1424","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1710f84-e3c1-4fbc-841e-c7c9ccf3a2e5?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-03-19T00:00:00Z","updated":"2024-05-31T15:30:54Z"},{"id":"wordfence:c172ab2b-ce1f-4a0d-b31f-b75ff2f03506","source":"wordfence","cve":"CVE-2026-4351","title":"Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c172ab2b-ce1f-4a0d-b31f-b75ff2f03506?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-04-09T11:55:00Z","updated":"2026-04-10T01:24:59Z"},{"id":"wordfence:c174887b-e24d-4100-97da-8e0923ebafe5","source":"wordfence","cve":"CVE-2026-10553","title":"jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c174887b-e24d-4100-97da-8e0923ebafe5?source=api-prod","affected":[{"type":"plugin","slug":"jquery-hover-footnotes","name":"jQuery Hover Footnotes","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:07:36Z","updated":"2026-06-09T03:41:23Z"},{"id":"wordfence:c177440a-4575-4202-be16-ac7ab0fbb90b","source":"wordfence","cve":"CVE-2019-15317","title":"GiveWP <= 2.4.6 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c177440a-4575-4202-be16-ac7ab0fbb90b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":false,"patched_in":"2.4.7"}],"published":"2019-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c17967a4-20df-4b23-973f-591a0caeea39","source":"wordfence","cve":"CVE-2023-3501","title":"FormCraft <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c17967a4-20df-4b23-973f-591a0caeea39?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c179cb56-6d18-4e04-8539-3834a286e302","source":"wordfence","cve":"CVE-2024-53766","title":"Devnex Addons For Elementor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c179cb56-6d18-4e04-8539-3834a286e302?source=api-prod","affected":[{"type":"plugin","slug":"devnex-addons-for-elementor","name":"Devnex Addons For Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2025-05-07T14:01:38Z"},{"id":"wordfence:c17b03b4-d503-4bee-a1cd-4d66d27f6f9e","source":"wordfence","cve":"CVE-2025-64250","title":"Directorist <= 8.6.6 - Unauthenticated Open Redirect","severity":"medium","cvss":5.8,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c17b03b4-d503-4bee-a1cd-4d66d27f6f9e?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.6.6","to_inclusive":true,"patched_in":"8.6.7"}],"published":"2025-12-15T00:00:00Z","updated":"2026-04-14T14:36:20Z"},{"id":"wordfence:c17c344b-c891-4086-98c8-cea5673173d7","source":"wordfence","cve":"","title":"More Featured Images <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c17c344b-c891-4086-98c8-cea5673173d7?source=api-prod","affected":[{"type":"plugin","slug":"more-featured-images","name":"More Featured Images","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c17d7fba-7b98-4a7a-a35e-78f16be81aca","source":"wordfence","cve":"CVE-2024-30517","title":"Sliced Invoices <= 3.9.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c17d7fba-7b98-4a7a-a35e-78f16be81aca?source=api-prod","affected":[{"type":"plugin","slug":"sliced-invoices","name":"Sliced Invoices \u2013 WordPress Invoice Plugin","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:29:08Z"},{"id":"wordfence:c17ef8db-98ea-47b0-8d7f-b2b3f01bf6ec","source":"wordfence","cve":"CVE-2024-31426","title":"Inline Related Posts <= 3.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c17ef8db-98ea-47b0-8d7f-b2b3f01bf6ec?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:43:21Z"},{"id":"wordfence:c1804afe-55a1-428f-ae5d-99d68f61d33b","source":"wordfence","cve":"CVE-2012-3575","title":"RBX Gallery < 3.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1804afe-55a1-428f-ae5d-99d68f61d33b?source=api-prod","affected":[{"type":"plugin","slug":"rbxgallery","name":"rbxgallery","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2012-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1818f01-8cb8-430f-adc4-399e45933180","source":"wordfence","cve":"CVE-2026-32552","title":"YITH WooCommerce Membership Premium <= 2.33.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1818f01-8cb8-430f-adc4-399e45933180?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-membership-premium","name":"YITH WooCommerce Membership Premium","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.33.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:38:20Z"},{"id":"wordfence:c182b4f2-c67b-4e82-a790-6d98946ebf2c","source":"wordfence","cve":"CVE-2024-9686","title":"Order Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c182b4f2-c67b-4e82-a790-6d98946ebf2c?source=api-prod","affected":[{"type":"plugin","slug":"order-notification-for-telegram","name":"Order Notification for Telegram","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T04:33:41Z"},{"id":"wordfence:c1836b1e-6c37-4a07-ac29-687d2eebd3ec","source":"wordfence","cve":"CVE-2019-15863","title":"ConvertPlus <= 3.4.4 - Unauthorized Account Creation","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1836b1e-6c37-4a07-ac29-687d2eebd3ec?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2019-06-07T00:00:00Z","updated":"2024-08-15T18:21:58Z"},{"id":"wordfence:c183ba80-67d4-4fa9-bc5a-5ee14edb2305","source":"wordfence","cve":"CVE-2026-85037","title":"Sunshine Photo Cart <= 3.6 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c183ba80-67d4-4fa9-bc5a-5ee14edb2305?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:21:34Z"},{"id":"wordfence:c186d5eb-abc2-47bd-9d3c-2b2f24d2f87e","source":"wordfence","cve":"CVE-2026-7614","title":"Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c186d5eb-abc2-47bd-9d3c-2b2f24d2f87e?source=api-prod","affected":[{"type":"plugin","slug":"old-posts-highlighter","name":"Old Posts Highlighter","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:20:51Z","updated":"2026-05-27T05:31:30Z"},{"id":"wordfence:c1870c6e-23b6-4f3b-adba-72633d62dfd0","source":"wordfence","cve":"CVE-2022-46857","title":"SiteAlert (Formerly WP Health) <= 1.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1870c6e-23b6-4f3b-adba-72633d62dfd0?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-health-check","name":"SiteAlert (Formerly WP Health)","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2023-04-19T00:00:00Z","updated":"2025-02-11T21:01:46Z"},{"id":"wordfence:c1871009-8bf1-47a6-9fef-9ab2798b057c","source":"wordfence","cve":"CVE-2023-0275","title":"Easy Accept Payments for PayPal <= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1871009-8bf1-47a6-9fef-9ab2798b057c?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-easy-paypal-payment-or-donation-accept-plugin","name":"Easy Accept Payments via PayPal","from":"*","from_inclusive":true,"to":"4.9.9","to_inclusive":true,"patched_in":"4.9.10"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c187ed25-6ba7-4a58-97df-5fea723d485a","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c187ed25-6ba7-4a58-97df-5fea723d485a?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c189a778-0338-408c-bcca-a0ac76d8eb44","source":"wordfence","cve":"CVE-2023-23992","title":"AutomatorWP <= 2.5.0 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c189a778-0338-408c-bcca-a0ac76d8eb44?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c189bdcb-3b72-4e25-8444-6852444b89f7","source":"wordfence","cve":"CVE-2024-32082","title":"Sync Post With Other Site <= 1.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c189bdcb-3b72-4e25-8444-6852444b89f7?source=api-prod","affected":[{"type":"plugin","slug":"sync-post-with-other-site","name":"Sync Post With Other Site","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:51:38Z"},{"id":"wordfence:c18ad885-52a8-467b-83f2-aeb0c8be8be0","source":"wordfence","cve":"CVE-2026-1537","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c18ad885-52a8-467b-83f2-aeb0c8be8be0?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-02-11T13:37:48Z","updated":"2026-02-12T02:23:25Z"},{"id":"wordfence:c18d22bd-0a73-4fcf-b89d-b7dd2ef5917b","source":"wordfence","cve":"CVE-2026-39733","title":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content <= 4.17.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c18d22bd-0a73-4fcf-b89d-b7dd2ef5917b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.7","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:26:07Z"},{"id":"wordfence:c190c2d7-961b-4643-a7fe-6d4a22b0d5d7","source":"wordfence","cve":"CVE-2019-11557","title":"WDContactFormBuilder <= 1.0.68 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c190c2d7-961b-4643-a7fe-6d4a22b0d5d7?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-builder","name":"WDContactFormBuilder","from":"*","from_inclusive":true,"to":"1.0.69","to_inclusive":false,"patched_in":"1.0.69"}],"published":"2019-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c191c57b-895c-4ae9-9eed-0125f34d438c","source":"wordfence","cve":"CVE-2024-35664","title":"WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c191c57b-895c-4ae9-9eed-0125f34d438c?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backup-mainwp","name":"WPvivid Backup for MainWP","from":"*","from_inclusive":true,"to":"0.9.32","to_inclusive":true,"patched_in":"0.9.33"}],"published":"2024-06-03T00:00:00Z","updated":"2026-04-15T20:34:32Z"},{"id":"wordfence:c191da68-d531-4c01-a364-2621c822dc80","source":"wordfence","cve":"CVE-2025-32230","title":"Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection","severity":"medium","cvss":4.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c191da68-d531-4c01-a364-2621c822dc80?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-30T15:41:40Z"},{"id":"wordfence:c192425a-1e2d-4f7d-bd88-3a594d70a461","source":"wordfence","cve":"CVE-2022-45843","title":"Smart Slider 3 <= 3.5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c192425a-1e2d-4f7d-bd88-3a594d70a461?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.9","to_inclusive":true,"patched_in":"3.5.1.11"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c195c772-dd88-4e35-bd95-ca2d8bb6ddb5","source":"wordfence","cve":"CVE-2025-23515","title":"ts-tree <= 0.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c195c772-dd88-4e35-bd95-ca2d8bb6ddb5?source=api-prod","affected":[{"type":"plugin","slug":"ts-tree","name":"ts-tree","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-16T00:00:00Z","updated":"2025-03-10T19:03:41Z"},{"id":"wordfence:c195d62d-5f2f-4248-9a84-b551f532256b","source":"wordfence","cve":"CVE-2015-9426","title":"Manual Image Crop <= 1.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c195d62d-5f2f-4248-9a84-b551f532256b?source=api-prod","affected":[{"type":"plugin","slug":"manual-image-crop","name":"Manual Image Crop","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":false,"patched_in":"1.11"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c195ec93-6c40-495a-b0ad-d41959f4a45f","source":"wordfence","cve":"CVE-2026-103350","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.8.0 - Unauthenticated Reduced Booking Price","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c195ec93-6c40-495a-b0ad-d41959f4a45f?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-28T17:14:02Z"},{"id":"wordfence:c198008f-271e-431e-beb9-3a9f93cbbf8e","source":"wordfence","cve":"CVE-2023-28751","title":"Wp Ultimate Review <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c198008f-271e-431e-beb9-3a9f93cbbf8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1993d27-5804-425b-9bcc-2359791d1ae8","source":"wordfence","cve":"CVE-2026-52696","title":"JetBlog <= 2.4.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1993d27-5804-425b-9bcc-2359791d1ae8?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.8.1"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-18T13:36:40Z"},{"id":"wordfence:c19b0da5-db46-4a27-86a6-445dd9a3350d","source":"wordfence","cve":"CVE-2024-52369","title":"KBucket <= 4.2.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c19b0da5-db46-4a27-86a6-445dd9a3350d?source=api-prod","affected":[{"type":"plugin","slug":"kbucket","name":"KBucket: Your Curated Content in WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2024-11-11T00:00:00Z","updated":"2024-12-20T20:11:28Z"},{"id":"wordfence:c19b24ef-cf49-4a5c-a187-0f09ac53c337","source":"wordfence","cve":"CVE-2025-8676","title":"B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c19b24ef-cf49-4a5c-a187-0f09ac53c337?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-08-14T13:59:14Z","updated":"2025-08-15T02:24:25Z"},{"id":"wordfence:c19d9288-39b2-4db1-abc6-ba87f98fecad","source":"wordfence","cve":"CVE-2014-8754","title":"Ad Manager <= 1.1.2 - Open Redirection","severity":"medium","cvss":6.5,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c19d9288-39b2-4db1-abc6-ba87f98fecad?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-admanager","name":"wordpress-admanager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c19dd824-eefb-4bf9-94a8-ce4be637fbac","source":"wordfence","cve":"CVE-2025-49378","title":"Hydra Booking <= 1.1.10 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c19dd824-eefb-4bf9-94a8-ce4be637fbac?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2025-06-12T00:00:00Z","updated":"2025-10-29T19:09:26Z"},{"id":"wordfence:c19fde88-236d-4c27-a97c-e2fef49b7862","source":"wordfence","cve":"CVE-2025-58970","title":"Doctreat <= 1.6.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c19fde88-236d-4c27-a97c-e2fef49b7862?source=api-prod","affected":[{"type":"theme","slug":"doctreat","name":"Doctreat - Hospitals and Doctors Directory WordPress Listing Theme","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-08-02T00:00:00Z","updated":"2025-11-04T17:01:37Z"},{"id":"wordfence:c1a0200f-9861-4eca-adbf-d458eb6b4e63","source":"wordfence","cve":"CVE-2026-6441","title":"Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a0200f-9861-4eca-adbf-d458eb6b4e63?source=api-prod","affected":[{"type":"plugin","slug":"canto","name":"Canto","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-04-16T18:16:51Z","updated":"2026-07-08T20:37:28Z"},{"id":"wordfence:c1a0d446-63b6-4265-a542-345d766faf15","source":"wordfence","cve":"CVE-2021-25029","title":"CLUEVO E-Learning Platform <= 1.8.0 - Authenticated Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a0d446-63b6-4265-a542-345d766faf15?source=api-prod","affected":[{"type":"plugin","slug":"cluevo-lms","name":"CLUEVO LMS, E-Learning Platform","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"}],"published":"2022-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1a0d54f-08f7-4ec5-8cfe-6c4a6eb26748","source":"wordfence","cve":"CVE-2023-1435","title":"Ajax Search Pro <= 4.26.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a0d54f-08f7-4ec5-8cfe-6c4a6eb26748?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-pro","name":"Ajax Search Pro","from":"*","from_inclusive":true,"to":"4.26.1","to_inclusive":true,"patched_in":"4.26.2"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1a4d8a3-5553-4b1c-b0f8-d6a372de3692","source":"wordfence","cve":"CVE-2023-48325","title":"Landing Page Builder <= 1.5.1.5 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a4d8a3-5553-4b1c-b0f8-d6a372de3692?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.1.5","to_inclusive":true,"patched_in":"1.5.1.6"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1a5f593-92b5-41f0-9ad9-1f9e8c4f5e41","source":"wordfence","cve":"CVE-2025-68854","title":"ID Arrays <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a5f593-92b5-41f0-9ad9-1f9e8c4f5e41?source=api-prod","affected":[{"type":"plugin","slug":"id-arrays","name":"ID Arrays","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T16:15:41Z"},{"id":"wordfence:c1a7f09e-2d2a-4d5e-bf4c-cb61a6cc28e1","source":"wordfence","cve":"CVE-2026-104677","title":"Coder 4.0 - 4.5.1 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a7f09e-2d2a-4d5e-bf4c-cb61a6cc28e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"4.0","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:27:45Z"},{"id":"wordfence:c1a8a9dd-21f0-4bec-93ba-53ab8ef6d1ab","source":"wordfence","cve":"CVE-2025-26881","title":"Sticky Content <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a8a9dd-21f0-4bec-93ba-53ab8ef6d1ab?source=api-prod","affected":[{"type":"plugin","slug":"sticky-menu-block","name":"Sticky Content \u2013 Make Any Section Sticky on Scroll","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T18:21:42Z"},{"id":"wordfence:c1a8ecc0-0171-4fa4-a565-db9c3dc6899d","source":"wordfence","cve":"CVE-2026-80342","title":"Payment Plugins for PayPal WooCommerce <= 2.0.26 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a8ecc0-0171-4fa4-a565-db9c3dc6899d?source=api-prod","affected":[{"type":"plugin","slug":"pymntpl-paypal-woocommerce","name":"Payment Plugins for PayPal WooCommerce","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:47:52Z"},{"id":"wordfence:c1a9e2d8-f823-4612-846c-0de72b618b66","source":"wordfence","cve":"CVE-2025-49975","title":"JobWP <= 2.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1a9e2d8-f823-4612-846c-0de72b618b66?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-08T15:22:48Z"},{"id":"wordfence:c1ac9f77-eea7-4726-b2ba-019c26aec242","source":"wordfence","cve":"CVE-2024-1754","title":"NPS computy <= 2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ac9f77-eea7-4726-b2ba-019c26aec242?source=api-prod","affected":[{"type":"plugin","slug":"nps-computy","name":"NPS computy","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:38:42Z"},{"id":"wordfence:c1acc256-c8f5-4738-8788-d52b4e2b80ef","source":"wordfence","cve":"CVE-2021-24288","title":"AcyMailing SMTP Newsletter < 7.5.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1acc256-c8f5-4738-8788-d52b4e2b80ef?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"7.5.0","to_inclusive":false,"patched_in":"7.5.0"}],"published":"2021-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1ad8739-6b35-4448-8c2c-a3c49b83a6b1","source":"wordfence","cve":"CVE-2026-116401","title":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ad8739-6b35-4448-8c2c-a3c49b83a6b1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-10-30T07:26:24Z","updated":"2026-11-03T19:30:32Z"},{"id":"wordfence:c1ae1535-e5fb-4d1d-9349-59f4adaca328","source":"wordfence","cve":"CVE-2024-52358","title":"Responsive Addons for Elementor <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ae1535-e5fb-4d1d-9349-59f4adaca328?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:57:25Z"},{"id":"wordfence:c1b0ac88-8afd-4e46-9721-7aab91090e37","source":"wordfence","cve":"","title":"PublishPress: Editorial Calendar, Workflow, Comments, Notifications and Statuses <= 3.5.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b0ac88-8afd-4e46-9721-7aab91090e37?source=api-prod","affected":[{"type":"plugin","slug":"publishpress","name":"PublishPress Planner \u2013 Editorial Calendar, Marketing Content, Kanban Board","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1b1418e-3ec4-479c-b607-1ea394d630fe","source":"wordfence","cve":"CVE-2026-81342","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b1418e-3ec4-479c-b607-1ea394d630fe?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.43","to_inclusive":false,"patched_in":"3.7.43"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:53:00Z"},{"id":"wordfence:c1b1bdaf-eeec-4f93-86d6-cb94db6c32f8","source":"wordfence","cve":"CVE-2024-35647","title":"Global Notification Bar <= 1.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b1bdaf-eeec-4f93-86d6-cb94db6c32f8?source=api-prod","affected":[{"type":"plugin","slug":"global-notification-bar","name":"Global Notification Bar","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:15:01Z"},{"id":"wordfence:c1b513dc-ead4-46ec-a06e-4e856134a170","source":"wordfence","cve":"CVE-2025-30769","title":"WIP WooCarousel Lite <= 1.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b513dc-ead4-46ec-a06e-4e856134a170?source=api-prod","affected":[{"type":"plugin","slug":"wip-woocarousel-lite","name":"WIP WooCarousel Lite","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-02T15:20:31Z"},{"id":"wordfence:c1b5cb0a-e816-45d7-9c69-aaea56ac64f9","source":"wordfence","cve":"CVE-2026-27401","title":"YITH PayPal Express Checkout for WooCommerce <= 1.62.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b5cb0a-e816-45d7-9c69-aaea56ac64f9?source=api-prod","affected":[{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.62.0","to_inclusive":true,"patched_in":"1.62.1"}],"published":"2026-10-29T11:27:00Z","updated":"2026-11-03T19:53:54Z"},{"id":"wordfence:c1b81a26-c12c-4b57-9ef1-c53e0b87ad9a","source":"wordfence","cve":"CVE-2021-24181","title":"Tutor LMS \u2013 eLearning and online course solution <= 1.7.6 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b81a26-c12c-4b57-9ef1-c53e0b87ad9a?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1b93229-55ef-4216-8d48-35e8b6506c19","source":"wordfence","cve":"CVE-2024-32600","title":"Master Slider <= 3.9.5 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b93229-55ef-4216-8d48-35e8b6506c19?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:37:10Z"},{"id":"wordfence:c1ba314e-0c7a-408a-9565-89989b22de44","source":"wordfence","cve":"CVE-2024-5575","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.42 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ba314e-0c7a-408a-9565-89989b22de44?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.42","to_inclusive":true,"patched_in":"3.1.43"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-11T16:29:43Z"},{"id":"wordfence:c1bb3ab9-afbb-40e7-967a-45f737777dcf","source":"wordfence","cve":"","title":"Ajax Load More < 2.11.2 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1bb3ab9-afbb-40e7-967a-45f737777dcf?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"2.11.2","to_inclusive":false,"patched_in":"2.11.2"}],"published":"2016-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1c106e8-9642-4294-90fd-6838cc551b90","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_delete_snapshot","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c106e8-9642-4294-90fd-6838cc551b90?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1c218c6-1599-4dc9-846f-e0ef74821488","source":"wordfence","cve":"CVE-2023-2078","title":"Buy Me a Coffee \u2013 Button and Widget Plugin <= 3.7 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c218c6-1599-4dc9-846f-e0ef74821488?source=api-prod","affected":[{"type":"plugin","slug":"buymeacoffee","name":"Buy Me a Coffee \u2013 Button and Widget Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1c79256-3f59-4137-b81b-e2bb5402c148","source":"wordfence","cve":"CVE-2026-115831","title":"VOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c79256-3f59-4137-b81b-e2bb5402c148?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.5.16"}],"published":"2026-11-05T20:40:50Z","updated":"2026-11-06T09:38:15Z"},{"id":"wordfence:c1c7f1dc-d2c3-43d1-ba76-a2763dfac9d0","source":"wordfence","cve":"CVE-2025-23607","title":"CAMOO SMS <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c7f1dc-d2c3-43d1-ba76-a2763dfac9d0?source=api-prod","affected":[{"type":"plugin","slug":"camoo-sms","name":"CAMOO SMS","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T18:11:06Z"},{"id":"wordfence:c1c89ce7-82d8-42e9-9608-cc77cb9c41d6","source":"wordfence","cve":"CVE-2025-22759","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.27.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1c89ce7-82d8-42e9-9608-cc77cb9c41d6?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.5","to_inclusive":true,"patched_in":"1.27.6"}],"published":"2025-01-14T00:00:00Z","updated":"2025-04-08T19:32:38Z"},{"id":"wordfence:c1cae64e-caed-43c0-9a75-9aa4234946a0","source":"wordfence","cve":"CVE-2023-6782","title":"AMP for WP \u2013 Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.92","to_inclusive":true,"patched_in":"1.0.92.1"}],"published":"2023-12-18T00:00:00Z","updated":"2024-07-29T21:37:20Z"},{"id":"wordfence:c1cec0b1-b77c-4d21-a3d2-c79fd3250bb0","source":"wordfence","cve":"CVE-2023-1870","title":"YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cec0b1-b77c-4d21-a3d2-c79fd3250bb0?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d02646-271a-4079-8a47-00b4029e9c1f","source":"wordfence","cve":"CVE-2022-1768","title":"RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"9.3.2","to_inclusive":true,"patched_in":"9.3.3"}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d157ea-ea5b-46f1-9833-07816c812f85","source":"wordfence","cve":"CVE-2025-54022","title":"Coupon Affiliates <= 6.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d157ea-ea5b-46f1-9833-07816c812f85?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:27:17Z"},{"id":"wordfence:c1d19968-dbd8-4433-99a7-b973a59c4653","source":"wordfence","cve":"CVE-2024-12559","title":"ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d19968-dbd8-4433-99a7-b973a59c4653?source=api-prod","affected":[{"type":"plugin","slug":"clickdesigns","name":"ClickDesigns","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-06T15:06:14Z","updated":"2025-01-31T14:51:41Z"},{"id":"wordfence:c1d2b6bd-a75a-4a07-b2f0-8ec206d41211","source":"wordfence","cve":"CVE-2023-2719","title":"SupportCandy <= 3.1.6 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d2b6bd-a75a-4a07-b2f0-8ec206d41211?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d354fc-8137-44fa-980a-215dbeb7d15c","source":"wordfence","cve":"CVE-2008-0388","title":"WP-Forum <= 1.7.4 - Remote SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d354fc-8137-44fa-980a-215dbeb7d15c?source=api-prod","affected":[{"type":"plugin","slug":"wp-forum","name":"wp-forum","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2008-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d359ef-a6f1-451e-a76b-e8f7a54b4eac","source":"wordfence","cve":"CVE-2026-48836","title":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments <= 2.1.19 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d359ef-a6f1-451e-a76b-e8f7a54b4eac?source=api-prod","affected":[{"type":"plugin","slug":"easy-invoice","name":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T13:59:13Z"},{"id":"wordfence:c1d532f8-c8aa-4d1b-9a6b-cb12402bf1eb","source":"wordfence","cve":"CVE-2026-45213","title":"BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d532f8-c8aa-4d1b-9a6b-cb12402bf1eb?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.7.1","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-03-30T00:00:00Z","updated":"2026-07-10T19:23:56Z"},{"id":"wordfence:c1d5bc13-585d-405d-b6f3-14db26464e55","source":"wordfence","cve":"CVE-2026-111726","title":"Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d5bc13-585d-405d-b6f3-14db26464e55?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"7.8.3"}],"published":"2026-10-16T14:35:46Z","updated":"2026-10-17T03:43:30Z"},{"id":"wordfence:c1d67b80-67b7-4194-ab90-e9f8cea1ac33","source":"wordfence","cve":"CVE-2021-24596","title":"youForms for WordPress \u2013 Creating Forms for CopeCart <= 1.0.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d67b80-67b7-4194-ab90-e9f8cea1ac33?source=api-prod","affected":[{"type":"plugin","slug":"youforms-free-for-copecart","name":"youForms for WordPress \u2013 Creating Forms for CopeCart","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2021-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d8ae51-5f5e-466d-9994-32c898f01f53","source":"wordfence","cve":"CVE-2008-0507","title":"AdServe < 0.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d8ae51-5f5e-466d-9994-32c898f01f53?source=api-prod","affected":[{"type":"plugin","slug":"adserve","name":"AdServe","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2008-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1d9ee9f-d8d0-4a9d-b414-bc79c4255b4e","source":"wordfence","cve":"CVE-2023-52142","title":"Events Shortcodes & Templates For The Events Calendar <= 2.3.1 - Authenticated (Contributor+) SQL Injection via shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d9ee9f-d8d0-4a9d-b414-bc79c4255b4e?source=api-prod","affected":[{"type":"plugin","slug":"template-events-calendar","name":"Events Shortcodes For The Events Calendar","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1da9295-e43c-4dea-b035-8ad165fc1d73","source":"wordfence","cve":"CVE-2026-111976","title":"GiveWP <= 4.19.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1da9295-e43c-4dea-b035-8ad165fc1d73?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T01:16:05Z"},{"id":"wordfence:c1e563e1-5381-4353-aa09-b09971b830c8","source":"wordfence","cve":"CVE-2022-33900","title":"Easy Digital Downloads <= 3.0.1 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e563e1-5381-4353-aa09-b09971b830c8?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1e648f7-c2ea-40b2-9ff8-7402c13f3703","source":"wordfence","cve":"CVE-2026-57763","title":"Structured Content (JSON-LD) #wpsc <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e648f7-c2ea-40b2-9ff8-7402c13f3703?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:39:59Z"},{"id":"wordfence:c1e7b324-fb3b-4816-82a4-7b9807a99e96","source":"wordfence","cve":"CVE-2026-121763","title":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN <= 3.21.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e7b324-fb3b-4816-82a4-7b9807a99e96?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.21.2","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:08:10Z"},{"id":"wordfence:c1e842de-2df2-47f1-896b-ae7a538aef1c","source":"wordfence","cve":"CVE-2025-47529","title":"Experto CTA Widget \u2013 Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e842de-2df2-47f1-896b-ae7a538aef1c?source=api-prod","affected":[{"type":"plugin","slug":"experto-cta-widget","name":"Experto CTA Widget \u2013 Call To Action, Sticky CTA, Floating Button Plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-05-15T00:00:00Z","updated":"2025-05-22T13:17:21Z"},{"id":"wordfence:c1e9e536-b13d-495a-a43b-4ad3803a879c","source":"wordfence","cve":"CVE-2026-61969","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.6.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1e9e536-b13d-495a-a43b-4ad3803a879c?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:02:51Z"},{"id":"wordfence:c1eaa4b8-7bed-435f-b408-f74572147c09","source":"wordfence","cve":"CVE-2025-23524","title":"ClickBank Storefront WordPress Plugin <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1eaa4b8-7bed-435f-b408-f74572147c09?source=api-prod","affected":[{"type":"plugin","slug":"mycbgenie-clickbank-storefront","name":"ClickBank Storefront WordPress Plugin","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T19:32:24Z"},{"id":"wordfence:c1ec113c-d11f-4b0b-8d4a-46d37687b3b2","source":"wordfence","cve":"CVE-2023-47533","title":"Countdown and CountUp, WooCommerce Sales Timer <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ec113c-d11f-4b0b-8d4a-46d37687b3b2?source=api-prod","affected":[{"type":"plugin","slug":"countdown-wpdevart-extended","name":"Countdown and CountUp, WooCommerce Sales Timer","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2023-11-07T00:00:00Z","updated":"2024-12-16T09:51:15Z"},{"id":"wordfence:c1ee67ea-5500-4c06-bfda-5d5bf32db4ef","source":"wordfence","cve":"CVE-2025-58832","title":"Search by Google <= 1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1ee67ea-5500-4c06-bfda-5d5bf32db4ef?source=api-prod","affected":[{"type":"plugin","slug":"search-google","name":"Search by Google","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:39:49Z"},{"id":"wordfence:c1f10e67-d301-46ba-b92e-432819cb9606","source":"wordfence","cve":"CVE-2023-0230","title":"VK All in One Expansion Unit <= 9.85.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f10e67-d301-46ba-b92e-432819cb9606?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.85.0.1","to_inclusive":true,"patched_in":"9.86.0.0"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1f55b51-cc93-4f45-9666-03740e147277","source":"wordfence","cve":"CVE-2024-10015","title":"ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f55b51-cc93-4f45-9666-03740e147277?source=api-prod","affected":[{"type":"plugin","slug":"convertcalculator","name":"ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-11-15T15:03:43Z","updated":"2024-11-20T16:28:04Z"},{"id":"wordfence:c1f56477-a397-4c91-95a8-e0bd9ffc4961","source":"wordfence","cve":"CVE-2024-37945","title":"WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f56477-a397-4c91-95a8-e0bd9ffc4961?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-07-10T00:00:00Z","updated":"2026-04-15T20:51:04Z"},{"id":"wordfence:c1f643bd-a168-4506-9606-0b8b91573ebb","source":"wordfence","cve":"CVE-2022-25609","title":"Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f643bd-a168-4506-9606-0b8b91573ebb?source=api-prod","affected":[{"type":"plugin","slug":"yoo-slider","name":"Yoo Slider \u2013 Image Slider & Video Slider","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2022-03-21T21:28:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1f64b77-5c8b-44f3-b1a8-6aa9f13624b7","source":"wordfence","cve":"","title":"WooCommerce Amazon Affiliates < 9.0.2.16 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f64b77-5c8b-44f3-b1a8-6aa9f13624b7?source=api-prod","affected":[{"type":"plugin","slug":"wwc-amz-aff","name":"WooCommerce Amazon Affiliates","from":"*","from_inclusive":true,"to":"9.0.2.16","to_inclusive":false,"patched_in":"9.0.2.16"}],"published":"2015-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c1f71ffb-f09c-40f6-b65e-af30ce155466","source":"wordfence","cve":"CVE-2025-13907","title":"CSS3 Buttons <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f71ffb-f09c-40f6-b65e-af30ce155466?source=api-prod","affected":[{"type":"plugin","slug":"css3-buttons","name":"CSS3 Buttons","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:37:49Z","updated":"2025-12-06T05:49:32Z"},{"id":"wordfence:c1f94034-ea8e-461e-8be1-c429283a6dbc","source":"wordfence","cve":"CVE-2025-28922","title":"Go To Top <= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f94034-ea8e-461e-8be1-c429283a6dbc?source=api-prod","affected":[{"type":"plugin","slug":"go-to-top","name":"Go To Top","from":"*","from_inclusive":true,"to":"0.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:12:41Z"},{"id":"wordfence:c1faea72-1863-4055-897c-352c8174a715","source":"wordfence","cve":"CVE-2025-62745","title":"Team Showcase <= 1.22.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1faea72-1863-4055-897c-352c8174a715?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.28","to_inclusive":true,"patched_in":""}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:12:34Z"},{"id":"wordfence:c1fda48e-cd19-469e-8a73-fd933752d03c","source":"wordfence","cve":"CVE-2025-9853","title":"Optio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fda48e-cd19-469e-8a73-fd933752d03c?source=api-prod","affected":[{"type":"plugin","slug":"optio-dentistry","name":"Optio Dentistry","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-09-05T14:06:29Z","updated":"2025-09-06T02:24:18Z"},{"id":"wordfence:c1fe4f60-d93b-4071-90ae-ac863c17fe19","source":"wordfence","cve":"CVE-2025-5947","title":"Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fe4f60-d93b-4071-90ae-ac863c17fe19?source=api-prod","affected":[{"type":"plugin","slug":"sf-booking","name":"Service Finder Bookings","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2025-07-31T14:59:11Z","updated":"2025-08-01T03:24:48Z"},{"id":"wordfence:c20059de-9d81-4318-a015-8e402945828c","source":"wordfence","cve":"CVE-2025-12037","title":"WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20059de-9d81-4318-a015-8e402945828c?source=api-prod","affected":[{"type":"plugin","slug":"wp-404-auto-redirect-to-similar-post","name":"WP 404 Auto Redirect to Similar Post","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2026-02-17T16:29:12Z","updated":"2026-02-18T04:35:45Z"},{"id":"wordfence:c2005b0a-4305-4eb0-ad4d-432c7c3ce3f6","source":"wordfence","cve":"CVE-2026-25033","title":"Motta Addons < 1.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2005b0a-4305-4eb0-ad4d-432c7c3ce3f6?source=api-prod","affected":[{"type":"plugin","slug":"motta-addons","name":"Motta Addons","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:35:17Z"},{"id":"wordfence:c201b563-1195-45b8-adf9-c8aeccb8ce0e","source":"wordfence","cve":"CVE-2026-120075","title":"WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c201b563-1195-45b8-adf9-c8aeccb8ce0e?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2026-10-30T20:02:03Z","updated":"2026-10-31T08:30:47Z"},{"id":"wordfence:c2020323-b08d-4a5c-818f-1c440e057e75","source":"wordfence","cve":"CVE-2014-5345","title":"Disqus Comment System < 2.76 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2020323-b08d-4a5c-818f-1c440e057e75?source=api-prod","affected":[{"type":"plugin","slug":"disqus-comment-system","name":"Disqus Comment System","from":"*","from_inclusive":true,"to":"2.76","to_inclusive":false,"patched_in":"2.76"}],"published":"2014-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2036c08-3aaf-4e41-bcd6-787f4b8fba9d","source":"wordfence","cve":"CVE-2023-0389","title":"Calculated Fields Form <= 1.1.150 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2036c08-3aaf-4e41-bcd6-787f4b8fba9d?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.1.150","to_inclusive":true,"patched_in":"1.1.151"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c205041a-01c9-44cd-8270-dafae2a78cbf","source":"wordfence","cve":"CVE-2024-53749","title":"Post Carousel Slider for Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c205041a-01c9-44cd-8270-dafae2a78cbf?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel-slider-for-elementor","name":"Post Carousel Slider for Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-11-28T00:00:00Z","updated":"2025-04-28T18:22:43Z"},{"id":"wordfence:c2054dcd-1a65-48bc-9dcf-824fa448921d","source":"wordfence","cve":"CVE-2024-32137","title":"User Activity Log Pro <= 2.3.4 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2054dcd-1a65-48bc-9dcf-824fa448921d?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log-pro","name":"User Activity Log Pro","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-18T14:55:35Z"},{"id":"wordfence:c2057ec2-9f03-4ae9-b200-aa5a318b461e","source":"wordfence","cve":"CVE-2026-1303","title":"MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2057ec2-9f03-4ae9-b200-aa5a318b461e?source=api-prod","affected":[{"type":"plugin","slug":"olalaweb-mailchimp-campaign-manager","name":"MailChimp Campaigns","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:28:49Z","updated":"2026-02-14T06:42:34Z"},{"id":"wordfence:c2059b3f-2fbc-4dbb-b8f8-4dddb5320455","source":"wordfence","cve":"CVE-2025-22295","title":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto <= 8.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2059b3f-2fbc-4dbb-b8f8-4dddb5320455?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":"8.0.7"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:51:09Z"},{"id":"wordfence:c2075960-fde4-4ca9-a000-23fdd6d5de1c","source":"wordfence","cve":"CVE-2023-24374","title":"Material Design Icons for Page Builders <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2075960-fde4-4ca9-a000-23fdd6d5de1c?source=api-prod","affected":[{"type":"plugin","slug":"material-design-icons-for-elementor","name":"Material Design Icons for Page Builders","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2081e4a-c6b7-4730-be59-bc728b90ecaa","source":"wordfence","cve":"CVE-2024-5770","title":"WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update","severity":"medium","cvss":4.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2081e4a-c6b7-4730-be59-bc728b90ecaa?source=api-prod","affected":[{"type":"plugin","slug":"wp-force-ssl","name":"WP Force SSL & HTTPS SSL Redirect","from":"*","from_inclusive":true,"to":"1.66","to_inclusive":true,"patched_in":"1.67"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T04:32:38Z"},{"id":"wordfence:c20c1fb1-8803-4f84-bdbb-6f03edd907cf","source":"wordfence","cve":"CVE-2024-37482","title":"The Post Grid <= 7.7.4 - Missing Authorization via AJAX","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20c1fb1-8803-4f84-bdbb-6f03edd907cf?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.4","to_inclusive":true,"patched_in":"7.7.5"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:53:00Z"},{"id":"wordfence:c20c674f-54b5-470f-b470-07a63501eb4d","source":"wordfence","cve":"CVE-2023-5618","title":"Modern Footnotes <= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20c674f-54b5-470f-b470-07a63501eb4d?source=api-prod","affected":[{"type":"plugin","slug":"modern-footnotes","name":"Modern Footnotes","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.4.17"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c20e0552-1ff6-43d9-be87-f6c482f1866e","source":"wordfence","cve":"CVE-2026-65514","title":"Appointment Hour Booking \u2013 Booking Calendar <= 1.5.86 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20e0552-1ff6-43d9-be87-f6c482f1866e?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.86","to_inclusive":true,"patched_in":"1.5.87"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:43:07Z"},{"id":"wordfence:c20e288e-492d-49ed-89cb-e1ee3e8c204e","source":"wordfence","cve":"CVE-2014-9398","title":"Twitter LiveBlog <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20e288e-492d-49ed-89cb-e1ee3e8c204e?source=api-prod","affected":[{"type":"plugin","slug":"twitter-liveblog","name":"twitter-liveblog","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2014-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c20ff80c-75da-4879-ba1c-e14edf779f58","source":"wordfence","cve":"CVE-2024-0779","title":"Enjoy Social Feed <= 6.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c20ff80c-75da-4879-ba1c-e14edf779f58?source=api-prod","affected":[{"type":"plugin","slug":"enjoy-instagram-instagram-responsive-images-gallery-and-carousel","name":"Enjoy Social Feed plugin for WordPress website","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-04-24T14:27:05Z"},{"id":"wordfence:c2110dbe-a625-4fa5-8426-8f11b3c33844","source":"wordfence","cve":"CVE-2022-0703","title":"GD Mylist <= 1.1.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2110dbe-a625-4fa5-8426-8f11b3c33844?source=api-prod","affected":[{"type":"plugin","slug":"gd-mylist","name":"GDMylist","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c211e0c0-3086-43d2-853c-489f9c42b0ab","source":"wordfence","cve":"CVE-2025-4334","title":"Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c211e0c0-3086-43d2-853c-489f9c42b0ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.4"}],"published":"2025-06-25T13:47:19Z","updated":"2026-05-19T14:55:53Z"},{"id":"wordfence:c2121162-68db-47c4-80f6-222f013f48c2","source":"wordfence","cve":"CVE-2022-3832","title":"External Media <= 1.0.35 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2121162-68db-47c4-80f6-222f013f48c2?source=api-prod","affected":[{"type":"plugin","slug":"external-media","name":"External Media","from":"*","from_inclusive":true,"to":"1.0.35","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2136e1c-5f69-434d-bdc7-72a144da744b","source":"wordfence","cve":"CVE-2023-47760","title":"Essential Blocks for Gutenberg <= 4.2.0 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2136e1c-5f69-434d-bdc7-72a144da744b?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2138634-c149-4fd1-a33d-351bbf633ea3","source":"wordfence","cve":"CVE-2024-10777","title":"AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2138634-c149-4fd1-a33d-351bbf633ea3?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2024-12-04T00:00:00Z","updated":"2024-12-05T09:23:08Z"},{"id":"wordfence:c2151c87-0df3-477a-a1b2-7d2e5bc44eb5","source":"wordfence","cve":"CVE-2024-54379","title":"Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2151c87-0df3-477a-a1b2-7d2e5bc44eb5?source=api-prod","affected":[{"type":"plugin","slug":"minterpress","name":"Minterpress","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:34:30Z"},{"id":"wordfence:c2165ca1-2c7d-42a4-a547-8adb30c24eab","source":"wordfence","cve":"CVE-2026-25004","title":"CM Business Directory \u2013 Optimise and showcase local business <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2165ca1-2c7d-42a4-a547-8adb30c24eab?source=api-prod","affected":[{"type":"plugin","slug":"cm-business-directory","name":"CM Business Directory \u2013 Optimise and showcase local business","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-01-16T00:00:00Z","updated":"2026-02-26T20:05:39Z"},{"id":"wordfence:c218bf5e-b28b-4512-8bc7-7662b4a06f1e","source":"wordfence","cve":"CVE-2024-10484","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c218bf5e-b28b-4512-8bc7-7662b4a06f1e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.16.2","to_inclusive":true,"patched_in":"2.16.3"}],"published":"2024-12-02T16:32:12Z","updated":"2024-12-03T05:33:26Z"},{"id":"wordfence:c21ad9c1-7424-432e-853e-f797ab839b9b","source":"wordfence","cve":"CVE-2026-27998","title":"Vixus - Business Startup Elementor Template Kit <= 1.0.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c21ad9c1-7424-432e-853e-f797ab839b9b?source=api-prod","affected":[{"type":"theme","slug":"vixus","name":"Vixus - Business Startup Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:24:48Z"},{"id":"wordfence:c21b5436-4421-4a09-952c-3dc0d9adb356","source":"wordfence","cve":"CVE-2025-23488","title":"rng-refresh <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c21b5436-4421-4a09-952c-3dc0d9adb356?source=api-prod","affected":[{"type":"plugin","slug":"rng-refresh","name":"rng-refresh","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T18:48:23Z"},{"id":"wordfence:c21c12b1-763e-4c01-bd41-5e2d0b34a50f","source":"wordfence","cve":"CVE-2023-24378","title":"Glossary <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c21c12b1-763e-4c01-bd41-5e2d0b34a50f?source=api-prod","affected":[{"type":"plugin","slug":"glossary-by-codeat","name":"Glossary","from":"*","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.28"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c21f0b61-720a-4770-8edb-027324910afc","source":"wordfence","cve":"CVE-2026-28088","title":"Aqualots <= 1.1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c21f0b61-720a-4770-8edb-027324910afc?source=api-prod","affected":[{"type":"theme","slug":"aqualots","name":"Aqualots","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T17:01:14Z"},{"id":"wordfence:c21f5461-9c1e-48ec-b15f-6a9be1e27b43","source":"wordfence","cve":"CVE-2024-6628","title":"EleForms \u2013 All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c21f5461-9c1e-48ec-b15f-6a9be1e27b43?source=api-prod","affected":[{"type":"plugin","slug":"all-contact-form-integration-for-elementor","name":"EleForms \u2013 All In One Form Integration including DB for Elementor","from":"*","from_inclusive":true,"to":"2.9.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:10:57Z","updated":"2024-11-16T03:20:50Z"},{"id":"wordfence:c22288e6-76f3-4c5a-bd7b-30681334bab7","source":"wordfence","cve":"CVE-2024-11906","title":"TPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22288e6-76f3-4c5a-bd7b-30681334bab7?source=api-prod","affected":[{"type":"plugin","slug":"tpg-get-posts","name":"TPG Get Posts","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T10:45:43Z","updated":"2024-12-16T23:24:18Z"},{"id":"wordfence:c2260d6b-1a41-4757-a063-8b8857ef416a","source":"wordfence","cve":"CVE-2025-2270","title":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2260d6b-1a41-4757-a063-8b8857ef416a?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.8.9.1","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2025-04-03T16:22:47Z","updated":"2025-04-04T05:22:49Z"},{"id":"wordfence:c226ca9a-8a2e-4e56-a039-96c31526a379","source":"wordfence","cve":"CVE-2023-6783","title":"WolfNet IDX for WordPress <= 1.19.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c226ca9a-8a2e-4e56-a039-96c31526a379?source=api-prod","affected":[{"type":"plugin","slug":"wolfnet-idx-for-wordpress","name":"WolfNet IDX for WordPress","from":"*","from_inclusive":true,"to":"1.19.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:44:30Z"},{"id":"wordfence:c227a9c9-2198-4682-b5ef-4898ed3ea617","source":"wordfence","cve":"CVE-2026-114186","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c227a9c9-2198-4682-b5ef-4898ed3ea617?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-06T15:27:45Z","updated":"2026-11-10T19:15:49Z"},{"id":"wordfence:c22b9505-6341-4db8-9d21-23796caf63d3","source":"wordfence","cve":"CVE-2007-6369","title":"PictPress <= 0.91 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22b9505-6341-4db8-9d21-23796caf63d3?source=api-prod","affected":[{"type":"plugin","slug":"pictpress","name":"PictPress","from":"*","from_inclusive":true,"to":"0.91","to_inclusive":true,"patched_in":"0.99"}],"published":"2007-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c22c2c17-c9c5-46eb-877a-a49ccf1a74ef","source":"wordfence","cve":"CVE-2023-32095","title":"Rename Media Files <= 1.0.1 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22c2c17-c9c5-46eb-877a-a49ccf1a74ef?source=api-prod","affected":[{"type":"plugin","slug":"rename-media-files","name":"Rename Media Files","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c22d6da6-84a1-4bc1-bcd1-123a5c956f93","source":"wordfence","cve":"CVE-2026-66633","title":"Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22d6da6-84a1-4bc1-bcd1-123a5c956f93?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.12","to_inclusive":false,"patched_in":"6.2.12"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T20:57:54Z"},{"id":"wordfence:c22e5765-54bd-4677-947c-8a7c48bdf65b","source":"wordfence","cve":"CVE-2024-13593","title":"BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22e5765-54bd-4677-947c-8a7c48bdf65b?source=api-prod","affected":[{"type":"plugin","slug":"bmlt-meeting-map","name":"BMLT Meeting Map","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-01-22T00:00:00Z","updated":"2025-01-23T09:21:10Z"},{"id":"wordfence:c22f34f1-2df7-4ffc-b808-234ca9039404","source":"wordfence","cve":"CVE-2026-14481","title":"Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c22f34f1-2df7-4ffc-b808-234ca9039404?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-checker","name":"Equalize Digital Accessibility Checker \u2013 WCAG, ADA, EAA and Section 508 compliance","from":"*","from_inclusive":true,"to":"1.46.0","to_inclusive":true,"patched_in":"1.47.0"}],"published":"2026-07-22T20:25:03Z","updated":"2026-07-23T08:34:41Z"},{"id":"wordfence:c232344c-5070-4461-b143-0f53d61d6eac","source":"wordfence","cve":"CVE-2016-10967","title":"Real3D Flipbook <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c232344c-5070-4461-b143-0f53d61d6eac?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2016-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2324caa-f804-4f76-9d08-8951fbee4669","source":"wordfence","cve":"CVE-2023-5163","title":"Weather Atlas Widget <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2324caa-f804-4f76-9d08-8951fbee4669?source=api-prod","affected":[{"type":"plugin","slug":"weather-atlas","name":"Weather Atlas Widget","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c232b39c-7144-4d3a-9770-883986ca8b29","source":"wordfence","cve":"","title":"WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c232b39c-7144-4d3a-9770-883986ca8b29?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2020-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c232ddc0-35e8-42e0-8fff-831c74457615","source":"wordfence","cve":"CVE-2021-24540","title":"Wonder Video Embed <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c232ddc0-35e8-42e0-8fff-831c74457615?source=api-prod","affected":[{"type":"plugin","slug":"wonderplugin-video-embed","name":"Wonder Video Embed","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2330359-447e-4871-b364-620d9b065f70","source":"wordfence","cve":"CVE-2025-27304","title":"Contact Form 7 Star Rating with font Awesome <= 1.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2330359-447e-4871-b364-620d9b065f70?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-star-rating-with-font-awersome","name":"Contact Form 7 Star Rating with font Awesome","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:53:14Z"},{"id":"wordfence:c2346543-c05a-4c69-9b1d-3d33c860c385","source":"wordfence","cve":"CVE-2025-24665","title":"Small Package Quotes \u2013 Unishippers Edition <= 2.4.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2346543-c05a-4c69-9b1d-3d33c860c385?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-unishippers-edition","name":"Small Package Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-28T16:17:48Z"},{"id":"wordfence:c2353d9d-d5ae-4470-9c0f-119acecd6686","source":"wordfence","cve":"CVE-2025-10683","title":"Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2353d9d-d5ae-4470-9c0f-119acecd6686?source=api-prod","affected":[{"type":"plugin","slug":"email-subscription-with-secure-captcha","name":"Easy Email Subscription","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-11-05T14:24:51Z","updated":"2025-11-06T02:31:05Z"},{"id":"wordfence:c237c4bc-b971-4d76-97a1-155ef7a3e5df","source":"wordfence","cve":"CVE-2024-54256","title":"Easy Blocks pro <= 1.0.21 - Missing Authorization","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c237c4bc-b971-4d76-97a1-155ef7a3e5df?source=api-prod","affected":[{"type":"plugin","slug":"easy-blocks-pro","name":"Easy Blocks pro","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:35:31Z"},{"id":"wordfence:c237cfa7-1b55-4cca-91de-0fde3d598329","source":"wordfence","cve":"CVE-2025-32140","title":"WP Remote Thumbnail <= 1.3.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c237cfa7-1b55-4cca-91de-0fde3d598329?source=api-prod","affected":[{"type":"plugin","slug":"wp-remote-thumbnail","name":"WP Remote Thumbnail","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-08T00:00:00Z","updated":"2025-05-09T13:36:10Z"},{"id":"wordfence:c2385865-ff03-4daf-bf81-3ec3ea11c91f","source":"wordfence","cve":"CVE-2015-5734","title":"WordPress Core < 4.2.4 - Cross-Site Scripting in Theme Preview","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2385865-ff03-4daf-bf81-3ec3ea11c91f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2397cdc-48ae-468c-b3e5-6229454004cb","source":"wordfence","cve":"CVE-2026-25317","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2397cdc-48ae-468c-b3e5-6229454004cb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T19:33:55Z"},{"id":"wordfence:c23995c6-989e-48d2-ba60-b0bf7b750245","source":"wordfence","cve":"CVE-2024-8325","title":"Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23995c6-989e-48d2-ba60-b0bf7b750245?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T05:31:38Z"},{"id":"wordfence:c23bba83-35d2-4098-8104-8389bb2ff880","source":"wordfence","cve":"CVE-2024-4000","title":"WordPress Header Builder Plugin \u2013 Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23bba83-35d2-4098-8104-8389bb2ff880?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:34Z"},{"id":"wordfence:c23c08c2-5baa-47a9-a060-b6019d3cdc83","source":"wordfence","cve":"CVE-2026-22382","title":"PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23c08c2-5baa-47a9-a060-b6019d3cdc83?source=api-prod","affected":[{"type":"theme","slug":"pawfriends","name":"PawFriends - Pet Shop and Veterinary WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T21:53:43Z"},{"id":"wordfence:c23c3b24-893f-4589-8fab-bd54259bd105","source":"wordfence","cve":"CVE-2015-9316","title":"WP Fastest Cache < 0.8.4.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23c3b24-893f-4589-8fab-bd54259bd105?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.4.9","to_inclusive":false,"patched_in":"0.8.4.9"}],"published":"2015-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c23e9810-40ea-43e2-9292-f05f300a7ddf","source":"wordfence","cve":"CVE-2022-4711","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23e9810-40ea-43e2-9292-f05f300a7ddf?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c23fb3ab-954d-415f-8e2e-d44d64dc072f","source":"wordfence","cve":"CVE-2026-96831","title":"Themify Builder <= 7.8.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c23fb3ab-954d-415f-8e2e-d44d64dc072f?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:47:22Z"},{"id":"wordfence:c240826d-6b1c-424a-9bb0-eab627d7f5ed","source":"wordfence","cve":"CVE-2026-66691","title":"Nokri \u2013 Job Board WordPress Theme <= 1.6.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c240826d-6b1c-424a-9bb0-eab627d7f5ed?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-14T13:21:28Z"},{"id":"wordfence:c2421108-d4b0-480e-a020-95712cdfae8e","source":"wordfence","cve":"CVE-2022-1329","title":"Elementor Website Builder 3.6.0 - 3.6.2  - Missing Authorization to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2421108-d4b0-480e-a020-95712cdfae8e?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"3.6.0","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c244eb33-acaf-460b-ae1d-6688b21cc60f","source":"wordfence","cve":"CVE-2024-12155","title":"SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c244eb33-acaf-460b-ae1d-6688b21cc60f?source=api-prod","affected":[{"type":"plugin","slug":"sv100-companion","name":"SV100 Companion","from":"*","from_inclusive":true,"to":"2.0.02","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:32:55Z","updated":"2024-12-12T13:41:58Z"},{"id":"wordfence:c24501be-8f40-4240-84e1-3eaaf1de3f25","source":"wordfence","cve":"CVE-2026-24550","title":"Blockons <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c24501be-8f40-4240-84e1-3eaaf1de3f25?source=api-prod","affected":[{"type":"plugin","slug":"blockons","name":"Blockons \u2013 Gutenberg blocks for WordPress and WooCommerce websites","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.19"}],"published":"2026-01-23T00:00:00Z","updated":"2026-10-28T21:10:07Z"},{"id":"wordfence:c245eedf-e5ce-4ac2-ac59-e9cb1dc58449","source":"wordfence","cve":"CVE-2026-92243","title":"Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c245eedf-e5ce-4ac2-ac59-e9cb1dc58449?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"5.5.19"}],"published":"2026-10-02T14:15:06Z","updated":"2026-10-03T02:25:36Z"},{"id":"wordfence:c2475643-a0b4-444a-a2c6-a5c45e90e1dd","source":"wordfence","cve":"CVE-2024-9105","title":"UltimateAI <= 2.8.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2475643-a0b4-444a-a2c6-a5c45e90e1dd?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_AI","name":"Ultimate AI","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T02:05:10Z"},{"id":"wordfence:c248606f-2d79-46c1-8975-e111b9118ceb","source":"wordfence","cve":"CVE-2011-1762","title":"WordPress Core < 3.1.2 - Incorrect Authorization for Contributor-level users","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c248606f-2d79-46c1-8975-e111b9118ceb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2011-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2487a5e-f038-414b-bc88-ed2c7f2c624c","source":"wordfence","cve":"CVE-2021-24251","title":"Business Directory Plugin <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Payment History Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2487a5e-f038-414b-bc88-ed2c7f2c624c?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.11.2"}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c248f11c-f381-4335-b6f7-bb18bbf1f7b0","source":"wordfence","cve":"CVE-2022-1617","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c248f11c-f381-4335-b6f7-bb18bbf1f7b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2022-04-27T00:00:00Z","updated":"2024-08-06T13:13:58Z"},{"id":"wordfence:c24c57e5-2b42-40db-816a-f1327d1ac09b","source":"wordfence","cve":"CVE-2023-0336","title":"OoohBoi Steroids for Elementor <= 2.1.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c24c57e5-2b42-40db-816a-f1327d1ac09b?source=api-prod","affected":[{"type":"plugin","slug":"ooohboi-steroids-for-elementor","name":"OoohBoi Steroids for Elementor","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c24cf4de-1392-43a8-85a5-8c66c00c44d7","source":"wordfence","cve":"CVE-2025-10476","title":"WP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c24cf4de-1392-43a8-85a5-8c66c00c44d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-11-26T21:34:28Z","updated":"2025-11-27T10:57:38Z"},{"id":"wordfence:c24e00b5-4014-42fc-818d-3877dfbd3fda","source":"wordfence","cve":"CVE-2026-42757","title":"WebinarIgnition \u2013 Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c24e00b5-4014-42fc-818d-3877dfbd3fda?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"4.08.253","to_inclusive":false,"patched_in":"4.08.253"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-02T11:32:03Z"},{"id":"wordfence:c250bc90-130a-489a-b0da-6996073f44b5","source":"wordfence","cve":"CVE-2024-51606","title":"Blrt WP Embed <= 1.6.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c250bc90-130a-489a-b0da-6996073f44b5?source=api-prod","affected":[{"type":"plugin","slug":"blrt-wp-embed","name":"Blrt WP Embed","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:34:25Z"},{"id":"wordfence:c25412d4-f24c-4e29-9b1f-fa89b0383f64","source":"wordfence","cve":"CVE-2025-26978","title":"FS Poster <= 6.5.8 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":7.7,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25412d4-f24c-4e29-9b1f-fa89b0383f64?source=api-prod","affected":[{"type":"plugin","slug":"fs-poster","name":"FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]","from":"*","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"6.5.9"}],"published":"2025-02-24T00:00:00Z","updated":"2026-02-26T15:04:17Z"},{"id":"wordfence:c2553c88-3bef-4a9f-8339-f6667aa5fb93","source":"wordfence","cve":"CVE-2026-27544","title":"QA Assistants \u2013 Driven by data <= 5.2.0.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2553c88-3bef-4a9f-8339-f6667aa5fb93?source=api-prod","affected":[{"type":"plugin","slug":"qa-heatmap-analytics","name":"QA Assistants \u2013 Driven by data","from":"*","from_inclusive":true,"to":"5.2.0.0","to_inclusive":true,"patched_in":"5.2.0.1"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T12:45:15Z"},{"id":"wordfence:c258a198-73bc-4ceb-9ab4-d26c5b6b656d","source":"wordfence","cve":"CVE-2026-27986","title":"OsTende <= 1.4.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c258a198-73bc-4ceb-9ab4-d26c5b6b656d?source=api-prod","affected":[{"type":"theme","slug":"ostende","name":"OsTende","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:23:54Z"},{"id":"wordfence:c25bf8a2-cf09-4c44-9624-087b7e5d7a78","source":"wordfence","cve":"CVE-2026-42637","title":"PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25bf8a2-cf09-4c44-9624-087b7e5d7a78?source=api-prod","affected":[{"type":"plugin","slug":"payplug","name":"PayPlug for WooCommerce (Official)","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-28T21:16:28Z"},{"id":"wordfence:c25ce375-0cdd-4e3e-adfc-3f8bc12a318d","source":"wordfence","cve":"CVE-2025-30526","title":"Typekit plugin for WordPress <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25ce375-0cdd-4e3e-adfc-3f8bc12a318d?source=api-prod","affected":[{"type":"plugin","slug":"typekit","name":"Typekit plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:25:42Z"},{"id":"wordfence:c25d8622-f40f-4312-ba52-3b2f951f9a15","source":"wordfence","cve":"CVE-2026-123698","title":"Security For WooCommerce <= 1.0.16 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25d8622-f40f-4312-ba52-3b2f951f9a15?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-for-woocommerce","name":"Security For WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:03Z"},{"id":"wordfence:c25e2264-6be8-4e30-97e1-a3c56355fa36","source":"wordfence","cve":"CVE-2026-103346","title":"Payflex Payment Gateway <= 2.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25e2264-6be8-4e30-97e1-a3c56355fa36?source=api-prod","affected":[{"type":"plugin","slug":"payflex-payment-gateway","name":"Payflex Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-10-04T07:34:24Z","updated":"2026-10-08T23:04:27Z"},{"id":"wordfence:c25fc6ff-1928-4690-bf1e-a5e87425c6f0","source":"wordfence","cve":"CVE-2025-62126","title":"Varnish/Nginx Proxy Caching <= 1.8.3 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c25fc6ff-1928-4690-bf1e-a5e87425c6f0?source=api-prod","affected":[{"type":"plugin","slug":"vcaching","name":"Varnish/Nginx Proxy Caching","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:18:01Z"},{"id":"wordfence:c265590c-be4f-4191-8368-7d366d182dc0","source":"wordfence","cve":"CVE-2023-23890","title":"WP Airbnb Review Slider <= 3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c265590c-be4f-4191-8368-7d366d182dc0?source=api-prod","affected":[{"type":"plugin","slug":"wp-airbnb-review-slider","name":"WP Airbnb Review Slider","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2663150-61f9-49e3-9219-fbe89cc6b03c","source":"wordfence","cve":"CVE-2024-5943","title":"Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2663150-61f9-49e3-9219-fbe89cc6b03c?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2024-07-03T23:23:26Z","updated":"2024-07-04T11:34:05Z"},{"id":"wordfence:c26c5e45-d3e9-4fa1-9aed-323b100c9bee","source":"wordfence","cve":"CVE-2024-54299","title":"Revi.io <= 5.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c26c5e45-d3e9-4fa1-9aed-323b100c9bee?source=api-prod","affected":[{"type":"plugin","slug":"revi-io-customer-and-product-reviews","name":"Revi.io \u2013 Customer and Product Reviews","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:54:22Z"},{"id":"wordfence:c26e2aea-835e-4462-b4e3-99d2caf3a014","source":"wordfence","cve":"CVE-2023-0273","title":"Custom Content Shortcode <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c26e2aea-835e-4462-b4e3-99d2caf3a014?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-shortcode","name":"Custom Content Shortcode","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c26e5109-aaf8-4bba-9331-b8baaf109a55","source":"wordfence","cve":"CVE-2025-24663","title":"Simple Download Monitor <= 3.9.25 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c26e5109-aaf8-4bba-9331-b8baaf109a55?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.9.26"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:09:41Z"},{"id":"wordfence:c272d8af-6ebd-44b2-bff2-fa94de2046c4","source":"wordfence","cve":"CVE-2026-57757","title":"pCloud WP Backup <= 2.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c272d8af-6ebd-44b2-bff2-fa94de2046c4?source=api-prod","affected":[{"type":"plugin","slug":"pcloud-wp-backup","name":"pCloud WP Backup","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:18:34Z"},{"id":"wordfence:c272f769-65da-4963-aff0-8f68a277ea63","source":"wordfence","cve":"CVE-2022-21662","title":"WordPress Core < 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting","severity":"high","cvss":8.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c272f769-65da-4963-aff0-8f68a277ea63?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.37","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.35","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":false,"patched_in":"3.7.37"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":false,"patched_in":"3.7.37"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c274a9b2-c95e-4898-afa4-d6e2f6006f91","source":"wordfence","cve":"","title":"Premium Gallery Manager (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c274a9b2-c95e-4898-afa4-d6e2f6006f91?source=api-prod","affected":[{"type":"plugin","slug":"Premium_Gallery_Manager","name":"Premium Gallery Manager","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c275517f-0699-4d5f-a9d7-cb8aac0c06d8","source":"wordfence","cve":"CVE-2026-62018","title":"Gunslinger <= 1.11 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c275517f-0699-4d5f-a9d7-cb8aac0c06d8?source=api-prod","affected":[{"type":"theme","slug":"gunslinger","name":"Gunslinger","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:38:19Z"},{"id":"wordfence:c2760f65-a981-42f6-b18c-fcf493bd34b6","source":"wordfence","cve":"","title":"Codup Read Only Admin <= 1.1.1.7 - Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2760f65-a981-42f6-b18c-fcf493bd34b6?source=api-prod","affected":[{"type":"plugin","slug":"codup-read-only-admin","name":"Codup Read Only Admin","from":"*","from_inclusive":true,"to":"1.1.1.7","to_inclusive":true,"patched_in":"1.1.1.8"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2775885-6e93-4a71-8efa-6e696e880cec","source":"wordfence","cve":"CVE-2026-118168","title":"MapPress Maps for WordPress <= 2.97.14 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2775885-6e93-4a71-8efa-6e696e880cec?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.97.14","to_inclusive":true,"patched_in":"2.97.15"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-03T19:47:52Z"},{"id":"wordfence:c2777158-baa4-4209-ae15-03da5adafc75","source":"wordfence","cve":"CVE-2019-17231","title":"OneTone <= 3.0.6 & OneTone Companion <= 1.1.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2777158-baa4-4209-ae15-03da5adafc75?source=api-prod","affected":[{"type":"theme","slug":"onetone","name":"OneTone","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"onetone-companion","name":"OneTone Companion","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c27b390f-282b-4a18-98c3-3442554d63e1","source":"wordfence","cve":"CVE-2025-64217","title":"Photography <= 7.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27b390f-282b-4a18-98c3-3442554d63e1?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.7.2","to_inclusive":true,"patched_in":"7.7.4"}],"published":"2025-11-11T00:00:00Z","updated":"2025-12-19T16:45:59Z"},{"id":"wordfence:c27bbfeb-bdc2-4348-848a-4051b9af2959","source":"wordfence","cve":"CVE-2025-31028","title":"WP Hide Categories <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27bbfeb-bdc2-4348-848a-4051b9af2959?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-categories","name":"WP Hide Categories","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:09:45Z"},{"id":"wordfence:c27c64cd-7ee9-44bb-8698-08a3529b946c","source":"wordfence","cve":"CVE-2025-60071","title":"Riode | Multi-Purpose WooCommerce <= 1.6.23 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27c64cd-7ee9-44bb-8698-08a3529b946c?source=api-prod","affected":[{"type":"theme","slug":"riode","name":"Riode | Multi-Purpose WooCommerce","from":"*","from_inclusive":true,"to":"1.6.23","to_inclusive":true,"patched_in":""}],"published":"2025-08-02T00:00:00Z","updated":"2025-12-20T15:25:37Z"},{"id":"wordfence:c27d682f-d722-4c8b-9ba0-31e03efea1da","source":"wordfence","cve":"CVE-2026-14836","title":"Login & Register Forms \u2013 Popup, Slider, Profile & WooCommerce < 3.2.5 - Authentication Bypass via Brute Force","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27d682f-d722-4c8b-9ba0-31e03efea1da?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:17:33Z"},{"id":"wordfence:c27f2d6c-826b-4b17-b432-cd142f96ce7a","source":"wordfence","cve":"CVE-2025-23749","title":"mybb Last Topics <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27f2d6c-826b-4b17-b432-cd142f96ce7a?source=api-prod","affected":[{"type":"plugin","slug":"mybb-last-topics","name":"mybb Last Topics","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:29:12Z"},{"id":"wordfence:c27f566a-913e-498e-90bb-113692b74612","source":"wordfence","cve":"CVE-2024-37960","title":"CodePen Embedded Pens Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c27f566a-913e-498e-90bb-113692b74612?source=api-prod","affected":[{"type":"plugin","slug":"codepen-embedded-pen-shortcode","name":"CodePen Embedded Pens Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-19T14:11:45Z"},{"id":"wordfence:c2805cb0-8913-4487-8445-031b7d920e2d","source":"wordfence","cve":"CVE-2024-3034","title":"BackUpWordPress <= 3.13 - Authenticated (Admin+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2805cb0-8913-4487-8445-031b7d920e2d?source=api-prod","affected":[{"type":"plugin","slug":"backupwordpress","name":"BackUpWordPress","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":true,"patched_in":"3.14"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-27T04:33:29Z"},{"id":"wordfence:c2826ac2-bb1c-4aee-ba3f-c77825fc395c","source":"wordfence","cve":"CVE-2022-4327","title":"Anti-Malware Security and Brute-Force Firewall <= 4.21.85 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2826ac2-bb1c-4aee-ba3f-c77825fc395c?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.21.85","to_inclusive":true,"patched_in":"4.21.86"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c28479bf-768a-4ab4-8e74-ad367b9b744f","source":"wordfence","cve":"CVE-2025-11379","title":"WebP Express <= 0.25.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c28479bf-768a-4ab4-8e74-ad367b9b744f?source=api-prod","affected":[{"type":"plugin","slug":"webp-express","name":"WebP Express","from":"*","from_inclusive":true,"to":"0.25.9","to_inclusive":true,"patched_in":"0.25.11"}],"published":"2025-12-03T15:48:18Z","updated":"2026-01-06T20:50:24Z"},{"id":"wordfence:c284ed3e-7f8e-4841-88f3-33e99f98aa83","source":"wordfence","cve":"CVE-2024-34368","title":"Mooberry Book Manager <= 4.15.12 - Unauthenticated Information Exposure via Export Files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c284ed3e-7f8e-4841-88f3-33e99f98aa83?source=api-prod","affected":[{"type":"plugin","slug":"mooberry-book-manager","name":"Mooberry Book Manager","from":"*","from_inclusive":true,"to":"4.15.12","to_inclusive":true,"patched_in":"4.15.13"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:26:16Z"},{"id":"wordfence:c287ed1d-83ff-4ee7-bebc-e57850d081a0","source":"wordfence","cve":"CVE-2024-7822","title":"Quick Code <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c287ed1d-83ff-4ee7-bebc-e57850d081a0?source=api-prod","affected":[{"type":"plugin","slug":"quick-code","name":"Quick Code","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T22:34:50Z"},{"id":"wordfence:c28bc239-c77b-4a64-a0bf-edde7d61e268","source":"wordfence","cve":"CVE-2024-13926","title":"WP-Syntax <= 1.2 - Authenticated (Author+) Regex Denial of Service","severity":"medium","cvss":4.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c28bc239-c77b-4a64-a0bf-edde7d61e268?source=api-prod","affected":[{"type":"plugin","slug":"wp-syntax","name":"WP-Syntax","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-22T20:30:12Z"},{"id":"wordfence:c28e2aba-73eb-43f9-bae9-a78a67e6207c","source":"wordfence","cve":"CVE-2024-31277","title":"Product Designer <= 1.0.32 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c28e2aba-73eb-43f9-bae9-a78a67e6207c?source=api-prod","affected":[{"type":"plugin","slug":"product-designer","name":"PickPlugins Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":"1.0.33"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:59:38Z"},{"id":"wordfence:c28e740e-9337-41b5-a8e7-ca68e41eaed4","source":"wordfence","cve":"CVE-2025-9565","title":"Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c28e740e-9337-41b5-a8e7-ca68e41eaed4?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":"2.1.11"}],"published":"2025-09-16T17:33:55Z","updated":"2025-09-17T06:17:50Z"},{"id":"wordfence:c291aa80-f1cd-4933-b522-73ec115a3a68","source":"wordfence","cve":"CVE-2023-52118","title":"WP User Profile Avatar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c291aa80-f1cd-4933-b522-73ec115a3a68?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-profile-avatar","name":"WP User Profile Avatar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c296743a-ec08-4cdd-b3d0-ab3de93f5bb9","source":"wordfence","cve":"","title":"Music Store \u2013 WordPress eCommerce < 1.0.15 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c296743a-ec08-4cdd-b3d0-ab3de93f5bb9?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":false,"patched_in":"1.0.15"}],"published":"2015-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2967eae-82bb-4556-a21a-c5bb6b905c62","source":"wordfence","cve":"CVE-2023-5741","title":"POWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2967eae-82bb-4556-a21a-c5bb6b905c62?source=api-prod","affected":[{"type":"plugin","slug":"powr-pack","name":"Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2023-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c298c81c-a973-4239-b48a-36b9fbedbe25","source":"wordfence","cve":"CVE-2026-15256","title":"Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c298c81c-a973-4239-b48a-36b9fbedbe25?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.9","to_inclusive":true,"patched_in":"3.14.10"}],"published":"2026-07-27T00:00:00Z","updated":"2026-09-17T15:15:34Z"},{"id":"wordfence:c298c87e-cf3c-4b72-bb0e-a01ca2dfe52f","source":"wordfence","cve":"CVE-2024-8724","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c298c87e-cf3c-4b72-bb0e-a01ca2dfe52f?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-09-13T14:49:36Z","updated":"2024-09-14T03:29:29Z"},{"id":"wordfence:c2990ed9-061e-4d35-aae0-99282a4f3737","source":"wordfence","cve":"CVE-2022-23988","title":"WS Form LITE and WS Form Pro < 1.8.176 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2990ed9-061e-4d35-aae0-99282a4f3737?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.8.176","to_inclusive":false,"patched_in":"1.8.176"},{"type":"plugin","slug":"ws-form-pro","name":"WS Form Pro","from":"*","from_inclusive":true,"to":"1.8.176","to_inclusive":false,"patched_in":"1.8.176"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2995828-8a3e-400d-9e2b-aba8fd17cf00","source":"wordfence","cve":"CVE-2025-4479","title":"ElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2995828-8a3e-400d-9e2b-aba8fd17cf00?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-06-18T15:03:12Z","updated":"2025-06-19T03:40:14Z"},{"id":"wordfence:c29b9cb5-fd47-47d6-a341-a4b5ca0683f1","source":"wordfence","cve":"CVE-2025-24644","title":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.7.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c29b9cb5-fd47-47d6-a341-a4b5ca0683f1?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:51:50Z"},{"id":"wordfence:c29cb99f-72e9-4178-b961-7ab50a5b6c7d","source":"wordfence","cve":"CVE-2022-36428","title":"Rock Convert <= 2.11.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c29cb99f-72e9-4178-b961-7ab50a5b6c7d?source=api-prod","affected":[{"type":"plugin","slug":"rock-convert","name":"Rock Convert","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2a121db-8a04-4da2-98b8-05a5eba06e45","source":"wordfence","cve":"CVE-2024-11846","title":"Travel Tour < 5.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a121db-8a04-4da2-98b8-05a5eba06e45?source=api-prod","affected":[{"type":"theme","slug":"traveltour","name":"TravelTour","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":false,"patched_in":"5.2.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:03:05Z"},{"id":"wordfence:c2a166de-3bdf-4883-91ba-655f2757c53b","source":"wordfence","cve":"CVE-2025-0818","title":"Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a166de-3bdf-4883-91ba-655f2757c53b?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.4.0"},{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9"},{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.4.2","to_inclusive":true,"patched_in":"8.4.3"}],"published":"2025-08-12T00:00:00Z","updated":"2025-08-13T13:13:37Z"},{"id":"wordfence:c2a1b1a4-df72-4666-b116-882af4cd5796","source":"wordfence","cve":"CVE-2024-13740","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a1b1a4-df72-4666-b116-882af4cd5796?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.4.2","to_inclusive":true,"patched_in":"5.9.4.3"}],"published":"2025-02-17T13:45:14Z","updated":"2025-02-18T02:26:17Z"},{"id":"wordfence:c2a2c069-5dc6-45e2-8ca1-842759d541c4","source":"wordfence","cve":"CVE-2024-7317","title":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a2c069-5dc6-45e2-8ca1-842759d541c4?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-08-05T22:52:16Z","updated":"2024-08-06T10:59:36Z"},{"id":"wordfence:c2a3076b-f5dc-4d93-b0a5-7121ba4e529a","source":"wordfence","cve":"CVE-2026-49772","title":"The Events Calendar  6.15.12-6.16.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a3076b-f5dc-4d93-b0a5-7121ba4e529a?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"6.15.12","from_inclusive":true,"to":"6.16.2","to_inclusive":true,"patched_in":"6.16.3"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:40:09Z"},{"id":"wordfence:c2a30bb9-501b-44bd-8121-c137bb1c3ae5","source":"wordfence","cve":"CVE-2015-9446","title":"Unite Gallery Lite < 1.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a30bb9-501b-44bd-8121-c137bb1c3ae5?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2015-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2a515d9-dc4c-4755-b602-a9eb22f8e814","source":"wordfence","cve":"CVE-2021-24876","title":"Registrations for The Events Calendar <= 2.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a515d9-dc4c-4755-b602-a9eb22f8e814?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2021-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2a57428-3473-4f24-ae30-5f6cada7481c","source":"wordfence","cve":"CVE-2025-13072","title":"HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a57428-3473-4f24-ae30-5f6cada7481c?source=api-prod","affected":[{"type":"plugin","slug":"handl-utm-grabber","name":"HandL UTM Grabber / Tracker","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2025-11-19T00:00:00Z","updated":"2025-12-12T21:01:33Z"},{"id":"wordfence:c2a5ae9f-b57c-4a71-b976-5975ad086c74","source":"wordfence","cve":"CVE-2023-5943","title":"Wp-Adv-Quiz <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Quiz Question and Message","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a5ae9f-b57c-4a71-b976-5975ad086c74?source=api-prod","affected":[{"type":"plugin","slug":"advanced-quiz","name":"Wp-Adv-Quiz","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-01-03T00:00:00Z","updated":"2024-02-04T13:01:48Z"},{"id":"wordfence:c2a6c3b7-eaef-41c8-9126-df8e8e1dd3e7","source":"wordfence","cve":"CVE-2026-48879","title":"AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a6c3b7-eaef-41c8-9126-df8e8e1dd3e7?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":"1.4.19"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:00:59Z"},{"id":"wordfence:c2a761ce-5a0c-4ba6-91f7-82ef7935f734","source":"wordfence","cve":"CVE-2025-24554","title":"AWcode Toolkit <= 1.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a761ce-5a0c-4ba6-91f7-82ef7935f734?source=api-prod","affected":[{"type":"plugin","slug":"awcode-toolkit","name":"AWcode Toolkit","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2024-11-15T00:00:00Z","updated":"2025-02-20T16:31:35Z"},{"id":"wordfence:c2a91fe9-f642-4a61-a175-ed5bb537bf08","source":"wordfence","cve":"CVE-2026-11597","title":"Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a91fe9-f642-4a61-a175-ed5bb537bf08?source=api-prod","affected":[{"type":"plugin","slug":"surbma-infusionsoft-shortcode","name":"Surbma | Infusionsoft Shortcode","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-06-26T17:50:25Z","updated":"2026-06-27T06:50:58Z"},{"id":"wordfence:c2a97987-1a9f-4e9e-af5d-4db542eec5ae","source":"wordfence","cve":"CVE-2025-46542","title":"Xpert Tab <=  1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a97987-1a9f-4e9e-af5d-4db542eec5ae?source=api-prod","affected":[{"type":"plugin","slug":"xpert-tab","name":"Xpert Tab","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:46:17Z"},{"id":"wordfence:c2aa02d9-317b-49cc-b7f3-ed7dd8041658","source":"wordfence","cve":"CVE-2026-88847","title":"MasterStudy LMS <= 3.7.49 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aa02d9-317b-49cc-b7f3-ed7dd8041658?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-29T19:55:42Z"},{"id":"wordfence:c2abf547-841f-429e-b053-5eddeab9dd93","source":"wordfence","cve":"CVE-2026-78395","title":"Link Library <= 7.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2abf547-841f-429e-b053-5eddeab9dd93?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.0","to_inclusive":true,"patched_in":"7.10.0"}],"published":"2026-10-26T00:00:00Z","updated":"2026-11-03T20:11:19Z"},{"id":"wordfence:c2ad4325-be1f-48c1-b21f-adf9ce3fa2cb","source":"wordfence","cve":"CVE-2026-15673","title":"SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings","severity":"medium","cvss":4.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ad4325-be1f-48c1-b21f-adf9ce3fa2cb?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-07-27T18:23:05Z","updated":"2026-07-28T06:54:36Z"},{"id":"wordfence:c2aee799-4e4c-4a41-8b76-e2ad576fe2e2","source":"wordfence","cve":"CVE-2025-13748","title":"Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2aee799-4e4c-4a41-8b76-e2ad576fe2e2?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2025-12-05T18:10:08Z","updated":"2025-12-06T06:39:09Z"},{"id":"wordfence:c2af263f-960b-4807-bc85-d136136fa30f","source":"wordfence","cve":"CVE-2025-14394","title":"Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2af263f-960b-4807-bc85-d136136fa30f?source=api-prod","affected":[{"type":"plugin","slug":"popover-windows","name":"Popover Windows","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-12T16:09:54Z","updated":"2025-12-13T04:31:32Z"},{"id":"wordfence:c2b2671e-0db7-4ba9-b574-a0122959e8fc","source":"wordfence","cve":"CVE-2024-8529","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b2671e-0db7-4ba9-b574-a0122959e8fc?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.7.1"}],"published":"2024-09-11T00:00:00Z","updated":"2025-03-24T15:06:27Z"},{"id":"wordfence:c2b2bb9a-2a32-4591-a149-bfb487c48890","source":"wordfence","cve":"CVE-2024-49327","title":"Woostagram Connect <= 1.0.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b2bb9a-2a32-4591-a149-bfb487c48890?source=api-prod","affected":[{"type":"plugin","slug":"woostagram-connect","name":"Woostagram Connect","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T16:38:18Z"},{"id":"wordfence:c2b3113e-7a47-4a32-aafd-bc806f99f8b6","source":"wordfence","cve":"CVE-2025-25088","title":"WP Keyword Monitor <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b3113e-7a47-4a32-aafd-bc806f99f8b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-keyword-monitor","name":"WP Keyword Monitor","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:09:59Z"},{"id":"wordfence:c2b36621-3322-4631-b693-629c5084708b","source":"wordfence","cve":"CVE-2026-17582","title":"Slider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b36621-3322-4631-b693-629c5084708b?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"9.1.7","to_inclusive":true,"patched_in":"9.1.8"}],"published":"2026-08-15T16:26:49Z","updated":"2026-08-16T05:27:30Z"},{"id":"wordfence:c2b7802a-3cbe-4488-93d2-5f8a34faf8ae","source":"wordfence","cve":"CVE-2012-2916","title":"Sabre < 1.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b7802a-3cbe-4488-93d2-5f8a34faf8ae?source=api-prod","affected":[{"type":"plugin","slug":"sabre","name":"Sabre","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2b79193-f8fc-4ea2-8973-fe292cfb926b","source":"wordfence","cve":"CVE-2017-20208","title":"RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292cfb926b?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"3.7.9.3","to_inclusive":false,"patched_in":"3.7.9.3"}],"published":"2017-10-02T00:00:00Z","updated":"2025-10-18T03:33:25Z"},{"id":"wordfence:c2b795d8-3cab-4d81-a016-b4498315ddf4","source":"wordfence","cve":"CVE-2023-23803","title":"JustTables \u2013 WooCommerce Product Table <= 1.4.9 - Cross-Site Request Forgery via plugin_activation()","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b795d8-3cab-4d81-a016-b4498315ddf4?source=api-prod","affected":[{"type":"plugin","slug":"just-tables","name":"JustTables \u2013 WooCommerce Product Table","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2b92091-e615-484f-b402-2e793eed214d","source":"wordfence","cve":"CVE-2024-12447","title":"Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b92091-e615-484f-b402-2e793eed214d?source=api-prod","affected":[{"type":"plugin","slug":"get-post-content-shortcode","name":"Get Post Content Shortcode","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:54:39Z","updated":"2024-12-14T04:23:45Z"},{"id":"wordfence:c2b9c6ab-28b4-49c7-9dc2-32bca81300f8","source":"wordfence","cve":"CVE-2026-42647","title":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more <= 5.7.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b9c6ab-28b4-49c7-9dc2-32bca81300f8?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"5.7.8"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:57:23Z"},{"id":"wordfence:c2ba5136-cd30-4b65-af3e-f1161ae6eeee","source":"wordfence","cve":"CVE-2025-47544","title":"Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.8 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ba5136-cd30-4b65-af3e-f1161ae6eeee?source=api-prod","affected":[{"type":"plugin","slug":"aco-woo-dynamic-pricing","name":"Dynamic Pricing With Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:04:04Z"},{"id":"wordfence:c2bc94a7-5a03-48be-be77-b05681033ba3","source":"wordfence","cve":"CVE-2025-30858","title":"Snow Storm <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2bc94a7-5a03-48be-be77-b05681033ba3?source=api-prod","affected":[{"type":"plugin","slug":"snow-storm","name":"Snow Storm","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T14:22:43Z"},{"id":"wordfence:c2be56d2-d473-455e-8d6e-d2df6abb19ca","source":"wordfence","cve":"CVE-2021-24219","title":"Multiple Thrive Themes and Plugins (Various Versions) - Arbitrary Options Update","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2be56d2-d473-455e-8d6e-d2df6abb19ca?source=api-prod","affected":[{"type":"plugin","slug":"thrive-ab-page-testing","name":"Thrive Optimize","from":"*","from_inclusive":true,"to":"1.4.13.3","to_inclusive":false,"patched_in":"1.4.13.3"},{"type":"plugin","slug":"thrive-dashboard","name":"Thrive Dashboard","from":"*","from_inclusive":true,"to":"2.3.9.3","to_inclusive":false,"patched_in":"2.3.9.3"},{"type":"plugin","slug":"thrive-leads","name":"Thrive Leads","from":"*","from_inclusive":true,"to":"2.3.9.4","to_inclusive":false,"patched_in":"2.3.9.4"},{"type":"plugin","slug":"thrive-clever-widgets","name":"Thrive Clever Widgets","from":"*","from_inclusive":true,"to":"1.57.1","to_inclusive":false,"patched_in":"1.57.1"},{"type":"theme","slug":"thrive-theme","name":"Thrive Themes Builder","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":false,"patched_in":"2.2.4"},{"type":"plugin","slug":"thrive-ultimatum","name":"Thrive Ultimatum","from":"*","from_inclusive":true,"to":"2.3.9.4","to_inclusive":false,"patched_in":"2.3.9.4"},{"type":"theme","slug":"ignition","name":"Ignition","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"storied","name":"Storied","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"thrive-apprentice","name":"Thrive Apprentice","from":"*","from_inclusive":true,"to":"2.3.9.4","to_inclusive":false,"patched_in":"2.3.9.4"},{"type":"theme","slug":"luxe","name":"Luxe","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"thrive-comments","name":"Thrive Comments","from":"*","from_inclusive":true,"to":"1.4.15.3","to_inclusive":false,"patched_in":"1.4.15.3"},{"type":"theme","slug":"voice","name":"Voice","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"thrive-visual-editor","name":"Thrive Visual Editor","from":"*","from_inclusive":true,"to":"2.6.7.4","to_inclusive":false,"patched_in":"2.6.7.4"},{"type":"plugin","slug":"thrive-ovation","name":"Thrive Ovation","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":false,"patched_in":"2.4.5"},{"type":"theme","slug":"squared","name":"Squared","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"performag","name":"Performag","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"minus","name":"Minus","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"thrive-quiz-builder","name":"Thrive Quiz Builder","from":"*","from_inclusive":true,"to":"2.3.9.4","to_inclusive":false,"patched_in":"2.3.9.4"},{"type":"theme","slug":"pressive","name":"Pressive","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"rise","name":"Rise","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"focusblog","name":"FocusBlog","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"plugin","slug":"thrive-headline-optimizer","name":"Thrive Headline Optimizer","from":"*","from_inclusive":true,"to":"1.3.7.3","to_inclusive":false,"patched_in":"1.3.7.3"}],"published":"2021-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2c0ab2d-1ba9-4a0a-b1fa-bacebe1034eb","source":"wordfence","cve":"CVE-2024-9932","title":"Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c0ab2d-1ba9-4a0a-b1fa-bacebe1034eb?source=api-prod","affected":[{"type":"plugin","slug":"wux-blog-editor","name":"Wux Blog Editor","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T01:58:37Z"},{"id":"wordfence:c2c11644-b9b5-40c7-b558-995b621fc5d6","source":"wordfence","cve":"CVE-2026-3349","title":"MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c11644-b9b5-40c7-b558-995b621fc5d6?source=api-prod","affected":[{"type":"plugin","slug":"minhnhut-link-gateway","name":"MinhNhut Link Gateway","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T20:48:35Z","updated":"2026-05-27T09:27:31Z"},{"id":"wordfence:c2c2385e-0d1e-435a-9b82-972964084148","source":"wordfence","cve":"CVE-2025-1564","title":"SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c2385e-0d1e-435a-9b82-972964084148?source=api-prod","affected":[{"type":"plugin","slug":"setsail-membership","name":"SetSail Membership","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:05Z"},{"id":"wordfence:c2c58f4a-1436-4796-bf61-895177639dbe","source":"wordfence","cve":"CVE-2026-14601","title":"Link Whisper Free < 0.9.7 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c58f4a-1436-4796-bf61-895177639dbe?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":false,"patched_in":"0.9.7"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:09:32Z"},{"id":"wordfence:c2c74678-ff9e-4b67-9061-505dbebcf9aa","source":"wordfence","cve":"CVE-2024-13878","title":"SpotBot <= 0.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c74678-ff9e-4b67-9061-505dbebcf9aa?source=api-prod","affected":[{"type":"plugin","slug":"spotbot","name":"SpotBot","from":"*","from_inclusive":true,"to":"0.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:08:52Z"},{"id":"wordfence:c2c80b7d-aad9-4d5e-814a-6ed928827043","source":"wordfence","cve":"CVE-2024-35683","title":"Leyka <= 3.31.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c80b7d-aad9-4d5e-814a-6ed928827043?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.31.1","to_inclusive":true,"patched_in":"3.31.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:01:42Z"},{"id":"wordfence:c2cb2475-2064-4212-89fe-402622736b78","source":"wordfence","cve":"CVE-2024-6856","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to SMTP Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2cb2475-2064-4212-89fe-402622736b78?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-15T20:16:27Z"},{"id":"wordfence:c2cdf4e5-0a40-42ca-b5ac-78511fdd2b77","source":"wordfence","cve":"CVE-2023-6798","title":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2cdf4e5-0a40-42ca-b5ac-78511fdd2b77?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:21Z"},{"id":"wordfence:c2d03b83-c406-4d3f-b6be-015edcc15515","source":"wordfence","cve":"CVE-2024-1679","title":"Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2d03b83-c406-4d3f-b6be-015edcc15515?source=api-prod","affected":[{"type":"plugin","slug":"a4-barcode-generator","name":"Barcode Generator: Print Product and Order Labels with Barcodes (A4, Thermal/Roll, Letter)","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-31T15:30:39Z"},{"id":"wordfence:c2d1151b-e1c7-4b34-bdf4-285b845ea6d3","source":"wordfence","cve":"CVE-2025-53313","title":"Twitch TV Embed Suite <= 2.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2d1151b-e1c7-4b34-bdf4-285b845ea6d3?source=api-prod","affected":[{"type":"plugin","slug":"twitch-tv-embed-suite","name":"Twitch TV Embed Suite","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:26:42Z"},{"id":"wordfence:c2d6e619-c32a-450a-a4a0-1069becabff6","source":"wordfence","cve":"CVE-2026-15932","title":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System < 1.4.48 - Unauthenticated Arbitrary File Download","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2d6e619-c32a-450a-a4a0-1069becabff6?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.48","to_inclusive":false,"patched_in":"1.4.48"}],"published":"2026-07-16T00:00:00Z","updated":"2026-08-13T22:32:43Z"},{"id":"wordfence:c2d867eb-4227-4160-8bf2-4a7a92d68d88","source":"wordfence","cve":"CVE-2025-47634","title":"WC Pickup Store <= 1.8.9 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2d867eb-4227-4160-8bf2-4a7a92d68d88?source=api-prod","affected":[{"type":"plugin","slug":"wc-pickup-store","name":"WC Pickup Store","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-16T15:21:47Z"},{"id":"wordfence:c2da5ba0-530d-44a6-8a98-808276e0a9c6","source":"wordfence","cve":"CVE-2024-37497","title":"JetThemeCore for Elementor <= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2da5ba0-530d-44a6-8a98-808276e0a9c6?source=api-prod","affected":[{"type":"plugin","slug":"jet-theme-core","name":"JetThemeCore for Elementor","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:26:34Z"},{"id":"wordfence:c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9","source":"wordfence","cve":"CVE-2025-1405","title":"Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2ddd9a2-79d7-4f9c-9832-25c3363d3ce9?source=api-prod","affected":[{"type":"plugin","slug":"post-type-x","name":"Product Catalog Simple","from":"*","from_inclusive":true,"to":"1.7.11","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-02-27T18:52:31Z","updated":"2025-02-28T07:03:47Z"},{"id":"wordfence:c2e0a227-670d-40d8-ba82-6602ab57bc4a","source":"wordfence","cve":"CVE-2023-25067","title":"We\u2019re Open! <= 1.45 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e0a227-670d-40d8-ba82-6602ab57bc4a?source=api-prod","affected":[{"type":"plugin","slug":"opening-hours","name":"We\u2019re Open!","from":"*","from_inclusive":true,"to":"1.45","to_inclusive":true,"patched_in":"1.46"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2e552b8-84ad-436d-b029-f7dd4534f7d5","source":"wordfence","cve":"CVE-2024-13398","title":"Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e552b8-84ad-436d-b029-f7dd4534f7d5?source=api-prod","affected":[{"type":"plugin","slug":"checkout-for-paypal","name":"Checkout for PayPal","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":"1.0.33"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T04:30:22Z"},{"id":"wordfence:c2e64541-019a-4de8-aaaa-d4055be659c7","source":"wordfence","cve":"CVE-2025-27325","title":"Video.js HLS Player <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e64541-019a-4de8-aaaa-d4055be659c7?source=api-prod","affected":[{"type":"plugin","slug":"videojs-hls-player","name":"Video.js HLS Player","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:16:02Z"},{"id":"wordfence:c2e6a555-6f7e-48bd-8e8d-dfdcbd5f1e77","source":"wordfence","cve":"CVE-2024-6073","title":"WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Discount Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e6a555-6f7e-48bd-8e8d-dfdcbd5f1e77?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-06-24T00:00:00Z","updated":"2024-07-01T14:43:36Z"},{"id":"wordfence:c2e770e0-1a39-4946-838b-4fd1f1dea1c8","source":"wordfence","cve":"CVE-2024-5468","title":"WordPress Header Builder Plugin \u2013 Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e770e0-1a39-4946-838b-4fd1f1dea1c8?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-06-11T20:05:56Z","updated":"2024-06-12T08:33:20Z"},{"id":"wordfence:c2e80e6f-08e7-426b-9797-97483c3dc410","source":"wordfence","cve":"CVE-2015-1879","title":"Google Doc Embedder <= 2.5.18 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e80e6f-08e7-426b-9797-97483c3dc410?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.5.19","to_inclusive":false,"patched_in":"2.5.19"}],"published":"2015-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2e83cb5-3c10-45dc-b37e-4d47ebc6853d","source":"wordfence","cve":"CVE-2023-40675","title":"Landing Page Builder <= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e83cb5-3c10-45dc-b37e-4d47ebc6853d?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.1.2","to_inclusive":true,"patched_in":"1.5.1.3"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2e92646-bb71-4cf1-b826-e749693b0c0c","source":"wordfence","cve":"CVE-2024-32449","title":"RestroPress <= 3.1.2 - Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e92646-bb71-4cf1-b826-e749693b0c0c?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.2.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:15:13Z"},{"id":"wordfence:c2e98359-6b38-4132-9699-a0180813bff3","source":"wordfence","cve":"CVE-2024-32687","title":"WPC Frequently Bought Together for WooCommerce <= 7.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e98359-6b38-4132-9699-a0180813bff3?source=api-prod","affected":[{"type":"plugin","slug":"woo-bought-together","name":"WPC Frequently Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.4"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:13:43Z"},{"id":"wordfence:c2f10cc4-82a8-4668-b1e5-a08a0f79b59c","source":"wordfence","cve":"CVE-2021-24319","title":"Bello - Directory & Listing  - < 1.6.0 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f10cc4-82a8-4668-b1e5-a08a0f79b59c?source=api-prod","affected":[{"type":"theme","slug":"bello","name":"Bello - Directory & Listing","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2021-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2f209e1-4837-404b-8e3e-63a9d842a944","source":"wordfence","cve":"","title":"WP Social Comments <= 1.7.2 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f209e1-4837-404b-8e3e-63a9d842a944?source=api-prod","affected":[{"type":"plugin","slug":"gs-facebook-comments","name":"Genial Comments","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2f4461b-1373-4d09-8430-14d1961e1644","source":"wordfence","cve":"CVE-2024-0590","title":"Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f4461b-1373-4d09-8430-14d1961e1644?source=api-prod","affected":[{"type":"plugin","slug":"microsoft-clarity","name":"Microsoft Clarity","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":"0.9.4"}],"published":"2024-02-16T00:00:00Z","updated":"2024-07-29T21:37:21Z"},{"id":"wordfence:c2f4c1de-7eeb-45c4-bbff-ec85f2cda5aa","source":"wordfence","cve":"CVE-2023-28422","title":"Event Manager for WooCommerce <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f4c1de-7eeb-45c4-bbff-ec85f2cda5aa?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2f4ce08-934a-49d7-9994-82eed6935fda","source":"wordfence","cve":"CVE-2026-15246","title":"RealHomes Memberships <= 3.0.0 - Authenticated (Subscriber+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f4ce08-934a-49d7-9994-82eed6935fda?source=api-prod","affected":[{"type":"plugin","slug":"inspiry-memberships","name":"RealHomes Memberships","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-21T15:36:20Z"},{"id":"wordfence:c2f54e8d-9e81-4902-9111-b826ef5da164","source":"wordfence","cve":"CVE-2020-35489","title":"Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2f54e8d-9e81-4902-9111-b826ef5da164?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":false,"patched_in":"5.3.2"}],"published":"2020-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c2fa3845-917e-437f-b353-0af62f147196","source":"wordfence","cve":"CVE-2025-62976","title":"Sendle Shipping <= 6.02 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fa3845-917e-437f-b353-0af62f147196?source=api-prod","affected":[{"type":"plugin","slug":"official-sendle-shipping-method","name":"Sendle Shipping Plugin","from":"*","from_inclusive":true,"to":"6.02","to_inclusive":true,"patched_in":"6.03"}],"published":"2025-10-19T00:00:00Z","updated":"2025-12-19T15:08:47Z"},{"id":"wordfence:c2fc3d97-0aac-47f6-b0d9-968303341033","source":"wordfence","cve":"CVE-2026-16962","title":"Tamara Checkout <= 1.9.9.20 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fc3d97-0aac-47f6-b0d9-968303341033?source=api-prod","affected":[{"type":"plugin","slug":"tamara-checkout","name":"Tamara Checkout","from":"*","from_inclusive":true,"to":"1.9.9.20","to_inclusive":true,"patched_in":"1.9.9.21"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:27:14Z"},{"id":"wordfence:c2fc8741-9d53-473b-b396-5a47b3d0eacc","source":"wordfence","cve":"CVE-2025-69131","title":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fc8741-9d53-473b-b396-5a47b3d0eacc?source=api-prod","affected":[{"type":"plugin","slug":"wp_scraper","name":"WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite.","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:07:09Z"},{"id":"wordfence:c2fcf51d-ed21-4438-9179-07a56ed97251","source":"wordfence","cve":"CVE-2026-56010","title":"Abandoned Cart Pro for WooCommerce <= 10.4.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fcf51d-ed21-4438-9179-07a56ed97251?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandon-cart-pro","name":"Abandoned Cart Pro for WooCommerce","from":"*","from_inclusive":true,"to":"10.4.0","to_inclusive":true,"patched_in":"10.4.1"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-25T13:23:00Z"},{"id":"wordfence:c2fd1bd8-dcc2-4c9a-be3f-b0a58992a239","source":"wordfence","cve":"CVE-2024-31246","title":"PostX \u2013 Gutenberg Blocks for Post Grid <= 3.2.3 - Incorrect Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fd1bd8-dcc2-4c9a-be3f-b0a58992a239?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:02:47Z"},{"id":"wordfence:c2fd9be1-5918-4f6e-9cc5-ce4bfdd1286a","source":"wordfence","cve":"CVE-2024-56221","title":"WPMozo Addons Lite for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fd9be1-5918-4f6e-9cc5-ce4bfdd1286a?source=api-prod","affected":[{"type":"plugin","slug":"wpmozo-addons-lite-for-elementor","name":"WPMozo Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:08:34Z"},{"id":"wordfence:c2fde092-0a12-42ab-abbb-7f5ff5de9af2","source":"wordfence","cve":"CVE-2024-13510","title":"ShopSite <= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fde092-0a12-42ab-abbb-7f5ff5de9af2?source=api-prod","affected":[{"type":"plugin","slug":"shopsite-plugin","name":"ShopSite","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.5.11"}],"published":"2025-02-03T20:46:21Z","updated":"2025-02-04T09:21:07Z"},{"id":"wordfence:c2fe3724-f71c-4548-9410-838c0337f887","source":"wordfence","cve":"CVE-2014-1888","title":"BuddyPress <= 1.9.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c2fe3724-f71c-4548-9410-838c0337f887?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3001ec4-a1d8-43d7-8e0c-1fe2e4e7f314","source":"wordfence","cve":"CVE-2026-15667","title":"Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3001ec4-a1d8-43d7-8e0c-1fe2e4e7f314?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"4.1.23"}],"published":"2026-09-08T13:49:31Z","updated":"2026-09-09T02:27:37Z"},{"id":"wordfence:c3002e85-3f3d-478a-b5cc-d8204d27ca6b","source":"wordfence","cve":"CVE-2025-68540","title":"Fana <= 1.1.35 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3002e85-3f3d-478a-b5cc-d8204d27ca6b?source=api-prod","affected":[{"type":"theme","slug":"fana","name":"Fana - Fashion Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.35","to_inclusive":true,"patched_in":"1.1.36"}],"published":"2025-12-28T00:00:00Z","updated":"2026-01-05T18:49:30Z"},{"id":"wordfence:c300c485-e5ab-48b3-99e8-0def5668ef4a","source":"wordfence","cve":"CVE-2024-12304","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c300c485-e5ab-48b3-99e8-0def5668ef4a?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-01-10T14:30:35Z","updated":"2025-01-11T03:21:05Z"},{"id":"wordfence:c3016491-6a6a-433f-9018-5e84f9e3e37c","source":"wordfence","cve":"","title":"Bulk Delete <= 5.5.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3016491-6a6a-433f-9018-5e84f9e3e37c?source=api-prod","affected":[{"type":"plugin","slug":"bulk-delete","name":"Bulk Delete","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":false,"patched_in":"5.5.4"}],"published":"2016-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c303fffe-628b-4e88-9274-7dd242f2186e","source":"wordfence","cve":"CVE-2026-39468","title":"Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c303fffe-628b-4e88-9274-7dd242f2186e?source=api-prod","affected":[{"type":"plugin","slug":"meta-box","name":"Meta Box \u2013 A Framework for Dynamic Websites","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.11.2"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:55:05Z"},{"id":"wordfence:c3078d39-9d49-48be-aeeb-08775f220612","source":"wordfence","cve":"CVE-2026-16267","title":"Newsletters <= 4.15 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3078d39-9d49-48be-aeeb-08775f220612?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:38:20Z"},{"id":"wordfence:c30801d1-9335-4bba-b344-f0ff57cecf84","source":"wordfence","cve":"CVE-2024-0786","title":"Conversios <= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30801d1-9335-4bba-b344-f0ff57cecf84?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"7.0.8"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:21Z"},{"id":"wordfence:c309a873-5dae-4727-b4ee-05a45108233c","source":"wordfence","cve":"CVE-2026-118101","title":"BuddyForms <= 2.10.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c309a873-5dae-4727-b4ee-05a45108233c?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:47:11Z"},{"id":"wordfence:c309e32f-9b1a-453f-873c-cc9bd18bc115","source":"wordfence","cve":"CVE-2025-47438","title":"WP Job Portal <= 2.3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c309e32f-9b1a-453f-873c-cc9bd18bc115?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-13T14:53:20Z"},{"id":"wordfence:c30a4292-228a-483b-a443-0ccb1eca5a16","source":"wordfence","cve":"CVE-2026-24521","title":"Kama Thumbnail <= 3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30a4292-228a-483b-a443-0ccb1eca5a16?source=api-prod","affected":[{"type":"plugin","slug":"kama-thumbnail","name":"Kama Thumbnail","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-01-26T00:00:00Z","updated":"2026-10-28T21:10:17Z"},{"id":"wordfence:c30aeafe-725b-47be-b49d-00f58b474c3a","source":"wordfence","cve":"CVE-2026-56051","title":"TablePress \u2013 Tables in WordPress made easy <= 3.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30aeafe-725b-47be-b49d-00f58b474c3a?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:00:31Z"},{"id":"wordfence:c30b3958-8a61-4460-a072-eac1010c07b3","source":"wordfence","cve":"CVE-2020-37235","title":"Wibar <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30b3958-8a61-4460-a072-eac1010c07b3?source=api-prod","affected":[{"type":"theme","slug":"wibar","name":"Wibar | Wine and Vineyard WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-16T00:00:00Z","updated":"2026-07-29T20:40:58Z"},{"id":"wordfence:c30c6fc1-4693-40e9-8909-119a656bd985","source":"wordfence","cve":"CVE-2025-24600","title":"RSVPMarker  <= 11.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30c6fc1-4693-40e9-8909-119a656bd985?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"11.4.5","to_inclusive":true,"patched_in":"11.4.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:38:32Z"},{"id":"wordfence:c30d517b-e051-408c-a022-4399c3d62390","source":"wordfence","cve":"CVE-2023-1324","title":"Easy Forms for MailChimp <= 6.8.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30d517b-e051-408c-a022-4399c3d62390?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.7","to_inclusive":true,"patched_in":"6.8.8"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c30df356-6cae-4f8c-a0e6-35c5c66dbe8d","source":"wordfence","cve":"CVE-2026-39715","title":"AnyTrack Affiliate Link Manager <= 1.5.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30df356-6cae-4f8c-a0e6-35c5c66dbe8d?source=api-prod","affected":[{"type":"plugin","slug":"anytrack-affiliate-link-manager","name":"AnyTrack Affiliate Link Manager","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:34:51Z"},{"id":"wordfence:c30f2322-14b1-476a-bbaf-99a14bc9e017","source":"wordfence","cve":"CVE-2024-34552","title":"Stockholm <= 9.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c30f2322-14b1-476a-bbaf-99a14bc9e017?source=api-prod","affected":[{"type":"theme","slug":"stockholm","name":"Stockholm","from":"*","from_inclusive":true,"to":"9.6","to_inclusive":true,"patched_in":"9.7"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T21:16:07Z"},{"id":"wordfence:c3114906-fac1-42b9-9ba1-0a5d44c2fb3a","source":"wordfence","cve":"CVE-2023-41873","title":"SAML SP Single Sign On <= 5.0.4 - Missing Authorization to notice dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3114906-fac1-42b9-9ba1-0a5d44c2fb3a?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login Standard","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-04-17T13:01:09Z"},{"id":"wordfence:c311f5f8-d781-4b89-aa6d-a1ed7c5f4c4c","source":"wordfence","cve":"CVE-2025-31561","title":"Ultimate Push Notifications <= 1.3.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c311f5f8-d781-4b89-aa6d-a1ed7c5f4c4c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-push-notifications","name":"Ultimate Push Notifications","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-03-31T00:00:00Z","updated":"2026-09-23T14:28:08Z"},{"id":"wordfence:c3122921-6bea-49e7-b1d7-77a291928497","source":"wordfence","cve":"CVE-2025-8150","title":"Events Addon for Elementor <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3122921-6bea-49e7-b1d7-77a291928497?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-08-28T19:53:49Z","updated":"2025-08-29T08:25:56Z"},{"id":"wordfence:c3122ac8-5f53-4e78-8d59-c9f9a78c12a2","source":"wordfence","cve":"CVE-2025-58195","title":"Xpro Elementor Addons <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3122ac8-5f53-4e78-8d59-c9f9a78c12a2?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.17","to_inclusive":true,"patched_in":"1.4.18"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:22:31Z"},{"id":"wordfence:c312f915-fca6-4624-bfb9-8d8fd54d1b3c","source":"wordfence","cve":"CVE-2024-48046","title":"Contact Form by Supsystic <= 1.7.28 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c312f915-fca6-4624-bfb9-8d8fd54d1b3c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.28","to_inclusive":true,"patched_in":"1.7.29"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:54:01Z"},{"id":"wordfence:c3172e21-c2e4-4ec0-ad0f-4433303efcfb","source":"wordfence","cve":"","title":"Syncee for Suppliers <= 1.0.5 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3172e21-c2e4-4ec0-ad0f-4433303efcfb?source=api-prod","affected":[{"type":"plugin","slug":"syncee-for-suppliers","name":"Syncee for Suppliers","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c31732fa-eb35-4932-bee6-08955a14b010","source":"wordfence","cve":"CVE-2024-0873","title":"Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31732fa-eb35-4932-bee6-08955a14b010?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.1.1"}],"published":"2024-04-04T00:00:00Z","updated":"2024-05-31T15:30:54Z"},{"id":"wordfence:c3175913-8040-41e1-9f31-a63b03d7bad5","source":"wordfence","cve":"CVE-2025-24604","title":"VForm <= 3.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3175913-8040-41e1-9f31-a63b03d7bad5?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:44:47Z"},{"id":"wordfence:c317fe6a-b691-40bb-a646-a06a8337da31","source":"wordfence","cve":"","title":"Axact Author List Widget < 3.0.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c317fe6a-b691-40bb-a646-a06a8337da31?source=api-prod","affected":[{"type":"plugin","slug":"knr-author-list-widget","name":"Axact Author List Widget","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c31828dc-ef94-4895-8395-a5d52a0a82bd","source":"wordfence","cve":"CVE-2023-0558","title":"ContentStudio <= 1.2.5 - Authorization Bypass","severity":"high","cvss":8.2,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31828dc-ef94-4895-8395-a5d52a0a82bd?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3189e11-94f3-4af6-8ea5-92325d33d6a3","source":"wordfence","cve":"CVE-2025-58880","title":"Translate This gTranslate Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3189e11-94f3-4af6-8ea5-92325d33d6a3?source=api-prod","affected":[{"type":"plugin","slug":"translate-this-google-translate-web-element-shortcode","name":"Translate This gTranslate Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:57:51Z"},{"id":"wordfence:c318a0cf-5aaa-4442-a25e-138936d1dc90","source":"wordfence","cve":"CVE-2024-6486","title":"ImageMagick Engine <= 1.7.10 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c318a0cf-5aaa-4442-a25e-138936d1dc90?source=api-prod","affected":[{"type":"plugin","slug":"imagemagick-engine","name":"ImageMagick Engine","from":"*","from_inclusive":true,"to":"1.7.10","to_inclusive":true,"patched_in":"1.7.11"}],"published":"2024-09-20T00:00:00Z","updated":"2025-05-30T18:20:35Z"},{"id":"wordfence:c31906da-f2fd-40ac-86e0-3f1ed0409d0c","source":"wordfence","cve":"CVE-2026-11387","title":"SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31906da-f2fd-40ac-86e0-3f1ed0409d0c?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-06-30T19:08:22Z","updated":"2026-07-01T07:53:37Z"},{"id":"wordfence:c3190f9f-8b2f-4251-8804-f386e2c5678f","source":"wordfence","cve":"","title":"WP-Optimize <= 3.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3190f9f-8b2f-4251-8804-f386e2c5678f?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimize","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c319dd9f-d07d-42ea-bce8-1a99435347c5","source":"wordfence","cve":"CVE-2024-54341","title":"LabelGrid Tools <= 1.3.58 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c319dd9f-d07d-42ea-bce8-1a99435347c5?source=api-prod","affected":[{"type":"plugin","slug":"label-grid-tools","name":"LabelGrid Tools","from":"*","from_inclusive":true,"to":"1.3.58","to_inclusive":true,"patched_in":"1.3.59"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:11:27Z"},{"id":"wordfence:c31a7f53-3e1b-41f2-afbc-2f13c16c00d7","source":"wordfence","cve":"CVE-2026-123469","title":"The Events Calendar <= 6.18.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31a7f53-3e1b-41f2-afbc-2f13c16c00d7?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.3","to_inclusive":true,"patched_in":"6.18.3.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:20:32Z"},{"id":"wordfence:c31c0a10-0617-4bf7-a098-45df2d460a61","source":"wordfence","cve":"CVE-2025-62119","title":"Add Featured Image Custom Link <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31c0a10-0617-4bf7-a098-45df2d460a61?source=api-prod","affected":[{"type":"plugin","slug":"custom-url-to-featured-image","name":"Add Featured Image Custom Link","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:26:31Z"},{"id":"wordfence:c31cd87c-8e28-49f2-8e38-151acb1c99ce","source":"wordfence","cve":"CVE-2025-25115","title":"Like dislike plus counter | Like Dislike Buttons <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31cd87c-8e28-49f2-8e38-151acb1c99ce?source=api-prod","affected":[{"type":"plugin","slug":"like-dislike-plus-counter","name":"Like dislike plus counter | Like Dislike Buttons","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:23:26Z"},{"id":"wordfence:c31de209-e8fa-4bf6-bb29-d9a73ce0546b","source":"wordfence","cve":"CVE-2025-31896","title":"GetBookingsWP <= 1.1.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31de209-e8fa-4bf6-bb29-d9a73ce0546b?source=api-prod","affected":[{"type":"plugin","slug":"get-bookings-wp","name":"GetBookingsWP \u2013 Appointments Booking Calendar Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T14:22:51Z"},{"id":"wordfence:c31de71e-254a-4ae1-a4f1-0922c26d4154","source":"wordfence","cve":"CVE-2026-57816","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.15.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31de71e-254a-4ae1-a4f1-0922c26d4154?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.8","to_inclusive":true,"patched_in":"3.15.0.9"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:33:14Z"},{"id":"wordfence:c31e9400-ee59-4c7e-a52f-e0774c0d9af8","source":"wordfence","cve":"CVE-2025-25104","title":"URL-Preview-Box <= 1.20 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c31e9400-ee59-4c7e-a52f-e0774c0d9af8?source=api-prod","affected":[{"type":"plugin","slug":"good-url-preview-box","name":"URL-Preview-Box","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:19:03Z"},{"id":"wordfence:c320e437-c1b4-4ccf-9dfd-55ba9c810534","source":"wordfence","cve":"","title":"Download Monitor <= 1.9.6 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c320e437-c1b4-4ccf-9dfd-55ba9c810534?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2017-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c322841a-4134-4c21-8028-0ccacd46335b","source":"wordfence","cve":"CVE-2021-24808","title":"BP Better Messages <= 1.9.9.37 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c322841a-4134-4c21-8028-0ccacd46335b?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.9.41","to_inclusive":false,"patched_in":"1.9.9.41"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3248327-6e10-420e-83cf-a23296eb2e6f","source":"wordfence","cve":"CVE-2024-2381","title":"AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3248327-6e10-420e-83cf-a23296eb2e6f?source=api-prod","affected":[{"type":"plugin","slug":"ali2woo-lite","name":"AliNext \u2013 AliExpress Dropshipping Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2024-06-18T14:28:33Z","updated":"2024-08-01T20:30:22Z"},{"id":"wordfence:c3261392-abf5-4410-bac1-56934d9d6178","source":"wordfence","cve":"CVE-2026-96835","title":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.85 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3261392-abf5-4410-bac1-56934d9d6178?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.85","to_inclusive":true,"patched_in":"51.1.86"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:39:10Z"},{"id":"wordfence:c32649f8-2d1b-4067-a7f1-9bb2d3fe17e4","source":"wordfence","cve":"CVE-2026-78273","title":"Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c32649f8-2d1b-4067-a7f1-9bb2d3fe17e4?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards-pro","name":"Fluent Boards Pro","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T20:47:47Z"},{"id":"wordfence:c3277d93-4f47-445b-a193-ff990b55d054","source":"wordfence","cve":"CVE-2023-6491","title":"Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3277d93-4f47-445b-a193-ff990b55d054?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2024-06-06T00:00:00Z","updated":"2024-07-29T21:37:21Z"},{"id":"wordfence:c32824cc-8895-462f-bd5b-03b8da4db680","source":"wordfence","cve":"CVE-2018-5362","title":"WPGlobus \u2013 Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][page]","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c32824cc-8895-462f-bd5b-03b8da4db680?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus","name":"WPGlobus","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c328cdb2-2ca9-4bad-9d6d-be10e0cb3765","source":"wordfence","cve":"CVE-2025-30904","title":"Chartify <= 3.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c328cdb2-2ca9-4bad-9d6d-be10e0cb3765?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:28:48Z"},{"id":"wordfence:c329767e-7699-4860-9782-4a27ec1d3596","source":"wordfence","cve":"CVE-2025-52771","title":"Video Expander <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c329767e-7699-4860-9782-4a27ec1d3596?source=api-prod","affected":[{"type":"plugin","slug":"video-expander","name":"Video Expander","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:45:11Z"},{"id":"wordfence:c32a71d6-d61c-4f6f-9d35-70140235af7c","source":"wordfence","cve":"CVE-2025-14039","title":"Simple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c32a71d6-d61c-4f6f-9d35-70140235af7c?source=api-prod","affected":[{"type":"plugin","slug":"simple-folio","name":"Simple Folio","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-28T06:43:44Z"},{"id":"wordfence:c32ba2a0-a9a7-4f17-8169-912cecc40b7b","source":"wordfence","cve":"CVE-2026-1730","title":"OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c32ba2a0-a9a7-4f17-8169-912cecc40b7b?source=api-prod","affected":[{"type":"plugin","slug":"os-datahub-maps","name":"OS DataHub Maps","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2026-02-02T18:50:54Z","updated":"2026-02-03T07:31:26Z"},{"id":"wordfence:c32f1c6a-cf65-419e-bfcd-48ac8e3735bc","source":"wordfence","cve":"CVE-2023-25457","title":"Slider Carousel \u2013 Responsive Image Slider <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c32f1c6a-cf65-419e-bfcd-48ac8e3735bc?source=api-prod","affected":[{"type":"plugin","slug":"slider-images","name":"Slider Carousel \u2013 Image Slider","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3319993-6f2c-425d-8cb2-ab26f7a52139","source":"wordfence","cve":"","title":"Client Portal <= 1.1.8 - Cross-Site Request Forgery via cp_create_private_pages_for_all_users","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3319993-6f2c-425d-8cb2-ab26f7a52139?source=api-prod","affected":[{"type":"plugin","slug":"client-portal","name":"Client Portal \u2013 Private user pages and login","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c339bf65-c522-4954-8aed-275c51298aea","source":"wordfence","cve":"CVE-2026-2396","title":"List View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c339bf65-c522-4954-8aed-275c51298aea?source=api-prod","affected":[{"type":"plugin","slug":"list-view-google-calendar","name":"List View Google Calendar","from":"*","from_inclusive":true,"to":"7.4.3","to_inclusive":true,"patched_in":"7.4.4"}],"published":"2026-04-14T11:14:32Z","updated":"2026-04-14T23:26:07Z"},{"id":"wordfence:c33b51bb-d368-4056-97f2-03543c4e9f8c","source":"wordfence","cve":"CVE-2024-29906","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33b51bb-d368-4056-97f2-03543c4e9f8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:28:00Z"},{"id":"wordfence:c33ba940-14cf-4df7-bf41-cdac3890c0be","source":"wordfence","cve":"CVE-2025-31914","title":"Pixel WordPress Form BuilderPlugin & Autoresponder <= 1.0.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33ba940-14cf-4df7-bf41-cdac3890c0be?source=api-prod","affected":[{"type":"plugin","slug":"pixel-formbuilder","name":"Pixel WordPress Form BuilderPlugin & Autoresponder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-26T15:11:05Z"},{"id":"wordfence:c33d9295-0c7f-45a0-9d62-4293c8bbef0b","source":"wordfence","cve":"CVE-2024-2401","title":"Admin Page Spider <= 3.31 -  Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33d9295-0c7f-45a0-9d62-4293c8bbef0b?source=api-prod","affected":[{"type":"plugin","slug":"admin-page-spider","name":"Admin Page Spider","from":"*","from_inclusive":true,"to":"3.31","to_inclusive":true,"patched_in":"3.32"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-16T13:49:43Z"},{"id":"wordfence:c33d972f-921b-4b93-a20d-f3f7f6cbd3d4","source":"wordfence","cve":"CVE-2024-32594","title":"Attesa Extra <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33d972f-921b-4b93-a20d-f3f7f6cbd3d4?source=api-prod","affected":[{"type":"plugin","slug":"attesa-extra","name":"Attesa Extra","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-23T15:43:44Z"},{"id":"wordfence:c33ec58f-3e83-425a-9f0f-5e529be15e05","source":"wordfence","cve":"CVE-2025-11128","title":"Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33ec58f-3e83-425a-9f0f-5e529be15e05?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-23T12:32:34Z"},{"id":"wordfence:c33f8b0d-97d9-4d00-bd31-444ee2afbfe6","source":"wordfence","cve":"CVE-2024-43951","title":"Tempera <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c33f8b0d-97d9-4d00-bd31-444ee2afbfe6?source=api-prod","affected":[{"type":"theme","slug":"tempera","name":"Tempera","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:12:44Z"},{"id":"wordfence:c3403cd6-31ba-4c36-a60e-d3e5c038af78","source":"wordfence","cve":"CVE-2026-109973","title":"Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3403cd6-31ba-4c36-a60e-d3e5c038af78?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate-visual-composer","name":"Flipbox \u2013 Awesomes Flip Boxes Image Overlay","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2026-11-07T00:15:12Z","updated":"2026-11-07T12:27:07Z"},{"id":"wordfence:c340b7c0-35ab-4707-a999-261a721a9a37","source":"wordfence","cve":"CVE-2021-24306","title":"Ultimate Member <= 2.1.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c340b7c0-35ab-4707-a999-261a721a9a37?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":false,"patched_in":"2.1.20"}],"published":"2021-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c341a720-4abd-4ef0-a076-0c62a4cf503a","source":"wordfence","cve":"CVE-2025-46244","title":"Advanced Linked Variations for Woocommerce <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c341a720-4abd-4ef0-a076-0c62a4cf503a?source=api-prod","affected":[{"type":"plugin","slug":"linked-variation","name":"Linked Variations for WooCommerce \u2013 Link Separate Products by Attribute with Swatches, Quick View & Shortcodes","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:28:00Z"},{"id":"wordfence:c341adcf-7072-4c07-b1f1-94e46d4cc09e","source":"wordfence","cve":"CVE-2025-32275","title":"Survey Maker <= 5.1.6.3 - Unauthenticated Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c341adcf-7072-4c07-b1f1-94e46d4cc09e?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.6.3","to_inclusive":true,"patched_in":"5.1.6.4"}],"published":"2025-04-07T00:00:00Z","updated":"2025-05-21T13:43:00Z"},{"id":"wordfence:c342fe87-59f3-43e9-8694-cc2551650a91","source":"wordfence","cve":"","title":"Fusion Engage <= 1.0.5 - Local File Inclusion","severity":"medium","cvss":5.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c342fe87-59f3-43e9-8694-cc2551650a91?source=api-prod","affected":[{"type":"plugin","slug":"fusion-engage","name":"Fusion Engage","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2015-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c343cee6-909d-4c1a-a6e4-f916a2ae223e","source":"wordfence","cve":"CVE-2024-1365","title":"YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c343cee6-909d-4c1a-a6e4-f916a2ae223e?source=api-prod","affected":[{"type":"plugin","slug":"yml-for-yandex-market","name":"YML for Yandex Market","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2024-02-23T00:00:00Z","updated":"2024-05-31T15:30:54Z"},{"id":"wordfence:c346b7d8-d1d4-473d-9388-e38631658c78","source":"wordfence","cve":"CVE-2025-12065","title":"WP Carticon <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c346b7d8-d1d4-473d-9388-e38631658c78?source=api-prod","affected":[{"type":"plugin","slug":"wp-carticon","name":"WP Carticon","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:28:25Z","updated":"2025-11-04T04:27:21Z"},{"id":"wordfence:c3489038-2833-4080-b802-5733afab5de8","source":"wordfence","cve":"CVE-2024-3731","title":"Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3489038-2833-4080-b802-5733afab5de8?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.47.0","to_inclusive":true,"patched_in":"5.48.0"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T02:34:44Z"},{"id":"wordfence:c34b21da-6c35-4eec-826b-47dc46575971","source":"wordfence","cve":"CVE-2022-1894","title":"Popup Builder <= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c34b21da-6c35-4eec-826b-47dc46575971?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.1.10","to_inclusive":true,"patched_in":"4.1.11"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c34bc6b9-7c70-4ccc-b265-2919e39a3bcb","source":"wordfence","cve":"CVE-2025-60234","title":"Single Property <= 2.8 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c34bc6b9-7c70-4ccc-b265-2919e39a3bcb?source=api-prod","affected":[{"type":"theme","slug":"single-property","name":"Single Property WordPress Theme - Moore","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-11-04T18:15:44Z"},{"id":"wordfence:c34ca97f-d974-4ad1-b4a5-93613eb43a37","source":"wordfence","cve":"CVE-2024-10667","title":"Content Slider Block \u2013 Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ca97f-d974-4ad1-b4a5-93613eb43a37?source=api-prod","affected":[{"type":"plugin","slug":"content-slider-block","name":"Content Slider Block \u2013 Bring your content to life with slides","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T04:32:27Z"},{"id":"wordfence:c34ce601-5cf9-433f-bc9d-5c705eba6b08","source":"wordfence","cve":"CVE-2023-1844","title":"Subscribe2 <= 10.40 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ce601-5cf9-433f-bc9d-5c705eba6b08?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.40","to_inclusive":true,"patched_in":"10.41"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c34ef5e3-afcd-4686-861f-5e382812233a","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route","severity":"medium","cvss":4.3,"cwe":"CWE-1021","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ef5e3-afcd-4686-861f-5e382812233a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:47:57Z"},{"id":"wordfence:c3508b46-6920-48b9-9acb-620ea34e07e2","source":"wordfence","cve":"","title":"Branda \u2013 White Label WordPress <= 3.4.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3508b46-6920-48b9-9acb-620ea34e07e2?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.8.1","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c355658a-515a-48ed-a114-6a202e23e34b","source":"wordfence","cve":"CVE-2026-92975","title":"Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c355658a-515a-48ed-a114-6a202e23e34b?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.9"}],"published":"2026-10-09T17:14:41Z","updated":"2026-11-05T18:43:04Z"},{"id":"wordfence:c35652d0-c527-4b5c-bccb-daa6fb970434","source":"wordfence","cve":"CVE-2024-51865","title":"Simple Social Share Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c35652d0-c527-4b5c-bccb-daa6fb970434?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-share-block","name":"Simple Social Share Block","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:08:09Z"},{"id":"wordfence:c357e34f-2d0f-4af4-bb67-cbbc6cd4e141","source":"wordfence","cve":"","title":"Hreflang Manager <= 1.06 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c357e34f-2d0f-4af4-bb67-cbbc6cd4e141?source=api-prod","affected":[{"type":"plugin","slug":"hreflang-manager-lite","name":"Hreflang Manager \u2013 Hreflang Implementation for International SEO","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":"1.07"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c35bffb2-f805-48d6-938a-cb5142eac3b1","source":"wordfence","cve":"","title":"Fontiran <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c35bffb2-f805-48d6-938a-cb5142eac3b1?source=api-prod","affected":[{"type":"plugin","slug":"fontiran","name":"Fontiran","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c35ed3ef-49bd-4f64-bb0f-2abedb7b978e","source":"wordfence","cve":"CVE-2021-24675","title":"One User Avatar <= 2.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c35ed3ef-49bd-4f64-bb0f-2abedb7b978e?source=api-prod","affected":[{"type":"plugin","slug":"one-user-avatar","name":"One User Avatar | User Profile Picture","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c35efa26-9400-47f1-80c3-e86ca29c6b47","source":"wordfence","cve":"CVE-2020-36173","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c35efa26-9400-47f1-80c3-e86ca29c6b47?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.27.1","to_inclusive":true,"patched_in":"3.4.28"}],"published":"2020-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c35fcd14-b116-40c3-a12b-0183bc0e11f4","source":"wordfence","cve":"CVE-2026-115811","title":"Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c35fcd14-b116-40c3-a12b-0183bc0e11f4?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.16","to_inclusive":true,"patched_in":"3.3.17"}],"published":"2026-11-06T18:16:08Z","updated":"2026-11-07T06:39:41Z"},{"id":"wordfence:c3613f95-8338-40b8-8b16-2714fa3474ce","source":"wordfence","cve":"CVE-2021-24657","title":"Limit Login Attempts <= 4.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3613f95-8338-40b8-8b16-2714fa3474ce?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-limit-login-attempts","name":"Limit Login Attempts","from":"*","from_inclusive":true,"to":"4.0.50","to_inclusive":false,"patched_in":"4.0.50"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c36181aa-39c2-4009-b687-5964a6cc45c8","source":"wordfence","cve":"CVE-2022-1937","title":"Awin Data Feed <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c36181aa-39c2-4009-b687-5964a6cc45c8?source=api-prod","affected":[{"type":"plugin","slug":"awin-data-feed","name":"Awin Data Feed","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c366e14c-fa0e-4099-99d7-00f75874e1a2","source":"wordfence","cve":"CVE-2024-50556","title":"WM Zoom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c366e14c-fa0e-4099-99d7-00f75874e1a2?source=api-prod","affected":[{"type":"plugin","slug":"wm-zoom","name":"WM Zoom","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:20:31Z"},{"id":"wordfence:c3678b4d-0cd0-4873-8cf3-90c557931f4c","source":"wordfence","cve":"CVE-2026-4609","title":"ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3678b4d-0cd0-4873-8cf3-90c557931f4c?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.4","to_inclusive":true,"patched_in":"5.9.8.5"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T13:27:58Z"},{"id":"wordfence:c367eaed-7e0f-4143-9c88-bc22622f3a77","source":"wordfence","cve":"CVE-2025-57992","title":"Mail Baby SMTP <= 2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c367eaed-7e0f-4143-9c88-bc22622f3a77?source=api-prod","affected":[{"type":"plugin","slug":"mail-baby-smtp","name":"Mail Baby SMTP","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-20T19:16:58Z"},{"id":"wordfence:c36b0d08-7289-4410-adfb-99dbe1ac4c03","source":"wordfence","cve":"CVE-2025-32622","title":"OTP-less one tap Sign in <= 2.0.58 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c36b0d08-7289-4410-adfb-99dbe1ac4c03?source=api-prod","affected":[{"type":"plugin","slug":"otpless","name":"OTP-less one tap Sign in","from":"*","from_inclusive":true,"to":"2.0.58","to_inclusive":true,"patched_in":"2.0.59"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:36:09Z"},{"id":"wordfence:c36bc98b-2e31-4a6b-a529-6d7849db4b3e","source":"wordfence","cve":"CVE-2026-10082","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c36bc98b-2e31-4a6b-a529-6d7849db4b3e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T21:45:49Z"},{"id":"wordfence:c3717e03-9a18-48a1-97d3-1d41c7f93261","source":"wordfence","cve":"CVE-2024-10861","title":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3717e03-9a18-48a1-97d3-1d41c7f93261?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-16T02:02:31Z"},{"id":"wordfence:c3728280-3487-4cb2-8e37-f33811bc0a22","source":"wordfence","cve":"CVE-2023-0715","title":"Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folder","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3728280-3487-4cb2-8e37-f33811bc0a22?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c37413a4-720c-4546-b1b6-119eccf0831f","source":"wordfence","cve":"CVE-2025-53449","title":"Convex <= 1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c37413a4-720c-4546-b1b6-119eccf0831f?source=api-prod","affected":[{"type":"theme","slug":"convex","name":"Convex - Architecture & Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:27:32Z"},{"id":"wordfence:c37686f8-6bd7-4c06-b80a-7d6849bbc7b0","source":"wordfence","cve":"CVE-2023-41242","title":"Snap Pixel <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c37686f8-6bd7-4c06-b80a-7d6849bbc7b0?source=api-prod","affected":[{"type":"plugin","slug":"snap-pixel","name":"Pixel Integration for Snapchat","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-08-29T00:00:00Z","updated":"2025-08-01T13:57:36Z"},{"id":"wordfence:c3773a2d-50c7-4414-a93f-493d32b97b08","source":"wordfence","cve":"CVE-2026-110135","title":"OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3773a2d-50c7-4414-a93f-493d32b97b08?source=api-prod","affected":[{"type":"plugin","slug":"mobile-login-woocommerce","name":"OTP Login & Register Woocommerce","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:46:48Z"},{"id":"wordfence:c3799c76-2b25-4346-948e-14445d93b7f1","source":"wordfence","cve":"CVE-2024-13543","title":"Zarinpal Paid Downloads <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3799c76-2b25-4346-948e-14445d93b7f1?source=api-prod","affected":[{"type":"plugin","slug":"zarinpal-paid-downloads","name":"Zarinpal Paid Download","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-21T00:00:00Z","updated":"2025-01-30T22:10:48Z"},{"id":"wordfence:c37bbb3b-5ef4-4604-9b0e-256dde546b4b","source":"wordfence","cve":"CVE-2025-32527","title":"T&P Gallery Slider <= 1.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c37bbb3b-5ef4-4604-9b0e-256dde546b4b?source=api-prod","affected":[{"type":"plugin","slug":"tp-gallery-slider","name":"T&P Gallery Slider","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:21:00Z"},{"id":"wordfence:c37bfdeb-2d0c-4ace-94cc-b85c16985994","source":"wordfence","cve":"CVE-2023-32959","title":"Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c37bfdeb-2d0c-4ace-94cc-b85c16985994?source=api-prod","affected":[{"type":"theme","slug":"kathmag","name":"Kathmag","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"online-estore","name":"Online eStore","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"spidermag","name":"SpiderMag","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"medical-heed","name":"Medical Heed","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"},{"type":"theme","slug":"appzend","name":"Appzend","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"theme","slug":"buzzstore","name":"BuzzStore","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"craft-blog","name":"Craft Blog","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"fitness-park","name":"Fitness Park","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"kingcabs","name":"Kingcabs","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"},{"type":"theme","slug":"metrostore","name":"MetroStore","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"},{"type":"theme","slug":"sparklestore","name":"SparkleStore","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-05-16T00:00:00Z","updated":"2024-11-07T14:35:08Z"},{"id":"wordfence:c37d8218-6059-46f2-a5d9-d7c22486211e","source":"wordfence","cve":"CVE-2023-6737","title":"Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c37d8218-6059-46f2-a5d9-d7c22486211e?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.5"}],"published":"2023-12-18T00:00:00Z","updated":"2024-07-29T21:37:22Z"},{"id":"wordfence:c3802a0a-92fe-4ae0-a0ca-05f82cf69101","source":"wordfence","cve":"CVE-2026-9710","title":"Cornerstone < 7.8.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3802a0a-92fe-4ae0-a0ca-05f82cf69101?source=api-prod","affected":[{"type":"plugin","slug":"cornerstone","name":"Cornerstone","from":"*","from_inclusive":true,"to":"7.8.8","to_inclusive":false,"patched_in":"7.8.8"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-28T16:13:59Z"},{"id":"wordfence:c380b630-7378-43a9-8b8d-85d27b904ad4","source":"wordfence","cve":"CVE-2026-32423","title":"Admin and Site Enhancements (ASE) <= 8.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c380b630-7378-43a9-8b8d-85d27b904ad4?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"8.4.0","to_inclusive":true,"patched_in":"8.4.1"}],"published":"2026-02-27T00:00:00Z","updated":"2026-04-15T21:02:09Z"},{"id":"wordfence:c384d6c2-8aba-48ce-b989-66bcaa3ec4bf","source":"wordfence","cve":"CVE-2025-67962","title":"Broken Link Checker <= 1.2.6 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c384d6c2-8aba-48ce-b989-66bcaa3ec4bf?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker-seo","name":"Broken Link Checker by AIOSEO \u2013 Find & Fix Broken Internal, External & Video Links","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-12-09T00:00:00Z","updated":"2025-12-19T17:18:33Z"},{"id":"wordfence:c3851607-73e7-44ae-8d5b-e8b7460851ea","source":"wordfence","cve":"CVE-2026-15739","title":"Rich Showcase for Google Reviews <= 6.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pagination' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3851607-73e7-44ae-8d5b-e8b7460851ea?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"6.9.10"}],"published":"2026-07-23T19:00:45Z","updated":"2026-07-24T07:53:36Z"},{"id":"wordfence:c3854d33-e9c5-4e35-93e3-5d4989b59413","source":"wordfence","cve":"CVE-2026-25452","title":"Remoji \u2013 Post/Comment Reaction and Enhancement <= 2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3854d33-e9c5-4e35-93e3-5d4989b59413?source=api-prod","affected":[{"type":"plugin","slug":"remoji","name":"Remoji \u2013 Post/Comment Reaction and Enhancement","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-03-17T00:00:00Z","updated":"2026-07-08T20:46:58Z"},{"id":"wordfence:c3871a1e-513a-4bc4-a90d-a46cb56780d7","source":"wordfence","cve":"CVE-2025-54007","title":"Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3871a1e-513a-4bc4-a90d-a46cb56780d7?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:47:43Z"},{"id":"wordfence:c389ba1a-45c5-4fba-9b99-0713fe39da42","source":"wordfence","cve":"CVE-2025-3300","title":"WPMasterToolKit (WPMTK) \u2013 All in one plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c389ba1a-45c5-4fba-9b99-0713fe39da42?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-04-23T19:54:09Z","updated":"2025-04-30T13:39:24Z"},{"id":"wordfence:c38a5e59-3233-4b37-bd6f-baf5dc9f9a01","source":"wordfence","cve":"CVE-2018-12895","title":"WordPress Core < 4.9.7 - Authenticated Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38a5e59-3233-4b37-bd6f-baf5dc9f9a01?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.26","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.26","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.24","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.23","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.20","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.16","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.15","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.11","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.10","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"3.7.27"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"3.7.27"}],"published":"2018-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c38ac30d-95dc-415e-8ea6-507ed87d34db","source":"wordfence","cve":"CVE-2023-46607","title":"WP iCal Availability <= 1.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38ac30d-95dc-415e-8ea6-507ed87d34db?source=api-prod","affected":[{"type":"plugin","slug":"wp-ical-availability","name":"WP iCal Availability","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c38ac8d6-c6de-4be7-bf7b-198e085a0ad2","source":"wordfence","cve":"CVE-2024-11733","title":"WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38ac8d6-c6de-4be7-bf7b-198e085a0ad2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2025-01-03T10:02:32Z","updated":"2025-01-03T22:22:06Z"},{"id":"wordfence:c38b6cce-ea8b-48f3-a995-173047d1caf8","source":"wordfence","cve":"CVE-2014-4855","title":"Polylang <= 1.5.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38b6cce-ea8b-48f3-a995-173047d1caf8?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":false,"patched_in":"1.5.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c38eaab5-157c-43fa-ad67-6f063274ba69","source":"wordfence","cve":"CVE-2024-6560","title":"Addonify \u2013 Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38eaab5-157c-43fa-ad67-6f063274ba69?source=api-prod","affected":[{"type":"plugin","slug":"addonify-quick-view","name":"Addonify \u2013 Quick View For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T02:37:15Z"},{"id":"wordfence:c38ee04a-52db-478b-8e4d-790e7beadd28","source":"wordfence","cve":"CVE-2025-25080","title":"Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c38ee04a-52db-478b-8e4d-790e7beadd28?source=api-prod","affected":[{"type":"plugin","slug":"kona-instagram-feed-for-gutenberg","name":"Kona Gallery Block","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:21:59Z"},{"id":"wordfence:c390192d-0c90-4877-914b-1af16783695f","source":"wordfence","cve":"CVE-2025-23849","title":"PAPERCITE <= 0.5.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c390192d-0c90-4877-914b-1af16783695f?source=api-prod","affected":[{"type":"plugin","slug":"papercite","name":"PAPERCITE","from":"*","from_inclusive":true,"to":"0.5.18","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-19T16:16:37Z"},{"id":"wordfence:c3915c2f-400d-433d-bbc8-4d88258123dc","source":"wordfence","cve":"CVE-2023-32793","title":"WooCommerce Pre-Orders <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3915c2f-400d-433d-bbc8-4d88258123dc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pre-orders","name":"WooCommerce Pre-Orders","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3917e62-6d94-4dc6-9324-1188fc072250","source":"wordfence","cve":"CVE-2026-13416","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3917e62-6d94-4dc6-9324-1188fc072250?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.18","to_inclusive":false,"patched_in":"4.1.18"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T15:11:41Z"},{"id":"wordfence:c3920232-8711-472b-a93f-6461556b0fb9","source":"wordfence","cve":"CVE-2026-39767","title":"WPBase Cache <= 5.5.6 - Authenticated (Subscriber+) Denial of Service","severity":"medium","cvss":6.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3920232-8711-472b-a93f-6461556b0fb9?source=api-prod","affected":[{"type":"plugin","slug":"wpbase-cache","name":"WPBase Cache","from":"*","from_inclusive":true,"to":"5.5.6","to_inclusive":true,"patched_in":"5.5.7"}],"published":"2026-10-05T16:31:42Z","updated":"2026-10-28T21:17:20Z"},{"id":"wordfence:c392750b-ae4a-48b5-9ccb-43852fb13e27","source":"wordfence","cve":"CVE-2021-4371","title":"WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c392750b-ae4a-48b5-9ccb-43852fb13e27?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-front-end-editor","name":"WP Quick FrontEnd Editor \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2021-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3938bbb-dc3d-4550-a05d-0cde970e38f8","source":"wordfence","cve":"CVE-2025-13088","title":"Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3938bbb-dc3d-4550-a05d-0cde970e38f8?source=api-prod","affected":[{"type":"plugin","slug":"category-and-product-woocommerce-tabs","name":"Category and Product Woocommerce Tabs","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:16:17Z","updated":"2025-11-18T08:27:36Z"},{"id":"wordfence:c394295f-d1b5-48be-978f-f15a6b56e40f","source":"wordfence","cve":"CVE-2022-2887","title":"WP Server Health Stats <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c394295f-d1b5-48be-978f-f15a6b56e40f?source=api-prod","affected":[{"type":"plugin","slug":"wp-server-stats","name":"WP Server Health Stats","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2022-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c394b8b6-b7f6-4ba7-8a2b-98160cc286a8","source":"wordfence","cve":"CVE-2024-9946","title":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c394b8b6-b7f6-4ba7-8a2b-98160cc286a8?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.13.68","to_inclusive":true,"patched_in":"7.14"}],"published":"2024-11-05T00:00:00Z","updated":"2025-02-19T17:43:46Z"},{"id":"wordfence:c394c9bc-21f6-45ea-8eda-8ee22a9b87ba","source":"wordfence","cve":"CVE-2026-15394","title":"Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c394c9bc-21f6-45ea-8eda-8ee22a9b87ba?source=api-prod","affected":[{"type":"plugin","slug":"header-and-footer-script-adder","name":"Header Footer Script Adder","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-07-22T20:46:45Z","updated":"2026-07-23T09:33:58Z"},{"id":"wordfence:c3950275-be21-44b2-8751-ac8c9bb35a04","source":"wordfence","cve":"CVE-2026-94669","title":"Fluent Forms Pro Add On Pack <= 6.2.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3950275-be21-44b2-8751-ac8c9bb35a04?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"6.2.14"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:38:23Z"},{"id":"wordfence:c3978cb6-1739-4671-bb98-17c409c67d1c","source":"wordfence","cve":"CVE-2023-40213","title":"Justified Gallery <= 1.7.3 - Missing Authorization via 'dismiss_how_to_use_notice' and 'dismiss_notice'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3978cb6-1739-4671-bb98-17c409c67d1c?source=api-prod","affected":[{"type":"plugin","slug":"justified-gallery","name":"Justified Gallery","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c399687c-bb00-4b72-a17f-e3bf04918259","source":"wordfence","cve":"CVE-2018-20152","title":"WordPress Core < 5.0.1 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c399687c-bb00-4b72-a17f-e3bf04918259?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c39c1b72-e3e0-44fb-8fb8-602cb0aa61e3","source":"wordfence","cve":"CVE-2025-12844","title":"AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization","severity":"high","cvss":7.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c39c1b72-e3e0-44fb-8fb8-602cb0aa61e3?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-11-12T00:00:00Z","updated":"2025-11-13T07:27:55Z"},{"id":"wordfence:c39d16f1-ce80-402c-8a36-f9070dc5f9c9","source":"wordfence","cve":"CVE-2026-3835","title":"Prevent Direct Access \u2013 Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c39d16f1-ce80-402c-8a36-f9070dc5f9c9?source=api-prod","affected":[{"type":"plugin","slug":"prevent-direct-access","name":"Prevent Direct Access \u2013 Protect WordPress Files","from":"*","from_inclusive":true,"to":"2.8.8.8","to_inclusive":true,"patched_in":"2.8.8.9"}],"published":"2026-08-12T17:04:24Z","updated":"2026-08-13T05:29:19Z"},{"id":"wordfence:c39dc38c-1440-46f1-9b56-cc0711ae2b31","source":"wordfence","cve":"CVE-2026-27092","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c39dc38c-1440-46f1-9b56-cc0711ae2b31?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-01-07T00:00:00Z","updated":"2026-04-15T13:33:32Z"},{"id":"wordfence:c39fa559-8dcb-474e-a23f-91b91a209fab","source":"wordfence","cve":"CVE-2026-81788","title":"IMPress for IDX Broker <= 3.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c39fa559-8dcb-474e-a23f-91b91a209fab?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:27:34Z"},{"id":"wordfence:c3a381da-0dac-4b7f-8da8-46bb81c88f12","source":"wordfence","cve":"CVE-2026-52700","title":"WCMultiShipping \u2014 Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a381da-0dac-4b7f-8da8-46bb81c88f12?source=api-prod","affected":[{"type":"plugin","slug":"wc-multishipping","name":"WCMultiShipping \u2014 Mondial Relay, Inpost & Chronopost for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-15T19:21:40Z"},{"id":"wordfence:c3a647b6-ed9e-402d-9424-2937f7aa8960","source":"wordfence","cve":"CVE-2024-12859","title":"BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a647b6-ed9e-402d-9424-2937f7aa8960?source=api-prod","affected":[{"type":"plugin","slug":"boombox-theme-extensions","name":"BoomBox Theme Extensions","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-03T19:22:49Z"},{"id":"wordfence:c3a80bcd-170b-469b-b090-8f806f87b8d7","source":"wordfence","cve":"CVE-2026-103424","title":"Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a80bcd-170b-469b-b090-8f806f87b8d7?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.88","to_inclusive":true,"patched_in":"6.89"}],"published":"2026-10-09T15:35:34Z","updated":"2026-10-10T04:26:47Z"},{"id":"wordfence:c3a993fb-cec5-4a36-9f92-3defff0ab11b","source":"wordfence","cve":"CVE-2024-39655","title":"LiquidPoll \u2013 Advanced Polls for Creators and Brands <= 3.3.77 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a993fb-cec5-4a36-9f92-3defff0ab11b?source=api-prod","affected":[{"type":"plugin","slug":"wp-poll","name":"LiquidPoll \u2013 Polls, Surveys, NPS and Feedback Reviews","from":"*","from_inclusive":true,"to":"3.3.77","to_inclusive":true,"patched_in":"3.3.78"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:16:07Z"},{"id":"wordfence:c3abb96e-6ee2-4992-a122-9f661da9a4d6","source":"wordfence","cve":"CVE-2026-110590","title":"Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=api-prod","affected":[{"type":"plugin","slug":"klarna-payments-for-woocommerce","name":"Klarna for WooCommerce","from":"*","from_inclusive":true,"to":"4.13.3","to_inclusive":true,"patched_in":"4.13.4"}],"published":"2026-10-15T15:50:36Z","updated":"2026-10-29T18:26:56Z"},{"id":"wordfence:c3adf367-0126-4d95-b337-cc3581975113","source":"wordfence","cve":"CVE-2024-11052","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3adf367-0126-4d95-b337-cc3581975113?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.19","to_inclusive":true,"patched_in":"3.8.20"}],"published":"2024-12-11T16:24:17Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:c3afcac7-9900-463d-9cb9-f00c10ea47cf","source":"wordfence","cve":"CVE-2024-11638","title":"Gtbabel <= 6.6.8  - Unauthenticated Cookie Stealing","severity":"high","cvss":7.5,"cwe":"CWE-614","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3afcac7-9900-463d-9cb9-f00c10ea47cf?source=api-prod","affected":[{"type":"plugin","slug":"gtbabel","name":"Gtbabel","from":"*","from_inclusive":true,"to":"6.6.8","to_inclusive":true,"patched_in":"6.6.9"}],"published":"2025-02-17T00:00:00Z","updated":"2025-03-11T14:03:11Z"},{"id":"wordfence:c3b0c2c0-4eaf-4158-94e1-0cfb60310a1d","source":"wordfence","cve":"CVE-2024-51699","title":"Buooy Sticky Header <= 0.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3b0c2c0-4eaf-4158-94e1-0cfb60310a1d?source=api-prod","affected":[{"type":"plugin","slug":"buooy-sticky-header","name":"Buooy Sticky Header","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:50:10Z"},{"id":"wordfence:c3b1ff70-7e37-4f74-bd72-ecda81d13d83","source":"wordfence","cve":"CVE-2024-43308","title":"Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3b1ff70-7e37-4f74-bd72-ecda81d13d83?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2024-08-16T00:00:00Z","updated":"2024-09-12T14:54:30Z"},{"id":"wordfence:c3b42bd3-f7d3-43d1-bdd8-4389fd82e1e9","source":"wordfence","cve":"CVE-2007-0233","title":"WordPress Core < 2.0.7 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3b42bd3-f7d3-43d1-bdd8-4389fd82e1e9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2007-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3b6c3ab-529d-44f2-b901-ea720cbc3fbc","source":"wordfence","cve":"CVE-2016-10889","title":"NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion & SQL injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3b6c3ab-529d-44f2-b901-ea720cbc3fbc?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.56","to_inclusive":true,"patched_in":"2.1.57"}],"published":"2016-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3baf3d4-6989-4b74-8207-cac0ffd68317","source":"wordfence","cve":"CVE-2026-118639","title":"Surfer <= 1.8.1.758 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3baf3d4-6989-4b74-8207-cac0ffd68317?source=api-prod","affected":[{"type":"plugin","slug":"surferseo","name":"Surfer \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.8.1.758","to_inclusive":true,"patched_in":"1.8.1.759"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:24:14Z"},{"id":"wordfence:c3bcc8aa-3c2d-4036-bdf5-7042d7aaa5d5","source":"wordfence","cve":"CVE-2026-14938","title":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.95.3 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3bcc8aa-3c2d-4036-bdf5-7042d7aaa5d5?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"1.95.3","to_inclusive":false,"patched_in":"1.95.3"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:27:15Z"},{"id":"wordfence:c3bdc0c4-34fb-43cc-ba2b-340347bca146","source":"wordfence","cve":"CVE-2023-33998","title":"Easy Social Icons <= 3.2.4 - Missing Authorization via cnss_save_ajax_order","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3bdc0c4-34fb-43cc-ba2b-340347bca146?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3be87da-aa57-45f6-b58f-c58c92ea65a2","source":"wordfence","cve":"CVE-2026-27362","title":"Bakery Autoresponder Addon <= 1.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3be87da-aa57-45f6-b58f-c58c92ea65a2?source=api-prod","affected":[{"type":"plugin","slug":"vc-autoresponder-addon","name":"Bakery Autoresponder Addon","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:45:07Z"},{"id":"wordfence:c3c2d1cf-de15-4e7e-8c95-508b21e461a8","source":"wordfence","cve":"CVE-2025-49383","title":"Neresa <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c2d1cf-de15-4e7e-8c95-508b21e461a8?source=api-prod","affected":[{"type":"theme","slug":"neresa-wp","name":"Neresa - Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:29:31Z"},{"id":"wordfence:c3c5a2b6-9df1-45e9-832d-53e4a397aebf","source":"wordfence","cve":"CVE-2025-64357","title":"Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c5a2b6-9df1-45e9-832d-53e4a397aebf?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2025-10-30T00:00:00Z","updated":"2025-12-20T20:34:08Z"},{"id":"wordfence:c3c6f5cd-e724-4337-9d8b-79e48df9a76b","source":"wordfence","cve":"CVE-2025-69329","title":"Prestige < 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c6f5cd-e724-4337-9d8b-79e48df9a76b?source=api-prod","affected":[{"type":"theme","slug":"prestige","name":"Prestige","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:52:12Z"},{"id":"wordfence:c3c80120-c0b2-4bf7-87ec-1277106171c5","source":"wordfence","cve":"CVE-2025-32485","title":"WP Performance Pack <= 2.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c80120-c0b2-4bf7-87ec-1277106171c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-performance-pack","name":"WP Performance Pack","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:05:25Z"},{"id":"wordfence:c3c8cc17-2bda-413f-95dc-18c7a883ccea","source":"wordfence","cve":"CVE-2024-5071","title":"Bookster \u2013 WordPress Appointment Booking Plugin <= 1.1.0 - Unauthenticated Appointment Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c8cc17-2bda-413f-95dc-18c7a883ccea?source=api-prod","affected":[{"type":"plugin","slug":"bookster","name":"Bookster \u2013 Appointment Booking Management System","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-10T14:52:53Z"},{"id":"wordfence:c3c961eb-0174-4aa3-a117-7f72998eefbb","source":"wordfence","cve":"CVE-2018-5667","title":"Read and Understood <= 2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3c961eb-0174-4aa3-a117-7f72998eefbb?source=api-prod","affected":[{"type":"plugin","slug":"read-and-understood","name":"Read and Understood","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3ca06c0-6a7d-43ee-ac59-698e0f525e23","source":"wordfence","cve":"CVE-2026-15304","title":"Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ca06c0-6a7d-43ee-ac59-698e0f525e23?source=api-prod","affected":[{"type":"plugin","slug":"plugin-organizer","name":"Plugin Organizer","from":"*","from_inclusive":true,"to":"10.2.4","to_inclusive":true,"patched_in":"10.2.5"}],"published":"2026-07-27T20:32:04Z","updated":"2026-07-28T18:35:51Z"},{"id":"wordfence:c3ca0a37-f2e3-4403-83ca-7dd2924e317d","source":"wordfence","cve":"CVE-2025-49451","title":"Aeroscroll Gallery \u2013 Infinite Scroll Image Gallery & Post Grid with Photo Gallery <= 1.0.12 - Unauthenticated Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ca0a37-f2e3-4403-83ca-7dd2924e317d?source=api-prod","affected":[{"type":"plugin","slug":"aeroscroll-gallery","name":"Aeroscroll Gallery \u2013 Infinite Scroll Image Gallery & Post Grid with Photo Gallery","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-17T15:21:30Z"},{"id":"wordfence:c3cc20d7-bdb7-4591-a9ff-4e17e9b3ad9c","source":"wordfence","cve":"CVE-2026-57792","title":"D\u00f8r - Modern Architecture and Interior Design Theme <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3cc20d7-bdb7-4591-a9ff-4e17e9b3ad9c?source=api-prod","affected":[{"type":"theme","slug":"dor","name":"D\u00f8r - Modern Architecture and Interior Design Theme","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:36:08Z"},{"id":"wordfence:c3ccde73-8b88-48f9-8bbd-0392fcc40c81","source":"wordfence","cve":"CVE-2024-39651","title":"WooCommerce PDF Vouchers <= 4.9.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ccde73-8b88-48f9-8bbd-0392fcc40c81?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-vouchers","name":"WooCommerce - PDF Vouchers","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:29:52Z"},{"id":"wordfence:c3ce0b74-cc65-4ea9-9fcc-d7bcd00bb67f","source":"wordfence","cve":"CVE-2025-24574","title":"PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ce0b74-cc65-4ea9-9fcc-d7bcd00bb67f?source=api-prod","affected":[{"type":"plugin","slug":"pepro-bacs-receipt-upload-for-woocommerce","name":"PeproDev Receipt Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-12-13T00:00:00Z","updated":"2026-04-15T20:53:41Z"},{"id":"wordfence:c3d0f9e9-29f5-4d74-814b-bad0fc535e1c","source":"wordfence","cve":"CVE-2024-34767","title":"ShopLentor <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d0f9e9-29f5-4d74-814b-bad0fc535e1c?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-21T10:26:17Z"},{"id":"wordfence:c3d2425e-69e5-4efe-bbc6-0ef121e74341","source":"wordfence","cve":"CVE-2026-15052","title":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d2425e-69e5-4efe-bbc6-0ef121e74341?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-07-31T19:41:41Z","updated":"2026-08-01T07:49:51Z"},{"id":"wordfence:c3d2c9a4-32f7-484f-86ce-a33ef1174b28","source":"wordfence","cve":"CVE-2023-4840","title":"MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d2c9a4-32f7-484f-86ce-a33ef1174b28?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.88.4","to_inclusive":true,"patched_in":"2.88.5"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3d356d1-2f6d-42e0-b774-6384872c0a90","source":"wordfence","cve":"CVE-2016-10992","title":"Music Store <= 1.0.41 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d356d1-2f6d-42e0-b774-6384872c0a90?source=api-prod","affected":[{"type":"plugin","slug":"music-store","name":"Music Store \u2013 WordPress eCommerce","from":"*","from_inclusive":true,"to":"1.0.41","to_inclusive":true,"patched_in":"1.0.43"}],"published":"2016-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3d40868-267f-4875-81ea-09e18010670a","source":"wordfence","cve":"CVE-2024-37432","title":"Esteem <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d40868-267f-4875-81ea-09e18010670a?source=api-prod","affected":[{"type":"theme","slug":"esteem","name":"Esteem","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-09-03T16:39:00Z"},{"id":"wordfence:c3d42b22-cf8f-4726-9188-4c7baf8e5200","source":"wordfence","cve":"CVE-2024-56043","title":"WPLMS <= 1.9.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d42b22-cf8f-4726-9188-4c7baf8e5200?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.9.1"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:01:38Z"},{"id":"wordfence:c3d5f51f-6abd-49d0-b8cd-bbe518787ab8","source":"wordfence","cve":"CVE-2014-6313","title":"WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter","severity":"high","cvss":7.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d5f51f-6abd-49d0-b8cd-bbe518787ab8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2014-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3d62ac3-7980-4817-ab22-e5d0a6a10d84","source":"wordfence","cve":"CVE-2025-5565","title":"Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d62ac3-7980-4817-ab22-e5d0a6a10d84?source=api-prod","affected":[{"type":"plugin","slug":"hide-it","name":"Hide It","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:48:02Z","updated":"2025-06-06T06:42:53Z"},{"id":"wordfence:c3d7728f-7c25-4505-8db3-b67a5c17a439","source":"wordfence","cve":"","title":"Post Connector <= 1.0.3 and Post Conector Premium <= 1.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d7728f-7c25-4505-8db3-b67a5c17a439?source=api-prod","affected":[{"type":"plugin","slug":"post-connector-pro","name":"Post Connector Premium","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":false,"patched_in":"1.6.4"},{"type":"plugin","slug":"post-connector","name":"Post Connector","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3d7a587-042d-4ba1-9373-aaeb24c711f5","source":"wordfence","cve":"CVE-2024-43239","title":"Masteriyo - LMS <= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d7a587-042d-4ba1-9373-aaeb24c711f5?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.11.4","to_inclusive":true,"patched_in":"1.11.5"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T14:51:44Z"},{"id":"wordfence:c3d808f8-07e7-4dcc-8a64-b0dfd6dbec27","source":"wordfence","cve":"CVE-2026-87792","title":"Design Scuole Italia <= 2.17.3 -  Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3d808f8-07e7-4dcc-8a64-b0dfd6dbec27?source=api-prod","affected":[{"type":"plugin","slug":"design-scuole-wordpress-theme","name":"design-scuole-wordpress-theme","from":"1.0","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-16T17:56:07Z"},{"id":"wordfence:c3da10da-8de3-4547-abe4-202002728c80","source":"wordfence","cve":"CVE-2021-21389","title":"BuddyPress 5.0.0-7.2.0 - Privilege Escalation via REST API","severity":"high","cvss":8.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3da10da-8de3-4547-abe4-202002728c80?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"5.0.0","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2021-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3db93fa-13a1-47aa-b7c2-deef1516c5e7","source":"wordfence","cve":"CVE-2026-57729","title":"Flatsome <= 3.20.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3db93fa-13a1-47aa-b7c2-deef1516c5e7?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:40:53Z"},{"id":"wordfence:c3dbae56-d28f-4d57-848d-8cf0d0c0cffc","source":"wordfence","cve":"CVE-2026-57721","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.6.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dbae56-d28f-4d57-848d-8cf0d0c0cffc?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.6.7.6","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:43:28Z"},{"id":"wordfence:c3dd6240-bb39-49a3-b012-773a831d2034","source":"wordfence","cve":"CVE-2024-56216","title":"Themify Builder <= 7.6.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dd6240-bb39-49a3-b012-773a831d2034?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.5"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:10:05Z"},{"id":"wordfence:c3dfb0b7-5d9f-492b-9a1a-d4445d39c00c","source":"wordfence","cve":"CVE-2024-7417","title":"Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dfb0b7-5d9f-492b-9a1a-d4445d39c00c?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.986","to_inclusive":true,"patched_in":"1.3.987"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T03:32:51Z"},{"id":"wordfence:c3e47d14-4c00-4b10-9e4d-7f1d7946a2b4","source":"wordfence","cve":"CVE-2024-31236","title":"Royal Elementor Addons <= 1.3.93 - Authenticated (Contributor+) Stored Cross-Site Scriting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3e47d14-4c00-4b10-9e4d-7f1d7946a2b4?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.93","to_inclusive":true,"patched_in":"1.3.95"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:51:35Z"},{"id":"wordfence:c3e6ae84-4270-42ad-b024-b367be9a7f14","source":"wordfence","cve":"CVE-2025-67938","title":"Biagiotti < 3.5.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3e6ae84-4270-42ad-b024-b367be9a7f14?source=api-prod","affected":[{"type":"theme","slug":"biagiotti","name":"Biagiotti","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":false,"patched_in":"3.5.2"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T16:09:25Z"},{"id":"wordfence:c3e7539c-e18f-444c-9d10-92450b6e2e03","source":"wordfence","cve":"CVE-2025-60077","title":"YayPricing <= 3.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3e7539c-e18f-444c-9d10-92450b6e2e03?source=api-prod","affected":[{"type":"plugin","slug":"yaypricing","name":"YayPricing \u2013 WooCommerce Dynamic Pricing & Discounts","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-08-29T00:00:00Z","updated":"2026-01-06T18:45:56Z"},{"id":"wordfence:c3e98eb0-3c56-46fd-839e-ff530d431e8d","source":"wordfence","cve":"CVE-2026-7558","title":"Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3e98eb0-3c56-46fd-839e-ff530d431e8d?source=api-prod","affected":[{"type":"plugin","slug":"token-of-trust","name":"Age Verification & Identity Verification by Token of Trust","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-07-08T17:45:10Z","updated":"2026-07-09T06:52:49Z"},{"id":"wordfence:c3ea04ba-b609-49cd-aae8-68f5b51df154","source":"wordfence","cve":"CVE-2024-9232","title":"Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ea04ba-b609-49cd-aae8-68f5b51df154?source=api-prod","affected":[{"type":"plugin","slug":"download-plugins-dashboard","name":"Download Plugins and Themes in ZIP from Dashboard","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:21Z"},{"id":"wordfence:c3ea4bf9-e109-465e-890a-c2923089fb66","source":"wordfence","cve":"CVE-2024-5637","title":"Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ea4bf9-e109-465e-890a-c2923089fb66?source=api-prod","affected":[{"type":"plugin","slug":"market-exporter","name":"Market Exporter","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T11:02:21Z"},{"id":"wordfence:c3eb3444-de5c-4cb0-acaa-c6303fab46e0","source":"wordfence","cve":"CVE-2024-12265","title":"Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3eb3444-de5c-4cb0-acaa-c6303fab46e0?source=api-prod","affected":[{"type":"plugin","slug":"depay-payments-for-woocommerce","name":"Web3 Crypto Payments by DePay for WooCommerce","from":"*","from_inclusive":true,"to":"2.12.17","to_inclusive":true,"patched_in":"2.12.18"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:c3ec1155-a055-4eb2-8c6a-cae591ad6f87","source":"wordfence","cve":"CVE-2026-102399","title":"Photo Gallery \u2013 Responsive Image Galleries by Supsystic <= 1.21.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ec1155-a055-4eb2-8c6a-cae591ad6f87?source=api-prod","affected":[{"type":"plugin","slug":"gallery-by-supsystic","name":"Photo Gallery by Supsystic \u2013 Image Gallery, Masonry, Albums & Lightbox","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:41:52Z"},{"id":"wordfence:c3ec4978-0d51-4ca1-b0cf-81aaa4d43f7b","source":"wordfence","cve":"CVE-2026-15759","title":"ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ec4978-0d51-4ca1-b0cf-81aaa4d43f7b?source=api-prod","affected":[{"type":"plugin","slug":"chat-help","name":"ChatHelp \u2013 Click to Chat Button, Chat to Order for WooCommerce & Floating Chat Form","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-07-16T15:14:24Z","updated":"2026-07-17T03:43:42Z"},{"id":"wordfence:c3ecda09-ecee-4e97-ae6f-92d52b0589e5","source":"wordfence","cve":"CVE-2025-58674","title":"WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ecda09-ecee-4e97-ae6f-92d52b0589e5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.30","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.26","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.27","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.23","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.20","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.22","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.19","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.17","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.16","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.15","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.13","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.11","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.10","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.8","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6","from_inclusive":true,"to":"6.6.3","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.3","to_inclusive":true,"patched_in":"4.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.2","to_inclusive":true,"patched_in":"4.7.31"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:25:17Z"},{"id":"wordfence:c3ecf521-e7e6-476b-8aaf-6d2d2b66f3d4","source":"wordfence","cve":"CVE-2026-27356","title":"MC4WP: Mailchimp for WordPress <= 4.14.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ecf521-e7e6-476b-8aaf-6d2d2b66f3d4?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2026-11-06T22:30:00Z","updated":"2026-11-10T20:04:29Z"},{"id":"wordfence:c3ecf638-dfc4-4e9d-bca8-cd008227e934","source":"wordfence","cve":"CVE-2023-4798","title":"User Avatar \u2013 Reloaded <= 1.2.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ecf638-dfc4-4e9d-bca8-cd008227e934?source=api-prod","affected":[{"type":"plugin","slug":"user-avatar-reloaded","name":"User Avatar \u2013 Reloaded","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3ede2bc-15a6-4194-a963-d176cb0fc612","source":"wordfence","cve":"CVE-2024-43290","title":"Atarim <= 4.0.1 - Missing Authorization via remove_feedbacktool_notice()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3ede2bc-15a6-4194-a963-d176cb0fc612?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:04:50Z"},{"id":"wordfence:c3efae8f-ca89-4d8c-a177-6793994b3ea0","source":"wordfence","cve":"CVE-2026-15345","title":"ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efae8f-ca89-4d8c-a177-6793994b3ea0?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.11.5","to_inclusive":true,"patched_in":"3.11.6"}],"published":"2026-08-15T16:26:13Z","updated":"2026-08-16T05:27:30Z"},{"id":"wordfence:c3efb7b1-5230-40f9-a8a0-3712916284be","source":"wordfence","cve":"CVE-2024-27994","title":"YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efb7b1-5230-40f9-a8a0-3712916284be?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T21:17:31Z"},{"id":"wordfence:c3efbd9d-e2b5-4915-a964-29a49c7fba86","source":"wordfence","cve":"CVE-2023-1172","title":"Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"21.5","from_inclusive":true,"to":"21.5","to_inclusive":true,"patched_in":"21.5.1"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3f0032e-a6f4-47f5-b3eb-6f1c9bf9670c","source":"wordfence","cve":"CVE-2023-1025","title":"Simple File List <= 6.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f0032e-a6f4-47f5-b3eb-6f1c9bf9670c?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.0.9","to_inclusive":true,"patched_in":"6.0.10"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3f07ebf-5e8b-42ea-853e-9b28784b14a5","source":"wordfence","cve":"CVE-2025-31851","title":"Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f07ebf-5e8b-42ea-853e-9b28784b14a5?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.27","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:39:34Z"},{"id":"wordfence:c3f0ff27-49d7-4aa0-aa00-2853eadecddb","source":"wordfence","cve":"CVE-2026-9767","title":"The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f0ff27-49d7-4aa0-aa00-2853eadecddb?source=api-prod","affected":[{"type":"plugin","slug":"school-management-system","name":"The School Management \u2013 Education & Learning ERP","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2026-08-15T17:21:51Z","updated":"2026-08-16T05:27:31Z"},{"id":"wordfence:c3f13f7a-95ed-4f90-8c65-7a4318a8b542","source":"wordfence","cve":"CVE-2025-49387","title":"Drag and Drop File Upload for Elementor Forms <= 1.5.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f13f7a-95ed-4f90-8c65-7a4318a8b542?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-for-elementor-forms","name":"Drag and Drop File Upload for Elementor Forms","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:20:23Z"},{"id":"wordfence:c3f37ef5-ddf5-4bd5-b6aa-121dda22fb01","source":"wordfence","cve":"CVE-2024-1792","title":"CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f37ef5-ddf5-4bd5-b6aa-121dda22fb01?source=api-prod","affected":[{"type":"plugin","slug":"cmb2","name":"CMB2","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-09T18:59:20Z"},{"id":"wordfence:c3f3e56e-bbb6-4ceb-811d-447ed837d176","source":"wordfence","cve":"CVE-2018-3810","title":"Smart Google Code Inserter < 3.5 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f3e56e-bbb6-4ceb-811d-447ed837d176?source=api-prod","affected":[{"type":"plugin","slug":"smart-google-code-inserter","name":"Smart Google Code Inserter","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":false,"patched_in":"3.5"}],"published":"2018-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3f50771-f889-4de9-9d43-a736c4c24efc","source":"wordfence","cve":"CVE-2013-6243","title":"WordPress Landing Pages < 1.2.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f50771-f889-4de9-9d43-a736c4c24efc?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2013-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c3f6e326-c815-4acf-8393-1fd33e84d996","source":"wordfence","cve":"CVE-2026-34894","title":"Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f6e326-c815-4acf-8393-1fd33e84d996?source=api-prod","affected":[{"type":"plugin","slug":"integrio-core","name":"Integrio Core","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:30:22Z"},{"id":"wordfence:c3f71792-63dd-4ba7-8aac-3a3fed3baa95","source":"wordfence","cve":"CVE-2026-78262","title":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f71792-63dd-4ba7-8aac-3a3fed3baa95?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2026-08-24T13:23:47Z","updated":"2026-09-10T19:30:04Z"},{"id":"wordfence:c3f9898b-0aa0-4dd1-9298-96c853dbef5c","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3f9898b-0aa0-4dd1-9298-96c853dbef5c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:30:40Z"},{"id":"wordfence:c3fa13d6-e8c7-4f89-8dc2-d2be0055830b","source":"wordfence","cve":"CVE-2025-32129","title":"Welcome Bar <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3fa13d6-e8c7-4f89-8dc2-d2be0055830b?source=api-prod","affected":[{"type":"plugin","slug":"intelly-welcome-bar","name":"Welcome Bar","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-08-14T15:13:58Z"},{"id":"wordfence:c3fa6ad5-fae4-42d8-b11c-a1e870200944","source":"wordfence","cve":"CVE-2025-49275","title":"Blogbyte <= 1.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c3fa6ad5-fae4-42d8-b11c-a1e870200944?source=api-prod","affected":[{"type":"theme","slug":"blogbyte","name":"Blogbyte","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:36:00Z"},{"id":"wordfence:c4006612-770a-482f-a8c2-e62f607914a9","source":"wordfence","cve":"CVE-2024-0201","title":"Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4006612-770a-482f-a8c2-e62f607914a9?source=api-prod","affected":[{"type":"plugin","slug":"product-expiry-for-woocommerce","name":"Product Expiry for WooCommerce","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2024-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4039a27-0100-49c5-8dce-cf015a08ef04","source":"wordfence","cve":"","title":"ContentStudio <= 1.1.8 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4039a27-0100-49c5-8dce-cf015a08ef04?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4048480-25a8-449f-8edb-a2a8854425ff","source":"wordfence","cve":"CVE-2025-24710","title":"Gwolle Guestbook <= 4.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4048480-25a8-449f-8edb-a2a8854425ff?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:45:45Z"},{"id":"wordfence:c4067e03-427c-4b03-a250-0354572ae361","source":"wordfence","cve":"CVE-2023-47853","title":"myCred <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4067e03-427c-4b03-a250-0354572ae361?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4073c20-e5ca-4978-86a4-7715ba2921bb","source":"wordfence","cve":"CVE-2024-54270","title":"Axeptio <= 2.5.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4073c20-e5ca-4978-86a4-7715ba2921bb?source=api-prod","affected":[{"type":"plugin","slug":"axeptio-sdk-integration","name":"Axeptio \u2013 Cookie Banner \u2013 GDPR Consent & Compliance with a friendly touch","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-06T15:34:38Z"},{"id":"wordfence:c40752df-1337-475b-8b5e-0d171946bfe9","source":"wordfence","cve":"CVE-2023-2742","title":"AI ChatBot <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c40752df-1337-475b-8b5e-0d171946bfe9?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4098a47-986c-4b2c-b27a-18ff81da0f58","source":"wordfence","cve":"CVE-2023-51362","title":"All-in-one Floating Contact Form \u2013 My Sticky Elements <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4098a47-986c-4b2c-b27a-18ff81da0f58?source=api-prod","affected":[{"type":"plugin","slug":"mystickyelements","name":"All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs  \u2013 My Sticky Elements","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c40bf215-81c1-423a-9d41-9a231dfc8053","source":"wordfence","cve":"CVE-2023-24379","title":"Landing Page Builder \u2013 Free Landing Page Templates <= 3.1.9.8 - Local File Inclusion via 'lpp_template_select'","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c40bf215-81c1-423a-9d41-9a231dfc8053?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-landing-page","name":"Landing Page Builder \u2013 Free Landing Page Templates","from":"*","from_inclusive":true,"to":"3.1.9.8","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c40e0582-b471-415a-aedc-10e3f44d2ce8","source":"wordfence","cve":"CVE-2025-57994","title":"Upcoming Events Lists <= 1.4.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c40e0582-b471-415a-aedc-10e3f44d2ce8?source=api-prod","affected":[{"type":"plugin","slug":"upcoming-events-lists","name":"Upcoming Events Lists","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:10:01Z"},{"id":"wordfence:c41651ce-ee9b-408f-a25f-113d71beb935","source":"wordfence","cve":"CVE-2025-10305","title":"Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41651ce-ee9b-408f-a25f-113d71beb935?source=api-prod","affected":[{"type":"plugin","slug":"secure-passkeys","name":"Secure Passkeys","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-09-19T00:00:00Z","updated":"2025-09-20T04:27:56Z"},{"id":"wordfence:c4192a7f-b962-46f9-a524-7271ed6f4917","source":"wordfence","cve":"CVE-2026-2373","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1049","to_inclusive":true,"patched_in":"1.7.1050"}],"published":"2026-03-16T15:17:51Z","updated":"2026-03-17T03:36:25Z"},{"id":"wordfence:c41993f5-f502-489c-8ca7-2d591b3ee88a","source":"wordfence","cve":"CVE-2026-120043","title":"Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41993f5-f502-489c-8ca7-2d591b3ee88a?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2026-11-06T15:34:20Z","updated":"2026-11-07T04:27:14Z"},{"id":"wordfence:c41aadb1-e1a6-4bda-ac94-c461c320e78f","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break","severity":"low","cvss":3.7,"cwe":"CWE-116","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41aadb1-e1a6-4bda-ac94-c461c320e78f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.7.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.7.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:45:52Z"},{"id":"wordfence:c41b0370-2881-4053-98b1-9c70251a3b63","source":"wordfence","cve":"CVE-2026-9626","title":"JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41b0370-2881-4053-98b1-9c70251a3b63?source=api-prod","affected":[{"type":"plugin","slug":"json-api-user","name":"JSON API User","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2026-07-02T15:54:16Z","updated":"2026-07-03T04:30:19Z"},{"id":"wordfence:c41b6c52-4da8-427b-8f5d-6a3339dad3cd","source":"wordfence","cve":"CVE-2025-11927","title":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41b6c52-4da8-427b-8f5d-6a3339dad3cd?source=api-prod","affected":[{"type":"plugin","slug":"nazy-load","name":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T04:27:42Z"},{"id":"wordfence:c41e5b9b-09ec-4336-81e6-379af8c745e8","source":"wordfence","cve":"CVE-2026-84770","title":"Mang Board WP <= 2.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c41e5b9b-09ec-4336-81e6-379af8c745e8?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:36:04Z"},{"id":"wordfence:c42139fc-34a2-47ae-b172-d2cd4f1cf098","source":"wordfence","cve":"CVE-2026-77824","title":"Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42139fc-34a2-47ae-b172-d2cd4f1cf098?source=api-prod","affected":[{"type":"plugin","slug":"media-sweep","name":"Media Sweep \u2013 WordPress Media Cleaner","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-08-24T22:27:18Z","updated":"2026-08-25T11:27:12Z"},{"id":"wordfence:c42203bc-3f69-44d2-b165-abb55937f65b","source":"wordfence","cve":"CVE-2014-5201","title":"Gallery Objects <= 0.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42203bc-3f69-44d2-b165-abb55937f65b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-objects","name":"gallery-objects","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2014-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c42428c6-5d9d-4679-91fe-8ec6f3a3bf9e","source":"wordfence","cve":"CVE-2018-16159","title":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.1.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42428c6-5d9d-4679-91fe-8ec6f3a3bf9e?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":false,"patched_in":"4.1.8"}],"published":"2018-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4250395-3709-47cd-86d4-e6a1fec10298","source":"wordfence","cve":"CVE-2024-2428","title":"The Ultimate Video Player For WordPress <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4250395-3709-47cd-86d4-e6a1fec10298?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-03-20T00:00:00Z","updated":"2024-03-29T18:03:25Z"},{"id":"wordfence:c4285590-9c2f-4189-8b47-09378d8a2432","source":"wordfence","cve":"CVE-2025-3815","title":"SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4285590-9c2f-4189-8b47-09378d8a2432?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.12.32","to_inclusive":true,"patched_in":"1.12.33"}],"published":"2025-05-02T19:04:18Z","updated":"2025-05-03T07:22:57Z"},{"id":"wordfence:c42b646f-7a41-416b-8632-d088b8d0cb7c","source":"wordfence","cve":"CVE-2011-5307","title":"Photosmash Plugin < 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42b646f-7a41-416b-8632-d088b8d0cb7c?source=api-prod","affected":[{"type":"plugin","slug":"photosmash-galleries","name":"photosmash-galleries","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2011-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c42d78a1-c855-4b19-840a-42d5f0851381","source":"wordfence","cve":"CVE-2026-103998","title":"Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42d78a1-c855-4b19-840a-42d5f0851381?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.48","to_inclusive":true,"patched_in":"1.15.49"}],"published":"2026-10-09T15:48:32Z","updated":"2026-10-10T04:26:48Z"},{"id":"wordfence:c42f56a2-b9f9-40ef-86ad-fea6cf2e29f8","source":"wordfence","cve":"CVE-2023-4938","title":"BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c42f56a2-b9f9-40ef-86ad-fea6cf2e29f8?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.1.3.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c432c094-fe56-4f52-ace9-f5b47e69cf99","source":"wordfence","cve":"CVE-2025-68563","title":"Subscribe to Unlock Lite <= 1.3.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c432c094-fe56-4f52-ace9-f5b47e69cf99?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-unlock-lite","name":"Subscribe to Unlock Lite \u2013 Opt In Content Locker Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-05T18:51:21Z"},{"id":"wordfence:c434e6b8-0dd5-4ffe-93b1-1af614c08f85","source":"wordfence","cve":"CVE-2021-4369","title":"Frontend File Manager <= 18.2 - Unauthenticated Content Injection","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c434e6b8-0dd5-4ffe-93b1-1af614c08f85?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"18.3","to_inclusive":false,"patched_in":"18.3"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4351ae8-7e9e-47fd-8733-2159711664af","source":"wordfence","cve":"CVE-2025-62741","title":"Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4351ae8-7e9e-47fd-8733-2159711664af?source=api-prod","affected":[{"type":"theme","slug":"pool-services","name":"Pool Services WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-27T00:00:00Z","updated":"2026-01-15T17:02:00Z"},{"id":"wordfence:c43c060b-7a18-49ee-a753-ae1ed2f7e04d","source":"wordfence","cve":"CVE-2026-6933","title":"Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c43c060b-7a18-49ee-a753-ae1ed2f7e04d?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-dev-tools","name":"Premmerce Dev Tools","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T16:26:34Z","updated":"2026-06-16T04:30:16Z"},{"id":"wordfence:c43c8c01-3f8a-4ae4-8113-d410850e721d","source":"wordfence","cve":"CVE-2021-36890","title":"Social Share Buttons by Supsystic <= 2.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c43c8c01-3f8a-4ae4-8113-d410850e721d?source=api-prod","affected":[{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2022-05-27T13:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c43e292b-8344-4842-bed1-32e7f8cb992b","source":"wordfence","cve":"CVE-2020-15020","title":"Elementor Website Builder <= 2.9.13 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c43e292b-8344-4842-bed1-32e7f8cb992b?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.14","to_inclusive":false,"patched_in":"2.9.14"}],"published":"2020-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c43e5a7c-136a-4d24-b47c-cb94ca9cb1f5","source":"wordfence","cve":"CVE-2026-40804","title":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c43e5a7c-136a-4d24-b47c-cb94ca9cb1f5?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.18.0"}],"published":"2026-10-06T00:00:00Z","updated":"2026-11-10T23:21:10Z"},{"id":"wordfence:c43f4c91-329d-46b9-b2c8-f35e5baa38d7","source":"wordfence","cve":"CVE-2024-13710","title":"Estatebud \u2013 Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c43f4c91-329d-46b9-b2c8-f35e5baa38d7?source=api-prod","affected":[{"type":"plugin","slug":"estatebud-properties-listings","name":"Estatebud \u2013 Properties & Listings","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T19:32:36Z","updated":"2025-03-25T08:22:15Z"},{"id":"wordfence:c441d113-cc3b-4be4-9e6f-10907c682c3d","source":"wordfence","cve":"CVE-2025-22629","title":"iNET Webkit <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c441d113-cc3b-4be4-9e6f-10907c682c3d?source=api-prod","affected":[{"type":"plugin","slug":"inet-webkit","name":"iNET Webkit","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-18T20:24:17Z"},{"id":"wordfence:c44232a9-7b97-449c-b584-ca3c26d63581","source":"wordfence","cve":"CVE-2026-1649","title":"Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c44232a9-7b97-449c-b584-ca3c26d63581?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-02-17T20:16:41Z","updated":"2026-02-18T08:26:05Z"},{"id":"wordfence:c446f429-1981-4d6d-a5ec-a5837428d212","source":"wordfence","cve":"CVE-2024-1168","title":"SEOPress \u2013 On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c446f429-1981-4d6d-a5ec-a5837428d212?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"7.9","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2024-06-19T13:31:27Z","updated":"2024-06-20T18:44:15Z"},{"id":"wordfence:c4470c03-64fc-46d9-b224-de5a3149c3d5","source":"wordfence","cve":"CVE-2023-49153","title":"Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 - Cross-Site Request Forgery via wactc_text_form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4470c03-64fc-46d9-b224-de5a3149c3d5?source=api-prod","affected":[{"type":"plugin","slug":"woo-add-to-cart-text-change","name":"Add to Cart Text Changer and Customize Button, Add Custom Icon","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-11T08:56:22Z"},{"id":"wordfence:c4498d0a-32f2-4747-88bd-0f85312b4653","source":"wordfence","cve":"CVE-2026-15794","title":"Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4498d0a-32f2-4747-88bd-0f85312b4653?source=api-prod","affected":[{"type":"plugin","slug":"gridlist-view-for-woocommerce","name":"Grid/List View for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.9.1"}],"published":"2026-07-22T20:26:43Z","updated":"2026-07-23T08:34:41Z"},{"id":"wordfence:c44b7ded-e67d-4185-92de-78a82f409333","source":"wordfence","cve":"CVE-2025-64381","title":"Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c44b7ded-e67d-4185-92de-78a82f409333?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.7","to_inclusive":true,"patched_in":"10.14.8"}],"published":"2025-11-13T00:00:00Z","updated":"2025-11-17T18:30:37Z"},{"id":"wordfence:c44b9eb6-96a8-4e19-b4c1-72a69b9f159f","source":"wordfence","cve":"CVE-2015-5599","title":"Powerplay Gallery <= 3.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c44b9eb6-96a8-4e19-b4c1-72a69b9f159f?source=api-prod","affected":[{"type":"plugin","slug":"wp-powerplaygallery","name":"Powerplay Gallery","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2015-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c44c1a50-e282-4a5b-8b7f-1021c9d6f58e","source":"wordfence","cve":"CVE-2024-9116","title":"Monkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c44c1a50-e282-4a5b-8b7f-1021c9d6f58e?source=api-prod","affected":[{"type":"plugin","slug":"monkee-boy-wp-essentials","name":"Monkee-Boy Essentials","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T20:36:56Z","updated":"2024-10-26T09:35:20Z"},{"id":"wordfence:c44e7178-790c-42ab-ac87-9a678e7b38d8","source":"wordfence","cve":"CVE-2025-26753","title":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.1.10 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c44e7178-790c-42ab-ac87-9a678e7b38d8?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-03-03T21:09:26Z"},{"id":"wordfence:c4518d6e-2f56-4e12-a11f-24914fee9ace","source":"wordfence","cve":"CVE-2025-52761","title":"WP Funnel Manager <= 1.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4518d6e-2f56-4e12-a11f-24914fee9ace?source=api-prod","affected":[{"type":"plugin","slug":"wp-funnel-manager","name":"WP Funnel Manager","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-08-20T00:00:00Z","updated":"2026-04-25T15:34:16Z"},{"id":"wordfence:c4528b63-8d8e-44a4-a71f-2ad1636ac93c","source":"wordfence","cve":"CVE-2024-2030","title":"Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4528b63-8d8e-44a4-a71f-2ad1636ac93c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-03-06T00:00:00Z","updated":"2024-05-31T15:30:54Z"},{"id":"wordfence:c453aaf6-767d-4929-bbb3-3c0b78b0507a","source":"wordfence","cve":"CVE-2024-12295","title":"BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password","severity":"high","cvss":8.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c453aaf6-767d-4929-bbb3-3c0b78b0507a?source=api-prod","affected":[{"type":"plugin","slug":"boombox-theme-extensions","name":"BoomBox Theme Extensions","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T04:21:07Z"},{"id":"wordfence:c454a958-91c4-4847-91f6-dedebf857964","source":"wordfence","cve":"CVE-2024-3269","title":"Download Monitor <= 4.9.13 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c454a958-91c4-4847-91f6-dedebf857964?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.9.13","to_inclusive":true,"patched_in":"4.9.14"}],"published":"2024-05-29T14:49:49Z","updated":"2024-05-30T03:34:30Z"},{"id":"wordfence:c4555cd1-5ae5-42b3-938f-ffce5ba4fe56","source":"wordfence","cve":"CVE-2024-5451","title":"The7 \u2014 Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4555cd1-5ae5-42b3-938f-ffce5ba4fe56?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"11.13.0","to_inclusive":true,"patched_in":"11.14.0"}],"published":"2024-06-24T21:29:55Z","updated":"2024-06-25T13:53:22Z"},{"id":"wordfence:c4580748-f5dc-4f05-81d2-a8e9b76a7a7d","source":"wordfence","cve":"CVE-2022-0380","title":"Fotobook <= 3.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4580748-f5dc-4f05-81d2-a8e9b76a7a7d?source=api-prod","affected":[{"type":"plugin","slug":"fotobook","name":"Fotobook","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c458e018-5901-4917-9847-35f07646e068","source":"wordfence","cve":"CVE-2026-15980","title":"MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token","severity":"critical","cvss":9.8,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e018-5901-4917-9847-35f07646e068?source=api-prod","affected":[{"type":"plugin","slug":"myhome-core","name":"MyHome Core","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2026-08-29T16:23:23Z","updated":"2026-08-30T04:25:48Z"},{"id":"wordfence:c458e6d6-28ba-4465-ace2-5da9e99ca2c7","source":"wordfence","cve":"CVE-2024-30245","title":"DecaLog <= 3.9.0 - Authenticated (Admin+) SQL injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e6d6-28ba-4465-ace2-5da9e99ca2c7?source=api-prod","affected":[{"type":"plugin","slug":"decalog","name":"DecaLog","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T20:09:13Z"},{"id":"wordfence:c45aea72-2c9d-484d-8904-a1985df4b57c","source":"wordfence","cve":"CVE-2025-2880","title":"Yame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c45aea72-2c9d-484d-8904-a1985df4b57c?source=api-prod","affected":[{"type":"plugin","slug":"yame-linkinbio","name":"Yame | Link In Bio","from":"*","from_inclusive":true,"to":"0.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T13:10:52Z","updated":"2025-05-02T01:43:36Z"},{"id":"wordfence:c45b6163-7ebf-4f18-afd6-735d02d9170d","source":"wordfence","cve":"CVE-2024-4082","title":"Joli FAQ SEO \u2013 WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c45b6163-7ebf-4f18-afd6-735d02d9170d?source=api-prod","affected":[{"type":"plugin","slug":"joli-faq-seo","name":"Joli FAQ SEO \u2013 WordPress FAQ Plugin","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:37Z"},{"id":"wordfence:c460e742-1008-4334-971c-999107851d62","source":"wordfence","cve":"CVE-2025-58627","title":"Miraculous Core < 2.0.9 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c460e742-1008-4334-971c-999107851d62?source=api-prod","affected":[{"type":"plugin","slug":"miraculouscore","name":"Miraculous Core","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2025-09-01T00:00:00Z","updated":"2025-11-11T17:19:35Z"},{"id":"wordfence:c4624846-3399-458b-8287-77553f43cd37","source":"wordfence","cve":"CVE-2025-62096","title":"Maximum Products per User for WooCommerce <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4624846-3399-458b-8287-77553f43cd37?source=api-prod","affected":[{"type":"plugin","slug":"maximum-products-per-user-for-woocommerce","name":"Maximum Products per User for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-08T21:14:04Z"},{"id":"wordfence:c462eb91-10f2-47d0-afeb-7ad7ba23c87e","source":"wordfence","cve":"CVE-2026-118088","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c462eb91-10f2-47d0-afeb-7ad7ba23c87e?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.5","to_inclusive":true,"patched_in":"3.13.6"}],"published":"2026-10-29T14:26:00Z","updated":"2026-11-03T19:44:22Z"},{"id":"wordfence:c463a1d4-14c8-460a-ad83-6f3b38f1e4e8","source":"wordfence","cve":"CVE-2025-14167","title":"Remove Post Type Slug <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c463a1d4-14c8-460a-ad83-6f3b38f1e4e8?source=api-prod","affected":[{"type":"plugin","slug":"remove-post-type-slug","name":"Remove Post Type Slug","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:59:41Z","updated":"2026-02-19T04:36:22Z"},{"id":"wordfence:c463ad1f-5522-41f2-8749-e19fcba46409","source":"wordfence","cve":"CVE-2025-25099","title":"Appointment Buddy Widget <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c463ad1f-5522-41f2-8749-e19fcba46409?source=api-prod","affected":[{"type":"plugin","slug":"appointment-buddy-online-appointment-booking-by-accrete","name":"Appointment Buddy Widget By Accrete","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:13:35Z"},{"id":"wordfence:c4654bed-3503-4b57-a09c-449184655bc6","source":"wordfence","cve":"CVE-2026-119489","title":"WP Recipe Maker <= 10.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4654bed-3503-4b57-a09c-449184655bc6?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.9.1","to_inclusive":true,"patched_in":"10.9.2"}],"published":"2026-11-07T08:55:00Z","updated":"2026-11-10T19:27:50Z"},{"id":"wordfence:c4665b87-e1f8-4a73-b6d6-1d5c14067b3a","source":"wordfence","cve":"CVE-2024-9239","title":"Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4665b87-e1f8-4a73-b6d6-1d5c14067b3a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.2.4"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:55Z"},{"id":"wordfence:c466c0ff-d84b-4536-bea7-ada2a80aad15","source":"wordfence","cve":"","title":"WordPress Share Buttons Plugin \u2013 AddThis < 2.2.0 - Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c466c0ff-d84b-4536-bea7-ada2a80aad15?source=api-prod","affected":[{"type":"plugin","slug":"addthis","name":"WordPress Share Buttons Plugin \u2013 AddThis","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2011-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4679fa7-be6b-4f50-8cdf-ff9822794f19","source":"wordfence","cve":"CVE-2024-10508","title":"RegistrationMagic \u2013 User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery","severity":"critical","cvss":9.8,"cwe":"CWE-230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4679fa7-be6b-4f50-8cdf-ff9822794f19?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.2.6","to_inclusive":true,"patched_in":"6.0.2.7"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T07:35:07Z"},{"id":"wordfence:c467a634-d5cf-4e80-9a64-009cdad2a684","source":"wordfence","cve":"CVE-2024-10825","title":"Hide My WP Ghost \u2013 Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c467a634-d5cf-4e80-9a64-009cdad2a684?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.3.01","to_inclusive":true,"patched_in":"5.3.02"}],"published":"2024-11-14T18:16:20Z","updated":"2024-11-15T06:48:04Z"},{"id":"wordfence:c468a56c-4411-49fc-8014-fc9b71a645c3","source":"wordfence","cve":"CVE-2024-32690","title":"RSS Feed Widget <= 2.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c468a56c-4411-49fc-8014-fc9b71a645c3?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T13:20:00Z"},{"id":"wordfence:c46b26c7-3302-4730-915c-1882b315600c","source":"wordfence","cve":"CVE-2019-6780","title":"Wise Chat <= 2.6.3 - Reverse Tabnabbing","severity":"medium","cvss":6.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46b26c7-3302-4730-915c-1882b315600c?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2019-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c46bcbd1-566d-4b21-84a1-f25e3df7ddc7","source":"wordfence","cve":"CVE-2024-1407","title":"Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46bcbd1-566d-4b21-84a1-f25e3df7ddc7?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.10","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-06-18T18:44:27Z","updated":"2024-06-19T06:55:48Z"},{"id":"wordfence:c46c47d8-e0cc-45fb-9771-bffcf8131426","source":"wordfence","cve":"CVE-2025-31785","title":"Clearbit Reveal <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46c47d8-e0cc-45fb-9771-bffcf8131426?source=api-prod","affected":[{"type":"plugin","slug":"clearbit","name":"Clearbit Reveal","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:05:32Z"},{"id":"wordfence:c46cf202-320b-40a0-9de0-e4992f23395f","source":"wordfence","cve":"CVE-2015-9405","title":"WP-Matomo Integration (WP-Piwik) < 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46cf202-320b-40a0-9de0-e4992f23395f?source=api-prod","affected":[{"type":"plugin","slug":"wp-piwik","name":"Connect Matomo \u2013 Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2015-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c46d71fb-ccf1-4cbe-8088-edb7fba225e9","source":"wordfence","cve":"CVE-2024-13354","title":"Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46d71fb-ccf1-4cbe-8088-edb7fba225e9?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:c46f66ee-28cf-4c4c-aaba-aacfad37ad89","source":"wordfence","cve":"CVE-2025-23906","title":"WordPress Dashboard Tweeter <= 1.3.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c46f66ee-28cf-4c4c-aaba-aacfad37ad89?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-dashboard-twitter","name":"WordPress Dashboard Tweeter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T21:15:07Z"},{"id":"wordfence:c47386ee-25c8-4a77-92e8-5a82afc9c826","source":"wordfence","cve":"CVE-2021-4416","title":"wp-mpdf <= 3.5.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c47386ee-25c8-4a77-92e8-5a82afc9c826?source=api-prod","affected":[{"type":"plugin","slug":"wp-mpdf","name":"wp-mpdf","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4740494-625f-49ff-967e-07f791ec3f1f","source":"wordfence","cve":"CVE-2025-29013","title":"Custom Category/Post Type Post order <= 1.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4740494-625f-49ff-967e-07f791ec3f1f?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-order-category","name":"Custom Category Post Order","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-17T14:04:03Z"},{"id":"wordfence:c4747f6c-d083-4f7e-a9ef-3dd9c8f6047b","source":"wordfence","cve":"CVE-2018-17884","title":"Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4747f6c-d083-4f7e-a9ef-3dd9c8f6047b?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2018-07-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c475c51e-f01d-4698-822f-5b8df999bf6d","source":"wordfence","cve":"CVE-2026-89424","title":"Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c475c51e-f01d-4698-822f-5b8df999bf6d?source=api-prod","affected":[{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2026-09-30T19:57:20Z","updated":"2026-10-01T08:28:46Z"},{"id":"wordfence:c47601b4-bf16-4f59-b5f3-584a8eac7c67","source":"wordfence","cve":"CVE-2024-0366","title":"Starbox \u2013 the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c47601b4-bf16-4f59-b5f3-584a8eac7c67?source=api-prod","affected":[{"type":"plugin","slug":"starbox","name":"Starbox \u2013 the Author Box for Humans","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-01-30T00:00:00Z","updated":"2024-07-29T21:37:22Z"},{"id":"wordfence:c476d9af-9060-4294-874a-86e550253d3b","source":"wordfence","cve":"CVE-2020-36722","title":"Visual Composer <= 26.0 - Multiple Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c476d9af-9060-4294-874a-86e550253d3b?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"26.0","to_inclusive":true,"patched_in":"27.0"}],"published":"2020-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4770184-1b96-490c-b506-f648ab3ed764","source":"wordfence","cve":"CVE-2024-3588","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4770184-1b96-490c-b506-f648ab3ed764?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:36Z"},{"id":"wordfence:c4772b32-a730-44f2-b43c-f9bd5abb6541","source":"wordfence","cve":"CVE-2026-4987","title":"SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-03-27T12:56:32Z","updated":"2026-03-28T01:25:46Z"},{"id":"wordfence:c478a421-8dc1-46cb-ada8-ceb107f22a53","source":"wordfence","cve":"CVE-2022-23981","title":"Perfect Brands for WooCommerce <= 2.0.4 - Unauthorized Brand Creation","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c478a421-8dc1-46cb-ada8-ceb107f22a53?source=api-prod","affected":[{"type":"plugin","slug":"perfect-woocommerce-brands","name":"Perfect Brands for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-01-28T09:32:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4796b65-4f55-4af9-bfc7-2ccec32f3414","source":"wordfence","cve":"CVE-2026-66592","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4796b65-4f55-4af9-bfc7-2ccec32f3414?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"4.7.12"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:08:42Z"},{"id":"wordfence:c47dbe5d-2507-4946-9ec4-6dd69890277f","source":"wordfence","cve":"CVE-2025-63067","title":"Porto Theme - Functionality < 3.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c47dbe5d-2507-4946-9ec4-6dd69890277f?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.7.3"}],"published":"2025-10-12T00:00:00Z","updated":"2026-02-26T15:20:43Z"},{"id":"wordfence:c47e170f-f51e-400a-97f3-4da034c193a9","source":"wordfence","cve":"CVE-2026-9730","title":"Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c47e170f-f51e-400a-97f3-4da034c193a9?source=api-prod","affected":[{"type":"plugin","slug":"remove-nofollow-commenter-link","name":"Remove NoFollow Commenter URL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:00Z","updated":"2026-06-02T07:48:32Z"},{"id":"wordfence:c47e9220-d7d7-4a66-b555-8fa837d45d59","source":"wordfence","cve":"CVE-2023-0064","title":"eVision Responsive Column Layout Shortcodes <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c47e9220-d7d7-4a66-b555-8fa837d45d59?source=api-prod","affected":[{"type":"plugin","slug":"wens-responsive-column-layout-shortcodes","name":"eVision Responsive Column Layout Shortcodes","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c48091fc-c11d-4753-9763-e1face3723fe","source":"wordfence","cve":"","title":"PublishPress Capabilities <= 1.5.8 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c48091fc-c11d-4753-9763-e1face3723fe?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2018-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c481767a-dcc8-4b39-be3b-3bbce313f7ae","source":"wordfence","cve":"CVE-2025-31424","title":"WP Lead Capturing Pages < 2.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c481767a-dcc8-4b39-be3b-3bbce313f7ae?source=api-prod","affected":[{"type":"plugin","slug":"leadcapture","name":"WP Lead Capturing Pages - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-06-03T00:00:00Z","updated":"2026-02-25T13:23:28Z"},{"id":"wordfence:c4831a75-9d2b-4808-8b23-f1e9750fd905","source":"wordfence","cve":"CVE-2019-6012","title":"wpDataTables Lite plugin <= 2.0.11 - SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4831a75-9d2b-4808-8b23-f1e9750fd905?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c483cdc5-56e4-4ee7-a782-0505816728ab","source":"wordfence","cve":"CVE-2026-81754","title":"Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c483cdc5-56e4-4ee7-a782-0505816728ab?source=api-prod","affected":[{"type":"plugin","slug":"vigilante","name":"Vigilant \u2013 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner\u2026","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-09-10T14:46:45Z","updated":"2026-09-11T03:39:38Z"},{"id":"wordfence:c4851379-140c-4884-9ab1-0766343b3342","source":"wordfence","cve":"CVE-2026-112833","title":"Seriously Simple Podcasting <= 3.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4851379-140c-4884-9ab1-0766343b3342?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.17.0","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2026-10-20T14:53:00Z","updated":"2026-10-23T18:37:11Z"},{"id":"wordfence:c4884ba9-4448-43b0-93d3-110b719845ea","source":"wordfence","cve":"CVE-2024-2504","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4884ba9-4448-43b0-93d3-110b719845ea?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2024-03-21T00:00:00Z","updated":"2024-05-31T15:30:54Z"},{"id":"wordfence:c4886822-3a05-45b3-ad1d-4d4a4f921817","source":"wordfence","cve":"CVE-2023-4376","title":"Serial Codes Generator and Validator with WooCommerce Support <= 2.4.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4886822-3a05-45b3-ad1d-4d4a4f921817?source=api-prod","affected":[{"type":"plugin","slug":"serial-codes-generator-and-validator","name":"Serial Codes Generator and Validator with WooCommerce Support","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":false,"patched_in":"2.4.15"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4901d9d-7b37-40d5-a42b-59c80bbbe8ff","source":"wordfence","cve":"CVE-2024-8852","title":"All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4901d9d-7b37-40d5-a42b-59c80bbbe8ff?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.86","to_inclusive":true,"patched_in":"7.87"}],"published":"2024-10-21T16:33:48Z","updated":"2024-10-22T05:33:48Z"},{"id":"wordfence:c490e344-66da-4176-bd93-7e07a491bfa9","source":"wordfence","cve":"","title":"All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c490e344-66da-4176-bd93-7e07a491bfa9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4921cf5-8d09-4278-bf37-02a5f2779fa9","source":"wordfence","cve":"CVE-2025-31879","title":"Barcode Generator for WooCommerce <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4921cf5-8d09-4278-bf37-02a5f2779fa9?source=api-prod","affected":[{"type":"plugin","slug":"embedding-barcodes-into-product-pages-and-orders","name":"Barcode Generator for WooCommerce \u2013 Show barcodes on products, orders, invoices and other pages","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-11T14:26:21Z"},{"id":"wordfence:c493191e-b2ec-4e5e-ac41-0cff24635a25","source":"wordfence","cve":"CVE-2024-56291","title":"PlainInventory <= 3.1.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c493191e-b2ec-4e5e-ac41-0cff24635a25?source=api-prod","affected":[{"type":"plugin","slug":"z-inventory-manager","name":"Zintory \u2013 Inventory Manager","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:33:17Z"},{"id":"wordfence:c49389b5-bf5a-49b8-8d20-404195b50308","source":"wordfence","cve":"CVE-2022-29476","title":"Notification Bar for WordPress <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49389b5-bf5a-49b8-8d20-404195b50308?source=api-prod","affected":[{"type":"plugin","slug":"8-degree-notification-bar","name":"Notification Bar for WordPress","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2022-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c495ac39-c99b-423d-a601-d0bfcc514ebe","source":"wordfence","cve":"CVE-2024-30231","title":"Product Import Export for WooCommerce <= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c495ac39-c99b-423d-a601-d0bfcc514ebe?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T15:04:43Z"},{"id":"wordfence:c495d7f6-6d4a-4b1a-90f9-5273e7773d7a","source":"wordfence","cve":"CVE-2025-14983","title":"Advanced Custom Fields: Font Awesome <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c495d7f6-6d4a-4b1a-90f9-5273e7773d7a?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-font-awesome","name":"Advanced Custom Fields: Font Awesome Field","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:23Z"},{"id":"wordfence:c496a5f8-9cfc-49b3-b360-d942d554b860","source":"wordfence","cve":"CVE-2024-32694","title":"3D FlipBook, PDF Viewer, PDF Embedder \u2013 Real 3D FlipBook WordPress Plugin <= 3.62 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c496a5f8-9cfc-49b3-b360-d942d554b860?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"3.62","to_inclusive":true,"patched_in":"3.63"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-24T12:44:59Z"},{"id":"wordfence:c4979e2f-225a-4f76-a324-dae5c84883f7","source":"wordfence","cve":"CVE-2025-49312","title":"Echo RSS Feed Post Generator <= 5.4.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4979e2f-225a-4f76-a324-dae5c84883f7?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-post-generator-echo","name":"Echo RSS Feed Post Generator","from":"*","from_inclusive":true,"to":"5.4.8.1","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2025-06-18T00:00:00Z","updated":"2025-07-09T15:13:34Z"},{"id":"wordfence:c49811bf-19d5-450f-9f11-a5fc9e8781c8","source":"wordfence","cve":"CVE-2020-11732","title":"Media Library Assistant <= 2.81 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49811bf-19d5-450f-9f11-a5fc9e8781c8?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"2.81","to_inclusive":true,"patched_in":"2.82"}],"published":"2019-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c498bd08-e5ad-460f-ac25-f18ee7d0f35b","source":"wordfence","cve":"CVE-2025-68978","title":"DesignThemes Core <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c498bd08-e5ad-460f-ac25-f18ee7d0f35b?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-core","name":"DesignThemes Core","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-17T00:00:00Z","updated":"2026-01-06T15:07:37Z"},{"id":"wordfence:c49b3841-370b-42ed-9545-e69c2544642d","source":"wordfence","cve":"","title":"Marker.io <= 1.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49b3841-370b-42ed-9545-e69c2544642d?source=api-prod","affected":[{"type":"plugin","slug":"marker-io","name":"Marker.io \u2013 Visual Website Feedback","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":false,"patched_in":"1.1.7"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c49c97cf-78e9-4da2-ab0d-ff014c29feaa","source":"wordfence","cve":"","title":"Strong Testimonials <= 2.31.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49c97cf-78e9-4da2-ab0d-ff014c29feaa?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"2.31.4","to_inclusive":true,"patched_in":"2.31.5"}],"published":"2018-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c49dcb39-7d03-4d7e-9a07-7ac8a6506e7f","source":"wordfence","cve":"CVE-2013-7129","title":"Bloog <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49dcb39-7d03-4d7e-9a07-7ac8a6506e7f?source=api-prod","affected":[{"type":"theme","slug":"Blooog-v1.1","name":"Bloog","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2013-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c49eb49c-4fe3-4b62-9395-ac7ec08dc9ef","source":"wordfence","cve":"CVE-2025-49339","title":"Direct Payments WP <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49eb49c-4fe3-4b62-9395-ac7ec08dc9ef?source=api-prod","affected":[{"type":"plugin","slug":"direct-payments-wp","name":"Direct Payments WP \u2013 Receive Payments with Forms","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:16:00Z"},{"id":"wordfence:c49f27d8-2c4d-4cbf-945c-f12878f4c17f","source":"wordfence","cve":"CVE-2025-27005","title":"HTML5 Video Player <= 5.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c49f27d8-2c4d-4cbf-945c-f12878f4c17f?source=api-prod","affected":[{"type":"plugin","slug":"lbg-vp2-html5-bottom","name":"HTML5 Video Player WordPress Plugin","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:57:27Z"},{"id":"wordfence:c4a051e3-4489-4124-abf6-905b7ff7fd3c","source":"wordfence","cve":"CVE-2024-33955","title":"Freesia Empire <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a051e3-4489-4124-abf6-905b7ff7fd3c?source=api-prod","affected":[{"type":"theme","slug":"freesia-empire","name":"Freesia Empire","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T20:33:13Z"},{"id":"wordfence:c4a1b869-42d2-4b6d-8e6a-853325e2afde","source":"wordfence","cve":"CVE-2026-24577","title":"Pie Register <= 3.8.4.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a1b869-42d2-4b6d-8e6a-853325e2afde?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.8","to_inclusive":true,"patched_in":"3.8.4.9"}],"published":"2026-01-20T00:00:00Z","updated":"2026-04-15T13:35:12Z"},{"id":"wordfence:c4a20569-c1ad-49d2-b5dd-87b97ff95cc0","source":"wordfence","cve":"CVE-2025-58260","title":"Highlight and Share \u2013 Social Text and Image Sharing <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a20569-c1ad-49d2-b5dd-87b97ff95cc0?source=api-prod","affected":[{"type":"plugin","slug":"highlight-and-share","name":"Highlight and Share \u2013 Unobtrusive and Lightweight Content Sharing","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-12-04T20:25:12Z"},{"id":"wordfence:c4a46d4c-3f03-4d41-8382-b43a02b59cb2","source":"wordfence","cve":"CVE-2024-12815","title":"Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a46d4c-3f03-4d41-8382-b43a02b59cb2?source=api-prod","affected":[{"type":"plugin","slug":"point-maker","name":"Point Maker","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:06:40Z","updated":"2025-03-05T09:21:48Z"},{"id":"wordfence:c4a649b0-d5b2-4e4c-833c-01ecf12611a5","source":"wordfence","cve":"","title":"Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a649b0-d5b2-4e4c-833c-01ecf12611a5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zoho","name":"WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u2013 CRM, Bigin","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4a6b786-d0ef-41f6-b2bf-83307ec02b91","source":"wordfence","cve":"CVE-2024-0658","title":"Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a6b786-d0ef-41f6-b2bf-83307ec02b91?source=api-prod","affected":[{"type":"plugin","slug":"insert-php-code-snippet","name":"Insert PHP Code Snippet","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-02-09T00:00:00Z","updated":"2024-07-29T21:37:23Z"},{"id":"wordfence:c4a70eec-ee14-4bef-8d23-5954b1f1baf5","source":"wordfence","cve":"CVE-2022-2091","title":"Cache Images <= 3.2 - Cross-Site Request Forgery to Image Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a70eec-ee14-4bef-8d23-5954b1f1baf5?source=api-prod","affected":[{"type":"plugin","slug":"cache-images","name":"Cache Images","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4aa2813-6920-4886-b6d2-78fbcd00bdf7","source":"wordfence","cve":"CVE-2020-5611","title":"Social Rocket \u2013 Social Sharing Plugin < 1.2.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4aa2813-6920-4886-b6d2-78fbcd00bdf7?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":false,"patched_in":"1.2.10"}],"published":"2020-07-22T00:00:00Z","updated":"2024-06-06T16:09:05Z"},{"id":"wordfence:c4ab6fcd-9c03-4bab-8e31-57b57e67e1e3","source":"wordfence","cve":"CVE-2024-6711","title":"Event Tickets with Ticket Scanner <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4ab6fcd-9c03-4bab-8e31-57b57e67e1e3?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-08-13T00:00:00Z","updated":"2024-08-15T17:49:59Z"},{"id":"wordfence:c4ab83d0-0e01-4b12-bc1f-9d693c13ce57","source":"wordfence","cve":"CVE-2025-58954","title":"HomeRoofer <= 2.11.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4ab83d0-0e01-4b12-bc1f-9d693c13ce57?source=api-prod","affected":[{"type":"theme","slug":"homeroofer","name":"HomerRofer","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T15:21:23Z"},{"id":"wordfence:c4aceec4-4832-4d83-98b3-f705c391b0c9","source":"wordfence","cve":"CVE-2019-14789","title":"Custom 404 Pro <= 3.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4aceec4-4832-4d83-98b3-f705c391b0c9?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":false,"patched_in":"3.2.9"}],"published":"2019-06-25T00:00:00Z","updated":"2024-08-15T18:22:10Z"},{"id":"wordfence:c4b01e7d-1c6d-4252-95a4-13f4e486b643","source":"wordfence","cve":"CVE-2026-12273","title":"Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b01e7d-1c6d-4252-95a4-13f4e486b643?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:16:58Z"},{"id":"wordfence:c4b1cae3-dc08-43b1-9a20-62b7263efeba","source":"wordfence","cve":"CVE-2023-0328","title":"WPCode <= 2.0.6 - Missing Authorization to Sensitive Key Disclosure/Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b1cae3-dc08-43b1-9a20-62b7263efeba?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers","name":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2023-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4b2cf3b-5d35-4ce6-9453-1538a6f7752f","source":"wordfence","cve":"CVE-2026-0718","title":"Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b2cf3b-5d35-4ce6-9453-1538a6f7752f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2026-04-15T18:53:44Z","updated":"2026-04-16T07:39:51Z"},{"id":"wordfence:c4b833c3-818d-4646-bd6d-8b3be13ea0f1","source":"wordfence","cve":"CVE-2025-13956","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b833c3-818d-4646-bd6d-8b3be13ea0f1?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-12-15T16:22:18Z","updated":"2025-12-16T04:31:36Z"},{"id":"wordfence:c4c2689d-be51-4907-b624-c85da39f545d","source":"wordfence","cve":"CVE-2023-41697","title":"Easy WP Cleaner <= 1.9 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c2689d-be51-4907-b624-c85da39f545d?source=api-prod","affected":[{"type":"plugin","slug":"easy-wp-cleaner","name":"Easy WP Cleaner","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-05-17T13:31:00Z"},{"id":"wordfence:c4c3f136-fa26-4813-9e69-f94eba9e4df7","source":"wordfence","cve":"CVE-2026-15338","title":"LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c3f136-fa26-4813-9e69-f94eba9e4df7?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-07-10T14:17:33Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:c4c438e0-ea25-4372-8e4e-5d7163cc3447","source":"wordfence","cve":"CVE-2024-1743","title":"WooCommerce Customers Manager <= 29.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c438e0-ea25-4372-8e4e-5d7163cc3447?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"29.7","to_inclusive":true,"patched_in":"29.8"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-25T12:32:53Z"},{"id":"wordfence:c4c530fa-eaf4-4721-bfb6-9fc06d7f343c","source":"wordfence","cve":"CVE-2024-8353","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2024-09-27T13:58:26Z","updated":"2025-03-04T16:48:59Z"},{"id":"wordfence:c4c58c0e-40c3-4648-8626-3c827cba1df4","source":"wordfence","cve":"CVE-2026-105073","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c58c0e-40c3-4648-8626-3c827cba1df4?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.1.26"}],"published":"2026-10-05T11:22:00Z","updated":"2026-10-08T23:31:00Z"},{"id":"wordfence:c4c95f55-445a-41eb-879a-73b23f0217af","source":"wordfence","cve":"CVE-2025-62066","title":"Revolution < 2.5.8 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c95f55-445a-41eb-879a-73b23f0217af?source=api-prod","affected":[{"type":"theme","slug":"revolution","name":"Revolution - Creative Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":false,"patched_in":"2.5.8"}],"published":"2025-10-18T00:00:00Z","updated":"2025-10-29T15:12:17Z"},{"id":"wordfence:c4cad108-6574-4f14-8a37-89c4c10279d6","source":"wordfence","cve":"CVE-2023-33213","title":"wpView <=\u00a01.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4cad108-6574-4f14-8a37-89c4c10279d6?source=api-prod","affected":[{"type":"plugin","slug":"wpview","name":"Display Custom Fields \u2013 wpView","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4cd477c-29c5-4715-bffb-55754858f9fc","source":"wordfence","cve":"CVE-2025-32145","title":"WpEvently <= 4.3.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4cd477c-29c5-4715-bffb-55754858f9fc?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2025-04-08T00:00:00Z","updated":"2025-04-25T14:48:44Z"},{"id":"wordfence:c4d19f85-e39f-46e6-b62c-b6d3dc51a0df","source":"wordfence","cve":"CVE-2018-20978","title":"Import any XML or CSV File to WordPress <= 3.4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d19f85-e39f-46e6-b62c-b6d3dc51a0df?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":false,"patched_in":"3.4.7"}],"published":"2018-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4d2e763-0dd6-4e1c-af37-036fffff84d7","source":"wordfence","cve":"CVE-2026-16942","title":"Custom HTML Pages <= 0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d2e763-0dd6-4e1c-af37-036fffff84d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-html-pages","name":"WP Custom HTML Page","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:33:25Z"},{"id":"wordfence:c4d46c87-5c30-4251-941e-a5e52b5d0c9f","source":"wordfence","cve":"CVE-2024-13565","title":"Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d46c87-5c30-4251-941e-a5e52b5d0c9f?source=api-prod","affected":[{"type":"plugin","slug":"simple-map-no-api","name":"Simple Map No Api","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:46:28Z","updated":"2025-02-18T04:21:22Z"},{"id":"wordfence:c4d496d1-fc9a-4db5-b5ad-aa5c66ecd3cb","source":"wordfence","cve":"CVE-2026-13143","title":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d496d1-fc9a-4db5-b5ad-aa5c66ecd3cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"11.8.1","to_inclusive":false,"patched_in":"11.8.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:32:12Z"},{"id":"wordfence:c4d552a7-499f-4946-b0ec-5f733c01a365","source":"wordfence","cve":"CVE-2023-23722","title":"WP eBay Product Feeds <= 3.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d552a7-499f-4946-b0ec-5f733c01a365?source=api-prod","affected":[{"type":"plugin","slug":"ebay-feeds-for-wordpress","name":"WP eBay Product Feeds","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4d5d58f-913a-4a26-8b2a-bfdd08033993","source":"wordfence","cve":"CVE-2024-3666","title":"Opal Estate Pro \u2013 Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d5d58f-913a-4a26-8b2a-bfdd08033993?source=api-prod","affected":[{"type":"plugin","slug":"opal-estate-pro","name":"Opal Estate Pro \u2013 Property Management and Submission","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T19:15:57Z","updated":"2024-05-22T07:37:26Z"},{"id":"wordfence:c4d86204-51df-4adf-aac4-f5e007d9f3c3","source":"wordfence","cve":"CVE-2022-4227","title":"Booster (<= 5.6.2), Booster Plus (< 6.0.0), and Booster Elite (< 6.0.0) for WooCommerce - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d86204-51df-4adf-aac4-f5e007d9f3c3?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"},{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"},{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4d8ec65-cebe-48fe-875b-a62f2af2bfd8","source":"wordfence","cve":"CVE-2025-46239","title":"Theme Switcha <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d8ec65-cebe-48fe-875b-a62f2af2bfd8?source=api-prod","affected":[{"type":"plugin","slug":"theme-switcha","name":"Theme Switcha \u2013 Easily Switch Themes for Development and Testing","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:21:39Z"},{"id":"wordfence:c4d8f5a9-56e1-4676-b03f-1f5464c5b29a","source":"wordfence","cve":"","title":"Unyson <= 2.7.18 -  Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d8f5a9-56e1-4676-b03f-1f5464c5b29a?source=api-prod","affected":[{"type":"plugin","slug":"unyson","name":"Unyson","from":"*","from_inclusive":true,"to":"2.7.18","to_inclusive":true,"patched_in":"2.7.19"}],"published":"2018-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4d99e64-1daf-4349-9702-341f05a65c21","source":"wordfence","cve":"CVE-2019-1010209","title":"GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership <= 1.4.13 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d99e64-1daf-4349-9702-341f05a65c21?source=api-prod","affected":[{"type":"plugin","slug":"gourl-bitcoin-payment-gateway-paid-downloads-membership","name":"GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2018-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4db394c-415a-40c5-ae0e-2dfe503867d4","source":"wordfence","cve":"CVE-2025-58019","title":"Search Atlas SEO <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4db394c-415a-40c5-ae0e-2dfe503867d4?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:27:10Z"},{"id":"wordfence:c4dc736a-6c34-489f-a73a-c7030c60b97f","source":"wordfence","cve":"CVE-2024-37934","title":"Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dc736a-6c34-489f-a73a-c7030c60b97f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.8.5"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:48:25Z"},{"id":"wordfence:c4dd681d-90cb-44dc-adf0-d7e269d15a60","source":"wordfence","cve":"CVE-2026-1320","title":"Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dd681d-90cb-44dc-adf0-d7e269d15a60?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"4.9.9"}],"published":"2026-02-12T01:05:30Z","updated":"2026-02-12T13:25:35Z"},{"id":"wordfence:c4debc89-d5ea-4cf1-8e69-197a75794d0b","source":"wordfence","cve":"CVE-2024-13515","title":"Image Source Control Lite \u2013 Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4debc89-d5ea-4cf1-8e69-197a75794d0b?source=api-prod","affected":[{"type":"plugin","slug":"image-source-control-isc","name":"Image Source Control Lite \u2013 Show Image Credits and Captions","from":"*","from_inclusive":true,"to":"2.28.0","to_inclusive":true,"patched_in":"2.28.1"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T05:33:49Z"},{"id":"wordfence:c4dfd5af-0af0-469c-81ed-52867609550c","source":"wordfence","cve":"CVE-2023-27456","title":"Total Theme <= 2.1.19 - Authenticated(Subscriber+) Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4dfd5af-0af0-469c-81ed-52867609550c?source=api-prod","affected":[{"type":"theme","slug":"total","name":"Total","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2023-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4e0a21a-f519-4c5b-9dcf-64cf06410def","source":"wordfence","cve":"CVE-2026-24590","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.3.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e0a21a-f519-4c5b-9dcf-64cf06410def?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.3.23","to_inclusive":true,"patched_in":"7.3.24"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:25:13Z"},{"id":"wordfence:c4e0ba71-74dc-414a-9c4e-ad07448e2f18","source":"wordfence","cve":"CVE-2024-34823","title":"Arigato Autoresponder and Newsletter <= 2.7.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e0ba71-74dc-414a-9c4e-ad07448e2f18?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.7.2.3","to_inclusive":true,"patched_in":"2.7.2.4"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:01:59Z"},{"id":"wordfence:c4e13ff2-410e-4a65-8b9c-660629eefd5b","source":"wordfence","cve":"CVE-2025-54038","title":"Restaurant Menu by MotoPress <= 2.4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e13ff2-410e-4a65-8b9c-660629eefd5b?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:34:58Z"},{"id":"wordfence:c4e1ce97-c390-4b87-b68d-bbce93d4665f","source":"wordfence","cve":"CVE-2025-9057","title":"Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e1ce97-c390-4b87-b68d-bbce93d4665f?source=api-prod","affected":[{"type":"plugin","slug":"biagiotti-core","name":"Biagiotti Core","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-05T18:23:33Z"},{"id":"wordfence:c4e54002-a5c3-454b-806f-879e7f252b1c","source":"wordfence","cve":"CVE-2025-58606","title":"SaasLauncher <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e54002-a5c3-454b-806f-879e7f252b1c?source=api-prod","affected":[{"type":"theme","slug":"saaslauncher","name":"SaasLauncher","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:44:39Z"},{"id":"wordfence:c4ea7512-34f4-4f58-8564-74a79c84d9d8","source":"wordfence","cve":"CVE-2024-54374","title":"Sogrid <= 1.5.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4ea7512-34f4-4f58-8564-74a79c84d9d8?source=api-prod","affected":[{"type":"plugin","slug":"sogrid","name":"WordPress Post Grid Layouts with Pagination \u2013 Sogrid","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T17:09:21Z"},{"id":"wordfence:c4ece408-a370-4848-9705-3f8d3de8ca03","source":"wordfence","cve":"CVE-2026-23979","title":"Gyan Elements <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4ece408-a370-4848-9705-3f8d3de8ca03?source=api-prod","affected":[{"type":"plugin","slug":"gyan-elements","name":"Gyan Elements","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:32:39Z"},{"id":"wordfence:c4edf78c-cd17-42dd-90dc-10946e79d57b","source":"wordfence","cve":"CVE-2024-13701","title":"Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4edf78c-cd17-42dd-90dc-10946e79d57b?source=api-prod","affected":[{"type":"plugin","slug":"stklcode-liveticker","name":"Liveticker (by stklcode)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T03:21:40Z"},{"id":"wordfence:c4ee6753-3f1e-472e-9350-eea8de089bef","source":"wordfence","cve":"CVE-2025-66135","title":"Imager for Elementor <= 2.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4ee6753-3f1e-472e-9350-eea8de089bef?source=api-prod","affected":[{"type":"plugin","slug":"imager-elementor","name":"Imager \u2013 Advanced Image-Box for Elementor","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-09T00:00:00Z","updated":"2026-01-15T16:56:30Z"},{"id":"wordfence:c4f19302-70a5-4132-b841-fba1dd86a0d3","source":"wordfence","cve":"CVE-2023-33209","title":"SEO Change Monitor <= 1.2 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f19302-70a5-4132-b841-fba1dd86a0d3?source=api-prod","affected":[{"type":"plugin","slug":"seo-change-monitor","name":"SEO Change Monitor \u2013 Track Website Changes","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c4f198c7-6a25-4dd4-8376-27cf324e5cf6","source":"wordfence","cve":"CVE-2026-22498","title":"Laurent - Elegant Restaurant WordPress Theme <= 3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f198c7-6a25-4dd4-8376-27cf324e5cf6?source=api-prod","affected":[{"type":"theme","slug":"laurent","name":"Laurent - Elegant Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:14:15Z"},{"id":"wordfence:c4f22ca7-0e7c-438a-8e63-cf3723d087f4","source":"wordfence","cve":"CVE-2025-14452","title":"WP Customer Reviews <= 3.7.5 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f22ca7-0e7c-438a-8e63-cf3723d087f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2026-02-18T16:21:24Z","updated":"2026-02-19T04:36:23Z"},{"id":"wordfence:c4f291e0-6c99-43d8-830a-1ff90b496b18","source":"wordfence","cve":"CVE-2025-32220","title":"Salon booking system <= 10.29.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f291e0-6c99-43d8-830a-1ff90b496b18?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.29.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-05T19:36:33Z"},{"id":"wordfence:c4f6316d-1737-4935-bcd2-f8c9179ef9ad","source":"wordfence","cve":"CVE-2025-69176","title":"ITactics <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f6316d-1737-4935-bcd2-f8c9179ef9ad?source=api-prod","affected":[{"type":"theme","slug":"itactics","name":"ITactics - IT Solutions & Digital Startup WordPress Theme + AI","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:34:10Z"},{"id":"wordfence:c4f76e1d-23f2-4dff-98eb-c73f7e7f10cb","source":"wordfence","cve":"CVE-2025-46465","title":"Print Science Designer <= 1.3.155 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f76e1d-23f2-4dff-98eb-c73f7e7f10cb?source=api-prod","affected":[{"type":"plugin","slug":"print-science-designer","name":"Print Science Designer","from":"*","from_inclusive":true,"to":"1.3.155","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:16:10Z"},{"id":"wordfence:c4f8e79b-a1ba-486c-8f64-d216ef5bb2f7","source":"wordfence","cve":"CVE-2024-13615","title":"Social Media Plugin by Social Snap <= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4f8e79b-a1ba-486c-8f64-d216ef5bb2f7?source=api-prod","affected":[{"type":"plugin","slug":"socialsnap","name":"Social Snap \u2014 Social Share Buttons & Click to Tweet","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-02-18T00:00:00Z","updated":"2025-04-23T17:24:37Z"},{"id":"wordfence:c4fe6dcc-93c8-4956-85ae-a1125bc84509","source":"wordfence","cve":"CVE-2026-14489","title":"WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4fe6dcc-93c8-4956-85ae-a1125bc84509?source=api-prod","affected":[{"type":"plugin","slug":"whmcs-bridge","name":"WHMCS Bridge","from":"*","from_inclusive":true,"to":"6.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:36:34Z","updated":"2026-07-08T05:34:09Z"},{"id":"wordfence:c4feb8e8-8620-44b9-9e8d-7ea513e168ff","source":"wordfence","cve":"CVE-2023-1660","title":"ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c4feb8e8-8620-44b9-9e8d-7ea513e168ff?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5007dd0-a62c-4ad8-8f8b-eb3f4387c370","source":"wordfence","cve":"CVE-2025-13597","title":"AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5007dd0-a62c-4ad8-8f8b-eb3f4387c370?source=api-prod","affected":[{"type":"plugin","slug":"ai-feeds","name":"AI Feeds","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-11-25T09:45:10Z","updated":"2025-11-25T22:28:37Z"},{"id":"wordfence:c5033a86-540d-4a96-9ed4-838856096af3","source":"wordfence","cve":"CVE-2024-56207","title":"EditionGuard for WooCommerce \u2013 eBook Sales with DRM <= 3.4.2 - Cross-Site Request Forgery to Privilege Escalation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5033a86-540d-4a96-9ed4-838856096af3?source=api-prod","affected":[{"type":"plugin","slug":"editionguard-for-woocommerce-ebook-sales-with-drm","name":"EditionGuard for WooCommerce \u2013 eBook Sales with DRM","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:22:12Z"},{"id":"wordfence:c506c0fb-d853-45d2-b6d5-9c3b1fa4f1e8","source":"wordfence","cve":"CVE-2026-48971","title":"Product Import Export for WooCommerce \u2013 Import Export Product CSV Suite <= 2.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c506c0fb-d853-45d2-b6d5-9c3b1fa4f1e8?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:12:28Z"},{"id":"wordfence:c506fd52-ec10-48bd-a221-713d6c5951ce","source":"wordfence","cve":"CVE-2024-52487","title":"Ultimate Classified Listings <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c506fd52-ec10-48bd-a221-713d6c5951ce?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-classified-listings","name":"Ultimate Classified Listings \u2013 Classifieds, Directory & Marketplace","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-11-19T00:00:00Z","updated":"2026-06-23T17:32:22Z"},{"id":"wordfence:c508c3df-c16d-4535-8f34-32fa290e4a4b","source":"wordfence","cve":"CVE-2025-49403","title":"Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c508c3df-c16d-4535-8f34-32fa290e4a4b?source=api-prod","affected":[{"type":"plugin","slug":"age-restriction","name":"Premium Age Verification / Restriction for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:17:39Z"},{"id":"wordfence:c508cb73-53e6-4ebe-b3d0-285908b722c9","source":"wordfence","cve":"CVE-2025-13486","title":"Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c508cb73-53e6-4ebe-b3d0-285908b722c9?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.9.0.5","from_inclusive":true,"to":"0.9.1.1","to_inclusive":true,"patched_in":"0.9.2"}],"published":"2025-12-02T18:43:18Z","updated":"2025-12-03T06:48:16Z"},{"id":"wordfence:c508d38c-f5e3-4193-8209-0083a8a18da4","source":"wordfence","cve":"CVE-2022-3908","title":"Helloprint <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c508d38c-f5e3-4193-8209-0083a8a18da4?source=api-prod","affected":[{"type":"plugin","slug":"helloprint","name":"Plug your WooCommerce into the largest catalog of customized print products from Helloprint","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c509345b-441f-474d-ad3a-720801859f86","source":"wordfence","cve":"CVE-2024-11458","title":"FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c509345b-441f-474d-ad3a-720801859f86?source=api-prod","affected":[{"type":"plugin","slug":"faq-builder-ays","name":"FAQ Builder AYS","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:21Z"},{"id":"wordfence:c509b832-d993-47c3-9c2a-efc4fc75686b","source":"wordfence","cve":"CVE-2024-50421","title":"WooCommerce PDF Invoices & Packing Slips <= 3.8.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c509b832-d993-47c3-9c2a-efc4fc75686b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T19:16:06Z"},{"id":"wordfence:c50c8eb5-5f7c-4294-86fa-a5998db0675c","source":"wordfence","cve":"CVE-2025-8594","title":"Pz-LinkCard <= 2.5.6 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c50c8eb5-5f7c-4294-86fa-a5998db0675c?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-09-23T00:00:00Z","updated":"2026-10-01T22:45:02Z"},{"id":"wordfence:c50cf850-f890-4b14-8840-4cca3080e081","source":"wordfence","cve":"CVE-2026-65564","title":"MapPress \u2013 Google Maps, OpenStreetMap & Leaflet <= 2.97.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c50cf850-f890-4b14-8840-4cca3080e081?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.97.6","to_inclusive":true,"patched_in":"2.97.7"}],"published":"2026-07-24T00:00:00Z","updated":"2026-07-29T12:13:29Z"},{"id":"wordfence:c510063e-1c64-40fa-842a-e7efd3dc550a","source":"wordfence","cve":"CVE-2019-16219","title":"WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c510063e-1c64-40fa-842a-e7efd3dc550a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.29","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.27","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.26","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.23","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.19","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.18","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.17","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.12","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"3.7.30"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2019-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c513e674-c027-4335-8ba3-b19696a1ce9b","source":"wordfence","cve":"CVE-2023-35777","title":"The Events Calendar <= 6.1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c513e674-c027-4335-8ba3-b19696a1ce9b?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.1.2.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c51889e4-9ca2-4c3f-addb-8285579324f6","source":"wordfence","cve":"CVE-2021-20865","title":"Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c51889e4-9ca2-4c3f-addb-8285579324f6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"}],"published":"2021-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c51b066c-84d2-4791-b863-6a98b954e4a3","source":"wordfence","cve":"CVE-2025-3514","title":"SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c51b066c-84d2-4791-b863-6a98b954e4a3?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-04-11T00:00:00Z","updated":"2025-06-05T19:37:51Z"},{"id":"wordfence:c51c6cfb-9a79-4190-87ff-7eddb866ae56","source":"wordfence","cve":"CVE-2026-12238","title":"WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c51c6cfb-9a79-4190-87ff-7eddb866ae56?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.1.01","to_inclusive":true,"patched_in":"10.1.02"}],"published":"2026-06-19T06:01:56Z","updated":"2026-06-19T18:32:05Z"},{"id":"wordfence:c51d3097-d190-42e0-9a91-5a48c3e5ef95","source":"wordfence","cve":"CVE-2026-15372","title":"2FA <= 4.0.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c51d3097-d190-42e0-9a91-5a48c3e5ef95?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2026-07-29T00:00:00Z","updated":"2026-09-17T15:16:23Z"},{"id":"wordfence:c5203a17-cc4f-4545-a231-dfbfb900f0fd","source":"wordfence","cve":"","title":"BuddyPress xProfile Checkout Manager for WooCommerce <= 1.3.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5203a17-cc4f-4545-a231-dfbfb900f0fd?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-buddypress-integration-xprofile-checkout-manager","name":"BuddyPress xProfile Checkout Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2022-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c52435f3-cc1c-4d3a-a664-a07e60fad6ae","source":"wordfence","cve":"CVE-2023-6623","title":"Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52435f3-cc1c-4d3a-a664-a07e60fad6ae?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2023-12-21T00:00:00Z","updated":"2024-02-06T15:01:38Z"},{"id":"wordfence:c525344a-fb62-48c9-bfd2-a77f59da3470","source":"wordfence","cve":"CVE-2024-7918","title":"Pocket Widget <= 0.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c525344a-fb62-48c9-bfd2-a77f59da3470?source=api-prod","affected":[{"type":"plugin","slug":"pocket-widget","name":"Pocket Widget","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-26T15:08:36Z"},{"id":"wordfence:c525b41c-dca5-442a-927e-4583cb303ed1","source":"wordfence","cve":"CVE-2025-3282","title":"User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c525b41c-dca5-442a-927e-4583cb303ed1?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T06:37:20Z"},{"id":"wordfence:c52628cc-d7c5-4e63-9a78-1c69c9aa1078","source":"wordfence","cve":"CVE-2026-115968","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52628cc-d7c5-4e63-9a78-1c69c9aa1078?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-26T13:06:32Z","updated":"2026-11-03T19:29:14Z"},{"id":"wordfence:c5277e25-d923-4553-9371-192d4cf4389a","source":"wordfence","cve":"CVE-2023-0165","title":"Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5277e25-d923-4553-9371-192d4cf4389a?source=api-prod","affected":[{"type":"plugin","slug":"nd-projects","name":"Cost Calculator","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5293c0f-90b0-41df-a623-90297d998c41","source":"wordfence","cve":"CVE-2026-5293","title":"\u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3 <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5293c0f-90b0-41df-a623-90297d998c41?source=api-prod","affected":[{"type":"plugin","slug":"os-diagnosis-generator","name":"\u8a3a\u65ad\u30b8\u30a7\u30cd\u30ec\u30fc\u30bf\u4f5c\u6210\u30d7\u30e9\u30b0\u30a4\u30f3","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:02:54Z","updated":"2026-07-21T14:06:02Z"},{"id":"wordfence:c52a8b78-39bd-473b-ad78-377c31453f4e","source":"wordfence","cve":"CVE-2018-19042","title":"Media File Manager <= 1.4.2 - Directory Traversal to Arbitrary File Relocation","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52a8b78-39bd-473b-ad78-377c31453f4e?source=api-prod","affected":[{"type":"plugin","slug":"media-file-manager","name":"Media File Manager","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2018-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c52cadb2-703f-4aad-85f2-aec1dd4befdc","source":"wordfence","cve":"CVE-2026-8599","title":"MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52cadb2-703f-4aad-85f2-aec1dd4befdc?source=api-prod","affected":[{"type":"plugin","slug":"mailerpress","name":"MailerPress \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-06-08T19:47:21Z","updated":"2026-06-09T07:49:57Z"},{"id":"wordfence:c52cdb58-c97a-43a6-a3ff-be084ceee085","source":"wordfence","cve":"CVE-2024-11887","title":"Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52cdb58-c97a-43a6-a3ff-be084ceee085?source=api-prod","affected":[{"type":"plugin","slug":"geo-targetly-geo-content","name":"Geo Content","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":"6.1"}],"published":"2025-01-06T16:26:44Z","updated":"2025-07-10T14:05:32Z"},{"id":"wordfence:c52de26a-d52c-4b2e-8e51-731115d29bd0","source":"wordfence","cve":"CVE-2025-13863","title":"RevInsite <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52de26a-d52c-4b2e-8e51-731115d29bd0?source=api-prod","affected":[{"type":"plugin","slug":"revinsite","name":"RevInsite","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:46:24Z","updated":"2025-12-06T05:49:32Z"},{"id":"wordfence:c52eba24-e9b1-4471-9c0e-090f5cf8d932","source":"wordfence","cve":"CVE-2026-39690","title":"Author Avatars List/Block <= 2.1.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c52eba24-e9b1-4471-9c0e-090f5cf8d932?source=api-prod","affected":[{"type":"plugin","slug":"author-avatars","name":"Author Avatars List/Block","from":"*","from_inclusive":true,"to":"2.1.25","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-15T21:30:30Z"},{"id":"wordfence:c530f5d2-eed3-433b-bf96-656593ad6ce2","source":"wordfence","cve":"CVE-2024-7629","title":"Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c530f5d2-eed3-433b-bf96-656593ad6ce2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-video","name":"Responsive Video","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-20T17:23:55Z","updated":"2024-08-21T05:30:24Z"},{"id":"wordfence:c532fc06-1ddd-4472-a5aa-10d7c8688d36","source":"wordfence","cve":"CVE-2024-9146","title":"CSS JS Files <= 1.5.0 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c532fc06-1ddd-4472-a5aa-10d7c8688d36?source=api-prod","affected":[{"type":"plugin","slug":"css-js-files","name":"CSS JS Files","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:28:13Z"},{"id":"wordfence:c536261b-7a64-4aec-b326-aac0ac554f4b","source":"wordfence","cve":"CVE-2025-49965","title":"PixelBeds Channel Manager and Hotel Booking Engine <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c536261b-7a64-4aec-b326-aac0ac554f4b?source=api-prod","affected":[{"type":"plugin","slug":"pixelbeds-channel-manager-booking-engine","name":"PixelBeds Channel Manager and Hotel Booking Engine","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:45:37Z"},{"id":"wordfence:c536ae81-cf30-4af4-8b79-ee5dd03a4751","source":"wordfence","cve":"CVE-2024-6723","title":"AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c536ae81-cf30-4af4-8b79-ee5dd03a4751?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-04T15:50:50Z"},{"id":"wordfence:c5372890-72d4-482d-a7f2-04a50520c4dc","source":"wordfence","cve":"CVE-2021-25033","title":"WordPress Newsletter Plugin \u2013 Noptin < 1.6.5 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5372890-72d4-482d-a7f2-04a50520c4dc?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":false,"patched_in":"1.6.5"}],"published":"2022-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c53997b3-5123-4483-9f56-011cc627b7da","source":"wordfence","cve":"CVE-2025-23993","title":"Felan Framework <= 1.1.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c53997b3-5123-4483-9f56-011cc627b7da?source=api-prod","affected":[{"type":"plugin","slug":"felan-framework","name":"Felan Framework","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T22:07:43Z"},{"id":"wordfence:c53c322a-b197-4ece-ae4a-a3a86a009e4d","source":"wordfence","cve":"CVE-2025-6085","title":"Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c53c322a-b197-4ece-ae4a-a3a86a009e4d?source=api-prod","affected":[{"type":"plugin","slug":"integromat-connector","name":"Make Connector","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-09-03T21:08:50Z","updated":"2025-09-19T18:32:41Z"},{"id":"wordfence:c53d4453-baf7-46b9-b019-d2be99c4a66e","source":"wordfence","cve":"CVE-2025-62962","title":"CloudSearch <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c53d4453-baf7-46b9-b019-d2be99c4a66e?source=api-prod","affected":[{"type":"plugin","slug":"cloud-search","name":"CloudSearch","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:44:08Z"},{"id":"wordfence:c53da813-0376-4c61-bfe0-fd8a2c946937","source":"wordfence","cve":"CVE-2026-83561","title":"Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c53da813-0376-4c61-bfe0-fd8a2c946937?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.5.4","to_inclusive":true,"patched_in":"7.5.5"}],"published":"2026-09-17T20:28:29Z","updated":"2026-09-18T08:28:32Z"},{"id":"wordfence:c53ebf2f-44ab-4d0f-ac3d-c08806c07343","source":"wordfence","cve":"CVE-2023-47662","title":"Live Gold Price & Silver Price Charts Widgets <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c53ebf2f-44ab-4d0f-ac3d-c08806c07343?source=api-prod","affected":[{"type":"plugin","slug":"gold-price-chart-widget","name":"Live Gold Price & Silver Price Charts Widgets","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5429fb1-7072-4a00-8fb3-48d4f876417f","source":"wordfence","cve":"","title":"Customer Reviews for WooCommerce <= 5.36.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5429fb1-7072-4a00-8fb3-48d4f876417f?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.36.1","to_inclusive":false,"patched_in":"5.36.1"}],"published":"2023-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c542b535-f75c-4f63-a3d8-7f80139ac97e","source":"wordfence","cve":"","title":"FrieChat - WordPress Chat Plugin < 1.0.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c542b535-f75c-4f63-a3d8-7f80139ac97e?source=api-prod","affected":[{"type":"plugin","slug":"friechat","name":"FrieChat - WordPress Chat Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2015-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c544c86d-e414-49c2-ae57-3293b1a6409d","source":"wordfence","cve":"CVE-2013-0235","title":"WordPress Core < 3.5.1 - Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c544c86d-e414-49c2-ae57-3293b1a6409d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5451e21-2782-4d2b-8c2b-be12102e20c4","source":"wordfence","cve":"CVE-2024-43123","title":"Card Elements for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5451e21-2782-4d2b-8c2b-be12102e20c4?source=api-prod","affected":[{"type":"plugin","slug":"card-elements-for-elementor","name":"Card Elements for Elementor","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:56:21Z"},{"id":"wordfence:c54770f1-1409-4208-a4ab-0ff3dbc3835d","source":"wordfence","cve":"CVE-2023-28775","title":"Yoast SEO Premium <= 20.4 - Missing Authorization to Zapier Key Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c54770f1-1409-4208-a4ab-0ff3dbc3835d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo-premium","name":"Yoast SEO Premium","from":"*","from_inclusive":true,"to":"20.4","to_inclusive":true,"patched_in":"20.5"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c548a6dc-7c6d-4837-9417-dabb3fc8f0f6","source":"wordfence","cve":"CVE-2026-5305","title":"Email Encoder < 0.3.12 (premium) < 1.0.25 (free) - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c548a6dc-7c6d-4837-9417-dabb3fc8f0f6?source=api-prod","affected":[{"type":"plugin","slug":"email-address-encoder","name":"Email Address Encoder","from":"*","from_inclusive":true,"to":"1.0.25","to_inclusive":false,"patched_in":"1.0.25"},{"type":"plugin","slug":"email-encoder-premium","name":"email-encoder-premium","from":"*","from_inclusive":true,"to":"0.3.12","to_inclusive":false,"patched_in":"0.3.12"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-09T16:10:35Z"},{"id":"wordfence:c548b70a-8566-4aaf-a3a2-fce6c19e6a0c","source":"wordfence","cve":"CVE-2024-13911","title":"Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure","severity":"high","cvss":7.2,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c548b70a-8566-4aaf-a3a2-fce6c19e6a0c?source=api-prod","affected":[{"type":"plugin","slug":"database-backup","name":"Database Backup and Table Integrity Check with Automated Scheduling","from":"*","from_inclusive":true,"to":"2.35","to_inclusive":true,"patched_in":"2.36"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:05Z"},{"id":"wordfence:c548ea22-e40c-4174-a0de-e2d9b7602c71","source":"wordfence","cve":"CVE-2025-31553","title":"Advanced WooCommerce Product Sales Reporting <= 4.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c548ea22-e40c-4174-a0de-e2d9b7602c71?source=api-prod","affected":[{"type":"plugin","slug":"webd-woocommerce-advanced-reporting-statistics","name":"Advanced Reporting and Statistics for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-03-31T00:00:00Z","updated":"2026-01-07T14:32:58Z"},{"id":"wordfence:c549ba14-276e-46ab-8019-97430a566d8c","source":"wordfence","cve":"CVE-2026-116520","title":"PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c549ba14-276e-46ab-8019-97430a566d8c?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.26","to_inclusive":true,"patched_in":"1.9.27"}],"published":"2026-10-30T17:25:42Z","updated":"2026-10-31T05:33:08Z"},{"id":"wordfence:c54c1fab-634d-4d1a-8234-8f1ae41c7cd4","source":"wordfence","cve":"CVE-2025-1778","title":"Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c54c1fab-634d-4d1a-8234-8f1ae41c7cd4?source=api-prod","affected":[{"type":"theme","slug":"art-theme","name":"Art Theme","from":"*","from_inclusive":true,"to":"3.12.2.3","to_inclusive":true,"patched_in":"3.12.3"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-06T05:22:42Z"},{"id":"wordfence:c54d503f-9de5-496f-bd6d-2e417a5c1b67","source":"wordfence","cve":"","title":"Picturesurf Gallery <= 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c54d503f-9de5-496f-bd6d-2e417a5c1b67?source=api-prod","affected":[{"type":"plugin","slug":"picturesurf-gallery","name":"picturesurf-gallery","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2012-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c54d986e-6bf5-4612-bcb9-170d5b678f4f","source":"wordfence","cve":"CVE-2025-57922","title":"Env\u00edos Coordinadora Woocommerce <= 1.1.31 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c54d986e-6bf5-4612-bcb9-170d5b678f4f?source=api-prod","affected":[{"type":"plugin","slug":"coordinadora","name":"Env\u00edos Coordinadora Woocommerce (Oficial) \u2013 WordPress plugin","from":"*","from_inclusive":true,"to":"1.1.31","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:52:03Z"},{"id":"wordfence:c54e5cd9-cc51-4367-afe0-11a6abfc0437","source":"wordfence","cve":"CVE-2025-8383","title":"Depicter <= 4.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c54e5cd9-cc51-4367-afe0-11a6abfc0437?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2025-10-30T20:18:20Z","updated":"2025-12-19T15:40:11Z"},{"id":"wordfence:c5519d4e-84b5-4901-b55c-a0a919f4b6c9","source":"wordfence","cve":"CVE-2023-51505","title":"Active Products Tables for WooCommerce <= 1.0.6 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5519d4e-84b5-4901-b55c-a0a919f4b6c9?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.6.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c55404f8-f928-4ed8-af60-a8dec103ce78","source":"wordfence","cve":"CVE-2024-12109","title":"Product Labels For Woocommerce (Sale Badges) <= 1.5.8 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55404f8-f928-4ed8-af60-a8dec103ce78?source=api-prod","affected":[{"type":"plugin","slug":"aco-product-labels-for-woocommerce","name":"Product Labels For Woocommerce (Sale Badges)","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:37:45Z"},{"id":"wordfence:c55487f9-dc8a-41a0-b052-625665c1543f","source":"wordfence","cve":"CVE-2015-9369","title":"Easy US Sales Taxes Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55487f9-dc8a-41a0-b052-625665c1543f?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-easy-us-sales-taxes","name":"Easy US Sales Taxes Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5549f6a-f7ac-4586-a3ff-43abeaedd4a0","source":"wordfence","cve":"CVE-2026-14234","title":"WOLF - WordPress Posts Bulk Editor and Manager <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5549f6a-f7ac-4586-a3ff-43abeaedd4a0?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-30T17:28:30Z"},{"id":"wordfence:c55792d6-3f31-4635-ad5c-17d03a5b2977","source":"wordfence","cve":"CVE-2021-24211","title":"WordPress Related Posts <= 3.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55792d6-3f31-4635-ad5c-17d03a5b2977?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-23-related-posts-plugin","name":"WordPress Related Posts","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2021-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c557b542-f092-446d-874c-968c5aab8a74","source":"wordfence","cve":"CVE-2026-107237","title":"Backup and Staging by WP Time Capsule <= 1.22.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c557b542-f092-446d-874c-968c5aab8a74?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.27","to_inclusive":true,"patched_in":"1.22.28"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:22:00Z"},{"id":"wordfence:c557fc55-3c0d-43ff-8575-32f669299b39","source":"wordfence","cve":"CVE-2023-30780","title":"User IP and Location <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c557fc55-3c0d-43ff-8575-32f669299b39?source=api-prod","affected":[{"type":"plugin","slug":"user-ip-and-location","name":"User IP and Location","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c55bf5f5-20d5-4157-94d3-1a330cdc82df","source":"wordfence","cve":"CVE-2026-12941","title":"MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55bf5f5-20d5-4157-94d3-1a330cdc82df?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.0.10"}],"published":"2026-07-15T13:53:12Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:c55ca7d4-6bc0-49c9-8ce0-50fff8775a76","source":"wordfence","cve":"CVE-2023-4520","title":"FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.37.7212","to_inclusive":true,"patched_in":"7.5.39.7212"}],"published":"2023-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c55ce1a2-f3e6-4fce-8a40-195a9739172e","source":"wordfence","cve":"CVE-2025-62006","title":"WP SMS <= 7.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ce1a2-f3e6-4fce-8a40-195a9739172e?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:33:29Z"},{"id":"wordfence:c55d3625-89cf-4d39-ad7b-59378826161d","source":"wordfence","cve":"CVE-2026-25400","title":"Apicona <= 24.1.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55d3625-89cf-4d39-ad7b-59378826161d?source=api-prod","affected":[{"type":"theme","slug":"apicona","name":"Apicona - Health & Medical WordPress Theme","from":"*","from_inclusive":true,"to":"24.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:14:42Z"},{"id":"wordfence:c55e1d38-081c-4ef6-aad7-04ef52c6bee0","source":"wordfence","cve":"","title":"Commentator < 2.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c55e1d38-081c-4ef6-aad7-04ef52c6bee0?source=api-prod","affected":[{"type":"plugin","slug":"commentator","name":"commentator","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":false,"patched_in":"2.5.3"}],"published":"2016-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c560bc33-d664-433e-bfd9-e4fa1776bb76","source":"wordfence","cve":"CVE-2025-11728","title":"Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=api-prod","affected":[{"type":"plugin","slug":"oceanpayment-creditcard-gateway","name":"Oceanpayment CreditCard Gateway","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:36:36Z","updated":"2025-10-15T08:26:03Z"},{"id":"wordfence:c56234f3-7dd6-4dff-887d-5ddbf0cb7d3c","source":"wordfence","cve":"CVE-2025-13921","title":"weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56234f3-7dd6-4dff-887d-5ddbf0cb7d3c?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.1.17"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-23T13:24:25Z"},{"id":"wordfence:c5644bb7-b97e-45da-a67a-d86219d2df06","source":"wordfence","cve":"CVE-2025-62079","title":"Export Categories & Taxonomies <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5644bb7-b97e-45da-a67a-d86219d2df06?source=api-prod","affected":[{"type":"plugin","slug":"wp-export-categories-taxonomies","name":"WP Export Categories & Taxonomies","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:21:20Z"},{"id":"wordfence:c565f455-6c83-42af-9f79-dcf4d03320a8","source":"wordfence","cve":"CVE-2025-22552","title":"Affiliate Disclosure Statement <= 0.3 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c565f455-6c83-42af-9f79-dcf4d03320a8?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-disclosure-statement","name":"Affiliate Disclosure Statement","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:18:17Z"},{"id":"wordfence:c566feec-259a-413f-93f3-6c8472e6596f","source":"wordfence","cve":"CVE-2026-105887","title":"Robo Gallery \u2013 Photo & Image Slider <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c566feec-259a-413f-93f3-6c8472e6596f?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:30:33Z"},{"id":"wordfence:c5697616-4e19-45a3-b860-623af66469bc","source":"wordfence","cve":"CVE-2026-57814","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5697616-4e19-45a3-b860-623af66469bc?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.55.0.1","to_inclusive":true,"patched_in":"1.55.0.2"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:36:52Z"},{"id":"wordfence:c56b1dca-3841-48df-837e-7973940e74e3","source":"wordfence","cve":"CVE-2024-27188","title":"Breeze <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56b1dca-3841-48df-837e-7973940e74e3?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T17:19:08Z"},{"id":"wordfence:c56bf3c7-046f-446f-bd33-8fc468445dd2","source":"wordfence","cve":"CVE-2025-49990","title":"ContentStudio <= 1.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56bf3c7-046f-446f-bd33-8fc468445dd2?source=api-prod","affected":[{"type":"plugin","slug":"contentstudio","name":"ContentStudio","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-06-19T00:00:00Z","updated":"2025-12-09T17:13:23Z"},{"id":"wordfence:c56e5250-7cbd-41f4-9b8c-79a644830708","source":"wordfence","cve":"CVE-2022-3124","title":"Frontend File Manager <= 21.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56e5250-7cbd-41f4-9b8c-79a644830708?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"21.2","to_inclusive":true,"patched_in":"21.3"}],"published":"2022-09-07T00:00:00Z","updated":"2025-05-30T21:03:46Z"},{"id":"wordfence:c56ec6ae-5b75-4cbb-aedd-f318fddc7bf0","source":"wordfence","cve":"CVE-2025-13231","title":"Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition","severity":"medium","cvss":6.5,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56ec6ae-5b75-4cbb-aedd-f318fddc7bf0?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-16T08:20:27Z"},{"id":"wordfence:c56ed896-9267-49e6-a207-fe5362fe18cd","source":"wordfence","cve":"CVE-2023-1169","title":"OoohBoi Steroids for Elementor <= 2.1.4 - Missing Authorization leading to Authenticated (Subscriber+) Image Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c56ed896-9267-49e6-a207-fe5362fe18cd?source=api-prod","affected":[{"type":"plugin","slug":"ooohboi-steroids-for-elementor","name":"OoohBoi Steroids for Elementor","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5728d00-1fcb-4c70-b361-1e4e15bac89b","source":"wordfence","cve":"CVE-2026-97239","title":"MCP Content Manager Lite <= 1.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5728d00-1fcb-4c70-b361-1e4e15bac89b?source=api-prod","affected":[{"type":"plugin","slug":"mcp-content-manager-lite","name":"MCP Content Manager Lite","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-09-29T09:54:57Z","updated":"2026-10-08T23:56:43Z"},{"id":"wordfence:c5757abd-33dc-4751-bc55-afd944ff2341","source":"wordfence","cve":"CVE-2018-25095","title":"Duplicator < 1.3.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5757abd-33dc-4751-bc55-afd944ff2341?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2023-12-15T00:00:00Z","updated":"2024-02-07T13:48:28Z"},{"id":"wordfence:c575f3f5-3a0b-4b88-9d9a-5e8212a02144","source":"wordfence","cve":"CVE-2025-30792","title":"Comment Approved Notifier Extended <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c575f3f5-3a0b-4b88-9d9a-5e8212a02144?source=api-prod","affected":[{"type":"plugin","slug":"comment-approved-notifier-extended","name":"Comment Approved Notifier Extended","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:29:58Z"},{"id":"wordfence:c5774f0f-aacf-4383-b1f8-20a919c6b759","source":"wordfence","cve":"CVE-2026-22394","title":"Evently <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5774f0f-aacf-4383-b1f8-20a919c6b759?source=api-prod","affected":[{"type":"theme","slug":"evently","name":"Evently - Conference & Meetup WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:37:03Z"},{"id":"wordfence:c5782b71-3234-4e53-9b26-225472f604c5","source":"wordfence","cve":"CVE-2023-50853","title":"Advanced Form Integration <= 1.75.0 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5782b71-3234-4e53-9b26-225472f604c5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"1.76.0","to_inclusive":false,"patched_in":"1.76.0"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c579825b-e92e-48d2-925e-d1fc81374c4a","source":"wordfence","cve":"CVE-2023-23801","title":"Really Simple Google Tag Manager <= 1.0.6 - Cross-Site Request Forgery via plugin_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c579825b-e92e-48d2-925e-d1fc81374c4a?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-google-tag-manager","name":"Really Simple Google Tag Manager (GTM)","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c57aaae7-435c-4bf9-8463-648e46103e88","source":"wordfence","cve":"CVE-2025-67560","title":"Listdom <= 5.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c57aaae7-435c-4bf9-8463-648e46103e88?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:13:09Z"},{"id":"wordfence:c57b9a78-53f4-40bb-ae6a-c5242b41329f","source":"wordfence","cve":"CVE-2025-14506","title":"ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c57b9a78-53f4-40bb-ae6a-c5242b41329f?source=api-prod","affected":[{"type":"plugin","slug":"convertforce-popup-builder","name":"ConvertForce: Popup, Notification Bar & Slide-in Builder","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":"0.0.8"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T11:22:39Z"},{"id":"wordfence:c57bd721-2888-47d1-97a4-7c7603396f2b","source":"wordfence","cve":"CVE-2026-27537","title":"Smart Popup by Supsystic <= 1.11.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c57bd721-2888-47d1-97a4-7c7603396f2b?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:02:17Z"},{"id":"wordfence:c57bffc8-1ee5-4380-a78f-f4fc8c606861","source":"wordfence","cve":"CVE-2024-5922","title":"Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c57bffc8-1ee5-4380-a78f-f4fc8c606861?source=api-prod","affected":[{"type":"theme","slug":"scylla-lite","name":"Scylla lite","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":""}],"published":"2024-06-27T20:12:55Z","updated":"2024-06-28T08:33:29Z"},{"id":"wordfence:c5811d13-0c5d-4a10-86a1-6318cc2e7663","source":"wordfence","cve":"CVE-2026-12432","title":"Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5811d13-0c5d-4a10-86a1-6318cc2e7663?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2026-06-26T18:04:03Z","updated":"2026-06-27T06:50:59Z"},{"id":"wordfence:c581616d-c9e7-46f2-9c2f-5e082a13fd0b","source":"wordfence","cve":"CVE-2024-5162","title":"WordPress prettyPhoto <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c581616d-c9e7-46f2-9c2f-5e082a13fd0b?source=api-prod","affected":[{"type":"plugin","slug":"prettyphoto","name":"PrettyPhoto \u2013 Simple Lightbox Plugin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-06-05T15:42:50Z","updated":"2025-05-27T19:51:36Z"},{"id":"wordfence:c5820352-a271-43c6-950d-815402241362","source":"wordfence","cve":"CVE-2015-1385","title":"PowerPress <= 6.0.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5820352-a271-43c6-950d-815402241362?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2015-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c583ef34-ddec-4d6c-9685-ef4bce5e785e","source":"wordfence","cve":"CVE-2023-44142","title":"Inactive Logout <= 3.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c583ef34-ddec-4d6c-9685-ef4bce5e785e?source=api-prod","affected":[{"type":"plugin","slug":"inactive-logout","name":"Inactive Logout","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c58a2de0-8bb3-4e48-889e-0a8f47ca2959","source":"wordfence","cve":"CVE-2020-7241","title":"WP Database Backup <= 5.5 - Unauthenticated Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c58a2de0-8bb3-4e48-889e-0a8f47ca2959?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2020-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c58d5a57-6b87-4a39-b995-c86fbc779565","source":"wordfence","cve":"CVE-2019-14314","title":"NextGEN Gallery <= 3.2.10 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c58d5a57-6b87-4a39-b995-c86fbc779565?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":false,"patched_in":"3.2.11"}],"published":"2019-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c58d9011-a082-48ca-b702-ef5563af2c66","source":"wordfence","cve":"CVE-2023-25788","title":"Saphali Woocommerce Lite <= 1.8.13 - Cross-Site Request Forgery via 'woocommerce_saphali_page_s_l'","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c58d9011-a082-48ca-b702-ef5563af2c66?source=api-prod","affected":[{"type":"plugin","slug":"saphali-woocommerce-lite","name":"Saphali Woocommerce Lite","from":"*","from_inclusive":true,"to":"1.8.13","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c58df44c-ec0a-4c61-b78c-a94d49be194c","source":"wordfence","cve":"CVE-2025-59001","title":"Salient Core <= 3.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c58df44c-ec0a-4c61-b78c-a94d49be194c?source=api-prod","affected":[{"type":"plugin","slug":"salient-core","name":"Salient | Creative Multipurpose & WooCommerce Theme","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2025-10-08T00:00:00Z","updated":"2025-12-19T22:05:03Z"},{"id":"wordfence:c58fa0a0-0b22-42df-8d3a-c3de78e12aa7","source":"wordfence","cve":"CVE-2021-24800","title":"DW Question & Answer Pro <= 1.3.6 - Missing Authorization Checks","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c58fa0a0-0b22-42df-8d3a-c3de78e12aa7?source=api-prod","affected":[{"type":"plugin","slug":"dw-question-answer-pro","name":"DW Question Answer Pro","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2022-04-08T00:00:00Z","updated":"2026-02-25T18:36:14Z"},{"id":"wordfence:c59195f5-bb77-4f96-bd5e-b871d663ccce","source":"wordfence","cve":"CVE-2024-39665","title":"Filter & Grids <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59195f5-bb77-4f96-bd5e-b871d663ccce?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:09:34Z"},{"id":"wordfence:c592887c-718c-46d7-8dc3-d337711471ee","source":"wordfence","cve":"CVE-2023-45768","title":"Next Page <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c592887c-718c-46d7-8dc3-d337711471ee?source=api-prod","affected":[{"type":"plugin","slug":"next-page","name":"Next Page","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c594e139-98c7-4369-bc3f-e92564135cf7","source":"wordfence","cve":"CVE-2025-39591","title":"WP Subscription Forms <= 1.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c594e139-98c7-4369-bc3f-e92564135cf7?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscription-forms","name":"WP Subscription Forms \u2013 Subscription Form Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-30T22:16:45Z"},{"id":"wordfence:c5960396-5320-4978-aa82-2e33700daa43","source":"wordfence","cve":"CVE-2024-8440","title":"Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5960396-5320-4978-aa82-2e33700daa43?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-09-10T17:52:37Z","updated":"2024-09-11T06:42:27Z"},{"id":"wordfence:c596c278-4f16-4830-8e6e-5e1392d4d118","source":"wordfence","cve":"CVE-2024-3065","title":"PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 -  Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c596c278-4f16-4830-8e6e-5e1392d4d118?source=api-prod","affected":[{"type":"plugin","slug":"paypal-pay-buy-donation-and-cart-buttons-shortcode","name":"PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-05-22T12:58:06Z","updated":"2024-06-27T13:43:40Z"},{"id":"wordfence:c59871cc-2d62-4eea-a78b-19810570c47d","source":"wordfence","cve":"CVE-2022-0840","title":"Easy Social Icons <= 3.2.0 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59871cc-2d62-4eea-a78b-19810570c47d?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c599a562-5218-4b37-bcf7-0e82008a4e68","source":"wordfence","cve":"CVE-2026-94504","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c599a562-5218-4b37-bcf7-0e82008a4e68?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-09-21T18:15:56Z","updated":"2026-09-24T19:53:33Z"},{"id":"wordfence:c59a365c-7fed-431b-8c28-a3b04f9828fe","source":"wordfence","cve":"CVE-2024-37268","title":"Striking <= 2.3.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59a365c-7fed-431b-8c28-a3b04f9828fe?source=api-prod","affected":[{"type":"theme","slug":"striking-r","name":"Striking","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:05:43Z"},{"id":"wordfence:c59a4802-ce4c-4f19-be7a-848862e1d3cf","source":"wordfence","cve":"CVE-2025-24695","title":"Extensions For CF7 <= 3.2.0 - Authenticated (Admin+) Sever-Side Request Forgery","severity":"low","cvss":3.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59a4802-ce4c-4f19-be7a-848862e1d3cf?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:18:34Z"},{"id":"wordfence:c59ac25a-3b97-4295-a882-6701f2a59db0","source":"wordfence","cve":"CVE-2025-31044","title":"Premium SEO Pack <= 3.3.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59ac25a-3b97-4295-a882-6701f2a59db0?source=api-prod","affected":[{"type":"plugin","slug":"premium-seo-pack","name":"Premium SEO Pack \u2013 WP SEO Plugin","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:50:25Z"},{"id":"wordfence:c59baad8-b888-4475-8371-645811a6b569","source":"wordfence","cve":"CVE-2023-47529","title":"Cloud Templates & Patterns collection <= 1.2.2 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59baad8-b888-4475-8371-645811a6b569?source=api-prod","affected":[{"type":"plugin","slug":"templates-patterns-collection","name":"Starter Sites & Templates by Neve","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c59c89da-f7d2-48a6-9489-824f542af804","source":"wordfence","cve":"CVE-2024-53716","title":"wp auto top <= 2.9.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59c89da-f7d2-48a6-9489-824f542af804?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-top","name":"wp auto top","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:27:14Z"},{"id":"wordfence:c59cddfb-c434-4a69-9c1c-7d58f022c1aa","source":"wordfence","cve":"","title":"Download Manager <= 2.8.7 - Privilege Escalation","severity":"medium","cvss":6.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59cddfb-c434-4a69-9c1c-7d58f022c1aa?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":false,"patched_in":"2.8.8"}],"published":"2016-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c59f1784-da65-4e6d-b284-d65ee2196be9","source":"wordfence","cve":"CVE-2023-49852","title":"Responsive Slick Slider WordPress <= 1.5 - Authenticated (Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c59f1784-da65-4e6d-b284-d65ee2196be9?source=api-prod","affected":[{"type":"plugin","slug":"responsive-slick-slider","name":"Responsive Slick Slider WordPress","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2025-04-04T13:13:56Z"},{"id":"wordfence:c5a0975e-99e9-46ea-82d4-0ab3149a03a6","source":"wordfence","cve":"CVE-2026-94231","title":"TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a0975e-99e9-46ea-82d4-0ab3149a03a6?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"1.1.9","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:02:18Z"},{"id":"wordfence:c5a0b8fe-d284-4780-84b5-2e97fa96c99a","source":"wordfence","cve":"CVE-2024-3564","title":"Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a0b8fe-d284-4780-84b5-2e97fa96c99a?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-widget","name":"Content Blocks (Custom Post Widget)","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-01T03:31:19Z"},{"id":"wordfence:c5a263d5-df39-412e-b40a-e06e23168b7e","source":"wordfence","cve":"CVE-2024-43213","title":"WC Marketplace <= 4.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a263d5-df39-412e-b40a-e06e23168b7e?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-22T17:24:05Z"},{"id":"wordfence:c5a26a49-f113-4aca-acc0-4b0c9955e13c","source":"wordfence","cve":"CVE-2026-12978","title":"FunnelKit <= 3.15.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a26a49-f113-4aca-acc0-4b0c9955e13c?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.5","to_inclusive":true,"patched_in":"3.15.0.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-29T23:14:58Z"},{"id":"wordfence:c5a2d57d-eaa1-4a8a-86cb-f28adf13fab2","source":"wordfence","cve":"CVE-2025-49917","title":"Icegram Express Pro <= 5.9.5 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a2d57d-eaa1-4a8a-86cb-f28adf13fab2?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers-premium","name":"Icegram Express Pro","from":"*","from_inclusive":true,"to":"5.9.5","to_inclusive":true,"patched_in":"5.9.6"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-29T16:31:05Z"},{"id":"wordfence:c5a404de-ee26-44af-9e4f-f93694da7a77","source":"wordfence","cve":"CVE-2024-5669","title":"XPlainer \u2013 WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a404de-ee26-44af-9e4f-f93694da7a77?source=api-prod","affected":[{"type":"plugin","slug":"faq-for-woocommerce","name":"Happy FAQs \u2013 FAQ, Product FAQ & Help Center","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-07-08T19:41:21Z","updated":"2024-08-01T20:20:40Z"},{"id":"wordfence:c5a43f29-74d5-43ac-8c36-b4bc58942b9e","source":"wordfence","cve":"CVE-2024-6718","title":"PVN Auth Popup <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a43f29-74d5-43ac-8c36-b4bc58942b9e?source=api-prod","affected":[{"type":"plugin","slug":"pvn-auth-popup","name":"PVN Auth Popup","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-08-01T13:41:37Z"},{"id":"wordfence:c5a49349-bf91-4705-8d39-cf46a15c83dd","source":"wordfence","cve":"CVE-2025-39556","title":"Mediavine Control Panel <= 2.10.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a49349-bf91-4705-8d39-cf46a15c83dd?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-control-panel","name":"Mediavine Control Panel","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:33:30Z"},{"id":"wordfence:c5a5c209-0ccd-4fa9-b22d-05bb22247441","source":"wordfence","cve":"","title":"OneLogin SAML-SSO Plugin < 2.1.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a5c209-0ccd-4fa9-b22d-05bb22247441?source=api-prod","affected":[{"type":"plugin","slug":"onelogin-saml-sso","name":"OneLogin SAML SSO","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2016-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5a8fd90-49dd-4a5e-88f2-cd6b338da2d6","source":"wordfence","cve":"CVE-2024-13600","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a8fd90-49dd-4a5e-88f2-cd6b338da2d6?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T05:28:40Z"},{"id":"wordfence:c5a9df99-3b0a-4689-ade3-a09d0cd2a049","source":"wordfence","cve":"CVE-2025-0718","title":"Nested Pages <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a9df99-3b0a-4689-ade3-a09d0cd2a049?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2025-03-02T00:00:00Z","updated":"2025-04-02T15:56:59Z"},{"id":"wordfence:c5aa0006-435d-4874-8d71-659d5d72e702","source":"wordfence","cve":"CVE-2021-25047","title":"10Web Social Photo Feed <= 1.4.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5aa0006-435d-4874-8d71-659d5d72e702?source=api-prod","affected":[{"type":"plugin","slug":"wd-instagram-feed","name":"10WebSocial","from":"*","from_inclusive":true,"to":"1.4.28","to_inclusive":true,"patched_in":"1.4.29"}],"published":"2021-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5aa7e58-79f4-426d-af93-7792ddef7f3a","source":"wordfence","cve":"CVE-2026-77008","title":"HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update","severity":"high","cvss":7.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5aa7e58-79f4-426d-af93-7792ddef7f3a?source=api-prod","affected":[{"type":"plugin","slug":"hel-online-classroom","name":"HEL Online Classroom: AI-powered Online Classrooms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:41:16Z"},{"id":"wordfence:c5ab685c-1e58-43f3-a984-52afcfaa5aca","source":"wordfence","cve":"CVE-2014-100016","title":"Photocrati <= 4.8.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ab685c-1e58-43f3-a984-52afcfaa5aca?source=api-prod","affected":[{"type":"theme","slug":"photocrati-theme","name":"Photocrati","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2014-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5ab6a1f-181c-4bc2-bcc3-e19f94fc5e46","source":"wordfence","cve":"CVE-2023-51373","title":"Google Photos Gallery with Shortcodes <= 4.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ab6a1f-181c-4bc2-bcc3-e19f94fc5e46?source=api-prod","affected":[{"type":"plugin","slug":"google-picasa-albums-viewer","name":"Google Photos Gallery with Shortcodes","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5abd601-132a-4d8b-bfcc-afd5c6ed9947","source":"wordfence","cve":"CVE-2025-10849","title":"Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5abd601-132a-4d8b-bfcc-afd5c6ed9947?source=api-prod","affected":[{"type":"plugin","slug":"felan-framework","name":"Felan Framework","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-10-15T18:07:34Z","updated":"2025-10-16T06:47:30Z"},{"id":"wordfence:c5ac4ad0-4fcf-4cb7-980c-162a561ab1ff","source":"wordfence","cve":"CVE-2025-58980","title":"Export WP Page to Static HTML/CSS <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ac4ad0-4fcf-4cb7-980c-162a561ab1ff?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:04:10Z"},{"id":"wordfence:c5ada976-03b8-4219-9ae3-9060fb7b9de5","source":"wordfence","cve":"CVE-2021-4370","title":"uListing <= 1.6.6 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ada976-03b8-4219-9ae3-9060fb7b9de5?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5b0939a-1699-483c-9a4f-7978155e6ad1","source":"wordfence","cve":"CVE-2022-46793","title":"Product Feed PRO for WooCommerce <= 12.4.0 - Cross-Site Request Forgery via update_project","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b0939a-1699-483c-9a4f-7978155e6ad1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"12.4.0","to_inclusive":true,"patched_in":"12.4.1"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5b26206-8cf5-41ac-8ce8-02d0a5dd161c","source":"wordfence","cve":"CVE-2026-97067","title":"EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b26206-8cf5-41ac-8ce8-02d0a5dd161c?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.7","to_inclusive":true,"patched_in":"8.8.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:44:10Z"},{"id":"wordfence:c5b2e22c-3811-4bf8-a8da-2ca9c38333dc","source":"wordfence","cve":"CVE-2022-1691","title":"Realty Workstation <= 1.0.9 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b2e22c-3811-4bf8-a8da-2ca9c38333dc?source=api-prod","affected":[{"type":"plugin","slug":"realty-workstation","name":"Realty Workstation","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5b30d27-a3f8-4535-a47f-675c939ec648","source":"wordfence","cve":"CVE-2026-8424","title":"Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b30d27-a3f8-4535-a47f-675c939ec648?source=api-prod","affected":[{"type":"plugin","slug":"remove-yellow-bgbox","name":"Remove Yellow BGBOX","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:07:21Z","updated":"2026-05-20T01:25:53Z"},{"id":"wordfence:c5b3f361-da53-42eb-b1fb-c0bfd641335b","source":"wordfence","cve":"CVE-2026-110019","title":"Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b3f361-da53-42eb-b1fb-c0bfd641335b?source=api-prod","affected":[{"type":"plugin","slug":"lpagery","name":"Bulk Page Generator \u2013 LPagery","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-15T15:58:29Z","updated":"2026-10-16T04:27:04Z"},{"id":"wordfence:c5b51ebf-4ae6-45b6-9eb3-dcfaeb8a06bd","source":"wordfence","cve":"CVE-2014-4550","title":"Shortcode Ninja <= 1.4 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b51ebf-4ae6-45b6-9eb3-dcfaeb8a06bd?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-ninja","name":"shortcode-ninja","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5b6003c-f19b-4cb1-8df3-e2b2ebf162ef","source":"wordfence","cve":"CVE-2026-115212","title":"mView <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b6003c-f19b-4cb1-8df3-e2b2ebf162ef?source=api-prod","affected":[{"type":"plugin","slug":"mview","name":"mView \u8c46\u74e3\u7535\u5f71","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:17:29Z"},{"id":"wordfence:c5b67927-5993-4e21-af52-8ebe7fee48ab","source":"wordfence","cve":"CVE-2024-2688","title":"EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b67927-5993-4e21-af52-8ebe7fee48ab?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T02:32:57Z"},{"id":"wordfence:c5b74908-65ed-4b6f-856f-e95cfd64f998","source":"wordfence","cve":"CVE-2023-36517","title":"WP Abstracts <= 2.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b74908-65ed-4b6f-856f-e95cfd64f998?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5b8268a-f3a3-4576-b235-962de37cc388","source":"wordfence","cve":"CVE-2025-3782","title":"Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b8268a-f3a3-4576-b235-962de37cc388?source=api-prod","affected":[{"type":"plugin","slug":"cision-block","name":"Cision Block","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2025-05-05T20:29:59Z","updated":"2025-05-06T09:21:50Z"},{"id":"wordfence:c5b9e53e-d2d3-40a0-adba-f489343c6ee6","source":"wordfence","cve":"CVE-2023-7246","title":"System Dashboard  <= 2.8.9 - Reflected Cross-Site Scripting via X-Forwarded-For","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b9e53e-d2d3-40a0-adba-f489343c6ee6?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":true,"patched_in":"2.8.10"}],"published":"2024-02-28T00:00:00Z","updated":"2024-08-16T19:08:38Z"},{"id":"wordfence:c5ba37d7-8fde-4ee3-93db-d2459da34bc4","source":"wordfence","cve":"CVE-2025-14172","title":"WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ba37d7-8fde-4ee3-93db-d2459da34bc4?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-page-permalinks","name":"WP Page Permalink Extension","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:56:04Z","updated":"2026-10-21T05:31:47Z"},{"id":"wordfence:c5bbf7ed-c154-4153-adbf-59f0f7aa3a18","source":"wordfence","cve":"CVE-2026-5096","title":"Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bbf7ed-c154-4153-adbf-59f0f7aa3a18?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T11:29:29Z"},{"id":"wordfence:c5bc615e-37ca-458b-b237-5770b9afe99b","source":"wordfence","cve":"CVE-2026-25469","title":"ViaBill \u2013 WooCommerce < 1.1.70 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bc615e-37ca-458b-b237-5770b9afe99b?source=api-prod","affected":[{"type":"plugin","slug":"viabill-woocommerce","name":"ViaBill \u2013 WooCommerce","from":"*","from_inclusive":true,"to":"1.1.70","to_inclusive":false,"patched_in":"1.1.70"}],"published":"2026-03-16T00:00:00Z","updated":"2026-05-26T18:19:20Z"},{"id":"wordfence:c5bc757d-2495-4be2-bccd-d4090e66ced4","source":"wordfence","cve":"CVE-2025-26936","title":"Fresh Framework <= 1.70.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bc757d-2495-4be2-bccd-d4090e66ced4?source=api-prod","affected":[{"type":"plugin","slug":"fresh-framework","name":"Fresh Framework","from":"*","from_inclusive":true,"to":"1.70.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T21:49:14Z"},{"id":"wordfence:c5bd11c6-2f55-4eee-834a-c4e405482b9c","source":"wordfence","cve":"CVE-2024-5756","title":"Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bd11c6-2f55-4eee-834a-c4e405482b9c?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.23","to_inclusive":true,"patched_in":"5.7.24"}],"published":"2024-06-20T16:01:32Z","updated":"2024-06-21T04:34:11Z"},{"id":"wordfence:c5bf1c8c-97b0-412c-aa26-88fd7bbe7c8c","source":"wordfence","cve":"","title":"Soundslides < 2.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bf1c8c-97b0-412c-aa26-88fd7bbe7c8c?source=api-prod","affected":[{"type":"plugin","slug":"soundslides","name":"Soundslides","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5bfa589-c9ee-40bb-ad41-36ff86030e30","source":"wordfence","cve":"CVE-2026-96682","title":"Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bfa589-c9ee-40bb-ad41-36ff86030e30?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-10-09T17:28:18Z","updated":"2026-10-10T05:31:05Z"},{"id":"wordfence:c5bfa818-65e4-4b36-8b61-6f47b42eb6c5","source":"wordfence","cve":"CVE-2014-9032","title":"WordPress Core < 4.0.1 - Cross-Site Scripting via media-playlists","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bfa818-65e4-4b36-8b61-6f47b42eb6c5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.7.5"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2014-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5c17dea-7b61-4e73-ac61-3fe536c22962","source":"wordfence","cve":"","title":"WooCommerce Products Vendor <= 2.1.65 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c17dea-7b61-4e73-ac61-3fe536c22962?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.65","to_inclusive":true,"patched_in":"2.1.66"}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5c2beb1-9478-487d-b11a-654e68ca9c3d","source":"wordfence","cve":"CVE-2024-43294","title":"Bold Timeline Lite <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c2beb1-9478-487d-b11a-654e68ca9c3d?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:36:36Z"},{"id":"wordfence:c5c3dd80-c6e0-4e7f-a921-712f3c3257a3","source":"wordfence","cve":"CVE-2024-13621","title":"The GDPR Framework By Data443 <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c3dd80-c6e0-4e7f-a921-712f3c3257a3?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-framework","name":"The GDPR Framework By Data443","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:44:40Z"},{"id":"wordfence:c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099","source":"wordfence","cve":"CVE-2025-11771","title":"Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=api-prod","affected":[{"type":"plugin","slug":"tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop","name":"Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-11-20T19:19:37Z","updated":"2026-02-13T19:43:04Z"},{"id":"wordfence:c5c82d8d-88eb-4159-af94-3f8e257dded6","source":"wordfence","cve":"CVE-2026-17162","title":"WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c82d8d-88eb-4159-af94-3f8e257dded6?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.24","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-28T13:20:07Z","updated":"2026-07-29T01:29:43Z"},{"id":"wordfence:c5c83ab8-91d4-488e-903d-2a4b7f0dfe7d","source":"wordfence","cve":"CVE-2026-104762","title":"Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c83ab8-91d4-488e-903d-2a4b7f0dfe7d?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.7.12.1"}],"published":"2026-10-09T17:16:22Z","updated":"2026-10-10T05:31:05Z"},{"id":"wordfence:c5c96063-a6ac-4325-9f44-a6f8344e00ef","source":"wordfence","cve":"CVE-2024-31109","title":"Woocommerce Social Media Share Buttons <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c96063-a6ac-4325-9f44-a6f8344e00ef?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-social-media-share-buttons","name":"Woocommerce Social Media Share Buttons","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:13:00Z"},{"id":"wordfence:c5c9d5de-f0d0-4469-97cc-8a25740c8fde","source":"wordfence","cve":"CVE-2022-41655","title":"Phone Orders for WooCommerce <= 3.7.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c9d5de-f0d0-4469-97cc-8a25740c8fde?source=api-prod","affected":[{"type":"plugin","slug":"phone-orders-for-woocommerce","name":"Phone Orders for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5cb6c6d-5617-4044-939e-c8795eaabad6","source":"wordfence","cve":"CVE-2026-108479","title":"Patreon WordPress <= 1.9.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5cb6c6d-5617-4044-939e-c8795eaabad6?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.17","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-12T17:34:00Z","updated":"2026-10-13T13:49:55Z"},{"id":"wordfence:c5cc35d4-741d-4fea-974a-6ee01fbfefc6","source":"wordfence","cve":"CVE-2025-68560","title":"TheGem Theme Elements (for Elementor) <= 5.10.5.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5cc35d4-741d-4fea-974a-6ee01fbfefc6?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements-elementor","name":"TheGem Theme Elements","from":"*","from_inclusive":true,"to":"5.10.5.1","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-12T00:00:00Z","updated":"2026-01-06T14:23:47Z"},{"id":"wordfence:c5cdc4bc-d1ea-429e-8b33-6872d8aa5bba","source":"wordfence","cve":"CVE-2026-89000","title":"WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5cdc4bc-d1ea-429e-8b33-6872d8aa5bba?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.26","to_inclusive":true,"patched_in":"2.8.27"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:56:18Z"},{"id":"wordfence:c5ce2d08-6e01-4a7c-a2d5-ba98639107a8","source":"wordfence","cve":"","title":"MultiParcels Shipping For WooCommerce <= 1.15.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ce2d08-6e01-4a7c-a2d5-ba98639107a8?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.15.5","to_inclusive":true,"patched_in":"1.15.6"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5cff14e-e891-4569-afd8-2885ebb26401","source":"wordfence","cve":"CVE-2025-4405","title":"Hot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5cff14e-e891-4569-afd8-2885ebb26401?source=api-prod","affected":[{"type":"plugin","slug":"hot-random-image","name":"Hot Random Image","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-05-21T20:43:16Z","updated":"2025-05-22T09:21:51Z"},{"id":"wordfence:c5d0c910-e641-4ec7-a071-1069726580fc","source":"wordfence","cve":"CVE-2026-14921","title":"Ultimate Addons for WPBakery Page Builder <= 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d0c910-e641-4ec7-a071-1069726580fc?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.21.4","to_inclusive":true,"patched_in":"3.21.5"}],"published":"2026-07-13T00:00:00Z","updated":"2026-09-18T14:39:44Z"},{"id":"wordfence:c5d0dda5-c323-484b-be34-cf2fc4496602","source":"wordfence","cve":"CVE-2025-54710","title":"Tiktok Feed <= 1.0.21 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d0dda5-c323-484b-be34-cf2fc4496602?source=api-prod","affected":[{"type":"plugin","slug":"b-tiktok-feed","name":"Feeds for TikTok \u2013 Keep Your Site Fresh with Your Latest Videos","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:44:11Z"},{"id":"wordfence:c5d17538-30ff-423c-bd61-d85a3f5aba74","source":"wordfence","cve":"CVE-2026-8790","title":"Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d17538-30ff-423c-bd61-d85a3f5aba74?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2026-08-04T16:20:12Z","updated":"2026-08-05T04:25:26Z"},{"id":"wordfence:c5d330cd-ad1f-451e-bf41-39cfeb296cf0","source":"wordfence","cve":"CVE-2023-6965","title":"Pods - Custom Content Types and Fields - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d330cd-ad1f-451e-bf41-39cfeb296cf0?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.7.31","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.8","from_inclusive":true,"to":"2.8.23.2","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3","from_inclusive":true,"to":"3.0.10.2","to_inclusive":false,"patched_in":"2.7.31.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-07-29T21:37:23Z"},{"id":"wordfence:c5d39e14-959f-4aba-9413-21beeb840c59","source":"wordfence","cve":"CVE-2025-68542","title":"Checkout Gateway for IRIS <= 1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d39e14-959f-4aba-9413-21beeb840c59?source=api-prod","affected":[{"type":"plugin","slug":"checkout-gateway-iris","name":"Checkout Gateway for IRIS","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:11:56Z"},{"id":"wordfence:c5d39e9b-9753-4c87-8576-982f6744912f","source":"wordfence","cve":"CVE-2011-4562","title":"Redirection <= 2.2.9 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d39e9b-9753-4c87-8576-982f6744912f?source=api-prod","affected":[{"type":"plugin","slug":"redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":false,"patched_in":"2.2.10"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5d46fdb-b028-4298-884b-e4fe9d6bb5ca","source":"wordfence","cve":"CVE-2025-47562","title":"MapSVG <= 8.5.34 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d46fdb-b028-4298-884b-e4fe9d6bb5ca?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.5.34","to_inclusive":true,"patched_in":"8.6.11"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-13T21:58:24Z"},{"id":"wordfence:c5d6e18b-00d0-4f02-b56b-692170c08d99","source":"wordfence","cve":"CVE-2021-20846","title":"Push Notifications for WordPress (Lite) < 6.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d6e18b-00d0-4f02-b56b-692170c08d99?source=api-prod","affected":[{"type":"plugin","slug":"push-notifications-for-wp","name":"Push Notifications for WordPress (Lite)","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":false,"patched_in":"6.0.1"}],"published":"2021-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5d8a452-1f80-4bd8-bf63-086139a67189","source":"wordfence","cve":"CVE-2025-32564","title":"Stop Registration Spam <= 1.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d8a452-1f80-4bd8-bf63-086139a67189?source=api-prod","affected":[{"type":"plugin","slug":"stop-registration-spam","name":"Stop Registration Spam","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:47:56Z"},{"id":"wordfence:c5d96be2-b89a-46b0-a4f1-da44f9b54b2d","source":"wordfence","cve":"CVE-2024-31933","title":"Page Builder: Live Composer <= 1.5.35 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5d96be2-b89a-46b0-a4f1-da44f9b54b2d?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.35","to_inclusive":true,"patched_in":"1.5.36"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:54:56Z"},{"id":"wordfence:c5da24e6-442f-450c-91d3-581719dc7210","source":"wordfence","cve":"CVE-2024-7769","title":"Wordpress Clicksold IDX Plugin <= 1.90 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5da24e6-442f-450c-91d3-581719dc7210?source=api-prod","affected":[{"type":"plugin","slug":"clicksold-wordpress-plugin","name":"ClickSold IDX","from":"*","from_inclusive":true,"to":"1.90","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-27T14:20:18Z"},{"id":"wordfence:c5dbc414-3043-4820-b929-a82f8ad0c7e6","source":"wordfence","cve":"CVE-2026-86785","title":"Social Commerce for WooCommerce <= 2.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5dbc414-3043-4820-b929-a82f8ad0c7e6?source=api-prod","affected":[{"type":"plugin","slug":"woo-to-facebook-shop","name":"Social Commerce for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-20T00:00:00Z","updated":"2026-09-29T19:38:36Z"},{"id":"wordfence:c5decbb3-05a0-403f-918a-9b516df85778","source":"wordfence","cve":"CVE-2024-24929","title":"WP Contact Form <= 1.6 - Cross-Site Request Forgery via wpcf_adminpage","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5decbb3-05a0-403f-918a-9b516df85778?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form","name":"WP Contact Form","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-12T15:20:03Z"},{"id":"wordfence:c5e011d3-bd0f-46cb-9fb1-af06bcb7e307","source":"wordfence","cve":"CVE-2011-4618","title":"Advanced Text Widget <= 2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e011d3-bd0f-46cb-9fb1-af06bcb7e307?source=api-prod","affected":[{"type":"plugin","slug":"advanced-text-widget","name":"Advanced Text Widget","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2012-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5e26a56-bba0-4204-bcb7-c5ec123a9b2d","source":"wordfence","cve":"CVE-2023-47852","title":"Link Whisper Free <= 0.6.5 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e26a56-bba0-4204-bcb7-c5ec123a9b2d?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":true,"patched_in":"0.6.6"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5e4e1e3-61a6-4c37-80dd-93b5cea440e3","source":"wordfence","cve":"CVE-2025-5339","title":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via \u2018bsa_pro_id'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:54:19Z","updated":"2025-07-02T03:47:26Z"},{"id":"wordfence:c5e516d6-eece-42d3-9349-29be685a3509","source":"wordfence","cve":"CVE-2024-35673","title":"Pure Chat \u2013 Live Chat Plugin & More! <= 2.22 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e516d6-eece-42d3-9349-29be685a3509?source=api-prod","affected":[{"type":"plugin","slug":"pure-chat","name":"Pure Chat \u2013 Live Chat & More!","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"2.23"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-19T17:07:11Z"},{"id":"wordfence:c5e64adf-49b3-4e85-8dc1-918f7e92965b","source":"wordfence","cve":"CVE-2024-7144","title":"JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e64adf-49b3-4e85-8dc1-918f7e92965b?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.20","to_inclusive":true,"patched_in":"2.6.20.1"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T13:48:56Z"},{"id":"wordfence:c5e65bba-e1eb-43b9-b3a6-7b8437692318","source":"wordfence","cve":"CVE-2026-24567","title":"Anything Order by Terms <= 1.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e65bba-e1eb-43b9-b3a6-7b8437692318?source=api-prod","affected":[{"type":"plugin","slug":"anything-order-by-terms","name":"Anything Order by Terms","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:11:24Z"},{"id":"wordfence:c5e66244-2b86-491b-9eca-19e42e7f2da8","source":"wordfence","cve":"","title":"Category Order and Taxonomy Terms Order <1.4.6.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e66244-2b86-491b-9eca-19e42e7f2da8?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-terms-order","name":"Category Order and Taxonomy Terms Order","from":"*","from_inclusive":true,"to":"1.4.6.0","to_inclusive":false,"patched_in":"1.4.6.1"}],"published":"2015-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5e71478-41f9-4312-8202-751d2e4c2088","source":"wordfence","cve":"CVE-2026-16260","title":"Post Grid, Slider & Carousel Ultimate <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e71478-41f9-4312-8202-751d2e4c2088?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-02T21:46:59Z"},{"id":"wordfence:c5e9ab63-d61e-40f1-a5cb-432f33dfd2a6","source":"wordfence","cve":"CVE-2024-11219","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e9ab63-d61e-40f1-a5cb-432f33dfd2a6?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-11-26T16:32:46Z","updated":"2024-11-27T05:31:57Z"},{"id":"wordfence:c5ea9f51-0ccf-4dda-82ee-80da5dc12c2a","source":"wordfence","cve":"CVE-2026-27345","title":"E-cab Taxi Booking Manager for Woocommerce <= 2.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ea9f51-0ccf-4dda-82ee-80da5dc12c2a?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:05:38Z"},{"id":"wordfence:c5eb35dc-08f9-4aa0-9eae-f5ce9db1cd10","source":"wordfence","cve":"CVE-2026-39549","title":"Aperitif <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5eb35dc-08f9-4aa0-9eae-f5ce9db1cd10?source=api-prod","affected":[{"type":"theme","slug":"aperitif","name":"Aperitif - Wine Shop and Liquor Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:16:10Z"},{"id":"wordfence:c5eb9b1f-39d5-4c5d-8fb3-71d4bbe5f43a","source":"wordfence","cve":"CVE-2023-40219","title":"Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5eb9b1f-39d5-4c5d-8fb3-71d4bbe5f43a?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.21","to_inclusive":true,"patched_in":"2.8.22"}],"published":"2023-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5ed7387-34e2-4cf0-926b-e5c2ef4222cd","source":"wordfence","cve":"CVE-2025-22754","title":"Amber <= 1.4.4  - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ed7387-34e2-4cf0-926b-e5c2ef4222cd?source=api-prod","affected":[{"type":"plugin","slug":"amberlink","name":"Amber","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T15:03:15Z"},{"id":"wordfence:c5ee1e5d-92ee-4bd1-8da7-65294bcc4b04","source":"wordfence","cve":"CVE-2025-60039","title":"Noisa <= 2.6.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ee1e5d-92ee-4bd1-8da7-65294bcc4b04?source=api-prod","affected":[{"type":"theme","slug":"noisa","name":"Noisa","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T16:08:54Z"},{"id":"wordfence:c5ee2ae1-ea25-46fa-bc7c-114d4f6f9b4b","source":"wordfence","cve":"CVE-2024-37422","title":"Progress Planner <= 0.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ee2ae1-ea25-46fa-bc7c-114d4f6f9b4b?source=api-prod","affected":[{"type":"plugin","slug":"progress-planner","name":"Progress Planner","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":"0.9.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:51:19Z"},{"id":"wordfence:c5f12e55-3608-415a-82ce-34781994111c","source":"wordfence","cve":"CVE-2026-25409","title":"JAMstack Deployments <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f12e55-3608-415a-82ce-34781994111c?source=api-prod","affected":[{"type":"plugin","slug":"wp-jamstack-deployments","name":"JAMstack Deployments","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-26T19:54:30Z"},{"id":"wordfence:c5f13373-4a8d-4171-9ad6-d4d65cfc036c","source":"wordfence","cve":"CVE-2026-97191","title":"Advanced Custom Fields <= 6.8.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f13373-4a8d-4171-9ad6-d4d65cfc036c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"6.8.11"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T20:12:38Z"},{"id":"wordfence:c5f23c14-e9ed-474c-9acc-2d6d43201572","source":"wordfence","cve":"CVE-2014-4560","title":"Toolpage <= 1.6.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f23c14-e9ed-474c-9acc-2d6d43201572?source=api-prod","affected":[{"type":"plugin","slug":"toolpage","name":"Toolpage","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5f24f89-3653-452d-bb1e-8bc113770624","source":"wordfence","cve":"CVE-2024-51907","title":"WP Virtual Room Configurator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f24f89-3653-452d-bb1e-8bc113770624?source=api-prod","affected":[{"type":"plugin","slug":"configure-conference-room","name":"WP Virtual Room Configurator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:55:21Z"},{"id":"wordfence:c5f30190-4576-4c2b-b069-72501538733b","source":"wordfence","cve":"CVE-2023-3198","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f30190-4576-4c2b-b069-72501538733b?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5f3e34d-07fb-4e49-a4e2-f8e92301b35e","source":"wordfence","cve":"CVE-2022-2443","title":"FreeMind WP Browser <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f3e34d-07fb-4e49-a4e2-f8e92301b35e?source=api-prod","affected":[{"type":"plugin","slug":"freemind-wp-browser","name":"FreeMind WP Browser","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5f6ae5d-7854-44c7-9fb8-efaa6e850d59","source":"wordfence","cve":"CVE-2023-4716","title":"Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f6ae5d-7854-44c7-9fb8-efaa6e850d59?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5f9bc43-6a93-495d-b2af-954aafcf3dfe","source":"wordfence","cve":"CVE-2024-9599","title":"Popup Box <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f9bc43-6a93-495d-b2af-954aafcf3dfe?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2024-10-31T00:00:00Z","updated":"2025-05-29T22:43:02Z"},{"id":"wordfence:c5fa2f02-4a81-4d49-b473-7447cd371244","source":"wordfence","cve":"CVE-2016-1000147","title":"Recipes Writer <= 1.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fa2f02-4a81-4d49-b473-7447cd371244?source=api-prod","affected":[{"type":"plugin","slug":"recipes-writer","name":"Recipes Writer","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5fbb963-f89d-4037-9456-8587bcf5d620","source":"wordfence","cve":"CVE-2025-13856","title":"Extra Post Images <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fbb963-f89d-4037-9456-8587bcf5d620?source=api-prod","affected":[{"type":"plugin","slug":"extra-post-images","name":"Extra Post Images","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:43:02Z","updated":"2025-12-06T05:49:33Z"},{"id":"wordfence:c5fcbb61-5f22-4333-bdd9-7d843dd7e45a","source":"wordfence","cve":"CVE-2017-10889","title":"TablePress <= 1.8 - XML External Entity Injection","severity":"medium","cvss":4.3,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fcbb61-5f22-4333-bdd9-7d843dd7e45a?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2017-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5fcfa21-b3f7-4241-a931-9708ced4f811","source":"wordfence","cve":"CVE-2024-13921","title":"Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fcfa21-b3f7-4241-a931-9708ced4f811?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-03-19T22:28:23Z","updated":"2025-03-20T11:11:28Z"},{"id":"wordfence:c5fd2255-7f02-4de8-b904-a753580123b9","source":"wordfence","cve":"CVE-2024-53762","title":"FastBook \u2013 Responsive Appointment Booking and Scheduling System <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fd2255-7f02-4de8-b904-a753580123b9?source=api-prod","affected":[{"type":"plugin","slug":"fastbook-responsive-appointment-booking-and-scheduling-system","name":"FastBook \u2013 Responsive Appointment Booking and Scheduling System","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:24:20Z"},{"id":"wordfence:c5fe6884-4a31-4341-b30f-354b447f5313","source":"wordfence","cve":"CVE-2014-4557","title":"Jigoshop Swipe plugin <= 3.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fe6884-4a31-4341-b30f-354b447f5313?source=api-prod","affected":[{"type":"plugin","slug":"swipe-hq-checkout-for-jigoshop","name":"Jigoshop Swipe plugin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5fee6e4-b985-4190-953b-133bc90e47da","source":"wordfence","cve":"","title":"Freshmail <= 1.5.8 - Multiple SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5fee6e4-b985-4190-953b-133bc90e47da?source=api-prod","affected":[{"type":"plugin","slug":"freshmail-newsletter","name":"Freshmail for WordPress","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.6"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c5ff309e-4ada-4683-b850-89e0ef9ebaee","source":"wordfence","cve":"CVE-2026-91074","title":"BSK PDF Manager < 3.8.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ff309e-4ada-4683-b850-89e0ef9ebaee?source=api-prod","affected":[{"type":"plugin","slug":"bsk-pdf-manager","name":"BSK PDF Manager","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2026-10-14T00:00:00Z","updated":"2026-11-10T23:21:50Z"},{"id":"wordfence:c5ffe80a-edd3-4369-a5bc-ce7c9b259416","source":"wordfence","cve":"CVE-2025-39417","title":"Redirect wordpress to welcome or landing page <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5ffe80a-edd3-4369-a5bc-ce7c9b259416?source=api-prod","affected":[{"type":"plugin","slug":"redirect-to-welcome-or-landing-page","name":"Redirect wordpress to welcome or landing page","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-30T22:15:22Z"},{"id":"wordfence:c600d267-0fed-4682-bc71-5bd0d2f70cae","source":"wordfence","cve":"CVE-2025-14564","title":"Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c600d267-0fed-4682-bc71-5bd0d2f70cae?source=api-prod","affected":[{"type":"plugin","slug":"viable-url-media-uploader","name":"Viable URL Media Uploader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T20:24:02Z","updated":"2026-10-14T18:27:06Z"},{"id":"wordfence:c600e8d0-7fe1-408e-a51d-8519a9acceb1","source":"wordfence","cve":"CVE-2024-32832","title":"Login with phone number <= 1.6.93 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c600e8d0-7fe1-408e-a51d-8519a9acceb1?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.6.93","to_inclusive":true,"patched_in":"1.6.94"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:04:48Z"},{"id":"wordfence:c6025dd5-a1d7-48cc-90b3-f020d3d2298b","source":"wordfence","cve":"CVE-2024-7791","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6025dd5-a1d7-48cc-90b3-f020d3d2298b?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.4.3","to_inclusive":true,"patched_in":"1.4.4.4"}],"published":"2024-08-26T22:18:11Z","updated":"2024-08-27T10:59:49Z"},{"id":"wordfence:c603bd67-2e14-45ed-bbff-1bcbd3c18425","source":"wordfence","cve":"CVE-2026-25312","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c603bd67-2e14-45ed-bbff-1bcbd3c18425?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.3","to_inclusive":true,"patched_in":"4.2.8.4"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-27T20:17:15Z"},{"id":"wordfence:c6048ba9-671f-4729-9618-d7a0556a31e6","source":"wordfence","cve":"CVE-2024-4479","title":"Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6048ba9-671f-4729-9618-d7a0556a31e6?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-06-14T12:29:18Z","updated":"2024-06-15T02:02:01Z"},{"id":"wordfence:c6070ea5-3231-4a36-b154-400c86eaf31b","source":"wordfence","cve":"CVE-2026-40798","title":"wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6070ea5-3231-4a36-b154-400c86eaf31b?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:30:05Z"},{"id":"wordfence:c60979fc-d2d2-4995-87fd-077ea6569a51","source":"wordfence","cve":"CVE-2025-22586","title":"WPEX Replace DB Urls <= 0.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c60979fc-d2d2-4995-87fd-077ea6569a51?source=api-prod","affected":[{"type":"plugin","slug":"wpex-replace","name":"WPEX Replace DB Urls","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:51:32Z"},{"id":"wordfence:c60ddcba-99e7-4cba-8bee-f2b01369b025","source":"wordfence","cve":"CVE-2025-53291","title":"Spreadconnect <= 2.1.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c60ddcba-99e7-4cba-8bee-f2b01369b025?source=api-prod","affected":[{"type":"plugin","slug":"wc-spod","name":"Spreadconnect","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2025-06-27T00:00:00Z","updated":"2026-09-30T14:22:51Z"},{"id":"wordfence:c60f68e6-67f7-4a08-916c-83a1ab34fea6","source":"wordfence","cve":"CVE-2024-34790","title":"ImageMagick Sharpen Resized Images <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c60f68e6-67f7-4a08-916c-83a1ab34fea6?source=api-prod","affected":[{"type":"plugin","slug":"imagemagick-sharpen-resized-images","name":"ImageMagick Sharpen Resized Images","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T21:00:01Z"},{"id":"wordfence:c6102c07-2776-4963-8d16-a779c5979275","source":"wordfence","cve":"CVE-2024-10266","title":"Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6102c07-2776-4963-8d16-a779c5979275?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.60","to_inclusive":true,"patched_in":"4.10.61"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T11:01:35Z"},{"id":"wordfence:c6109256-ac1d-43cf-b6e4-53aee4725483","source":"wordfence","cve":"CVE-2024-54338","title":"Hello Event Widgets For Elementor <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6109256-ac1d-43cf-b6e4-53aee4725483?source=api-prod","affected":[{"type":"plugin","slug":"hello-event-widgets-for-elementor","name":"Hello Event Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:11:51Z"},{"id":"wordfence:c61093b0-6004-4f20-bea5-95c891f44a13","source":"wordfence","cve":"CVE-2025-54741","title":"Super Blank <= 1.2.0 - Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c61093b0-6004-4f20-bea5-95c891f44a13?source=api-prod","affected":[{"type":"plugin","slug":"super-blank","name":"Super Blank","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-09-23T00:00:00Z","updated":"2025-09-30T12:40:09Z"},{"id":"wordfence:c6168ee5-5df3-4d79-96bb-95029f2ac54b","source":"wordfence","cve":"","title":"iThemes Security <= 4.6.12 - Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6168ee5-5df3-4d79-96bb-95029f2ac54b?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"4.6.13","to_inclusive":false,"patched_in":"4.6.13"}],"published":"2015-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c61877f7-b037-4ddb-8f04-14c01268884b","source":"wordfence","cve":"CVE-2025-39368","title":"Rootspersona <= 3.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c61877f7-b037-4ddb-8f04-14c01268884b?source=api-prod","affected":[{"type":"plugin","slug":"rootspersona","name":"RootsPersona","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-05-19T00:00:00Z","updated":"2026-07-31T12:12:30Z"},{"id":"wordfence:c619cb36-7216-4a23-96d2-57d8142be4af","source":"wordfence","cve":"CVE-2021-24819","title":"Page/Post Content Shortcode <= 1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c619cb36-7216-4a23-96d2-57d8142be4af?source=api-prod","affected":[{"type":"plugin","slug":"pagepost-content-shortcode","name":"Page/Post Content Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c619e758-c71d-41cf-bff9-119ad9e3d9c4","source":"wordfence","cve":"CVE-2024-47340","title":"Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c619e758-c71d-41cf-bff9-119ad9e3d9c4?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.89","to_inclusive":true,"patched_in":"2.2.90"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:21:46Z"},{"id":"wordfence:c61b5668-18d8-42e0-9ee3-d26ab7424350","source":"wordfence","cve":"CVE-2023-47672","title":"WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c61b5668-18d8-42e0-9ee3-d26ab7424350?source=api-prod","affected":[{"type":"plugin","slug":"wp-category-posts-list","name":"WP Category Post List Widget","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c61b5726-6d54-4e1a-bf39-fb057bcd8c29","source":"wordfence","cve":"CVE-2025-31535","title":"Simple Owl Carousel <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c61b5726-6d54-4e1a-bf39-fb057bcd8c29?source=api-prod","affected":[{"type":"plugin","slug":"simple-owl-carousel","name":"Simple Owl Carousel","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:17:42Z"},{"id":"wordfence:c61e0ff9-436a-4d82-be40-9ac5b4206976","source":"wordfence","cve":"CVE-2026-105195","title":"Booking Calendar 10.15 - 11.8.2 - Authenticated (Editor+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c61e0ff9-436a-4d82-be40-9ac5b4206976?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"10.15","from_inclusive":true,"to":"11.8.2","to_inclusive":true,"patched_in":"11.8.3"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:34:53Z"},{"id":"wordfence:c6210c35-31d7-4a8d-b34f-596977c7a33e","source":"wordfence","cve":"CVE-2025-4586","title":"IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6210c35-31d7-4a8d-b34f-596977c7a33e?source=api-prod","affected":[{"type":"plugin","slug":"irm-newsroom","name":"IRM Newsroom","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"}],"published":"2025-06-12T13:12:28Z","updated":"2025-11-05T21:36:05Z"},{"id":"wordfence:c621e57e-8483-4dde-9c83-cc4522f92c1c","source":"wordfence","cve":"CVE-2022-22734","title":"Simple Quotation <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c621e57e-8483-4dde-9c83-cc4522f92c1c?source=api-prod","affected":[{"type":"plugin","slug":"simple-quotation","name":"Simple Quotation","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2022-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c62260f8-fe32-4f30-9366-23e64ad5bd36","source":"wordfence","cve":"CVE-2026-11782","title":"Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62260f8-fe32-4f30-9366-23e64ad5bd36?source=api-prod","affected":[{"type":"plugin","slug":"points-and-rewards-for-woocommerce","name":"Points and Rewards for WooCommerce \u2013 Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":false,"patched_in":"2.10.1"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:18:16Z"},{"id":"wordfence:c624e17f-66f8-4389-b922-b97c73b3c4a2","source":"wordfence","cve":"CVE-2025-32237","title":"MasterStudy LMS <= 3.5.28 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c624e17f-66f8-4389-b922-b97c73b3c4a2?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.5.28","to_inclusive":true,"patched_in":"3.5.29"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:03:19Z"},{"id":"wordfence:c62680b5-e9e0-497f-b957-9b223a623917","source":"wordfence","cve":"CVE-2024-13475","title":"Small Package Quotes \u2013 UPS Edition <= 4.5.16 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62680b5-e9e0-497f-b957-9b223a623917?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-ups-edition","name":"Small Package Quotes \u2013 UPS Edition","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T09:22:53Z"},{"id":"wordfence:c62860e2-8c89-4f1c-a7d8-ef13f545ad52","source":"wordfence","cve":"CVE-2021-24369","title":"WordPress Payments Plugin | GetPaid <= 2.3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62860e2-8c89-4f1c-a7d8-ef13f545ad52?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2021-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c628dc0b-0648-4b7b-88cf-368771ebee45","source":"wordfence","cve":"CVE-2025-66091","title":"Stylish Cost Calculator <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c628dc0b-0648-4b7b-88cf-368771ebee45?source=api-prod","affected":[{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"8.1.5","to_inclusive":true,"patched_in":"8.1.6"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-24T20:59:55Z"},{"id":"wordfence:c62aa119-98bc-485e-92f2-43bf21756ebd","source":"wordfence","cve":"CVE-2024-11901","title":"PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62aa119-98bc-485e-92f2-43bf21756ebd?source=api-prod","affected":[{"type":"plugin","slug":"embed-power-bi-reports","name":"PowerBI Embed Reports","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2024-12-11T15:09:02Z","updated":"2024-12-12T20:06:30Z"},{"id":"wordfence:c62cb055-2816-40dc-b25b-395d7e230c9f","source":"wordfence","cve":"","title":"GD bbPress Attachments <= 2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62cb055-2816-40dc-b25b-395d7e230c9f?source=api-prod","affected":[{"type":"plugin","slug":"gd-bbpress-attachments","name":"forumAttachments for bbPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2018-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c62d8146-e4b1-4c86-9d8a-c3a9bbfb0763","source":"wordfence","cve":"","title":"Profile Builder \u2013 User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62d8146-e4b1-4c86-9d8a-c3a9bbfb0763?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"1.1.60","to_inclusive":false,"patched_in":"1.1.60"}],"published":"2014-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c62e8fc2-fad5-4fcc-b0e8-e434b21b65d1","source":"wordfence","cve":"CVE-2025-39597","title":"Fast eBay Listings <= 2.12.15 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62e8fc2-fad5-4fcc-b0e8-e434b21b65d1?source=api-prod","affected":[{"type":"plugin","slug":"fast-ebay-listings","name":"Fast eBay Listings","from":"*","from_inclusive":true,"to":"2.12.15","to_inclusive":true,"patched_in":"2.12.16"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:51:10Z"},{"id":"wordfence:c62ec31a-55e9-4404-b860-fa9a51ba3d3f","source":"wordfence","cve":"CVE-2024-4273","title":"Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c62ec31a-55e9-4404-b860-fa9a51ba3d3f?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-06-03T16:39:39Z","updated":"2024-07-08T20:43:42Z"},{"id":"wordfence:c63048ad-3d37-402e-8e61-415d2d6caa69","source":"wordfence","cve":"","title":"Form Lightbox <= 2.1 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63048ad-3d37-402e-8e61-415d2d6caa69?source=api-prod","affected":[{"type":"plugin","slug":"form-lightbox","name":"Form Lightbox","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c63079af-6a22-4692-ab81-96e166a00c38","source":"wordfence","cve":"","title":"Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Arbitrary Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63079af-6a22-4692-ab81-96e166a00c38?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6372bcd-ae01-4fe4-ac9e-4f3c34c34416","source":"wordfence","cve":"CVE-2024-9770","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.11 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6372bcd-ae01-4fe4-ac9e-4f3c34c34416?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.11","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-03-03T00:00:00Z","updated":"2025-04-21T15:54:26Z"},{"id":"wordfence:c63c0627-2402-4b93-b0fa-3764b245a585","source":"wordfence","cve":"CVE-2026-66684","title":"Export Import Menus <= 1.9.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63c0627-2402-4b93-b0fa-3764b245a585?source=api-prod","affected":[{"type":"plugin","slug":"export-import-menus","name":"Export Import Menus","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:59:59Z"},{"id":"wordfence:c63cc262-28a9-43d0-9b4b-25a5a87fd2d6","source":"wordfence","cve":"CVE-2026-105992","title":"Ettrick Escape Room Booking <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63cc262-28a9-43d0-9b4b-25a5a87fd2d6?source=api-prod","affected":[{"type":"plugin","slug":"ettrick-escape-room-booking","name":"Escape Room Booking Pro","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:04:44Z"},{"id":"wordfence:c63d5ccb-8798-4894-8bac-83bebe353cd0","source":"wordfence","cve":"CVE-2024-51779","title":"Don't Break The Code <= .3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63d5ccb-8798-4894-8bac-83bebe353cd0?source=api-prod","affected":[{"type":"plugin","slug":"dont-break-the-code","name":"Don't Break The Code","from":"*","from_inclusive":true,"to":".3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T19:07:35Z"},{"id":"wordfence:c63ddc62-a4f1-4da4-a65e-4573369d6c30","source":"wordfence","cve":"CVE-2024-1649","title":"Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63ddc62-a4f1-4da4-a65e-4573369d6c30?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:53:32Z"},{"id":"wordfence:c63e7dbb-af56-47b9-8206-5bef96754a38","source":"wordfence","cve":"CVE-2024-37421","title":"JobScout <= 1.1.4 - Cross-Site Request Forgery to Notice Dimissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63e7dbb-af56-47b9-8206-5bef96754a38?source=api-prod","affected":[{"type":"theme","slug":"jobscout","name":"JobScout","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:49:19Z"},{"id":"wordfence:c63eb95c-cda6-4f88-8b23-5162663150c1","source":"wordfence","cve":"CVE-2025-67622","title":"Evergreen Post Tweeter <= 1.8.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63eb95c-cda6-4f88-8b23-5162663150c1?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-post-tweeter","name":"Evergreen Post Tweeter","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-05T18:42:55Z"},{"id":"wordfence:c63ff9d7-6a14-4186-8550-4e5c50855e7f","source":"wordfence","cve":"CVE-2024-4567","title":"Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c63ff9d7-6a14-4186-8550-4e5c50855e7f?source=api-prod","affected":[{"type":"plugin","slug":"themify-shortcodes","name":"Themify Shortcodes","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:38Z"},{"id":"wordfence:c64189c8-b064-4fd2-bb3d-00cb4054ae51","source":"wordfence","cve":"CVE-2025-49280","title":"Magty <= 1.0.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c64189c8-b064-4fd2-bb3d-00cb4054ae51?source=api-prod","affected":[{"type":"theme","slug":"magty","name":"Magty","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T17:53:48Z"},{"id":"wordfence:c6451aaa-d4ef-4903-8e30-97dfee456d93","source":"wordfence","cve":"CVE-2025-53266","title":"Cron Logger <= 1.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6451aaa-d4ef-4903-8e30-97dfee456d93?source=api-prod","affected":[{"type":"plugin","slug":"cron-logger","name":"Cron Logger","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-06-27T00:00:00Z","updated":"2026-08-14T15:14:30Z"},{"id":"wordfence:c647beda-cf73-4372-975f-a8c8ed05217f","source":"wordfence","cve":"CVE-2024-4352","title":"Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c647beda-cf73-4372-975f-a8c8ed05217f?source=api-prod","affected":[{"type":"plugin","slug":"tutor-pro","name":"Tutor LMS Pro","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T09:32:13Z"},{"id":"wordfence:c64869f0-a4dd-4135-8ed8-a6ff82a48e1f","source":"wordfence","cve":"CVE-2025-12747","title":"Tainacan <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c64869f0-a4dd-4135-8ed8-a6ff82a48e1f?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-11-20T00:00:00Z","updated":"2025-11-21T16:28:14Z"},{"id":"wordfence:c648aace-93d9-46c9-bf10-80286c81422c","source":"wordfence","cve":"CVE-2024-37499","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c648aace-93d9-46c9-bf10-80286c81422c?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:18:24Z"},{"id":"wordfence:c648fbb1-cc12-4334-b334-0f784542ab6d","source":"wordfence","cve":"CVE-2022-1647","title":"FormCraft Basic <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c648fbb1-cc12-4334-b334-0f784542ab6d?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c64956c3-b6f5-419e-82f3-3c9e90e1d677","source":"wordfence","cve":"CVE-2024-31249","title":"Subscribe To Comments Reloaded <= 220725 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c64956c3-b6f5-419e-82f3-3c9e90e1d677?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments-reloaded","name":"Subscribe To Comments Reloaded","from":"*","from_inclusive":true,"to":"220725","to_inclusive":true,"patched_in":"240119"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:29:54Z"},{"id":"wordfence:c64a4e84-fc39-47fa-904c-87a252fbf134","source":"wordfence","cve":"CVE-2024-51873","title":"Multi-day Booking Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c64a4e84-fc39-47fa-904c-87a252fbf134?source=api-prod","affected":[{"type":"plugin","slug":"multi-day-booking-calendar","name":"Multi-day Booking Calendar","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:44:47Z"},{"id":"wordfence:c64e1b35-46f4-4d90-a4c9-79bf512471de","source":"wordfence","cve":"CVE-2025-23610","title":"Ultimate Events <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c64e1b35-46f4-4d90-a4c9-79bf512471de?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-events","name":"Ultimate Events","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:04:37Z"},{"id":"wordfence:c6571ebd-1b28-4670-ad87-3919577f01ad","source":"wordfence","cve":"CVE-2026-39623","title":"Biolife <= 3.2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6571ebd-1b28-4670-ad87-3919577f01ad?source=api-prod","affected":[{"type":"theme","slug":"biolife","name":"Biolife - Organic Food WordPress Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T15:20:05Z"},{"id":"wordfence:c65a4ac6-0438-40d0-b0b4-32366fac477c","source":"wordfence","cve":"CVE-2026-57363","title":"WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c65a4ac6-0438-40d0-b0b4-32366fac477c?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.3.8"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:53:10Z"},{"id":"wordfence:c65a5a9a-3c2a-40a8-903b-4258f065b443","source":"wordfence","cve":"CVE-2025-26897","title":"List Related Attachments <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c65a5a9a-3c2a-40a8-903b-4258f065b443?source=api-prod","affected":[{"type":"plugin","slug":"list-related-attachments-widget","name":"List Related Attachments","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:11:54Z"},{"id":"wordfence:c65b48a4-5278-4648-9785-091d1acfaab3","source":"wordfence","cve":"CVE-2026-22520","title":"Handmade Framework <= 3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c65b48a4-5278-4648-9785-091d1acfaab3?source=api-prod","affected":[{"type":"plugin","slug":"handmade-framework","name":"Handmade Framework","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-09T00:00:00Z","updated":"2026-03-12T16:12:06Z"},{"id":"wordfence:c65b6793-42e3-40cb-a6fe-b000c879d41f","source":"wordfence","cve":"CVE-2024-13657","title":"Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c65b6793-42e3-40cb-a6fe-b000c879d41f?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-widget","name":"Store Locator Widget","from":"*","from_inclusive":true,"to":"2025r1","to_inclusive":true,"patched_in":"2025r2"}],"published":"2025-02-18T19:26:05Z","updated":"2025-02-27T20:17:32Z"},{"id":"wordfence:c6600f0f-2fa3-49b8-bab3-a74f69da5024","source":"wordfence","cve":"CVE-2025-39355","title":"FAT Services Booking <= 5.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6600f0f-2fa3-49b8-bab3-a74f69da5024?source=api-prod","affected":[{"type":"plugin","slug":"fat-services-booking","name":"FAT Services Booking","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:17:19Z"},{"id":"wordfence:c660f356-46af-4d34-af82-ab2a0b74dded","source":"wordfence","cve":"CVE-2024-13618","title":"Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c660f356-46af-4d34-af82-ab2a0b74dded?source=api-prod","affected":[{"type":"plugin","slug":"aoa-downloadable","name":"Downloable by American Osteopathic Association","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-13T14:35:43Z"},{"id":"wordfence:c6615abc-ffbb-4b37-ad7a-fc8c5c09bd23","source":"wordfence","cve":"CVE-2026-88792","title":"Dictionary <= 1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6615abc-ffbb-4b37-ad7a-fc8c5c09bd23?source=api-prod","affected":[{"type":"plugin","slug":"dictionary","name":"Dictionary","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:46:33Z"},{"id":"wordfence:c6629349-996d-4873-ba01-c1374a1d0f8a","source":"wordfence","cve":"CVE-2026-81021","title":"SupportCandy \u2013 AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6629349-996d-4873-ba01-c1374a1d0f8a?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"3.2.9","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T14:53:12Z"},{"id":"wordfence:c66309e7-2fbd-4273-bb3b-807965529420","source":"wordfence","cve":"CVE-2026-104641","title":"Simple Shopping Cart <= 5.3.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66309e7-2fbd-4273-bb3b-807965529420?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:03:01Z"},{"id":"wordfence:c664b2b3-7ecf-4bd7-8623-3e882acfd945","source":"wordfence","cve":"CVE-2026-16777","title":"Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c664b2b3-7ecf-4bd7-8623-3e882acfd945?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-09-17T18:49:29Z","updated":"2026-09-18T07:40:04Z"},{"id":"wordfence:c664b4e5-8f9f-4cbd-86a6-74901fa47223","source":"wordfence","cve":"CVE-2025-69102","title":"Test Email <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c664b4e5-8f9f-4cbd-86a6-74901fa47223?source=api-prod","affected":[{"type":"plugin","slug":"wp-test-email","name":"WP Test Email","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T15:55:44Z"},{"id":"wordfence:c6670e56-ae81-4b1b-8274-bf355a411e92","source":"wordfence","cve":"CVE-2007-1244","title":"WordPress Core <= 2.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6670e56-ae81-4b1b-8274-bf355a411e92?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2007-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c667be65-e6d3-40e1-aeec-384d309fde3d","source":"wordfence","cve":"CVE-2025-1322","title":"WP-Recall \u2013 Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c667be65-e6d3-40e1-aeec-384d309fde3d?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.10","to_inclusive":true,"patched_in":"16.26.12"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T09:22:55Z"},{"id":"wordfence:c6683edc-8c77-446c-bd7e-e97b8c5d0c57","source":"wordfence","cve":"CVE-2022-2224","title":"Gallery for Social Photo <= 1.0.0.27 - Cross-Site Request Forgery to Post Duplication","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6683edc-8c77-446c-bd7e-e97b8c5d0c57?source=api-prod","affected":[{"type":"plugin","slug":"feed-instagram-lite","name":"Gallery for Social Photo","from":"*","from_inclusive":true,"to":"1.0.0.27","to_inclusive":true,"patched_in":"1.0.0.29"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c66a75a3-d420-4f2e-9f61-fe7dc2cb759e","source":"wordfence","cve":"CVE-2026-19942","title":"Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66a75a3-d420-4f2e-9f61-fe7dc2cb759e?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-08-18T16:21:44Z","updated":"2026-08-19T04:27:08Z"},{"id":"wordfence:c66bc0b1-c157-4c05-ae9d-0927863c6b95","source":"wordfence","cve":"CVE-2023-5906","title":"Job Manager & Career <= 1.4.3 - Sensitive Information Exposure","severity":"low","cvss":3.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66bc0b1-c157-4c05-ae9d-0927863c6b95?source=api-prod","affected":[{"type":"plugin","slug":"job-manager-career","name":"Job Manager & Career \u2013 Manage job board listings, and recruitments","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c66d0fb4-e2df-4bdb-8ccb-18a96173a55d","source":"wordfence","cve":"CVE-2025-7846","title":"WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function","severity":"high","cvss":8.8,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66d0fb4-e2df-4bdb-8ccb-18a96173a55d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"16.7","to_inclusive":true,"patched_in":"16.8"}],"published":"2025-10-30T18:34:20Z","updated":"2025-10-31T06:42:57Z"},{"id":"wordfence:c66d88a1-0936-40c4-adcf-ad79b9c57a80","source":"wordfence","cve":"CVE-2017-14507","title":"Content Timeline <= 4.4.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66d88a1-0936-40c4-adcf-ad79b9c57a80?source=api-prod","affected":[{"type":"plugin","slug":"content_timeline","name":"content_timeline","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c66f1633-5563-4deb-b315-79b4b9e17a95","source":"wordfence","cve":"CVE-2026-39597","title":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets <= 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c66f1633-5563-4deb-b315-79b4b9e17a95?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:58:13Z"},{"id":"wordfence:c6716a5d-48ed-4735-b765-a7606ea401d0","source":"wordfence","cve":"CVE-2026-13378","title":"Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6716a5d-48ed-4735-b765-a7606ea401d0?source=api-prod","affected":[{"type":"plugin","slug":"form-vibes","name":"Form Vibes \u2013 Save Contact Form 7 & Elementor Form Entries to Database","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-07-10T16:30:45Z","updated":"2026-07-11T04:32:58Z"},{"id":"wordfence:c674bb2a-8ecf-4aea-a729-c9bdf4ee35fd","source":"wordfence","cve":"CVE-2016-5837","title":"WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c674bb2a-8ecf-4aea-a729-c9bdf4ee35fd?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c674ec32-7959-414a-8c31-3455bebb47bb","source":"wordfence","cve":"CVE-2023-40603","title":"Simple Org Chart <= 2.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c674ec32-7959-414a-8c31-3455bebb47bb?source=api-prod","affected":[{"type":"plugin","slug":"simple-org-chart","name":"Simple Org Chart","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-08-17T00:00:00Z","updated":"2025-05-07T14:05:35Z"},{"id":"wordfence:c675f883-7e6f-43c3-a901-82ed2d2b3772","source":"wordfence","cve":"CVE-2022-0345","title":"Better Notifications for WP <= 1.8.6 - Email Address Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c675f883-7e6f-43c3-a901-82ed2d2b3772?source=api-prod","affected":[{"type":"plugin","slug":"bnfw","name":"Customize WordPress Emails and Alerts \u2013 Better Notifications for WP","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":false,"patched_in":"1.8.7"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c67b310c-4a27-427d-9f99-fab56f3f6580","source":"wordfence","cve":"CVE-2024-49239","title":"Add Categories Post Footer <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c67b310c-4a27-427d-9f99-fab56f3f6580?source=api-prod","affected":[{"type":"plugin","slug":"add-categories-post-footer","name":"Add Categories Post Footer","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:51:14Z"},{"id":"wordfence:c67c520d-4843-4ef1-8c96-cbf0eaab58cb","source":"wordfence","cve":"CVE-2025-13092","title":"Devs CRM \u2013 Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c67c520d-4843-4ef1-8c96-cbf0eaab58cb?source=api-prod","affected":[{"type":"plugin","slug":"devs-crm","name":"Devs CRM","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-12-12T16:08:20Z","updated":"2026-09-21T19:30:29Z"},{"id":"wordfence:c67c958e-1ab2-498c-b665-73e239d0029b","source":"wordfence","cve":"CVE-2024-11827","title":"Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c67c958e-1ab2-498c-b665-73e239d0029b?source=api-prod","affected":[{"type":"plugin","slug":"ootb-openstreetmap","name":"Out of the Block: OpenStreetMap","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2024-12-12T22:57:05Z","updated":"2024-12-16T10:26:14Z"},{"id":"wordfence:c67ee9bc-3626-4323-8b16-0fcae0db1991","source":"wordfence","cve":"CVE-2024-31239","title":"Nudgify Social Proof, Sales Popup & FOMO <= 1.3.3 - Cross-Site Request Forgery via sync_orders_manually()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c67ee9bc-3626-4323-8b16-0fcae0db1991?source=api-prod","affected":[{"type":"plugin","slug":"nudgify","name":"Nudgify Social Proof","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:43:21Z"},{"id":"wordfence:c67f01c0-8b49-48e3-88da-49b39d6b0a4a","source":"wordfence","cve":"CVE-2025-39549","title":"Most And Least Read Posts Widget <= 2.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c67f01c0-8b49-48e3-88da-49b39d6b0a4a?source=api-prod","affected":[{"type":"plugin","slug":"most-and-least-read-posts-widget","name":"Most And Least Read Posts Widget","from":"*","from_inclusive":true,"to":"2.5.20","to_inclusive":true,"patched_in":"2.5.21"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:34:35Z"},{"id":"wordfence:c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4","source":"wordfence","cve":"CVE-2026-116548","title":"VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6813d20-ed4e-4cd0-9fe2-dd1f21683ef4?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2026-10-30T18:04:46Z","updated":"2026-10-31T06:44:22Z"},{"id":"wordfence:c681956c-7d96-4e32-af81-a573a0840bb6","source":"wordfence","cve":"CVE-2024-13384","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.23 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c681956c-7d96-4e32-af81-a573a0840bb6?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.23","to_inclusive":true,"patched_in":"3.2.24"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:36:31Z"},{"id":"wordfence:c681d1ac-a5d0-43f2-a1e4-0684cd56a3b8","source":"wordfence","cve":"CVE-2023-51356","title":"ARMember <= 4.0.10 - Authenticated(Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c681d1ac-a5d0-43f2-a1e4-0684cd56a3b8?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6840350-7ff4-4ec2-bf2b-94ce6f782537","source":"wordfence","cve":"CVE-2024-4789","title":"Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6840350-7ff4-4ec2-bf2b-94ce6f782537?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"3.1.72","to_inclusive":true,"patched_in":"3.1.73"}],"published":"2024-05-16T19:35:17Z","updated":"2024-05-17T08:31:41Z"},{"id":"wordfence:c6848b7a-d869-41e7-9f33-01a35b6d4822","source":"wordfence","cve":"CVE-2026-8042","title":"Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6848b7a-d869-41e7-9f33-01a35b6d4822?source=api-prod","affected":[{"type":"plugin","slug":"github-shortcode","name":"Github Shortcode","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T18:56:11Z","updated":"2026-05-27T07:45:56Z"},{"id":"wordfence:c68a9b05-5e60-4d5f-9d00-a9a5b85271f2","source":"wordfence","cve":"CVE-2022-3936","title":"Team Members <= 5.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c68a9b05-5e60-4d5f-9d00-a9a5b85271f2?source=api-prod","affected":[{"type":"plugin","slug":"team-members","name":"Team Members","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c68a9f80-30c3-4615-a0cc-dd2beb546b15","source":"wordfence","cve":"CVE-2026-118783","title":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos < 5.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c68a9f80-30c3-4615-a0cc-dd2beb546b15?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:34:19Z"},{"id":"wordfence:c68b4883-97c8-4c6f-8d04-f2318bd8183d","source":"wordfence","cve":"CVE-2025-30945","title":"Taskbuilder <= 4.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c68b4883-97c8-4c6f-8d04-f2318bd8183d?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2025-06-05T00:00:00Z","updated":"2025-09-09T17:35:53Z"},{"id":"wordfence:c68ec00c-20a5-461d-bf72-c3190d29c9cf","source":"wordfence","cve":"CVE-2024-4997","title":"WPUpper Share Buttons <= 3.43 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c68ec00c-20a5-461d-bf72-c3190d29c9cf?source=api-prod","affected":[{"type":"plugin","slug":"wpupper-share-buttons","name":"WPUpper Share Buttons","from":"*","from_inclusive":true,"to":"3.43","to_inclusive":true,"patched_in":"3.50"}],"published":"2024-06-03T16:40:47Z","updated":"2024-07-08T20:41:55Z"},{"id":"wordfence:c6914c8c-50ae-482f-81cd-cbd28466f3a1","source":"wordfence","cve":"CVE-2024-35678","title":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress <= 1.7.2 - Authenticated (Author+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6914c8c-50ae-482f-81cd-cbd28466f3a1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-db","name":"Contact Form to DB by BestWebSoft \u2013 Messages Database Plugin For WordPress","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-13T14:42:13Z"},{"id":"wordfence:c691d129-35db-4de8-a28e-5e77347e2280","source":"wordfence","cve":"CVE-2023-4666","title":"Form Maker by 10Web <= 1.15.19 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c691d129-35db-4de8-a28e-5e77347e2280?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.20","to_inclusive":false,"patched_in":"1.15.20"}],"published":"2023-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c691e469-3bd2-415d-8feb-9ae94aeaf339","source":"wordfence","cve":"CVE-2024-11897","title":"Contact Form, Survey & Form Builder \u2013 MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c691e469-3bd2-415d-8feb-9ae94aeaf339?source=api-prod","affected":[{"type":"plugin","slug":"mightyforms","name":"Contact Form, Survey & Form Builder \u2013 MightyForms","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2024-12-03T14:13:52Z","updated":"2024-12-21T15:45:31Z"},{"id":"wordfence:c6927b4f-f47e-47fc-a5bf-b7fa42c31412","source":"wordfence","cve":"CVE-2025-13974","title":"Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6927b4f-f47e-47fc-a5bf-b7fa42c31412?source=api-prod","affected":[{"type":"plugin","slug":"email-customizer-for-woocommerce","name":"Email Customizer for WooCommerce | Drag and Drop Email Templates Builder","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2026-01-06T20:40:18Z","updated":"2026-02-12T16:50:38Z"},{"id":"wordfence:c693831f-fe60-4548-83aa-4ebd03d134ec","source":"wordfence","cve":"CVE-2025-0433","title":"Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c693831f-fe60-4548-83aa-4ebd03d134ec?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.7.1","to_inclusive":true,"patched_in":"2.0.7.2"}],"published":"2025-03-03T19:57:54Z","updated":"2025-03-04T08:23:43Z"},{"id":"wordfence:c6944a15-45dc-48ac-b232-e082515d0e54","source":"wordfence","cve":"CVE-2026-110895","title":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System <= 1.4.54 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6944a15-45dc-48ac-b232-e082515d0e54?source=api-prod","affected":[{"type":"plugin","slug":"support-genix-lite","name":"Support Genix \u2013 Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System","from":"*","from_inclusive":true,"to":"1.4.54","to_inclusive":true,"patched_in":"1.4.55"}],"published":"2026-10-16T10:42:23Z","updated":"2026-10-23T18:39:04Z"},{"id":"wordfence:c694f5e5-43eb-453c-98d7-0d575d53df1a","source":"wordfence","cve":"CVE-2018-9035","title":"Contact Form 7 to Database Extension 2.10.32 - CSV Injection","severity":"high","cvss":8.6,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c694f5e5-43eb-453c-98d7-0d575d53df1a?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-to-database-extension","name":"Contact Form DB","from":"2.10.32","from_inclusive":true,"to":"2.10.32","to_inclusive":true,"patched_in":"2.10.36"}],"published":"2018-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6958b5c-2f67-4f9b-acb2-85dc82c039b5","source":"wordfence","cve":"CVE-2026-19944","title":"WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6958b5c-2f67-4f9b-acb2-85dc82c039b5?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-09-08T15:02:27Z","updated":"2026-09-09T03:28:50Z"},{"id":"wordfence:c69805c9-7e29-470c-b501-39b64d60367c","source":"wordfence","cve":"CVE-2025-69336","title":"Ultimate Store Kit Elementor Addons <= 2.9.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c69805c9-7e29-470c-b501-39b64d60367c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T14:57:38Z"},{"id":"wordfence:c698ba21-f578-469c-8148-7b949027ce7f","source":"wordfence","cve":"CVE-2025-27320","title":"Profile Widget Ninja <= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c698ba21-f578-469c-8148-7b949027ce7f?source=api-prod","affected":[{"type":"plugin","slug":"profile-widget-ninja","name":"Profile Widget Ninja","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T21:48:26Z"},{"id":"wordfence:c6996e6b-e421-438a-ad21-f7ddbd29742f","source":"wordfence","cve":"CVE-2025-49954","title":"WP-Click-Tracker <= 0.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6996e6b-e421-438a-ad21-f7ddbd29742f?source=api-prod","affected":[{"type":"plugin","slug":"wp-click-track","name":"WP-Click-Tracker","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-14T00:00:00Z","updated":"2025-10-29T20:02:29Z"},{"id":"wordfence:c6998185-0f9b-48ab-9dca-05adf5ae603a","source":"wordfence","cve":"CVE-2025-12963","title":"LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.7.43 - Missing Authorization to Uanuthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=api-prod","affected":[{"type":"plugin","slug":"lazytasks-project-task-management","name":"LazyTasks \u2013 Project & Task Management with Collaboration, Kanban and Gantt Chart","from":"*","from_inclusive":true,"to":"1.7.43","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:07:57Z","updated":"2026-09-21T19:10:51Z"},{"id":"wordfence:c699c99d-cf6b-4c14-aaaf-c5270b8763c1","source":"wordfence","cve":"CVE-2025-30774","title":"Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c699c99d-cf6b-4c14-aaaf-c5270b8763c1?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.6.8.7","to_inclusive":true,"patched_in":"6.6.8.8"}],"published":"2025-03-29T00:00:00Z","updated":"2025-04-10T13:08:44Z"},{"id":"wordfence:c69c9119-9360-401c-956b-0e782122784f","source":"wordfence","cve":"CVE-2025-30638","title":"Powie's Uptime Robot <= 0.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c69c9119-9360-401c-956b-0e782122784f?source=api-prod","affected":[{"type":"plugin","slug":"powies-uptime-robot","name":"Powie&#039;s Uptime Robot Plugin","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:10:52Z"},{"id":"wordfence:c6a02da1-b005-4fa9-9657-1c5f019f3858","source":"wordfence","cve":"CVE-2023-5652","title":"WP Hotel Booking <= 2.0.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a02da1-b005-4fa9-9657-1c5f019f3858?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6a0811e-f02b-49d1-915e-cf7ac4b5e1f5","source":"wordfence","cve":"","title":"Power Zoomer <= 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a0811e-f02b-49d1-915e-cf7ac4b5e1f5?source=api-prod","affected":[{"type":"plugin","slug":"power-zoomer","name":"Power Zoomer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2013-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6a3ae10-843f-484a-ad6c-221ffece7cc2","source":"wordfence","cve":"CVE-2024-32720","title":"Appointment Hour Booking <= 1.4.56 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a3ae10-843f-484a-ad6c-221ffece7cc2?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.56","to_inclusive":true,"patched_in":"1.4.57"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T17:20:17Z"},{"id":"wordfence:c6a49422-ac78-4fad-a69a-55c0569ec8b5","source":"wordfence","cve":"CVE-2026-57795","title":"Kitchor <= 1.4.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a49422-ac78-4fad-a69a-55c0569ec8b5?source=api-prod","affected":[{"type":"theme","slug":"kitchor","name":"Kitchor - Interior Design WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:54:47Z"},{"id":"wordfence:c6a4fffa-8cfe-4bfc-ad79-55132ff6d7d6","source":"wordfence","cve":"CVE-2026-94117","title":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign <= 2.0.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a4fffa-8cfe-4bfc-ad79-55132ff6d7d6?source=api-prod","affected":[{"type":"plugin","slug":"hashbar-wp-notification-bar","name":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-09-21T14:27:00Z","updated":"2026-09-29T20:04:20Z"},{"id":"wordfence:c6a6fa09-f7bd-4ed0-8fdc-3f927b33af02","source":"wordfence","cve":"CVE-2015-9447","title":"Unite Gallery Lite < 1.5 - Cross-Site Request Forgery and SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a6fa09-f7bd-4ed0-8fdc-3f927b33af02?source=api-prod","affected":[{"type":"plugin","slug":"unite-gallery-lite","name":"Unite Gallery Lite","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":false,"patched_in":"1.5"}],"published":"2015-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6a8ad3e-d8ab-40f0-955f-7c64897466fb","source":"wordfence","cve":"CVE-2026-117571","title":"Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6a8ad3e-d8ab-40f0-955f-7c64897466fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":true,"patched_in":"8.8"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:38:16Z"},{"id":"wordfence:c6aa5b1d-e718-4c93-ab00-7fc343bbffba","source":"wordfence","cve":"CVE-2024-43124","title":"Graphina <= 1.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6aa5b1d-e718-4c93-ab00-7fc343bbffba?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:09:27Z"},{"id":"wordfence:c6aaabe9-4f55-4c01-b350-573e6a944353","source":"wordfence","cve":"CVE-2024-4566","title":"ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6aaabe9-4f55-4c01-b350-573e6a944353?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2024-05-20T19:43:02Z","updated":"2024-05-21T08:31:05Z"},{"id":"wordfence:c6ab1328-b5a0-4592-8455-0bc1874f2b3e","source":"wordfence","cve":"CVE-2026-39504","title":"InstaWP Connect <= 0.1.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ab1328-b5a0-4592-8455-0bc1874f2b3e?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.2.5","to_inclusive":true,"patched_in":"0.1.2.7"}],"published":"2026-03-11T00:00:00Z","updated":"2026-04-15T21:11:34Z"},{"id":"wordfence:c6ac5484-3caa-4821-990b-cd49c2c4873d","source":"wordfence","cve":"CVE-2025-1457","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ac5484-3caa-4821-990b-cd49c2c4873d?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.28","to_inclusive":true,"patched_in":"5.10.29"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-19T03:21:25Z"},{"id":"wordfence:c6ae2633-caf6-4319-ba81-e71a673c89ee","source":"wordfence","cve":"CVE-2015-2213","title":"WordPress Core < 4.2.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ae2633-caf6-4319-ba81-e71a673c89ee?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"3.7.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6ae2f0d-a0c2-4f4a-bb1b-f6419aa2e155","source":"wordfence","cve":"CVE-2025-49419","title":"Foxit eSign for WordPress <= 2.0.3 - Authenticated (Admin+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ae2f0d-a0c2-4f4a-bb1b-f6419aa2e155?source=api-prod","affected":[{"type":"plugin","slug":"esign-genie-for-wp","name":"Foxit eSign for WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T14:16:49Z"},{"id":"wordfence:c6b079f5-715d-4fb3-bcaf-539412d5e956","source":"wordfence","cve":"CVE-2021-39338","title":"MyBB Cross-Poster <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b079f5-715d-4fb3-bcaf-539412d5e956?source=api-prod","affected":[{"type":"plugin","slug":"mybb-cross-poster","name":"MyBB Cross-Poster","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6b395b1-c6fb-4ab9-b446-cba9e32ca65d","source":"wordfence","cve":"","title":"Accessibility Suite by Online ADA < 2.0.11 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b395b1-c6fb-4ab9-b446-cba9e32ca65d?source=api-prod","affected":[{"type":"plugin","slug":"online-accessibility","name":"Accessibility Suite by Ability, Inc","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":false,"patched_in":"2.0.11"}],"published":"2019-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6b3d91c-591b-444d-888b-1b443e72afca","source":"wordfence","cve":"CVE-2021-24926","title":"Domain Check <= 1.0.16 - Reflected Cross-Site Scripting via domain","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b3d91c-591b-444d-888b-1b443e72afca?source=api-prod","affected":[{"type":"plugin","slug":"domain-check","name":"Domain Check","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6b3e014-fb08-41e9-a667-b70f96602134","source":"wordfence","cve":"CVE-2012-3434","title":"Count Per Day <= 3.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b3e014-fb08-41e9-a667-b70f96602134?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6b43a4f-ef44-46cf-89ce-5747ac5f47cd","source":"wordfence","cve":"CVE-2024-53750","title":"PayPal Responder <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b43a4f-ef44-46cf-89ce-5747ac5f47cd?source=api-prod","affected":[{"type":"plugin","slug":"paypal-responder","name":"PayPal Responder","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:32:36Z"},{"id":"wordfence:c6b7447c-c61f-40c7-a423-877dcf3e6709","source":"wordfence","cve":"CVE-2025-49888","title":"PW WooCommerce On Sale! <= 1.39 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b7447c-c61f-40c7-a423-877dcf3e6709?source=api-prod","affected":[{"type":"plugin","slug":"pw-woocommerce-on-sale","name":"PW WooCommerce On Sale!","from":"*","from_inclusive":true,"to":"1.39","to_inclusive":true,"patched_in":"1.40"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:38:25Z"},{"id":"wordfence:c6b75ae7-89d9-4dd4-85c1-c12369bd86c8","source":"wordfence","cve":"CVE-2024-13464","title":"Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b75ae7-89d9-4dd4-85c1-c12369bd86c8?source=api-prod","affected":[{"type":"plugin","slug":"library-bookshelves","name":"Library Bookshelves","from":"*","from_inclusive":true,"to":"5.10","to_inclusive":true,"patched_in":"5.11"}],"published":"2025-02-17T15:44:03Z","updated":"2025-03-06T20:34:24Z"},{"id":"wordfence:c6b8d5ca-34e2-4d25-9185-7fcee790379d","source":"wordfence","cve":"CVE-2026-104006","title":"SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check","severity":"low","cvss":3.7,"cwe":"CWE-524","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b8d5ca-34e2-4d25-9185-7fcee790379d?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-10-09T17:42:19Z","updated":"2026-10-10T06:40:16Z"},{"id":"wordfence:c6b95cc2-c40b-40db-abd2-d66978cf55d1","source":"wordfence","cve":"","title":"Salem Theme <= 1.5.5 - DOM-based Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b95cc2-c40b-40db-abd2-d66978cf55d1?source=api-prod","affected":[{"type":"theme","slug":"salem","name":"salem","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2015-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6ba1f91-9cfa-473f-a0b9-3f9830078b2a","source":"wordfence","cve":"CVE-2026-62077","title":"Avala <= 1.1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba1f91-9cfa-473f-a0b9-3f9830078b2a?source=api-prod","affected":[{"type":"theme","slug":"avala","name":"Avala - Wedding & Event WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:06:42Z"},{"id":"wordfence:c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5","source":"wordfence","cve":"CVE-2025-12348","title":"Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ba7244-0ecf-412f-9b8b-6b81fa6cdeb5?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":"5.9.11"}],"published":"2025-12-11T21:13:45Z","updated":"2025-12-12T09:20:32Z"},{"id":"wordfence:c6bc8753-9b63-41ee-8269-89883969983b","source":"wordfence","cve":"CVE-2025-23448","title":"visualslider Sldier <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6bc8753-9b63-41ee-8269-89883969983b?source=api-prod","affected":[{"type":"plugin","slug":"visual-slider","name":"Visual Slider","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-01-16T00:00:00Z","updated":"2025-05-16T14:17:36Z"},{"id":"wordfence:c6c1a446-055b-4ac4-bceb-451c0fbe6369","source":"wordfence","cve":"CVE-2024-3755","title":"MF Gig Calendar <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c1a446-055b-4ac4-bceb-451c0fbe6369?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-07T12:53:16Z"},{"id":"wordfence:c6c236c0-95a4-479a-a154-d267ce2c0aba","source":"wordfence","cve":"CVE-2025-14361","title":"Woocommerce Envato Affiliates <= 1.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c236c0-95a4-479a-a154-d267ce2c0aba?source=api-prod","affected":[{"type":"plugin","slug":"wooenvato","name":"Woocommerce Envato Affiliates","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:40:16Z"},{"id":"wordfence:c6c2fcc5-8995-4455-9072-8557465ecd88","source":"wordfence","cve":"CVE-2026-62132","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c2fcc5-8995-4455-9072-8557465ecd88?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:29:38Z"},{"id":"wordfence:c6c370f5-087b-4e75-a726-b79bf792441b","source":"wordfence","cve":"CVE-2022-3207","title":"Simple File List  <= 4.4.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c370f5-087b-4e75-a726-b79bf792441b?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6c48173-ffe3-40f8-a2fa-cee66869e343","source":"wordfence","cve":"CVE-2025-6833","title":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c48173-ffe3-40f8-a2fa-cee66869e343?source=api-prod","affected":[{"type":"plugin","slug":"aio-time-clock-lite","name":"All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-10-21T21:09:38Z","updated":"2025-10-22T09:24:38Z"},{"id":"wordfence:c6c52046-c85d-46af-b36c-41c70dad5426","source":"wordfence","cve":"CVE-2025-15483","title":"Link Hopper <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c52046-c85d-46af-b36c-41c70dad5426?source=api-prod","affected":[{"type":"plugin","slug":"link-hopper","name":"Link Hopper","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"3.0"}],"published":"2026-02-13T18:33:52Z","updated":"2026-10-07T11:22:03Z"},{"id":"wordfence:c6c52f1a-2203-4abe-b777-064bd6fd1714","source":"wordfence","cve":"CVE-2025-5060","title":"Bravis User <= 1.0.1 - Authentication Bypass to Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c52f1a-2203-4abe-b777-064bd6fd1714?source=api-prod","affected":[{"type":"plugin","slug":"bravis-user","name":"Bravis User","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2025-08-22T18:31:57Z","updated":"2026-02-26T19:29:47Z"},{"id":"wordfence:c6c5bea1-c34d-428d-a77e-16cdd45fbc40","source":"wordfence","cve":"CVE-2026-39469","title":"PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c5bea1-c34d-428d-a77e-16cdd45fbc40?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-03-12T00:00:00Z","updated":"2026-05-05T15:09:41Z"},{"id":"wordfence:c6c846c8-df8a-4a95-834e-a9443b6a86b5","source":"wordfence","cve":"CVE-2025-2107","title":"Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c846c8-df8a-4a95-834e-a9443b6a86b5?source=api-prod","affected":[{"type":"plugin","slug":"arielbrailovsky-viralad","name":"ArielBrailovsky-ViralAd","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T01:45:28Z"},{"id":"wordfence:c6c93ec9-668d-4b8d-abc4-edd04cbf9839","source":"wordfence","cve":"CVE-2023-24411","title":"BNE Testimonials <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c93ec9-668d-4b8d-abc4-edd04cbf9839?source=api-prod","affected":[{"type":"plugin","slug":"bne-testimonials","name":"BNE Testimonials","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6ca63b8-b437-4e34-a57e-c3d956fbd102","source":"wordfence","cve":"CVE-2025-10705","title":"MxChat \u2013 AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ca63b8-b437-4e34-a57e-c3d956fbd102?source=api-prod","affected":[{"type":"plugin","slug":"mxchat-basic","name":"MxChat \u2013 AI Chatbot & Content Generation for WordPress","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-10-22T00:00:00Z","updated":"2025-10-23T12:32:34Z"},{"id":"wordfence:c6cd7986-6d3b-426b-a539-8dc11f0d7b04","source":"wordfence","cve":"CVE-2019-17071","title":"Client Dash <= 2.2.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6cd7986-6d3b-426b-a539-8dc11f0d7b04?source=api-prod","affected":[{"type":"plugin","slug":"client-dash","name":"Client Dash","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2019-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6d1f25f-9024-41e4-9665-aad0a520bbab","source":"wordfence","cve":"CVE-2025-31547","title":"Uptime Robot Plugin for WordPress <= 2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d1f25f-9024-41e4-9665-aad0a520bbab?source=api-prod","affected":[{"type":"plugin","slug":"uptime-robot-monitor","name":"Uptime Robot Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:32:51Z"},{"id":"wordfence:c6d2c4b4-8795-4252-bb43-4cfa4bc6fa06","source":"wordfence","cve":"CVE-2025-54010","title":"FluentSnippets <= 10.50 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d2c4b4-8795-4252-bb43-4cfa4bc6fa06?source=api-prod","affected":[{"type":"plugin","slug":"easy-code-manager","name":"FluentSnippets \u2013 High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager","from":"*","from_inclusive":true,"to":"10.50","to_inclusive":true,"patched_in":"10.51"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:27:51Z"},{"id":"wordfence:c6d45e18-7aa0-4f73-bf07-069870b467f4","source":"wordfence","cve":"CVE-2022-2050","title":"WP-Paginate <= 2.1.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d45e18-7aa0-4f73-bf07-069870b467f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-paginate","name":"WP-Paginate","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":false,"patched_in":"2.1.9"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6d5275d-43d0-41f6-96c7-e7646eac4534","source":"wordfence","cve":"CVE-2024-4036","title":"Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d5275d-43d0-41f6-96c7-e7646eac4534?source=api-prod","affected":[{"type":"plugin","slug":"sydney-toolbox","name":"Sydney Toolbox","from":"*","from_inclusive":true,"to":"1.30","to_inclusive":true,"patched_in":"1.31"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:52:36Z"},{"id":"wordfence:c6d8533c-43d9-4bd6-a72e-dda8660e474e","source":"wordfence","cve":"CVE-2025-39560","title":"Live Forms <= 4.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6d8533c-43d9-4bd6-a72e-dda8660e474e?source=api-prod","affected":[{"type":"plugin","slug":"liveforms","name":"Contact Form, Drag and Drop Form Builder Plugin \u2013 Live Forms","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:18:06Z"},{"id":"wordfence:c6db680e-1fd4-420c-98f4-2b6dc5cf6781","source":"wordfence","cve":"CVE-2024-9189","title":"EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6db680e-1fd4-420c-98f4-2b6dc5cf6781?source=api-prod","affected":[{"type":"plugin","slug":"eu-vat-for-woocommerce","name":"EU/UK VAT Validation Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.12.12","to_inclusive":true,"patched_in":"2.12.14"}],"published":"2024-09-27T00:00:00Z","updated":"2024-09-28T02:04:30Z"},{"id":"wordfence:c6de092f-66cc-4577-8627-fbe59deca4b6","source":"wordfence","cve":"CVE-2026-77785","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6de092f-66cc-4577-8627-fbe59deca4b6?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.277","to_inclusive":false,"patched_in":"1.0.277"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:39:17Z"},{"id":"wordfence:c6de194f-cefb-4680-9d2a-baf84234a526","source":"wordfence","cve":"CVE-2026-62007","title":"Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6de194f-cefb-4680-9d2a-baf84234a526?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:42Z"},{"id":"wordfence:c6e2710f-f51a-487d-a4bb-a19f614ff254","source":"wordfence","cve":"","title":"Customer Reviews for WooCommerce <= 5.38.1 - Missing Authorization via manual review reminders","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e2710f-f51a-487d-a4bb-a19f614ff254?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.38.2","to_inclusive":false,"patched_in":"5.38.2"}],"published":"2023-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6e2f37a-63c1-4d9b-b316-3ed568a9263f","source":"wordfence","cve":"CVE-2026-85350","title":"UpsellWP <= 2.2.9 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e2f37a-63c1-4d9b-b316-3ed568a9263f?source=api-prod","affected":[{"type":"plugin","slug":"checkout-upsell-and-order-bumps","name":"UpsellWP \u2013 Upsell and Related Products Offers for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:40:51Z"},{"id":"wordfence:c6e52e66-cc97-400c-8e53-9921de29a5f2","source":"wordfence","cve":"CVE-2026-119273","title":"BulletProof Security <= 7.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e52e66-cc97-400c-8e53-9921de29a5f2?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T00:00:00Z","updated":"2026-11-11T16:08:35Z"},{"id":"wordfence:c6e7ada1-c5ff-4a05-92e1-d681fc659956","source":"wordfence","cve":"CVE-2021-24619","title":"Per Page Add to Head <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e7ada1-c5ff-4a05-92e1-d681fc659956?source=api-prod","affected":[{"type":"plugin","slug":"per-page-add-to","name":"Per page add to head","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2021-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6e82b46-0b10-45fe-949e-dd94dd8656c0","source":"wordfence","cve":"CVE-2023-23861","title":"GMAce <= 1.5.2 - Cross-Site Request Forgery via gmace_manager_client","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e82b46-0b10-45fe-949e-dd94dd8656c0?source=api-prod","affected":[{"type":"plugin","slug":"gmace","name":"GMAce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6e8a78b-01ad-47b2-84e6-4f6ff78c02b6","source":"wordfence","cve":"CVE-2026-5714","title":"Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e8a78b-01ad-47b2-84e6-4f6ff78c02b6?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2026-06-08T14:13:36Z","updated":"2026-06-09T02:28:48Z"},{"id":"wordfence:c6e91bbb-8e71-4806-b3af-f9c26c9b1d40","source":"wordfence","cve":"CVE-2026-110364","title":"Flexible Quantity \u2013 Measurement Price Calculator for WooCommerce <= 2.3.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6e91bbb-8e71-4806-b3af-f9c26c9b1d40?source=api-prod","affected":[{"type":"plugin","slug":"flexible-quantity-measurement-price-calculator-for-woocommerce","name":"Flexible Quantity & Price Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.23","to_inclusive":true,"patched_in":"2.3.24"}],"published":"2026-10-15T18:16:00Z","updated":"2026-10-23T18:33:03Z"},{"id":"wordfence:c6ea48b4-b4ef-40e2-ade9-8bf44147e8c7","source":"wordfence","cve":"CVE-2025-24733","title":"Post Grid Master <= 3.4.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ea48b4-b4ef-40e2-ade9-8bf44147e8c7?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.12","to_inclusive":true,"patched_in":"3.4.13"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:02:43Z"},{"id":"wordfence:c6edff9f-9876-4824-b057-8acbda861ffa","source":"wordfence","cve":"CVE-2024-32513","title":"Product Feed PRO for WooCommerce by AdTribes \u2013 WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.3.1 - Sensitive Information Exposure via Log Files","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6edff9f-9876-4824-b057-8acbda861ffa?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"13.3.1","to_inclusive":true,"patched_in":"13.3.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-24T12:35:10Z"},{"id":"wordfence:c6ee9437-a12a-476b-9a4b-8da8d9fbfeb3","source":"wordfence","cve":"CVE-2026-73532","title":"Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ee9437-a12a-476b-9a4b-8da8d9fbfeb3?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables-pro","name":"Ninja Tables Pro","from":"5.2.11","from_inclusive":true,"to":"5.2.11","to_inclusive":true,"patched_in":"5.2.13"},{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"6.2.7","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-17T15:24:14Z"},{"id":"wordfence:c6ef0c41-e498-4de6-a86a-d23f65a7a824","source":"wordfence","cve":"CVE-2018-14502","title":"Chained Quiz <= 1.0.8.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ef0c41-e498-4de6-a86a-d23f65a7a824?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2018-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6efb471-3f6a-4ec0-a2cd-fc1154d48ef5","source":"wordfence","cve":"CVE-2024-31258","title":"Form to Chat App <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6efb471-3f6a-4ec0-a2cd-fc1154d48ef5?source=api-prod","affected":[{"type":"plugin","slug":"form-to-chat","name":"Form to Chat App \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:19:43Z"},{"id":"wordfence:c6efb57a-9638-44d1-a8d1-8eeadcc81ecc","source":"wordfence","cve":"CVE-2022-38137","title":"Analytify \u2013 Google Analytics Dashboard For WordPress <= 4.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6efb57a-9638-44d1-a8d1-8eeadcc81ecc?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6f0b546-efd2-4592-a9c1-4784e13209d8","source":"wordfence","cve":"CVE-2025-31871","title":"WP Clone any post type <= 3.6 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f0b546-efd2-4592-a9c1-4784e13209d8?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-any-post-type","name":"WP Clone any post type","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2025-04-01T00:00:00Z","updated":"2026-06-01T20:20:11Z"},{"id":"wordfence:c6f2933a-b5ce-46a8-99c3-f21c7345f807","source":"wordfence","cve":"CVE-2026-48201","title":"Fast Velocity Minify <= 3.5.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f2933a-b5ce-46a8-99c3-f21c7345f807?source=api-prod","affected":[{"type":"plugin","slug":"fast-velocity-minify","name":"Fast Velocity Minify","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-10-30T07:50:33Z","updated":"2026-11-03T20:00:23Z"},{"id":"wordfence:c6f3b765-396f-422f-864d-a48bee8c69cb","source":"wordfence","cve":"CVE-2024-24850","title":"Quicksand Post Filter jQuery Plugin <= 3.1.1 - Missing Authorization via quicksand_admin_ajax","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f3b765-396f-422f-864d-a48bee8c69cb?source=api-prod","affected":[{"type":"plugin","slug":"quicksand-jquery-post-filter","name":"Quicksand Post Filter jQuery Plugin","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:21:34Z"},{"id":"wordfence:c6f4ee5d-819d-4125-8cff-acf9811e2919","source":"wordfence","cve":"CVE-2024-32139","title":"Podlove Podcast Publisher <= 4.0.12 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f4ee5d-819d-4125-8cff-acf9811e2919?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.0.12","to_inclusive":true,"patched_in":"4.0.14"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:48:27Z"},{"id":"wordfence:c6f61e13-20fb-4cef-bae7-2cd5fa038175","source":"wordfence","cve":"CVE-2026-0735","title":"User Language Switch <= 1.6.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f61e13-20fb-4cef-bae7-2cd5fa038175?source=api-prod","affected":[{"type":"plugin","slug":"user-language-switch","name":"User Language Switch","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:31:14Z","updated":"2026-02-14T06:42:34Z"},{"id":"wordfence:c6f6662f-1013-4de1-9091-1ac330260eed","source":"wordfence","cve":"CVE-2025-11733","title":"Footnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f6662f-1013-4de1-9091-1ac330260eed?source=api-prod","affected":[{"type":"plugin","slug":"footnotes-made-easy","name":"Footnotes Made Easy","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2025-11-03T16:03:22Z","updated":"2025-11-20T15:24:22Z"},{"id":"wordfence:c6f68bfd-36c3-45f5-a50b-6803b5967e52","source":"wordfence","cve":"CVE-2021-47940","title":"Download from files <= 1.48 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f68bfd-36c3-45f5-a50b-6803b5967e52?source=api-prod","affected":[{"type":"plugin","slug":"download-from-files","name":"Download from files","from":"*","from_inclusive":true,"to":"1.48","to_inclusive":true,"patched_in":""}],"published":"2021-09-13T00:00:00Z","updated":"2026-07-29T20:52:11Z"},{"id":"wordfence:c6f7da0b-cc2c-43e5-8ae9-ef7d6d6f0ae9","source":"wordfence","cve":"CVE-2018-1002008","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f7da0b-cc2c-43e5-8ae9-ef7d6d6f0ae9?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c6f8f178-47a4-4bca-b8a2-e8f148c24e1b","source":"wordfence","cve":"CVE-2026-32353","title":"MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f8f178-47a4-4bca-b8a2-e8f148c24e1b?source=api-prod","affected":[{"type":"plugin","slug":"mailerpress","name":"MailerPress \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-05T13:37:26Z"},{"id":"wordfence:c6f96cec-ddcb-45b2-a28c-b4e7b6f5c719","source":"wordfence","cve":"CVE-2026-7640","title":"WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f96cec-ddcb-45b2-a28c-b4e7b6f5c719?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.3.5","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2026-07-13T13:11:57Z","updated":"2026-07-14T01:30:02Z"},{"id":"wordfence:c6fb55fd-04ee-4f1a-b651-17a82e771d62","source":"wordfence","cve":"CVE-2026-57677","title":"Novalnet Payment Gateway for WooCommerce <= 12.10.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6fb55fd-04ee-4f1a-b651-17a82e771d62?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-novalnet-gateway","name":"Novalnet Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"12.10.3","to_inclusive":true,"patched_in":"12.10.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:53:13Z"},{"id":"wordfence:c6fd7da8-d203-4076-8c7d-b8532d9d0bed","source":"wordfence","cve":"CVE-2024-31255","title":"ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c6fd7da8-d203-4076-8c7d-b8532d9d0bed?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-dynamic-pricing-and-discounts","name":"ELEX WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:17:46Z"},{"id":"wordfence:c7035903-d598-4db3-ba77-6e836229c5de","source":"wordfence","cve":"CVE-2023-32298","title":"Simple User Listing <= 1.9.2 - Reflected Cross-Site Scripting via as","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7035903-d598-4db3-ba77-6e836229c5de?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-listing","name":"Simple User Listing","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c70865c8-3c63-4988-a1fd-f8f10c20228f","source":"wordfence","cve":"CVE-2024-30434","title":"WP-CRM System <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c70865c8-3c63-4988-a1fd-f8f10c20228f?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.9.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:13:49Z"},{"id":"wordfence:c708698f-a38a-4213-a022-817b380e64df","source":"wordfence","cve":"CVE-2026-39478","title":"Anti-Malware Security and Brute-Force Firewall <= 4.23.87 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c708698f-a38a-4213-a022-817b380e64df?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.23.87","to_inclusive":true,"patched_in":"4.23.88"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:45:05Z"},{"id":"wordfence:c7088e84-a138-452b-bc4d-8ca9427ca8ae","source":"wordfence","cve":"CVE-2017-18561","title":"Embed Images in Comments < 0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7088e84-a138-452b-bc4d-8ca9427ca8ae?source=api-prod","affected":[{"type":"plugin","slug":"embed-comment-images","name":"Embed Images in Comments","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":false,"patched_in":"0.6"}],"published":"2017-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c70baf59-e3c8-461d-9fb3-8c2a71173140","source":"wordfence","cve":"CVE-2016-20071","title":"404 SEO Redirection <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c70baf59-e3c8-461d-9fb3-8c2a71173140?source=api-prod","affected":[{"type":"plugin","slug":"404-redirection-manager","name":"404 SEO Redirection","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:46:20Z"},{"id":"wordfence:c70bb3d6-6acd-46b2-8e47-30be031f73e4","source":"wordfence","cve":"CVE-2023-26541","title":"asMember <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c70bb3d6-6acd-46b2-8e47-30be031f73e4?source=api-prod","affected":[{"type":"plugin","slug":"asmember","name":"asMember","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c70ed02e-1183-475b-a110-4a2d8dbe610e","source":"wordfence","cve":"","title":"Nitro by WooRockets <= 1.7.9 - Missing Authorization to Arbitrary Plugin Installation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c70ed02e-1183-475b-a110-4a2d8dbe610e?source=api-prod","affected":[{"type":"theme","slug":"wr-nitro","name":"Nitro by WooRockets","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":""}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c710331d-e8a1-4e4a-b7b7-ba20026ae78d","source":"wordfence","cve":"CVE-2026-125436","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c710331d-e8a1-4e4a-b7b7-ba20026ae78d?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.9.9","to_inclusive":true,"patched_in":"7.9.10"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:54Z"},{"id":"wordfence:c7112f34-3055-4033-82ba-d59489cd8c6b","source":"wordfence","cve":"","title":"Wise Chat <= 2.8.3 - CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7112f34-3055-4033-82ba-d59489cd8c6b?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2020-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c712972d-c6b2-46be-8c93-27a7e7c920a0","source":"wordfence","cve":"CVE-2026-92829","title":"Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c712972d-c6b2-46be-8c93-27a7e7c920a0?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2026-09-24T18:10:48Z","updated":"2026-09-25T06:39:55Z"},{"id":"wordfence:c714e2b3-8a96-4078-99a4-4ce620939828","source":"wordfence","cve":"CVE-2026-78657","title":"SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c714e2b3-8a96-4078-99a4-4ce620939828?source=api-prod","affected":[{"type":"plugin","slug":"sigmaforms-pro","name":"SigmaForms Pro \u2013 AI Generated Forms","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2026-09-01T17:00:20Z","updated":"2026-09-02T05:29:52Z"},{"id":"wordfence:c7164c43-9a16-4021-a365-b1908a17140e","source":"wordfence","cve":"CVE-2024-54249","title":"Advanced Options Editor <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7164c43-9a16-4021-a365-b1908a17140e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-options-editor","name":"Advanced Options Editor","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-05T00:00:00Z","updated":"2025-01-17T13:45:24Z"},{"id":"wordfence:c72099cc-e70a-4afe-92c0-8f9f8c1e91b7","source":"wordfence","cve":"CVE-2025-13886","title":"LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c72099cc-e70a-4afe-92c0-8f9f8c1e91b7?source=api-prod","affected":[{"type":"plugin","slug":"lt-unleashed","name":"LT Unleashed","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:19:08Z","updated":"2025-12-12T02:20:56Z"},{"id":"wordfence:c720fffe-c089-450a-ac5f-1138c1c223d9","source":"wordfence","cve":"CVE-2026-9719","title":"LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c720fffe-c089-450a-ac5f-1138c1c223d9?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2026-06-05T11:05:15Z","updated":"2026-06-05T23:28:27Z"},{"id":"wordfence:c72118ac-a7e4-4f32-8c33-cbf95860357f","source":"wordfence","cve":"CVE-2026-120408","title":"All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c72118ac-a7e4-4f32-8c33-cbf95860357f?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:36:48Z"},{"id":"wordfence:c7214f90-a205-4d7e-94c8-ee07515ebbf1","source":"wordfence","cve":"CVE-2025-32486","title":"Material Dashboard <= 1.4.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7214f90-a205-4d7e-94c8-ee07515ebbf1?source=api-prod","affected":[{"type":"plugin","slug":"material-dashboard","name":"Material Dashboard","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T19:04:09Z"},{"id":"wordfence:c722238a-6222-48f8-9b01-bdba56490c83","source":"wordfence","cve":"CVE-2025-10126","title":"MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c722238a-6222-48f8-9b01-bdba56490c83?source=api-prod","affected":[{"type":"plugin","slug":"mybrain-utilities","name":"MyBrain Utilities","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-09-09T17:56:17Z","updated":"2025-09-10T06:38:52Z"},{"id":"wordfence:c7243f40-5cca-475a-bb27-44fab965bb0e","source":"wordfence","cve":"CVE-2024-4478","title":"Happy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7243f40-5cca-475a-bb27-44fab965bb0e?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.7","to_inclusive":true,"patched_in":"3.10.8"}],"published":"2024-05-15T19:30:58Z","updated":"2024-05-16T07:32:43Z"},{"id":"wordfence:c7266ce6-2853-4c5d-9e36-8c5b7418b072","source":"wordfence","cve":"CVE-2025-8593","title":"GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7266ce6-2853-4c5d-9e36-8c5b7418b072?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-gravity-forms","name":"GSheetConnector \u2013 Gravity Forms Google Sheets Connector \u2013 Real-Time Sync","from":"*","from_inclusive":true,"to":"1.3.27","to_inclusive":true,"patched_in":"1.3.28"}],"published":"2025-10-10T20:59:26Z","updated":"2025-10-11T09:28:41Z"},{"id":"wordfence:c726cf73-3cf8-462d-a33d-2bbba9bfc02a","source":"wordfence","cve":"CVE-2025-47481","title":"GS Testimonial Slider <= 3.2.9 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c726cf73-3cf8-462d-a33d-2bbba9bfc02a?source=api-prod","affected":[{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:14:58Z"},{"id":"wordfence:c726d6a4-5178-428e-8915-3f8408900e2f","source":"wordfence","cve":"CVE-2026-28073","title":"Wp EMember <= 10.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c726d6a4-5178-428e-8915-3f8408900e2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-13T12:21:31Z"},{"id":"wordfence:c726d8f0-7f2a-414b-9d73-a053921074d9","source":"wordfence","cve":"CVE-2023-2733","title":"MStore API <= 3.9.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c726d8f0-7f2a-414b-9d73-a053921074d9?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c727ab41-c091-4fff-8abe-f52a904cd9f0","source":"wordfence","cve":"CVE-2025-14062","title":"Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c727ab41-c091-4fff-8abe-f52a904cd9f0?source=api-prod","affected":[{"type":"plugin","slug":"animated-pixel-marquee-creator","name":"Animated Pixel Marquee Creator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:25:34Z","updated":"2025-12-12T03:20:55Z"},{"id":"wordfence:c7296ef0-6cba-4aa3-acf7-621247691e81","source":"wordfence","cve":"CVE-2024-51612","title":"Reftagger Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7296ef0-6cba-4aa3-acf7-621247691e81?source=api-prod","affected":[{"type":"plugin","slug":"reftagger-shortcode","name":"Reftagger Shortcode","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:09:36Z"},{"id":"wordfence:c7296fdb-d5d6-4d4f-ac80-b9d5452191b4","source":"wordfence","cve":"","title":"WP Symposium Pro < 16.01 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7296fdb-d5d6-4d4f-ac80-b9d5452191b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium-pro","name":"WP Symposium Pro","from":"*","from_inclusive":true,"to":"16.01","to_inclusive":false,"patched_in":"16.01"}],"published":"2016-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c729d5d4-9629-46f1-b90f-f7b4771e50e1","source":"wordfence","cve":"CVE-2025-53567","title":"Ghost Kit <= 3.4.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c729d5d4-9629-46f1-b90f-f7b4771e50e1?source=api-prod","affected":[{"type":"plugin","slug":"ghostkit","name":"Block Animations, Motion & Scroll Effects \u2013 Ghost Kit","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:49:53Z"},{"id":"wordfence:c729f826-3073-4e77-a663-1a1d3ab229e7","source":"wordfence","cve":"CVE-2026-54845","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c729f826-3073-4e77-a663-1a1d3ab229e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:50:50Z"},{"id":"wordfence:c72a6459-f5a7-4b3d-ac70-c685fb90f903","source":"wordfence","cve":"CVE-2026-24960","title":"Charety < 2.0.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c72a6459-f5a7-4b3d-ac70-c685fb90f903?source=api-prod","affected":[{"type":"theme","slug":"charety","name":"Charety - Charity & Donation WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:37:04Z"},{"id":"wordfence:c72aa934-3925-49ee-95cb-e81316865d4a","source":"wordfence","cve":"CVE-2025-66055","title":"Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c72aa934-3925-49ee-95cb-e81316865d4a?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.10","to_inclusive":true,"patched_in":"5.9.11"}],"published":"2025-11-08T00:00:00Z","updated":"2025-11-24T21:11:18Z"},{"id":"wordfence:c72daa83-afda-4999-b856-aba4d4118228","source":"wordfence","cve":"CVE-2025-22355","title":"Kikx Simple Post Author Filter <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c72daa83-afda-4999-b856-aba4d4118228?source=api-prod","affected":[{"type":"plugin","slug":"sa-post-author-filter","name":"Kikx Simple Post Author Filter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:21:05Z"},{"id":"wordfence:c7349e5f-fd45-44bf-9f9e-c0d109069232","source":"wordfence","cve":"CVE-2026-40765","title":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7349e5f-fd45-44bf-9f9e-c0d109069232?source=api-prod","affected":[{"type":"plugin","slug":"collectchat","name":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:43:34Z"},{"id":"wordfence:c7370cbc-f681-49d7-9330-762443202529","source":"wordfence","cve":"CVE-2026-18344","title":"Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7370cbc-f681-49d7-9330-762443202529?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.1.53","to_inclusive":false,"patched_in":"1.1.53"}],"published":"2026-07-31T19:57:41Z","updated":"2026-08-01T08:32:29Z"},{"id":"wordfence:c738e051-ad1c-4115-94d3-127dd5dff935","source":"wordfence","cve":"CVE-2023-3933","title":"Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c738e051-ad1c-4115-94d3-127dd5dff935?source=api-prod","affected":[{"type":"theme","slug":"yourjourney","name":"Your Journey","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c73d4b78-72aa-409a-a787-898179773b82","source":"wordfence","cve":"CVE-2023-2188","title":"Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c73d4b78-72aa-409a-a787-898179773b82?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.227","to_inclusive":true,"patched_in":"1.0.229"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c73dbc40-ba54-4836-9bb1-a35f95d5a077","source":"wordfence","cve":"CVE-2023-48288","title":"WordPress Job Board and Recruitment Plugin \u2013 JobWP <= 2.1 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c73dbc40-ba54-4836-9bb1-a35f95d5a077?source=api-prod","affected":[{"type":"plugin","slug":"jobwp","name":"JobWP \u2013 Job Board Plugin for WordPress | Job Listings, Career Page & Applications","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c73e53c0-3b69-4f45-b2c5-2e9b55bb8e77","source":"wordfence","cve":"CVE-2025-58618","title":"Pie Calendar <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c73e53c0-3b69-4f45-b2c5-2e9b55bb8e77?source=api-prod","affected":[{"type":"plugin","slug":"pie-calendar","name":"Pie Calendar \u2013 Events Calendar Made Simple","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:36:06Z"},{"id":"wordfence:c73e6889-78f1-4118-ba76-4cd696d24800","source":"wordfence","cve":"CVE-2021-24426","title":"Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c73e6889-78f1-4118-ba76-4cd696d24800?source=api-prod","affected":[{"type":"plugin","slug":"backup-wd","name":"Backup by 10Web \u2013 Backup and Restore Plugin","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":""}],"published":"2021-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c741350a-e083-499c-992d-727f46ca57f9","source":"wordfence","cve":"CVE-2017-18573","title":"Simple Login Log < 1.1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c741350a-e083-499c-992d-727f46ca57f9?source=api-prod","affected":[{"type":"plugin","slug":"simple-login-log","name":"Simple Login Log","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2017-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c74209e2-52cc-4ea1-967f-65fb9031e9a0","source":"wordfence","cve":"CVE-2024-29908","title":"Co-marquage service-public.fr <= 0.5.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c74209e2-52cc-4ea1-967f-65fb9031e9a0?source=api-prod","affected":[{"type":"plugin","slug":"co-marquage-service-public","name":"Co-marquage service-public.fr","from":"*","from_inclusive":true,"to":"0.5.71","to_inclusive":true,"patched_in":"0.5.72"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T16:30:32Z"},{"id":"wordfence:c7429367-f9f4-4859-9537-0f543e32870a","source":"wordfence","cve":"CVE-2024-9609","title":"LearnPress Export Import \u2013 WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7429367-f9f4-4859-9537-0f543e32870a?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-import-export","name":"LearnPress \u2013 Backup & Migration Tool","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2024-11-14T15:47:34Z","updated":"2024-11-15T04:29:05Z"},{"id":"wordfence:c7430c99-2696-4b13-8f90-9cb86d52357b","source":"wordfence","cve":"CVE-2025-69058","title":"PartyMaker <= 1.1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7430c99-2696-4b13-8f90-9cb86d52357b?source=api-prod","affected":[{"type":"theme","slug":"partymaker","name":"PartyMaker | Event Planner & Wedding Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:34:20Z"},{"id":"wordfence:c743fcc4-650f-416f-9b3e-3f206ca8d3bd","source":"wordfence","cve":"CVE-2026-19088","title":"ShopEngine <= 4.9.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c743fcc4-650f-416f-9b3e-3f206ca8d3bd?source=api-prod","affected":[{"type":"plugin","slug":"shopengine","name":"ShopEngine \u2013 All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-15T22:00:35Z"},{"id":"wordfence:c74553c0-366e-44d7-8c4a-161a05ef02b4","source":"wordfence","cve":"CVE-2023-5454","title":"Templately <= 2.2.5 - Improper Authorization to Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c74553c0-366e-44d7-8c4a-161a05ef02b4?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7457ce7-8471-415d-8e34-4505aa34fd61","source":"wordfence","cve":"CVE-2024-5819","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7457ce7-8471-415d-8e34-4505aa34fd61?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.45","to_inclusive":true,"patched_in":"3.2.46"}],"published":"2024-06-28T00:00:00Z","updated":"2024-06-29T09:46:42Z"},{"id":"wordfence:c745b86b-8ab7-4e04-8888-65e43d568410","source":"wordfence","cve":"CVE-2024-2159","title":"Sassy Social Share <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-179","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c745b86b-8ab7-4e04-8888-65e43d568410?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.60","to_inclusive":true,"patched_in":"3.3.61"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-25T13:34:48Z"},{"id":"wordfence:c7476f2c-c32f-4ff7-ad32-70cf68387342","source":"wordfence","cve":"","title":"Disqus Comment System < 2.76 -  Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7476f2c-c32f-4ff7-ad32-70cf68387342?source=api-prod","affected":[{"type":"plugin","slug":"disqus-comment-system","name":"Disqus Comment System","from":"*","from_inclusive":true,"to":"2.76","to_inclusive":false,"patched_in":"2.76"}],"published":"2014-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c74784de-b9cc-4d50-b6be-dc5bb22d1daa","source":"wordfence","cve":"CVE-2026-59515","title":"AI Copilot \u2013 Content Generator <= 1.5.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c74784de-b9cc-4d50-b6be-dc5bb22d1daa?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:19:45Z"},{"id":"wordfence:c7479f03-3677-4192-9978-a3653d37fcb6","source":"wordfence","cve":"CVE-2026-57776","title":"VW Wedding <= 1.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7479f03-3677-4192-9978-a3653d37fcb6?source=api-prod","affected":[{"type":"theme","slug":"vw-wedding","name":"VW Wedding","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:38:15Z"},{"id":"wordfence:c748c2a3-4df1-4bcb-a6d3-9644da623f1c","source":"wordfence","cve":"CVE-2025-32621","title":"WP Map Route Planner <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c748c2a3-4df1-4bcb-a6d3-9644da623f1c?source=api-prod","affected":[{"type":"plugin","slug":"wp-map-route-planner","name":"WP Map Route Planner","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:04:50Z"},{"id":"wordfence:c74bf337-9b8b-4461-897a-b49b0077580d","source":"wordfence","cve":"CVE-2024-56218","title":"Contact Form 7 Dynamic Text Extension <= 5.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c74bf337-9b8b-4461-897a-b49b0077580d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:19:08Z"},{"id":"wordfence:c74ce3e8-cab9-4cc6-a1ad-1e51f7268474","source":"wordfence","cve":"CVE-2024-12209","title":"WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c74ce3e8-cab9-4cc6-a1ad-1e51f7268474?source=api-prod","affected":[{"type":"plugin","slug":"wp-health","name":"WP Umbrella: Security Backup Restore & Monitoring","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.17.1"}],"published":"2024-12-07T16:24:56Z","updated":"2024-12-08T05:25:17Z"},{"id":"wordfence:c7528928-e677-4a2d-8ee1-78166d0c34df","source":"wordfence","cve":"CVE-2024-47313","title":"Catch Base <= 3.4.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7528928-e677-4a2d-8ee1-78166d0c34df?source=api-prod","affected":[{"type":"theme","slug":"catch-base","name":"Catch Base","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:07:24Z"},{"id":"wordfence:c754d957-26a8-4fef-a487-96d566c2dc36","source":"wordfence","cve":"CVE-2025-7526","title":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c754d957-26a8-4fef-a487-96d566c2dc36?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2025-10-08T16:24:06Z","updated":"2025-10-09T05:23:53Z"},{"id":"wordfence:c75bfba9-b25a-4966-835c-8d22736de809","source":"wordfence","cve":"","title":"UpdraftPlus WordPress Backup Plugin <= 1.9.50 - Nonce Leak to Authorization Bypass","severity":"critical","cvss":9.9,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c75bfba9-b25a-4966-835c-8d22736de809?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.9.51","to_inclusive":false,"patched_in":"1.9.51"}],"published":"2015-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c75e0013-2b4c-4172-8a6b-7e1072d36089","source":"wordfence","cve":"CVE-2025-49238","title":"Everest Backup <= 2.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e0013-2b4c-4172-8a6b-7e1072d36089?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:12:10Z"},{"id":"wordfence:c75e6d27-7f6b-4bec-b653-c2024504f427","source":"wordfence","cve":"CVE-2023-0292","title":"Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c75e6d27-7f6b-4bec-b653-c2024504f427?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.0.8","to_inclusive":true,"patched_in":"8.0.9"}],"published":"2023-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7600fe1-94e4-4e3e-a9a6-ff3589813715","source":"wordfence","cve":"CVE-2017-20194","title":"Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.05.03","to_inclusive":false,"patched_in":"2.05.03"}],"published":"2017-11-12T00:00:00Z","updated":"2024-10-16T07:31:52Z"},{"id":"wordfence:c761f19e-3263-4fa5-90c0-d661f160ed3a","source":"wordfence","cve":"CVE-2024-34817","title":"Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c761f19e-3263-4fa5-90c0-d661f160ed3a?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-contact-form-7-and-pipedrive","name":"Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:09:15Z"},{"id":"wordfence:c7621d0f-3a69-4aea-a652-3143e256902e","source":"wordfence","cve":"CVE-2024-13330","title":"JustRows free <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7621d0f-3a69-4aea-a652-3143e256902e?source=api-prod","affected":[{"type":"plugin","slug":"justrows-free","name":"JustRows free","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:22:11Z"},{"id":"wordfence:c763a8d8-c31a-4c9f-8f0e-814cda91b860","source":"wordfence","cve":"CVE-2021-33852","title":"Post Duplicator <= 2.23 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c763a8d8-c31a-4c9f-8f0e-814cda91b860?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"2.24","to_inclusive":false,"patched_in":"2.24"}],"published":"2021-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7641d52-e930-4143-9180-2903d018da91","source":"wordfence","cve":"CVE-2024-0428","title":"Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7641d52-e930-4143-9180-2903d018da91?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-index-now","name":"CrawlWP SEO \u2013 Complete WordPress SEO Plugin with AI, Indexing & Search Performance","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-01-12T00:00:00Z","updated":"2024-07-29T21:37:24Z"},{"id":"wordfence:c764811f-e9dc-4c3d-b696-5792e70ff0b6","source":"wordfence","cve":"CVE-2025-4631","title":"Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c764811f-e9dc-4c3d-b696-5792e70ff0b6?source=api-prod","affected":[{"type":"plugin","slug":"profitori","name":"The E-Commerce ERP: Purchasing, Inventory, Fulfillment, Manufacturing, BOM, Accounting, Sales Analysis","from":"2.0.6.0","from_inclusive":true,"to":"2.1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T18:08:49Z","updated":"2025-05-31T06:40:58Z"},{"id":"wordfence:c764e742-1135-43aa-a190-3b7ec6767f1c","source":"wordfence","cve":"CVE-2025-30933","title":"LogisticsHub <= 1.1.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c764e742-1135-43aa-a190-3b7ec6767f1c?source=api-prod","affected":[{"type":"theme","slug":"logistics-hub","name":"LogisticsHub - Logistics and Transportation WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-08T17:36:13Z"},{"id":"wordfence:c76615ef-8b58-423f-aa29-d9c8a688f0fe","source":"wordfence","cve":"CVE-2026-78087","title":"VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c76615ef-8b58-423f-aa29-d9c8a688f0fe?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.126.1","to_inclusive":true,"patched_in":"1.126.2"}],"published":"2026-10-14T16:37:10Z","updated":"2026-10-15T05:30:24Z"},{"id":"wordfence:c768010d-0ff7-42b8-aca5-83c0a46a43e2","source":"wordfence","cve":"CVE-2026-32434","title":"VW Fitness <= 4.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c768010d-0ff7-42b8-aca5-83c0a46a43e2?source=api-prod","affected":[{"type":"theme","slug":"vw-fitness","name":"VW Fitness","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:04:16Z"},{"id":"wordfence:c7697346-842c-4d34-83be-42f8607fb14d","source":"wordfence","cve":"CVE-2026-13596","title":"Participants Database < 2.7.8.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7697346-842c-4d34-83be-42f8607fb14d?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.4","to_inclusive":false,"patched_in":"2.7.8.4"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:20:13Z"},{"id":"wordfence:c76da3a4-ec6f-4aa3-8f13-4daa212441f2","source":"wordfence","cve":"CVE-2026-57752","title":"iNET Webkit  1.2.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c76da3a4-ec6f-4aa3-8f13-4daa212441f2?source=api-prod","affected":[{"type":"plugin","slug":"inet-webkit","name":"iNET Webkit","from":"1.2.4","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:41:48Z"},{"id":"wordfence:c76e7110-ff61-4fa9-8a29-b1b562187bb5","source":"wordfence","cve":"CVE-2024-38685","title":"WP Announcement <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c76e7110-ff61-4fa9-8a29-b1b562187bb5?source=api-prod","affected":[{"type":"plugin","slug":"sp-announcement","name":"WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:49:11Z"},{"id":"wordfence:c7723579-33ca-4007-a6fa-31b15f3e70a1","source":"wordfence","cve":"CVE-2022-40215","title":"Tabs <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7723579-33ca-4007-a6fa-31b15f3e70a1?source=api-prod","affected":[{"type":"plugin","slug":"vc-tabs","name":"Tabs \u2013 Responsive Tabs with WooCommerce Product Tab Extension","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c77295f3-0a37-4fa8-a375-b4bd3dc55945","source":"wordfence","cve":"","title":"Contact Form Email < 1.1.48 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77295f3-0a37-4fa8-a375-b4bd3dc55945?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.1.48","to_inclusive":false,"patched_in":"1.1.48"}],"published":"2016-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c773a399-61ef-4bb0-987d-6de0bbe58ec1","source":"wordfence","cve":"CVE-2025-11191","title":"RealPress <= 1.0.9 - Missing Authorization to Unauthenticated Page Creation and Email Sending","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c773a399-61ef-4bb0-987d-6de0bbe58ec1?source=api-prod","affected":[{"type":"plugin","slug":"realpress","name":"RealPress \u2013 Real Estate Plugin","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-10-10T00:00:00Z","updated":"2025-11-04T15:28:53Z"},{"id":"wordfence:c774891a-c18a-4ef9-9ed0-9fcb95d371cb","source":"wordfence","cve":"CVE-2025-28934","title":"Simple Post Series <= 2.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c774891a-c18a-4ef9-9ed0-9fcb95d371cb?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-series","name":"Simple Post Series","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T17:46:56Z"},{"id":"wordfence:c774b520-9d9f-4102-8564-49673d5ae1e6","source":"wordfence","cve":"CVE-2022-2536","title":"Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-11-14T00:00:00Z","updated":"2025-07-21T14:09:45Z"},{"id":"wordfence:c77619cd-8d14-42b9-a536-cf39c50e714a","source":"wordfence","cve":"","title":"Front End Upload < 0.5.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77619cd-8d14-42b9-a536-cf39c50e714a?source=api-prod","affected":[{"type":"plugin","slug":"front-end-upload","name":"front-end-upload","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":"0.5.4"}],"published":"2012-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7780eea-230b-41ad-addd-92791e5ab432","source":"wordfence","cve":"CVE-2025-24627","title":"Blur Text <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7780eea-230b-41ad-addd-92791e5ab432?source=api-prod","affected":[{"type":"plugin","slug":"blur-text","name":"Blur Text","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:29:11Z"},{"id":"wordfence:c77b0d79-5738-4ce2-b219-cb557216890f","source":"wordfence","cve":"CVE-2019-19985","title":"Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated File Download w/ Information Disclosure","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77b0d79-5738-4ce2-b219-cb557216890f?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c77b357e-4bcd-45e2-9a84-7d299fcfdd88","source":"wordfence","cve":"CVE-2026-65509","title":"wpDataTables (Premium) <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77b357e-4bcd-45e2-9a84-7d299fcfdd88?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:47:41Z"},{"id":"wordfence:c77c00c7-a4f6-4ad6-9f1f-4bd941fd6e09","source":"wordfence","cve":"CVE-2026-28022","title":"Foodie <= 1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77c00c7-a4f6-4ad6-9f1f-4bd941fd6e09?source=api-prod","affected":[{"type":"theme","slug":"foodie","name":"Foodie","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:26:17Z"},{"id":"wordfence:c77d0ab6-12d5-4aed-a507-82a718c68301","source":"wordfence","cve":"CVE-2026-88785","title":"Simple Membership <= 4.8.2 - Information Exposure","severity":"low","cvss":3.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77d0ab6-12d5-4aed-a507-82a718c68301?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":"4.8.3"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:45:30Z"},{"id":"wordfence:c77d94ae-528d-4525-b16d-96529bee08c0","source":"wordfence","cve":"CVE-2024-4355","title":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsoure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77d94ae-528d-4525-b16d-96529bee08c0?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"10.23","to_inclusive":true,"patched_in":"10.24"}],"published":"2024-05-29T19:55:23Z","updated":"2024-06-06T12:57:41Z"},{"id":"wordfence:c77db815-e401-4410-b6ec-e6668dd988ab","source":"wordfence","cve":"CVE-2022-40217","title":"WPide <= 2.6 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77db815-e401-4410-b6ec-e6668dd988ab?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c77ef86e-ea5b-46fc-a3d7-d11a20f3f871","source":"wordfence","cve":"CVE-2023-0062","title":"EAN for WooCommerce <= 4.4.2 - Authenticated (Contributor+ )Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77ef86e-ea5b-46fc-a3d7-d11a20f3f871?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c77f6fff-8456-4979-90c3-52078ee12264","source":"wordfence","cve":"CVE-2015-2039","title":"Acobot Live Chat & Contact Form <= 2.0 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77f6fff-8456-4979-90c3-52078ee12264?source=api-prod","affected":[{"type":"plugin","slug":"acobot","name":"acobot","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2015-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c77fce42-92e9-43bc-ab3b-599e036ed648","source":"wordfence","cve":"CVE-2012-3384","title":"WordPress Core < 3.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c77fce42-92e9-43bc-ab3b-599e036ed648?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2012-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c785b7a0-5091-4d89-87d3-cd7d9984553e","source":"wordfence","cve":"CVE-2024-11154","title":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"*","from_inclusive":true,"to":"3.5.15","to_inclusive":true,"patched_in":"3.5.16"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T13:55:13Z"},{"id":"wordfence:c786374e-3b69-4543-a8f2-f4dc3db92bf5","source":"wordfence","cve":"CVE-2026-42724","title":"CleanSkin <= 1.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c786374e-3b69-4543-a8f2-f4dc3db92bf5?source=api-prod","affected":[{"type":"theme","slug":"cleanskin","name":"CleanSkin | Handmade Organic Soap & Natural Cosmetics Shop WordPress Theme + Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:20:54Z"},{"id":"wordfence:c787d28e-c942-415d-8227-ce3e940fd0cc","source":"wordfence","cve":"CVE-2024-2907","title":"AGCA \u2013 Custom Dashboard & Login Page <= 7.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c787d28e-c942-415d-8227-ce3e940fd0cc?source=api-prod","affected":[{"type":"plugin","slug":"ag-custom-admin","name":"AGCA \u2013 Custom Dashboard & Login Page","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2024-04-04T00:00:00Z","updated":"2024-05-01T15:05:25Z"},{"id":"wordfence:c78a0325-5bbf-4550-8477-94247f085e40","source":"wordfence","cve":"CVE-2025-14842","title":"Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload","severity":"medium","cvss":6.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c78a0325-5bbf-4550-8477-94247f085e40?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.2","to_inclusive":true,"patched_in":"1.3.9.3"}],"published":"2026-01-06T18:04:29Z","updated":"2026-01-07T06:36:04Z"},{"id":"wordfence:c78acf9d-89bf-4c8f-b333-31a330701614","source":"wordfence","cve":"CVE-2016-11012","title":"Sola Support Tickets < 3.13 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c78acf9d-89bf-4c8f-b333-31a330701614?source=api-prod","affected":[{"type":"plugin","slug":"sola-support-tickets","name":"Sola Support Tickets","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":false,"patched_in":"3.13"}],"published":"2016-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c78b07c1-c31e-4e98-b33d-eb364ec11851","source":"wordfence","cve":"CVE-2025-31415","title":"YayExtra <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c78b07c1-c31e-4e98-b33d-eb364ec11851?source=api-prod","affected":[{"type":"plugin","slug":"yayextra","name":"YayExtra \u2013 WooCommerce Extra Product Options","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:43:27Z"},{"id":"wordfence:c78ec44e-c3e4-410e-9937-46657664d6cb","source":"wordfence","cve":"CVE-2023-2795","title":"CodeColorer <= 0.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c78ec44e-c3e4-410e-9937-46657664d6cb?source=api-prod","affected":[{"type":"plugin","slug":"codecolorer","name":"CodeColorer","from":"*","from_inclusive":true,"to":"0.10.0","to_inclusive":true,"patched_in":"0.10.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7907277-ee09-4a4e-a65c-13f18be65473","source":"wordfence","cve":"CVE-2025-49446","title":"Admin Notes <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7907277-ee09-4a4e-a65c-13f18be65473?source=api-prod","affected":[{"type":"plugin","slug":"admin-note","name":"Admin Notes","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T14:57:51Z"},{"id":"wordfence:c7909b75-8087-4d38-8325-c619bf84d997","source":"wordfence","cve":"CVE-2025-8289","title":"Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7909b75-8087-4d38-8325-c619bf84d997?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-08-19T12:30:22Z","updated":"2025-08-20T01:44:36Z"},{"id":"wordfence:c793bf75-5e44-4511-9005-4175f349cef4","source":"wordfence","cve":"CVE-2013-0731","title":"MailUp newsletter sign-up form < 1.3.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c793bf75-5e44-4511-9005-4175f349cef4?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailup","name":"MailUp newsletter sign-up form","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2013-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c793d7ad-987f-4b44-92aa-d0fdd66aa537","source":"wordfence","cve":"","title":"Members List Plugin <= 4.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c793d7ad-987f-4b44-92aa-d0fdd66aa537?source=api-prod","affected":[{"type":"plugin","slug":"members-list","name":"Members List Plugin","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c79587d8-56a9-4c1c-99dc-bc66194ffe52","source":"wordfence","cve":"","title":"WP-UserOnline < 2.70 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c79587d8-56a9-4c1c-99dc-bc66194ffe52?source=api-prod","affected":[{"type":"plugin","slug":"wp-useronline","name":"WP-UserOnline","from":"*","from_inclusive":true,"to":"2.62","to_inclusive":true,"patched_in":"2.70"}],"published":"2010-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c799a373-3c0e-4b77-9e51-0e6bd2ab4b7f","source":"wordfence","cve":"CVE-2021-24335","title":"Car Repair Services & Auto Mechanic < 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c799a373-3c0e-4b77-9e51-0e6bd2ab4b7f?source=api-prod","affected":[{"type":"theme","slug":"car-repair-service","name":"Car Repair Services & Auto Mechanic WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c79a173d-b9c3-4554-95e7-2a4b87382079","source":"wordfence","cve":"CVE-2022-1842","title":"OpenBook Book Data <= 3.5.2 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c79a173d-b9c3-4554-95e7-2a4b87382079?source=api-prod","affected":[{"type":"plugin","slug":"openbook-book-data","name":"OpenBook Book Data","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c79a9fad-3f4a-47f5-b911-c9f22a08f0aa","source":"wordfence","cve":"CVE-2025-23470","title":"Visit Site Link enhanced <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c79a9fad-3f4a-47f5-b911-c9f22a08f0aa?source=api-prod","affected":[{"type":"plugin","slug":"visit-site-link-enhanced","name":"\"Visit Site\" Link enhanced \u2013 WordPress PlugIn","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:51:05Z"},{"id":"wordfence:c79d781e-4c11-43e9-8c5f-aa89e8fbf635","source":"wordfence","cve":"CVE-2023-30779","title":"Query Wrangler <= 1.5.51 - Reflected Cross-Site Scripting via page parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c79d781e-4c11-43e9-8c5f-aa89e8fbf635?source=api-prod","affected":[{"type":"plugin","slug":"query-wrangler","name":"Query Wrangler","from":"*","from_inclusive":true,"to":"1.5.51","to_inclusive":true,"patched_in":"1.5.52"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c79fd08c-97bc-4d55-832e-92d0897bc3dc","source":"wordfence","cve":"","title":"Protected Posts Logout Button <= 1.4.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c79fd08c-97bc-4d55-832e-92d0897bc3dc?source=api-prod","affected":[{"type":"plugin","slug":"protected-posts-logout-button","name":"Protected Posts Logout Button","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7a2be64-18e5-4e79-a5a2-3bf3cf949a67","source":"wordfence","cve":"CVE-2024-51802","title":"Lead capture, gated content & newsletter opt-ins <= 7.4.857 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a2be64-18e5-4e79-a5a2-3bf3cf949a67?source=api-prod","affected":[{"type":"plugin","slug":"bread-butter","name":"Bread & Butter \u2013 Identify Website Visitors, Score Leads & Gate Content","from":"*","from_inclusive":true,"to":"7.4.857","to_inclusive":true,"patched_in":"7.5.880"}],"published":"2024-11-08T00:00:00Z","updated":"2024-12-06T12:43:19Z"},{"id":"wordfence:c7a34c76-34f0-42db-af90-b477a45b84d7","source":"wordfence","cve":"CVE-2024-34411","title":"canvasio3D Light <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a34c76-34f0-42db-af90-b477a45b84d7?source=api-prod","affected":[{"type":"plugin","slug":"canvasio3d-light","name":"canvasio3D Light","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:08:47Z"},{"id":"wordfence:c7a6eff3-a592-4476-aff4-c133bb4e5870","source":"wordfence","cve":"CVE-2012-6649","title":"WP GPX Maps < 1.1.23 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a6eff3-a592-4476-aff4-c133bb4e5870?source=api-prod","affected":[{"type":"plugin","slug":"wp-gpx-maps","name":"WP GPX Maps \u2013 GPX, FIT & KML maps with elevation profile","from":"*","from_inclusive":true,"to":"1.1.23","to_inclusive":false,"patched_in":"1.1.23"}],"published":"2012-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7a7df90-a542-48cf-a58e-bcbddc978df2","source":"wordfence","cve":"CVE-2023-41863","title":"PeproDev CF7 Database <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting via form submission","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a7df90-a542-48cf-a58e-bcbddc978df2?source=api-prod","affected":[{"type":"plugin","slug":"pepro-cf7-database","name":"PeproDev CF7 Database","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7a92dc0-f3bd-4133-b7c1-137eb7799d7f","source":"wordfence","cve":"CVE-2024-49224","title":"Mitm Bug Tracker <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a92dc0-f3bd-4133-b7c1-137eb7799d7f?source=api-prod","affected":[{"type":"plugin","slug":"mitm-bug-tracker","name":"Mitm Bug Tracker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:06:02Z"},{"id":"wordfence:c7a943e2-f121-4f3c-b7e9-81a2158fa93f","source":"wordfence","cve":"CVE-2026-24620","title":"Landing Page Builder <= 1.5.3.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a943e2-f121-4f3c-b7e9-81a2158fa93f?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-add","name":"Landing Page Builder \u2013 Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.5.3.4","to_inclusive":true,"patched_in":"1.5.3.5"}],"published":"2026-01-10T15:52:46Z","updated":"2026-04-15T13:34:06Z"},{"id":"wordfence:c7a97aeb-f34c-4997-864b-132bb5ed28e7","source":"wordfence","cve":"CVE-2022-0786","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 2.3.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7a97aeb-f34c-4997-864b-132bb5ed28e7?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7aa1f57-44c2-45ec-87a3-483f8dc9a957","source":"wordfence","cve":"CVE-2022-25613","title":"FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7aa1f57-44c2-45ec-87a3-483f8dc9a957?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.18.727","to_inclusive":true,"patched_in":"7.5.19.728"}],"published":"2022-04-04T05:25:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7aaff3e-0c81-4fe7-b162-569c517f6c49","source":"wordfence","cve":"CVE-2024-4370","title":"WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7aaff3e-0c81-4fe7-b162-569c517f6c49?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.1.36","to_inclusive":true,"patched_in":"1.1.37"}],"published":"2024-05-14T10:38:28Z","updated":"2024-05-14T23:31:46Z"},{"id":"wordfence:c7ab5a00-ce1c-4d74-9192-c9834e2d702d","source":"wordfence","cve":"","title":"Visitor Traffic Real Time Statistics <= 6.7 - Missing Authorization to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ab5a00-ce1c-4d74-9192-c9834e2d702d?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":false,"patched_in":"6.9"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7ab6715-78ac-4030-9147-73c472c6b2e0","source":"wordfence","cve":"CVE-2024-53811","title":"WDesignkit <= 1.0.40 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ab6715-78ac-4030-9147-73c472c6b2e0?source=api-prod","affected":[{"type":"plugin","slug":"wdesignkit","name":"WDesignKit \u2013 AI Website Builder for WordPress with MCP & AI Widget Builder","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T19:12:12Z"},{"id":"wordfence:c7adf1fc-5123-49f8-92e5-b187b74f0e35","source":"wordfence","cve":"CVE-2026-1164","title":"Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7adf1fc-5123-49f8-92e5-b187b74f0e35?source=api-prod","affected":[{"type":"plugin","slug":"easy-voice-mail","name":"Easy Voice Mail","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2026-02-13T16:18:13Z","updated":"2026-03-06T18:31:16Z"},{"id":"wordfence:c7b1216e-b174-4598-bd7b-27a34d251d8a","source":"wordfence","cve":"CVE-2026-57682","title":"Simple Link Directory Pro <= 15.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b1216e-b174-4598-bd7b-27a34d251d8a?source=api-prod","affected":[{"type":"plugin","slug":"qc-simple-link-directory","name":"Simple Link Directory Pro","from":"*","from_inclusive":true,"to":"15.0.5","to_inclusive":true,"patched_in":"15.0.6"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:48:09Z"},{"id":"wordfence:c7b3aa68-e8db-4fac-8c94-b1398bec3263","source":"wordfence","cve":"CVE-2025-30535","title":"External image replace <= 1.0.8 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b3aa68-e8db-4fac-8c94-b1398bec3263?source=api-prod","affected":[{"type":"plugin","slug":"external-image-replace","name":"External image replace","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:18:28Z"},{"id":"wordfence:c7b540b9-cdf1-40ea-b693-c237e76c0958","source":"wordfence","cve":"CVE-2021-24159","title":"Contact Form 7 Style <= 3.1.9 Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b540b9-cdf1-40ea-b693-c237e76c0958?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-style","name":"Contact Form 7 Style","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":""}],"published":"2021-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7b5e028-d4ea-4f6d-aee1-0e9661853d43","source":"wordfence","cve":"CVE-2025-32507","title":"Event Espresso \u2013 Custom Email Template Shortcode <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b5e028-d4ea-4f6d-aee1-0e9661853d43?source=api-prod","affected":[{"type":"plugin","slug":"email-shortcode","name":"Event Espresso \u2013 Custom Email Template Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:21:03Z"},{"id":"wordfence:c7b68860-3ecf-4608-ac10-ae557152d04e","source":"wordfence","cve":"CVE-2026-32336","title":"Rara Business <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b68860-3ecf-4608-ac10-ae557152d04e?source=api-prod","affected":[{"type":"theme","slug":"rara-business","name":"Rara Business","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:45:59Z"},{"id":"wordfence:c7b897f5-f988-4515-83bc-456f041d7e2e","source":"wordfence","cve":"CVE-2026-7647","title":"Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7b897f5-f988-4515-83bc-456f041d7e2e?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.14.5","to_inclusive":true,"patched_in":"3.14.6"}],"published":"2026-05-01T17:10:32Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:c7ba4218-5b60-4e72-b98d-7c95c9fc3d59","source":"wordfence","cve":"CVE-2024-0957","title":"WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2024-03-21T00:00:00Z","updated":"2024-03-22T02:00:01Z"},{"id":"wordfence:c7bb018b-2b7e-4fe4-b8f1-8284d2084d13","source":"wordfence","cve":"CVE-2026-87074","title":"Forminator Forms <= 1.57.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bb018b-2b7e-4fe4-b8f1-8284d2084d13?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2.0","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:54:35Z"},{"id":"wordfence:c7bb055d-dd43-4c40-be30-325ecb6d7731","source":"wordfence","cve":"","title":"Amplus (Unspecified Version) - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bb055d-dd43-4c40-be30-325ecb6d7731?source=api-prod","affected":[{"type":"theme","slug":"amplus","name":"Amplus","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7bcd458-71bf-4961-a7ce-3f88593f6f5e","source":"wordfence","cve":"CVE-2015-6738","title":"iFrame <= 4.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bcd458-71bf-4961-a7ce-3f88593f6f5e?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7bf3d06-2378-4c2c-9d7e-c1de703043a8","source":"wordfence","cve":"CVE-2025-23923","title":"Lockets <= 0.999 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bf3d06-2378-4c2c-9d7e-c1de703043a8?source=api-prod","affected":[{"type":"plugin","slug":"lockets","name":"Lockets","from":"*","from_inclusive":true,"to":"0.999","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-21T14:30:33Z"},{"id":"wordfence:c7bfc7bf-19bb-43aa-95fc-7f4558699f41","source":"wordfence","cve":"","title":"WP Print Friendly <= 0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bfc7bf-19bb-43aa-95fc-7f4558699f41?source=api-prod","affected":[{"type":"plugin","slug":"wp-print-friendly","name":"WP Print Friendly","from":"*","from_inclusive":true,"to":"0.6.1","to_inclusive":false,"patched_in":"0.6.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7c0a72a-08fe-4365-b762-93a96455a589","source":"wordfence","cve":"CVE-2024-4381","title":"CB (legacy) <= 0.9.4.18 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c0a72a-08fe-4365-b762-93a96455a589?source=api-prod","affected":[{"type":"plugin","slug":"commons-booking","name":"CB (legacy)","from":"*","from_inclusive":true,"to":"0.9.4.18","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:12:23Z"},{"id":"wordfence:c7c1dc51-47ca-4b2f-9ff9-275bd8b1c106","source":"wordfence","cve":"CVE-2026-1277","title":"URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c1dc51-47ca-4b2f-9ff9-275bd8b1c106?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2026-02-17T16:15:33Z","updated":"2026-02-18T04:35:46Z"},{"id":"wordfence:c7c36911-4afe-4ac7-9a76-7365bb86f81c","source":"wordfence","cve":"CVE-2017-18491","title":"Advanced Contact Us Form Builder for WordPress <= 4.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c36911-4afe-4ac7-9a76-7365bb86f81c?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7c7247c-2fc3-46ff-858e-2242b7211476","source":"wordfence","cve":"CVE-2025-13035","title":"Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains","severity":"high","cvss":8.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7247c-2fc3-46ff-858e-2242b7211476?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2025-11-18T19:03:25Z","updated":"2025-11-20T20:27:58Z"},{"id":"wordfence:c7c7298d-f20c-479c-b422-81bff4c19523","source":"wordfence","cve":"CVE-2025-22287","title":"LTL Freight Quotes \u2013 FreightQuote Edition <= 2.3.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c7298d-f20c-479c-b422-81bff4c19523?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-freightquote-edition","name":"LTL Freight Quotes \u2013 FreightQuote Edition","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-02-12T00:00:00Z","updated":"2025-03-21T14:47:26Z"},{"id":"wordfence:c7c8380b-02ae-49d2-8c64-debe7f73ee35","source":"wordfence","cve":"CVE-2023-49846","title":"Author Avatars List/Block <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c8380b-02ae-49d2-8c64-debe7f73ee35?source=api-prod","affected":[{"type":"plugin","slug":"author-avatars","name":"Author Avatars List/Block","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7c89fce-afef-4b5a-92c3-41bcfb382978","source":"wordfence","cve":"CVE-2025-39571","title":"WowStore <= 4.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7c89fce-afef-4b5a-92c3-41bcfb382978?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:18:00Z"},{"id":"wordfence:c7ca7848-f69f-41fd-b7b2-62f608e5ba2b","source":"wordfence","cve":"CVE-2026-116403","title":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy <= 3.7.1 - Unauthenticated Discount Code Limit Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ca7848-f69f-41fd-b7b2-62f608e5ba2b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T15:11:08Z"},{"id":"wordfence:c7caf1f4-a8dd-4016-91eb-2adbeed5290a","source":"wordfence","cve":"CVE-2026-6963","title":"WP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7caf1f4-a8dd-4016-91eb-2adbeed5290a?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-gateway","name":"WP Mail Gateway","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T04:27:45Z"},{"id":"wordfence:c7cc92aa-2904-41f7-a17a-a60a2dad4681","source":"wordfence","cve":"CVE-2026-94670","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7cc92aa-2904-41f7-a17a-a60a2dad4681?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-10-02T08:05:50Z","updated":"2026-10-09T00:08:37Z"},{"id":"wordfence:c7cd6e44-bd78-4eb8-bab8-09e2af583222","source":"wordfence","cve":"CVE-2025-6253","title":"UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7cd6e44-bd78-4eb8-bab8-09e2af583222?source=api-prod","affected":[{"type":"plugin","slug":"uicore-elements","name":"UiCore Elements \u2013 Free widgets and templates for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-08-11T17:05:09Z","updated":"2025-08-12T05:27:11Z"},{"id":"wordfence:c7cdf109-a9ce-4b1e-ac4d-07c5eee550cf","source":"wordfence","cve":"CVE-2024-35705","title":"Block for Font Awesome <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7cdf109-a9ce-4b1e-ac4d-07c5eee550cf?source=api-prod","affected":[{"type":"plugin","slug":"block-for-font-awesome","name":"Block for Font Awesome Icons \u2013 Searchable Icon Picker, SVG, FA 7","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:51:00Z"},{"id":"wordfence:c7ce7b9d-7284-4a31-b60d-aa66b7871685","source":"wordfence","cve":"CVE-2026-109984","title":"FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ce7b9d-7284-4a31-b60d-aa66b7871685?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.55.7212","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-10-30T17:07:59Z","updated":"2026-10-30T17:15:32Z"},{"id":"wordfence:c7d04f7d-d114-4104-a7cb-298c148e2b6d","source":"wordfence","cve":"CVE-2007-1894","title":"WordPress Core <= 2.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d04f7d-d114-4104-a7cb-298c148e2b6d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.1","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7d215e9-e615-46ab-b0b8-b37f10cfae98","source":"wordfence","cve":"CVE-2023-51374","title":"ZeroBounce Email Verification & Validation <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d215e9-e615-46ab-b0b8-b37f10cfae98?source=api-prod","affected":[{"type":"plugin","slug":"zerobounce","name":"ZeroBounce Email Verification & Validation","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7d3edf5-245f-42f2-9add-e87de6839ed1","source":"wordfence","cve":"CVE-2023-5458","title":"CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 - Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d3edf5-245f-42f2-9add-e87de6839ed1?source=api-prod","affected":[{"type":"plugin","slug":"cits-support-svg-webp-media-upload","name":"CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7d667af-d15f-4fe0-91af-36a3ed314760","source":"wordfence","cve":"CVE-2016-1000143","title":"Photoxhibit <= 2.1.8 - Reflected Cross-Site Scripting via gid","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d667af-d15f-4fe0-91af-36a3ed314760?source=api-prod","affected":[{"type":"plugin","slug":"photoxhibit","name":"PhotoXhibit","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":""}],"published":"2016-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7d688af-649c-4858-9c63-b12933d78bc2","source":"wordfence","cve":"CVE-2024-12128","title":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Reflected Cross-Site Scripting via monthly_sales_current_year Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d688af-649c-4858-9c63-b12933d78bc2?source=api-prod","affected":[{"type":"plugin","slug":"simple-e-commerce-shopping-cart","name":"Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:16:57Z","updated":"2024-12-07T09:27:06Z"},{"id":"wordfence:c7db2ec4-67cd-4ebb-8fbb-a1dc9def2f9a","source":"wordfence","cve":"CVE-2025-39438","title":"Theme Changer <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7db2ec4-67cd-4ebb-8fbb-a1dc9def2f9a?source=api-prod","affected":[{"type":"plugin","slug":"theme-changer","name":"Theme Changer","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-25T14:56:06Z"},{"id":"wordfence:c7e1028e-e04b-46c4-b574-889d9fc1069d","source":"wordfence","cve":"CVE-2024-4619","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e1028e-e04b-46c4-b574-889d9fc1069d?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.21.5","to_inclusive":true,"patched_in":"3.21.6"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-22T21:36:06Z"},{"id":"wordfence:c7e24790-01a0-41bc-a380-60d86c6e1443","source":"wordfence","cve":"CVE-2026-88999","title":"Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e24790-01a0-41bc-a380-60d86c6e1443?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.14","to_inclusive":true,"patched_in":"4.5.15"}],"published":"2026-09-30T16:41:29Z","updated":"2026-10-01T05:30:55Z"},{"id":"wordfence:c7e3a8ee-9950-4da4-8450-8b5902b3b876","source":"wordfence","cve":"CVE-2022-4693","title":"User Verification <= 1.0.93 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7e3a8ee-9950-4da4-8450-8b5902b3b876?source=api-prod","affected":[{"type":"plugin","slug":"user-verification","name":"User Verification by PickPlugins","from":"*","from_inclusive":true,"to":"1.0.93","to_inclusive":true,"patched_in":"1.0.94"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7f041a7-f5cc-463c-97b0-d4ecb3edb77a","source":"wordfence","cve":"CVE-2025-14314","title":"PopupKit <= 2.1.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f041a7-f5cc-463c-97b0-d4ecb3edb77a?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder-block","name":"Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-19T16:35:04Z"},{"id":"wordfence:c7f098b9-eca3-41c7-9c74-0f4b3f75c915","source":"wordfence","cve":"CVE-2026-1771","title":"MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2026-07-20T19:29:00Z","updated":"2026-07-21T07:51:22Z"},{"id":"wordfence:c7f10f62-98cf-4629-9a48-59a42490276d","source":"wordfence","cve":"CVE-2022-0440","title":"Catch Themes Demo Import <= 2.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f10f62-98cf-4629-9a48-59a42490276d?source=api-prod","affected":[{"type":"plugin","slug":"catch-themes-demo-import","name":"Catch Themes Demo Import","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2022-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7f1ffba-bae2-4f69-ac96-c4570d36eb73","source":"wordfence","cve":"CVE-2024-37932","title":"Woocommerce OpenPos <= 6.4.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f1ffba-bae2-4f69-ac96-c4570d36eb73?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-openpos","name":"Openpos - WooCommerce Point Of Sale(POS)","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-27T13:29:19Z"},{"id":"wordfence:c7f4f726-7e53-4397-8d8b-7a574326adc6","source":"wordfence","cve":"CVE-2025-13457","title":"WooCommerce Square <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f4f726-7e53-4397-8d8b-7a574326adc6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.2.0","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.3.0","from_inclusive":true,"to":"4.3.2","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.4.0","from_inclusive":true,"to":"4.4.2","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.5.0","from_inclusive":true,"to":"4.5.2","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.6.0","from_inclusive":true,"to":"4.6.4","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.7.0","from_inclusive":true,"to":"4.7.4","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.8.0","from_inclusive":true,"to":"4.8.8","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"4.9.0","from_inclusive":true,"to":"4.9.9","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"5.0.0","from_inclusive":true,"to":"5.0.1","to_inclusive":false,"patched_in":"4.2.3"},{"type":"plugin","slug":"woocommerce-square","name":"WooCommerce Square","from":"5.1.0","from_inclusive":true,"to":"5.1.2","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2026-01-09T14:05:48Z","updated":"2026-01-10T03:21:01Z"},{"id":"wordfence:c7f5ac78-5195-4b59-abc7-f41e487f9361","source":"wordfence","cve":"CVE-2025-6382","title":"Taeggie Feed <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f5ac78-5195-4b59-abc7-f41e487f9361?source=api-prod","affected":[{"type":"plugin","slug":"taeggie-feed","name":"Taeggie Feed","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":"0.1.11"}],"published":"2025-07-23T20:45:47Z","updated":"2025-10-21T21:10:13Z"},{"id":"wordfence:c7f5aece-dff2-40d9-bab7-9e2a795fab5b","source":"wordfence","cve":"CVE-2025-31798","title":"Publitio <= 2.1.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f5aece-dff2-40d9-bab7-9e2a795fab5b?source=api-prod","affected":[{"type":"plugin","slug":"publitio","name":"Publitio","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-23T17:48:11Z"},{"id":"wordfence:c7f7b6b1-61d6-4911-ad1f-16a14c16618d","source":"wordfence","cve":"CVE-2023-0151","title":"uTubeVideo Gallery <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f7b6b1-61d6-4911-ad1f-16a14c16618d?source=api-prod","affected":[{"type":"plugin","slug":"utubevideo-gallery","name":"uTubeVideo Gallery","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7f7e545-5e14-421e-90b4-bc54b23d0fe6","source":"wordfence","cve":"CVE-2024-9628","title":"WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f7e545-5e14-421e-90b4-bc54b23d0fe6?source=api-prod","affected":[{"type":"plugin","slug":"wps-telegram-chat","name":"WPS Telegram Chat","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-25T20:48:45Z"},{"id":"wordfence:c7fa48e2-e4d5-4e9e-8864-ef5dac36573c","source":"wordfence","cve":"CVE-2026-111847","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fa48e2-e4d5-4e9e-8864-ef5dac36573c?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.72","to_inclusive":true,"patched_in":"2.1.80"}],"published":"2026-10-22T06:50:00Z","updated":"2026-10-23T18:31:47Z"},{"id":"wordfence:c7fcfcb3-cee0-4a18-b82d-0e0cfee0d2a0","source":"wordfence","cve":"CVE-2026-42700","title":"Image Slider <= 1.1.130 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fcfcb3-cee0-4a18-b82d-0e0cfee0d2a0?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-widget","name":"Image Slider","from":"*","from_inclusive":true,"to":"1.1.130","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T17:13:00Z","updated":"2026-10-08T23:35:44Z"},{"id":"wordfence:c7fdd481-57f0-4fa8-8434-868ef6341fd2","source":"wordfence","cve":"CVE-2026-32369","title":"Medilink-Core < 2.0.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fdd481-57f0-4fa8-8434-868ef6341fd2?source=api-prod","affected":[{"type":"plugin","slug":"medilink-core","name":"Medilink-Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2026-02-16T00:00:00Z","updated":"2026-05-05T14:10:11Z"},{"id":"wordfence:c7fe06c1-fe51-42b5-9c56-cb9e6513f4af","source":"wordfence","cve":"CVE-2021-36878","title":"uListing <= 2.0.5 - Cross-Site Request Forgery leading to Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fe06c1-fe51-42b5-9c56-cb9e6513f4af?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T04:44:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7fe81f4-a3f3-4e4e-ae30-f4d09844461c","source":"wordfence","cve":"CVE-2026-11855","title":"Simple Membership <= 4.7.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fe81f4-a3f3-4e4e-ae30-f4d09844461c?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2026-06-15T00:00:00Z","updated":"2026-09-18T15:00:00Z"},{"id":"wordfence:c7fef895-95d3-4106-94f1-52f8044c3b62","source":"wordfence","cve":"","title":"FGallery Plus (All Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7fef895-95d3-4106-94f1-52f8044c3b62?source=api-prod","affected":[{"type":"plugin","slug":"fgallery_plus","name":"FGallery Plus","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c7ffd34b-c1b5-4031-937d-c509f9979116","source":"wordfence","cve":"CVE-2025-32187","title":"Administrator Z <= 2025.09.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ffd34b-c1b5-4031-937d-c509f9979116?source=api-prod","affected":[{"type":"plugin","slug":"administrator-z","name":"Administrator Z","from":"*","from_inclusive":true,"to":"2025.09.27","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2026-03-06T14:40:33Z"},{"id":"wordfence:c800a65a-e545-465c-84c7-a2cd3d393477","source":"wordfence","cve":"CVE-2026-113486","title":"Media Library Assistant < 3.42 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c800a65a-e545-465c-84c7-a2cd3d393477?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":false,"patched_in":"3.42"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:16:34Z"},{"id":"wordfence:c801dfe6-a39f-4212-9cd7-71ef921c43ef","source":"wordfence","cve":"CVE-2017-18560","title":"Content Audit <= 1.9.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c801dfe6-a39f-4212-9cd7-71ef921c43ef?source=api-prod","affected":[{"type":"plugin","slug":"content-audit","name":"Content Audit","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8032213-52e7-4222-a9a5-13fa64d66213","source":"wordfence","cve":"CVE-2024-8618","title":"Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8032213-52e7-4222-a9a5-13fa64d66213?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-09-04T00:00:00Z","updated":"2025-05-29T22:28:29Z"},{"id":"wordfence:c80498d0-20b0-40c4-a646-c691dbc6dff5","source":"wordfence","cve":"CVE-2026-93950","title":"Motors - Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80498d0-20b0-40c4-a646-c691dbc6dff5?source=api-prod","affected":[{"type":"theme","slug":"motors","name":"Motors - Car Dealer, Rental & Listing WordPress theme","from":"*","from_inclusive":true,"to":"1.4.108","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:33:02Z","updated":"2026-10-14T04:05:13Z"},{"id":"wordfence:c8065d25-2ded-4021-a53d-204242db0915","source":"wordfence","cve":"CVE-2022-4888","title":"Multiple Addify Plugins <= (Various Versions) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8065d25-2ded-4021-a53d-204242db0915?source=api-prod","affected":[{"type":"plugin","slug":"addify-custom-registration-forms-builder","name":"Custom Registration Forms Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"addify-custom-fields-for-woocommerce","name":"Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"},{"type":"plugin","slug":"addify-product-labels-and-stickers","name":"WooCommerce Product Labels and Stickers","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"addify-product-dynamic-pricing-and-discounts","name":"Product Dynamic Pricing and Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"addify-abandoned-cart-recovery","name":"WooCommerce Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"},{"type":"plugin","slug":"addify-checkout-fields-manager","name":"WooCommerce Checkout Field Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"addify-order-tracking-for-woocommerce","name":"WooCommerce Order Tracking","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"addify-free-gifts-woocommerce","name":"WooCommerce Advanced Free Gifts","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"},{"type":"plugin","slug":"addify-image-watermark-for-woocommerce","name":"Image Watermark for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"},{"type":"plugin","slug":"addify-gift-registry-for-woocommerce","name":"WooCommerce Gift Registry","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"addify-order-approval-woocommerce","name":"WooCommerce Order Approval","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"},{"type":"plugin","slug":"addify-price-calculator-for-woocommerce","name":"Price Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"},{"type":"plugin","slug":"addify-custom-order-number","name":"WooCommerce Custom Order Number","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2023-07-10T00:00:00Z","updated":"2026-11-05T17:07:47Z"},{"id":"wordfence:c80833c3-8ffc-41a1-8d11-dafa962191fd","source":"wordfence","cve":"","title":"Product Feed PRO for WooCommerce <= 12.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80833c3-8ffc-41a1-8d11-dafa962191fd?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"12.4.4","to_inclusive":true,"patched_in":"12.4.5"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8091442-f937-4f82-a5b1-c033fedcdc0d","source":"wordfence","cve":"CVE-2026-54844","title":"CheckView \u2013 Form & Checkout Testing <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8091442-f937-4f82-a5b1-c033fedcdc0d?source=api-prod","affected":[{"type":"plugin","slug":"checkview","name":"CheckView \u2013 Form & Checkout Testing","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:34:08Z"},{"id":"wordfence:c80a63ac-c734-4744-bb8a-e8a38bc089dd","source":"wordfence","cve":"CVE-2026-122060","title":"Recipe Maker <= 10.9.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80a63ac-c734-4744-bb8a-e8a38bc089dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.9.1","to_inclusive":true,"patched_in":"10.9.2"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:52:11Z"},{"id":"wordfence:c80ac8db-a748-46f4-baef-6c6ff87efb0d","source":"wordfence","cve":"CVE-2025-69105","title":"Modernee <= 1.6.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80ac8db-a748-46f4-baef-6c6ff87efb0d?source=api-prod","affected":[{"type":"theme","slug":"modernee","name":"Modernee","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:42:22Z"},{"id":"wordfence:c80b1d1b-9650-4481-a9aa-09269cbbabde","source":"wordfence","cve":"CVE-2024-54427","title":"Category of Posts <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80b1d1b-9650-4481-a9aa-09269cbbabde?source=api-prod","affected":[{"type":"plugin","slug":"list-one-category-of-posts","name":"Category of Posts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:02:40Z"},{"id":"wordfence:c80d845b-117e-4f60-8978-4aa9806d8c9d","source":"wordfence","cve":"CVE-2025-31088","title":"Paid Member Subscriptions <= 2.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80d845b-117e-4f60-8978-4aa9806d8c9d?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.14.3","to_inclusive":true,"patched_in":"2.14.4"}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:05:37Z"},{"id":"wordfence:c80d994e-997f-457b-b6f9-3589815dc86e","source":"wordfence","cve":"CVE-2016-10873","title":"WP Database Backup <= 4.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80d994e-997f-457b-b6f9-3589815dc86e?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2016-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c80e2a84-fa77-49a8-b197-c258aba58537","source":"wordfence","cve":"CVE-2025-22711","title":"Image Source Control <= 2.29.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80e2a84-fa77-49a8-b197-c258aba58537?source=api-prod","affected":[{"type":"plugin","slug":"image-source-control-isc","name":"Image Source Control Lite \u2013 Show Image Credits and Captions","from":"*","from_inclusive":true,"to":"2.29.0","to_inclusive":true,"patched_in":"2.29.1"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T16:50:03Z"},{"id":"wordfence:c80e6f0b-ccca-4755-b64e-cfcebc5cc1fe","source":"wordfence","cve":"","title":"WP Sticky Button <= 1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80e6f0b-ccca-4755-b64e-cfcebc5cc1fe?source=api-prod","affected":[{"type":"plugin","slug":"wa-sticky-button","name":"WP Sticky Button \u2013 Click to Chat","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c80e9dc6-6a0a-4bdf-bcc4-52df9cc4c405","source":"wordfence","cve":"CVE-2026-3326","title":"XStore < 9.7.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80e9dc6-6a0a-4bdf-bcc4-52df9cc4c405?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.7.3","to_inclusive":false,"patched_in":"9.7.3"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-18T13:18:36Z"},{"id":"wordfence:c80fdf06-48ce-4778-9123-9c531538195d","source":"wordfence","cve":"CVE-2025-23738","title":"Ps Ads Pro <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c80fdf06-48ce-4778-9123-9c531538195d?source=api-prod","affected":[{"type":"plugin","slug":"ps-ads-pro","name":"Ps Ads Pro","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:32:31Z"},{"id":"wordfence:c814924a-bdcd-4b73-905b-a469f4d37ddf","source":"wordfence","cve":"CVE-2017-18583","title":"Post Pay Counter < 2.731 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c814924a-bdcd-4b73-905b-a469f4d37ddf?source=api-prod","affected":[{"type":"plugin","slug":"post-pay-counter","name":"Post Pay Counter","from":"*","from_inclusive":true,"to":"2.731","to_inclusive":false,"patched_in":"2.731"}],"published":"2017-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8177f27-19e1-4272-91ee-55d980b7128e","source":"wordfence","cve":"CVE-2026-1824","title":"Infomaniak Connect for OpenID <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8177f27-19e1-4272-91ee-55d980b7128e?source=api-prod","affected":[{"type":"plugin","slug":"infomaniak-connect-openid","name":"Infomaniak Connect for OpenID","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:46:52Z","updated":"2026-10-13T16:03:09Z"},{"id":"wordfence:c817f0b1-7ea8-4066-9f0a-44ce4a1ddbdf","source":"wordfence","cve":"CVE-2026-116404","title":"Redux Framework <= 4.5.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c817f0b1-7ea8-4066-9f0a-44ce4a1ddbdf?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-10-26T12:36:24Z","updated":"2026-11-03T19:30:44Z"},{"id":"wordfence:c81b2dca-d830-4901-8b16-5feb7cd1a4d5","source":"wordfence","cve":"CVE-2022-1047","title":"Themify PTB Search Addon <= 1.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c81b2dca-d830-4901-8b16-5feb7cd1a4d5?source=api-prod","affected":[{"type":"plugin","slug":"themify-ptb-search","name":"Themify Post Type Builder (PTB) Search Addon","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c81f9926-736b-42f1-a0f5-f9b434ffcce1","source":"wordfence","cve":"CVE-2024-51691","title":"Admin Amplify <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c81f9926-736b-42f1-a0f5-f9b434ffcce1?source=api-prod","affected":[{"type":"plugin","slug":"wpr-admin-amplify","name":"Admin Amplify","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:27:31Z"},{"id":"wordfence:c81fac53-32d9-40da-80b1-e885b605c80c","source":"wordfence","cve":"CVE-2026-94664","title":"PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c81fac53-32d9-40da-80b1-e885b605c80c?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-contact-form-7","name":"PDF for Contact Form 7 + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:47:37Z"},{"id":"wordfence:c820003b-8f30-4557-a282-e3ad7e403062","source":"wordfence","cve":"CVE-2023-25450","title":"GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c820003b-8f30-4557-a282-e3ad7e403062?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8207f83-c771-44b1-ab18-ff582ad7b274","source":"wordfence","cve":"CVE-2026-112849","title":"Hostme v2 - Responsive WordPress Theme <= 7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8207f83-c771-44b1-ab18-ff582ad7b274?source=api-prod","affected":[{"type":"theme","slug":"hostmev2","name":"Hostme v2 - Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:55:36Z"},{"id":"wordfence:c820ff17-718d-4e3a-9a46-7d5a4a573f78","source":"wordfence","cve":"CVE-2024-53742","title":"Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c820ff17-718d-4e3a-9a46-7d5a4a573f78?source=api-prod","affected":[{"type":"plugin","slug":"multilevel-referral-plugin-for-woocommerce","name":"Multilevel Referral Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.27","to_inclusive":true,"patched_in":"2.28"}],"published":"2024-11-28T00:00:00Z","updated":"2026-01-23T19:49:57Z"},{"id":"wordfence:c824823c-68d0-4f41-ac22-c517763357eb","source":"wordfence","cve":"","title":"Traveler \u2013 Travel Booking WordPress Theme < 2.7.8.6 - Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c824823c-68d0-4f41-ac22-c517763357eb?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.7.8.6","to_inclusive":false,"patched_in":"2.7.8.6"}],"published":"2020-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c825723b-2ec5-4af8-91a1-454d35a7f1bb","source":"wordfence","cve":"CVE-2025-30977","title":"WP Live Chat + Chatbots Plugin for WordPress \u2013 Chaport <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c825723b-2ec5-4af8-91a1-454d35a7f1bb?source=api-prod","affected":[{"type":"plugin","slug":"chaport","name":"Chaport \u2014 Live Chat & Chatbots","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-12-05T17:53:53Z"},{"id":"wordfence:c829217a-c5be-4713-bbf4-c1ba829c1187","source":"wordfence","cve":"CVE-2022-25649","title":"Affiliate For WooCommerce <= 4.7.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c829217a-c5be-4713-bbf4-c1ba829c1187?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-for-woocommerce","name":"Affiliate For WooCommerce","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c829894f-05b8-4c65-9f3a-3a5d6e212cde","source":"wordfence","cve":"","title":"Quiz And Survey Master <= 7.3.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c829894f-05b8-4c65-9f3a-3a5d6e212cde?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.10","to_inclusive":true,"patched_in":"7.3.11"}],"published":"2022-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c82e24a3-8000-4aa5-953e-11415b94909b","source":"wordfence","cve":"CVE-2024-43142","title":"Tutor LMS <= 2.7.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c82e24a3-8000-4aa5-953e-11415b94909b?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:02:52Z"},{"id":"wordfence:c82f3864-13af-4ff6-824a-4c799a98f3f6","source":"wordfence","cve":"CVE-2026-1704","title":"Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.9.29","to_inclusive":true,"patched_in":"1.6.10.0"}],"published":"2026-03-12T19:08:49Z","updated":"2026-03-13T07:23:48Z"},{"id":"wordfence:c8313827-f3ce-451d-869a-99684f58daff","source":"wordfence","cve":"CVE-2006-1263","title":"WordPress Core < 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8313827-f3ce-451d-869a-99684f58daff?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2006-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c83241b6-a992-47a7-8208-c562b89bff4c","source":"wordfence","cve":"CVE-2026-16616","title":"Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c83241b6-a992-47a7-8208-c562b89bff4c?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.11","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:16:01Z"},{"id":"wordfence:c8399133-da13-48ec-a0d0-94e51d5f3e4f","source":"wordfence","cve":"CVE-2026-84776","title":"MalCare WordPress Security Plugin \u2013 Malware Scanner, Cleaner, Security Firewall <= 6.69 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8399133-da13-48ec-a0d0-94e51d5f3e4f?source=api-prod","affected":[{"type":"plugin","slug":"malcare-security","name":"MalCare WordPress Security Plugin \u2013 Malware Scanner, Cleaner, Security Firewall","from":"*","from_inclusive":true,"to":"6.69","to_inclusive":true,"patched_in":"6.72"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:19:11Z"},{"id":"wordfence:c83a2c4d-a264-49ec-85f1-e3f48715d725","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection","severity":"medium","cvss":5.5,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c83a2c4d-a264-49ec-85f1-e3f48715d725?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:31:10Z"},{"id":"wordfence:c83df43e-286d-4695-9c37-bee2870fd3b5","source":"wordfence","cve":"CVE-2023-2489","title":"Stop Spammers Security <= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c83df43e-286d-4695-9c37-bee2870fd3b5?source=api-prod","affected":[{"type":"plugin","slug":"stop-spammer-registrations-plugin","name":"Stop Spammers Classic","from":"*","from_inclusive":true,"to":"2022.6","to_inclusive":true,"patched_in":"2023"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c83f48dd-9070-412d-b911-98581a81e29a","source":"wordfence","cve":"CVE-2025-14426","title":"Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c83f48dd-9070-412d-b911-98581a81e29a?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.18","to_inclusive":true,"patched_in":"3.2.19"}],"published":"2025-12-29T00:00:00Z","updated":"2025-12-30T12:22:38Z"},{"id":"wordfence:c8416840-c022-40a1-bcd3-17b34df11d95","source":"wordfence","cve":"CVE-2022-47444","title":"ProfilePress <= 4.5.3 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8416840-c022-40a1-bcd3-17b34df11d95?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8440240-f652-4372-9ed8-f3eb3b8336e0","source":"wordfence","cve":"CVE-2022-1672","title":"Insights from Google PageSpeed <= 4.0.6 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8440240-f652-4372-9ed8-f3eb3b8336e0?source=api-prod","affected":[{"type":"plugin","slug":"google-pagespeed-insights","name":"Insights from Google PageSpeed","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8452e54-7a81-4921-b531-8cb3b0953dab","source":"wordfence","cve":"CVE-2024-3307","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8452e54-7a81-4921-b531-8cb3b0953dab?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:37Z"},{"id":"wordfence:c84cf8f1-ff13-47e9-bf9d-a6f638af0492","source":"wordfence","cve":"CVE-2025-62973","title":"BuddyForms <= 2.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c84cf8f1-ff13-47e9-bf9d-a6f638af0492?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2026-10-16T18:08:47Z"},{"id":"wordfence:c84e274e-292f-4d0f-b847-4a786b4cb15a","source":"wordfence","cve":"CVE-2007-0541","title":"WordPress Core < 2.1 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c84e274e-292f-4d0f-b847-4a786b4cb15a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2007-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c84e8ff6-0157-4408-ade7-6ad46dcae5f8","source":"wordfence","cve":"CVE-2026-104400","title":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c84e8ff6-0157-4408-ade7-6ad46dcae5f8?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2026-10-05T08:07:00Z","updated":"2026-10-08T23:24:38Z"},{"id":"wordfence:c854e110-84ba-4b61-b9fd-4ac80b3029a9","source":"wordfence","cve":"CVE-2026-107425","title":"Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c854e110-84ba-4b61-b9fd-4ac80b3029a9?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:34:49Z"},{"id":"wordfence:c8557731-924d-4b35-97ca-bc8f37067f5d","source":"wordfence","cve":"CVE-2026-112348","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.2.4 - Unauthenticated reCAPTCHA Validation Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8557731-924d-4b35-97ca-bc8f37067f5d?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:28:30Z"},{"id":"wordfence:c85590b5-4d96-47b1-9dec-603f444dcaf7","source":"wordfence","cve":"CVE-2026-97286","title":"Strong Testimonials <= 3.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85590b5-4d96-47b1-9dec-603f444dcaf7?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.11","to_inclusive":true,"patched_in":"3.3.12"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:44:31Z"},{"id":"wordfence:c856e06d-34f7-42e9-a72c-3d4e9207e07e","source":"wordfence","cve":"CVE-2025-4198","title":"Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c856e06d-34f7-42e9-a72c-3d4e9207e07e?source=api-prod","affected":[{"type":"plugin","slug":"alink-tap","name":"Alink Tap","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-03T01:43:06Z"},{"id":"wordfence:c857fb50-f3f1-4574-ada9-9492fe09a9c3","source":"wordfence","cve":"CVE-2025-68069","title":"Directorist <= 8.6.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c857fb50-f3f1-4574-ada9-9492fe09a9c3?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.6.6","to_inclusive":true,"patched_in":"8.6.7"}],"published":"2026-01-27T00:00:00Z","updated":"2026-04-14T14:35:52Z"},{"id":"wordfence:c8582af5-92e9-43ef-836f-d87d5cf827d8","source":"wordfence","cve":"CVE-2022-2799","title":"Affiliates Manager <= 2.9.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8582af5-92e9-43ef-836f-d87d5cf827d8?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c85a2d47-cabe-4c0b-b329-af93163d3771","source":"wordfence","cve":"CVE-2026-59546","title":"WP Ghost (Hide My WP Ghost) \u2013 Security & Firewall <= 7.0.06 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85a2d47-cabe-4c0b-b329-af93163d3771?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.06","to_inclusive":true,"patched_in":"7.0.07"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:07:51Z"},{"id":"wordfence:c85c13ed-6981-4062-8aca-800721b28b88","source":"wordfence","cve":"CVE-2023-39988","title":"WxSync <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85c13ed-6981-4062-8aca-800721b28b88?source=api-prod","affected":[{"type":"plugin","slug":"wxsync","name":"WxSync-\u6807\u51c6\u4e91\u5fae\u4fe1\u516c\u4f17\u53f7\u6587\u7ae0\u514d\u8d39\u91c7\u96c6-\u4efb\u610f\u516c\u4f17\u53f7\u81ea\u52a8\u91c7\u96c6\u4ed8\u8d39\u8d2d\u4e70","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2023-08-09T00:00:00Z","updated":"2025-03-18T19:17:01Z"},{"id":"wordfence:c85f6c1b-673d-4fe9-acef-a15d90fcf414","source":"wordfence","cve":"CVE-2022-4112","title":"Quizlord <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85f6c1b-673d-4fe9-acef-a15d90fcf414?source=api-prod","affected":[{"type":"plugin","slug":"quizlord","name":"Quizlord","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c85f8780-8251-4b2b-a2cf-bf9d08cb50fa","source":"wordfence","cve":"CVE-2026-121780","title":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85f8780-8251-4b2b-a2cf-bf9d08cb50fa?source=api-prod","affected":[{"type":"plugin","slug":"nazy-load","name":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2026-11-07T09:41:36Z","updated":"2026-11-10T19:49:20Z"},{"id":"wordfence:c85fa04e-477e-4ac9-b112-02b2ab18ca32","source":"wordfence","cve":"CVE-2023-0159","title":"Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c85fa04e-477e-4ac9-b112-02b2ab18ca32?source=api-prod","affected":[{"type":"plugin","slug":"extensive-vc-addon","name":"Extensive VC Addons for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8647c44-4879-4895-bd07-19f7d62a7326","source":"wordfence","cve":"CVE-2023-1404","title":"Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8647c44-4879-4895-bd07-19f7d62a7326?source=api-prod","affected":[{"type":"plugin","slug":"show-posts","name":"Weaver Show Posts","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2023-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8661bd7-65b7-4277-81a0-fd410ae0ee1b","source":"wordfence","cve":"CVE-2022-0653","title":"Profile Builder - User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8661bd7-65b7-4277-81a0-fd410ae0ee1b?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c866b3b7-50cf-41a5-bdc2-60384b15df79","source":"wordfence","cve":"CVE-2020-24146","title":"CM Download Manager < 2.8.0 - Directory Traversal to Arbitrary File Deletion and Denial of Service","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c866b3b7-50cf-41a5-bdc2-60384b15df79?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c86956bf-b013-4a84-b77e-8b1007238b27","source":"wordfence","cve":"CVE-2026-11446","title":"Booktics \u2013 Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c86956bf-b013-4a84-b77e-8b1007238b27?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2026-09-10T14:53:08Z","updated":"2026-09-11T03:39:38Z"},{"id":"wordfence:c86d41e1-20e9-45b4-9e02-796652fa0546","source":"wordfence","cve":"CVE-2026-103382","title":"Casso Flow \u2013 T\u1ef1 \u0111\u1ed9ng x\u00e1c nh\u1eadn thanh to\u00e1n chuy\u1ec3n kho\u1ea3n ng\u00e2n h\u00e0ng < 4.2.0 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c86d41e1-20e9-45b4-9e02-796652fa0546?source=api-prod","affected":[{"type":"plugin","slug":"casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang","name":"Casso Flow \u2013 T\u1ef1 \u0111\u1ed9ng x\u00e1c nh\u1eadn thanh to\u00e1n chuy\u1ec3n kho\u1ea3n ng\u00e2n h\u00e0ng","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":false,"patched_in":"4.2.0"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:25:09Z"},{"id":"wordfence:c86e5cfd-f450-48d6-819e-5345fc0fdfc8","source":"wordfence","cve":"CVE-2024-23504","title":"Ninja Tables <= 5.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c86e5cfd-f450-48d6-819e-5345fc0fdfc8?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-26T13:48:42Z"},{"id":"wordfence:c86f157e-e7f2-4b00-977c-c4cc7c2b3b0b","source":"wordfence","cve":"CVE-2024-22156","title":"SalesKing <= 1.6.15 - Missing Authorization to Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c86f157e-e7f2-4b00-977c-c4cc7c2b3b0b?source=api-prod","affected":[{"type":"plugin","slug":"salesking","name":"SalesKing","from":"*","from_inclusive":true,"to":"1.6.15","to_inclusive":true,"patched_in":"1.6.30"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c870764c-3e2c-4be2-acff-6bcb56127fce","source":"wordfence","cve":"CVE-2025-66087","title":"PropertyHive <= 2.1.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c870764c-3e2c-4be2-acff-6bcb56127fce?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-01T17:17:47Z"},{"id":"wordfence:c873c04e-516e-41ee-a295-b8c5235abc1b","source":"wordfence","cve":"CVE-2025-3479","title":"Forminator <= 1.42.0 - Order Replay Vulnerability","severity":"medium","cvss":5.3,"cwe":"CWE-354","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.42.0","to_inclusive":true,"patched_in":"1.42.1"}],"published":"2025-04-16T22:33:04Z","updated":"2025-04-17T11:13:07Z"},{"id":"wordfence:c873c76a-144e-4945-8fa2-c9ffe0e3c061","source":"wordfence","cve":"CVE-2023-47504","title":"Elementor Website Builder <= 3.16.4 - Missing Authorization to Arbitrary Attachment Read","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c76a-144e-4945-8fa2-c9ffe0e3c061?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.16.4","to_inclusive":true,"patched_in":"3.16.5"}],"published":"2023-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c873d838-58e8-4f69-bccb-6d1de8d91877","source":"wordfence","cve":"","title":"Login as User or Customer <= 2.1 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c873d838-58e8-4f69-bccb-6d1de8d91877?source=api-prod","affected":[{"type":"plugin","slug":"login-as-customer-or-user","name":"Login as User or Customer \u2014 User Switching","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.1"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c874a9b1-86f4-48ff-867f-feb86ab764a9","source":"wordfence","cve":"CVE-2026-94257","title":"SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c874a9b1-86f4-48ff-867f-feb86ab764a9?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"3.9.6","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T14:45:57Z"},{"id":"wordfence:c874c643-ceb6-4646-adfa-6cd7393bb4f5","source":"wordfence","cve":"CVE-2024-29790","title":"SEO Plugin by Squirrly SEO <= 12.3.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c874c643-ceb6-4646-adfa-6cd7393bb4f5?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.3.16","to_inclusive":true,"patched_in":"12.3.17"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:51:49Z"},{"id":"wordfence:c876df3a-a021-428c-bd78-124d0c1853b9","source":"wordfence","cve":"CVE-2026-28568","title":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c876df3a-a021-428c-bd78-124d0c1853b9?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-08-14T10:46:44Z","updated":"2026-09-02T21:32:55Z"},{"id":"wordfence:c877ac24-a6da-4e61-a669-a0224c9e3bb5","source":"wordfence","cve":"CVE-2024-2349","title":"Fancy Elementor Flipbox <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c877ac24-a6da-4e61-a669-a0224c9e3bb5?source=api-prod","affected":[{"type":"plugin","slug":"fancy-elementor-flipbox","name":"Fancy Elementor Flipbox","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-21T13:48:29Z"},{"id":"wordfence:c877af68-1caa-412c-818a-031bd788660a","source":"wordfence","cve":"CVE-2025-49322","title":"404 Page by SeedProd <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c877af68-1caa-412c-818a-031bd788660a?source=api-prod","affected":[{"type":"plugin","slug":"404-page","name":"404 Page by SeedProd","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:37:39Z"},{"id":"wordfence:c879123c-531e-43d8-a7d3-16a3c86b68a3","source":"wordfence","cve":"CVE-2023-6446","title":"Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c879123c-531e-43d8-a7d3-16a3c86b68a3?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.2.40","to_inclusive":true,"patched_in":"1.2.41"}],"published":"2023-12-05T00:00:00Z","updated":"2024-07-29T21:37:24Z"},{"id":"wordfence:c879566b-8d3b-45aa-91e5-aef1198ef994","source":"wordfence","cve":"CVE-2026-15151","title":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin < 2.7.23 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c879566b-8d3b-45aa-91e5-aef1198ef994?source=api-prod","affected":[{"type":"plugin","slug":"restaurant-reservations","name":"Five Star Restaurant Reservations \u2013 WordPress Booking Plugin","from":"*","from_inclusive":true,"to":"2.7.23","to_inclusive":false,"patched_in":"2.7.23"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:27:25Z"},{"id":"wordfence:c8798fb2-4cab-4960-9e32-fd74bb4a5091","source":"wordfence","cve":"CVE-2026-3601","title":"User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8798fb2-4cab-4960-9e32-fd74bb4a5091?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2026-05-04T19:57:08Z","updated":"2026-05-05T08:27:37Z"},{"id":"wordfence:c87a80ad-27bf-404d-8adf-9acc91354515","source":"wordfence","cve":"CVE-2023-23999","title":"Google Analytics by Monster Insights <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c87a80ad-27bf-404d-8adf-9acc91354515?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-for-wordpress","name":"MonsterInsights \u2013 Google Analytics Dashboard for WordPress (Website Stats Made Easy)","from":"*","from_inclusive":true,"to":"8.14.0","to_inclusive":true,"patched_in":"8.14.1"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c87adbd9-3b09-403e-921a-31b3f58962e9","source":"wordfence","cve":"CVE-2026-11367","title":"PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c87adbd9-3b09-403e-921a-31b3f58962e9?source=api-prod","affected":[{"type":"plugin","slug":"pixmagix","name":"PixMagix \u2013 WordPress Image Editor","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2026-06-29T16:17:28Z","updated":"2026-07-10T14:42:24Z"},{"id":"wordfence:c87e7f50-f14a-4751-abcb-3a5bdd214889","source":"wordfence","cve":"CVE-2026-9125","title":"The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c87e7f50-f14a-4751-abcb-3a5bdd214889?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-06-11T12:49:42Z","updated":"2026-08-28T17:23:38Z"},{"id":"wordfence:c87e8245-236f-4ab8-837b-c5eeec92bb0c","source":"wordfence","cve":"CVE-2024-43944","title":"Maintenance & Coming Soon Redirect Animation <= 2.3.0 - IP Spoofing to Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c87e8245-236f-4ab8-837b-c5eeec92bb0c?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-coming-soon-redirect-animation","name":"Maintenance & Coming Soon Redirect Animation","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2025-03-12T13:20:16Z"},{"id":"wordfence:c880470f-3f81-47a2-b450-7074410e9f43","source":"wordfence","cve":"CVE-2025-13542","title":"DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c880470f-3f81-47a2-b450-7074410e9f43?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-lms","name":"DesignThemes LMS","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-12-02T07:26:08Z","updated":"2025-12-02T19:27:16Z"},{"id":"wordfence:c8815e53-f96b-44b2-8dae-9fcc481b6e0c","source":"wordfence","cve":"CVE-2026-54831","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8815e53-f96b-44b2-8dae-9fcc481b6e0c?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.162","to_inclusive":true,"patched_in":"2.8.163"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:53:40Z"},{"id":"wordfence:c881ddce-05f8-4b56-ac72-52c9b7773db0","source":"wordfence","cve":"","title":"WP Prayer <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c881ddce-05f8-4b56-ac72-52c9b7773db0?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c883c5ab-7bff-48c8-9842-bf51f016981a","source":"wordfence","cve":"CVE-2025-69047","title":"MaxShop <= 3.6.20 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c883c5ab-7bff-48c8-9842-bf51f016981a?source=api-prod","affected":[{"type":"theme","slug":"sw_maxshop","name":"Maxshop - Responsive & Multi-Purpose eCommerce HTML Template","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:23:53Z"},{"id":"wordfence:c884af7a-cd66-4f38-887d-a782ffb32219","source":"wordfence","cve":"","title":"AffiliateWP < 2.0.9.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c884af7a-cd66-4f38-887d-a782ffb32219?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-wp","name":"AffiliateWP","from":"*","from_inclusive":true,"to":"2.0.9.1","to_inclusive":false,"patched_in":"2.0.9.1"}],"published":"2017-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c885e9d8-7e43-4a2e-a111-b156161a58b1","source":"wordfence","cve":"CVE-2026-14928","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c885e9d8-7e43-4a2e-a111-b156161a58b1?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:22:40Z"},{"id":"wordfence:c886ce5a-0633-4892-9471-c1a7ee858c93","source":"wordfence","cve":"CVE-2026-13422","title":"HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c886ce5a-0633-4892-9471-c1a7ee858c93?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz","name":"HD Quiz","from":"2.2.0","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-06-26T12:56:19Z","updated":"2026-06-27T01:27:22Z"},{"id":"wordfence:c886daf1-6e1e-4100-bd40-241588de0410","source":"wordfence","cve":"CVE-2024-51867","title":"Simpul Events by Esotech <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c886daf1-6e1e-4100-bd40-241588de0410?source=api-prod","affected":[{"type":"plugin","slug":"simpul-events-by-esotech","name":"Simpul Events by Esotech","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:08:45Z"},{"id":"wordfence:c88c6ad8-d4bd-4785-a6e7-e5034c58158b","source":"wordfence","cve":"CVE-2025-8607","title":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c88c6ad8-d4bd-4785-a6e7-e5034c58158b?source=api-prod","affected":[{"type":"plugin","slug":"slingblocks","name":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-08-20T16:47:39Z","updated":"2025-08-21T05:28:16Z"},{"id":"wordfence:c88d378a-6c58-4670-b0b6-0e0d51c39bd1","source":"wordfence","cve":"CVE-2025-13885","title":"Zenost Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c88d378a-6c58-4670-b0b6-0e0d51c39bd1?source=api-prod","affected":[{"type":"plugin","slug":"zenost-shortcodes","name":"Zenost Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:31:21Z","updated":"2025-12-12T03:20:56Z"},{"id":"wordfence:c88dcf62-4b6c-4ff0-8530-5aefd54bd347","source":"wordfence","cve":"CVE-2026-1919","title":"Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c88dcf62-4b6c-4ff0-8530-5aefd54bd347?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-03-09T13:22:08Z","updated":"2026-03-10T02:21:49Z"},{"id":"wordfence:c88f9c43-6772-4406-b1f0-2d20f970f1c2","source":"wordfence","cve":"CVE-2026-57678","title":"Slider Revolution  7.0.0-7.0.16 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c88f9c43-6772-4406-b1f0-2d20f970f1c2?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0.0","from_inclusive":true,"to":"7.0.16","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T14:03:06Z"},{"id":"wordfence:c892e5da-bab2-4689-bad0-4b4789015113","source":"wordfence","cve":"CVE-2021-36875","title":"Listing, Classified Ads & Business Directory \u2013 uListing <= 2.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c892e5da-bab2-4689-bad0-4b4789015113?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2021-07-27T04:26:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8958931-36be-47b7-9262-3061cff9be22","source":"wordfence","cve":"","title":"Amerisale-Re (All Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8958931-36be-47b7-9262-3061cff9be22?source=api-prod","affected":[{"type":"plugin","slug":"amerisale-re","name":"amerisale-re","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c896da97-3100-43a8-a5e0-44b61c4431fd","source":"wordfence","cve":"CVE-2023-0172","title":"Juicer <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c896da97-3100-43a8-a5e0-44b61c4431fd?source=api-prod","affected":[{"type":"plugin","slug":"juicer","name":"Juicer.io: Effortlessly embed, curate, and aggregate social media feeds into your website","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.11"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8970d08-6c75-4dbb-ad24-6d9ba4c07530","source":"wordfence","cve":"CVE-2023-51495","title":"WooCommerce Warranty Requests <= 2.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8970d08-6c75-4dbb-ad24-6d9ba4c07530?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-warranty","name":"WooCommerce Warranty Requests","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c89919dc-45e4-4d16-b803-c9c90a31c6f2","source":"wordfence","cve":"CVE-2026-48195","title":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89919dc-45e4-4d16-b803-c9c90a31c6f2?source=api-prod","affected":[{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-10-29T13:06:00Z","updated":"2026-11-03T19:59:24Z"},{"id":"wordfence:c89934b1-5e3c-4bf2-8d36-17c4268ccd4e","source":"wordfence","cve":"CVE-2024-12513","title":"Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89934b1-5e3c-4bf2-8d36-17c4268ccd4e?source=api-prod","affected":[{"type":"plugin","slug":"contests-from-rewards-fuel","name":"Contests by Rewards Fuel","from":"*","from_inclusive":true,"to":"2.0.65","to_inclusive":true,"patched_in":"2.0.66"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T02:26:08Z"},{"id":"wordfence:c89a8001-ab50-466c-aa51-62c0ff5f86dc","source":"wordfence","cve":"CVE-2023-51530","title":"GS Logo Slider <= 3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89a8001-ab50-466c-aa51-62c0ff5f86dc?source=api-prod","affected":[{"type":"plugin","slug":"gs-logo-slider","name":"Logo Slider \u2013 Logo Carousel, Logo Showcase, Logo Gallery & Client Logos","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c89b4177-2e8b-4124-9517-6a1ff6830308","source":"wordfence","cve":"CVE-2025-39489","title":"CouponXL <= 4.5.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89b4177-2e8b-4124-9517-6a1ff6830308?source=api-prod","affected":[{"type":"theme","slug":"couponxl","name":"CouponXL - Coupons, Deals & Discounts WP Theme","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-10-08T17:10:29Z"},{"id":"wordfence:c89d541f-d34e-46f9-a7cd-aeb00b2e8ad0","source":"wordfence","cve":"CVE-2020-11727","title":"Advanced Order Export for WooCommerce <= 3.1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89d541f-d34e-46f9-a7cd-aeb00b2e8ad0?source=api-prod","affected":[{"type":"plugin","slug":"woo-order-export-lite","name":"Advanced Order Export For WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2020-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c89d56e2-68aa-4caf-bc1b-9aa32ec11ba3","source":"wordfence","cve":"","title":"Gravity Forms <= 2.0.6.5 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89d56e2-68aa-4caf-bc1b-9aa32ec11ba3?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.0.6.5","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2016-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c89d9bfd-f14e-4299-ab25-a6856c1af95c","source":"wordfence","cve":"CVE-2026-27413","title":"Profile Builder Pro < 3.14.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89d9bfd-f14e-4299-ab25-a6856c1af95c?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.14.0","to_inclusive":false,"patched_in":"3.14.0"}],"published":"2026-02-23T00:00:00Z","updated":"2026-04-15T13:37:39Z"},{"id":"wordfence:c89e2f15-20e9-442a-8a05-025a6f95c351","source":"wordfence","cve":"CVE-2025-23509","title":"HyperComments <= 0.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c89e2f15-20e9-442a-8a05-025a6f95c351?source=api-prod","affected":[{"type":"plugin","slug":"comments-with-hypercommentscom","name":"HyperComments","from":"*","from_inclusive":true,"to":"0.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:39:51Z"},{"id":"wordfence:c8a1127c-308d-4347-bd42-2071b906e247","source":"wordfence","cve":"CVE-2022-1605","title":"Email Users <= 4.8.8 - Arbitrary Settings Update via Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a1127c-308d-4347-bd42-2071b906e247?source=api-prod","affected":[{"type":"plugin","slug":"email-users","name":"Email Users","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8a14993-6faa-47fd-a066-d827ab143d9b","source":"wordfence","cve":"CVE-2025-39544","title":"WP Tools <= 5.18 - Cross-Site Request Forgery to Arbitrary File Renaming","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a14993-6faa-47fd-a066-d827ab143d9b?source=api-prod","affected":[{"type":"plugin","slug":"wptools","name":"WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log","from":"*","from_inclusive":true,"to":"5.18","to_inclusive":true,"patched_in":"5.19"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:02:37Z"},{"id":"wordfence:c8a27ec5-019b-4aa5-8317-1c832af3b7ca","source":"wordfence","cve":"CVE-2024-29796","title":"Hot Random Image <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a27ec5-019b-4aa5-8317-1c832af3b7ca?source=api-prod","affected":[{"type":"plugin","slug":"hot-random-image","name":"Hot Random Image","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:00:46Z"},{"id":"wordfence:c8a29088-0c98-4a79-a4bf-025bcf89782b","source":"wordfence","cve":"CVE-2026-11565","title":"Advanced File Manager <= 5.4.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a29088-0c98-4a79-a4bf-025bcf89782b?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.4.12","to_inclusive":true,"patched_in":"5.4.13"}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T19:49:14Z"},{"id":"wordfence:c8a2e3ea-8da8-4e86-9720-3149ddb13bbe","source":"wordfence","cve":"CVE-2024-54389","title":"addWeather <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a2e3ea-8da8-4e86-9720-3149ddb13bbe?source=api-prod","affected":[{"type":"plugin","slug":"myweather","name":"addWeather","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:57:26Z"},{"id":"wordfence:c8a49064-ad48-410e-9b32-f94109830ccf","source":"wordfence","cve":"CVE-2022-4210","title":"Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via dnf","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a49064-ad48-410e-9b32-f94109830ccf?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.2.1"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8a4e9b8-9794-48b7-8c53-cfad37ed530c","source":"wordfence","cve":"CVE-2023-23664","title":"ConvertBox Auto Embed WordPress plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a4e9b8-9794-48b7-8c53-cfad37ed530c?source=api-prod","affected":[{"type":"plugin","slug":"convertbox-auto-embed","name":"ConvertBox Auto Embed WordPress plugin","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8a8be59-d4c1-4cce-b474-8d885b4d89c6","source":"wordfence","cve":"CVE-2013-1409","title":"CommentLuv < 2.92.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a8be59-d4c1-4cce-b474-8d885b4d89c6?source=api-prod","affected":[{"type":"plugin","slug":"commentluv","name":"CommentLuv","from":"*","from_inclusive":true,"to":"2.92.4","to_inclusive":false,"patched_in":"2.92.4"}],"published":"2013-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8a8def2-e47b-4f07-b744-a96b0034e7d2","source":"wordfence","cve":"CVE-2026-110378","title":"Ninja Forms Signature Contract Add-On <= 3.2.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a8def2-e47b-4f07-b744-a96b0034e7d2?source=api-prod","affected":[{"type":"plugin","slug":"ninja-signature-contract-forms-add-on","name":"Ninja Forms Signature Contract Add-On","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.5.1"}],"published":"2026-10-15T18:07:00Z","updated":"2026-10-23T18:19:58Z"},{"id":"wordfence:c8a93aab-4845-46ed-8adc-d06b2ee8ee9e","source":"wordfence","cve":"CVE-2024-3726","title":"Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8a93aab-4845-46ed-8adc-d06b2ee8ee9e?source=api-prod","affected":[{"type":"plugin","slug":"login-logout-register-menu","name":"Login Logout Register Menu","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-29T14:17:19Z","updated":"2024-05-30T02:35:09Z"},{"id":"wordfence:c8abcc7b-6c68-4fc8-81af-e88624e417dd","source":"wordfence","cve":"CVE-2024-12626","title":"AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value","severity":"critical","cvss":9.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8abcc7b-6c68-4fc8-81af-e88624e417dd?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.0.9","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2024-12-18T00:00:00Z","updated":"2024-12-19T11:14:16Z"},{"id":"wordfence:c8ae0a47-cba5-468e-8d25-7b7176373b9c","source":"wordfence","cve":"CVE-2024-3500","title":"ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8ae0a47-cba5-468e-8d25-7b7176373b9c?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-09-05T13:32:24Z"},{"id":"wordfence:c8af0c5c-3d7b-416d-9d10-6867fcf909a5","source":"wordfence","cve":"CVE-2024-9195","title":"WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8af0c5c-3d7b-416d-9d10-6867fcf909a5?source=api-prod","affected":[{"type":"plugin","slug":"WHMpress_Client_Area_Api","name":"WHMCS Client Area for WordPress by WHMpress","from":"*","from_inclusive":true,"to":"4.3-revision-3","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T08:23:18Z"},{"id":"wordfence:c8b1015f-6825-4813-b5db-71f1c1e88310","source":"wordfence","cve":"CVE-2022-45364","title":"Drag and Drop Multiple File Upload \u2013 Contact Form 7 <= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8b1015f-6825-4813-b5db-71f1c1e88310?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.6.5","to_inclusive":true,"patched_in":"1.3.6.6"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8b3d614-a943-488a-aeb3-c874e72d2733","source":"wordfence","cve":"CVE-2025-69004","title":"Bajaar - Highly Customizable WooCommerce WordPress <= 2.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8b3d614-a943-488a-aeb3-c874e72d2733?source=api-prod","affected":[{"type":"theme","slug":"bajaar","name":"bajaar","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T15:57:29Z"},{"id":"wordfence:c8b497b4-947c-4011-92c3-a3e265b80845","source":"wordfence","cve":"CVE-2026-22401","title":"Freshio <= 2.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8b497b4-947c-4011-92c3-a3e265b80845?source=api-prod","affected":[{"type":"theme","slug":"freshio","name":"Freshio - Organic & Food Store WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:23:30Z"},{"id":"wordfence:c8b80ad3-7a52-463b-abbd-544c4d5c6090","source":"wordfence","cve":"CVE-2025-32584","title":"Chat2 <= 4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8b80ad3-7a52-463b-abbd-544c4d5c6090?source=api-prod","affected":[{"type":"plugin","slug":"chat2","name":"Chat2","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-04-09T00:00:00Z","updated":"2025-07-08T15:18:24Z"},{"id":"wordfence:c8b87b01-e445-4372-b687-6e0b54de66d3","source":"wordfence","cve":"CVE-2025-24579","title":"Nested Pages <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8b87b01-e445-4372-b687-6e0b54de66d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:58:29Z"},{"id":"wordfence:c8bc1653-8fee-468a-bb6d-f24959846ee5","source":"wordfence","cve":"CVE-2024-2123","title":"Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bc1653-8fee-468a-bb6d-f24959846ee5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-13T09:35:14Z"},{"id":"wordfence:c8bd5021-4895-4b0e-b517-186959f76095","source":"wordfence","cve":"CVE-2024-8437","title":"WP Easy Gallery \u2013 WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd5021-4895-4b0e-b517-186959f76095?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T07:30:46Z"},{"id":"wordfence:c8bd778b-1d56-4544-b2c3-a77a7ec05aa4","source":"wordfence","cve":"CVE-2024-1807","title":"Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd778b-1d56-4544-b2c3-a77a7ec05aa4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-sort-and-display","name":"Product Sort and Display for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T09:32:09Z"},{"id":"wordfence:c8bd975a-38ac-4014-a4c5-d022e58afc54","source":"wordfence","cve":"CVE-2024-51880","title":"BeBetter Social Icons <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bd975a-38ac-4014-a4c5-d022e58afc54?source=api-prod","affected":[{"type":"plugin","slug":"bebetter-social-icons","name":"BeBetter Social Icons","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:45:03Z"},{"id":"wordfence:c8bfa7ae-9908-4f4b-8fb4-d68c97423ae7","source":"wordfence","cve":"CVE-2026-84819","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bfa7ae-9908-4f4b-8fb4-d68c97423ae7?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-15T20:40:15Z"},{"id":"wordfence:c8c530e2-ce42-40f3-82ab-1df9089a5407","source":"wordfence","cve":"CVE-2023-24408","title":"Ecwid Shopping Cart <= 6.11.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c530e2-ce42-40f3-82ab-1df9089a5407?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.11.4","to_inclusive":true,"patched_in":"6.11.5"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8c60701-37f0-4404-b965-9136ac456e38","source":"wordfence","cve":"CVE-2025-4608","title":"Structured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c60701-37f0-4404-b965-9136ac456e38?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-07-23T20:37:40Z","updated":"2025-11-05T21:37:17Z"},{"id":"wordfence:c8c69fc2-e1bf-43e7-a80e-931dbb70d8da","source":"wordfence","cve":"CVE-2022-2913","title":"Login No Captcha reCAPTCHA <= 1.6.11 - CAPTCHA Bypass via Whitelisted IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c69fc2-e1bf-43e7-a80e-931dbb70d8da?source=api-prod","affected":[{"type":"plugin","slug":"login-recaptcha","name":"Login No Captcha reCAPTCHA","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.7"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8c89eea-f6b0-4771-ab7d-05e266324d58","source":"wordfence","cve":"CVE-2024-5033","title":"SULly <= 4.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c89eea-f6b0-4771-ab7d-05e266324d58?source=api-prod","affected":[{"type":"plugin","slug":"sully","name":"SULly","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:20:15Z"},{"id":"wordfence:c8c8f6d4-817b-4ff7-8362-5d699237d6ce","source":"wordfence","cve":"CVE-2025-32646","title":"Question Answer <= 1.2.70 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c8f6d4-817b-4ff7-8362-5d699237d6ce?source=api-prod","affected":[{"type":"plugin","slug":"question-answer","name":"PickPlugins Question Answer","from":"*","from_inclusive":true,"to":"1.2.70","to_inclusive":true,"patched_in":"1.2.71"}],"published":"2025-04-10T00:00:00Z","updated":"2026-01-13T17:01:16Z"},{"id":"wordfence:c8c95e9a-9d4d-4a94-bd71-d5d53085df90","source":"wordfence","cve":"CVE-2025-30819","title":"Simple Giveaways <= 2.48.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8c95e9a-9d4d-4a94-bd71-d5d53085df90?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.48.1","to_inclusive":true,"patched_in":"2.48.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:18:22Z"},{"id":"wordfence:c8cef103-8b8d-4e9b-9cd2-6e998dcb68dd","source":"wordfence","cve":"","title":"Page Link Manager <= 1.0b - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8cef103-8b8d-4e9b-9cd2-6e998dcb68dd?source=api-prod","affected":[{"type":"plugin","slug":"page-link-manager","name":"Page Link Manager","from":"*","from_inclusive":true,"to":"1.0b","to_inclusive":true,"patched_in":""}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8d06b5d-43b8-4dae-abe9-abe07a63528e","source":"wordfence","cve":"CVE-2023-0419","title":"Shortcode for Font Awesome <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d06b5d-43b8-4dae-abe9-abe07a63528e?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-for-font-awesome","name":"Shortcode for Font Awesome","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8d19086-53db-49f3-bc29-88ef869cc18b","source":"wordfence","cve":"CVE-2026-111978","title":"GiveWP <= 4.19.0.0 - Authenticated (Give Manager+) Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d19086-53db-49f3-bc29-88ef869cc18b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.0.0","to_inclusive":true,"patched_in":"4.19.0.1"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T15:05:33Z"},{"id":"wordfence:c8d286db-b2a7-46c4-825f-dc67dda8a63d","source":"wordfence","cve":"CVE-2025-15147","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d286db-b2a7-46c4-825f-dc67dda8a63d?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.11.8","to_inclusive":true,"patched_in":"2.11.9"}],"published":"2026-02-09T11:17:32Z","updated":"2026-02-09T23:23:28Z"},{"id":"wordfence:c8d67db1-4ffd-41f7-8c3f-057e3a183c32","source":"wordfence","cve":"CVE-2026-81797","title":"Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d67db1-4ffd-41f7-8c3f-057e3a183c32?source=api-prod","affected":[{"type":"theme","slug":"buzzstone","name":"Buzz Stone | Magazine & Viral Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:45:00Z","updated":"2026-10-13T14:09:38Z"},{"id":"wordfence:c8d7448a-b8a6-4b0b-92df-a15272fc56bf","source":"wordfence","cve":"CVE-2024-2117","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d7448a-b8a6-4b0b-92df-a15272fc56bf?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.20.2","to_inclusive":true,"patched_in":"3.20.3"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-09T18:59:21Z"},{"id":"wordfence:c8d87951-4c9b-45b8-be73-17c7b9bdbcd9","source":"wordfence","cve":"CVE-2025-25160","title":"Style Tweaker <= 0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d87951-4c9b-45b8-be73-17c7b9bdbcd9?source=api-prod","affected":[{"type":"plugin","slug":"style-tweaker","name":"Style Tweaker","from":"*","from_inclusive":true,"to":"0.11","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:34:31Z"},{"id":"wordfence:c8d9a104-ebfe-48e8-9a5b-4cbf3da226a1","source":"wordfence","cve":"CVE-2026-41563","title":"Sitemovr <= 1.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d9a104-ebfe-48e8-9a5b-4cbf3da226a1?source=api-prod","affected":[{"type":"plugin","slug":"sitemovr","name":"Sitemovr","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:28:41Z","updated":"2026-10-08T23:33:58Z"},{"id":"wordfence:c8d9d19e-a080-40e9-8a71-01888393f618","source":"wordfence","cve":"CVE-2023-49156","title":"GoDaddy Email Marketing <= 1.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d9d19e-a080-40e9-8a71-01888393f618?source=api-prod","affected":[{"type":"plugin","slug":"godaddy-email-marketing-sign-up-forms","name":"GoDaddy Email Marketing","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8db0c54-0a68-41bc-832f-1e0e1a92d167","source":"wordfence","cve":"CVE-2024-4602","title":"Embed Peertube Playlist <= 1.07 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8db0c54-0a68-41bc-832f-1e0e1a92d167?source=api-prod","affected":[{"type":"plugin","slug":"embed-peertube-playlist","name":"Embed Peertube Playlist","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":"1.10"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:30:11Z"},{"id":"wordfence:c8db80ef-5863-41dd-b33f-850984a72ee6","source":"wordfence","cve":"CVE-2024-5073","title":"Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8db80ef-5863-41dd-b33f-850984a72ee6?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.21","to_inclusive":true,"patched_in":"5.9.22"}],"published":"2024-05-29T18:31:01Z","updated":"2024-05-30T06:48:09Z"},{"id":"wordfence:c8dc9fd0-929e-447f-be05-085be98e4d0f","source":"wordfence","cve":"CVE-2015-9455","title":"BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8dc9fd0-929e-447f-be05-085be98e4d0f?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-activity-plus","name":"BuddyPress Activity Plus","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2015-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8de9ce3-c96a-4fe5-a1f9-8019ca13cc11","source":"wordfence","cve":"CVE-2026-52705","title":"Sigma Forms Pro <= 1.4.5 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8de9ce3-c96a-4fe5-a1f9-8019ca13cc11?source=api-prod","affected":[{"type":"plugin","slug":"sigmaforms-pro","name":"SigmaForms Pro \u2013 AI Generated Forms","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-25T17:50:48Z"},{"id":"wordfence:c8dfc1de-e17d-45c0-aab7-351150c07545","source":"wordfence","cve":"CVE-2024-43962","title":"LWS Affiliation <= 2.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8dfc1de-e17d-45c0-aab7-351150c07545?source=api-prod","affected":[{"type":"plugin","slug":"lws-affiliation","name":"LWS Affiliation","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-23T21:13:19Z"},{"id":"wordfence:c8e1bc48-98ff-48f0-b3b3-4032dc3ac3f1","source":"wordfence","cve":"CVE-2025-62752","title":"Calendar.online / Kalender.digital <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e1bc48-98ff-48f0-b3b3-4032dc3ac3f1?source=api-prod","affected":[{"type":"plugin","slug":"kalender-digital","name":"Calendar.online / Kalender.digital \u2013 Plugin","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-10T20:42:32Z"},{"id":"wordfence:c8e231a9-4527-41b1-adf6-4eab6bf39801","source":"wordfence","cve":"CVE-2025-15659","title":"Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e231a9-4527-41b1-adf6-4eab6bf39801?source=api-prod","affected":[{"type":"plugin","slug":"elizaibot-chatbots","name":"Elizaibots","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2026-07-10T19:03:42Z"},{"id":"wordfence:c8e56c2c-b559-493f-bafa-501c5948d806","source":"wordfence","cve":"CVE-2026-32446","title":"Contact Form by WPForms <= 1.9.9.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e56c2c-b559-493f-bafa-501c5948d806?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.9.3","to_inclusive":true,"patched_in":"1.9.9.4"}],"published":"2026-03-07T00:00:00Z","updated":"2026-04-15T21:21:23Z"},{"id":"wordfence:c8e634ef-b496-40cd-ab20-32f68c0be7ee","source":"wordfence","cve":"CVE-2024-49688","title":"ARPrice <= 4.1.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e634ef-b496-40cd-ab20-32f68c0be7ee?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-03T00:00:00Z","updated":"2026-02-26T15:03:30Z"},{"id":"wordfence:c8e768a4-09ac-4772-9e5d-b9f63bac208c","source":"wordfence","cve":"CVE-2018-5293","title":"GD Rating System <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e768a4-09ac-4772-9e5d-b9f63bac208c?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8e90994-3b5c-4ae6-a27f-890a9101b440","source":"wordfence","cve":"CVE-2023-1920","title":"WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e90994-3b5c-4ae6-a27f-890a9101b440?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb","source":"wordfence","cve":"CVE-2023-6242","title":"EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:37:24Z"},{"id":"wordfence:c8ebbf22-9bce-4d82-aecf-82080386e7e2","source":"wordfence","cve":"CVE-2024-2869","title":"Easy Property Listings <= 3.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8ebbf22-9bce-4d82-aecf-82080386e7e2?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2024-10-29T00:00:00Z","updated":"2025-05-29T22:02:22Z"},{"id":"wordfence:c8edba5b-9bce-4a93-86a6-bb6dcb30fa60","source":"wordfence","cve":"CVE-2023-6978","title":"WP Job Manager \u2013 Company Profiles <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8edba5b-9bce-4a93-86a6-bb6dcb30fa60?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager-companies","name":"WP Job Manager \u2013 Company Profiles","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T07:32:27Z"},{"id":"wordfence:c8eebc67-e590-4d7f-8925-e5e5090cedf0","source":"wordfence","cve":"CVE-2024-3604","title":"OSM \u2013 OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eebc67-e590-4d7f-8925-e5e5090cedf0?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-07-08T20:10:52Z","updated":"2024-09-27T14:16:54Z"},{"id":"wordfence:c8f008c6-42c6-40c3-9058-d8812ec40bef","source":"wordfence","cve":"CVE-2023-23491","title":"Quick Event Manager <= 9.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f008c6-42c6-40c3-9058-d8812ec40bef?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.7.5","to_inclusive":false,"patched_in":"9.7.5"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8f0456d-078e-4962-98a3-d1451b01b75f","source":"wordfence","cve":"CVE-2026-39513","title":"Easy Appointments <= 3.12.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f0456d-078e-4962-98a3-d1451b01b75f?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.21","to_inclusive":true,"patched_in":"3.12.22"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T14:51:35Z"},{"id":"wordfence:c8f27900-3142-40d3-9df3-b3435adb728d","source":"wordfence","cve":"CVE-2026-81772","title":"Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f27900-3142-40d3-9df3-b3435adb728d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-style","name":"Ninja Forms - Layout & Styles","from":"*","from_inclusive":true,"to":"3.0.31","to_inclusive":true,"patched_in":"3.0.32"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T14:01:19Z"},{"id":"wordfence:c8f3c96b-9a78-47cb-9266-ff87d9409160","source":"wordfence","cve":"CVE-2026-11421","title":"ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f3c96b-9a78-47cb-9266-ff87d9409160?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.17.4","to_inclusive":true,"patched_in":"1.17.5"}],"published":"2026-08-04T16:17:42Z","updated":"2026-08-05T04:25:26Z"},{"id":"wordfence:c8f42f17-bce2-421e-9031-bfa0f8c26b2a","source":"wordfence","cve":"CVE-2026-1648","title":"Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f42f17-bce2-421e-9031-bfa0f8c26b2a?source=api-prod","affected":[{"type":"plugin","slug":"performance-monitor","name":"Performance Monitor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:10:03Z","updated":"2026-04-09T16:07:48Z"},{"id":"wordfence:c8f45054-e6a4-403b-94eb-2dd2a4840c22","source":"wordfence","cve":"CVE-2026-15726","title":"Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f45054-e6a4-403b-94eb-2dd2a4840c22?source=api-prod","affected":[{"type":"plugin","slug":"cryout-serious-slider","name":"Serious Slider","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-08-15T16:22:52Z","updated":"2026-08-16T04:24:56Z"},{"id":"wordfence:c8f506ef-972c-403d-9167-ffdd93be8ea6","source":"wordfence","cve":"CVE-2026-2504","title":"Dealia \u2013 Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=api-prod","affected":[{"type":"plugin","slug":"dealia-request-a-quote","name":"Dealia \u2013 Request a quote","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-02-18T15:54:50Z","updated":"2026-02-25T15:47:02Z"},{"id":"wordfence:c8faa8bb-0ebe-4671-87cf-98edbebe913e","source":"wordfence","cve":"CVE-2021-34657","title":"TypoFR <= 0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8faa8bb-0ebe-4671-87cf-98edbebe913e?source=api-prod","affected":[{"type":"plugin","slug":"typofr","name":"typofr","from":"*","from_inclusive":true,"to":"0.11","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c8fb459b-39c1-4bbe-b176-93b25822be2e","source":"wordfence","cve":"CVE-2025-26954","title":"ZooEffect <= 1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8fb459b-39c1-4bbe-b176-93b25822be2e?source=api-prod","affected":[{"type":"plugin","slug":"1-jquery-photo-gallery-slideshow-flash","name":"ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast \u2013 HTML5","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:03:01Z"},{"id":"wordfence:c8fe4c70-c196-4f20-b787-bea223726fab","source":"wordfence","cve":"CVE-2026-57722","title":"Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8fe4c70-c196-4f20-b787-bea223726fab?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:58:17Z"},{"id":"wordfence:c8fe569a-62dd-4be5-915d-de589663658f","source":"wordfence","cve":"CVE-2022-2912","title":"Craw Data <= 1.0.0 - Server Side Request Forgery","severity":"high","cvss":7.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c8fe569a-62dd-4be5-915d-de589663658f?source=api-prod","affected":[{"type":"plugin","slug":"craw-data","name":"Craw Data","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c900e013-2f33-47df-9ee3-eb177db72511","source":"wordfence","cve":"CVE-2025-49986","title":"Video List Manager <= 1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c900e013-2f33-47df-9ee3-eb177db72511?source=api-prod","affected":[{"type":"plugin","slug":"video-list-manager","name":"Video List Manager","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:12:07Z"},{"id":"wordfence:c901f85d-fcdb-43e5-8626-f2410e4e328f","source":"wordfence","cve":"CVE-2022-3394","title":"WP ALL Export Pro <= 1.7.8 - Authenticated Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c901f85d-fcdb-43e5-8626-f2410e4e328f?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9032d18-203b-42d5-93d3-2d18c49a00e1","source":"wordfence","cve":"CVE-2026-116389","title":"Phoenix Media Rename <= 3.13.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9032d18-203b-42d5-93d3-2d18c49a00e1?source=api-prod","affected":[{"type":"plugin","slug":"phoenix-media-rename","name":"Phoenix Media Rename","from":"*","from_inclusive":true,"to":"3.13.5","to_inclusive":true,"patched_in":"3.13.6"}],"published":"2026-10-26T13:02:44Z","updated":"2026-11-03T19:29:39Z"},{"id":"wordfence:c904391e-efa1-4fba-b6a5-b9b38822e194","source":"wordfence","cve":"CVE-2024-7692","title":"Flaming Forms <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c904391e-efa1-4fba-b6a5-b9b38822e194?source=api-prod","affected":[{"type":"plugin","slug":"flaming-forms","name":"Flaming Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-15T18:05:21Z"},{"id":"wordfence:c906a988-ad45-49cc-9d77-6b501445ddc5","source":"wordfence","cve":"","title":"Gallery for Social Photo <= 1.0.0.25 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c906a988-ad45-49cc-9d77-6b501445ddc5?source=api-prod","affected":[{"type":"plugin","slug":"feed-instagram-lite","name":"Gallery for Social Photo","from":"*","from_inclusive":true,"to":"1.0.0.25","to_inclusive":true,"patched_in":"1.0.0.27"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c90844e1-0502-4d08-888f-4835f63f8dd0","source":"wordfence","cve":"CVE-2021-20083","title":"WordPress Core < 5.9.1 - jQuery Prototype Pollution","severity":"high","cvss":8.8,"cwe":"CWE-915","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c90844e1-0502-4d08-888f-4835f63f8dd0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.37","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.37","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.35","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.34","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.34","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.31","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.27","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.26","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.25","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.22","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.22","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.18","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.19","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.15","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.12","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.14","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.11","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.9","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"3.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"3.7.38"}],"published":"2022-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c90dadc9-0109-4ebd-8135-3efd26682ad9","source":"wordfence","cve":"CVE-2024-12394","title":"Action Network <= 1.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c90dadc9-0109-4ebd-8135-3efd26682ad9?source=api-prod","affected":[{"type":"plugin","slug":"wp-action-network","name":"Organizers Embed \u2013 Action Network for WordPress","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-01-08T22:09:53Z","updated":"2025-11-07T16:53:41Z"},{"id":"wordfence:c90f9935-0cdf-4699-bf1c-89e287d8ede0","source":"wordfence","cve":"CVE-2025-58625","title":"WP Flow Plus <= 5.2.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c90f9935-0cdf-4699-bf1c-89e287d8ede0?source=api-prod","affected":[{"type":"plugin","slug":"wp-imageflow2","name":"WP Flow Plus","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T13:32:17Z"},{"id":"wordfence:c90fc17b-f355-4067-928f-031734a572f3","source":"wordfence","cve":"CVE-2025-22304","title":"WP Visitor Statistics (Real Time Traffic) <= 7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c90fc17b-f355-4067-928f-031734a572f3?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-03T14:55:53Z"},{"id":"wordfence:c9141ad3-86cf-47ae-be99-d78f0337f2ca","source":"wordfence","cve":"","title":"WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9141ad3-86cf-47ae-be99-d78f0337f2ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2024-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c915b30b-a15d-4ac7-abb6-f6d81a6e2ee7","source":"wordfence","cve":"CVE-2025-68858","title":"wpCAS <= 1.07 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c915b30b-a15d-4ac7-abb6-f6d81a6e2ee7?source=api-prod","affected":[{"type":"plugin","slug":"wpcas","name":"wpCAS","from":"*","from_inclusive":true,"to":"1.07","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:19:39Z"},{"id":"wordfence:c9160eb6-959e-4181-96ec-8e26beb0b239","source":"wordfence","cve":"CVE-2026-42760","title":"Backup and Staging by WP Time Capsule <= 1.22.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9160eb6-959e-4181-96ec-8e26beb0b239?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.25","to_inclusive":true,"patched_in":"1.22.26"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-11T14:06:09Z"},{"id":"wordfence:c9176a81-fe51-48dd-a151-4596443b430f","source":"wordfence","cve":"CVE-2022-3244","title":"WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9176a81-fe51-48dd-a151-4596443b430f?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c91a14d3-bc41-4490-888c-486ad2994095","source":"wordfence","cve":"CVE-2026-4803","title":"Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c91a14d3-bc41-4490-888c-486ad2994095?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-05-04T14:32:14Z","updated":"2026-05-05T03:37:38Z"},{"id":"wordfence:c91a4d4d-5bfa-42fd-80b4-7a75ee79db19","source":"wordfence","cve":"CVE-2025-14941","title":"GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c91a4d4d-5bfa-42fd-80b4-7a75ee79db19?source=api-prod","affected":[{"type":"plugin","slug":"gzseo","name":"GZSEO","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-01-23T19:25:57Z","updated":"2026-02-24T19:15:08Z"},{"id":"wordfence:c91d1ec0-0430-4ddd-b6b1-25af0b5cea9d","source":"wordfence","cve":"CVE-2024-10606","title":"WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c91d1ec0-0430-4ddd-b6b1-25af0b5cea9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:24Z"},{"id":"wordfence:c91f1e35-88ad-46e9-8d30-d4bddde92975","source":"wordfence","cve":"CVE-2025-52764","title":"flexoslider <= 1.0004 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c91f1e35-88ad-46e9-8d30-d4bddde92975?source=api-prod","affected":[{"type":"plugin","slug":"flexoslider","name":"flexoslider","from":"*","from_inclusive":true,"to":"1.0004","to_inclusive":true,"patched_in":""}],"published":"2025-06-14T00:00:00Z","updated":"2025-11-11T17:12:29Z"},{"id":"wordfence:c9205896-487d-4b8f-84cf-7ba16e1205e3","source":"wordfence","cve":"CVE-2024-7425","title":"WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update","severity":"medium","cvss":6.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9205896-487d-4b8f-84cf-7ba16e1205e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-02-07T03:24:40Z","updated":"2025-02-07T16:21:20Z"},{"id":"wordfence:c921d8fd-07f6-4d17-89b7-0e8e3dc1e2f8","source":"wordfence","cve":"CVE-2025-22593","title":"Laika Pedigree Tree <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c921d8fd-07f6-4d17-89b7-0e8e3dc1e2f8?source=api-prod","affected":[{"type":"plugin","slug":"laika-pedigree-tree","name":"Laika Pedigree Tree","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:20:35Z"},{"id":"wordfence:c9221f21-9a0c-4ee0-962b-e185b4d9df1a","source":"wordfence","cve":"CVE-2025-59555","title":"Medizin < 1.9.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9221f21-9a0c-4ee0-962b-e185b4d9df1a?source=api-prod","affected":[{"type":"theme","slug":"medizin","name":"Medizin - Medical WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":false,"patched_in":"1.9.7"}],"published":"2025-07-10T00:00:00Z","updated":"2025-11-04T18:09:10Z"},{"id":"wordfence:c923d1d6-04c6-4ea2-a69e-041fea1e280a","source":"wordfence","cve":"CVE-2024-10233","title":"SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c923d1d6-04c6-4ea2-a69e-041fea1e280a?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2024-10-28T22:36:10Z","updated":"2024-10-29T11:01:35Z"},{"id":"wordfence:c923e7ca-355c-4007-9fa3-3ca27055d0f3","source":"wordfence","cve":"CVE-2026-24365","title":"Stock Manager for WooCommerce < 3.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c923e7ca-355c-4007-9fa3-3ca27055d0f3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-stock-manager","name":"Stock Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"}],"published":"2026-01-09T00:00:00Z","updated":"2026-02-03T20:53:50Z"},{"id":"wordfence:c924b317-97ec-43b8-9bf3-ed7618743de7","source":"wordfence","cve":"CVE-2024-11806","title":"PKT1 Centro de envios <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c924b317-97ec-43b8-9bf3-ed7618743de7?source=api-prod","affected":[{"type":"plugin","slug":"pkt1-centro-de-envios","name":"PKT1 Centro de envios","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-30T22:31:49Z"},{"id":"wordfence:c927455d-5e20-4c8c-a1cd-455c8166335c","source":"wordfence","cve":"CVE-2026-16293","title":"Blubrry PowerPress <= 11.16.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c927455d-5e20-4c8c-a1cd-455c8166335c?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.16.10","to_inclusive":true,"patched_in":"11.16.11"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:40:19Z"},{"id":"wordfence:c9276757-1f73-44bf-9640-ea749ede5f16","source":"wordfence","cve":"CVE-2025-22699","title":"Traveler Code <= 3.1.1 - Unauthenticated Arbitrary SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9276757-1f73-44bf-9640-ea749ede5f16?source=api-prod","affected":[{"type":"plugin","slug":"traveler-code","name":"Traveler Code","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-03-05T14:22:53Z"},{"id":"wordfence:c92776c4-643c-40f2-ac28-5df5d6bf7fcd","source":"wordfence","cve":"CVE-2024-13910","title":"Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c92776c4-643c-40f2-ac28-5df5d6bf7fcd?source=api-prod","affected":[{"type":"plugin","slug":"database-backup","name":"Database Backup and Table Integrity Check with Automated Scheduling","from":"*","from_inclusive":true,"to":"2.36","to_inclusive":true,"patched_in":"2.37"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T08:23:22Z"},{"id":"wordfence:c9279c42-2a59-4228-983a-332179f8d845","source":"wordfence","cve":"CVE-2026-57803","title":"Struktur Core <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9279c42-2a59-4228-983a-332179f8d845?source=api-prod","affected":[{"type":"plugin","slug":"struktur-core","name":"Struktur Core","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:53:00Z"},{"id":"wordfence:c9291a17-7add-4cc2-ab44-9b640940c6b7","source":"wordfence","cve":"CVE-2014-4566","title":"verwei.se \u2013 WordPress \u2013 Twitter <= 1.0 2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9291a17-7add-4cc2-ab44-9b640940c6b7?source=api-prod","affected":[{"type":"plugin","slug":"verweise-wordpress-twitter","name":"verwei.se \u2013 WordPress \u2013 Twitter","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9295b82-27c1-4f35-b40c-1ac40ebe5d5e","source":"wordfence","cve":"CVE-2024-3681","title":"Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9295b82-27c1-4f35-b40c-1ac40ebe5d5e?source=api-prod","affected":[{"type":"plugin","slug":"interactive-world-maps","name":"Interactive World Maps","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:57:17Z"},{"id":"wordfence:c929a742-6481-40a0-94b5-76ddb8494896","source":"wordfence","cve":"CVE-2022-3907","title":"Clerk <= 3.8.2 -  Authorization Bypass via Insufficient Validation","severity":"medium","cvss":5.6,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c929a742-6481-40a0-94b5-76ddb8494896?source=api-prod","affected":[{"type":"plugin","slug":"clerkio","name":"Clerk","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c92e15a8-6b0c-43bf-813d-b2484cb9ef8e","source":"wordfence","cve":"CVE-2024-13569","title":"Front End Users <= 3.2.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c92e15a8-6b0c-43bf-813d-b2484cb9ef8e?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.32","to_inclusive":true,"patched_in":"3.2.33"}],"published":"2025-04-01T00:00:00Z","updated":"2025-11-05T21:23:10Z"},{"id":"wordfence:c92e166d-2ede-4280-a875-d30c0cf6f467","source":"wordfence","cve":"CVE-2023-30785","title":"Video Grid <= 1.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c92e166d-2ede-4280-a875-d30c0cf6f467?source=api-prod","affected":[{"type":"plugin","slug":"video-grid","name":"Video Grid","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c930c240-df79-47d0-866c-de40c219ce25","source":"wordfence","cve":"CVE-2025-49443","title":"Bacon Ipsum <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c930c240-df79-47d0-866c-de40c219ce25?source=api-prod","affected":[{"type":"plugin","slug":"bacon-ipsum","name":"Bacon Ipsum","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:39:45Z"},{"id":"wordfence:c9314970-1030-4488-8147-05ba1453182c","source":"wordfence","cve":"CVE-2024-11783","title":"Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9314970-1030-4488-8147-05ba1453182c?source=api-prod","affected":[{"type":"plugin","slug":"finance-calculator-with-application-form","name":"Financial Calculator","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:03:12Z","updated":"2024-12-20T06:59:10Z"},{"id":"wordfence:c9364785-1174-46d1-8671-001b755361a6","source":"wordfence","cve":"CVE-2025-9895","title":"Notification Bar <= 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9364785-1174-46d1-8671-001b755361a6?source=api-prod","affected":[{"type":"plugin","slug":"simple-bar","name":"Notification Bar","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:34:16Z","updated":"2025-10-03T11:17:20Z"},{"id":"wordfence:c9381244-5ab9-4927-8e18-d6030a399d7c","source":"wordfence","cve":"CVE-2024-30526","title":"Easy Social Feed <= 6.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9381244-5ab9-4927-8e18-d6030a399d7c?source=api-prod","affected":[{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2024-03-29T00:00:00Z","updated":"2024-06-07T12:50:18Z"},{"id":"wordfence:c940719c-f233-41bb-8866-2487ba0719e2","source":"wordfence","cve":"CVE-2025-69055","title":"BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c940719c-f233-41bb-8866-2487ba0719e2?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.16.3.3","to_inclusive":false,"patched_in":"3.16.3.3"}],"published":"2025-12-31T00:00:00Z","updated":"2026-02-25T14:40:22Z"},{"id":"wordfence:c942fd74-7a2d-43ec-9806-cdfe21a83149","source":"wordfence","cve":"CVE-2015-9385","title":"Quotes and Tips by BestWebSoft < 1.20 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c942fd74-7a2d-43ec-9806-cdfe21a83149?source=api-prod","affected":[{"type":"plugin","slug":"quotes-and-tips","name":"Quotes and Tips by BestWebSoft","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":false,"patched_in":"1.20"}],"published":"2015-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9438574-11ce-4535-ae64-89b42517c6c2","source":"wordfence","cve":"CVE-2025-15662","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9438574-11ce-4535-ae64-89b42517c6c2?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T21:38:01Z"},{"id":"wordfence:c943cf0b-0e99-4d47-808d-2b803369d53a","source":"wordfence","cve":"CVE-2023-5465","title":"Popup with fancybox <= 3.5 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c943cf0b-0e99-4d47-808d-2b803369d53a?source=api-prod","affected":[{"type":"plugin","slug":"popup-with-fancybox","name":"Popup with fancybox","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9443e36-648c-4984-8b06-28e9da959e26","source":"wordfence","cve":"CVE-2025-1783","title":"Gallery Styles <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9443e36-648c-4984-8b06-28e9da959e26?source=api-prod","affected":[{"type":"plugin","slug":"gallery-styles","name":"Gallery Styles \u2013 Sort & Style the Gallery Block (Exif, Hover, Duotone)","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T09:22:55Z"},{"id":"wordfence:c9466e5f-d8eb-4de4-a1d2-e5ef15bf1e4e","source":"wordfence","cve":"CVE-2024-2839","title":"Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9466e5f-d8eb-4de4-a1d2-e5ef15bf1e4e?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.263","to_inclusive":true,"patched_in":"1.0.270"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T06:47:45Z"},{"id":"wordfence:c94c2b2a-03c8-4ffe-83f9-2142385a0363","source":"wordfence","cve":"CVE-2026-27355","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.66 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c94c2b2a-03c8-4ffe-83f9-2142385a0363?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.66","to_inclusive":true,"patched_in":"3.1.67"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:48:39Z"},{"id":"wordfence:c94c3e75-2489-4d1e-afde-4a87b34ce155","source":"wordfence","cve":"CVE-2026-115951","title":"Lazy Load for Videos <= 2.18.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c94c3e75-2489-4d1e-afde-4a87b34ce155?source=api-prod","affected":[{"type":"plugin","slug":"lazy-load-for-videos","name":"Lazy Load for Videos","from":"*","from_inclusive":true,"to":"2.18.11","to_inclusive":true,"patched_in":"2.18.12"}],"published":"2026-10-26T10:26:00Z","updated":"2026-10-28T01:24:44Z"},{"id":"wordfence:c94e321e-69d9-40c5-8242-8d090ba604d1","source":"wordfence","cve":"CVE-2024-52387","title":"Master Addons for Elementor <= 2.0.9.9.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c94e321e-69d9-40c5-8242-8d090ba604d1?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.9.9.4","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-11-11T00:00:00Z","updated":"2026-01-27T20:40:53Z"},{"id":"wordfence:c950ac0a-80fb-4f95-ba20-afb8ba6b137f","source":"wordfence","cve":"CVE-2022-38075","title":"Mantenimiento web <= 0.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c950ac0a-80fb-4f95-ba20-afb8ba6b137f?source=api-prod","affected":[{"type":"plugin","slug":"mantenimiento-web","name":"Mantenimiento web","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":"0.9"}],"published":"2022-10-31T15:54:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c95210ba-65f6-4bf8-8986-f537f1854d02","source":"wordfence","cve":"CVE-2021-24378","title":"Autoptimize <= 2.7.7 - Unsafe File Upload to Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c95210ba-65f6-4bf8-8986-f537f1854d02?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2020-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c95505e3-6851-476e-af40-bb841eb01be7","source":"wordfence","cve":"CVE-2019-17669","title":"WordPress Core < 5.2.4 - Server Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c95505e3-6851-476e-af40-bb841eb01be7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c956e4c5-bf7e-4ec4-b795-74d477a61694","source":"wordfence","cve":"CVE-2026-8419","title":"Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c956e4c5-bf7e-4ec4-b795-74d477a61694?source=api-prod","affected":[{"type":"plugin","slug":"amazon-scraper","name":"Amazon Scraper","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:06:40Z","updated":"2026-05-20T01:25:53Z"},{"id":"wordfence:c956f1d0-f3fc-4da2-b6d8-3a294a033f3c","source":"wordfence","cve":"CVE-2026-116750","title":"VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c956f1d0-f3fc-4da2-b6d8-3a294a033f3c?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2026-10-27T18:04:51Z","updated":"2026-10-28T06:45:19Z"},{"id":"wordfence:c9586c39-3018-449f-8e03-3c5920438092","source":"wordfence","cve":"CVE-2026-18051","title":"W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9586c39-3018-449f-8e03-3c5920438092?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":false,"patched_in":"2.10.5"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:15:05Z"},{"id":"wordfence:c958880e-6068-4e7d-a780-1251f3ab9bf7","source":"wordfence","cve":"CVE-2026-1566","title":"LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-03-02T11:03:51Z","updated":"2026-03-02T23:22:55Z"},{"id":"wordfence:c959d881-b00d-465c-bafa-988ffcf86995","source":"wordfence","cve":"CVE-2021-24359","title":"The Plus Addons for Elementor Page Builder <= 4.1.10 - Open Redirect","severity":"medium","cvss":5.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c959d881-b00d-465c-bafa-988ffcf86995?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"4.1.11","to_inclusive":false,"patched_in":"4.1.11"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c959fac5-d881-403d-85e0-edf4cb1be02e","source":"wordfence","cve":"CVE-2025-11127","title":"Mstoreapp Mobile <= 2.08 & <= 9.0.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c959fac5-d881-403d-85e0-edf4cb1be02e?source=api-prod","affected":[{"type":"plugin","slug":"woo-mstoreapp-mobile-app","name":"Mstore Mobile App","from":"*","from_inclusive":true,"to":"2.08","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mstoreapp-mobile-app","name":"Mstoreapp Mobile","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-24T21:06:17Z"},{"id":"wordfence:c95e5e27-58e5-42ea-841a-f49fdedc3796","source":"wordfence","cve":"CVE-2023-6786","title":"Payment Gateway for Telcell <= 2.0.3 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c95e5e27-58e5-42ea-841a-f49fdedc3796?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-for-telcell","name":"Payment Gateway for Telcell","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-02-27T00:00:00Z","updated":"2025-05-27T14:34:02Z"},{"id":"wordfence:c96175ef-03a5-43cb-adec-1b3c9fb8b1eb","source":"wordfence","cve":"CVE-2025-22633","title":"Give \u2013 Divi Donation Modules <= 2.0.0 - Sensitive Information Dislcosure","severity":"medium","cvss":5.8,"cwe":"CWE-538","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96175ef-03a5-43cb-adec-1b3c9fb8b1eb?source=api-prod","affected":[{"type":"plugin","slug":"give-donation-modules-for-divi","name":"Give \u2013 Divi Donation Modules","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-24T15:38:33Z"},{"id":"wordfence:c962553f-ad49-43da-a29c-eb0823a34247","source":"wordfence","cve":"CVE-2026-28077","title":"Vapester <= 1.1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c962553f-ad49-43da-a29c-eb0823a34247?source=api-prod","affected":[{"type":"theme","slug":"vapester","name":"Vapester | Cigarette Store & Vape Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:47:25Z"},{"id":"wordfence:c964c99b-f751-4e81-b6bf-f10a3b1106ba","source":"wordfence","cve":"CVE-2025-39358","title":"WP Posts Carousel <= 1.3.12 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c964c99b-f751-4e81-b6bf-f10a3b1106ba?source=api-prod","affected":[{"type":"plugin","slug":"wp-posts-carousel","name":"CCI Posts Carousel All In One","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-02T19:27:58Z"},{"id":"wordfence:c96507cf-3c2d-4516-92f5-d08384aa6b1a","source":"wordfence","cve":"","title":"WORDPRESS VIDEO GALLERY <= 2.8 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96507cf-3c2d-4516-92f5-d08384aa6b1a?source=api-prod","affected":[{"type":"plugin","slug":"contus-video-gallery","name":"WORDPRESS VIDEO GALLERY","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2015-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c967f087-89c4-4798-9758-fcbe25a44f4f","source":"wordfence","cve":"CVE-2026-12583","title":"Newsletters <= 4.14 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c967f087-89c4-4798-9758-fcbe25a44f4f?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.14","to_inclusive":true,"patched_in":"4.15"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-29T22:38:53Z"},{"id":"wordfence:c9686681-4e64-43f1-ba0a-56d10c8d1db9","source":"wordfence","cve":"CVE-2025-13314","title":"Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9686681-4e64-43f1-ba0a-56d10c8d1db9?source=api-prod","affected":[{"type":"plugin","slug":"filter-plus","name":"Filter Plus \u2013 WooCommerce Product Filter & AJAX Post Filter","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-12-11T15:04:59Z","updated":"2025-12-12T16:01:15Z"},{"id":"wordfence:c968ee80-fb33-484b-aac1-eb265f4229be","source":"wordfence","cve":"CVE-2025-63023","title":"Payment Gateway for PayPal on WooCommerce <= 9.0.53 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c968ee80-fb33-484b-aac1-eb265f4229be?source=api-prod","affected":[{"type":"plugin","slug":"woo-paypal-gateway","name":"Payment Gateway for PayPal on WooCommerce","from":"*","from_inclusive":true,"to":"9.0.53","to_inclusive":true,"patched_in":"9.0.54"}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-06T18:26:37Z"},{"id":"wordfence:c9694f9b-beaa-44c9-b577-aae4fd14936b","source":"wordfence","cve":"CVE-2026-28002","title":"Booktics  1.0.22 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9694f9b-beaa-44c9-b577-aae4fd14936b?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"1.0.22","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T22:02:04Z"},{"id":"wordfence:c96ab066-9973-4eeb-b256-af9096399679","source":"wordfence","cve":"CVE-2026-106647","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor 1.3.68 - 1.7.1069 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96ab066-9973-4eeb-b256-af9096399679?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.3.68","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:19:08Z"},{"id":"wordfence:c96b3d65-431b-447a-8dc5-8865d83a92b9","source":"wordfence","cve":"CVE-2022-47168","title":"Printful Integration for WooCommerce <= 2.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96b3d65-431b-447a-8dc5-8865d83a92b9?source=api-prod","affected":[{"type":"plugin","slug":"printful-shipping-for-woocommerce","name":"Printful Integration for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c96b9599-b1a5-4aa6-85fe-7af3f12d1776","source":"wordfence","cve":"CVE-2025-47437","title":"LiteSpeed Cache <= 7.0.1 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96b9599-b1a5-4aa6-85fe-7af3f12d1776?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:30:29Z"},{"id":"wordfence:c96decab-0943-43c6-b8f7-9fd2e3f3b45d","source":"wordfence","cve":"CVE-2025-46531","title":"WP AVCL Automation Helper (formerly WPFlyLeads) <= 3.4 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96decab-0943-43c6-b8f7-9fd2e3f3b45d?source=api-prod","affected":[{"type":"plugin","slug":"woozap","name":"WP AVCL Automation Helper (formerly WPFlyLeads)","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:52:16Z"},{"id":"wordfence:c96e5939-5b6d-4cf2-83eb-a7b94f032bcb","source":"wordfence","cve":"CVE-2024-11386","title":"GatorMail SmartForms <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c96e5939-5b6d-4cf2-83eb-a7b94f032bcb?source=api-prod","affected":[{"type":"plugin","slug":"gatormail-smart-forms","name":"GatorMail SmartForms","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-10T19:03:56Z","updated":"2025-02-14T22:42:12Z"},{"id":"wordfence:c971731f-7fa1-4ea1-b3b3-3a991f575023","source":"wordfence","cve":"CVE-2026-91015","title":"Master Addons for Elementor <= 3.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c971731f-7fa1-4ea1-b3b3-3a991f575023?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:04Z"},{"id":"wordfence:c974726e-9371-40e5-8664-c12c8c06e5b9","source":"wordfence","cve":"CVE-2024-12474","title":"GeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c974726e-9371-40e5-8664-c12c8c06e5b9?source=api-prod","affected":[{"type":"plugin","slug":"geodatasource-country-region-dropdown","name":"GeoDataSource Country Region DropDown","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:15Z"},{"id":"wordfence:c978a252-1f77-4c8d-b51a-04ed3493ee34","source":"wordfence","cve":"","title":"Dynamic Font Replacement DFR4WP EN  <= 1.3 EN - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c978a252-1f77-4c8d-b51a-04ed3493ee34?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-font-replacement-4wp","name":"Dynamic Font Replacement DFR4WP EN","from":"*","from_inclusive":true,"to":"1.3 EN","to_inclusive":true,"patched_in":""}],"published":"2013-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9799ebf-1810-4c34-8262-2559de61c1c8","source":"wordfence","cve":"CVE-2020-15537","title":"Vanguard - Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9799ebf-1810-4c34-8262-2559de61c1c8?source=api-prod","affected":[{"type":"plugin","slug":"vanguard","name":"Vanguard - Marketplace Digital Products PHP7","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c97a341c-23f5-49a9-ad05-1fb387047e3b","source":"wordfence","cve":"CVE-2025-12958","title":"Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation","severity":"low","cvss":2.7,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97a341c-23f5-49a9-ad05-1fb387047e3b?source=api-prod","affected":[{"type":"plugin","slug":"rankology-seo-and-analytics-tool","name":"Rankology SEO and Analytics Tool","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.5"}],"published":"2026-01-06T19:26:19Z","updated":"2026-01-23T19:18:20Z"},{"id":"wordfence:c97b31bc-75d6-40af-bf4a-714ea69d2c28","source":"wordfence","cve":"","title":"Easy Career Openings <= 0.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97b31bc-75d6-40af-bf4a-714ea69d2c28?source=api-prod","affected":[{"type":"plugin","slug":"easy-career-openings","name":"Easy Career Openings","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2013-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c97c0191-1ef4-4a37-a93d-bceb2be298b4","source":"wordfence","cve":"CVE-2025-10189","title":"BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97c0191-1ef4-4a37-a93d-bceb2be298b4?source=api-prod","affected":[{"type":"plugin","slug":"bp-direct-menus","name":"BP Direct Menus","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:28:56Z","updated":"2025-09-30T03:35:31Z"},{"id":"wordfence:c97c338d-19b1-40fc-90c5-3e52d4cc053b","source":"wordfence","cve":"CVE-2026-39604","title":"MyBookTable Bookstore <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97c338d-19b1-40fc-90c5-3e52d4cc053b?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-01T00:00:00Z","updated":"2026-04-15T21:16:12Z"},{"id":"wordfence:c97f7513-188b-434c-8cb1-883bed016848","source":"wordfence","cve":"CVE-2024-30541","title":"LWS Optimize <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97f7513-188b-434c-8cb1-883bed016848?source=api-prod","affected":[{"type":"plugin","slug":"lws-optimize","name":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T19:37:19Z"},{"id":"wordfence:c97fc289-1ee3-4401-a57e-b4c8d998259e","source":"wordfence","cve":"CVE-2023-0267","title":"Ultimate Carousel For WPBakery Page Builder <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c97fc289-1ee3-4401-a57e-b4c8d998259e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-carousel-for-visual-composer","name":"Ultimate Carousel For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9826506-2292-44a7-9564-832e54bf4fba","source":"wordfence","cve":"CVE-2025-13987","title":"Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9826506-2292-44a7-9564-832e54bf4fba?source=api-prod","affected":[{"type":"plugin","slug":"purchase-and-expense-manager","name":"Purchase and Expense Manager","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:33:01Z","updated":"2025-12-12T03:20:57Z"},{"id":"wordfence:c9842bb5-0a71-40a9-83bc-f1841b660693","source":"wordfence","cve":"CVE-2023-5757","title":"WP Crowdfunding <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9842bb5-0a71-40a9-83bc-f1841b660693?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c988b505-d42a-4d23-a641-f2fc8ab9c988","source":"wordfence","cve":"CVE-2024-32084","title":"Before And After <= 3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c988b505-d42a-4d23-a641-f2fc8ab9c988?source=api-prod","affected":[{"type":"plugin","slug":"before-and-after","name":"Before And After: Lead Capture Forms For WordPress","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:11:53Z"},{"id":"wordfence:c98c1ce9-8213-47cb-b928-3641f821a806","source":"wordfence","cve":"","title":"InPost Gallery <= 2.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c98c1ce9-8213-47cb-b928-3641f821a806?source=api-prod","affected":[{"type":"plugin","slug":"inpost-gallery","name":"InPost Gallery","from":"*","from_inclusive":true,"to":"2.1.2.1","to_inclusive":false,"patched_in":"2.1.2.1"}],"published":"2016-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c98cd47b-075a-44c4-8755-02f474f9ca42","source":"wordfence","cve":"CVE-2026-28037","title":"EventON <= 4.9.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c98cd47b-075a-44c4-8755-02f474f9ca42?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.9.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:47:31Z"},{"id":"wordfence:c9926150-a4af-4fc0-808f-329d1a0aa0b1","source":"wordfence","cve":"CVE-2024-6228","title":"WANotifier <= 2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9926150-a4af-4fc0-808f-329d1a0aa0b1?source=api-prod","affected":[{"type":"plugin","slug":"notifier","name":"WANotifier for Forms and Actions","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2026-06-15T00:00:00Z","updated":"2026-08-21T13:04:27Z"},{"id":"wordfence:c9955d65-afb3-4d28-abd2-9f2fec92d013","source":"wordfence","cve":"CVE-2022-3805","title":"Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass","severity":"high","cvss":8.6,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c997dfc8-7cec-4636-9fe4-df1fb6436082","source":"wordfence","cve":"CVE-2025-12569","title":"Front User Submit <= 4.9.5 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c997dfc8-7cec-4636-9fe4-df1fb6436082?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-01T17:19:59Z"},{"id":"wordfence:c9983364-9b52-4acc-91d4-b352c6d24d52","source":"wordfence","cve":"CVE-2023-2289","title":"wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9983364-9b52-4acc-91d4-b352c6d24d52?source=api-prod","affected":[{"type":"plugin","slug":"wp-vertical-image-slider","name":"Vertical Image Slider \u2013 Responsive Thumbnail Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c999b088-1525-4e7b-9e46-483a84eab091","source":"wordfence","cve":"CVE-2026-109926","title":"Productive Commerce <= 1.1.48 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c999b088-1525-4e7b-9e46-483a84eab091?source=api-prod","affected":[{"type":"plugin","slug":"productive-commerce","name":"Productive Commerce \u2013 Wishlist, Compare & MiniCart","from":"*","from_inclusive":true,"to":"1.1.48","to_inclusive":true,"patched_in":"1.1.49"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:13:33Z"},{"id":"wordfence:c99b8a94-c35b-43a1-bb14-2ca97be421cc","source":"wordfence","cve":"CVE-2024-13541","title":"aDirectory \u2013 WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c99b8a94-c35b-43a1-bb14-2ca97be421cc?source=api-prod","affected":[{"type":"plugin","slug":"adirectory","name":"aDirectory \u2013 WP Business Directory Plugin and Classified Ads Listings Directory","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T03:21:41Z"},{"id":"wordfence:c99e7f4c-ba91-4d64-b8d4-23940381e79a","source":"wordfence","cve":"","title":"Simple Personal Message < 2.0.0 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c99e7f4c-ba91-4d64-b8d4-23940381e79a?source=api-prod","affected":[{"type":"plugin","slug":"simple-personal-message","name":"Simple Personal Message","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2016-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9a030c0-6129-40b0-81da-4c420929d198","source":"wordfence","cve":"CVE-2026-92966","title":"Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a030c0-6129-40b0-81da-4c420929d198?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.0","to_inclusive":true,"patched_in":"5.7.1"}],"published":"2026-09-30T15:46:49Z","updated":"2026-10-01T04:27:35Z"},{"id":"wordfence:c9a1f1a1-4f0a-48b5-80c8-525b69006863","source":"wordfence","cve":"CVE-2024-3723","title":"Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a1f1a1-4f0a-48b5-80c8-525b69006863?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-06-10T17:31:33Z","updated":"2024-07-11T17:47:07Z"},{"id":"wordfence:c9a3d3c3-278b-46c7-87d0-53528d616951","source":"wordfence","cve":"CVE-2015-9411","title":"Replyable \u2013 Subscribe to Comments and Reply by Email < 1.4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a3d3c3-278b-46c7-87d0-53528d616951?source=api-prod","affected":[{"type":"plugin","slug":"postmatic","name":"Replyable \u2013 Subscribe to Comments and Reply by Email","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":false,"patched_in":"1.4.6"}],"published":"2015-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9a5f8ca-7efc-401b-8a93-07fbe7204dce","source":"wordfence","cve":"CVE-2026-16230","title":"Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field","severity":"critical","cvss":9.8,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a5f8ca-7efc-401b-8a93-07fbe7204dce?source=api-prod","affected":[{"type":"plugin","slug":"formidable-signature","name":"Formidable Digital Signatures","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-08-11T06:34:15Z","updated":"2026-08-11T19:37:28Z"},{"id":"wordfence:c9a717ff-8bab-4ead-8323-35bd2fdee12d","source":"wordfence","cve":"CVE-2025-31057","title":"Universal Video Player <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a717ff-8bab-4ead-8323-35bd2fdee12d?source=api-prod","affected":[{"type":"plugin","slug":"elementor_widget_universal_video_player","name":"Universal Video Player - WordPress Plugin","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-11T19:55:16Z"},{"id":"wordfence:c9a9675f-76f5-4551-8d2d-60ae7a8378d1","source":"wordfence","cve":"CVE-2024-50506","title":"Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a9675f-76f5-4551-8d2d-60ae7a8378d1?source=api-prod","affected":[{"type":"plugin","slug":"marketing-automation-by-azexo","name":"Marketing Automation by AZEXO","from":"*","from_inclusive":true,"to":"1.27.80","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:40:06Z"},{"id":"wordfence:c9a989db-683c-492c-8c26-abef0fecf00e","source":"wordfence","cve":"CVE-2019-15331","title":"WP Support Plus Responsive Ticket System <= 9.1.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9a989db-683c-492c-8c26-abef0fecf00e?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":false,"patched_in":"9.1.2"}],"published":"2019-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9aa2a44-5a71-4a10-9876-3d54b8d268c5","source":"wordfence","cve":"CVE-2024-6552","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.2 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9aa2a44-5a71-4a10-9876-3d54b8d268c5?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2024-08-07T14:41:09Z","updated":"2024-08-08T03:30:47Z"},{"id":"wordfence:c9aa467f-9ac2-4a84-b0bb-761101733af7","source":"wordfence","cve":"CVE-2024-12309","title":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9aa467f-9ac2-4a84-b0bb-761101733af7?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":true,"patched_in":"4.2.5"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:52Z"},{"id":"wordfence:c9ab868b-51ab-4dad-b662-8302cda9c0e7","source":"wordfence","cve":"CVE-2023-44239","title":"WWM Social Share On Image Hover <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ab868b-51ab-4dad-b662-8302cda9c0e7?source=api-prod","affected":[{"type":"plugin","slug":"wwm-social-share-on-image-hover","name":"WWM Social Share On Image Hover","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9b010ff-8a4a-4553-bb2b-d58a254d7ee4","source":"wordfence","cve":"CVE-2024-10899","title":"WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b010ff-8a4a-4553-bb2b-d58a254d7ee4?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:56Z"},{"id":"wordfence:c9b09489-9f32-41f6-befd-7c08612d3edc","source":"wordfence","cve":"CVE-2025-48169","title":"Code Engine <= 0.3.3 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b09489-9f32-41f6-befd-7c08612d3edc?source=api-prod","affected":[{"type":"plugin","slug":"code-engine","name":"Code Engine \u2013 PHP Snippets, AI Functions & Automation for WordPress","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":"0.3.4"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T15:06:33Z"},{"id":"wordfence:c9b4b8cc-fa30-454d-b86a-55133f2ca993","source":"wordfence","cve":"CVE-2026-14929","title":"JS Help Desk <= 3.1.3 - Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b4b8cc-fa30-454d-b86a-55133f2ca993?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:32:18Z"},{"id":"wordfence:c9bd3620-60a2-4741-b623-5147b6997575","source":"wordfence","cve":"CVE-2023-5087","title":"Page Builder: Pagelayer <= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9bd3620-60a2-4741-b623-5147b6997575?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9c1039e-759f-420a-87a7-6a106640ff60","source":"wordfence","cve":"CVE-2025-22688","title":"Unlimited Page Sidebars <= 0.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c1039e-759f-420a-87a7-6a106640ff60?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-page-sidebars","name":"Unlimited Page Sidebars","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":"0.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:43:56Z"},{"id":"wordfence:c9c1ddaf-4bf2-4937-b7bf-a09162db043e","source":"wordfence","cve":"CVE-2023-3023","title":"WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c1ddaf-4bf2-4937-b7bf-a09162db043e?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.4.10","to_inclusive":true,"patched_in":"5.4.11"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9c29130-1b42-4edd-ad62-6f635e03ae31","source":"wordfence","cve":"CVE-2022-4290","title":"Cyr to Lat <= 3.5 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c29130-1b42-4edd-ad62-6f635e03ae31?source=api-prod","affected":[{"type":"plugin","slug":"cyr3lat","name":"Cyr to Lat Enhanced","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9c2fb7f-a05b-4852-97eb-7befe880d703","source":"wordfence","cve":"CVE-2024-1986","title":"Elite Booster for WooCommerce  <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c2fb7f-a05b-4852-97eb-7befe880d703?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-07T20:33:28Z"},{"id":"wordfence:c9c5516c-3f6b-438d-b3f1-27a68de48d1d","source":"wordfence","cve":"CVE-2026-105871","title":"Element Pack Addons for Elementor \u2013 Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c5516c-3f6b-438d-b3f1-27a68de48d1d?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.8.6","to_inclusive":true,"patched_in":"8.8.7"}],"published":"2026-10-07T09:03:00Z","updated":"2026-10-08T23:31:51Z"},{"id":"wordfence:c9c907ea-3ab4-4674-8945-ade4f6ff2679","source":"wordfence","cve":"CVE-2023-6493","title":"Depicter Slider \u2013 Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c907ea-3ab4-4674-8945-ade4f6ff2679?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-01-04T00:00:00Z","updated":"2024-07-29T21:37:25Z"},{"id":"wordfence:c9cbacbf-5ce2-4dd3-9f0b-6049b83a16c6","source":"wordfence","cve":"CVE-2024-52489","title":"Add Chat App Button <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cbacbf-5ce2-4dd3-9f0b-6049b83a16c6?source=api-prod","affected":[{"type":"plugin","slug":"add-whatsapp-button","name":"Add Chat App Button","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:06:27Z"},{"id":"wordfence:c9cccff7-29c0-4275-b689-a3f29bc25e57","source":"wordfence","cve":"CVE-2025-39389","title":"AnalyticsWP <= 2.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cccff7-29c0-4275-b689-a3f29bc25e57?source=api-prod","affected":[{"type":"plugin","slug":"analyticswp","name":"AnalyticsWP","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:16:02Z"},{"id":"wordfence:c9cd43f5-c3d0-4eb2-9c18-1af2edca37ff","source":"wordfence","cve":"CVE-2025-3918","title":"Job Listings 0.1 - 0.1.1 - Unauthenticated Privilege Escalation via register_action Function","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cd43f5-c3d0-4eb2-9c18-1af2edca37ff?source=api-prod","affected":[{"type":"plugin","slug":"job-listings","name":"Job Listings","from":"0.1","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:32:50Z","updated":"2025-05-03T01:43:06Z"},{"id":"wordfence:c9ce2107-18bd-4331-bd8e-578f56fdebf7","source":"wordfence","cve":"CVE-2021-25028","title":"Event Tickets <= 5.2.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ce2107-18bd-4331-bd8e-578f56fdebf7?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2021-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9cf97a6-38bb-4499-98f0-ca2b7111f654","source":"wordfence","cve":"CVE-2024-7434","title":"UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cf97a6-38bb-4499-98f0-ca2b7111f654?source=api-prod","affected":[{"type":"theme","slug":"ultrapress","name":"UltraPress","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2025-01-15T15:20:54Z"},{"id":"wordfence:c9d00ee8-b9df-4044-a5e2-320391d6c9b1","source":"wordfence","cve":"CVE-2026-7520","title":"MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d00ee8-b9df-4044-a5e2-320391d6c9b1?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2026-08-04T18:41:47Z","updated":"2026-08-05T07:39:23Z"},{"id":"wordfence:c9d07faf-cc88-4233-a552-55e3376a2fc4","source":"wordfence","cve":"CVE-2023-51672","title":"FunnelKit Checkout <= 3.10.3 - Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d07faf-cc88-4233-a552-55e3376a2fc4?source=api-prod","affected":[{"type":"plugin","slug":"woofunnels-aero-checkout","name":"FunnelKit Checkout","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9d1bb31-ddc6-438f-b443-fedd25ac136e","source":"wordfence","cve":"CVE-2026-105259","title":"Easy Social Icons <= 4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d1bb31-ddc6-438f-b443-fedd25ac136e?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:09:14Z"},{"id":"wordfence:c9d2431d-32ea-4f2d-9fce-bd44dc6680ba","source":"wordfence","cve":"CVE-2026-57635","title":"FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d2431d-32ea-4f2d-9fce-bd44dc6680ba?source=api-prod","affected":[{"type":"plugin","slug":"funnelkit-stripe-woo-payment-gateway","name":"FunnelKit Payment Gateway for Stripe WooCommerce","from":"*","from_inclusive":true,"to":"1.14.0.3","to_inclusive":true,"patched_in":"1.14.0.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:52:50Z"},{"id":"wordfence:c9d38777-67b0-41ed-9184-cd45c61101c5","source":"wordfence","cve":"CVE-2025-69190","title":"Listihub <= 1.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d38777-67b0-41ed-9184-cd45c61101c5?source=api-prod","affected":[{"type":"theme","slug":"listihub","name":"Listihub - Directory Listing WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:57:06Z"},{"id":"wordfence:c9d58fde-54f6-4892-b5ed-2029593c3fa4","source":"wordfence","cve":"CVE-2016-10974","title":"Fluid Responsive Slideshow < 2.2.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d58fde-54f6-4892-b5ed-2029593c3fa4?source=api-prod","affected":[{"type":"plugin","slug":"fluid-responsive-slideshow","name":"Fluid Responsive Slideshow","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2016-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9d5c661-bc81-4706-b930-6e3309f3d705","source":"wordfence","cve":"CVE-2022-2798","title":"Affiliates Manager <= 2.9.13 - CSV Injection","severity":"critical","cvss":9.0,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d5c661-bc81-4706-b930-6e3309f3d705?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9d82a7e-abf0-4698-898d-4bbd79d36321","source":"wordfence","cve":"CVE-2024-51883","title":"I Plant A Tree <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9d82a7e-abf0-4698-898d-4bbd79d36321?source=api-prod","affected":[{"type":"plugin","slug":"i-plant-a-tree","name":"I Plant A Tree","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-25T16:05:17Z"},{"id":"wordfence:c9db93e9-bcd8-48d7-aa68-b92532bab1e6","source":"wordfence","cve":"CVE-2026-32528","title":"Riode | Multi-Purpose WooCommerce < 1.6.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9db93e9-bcd8-48d7-aa68-b92532bab1e6?source=api-prod","affected":[{"type":"theme","slug":"riode","name":"Riode | Multi-Purpose WooCommerce","from":"*","from_inclusive":true,"to":"1.6.29","to_inclusive":false,"patched_in":"1.6.29"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:35:23Z"},{"id":"wordfence:c9dca86f-b853-4d29-ae43-bd6ea74d058d","source":"wordfence","cve":"CVE-2026-85652","title":"Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9dca86f-b853-4d29-ae43-bd6ea74d058d?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.44","to_inclusive":true,"patched_in":"1.8.45"}],"published":"2026-09-17T19:39:00Z","updated":"2026-09-18T07:40:04Z"},{"id":"wordfence:c9dd2d46-2994-4ea3-9b2a-6aa3444b1b38","source":"wordfence","cve":"CVE-2026-22433","title":"CloudMe | Cloud Storage & File-Sharing WordPress Theme <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9dd2d46-2994-4ea3-9b2a-6aa3444b1b38?source=api-prod","affected":[{"type":"theme","slug":"cloudme","name":"CloudMe | Cloud Storage & File-Sharing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:37:08Z"},{"id":"wordfence:c9de2fe9-c1d7-4898-806d-68628061a98d","source":"wordfence","cve":"CVE-2024-31112","title":"Convert Post Types <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9de2fe9-c1d7-4898-806d-68628061a98d?source=api-prod","affected":[{"type":"plugin","slug":"convert-post-types","name":"Convert Post Types","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:26:45Z"},{"id":"wordfence:c9de6f14-67e4-40c2-8efb-7e9cad659d37","source":"wordfence","cve":"CVE-2024-7891","title":"Floating Contact Button <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9de6f14-67e4-40c2-8efb-7e9cad659d37?source=api-prod","affected":[{"type":"plugin","slug":"floating-contact","name":"Floating Contact Button","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2024-08-20T00:00:00Z","updated":"2024-09-12T15:44:05Z"},{"id":"wordfence:c9df788e-a92e-4519-9e23-8aed08479b68","source":"wordfence","cve":"CVE-2024-31356","title":"User Activity Log <= 1.9 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9df788e-a92e-4519-9e23-8aed08479b68?source=api-prod","affected":[{"type":"plugin","slug":"user-activity-log","name":"User Activity Log","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-04-07T00:00:00Z","updated":"2024-05-28T16:48:38Z"},{"id":"wordfence:c9e09c6a-7d71-4c82-bc7a-ac310f52b5cd","source":"wordfence","cve":"CVE-2026-65551","title":"Breakdance <= 2.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e09c6a-7d71-4c82-bc7a-ac310f52b5cd?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-25T23:29:03Z"},{"id":"wordfence:c9e1410f-10c9-4654-8b61-cfcdde696da7","source":"wordfence","cve":"CVE-2024-4444","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-420","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e1410f-10c9-4654-8b61-cfcdde696da7?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.5","to_inclusive":true,"patched_in":"4.2.6.6"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-10T08:32:35Z"},{"id":"wordfence:c9e2694b-3dad-411c-ade9-89c82f2f5d18","source":"wordfence","cve":"CVE-2026-116399","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e2694b-3dad-411c-ade9-89c82f2f5d18?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.4.2","to_inclusive":true,"patched_in":"0.1.4.3"}],"published":"2026-10-29T13:53:00Z","updated":"2026-11-03T19:30:22Z"},{"id":"wordfence:c9e3702b-8a3a-467d-aba8-2d617ee5c419","source":"wordfence","cve":"CVE-2025-32606","title":"Listings for Buildium <= 0.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e3702b-8a3a-467d-aba8-2d617ee5c419?source=api-prod","affected":[{"type":"plugin","slug":"listings-for-buildium","name":"Listings for Buildium","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":"0.1.6"}],"published":"2025-04-11T00:00:00Z","updated":"2025-12-09T21:54:38Z"},{"id":"wordfence:c9e45ae8-e5b5-460b-80f8-de562ae7c56a","source":"wordfence","cve":"CVE-2023-32126","title":"SALERT <= 1.2.1 - Missing Authorization via salert_save_settings_with_ajax()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e45ae8-e5b5-460b-80f8-de562ae7c56a?source=api-prod","affected":[{"type":"plugin","slug":"salert","name":"SALERT \u2013 Social Proof Notifications & Live Sales Popup","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9e50b6a-0b64-4cc8-91a0-509fb8d0bf42","source":"wordfence","cve":"CVE-2026-25350","title":"Miti < 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e50b6a-0b64-4cc8-91a0-509fb8d0bf42?source=api-prod","affected":[{"type":"theme","slug":"miti","name":"Miti - Elementor Fashion WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:43:39Z"},{"id":"wordfence:c9ebc817-ccae-4ad2-8eea-eade1c2a1a0c","source":"wordfence","cve":"CVE-2025-9451","title":"Smartcat Translator for WPML <= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebc817-ccae-4ad2-8eea-eade1c2a1a0c?source=api-prod","affected":[{"type":"plugin","slug":"smartcat-wpml","name":"Smartcat Translator for WPML","from":"*","from_inclusive":true,"to":"3.1.72","to_inclusive":true,"patched_in":"3.1.73"}],"published":"2025-09-10T18:45:26Z","updated":"2025-10-21T20:58:43Z"},{"id":"wordfence:c9ebcd32-90c1-419c-a67c-6fe41ee9fab1","source":"wordfence","cve":"CVE-2025-1008","title":"Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebcd32-90c1-419c-a67c-6fe41ee9fab1?source=api-prod","affected":[{"type":"plugin","slug":"recently-purchased-products-for-woo","name":"Recently Purchased Products For Woo","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-03-04T19:18:39Z","updated":"2025-03-07T14:13:14Z"},{"id":"wordfence:c9f4760c-a794-43e0-80a3-88b3f41810f5","source":"wordfence","cve":"CVE-2018-8710","title":"WOOF - Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9f4760c-a794-43e0-80a3-88b3f41810f5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2018-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9f71433-7b86-46c7-b91e-bc59679f0351","source":"wordfence","cve":"CVE-2024-3481","title":"Counter Box \u2013 WordPress plugin for countdown, timer, counter <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9f71433-7b86-46c7-b91e-bc59679f0351?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:46:11Z"},{"id":"wordfence:c9f8e9b5-f4bf-48e3-b315-1b9b24be6e93","source":"wordfence","cve":"","title":"Journey Analytics <= 1.0.12 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9f8e9b5-f4bf-48e3-b315-1b9b24be6e93?source=api-prod","affected":[{"type":"plugin","slug":"journey-analytics","name":"Journey Analytics","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9fa2f2d-55bf-4d67-994d-08f14ddfdb41","source":"wordfence","cve":"CVE-2026-102377","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.46 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fa2f2d-55bf-4d67-994d-08f14ddfdb41?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.46","to_inclusive":true,"patched_in":"1.8.47"}],"published":"2026-09-30T12:54:13Z","updated":"2026-10-08T23:10:46Z"},{"id":"wordfence:c9fb3480-f83a-4cf1-873e-4a938805666b","source":"wordfence","cve":"CVE-2024-52409","title":"AJAX Random Posts <= 0.3.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fb3480-f83a-4cf1-873e-4a938805666b?source=api-prod","affected":[{"type":"plugin","slug":"ajax-random-posts","name":"AJAX Random Posts","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:26:01Z"},{"id":"wordfence:c9fc747c-3b13-4a49-a181-fe6a952a4ce3","source":"wordfence","cve":"CVE-2021-24761","title":"Error Log Viewer by BestWebSoft <= 1.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fc747c-3b13-4a49-a181-fe6a952a4ce3?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer","name":"Error Log Viewer by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2021-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:c9fd7c6b-9ba3-4e27-9b3d-8b1fbcc5e26f","source":"wordfence","cve":"CVE-2024-56292","title":"Email Reminders <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fd7c6b-9ba3-4e27-9b3d-8b1fbcc5e26f?source=api-prod","affected":[{"type":"plugin","slug":"email-reminders","name":"Email Reminders","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:07:09Z"},{"id":"wordfence:c9fe3574-f338-474c-af78-f843501d422c","source":"wordfence","cve":"CVE-2025-1319","title":"Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fe3574-f338-474c-af78-f843501d422c?source=api-prod","affected":[{"type":"plugin","slug":"site-mailer","name":"Email Deliverability \u2013 SMTP Replacement, Email API Deliverability & Email Log","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-02-27T23:34:36Z","updated":"2025-02-28T23:09:35Z"},{"id":"wordfence:ca0024c9-b740-4871-8912-06102677368f","source":"wordfence","cve":"CVE-2026-40722","title":"Yoast SEO Premium <= 26.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca0024c9-b740-4871-8912-06102677368f?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo-premium","name":"Yoast SEO Premium","from":"*","from_inclusive":true,"to":"26.6","to_inclusive":true,"patched_in":"26.7"}],"published":"2026-01-15T00:00:00Z","updated":"2026-09-18T14:46:52Z"},{"id":"wordfence:ca0191be-df68-4b5f-85e6-40e962cc5de8","source":"wordfence","cve":"CVE-2026-121515","title":"FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca0191be-df68-4b5f-85e6-40e962cc5de8?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7212","to_inclusive":true,"patched_in":"7.5.57.7212"}],"published":"2026-11-06T13:48:42Z","updated":"2026-11-07T02:29:17Z"},{"id":"wordfence:ca02cd21-e278-478e-80e8-18ff51f6ed10","source":"wordfence","cve":"CVE-2025-39480","title":"Car Dealer < 1.6.7 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca02cd21-e278-478e-80e8-18ff51f6ed10?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"}],"published":"2025-05-22T00:00:00Z","updated":"2026-03-17T21:24:00Z"},{"id":"wordfence:ca036121-072c-4944-84e9-3b8b69f3e17c","source":"wordfence","cve":"CVE-2015-9364","title":"2Checkout Add-on for iThemes Exchange < 1.1.0 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca036121-072c-4944-84e9-3b8b69f3e17c?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-2checkout","name":"2Checkout Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca04a041-6614-420b-a7c5-65128202d713","source":"wordfence","cve":"CVE-2025-58678","title":"Accordion <= 2.3.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca04a041-6614-420b-a7c5-65128202d713?source=api-prod","affected":[{"type":"plugin","slug":"accordions","name":"Accordions","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:11:10Z"},{"id":"wordfence:ca05783d-7516-469e-b8a0-c23035db43b7","source":"wordfence","cve":"CVE-2023-40205","title":"PixTypes <= 1.4.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca05783d-7516-469e-b8a0-c23035db43b7?source=api-prod","affected":[{"type":"plugin","slug":"pixtypes","name":"PixTypes","from":"*","from_inclusive":true,"to":"1.4.15","to_inclusive":true,"patched_in":"1.4.16"}],"published":"2023-08-11T00:00:00Z","updated":"2026-03-06T18:40:08Z"},{"id":"wordfence:ca058dde-48fd-46f4-b16c-97cdf79578ff","source":"wordfence","cve":"CVE-2023-29425","title":"ShiftController Employee Shift Scheduling <= 4.9.23 - Cross-Site Request Forgery via get","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca058dde-48fd-46f4-b16c-97cdf79578ff?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.23","to_inclusive":true,"patched_in":"4.9.24"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca064db0-2718-4521-9467-335b59208858","source":"wordfence","cve":"CVE-2023-51417","title":"JVM rich text icons <= 1.2.3 - Authenticated(Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca064db0-2718-4521-9467-335b59208858?source=api-prod","affected":[{"type":"plugin","slug":"jvm-rich-text-icons","name":"JVM Rich Text Icons","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca09ce0d-3989-420d-9457-f0acd709cc6b","source":"wordfence","cve":"CVE-2023-41868","title":"Stagtools <= 2.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca09ce0d-3989-420d-9457-f0acd709cc6b?source=api-prod","affected":[{"type":"plugin","slug":"stagtools","name":"StagTools","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca0bc327-1a64-493b-8813-8bb7b71635f0","source":"wordfence","cve":"CVE-2024-32100","title":"Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca0bc327-1a64-493b-8813-8bb7b71635f0?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:26:33Z"},{"id":"wordfence:ca0e51b2-640a-4bd1-b667-74107b7dcc6f","source":"wordfence","cve":"CVE-2024-31256","title":"WebinarPress <= 1.33.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca0e51b2-640a-4bd1-b667-74107b7dcc6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.9","to_inclusive":true,"patched_in":"1.33.10"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:35:35Z"},{"id":"wordfence:ca11e840-04bd-4731-bfa9-3bf8ed98e155","source":"wordfence","cve":"CVE-2024-12403","title":"Image Gallery \u2013 Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca11e840-04bd-4731-bfa9-3bf8ed98e155?source=api-prod","affected":[{"type":"plugin","slug":"awesome-responsive-photo-gallery","name":"Awesome Responsive Photo Gallery \u2013 Image & Video Lightbox Gallery","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T09:25:55Z"},{"id":"wordfence:ca12d05f-23f4-44e4-b513-a0452a170130","source":"wordfence","cve":"CVE-2026-39484","title":"Hide My WP Ghost < 7.0.00 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca12d05f-23f4-44e4-b513-a0452a170130?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.00","to_inclusive":false,"patched_in":"7.0.00"}],"published":"2026-03-18T00:00:00Z","updated":"2026-05-05T14:56:01Z"},{"id":"wordfence:ca12f906-d896-428a-a144-a1afe045197b","source":"wordfence","cve":"CVE-2022-0279","title":"AnyComment <= 0.2.17 - Race Condition","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca12f906-d896-428a-a144-a1afe045197b?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.2.18","to_inclusive":false,"patched_in":"0.2.18"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca1316be-1978-46c1-8685-10a8d4c34bdb","source":"wordfence","cve":"CVE-2024-10680","title":"Form Maker by 10Web <= 1.15.31 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1316be-1978-46c1-8685-10a8d4c34bdb?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.31","to_inclusive":true,"patched_in":"1.15.32"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-21T20:25:42Z"},{"id":"wordfence:ca132d26-e927-41f1-be57-0c3bdeace2e6","source":"wordfence","cve":"","title":"Fontsampler <= 0.4.12 -  Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca132d26-e927-41f1-be57-0c3bdeace2e6?source=api-prod","affected":[{"type":"plugin","slug":"fontsampler","name":"Fontsampler","from":"*","from_inclusive":true,"to":"0.4.12","to_inclusive":true,"patched_in":"0.4.13"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca139d90-c634-4b87-ac82-2d340e06b309","source":"wordfence","cve":"CVE-2026-81290","title":"Email Subscribers & Newsletters \u2013 Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca139d90-c634-4b87-ac82-2d340e06b309?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.33","to_inclusive":true,"patched_in":"5.9.34"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:57:32Z"},{"id":"wordfence:ca13db03-74ee-4fdf-96ea-28219f9324e5","source":"wordfence","cve":"CVE-2024-31364","title":"ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca13db03-74ee-4fdf-96ea-28219f9324e5?source=api-prod","affected":[{"type":"plugin","slug":"elex-woocommerce-dynamic-pricing-and-discounts","name":"ELEX WooCommerce Dynamic Pricing and Discounts","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T14:26:16Z"},{"id":"wordfence:ca149cc0-b256-41cd-b64d-dd905bd72602","source":"wordfence","cve":"CVE-2025-6256","title":"Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca149cc0-b256-41cd-b64d-dd905bd72602?source=api-prod","affected":[{"type":"plugin","slug":"flex-guten","name":"Flex Guten \u2013 Multile Blocks","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-08-05T13:00:10Z","updated":"2025-08-11T14:02:46Z"},{"id":"wordfence:ca14ec54-0864-47f7-9653-1fe04e2875de","source":"wordfence","cve":"CVE-2026-18059","title":"PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca14ec54-0864-47f7-9653-1fe04e2875de?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite-pro","name":"PixelYourSite Pro \u2013 Your smart PIXEL (TAG) Manager","from":"*","from_inclusive":true,"to":"12.6.1","to_inclusive":false,"patched_in":"12.6.1"},{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"11.2.1","to_inclusive":true,"patched_in":"11.2.2"}],"published":"2026-07-31T19:45:43Z","updated":"2026-08-01T07:49:52Z"},{"id":"wordfence:ca155a52-4ee8-45dd-a74c-7155ea5bc0c1","source":"wordfence","cve":"CVE-2026-57702","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 2.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca155a52-4ee8-45dd-a74c-7155ea5bc0c1?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:38:12Z"},{"id":"wordfence:ca17fd4a-fd14-46e6-9348-19b74fec5df8","source":"wordfence","cve":"CVE-2021-24855","title":"Display Post Metadata <= 1.4.0 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca17fd4a-fd14-46e6-9348-19b74fec5df8?source=api-prod","affected":[{"type":"plugin","slug":"display-post-metadata","name":"Display Post Metadata","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca1837a4-ea04-4a82-aadb-43e9cff28833","source":"wordfence","cve":"CVE-2026-109214","title":"User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1837a4-ea04-4a82-aadb-43e9cff28833?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-11-06T23:13:49Z","updated":"2026-11-07T11:26:34Z"},{"id":"wordfence:ca195af0-9b51-4eca-b1ca-309b4b26ed4e","source":"wordfence","cve":"CVE-2026-39467","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider <= 3.106.0 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca195af0-9b51-4eca-b1ca-309b4b26ed4e?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.106.0","to_inclusive":true,"patched_in":"3.107.0"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:59:26Z"},{"id":"wordfence:ca1aafcc-8cc1-41f1-b28c-bf5707054ce9","source":"wordfence","cve":"CVE-2024-56260","title":"ShopElement <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1aafcc-8cc1-41f1-b28c-bf5707054ce9?source=api-prod","affected":[{"type":"plugin","slug":"shopelement","name":"ShopElement \u2013 Elementor Addons for WooCommerce Product Grid, Carousel & Category Widgets","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:21:48Z"},{"id":"wordfence:ca1c1b43-def2-4f9f-b5c7-075ca188f6e7","source":"wordfence","cve":"CVE-2024-1325","title":"Live Sales Notification for Woocommerce \u2013 Woomotiv <= 3.4.3 - Cross-Site Request Forgery  via ajax_cancel_review","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1c1b43-def2-4f9f-b5c7-075ca188f6e7?source=api-prod","affected":[{"type":"plugin","slug":"woomotiv","name":"Live Sales Notification for Woocommerce \u2013 Woomotiv","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-09T18:44:27Z"},{"id":"wordfence:ca1d5275-3398-47a7-889b-4050ebe635ee","source":"wordfence","cve":"CVE-2024-7950","title":"WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1d5275-3398-47a7-889b-4050ebe635ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-09-03T14:04:34Z","updated":"2024-09-04T02:33:48Z"},{"id":"wordfence:ca1dec2a-c3a1-4edc-b9f6-7504c1830d29","source":"wordfence","cve":"CVE-2025-58643","title":"LTL Freight Quotes \u2013 Daylight Edition <= 2.2.7 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1dec2a-c3a1-4edc-b9f6-7504c1830d29?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-daylight-edition","name":"LTL Freight Quotes \u2013 Daylight Edition","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:35:47Z"},{"id":"wordfence:ca1f0dc6-c0bc-4e9f-b3b6-d6274aa7a7db","source":"wordfence","cve":"CVE-2024-0870","title":"YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1f0dc6-c0bc-4e9f-b3b6-d6274aa7a7db?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-gift-cards","name":"YITH WooCommerce Gift Cards","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":"4.13.0"}],"published":"2024-05-13T00:00:00Z","updated":"2024-07-29T21:37:25Z"},{"id":"wordfence:ca1fd2f3-7f3a-4227-b013-95e4ec59fce4","source":"wordfence","cve":"CVE-2022-1540","title":"PostmagThemes Demo Import <= 1.0.7 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca1fd2f3-7f3a-4227-b013-95e4ec59fce4?source=api-prod","affected":[{"type":"plugin","slug":"postmagthemes-demo-import","name":"PostmagThemes One click Demo Import for WordPress Site","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-11-11T00:00:00Z","updated":"2024-06-05T19:33:43Z"},{"id":"wordfence:ca203777-84ea-47ab-bafc-f2cc8f778fcd","source":"wordfence","cve":"","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca203777-84ea-47ab-bafc-f2cc8f778fcd?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.6.5","to_inclusive":true,"patched_in":"4.1.6.6"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca21320a-ee26-47e9-bbf8-cfbb45d7a882","source":"wordfence","cve":"CVE-2022-36387","title":"About Me <= 1.0.12 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca21320a-ee26-47e9-bbf8-cfbb45d7a882?source=api-prod","affected":[{"type":"plugin","slug":"about-me","name":"About Me","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca24aa2f-5d31-4128-af75-68bd24637ee7","source":"wordfence","cve":"CVE-2022-46796","title":"CURCY <= 2.1.25 - Missing Authorization to Currency Exchange Retrieval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca24aa2f-5d31-4128-af75-68bd24637ee7?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.25","to_inclusive":true,"patched_in":"2.1.26"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca263c58-addd-4cd6-b55b-82b7023849e1","source":"wordfence","cve":"CVE-2024-7315","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.105 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca263c58-addd-4cd6-b55b-82b7023849e1?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.105","to_inclusive":true,"patched_in":"0.9.106"}],"published":"2024-09-11T00:00:00Z","updated":"2024-09-20T18:13:06Z"},{"id":"wordfence:ca26ff73-2374-4d11-94ce-3127d4a4c13b","source":"wordfence","cve":"CVE-2025-46484","title":"Image Hover Effects For WPBakery Page Builder <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca26ff73-2374-4d11-94ce-3127d4a4c13b?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-for-visual-composer","name":"Image Hover Effects For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:34:23Z"},{"id":"wordfence:ca29158a-ca60-46c7-93a5-bcf76e7666e4","source":"wordfence","cve":"CVE-2024-8505","title":"WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca29158a-ca60-46c7-93a5-bcf76e7666e4?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2024-10-01T21:01:15Z","updated":"2024-10-02T09:31:59Z"},{"id":"wordfence:ca29baf1-7214-4569-9106-6d369e9f4d6f","source":"wordfence","cve":"CVE-2024-7761","title":"Simple Job Board <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca29baf1-7214-4569-9106-6d369e9f4d6f?source=api-prod","affected":[{"type":"plugin","slug":"simple-job-board","name":"Simple Job Board","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2024-07-04T00:00:00Z","updated":"2024-09-26T18:07:36Z"},{"id":"wordfence:ca2b5063-dec5-4e5d-a195-91cef84a1971","source":"wordfence","cve":"CVE-2026-39793","title":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.  4.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca2b5063-dec5-4e5d-a195-91cef84a1971?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"4.0.0","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:02:22Z"},{"id":"wordfence:ca2b6f6e-4cc0-40ae-8969-c82c5a231f41","source":"wordfence","cve":"CVE-2025-6715","title":"LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca2b6f6e-4cc0-40ae-8969-c82c5a231f41?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.93","to_inclusive":true,"patched_in":"5.1.94"}],"published":"2025-07-23T00:00:00Z","updated":"2025-08-19T14:11:20Z"},{"id":"wordfence:ca2d687f-0358-4642-849b-100bf40cbbf1","source":"wordfence","cve":"CVE-2025-2481","title":"MediaView <= 1.1.2 - Reflected Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca2d687f-0358-4642-849b-100bf40cbbf1?source=api-prod","affected":[{"type":"plugin","slug":"mediaview","name":"MediaView","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-03-26T12:57:09Z","updated":"2025-11-05T19:21:53Z"},{"id":"wordfence:ca329b94-1d4c-439c-b45a-6b39ccf3d1eb","source":"wordfence","cve":"CVE-2024-9651","title":"Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca329b94-1d4c-439c-b45a-6b39ccf3d1eb?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2024-11-18T00:00:00Z","updated":"2024-12-12T19:22:44Z"},{"id":"wordfence:ca32fd93-cab3-431b-91c3-9ed244f9d1f1","source":"wordfence","cve":"CVE-2015-9305","title":"WP Google Map Plugin < 2.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca32fd93-cab3-431b-91c3-9ed244f9d1f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2015-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca33e88f-e76d-45ef-a8da-153f02214913","source":"wordfence","cve":"CVE-2024-38725","title":"Admin Dashboard RSS Feed <= 3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca33e88f-e76d-45ef-a8da-153f02214913?source=api-prod","affected":[{"type":"plugin","slug":"admin-dashboard-rss-feed","name":"Admin Dashboard RSS Feed","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2024-07-11T00:00:00Z","updated":"2025-03-20T15:36:02Z"},{"id":"wordfence:ca35aa09-c805-49c8-81fb-c0003ea2c197","source":"wordfence","cve":"CVE-2025-31836","title":"Review Manager <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca35aa09-c805-49c8-81fb-c0003ea2c197?source=api-prod","affected":[{"type":"plugin","slug":"review-manager","name":"Review Manager","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:12:28Z"},{"id":"wordfence:ca3775db-0722-4090-924e-81e38d5dce97","source":"wordfence","cve":"CVE-2024-9930","title":"Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca3775db-0722-4090-924e-81e38d5dce97?source=api-prod","affected":[{"type":"plugin","slug":"sb-core","name":"Extensions by HocWP Team","from":"*","from_inclusive":true,"to":"0.2.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-26T01:58:38Z"},{"id":"wordfence:ca37d453-9f9a-46b2-a17f-65a16e3e2ed1","source":"wordfence","cve":"CVE-2023-3325","title":"CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature","severity":"high","cvss":8.1,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca37d453-9f9a-46b2-a17f-65a16e3e2ed1?source=api-prod","affected":[{"type":"plugin","slug":"cms-commander-client","name":"CMS Commander \u2013 Manage Multiple Sites","from":"*","from_inclusive":true,"to":"2.287","to_inclusive":true,"patched_in":"2.288"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca380ae0-6ca5-4f48-a275-a9d21bfaa4d3","source":"wordfence","cve":"CVE-2025-58893","title":"Alright <= 1.6.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca380ae0-6ca5-4f48-a275-a9d21bfaa4d3?source=api-prod","affected":[{"type":"theme","slug":"alright","name":"Alright - Full Site Editing Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-20T21:06:25Z"},{"id":"wordfence:ca38c423-2df8-4f20-bd95-2ecd84167a7f","source":"wordfence","cve":"CVE-2026-9273","title":"Membership Plugin \u2013 Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover","severity":"critical","cvss":9.3,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca38c423-2df8-4f20-bd95-2ecd84167a7f?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-08-04T16:16:32Z","updated":"2026-08-05T04:25:27Z"},{"id":"wordfence:ca3bf30b-a227-4c1a-ad38-f0417d6f6cb9","source":"wordfence","cve":"CVE-2026-97236","title":"ThemeREX Addons < 2.45.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca3bf30b-a227-4c1a-ad38-f0417d6f6cb9?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.45.0","to_inclusive":false,"patched_in":"2.45.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T17:52:03Z"},{"id":"wordfence:ca41c951-318f-47a7-9a30-c1d4eea1b1b5","source":"wordfence","cve":"CVE-2025-0853","title":"PGS Core <= 5.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca41c951-318f-47a7-9a30-c1d4eea1b1b5?source=api-prod","affected":[{"type":"plugin","slug":"pgs-core","name":"PGS Core","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2025-05-06T00:00:00Z","updated":"2025-05-06T21:22:23Z"},{"id":"wordfence:ca423309-d8bd-46a4-9e88-9534d9c60b4a","source":"wordfence","cve":"CVE-2025-12494","title":"Image Gallery \u2013 Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca423309-d8bd-46a4-9e88-9534d9c60b4a?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.12.28","to_inclusive":true,"patched_in":"2.12.29"}],"published":"2025-11-14T16:51:36Z","updated":"2025-11-15T05:45:35Z"},{"id":"wordfence:ca4398d3-1299-4456-9cf8-1674b2fe79d4","source":"wordfence","cve":"CVE-2025-53204","title":"Event List <= 1.9.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4398d3-1299-4456-9cf8-1674b2fe79d4?source=api-prod","affected":[{"type":"plugin","slug":"eventlist","name":"Event List","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:38:49Z"},{"id":"wordfence:ca449d15-b05e-4341-99b0-472a14cab8f4","source":"wordfence","cve":"CVE-2023-30874","title":"GPS Plotter <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca449d15-b05e-4341-99b0-472a14cab8f4?source=api-prod","affected":[{"type":"plugin","slug":"gps-plotter","name":"Gps Plotter","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-21T00:00:00Z","updated":"2024-11-14T15:48:56Z"},{"id":"wordfence:ca46ea28-3115-4db1-8aeb-cbef731b0376","source":"wordfence","cve":"CVE-2022-40192","title":"wpForo Forum <= 2.0.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca46ea28-3115-4db1-8aeb-cbef731b0376?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca47486b-0761-48b8-94a7-77175ed5a37e","source":"wordfence","cve":"CVE-2025-9346","title":"Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca47486b-0761-48b8-94a7-77175ed5a37e?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.1","to_inclusive":true,"patched_in":"10.14.2"}],"published":"2025-08-27T00:00:00Z","updated":"2025-08-28T03:42:45Z"},{"id":"wordfence:ca481a37-8c45-499c-bf68-3af6795af827","source":"wordfence","cve":"","title":"Predictive Search <= 1.2.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca481a37-8c45-499c-bf68-3af6795af827?source=api-prod","affected":[{"type":"plugin","slug":"predictive-search","name":"Predictive Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca4824fb-192a-499d-bf92-aa59410d8d4a","source":"wordfence","cve":"CVE-2017-14720","title":"WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4824fb-192a-499d-bf92-aa59410d8d4a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca496e0c-653a-4dce-bf27-48b17f02b357","source":"wordfence","cve":"CVE-2026-94388","title":"Green Popups < 7.6.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca496e0c-653a-4dce-bf27-48b17f02b357?source=api-prod","affected":[{"type":"plugin","slug":"halfdata-green-popups","name":"Green Popups","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":false,"patched_in":"7.6.3"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:42:08Z"},{"id":"wordfence:ca497ffa-6306-46dc-895f-94f1d5236e28","source":"wordfence","cve":"CVE-2024-6799","title":"YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca497ffa-6306-46dc-895f-94f1d5236e28?source=api-prod","affected":[{"type":"plugin","slug":"yith-essential-kit-for-woocommerce-1","name":"YITH Essential Kit for WooCommerce #1","from":"*","from_inclusive":true,"to":"2.34.0","to_inclusive":true,"patched_in":"2.35.0"}],"published":"2024-07-18T00:00:00Z","updated":"2024-07-19T07:36:48Z"},{"id":"wordfence:ca4cf299-9dee-4ebf-83f3-4c3471bd9fb0","source":"wordfence","cve":"CVE-2024-1336","title":"ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOn","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4cf299-9dee-4ebf-83f3-4c3471bd9fb0?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:26Z"},{"id":"wordfence:ca4dead2-c6da-4613-8ce6-13699a7495a1","source":"wordfence","cve":"CVE-2023-29428","title":"Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 - Missing Authorization via spbsmAjax","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4dead2-c6da-4613-8ce6-13699a7495a1?source=api-prod","affected":[{"type":"plugin","slug":"superb-social-share-and-follow-buttons","name":"Superb Social Media Share Buttons and Follow Buttons","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca4e2fa0-9b18-4318-b588-33d5bc3c5ab9","source":"wordfence","cve":"CVE-2026-23975","title":"Golo < 1.7.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4e2fa0-9b18-4318-b588-33d5bc3c5ab9?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:17:28Z"},{"id":"wordfence:ca4f243d-0a56-4b6c-86f9-6eb435203ddc","source":"wordfence","cve":"CVE-2026-32351","title":"PowerPress Podcasting <= 11.15.13 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca4f243d-0a56-4b6c-86f9-6eb435203ddc?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.15.13","to_inclusive":true,"patched_in":"11.15.14"}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:04:08Z"},{"id":"wordfence:ca50e5e7-be46-40f1-9782-a72ca8ab7e9a","source":"wordfence","cve":"CVE-2025-13857","title":"Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca50e5e7-be46-40f1-9782-a72ca8ab7e9a?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-webclap-for-wordpress","name":"Yet Another WebClap for WordPress","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T16:45:16Z","updated":"2025-12-06T05:49:34Z"},{"id":"wordfence:ca5381b3-0c7a-42e7-94ff-b5e9ecd5381c","source":"wordfence","cve":"CVE-2026-100506","title":"WP Spell Check <= 12.1 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5381b3-0c7a-42e7-94ff-b5e9ecd5381c?source=api-prod","affected":[{"type":"plugin","slug":"wp-spell-check","name":"WP Spell Check","from":"*","from_inclusive":true,"to":"12.1","to_inclusive":true,"patched_in":"12.2"}],"published":"2026-10-03T18:40:32Z","updated":"2026-10-08T22:53:00Z"},{"id":"wordfence:ca55a7a0-da31-4d3f-845b-80f89ffbadf5","source":"wordfence","cve":"CVE-2022-47165","title":"CoSchedule <= 3.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca55a7a0-da31-4d3f-845b-80f89ffbadf5?source=api-prod","affected":[{"type":"plugin","slug":"coschedule-by-todaymade","name":"CoSchedule","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca564941-4780-4da2-b937-c9bd45966d81","source":"wordfence","cve":"CVE-2023-5448","title":"WP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca564941-4780-4da2-b937-c9bd45966d81?source=api-prod","affected":[{"type":"plugin","slug":"wp-register-profile-with-shortcode","name":"WP Register Profile With Shortcode","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca57c103-094b-4e1f-8875-75f883ff10a7","source":"wordfence","cve":"CVE-2025-23562","title":"XLSXviewer <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca57c103-094b-4e1f-8875-75f883ff10a7?source=api-prod","affected":[{"type":"plugin","slug":"xlsx-viewer","name":"XLSXviewer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:00:47Z"},{"id":"wordfence:ca5b1ff6-19c5-4384-ae63-faf1f40122e7","source":"wordfence","cve":"CVE-2026-5400","title":"Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5b1ff6-19c5-4384-ae63-faf1f40122e7?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"4.5.14"}],"published":"2026-09-18T19:01:22Z","updated":"2026-09-19T07:43:20Z"},{"id":"wordfence:ca5bc2af-394b-4fc1-b6c3-ed9ff0a5959a","source":"wordfence","cve":"CVE-2024-24717","title":"Beds24 Online Booking <= 2.0.23 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5bc2af-394b-4fc1-b6c3-ed9ff0a5959a?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.23","to_inclusive":true,"patched_in":"2.0.24"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T16:17:15Z"},{"id":"wordfence:ca5befe9-7769-4367-84cf-05aabeced67a","source":"wordfence","cve":"CVE-2024-2350","title":"Clever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5befe9-7769-4367-84cf-05aabeced67a?source=api-prod","affected":[{"type":"plugin","slug":"cafe-lite","name":"Clever Addons for Elementor","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-06-05T13:03:48Z","updated":"2024-08-01T21:01:54Z"},{"id":"wordfence:ca5cb925-6f95-4f81-92d0-5f3c8e5f7d59","source":"wordfence","cve":"CVE-2026-11977","title":"WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5cb925-6f95-4f81-92d0-5f3c8e5f7d59?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.10.0"}],"published":"2026-08-04T19:33:14Z","updated":"2026-08-05T07:39:24Z"},{"id":"wordfence:ca5d61c9-7888-4364-a52b-978bc54e5edf","source":"wordfence","cve":"CVE-2026-109900","title":"Melapress Role Editor <= 1.3.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5d61c9-7888-4364-a52b-978bc54e5edf?source=api-prod","affected":[{"type":"plugin","slug":"melapress-role-editor","name":"Melapress Role Editor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-11-06T15:26:55Z","updated":"2026-11-10T19:12:54Z"},{"id":"wordfence:ca5fbb95-1b03-4bb9-850a-586b19a374ef","source":"wordfence","cve":"CVE-2025-60189","title":"PoloPag \u2013 Pix Autom\u00e1tico para Woocommerce <= 2.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5fbb95-1b03-4bb9-850a-586b19a374ef?source=api-prod","affected":[{"type":"plugin","slug":"wc-polo-payments","name":"PoloPag \u2013 Pix Autom\u00e1tico para eCommerce","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-07-28T00:00:00Z","updated":"2026-01-06T16:59:10Z"},{"id":"wordfence:ca616ae6-59d3-4037-b538-d371f007a037","source":"wordfence","cve":"CVE-2024-4870","title":"Frontend Registration \u2013 Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca616ae6-59d3-4037-b538-d371f007a037?source=api-prod","affected":[{"type":"plugin","slug":"frontend-registration-contact-form-7","name":"Frontend Registration \u2013 Contact Form 7","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-04T02:00:56Z"},{"id":"wordfence:ca62b54e-dde6-440f-bed9-db320179269e","source":"wordfence","cve":"CVE-2023-2568","title":"Photo Gallery by Ays <= 5.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca62b54e-dde6-440f-bed9-db320179269e?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca646202-b9e2-4272-b0e2-d39cd748fb8e","source":"wordfence","cve":"CVE-2024-4398","title":"HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca646202-b9e2-4272-b0e2-d39cd748fb8e?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.2.19","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-10T07:33:39Z"},{"id":"wordfence:ca64692b-b194-4ceb-975e-72e4041252f2","source":"wordfence","cve":"CVE-2022-2540","title":"Link Optimizer Lite <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca64692b-b194-4ceb-975e-72e4041252f2?source=api-prod","affected":[{"type":"plugin","slug":"link-optimizer-lite","name":"Link Optimizer Lite","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca648819-1771-405b-bec1-c511427aeea6","source":"wordfence","cve":"CVE-2026-82229","title":"Social Login, Social Sharing by miniOrange <= 7.8.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca648819-1771-405b-bec1-c511427aeea6?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"7.9.0"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:53:04Z"},{"id":"wordfence:ca66afc3-a749-4ddc-8e2f-959f65cebd45","source":"wordfence","cve":"CVE-2023-2517","title":"Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca66afc3-a749-4ddc-8e2f-959f65cebd45?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca66c98c-66cb-4573-ae27-bec8a5541583","source":"wordfence","cve":"CVE-2025-58798","title":"BCM Duplicate Menu <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca66c98c-66cb-4573-ae27-bec8a5541583?source=api-prod","affected":[{"type":"plugin","slug":"bcm-duplicate-menu","name":"BCM Duplicate Menu","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:55:23Z"},{"id":"wordfence:ca6756d0-d1d2-41b3-ad62-fc665a281e6b","source":"wordfence","cve":"CVE-2023-37992","title":"Smarty for WordPress <= 3.1.35 - Cross-Site Request Forgery via displaySmartyManagementPage","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6756d0-d1d2-41b3-ad62-fc665a281e6b?source=api-prod","affected":[{"type":"plugin","slug":"smarty-for-wordpress","name":"Smarty for WordPress","from":"*","from_inclusive":true,"to":"3.1.35","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca686024-1479-48ed-8e21-4ebe3c981560","source":"wordfence","cve":"CVE-2024-50418","title":"Time Slot <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca686024-1479-48ed-8e21-4ebe3c981560?source=api-prod","affected":[{"type":"plugin","slug":"timeslot","name":"Time Slot \u2013 Booking and Appointment System","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:51:14Z"},{"id":"wordfence:ca699e12-efbd-4684-a789-e137a304416f","source":"wordfence","cve":"CVE-2026-62053","title":"Wine House | Winery & Restaurant WordPress Theme <= 3.20 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca699e12-efbd-4684-a789-e137a304416f?source=api-prod","affected":[{"type":"theme","slug":"wine-house","name":"Wine House | Winery & Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"3.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T07:27:18Z","updated":"2026-10-13T13:59:43Z"},{"id":"wordfence:ca6aa922-9c58-445c-b88a-3d1d1c95102c","source":"wordfence","cve":"CVE-2026-6072","title":"Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=api-prod","affected":[{"type":"plugin","slug":"oliver-pos","name":"Oliver POS \u2013 WooCommerce POS for iPhone, iPad & Android","from":"*","from_inclusive":true,"to":"2.4.2.6","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-05-19T12:03:04Z","updated":"2026-05-28T14:44:33Z"},{"id":"wordfence:ca6b7886-790a-4f00-855c-6dc913ea01db","source":"wordfence","cve":"CVE-2014-125105","title":"Broken Link Checker < 1.10.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6b7886-790a-4f00-855c-6dc913ea01db?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":false,"patched_in":"1.10.2"}],"published":"2014-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca6bdde6-f381-4ccb-8984-519cf9aca0b1","source":"wordfence","cve":"CVE-2024-12176","title":"WordLift \u2013 AI powered SEO \u2013 Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6bdde6-f381-4ccb-8984-519cf9aca0b1?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.54.2","to_inclusive":true,"patched_in":"3.54.3"}],"published":"2025-01-06T15:41:43Z","updated":"2025-07-25T19:37:37Z"},{"id":"wordfence:ca6c0527-5a1c-4bf3-af71-8e40381f0c1c","source":"wordfence","cve":"CVE-2026-57394","title":"Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6c0527-5a1c-4bf3-af71-8e40381f0c1c?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.14","to_inclusive":true,"patched_in":"4.15"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:45:21Z"},{"id":"wordfence:ca6f87ee-2a2f-44fc-af3c-f8ecb420cd04","source":"wordfence","cve":"CVE-2026-27077","title":"MultiOffice <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6f87ee-2a2f-44fc-af3c-f8ecb420cd04?source=api-prod","affected":[{"type":"theme","slug":"multioffice","name":"MultiOffice - Coworking Space WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:48:49Z"},{"id":"wordfence:ca729178-8df0-437e-82cc-70c4975f7b47","source":"wordfence","cve":"","title":"MailPoet Newsletters <= 2.7.2 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca729178-8df0-437e-82cc-70c4975f7b47?source=api-prod","affected":[{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2016-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca72924f-23fc-42ef-9556-8fb9f5e88add","source":"wordfence","cve":"CVE-2014-4941","title":"Cross-RSS <= 1.7 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca72924f-23fc-42ef-9556-8fb9f5e88add?source=api-prod","affected":[{"type":"plugin","slug":"cross-rss","name":"Cross-RSS","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2014-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca73de6d-2d47-4d7c-a917-0f99fed8c27d","source":"wordfence","cve":"CVE-2023-28426","title":"SVG Sanitizer library <= 0.15.4 - Cross-Site Scripting Bypass","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca73de6d-2d47-4d7c-a917-0f99fed8c27d?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca74b5b1-e4dd-4ca9-8716-b9d0f5adcc0d","source":"wordfence","cve":"CVE-2026-57661","title":"WPComplete <= 2.9.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca74b5b1-e4dd-4ca9-8716-b9d0f5adcc0d?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.5","to_inclusive":true,"patched_in":"2.9.5.6"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:49:20Z"},{"id":"wordfence:ca74bb1d-1954-4869-aaa9-bf66600cdf2a","source":"wordfence","cve":"CVE-2026-1097","title":"ThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca74bb1d-1954-4869-aaa9-bf66600cdf2a?source=api-prod","affected":[{"type":"plugin","slug":"themeruby-multi-authors","name":"ThemeRuby Multi Authors \u2013 Assign Multiple Writers to Posts","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-01-23T19:24:56Z","updated":"2026-02-03T19:01:19Z"},{"id":"wordfence:ca77c769-a5e4-406f-954b-00bd767909ec","source":"wordfence","cve":"CVE-2024-54435","title":"Onlywire Multi Autosubmitter <= 1.2.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca77c769-a5e4-406f-954b-00bd767909ec?source=api-prod","affected":[{"type":"plugin","slug":"onlywire-multi-autosubmitter","name":"Onlywire Multi Autosubmitter","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T11:00:08Z"},{"id":"wordfence:ca7a968d-b1e9-4e8b-803a-58269910d9ff","source":"wordfence","cve":"CVE-2025-69362","title":"UiChemy <= 4.4.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7a968d-b1e9-4e8b-803a-58269910d9ff?source=api-prod","affected":[{"type":"plugin","slug":"uichemy","name":"UiChemy \u2013 Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T16:16:20Z"},{"id":"wordfence:ca7dfdea-b9c6-4108-8d18-1f952180cd3d","source":"wordfence","cve":"CVE-2025-49978","title":"JobSearch < 3.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7dfdea-b9c6-4108-8d18-1f952180cd3d?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":false,"patched_in":"3.0.6"}],"published":"2025-06-19T00:00:00Z","updated":"2026-02-26T15:27:54Z"},{"id":"wordfence:ca7e7419-5e1f-42f3-8dad-78d536b36888","source":"wordfence","cve":"CVE-2024-44031","title":"JoomSport <= 5.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7e7419-5e1f-42f3-8dad-78d536b36888?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.6.3","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:06:20Z"},{"id":"wordfence:ca7e89fc-4d85-4512-9e27-e212d57e0e35","source":"wordfence","cve":"CVE-2026-25338","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7e89fc-4d85-4512-9e27-e212d57e0e35?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-02-08T00:00:00Z","updated":"2026-05-04T15:44:49Z"},{"id":"wordfence:ca7f1b56-a732-40c1-a05e-4ab3e6b05037","source":"wordfence","cve":"CVE-2023-7115","title":"Page Builder: Pagelayer <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7f1b56-a732-40c1-a05e-4ab3e6b05037?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-12-24T00:00:00Z","updated":"2024-03-22T16:34:20Z"},{"id":"wordfence:ca7f72bf-5271-42a2-99cb-3021f10ea5f3","source":"wordfence","cve":"CVE-2022-29423","title":"Countdown & Clock <= 2.3.2 - Pro Features Lock Bypass","severity":"low","cvss":3.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca7f72bf-5271-42a2-99cb-3021f10ea5f3?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2022-04-28T12:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca803e6b-efbd-45e7-990d-d60d5d03fac5","source":"wordfence","cve":"CVE-2025-26736","title":"MorningTime Lite <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca803e6b-efbd-45e7-990d-d60d5d03fac5?source=api-prod","affected":[{"type":"theme","slug":"morningtime-lite","name":"MorningTime Lite","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:36:59Z"},{"id":"wordfence:ca868ec4-9d28-4edd-b31c-a8546f9ced9e","source":"wordfence","cve":"CVE-2025-22508","title":"FAT Event Lite <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca868ec4-9d28-4edd-b31c-a8546f9ced9e?source=api-prod","affected":[{"type":"plugin","slug":"fat-event-lite","name":"FAT Event Lite","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:52:05Z"},{"id":"wordfence:ca878f27-f837-412b-8d63-9decb40dc8a5","source":"wordfence","cve":"CVE-2024-6809","title":"Simple Video Directory <= 1.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca878f27-f837-412b-8d63-9decb40dc8a5?source=api-prod","affected":[{"type":"plugin","slug":"simple-media-directory","name":"Simple Video Directory","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-05-21T00:00:00Z","updated":"2025-05-29T22:37:53Z"},{"id":"wordfence:ca88c62d-0f27-40e0-9dd2-21d3d133fda3","source":"wordfence","cve":"CVE-2024-33544","title":"WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca88c62d-0f27-40e0-9dd2-21d3d133fda3?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.0.10","to_inclusive":true,"patched_in":"14.0.31"}],"published":"2024-04-25T00:00:00Z","updated":"2026-03-17T21:19:45Z"},{"id":"wordfence:ca8aa00f-01c4-47c6-818f-c34a68827657","source":"wordfence","cve":"CVE-2026-86837","title":"Bookly <= 28.2 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca8aa00f-01c4-47c6-818f-c34a68827657?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:12:06Z"},{"id":"wordfence:ca8c676a-144c-4809-b8f6-50cb9e1390b5","source":"wordfence","cve":"CVE-2015-9516","title":"Easy Digital Downloads \u2013 Invoices <= 1.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca8c676a-144c-4809-b8f6-50cb9e1390b5?source=api-prod","affected":[{"type":"plugin","slug":"edd-invoices","name":"Easy Digital Downloads \u2013 Invoices","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca8dfd10-8c35-4c19-bfb1-8807ef8ab421","source":"wordfence","cve":"CVE-2026-124271","title":"Restrict User Access \u2013 Ultimate Membership & Content Protection <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca8dfd10-8c35-4c19-bfb1-8807ef8ab421?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:02:19Z"},{"id":"wordfence:ca8f4f6b-756b-4511-9e48-e41a872a9dad","source":"wordfence","cve":"","title":"Contextual Related Posts <= 3.3.1 - Cross-Site Request Forgery in crpClearCache","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca8f4f6b-756b-4511-9e48-e41a872a9dad?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca8fe2c6-2a7e-4fed-baf0-c8a4979ab966","source":"wordfence","cve":"CVE-2024-37556","title":"WordPress Notification Bar <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca8fe2c6-2a7e-4fed-baf0-c8a4979ab966?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-notification-bar","name":"WordPress Notification Bar","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-11T14:11:54Z"},{"id":"wordfence:ca91046d-61c1-4a65-a078-c7dffb27092c","source":"wordfence","cve":"CVE-2023-23710","title":"WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca91046d-61c1-4a65-a078-c7dffb27092c?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.5.14","to_inclusive":true,"patched_in":"7.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca91e41d-b728-4eb0-86d5-043813d8c2c1","source":"wordfence","cve":"CVE-2023-6961","title":"WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca91e41d-b728-4eb0-86d5-043813d8c2c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-seo","name":"WP Meta SEO","from":"*","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"4.5.13"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:37:26Z"},{"id":"wordfence:ca94c815-488f-4d86-a642-39d2de803763","source":"wordfence","cve":"CVE-2025-14608","title":"WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca94c815-488f-4d86-a642-39d2de803763?source=api-prod","affected":[{"type":"plugin","slug":"wp-last-modified-info","name":"WP Last Modified Info","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2026-02-13T00:00:00Z","updated":"2026-02-14T03:25:28Z"},{"id":"wordfence:ca954d68-18a5-47e2-af56-261c7a55b017","source":"wordfence","cve":"CVE-2023-51536","title":"CRM Perks Forms <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca954d68-18a5-47e2-af56-261c7a55b017?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ca97a718-7508-4bc0-8f8e-7849eb9a0dc0","source":"wordfence","cve":"CVE-2026-18510","title":"TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca97a718-7508-4bc0-8f8e-7849eb9a0dc0?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.3"}],"published":"2026-08-05T17:09:31Z","updated":"2026-08-06T05:29:25Z"},{"id":"wordfence:ca985d5d-56b9-4bf9-b51c-1d1a71c21a0d","source":"wordfence","cve":"CVE-2025-23829","title":"Woo Update Variations In Cart <= 0.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca985d5d-56b9-4bf9-b51c-1d1a71c21a0d?source=api-prod","affected":[{"type":"plugin","slug":"woo-update-variations-in-cart","name":"Woo Update Variations In Cart","from":"*","from_inclusive":true,"to":"0.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:41:27Z"},{"id":"wordfence:ca989077-60c8-4bd9-a91b-fbefd2ccc49b","source":"wordfence","cve":"CVE-2026-40724","title":"Client Portal (Pro) <= 5.6.2 - Authenticated (CP Client+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca989077-60c8-4bd9-a91b-fbefd2ccc49b?source=api-prod","affected":[{"type":"plugin","slug":"leco-client-portal","name":"Client Portal Pro","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":true,"patched_in":"5.6.3"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T15:15:25Z"},{"id":"wordfence:ca98fbc6-8cfa-4997-8a46-344afb75a97e","source":"wordfence","cve":"CVE-2024-2654","title":"File Manager <= 7.2.5 - Authenticated (Administrator+) Directory Traversal","severity":"medium","cvss":6.8,"cwe":"CWE-35","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca98fbc6-8cfa-4997-8a46-344afb75a97e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.2.5","to_inclusive":true,"patched_in":"7.2.6"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-09T18:59:21Z"},{"id":"wordfence:ca9ad8ca-aad1-4950-b540-64ffc4a07c12","source":"wordfence","cve":"CVE-2025-8567","title":"Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca9ad8ca-aad1-4950-b540-64ffc4a07c12?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-08-18T19:56:11Z","updated":"2025-08-19T08:24:17Z"},{"id":"wordfence:ca9c10b6-6d32-45c9-beb1-7a5c84d0863d","source":"wordfence","cve":"CVE-2014-125099","title":"I Recommend This <= 3.7.2 - Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ca9c10b6-6d32-45c9-beb1-7a5c84d0863d?source=api-prod","affected":[{"type":"plugin","slug":"i-recommend-this","name":"I Recommend This \u2013 Love/Like Button for WordPress Posts","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2014-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa09e12-60f9-4ef4-85f7-dadb6833e077","source":"wordfence","cve":"CVE-2021-24351","title":"The Plus Addons for Elementor Page Builder <= 4.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa09e12-60f9-4ef4-85f7-dadb6833e077?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":false,"patched_in":"4.1.12"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa0f581-3fe8-4b9f-b69c-ec38ee25d697","source":"wordfence","cve":"CVE-2020-15038","title":"Coming Soon Page by SeedProd <= 5.1.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa0f581-3fe8-4b9f-b69c-ec38ee25d697?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":false,"patched_in":"5.1.2"}],"published":"2020-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa1a42a-6bb2-42c8-aae7-fb1c895573a8","source":"wordfence","cve":"CVE-2026-18467","title":"Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa1a42a-6bb2-42c8-aae7-fb1c895573a8?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2026-09-23T13:14:06Z","updated":"2026-09-24T01:28:01Z"},{"id":"wordfence:caa23ec8-547b-425e-94bd-297d12702256","source":"wordfence","cve":"CVE-2025-68835","title":"Ravpage <= 2.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa23ec8-547b-425e-94bd-297d12702256?source=api-prod","affected":[{"type":"plugin","slug":"ravpage","name":"ravpage","from":"*","from_inclusive":true,"to":"2.40","to_inclusive":true,"patched_in":"2.41"}],"published":"2026-01-20T00:00:00Z","updated":"2026-06-18T14:56:05Z"},{"id":"wordfence:caa292cc-d907-4190-8d47-d311c7a19991","source":"wordfence","cve":"CVE-2024-51811","title":"Popup Image <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa292cc-d907-4190-8d47-d311c7a19991?source=api-prod","affected":[{"type":"plugin","slug":"popup-image","name":"Popup Image","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:54:15Z"},{"id":"wordfence:caa2bbdf-353e-49a2-b0e5-d9236848a211","source":"wordfence","cve":"CVE-2022-2350","title":"Disable User Login <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa2bbdf-353e-49a2-b0e5-d9236848a211?source=api-prod","affected":[{"type":"plugin","slug":"wp-users-disable","name":"Disable User Login","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa39613-aaf3-4e47-8866-8fda1f7fc15b","source":"wordfence","cve":"","title":"Booking Calendar WpDevArt <= 3.2.11 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa39613-aaf3-4e47-8866-8fda1f7fc15b?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.11","to_inclusive":true,"patched_in":"3.2.12"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa4aed4-0761-4ea6-841a-544a7f2ecb21","source":"wordfence","cve":"CVE-2026-32403","title":"Toocheke Companion <= 1.194 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa4aed4-0761-4ea6-841a-544a7f2ecb21?source=api-prod","affected":[{"type":"plugin","slug":"toocheke-companion","name":"Toocheke Companion","from":"*","from_inclusive":true,"to":"1.194","to_inclusive":true,"patched_in":"1.195"}],"published":"2026-02-21T00:00:00Z","updated":"2026-04-15T20:58:22Z"},{"id":"wordfence:caa5b9aa-e98c-48fc-9e63-0a1380465918","source":"wordfence","cve":"CVE-2026-11395","title":"CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa5b9aa-e98c-48fc-9e63-0a1380465918?source=api-prod","affected":[{"type":"plugin","slug":"cf7-to-zapier","name":"CF7 to Webhook","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-06-17T18:15:54Z","updated":"2026-06-18T06:50:07Z"},{"id":"wordfence:caa66246-7ffa-4944-ae3a-9c872300b7d4","source":"wordfence","cve":"CVE-2018-20151","title":"WordPress Core < 5.0.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa66246-7ffa-4944-ae3a-9c872300b7d4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caa73e10-fc2d-4a51-a2fb-6f13817e7c74","source":"wordfence","cve":"CVE-2025-67598","title":"SupportCandy <= 3.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa73e10-fc2d-4a51-a2fb-6f13817e7c74?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-11T17:10:24Z"},{"id":"wordfence:caa97ae8-40a8-4ca1-820b-83675c053bfc","source":"wordfence","cve":"CVE-2024-1565","title":"EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa97ae8-40a8-4ca1-820b-83675c053bfc?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.9.11"}],"published":"2024-06-12T20:25:10Z","updated":"2024-06-13T08:31:33Z"},{"id":"wordfence:caae093e-58e8-48b1-8665-2a5f49e98c58","source":"wordfence","cve":"CVE-2011-5207","title":"TheCartPress eCommerce Shopping Cart <= 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caae093e-58e8-48b1-8665-2a5f49e98c58?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2011-12-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caae3272-0a3d-4f71-8808-c503b5470caa","source":"wordfence","cve":"CVE-2026-94674","title":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.69.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caae3272-0a3d-4f71-8808-c503b5470caa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-google-adwords-conversion-tracking-tag","name":"Pixel Manager for WooCommerce \u2013 Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing","from":"*","from_inclusive":true,"to":"1.69.0","to_inclusive":true,"patched_in":"1.69.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:54:34Z"},{"id":"wordfence:cab034fd-4cf2-4253-bbcd-c8bb86325fa8","source":"wordfence","cve":"CVE-2025-12109","title":"Header Footer Script Adder \u2013 Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab034fd-4cf2-4253-bbcd-c8bb86325fa8?source=api-prod","affected":[{"type":"plugin","slug":"header-and-footer-script-adder","name":"Header Footer Script Adder","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-12-12T15:27:51Z","updated":"2025-12-13T04:31:34Z"},{"id":"wordfence:cab1d5a0-66e0-4017-8563-f8e582a6f964","source":"wordfence","cve":"CVE-2020-12074","title":"Product Import Export for WooCommerce <= 1.7.4 - Missing Authorization to CSV Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab1d5a0-66e0-4017-8563-f8e582a6f964?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2020-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cab22e97-ee7f-4be2-9381-ba16b67456b9","source":"wordfence","cve":"CVE-2025-30857","title":"Currency Switcher for WooCommerce <= 0.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab22e97-ee7f-4be2-9381-ba16b67456b9?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher-for-woocommerce","name":"Currency Switcher for WooCommerce","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":"0.0.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:39:26Z"},{"id":"wordfence:cab2f0d7-f288-4462-b2a7-7a999cd47466","source":"wordfence","cve":"CVE-2018-20964","title":"Contact Form Email <= 1.2.65 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab2f0d7-f288-4462-b2a7-7a999cd47466?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.2.65","to_inclusive":true,"patched_in":"1.2.66"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cab56873-f79c-4fd2-8d40-ee4a338cbe8b","source":"wordfence","cve":"CVE-2024-2665","title":"Premium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab56873-f79c-4fd2-8d40-ee4a338cbe8b?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.27","to_inclusive":true,"patched_in":"4.10.28"}],"published":"2024-04-09T00:00:00Z","updated":"2024-10-24T19:29:49Z"},{"id":"wordfence:cab89b56-d989-40c4-83be-2de3b1a91382","source":"wordfence","cve":"CVE-2026-40756","title":"Zoya <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab89b56-d989-40c4-83be-2de3b1a91382?source=api-prod","affected":[{"type":"theme","slug":"zoya","name":"Zoya - Minimal Blog Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:19:28Z"},{"id":"wordfence:cab9eb4f-6ce6-473a-8248-85e7208c366e","source":"wordfence","cve":"CVE-2025-62027","title":"Event Tickets <= 5.26.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab9eb4f-6ce6-473a-8248-85e7208c366e?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.26.3","to_inclusive":true,"patched_in":"5.26.4"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:29:29Z"},{"id":"wordfence:cab9f082-6f9d-443c-8cf0-4cfe2516e39c","source":"wordfence","cve":"CVE-2025-31014","title":"Material Dashboard <= 1.4.5 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cab9f082-6f9d-443c-8cf0-4cfe2516e39c?source=api-prod","affected":[{"type":"plugin","slug":"material-dashboard","name":"Material Dashboard","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:32:27Z"},{"id":"wordfence:cabb5976-375a-4f67-8ffd-6dd56d48b81d","source":"wordfence","cve":"CVE-2025-53344","title":"Thim Core <= 2.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabb5976-375a-4f67-8ffd-6dd56d48b81d?source=api-prod","affected":[{"type":"plugin","slug":"thim-core","name":"Thim Core","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T20:36:41Z"},{"id":"wordfence:cabb9be3-581a-48d9-afa2-929921eae52d","source":"wordfence","cve":"CVE-2024-37091","title":"Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabb9be3-581a-48d9-afa2-929921eae52d?source=api-prod","affected":[{"type":"plugin","slug":"consulting-elementor-widgets","name":"Consulting Elementor Widgets","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T20:36:14Z"},{"id":"wordfence:cabdc9db-2d1c-4390-a4b7-65648ef9f16a","source":"wordfence","cve":"CVE-2023-33924","title":"SIS Handball <= 1.0.45 - Authenticated (Administrator+) SQL Injection via 'orderby'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabdc9db-2d1c-4390-a4b7-65648ef9f16a?source=api-prod","affected":[{"type":"plugin","slug":"sis-handball","name":"SIS Handball","from":"*","from_inclusive":true,"to":"1.0.45","to_inclusive":true,"patched_in":""}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cabe5d20-710c-47d7-a5a3-562287ab5706","source":"wordfence","cve":"CVE-2022-23980","title":"Yasr \u2013 Yet Another Stars Rating  <= 2.9.9 - Cross-Site Scripting via source","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabe5d20-710c-47d7-a5a3-562287ab5706?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-02-03T21:54:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cabf776d-8749-45a8-94c1-7d1eef93a183","source":"wordfence","cve":"CVE-2025-9488","title":"Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabf776d-8749-45a8-94c1-7d1eef93a183?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-13T04:31:34Z"},{"id":"wordfence:cabf7aae-0673-4358-a2df-0ca22c8432b5","source":"wordfence","cve":"CVE-2023-4148","title":"Ditty <= 3.1.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cabf7aae-0673-4358-a2df-0ca22c8432b5?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.25","to_inclusive":false,"patched_in":"3.1.25"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cac05073-0ac9-45be-9fd0-e812d9fd2437","source":"wordfence","cve":"CVE-2025-48303","title":"Post Type Converter <= 0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac05073-0ac9-45be-9fd0-e812d9fd2437?source=api-prod","affected":[{"type":"plugin","slug":"post-type-converter","name":"Post Type Converter","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T19:57:36Z"},{"id":"wordfence:cac076c6-41b7-4daa-8703-2d6a2f01d02e","source":"wordfence","cve":"CVE-2025-39581","title":"Themify Shortcodes <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac076c6-41b7-4daa-8703-2d6a2f01d02e?source=api-prod","affected":[{"type":"plugin","slug":"themify-shortcodes","name":"Themify Shortcodes","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:18:46Z"},{"id":"wordfence:cac173ab-0f28-4d00-9e4f-f1819d62d92f","source":"wordfence","cve":"CVE-2026-85001","title":"EmbedPress 4.4.9 - 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac173ab-0f28-4d00-9e4f-f1819d62d92f?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"4.4.9","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.7"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:56:20Z"},{"id":"wordfence:cac1c1fa-7d6c-43c3-885e-9be320cb8f83","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac1c1fa-7d6c-43c3-885e-9be320cb8f83?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:29:41Z"},{"id":"wordfence:cac2a45e-f09e-4639-9a45-68d528a5094e","source":"wordfence","cve":"CVE-2023-6500","title":"Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac2a45e-f09e-4639-9a45-68d528a5094e?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.6.10"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:37:26Z"},{"id":"wordfence:cac4482e-bdf8-434a-ad22-ca2eeec15906","source":"wordfence","cve":"CVE-2024-44028","title":"NiceJob <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac4482e-bdf8-434a-ad22-ca2eeec15906?source=api-prod","affected":[{"type":"plugin","slug":"nicejob","name":"NiceJob","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:19:22Z"},{"id":"wordfence:cac4608e-9eee-4e36-b219-a6133bac8a5f","source":"wordfence","cve":"CVE-2024-37519","title":"Premium Blocks \u2013 Gutenberg Blocks for WordPress <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac4608e-9eee-4e36-b219-a6133bac8a5f?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.1.27","to_inclusive":true,"patched_in":"2.1.28"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T20:47:12Z"},{"id":"wordfence:cac5e5ca-34cc-4219-96a3-438c5a1d6a23","source":"wordfence","cve":"CVE-2026-15095","title":"Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5e5ca-34cc-4219-96a3-438c5a1d6a23?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.43","to_inclusive":true,"patched_in":"6.6.44"}],"published":"2026-09-21T20:03:56Z","updated":"2026-09-22T08:27:19Z"},{"id":"wordfence:cac5f723-f273-4c19-83ff-9110ec4f86a5","source":"wordfence","cve":"CVE-2026-28153","title":"Notification Master \u2013 Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac5f723-f273-4c19-83ff-9110ec4f86a5?source=api-prod","affected":[{"type":"plugin","slug":"notification-master","name":"Notification Master \u2013 Real-Time WordPress Notifications With Email, SMS, Webhooks & More","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-08-20T00:00:00Z","updated":"2026-10-28T21:13:44Z"},{"id":"wordfence:cac6c4f3-ac60-45d6-a5ba-6708fc1491a4","source":"wordfence","cve":"CVE-2026-109513","title":"NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac6c4f3-ac60-45d6-a5ba-6708fc1491a4?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2026-10-15T16:29:54Z","updated":"2026-10-16T05:30:27Z"},{"id":"wordfence:cac9614d-3fe5-4657-af6b-81acb71f51f1","source":"wordfence","cve":"CVE-2021-24927","title":"My Calendar <= 3.2.17 - Subscriber+ Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac9614d-3fe5-4657-af6b-81acb71f51f1?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.2.17","to_inclusive":true,"patched_in":"3.2.18"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cacd31bd-ccc6-49fa-89f1-09f3c5cd9072","source":"wordfence","cve":"","title":"Captcha 4.3.6 - 4.4.4 - Plugin Backdoor","severity":"critical","cvss":9.6,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cacd31bd-ccc6-49fa-89f1-09f3c5cd9072?source=api-prod","affected":[{"type":"plugin","slug":"captcha","name":"Captcha","from":"4.3.6","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cacd9237-a330-4927-ac53-ee86b9ac8289","source":"wordfence","cve":"CVE-2026-40773","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cacd9237-a330-4927-ac53-ee86b9ac8289?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"4.7.10"}],"published":"2026-04-21T00:00:00Z","updated":"2026-04-30T14:41:33Z"},{"id":"wordfence:cace29fd-95d0-48ea-8dfa-6fd12dd9ccbf","source":"wordfence","cve":"CVE-2022-2168","title":"Download Manager <= 3.2.43 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cace29fd-95d0-48ea-8dfa-6fd12dd9ccbf?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.43","to_inclusive":true,"patched_in":"3.2.44"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cacf2e32-12cf-41a9-a57f-1135c165494c","source":"wordfence","cve":"CVE-2025-12482","title":"Booking for Appointments and Events Calendar \u2013 Amelia <= 1.2.35 - Unauthenticated SQL Injection via search","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cacf2e32-12cf-41a9-a57f-1135c165494c?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.2.35","to_inclusive":true,"patched_in":"1.2.36"}],"published":"2025-11-15T15:54:28Z","updated":"2025-11-16T04:17:30Z"},{"id":"wordfence:cad19306-6eef-4f80-9442-e7b314b3a873","source":"wordfence","cve":"CVE-2024-0369","title":"Bulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitles","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad19306-6eef-4f80-9442-e7b314b3a873?source=api-prod","affected":[{"type":"plugin","slug":"bulk-edit-post-titles","name":"Bulk Edit Post Titles","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:37:26Z"},{"id":"wordfence:cad2334c-21f5-40bc-8b08-32c12ce1e077","source":"wordfence","cve":"CVE-2026-110530","title":"FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad2334c-21f5-40bc-8b08-32c12ce1e077?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2026.0517","to_inclusive":true,"patched_in":"2026.1016"}],"published":"2026-10-30T20:11:36Z","updated":"2026-10-31T08:30:47Z"},{"id":"wordfence:cad4300f-02f9-4c9f-9bb3-1c9da8b78ac9","source":"wordfence","cve":"CVE-2024-8663","title":"WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad4300f-02f9-4c9f-9bb3-1c9da8b78ac9?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-booking-calendar","name":"WP Simple Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-09-12T18:24:38Z","updated":"2024-09-13T06:47:30Z"},{"id":"wordfence:cad4c72d-9374-410a-91b7-5e9aff01738b","source":"wordfence","cve":"CVE-2023-23745","title":"MainWP Boilerplate Extension <= 4.1 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad4c72d-9374-410a-91b7-5e9aff01738b?source=api-prod","affected":[{"type":"plugin","slug":"boilerplate-extension","name":"MainWP Boilerplate Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cad5274f-0d73-425d-bdfb-478c77d55d6c","source":"wordfence","cve":"","title":"WordPress Download Manager <= 2.9.96 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad5274f-0d73-425d-bdfb-478c77d55d6c?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.97","to_inclusive":false,"patched_in":"2.9.97"}],"published":"2019-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cad57b23-1d0a-4676-a52a-51ae0a13d126","source":"wordfence","cve":"CVE-2025-49061","title":"Porn Videos Embed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad57b23-1d0a-4676-a52a-51ae0a13d126?source=api-prod","affected":[{"type":"plugin","slug":"porn-videos-embed","name":"Porn Videos Embed","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-06T00:00:00Z","updated":"2025-08-11T14:38:49Z"},{"id":"wordfence:cad7731a-1f81-4055-9b49-15b35edd3fcf","source":"wordfence","cve":"CVE-2024-9417","title":"Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload","severity":"medium","cvss":6.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad7731a-1f81-4055-9b49-15b35edd3fcf?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-10-04T00:00:00Z","updated":"2024-10-05T09:39:22Z"},{"id":"wordfence:cad821ec-04f5-4cff-8846-628d183502fd","source":"wordfence","cve":"CVE-2025-48161","title":"YaySMTP <= 1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cad821ec-04f5-4cff-8846-628d183502fd?source=api-prod","affected":[{"type":"plugin","slug":"smtp-sendinblue","name":"Brevo SMTP \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:56:02Z"},{"id":"wordfence:cadb77be-1b57-4c05-8fb2-cc5916a215a4","source":"wordfence","cve":"CVE-2024-52433","title":"My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cadb77be-1b57-4c05-8fb2-cc5916a215a4?source=api-prod","affected":[{"type":"plugin","slug":"my-geo-posts-free","name":"My Geo Posts Free","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:32:31Z"},{"id":"wordfence:cadd47e9-1d5b-4f04-8421-7707dad53ea6","source":"wordfence","cve":"","title":"Google Forms <= 0.90 - Unauthenticated PHP Object injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cadd47e9-1d5b-4f04-8421-7707dad53ea6?source=api-prod","affected":[{"type":"plugin","slug":"wpgform","name":"Google Forms","from":"*","from_inclusive":true,"to":"0.91","to_inclusive":false,"patched_in":"0.91"}],"published":"2017-01-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae15a1c-63bc-4349-aba3-7f34737d6045","source":"wordfence","cve":"CVE-2024-29220","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae15a1c-63bc-4349-aba3-7f34737d6045?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-07T19:20:28Z"},{"id":"wordfence:cae1e209-96f3-49ed-a233-768db8e36c5b","source":"wordfence","cve":"","title":"Event Management, Events Calendar, RSVP Event Tickets Plugin <= 3.8.4 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae1e209-96f3-49ed-a233-768db8e36c5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-events","name":"Event RSVP and Simple Event Management Plugin","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.8.5"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae1e984-95b2-4b76-b6b3-563dc3104a72","source":"wordfence","cve":"","title":"Woo Custom Checkout Field < 1.3.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae1e984-95b2-4b76-b6b3-563dc3104a72?source=api-prod","affected":[{"type":"plugin","slug":"woo-custom-checkout-field","name":"Woo Custom Checkout Field","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":false,"patched_in":"1.3.5"}],"published":"2016-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae1f5c7-ae91-4f45-8b4f-b2be89d36437","source":"wordfence","cve":"CVE-2012-6312","title":"Video Lead Form < 0.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae1f5c7-ae91-4f45-8b4f-b2be89d36437?source=api-prod","affected":[{"type":"plugin","slug":"video-lead-form","name":"Video Lead Form","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":false,"patched_in":"0.6"}],"published":"2012-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae284dd-34e0-4dc5-a954-b37935f3cfbc","source":"wordfence","cve":"CVE-2022-1938","title":"Awin Data Feed <= 1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae284dd-34e0-4dc5-a954-b37935f3cfbc?source=api-prod","affected":[{"type":"plugin","slug":"awin-data-feed","name":"Awin Data Feed","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae45f7d-0ffe-41c4-9d1c-3211d6f86e5c","source":"wordfence","cve":"CVE-2025-23826","title":"Stop Comment Spam <= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae45f7d-0ffe-41c4-9d1c-3211d6f86e5c?source=api-prod","affected":[{"type":"plugin","slug":"stop-comment-spam","name":"Stop Comment Spam","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":"0.5.4"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:43:11Z"},{"id":"wordfence:cae6e8b9-a8a9-41d3-83e8-d833515a0244","source":"wordfence","cve":"CVE-2023-52225","title":"Taggbox <= 3.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae6e8b9-a8a9-41d3-83e8-d833515a0244?source=api-prod","affected":[{"type":"plugin","slug":"taggbox-widget","name":"Taggbox: Social Media Feed Widget","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-01-05T00:00:00Z","updated":"2026-02-26T14:53:44Z"},{"id":"wordfence:cae72c7e-9bc8-40a7-b125-c9e8c86b14bf","source":"wordfence","cve":"CVE-2021-38348","title":"Advance Search <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae72c7e-9bc8-40a7-b125-c9e8c86b14bf?source=api-prod","affected":[{"type":"plugin","slug":"advance-search","name":"Advanced Search","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae74177-7bfc-4fe2-9d45-0bc567a17909","source":"wordfence","cve":"CVE-2022-4302","title":"White Label CMS <= 2.4 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae74177-7bfc-4fe2-9d45-0bc567a17909?source=api-prod","affected":[{"type":"plugin","slug":"white-label-cms","name":"White Label CMS","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cae7dabd-ce43-43e3-9f67-b2de55bd720b","source":"wordfence","cve":"CVE-2026-9829","title":"Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cae7dabd-ce43-43e3-9f67-b2de55bd720b?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.41","to_inclusive":true,"patched_in":"1.8.42"}],"published":"2026-06-05T15:34:43Z","updated":"2026-06-06T04:28:23Z"},{"id":"wordfence:caea83eb-d1d0-4fe2-999f-bc34807db552","source":"wordfence","cve":"CVE-2026-79621","title":"CatalogX \u2013 Catalog Mode, Enquiry & Quotes for WooCommerce < 6.1.3 - Unauthenticated Email Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caea83eb-d1d0-4fe2-999f-bc34807db552?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":false,"patched_in":"6.1.3"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:36:15Z"},{"id":"wordfence:caeaaf52-79c3-4617-b7aa-ae46c555c71f","source":"wordfence","cve":"CVE-2026-112824","title":"Bus Ticket Booking with Seat Reservation <= 5.9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caeaaf52-79c3-4617-b7aa-ae46c555c71f?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.9.7","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2026-10-20T15:13:00Z","updated":"2026-10-23T18:51:28Z"},{"id":"wordfence:caeed320-c192-4b17-87ad-0a18366b7fe4","source":"wordfence","cve":"CVE-2026-24607","title":"Travel Monster <= 1.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caeed320-c192-4b17-87ad-0a18366b7fe4?source=api-prod","affected":[{"type":"theme","slug":"travel-monster","name":"Travel Monster","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-01-13T13:56:20Z","updated":"2026-02-25T14:39:08Z"},{"id":"wordfence:caf0d33d-4bfd-460f-b21c-df36b1452b2e","source":"wordfence","cve":"CVE-2022-25617","title":"Code Snippets <= 2.14.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf0d33d-4bfd-460f-b21c-df36b1452b2e?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"2.14.3","to_inclusive":true,"patched_in":"2.14.4"}],"published":"2022-05-18T13:17:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caf5bdc7-8ed9-4b3f-a46d-511f021292a1","source":"wordfence","cve":"CVE-2026-73347","title":"TrueBooker \u2013 Appointment Booking and Scheduler System <= 1.2.6 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf5bdc7-8ed9-4b3f-a46d-511f021292a1?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:29:11Z"},{"id":"wordfence:caf61bf9-4b0f-450a-b571-b0fec42e9e39","source":"wordfence","cve":"CVE-2022-0191","title":"Ad Invalid Click Protector (AICP) <= 1.2.5.2 - Cross-Site Request Forgery to Arbitrary Ban Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf61bf9-4b0f-450a-b571-b0fec42e9e39?source=api-prod","affected":[{"type":"plugin","slug":"ad-invalid-click-protector","name":"Ad Invalid Click Protector (AICP)","from":"*","from_inclusive":true,"to":"1.2.5.2","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:caf7b262-7da8-41fe-9745-7468de13f669","source":"wordfence","cve":"CVE-2026-14853","title":"WooCommerce Bookings <= 3.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf7b262-7da8-41fe-9745-7468de13f669?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bookings","name":"WooCommerce Bookings","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-08-21T00:00:00Z","updated":"2026-09-03T16:22:39Z"},{"id":"wordfence:caf879a7-650e-4c70-b23a-51cac00f0cc6","source":"wordfence","cve":"CVE-2024-31358","title":"5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg <= 1.2.67 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf879a7-650e-4c70-b23a-51cac00f0cc6?source=api-prod","affected":[{"type":"plugin","slug":"5-stars-rating-funnel","name":"Build 5 Star Reviews on Google Reviews, Yelp, Facebook\u2026 easily and risk-free | RRatingg","from":"*","from_inclusive":true,"to":"1.3.02","to_inclusive":false,"patched_in":"1.3.02"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T13:27:54Z"},{"id":"wordfence:caf9dbd4-a9ba-4b66-9425-84b737901c7f","source":"wordfence","cve":"CVE-2026-121472","title":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI < 6.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caf9dbd4-a9ba-4b66-9425-84b737901c7f?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"6.0.8","to_inclusive":false,"patched_in":"6.0.8"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:20Z"},{"id":"wordfence:cafc574d-2075-4e8c-8d9b-f0b2874a69bb","source":"wordfence","cve":"CVE-2025-58689","title":"Tapfiliate <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cafc574d-2075-4e8c-8d9b-f0b2874a69bb?source=api-prod","affected":[{"type":"plugin","slug":"tapfiliate","name":"Tapfiliate","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-04-15T13:30:53Z"},{"id":"wordfence:caff9be6-4161-47a0-ba47-6c8fc0c4ab40","source":"wordfence","cve":"CVE-2023-6506","title":"WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caff9be6-4161-47a0-ba47-6c8fc0c4ab40?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:37:27Z"},{"id":"wordfence:cb0261c6-0477-4769-b92a-b49a192df4bb","source":"wordfence","cve":"CVE-2024-4379","title":"Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0261c6-0477-4769-b92a-b49a192df4bb?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.31","to_inclusive":true,"patched_in":"4.10.32"}],"published":"2024-05-30T17:09:22Z","updated":"2024-05-31T05:32:01Z"},{"id":"wordfence:cb028377-d62d-4172-9253-6870c985736f","source":"wordfence","cve":"CVE-2024-13627","title":"WP Touch Slider <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb028377-d62d-4172-9253-6870c985736f?source=api-prod","affected":[{"type":"plugin","slug":"wp-touch-slider","name":"OWL Carousel Slider","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-30T21:55:12Z"},{"id":"wordfence:cb02878a-2c85-4dcb-bdc0-e65addf9fb9c","source":"wordfence","cve":"CVE-2026-15298","title":"TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb02878a-2c85-4dcb-bdc0-e65addf9fb9c?source=api-prod","affected":[{"type":"plugin","slug":"telsender","name":"TelSender \u2013 \u0421ontact form 7, Events, Wpforms, ninja forms  and woocommerce to telegram bot","from":"*","from_inclusive":true,"to":"1.14.14","to_inclusive":true,"patched_in":"1.14.15"}],"published":"2026-01-27T21:48:26Z","updated":"2026-07-10T04:31:26Z"},{"id":"wordfence:cb03eb79-27c9-4a9d-b690-71946e11f39f","source":"wordfence","cve":"CVE-2026-61979","title":"SAML Single Sign On \u2013 SSO Login <= 5.4.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-250","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb03eb79-27c9-4a9d-b690-71946e11f39f?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:41:16Z"},{"id":"wordfence:cb072bfa-991a-4839-996d-fdc803427076","source":"wordfence","cve":"CVE-2008-6762","title":"WordPress Core < 2.8.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb072bfa-991a-4839-996d-fdc803427076?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":false,"patched_in":"2.8.1"}],"published":"2008-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb075e85-75fc-4008-8270-4d1064ace29e","source":"wordfence","cve":"CVE-2024-2297","title":"Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave","severity":"high","cvss":7.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb075e85-75fc-4008-8270-4d1064ace29e?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.9.6.1","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T05:23:05Z"},{"id":"wordfence:cb07f79f-6583-4f65-bc88-65dbd7207d5e","source":"wordfence","cve":"CVE-2025-31760","title":"SnapWidget Social Photo Feed Widget <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb07f79f-6583-4f65-bc88-65dbd7207d5e?source=api-prod","affected":[{"type":"plugin","slug":"snapwidget-wp-instagram-widget","name":"SnapWidget Social Photo Feed Widget","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-04-01T00:00:00Z","updated":"2026-11-03T22:43:37Z"},{"id":"wordfence:cb08cf02-4766-4093-9306-3b4581f54f77","source":"wordfence","cve":"CVE-2023-45631","title":"Responsive Image Gallery, Gallery Album <= 2.0.3 - Missing Authorization via Multiple AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb08cf02-4766-4093-9306-3b4581f54f77?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-07-23T19:04:48Z"},{"id":"wordfence:cb0a5b99-58fd-47b8-9d52-89d809d74717","source":"wordfence","cve":"CVE-2026-92427","title":"Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0a5b99-58fd-47b8-9d52-89d809d74717?source=api-prod","affected":[{"type":"plugin","slug":"coinsnap-bitcoin-crowdfunding","name":"Coinsnap Bitcoin Crowdfunding","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:40:35Z"},{"id":"wordfence:cb0ac434-7e85-44d4-b21e-df462f63cd9c","source":"wordfence","cve":"CVE-2024-4488","title":"Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0ac434-7e85-44d4-b21e-df462f63cd9c?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.976","to_inclusive":true,"patched_in":"1.3.977"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T06:52:23Z"},{"id":"wordfence:cb0fee1c-9dac-497c-a364-3b616e4b8ac0","source":"wordfence","cve":"CVE-2024-37447","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) Manager <= 9.6.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0fee1c-9dac-497c-a364-3b616e4b8ac0?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"9.6.1.1","to_inclusive":true,"patched_in":"9.6.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:08:06Z"},{"id":"wordfence:cb102a58-2fc0-4441-8f51-a6109e323878","source":"wordfence","cve":"CVE-2008-0939","title":"WP Photo Album Plus <= 1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb102a58-2fc0-4441-8f51-a6109e323878?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2008-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb105ff0-5085-4813-81a6-b1f0798d576c","source":"wordfence","cve":"","title":"MainWP (Various extensions) - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb105ff0-5085-4813-81a6-b1f0798d576c?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-wordfence-extension","name":"MainWP Wordfence Extension","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"},{"type":"plugin","slug":"mainwp-ithemes-security-extension","name":"MainWP iThemes Security Extension","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"mainwp-file-uploader-extension","name":"MainWP File Uploader Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"},{"type":"plugin","slug":"mainwp-code-snippets-extension","name":"MainWP Code Snippets Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-post-plus-extension","name":"MainWP Post Plus Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.1.1"},{"type":"plugin","slug":"mainwp-seo-extension","name":"MainWP WordPress SEO Extension","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-maintenance-extension","name":"MainWP Maintenance Extension","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"mainwp-page-speed-extension","name":"MainWP Page Speed Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-clone-extension","name":"MainWP Clone Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-article-uploader-extension","name":"MainWP Article Uploader Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-broken-links-checker-extension","name":"MainWP Broken Link Checker","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mainwp-comments-extension","name":"MainWP Comments Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"},{"type":"plugin","slug":"mainwp-updraftplus-extension","name":"MainWP UpdraftPlus Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"},{"type":"plugin","slug":"mainwp-favorites-extension","name":"MainWP Favorites Extension","from":"*","from_inclusive":true,"to":"4.0.10","to_inclusive":true,"patched_in":"4.0.11"},{"type":"plugin","slug":"mainwp-staging-extension","name":"MainWP Staging Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"},{"type":"plugin","slug":"boilerplate-extension","name":"MainWP Boilerplate Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"},{"type":"plugin","slug":"mainwp-blogvault-backup-extension","name":"MainWP BlogVault Backup Extension","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"mainwp-google-analytics-extension","name":"MainWP Google Analytics Extension","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"},{"type":"plugin","slug":"mainwp-buddy-extension","name":"MainWP Buddy Extension","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"mainwp-post-dripper-extension","name":"MainWP Post Dripper Extension","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"},{"type":"plugin","slug":"mainwp-rocket-extension","name":"MainWP Rocket Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb1105fc-ed12-4a82-9cc4-4b45aa34cdc5","source":"wordfence","cve":"CVE-2022-45809","title":"Thumbs Rating <= 5.0.0 - Race Condition","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb1105fc-ed12-4a82-9cc4-4b45aa34cdc5?source=api-prod","affected":[{"type":"plugin","slug":"thumbs-rating","name":"Thumbs Rating","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb112c12-2587-46de-a688-d0f04e1ec431","source":"wordfence","cve":"CVE-2024-32145","title":"WP Google Analytics Events <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb112c12-2587-46de-a688-d0f04e1ec431?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-analytics-events","name":"WP Google Analytics Events \u2013 No-Code Custom Event Tracking for Google Analytics","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:32:32Z"},{"id":"wordfence:cb141b46-2585-4b58-8d91-0cdb275348a1","source":"wordfence","cve":"CVE-2025-14173","title":"Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb141b46-2585-4b58-8d91-0cdb275348a1?source=api-prod","affected":[{"type":"plugin","slug":"perfit-woocommerce","name":"Perfit WooCommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:28:36Z","updated":"2026-01-14T06:40:08Z"},{"id":"wordfence:cb148264-c75e-4e73-95d7-3a06cdd8990e","source":"wordfence","cve":"CVE-2023-1893","title":"Login Configurator <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb148264-c75e-4e73-95d7-3a06cdd8990e?source=api-prod","affected":[{"type":"plugin","slug":"login-configurator","name":"Login Configurator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb14862d-e614-475b-9d3d-ba9a6c2f962b","source":"wordfence","cve":"CVE-2026-84779","title":"Agentimus \u2013 AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb14862d-e614-475b-9d3d-ba9a6c2f962b?source=api-prod","affected":[{"type":"plugin","slug":"agentimus","name":"Agentimus \u2013 AI SEO, llms.txt & MCP for AI Agents","from":"*","from_inclusive":true,"to":"1.51.0","to_inclusive":true,"patched_in":"1.51.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:11:39Z"},{"id":"wordfence:cb1576f8-0586-4ad8-befb-b502d30fab52","source":"wordfence","cve":"CVE-2016-1000132","title":"CM Tooltip Glossary  \u2013 Better SEO and UEX for your WP site <= 3.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb1576f8-0586-4ad8-befb-b502d30fab52?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":false,"patched_in":"3.3.5"}],"published":"2016-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb158acc-69d7-4a7d-b356-7de1f6b37019","source":"wordfence","cve":"CVE-2026-5523","title":"Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb158acc-69d7-4a7d-b356-7de1f6b37019?source=api-prod","affected":[{"type":"plugin","slug":"divi-form-builder","name":"Divi Form Builder","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T04:32:54Z"},{"id":"wordfence:cb1626ae-cf58-4377-ab4f-58e4536825fe","source":"wordfence","cve":"CVE-2025-39356","title":"Foodbakery Sticky Cart <= 3.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb1626ae-cf58-4377-ab4f-58e4536825fe?source=api-prod","affected":[{"type":"plugin","slug":"foodbakery-sticky-cart","name":"Foodbakery Sticky Cart","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T22:13:43Z"},{"id":"wordfence:cb18d6d8-28e5-4125-9209-a71403f678f0","source":"wordfence","cve":"CVE-2023-30616","title":"Form Block <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb18d6d8-28e5-4125-9209-a71403f678f0?source=api-prod","affected":[{"type":"plugin","slug":"form-block","name":"Form Block","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2023-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb1db880-0942-4fac-a548-8b6a28dce8c0","source":"wordfence","cve":"CVE-2023-25790","title":"Woodmart <= 7.0.4 - Unauthenticated Arbitrary Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb1db880-0942-4fac-a548-8b6a28dce8c0?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2023-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb1dc7e4-a339-4760-9f63-aaa6590bd5e0","source":"wordfence","cve":"CVE-2023-0381","title":"GigPress <= 2.3.28 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb1dc7e4-a339-4760-9f63-aaa6590bd5e0?source=api-prod","affected":[{"type":"plugin","slug":"gigpress","name":"GigPress","from":"*","from_inclusive":true,"to":"2.3.28","to_inclusive":true,"patched_in":"2.3.29"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb269a48-e813-4cda-821a-ee70431372d2","source":"wordfence","cve":"CVE-2024-9390","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb269a48-e813-4cda-821a-ee70431372d2?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.2.1"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-30T18:49:28Z"},{"id":"wordfence:cb2763ae-6c40-4492-b285-0021ab4305f7","source":"wordfence","cve":"CVE-2026-39699","title":"AI Workflow Automation <= 2.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb2763ae-6c40-4492-b285-0021ab4305f7?source=api-prod","affected":[{"type":"plugin","slug":"ai-workflow-automation-lite","name":"AI Workflow Automation","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-02-27T00:00:00Z","updated":"2026-07-28T19:47:11Z"},{"id":"wordfence:cb2829eb-3079-429e-ab0f-e23a2c32d616","source":"wordfence","cve":"CVE-2024-29761","title":"WP Post Disclaimer <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb2829eb-3079-429e-ab0f-e23a2c32d616?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-disclaimer","name":"WP Post Disclaimer","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:31:27Z"},{"id":"wordfence:cb28ef31-657d-4d95-b651-98dbdcaf3dd7","source":"wordfence","cve":"CVE-2026-94074","title":"Simply Schedule Appointments <= 1.6.12.29 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb28ef31-657d-4d95-b651-98dbdcaf3dd7?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.29","to_inclusive":true,"patched_in":"1.6.12.31"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:51:27Z"},{"id":"wordfence:cb2c23cb-e7f6-4209-ab59-a44cd58d7d4c","source":"wordfence","cve":"CVE-2024-51586","title":"Elementary Addons <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb2c23cb-e7f6-4209-ab59-a44cd58d7d4c?source=api-prod","affected":[{"type":"plugin","slug":"elementary-addons","name":"Elementary Addons","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:38:57Z"},{"id":"wordfence:cb2e9370-f50e-4792-99f6-4678e0256a56","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin < 3.0.61 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb2e9370-f50e-4792-99f6-4678e0256a56?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"3.0.61","to_inclusive":false,"patched_in":"3.0.61"}],"published":"2014-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb2f764f-1e50-4e42-9b70-88f9967906fd","source":"wordfence","cve":"CVE-2024-32539","title":"WP File Download Light <= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb2f764f-1e50-4e42-9b70-88f9967906fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download-light","name":"WP File Download Light","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T14:04:43Z"},{"id":"wordfence:cb309336-5b35-45cf-9c58-4bb75d8a5cba","source":"wordfence","cve":"CVE-2026-1650","title":"MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb309336-5b35-45cf-9c58-4bb75d8a5cba?source=api-prod","affected":[{"type":"plugin","slug":"mobile-dj-manager","name":"MDJM Event Management","from":"*","from_inclusive":true,"to":"1.7.8.1","to_inclusive":true,"patched_in":"1.7.8.2"}],"published":"2026-03-06T11:57:27Z","updated":"2026-03-07T01:21:23Z"},{"id":"wordfence:cb3157b3-0ba1-4471-a3d7-bab65c68a611","source":"wordfence","cve":"CVE-2026-42378","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions <= 8.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb3157b3-0ba1-4471-a3d7-bab65c68a611?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:18:05Z"},{"id":"wordfence:cb334b74-5561-4ac7-b321-397600e26d06","source":"wordfence","cve":"CVE-2022-3989","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb334b74-5561-4ac7-b321-397600e26d06?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb35ad37-5a13-4610-95a1-6587e7f626fd","source":"wordfence","cve":"CVE-2024-54400","title":"AppMaps <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb35ad37-5a13-4610-95a1-6587e7f626fd?source=api-prod","affected":[{"type":"plugin","slug":"appmaps","name":"AppMaps","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:43:30Z"},{"id":"wordfence:cb371826-3fbd-4884-945f-cc040512dc95","source":"wordfence","cve":"CVE-2025-60107","title":"LambertGroup - AllInOne - Banner with Playlist <= 3.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb371826-3fbd-4884-945f-cc040512dc95?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-bannerWithPlaylist","name":"LambertGroup - AllInOne - Banner with Playlist","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:22:07Z"},{"id":"wordfence:cb37b784-b1ff-4cee-889d-751218e5b95d","source":"wordfence","cve":"CVE-2021-42362","title":"WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb37b784-b1ff-4cee-889d-751218e5b95d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2021-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb38d3bc-ae82-40ef-b20d-525d51432b1c","source":"wordfence","cve":"CVE-2018-5284","title":"ImageInject <= 1.15 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb38d3bc-ae82-40ef-b20d-525d51432b1c?source=api-prod","affected":[{"type":"plugin","slug":"wp-inject","name":"ImageInject","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.16"}],"published":"2018-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb3b8461-280e-41a3-bc26-32ef3897f184","source":"wordfence","cve":"CVE-2025-66111","title":"Nelio Popups <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb3b8461-280e-41a3-bc26-32ef3897f184?source=api-prod","affected":[{"type":"plugin","slug":"nelio-popups","name":"Nelio Popups","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-12-10T00:00:00Z","updated":"2025-12-12T20:58:56Z"},{"id":"wordfence:cb3d8d70-a965-4ef7-9b03-f64cb0fdbf8f","source":"wordfence","cve":"CVE-2024-53719","title":"Zajax \u2013 Ajax Navigation <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb3d8d70-a965-4ef7-9b03-f64cb0fdbf8f?source=api-prod","affected":[{"type":"plugin","slug":"zajax-ajax-navigation","name":"Zajax \u2013 Ajax Navigation","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:40:34Z"},{"id":"wordfence:cb3f3bc7-9127-43ba-80ad-e32fd7c3b05e","source":"wordfence","cve":"CVE-2025-49424","title":"Essential Doo Components for Visual Composer <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb3f3bc7-9127-43ba-80ad-e32fd7c3b05e?source=api-prod","affected":[{"type":"plugin","slug":"animated-icon-banner-for-visual-composer","name":"Essential Doo Components for Visual Composer","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-25T17:21:31Z"},{"id":"wordfence:cb427792-8675-4c38-a4e6-ba2b8091003f","source":"wordfence","cve":"","title":"TinyMCE Advanced <= 4.1.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb427792-8675-4c38-a4e6-ba2b8091003f?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-advanced","name":"Advanced Editor Tools","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb453fe3-ba89-437c-b3fb-9ec207eaa9f0","source":"wordfence","cve":"CVE-2025-1321","title":"teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb453fe3-ba89-437c-b3fb-9ec207eaa9f0?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.7","to_inclusive":true,"patched_in":"9.0.8"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-04T03:37:59Z"},{"id":"wordfence:cb4681a5-d722-4585-97d3-370938c079a2","source":"wordfence","cve":"","title":"WP Table Builder \u2013 WordPress Table Plugin <= 1.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb4681a5-d722-4585-97d3-370938c079a2?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb46d7fa-9667-4479-8136-837cb61eaf4c","source":"wordfence","cve":"CVE-2025-7439","title":"Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb46d7fa-9667-4479-8136-837cb61eaf4c?source=api-prod","affected":[{"type":"plugin","slug":"anber-elementor-addon","name":"Anber Elementor Addon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:49:26Z","updated":"2025-08-16T03:38:52Z"},{"id":"wordfence:cb472bdb-de35-45e4-bcea-04f27d425817","source":"wordfence","cve":"CVE-2026-1611","title":"Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb472bdb-de35-45e4-bcea-04f27d425817?source=api-prod","affected":[{"type":"plugin","slug":"wikiloops-track-player","name":"Wikiloops Track Player","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:25:08Z","updated":"2026-02-07T08:26:39Z"},{"id":"wordfence:cb47b6cc-87e4-4d29-bbc7-6d7552bc3943","source":"wordfence","cve":"CVE-2022-4702","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb47b6cc-87e4-4d29-bbc7-6d7552bc3943?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb49eb5f-c1ff-4440-8b53-c2515e65da27","source":"wordfence","cve":"CVE-2026-0561","title":"Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb49eb5f-c1ff-4440-8b53-c2515e65da27?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"21.0.8","to_inclusive":true,"patched_in":"21.0.10"}],"published":"2026-02-18T16:17:44Z","updated":"2026-02-19T04:36:25Z"},{"id":"wordfence:cb49f48e-98bf-4838-8eb0-91a7daad182c","source":"wordfence","cve":"CVE-2024-56259","title":"GeoDirectory <= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb49f48e-98bf-4838-8eb0-91a7daad182c?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.3.84","to_inclusive":true,"patched_in":"2.3.85"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:10:03Z"},{"id":"wordfence:cb4bb127-360d-4f17-9da9-f7be17140ff3","source":"wordfence","cve":"CVE-2023-24392","title":"Full Width Banner Slider Wp <= 1.1.7 - Reflected Cross-Site Scripting via search_term","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb4bb127-360d-4f17-9da9-f7be17140ff3?source=api-prod","affected":[{"type":"plugin","slug":"full-width-responsive-slider-wp","name":"Full Width Slider \u2013 Responsive Hero, Banner & Image Slider","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb4e3b3c-20f4-4591-af0a-539b405d675e","source":"wordfence","cve":"","title":"Ultimate Product Catalog < 4.2.3 - Authenticated SQL Injection","severity":"medium","cvss":5.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb4e3b3c-20f4-4591-af0a-539b405d675e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2017-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb4eb28a-3dd5-4d8d-bef0-53cee7285180","source":"wordfence","cve":"CVE-2023-50377","title":"Simple Counter <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb4eb28a-3dd5-4d8d-bef0-53cee7285180?source=api-prod","affected":[{"type":"plugin","slug":"abwp-simple-counter","name":"Simple Counter","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-12-19T00:00:00Z","updated":"2024-05-17T13:46:44Z"},{"id":"wordfence:cb51383f-03c8-4e81-bfed-40fd9f5c4d20","source":"wordfence","cve":"CVE-2023-36512","title":"AutomateWoo <= 5.7.5 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb51383f-03c8-4e81-bfed-40fd9f5c4d20?source=api-prod","affected":[{"type":"plugin","slug":"automatewoo","name":"AutomateWoo","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.7.6"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb55be41-c3aa-4f1e-9330-a31181a3a264","source":"wordfence","cve":"CVE-2026-12281","title":"Shibboleth <= 2.5.3 - Unauthenticated Administrator Account Creation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb55be41-c3aa-4f1e-9330-a31181a3a264?source=api-prod","affected":[{"type":"plugin","slug":"shibboleth","name":"Shibboleth","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-06-24T00:00:00Z","updated":"2026-07-30T12:07:25Z"},{"id":"wordfence:cb56b00c-31dd-4076-aeaf-9b249f04f1c6","source":"wordfence","cve":"CVE-2022-2575","title":"WBW Currency Switcher <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb56b00c-31dd-4076-aeaf-9b249f04f1c6?source=api-prod","affected":[{"type":"plugin","slug":"woo-currency","name":"Currency Switcher for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb5c08ea-1321-42f8-aea2-49661396311b","source":"wordfence","cve":"","title":"RSS Includes Pages <= 3.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5c08ea-1321-42f8-aea2-49661396311b?source=api-prod","affected":[{"type":"plugin","slug":"rss-includes-pages","name":"RSS Includes Pages","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"}],"published":"2017-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb5c5e82-d6e5-4237-958f-12fc4698e77e","source":"wordfence","cve":"CVE-2023-28619","title":"Resoto <= 1.0.8 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5c5e82-d6e5-4237-958f-12fc4698e77e?source=api-prod","affected":[{"type":"theme","slug":"resoto","name":"Resoto","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb5ca73c-1a1d-4a93-bbcb-8af606189f26","source":"wordfence","cve":"CVE-2025-12388","title":"B Carousel Block \u2013 Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5ca73c-1a1d-4a93-bbcb-8af606189f26?source=api-prod","affected":[{"type":"plugin","slug":"b-carousel-block","name":"Carousel Block \u2013 Showcase Images in Elegant Sliding Displays","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-11-04T17:38:53Z","updated":"2025-11-05T06:35:03Z"},{"id":"wordfence:cb5cb1a5-30d2-434f-90f9-d37aecfbe158","source":"wordfence","cve":"CVE-2023-3201","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5cb1a5-30d2-434f-90f9-d37aecfbe158?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb5cb94b-1f4c-4e93-9764-c50e8449acfb","source":"wordfence","cve":"CVE-2025-24780","title":"Printcart Web to Print Product Designer for WooCommerce <= 2.4.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5cb94b-1f4c-4e93-9764-c50e8449acfb?source=api-prod","affected":[{"type":"plugin","slug":"printcart-integration","name":"Printcart Store \u2013 Web to Print Product Designer for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-17T17:31:30Z"},{"id":"wordfence:cb5d3d64-a465-4c26-9cf7-7acc7dab862a","source":"wordfence","cve":"","title":"Spicy Blogroll <= 1.0.0 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5d3d64-a465-4c26-9cf7-7acc7dab862a?source=api-prod","affected":[{"type":"plugin","slug":"spicy-blogroll","name":"Spicy Blogroll","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2013-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb5f5e33-e066-4a85-9367-4b8c2f948adf","source":"wordfence","cve":"CVE-2025-12191","title":"PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb5f5e33-e066-4a85-9367-4b8c2f948adf?source=api-prod","affected":[{"type":"plugin","slug":"pdf-catalog-for-woocommerce","name":"PDF Catalog for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:30:02Z","updated":"2025-12-05T05:31:28Z"},{"id":"wordfence:cb603be6-4a12-49e1-b8cc-b2062eb97f16","source":"wordfence","cve":"CVE-2026-1490","title":"Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-350","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb603be6-4a12-49e1-b8cc-b2062eb97f16?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.71","to_inclusive":true,"patched_in":"6.72"}],"published":"2026-02-14T14:21:19Z","updated":"2026-02-15T02:22:56Z"},{"id":"wordfence:cb610baa-093d-4a41-8e28-c65fdb0e32aa","source":"wordfence","cve":"CVE-2023-47656","title":"ANAC XML Bandi di Gara <= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb610baa-093d-4a41-8e28-c65fdb0e32aa?source=api-prod","affected":[{"type":"plugin","slug":"avcp","name":"ANAC XML Bandi di Gara","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2023-11-07T00:00:00Z","updated":"2025-05-29T19:29:32Z"},{"id":"wordfence:cb62eefe-9993-43f7-b3ae-de47c0951bee","source":"wordfence","cve":"CVE-2024-8656","title":"WPFactory Helper <= 1.7.0 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb62eefe-9993-43f7-b3ae-de47c0951bee?source=api-prod","affected":[{"type":"plugin","slug":"wpcodefactory-helper","name":"WPFactory Helper","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-09-12T15:26:53Z","updated":"2024-09-13T03:37:25Z"},{"id":"wordfence:cb64128c-0342-4365-bf46-0170fc876694","source":"wordfence","cve":"CVE-2026-57323","title":"HTML5 Video Player \u2013 Embed and Play Videos in Custom Player <= 2.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb64128c-0342-4365-bf46-0170fc876694?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:55:53Z"},{"id":"wordfence:cb643921-0e14-42c1-a5a6-cc9d24b4f6e9","source":"wordfence","cve":"CVE-2026-104338","title":"Razorpay for WooCommerce <= 4.8.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb643921-0e14-42c1-a5a6-cc9d24b4f6e9?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-10T19:08:42Z"},{"id":"wordfence:cb6457ea-6353-4a69-ad72-cd5acd47ed8c","source":"wordfence","cve":"CVE-2023-28785","title":"Yoast SEO: Local <= 14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6457ea-6353-4a69-ad72-cd5acd47ed8c?source=api-prod","affected":[{"type":"plugin","slug":"wpseo-local","name":"Yoast SEO: Local","from":"*","from_inclusive":true,"to":"14.9","to_inclusive":true,"patched_in":"15.0"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb64952e-170e-47c5-87fd-d2ec60192b65","source":"wordfence","cve":"CVE-2024-5161","title":"Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb64952e-170e-47c5-87fd-d2ec60192b65?source=api-prod","affected":[{"type":"plugin","slug":"magical-addons-for-elementor","name":"Magical Addons For Elementor ( Theme Builder, Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )","from":"*","from_inclusive":true,"to":"1.1.39","to_inclusive":true,"patched_in":"1.1.40"}],"published":"2024-06-05T15:35:23Z","updated":"2024-06-06T03:53:11Z"},{"id":"wordfence:cb649fb2-2d0e-4fe3-89d5-90bcbc0bcfcf","source":"wordfence","cve":"CVE-2022-45819","title":"Popup Maker <= 1.17.1 - Missing Authorization via save_popup_enabled_state","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb649fb2-2d0e-4fe3-89d5-90bcbc0bcfcf?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2023-03-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb661b7f-5474-48b0-92b6-4559624732ae","source":"wordfence","cve":"CVE-2026-110532","title":"Mail Mage <= 0.0.25 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb661b7f-5474-48b0-92b6-4559624732ae?source=api-prod","affected":[{"type":"plugin","slug":"mail-mage","name":"Mail Mage","from":"*","from_inclusive":true,"to":"0.0.25","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:14:04Z"},{"id":"wordfence:cb68f328-3090-487e-bb1f-95fe1571abd0","source":"wordfence","cve":"CVE-2019-6011","title":"wpDataTables Lite plugin <= 2.0.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb68f328-3090-487e-bb1f-95fe1571abd0?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb6a47c1-1363-4529-a7b4-9b26b299320e","source":"wordfence","cve":"CVE-2026-121491","title":"Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6a47c1-1363-4529-a7b4-9b26b299320e?source=api-prod","affected":[{"type":"plugin","slug":"fiber-admin","name":"Fiber Admin","from":"3.1.0","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:42:38Z"},{"id":"wordfence:cb6a98ba-0b62-47e1-b87f-eff68f867b98","source":"wordfence","cve":"CVE-2026-111399","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6a98ba-0b62-47e1-b87f-eff68f867b98?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.16.1","to_inclusive":true,"patched_in":"8.16.2"}],"published":"2026-10-16T12:30:00Z","updated":"2026-10-23T18:41:43Z"},{"id":"wordfence:cb6bfe31-0c90-4aca-8165-b30507f18ea5","source":"wordfence","cve":"","title":"Multivendor Marketplace Solution for WooCommerce \u2013 WC Marketplace < 3.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6bfe31-0c90-4aca-8165-b30507f18ea5?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":false,"patched_in":"3.8.4"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb6d11ad-0983-4a4b-b52b-824eae8b8e3c","source":"wordfence","cve":"CVE-2023-4887","title":"Google Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6d11ad-0983-4a4b-b52b-824eae8b8e3c?source=api-prod","affected":[{"type":"plugin","slug":"intergeo-maps","name":"Google Maps Plugin by Intergeo","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-11T00:00:00Z","updated":"2024-10-24T18:09:22Z"},{"id":"wordfence:cb6de4da-0d60-4332-be25-5521e430a4fa","source":"wordfence","cve":"CVE-2021-24977","title":"Use Any Font <= 6.2.0 - Unauthenticated Arbitrary CSS Appending","severity":"medium","cvss":6.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb6de4da-0d60-4332-be25-5521e430a4fa?source=api-prod","affected":[{"type":"plugin","slug":"use-any-font","name":"Use Any Font | Custom Font Uploader","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb713c9c-adb4-410c-a92f-d4d5b002d626","source":"wordfence","cve":"CVE-2026-39647","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.11 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb713c9c-adb4-410c-a92f-d4d5b002d626?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":true,"patched_in":"5.12"}],"published":"2026-02-15T00:00:00Z","updated":"2026-05-11T19:42:05Z"},{"id":"wordfence:cb714378-ed60-4bf1-8c9c-b37515ddb353","source":"wordfence","cve":"CVE-2021-24658","title":"Erident Custom Login and Dashboard <= 3.5.8 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb714378-ed60-4bf1-8c9c-b37515ddb353?source=api-prod","affected":[{"type":"plugin","slug":"erident-custom-login-and-dashboard","name":"Erident Custom Login Page & Dashboard","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2021-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb725044-01c3-4c0c-b276-291f897f11e7","source":"wordfence","cve":"CVE-2026-1911","title":"Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb725044-01c3-4c0c-b276-291f897f11e7?source=api-prod","affected":[{"type":"plugin","slug":"twitter-feeds","name":"Twitter Feeds","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:44Z","updated":"2026-03-21T03:27:03Z"},{"id":"wordfence:cb7316cd-8a15-4b81-b57c-b8e4adcaf1ef","source":"wordfence","cve":"CVE-2022-36365","title":"WHA Crossword <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7316cd-8a15-4b81-b57c-b8e4adcaf1ef?source=api-prod","affected":[{"type":"plugin","slug":"wha-crossword","name":"WHA Crossword","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb731e56-6962-4268-b248-f97d0c7e3bf4","source":"wordfence","cve":"CVE-2026-84905","title":"Eventin <= 4.1.23 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb731e56-6962-4268-b248-f97d0c7e3bf4?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:53:59Z"},{"id":"wordfence:cb7335c0-b6ed-43bb-91b7-870093d14cb8","source":"wordfence","cve":"CVE-2023-36680","title":"Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7335c0-b6ed-43bb-91b7-870093d14cb8?source=api-prod","affected":[{"type":"plugin","slug":"image-regenerate-select-crop","name":"Image Regenerate & Select Crop","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.2.0"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb73e92b-b807-4406-b378-cef6cff9eb82","source":"wordfence","cve":"CVE-2023-40601","title":"Mortgage Calculator Estatik <= 2.0.11 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb73e92b-b807-4406-b378-cef6cff9eb82?source=api-prod","affected":[{"type":"plugin","slug":"estatik-mortgage-calculator","name":"Estatik Mortgage Calculator","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2026-03-23T15:44:42Z"},{"id":"wordfence:cb7423bd-573b-4104-bf0a-8aef16ec2921","source":"wordfence","cve":"CVE-2026-119175","title":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7423bd-573b-4104-bf0a-8aef16ec2921?source=api-prod","affected":[{"type":"plugin","slug":"nazy-load","name":"Flying Images: Optimize and Lazy Load Images for Faster Page Speed","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.4.16"}],"published":"2026-11-06T14:16:48Z","updated":"2026-11-07T02:29:17Z"},{"id":"wordfence:cb7478fa-418d-43ce-8db7-b7ede06574df","source":"wordfence","cve":"CVE-2026-110253","title":"weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7478fa-418d-43ce-8db7-b7ede06574df?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.28","to_inclusive":true,"patched_in":"1.6.29"}],"published":"2026-10-16T19:37:37Z","updated":"2026-10-17T07:51:26Z"},{"id":"wordfence:cb753b29-ca8c-4044-97ff-3b7e57d5de61","source":"wordfence","cve":"CVE-2025-10175","title":"WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb753b29-ca8c-4044-97ff-3b7e57d5de61?source=api-prod","affected":[{"type":"plugin","slug":"wp-links-page","name":"WP Links Page","from":"*","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-10-10T20:39:51Z","updated":"2025-12-09T17:04:21Z"},{"id":"wordfence:cb75b6ba-feb7-4e18-91f6-7ca1e90ef039","source":"wordfence","cve":"CVE-2022-4393","title":"ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb75b6ba-feb7-4e18-91f6-7ca1e90ef039?source=api-prod","affected":[{"type":"plugin","slug":"imagelinks-interactive-image-builder-lite","name":"ImageLinks \u2013 Interactive Image Builder with Hotspots","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb7ebe8c-2202-4206-bd2b-bf3129ff7178","source":"wordfence","cve":"CVE-2025-31901","title":"Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7ebe8c-2202-4206-bd2b-bf3129ff7178?source=api-prod","affected":[{"type":"plugin","slug":"wedesin-html-sitemap","name":"Digihood HTML Sitemap","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-09T20:44:44Z"},{"id":"wordfence:cb7ec7ad-797b-4a5c-9b1c-31284083faef","source":"wordfence","cve":"","title":"GiveWP <= 2.25.1 - Cross-Site Request Forgery via save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7ec7ad-797b-4a5c-9b1c-31284083faef?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb7ee61d-2f2c-4e5e-891e-e8b7a5cd29fa","source":"wordfence","cve":"CVE-2025-26735","title":"Grip <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7ee61d-2f2c-4e5e-891e-e8b7a5cd29fa?source=api-prod","affected":[{"type":"theme","slug":"grip","name":"Grip","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-22T18:41:59Z"},{"id":"wordfence:cb7f78b8-670f-4a23-9498-6fa570833642","source":"wordfence","cve":"CVE-2026-54806","title":"WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7f78b8-670f-4a23-9498-6fa570833642?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.3.1","to_inclusive":true,"patched_in":"5.6.4"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T15:58:14Z"},{"id":"wordfence:cb801c72-0e50-4df1-88cc-30f8037c6d3c","source":"wordfence","cve":"CVE-2026-104932","title":"Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption","severity":"high","cvss":8.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb801c72-0e50-4df1-88cc-30f8037c6d3c?source=api-prod","affected":[{"type":"plugin","slug":"search-regex","name":"Search Regex","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2026-10-15T17:06:10Z","updated":"2026-10-16T05:30:29Z"},{"id":"wordfence:cb823899-e90d-4857-9f72-aa7fe60aaca2","source":"wordfence","cve":"CVE-2018-17138","title":"Jibu Pro <= 1.7 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb823899-e90d-4857-9f72-aa7fe60aaca2?source=api-prod","affected":[{"type":"plugin","slug":"jibu-pro","name":"Jibu Pro","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2018-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb84b71e-7d4d-4bd7-88cb-1b86d7023edb","source":"wordfence","cve":"CVE-2024-11682","title":"G Web Pro Store Locator <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb84b71e-7d4d-4bd7-88cb-1b86d7023edb?source=api-prod","affected":[{"type":"plugin","slug":"gwebpro-store-locator","name":"G Web Pro Store Locator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T18:44:15Z","updated":"2024-12-21T07:03:02Z"},{"id":"wordfence:cb855743-1d08-4e21-a23c-a4ffba615f57","source":"wordfence","cve":"","title":"NextGen Gallery <= 2.0 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb855743-1d08-4e21-a23c-a4ffba615f57?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2014-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb866476-14c0-4ade-90b0-670418b397fb","source":"wordfence","cve":"CVE-2017-1002002","title":"Webapp builder 2.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb866476-14c0-4ade-90b0-670418b397fb?source=api-prod","affected":[{"type":"plugin","slug":"webapp-builder","name":"webapp-builder","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb879587-6210-4e23-8f02-9ce93a271962","source":"wordfence","cve":"CVE-2024-32828","title":"Flexible Shipping <= 4.24.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb879587-6210-4e23-8f02-9ce93a271962?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping","name":"Weight Based Shipping Table Rate for WooCommerce \u2013 Flexible Shipping","from":"*","from_inclusive":true,"to":"4.24.15","to_inclusive":true,"patched_in":"4.24.16"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:45:32Z"},{"id":"wordfence:cb8bb740-d977-4d5f-a4db-d75b67ff1ed2","source":"wordfence","cve":"CVE-2025-22677","title":"Uix Shortcodes <= 2.0.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8bb740-d977-4d5f-a4db-d75b67ff1ed2?source=api-prod","affected":[{"type":"plugin","slug":"uix-shortcodes","name":"Uix Shortcodes","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:09:21Z"},{"id":"wordfence:cb8c80fc-3b51-4003-b221-6f02e74bead0","source":"wordfence","cve":"CVE-2023-1912","title":"Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8c80fc-3b51-4003-b221-6f02e74bead0?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts","name":"Limit Login Attempts","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb8ecbbc-ada9-4887-92e6-25a587ecfb84","source":"wordfence","cve":"CVE-2024-1840","title":"WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8ecbbc-ada9-4887-92e6-25a587ecfb84?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"7.5","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:30:55Z"},{"id":"wordfence:cb8eea53-64d1-4375-9364-292b96080f68","source":"wordfence","cve":"CVE-2014-9734","title":"Slider Revolution <= 4.1.4 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8eea53-64d1-4375-9364-292b96080f68?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.2"}],"published":"2014-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb8fdb10-7b7f-4ba7-a324-5daeb872498e","source":"wordfence","cve":"CVE-2025-52818","title":"Trusty Whistleblowing <= 2.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb8fdb10-7b7f-4ba7-a324-5daeb872498e?source=api-prod","affected":[{"type":"plugin","slug":"trusty-whistleblowing-solution","name":"Trusty Whistleblowing Solution","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-06-23T00:00:00Z","updated":"2026-05-11T21:02:57Z"},{"id":"wordfence:cb91188b-71df-4aee-98f1-b77e0a33e01c","source":"wordfence","cve":"CVE-2014-4513","title":"ActiveHelper LiveHelp Live Chat < 3.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb91188b-71df-4aee-98f1-b77e0a33e01c?source=api-prod","affected":[{"type":"plugin","slug":"activehelper-livehelp","name":"ActiveHelper LiveHelp Live Chat","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb93a5f2-9bcf-4b06-aad7-ba36c7dea714","source":"wordfence","cve":"CVE-2023-38518","title":"Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb93a5f2-9bcf-4b06-aad7-ba36c7dea714?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cb94caa4-35a4-4aa3-8d25-263bbd58072a","source":"wordfence","cve":"CVE-2024-13307","title":"Reales WP - Real Estate WordPress Theme <= 2.1.2 - Missing Authorization to Unauthenticated Attachment Deletion and Favorite Property Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb94caa4-35a4-4aa3-8d25-263bbd58072a?source=api-prod","affected":[{"type":"theme","slug":"reales-wp-real-estate-wordpress-theme","name":"Reales WP - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:41:25Z","updated":"2025-04-24T08:23:51Z"},{"id":"wordfence:cb981b48-a31a-4ebb-96c9-c6d31e2dfe02","source":"wordfence","cve":"CVE-2026-24981","title":"Visionary Core <= 1.4.9 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb981b48-a31a-4ebb-96c9-c6d31e2dfe02?source=api-prod","affected":[{"type":"plugin","slug":"noo-visionary-core","name":"Visionary Core","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:03:30Z"},{"id":"wordfence:cb98228b-b1f3-40a5-a469-24816f8b2cba","source":"wordfence","cve":"CVE-2026-39559","title":"Uppercase < 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb98228b-b1f3-40a5-a469-24816f8b2cba?source=api-prod","affected":[{"type":"theme","slug":"uppercase","name":"Uppercase - WordPress Blog Theme with Dark Mode","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:09:43Z"},{"id":"wordfence:cb9ca8e0-741c-4763-b677-61f16e5a3b50","source":"wordfence","cve":"CVE-2022-3720","title":"Event Monster <= 1.2.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cb9ca8e0-741c-4763-b677-61f16e5a3b50?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cba546d8-df3e-4ada-9cf9-663baf175dd0","source":"wordfence","cve":"CVE-2025-9058","title":"Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cba546d8-df3e-4ada-9cf9-663baf175dd0?source=api-prod","affected":[{"type":"plugin","slug":"mikado-core","name":"Mikado Core","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-09-08T17:10:36Z","updated":"2025-09-09T05:25:45Z"},{"id":"wordfence:cba77ced-412e-4461-8d2a-980371c78a17","source":"wordfence","cve":"CVE-2023-49743","title":"Dashboard Widgets Suite <= 3.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cba77ced-412e-4461-8d2a-980371c78a17?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-widgets-suite","name":"Dashboard Widgets Suite","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbaa95d4-899f-49a0-a888-4ffee61c0335","source":"wordfence","cve":"CVE-2024-8715","title":"Simple LDAP Login <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbaa95d4-899f-49a0-a888-4ffee61c0335?source=api-prod","affected":[{"type":"plugin","slug":"simple-ldap-login","name":"Simple LDAP Login","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2024-09-27T00:00:00Z","updated":"2024-09-28T02:31:29Z"},{"id":"wordfence:cbaf06b2-9ac3-4882-9212-fdcecdc5fb8c","source":"wordfence","cve":"CVE-2025-8104","title":"Memory Usage <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbaf06b2-9ac3-4882-9212-fdcecdc5fb8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-memory","name":"Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions","from":"*","from_inclusive":true,"to":"3.98","to_inclusive":true,"patched_in":"3.99"}],"published":"2025-07-26T16:22:38Z","updated":"2025-07-27T04:23:40Z"},{"id":"wordfence:cbafdc15-cf42-4a12-bd79-5c602ce10625","source":"wordfence","cve":"CVE-2023-25057","title":"Libsyn Publisher Hub <= 1.3.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbafdc15-cf42-4a12-bd79-5c602ce10625?source=api-prod","affected":[{"type":"plugin","slug":"libsyn-podcasting","name":"Libsyn Publisher Hub","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbb0f6cf-c41d-4e54-addd-3f2454d02152","source":"wordfence","cve":"CVE-2025-62017","title":"Kallyas <= 4.22.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb0f6cf-c41d-4e54-addd-3f2454d02152?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:17:24Z"},{"id":"wordfence:cbb25a81-a92b-4773-9194-9aa355750817","source":"wordfence","cve":"CVE-2026-42640","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb25a81-a92b-4773-9194-9aa355750817?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:57:35Z"},{"id":"wordfence:cbb31cc2-d221-4e2c-a4de-e954d3c9069d","source":"wordfence","cve":"CVE-2024-35731","title":"Kenta Blocks \u2013 Responsive Blocks and block templates library <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb31cc2-d221-4e2c-a4de-e954d3c9069d?source=api-prod","affected":[{"type":"plugin","slug":"kenta-blocks","name":"Kenta Blocks \u2013 Responsive Blocks and block templates library","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:44:20Z"},{"id":"wordfence:cbb3378a-d3e8-4a31-9ed2-f580960878cf","source":"wordfence","cve":"CVE-2025-13962","title":"Divelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb3378a-d3e8-4a31-9ed2-f580960878cf?source=api-prod","affected":[{"type":"plugin","slug":"divelogs-widget","name":"Divelogs Widget","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-12-11T14:46:32Z","updated":"2025-12-12T03:20:57Z"},{"id":"wordfence:cbb3bd9b-ac1f-4488-931f-2ba37576df2d","source":"wordfence","cve":"CVE-2024-5646","title":"Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb3bd9b-ac1f-4488-931f-2ba37576df2d?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-06-11T08:10:30Z","updated":"2024-06-11T20:33:01Z"},{"id":"wordfence:cbb4f5a4-a693-4a05-813a-1fc189b3412c","source":"wordfence","cve":"CVE-2026-82847","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates < 3.4.1 - Authenticated (Custom Role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb4f5a4-a693-4a05-813a-1fc189b3412c?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:16:29Z"},{"id":"wordfence:cbb51383-1eab-4490-aa4c-bd1488312400","source":"wordfence","cve":"","title":"Trust Payments Gateway (3DS2) <= 1.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb51383-1eab-4490-aa4c-bd1488312400?source=api-prod","affected":[{"type":"plugin","slug":"trust-payments-gateway-3ds2","name":"Trust Payments Gateway for WooCommerce (JavaScript Library)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbb5e80a-4dfe-429c-96c1-7fab52e0ce21","source":"wordfence","cve":"CVE-2024-48037","title":"Contact Form Widget <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb5e80a-4dfe-429c-96c1-7fab52e0ce21?source=api-prod","affected":[{"type":"plugin","slug":"new-contact-form-widget","name":"Contact Form Widget \u2013 Responsive Contact Form, Query Form & Form Builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:44:50Z"},{"id":"wordfence:cbb7bdcf-9f93-4c86-a4b3-ad5aaf7521b0","source":"wordfence","cve":"CVE-2024-13531","title":"ShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb7bdcf-9f93-4c86-a4b3-ad5aaf7521b0?source=api-prod","affected":[{"type":"plugin","slug":"shipengine-shipping-quotes","name":"ShipEngine Shipping Quotes","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-02-11T21:10:23Z","updated":"2025-02-18T21:34:58Z"},{"id":"wordfence:cbb8501e-7e8b-4ed6-8792-c685a69de982","source":"wordfence","cve":"CVE-2023-33994","title":"Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbb8501e-7e8b-4ed6-8792-c685a69de982?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.0.5.1","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2023-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbba781f-c710-4360-a4ed-21a8f7350bb9","source":"wordfence","cve":"CVE-2025-58844","title":"Database to Excel <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbba781f-c710-4360-a4ed-21a8f7350bb9?source=api-prod","affected":[{"type":"plugin","slug":"database-to-excel","name":"Database to Excel","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:08:57Z"},{"id":"wordfence:cbba866d-93dd-4ef5-9670-ab958f61f06e","source":"wordfence","cve":"CVE-2026-0746","title":"AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbba866d-93dd-4ef5-9670-ab958f61f06e?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-01-27T06:06:34Z","updated":"2026-01-27T18:27:55Z"},{"id":"wordfence:cbbaa4bd-6460-4f2b-afb5-6bb973443902","source":"wordfence","cve":"CVE-2023-26005","title":"Fitrush <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbaa4bd-6460-4f2b-afb5-6bb973443902?source=api-prod","affected":[{"type":"theme","slug":"bw-fitrush","name":"Fitrush - Fitness and Health Supplements WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T13:49:46Z"},{"id":"wordfence:cbbbf5fe-0369-4de6-9b2f-957286b6f394","source":"wordfence","cve":"CVE-2024-11855","title":"Koalendar \u2013 Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbbf5fe-0369-4de6-9b2f-957286b6f394?source=api-prod","affected":[{"type":"plugin","slug":"koalendar-free-booking-widget","name":"Koalendar \u2013 Easy Appointment Scheduling & Booking Plugin","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-12-13T15:48:35Z","updated":"2024-12-17T12:44:33Z"},{"id":"wordfence:cbbf9fbb-74fd-42eb-a781-2a720fe56b13","source":"wordfence","cve":"CVE-2023-6812","title":"WP Compress \u2013 Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbf9fbb-74fd-42eb-a781-2a720fe56b13?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.20.01","to_inclusive":true,"patched_in":"6.20.02"}],"published":"2024-05-13T00:00:00Z","updated":"2024-07-29T21:37:27Z"},{"id":"wordfence:cbc05086-e7ba-4139-a294-52a19ffc8b93","source":"wordfence","cve":"CVE-2025-54714","title":"Zephyr Project Manager <= 3.3.201 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc05086-e7ba-4139-a294-52a19ffc8b93?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.201","to_inclusive":true,"patched_in":"3.3.202"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:35:36Z"},{"id":"wordfence:cbc26607-a588-4059-9a37-afede7c9e3f6","source":"wordfence","cve":"CVE-2025-11821","title":"Woocommerce \u2013 Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc26607-a588-4059-9a37-afede7c9e3f6?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-by-custom-tax","name":"Woocommerce \u2013 Products By Custom Tax","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:00:04Z","updated":"2025-11-11T03:30:48Z"},{"id":"wordfence:cbc3210d-224e-4ed2-ada7-dc17deb17584","source":"wordfence","cve":"CVE-2025-3809","title":"Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc3210d-224e-4ed2-ada7-dc17deb17584?source=api-prod","affected":[{"type":"plugin","slug":"debug-log-manager","name":"Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T20:20:37Z"},{"id":"wordfence:cbc32e6d-47c5-4050-ba77-5a54203fe56a","source":"wordfence","cve":"CVE-2026-15341","title":"User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc32e6d-47c5-4050-ba77-5a54203fe56a?source=api-prod","affected":[{"type":"plugin","slug":"user-session-synchronizer","name":"User Session Synchronizer","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T14:02:18Z","updated":"2026-09-02T13:47:59Z"},{"id":"wordfence:cbc39f4e-6965-4c5e-b3e6-9ddecff0745b","source":"wordfence","cve":"CVE-2025-31409","title":"Bridge Core < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc39f4e-6965-4c5e-b3e6-9ddecff0745b?source=api-prod","affected":[{"type":"plugin","slug":"bridge-core","name":"Bridge Core","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":false,"patched_in":"3.3.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:43:58Z"},{"id":"wordfence:cbc3fa27-630d-4048-b727-903da09ad644","source":"wordfence","cve":"CVE-2024-29789","title":"OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc3fa27-630d-4048-b727-903da09ad644?source=api-prod","affected":[{"type":"plugin","slug":"oneclick-whatsapp-order","name":"OneClick Chat to Order","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-10T18:57:47Z"},{"id":"wordfence:cbc655f0-45a1-4d67-af35-daf4129599c6","source":"wordfence","cve":"CVE-2026-81807","title":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box < 20260827 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc655f0-45a1-4d67-af35-daf4129599c6?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20260827","to_inclusive":false,"patched_in":"20260827"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:29:13Z"},{"id":"wordfence:cbc86326-fced-4583-b128-9f592979cc9e","source":"wordfence","cve":"CVE-2025-52789","title":"Lewe ChordPress <= 3.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc86326-fced-4583-b128-9f592979cc9e?source=api-prod","affected":[{"type":"plugin","slug":"chordpress","name":"Lewe ChordPress \u2013 ChordPro Text Formatter","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:28:05Z"},{"id":"wordfence:cbca3d1e-0985-43d3-855e-eee07715f670","source":"wordfence","cve":"CVE-2025-14574","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca3d1e-0985-43d3-855e-eee07715f670?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2026-01-08T17:31:31Z","updated":"2026-01-09T06:34:57Z"},{"id":"wordfence:cbca88e0-1563-43cb-adf4-4f89856a07d0","source":"wordfence","cve":"CVE-2023-51504","title":"Dan's Embedder for Google Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca88e0-1563-43cb-adf4-4f89856a07d0?source=api-prod","affected":[{"type":"plugin","slug":"dans-gcal","name":"Dan&#039;s Embedder for Google Calendar","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1","source":"wordfence","cve":"CVE-2026-116509","title":"Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbca9065-6f0a-4fb3-ba54-ebd8a7c44af1?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.9","to_inclusive":true,"patched_in":"11.3.0"}],"published":"2026-11-12T20:51:37Z","updated":"2026-11-13T09:35:15Z"},{"id":"wordfence:cbcb1acb-1784-4ba2-83de-0fb89f5bd4d5","source":"wordfence","cve":"CVE-2024-49255","title":"Da Reactions <= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcb1acb-1784-4ba2-83de-0fb89f5bd4d5?source=api-prod","affected":[{"type":"plugin","slug":"da-reactions","name":"Da Reactions","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:57:22Z"},{"id":"wordfence:cbcb50dc-92b3-430c-bce3-81a46f4271e0","source":"wordfence","cve":"CVE-2026-97079","title":"Appointment Booking Plugin & Scheduling System \u2013 Webba Booking Calendar <= 6.5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcb50dc-92b3-430c-bce3-81a46f4271e0?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:41:00Z"},{"id":"wordfence:cbcd978b-e81f-4c39-b2f7-adc948d21b1b","source":"wordfence","cve":"CVE-2024-12171","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcd978b-e81f-4c39-b2f7-adc948d21b1b?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T03:21:14Z"},{"id":"wordfence:cbce3e7d-2f6f-4cdb-9936-3c8b0e5dfff5","source":"wordfence","cve":"CVE-2026-105257","title":"LatePoint <= 5.7.4 - Authenticated (Agent+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbce3e7d-2f6f-4cdb-9936-3c8b0e5dfff5?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.4","to_inclusive":true,"patched_in":"5.7.5"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T19:42:16Z"},{"id":"wordfence:cbce42a0-29a7-40df-973c-1fe7338f6c94","source":"wordfence","cve":"CVE-2023-5660","title":"SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbce42a0-29a7-40df-973c-1fe7338f6c94?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.22.3.31","to_inclusive":true,"patched_in":"1.23.11.6"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbcec789-62b1-4858-a746-8034ff988458","source":"wordfence","cve":"CVE-2026-73403","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcec789-62b1-4858-a746-8034ff988458?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T18:59:15Z"},{"id":"wordfence:cbcf3487-c1d4-4173-b197-1dd381990eb7","source":"wordfence","cve":"CVE-2023-37991","title":"WP Emoji One <= 0.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcf3487-c1d4-4173-b197-1dd381990eb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-emoji-one","name":"WP Emoji One","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbcf65b9-0114-46e6-a51f-61d606c68e5c","source":"wordfence","cve":"CVE-2011-5181","title":"Live Chat from ClickDesk \u2013 Live Chat \u2013 Help Desk Plugin for Websites <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcf65b9-0114-46e6-a51f-61d606c68e5c?source=api-prod","affected":[{"type":"plugin","slug":"clickdesk-live-support-chat-plugin","name":"Live Chat from ClickDesk \u2013 Live Chat \u2013 Help Desk Plugin for Websites","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2011-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbd38a30-f78d-4c4c-9ffa-1f84ed26f373","source":"wordfence","cve":"CVE-2026-108174","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd38a30-f78d-4c4c-9ffa-1f84ed26f373?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:37Z"},{"id":"wordfence:cbd42fc4-ab4a-4053-b765-18272eacd2bc","source":"wordfence","cve":"CVE-2024-6311","title":"Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd42fc4-ab4a-4053-b765-18272eacd2bc?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.7.3.2","to_inclusive":true,"patched_in":"3.7.4.1"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T06:43:31Z"},{"id":"wordfence:cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2","source":"wordfence","cve":"CVE-2026-97340","title":"Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd47a59-5a9e-4eb2-9152-2cd47fc38ae2?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.16.1","to_inclusive":true,"patched_in":"7.16.2"}],"published":"2026-10-09T19:26:37Z","updated":"2026-10-10T07:41:48Z"},{"id":"wordfence:cbd4983f-bf92-45c3-95a6-6f5e39bca228","source":"wordfence","cve":"CVE-2023-35772","title":"Google Map Shortcode <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd4983f-bf92-45c3-95a6-6f5e39bca228?source=api-prod","affected":[{"type":"plugin","slug":"google-map-shortcode","name":"Google Map Shortcode","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbd4f08c-9989-4af9-b615-1db82909a1db","source":"wordfence","cve":"CVE-2021-24714","title":"Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd4f08c-9989-4af9-b615-1db82909a1db?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":false,"patched_in":"3.6.3"}],"published":"2021-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbd5dc98-ac5b-4548-9f98-faa91f5b1e2b","source":"wordfence","cve":"CVE-2021-24682","title":"Cool Tag Cloud <= 2.25 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd5dc98-ac5b-4548-9f98-faa91f5b1e2b?source=api-prod","affected":[{"type":"plugin","slug":"cool-tag-cloud","name":"Cool Tag Cloud","from":"*","from_inclusive":true,"to":"2.25","to_inclusive":true,"patched_in":"2.26"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbd6a4ee-49ea-4008-83ac-1a3c3ccdd4d4","source":"wordfence","cve":"CVE-2024-9835","title":"RSS Feed Widget <= 3.0.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd6a4ee-49ea-4008-83ac-1a3c3ccdd4d4?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-10-22T00:00:00Z","updated":"2024-12-12T18:02:24Z"},{"id":"wordfence:cbd8d37d-50f7-4480-acef-cdec33c9f07f","source":"wordfence","cve":"CVE-2015-20067","title":"WP Attachment Export < 0.2.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbd8d37d-50f7-4480-acef-cdec33c9f07f?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachment-export","name":"WP Attachment Export","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":false,"patched_in":"0.2.4"}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbdb3be2-50c5-4516-bce1-8785e338fe5c","source":"wordfence","cve":"","title":"Tidio \u2013 Live Chat, Chatbots & Email Integration <= 5.2.0 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdb3be2-50c5-4516-bce1-8785e338fe5c?source=api-prod","affected":[{"type":"plugin","slug":"tidio-live-chat","name":"Tidio \u2013 Live Chat & AI Chatbots","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbde3644-4ac3-4082-9dc2-676c47c43532","source":"wordfence","cve":"CVE-2025-59589","title":"Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbde3644-4ac3-4082-9dc2-676c47c43532?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.8","to_inclusive":true,"patched_in":"8.6.9"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:55:33Z"},{"id":"wordfence:cbdfe58e-1e09-41b6-8ac9-6976c27aa58d","source":"wordfence","cve":"CVE-2025-11268","title":"Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":4.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdfe58e-1e09-41b6-8ac9-6976c27aa58d?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.2.16","to_inclusive":true,"patched_in":"3.2.17"}],"published":"2025-11-05T19:34:35Z","updated":"2025-11-06T08:26:29Z"},{"id":"wordfence:cbdfef0e-aadd-456b-84f6-ecd626400cbe","source":"wordfence","cve":"CVE-2012-1785","title":"Videopack (formerly Video Embed & Thumbnail Generator) < 2.0 - Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbdfef0e-aadd-456b-84f6-ecd626400cbe?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-thumbnail-generator","name":"Videopack","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2012-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbe0477e-4a48-4d0d-8cc4-17d1bce84658","source":"wordfence","cve":"CVE-2025-26962","title":"Contact Form Plugin <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe0477e-4a48-4d0d-8cc4-17d1bce84658?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-lite","name":"Contact Form Plugin","from":"*","from_inclusive":true,"to":"1.1.25","to_inclusive":true,"patched_in":"1.1.27"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:55:04Z"},{"id":"wordfence:cbe2243d-b1a7-4658-ab0e-2a49bc00515f","source":"wordfence","cve":"CVE-2026-119467","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe2243d-b1a7-4658-ab0e-2a49bc00515f?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-11-07T09:02:00Z","updated":"2026-11-10T19:25:40Z"},{"id":"wordfence:cbe2be48-cad8-4679-beb8-c4c80c045d37","source":"wordfence","cve":"CVE-2026-57799","title":"Nuss - Hotel Booking WordPress <= 1.3.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe2be48-cad8-4679-beb8-c4c80c045d37?source=api-prod","affected":[{"type":"theme","slug":"nuss","name":"Nuss - Hotel Booking WordPress","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:35:16Z"},{"id":"wordfence:cbe3ce13-ce92-423f-b190-1b2c3dc74b82","source":"wordfence","cve":"CVE-2025-14357","title":"Mega Store Woocommerce <= 6.4.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe3ce13-ce92-423f-b190-1b2c3dc74b82?source=api-prod","affected":[{"type":"theme","slug":"mega-store-woocommerce","name":"Mega Store Woocommerce","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:50:48Z","updated":"2026-08-15T20:25:14Z"},{"id":"wordfence:cbe7a209-d5c8-4616-bdcb-c52569231774","source":"wordfence","cve":"CVE-2024-37274","title":"WP Mobile Menu <= 2.8.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe7a209-d5c8-4616-bdcb-c52569231774?source=api-prod","affected":[{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.4.3","to_inclusive":true,"patched_in":"2.8.4.4"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:38:12Z"},{"id":"wordfence:cbe8cf1c-6105-4d38-b057-79566b1cd057","source":"wordfence","cve":"CVE-2025-26560","title":"WP Contact Form III <= 1.6.2d - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe8cf1c-6105-4d38-b057-79566b1cd057?source=api-prod","affected":[{"type":"plugin","slug":"wp-contact-form-iii","name":"WP Contact Form III","from":"*","from_inclusive":true,"to":"1.6.2d","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T18:05:36Z"},{"id":"wordfence:cbe8cf6c-b1fa-4f71-bb63-c8b181e54882","source":"wordfence","cve":"CVE-2026-15155","title":"Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection","severity":"high","cvss":8.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-07-10T16:46:50Z","updated":"2026-07-17T14:45:27Z"},{"id":"wordfence:cbed386b-9db6-499e-95eb-01bf35017b3a","source":"wordfence","cve":"CVE-2026-27394","title":"Eventer - WordPress Event & Booking Manager Plugin <= 0.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbed386b-9db6-499e-95eb-01bf35017b3a?source=api-prod","affected":[{"type":"plugin","slug":"eventer","name":"Eventer","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T20:59:29Z"},{"id":"wordfence:cbee3d3b-383b-48f5-be63-61cd692a18a0","source":"wordfence","cve":"CVE-2025-12583","title":"Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbee3d3b-383b-48f5-be63-61cd692a18a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-downloads-list","name":"Simple Downloads List","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-11-07T14:19:32Z","updated":"2025-11-08T02:28:03Z"},{"id":"wordfence:cbeff9a1-98e6-467b-83d0-416fdee2a8bf","source":"wordfence","cve":"CVE-2026-77702","title":"Eventin <= 4.1.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbeff9a1-98e6-467b-83d0-416fdee2a8bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:50:37Z"},{"id":"wordfence:cbf193ef-e172-4fe3-9bff-b5cbac9adb54","source":"wordfence","cve":"CVE-2023-7230","title":"illi Link Party! <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbf193ef-e172-4fe3-9bff-b5cbac9adb54?source=api-prod","affected":[{"type":"plugin","slug":"link-party","name":"illi Link Party!","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:49:09Z"},{"id":"wordfence:cbf1cbe0-4740-4d76-a3f5-7d2e1a64d4ee","source":"wordfence","cve":"CVE-2026-104909","title":"Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbf1cbe0-4740-4d76-a3f5-7d2e1a64d4ee?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-13T19:23:16Z","updated":"2026-10-14T07:43:36Z"},{"id":"wordfence:cbf8a398-334b-4b89-8a39-b8f0032fefc7","source":"wordfence","cve":"CVE-2022-25812","title":"Transposh WordPress Translation <= 1.0.9.1 - Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbf8a398-334b-4b89-8a39-b8f0032fefc7?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.1","to_inclusive":true,"patched_in":"1.0.9.2"}],"published":"2022-07-22T00:00:00Z","updated":"2025-07-21T14:05:12Z"},{"id":"wordfence:cbfbb06c-f048-4912-9ff7-59aa10bc96bd","source":"wordfence","cve":"CVE-2023-0765","title":"Gallery by BestWebSoft <= 4.6.9 - Authenticated (Author+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbfbb06c-f048-4912-9ff7-59aa10bc96bd?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbfbd7c2-7a46-4292-9173-f90298a7fcc4","source":"wordfence","cve":"CVE-2023-48322","title":"eDoc Employee Job Application <= 1.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbfbd7c2-7a46-4292-9173-f90298a7fcc4?source=api-prod","affected":[{"type":"plugin","slug":"edoc-employee-application","name":"eDoc Employee Job Application  \u2013 Best WordPress Job Manager for Employees","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbfd8d72-ce1a-4366-9d1b-13c8c5fe8b71","source":"wordfence","cve":"CVE-2025-64350","title":"Rank Math SEO <= 1.0.252.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbfd8d72-ce1a-4366-9d1b-13c8c5fe8b71?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.252.1","to_inclusive":true,"patched_in":"1.0.253"}],"published":"2025-09-11T00:00:00Z","updated":"2025-11-04T15:35:49Z"},{"id":"wordfence:cbfe514a-03e9-4834-951d-c0b09fc40b29","source":"wordfence","cve":"CVE-2026-118091","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbfe514a-03e9-4834-951d-c0b09fc40b29?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.5","to_inclusive":true,"patched_in":"3.13.6"}],"published":"2026-10-29T14:22:00Z","updated":"2026-11-03T19:45:19Z"},{"id":"wordfence:cbff7ec1-535d-43bf-be61-83a1e7625c77","source":"wordfence","cve":"","title":"Top 10 \u2013 Popular posts plugin for WordPress <= 3.2.4 - Missing Authorization on tptn_chart_data","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbff7ec1-535d-43bf-be61-83a1e7625c77?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cbff92c1-8492-4d0d-bd90-8fd33625bf6f","source":"wordfence","cve":"CVE-2024-9941","title":"WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cbff92c1-8492-4d0d-bd90-8fd33625bf6f?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.1.0","to_inclusive":true,"patched_in":"67.2.0"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T07:38:07Z"},{"id":"wordfence:cc0087a8-ec3a-4c16-8ce3-d346ae0ca58d","source":"wordfence","cve":"CVE-2023-6824","title":"WP Customer Area <= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0087a8-ec3a-4c16-8ce3-d346ae0ca58d?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:47:11Z"},{"id":"wordfence:cc010feb-52bc-4775-a011-c0415cf5821c","source":"wordfence","cve":"CVE-2025-22515","title":"Show Google Analytics widget <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc010feb-52bc-4775-a011-c0415cf5821c?source=api-prod","affected":[{"type":"plugin","slug":"show-google-analytics-widget","name":"Show Google Analytics widget","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:43:02Z"},{"id":"wordfence:cc01bb79-67cd-40d8-b0e0-1853df1aa3c4","source":"wordfence","cve":"CVE-2016-20065","title":"Product Catalog 8 <= 1.2.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc01bb79-67cd-40d8-b0e0-1853df1aa3c4?source=api-prod","affected":[{"type":"plugin","slug":"product-catalog-8","name":"product-catalog-8","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2016-11-28T00:00:00Z","updated":"2026-07-29T16:03:05Z"},{"id":"wordfence:cc030c9a-3cda-4eb8-9a7f-94a4b65a4272","source":"wordfence","cve":"CVE-2024-30503","title":"Mailster <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc030c9a-3cda-4eb8-9a7f-94a4b65a4272?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster WordPress Newsletter Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:48:43Z"},{"id":"wordfence:cc03b3f4-2edb-463b-812b-6a187a7a893c","source":"wordfence","cve":"CVE-2024-13635","title":"VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc03b3f4-2edb-463b-812b-6a187a7a893c?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.94.2.2","to_inclusive":true,"patched_in":"1.95.0.3"}],"published":"2025-03-06T21:13:55Z","updated":"2025-03-07T09:21:16Z"},{"id":"wordfence:cc046b72-692a-4980-90ad-26c8fc2a131a","source":"wordfence","cve":"","title":"Ultimate Member <= 1.3.64 - Local File Inclusion","severity":"critical","cvss":9.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc046b72-692a-4980-90ad-26c8fc2a131a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"1.3.65","to_inclusive":false,"patched_in":"1.3.65"}],"published":"2016-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc06654f-a522-4b86-aff6-2d0a6c7ec0a2","source":"wordfence","cve":"CVE-2026-106015","title":"Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover visa Brute Force","severity":"critical","cvss":9.8,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc06654f-a522-4b86-aff6-2d0a6c7ec0a2?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-affiliate","name":"Ecommerce Affiliate","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:34:08Z"},{"id":"wordfence:cc06a6d7-4fd9-450d-99f2-3f40343a9555","source":"wordfence","cve":"CVE-2020-12742","title":"iubenda < 2.3.5 - Failure to Restrict URL Protocol","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc06a6d7-4fd9-450d-99f2-3f40343a9555?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2020-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc07d2db-0a1b-4948-ad02-f9b244b40e66","source":"wordfence","cve":"CVE-2026-104724","title":"FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc07d2db-0a1b-4948-ad02-f9b244b40e66?source=api-prod","affected":[{"type":"plugin","slug":"firebox","name":"FireBox \u2013 WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2026-10-09T15:42:12Z","updated":"2026-10-10T04:26:48Z"},{"id":"wordfence:cc083470-3b43-42f3-8979-7fa6cce6ee75","source":"wordfence","cve":"CVE-2024-10531","title":"Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc083470-3b43-42f3-8979-7fa6cce6ee75?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:19Z"},{"id":"wordfence:cc09377b-f30b-414b-a551-d3689ddcc5a4","source":"wordfence","cve":"CVE-2026-3350","title":"Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc09377b-f30b-414b-a551-d3689ddcc5a4?source=api-prod","affected":[{"type":"plugin","slug":"alt-manager","name":"Image Alt Text Manager \u2013 Bulk & Dynamic Alt Tags For image SEO Optimization + AI","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-03-20T10:42:47Z","updated":"2026-03-20T23:25:13Z"},{"id":"wordfence:cc09b436-fa3d-4ed0-8b99-e14234332521","source":"wordfence","cve":"CVE-2025-24562","title":"KBucket <= 4.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc09b436-fa3d-4ed0-8b99-e14234332521?source=api-prod","affected":[{"type":"plugin","slug":"kbucket","name":"KBucket: Your Curated Content in WordPress","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:07:24Z"},{"id":"wordfence:cc0af0a4-81b5-425e-aba3-0c422aa33634","source":"wordfence","cve":"CVE-2025-14168","title":"WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0af0a4-81b5-425e-aba3-0c422aa33634?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-booster","name":"WP DB Booster","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:05:46Z","updated":"2025-12-20T03:20:24Z"},{"id":"wordfence:cc0b766a-b7fd-4950-9868-de3308123229","source":"wordfence","cve":"CVE-2024-13529","title":"SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0b766a-b7fd-4950-9868-de3308123229?source=api-prod","affected":[{"type":"theme","slug":"socialv","name":"SocialV - Social Network and Community BuddyPress Theme","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T09:21:08Z"},{"id":"wordfence:cc0d15ab-e0a4-4ac5-8558-23aeaf00b11a","source":"wordfence","cve":"CVE-2006-2667","title":"WordPress Core < 2.0.3 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0d15ab-e0a4-4ac5-8558-23aeaf00b11a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2006-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc0e133d-b1c7-42c4-bd1f-7b91f0ec4fb3","source":"wordfence","cve":"CVE-2021-36849","title":"Social Media Share Buttons <= 3.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0e133d-b1c7-42c4-bd1f-7b91f0ec4fb3?source=api-prod","affected":[{"type":"plugin","slug":"mashsharer","name":"MashShare \u2013 Social Media Share Buttons, Social Share Icons","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2022-06-16T15:39:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc0fbe84-e455-4e62-9c48-49340d08f81d","source":"wordfence","cve":"CVE-2026-12416","title":"Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0fbe84-e455-4e62-9c48-49340d08f81d?source=api-prod","affected":[{"type":"plugin","slug":"invoice-creator","name":"Invoice Generator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:37:37Z","updated":"2026-06-24T05:33:30Z"},{"id":"wordfence:cc10a78a-7950-4ebe-a8c2-a61156b60842","source":"wordfence","cve":"CVE-2025-22811","title":"MT Addons for Elementor <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc10a78a-7950-4ebe-a8c2-a61156b60842?source=api-prod","affected":[{"type":"plugin","slug":"mt-addons-for-elementor","name":"MT Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:01:03Z"},{"id":"wordfence:cc116b88-6610-4383-a6a7-5528e1a16ba9","source":"wordfence","cve":"CVE-2025-53258","title":"Hover Effects <= 2.1.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc116b88-6610-4383-a6a7-5528e1a16ba9?source=api-prod","affected":[{"type":"plugin","slug":"hover-effects","name":"Hover Effects \u2013 easily create any hover effect","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-06-27T00:00:00Z","updated":"2025-12-03T16:54:24Z"},{"id":"wordfence:cc13d13c-6b79-4bf1-8e77-c8cb836dc0c5","source":"wordfence","cve":"CVE-2025-11923","title":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc13d13c-6b79-4bf1-8e77-c8cb836dc0c5?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"3.5.3","from_inclusive":true,"to":"3.41.1","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"4.0.0","from_inclusive":true,"to":"4.21.3","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"5.0.0","from_inclusive":true,"to":"5.10.0","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"6.0.0","from_inclusive":true,"to":"6.11.0","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"7.0.0","from_inclusive":true,"to":"7.8.7","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"8.0.0","from_inclusive":true,"to":"8.0.7","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"9.0.0","from_inclusive":true,"to":"9.0.7","to_inclusive":true,"patched_in":"3.41.2"},{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"9.1.0","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"3.41.2"}],"published":"2025-11-12T14:27:17Z","updated":"2025-11-13T21:56:09Z"},{"id":"wordfence:cc174fc6-b72a-49ed-9aed-7a935a239295","source":"wordfence","cve":"CVE-2026-57372","title":"WPJAM Basic <= 7.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc174fc6-b72a-49ed-9aed-7a935a239295?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:29:50Z"},{"id":"wordfence:cc1aa8e9-27d4-44ee-a23a-f8c35d295591","source":"wordfence","cve":"CVE-2026-103335","title":"Video Conferencing with Zoom <= 4.6.10 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1aa8e9-27d4-44ee-a23a-f8c35d295591?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"4.6.11"}],"published":"2026-10-05T08:43:00Z","updated":"2026-10-08T23:17:37Z"},{"id":"wordfence:cc1ac65f-1bea-4efd-b918-754f306abd0a","source":"wordfence","cve":"CVE-2025-10720","title":"WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1ac65f-1bea-4efd-b918-754f306abd0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T00:00:00Z","updated":"2025-10-16T13:09:24Z"},{"id":"wordfence:cc1b09fe-7f2c-4236-a0d2-54a0f9490e46","source":"wordfence","cve":"CVE-2026-121722","title":"Formidable Forms Signature Online Contract Automation <= 2.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1b09fe-7f2c-4236-a0d2-54a0f9490e46?source=api-prod","affected":[{"type":"plugin","slug":"forms-signature-formidable-online-contract-automation","name":"Formidable Forms Signature Online Contract Automation","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-11-07T10:41:25Z","updated":"2026-11-10T19:45:08Z"},{"id":"wordfence:cc1c76ee-078d-4c9a-a4d3-063d9147d7e8","source":"wordfence","cve":"CVE-2024-8921","title":"Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1c76ee-078d-4c9a-a4d3-063d9147d7e8?source=api-prod","affected":[{"type":"plugin","slug":"zita-site-library","name":"Zita Site Library for Elementor","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2024-10-15T21:49:51Z","updated":"2024-10-16T11:03:11Z"},{"id":"wordfence:cc1ca9d4-49bf-4718-a451-edef8825a09c","source":"wordfence","cve":"CVE-2025-28879","title":"Bee Layer Slider <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1ca9d4-49bf-4718-a451-edef8825a09c?source=api-prod","affected":[{"type":"plugin","slug":"bee-layer-slider","name":"Layer Slider","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:45:51Z"},{"id":"wordfence:cc1cf03f-265c-4cb5-b32b-8039b9e5da2a","source":"wordfence","cve":"CVE-2021-24757","title":"Stylish Price List < 6.9.0 - Arbitrary Image Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1cf03f-265c-4cb5-b32b-8039b9e5da2a?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":false,"patched_in":"6.9.0"}],"published":"2021-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc1e480c-577a-467a-8297-747512286a39","source":"wordfence","cve":"CVE-2023-0520","title":"RapidExpCart <= 1.0 - Authenticated (Level 8/Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1e480c-577a-467a-8297-747512286a39?source=api-prod","affected":[{"type":"plugin","slug":"rapidexpcart","name":"RapidExpCart","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc1e9778-2860-4e3c-a2e4-28f10d585fed","source":"wordfence","cve":"","title":"CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1e9778-2860-4e3c-a2e4-28f10d585fed?source=api-prod","affected":[{"type":"plugin","slug":"gf-hubspot","name":"WP Gravity Forms HubSpot","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"gf-constant-contact","name":"WP Gravity Forms Constant Contact Plugin","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"plugin","slug":"contact-form-entries","name":"Database for Contact Form 7, WPforms, Elementor forms","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"gf-insightly","name":"WP Gravity Forms Insightly","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"cf7-infusionsoft","name":"Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"gf-dynamics-crm","name":"WP Gravity Forms Dynamics CRM","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"cf7-active-campaign","name":"Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"},{"type":"plugin","slug":"wp-hubspot-woocommerce","name":"Integration for HubSpot and WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"plugin","slug":"integration-for-contact-form-7-and-pipedrive","name":"Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"gf-zendesk","name":"WP Gravity Forms Zendesk","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"gf-salesforce-crmperks","name":"CRM Perks Integration for Gravity Forms and Salesforce","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"integration-for-gravity-forms-and-pipedrive","name":"Integration for Gravity Forms and Pipedrive","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"gf-infusionsoft","name":"WP Gravity Forms Keap/Infusionsoft","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"},{"type":"plugin","slug":"cf7-mailchimp","name":"Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"gf-zoho","name":"WP Gravity Forms Zoho CRM and Bigin","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"},{"type":"plugin","slug":"gf-freshdesk","name":"WP Gravity Forms FreshDesk Plugin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"woo-salesforce-plugin-crm-perks","name":"Integration for WooCommerce and Salesforce","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"},{"type":"plugin","slug":"cf7-insightly","name":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"wp-gravity-forms-spreadsheets","name":"Connector for Gravity Forms and Google Sheets","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"cf7-zoho","name":"WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms \u2013 CRM, Bigin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"},{"type":"plugin","slug":"wp-woocommerce-quickbooks","name":"Integration for WooCommerce and QuickBooks","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"},{"type":"plugin","slug":"wp-infusionsoft-woocommerce","name":"WP Keap/Infusionsoft WooCommerce Plugin","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"},{"type":"plugin","slug":"woo-zoho","name":"Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"cf7-zendesk","name":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"plugin","slug":"cf7-constant-contact","name":"Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2021-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc250014-98ec-4d21-8084-551c365c2223","source":"wordfence","cve":"CVE-2026-77701","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc250014-98ec-4d21-8084-551c365c2223?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:09:21Z"},{"id":"wordfence:cc26d20e-3ecd-438e-a123-5015ecc17290","source":"wordfence","cve":"CVE-2015-9272","title":"VideoWhisper Video Presentation <= 4.1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc26d20e-3ecd-438e-a123-5015ecc17290?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-video-presentation","name":"VideoWhisper Video Presentation","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2015-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc2c41b5-71ab-44f3-baf8-c9fef1dadf2d","source":"wordfence","cve":"CVE-2025-26758","title":"Spotlight Social Media Feeds <= 1.7.1 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2c41b5-71ab-44f3-baf8-c9fef1dadf2d?source=api-prod","affected":[{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:14:18Z"},{"id":"wordfence:cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c","source":"wordfence","cve":"CVE-2026-78159","title":"The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.3","to_inclusive":true,"patched_in":"6.17.3.1"}],"published":"2026-09-11T18:40:37Z","updated":"2026-09-16T15:43:06Z"},{"id":"wordfence:cc2cd74d-b828-4524-b33d-c806bfd970b9","source":"wordfence","cve":"CVE-2023-47244","title":"Email Marketing for WooCommerce by Omnisend <= 1.13.8 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2cd74d-b828-4524-b33d-c806bfd970b9?source=api-prod","affected":[{"type":"plugin","slug":"omnisend-connect","name":"Email Marketing for WooCommerce by Omnisend","from":"*","from_inclusive":true,"to":"1.13.8","to_inclusive":true,"patched_in":"1.13.9"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc2ee5bb-eeb8-4134-8f3f-b411e56457f0","source":"wordfence","cve":"CVE-2025-5062","title":"WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ee5bb-eeb8-4134-8f3f-b411e56457f0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"9.3.2","to_inclusive":true,"patched_in":"9.3.4"},{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.4","from_inclusive":true,"to":"9.4.2","to_inclusive":true,"patched_in":"9.3.4"}],"published":"2025-05-21T00:00:00Z","updated":"2025-12-03T16:28:15Z"},{"id":"wordfence:cc2f8da1-7503-45e3-8a7d-0031ce264edf","source":"wordfence","cve":"CVE-2025-6440","title":"WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2f8da1-7503-45e3-8a7d-0031ce264edf?source=api-prod","affected":[{"type":"plugin","slug":"wc-designer-pro","name":"WooCommerce Designer Pro","from":"*","from_inclusive":true,"to":"1.9.26","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-24T07:23:29Z"},{"id":"wordfence:cc313055-a433-444f-8f83-cf2be1c80652","source":"wordfence","cve":"CVE-2025-15698","title":"Business Name Generator <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc313055-a433-444f-8f83-cf2be1c80652?source=api-prod","affected":[{"type":"plugin","slug":"designbro-business-name-generator","name":"Business Name Generator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:05:46Z"},{"id":"wordfence:cc32826c-5dfd-44be-aed9-d38f945e1d97","source":"wordfence","cve":"CVE-2026-25382","title":"IdealAuto < 3.8.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc32826c-5dfd-44be-aed9-d38f945e1d97?source=api-prod","affected":[{"type":"theme","slug":"idealauto","name":"IdealAuto - Car Dealer & Services WordPress Theme","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":false,"patched_in":"3.8.6"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:47:34Z"},{"id":"wordfence:cc33b2fc-291a-49d5-8fe7-7bf4e9ebab5d","source":"wordfence","cve":"CVE-2025-31816","title":"Mobile App Canvas <= 3.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc33b2fc-291a-49d5-8fe7-7bf4e9ebab5d?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app","name":"Mobile App Canvas \u2013 Convert your Website Into an App for iOS and Android","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:47:17Z"},{"id":"wordfence:cc358df9-7930-44da-8b33-d39db8a87b20","source":"wordfence","cve":"CVE-2014-8492","title":"Profile Builder <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc358df9-7930-44da-8b33-d39db8a87b20?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2014-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc35af61-363d-463d-844a-8a0b8c37aa27","source":"wordfence","cve":"CVE-2025-23801","title":"Style Admin <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc35af61-363d-463d-844a-8a0b8c37aa27?source=api-prod","affected":[{"type":"plugin","slug":"style-admin","name":"Style Admin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:45:16Z"},{"id":"wordfence:cc3619da-815b-48ec-83b1-b7c15f729304","source":"wordfence","cve":"CVE-2025-39350","title":"wProject < 5.8.0 - Missing Authorization to Unauthenticated Content Modification and Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3619da-815b-48ec-83b1-b7c15f729304?source=api-prod","affected":[{"type":"theme","slug":"wproject","name":"wProject","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":false,"patched_in":"5.8.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:31:09Z"},{"id":"wordfence:cc365364-4185-4dcb-a3b6-36c9781b0916","source":"wordfence","cve":"CVE-2026-40730","title":"ThemeGrill Demo Importer <= 2.0.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc365364-4185-4dcb-a3b6-36c9781b0916?source=api-prod","affected":[{"type":"plugin","slug":"themegrill-demo-importer","name":"Starter Templates & Sites Pack by ThemeGrill","from":"*","from_inclusive":true,"to":"2.0.0.6","to_inclusive":true,"patched_in":"2.0.0.7"}],"published":"2026-03-06T00:00:00Z","updated":"2026-05-07T13:46:10Z"},{"id":"wordfence:cc3a7293-13e1-4dac-aa84-924228236df6","source":"wordfence","cve":"CVE-2025-49994","title":"Athens <= 1.1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3a7293-13e1-4dac-aa84-924228236df6?source=api-prod","affected":[{"type":"theme","slug":"athens","name":"Athens - Law Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-15T17:30:43Z"},{"id":"wordfence:cc3ab9de-4067-46db-99ee-e08cca4702c8","source":"wordfence","cve":"CVE-2025-58987","title":"Football Pool <= 2.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3ab9de-4067-46db-99ee-e08cca4702c8?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:12:26Z"},{"id":"wordfence:cc3cf6c5-643e-49ca-b09c-bd7cfec328ee","source":"wordfence","cve":"CVE-2026-4061","title":"Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3cf6c5-643e-49ca-b09c-bd7cfec328ee?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.18","to_inclusive":true,"patched_in":"1.13.19"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-05T13:57:54Z"},{"id":"wordfence:cc3d49c5-3054-4e1f-b571-6591a0b31d69","source":"wordfence","cve":"CVE-2023-51377","title":"Everest Forms <= 2.0.3 - Unauthorized Form Submission via Disabled Forms","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc3d49c5-3054-4e1f-b571-6591a0b31d69?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.3.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc42ac65-969a-476d-993e-7d8bc2b4fa96","source":"wordfence","cve":"","title":"Method <= 2.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc42ac65-969a-476d-993e-7d8bc2b4fa96?source=api-prod","affected":[{"type":"theme","slug":"method","name":"Method","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc43e33c-f375-4ce1-9c6c-eff8236480dd","source":"wordfence","cve":"CVE-2026-84220","title":"Kirki <= 6.3.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc43e33c-f375-4ce1-9c6c-eff8236480dd?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:25:07Z"},{"id":"wordfence:cc4598a7-d5cf-4553-b29a-659fe288ece9","source":"wordfence","cve":"CVE-2025-5955","title":"Service Finder SMS System <= 2.0.0 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4598a7-d5cf-4553-b29a-659fe288ece9?source=api-prod","affected":[{"type":"plugin","slug":"aone-sms","name":"Service Finder SMS System","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-18T16:13:49Z","updated":"2025-09-19T04:27:05Z"},{"id":"wordfence:cc465757-4295-4a75-90f6-92c4be4e8944","source":"wordfence","cve":"CVE-2022-46809","title":"ReviewX <= 1.6.7 - Unauthenticated CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc465757-4295-4a75-90f6-92c4be4e8944?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc468bfd-b9a2-4fe6-b896-d738c767146a","source":"wordfence","cve":"CVE-2024-13440","title":"Super Store Finder <= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting","severity":"high","cvss":8.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc468bfd-b9a2-4fe6-b896-d738c767146a?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1"}],"published":"2025-02-08T00:00:00Z","updated":"2025-02-13T16:30:14Z"},{"id":"wordfence:cc472230-bd80-4bdb-a969-fed7551cc60d","source":"wordfence","cve":"CVE-2019-17235","title":"IgniteUp \u2013 Coming Soon and Maintenance Mode <= 3.4.0 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc472230-bd80-4bdb-a969-fed7551cc60d?source=api-prod","affected":[{"type":"plugin","slug":"igniteup","name":"IgniteUp \u2013 Coming Soon and Maintenance Mode","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2019-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc490eea-455d-46f1-bbb1-d57af8ab5e74","source":"wordfence","cve":"CVE-2025-68604","title":"WPGraphQL <= 2.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc490eea-455d-46f1-bbb1-d57af8ab5e74?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:14:17Z"},{"id":"wordfence:cc49112a-4f12-4fc3-8f9b-832f657d76ec","source":"wordfence","cve":"","title":"Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49112a-4f12-4fc3-8f9b-832f657d76ec?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"6.2","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-10-31T00:00:00Z","updated":"2026-11-05T13:44:11Z"},{"id":"wordfence:cc49db10-988d-42bd-a9cf-9a86f4c79568","source":"wordfence","cve":"CVE-2023-7002","title":"Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url","severity":"high","cvss":7.2,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-12-22T00:00:00Z","updated":"2024-07-29T21:37:28Z"},{"id":"wordfence:cc4a7efd-f4f4-44a7-bd55-a6ae3a1d3521","source":"wordfence","cve":"CVE-2023-47877","title":"Perfmatters < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4a7efd-f4f4-44a7-bd55-a6ae3a1d3521?source=api-prod","affected":[{"type":"plugin","slug":"perfmatters","name":"Perfmatters","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc4af854-13a5-416f-ac97-aba7a6e85732","source":"wordfence","cve":"CVE-2025-48365","title":"Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4af854-13a5-416f-ac97-aba7a6e85732?source=api-prod","affected":[{"type":"plugin","slug":"customcomment","name":"Custom Comment","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:00:07Z"},{"id":"wordfence:cc4b52c6-1ac2-4f90-a776-c91232f5de34","source":"wordfence","cve":"CVE-2024-10172","title":"WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4b52c6-1ac2-4f90-a776-c91232f5de34?source=api-prod","affected":[{"type":"plugin","slug":"void-visual-whmcs-element","name":"Innovs WPBakery Visual Composer WHMCS Elements","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.4.1"}],"published":"2024-11-20T13:55:32Z","updated":"2024-12-24T16:57:29Z"},{"id":"wordfence:cc4d09e3-487a-4f12-818a-72ae9a6f33c0","source":"wordfence","cve":"CVE-2024-32580","title":"Master Slider \u2013 Responsive Touch Slider <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4d09e3-487a-4f12-818a-72ae9a6f33c0?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T12:47:13Z"},{"id":"wordfence:cc4e17e5-25d3-4100-85a2-89f44fbd3834","source":"wordfence","cve":"CVE-2025-39555","title":"Church Admin <= 5.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4e17e5-25d3-4100-85a2-89f44fbd3834?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.23","to_inclusive":true,"patched_in":"5.0.24"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T19:29:44Z"},{"id":"wordfence:cc4ec554-f7f5-4c0a-9f86-8d5c74bfe0ab","source":"wordfence","cve":"CVE-2024-33588","title":"Knowledge Base documentation & wiki plugin \u2013 BasePress <= 2.16.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4ec554-f7f5-4c0a-9f86-8d5c74bfe0ab?source=api-prod","affected":[{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.16.1","to_inclusive":true,"patched_in":"2.16.2.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:58:48Z"},{"id":"wordfence:cc4f2fd3-ed6b-4fe4-b300-02b1b35ebb7b","source":"wordfence","cve":"","title":"Easy Social Icons <= 3.2.0 - Authenticated (Admin+) Cross-Site Scripting and Missing Authorization Checks","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4f2fd3-ed6b-4fe4-b300-02b1b35ebb7b?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc525501-1fe9-4c31-a126-c1984446b978","source":"wordfence","cve":"CVE-2024-21743","title":"Houzez Login Register <= 3.2.5 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc525501-1fe9-4c31-a126-c1984446b978?source=api-prod","affected":[{"type":"plugin","slug":"houzez-login-register","name":"Houzez Login Register","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-09-17T00:00:00Z","updated":"2024-10-04T18:49:43Z"},{"id":"wordfence:cc540e5c-180f-4743-b1fb-608aa0e3ae79","source":"wordfence","cve":"CVE-2026-2868","title":"Gutenverse \u2013 Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc540e5c-180f-4743-b1fb-608aa0e3ae79?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-05-04T14:22:31Z","updated":"2026-05-05T02:26:57Z"},{"id":"wordfence:cc550fd9-c332-4a40-b4a9-166d5ffebc76","source":"wordfence","cve":"","title":"My Geo Posts Free <= 1.2 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc550fd9-c332-4a40-b4a9-166d5ffebc76?source=api-prod","affected":[{"type":"plugin","slug":"my-geo-posts-free","name":"My Geo Posts Free","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc55271f-9917-43e5-96b1-fb8360a35af2","source":"wordfence","cve":"CVE-2026-41555","title":"Newsletter Subscription Form \u2013 User Subscriptions Form, Capture Email <= 1.5.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc55271f-9917-43e5-96b1-fb8360a35af2?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-subscription-form","name":"Newsletter Subscription Form \u2013 User Subscriptions Form, Capture Email","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:30:57Z","updated":"2026-10-08T23:33:01Z"},{"id":"wordfence:cc554199-8c5c-4cce-a103-46a4a8450bf3","source":"wordfence","cve":"CVE-2025-46517","title":"Blog Manager WP <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc554199-8c5c-4cce-a103-46a4a8450bf3?source=api-prod","affected":[{"type":"plugin","slug":"blog-manager-wp","name":"Blog Manager WP","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:27:51Z"},{"id":"wordfence:cc5754c2-a052-41ac-af19-7c4f55860f95","source":"wordfence","cve":"CVE-2024-0829","title":"Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc5754c2-a052-41ac-af19-7c4f55860f95?source=api-prod","affected":[{"type":"plugin","slug":"wp-comment-fields","name":"Comments Extra Fields For Post,Pages and CPT","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:37:28Z"},{"id":"wordfence:cc588948-151d-4bdb-96a2-cdfde2cb0965","source":"wordfence","cve":"CVE-2025-30966","title":"WPJobBoard < 5.11.1 - Authenticated (Subscriber+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc588948-151d-4bdb-96a2-cdfde2cb0965?source=api-prod","affected":[{"type":"plugin","slug":"wpjobboard","name":"WP Job Board","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":false,"patched_in":"5.11.1"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:48:05Z"},{"id":"wordfence:cc5a6724-e860-410e-8a3d-c26d9bc7e842","source":"wordfence","cve":"CVE-2021-24286","title":"Redirect 404 to parent < 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc5a6724-e860-410e-8a3d-c26d9bc7e842?source=api-prod","affected":[{"type":"plugin","slug":"redirect-404-to-parent","name":"Redirect 404 to parent","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2021-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc5cee40-32a4-499a-ba34-97e07a276a36","source":"wordfence","cve":"CVE-2025-68907","title":"Hostme v2 <= 7.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc5cee40-32a4-499a-ba34-97e07a276a36?source=api-prod","affected":[{"type":"theme","slug":"hostmev2","name":"Hostme v2 - Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:09:47Z"},{"id":"wordfence:cc5f7a07-8117-4305-a72c-6afed80b6bcf","source":"wordfence","cve":"CVE-2023-23668","title":"GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc5f7a07-8117-4305-a72c-6afed80b6bcf?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc61b452-3a91-4337-a9f1-269cbcad4afd","source":"wordfence","cve":"CVE-2026-27065","title":"BuilderPress <= 2.0.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc61b452-3a91-4337-a9f1-269cbcad4afd?source=api-prod","affected":[{"type":"plugin","slug":"builderpress","name":"BuilderPress - WordPress Theme for Construction, A","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:34:26Z"},{"id":"wordfence:cc65d444-741d-4d27-84a8-07d916caf0e4","source":"wordfence","cve":"CVE-2025-62886","title":"Pricing Table builder <= 1.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc65d444-741d-4d27-84a8-07d916caf0e4?source=api-prod","affected":[{"type":"plugin","slug":"wpdevart-pricing-table","name":"Pricing Table builder \u2013 Price List","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-29T00:00:00Z","updated":"2025-10-29T21:06:59Z"},{"id":"wordfence:cc67fbfa-d84c-45c3-bbb1-4557dc70a8c9","source":"wordfence","cve":"CVE-2024-13561","title":"Target Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc67fbfa-d84c-45c3-bbb1-4557dc70a8c9?source=api-prod","affected":[{"type":"plugin","slug":"brid-video-easy-publish","name":"Target Video Easy Publish","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2025-01-28T22:37:51Z","updated":"2025-01-29T11:10:02Z"},{"id":"wordfence:cc69c2ff-5936-4b5d-b476-badca08eeeac","source":"wordfence","cve":"CVE-2025-69010","title":"Themebeez Toolkit <= 1.3.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc69c2ff-5936-4b5d-b476-badca08eeeac?source=api-prod","affected":[{"type":"plugin","slug":"themebeez-toolkit","name":"Themebeez Toolkit","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-12-26T00:00:00Z","updated":"2026-07-28T18:57:07Z"},{"id":"wordfence:cc6b1fa7-d5f9-4aec-860e-067c26745450","source":"wordfence","cve":"CVE-2026-109209","title":"All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6b1fa7-d5f9-4aec-860e-067c26745450?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2026-10-27T14:29:11Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:cc6b521b-32a4-40a2-bb4e-c0c7642693c9","source":"wordfence","cve":"CVE-2025-62927","title":"Nelio Content <= 4.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6b521b-32a4-40a2-bb4e-c0c7642693c9?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2025-10-05T00:00:00Z","updated":"2025-11-07T17:04:17Z"},{"id":"wordfence:cc6d943d-32c0-45d7-9de9-b576199e6fe7","source":"wordfence","cve":"CVE-2022-0215","title":"Login/Signup Popup <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6d943d-32c0-45d7-9de9-b576199e6fe7?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc6ed7d3-7a57-4146-997b-96d4a9063214","source":"wordfence","cve":"CVE-2024-32561","title":"Tagembed: Embed Twitter Feed, Google Reviews, YouTube Videos, TikTok, RSS Feed & More Social Media Feeds <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6ed7d3-7a57-4146-997b-96d4a9063214?source=api-prod","affected":[{"type":"plugin","slug":"tagembed-widget","name":"Tagembed: Social Media Feeds and Customer Reviews Widget","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.9"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T16:07:19Z"},{"id":"wordfence:cc6edf0a-7917-4ec1-afc0-a1000955cf2e","source":"wordfence","cve":"CVE-2025-39447","title":"JetElements For Elementor <= 2.7.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6edf0a-7917-4ec1-afc0-a1000955cf2e?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.4.1","to_inclusive":true,"patched_in":"2.7.4.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:10:05Z"},{"id":"wordfence:cc6f017d-b0ba-494d-9ad1-8b6cdca48fb1","source":"wordfence","cve":"CVE-2021-23209","title":"AMP for WP <= 1.0.77.32 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6f017d-b0ba-494d-9ad1-8b6cdca48fb1?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.77.32","to_inclusive":true,"patched_in":"1.0.77.33"}],"published":"2021-12-15T10:11:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc6fdb7c-b750-4f03-9785-a9dc7573580d","source":"wordfence","cve":"CVE-2024-2784","title":"The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc6fdb7c-b750-4f03-9785-a9dc7573580d?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T04:29:59Z"},{"id":"wordfence:cc7075a6-5609-42ab-a4cb-9d33686c7de0","source":"wordfence","cve":"CVE-2024-13833","title":"Album Gallery \u2013 WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7075a6-5609-42ab-a4cb-9d33686c7de0?source=api-prod","affected":[{"type":"plugin","slug":"new-album-gallery","name":"Album Gallery for Photo & Video","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T11:22:49Z"},{"id":"wordfence:cc727156-28dc-4b0a-b777-52a1bbc72f79","source":"wordfence","cve":"CVE-2022-4946","title":"AccessPress Anonymous Post <= 2.8.4 - Authenticated (Contributor+) Arbitrary Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc727156-28dc-4b0a-b777-52a1bbc72f79?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-anonymous-post","name":"Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc742fa0-7d10-4fe4-b95c-7d4ca563d402","source":"wordfence","cve":"CVE-2016-10972","title":"Newspaper - News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc742fa0-7d10-4fe4-b95c-7d4ca563d402?source=api-prod","affected":[{"type":"theme","slug":"Newspaper","name":"Newspaper - News & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"6.7.1","to_inclusive":true,"patched_in":"6.7.2"}],"published":"2016-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc748d31-b8e6-44b6-af30-944c0b0f1f0c","source":"wordfence","cve":"CVE-2012-10064","title":"Omni Secure Files <= 0.1.13 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc748d31-b8e6-44b6-af30-944c0b0f1f0c?source=api-prod","affected":[{"type":"plugin","slug":"omni-secure-files","name":"Omni Secure Files","from":"*","from_inclusive":true,"to":"0.1.13","to_inclusive":true,"patched_in":"0.1.14"}],"published":"2012-06-07T00:00:00Z","updated":"2026-02-02T20:59:10Z"},{"id":"wordfence:cc74954d-409a-4407-a314-878bf6bc8397","source":"wordfence","cve":"CVE-2026-119748","title":"Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.62 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc74954d-409a-4407-a314-878bf6bc8397?source=api-prod","affected":[{"type":"plugin","slug":"invoicing","name":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","from":"*","from_inclusive":true,"to":"2.8.62","to_inclusive":true,"patched_in":"2.8.63"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:56:09Z"},{"id":"wordfence:cc74e973-90ab-4678-a035-82b4b2b85604","source":"wordfence","cve":"CVE-2023-23673","title":"I Recommend This <= 3.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc74e973-90ab-4678-a035-82b4b2b85604?source=api-prod","affected":[{"type":"plugin","slug":"i-recommend-this","name":"I Recommend This \u2013 Love/Like Button for WordPress Posts","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc751980-987f-49c5-a9fb-16ba219c174a","source":"wordfence","cve":"CVE-2026-15950","title":"Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc751980-987f-49c5-a9fb-16ba219c174a?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-07-31T19:29:28Z","updated":"2026-08-01T07:49:52Z"},{"id":"wordfence:cc7689ea-3e7b-4367-872d-fa036a29f842","source":"wordfence","cve":"CVE-2024-2837","title":"WP Chat App <= 3.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7689ea-3e7b-4367-872d-fa036a29f842?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp","name":"WP Chat App","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-25T13:48:11Z"},{"id":"wordfence:cc7893ee-414d-4796-bb34-4d83951b95bd","source":"wordfence","cve":"CVE-2026-104723","title":"LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7893ee-414d-4796-bb34-4d83951b95bd?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"10.2.1","to_inclusive":true,"patched_in":"10.3.0"}],"published":"2026-10-09T17:20:42Z","updated":"2026-10-10T05:31:05Z"},{"id":"wordfence:cc7bf6c6-22ad-49cc-8199-17825b1312e7","source":"wordfence","cve":"CVE-2024-51596","title":"Business <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7bf6c6-22ad-49cc-8199-17825b1312e7?source=api-prod","affected":[{"type":"plugin","slug":"business","name":"WordPress Business Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:46:20Z"},{"id":"wordfence:cc7c7e21-fbd7-4451-bc7d-3d11db01a443","source":"wordfence","cve":"CVE-2026-7472","title":"Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc7c7e21-fbd7-4451-bc7d-3d11db01a443?source=api-prod","affected":[{"type":"plugin","slug":"expand-maker","name":"Read More & Accordion","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:12:45Z","updated":"2026-05-20T01:25:54Z"},{"id":"wordfence:cc8147ae-fb6c-444c-9113-98bdeff3a4dd","source":"wordfence","cve":"CVE-2025-30839","title":"Taxi Booking Manager for WooCommerce <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8147ae-fb6c-444c-9113-98bdeff3a4dd?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T13:59:59Z"},{"id":"wordfence:cc815ef2-dd02-4faa-b202-dd1552f889db","source":"wordfence","cve":"CVE-2026-7252","title":"WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc815ef2-dd02-4faa-b202-dd1552f889db?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimize","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"4.5.3"}],"published":"2026-05-06T15:34:39Z","updated":"2026-05-07T04:27:34Z"},{"id":"wordfence:cc825b2f-43d0-42f0-972d-7d361f7e0b59","source":"wordfence","cve":"CVE-2026-97643","title":"GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-09T17:09:26Z","updated":"2026-10-10T05:31:06Z"},{"id":"wordfence:cc83c4e8-38d6-435c-9030-aad656b47cf0","source":"wordfence","cve":"CVE-2025-49886","title":"Zikzag Core <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc83c4e8-38d6-435c-9030-aad656b47cf0?source=api-prod","affected":[{"type":"plugin","slug":"zikzag-core","name":"Zikzag Core","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-06-24T00:00:00Z","updated":"2025-07-01T19:09:49Z"},{"id":"wordfence:cc886378-cebf-4c0b-a089-62e9469dd954","source":"wordfence","cve":"","title":"KONTXT Content Advisor <= 2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc886378-cebf-4c0b-a089-62e9469dd954?source=api-prod","affected":[{"type":"plugin","slug":"blobinator","name":"KONTXT Content Advisor","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc899b1a-34b1-4e91-b0a0-d86a564f8030","source":"wordfence","cve":"CVE-2026-92409","title":"Donation Thermometer < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc899b1a-34b1-4e91-b0a0-d86a564f8030?source=api-prod","affected":[{"type":"plugin","slug":"donation-thermometer","name":"Donation Thermometer","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:25:01Z"},{"id":"wordfence:cc8aa5c9-8ffc-4dc6-8b61-8c05aded7749","source":"wordfence","cve":"CVE-2025-49958","title":"Robokassa payment gateway for Woocommerce <= 1.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8aa5c9-8ffc-4dc6-8b61-8c05aded7749?source=api-prod","affected":[{"type":"plugin","slug":"robokassa","name":"Robokassa payment gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-07-15T00:00:00Z","updated":"2026-11-03T22:44:05Z"},{"id":"wordfence:cc8e2042-93aa-454a-97b7-283d8a22bf46","source":"wordfence","cve":"CVE-2013-0734","title":"Mingle Forum  <= 1.0.33.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8e2042-93aa-454a-97b7-283d8a22bf46?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.33.3","to_inclusive":true,"patched_in":"1.0.34"}],"published":"2013-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc8e2524-b77d-447e-aea9-0dfef33809f9","source":"wordfence","cve":"","title":"Timely All-in-One Events Calendar < 1.10 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8e2524-b77d-447e-aea9-0dfef33809f9?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-event-calendar","name":"Timely All-in-One Events Calendar","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":false,"patched_in":"1.10"}],"published":"2013-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc8f06a0-8a7e-49ea-bd40-80a476434801","source":"wordfence","cve":"CVE-2026-121779","title":"YITH WooCommerce Subscription <= 4.22.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8f06a0-8a7e-49ea-bd40-80a476434801?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-subscription","name":"YITH WooCommerce Subscription","from":"*","from_inclusive":true,"to":"4.22.0","to_inclusive":true,"patched_in":"4.23.0"}],"published":"2026-11-07T08:42:00Z","updated":"2026-11-10T19:48:59Z"},{"id":"wordfence:cc8f28c6-3ee3-466f-82c3-bbc86a30bb3b","source":"wordfence","cve":"CVE-2026-92432","title":"Patreon WordPress <= 1.9.0 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc8f28c6-3ee3-466f-82c3-bbc86a30bb3b?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T19:41:20Z"},{"id":"wordfence:cc90d500-b338-43ff-aac7-14a42d3d16b8","source":"wordfence","cve":"CVE-2026-32358","title":"Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc90d500-b338-43ff-aac7-14a42d3d16b8?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.14.15","to_inclusive":true,"patched_in":"10.14.16"}],"published":"2026-02-14T00:00:00Z","updated":"2026-04-15T21:05:06Z"},{"id":"wordfence:cc910c27-d83c-4f3d-b491-f3e169d8f25f","source":"wordfence","cve":"","title":"Fluid Responsive Slideshow < 2.2.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc910c27-d83c-4f3d-b491-f3e169d8f25f?source=api-prod","affected":[{"type":"plugin","slug":"fluid-responsive-slideshow","name":"Fluid Responsive Slideshow","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2016-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc912ace-65d9-4833-a3ad-dc5d37989269","source":"wordfence","cve":"","title":"TrustMate.io integration for WooCommerce < 1.8.12 - Authenticated (Subscriber+) Arbitrary Blog Option Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc912ace-65d9-4833-a3ad-dc5d37989269?source=api-prod","affected":[{"type":"plugin","slug":"trustmate-io-integration-for-woocommerce","name":"TrustMate.io \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc938f6b-29fd-4f4f-b569-8b81a607ad47","source":"wordfence","cve":"CVE-2025-58247","title":"TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc938f6b-29fd-4f4f-b569-8b81a607ad47?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T20:18:33Z"},{"id":"wordfence:cc940d0c-446a-417b-95ac-b5f8a0586906","source":"wordfence","cve":"CVE-2024-38696","title":"Zoho CRM Lead Magnet <= 1.7.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc940d0c-446a-417b-95ac-b5f8a0586906?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.7.8.8","to_inclusive":true,"patched_in":"1.7.8.9"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:37:59Z"},{"id":"wordfence:cc97109c-187f-43b7-b5ed-5afeec5ea8fd","source":"wordfence","cve":"CVE-2023-0762","title":"Clock In Portal <= 2.1 - Cross-Site Request Forgery to Designation Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc97109c-187f-43b7-b5ed-5afeec5ea8fd?source=api-prod","affected":[{"type":"plugin","slug":"clock-in-portal","name":"Clock In Portal- Staff & Attendance Management","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc987edf-5a68-4baf-947c-e623c85ec659","source":"wordfence","cve":"CVE-2021-24123","title":"PowerPress <= 8.3.7 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc987edf-5a68-4baf-947c-e623c85ec659?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.3.8"}],"published":"2020-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cc98fca3-a68a-437e-bb16-94182f111b8d","source":"wordfence","cve":"CVE-2024-56038","title":"SendSMS <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc98fca3-a68a-437e-bb16-94182f111b8d?source=api-prod","affected":[{"type":"plugin","slug":"sendsms","name":"SendSMS","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:04:37Z"},{"id":"wordfence:cc9935d8-7790-457b-88bf-bee5e13b0f5a","source":"wordfence","cve":"CVE-2024-3233","title":"Ivory Search \u2013 WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9935d8-7790-457b-88bf-bee5e13b0f5a?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":"5.5.6"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-02T16:52:40Z"},{"id":"wordfence:cc994b2a-b3da-4edc-ada3-1150065efd30","source":"wordfence","cve":"CVE-2023-46145","title":"Themify Ultra <= 7.3.5 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc994b2a-b3da-4edc-ada3-1150065efd30?source=api-prod","affected":[{"type":"theme","slug":"themify-ultra","name":"Themify Ultra","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-04-22T14:16:48Z"},{"id":"wordfence:cc9d8d04-78af-4e43-8a51-89ece1d80336","source":"wordfence","cve":"CVE-2024-35675","title":"Advanced Woo Labels \u2013 Product Labels for WooCommerce <= 1.93 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9d8d04-78af-4e43-8a51-89ece1d80336?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-labels","name":"Advanced Woo Labels \u2013 Product Labels & Badges for WooCommerce","from":"*","from_inclusive":true,"to":"1.93","to_inclusive":true,"patched_in":"1.94"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-12T13:49:27Z"},{"id":"wordfence:cc9dd55d-3c37-4f24-81a1-fdc8ca284566","source":"wordfence","cve":"CVE-2024-0984","title":"ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9dd55d-3c37-4f24-81a1-fdc8ca284566?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:53:47Z"},{"id":"wordfence:cc9e9238-7695-4ae1-83cb-8e321615a9b1","source":"wordfence","cve":"CVE-2025-22818","title":"S3Player \u2013 WooCommerce & Elementor Integration <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc9e9238-7695-4ae1-83cb-8e321615a9b1?source=api-prod","affected":[{"type":"plugin","slug":"drm-protected-video-streaming","name":"S3Player \u2013 WooCommerce & Elementor Integration","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:58:59Z"},{"id":"wordfence:cca02358-a1d2-4f54-acf7-f7a769c58f14","source":"wordfence","cve":"CVE-2026-104398","title":"AFFI \u2013 Affiliate Marketing for WooCommerce <= 1.0.10 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca02358-a1d2-4f54-acf7-f7a769c58f14?source=api-prod","affected":[{"type":"plugin","slug":"affi-affiliate-marketing-for-woo","name":"AFFI \u2013 Affiliate Marketing for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-10-08T16:53:17Z","updated":"2026-10-13T13:52:39Z"},{"id":"wordfence:cca16945-f230-4d0d-9f40-eabd5bf42e30","source":"wordfence","cve":"","title":"Easy Social Icons <= 3.2.2 - Admin+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca16945-f230-4d0d-9f40-eabd5bf42e30?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cca2bd96-ac3c-480c-8fe7-fb5227a093ae","source":"wordfence","cve":"CVE-2024-9867","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca2bd96-ac3c-480c-8fe7-fb5227a093ae?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.2","to_inclusive":true,"patched_in":"5.10.3"}],"published":"2024-11-04T00:00:00Z","updated":"2025-08-04T20:22:03Z"},{"id":"wordfence:cca53aba-b7dd-4b78-b2ac-c69050308e94","source":"wordfence","cve":"CVE-2025-5541","title":"Runners Log <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca53aba-b7dd-4b78-b2ac-c69050308e94?source=api-prod","affected":[{"type":"plugin","slug":"runners-log","name":"Runners Log","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:54:50Z","updated":"2025-06-06T06:42:53Z"},{"id":"wordfence:cca551d0-24a7-457d-a221-ba0b68ab143e","source":"wordfence","cve":"CVE-2026-57336","title":"Jobify <= 4.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca551d0-24a7-457d-a221-ba0b68ab143e?source=api-prod","affected":[{"type":"theme","slug":"jobify","name":"Jobify - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-10T19:09:44Z"},{"id":"wordfence:cca6e588-0fd6-4643-897c-bcc3f482ddda","source":"wordfence","cve":"CVE-2026-24630","title":"Stylish Cost Calculator < 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca6e588-0fd6-4643-897c-bcc3f482ddda?source=api-prod","affected":[{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"8.3.1","to_inclusive":false,"patched_in":"8.3.1"}],"published":"2026-01-09T14:36:05Z","updated":"2026-05-11T19:41:01Z"},{"id":"wordfence:cca71257-05dc-43d5-8de6-faf0a2feab2e","source":"wordfence","cve":"CVE-2024-0767","title":"Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca71257-05dc-43d5-8de6-faf0a2feab2e?source=api-prod","affected":[{"type":"plugin","slug":"envo-elementor-for-woocommerce","name":"Envo\u2019s Templates & Widgets for Elementor and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-07T16:38:52Z"},{"id":"wordfence:cca7bb88-4a2c-4406-8610-15ce6e77c31f","source":"wordfence","cve":"CVE-2024-4087","title":"Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca7bb88-4a2c-4406-8610-15ce6e77c31f?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.975","to_inclusive":true,"patched_in":"1.3.976"}],"published":"2024-05-31T17:38:07Z","updated":"2024-06-01T05:38:11Z"},{"id":"wordfence:cca90146-83bb-42bd-9b3b-89298f7a2b2c","source":"wordfence","cve":"CVE-2024-49695","title":"WP Flow Plus <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca90146-83bb-42bd-9b3b-89298f7a2b2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-imageflow2","name":"WP Flow Plus","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:15:54Z"},{"id":"wordfence:cca9a0f3-7377-4411-a2e4-55574da614c0","source":"wordfence","cve":"CVE-2025-23537","title":"add custom google tag manager <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca9a0f3-7377-4411-a2e4-55574da614c0?source=api-prod","affected":[{"type":"plugin","slug":"add-custom-google-tag-manager","name":"add custom google tag manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:31:21Z"},{"id":"wordfence:cca9f71c-42e6-416f-94f2-cb79bbdfc69a","source":"wordfence","cve":"CVE-2024-12323","title":"turboSMTP <= 4.6 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cca9f71c-42e6-416f-94f2-cb79bbdfc69a?source=api-prod","affected":[{"type":"plugin","slug":"turbosmtp","name":"turboSMTP","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2024-12-09T00:00:00Z","updated":"2024-12-10T14:28:14Z"},{"id":"wordfence:ccaba382-7fe8-4197-bec4-87c35d9a7a81","source":"wordfence","cve":"CVE-2026-8425","title":"Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccaba382-7fe8-4197-bec4-87c35d9a7a81?source=api-prod","affected":[{"type":"plugin","slug":"notify-odoo","name":"Notify Odoo","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-05-14T18:52:41Z","updated":"2026-05-15T07:46:39Z"},{"id":"wordfence:ccaccf03-4162-4365-9f12-0363a78e91d4","source":"wordfence","cve":"CVE-2026-0950","title":"Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccaccf03-4162-4365-9f12-0363a78e91d4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.17","to_inclusive":true,"patched_in":"2.19.18"}],"published":"2026-02-02T16:58:28Z","updated":"2026-02-03T05:30:16Z"},{"id":"wordfence:ccad206a-407e-4c49-9a4a-d5dce3e9612a","source":"wordfence","cve":"","title":"Two Way CHAT \u2013 Send or receive messages to your user <= 3.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccad206a-407e-4c49-9a4a-d5dce3e9612a?source=api-prod","affected":[{"type":"plugin","slug":"twchat","name":"TWChat \u2013 Send or receive messages from users","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680","source":"wordfence","cve":"CVE-2026-107758","title":"Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccae5cbd-cfe6-48b3-8bcd-0b08ceb94680?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.390","to_inclusive":true,"patched_in":"1.0.392"}],"published":"2026-10-15T15:13:57Z","updated":"2026-10-16T03:38:44Z"},{"id":"wordfence:ccb24a6d-5df4-4b56-b63a-353ad41e7f1c","source":"wordfence","cve":"CVE-2025-68017","title":"Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb24a6d-5df4-4b56-b63a-353ad41e7f1c?source=api-prod","affected":[{"type":"plugin","slug":"antideo-email-validator","name":"Antideo Email Validator","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-01-16T00:00:00Z","updated":"2026-03-17T21:31:35Z"},{"id":"wordfence:ccb34b44-9fa4-4ebe-b217-b2a42920247f","source":"wordfence","cve":"CVE-2023-5387","title":"Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb34b44-9fa4-4ebe-b217-b2a42920247f?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccb518a4-bdc7-463e-95b7-0628c566aab8","source":"wordfence","cve":"CVE-2024-6070","title":"If-So Dynamic Content Personalization <= 1.8.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb518a4-bdc7-463e-95b7-0628c566aab8?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.8.0.3","to_inclusive":true,"patched_in":"1.8.0.4"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T19:11:22Z"},{"id":"wordfence:ccb6275e-d933-428c-890c-dbfb95d5e4a1","source":"wordfence","cve":"CVE-2023-24003","title":"WP Popups <= 2.1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb6275e-d933-428c-890c-dbfb95d5e4a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-popups-lite","name":"WP Popups \u2013 WordPress Popup builder","from":"*","from_inclusive":true,"to":"2.1.4.8","to_inclusive":true,"patched_in":"2.1.4.9"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccb65de5-bfb5-47db-87c9-ad46e65924b8","source":"wordfence","cve":"CVE-2024-3679","title":"Premium SEO Pack \u2013 WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb65de5-bfb5-47db-87c9-ad46e65924b8?source=api-prod","affected":[{"type":"plugin","slug":"premium-seo-pack","name":"Premium SEO Pack \u2013 WP SEO Plugin","from":"*","from_inclusive":true,"to":"1.6.002","to_inclusive":true,"patched_in":""}],"published":"2024-08-28T00:00:00Z","updated":"2024-10-28T20:33:41Z"},{"id":"wordfence:ccb72e0c-b188-41a0-bdd4-d2532d54903c","source":"wordfence","cve":"CVE-2026-62133","title":"RTMKit <= 2.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb72e0c-b188-41a0-bdd4-d2532d54903c?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:30:00Z"},{"id":"wordfence:ccb7e94c-385e-4ce9-acfa-978403047159","source":"wordfence","cve":"CVE-2024-2664","title":"Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb7e94c-385e-4ce9-acfa-978403047159?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.24","to_inclusive":true,"patched_in":"4.10.25"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T03:16:51Z"},{"id":"wordfence:ccb81a3e-744f-4a16-ad9b-1b9dbc09571c","source":"wordfence","cve":"CVE-2025-7825","title":"Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation","severity":"medium","cvss":6.3,"cwe":"CWE-96","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=api-prod","affected":[{"type":"plugin","slug":"wp-structured-data-schema","name":"Schema Plugin For Divi, Gutenberg & Shortcodes","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:14:01Z","updated":"2026-10-21T05:31:47Z"},{"id":"wordfence:ccbeb69e-6476-42a6-86ac-723947c70301","source":"wordfence","cve":"CVE-2023-51477","title":"BuddyBoss Theme <= 2.4.60 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbeb69e-6476-42a6-86ac-723947c70301?source=api-prod","affected":[{"type":"theme","slug":"buddyboss-theme","name":"BuddyBoss Theme","from":"*","from_inclusive":true,"to":"2.4.60","to_inclusive":true,"patched_in":"2.4.61"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccbf6d57-44ba-4064-8880-81cd9136ca33","source":"wordfence","cve":"CVE-2024-56219","title":"Widget Options <= 4.0.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbf6d57-44ba-4064-8880-81cd9136ca33?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.0.6.1","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:16:35Z"},{"id":"wordfence:ccbf81d8-ecae-4e00-9a26-aea0976aa1f1","source":"wordfence","cve":"CVE-2026-39622","title":"Education Base <= 3.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbf81d8-ecae-4e00-9a26-aea0976aa1f1?source=api-prod","affected":[{"type":"theme","slug":"education-base","name":"Education Base","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-02-11T00:00:00Z","updated":"2026-08-14T15:17:04Z"},{"id":"wordfence:ccbf971e-9181-4a0c-88a4-efe8634c7b5c","source":"wordfence","cve":"CVE-2026-86407","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 5.0 - 5.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccbf971e-9181-4a0c-88a4-efe8634c7b5c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"5.0","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-09-13T00:00:00Z","updated":"2026-09-15T20:14:21Z"},{"id":"wordfence:ccc1dd7b-61f3-4358-bbf8-75f44200d3b1","source":"wordfence","cve":"CVE-2025-24982","title":"Cross-Site Request Forgery <= 1.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc1dd7b-61f3-4358-bbf8-75f44200d3b1?source=api-prod","affected":[{"type":"plugin","slug":"winterlock","name":"Activity Log for WordPress","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-24T15:17:36Z"},{"id":"wordfence:ccc2502c-9d26-4041-a020-1db35f144ddf","source":"wordfence","cve":"CVE-2025-39407","title":"Memberpress < 1.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc2502c-9d26-4041-a020-1db35f144ddf?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"}],"published":"2025-04-17T00:00:00Z","updated":"2025-08-15T19:02:45Z"},{"id":"wordfence:ccc6c0a3-8a7e-4a71-b74a-37450c2878b6","source":"wordfence","cve":"CVE-2026-104408","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.8.3 - Authenticated (Custom Role+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc6c0a3-8a7e-4a71-b74a-37450c2878b6?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.9"}],"published":"2026-10-05T08:44:00Z","updated":"2026-10-08T23:25:54Z"},{"id":"wordfence:ccc75dee-1cf8-4fda-b2a1-f5d68e6c7887","source":"wordfence","cve":"CVE-2024-6310","title":"Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc75dee-1cf8-4fda-b2a1-f5d68e6c7887?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ajax-page-loader","name":"Advanced AJAX Page Loader","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:48Z"},{"id":"wordfence:ccc7fd8b-ac7d-4b40-816a-a5a1565c422a","source":"wordfence","cve":"CVE-2014-8809","title":"WP Symposium <= 14.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc7fd8b-ac7d-4b40-816a-a5a1565c422a?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"14.10","to_inclusive":true,"patched_in":"14.11"}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cccbdb49-d423-4955-a078-ae0acdb79804","source":"wordfence","cve":"CVE-2010-0673","title":"Copperleaf Photolog <= 0.16- SQL injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cccbdb49-d423-4955-a078-ae0acdb79804?source=api-prod","affected":[{"type":"plugin","slug":"cpl","name":"Copperleaf Photolog","from":"*","from_inclusive":true,"to":"0.16","to_inclusive":true,"patched_in":""}],"published":"2010-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cccdc9ea-7511-4588-9459-61c38000724d","source":"wordfence","cve":"CVE-2018-16174","title":"LearnPress <= 3.0.12 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cccdc9ea-7511-4588-9459-61c38000724d?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2018-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccce77cf-e9a9-4fbc-a99d-b9732dce3e73","source":"wordfence","cve":"CVE-2026-115594","title":"Media Library Assistant <= 3.42 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccce77cf-e9a9-4fbc-a99d-b9732dce3e73?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2026-10-26T10:28:00Z","updated":"2026-10-28T01:22:47Z"},{"id":"wordfence:ccced656-0907-48d2-a8ab-32ac86c1e6c9","source":"wordfence","cve":"CVE-2025-46460","title":"Easy Guide <= 1.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccced656-0907-48d2-a8ab-32ac86c1e6c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-guide","name":"WordPress Easy Guide","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:08:50Z"},{"id":"wordfence:ccd11b05-feb0-4e32-b11d-9c8f10ddf30a","source":"wordfence","cve":"CVE-2025-5845","title":"Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd11b05-feb0-4e32-b11d-9c8f10ddf30a?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-reviews","name":"Affiliate Reviews","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-07-15T18:16:51Z","updated":"2025-08-22T15:23:41Z"},{"id":"wordfence:ccd273dc-9de3-4863-a787-db653f2003ca","source":"wordfence","cve":"CVE-2025-4219","title":"DPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd273dc-9de3-4863-a787-db653f2003ca?source=api-prod","affected":[{"type":"plugin","slug":"dpepress","name":"DPEPress","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T20:34:26Z","updated":"2025-05-21T09:21:52Z"},{"id":"wordfence:ccd2ef23-23b7-4a32-aeda-41ea9439f166","source":"wordfence","cve":"","title":"WP-Recall <= 16.24.47 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd2ef23-23b7-4a32-aeda-41ea9439f166?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.24.47","to_inclusive":true,"patched_in":"16.24.48"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccd3eae5-3d30-4d0d-8f95-5f0747e4e944","source":"wordfence","cve":"CVE-2026-77194","title":"Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd3eae5-3d30-4d0d-8f95-5f0747e4e944?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-01T11:31:08Z"},{"id":"wordfence:ccd73030-7185-4302-b3fd-29cbbe716e3e","source":"wordfence","cve":"CVE-2024-9820","title":"WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-784","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-login-telegram","name":"AuthPress","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-15T02:03:53Z"},{"id":"wordfence:ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a","source":"wordfence","cve":"CVE-2023-0721","title":"Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd85a72-1872-4c4f-8ba7-7f91b0b37d4a?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccd917ae-3fa2-47b5-ace7-1462647e2352","source":"wordfence","cve":"CVE-2024-9886","title":"WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd917ae-3fa2-47b5-ace7-1462647e2352?source=api-prod","affected":[{"type":"plugin","slug":"wp-baidu-map","name":"WP Baidu Map","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T14:00:09Z","updated":"2024-10-30T02:04:37Z"},{"id":"wordfence:ccda029b-e553-4d73-9ff8-51686c0c5f4c","source":"wordfence","cve":"CVE-2026-42636","title":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccda029b-e553-4d73-9ff8-51686c0c5f4c?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-10-05T16:20:25Z","updated":"2026-10-13T17:02:07Z"},{"id":"wordfence:ccdf9626-e1c2-404d-90b0-5edbfeba2faf","source":"wordfence","cve":"CVE-2025-31773","title":"Ship Per Product <= 2.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccdf9626-e1c2-404d-90b0-5edbfeba2faf?source=api-prod","affected":[{"type":"plugin","slug":"ship-per-product","name":"Ship Per Product","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:19:20Z"},{"id":"wordfence:cce0fd52-b4a3-4608-81ca-f50c859ae6a5","source":"wordfence","cve":"CVE-2024-32950","title":"WP Media Category Management <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce0fd52-b4a3-4608-81ca-f50c859ae6a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-category-management","name":"WP Media Category Management","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:33:51Z"},{"id":"wordfence:cce13008-a0f8-458f-ade5-450d0dcc966a","source":"wordfence","cve":"CVE-2024-32820","title":"Social Share Icons & Social Share Buttons <= 3.6.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce13008-a0f8-458f-ade5-450d0dcc966a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2024-04-29T00:00:00Z","updated":"2024-04-29T15:19:18Z"},{"id":"wordfence:cce35f0b-07b2-4b7b-b1c9-fcf2840e8437","source":"wordfence","cve":"CVE-2025-67961","title":"WPO365 <= 40.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce35f0b-07b2-4b7b-b1c9-fcf2840e8437?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"40.0","to_inclusive":true,"patched_in":"40.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:36:54Z"},{"id":"wordfence:cce48da9-9c9b-49ef-bc03-371cb0e99242","source":"wordfence","cve":"CVE-2025-30822","title":"Custom Login Logo <= 1.1.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce48da9-9c9b-49ef-bc03-371cb0e99242?source=api-prod","affected":[{"type":"plugin","slug":"ideal-wp-login-logo-changer","name":"Custom Login Logo","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:03:06Z"},{"id":"wordfence:cce4a7cc-d93c-4d0e-ba63-b73bee0ea181","source":"wordfence","cve":"","title":"Find Slow Functions & Actions & Filters & Hooks <= 1.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce4a7cc-d93c-4d0e-ba63-b73bee0ea181?source=api-prod","affected":[{"type":"plugin","slug":"debug-functions-time","name":"Find Slow Functions & Actions & Filters & Hooks (Debug Bar)","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":"1.41"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cce4d44a-4613-4230-ace1-2d26c7c487b3","source":"wordfence","cve":"CVE-2024-32564","title":"Post Grid Gutenberg Blocks and WordPress Blog Plugin \u2013 PostX  <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cce4d44a-4613-4230-ace1-2d26c7c487b3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T11:54:51Z"},{"id":"wordfence:ccea6d3e-a889-4058-a9ff-e75b8de16ba0","source":"wordfence","cve":"CVE-2024-4061","title":"Survey Maker \u2013 Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys <= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccea6d3e-a889-4058-a9ff-e75b8de16ba0?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2024-04-30T00:00:00Z","updated":"2024-06-06T13:21:11Z"},{"id":"wordfence:ccee37f3-4120-46fb-a201-346994d4d55b","source":"wordfence","cve":"CVE-2025-27000","title":"Simple Photo Feed <= 1.4.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccee37f3-4120-46fb-a201-346994d4d55b?source=api-prod","affected":[{"type":"plugin","slug":"simple-photo-feed","name":"Simple Photo Feed","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-25T13:56:15Z"},{"id":"wordfence:ccf00ec5-b91a-47db-81e6-68f984b8f06b","source":"wordfence","cve":"CVE-2026-12114","title":"Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf00ec5-b91a-47db-81e6-68f984b8f06b?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-supreme","name":"Team Members \u2013 Multi Language Supported Team Plugin","from":"*","from_inclusive":true,"to":"8.7","to_inclusive":true,"patched_in":"8.8"}],"published":"2026-06-29T14:28:14Z","updated":"2026-06-30T02:30:43Z"},{"id":"wordfence:ccf0d2ca-2891-45d1-8ea2-90dd435b359f","source":"wordfence","cve":"CVE-2024-2344","title":"Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf0d2ca-2891-45d1-8ea2-90dd435b359f?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.6","to_inclusive":true,"patched_in":"7.11.7"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:42:44Z"},{"id":"wordfence:ccf0d482-b4a1-47a8-8741-0970531e9630","source":"wordfence","cve":"CVE-2023-0066","title":"Companion Sitemap Generator <= 4.5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf0d482-b4a1-47a8-8741-0970531e9630?source=api-prod","affected":[{"type":"plugin","slug":"companion-sitemap-generator","name":"Companion Sitemap Generator \u2013 Simple, Smart, and SEO-Ready","from":"*","from_inclusive":true,"to":"4.5.1.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccf17caa-3f05-4461-b258-ae655d95ec2e","source":"wordfence","cve":"CVE-2026-101926","title":"Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf17caa-3f05-4461-b258-ae655d95ec2e?source=api-prod","affected":[{"type":"plugin","slug":"woo-poly-integration","name":"Hyyan Integration for WooCommerce and Polylang","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:41:32Z","updated":"2026-10-14T04:28:11Z"},{"id":"wordfence:ccf2198d-b8a4-4838-aefc-5fe9d4e5a061","source":"wordfence","cve":"CVE-2025-68887","title":"WP-BusinessDirectory <= 3.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf2198d-b8a4-4838-aefc-5fe9d4e5a061?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-13T17:36:18Z"},{"id":"wordfence:ccf2bd2a-6041-49ca-8ff9-d8541b2d2b73","source":"wordfence","cve":"CVE-2022-3132","title":"Goolytics \u2013 Simple Google Analytics <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf2bd2a-6041-49ca-8ff9-d8541b2d2b73?source=api-prod","affected":[{"type":"plugin","slug":"goolytics-simple-google-analytics","name":"Goolytics \u2013 Simple Google Analytics","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2022-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccf4554e-4b34-46b0-b423-5cee7150e6c2","source":"wordfence","cve":"CVE-2024-3208","title":"Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf4554e-4b34-46b0-b423-5cee7150e6c2?source=api-prod","affected":[{"type":"plugin","slug":"sydney-toolbox","name":"Sydney Toolbox","from":"*","from_inclusive":true,"to":"1.28","to_inclusive":true,"patched_in":"1.29"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-09T18:59:22Z"},{"id":"wordfence:ccf77cb1-b6b6-49de-8de4-20eddd3b5e62","source":"wordfence","cve":"CVE-2026-2312","title":"Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf77cb1-b6b6-49de-8de4-20eddd3b5e62?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.3.6","to_inclusive":true,"patched_in":"8.3.7"}],"published":"2026-02-13T22:18:24Z","updated":"2026-02-14T11:24:31Z"},{"id":"wordfence:ccf7ecf9-4e73-437d-98c2-be9ff3f1cdb6","source":"wordfence","cve":"CVE-2025-27302","title":"CHATLIVE <= 2.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf7ecf9-4e73-437d-98c2-be9ff3f1cdb6?source=api-prod","affected":[{"type":"plugin","slug":"chatlive","name":"CHATLIVE \u2013 Support online chat","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:45:21Z"},{"id":"wordfence:ccf80f2d-3d2d-4fe6-a4c4-5a850cf5bdc8","source":"wordfence","cve":"CVE-2018-5286","title":"GD Rating System <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccf80f2d-3d2d-4fe6-a4c4-5a850cf5bdc8?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ccfd4949-07ae-48b6-9aa2-82fd6b1bf692","source":"wordfence","cve":"CVE-2025-9129","title":"Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfd4949-07ae-48b6-9aa2-82fd6b1bf692?source=api-prod","affected":[{"type":"plugin","slug":"flexi","name":"Flexi \u2013 Guest Submit","from":"*","from_inclusive":true,"to":"4.28","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:16:14Z","updated":"2025-10-03T11:17:21Z"},{"id":"wordfence:ccfdb5f5-8417-44a3-a27c-157a9619c68b","source":"wordfence","cve":"CVE-2023-46622","title":"WPPizza <= 3.18.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfdb5f5-8417-44a3-a27c-157a9619c68b?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.18.2","to_inclusive":true,"patched_in":"3.18.3"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd00d716-535c-41eb-a766-82079e0060e6","source":"wordfence","cve":"CVE-2025-6994","title":"Reveal Listing <= 3.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd00d716-535c-41eb-a766-82079e0060e6?source=api-prod","affected":[{"type":"plugin","slug":"reveal-listing","name":"Reveal Listing","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-06T03:41:01Z"},{"id":"wordfence:cd016800-ad9b-4617-82ff-1c439b9b3920","source":"wordfence","cve":"CVE-2025-39529","title":"Scriptless Social Sharing <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd016800-ad9b-4617-82ff-1c439b9b3920?source=api-prod","affected":[{"type":"plugin","slug":"scriptless-social-sharing","name":"Scriptless Social Sharing","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-07-21T20:40:36Z"},{"id":"wordfence:cd01d83e-a337-4f93-8bd0-0c9f3c786583","source":"wordfence","cve":"CVE-2021-24784","title":"WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd01d83e-a337-4f93-8bd0-0c9f3c786583?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-logo-changer","name":"WP Admin Logo Changer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd02c709-f0c0-43cc-b0b5-90b8cb1837fe","source":"wordfence","cve":"CVE-2026-27536","title":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd02c709-f0c0-43cc-b0b5-90b8cb1837fe?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-subscribe-sm","name":"MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T19:02:27Z"},{"id":"wordfence:cd03483a-f46c-4e17-8b58-df87b0ad7fa3","source":"wordfence","cve":"CVE-2025-6720","title":"Vchasno Kasa <= 1.0.3 - Unauthenticated Log File Clearing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd03483a-f46c-4e17-8b58-df87b0ad7fa3?source=api-prod","affected":[{"type":"plugin","slug":"mrkv-vchasno-kasa","name":"MORKVA Vchasno Kasa Integration","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-07-18T17:11:58Z","updated":"2025-07-19T05:32:10Z"},{"id":"wordfence:cd066a04-8094-4004-8a64-317c6bd4e101","source":"wordfence","cve":"CVE-2024-3198","title":"WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd066a04-8094-4004-8a64-317c6bd4e101?source=api-prod","affected":[{"type":"plugin","slug":"wp-font-awesome-share-icons","name":"WP Font Awesome Share Icons","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-21T18:38:32Z","updated":"2024-05-22T06:50:35Z"},{"id":"wordfence:cd091bd5-6b6a-4964-9249-525bbbec702c","source":"wordfence","cve":"CVE-2026-7802","title":"Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd091bd5-6b6a-4964-9249-525bbbec702c?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.2","to_inclusive":true,"patched_in":"3.29.3"}],"published":"2026-05-27T14:51:29Z","updated":"2026-05-28T03:27:28Z"},{"id":"wordfence:cd0abdf2-24da-4e87-825b-0796af6c3ccd","source":"wordfence","cve":"CVE-2023-41650","title":"Remove/hide Author, Date, Category Like Entry-Meta <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd0abdf2-24da-4e87-825b-0796af6c3ccd?source=api-prod","affected":[{"type":"plugin","slug":"removehide-author-date-category-like-entry-meta","name":"Remove/hide Author, Date, Category Like Entry-Meta","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd0deff3-3498-49c2-a222-7fced860fa83","source":"wordfence","cve":"CVE-2026-115224","title":"Customer Engagement System \u2013 Popup Builder, Forms, CRM & Email Marketing Automation < 2.0.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd0deff3-3498-49c2-a222-7fced860fa83?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:15:53Z"},{"id":"wordfence:cd0fe8d5-ff39-44b3-91ce-8fd211fdbaea","source":"wordfence","cve":"CVE-2025-32228","title":"Ai Image Alt Text Generator for WP <= 1.1.5 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd0fe8d5-ff39-44b3-91ce-8fd211fdbaea?source=api-prod","affected":[{"type":"plugin","slug":"ai-image-alt-text-generator-for-wp","name":"Ai Image Alt Text Generator for WP","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-07-24T19:04:56Z"},{"id":"wordfence:cd106b92-48ee-46f4-b0a3-f595d227a0a1","source":"wordfence","cve":"CVE-2024-9575","title":"pretix widget <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd106b92-48ee-46f4-b0a3-f595d227a0a1?source=api-prod","affected":[{"type":"plugin","slug":"pretix-widget","name":"pretix widget","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:52:44Z"},{"id":"wordfence:cd11abe3-8307-492b-beef-242fb21a4206","source":"wordfence","cve":"CVE-2024-11204","title":"ForumWP \u2013 Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd11abe3-8307-492b-beef-242fb21a4206?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-12-05T19:44:17Z","updated":"2024-12-12T14:17:28Z"},{"id":"wordfence:cd126bcb-0add-4662-a4d9-03a55a7d9a32","source":"wordfence","cve":"CVE-2021-24264","title":"Image Hover Effects \u2013 Elementor Addon <= 1.3.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd126bcb-0add-4662-a4d9-03a55a7d9a32?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-addon-for-elementor","name":"Image Hover Effects \u2013 Elementor Addon","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":false,"patched_in":"1.3.4"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd132aa5-d30a-41de-aa8d-aefae6c95c47","source":"wordfence","cve":"CVE-2024-12781","title":"Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd132aa5-d30a-41de-aa8d-aefae6c95c47?source=api-prod","affected":[{"type":"theme","slug":"aurum","name":"Aurum - WordPress & WooCommerce Shopping Theme","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-01-06T17:57:20Z","updated":"2025-01-07T06:40:59Z"},{"id":"wordfence:cd156e40-7706-493b-918b-c9be45040cb5","source":"wordfence","cve":"CVE-2025-58661","title":"eZee Online Hotel Booking Engine <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd156e40-7706-493b-918b-c9be45040cb5?source=api-prod","affected":[{"type":"plugin","slug":"online-booking-engine","name":"eZee Online Hotel Booking Engine","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:48:10Z"},{"id":"wordfence:cd177a43-6059-4125-9408-1090b9a54117","source":"wordfence","cve":"CVE-2022-4529","title":"Security, Antivirus, Firewall \u2013 S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd177a43-6059-4125-9408-1090b9a54117?source=api-prod","affected":[{"type":"plugin","slug":"security-antivirus-firewall","name":"Security, Antivirus, Firewall \u2013 S.A.F","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-04T00:00:00Z","updated":"2024-09-05T11:00:16Z"},{"id":"wordfence:cd188e55-6147-49a6-a68f-7b1f8f7109da","source":"wordfence","cve":"CVE-2025-15700","title":"AWP Classifieds <= 4.4.8 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd188e55-6147-49a6-a68f-7b1f8f7109da?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T13:33:46Z"},{"id":"wordfence:cd190651-2a82-41b2-9c59-5ae6e4441220","source":"wordfence","cve":"CVE-2025-31804","title":"Follow Us Badges <= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd190651-2a82-41b2-9c59-5ae6e4441220?source=api-prod","affected":[{"type":"plugin","slug":"wpsite-follow-us-badges","name":"Follow Us Badges","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:55:32Z"},{"id":"wordfence:cd1cf741-9a24-40be-9b7f-ffaa9d1d4808","source":"wordfence","cve":"CVE-2025-48103","title":"Today's Date Inserter <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd1cf741-9a24-40be-9b7f-ffaa9d1d4808?source=api-prod","affected":[{"type":"plugin","slug":"todays-date-inserter","name":"Today's Date Inserter","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-09-10T20:54:06Z"},{"id":"wordfence:cd1fc89f-b0f0-43a3-a311-07a79232a3ea","source":"wordfence","cve":"CVE-2021-25092","title":"Link Library <= 7.2.7 - Cross-Site Request Forgery to Library Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd1fc89f-b0f0-43a3-a311-07a79232a3ea?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2021-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd224169-ae51-4af8-b6de-706ed580ff8d","source":"wordfence","cve":"CVE-2024-1668","title":"Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries","severity":"medium","cvss":6.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd224169-ae51-4af8-b6de-706ed580ff8d?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.5","to_inclusive":true,"patched_in":"7.11.6"}],"published":"2024-03-01T00:00:00Z","updated":"2024-07-31T15:43:10Z"},{"id":"wordfence:cd25daac-23a2-4375-9dc2-8e9f20a564c8","source":"wordfence","cve":"CVE-2021-24291","title":"Photo Gallery <= 1.5.68 - Multiple Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd25daac-23a2-4375-9dc2-8e9f20a564c8?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.69","to_inclusive":false,"patched_in":"1.5.69"}],"published":"2021-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd28ac3c-aaef-49e3-843d-8532404703c9","source":"wordfence","cve":"CVE-2025-11693","title":"Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd28ac3c-aaef-49e3-843d-8532404703c9?source=api-prod","affected":[{"type":"plugin","slug":"export-wp-page-to-static-html","name":"Export WordPress Pages to Static HTML & PDF \u2014 Static Site Export","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-12-12T15:39:07Z","updated":"2025-12-13T04:31:33Z"},{"id":"wordfence:cd28e5cc-94a2-4a0f-a795-7c2ddb01c35a","source":"wordfence","cve":"CVE-2021-39311","title":"link-list-manager <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd28e5cc-94a2-4a0f-a795-7c2ddb01c35a?source=api-prod","affected":[{"type":"plugin","slug":"link-list-manager","name":"link-list-manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd2951c4-6450-48a3-bcfb-5c74dc778ee7","source":"wordfence","cve":"CVE-2024-49244","title":"CSV Product Import Export for WooCommerce <= 1.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2951c4-6450-48a3-bcfb-5c74dc778ee7?source=api-prod","affected":[{"type":"plugin","slug":"csv-wc-product-import-export","name":"CSV Product Import Export for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:35:27Z"},{"id":"wordfence:cd2a8e7b-6fca-49f3-ba6d-bdaa418f611a","source":"wordfence","cve":"CVE-2024-13857","title":"WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2a8e7b-6fca-49f3-ba6d-bdaa418f611a?source=api-prod","affected":[{"type":"plugin","slug":"wpgetapi","name":"WPGet API \u2013 Connect to any external REST API","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.25.1"}],"published":"2025-03-06T20:56:52Z","updated":"2025-03-07T09:21:16Z"},{"id":"wordfence:cd2abab4-f93c-454d-928d-128a490da0e2","source":"wordfence","cve":"CVE-2023-45059","title":"Gumroad <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2abab4-f93c-454d-928d-128a490da0e2?source=api-prod","affected":[{"type":"plugin","slug":"gumroad","name":"Gumroad","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd2b419f-7b79-4988-ade3-5e7f53f3da58","source":"wordfence","cve":"CVE-2024-49690","title":"Qi Blocks <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2b419f-7b79-4988-ade3-5e7f53f3da58?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:54:12Z"},{"id":"wordfence:cd2c9b28-d5b5-4930-a441-f889ee2778cd","source":"wordfence","cve":"","title":"SchedulePress <= 5.0.4 - Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2c9b28-d5b5-4930-a441-f889ee2778cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-scheduled-posts","name":"SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd2dcc09-7de5-489a-95a5-e82cb88d8cbb","source":"wordfence","cve":"CVE-2015-2826","title":"Simple Ads Manager 2.5.94 & 2.5.96 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2dcc09-7de5-489a-95a5-e82cb88d8cbb?source=api-prod","affected":[{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"2.5.94","from_inclusive":true,"to":"2.5.94","to_inclusive":true,"patched_in":"2.5.97"},{"type":"plugin","slug":"simple-ads-manager","name":"Simple Ads Manager","from":"2.5.96","from_inclusive":true,"to":"2.5.96","to_inclusive":true,"patched_in":"2.5.97"}],"published":"2015-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd2dfa02-0404-4300-a5ed-6326f9df6d30","source":"wordfence","cve":"CVE-2025-5096","title":"TablePress <= 3.1.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2dfa02-0404-4300-a5ed-6326f9df6d30?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2025-05-22T19:56:52Z","updated":"2025-05-23T08:23:41Z"},{"id":"wordfence:cd312b95-03b1-4d0f-8bb4-712900557c67","source":"wordfence","cve":"CVE-2024-37120","title":"Tabs <= 4.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd312b95-03b1-4d0f-8bb4-712900557c67?source=api-prod","affected":[{"type":"plugin","slug":"vc-tabs","name":"Tabs \u2013 Responsive Tabs with WooCommerce Product Tab Extension","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T17:05:00Z"},{"id":"wordfence:cd328738-7467-4f30-83bb-9e1c836fa940","source":"wordfence","cve":"CVE-2010-4839","title":"Event Registration < 6.00.03 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd328738-7467-4f30-83bb-9e1c836fa940?source=api-prod","affected":[{"type":"plugin","slug":"event-registration","name":"Event Registration","from":"*","from_inclusive":true,"to":"6.00.03","to_inclusive":false,"patched_in":"6.00.03"}],"published":"2010-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd3517ac-23a4-4671-a478-b57e69b132ba","source":"wordfence","cve":"CVE-2026-90965","title":"Essential Real Estate <= 5.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd3517ac-23a4-4671-a478-b57e69b132ba?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:10:31Z"},{"id":"wordfence:cd36530d-4165-4b98-a75f-b9c88178a5b6","source":"wordfence","cve":"CVE-2014-9099","title":"WhyDoWork AdSense <= 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd36530d-4165-4b98-a75f-b9c88178a5b6?source=api-prod","affected":[{"type":"plugin","slug":"whydowork-adsense","name":"WhyDoWork AdSense","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd393566-b037-40ce-b3cd-12e323e9451b","source":"wordfence","cve":"CVE-2024-54313","title":"FULL Customer <= 3.1.25 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd393566-b037-40ce-b3cd-12e323e9451b?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"3.1.25","to_inclusive":true,"patched_in":"3.1.26"}],"published":"2024-12-11T00:00:00Z","updated":"2025-02-26T22:33:24Z"},{"id":"wordfence:cd39fb27-5631-442d-89bd-89c8981b64b3","source":"wordfence","cve":"CVE-2026-27993","title":"Aldo <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd39fb27-5631-442d-89bd-89c8981b64b3?source=api-prod","affected":[{"type":"theme","slug":"aldo","name":"Aldo","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:23:51Z"},{"id":"wordfence:cd3a7af1-0cae-4872-9e61-58e9a9e3eda5","source":"wordfence","cve":"CVE-2021-24175","title":"Plus Addons for Elementor Page Builder <= 4.1.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd3a7af1-0cae-4872-9e61-58e9a9e3eda5?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":false,"patched_in":"4.1.7"}],"published":"2021-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd3fb4fc-6a15-4b8e-8a0b-048a377fda67","source":"wordfence","cve":"CVE-2026-25422","title":"Popularis Extra <= 1.2.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd3fb4fc-6a15-4b8e-8a0b-048a377fda67?source=api-prod","affected":[{"type":"plugin","slug":"popularis-extra","name":"Popularis Extra","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-01-28T00:00:00Z","updated":"2026-11-10T23:18:40Z"},{"id":"wordfence:cd3fe254-e8cb-450b-901b-fdf49209013f","source":"wordfence","cve":"CVE-2025-5800","title":"Testimonial Post type <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd3fe254-e8cb-450b-901b-fdf49209013f?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-post-type","name":"Testimonial Post type","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:33:50Z","updated":"2025-07-18T05:24:02Z"},{"id":"wordfence:cd41bdb3-67d4-481c-a8b1-feb76df37745","source":"wordfence","cve":"CVE-2025-23889","title":"FooGallery Captions <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd41bdb3-67d4-481c-a8b1-feb76df37745?source=api-prod","affected":[{"type":"plugin","slug":"foogallery-captions","name":"FooGallery Captions","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:28:06Z"},{"id":"wordfence:cd4336a9-35db-4994-9e2a-5ed9b51a74ae","source":"wordfence","cve":"CVE-2016-10893","title":"Crayon Syntax Highlighter < 2.8.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4336a9-35db-4994-9e2a-5ed9b51a74ae?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":false,"patched_in":"2.8.4"}],"published":"2016-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd4395be-7b4c-46b0-be00-7dedc6691f4a","source":"wordfence","cve":"CVE-2026-1928","title":"Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4395be-7b4c-46b0-be00-7dedc6691f4a?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.276","to_inclusive":true,"patched_in":"1.0.277"}],"published":"2026-10-27T00:00:00Z","updated":"2026-10-28T03:42:54Z"},{"id":"wordfence:cd47f21c-70e1-4458-a552-377956141a65","source":"wordfence","cve":"CVE-2024-31305","title":"Transcoder <= 1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd47f21c-70e1-4458-a552-377956141a65?source=api-prod","affected":[{"type":"plugin","slug":"transcoder","name":"Transcoder","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:00:58Z"},{"id":"wordfence:cd493279-215e-422c-a9f9-353032b8d4aa","source":"wordfence","cve":"CVE-2026-14931","title":"JS Help Desk <= 3.1.3 - Authenticated (Contributor+) User Email Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd493279-215e-422c-a9f9-353032b8d4aa?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T15:32:27Z"},{"id":"wordfence:cd49bf11-825d-4e63-8522-f765c5d79f57","source":"wordfence","cve":"CVE-2026-39651","title":"Total Poll Lite <= 4.12.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd49bf11-825d-4e63-8522-f765c5d79f57?source=api-prod","affected":[{"type":"plugin","slug":"totalpoll-lite","name":"TotalPoll for Polls and Contests","from":"*","from_inclusive":true,"to":"4.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-15T00:00:00Z","updated":"2026-10-15T13:20:30Z"},{"id":"wordfence:cd4a087a-f7cf-451c-85d5-c37a6015b9e1","source":"wordfence","cve":"CVE-2024-12587","title":"Contact Form Master <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4a087a-f7cf-451c-85d5-c37a6015b9e1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-master","name":"Contact Form Master \u2013 by Edmon","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T00:00:00Z","updated":"2025-01-09T14:33:33Z"},{"id":"wordfence:cd4c2c11-2d73-48b4-8e7e-e281451973a2","source":"wordfence","cve":"CVE-2026-24353","title":"User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4c2c11-2d73-48b4-8e7e-e281451973a2?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"5.0"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-03T21:00:06Z"},{"id":"wordfence:cd4d67cd-5fb0-425d-8b22-c69ebb0ffa72","source":"wordfence","cve":"CVE-2024-6869","title":"Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4d67cd-5fb0-425d-8b22-c69ebb0ffa72?source=api-prod","affected":[{"type":"plugin","slug":"falang","name":"Falang multilanguage for WordPress","from":"*","from_inclusive":true,"to":"1.3.52","to_inclusive":true,"patched_in":"1.3.53"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T04:11:40Z"},{"id":"wordfence:cd4d6cbf-cec5-4fd2-af8e-698cf25da40b","source":"wordfence","cve":"CVE-2025-60131","title":"Werk aan de Muur <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4d6cbf-cec5-4fd2-af8e-698cf25da40b?source=api-prod","affected":[{"type":"plugin","slug":"werk-aan-de-muur","name":"Werk aan de Muur","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T20:49:42Z"},{"id":"wordfence:cd4dc8ab-792b-41ff-a7b9-77a11c02d91b","source":"wordfence","cve":"CVE-2025-8905","title":"Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4dc8ab-792b-41ff-a7b9-77a11c02d91b?source=api-prod","affected":[{"type":"plugin","slug":"err-our-team","name":"Inpersttion For Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:16:19Z","updated":"2026-05-04T14:57:55Z"},{"id":"wordfence:cd4f7b73-947b-4962-9880-5f279580f43c","source":"wordfence","cve":"CVE-2022-45359","title":"Yith WooCommerce Gift Cards Premium <= 3.19.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd4f7b73-947b-4962-9880-5f279580f43c?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-gift-cards-premium","name":"YITH WooCommerce Gift Cards Premium","from":"*","from_inclusive":true,"to":"3.19.0","to_inclusive":true,"patched_in":"3.20.0"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd528d9e-15e9-4a3f-a782-0c616dc73708","source":"wordfence","cve":"CVE-2026-88912","title":"rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd528d9e-15e9-4a3f-a782-0c616dc73708?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.12","to_inclusive":false,"patched_in":"4.7.12"}],"published":"2026-09-13T00:00:00Z","updated":"2026-09-15T19:58:56Z"},{"id":"wordfence:cd53147f-2230-4b8b-a1a1-df377b334072","source":"wordfence","cve":"CVE-2022-0234","title":"WOOCS <= 1.3.7.4 - Reflected Cross-Site Scripting via AJAX action","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd53147f-2230-4b8b-a1a1-df377b334072?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7.4","to_inclusive":true,"patched_in":"1.3.7.5"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd54d335-eb9c-4d0a-92c0-13462ef41a85","source":"wordfence","cve":"CVE-2018-20977","title":"Schema - All In One Schema Rich Snippets <= 1.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd54d335-eb9c-4d0a-92c0-13462ef41a85?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-schemaorg-rich-snippets","name":"Schema \u2013 All In One Schema Rich Snippets","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2017-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd552e86-5f0f-4203-b648-f069503b48e3","source":"wordfence","cve":"CVE-2021-43409","title":"WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 15.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd552e86-5f0f-4203-b648-f069503b48e3?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"15.3","to_inclusive":true,"patched_in":"15.4"}],"published":"2021-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd578650-8ce9-40a4-94ca-e9d4951503a6","source":"wordfence","cve":"","title":"WordPress Core 6.7.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Categories Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd578650-8ce9-40a4-94ca-e9d4951503a6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.7.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.7.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T18:04:56Z"},{"id":"wordfence:cd59bee7-5de5-406d-8c1b-654306d68ab8","source":"wordfence","cve":"CVE-2024-4470","title":"Master Slider \u2013 Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd59bee7-5de5-406d-8c1b-654306d68ab8?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"3.9.10"}],"published":"2024-05-20T17:59:21Z","updated":"2024-05-21T06:49:59Z"},{"id":"wordfence:cd5a3d4b-6e8b-4abe-9f38-58accada2f57","source":"wordfence","cve":"CVE-2023-45770","title":"Fast WP Speed <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5a3d4b-6e8b-4abe-9f38-58accada2f57?source=api-prod","affected":[{"type":"plugin","slug":"fast-wp-speed","name":"Fast WP Speed","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd5e9736-e4d9-4730-aaaf-2069a9633f02","source":"wordfence","cve":"CVE-2024-31938","title":"NewsXpress <= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5e9736-e4d9-4730-aaaf-2069a9633f02?source=api-prod","affected":[{"type":"theme","slug":"newsxpress","name":"NewsXpress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:54:45Z"},{"id":"wordfence:cd5ea360-0a34-4a65-b49b-d1e79b2fcddd","source":"wordfence","cve":"CVE-2026-114706","title":"Strong Testimonials <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5ea360-0a34-4a65-b49b-d1e79b2fcddd?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.15","to_inclusive":true,"patched_in":"3.3.16"}],"published":"2026-10-29T14:30:00Z","updated":"2026-11-03T19:25:03Z"},{"id":"wordfence:cd5f5861-5be4-456d-915d-bafb7bff2110","source":"wordfence","cve":"CVE-2024-1389","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5f5861-5be4-456d-915d-bafb7bff2110?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2024-02-13T00:00:00Z","updated":"2024-02-20T18:56:46Z"},{"id":"wordfence:cd600810-b1bc-4025-b441-5c90da7240de","source":"wordfence","cve":"CVE-2026-1401","title":"Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd600810-b1bc-4025-b441-5c90da7240de?source=api-prod","affected":[{"type":"plugin","slug":"tune-library","name":"Tune Library","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-06T06:46:32Z"},{"id":"wordfence:cd64b4cb-955a-4942-9837-bdf0e6a1b48a","source":"wordfence","cve":"CVE-2021-25098","title":"Easy Pricing Tables <= 3.1.2 - Arbitrary Post Removal via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd64b4cb-955a-4942-9837-bdf0e6a1b48a?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd679d7b-d8d9-46c4-87d2-8d04506ee5dd","source":"wordfence","cve":"CVE-2025-30980","title":"Simple Keyword to Link <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd679d7b-d8d9-46c4-87d2-8d04506ee5dd?source=api-prod","affected":[{"type":"plugin","slug":"simple-keyword-to-link","name":"Simple Keyword to Link","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:03:38Z"},{"id":"wordfence:cd6ce97c-fd80-4c43-a4d2-02aa91d11fac","source":"wordfence","cve":"CVE-2024-10294","title":"CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6ce97c-fd80-4c43-a4d2-02aa91d11fac?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T02:32:03Z"},{"id":"wordfence:cd6dcfe2-91c4-42c1-ada4-91c6f25c4690","source":"wordfence","cve":"CVE-2026-25468","title":"Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6dcfe2-91c4-42c1-ada4-91c6f25c4690?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.20.8","to_inclusive":true,"patched_in":"3.21.0"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:42:17Z"},{"id":"wordfence:cd6ed285-f215-44d3-9db9-9b2bfffee60a","source":"wordfence","cve":"CVE-2024-4430","title":"Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6ed285-f215-44d3-9db9-9b2bfffee60a?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.1.2","to_inclusive":true,"patched_in":"2.8.1.3"}],"published":"2024-05-10T08:49:41Z","updated":"2024-05-31T15:30:55Z"},{"id":"wordfence:cd6f4f0d-0e70-459a-8f09-64d1f6f8bb7e","source":"wordfence","cve":"","title":"BuddyForms ACF <= 1.3.8 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd6f4f0d-0e70-459a-8f09-64d1f6f8bb7e?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms-acf","name":"BuddyForms Advanced Custom Fields","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd726b20-75c9-408e-86fc-061db591a9db","source":"wordfence","cve":"CVE-2024-10324","title":"RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-1230","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd726b20-75c9-408e-86fc-061db591a9db?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T13:40:58Z"},{"id":"wordfence:cd731f89-8811-4068-ab34-3cee8cc7d089","source":"wordfence","cve":"CVE-2025-0767","title":"WP Activity Log <= 5.3.2 - Authenticated (Admin+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd731f89-8811-4068-ab34-3cee8cc7d089?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2025-02-27T00:00:00Z","updated":"2025-03-05T14:29:38Z"},{"id":"wordfence:cd7346e8-cd77-46dd-8e7d-694f65b6b62f","source":"wordfence","cve":"","title":"Second Street <= 3.1.6 - Stored Cross-Site Scripting via organization_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7346e8-cd77-46dd-8e7d-694f65b6b62f?source=api-prod","affected":[{"type":"plugin","slug":"second-street-promotion","name":"Second Street","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd73cf64-289d-4401-bef7-9a4398a85055","source":"wordfence","cve":"CVE-2023-33312","title":"Easy Captcha <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd73cf64-289d-4401-bef7-9a4398a85055?source=api-prod","affected":[{"type":"plugin","slug":"easy-captcha","name":"Easy Captcha","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd7553e8-e43d-4740-b2ee-e3d8dc351e53","source":"wordfence","cve":"CVE-2023-3447","title":"Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection","severity":"high","cvss":7.6,"cwe":"CWE-90","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=api-prod","affected":[{"type":"plugin","slug":"ldap-login-for-intranet-sites","name":"Active Directory Integration / LDAP Integration","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd760ff9-fe72-44d6-a5f0-212a20dd2a51","source":"wordfence","cve":"CVE-2026-89417","title":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd760ff9-fe72-44d6-a5f0-212a20dd2a51?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"6.3.10","to_inclusive":true,"patched_in":"6.3.11"}],"published":"2026-10-06T20:08:04Z","updated":"2026-10-07T08:28:11Z"},{"id":"wordfence:cd7875d6-e866-4625-94e5-2ef8a1d11503","source":"wordfence","cve":"CVE-2025-8568","title":"GMap - Venturit <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7875d6-e866-4625-94e5-2ef8a1d11503?source=api-prod","affected":[{"type":"plugin","slug":"gmap-venturit","name":"GMap Generator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-11T13:49:18Z","updated":"2025-08-12T02:24:48Z"},{"id":"wordfence:cd78a017-46b8-4335-b81d-480d4d0bcec2","source":"wordfence","cve":"CVE-2025-64376","title":"ListingPro < 2.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd78a017-46b8-4335-b81d-480d4d0bcec2?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":false,"patched_in":"2.9.10"}],"published":"2025-09-12T00:00:00Z","updated":"2025-12-19T17:06:21Z"},{"id":"wordfence:cd7c763f-5c2b-407e-bdb1-4ea34fac5f4d","source":"wordfence","cve":"CVE-2015-4336","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Command Execution","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7c763f-5c2b-407e-bdb1-4ea34fac5f4d?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2015-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd7dba3a-eb76-48f2-9656-7621c7406c05","source":"wordfence","cve":"CVE-2026-15244","title":"HUSKY - Products Filter Professional for WooCommerce <= 1.4.0 - Authenticated (Shop manager+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7dba3a-eb76-48f2-9656-7621c7406c05?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2026-07-17T00:00:00Z","updated":"2026-08-15T21:27:43Z"},{"id":"wordfence:cd7ed687-4049-4957-86e9-b2f59621c747","source":"wordfence","cve":"CVE-2024-4193","title":"Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7ed687-4049-4957-86e9-b2f59621c747?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider","name":"Testimonial Slider","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-09T20:03:38Z"},{"id":"wordfence:cd7fdfe6-f79b-4549-82f8-b4461a81c1f7","source":"wordfence","cve":"CVE-2025-52776","title":"Video List Manager <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7fdfe6-f79b-4549-82f8-b4461a81c1f7?source=api-prod","affected":[{"type":"plugin","slug":"video-list-manager","name":"Video List Manager","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:07:59Z"},{"id":"wordfence:cd828557-94f6-4278-98ef-bcf4d1d86440","source":"wordfence","cve":"CVE-2025-6063","title":"XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd828557-94f6-4278-98ef-bcf4d1d86440?source=api-prod","affected":[{"type":"plugin","slug":"xisearch-bar","name":"XiSearch bar","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-13T19:46:19Z","updated":"2025-06-14T08:23:27Z"},{"id":"wordfence:cd831fdb-9b06-4e4e-9423-d221fd3aa69a","source":"wordfence","cve":"CVE-2025-49428","title":"Cookie Warning <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd831fdb-9b06-4e4e-9423-d221fd3aa69a?source=api-prod","affected":[{"type":"plugin","slug":"cookie-warning","name":"Cookie Warning","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-25T17:21:08Z"},{"id":"wordfence:cd8361c6-a235-4038-935c-3a4a37340764","source":"wordfence","cve":"CVE-2025-39487","title":"Rankie <= 1.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8361c6-a235-4038-935c-3a4a37340764?source=api-prod","affected":[{"type":"plugin","slug":"valvepress-rankie","name":"Rankie - Wordpress Rank Tracker Plugin","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-24T18:12:22Z"},{"id":"wordfence:cd8389f1-b70d-4d1a-bb25-e219c9099313","source":"wordfence","cve":"","title":"Newsletter Manager <= 1.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8389f1-b70d-4d1a-bb25-e219c9099313?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-manager","name":"Newsletter Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2019-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd85da97-f62c-4c4e-ae29-dea5aa529f54","source":"wordfence","cve":"CVE-2014-1889","title":"BuddyPress <= 1.9.1 - Authorization Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd85da97-f62c-4c4e-ae29-dea5aa529f54?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":false,"patched_in":"1.9.2"}],"published":"2014-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd88b116-0a6e-412b-8d43-024fdf36bcdf","source":"wordfence","cve":"","title":"Beaver Builder \u2013 WordPress Page Builder (Free & Pro) <= 1.7 - Authorization Bypass","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd88b116-0a6e-412b-8d43-024fdf36bcdf?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2016-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd89c6ff-2737-4c48-8b0f-f305c4735775","source":"wordfence","cve":"CVE-2014-4580","title":"WP BlipBot <= 3.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd89c6ff-2737-4c48-8b0f-f305c4735775?source=api-prod","affected":[{"type":"plugin","slug":"wp-blipbot","name":"WP BlipBot","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd8a45c9-ca48-4ea6-b34e-f05206f16155","source":"wordfence","cve":"CVE-2024-10392","title":"AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8a45c9-ca48-4ea6-b34e-f05206f16155?source=api-prod","affected":[{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.89","to_inclusive":true,"patched_in":"1.8.90"}],"published":"2024-10-30T16:46:23Z","updated":"2024-10-31T05:31:23Z"},{"id":"wordfence:cd8c07cc-7fdd-4474-8be1-b08d857ae109","source":"wordfence","cve":"CVE-2022-1027","title":"Page Restriction WordPress <= 1.2.6 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8c07cc-7fdd-4474-8be1-b08d857ae109?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd8f5406-bbd2-44ab-9d98-3857216efc28","source":"wordfence","cve":"CVE-2011-5106","title":"Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8f5406-bbd2-44ab-9d98-3857216efc28?source=api-prod","affected":[{"type":"plugin","slug":"flexible-custom-post-type","name":"Flexible Custom Post Type","from":"*","from_inclusive":true,"to":"0.1.7","to_inclusive":false,"patched_in":"0.1.7"}],"published":"2011-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd90d9c0-0cab-4fd3-b016-106032f300f7","source":"wordfence","cve":"CVE-2023-5436","title":"Vertical marquee plugin <= 7.1 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd90d9c0-0cab-4fd3-b016-106032f300f7?source=api-prod","affected":[{"type":"plugin","slug":"vertical-marquee-plugin","name":"Vertical marquee plugin","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"7.2"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd93b123-bcab-41a2-910c-8d15e726297b","source":"wordfence","cve":"CVE-2026-61977","title":"JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd93b123-bcab-41a2-910c-8d15e726297b?source=api-prod","affected":[{"type":"plugin","slug":"jet-search","name":"JetSearch","from":"*","from_inclusive":true,"to":"3.6.1.2","to_inclusive":true,"patched_in":"3.6.1.3"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-04T19:33:35Z"},{"id":"wordfence:cd93da2b-a64d-45a0-8d6c-e2a93ef20e13","source":"wordfence","cve":"","title":"WordPress to Hootsuite <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd93da2b-a64d-45a0-8d6c-e2a93ef20e13?source=api-prod","affected":[{"type":"plugin","slug":"wp-to-hootsuite","name":"Social Media Auto Poster \u2013 Schedule & Publish to Hootsuite","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd9490f2-ad52-477e-ae3b-be49984e8189","source":"wordfence","cve":"CVE-2024-4463","title":"Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9490f2-ad52-477e-ae3b-be49984e8189?source=api-prod","affected":[{"type":"plugin","slug":"squelch-tabs-and-accordions-shortcodes","name":"Squelch Tabs and Accordions Shortcodes","from":"*","from_inclusive":true,"to":"0.4.7","to_inclusive":true,"patched_in":"0.4.8"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:39Z"},{"id":"wordfence:cd959968-d3f0-4546-8fc6-eb451b417f0d","source":"wordfence","cve":"CVE-2026-2351","title":"Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd959968-d3f0-4546-8fc6-eb451b417f0d?source=api-prod","affected":[{"type":"plugin","slug":"task-manager","name":"Task Manager","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:35Z","updated":"2026-03-21T03:27:03Z"},{"id":"wordfence:cd95eb77-dda1-4303-8d07-e77b7a11a4cc","source":"wordfence","cve":"CVE-2025-31454","title":"Delete Post Revision <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd95eb77-dda1-4303-8d07-e77b7a11a4cc?source=api-prod","affected":[{"type":"plugin","slug":"delete-post-revision","name":"Delete Post Revision","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:16:20Z"},{"id":"wordfence:cd95f517-baf6-4feb-a9a5-f73008634dd4","source":"wordfence","cve":"CVE-2024-32439","title":"WP Client Reports <= 1.0.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd95f517-baf6-4feb-a9a5-f73008634dd4?source=api-prod","affected":[{"type":"plugin","slug":"wp-client-reports","name":"WP Client Reports","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:00:32Z"},{"id":"wordfence:cd96beee-afcb-4439-ad9b-f24e8afeac3c","source":"wordfence","cve":"CVE-2025-6838","title":"Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection","severity":"medium","cvss":4.1,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd96beee-afcb-4439-ad9b-f24e8afeac3c?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-notifier","name":"Broken Link Notifier","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-07-10T19:45:24Z","updated":"2025-07-11T08:22:24Z"},{"id":"wordfence:cd97a7a4-9f57-4882-9e3e-0e9853416af9","source":"wordfence","cve":"CVE-2026-14262","title":"Simple JWT Login <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd97a7a4-9f57-4882-9e3e-0e9853416af9?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2026-07-10T15:02:36Z","updated":"2026-07-11T03:44:25Z"},{"id":"wordfence:cd97d688-d8af-4598-8faa-97eefad63808","source":"wordfence","cve":"CVE-2014-4515","title":"Anyfont <= 2.2.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd97d688-d8af-4598-8faa-97eefad63808?source=api-prod","affected":[{"type":"plugin","slug":"anyfont","name":"anyfont","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2014-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd9d7d34-c03d-4791-94b4-9d2f502a7e37","source":"wordfence","cve":"CVE-2024-53793","title":"eDoc Easy Tables <= 1.29 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9d7d34-c03d-4791-94b4-9d2f502a7e37?source=api-prod","affected":[{"type":"plugin","slug":"edoc-easy-tables","name":"eDoc Easy Tables \u2013 Best WordPress Table Maker","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":""}],"published":"2024-11-29T00:00:00Z","updated":"2024-12-06T16:24:26Z"},{"id":"wordfence:cd9e0044-263e-453a-b9e5-b3c6b98e90be","source":"wordfence","cve":"CVE-2022-1613","title":"Restricted Site Access <= 7.3.1 - Access Bypass via IP Spoofing","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9e0044-263e-453a-b9e5-b3c6b98e90be?source=api-prod","affected":[{"type":"plugin","slug":"restricted-site-access","name":"Restricted Site Access","from":"*","from_inclusive":true,"to":"7.3.2","to_inclusive":false,"patched_in":"7.3.2"}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cd9e0d69-8be6-442c-aa26-a6e9df6b533b","source":"wordfence","cve":"CVE-2026-108490","title":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9e0d69-8be6-442c-aa26-a6e9df6b533b?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.11.110","to_inclusive":true,"patched_in":"4.11.111"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:46:39Z"},{"id":"wordfence:cd9eb6e5-5566-4a11-bcca-26c166a5b4c5","source":"wordfence","cve":"CVE-2025-60242","title":"Download Counter <= 1.4 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9eb6e5-5566-4a11-bcca-26c166a5b4c5?source=api-prod","affected":[{"type":"plugin","slug":"download-counter","name":"Download Counter","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-22T00:00:00Z","updated":"2025-11-11T17:24:59Z"},{"id":"wordfence:cda2465e-b17e-4b5c-ad86-3c3c7a354d03","source":"wordfence","cve":"","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cda2465e-b17e-4b5c-ad86-3c3c7a354d03?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2022-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cda36dfc-385d-481a-b4f3-34f98b2b95a0","source":"wordfence","cve":"CVE-2025-23786","title":"Email to Download <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cda36dfc-385d-481a-b4f3-34f98b2b95a0?source=api-prod","affected":[{"type":"plugin","slug":"email-to-download","name":"Email to Download","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T21:15:37Z"},{"id":"wordfence:cda53ae6-ce3e-4c0e-a64d-4d2b3fe22bed","source":"wordfence","cve":"CVE-2026-48199","title":"Sermon'e <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cda53ae6-ce3e-4c0e-a64d-4d2b3fe22bed?source=api-prod","affected":[{"type":"plugin","slug":"sermone","name":"Sermon'e","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-14T00:04:24Z"},{"id":"wordfence:cda6d5d5-b49a-40f4-9c83-c1c569891339","source":"wordfence","cve":"CVE-2026-12731","title":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cda6d5d5-b49a-40f4-9c83-c1c569891339?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-07-02T11:58:36Z","updated":"2026-07-03T01:28:21Z"},{"id":"wordfence:cda83985-aa36-40ac-80ee-6963fcd77702","source":"wordfence","cve":"CVE-2026-28175","title":"Visitors Traffic Real Time Statistics <= 8.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cda83985-aa36-40ac-80ee-6963fcd77702?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"8.11","to_inclusive":true,"patched_in":"8.12"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:07:20Z"},{"id":"wordfence:cdaa6b7c-bf38-44b5-9d83-2918cbedc683","source":"wordfence","cve":"CVE-2024-12256","title":"Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaa6b7c-bf38-44b5-9d83-2918cbedc683?source=api-prod","affected":[{"type":"plugin","slug":"simple-video-management-system","name":"Simple Video Management System","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T04:22:19Z"},{"id":"wordfence:cdaa7450-3b51-470d-8903-52fd1d4215a2","source":"wordfence","cve":"CVE-2023-34019","title":"Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaa7450-3b51-470d-8903-52fd1d4215a2?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.6.4.3","to_inclusive":true,"patched_in":"3.6.4.4"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdaaffa7-eb5e-4cb9-aa26-12cfeb7dabd1","source":"wordfence","cve":"CVE-2017-20183","title":"External Media without Import < 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaaffa7-eb5e-4cb9-aa26-12cfeb7dabd1?source=api-prod","affected":[{"type":"plugin","slug":"external-media-without-import","name":"External Media without Import","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":false,"patched_in":"1.0.0"}],"published":"2017-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdac6080-5e23-488d-8b3c-de0c6c92e344","source":"wordfence","cve":"","title":"Service Finder - Provider and Business Listing Theme < 3.2 - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdac6080-5e23-488d-8b3c-de0c6c92e344?source=api-prod","affected":[{"type":"theme","slug":"sf-booking","name":"Service Finder - Provider and Business Listing WordPress Theme","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"}],"published":"2018-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdaea9be-64ef-4567-ae17-08ae44293b5e","source":"wordfence","cve":"CVE-2015-9517","title":"Easy Digital Downloads \u2013 Manual Purchases < 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaea9be-64ef-4567-ae17-08ae44293b5e?source=api-prod","affected":[{"type":"plugin","slug":"edd-manual-purchases","name":"Easy Digital Downloads \u2013 Manual Purchases","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":false,"patched_in":"1.9.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdaf1de1-9a84-469b-a7bb-694f80199cb7","source":"wordfence","cve":"CVE-2024-51795","title":"Pdf Embedder Fay <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaf1de1-9a84-469b-a7bb-694f80199cb7?source=api-prod","affected":[{"type":"plugin","slug":"pdf-embedder-fay","name":"Pdf Embedder Fay","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:51:43Z"},{"id":"wordfence:cdaf96b6-1286-4bbc-893e-68de43ba1f25","source":"wordfence","cve":"CVE-2024-4269","title":"SVG Block <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdaf96b6-1286-4bbc-893e-68de43ba1f25?source=api-prod","affected":[{"type":"plugin","slug":"svg-block","name":"SVG Block","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:26:13Z"},{"id":"wordfence:cdb35927-b239-4243-a2d0-2e2c2cc61668","source":"wordfence","cve":"CVE-2022-0788","title":"WP Fundraising Donation and Crowdfunding Platform <= 1.4.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb35927-b239-4243-a2d0-2e2c2cc61668?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2022-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdb3cdf8-7563-4ccd-83fe-7ebd13fa7936","source":"wordfence","cve":"CVE-2021-24502","title":"WP Google Map <= 1.7.6 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb3cdf8-7563-4ccd-83fe-7ebd13fa7936?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2021-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdb3fbaa-4d33-4754-848b-77e902ea4a85","source":"wordfence","cve":"CVE-2023-1649","title":"AI ChatBot <= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb3fbaa-4d33-4754-848b-77e902ea4a85?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdb483db-56f7-4d12-9022-46c829091cc1","source":"wordfence","cve":"CVE-2015-3173","title":"Custom Content Type Manager <= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb483db-56f7-4d12-9022-46c829091cc1?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-type-manager","name":"Custom Content Type Manager","from":"*","from_inclusive":true,"to":"0.9.8.5","to_inclusive":true,"patched_in":"0.9.8.6"}],"published":"2015-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdb4cb5e-38ea-430e-b6ae-3712b3607a25","source":"wordfence","cve":"CVE-2025-5239","title":"Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb4cb5e-38ea-430e-b6ae-3712b3607a25?source=api-prod","affected":[{"type":"plugin","slug":"domain-for-sale","name":"Domain For Sale \u2013 Landing Page Per Domain, Domain Mapping, Offers & Listings","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":"3.0.11"}],"published":"2025-06-05T22:24:39Z","updated":"2025-06-06T11:13:18Z"},{"id":"wordfence:cdb5a65a-313f-44b3-9a79-7fae1207e8e2","source":"wordfence","cve":"CVE-2025-24744","title":"Bridge Core <= 3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb5a65a-313f-44b3-9a79-7fae1207e8e2?source=api-prod","affected":[{"type":"plugin","slug":"bridge-core","name":"Bridge Core","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:27:05Z"},{"id":"wordfence:cdb69e0e-f3d4-4b5b-9bdf-14018f4c7ecc","source":"wordfence","cve":"CVE-2024-5555","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb69e0e-f3d4-4b5b-9bdf-14018f4c7ecc?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.5","to_inclusive":true,"patched_in":"5.6.6"}],"published":"2024-07-17T00:00:00Z","updated":"2024-07-18T08:33:04Z"},{"id":"wordfence:cdb7a2b8-bfc8-4f3f-bd61-744d015358f8","source":"wordfence","cve":"CVE-2026-15236","title":"Gallery for Google Photos <= 1.2.0 - Unauthenticated Google OAuth Token Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb7a2b8-bfc8-4f3f-bd61-744d015358f8?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-photos","name":"Gallery for Google Photos \u2013 share your albums right on your site","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-21T15:42:22Z"},{"id":"wordfence:cdb9c321-1a2c-4593-9947-2071a908ee1c","source":"wordfence","cve":"CVE-2022-3459","title":"WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb9c321-1a2c-4593-9947-2071a908ee1c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multiple-free-gift","name":"WooCommerce Multiple Free Gift","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-13T00:00:00Z","updated":"2024-09-14T02:04:20Z"},{"id":"wordfence:cdbad4b2-961a-41df-b284-14deb0a76677","source":"wordfence","cve":"CVE-2019-10864","title":"WP Statistics <= 12.6.3 - Referer Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdbad4b2-961a-41df-b284-14deb0a76677?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.6.3","to_inclusive":true,"patched_in":"12.6.4"}],"published":"2019-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdbbccc5-07e5-48fb-8242-cd100a76eb9f","source":"wordfence","cve":"CVE-2025-39474","title":"Amely <= 3.1.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdbbccc5-07e5-48fb-8242-cd100a76eb9f?source=api-prod","affected":[{"type":"theme","slug":"amely","name":"Amely - Fashion Shop WordPress Theme for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:20:11Z"},{"id":"wordfence:cdbf2658-b819-4fd3-ac89-8b90a7e3a2cf","source":"wordfence","cve":"","title":"Social Share, Social Login and Social Comments <= 7.10.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdbf2658-b819-4fd3-ac89-8b90a7e3a2cf?source=api-prod","affected":[{"type":"plugin","slug":"super-socializer","name":"Social Share, Social Login and Social Comments Plugin \u2013 Super Socializer","from":"*","from_inclusive":true,"to":"7.10.6","to_inclusive":true,"patched_in":"7.11"}],"published":"2018-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdc020fb-b3fe-4a18-8904-24c7212a8a67","source":"wordfence","cve":"CVE-2026-25464","title":"Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc020fb-b3fe-4a18-8904-24c7212a8a67?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.6.4","to_inclusive":true,"patched_in":"7.6.5"}],"published":"2026-03-16T00:00:00Z","updated":"2026-04-15T13:42:07Z"},{"id":"wordfence:cdc215c1-4e79-4681-af85-fec47eaf3949","source":"wordfence","cve":"CVE-2026-73339","title":"Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc215c1-4e79-4681-af85-fec47eaf3949?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar","name":"Modern Events Calendar","from":"*","from_inclusive":true,"to":"7.35.0","to_inclusive":false,"patched_in":"7.35.0"}],"published":"2026-08-17T12:49:46Z","updated":"2026-09-02T21:49:15Z"},{"id":"wordfence:cdc37da4-9de6-467b-a168-e3fa29baa06b","source":"wordfence","cve":"CVE-2025-11363","title":"Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc37da4-9de6-467b-a168-e3fa29baa06b?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1036","to_inclusive":true,"patched_in":"1.7.1037"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-19T20:41:03Z"},{"id":"wordfence:cdc5ef6a-32d8-4c4b-b459-d9b543b56898","source":"wordfence","cve":"CVE-2026-1053","title":"Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc5ef6a-32d8-4c4b-b459-d9b543b56898?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.13","to_inclusive":true,"patched_in":"5.5.14"}],"published":"2026-01-27T19:35:51Z","updated":"2026-01-28T08:26:56Z"},{"id":"wordfence:cdc993a4-6f65-4570-811c-13a80dbec064","source":"wordfence","cve":"CVE-2024-9927","title":"WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal","severity":"high","cvss":7.2,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc993a4-6f65-4570-811c-13a80dbec064?source=api-prod","affected":[{"type":"plugin","slug":"wooCommerce-order-proposal","name":"WooCommerce Order Proposal","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-10-22T13:22:55Z","updated":"2024-10-23T02:06:04Z"},{"id":"wordfence:cdcac5f9-a744-4853-8a80-ed38fec81dbb","source":"wordfence","cve":"CVE-2023-5121","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcac5f9-a744-4853-8a80-ed38fec81dbb?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.89","to_inclusive":true,"patched_in":"0.9.90"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdcae7fe-1cc1-4168-8b4b-fcee5bf91be2","source":"wordfence","cve":"CVE-2025-64266","title":"Booking and Rental Manager <= 2.5.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcae7fe-1cc1-4168-8b4b-fcee5bf91be2?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-09-20T00:00:00Z","updated":"2025-12-20T19:18:27Z"},{"id":"wordfence:cdcb09ee-80c7-445c-932f-7fce3ae743c5","source":"wordfence","cve":"CVE-2026-24991","title":"Extensions For CF7 <= 3.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcb09ee-80c7-445c-932f-7fce3ae743c5?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-01-23T00:00:00Z","updated":"2026-02-02T21:03:15Z"},{"id":"wordfence:cdcbb567-00d0-43ef-a007-3b004701fdfd","source":"wordfence","cve":"CVE-2026-62092","title":"Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported) <= 1.4.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcbb567-00d0-43ef-a007-3b004701fdfd?source=api-prod","affected":[{"type":"theme","slug":"armania","name":"Armania - Fashion, Furniture, Organic, Food Multipurpose Elementor WooCommerce Theme (RTL Supported)","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:23:23Z"},{"id":"wordfence:cdcdbba7-8280-457b-a511-66a486978a31","source":"wordfence","cve":"CVE-2022-3384","title":"Ultimate Member \u2013 User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcdbba7-8280-457b-a511-66a486978a31?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdd3d90a-6262-4dbe-b59b-593ca1a7dcaa","source":"wordfence","cve":"CVE-2024-49679","title":"WPKoi Templates for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd3d90a-6262-4dbe-b59b-593ca1a7dcaa?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:16:26Z"},{"id":"wordfence:cdd4639a-683f-4267-828f-2fd404d9156f","source":"wordfence","cve":"CVE-2025-23523","title":"HSS Embed Streaming Video <= 3.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd4639a-683f-4267-828f-2fd404d9156f?source=api-prod","affected":[{"type":"plugin","slug":"hss-embed-streaming-video","name":"HSS Embed Streaming Video","from":"*","from_inclusive":true,"to":"3.23","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:44:05Z"},{"id":"wordfence:cdd464ad-24bc-4922-8bfa-ac42fbe60b52","source":"wordfence","cve":"CVE-2022-4700","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd464ad-24bc-4922-8bfa-ac42fbe60b52?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdd563b7-a1b9-4d99-9a6e-c8acf9dda619","source":"wordfence","cve":"CVE-2026-1304","title":"Membership Plugin \u2013 Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd563b7-a1b9-4d99-9a6e-c8acf9dda619?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.18","to_inclusive":true,"patched_in":"3.2.19"}],"published":"2026-02-17T17:14:49Z","updated":"2026-02-18T05:29:18Z"},{"id":"wordfence:cdd7971c-6f1c-437a-832c-e2b2817a197e","source":"wordfence","cve":"CVE-2024-7492","title":"MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd7971c-6f1c-437a-832c-e2b2817a197e?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child-reports","name":"MainWP Child Reports","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-08T02:32:09Z"},{"id":"wordfence:cdd7b2ec-5470-492d-a8ea-ae69b45572ce","source":"wordfence","cve":"CVE-2024-37512","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd7b2ec-5470-492d-a8ea-ae69b45572ce?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.10","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T20:45:37Z"},{"id":"wordfence:cdd7e9d1-a580-4b32-9365-7ce17cdc37cd","source":"wordfence","cve":"CVE-2025-12713","title":"Soundslides <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd7e9d1-a580-4b32-9365-7ce17cdc37cd?source=api-prod","affected":[{"type":"plugin","slug":"soundslides","name":"Soundslides","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-26T14:19:37Z","updated":"2025-11-27T02:26:15Z"},{"id":"wordfence:cddbb0f8-fc73-46d7-80af-edb69227084f","source":"wordfence","cve":"","title":"WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cddbb0f8-fc73-46d7-80af-edb69227084f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.33","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.28","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.29","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.25","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.22","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.24","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.21","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.18","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.17","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.15","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.13","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.12","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"4.7.34"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"4.7.34"}],"published":"2026-08-08T00:00:00Z","updated":"2026-08-08T19:30:07Z"},{"id":"wordfence:cddc6d2e-bf42-478a-8390-d3aa9ce04292","source":"wordfence","cve":"CVE-2025-58859","title":"Add to Feedly <= 1.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cddc6d2e-bf42-478a-8390-d3aa9ce04292?source=api-prod","affected":[{"type":"plugin","slug":"add-to-feedly","name":"Add to Feedly","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:53:02Z"},{"id":"wordfence:cddda02e-c36f-4ed8-b3ac-6cb3f17c6ce2","source":"wordfence","cve":"CVE-2023-51514","title":"CBX Bookmark & Favorite <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cddda02e-c36f-4ed8-b3ac-6cb3f17c6ce2?source=api-prod","affected":[{"type":"plugin","slug":"cbxwpbookmark","name":"CBX Bookmark & Favorite","from":"*","from_inclusive":true,"to":"1.7.13","to_inclusive":true,"patched_in":"1.7.14"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdde21b6-a5d9-4d47-9ff1-eda050822990","source":"wordfence","cve":"CVE-2026-74933","title":"GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdde21b6-a5d9-4d47-9ff1-eda050822990?source=api-prod","affected":[{"type":"plugin","slug":"geniewords","name":"GenieWords","from":"1.5.27","from_inclusive":true,"to":"1.5.34","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:53:04Z"},{"id":"wordfence:cdde4cf7-613d-47ee-aa1b-202c031ab777","source":"wordfence","cve":"CVE-2025-69173","title":"Tipsy <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdde4cf7-613d-47ee-aa1b-202c031ab777?source=api-prod","affected":[{"type":"theme","slug":"tipsy","name":"tipsy","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:10:53Z"},{"id":"wordfence:cddf4aa1-5c7d-4aa1-9384-1c352f0c6da9","source":"wordfence","cve":"CVE-2023-41870","title":"WP Crowdfunding <= 2.1.4 - Missing Authorization via settings_reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cddf4aa1-5c7d-4aa1-9384-1c352f0c6da9?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cddfb3d3-89b8-4d93-8931-54de395fdb53","source":"wordfence","cve":"CVE-2025-47683","title":"WP Maintenance <= 6.1.9.7 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cddfb3d3-89b8-4d93-8931-54de395fdb53?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.1.9.7","to_inclusive":true,"patched_in":"6.1.9.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-21T13:34:07Z"},{"id":"wordfence:cde35356-daba-47ff-9278-21447337f0c7","source":"wordfence","cve":"CVE-2021-25050","title":"Remove Footer Credit <= 1.0.10 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde35356-daba-47ff-9278-21447337f0c7?source=api-prod","affected":[{"type":"plugin","slug":"remove-footer-credit","name":"Remove Footer Credit","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cde440a2-55f8-406a-b81b-919028f0e887","source":"wordfence","cve":"CVE-2025-2511","title":"AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde440a2-55f8-406a-b81b-919028f0e887?source=api-prod","affected":[{"type":"plugin","slug":"ahathat","name":"AHAthat Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T22:18:46Z","updated":"2025-03-19T11:10:38Z"},{"id":"wordfence:cde526f2-7eff-49cf-8a9f-e0c0cdd12522","source":"wordfence","cve":"CVE-2023-44470","title":"Kv TinyMCE Editor Add Fonts <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde526f2-7eff-49cf-8a9f-e0c0cdd12522?source=api-prod","affected":[{"type":"plugin","slug":"kv-tinymce-editor-fonts","name":"Kv TinyMCE Editor Add Fonts","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cde57dc8-9bfe-482c-8f04-654f4386e484","source":"wordfence","cve":"CVE-2022-1556","title":"StaffList <= 3.1.2 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde57dc8-9bfe-482c-8f04-654f4386e484?source=api-prod","affected":[{"type":"plugin","slug":"stafflist","name":"StaffList","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cde6e758-9723-43f2-9972-32be8aeb2b91","source":"wordfence","cve":"CVE-2024-1468","title":"Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde6e758-9723-43f2-9972-32be8aeb2b91?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.4","to_inclusive":true,"patched_in":"7.11.5"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T03:30:29Z"},{"id":"wordfence:cde79196-20aa-42f1-b35f-af347bcb6e5f","source":"wordfence","cve":"CVE-2025-8622","title":"Flexible Maps <= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde79196-20aa-42f1-b35f-af347bcb6e5f?source=api-prod","affected":[{"type":"plugin","slug":"wp-flexible-map","name":"Flexible Map","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.19.0"}],"published":"2025-08-18T19:06:21Z","updated":"2025-08-19T07:26:28Z"},{"id":"wordfence:cde81421-e080-4530-87a5-6515f1c9800b","source":"wordfence","cve":"CVE-2026-93428","title":"Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde81421-e080-4530-87a5-6515f1c9800b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.1","to_inclusive":true,"patched_in":"2.14.0"}],"published":"2026-10-02T13:59:43Z","updated":"2026-10-03T02:25:36Z"},{"id":"wordfence:cde8c669-c9bb-4ecc-b589-3cda8757dfc6","source":"wordfence","cve":"CVE-2022-47159","title":"Logaster Logo Generator <= 1.3 - Cross-Site Request Forgery to Arbitrary Media Deletion and Creation","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde8c669-c9bb-4ecc-b589-3cda8757dfc6?source=api-prod","affected":[{"type":"plugin","slug":"logaster-logo-generator","name":"Logaster Logo Generator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cde92185-d63a-47b3-a17e-3f2b2b20270c","source":"wordfence","cve":"CVE-2022-47423","title":"WP-dTree <= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cde92185-d63a-47b3-a17e-3f2b2b20270c?source=api-prod","affected":[{"type":"plugin","slug":"wp-dtree-30","name":"WP-dTree","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2023-04-19T00:00:00Z","updated":"2026-10-28T21:04:43Z"},{"id":"wordfence:cdeb9625-65fa-42bd-9708-7090691aae45","source":"wordfence","cve":"CVE-2024-54232","title":"RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdeb9625-65fa-42bd-9708-7090691aae45?source=api-prod","affected":[{"type":"plugin","slug":"rrdevs-for-elementor","name":"RRAddons for Elementor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-12T13:44:05Z"},{"id":"wordfence:cdec0d79-a78a-499d-a7d0-94b65bfb84bd","source":"wordfence","cve":"CVE-2021-24395","title":"Embed Youtube Video <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdec0d79-a78a-499d-a7d0-94b65bfb84bd?source=api-prod","affected":[{"type":"plugin","slug":"embed-youtube-video","name":"Embed Youtube Video","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdee0cd8-b83b-4436-aebe-533f5af03ef1","source":"wordfence","cve":"CVE-2021-4417","title":"Forminator \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdee0cd8-b83b-4436-aebe-533f5af03ef1?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":false,"patched_in":"1.13.5"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdf3b629-c1a2-4fdd-b7fc-d3550bd30857","source":"wordfence","cve":"CVE-2023-31073","title":"Display custom fields in the frontend \u2013 Post and User Profile Fields <= 1.2.0 - Missing Authorization via vg_display_data shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdf3b629-c1a2-4fdd-b7fc-d3550bd30857?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-to-display-post-and-user-data","name":"Display custom fields in the frontend \u2013 Post and User Profile Fields","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cdf67099-5514-45ba-9a4c-10af984bf593","source":"wordfence","cve":"CVE-2024-10003","title":"Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdf67099-5514-45ba-9a4c-10af984bf593?source=api-prod","affected":[{"type":"plugin","slug":"rover-idx","name":"Rover IDX","from":"*","from_inclusive":true,"to":"3.0.0.2903","to_inclusive":true,"patched_in":"3.0.0.2905"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T04:31:58Z"},{"id":"wordfence:cdfac55e-3271-4299-a956-41bd723b9daf","source":"wordfence","cve":"CVE-2026-82852","title":"MapSVG \u2013 Vector maps, Image maps, Google Maps <= 8.15.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdfac55e-3271-4299-a956-41bd723b9daf?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg-lite-interactive-vector-maps","name":"MapSVG \u2013 Vector maps, Google Maps, Image maps \u2013 with AI assistant","from":"*","from_inclusive":true,"to":"8.15.0","to_inclusive":true,"patched_in":"8.16.0"}],"published":"2026-08-31T08:33:00Z","updated":"2026-09-10T19:34:53Z"},{"id":"wordfence:cdfc1110-7bbd-45f0-97ef-271c45d222c1","source":"wordfence","cve":"CVE-2026-1983","title":"SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdfc1110-7bbd-45f0-97ef-271c45d222c1?source=api-prod","affected":[{"type":"plugin","slug":"simple-event-attendance","name":"SEATT: Simple Event Attendance","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T16:18:32Z","updated":"2026-02-14T04:35:42Z"},{"id":"wordfence:cdffbef4-5462-49b2-a97e-6a497147bc41","source":"wordfence","cve":"CVE-2026-3353","title":"Comment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cdffbef4-5462-49b2-a97e-6a497147bc41?source=api-prod","affected":[{"type":"plugin","slug":"comment-spam-wiper","name":"Comment SPAM Wiper","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:11Z","updated":"2026-03-21T03:27:04Z"},{"id":"wordfence:ce010c6f-16bd-4178-a621-31ba6378946a","source":"wordfence","cve":"CVE-2026-4132","title":"HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters","severity":"high","cvss":7.2,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.19.2","to_inclusive":true,"patched_in":"1.19.3"}],"published":"2026-04-21T19:13:19Z","updated":"2026-09-18T19:02:23Z"},{"id":"wordfence:ce01e7c9-1ffc-4cc4-a1e4-dc67861db410","source":"wordfence","cve":"CVE-2025-31464","title":"Text Selection Color <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce01e7c9-1ffc-4cc4-a1e4-dc67861db410?source=api-prod","affected":[{"type":"plugin","slug":"text-selection-color","name":"Text Selection Color","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:45:53Z"},{"id":"wordfence:ce032abe-ee9d-4be1-ac97-5fa95d598e85","source":"wordfence","cve":"CVE-2026-1719","title":"Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce032abe-ee9d-4be1-ac97-5fa95d598e85?source=api-prod","affected":[{"type":"plugin","slug":"gf-bookings-premium","name":"Gravity Bookings","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6"}],"published":"2026-05-05T20:29:43Z","updated":"2026-05-07T17:23:25Z"},{"id":"wordfence:ce03e98d-7c29-405f-81bc-4a1114d9889d","source":"wordfence","cve":"","title":"Subscribe To Comments Reloaded < 150820 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce03e98d-7c29-405f-81bc-4a1114d9889d?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments-reloaded","name":"Subscribe To Comments Reloaded","from":"*","from_inclusive":true,"to":"150820","to_inclusive":false,"patched_in":"150820"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce0408a7-877a-46f4-a613-b4d54045c639","source":"wordfence","cve":"CVE-2025-69041","title":"Dekoro <= 1.0.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce0408a7-877a-46f4-a613-b4d54045c639?source=api-prod","affected":[{"type":"theme","slug":"dekoro","name":"Dekoro - Furniture Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:35:47Z"},{"id":"wordfence:ce047db1-b701-4903-9244-68b3ecaad78f","source":"wordfence","cve":"CVE-2020-13764","title":"Gravityforms <= 2.4.8 - Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce047db1-b701-4903-9244-68b3ecaad78f?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2019-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce060989-ce70-49ac-921c-a687bc944090","source":"wordfence","cve":"","title":"Mass Delete Taxonomies <= 3.0.0 - Cross-Site Request Forgery via mp_plugin_mass_delete_tags_init","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce060989-ce70-49ac-921c-a687bc944090?source=api-prod","affected":[{"type":"plugin","slug":"mass-delete-tags","name":"Mass Delete Taxonomies","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce0757a2-8626-4f42-9854-da1dee289e13","source":"wordfence","cve":"CVE-2025-32166","title":"Emma for WordPress <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce0757a2-8626-4f42-9854-da1dee289e13?source=api-prod","affected":[{"type":"plugin","slug":"emma-emarketing-plugin","name":"Emma for WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:20:58Z"},{"id":"wordfence:ce0c42bf-41d4-4fb5-af01-e98c4e4ec2fc","source":"wordfence","cve":"CVE-2024-13100","title":"OPSI Israel Domestic Shipments <= 2.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce0c42bf-41d4-4fb5-af01-e98c4e4ec2fc?source=api-prod","affected":[{"type":"plugin","slug":"woo-ups-pickup","name":"OPSI Israel Domestic Shipments","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-19T16:45:36Z"},{"id":"wordfence:ce0dcbe6-9231-45d9-9658-5d775e02cfcb","source":"wordfence","cve":"CVE-2023-6049","title":"Estatik Real Estate Plugin  <= 4.1.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce0dcbe6-9231-45d9-9658-5d775e02cfcb?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-12-25T00:00:00Z","updated":"2024-02-06T15:29:28Z"},{"id":"wordfence:ce101aad-10a3-4a8c-9f4a-0e38e35b4dab","source":"wordfence","cve":"CVE-2026-2442","title":"Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'","severity":"medium","cvss":5.3,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce101aad-10a3-4a8c-9f4a-0e38e35b4dab?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-03-27T20:45:22Z","updated":"2026-03-28T09:27:10Z"},{"id":"wordfence:ce106c3a-e99b-4182-84d8-8f896edbbefd","source":"wordfence","cve":"CVE-2022-47157","title":"WP Custom Fields Search <= 1.2.34 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce106c3a-e99b-4182-84d8-8f896edbbefd?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-fields-search","name":"WP Custom Fields Search","from":"*","from_inclusive":true,"to":"1.2.34","to_inclusive":true,"patched_in":"1.2.35"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce1088da-8db0-4bf5-a1ee-2121d5b9840a","source":"wordfence","cve":"CVE-2026-42648","title":"Spectra <= 2.19.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce1088da-8db0-4bf5-a1ee-2121d5b9840a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.22","to_inclusive":true,"patched_in":"2.19.23"}],"published":"2026-03-27T00:00:00Z","updated":"2026-05-07T14:04:12Z"},{"id":"wordfence:ce116ee1-f0ea-469b-8c17-8c17c76fdc66","source":"wordfence","cve":"CVE-2024-1946","title":"Genesis Blocks <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce116ee1-f0ea-469b-8c17-8c17c76fdc66?source=api-prod","affected":[{"type":"plugin","slug":"genesis-blocks","name":"Genesis Blocks","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-04T16:19:54Z"},{"id":"wordfence:ce119965-01a0-4cff-a0b2-e99bceb1406c","source":"wordfence","cve":"CVE-2025-7634","title":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2025-10-08T16:24:07Z","updated":"2025-10-09T05:23:55Z"},{"id":"wordfence:ce14d75c-feb0-4d7b-860d-8260f766c3c2","source":"wordfence","cve":"CVE-2026-109145","title":"User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce14d75c-feb0-4d7b-860d-8260f766c3c2?source=api-prod","affected":[{"type":"plugin","slug":"user-rights-access-manager","name":"User Rights Access Manager","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:10:19Z"},{"id":"wordfence:ce16175a-c58e-4432-80de-7872216ae273","source":"wordfence","cve":"CVE-2024-32702","title":"ARforms <= 6.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce16175a-c58e-4432-80de-7872216ae273?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-06-18T15:45:36Z"},{"id":"wordfence:ce182e57-a9d4-4c4b-b124-e6626ccdd712","source":"wordfence","cve":"CVE-2025-11860","title":"Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce182e57-a9d4-4c4b-b124-e6626ccdd712?source=api-prod","affected":[{"type":"plugin","slug":"ot-twitter-feed","name":"Twitter Feed","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:17:16Z","updated":"2025-11-11T03:30:49Z"},{"id":"wordfence:ce1ac711-6026-49ef-b66b-2cc199697942","source":"wordfence","cve":"CVE-2023-3295","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce1ac711-6026-49ef-b66b-2cc199697942?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.66","to_inclusive":true,"patched_in":"1.5.67"}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce1e944b-1ee9-4400-a182-d505381cb007","source":"wordfence","cve":"CVE-2025-68570","title":"Captivate Sync <= 3.2.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce1e944b-1ee9-4400-a182-d505381cb007?source=api-prod","affected":[{"type":"plugin","slug":"captivatesync-trade","name":"Captivate Sync","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-23T18:56:57Z"},{"id":"wordfence:ce23efed-fe21-486a-ab3b-9ed0dd26a971","source":"wordfence","cve":"CVE-2024-6669","title":"AI ChatBot for WordPress \u2013 WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce23efed-fe21-486a-ab3b-9ed0dd26a971?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"5.5.7","to_inclusive":true,"patched_in":"5.5.8"}],"published":"2024-07-16T18:32:59Z","updated":"2024-07-17T06:45:12Z"},{"id":"wordfence:ce24218c-56fb-40c3-8628-b57390a888fb","source":"wordfence","cve":"CVE-2026-88998","title":"Tickera \u2013 Sell Tickets & Manage Events < 3.6.0.4 - Unauthenticated Arbitrary Order Payment Confirmation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce24218c-56fb-40c3-8628-b57390a888fb?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.4","to_inclusive":false,"patched_in":"3.6.0.4"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T21:21:37Z"},{"id":"wordfence:ce261415-870c-4300-85e8-b15a02c7eec5","source":"wordfence","cve":"CVE-2025-2269","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce261415-870c-4300-85e8-b15a02c7eec5?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.34","to_inclusive":true,"patched_in":"1.8.35"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-11T23:21:55Z"},{"id":"wordfence:ce27f598-b64a-45da-b61a-190570220ec2","source":"wordfence","cve":"CVE-2024-33649","title":"Opal Widgets For Elementor <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce27f598-b64a-45da-b61a-190570220ec2?source=api-prod","affected":[{"type":"plugin","slug":"opal-widgets-for-elementor","name":"Opal Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:48:22Z"},{"id":"wordfence:ce297421-506c-4230-837e-96200677e1e2","source":"wordfence","cve":"CVE-2023-35764","title":"Survey Maker <= 4.0.9 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce297421-506c-4230-837e-96200677e1e2?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2024-04-27T00:00:00Z","updated":"2024-05-07T19:30:48Z"},{"id":"wordfence:ce2a438c-8506-4f07-ac1d-b682ad5a038b","source":"wordfence","cve":"CVE-2024-27960","title":"Email Subscription Popup <= 1.2.20 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2a438c-8506-4f07-ac1d-b682ad5a038b?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":"1.2.21"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T19:37:22Z"},{"id":"wordfence:ce2b4f93-93a6-480f-a877-ca47bd133bb6","source":"wordfence","cve":"CVE-2024-8725","title":"Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload","severity":"medium","cvss":6.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2b4f93-93a6-480f-a877-ca47bd133bb6?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.2.9"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T10:59:34Z"},{"id":"wordfence:ce2bef2f-fe28-48ea-8b83-052eebd31622","source":"wordfence","cve":"CVE-2023-27434","title":"Classic Editor and Classic Widgets <= 1.2.5 - Cross-Site Request Forgery via render_settings_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2bef2f-fe28-48ea-8b83-052eebd31622?source=api-prod","affected":[{"type":"plugin","slug":"classic-editor-and-classic-widgets","name":"Classic Editor and Classic Widgets","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce2d2594-e856-4249-9467-01c0fe1c0c71","source":"wordfence","cve":"CVE-2026-6828","title":"Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2d2594-e856-4249-9467-01c0fe1c0c71?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T04:26:45Z"},{"id":"wordfence:ce2d582e-4f50-4b55-9f3b-3c46d96c0927","source":"wordfence","cve":"CVE-2025-1264","title":"Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2d582e-4f50-4b55-9f3b-3c46d96c0927?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker-seo","name":"Broken Link Checker by AIOSEO \u2013 Find & Fix Broken Internal, External & Video Links","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-04-05T16:21:19Z","updated":"2025-04-06T04:21:22Z"},{"id":"wordfence:ce2edda2-7707-415e-9493-e1067a421f54","source":"wordfence","cve":"CVE-2021-24950","title":"Insight Core <= 1.0 - Authenticated PHP Object Injection & Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2edda2-7707-415e-9493-e1067a421f54?source=api-prod","affected":[{"type":"plugin","slug":"insight-core","name":"Insight Core","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce30649a-c1a0-42d5-b2e7-1ebe7989efa3","source":"wordfence","cve":"CVE-2022-45068","title":"Mercado Pago payments for WooCommerce <= 6.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce30649a-c1a0-42d5-b2e7-1ebe7989efa3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mercadopago","name":"Mercado Pago payments for WooCommerce","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce330cae-c2f8-42f3-822b-ca24bf46e433","source":"wordfence","cve":"CVE-2023-3136","title":"MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce330cae-c2f8-42f3-822b-ca24bf46e433?source=api-prod","affected":[{"type":"plugin","slug":"mailarchiver","name":"MailArchiver","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.11.0"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce332037-bfa3-42a6-a352-ba13439db62f","source":"wordfence","cve":"CVE-2025-31060","title":"Capie <= 1.0.40 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce332037-bfa3-42a6-a352-ba13439db62f?source=api-prod","affected":[{"type":"theme","slug":"capie","name":"Capie - Minimal Creative WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":"1.0.53.1"}],"published":"2025-05-21T00:00:00Z","updated":"2026-02-26T15:10:14Z"},{"id":"wordfence:ce336caf-fc71-4b16-8824-d3e34a1eb69e","source":"wordfence","cve":"CVE-2025-31638","title":"Spare <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce336caf-fc71-4b16-8824-d3e34a1eb69e?source=api-prod","affected":[{"type":"theme","slug":"spare","name":"Spare - Ultimate MultiPurpose LESS Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-11T20:31:35Z"},{"id":"wordfence:ce33f2a6-43a4-4382-97ff-9588e92b483d","source":"wordfence","cve":"CVE-2026-52699","title":"VikRentCar Car Rental Management System <= 1.4.5 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce33f2a6-43a4-4382-97ff-9588e92b483d?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-18T13:34:31Z"},{"id":"wordfence:ce340b88-cbab-4ba8-93ae-8790f2348456","source":"wordfence","cve":"CVE-2022-44737","title":"All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce340b88-cbab-4ba8-93ae-8790f2348456?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce37fbd2-8d41-4feb-adf6-7ca0ca54e27a","source":"wordfence","cve":"CVE-2025-5291","title":"Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce37fbd2-8d41-4feb-adf6-7ca0ca54e27a?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.8","to_inclusive":true,"patched_in":"3.10.9"}],"published":"2025-06-16T22:19:54Z","updated":"2025-06-17T11:23:42Z"},{"id":"wordfence:ce38401f-443b-42b8-ae4e-53700f25bee7","source":"wordfence","cve":"CVE-2025-39473","title":"Seofy Core <= 1.6.8 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce38401f-443b-42b8-ae4e-53700f25bee7?source=api-prod","affected":[{"type":"plugin","slug":"seofy-core","name":"Seofy Core","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.11"}],"published":"2025-06-03T00:00:00Z","updated":"2026-02-26T15:11:49Z"},{"id":"wordfence:ce3861a3-3a0f-4414-bea7-941c2d36fc39","source":"wordfence","cve":"CVE-2026-8892","title":"CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3861a3-3a0f-4414-bea7-941c2d36fc39?source=api-prod","affected":[{"type":"plugin","slug":"cm-business-directory","name":"CM Business Directory \u2013 Optimise and showcase local business","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-07-02T16:10:17Z","updated":"2026-07-03T04:30:19Z"},{"id":"wordfence:ce389e92-640c-4e95-a0f5-528c6c7a0120","source":"wordfence","cve":"CVE-2026-62118","title":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce389e92-640c-4e95-a0f5-528c6c7a0120?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:39:15Z"},{"id":"wordfence:ce3a3802-ea03-4840-8da2-fd292a0c4099","source":"wordfence","cve":"CVE-2024-56232","title":"WP Nice Loader <= 0.1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3a3802-ea03-4840-8da2-fd292a0c4099?source=api-prod","affected":[{"type":"plugin","slug":"wp-nice-loader","name":"WP Nice Loader","from":"*","from_inclusive":true,"to":"0.1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:28:17Z"},{"id":"wordfence:ce3ae202-1227-4247-9133-5c7284392c9f","source":"wordfence","cve":"CVE-2026-14282","title":"GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3ae202-1227-4247-9133-5c7284392c9f?source=api-prod","affected":[{"type":"plugin","slug":"godam","name":"GoDAM \u2013 Video Hosting for LMS & Online Courses","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-07-22T20:25:57Z","updated":"2026-07-23T08:34:41Z"},{"id":"wordfence:ce3c96c9-1112-4eb0-8367-b8037198b10f","source":"wordfence","cve":"CVE-2026-66639","title":"WPZOOM Forms \u2013 Drag & Drop Contact Form Builder for WordPress <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3c96c9-1112-4eb0-8367-b8037198b10f?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-forms","name":"WPZOOM Forms \u2013 Drag & Drop Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-03T20:06:15Z"},{"id":"wordfence:ce3cb2e9-6491-4b93-bd98-1ece39171b0c","source":"wordfence","cve":"CVE-2025-68999","title":"Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3cb2e9-6491-4b93-bd98-1ece39171b0c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.20.4","to_inclusive":true,"patched_in":"3.20.6"}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-27T19:20:21Z"},{"id":"wordfence:ce3d82ec-5f94-4511-a6ba-8ee1dec06160","source":"wordfence","cve":"CVE-2025-6350","title":"WP VR \u2013 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3d82ec-5f94-4511-a6ba-8ee1dec06160?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.5.32","to_inclusive":true,"patched_in":"8.5.33"}],"published":"2025-06-27T15:12:22Z","updated":"2025-06-28T03:22:00Z"},{"id":"wordfence:ce3e5bc7-63e9-4c0e-ae66-c24c2b8be2da","source":"wordfence","cve":"CVE-2024-37494","title":"Youzify <= 1.2.5 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3e5bc7-63e9-4c0e-ae66-c24c2b8be2da?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-11T13:31:03Z"},{"id":"wordfence:ce3f1310-4d2e-45aa-a3ee-3972a6a31c2e","source":"wordfence","cve":"CVE-2024-2468","title":"EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3f1310-4d2e-45aa-a3ee-3972a6a31c2e?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2024-03-22T00:00:00Z","updated":"2024-03-23T02:32:57Z"},{"id":"wordfence:ce3ff7f9-ccad-45c0-a278-f66fbb6263ee","source":"wordfence","cve":"CVE-2022-1779","title":"Auto Delete Posts <= 1.3.0 - Cross-Site Request Forgery to Arbitrary Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3ff7f9-ccad-45c0-a278-f66fbb6263ee?source=api-prod","affected":[{"type":"plugin","slug":"auto-delete-posts","name":"Auto Delete Posts","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce457c98-c55b-4b71-a80b-393eceb9effd","source":"wordfence","cve":"CVE-2023-4668","title":"Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fe","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.7.30","to_inclusive":true,"patched_in":"2.7.31"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce47c956-5b19-43e4-8e04-9e7f68aeb924","source":"wordfence","cve":"CVE-2024-35744","title":"Upunzipper <= 1.0.0 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce47c956-5b19-43e4-8e04-9e7f68aeb924?source=api-prod","affected":[{"type":"plugin","slug":"upunzipper","name":"Upunzipper","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:41:47Z"},{"id":"wordfence:ce4872f8-f589-4ae9-a5c5-4bb66043bfeb","source":"wordfence","cve":"CVE-2026-15931","title":"Simple Membership <= 4.7.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4872f8-f589-4ae9-a5c5-4bb66043bfeb?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:32:00Z"},{"id":"wordfence:ce489717-6489-40a7-9f69-74ba841ed235","source":"wordfence","cve":"CVE-2025-27314","title":"Kush Micro News <= 1.6.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce489717-6489-40a7-9f69-74ba841ed235?source=api-prod","affected":[{"type":"plugin","slug":"kush-micro-news","name":"Kush Micro News","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:36:54Z"},{"id":"wordfence:ce4ac97d-7eb3-4005-b75a-0fe32e31fa92","source":"wordfence","cve":"CVE-2024-32728","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4ac97d-7eb3-4005-b75a-0fe32e31fa92?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:30:58Z"},{"id":"wordfence:ce4b7710-f579-4fa7-a7a3-f7da61bd813e","source":"wordfence","cve":"CVE-2025-58644","title":"LTL Freight Quotes - TQL Edition <= 1.2.6 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4b7710-f579-4fa7-a7a3-f7da61bd813e?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-tql-edition","name":"LTL Freight Quotes \u2013 TQL Edition","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:36:53Z"},{"id":"wordfence:ce4c4395-6d1a-4d5f-885f-383e5c44c0f8","source":"wordfence","cve":"CVE-2024-4223","title":"Tutor LMS <= 2.7.0 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T08:32:51Z"},{"id":"wordfence:ce4ca9c6-7ffd-4170-9004-f7bc3ad15df0","source":"wordfence","cve":"CVE-2020-11512","title":"IMPress for IDX Broker <= 2.6.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4ca9c6-7ffd-4170-9004-f7bc3ad15df0?source=api-prod","affected":[{"type":"plugin","slug":"idx-broker-platinum","name":"IMPress for IDX Broker","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":false,"patched_in":"2.6.2"}],"published":"2020-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce4e415b-a0d9-47fd-a111-76b81bcac12f","source":"wordfence","cve":"CVE-2025-67614","title":"TheNa <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4e415b-a0d9-47fd-a111-76b81bcac12f?source=api-prod","affected":[{"type":"theme","slug":"thena","name":"TheNa - Photography & Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:36:51Z"},{"id":"wordfence:ce4fd12c-824c-44b9-a5be-d2f1abf79acc","source":"wordfence","cve":"CVE-2017-18562","title":"Error Log Viewer by BestWebSoft < 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4fd12c-824c-44b9-a5be-d2f1abf79acc?source=api-prod","affected":[{"type":"plugin","slug":"error-log-viewer","name":"Error Log Viewer by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce544dd0-6e4a-4a73-bba0-db2d667e378e","source":"wordfence","cve":"CVE-2019-15659","title":"Pie Register \u2013 User Registration Forms. Invitation based registrations, Custom Login, Payments < 3.1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce544dd0-6e4a-4a73-bba0-db2d667e378e?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce546f2e-5323-44b9-b980-5619f2db2944","source":"wordfence","cve":"CVE-2026-9014","title":"WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce546f2e-5323-44b9-b980-5619f2db2944?source=api-prod","affected":[{"type":"plugin","slug":"wp-promoter","name":"WP Promoter","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:23:04Z","updated":"2026-05-27T05:31:30Z"},{"id":"wordfence:ce55230e-8c9e-41aa-b107-16c5988d1feb","source":"wordfence","cve":"CVE-2024-5787","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce55230e-8c9e-41aa-b107-16c5988d1feb?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.20","to_inclusive":true,"patched_in":"2.7.21"}],"published":"2024-06-12T17:12:58Z","updated":"2024-06-13T05:34:47Z"},{"id":"wordfence:ce5633a5-b443-4d09-8995-b8611de12c53","source":"wordfence","cve":"CVE-2026-25434","title":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5633a5-b443-4d09-8995-b8611de12c53?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:07:07Z","updated":"2026-10-26T11:08:25Z"},{"id":"wordfence:ce57a3eb-a71b-4335-9e6c-52648ce00062","source":"wordfence","cve":"CVE-2022-2299","title":"Allow SVG Files <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce57a3eb-a71b-4335-9e6c-52648ce00062?source=api-prod","affected":[{"type":"plugin","slug":"asf-allow-svg-files","name":"Allow svg files","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce5a89bc-c230-41d7-b0a7-d19d7b22ffb2","source":"wordfence","cve":"CVE-2026-0550","title":"myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5a89bc-c230-41d7-b0a7-d19d7b22ffb2?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.7.3","to_inclusive":true,"patched_in":"2.9.7.4"}],"published":"2026-02-13T19:46:58Z","updated":"2026-02-14T08:26:51Z"},{"id":"wordfence:ce5b3390-75c2-4288-91a6-f9ceb893a952","source":"wordfence","cve":"CVE-2024-49623","title":"Duplicate Title Validate <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5b3390-75c2-4288-91a6-f9ceb893a952?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-title-validate","name":"Duplicate Title Validator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-10-18T00:00:00Z","updated":"2024-12-17T13:08:19Z"},{"id":"wordfence:ce5c048a-0dbf-448d-bfca-aff347d9466b","source":"wordfence","cve":"CVE-2026-13392","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor < 3.10.01 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5c048a-0dbf-448d-bfca-aff347d9466b?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.10.01","to_inclusive":false,"patched_in":"3.10.01"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:48:47Z"},{"id":"wordfence:ce5efd37-131f-4b75-b682-023a07070ca0","source":"wordfence","cve":"CVE-2021-38316","title":"WP Academic People List <= 0.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5efd37-131f-4b75-b682-023a07070ca0?source=api-prod","affected":[{"type":"plugin","slug":"wp-academic-people","name":"WP Academic People List","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce5f4960-e47c-4926-97f2-8c94c438a4e0","source":"wordfence","cve":"CVE-2021-24269","title":"Sina Extension for Elementor <= 3.3.11 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce5f4960-e47c-4926-97f2-8c94c438a4e0?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":false,"patched_in":"3.3.12"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce695f15-557c-47b1-a5c4-ce68cc84d721","source":"wordfence","cve":"CVE-2022-25614","title":"eRoom \u2013 Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce695f15-557c-47b1-a5c4-ce68cc84d721?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2022-04-11T17:58:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce6a270a-31ca-4903-b77c-d8a28f1ed529","source":"wordfence","cve":"CVE-2026-105069","title":"QR Redirector <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6a270a-31ca-4903-b77c-d8a28f1ed529?source=api-prod","affected":[{"type":"plugin","slug":"qr-redirector","name":"QR Redirector","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-10-05T08:32:00Z","updated":"2026-10-08T23:15:15Z"},{"id":"wordfence:ce6b9b0a-e82e-459a-bddf-1c9354bcec00","source":"wordfence","cve":"CVE-2023-6638","title":"GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6b9b0a-e82e-459a-bddf-1c9354bcec00?source=api-prod","affected":[{"type":"plugin","slug":"gg-woo-feed","name":"GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-12-15T00:00:00Z","updated":"2024-06-05T19:55:46Z"},{"id":"wordfence:ce6c2f36-9eed-482f-9201-8d26e8c5c369","source":"wordfence","cve":"CVE-2024-9777","title":"Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6c2f36-9eed-482f-9201-8d26e8c5c369?source=api-prod","affected":[{"type":"theme","slug":"ashe","name":"Ashe","from":"*","from_inclusive":true,"to":"2.243","to_inclusive":true,"patched_in":"2.244"}],"published":"2024-11-18T23:50:20Z","updated":"2024-11-19T12:45:33Z"},{"id":"wordfence:ce6cfed1-b19c-4000-81a1-fad13dc526d3","source":"wordfence","cve":"CVE-2026-59516","title":"ICS Calendar <= 12.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6cfed1-b19c-4000-81a1-fad13dc526d3?source=api-prod","affected":[{"type":"plugin","slug":"ics-calendar","name":"ICS Calendar","from":"*","from_inclusive":true,"to":"12.1.1","to_inclusive":true,"patched_in":"12.1.1.1"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:17:13Z"},{"id":"wordfence:ce6ea115-941e-482f-a2a4-95293ff10a69","source":"wordfence","cve":"","title":"Contact Form Email <= 1.3.31 - Cross-Site Request Forgery to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6ea115-941e-482f-a2a4-95293ff10a69?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":"1.3.32"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce70da8e-7273-4eca-b187-2db7c36f1a50","source":"wordfence","cve":"CVE-2025-6986","title":"FileBird \u2013 WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce70da8e-7273-4eca-b187-2db7c36f1a50?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"6.4.8","to_inclusive":true,"patched_in":"6.4.9"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-06T01:45:13Z"},{"id":"wordfence:ce72cbe0-c774-4077-9ad5-8854d62238d1","source":"wordfence","cve":"CVE-2026-123667","title":"Photo Engine (Media Organizer & Lightroom) < 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce72cbe0-c774-4077-9ad5-8854d62238d1?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":false,"patched_in":"6.6.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:11Z"},{"id":"wordfence:ce735b8a-0966-4f5b-bdab-2b00af652e7f","source":"wordfence","cve":"CVE-2026-42416","title":"uDesign | Multipurpose WordPress Theme <= 4.15.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce735b8a-0966-4f5b-bdab-2b00af652e7f?source=api-prod","affected":[{"type":"plugin","slug":"u-design-core","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:12:36Z","updated":"2026-10-08T23:34:33Z"},{"id":"wordfence:ce75f50d-a9d9-4e4e-85b2-6e15ffa77a94","source":"wordfence","cve":"CVE-2026-32360","title":"Rich Showcase for Google Reviews <= 6.9.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce75f50d-a9d9-4e4e-85b2-6e15ffa77a94?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"6.9.4.3","to_inclusive":true,"patched_in":"6.9.4.4"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:05:32Z"},{"id":"wordfence:ce779d08-93bf-4634-bb83-f5573876e086","source":"wordfence","cve":"","title":"Powerkit < 2.5.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce779d08-93bf-4634-bb83-f5573876e086?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":false,"patched_in":"2.5.9"}],"published":"2022-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce7c2f30-188a-4ae7-976f-c7f0aaf96eee","source":"wordfence","cve":"CVE-2024-4459","title":"Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce7c2f30-188a-4ae7-976f-c7f0aaf96eee?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-05T15:27:40Z","updated":"2024-07-01T17:16:39Z"},{"id":"wordfence:ce7ee2c7-0c7b-4ce3-89d2-5503dff6e59c","source":"wordfence","cve":"CVE-2026-2583","title":"Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce7ee2c7-0c7b-4ce3-89d2-5503dff6e59c?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.1.30","to_inclusive":true,"patched_in":"2.1.31"}],"published":"2026-03-02T09:26:54Z","updated":"2026-03-02T22:23:40Z"},{"id":"wordfence:ce80267b-3c62-4105-a069-ba7497dacd07","source":"wordfence","cve":"CVE-2026-25367","title":"CitiLights < 3.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce80267b-3c62-4105-a069-ba7497dacd07?source=api-prod","affected":[{"type":"theme","slug":"noo-citilights","name":"Support for CitiLights - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":false,"patched_in":"3.7.2"}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-25T15:27:52Z"},{"id":"wordfence:ce8028a3-6fca-448f-b9a0-444db651148c","source":"wordfence","cve":"CVE-2023-7085","title":"Scalable Vector Graphics (SVG) <= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8028a3-6fca-448f-b9a0-444db651148c?source=api-prod","affected":[{"type":"plugin","slug":"scalable-vector-graphics-svg","name":"Scalable Vector Graphics (SVG)","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-23T15:33:51Z"},{"id":"wordfence:ce834ae1-e05a-4b0e-9d7f-144669437d70","source":"wordfence","cve":"","title":"Caldera Forms Pro < 1.8.2 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce834ae1-e05a-4b0e-9d7f-144669437d70?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms-pro","name":"Caldera Forms Pro","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"},{"type":"plugin","slug":"caldera-forms-pro","name":"Caldera Forms Pro","from":"1.8","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2019-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce8397d5-6637-4faa-be1f-9cf52c25be9b","source":"wordfence","cve":"CVE-2024-12615","title":"Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8397d5-6637-4faa-be1f-9cf52c25be9b?source=api-prod","affected":[{"type":"plugin","slug":"passwords-manager","name":"Passwords Manager","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T09:39:16Z"},{"id":"wordfence:ce8474eb-a521-4739-bc3f-3782deb3bc9f","source":"wordfence","cve":"CVE-2026-57810","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8474eb-a521-4739-bc3f-3782deb3bc9f?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:19:31Z"},{"id":"wordfence:ce8526f0-9dfb-4020-aa58-d2ff5bd652bf","source":"wordfence","cve":"CVE-2023-0448","title":"WP Helper Premium <= 4.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8526f0-9dfb-4020-aa58-d2ff5bd652bf?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce88d6e9-b35a-4099-bd6f-d09eac0c8170","source":"wordfence","cve":"CVE-2026-66687","title":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager <= 1.3.2 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce88d6e9-b35a-4099-bd6f-d09eac0c8170?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:49:20Z"},{"id":"wordfence:ce88f1e7-969b-4d43-a12c-da2812d3bfec","source":"wordfence","cve":"CVE-2025-62093","title":"Image&Video FullScreen Background <= 1.6.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce88f1e7-969b-4d43-a12c-da2812d3bfec?source=api-prod","affected":[{"type":"plugin","slug":"lbg_fullscreen_fullwidth_slider","name":"Image&Video FullScreen Background","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-28T00:00:00Z","updated":"2025-12-11T15:35:49Z"},{"id":"wordfence:ce8e5635-a343-40b4-838c-21b942af5242","source":"wordfence","cve":"CVE-2015-2324","title":"Photo Gallery by 10Web <= 1.2.12 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8e5635-a343-40b4-838c-21b942af5242?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":false,"patched_in":"1.2.13"}],"published":"2015-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce8ec66f-5efc-4354-8871-8e35ab4e51fc","source":"wordfence","cve":"CVE-2026-15015","title":"MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8ec66f-5efc-4354-8871-8e35ab4e51fc?source=api-prod","affected":[{"type":"plugin","slug":"mountdev-ai-mcp-connector","name":"MountDev AI MCP Connector for WordPress","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-07-22T20:49:11Z","updated":"2026-07-23T09:33:59Z"},{"id":"wordfence:ce8f8883-f069-4896-8c5f-93600d2c2e6d","source":"wordfence","cve":"CVE-2024-13863","title":"Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8f8883-f069-4896-8c5f-93600d2c2e6d?source=api-prod","affected":[{"type":"plugin","slug":"stylish-google-sheet-reader","name":"Stylish Google Sheet Reader \u2013 Embed Google Sheets as Interactive Tables with Built-in Form Submissions","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-03-04T00:00:00Z","updated":"2025-04-21T15:51:35Z"},{"id":"wordfence:ce8fa964-d543-4d46-a534-e403dff4f425","source":"wordfence","cve":"CVE-2026-1219","title":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8fa964-d543-4d46-a534-e403dff4f425?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"4.0","from_inclusive":true,"to":"5.10","to_inclusive":true,"patched_in":"5.11"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T09:27:06Z"},{"id":"wordfence:ce90db0c-d4ca-4b32-8a64-681642aaf032","source":"wordfence","cve":"CVE-2022-29439","title":"Image Slider by NextCode <= 1.1.2 - Cross-Site Request Forgery to Slide Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce90db0c-d4ca-4b32-8a64-681642aaf032?source=api-prod","affected":[{"type":"plugin","slug":"baslider","name":"Image Slider by NextCode \u2013 Photo & Video Slider","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-26T11:06:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce918263-dc4a-4db1-a506-a9e6c8125741","source":"wordfence","cve":"CVE-2026-82627","title":"Uncanny Automator \u2013 AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce918263-dc4a-4db1-a506-a9e6c8125741?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.6.1.1","to_inclusive":true,"patched_in":"7.7.0"}],"published":"2026-10-07T11:36:55Z","updated":"2026-10-08T01:26:40Z"},{"id":"wordfence:ce924708-935a-45c0-8959-dd122632cef4","source":"wordfence","cve":"CVE-2026-9855","title":"Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce924708-935a-45c0-8959-dd122632cef4?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.8"}],"published":"2026-09-18T18:50:05Z","updated":"2026-09-19T07:43:20Z"},{"id":"wordfence:ce925d1c-2254-49ea-9fcf-e948813b3f2c","source":"wordfence","cve":"CVE-2026-103422","title":"AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce925d1c-2254-49ea-9fcf-e948813b3f2c?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T14:19:11Z","updated":"2026-10-14T02:27:38Z"},{"id":"wordfence:ce95c4a1-0873-4178-a63a-ca9ffdb29ed7","source":"wordfence","cve":"CVE-2026-111317","title":"JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce95c4a1-0873-4178-a63a-ca9ffdb29ed7?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.7.1"}],"published":"2026-11-06T22:46:18Z","updated":"2026-11-07T11:26:35Z"},{"id":"wordfence:ce96ab3a-a8a4-44a3-80ce-3a3ec419db47","source":"wordfence","cve":"CVE-2024-43997","title":"EasyJobs <= 2.4.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce96ab3a-a8a4-44a3-80ce-3a3ec419db47?source=api-prod","affected":[{"type":"plugin","slug":"easyjobs","name":"easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:24:44Z"},{"id":"wordfence:ce96dab2-70ab-4925-8323-daf65d61c81a","source":"wordfence","cve":"","title":"Connections Business Directory < 0.7.9.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce96dab2-70ab-4925-8323-daf65d61c81a?source=api-prod","affected":[{"type":"plugin","slug":"connections","name":"Connections Business Directory","from":"*","from_inclusive":true,"to":"0.7.9.4","to_inclusive":false,"patched_in":"0.7.9.4"}],"published":"2014-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce978334-42e1-4334-a2d1-c3966339e4fc","source":"wordfence","cve":"CVE-2023-33928","title":"WordPress Backup & Migration <= 1.4.0 - Missing Authorization via wt_delete_schedule","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce978334-42e1-4334-a2d1-c3966339e4fc?source=api-prod","affected":[{"type":"plugin","slug":"wp-migration-duplicator","name":"WebToffee WP Backup and Migration","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce984199-b29b-4722-8199-8e37b66e2ed9","source":"wordfence","cve":"CVE-2025-58010","title":"SV Proven Expert <= 2.0.06 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce984199-b29b-4722-8199-8e37b66e2ed9?source=api-prod","affected":[{"type":"plugin","slug":"sv-provenexpert","name":"SV Proven Expert","from":"*","from_inclusive":true,"to":"2.0.06","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:28:48Z"},{"id":"wordfence:ce9aa906-72be-4551-9850-76f0adb6da97","source":"wordfence","cve":"CVE-2023-51548","title":"SlickNav Mobile Menu <= 1.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9aa906-72be-4551-9850-76f0adb6da97?source=api-prod","affected":[{"type":"plugin","slug":"slicknav-mobile-menu","name":"SlickNav Mobile Menu","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2023-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce9b908b-1388-41fb-915c-e4e29eaf57ed","source":"wordfence","cve":"CVE-2023-5231","title":"Magic Action Box <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9b908b-1388-41fb-915c-e4e29eaf57ed?source=api-prod","affected":[{"type":"plugin","slug":"magic-action-box","name":"Magic Action Box","from":"*","from_inclusive":true,"to":"2.17.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce9dab37-4118-4e13-857c-9aa072d25edf","source":"wordfence","cve":"CVE-2024-12190","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <=  2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9dab37-4118-4e13-857c-9aa072d25edf?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":true,"patched_in":"2.17.4"}],"published":"2024-12-24T00:00:00Z","updated":"2024-12-25T03:21:35Z"},{"id":"wordfence:ce9e5b74-dc20-4bb8-884e-bf46d2a484c1","source":"wordfence","cve":"CVE-2025-57996","title":"Buckets <= 0.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9e5b74-dc20-4bb8-884e-bf46d2a484c1?source=api-prod","affected":[{"type":"plugin","slug":"buckets","name":"Buckets","from":"*","from_inclusive":true,"to":"0.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:26:29Z"},{"id":"wordfence:ce9e9298-7ff3-4ecc-9665-cc4a3b76059c","source":"wordfence","cve":"","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) < 2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9e9298-7ff3-4ecc-9665-cc4a3b76059c?source=api-prod","affected":[{"type":"plugin","slug":"mapsmarker","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2012-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ce9ec867-a23a-4081-b791-c6dba6985294","source":"wordfence","cve":"CVE-2024-37943","title":"YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9ec867-a23a-4081-b791-c6dba6985294?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-navigation","name":"YITH WooCommerce Ajax Product Filter","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T14:02:44Z"},{"id":"wordfence:ce9f1611-46ce-4eb7-927c-1cc097f03bd9","source":"wordfence","cve":"CVE-2025-46530","title":"Hacklog Remote Attachment <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9f1611-46ce-4eb7-927c-1cc097f03bd9?source=api-prod","affected":[{"type":"plugin","slug":"hacklog-remote-attachment","name":"Hacklog Remote Attachment","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:10:03Z"},{"id":"wordfence:cea30a5d-2074-48b1-aca5-7c502e496961","source":"wordfence","cve":"CVE-2024-49288","title":"Email Template Customizer for WooCommerce <= 1.2.9.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cea30a5d-2074-48b1-aca5-7c502e496961?source=api-prod","affected":[{"type":"plugin","slug":"email-template-customizer-for-woo","name":"Mailonix \u2013 Email Template Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.9.1","to_inclusive":true,"patched_in":"1.2.9.2"}],"published":"2024-10-15T00:00:00Z","updated":"2024-11-18T17:35:57Z"},{"id":"wordfence:cea39157-94aa-4982-983e-9c3e4b1af86d","source":"wordfence","cve":"CVE-2024-9990","title":"Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypass","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cea39157-94aa-4982-983e-9c3e4b1af86d?source=api-prod","affected":[{"type":"plugin","slug":"crypto","name":"Crypto","from":"*","from_inclusive":true,"to":"2.15","to_inclusive":true,"patched_in":"2.16"}],"published":"2024-10-28T00:00:00Z","updated":"2024-11-05T14:34:28Z"},{"id":"wordfence:cea8295b-b4be-4a95-9137-ad2033a5169d","source":"wordfence","cve":"CVE-2024-11813","title":"Pulsating Chat Button <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cea8295b-b4be-4a95-9137-ad2033a5169d?source=api-prod","affected":[{"type":"plugin","slug":"amin-chat-button","name":"Pulsating Chat Button","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-03T14:18:53Z","updated":"2025-01-30T16:52:39Z"},{"id":"wordfence:ceaa3a5a-c64c-402f-b4f9-33a9577a41ec","source":"wordfence","cve":"CVE-2025-49427","title":"Abbie Expander <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaa3a5a-c64c-402f-b4f9-33a9577a41ec?source=api-prod","affected":[{"type":"plugin","slug":"abbie-expander","name":"Abbie Expander","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:38:03Z"},{"id":"wordfence:ceaccdb3-4d98-4463-9db9-a6f1712d6869","source":"wordfence","cve":"CVE-2026-9183","title":"24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaccdb3-4d98-4463-9db9-a6f1712d6869?source=api-prod","affected":[{"type":"plugin","slug":"24liveblog","name":"24liveblog \u2013 live blog tool","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:38:57Z","updated":"2026-06-24T05:33:31Z"},{"id":"wordfence:ceae0115-268c-401b-876b-3477d10c10e6","source":"wordfence","cve":"CVE-2023-6986","title":"EmbedPress \u2013 Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceae0115-268c-401b-876b-3477d10c10e6?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.6"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:37:29Z"},{"id":"wordfence:ceaf5f81-1adf-4512-b610-d1d183876762","source":"wordfence","cve":"CVE-2021-24980","title":"Gwolle Guestbook <= 4.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaf5f81-1adf-4512-b610-d1d183876762?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.2"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ceaf64d6-9872-4572-807e-7fce76edee57","source":"wordfence","cve":"CVE-2024-9237","title":"Fish and Ships <= 1.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaf64d6-9872-4572-807e-7fce76edee57?source=api-prod","affected":[{"type":"plugin","slug":"fish-and-ships","name":"Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T02:32:24Z"},{"id":"wordfence:ceb041f6-b88a-495a-8f5f-7f39f640748d","source":"wordfence","cve":"CVE-2024-3725","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb041f6-b88a-495a-8f5f-7f39f640748d?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.10"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:40Z"},{"id":"wordfence:ceb08ca9-e512-4a97-b323-cd9447b8bcac","source":"wordfence","cve":"CVE-2024-32714","title":"Academy LMS <= 1.9.16 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb08ca9-e512-4a97-b323-cd9447b8bcac?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"1.9.16","to_inclusive":true,"patched_in":"1.9.17"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:19:00Z"},{"id":"wordfence:ceb0dffa-02a2-4193-b2c4-4774091eacfa","source":"wordfence","cve":"CVE-2024-10640","title":"The FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb0dffa-02a2-4193-b2c4-4774091eacfa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2.2","to_inclusive":true,"patched_in":"1.4.2.3"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T11:19:44Z"},{"id":"wordfence:ceb25902-9dcb-4aba-bee2-893f5cdadebc","source":"wordfence","cve":"CVE-2025-62936","title":"xSmart <= 1.2.9.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb25902-9dcb-4aba-bee2-893f5cdadebc?source=api-prod","affected":[{"type":"theme","slug":"xsmart","name":"xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency","from":"*","from_inclusive":true,"to":"1.2.9.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-29T16:11:23Z"},{"id":"wordfence:ceb25a7b-da93-41eb-bae7-8bffa96f7a1c","source":"wordfence","cve":"CVE-2024-27191","title":"Slivery Extender <= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb25a7b-da93-41eb-bae7-8bffa96f7a1c?source=api-prod","affected":[{"type":"plugin","slug":"slivery-extender","name":"Slivery Extender","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-02-26T00:00:00Z","updated":"2026-02-26T14:54:44Z"},{"id":"wordfence:ceb3ec6d-9960-441c-82ca-3cba9da77495","source":"wordfence","cve":"CVE-2026-27423","title":"Participants Database <= 2.7.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb3ec6d-9960-441c-82ca-3cba9da77495?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.4","to_inclusive":true,"patched_in":"2.7.8.5"}],"published":"2026-07-22T00:00:00Z","updated":"2026-08-14T15:21:11Z"},{"id":"wordfence:ceb7117a-d8b3-44bb-a1f0-3f585135c895","source":"wordfence","cve":"CVE-2026-12274","title":"Tutor LMS <= 3.9.12 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb7117a-d8b3-44bb-a1f0-3f585135c895?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms","name":"Tutor LMS","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:03:04Z"},{"id":"wordfence:ceb7316e-8b55-4e7a-9309-8a9e84f22c90","source":"wordfence","cve":"CVE-2025-10125","title":"Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb7316e-8b55-4e7a-9309-8a9e84f22c90?source=api-prod","affected":[{"type":"plugin","slug":"memberlite-shortcodes","name":"Memberlite Shortcodes","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-09-16T14:11:22Z","updated":"2025-09-17T04:01:16Z"},{"id":"wordfence:ceb7d0a7-ea34-4c6f-a144-660debc74a9e","source":"wordfence","cve":"CVE-2022-38057","title":"TH Advance Product Search <= 1.1.4 - Missing Authorization to Plugin Settings Reset","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb7d0a7-ea34-4c6f-a144-660debc74a9e?source=api-prod","affected":[{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ceb950f4-0ca6-45d1-b261-c8fa045bc555","source":"wordfence","cve":"CVE-2025-69008","title":"Inboxify Sign Up Form <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb950f4-0ca6-45d1-b261-c8fa045bc555?source=api-prod","affected":[{"type":"plugin","slug":"inboxify-sign-up-form","name":"Inboxify Sign Up Form","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-05T19:03:32Z"},{"id":"wordfence:ceba35c3-16b0-4366-b33c-603bdc2c1006","source":"wordfence","cve":"CVE-2023-3814","title":"Advanced File Manager <= 5.1 - Authenticated (Administrator+) Arbitrary File and Folder Access","severity":"medium","cvss":6.6,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceba35c3-16b0-4366-b33c-603bdc2c1006?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-08-14T00:00:00Z","updated":"2024-07-10T18:31:49Z"},{"id":"wordfence:cebd40c2-42df-4792-81dc-2b1082f1712b","source":"wordfence","cve":"CVE-2021-34668","title":"WordPress Real Media Library <= 4.14.1 - Authenticated (Author) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cebd40c2-42df-4792-81dc-2b1082f1712b?source=api-prod","affected":[{"type":"plugin","slug":"real-media-library-lite","name":"Real Media Library: Media Library Folder & File Manager","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cebe27ca-ab29-48dd-bb3c-bcbe8573889b","source":"wordfence","cve":"CVE-2025-58025","title":"Master Slider <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cebe27ca-ab29-48dd-bb3c-bcbe8573889b?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":true,"patched_in":"3.11.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-05-11T19:55:18Z"},{"id":"wordfence:cec0ba0e-28a5-46c0-97c2-bbf73bd2dbad","source":"wordfence","cve":"CVE-2024-37490","title":"Bard <= 2.210 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cec0ba0e-28a5-46c0-97c2-bbf73bd2dbad?source=api-prod","affected":[{"type":"theme","slug":"bard","name":"Bard","from":"*","from_inclusive":true,"to":"2.210","to_inclusive":true,"patched_in":"2.211"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:58:02Z"},{"id":"wordfence:cec0d64e-7b31-4484-8237-2ab4d730ab86","source":"wordfence","cve":"CVE-2026-11973","title":"WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cec0d64e-7b31-4484-8237-2ab4d730ab86?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2026-07-28T19:38:30Z","updated":"2026-08-16T22:40:10Z"},{"id":"wordfence:cec13225-baa3-4f26-b2d2-af6106888c74","source":"wordfence","cve":"CVE-2026-1710","title":"WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cec13225-baa3-4f26-b2d2-af6106888c74?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"*","from_inclusive":true,"to":"10.5.1","to_inclusive":true,"patched_in":"10.6.0"}],"published":"2026-03-30T16:13:16Z","updated":"2026-04-06T15:32:10Z"},{"id":"wordfence:cec428cd-0fa1-4bc4-b7f6-faf90c31f306","source":"wordfence","cve":"CVE-2025-13862","title":"Menu Card <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cec428cd-0fa1-4bc4-b7f6-faf90c31f306?source=api-prod","affected":[{"type":"plugin","slug":"menu-card","name":"Menu Card","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:22:42Z","updated":"2026-01-09T11:15:35Z"},{"id":"wordfence:cec5bfa6-96ed-4a5a-be19-63434af32c89","source":"wordfence","cve":"CVE-2015-3440","title":"WordPress Core < 4.2.1 - Cross-Site Scripting via Comments","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cec5bfa6-96ed-4a5a-be19-63434af32c89?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.0.4"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2015-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cece751c-400d-42b4-9438-950d5aca51fc","source":"wordfence","cve":"CVE-2020-36849","title":"AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cece751c-400d-42b4-9438-950d5aca51fc?source=api-prod","affected":[{"type":"plugin","slug":"ait-csv-import-export","name":"AIT CSV import/export","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2020-11-13T00:00:00Z","updated":"2025-07-12T11:23:40Z"},{"id":"wordfence:cecebfd0-c2af-4150-8793-299cdbeaa7b9","source":"wordfence","cve":"CVE-2026-1228","title":"Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cecebfd0-c2af-4150-8793-299cdbeaa7b9?source=api-prod","affected":[{"type":"plugin","slug":"timeline-block-block","name":"Timeline Block \u2013 tell your story with elegant timelines","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2026-02-05T13:39:29Z","updated":"2026-02-06T02:23:38Z"},{"id":"wordfence:cecf1bcc-ed3e-430c-80d4-d940416eed9a","source":"wordfence","cve":"CVE-2024-31292","title":"Import XML and RSS Feeds <= 2.1.5 - Authenticated (Administrator+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cecf1bcc-ed3e-430c-80d4-d940416eed9a?source=api-prod","affected":[{"type":"plugin","slug":"import-xml-feed","name":"Import XML and RSS Feeds","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-10T20:16:46Z"},{"id":"wordfence:cecf47b8-acda-4a9f-9cf4-e25626d63c26","source":"wordfence","cve":"CVE-2025-64292","title":"Analytics Germanized for Google Analytics <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cecf47b8-acda-4a9f-9cf4-e25626d63c26?source=api-prod","affected":[{"type":"plugin","slug":"ga-germanized","name":"Analytics Germanized for Google Analytics (GDPR / DSGVO)","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T16:57:18Z"},{"id":"wordfence:cecffd72-4597-4308-9f21-4731269e8cf1","source":"wordfence","cve":"CVE-2019-14695","title":"Popup Builder <= 3.44 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cecffd72-4597-4308-9f21-4731269e8cf1?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"3.44","to_inclusive":true,"patched_in":"3.45"}],"published":"2019-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ced01ad6-01a9-401c-baf1-25af6840a374","source":"wordfence","cve":"CVE-2026-73387","title":"Resido - Real Estate WordPress Theme <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced01ad6-01a9-401c-baf1-25af6840a374?source=api-prod","affected":[{"type":"theme","slug":"resido","name":"Resido - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:12:54Z"},{"id":"wordfence:ced350cf-1116-4003-ac74-f6dec34360a5","source":"wordfence","cve":"CVE-2025-14042","title":"Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced350cf-1116-4003-ac74-f6dec34360a5?source=api-prod","affected":[{"type":"theme","slug":"automotive","name":"Automotive Car Dealership Business WordPress Theme","from":"*","from_inclusive":true,"to":"13.4.1","to_inclusive":true,"patched_in":"13.4.2"}],"published":"2026-05-28T17:26:48Z","updated":"2026-05-29T05:32:37Z"},{"id":"wordfence:ced380a5-04a6-40c1-a731-0d3b929e4428","source":"wordfence","cve":"CVE-2024-31941","title":"CP Media Player <= 1.1.3 - Cross-Site Request Forgery to Player Deletion and Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced380a5-04a6-40c1-a731-0d3b929e4428?source=api-prod","affected":[{"type":"plugin","slug":"audio-and-video-player","name":"CP Media Player \u2013 Audio Player and Video Player","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-01-29T00:00:00Z","updated":"2024-04-16T13:49:40Z"},{"id":"wordfence:ced4a635-f579-41fb-840c-3ba54dbe92c8","source":"wordfence","cve":"CVE-2021-24845","title":"Improved Include Page <= 1.2 - Authenticated (Contributor+) Arbitrary Posts/Pages Access","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced4a635-f579-41fb-840c-3ba54dbe92c8?source=api-prod","affected":[{"type":"plugin","slug":"improved-include-page","name":"Improved Include Page","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ced6450a-7d5a-4091-8181-98c005e74346","source":"wordfence","cve":"CVE-2024-44056","title":"Mantra <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced6450a-7d5a-4091-8181-98c005e74346?source=api-prod","affected":[{"type":"theme","slug":"mantra","name":"Mantra","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-08-29T00:00:00Z","updated":"2025-01-17T14:25:48Z"},{"id":"wordfence:ced798e1-b002-4a47-a820-8062e287d8da","source":"wordfence","cve":"CVE-2025-31834","title":"JobBoard Job listing <= 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ced798e1-b002-4a47-a820-8062e287d8da?source=api-prod","affected":[{"type":"plugin","slug":"job-board-light","name":"JobBoard Job listing plugin","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:24:23Z"},{"id":"wordfence:ceda1e49-4e65-4038-9207-ef4647838f53","source":"wordfence","cve":"CVE-2025-12645","title":"Inline frame \u2013 Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceda1e49-4e65-4038-9207-ef4647838f53?source=api-prod","affected":[{"type":"plugin","slug":"inline-frame-iframe","name":"Inline frame \u2013 Iframe","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:09:16Z","updated":"2025-11-25T07:28:25Z"},{"id":"wordfence:cedc575c-ee8f-4c62-bc44-95252a0c8b6f","source":"wordfence","cve":"CVE-2024-37228","title":"InstaWP Connect <= 0.1.0.38 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cedc575c-ee8f-4c62-bc44-95252a0c8b6f?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.38","to_inclusive":true,"patched_in":"0.1.0.39"}],"published":"2024-06-21T00:00:00Z","updated":"2024-06-27T13:30:17Z"},{"id":"wordfence:cede59f9-611f-4da4-8140-181bd0a469d5","source":"wordfence","cve":"","title":"Contact Form by FormGet < 5.3.1 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cede59f9-611f-4da4-8140-181bd0a469d5?source=api-prod","affected":[{"type":"plugin","slug":"formget-contact-form","name":"Contact Form by FormGet \u2013 Best Form Builder Plugin for WordPress","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":false,"patched_in":"5.3.1"}],"published":"2015-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cede7e6f-e3e8-479b-9c7b-91c390ed3936","source":"wordfence","cve":"CVE-2022-3603","title":"Export customers list csv for WooCommerce <= 2.0.67 - CSV Injection","severity":"medium","cvss":4.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cede7e6f-e3e8-479b-9c7b-91c390ed3936?source=api-prod","affected":[{"type":"plugin","slug":"export-woocommerce-customer-list","name":"PiWeb Export Customers Users & Guest customer to CSV for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.67","to_inclusive":true,"patched_in":"2.0.69"}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cede8ff5-f739-4eb3-9672-5adb5d2ae0a9","source":"wordfence","cve":"CVE-2026-1756","title":"WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cede8ff5-f739-4eb3-9672-5adb5d2ae0a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-foft-loader","name":"WP FOFT Loader","from":"*","from_inclusive":true,"to":"2.1.39","to_inclusive":true,"patched_in":"2.1.40"}],"published":"2026-02-03T17:31:06Z","updated":"2026-02-04T06:42:38Z"},{"id":"wordfence:cededc46-ebf5-4614-b9d7-2047f70635f7","source":"wordfence","cve":"CVE-2026-66451","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cededc46-ebf5-4614-b9d7-2047f70635f7?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"4.1.10"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T22:51:00Z"},{"id":"wordfence:cedf0d4c-ee4c-4400-883c-46abe05795c0","source":"wordfence","cve":"CVE-2024-13825","title":"Email Keep <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cedf0d4c-ee4c-4400-883c-46abe05795c0?source=api-prod","affected":[{"type":"plugin","slug":"email-keep","name":"Email Keep","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-03-10T15:56:26Z"},{"id":"wordfence:cedf147d-82ba-41f2-b30a-1befedf8694a","source":"wordfence","cve":"CVE-2025-68023","title":"Addonify \u2013 Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cedf147d-82ba-41f2-b30a-1befedf8694a?source=api-prod","affected":[{"type":"plugin","slug":"addonify-compare-products","name":"Addonify \u2013 Compare Products For WooCommerce","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":"1.1.18"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-16T22:08:57Z"},{"id":"wordfence:cedf6dea-c2d8-4cbd-8a38-3b903e722668","source":"wordfence","cve":"CVE-2024-52500","title":"Monetag Official Plugin <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cedf6dea-c2d8-4cbd-8a38-3b903e722668?source=api-prod","affected":[{"type":"plugin","slug":"monetag-official","name":"Monetag Official Plugin","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-29T00:00:00Z","updated":"2025-02-26T20:34:18Z"},{"id":"wordfence:cee0fbbb-64eb-4022-8220-dfcc5c37aa40","source":"wordfence","cve":"CVE-2025-39537","title":"WP JobHunt <= 7.1 - Unauthenticated Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cee0fbbb-64eb-4022-8220-dfcc5c37aa40?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:57:41Z"},{"id":"wordfence:cee5d8be-d122-46c5-9c1c-da595ce72179","source":"wordfence","cve":"CVE-2025-69177","title":"Roneous - Creative Multi-Purpose WordPress Theme <= 2.1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cee5d8be-d122-46c5-9c1c-da595ce72179?source=api-prod","affected":[{"type":"theme","slug":"roneous","name":"Roneous - Creative Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:10:30Z"},{"id":"wordfence:cee6a100-cda5-48a6-9f9c-ea17f80c4165","source":"wordfence","cve":"CVE-2024-22152","title":"Product Import Export for WooCommerce <= 2.3.7 - Authenticated(Shop Manager+) Arbitrary File Upload via upload_import_file","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cee6a100-cda5-48a6-9f9c-ea17f80c4165?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ceea74e0-afb2-4b5c-a538-48aace4d9619","source":"wordfence","cve":"CVE-2024-10483","title":"Simple:Press Forum <= 6.10.10 - Reflected Cross-Site Scripting via msearch","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceea74e0-afb2-4b5c-a538-48aace4d9619?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.10.10","to_inclusive":true,"patched_in":"6.10.11"}],"published":"2025-01-17T00:00:00Z","updated":"2025-03-03T21:04:46Z"},{"id":"wordfence:ceeae3e8-d213-4770-b8cb-67e4cdbbe89a","source":"wordfence","cve":"CVE-2024-51896","title":"Magic Slider <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceeae3e8-d213-4770-b8cb-67e4cdbbe89a?source=api-prod","affected":[{"type":"plugin","slug":"magic-slider","name":"Magic Slider","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:42:12Z"},{"id":"wordfence:ceebbad1-a239-485e-b021-5d4880f99f8a","source":"wordfence","cve":"CVE-2026-24378","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.8.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceebbad1-a239-485e-b021-5d4880f99f8a?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.8.0","to_inclusive":true,"patched_in":"4.2.8.1"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:50:22Z"},{"id":"wordfence:ceebd61a-a7f8-4854-8b54-b61f8bf204e6","source":"wordfence","cve":"CVE-2024-50468","title":"Raptor Editor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceebd61a-a7f8-4854-8b54-b61f8bf204e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-raptor","name":"Raptor Editor","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:55:30Z"},{"id":"wordfence:ceee40aa-dfaa-4171-8978-1bd98e4266e3","source":"wordfence","cve":"CVE-2026-96832","title":"Content Egg \u2013 Affiliate Product Importer & Price Comparison <= 6.3.1 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee40aa-dfaa-4171-8978-1bd98e4266e3?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"11.9.0"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:49:32Z"},{"id":"wordfence:ceee48dd-72a7-49c3-90d5-7af1a30f9ecb","source":"wordfence","cve":"CVE-2026-85659","title":"PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=api-prod","affected":[{"type":"plugin","slug":"pilotpress","name":"PilotPress","from":"*","from_inclusive":true,"to":"2.0.43","to_inclusive":true,"patched_in":"2.0.44"}],"published":"2026-10-15T16:30:23Z","updated":"2026-10-16T05:30:29Z"},{"id":"wordfence:ceeefc3f-1cb7-48df-9978-258f015d93c7","source":"wordfence","cve":"CVE-2024-5863","title":"Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceeefc3f-1cb7-48df-9978-258f015d93c7?source=api-prod","affected":[{"type":"plugin","slug":"easy-image-collage","name":"Easy Image Collage","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2024-06-27T00:00:00Z","updated":"2024-06-28T03:37:49Z"},{"id":"wordfence:ceef080c-3d3b-494d-8cfa-fe9724b9207f","source":"wordfence","cve":"","title":"SecuPress Free and SecuPress Pro <= 1.4.12 - Unauthenticated Arbitrary IP Ban","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceef080c-3d3b-494d-8cfa-fe9724b9207f?source=api-prod","affected":[{"type":"plugin","slug":"secupress-pro","name":"SecuPress Pro","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2021-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ceef1c0b-c845-4c03-8763-89a1823f69fb","source":"wordfence","cve":"CVE-2025-52738","title":"Wikipedia Preview <= 1.15.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ceef1c0b-c845-4c03-8763-89a1823f69fb?source=api-prod","affected":[{"type":"plugin","slug":"wikipedia-preview","name":"Wikipedia Preview","from":"*","from_inclusive":true,"to":"1.15.0","to_inclusive":true,"patched_in":"1.16.0"}],"published":"2025-08-03T00:00:00Z","updated":"2025-11-04T16:03:36Z"},{"id":"wordfence:cef83a3e-9e8b-4c4c-9adc-cdcebefadd39","source":"wordfence","cve":"CVE-2017-1002012","title":"Image Gallery with Slideshow Plugin <= 1.5.2 - SQL Injection via gid","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cef83a3e-9e8b-4c4c-9adc-cdcebefadd39?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-with-slideshow","name":"Image Gallery with Slideshow Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cef9d696-2189-4fd7-8d8f-10b972e16942","source":"wordfence","cve":"CVE-2026-39761","title":"Meta Box AIO <= 3.7.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cef9d696-2189-4fd7-8d8f-10b972e16942?source=api-prod","affected":[{"type":"plugin","slug":"meta-box-aio","name":"Meta Box AIO","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:04:48Z","updated":"2026-10-22T16:33:03Z"},{"id":"wordfence:cefa38d0-7da1-48dd-98d7-fe2f36e19d7c","source":"wordfence","cve":"CVE-2023-36511","title":"WooCommerce Order Barcodes <= 1.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cefa38d0-7da1-48dd-98d7-fe2f36e19d7c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-order-barcodes","name":"Woocommerce Order Barcodes","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cefb4f36-2131-466f-92f9-14c5bc38ad8e","source":"wordfence","cve":"CVE-2026-75861","title":"Ultimate Gift Cards for WooCommerce <= 3.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cefb4f36-2131-466f-92f9-14c5bc38ad8e?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:29:18Z"},{"id":"wordfence:cefb979e-2b5b-4820-a350-ee106131f0f9","source":"wordfence","cve":"CVE-2011-4957","title":"WordPress Core < 3.1.1 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cefb979e-2b5b-4820-a350-ee106131f0f9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2011-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cefcd612-0ba8-4225-8f23-817b7220ee7b","source":"wordfence","cve":"CVE-2024-2082","title":"EleForms \u2013 All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cefcd612-0ba8-4225-8f23-817b7220ee7b?source=api-prod","affected":[{"type":"plugin","slug":"all-contact-form-integration-for-elementor","name":"EleForms \u2013 All In One Form Integration including DB for Elementor","from":"*","from_inclusive":true,"to":"2.9.9.7","to_inclusive":true,"patched_in":"2.9.9.8"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-02T16:52:41Z"},{"id":"wordfence:cefdf1c5-eab4-4f06-aa5c-24cdef36e5f9","source":"wordfence","cve":"CVE-2024-7861","title":"Misiek Paypal <= 1.1.20090324 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cefdf1c5-eab4-4f06-aa5c-24cdef36e5f9?source=api-prod","affected":[{"type":"plugin","slug":"misiek-paypal","name":"Misiek Paypal","from":"*","from_inclusive":true,"to":"1.1.20090324","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T16:37:28Z"},{"id":"wordfence:cf001185-8ecc-444d-a4f7-3d9b3267be35","source":"wordfence","cve":"CVE-2025-50045","title":"Related Products Manager for WooCommerce <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf001185-8ecc-444d-a4f7-3d9b3267be35?source=api-prod","affected":[{"type":"plugin","slug":"related-products-manager-woocommerce","name":"Related Products Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-25T15:05:02Z"},{"id":"wordfence:cf00d5a9-bf7f-404c-b91f-1d7cf14d883b","source":"wordfence","cve":"CVE-2015-9429","title":"YITH Maintenance Mode <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf00d5a9-bf7f-404c-b91f-1d7cf14d883b?source=api-prod","affected":[{"type":"plugin","slug":"yith-maintenance-mode","name":"YITH Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2015-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf0265cb-d58d-4680-8d5b-9b9334f7721e","source":"wordfence","cve":"CVE-2025-49448","title":"FW Food Menu  <= 6.0.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0265cb-d58d-4680-8d5b-9b9334f7721e?source=api-prod","affected":[{"type":"plugin","slug":"fw-food-menu","name":"FW Food Menu \u2013 Responsive food menu with ordering & delivery solutions","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-07-01T14:20:33Z"},{"id":"wordfence:cf02db2c-5fd2-4f21-a95c-e7645e22ecc6","source":"wordfence","cve":"","title":"WP Advanced Importer <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf02db2c-5fd2-4f21-a95c-e7645e22ecc6?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-importer","name":"WP Advanced Importer","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2016-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf037a61-7e4d-4c20-b868-2fa78950bad3","source":"wordfence","cve":"","title":"Golo - City Travel Guide WordPress Theme < 1.3.3 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf037a61-7e4d-4c20-b868-2fa78950bad3?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":false,"patched_in":"1.3.3"}],"published":"2020-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf0798cd-bf1a-4c1c-82c5-e417b9983c77","source":"wordfence","cve":"","title":"WPRealty <= 2.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0798cd-bf1a-4c1c-82c5-e417b9983c77?source=api-prod","affected":[{"type":"plugin","slug":"wp-realty","name":"WPRealty","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2013-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf0950d3-4d7b-457a-8e67-df310d2712d4","source":"wordfence","cve":"CVE-2025-1407","title":"AMO Team Showcase <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0950d3-4d7b-457a-8e67-df310d2712d4?source=api-prod","affected":[{"type":"plugin","slug":"amo-team-showcase","name":"AMO Team Showcase","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T15:02:47Z","updated":"2025-02-21T03:21:21Z"},{"id":"wordfence:cf0c34d3-5c7d-43a5-9430-2ebdc155123f","source":"wordfence","cve":"CVE-2024-5544","title":"Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0c34d3-5c7d-43a5-9430-2ebdc155123f?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.17","to_inclusive":true,"patched_in":"3.18"}],"published":"2024-07-01T19:02:32Z","updated":"2024-07-02T07:37:06Z"},{"id":"wordfence:cf0c7e3e-b6f3-4c99-bf8a-13b890c870bb","source":"wordfence","cve":"CVE-2025-25086","title":"Secret Meta <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0c7e3e-b6f3-4c99-bf8a-13b890c870bb?source=api-prod","affected":[{"type":"plugin","slug":"facebook-secret-meta","name":"Secret Meta","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:19:10Z"},{"id":"wordfence:cf0f5fd4-cd06-4d11-9f22-1f417b546afb","source":"wordfence","cve":"CVE-2024-4455","title":"YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0f5fd4-cd06-4d11-9f22-1f417b546afb?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T10:58:38Z"},{"id":"wordfence:cf0fb349-4cb8-4cf3-ae7c-5c4dcc6fd4f7","source":"wordfence","cve":"CVE-2024-12336","title":"WC Affiliate \u2013 A Complete WooCommerce Affiliate Plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0fb349-4cb8-4cf3-ae7c-5c4dcc6fd4f7?source=api-prod","affected":[{"type":"plugin","slug":"wc-affiliate","name":"WC Affiliate \u2013 WooCommerce Affiliate Plugin","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-03-14T14:23:37Z","updated":"2025-03-18T19:42:39Z"},{"id":"wordfence:cf1000eb-fac3-4710-bfcd-a6cc2c6327d4","source":"wordfence","cve":"CVE-2024-29765","title":"Aparat for WordPress <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1000eb-fac3-4710-bfcd-a6cc2c6327d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-aparat","name":"Aparat for WordPress","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:18:53Z"},{"id":"wordfence:cf11be7a-0b31-46ce-82ce-5a42898a8a10","source":"wordfence","cve":"CVE-2022-1412","title":"Log WP_Mail <= 0.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf11be7a-0b31-46ce-82ce-5a42898a8a10?source=api-prod","affected":[{"type":"plugin","slug":"logwpmail","name":"Log WP_Mail","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf13732b-7c24-443a-bae9-d8cf70b5cb33","source":"wordfence","cve":"","title":"Stock Sync for WooCommerce <= 2.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf13732b-7c24-443a-bae9-d8cf70b5cb33?source=api-prod","affected":[{"type":"plugin","slug":"stock-sync-for-woocommerce","name":"Stock Sync for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf13f500-e931-4d68-bf24-f829445a1a98","source":"wordfence","cve":"CVE-2025-69371","title":"KindlyCare <= 1.6.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf13f500-e931-4d68-bf24-f829445a1a98?source=api-prod","affected":[{"type":"theme","slug":"kindlycare","name":"KindlyCare - Senior Care & Medical WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T16:46:27Z"},{"id":"wordfence:cf159a11-9490-4f79-a62d-c279cfe26108","source":"wordfence","cve":"","title":"Ripe HD FLV <= 1.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf159a11-9490-4f79-a62d-c279cfe26108?source=api-prod","affected":[{"type":"plugin","slug":"ripe-hd-player","name":"Ripe HD FLV","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2013-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf17a817-6f61-43d5-9da2-58fbbef458d9","source":"wordfence","cve":"CVE-2023-22717","title":"FormCraft <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf17a817-6f61-43d5-9da2-58fbbef458d9?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.10"}],"published":"2023-04-19T00:00:00Z","updated":"2024-07-23T17:47:22Z"},{"id":"wordfence:cf195cca-4e07-41ff-bf26-9ad5fca3635d","source":"wordfence","cve":"CVE-2024-1238","title":"ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf195cca-4e07-41ff-bf26-9ad5fca3635d?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2024-03-29T00:00:00Z","updated":"2024-05-31T15:30:55Z"},{"id":"wordfence:cf19c42c-5711-42e0-b325-093001d7ee54","source":"wordfence","cve":"CVE-2025-46446","title":"Libro de Reclamaciones <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf19c42c-5711-42e0-b325-093001d7ee54?source=api-prod","affected":[{"type":"plugin","slug":"libro-de-reclamaciones","name":"Libro de Reclamaciones","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:03:21Z"},{"id":"wordfence:cf1ca22a-7fb6-457c-bde0-83f6744185be","source":"wordfence","cve":"CVE-2026-3462","title":"Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1ca22a-7fb6-457c-bde0-83f6744185be?source=api-prod","affected":[{"type":"plugin","slug":"reepay-checkout-gateway","name":"Frisbii Pay","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.8.10"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-27T06:50:59Z"},{"id":"wordfence:cf1cc19a-2ca2-4322-9f37-3f7e24ea38c6","source":"wordfence","cve":"CVE-2021-24910","title":"Transposh WordPress Translation <= 1.0.7 - Reflected Cross-Site Scripting via tp_tp","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1cc19a-2ca2-4322-9f37-3f7e24ea38c6?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf1e4b20-e7e5-4a3a-9895-02d51499d54e","source":"wordfence","cve":"CVE-2024-8734","title":"Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1e4b20-e7e5-4a3a-9895-02d51499d54e?source=api-prod","affected":[{"type":"plugin","slug":"lucas-string-replace","name":"Lucas String Replace","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T15:10:43Z"},{"id":"wordfence:cf21c4a8-2e26-4235-8c9b-cda31a687a87","source":"wordfence","cve":"CVE-2024-13327","title":"Musicbox <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf21c4a8-2e26-4235-8c9b-cda31a687a87?source=api-prod","affected":[{"type":"plugin","slug":"musicbox","name":"Musicbox","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:17:59Z"},{"id":"wordfence:cf229083-ac10-42c0-a70a-f273e3eab1ce","source":"wordfence","cve":"CVE-2025-32221","title":"EazyDocs <= 2.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf229083-ac10-42c0-a70a-f273e3eab1ce?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2025-04-07T00:00:00Z","updated":"2026-01-06T20:28:01Z"},{"id":"wordfence:cf238735-8c21-495b-8da0-912921c1f11c","source":"wordfence","cve":"CVE-2024-49278","title":"Omnipress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf238735-8c21-495b-8da0-912921c1f11c?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2024-10-15T00:00:00Z","updated":"2025-03-12T13:25:58Z"},{"id":"wordfence:cf24216c-7882-4359-b526-44d845de0249","source":"wordfence","cve":"CVE-2014-3114","title":"EZPZ One Click Backup <= 12.03.10 - Unauthenticated Command Injection","severity":"critical","cvss":9.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf24216c-7882-4359-b526-44d845de0249?source=api-prod","affected":[{"type":"plugin","slug":"ezpz-one-click-backup","name":"EZPZ One Click Backup","from":"*","from_inclusive":true,"to":"12.03.10","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf245445-27fd-4678-b95d-fb0b1c2aff7b","source":"wordfence","cve":"CVE-2024-54263","title":"Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf245445-27fd-4678-b95d-fb0b1c2aff7b?source=api-prod","affected":[{"type":"plugin","slug":"spirit-framework","name":"Spirit Framework","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""}],"published":"2025-09-03T10:38:00Z","updated":"2026-02-09T22:15:32Z"},{"id":"wordfence:cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8","source":"wordfence","cve":"CVE-2022-4153","title":"Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[]","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16","source":"wordfence","cve":"CVE-2025-13950","title":"OneSignal \u2013 Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=api-prod","affected":[{"type":"plugin","slug":"onesignal-free-web-push-notifications","name":"OneSignal \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2025-12-15T02:15:21Z","updated":"2025-12-15T14:25:14Z"},{"id":"wordfence:cf2c451d-a30c-4c0f-9cf0-6361f6b1913c","source":"wordfence","cve":"CVE-2026-54826","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.4.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2c451d-a30c-4c0f-9cf0-6361f6b1913c?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-25T14:07:18Z"},{"id":"wordfence:cf2d14ff-d02a-4bed-9604-ff2489d4bef9","source":"wordfence","cve":"","title":"Corona (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2d14ff-d02a-4bed-9604-ff2489d4bef9?source=api-prod","affected":[{"type":"theme","slug":"corona","name":"Corona","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf2e8b6f-2bdb-46c4-84a0-9e196355dda9","source":"wordfence","cve":"CVE-2024-31372","title":"No-Bot Registration <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2e8b6f-2bdb-46c4-84a0-9e196355dda9?source=api-prod","affected":[{"type":"plugin","slug":"no-bot-registration","name":"No-Bot Registration","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-16T15:08:09Z"},{"id":"wordfence:cf2f2474-50d6-46da-a97c-731edb514ae5","source":"wordfence","cve":"","title":"Manage Calameo Publications by Athlon < 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2f2474-50d6-46da-a97c-731edb514ae5?source=api-prod","affected":[{"type":"plugin","slug":"athlon-manage-calameo-publications","name":"Manage Calameo Publications by Athlon","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf31cda3-9485-49cf-91e4-2d9baaf7ad0c","source":"wordfence","cve":"CVE-2026-123861","title":"JetFormBuilder \u2013 Hierarchical Select <= 1.0.10 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf31cda3-9485-49cf-91e4-2d9baaf7ad0c?source=api-prod","affected":[{"type":"plugin","slug":"jet-form-builder-hierarchical-select","name":"JetFormBuilder \u2013 Hierarchical Select","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:23:16Z"},{"id":"wordfence:cf326914-6a38-4984-a2a7-66e05f41a96b","source":"wordfence","cve":"CVE-2026-1714","title":"ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action","severity":"high","cvss":8.6,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf326914-6a38-4984-a2a7-66e05f41a96b?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-02-17T16:06:59Z","updated":"2026-06-12T18:57:54Z"},{"id":"wordfence:cf346e71-9baa-473b-8a65-1f22dae8118f","source":"wordfence","cve":"CVE-2026-13147","title":"Kirki <= 6.0.11 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf346e71-9baa-473b-8a65-1f22dae8118f?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-30T12:32:54Z"},{"id":"wordfence:cf34af9d-4de7-498d-8065-c3cc6818b7c4","source":"wordfence","cve":"","title":"Advance Menu Manager <= 3.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf34af9d-4de7-498d-8065-c3cc6818b7c4?source=api-prod","affected":[{"type":"plugin","slug":"advance-menu-manager","name":"Advanced Menu Manager Pro \u2013 Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf34eb9f-f6e9-4a7a-8459-c86f9fa3dad8","source":"wordfence","cve":"CVE-2024-5150","title":"Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf34eb9f-f6e9-4a7a-8459-c86f9fa3dad8?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.26","to_inclusive":true,"patched_in":"1.7.27"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-29T02:00:37Z"},{"id":"wordfence:cf37013e-872a-4582-b6b2-4335f2d9c818","source":"wordfence","cve":"CVE-2025-22339","title":"Store Commerce <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf37013e-872a-4582-b6b2-4335f2d9c818?source=api-prod","affected":[{"type":"theme","slug":"store-commerce","name":"Store Commerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-30T16:20:07Z"},{"id":"wordfence:cf3916fc-f652-4615-872c-3f007b8999df","source":"wordfence","cve":"CVE-2024-8393","title":"Woocommerce Blocks \u2013 Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3916fc-f652-4615-872c-3f007b8999df?source=api-prod","affected":[{"type":"plugin","slug":"woolook","name":"Woocommerce Blocks \u2013 Woolook","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T03:38:52Z"},{"id":"wordfence:cf3a16b6-7256-4fad-b3f2-d1d9d833f45e","source":"wordfence","cve":"CVE-2023-2337","title":"ConvertKit <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3a16b6-7256-4fad-b3f2-d1d9d833f45e?source=api-prod","affected":[{"type":"plugin","slug":"convertkit","name":"Kit (formerly ConvertKit) \u2013 Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf3c2031-06c7-42c9-a099-a798dc0cc3d0","source":"wordfence","cve":"CVE-2025-22723","title":"Barcode Scanner with Inventory & Order Manager <= 1.6.7 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3c2031-06c7-42c9-a099-a798dc0cc3d0?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-21T16:02:30Z"},{"id":"wordfence:cf3d2b0f-667f-469e-a1de-3be213cd7007","source":"wordfence","cve":"CVE-2024-6925","title":"TrueBooker <= 1.0.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3d2b0f-667f-469e-a1de-3be213cd7007?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2024-08-10T00:00:00Z","updated":"2024-10-01T09:34:02Z"},{"id":"wordfence:cf3df923-9426-4e5b-ba59-eda0b5c18d40","source":"wordfence","cve":"CVE-2021-25032","title":"PublishPress Capabilities <= 2.3 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3df923-9426-4e5b-ba59-eda0b5c18d40?source=api-prod","affected":[{"type":"plugin","slug":"capability-manager-enhanced","name":"PublishPress Capabilities: User Role Access Control, Admin Area Permissions","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2021-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf3efda0-8609-4a75-a00b-735b49ef260b","source":"wordfence","cve":"CVE-2026-17581","title":"WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3efda0-8609-4a75-a00b-735b49ef260b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pos","name":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2026-08-15T17:26:58Z","updated":"2026-08-16T05:27:31Z"},{"id":"wordfence:cf3f82dc-3820-4c9d-adbb-ca0375078876","source":"wordfence","cve":"CVE-2021-24996","title":"IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3f82dc-3820-4c9d-adbb-ca0375078876?source=api-prod","affected":[{"type":"plugin","slug":"idpay-contact-form-7","name":"IDPay for Contact Form 7","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf433ec6-7f75-4608-81b3-ea24078b6b6c","source":"wordfence","cve":"CVE-2025-53264","title":"ONet Regenerate Thumbnails <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf433ec6-7f75-4608-81b3-ea24078b6b6c?source=api-prod","affected":[{"type":"plugin","slug":"onet-regenerate-thumbnails","name":"ONet Regenerate Thumbnails","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:22:22Z"},{"id":"wordfence:cf44a96e-0efb-4363-9f49-ba4a82924569","source":"wordfence","cve":"","title":"Video Lightbox <= 1.9.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf44a96e-0efb-4363-9f49-ba4a82924569?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf458f57-2c8b-44d1-8e36-bbfc1a66c2e2","source":"wordfence","cve":"CVE-2014-4541","title":"OMFG Mobile Pro <= 1.1.26 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf458f57-2c8b-44d1-8e36-bbfc1a66c2e2?source=api-prod","affected":[{"type":"plugin","slug":"omfg-mobile","name":"OMFG Mobile Pro","from":"*","from_inclusive":true,"to":"1.1.26","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf47c784-c232-4cec-8dd4-8f7d3987c6ee","source":"wordfence","cve":"CVE-2025-49874","title":"Arconix FAQ <= 1.9.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf47c784-c232-4cec-8dd4-8f7d3987c6ee?source=api-prod","affected":[{"type":"plugin","slug":"arconix-faq","name":"Arconix FAQ","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T14:46:14Z"},{"id":"wordfence:cf48ad3b-9b3a-4052-bacf-52a729d62365","source":"wordfence","cve":"","title":"Link Checker <= 1.16.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf48ad3b-9b3a-4052-bacf-52a729d62365?source=api-prod","affected":[{"type":"plugin","slug":"link-checker","name":"Link Checker","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"}],"published":"2019-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf49d3fb-de14-42bc-bf51-f9adceba0d32","source":"wordfence","cve":"CVE-2025-15369","title":"Xpro Addons \u2014 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf49d3fb-de14-42bc-bf51-f9adceba0d32?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-05-19T13:32:00Z","updated":"2026-05-20T02:27:48Z"},{"id":"wordfence:cf4a3171-f041-40ce-8148-239c24d7ce95","source":"wordfence","cve":"CVE-2025-5939","title":"Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4a3171-f041-40ce-8148-239c24d7ce95?source=api-prod","affected":[{"type":"plugin","slug":"telegram-for-wp","name":"Telegram for WP","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:09:43Z","updated":"2025-06-13T01:47:50Z"},{"id":"wordfence:cf4d42a2-746b-4c23-b0fe-b66eafb76303","source":"wordfence","cve":"CVE-2008-1061","title":"Sniplets < 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4d42a2-746b-4c23-b0fe-b66eafb76303?source=api-prod","affected":[{"type":"plugin","slug":"sniplets","name":"Sniplets","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2008-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf4e9b41-20e8-4dba-a51c-6e8f09232ffb","source":"wordfence","cve":"CVE-2023-1835","title":"Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4e9b41-20e8-4dba-a51c-6e8f09232ffb?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.21","to_inclusive":true,"patched_in":"3.6.22"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf4efae5-d8ea-4c94-bc8a-c73615f2fe62","source":"wordfence","cve":"CVE-2026-39527","title":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View < 4.11.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4efae5-d8ea-4c94-bc8a-c73615f2fe62?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.11.2","to_inclusive":false,"patched_in":"4.11.2"}],"published":"2026-04-17T00:00:00Z","updated":"2026-04-21T15:04:20Z"},{"id":"wordfence:cf4f3f5e-28f7-492c-9d54-4826826bd904","source":"wordfence","cve":"CVE-2021-42360","title":"Starter Templates \u2014 Elementor, Gutenberg & Beaver Builder Templates  <= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4f3f5e-28f7-492c-9d54-4826826bd904?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf5075f9-9658-4a09-bd38-34a72f6560f4","source":"wordfence","cve":"CVE-2024-1467","title":"Starter Templates \u2014 Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5075f9-9658-4a09-bd38-34a72f6560f4?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:39Z"},{"id":"wordfence:cf558c77-fc78-4149-bc7f-2b5353144daf","source":"wordfence","cve":"CVE-2025-6692","title":"YouTube Embed <= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf558c77-fc78-4149-bc7f-2b5353144daf?source=api-prod","affected":[{"type":"plugin","slug":"youram-youtube-embed","name":"YouTube Embed \u2013 YouTube Gallery, Vimeo Gallery \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T20:26:43Z","updated":"2025-07-29T09:23:46Z"},{"id":"wordfence:cf57aeaa-e37e-4b22-aeaa-f0a9f4877484","source":"wordfence","cve":"CVE-2024-1317","title":"RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf57aeaa-e37e-4b22-aeaa-f0a9f4877484?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-02-09T00:00:00Z","updated":"2024-02-20T18:56:46Z"},{"id":"wordfence:cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7","source":"wordfence","cve":"CVE-2026-93746","title":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5ccfe6-c0e3-412f-9a93-2ccabb9997e7?source=api-prod","affected":[{"type":"plugin","slug":"print-invoices-packing-slip-labels-for-woocommerce","name":"WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-10-09T19:11:05Z","updated":"2026-10-10T07:41:48Z"},{"id":"wordfence:cf5f0f9f-b0b1-4ac8-a8c2-e349dfb9e6c3","source":"wordfence","cve":"CVE-2024-13096","title":"WP Finance <= 1.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5f0f9f-b0b1-4ac8-a8c2-e349dfb9e6c3?source=api-prod","affected":[{"type":"plugin","slug":"wp-finance","name":"WP Finance","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-02-20T16:06:52Z"},{"id":"wordfence:cf6182b6-c291-4020-a016-5c6b96039549","source":"wordfence","cve":"CVE-2025-68873","title":"PRIMER by chlo\u00e9digital <= 1.0.25 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6182b6-c291-4020-a016-5c6b96039549?source=api-prod","affected":[{"type":"plugin","slug":"primer-by-chloedigital","name":"PRIMER by chlo\u00e9digital","from":"*","from_inclusive":true,"to":"1.0.25","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-13T17:35:39Z"},{"id":"wordfence:cf625e34-1f51-42a3-8daa-a5188dea226e","source":"wordfence","cve":"CVE-2026-92097","title":"Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf625e34-1f51-42a3-8daa-a5188dea226e?source=api-prod","affected":[{"type":"plugin","slug":"click-to-chat-for-whatsapp","name":"Click to Chat \u2013 HoliThemes","from":"*","from_inclusive":true,"to":"4.44","to_inclusive":true,"patched_in":"4.45"}],"published":"2026-10-13T12:25:30Z","updated":"2026-10-14T01:27:17Z"},{"id":"wordfence:cf643f14-bbca-40ee-bce0-648e50d17ca9","source":"wordfence","cve":"CVE-2024-5026","title":"CM Tooltip Glossary <= 4.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf643f14-bbca-40ee-bce0-648e50d17ca9?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2024-05-01T00:00:00Z","updated":"2025-05-29T22:15:07Z"},{"id":"wordfence:cf64f1c5-257d-49b2-b626-eaa4592b8335","source":"wordfence","cve":"CVE-2026-6247","title":"scratchblocks for WP <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf64f1c5-257d-49b2-b626-eaa4592b8335?source=api-prod","affected":[{"type":"plugin","slug":"scratchblocks-for-wp","name":"scratchblocks for WP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:02:23Z","updated":"2026-05-12T07:48:28Z"},{"id":"wordfence:cf6563a4-56ca-46b1-a854-aad7cc550f73","source":"wordfence","cve":"CVE-2015-5065","title":"PayPal Currency Converter BASIC for WooCommerce <= 1.3 - Path Traversal to Arbitrary File Read","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6563a4-56ca-46b1-a854-aad7cc550f73?source=api-prod","affected":[{"type":"plugin","slug":"paypal-currency-converter-basic-for-woocommerce","name":"PayPal Currency Converter BASIC for WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2015-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf665438-20d2-4df9-b3ff-54123343a46d","source":"wordfence","cve":"","title":"Rencontre \u2013 Dating Site <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf665438-20d2-4df9-b3ff-54123343a46d?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":false,"patched_in":"3.2.2"}],"published":"2019-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf67d95a-7819-49b7-8a2a-ea945a0167b1","source":"wordfence","cve":"CVE-2025-39435","title":"My Marginalia <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf67d95a-7819-49b7-8a2a-ea945a0167b1?source=api-prod","affected":[{"type":"plugin","slug":"my-marginalia","name":"My Marginalia","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:47:20Z"},{"id":"wordfence:cf68401a-0a79-43f0-adee-fd0594d5dee0","source":"wordfence","cve":"CVE-2025-24755","title":"PDF Invoices for WooCommerce + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf68401a-0a79-43f0-adee-fd0594d5dee0?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-woocommerce","name":"PDF Invoice for WooCommerce + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:46:02Z"},{"id":"wordfence:cf69a071-d4dd-4ed7-8366-cdd205724a9b","source":"wordfence","cve":"CVE-2025-66123","title":"BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf69a071-d4dd-4ed7-8366-cdd205724a9b?source=api-prod","affected":[{"type":"plugin","slug":"ovabookpro","name":"BookPro - Appointment Booking WordPress Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T11:44:08Z"},{"id":"wordfence:cf6c13de-e666-4c80-aa4c-6f610d899d03","source":"wordfence","cve":"CVE-2024-5156","title":"Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6c13de-e666-4c80-aa4c-6f610d899d03?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.18.7","to_inclusive":true,"patched_in":"3.19.0"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T14:00:46Z"},{"id":"wordfence:cf6e3552-9616-4da1-8d8e-a6144ba1d0a3","source":"wordfence","cve":"CVE-2023-47239","title":"Easy PayPal Shopping Cart <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6e3552-9616-4da1-8d8e-a6144ba1d0a3?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-shopping-cart","name":"Easy PayPal Shopping Cart","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.1.11"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf6e5800-9885-4258-87a5-0e0de75f955d","source":"wordfence","cve":"CVE-2025-30788","title":"EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.08 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf6e5800-9885-4258-87a5-0e0de75f955d?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"*","from_inclusive":true,"to":"5.25.08","to_inclusive":true,"patched_in":"5.25.10"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:42:09Z"},{"id":"wordfence:cf711c64-dd5e-4725-824c-fbe9063916d9","source":"wordfence","cve":"CVE-2022-0190","title":"Ad Invalid Click Protector <= 1.2.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf711c64-dd5e-4725-824c-fbe9063916d9?source=api-prod","affected":[{"type":"plugin","slug":"ad-invalid-click-protector","name":"Ad Invalid Click Protector (AICP)","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf71d36c-c730-470b-bd22-a393370d867c","source":"wordfence","cve":"CVE-2024-43339","title":"WebinarPress <= 1.33.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf71d36c-c730-470b-bd22-a393370d867c?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.20","to_inclusive":true,"patched_in":"1.33.21"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:30:17Z"},{"id":"wordfence:cf72cc4c-ec99-46c2-bb12-d11e9d51ffc8","source":"wordfence","cve":"CVE-2025-68507","title":"Icegram <= 3.1.35 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf72cc4c-ec99-46c2-bb12-d11e9d51ffc8?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"3.1.35","to_inclusive":true,"patched_in":"3.1.36"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T20:14:17Z"},{"id":"wordfence:cf753fcf-9db0-4161-97e5-0f09c3452544","source":"wordfence","cve":"CVE-2024-32454","title":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf753fcf-9db0-4161-97e5-0f09c3452544?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-03T19:06:14Z"},{"id":"wordfence:cf7987ed-bde8-41a1-b679-299e7b09e282","source":"wordfence","cve":"CVE-2026-22353","title":"teachPress <= 9.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7987ed-bde8-41a1-b679-299e7b09e282?source=api-prod","affected":[{"type":"plugin","slug":"teachpress","name":"teachPress","from":"*","from_inclusive":true,"to":"9.0.12","to_inclusive":true,"patched_in":"9.0.13"}],"published":"2025-12-30T00:00:00Z","updated":"2026-04-15T13:33:08Z"},{"id":"wordfence:cf7adeb3-4c6b-4181-af07-0acb1fc8cdb0","source":"wordfence","cve":"CVE-2026-8039","title":"Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7adeb3-4c6b-4181-af07-0acb1fc8cdb0?source=api-prod","affected":[{"type":"plugin","slug":"fancy-testimonials","name":"Fancy Testimonials","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-17T19:25:04Z","updated":"2026-10-26T05:36:55Z"},{"id":"wordfence:cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3","source":"wordfence","cve":"CVE-2023-0958","title":"Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7bdd0e-f3b3-4be5-8a30-2c6d9cb783a3?source=api-prod","affected":[{"type":"plugin","slug":"http-https-remover","name":"SSL Mixed Content Fix","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"},{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"},{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"},{"type":"plugin","slug":"ultimate-posts-widget","name":"Ultimate Posts Widget","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"},{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"pop-up-pop-up","name":"Pop-up","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"},{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"},{"type":"plugin","slug":"feedburner-alternative-and-rss-redirect","name":"RSS Redirect & Feedburner Alternative","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"},{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf7c3ffe-079e-4db4-9dc4-3405527c0a99","source":"wordfence","cve":"CVE-2023-0399","title":"Image Over Image For WPBakery Page Builder <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7c3ffe-079e-4db4-9dc4-3405527c0a99?source=api-prod","affected":[{"type":"plugin","slug":"image-over-image-vc-extension","name":"Image Over Image For WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf7de1c4-e63e-4423-a6af-c08bd4f078f8","source":"wordfence","cve":"CVE-2026-97259","title":"Pay with Vipps and MobilePay for WooCommerce <= 6.2.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7de1c4-e63e-4423-a6af-c08bd4f078f8?source=api-prod","affected":[{"type":"plugin","slug":"woo-vipps","name":"Pay with Vipps and MobilePay for WooCommerce","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2026-09-30T11:16:00Z","updated":"2026-10-08T23:58:32Z"},{"id":"wordfence:cf7ec469-70b7-4ec2-83df-c788c76730b4","source":"wordfence","cve":"CVE-2024-12059","title":"ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf7ec469-70b7-4ec2-83df-c788c76730b4?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:24Z"},{"id":"wordfence:cf803368-64ff-4dbe-85ae-af30e18bc833","source":"wordfence","cve":"CVE-2008-3233","title":"WordPress Core < 2.6 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf803368-64ff-4dbe-85ae-af30e18bc833?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2008-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf806412-9f21-468e-a497-319d5b24e677","source":"wordfence","cve":"CVE-2024-35729","title":"Tickera <= 3.5.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf806412-9f21-468e-a497-319d5b24e677?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.2.6","to_inclusive":true,"patched_in":"3.5.2.7"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:15:59Z"},{"id":"wordfence:cf80f304-f79d-4863-b57a-d273daa5fe7f","source":"wordfence","cve":"CVE-2026-115869","title":"Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf80f304-f79d-4863-b57a-d273daa5fe7f?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.8.4","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2026-10-30T15:45:06Z","updated":"2026-10-30T17:15:32Z"},{"id":"wordfence:cf810967-9fb9-4d6b-9671-1f41176248bb","source":"wordfence","cve":"CVE-2025-32195","title":"Ecwid Shopping Cart <= 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf810967-9fb9-4d6b-9671-1f41176248bb?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-01T13:58:19Z"},{"id":"wordfence:cf831f67-b20d-4624-8853-39e872ce5608","source":"wordfence","cve":"CVE-2026-28026","title":"Motorix <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf831f67-b20d-4624-8853-39e872ce5608?source=api-prod","affected":[{"type":"theme","slug":"motorix","name":"Motorix","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:29:54Z"},{"id":"wordfence:cf851bed-f5d8-44e2-810d-906ba3d3c1c5","source":"wordfence","cve":"CVE-2025-11391","title":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf851bed-f5d8-44e2-810d-906ba3d3c1c5?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"33.0.15","to_inclusive":true,"patched_in":"33.0.16"}],"published":"2025-10-17T18:09:32Z","updated":"2025-10-18T06:42:48Z"},{"id":"wordfence:cf85ddc7-cb90-4502-9936-f2c51030b4a6","source":"wordfence","cve":"CVE-2024-48026","title":"Disc Golf Manager <= 1.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf85ddc7-cb90-4502-9936-f2c51030b4a6?source=api-prod","affected":[{"type":"plugin","slug":"disc-golf-manager","name":"Disc Golf Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:53:58Z"},{"id":"wordfence:cf8817fd-b49a-4fb3-9c91-09e952ff0953","source":"wordfence","cve":"CVE-2025-1401","title":"WP Click Info <= 2.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf8817fd-b49a-4fb3-9c91-09e952ff0953?source=api-prod","affected":[{"type":"plugin","slug":"wp-click-info","name":"WP Click Info","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T21:57:48Z"},{"id":"wordfence:cf8919d4-6ca7-44ed-ae2a-14b0c96a568f","source":"wordfence","cve":"CVE-2024-45453","title":"Maintenance Redirect <= 2.0.1 - IP Spoofing to Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf8919d4-6ca7-44ed-ae2a-14b0c96a568f?source=api-prod","affected":[{"type":"plugin","slug":"jf3-maintenance-mode","name":"Maintenance Redirect","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-18T16:05:45Z"},{"id":"wordfence:cf902756-21f3-483b-a5d8-a9b4226bde22","source":"wordfence","cve":"CVE-2025-11967","title":"Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf902756-21f3-483b-a5d8-a9b4226bde22?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.18.10","to_inclusive":true,"patched_in":"1.18.11"}],"published":"2025-11-07T21:08:54Z","updated":"2025-11-08T09:28:11Z"},{"id":"wordfence:cf91d75e-cef4-4154-aa16-6ca96db9c5bb","source":"wordfence","cve":"CVE-2025-7504","title":"Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf91d75e-cef4-4154-aa16-6ca96db9c5bb?source=api-prod","affected":[{"type":"plugin","slug":"friends","name":"Friends","from":"3.5.1","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-12T08:23:42Z"},{"id":"wordfence:cf9470c9-693b-4f36-91d9-26b2d488b377","source":"wordfence","cve":"CVE-2018-13832","title":"All In One Favicon <= 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf9470c9-693b-4f36-91d9-26b2d488b377?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-favicon","name":"All In One Favicon","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2018-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf96887c-6e0d-43d9-a3f2-88981adb4c98","source":"wordfence","cve":"CVE-2022-4219","title":"Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf96887c-6e0d-43d9-a3f2-88981adb4c98?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.4","to_inclusive":true,"patched_in":"1.3.2.5"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cf98200b-be05-4939-bab4-6524ae6752bd","source":"wordfence","cve":"CVE-2026-96450","title":"Pixfort Core < 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf98200b-be05-4939-bab4-6524ae6752bd?source=api-prod","affected":[{"type":"plugin","slug":"pixfort-core","name":"Pixfort Core","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":false,"patched_in":"4.3.3"}],"published":"2026-09-29T00:00:00Z","updated":"2026-09-30T16:31:07Z"},{"id":"wordfence:cf992c75-a1ae-49c3-8110-2f3b31b23f6c","source":"wordfence","cve":"CVE-2023-0924","title":"Zyrex Popup <= 1.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf992c75-a1ae-49c3-8110-2f3b31b23f6c?source=api-prod","affected":[{"type":"plugin","slug":"popup-zyrex","name":"POPUP Zyrex","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfa375a8-ab07-45da-bc77-1e7edc996e05","source":"wordfence","cve":"CVE-2026-14327","title":"AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa375a8-ab07-45da-bc77-1e7edc996e05?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-wordpress","name":"AR for WordPress","from":"*","from_inclusive":true,"to":"8.40","to_inclusive":true,"patched_in":"8.41"}],"published":"2026-07-02T12:02:11Z","updated":"2026-07-03T01:28:22Z"},{"id":"wordfence:cfa487fb-c014-47f1-9537-73881ede30b4","source":"wordfence","cve":"CVE-2024-11283","title":"WP JobHunt <= 7.1 - Authentication Bypass to Candidate","severity":"high","cvss":7.5,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa487fb-c014-47f1-9537-73881ede30b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobhunt","name":"WP JobHunt","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:34Z"},{"id":"wordfence:cfa48f93-867d-427b-9fb4-ced7b5427a8d","source":"wordfence","cve":"CVE-2026-74009","title":"Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa48f93-867d-427b-9fb4-ced7b5427a8d?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"4.8.8"}],"published":"2026-08-17T17:09:00Z","updated":"2026-09-10T19:13:58Z"},{"id":"wordfence:cfa6bc4b-7fc8-40c7-bfca-18410f6cd615","source":"wordfence","cve":"CVE-2026-11964","title":"User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa6bc4b-7fc8-40c7-bfca-18410f6cd615?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:09:56Z"},{"id":"wordfence:cfa8aaf8-10c8-4024-8223-6218963012d2","source":"wordfence","cve":"CVE-2026-15252","title":"Search Atlas SEO \u2013 Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfa8aaf8-10c8-4024-8223-6218963012d2?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":false,"patched_in":"2.6.12"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:24:15Z"},{"id":"wordfence:cfaa8ffd-549e-4803-aa17-d1317a606e7a","source":"wordfence","cve":"CVE-2026-7475","title":"Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaa8ffd-549e-4803-aa17-d1317a606e7a?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-05-07T20:49:56Z","updated":"2026-05-08T09:26:53Z"},{"id":"wordfence:cfaea9dd-98bf-4835-9c9f-362bf01e4639","source":"wordfence","cve":"CVE-2025-25145","title":"Infusionsoft Analytics <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaea9dd-98bf-4835-9c9f-362bf01e4639?source=api-prod","affected":[{"type":"plugin","slug":"infusionsoft-web-tracker","name":"Infusionsoft Analytics for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:20:26Z"},{"id":"wordfence:cfaf39b3-ac83-4cf8-ad52-0eff3c83cffd","source":"wordfence","cve":"CVE-2026-121571","title":"Autopay dla WooCommerce <= 2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfaf39b3-ac83-4cf8-ad52-0eff3c83cffd?source=api-prod","affected":[{"type":"plugin","slug":"pay-wp","name":"Autopay dla WooCommerce","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-11-07T10:42:00Z","updated":"2026-11-10T19:43:17Z"},{"id":"wordfence:cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b","source":"wordfence","cve":"CVE-2026-2503","title":"ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b?source=api-prod","affected":[{"type":"plugin","slug":"element-camp","name":"ElementCamp","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2026-03-20T15:15:19Z","updated":"2026-09-18T18:58:00Z"},{"id":"wordfence:cfb27513-61ad-4cf0-a471-0ab7aeb0801b","source":"wordfence","cve":"CVE-2023-27617","title":"RSVPMarker  <= 10.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb27513-61ad-4cf0-a471-0ab7aeb0801b?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfb45af3-c22a-4045-b564-22f7081868d7","source":"wordfence","cve":"CVE-2024-32099","title":"WP Mail Catcher <= 2.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb45af3-c22a-4045-b564-22f7081868d7?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T21:04:11Z"},{"id":"wordfence:cfb46f29-ce39-4f19-9084-a28749ccfda4","source":"wordfence","cve":"CVE-2026-97317","title":"Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb46f29-ce39-4f19-9084-a28749ccfda4?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.26","to_inclusive":true,"patched_in":"1.12.27"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T00:18:32Z"},{"id":"wordfence:cfb48c2e-9447-4fd1-a5a4-d9b675276ced","source":"wordfence","cve":"CVE-2024-4959","title":"Frontend Checklist <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Items","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb48c2e-9447-4fd1-a5a4-d9b675276ced?source=api-prod","affected":[{"type":"plugin","slug":"frontend-checklist","name":"Frontend Checklist","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:32:56Z"},{"id":"wordfence:cfb52a38-2894-4b43-b936-a11fa6257741","source":"wordfence","cve":"CVE-2024-12732","title":"AffiliateImporterEb <= 1.0.6 - Reflected Cross-Site Scripting via 'module'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb52a38-2894-4b43-b936-a11fa6257741?source=api-prod","affected":[{"type":"plugin","slug":"affiliateimportereb","name":"AffiliateImporterEb","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-05-27T15:17:29Z"},{"id":"wordfence:cfb53e44-7f9d-490f-b938-f428c20219d7","source":"wordfence","cve":"CVE-2026-13424","title":"Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb53e44-7f9d-490f-b938-f428c20219d7?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.7","to_inclusive":true,"patched_in":"28.0"}],"published":"2026-08-15T17:53:44Z","updated":"2026-08-16T06:38:08Z"},{"id":"wordfence:cfb63a23-71f1-4497-a1ba-5b10abf0e22a","source":"wordfence","cve":"CVE-2025-39602","title":"WooCommerce Product Table Lite <= 3.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb63a23-71f1-4497-a1ba-5b10abf0e22a?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-30T22:17:30Z"},{"id":"wordfence:cfb6e263-efcc-4ecb-8c9a-91f73f82b55a","source":"wordfence","cve":"CVE-2025-23990","title":"Scroll Styler <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb6e263-efcc-4ecb-8c9a-91f73f82b55a?source=api-prod","affected":[{"type":"plugin","slug":"scroll-styler","name":"Scroll Styler","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:33:01Z"},{"id":"wordfence:cfb87c87-f9dc-4f26-93f5-10d6bf6c822b","source":"wordfence","cve":"CVE-2024-35168","title":"WP Discourse <= 2.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb87c87-f9dc-4f26-93f5-10d6bf6c822b?source=api-prod","affected":[{"type":"plugin","slug":"wp-discourse","name":"WP Discourse","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T19:59:49Z"},{"id":"wordfence:cfbb751c-8d43-4b39-9f93-d52bb3d7fe93","source":"wordfence","cve":"CVE-2026-121777","title":"Cool FormKit Lite \u2013 Advanced Form Builder for Elementor <= 2.7.10 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbb751c-8d43-4b39-9f93-d52bb3d7fe93?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-elementor-form","name":"Cool FormKit Lite \u2013 Advanced Form Builder for Elementor","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.7.11"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:12:23Z"},{"id":"wordfence:cfbbb8cf-ea03-4a99-92a2-6d0672c82190","source":"wordfence","cve":"CVE-2026-25022","title":"KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbbb8cf-ea03-4a99-92a2-6d0672c82190?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-02-01T18:08:24Z","updated":"2026-02-09T22:17:59Z"},{"id":"wordfence:cfbc7af2-1e2c-4aaf-b73c-870f7519aff1","source":"wordfence","cve":"CVE-2023-4827","title":"File Manager Pro \u2013 Filester - <= 1.7.6 - Cross-Site Request Forgery to Arbitrary File Rename","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbc7af2-1e2c-4aaf-b73c-870f7519aff1?source=api-prod","affected":[{"type":"plugin","slug":"filester","name":"File Manager Pro \u2013 Filester","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfbc7f74-89c6-4418-9e1e-12650e179912","source":"wordfence","cve":"CVE-2024-31377","title":"WP Photo Album Plus <= 8.7.01.001 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbc7f74-89c6-4418-9e1e-12650e179912?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"8.7.01.001","to_inclusive":true,"patched_in":"8.7.01.002"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:13:19Z"},{"id":"wordfence:cfbc90b9-af91-49ac-ad3d-a37c17e8ba6d","source":"wordfence","cve":"CVE-2024-13536","title":"1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbc90b9-af91-49ac-ad3d-a37c17e8ba6d?source=api-prod","affected":[{"type":"plugin","slug":"1003-mortgage-application","name":"1003 Mortgage Application","from":"*","from_inclusive":true,"to":"1.87","to_inclusive":true,"patched_in":""}],"published":"2025-01-20T15:24:32Z","updated":"2025-01-21T04:20:57Z"},{"id":"wordfence:cfbd331d-07de-47f8-b4f1-cc31f897cdfd","source":"wordfence","cve":"CVE-2026-94254","title":"SellKit \u2013 Funnel builder and checkout optimizer for WooCommerce to sell more, faster < 2.8.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbd331d-07de-47f8-b4f1-cc31f897cdfd?source=api-prod","affected":[{"type":"plugin","slug":"sellkit","name":"SellKit \u2013 Funnel builder and checkout optimizer for WooCommerce to sell more, faster","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"}],"published":"2026-10-14T00:00:00Z","updated":"2026-11-03T19:33:54Z"},{"id":"wordfence:cfbd41fa-15f0-473a-be5a-862e8a14b287","source":"wordfence","cve":"CVE-2023-3182","title":"Restrict Content <= 3.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfbd41fa-15f0-473a-be5a-862e8a14b287?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfc09dee-9af6-49ff-bfe2-abcc616940d7","source":"wordfence","cve":"CVE-2016-1000142","title":"MW Font Changer <= 4.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc09dee-9af6-49ff-bfe2-abcc616940d7?source=api-prod","affected":[{"type":"plugin","slug":"parsi-font","name":"MW Font Changer","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":false,"patched_in":"4.3"}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfc59270-d08c-4b78-9863-4bb88120b878","source":"wordfence","cve":"CVE-2022-0702","title":"Petfinder Listings <= 1.0.19 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc59270-d08c-4b78-9863-4bb88120b878?source=api-prod","affected":[{"type":"plugin","slug":"petfinder-listings","name":"List Petfinder Pets","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfc59e3d-13c6-4051-8a1a-d109ea06b10b","source":"wordfence","cve":"","title":"Opening Hours <= 2.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc59e3d-13c6-4051-8a1a-d109ea06b10b?source=api-prod","affected":[{"type":"plugin","slug":"wp-opening-hours","name":"Opening Hours","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfc6b4a5-ff13-457f-9e06-de15e8cb5510","source":"wordfence","cve":"CVE-2024-31308","title":"WP Import Export Lite <= 3.9.26 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc6b4a5-ff13-457f-9e06-de15e8cb5510?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.26","to_inclusive":true,"patched_in":"3.9.27"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:01:57Z"},{"id":"wordfence:cfc6c595-dad2-4abc-8187-ed72355273b8","source":"wordfence","cve":"CVE-2021-4373","title":"Better Search <= 2.5.2 - Cross-Site Request Forgery to Settings Import","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc6c595-dad2-4abc-8187-ed72355273b8?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":false,"patched_in":"2.5.3"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfc6c5cd-208c-433f-9121-9d0c101b587d","source":"wordfence","cve":"CVE-2026-14819","title":"Event Tickets <= 5.28.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc6c5cd-208c-433f-9121-9d0c101b587d?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.28.3","to_inclusive":true,"patched_in":"5.28.4"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-29T23:18:11Z"},{"id":"wordfence:cfc6ff21-52f5-453f-bf97-881c39be1aeb","source":"wordfence","cve":"CVE-2024-10629","title":"GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc6ff21-52f5-453f-bf97-881c39be1aeb?source=api-prod","affected":[{"type":"plugin","slug":"gpx-viewer","name":"GPX Viewer","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2024-11-12T13:21:00Z","updated":"2024-11-15T15:41:36Z"},{"id":"wordfence:cfc78684-fdb7-4ce1-8464-0d057b48a7fa","source":"wordfence","cve":"CVE-2024-33641","title":"Custom field finder <= 0.3 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfc78684-fdb7-4ce1-8464-0d057b48a7fa?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-finder","name":"Custom field finder","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:41:20Z"},{"id":"wordfence:cfcc1a4d-c6c7-4ca8-afe5-79298e7ad3d7","source":"wordfence","cve":"CVE-2023-36502","title":"Balkon <= 1.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfcc1a4d-c6c7-4ca8-afe5-79298e7ad3d7?source=api-prod","affected":[{"type":"theme","slug":"balkon","name":"Balkon","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfcd59ae-085f-47d2-a4d2-2d1239f035d2","source":"wordfence","cve":"CVE-2024-2255","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfcd59ae-085f-47d2-a4d2-2d1239f035d2?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-22T19:31:52Z"},{"id":"wordfence:cfd1e59a-a76d-4f6d-9d22-021afd45d9af","source":"wordfence","cve":"CVE-2022-45839","title":"Better Click To Tweet <= 5.10.3 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd1e59a-a76d-4f6d-9d22-021afd45d9af?source=api-prod","affected":[{"type":"plugin","slug":"better-click-to-tweet","name":"Better Click To Share \u2013 Shareable Quote Boxes for X (Twitter)","from":"*","from_inclusive":true,"to":"5.10.3","to_inclusive":true,"patched_in":"5.10.4"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfd32e46-a4fc-4c10-b546-9f9da75db791","source":"wordfence","cve":"CVE-2023-2834","title":"BookIt <= 2.3.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd32e46-a4fc-4c10-b546-9f9da75db791?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfd35a3c-7203-4832-8b0d-56f3e7983118","source":"wordfence","cve":"CVE-2025-7695","title":"Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd35a3c-7203-4832-8b0d-56f3e7983118?source=api-prod","affected":[{"type":"plugin","slug":"integration-cds","name":"DataPress (Dataverse Integration)","from":"2.77","from_inclusive":true,"to":"2.81","to_inclusive":true,"patched_in":"2.81.1"}],"published":"2025-07-23T20:27:17Z","updated":"2025-07-24T09:22:22Z"},{"id":"wordfence:cfd3f0e3-e73e-4ec2-ac67-da1cc15aa217","source":"wordfence","cve":"CVE-2017-18499","title":"Simple Membership <= 3.5.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd3f0e3-e73e-4ec2-ac67-da1cc15aa217?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":false,"patched_in":"3.5.7"}],"published":"2017-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfd69b54-3056-4909-b3e8-ef2387ea9ea8","source":"wordfence","cve":"CVE-2024-43297","title":"WOOCS \u2013 WooCommerce Currency Switcher <= 1.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd69b54-3056-4909-b3e8-ef2387ea9ea8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.2.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T19:40:48Z"},{"id":"wordfence:cfd8a6a4-9159-480f-abe2-71972585217b","source":"wordfence","cve":"CVE-2023-0553","title":"Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd8a6a4-9159-480f-abe2-71972585217b?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-menu","name":"Quick Restaurant Menu","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfdd7e9f-a2a5-43ac-8eb1-b9723e932db9","source":"wordfence","cve":"CVE-2025-60179","title":"Click & Tweet <= 0.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfdd7e9f-a2a5-43ac-8eb1-b9723e932db9?source=api-prod","affected":[{"type":"plugin","slug":"click-tweet","name":"Click & Tweet","from":"*","from_inclusive":true,"to":"0.8.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T13:15:42Z"},{"id":"wordfence:cfde2cf5-d40a-4843-946a-5555b4d95ecf","source":"wordfence","cve":"CVE-2026-81338","title":"MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection","severity":"medium","cvss":6.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfde2cf5-d40a-4843-946a-5555b4d95ecf?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:03:24Z"},{"id":"wordfence:cfdff272-fd65-4dfb-8b02-6d266ce4a1cc","source":"wordfence","cve":"CVE-2024-52344","title":"Provide Forex Signals <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfdff272-fd65-4dfb-8b02-6d266ce4a1cc?source=api-prod","affected":[{"type":"plugin","slug":"provide-forex-signals","name":"Provide Forex Signals","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:56:25Z"},{"id":"wordfence:cfe2cabd-98f6-4ebc-8a02-e6951202aa88","source":"wordfence","cve":"CVE-2023-6594","title":"WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe2cabd-98f6-4ebc-8a02-e6951202aa88?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.7.4","to_inclusive":true,"patched_in":"9.7.6"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:37:29Z"},{"id":"wordfence:cfe45a6b-bd31-4716-9d4d-f7d1b48f9884","source":"wordfence","cve":"CVE-2026-54837","title":"Intranet & Private Site \u2013 All-In-One Intranet <= 1.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe45a6b-bd31-4716-9d4d-f7d1b48f9884?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-intranet","name":"Intranet & Private Site \u2013 All-In-One Intranet","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:52:04Z"},{"id":"wordfence:cfe4d99c-9cbd-4255-8f90-f904313d46b4","source":"wordfence","cve":"CVE-2024-0979","title":"Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe4d99c-9cbd-4255-8f90-f904313d46b4?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-widgets-suite","name":"Dashboard Widgets Suite","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2024-06-12T19:49:38Z","updated":"2024-06-13T08:31:33Z"},{"id":"wordfence:cfe52386-bfdc-452f-8dd3-a12b3e39f296","source":"wordfence","cve":"CVE-2026-12739","title":"WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe52386-bfdc-452f-8dd3-a12b3e39f296?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-09-17T18:51:03Z","updated":"2026-09-18T07:40:04Z"},{"id":"wordfence:cfe548ce-5dc9-4073-b755-d28e37720808","source":"wordfence","cve":"CVE-2025-5564","title":"GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe548ce-5dc9-4073-b755-d28e37720808?source=api-prod","affected":[{"type":"plugin","slug":"gc-social-wall","name":"GC Social Wall","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:46:55Z","updated":"2025-06-26T02:06:35Z"},{"id":"wordfence:cfe5d24a-a2ed-46c1-8d9b-9bd2c63cb8b3","source":"wordfence","cve":"CVE-2024-25910","title":"MoveTo <= 6.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe5d24a-a2ed-46c1-8d9b-9bd2c63cb8b3?source=api-prod","affected":[{"type":"plugin","slug":"moveto","name":"Moveto - Movers quotation and booking management tool","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T14:54:15Z"},{"id":"wordfence:cfea0427-78dc-4151-864a-63b6761fc294","source":"wordfence","cve":"CVE-2025-8198","title":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme <= 3.9.0 - Unauthenticated Price Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfea0427-78dc-4151-864a-63b6761fc294?source=api-prod","affected":[{"type":"theme","slug":"minimog","name":"MinimogWP \u2013 The High Converting eCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-07-25T16:30:16Z","updated":"2025-07-26T05:45:53Z"},{"id":"wordfence:cfea29b2-03dd-4d48-9cbf-c80017cd2b17","source":"wordfence","cve":"CVE-2025-60149","title":"Notely <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfea29b2-03dd-4d48-9cbf-c80017cd2b17?source=api-prod","affected":[{"type":"plugin","slug":"notely","name":"Notely","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-03-17T21:27:17Z"},{"id":"wordfence:cfec1129-a017-453e-8a4e-ed31dee2bb30","source":"wordfence","cve":"CVE-2025-46255","title":"LoginWP - Pro <= 4.0.8.5 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfec1129-a017-453e-8a4e-ed31dee2bb30?source=api-prod","affected":[{"type":"plugin","slug":"loginwp-pro","name":"LoginWP - Pro","from":"*","from_inclusive":true,"to":"4.0.8.5","to_inclusive":true,"patched_in":"4.0.8.6"}],"published":"2025-07-22T00:00:00Z","updated":"2025-12-13T04:19:32Z"},{"id":"wordfence:cfec4c31-ba09-4832-a095-4ca5f5192674","source":"wordfence","cve":"CVE-2024-3058","title":"ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfec4c31-ba09-4832-a095-4ca5f5192674?source=api-prod","affected":[{"type":"plugin","slug":"enl-newsletter","name":"ENL Newsletter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-05T00:00:00Z","updated":"2024-05-01T15:14:56Z"},{"id":"wordfence:cfec9303-bdc5-4ba7-90dd-0c7559459d23","source":"wordfence","cve":"","title":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock <= 2.3.9.5 - Authenticated Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfec9303-bdc5-4ba7-90dd-0c7559459d23?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.3.9.5","to_inclusive":true,"patched_in":"2.3.9.6"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfeca343-c796-45d5-a71d-8211d8b38b3e","source":"wordfence","cve":"CVE-2024-12159","title":"Optimize Your Campaigns \u2013 Google Shopping \u2013 Google Ads \u2013 Google Adwords <= 3.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfeca343-c796-45d5-a71d-8211d8b38b3e?source=api-prod","affected":[{"type":"plugin","slug":"muzaara-adwords-optimize-dashboard","name":"Optimize Your Campaigns \u2013 Google Shopping \u2013 Google Ads \u2013 Google Adwords","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:05:34Z","updated":"2025-01-07T04:22:19Z"},{"id":"wordfence:cfecc35a-30e2-4474-b727-ec2fcbf07e0c","source":"wordfence","cve":"CVE-2025-23578","title":"Custom CSS Addons <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfecc35a-30e2-4474-b727-ec2fcbf07e0c?source=api-prod","affected":[{"type":"plugin","slug":"css-addons","name":"Custom CSS Addons","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:11:35Z"},{"id":"wordfence:cfefcc38-764d-4dd9-b098-cdcad475d634","source":"wordfence","cve":"CVE-2026-5114","title":"SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfefcc38-764d-4dd9-b098-cdcad475d634?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-07-27T21:19:42Z","updated":"2026-07-28T18:35:52Z"},{"id":"wordfence:cff04656-5930-4324-9ddf-43a2166cdf04","source":"wordfence","cve":"CVE-2023-39164","title":"Molongui <= 4.6.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff04656-5930-4324-9ddf-43a2166cdf04?source=api-prod","affected":[{"type":"plugin","slug":"molongui-authorship","name":"Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Authors for WordPress","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cff2e5be-0de0-4e62-a881-6156760b7d99","source":"wordfence","cve":"CVE-2024-4209","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff2e5be-0de0-4e62-a881-6156760b7d99?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":"3.2.37"}],"published":"2024-05-10T13:33:39Z","updated":"2024-05-11T01:56:00Z"},{"id":"wordfence:cff3bfae-bda7-4ab1-b6f5-11bd0dfd75b8","source":"wordfence","cve":"CVE-2025-22738","title":"WP ULike <= 4.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff3bfae-bda7-4ab1-b6f5-11bd0dfd75b8?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.6","to_inclusive":true,"patched_in":"4.7.7"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:46:37Z"},{"id":"wordfence:cff64b97-b3cf-41e7-aea6-004ab764e8e8","source":"wordfence","cve":"CVE-2025-31844","title":"Magical Blocks <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff64b97-b3cf-41e7-aea6-004ab764e8e8?source=api-prod","affected":[{"type":"plugin","slug":"magical-blocks","name":"Magical Blocks \u2013 Elementor Style Blocks for Gutenberg","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-04-01T00:00:00Z","updated":"2026-02-26T15:05:26Z"},{"id":"wordfence:cff6b26e-bafa-4b85-b7f1-eea9bb4b6476","source":"wordfence","cve":"CVE-2024-27952","title":"Advanced Sermons <= 3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff6b26e-bafa-4b85-b7f1-eea9bb4b6476?source=api-prod","affected":[{"type":"plugin","slug":"advanced-sermons","name":"Advanced Sermons","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:49:38Z"},{"id":"wordfence:cff74b3d-f056-4e9f-a62d-a3d79b4f4d56","source":"wordfence","cve":"","title":"Car Rental System < 3.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cff74b3d-f056-4e9f-a62d-a3d79b4f4d56?source=api-prod","affected":[{"type":"plugin","slug":"car-rental-system","name":"Car Rental System","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cffa4593-bd88-4018-b801-98d9d586111a","source":"wordfence","cve":"CVE-2024-54365","title":"KH Easy User Settings <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffa4593-bd88-4018-b801-98d9d586111a?source=api-prod","affected":[{"type":"plugin","slug":"kh-easy-user-settings","name":"KH Easy User Settings","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:36:00Z"},{"id":"wordfence:cffaa829-3eee-4390-b3c0-5c0f04ff9e8f","source":"wordfence","cve":"CVE-2021-25045","title":"Asgaros Forum <= 1.15.14 - Admin+ SQL Injection via forum_id","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffaa829-3eee-4390-b3c0-5c0f04ff9e8f?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"1.15.14","to_inclusive":true,"patched_in":"1.15.15"}],"published":"2021-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cffb26bc-3d3f-4593-bb36-d2abcd67861e","source":"wordfence","cve":"CVE-2021-4445","title":"Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb36-d2abcd67861e?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2021-08-30T00:00:00Z","updated":"2024-10-16T06:43:42Z"},{"id":"wordfence:cffb3b61-fefc-4bf8-9904-55a7143aeef1","source":"wordfence","cve":"CVE-2024-37118","title":"Uncanny Automator Pro < 5.3.0.1 - Cross-Site Request Forgery to License Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb3b61-fefc-4bf8-9904-55a7143aeef1?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator-pro","name":"Uncanny Automator Pro","from":"*","from_inclusive":true,"to":"5.3.0.1","to_inclusive":false,"patched_in":"5.3.0.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T14:59:10Z"},{"id":"wordfence:cffe745d-2fe2-4959-9641-9a0ae33bff4c","source":"wordfence","cve":"","title":"Simple Payment Donations <= 4.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffe745d-2fe2-4959-9641-9a0ae33bff4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-payment-form","name":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2022-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cffeac2c-8ca3-44f7-b54c-3c23b7a849a3","source":"wordfence","cve":"CVE-2021-39316","title":"ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cffeac2c-8ca3-44f7-b54c-3c23b7a849a3?source=api-prod","affected":[{"type":"plugin","slug":"dzs-zoomsounds","name":"ZoomSounds - WordPress Wave Audio Player with Playlist","from":"*","from_inclusive":true,"to":"6.45","to_inclusive":true,"patched_in":"6.50"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:cfffe880-e3f9-4163-a726-e248433e1034","source":"wordfence","cve":"","title":"My Calendar <= 2.3.29 - Path Traversal to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cfffe880-e3f9-4163-a726-e248433e1034?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"2.3.29","to_inclusive":true,"patched_in":"2.3.30"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0029883-79e0-4dd3-85a3-6bbf30452267","source":"wordfence","cve":"CVE-2024-35780","title":"Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0029883-79e0-4dd3-85a3-6bbf30452267?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.5.42","to_inclusive":true,"patched_in":"1.5.43"}],"published":"2024-06-19T00:00:00Z","updated":"2024-07-01T16:50:34Z"},{"id":"wordfence:d0033a19-47ac-4ffc-93a4-2ea693e93397","source":"wordfence","cve":"CVE-2021-31693","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.5.68 - Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0033a19-47ac-4ffc-93a4-2ea693e93397?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.5.68","to_inclusive":true,"patched_in":"1.5.69"}],"published":"2021-04-19T00:00:00Z","updated":"2024-03-29T18:01:39Z"},{"id":"wordfence:d0059382-3e13-434a-a3d1-7892d14a371b","source":"wordfence","cve":"CVE-2023-0170","title":"Html5 Audio Player <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0059382-3e13-434a-a3d1-7892d14a371b?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.1.12"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0064a76-3ccc-4dd6-b312-d19abb3944fa","source":"wordfence","cve":"CVE-2026-25321","title":"SupportCandy \u2013 Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0064a76-3ccc-4dd6-b312-d19abb3944fa?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2026-01-29T00:00:00Z","updated":"2026-05-04T15:39:26Z"},{"id":"wordfence:d0077130-f604-4400-aa2b-e8a1f06cd475","source":"wordfence","cve":"CVE-2025-67584","title":"GoDAM <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077130-f604-4400-aa2b-e8a1f06cd475?source=api-prod","affected":[{"type":"plugin","slug":"godam","name":"GoDAM \u2013 Video Hosting for LMS & Online Courses","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-11T16:51:23Z"},{"id":"wordfence:d0077d56-11e7-4e74-abe0-63e81db67be3","source":"wordfence","cve":"CVE-2026-78175","title":"Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077d56-11e7-4e74-abe0-63e81db67be3?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-11T18:49:43Z","updated":"2026-09-12T07:39:16Z"},{"id":"wordfence:d0091500-f606-4abc-8d6e-51020f18bb54","source":"wordfence","cve":"CVE-2026-22371","title":"Gustavo <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0091500-f606-4abc-8d6e-51020f18bb54?source=api-prod","affected":[{"type":"theme","slug":"gustavo","name":"Gustavo | Mexican Grill, Bar & Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:30:15Z"},{"id":"wordfence:d00b128a-f6ce-47e4-a5d8-4999efc9b569","source":"wordfence","cve":"CVE-2026-16534","title":"Import and export users and customers <= 2.4.1 - Authenticated (Admin+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d00b128a-f6ce-47e4-a5d8-4999efc9b569?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2026-07-23T00:00:00Z","updated":"2026-09-17T15:31:29Z"},{"id":"wordfence:d00c6fe3-5914-46e1-9a00-0641d17aa79f","source":"wordfence","cve":"CVE-2024-13121","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d00c6fe3-5914-46e1-9a00-0641d17aa79f?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.19","to_inclusive":true,"patched_in":"4.15.20"}],"published":"2025-01-23T00:00:00Z","updated":"2025-02-21T19:24:18Z"},{"id":"wordfence:d00de69c-3858-414e-a6f5-87741c049e60","source":"wordfence","cve":"CVE-2026-109691","title":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d00de69c-3858-414e-a6f5-87741c049e60?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:46:07Z"},{"id":"wordfence:d00edaf1-2a97-4000-afd9-432ca8fa3df4","source":"wordfence","cve":"CVE-2023-40334","title":"HUSKY \u2013 Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 - Missing Authorization via woof_meta_get_keys()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d00edaf1-2a97-4000-afd9-432ca8fa3df4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.4.2","to_inclusive":true,"patched_in":"1.3.4.3"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d01038f6-57c3-4368-810f-0f3ef9a5933a","source":"wordfence","cve":"CVE-2026-14230","title":"ECS <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01038f6-57c3-4368-810f-0f3ef9a5933a?source=api-prod","affected":[{"type":"plugin","slug":"ele-custom-skin","name":"ECS \u2013 Ele Custom Skin for Elementor","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T22:28:26Z"},{"id":"wordfence:d01113d2-a619-412b-bb09-d69df4da3202","source":"wordfence","cve":"CVE-2026-22362","title":"Photolia <= 1.0.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01113d2-a619-412b-bb09-d69df4da3202?source=api-prod","affected":[{"type":"theme","slug":"photolia","name":"Photolia | Photo Company & Supply Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:32:18Z"},{"id":"wordfence:d0117436-7a2a-42f3-8c05-75dfddfb9d09","source":"wordfence","cve":"CVE-2024-2785","title":"The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0117436-7a2a-42f3-8c05-75dfddfb9d09?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T20:03:40Z"},{"id":"wordfence:d014f512-9030-49ce-945d-4900594fb373","source":"wordfence","cve":"CVE-2023-4602","title":"Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d014f512-9030-49ce-945d-4900594fb373?source=api-prod","affected":[{"type":"plugin","slug":"namaste-lms","name":"Namaste! LMS","from":"*","from_inclusive":true,"to":"2.6.1.1","to_inclusive":true,"patched_in":"2.6.1.2"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d015e6ce-641c-4d68-b42b-03c039e973bd","source":"wordfence","cve":"CVE-2024-11786","title":"Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d015e6ce-641c-4d68-b42b-03c039e973bd?source=api-prod","affected":[{"type":"plugin","slug":"login-with-vipps","name":"Login with Vipps and MobilePay","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:21Z"},{"id":"wordfence:d0177510-cd7d-4cc5-96c3-78433aa0e3f6","source":"wordfence","cve":"CVE-2024-6467","title":"BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation","severity":"high","cvss":8.8,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0177510-cd7d-4cc5-96c3-78433aa0e3f6?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-07-16T00:00:00Z","updated":"2024-07-19T15:24:20Z"},{"id":"wordfence:d0189895-91d6-48ea-86cb-9a2db9de3d9a","source":"wordfence","cve":"CVE-2025-60130","title":"WEDOS Global <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0189895-91d6-48ea-86cb-9a2db9de3d9a?source=api-prod","affected":[{"type":"plugin","slug":"wgpwpp","name":"WEDOS | Protection & Cache Performance","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-04-15T13:31:06Z"},{"id":"wordfence:d01a7887-afd7-418b-99ad-92157582a506","source":"wordfence","cve":"CVE-2025-13963","title":"FX Currency Converter <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01a7887-afd7-418b-99ad-92157582a506?source=api-prod","affected":[{"type":"plugin","slug":"fx-currency-converter","name":"FX Currency Converter","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":"0.2.1"}],"published":"2025-12-11T15:00:45Z","updated":"2025-12-12T03:20:57Z"},{"id":"wordfence:d01a8636-3796-4fb3-b603-d1ef42bc3e72","source":"wordfence","cve":"CVE-2026-57771","title":"GD Rating System <= 3.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01a8636-3796-4fb3-b603-d1ef42bc3e72?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-16T18:36:54Z"},{"id":"wordfence:d01b6056-a38d-4a60-9cdc-68663aa2aed6","source":"wordfence","cve":"CVE-2024-8363","title":"Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01b6056-a38d-4a60-9cdc-68663aa2aed6?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.02","to_inclusive":true,"patched_in":"2.03"}],"published":"2024-09-04T20:25:55Z","updated":"2024-09-05T08:30:11Z"},{"id":"wordfence:d01cb5f9-b52c-4098-8697-426b13e9235f","source":"wordfence","cve":"CVE-2026-62069","title":"Fabius - One Page Resume WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01cb5f9-b52c-4098-8697-426b13e9235f?source=api-prod","affected":[{"type":"theme","slug":"fabius-wp","name":"Fabius - One Page Resume WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T19:40:13Z"},{"id":"wordfence:d01f4e67-a463-4973-97b1-41a64398686a","source":"wordfence","cve":"CVE-2025-15525","title":"Ajax Load More \u2013 Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d01f4e67-a463-4973-97b1-41a64398686a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-01-30T16:20:53Z","updated":"2026-01-31T04:35:15Z"},{"id":"wordfence:d0206a57-4f1e-4cd2-a854-d435d769f391","source":"wordfence","cve":"CVE-2025-23550","title":"Product Puller <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0206a57-4f1e-4cd2-a854-d435d769f391?source=api-prod","affected":[{"type":"plugin","slug":"product-puller","name":"Product Puller","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:02:43Z"},{"id":"wordfence:d0215e53-0394-4845-93e4-463cd5642fb3","source":"wordfence","cve":"","title":"Modal Survey < 2.0.1.8.2 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0215e53-0394-4845-93e4-463cd5642fb3?source=api-prod","affected":[{"type":"plugin","slug":"modal_survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.1.8.2","to_inclusive":false,"patched_in":"2.0.1.8.2"}],"published":"2021-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d021636e-2d23-4fb3-baf7-0f40d4ade3db","source":"wordfence","cve":"CVE-2020-8426","title":"Elementor Website Builder <= 2.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d021636e-2d23-4fb3-baf7-0f40d4ade3db?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2020-01-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0237d64-40db-4e4e-be61-893217135ef7","source":"wordfence","cve":"CVE-2022-44586","title":"AM-HiLi <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0237d64-40db-4e4e-be61-893217135ef7?source=api-prod","affected":[{"type":"plugin","slug":"am-hili-affiliate-manager-for-publishers","name":"AM-HiLi","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0240b35-72d0-4943-84cd-5d1574609b36","source":"wordfence","cve":"CVE-2022-47597","title":"Popup Maker <= 1.17.1 - Sensitive Data Exposure via debug log file","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0240b35-72d0-4943-84cd-5d1574609b36?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.18.0"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d024347c-5347-452d-9229-2993ba34d767","source":"wordfence","cve":"CVE-2026-66571","title":"Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d024347c-5347-452d-9229-2993ba34d767?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.4.0.5","to_inclusive":true,"patched_in":"1.4.0.6"}],"published":"2026-09-17T12:06:00Z","updated":"2026-09-22T18:44:47Z"},{"id":"wordfence:d024682b-8bf9-49e1-9891-5e8f77ab5792","source":"wordfence","cve":"CVE-2026-18202","title":"JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d024682b-8bf9-49e1-9891-5e8f77ab5792?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14","to_inclusive":false,"patched_in":"3.8.14"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:14:43Z"},{"id":"wordfence:d02bc6c9-dca7-45cb-acc7-db0d269c16a3","source":"wordfence","cve":"CVE-2025-47647","title":"Sidebar Manager Light <= 1.18 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d02bc6c9-dca7-45cb-acc7-db0d269c16a3?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-manager-light","name":"Sidebar Manager Light","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:41:07Z"},{"id":"wordfence:d02fc744-35e5-44eb-8790-66997e95d017","source":"wordfence","cve":"CVE-2016-10895","title":"Option Tree <= 2.5.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d02fc744-35e5-44eb-8790-66997e95d017?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2019-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d03008ae-ccb5-43b2-834a-71c71c43c678","source":"wordfence","cve":"CVE-2024-34803","title":"Fastly <= 1.2.25 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d03008ae-ccb5-43b2-834a-71c71c43c678?source=api-prod","affected":[{"type":"plugin","slug":"fastly","name":"Fastly","from":"*","from_inclusive":true,"to":"1.2.25","to_inclusive":true,"patched_in":"1.2.26"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T21:21:00Z"},{"id":"wordfence:d0301141-bbc6-4a9e-b816-888554600b57","source":"wordfence","cve":"","title":"iubenda <= 3.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0301141-bbc6-4a9e-b816-888554600b57?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0318ed9-a464-498b-a821-f7746740937c","source":"wordfence","cve":"CVE-2009-2851","title":"WordPress Core <= 2.8.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0318ed9-a464-498b-a821-f7746740937c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2009-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d03459d8-b1f2-4270-a294-403754db1f2f","source":"wordfence","cve":"CVE-2024-2417","title":"User Registration \u2013 Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-04-19T00:00:00Z","updated":"2024-05-02T16:52:41Z"},{"id":"wordfence:d034c3cb-8089-47d6-839b-659bedab5ca1","source":"wordfence","cve":"CVE-2022-40191","title":"Contact Form By Mega Forms <= 1.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d034c3cb-8089-47d6-839b-659bedab5ca1?source=api-prod","affected":[{"type":"plugin","slug":"mega-forms","name":"Mega Forms \u2013 Drag & Drop Form Builder with Multi-Step & Conditional Logic","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2022-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d038f1a2-4755-417f-965d-508b57c05738","source":"wordfence","cve":"CVE-2024-10079","title":"WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d038f1a2-4755-417f-965d-508b57c05738?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-types","name":"WP Easy Post Types","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-18T07:35:26Z"},{"id":"wordfence:d0392da9-4fea-4ee1-8ffe-20541027b27e","source":"wordfence","cve":"CVE-2025-69037","title":"Pippo <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0392da9-4fea-4ee1-8ffe-20541027b27e?source=api-prod","affected":[{"type":"theme","slug":"pippo","name":"Pippo - Kids Toys Store WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:49:53Z"},{"id":"wordfence:d039ba8f-0452-4c14-a655-7f6880c1f1b4","source":"wordfence","cve":"CVE-2024-25916","title":"My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d039ba8f-0452-4c14-a655-7f6880c1f1b4?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.4.23","to_inclusive":true,"patched_in":"3.4.24"}],"published":"2024-02-11T00:00:00Z","updated":"2024-02-20T16:06:04Z"},{"id":"wordfence:d03b4dcd-297d-4361-9cc4-6ccf3d4f0e85","source":"wordfence","cve":"CVE-2009-4424","title":"Pyrmont V2 <= 2.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d03b4dcd-297d-4361-9cc4-6ccf3d4f0e85?source=api-prod","affected":[{"type":"theme","slug":"pyrmont-v2","name":"Pyrmont V2","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2009-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d03beb32-503c-4657-80d8-27800b2cb233","source":"wordfence","cve":"CVE-2024-51807","title":"AgendaPress \u2013 Easily Publish Meeting Agendas and Programs on WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d03beb32-503c-4657-80d8-27800b2cb233?source=api-prod","affected":[{"type":"plugin","slug":"agendapress","name":"AgendaPress \u2013 Easily Publish Meeting Agendas and Programs on WordPress","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:35:42Z"},{"id":"wordfence:d03dbe48-371f-4fb7-8902-a013338ac7d4","source":"wordfence","cve":"CVE-2024-11894","title":"The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d03dbe48-371f-4fb7-8902-a013338ac7d4?source=api-prod","affected":[{"type":"plugin","slug":"the-permalinker","name":"The Permalinker","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-12-13T15:58:35Z","updated":"2024-12-16T10:06:09Z"},{"id":"wordfence:d042649e-abdc-4c9d-a94a-f0cea31f4e91","source":"wordfence","cve":"CVE-2025-69130","title":"Entrepreneur - Booking for Small Businesses WordPress <= 3.1.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d042649e-abdc-4c9d-a94a-f0cea31f4e91?source=api-prod","affected":[{"type":"theme","slug":"entrepreneurx","name":"Entrepreneur - Booking for Small Businesses WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:18:32Z"},{"id":"wordfence:d0467548-f1eb-4ea2-9913-4b7ffeb6e91a","source":"wordfence","cve":"CVE-2024-4669","title":"Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0467548-f1eb-4ea2-9913-4b7ffeb6e91a?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2024-06-11T08:17:21Z","updated":"2024-06-11T20:33:01Z"},{"id":"wordfence:d04bae24-f513-4106-873e-9997d656b71a","source":"wordfence","cve":"CVE-2026-24530","title":"WebP Conversion <= 2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d04bae24-f513-4106-873e-9997d656b71a?source=api-prod","affected":[{"type":"plugin","slug":"webp-conversion","name":"WebP Conversion","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T16:24:40Z"},{"id":"wordfence:d04d6034-4f90-48e4-81f2-26220001fe32","source":"wordfence","cve":"CVE-2026-12586","title":"Lenxel WP <= 1.0.31 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d04d6034-4f90-48e4-81f2-26220001fe32?source=api-prod","affected":[{"type":"theme","slug":"lenxel-wp","name":"Lenxel WP","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:30:02Z"},{"id":"wordfence:d04e87f3-351c-4352-a6f1-69c652baa992","source":"wordfence","cve":"CVE-2026-25398","title":"Vertex Addons for Elementor <= 1.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d04e87f3-351c-4352-a6f1-69c652baa992?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor-builder","name":"Vertex Addons for Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:08:58Z"},{"id":"wordfence:d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3","source":"wordfence","cve":"CVE-2019-25214","title":"ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3?source=api-prod","affected":[{"type":"plugin","slug":"wpshopify","name":"ShopWP","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2019-10-07T00:00:00Z","updated":"2024-10-16T06:43:43Z"},{"id":"wordfence:d0506137-82e3-4988-9b23-370465a866c0","source":"wordfence","cve":"CVE-2024-9215","title":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0506137-82e3-4988-9b23-370465a866c0?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T02:06:04Z"},{"id":"wordfence:d050b5a4-efd1-45d5-a3f7-13fa9e19ab37","source":"wordfence","cve":"CVE-2024-4091","title":"Responsive Gallery Grid <= 2.3.14 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d050b5a4-efd1-45d5-a3f7-13fa9e19ab37?source=api-prod","affected":[{"type":"plugin","slug":"responsive-gallery-grid","name":"Responsive Gallery Grid","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2024-10-30T00:00:00Z","updated":"2025-05-29T22:10:34Z"},{"id":"wordfence:d0538778-5ba4-4bec-a89d-ef90a9ba8375","source":"wordfence","cve":"CVE-2026-14956","title":"Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0538778-5ba4-4bec-a89d-ef90a9ba8375?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"3.1.8.6","to_inclusive":true,"patched_in":"3.1.8.7"}],"published":"2026-07-16T13:00:33Z","updated":"2026-07-17T01:30:55Z"},{"id":"wordfence:d0567dc8-7a4c-42f4-bf45-f31a8efaa354","source":"wordfence","cve":"CVE-2021-4374","title":"WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0567dc8-7a4c-42f4-bf45-f31a8efaa354?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"3.53.3","to_inclusive":false,"patched_in":"3.53.3"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0567f1a-da21-49d5-9117-193bc3337761","source":"wordfence","cve":"CVE-2025-64206","title":"Jannah <= 7.6.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0567f1a-da21-49d5-9117-193bc3337761?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-20T19:03:08Z"},{"id":"wordfence:d056ad60-0102-490e-89a8-31fe6513645e","source":"wordfence","cve":"CVE-2022-2407","title":"WP phpMyAdmin <= 5.2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d056ad60-0102-490e-89a8-31fe6513645e?source=api-prod","affected":[{"type":"plugin","slug":"wp-phpmyadmin-extension","name":"WP phpMyAdmin","from":"*","from_inclusive":true,"to":"5.2.0.3","to_inclusive":true,"patched_in":"5.2.0.4"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d056eeea-6ed2-4139-ba32-727a95f29aaf","source":"wordfence","cve":"","title":"Polylang <= 2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d056eeea-6ed2-4139-ba32-727a95f29aaf?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2019-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0586453-76ec-4ec9-9965-780af7cb31ec","source":"wordfence","cve":"","title":"Async Javascript <= 2.20.12.09 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0586453-76ec-4ec9-9965-780af7cb31ec?source=api-prod","affected":[{"type":"plugin","slug":"async-javascript","name":"Async JavaScript","from":"*","from_inclusive":true,"to":"2.20.12.09","to_inclusive":true,"patched_in":"2.21.06.29"}],"published":"2021-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d058b578-3bf1-4bd4-a13b-8b55d4800fd9","source":"wordfence","cve":"CVE-2025-28957","title":"OwnerRez <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d058b578-3bf1-4bd4-a13b-8b55d4800fd9?source=api-prod","affected":[{"type":"plugin","slug":"ownerrez","name":"OwnerRez","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-21T20:36:23Z"},{"id":"wordfence:d0598341-0088-42bf-9a34-794c941a848d","source":"wordfence","cve":"CVE-2024-8043","title":"Vikinghammer Tweet <= 0.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0598341-0088-42bf-9a34-794c941a848d?source=api-prod","affected":[{"type":"plugin","slug":"vikinghammer-tweet","name":"Vikinghammer Tweet","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T21:52:08Z"},{"id":"wordfence:d05c58df-8b13-413e-babb-dee87ac17b4e","source":"wordfence","cve":"CVE-2026-118186","title":"PublishPress Revisions 3.6.0 - 4.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d05c58df-8b13-413e-babb-dee87ac17b4e?source=api-prod","affected":[{"type":"plugin","slug":"revisionary","name":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","from":"3.6.0","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:21:05Z"},{"id":"wordfence:d05de50e-1d3b-4e41-bfec-079b5cd82784","source":"wordfence","cve":"CVE-2024-51632","title":"SH Slideshow <= 4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d05de50e-1d3b-4e41-bfec-079b5cd82784?source=api-prod","affected":[{"type":"plugin","slug":"sh-slideshow","name":"SH Slideshow","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:19:58Z"},{"id":"wordfence:d05f7b77-382b-422a-8096-f47291f4dc45","source":"wordfence","cve":"CVE-2022-0594","title":"Professional Social Sharing Buttons, Icons & Related Posts \u2013 Shareaholic <= 9.7.5 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d05f7b77-382b-422a-8096-f47291f4dc45?source=api-prod","affected":[{"type":"plugin","slug":"shareaholic","name":"Professional Social Sharing Buttons, Icons & Related Posts \u2013 Shareaholic","from":"*","from_inclusive":true,"to":"9.7.5","to_inclusive":true,"patched_in":"9.7.6"}],"published":"2022-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d062bc7b-0cb0-46bd-b203-90cc9a44a403","source":"wordfence","cve":"CVE-2023-49771","title":"Smart External Link Click Monitor [Link Log] <= 5.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d062bc7b-0cb0-46bd-b203-90cc9a44a403?source=api-prod","affected":[{"type":"plugin","slug":"link-log","name":"Smart External Link Click Monitor [Link Log]","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d062fb5d-87ae-4a23-a8f7-d8e2c169db7e","source":"wordfence","cve":"CVE-2025-58808","title":"prettyPhoto <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d062fb5d-87ae-4a23-a8f7-d8e2c169db7e?source=api-prod","affected":[{"type":"plugin","slug":"prettyphoto","name":"PrettyPhoto \u2013 Simple Lightbox Plugin","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:38:56Z"},{"id":"wordfence:d0631ac6-2d85-4073-be2c-05480deecf97","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetranslation function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0631ac6-2d85-4073-be2c-05480deecf97?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0631ec9-fb72-4573-a41b-9b6b01aeaae9","source":"wordfence","cve":"CVE-2023-36685","title":"CartFlows Pro <= 1.11.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0631ec9-fb72-4573-a41b-9b6b01aeaae9?source=api-prod","affected":[{"type":"plugin","slug":"cartflows-pro","name":"CartFlows Pro","from":"*","from_inclusive":true,"to":"1.11.12","to_inclusive":true,"patched_in":"1.11.13"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d06761dc-8f06-44ce-b2c6-4f9a0682472d","source":"wordfence","cve":"CVE-2026-28185","title":"Log in with Google <= 1.4.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d06761dc-8f06-44ce-b2c6-4f9a0682472d?source=api-prod","affected":[{"type":"plugin","slug":"login-with-google","name":"Log in with Google","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:23:25Z"},{"id":"wordfence:d0693b76-dd6a-4ebc-8384-b7dadb606849","source":"wordfence","cve":"CVE-2026-32406","title":"WPC Product Bundles for WooCommerce <= 8.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0693b76-dd6a-4ebc-8384-b7dadb606849?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-bundle","name":"WPC Product Bundles for WooCommerce","from":"*","from_inclusive":true,"to":"8.4.5","to_inclusive":true,"patched_in":"8.4.6"}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T20:58:52Z"},{"id":"wordfence:d06a8ec6-19c0-4c76-8954-2395429bd38b","source":"wordfence","cve":"CVE-2025-26546","title":"Cookies Pro <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d06a8ec6-19c0-4c76-8954-2395429bd38b?source=api-prod","affected":[{"type":"plugin","slug":"cookies-pro","name":"Cookies Pro","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T00:00:00Z","updated":"2025-03-25T18:01:49Z"},{"id":"wordfence:d06e9c13-a365-4dd7-a923-62ee2e2e2ffb","source":"wordfence","cve":"CVE-2025-64288","title":"Premmerce <= 1.3.19 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d06e9c13-a365-4dd7-a923-62ee2e2e2ffb?source=api-prod","affected":[{"type":"plugin","slug":"premmerce","name":"Premmerce","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2025-05-10T00:00:00Z","updated":"2026-01-06T18:39:30Z"},{"id":"wordfence:d06f265c-c1c1-4316-9526-3392f6ee31da","source":"wordfence","cve":"CVE-2023-4307","title":"Lock User Account <= 1.0.3 - Cross-Site Request Forgery to Account Lock/Unlock","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d06f265c-c1c1-4316-9526-3392f6ee31da?source=api-prod","affected":[{"type":"plugin","slug":"lock-user-account","name":"Lock User Account","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d070e12e-ec53-4574-ac37-dc8805d9a553","source":"wordfence","cve":"CVE-2023-4776","title":"WPSchoolPress <= 2.2.4 - Authenticated(Teacher+) SQL Injection via ClassID","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d070e12e-ec53-4574-ac37-dc8805d9a553?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d070f07a-c4e4-48ea-942d-7bb0bb834a52","source":"wordfence","cve":"CVE-2024-43155","title":"ComboBlocks <= 2.2.86 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d070f07a-c4e4-48ea-942d-7bb0bb834a52?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.86","to_inclusive":true,"patched_in":"2.2.87"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:18:59Z"},{"id":"wordfence:d073d9df-0636-4884-b5d0-e2da779e5edf","source":"wordfence","cve":"CVE-2024-10692","title":"PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d073d9df-0636-4884-b5d0-e2da779e5edf?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:25:00Z"},{"id":"wordfence:d077f0d4-24f6-454b-a05a-9df86a87a89c","source":"wordfence","cve":"CVE-2025-31874","title":"WebberZone Snippetz <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d077f0d4-24f6-454b-a05a-9df86a87a89c?source=api-prod","affected":[{"type":"plugin","slug":"add-to-all","name":"WebberZone Snippetz \u2013 Header, Body and Footer manager","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-04-01T00:00:00Z","updated":"2025-06-12T18:25:27Z"},{"id":"wordfence:d07a08ad-c9b7-44fe-a199-fa8bb7f3eea2","source":"wordfence","cve":"CVE-2026-2982","title":"WP Table Builder \u2013 Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07a08ad-c9b7-44fe-a199-fa8bb7f3eea2?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-11-11T22:23:53Z","updated":"2026-11-12T11:32:16Z"},{"id":"wordfence:d07b5377-ce5f-4faa-ac72-78f5175913c3","source":"wordfence","cve":"","title":"Magazine Basic (Unknown Versions) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07b5377-ce5f-4faa-ac72-78f5175913c3?source=api-prod","affected":[{"type":"theme","slug":"magazine-basic","name":"Magazine Basic","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d07c43e0-783a-499b-b172-d058583d0749","source":"wordfence","cve":"CVE-2025-1663","title":"Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07c43e0-783a-499b-b172-d058583d0749?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.142","to_inclusive":true,"patched_in":"1.5.143"}],"published":"2025-04-02T19:12:50Z","updated":"2025-04-03T07:21:24Z"},{"id":"wordfence:d07d8c3a-5e97-422a-ba20-e0bc206dda59","source":"wordfence","cve":"CVE-2023-25470","title":"Rus-To-Lat <= 0.3 - Cross-Site Request Forgery to Plugins Options Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07d8c3a-5e97-422a-ba20-e0bc206dda59?source=api-prod","affected":[{"type":"plugin","slug":"rustolat","name":"Rus-To-Lat","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d07fe28c-f76e-42b2-b894-be316004235a","source":"wordfence","cve":"CVE-2026-19985","title":"Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07fe28c-f76e-42b2-b894-be316004235a?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.28.1","to_inclusive":true,"patched_in":"4.28.2"}],"published":"2026-09-10T14:41:38Z","updated":"2026-09-11T03:39:38Z"},{"id":"wordfence:d080845b-6814-4b10-a3ab-1f5aa1d09132","source":"wordfence","cve":"CVE-2026-104732","title":"Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d080845b-6814-4b10-a3ab-1f5aa1d09132?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ip-blocker","name":"Advanced IP Blocker","from":"*","from_inclusive":true,"to":"8.13.13","to_inclusive":true,"patched_in":"8.13.14"}],"published":"2026-10-09T15:13:42Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:d08282a5-8e16-4f54-9243-68f0af514c12","source":"wordfence","cve":"CVE-2026-22489","title":"Image Slider Slideshow <= 1.8 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d08282a5-8e16-4f54-9243-68f0af514c12?source=api-prod","affected":[{"type":"plugin","slug":"image-slider-slideshow","name":"Image Slider Slideshow","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:12:28Z"},{"id":"wordfence:d082c6e6-a18a-44e2-9478-7189f9777198","source":"wordfence","cve":"CVE-2026-9594","title":"WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d082c6e6-a18a-44e2-9478-7189f9777198?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-06-05T15:28:12Z","updated":"2026-06-06T03:28:25Z"},{"id":"wordfence:d083cf7c-f116-40aa-bffb-91e43ba52490","source":"wordfence","cve":"CVE-2025-26768","title":"what3words Address Field <= 4.0.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d083cf7c-f116-40aa-bffb-91e43ba52490?source=api-prod","affected":[{"type":"plugin","slug":"3-word-address-validation-field","name":"what3words Address Field","from":"*","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"4.0.16"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T20:59:06Z"},{"id":"wordfence:d0847652-28c1-4d4c-89de-936eba1a4d3e","source":"wordfence","cve":"CVE-2026-39730","title":"Wise Chat <= 3.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0847652-28c1-4d4c-89de-936eba1a4d3e?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2026-10-05T12:26:18Z","updated":"2026-10-13T17:01:47Z"},{"id":"wordfence:d0864b6e-e193-4704-99ec-a5f2232c4816","source":"wordfence","cve":"CVE-2024-9115","title":"Common Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0864b6e-e193-4704-99ec-a5f2232c4816?source=api-prod","affected":[{"type":"plugin","slug":"common-tools-for-site","name":"Common Tools for Site","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T21:23:14Z","updated":"2024-09-26T09:29:42Z"},{"id":"wordfence:d087957c-0dd5-46a9-a6bc-85f2f79f43bd","source":"wordfence","cve":"CVE-2024-1416","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d087957c-0dd5-46a9-a6bc-85f2f79f43bd?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-31T15:56:13Z"},{"id":"wordfence:d089bfee-3d23-4d35-83e0-7575702a21b4","source":"wordfence","cve":"","title":"Better Customer List for WooCommerce <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d089bfee-3d23-4d35-83e0-7575702a21b4?source=api-prod","affected":[{"type":"plugin","slug":"woo-better-customer-list","name":"Better Customer List for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:41:15Z"},{"id":"wordfence:d08db182-bfbf-42bd-8070-cbd80b3b5759","source":"wordfence","cve":"CVE-2025-22559","title":"TubePress.NET <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d08db182-bfbf-42bd-8070-cbd80b3b5759?source=api-prod","affected":[{"type":"plugin","slug":"tubepressnet","name":"TubePress.NET","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:26:22Z"},{"id":"wordfence:d0913632-85c5-4835-b606-4eca51df2496","source":"wordfence","cve":"CVE-2024-1541","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0913632-85c5-4835-b606-4eca51df2496?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.23","to_inclusive":true,"patched_in":"3.2.24"}],"published":"2024-03-01T00:00:00Z","updated":"2024-05-31T15:30:56Z"},{"id":"wordfence:d0966138-b28b-4c03-a2cf-b51c5f478276","source":"wordfence","cve":"CVE-2024-13787","title":"VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0966138-b28b-4c03-a2cf-b51c5f478276?source=api-prod","affected":[{"type":"theme","slug":"veda","name":"VEDA - MultiPurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:49Z"},{"id":"wordfence:d0969d4a-c1cd-4b60-b298-e97f694887e9","source":"wordfence","cve":"CVE-2025-48111","title":"YITH PayPal Express Checkout for WooCommerce <= 1.49.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0969d4a-c1cd-4b60-b298-e97f694887e9?source=api-prod","affected":[{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.49.0","to_inclusive":true,"patched_in":"1.49.1"}],"published":"2025-06-16T00:00:00Z","updated":"2025-06-25T14:44:24Z"},{"id":"wordfence:d097d918-04dc-4291-bb82-3f5cc8eea158","source":"wordfence","cve":"","title":"WP DS FAQ Plus < 1.4.2 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d097d918-04dc-4291-bb82-3f5cc8eea158?source=api-prod","affected":[{"type":"plugin","slug":"wp-ds-faq-plus","name":"DS FAQ Plus","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2020-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d09985e9-ee18-41a0-94d0-05dd80a68ed9","source":"wordfence","cve":"CVE-2025-67944","title":"Nelio AB Testing <= 8.1.8 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09985e9-ee18-41a0-94d0-05dd80a68ed9?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"8.1.8","to_inclusive":true,"patched_in":"8.2.0"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:48:07Z"},{"id":"wordfence:d0999244-4097-4e8c-8f7e-4accd7727d69","source":"wordfence","cve":"","title":"Dropshix < 4.0.14 - Authorization Bypass","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0999244-4097-4e8c-8f7e-4accd7727d69?source=api-prod","affected":[{"type":"plugin","slug":"dropshipping-xox","name":"Dropshix","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":false,"patched_in":"4.0.14"}],"published":"2019-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d09a0b62-6556-4be5-a6f2-0cb0edcced3b","source":"wordfence","cve":"","title":"GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09a0b62-6556-4be5-a6f2-0cb0edcced3b?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.25.2","to_inclusive":true,"patched_in":"2.25.3"}],"published":"2023-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d09a53cc-1773-467d-a9c7-72f343ed02a4","source":"wordfence","cve":"CVE-2025-8608","title":"Mihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09a53cc-1773-467d-a9c7-72f343ed02a4?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-elementor-yandex-maps","name":"Maps from Yandex for Elementor","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-09-29T15:32:06Z","updated":"2025-10-14T17:15:37Z"},{"id":"wordfence:d09ab1c2-4c89-432d-955a-8bcdd4487056","source":"wordfence","cve":"CVE-2025-69114","title":"MaxiNet - Internet & IPTV Provider Elementor Template Kit <= 1.2.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09ab1c2-4c89-432d-955a-8bcdd4487056?source=api-prod","affected":[{"type":"theme","slug":"maxinet","name":"MaxiNet - Internet & IPTV Provider Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:17:40Z"},{"id":"wordfence:d09b638f-4c30-41cc-84fd-ae0816e2c29e","source":"wordfence","cve":"CVE-2025-23731","title":"Tax Report for WooCommerce <= 2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09b638f-4c30-41cc-84fd-ae0816e2c29e?source=api-prod","affected":[{"type":"plugin","slug":"tax-report-for-woocommerce","name":"Tax Report for WooCommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:30:27Z"},{"id":"wordfence:d09d8ac7-67f4-490b-8d09-6811f132fede","source":"wordfence","cve":"CVE-2024-31352","title":"Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09d8ac7-67f4-490b-8d09-6811f132fede?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.13","to_inclusive":true,"patched_in":"5.7.14"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T13:44:31Z"},{"id":"wordfence:d09ea234-f04e-4337-851e-b42bbf6f8901","source":"wordfence","cve":"CVE-2025-30928","title":"WP Biographia <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d09ea234-f04e-4337-851e-b42bbf6f8901?source=api-prod","affected":[{"type":"plugin","slug":"wp-biographia","name":"WP Biographia","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T21:08:37Z"},{"id":"wordfence:d0a311b7-5582-4581-bf4e-636d8a936ac6","source":"wordfence","cve":"","title":"WooCommerce Blocks <= 3.7.0 - Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a311b7-5582-4581-bf4e-636d8a936ac6?source=api-prod","affected":[{"type":"plugin","slug":"woo-gutenberg-products-block","name":"WooCommerce Blocks","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":false,"patched_in":"3.7.1"}],"published":"2020-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0a38293-3730-44ae-90de-bc94a9e850b1","source":"wordfence","cve":"CVE-2025-27322","title":"QR Code for WooCommerce <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a38293-3730-44ae-90de-bc94a9e850b1?source=api-prod","affected":[{"type":"plugin","slug":"wc-qr-codes","name":"QR Code for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:40:24Z"},{"id":"wordfence:d0a55af3-108a-4a7b-ac9e-ef7c9e3a3acd","source":"wordfence","cve":"CVE-2025-32594","title":"Simple WP Events <= 1.8.17 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a55af3-108a-4a7b-ac9e-ef7c9e3a3acd?source=api-prod","affected":[{"type":"plugin","slug":"simple-wp-events","name":"Simple WP Events","from":"*","from_inclusive":true,"to":"1.8.17","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-23T14:26:42Z"},{"id":"wordfence:d0a60f4c-dc80-4ab6-8ce5-38eb9940c696","source":"wordfence","cve":"CVE-2026-57342","title":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization <= 3.11.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a60f4c-dc80-4ab6-8ce5-38eb9940c696?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"3.11.4"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T20:09:16Z"},{"id":"wordfence:d0a818b6-5e25-4c96-8757-b8593c713923","source":"wordfence","cve":"CVE-2026-39571","title":"Instantio <= 3.3.30 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a818b6-5e25-4c96-8757-b8593c713923?source=api-prod","affected":[{"type":"plugin","slug":"instantio","name":"Instantio \u2014 Side Cart & One-Page Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.30","to_inclusive":true,"patched_in":"3.3.31"}],"published":"2026-03-25T00:00:00Z","updated":"2026-05-05T15:27:28Z"},{"id":"wordfence:d0a81d60-d489-4786-aa21-805a1e2aa198","source":"wordfence","cve":"","title":"Ad Inserter Pro <= 2.7.15 - Arbitrary File Modification","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a81d60-d489-4786-aa21-805a1e2aa198?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter-pro","name":"Ad Inserter Pro","from":"*","from_inclusive":true,"to":"2.7.15","to_inclusive":true,"patched_in":"2.7.16"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0a88427-a8ab-4209-958e-3664ab3cc2e9","source":"wordfence","cve":"CVE-2026-18473","title":"Directory Kit <= 1.5.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a88427-a8ab-4209-958e-3664ab3cc2e9?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:56:26Z"},{"id":"wordfence:d0a8c924-04f7-47e7-ba84-f090abc7279a","source":"wordfence","cve":"CVE-2025-68882","title":"Scalenut <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0a8c924-04f7-47e7-ba84-f090abc7279a?source=api-prod","affected":[{"type":"plugin","slug":"scalenut","name":"Scalenut","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:17:42Z"},{"id":"wordfence:d0aa1fad-1ff4-4bc5-a584-99b528470990","source":"wordfence","cve":"CVE-2023-52184","title":"WP Job Portal <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0aa1fad-1ff4-4bc5-a584-99b528470990?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0aabaa4-0bcf-4163-85f2-51b5fc3ae3f9","source":"wordfence","cve":"CVE-2026-62142","title":"WP 2FA \u2013 Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0aabaa4-0bcf-4163-85f2-51b5fc3ae3f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:31:27Z"},{"id":"wordfence:d0abc8f9-7b6f-443d-a17f-8da034359c52","source":"wordfence","cve":"CVE-2025-64353","title":"Polylang <= 3.7.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0abc8f9-7b6f-443d-a17f-8da034359c52?source=api-prod","affected":[{"type":"plugin","slug":"polylang","name":"Polylang","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2025-10-28T00:00:00Z","updated":"2025-11-04T14:39:59Z"},{"id":"wordfence:d0ace3b6-7941-43c6-b636-8f7b9d51da3e","source":"wordfence","cve":"","title":"Level Four Store Front < 8.1.15 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ace3b6-7941-43c6-b636-8f7b9d51da3e?source=api-prod","affected":[{"type":"plugin","slug":"levelfourstorefront","name":"Level Four Store Front","from":"*","from_inclusive":true,"to":"8.1.15","to_inclusive":false,"patched_in":"8.1.15"}],"published":"2013-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0ad02d9-546f-4bcb-b567-785e3acfb489","source":"wordfence","cve":"CVE-2024-11617","title":"Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ad02d9-546f-4bcb-b567-785e3acfb489?source=api-prod","affected":[{"type":"plugin","slug":"envolve-plugin","name":"Envolve Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T06:42:37Z"},{"id":"wordfence:d0af6050-8602-4ed3-b017-c10aa023849b","source":"wordfence","cve":"CVE-2025-3437","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0af6050-8602-4ed3-b017-c10aa023849b?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.66","to_inclusive":true,"patched_in":"1.4.67"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T09:21:21Z"},{"id":"wordfence:d0b1fa88-2fc6-41af-bd39-12af92dc6533","source":"wordfence","cve":"CVE-2023-5433","title":"Message ticker <= 9.2 -  Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b1fa88-2fc6-41af-bd39-12af92dc6533?source=api-prod","affected":[{"type":"plugin","slug":"message-ticker","name":"Message ticker","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0b27bc8-617a-4f98-954f-e49f87dca311","source":"wordfence","cve":"CVE-2024-13786","title":"Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b27bc8-617a-4f98-954f-e49f87dca311?source=api-prod","affected":[{"type":"theme","slug":"education","name":"Education Center | LMS & Online Courses WordPress Theme","from":"*","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.6.11"}],"published":"2025-03-01T00:00:00Z","updated":"2025-07-02T06:40:23Z"},{"id":"wordfence:d0b369b4-b107-4207-8d5a-4551a2adf437","source":"wordfence","cve":"CVE-2024-32535","title":"Access Category Password <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b369b4-b107-4207-8d5a-4551a2adf437?source=api-prod","affected":[{"type":"plugin","slug":"access-category-password","name":"Access Category Password","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T15:40:20Z"},{"id":"wordfence:d0b3d83b-9695-40c5-b6ee-2a76c940de6e","source":"wordfence","cve":"CVE-2024-1419","title":"The Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b3d83b-9695-40c5-b6ee-2a76c940de6e?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T06:59:49Z"},{"id":"wordfence:d0b4a357-fddd-4b42-8834-3a294e0d150c","source":"wordfence","cve":"CVE-2015-4065","title":"WordPress Landing Pages <= 1.8.4 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b4a357-fddd-4b42-8834-3a294e0d150c?source=api-prod","affected":[{"type":"plugin","slug":"landing-pages","name":"WordPress Landing Pages","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2015-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0b73619-819a-49c3-a29c-549c6da2c523","source":"wordfence","cve":"CVE-2024-9020","title":"List category posts <= 0.90.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b73619-819a-49c3-a29c-549c6da2c523?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.90.2","to_inclusive":true,"patched_in":"0.90.3"}],"published":"2024-12-27T00:00:00Z","updated":"2025-02-21T19:56:04Z"},{"id":"wordfence:d0bace1c-0a22-4f7f-9862-1eb0cd3ea48b","source":"wordfence","cve":"CVE-2024-51826","title":"Bitcoin Payments <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0bace1c-0a22-4f7f-9862-1eb0cd3ea48b?source=api-prod","affected":[{"type":"plugin","slug":"bitcoin-payments","name":"Bitcoin Payments","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:47:01Z"},{"id":"wordfence:d0bd67c9-4c5a-41f0-971f-19e6525092ca","source":"wordfence","cve":"CVE-2026-41556","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0bd67c9-4c5a-41f0-971f-19e6525092ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.13","to_inclusive":true,"patched_in":"4.16.14"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:52:33Z"},{"id":"wordfence:d0bf7032-aba0-429a-93b3-dd642147c7ec","source":"wordfence","cve":"CVE-2025-26744","title":"JetBlog <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0bf7032-aba0-429a-93b3-dd642147c7ec?source=api-prod","affected":[{"type":"plugin","slug":"jet-blog","name":"JetBlog","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.3.1"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:10:36Z"},{"id":"wordfence:d0c0562f-1f3b-4630-bbc5-4ea2985d71d1","source":"wordfence","cve":"","title":"Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c0562f-1f3b-4630-bbc5-4ea2985d71d1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.45","to_inclusive":true,"patched_in":"2.0.46"}],"published":"2019-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0c2f585-4bcd-43a4-a54a-7772caf63fa8","source":"wordfence","cve":"CVE-2025-31792","title":"Piotnet Forms <= 1.0.30 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c2f585-4bcd-43a4-a54a-7772caf63fa8?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:07:21Z"},{"id":"wordfence:d0c4b963-047a-4d41-8dba-9eaa5e555235","source":"wordfence","cve":"CVE-2024-35691","title":"Widget Options - Extended <= 5.1.0 &  Widget Options <= 4.0.1 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c4b963-047a-4d41-8dba-9eaa5e555235?source=api-prod","affected":[{"type":"plugin","slug":"extended-widget-options","name":"Widget Options - Extended","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":false,"patched_in":"5.1.3"},{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T14:14:34Z"},{"id":"wordfence:d0c72033-ab9b-49bb-be28-e09a810137fe","source":"wordfence","cve":"CVE-2007-5229","title":"FeedBurner FeedSmith <= 2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c72033-ab9b-49bb-be28-e09a810137fe?source=api-prod","affected":[{"type":"plugin","slug":"feedburner-feedsmith","name":"feedburner-feedsmith","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2007-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0c724a4-7783-4d2a-938e-800960c2be64","source":"wordfence","cve":"CVE-2024-3918","title":"Pet Manager <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c724a4-7783-4d2a-938e-800960c2be64?source=api-prod","affected":[{"type":"plugin","slug":"pet-manager","name":"Pet Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-02T00:00:00Z","updated":"2024-05-09T15:05:28Z"},{"id":"wordfence:d0c74637-97b6-44d8-89c7-4a662fc537c6","source":"wordfence","cve":"CVE-2024-49639","title":"Monitor.chat <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c74637-97b6-44d8-89c7-4a662fc537c6?source=api-prod","affected":[{"type":"plugin","slug":"monitor-chat","name":"Monitor.chat \u2013 Monitor WordPress with Instant Messages","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:04:23Z"},{"id":"wordfence:d0c91a58-31e9-4f6e-81fb-0681fb9ce4d6","source":"wordfence","cve":"CVE-2023-38512","title":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View <= 4.5.4 - Cross-Site Request Forgery via wpstream_update_local_event_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c91a58-31e9-4f6e-81fb-0681fb9ce4d6?source=api-prod","affected":[{"type":"plugin","slug":"wpstream","name":"WpStream \u2013 Live Streaming, Video on Demand, Pay Per View","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0c9f4c5-a4f6-4cab-8531-5b88b3f347ea","source":"wordfence","cve":"CVE-2023-36385","title":"PostX \u2013 Gutenberg Blocks for Post Grid <= 2.9.9 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c9f4c5-a4f6-4cab-8531-5b88b3f347ea?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"2.9.10"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0ca1d32-d094-46a2-838a-000e8b531767","source":"wordfence","cve":"CVE-2025-8149","title":"aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ca1d32-d094-46a2-838a-000e8b531767?source=api-prod","affected":[{"type":"plugin","slug":"athemes-addons-for-elementor-lite","name":"aThemes Addons for Elementor \u2013 Widgets & Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-09-05T15:01:44Z","updated":"2025-09-06T03:22:40Z"},{"id":"wordfence:d0ca76a3-143c-4e86-a6d7-e1d3b3d7b378","source":"wordfence","cve":"CVE-2023-22686","title":"Nice PayPal Button Lite <= 1.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ca76a3-143c-4e86-a6d7-e1d3b3d7b378?source=api-prod","affected":[{"type":"plugin","slug":"nice-paypal-button-lite","name":"Nice PayPal Button Lite","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0ca9780-8918-40ff-80c0-62ce483adbae","source":"wordfence","cve":"","title":"BuddyPress <= 7.2.1 - Missing Authorization to Unauthorized Group Access","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ca9780-8918-40ff-80c0-62ce483adbae?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2021-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0cae039-e112-48b4-8e8b-f617108601df","source":"wordfence","cve":"CVE-2021-24174","title":"Database Backups <= 1.2.2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0cae039-e112-48b4-8e8b-f617108601df?source=api-prod","affected":[{"type":"plugin","slug":"database-backups","name":"Database Backups","from":"*","from_inclusive":true,"to":"1.2.2.6","to_inclusive":true,"patched_in":""}],"published":"2021-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0cb4434-94c5-42a9-bd86-869058dcbf67","source":"wordfence","cve":"","title":"Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0cb4434-94c5-42a9-bd86-869058dcbf67?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.22.1","to_inclusive":true,"patched_in":"1.23.3"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0d0184a-6aa1-41af-8b18-6bab3b64f42f","source":"wordfence","cve":"CVE-2026-24556","title":"ElementCamp <= 2.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d0184a-6aa1-41af-8b18-6bab3b64f42f?source=api-prod","affected":[{"type":"plugin","slug":"element-camp","name":"ElementCamp","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:09:37Z"},{"id":"wordfence:d0d16797-b795-4623-a22b-f277e602fe53","source":"wordfence","cve":"CVE-2026-15253","title":"Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d16797-b795-4623-a22b-f277e602fe53?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-replace","name":"Easy Media Replace","from":"*","from_inclusive":true,"to":"0.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-17T00:00:00Z","updated":"2026-08-20T22:57:57Z"},{"id":"wordfence:d0d1c29b-85f2-47dd-8f5b-aa0f5d3a4251","source":"wordfence","cve":"CVE-2026-39751","title":"PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d1c29b-85f2-47dd-8f5b-aa0f5d3a4251?source=api-prod","affected":[{"type":"plugin","slug":"payplug","name":"PayPlug for WooCommerce (Official)","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-05T12:00:57Z","updated":"2026-10-28T21:16:38Z"},{"id":"wordfence:d0d4bbcc-4a91-404d-8d07-de0d552f46cd","source":"wordfence","cve":"CVE-2024-9879","title":"Melapress File Monitor <= 2.1.0 - Authenticated (Admin+) Authenticated SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d4bbcc-4a91-404d-8d07-de0d552f46cd?source=api-prod","affected":[{"type":"plugin","slug":"website-file-changes-monitor","name":"Melapress File Monitor","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-03-02T00:00:00Z","updated":"2025-05-30T19:06:20Z"},{"id":"wordfence:d0d58775-13c1-4926-9015-554106a1d0f5","source":"wordfence","cve":"CVE-2024-10499","title":"AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d58775-13c1-4926-9015-554106a1d0f5?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-11-21T00:00:00Z","updated":"2025-01-17T13:00:51Z"},{"id":"wordfence:d0d61395-3434-460f-8821-79e7676eff17","source":"wordfence","cve":"CVE-2024-30184","title":"Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d61395-3434-460f-8821-79e7676eff17?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:30:51Z"},{"id":"wordfence:d0d6f467-6e62-45ff-bf9d-4db5b1ed1dd2","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'logFilter' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d6f467-6e62-45ff-bf9d-4db5b1ed1dd2?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0d78230-2722-40ff-a54d-0f1896ca3349","source":"wordfence","cve":"CVE-2025-68073","title":"GDPR CCPA Compliance Support <= 2.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d78230-2722-40ff-a54d-0f1896ca3349?source=api-prod","affected":[{"type":"plugin","slug":"ninja-gdpr-compliance","name":"GDPR CCPA Compliance & Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-28T18:26:19Z"},{"id":"wordfence:d0d8d660-4f8f-4fd5-b001-b182219cf327","source":"wordfence","cve":"CVE-2014-9393","title":"Post to Twitter <= 0.7 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d8d660-4f8f-4fd5-b001-b182219cf327?source=api-prod","affected":[{"type":"plugin","slug":"post-to-twitter","name":"Post to Twitter","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0d9ba14-c0c9-426e-927e-9139a0882f0d","source":"wordfence","cve":"CVE-2024-13506","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0d9ba14-c0c9-426e-927e-9139a0882f0d?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.97","to_inclusive":true,"patched_in":"2.8.98"}],"published":"2025-02-10T22:19:26Z","updated":"2025-02-11T11:10:05Z"},{"id":"wordfence:d0da2e4f-f605-4d10-a832-4659605f1d57","source":"wordfence","cve":"CVE-2025-69075","title":"Yolox <= 1.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0da2e4f-f605-4d10-a832-4659605f1d57?source=api-prod","affected":[{"type":"theme","slug":"yolox","name":"Yolox | Business & Startup Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:31:43Z"},{"id":"wordfence:d0dcf95e-1540-48ed-a4a2-f803d67ea141","source":"wordfence","cve":"CVE-2022-47443","title":"Multi Rating <= 5.0.5 - Cross Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0dcf95e-1540-48ed-a4a2-f803d67ea141?source=api-prod","affected":[{"type":"plugin","slug":"multi-rating","name":"Multi Rating","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0dd4fc0-1c6a-4556-b219-893563a27a69","source":"wordfence","cve":"CVE-2025-8570","title":"BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter","severity":"critical","cvss":9.8,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0dd4fc0-1c6a-4556-b219-893563a27a69?source=api-prod","affected":[{"type":"plugin","slug":"beyondcart","name":"BeyondCart Connector","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-09-10T18:48:51Z","updated":"2025-09-26T18:30:35Z"},{"id":"wordfence:d0e02954-a2e7-417b-a467-fee0076d9b2a","source":"wordfence","cve":"CVE-2023-22718","title":"User Meta Manager <= 3.4.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e02954-a2e7-417b-a467-fee0076d9b2a?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-manager","name":"User Meta Manager","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0e0d284-2056-414e-9069-d2302db0670d","source":"wordfence","cve":"CVE-2019-25737","title":"Live Chat Unlimited <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e0d284-2056-414e-9069-d2302db0670d?source=api-prod","affected":[{"type":"plugin","slug":"screets-lcx","name":"Live Chat Unlimited","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-04T00:00:00Z","updated":"2026-07-29T20:01:46Z"},{"id":"wordfence:d0e10c09-03b2-4286-95ef-e819fc2b900f","source":"wordfence","cve":"CVE-2024-44058","title":"Parabola <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e10c09-03b2-4286-95ef-e819fc2b900f?source=api-prod","affected":[{"type":"theme","slug":"parabola","name":"Parabola","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:56:02Z"},{"id":"wordfence:d0e2ae5c-685d-4cf0-91e2-2f8620b2eb6b","source":"wordfence","cve":"CVE-2022-2412","title":"Better Tag Cloud <= 0.99.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e2ae5c-685d-4cf0-91e2-2f8620b2eb6b?source=api-prod","affected":[{"type":"plugin","slug":"nktagcloud","name":"Better Tag Cloud","from":"*","from_inclusive":true,"to":"0.99.5","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0e6900c-21a3-4b46-bb61-8c41e2234a26","source":"wordfence","cve":"CVE-2026-6813","title":"Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e6900c-21a3-4b46-bb61-8c41e2234a26?source=api-prod","affected":[{"type":"plugin","slug":"continually","name":"Continually","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T20:38:13Z","updated":"2026-05-12T09:29:03Z"},{"id":"wordfence:d0e73b59-58d7-4f4b-b7f3-568190be9b09","source":"wordfence","cve":"CVE-2026-107657","title":"HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e73b59-58d7-4f4b-b7f3-568190be9b09?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.31","to_inclusive":true,"patched_in":"1.7.32"}],"published":"2026-10-09T19:43:31Z","updated":"2026-10-10T08:26:40Z"},{"id":"wordfence:d0e7acbe-90a9-4cc9-a109-b7fda0761a0a","source":"wordfence","cve":"CVE-2026-28571","title":"Contact Form to Chat Apps | Click to Chat to Order \u2013 FormyChat <= 2.15.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e7acbe-90a9-4cc9-a109-b7fda0761a0a?source=api-prod","affected":[{"type":"plugin","slug":"social-contact-form","name":"Contact Form to Chat Apps | Click to Chat to Order \u2013 FormyChat","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2026-08-17T12:09:05Z","updated":"2026-09-16T17:31:18Z"},{"id":"wordfence:d0e82bef-3857-4b13-a124-70aeaf90e8ce","source":"wordfence","cve":"CVE-2025-49062","title":"WP-jScrollPane <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0e82bef-3857-4b13-a124-70aeaf90e8ce?source=api-prod","affected":[{"type":"plugin","slug":"wp-jscrollpane","name":"WP-jScrollPane","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:40:44Z"},{"id":"wordfence:d0eafb20-4ef2-448b-9da7-ad8aa9e45215","source":"wordfence","cve":"CVE-2025-1730","title":"Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0eafb20-4ef2-448b-9da7-ad8aa9e45215?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-counter","name":"Simple Download Counter","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T06:39:29Z"},{"id":"wordfence:d0ec4f27-2057-468e-bfcd-818c50952cac","source":"wordfence","cve":"CVE-2021-24570","title":"Paypal Donation <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ec4f27-2057-468e-bfcd-818c50952cac?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0ec9b5f-84c2-4736-98fb-130215430b8c","source":"wordfence","cve":"CVE-2025-68600","title":"Link Library <= 7.8.7 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0ec9b5f-84c2-4736-98fb-130215430b8c?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.8.7","to_inclusive":true,"patched_in":"7.8.8"}],"published":"2025-12-24T00:00:00Z","updated":"2026-04-14T14:37:38Z"},{"id":"wordfence:d0f216fc-7073-42da-a3cc-7452fa9775bd","source":"wordfence","cve":"CVE-2024-34812","title":"ShopBuilder \u2013 Elementor WooCommerce Builder Addons <= 2.1.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f216fc-7073-42da-a3cc-7452fa9775bd?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:34:04Z"},{"id":"wordfence:d0f35a20-ffcf-4413-b1ea-748cd6aa6f20","source":"wordfence","cve":"CVE-2017-17780","title":"Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f35a20-ffcf-4413-b1ea-748cd6aa6f20?source=api-prod","affected":[{"type":"plugin","slug":"mediaburst-email-to-sms","name":"Clockwork SMS Notfications","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"clockwork-two-factor-authentication","name":"Two-Factor Authentication \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"booking-sms","name":"Booking Calendar \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"formidable-sms","name":"Formidable \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"gravity-forms-sms-notifications","name":"Gravity Forms \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"contact-form-7-sms-addon","name":"Contact Form 7 \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"mediaburst-ecommerce-sms-notifications","name":"WP e-Commerce \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"fscf-sms","name":"Fast Secure Contact Form \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2017-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0f4ca62-8342-4b53-948e-3cf2408631bf","source":"wordfence","cve":"CVE-2025-53430","title":"Etta <= 1.14.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f4ca62-8342-4b53-948e-3cf2408631bf?source=api-prod","affected":[{"type":"theme","slug":"etta","name":"Etta - Marketing WordPress Theme","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T16:24:28Z"},{"id":"wordfence:d0f5b9b7-2482-4f25-b50e-e2d9b3ef4902","source":"wordfence","cve":"","title":"SL User Create < 0.2.5 - Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f5b9b7-2482-4f25-b50e-e2d9b3ef4902?source=api-prod","affected":[{"type":"plugin","slug":"sl-user-create","name":"SL User Create","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":false,"patched_in":"0.2.5"}],"published":"2013-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0f6be2b-5eb6-4828-ae95-7f2253700ee9","source":"wordfence","cve":"CVE-2024-13183","title":"Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6be2b-5eb6-4828-ae95-7f2253700ee9?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.43","to_inclusive":true,"patched_in":"2.10.44"}],"published":"2025-01-09T18:53:22Z","updated":"2025-01-10T07:21:48Z"},{"id":"wordfence:d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf","source":"wordfence","cve":"CVE-2025-11748","title":"Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6d28a-d5ca-4700-bc61-f2dd20f06fcf?source=api-prod","affected":[{"type":"plugin","slug":"groups","name":"Groups \u2013 Memberships and Access Control","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-11T14:24:55Z"},{"id":"wordfence:d0fa6998-b85a-413e-be00-81926b4ea6ab","source":"wordfence","cve":"CVE-2024-48030","title":"Telecash Ricaricaweb <= 2.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fa6998-b85a-413e-be00-81926b4ea6ab?source=api-prod","affected":[{"type":"plugin","slug":"telecash-ricaricaweb","name":"Telecash Ricaricaweb","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:55:54Z"},{"id":"wordfence:d0fb6bf0-48b8-48cc-8080-8fe19c36ce7c","source":"wordfence","cve":"","title":"Dendelion < 2.6.6 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fb6bf0-48b8-48cc-8080-8fe19c36ce7c?source=api-prod","affected":[{"type":"theme","slug":"dandelion","name":"Dendelion","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2014-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d0fbf502-2dfb-49e5-94a6-1525aabc08c1","source":"wordfence","cve":"CVE-2025-13090","title":"WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fbf502-2dfb-49e5-94a6-1525aabc08c1?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-12-01T21:39:47Z","updated":"2025-12-02T11:20:09Z"},{"id":"wordfence:d0fd1c19-b752-4562-9365-165d709b91b2","source":"wordfence","cve":"CVE-2024-11496","title":"Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d0fd1c19-b752-4562-9365-165d709b91b2?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2025-01-06T16:09:04Z","updated":"2025-01-30T22:23:13Z"},{"id":"wordfence:d1000b18-ce1f-4803-98ea-c6b42ccc9f54","source":"wordfence","cve":"CVE-2026-32345","title":"Perfect Portfolio <= 1.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1000b18-ce1f-4803-98ea-c6b42ccc9f54?source=api-prod","affected":[{"type":"theme","slug":"perfect-portfolio","name":"Perfect Portfolio","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:47:58Z"},{"id":"wordfence:d10036de-940f-4772-9aca-13bc647548d2","source":"wordfence","cve":"CVE-2024-11899","title":"Slider Pro Lite <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d10036de-940f-4772-9aca-13bc647548d2?source=api-prod","affected":[{"type":"plugin","slug":"slider-pro-lite","name":"Slider Pro Lite","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:04:19Z","updated":"2025-01-07T03:21:58Z"},{"id":"wordfence:d1010f1d-47d2-4aa9-9b31-e5d63dafbc39","source":"wordfence","cve":"CVE-2025-60102","title":"WPFront User Role Editor <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1010f1d-47d2-4aa9-9b31-e5d63dafbc39?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-user-role-editor","name":"WPFront User Role Editor","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.4"}],"published":"2025-09-26T00:00:00Z","updated":"2025-12-03T16:55:30Z"},{"id":"wordfence:d10336c2-656f-40f7-a95a-dbf829c2ce38","source":"wordfence","cve":"CVE-2021-20851","title":"Browser and Operating System Finder <= 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d10336c2-656f-40f7-a95a-dbf829c2ce38?source=api-prod","affected":[{"type":"plugin","slug":"browser-and-operating-system-finder","name":"Browser and Operating System Finder","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2021-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d10364ed-179d-4506-a6f0-42b03c005242","source":"wordfence","cve":"","title":"Page Builder by SiteOrigin < 2.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d10364ed-179d-4506-a6f0-42b03c005242?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2015-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1040d5b-e02d-4762-825f-409c8770c66f","source":"wordfence","cve":"","title":"Zoner - Real Estate <= 4.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1040d5b-e02d-4762-825f-409c8770c66f?source=api-prod","affected":[{"type":"theme","slug":"zoner","name":"Zoner - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2019-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1043dce-628f-485b-bc1c-b78938c2a6f5","source":"wordfence","cve":"CVE-2024-12860","title":"CarSpot \u2013 Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1043dce-628f-485b-bc1c-b78938c2a6f5?source=api-prod","affected":[{"type":"theme","slug":"carspot","name":"CarSpot \u2013 Dealership Wordpress Classified Theme","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-02-17T20:04:38Z","updated":"2025-02-18T08:21:43Z"},{"id":"wordfence:d105cae2-2442-4726-bbe8-2edbd1e7a28c","source":"wordfence","cve":"CVE-2025-49979","title":"Media Hygiene <= 4.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d105cae2-2442-4726-bbe8-2edbd1e7a28c?source=api-prod","affected":[{"type":"plugin","slug":"media-hygiene","name":"Media Hygiene: Remove or Delete Unused Images and More!","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-06-19T00:00:00Z","updated":"2026-03-31T19:36:26Z"},{"id":"wordfence:d10672ba-ae98-43e8-9ad8-2b12e2b7bc49","source":"wordfence","cve":"CVE-2026-65553","title":"Spider Analyser \u2013 WordPress\u641c\u7d22\u5f15\u64ce\u8718\u86db\u5206\u6790\u63d2\u4ef6 <= 2.1.3 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d10672ba-ae98-43e8-9ad8-2b12e2b7bc49?source=api-prod","affected":[{"type":"plugin","slug":"spider-analyser","name":"Spider Analyser \u2013 WordPress\u641c\u7d22\u5f15\u64ce\u8718\u86db\u5206\u6790\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-07T18:26:22Z"},{"id":"wordfence:d106d581-d711-44ac-b85a-c43aad727eeb","source":"wordfence","cve":"CVE-2025-9857","title":"Heateor Login \u2013 Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d106d581-d711-44ac-b85a-c43aad727eeb?source=api-prod","affected":[{"type":"plugin","slug":"heateor-login","name":"Heateor Login \u2013 Social Login Plugin","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2025-09-09T17:52:04Z","updated":"2025-09-10T06:38:52Z"},{"id":"wordfence:d108cb36-c072-483e-9746-15b8e7a880c3","source":"wordfence","cve":"CVE-2024-1326","title":"Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d108cb36-c072-483e-9746-15b8e7a880c3?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-20T19:49:16Z"},{"id":"wordfence:d10a0372-1ab3-474e-8d5c-33f71fddfe06","source":"wordfence","cve":"CVE-2022-1603","title":"Mail Subscribe List <= 2.1.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d10a0372-1ab3-474e-8d5c-33f71fddfe06?source=api-prod","affected":[{"type":"plugin","slug":"mail-subscribe-list","name":"Mail Subscribe List","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d11217ec-55a6-4422-9995-4cc1761d430e","source":"wordfence","cve":"CVE-2025-9849","title":"Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11217ec-55a6-4422-9995-4cc1761d430e?source=api-prod","affected":[{"type":"plugin","slug":"html-social-share-buttons","name":"HTML Social Share Buttons","from":"*","from_inclusive":true,"to":"2.1.16","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-09-05T13:40:08Z","updated":"2025-09-09T14:59:39Z"},{"id":"wordfence:d1123d28-56a7-4bf8-92ce-2749e4676623","source":"wordfence","cve":"CVE-2025-63069","title":"Ivory Search <= 5.5.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1123d28-56a7-4bf8-92ce-2749e4676623?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.12","to_inclusive":true,"patched_in":"5.5.13"}],"published":"2025-09-28T00:00:00Z","updated":"2025-12-11T15:16:01Z"},{"id":"wordfence:d11295b5-0847-4c71-92fa-c35ba7fe7078","source":"wordfence","cve":"CVE-2025-62127","title":"WEN Logo Slider <= 3.4.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11295b5-0847-4c71-92fa-c35ba7fe7078?source=api-prod","affected":[{"type":"plugin","slug":"wen-logo-slider","name":"WEN Logo Slider","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:13:39Z"},{"id":"wordfence:d112f1b0-bfe0-44f0-b43a-334976bdb114","source":"wordfence","cve":"CVE-2026-73344","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d112f1b0-bfe0-44f0-b43a-334976bdb114?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.79","to_inclusive":true,"patched_in":"5.5.80"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-13T19:01:22Z"},{"id":"wordfence:d1167f98-850c-4493-b93e-95e59bfe7df7","source":"wordfence","cve":"CVE-2026-73367","title":"Easy Google Maps < 1.14.2 - Unauthenticated Arbitrary Remote Script Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1167f98-850c-4493-b93e-95e59bfe7df7?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.14.2","to_inclusive":false,"patched_in":"1.14.2"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-16T15:51:01Z"},{"id":"wordfence:d116e432-ded9-4fc1-9509-710269dba5e0","source":"wordfence","cve":"CVE-2013-2205","title":"WordPress Core < 3.5.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d116e432-ded9-4fc1-9509-710269dba5e0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d117d930-d210-44bf-ac49-19c003ca5a24","source":"wordfence","cve":"CVE-2025-7662","title":"Gestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d117d930-d210-44bf-ac49-19c003ca5a24?source=api-prod","affected":[{"type":"plugin","slug":"gestion-tarifs","name":"Gestion de tarifs","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:16:13Z","updated":"2025-08-15T08:25:42Z"},{"id":"wordfence:d118409f-6d7a-4116-92c1-ea754933277e","source":"wordfence","cve":"CVE-2026-84896","title":"King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder < 51.1.77 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d118409f-6d7a-4116-92c1-ea754933277e?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.77","to_inclusive":false,"patched_in":"51.1.77"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:04:30Z"},{"id":"wordfence:d118beb2-bcb1-4d35-b25e-172fa4b6d916","source":"wordfence","cve":"","title":"WP-FB-AutoConnect <= 4.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d118beb2-bcb1-4d35-b25e-172fa4b6d916?source=api-prod","affected":[{"type":"plugin","slug":"wp-fb-autoconnect","name":"WP Social AutoConnect","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d11b5a8c-c647-4476-b749-b7048d4d06d1","source":"wordfence","cve":"CVE-2025-15697","title":"Dictionary <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11b5a8c-c647-4476-b749-b7048d4d06d1?source=api-prod","affected":[{"type":"plugin","slug":"dictionary","name":"Dictionary","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:28:25Z"},{"id":"wordfence:d11c84ea-e52b-4396-a508-9d415040b76e","source":"wordfence","cve":"CVE-2023-39314","title":"Leyka <= 3.30.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11c84ea-e52b-4396-a508-9d415040b76e?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.30.2","to_inclusive":true,"patched_in":"3.30.3"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d11d5dbc-7329-40ed-8e84-d57fa59460a4","source":"wordfence","cve":"CVE-2024-44007","title":"SKT Templates \u2013 Elementor & Gutenberg templates <= 6.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11d5dbc-7329-40ed-8e84-d57fa59460a4?source=api-prod","affected":[{"type":"plugin","slug":"skt-templates","name":"SKT Templates \u2013 100% Free Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"6.14","to_inclusive":true,"patched_in":"6.15"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T17:20:29Z"},{"id":"wordfence:d11e3896-6901-4a52-b863-19cb25d21014","source":"wordfence","cve":"CVE-2026-27354","title":"WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11e3896-6901-4a52-b863-19cb25d21014?source=api-prod","affected":[{"type":"plugin","slug":"woo-coming-soon-product","name":"WooCommerce Coming Soon Product with Countdown","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:44:46Z"},{"id":"wordfence:d11e8124-1028-4dba-bbd9-c45699d78909","source":"wordfence","cve":"CVE-2022-4629","title":"Product Slider for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d11e8124-1028-4dba-bbd9-c45699d78909?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-slider","name":"Product Slider, Product Carousel and Product Grid Gallery for WooCommerce \u2013 Reno Product Slider (formerly Product Slider for WooCommerce)","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2022-12-28T00:00:00Z","updated":"2024-10-24T18:19:36Z"},{"id":"wordfence:d12067ce-d2a1-4426-995c-590285500094","source":"wordfence","cve":"CVE-2025-69188","title":"Fitness Trainer <= 1.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d12067ce-d2a1-4426-995c-590285500094?source=api-prod","affected":[{"type":"plugin","slug":"fitness-trainer","name":"Fitness Trainer- Training Membership Plugin","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:57:39Z"},{"id":"wordfence:d1213431-a2a7-434a-b479-ac65fbc84820","source":"wordfence","cve":"CVE-2026-42749","title":"Disable Comments & Delete All Comments <= 1.3.0 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1213431-a2a7-434a-b479-ac65fbc84820?source=api-prod","affected":[{"type":"plugin","slug":"comments-plus","name":"Disable Comments & Delete All Comments","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-02T11:35:19Z"},{"id":"wordfence:d122321a-d714-4283-89b8-dc7dbfa96b20","source":"wordfence","cve":"CVE-2026-1451","title":"rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d122321a-d714-4283-89b8-dc7dbfa96b20?source=api-prod","affected":[{"type":"plugin","slug":"rognone","name":"rognone","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:44:42Z","updated":"2026-06-02T07:48:32Z"},{"id":"wordfence:d1238995-fb94-4b65-a730-83030ea7de3f","source":"wordfence","cve":"CVE-2026-97193","title":"Secure Custom Fields <= 6.9.7 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1238995-fb94-4b65-a730-83030ea7de3f?source=api-prod","affected":[{"type":"plugin","slug":"secure-custom-fields","name":"Secure Custom Fields","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T20:13:04Z"},{"id":"wordfence:d12520a0-0fac-46f0-b58f-62bc2f1f86c5","source":"wordfence","cve":"CVE-2025-26941","title":"Church Admin <= 5.0.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d12520a0-0fac-46f0-b58f-62bc2f1f86c5?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.18","to_inclusive":true,"patched_in":"5.0.19"}],"published":"2025-03-13T00:00:00Z","updated":"2025-04-22T20:02:32Z"},{"id":"wordfence:d1291a06-a596-4e87-9036-787039b06850","source":"wordfence","cve":"CVE-2025-58200","title":"Flexible FAQ <= 0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1291a06-a596-4e87-9036-787039b06850?source=api-prod","affected":[{"type":"plugin","slug":"flexible-faq","name":"Flexible FAQ","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:33:19Z"},{"id":"wordfence:d12c4b1c-23d0-430f-a6ea-0a3ab487ed10","source":"wordfence","cve":"CVE-2024-10078","title":"WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d12c4b1c-23d0-430f-a6ea-0a3ab487ed10?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-types","name":"WP Easy Post Types","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-24T18:14:59Z"},{"id":"wordfence:d1305df9-5002-4352-875c-2dcba7b06c10","source":"wordfence","cve":"CVE-2026-75980","title":"BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1305df9-5002-4352-875c-2dcba7b06c10?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2026-08-31T17:02:40Z","updated":"2026-09-01T05:30:41Z"},{"id":"wordfence:d130af27-cc17-4207-9084-15bbc56267b9","source":"wordfence","cve":"CVE-2026-85349","title":"FluentBoards <= 2.0.14 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d130af27-cc17-4207-9084-15bbc56267b9?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:55:40Z"},{"id":"wordfence:d131115b-e2c9-42c6-9262-a19272944652","source":"wordfence","cve":"CVE-2023-23810","title":"Panorama \u2013 WordPress Project Management Plugin <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d131115b-e2c9-42c6-9262-a19272944652?source=api-prod","affected":[{"type":"plugin","slug":"project-panorama-lite","name":"Panorama \u2013 WordPress Project Management Plugin","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d132d587-0c90-40b2-97b7-c5f1d3dd3bac","source":"wordfence","cve":"CVE-2025-30986","title":"Elite Video Player <= 10.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d132d587-0c90-40b2-97b7-c5f1d3dd3bac?source=api-prod","affected":[{"type":"plugin","slug":"elite-video-player","name":"Elite Video Player","from":"*","from_inclusive":true,"to":"10.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:06:12Z"},{"id":"wordfence:d1390c22-3c8d-47f1-b225-1bcbc215832a","source":"wordfence","cve":"CVE-2024-23510","title":"Don't Muck My Markup <= 1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1390c22-3c8d-47f1-b225-1bcbc215832a?source=api-prod","affected":[{"type":"plugin","slug":"dont-muck-my-markup","name":"Don&#039;t Muck My Markup","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-02T21:13:20Z"},{"id":"wordfence:d139fb44-b66b-46e3-af99-9404ec34fd06","source":"wordfence","cve":"CVE-2025-30598","title":"OSS Upload <= 4.8.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d139fb44-b66b-46e3-af99-9404ec34fd06?source=api-prod","affected":[{"type":"plugin","slug":"oss-upload","name":"OSS Upload","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:03:45Z"},{"id":"wordfence:d13ca79f-50fa-4395-8de1-b58a9459a34c","source":"wordfence","cve":"CVE-2025-32498","title":"VKontakte Cross-Post <=  0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d13ca79f-50fa-4395-8de1-b58a9459a34c?source=api-prod","affected":[{"type":"plugin","slug":"vkontakte-cross-post","name":"VKontakte Cross-Post","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:02:50Z"},{"id":"wordfence:d13ccd77-a39a-4779-86e6-9cd9484ff82a","source":"wordfence","cve":"CVE-2025-32618","title":"Wishlist <= 1.0.44 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d13ccd77-a39a-4779-86e6-9cd9484ff82a?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.44","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2026-04-30T03:17:42Z"},{"id":"wordfence:d13d072e-9c9c-4a32-b9f4-7d15dc704b50","source":"wordfence","cve":"CVE-2024-0821","title":"Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d13d072e-9c9c-4a32-b9f4-7d15dc704b50?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-29T21:37:30Z"},{"id":"wordfence:d1408c27-2328-4228-bba4-e28b263851c6","source":"wordfence","cve":"CVE-2025-30554","title":"Frizzly <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1408c27-2328-4228-bba4-e28b263851c6?source=api-prod","affected":[{"type":"plugin","slug":"frizzly","name":"Frizzly \u2013 Social Share Buttons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-04-01T00:00:00Z","updated":"2026-09-09T15:51:07Z"},{"id":"wordfence:d140c42b-09d9-41aa-8a6a-0fa4b4404b11","source":"wordfence","cve":"CVE-2026-24562","title":"Ryviu \u2013 Product Reviews for WooCommerce <= 3.1.26 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d140c42b-09d9-41aa-8a6a-0fa4b4404b11?source=api-prod","affected":[{"type":"plugin","slug":"ryviu","name":"Ryviu \u2013 Review Importer & Product Reviews","from":"*","from_inclusive":true,"to":"3.1.26","to_inclusive":true,"patched_in":"3.1.27"}],"published":"2026-01-22T00:00:00Z","updated":"2026-09-09T16:05:54Z"},{"id":"wordfence:d1418658-e068-4f49-a959-3bc8283c239a","source":"wordfence","cve":"CVE-2025-39404","title":"Sassy Social Share <= 3.3.73 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1418658-e068-4f49-a959-3bc8283c239a?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"*","from_inclusive":true,"to":"3.3.73","to_inclusive":true,"patched_in":"3.3.74"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:54:10Z"},{"id":"wordfence:d14275cd-e4fa-4ac7-b9b9-ebe11f89e0bd","source":"wordfence","cve":"CVE-2026-109898","title":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d14275cd-e4fa-4ac7-b9b9-ebe11f89e0bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.25","to_inclusive":true,"patched_in":"4.1.26"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:43:37Z"},{"id":"wordfence:d1429549-2e73-4db3-bc83-98c722a80903","source":"wordfence","cve":"CVE-2024-38773","title":"FormLift for Infusionsoft Web Forms <= 7.5.17 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1429549-2e73-4db3-bc83-98c722a80903?source=api-prod","affected":[{"type":"plugin","slug":"formlift","name":"FormLift for Keap (Legacy) Web Forms","from":"*","from_inclusive":true,"to":"7.5.17","to_inclusive":true,"patched_in":"7.5.18"}],"published":"2024-07-19T00:00:00Z","updated":"2026-08-23T23:43:39Z"},{"id":"wordfence:d1436ca4-933b-426a-987d-c5cbbc29353b","source":"wordfence","cve":"CVE-2023-3508","title":"WooCommerce Pre-Orders <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1436ca4-933b-426a-987d-c5cbbc29353b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pre-orders","name":"WooCommerce Pre-Orders","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d143cefc-e387-47bd-aff6-a2099f704d20","source":"wordfence","cve":"CVE-2022-40687","title":"Creative Mail <= 1.5.4 - Cross-Site Request Forgery to Settings Disconnect","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d143cefc-e387-47bd-aff6-a2099f704d20?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d144aab0-a55a-4889-86d9-40534cbec31c","source":"wordfence","cve":"CVE-2026-39538","title":"Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d144aab0-a55a-4889-86d9-40534cbec31c?source=api-prod","affected":[{"type":"plugin","slug":"mikado-core","name":"Mikado Core","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-02-02T00:00:00Z","updated":"2026-04-15T21:28:33Z"},{"id":"wordfence:d145d0af-e364-4cc3-af4f-03117eb34637","source":"wordfence","cve":"CVE-2024-7410","title":"My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d145d0af-e364-4cc3-af4f-03117eb34637?source=api-prod","affected":[{"type":"plugin","slug":"my-custom-css","name":"My Custom CSS PHP & ADS","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-08T20:34:54Z","updated":"2024-08-09T09:30:13Z"},{"id":"wordfence:d1498fdf-9d5e-4277-92be-469d6646864b","source":"wordfence","cve":"CVE-2024-4611","title":"AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-703","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1498fdf-9d5e-4277-92be-469d6646864b?source=api-prod","affected":[{"type":"plugin","slug":"apppresser","name":"AppPresser \u2013 Mobile App Framework","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2024-05-28T00:00:00Z","updated":"2024-05-29T04:30:30Z"},{"id":"wordfence:d14c8890-482c-4d43-a68f-0d04c4feca8f","source":"wordfence","cve":"CVE-2023-6738","title":"PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields","severity":"medium","cvss":5.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d14c8890-482c-4d43-a68f-0d04c4feca8f?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:37:30Z"},{"id":"wordfence:d1507a4c-8fe6-43f9-b750-2720dc301abd","source":"wordfence","cve":"CVE-2026-39523","title":"Solene Core <= 2.3.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1507a4c-8fe6-43f9-b750-2720dc301abd?source=api-prod","affected":[{"type":"plugin","slug":"solene-core","name":"Solene Core","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:11:14Z"},{"id":"wordfence:d151c9a1-d47e-4155-8539-133f6abd57a5","source":"wordfence","cve":"CVE-2021-24492","title":"Handsome Testimonials & Reviews < 2.1.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d151c9a1-d47e-4155-8539-133f6abd57a5?source=api-prod","affected":[{"type":"plugin","slug":"handsome-testimonials","name":"Handsome Testimonials & Reviews","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d152271f-af5c-4faf-9945-483b69b716f2","source":"wordfence","cve":"CVE-2024-11774","title":"Outdooractive Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d152271f-af5c-4faf-9945-483b69b716f2?source=api-prod","affected":[{"type":"plugin","slug":"outdooractive-embed","name":"Outdooractive Embed","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-12-19T18:07:46Z","updated":"2024-12-24T16:04:53Z"},{"id":"wordfence:d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8","source":"wordfence","cve":"CVE-2025-8416","title":"Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.9.8"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T06:49:25Z"},{"id":"wordfence:d1568e8d-9ea5-4673-a657-03e89cfb6000","source":"wordfence","cve":"CVE-2023-45652","title":"Remote Content Shortcode <= 1.5 - Authenticated(Contributor+) Local File Inclusion via shortcode","severity":"medium","cvss":6.3,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1568e8d-9ea5-4673-a657-03e89cfb6000?source=api-prod","affected":[{"type":"plugin","slug":"remote-content-shortcode","name":"Remote Content Shortcode","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d156f277-88cb-43aa-895c-63684aa1466e","source":"wordfence","cve":"CVE-2026-39479","title":"OttoKit <= 1.1.20 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d156f277-88cb-43aa-895c-63684aa1466e?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":true,"patched_in":"1.1.21"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-15T21:23:50Z"},{"id":"wordfence:d157c63d-824d-4ad0-841c-fdca63b37eb4","source":"wordfence","cve":"CVE-2025-67917","title":"Traveler <= 3.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d157c63d-824d-4ad0-841c-fdca63b37eb4?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T14:31:44Z"},{"id":"wordfence:d159130a-c99d-44d3-a130-aa0146f17157","source":"wordfence","cve":"","title":"Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal <= 5.1.12 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d159130a-c99d-44d3-a130-aa0146f17157?source=api-prod","affected":[{"type":"plugin","slug":"seamless-donations","name":"Seamless Donations is Sunset","from":"*","from_inclusive":true,"to":"5.1.12","to_inclusive":true,"patched_in":"5.1.13"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d15e36b6-61f9-42a4-86aa-8dd0e0563584","source":"wordfence","cve":"CVE-2026-22349","title":"Menu In Post <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d15e36b6-61f9-42a4-86aa-8dd0e0563584?source=api-prod","affected":[{"type":"plugin","slug":"menu-in-post","name":"Menu In Post","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-14T19:37:02Z"},{"id":"wordfence:d162559e-fb6c-40e2-9fc3-49370f9a779e","source":"wordfence","cve":"CVE-2025-24689","title":"Import and export users and customers <= 1.27.12 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d162559e-fb6c-40e2-9fc3-49370f9a779e?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.27.12","to_inclusive":true,"patched_in":"1.27.13"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:36:15Z"},{"id":"wordfence:d16363d6-ca4b-4de0-abae-a7b07803e2e3","source":"wordfence","cve":"CVE-2024-9022","title":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16363d6-ca4b-4de0-abae-a7b07803e2e3?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-15T11:52:37Z"},{"id":"wordfence:d1647a2c-d21d-4b4b-a22e-32351022404e","source":"wordfence","cve":"CVE-2023-30875","title":"Logo Scheduler <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1647a2c-d21d-4b4b-a22e-32351022404e?source=api-prod","affected":[{"type":"plugin","slug":"logo-scheduler-great-for-holidays-events-and-more","name":"Logo Scheduler \u2013 Great for holidays, events, and more","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d167a483-7190-4285-a055-2280cc36f9c6","source":"wordfence","cve":"CVE-2024-49634","title":"BP Member Type Manager <= 1.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d167a483-7190-4285-a055-2280cc36f9c6?source=api-prod","affected":[{"type":"plugin","slug":"bp-member-type-manager","name":"BP Member Type Manager","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:47:03Z"},{"id":"wordfence:d167c871-93f4-46b4-9e4e-6d2c8a1ba88f","source":"wordfence","cve":"CVE-2026-124269","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.51.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d167c871-93f4-46b4-9e4e-6d2c8a1ba88f?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.51.0","to_inclusive":true,"patched_in":"3.51.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:36Z"},{"id":"wordfence:d169fa88-3f75-47a0-93df-dd3550b59278","source":"wordfence","cve":"CVE-2026-16739","title":"Epeken All Kurir for Woocommerce < 2.1.8 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d169fa88-3f75-47a0-93df-dd3550b59278?source=api-prod","affected":[{"type":"plugin","slug":"epeken-all-kurir","name":"Epeken All Kurir for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2026-08-11T00:00:00Z","updated":"2026-10-28T21:13:12Z"},{"id":"wordfence:d16a3da0-9539-4555-8dfc-65cb4f4d7b4d","source":"wordfence","cve":"CVE-2023-2113","title":"Autoptimize <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16a3da0-9539-4555-8dfc-65cb4f4d7b4d?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d16a7408-9a13-4a8d-80a5-f510ba27e595","source":"wordfence","cve":"CVE-2025-49361","title":"Mamita <= 1.0.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16a7408-9a13-4a8d-80a5-f510ba27e595?source=api-prod","affected":[{"type":"theme","slug":"mamita","name":"Mamita | Pregnancy & Maternity Cinique Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:20:54Z"},{"id":"wordfence:d16c13bf-7cab-4870-898e-971b5c4d7b7b","source":"wordfence","cve":"CVE-2026-39530","title":"SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16c13bf-7cab-4870-898e-971b5c4d7b7b?source=api-prod","affected":[{"type":"plugin","slug":"speakout","name":"SpeakOut! Email Petitions","from":"*","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"4.6.5.1"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T14:50:43Z"},{"id":"wordfence:d16cb094-d1e7-48ca-8baa-8171d02d3ef5","source":"wordfence","cve":"CVE-2025-60153","title":"Subscribe To Unlock <= 1.1.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16cb094-d1e7-48ca-8baa-8171d02d3ef5?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-unlock","name":"Subscribe To Unlock","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:12:56Z"},{"id":"wordfence:d16f7c33-0e60-43bb-b200-883cced640f3","source":"wordfence","cve":"","title":"YITH WooCommerce Ajax Product Filter <= 3.11.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16f7c33-0e60-43bb-b200-883cced640f3?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-navigation","name":"YITH WooCommerce Ajax Product Filter","from":"*","from_inclusive":true,"to":"3.11.1","to_inclusive":false,"patched_in":"3.11.1"}],"published":"2020-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d16fa590-1409-4f04-b8b7-0cce17412a5f","source":"wordfence","cve":"CVE-2023-1345","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'queue_posts'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d16fa590-1409-4f04-b8b7-0cce17412a5f?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d170af2a-9b8c-43ad-b712-b89bcfadd5b7","source":"wordfence","cve":"CVE-2023-6732","title":"Ultimate Maps by Supsystic <= 1.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d170af2a-9b8c-43ad-b712-b89bcfadd5b7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"}],"published":"2024-01-12T00:00:00Z","updated":"2024-02-06T14:55:16Z"},{"id":"wordfence:d174f856-d94a-42ed-b547-67699e175cd8","source":"wordfence","cve":"CVE-2024-7628","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d174f856-d94a-42ed-b547-67699e175cd8?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.15.2","to_inclusive":true,"patched_in":"4.15.3"}],"published":"2024-08-14T14:08:51Z","updated":"2024-08-15T02:30:38Z"},{"id":"wordfence:d175e862-64ea-4b7e-bf66-e1222efee6b6","source":"wordfence","cve":"CVE-2024-35714","title":"Idyllic <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d175e862-64ea-4b7e-bf66-e1222efee6b6?source=api-prod","affected":[{"type":"theme","slug":"idyllic","name":"Idyllic","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:38:51Z"},{"id":"wordfence:d1769ed5-5f56-4b70-af36-c60119f0a356","source":"wordfence","cve":"CVE-2024-29089","title":"Five Star Restaurant Menu <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1769ed5-5f56-4b70-af36-c60119f0a356?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:39:57Z"},{"id":"wordfence:d1772e79-85c7-4a8e-a5d8-8d73013e6de3","source":"wordfence","cve":"CVE-2015-1000005","title":"Candidate Application Form <= 1.3 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1772e79-85c7-4a8e-a5d8-8d73013e6de3?source=api-prod","affected":[{"type":"plugin","slug":"candidate-application-form","name":"candidate-application-form","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2015-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d178b2c9-a157-4e53-a7d7-940370cb3b57","source":"wordfence","cve":"CVE-2024-30547","title":"Header Image Slider <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d178b2c9-a157-4e53-a7d7-940370cb3b57?source=api-prod","affected":[{"type":"plugin","slug":"header-image-slider","name":"Header Image Slider","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:35:48Z"},{"id":"wordfence:d17aca2b-5ac6-46cd-a439-f492e6573a46","source":"wordfence","cve":"CVE-2024-12502","title":"My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d17aca2b-5ac6-46cd-a439-f492e6573a46?source=api-prod","affected":[{"type":"plugin","slug":"my-idx-home-search","name":"My IDX Home Search","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2024-12-13T15:56:33Z","updated":"2024-12-21T16:09:01Z"},{"id":"wordfence:d17d9610-d0fd-419d-a7ea-e9c313f1c542","source":"wordfence","cve":"CVE-2024-0604","title":"Best WordPress Gallery Plugin \u2013 FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d17d9610-d0fd-419d-a7ea-e9c313f1c542?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2024-02-14T00:00:00Z","updated":"2024-07-29T21:37:31Z"},{"id":"wordfence:d1813e3a-0c42-4ac6-a3ee-168912dfdc44","source":"wordfence","cve":"CVE-2024-9236","title":"Team \u2013 Team Members Showcase Plugin <= 4.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1813e3a-0c42-4ac6-a3ee-168912dfdc44?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2024-10-03T00:00:00Z","updated":"2025-05-30T18:50:53Z"},{"id":"wordfence:d1845942-2638-42db-9fdf-66890786ea0a","source":"wordfence","cve":"CVE-2024-51681","title":"WP Pocket URLs <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1845942-2638-42db-9fdf-66890786ea0a?source=api-prod","affected":[{"type":"plugin","slug":"wp-pocket-urls","name":"WP Pocket URLs","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T20:24:24Z"},{"id":"wordfence:d18684e3-0745-4415-a765-8c99af33aba6","source":"wordfence","cve":"CVE-2025-57944","title":"Skimlinks Affiliate Marketing Tool <= 1.3 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d18684e3-0745-4415-a765-8c99af33aba6?source=api-prod","affected":[{"type":"plugin","slug":"skimlinks","name":"Skimlinks Affiliate Marketing Tool","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:17:32Z"},{"id":"wordfence:d187a8d6-fa81-45c6-a107-f8b96b130e6c","source":"wordfence","cve":"CVE-2024-33944","title":"WooCommerce AWeber Newsletter Subscription <= 4.0.2 - Missing Authorization to Access Token Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d187a8d6-fa81-45c6-a107-f8b96b130e6c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-aweber-newsletter-subscription","name":"AWeber for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T18:53:06Z"},{"id":"wordfence:d1894596-b430-41b3-9d28-12c7dea7ff9b","source":"wordfence","cve":"CVE-2026-107744","title":"LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"4.4.11"}],"published":"2026-10-16T14:31:20Z","updated":"2026-10-17T03:43:30Z"},{"id":"wordfence:d1898b09-695a-4767-9047-b0343e18a62e","source":"wordfence","cve":"CVE-2025-69013","title":"Stratum Widgets for Elementor <= 1.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1898b09-695a-4767-9047-b0343e18a62e?source=api-prod","affected":[{"type":"plugin","slug":"stratum","name":"Stratum Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-12-27T00:00:00Z","updated":"2026-01-06T15:48:35Z"},{"id":"wordfence:d18c17f1-7b85-46d6-a92e-948be98adf87","source":"wordfence","cve":"","title":"MZ MBO Access <= 2.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d18c17f1-7b85-46d6-a92e-948be98adf87?source=api-prod","affected":[{"type":"plugin","slug":"mindbody-access-management","name":"MZ MBO Access","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d18d800b-647f-4706-9ec1-a8ea4e643965","source":"wordfence","cve":"CVE-2023-33927","title":"Multiple Page Generator Plugin \u2013 MPG <= 3.3.19 - Authenticated (Administrator+) SQL Injection in projects_list and total_projects","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d18d800b-647f-4706-9ec1-a8ea4e643965?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.3.20"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d18e9696-0f96-4478-9871-a93ac2976c11","source":"wordfence","cve":"CVE-2026-8689","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d18e9696-0f96-4478-9871-a93ac2976c11?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.11.14","to_inclusive":true,"patched_in":"3.11.15"}],"published":"2026-05-27T19:31:18Z","updated":"2026-05-28T07:43:43Z"},{"id":"wordfence:d18fd2a8-a95c-40e2-bf35-333ee853639d","source":"wordfence","cve":"CVE-2026-15275","title":"WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d18fd2a8-a95c-40e2-bf35-333ee853639d?source=api-prod","affected":[{"type":"plugin","slug":"wp-multi-store-locator-pro","name":"WP Multi Store Locator Pro","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-09-17T19:21:38Z","updated":"2026-09-18T07:40:05Z"},{"id":"wordfence:d1925082-eeee-4472-9721-c6205782d567","source":"wordfence","cve":"CVE-2021-24477","title":"Migrate Users <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1925082-eeee-4472-9721-c6205782d567?source=api-prod","affected":[{"type":"plugin","slug":"migrate-users","name":"Migrate Users","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d199e597-64ed-4dcc-a153-b5c8e4e9e93d","source":"wordfence","cve":"CVE-2023-48759","title":"JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d199e597-64ed-4dcc-a153-b5c8e4e9e93d?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.13.1"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d19a9c96-918f-4f19-82a9-badd5765cea3","source":"wordfence","cve":"CVE-2023-51684","title":"Easy Digital Downloads <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19a9c96-918f-4f19-82a9-badd5765cea3?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d19ac6fc-029f-4f19-913e-e082acecc594","source":"wordfence","cve":"CVE-2024-12132","title":"WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19ac6fc-029f-4f19-913e-e082acecc594?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-01-02T19:25:08Z","updated":"2025-01-03T08:22:21Z"},{"id":"wordfence:d19b433f-2245-4ba3-8f46-36a184c2454d","source":"wordfence","cve":"CVE-2022-40130","title":"WP-Polls <= 2.76.0 - Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19b433f-2245-4ba3-8f46-36a184c2454d?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.76.0","to_inclusive":true,"patched_in":"2.77.0"}],"published":"2022-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d19c0112-f205-4848-aa79-07b95c31a14c","source":"wordfence","cve":"CVE-2025-69112","title":"Planty <= 1.14.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19c0112-f205-4848-aa79-07b95c31a14c?source=api-prod","affected":[{"type":"theme","slug":"planty","name":"Planty","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:37:03Z"},{"id":"wordfence:d19d9234-2f74-41a9-8f7e-98da9e844e7c","source":"wordfence","cve":"CVE-2026-120579","title":"Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19d9234-2f74-41a9-8f7e-98da9e844e7c?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-11-07T00:14:08Z","updated":"2026-11-07T12:27:07Z"},{"id":"wordfence:d19df1f1-df64-4b4a-8dcb-8c76566fc2ec","source":"wordfence","cve":"CVE-2022-45844","title":"Organization chart <= 1.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19df1f1-df64-4b4a-8dcb-8c76566fc2ec?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2022-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d19e6433-c248-44ff-97a9-0f351eb77763","source":"wordfence","cve":"CVE-2023-6626","title":"Product Enquiry for WooCommerce <= 3.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19e6433-c248-44ff-97a9-0f351eb77763?source=api-prod","affected":[{"type":"plugin","slug":"gm-woocommerce-quote-popup","name":"Product Enquiry for WooCommerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-12-28T00:00:00Z","updated":"2024-02-06T13:48:38Z"},{"id":"wordfence:d19eeb42-2438-4126-8c60-14839baceff0","source":"wordfence","cve":"CVE-2023-0069","title":"WPaudio MP3 Player <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d19eeb42-2438-4126-8c60-14839baceff0?source=api-prod","affected":[{"type":"plugin","slug":"wpaudio-mp3-player","name":"WPaudio MP3 Player","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1a14fc2-cebe-4a0e-92b0-af2a9c805401","source":"wordfence","cve":"CVE-2024-33546","title":"WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.10 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a14fc2-cebe-4a0e-92b0-af2a9c805401?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.0.10","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:24:41Z"},{"id":"wordfence:d1a3bc4b-cc17-4728-b242-13841b5f7660","source":"wordfence","cve":"CVE-2026-4119","title":"Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a3bc4b-cc17-4728-b242-13841b5f7660?source=api-prod","affected":[{"type":"plugin","slug":"create-db-tables","name":"Create DB Tables","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:08:50Z","updated":"2026-04-22T07:45:41Z"},{"id":"wordfence:d1a6345d-941f-4475-8b5f-d3cafed2ba73","source":"wordfence","cve":"CVE-2025-23975","title":"Botnet Attack Blocker <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a6345d-941f-4475-8b5f-d3cafed2ba73?source=api-prod","affected":[{"type":"plugin","slug":"botnet-attack-blocker","name":"Botnet Attack Blocker","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-24T15:59:15Z"},{"id":"wordfence:d1a6bdc8-ae74-4d0b-9c47-f4bf69158a44","source":"wordfence","cve":"CVE-2023-28986","title":"Affiliates Manager <= 2.9.20 - Cross-Site Request Forgery via process_bulk_action()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a6bdc8-ae74-4d0b-9c47-f4bf69158a44?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.20","to_inclusive":true,"patched_in":"2.9.21"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1a78208-0909-4134-bc78-19e395fe7e24","source":"wordfence","cve":"CVE-2026-12090","title":"Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a78208-0909-4134-bc78-19e395fe7e24?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-06-30T15:19:52Z","updated":"2026-07-01T03:43:38Z"},{"id":"wordfence:d1a7e39a-5fd1-4bb3-9cd9-4bded794f8f0","source":"wordfence","cve":"CVE-2018-5288","title":"GD Rating System <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a7e39a-5fd1-4bb3-9cd9-4bded794f8f0?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1abc6ef-2488-4a99-886c-3194e47b22d0","source":"wordfence","cve":"CVE-2025-28999","title":"WooCommerce Shop Page Builder <= 2.27.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1abc6ef-2488-4a99-886c-3194e47b22d0?source=api-prod","affected":[{"type":"plugin","slug":"dzs-wootable","name":"WooCommerce Shop Page Builder","from":"*","from_inclusive":true,"to":"2.27.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-21T21:32:09Z"},{"id":"wordfence:d1ae714b-4811-4ffa-ba8d-82ad6b948704","source":"wordfence","cve":"CVE-2025-23740","title":"Easy School Registration <= 3.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ae714b-4811-4ffa-ba8d-82ad6b948704?source=api-prod","affected":[{"type":"plugin","slug":"easy-school-registration","name":"Easy School Registration","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:35:42Z"},{"id":"wordfence:d1affd1b-a0b3-46c9-8b8e-e0e00b77e15c","source":"wordfence","cve":"CVE-2026-97290","title":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1affd1b-a0b3-46c9-8b8e-e0e00b77e15c?source=api-prod","affected":[{"type":"plugin","slug":"photonic","name":"Photonic Gallery & Lightbox for Flickr, SmugMug & Others","from":"*","from_inclusive":true,"to":"3.36","to_inclusive":true,"patched_in":"3.37"}],"published":"2026-09-30T13:34:47Z","updated":"2026-10-09T00:01:31Z"},{"id":"wordfence:d1b3a6d3-94d6-47f1-a3c8-5eb33b1ad392","source":"wordfence","cve":"CVE-2025-54048","title":"Custom API for WP <= 4.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1b3a6d3-94d6-47f1-a3c8-5eb33b1ad392?source=api-prod","affected":[{"type":"plugin","slug":"custom-api-for-wp","name":"Custom API for WP","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:53:15Z"},{"id":"wordfence:d1b3d4d5-9d2b-4924-a830-27c07fa1ba98","source":"wordfence","cve":"CVE-2024-3810","title":"Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1b3d4d5-9d2b-4924-a830-27c07fa1ba98?source=api-prod","affected":[{"type":"plugin","slug":"salient-shortcodes","name":"Salient Shortcodes","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-18T05:40:03Z"},{"id":"wordfence:d1b4841b-c701-4915-9592-518e68179d20","source":"wordfence","cve":"CVE-2022-3462","title":"Highlight Focus <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1b4841b-c701-4915-9592-518e68179d20?source=api-prod","affected":[{"type":"plugin","slug":"highlight-focus","name":"Highlight Focus","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1b4ea18-0937-4bd4-b161-a3780e6c6749","source":"wordfence","cve":"CVE-2025-6324","title":"Easy Invoice <= 2.0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1b4ea18-0937-4bd4-b161-a3780e6c6749?source=api-prod","affected":[{"type":"plugin","slug":"easy-invoice","name":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-19T16:44:32Z"},{"id":"wordfence:d1b92249-bc18-4939-aefa-286667f6c003","source":"wordfence","cve":"CVE-2023-3706","title":"ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1b92249-bc18-4939-aefa-286667f6c003?source=api-prod","affected":[{"type":"plugin","slug":"activitypub","name":"ActivityPub","from":"*","from_inclusive":true,"to":"0.17.0","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1ba4b18-ff46-45ef-b7d4-0a314cf2d74c","source":"wordfence","cve":"CVE-2023-41950","title":"Laposta Signup Basic <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ba4b18-ff46-45ef-b7d4-0a314cf2d74c?source=api-prod","affected":[{"type":"plugin","slug":"laposta-signup-basic","name":"Laposta Signup Basic","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1bc3fe4-ebca-4379-b920-6602fc06be4d","source":"wordfence","cve":"CVE-2025-32123","title":"HTML5 Video Player with Playlist & Multiple Skins <= 5.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1bc3fe4-ebca-4379-b920-6602fc06be4d?source=api-prod","affected":[{"type":"plugin","slug":"lbg-vp2-html5-rightside","name":"HTML5 Video Player with Playlist & Multiple Skins","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:55:42Z"},{"id":"wordfence:d1bd0569-9ee8-4319-80b3-6470c6dbdb76","source":"wordfence","cve":"CVE-2026-89003","title":"WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1bd0569-9ee8-4319-80b3-6470c6dbdb76?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.26","to_inclusive":true,"patched_in":"2.8.27"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-29T19:56:50Z"},{"id":"wordfence:d1bf83df-7a1f-4572-9c8d-1013750d51d7","source":"wordfence","cve":"CVE-2023-4995","title":"Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1bf83df-7a1f-4572-9c8d-1013750d51d7?source=api-prod","affected":[{"type":"plugin","slug":"embed-calendly-scheduling","name":"EMC \u2013 Embed Calendly Scheduling With Ease","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1c00b78-b525-4b6c-b232-7d24ef25c540","source":"wordfence","cve":"CVE-2025-2055","title":"MapPress Maps for WordPress <= 2.94.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c00b78-b525-4b6c-b232-7d24ef25c540?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.94.8","to_inclusive":true,"patched_in":"2.94.9"}],"published":"2025-03-13T00:00:00Z","updated":"2026-09-17T00:02:25Z"},{"id":"wordfence:d1c1847c-8cc9-4080-8da5-7364c4358034","source":"wordfence","cve":"CVE-2026-8707","title":"NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c1847c-8cc9-4080-8da5-7364c4358034?source=api-prod","affected":[{"type":"plugin","slug":"product-icon-badge","name":"NS Product icon badge","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:14Z","updated":"2026-05-27T05:31:31Z"},{"id":"wordfence:d1c3ddae-046a-4080-ac2b-90fb89fbff7b","source":"wordfence","cve":"CVE-2023-0368","title":"Responsive Tabs For WPBakery Page Builder <= 1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c3ddae-046a-4080-ac2b-90fb89fbff7b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs-for-wpbakery","name":"Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1c4052b-e8e9-47da-8a36-c67f16ab2553","source":"wordfence","cve":"CVE-2025-48271","title":"Leadinfo <= 1.1 - Missing Authorization to Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c4052b-e8e9-47da-8a36-c67f16ab2553?source=api-prod","affected":[{"type":"plugin","slug":"leadinfo","name":"Leadinfo","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-05-25T00:00:00Z","updated":"2025-05-30T20:22:58Z"},{"id":"wordfence:d1c43e93-69a3-407e-860e-ab25af5d7177","source":"wordfence","cve":"CVE-2023-0711","title":"Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_state","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c43e93-69a3-407e-860e-ab25af5d7177?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1c514dd-132f-4e42-a512-bb0cf24da937","source":"wordfence","cve":"CVE-2024-44062","title":"Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c514dd-132f-4e42-a512-bb0cf24da937?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-08-29T00:00:00Z","updated":"2024-10-04T16:18:58Z"},{"id":"wordfence:d1c597ac-9ac9-4eef-be83-16dc36c32463","source":"wordfence","cve":"CVE-2025-57914","title":"Deliver via Shipos for WooCommerce <= 3.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c597ac-9ac9-4eef-be83-16dc36c32463?source=api-prod","affected":[{"type":"plugin","slug":"wc-shipos-delivery","name":"Deliver via Shipos for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-12-11T20:44:32Z"},{"id":"wordfence:d1c7df8e-2f82-4474-88ef-8c8ddaeb4656","source":"wordfence","cve":"CVE-2026-4117","title":"CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c7df8e-2f82-4474-88ef-8c8ddaeb4656?source=api-prod","affected":[{"type":"plugin","slug":"calj","name":"CalJ Shabbat Times","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-04-21T19:08:40Z","updated":"2026-09-18T19:48:42Z"},{"id":"wordfence:d1c80d7c-0eab-4437-ad03-9789d34638a1","source":"wordfence","cve":"CVE-2007-4544","title":"WordPress MU <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c80d7c-0eab-4437-ad03-9789d34638a1?source=api-prod","affected":[{"type":"core","slug":"wpmu","name":"WordPress MU","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2007-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1c9da9c-8a92-44fd-a35a-4c6d3777901f","source":"wordfence","cve":"CVE-2020-35934","title":"Advanced Access Manager <= 6.6.1 - Authenticated Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c9da9c-8a92-44fd-a35a-4c6d3777901f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":true,"patched_in":"6.6.2"}],"published":"2020-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1cb4c3d-f4c0-4464-b14d-ce45151bd661","source":"wordfence","cve":"CVE-2025-23531","title":"RSVPMaker Volunteer Roles <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cb4c3d-f4c0-4464-b14d-ce45151bd661?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker-volunteer-roles","name":"RSVPMaker Volunteer Roles","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:41:17Z"},{"id":"wordfence:d1cc604a-b3dc-4dc1-b20b-4021b5b7d426","source":"wordfence","cve":"CVE-2015-9352","title":"WP-Polls <= 2.71 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cc604a-b3dc-4dc1-b20b-4021b5b7d426?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.71","to_inclusive":true,"patched_in":"2.72"}],"published":"2019-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1cd3de2-16ca-4f95-ad6f-47cfbe00c959","source":"wordfence","cve":"CVE-2026-91109","title":"Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cd3de2-16ca-4f95-ad6f-47cfbe00c959?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.31","to_inclusive":true,"patched_in":"1.6.12.33"}],"published":"2026-09-30T15:10:42Z","updated":"2026-10-01T03:28:24Z"},{"id":"wordfence:d1cd5209-7959-49ae-a363-5fb4f06e2aec","source":"wordfence","cve":"CVE-2023-5340","title":"Five Star Restaurant Menu and Food Ordering <= 2.4.10 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cd5209-7959-49ae-a363-5fb4f06e2aec?source=api-prod","affected":[{"type":"plugin","slug":"food-and-drink-menu","name":"Five Star Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1cf560e-8d55-4ccd-b939-4186cee0c0a9","source":"wordfence","cve":"CVE-2025-68502","title":"JetPopup <= 2.0.20.1 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1cf560e-8d55-4ccd-b939-4186cee0c0a9?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.20.1","to_inclusive":true,"patched_in":"2.0.20.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T21:47:02Z"},{"id":"wordfence:d1d113fd-efb4-4918-a5df-153e549836d6","source":"wordfence","cve":"CVE-2025-47604","title":"Inline Related Posts <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d113fd-efb4-4918-a5df-153e549836d6?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-26T15:06:56Z"},{"id":"wordfence:d1d21339-3a86-4bee-be86-2d2ab9190b26","source":"wordfence","cve":"CVE-2024-10711","title":"WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d21339-3a86-4bee-be86-2d2ab9190b26?source=api-prod","affected":[{"type":"plugin","slug":"ithemelandco-woo-report","name":"REPORTiT \u2013 Advanced Reporting for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-11-04T19:57:55Z","updated":"2024-11-05T08:31:37Z"},{"id":"wordfence:d1d32a1d-076e-4a93-a678-145d154edb3a","source":"wordfence","cve":"CVE-2024-32675","title":"Order Limit for WooCommerce <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d32a1d-076e-4a93-a678-145d154edb3a?source=api-prod","affected":[{"type":"plugin","slug":"wc-order-limit-lite","name":"Order Limit for WooCommerce (Free Version)","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-04-17T00:00:00Z","updated":"2024-04-23T15:02:34Z"},{"id":"wordfence:d1d571e3-cf6d-4e9b-a3d7-e7e19497b5a9","source":"wordfence","cve":"CVE-2026-8844","title":"Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d571e3-cf6d-4e9b-a3d7-e7e19497b5a9?source=api-prod","affected":[{"type":"plugin","slug":"responsive-checker-real-time","name":"Responsive Check","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:02Z","updated":"2026-05-27T05:31:31Z"},{"id":"wordfence:d1d9166d-2715-4aa6-bf72-313708ac2910","source":"wordfence","cve":"CVE-2025-30532","title":"Weather Layer <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1d9166d-2715-4aa6-bf72-313708ac2910?source=api-prod","affected":[{"type":"plugin","slug":"weather-layer","name":"Weather Layer","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:45:22Z"},{"id":"wordfence:d1dd82a7-c9eb-4bc6-a9ae-0085392c68c5","source":"wordfence","cve":"CVE-2025-15677","title":"GeoDirectory <= 2.8.109 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1dd82a7-c9eb-4bc6-a9ae-0085392c68c5?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.109","to_inclusive":true,"patched_in":"2.8.110"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-15T21:13:41Z"},{"id":"wordfence:d1de5088-c307-4e61-91cf-082c00f93c5b","source":"wordfence","cve":"CVE-2025-62112","title":"Import into Easy Property Listings <= 2.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1de5088-c307-4e61-91cf-082c00f93c5b?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings-xml-csv-import","name":"Import into Easy Property Listings","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T20:16:30Z"},{"id":"wordfence:d1e041f0-3019-4d1f-b1a3-b40275c0966a","source":"wordfence","cve":"CVE-2025-11729","title":"PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e041f0-3019-4d1f-b1a3-b40275c0966a?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.15","to_inclusive":true,"patched_in":"1.9.16"}],"published":"2026-08-18T11:03:47Z","updated":"2026-08-18T23:26:10Z"},{"id":"wordfence:d1e0d59b-903e-466b-9892-a2cee6f7a53f","source":"wordfence","cve":"CVE-2026-57369","title":"Themify Builder <= 7.7.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e0d59b-903e-466b-9892-a2cee6f7a53f?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.7.4","to_inclusive":true,"patched_in":"7.7.5"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:51:44Z"},{"id":"wordfence:d1e30342-143d-4ea3-9947-b5e5c55725a7","source":"wordfence","cve":"CVE-2015-1204","title":"Slimstat Analytics <= 3.9.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e30342-143d-4ea3-9947-b5e5c55725a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":false,"patched_in":"3.9.3"}],"published":"2015-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1e37bca-4fca-4ec4-b48b-b423ec7e129c","source":"wordfence","cve":"CVE-2024-13220","title":"Google Map Professional <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e37bca-4fca-4ec4-b48b-b423ec7e129c?source=api-prod","affected":[{"type":"plugin","slug":"google-map-professional","name":"WordPress Google Map Professional (Map In Your Language)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T18:59:54Z"},{"id":"wordfence:d1e38cdc-7bc5-4963-9ebe-efd6c6ea228d","source":"wordfence","cve":"CVE-2021-24699","title":"Easy Media Download <= 1.1.5 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e38cdc-7bc5-4963-9ebe-efd6c6ea228d?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-download","name":"Easy Media Download","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2021-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1e3a7d8-d303-4638-8dc9-c62302cfa5fb","source":"wordfence","cve":"CVE-2026-8904","title":"FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e3a7d8-d303-4638-8dc9-c62302cfa5fb?source=api-prod","affected":[{"type":"plugin","slug":"fastpicker","name":"FastPicker, an order picker and order management system (oms) for WooCommerce on steroids","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:05:35Z","updated":"2026-06-09T03:41:23Z"},{"id":"wordfence:d1e5131a-9e72-441d-971c-8b9af35cf3f7","source":"wordfence","cve":"CVE-2024-4371","title":"CoDesigner WooCommerce Builder for Elementor \u2013 Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e5131a-9e72-441d-971c-8b9af35cf3f7?source=api-prod","affected":[{"type":"plugin","slug":"woolementor","name":"CoDesigner \u2013 All in One Elementor WooCommerce Builder","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5"}],"published":"2024-06-12T19:54:17Z","updated":"2024-06-13T08:31:33Z"},{"id":"wordfence:d1e5157d-7e07-4dd7-9c41-9c8a11150745","source":"wordfence","cve":"CVE-2025-14430","title":"Brook <= 2.9.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e5157d-7e07-4dd7-9c41-9c8a11150745?source=api-prod","affected":[{"type":"theme","slug":"brook","name":"Brook - Agency Business Creative WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T19:24:22Z"},{"id":"wordfence:d1e65ea8-b4d2-4912-a71a-7b7142311075","source":"wordfence","cve":"CVE-2025-62123","title":"Gmail SMTP <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e65ea8-b4d2-4912-a71a-7b7142311075?source=api-prod","affected":[{"type":"plugin","slug":"wp-gmail-smtp","name":"WP Gmail SMTP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:27:23Z"},{"id":"wordfence:d1e8412a-f2fb-4f90-9847-1e4043dda480","source":"wordfence","cve":"CVE-2025-22654","title":"Simplified Plugin <= 1.0.6 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e8412a-f2fb-4f90-9847-1e4043dda480?source=api-prod","affected":[{"type":"plugin","slug":"simplified","name":"Simplified Plugin","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-01-03T00:00:00Z","updated":"2025-06-25T14:11:18Z"},{"id":"wordfence:d1e90871-b178-48bc-8355-8b2415d2f2ab","source":"wordfence","cve":"CVE-2026-66582","title":"TranslatePress \u2013 Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e90871-b178-48bc-8355-8b2415d2f2ab?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:26:13Z"},{"id":"wordfence:d1e947a7-7449-4795-8016-b34811c0c369","source":"wordfence","cve":"CVE-2026-14314","title":"PeproDev WooCommerce Receipt Uploader <= 2.14.0 - Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e947a7-7449-4795-8016-b34811c0c369?source=api-prod","affected":[{"type":"plugin","slug":"pepro-bacs-receipt-upload-for-woocommerce","name":"PeproDev Receipt Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2026-07-29T00:00:00Z","updated":"2026-10-21T00:01:34Z"},{"id":"wordfence:d1ed7ed0-5bcd-42ca-ab56-70ebd3d3c63a","source":"wordfence","cve":"CVE-2014-4532","title":"GarageSale < 1.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ed7ed0-5bcd-42ca-ab56-70ebd3d3c63a?source=api-prod","affected":[{"type":"plugin","slug":"garagesale","name":"GarageSale","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1ee155a-3b4d-4b32-a1ec-86e0575e0ad8","source":"wordfence","cve":"CVE-2026-1912","title":"Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ee155a-3b4d-4b32-a1ec-86e0575e0ad8?source=api-prod","affected":[{"type":"plugin","slug":"citations-tools","name":"Citations tools","from":"*","from_inclusive":true,"to":"0.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T16:19:01Z","updated":"2026-02-14T04:35:42Z"},{"id":"wordfence:d1efe450-d081-421e-95c3-f2d79c328a33","source":"wordfence","cve":"CVE-2022-2379","title":"Easy Student Results <= 2.2.8 -  Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1efe450-d081-421e-95c3-f2d79c328a33?source=api-prod","affected":[{"type":"plugin","slug":"easy-student-results","name":"Easy Student Results","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1f308cc-2ea9-4c67-9c1b-4f2e4676b2c2","source":"wordfence","cve":"CVE-2026-61986","title":"Contest Gallery \u2013 Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f308cc-2ea9-4c67-9c1b-4f2e4676b2c2?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"30.0.5","to_inclusive":true,"patched_in":"30.0.6"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:29:45Z"},{"id":"wordfence:d1f3a9e4-9bdf-4342-a735-72e70219daeb","source":"wordfence","cve":"CVE-2026-116622","title":"Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f3a9e4-9bdf-4342-a735-72e70219daeb?source=api-prod","affected":[{"type":"plugin","slug":"food-store","name":"Food Store \u2013 Online Food Delivery & Pickup","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-29T18:06:10Z","updated":"2026-10-30T06:47:32Z"},{"id":"wordfence:d1f41400-5c59-444d-9c1e-121e83449521","source":"wordfence","cve":"CVE-2024-0377","title":"LifterLMS \u2013 WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f41400-5c59-444d-9c1e-121e83449521?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:31Z"},{"id":"wordfence:d1f48424-6d1b-4fc3-a20b-f6f1e066da86","source":"wordfence","cve":"CVE-2026-16965","title":"Solace Extra <= 1.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f48424-6d1b-4fc3-a20b-f6f1e066da86?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:49:42Z"},{"id":"wordfence:d1f51f00-9991-49b3-950a-4a12667991e4","source":"wordfence","cve":"CVE-2026-2292","title":"Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f51f00-9991-49b3-950a-4a12667991e4?source=api-prod","affected":[{"type":"plugin","slug":"morkva-ua-shipping","name":"morkva UA Shipping \u2013 Nova Poshta, Ukrposhta, Rozetka, Nova Global","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.7.10"}],"published":"2026-03-03T12:44:45Z","updated":"2026-03-04T01:21:59Z"},{"id":"wordfence:d1f5e31b-ef43-4fee-840f-873089584a97","source":"wordfence","cve":"CVE-2026-24531","title":"Prowess <= 2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f5e31b-ef43-4fee-840f-873089584a97?source=api-prod","affected":[{"type":"theme","slug":"prowess","name":"Prowess - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-25T00:00:00Z","updated":"2026-01-27T19:02:57Z"},{"id":"wordfence:d1f86c9d-38dc-4d5d-af37-9443348fe1e8","source":"wordfence","cve":"","title":"Redirect By Cookie <= 1.06 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f86c9d-38dc-4d5d-af37-9443348fe1e8?source=api-prod","affected":[{"type":"plugin","slug":"redirect-by-cookie","name":"Redirect By Cookie","from":"*","from_inclusive":true,"to":"1.06","to_inclusive":true,"patched_in":"1.07"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1f957ce-7bb0-4701-8b2a-522211c408d8","source":"wordfence","cve":"CVE-2023-41949","title":"iFolders <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f957ce-7bb0-4701-8b2a-522211c408d8?source=api-prod","affected":[{"type":"plugin","slug":"ifolders","name":"iFolders \u2013 Ultimate Folder Organizer for Media Library, Pages, Posts and Users","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d1f9a46c-5702-448a-b97b-3e2ba107737a","source":"wordfence","cve":"CVE-2024-6412","title":"HTML Forms \u2013 Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f9a46c-5702-448a-b97b-3e2ba107737a?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.3.33","to_inclusive":true,"patched_in":"1.3.34"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-09T19:34:40Z"},{"id":"wordfence:d1fb652a-4490-43da-b069-b35d2f251b40","source":"wordfence","cve":"CVE-2026-113674","title":"GeoDirectory <= 2.8.193 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1fb652a-4490-43da-b069-b35d2f251b40?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.193","to_inclusive":true,"patched_in":"2.8.194"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T01:18:39Z"},{"id":"wordfence:d1ff2dee-1fa6-4093-9c96-f573f4fa2ba9","source":"wordfence","cve":"CVE-2026-12865","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery < 1.8.44 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d1ff2dee-1fa6-4093-9c96-f573f4fa2ba9?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.44","to_inclusive":false,"patched_in":"1.8.44"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:30:20Z"},{"id":"wordfence:d2031289-eaf3-4a1b-8771-769c08d99ca3","source":"wordfence","cve":"","title":"Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2031289-eaf3-4a1b-8771-769c08d99ca3?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.55","to_inclusive":true,"patched_in":"1.3.56"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d203f477-ca42-40a2-842e-9af98dd9d410","source":"wordfence","cve":"CVE-2025-49321","title":"Eventin <= 4.0.28 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d203f477-ca42-40a2-842e-9af98dd9d410?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"4.0.29"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:31:52Z"},{"id":"wordfence:d204ed58-efb2-4383-aa0f-cbad0bae4d02","source":"wordfence","cve":"CVE-2024-12100","title":"Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d204ed58-efb2-4383-aa0f-cbad0bae4d02?source=api-prod","affected":[{"type":"plugin","slug":"bitcoin-lightning-publisher","name":"Bitcoin Lightning Publisher for WordPress","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-23T16:50:10Z","updated":"2024-12-24T05:23:45Z"},{"id":"wordfence:d2053171-a213-43bf-bd15-2f42a178c3a8","source":"wordfence","cve":"CVE-2025-67589","title":"WooCommerce PDF Invoices & Packing Slips <= 4.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2053171-a213-43bf-bd15-2f42a178c3a8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-12-07T00:00:00Z","updated":"2025-12-11T15:57:16Z"},{"id":"wordfence:d20830a9-f660-4d16-8b11-a03d17d85bba","source":"wordfence","cve":"CVE-2025-53212","title":"Revolution Video Player With Bottom Playlist <= 2.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20830a9-f660-4d16-8b11-a03d17d85bba?source=api-prod","affected":[{"type":"plugin","slug":"revolution_video_player","name":"Revolution Video Player With Bottom Playlist WordPress Plugin - YouTube/Vimeo/Self-Hosted Support","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:41:58Z"},{"id":"wordfence:d20b2d00-054e-4772-a5a5-b7b33063043c","source":"wordfence","cve":"CVE-2026-19513","title":"Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20b2d00-054e-4772-a5a5-b7b33063043c?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-09-01T01:18:46Z","updated":"2026-09-01T13:29:50Z"},{"id":"wordfence:d20c09ee-bd75-4f96-b0b9-2cf6f87aa4cb","source":"wordfence","cve":"CVE-2024-12163","title":"Goodlayers Core <= 2.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20c09ee-bd75-4f96-b0b9-2cf6f87aa4cb?source=api-prod","affected":[{"type":"plugin","slug":"goodlayers-core","name":"Goodlayers Core","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:35:09Z"},{"id":"wordfence:d20e1313-579c-4b31-aa2a-090b0b05fb67","source":"wordfence","cve":"CVE-2026-24539","title":"Protecci\u00f3n de datos \u2013 RGPD <= 0.68 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20e1313-579c-4b31-aa2a-090b0b05fb67?source=api-prod","affected":[{"type":"plugin","slug":"proteccion-datos-rgpd","name":"Protecci\u00f3n de datos \u2013 RGPD","from":"*","from_inclusive":true,"to":"0.68","to_inclusive":true,"patched_in":"0.69"}],"published":"2026-01-24T00:00:00Z","updated":"2026-01-28T13:44:02Z"},{"id":"wordfence:d20eb274-e578-445f-95f4-5e677d9ad7f3","source":"wordfence","cve":"","title":"W3 Total Cache plugin <= 0.9.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20eb274-e578-445f-95f4-5e677d9ad7f3?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.7.3","to_inclusive":true,"patched_in":"0.9.7.4"}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d20ff1a8-8794-41e1-9e66-1cda90f9ff77","source":"wordfence","cve":"CVE-2023-40600","title":"EWWW Image Optimizer <= 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20ff1a8-8794-41e1-9e66-1cda90f9ff77?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d20ffc7c-0e12-45ec-940f-a42655093021","source":"wordfence","cve":"CVE-2021-34645","title":"Shopping Cart & eCommerce Store <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d20ffc7c-0e12-45ec-940f-a42655093021?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d21187bc-5bd0-49b9-9ef2-6654263cd93c","source":"wordfence","cve":"CVE-2025-13311","title":"Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21187bc-5bd0-49b9-9ef2-6654263cd93c?source=api-prod","affected":[{"type":"plugin","slug":"just-highlight","name":"Just Highlight","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:13:42Z","updated":"2025-11-25T07:28:27Z"},{"id":"wordfence:d21209a7-efed-4526-8dd6-199e0fdf8657","source":"wordfence","cve":"CVE-2024-0561","title":"Ultimate Posts Widget <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21209a7-efed-4526-8dd6-199e0fdf8657?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-posts-widget","name":"Ultimate Posts Widget","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2024-02-13T00:00:00Z","updated":"2024-02-22T14:06:44Z"},{"id":"wordfence:d212c19d-fca9-4daf-95f4-5b3ac302e817","source":"wordfence","cve":"CVE-2022-41839","title":"LoginPress | Custom Login Page Customizer <= 1.6.2 - Missing Authorization to Settings Changes","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d212c19d-fca9-4daf-95f4-5b3ac302e817?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2137662-d328-4da7-986a-341ff1bdca63","source":"wordfence","cve":"","title":"iThemes Security < 3.4.4 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2137662-d328-4da7-986a-341ff1bdca63?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":false,"patched_in":"3.4.4"}],"published":"2012-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2165d61-dc86-4893-91c4-85f0a577fc1c","source":"wordfence","cve":"CVE-2022-25307","title":"WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via platform","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2165d61-dc86-4893-91c4-85f0a577fc1c?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.1.5","to_inclusive":true,"patched_in":"13.1.6"}],"published":"2022-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d216f8ea-2253-475d-9d23-9a83bfa2c21f","source":"wordfence","cve":"CVE-2017-12200","title":"Ultimate Product Catalog <= 4.2.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d216f8ea-2253-475d-9d23-9a83bfa2c21f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"4.2.12"}],"published":"2017-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2183a22-fba5-48d2-a68a-6914f04fb902","source":"wordfence","cve":"CVE-2024-31944","title":"WooCommerce UPS Shipping \u2013 Live Rates and Access Points <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2183a22-fba5-48d2-a68a-6914f04fb902?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping-ups","name":"Shipping Live Rates and Access Points for UPS for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T14:40:19Z"},{"id":"wordfence:d21a12b4-2f9d-4ae3-a5f6-1ba90fab43a2","source":"wordfence","cve":"CVE-2025-4591","title":"Weluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21a12b4-2f9d-4ae3-a5f6-1ba90fab43a2?source=api-prod","affected":[{"type":"plugin","slug":"weluka-lite","name":"Weluka Lite","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T14:26:35Z","updated":"2025-05-15T03:21:39Z"},{"id":"wordfence:d21aeeb6-2e7d-426e-82c5-ff65e33bc5cb","source":"wordfence","cve":"CVE-2024-8546","title":"ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21aeeb6-2e7d-426e-82c5-ff65e33bc5cb?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2024-09-24T23:43:47Z","updated":"2024-09-25T12:44:12Z"},{"id":"wordfence:d21b09f2-6766-4f55-9745-ae9fd4a0d88c","source":"wordfence","cve":"CVE-2024-4534","title":"KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21b09f2-6766-4f55-9745-ae9fd4a0d88c?source=api-prod","affected":[{"type":"plugin","slug":"kkprogressbar","name":"KKProgressbar2 Free \u2013 advanced progress bars","from":"*","from_inclusive":true,"to":"1.1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:28:06Z"},{"id":"wordfence:d21bebcc-8dba-407d-8a3a-b91d3cddd38f","source":"wordfence","cve":"","title":"WP Ultimate CSV Importer  <= 6.4.0 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21bebcc-8dba-407d-8a3a-b91d3cddd38f?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d21c7537-8437-43aa-ab52-9e14d27a6e7f","source":"wordfence","cve":"CVE-2024-11926","title":"Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21c7537-8437-43aa-ab52-9e14d27a6e7f?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T11:09:31Z"},{"id":"wordfence:d21ca709-183f-4dd1-849c-f1b2a4f7ec43","source":"wordfence","cve":"CVE-2023-4779","title":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21ca709-183f-4dd1-849c-f1b2a4f7ec43?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20230811","to_inclusive":true,"patched_in":"20230901"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d21cf285-9d75-43a2-9e81-67116f0bf896","source":"wordfence","cve":"CVE-2019-25224","title":"WP Database Backup < 5.2 - Unauthenticated OS Command Injection","severity":"critical","cvss":9.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2019-04-24T00:00:00Z","updated":"2025-07-25T02:23:58Z"},{"id":"wordfence:d21dc02f-789c-497e-9d01-02fa49bf9e30","source":"wordfence","cve":"CVE-2021-4418","title":"Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21dc02f-789c-497e-9d01-02fa49bf9e30?source=api-prod","affected":[{"type":"plugin","slug":"custom-css-js-php","name":"Custom css-js-php","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2021-06-08T00:00:00Z","updated":"2024-09-10T17:20:05Z"},{"id":"wordfence:d22013e5-896a-4dcb-bbe4-e6be7d697816","source":"wordfence","cve":"CVE-2024-27972","title":"WP Fusion Lite <= 3.41.24 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d22013e5-896a-4dcb-bbe4-e6be7d697816?source=api-prod","affected":[{"type":"plugin","slug":"wp-fusion-lite","name":"WP Fusion Lite \u2013 Marketing Automation and CRM Integration for WordPress","from":"*","from_inclusive":true,"to":"3.41.24","to_inclusive":true,"patched_in":"3.42.10"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:29:45Z"},{"id":"wordfence:d22134ec-00ca-4672-b9b1-1b1efad13aeb","source":"wordfence","cve":"CVE-2024-5077","title":"Wp EMember <= 10.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d22134ec-00ca-4672-b9b1-1b1efad13aeb?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.5","to_inclusive":true,"patched_in":"10.6.6"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T19:52:40Z"},{"id":"wordfence:d222ef6d-cdec-482e-92ba-65eeabbcdeae","source":"wordfence","cve":"CVE-2025-1911","title":"Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function","severity":"low","cvss":2.7,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d222ef6d-cdec-482e-92ba-65eeabbcdeae?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-03-25T23:22:17Z","updated":"2025-03-26T11:55:53Z"},{"id":"wordfence:d2230151-fde2-43d6-8bff-0d2ffd559ab3","source":"wordfence","cve":"CVE-2026-1924","title":"Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2230151-fde2-43d6-8bff-0d2ffd559ab3?source=api-prod","affected":[{"type":"plugin","slug":"aruba-hispeed-cache","name":"Aruba HiSpeed Cache","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-04-09T12:50:15Z","updated":"2026-07-30T17:27:11Z"},{"id":"wordfence:d223de07-6377-491f-8d2c-9c31aa814792","source":"wordfence","cve":"CVE-2023-2256","title":"PPOM for WooCommerce <= 32.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d223de07-6377-491f-8d2c-9c31aa814792?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"32.0.6","to_inclusive":true,"patched_in":"32.0.7"}],"published":"2023-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d224151c-0fe2-4032-a847-39628cc2f520","source":"wordfence","cve":"CVE-2025-9620","title":"Seo Monster <= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d224151c-0fe2-4032-a847-39628cc2f520?source=api-prod","affected":[{"type":"plugin","slug":"seo-monster","name":"Seo Monster","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:50:58Z","updated":"2025-09-11T07:24:59Z"},{"id":"wordfence:d2246fac-0d95-4ff5-ad1e-aa1fefa03b4d","source":"wordfence","cve":"CVE-2024-13516","title":"Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2246fac-0d95-4ff5-ad1e-aa1fefa03b4d?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T05:33:50Z"},{"id":"wordfence:d225dee1-305c-4378-bc07-192347a0c838","source":"wordfence","cve":"CVE-2024-1797","title":"WP ULike \u2013 Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d225dee1-305c-4378-bc07-192347a0c838?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:42Z"},{"id":"wordfence:d2266254-9281-4859-8630-f7bb5c0ead19","source":"wordfence","cve":"CVE-2024-7857","title":"Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2266254-9281-4859-8630-f7bb5c0ead19?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.2.2","to_inclusive":true,"patched_in":"8.2.3"}],"published":"2024-08-28T00:00:00Z","updated":"2025-01-31T20:30:35Z"},{"id":"wordfence:d2278347-d961-47d7-b89d-61a82441597c","source":"wordfence","cve":"CVE-2022-27628","title":"WZone - Lite <= 3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2278347-d961-47d7-b89d-61a82441597c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-amazon-affiliates-light-version","name":"WZone \u2013 Lite Version","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d227d4e4-2899-434c-8b93-8d93a89b1b1b","source":"wordfence","cve":"CVE-2026-3554","title":"Sherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d227d4e4-2899-434c-8b93-8d93a89b1b1b?source=api-prod","affected":[{"type":"plugin","slug":"sherk-custom-post-type-displays","name":"Sherk Custom Post Type Displays","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:43Z","updated":"2026-03-21T03:27:05Z"},{"id":"wordfence:d22d9414-2df9-4528-a426-dce6e83f8d44","source":"wordfence","cve":"CVE-2023-5432","title":"Jquery news ticker <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d22d9414-2df9-4528-a426-dce6e83f8d44?source=api-prod","affected":[{"type":"plugin","slug":"jquery-news-ticker","name":"Jquery news ticker","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d22e1b63-6ec9-4c06-9616-d976a8a83769","source":"wordfence","cve":"CVE-2025-69363","title":"Responsive Addons for Elementor <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d22e1b63-6ec9-4c06-9616-d976a8a83769?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:18:48Z"},{"id":"wordfence:d22fb2e8-bb61-49bc-9fab-8f7c58339a69","source":"wordfence","cve":"","title":"Custom 404 Pro <= 3.7.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d22fb2e8-bb61-49bc-9fab-8f7c58339a69?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":false,"patched_in":"3.7.3"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d230a727-0838-4b64-99f6-c91a362aacf7","source":"wordfence","cve":"CVE-2026-25444","title":"Appointment Booking Plugin for WooCommerce \u2013 WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d230a727-0838-4b64-99f6-c91a362aacf7?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:13:46Z"},{"id":"wordfence:d230b781-e208-4e66-b8ed-aba72db8d8dc","source":"wordfence","cve":"CVE-2026-6448","title":"Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d230b781-e208-4e66-b8ed-aba72db8d8dc?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"11.1.3"}],"published":"2026-06-05T10:44:40Z","updated":"2026-06-05T23:28:27Z"},{"id":"wordfence:d234212a-2019-477d-81d1-b2acc2321055","source":"wordfence","cve":"CVE-2024-12711","title":"RSVP and Event Management <= 2.7.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d234212a-2019-477d-81d1-b2acc2321055?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.7.14"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T11:11:14Z"},{"id":"wordfence:d2365e92-d70d-47fa-9abe-7cbdd6336f39","source":"wordfence","cve":"CVE-2025-11372","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.9.3","to_inclusive":true,"patched_in":"4.2.9.4"}],"published":"2025-10-17T18:38:36Z","updated":"2025-10-18T06:42:49Z"},{"id":"wordfence:d2388b82-3c2a-4b39-88b7-5a8e613ff781","source":"wordfence","cve":"CVE-2025-48297","title":"Simple Link Directory < 14.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2388b82-3c2a-4b39-88b7-5a8e613ff781?source=api-prod","affected":[{"type":"plugin","slug":"qc-simple-link-directory","name":"Simple Link Directory Pro","from":"*","from_inclusive":true,"to":"14.8.1","to_inclusive":false,"patched_in":"14.8.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:40:15Z"},{"id":"wordfence:d23ac5df-3331-47e0-94b7-53ac8f228935","source":"wordfence","cve":"CVE-2024-0905","title":"Fancy Product Designer <= 6.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d23ac5df-3331-47e0-94b7-53ac8f228935?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:44:50Z"},{"id":"wordfence:d23d2cdf-206e-4714-9753-198519ba737b","source":"wordfence","cve":"CVE-2023-47224","title":"WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d23d2cdf-206e-4714-9753-198519ba737b?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"7.7.0","to_inclusive":true,"patched_in":"7.8.1"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d23fe5e7-0e0d-4648-a887-143b0bd2e615","source":"wordfence","cve":"CVE-2026-96903","title":"Easy Property Listings <= 3.5.26 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d23fe5e7-0e0d-4648-a887-143b0bd2e615?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.26","to_inclusive":true,"patched_in":"3.5.27"}],"published":"2026-10-17T00:00:00Z","updated":"2026-10-23T19:03:36Z"},{"id":"wordfence:d2427236-f8cf-4fbf-8461-77bb75638a0a","source":"wordfence","cve":"CVE-2025-24756","title":"Roi Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2427236-f8cf-4fbf-8461-77bb75638a0a?source=api-prod","affected":[{"type":"plugin","slug":"roi-calculator","name":"Roi Calculator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:18:06Z"},{"id":"wordfence:d242a466-0611-4e64-8145-29f64100e62b","source":"wordfence","cve":"CVE-2023-2066","title":"Announcement & Notification Banner \u2013 Bulletin <= 3.6.0 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d242a466-0611-4e64-8145-29f64100e62b?source=api-prod","affected":[{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2448afc-70d1-4dd5-b73b-62d182ee9a8a","source":"wordfence","cve":"CVE-2025-9485","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()","severity":"critical","cvss":9.8,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.26.12","to_inclusive":true,"patched_in":"6.26.13"}],"published":"2025-10-03T14:11:31Z","updated":"2025-10-04T02:24:37Z"},{"id":"wordfence:d244bc34-821d-41bf-9efb-39a4644c6b1c","source":"wordfence","cve":"CVE-2026-24392","title":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.14.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d244bc34-821d-41bf-9efb-39a4644c6b1c?source=api-prod","affected":[{"type":"plugin","slug":"hurrytimer","name":"HurryTimer \u2013 An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"2.14.2","to_inclusive":true,"patched_in":"2.14.3"}],"published":"2026-01-11T00:00:00Z","updated":"2026-02-26T19:50:16Z"},{"id":"wordfence:d245dc6c-c579-4e28-a953-9227261911d4","source":"wordfence","cve":"CVE-2023-0340","title":"Custom Content Shortcode <= 4.0.2 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d245dc6c-c579-4e28-a953-9227261911d4?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-shortcode","name":"Custom Content Shortcode","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d24b34d9-3aa3-46df-9000-eda8e416aa49","source":"wordfence","cve":"CVE-2025-58615","title":"WP Bannerize Pro <= 1.10.0 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24b34d9-3aa3-46df-9000-eda8e416aa49?source=api-prod","affected":[{"type":"plugin","slug":"wp-bannerize-pro","name":"WP Bannerize Pro","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":true,"patched_in":"1.11.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-11T14:36:06Z"},{"id":"wordfence:d24c65b6-20da-4f17-be9f-b8fbf5e721e3","source":"wordfence","cve":"CVE-2024-32578","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.54 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24c65b6-20da-4f17-be9f-b8fbf5e721e3?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.54","to_inclusive":true,"patched_in":"1.2.55"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:42:10Z"},{"id":"wordfence:d24c9310-5470-4d08-83b3-c801f4d25d3e","source":"wordfence","cve":"","title":"Grow Social <= 1.18.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24c9310-5470-4d08-83b3-c801f4d25d3e?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.18.2","to_inclusive":true,"patched_in":"1.19.0"}],"published":"2021-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d24f42c0-5fd4-4960-b529-10cd5d9e7379","source":"wordfence","cve":"CVE-2026-49071","title":"WooCommerce Dropshipping Premium <= 5.2.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24f42c0-5fd4-4960-b529-10cd5d9e7379?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-dropshipping","name":"WooCommerce Dropshipping Premium","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:35:13Z"},{"id":"wordfence:d24fa600-7698-4081-92f5-e11606928886","source":"wordfence","cve":"CVE-2026-92799","title":"Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24fa600-7698-4081-92f5-e11606928886?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-24T18:11:38Z","updated":"2026-09-25T06:39:55Z"},{"id":"wordfence:d253a001-7023-4070-81c5-35d485ffd36c","source":"wordfence","cve":"CVE-2024-3265","title":"WP Advanced Search <= 1.1.6 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d253a001-7023-4070-81c5-35d485ffd36c?source=api-prod","affected":[{"type":"plugin","slug":"advance-search","name":"Advanced Search","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-22T14:07:30Z"},{"id":"wordfence:d2547355-cfc0-4a87-9bab-32753bd456ad","source":"wordfence","cve":"CVE-2024-38690","title":"iPanorama 360 WordPress Virtual Tour Builder <= 1.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2547355-cfc0-4a87-9bab-32753bd456ad?source=api-prod","affected":[{"type":"plugin","slug":"ipanorama-360-virtual-tour-builder-lite","name":"iPanorama 360 \u2013 Advanced Virtual Tour Builder","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2024-07-10T00:00:00Z","updated":"2024-07-18T13:09:19Z"},{"id":"wordfence:d254e43f-8a8b-4309-91f3-c60710c13647","source":"wordfence","cve":"CVE-2024-29810","title":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d254e43f-8a8b-4309-91f3-c60710c13647?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.21","to_inclusive":true,"patched_in":"1.8.22"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T15:25:47Z"},{"id":"wordfence:d2550461-2546-4dc4-85ff-decf2fca3f10","source":"wordfence","cve":"CVE-2023-28660","title":"Events Made Easy <= 2.3.17 - Authenticated (Subscriber+) SQL Injection via 'search_name'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2550461-2546-4dc4-85ff-decf2fca3f10?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"2.3.17","to_inclusive":true,"patched_in":"2.3.18"}],"published":"2023-03-20T00:00:00Z","updated":"2026-08-25T23:35:18Z"},{"id":"wordfence:d257c128-dcab-49c6-9664-0cc393dcc4d9","source":"wordfence","cve":"CVE-2025-53271","title":"Additional Order Filters for WooCommerce <= 1.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d257c128-dcab-49c6-9664-0cc393dcc4d9?source=api-prod","affected":[{"type":"plugin","slug":"additional-order-filters-for-woocommerce","name":"Additional Order Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2025-06-27T00:00:00Z","updated":"2025-10-21T21:08:06Z"},{"id":"wordfence:d257d0e0-7e42-49d5-83c6-f5c44f2e15fc","source":"wordfence","cve":"","title":"WP Marketplace \u2013 Complete Shopping Cart / eCommerce Solution <= 1.2.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d257d0e0-7e42-49d5-83c6-f5c44f2e15fc?source=api-prod","affected":[{"type":"plugin","slug":"wpmarketplace","name":"WP Marketplace \u2013 Complete Shopping Cart / eCommerce Solution","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2012-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2594cef-6bde-425f-9412-fd4ed3da312e","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in savetranslationstay function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2594cef-6bde-425f-9412-fd4ed3da312e?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d25ed357-2895-47c7-9418-628068c6d18e","source":"wordfence","cve":"CVE-2022-2256","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d25ed357-2895-47c7-9418-628068c6d18e?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d25f23cc-6012-4607-a643-5350175a439b","source":"wordfence","cve":"CVE-2013-1765","title":"Smart Flv <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d25f23cc-6012-4607-a643-5350175a439b?source=api-prod","affected":[{"type":"plugin","slug":"smart-flv","name":"Smart Flv","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d261f5d7-bbd5-4434-9468-d23c43653ebd","source":"wordfence","cve":"CVE-2026-78153","title":"Restrict User Access <= 2.8 - Unauthenticated Content Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d261f5d7-bbd5-4434-9468-d23c43653ebd?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T15:48:58Z"},{"id":"wordfence:d266b6ee-24ec-4363-a986-5ccd4db5ae3c","source":"wordfence","cve":"CVE-2024-1126","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d266b6ee-24ec-4363-a986-5ccd4db5ae3c?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-02-14T00:00:00Z","updated":"2024-10-24T19:00:08Z"},{"id":"wordfence:d267a3d8-2fe3-48b2-95a1-49d3baa67694","source":"wordfence","cve":"CVE-2025-50027","title":"Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d267a3d8-2fe3-48b2-95a1-49d3baa67694?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-10T14:07:06Z"},{"id":"wordfence:d26c7cd4-7548-421f-ace0-7f9dce16b0dc","source":"wordfence","cve":"CVE-2025-11897","title":"The7 \u2014 Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d26c7cd4-7548-421f-ace0-7f9dce16b0dc?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"12.9.1","to_inclusive":true,"patched_in":"12.9.2"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T12:26:28Z"},{"id":"wordfence:d26e8b21-fa9e-4dfe-a095-5c9f74d968f4","source":"wordfence","cve":"CVE-2023-23974","title":"Quick Event Manager <= 9.7.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d26e8b21-fa9e-4dfe-a095-5c9f74d968f4?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"*","from_inclusive":true,"to":"9.7.4","to_inclusive":true,"patched_in":"9.7.5"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d27090ca-4a6d-4533-a013-674cfc756d25","source":"wordfence","cve":"CVE-2025-23860","title":"Charity-thermometer <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d27090ca-4a6d-4533-a013-674cfc756d25?source=api-prod","affected":[{"type":"plugin","slug":"charitydonation-thermometer","name":"Charity-thermometer","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:10:03Z"},{"id":"wordfence:d2716f7e-ae73-482a-acf7-772884f0b3ab","source":"wordfence","cve":"CVE-2017-14724","title":"WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2716f7e-ae73-482a-acf7-772884f0b3ab?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d274f8b1-0f7c-44cc-8063-3d04a33a9404","source":"wordfence","cve":"CVE-2022-40198","title":"TeraWallet \u2013 For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d274f8b1-0f7c-44cc-8063-3d04a33a9404?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.24","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d276af21-fa9d-46bd-94e3-03776d4f2238","source":"wordfence","cve":"CVE-2020-8615","title":"Tutor LMS < 1.5.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d276af21-fa9d-46bd-94e3-03776d4f2238?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2020-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d27c2393-64b2-4087-aa91-cbfaec644e13","source":"wordfence","cve":"","title":"WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type","severity":"low","cvss":3.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d27c2393-64b2-4087-aa91-cbfaec644e13?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7.0","from_inclusive":true,"to":"4.7.37","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8.0","from_inclusive":true,"to":"4.8.32","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9.0","from_inclusive":true,"to":"4.9.33","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0.0","from_inclusive":true,"to":"5.0.29","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1.0","from_inclusive":true,"to":"5.1.26","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2.0","from_inclusive":true,"to":"5.2.28","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3.0","from_inclusive":true,"to":"5.3.25","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4.0","from_inclusive":true,"to":"5.4.23","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5.0","from_inclusive":true,"to":"5.5.22","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6.0","from_inclusive":true,"to":"5.6.21","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7.0","from_inclusive":true,"to":"5.7.19","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8.0","from_inclusive":true,"to":"5.8.17","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9.0","from_inclusive":true,"to":"5.9.18","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0.0","from_inclusive":true,"to":"6.0.16","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1.0","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2.0","from_inclusive":true,"to":"6.2.13","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3.0","from_inclusive":true,"to":"6.3.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4.0","from_inclusive":true,"to":"6.4.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5.0","from_inclusive":true,"to":"6.5.12","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.9","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"4.7.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"4.7.38"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-07T18:04:36Z"},{"id":"wordfence:d27ef0b4-266f-47b8-a7aa-ddff5adaac7a","source":"wordfence","cve":"CVE-2024-6549","title":"Admin Post Navigation <= 2.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d27ef0b4-266f-47b8-a7aa-ddff5adaac7a?source=api-prod","affected":[{"type":"plugin","slug":"admin-post-navigation","name":"Admin Post Navigation","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:08:57Z","updated":"2024-07-27T01:51:06Z"},{"id":"wordfence:d283527a-a955-4f82-9827-81a71158d8e2","source":"wordfence","cve":"CVE-2020-36752","title":"Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d283527a-a955-4f82-9827-81a71158d8e2?source=api-prod","affected":[{"type":"plugin","slug":"nifty-coming-soon-and-under-construction-page","name":"Coming Soon & Maintenance Mode Page & Under Construction","from":"*","from_inclusive":true,"to":"1.57","to_inclusive":true,"patched_in":"1.58"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2885b38-9e5a-4e06-ad1d-9c3b266f78a8","source":"wordfence","cve":"CVE-2026-66591","title":"Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2885b38-9e5a-4e06-ad1d-9c3b266f78a8?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.39","to_inclusive":true,"patched_in":"3.40"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:30:09Z"},{"id":"wordfence:d28e5374-dd34-4745-a20b-059e9846d96d","source":"wordfence","cve":"CVE-2026-6704","title":"Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d28e5374-dd34-4745-a20b-059e9846d96d?source=api-prod","affected":[{"type":"plugin","slug":"blog-settings","name":"Blog Settings","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:07:42Z","updated":"2026-05-05T02:26:58Z"},{"id":"wordfence:d2922c85-7e16-48a1-9c43-c1a9d34571e0","source":"wordfence","cve":"CVE-2024-9897","title":"StreamWeasels Twitch Integration <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2922c85-7e16-48a1-9c43-c1a9d34571e0?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2024-10-18T20:37:40Z","updated":"2024-10-19T09:37:43Z"},{"id":"wordfence:d292c4ff-123e-4aa0-8ce8-d2bb2f3c6e02","source":"wordfence","cve":"CVE-2020-8594","title":"Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d292c4ff-123e-4aa0-8ce8-d2bb2f3c6e02?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.23","to_inclusive":false,"patched_in":"3.4.23"}],"published":"2020-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d293f35a-a42f-441f-b521-da0ba9887c45","source":"wordfence","cve":"CVE-2023-25445","title":"HappyFiles Pro <= 1.8.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d293f35a-a42f-441f-b521-da0ba9887c45?source=api-prod","affected":[{"type":"plugin","slug":"happyfiles-pro","name":"HappyFiles Pro","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d29581bb-f9f4-473a-b1b4-030cd4f5b8c2","source":"wordfence","cve":"CVE-2025-26571","title":"Wibiya Toolbar <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d29581bb-f9f4-473a-b1b4-030cd4f5b8c2?source=api-prod","affected":[{"type":"plugin","slug":"wibiya","name":"Wibiya Toolbar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:39:15Z"},{"id":"wordfence:d295e2c6-4e0c-4b52-83dc-6363267a0c71","source":"wordfence","cve":"CVE-2025-69389","title":"Visitor Maps Extended Referer Field <= 1.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d295e2c6-4e0c-4b52-83dc-6363267a0c71?source=api-prod","affected":[{"type":"plugin","slug":"visitor-maps-extended-referer-field","name":"Visitor Maps Extended Referer Field","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T00:00:00Z","updated":"2026-02-16T21:47:01Z"},{"id":"wordfence:d295f424-8e18-4a32-8d96-94ce931d125b","source":"wordfence","cve":"CVE-2025-63077","title":"Happy Addons for Elementor <= 3.20.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d295f424-8e18-4a32-8d96-94ce931d125b?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.20.3","to_inclusive":true,"patched_in":"3.20.4"}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-19T15:55:57Z"},{"id":"wordfence:d2989589-0d68-486d-8a3a-d0cff48dfecc","source":"wordfence","cve":"CVE-2025-22622","title":"Age Verification for your checkout page. Verify your customer's identity <= 1.20.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2989589-0d68-486d-8a3a-d0cff48dfecc?source=api-prod","affected":[{"type":"plugin","slug":"agecheckernet","name":"Age Verification for your checkout page. Verify your customer\u2019s identity","from":"1.20.0","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-02-24T15:21:48Z"},{"id":"wordfence:d2994fbb-29b0-4725-a046-edeca4bcbcd7","source":"wordfence","cve":"CVE-2024-0235","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2994fbb-29b0-4725-a046-edeca4bcbcd7?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:07:31Z"},{"id":"wordfence:d29a3a29-1fb5-41c8-9516-16bd9fc0018d","source":"wordfence","cve":"CVE-2026-1825","title":"Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d29a3a29-1fb5-41c8-9516-16bd9fc0018d?source=api-prod","affected":[{"type":"plugin","slug":"show-youtube-video","name":"Show YouTube video","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:47:10Z","updated":"2026-03-07T07:22:07Z"},{"id":"wordfence:d29ac638-c067-41a8-8b11-cc3e5b0be514","source":"wordfence","cve":"CVE-2024-13221","title":"Fantastic Elasticsearch <= 4.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d29ac638-c067-41a8-8b11-cc3e5b0be514?source=api-prod","affected":[{"type":"plugin","slug":"fantastic-elasticsearch","name":"Fantastic ElasticSearch","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-10T00:00:00Z","updated":"2025-01-14T19:00:38Z"},{"id":"wordfence:d29c69bb-4feb-477e-b18f-934ece21aff6","source":"wordfence","cve":"CVE-2026-6399","title":"General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d29c69bb-4feb-477e-b18f-934ece21aff6?source=api-prod","affected":[{"type":"plugin","slug":"general-options","name":"General Options","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:04:19Z","updated":"2026-05-20T01:25:55Z"},{"id":"wordfence:d29d27f5-d2fd-4124-bb94-dc5baf37d0a7","source":"wordfence","cve":"CVE-2025-30767","title":"PDF for WPForms <= 5.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d29d27f5-d2fd-4124-bb94-dc5baf37d0a7?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-02T14:25:28Z"},{"id":"wordfence:d2a3ad97-b4ea-4ad9-ac83-071e56cb8df7","source":"wordfence","cve":"CVE-2023-44229","title":"Tiny Carousel Horizontal Slider <= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a3ad97-b4ea-4ad9-ac83-071e56cb8df7?source=api-prod","affected":[{"type":"plugin","slug":"tiny-carousel-horizontal-slider","name":"Tiny Carousel Horizontal Slider","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2a60cb2-fe7d-4c51-9995-5cb4682d9d26","source":"wordfence","cve":"CVE-2023-41651","title":"Multi-column Tag Map <= 17.0.26 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a60cb2-fe7d-4c51-9995-5cb4682d9d26?source=api-prod","affected":[{"type":"plugin","slug":"multi-column-tag-map","name":"Multi-column Tag Map","from":"*","from_inclusive":true,"to":"17.0.26","to_inclusive":true,"patched_in":"17.0.27"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2a63b8e-e16e-4702-be1b-acc5c3e74b22","source":"wordfence","cve":"CVE-2026-2720","title":"Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a63b8e-e16e-4702-be1b-acc5c3e74b22?source=api-prod","affected":[{"type":"plugin","slug":"hr-press-lite","name":"HR Press Lite","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2026-03-20T15:15:10Z","updated":"2026-09-18T19:01:37Z"},{"id":"wordfence:d2a77443-9fca-4686-be48-b3905a33c87f","source":"wordfence","cve":"CVE-2023-2967","title":"TinyMCE Custom Styles <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a77443-9fca-4686-be48-b3905a33c87f?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-custom-styles","name":"TinyMCE Custom Styles","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2a7f4b0-2218-499b-8674-65ab8aced6a9","source":"wordfence","cve":"CVE-2025-30771","title":"WP Cassify <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a7f4b0-2218-499b-8674-65ab8aced6a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-cassify","name":"WP Cassify","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-02T20:54:28Z"},{"id":"wordfence:d2a95c6f-7248-4805-af86-11fd536b5d8d","source":"wordfence","cve":"CVE-2024-22162","title":"WPZOOM Shortcodes <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a95c6f-7248-4805-af86-11fd536b5d8d?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-shortcodes","name":"WPZOOM Shortcodes","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2a99b86-5eb8-438d-a040-68aba2ffa183","source":"wordfence","cve":"CVE-2022-2240","title":"Request a Quote <= 2.3.8 - CSV Injection","severity":"high","cvss":8.3,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a99b86-5eb8-438d-a040-68aba2ffa183?source=api-prod","affected":[{"type":"plugin","slug":"request-a-quote","name":"Request a Quote \u2013 Quote Forms for Any WordPress Site","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2a9a2fd-5667-4033-a273-f4f5660cb27e","source":"wordfence","cve":"CVE-2020-35939","title":"Team Showcase <= 1.22.15 - Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2a9a2fd-5667-4033-a273-f4f5660cb27e?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.16","to_inclusive":false,"patched_in":"1.22.16"}],"published":"2020-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2aabec9-1968-4c0e-baed-9aa78eb236e8","source":"wordfence","cve":"CVE-2023-2605","title":"WP Brutal AI < 2.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2aabec9-1968-4c0e-baed-9aa78eb236e8?source=api-prod","affected":[{"type":"plugin","slug":"wpbrutalai","name":"WP Brutal AI","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2ad9184-5047-4037-9791-23dbf93d794b","source":"wordfence","cve":"CVE-2026-24538","title":"Omnipress <= 1.6.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ad9184-5047-4037-9791-23dbf93d794b?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-24T00:00:00Z","updated":"2026-05-22T05:17:51Z"},{"id":"wordfence:d2aea3e1-60cb-4992-a217-4250bed2641e","source":"wordfence","cve":"","title":"Ultimate Instagram Feed - WordPress Plugin < 1.3.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2aea3e1-60cb-4992-a217-4250bed2641e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-instagram-feed","name":"Ultimate Instagram Feed \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2017-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b0de76-14be-414e-bbdb-1188f3516633","source":"wordfence","cve":"CVE-2025-30786","title":"Quotes llama <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b0de76-14be-414e-bbdb-1188f3516633?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:14:42Z"},{"id":"wordfence:d2b0ee02-b6df-4f35-9d17-6e68a8d82f8e","source":"wordfence","cve":"CVE-2026-105066","title":"SimplyRETS Real Estate IDX <= 3.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b0ee02-b6df-4f35-9d17-6e68a8d82f8e?source=api-prod","affected":[{"type":"plugin","slug":"simply-rets","name":"SimplyRETS Real Estate IDX","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-10-12T17:39:20Z","updated":"2026-10-23T18:03:37Z"},{"id":"wordfence:d2b16d43-6bd3-4ed2-9824-40a9458433bd","source":"wordfence","cve":"CVE-2025-54033","title":"Theme Builder For Elementor <= 1.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b16d43-6bd3-4ed2-9824-40a9458433bd?source=api-prod","affected":[{"type":"plugin","slug":"theme-builder-for-elementor","name":"Theme Builder For Elementor & Starter Templates","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:22:06Z"},{"id":"wordfence:d2b1e973-f22d-4e69-b3b8-d6ea5df3f047","source":"wordfence","cve":"CVE-2026-5361","title":"Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b1e973-f22d-4e69-b3b8-d6ea5df3f047?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":true,"patched_in":"1.12.5"}],"published":"2026-05-13T14:42:15Z","updated":"2026-05-14T03:27:15Z"},{"id":"wordfence:d2b3279b-fd39-4c34-92e8-57d309f37a93","source":"wordfence","cve":"CVE-2022-0424","title":"Popup by Supsystic <= 1.10.8 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3279b-fd39-4c34-92e8-57d309f37a93?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.9","to_inclusive":false,"patched_in":"1.10.9"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b32fdc-b73f-48e5-88bf-e836ec2f791f","source":"wordfence","cve":"CVE-2023-5611","title":"Seraphinite Accelerator (Base, cache only) <= 2.20.31 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b32fdc-b73f-48e5-88bf-e836ec2f791f?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.20.31","to_inclusive":true,"patched_in":"2.20.32"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b3612e-3c91-469b-98ef-fdb03b0ee9d9","source":"wordfence","cve":"CVE-2023-3202","title":"MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b4203f-7301-4ab6-b7a1-c43516bea477","source":"wordfence","cve":"","title":"Football Live Scores <= 1.5 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b4203f-7301-4ab6-b7a1-c43516bea477?source=api-prod","affected":[{"type":"plugin","slug":"football-live-scores","name":"Football Live Scores","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b66eca-67cf-404e-9c4b-6add0ee79141","source":"wordfence","cve":"CVE-2022-41134","title":"Optinly <= 1.0.15 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b66eca-67cf-404e-9c4b-6add0ee79141?source=api-prod","affected":[{"type":"plugin","slug":"optinly","name":"Optinly \u2013 Exit Intent, Newsletter Popups, Gamification & Opt-in Forms","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b66f27-e4d2-4f6e-be96-b7f967a30885","source":"wordfence","cve":"CVE-2023-25456","title":"Klaviyo <= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b66f27-e4d2-4f6e-be96-b7f967a30885?source=api-prod","affected":[{"type":"plugin","slug":"klaviyo","name":"Klaviyo","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2b74b9d-b296-4d3b-936f-419dad502d79","source":"wordfence","cve":"CVE-2024-47311","title":"Wheel of Life <= 1.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b74b9d-b296-4d3b-936f-419dad502d79?source=api-prod","affected":[{"type":"plugin","slug":"wheel-of-life","name":"Wheel of Life: Coaching and Assessment Tool for Life Coach","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:00:42Z"},{"id":"wordfence:d2b7ed73-a654-40ef-8d80-6171393da8e7","source":"wordfence","cve":"CVE-2026-8438","title":"All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b7ed73-a654-40ef-8d80-6171393da8e7?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"5.4.8"}],"published":"2026-06-05T11:51:22Z","updated":"2026-06-18T20:24:02Z"},{"id":"wordfence:d2b9f92f-be68-4be2-a7e0-3ff5fcec641d","source":"wordfence","cve":"CVE-2025-63048","title":"ListingPro Lead Form <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b9f92f-be68-4be2-a7e0-3ff5fcec641d?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-lead-form","name":"ListingPro Lead Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-12-11T16:29:17Z"},{"id":"wordfence:d2baa77d-caac-4c62-bbd0-8621dc66773e","source":"wordfence","cve":"CVE-2026-80440","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2baa77d-caac-4c62-bbd0-8621dc66773e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.14.2","to_inclusive":false,"patched_in":"7.8.14.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T15:01:50Z"},{"id":"wordfence:d2bac05e-ecd0-427b-90a0-6cf78175cd19","source":"wordfence","cve":"CVE-2025-13908","title":"The Tooltip <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2bac05e-ecd0-427b-90a0-6cf78175cd19?source=api-prod","affected":[{"type":"plugin","slug":"the-tooltip","name":"The Tooltip","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:20:51Z","updated":"2026-01-09T11:15:35Z"},{"id":"wordfence:d2c0be66-b2e9-4afd-a804-cc432b3fc694","source":"wordfence","cve":"CVE-2026-19417","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c0be66-b2e9-4afd-a804-cc432b3fc694?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":false,"patched_in":"4.5.4"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:13:05Z"},{"id":"wordfence:d2c2a02a-6282-4109-a503-bbe78b3627be","source":"wordfence","cve":"CVE-2025-57915","title":"TOCHAT.BE <= 1.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c2a02a-6282-4109-a503-bbe78b3627be?source=api-prod","affected":[{"type":"plugin","slug":"tochat-be","name":"TOCHAT.BE","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:17:05Z"},{"id":"wordfence:d2c3752b-0d2f-402d-bdbf-fb3fd76cf558","source":"wordfence","cve":"CVE-2026-109193","title":"HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c3752b-0d2f-402d-bdbf-fb3fd76cf558?source=api-prod","affected":[{"type":"plugin","slug":"hivepress","name":"HivePress \u2013 Business Directory, Listings & Classified Ads Plugin","from":"*","from_inclusive":true,"to":"1.7.32","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-15T17:55:27Z","updated":"2026-10-16T06:41:06Z"},{"id":"wordfence:d2c3ea1a-ecf4-4af4-9c87-a6cdede84087","source":"wordfence","cve":"CVE-2025-60142","title":"Simple Meta Tags <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c3ea1a-ecf4-4af4-9c87-a6cdede84087?source=api-prod","affected":[{"type":"plugin","slug":"simple-meta-tags","name":"Simple Meta Tags","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:15:11Z"},{"id":"wordfence:d2c4a000-94e9-42f1-bdb3-633741fcd54e","source":"wordfence","cve":"CVE-2026-6128","title":"All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c4a000-94e9-42f1-bdb3-633741fcd54e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration-unlimited-extension","name":"All-in-One WP Migration Unlimited Extension","from":"*","from_inclusive":true,"to":"2.84","to_inclusive":true,"patched_in":"2.85"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T07:40:16Z"},{"id":"wordfence:d2c62f42-b649-4873-a330-4a0f268cab21","source":"wordfence","cve":"CVE-2013-6010","title":"Comment Attachment <= 1.5.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c62f42-b649-4873-a330-4a0f268cab21?source=api-prod","affected":[{"type":"plugin","slug":"comment-attachment","name":"Comment Attachment","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2013-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2c6fefe-f6f3-44ce-906c-abad717840d5","source":"wordfence","cve":"CVE-2024-9938","title":"Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c6fefe-f6f3-44ce-906c-abad717840d5?source=api-prod","affected":[{"type":"plugin","slug":"bounce-handler-mailpoet","name":"Bounce Handler MailPoet 3","from":"*","from_inclusive":true,"to":"1.3.21","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:04:12Z","updated":"2024-11-16T03:20:51Z"},{"id":"wordfence:d2c70f93-4045-4c91-b412-d8b0ba240bc6","source":"wordfence","cve":"CVE-2024-49659","title":"Coub <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c70f93-4045-4c91-b412-d8b0ba240bc6?source=api-prod","affected":[{"type":"plugin","slug":"coub","name":"Coub","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:52:46Z"},{"id":"wordfence:d2c9aff2-56c4-4287-bf49-681ae049e903","source":"wordfence","cve":"CVE-2025-69409","title":"PJ | Life & Business Coaching <= 3.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2c9aff2-56c4-4287-bf49-681ae049e903?source=api-prod","affected":[{"type":"theme","slug":"pj","name":"PJ | Life & Business Coaching Site Template","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:43:24Z"},{"id":"wordfence:d2cc4dcc-f3d1-4425-aeb8-9ef51e79287d","source":"wordfence","cve":"CVE-2024-52499","title":"Pricing table addon for elementor <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cc4dcc-f3d1-4425-aeb8-9ef51e79287d?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table-addon-for-elementor","name":"Pricing table addon for elementor","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:27:44Z"},{"id":"wordfence:d2ccdafb-39f4-4249-95fa-a3d752c435f4","source":"wordfence","cve":"CVE-2012-4264","title":"Better WP Security <= 3.2.4 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ccdafb-39f4-4249-95fa-a3d752c435f4?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2cee46a-03d5-4a31-ba15-28be97794199","source":"wordfence","cve":"CVE-2025-9629","title":"USS Upyun <= 1.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cee46a-03d5-4a31-ba15-28be97794199?source=api-prod","affected":[{"type":"plugin","slug":"uss-upyun","name":"USS Upyun","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-09-16T00:00:00Z","updated":"2025-09-17T01:49:16Z"},{"id":"wordfence:d2cf310d-b8ea-4960-8288-b31633e6b6ef","source":"wordfence","cve":"CVE-2025-58956","title":"WP Attractive Donations System < 1.29 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cf310d-b8ea-4960-8288-b31633e6b6ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-attractive-donations-system-easy-stripe-paypal-donations","name":"WP Attractive Donations System","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":false,"patched_in":"1.29"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:12:24Z"},{"id":"wordfence:d2cffdc3-bd74-42ab-befd-8a396c5d990d","source":"wordfence","cve":"CVE-2024-5152","title":"ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cffdc3-bd74-42ab-befd-8a396c5d990d?source=api-prod","affected":[{"type":"plugin","slug":"element-ready-lite","name":"ElementsReady Addons for Elementor","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2024-06-05T15:36:55Z","updated":"2024-07-08T20:47:31Z"},{"id":"wordfence:d2d040d5-ffcb-4ab9-8606-c18a3d2ccad9","source":"wordfence","cve":"CVE-2025-67571","title":"WPFunnels <= 3.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d040d5-ffcb-4ab9-8606-c18a3d2ccad9?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-11-15T00:00:00Z","updated":"2025-12-11T17:05:37Z"},{"id":"wordfence:d2d23e6f-d48f-4734-95f8-12bd58eb1c2f","source":"wordfence","cve":"CVE-2024-11852","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d23e6f-d48f-4734-95f8-12bd58eb1c2f?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.10.12","to_inclusive":true,"patched_in":"5.10.13"}],"published":"2024-12-21T12:54:05Z","updated":"2024-12-22T01:54:58Z"},{"id":"wordfence:d2d2954c-762c-4bdc-8469-7fe19f4e980d","source":"wordfence","cve":"CVE-2025-6540","title":"web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d2954c-762c-4bdc-8469-7fe19f4e980d?source=api-prod","affected":[{"type":"plugin","slug":"web-cam","name":"web-cam","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-06-25T14:07:37Z","updated":"2025-12-09T17:16:57Z"},{"id":"wordfence:d2d34c84-473c-49f8-b55c-c869b5479974","source":"wordfence","cve":"CVE-2023-5251","title":"Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d34c84-473c-49f8-b55c-c869b5479974?source=api-prod","affected":[{"type":"plugin","slug":"grid-plus","name":"Grid Plus \u2013 Unlimited grid layout","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2d4508d-91ae-47a0-b11f-fec469686dc7","source":"wordfence","cve":"CVE-2024-5030","title":"CM Table Of Contents <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d4508d-91ae-47a0-b11f-fec469686dc7?source=api-prod","affected":[{"type":"plugin","slug":"cm-table-of-content","name":"CM Table Of Contents \u2013 Clear navigation for better content discovery","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T17:02:18Z"},{"id":"wordfence:d2d4a2ef-ea4a-456f-a8d1-600f51505ad7","source":"wordfence","cve":"CVE-2025-48276","title":"Visual Composer Website Builder <= 45.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d4a2ef-ea4a-456f-a8d1-600f51505ad7?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.11.0","to_inclusive":true,"patched_in":"45.12.0"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:52:28Z"},{"id":"wordfence:d2d4c7ff-ecd3-4cfb-9466-08f3e6c4bd48","source":"wordfence","cve":"CVE-2022-4386","title":"Intuitive Custom Post Order <= 3.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d4c7ff-ecd3-4cfb-9466-08f3e6c4bd48?source=api-prod","affected":[{"type":"plugin","slug":"intuitive-custom-post-order","name":"Intuitive Custom Post Order","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2d50c64-f4e2-4a5a-b37f-bbb636ee468d","source":"wordfence","cve":"CVE-2026-32432","title":"Time Slots Booking Form <= 1.2.42 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d50c64-f4e2-4a5a-b37f-bbb636ee468d?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.42","to_inclusive":true,"patched_in":"1.2.43"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:18:49Z"},{"id":"wordfence:d2d6245c-74b9-4850-9741-d23bc4e30de3","source":"wordfence","cve":"CVE-2026-96338","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d6245c-74b9-4850-9741-d23bc4e30de3?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:51:06Z"},{"id":"wordfence:d2de0442-2a2b-402c-abb9-5f49e172d0c3","source":"wordfence","cve":"CVE-2025-68063","title":"Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2de0442-2a2b-402c-abb9-5f49e172d0c3?source=api-prod","affected":[{"type":"theme","slug":"splash","name":"splash","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:33:16Z"},{"id":"wordfence:d2ded652-1cca-400b-80ca-2aab1a1def8b","source":"wordfence","cve":"CVE-2025-53285","title":"Add &amp; Replace Affiliate Links for Amazon <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ded652-1cca-400b-80ca-2aab1a1def8b?source=api-prod","affected":[{"type":"plugin","slug":"add-replace-affiliate-links-for-amazon","name":"Add & Replace Affiliate Links for Amazon","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:33:17Z"},{"id":"wordfence:d2e040bd-df5f-4b40-bc7b-9521f224c297","source":"wordfence","cve":"","title":"Photo Gallery by 10Web < 1.3.43 - Authenticated Path Traversal","severity":"medium","cvss":4.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e040bd-df5f-4b40-bc7b-9521f224c297?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.3.43","to_inclusive":false,"patched_in":"1.3.43"}],"published":"2017-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2e10791-7158-47ae-85c9-4a5a53b25d68","source":"wordfence","cve":"CVE-2023-23705","title":"WordPress Books Gallery <= 4.4.8 - Cross-Site Request Forgery leading to Plugin Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e10791-7158-47ae-85c9-4a5a53b25d68?source=api-prod","affected":[{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2e33463-b546-4987-a34d-02911f72d35d","source":"wordfence","cve":"CVE-2026-95524","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Unauthenticated Unauthorized User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e33463-b546-4987-a34d-02911f72d35d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:29:02Z"},{"id":"wordfence:d2e342d0-dd34-4ad6-8dd1-c86f677d2acb","source":"wordfence","cve":"CVE-2025-60042","title":"Chinchilla <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e342d0-dd34-4ad6-8dd1-c86f677d2acb?source=api-prod","affected":[{"type":"theme","slug":"chinchilla","name":"Chinchilla - Pet WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:37:09Z"},{"id":"wordfence:d2e3ac14-1421-49f0-9c60-7f7d5c9d7654","source":"wordfence","cve":"CVE-2023-3126","title":"B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e3ac14-1421-49f0-9c60-7f7d5c9d7654?source=api-prod","affected":[{"type":"plugin","slug":"b2bking-wholesale-for-woocommerce","name":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More","from":"*","from_inclusive":true,"to":"4.6.00","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2e5fca6-363c-4875-9eb8-44e080d99650","source":"wordfence","cve":"CVE-2025-1666","title":"Cookie banner plugin for WordPress \u2013 Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e5fca6-363c-4875-9eb8-44e080d99650?source=api-prod","affected":[{"type":"plugin","slug":"cookiebot","name":"Cookiebot \u2013 Cookie Banner & Cookie Consent for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2025-03-05T00:00:00Z","updated":"2025-03-06T11:11:03Z"},{"id":"wordfence:d2e60da7-25c6-44e9-aa62-ed32f0f5b0e0","source":"wordfence","cve":"CVE-2025-23876","title":"WP krpano <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e60da7-25c6-44e9-aa62-ed32f0f5b0e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-krpano","name":"WP krpano","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:42:03Z"},{"id":"wordfence:d2e762b6-b3f2-4610-b7db-98c62e014d40","source":"wordfence","cve":"CVE-2025-32222","title":"Widget Logic <= 6.0.5 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e762b6-b3f2-4610-b7db-98c62e014d40?source=api-prod","affected":[{"type":"plugin","slug":"widget-logic","name":"Widget Logic","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2025-06-09T00:00:00Z","updated":"2025-07-25T15:50:48Z"},{"id":"wordfence:d2e99867-4992-47b5-a642-abd104eee18f","source":"wordfence","cve":"CVE-2022-0879","title":"Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2e99867-4992-47b5-a642-abd104eee18f?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":false,"patched_in":"1.9.7"}],"published":"2022-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2ea39fb-5adc-4666-95da-b25024ca32d6","source":"wordfence","cve":"","title":"Count per Day < 3.5.5 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea39fb-5adc-4666-95da-b25024ca32d6?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"3.5.5"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2ea5e34-9303-43c8-8579-80ef02e1d9c4","source":"wordfence","cve":"CVE-2025-2613","title":"Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea5e34-9303-43c8-8579-80ef02e1d9c4?source=api-prod","affected":[{"type":"plugin","slug":"customized-login","name":"Login Manager \u2013 Design Login Page, View Login Activity, Limit Login Attempts","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T12:41:19Z","updated":"2025-04-18T01:44:10Z"},{"id":"wordfence:d2ea91f1-5ff1-4ee6-a4d9-30f829ebc24c","source":"wordfence","cve":"CVE-2023-25997","title":"Sola Support Ticket <= 3.18 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ea91f1-5ff1-4ee6-a4d9-30f829ebc24c?source=api-prod","affected":[{"type":"plugin","slug":"sola-support-tickets","name":"Sola Support Tickets","from":"*","from_inclusive":true,"to":"3.18","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T14:49:07Z"},{"id":"wordfence:d2ead824-2722-4b09-8387-e064dee371c1","source":"wordfence","cve":"CVE-2024-12030","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ead824-2722-4b09-8387-e064dee371c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.5","to_inclusive":true,"patched_in":"1.3.3.6"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T04:18:00Z"},{"id":"wordfence:d2eba19d-1e77-439b-8d96-5dfadb2e9b23","source":"wordfence","cve":"CVE-2025-46512","title":"Custom Functions Plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2eba19d-1e77-439b-8d96-5dfadb2e9b23?source=api-prod","affected":[{"type":"plugin","slug":"custom-functions","name":"Custom Functions Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:53:25Z"},{"id":"wordfence:d2ee943a-a7be-44e3-8fe4-b9c0fbb638f1","source":"wordfence","cve":"CVE-2025-24558","title":"CRM Perks \u2013 WordPress HelpDesk Integration \u2013 Zendesk, Freshdesk, HelpScout <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2ee943a-a7be-44e3-8fe4-b9c0fbb638f1?source=api-prod","affected":[{"type":"plugin","slug":"support-x","name":"CRM Perks \u2013 WordPress HelpDesk Integration \u2013 Zendesk, Freshdesk, HelpScout","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-11-23T00:00:00Z","updated":"2025-02-21T14:44:27Z"},{"id":"wordfence:d2f777b6-5872-4196-81fb-82a9b6aaef2e","source":"wordfence","cve":"CVE-2023-45640","title":"WP ULike <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2f777b6-5872-4196-81fb-82a9b6aaef2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.6.9"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d2f78187-310a-4b6a-98f7-47917149ae7f","source":"wordfence","cve":"CVE-2024-39628","title":"Ninja Forms <= 3.8.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2f78187-310a-4b6a-98f7-47917149ae7f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2024-07-24T00:00:00Z","updated":"2024-08-01T12:52:57Z"},{"id":"wordfence:d2f78e28-5a80-4a17-afbf-3d8df29ed448","source":"wordfence","cve":"CVE-2026-94158","title":"Gloria Admin Panel <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2f78e28-5a80-4a17-afbf-3d8df29ed448?source=api-prod","affected":[{"type":"plugin","slug":"gloria-admin-panel","name":"Gloria Admin Panel","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T16:28:24Z"},{"id":"wordfence:d2f7f4dd-097e-4ee7-b430-a9e7b5323a1b","source":"wordfence","cve":"CVE-2025-68511","title":"Gutenverse Form <= 2.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2f7f4dd-097e-4ee7-b430-a9e7b5323a1b?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-form","name":"Gutenverse Form \u2013 Contact Form Builder, Block Form & Booking Form","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-06T14:11:11Z"},{"id":"wordfence:d2fbd599-0a6c-4182-87d9-ad7cf3fb5865","source":"wordfence","cve":"CVE-2024-1050","title":"Import and export users and customers <= 1.26.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2fbd599-0a6c-4182-87d9-ad7cf3fb5865?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.5","to_inclusive":true,"patched_in":"1.26.6"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-15T19:45:40Z"},{"id":"wordfence:d2fdd6eb-c848-446c-abad-7d2ea93f5512","source":"wordfence","cve":"CVE-2024-38693","title":"WP User Frontend <= 4.0.7 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2fdd6eb-c848-446c-abad-7d2ea93f5512?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:11:23Z"},{"id":"wordfence:d300288e-f100-4c02-ba65-d728e3b1522e","source":"wordfence","cve":"CVE-2023-47515","title":"Seers <= 8.1.1 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d300288e-f100-4c02-ba65-d728e3b1522e?source=api-prod","affected":[{"type":"plugin","slug":"seers-cookie-consent-banner-privacy-policy","name":"Seers AI | Cookie Consent Banner \u2013 GDPR & CCPA Compliant Consent Management Platform","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.1.2"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-22T15:45:21Z"},{"id":"wordfence:d3004699-3285-426a-8a85-33be6c0c0b6f","source":"wordfence","cve":"","title":"Print My Blog \u2013 Print, PDF, & eBook Converter <= 3.15.8 - Unprotected AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3004699-3285-426a-8a85-33be6c0c0b6f?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.15.8","to_inclusive":true,"patched_in":"3.15.9"}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3027edb-770a-43d8-8abe-e9d9a51f4ab3","source":"wordfence","cve":"","title":"Dynamic Widgets <= 1.5.1 - Cross Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3027edb-770a-43d8-8abe-e9d9a51f4ab3?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-widgets","name":"Dynamic Widgets","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3028e36-33e5-43ae-a752-2bcc8ad13a10","source":"wordfence","cve":"CVE-2025-58628","title":"Miraculous < 2.0.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3028e36-33e5-43ae-a752-2bcc8ad13a10?source=api-prod","affected":[{"type":"theme","slug":"miraculous","name":"Miraculous - Multi Vendor Online Music Store Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":false,"patched_in":"2.0.9"}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-11T14:26:34Z"},{"id":"wordfence:d302f956-3f6e-41a7-a02b-d6b4431138b8","source":"wordfence","cve":"CVE-2014-100008","title":"JS Multi Hotel <= 2.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d302f956-3f6e-41a7-a02b-d6b4431138b8?source=api-prod","affected":[{"type":"plugin","slug":"js-multihotel","name":"JS Multi Hotel","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2014-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3034130-98f8-4907-862f-e04ff67b4d20","source":"wordfence","cve":"CVE-2022-3150","title":"WP Custom Cursors <= 3.0.1 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3034130-98f8-4907-862f-e04ff67b4d20?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3039831-6a29-48de-bdf3-66cac7655719","source":"wordfence","cve":"CVE-2018-10102","title":"WordPress Core < 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3039831-6a29-48de-bdf3-66cac7655719?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.23","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.15","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.14","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"3.7.26"}],"published":"2018-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3083d76-dc4a-41eb-9165-4b0c30f1ba4b","source":"wordfence","cve":"CVE-2024-51817","title":"Combo WP Rewrite Slugs <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3083d76-dc4a-41eb-9165-4b0c30f1ba4b?source=api-prod","affected":[{"type":"plugin","slug":"combo-wp-rewrite-slugs","name":"Combo WP Rewrite Slugs","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:27:14Z"},{"id":"wordfence:d3088e5b-9e3c-4021-b99a-26ac90ece82e","source":"wordfence","cve":"CVE-2026-24374","title":"RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3088e5b-9e3c-4021-b99a-26ac90ece82e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.6.9","to_inclusive":true,"patched_in":"6.0.7.0"}],"published":"2026-01-10T00:00:00Z","updated":"2026-02-03T21:12:46Z"},{"id":"wordfence:d3092a92-db5b-4e22-b4cf-43b773c7eb48","source":"wordfence","cve":"CVE-2024-31289","title":"Hello Elementor <= 3.0.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3092a92-db5b-4e22-b4cf-43b773c7eb48?source=api-prod","affected":[{"type":"theme","slug":"hello-elementor","name":"Hello Elementor","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-17T12:57:46Z"},{"id":"wordfence:d3098565-d037-4a31-af3c-00e8b93b922e","source":"wordfence","cve":"CVE-2024-7648","title":"Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3098565-d037-4a31-af3c-00e8b93b922e?source=api-prod","affected":[{"type":"plugin","slug":"opal-membership","name":"Opal Membership","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-09T15:03:14Z","updated":"2024-08-10T03:23:26Z"},{"id":"wordfence:d30cb60e-19a1-4720-abb0-c04a66894b6a","source":"wordfence","cve":"CVE-2024-55984","title":"Saksh Escrow System <= 2.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d30cb60e-19a1-4720-abb0-c04a66894b6a?source=api-prod","affected":[{"type":"plugin","slug":"saksh-escrow-system","name":"Saksh Escrow System","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:10:31Z"},{"id":"wordfence:d30cc136-ebde-4c76-9831-ffde79bf3c4a","source":"wordfence","cve":"CVE-2024-27949","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d30cc136-ebde-4c76-9831-ffde79bf3c4a?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-04T13:18:56Z"},{"id":"wordfence:d30d9b7e-86c0-4816-9362-ac363f61d5b7","source":"wordfence","cve":"CVE-2024-49696","title":"Robo Gallery <= 3.2.21 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d30d9b7e-86c0-4816-9362-ac363f61d5b7?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:06:07Z"},{"id":"wordfence:d3103345-ce26-4bb1-898f-764ab6cf0ea0","source":"wordfence","cve":"CVE-2025-64222","title":"WooCommerce Recover Abandoned Cart <= 24.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3103345-ce26-4bb1-898f-764ab6cf0ea0?source=api-prod","affected":[{"type":"plugin","slug":"rac","name":"WooCommerce Recover Abandoned Cart","from":"*","from_inclusive":true,"to":"24.6.0","to_inclusive":true,"patched_in":"24.7.0"}],"published":"2025-11-09T00:00:00Z","updated":"2025-12-20T19:08:23Z"},{"id":"wordfence:d311170c-db2b-4c23-aa43-98d7e92839bb","source":"wordfence","cve":"CVE-2024-2925","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d311170c-db2b-4c23-aa43-98d7e92839bb?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.0.5","to_inclusive":true,"patched_in":"2.8.0.7"}],"published":"2024-04-01T00:00:00Z","updated":"2024-04-02T06:47:46Z"},{"id":"wordfence:d31195f4-2e2f-41b8-9e8f-2264aa0bfc9e","source":"wordfence","cve":"CVE-2024-50471","title":"Trip Plan <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d31195f4-2e2f-41b8-9e8f-2264aa0bfc9e?source=api-prod","affected":[{"type":"plugin","slug":"tripplan","name":"TripPlan","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-10-24T00:00:00Z","updated":"2025-03-25T18:49:51Z"},{"id":"wordfence:d311aab4-fca8-4e83-83cf-c4b8350d7dd1","source":"wordfence","cve":"CVE-2012-3414","title":"SWFUpload <= 2.2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d311aab4-fca8-4e83-83cf-c4b8350d7dd1?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-cvs-importer","name":"wp-ecommerce-cvs-importer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-image-news-slider","name":"Image News Slider","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"},{"type":"plugin","slug":"apptha-banner","name":"apptha-banner","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mac-dock-photogallery","name":"mac-dock-photogallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"comment-extra-field","name":"Comment Extra Fields","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"sprapid","name":"sprapid","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wysija-newsletters","name":"MailPoet Newsletters (Previous)","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"},{"type":"plugin","slug":"power-zoomer","name":"Power Zoomer","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"dm-albums","name":"dm-albums","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-powerplaygallery","name":"Powerplay Gallery","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"},{"type":"plugin","slug":"wp-dreamworkgallery","name":"wp-dreamworkgallery","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"wp-levoslideshow","name":"Levo Slideshow","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"apptha-slider-gallery","name":"apptha-slider-gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"smart-slide-show","name":"Smart Slideshow","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"},{"type":"plugin","slug":"mac-dock-gallery","name":"mac-dock-gallery","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"},{"type":"plugin","slug":"slide-show-pro","name":"slide-show-pro","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"},{"type":"plugin","slug":"fluid-accessible-ui-options","name":"fluid-accessible-ui-options","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"spotlightyour","name":"Spotlight","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":false,"patched_in":"4.4"},{"type":"plugin","slug":"blaze-slide-show-for-wordpress","name":"Blaze Slideshow","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.6"},{"type":"plugin","slug":"fresh-page","name":"fresh-page","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-3dbanner-rotator","name":"wp-3dbanner-rotator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"},{"type":"plugin","slug":"wp-bliss-gallery","name":"wp-bliss-gallery","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"},{"type":"plugin","slug":"wp-carouselslideshow","name":"wp-carouselslideshow","from":"*","from_inclusive":true,"to":"3.10","to_inclusive":true,"patched_in":"3.11"},{"type":"plugin","slug":"wp-matrix-gallery","name":"wp-matrix-gallery","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"wp-royal-gallery","name":"wp-royal-gallery","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"wp-extended","name":"wp-extended","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-3dflick-slideshow","name":"3D Flick Slideshow","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"wp-superb-slideshow","name":"wp-superb-slideshow","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"},{"type":"plugin","slug":"wp-flipslideshow","name":"wp-flipslideshow","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"wp-vertical-gallery","name":"wp-vertical-gallery","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"fluid-accessible-uploader","name":"fluid-accessible-uploader","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pdw-file-browser","name":"PDF File Browser","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-homepage-slideshow","name":"Homepage SlideShow","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"},{"type":"plugin","slug":"wp-yasslideshow","name":"wp-yasslideshow","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"},{"type":"plugin","slug":"flash-album-gallery","name":"Album and Image Gallery with Lightbox \u2013 Flagallery Photo Portfolio","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":false,"patched_in":"2.12"},{"type":"plugin","slug":"fluid-accessible-pager","name":"fluid-accessible-pager","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"},{"type":"plugin","slug":"ultimate-tinymce","name":"Ultimate TinyMCE","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.6"},{"type":"plugin","slug":"fluid-accessible-rich-inline-edit","name":"fluid-accessible-rich-inline-edit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"pica-photo-gallery","name":"PICA Photo Gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-11-09T20:12:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3120a05-2fc1-4f63-b771-3ed76165eac5","source":"wordfence","cve":"CVE-2026-96961","title":"Pie Register <= 3.8.4.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3120a05-2fc1-4f63-b771-3ed76165eac5?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.15","to_inclusive":true,"patched_in":"3.8.4.16"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T20:11:25Z"},{"id":"wordfence:d317d40b-2b99-408b-b445-1a789df3c958","source":"wordfence","cve":"CVE-2026-8279","title":"Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-09-06T00:00:00Z","updated":"2026-09-07T12:29:05Z"},{"id":"wordfence:d317f2c7-06f3-4875-9f9b-eb7f450aa2f4","source":"wordfence","cve":"CVE-2023-6963","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.4 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d317f2c7-06f3-4875-9f9b-eb7f450aa2f4?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2024-01-17T00:00:00Z","updated":"2024-02-05T21:22:02Z"},{"id":"wordfence:d3184996-655c-41d5-a3c5-6b36fbff58dc","source":"wordfence","cve":"CVE-2024-8988","title":"PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3184996-655c-41d5-a3c5-6b36fbff58dc?source=api-prod","affected":[{"type":"plugin","slug":"peepso-files","name":"PeepSo Core: File Uploads","from":"*","from_inclusive":true,"to":"6.4.6.0","to_inclusive":true,"patched_in":"6.4.6.1"}],"published":"2025-05-13T00:00:00Z","updated":"2025-05-14T08:22:11Z"},{"id":"wordfence:d31aad1c-89d4-4f71-bfed-a795f7a4f209","source":"wordfence","cve":"CVE-2023-1911","title":"Blocksy Companion <= 1.8.81 - Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d31aad1c-89d4-4f71-bfed-a795f7a4f209?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"1.8.81","to_inclusive":true,"patched_in":"1.8.82"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d31b855d-39fb-4f2f-91b6-daa6fe8bb4e9","source":"wordfence","cve":"CVE-2025-64228","title":"SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d31b855d-39fb-4f2f-91b6-daa6fe8bb4e9?source=api-prod","affected":[{"type":"plugin","slug":"affs","name":"SUMO Affiliates Pro","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":"11.1.0"}],"published":"2025-11-04T00:00:00Z","updated":"2025-11-04T15:49:14Z"},{"id":"wordfence:d31b9022-ae45-4bc2-b820-fb88faf0796f","source":"wordfence","cve":"CVE-2023-22711","title":"IMPress Listings <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d31b9022-ae45-4bc2-b820-fb88faf0796f?source=api-prod","affected":[{"type":"plugin","slug":"wp-listings","name":"IMPress Listings","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d31d0553-9378-4c7e-a258-12562aa6b388","source":"wordfence","cve":"CVE-2023-5054","title":"Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=api-prod","affected":[{"type":"plugin","slug":"superstorefinder-wp","name":"Super Store Finder","from":"*","from_inclusive":true,"to":"6.9.3","to_inclusive":true,"patched_in":"6.9.4"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d321183a-f0ef-4b5b-855a-da95edb610b9","source":"wordfence","cve":"CVE-2025-12190","title":"Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d321183a-f0ef-4b5b-855a-da95edb610b9?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer-wpssk","name":"Image Optimizer by wps.sk","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:39:41Z","updated":"2025-12-05T05:31:31Z"},{"id":"wordfence:d32215b5-9ecb-4feb-b76f-18821184dd8b","source":"wordfence","cve":"CVE-2024-3821","title":"wpDataTables - Tables & Table Charts (Premium) <= 6.3.2 - Missing Authorization to DataTable Access & Modification","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d32215b5-9ecb-4feb-b76f-18821184dd8b?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"6.3.2","to_inclusive":true,"patched_in":"6.4"}],"published":"2024-05-31T00:00:00Z","updated":"2025-10-30T11:18:40Z"},{"id":"wordfence:d3221af7-13ea-4c90-b2ca-75eb3d373ed3","source":"wordfence","cve":"CVE-2018-0589","title":"Ultimate Member <= 2.0.3 - Improper Access Control","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3221af7-13ea-4c90-b2ca-75eb3d373ed3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2018-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d322fc70-7dc0-439e-936a-da449e310012","source":"wordfence","cve":"CVE-2025-66102","title":"FV Antispam <= 2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d322fc70-7dc0-439e-936a-da449e310012?source=api-prod","affected":[{"type":"plugin","slug":"fv-antispam","name":"FV Antispam","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-19T16:53:48Z"},{"id":"wordfence:d323d28f-280c-49cd-b7f7-3e272ea62549","source":"wordfence","cve":"CVE-2017-6095","title":"Mail Masta <= 1.0 - SQL Injection via list_id parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d323d28f-280c-49cd-b7f7-3e272ea62549?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d32591d3-f2e4-429e-b703-507a9464bcc7","source":"wordfence","cve":"CVE-2026-66480","title":"YITH WooCommerce Product Add-Ons <= 4.34.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d32591d3-f2e4-429e-b703-507a9464bcc7?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.34.0","to_inclusive":true,"patched_in":"4.34.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:58:34Z"},{"id":"wordfence:d328e059-7235-496d-9c5a-c394df7ad235","source":"wordfence","cve":"CVE-2025-14316","title":"AhaChat Messenger Marketing <= 1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d328e059-7235-496d-9c5a-c394df7ad235?source=api-prod","affected":[{"type":"plugin","slug":"ahachat-messenger-marketing","name":"AhaChat Messenger Marketing","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-01-27T19:02:31Z"},{"id":"wordfence:d32b458f-9fc3-4bcc-8009-9832070a7edb","source":"wordfence","cve":"CVE-2026-106600","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d32b458f-9fc3-4bcc-8009-9832070a7edb?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.18.0","to_inclusive":true,"patched_in":"4.18.0.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:32:15Z"},{"id":"wordfence:d32ceb67-8ad1-4f59-b4a8-63c9c3e8b90c","source":"wordfence","cve":"CVE-2022-46848","title":"Visualizer <= 3.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d32ceb67-8ad1-4f59-b4a8-63c9c3e8b90c?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d32f7e98-8203-400e-bc26-4556ddba2510","source":"wordfence","cve":"CVE-2025-12498","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d32f7e98-8203-400e-bc26-4556ddba2510?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.2.0.0","to_inclusive":true,"patched_in":"4.2.0.1"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T06:39:57Z"},{"id":"wordfence:d3300568-4197-4cff-a6f0-696c6d4df075","source":"wordfence","cve":"CVE-2025-22358","title":"Wp advertising management <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3300568-4197-4cff-a6f0-696c6d4df075?source=api-prod","affected":[{"type":"plugin","slug":"advertising-management","name":"Wp advertising management","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:55:12Z"},{"id":"wordfence:d33199ea-7c96-4c60-a7b8-5c7e9835e231","source":"wordfence","cve":"CVE-2024-13609","title":"1 Click WordPress Migration Plugin \u2013 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33199ea-7c96-4c60-a7b8-5c7e9835e231?source=api-prod","affected":[{"type":"plugin","slug":"1-click-migration","name":"1-Click WordPress Migration Plugin \u2013 Backup, Migrate & Clone","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-02-17T15:39:51Z","updated":"2025-11-06T15:33:36Z"},{"id":"wordfence:d3326e9d-504f-444f-baf7-03989594f483","source":"wordfence","cve":"CVE-2024-12563","title":"s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3326e9d-504f-444f-baf7-03989594f483?source=api-prod","affected":[{"type":"plugin","slug":"s2member-pro","name":"s2Member Pro","from":"*","from_inclusive":true,"to":"250214","to_inclusive":true,"patched_in":"250419"}],"published":"2025-03-18T00:00:00Z","updated":"2025-04-21T04:10:22Z"},{"id":"wordfence:d33437b9-e3c7-4e77-a439-22eb890e2ede","source":"wordfence","cve":"CVE-2025-31602","title":"Apimo Connector <= 2.6.3.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33437b9-e3c7-4e77-a439-22eb890e2ede?source=api-prod","affected":[{"type":"plugin","slug":"apimo","name":"Apimo Connector","from":"*","from_inclusive":true,"to":"2.6.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:02:48Z"},{"id":"wordfence:d3343d96-ca52-46a6-b464-cd2e5375d10f","source":"wordfence","cve":"","title":"Fathom Analytics <= 3.0.7 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3343d96-ca52-46a6-b464-cd2e5375d10f?source=api-prod","affected":[{"type":"plugin","slug":"fathom-analytics","name":"Fathom Analytics for WP","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d33467d4-aabd-4030-ba10-68e2460b2ed2","source":"wordfence","cve":"CVE-2022-24663","title":"PHP Everywhere <= 2.0.3 - Remote Code Execution by Subscriber+ users via shortcode","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33467d4-aabd-4030-ba10-68e2460b2ed2?source=api-prod","affected":[{"type":"plugin","slug":"php-everywhere","name":"PHP Everywhere","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2022-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3364c9d-f814-4e48-a14b-50e7b02123f5","source":"wordfence","cve":"CVE-2026-31918","title":"immonex Kickstart <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3364c9d-f814-4e48-a14b-50e7b02123f5?source=api-prod","affected":[{"type":"plugin","slug":"immonex-kickstart","name":"immonex Kickstart","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2026-02-05T00:00:00Z","updated":"2026-04-15T20:43:46Z"},{"id":"wordfence:d33721e2-0a90-4102-84d5-2633c0fd47ed","source":"wordfence","cve":"CVE-2025-14030","title":"AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33721e2-0a90-4102-84d5-2633c0fd47ed?source=api-prod","affected":[{"type":"plugin","slug":"ai-feeds","name":"AI Feeds","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2025-12-11T21:24:12Z","updated":"2025-12-12T11:15:54Z"},{"id":"wordfence:d337e39c-3a3d-4465-bc40-77f0b27aeab2","source":"wordfence","cve":"CVE-2023-48289","title":"Import Spreadsheets from Microsoft Excel <= 10.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d337e39c-3a3d-4465-bc40-77f0b27aeab2?source=api-prod","affected":[{"type":"plugin","slug":"import-spreadsheets-from-microsoft-excel","name":"SpreadsheetConverter Calculator","from":"*","from_inclusive":true,"to":"10.1.3","to_inclusive":true,"patched_in":"10.1.4"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d338b583-4587-4b8d-b78e-a1b9a1054435","source":"wordfence","cve":"CVE-2024-29932","title":"WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d338b583-4587-4b8d-b78e-a1b9a1054435?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:28:50Z"},{"id":"wordfence:d33a77c6-9977-4d92-92c4-4273ee73452e","source":"wordfence","cve":"CVE-2020-35947","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33a77c6-9977-4d92-92c4-4273ee73452e?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d33b83d5-cfc0-48b6-a54e-1ae8ac52aae1","source":"wordfence","cve":"CVE-2025-12093","title":"Voidek Employee Portal <= 1.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33b83d5-cfc0-48b6-a54e-1ae8ac52aae1?source=api-prod","affected":[{"type":"plugin","slug":"voidek-employee-portal","name":"Voidek Employee Portal","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-12-04T17:32:22Z","updated":"2025-12-19T14:33:36Z"},{"id":"wordfence:d33cc844-eaed-4006-aae1-122b773e9f11","source":"wordfence","cve":"CVE-2024-49298","title":"PeproDev Ultimate Invoice <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33cc844-eaed-4006-aae1-122b773e9f11?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:57:17Z"},{"id":"wordfence:d33df4e4-6ac7-499a-9d43-d19e287f7689","source":"wordfence","cve":"CVE-2015-10117","title":"GF Windcave Free <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33df4e4-6ac7-499a-9d43-d19e287f7689?source=api-prod","affected":[{"type":"plugin","slug":"gravity-forms-dps-pxpay","name":"GF Windcave Free","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2015-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d33fad22-7778-4407-9324-6edf7c333569","source":"wordfence","cve":"CVE-2024-51841","title":"File Select Control For Elementor <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33fad22-7778-4407-9324-6edf7c333569?source=api-prod","affected":[{"type":"plugin","slug":"file-select-control-for-elementor","name":"File Select Control For Elementor","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:29:29Z"},{"id":"wordfence:d33ff4cc-a44d-4c13-bbed-f4581469e9cd","source":"wordfence","cve":"CVE-2024-43299","title":"SpeedyCache <= 1.1.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d33ff4cc-a44d-4c13-bbed-f4581469e9cd?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:23:04Z"},{"id":"wordfence:d3405b50-a3f0-4280-8a34-ed86ce3d4db4","source":"wordfence","cve":"CVE-2025-1527","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +20 Modules \u2013 All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3405b50-a3f0-4280-8a34-ed86ce3d4db4?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T11:13:34Z"},{"id":"wordfence:d340b74c-e9e5-4221-a1f3-c8e652c575c8","source":"wordfence","cve":"CVE-2026-82184","title":"WPLP Cookie Consent <= 4.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d340b74c-e9e5-4221-a1f3-c8e652c575c8?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:19:16Z"},{"id":"wordfence:d342e8a3-d9fc-4ad1-ba82-ac9c4a37a78c","source":"wordfence","cve":"CVE-2026-57326","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 6.4.22 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d342e8a3-d9fc-4ad1-ba82-ac9c4a37a78c?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.22","to_inclusive":true,"patched_in":"6.4.23"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:57:43Z"},{"id":"wordfence:d3457b87-c860-4cf2-ac3d-2c6521b629ea","source":"wordfence","cve":"CVE-2024-0516","title":"Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3457b87-c860-4cf2-ac3d-2c6521b629ea?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:32Z"},{"id":"wordfence:d34701a0-c745-441c-8d6c-7befc877f8d0","source":"wordfence","cve":"CVE-2025-12655","title":"Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d34701a0-c745-441c-8d6c-7befc877f8d0?source=api-prod","affected":[{"type":"plugin","slug":"hippoo","name":"Hippoo Mobile App for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-12-11T17:41:07Z","updated":"2025-12-12T06:32:59Z"},{"id":"wordfence:d3487779-555e-416d-a2b7-7686c4dc6db7","source":"wordfence","cve":"CVE-2025-58997","title":"Mow <= 4.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3487779-555e-416d-a2b7-7686c4dc6db7?source=api-prod","affected":[{"type":"theme","slug":"mow","name":"Mow","from":"*","from_inclusive":true,"to":"4.10","to_inclusive":true,"patched_in":"4.11"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:23:54Z"},{"id":"wordfence:d34936af-f3a4-414d-ad71-7ad3af6feed4","source":"wordfence","cve":"CVE-2025-49894","title":"WP Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d34936af-f3a4-414d-ad71-7ad3af6feed4?source=api-prod","affected":[{"type":"plugin","slug":"wp-emmet","name":"WP Emmet","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2025-08-18T15:47:16Z"},{"id":"wordfence:d349a232-2852-45be-891c-70053f6a1d26","source":"wordfence","cve":"CVE-2025-6174","title":"WordPress Qwizcards <= 3.94 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d349a232-2852-45be-891c-70053f6a1d26?source=api-prod","affected":[{"type":"plugin","slug":"qwiz-online-quizzes-and-flashcards","name":"Qwizcards | online quizzes and flashcards","from":"*","from_inclusive":true,"to":"3.94","to_inclusive":true,"patched_in":"3.95"}],"published":"2025-07-02T00:00:00Z","updated":"2025-08-25T17:11:59Z"},{"id":"wordfence:d34ba8b3-e8a8-4810-a0d9-8781bc7d1201","source":"wordfence","cve":"CVE-2024-56300","title":"Post/Page Copying Tool <= 2.0.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d34ba8b3-e8a8-4810-a0d9-8781bc7d1201?source=api-prod","affected":[{"type":"plugin","slug":"postpage-import-export-with-custom-fields-taxonomies","name":"Post/Page Import Export \u2013 Migrate Content with Custom Fields & Taxonomies","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:45:59Z"},{"id":"wordfence:d34f4e77-f384-4d84-be32-0d349962b614","source":"wordfence","cve":"CVE-2026-14245","title":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d34f4e77-f384-4d84-be32-0d349962b614?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-otp-verification","name":"miniOrange OTP Login, Verification and SMS Notifications","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-07-08T19:20:36Z","updated":"2026-07-09T07:55:14Z"},{"id":"wordfence:d35266cd-41e6-4358-afaa-bc008962f2e1","source":"wordfence","cve":"CVE-2024-1859","title":"Slider Responsive Slideshow \u2013 Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35266cd-41e6-4358-afaa-bc008962f2e1?source=api-prod","affected":[{"type":"plugin","slug":"slider-responsive-slideshow","name":"Responsive Slideshow \u2013 Photo Carousel","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-01T06:47:52Z"},{"id":"wordfence:d352e4d1-92ab-482b-8fce-90ee3e22ba3c","source":"wordfence","cve":"CVE-2026-17580","title":"Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d352e4d1-92ab-482b-8fce-90ee3e22ba3c?source=api-prod","affected":[{"type":"plugin","slug":"acf-views","name":"Advanced Views \u2013 Display Framework \u2013 Gutenberg/Elementor/Shortcode","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-07-31T19:18:52Z","updated":"2026-08-01T07:49:53Z"},{"id":"wordfence:d353bd5b-2155-458a-8959-89358bb00126","source":"wordfence","cve":"CVE-2026-54192","title":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups <= 6.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d353bd5b-2155-458a-8959-89358bb00126?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"6.2.9","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-23T16:00:06Z"},{"id":"wordfence:d353d8b7-76a5-45ce-aa7c-d571dedcbfd4","source":"wordfence","cve":"CVE-2023-25046","title":"Podlove Podcast Publisher <= 3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d353d8b7-76a5-45ce-aa7c-d571dedcbfd4?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3543a39-ad88-40be-93b8-36ec638db4bd","source":"wordfence","cve":"CVE-2023-33923","title":"Multiple Themes (Various Versions) - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3543a39-ad88-40be-93b8-36ec638db4bd?source=api-prod","affected":[{"type":"theme","slug":"viral-news","name":"Viral News","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"},{"type":"theme","slug":"hashone","name":"HashOne","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"theme","slug":"viral","name":"Viral","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d357f92a-3c20-4972-af4d-65053027d31c","source":"wordfence","cve":"CVE-2017-9066","title":"WordPress Core < 4.7.5 - Server-Side Request Forgery","severity":"high","cvss":7.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d357f92a-3c20-4972-af4d-65053027d31c?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d359dc78-fc90-4570-a768-5f1a05f865e1","source":"wordfence","cve":"CVE-2024-2328","title":"Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d359dc78-fc90-4570-a768-5f1a05f865e1?source=api-prod","affected":[{"type":"plugin","slug":"real-media-library-lite","name":"Real Media Library: Media Library Folder & File Manager","from":"*","from_inclusive":true,"to":"4.22.11","to_inclusive":true,"patched_in":"4.22.12"}],"published":"2024-04-15T00:00:00Z","updated":"2024-06-19T17:08:23Z"},{"id":"wordfence:d35dd18b-0f05-482f-aef3-08977cbec8a0","source":"wordfence","cve":"CVE-2024-7063","title":"ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35dd18b-0f05-482f-aef3-08977cbec8a0?source=api-prod","affected":[{"type":"plugin","slug":"elementskit","name":"ElementsKit Pro","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2024-08-14T00:00:00Z","updated":"2024-08-15T05:30:58Z"},{"id":"wordfence:d35e2d84-12c7-4c01-bde9-2fb05583a212","source":"wordfence","cve":"CVE-2024-39634","title":"PowerPack Pro for Elementor <= 2.10.14 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35e2d84-12c7-4c01-bde9-2fb05583a212?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"2.10.14","to_inclusive":true,"patched_in":"2.10.15"}],"published":"2024-07-24T00:00:00Z","updated":"2024-08-01T16:53:19Z"},{"id":"wordfence:d35ea739-5ee9-4779-87d5-3f13b11229cf","source":"wordfence","cve":"CVE-2025-2805","title":"ORDER POST <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ea739-5ee9-4779-87d5-3f13b11229cf?source=api-prod","affected":[{"type":"plugin","slug":"order-post","name":"ORDER POST","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T18:09:31Z","updated":"2025-04-10T07:02:40Z"},{"id":"wordfence:d35ec0f0-fa7a-4531-b5f7-5adcf2af051c","source":"wordfence","cve":"CVE-2023-5383","title":"Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ec0f0-fa7a-4531-b5f7-5adcf2af051c?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d35faf39-4882-4393-9b77-57dc45ac9d04","source":"wordfence","cve":"CVE-2025-11370","title":"Depicter <= 4.0.7 - Missing Authorization to Unauthenticated Display Rule Updates","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35faf39-4882-4393-9b77-57dc45ac9d04?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-01-05T15:17:33Z","updated":"2026-01-06T03:21:40Z"},{"id":"wordfence:d35ff2cc-9af2-4b72-bc49-e205275daa4d","source":"wordfence","cve":"CVE-2024-6590","title":"Spreadsheet Integration \u2013 Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d35ff2cc-9af2-4b72-bc49-e205275daa4d?source=api-prod","affected":[{"type":"plugin","slug":"wpgsi","name":"WPGSI: Spreadsheet Integration","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-09-24T12:20:20Z","updated":"2024-10-08T22:21:00Z"},{"id":"wordfence:d360de79-8490-4e70-b2d9-4f01a1ed3305","source":"wordfence","cve":"CVE-2025-3897","title":"EUCookieLaw <= 2.7.2 - Unauthenticated Arbitrary File Read","severity":"medium","cvss":5.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d360de79-8490-4e70-b2d9-4f01a1ed3305?source=api-prod","affected":[{"type":"plugin","slug":"eucookielaw","name":"EUCookieLaw","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-09T11:11:21Z"},{"id":"wordfence:d3626ab4-edda-449e-8906-39fe9cd81644","source":"wordfence","cve":"CVE-2026-42634","title":"Video Background Block \u2013 Add Stunning Video Backgrounds to Any Section <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3626ab4-edda-449e-8906-39fe9cd81644?source=api-prod","affected":[{"type":"plugin","slug":"video-background-block","name":"Video Background Block \u2013 Add Stunning Video Backgrounds to Any Section","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-10-05T16:21:05Z","updated":"2026-10-28T21:17:10Z"},{"id":"wordfence:d36856c1-5b61-403d-816e-7efa8ca4d41a","source":"wordfence","cve":"CVE-2026-49075","title":"JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d36856c1-5b61-403d-816e-7efa8ca4d41a?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.9.1","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:39:39Z"},{"id":"wordfence:d36b08fb-5619-4c5c-8124-9c82a834085b","source":"wordfence","cve":"CVE-2026-22426","title":"Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d36b08fb-5619-4c5c-8124-9c82a834085b?source=api-prod","affected":[{"type":"theme","slug":"sweetjane","name":"Sweet Jane - Delightful Cake Shop Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:22:49Z"},{"id":"wordfence:d36d97fb-2fce-4248-8955-7d66919487e3","source":"wordfence","cve":"","title":"Automatic pages for Privacy Policy, Terms, About, Contact us <= 1.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d36d97fb-2fce-4248-8955-7d66919487e3?source=api-prod","affected":[{"type":"plugin","slug":"automatic-pages-for-privacy-policy-terms-about-and-contact","name":"Automatic pages for Privacy Policy, Terms, About, Contact us","from":"*","from_inclusive":true,"to":"1.41","to_inclusive":true,"patched_in":"1.42"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d36e869a-5bd4-4f59-8e28-01fa586024c5","source":"wordfence","cve":"CVE-2023-48277","title":"Super Progressive Web Apps <= 2.2.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d36e869a-5bd4-4f59-8e28-01fa586024c5?source=api-prod","affected":[{"type":"plugin","slug":"super-progressive-web-apps","name":"Super Progressive Web Apps","from":"*","from_inclusive":true,"to":"2.2.21","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2023-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d372fbca-47c8-45b8-b5cb-83b8367860f4","source":"wordfence","cve":"CVE-2024-45269","title":"Carousel Slider <= 1.10.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d372fbca-47c8-45b8-b5cb-83b8367860f4?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-30T00:00:00Z","updated":"2024-09-12T16:38:05Z"},{"id":"wordfence:d37599aa-d8e0-4ff2-8e15-a96f1865f4d9","source":"wordfence","cve":"CVE-2025-9204","title":"X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d37599aa-d8e0-4ff2-8e15-a96f1865f4d9?source=api-prod","affected":[{"type":"plugin","slug":"x-addons-elementor","name":"X Addons for Elementor \u2013 20+ Widgets, Templates & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2025-10-02T22:36:18Z","updated":"2025-10-10T21:03:22Z"},{"id":"wordfence:d3775d48-5985-475e-8fb9-c4c5fd044772","source":"wordfence","cve":"CVE-2024-11178","title":"Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3775d48-5985-475e-8fb9-c4c5fd044772?source=api-prod","affected":[{"type":"plugin","slug":"otp-login","name":"Login with OTP","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-05T00:00:00Z","updated":"2025-03-04T23:36:39Z"},{"id":"wordfence:d379bc09-7788-4a29-b23f-7f42afe04fd4","source":"wordfence","cve":"CVE-2025-4317","title":"TheGem <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d379bc09-7788-4a29-b23f-7f42afe04fd4?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.10.3","to_inclusive":true,"patched_in":"5.10.3.1"}],"published":"2025-05-12T18:13:07Z","updated":"2025-05-13T06:40:55Z"},{"id":"wordfence:d37b10f7-ea20-47cb-913a-4286c2ee2771","source":"wordfence","cve":"CVE-2013-5672","title":"Testimonial < 2.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d37b10f7-ea20-47cb-913a-4286c2ee2771?source=api-prod","affected":[{"type":"plugin","slug":"indianic-testimonial","name":"Testimonial","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2013-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d37bb136-c53d-4760-b7fd-91e6f20fbc20","source":"wordfence","cve":"CVE-2024-51816","title":"Banner System <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d37bb136-c53d-4760-b7fd-91e6f20fbc20?source=api-prod","affected":[{"type":"plugin","slug":"banner-system","name":"Banner System","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:42:37Z"},{"id":"wordfence:d3804220-7c80-419c-9bf5-174e5c8ea924","source":"wordfence","cve":"CVE-2024-43991","title":"Hotel Galaxy <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3804220-7c80-419c-9bf5-174e5c8ea924?source=api-prod","affected":[{"type":"theme","slug":"hotel-galaxy","name":"Hotel Galaxy","from":"*","from_inclusive":true,"to":"4.4.24","to_inclusive":true,"patched_in":""}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:26:58Z"},{"id":"wordfence:d3849db8-5c9e-410e-be53-c9ab76162630","source":"wordfence","cve":"CVE-2026-4834","title":"WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3849db8-5c9e-410e-be53-c9ab76162630?source=api-prod","affected":[{"type":"plugin","slug":"erp-pro","name":"WP ERP Pro","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-21T14:13:56Z","updated":"2026-05-22T02:28:08Z"},{"id":"wordfence:d384e03a-ad2d-4399-9c82-a0ff70ac90f7","source":"wordfence","cve":"CVE-2026-97255","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1069 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d384e03a-ad2d-4399-9c82-a0ff70ac90f7?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1069","to_inclusive":true,"patched_in":"1.7.1070"}],"published":"2026-10-26T10:03:00Z","updated":"2026-10-28T01:28:28Z"},{"id":"wordfence:d385813e-960e-40ec-8b0f-8d2056a544c3","source":"wordfence","cve":"CVE-2025-49410","title":"TC Testimonials <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d385813e-960e-40ec-8b0f-8d2056a544c3?source=api-prod","affected":[{"type":"plugin","slug":"tc-testimonial","name":"TC Testimonials","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:09:47Z"},{"id":"wordfence:d386f842-24f6-4b09-a2eb-cbf7712f7123","source":"wordfence","cve":"CVE-2024-49666","title":"ARPrice <= 4.1.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d386f842-24f6-4b09-a2eb-cbf7712f7123?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-03T00:00:00Z","updated":"2026-02-26T15:03:14Z"},{"id":"wordfence:d38762ea-fceb-4f98-a976-c1185f15ecf9","source":"wordfence","cve":"CVE-2025-58873","title":"Pushe Web Push Notification <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38762ea-fceb-4f98-a976-c1185f15ecf9?source=api-prod","affected":[{"type":"plugin","slug":"pushe-webpush","name":"Pushe Web Push Notification","from":"*","from_inclusive":true,"to":"0.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:27:47Z"},{"id":"wordfence:d38cf4d5-a2b3-46c7-9cbc-777ebf6a68be","source":"wordfence","cve":"CVE-2024-31092","title":"Comic Easel <= 1.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38cf4d5-a2b3-46c7-9cbc-777ebf6a68be?source=api-prod","affected":[{"type":"plugin","slug":"comic-easel","name":"Comic Easel","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:23:52Z"},{"id":"wordfence:d38d41c7-8786-4145-9591-3e24eff3b79c","source":"wordfence","cve":"CVE-2023-2087","title":"Essential Blocks <= 4.0.6 - Cross-Site Request Forgery via save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38d41c7-8786-4145-9591-3e24eff3b79c?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d38ee896-8cdd-45c5-b393-bdcb7baa7bd3","source":"wordfence","cve":"CVE-2024-21744","title":"Mapster WP Maps <= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38ee896-8cdd-45c5-b393-bdcb7baa7bd3?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.2.38","to_inclusive":true,"patched_in":"1.2.39"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-24T14:04:16Z"},{"id":"wordfence:d38fa0a1-3493-4f0d-9ef9-9cdcdebc351a","source":"wordfence","cve":"CVE-2026-84765","title":"Breadcrumb NavXT <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38fa0a1-3493-4f0d-9ef9-9cdcdebc351a?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumb-navxt","name":"Breadcrumb NavXT","from":"*","from_inclusive":true,"to":"7.5.1","to_inclusive":true,"patched_in":"7.5.2"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:19:33Z"},{"id":"wordfence:d38fd7d0-0d04-4d60-bb5b-7a68758df83c","source":"wordfence","cve":"CVE-2025-31001","title":"GTM Kit <= 2.4.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d38fd7d0-0d04-4d60-bb5b-7a68758df83c?source=api-prod","affected":[{"type":"plugin","slug":"gtm-kit","name":"GTM Kit \u2013 Google Tag Manager & GA4 integration","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-10T13:16:17Z"},{"id":"wordfence:d390186e-b6a3-4c9c-8065-2ac4fff9be37","source":"wordfence","cve":"CVE-2026-12723","title":"Kirki <= 6.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d390186e-b6a3-4c9c-8065-2ac4fff9be37?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T22:39:55Z"},{"id":"wordfence:d3905ebe-334c-4c6f-a430-4c25cd15c61f","source":"wordfence","cve":"CVE-2024-29935","title":"Sina Extension for Elementor <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3905ebe-334c-4c6f-a430-4c25cd15c61f?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:49:51Z"},{"id":"wordfence:d3908109-5c40-4099-9c6c-64627a719f00","source":"wordfence","cve":"CVE-2026-81404","title":"IPGP Visitors Origin < 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3908109-5c40-4099-9c6c-64627a719f00?source=api-prod","affected":[{"type":"plugin","slug":"ipgp-visitors-origin","name":"IPGP Visitors Origin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-09T13:01:43Z"},{"id":"wordfence:d392a5e7-2cfd-44c3-8fa0-cf0bc498f6b8","source":"wordfence","cve":"CVE-2025-30970","title":"Easy Contact <= 0.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d392a5e7-2cfd-44c3-8fa0-cf0bc498f6b8?source=api-prod","affected":[{"type":"plugin","slug":"easy-contact","name":"Easy Contact","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T13:18:00Z"},{"id":"wordfence:d392b84b-2a1f-430c-84a1-22431763a6a5","source":"wordfence","cve":"CVE-2019-11869","title":"Yuzo Related Posts <= 5.12.93 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d392b84b-2a1f-430c-84a1-22431763a6a5?source=api-prod","affected":[{"type":"plugin","slug":"yuzo-related-post","name":"YUZO","from":"*","from_inclusive":true,"to":"5.12.94","to_inclusive":false,"patched_in":"5.12.94"}],"published":"2019-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3945a60-6be2-4ce5-850e-a214523fb584","source":"wordfence","cve":"CVE-2024-13116","title":"Crelly Slider <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3945a60-6be2-4ce5-850e-a214523fb584?source=api-prod","affected":[{"type":"plugin","slug":"crelly-slider","name":"Crelly Slider","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-18T14:46:32Z"},{"id":"wordfence:d3967eae-dc58-4935-af2b-3eff84fa26bd","source":"wordfence","cve":"CVE-2026-94662","title":"Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3967eae-dc58-4935-af2b-3eff84fa26bd?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2026-10-02T07:04:18Z","updated":"2026-10-09T00:08:21Z"},{"id":"wordfence:d396e47a-cabe-4498-9269-d67bdeb0c570","source":"wordfence","cve":"CVE-2016-10996","title":"Popup Builder by OptinMonster <= 1.1.4.5 - Remote Code Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d396e47a-cabe-4498-9269-d67bdeb0c570?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"1.1.4.6","to_inclusive":false,"patched_in":"1.1.4.6"}],"published":"2016-01-14T11:25:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d396e90b-c113-4534-8ce3-27bea3bd7296","source":"wordfence","cve":"","title":"Predictive Search <= 1.2.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d396e90b-c113-4534-8ce3-27bea3bd7296?source=api-prod","affected":[{"type":"plugin","slug":"predictive-search","name":"Predictive Search","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d396ed2e-ae33-4cc8-a943-df33d9f1aeb4","source":"wordfence","cve":"CVE-2025-26924","title":"Ohio Extra <= 3.4.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d396ed2e-ae33-4cc8-a943-df33d9f1aeb4?source=api-prod","affected":[{"type":"plugin","slug":"ohio-extra","name":"Ohio Extra","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:34:39Z"},{"id":"wordfence:d3980ba8-e3f0-45f4-a2c3-c4a810e158ec","source":"wordfence","cve":"CVE-2026-39550","title":"Aperitif <= 1.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3980ba8-e3f0-45f4-a2c3-c4a810e158ec?source=api-prod","affected":[{"type":"theme","slug":"aperitif","name":"Aperitif - Wine Shop and Liquor Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:03:06Z"},{"id":"wordfence:d3999c59-57a9-410c-a550-7d198bdb25ea","source":"wordfence","cve":"CVE-2024-2501","title":"Hubbub Lite \u2013 Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3999c59-57a9-410c-a550-7d198bdb25ea?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.33.1","to_inclusive":true,"patched_in":"1.33.2"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-09T18:59:23Z"},{"id":"wordfence:d39a73dd-5d62-43cc-af36-6bdf85dec3f1","source":"wordfence","cve":"CVE-2012-6629","title":"Newsletter Manager < 1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d39a73dd-5d62-43cc-af36-6bdf85dec3f1?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-manager","name":"Newsletter Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2014-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d39a85fe-8cae-4ba1-b100-fbfa5a08df67","source":"wordfence","cve":"CVE-2024-54283","title":"SeedProd Pro <= 6.18.12 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d39a85fe-8cae-4ba1-b100-fbfa5a08df67?source=api-prod","affected":[{"type":"plugin","slug":"seedprod-coming-soon-pro-5","name":"SeedProd Pro","from":"*","from_inclusive":true,"to":"6.18.12","to_inclusive":true,"patched_in":"6.18.13"}],"published":"2024-12-11T00:00:00Z","updated":"2025-02-27T16:54:15Z"},{"id":"wordfence:d39ec46d-58c4-40e4-b94a-e7a9fc99291a","source":"wordfence","cve":"CVE-2026-1722","title":"WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d39ec46d-58c4-40e4-b94a-e7a9fc99291a?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-02-09T18:54:40Z","updated":"2026-02-10T07:27:03Z"},{"id":"wordfence:d3a04d92-1ce8-4405-9d26-0635384106b4","source":"wordfence","cve":"CVE-2026-22403","title":"Innovio - Multipurpose Landing Page WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a04d92-1ce8-4405-9d26-0635384106b4?source=api-prod","affected":[{"type":"theme","slug":"innovio","name":"Innovio - Multipurpose Landing Page WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:38:21Z"},{"id":"wordfence:d3a4fa4d-a7d2-4890-b0f5-5fe69bc5e7ac","source":"wordfence","cve":"CVE-2024-12919","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a4fa4d-a7d2-4890-b0f5-5fe69bc5e7ac?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.13.7","to_inclusive":true,"patched_in":"2.13.8"}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-14T09:21:57Z"},{"id":"wordfence:d3a5be68-8073-48b0-a536-bb3a05e83dda","source":"wordfence","cve":"CVE-2025-13559","title":"EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a5be68-8073-48b0-a536-bb3a05e83dda?source=api-prod","affected":[{"type":"plugin","slug":"edukart-pro","name":"EduKart Pro","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T15:49:25Z","updated":"2025-11-25T04:38:01Z"},{"id":"wordfence:d3a5d7c3-b9dd-46e8-92e2-455ef1394b50","source":"wordfence","cve":"CVE-2017-12131","title":"Easy Testimonials <= 3.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a5d7c3-b9dd-46e8-92e2-455ef1394b50?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2017-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3a9a1f1-566f-478e-a0b7-857c12f21ff7","source":"wordfence","cve":"CVE-2023-4604","title":"Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting via 'post'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a9a1f1-566f-478e-a0b7-857c12f21ff7?source=api-prod","affected":[{"type":"plugin","slug":"2j-slideshow","name":"Slideshow, Image Slider by 2J","from":"*","from_inclusive":true,"to":"1.3.54","to_inclusive":true,"patched_in":""}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T07:34:25Z"},{"id":"wordfence:d3a9a836-34c1-4ef3-9cde-c7ccb3163165","source":"wordfence","cve":"CVE-2022-0701","title":"Seo 301 Meta <= 1.9.1 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3a9a836-34c1-4ef3-9cde-c7ccb3163165?source=api-prod","affected":[{"type":"plugin","slug":"seo-301-meta","name":"Seo 301 Meta","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3aa1f74-6372-4abe-894b-07ad3e81ea81","source":"wordfence","cve":"CVE-2026-14500","title":"Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3aa1f74-6372-4abe-894b-07ad3e81ea81?source=api-prod","affected":[{"type":"plugin","slug":"bulk-order-update-for-woocommerce","name":"Bulk Order Update for WooCommerce","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:31:06Z","updated":"2026-07-08T05:34:10Z"},{"id":"wordfence:d3aa8d64-a0d1-49ad-ad92-e2a2bf066fe1","source":"wordfence","cve":"CVE-2024-53792","title":"Watu Quiz <= 3.4.1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3aa8d64-a0d1-49ad-ad92-e2a2bf066fe1?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.1.2","to_inclusive":true,"patched_in":"3.4.1.3"}],"published":"2024-11-29T00:00:00Z","updated":"2024-12-05T14:49:25Z"},{"id":"wordfence:d3ab23ea-5ded-49dc-9d03-6d1773947d56","source":"wordfence","cve":"CVE-2024-51813","title":"Anant Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ab23ea-5ded-49dc-9d03-6d1773947d56?source=api-prod","affected":[{"type":"plugin","slug":"anant-addons-for-elementor","name":"Anant Addons for Elementor \u2013 Widgets, Templates & WooCommerce Builder","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:37:03Z"},{"id":"wordfence:d3abf6bd-bece-470e-93c7-ab9968171a3f","source":"wordfence","cve":"CVE-2024-22161","title":"HD Quiz <= 1.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3abf6bd-bece-470e-93c7-ab9968171a3f?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz","name":"HD Quiz","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":"1.8.12"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3ace116-69e1-44b1-a63f-693153ab4679","source":"wordfence","cve":"CVE-2021-24709","title":"Weather Effect \u2013 Christmas Santa Snow Falling <= 1.3.5 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ace116-69e1-44b1-a63f-693153ab4679?source=api-prod","affected":[{"type":"plugin","slug":"weather-effect","name":"Weather Effect","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2021-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3adabcc-3259-4d4d-8359-71af16823d18","source":"wordfence","cve":"CVE-2022-3098","title":"Login Block IPs <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3adabcc-3259-4d4d-8359-71af16823d18?source=api-prod","affected":[{"type":"plugin","slug":"login-block-ips","name":"Login Block IPs","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3adb4ba-cabd-4b16-bda6-5d5fc7582d5f","source":"wordfence","cve":"CVE-2025-67582","title":"Wbcom Designs <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3adb4ba-cabd-4b16-bda6-5d5fc7582d5f?source=api-prod","affected":[{"type":"plugin","slug":"lock-my-bp","name":"Wbcom Designs \u2013 Private Community for BuddyPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:20:57Z"},{"id":"wordfence:d3ae776f-65d7-4bb5-9368-9cd22207ea98","source":"wordfence","cve":"CVE-2024-34423","title":"Forty Four \u2013 404 Plugin for WordPress <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ae776f-65d7-4bb5-9368-9cd22207ea98?source=api-prod","affected":[{"type":"plugin","slug":"forty-four","name":"Forty Four \u2013 404 Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:46:23Z"},{"id":"wordfence:d3af34f4-72c5-43a4-9ca1-0729455298c5","source":"wordfence","cve":"CVE-2026-25323","title":"OSM \u2013 OpenStreetMap <= 6.1.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3af34f4-72c5-43a4-9ca1-0729455298c5?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.12","to_inclusive":true,"patched_in":"6.1.13"}],"published":"2026-01-29T00:00:00Z","updated":"2026-05-04T15:40:16Z"},{"id":"wordfence:d3af64a2-3bd6-47af-919e-00c5249dcc74","source":"wordfence","cve":"CVE-2025-5486","title":"WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3af64a2-3bd6-47af-919e-00c5249dcc74?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-debug","name":"WP Email Debug","from":"1.0","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-06-05T17:34:46Z","updated":"2025-08-21T05:28:16Z"},{"id":"wordfence:d3b26060-294e-4d4c-9295-0b08f533d5c4","source":"wordfence","cve":"CVE-2023-5639","title":"Team Showcase <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b26060-294e-4d4c-9295-0b08f533d5c4?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase","name":"Team Showcase \u2013 Responsive Team Members Grid, Slider & Carousel Plugin","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3b62eb2-6c03-4e24-a454-5de54a4521b2","source":"wordfence","cve":"CVE-2023-39312","title":"Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b62eb2-6c03-4e24-a454-5de54a4521b2?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.1","to_inclusive":true,"patched_in":"7.11.2"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3b80f57-881f-4b97-8c5f-78317ea0b86b","source":"wordfence","cve":"CVE-2025-31432","title":"Pop-Up Chop Chop <= 2.1.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b80f57-881f-4b97-8c5f-78317ea0b86b?source=api-prod","affected":[{"type":"plugin","slug":"pop-up","name":"Pop-Up Chop Chop","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-03T13:40:26Z"},{"id":"wordfence:d3b9464c-dcc4-4ae8-816f-1572f84dfe08","source":"wordfence","cve":"CVE-2026-8145","title":"WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'","severity":"medium","cvss":5.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9464c-dcc4-4ae8-816f-1572f84dfe08?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-15T11:34:32Z"},{"id":"wordfence:d3b954e6-cf5d-4451-b770-777d116edd90","source":"wordfence","cve":"","title":"Image Gallery - Responsive Photo Gallery < 2.0.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b954e6-cf5d-4451-b770-777d116edd90?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":false,"patched_in":"2.0.6"}],"published":"2016-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3b9d0ab-d785-4e93-9ab8-f75673a27334","source":"wordfence","cve":"CVE-2024-1806","title":"ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9d0ab-d785-4e93-9ab8-f75673a27334?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.1","to_inclusive":true,"patched_in":"4.15.2"}],"published":"2024-02-23T00:00:00Z","updated":"2024-06-19T17:08:50Z"},{"id":"wordfence:d3ba1ccc-29ae-414d-9c5f-566a75b8346b","source":"wordfence","cve":"CVE-2025-25087","title":"seekXL Snapr <= 2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ba1ccc-29ae-414d-9c5f-566a75b8346b?source=api-prod","affected":[{"type":"plugin","slug":"seekxl-snapr","name":"seekXL Snapr","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T18:29:54Z"},{"id":"wordfence:d3bad1f8-0351-421e-ab00-015e15643f0f","source":"wordfence","cve":"CVE-2024-4531","title":"Business Card <= 1.0.0 - Cross-Site Request Forgery to Card Edit","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bad1f8-0351-421e-ab00-015e15643f0f?source=api-prod","affected":[{"type":"plugin","slug":"business-card-by-esterox-100","name":"Business Card","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T00:27:13Z"},{"id":"wordfence:d3bb5bb0-2c70-4416-8ee1-97aba100cc1d","source":"wordfence","cve":"CVE-2023-0362","title":"Themify Portfolio Post <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bb5bb0-2c70-4416-8ee1-97aba100cc1d?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3bc5ef7-6825-463f-a3ce-d6ab1fc0e030","source":"wordfence","cve":"CVE-2025-0365","title":"Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bc5ef7-6825-463f-a3ce-d6ab1fc0e030?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"4.8.8"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T05:30:38Z"},{"id":"wordfence:d3bd26dc-1191-4044-8d83-cc7401bf228e","source":"wordfence","cve":"CVE-2026-110010","title":"MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bd26dc-1191-4044-8d83-cc7401bf228e?source=api-prod","affected":[{"type":"plugin","slug":"mb-custom-post-type","name":"MB Custom Post Types & Custom Taxonomies","from":"2.0.2","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:14:38Z"},{"id":"wordfence:d3bd7b0e-aae3-4ac9-b092-3101da441e1e","source":"wordfence","cve":"CVE-2023-27416","title":"Decon WP SMS <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bd7b0e-aae3-4ac9-b092-3101da441e1e?source=api-prod","affected":[{"type":"plugin","slug":"decon-wp-sms","name":"Decon WP SMS","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3bea017-9fc3-4e14-97c4-5bb525650cde","source":"wordfence","cve":"CVE-2024-2838","title":"WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bea017-9fc3-4e14-97c4-5bb525650cde?source=api-prod","affected":[{"type":"plugin","slug":"wpc-composite-products","name":"WPC Composite Products for WooCommerce","from":"*","from_inclusive":true,"to":"7.2.7","to_inclusive":true,"patched_in":"7.2.8"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-27T03:44:32Z"},{"id":"wordfence:d3beee75-0480-4504-a177-45f8cd32cf36","source":"wordfence","cve":"CVE-2024-5987","title":"WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3beee75-0480-4504-a177-45f8cd32cf36?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.2.8","to_inclusive":true,"patched_in":"0.6.2.9"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T05:30:59Z"},{"id":"wordfence:d3c1d9ba-a736-4fb9-bdd3-6dc79881baf8","source":"wordfence","cve":"CVE-2025-49358","title":"Content Fetcher <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c1d9ba-a736-4fb9-bdd3-6dc79881baf8?source=api-prod","affected":[{"type":"plugin","slug":"content-fetcher","name":"Content Fetcher","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:18:46Z"},{"id":"wordfence:d3c26454-a91d-4141-9b31-5c902c5e8eec","source":"wordfence","cve":"CVE-2023-52201","title":"pTypeConverter <= 0.2.8.1 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c26454-a91d-4141-9b31-5c902c5e8eec?source=api-prod","affected":[{"type":"plugin","slug":"ptypeconverter","name":"pTypeConverter","from":"*","from_inclusive":true,"to":"0.2.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3c2e5fe-cc02-479e-9f33-e1a783088596","source":"wordfence","cve":"CVE-2024-8858","title":"Elementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c2e5fe-cc02-479e-9f33-e1a783088596?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.5","to_inclusive":true,"patched_in":"8.5.1"}],"published":"2024-09-24T21:40:45Z","updated":"2024-10-04T16:35:40Z"},{"id":"wordfence:d3c3efc9-c1da-4f4e-81d2-f4a7a1a4e740","source":"wordfence","cve":"CVE-2025-52755","title":"Child Themes <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c3efc9-c1da-4f4e-81d2-f4a7a1a4e740?source=api-prod","affected":[{"type":"plugin","slug":"child-themes","name":"Child Themes","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-10-29T21:02:22Z"},{"id":"wordfence:d3c4b62b-c8b1-40b8-b250-d9da94208c62","source":"wordfence","cve":"","title":"EasyJobs <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c4b62b-c8b1-40b8-b250-d9da94208c62?source=api-prod","affected":[{"type":"plugin","slug":"easyjobs","name":"easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2022-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3c6fb8b-9df8-4cf5-b9e6-702852bb1977","source":"wordfence","cve":"CVE-2023-45655","title":"PixFields <= 0.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c6fb8b-9df8-4cf5-b9e6-702852bb1977?source=api-prod","affected":[{"type":"plugin","slug":"pixfields","name":"PixFields","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":"0.7.1"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3c997cd-37b4-4b9c-b99e-397be484aa36","source":"wordfence","cve":"CVE-2023-5132","title":"Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3c997cd-37b4-4b9c-b99e-397be484aa36?source=api-prod","affected":[{"type":"plugin","slug":"soisy-pagamento-rateale","name":"Soisy Pagamento Rateale","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.0.2"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3ca4c3c-2b20-42d4-8dcf-77f4d52c25a3","source":"wordfence","cve":"CVE-2023-30486","title":"Square <= 2.0.0 - Missing Authorization via activate_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ca4c3c-2b20-42d4-8dcf-77f4d52c25a3?source=api-prod","affected":[{"type":"theme","slug":"square","name":"Square","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3ca9ea5-f824-47c8-9e46-c6901da4e8a7","source":"wordfence","cve":"CVE-2026-76552","title":"Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ca9ea5-f824-47c8-9e46-c6901da4e8a7?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.9.33"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:25:17Z"},{"id":"wordfence:d3cb7431-9037-45a3-b598-e7c99370980a","source":"wordfence","cve":"CVE-2026-14860","title":"Podcast Player <= 8.3.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3cb7431-9037-45a3-b598-e7c99370980a?source=api-prod","affected":[{"type":"plugin","slug":"podcast-player","name":"Podcast Player \u2013 Your Podcasting Companion","from":"*","from_inclusive":true,"to":"8.3.0","to_inclusive":true,"patched_in":"8.3.1"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T14:11:01Z"},{"id":"wordfence:d3cd468e-424c-48bb-bc1f-cb8f8c3ccb20","source":"wordfence","cve":"CVE-2025-39465","title":"Advanced Google Maps <= 5.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3cd468e-424c-48bb-bc1f-cb8f8c3ccb20?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-gold","name":"WP Maps Pro","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"5.8.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:24:26Z"},{"id":"wordfence:d3cda8d0-321c-4b15-980e-5ebf49fac367","source":"wordfence","cve":"CVE-2024-5940","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3cda8d0-321c-4b15-980e-5ebf49fac367?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-20T02:03:19Z"},{"id":"wordfence:d3d0f705-2458-4cc6-8730-997314084f24","source":"wordfence","cve":"CVE-2022-4965","title":"Invitation Code Content Restriction Plugin from CreativeMinds <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d0f705-2458-4cc6-8730-997314084f24?source=api-prod","affected":[{"type":"plugin","slug":"invitation-code-content-access","name":"Invitation Code Content Restriction Plugin from CreativeMinds","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-03-20T00:00:00Z","updated":"2024-04-09T19:05:06Z"},{"id":"wordfence:d3d26aa4-8bea-48e8-ad14-513690a31831","source":"wordfence","cve":"CVE-2024-1872","title":"Button <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d26aa4-8bea-48e8-ad14-513690a31831?source=api-prod","affected":[{"type":"plugin","slug":"button","name":"Button","from":"*","from_inclusive":true,"to":"1.1.27","to_inclusive":true,"patched_in":"1.1.28"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-09T13:26:35Z"},{"id":"wordfence:d3d3396d-4a51-44dc-959c-38057d47d145","source":"wordfence","cve":"CVE-2026-88848","title":"MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d3396d-4a51-44dc-959c-38057d47d145?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.49","to_inclusive":true,"patched_in":"3.7.50"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-30T14:17:31Z"},{"id":"wordfence:d3d6104b-eb2d-4e7e-98bd-6a46bd69ef5c","source":"wordfence","cve":"CVE-2023-45064","title":"OPcache Dashboard <= 0.3.1 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d6104b-eb2d-4e7e-98bd-6a46bd69ef5c?source=api-prod","affected":[{"type":"plugin","slug":"opcache","name":"OPcache Dashboard","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3d795f5-c79a-4615-be1f-120a6ffd663d","source":"wordfence","cve":"CVE-2023-4109","title":"Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d795f5-c79a-4615-be1f-120a6ffd663d?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2023-08-07T00:00:00Z","updated":"2024-05-31T15:30:56Z"},{"id":"wordfence:d3d8164c-3fc0-44fe-856f-725b39c102d6","source":"wordfence","cve":"CVE-2025-15396","title":"Library Viewer < 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d8164c-3fc0-44fe-856f-725b39c102d6?source=api-prod","affected":[{"type":"plugin","slug":"library-viewer","name":"Library Viewer","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2026-02-06T00:00:00Z","updated":"2026-02-09T20:55:50Z"},{"id":"wordfence:d3dae870-9b5f-47ef-b8b2-23fac613ec00","source":"wordfence","cve":"CVE-2023-0065","title":"i2 Pros & Cons <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3dae870-9b5f-47ef-b8b2-23fac613ec00?source=api-prod","affected":[{"type":"plugin","slug":"i2-pro-cons","name":"i2 Pros & Cons","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-10-23T08:41:05Z"},{"id":"wordfence:d3dccecb-893c-4746-9047-5c32ca227508","source":"wordfence","cve":"CVE-2019-9576","title":"Blog2Social: Social Media Auto Post & Scheduler <= 5.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3dccecb-893c-4746-9047-5c32ca227508?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"5.0.3"}],"published":"2019-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3df5cc6-f998-409a-93fe-e514633e4905","source":"wordfence","cve":"CVE-2012-5856","title":"Uk Cookie <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3df5cc6-f998-409a-93fe-e514633e4905?source=api-prod","affected":[{"type":"plugin","slug":"uk-cookie","name":"Uk Cookie","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2012-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3dfa92a-57da-49ab-95f7-504fa99ed47f","source":"wordfence","cve":"CVE-2024-6391","title":"oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3dfa92a-57da-49ab-95f7-504fa99ed47f?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.10.3","to_inclusive":true,"patched_in":"4.12.0"}],"published":"2024-07-08T23:21:00Z","updated":"2024-07-09T11:33:21Z"},{"id":"wordfence:d3e0f601-d445-4805-858a-8ad1ce9e62df","source":"wordfence","cve":"","title":"Dewplayer <= 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e0f601-d445-4805-858a-8ad1ce9e62df?source=api-prod","affected":[{"type":"plugin","slug":"dewplayer-flash-mp3-player","name":"Dewplayer","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3e194c0-b35a-496b-b31a-666334312f20","source":"wordfence","cve":"CVE-2024-30514","title":"Paid Memberships Pro \u2013 Payfast Gateway Add On <= 1.4.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e194c0-b35a-496b-b31a-666334312f20?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-payfast","name":"Paid Memberships Pro \u2013 Payfast Gateway Add On","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:31:25Z"},{"id":"wordfence:d3e293db-9177-4fbb-a469-900d9330642d","source":"wordfence","cve":"CVE-2026-3618","title":"Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e293db-9177-4fbb-a469-900d9330642d?source=api-prod","affected":[{"type":"plugin","slug":"columns-bws","name":"Columns by BestWebSoft \u2013 Additional Columns Plugin for Posts Pages and Widgets","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:49Z","updated":"2026-04-08T06:43:41Z"},{"id":"wordfence:d3e300b3-39cc-4681-a8e8-02d9743f97ff","source":"wordfence","cve":"CVE-2026-116512","title":"Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e300b3-39cc-4681-a8e8-02d9743f97ff?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2026-10-30T19:25:37Z","updated":"2026-10-31T07:46:51Z"},{"id":"wordfence:d3e6185e-b07c-4ce3-a2b4-971c88e10bc0","source":"wordfence","cve":"CVE-2025-53341","title":"Stratus <= 4.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3e6185e-b07c-4ce3-a2b4-971c88e10bc0?source=api-prod","affected":[{"type":"theme","slug":"stratus","name":"App, SaaS & Software Startup Tech Theme - Stratus","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:38:18Z"},{"id":"wordfence:d3ea9e96-9958-4a4f-b988-6f024b113fc9","source":"wordfence","cve":"CVE-2017-18529","title":"PromoBar by BestWebSoft \u2013 Customizable Advertisement Banner for WordPress Website <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ea9e96-9958-4a4f-b988-6f024b113fc9?source=api-prod","affected":[{"type":"plugin","slug":"promobar","name":"PromoBar by BestWebSoft \u2013 Customizable Advertisement Banner for WordPress Website","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":false,"patched_in":"1.1.1"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3ec7d23-4386-470f-955e-631f461e290b","source":"wordfence","cve":"","title":"S3 Video Plugin < 0.98 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ec7d23-4386-470f-955e-631f461e290b?source=api-prod","affected":[{"type":"plugin","slug":"s3-video","name":"S3 Video Plugin","from":"*","from_inclusive":true,"to":"0.98","to_inclusive":false,"patched_in":"0.98"}],"published":"2013-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3ee118c-b8cd-4bac-97bd-508efdfa1a1e","source":"wordfence","cve":"CVE-2025-22671","title":"Disable Elementor Editor Translation <= 1.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ee118c-b8cd-4bac-97bd-508efdfa1a1e?source=api-prod","affected":[{"type":"plugin","slug":"disable-elementor-editor-translation","name":"Disable Elementor Editor Translation","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:04:03Z"},{"id":"wordfence:d3ee6004-03d1-4216-b22e-0aadc1f4d9de","source":"wordfence","cve":"CVE-2023-37886","title":"RealHomes <= 4.3.7 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3ee6004-03d1-4216-b22e-0aadc1f4d9de?source=api-prod","affected":[{"type":"theme","slug":"realhomes","name":"RH - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2023-07-11T00:00:00Z","updated":"2025-05-12T17:21:29Z"},{"id":"wordfence:d3eedeb8-6982-4af8-8377-7a9122f6b232","source":"wordfence","cve":"CVE-2026-27994","title":"Tediss <= 1.2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3eedeb8-6982-4af8-8377-7a9122f6b232?source=api-prod","affected":[{"type":"theme","slug":"tediss","name":"Tediss | Play Area & Child Care Center WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:24:19Z"},{"id":"wordfence:d3efaa0d-8af6-4cdf-9225-8bbcfdbb73d3","source":"wordfence","cve":"CVE-2026-2571","title":"Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3efaa0d-8af6-4cdf-9225-8bbcfdbb73d3?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.49","to_inclusive":true,"patched_in":"3.3.50"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-19T06:46:16Z"},{"id":"wordfence:d3f3fc78-0255-4c0a-8ee0-c2ccea28929f","source":"wordfence","cve":"CVE-2026-16300","title":"Chama <= 1.0.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f3fc78-0255-4c0a-8ee0-c2ccea28929f?source=api-prod","affected":[{"type":"plugin","slug":"chama","name":"ChamaWP \u2013 Monetize With Donations, Memberships, Crowdfunding, Commissions & Restricted Content","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:26:14Z"},{"id":"wordfence:d3f4de75-abf5-46e8-854d-be91ed74a5f3","source":"wordfence","cve":"CVE-2024-9654","title":"Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass","severity":"low","cvss":3.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f4de75-abf5-46e8-854d-be91ed74a5f3?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"3.1","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T11:10:21Z"},{"id":"wordfence:d3f8a294-3bb2-4d6b-b298-3844a6f51596","source":"wordfence","cve":"CVE-2025-43837","title":"Total Donations <= 3.0.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f8a294-3bb2-4d6b-b298-3844a6f51596?source=api-prod","affected":[{"type":"plugin","slug":"total-donations","name":"Total Donations","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-29T00:00:00Z","updated":"2025-05-05T18:13:05Z"},{"id":"wordfence:d3f9e624-c176-403c-a3c5-7bd11027ebe5","source":"wordfence","cve":"CVE-2023-27415","title":"LetterPress <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f9e624-c176-403c-a3c5-7bd11027ebe5?source=api-prod","affected":[{"type":"plugin","slug":"letterpress","name":"LetterPress \u2013 Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-05-11T00:00:00Z","updated":"2026-10-28T21:04:52Z"},{"id":"wordfence:d3fb6a84-2339-4d5c-a88a-f8e08a940840","source":"wordfence","cve":"","title":"Responsive Zoom In/Out Slider WordPress Plugin (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3fb6a84-2339-4d5c-a88a-f8e08a940840?source=api-prod","affected":[{"type":"plugin","slug":"lbg_zoominoutslider","name":"Responsive Zoom In/Out Slider WordPress Plugin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d3fdc72e-8119-4c60-94c5-d01fe38117b2","source":"wordfence","cve":"CVE-2026-84095","title":"Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d3fdc72e-8119-4c60-94c5-d01fe38117b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.7.11","to_inclusive":true,"patched_in":"12.7.12"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T14:06:56Z"},{"id":"wordfence:d400ee7d-d26e-43fa-988c-0d9448800ec6","source":"wordfence","cve":"CVE-2025-62045","title":"TheGem Theme Elements (for WPBakery) <= 5.10.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d400ee7d-d26e-43fa-988c-0d9448800ec6?source=api-prod","affected":[{"type":"plugin","slug":"thegem-elements","name":"TheGem Theme Elements (for WPBakery)","from":"*","from_inclusive":true,"to":"5.10.5.1","to_inclusive":true,"patched_in":"5.10.5.2"}],"published":"2025-10-13T00:00:00Z","updated":"2025-10-29T15:16:12Z"},{"id":"wordfence:d4027138-9a8a-4602-90fd-19e9f7c45bb4","source":"wordfence","cve":"CVE-2024-9655","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4027138-9a8a-4602-90fd-19e9f7c45bb4?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2024-10-31T19:06:24Z","updated":"2024-11-01T07:33:30Z"},{"id":"wordfence:d402b7d1-3c12-4bdd-8ff3-e58d5501f0c0","source":"wordfence","cve":"CVE-2026-13252","title":"RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d402b7d1-3c12-4bdd-8ff3-e58d5501f0c0?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-07-01T20:08:52Z","updated":"2026-07-02T08:33:07Z"},{"id":"wordfence:d4070a24-04fa-44e8-8ec2-bc84ba53b90d","source":"wordfence","cve":"CVE-2014-8584","title":"SpiderVPlayer <= 1.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4070a24-04fa-44e8-8ec2-bc84ba53b90d?source=api-prod","affected":[{"type":"plugin","slug":"player","name":"SpiderVPlayer","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2014-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4093f00-838b-49d1-930c-c7ee2238046f","source":"wordfence","cve":"CVE-2022-1282","title":"Photo Gallery by 10Web <= 1.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4093f00-838b-49d1-930c-c7ee2238046f?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4095518-0daf-4cfe-a521-86fb1c927f51","source":"wordfence","cve":"CVE-2018-12534","title":"Quick Chat < 4.00 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4095518-0daf-4cfe-a521-86fb1c927f51?source=api-prod","affected":[{"type":"plugin","slug":"quick-chat","name":"Quick Chat","from":"*","from_inclusive":true,"to":"4.00","to_inclusive":false,"patched_in":"4.00"}],"published":"2012-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4096ad8-dc3c-4008-a035-2ba18044cf43","source":"wordfence","cve":"CVE-2026-28114","title":"WooCommerce License Manager <= 7.0.6 - Authenticated (Shop Manager+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4096ad8-dc3c-4008-a035-2ba18044cf43?source=api-prod","affected":[{"type":"plugin","slug":"fs-license-manager","name":"WooCommerce License Manager","from":"*","from_inclusive":true,"to":"7.0.6","to_inclusive":true,"patched_in":"7.0.7"}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:13:22Z"},{"id":"wordfence:d40d6228-dacd-4f94-b6a3-a402c4e24554","source":"wordfence","cve":"CVE-2025-57972","title":"Helpdesk Support Ticket System for WooCommerce <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d40d6228-dacd-4f94-b6a3-a402c4e24554?source=api-prod","affected":[{"type":"plugin","slug":"support-ticket-system-for-woocommerce","name":"Helpdesk Support Ticket System for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-07T14:32:47Z"},{"id":"wordfence:d40e9d1c-8693-467f-a0e3-1000c6635a25","source":"wordfence","cve":"CVE-2025-31881","title":"Pearl <= 1.3.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d40e9d1c-8693-467f-a0e3-1000c6635a25?source=api-prod","affected":[{"type":"plugin","slug":"pearl-header-builder","name":"Pearl \u2013 Header Builder","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2025-04-01T00:00:00Z","updated":"2025-08-22T15:32:24Z"},{"id":"wordfence:d411982d-4ed3-4dd5-9a18-111c15aa641b","source":"wordfence","cve":"CVE-2026-24598","title":"Multilanguage by BestWebSoft <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d411982d-4ed3-4dd5-9a18-111c15aa641b?source=api-prod","affected":[{"type":"plugin","slug":"multilanguage","name":"Multilanguage by BestWebSoft \u2013 WordPress Translation Plugin and Language Switcher","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-10-23T06:55:21Z"},{"id":"wordfence:d41355ed-77d0-48b3-bbb3-4cc3b4df4b2a","source":"wordfence","cve":"CVE-2023-5946","title":"Digirisk 6.0.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d41355ed-77d0-48b3-bbb3-4cc3b4df4b2a?source=api-prod","affected":[{"type":"plugin","slug":"digirisk","name":"Digirisk","from":"6.0.0.0","from_inclusive":true,"to":"6.0.0.0","to_inclusive":true,"patched_in":"6.1.0.0"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4170426-b418-48ec-8233-1ca1aca60473","source":"wordfence","cve":"","title":"DW Question & Answer < 1.4.2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4170426-b418-48ec-8233-1ca1aca60473?source=api-prod","affected":[{"type":"plugin","slug":"dw-question-answer","name":"DW Question & Answer","from":"*","from_inclusive":true,"to":"1.4.2.3","to_inclusive":false,"patched_in":"1.4.2.3"}],"published":"2016-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4185a0e-d944-408f-8a43-8f9c6bc3964d","source":"wordfence","cve":"CVE-2024-6338","title":"FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4185a0e-d944-408f-8a43-8f9c6bc3964d?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.46.7212","to_inclusive":true,"patched_in":"7.5.47.7212"}],"published":"2024-07-18T19:26:14Z","updated":"2024-07-19T07:36:49Z"},{"id":"wordfence:d419fceb-731b-4b45-b995-46e7e0fedb38","source":"wordfence","cve":"CVE-2025-32608","title":"Movylo Marketing Automation <= 2.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d419fceb-731b-4b45-b995-46e7e0fedb38?source=api-prod","affected":[{"type":"plugin","slug":"movylo-widget","name":"Movylo Marketing Automation","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-14T00:00:00Z","updated":"2025-04-21T20:35:21Z"},{"id":"wordfence:d41a8c39-8b06-45b2-afe4-8c695faf8cb8","source":"wordfence","cve":"CVE-2024-10311","title":"External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass","severity":"high","cvss":7.5,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d41a8c39-8b06-45b2-afe4-8c695faf8cb8?source=api-prod","affected":[{"type":"plugin","slug":"external-database-based-actions","name":"External Database Based Actions","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-14T00:00:00Z","updated":"2024-11-15T09:29:40Z"},{"id":"wordfence:d41d0ff5-32fa-4668-bbd6-1523c48e5b5d","source":"wordfence","cve":"CVE-2026-39744","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d41d0ff5-32fa-4668-bbd6-1523c48e5b5d?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-11-04T07:18:28Z","updated":"2026-11-10T20:04:46Z"},{"id":"wordfence:d41f506a-b243-41e2-a67e-697fc34fba2e","source":"wordfence","cve":"CVE-2026-40780","title":"Bookit \u2014 Booking & Appointment Calendar <= 2.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d41f506a-b243-41e2-a67e-697fc34fba2e?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.4.1"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:15:20Z"},{"id":"wordfence:d41fb15c-9e0b-46d2-b60b-4213facc02a7","source":"wordfence","cve":"CVE-2023-5749","title":"EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d41fb15c-9e0b-46d2-b60b-4213facc02a7?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2023-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d420ee49-e7b3-43d8-a263-8a93abd1133c","source":"wordfence","cve":"CVE-2025-13536","title":"Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d420ee49-e7b3-43d8-a263-8a93abd1133c?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.15.2","to_inclusive":true,"patched_in":"11.15.3"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T08:27:09Z"},{"id":"wordfence:d4271fde-ce9e-416e-8f7d-661a3e777a5d","source":"wordfence","cve":"CVE-2025-68083","title":"Meks Quick Plugin Disabler <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4271fde-ce9e-416e-8f7d-661a3e777a5d?source=api-prod","affected":[{"type":"plugin","slug":"meks-quick-plugin-disabler","name":"Meks Quick Plugin Disabler","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:07:19Z"},{"id":"wordfence:d42730e8-2d18-46b7-bb26-432132e23db1","source":"wordfence","cve":"CVE-2026-104642","title":"Simple Shopping Cart 5.1.3 - 5.3.2 - Authenticated (Contributor+) Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d42730e8-2d18-46b7-bb26-432132e23db1?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"5.1.3","from_inclusive":true,"to":"5.3.2","to_inclusive":true,"patched_in":"5.3.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:03:12Z"},{"id":"wordfence:d42b8856-e5d0-4122-98a4-8c959832b271","source":"wordfence","cve":"CVE-2026-16635","title":"Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d42b8856-e5d0-4122-98a4-8c959832b271?source=api-prod","affected":[{"type":"plugin","slug":"pronamic-ideal","name":"Pronamic Pay","from":"*","from_inclusive":true,"to":"10.1.0","to_inclusive":true,"patched_in":"10.2.0"}],"published":"2026-07-31T20:28:17Z","updated":"2026-08-01T08:32:29Z"},{"id":"wordfence:d42bf247-413b-4458-84f3-f503c7af907d","source":"wordfence","cve":"CVE-2026-61978","title":"Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d42bf247-413b-4458-84f3-f503c7af907d?source=api-prod","affected":[{"type":"plugin","slug":"secure-card-gateway-for-epay-paycenter-piraeus-bank","name":"WebHosting4U Secure Card Gateway for ePay Paycenter (Piraeus Bank)","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":"1.0.33"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-15T21:55:46Z"},{"id":"wordfence:d42eeda5-7034-4544-be97-8064ff6d3185","source":"wordfence","cve":"CVE-2014-2674","title":"Ajax Pagination (twitter Style) <= 1.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d42eeda5-7034-4544-be97-8064ff6d3185?source=api-prod","affected":[{"type":"plugin","slug":"ajax-pagination","name":"Ajax Pagination (twitter Style)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2014-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d430c863-6af1-4519-b276-3bf7e2b2d3c2","source":"wordfence","cve":"CVE-2026-81789","title":"Advanced Product Fields Extended for WooCommerce <= 3.1.6 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d430c863-6af1-4519-b276-3bf7e2b2d3c2?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-fields-for-woocommerce-extended","name":"Advanced Product Fields Extended for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-22T18:16:44Z"},{"id":"wordfence:d43234d0-5f44-4484-a8d6-16d43d1db51e","source":"wordfence","cve":"CVE-2023-0467","title":"WP Dark Mode <= 4.0.7 - Authenticated (Subscriber+) Local File Inclusion via 'style'","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d43234d0-5f44-4484-a8d6-16d43d1db51e?source=api-prod","affected":[{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2023-03-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4325e51-5d57-4763-a6c4-29c67330bdbd","source":"wordfence","cve":"","title":"FoxyPress <= 0.4.2.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4325e51-5d57-4763-a6c4-29c67330bdbd?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.2.7","to_inclusive":true,"patched_in":"0.4.2.8"}],"published":"2012-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d433a5b3-4661-4246-ae60-8a99633372ad","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'deleteRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d433a5b3-4661-4246-ae60-8a99633372ad?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4342f4e-70ae-496c-a083-7e58c0719872","source":"wordfence","cve":"CVE-2026-121633","title":"Order Tracking <= 3.5.0 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4342f4e-70ae-496c-a083-7e58c0719872?source=api-prod","affected":[{"type":"plugin","slug":"order-tracking","name":"Order Tracking \u2013 WordPress Status Tracking Plugin","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T13:06:05Z"},{"id":"wordfence:d43fe5eb-493e-428d-b293-69fa237d9eac","source":"wordfence","cve":"CVE-2026-93932","title":"Smart Casa | Home Automation & House Technologies WordPress Theme <= 1.0.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d43fe5eb-493e-428d-b293-69fa237d9eac?source=api-prod","affected":[{"type":"theme","slug":"smart-casa","name":"Smart Casa | Home Automation & House Technologies WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:46:29Z","updated":"2026-10-13T14:26:36Z"},{"id":"wordfence:d4404401-466e-4bc9-aa9c-8262aedcb457","source":"wordfence","cve":"CVE-2026-66599","title":"WPComplete <= 2.9.5.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4404401-466e-4bc9-aa9c-8262aedcb457?source=api-prod","affected":[{"type":"plugin","slug":"wpcomplete","name":"WPComplete","from":"*","from_inclusive":true,"to":"2.9.5.6","to_inclusive":true,"patched_in":"2.9.5.7"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:17:14Z"},{"id":"wordfence:d440b7fc-e094-49b7-91d0-8f0d54e6ce83","source":"wordfence","cve":"CVE-2026-39632","title":"Grand Blog <= 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d440b7fc-e094-49b7-91d0-8f0d54e6ce83?source=api-prod","affected":[{"type":"theme","slug":"grandblog","name":"Grand Blog WordPress","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:20:43Z"},{"id":"wordfence:d44184d0-2874-483b-9855-37a4f9cd141f","source":"wordfence","cve":"CVE-2026-42671","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.157 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44184d0-2874-483b-9855-37a4f9cd141f?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.157","to_inclusive":true,"patched_in":"2.8.158"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-19T13:33:43Z"},{"id":"wordfence:d4429eb0-2b9a-4366-9f93-90484872c48e","source":"wordfence","cve":"CVE-2024-30197","title":"Church Admin <= 4.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4429eb0-2b9a-4366-9f93-90484872c48e?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.0.26","to_inclusive":true,"patched_in":"4.0.27"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T14:31:52Z"},{"id":"wordfence:d4440a99-914d-4cbb-8b9f-9093a1ddd4ad","source":"wordfence","cve":"CVE-2026-25449","title":"Travel Booking WordPress Theme < 3.2.8.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4440a99-914d-4cbb-8b9f-9093a1ddd4ad?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.8.1","to_inclusive":false,"patched_in":"3.2.8.1"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:26:01Z"},{"id":"wordfence:d4443759-af1c-409b-aa5f-3bfd55cb44a9","source":"wordfence","cve":"CVE-2025-30964","title":"Photography <= 7.5.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4443759-af1c-409b-aa5f-3bfd55cb44a9?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:49:00Z"},{"id":"wordfence:d4464bb1-273a-42c4-a7ec-8e123d286963","source":"wordfence","cve":"CVE-2025-1913","title":"Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4464bb1-273a-42c4-a7ec-8e123d286963?source=api-prod","affected":[{"type":"plugin","slug":"product-import-export-for-woo","name":"Product Import Export for WooCommerce \u2013 CSV Product Importer & Exporter","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-03-25T23:23:13Z","updated":"2025-12-05T16:47:29Z"},{"id":"wordfence:d4491b89-2120-4edb-a396-e45ba09b3b99","source":"wordfence","cve":"CVE-2023-7291","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4491b89-2120-4edb-a396-e45ba09b3b99?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:43Z"},{"id":"wordfence:d449466d-e78a-48a3-8eff-90b56646dd6b","source":"wordfence","cve":"CVE-2023-25040","title":"Shortcodes Ultimate <= 5.12.6 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d449466d-e78a-48a3-8eff-90b56646dd6b?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.12.6","to_inclusive":true,"patched_in":"5.12.7"}],"published":"2023-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d449a285-34f5-41ed-acfd-2a9acfb04271","source":"wordfence","cve":"CVE-2025-10176","title":"The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d449a285-34f5-41ed-acfd-2a9acfb04271?source=api-prod","affected":[{"type":"plugin","slug":"hackrepair-plugin-archiver","name":"The Hack Repair Guy\u2019s Plugin Archiver","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2025-09-12T09:16:21Z","updated":"2025-09-12T21:25:25Z"},{"id":"wordfence:d44a45fb-3bff-4a1f-8319-a58a47a9d76b","source":"wordfence","cve":"CVE-2023-5602","title":"Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44a45fb-3bff-4a1f-8319-a58a47a9d76b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d44ecf8a-d19a-403a-96c7-89e223a5cc22","source":"wordfence","cve":"CVE-2024-2028","title":"Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44ecf8a-d19a-403a-96c7-89e223a5cc22?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:27:17Z"},{"id":"wordfence:d44f8891-cc24-4f6f-9032-3a4c632c6fb6","source":"wordfence","cve":"CVE-2022-4119","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 6.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44f8891-cc24-4f6f-9032-3a4c632c6fb6?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d44f8af2-3525-4b00-afa8-a908250cc838","source":"wordfence","cve":"CVE-2025-14533","title":"Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44f8af2-3525-4b00-afa8-a908250cc838?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.1","to_inclusive":true,"patched_in":"0.9.2.2"}],"published":"2026-01-19T21:07:19Z","updated":"2026-01-20T09:25:01Z"},{"id":"wordfence:d44fe4d7-1af5-4e26-a33c-43a9cce4174c","source":"wordfence","cve":"CVE-2025-6043","title":"Malcure Malware Scanner \u2014 #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d44fe4d7-1af5-4e26-a33c-43a9cce4174c?source=api-prod","affected":[{"type":"plugin","slug":"wp-malware-removal","name":"Malcure Malware Shield \u2014 Removal, Repair, Monitor","from":"*","from_inclusive":true,"to":"17.0","to_inclusive":true,"patched_in":"17.1"}],"published":"2025-07-15T18:16:30Z","updated":"2025-07-17T17:26:52Z"},{"id":"wordfence:d452b3bf-6d9d-46df-b844-e2c47d5a0ef4","source":"wordfence","cve":"CVE-2026-83555","title":"Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d452b3bf-6d9d-46df-b844-e2c47d5a0ef4?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.34","to_inclusive":true,"patched_in":"5.9.35"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:49:14Z"},{"id":"wordfence:d454fc81-65ce-423d-bb8a-53a916d797a9","source":"wordfence","cve":"CVE-2026-39747","title":"Woffice CRM <= 5.4.35 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d454fc81-65ce-423d-bb8a-53a916d797a9?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.35","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:24:29Z","updated":"2026-10-08T23:40:20Z"},{"id":"wordfence:d4561441-d147-4c02-a837-c1656e17627d","source":"wordfence","cve":"CVE-2024-1812","title":"Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4561441-d147-4c02-a837-c1656e17627d?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-03-15T00:00:00Z","updated":"2024-04-09T18:59:24Z"},{"id":"wordfence:d45a01e5-0e69-4d95-b609-b9002b3776da","source":"wordfence","cve":"CVE-2026-93399","title":"Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d45a01e5-0e69-4d95-b609-b9002b3776da?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.3"}],"published":"2026-09-24T18:12:07Z","updated":"2026-09-25T06:39:56Z"},{"id":"wordfence:d45a4b0b-bb98-4c35-a743-c434946002a2","source":"wordfence","cve":"","title":"Responsive Lightbox2 <= 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d45a4b0b-bb98-4c35-a743-c434946002a2?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox2","name":"Responsive Lightbox2","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":false,"patched_in":"1.0.3"}],"published":"2020-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d45cd4c1-5887-44df-8073-033ece0d2181","source":"wordfence","cve":"CVE-2026-39770","title":"Doctreat - Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d45cd4c1-5887-44df-8073-033ece0d2181?source=api-prod","affected":[{"type":"theme","slug":"doctreat","name":"Doctreat - Hospitals and Doctors Directory WordPress Listing Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:33:10Z","updated":"2026-10-08T23:44:02Z"},{"id":"wordfence:d45eb4e4-b59b-479a-a49b-2ca6d254aa01","source":"wordfence","cve":"CVE-2026-57687","title":"Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d45eb4e4-b59b-479a-a49b-2ca6d254aa01?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.8"}],"published":"2026-06-29T00:00:00Z","updated":"2026-06-29T18:31:06Z"},{"id":"wordfence:d460cc34-c8b0-453b-9b6b-3bd53137625a","source":"wordfence","cve":"CVE-2023-39918","title":"Booking Package <= 1.6.01 - Reflected Cross-Site Scripting via 'mode'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d460cc34-c8b0-453b-9b6b-3bd53137625a?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.6.01","to_inclusive":true,"patched_in":"1.6.02"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4631eff-1faa-4cce-859f-1c2132376d93","source":"wordfence","cve":"CVE-2025-25147","title":"Auto SEO <= 2.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4631eff-1faa-4cce-859f-1c2132376d93?source=api-prod","affected":[{"type":"plugin","slug":"auto-seo","name":"Auto SEO","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-19T21:23:43Z"},{"id":"wordfence:d4634b17-923d-4000-9881-d1c2d235f039","source":"wordfence","cve":"CVE-2024-50545","title":"DataMentor <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4634b17-923d-4000-9881-d1c2d235f039?source=api-prod","affected":[{"type":"plugin","slug":"datamentor","name":"DataMentor","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-10-31T00:00:00Z","updated":"2026-09-09T15:49:52Z"},{"id":"wordfence:d463ca92-202b-47de-9d6a-cee4453d33b9","source":"wordfence","cve":"CVE-2025-66120","title":"CatFolders <= 2.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d463ca92-202b-47de-9d6a-cee4453d33b9?source=api-prod","affected":[{"type":"plugin","slug":"catfolders","name":"CatFolders \u2013 WordPress Media Library Folders & Categories","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-13T16:37:11Z"},{"id":"wordfence:d4655236-7dfe-40ae-9d0c-6eacc59af13d","source":"wordfence","cve":"CVE-2024-1955","title":"Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4655236-7dfe-40ae-9d0c-6eacc59af13d?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-backed-notices","name":"Hide Dashboard Notifications","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T02:05:43Z"},{"id":"wordfence:d4664b8d-4f8f-4be3-90e9-2dba4e737b2c","source":"wordfence","cve":"CVE-2023-0175","title":"Smart Logo Showcase Lite <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4664b8d-4f8f-4be3-90e9-2dba4e737b2c?source=api-prod","affected":[{"type":"plugin","slug":"smart-logo-showcase-lite","name":"Responsive Clients Logo Gallery Plugin for WordPress \u2013 Smart Logo Showcase Lite","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d466b837-e5be-4e0b-9d92-483f2f5fecef","source":"wordfence","cve":"CVE-2025-25163","title":"Plugin A/B Image Optimizer <= 3.3 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d466b837-e5be-4e0b-9d92-483f2f5fecef?source=api-prod","affected":[{"type":"plugin","slug":"images-optimizer","name":"Plugin A/B Image Optimizer","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T14:59:43Z"},{"id":"wordfence:d46d6493-8b89-4258-9d83-79e5946cd76f","source":"wordfence","cve":"CVE-2026-6446","title":"My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action","severity":"medium","cvss":5.4,"cwe":"CWE-522","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d46d6493-8b89-4258-9d83-79e5946cd76f?source=api-prod","affected":[{"type":"plugin","slug":"my-social-feeds","name":"My Social Feeds \u2013 bring your social content into WordPress","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T04:27:46Z"},{"id":"wordfence:d46edcfe-ab6b-4966-9d85-40a2e2ee3d44","source":"wordfence","cve":"CVE-2022-4213","title":"Chained Quiz <= 1.3.2.2 - Reflected Cross-Site Scripting via dn","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d46edcfe-ab6b-4966-9d85-40a2e2ee3d44?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.3.2.2","to_inclusive":true,"patched_in":"1.3.2.3"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d46f1ecb-0a57-4fcb-93d4-2a41a344b4eb","source":"wordfence","cve":"CVE-2025-27295","title":"Live css <= 1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d46f1ecb-0a57-4fcb-93d4-2a41a344b4eb?source=api-prod","affected":[{"type":"plugin","slug":"css-live","name":"Live css","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:32:56Z"},{"id":"wordfence:d46f7a3e-b444-42ce-bf5d-e93a83167181","source":"wordfence","cve":"CVE-2026-22396","title":"Fiorello <= 1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d46f7a3e-b444-42ce-bf5d-e93a83167181?source=api-prod","affected":[{"type":"theme","slug":"fiorello","name":"Fiorello - Florist and Flower Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:32:03Z"},{"id":"wordfence:d46f8e8a-80cb-4407-ac07-f4c93be691b6","source":"wordfence","cve":"CVE-2020-8436","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d46f8e8a-80cb-4407-ac07-f4c93be691b6?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.1","to_inclusive":true,"patched_in":"4.6.0.3"}],"published":"2020-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d472011d-1623-4791-9d56-715d90fe0469","source":"wordfence","cve":"CVE-2026-7249","title":"Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d472011d-1623-4791-9d56-715d90fe0469?source=api-prod","affected":[{"type":"plugin","slug":"location-weather","name":"Location Weather \u2013 WordPress Weather Forecast, Air Quality & Weather Widget","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-05-21T14:36:42Z","updated":"2026-05-22T03:39:22Z"},{"id":"wordfence:d4722d7f-9a7e-440e-9f3e-ce9208ffb39b","source":"wordfence","cve":"CVE-2026-93931","title":"Smash - Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4722d7f-9a7e-440e-9f3e-ce9208ffb39b?source=api-prod","affected":[{"type":"theme","slug":"smash","name":"Smash - Tennis WordPress Theme","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:46:18Z","updated":"2026-10-13T14:26:17Z"},{"id":"wordfence:d4723d9e-9b37-4a1f-ad40-47a918018184","source":"wordfence","cve":"CVE-2026-97308","title":"Login Lockdown & Protection <= 2.17 - Unauthenticated Login Lockout Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4723d9e-9b37-4a1f-ad40-47a918018184?source=api-prod","affected":[{"type":"plugin","slug":"login-lockdown","name":"Login Lockdown & Protection","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":true,"patched_in":"2.18"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:26:05Z"},{"id":"wordfence:d472572a-5696-4020-bc06-88016e4b4afd","source":"wordfence","cve":"CVE-2026-22344","title":"FiveStar <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d472572a-5696-4020-bc06-88016e4b4afd?source=api-prod","affected":[{"type":"theme","slug":"fivestar","name":"FiveStar - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:43:08Z"},{"id":"wordfence:d47a4a6d-e456-44ec-9f5c-912900730ac9","source":"wordfence","cve":"CVE-2026-62085","title":"WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47a4a6d-e456-44ec-9f5c-912900730ac9?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.6","to_inclusive":true,"patched_in":"5.6.7"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:41:42Z"},{"id":"wordfence:d47abf24-bced-44d8-aa99-42f25a938f46","source":"wordfence","cve":"CVE-2025-60045","title":"IDonatePro <= 2.1.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47abf24-bced-44d8-aa99-42f25a938f46?source=api-prod","affected":[{"type":"plugin","slug":"idonate-pro","name":"IDonatePro - Blood Donation, Request And Donor Management WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:37:46Z"},{"id":"wordfence:d47d582d-7c90-4f49-aee1-03a8775b850d","source":"wordfence","cve":"CVE-2024-6210","title":"Duplicator <= 1.5.9 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47d582d-7c90-4f49-aee1-03a8775b850d?source=api-prod","affected":[{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2024-07-10T13:42:05Z","updated":"2024-07-11T02:03:50Z"},{"id":"wordfence:d47f5d90-dc7d-4500-a6e6-e585e4a5c11b","source":"wordfence","cve":"CVE-2023-34376","title":"Change WooCommerce Add To Cart Button Text <= 1.3 - Missing Authorization via rexvs_settings_submit","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47f5d90-dc7d-4500-a6e6-e585e4a5c11b?source=api-prod","affected":[{"type":"plugin","slug":"change-woocommerce-add-to-cart-button-text","name":"Change WooCommerce Add To Cart Button Text","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d47f7d6f-7535-4117-b0da-b27811f733e6","source":"wordfence","cve":"CVE-2025-31068","title":"Seven Stars <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47f7d6f-7535-4117-b0da-b27811f733e6?source=api-prod","affected":[{"type":"theme","slug":"sevenstars","name":"Seven Stars - Modern Responsive MultiPurpose Theme","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:19:09Z"},{"id":"wordfence:d47f7f24-2938-4af6-93b8-1aefb41bbae2","source":"wordfence","cve":"CVE-2026-22357","title":"Link Whisper Free <= 0.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d47f7f24-2938-4af6-93b8-1aefb41bbae2?source=api-prod","affected":[{"type":"plugin","slug":"link-whisper","name":"Link Whisper Free","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":"0.9.3"}],"published":"2026-02-16T00:00:00Z","updated":"2026-05-04T14:39:40Z"},{"id":"wordfence:d4804081-67b1-4c62-af8e-bdbcea2ba6e7","source":"wordfence","cve":"","title":"WP Support Plus Responsive Ticket System <= 7.1.4 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4804081-67b1-4c62-af8e-bdbcea2ba6e7?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":false,"patched_in":"8.0.0"}],"published":"2016-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4828a91-fd56-4c38-8666-d296721120e9","source":"wordfence","cve":"CVE-2025-62909","title":"Smart WeTransfer <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4828a91-fd56-4c38-8666-d296721120e9?source=api-prod","affected":[{"type":"plugin","slug":"smart-wetransfer","name":"Smart WeTransfer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T00:00:00Z","updated":"2025-10-29T15:03:44Z"},{"id":"wordfence:d482f3a1-4a5a-4382-88b1-fd3b91605694","source":"wordfence","cve":"CVE-2025-9693","title":"User Meta \u2013 User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.0,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d482f3a1-4a5a-4382-88b1-fd3b91605694?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:50:20Z","updated":"2025-09-11T07:25:02Z"},{"id":"wordfence:d4837258-c749-4194-926c-22b67e20c1fc","source":"wordfence","cve":"CVE-2024-10571","title":"Chartify \u2013 WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4837258-c749-4194-926c-22b67e20c1fc?source=api-prod","affected":[{"type":"plugin","slug":"chart-builder","name":"Chartify \u2013 WordPress Chart Plugin","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2024-11-13T00:00:00Z","updated":"2025-03-24T15:04:56Z"},{"id":"wordfence:d484500f-c8c1-4278-8a38-82a7fd5674f9","source":"wordfence","cve":"CVE-2023-51376","title":"ProjectHuddle Client Site <= 1.0.34 - Missing Authorization via ph_child_ajax_notice_handler","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d484500f-c8c1-4278-8a38-82a7fd5674f9?source=api-prod","affected":[{"type":"plugin","slug":"projecthuddle-child-site","name":"SureFeedback Client Site","from":"*","from_inclusive":true,"to":"1.0.34","to_inclusive":true,"patched_in":"1.0.35"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d48899b9-b3b3-45d7-b7e1-6a8560becb0b","source":"wordfence","cve":"CVE-2026-39694","title":"Simply Schedule Appointments <= 1.6.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d48899b9-b3b3-45d7-b7e1-6a8560becb0b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.0","to_inclusive":true,"patched_in":"1.6.11.1"}],"published":"2026-02-26T00:00:00Z","updated":"2026-05-05T18:31:40Z"},{"id":"wordfence:d488cfef-8ee7-483a-94f2-c172e5576005","source":"wordfence","cve":"CVE-2024-33597","title":"SSU <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d488cfef-8ee7-483a-94f2-c172e5576005?source=api-prod","affected":[{"type":"plugin","slug":"wp-s3-smart-upload","name":"SSU \u2013 WordPress Amazon S3 & Wasabi Smart File Uploads Plugin","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:28:31Z"},{"id":"wordfence:d48aba0f-4655-4836-bc6c-c9c74339f758","source":"wordfence","cve":"CVE-2026-85128","title":"Choose User Role at Registration for WooCommerce <= 1.3.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d48aba0f-4655-4836-bc6c-c9c74339f758?source=api-prod","affected":[{"type":"plugin","slug":"choose-user-role-at-registration","name":"Choose User Role at Registration for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:23:40Z"},{"id":"wordfence:d48f98cb-18d5-4b15-96cb-94a4c86148e4","source":"wordfence","cve":"CVE-2026-27050","title":"RealPress \u2013 Real Estate Plugin <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d48f98cb-18d5-4b15-96cb-94a4c86148e4?source=api-prod","affected":[{"type":"plugin","slug":"realpress","name":"RealPress \u2013 Real Estate Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-01-13T00:00:00Z","updated":"2026-04-14T14:31:02Z"},{"id":"wordfence:d4918bc5-5d92-4363-abd5-69f2c9a46543","source":"wordfence","cve":"CVE-2026-27398","title":"RSVP and Event Management <= 2.7.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4918bc5-5d92-4363-abd5-69f2c9a46543?source=api-prod","affected":[{"type":"plugin","slug":"rsvp","name":"RSVP and Event Management","from":"*","from_inclusive":true,"to":"2.7.16","to_inclusive":true,"patched_in":"2.7.17"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:26:46Z"},{"id":"wordfence:d4933a30-974f-487d-9444-b0ea1283a09c","source":"wordfence","cve":"CVE-2023-6486","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4933a30-974f-487d-9444-b0ea1283a09c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2024-04-03T00:00:00Z","updated":"2024-07-29T21:37:32Z"},{"id":"wordfence:d4994d7d-82f7-4cb0-869f-e27abe04b621","source":"wordfence","cve":"","title":"Knews Multilingual Newsletters Plugin <= 1.7.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4994d7d-82f7-4cb0-869f-e27abe04b621?source=api-prod","affected":[{"type":"plugin","slug":"knews","name":"Knews Multilingual Newsletters","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2015-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d49a2180-cf3f-4ef9-805f-e7592b793a2c","source":"wordfence","cve":"CVE-2014-4600","title":"WP Ultimate Email Marketer <= 1.1.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49a2180-cf3f-4ef9-805f-e7592b793a2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-email-marketer","name":"WP Ultimate Email Marketer","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d49a85d9-dea4-4632-adf7-c29b71b12c50","source":"wordfence","cve":"CVE-2025-53249","title":"Build App Online <= 1.0.23 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49a85d9-dea4-4632-adf7-c29b71b12c50?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T19:53:05Z"},{"id":"wordfence:d49aee72-9854-4f72-993b-967b9d6891b1","source":"wordfence","cve":"CVE-2025-68068","title":"Stockholm <= 9.14.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49aee72-9854-4f72-993b-967b9d6891b1?source=api-prod","affected":[{"type":"theme","slug":"stockholm","name":"Stockholm","from":"*","from_inclusive":true,"to":"9.14.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-18T00:00:00Z","updated":"2025-12-19T17:06:00Z"},{"id":"wordfence:d49b404f-4683-410b-884e-2c11218a3204","source":"wordfence","cve":"CVE-2026-19699","title":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49b404f-4683-410b-884e-2c11218a3204?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:11:59Z"},{"id":"wordfence:d49b8c44-4dad-4990-a8a8-116b424a7dfa","source":"wordfence","cve":"CVE-2023-5776","title":"Post Meta Data Manager <= 1.2.1 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49b8c44-4dad-4990-a8a8-116b424a7dfa?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d49bd587-26fc-48fb-86aa-a043a5938d43","source":"wordfence","cve":"","title":"CP Image Store with Slideshow < 1.0.7 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49bd587-26fc-48fb-86aa-a043a5938d43?source=api-prod","affected":[{"type":"plugin","slug":"cp-image-store","name":"CP Image Store with Slideshow","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":false,"patched_in":"1.0.7"}],"published":"2015-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d49cdae7-4a95-494d-81da-a93e3c764ee7","source":"wordfence","cve":"CVE-2016-20074","title":"Lazy content Slider <= 3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d49cdae7-4a95-494d-81da-a93e3c764ee7?source=api-prod","affected":[{"type":"plugin","slug":"lazy-content-slider","name":"Lazy content Slider","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:38:24Z"},{"id":"wordfence:d4a15720-2535-4258-8d58-20818cdbd413","source":"wordfence","cve":"CVE-2025-22561","title":"Title Experiments Free <= 9.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a15720-2535-4258-8d58-20818cdbd413?source=api-prod","affected":[{"type":"plugin","slug":"wp-experiments-free","name":"Title Experiments Free","from":"*","from_inclusive":true,"to":"9.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:17:09Z"},{"id":"wordfence:d4a21d0d-f455-4901-a04b-13c891cf8f75","source":"wordfence","cve":"CVE-2026-4029","title":"Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a21d0d-f455-4901-a04b-13c891cf8f75?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-backup","name":"Database Backup for WordPress","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-05-13T00:00:00Z","updated":"2026-05-14T12:32:10Z"},{"id":"wordfence:d4a59aa8-db96-4487-97e9-e42aa57967fc","source":"wordfence","cve":"CVE-2024-37461","title":"IdeaPush <= 8.65 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a59aa8-db96-4487-97e9-e42aa57967fc?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.65","to_inclusive":true,"patched_in":"8.66"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:03:05Z"},{"id":"wordfence:d4a5c931-16f8-41b6-b4b6-567aa6c6c90e","source":"wordfence","cve":"CVE-2022-4346","title":"All-In-One Security <= 5.1.2 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a5c931-16f8-41b6-b4b6-567aa6c6c90e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4a5ec27-fe7e-411d-811c-e6b66dd7ba56","source":"wordfence","cve":"CVE-2026-27080","title":"Deston <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a5ec27-fe7e-411d-811c-e6b66dd7ba56?source=api-prod","affected":[{"type":"theme","slug":"deston","name":"Deston - Corporate Business WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:50:03Z"},{"id":"wordfence:d4a6c1e4-635f-4d4d-87a4-8eeded25f07f","source":"wordfence","cve":"CVE-2012-6625","title":"WP Forum Server < 1.7.4 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a6c1e4-635f-4d4d-87a4-8eeded25f07f?source=api-prod","affected":[{"type":"plugin","slug":"forum-server","name":"WP Forum Server","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4a7c647-4c57-499a-8e46-ca273985bd6d","source":"wordfence","cve":"CVE-2023-47871","title":"Contact Form to Any API <= 1.1.6 - Missing Authorization via delete_cf7_records()","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a7c647-4c57-499a-8e46-ca273985bd6d?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4a905c0-f958-4c9b-9e96-dd8653b50497","source":"wordfence","cve":"CVE-2024-43135","title":"WPCafe <= 2.2.28 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a905c0-f958-4c9b-9e96-dd8653b50497?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"2.2.28","to_inclusive":true,"patched_in":"2.2.29"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T17:21:16Z"},{"id":"wordfence:d4aa9303-953f-4bc3-8069-8e9a967461a9","source":"wordfence","cve":"CVE-2025-12663","title":"Jeba Cute forkit <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aa9303-953f-4bc3-8069-8e9a967461a9?source=api-prod","affected":[{"type":"plugin","slug":"jeba-cute-forkit","name":"Jeba Cute forkit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:10:25Z","updated":"2025-11-11T03:30:49Z"},{"id":"wordfence:d4aaca22-76b9-42ec-a960-65d44d696324","source":"wordfence","cve":"CVE-2023-3167","title":"Mail Queue <= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aaca22-76b9-42ec-a960-65d44d696324?source=api-prod","affected":[{"type":"plugin","slug":"mail-queue","name":"Mail Queue","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4ac0d0f-fc08-43f5-8003-f14bd0b71fbe","source":"wordfence","cve":"CVE-2026-115601","title":"Custom Price for WooCommerce <= 1.1.29 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ac0d0f-fc08-43f5-8003-f14bd0b71fbe?source=api-prod","affected":[{"type":"plugin","slug":"custom-price-for-woocommerce","name":"Custom Price for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.29","to_inclusive":true,"patched_in":"1.1.30"}],"published":"2026-10-29T14:31:00Z","updated":"2026-11-03T19:27:12Z"},{"id":"wordfence:d4ae4e05-cdbf-481f-abcc-9704e75ec8ad","source":"wordfence","cve":"CVE-2022-0169","title":"Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ae4e05-cdbf-481f-abcc-9704e75ec8ad?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"}],"published":"2022-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4b06b93-6b15-4b1f-bdd9-080618591bdc","source":"wordfence","cve":"CVE-2025-11361","title":"Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2025-10-17T16:25:07Z","updated":"2025-12-01T14:41:41Z"},{"id":"wordfence:d4b071a5-66b5-406d-a14f-5ae22ea4b8eb","source":"wordfence","cve":"CVE-2025-63076","title":"The7 Elements < 2.7.12 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b071a5-66b5-406d-a14f-5ae22ea4b8eb?source=api-prod","affected":[{"type":"plugin","slug":"dt-the7-core","name":"The7 Elements","from":"*","from_inclusive":true,"to":"2.7.12","to_inclusive":false,"patched_in":"2.7.12"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-18T17:42:59Z"},{"id":"wordfence:d4b17cce-bb52-4125-8c85-6da15517275f","source":"wordfence","cve":"CVE-2023-22701","title":"Ebook Store <= 5.775 - Missing Authorization via ebook_store_export_orders","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b17cce-bb52-4125-8c85-6da15517275f?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.775","to_inclusive":true,"patched_in":"5.78"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4b4b5a0-b121-4ed2-b3ae-506f2950c7cf","source":"wordfence","cve":"CVE-2025-31806","title":"Webling <= 3.9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b4b5a0-b121-4ed2-b3ae-506f2950c7cf?source=api-prod","affected":[{"type":"plugin","slug":"webling","name":"Webling","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-04-01T00:00:00Z","updated":"2026-03-17T21:21:03Z"},{"id":"wordfence:d4b6d2c6-d157-4c4c-b6e1-557b8353c742","source":"wordfence","cve":"CVE-2023-47523","title":"Auto Tag Creator <= 1.0.2 - Missing Authorization via tag_save_settings_callback","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b6d2c6-d157-4c4c-b6e1-557b8353c742?source=api-prod","affected":[{"type":"plugin","slug":"auto-tag-creator","name":"Auto Tag Creator \u2013 Automatic Tags for Posts and WooCommerce Products","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2023-11-07T00:00:00Z","updated":"2026-05-26T18:14:27Z"},{"id":"wordfence:d4ba4365-449e-4271-b46e-7f149efc752c","source":"wordfence","cve":"","title":"Video Conferencing with Zoom < 3.8.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ba4365-449e-4271-b46e-7f149efc752c?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"3.8.16","to_inclusive":false,"patched_in":"3.8.16"}],"published":"2021-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4bbb00b-4baf-4dc1-85ab-3ca3d59eaf33","source":"wordfence","cve":"","title":"Easy Forms for Mailchimp < 6.1 - Local File Inclusion","severity":"critical","cvss":9.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bbb00b-4baf-4dc1-85ab-3ca3d59eaf33?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":false,"patched_in":"6.1"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4bc05a2-25f9-4276-8541-a77efc7bd617","source":"wordfence","cve":"CVE-2026-101325","title":"Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bc05a2-25f9-4276-8541-a77efc7bd617?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.1","to_inclusive":true,"patched_in":"4.18.2"}],"published":"2026-10-30T20:12:10Z","updated":"2026-10-31T08:30:47Z"},{"id":"wordfence:d4bcd44e-2677-4d53-9404-350979915647","source":"wordfence","cve":"CVE-2026-66616","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.49 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bcd44e-2677-4d53-9404-350979915647?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.49","to_inclusive":true,"patched_in":"1.15.50"}],"published":"2026-08-19T00:00:00Z","updated":"2026-11-03T22:46:17Z"},{"id":"wordfence:d4bce9d1-38b9-4c25-b5dc-fd9dedfc3ede","source":"wordfence","cve":"CVE-2024-30224","title":"WholesaleX \u2013 WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) <= 1.3.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bce9d1-38b9-4c25-b5dc-fd9dedfc3ede?source=api-prod","affected":[{"type":"plugin","slug":"wholesalex","name":"WholesaleX \u2013 Wholesale Pricing & B2B Solution","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T21:16:50Z"},{"id":"wordfence:d4beb0b7-e287-43bd-b8d1-3aa65e268ead","source":"wordfence","cve":"CVE-2024-27993","title":"Calendarista Basic Edition <= 3.0.2 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4beb0b7-e287-43bd-b8d1-3aa65e268ead?source=api-prod","affected":[{"type":"plugin","slug":"calendarista-basic-edition","name":"Calendarista Basic Edition \u2013 WordPress appointment booking system","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:53:22Z"},{"id":"wordfence:d4bee7f0-ccbf-44b6-b853-f726d44fb83e","source":"wordfence","cve":"CVE-2026-57356","title":"MoreConvert Wishlist for WooCommerce <= 1.9.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bee7f0-ccbf-44b6-b853-f726d44fb83e?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert","name":"MoreConvert Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.19","to_inclusive":true,"patched_in":"1.9.20"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T20:00:16Z"},{"id":"wordfence:d4bf80cd-8956-4143-afcb-995013554d56","source":"wordfence","cve":"CVE-2015-9493","title":"My Wish List < 1.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bf80cd-8956-4143-afcb-995013554d56?source=api-prod","affected":[{"type":"plugin","slug":"my-wish-list","name":"My Wish List","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"}],"published":"2015-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4c1add9-2141-4221-889b-f9b0efebd6c7","source":"wordfence","cve":"CVE-2022-45358","title":"Activello <= 1.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c1add9-2141-4221-889b-f9b0efebd6c7?source=api-prod","affected":[{"type":"theme","slug":"activello","name":"Activello","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-11-23T00:00:00Z","updated":"2026-08-14T15:11:41Z"},{"id":"wordfence:d4c27c06-214a-4c20-80d0-b6b4d18737c3","source":"wordfence","cve":"CVE-2023-40000","title":"LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c27c06-214a-4c20-80d0-b6b4d18737c3?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"5.7.0.1"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T16:09:40Z"},{"id":"wordfence:d4c2e35a-f271-45b0-a3b6-9a1dbbcaf72f","source":"wordfence","cve":"CVE-2024-56023","title":"WP eCommerce Quickpay <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c2e35a-f271-45b0-a3b6-9a1dbbcaf72f?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-quickpay","name":"WP eCommerce Quickpay","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:08:11Z"},{"id":"wordfence:d4c56931-c2af-4940-95e4-3f3dae51c31c","source":"wordfence","cve":"CVE-2024-4095","title":"Collapse-O-Matic <= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c56931-c2af-4940-95e4-3f3dae51c31c?source=api-prod","affected":[{"type":"plugin","slug":"jquery-collapse-o-matic","name":"Collapse-O-Matic","from":"*","from_inclusive":true,"to":"1.8.5.8","to_inclusive":true,"patched_in":""}],"published":"2024-06-14T20:12:13Z","updated":"2024-06-15T08:42:19Z"},{"id":"wordfence:d4c5a982-74ba-4a54-8c95-515a628f9c39","source":"wordfence","cve":"","title":"FLV Embed <= 1.2.1 - Cross-Site Request Forgery to Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c5a982-74ba-4a54-8c95-515a628f9c39?source=api-prod","affected":[{"type":"plugin","slug":"flv-embed","name":"FLV Embed","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4c6d0ef-fe2c-4449-9e9c-135529a99575","source":"wordfence","cve":"","title":"Soundy Background Music <= 3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c6d0ef-fe2c-4449-9e9c-135529a99575?source=api-prod","affected":[{"type":"plugin","slug":"soundy-background-music","name":"Soundy Background Music","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2016-03-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4c79242-5c89-40c0-abcc-c112f7a64a74","source":"wordfence","cve":"CVE-2023-2557","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c79242-5c89-40c0-abcc-c112f7a64a74?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4c8333f-1570-4bf2-a7d0-cce705e88f27","source":"wordfence","cve":"CVE-2024-6138","title":"Secure Copy Content Protection and Content Locking <= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c8333f-1570-4bf2-a7d0-cce705e88f27?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-06-20T00:00:00Z","updated":"2024-08-09T20:31:13Z"},{"id":"wordfence:d4cb4dea-afaa-4ab5-a48a-f1bee6d4665b","source":"wordfence","cve":"CVE-2024-37267","title":"Striking <= 2.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cb4dea-afaa-4ab5-a48a-f1bee6d4665b?source=api-prod","affected":[{"type":"theme","slug":"striking-r","name":"Striking","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T14:06:15Z"},{"id":"wordfence:d4cc9537-879c-4c12-8b76-60241b7a3420","source":"wordfence","cve":"CVE-2026-85657","title":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <=  4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cc9537-879c-4c12-8b76-60241b7a3420?source=api-prod","affected":[{"type":"plugin","slug":"publishpress-authors","name":"Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.16.0"}],"published":"2026-09-14T12:04:35Z","updated":"2026-09-15T01:03:09Z"},{"id":"wordfence:d4cdf774-c93b-4b94-85ba-aa56bf401873","source":"wordfence","cve":"CVE-2023-1159","title":"Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4cdf774-c93b-4b94-85ba-aa56bf401873?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"21.7","from_inclusive":true,"to":"21.7","to_inclusive":true,"patched_in":"21.8"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4ce9465-8158-4046-8195-5a82e6beb8d9","source":"wordfence","cve":"CVE-2025-31438","title":"WP Supersized <= 3.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ce9465-8158-4046-8195-5a82e6beb8d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-supersized","name":"WP Supersized","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:24:00Z"},{"id":"wordfence:d4d11477-8a9a-42a0-aafd-5ef10ca5a349","source":"wordfence","cve":"CVE-2022-4453","title":"3D FlipBook <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d11477-8a9a-42a0-aafd-5ef10ca5a349?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4d5ae93-000e-4001-adfa-c11058032469","source":"wordfence","cve":"CVE-2023-6561","title":"Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d5ae93-000e-4001-adfa-c11058032469?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2023-12-14T00:00:00Z","updated":"2024-07-29T21:37:32Z"},{"id":"wordfence:d4d5b553-141c-4d3e-b435-41753e3580df","source":"wordfence","cve":"CVE-2020-37244","title":"Membership by Supsystic <= 1.4.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d5b553-141c-4d3e-b435-41753e3580df?source=api-prod","affected":[{"type":"plugin","slug":"membership-by-supsystic","name":"Membership by Supsystic","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-16T00:00:00Z","updated":"2026-07-29T20:41:17Z"},{"id":"wordfence:d4d7a36f-0210-43e8-b95c-f8666bf70aac","source":"wordfence","cve":"CVE-2025-58599","title":"Order Delivery Date for WooCommerce <= 4.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d7a36f-0210-43e8-b95c-f8666bf70aac?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:41:06Z"},{"id":"wordfence:d4d9e8fa-abc5-477a-bf99-dc910f0aabda","source":"wordfence","cve":"CVE-2024-27990","title":"The Moneytizer <= 9.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4d9e8fa-abc5-477a-bf99-dc910f0aabda?source=api-prod","affected":[{"type":"plugin","slug":"the-moneytizer","name":"The Moneytizer","from":"*","from_inclusive":true,"to":"9.5.20","to_inclusive":true,"patched_in":"9.6.1"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:52:29Z"},{"id":"wordfence:d4da8ead-326f-4c93-b56d-8bfa643d7906","source":"wordfence","cve":"CVE-2024-7782","title":"Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletion","severity":"high","cvss":8.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4da8ead-326f-4c93-b56d-8bfa643d7906?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"2.0","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2024-08-19T14:58:34Z","updated":"2025-07-02T14:44:54Z"},{"id":"wordfence:d4dacd15-85cc-41f5-830c-b02c85c798f9","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'cronLogDeleteOption' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4dacd15-85cc-41f5-830c-b02c85c798f9?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4db7f56-41c7-497a-8e83-460450644d5b","source":"wordfence","cve":"CVE-2026-39629","title":"Uminex <= 1.0.9 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4db7f56-41c7-497a-8e83-460450644d5b?source=api-prod","affected":[{"type":"theme","slug":"uminex","name":"Uminex - Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-12T00:00:00Z","updated":"2026-05-05T15:29:14Z"},{"id":"wordfence:d4dc2456-12fb-4f2c-a1e7-6cc5d1cf8faf","source":"wordfence","cve":"CVE-2025-52733","title":"ANON::form embedded secure form <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4dc2456-12fb-4f2c-a1e7-6cc5d1cf8faf?source=api-prod","affected":[{"type":"plugin","slug":"anonform-embedded-secure-form","name":"ANON::form embedded secure form","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:55:58Z"},{"id":"wordfence:d4dc4c7f-b5cd-4090-a303-4386af935712","source":"wordfence","cve":"CVE-2026-22430","title":"Verdure <= 1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4dc4c7f-b5cd-4090-a303-4386af935712?source=api-prod","affected":[{"type":"theme","slug":"verdure","name":"Verdure - Organic Tea Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-02T00:00:00Z","updated":"2026-01-14T20:20:46Z"},{"id":"wordfence:d4e04650-624a-4440-b166-8de0f24bb1dd","source":"wordfence","cve":"CVE-2024-0956","title":"WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e04650-624a-4440-b166-8de0f24bb1dd?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2024-03-28T00:00:00Z","updated":"2025-11-05T18:47:34Z"},{"id":"wordfence:d4e1ca02-4eb5-4a46-99d5-89630f37d9ed","source":"wordfence","cve":"CVE-2023-1020","title":"Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e1ca02-4eb5-4a46-99d5-89630f37d9ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-shoutbox-live-chat","name":"Steveas WP Live Chat Shoutbox","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4e1ddaa-d05a-4261-b55d-54d7650c12b8","source":"wordfence","cve":"CVE-2025-12580","title":"SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e1ddaa-d05a-4261-b55d-54d7650c12b8?source=api-prod","affected":[{"type":"plugin","slug":"sms4wp","name":"SMS for WordPress","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T14:26:05Z","updated":"2025-11-05T03:27:57Z"},{"id":"wordfence:d4e3e818-8d47-467a-b5cf-7eebd6a624a2","source":"wordfence","cve":"CVE-2021-24582","title":"ThinkTwit < 1.7.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e3e818-8d47-467a-b5cf-7eebd6a624a2?source=api-prod","affected":[{"type":"plugin","slug":"thinktwit","name":"ThinkTwit","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4e97c01-7e8a-41b7-90ad-029d8c5fd37c","source":"wordfence","cve":"CVE-2023-50852","title":"BookIt <= 2.4.3 - Authenticated(Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e97c01-7e8a-41b7-90ad-029d8c5fd37c?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4eb12ee-8c07-460d-8bfe-f2f78f7ed569","source":"wordfence","cve":"CVE-2025-67623","title":"6Storage Rentals <= 2.20.0 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4eb12ee-8c07-460d-8bfe-f2f78f7ed569?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-20T00:00:00Z","updated":"2026-01-05T21:15:32Z"},{"id":"wordfence:d4ec4480-ed4a-4a8b-b19a-2b60e7fba0c7","source":"wordfence","cve":"CVE-2024-9765","title":"EKC Tournament Manager <= 2.2.1 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ec4480-ed4a-4a8b-b19a-2b60e7fba0c7?source=api-prod","affected":[{"type":"plugin","slug":"ekc-tournament-manager","name":"EKC Tournament Manager","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-11-14T00:00:00Z","updated":"2025-05-23T15:37:53Z"},{"id":"wordfence:d4ef511b-baf7-481d-8a3f-637cf571f98e","source":"wordfence","cve":"CVE-2026-86812","title":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System 3.0.10 - 3.0.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4ef511b-baf7-481d-8a3f-637cf571f98e?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"3.0.10","from_inclusive":true,"to":"3.0.17","to_inclusive":true,"patched_in":"3.0.18"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:21:30Z"},{"id":"wordfence:d4efe60a-d8e3-4e51-95b2-246e30e90e89","source":"wordfence","cve":"CVE-2023-51501","title":"Uncode Core <= 2.8.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4efe60a-d8e3-4e51-95b2-246e30e90e89?source=api-prod","affected":[{"type":"plugin","slug":"uncode-core","name":"Uncode Core","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4f28285-bfa3-4063-bc8b-303db72d0156","source":"wordfence","cve":"","title":"Timely All-in-One Events Calendar <= 2.5.38 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f28285-bfa3-4063-bc8b-303db72d0156?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-event-calendar","name":"Timely All-in-One Events Calendar","from":"*","from_inclusive":true,"to":"2.5.38","to_inclusive":true,"patched_in":"2.5.39"}],"published":"2019-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4f29711-6aec-4481-a3bc-2303592bb79c","source":"wordfence","cve":"CVE-2024-37109","title":"WishList Member X < 3.26.7 - Authenticated (Subscriber+) Remote Code Execution","severity":"critical","cvss":9.9,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f29711-6aec-4481-a3bc-2303592bb79c?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T14:58:06Z"},{"id":"wordfence:d4f3d386-98cc-4b5a-b13f-841e812bb37f","source":"wordfence","cve":"CVE-2014-7297","title":"Enfold < 3.0.1 - Unspecified Vulnerability","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f3d386-98cc-4b5a-b13f-841e812bb37f?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"Enfold - Responsive Multi-Purpose Theme","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":false,"patched_in":"3.0.1"}],"published":"2014-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d4f4fbe3-44ec-4530-93e1-6422ed3ef188","source":"wordfence","cve":"CVE-2025-26919","title":"Tain\u00e1 <= 0.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f4fbe3-44ec-4530-93e1-6422ed3ef188?source=api-prod","affected":[{"type":"theme","slug":"taina","name":"Tain\u00e1","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":"0.2.5"}],"published":"2025-04-02T00:00:00Z","updated":"2025-12-19T16:14:21Z"},{"id":"wordfence:d4f60e8c-2745-4930-9101-914bd73c6e1c","source":"wordfence","cve":"CVE-2023-5001","title":"Horizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f60e8c-2745-4930-9101-914bd73c6e1c?source=api-prod","affected":[{"type":"plugin","slug":"horizontal-scrolling-announcement","name":"Horizontal scrolling announcement","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-15T00:00:00Z","updated":"2024-10-24T18:10:47Z"},{"id":"wordfence:d4f8607c-711e-4d0e-8379-49346033a837","source":"wordfence","cve":"CVE-2026-107745","title":"AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter","severity":"medium","cvss":4.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4f8607c-711e-4d0e-8379-49346033a837?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.4","to_inclusive":true,"patched_in":"3.8.5"}],"published":"2026-10-27T14:29:04Z","updated":"2026-10-28T02:30:00Z"},{"id":"wordfence:d4fb697f-4571-4aa8-8430-fd4f457de2a8","source":"wordfence","cve":"CVE-2024-34429","title":"Corona Virus (COVID-19) Banner & Live Data <= 1.8.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4fb697f-4571-4aa8-8430-fd4f457de2a8?source=api-prod","affected":[{"type":"plugin","slug":"corona-virus-covid-19-banner","name":"Simple Website Banner","from":"*","from_inclusive":true,"to":"1.8.0.3","to_inclusive":true,"patched_in":"1.8.0.4"}],"published":"2024-05-06T00:00:00Z","updated":"2024-06-19T17:09:15Z"},{"id":"wordfence:d502e617-a59f-4385-b050-3702a1b1ed7e","source":"wordfence","cve":"CVE-2024-2950","title":"BoldGrid Easy SEO \u2013 Simple and Effective SEO <= 1.6.14 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d502e617-a59f-4385-b050-3702a1b1ed7e?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-easy-seo","name":"BoldGrid Easy SEO \u2013 Simple and Effective SEO","from":"*","from_inclusive":true,"to":"1.6.14","to_inclusive":true,"patched_in":"1.6.15"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T03:32:05Z"},{"id":"wordfence:d5031631-9f12-47d3-997d-4418d348ab40","source":"wordfence","cve":"CVE-2026-3550","title":"RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5031631-9f12-47d3-997d-4418d348ab40?source=api-prod","affected":[{"type":"plugin","slug":"ft-rockpress","name":"RockPress","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2026-03-19T19:51:24Z","updated":"2026-03-20T08:25:58Z"},{"id":"wordfence:d503de5f-ba13-4c51-b514-15f2e7b2752b","source":"wordfence","cve":"CVE-2022-44587","title":"WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d503de5f-ba13-4c51-b514-15f2e7b2752b?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-27T13:24:14Z"},{"id":"wordfence:d504c2bd-d6a8-4a66-a650-4a18cb32c54a","source":"wordfence","cve":"CVE-2025-24580","title":"12 Step Meeting List <= 3.16.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d504c2bd-d6a8-4a66-a650-4a18cb32c54a?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"*","from_inclusive":true,"to":"3.16.5","to_inclusive":true,"patched_in":"3.16.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:12:41Z"},{"id":"wordfence:d50865b5-3910-4b26-8a4f-08922a2af230","source":"wordfence","cve":"CVE-2025-46497","title":"Navegg Analytics <= 3.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50865b5-3910-4b26-8a4f-08922a2af230?source=api-prod","affected":[{"type":"plugin","slug":"navegg","name":"Navegg Analytics","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:11:27Z"},{"id":"wordfence:d50d0e87-a4be-465b-8cc1-4b56201c9fc0","source":"wordfence","cve":"CVE-2024-31370","title":"AIKit <= 4.14.1 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50d0e87-a4be-465b-8cc1-4b56201c9fc0?source=api-prod","affected":[{"type":"plugin","slug":"aikit-wordpress-ai-writing-assistant-using-gpt3","name":"AIKit - WordPress AI Automatic Writer, Chatbot, Writing Assistant & Content Repurposer / OpenAI GPT","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-11T16:11:12Z"},{"id":"wordfence:d50d8d51-3bb4-4556-95e3-06812a31d0d6","source":"wordfence","cve":"CVE-2023-2122","title":"Image Optimizer WD <= 1.0.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50d8d51-3bb4-4556-95e3-06812a31d0d6?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer-wd","name":"Image Optimizer by 10web \u2013 Image Optimizer and Compression plugin","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2023-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d50e0b60-31b4-4633-899a-f400442992b5","source":"wordfence","cve":"CVE-2026-22418","title":"Great Lotus | Buddhist Temple WordPress Theme + RTL <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50e0b60-31b4-4633-899a-f400442992b5?source=api-prod","affected":[{"type":"theme","slug":"great-lotus","name":"Great Lotus | Buddhist Temple WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:39:25Z"},{"id":"wordfence:d50eb008-6506-4f5f-b426-49fc61ecd876","source":"wordfence","cve":"CVE-2025-68899","title":"Vivagh <= 2.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50eb008-6506-4f5f-b426-49fc61ecd876?source=api-prod","affected":[{"type":"theme","slug":"vivagh","name":"Wedding Photographer WordPress Theme - Vivagh","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T14:14:55Z"},{"id":"wordfence:d50f5cf0-0771-4fb4-966a-7359c1b95f58","source":"wordfence","cve":"CVE-2026-94076","title":"GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d50f5cf0-0771-4fb4-966a-7359c1b95f58?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"14.2.5","to_inclusive":true,"patched_in":"14.2.6"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:50:38Z"},{"id":"wordfence:d5111215-7ce9-46e3-b247-c3f0f28ec094","source":"wordfence","cve":"CVE-2024-12156","title":"AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5111215-7ce9-46e3-b247-c3f0f28ec094?source=api-prod","affected":[{"type":"plugin","slug":"seo-help","name":"QC SEO Help for llms.txt, AI Analytics, AI Content Writer, FAQ Generator, Subtitle to Article","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.1.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T04:23:15Z"},{"id":"wordfence:d518f02a-073d-4eb8-8b9d-0a2ff815b0f3","source":"wordfence","cve":"CVE-2026-19423","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d518f02a-073d-4eb8-8b9d-0a2ff815b0f3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"2.6.7","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:55:36Z"},{"id":"wordfence:d51a8673-8fe0-4329-970d-085db5cdf2d3","source":"wordfence","cve":"CVE-2026-95808","title":"Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51a8673-8fe0-4329-970d-085db5cdf2d3?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.48","to_inclusive":true,"patched_in":"1.15.49"}],"published":"2026-10-13T15:09:23Z","updated":"2026-10-14T03:40:06Z"},{"id":"wordfence:d51ba0c2-588d-4241-977a-9649cb77c78e","source":"wordfence","cve":"CVE-2026-107759","title":"WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51ba0c2-588d-4241-977a-9649cb77c78e?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-msgraphmailer","name":"WPO365 | MICROSOFT 365 GRAPH MAILER","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2026-10-30T19:15:13Z","updated":"2026-10-31T07:46:52Z"},{"id":"wordfence:d51d8b79-04ff-470f-92da-12eb72ac023a","source":"wordfence","cve":"CVE-2024-44011","title":"WP Ticket Ultra Help Desk & Support Plugin <= 1.0.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51d8b79-04ff-470f-92da-12eb72ac023a?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket-ultra","name":"WP Ticket Ultra Help Desk & Support Plugin","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:39:52Z"},{"id":"wordfence:d51db160-c701-426d-890f-73cc4785cad8","source":"wordfence","cve":"CVE-2024-1382","title":"Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51db160-c701-426d-890f-73cc4785cad8?source=api-prod","affected":[{"type":"plugin","slug":"nd-restaurant-reservations","name":"Restaurant Reservations","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-03-06T00:00:00Z","updated":"2024-03-07T08:34:54Z"},{"id":"wordfence:d51f0230-b85c-4c2d-9fa0-e68b52e51c76","source":"wordfence","cve":"CVE-2023-2842","title":"WP Inventory Manager <= 2.1.0.13 - Cross-Site Request Forgery via delete_item","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d51f0230-b85c-4c2d-9fa0-e68b52e51c76?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.1.0.13","to_inclusive":true,"patched_in":"2.1.0.14"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5209e18-894e-46fa-9eb1-11016ef41104","source":"wordfence","cve":"CVE-2025-14975","title":"Custom Login Page Customizer <= 2.5.3 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5209e18-894e-46fa-9eb1-11016ef41104?source=api-prod","affected":[{"type":"plugin","slug":"login-customizer","name":"Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-04T13:12:46Z"},{"id":"wordfence:d5211437-9c6d-435f-a7f2-17ed754d0fab","source":"wordfence","cve":"CVE-2025-10056","title":"Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery","severity":"medium","cvss":4.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=api-prod","affected":[{"type":"plugin","slug":"task-scheduler","name":"Task Scheduler","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:39:58Z","updated":"2025-10-15T08:26:03Z"},{"id":"wordfence:d5217ca4-8155-4e38-9411-6e16afabfba5","source":"wordfence","cve":"CVE-2026-24559","title":"Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5217ca4-8155-4e38-9411-6e16afabfba5?source=api-prod","affected":[{"type":"plugin","slug":"cf7-hubspot","name":"Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T15:40:10Z"},{"id":"wordfence:d5227269-4406-4fcf-af37-f1db0af857d6","source":"wordfence","cve":"CVE-2026-1400","title":"AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5227269-4406-4fcf-af37-f1db0af857d6?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-01-27T19:28:10Z","updated":"2026-01-28T08:26:56Z"},{"id":"wordfence:d522adb8-6a1f-4df7-8374-3f7491ed377c","source":"wordfence","cve":"CVE-2025-69155","title":"Fitness Zone WordPress <= 5.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d522adb8-6a1f-4df7-8374-3f7491ed377c?source=api-prod","affected":[{"type":"theme","slug":"fitnesszone","name":"Fitness Zone WordPress Theme","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:40:14Z"},{"id":"wordfence:d52332cc-ba8d-4e7f-981a-c829fd45b5c4","source":"wordfence","cve":"CVE-2025-31926","title":"Sticky Radio Player <= 3.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52332cc-ba8d-4e7f-981a-c829fd45b5c4?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio5-html5-shoutcast_sticky","name":"Sticky Radio Player","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T21:15:54Z"},{"id":"wordfence:d5244db8-86b3-4d1d-8fd6-febfd5a7372e","source":"wordfence","cve":"CVE-2024-31232","title":"Rehub <= 19.6.1 - Authenticated (Editor+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5244db8-86b3-4d1d-8fd6-febfd5a7372e?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.6.1","to_inclusive":true,"patched_in":"19.6.2"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-06T17:28:50Z"},{"id":"wordfence:d524a2c1-43df-4059-b1ec-b0738026158e","source":"wordfence","cve":"","title":"Travel Booking WordPress Theme < 2.8.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d524a2c1-43df-4059-b1ec-b0738026158e?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d524b859-b61c-4c52-b4b3-76f2983c085a","source":"wordfence","cve":"CVE-2025-3951","title":"WP-Optimize <= 4.1.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d524b859-b61c-4c52-b4b3-76f2983c085a?source=api-prod","affected":[{"type":"plugin","slug":"wp-optimize","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-05-12T00:00:00Z","updated":"2025-06-06T14:11:50Z"},{"id":"wordfence:d5274ebf-3907-42bd-9c6b-731e0d29665a","source":"wordfence","cve":"CVE-2026-22386","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5274ebf-3907-42bd-9c6b-731e0d29665a?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-10-29T13:04:00Z","updated":"2026-11-03T19:51:59Z"},{"id":"wordfence:d52983d1-7da4-44e6-bfed-75107b923267","source":"wordfence","cve":"CVE-2012-5318","title":"Kish Guest Posting <= 1.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52983d1-7da4-44e6-bfed-75107b923267?source=api-prod","affected":[{"type":"plugin","slug":"kish-guest-posting","name":"Kish Guest Posting","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2012-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d52a1c67-e20d-4390-9d07-94337a31d193","source":"wordfence","cve":"CVE-2025-12081","title":"ACF Photo Gallery Field <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52a1c67-e20d-4390-9d07-94337a31d193?source=api-prod","affected":[{"type":"plugin","slug":"navz-photo-gallery","name":"ACF Photo Gallery Field","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-02-18T14:58:38Z","updated":"2026-02-19T03:25:19Z"},{"id":"wordfence:d52cdc45-efea-46b5-9004-f3169e807747","source":"wordfence","cve":"CVE-2020-15299","title":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme <= 2.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52cdc45-efea-46b5-9004-f3169e807747?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2020-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d52d3291-838a-4b23-b969-8c6273faec1e","source":"wordfence","cve":"","title":"Product Filter For WooCommerce Product <= 1.3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52d3291-838a-4b23-b969-8c6273faec1e?source=api-prod","affected":[{"type":"plugin","slug":"product-filter-for-woocommerce-product","name":"Product Filter For WooCommerce Product","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2022-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d52e644b-a58f-4e09-9e53-e9cbef75e34f","source":"wordfence","cve":"CVE-2025-2933","title":"Email Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52e644b-a58f-4e09-9e53-e9cbef75e34f?source=api-prod","affected":[{"type":"plugin","slug":"wp-update-mail-notification","name":"Email Notifications for Updates","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-04-04T13:05:55Z","updated":"2025-04-22T19:10:37Z"},{"id":"wordfence:d52ec5ce-b193-4908-8927-44592d1a2f3d","source":"wordfence","cve":"CVE-2026-42753","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52ec5ce-b193-4908-8927-44592d1a2f3d?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.11.10","to_inclusive":true,"patched_in":"2.11.11"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-01T16:19:17Z"},{"id":"wordfence:d52f601b-6a80-4b6f-895b-fcbbdf73103a","source":"wordfence","cve":"CVE-2021-4436","title":"3DPrint Lite < 1.9.1.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52f601b-6a80-4b6f-895b-fcbbdf73103a?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"1.9.1.5","to_inclusive":false,"patched_in":"1.9.1.5"}],"published":"2021-09-23T00:00:00Z","updated":"2024-02-06T00:56:37Z"},{"id":"wordfence:d52f6779-efb3-42ed-95b0-c950b51c96f3","source":"wordfence","cve":"CVE-2025-47666","title":"Image&Video FullScreen Background <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d52f6779-efb3-42ed-95b0-c950b51c96f3?source=api-prod","affected":[{"type":"plugin","slug":"lbg_fullscreen_fullwidth_slider","name":"Image&Video FullScreen Background","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:22:37Z"},{"id":"wordfence:d53069a3-5b8e-4ee1-b4da-97ff8f58ab03","source":"wordfence","cve":"","title":"Code Styling Localization <= 1.99.19 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d53069a3-5b8e-4ee1-b4da-97ff8f58ab03?source=api-prod","affected":[{"type":"plugin","slug":"codestyling-localization","name":"Codestyling Localization","from":"*","from_inclusive":true,"to":"1.99.19","to_inclusive":true,"patched_in":"1.99.20"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d53161ad-cc5f-4433-b288-a8095cdfd7db","source":"wordfence","cve":"CVE-2023-2435","title":"Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Local File Inclusion via Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d53161ad-cc5f-4433-b288-a8095cdfd7db?source=api-prod","affected":[{"type":"plugin","slug":"blog-in-blog","name":"Blog-in-Blog","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-05-30T00:00:00Z","updated":"2026-02-03T19:10:06Z"},{"id":"wordfence:d534feae-d1b7-4544-b1c5-c23f37dd5bab","source":"wordfence","cve":"CVE-2025-12981","title":"Listee <= 1.1.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d534feae-d1b7-4544-b1c5-c23f37dd5bab?source=api-prod","affected":[{"type":"theme","slug":"listee","name":"Listee","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2026-02-26T17:48:51Z","updated":"2026-02-27T06:43:49Z"},{"id":"wordfence:d535c069-cfa3-4c41-9a01-b4c4e7c75764","source":"wordfence","cve":"CVE-2022-25858","title":"Terser < 4.8.1 and 5.0.0-5.14.1 - Regular Expression Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-1333","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d535c069-cfa3-4c41-9a01-b4c4e7c75764?source=api-prod","affected":[{"type":"plugin","slug":"publisher-media-kit","name":"Publisher Media Kit","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"},{"type":"plugin","slug":"retro-winamp-block","name":"Retro Winamp Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"maps-block-apple","name":"Block for Apple Maps","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"autoshare-for-twitter","name":"Autopost for X (formerly Autoshare for Twitter)","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d535eb0e-28df-46f3-8958-22701f9f15e7","source":"wordfence","cve":"CVE-2025-30802","title":"Our Team Members <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d535eb0e-28df-46f3-8958-22701f9f15e7?source=api-prod","affected":[{"type":"plugin","slug":"our-team-members","name":"Team Members Profile \u2013 Employee Directory & Staff Showcase","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:24:33Z"},{"id":"wordfence:d536d3a8-9ac5-4ea9-8c65-16ad8b3a7106","source":"wordfence","cve":"CVE-2023-41236","title":"Happy Elementor Addons Pro <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d536d3a8-9ac5-4ea9-8c65-16ad8b3a7106?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons-pro","name":"Happy Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2023-08-29T00:00:00Z","updated":"2024-10-03T13:58:38Z"},{"id":"wordfence:d5396344-abb6-4ab5-9974-8ccbe8ca5842","source":"wordfence","cve":"CVE-2025-49948","title":"Super Edit <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5396344-abb6-4ab5-9974-8ccbe8ca5842?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-edit","name":"WP Super Edit","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-07-09T00:00:00Z","updated":"2025-10-29T21:04:28Z"},{"id":"wordfence:d539a066-6b59-4235-868e-f3085436e9f4","source":"wordfence","cve":"CVE-2024-9382","title":"Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d539a066-6b59-4235-868e-f3085436e9f4?source=api-prod","affected":[{"type":"plugin","slug":"gantry","name":"Gantry 4 Framework","from":"*","from_inclusive":true,"to":"4.1.21","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:42:49Z","updated":"2024-10-18T04:32:56Z"},{"id":"wordfence:d539dc3f-ebb9-40d6-9016-7d52935e2575","source":"wordfence","cve":"CVE-2025-47508","title":"GamiPress <= 7.3.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d539dc3f-ebb9-40d6-9016-7d52935e2575?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.3.7","to_inclusive":true,"patched_in":"7.3.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:43:28Z"},{"id":"wordfence:d53c16c6-9a67-4bfa-a993-4b391d24be23","source":"wordfence","cve":"CVE-2025-32532","title":"UXsniff <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d53c16c6-9a67-4bfa-a993-4b391d24be23?source=api-prod","affected":[{"type":"plugin","slug":"ux-sniff","name":"UXsniff AI-powered Heatmaps and Session Recordings","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-18T13:39:46Z"},{"id":"wordfence:d5400ec0-383b-4ac5-9b38-44533519e44d","source":"wordfence","cve":"CVE-2021-24384","title":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more <= 5.1.7 - Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5400ec0-383b-4ac5-9b38-44533519e44d?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":false,"patched_in":"5.1.8"}],"published":"2021-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d541f86a-744e-498e-bfab-b1a917c6ac49","source":"wordfence","cve":"CVE-2014-4523","title":"Easy Career Opening <= 0.4 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d541f86a-744e-498e-bfab-b1a917c6ac49?source=api-prod","affected":[{"type":"plugin","slug":"easy-career-openings","name":"Easy Career Openings","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d542c1e8-7e9f-4687-8739-0ebcb865b998","source":"wordfence","cve":"CVE-2022-47596","title":"Media Library Categories <= 1.9.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d542c1e8-7e9f-4687-8739-0ebcb865b998?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-library-categories","name":"Media Library Categories","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d549aac0-c2df-45c6-ac00-f2949ba4ec1a","source":"wordfence","cve":"CVE-2026-94499","title":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.12.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d549aac0-c2df-45c6-ac00-f2949ba4ec1a?source=api-prod","affected":[{"type":"plugin","slug":"formgent","name":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"1.12.3"}],"published":"2026-09-29T08:19:51Z","updated":"2026-10-09T00:08:14Z"},{"id":"wordfence:d549fcd5-6808-4d7d-bf1f-df8cfa458744","source":"wordfence","cve":"","title":"Bulk Order Form for WooCommerce <= 3.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d549fcd5-6808-4d7d-bf1f-df8cfa458744?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bulk-order-form","name":"Bulk Order Form for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d54a5549-5807-4ddc-a538-56ad384f14dc","source":"wordfence","cve":"CVE-2026-104676","title":"Zion Builder \u2013 Website Builder for Speed & Creativity <= 3.6.17 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d54a5549-5807-4ddc-a538-56ad384f14dc?source=api-prod","affected":[{"type":"plugin","slug":"zionbuilder","name":"Zion Builder \u2013 Website Builder for Speed & Creativity","from":"*","from_inclusive":true,"to":"3.6.17","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T00:00:00Z","updated":"2026-11-11T16:08:52Z"},{"id":"wordfence:d54aed9a-d184-44e7-b1b6-465f288ca8de","source":"wordfence","cve":"CVE-2025-27349","title":"Get Posts <= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d54aed9a-d184-44e7-b1b6-465f288ca8de?source=api-prod","affected":[{"type":"plugin","slug":"nurelm-get-posts","name":"Get Posts","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:12:36Z"},{"id":"wordfence:d54b4dc9-8590-433c-873a-efb49e2e79cd","source":"wordfence","cve":"CVE-2020-36753","title":"Hueman <= 3.6.3 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d54b4dc9-8590-433c-873a-efb49e2e79cd?source=api-prod","affected":[{"type":"theme","slug":"hueman","name":"Hueman","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2020-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d54c7623-25af-4bf1-a6e0-9022ec26f391","source":"wordfence","cve":"CVE-2024-3162","title":"Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d54c7623-25af-4bf1-a6e0-9022ec26f391?source=api-prod","affected":[{"type":"plugin","slug":"jeg-elementor-kit","name":"Jeg Kit for Elementor \u2013 Powerful Addons for Elementor, Widgets & Templates for WordPress","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-04-02T00:00:00Z","updated":"2024-04-29T15:53:20Z"},{"id":"wordfence:d5502ebc-0b35-4966-bff6-90efdcb0db58","source":"wordfence","cve":"CVE-2023-3365","title":"MultiParcels Shipping For WooCommerce <= 1.14.13 - Missing Authorization via get_history","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5502ebc-0b35-4966-bff6-90efdcb0db58?source=api-prod","affected":[{"type":"plugin","slug":"multiparcels-shipping-for-woocommerce","name":"NOPARCELS / MultiParcels Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.14.13","to_inclusive":true,"patched_in":"1.14.14"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d55033fb-17a6-4b8d-87f4-1c102ef7dbcd","source":"wordfence","cve":"CVE-2019-14790","title":"Limb Gallery \u2013 Create Beautiful Image & Video Galleries <= 1.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55033fb-17a6-4b8d-87f4-1c102ef7dbcd?source=api-prod","affected":[{"type":"plugin","slug":"limb-gallery","name":"Limb Gallery | Create Beautiful Image & Video Galleries","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2019-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5522065-bc52-445a-a242-31a05dd95124","source":"wordfence","cve":"CVE-2025-52790","title":"WP-DownloadCounter <= 1.01 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5522065-bc52-445a-a242-31a05dd95124?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadcounter","name":"WP-DownloadCounter","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T16:01:36Z"},{"id":"wordfence:d553aab2-d441-46d6-9c01-5dcfdc48674f","source":"wordfence","cve":"CVE-2025-1262","title":"Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d553aab2-d441-46d6-9c01-5dcfdc48674f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-google-recaptcha","name":"Advanced Google reCAPTCHA","from":"*","from_inclusive":true,"to":"1.27","to_inclusive":true,"patched_in":"1.28"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T12:41:29Z"},{"id":"wordfence:d554874d-a681-4355-845c-5df8d66825fb","source":"wordfence","cve":"CVE-2025-63013","title":"Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d554874d-a681-4355-845c-5df8d66825fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-11-05T00:00:00Z","updated":"2026-01-27T20:57:16Z"},{"id":"wordfence:d554cfa3-06b4-4704-84c9-d336301af6c8","source":"wordfence","cve":"CVE-2026-87840","title":"Tripzzy <= 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d554cfa3-06b4-4704-84c9-d336301af6c8?source=api-prod","affected":[{"type":"plugin","slug":"tripzzy","name":"Tripzzy \u2013 Travel Engine System","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:45:27Z"},{"id":"wordfence:d556e65f-da13-4880-84d6-0b881be7c407","source":"wordfence","cve":"CVE-2024-51818","title":"Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d556e65f-da13-4880-84d6-0b881be7c407?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2025-01-03T00:00:00Z","updated":"2025-12-04T20:35:54Z"},{"id":"wordfence:d55737a5-8aa5-4c26-bbb5-bbc5ea8be8d1","source":"wordfence","cve":"CVE-2025-3421","title":"Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55737a5-8aa5-4c26-bbb5-bbc5ea8be8d1?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-11T14:31:08Z"},{"id":"wordfence:d557ccb4-99c3-4286-91cd-87576a95f179","source":"wordfence","cve":"","title":"Repagent (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d557ccb4-99c3-4286-91cd-87576a95f179?source=api-prod","affected":[{"type":"theme","slug":"repagent","name":"repagent","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d557db81-9689-4fc1-b749-3595859048de","source":"wordfence","cve":"CVE-2022-44741","title":"Testimonial Slider <= 1.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d557db81-9689-4fc1-b749-3595859048de?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider","name":"Testimonial Slider","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5599101-a7bd-4aa7-91da-f11694bdc000","source":"wordfence","cve":"CVE-2026-4268","title":"WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5599101-a7bd-4aa7-91da-f11694bdc000?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.0.05","to_inclusive":true,"patched_in":"10.0.06"}],"published":"2026-03-17T13:24:29Z","updated":"2026-03-18T01:24:48Z"},{"id":"wordfence:d559b862-ee07-4207-8c64-81961516a046","source":"wordfence","cve":"CVE-2024-2253","title":"Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d559b862-ee07-4207-8c64-81961516a046?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-carousel-elementor","name":"Testimonial Carousel For Elementor","from":"*","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":"10.2.3"}],"published":"2024-05-29T00:00:00Z","updated":"2024-06-06T12:38:09Z"},{"id":"wordfence:d55b210f-bbed-4206-a109-99f217a2eb67","source":"wordfence","cve":"CVE-2024-27995","title":"ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55b210f-bbed-4206-a109-99f217a2eb67?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.23","to_inclusive":true,"patched_in":"4.0.24"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T18:50:30Z"},{"id":"wordfence:d55bab2a-5e2e-440e-b4fa-03853679ba22","source":"wordfence","cve":"CVE-2024-0838","title":"Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55bab2a-5e2e-440e-b4fa-03853679ba22?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2024-02-13T00:00:00Z","updated":"2024-05-31T15:30:56Z"},{"id":"wordfence:d55c832b-f558-4e8a-8301-33dd38d39ef1","source":"wordfence","cve":"CVE-2024-0667","title":"Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute","severity":"medium","cvss":5.4,"cwe":"CWE-1078","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55c832b-f558-4e8a-8301-33dd38d39ef1?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.21","to_inclusive":true,"patched_in":"1.15.22"}],"published":"2024-01-26T00:00:00Z","updated":"2024-07-29T21:37:32Z"},{"id":"wordfence:d55e8e36-d0f3-4c1f-a6b6-d105e19bb4da","source":"wordfence","cve":"CVE-2026-62039","title":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55e8e36-d0f3-4c1f-a6b6-d105e19bb4da?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:26:53Z"},{"id":"wordfence:d55f10f3-5484-4b90-80da-3d91f409fe04","source":"wordfence","cve":"CVE-2023-27437","title":"Event Espresso 4 Decaf <= 4.10.44.decaf - Feature Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-354","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d55f10f3-5484-4b90-80da-3d91f409fe04?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-decaf","name":"Event Espresso \u2013 Event Registration & Ticketing Sales","from":"*","from_inclusive":true,"to":"4.10.44.decaf","to_inclusive":true,"patched_in":"4.10.45.decaf"}],"published":"2023-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d560f28f-899c-44cf-8640-55647c1de7dc","source":"wordfence","cve":"CVE-2024-6321","title":"ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d560f28f-899c-44cf-8640-55647c1de7dc?source=api-prod","affected":[{"type":"plugin","slug":"scrollto-bottom","name":"ScrollTo Bottom","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:48Z"},{"id":"wordfence:d5631826-6975-41e9-a896-f2aa0581334f","source":"wordfence","cve":"CVE-2024-7560","title":"News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5631826-6975-41e9-a896-f2aa0581334f?source=api-prod","affected":[{"type":"theme","slug":"news-flash","name":"News Flash","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-07T13:00:55Z","updated":"2024-08-08T01:50:33Z"},{"id":"wordfence:d5653ebe-7145-4b1c-94f8-ca87ed0dc4f5","source":"wordfence","cve":"CVE-2026-0868","title":"EMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5653ebe-7145-4b1c-94f8-ca87ed0dc4f5?source=api-prod","affected":[{"type":"plugin","slug":"embed-calendly-scheduling","name":"EMC \u2013 Embed Calendly Scheduling With Ease","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2026-04-18T15:07:18Z","updated":"2026-04-19T03:26:14Z"},{"id":"wordfence:d5688bb7-cd2d-42c6-b8cf-d908448ccfc1","source":"wordfence","cve":"CVE-2023-32509","title":"Order Your Posts Manually <= 2.2.5 - Reflected Cross-Site Scripting via 'cat_id'","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5688bb7-cd2d-42c6-b8cf-d908448ccfc1?source=api-prod","affected":[{"type":"plugin","slug":"order-your-posts-manually","name":"Order Your Posts Manually","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d56aaa20-f40c-4f99-bc38-0b14fa39a175","source":"wordfence","cve":"CVE-2023-34384","title":"Kebo Twitter Feed <= 1.5.12 - Cross-Site Request Forgery via kebo_twitter_menu_render","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d56aaa20-f40c-4f99-bc38-0b14fa39a175?source=api-prod","affected":[{"type":"plugin","slug":"kebo-twitter-feed","name":"Kebo Twitter Feed","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":""}],"published":"2023-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d56ce525-c6af-42ac-9c74-ffce65dda2ae","source":"wordfence","cve":"CVE-2025-66095","title":"KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d56ce525-c6af-42ac-9c74-ffce65dda2ae?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.13","to_inclusive":true,"patched_in":"3.6.14"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-01T17:13:33Z"},{"id":"wordfence:d56cfeb1-1257-4f6b-b889-d9f5839ce60d","source":"wordfence","cve":"CVE-2025-49256","title":"Sapa <= 1.1.14 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d56cfeb1-1257-4f6b-b889-d9f5839ce60d?source=api-prod","affected":[{"type":"theme","slug":"sapa","name":"Sapa - Product Landing Page WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:34:59Z"},{"id":"wordfence:d56e8a6f-f6fb-4a34-becc-f1b7abed02ca","source":"wordfence","cve":"CVE-2026-57403","title":"GD Security Headers <= 1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d56e8a6f-f6fb-4a34-becc-f1b7abed02ca?source=api-prod","affected":[{"type":"plugin","slug":"gd-security-headers","name":"GD Security Headers","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:43:16Z"},{"id":"wordfence:d570009f-0011-485a-bd14-f511cb2b60d7","source":"wordfence","cve":"CVE-2015-9494","title":"Post Kinds < 1.3.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d570009f-0011-485a-bd14-f511cb2b60d7?source=api-prod","affected":[{"type":"plugin","slug":"indieweb-post-kinds","name":"Post Kinds","from":"*","from_inclusive":true,"to":"1.3.1.1","to_inclusive":false,"patched_in":"1.3.1.1"}],"published":"2015-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d571e741-6d72-47fe-8eb0-8a75c173f626","source":"wordfence","cve":"CVE-2024-56071","title":"Simple Dashboard <= 2.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d571e741-6d72-47fe-8eb0-8a75c173f626?source=api-prod","affected":[{"type":"plugin","slug":"simple-dashboard","name":"Simple Dashboard","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T16:20:24Z"},{"id":"wordfence:d5744ed4-f150-48a6-9f5d-d49f9d4c8454","source":"wordfence","cve":"CVE-2021-24782","title":"Flex Local Fonts <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5744ed4-f150-48a6-9f5d-d49f9d4c8454?source=api-prod","affected":[{"type":"plugin","slug":"fsflex-local-fonts","name":"Flex Local Fonts","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d574ed8b-2887-4a56-9fca-914148095ba1","source":"wordfence","cve":"CVE-2023-2709","title":"AN_GradeBook <= 5.0.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d574ed8b-2887-4a56-9fca-914148095ba1?source=api-prod","affected":[{"type":"plugin","slug":"an-gradebook","name":"GradeBook","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d57816cb-1e73-4097-ae1d-7ae2879a4c5c","source":"wordfence","cve":"CVE-2026-82845","title":"Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57816cb-1e73-4097-ae1d-7ae2879a4c5c?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T18:45:11Z"},{"id":"wordfence:d5786d8d-58a6-4dee-87cb-cad054a4cb90","source":"wordfence","cve":"CVE-2026-15237","title":"Hotel Booking Lite <= 6.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5786d8d-58a6-4dee-87cb-cad054a4cb90?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"6.2.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-09-18T14:27:49Z"},{"id":"wordfence:d57af81e-ef63-44ec-a1f6-dd1b5b627ec4","source":"wordfence","cve":"CVE-2026-97245","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 - Authenticated (Shop Worker+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57af81e-ef63-44ec-a1f6-dd1b5b627ec4?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:52:38Z"},{"id":"wordfence:d57b8c89-109c-4b3b-bea4-adfe7dbfb26d","source":"wordfence","cve":"CVE-2021-24817","title":"Ultimate NoFollow <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57b8c89-109c-4b3b-bea4-adfe7dbfb26d?source=api-prod","affected":[{"type":"plugin","slug":"nofollow","name":"Ultimate Nofollow","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d57be728-6adc-401f-be90-e28734f85d41","source":"wordfence","cve":"CVE-2026-104405","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57be728-6adc-401f-be90-e28734f85d41?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-05T10:38:47Z","updated":"2026-10-08T23:25:23Z"},{"id":"wordfence:d57c3934-61b9-419d-af11-65f5f26284e3","source":"wordfence","cve":"CVE-2025-10684","title":"Construction Light <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57c3934-61b9-419d-af11-65f5f26284e3?source=api-prod","affected":[{"type":"plugin","slug":"wp-record","name":"WP-Record","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-11-21T00:00:00Z","updated":"2025-12-19T20:24:29Z"},{"id":"wordfence:d57d3d3f-7669-420f-8d6b-e946edc7eda0","source":"wordfence","cve":"CVE-2025-49076","title":"The Plus Addons for Elementor Page Builder Lite <= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57d3d3f-7669-420f-8d6b-e946edc7eda0?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:44:48Z"},{"id":"wordfence:d57e11e8-de23-469e-9b96-3fc24b03bf98","source":"wordfence","cve":"CVE-2026-9696","title":"Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e11e8-de23-469e-9b96-3fc24b03bf98?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.58","to_inclusive":true,"patched_in":"3.3.59"}],"published":"2026-10-09T15:57:15Z","updated":"2026-10-10T04:26:48Z"},{"id":"wordfence:d57e4c3b-6e0d-40d5-bcf3-10af797d2f1b","source":"wordfence","cve":"CVE-2021-24792","title":"Shiny Buttons \u2013 CSS3 Button Generator for WordPress <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e4c3b-6e0d-40d5-bcf3-10af797d2f1b?source=api-prod","affected":[{"type":"plugin","slug":"shiny-buttons","name":"Shiny Buttons \u2013 CSS3 Button Generator for WordPress","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d57e6739-2cae-4755-8fdf-25b74dac6792","source":"wordfence","cve":"CVE-2026-32534","title":"JS Help Desk \u2013 AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57e6739-2cae-4755-8fdf-25b74dac6792?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:52:39Z"},{"id":"wordfence:d57fa9f3-b1c0-4601-96d9-178d0dba1332","source":"wordfence","cve":"CVE-2024-12327","title":"LazyLoad Background Images <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d57fa9f3-b1c0-4601-96d9-178d0dba1332?source=api-prod","affected":[{"type":"plugin","slug":"lazyload-background-images","name":"LazyLoad Background Images","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:40:07Z","updated":"2025-01-07T04:22:23Z"},{"id":"wordfence:d5810757-1866-4788-809f-2c68e16a5156","source":"wordfence","cve":"CVE-2025-0353","title":"Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5810757-1866-4788-809f-2c68e16a5156?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-divi","name":"Divi Torque Lite","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-01-28T22:09:17Z","updated":"2025-01-29T11:10:04Z"},{"id":"wordfence:d5848d3a-d6a8-4e56-9012-9d600a3cf7fa","source":"wordfence","cve":"CVE-2021-24274","title":"Ultimate Maps by Supsystic <= 1.2.4 - Reflected Cross-Site scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5848d3a-d6a8-4e56-9012-9d600a3cf7fa?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2021-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d58490a9-c48f-4693-8e42-70486563a731","source":"wordfence","cve":"CVE-2026-65505","title":"Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58490a9-c48f-4693-8e42-70486563a731?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:42:45Z"},{"id":"wordfence:d586e455-c73f-4916-a926-4d53699bb434","source":"wordfence","cve":"CVE-2023-6495","title":"YARPP \u2013 Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d586e455-c73f-4916-a926-4d53699bb434?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.9","to_inclusive":true,"patched_in":"5.30.10"}],"published":"2024-06-18T00:00:00Z","updated":"2024-07-29T21:37:33Z"},{"id":"wordfence:d586f258-ddd4-48a1-9c7a-2d1b343b0d23","source":"wordfence","cve":"CVE-2014-8087","title":"post highlights 2.0 - 2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d586f258-ddd4-48a1-9c7a-2d1b343b0d23?source=api-prod","affected":[{"type":"plugin","slug":"post-highlights","name":"post highlights","from":"2.0","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2014-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d588a33a-ba2d-4201-9171-97abb16d44c1","source":"wordfence","cve":"CVE-2026-39785","title":"Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d588a33a-ba2d-4201-9171-97abb16d44c1?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"1.25.1","to_inclusive":true,"patched_in":"1.25.2"}],"published":"2026-10-05T16:41:56Z","updated":"2026-10-28T21:17:29Z"},{"id":"wordfence:d589915b-ff3a-4142-ae1e-6626440b69f3","source":"wordfence","cve":"CVE-2026-123183","title":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0 <= 2.1.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d589915b-ff3a-4142-ae1e-6626440b69f3?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:19:59Z"},{"id":"wordfence:d589bada-3568-45ed-9f7c-fb14363a617a","source":"wordfence","cve":"","title":"MainWP (Various extensions) - Missing Authorization to Arbitrary Page/Post Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d589bada-3568-45ed-9f7c-fb14363a617a?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-article-uploader-extension","name":"MainWP Article Uploader Extension","from":"4.0.2","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"},{"type":"plugin","slug":"boilerplate-extension","name":"MainWP Boilerplate Extension","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d58ca75a-f425-477d-8e48-a5d600543578","source":"wordfence","cve":"CVE-2023-44233","title":"FooGallery <= 2.2.44 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58ca75a-f425-477d-8e48-a5d600543578?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.2.44","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d58db3d7-65a4-4363-aa36-c6a3089be76d","source":"wordfence","cve":"CVE-2024-11184","title":"WP Enabled SVG <= 0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58db3d7-65a4-4363-aa36-c6a3089be76d?source=api-prod","affected":[{"type":"plugin","slug":"wp-enable-svg","name":"WP Enabled SVG","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-20T16:39:49Z"},{"id":"wordfence:d58e4317-8ad5-40d5-98b8-f8f07ab37e1f","source":"wordfence","cve":"CVE-2022-43450","title":"Stream <= 3.9.2 - Missing Authorization via load_alerts_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58e4317-8ad5-40d5-98b8-f8f07ab37e1f?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":false,"patched_in":"3.9.3"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d58fd503-84d0-4d62-9290-870b1dd32be7","source":"wordfence","cve":"CVE-2023-3408","title":"Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fd503-84d0-4d62-9290-870b1dd32be7?source=api-prod","affected":[{"type":"theme","slug":"bricks","name":"Bricks","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-17T08:37:24Z"},{"id":"wordfence:d58fd738-44a5-4f92-b9de-8213fc4d2db0","source":"wordfence","cve":"CVE-2026-28151","title":"Tonda - Elegant Shop WordPress Theme < 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fd738-44a5-4f92-b9de-8213fc4d2db0?source=api-prod","affected":[{"type":"theme","slug":"tonda","name":"Tonda - Elegant Shop WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:03:17Z"},{"id":"wordfence:d58fe116-0896-46b5-a120-d0fde9680ff1","source":"wordfence","cve":"CVE-2026-49773","title":"FV Flowplayer Video Player < 7.5.51.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d58fe116-0896-46b5-a120-d0fde9680ff1?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.51.7212","to_inclusive":false,"patched_in":"7.5.51.7212"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-08T14:30:09Z"},{"id":"wordfence:d590e730-ad5f-4046-b897-c3b8aed250b3","source":"wordfence","cve":"CVE-2026-24373","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d590e730-ad5f-4046-b897-c3b8aed250b3?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.1","to_inclusive":true,"patched_in":"6.0.7.2"}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:55:41Z"},{"id":"wordfence:d592141d-191b-4739-bc0a-07549ef2f31b","source":"wordfence","cve":"CVE-2024-13691","title":"Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia","severity":"medium","cvss":6.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d592141d-191b-4739-bc0a-07549ef2f31b?source=api-prod","affected":[{"type":"theme","slug":"uncode","name":"Uncode","from":"*","from_inclusive":true,"to":"2.9.1.6","to_inclusive":true,"patched_in":"2.9.1.7"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:21Z"},{"id":"wordfence:d592b81d-48c7-4b48-948d-f2b98719fdfc","source":"wordfence","cve":"","title":"Minimal Coming Soon \u2013 Coming Soon Page <= 2.33 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d592b81d-48c7-4b48-948d-f2b98719fdfc?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.33","to_inclusive":true,"patched_in":"2.35"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5947859-df78-475b-89b4-ad2441d9cf63","source":"wordfence","cve":"CVE-2021-24921","title":"Advanced Database Cleaner <= 3.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5947859-df78-475b-89b4-ad2441d9cf63?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":false,"patched_in":"3.0.4"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5971b4c-50c7-43e7-b562-5c18ffebaddc","source":"wordfence","cve":"CVE-2026-18960","title":"Block User Account <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Account Block Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5971b4c-50c7-43e7-b562-5c18ffebaddc?source=api-prod","affected":[{"type":"plugin","slug":"block-user-account","name":"Belaka \u2013 Block User Account","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-21T15:35:05Z"},{"id":"wordfence:d598e3c7-54ef-4650-abf9-70cb66713d08","source":"wordfence","cve":"CVE-2026-28111","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d598e3c7-54ef-4650-abf9-70cb66713d08?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.56.0","to_inclusive":true,"patched_in":"1.56.0.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-14T12:53:03Z"},{"id":"wordfence:d59a4d69-cf51-44c1-90bf-19be04774c27","source":"wordfence","cve":"CVE-2024-11826","title":"Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d59a4d69-cf51-44c1-90bf-19be04774c27?source=api-prod","affected":[{"type":"plugin","slug":"quillforms","name":"Quill Forms | Conversational Multi Step Forms, Surveys & quizzes","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-07T11:11:14Z"},{"id":"wordfence:d59c68c6-e09a-4e72-b0b6-af96db1c1b12","source":"wordfence","cve":"CVE-2026-103310","title":"PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d59c68c6-e09a-4e72-b0b6-af96db1c1b12?source=api-prod","affected":[{"type":"plugin","slug":"payhere-payment-gateway","name":"PayHere Payment Gateway","from":"2.4.0","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:20:19Z"},{"id":"wordfence:d59ea96f-ad02-4189-8155-7de7de5556ba","source":"wordfence","cve":"CVE-2024-11418","title":"Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d59ea96f-ad02-4189-8155-7de7de5556ba?source=api-prod","affected":[{"type":"plugin","slug":"additional-order-filters-for-woocommerce","name":"Additional Order Filters for WooCommerce","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2024-11-25T15:28:38Z","updated":"2024-11-26T03:36:26Z"},{"id":"wordfence:d5a0483c-e7f9-4304-8997-e590023780e8","source":"wordfence","cve":"CVE-2025-31376","title":"NanoSupport <= 0.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a0483c-e7f9-4304-8997-e590023780e8?source=api-prod","affected":[{"type":"plugin","slug":"nanosupport","name":"NanoSupport \u2014 Support Ticketing & Knowledgebase for WordPress","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:56:22Z"},{"id":"wordfence:d5a0c514-5200-47f4-9d2e-684d68946b9a","source":"wordfence","cve":"CVE-2024-10932","title":"Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a0c514-5200-47f4-9d2e-684d68946b9a?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.6.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-04T07:24:24Z"},{"id":"wordfence:d5a124b3-257b-4331-ac8f-eecd7a759127","source":"wordfence","cve":"CVE-2022-47435","title":"WP-OliveCart <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a124b3-257b-4331-ac8f-eecd7a759127?source=api-prod","affected":[{"type":"plugin","slug":"wp-olivecart","name":"WP-OliveCart","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5a135cf-99b6-4e9e-b66a-1b547501ce9f","source":"wordfence","cve":"CVE-2025-62152","title":"ConveyThis <= 269.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a135cf-99b6-4e9e-b66a-1b547501ce9f?source=api-prod","affected":[{"type":"plugin","slug":"conveythis-translate","name":"ConveyThis AI Multilingual Translation","from":"*","from_inclusive":true,"to":"269.2","to_inclusive":true,"patched_in":"269.3"}],"published":"2025-11-29T00:00:00Z","updated":"2026-02-26T15:21:38Z"},{"id":"wordfence:d5a3a560-08e6-43b7-b953-4e704eafc49b","source":"wordfence","cve":"CVE-2026-12135","title":"FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a3a560-08e6-43b7-b953-4e704eafc49b?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.51.7212","to_inclusive":true,"patched_in":"7.5.52.7212"}],"published":"2026-06-30T15:07:51Z","updated":"2026-07-01T03:43:38Z"},{"id":"wordfence:d5a3b416-4434-456e-91c7-24f874e8f959","source":"wordfence","cve":"CVE-2024-48022","title":"Shortcode For Elementor Templates <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a3b416-4434-456e-91c7-24f874e8f959?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-support-for-elementor-templates","name":"Shortcode For Elementor Templates","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-08T00:00:00Z","updated":"2024-10-16T12:36:45Z"},{"id":"wordfence:d5a49269-63de-413a-a16e-8bd1916c0151","source":"wordfence","cve":"CVE-2025-31878","title":"UPC/EAN/GTIN Code Generator <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a49269-63de-413a-a16e-8bd1916c0151?source=api-prod","affected":[{"type":"plugin","slug":"upc-ean-barcode-generator","name":"UPC/EAN/GTIN Barcode Generator/Importer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-08-11T14:07:55Z"},{"id":"wordfence:d5a4bfee-5e20-4898-aea2-c7e86718ccca","source":"wordfence","cve":"CVE-2024-34805","title":"iframe <= 5.0 - Authenticated (Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a4bfee-5e20-4898-aea2-c7e86718ccca?source=api-prod","affected":[{"type":"plugin","slug":"iframe","name":"iframe","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-22T13:10:27Z"},{"id":"wordfence:d5a4e980-afb7-416d-baa6-b8a25c5502b1","source":"wordfence","cve":"CVE-2026-24570","title":"Edwiser Bridge <= 4.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a4e980-afb7-416d-baa6-b8a25c5502b1?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-01-21T00:00:00Z","updated":"2026-02-24T18:41:19Z"},{"id":"wordfence:d5a51c22-c4ca-4897-ad7e-c5df00b07fe0","source":"wordfence","cve":"CVE-2026-12127","title":"WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name","severity":"medium","cvss":5.3,"cwe":"CWE-93","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a51c22-c4ca-4897-ad7e-c5df00b07fe0?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.2.1"}],"published":"2026-06-30T16:02:50Z","updated":"2026-07-01T04:32:27Z"},{"id":"wordfence:d5a6e9f4-dbc3-4af0-b9e4-4c9ad7b5fe9f","source":"wordfence","cve":"CVE-2023-25966","title":"Filebird <= 5.1.4 - Missing Authorization via resAdminPermissionsCheck","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a6e9f4-dbc3-4af0-b9e4-4c9ad7b5fe9f?source=api-prod","affected":[{"type":"plugin","slug":"filebird","name":"FileBird \u2013 WordPress Media Library Folders & File Manager","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5ab090c-14fd-4d58-a915-fd68e5eaefe1","source":"wordfence","cve":"CVE-2012-1010","title":"AllWebMenus WordPress Menu Plugin < 1.1.9 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5ab090c-14fd-4d58-a915-fd68e5eaefe1?source=api-prod","affected":[{"type":"plugin","slug":"allwebmenus-wordpress-menu-plugin","name":"AllWebMenus WordPress Menu Plugin","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"}],"published":"2012-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5abb538-9e69-485e-9389-90a2422510ca","source":"wordfence","cve":"CVE-2023-32110","title":"JupiterX Theme <= 3.0.0  - Authenticated Local File Inclusion via print_pane","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5abb538-9e69-485e-9389-90a2422510ca?source=api-prod","affected":[{"type":"theme","slug":"jupiterx","name":"JupiterX","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5b110a5-4027-4c98-a348-325c8b9c8405","source":"wordfence","cve":"CVE-2024-33549","title":"WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b110a5-4027-4c98-a348-325c8b9c8405?source=api-prod","affected":[{"type":"plugin","slug":"woozone","name":"WooCommerce Amazon Affiliates - Wordpress Plugin","from":"*","from_inclusive":true,"to":"14.1.00","to_inclusive":false,"patched_in":"14.1.00"}],"published":"2024-04-25T00:00:00Z","updated":"2026-02-26T14:57:00Z"},{"id":"wordfence:d5b573e2-373f-41bc-8d9a-ea42e908ac4e","source":"wordfence","cve":"CVE-2023-46638","title":"WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b573e2-373f-41bc-8d9a-ea42e908ac4e?source=api-prod","affected":[{"type":"plugin","slug":"wcp-openweather","name":"WCP OpenWeather","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5b5eb2a-4a6a-4a58-93ec-c83a573b8a86","source":"wordfence","cve":"CVE-2025-30770","title":"Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b5eb2a-4a6a-4a58-93ec-c83a573b8a86?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.4.7","to_inclusive":true,"patched_in":"1.8.4.8"}],"published":"2025-03-26T00:00:00Z","updated":"2025-04-02T15:28:21Z"},{"id":"wordfence:d5b695d7-c690-4748-b218-5699d1aa63bf","source":"wordfence","cve":"CVE-2026-1306","title":"midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b695d7-c690-4748-b218-5699d1aa63bf?source=api-prod","affected":[{"type":"plugin","slug":"midi-synth","name":"midi-Synth","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-02-13T18:33:05Z","updated":"2026-03-06T11:59:42Z"},{"id":"wordfence:d5b74a84-e418-4bd4-b36e-5bd4ba5197c9","source":"wordfence","cve":"CVE-2024-39658","title":"Salon booking system <= 10.7 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b74a84-e418-4bd4-b36e-5bd4ba5197c9?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.7","to_inclusive":true,"patched_in":"10.8"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T15:13:03Z"},{"id":"wordfence:d5b89ef5-2bf1-4fc0-9127-5c2a18c96caa","source":"wordfence","cve":"CVE-2025-24642","title":"Setup Default Featured Image <= 1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5b89ef5-2bf1-4fc0-9127-5c2a18c96caa?source=api-prod","affected":[{"type":"plugin","slug":"setup-default-feature-image","name":"Set Default Featured Image \u2013 Auto Fallback Thumbnail for Posts, Pages & CPT","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:05:50Z"},{"id":"wordfence:d5bf199d-5607-48d5-adcd-211ded2087d4","source":"wordfence","cve":"CVE-2025-31916","title":"JP Students Result Management System Premium  1.1.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf199d-5607-48d5-adcd-211ded2087d4?source=api-prod","affected":[{"type":"plugin","slug":"jp-students-result-system-premium","name":"JP Students Result Management System Premium","from":"1.1.7","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-28T15:15:19Z"},{"id":"wordfence:d5bf4972-424a-4470-a0bc-7dcc95378e0e","source":"wordfence","cve":"CVE-2024-2242","title":"Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-13T21:32:58Z"},{"id":"wordfence:d5c045e2-a6be-425f-a4f3-1e79badf738b","source":"wordfence","cve":"CVE-2026-15798","title":"Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c045e2-a6be-425f-a4f3-1e79badf738b?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.38","to_inclusive":true,"patched_in":"3.5.1.39"}],"published":"2026-08-27T13:39:55Z","updated":"2026-08-28T02:26:57Z"},{"id":"wordfence:d5c0c64c-7105-4bc3-b42d-89cfa44d02b9","source":"wordfence","cve":"CVE-2014-125134","title":"ChurcHope <= 2.1 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c0c64c-7105-4bc3-b42d-89cfa44d02b9?source=api-prod","affected":[{"type":"theme","slug":"churchope","name":"ChurcHope","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2014-12-07T00:00:00Z","updated":"2026-10-28T14:51:07Z"},{"id":"wordfence:d5c23952-3732-4316-aa43-ddab88a6ba79","source":"wordfence","cve":"CVE-2017-18530","title":"Rating by BestWebSoft < 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c23952-3732-4316-aa43-ddab88a6ba79?source=api-prod","affected":[{"type":"plugin","slug":"rating-bws","name":"Rating by BestWebSoft","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":false,"patched_in":"0.2"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5c29af7-f607-429a-9a1e-f8701fbb9e7a","source":"wordfence","cve":"CVE-2024-33927","title":"Giphypress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c29af7-f607-429a-9a1e-f8701fbb9e7a?source=api-prod","affected":[{"type":"plugin","slug":"giphypress","name":"Giphypress","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T13:55:26Z"},{"id":"wordfence:d5c3702c-65d3-4b89-a78f-6df267b02a1e","source":"wordfence","cve":"CVE-2026-93303","title":"HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c3702c-65d3-4b89-a78f-6df267b02a1e?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.10.1","to_inclusive":true,"patched_in":"2.10.2"}],"published":"2026-09-24T18:23:59Z","updated":"2026-09-25T06:39:56Z"},{"id":"wordfence:d5c48de7-20f6-408e-b4fb-f3d5d7ab272f","source":"wordfence","cve":"CVE-2025-8606","title":"GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation","severity":"low","cvss":2.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c48de7-20f6-408e-b4fb-f3d5d7ab272f?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-gravity-forms","name":"GSheetConnector \u2013 Gravity Forms Google Sheets Connector \u2013 Real-Time Sync","from":"*","from_inclusive":true,"to":"1.3.23","to_inclusive":true,"patched_in":"1.3.24"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T09:28:41Z"},{"id":"wordfence:d5c652be-ea24-4fbe-aa88-ea1f8814d34a","source":"wordfence","cve":"CVE-2026-39676","title":"Download Manager <= 3.3.52 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c652be-ea24-4fbe-aa88-ea1f8814d34a?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.52","to_inclusive":true,"patched_in":"3.3.53"}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-15T21:43:09Z"},{"id":"wordfence:d5c704f9-4fcb-455e-a1c7-f48d47b12dec","source":"wordfence","cve":"CVE-2023-33333","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via run_sync","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c704f9-4fcb-455e-a1c7-f48d47b12dec?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5c88ec9-f059-4f7e-975f-bc6e8f045191","source":"wordfence","cve":"CVE-2025-62089","title":"Mergado Pack <= 4.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c88ec9-f059-4f7e-975f-bc6e8f045191?source=api-prod","affected":[{"type":"plugin","slug":"mergado-marketing-pack","name":"Mergado Pack","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:22:33Z"},{"id":"wordfence:d5c9f08b-c02c-44e1-a8ae-3a2b1e06508a","source":"wordfence","cve":"CVE-2026-57648","title":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting <= 4.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5c9f08b-c02c-44e1-a8ae-3a2b1e06508a?source=api-prod","affected":[{"type":"plugin","slug":"nelio-content","name":"Nelio Content \u2013 Editorial Calendar & Social Media Auto-Posting","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:36:49Z"},{"id":"wordfence:d5cab96c-f6ab-4ee6-8453-22e8a39cc82f","source":"wordfence","cve":"CVE-2015-10093","title":"Mark User as Spammer <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5cab96c-f6ab-4ee6-8453-22e8a39cc82f?source=api-prod","affected":[{"type":"plugin","slug":"mark-user-as-spammer","name":"Mark User as Spammer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2015-04-22T00:00:00Z","updated":"2024-02-07T14:19:05Z"},{"id":"wordfence:d5cf5fd2-58c7-42d0-948f-95764647630b","source":"wordfence","cve":"CVE-2026-7792","title":"WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5cf5fd2-58c7-42d0-948f-95764647630b?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.10.0.4","to_inclusive":true,"patched_in":"1.10.0.5"}],"published":"2026-06-05T14:01:26Z","updated":"2026-06-06T02:28:37Z"},{"id":"wordfence:d5cfe324-ab86-454a-a016-5e3d0e4df936","source":"wordfence","cve":"CVE-2026-16604","title":"Passster \u2013 Password Protect Pages and Content < 4.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5cfe324-ab86-454a-a016-5e3d0e4df936?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":false,"patched_in":"4.3.6"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:20:31Z"},{"id":"wordfence:d5d0ccbd-a091-4897-a100-eac75ffa0e3b","source":"wordfence","cve":"CVE-2024-2286","title":"Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d0ccbd-a091-4897-a100-eac75ffa0e3b?source=api-prod","affected":[{"type":"plugin","slug":"sky-elementor-addons","name":"Sky Addons for Elementor \u2013 160+ Widgets, GSAP Animations, Templates & Theme Builder","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T15:27:18Z"},{"id":"wordfence:d5d12ecc-862f-4ecd-9c7b-25dc557abb8d","source":"wordfence","cve":"CVE-2024-54217","title":"ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d12ecc-862f-4ecd-9c7b-25dc557abb8d?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:50:54Z"},{"id":"wordfence:d5d23a02-11b6-4674-a13a-884de2d51ed7","source":"wordfence","cve":"CVE-2022-0591","title":"Formcraft3 <= 3.8.27 - Server Side Request Forgery","severity":"critical","cvss":9.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d23a02-11b6-4674-a13a-884de2d51ed7?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"3.8.28","to_inclusive":false,"patched_in":"3.8.28"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5d23fdc-081a-4228-897f-2470a9327887","source":"wordfence","cve":"","title":"WooCommerce AJAX Product Filters <= 1.3.6 - Arbitrary Settings Update","severity":"high","cvss":8.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d23fdc-081a-4228-897f-2470a9327887?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ajax-filters","name":"Advanced AJAX Product Filters","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2019-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5d2ff90-9817-490e-8162-ca4860b3ffe3","source":"wordfence","cve":"CVE-2024-37308","title":"Cooked \u2013 Recipe Management <= Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d2ff90-9817-490e-8162-ca4860b3ffe3?source=api-prod","affected":[{"type":"plugin","slug":"cooked","name":"Cooked \u2013 Recipe Management","from":"*","from_inclusive":true,"to":"1.7.15.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-18T15:40:22Z"},{"id":"wordfence:d5d3e333-4dcd-414b-85a6-8d9fbef357bd","source":"wordfence","cve":"","title":"SEO Friendly Images <= 3.0.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d3e333-4dcd-414b-85a6-8d9fbef357bd?source=api-prod","affected":[{"type":"plugin","slug":"seo-image","name":"SEO Friendly Images","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2015-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1","source":"wordfence","cve":"CVE-2024-2471","title":"FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d4aeb1-0a4f-49f1-b5a9-b582e271eae1?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T05:37:16Z"},{"id":"wordfence:d5d77105-19a8-40eb-8a9c-aa519a757a8d","source":"wordfence","cve":"CVE-2022-45368","title":"1003 Mortgage Application <= 1.75 - Authenticated (Subscriber+) Arbitrary File Download","severity":"high","cvss":7.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d77105-19a8-40eb-8a9c-aa519a757a8d?source=api-prod","affected":[{"type":"plugin","slug":"1003-mortgage-application","name":"1003 Mortgage Application","from":"*","from_inclusive":true,"to":"1.75","to_inclusive":true,"patched_in":"1.80"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5d7e59e-962c-45d9-b3be-033bccf4c6b1","source":"wordfence","cve":"CVE-2021-24534","title":"PhoneTrack Meu Site Manager <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5d7e59e-962c-45d9-b3be-033bccf4c6b1?source=api-prod","affected":[{"type":"plugin","slug":"phonetrack-meu-site-manager","name":"PhoneTrack Meu Site Manager","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":"0.1.1"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5dc39fb-7f68-42f2-8540-b739c5075775","source":"wordfence","cve":"CVE-2026-28064","title":"Edge Decor <= 2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5dc39fb-7f68-42f2-8540-b739c5075775?source=api-prod","affected":[{"type":"theme","slug":"edge-decor","name":"Edge Decor","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:28:28Z"},{"id":"wordfence:d5de8f35-266f-45ce-8678-e52a33036b30","source":"wordfence","cve":"CVE-2026-3853","title":"Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5de8f35-266f-45ce-8678-e52a33036b30?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.6","to_inclusive":true,"patched_in":"4.27.7"}],"published":"2026-09-04T18:15:45Z","updated":"2026-09-05T06:37:58Z"},{"id":"wordfence:d5df75f8-1250-4b79-a796-9146d3037bec","source":"wordfence","cve":"","title":"Under Construction <= 3.85 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5df75f8-1250-4b79-a796-9146d3037bec?source=api-prod","affected":[{"type":"plugin","slug":"under-construction-page","name":"Under Construction","from":"*","from_inclusive":true,"to":"3.85","to_inclusive":true,"patched_in":"3.86"}],"published":"2021-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5e0d192-17ee-42bd-9368-c8449d8e0d08","source":"wordfence","cve":"CVE-2024-13483","title":"LTL Freight Quotes \u2013 SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e0d192-17ee-42bd-9368-c8449d8e0d08?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-saia-edition","name":"LTL Freight Quotes \u2013 SAIA Edition","from":"*","from_inclusive":true,"to":"2.2.10","to_inclusive":true,"patched_in":"2.2.11"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:41Z"},{"id":"wordfence:d5e0d63c-64a9-4861-9c70-c0f4d82a042e","source":"wordfence","cve":"CVE-2025-52799","title":"LMS <= 9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e0d63c-64a9-4861-9c70-c0f4d82a042e?source=api-prod","affected":[{"type":"theme","slug":"lms","name":"LMS - Education WordPress Theme","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2025-06-23T00:00:00Z","updated":"2026-02-26T15:13:35Z"},{"id":"wordfence:d5e431f2-30f6-4c4d-8e15-20b1bf1888c6","source":"wordfence","cve":"CVE-2025-30544","title":"OK Poster Group <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e431f2-30f6-4c4d-8e15-20b1bf1888c6?source=api-prod","affected":[{"type":"plugin","slug":"ok-poster-group","name":"OK Poster Group","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:04:37Z"},{"id":"wordfence:d5e60125-35e2-4d6d-8ea7-078df0b9e55f","source":"wordfence","cve":"CVE-2023-0535","title":"Donation Block For PayPal <=  2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e60125-35e2-4d6d-8ea7-078df0b9e55f?source=api-prod","affected":[{"type":"plugin","slug":"donations-block","name":"Donation Block For PayPal","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5e70f6f-fc83-4c89-a1d5-35f188e0fd90","source":"wordfence","cve":"","title":"FG PrestaShop to WooCommerce Plugin <= 3.19.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e70f6f-fc83-4c89-a1d5-35f188e0fd90?source=api-prod","affected":[{"type":"plugin","slug":"fg-prestashop-to-woocommerce","name":"FG PrestaShop to WooCommerce","from":"*","from_inclusive":true,"to":"3.19.1","to_inclusive":true,"patched_in":"3.20.0"}],"published":"2017-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5ecb52e-6bf0-4168-b0d7-6972d23c9122","source":"wordfence","cve":"","title":"Real Estate 7 WordPress < 2.9.5 - Multiple Vulnerabilities","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5ecb52e-6bf0-4168-b0d7-6972d23c9122?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":false,"patched_in":"2.9.5"}],"published":"2020-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5ed7f73-34aa-45ac-a4c8-81bb78d9e63f","source":"wordfence","cve":"CVE-2024-54238","title":"Board Document Manager from CHUHPL <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5ed7f73-34aa-45ac-a4c8-81bb78d9e63f?source=api-prod","affected":[{"type":"plugin","slug":"board-document-manager-from-chuhpl","name":"Board Document Manager from CHUHPL","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:27:34Z"},{"id":"wordfence:d5ef3350-3eec-48b7-9241-5d2ce25555f0","source":"wordfence","cve":"CVE-2021-24368","title":"Quiz And Survey Master <= 7.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5ef3350-3eec-48b7-9241-5d2ce25555f0?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":"7.1.18"}],"published":"2021-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5f0587e-1f84-472c-8fb7-13ddda63e2ec","source":"wordfence","cve":"CVE-2025-13515","title":"Nouri.sh Newsletter <= 1.0.1.3 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f0587e-1f84-472c-8fb7-13ddda63e2ec?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-from-rss-to-email-newsletters-using-nourish","name":"Nouri.sh Newsletter","from":"*","from_inclusive":true,"to":"1.0.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:34:35Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:d5f1ceb3-34b6-4d97-9787-d52a92f84662","source":"wordfence","cve":"CVE-2013-2203","title":"WordPress Core < 3.5.2 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f1ceb3-34b6-4d97-9787-d52a92f84662?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5f267a5-012d-4b9a-a59d-9eccb04c557a","source":"wordfence","cve":"CVE-2025-12457","title":"Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f267a5-012d-4b9a-a59d-9eccb04c557a?source=api-prod","affected":[{"type":"plugin","slug":"enable-svg-webp-ico-upload","name":"Enable SVG, WebP, and ICO Upload","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-11-17T20:54:25Z","updated":"2025-12-12T17:01:23Z"},{"id":"wordfence:d5f36574-b4d0-4b67-baea-f5ef5e6618d1","source":"wordfence","cve":"CVE-2017-18553","title":"Ad Buttons <= 2.3.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f36574-b4d0-4b67-baea-f5ef5e6618d1?source=api-prod","affected":[{"type":"plugin","slug":"ad-buttons","name":"Ad Buttons","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2015-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5f372bf-6b13-4ba7-8b8b-9d3b500e4420","source":"wordfence","cve":"CVE-2023-3166","title":"Lana Email Logger <= 1.0.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f372bf-6b13-4ba7-8b8b-9d3b500e4420?source=api-prod","affected":[{"type":"plugin","slug":"lana-email-logger","name":"Lana Email Logger","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5f43ade-eed1-4bc3-afef-c46e205d7041","source":"wordfence","cve":"CVE-2026-95601","title":"Product Filter for WooCommerce by WBW <= 3.1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f43ade-eed1-4bc3-afef-c46e205d7041?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2026-09-23T07:41:13Z","updated":"2026-09-29T20:09:27Z"},{"id":"wordfence:d5f4c4ec-bdb5-4f27-8ee3-060de9b62502","source":"wordfence","cve":"CVE-2024-12046","title":"Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f4c4ec-bdb5-4f27-8ee3-060de9b62502?source=api-prod","affected":[{"type":"plugin","slug":"medical-addon-for-elementor","name":"Medical Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-04T07:21:02Z"},{"id":"wordfence:d5f82abe-64bb-4539-8fe7-261fad60cfa9","source":"wordfence","cve":"CVE-2023-24001","title":"Modal Dialog <= 3.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5f82abe-64bb-4539-8fe7-261fad60cfa9?source=api-prod","affected":[{"type":"plugin","slug":"modal-dialog","name":"Modal Dialog","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.5.10"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d5fa3282-b3be-4ea1-9865-011dea828a25","source":"wordfence","cve":"CVE-2026-9284","title":"WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5fa3282-b3be-4ea1-9865-011dea828a25?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-paypal-payments","name":"WooCommerce PayPal Payments","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-05-22T16:04:24Z","updated":"2026-06-01T15:33:38Z"},{"id":"wordfence:d5fbca66-403e-41bc-8f80-3fb56d4b9c66","source":"wordfence","cve":"CVE-2024-30192","title":"GS Pins for Pinterest <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shorcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5fbca66-403e-41bc-8f80-3fb56d4b9c66?source=api-prod","affected":[{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-10T18:57:34Z"},{"id":"wordfence:d5fd2c48-c114-4bd4-9a38-bc0d733f65f3","source":"wordfence","cve":"CVE-2025-32635","title":"Hive Support <= 1.2.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d5fd2c48-c114-4bd4-9a38-bc0d733f65f3?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-04-15T00:00:00Z","updated":"2025-07-25T19:19:29Z"},{"id":"wordfence:d6006ffe-e2db-477f-8a9f-c0cf0434086b","source":"wordfence","cve":"CVE-2025-13527","title":"xShare <= 1.0.1 - Cross-Site Request Forgery to 'rs_plugin_reset' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6006ffe-e2db-477f-8a9f-c0cf0434086b?source=api-prod","affected":[{"type":"plugin","slug":"xshare","name":"xShare","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:39:59Z","updated":"2026-01-07T08:21:54Z"},{"id":"wordfence:d60261eb-c8b1-4278-aeb8-4ea1abaeed25","source":"wordfence","cve":"CVE-2025-23467","title":"RSS News Scroller <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60261eb-c8b1-4278-aeb8-4ea1abaeed25?source=api-prod","affected":[{"type":"plugin","slug":"rss-news-scroller","name":"RSS News Scroller","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:33:06Z"},{"id":"wordfence:d6046c06-9a77-450f-9cdf-c5239e73cb6b","source":"wordfence","cve":"CVE-2026-87091","title":"Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6046c06-9a77-450f-9cdf-c5239e73cb6b?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2026-10-02T17:10:52Z","updated":"2026-10-03T05:29:18Z"},{"id":"wordfence:d60540ec-e176-42f3-a987-141a9aa184c6","source":"wordfence","cve":"CVE-2026-73352","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60540ec-e176-42f3-a987-141a9aa184c6?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.5.1","to_inclusive":true,"patched_in":"4.16.6"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:43:49Z"},{"id":"wordfence:d606cada-fd3d-4763-9751-5378e81969f0","source":"wordfence","cve":"CVE-2025-62040","title":"YOP Poll <= 6.5.37 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d606cada-fd3d-4763-9751-5378e81969f0?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.5.37","to_inclusive":true,"patched_in":"6.5.38"}],"published":"2025-10-12T00:00:00Z","updated":"2025-10-29T14:49:05Z"},{"id":"wordfence:d6077842-cc17-48c6-be3b-9149e4b87235","source":"wordfence","cve":"CVE-2026-39661","title":"SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6077842-cc17-48c6-be3b-9149e4b87235?source=api-prod","affected":[{"type":"plugin","slug":"sw_core","name":"sw_core","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:51:14Z"},{"id":"wordfence:d607e7c0-7812-4c77-a763-6095677b3525","source":"wordfence","cve":"CVE-2025-0170","title":"DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d607e7c0-7812-4c77-a763-6095677b3525?source=api-prod","affected":[{"type":"theme","slug":"dwt-listing","name":"DWT - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-16T01:49:03Z"},{"id":"wordfence:d608a4c0-14ba-4801-aa5a-0b4dab0acd65","source":"wordfence","cve":"CVE-2021-24759","title":"PDF.js Viewer <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d608a4c0-14ba-4801-aa5a-0b4dab0acd65?source=api-prod","affected":[{"type":"plugin","slug":"pdfjs-viewer-shortcode","name":"PDF.js Viewer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2021-08-11T00:00:00Z","updated":"2024-07-11T14:38:19Z"},{"id":"wordfence:d60b5741-5496-4e87-bcb0-adaa0db07d90","source":"wordfence","cve":"CVE-2020-36725","title":"TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60b5741-5496-4e87-bcb0-adaa0db07d90?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"1.21.11","to_inclusive":true,"patched_in":"1.21.12"},{"type":"plugin","slug":"ti-woocommerce-wishlist-premium","name":"TI WooCommerce Wishlist Pro","from":"*","from_inclusive":true,"to":"1.21.4","to_inclusive":true,"patched_in":"1.21.5"}],"published":"2020-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d60e1a2c-a3f1-4c39-a22f-9c09d0fed2c5","source":"wordfence","cve":"","title":"stats <= 1.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60e1a2c-a3f1-4c39-a22f-9c09d0fed2c5?source=api-prod","affected":[{"type":"plugin","slug":"stats","name":"stats","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2007-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d60e9835-63ec-4f31-b247-e92561f9007b","source":"wordfence","cve":"CVE-2026-17563","title":"User Frontend <= 4.3.10 -  Missing Authorization to Unauthenticated Post Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60e9835-63ec-4f31-b247-e92561f9007b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"4.3.11"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-16T15:25:37Z"},{"id":"wordfence:d60f3da1-1184-4629-880c-ce3893fb55a5","source":"wordfence","cve":"CVE-2023-45101","title":"Customer Reviews for WooCommerce <= 5.36.0 - Missing Authorization in Reviews Exporter","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60f3da1-1184-4629-880c-ce3893fb55a5?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.36.0","to_inclusive":true,"patched_in":"5.36.1"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d60f69f1-eaea-49cb-bbe3-281ec4f872f1","source":"wordfence","cve":"","title":"TableOn \u2013 WordPress Posts Table Filterable  <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60f69f1-eaea-49cb-bbe3-281ec4f872f1?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d60fb13c-cba8-466a-8881-1ed835881b79","source":"wordfence","cve":"CVE-2024-56012","title":"Flash News / Post (Responsive) <= 4.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d60fb13c-cba8-466a-8881-1ed835881b79?source=api-prod","affected":[{"type":"plugin","slug":"flashnews-fading-effect-pearlbells","name":"Flash News / Post (Responsive)","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:11:39Z"},{"id":"wordfence:d611fb0a-f957-4ff7-a402-e0cf0e2c12b6","source":"wordfence","cve":"CVE-2025-30848","title":"Hostel <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d611fb0a-f957-4ff7-a402-e0cf0e2c12b6?source=api-prod","affected":[{"type":"plugin","slug":"hostel","name":"Hostel","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.5.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:54:56Z"},{"id":"wordfence:d6198e3e-a8e8-4d67-a0d6-b62f187d4903","source":"wordfence","cve":"CVE-2012-10015","title":"BestWebSoft's Twitter <= 2.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6198e3e-a8e8-4d67-a0d6-b62f187d4903?source=api-prod","affected":[{"type":"plugin","slug":"twitter-plugin","name":"BestWebSoft's Twitter","from":"*","from_inclusive":true,"to":"2.14","to_inclusive":true,"patched_in":"2.15"}],"published":"2012-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d619d300-8bba-45a1-bd0a-d82e9066a43d","source":"wordfence","cve":"CVE-2023-5939","title":"rtMedia for WordPress, BuddyPress and bbPress WordPress <= 4.6.15 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d619d300-8bba-45a1-bd0a-d82e9066a43d?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"4.6.16"}],"published":"2023-11-29T00:00:00Z","updated":"2024-02-06T15:37:52Z"},{"id":"wordfence:d61a1e57-9285-437f-a6b1-48e553c49533","source":"wordfence","cve":"CVE-2026-97274","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 7.1.2 - Unauthenticated Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d61a1e57-9285-437f-a6b1-48e553c49533?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T13:40:17Z"},{"id":"wordfence:d61ae924-6ded-4930-a1fa-ca08d46bf8b9","source":"wordfence","cve":"CVE-2026-78333","title":"12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d61ae924-6ded-4930-a1fa-ca08d46bf8b9?source=api-prod","affected":[{"type":"plugin","slug":"12-step-meeting-list","name":"12 Step Meeting List","from":"3.17","from_inclusive":true,"to":"3.19.16","to_inclusive":true,"patched_in":"3.19.17"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:37:57Z"},{"id":"wordfence:d61d2dc5-7461-460c-8dbc-e32a512d5828","source":"wordfence","cve":"CVE-2025-4133","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d61d2dc5-7461-460c-8dbc-e32a512d5828?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.3.3","to_inclusive":true,"patched_in":"8.4.0"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-30T20:14:07Z"},{"id":"wordfence:d61e01b0-8006-41a2-ba4f-767d75f19b3a","source":"wordfence","cve":"CVE-2026-54851","title":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d61e01b0-8006-41a2-ba4f-767d75f19b3a?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.3.1"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:43:49Z"},{"id":"wordfence:d61ed3e3-5102-4293-a999-e324e721ab89","source":"wordfence","cve":"CVE-2023-23808","title":"Sponsors Carousel <= 4.02 - Authenticated (Admin+) Stored Cross-Site Scripting in show","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d61ed3e3-5102-4293-a999-e324e721ab89?source=api-prod","affected":[{"type":"plugin","slug":"sponsors-carousel","name":"Sponsors Carousel","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6203331-4fe0-4eba-bbe7-52a55549fd25","source":"wordfence","cve":"CVE-2025-48130","title":"Spice Blocks <= 2.0.7.4 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6203331-4fe0-4eba-bbe7-52a55549fd25?source=api-prod","affected":[{"type":"plugin","slug":"spice-blocks","name":"Spice Blocks","from":"*","from_inclusive":true,"to":"2.0.7.4","to_inclusive":true,"patched_in":"2.0.7.5"}],"published":"2025-06-04T00:00:00Z","updated":"2025-11-24T19:23:59Z"},{"id":"wordfence:d6203da8-8cf0-4bd8-8ecb-3e2ec787bf6f","source":"wordfence","cve":"CVE-2025-2524","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6203da8-8cf0-4bd8-8ecb-3e2ec787bf6f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2025-04-28T00:00:00Z","updated":"2025-06-13T17:25:54Z"},{"id":"wordfence:d6206d7e-90b9-43fd-a6cd-90e98162cd09","source":"wordfence","cve":"CVE-2013-7476","title":"Simple Fields < 1.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6206d7e-90b9-43fd-a6cd-90e98162cd09?source=api-prod","affected":[{"type":"plugin","slug":"simple-fields","name":"Simple Fields","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2013-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d621869c-31f7-4243-9815-f6d1bbe469e2","source":"wordfence","cve":"CVE-2023-49150","title":"Crypto Converter Widget <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d621869c-31f7-4243-9815-f6d1bbe469e2?source=api-prod","affected":[{"type":"plugin","slug":"crypto-converter-widget","name":"Crypto Converter \u26a1 Widget","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6221374-3c0d-4d37-8a27-130c504ea70d","source":"wordfence","cve":"CVE-2020-15364","title":"Nexos - Real Estate WordPress Theme < 1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6221374-3c0d-4d37-8a27-130c504ea70d?source=api-prod","affected":[{"type":"theme","slug":"nexos","name":"Nexos - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6226ae5-3b75-4521-b060-004f291203c7","source":"wordfence","cve":"CVE-2017-9834","title":"WatuPRO < 5.5.3.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6226ae5-3b75-4521-b060-004f291203c7?source=api-prod","affected":[{"type":"plugin","slug":"watupro","name":"WatuPRO","from":"*","from_inclusive":true,"to":"5.5.3.7","to_inclusive":false,"patched_in":"5.5.3.7"}],"published":"2017-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d623d4d6-2d76-4b4e-bd8b-69fe6ae352ca","source":"wordfence","cve":"CVE-2026-92249","title":"Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d623d4d6-2d76-4b4e-bd8b-69fe6ae352ca?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-09-17T18:44:08Z","updated":"2026-09-18T07:40:05Z"},{"id":"wordfence:d624f234-c57a-4a66-900d-362194a79d34","source":"wordfence","cve":"CVE-2023-40559","title":"WooCommerce Dynamic Pricing and Discount Rules <= 2.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d624f234-c57a-4a66-900d-362194a79d34?source=api-prod","affected":[{"type":"plugin","slug":"woo-conditional-discount-rules-for-checkout","name":"Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d625881a-4789-4fc4-94b7-5ab6c6b39092","source":"wordfence","cve":"CVE-2025-68982","title":"DesignThemes LMS Addon <= 2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d625881a-4789-4fc4-94b7-5ab6c6b39092?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-lms-addon","name":"DesignThemes LMS Addon","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-06T15:17:27Z"},{"id":"wordfence:d6286cda-c5b1-4923-bbf3-9f5b56973d23","source":"wordfence","cve":"CVE-2022-1971","title":"NextCellent Gallery <= 1.9.35 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6286cda-c5b1-4923-bbf3-9f5b56973d23?source=api-prod","affected":[{"type":"plugin","slug":"nextcellent-gallery-nextgen-legacy","name":"NextCellent Gallery \u2013 NextGEN Legacy","from":"*","from_inclusive":true,"to":"1.9.35","to_inclusive":true,"patched_in":""}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d62b8380-1679-40d8-a77f-17c583e88d39","source":"wordfence","cve":"CVE-2026-7444","title":"Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62b8380-1679-40d8-a77f-17c583e88d39?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.4.16","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-08-04T17:56:50Z","updated":"2026-08-05T06:38:01Z"},{"id":"wordfence:d62bd2bd-db01-479f-89e4-8031d69a912f","source":"wordfence","cve":"CVE-2023-3025","title":"Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd2bd-db01-479f-89e4-8031d69a912f?source=api-prod","affected":[{"type":"plugin","slug":"dropbox-folder-share","name":"Dropbox Folder Share","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":""}],"published":"2023-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d62bd71c-3d08-4767-b471-a1d5a17fe6ba","source":"wordfence","cve":"CVE-2024-6566","title":"Aramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd71c-3d08-4767-b471-a1d5a17fe6ba?source=api-prod","affected":[{"type":"plugin","slug":"aramex-shipping-woocommerce","name":"Aramex Shipping WooCommerce","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T13:12:04Z","updated":"2024-07-27T01:51:06Z"},{"id":"wordfence:d62c6a7e-2390-4e27-8419-53aa80b1dbac","source":"wordfence","cve":"CVE-2024-34766","title":"ChaosTheory <= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62c6a7e-2390-4e27-8419-53aa80b1dbac?source=api-prod","affected":[{"type":"theme","slug":"chaostheory","name":"ChaosTheory","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T20:36:10Z"},{"id":"wordfence:d62d0971-c4bc-40f7-80b4-a3d54ce4f3ac","source":"wordfence","cve":"CVE-2021-24523","title":"Daily Prayer Time <= 2021.08.09 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62d0971-c4bc-40f7-80b4-a3d54ce4f3ac?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2021.08.10","to_inclusive":false,"patched_in":"2021.08.10"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d62d3ca5-5795-46ef-ad8c-4474ff1e504e","source":"wordfence","cve":"CVE-2024-1080","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62d3ca5-5795-46ef-ad8c-4474ff1e504e?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.4","to_inclusive":true,"patched_in":"2.7.4.5"}],"published":"2024-03-11T00:00:00Z","updated":"2025-01-30T18:41:48Z"},{"id":"wordfence:d62da9a3-3a57-4bbd-b07d-8df39fa14c52","source":"wordfence","cve":"CVE-2022-1549","title":"WP Athletics <= 1.1.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62da9a3-3a57-4bbd-b07d-8df39fa14c52?source=api-prod","affected":[{"type":"plugin","slug":"wp-athletics","name":"WP Athletics","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d62fac9d-2048-4c0f-9afb-46ba3e4d6dfd","source":"wordfence","cve":"CVE-2026-62022","title":"Tonda Membership <= 1.0.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d62fac9d-2048-4c0f-9afb-46ba3e4d6dfd?source=api-prod","affected":[{"type":"plugin","slug":"tonda-membership","name":"Tonda Membership","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:32:05Z"},{"id":"wordfence:d6302ecb-07a1-4b80-a5f5-be6b623c7c9f","source":"wordfence","cve":"CVE-2024-3405","title":"WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6302ecb-07a1-4b80-a5f5-be6b623c7c9f?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T12:48:45Z"},{"id":"wordfence:d630dd85-0169-4582-a8ae-54e5053425ac","source":"wordfence","cve":"CVE-2024-13487","title":"CURCY \u2013 Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d630dd85-0169-4582-a8ae-54e5053425ac?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2025-02-05T18:44:02Z","updated":"2025-02-06T06:53:41Z"},{"id":"wordfence:d630e67d-e867-4610-af31-05e4b1420e47","source":"wordfence","cve":"CVE-2026-118092","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.55 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d630e67d-e867-4610-af31-05e4b1420e47?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.55","to_inclusive":true,"patched_in":"3.7.56"}],"published":"2026-10-29T14:17:00Z","updated":"2026-11-03T19:45:32Z"},{"id":"wordfence:d632bc58-f441-48fb-848c-40b22d3aa562","source":"wordfence","cve":"CVE-2026-4161","title":"Review Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d632bc58-f441-48fb-848c-40b22d3aa562?source=api-prod","affected":[{"type":"plugin","slug":"review-map-by-revukangaroo","name":"Review Map by RevuKangaroo","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:16:09Z","updated":"2026-03-21T03:27:06Z"},{"id":"wordfence:d6331b42-f15b-46c6-b8bd-7f65c28c4a12","source":"wordfence","cve":"CVE-2023-51519","title":"Slider by Soliloquy <= 2.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6331b42-f15b-46c6-b8bd-7f65c28c4a12?source=api-prod","affected":[{"type":"plugin","slug":"soliloquy-lite","name":"Slider by Soliloquy \u2013 Responsive Image Slider for WordPress","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6332d57-5832-4093-a609-f9c454452815","source":"wordfence","cve":"CVE-2026-6565","title":"Style Kits \u2013 Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6332d57-5832-4093-a609-f9c454452815?source=api-prod","affected":[{"type":"plugin","slug":"analogwp-templates","name":"Style Kits for Elementor","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-05-26T12:12:14Z","updated":"2026-05-27T01:26:18Z"},{"id":"wordfence:d634ba5c-842c-44d0-b919-01c297a779f2","source":"wordfence","cve":"CVE-2015-7667","title":"ResAds < 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d634ba5c-842c-44d0-b919-01c297a779f2?source=api-prod","affected":[{"type":"plugin","slug":"resads","name":"ResAds","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2015-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d63543f9-4865-444f-9a32-3b23e92b0bd4","source":"wordfence","cve":"CVE-2023-0588","title":"Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d63543f9-4865-444f-9a32-3b23e92b0bd4?source=api-prod","affected":[{"type":"plugin","slug":"catalyst-connect-client-portal","name":"Catalyst Connect Zoho CRM Client Portal","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d638120b-5396-408b-8273-d003ff9dd01d","source":"wordfence","cve":"CVE-2022-1209","title":"Ultimate Member <= 2.3.1 - Arbitrary Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2022-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d63a1a9e-bdba-4987-b3e9-48ef1cf9be5b","source":"wordfence","cve":"CVE-2025-58639","title":"Contact Form By Mega Forms <= 1.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d63a1a9e-bdba-4987-b3e9-48ef1cf9be5b?source=api-prod","affected":[{"type":"plugin","slug":"mega-forms","name":"Mega Forms \u2013 Drag & Drop Form Builder with Multi-Step & Conditional Logic","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:39:39Z"},{"id":"wordfence:d63a8ec5-043d-4263-a7f3-8c117d1fb0b7","source":"wordfence","cve":"CVE-2025-55710","title":"Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.37.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d63a8ec5-043d-4263-a7f3-8c117d1fb0b7?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.37.2","to_inclusive":true,"patched_in":"3.37.3"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:19:37Z"},{"id":"wordfence:d63bc735-b2ba-4be6-bd1c-f904ef860f5e","source":"wordfence","cve":"CVE-2021-36858","title":"Testimonials <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d63bc735-b2ba-4be6-bd1c-f904ef860f5e?source=api-prod","affected":[{"type":"plugin","slug":"super-testimonial","name":"Super Testimonial \u2013 Testimonial & Customer Review Slider Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2022-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d63cd13e-4a16-483f-8165-6c8090ceebab","source":"wordfence","cve":"CVE-2024-13731","title":"Alert Box Block \u2013 Display notice/alerts in the front end <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Box Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d63cd13e-4a16-483f-8165-6c8090ceebab?source=api-prod","affected":[{"type":"plugin","slug":"alert-box-block","name":"Alert Box Block \u2013 Grab Attention with Eye-Catching Notices","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-03-24T19:33:35Z","updated":"2025-05-09T13:39:37Z"},{"id":"wordfence:d641bdd9-b8f9-4811-ae64-adbd694b4a4f","source":"wordfence","cve":"CVE-2025-23759","title":"Affiliate Tools Vi\u1ec7t Nam <= 0.3.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d641bdd9-b8f9-4811-ae64-adbd694b4a4f?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-tools-viet-nam","name":"Affiliate Tools Vi\u1ec7t Nam","from":"*","from_inclusive":true,"to":"0.3.17","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T15:58:53Z"},{"id":"wordfence:d6421c33-152d-4e50-a96c-f97e2981b72f","source":"wordfence","cve":"","title":"RD Order Modifier for WooCommerce <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6421c33-152d-4e50-a96c-f97e2981b72f?source=api-prod","affected":[{"type":"plugin","slug":"rd-wc-order-modifier","name":"RD Order Modifier for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d643e360-e2ae-4bcb-b02b-c4957853425a","source":"wordfence","cve":"CVE-2025-58011","title":"Content Mask <= 1.8.5.2 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d643e360-e2ae-4bcb-b02b-c4957853425a?source=api-prod","affected":[{"type":"plugin","slug":"content-mask","name":"Content Mask","from":"*","from_inclusive":true,"to":"1.8.5.2","to_inclusive":true,"patched_in":"1.8.5.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:17:32Z"},{"id":"wordfence:d6489214-2155-47f4-83ef-0119b3c26e43","source":"wordfence","cve":"CVE-2021-24182","title":"Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6489214-2155-47f4-83ef-0119b3c26e43?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d64e336c-2174-468c-bd82-566ffeaf1d7a","source":"wordfence","cve":"CVE-2026-97240","title":"StifLi Backup Tools <= 2.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d64e336c-2174-468c-bd82-566ffeaf1d7a?source=api-prod","affected":[{"type":"plugin","slug":"stifli-backup-tools","name":"StifLi Backup Tools","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2026-09-29T10:02:14Z","updated":"2026-10-08T23:56:53Z"},{"id":"wordfence:d64e6440-0b96-4e81-a0fd-e0839bd78280","source":"wordfence","cve":"CVE-2025-26882","title":"Popup Builder <= 1.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d64e6440-0b96-4e81-a0fd-e0839bd78280?source=api-prod","affected":[{"type":"plugin","slug":"easy-notify-lite","name":"Easy Notify Lite","from":"*","from_inclusive":true,"to":"1.1.33","to_inclusive":true,"patched_in":"1.1.35"}],"published":"2025-02-22T00:00:00Z","updated":"2025-03-03T16:58:43Z"},{"id":"wordfence:d650261a-ec0a-4538-ad59-0589712702fa","source":"wordfence","cve":"CVE-2026-3986","title":"Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d650261a-ec0a-4538-ad59-0589712702fa?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.4.5.0","to_inclusive":true,"patched_in":"5.4.5.1"}],"published":"2026-03-12T19:59:06Z","updated":"2026-03-13T08:25:20Z"},{"id":"wordfence:d6516fc0-4ef8-423b-9cdb-a275996fd98b","source":"wordfence","cve":"","title":"WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6516fc0-4ef8-423b-9cdb-a275996fd98b?source=api-prod","affected":[{"type":"plugin","slug":"wp-basic-elements","name":"WP Basic Elements","from":"*","from_inclusive":true,"to":"5.2.15","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d652f383-ca3d-440e-a30f-64a50efd65e1","source":"wordfence","cve":"CVE-2026-1512","title":"Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d652f383-ca3d-440e-a30f-64a50efd65e1?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.5.9","to_inclusive":true,"patched_in":"6.5.10"}],"published":"2026-02-13T21:37:33Z","updated":"2026-02-14T09:49:41Z"},{"id":"wordfence:d6558119-35fe-4aa9-8e5a-4b9df329d8b6","source":"wordfence","cve":"CVE-2025-49337","title":"Dashboard Beacon <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6558119-35fe-4aa9-8e5a-4b9df329d8b6?source=api-prod","affected":[{"type":"plugin","slug":"wp-dashboard-beacon","name":"Dashboard Beacon","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:15:33Z"},{"id":"wordfence:d6572568-5586-4ed9-b0e2-32509b42ed31","source":"wordfence","cve":"","title":"Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6572568-5586-4ed9-b0e2-32509b42ed31?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d658e087-8cc7-4653-af3c-407b6f73fb7b","source":"wordfence","cve":"CVE-2025-11453","title":"Header and Footer Scripts <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d658e087-8cc7-4653-af3c-407b6f73fb7b?source=api-prod","affected":[{"type":"plugin","slug":"header-and-footer-scripts","name":"Header and Footer Scripts","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-01-08T21:20:03Z","updated":"2026-01-23T20:00:13Z"},{"id":"wordfence:d65eeb25-8c94-44e9-976d-db5d42e2d06e","source":"wordfence","cve":"CVE-2024-35630","title":"WP TripAdvisor Review Slider <= 12.6 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d65eeb25-8c94-44e9-976d-db5d42e2d06e?source=api-prod","affected":[{"type":"plugin","slug":"wp-tripadvisor-review-slider","name":"WP TripAdvisor Review Slider","from":"*","from_inclusive":true,"to":"12.6","to_inclusive":true,"patched_in":"12.7"}],"published":"2024-05-27T00:00:00Z","updated":"2024-06-05T13:44:16Z"},{"id":"wordfence:d661c24e-48f3-4b97-aa34-e46bd3907546","source":"wordfence","cve":"CVE-2025-11882","title":"Simple Donate <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d661c24e-48f3-4b97-aa34-e46bd3907546?source=api-prod","affected":[{"type":"plugin","slug":"simple-donate","name":"Simple Donate","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:59:02Z","updated":"2025-11-11T03:30:50Z"},{"id":"wordfence:d6628232-0bd1-4194-8322-36084b1eb0f7","source":"wordfence","cve":"CVE-2025-4419","title":"Hot Random Image <= 1.9.2 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6628232-0bd1-4194-8322-36084b1eb0f7?source=api-prod","affected":[{"type":"plugin","slug":"hot-random-image","name":"Hot Random Image","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2025-05-21T20:42:56Z","updated":"2025-05-22T09:21:52Z"},{"id":"wordfence:d662846b-c694-4030-ade1-f0d5bc811e12","source":"wordfence","cve":"CVE-2026-32418","title":"Meow Gallery <= 5.4.4 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d662846b-c694-4030-ade1-f0d5bc811e12?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-15T21:16:06Z"},{"id":"wordfence:d664d1f9-39b1-424f-a95e-7a480d809c79","source":"wordfence","cve":"CVE-2025-11502","title":"Schema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d664d1f9-39b1-424f-a95e-7a480d809c79?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.51","to_inclusive":true,"patched_in":"1.52"}],"published":"2025-10-31T00:00:00Z","updated":"2025-11-01T05:40:25Z"},{"id":"wordfence:d665df2d-5217-4a23-9278-5b88162f7d13","source":"wordfence","cve":"CVE-2026-16282","title":"Appointment Hour Booking <= 1.5.87 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d665df2d-5217-4a23-9278-5b88162f7d13?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.5.87","to_inclusive":true,"patched_in":"1.5.88"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:39:05Z"},{"id":"wordfence:d66665b6-8cb2-4bc0-929d-4a8689bada9e","source":"wordfence","cve":"CVE-2022-45066","title":"WooSwipe WooCommerce Gallery <= 3.0.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d66665b6-8cb2-4bc0-929d-4a8689bada9e?source=api-prod","affected":[{"type":"plugin","slug":"wooswipe","name":"WooSwipe WooCommerce Gallery","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2022-11-17T15:35:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d666d0fc-0362-4289-81c4-67f96e729877","source":"wordfence","cve":"CVE-2024-43304","title":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d666d0fc-0362-4289-81c4-67f96e729877?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-price-ticker-widget","name":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T20:58:55Z"},{"id":"wordfence:d667bafc-5f19-4889-a988-236df050c013","source":"wordfence","cve":"CVE-2024-8757","title":"Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d667bafc-5f19-4889-a988-236df050c013?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2024-10-11T20:41:41Z","updated":"2024-10-12T09:39:19Z"},{"id":"wordfence:d6686b67-8648-4f1b-8e05-fa67db60c8aa","source":"wordfence","cve":"CVE-2024-33566","title":"OrderConvo <= 12.4 - Missing Authorization to Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6686b67-8648-4f1b-8e05-fa67db60c8aa?source=api-prod","affected":[{"type":"plugin","slug":"admin-and-client-message-after-order-for-woocommerce","name":"OrderConvo \u2013 Vendor & Customer Messages After Orders","from":"*","from_inclusive":true,"to":"12.4","to_inclusive":true,"patched_in":"12.5"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T12:41:24Z"},{"id":"wordfence:d66d6f36-ad16-40ba-b32f-f4aff6f8b494","source":"wordfence","cve":"CVE-2025-14160","title":"Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d66d6f36-ad16-40ba-b32f-f4aff6f8b494?source=api-prod","affected":[{"type":"plugin","slug":"upcoming-for-calendly","name":"Upcoming for Calendly","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-12-11T14:28:42Z","updated":"2025-12-12T03:20:58Z"},{"id":"wordfence:d66df15e-1a0a-49e9-bcf9-67091499b24e","source":"wordfence","cve":"CVE-2024-3020","title":"Carousel, Slider, Gallery by WP Carousel \u2013 Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d66df15e-1a0a-49e9-bcf9-67091499b24e?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T04:30:22Z"},{"id":"wordfence:d672a729-d1fc-4ec1-9c0f-c51610fb5ab5","source":"wordfence","cve":"CVE-2025-24544","title":"Bitcoin and Altcoin Wallet <= 6.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d672a729-d1fc-4ec1-9c0f-c51610fb5ab5?source=api-prod","affected":[{"type":"plugin","slug":"wallets","name":"Bitcoin and Altcoin Wallets","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-11-10T00:00:00Z","updated":"2025-02-25T16:56:09Z"},{"id":"wordfence:d672fcb9-6607-477e-b168-546669886ea4","source":"wordfence","cve":"CVE-2024-31295","title":"Captcha by BestWebSoft <= 5.2.0 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d672fcb9-6607-477e-b168-546669886ea4?source=api-prod","affected":[{"type":"plugin","slug":"captcha-bws","name":"Captcha by BestWebSoft \u2013 Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:10:11Z"},{"id":"wordfence:d673d229-5024-4325-bddc-e52d87a1da62","source":"wordfence","cve":"CVE-2025-46518","title":"IGIT Related Posts With Thumb Image After Posts <=  4.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d673d229-5024-4325-bddc-e52d87a1da62?source=api-prod","affected":[{"type":"plugin","slug":"igit-related-posts-with-thumb-images-after-posts","name":"IGIT Related Posts and Post Nudges","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-05-02T00:00:00Z","updated":"2026-06-18T14:05:14Z"},{"id":"wordfence:d676700b-8c53-4e09-a654-767810b5a775","source":"wordfence","cve":"CVE-2026-4261","title":"Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d676700b-8c53-4e09-a654-767810b5a775?source=api-prod","affected":[{"type":"plugin","slug":"expire-users","name":"Expire Users","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T14:37:35Z","updated":"2026-03-21T03:27:07Z"},{"id":"wordfence:d678eca4-ad6d-4511-9f6d-37269dcf0ecb","source":"wordfence","cve":"CVE-2025-47629","title":"WP-CRM System <= 3.4.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d678eca4-ad6d-4511-9f6d-37269dcf0ecb?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-26T15:22:09Z"},{"id":"wordfence:d67a5bf3-37fc-4739-8e08-ef60e547d378","source":"wordfence","cve":"CVE-2026-96351","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 6.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67a5bf3-37fc-4739-8e08-ef60e547d378?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:49:10Z"},{"id":"wordfence:d67b1a6c-001d-452e-861c-0e5c7ab465dd","source":"wordfence","cve":"CVE-2024-31279","title":"Generate Child Theme <= 2.0 - Cross-Site Request Forgery via process_create_form()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67b1a6c-001d-452e-861c-0e5c7ab465dd?source=api-prod","affected":[{"type":"plugin","slug":"generate-child-theme","name":"Generate Child Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:37:01Z"},{"id":"wordfence:d67cd96b-6fec-44db-be50-395bed199e9b","source":"wordfence","cve":"","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Responsive WordPress Plugin <= 2.1.6 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67cd96b-6fec-44db-be50-395bed199e9b?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d67d5662-0cc7-4b14-a50b-15158f6e4239","source":"wordfence","cve":"CVE-2022-50946","title":"Netroics Blog Posts Grid <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67d5662-0cc7-4b14-a50b-15158f6e4239?source=api-prod","affected":[{"type":"plugin","slug":"netroics-blog-posts-grid","name":"Netroics Blog Posts Grid","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-08T00:00:00Z","updated":"2026-07-29T21:09:45Z"},{"id":"wordfence:d67de4f2-b680-49f8-be95-c2464b70f7d0","source":"wordfence","cve":"CVE-2024-12118","title":"The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67de4f2-b680-49f8-be95-c2464b70f7d0?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2025-01-22T22:22:48Z","updated":"2025-01-23T11:13:30Z"},{"id":"wordfence:d67e312f-58ad-46d9-a14c-4082ec64442e","source":"wordfence","cve":"CVE-2025-23940","title":"Image Switcher <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d67e312f-58ad-46d9-a14c-4082ec64442e?source=api-prod","affected":[{"type":"plugin","slug":"image-switcher","name":"Image Switcher","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:50:19Z"},{"id":"wordfence:d680c434-bafe-49de-957e-a94518250cde","source":"wordfence","cve":"CVE-2026-85311","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.60 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d680c434-bafe-49de-957e-a94518250cde?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.60","to_inclusive":true,"patched_in":"2.1.70"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:08:20Z"},{"id":"wordfence:d681fcaf-c7b3-496f-b0d8-a8ed48901cec","source":"wordfence","cve":"CVE-2014-10016","title":"Welcart e-Commerce <= 2.11.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d681fcaf-c7b3-496f-b0d8-a8ed48901cec?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.11.2"}],"published":"2014-03-03T00:00:00Z","updated":"2026-10-20T22:02:18Z"},{"id":"wordfence:d683c895-0532-4ffe-a4db-13d9c17426c7","source":"wordfence","cve":"CVE-2026-14824","title":"Quiz And Survey Master <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d683c895-0532-4ffe-a4db-13d9c17426c7?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.1","to_inclusive":true,"patched_in":"11.2.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:06:45Z"},{"id":"wordfence:d6847492-6204-40ae-b971-8eeb1a10ce23","source":"wordfence","cve":"CVE-2025-23692","title":"Slider for Writers <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6847492-6204-40ae-b971-8eeb1a10ce23?source=api-prod","affected":[{"type":"plugin","slug":"slider-for-writers","name":"Slider for Writers","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:41:20Z"},{"id":"wordfence:d684efcd-74fa-4b0c-b8dd-9674a2748fc3","source":"wordfence","cve":"CVE-2020-35932","title":"Newsletter <= 6.8.1 - Authenticated PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d684efcd-74fa-4b0c-b8dd-9674a2748fc3?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"6.8.2"}],"published":"2020-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d685c80a-3aad-4778-9aad-de41af33acbf","source":"wordfence","cve":"CVE-2024-56014","title":"Olivia <= 0.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d685c80a-3aad-4778-9aad-de41af33acbf?source=api-prod","affected":[{"type":"theme","slug":"olivia","name":"Olivia","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-08T14:33:10Z"},{"id":"wordfence:d685e464-a564-4ff6-b73b-b7cc465ba030","source":"wordfence","cve":"CVE-2026-118094","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d685e464-a564-4ff6-b73b-b7cc465ba030?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-29T12:59:00Z","updated":"2026-11-03T19:46:11Z"},{"id":"wordfence:d6878dcf-a878-444e-a647-463c3bafb234","source":"wordfence","cve":"CVE-2025-67976","title":"Watu Quiz <= 3.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6878dcf-a878-444e-a647-463c3bafb234?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.5.1"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:38:39Z"},{"id":"wordfence:d6879547-4a5f-48af-a3af-7e13c941b4bf","source":"wordfence","cve":"CVE-2026-28172","title":"Tracking Code Manager <= 2.6.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6879547-4a5f-48af-a3af-7e13c941b4bf?source=api-prod","affected":[{"type":"plugin","slug":"tracking-code-manager","name":"Tracking Code Manager","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:05:01Z"},{"id":"wordfence:d68841f1-f3f2-45e7-8a4f-d2d65624b617","source":"wordfence","cve":"CVE-2019-15775","title":"ND Learning <= 4.7 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68841f1-f3f2-45e7-8a4f-d2d65624b617?source=api-prod","affected":[{"type":"plugin","slug":"nd-learning","name":"Learning Courses","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2019-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6888b76-2419-4adc-b641-58602303ab30","source":"wordfence","cve":"CVE-2025-31752","title":"Bulk Fields Editor <= 1.8.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6888b76-2419-4adc-b641-58602303ab30?source=api-prod","affected":[{"type":"plugin","slug":"bulk-user-editor","name":"Bulk Fields Editor","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:11:37Z"},{"id":"wordfence:d68a2b60-ee89-4231-b256-214eba418244","source":"wordfence","cve":"CVE-2024-2411","title":"MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68a2b60-ee89-4231-b256-214eba418244?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-03-29T08:31:32Z"},{"id":"wordfence:d68bbf0d-72e9-4295-a1e1-4abeb36cae1b","source":"wordfence","cve":"CVE-2025-14154","title":"Better Messages \u2013 Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68bbf0d-72e9-4295-a1e1-4abeb36cae1b?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2025-12-16T17:20:44Z","updated":"2025-12-17T05:24:55Z"},{"id":"wordfence:d68d2144-96b9-482e-9791-c3506661596e","source":"wordfence","cve":"CVE-2023-4490","title":"WP Job Portal <= 2.0.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68d2144-96b9-482e-9791-c3506661596e?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2023-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d68e250e-d850-4100-81db-3e3c48a3a4a1","source":"wordfence","cve":"CVE-2024-11275","title":"WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68e250e-d850-4100-81db-3e3c48a3a4a1?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.27","to_inclusive":true,"patched_in":"1.0.28"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:52Z"},{"id":"wordfence:d68e74c2-3732-40ae-b589-3a9159aff93d","source":"wordfence","cve":"CVE-2021-25078","title":"Affiliates Manager <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d68e74c2-3732-40ae-b589-3a9159aff93d?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.8.9","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2021-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6934c0e-7526-4de7-9478-3c953b3dc64f","source":"wordfence","cve":"CVE-2024-25593","title":"NEX-Forms \u2013 Ultimate Form Builder <= 8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6934c0e-7526-4de7-9478-3c953b3dc64f?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T19:01:10Z"},{"id":"wordfence:d694491c-c0f5-4418-805a-db792ea4f712","source":"wordfence","cve":"CVE-2024-13362","title":"Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-stars-rating","name":"YASR \u2013 Yet Another Star Rating Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.4.12","to_inclusive":true,"patched_in":"3.4.15"},{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.5"},{"type":"plugin","slug":"ultimeter","name":"Ultimeter \u2013 the Ultimate Progress and Goals Meter","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.7"},{"type":"plugin","slug":"custom-php-settings","name":"Custom PHP Settings","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"},{"type":"plugin","slug":"fullscreen-background","name":"Full Screen Background","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"},{"type":"plugin","slug":"add-fields-to-checkout-page-woocommerce","name":"Custom WooCommerce Checkout Fields Editor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"dracula-dark-mode","name":"Dracula Dark Mode \u2013  Accessibility, Reading Mode & Dark Mode for WordPress","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"},{"type":"plugin","slug":"product-layouts","name":"Product Layouts for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.5"},{"type":"plugin","slug":"add-expires-headers","name":"AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.10.0"},{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.7.0"},{"type":"plugin","slug":"wp-books-gallery","name":"Books Gallery \u2013 Book Showcase, Library & Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.7.6"},{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"},{"type":"plugin","slug":"interactive-geo-maps","name":"MapGeo \u2013 Interactive Geo Maps","from":"*","from_inclusive":true,"to":"1.6.22","to_inclusive":true,"patched_in":"1.6.23"},{"type":"plugin","slug":"wp-notification-bell","name":"WP Notification Bell","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"plugin","slug":"spice-post-slider","name":"Carousel, Recent Post Slider and Banner Slider","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"wc-place-order-without-payment","name":"Place Order Without Payment for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.7"},{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.5.1"},{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.8"},{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"5.17.2","to_inclusive":true,"patched_in":"5.19.0"},{"type":"plugin","slug":"custom-page-templates-by-vegacorp","name":"WP Page Templates","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"},{"type":"plugin","slug":"gs-team-members","name":"Team Members \u2013 Team Showcase, Team Slider, Grid, Table & Staff Directory","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"advanced-scrollbar","name":"Advanced Scrollbar \u2013 Give Your Site a Sleek Branded Scrolling Feel","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.10"},{"type":"plugin","slug":"automatic-youtube-gallery","name":"Automatic YouTube Gallery \u2013 Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"},{"type":"plugin","slug":"wc-thanks-redirect","name":"Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"},{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"},{"type":"plugin","slug":"easy-marijuana-age-verify","name":"Marijuana Age Verify","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.6"},{"type":"plugin","slug":"five-star-ratings-shortcode","name":"Five-Star Ratings Shortcode","from":"*","from_inclusive":true,"to":"1.2.56","to_inclusive":true,"patched_in":"1.2.57"},{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"},{"type":"plugin","slug":"music-player-for-elementor","name":"Music Player for Elementor \u2013 Audio Player & Podcast Player","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"open-user-map","name":"Open User Map \u2013 Interactive Leaflet Maps","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"},{"type":"plugin","slug":"featured-images-for-rss-feeds","name":"Featured Images in RSS for Mailchimp & More","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.140","to_inclusive":true,"patched_in":"1.5.141"},{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"},{"type":"plugin","slug":"wp-meta-and-date-remover","name":"WP Meta and Date Remover","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"},{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.9"},{"type":"plugin","slug":"wp-stripe-donation","name":"AidWP \u2013 Donation & Payment Forms (Stripe Powered)","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.9"},{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"smart-phone-field-for-gravity-forms","name":"Smart phone field for Gravity Forms","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.2.0"},{"type":"plugin","slug":"send-users-email","name":"Send Users Email \u2013 Email Subscribers, Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.6.2"},{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.7.2","to_inclusive":true,"patched_in":"2.0.7.3"},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.29"},{"type":"plugin","slug":"bulletin-announcements","name":"Announcement Bar, Notification Bar & Banner \u2013 Bulletin","from":"*","from_inclusive":true,"to":"3.12.1","to_inclusive":true,"patched_in":"3.13.1"},{"type":"plugin","slug":"wc-cashapp","name":"Checkout with Cash App on WooCommerce","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"security-ninja","name":"Security Ninja \u2013 WordPress Security & Firewall","from":"*","from_inclusive":true,"to":"5.222","to_inclusive":true,"patched_in":"5.225"},{"type":"plugin","slug":"goal-tracker-ga","name":"Goal Tracker \u2013 Custom Event Tracking for GA4","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"},{"type":"plugin","slug":"justified-gallery","name":"Justified Gallery","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.10.0"},{"type":"plugin","slug":"remove-add-to-cart-woocommerce","name":"Remove Add to Cart WooCommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"},{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.16.3.3","to_inclusive":true,"patched_in":"2.16.3.6"},{"type":"plugin","slug":"aibuddy-openai-chatgpt","name":"AI Bud \u2013 AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.8.5"},{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"5.0.57","to_inclusive":true,"patched_in":"5.1.8"},{"type":"plugin","slug":"gpt3-ai-content-generator","name":"AI Puffer \u2013 MCP Server for Claude & ChatGPT, with AI Chatbot","from":"*","from_inclusive":true,"to":"1.8.99","to_inclusive":true,"patched_in":"2.3.17"},{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"},{"type":"plugin","slug":"blog-designer-pack","name":"Blog Designer Pack \u2013 Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.11"},{"type":"plugin","slug":"foobar-notifications-lite","name":"Notification Bar, Announcement and Cookie Notice WordPress Plugin \u2013 FooBar","from":"*","from_inclusive":true,"to":"2.1.34","to_inclusive":true,"patched_in":"2.1.35"},{"type":"plugin","slug":"tablesome","name":"Tablesome Table \u2013 Contact Form DB \u2013 WPForms, CF7, Gravity, Forminator, Fluent","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.17"},{"type":"plugin","slug":"widgets-on-pages","name":"Widgets on Pages","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"5.5.8","to_inclusive":true,"patched_in":"5.5.9"},{"type":"plugin","slug":"xt-woo-variation-swatches","name":"XT Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.7"},{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.5.1"},{"type":"plugin","slug":"woo-authorize-net-gateway-aim","name":"Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins","from":"*","from_inclusive":true,"to":"6.1.13","to_inclusive":true,"patched_in":"6.1.14"},{"type":"plugin","slug":"independent-analytics","name":"Independent Analytics \u2013 WordPress Analytics Plugin","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":true,"patched_in":"2.10.0"},{"type":"plugin","slug":"glossary-by-codeat","name":"Glossary","from":"*","from_inclusive":true,"to":"2.2.38","to_inclusive":true,"patched_in":"2.2.39"},{"type":"plugin","slug":"menu-image","name":"Menu Image, Icons made easy","from":"*","from_inclusive":true,"to":"3.12","to_inclusive":true,"patched_in":"3.13"},{"type":"plugin","slug":"pdf-poster","name":"PDF Poster \u2013 Let visitors read PDF\u2019s without leaving the page","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.3.1"},{"type":"plugin","slug":"fullworks-anti-spam","name":"Anti-Spam Protection \u2013 No API Key, GDPR Friendly","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.12"},{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"},{"type":"plugin","slug":"post-slider-and-carousel-pro","name":"Post Slider and Carousel Pro","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"},{"type":"plugin","slug":"restricted-content","name":"Restrict \u2013 membership, site, content and user access restrictions for WordPress","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"},{"type":"plugin","slug":"ga-for-wp","name":"TrueAna \u2013 True Analytics Dashboard","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.10.0"},{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.07","to_inclusive":true,"patched_in":"2.08"},{"type":"plugin","slug":"easy-facebook-likebox","name":"Easy Social Feed \u2013 All In One Social Feed Plugin for WordPress","from":"*","from_inclusive":true,"to":"6.6.5","to_inclusive":true,"patched_in":"6.6.6"},{"type":"plugin","slug":"delete-old-posts-programmatically","name":"Auto Post Cleaner","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"},{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.82","to_inclusive":true,"patched_in":"2.0.83"},{"type":"plugin","slug":"elespare","name":"EleSpare \u2013 Elementor News, Magazine & Blog Addons with Post Grid","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.4"},{"type":"plugin","slug":"logo-showcase-with-slick-slider","name":"Logo Showcase \u2013 Responsive Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.9"},{"type":"plugin","slug":"simply-gallery-block","name":"SimpLy Gallery","from":"*","from_inclusive":true,"to":"3.2.4.4","to_inclusive":true,"patched_in":"3.2.4.5"},{"type":"plugin","slug":"bulk-image-alt-text-with-yoast","name":"Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"},{"type":"plugin","slug":"spotlight-social-photo-feeds","name":"Spotlight Social Photo Feed","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"},{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"},{"type":"plugin","slug":"radio-station","name":"Radio Station by netmix\u00ae \u2013 Manage and play your Show Schedule in WordPress!","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.17"},{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"},{"type":"plugin","slug":"cf7-message-filter","name":"Message Filter for Contact Form 7","from":"*","from_inclusive":true,"to":"1.6.3.2","to_inclusive":true,"patched_in":"1.6.3.3"},{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.3.3","to_inclusive":true,"patched_in":"7.3.4"},{"type":"plugin","slug":"code-manager","name":"Code Manager","from":"*","from_inclusive":true,"to":"1.0.40","to_inclusive":true,"patched_in":"1.0.41"},{"type":"plugin","slug":"map-location-picker-at-checkout-for-woocommerce","name":"Kikote \u2013 Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.10.6","to_inclusive":true,"patched_in":"1.10.8"},{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"wps-team","name":"Team Members Showcase","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.2"},{"type":"plugin","slug":"post-list-designer","name":"Post List Designer \u2013 Category Post, Recent Post, Post List","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"},{"type":"plugin","slug":"wp-sheet-editor-bulk-spreadsheet-editor-for-posts-and-pages","name":"Bulk Edit Posts and Products in Spreadsheet","from":"*","from_inclusive":true,"to":"2.25.16","to_inclusive":true,"patched_in":"2.25.19"},{"type":"plugin","slug":"automatic-internal-links-for-seo","name":"Automatic Internal Links for SEO by Pagup","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"},{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.15","to_inclusive":true,"patched_in":"1.13.16"},{"type":"plugin","slug":"role-and-customer-based-pricing-for-woocommerce","name":"Role Based Pricing for Woo by Meow Crew","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"},{"type":"plugin","slug":"treepress","name":"TreePress \u2013 Easy Family Trees & Ancestor Profiles","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"},{"type":"plugin","slug":"wp-coupons-and-deals","name":"WP Coupons and Deals \u2013 WordPress Coupon Plugin","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"},{"type":"plugin","slug":"wp-auto-republish","name":"RevivePress \u2013 Keep your Old Content Evergreen","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-fail2ban","name":"WP fail2ban \u2013 Advanced Security","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.4.0"},{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"},{"type":"plugin","slug":"bbp-core","name":"Forumax \u2013 AI Powered Advanced Community Forum Plugin","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"foobox-image-lightbox","name":"Lightbox & Modal Popup WordPress Plugin \u2013 FooBox","from":"*","from_inclusive":true,"to":"2.7.33","to_inclusive":true,"patched_in":"2.7.34"},{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.31","to_inclusive":true,"patched_in":"5.5.32"},{"type":"plugin","slug":"woocustomizer","name":"StoreCustomizer \u2013 A plugin to Customize all WooCommerce Pages","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"wp-top-news","name":"WP Top News \u2014 Build a Complete News Portal in WordPress","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.3"},{"type":"plugin","slug":"contact-form-7-multi-step-module","name":"Webheadcoder Multi-Step Forms for Contact Form 7","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"},{"type":"plugin","slug":"easy-age-verify","name":"Easy Age Verify","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.9"},{"type":"plugin","slug":"woo-conditional-payment-gateways","name":"Disable Payment Methods based on cart conditions for WooCommerce","from":"*","from_inclusive":true,"to":"1.16.3","to_inclusive":true,"patched_in":"1.16.4"},{"type":"plugin","slug":"display-a-meta-field-as-block","name":"Meta Field Block \u2013 Display Custom Fields for ACF, Meta Box and More","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"},{"type":"plugin","slug":"woo-permalink-manager","name":"Premmerce Permalink Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"},{"type":"plugin","slug":"go-fetch-jobs-wp-job-manager","name":"Go Fetch Jobs (for WP Job Manager)","from":"*","from_inclusive":true,"to":"1.8.4.8.1","to_inclusive":true,"patched_in":"1.8.4.9.1"},{"type":"plugin","slug":"post-to-google-my-business","name":"Post to Google My Business (Google Business Profile)","from":"*","from_inclusive":true,"to":"3.1.28","to_inclusive":true,"patched_in":"3.2.2"},{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.7","to_inclusive":true,"patched_in":"8.0.8"},{"type":"plugin","slug":"xt-woo-quick-view-lite","name":"XT Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.5"},{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"2.0.19"},{"type":"plugin","slug":"wc-hkdigital-acba-gateway","name":"Payment Gateway for ACBA BANK","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"auto-install-free-ssl","name":"Auto-Install Free SSL \u2013 Generate & Install Free SSL Certificates","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"},{"type":"plugin","slug":"dynamic-copyright-year","name":"Dynamic Copyright Year","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.1"},{"type":"plugin","slug":"text-to-audio","name":"Text To Speech TTS Accessibility","from":"*","from_inclusive":true,"to":"1.7.34","to_inclusive":true,"patched_in":"1.8.12"},{"type":"plugin","slug":"widget-for-eventbrite-api","name":"Display Eventbrite Events","from":"*","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"6.1.11"},{"type":"plugin","slug":"woo-floating-cart-lite","name":"XT Floating Cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woocommerce-pay-per-post","name":"Pay For Post with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.26","to_inclusive":true,"patched_in":"3.1.28"},{"type":"plugin","slug":"advance-wc-analytics","name":"AWCA \u2013 The Great Analytics Insights for Your eStore","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.16.0"},{"type":"plugin","slug":"internal-links","name":"Internal Link Juicer: SEO Auto Linker for WordPress","from":"*","from_inclusive":true,"to":"2.24.6","to_inclusive":true,"patched_in":"2.25.2"},{"type":"plugin","slug":"wp-letsencrypt-ssl","name":"WP Encryption: One Click SSL / HTTPS & Free SSL certificate, HTTPS redirect","from":"*","from_inclusive":true,"to":"7.7.0","to_inclusive":true,"patched_in":"7.7.3"},{"type":"plugin","slug":"inavii-social-feed-for-elementor","name":"Inavii Social Feed \u2013 Live Social Proof Gallery","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.7"},{"type":"plugin","slug":"premmerce-woocommerce-product-filter","name":"Premmerce Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"post-slider-and-carousel","name":"Post Slider and Post Carousel with Post Vertical Scrolling Widget \u2013 A Responsive Post Slider","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"},{"type":"plugin","slug":"alt-manager","name":"Image Alt Text Manager \u2013 Bulk & Dynamic Alt Tags For image SEO Optimization + AI","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.6"},{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.21.0"},{"type":"plugin","slug":"embedder-for-google-reviews","name":"Embedder for Google Reviews","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.7.5"},{"type":"plugin","slug":"restaurant-cafe-addon-for-elementor","name":"Restaurant & Cafe Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-04-30T17:17:30Z","updated":"2026-10-16T18:48:53Z"},{"id":"wordfence:d6951a50-954b-4c2b-8499-7623027406c8","source":"wordfence","cve":"CVE-2024-31084","title":"Weekly Class Schedule <= 3.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6951a50-954b-4c2b-8499-7623027406c8?source=api-prod","affected":[{"type":"plugin","slug":"weekly-class-schedule","name":"Weekly Class Schedule","from":"*","from_inclusive":true,"to":"3.19","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:10:59Z"},{"id":"wordfence:d69915e9-af9b-4c07-ac43-21c6e350c3c4","source":"wordfence","cve":"CVE-2023-51538","title":"Awesome Support <= 6.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d69915e9-af9b-4c07-ac43-21c6e350c3c4?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d69cfed9-7369-40f3-b9a7-0cf2430e8eed","source":"wordfence","cve":"CVE-2023-1651","title":"ChatBot <= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d69cfed9-7369-40f3-b9a7-0cf2430e8eed?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2023-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d69ef230-2c98-4915-bd59-91d7c1a3ccb4","source":"wordfence","cve":"CVE-2026-39754","title":"Piotnet Addons For Elementor <= 7.1.71 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d69ef230-2c98-4915-bd59-91d7c1a3ccb4?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"7.1.71","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T11:57:39Z","updated":"2026-10-08T23:26:21Z"},{"id":"wordfence:d6a1a2c2-e754-43e5-84b5-579a805c8d71","source":"wordfence","cve":"","title":"Bookshelf <= 2.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a1a2c2-e754-43e5-84b5-579a805c8d71?source=api-prod","affected":[{"type":"plugin","slug":"bookshelf","name":"Bookshelf","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6a1eb50-c482-4ae2-8d34-798997a12c33","source":"wordfence","cve":"CVE-2025-55714","title":"JetElements For Elementor <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a1eb50-c482-4ae2-8d34-798997a12c33?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.7.9.1"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T21:08:30Z"},{"id":"wordfence:d6a44d36-43e6-4785-b2bc-0b4b98d847e7","source":"wordfence","cve":"CVE-2023-28779","title":"Terms Descriptions <= 3.4.4 - Reflected Cross-Site Scripting via term_search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a44d36-43e6-4785-b2bc-0b4b98d847e7?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6a4872e-0f62-44b1-b77e-0817b065980f","source":"wordfence","cve":"CVE-2018-20985","title":"WP Payeezy Pay < 2.98 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a4872e-0f62-44b1-b77e-0817b065980f?source=api-prod","affected":[{"type":"plugin","slug":"wp-payeezy-pay","name":"WP Payeezy Pay","from":"*","from_inclusive":true,"to":"2.98","to_inclusive":false,"patched_in":"2.98"}],"published":"2018-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6a51962-fe99-4911-85c9-a75bd18e74c2","source":"wordfence","cve":"CVE-2019-17670","title":"WordPress Core < 5.2.4 - Server Side Request Forgery #2","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a51962-fe99-4911-85c9-a75bd18e74c2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6a60159-5aa6-40fd-a1ea-320b56fd8b91","source":"wordfence","cve":"CVE-2024-34797","title":"Simple Popup Manager <= 1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a60159-5aa6-40fd-a1ea-320b56fd8b91?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-manager","name":"Simple Popup Manager","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:02:22Z"},{"id":"wordfence:d6a73a7f-53ac-4930-a1cd-c39818f64678","source":"wordfence","cve":"CVE-2024-3345","title":"ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a73a7f-53ac-4930-a1cd-c39818f64678?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2024-05-20T19:41:22Z","updated":"2024-05-21T08:31:06Z"},{"id":"wordfence:d6a7f882-4582-4b08-9597-329d140ad782","source":"wordfence","cve":"CVE-2023-5426","title":"Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a7f882-4582-4b08-9597-329d140ad782?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6a866b4-e915-4b60-ac76-e65f698e73c4","source":"wordfence","cve":"CVE-2025-47668","title":"CookieCode <= 2.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a866b4-e915-4b60-ac76-e65f698e73c4?source=api-prod","affected":[{"type":"plugin","slug":"cookiecode","name":"CookieCode","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:12:08Z"},{"id":"wordfence:d6a99806-cb8f-4c12-86ed-2cdbb45ba873","source":"wordfence","cve":"CVE-2025-11260","title":"WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a99806-cb8f-4c12-86ed-2cdbb45ba873?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-headless","name":"WP Headless CMS Framework","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T00:00:00Z","updated":"2025-11-13T08:27:47Z"},{"id":"wordfence:d6ac2996-098f-474c-b44e-78d5af7b503a","source":"wordfence","cve":"CVE-2025-2505","title":"Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ac2996-098f-474c-b44e-78d5af7b503a?source=api-prod","affected":[{"type":"plugin","slug":"age-gate","name":"Age Gate","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-20T07:29:58Z"},{"id":"wordfence:d6ad49ff-85eb-4d05-ba23-51d89695add3","source":"wordfence","cve":"CVE-2026-89274","title":"WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ad49ff-85eb-4d05-ba23-51d89695add3?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.8.1","to_inclusive":true,"patched_in":"10.8.2"}],"published":"2026-09-18T14:11:20Z","updated":"2026-09-19T02:27:11Z"},{"id":"wordfence:d6ad5464-6fc3-40ce-add5-4993b70a6c1a","source":"wordfence","cve":"","title":"WordPress Core 6.9.0 - 7.1.3 - Authenticated (Custom+) Incorrect Authorization to Read, Modify, and Delete Notes via REST API","severity":"low","cvss":3.8,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ad5464-6fc3-40ce-add5-4993b70a6c1a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.9.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.9.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.9.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T18:17:32Z"},{"id":"wordfence:d6ad88ba-717e-4ca1-8527-40bfe54cc5e2","source":"wordfence","cve":"CVE-2026-94275","title":"Track Orders for WooCommerce \u2013 Multi Carrier WooCommerce Shipping < 1.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ad88ba-717e-4ca1-8527-40bfe54cc5e2?source=api-prod","affected":[{"type":"plugin","slug":"track-orders-for-woocommerce","name":"Track Orders for WooCommerce \u2013 Multi Carrier WooCommerce Shipping","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:32:52Z"},{"id":"wordfence:d6ae4764-8792-4457-bc75-f26f9d0284b6","source":"wordfence","cve":"CVE-2025-12684","title":"URL Shortify <= 1.11.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ae4764-8792-4457-bc75-f26f9d0284b6?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.11.3"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-19T20:26:41Z"},{"id":"wordfence:d6ae7c9f-852d-428f-a469-6bfeead53db5","source":"wordfence","cve":"CVE-2021-34630","title":"GTranslate Pro and GTranslate Enterprise <= 2.8.64 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ae7c9f-852d-428f-a469-6bfeead53db5?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"2.8.65","to_inclusive":false,"patched_in":"2.8.65"}],"published":"2021-07-23T15:18:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6af7c1f-baee-49d5-a11e-34414f7cc99a","source":"wordfence","cve":"CVE-2026-52708","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6af7c1f-baee-49d5-a11e-34414f7cc99a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-10-29T14:15:00Z","updated":"2026-11-03T20:01:05Z"},{"id":"wordfence:d6b37e1b-ebfb-49dd-a7b8-73ace468b893","source":"wordfence","cve":"CVE-2025-39369","title":"Posts for Page <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b37e1b-ebfb-49dd-a7b8-73ace468b893?source=api-prod","affected":[{"type":"plugin","slug":"posts-for-page","name":"Posts for Page","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:04:23Z"},{"id":"wordfence:d6b6d824-51d3-4da9-a39a-b957368df4dc","source":"wordfence","cve":"CVE-2024-1512","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b6d824-51d3-4da9-a39a-b957368df4dc?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2024-02-16T00:00:00Z","updated":"2024-02-17T07:36:58Z"},{"id":"wordfence:d6b78324-cc94-47fd-ab1c-0c1593807c20","source":"wordfence","cve":"CVE-2026-91024","title":"Booking Manager <= 2.1.20 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b78324-cc94-47fd-ab1c-0c1593807c20?source=api-prod","affected":[{"type":"plugin","slug":"booking-manager","name":"Booking Manager \u2013 Sync WP Booking Calendar \u2013 Import Events, Export Bookings to ICS Calendar","from":"*","from_inclusive":true,"to":"2.1.20","to_inclusive":true,"patched_in":"2.1.21"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:43:51Z"},{"id":"wordfence:d6b8ba69-aa8b-436f-990c-39e283f5d2f2","source":"wordfence","cve":"CVE-2024-2384","title":"WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b8ba69-aa8b-436f-990c-39e283f5d2f2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pos","name":"WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.11","to_inclusive":true,"patched_in":"1.4.12"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T02:35:43Z"},{"id":"wordfence:d6bb08e8-9ef5-41db-a111-c377a5dfae77","source":"wordfence","cve":"CVE-2023-4792","title":"Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bb08e8-9ef5-41db-a111-c377a5dfae77?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post-page-menu-custom-post-type","name":"Duplicate Post Page Menu & Custom Post Type","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6bb8b44-a5b4-4909-9e2e-7123ae0737c9","source":"wordfence","cve":"CVE-2025-49041","title":"Get Cash <= 3.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bb8b44-a5b4-4909-9e2e-7123ae0737c9?source=api-prod","affected":[{"type":"plugin","slug":"get-cash","name":"Get Cash","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-12-01T00:00:00Z","updated":"2026-10-13T16:57:14Z"},{"id":"wordfence:d6bc11cd-157f-403f-90db-071208902d1c","source":"wordfence","cve":"CVE-2025-31620","title":"CoverManager <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bc11cd-157f-403f-90db-071208902d1c?source=api-prod","affected":[{"type":"plugin","slug":"covermanager","name":"CoverManager","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T13:15:16Z"},{"id":"wordfence:d6bf72a2-fc09-49a5-b848-b007e21f1da9","source":"wordfence","cve":"CVE-2026-39777","title":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace <= 2.12.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bf72a2-fc09-49a5-b848-b007e21f1da9?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-membership","name":"WCFM Membership \u2013 WooCommerce Memberships for Multivendor Marketplace","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:38:57Z"},{"id":"wordfence:d6bf752e-56be-42fc-b2d7-0a9658287c3b","source":"wordfence","cve":"CVE-2025-23642","title":"Sidebar-Content from Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bf752e-56be-42fc-b2d7-0a9658287c3b?source=api-prod","affected":[{"type":"plugin","slug":"sidebar-content-from-shortcode","name":"Sidebar-Content from Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:31:04Z"},{"id":"wordfence:d6c1ba13-9c1a-4ba8-b481-677bf0b1534b","source":"wordfence","cve":"CVE-2025-63047","title":"ListingPro <= 2.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c1ba13-9c1a-4ba8-b481-677bf0b1534b?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-19T00:00:00Z","updated":"2025-12-10T16:15:24Z"},{"id":"wordfence:d6c277f4-28e0-4159-a524-6576d72d2059","source":"wordfence","cve":"CVE-2025-14122","title":"AD Sliding FAQ <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c277f4-28e0-4159-a524-6576d72d2059?source=api-prod","affected":[{"type":"plugin","slug":"ad-sliding-faq","name":"AD Sliding FAQ","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2026-01-06T20:39:10Z","updated":"2026-06-26T18:21:46Z"},{"id":"wordfence:d6c5451b-0967-47c9-b7e7-0c2194fd24e9","source":"wordfence","cve":"CVE-2026-57742","title":"Kids Planet - Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c5451b-0967-47c9-b7e7-0c2194fd24e9?source=api-prod","affected":[{"type":"theme","slug":"kidsplanet","name":"Kids Planet - Children Kindergarten and Playgroup WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.14.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T12:55:36Z","updated":"2026-10-13T13:53:32Z"},{"id":"wordfence:d6c78f4b-97e5-4581-a776-4edb04871de8","source":"wordfence","cve":"CVE-2025-68509","title":"User Submitted Posts <= 20251121 - Unauthenticated Open Redirect","severity":"medium","cvss":5.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c78f4b-97e5-4581-a776-4edb04871de8?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20251121","to_inclusive":true,"patched_in":"20251210"}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-05T21:37:32Z"},{"id":"wordfence:d6c85f2b-965d-477f-9d9a-4a3f315c4904","source":"wordfence","cve":"CVE-2024-9608","title":"MyParcel <= 4.24.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c85f2b-965d-477f-9d9a-4a3f315c4904?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-myparcel","name":"MyParcel","from":"*","from_inclusive":true,"to":"4.24.1","to_inclusive":true,"patched_in":"4.24.2"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T11:23:44Z"},{"id":"wordfence:d6c906b3-8819-409c-946a-eeb9d938142d","source":"wordfence","cve":"","title":"VRView <= 1.1.3 and WP-VR-view <= 1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c906b3-8819-409c-946a-eeb9d938142d?source=api-prod","affected":[{"type":"plugin","slug":"vrview","name":"VRView","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-vr-view","name":"WP-VR-view \u2013 Add Photo Sphere, 360 video to WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2018-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6cbec61-cbe8-44a6-8cc8-8603393ed6b0","source":"wordfence","cve":"","title":"WooCommerce Beta Tester < 2.2.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6cbec61-cbe8-44a6-8cc8-8603393ed6b0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-beta-tester","name":"WooCommerce Beta Tester","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":false,"patched_in":"2.2.4"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6cc17a6-994c-4ac4-8175-263add849b1b","source":"wordfence","cve":"CVE-2024-10896","title":"Logo Slider <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6cc17a6-994c-4ac4-8175-263add849b1b?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2024-11-07T00:00:00Z","updated":"2025-02-26T22:46:47Z"},{"id":"wordfence:d6cef95b-3826-497c-8908-b5f24701d7e7","source":"wordfence","cve":"CVE-2025-66156","title":"Watcher for Elementor <= 1.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6cef95b-3826-497c-8908-b5f24701d7e7?source=api-prod","affected":[{"type":"plugin","slug":"watcher-elementor","name":"Watcher \u2013 Flexible Video Player for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T20:56:53Z"},{"id":"wordfence:d6d0651a-c2e2-4985-927c-b60e80475450","source":"wordfence","cve":"CVE-2025-64366","title":"MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d0651a-c2e2-4985-927c-b60e80475450?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.6.27","to_inclusive":true,"patched_in":"3.6.28"}],"published":"2025-10-23T00:00:00Z","updated":"2025-11-04T15:34:34Z"},{"id":"wordfence:d6d3396d-708d-45de-b32a-66e17624dc62","source":"wordfence","cve":"CVE-2024-48038","title":"wp-Monalisa <= 6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d3396d-708d-45de-b32a-66e17624dc62?source=api-prod","affected":[{"type":"plugin","slug":"wp-monalisa","name":"wp-Monalisa","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.5"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:46:16Z"},{"id":"wordfence:d6d394af-67b0-4754-bdec-6ee89b7e8bbd","source":"wordfence","cve":"CVE-2013-3253","title":"Xhanch \u2013 My Twitter <= 2.7.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d394af-67b0-4754-bdec-6ee89b7e8bbd?source=api-prod","affected":[{"type":"plugin","slug":"xhanch-my-twitter","name":"Xhanch \u2013 My Twitter","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6d6391a-542a-41c1-8eec-07ad5e77abdd","source":"wordfence","cve":"CVE-2026-40746","title":"Restaurant Zone <= 0.7.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d6391a-542a-41c1-8eec-07ad5e77abdd?source=api-prod","affected":[{"type":"theme","slug":"restaurant-zone","name":"Restaurant Zone","from":"*","from_inclusive":true,"to":"0.7.8","to_inclusive":true,"patched_in":"0.7.9"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:29:09Z"},{"id":"wordfence:d6d69ffd-bb39-4fcc-9444-27d1a901e7c9","source":"wordfence","cve":"CVE-2024-13562","title":"Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d69ffd-bb39-4fcc-9444-27d1a901e7c9?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.14.5","to_inclusive":true,"patched_in":"2.14.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-25T11:22:37Z"},{"id":"wordfence:d6d8cf85-6925-4bd9-83e4-88e4dba430ed","source":"wordfence","cve":"CVE-2024-50472","title":"Amilia Store <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d8cf85-6925-4bd9-83e4-88e4dba430ed?source=api-prod","affected":[{"type":"plugin","slug":"amilia-store","name":"Amilia Store","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:14:57Z"},{"id":"wordfence:d6da166e-10b4-4a4e-967c-6261d68144dc","source":"wordfence","cve":"CVE-2026-49085","title":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6da166e-10b4-4a4e-967c-6261d68144dc?source=api-prod","affected":[{"type":"plugin","slug":"cf7-insightly","name":"WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:42:26Z"},{"id":"wordfence:d6dcbd8c-018e-4c1b-8827-792300b3a5b1","source":"wordfence","cve":"CVE-2025-39454","title":"Name Directory <= 1.30.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6dcbd8c-018e-4c1b-8827-792300b3a5b1?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.30.0","to_inclusive":true,"patched_in":"1.30.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:18:17Z"},{"id":"wordfence:d6de5295-cb13-4e53-bcb2-3fc6c95b849a","source":"wordfence","cve":"CVE-2025-27358","title":"Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6de5295-cb13-4e53-bcb2-3fc6c95b849a?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2026-05-19T14:55:50Z"},{"id":"wordfence:d6dfed14-bb6f-4418-bdd8-9c548e63dac0","source":"wordfence","cve":"CVE-2016-6897","title":"WordPress Core < 4.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6dfed14-bb6f-4418-bdd8-9c548e63dac0?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":false,"patched_in":"4.6"}],"published":"2016-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6e1335c-17f8-4162-95c1-7b6a9cc94c94","source":"wordfence","cve":"CVE-2025-4955","title":"tarteaucitron.io <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e1335c-17f8-4162-95c1-7b6a9cc94c94?source=api-prod","affected":[{"type":"plugin","slug":"tarteaucitronjs","name":"tarteaucitron.io \u2013 Cookie Banner & GDPR Consent Management","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2025-05-28T00:00:00Z","updated":"2025-07-08T20:11:30Z"},{"id":"wordfence:d6e16234-ec7b-466f-bc11-e80e63dec49f","source":"wordfence","cve":"CVE-2026-42754","title":"Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e16234-ec7b-466f-bc11-e80e63dec49f?source=api-prod","affected":[{"type":"plugin","slug":"favicon-by-realfavicongenerator","name":"Favicon by RealFaviconGenerator","from":"*","from_inclusive":true,"to":"1.3.46","to_inclusive":true,"patched_in":"1.3.47"}],"published":"2026-05-30T00:00:00Z","updated":"2026-06-01T16:04:04Z"},{"id":"wordfence:d6e1cc0d-2c5f-4e34-bd19-d7c90cd4dff6","source":"wordfence","cve":"CVE-2024-8803","title":"Bulk NoIndex & NoFollow Toolkit <= 2.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e1cc0d-2c5f-4e34-bd19-d7c90cd4dff6?source=api-prod","affected":[{"type":"plugin","slug":"bulk-noindex-nofollow-toolkit-by-mad-fish","name":"Bulk NoIndex & NoFollow Toolkit","from":"*","from_inclusive":true,"to":"2.15","to_inclusive":true,"patched_in":"2.16"}],"published":"2024-09-25T13:45:17Z","updated":"2024-09-26T02:03:26Z"},{"id":"wordfence:d6e36098-fdee-41cb-b2c5-187ac2f73f0e","source":"wordfence","cve":"CVE-2025-49249","title":"Drone <= 1.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e36098-fdee-41cb-b2c5-187ac2f73f0e?source=api-prod","affected":[{"type":"theme","slug":"drone","name":"Drone Media | Aerial Photography & Videography Theme","from":"*","from_inclusive":true,"to":"1.40","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:49:00Z"},{"id":"wordfence:d6e7b44c-fe94-493b-846b-57c40e00d8fe","source":"wordfence","cve":"CVE-2023-0080","title":"Customer Reviews for WooCommerce <= 5.15.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e7b44c-fe94-493b-846b-57c40e00d8fe?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.15.0","to_inclusive":true,"patched_in":"5.16.0"}],"published":"2023-01-23T00:00:00Z","updated":"2024-06-17T17:06:47Z"},{"id":"wordfence:d6e87973-6001-439b-aef8-805ba4275d27","source":"wordfence","cve":"CVE-2026-56066","title":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization <= 3.11.4 - Unauthenticated Arbitrary File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e87973-6001-439b-aef8-805ba4275d27?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.11.4","to_inclusive":true,"patched_in":"3.11.5"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:57:36Z"},{"id":"wordfence:d6e8b7b6-d7f8-4b2a-a5f9-ef2d2560d12b","source":"wordfence","cve":"CVE-2025-57911","title":"Adverts <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6e8b7b6-d7f8-4b2a-a5f9-ef2d2560d12b?source=api-prod","affected":[{"type":"plugin","slug":"adverts-click-tracker","name":"WordPress Adverts Plugin \u2013 Adverts Click Tracker","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:15:49Z"},{"id":"wordfence:d6ea95b5-9e1c-41b1-9bc5-5fd5cecef65d","source":"wordfence","cve":"CVE-2024-5229","title":"Primary Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ea95b5-9e1c-41b1-9bc5-5fd5cecef65d?source=api-prod","affected":[{"type":"plugin","slug":"primary-addon-for-elementor","name":"Primary Addon for Elementor","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-05-24T14:12:13Z","updated":"2024-05-25T02:34:24Z"},{"id":"wordfence:d6eb094a-4f5a-418a-ba95-635765abfcff","source":"wordfence","cve":"CVE-2024-8436","title":"WP Easy Gallery \u2013 WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eb094a-4f5a-418a-ba95-635765abfcff?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-gallery","name":"WP Easy Gallery \u2013 WordPress Gallery Plugin","from":"*","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-23T18:51:50Z","updated":"2024-09-24T07:30:47Z"},{"id":"wordfence:d6eb878a-6f4b-4668-993d-d33a50abd618","source":"wordfence","cve":"CVE-2025-50032","title":"Paytiko for WooCommerce <= 1.4.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eb878a-6f4b-4668-993d-d33a50abd618?source=api-prod","affected":[{"type":"plugin","slug":"paytiko","name":"Paytiko for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2025-07-03T00:00:00Z","updated":"2026-06-18T14:02:49Z"},{"id":"wordfence:d6eba6da-ac14-4914-a807-6e234b80ee71","source":"wordfence","cve":"CVE-2025-10002","title":"ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6eba6da-ac14-4914-a807-6e234b80ee71?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2025-09-19T15:50:33Z","updated":"2025-09-20T04:27:56Z"},{"id":"wordfence:d6ebb590-1291-45dc-818a-258143a2d9a2","source":"wordfence","cve":"CVE-2024-31355","title":"Slideshow Gallery <= 1.7.8 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ebb590-1291-45dc-818a-258143a2d9a2?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-gallery","name":"Slideshow Gallery LITE","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2024-04-07T00:00:00Z","updated":"2024-05-15T17:32:39Z"},{"id":"wordfence:d6ec09e5-4994-4d23-bf8e-26b64d5303fa","source":"wordfence","cve":"CVE-2024-10855","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ec09e5-4994-4d23-bf8e-26b64d5303fa?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:56Z"},{"id":"wordfence:d6ec0bfd-6b3f-4de5-a7ea-73e35339202c","source":"wordfence","cve":"CVE-2024-50459","title":"WordPress Stripe Donation and Payment Plugin <= 3.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ec0bfd-6b3f-4de5-a7ea-73e35339202c?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-donation","name":"AidWP \u2013 Donation & Payment Forms (Stripe Powered)","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T20:14:26Z"},{"id":"wordfence:d6f15838-598c-4da4-ade1-0356ec8f6c3b","source":"wordfence","cve":"CVE-2024-13625","title":"Tube Video Ads Lite <= 1.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f15838-598c-4da4-ade1-0356ec8f6c3b?source=api-prod","affected":[{"type":"plugin","slug":"tube-video-ads-lite","name":"Tube Video Ads Lite","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-01-30T21:57:21Z"},{"id":"wordfence:d6f20fc3-41e5-4220-ac8b-54eb11719f07","source":"wordfence","cve":"CVE-2015-10102","title":"Freshdesk (official) <= 1.7 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f20fc3-41e5-4220-ac8b-54eb11719f07?source=api-prod","affected":[{"type":"plugin","slug":"freshdesk-support","name":"Freshdesk (official)","from":"1.7","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6f319c1-6bf4-41c7-826f-fb752777ec14","source":"wordfence","cve":"CVE-2025-58990","title":"ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f319c1-6bf4-41c7-826f-fb752777ec14?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:36:58Z"},{"id":"wordfence:d6f3de97-5b87-49e4-9239-f405f72b893a","source":"wordfence","cve":"CVE-2024-37507","title":"Eventin <= 3.3.57 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f3de97-5b87-49e4-9239-f405f72b893a?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"3.3.57","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T20:51:08Z"},{"id":"wordfence:d6f5092a-dc71-4290-b443-085a3595bb1a","source":"wordfence","cve":"CVE-2024-51636","title":"GMO Social Connection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f5092a-dc71-4290-b443-085a3595bb1a?source=api-prod","affected":[{"type":"plugin","slug":"gmo-social-connection","name":"Plugin Name: GMO Social Connection","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:49:11Z"},{"id":"wordfence:d6f68904-e575-457d-9040-c791b645e6c8","source":"wordfence","cve":"CVE-2012-10027","title":"WP Property <= 1.35.0 - Remote File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f68904-e575-457d-9040-c791b645e6c8?source=api-prod","affected":[{"type":"plugin","slug":"wp-property","name":"WP-Property \u2013 WordPress Powered Real Estate and Property Management","from":"*","from_inclusive":true,"to":"1.35.0","to_inclusive":true,"patched_in":"1.35.1"}],"published":"2012-06-05T00:00:00Z","updated":"2025-08-22T18:51:36Z"},{"id":"wordfence:d6f6a941-972d-420f-bc56-e4b955e30313","source":"wordfence","cve":"CVE-2026-92895","title":"Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f6a941-972d-420f-bc56-e4b955e30313?source=api-prod","affected":[{"type":"plugin","slug":"live-2d","name":"Live2DWebCanvas","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-05T22:01:15Z","updated":"2026-11-06T11:17:38Z"},{"id":"wordfence:d6f9ed45-f3a0-468a-ad11-d6d8ecaf79fb","source":"wordfence","cve":"CVE-2025-60226","title":"White Rabbit <= 1.5.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6f9ed45-f3a0-468a-ad11-d6d8ecaf79fb?source=api-prod","affected":[{"type":"theme","slug":"whiterabbit","name":"White Rabbit - Kids Toys & Children Clothing Store","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-11-04T18:27:40Z"},{"id":"wordfence:d6fa45e2-d082-472f-920d-35cb26d7261b","source":"wordfence","cve":"CVE-2025-68990","title":"BWL Pro Voting Manager <= 1.4.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fa45e2-d082-472f-920d-35cb26d7261b?source=api-prod","affected":[{"type":"plugin","slug":"bwl-pro-voting-manager","name":"BWL Pro Voting Manager","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T15:24:29Z"},{"id":"wordfence:d6fac092-803f-42ec-8840-bdc929d00d62","source":"wordfence","cve":"CVE-2025-49389","title":"Notice Bar <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fac092-803f-42ec-8840-bdc929d00d62?source=api-prod","affected":[{"type":"plugin","slug":"notice-bar","name":"Notice Bar","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:01:30Z"},{"id":"wordfence:d6fb275b-dbba-46df-b170-977ef4a84c4c","source":"wordfence","cve":"CVE-2026-6518","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fb275b-dbba-46df-b170-977ef4a84c4c?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.16","to_inclusive":true,"patched_in":"4.1.17"}],"published":"2026-04-17T15:02:18Z","updated":"2026-04-18T03:37:05Z"},{"id":"wordfence:d6fb5839-c4c3-422d-8418-5f4dc36cdb39","source":"wordfence","cve":"CVE-2025-48328","title":"Real Time Validation for Gravity Forms <= 1.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fb5839-c4c3-422d-8418-5f4dc36cdb39?source=api-prod","affected":[{"type":"plugin","slug":"real-time-validation-for-gravity-forms","name":"Real Time Validation for Gravity Forms","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:55:46Z"},{"id":"wordfence:d6fbf684-8651-484d-9459-ed11d6d9008f","source":"wordfence","cve":"CVE-2024-48029","title":"SB Random Posts Widget <= 1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fbf684-8651-484d-9459-ed11d6d9008f?source=api-prod","affected":[{"type":"plugin","slug":"sb-random-posts-widget","name":"SB Random Posts Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:53:20Z"},{"id":"wordfence:d6fc087b-c28d-4c6a-a59f-085773d542dd","source":"wordfence","cve":"","title":"Smoke Signal < 1.2.7 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fc087b-c28d-4c6a-a59f-085773d542dd?source=api-prod","affected":[{"type":"plugin","slug":"smokesignal","name":"SmokeSignal","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2017-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d6fcd334-4d9a-4c11-ab11-b96cdda698c4","source":"wordfence","cve":"CVE-2024-10684","title":"Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fcd334-4d9a-4c11-ab11-b96cdda698c4?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:20Z"},{"id":"wordfence:d6fcec03-4782-467a-ab8d-1c775ab40d3f","source":"wordfence","cve":"CVE-2025-47618","title":"BMI Adult & Kid Calculator <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fcec03-4782-467a-ab8d-1c775ab40d3f?source=api-prod","affected":[{"type":"plugin","slug":"bmi-adultkid-calculator","name":"BMI Adult & Kid Calculator","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-05-08T00:00:00Z","updated":"2026-10-28T21:07:33Z"},{"id":"wordfence:d6ffc8de-e8e4-41b6-a4b9-79511fb950fc","source":"wordfence","cve":"CVE-2026-4143","title":"Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ffc8de-e8e4-41b6-a4b9-79511fb950fc?source=api-prod","affected":[{"type":"plugin","slug":"neos-connector-for-fakturama","name":"Neos Connector for Fakturama","from":"*","from_inclusive":true,"to":"0.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:46Z","updated":"2026-03-21T03:27:08Z"},{"id":"wordfence:d7023a3e-35ba-4d52-8092-ae40b53d5efa","source":"wordfence","cve":"CVE-2024-8492","title":"Hustle <= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7023a3e-35ba-4d52-8092-ae40b53d5efa?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.4","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2024-07-29T00:00:00Z","updated":"2024-10-11T16:45:15Z"},{"id":"wordfence:d703abc2-3269-42b2-a75c-d163df62260d","source":"wordfence","cve":"","title":"Jetpack <= 6.4.2 - Cross-Site Scripting via post_meta","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d703abc2-3269-42b2-a75c-d163df62260d?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.5"}],"published":"2018-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7051345-8ca6-42e0-95fb-e127e65a5ef2","source":"wordfence","cve":"CVE-2024-4002","title":"Carousel, Slider, Gallery by WP Carousel <= 2.6.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7051345-8ca6-42e0-95fb-e127e65a5ef2?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-10-30T00:00:00Z","updated":"2025-02-21T19:52:35Z"},{"id":"wordfence:d707d766-a46d-49f5-b1be-a9b9e423e61e","source":"wordfence","cve":"CVE-2024-49274","title":"VOD Infomaniak <= 1.5.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d707d766-a46d-49f5-b1be-a9b9e423e61e?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:49:10Z"},{"id":"wordfence:d70e9d4e-2137-411b-bc01-28388a7b2519","source":"wordfence","cve":"CVE-2023-34371","title":"SpamReferrerBlock <= 2.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d70e9d4e-2137-411b-bc01-28388a7b2519?source=api-prod","affected":[{"type":"plugin","slug":"spamreferrerblock","name":"SpamReferrerBlock","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d70eed02-d362-4bbe-aba0-df46e61777a3","source":"wordfence","cve":"CVE-2025-23880","title":"amr personalise <= 2.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d70eed02-d362-4bbe-aba0-df46e61777a3?source=api-prod","affected":[{"type":"plugin","slug":"amr-personalise","name":"amr personalise","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:36:52Z"},{"id":"wordfence:d71143d6-d477-4a63-8f99-f4cc8a590536","source":"wordfence","cve":"CVE-2025-14063","title":"SEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d71143d6-d477-4a63-8f99-f4cc8a590536?source=api-prod","affected":[{"type":"plugin","slug":"seo-links-interlinking","name":"SEO Links Interlinking","from":"*","from_inclusive":true,"to":"1.7.9.9.1","to_inclusive":true,"patched_in":"1.7.9.9.2"}],"published":"2026-01-27T21:46:45Z","updated":"2026-02-06T17:27:08Z"},{"id":"wordfence:d713ff91-30ba-474d-87ca-39b15c77b30a","source":"wordfence","cve":"CVE-2024-34437","title":"Form Maker by 10Web <= 1.15.24 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d713ff91-30ba-474d-87ca-39b15c77b30a?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.24","to_inclusive":true,"patched_in":"1.15.25"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:45:49Z"},{"id":"wordfence:d7140a6e-a528-428e-850e-5e4a481c5d7d","source":"wordfence","cve":"CVE-2025-0180","title":"WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.7","to_inclusive":true,"patched_in":"4.8"}],"published":"2025-02-10T00:00:00Z","updated":"2025-02-28T17:54:34Z"},{"id":"wordfence:d714d740-d7e0-49fd-af08-b4a80c9d0599","source":"wordfence","cve":"CVE-2025-12830","title":"Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d714d740-d7e0-49fd-af08-b4a80c9d0599?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-12-11T14:24:03Z","updated":"2026-01-06T20:24:45Z"},{"id":"wordfence:d7184e6d-ae46-4725-b464-b9ccb5d518e1","source":"wordfence","cve":"CVE-2026-59560","title":"FundEngine <= 1.7.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7184e6d-ae46-4725-b464-b9ccb5d518e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:21:15Z"},{"id":"wordfence:d7195b51-f88e-4f44-b8fa-484f8c8fdae7","source":"wordfence","cve":"CVE-2024-56285","title":"WPBITS Addons For Elementor Page Builder <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7195b51-f88e-4f44-b8fa-484f8c8fdae7?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:26:10Z"},{"id":"wordfence:d719876f-d435-4065-8fb8-92acfa5bfcc2","source":"wordfence","cve":"CVE-2026-107436","title":"Strong Testimonials <= 3.3.12 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d719876f-d435-4065-8fb8-92acfa5bfcc2?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2026-10-16T10:41:53Z","updated":"2026-10-23T18:22:31Z"},{"id":"wordfence:d7199a4e-5811-4860-911b-b5d3fda24e16","source":"wordfence","cve":"CVE-2026-104926","title":"WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7199a4e-5811-4860-911b-b5d3fda24e16?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-extra-product-options-pro","name":"WooCommerce Extra Product Options Pro","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-10-30T20:57:27Z","updated":"2026-10-31T09:29:28Z"},{"id":"wordfence:d71caa62-6f77-44a6-8645-a27a08a48a78","source":"wordfence","cve":"CVE-2017-6575","title":"Mail Masta <= 1.0 - SQL Injection via member_id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d71caa62-6f77-44a6-8645-a27a08a48a78?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d71cdd64-7cd6-4b1a-ae8d-e9bf78e630c7","source":"wordfence","cve":"CVE-2024-8727","title":"DK PDF <= 1.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d71cdd64-7cd6-4b1a-ae8d-e9bf78e630c7?source=api-prod","affected":[{"type":"plugin","slug":"dk-pdf","name":"DK PDF \u2013 WordPress PDF Generator","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-04T12:30:47Z"},{"id":"wordfence:d7220537-aad0-48e0-81f1-7104ec15ffbe","source":"wordfence","cve":"CVE-2021-24572","title":"Accept Donations with PayPal <= 1.3.0 Cross-Site Request Forgery to Post Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7220537-aad0-48e0-81f1-7104ec15ffbe?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-donation","name":"Accept Donations with PayPal & Stripe","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d722ec8d-bfca-4da1-8eb0-8d33735c5e44","source":"wordfence","cve":"CVE-2025-0181","title":"WP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d722ec8d-bfca-4da1-8eb0-8d33735c5e44?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-10T00:00:00Z","updated":"2025-02-28T15:42:09Z"},{"id":"wordfence:d7258fc0-725e-47b6-ae8f-9e99a8781609","source":"wordfence","cve":"CVE-2025-69302","title":"DesignThemes Core Features <= 2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7258fc0-725e-47b6-ae8f-9e99a8781609?source=api-prod","affected":[{"type":"plugin","slug":"designthemes-core-features","name":"DesignThemes Core Features","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:17:58Z"},{"id":"wordfence:d7261e93-2341-4e14-a9b3-8fec295f6cde","source":"wordfence","cve":"","title":"Smart Slider 3 Pro  3.5.1.35 - Backdoor Embedded via Supply Chain Compromise","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7261e93-2341-4e14-a9b3-8fec295f6cde?source=api-prod","affected":[{"type":"plugin","slug":"nextend-smart-slider3-pro","name":"Smart Slider 3 Pro","from":"3.5.1.35","from_inclusive":true,"to":"3.5.1.35","to_inclusive":true,"patched_in":"3.5.1.36"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:23:06Z"},{"id":"wordfence:d726543c-9ce2-4359-978d-c72a451296a2","source":"wordfence","cve":"CVE-2026-16135","title":"VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d726543c-9ce2-4359-978d-c72a451296a2?source=api-prod","affected":[{"type":"plugin","slug":"vibebp","name":"VibeBP","from":"*","from_inclusive":true,"to":"1.9.9.8.1","to_inclusive":true,"patched_in":"1.9.9.8.2"}],"published":"2026-11-11T22:33:53Z","updated":"2026-11-12T11:32:17Z"},{"id":"wordfence:d7274e11-dcd4-471b-bfaf-ae90d0e4d7e6","source":"wordfence","cve":"CVE-2026-40790","title":"WSMS (formerly WP SMS) \u2013 SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7274e11-dcd4-471b-bfaf-ae90d0e4d7e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-sms","name":"WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T15:08:45Z"},{"id":"wordfence:d7285cfb-faba-4769-8f2e-9e14e6af604d","source":"wordfence","cve":"CVE-2026-66638","title":"Frontend Admin by DynamiApps <= 3.29.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7285cfb-faba-4769-8f2e-9e14e6af604d?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.10","to_inclusive":true,"patched_in":"3.29.11"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:37:06Z"},{"id":"wordfence:d7298682-981e-4674-b56d-d68005c1399d","source":"wordfence","cve":"CVE-2026-103327","title":"CryptoCloud \u2013 Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7298682-981e-4674-b56d-d68005c1399d?source=api-prod","affected":[{"type":"plugin","slug":"cryptocloud-crypto-payment-gateway","name":"CryptoCloud \u2013 Crypto Payment Gateway","from":"3.0.0","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-31T00:00:00Z","updated":"2026-11-05T15:42:01Z"},{"id":"wordfence:d72c8140-90f1-49f5-bc42-925e29ecc0b1","source":"wordfence","cve":"CVE-2023-45653","title":"Video Playlist For YouTube <= 6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d72c8140-90f1-49f5-bc42-925e29ecc0b1?source=api-prod","affected":[{"type":"plugin","slug":"video-playlist-for-youtube","name":"Video Playlist for YouTube","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-25T14:49:45Z"},{"id":"wordfence:d72cc420-1ff5-403b-b4ea-7c820fdebcf3","source":"wordfence","cve":"CVE-2026-0633","title":"MetForm \u2013 Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value","severity":"low","cvss":3.7,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d72cc420-1ff5-403b-b4ea-7c820fdebcf3?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-01-23T19:35:07Z","updated":"2026-01-24T08:26:37Z"},{"id":"wordfence:d72d7a21-0bea-4a32-b92b-326f47998b80","source":"wordfence","cve":"CVE-2026-104021","title":"Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d72d7a21-0bea-4a32-b92b-326f47998b80?source=api-prod","affected":[{"type":"plugin","slug":"fastcache-by-host-it","name":"Fastcache by Host.it","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-10-09T15:38:40Z","updated":"2026-10-10T04:26:51Z"},{"id":"wordfence:d730645c-1bed-4d55-a192-e28e858a73b5","source":"wordfence","cve":"CVE-2025-48149","title":"Cook&Meal <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d730645c-1bed-4d55-a192-e28e858a73b5?source=api-prod","affected":[{"type":"theme","slug":"cookandmeal","name":"Cook&Meal - Food Blog & Recipe WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:07:17Z"},{"id":"wordfence:d731f7bf-d2de-4f5f-8c4a-627713bec348","source":"wordfence","cve":"CVE-2026-42661","title":"WP Customer Area <= 8.3.4 - Authenticated (Custom+) Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d731f7bf-d2de-4f5f-8c4a-627713bec348?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-04T13:47:11Z"},{"id":"wordfence:d7324a4e-ff45-4908-bcaa-379b130f73c0","source":"wordfence","cve":"CVE-2024-11732","title":"BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7324a4e-ff45-4908-bcaa-379b130f73c0?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-shortcodes-extra","name":"BP Profile Shortcodes Extra","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T19:31:04Z","updated":"2024-12-03T07:35:01Z"},{"id":"wordfence:d732ea2d-c763-4735-b541-6c5fd5167cb4","source":"wordfence","cve":"CVE-2023-24390","title":"WeSecur Security <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d732ea2d-c763-4735-b541-6c5fd5167cb4?source=api-prod","affected":[{"type":"plugin","slug":"wesecur-security","name":"WeSecur Security \u2013 Antivirus, Malware Scanner and Protection for your WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d734893b-fe81-42e0-99f5-153138953287","source":"wordfence","cve":"CVE-2025-69184","title":"Institutions Directory <= 1.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d734893b-fe81-42e0-99f5-153138953287?source=api-prod","affected":[{"type":"plugin","slug":"institutions-directory","name":"Institutions Directory","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:03:47Z"},{"id":"wordfence:d7362f3f-c5d9-4ba0-b9c3-282c58861e2f","source":"wordfence","cve":"CVE-2023-47841","title":"Analytify Dashboard <= 5.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7362f3f-c5d9-4ba0-b9c3-282c58861e2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2023-11-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7389e17-a357-481a-8716-3a93cb6afa7c","source":"wordfence","cve":"CVE-2025-7038","title":"LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function","severity":"high","cvss":8.2,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7389e17-a357-481a-8716-3a93cb6afa7c?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.94","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-09-29T16:24:40Z","updated":"2025-09-30T04:27:07Z"},{"id":"wordfence:d738be73-2573-4fb8-b6f0-768a08628265","source":"wordfence","cve":"CVE-2024-11094","title":"404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-488","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d738be73-2573-4fb8-b6f0-768a08628265?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.35.17","to_inclusive":true,"patched_in":"2.35.18"}],"published":"2024-11-15T20:57:53Z","updated":"2024-11-19T15:32:50Z"},{"id":"wordfence:d73b4634-1547-41b0-beb5-ae80edd16936","source":"wordfence","cve":"CVE-2024-38676","title":"Booking Ultra Pro <= 1.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d73b4634-1547-41b0-beb5-ae80edd16936?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-27T16:58:01Z"},{"id":"wordfence:d73ca391-97a3-4701-8429-e73f5914e65e","source":"wordfence","cve":"","title":"RokStories <= 1.25 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d73ca391-97a3-4701-8429-e73f5914e65e?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokstories","name":"RokStories","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":"1.26"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d73e4d7d-e691-4c5b-9cb0-ba9e2249c78e","source":"wordfence","cve":"CVE-2026-32572","title":"WP User Frontend Pro <= 4.2.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d73e4d7d-e691-4c5b-9cb0-ba9e2249c78e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend-pro","name":"WP User Frontend Pro","from":"*","from_inclusive":true,"to":"4.2.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T12:50:46Z"},{"id":"wordfence:d73fd485-cb59-42eb-9426-9b89299bb6bc","source":"wordfence","cve":"CVE-2022-1063","title":"Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d73fd485-cb59-42eb-9426-9b89299bb6bc?source=api-prod","affected":[{"type":"plugin","slug":"thank-me-later","name":"Thank Me Later","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":""}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d74040d0-1fee-4906-af6f-a5d842c42fd4","source":"wordfence","cve":"CVE-2024-1778","title":"Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74040d0-1fee-4906-af6f-a5d842c42fd4?source=api-prod","affected":[{"type":"plugin","slug":"admin-side-data-storage-for-contact-form-7","name":"Admin side data storage for Contact Form 7","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T06:48:18Z"},{"id":"wordfence:d74553a4-0ef7-4908-a2e8-5e0216f7b256","source":"wordfence","cve":"CVE-2020-36754","title":"Paid Memberships Pro  <= 2.4.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74553a4-0ef7-4908-a2e8-5e0216f7b256?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":false,"patched_in":"2.4.3"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d748e0f8-fe00-4751-9c24-561fd27e62c3","source":"wordfence","cve":"CVE-2016-10935","title":"WooCommerce \u2013 Store Exporter <= 1.8.3 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d748e0f8-fe00-4751-9c24-561fd27e62c3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":false,"patched_in":"1.8.4"}],"published":"2016-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d749c24c-0ed9-423b-872a-4771e9d8a2eb","source":"wordfence","cve":"CVE-2023-47520","title":"Responsive Column Widgets <= 1.2.7 - Reflected Cross-Site Scripting via tab","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d749c24c-0ed9-423b-872a-4771e9d8a2eb?source=api-prod","affected":[{"type":"plugin","slug":"responsive-column-widgets","name":"Responsive Column Widgets","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d749db62-cea4-4ca2-8734-50fa2ab707f3","source":"wordfence","cve":"CVE-2024-3586","title":"LetterPress <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d749db62-cea4-4ca2-8734-50fa2ab707f3?source=api-prod","affected":[{"type":"plugin","slug":"letterpress","name":"LetterPress \u2013 Email Marketing, SMTP, Newsletter & Multi-Brand Subscriber Manager","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-04T21:11:15Z"},{"id":"wordfence:d74b0f43-02ef-4641-9b11-ef6d963941a0","source":"wordfence","cve":"CVE-2026-62106","title":"SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.9 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74b0f43-02ef-4641-9b11-ef6d963941a0?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.9","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:23:07Z"},{"id":"wordfence:d74c27bd-fc3e-4dc8-ba85-7f2208840eeb","source":"wordfence","cve":"CVE-2025-60127","title":"CopySafe Web Protection <= 5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74c27bd-fc3e-4dc8-ba85-7f2208840eeb?source=api-prod","affected":[{"type":"plugin","slug":"wp-copysafe-web","name":"CopySafe Web Protection \u2013 Copy Protect Images","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.3"}],"published":"2025-09-26T00:00:00Z","updated":"2025-11-10T15:36:21Z"},{"id":"wordfence:d74d71a8-774a-4ebb-b254-0e65a8044319","source":"wordfence","cve":"CVE-2023-51415","title":"GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74d71a8-774a-4ebb-b254-0e65a8044319?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-01-19T00:00:00Z","updated":"2024-01-24T16:55:21Z"},{"id":"wordfence:d74e8541-9726-4bc2-9fbd-f6016490e0ea","source":"wordfence","cve":"CVE-2025-1054","title":"UiCore Elements \u2013 Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74e8541-9726-4bc2-9fbd-f6016490e0ea?source=api-prod","affected":[{"type":"plugin","slug":"uicore-elements","name":"UiCore Elements \u2013 Free widgets and templates for Elementor","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-23T09:23:41Z"},{"id":"wordfence:d74efb03-4a1c-4163-bd79-ef17975a609e","source":"wordfence","cve":"CVE-2023-34385","title":"Export Import Menus <= 1.8.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74efb03-4a1c-4163-bd79-ef17975a609e?source=api-prod","affected":[{"type":"plugin","slug":"export-import-menus","name":"Export Import Menus","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d74f5813-cf7a-4ffb-9306-56f29b3a7d04","source":"wordfence","cve":"CVE-2023-41859","title":"Order Delivery Date for WP e-Commerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d74f5813-cf7a-4ffb-9306-56f29b3a7d04?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date","name":"Order Delivery Date for WP e-Commerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7526228-4e21-430c-90ad-1476c81698ad","source":"wordfence","cve":"CVE-2026-3354","title":"Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7526228-4e21-430c-90ad-1476c81698ad?source=api-prod","affected":[{"type":"plugin","slug":"wikilookup","name":"Wikilookup","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:01Z","updated":"2026-03-21T03:27:08Z"},{"id":"wordfence:d7573471-fc2c-4dde-a681-1068f2b7f925","source":"wordfence","cve":"CVE-2024-54437","title":"jCarousel <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7573471-fc2c-4dde-a681-1068f2b7f925?source=api-prod","affected":[{"type":"plugin","slug":"jcarousel-for-wordpress","name":"jCarousel for WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T10:59:02Z"},{"id":"wordfence:d7576dd9-198b-49a7-950e-fc301e4bc5f8","source":"wordfence","cve":"CVE-2023-32121","title":"Zero Spam <= 5.4.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7576dd9-198b-49a7-950e-fc301e4bc5f8?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d757c2e1-38e4-4d53-8851-25b48c783321","source":"wordfence","cve":"","title":"WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Unsafe Interactivity API Binding Properties","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d757c2e1-38e4-4d53-8851-25b48c783321?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T19:29:45Z"},{"id":"wordfence:d759d7ab-74d5-4195-9258-7281f49b5132","source":"wordfence","cve":"","title":"FoxyPress < 0.4.2.6 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d759d7ab-74d5-4195-9258-7281f49b5132?source=api-prod","affected":[{"type":"plugin","slug":"foxypress","name":"FoxyPress","from":"*","from_inclusive":true,"to":"0.4.2.5","to_inclusive":true,"patched_in":"0.4.2.6"}],"published":"2012-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d75cce66-35b5-4915-b29b-9a1ef648ec16","source":"wordfence","cve":"CVE-2025-23912","title":"WordPress Custom Sidebar <= 2.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d75cce66-35b5-4915-b29b-9a1ef648ec16?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-custom-sidebar","name":"WordPress Custom Sidebar","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T21:01:33Z"},{"id":"wordfence:d75d0f16-015b-49cd-a0d1-41e007fc7398","source":"wordfence","cve":"CVE-2021-24816","title":"Phoenix Media Rename <= 3.4.2 - Author Arbitrary Media File Renaming","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d75d0f16-015b-49cd-a0d1-41e007fc7398?source=api-prod","affected":[{"type":"plugin","slug":"phoenix-media-rename","name":"Phoenix Media Rename","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d75f1475-fa81-4eed-87da-0a0fa48ac082","source":"wordfence","cve":"CVE-2023-46781","title":"Current Menu Item for Custom Post Types <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d75f1475-fa81-4eed-87da-0a0fa48ac082?source=api-prod","affected":[{"type":"plugin","slug":"current-menu-item-for-custom-post-types","name":"Current Menu Item for Custom Post Types","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d75f6c80-ffbf-47a5-9180-5153b705cb28","source":"wordfence","cve":"CVE-2023-32589","title":"Dyslexiefont Free <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d75f6c80-ffbf-47a5-9180-5153b705cb28?source=api-prod","affected":[{"type":"plugin","slug":"dyslexiefont","name":"Dyslexiefont Free","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d76052f8-34b3-4930-a5bf-182420b07968","source":"wordfence","cve":"CVE-2024-12623","title":"DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76052f8-34b3-4930-a5bf-182420b07968?source=api-prod","affected":[{"type":"plugin","slug":"dicom-support","name":"DICOM Support","from":"*","from_inclusive":true,"to":"0.10.6","to_inclusive":true,"patched_in":"0.10.7"}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T07:04:55Z"},{"id":"wordfence:d76229c9-39e6-48ab-b038-be40b36aa7bd","source":"wordfence","cve":"","title":"Anti-Malware Security and Brute-Force Firewall <= 4.15.17 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76229c9-39e6-48ab-b038-be40b36aa7bd?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.15.17","to_inclusive":true,"patched_in":"4.16.18"}],"published":"2016-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d764b1be-b4ae-4845-b506-846f782cf21e","source":"wordfence","cve":"CVE-2022-1793","title":"Private Files <= 0.40 - Cross-Site Request Forgery to Disable Protection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d764b1be-b4ae-4845-b506-846f782cf21e?source=api-prod","affected":[{"type":"plugin","slug":"private-files","name":"Private Files","from":"*","from_inclusive":true,"to":"0.40","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d767b710-0bef-4f36-8edd-eccd845a2b07","source":"wordfence","cve":"CVE-2013-2708","title":"Content Slide <= 1.4.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d767b710-0bef-4f36-8edd-eccd845a2b07?source=api-prod","affected":[{"type":"plugin","slug":"content-slide","name":"WordPress Content Slide","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d76911c6-e185-47b2-a25f-167c29ac86db","source":"wordfence","cve":"CVE-2025-47620","title":"Martins Free Monetized Ad Exchange Network <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76911c6-e185-47b2-a25f-167c29ac86db?source=api-prod","affected":[{"type":"plugin","slug":"martins-free-and-easy-ad-network-get-more-visitors","name":"LexonAds: Get Free Traffic to Your Website & Traffic Exchange","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2026-02-02T21:23:12Z"},{"id":"wordfence:d7691f6a-136c-4312-a468-fc896ec07dc6","source":"wordfence","cve":"CVE-2025-24545","title":"BSK Forms Validation <= 1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7691f6a-136c-4312-a468-fc896ec07dc6?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravity-forms-custom-validation","name":"BSK Forms Validation","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-11-20T00:00:00Z","updated":"2025-02-25T16:58:47Z"},{"id":"wordfence:d769dd4f-f885-47e3-b39f-2ef3ae4a4f63","source":"wordfence","cve":"CVE-2025-28971","title":"Easy Elements Hider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d769dd4f-f885-47e3-b39f-2ef3ae4a4f63?source=api-prod","affected":[{"type":"plugin","slug":"easy-elements-hider","name":"Easy Elements Hider","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-04T00:00:00Z","updated":"2025-07-08T19:53:11Z"},{"id":"wordfence:d76b08c3-0d28-4e81-8843-5afded9efaa6","source":"wordfence","cve":"CVE-2021-24349","title":"Gallery from files <= 1.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76b08c3-0d28-4e81-8843-5afded9efaa6?source=api-prod","affected":[{"type":"plugin","slug":"gallery-from-files","name":"Gallery from files","from":"*","from_inclusive":true,"to":"1.60","to_inclusive":true,"patched_in":""}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d76b6355-a1c5-41a0-b3b6-ee13e5490314","source":"wordfence","cve":"CVE-2014-4942","title":"EasyCart <= 2.0.5 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76b6355-a1c5-41a0-b3b6-ee13e5490314?source=api-prod","affected":[{"type":"plugin","slug":"wp-easycart","name":"WP EasyCart: Shopping Cart and eCommerce Store","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d76fa916-8abe-43ef-8104-f1e1ec2c0437","source":"wordfence","cve":"CVE-2026-27333","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.3.23 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d76fa916-8abe-43ef-8104-f1e1ec2c0437?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.3.23","to_inclusive":true,"patched_in":"7.3.24"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:44:57Z"},{"id":"wordfence:d774af46-4928-4e86-b0e0-1a73f39a8f09","source":"wordfence","cve":"CVE-2025-15028","title":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d774af46-4928-4e86-b0e0-1a73f39a8f09?source=api-prod","affected":[{"type":"plugin","slug":"formgent","name":"FormGent \u2013 Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2026-08-05T22:20:13Z","updated":"2026-08-06T11:29:20Z"},{"id":"wordfence:d774bd22-4d4e-42d4-b4ae-c833dd36aa79","source":"wordfence","cve":"CVE-2025-10142","title":"PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d774bd22-4d4e-42d4-b4ae-c833dd36aa79?source=api-prod","affected":[{"type":"plugin","slug":"pagbank-connect","name":"PagBank / PagSeguro e Vindi para WooCommerce","from":"*","from_inclusive":true,"to":"4.44.3","to_inclusive":true,"patched_in":"4.44.4"}],"published":"2025-09-09T18:11:36Z","updated":"2025-09-10T06:38:52Z"},{"id":"wordfence:d77666b5-956d-420b-93ed-a15cdbfcced7","source":"wordfence","cve":"CVE-2023-32795","title":"WooCommerce Product Add-ons <= 6.1.3 - Authenticated (Shop Manager+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77666b5-956d-420b-93ed-a15cdbfcced7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addons","name":"WooCommerce Product Add-ons","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d776874c-d8ca-4d36-9e94-8bb95077d8f3","source":"wordfence","cve":"CVE-2025-59564","title":"EduMall < 4.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d776874c-d8ca-4d36-9e94-8bb95077d8f3?source=api-prod","affected":[{"type":"theme","slug":"edumall","name":"EduMall - Professional LMS Education Center WordPress Theme","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":false,"patched_in":"4.4.5"}],"published":"2025-08-02T00:00:00Z","updated":"2025-10-29T20:22:02Z"},{"id":"wordfence:d777014a-5397-4062-af39-7ea86589a0d0","source":"wordfence","cve":"CVE-2025-15370","title":"Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d777014a-5397-4062-af39-7ea86589a0d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"21.0.9","to_inclusive":true,"patched_in":"21.0.10"}],"published":"2026-01-15T15:58:56Z","updated":"2026-09-16T23:46:50Z"},{"id":"wordfence:d7778de0-591e-469a-acb2-5a66490a4690","source":"wordfence","cve":"CVE-2022-1095","title":"Mihdan: No External Links <= 4.7.4 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7778de0-591e-469a-acb2-5a66490a4690?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-no-external-links","name":"No External Links","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d77a47e9-0d34-4a88-a913-74a8ef972f9b","source":"wordfence","cve":"CVE-2025-64295","title":"All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77a47e9-0d34-4a88-a913-74a8ef972f9b?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.8.6.1","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-20T19:40:47Z"},{"id":"wordfence:d77b127e-52ee-4256-9450-410413b273f6","source":"wordfence","cve":"CVE-2025-11587","title":"Call Now Button <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77b127e-52ee-4256-9450-410413b273f6?source=api-prod","affected":[{"type":"plugin","slug":"call-now-button","name":"Call Now Button \u2013 The Free Click to Call Button for WordPress","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-10-28T23:59:27Z","updated":"2025-12-19T15:40:51Z"},{"id":"wordfence:d77c8096-40b1-4ac7-881f-6aed98da6752","source":"wordfence","cve":"CVE-2024-13859","title":"BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77c8096-40b1-4ac7-881f-6aed98da6752?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.8.50","to_inclusive":true,"patched_in":"2.8.51"}],"published":"2025-05-01T00:00:00Z","updated":"2025-05-09T17:54:43Z"},{"id":"wordfence:d77db5be-fa72-45f8-ad87-82cb0d0b4c94","source":"wordfence","cve":"CVE-2024-34436","title":"SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77db5be-fa72-45f8-ad87-82cb0d0b4c94?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:21:55Z"},{"id":"wordfence:d77e94ad-2bb7-442d-be67-b4f42b3b3107","source":"wordfence","cve":"CVE-2024-38782","title":"Leaflet Maps Marker <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d77e94ad-2bb7-442d-be67-b4f42b3b3107?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"3.12.9","to_inclusive":true,"patched_in":"3.12.10"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:07:02Z"},{"id":"wordfence:d781b699-8bec-458c-8ba1-cef8bd566978","source":"wordfence","cve":"CVE-2026-83541","title":"Sina Extension for Elementor 3.7.1 - 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d781b699-8bec-458c-8ba1-cef8bd566978?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"3.7.1","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2026-09-09T00:00:00Z","updated":"2026-09-15T20:23:15Z"},{"id":"wordfence:d783b6ca-940c-4939-b96a-339419d8ed56","source":"wordfence","cve":"CVE-2025-10141","title":"Digiseller <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d783b6ca-940c-4939-b96a-339419d8ed56?source=api-prod","affected":[{"type":"plugin","slug":"digiseller","name":"Digiseller","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-10-14T20:02:16Z","updated":"2025-11-17T20:42:20Z"},{"id":"wordfence:d784afb0-03ca-48f8-ac21-230601c028a1","source":"wordfence","cve":"CVE-2026-6176","title":"Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d784afb0-03ca-48f8-ac21-230601c028a1?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.106.0","to_inclusive":true,"patched_in":"5.107.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T11:29:29Z"},{"id":"wordfence:d78ac022-6f07-4da5-a657-cafa78dc1845","source":"wordfence","cve":"CVE-2022-4667","title":"RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d78ac022-6f07-4da5-a657-cafa78dc1845?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d78acfb6-0672-4b97-b1bc-d02b9e6e8f18","source":"wordfence","cve":"CVE-2026-109931","title":"Infility Global <= 2.16.24 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d78acfb6-0672-4b97-b1bc-d02b9e6e8f18?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.16.24","to_inclusive":true,"patched_in":"2.16.25"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:13:57Z"},{"id":"wordfence:d7911337-57fa-4268-8366-d37ff13fae86","source":"wordfence","cve":"CVE-2023-6197","title":"Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=api-prod","affected":[{"type":"plugin","slug":"audio-merchant","name":"Audio Merchant","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d791cd67-03a8-4408-8ca7-7b1ea613e660","source":"wordfence","cve":"CVE-2012-4920","title":"Forums < 1.4.4 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d791cd67-03a8-4408-8ca7-7b1ea613e660?source=api-prod","affected":[{"type":"plugin","slug":"zingiri-forum","name":"Forums","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2013-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d792be47-bbca-4d94-95b3-194acf3f57b3","source":"wordfence","cve":"CVE-2025-23948","title":"Background animation blocks <= 2.1.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d792be47-bbca-4d94-95b3-194acf3f57b3?source=api-prod","affected":[{"type":"plugin","slug":"background-animation-blocks","name":"Background animation blocks","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:49:04Z"},{"id":"wordfence:d795567d-7952-4e88-95bb-0c4bf43af0d0","source":"wordfence","cve":"CVE-2026-118089","title":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels <= 7.14.1 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d795567d-7952-4e88-95bb-0c4bf43af0d0?source=api-prod","affected":[{"type":"plugin","slug":"best-woocommerce-feed","name":"Product Feed Manager for WooCommerce \u2013 RexFeed \u2013 Sell on 200+ Shopping Channels","from":"*","from_inclusive":true,"to":"7.14.1","to_inclusive":true,"patched_in":"7.14.2"}],"published":"2026-10-30T09:07:30Z","updated":"2026-11-03T19:44:41Z"},{"id":"wordfence:d7968c70-0a66-4067-9864-105df483cd42","source":"wordfence","cve":"CVE-2025-28965","title":"URL Shortener <= 3.0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7968c70-0a66-4067-9864-105df483cd42?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-21T20:48:15Z"},{"id":"wordfence:d798406b-2b7f-4ca0-8d05-8aff4bf44dd8","source":"wordfence","cve":"CVE-2023-6892","title":"EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d798406b-2b7f-4ca0-8d05-8aff4bf44dd8?source=api-prod","affected":[{"type":"plugin","slug":"ean-for-woocommerce","name":"EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2024-04-17T00:00:00Z","updated":"2024-07-29T21:37:33Z"},{"id":"wordfence:d79905c2-c824-434d-af44-0ab688c2f818","source":"wordfence","cve":"CVE-2025-31393","title":"Social Bookmarking RELOADED <= 3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79905c2-c824-434d-af44-0ab688c2f818?source=api-prod","affected":[{"type":"plugin","slug":"social-bookmarking-reloaded","name":"Social Bookmarking RELOADED","from":"*","from_inclusive":true,"to":"3.18","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:56:36Z"},{"id":"wordfence:d79a79bf-db80-4ee6-9d84-542480586b6c","source":"wordfence","cve":"CVE-2025-23603","title":"Group category creator <= 1.3.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79a79bf-db80-4ee6-9d84-542480586b6c?source=api-prod","affected":[{"type":"plugin","slug":"group-category-creator","name":"Group category creator","from":"*","from_inclusive":true,"to":"1.3.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:26:59Z"},{"id":"wordfence:d79b092c-9e2c-4752-bf95-d3a6ac145073","source":"wordfence","cve":"CVE-2024-27970","title":"WP SendFox <= 1.3.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79b092c-9e2c-4752-bf95-d3a6ac145073?source=api-prod","affected":[{"type":"plugin","slug":"wp-sendfox","name":"WP SendFox","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:24:10Z"},{"id":"wordfence:d79ba062-4666-41a3-a777-0ba6f63a0cb8","source":"wordfence","cve":"CVE-2026-15019","title":"Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79ba062-4666-41a3-a777-0ba6f63a0cb8?source=api-prod","affected":[{"type":"plugin","slug":"direct-download-for-woocommerce","name":"Direct Download for WooCommerce","from":"*","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":""}],"published":"2026-09-09T14:49:11Z","updated":"2026-09-10T03:40:42Z"},{"id":"wordfence:d79dc179-8f0e-47e3-9697-82d9c9d44be2","source":"wordfence","cve":"CVE-2024-33550","title":"WP Masquerade <= 1.1.0 - Authenticated (Subscriber+) Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79dc179-8f0e-47e3-9697-82d9c9d44be2?source=api-prod","affected":[{"type":"plugin","slug":"wp-masquerade","name":"WP Masquerade","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:21:05Z"},{"id":"wordfence:d79e2d46-41e0-463d-a362-5b1ad0f2a2be","source":"wordfence","cve":"CVE-2026-13610","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) < 4.5.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79e2d46-41e0-463d-a362-5b1ad0f2a2be?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":false,"patched_in":"4.5.2"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T14:01:12Z"},{"id":"wordfence:d79ffe25-8acd-4b52-ac14-7df62247c0d4","source":"wordfence","cve":"CVE-2024-34757","title":"Borderless \u2013 Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d79ffe25-8acd-4b52-ac14-7df62247c0d4?source=api-prod","affected":[{"type":"plugin","slug":"borderless","name":"Borderless \u2013 Addons and Templates for Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T16:08:33Z"},{"id":"wordfence:d7a00926-2251-4d34-893a-e6c89c5ddb6f","source":"wordfence","cve":"CVE-2026-39731","title":"Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a00926-2251-4d34-893a-e6c89c5ddb6f?source=api-prod","affected":[{"type":"plugin","slug":"database-for-cf7","name":"Database for CF7","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T13:22:36Z","updated":"2026-10-08T23:24:48Z"},{"id":"wordfence:d7a02502-bc3c-4fd1-b6db-7b3c476c141f","source":"wordfence","cve":"","title":"Better Search <= 3.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a02502-bc3c-4fd1-b6db-7b3c476c141f?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7a05894-8f9d-442f-961c-2e80aa25c3db","source":"wordfence","cve":"CVE-2021-4419","title":"WP-Backgrounds Lite <= 2.3 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a05894-8f9d-442f-961c-2e80aa25c3db?source=api-prod","affected":[{"type":"plugin","slug":"wp-backgrounds-lite","name":"WP-Backgrounds Lite","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7a166ef-9d9c-43a9-a427-e3210f366c44","source":"wordfence","cve":"CVE-2026-93951","title":"Zeinet <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a166ef-9d9c-43a9-a427-e3210f366c44?source=api-prod","affected":[{"type":"theme","slug":"zeinet","name":"Zeinet - Internet Provider & Satellite TV","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:40:37Z"},{"id":"wordfence:d7a298c9-c688-4c39-bd68-2a58ff8d1402","source":"wordfence","cve":"CVE-2025-62937","title":"Post List Featured Image <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a298c9-c688-4c39-bd68-2a58ff8d1402?source=api-prod","affected":[{"type":"plugin","slug":"post-list-featured-image","name":"Post List Featured Image","from":"*","from_inclusive":true,"to":"0.5.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T14:54:01Z"},{"id":"wordfence:d7a5d60e-5de1-4fc5-b6d1-88700d38e5f0","source":"wordfence","cve":"CVE-2014-3850","title":"Member Approval <= 131109 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7a5d60e-5de1-4fc5-b6d1-88700d38e5f0?source=api-prod","affected":[{"type":"plugin","slug":"member-approval","name":"Member Approval","from":"*","from_inclusive":true,"to":"131109","to_inclusive":true,"patched_in":""}],"published":"2014-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7aaf9a6-0439-4458-9194-0ee4730f3e4e","source":"wordfence","cve":"CVE-2025-66137","title":"Searcher for Elementor <= 1.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aaf9a6-0439-4458-9194-0ee4730f3e4e?source=api-prod","affected":[{"type":"plugin","slug":"searcher-elementor","name":"Searcher \u2013 Ajax Search for Elementor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:53:25Z"},{"id":"wordfence:d7ac0683-120f-4e76-9d44-5ee1c789b2c8","source":"wordfence","cve":"CVE-2026-3997","title":"Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ac0683-120f-4e76-9d44-5ee1c789b2c8?source=api-prod","affected":[{"type":"plugin","slug":"text-toggle","name":"Text Toggle","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:07:17Z","updated":"2026-03-21T03:27:09Z"},{"id":"wordfence:d7aceccc-7004-42f2-b085-eade9c45141c","source":"wordfence","cve":"CVE-2024-6751","title":"Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:58Z"},{"id":"wordfence:d7ae89c1-d128-4b0c-ae70-69b0cd219382","source":"wordfence","cve":"CVE-2026-110185","title":"Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters","severity":"medium","cvss":5.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ae89c1-d128-4b0c-ae70-69b0cd219382?source=api-prod","affected":[{"type":"plugin","slug":"bit-pi","name":"Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.32.0"}],"published":"2026-10-27T17:51:27Z","updated":"2026-10-28T06:45:20Z"},{"id":"wordfence:d7b01c00-a505-4df4-b1bb-3fcdf146f8e0","source":"wordfence","cve":"CVE-2026-89030","title":"Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b01c00-a505-4df4-b1bb-3fcdf146f8e0?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:20:08Z"},{"id":"wordfence:d7b11375-a709-4926-8065-a9dfc9fa4f9a","source":"wordfence","cve":"CVE-2026-8847","title":"Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b11375-a709-4926-8065-a9dfc9fa4f9a?source=api-prod","affected":[{"type":"plugin","slug":"wp-dideo","name":"Dideo","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:22:34Z","updated":"2026-05-27T05:31:31Z"},{"id":"wordfence:d7b15198-8f44-4390-862b-35d41eb8a854","source":"wordfence","cve":"CVE-2025-14460","title":"Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b15198-8f44-4390-862b-35d41eb8a854?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-for-piraeus-bank","name":"Piraeus Bank WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2026-01-06T20:29:50Z","updated":"2026-01-15T18:11:49Z"},{"id":"wordfence:d7b2cb52-1cae-4a86-a089-21fa9be5adc5","source":"wordfence","cve":"CVE-2026-106648","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1070 - Unauthenticated Unauthorized Email Relay","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b2cb52-1cae-4a86-a089-21fa9be5adc5?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1070","to_inclusive":false,"patched_in":"1.7.1070"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:26:05Z"},{"id":"wordfence:d7b33199-d254-4d0c-88d0-ad2f7515d747","source":"wordfence","cve":"CVE-2023-36694","title":"Kingkong Board <= 2.1.0.2 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b33199-d254-4d0c-88d0-ad2f7515d747?source=api-prod","affected":[{"type":"plugin","slug":"kingkong-board","name":"Kingkong Board","from":"*","from_inclusive":true,"to":"2.1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7b40225-d994-43d2-8e8f-2dae271be9be","source":"wordfence","cve":"CVE-2026-57622","title":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b40225-d994-43d2-8e8f-2dae271be9be?source=api-prod","affected":[{"type":"plugin","slug":"wp-cafe","name":"WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Booking System","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":"3.0.15"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T19:00:03Z"},{"id":"wordfence:d7b40a67-40b2-4f9b-9f31-0afaeaebbeab","source":"wordfence","cve":"CVE-2022-40963","title":"WP Page Builder <= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b40a67-40b2-4f9b-9f31-0afaeaebbeab?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagebuilder","name":"WP Page Builder","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7b566f6-58d9-448e-bccf-8806ef1ed3c2","source":"wordfence","cve":"CVE-2024-34789","title":"Post Grid Elementor Addon <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b566f6-58d9-448e-bccf-8806ef1ed3c2?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-elementor-addon","name":"Post Grid Addon for Elementor","from":"*","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-21T10:14:51Z"},{"id":"wordfence:d7b67c83-7fb7-4bac-a8eb-7fc318f2ff50","source":"wordfence","cve":"CVE-2023-41127","title":"Evergreen Content Poster <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b67c83-7fb7-4bac-a8eb-7fc318f2ff50?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7b7b31a-2bc4-42b7-ba60-0f29fe65bbe7","source":"wordfence","cve":"CVE-2022-29413","title":"Hermit \u97f3\u4e50\u64ad\u653e\u5668 <= 3.1.6 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b7b31a-2bc4-42b7-ba60-0f29fe65bbe7?source=api-prod","affected":[{"type":"plugin","slug":"hermit","name":"Hermit \u97f3\u4e50\u64ad\u653e\u5668","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-04-28T12:49:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7b86055-5157-4751-9039-9c563745e383","source":"wordfence","cve":"CVE-2025-47669","title":"CBX Map for Google Map & OpenStreetMap <= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b86055-5157-4751-9039-9c563745e383?source=api-prod","affected":[{"type":"plugin","slug":"cbxgooglemap","name":"CBX Map for Google Map & OpenStreetMap","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-09-11T14:41:59Z"},{"id":"wordfence:d7b8d42c-bceb-456e-a682-358e8df831e3","source":"wordfence","cve":"CVE-2026-6214","title":"Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b8d42c-bceb-456e-a682-358e8df831e3?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.53.0","to_inclusive":true,"patched_in":"1.53.0.1"}],"published":"2026-05-06T14:41:59Z","updated":"2026-05-07T03:27:06Z"},{"id":"wordfence:d7bee25e-7574-4d3d-ad58-9b30d99de525","source":"wordfence","cve":"","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7bee25e-7574-4d3d-ad58-9b30d99de525?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.6.7","to_inclusive":true,"patched_in":"4.1.6.8"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7befdf6-07d7-42c9-876a-abb8f8f9c3df","source":"wordfence","cve":"CVE-2023-38393","title":"Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7befdf6-07d7-42c9-876a-abb8f8f9c3df?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2023-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7bf5f3c-9577-4824-a8ae-e13827fa5166","source":"wordfence","cve":"CVE-2022-29428","title":"WP Slider Plugin <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7bf5f3c-9577-4824-a8ae-e13827fa5166?source=api-prod","affected":[{"type":"plugin","slug":"simple-slider-ssp","name":"WP Slider Plugin","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2022-05-04T12:51:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7c03f9e-fd4e-4787-ae7c-8aff8c854730","source":"wordfence","cve":"CVE-2025-62751","title":"Vireo <= 1.0.37 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c03f9e-fd4e-4787-ae7c-8aff8c854730?source=api-prod","affected":[{"type":"theme","slug":"vireo","name":"Vireo","from":"*","from_inclusive":true,"to":"1.0.37","to_inclusive":true,"patched_in":"1.0.40"}],"published":"2025-12-31T00:00:00Z","updated":"2026-11-03T22:45:30Z"},{"id":"wordfence:d7c05856-fbee-498d-9e9f-f0a232df6d24","source":"wordfence","cve":"CVE-2024-31940","title":"Extra Product Options Builder for WooCommerce <= 1.2.104 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c05856-fbee-498d-9e9f-f0a232df6d24?source=api-prod","affected":[{"type":"plugin","slug":"additional-product-fields-for-woocommerce","name":"Extra Product Options Builder for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.104","to_inclusive":true,"patched_in":"1.2.105"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:57:04Z"},{"id":"wordfence:d7c0b933-469e-4f8b-94b2-8823568c5d45","source":"wordfence","cve":"CVE-2022-2409","title":"Rough Chart <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c0b933-469e-4f8b-94b2-8823568c5d45?source=api-prod","affected":[{"type":"plugin","slug":"rough-chart","name":"Rough Chart","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7c0f21a-b04c-407e-9e8c-f81a146deaa8","source":"wordfence","cve":"CVE-2026-18961","title":"Social Login, Passkeys, Magic Link & Email OTP \u2013 Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c0f21a-b04c-407e-9e8c-f81a146deaa8?source=api-prod","affected":[{"type":"plugin","slug":"ventraconnect-social-login","name":"Social Login, Passkeys, Magic Link & Email OTP \u2013 Passwordless Login by VentraConnect","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-08-11T13:46:45Z","updated":"2026-08-12T02:25:05Z"},{"id":"wordfence:d7c4b3bd-926b-4479-8f2f-3c42631282a4","source":"wordfence","cve":"CVE-2024-49663","title":"uCAT \u2013 Next Story <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c4b3bd-926b-4479-8f2f-3c42631282a4?source=api-prod","affected":[{"type":"plugin","slug":"ucat-next-story","name":"uCAT \u2013 Next Story","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T17:12:06Z"},{"id":"wordfence:d7c639b8-35f5-4eaf-a663-1adab3ba2a16","source":"wordfence","cve":"CVE-2026-2951","title":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c639b8-35f5-4eaf-a663-1adab3ba2a16?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2026-04-22T13:44:42Z","updated":"2026-04-23T02:25:21Z"},{"id":"wordfence:d7c72608-a348-4ae5-ae85-d87955bfad32","source":"wordfence","cve":"CVE-2025-30882","title":"JS Help Desk <= 2.9.1 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c72608-a348-4ae5-ae85-d87955bfad32?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:21:30Z"},{"id":"wordfence:d7c72de0-b9d0-47aa-8836-faf7ad8f9746","source":"wordfence","cve":"CVE-2024-55980","title":"Wr Age Verification <= 2.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c72de0-b9d0-47aa-8836-faf7ad8f9746?source=api-prod","affected":[{"type":"plugin","slug":"wr-age-verification","name":"Wr Age Verification","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T16:59:50Z"},{"id":"wordfence:d7c80143-c328-4cd1-95db-67de2edc058c","source":"wordfence","cve":"CVE-2025-7502","title":"WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c80143-c328-4cd1-95db-67de2edc058c?source=api-prod","affected":[{"type":"plugin","slug":"js_composer","name":"WPBakery Page Builder","from":"*","from_inclusive":true,"to":"8.5","to_inclusive":true,"patched_in":"8.6"}],"published":"2025-08-05T00:00:00Z","updated":"2025-08-06T01:45:14Z"},{"id":"wordfence:d7c94c68-bf3c-49b0-b7eb-39374c6002aa","source":"wordfence","cve":"CVE-2021-24551","title":"Edit Comments <= 0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c94c68-bf3c-49b0-b7eb-39374c6002aa?source=api-prod","affected":[{"type":"plugin","slug":"edit-comments","name":"Edit Comments","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7c98191-bf17-4e94-88cc-ad385b1fe97d","source":"wordfence","cve":"CVE-2025-12154","title":"Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c98191-bf17-4e94-88cc-ad385b1fe97d?source=api-prod","affected":[{"type":"plugin","slug":"auto-thumbnailer","name":"Auto Thumbnailer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:20:29Z","updated":"2025-12-05T05:31:29Z"},{"id":"wordfence:d7c9ef25-dc57-4a38-84d6-40f38bf96e4e","source":"wordfence","cve":"CVE-2026-78286","title":"Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c9ef25-dc57-4a38-84d6-40f38bf96e4e?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.9.8","to_inclusive":true,"patched_in":"8.9.9"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T20:51:36Z"},{"id":"wordfence:d7ccbe77-939f-4828-9b86-40cd654cfce6","source":"wordfence","cve":"CVE-2024-37510","title":"Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ccbe77-939f-4828-9b86-40cd654cfce6?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.1.7","to_inclusive":true,"patched_in":"1.8.1.8"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:41:07Z"},{"id":"wordfence:d7ce047b-3cd3-475b-9a9f-38d15174e7e5","source":"wordfence","cve":"CVE-2026-8118","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ce047b-3cd3-475b-9a9f-38d15174e7e5?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"1.7.1058","from_inclusive":true,"to":"1.7.1059","to_inclusive":true,"patched_in":"1.7.1060"}],"published":"2026-06-18T16:21:26Z","updated":"2026-06-19T04:31:34Z"},{"id":"wordfence:d7d08144-82b8-4f2e-8410-41bae20da00f","source":"wordfence","cve":"CVE-2025-32128","title":"Nearby Locations <= 1.1.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d08144-82b8-4f2e-8410-41bae20da00f?source=api-prod","affected":[{"type":"plugin","slug":"nearby-locations","name":"Nearby Locations","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:48:25Z"},{"id":"wordfence:d7d08b06-975d-41a7-a297-ebbf0cca13b6","source":"wordfence","cve":"CVE-2026-61983","title":"Church Admin <= 5.0.30 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d08b06-975d-41a7-a297-ebbf0cca13b6?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"5.0.30","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-13T19:23:55Z"},{"id":"wordfence:d7d08bfd-9861-4e21-a696-25b00233ad94","source":"wordfence","cve":"","title":"EWWW Image Optimizer <= 7.2.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d08bfd-9861-4e21-a696-25b00233ad94?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":false,"patched_in":"7.2.1"}],"published":"2023-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7d13261-7827-45f0-9afb-ba90cc9f2e51","source":"wordfence","cve":"CVE-2025-50053","title":"Blappsta Mobile App Plugin \u2013 Your native, mobile iPhone App and Android App <= 0.8.8.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d13261-7827-45f0-9afb-ba90cc9f2e51?source=api-prod","affected":[{"type":"plugin","slug":"yournewsapp","name":"Blappsta Mobile App Plugin \u2013 Your native, mobile iPhone App and Android App","from":"*","from_inclusive":true,"to":"0.8.8.8","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2026-01-05T18:18:59Z"},{"id":"wordfence:d7d18db8-17f4-4513-86da-8c9228c85eca","source":"wordfence","cve":"CVE-2024-54422","title":"Evernote Sync <= 3.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d18db8-17f4-4513-86da-8c9228c85eca?source=api-prod","affected":[{"type":"plugin","slug":"evernote-sync","name":"Evernote Sync","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T13:55:58Z"},{"id":"wordfence:d7d20733-d61b-4b2f-8597-528644f0bc26","source":"wordfence","cve":"CVE-2024-5449","title":"WP Dark Mode \u2013 WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d20733-d61b-4b2f-8597-528644f0bc26?source=api-prod","affected":[{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2024-06-05T15:09:52Z","updated":"2024-06-06T03:32:56Z"},{"id":"wordfence:d7d2c16c-f489-4c78-acca-46e5eddfbc7c","source":"wordfence","cve":"CVE-2025-1486","title":"WoWPth <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d2c16c-f489-4c78-acca-46e5eddfbc7c?source=api-prod","affected":[{"type":"plugin","slug":"wowpth","name":"WoWPth","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T00:00:00Z","updated":"2025-03-03T22:01:08Z"},{"id":"wordfence:d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0","source":"wordfence","cve":"","title":"Download Manager <= 2.8.7 - Missing Authorization","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":false,"patched_in":"2.8.8"}],"published":"2016-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7d3862f-7221-4a70-af72-f0b997ad8d43","source":"wordfence","cve":"CVE-2025-32271","title":"Woocommerce Role Pricing <= 3.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d3862f-7221-4a70-af72-f0b997ad8d43?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-role-pricing","name":"Woocommerce Role Pricing","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T20:47:11Z"},{"id":"wordfence:d7d68f43-2a57-4352-8aae-0657b386ac7c","source":"wordfence","cve":"CVE-2026-6070","title":"WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d68f43-2a57-4352-8aae-0657b386ac7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-businessdirectory","name":"WP-BusinessDirectory \u2013 Business directory plugin for WordPress","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-06-30T16:18:52Z","updated":"2026-07-01T04:32:28Z"},{"id":"wordfence:d7d698be-fae6-4960-912a-1078ea407031","source":"wordfence","cve":"CVE-2026-8896","title":"MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d698be-fae6-4960-912a-1078ea407031?source=api-prod","affected":[{"type":"plugin","slug":"mir-blocks-and-shortcodes","name":"MIR blocks and shortcodes","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:42:08Z","updated":"2026-06-24T05:33:30Z"},{"id":"wordfence:d7d6d15c-067f-44cb-bd61-ff39bed7e356","source":"wordfence","cve":"","title":"UserPro <= 4.9.27 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d6d15c-067f-44cb-bd61-ff39bed7e356?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"4.9.28","to_inclusive":false,"patched_in":"4.9.28"}],"published":"2018-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7d7c21b-20d5-40f5-9c23-2a29cbd7d79d","source":"wordfence","cve":"CVE-2026-81286","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d7c21b-20d5-40f5-9c23-2a29cbd7d79d?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2026-09-01T00:00:00Z","updated":"2026-09-09T13:42:08Z"},{"id":"wordfence:d7d8d1e9-04d6-43f0-86a1-386cc1255802","source":"wordfence","cve":"","title":"Toolset Types <= 1.2.1.1 - Cross-Site Scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d8d1e9-04d6-43f0-86a1-386cc1255802?source=api-prod","affected":[{"type":"plugin","slug":"types","name":"Toolset Types \u2013 Custom Post Types, Custom Fields and Taxonomies","from":"*","from_inclusive":true,"to":"1.2.1.1","to_inclusive":true,"patched_in":"1.2.1.2"}],"published":"2013-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7d8e8c4-f4b7-40ce-baf1-2162e7ccf05e","source":"wordfence","cve":"CVE-2026-97276","title":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative <= 14.16.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d8e8c4-f4b7-40ce-baf1-2162e7ccf05e?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.14","to_inclusive":true,"patched_in":"14.16.15"}],"published":"2026-10-02T06:41:47Z","updated":"2026-10-09T00:15:16Z"},{"id":"wordfence:d7d94443-3ab2-4d89-a580-2e9697d28cd7","source":"wordfence","cve":"CVE-2013-2200","title":"WordPress Core < 3.5.2 -  Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d94443-3ab2-4d89-a580-2e9697d28cd7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2013-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7dc74e2-fa6d-4d4c-b27c-d77c3688ed15","source":"wordfence","cve":"CVE-2025-58788","title":"License Manager for WooCommerce <= 3.0.12 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7dc74e2-fa6d-4d4c-b27c-d77c3688ed15?source=api-prod","affected":[{"type":"plugin","slug":"license-manager-for-woocommerce","name":"License Manager for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.0.13"}],"published":"2025-09-05T00:00:00Z","updated":"2025-10-08T21:04:42Z"},{"id":"wordfence:d7dcc31c-9255-4bd2-92b4-ce9a1df5f24c","source":"wordfence","cve":"CVE-2026-75796","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7dcc31c-9255-4bd2-92b4-ce9a1df5f24c?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:08:14Z"},{"id":"wordfence:d7e18997-90be-4fa4-aa4f-3b79544e00f5","source":"wordfence","cve":"CVE-2024-33684","title":"Save as PDF plugin by Pdfcrowd <= 3.2.0 - Missing Authorization","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e18997-90be-4fa4-aa4f-3b79544e00f5?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T13:05:33Z"},{"id":"wordfence:d7e41753-2dbf-4afa-b61e-e617be2c4dc2","source":"wordfence","cve":"CVE-2026-1314","title":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e41753-2dbf-4afa-b61e-e617be2c4dc2?source=api-prod","affected":[{"type":"plugin","slug":"interactive-3d-flipbook-powered-physics-engine","name":"3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery","from":"*","from_inclusive":true,"to":"1.16.17","to_inclusive":true,"patched_in":"1.16.18"}],"published":"2026-04-14T10:49:26Z","updated":"2026-04-14T23:26:07Z"},{"id":"wordfence:d7e4dd2c-5f6a-4bce-a46b-7bdd9d460804","source":"wordfence","cve":"CVE-2024-30451","title":"Geo Controller <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e4dd2c-5f6a-4bce-a46b-7bdd9d460804?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.6.4","to_inclusive":true,"patched_in":"8.6.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:22:23Z"},{"id":"wordfence:d7e6502a-df5e-49c3-8540-3fe085b0e171","source":"wordfence","cve":"CVE-2026-108069","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers < 3.7.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e6502a-df5e-49c3-8540-3fe085b0e171?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":false,"patched_in":"3.7.4"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:41:18Z"},{"id":"wordfence:d7e7247f-869a-4cf0-ae03-0b36ecbc1b7e","source":"wordfence","cve":"CVE-2023-1406","title":"Crocoblock JetEngine <= 3.1.3 - Authenticated(Author+) Arbitrary File Upload to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e7247f-869a-4cf0-ae03-0b36ecbc1b7e?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.3.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7e81331-0b39-4490-8624-38078b3d5420","source":"wordfence","cve":"CVE-2024-22144","title":"Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7e81331-0b39-4490-8624-38078b3d5420?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.21.96","to_inclusive":true,"patched_in":"4.23.56"}],"published":"2024-03-12T00:00:00Z","updated":"2024-05-07T19:53:22Z"},{"id":"wordfence:d7eb5fad-bb62-4f0b-ad52-b16c3e442b62","source":"wordfence","cve":"CVE-2024-10542","title":"Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7eb5fad-bb62-4f0b-ad52-b16c3e442b62?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.43.2","to_inclusive":true,"patched_in":"6.44"}],"published":"2024-11-25T17:06:04Z","updated":"2024-11-26T05:33:03Z"},{"id":"wordfence:d7ebf70c-8b63-4918-a262-1c95a06882c3","source":"wordfence","cve":"CVE-2026-42681","title":"E2Pdf \u2013 Export Pdf Tool for WordPress <= 1.32.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ebf70c-8b63-4918-a262-1c95a06882c3?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.14","to_inclusive":true,"patched_in":"1.32.15"}],"published":"2026-05-18T00:00:00Z","updated":"2026-05-26T19:33:23Z"},{"id":"wordfence:d7ed9911-5505-411e-b899-0791b1920bee","source":"wordfence","cve":"CVE-2025-57963","title":"Zoho Billing <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ed9911-5505-411e-b899-0791b1920bee?source=api-prod","affected":[{"type":"plugin","slug":"zoho-subscriptions","name":"Zoho Billing \u2013 Embed Payment Form","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-13T16:56:38Z"},{"id":"wordfence:d7eda36e-7cdf-444f-82ce-561ba96cd0f9","source":"wordfence","cve":"CVE-2019-13463","title":"Simple Link Directory < 7.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7eda36e-7cdf-444f-82ce-561ba96cd0f9?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory","name":"Simple Link Directory \u2013 AI Powered","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":false,"patched_in":"7.3.5"}],"published":"2019-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7edb3be-ffa9-4e80-addf-5e5aca6050ef","source":"wordfence","cve":"","title":"Pie Register < 3.0.18 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7edb3be-ffa9-4e80-addf-5e5aca6050ef?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":false,"patched_in":"3.0.18"}],"published":"2018-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7f024c5-80d8-490f-b448-9bccb877024b","source":"wordfence","cve":"","title":"Premium Courses & eLearning <= 1.0.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f024c5-80d8-490f-b448-9bccb877024b?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-courses","name":"Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1"}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7f0f654-e455-4284-ba44-35f1fbcbb3ba","source":"wordfence","cve":"CVE-2025-59134","title":"Sale! Immigration law, Visa services support, Migration Agent Consulting <= 1.5.8 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f0f654-e455-4284-ba44-35f1fbcbb3ba?source=api-prod","affected":[{"type":"theme","slug":"immiex","name":"Sale! Immigration law, Visa services support, Migration Agent Consulting WordPress Business Theme","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2025-10-17T00:00:00Z","updated":"2025-12-19T22:08:06Z"},{"id":"wordfence:d7f21dbe-f300-4336-9980-a69d40395f39","source":"wordfence","cve":"CVE-2024-13337","title":"Webcraftic Clearfy \u2013 WordPress optimization plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f21dbe-f300-4336-9980-a69d40395f39?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T06:37:20Z"},{"id":"wordfence:d7f294af-7702-4762-806b-2abdb1454a7c","source":"wordfence","cve":"CVE-2018-0642","title":"FV Flowplayer Video Player 6.1.2 - 6.6.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f294af-7702-4762-806b-2abdb1454a7c?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"6.1.2","from_inclusive":true,"to":"6.6.4","to_inclusive":true,"patched_in":"6.6.5"}],"published":"2018-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7f2b39f-d2e1-459d-b02d-6d064c471ed2","source":"wordfence","cve":"CVE-2025-57949","title":"Ongkoskirim.id <= 1.0.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f2b39f-d2e1-459d-b02d-6d064c471ed2?source=api-prod","affected":[{"type":"plugin","slug":"ongkoskirim-id","name":"Plugin Ongkos Kirim JNE Tiki Sicepat Wahana J&T POS for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:58:43Z"},{"id":"wordfence:d7f4e710-99a2-49df-a513-725e1daaa18a","source":"wordfence","cve":"CVE-2023-5425","title":"Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f4e710-99a2-49df-a513-725e1daaa18a?source=api-prod","affected":[{"type":"plugin","slug":"post-meta-data-manager","name":"Post Meta Data Manager","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d7f59489-9bff-4d22-8f99-6ea52d702ecf","source":"wordfence","cve":"CVE-2024-4038","title":"Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f59489-9bff-4d22-8f99-6ea52d702ecf?source=api-prod","affected":[{"type":"plugin","slug":"back-in-stock-notifier-for-woocommerce","name":"Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:40Z"},{"id":"wordfence:d7fa63b7-2e7f-4ed5-96b9-ae06d429af47","source":"wordfence","cve":"CVE-2024-7356","title":"Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7fa63b7-2e7f-4ed5-96b9-ae06d429af47?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.100","to_inclusive":true,"patched_in":"3.3.101"}],"published":"2024-08-02T20:41:18Z","updated":"2024-08-03T09:37:19Z"},{"id":"wordfence:d7fb1b31-3393-4fd4-9cef-35fda1258b5e","source":"wordfence","cve":"CVE-2025-27307","title":"Quotes llama <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7fb1b31-3393-4fd4-9cef-35fda1258b5e?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T18:14:49Z"},{"id":"wordfence:d7fd5efe-8b21-44e5-a09e-6f8b95b29835","source":"wordfence","cve":"CVE-2025-49367","title":"Monyxi <= 1.1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7fd5efe-8b21-44e5-a09e-6f8b95b29835?source=api-prod","affected":[{"type":"theme","slug":"monyxi","name":"Monyxi | ICO Cryptocurrency Trading Business Coach WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:22:07Z"},{"id":"wordfence:d7fe128e-02b7-4838-8575-db09d33d2340","source":"wordfence","cve":"CVE-2024-9850","title":"SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d7fe128e-02b7-4838-8575-db09d33d2340?source=api-prod","affected":[{"type":"plugin","slug":"case-study","name":"SVG Case Study","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T15:03:58Z","updated":"2024-11-16T03:20:51Z"},{"id":"wordfence:d8009f10-85d0-4798-8b6b-c1e4452139af","source":"wordfence","cve":"CVE-2016-10975","title":"Fluid Responsive Slideshow < 2.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8009f10-85d0-4798-8b6b-c1e4452139af?source=api-prod","affected":[{"type":"plugin","slug":"fluid-responsive-slideshow","name":"Fluid Responsive Slideshow","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":false,"patched_in":"2.2.7"}],"published":"2016-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d800a4e5-0af4-47b5-bdeb-126b21ad0ff1","source":"wordfence","cve":"CVE-2025-25125","title":"Fyrebox Quizzes <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d800a4e5-0af4-47b5-bdeb-126b21ad0ff1?source=api-prod","affected":[{"type":"plugin","slug":"fyrebox-shortcode","name":"Fyrebox Quizzes","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-05-14T14:14:45Z"},{"id":"wordfence:d80199a2-8a12-44f7-ba20-169d7af88c26","source":"wordfence","cve":"CVE-2024-30485","title":"Finale Lite <= 2.18.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80199a2-8a12-44f7-ba20-169d7af88c26?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.18.1"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:48:06Z"},{"id":"wordfence:d8029737-f3ad-4025-948a-ba0298c0869d","source":"wordfence","cve":"","title":"WP Job Manager <= 1.26.1 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8029737-f3ad-4025-948a-ba0298c0869d?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-manager","name":"WP Job Manager","from":"*","from_inclusive":true,"to":"1.26.2","to_inclusive":false,"patched_in":"1.26.2"}],"published":"2016-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d80417bc-2bb2-4826-be03-796a7cd2825f","source":"wordfence","cve":"CVE-2025-5937","title":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80417bc-2bb2-4826-be03-796a7cd2825f?source=api-prod","affected":[{"type":"plugin","slug":"paid-membership","name":"MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-06-27T19:13:01Z","updated":"2025-06-28T07:25:08Z"},{"id":"wordfence:d8045e14-dfeb-4d1b-8e72-861bc7f8b8ab","source":"wordfence","cve":"CVE-2025-59562","title":"Academy LMS <= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8045e14-dfeb-4d1b-8e72-861bc7f8b8ab?source=api-prod","affected":[{"type":"plugin","slug":"academy","name":"Academy LMS \u2013 AI Course Builder, Quizzes, Certificates & eLearning","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:37:41Z"},{"id":"wordfence:d806c085-b816-46a8-8271-073af16c541e","source":"wordfence","cve":"CVE-2026-94683","title":"DesignSetGo <= 2.8.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d806c085-b816-46a8-8271-073af16c541e?source=api-prod","affected":[{"type":"plugin","slug":"designsetgo","name":"DesignSetGo","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:33:04Z"},{"id":"wordfence:d8074af6-cb2c-44db-9110-517f33caa96e","source":"wordfence","cve":"CVE-2023-4627","title":"LadiApp <= 4.4 - Missing Authorization via save_config()","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8074af6-cb2c-44db-9110-517f33caa96e?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:56Z"},{"id":"wordfence:d8081c02-9280-4cb7-9b6c-e04d34f2439c","source":"wordfence","cve":"CVE-2025-27291","title":"WordPress Photo Gallery \u2013 Image Gallery <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8081c02-9280-4cb7-9b6c-e04d34f2439c?source=api-prod","affected":[{"type":"plugin","slug":"photo-image-gallery","name":"WordPress Photo Gallery \u2013 Image Gallery","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:37:54Z"},{"id":"wordfence:d8096f3c-e1a9-424f-af10-3e80212db985","source":"wordfence","cve":"CVE-2026-5427","title":"Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8096f3c-e1a9-424f-af10-3e80212db985?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2026-04-16T15:06:55Z","updated":"2026-04-17T03:36:45Z"},{"id":"wordfence:d80a6f8b-8528-48a5-a4f0-01b0b55de95a","source":"wordfence","cve":"CVE-2025-69386","title":"RVCFDI para Woocommerce <= 8.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80a6f8b-8528-48a5-a4f0-01b0b55de95a?source=api-prod","affected":[{"type":"plugin","slug":"rvcfdi-para-woocommerce","name":"RVCFDI para Woocommerce","from":"*","from_inclusive":true,"to":"8.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:48:00Z"},{"id":"wordfence:d80ab1a4-19f9-4fea-87b4-1d2ba465e860","source":"wordfence","cve":"CVE-2024-3673","title":"Web Directory Free <= 1.7.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80ab1a4-19f9-4fea-87b4-1d2ba465e860?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-09-12T14:44:07Z"},{"id":"wordfence:d80d583f-42c8-48fb-b757-88346c740b0e","source":"wordfence","cve":"CVE-2023-22681","title":"eExamhall <= 4.0 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80d583f-42c8-48fb-b757-88346c740b0e?source=api-prod","affected":[{"type":"plugin","slug":"eexamhall","name":"Online Exam Software : eExamhall","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d80ed885-43f8-43a4-bc61-e9ef92e3207e","source":"wordfence","cve":"CVE-2026-18441","title":"LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d80ed885-43f8-43a4-bc61-e9ef92e3207e?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"5.6.10"}],"published":"2026-09-17T10:58:18Z","updated":"2026-09-17T23:27:11Z"},{"id":"wordfence:d811782e-3b59-4a46-9a2e-f24ef3dfbd4a","source":"wordfence","cve":"CVE-2022-46795","title":"Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d811782e-3b59-4a46-9a2e-f24ef3dfbd4a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.2","to_inclusive":true,"patched_in":"4.7.3"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d814694d-6491-4ca3-b8ac-ff5c144f7399","source":"wordfence","cve":"CVE-2026-104757","title":"Import and export users and customers <= 2.5.5 - Authenticated (Editor+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d814694d-6491-4ca3-b8ac-ff5c144f7399?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2026-10-05T10:06:49Z","updated":"2026-10-08T23:28:09Z"},{"id":"wordfence:d817d6b8-dad5-4469-9332-fbee8d75bb0b","source":"wordfence","cve":"CVE-2026-81763","title":"Throws SPAM Away <= 3.8.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d817d6b8-dad5-4469-9332-fbee8d75bb0b?source=api-prod","affected":[{"type":"plugin","slug":"throws-spam-away","name":"Throws SPAM Away","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.9"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:41:20Z"},{"id":"wordfence:d818b467-a893-4f4f-b623-abff99ef37b4","source":"wordfence","cve":"CVE-2024-10763","title":"Campress <= 1.35 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d818b467-a893-4f4f-b623-abff99ef37b4?source=api-prod","affected":[{"type":"theme","slug":"campress","name":"Campress","from":"*","from_inclusive":true,"to":"1.35","to_inclusive":true,"patched_in":""}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T04:21:47Z"},{"id":"wordfence:d81b2927-f855-48f2-b7ae-f1411bee0040","source":"wordfence","cve":"CVE-2021-24154","title":"Theme Editor <= 2.5 - Authenticated Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d81b2927-f855-48f2-b7ae-f1411bee0040?source=api-prod","affected":[{"type":"plugin","slug":"theme-editor","name":"Theme Editor","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2021-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d81c62ae-99b7-48cf-87e5-dcc5c9c851ba","source":"wordfence","cve":"CVE-2024-52356","title":"The Pack Elementor addons <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d81c62ae-99b7-48cf-87e5-dcc5c9c851ba?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:17:22Z"},{"id":"wordfence:d81dd459-766f-4cb7-a7d2-da82a4ca9412","source":"wordfence","cve":"CVE-2026-22499","title":"Lella <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d81dd459-766f-4cb7-a7d2-da82a4ca9412?source=api-prod","affected":[{"type":"theme","slug":"lella","name":"Lella - Hairdresser and Beauty Salon WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:00:22Z"},{"id":"wordfence:d81ed8d9-4a7a-4b75-aab4-8e4dbd554f32","source":"wordfence","cve":"CVE-2023-0294","title":"Mediamatic \u2013 Media Library Folders <= 2.8.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d81ed8d9-4a7a-4b75-aab4-8e4dbd554f32?source=api-prod","affected":[{"type":"plugin","slug":"mediamatic","name":"Mediamatic \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8264557-30e2-4f9f-95db-7c135ff437ec","source":"wordfence","cve":"CVE-2025-69172","title":"Resurs <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8264557-30e2-4f9f-95db-7c135ff437ec?source=api-prod","affected":[{"type":"theme","slug":"resurs","name":"Resurs - Physiotherapy & Psychology Rehabilitation WordPress Theme","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:37:08Z"},{"id":"wordfence:d826fcda-5076-476c-950f-4d95c93311d4","source":"wordfence","cve":"CVE-2025-62029","title":"Grevo <= 2.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d826fcda-5076-476c-950f-4d95c93311d4?source=api-prod","affected":[{"type":"theme","slug":"grevo","name":"Grevo - Electric Vehicle Charging WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T15:22:18Z"},{"id":"wordfence:d8272233-afb3-46f1-ab85-189a3923e29d","source":"wordfence","cve":"CVE-2024-4034","title":"Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8272233-afb3-46f1-ab85-189a3923e29d?source=api-prod","affected":[{"type":"theme","slug":"virtue","name":"Virtue","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:52:43Z"},{"id":"wordfence:d82d1dd2-b5b5-490a-92e5-1a4d4ab0085d","source":"wordfence","cve":"CVE-2023-1804","title":"Product Catalog Feed by PixelYourSite <= 2.1.0 - Reflected Cross-Site Scripting via 'edit'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82d1dd2-b5b5-490a-92e5-1a4d4ab0085d?source=api-prod","affected":[{"type":"plugin","slug":"product-catalog-feed","name":"Product Catalog Feed by PixelYourSite","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d82d43b9-4c70-4525-88ba-eec7c81a62c1","source":"wordfence","cve":"CVE-2024-2130","title":"CWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82d43b9-4c70-4525-88ba-eec7c81a62c1?source=api-prod","affected":[{"type":"plugin","slug":"cww-companion","name":"CWW Companion","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T19:32:29Z"},{"id":"wordfence:d82dc4fa-ec99-445f-bec5-08ecc8573b1b","source":"wordfence","cve":"CVE-2026-81197","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Unauthenticated Unpublished Course Data Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82dc4fa-ec99-445f-bec5-08ecc8573b1b?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:51:40Z"},{"id":"wordfence:d82dd179-a63e-4a83-9b94-c4f3c7ded390","source":"wordfence","cve":"CVE-2024-37554","title":"UltraAddons Elementor Lite <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82dd179-a63e-4a83-9b94-c4f3c7ded390?source=api-prod","affected":[{"type":"plugin","slug":"ultraaddons-elementor-lite","name":"UltraAddons for Elementor","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2026-04-15T20:35:36Z"},{"id":"wordfence:d82e856b-c8c9-4139-ad54-89368e3b7125","source":"wordfence","cve":"CVE-2021-4375","title":"Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82e856b-c8c9-4139-ad54-89368e3b7125?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":false,"patched_in":"2.2.8"}],"published":"2021-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d82efaa3-ea61-476c-ad1a-60585450c63a","source":"wordfence","cve":"CVE-2024-10898","title":"Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82efaa3-ea61-476c-ad1a-60585450c63a?source=api-prod","affected":[{"type":"plugin","slug":"cf7-email-add-on","name":"Email Addon for Contact Form 7","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-11-20T00:00:00Z","updated":"2025-05-12T14:01:39Z"},{"id":"wordfence:d82f5ffb-3499-462b-a04e-37e33ddf05c9","source":"wordfence","cve":"CVE-2026-77770","title":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress 5.3.24 - 6.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion","severity":"high","cvss":7.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d82f5ffb-3499-462b-a04e-37e33ddf05c9?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"18.0","from_inclusive":true,"to":"19.2","to_inclusive":true,"patched_in":"6.3.1"},{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"5.3.24","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:38:42Z"},{"id":"wordfence:d830b73c-0666-4632-8001-fe2c467a37a0","source":"wordfence","cve":"CVE-2022-0920","title":"Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d830b73c-0666-4632-8001-fe2c467a37a0?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d830c2eb-16e8-425c-ac46-a467a2fd0133","source":"wordfence","cve":"CVE-2025-10750","title":"PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d830c2eb-16e8-425c-ac46-a467a2fd0133?source=api-prod","affected":[{"type":"plugin","slug":"embed-power-bi-reports","name":"PowerBI Embed Reports","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-10-17T19:06:40Z","updated":"2025-10-18T07:26:32Z"},{"id":"wordfence:d831fa81-4714-4757-b75d-0a8f5edda910","source":"wordfence","cve":"CVE-2023-2201","title":"Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d831fa81-4714-4757-b75d-0a8f5edda910?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2023-06-01T00:00:00Z","updated":"2024-05-08T14:42:29Z"},{"id":"wordfence:d834eb3a-e887-40df-b61d-56ba32048aa3","source":"wordfence","cve":"CVE-2026-65478","title":"ListingPro Plugin <= 2.9.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d834eb3a-e887-40df-b61d-56ba32048aa3?source=api-prod","affected":[{"type":"plugin","slug":"listingpro-plugin","name":"ListingPro Plugin","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:35:41Z"},{"id":"wordfence:d8351204-da6d-443a-98b5-0608bfb1e9d0","source":"wordfence","cve":"CVE-2025-9816","title":"WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8351204-da6d-443a-98b5-0608bfb1e9d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.15.4","to_inclusive":true,"patched_in":"14.15.5"}],"published":"2025-09-26T16:25:11Z","updated":"2026-10-02T19:55:08Z"},{"id":"wordfence:d837fb74-d938-466d-8fe8-1ca345349338","source":"wordfence","cve":"CVE-2026-28154","title":"Samex - Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d837fb74-d938-466d-8fe8-1ca345349338?source=api-prod","affected":[{"type":"theme","slug":"samex","name":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:48:57Z"},{"id":"wordfence:d83ae3a4-382f-4e64-bf1e-73f953f2f654","source":"wordfence","cve":"CVE-2025-13368","title":"Xpro Addons \u2014 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d83ae3a4-382f-4e64-bf1e-73f953f2f654?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.20","to_inclusive":true,"patched_in":"1.4.21"}],"published":"2026-04-03T19:27:45Z","updated":"2026-04-04T07:42:01Z"},{"id":"wordfence:d83b06f5-b9e3-4fe9-b738-e718c79c00a6","source":"wordfence","cve":"CVE-2026-111833","title":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.28 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d83b06f5-b9e3-4fe9-b738-e718c79c00a6?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.28","to_inclusive":true,"patched_in":"1.6.29"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:27:54Z"},{"id":"wordfence:d83cd6a0-d69c-4e6c-b76f-00c398b5f7e6","source":"wordfence","cve":"CVE-2025-13334","title":"Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d83cd6a0-d69c-4e6c-b76f-00c398b5f7e6?source=api-prod","affected":[{"type":"plugin","slug":"blaze-demo-importer","name":"Blaze Demo Importer","from":"1.0.0","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-12-11T15:12:44Z","updated":"2026-10-14T10:52:37Z"},{"id":"wordfence:d83d1fd0-6e21-406e-a7c0-89d26eabbb32","source":"wordfence","cve":"CVE-2023-4239","title":"Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d83d1fd0-6e21-406e-a7c0-89d26eabbb32?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":""}],"published":"2023-08-08T00:00:00Z","updated":"2026-09-24T17:52:51Z"},{"id":"wordfence:d83e0495-bfa6-4034-88db-7e4182977a94","source":"wordfence","cve":"CVE-2025-52717","title":"LifterLMS <= 8.0.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d83e0495-bfa6-4034-88db-7e4182977a94?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":"8.0.7"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:52:56Z"},{"id":"wordfence:d8405ba4-5880-4a9e-8196-722e7f59f9a1","source":"wordfence","cve":"CVE-2026-3004","title":"Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8405ba4-5880-4a9e-8196-722e7f59f9a1?source=api-prod","affected":[{"type":"plugin","slug":"snow-monkey-blocks","name":"Snow Monkey Blocks","from":"*","from_inclusive":true,"to":"24.1.11","to_inclusive":true,"patched_in":"24.1.12"}],"published":"2026-05-05T00:00:00Z","updated":"2026-05-13T07:44:12Z"},{"id":"wordfence:d844ca83-84e5-4b6c-ae26-f300c7328d78","source":"wordfence","cve":"CVE-2024-1759","title":"WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d844ca83-84e5-4b6c-ae26-f300c7328d78?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-03T12:03:35Z"},{"id":"wordfence:d8451f0f-0dfd-4926-aa35-75edf70ed6f2","source":"wordfence","cve":"CVE-2022-41781","title":"Permalink Manager Lite <= 2.2.20 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8451f0f-0dfd-4926-aa35-75edf70ed6f2?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.2.20","to_inclusive":true,"patched_in":"2.2.20.1"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8461a10-44e1-437a-ad6c-7107aeb66124","source":"wordfence","cve":"","title":"WordPress Affiliates Plugin \u2014 SliceWP Affiliates <= 1.0.45 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8461a10-44e1-437a-ad6c-7107aeb66124?source=api-prod","affected":[{"type":"plugin","slug":"slicewp","name":"Affiliate Program Suite \u2014 SliceWP Affiliates","from":"*","from_inclusive":true,"to":"1.0.45","to_inclusive":true,"patched_in":"1.0.46"}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d84797c7-f1fc-4222-aa75-5b44ef96a4a6","source":"wordfence","cve":"CVE-2025-24578","title":"ElementInvader Addons for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84797c7-f1fc-4222-aa75-5b44ef96a4a6?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:35:40Z"},{"id":"wordfence:d847e26b-8c11-4612-84d7-ff319ca374dc","source":"wordfence","cve":"CVE-2017-18596","title":"Elementor Website Builder <= 1.7.12 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d847e26b-8c11-4612-84d7-ff319ca374dc?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"1.7.12","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2017-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d848f34d-5b78-4e2b-9449-5722ad8b4fc8","source":"wordfence","cve":"CVE-2026-62141","title":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d848f34d-5b78-4e2b-9449-5722ad8b4fc8?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-10-30T15:10:00Z","updated":"2026-11-03T20:09:50Z"},{"id":"wordfence:d84a934f-a807-4968-9db0-9a292767046b","source":"wordfence","cve":"CVE-2024-37445","title":"Html5 Audio Player <= 2.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84a934f-a807-4968-9db0-9a292767046b?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:54:18Z"},{"id":"wordfence:d84ad258-8a0c-44b2-9897-03ad214e8493","source":"wordfence","cve":"","title":"Barclaycart (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84ad258-8a0c-44b2-9897-03ad214e8493?source=api-prod","affected":[{"type":"plugin","slug":"barclaycart","name":"barclaycart","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d84b94b3-b4ef-400c-8d4c-6b52d839c239","source":"wordfence","cve":"CVE-2025-47646","title":"PSW Front-end Login & Registration <= 1.12 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84b94b3-b4ef-400c-8d4c-6b52d839c239?source=api-prod","affected":[{"type":"plugin","slug":"psw-login-and-registration","name":"PSW Front-end Login & Registration","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-12T20:13:10Z"},{"id":"wordfence:d84be1a7-87b2-430b-9db1-a6b227e23d11","source":"wordfence","cve":"CVE-2026-86801","title":"To Do List Member 1.4  - 1.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84be1a7-87b2-430b-9db1-a6b227e23d11?source=api-prod","affected":[{"type":"plugin","slug":"todo-lists-for-membership-sites","name":"To Do List Member","from":"1.4","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:46:51Z"},{"id":"wordfence:d84cf972-be7e-497c-b360-2ea491e44ad6","source":"wordfence","cve":"CVE-2009-2431","title":"WordPress Core < 2.8 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84cf972-be7e-497c-b360-2ea491e44ad6?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.8"}],"published":"2009-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d84f9b06-9127-4526-8f17-21608ec2f601","source":"wordfence","cve":"CVE-2024-2327","title":"Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d84f9b06-9127-4526-8f17-21608ec2f601?source=api-prod","affected":[{"type":"plugin","slug":"global-elementor-buttons","name":"Global Elementor Buttons","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:25Z"},{"id":"wordfence:d851760a-e72c-4cd1-9399-9a54c126a30a","source":"wordfence","cve":"CVE-2025-57891","title":"Recurring PayPal Donations <= 1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d851760a-e72c-4cd1-9399-9a54c126a30a?source=api-prod","affected":[{"type":"plugin","slug":"recurring-donation","name":"Recurring PayPal Donations","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:02:01Z"},{"id":"wordfence:d851ad1f-be74-49eb-9c0d-c1b309581209","source":"wordfence","cve":"CVE-2024-9446","title":"WP Simple Anchors Links <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d851ad1f-be74-49eb-9c0d-c1b309581209?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-anchors-links","name":"WP Simple Anchors Links","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T18:08:43Z","updated":"2024-10-31T06:48:55Z"},{"id":"wordfence:d857324c-94c9-471a-9da8-0b8c9bb50262","source":"wordfence","cve":"CVE-2023-30493","title":"Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d857324c-94c9-471a-9da8-0b8c9bb50262?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.2"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8582985-ce9c-49f2-a7c6-180117e3da28","source":"wordfence","cve":"CVE-2025-64283","title":"RTMKit <= 1.6.7 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8582985-ce9c-49f2-a7c6-180117e3da28?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-02-14T00:00:00Z","updated":"2025-11-24T19:36:06Z"},{"id":"wordfence:d85b98c3-c912-4467-962c-eb64465266b2","source":"wordfence","cve":"CVE-2021-24864","title":"WP Cloudy <= 4.4.9 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d85b98c3-c912-4467-962c-eb64465266b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-cloudy","name":"WP Cloudy, weather plugin","from":"*","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":""}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d85e54c2-dff6-42e6-8123-767438f9c5f1","source":"wordfence","cve":"CVE-2024-13810","title":"Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d85e54c2-dff6-42e6-8123-767438f9c5f1?source=api-prod","affected":[{"type":"theme","slug":"zass","name":"Zass - WooCommerce Theme for Handmade Artists and Artisans","from":"*","from_inclusive":true,"to":"3.9.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:11:01Z","updated":"2025-03-05T09:21:49Z"},{"id":"wordfence:d8616189-5ab8-4db0-ab9e-768cc738aeb6","source":"wordfence","cve":"","title":"Jetpack <= 3.5.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8616189-5ab8-4db0-ab9e-768cc738aeb6?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8624f48-9938-4114-a55a-e635ca0dff2c","source":"wordfence","cve":"CVE-2022-3925","title":"Buddybadges <= 1.0.0 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8624f48-9938-4114-a55a-e635ca0dff2c?source=api-prod","affected":[{"type":"plugin","slug":"buddybadges","name":"buddybadges","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d862e8e6-ecf6-41f5-8f40-1225ecec7e1f","source":"wordfence","cve":"CVE-2023-27439","title":"New Adman <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d862e8e6-ecf6-41f5-8f40-1225ecec7e1f?source=api-prod","affected":[{"type":"plugin","slug":"new-adman","name":"New Adman","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8680df5-ef0c-45b6-b2c7-c54e60176bd6","source":"wordfence","cve":"CVE-2025-46527","title":"Web3Press <= 3.2.0 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8680df5-ef0c-45b6-b2c7-c54e60176bd6?source=api-prod","affected":[{"type":"plugin","slug":"likecoin","name":"Web3Press \u2013 Migrating to 3ook.com Decentralized Bookstore","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-08T18:12:58Z"},{"id":"wordfence:d8693b7d-693f-450a-89ef-e936a8813ca9","source":"wordfence","cve":"CVE-2026-4300","title":"Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8693b7d-693f-450a-89ef-e936a8813ca9?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2026-04-07T21:02:36Z","updated":"2026-04-08T09:25:53Z"},{"id":"wordfence:d86aa41c-24df-49ec-b273-7bb57addddde","source":"wordfence","cve":"CVE-2024-5860","title":"Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d86aa41c-24df-49ec-b273-7bb57addddde?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.2.8","to_inclusive":true,"patched_in":"3.5.2.9"}],"published":"2024-06-17T00:00:00Z","updated":"2024-06-18T03:21:54Z"},{"id":"wordfence:d86c720b-ede6-4789-ba83-2d035e1641bf","source":"wordfence","cve":"CVE-2024-32436","title":"Gift Vouchers <= 4.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d86c720b-ede6-4789-ba83-2d035e1641bf?source=api-prod","affected":[{"type":"plugin","slug":"gift-voucher","name":"Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T18:55:44Z"},{"id":"wordfence:d870ff8d-ea4b-4777-9892-0d9982182b9f","source":"wordfence","cve":"CVE-2024-0963","title":"Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d870ff8d-ea4b-4777-9892-0d9982182b9f?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.2.52","to_inclusive":true,"patched_in":"1.2.53"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-02T11:34:15Z"},{"id":"wordfence:d87133a0-d24a-4c6a-8d6b-3867a319796a","source":"wordfence","cve":"CVE-2026-66601","title":"Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d87133a0-d24a-4c6a-8d6b-3867a319796a?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.39","to_inclusive":true,"patched_in":"3.40"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:25:53Z"},{"id":"wordfence:d87134e8-9d73-4a39-b071-37a5dac033b4","source":"wordfence","cve":"CVE-2024-2124","title":"Translate WordPress and go Multilingual \u2013 Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d87134e8-9d73-4a39-b071-37a5dac033b4?source=api-prod","affected":[{"type":"plugin","slug":"weglot","name":"Translate WordPress with Weglot 2.0 \u2013 Multilingual AI Translation","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":true,"patched_in":"4.2.6"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T04:32:16Z"},{"id":"wordfence:d872ec33-6284-495c-b894-41fe7b40b63c","source":"wordfence","cve":"CVE-2025-6079","title":"School Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d872ec33-6284-495c-b894-41fe7b40b63c?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"93.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:56:23Z","updated":"2025-08-18T18:28:11Z"},{"id":"wordfence:d874a041-1cd4-4ca1-85bd-4050630d8502","source":"wordfence","cve":"CVE-2025-6782","title":"GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=api-prod","affected":[{"type":"plugin","slug":"gozen-forms","name":"GoZen Forms","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:18:38Z","updated":"2025-07-04T01:44:05Z"},{"id":"wordfence:d874f9d7-c532-467d-9e3d-9529dd5bdc47","source":"wordfence","cve":"CVE-2023-23790","title":"Pods <= 2.9.10.2 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d874f9d7-c532-467d-9e3d-9529dd5bdc47?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.9.10.2","to_inclusive":true,"patched_in":"2.9.11"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d875514c-c7d3-4236-842b-6e772048448d","source":"wordfence","cve":"CVE-2025-12524","title":"Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=api-prod","affected":[{"type":"plugin","slug":"post-type-switcher","name":"Post Type Switcher","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-11-17T18:38:47Z","updated":"2025-11-18T06:43:20Z"},{"id":"wordfence:d875969e-3749-4f0b-a807-36609bfca4d3","source":"wordfence","cve":"CVE-2013-3487","title":"BulletProof Security <= .48.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d875969e-3749-4f0b-a807-36609bfca4d3?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".48.9","to_inclusive":true,"patched_in":".49"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d875c7b8-a508-4764-aa94-51c799698791","source":"wordfence","cve":"CVE-2024-56003","title":"Caldera SMTP Mailer <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d875c7b8-a508-4764-aa94-51c799698791?source=api-prod","affected":[{"type":"plugin","slug":"caldera-smtp-mailer","name":"Caldera SMTP Mailer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:07:10Z"},{"id":"wordfence:d877ca14-7dba-4c31-afef-7072bd5bfa02","source":"wordfence","cve":"CVE-2025-68837","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d877ca14-7dba-4c31-afef-7072bd5bfa02?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:46:45Z"},{"id":"wordfence:d8781ed1-6609-4965-9ba2-30e70eac1c1a","source":"wordfence","cve":"CVE-2022-4682","title":"Lightbox Gallery <= 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8781ed1-6609-4965-9ba2-30e70eac1c1a?source=api-prod","affected":[{"type":"plugin","slug":"lightbox-gallery","name":"Lightbox Gallery","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d87c4534-3f71-4e7e-bf17-222e77fee24f","source":"wordfence","cve":"CVE-2025-15520","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d87c4534-3f71-4e7e-bf17-222e77fee24f?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.1","to_inclusive":true,"patched_in":"6.0.7.2"}],"published":"2026-01-23T00:00:00Z","updated":"2026-05-04T14:57:28Z"},{"id":"wordfence:d87f98d1-c281-4f75-a96a-e099c43ed4e1","source":"wordfence","cve":"CVE-2026-66471","title":"Accordions \u2013 Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d87f98d1-c281-4f75-a96a-e099c43ed4e1?source=api-prod","affected":[{"type":"plugin","slug":"accordions-wp","name":"Accordions \u2013 Responsive Accordion & FAQ Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-08-10T00:00:00Z","updated":"2026-09-09T16:10:01Z"},{"id":"wordfence:d8801b9a-afcb-483b-a018-4f68448e96de","source":"wordfence","cve":"CVE-2024-12250","title":"Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8801b9a-afcb-483b-a018-4f68448e96de?source=api-prod","affected":[{"type":"plugin","slug":"accept-authorize-net-payments-using-contact-form-7","name":"Accept Authorize.NET Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2024-12-17T14:56:24Z","updated":"2024-12-18T03:22:08Z"},{"id":"wordfence:d8805e63-3750-49f8-81dd-bd3353f30c87","source":"wordfence","cve":"CVE-2025-9128","title":"eID Easy <= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8805e63-3750-49f8-81dd-bd3353f30c87?source=api-prod","affected":[{"type":"plugin","slug":"smart-id","name":"eID Easy","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2025-09-10T18:55:40Z","updated":"2025-10-10T20:55:44Z"},{"id":"wordfence:d8880266-d30c-4974-8d08-731f86e212ec","source":"wordfence","cve":"CVE-2026-28140","title":"JetFormBuilder \u2014 Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8880266-d30c-4974-8d08-731f86e212ec?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.4.1","to_inclusive":true,"patched_in":"3.6.4.2"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:21:57Z"},{"id":"wordfence:d8882546-87ef-44b7-b72c-e70107ce4a0b","source":"wordfence","cve":"CVE-2026-107342","title":"Kali Forms <= 2.4.29 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8882546-87ef-44b7-b72c-e70107ce4a0b?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-03T19:21:02Z"},{"id":"wordfence:d888cd53-415c-4667-b35a-5b3bd2226eeb","source":"wordfence","cve":"CVE-2021-24760","title":"Gutenberg PDF Viewer Block <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d888cd53-415c-4667-b35a-5b3bd2226eeb?source=api-prod","affected":[{"type":"plugin","slug":"pdf-viewer-block","name":"PDF Viewer Block for Gutenberg","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d889257e-b7a6-4704-876d-4b49f92a0849","source":"wordfence","cve":"CVE-2025-52832","title":"NGG Smart Image Search <= 3.4.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d889257e-b7a6-4704-876d-4b49f92a0849?source=api-prod","affected":[{"type":"plugin","slug":"ngg-smart-image-search","name":"NGG Smart Image Search","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:53:54Z"},{"id":"wordfence:d8895dc9-5854-433d-801b-c8aebd6bc126","source":"wordfence","cve":"CVE-2025-53584","title":"WP Ticket Customer Service Software & Support Ticket System <= 6.0.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8895dc9-5854-433d-801b-c8aebd6bc126?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T21:05:18Z"},{"id":"wordfence:d88a5dfc-4654-4299-b5a5-2a48b3823e37","source":"wordfence","cve":"CVE-2014-2054","title":"Advanced Contact form 7 DB  <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)","severity":"low","cvss":3.7,"cwe":"CWE-1395","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d88a5dfc-4654-4299-b5a5-2a48b3823e37?source=api-prod","affected":[{"type":"plugin","slug":"advanced-cf7-db","name":"Advanced Contact form 7 DB","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"},{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-07T19:19:24Z"},{"id":"wordfence:d88a7c35-fe98-48eb-960b-0e4f8fcab4cb","source":"wordfence","cve":"CVE-2015-9526","title":"Easy Digital Downloads \u2013 Product Reviews <= 1.3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d88a7c35-fe98-48eb-960b-0e4f8fcab4cb?source=api-prod","affected":[{"type":"plugin","slug":"edd-product-reviews","name":"Easy Digital Downloads - Product Reviews","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.10"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d88eb628-09c9-451c-b5ae-f26a93514447","source":"wordfence","cve":"CVE-2022-46819","title":"Continuous announcement scroller <= 13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d88eb628-09c9-451c-b5ae-f26a93514447?source=api-prod","affected":[{"type":"plugin","slug":"continuous-announcement-scroller","name":"Continuous announcement scroller","from":"*","from_inclusive":true,"to":"13.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d890e7a5-ea9f-40e5-9549-a6f26421b043","source":"wordfence","cve":"CVE-2024-8728","title":"Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d890e7a5-ea9f-40e5-9549-a6f26421b043?source=api-prod","affected":[{"type":"plugin","slug":"easy-load-more","name":"Easy Load More","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T19:13:05Z","updated":"2024-10-01T07:30:21Z"},{"id":"wordfence:d891caca-40be-4905-b5c3-bc3f2ddcd3cd","source":"wordfence","cve":"CVE-2024-3993","title":"AZAN Plugin <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d891caca-40be-4905-b5c3-bc3f2ddcd3cd?source=api-prod","affected":[{"type":"plugin","slug":"azan","name":"AZAN Plugin","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":"0.7"}],"published":"2024-05-24T00:00:00Z","updated":"2024-08-01T17:32:11Z"},{"id":"wordfence:d893edd0-8a60-43fd-94bb-3b52cea1d00e","source":"wordfence","cve":"CVE-2013-2742","title":"BackupBuddy < 3.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d893edd0-8a60-43fd-94bb-3b52cea1d00e?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2013-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d897daf8-5320-4546-9a63-1d34a15b2a58","source":"wordfence","cve":"CVE-2023-5254","title":"AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d897daf8-5320-4546-9a63-1d34a15b2a58?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.8.9","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d897fdc8-bc72-426b-89f6-9416f9a7d25d","source":"wordfence","cve":"CVE-2025-62037","title":"Togo < 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d897fdc8-bc72-426b-89f6-9416f9a7d25d?source=api-prod","affected":[{"type":"theme","slug":"togo","name":"Togo \u2013 Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:05:47Z"},{"id":"wordfence:d8987bc5-2bc0-4a92-bcf0-cc3245e15bed","source":"wordfence","cve":"CVE-2026-5506","title":"Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8987bc5-2bc0-4a92-bcf0-cc3245e15bed?source=api-prod","affected":[{"type":"plugin","slug":"wavr","name":"Wavr","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:07Z","updated":"2026-04-08T06:43:42Z"},{"id":"wordfence:d89918e1-b525-4d32-9b11-5e014eb02c16","source":"wordfence","cve":"","title":"Auto Affiliate Links <= 6.4.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d89918e1-b525-4d32-9b11-5e014eb02c16?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.4.2.7","to_inclusive":true,"patched_in":"6.4.2.8"}],"published":"2024-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d89cf759-5e5f-43e2-90a9-a8e554653ee1","source":"wordfence","cve":"CVE-2023-6751","title":"Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d89cf759-5e5f-43e2-90a9-a8e554653ee1?source=api-prod","affected":[{"type":"plugin","slug":"hostinger","name":"Hostinger Tools","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:34Z"},{"id":"wordfence:d89ff7ef-e184-4993-9496-867f7bf28a4b","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.2 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d89ff7ef-e184-4993-9496-867f7bf28a4b?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8a0f5a3-fed8-4dac-b07a-46139a940665","source":"wordfence","cve":"CVE-2026-14848","title":"Paid Member Subscriptions <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Cross-User Subscription Hijack","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a0f5a3-fed8-4dac-b07a-46139a940665?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T14:25:17Z"},{"id":"wordfence:d8a12e1d-f46a-499e-bfd6-185d5b955071","source":"wordfence","cve":"","title":"Ecwid Ecommerce Shopping Cart <= 6.10.22 - Insufficient Access Control on Multiple AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a12e1d-f46a-499e-bfd6-185d5b955071?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.10.22","to_inclusive":true,"patched_in":"6.10.23"}],"published":"2022-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8a3e69e-b6d2-495a-878d-1c2329e9e553","source":"wordfence","cve":"CVE-2011-4803","title":"WPtouch <= 1.9.8 - SQL Injection","severity":"high","cvss":7.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a3e69e-b6d2-495a-878d-1c2329e9e553?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"1.9.8.1","to_inclusive":false,"patched_in":"1.9.8.1"}],"published":"2011-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8a45482-ab07-4088-b078-73a6ba6c802f","source":"wordfence","cve":"CVE-2025-67973","title":"Sunshine Photo Cart <= 3.5.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a45482-ab07-4088-b078-73a6ba6c802f?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.5.6.2","to_inclusive":true,"patched_in":"3.5.7.1"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:31:15Z"},{"id":"wordfence:d8a490c6-14c1-4c71-b44c-1e362cc892a8","source":"wordfence","cve":"CVE-2021-4376","title":"WooCommerce Multi Currency <= 2.1.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a490c6-14c1-4c71-b44c-1e362cc892a8?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8a4feb3-908f-4fff-84f2-099f56d46f5b","source":"wordfence","cve":"CVE-2024-10574","title":"Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a4feb3-908f-4fff-84f2-099f56d46f5b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Developer","from":"20.0.0","from_inclusive":true,"to":"21.8.0","to_inclusive":true,"patched_in":"21.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"7.0.0","from_inclusive":true,"to":"8.8.0","to_inclusive":true,"patched_in":"8.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Agency","from":"30.0.0","from_inclusive":true,"to":"31.8.0","to_inclusive":true,"patched_in":"31.8.0.100"}],"published":"2025-01-25T00:00:00Z","updated":"2025-03-12T17:35:27Z"},{"id":"wordfence:d8a56a1c-6af0-47e6-906c-bb3eb1440eb9","source":"wordfence","cve":"","title":"My Calendar < 2.3.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a56a1c-6af0-47e6-906c-bb3eb1440eb9?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8a81c01-495f-4861-b66f-000072e99512","source":"wordfence","cve":"CVE-2026-6939","title":"CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting via 'approval_code' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a81c01-495f-4861-b66f-000072e99512?source=api-prod","affected":[{"type":"plugin","slug":"corvuspay-woocommerce-integration","name":"CorvusPay WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2026-07-10T16:43:03Z","updated":"2026-07-11T05:35:50Z"},{"id":"wordfence:d8aa06eb-774a-4cd9-bd35-2d6409475696","source":"wordfence","cve":"CVE-2025-10938","title":"UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8aa06eb-774a-4cd9-bd35-2d6409475696?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.5.09","to_inclusive":true,"patched_in":"3.5.10"}],"published":"2025-11-20T19:18:39Z","updated":"2026-09-14T19:51:54Z"},{"id":"wordfence:d8af9d7e-e99e-4d60-ac02-9b0e3699e59f","source":"wordfence","cve":"CVE-2026-40803","title":"Jotform \u2013 AI Chatbot <= 3.8.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8af9d7e-e99e-4d60-ac02-9b0e3699e59f?source=api-prod","affected":[{"type":"plugin","slug":"jotform-ai-chatbot","name":"Jotform \u2013 AI Chatbot","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-28T21:18:31Z"},{"id":"wordfence:d8afc698-b9dd-4da8-a3fe-1813a14f6acc","source":"wordfence","cve":"CVE-2026-65460","title":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u0631\u062f\u0627\u062e\u062a \u0627\u0645\u0646 \u0632\u0631\u06cc\u0646\u200c\u067e\u0627\u0644 \u0628\u0631\u0627\u06cc \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 (ZarinPal for WooCommerce) <= 5.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8afc698-b9dd-4da8-a3fe-1813a14f6acc?source=api-prod","affected":[{"type":"plugin","slug":"zarinpal-woocommerce-payment-gateway","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u0631\u062f\u0627\u062e\u062a \u0627\u0645\u0646 \u0632\u0631\u06cc\u0646\u200c\u067e\u0627\u0644 \u0628\u0631\u0627\u06cc \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 (ZarinPal for WooCommerce)","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:39:06Z"},{"id":"wordfence:d8b0f381-c07c-4560-bb5c-3a6aee442390","source":"wordfence","cve":"CVE-2026-89330","title":"EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b0f381-c07c-4560-bb5c-3a6aee442390?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"4.6.6"}],"published":"2026-09-17T18:31:10Z","updated":"2026-09-18T06:38:56Z"},{"id":"wordfence:d8b20316-b9f8-4e34-a23a-47e03475b19c","source":"wordfence","cve":"CVE-2026-16619","title":"miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force","severity":"low","cvss":3.1,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b20316-b9f8-4e34-a23a-47e03475b19c?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":true,"patched_in":"6.2.8"}],"published":"2026-07-30T00:00:00Z","updated":"2026-09-17T15:32:55Z"},{"id":"wordfence:d8b449c6-ae13-404a-a356-37d1a08c2a14","source":"wordfence","cve":"CVE-2024-50470","title":"Themes4WP YouTube External Subtitles <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b449c6-ae13-404a-a356-37d1a08c2a14?source=api-prod","affected":[{"type":"plugin","slug":"themes4wp-youtube-external-subtitles","name":"Themes4WP YouTube External Subtitles","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:50:44Z"},{"id":"wordfence:d8b47395-6d04-4ecc-9ae5-081aabe30d31","source":"wordfence","cve":"CVE-2026-25428","title":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll <= 2.5.5 - Authenticated (Editor+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b47395-6d04-4ecc-9ae5-081aabe30d31?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2026-01-27T00:00:00Z","updated":"2026-05-11T19:42:05Z"},{"id":"wordfence:d8b544ba-8530-4c00-a8a8-b24d8b68a33a","source":"wordfence","cve":"","title":"Double Opt-In for Download <= 2.0.9 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b544ba-8530-4c00-a8a8-b24d8b68a33a?source=api-prod","affected":[{"type":"plugin","slug":"double-opt-in-for-download","name":"Double Opt-In for Download","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2016-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8b5b320-9283-4072-be65-f5c62ca29b35","source":"wordfence","cve":"CVE-2025-47516","title":"Time Clock <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b5b320-9283-4072-be65-f5c62ca29b35?source=api-prod","affected":[{"type":"plugin","slug":"time-clock","name":"Time Clock \u2013 A WordPress Employee & Volunteer Time Clock Plugin","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:31:57Z"},{"id":"wordfence:d8ba1a2f-d4f9-4cfe-9a42-ec2e116aed1b","source":"wordfence","cve":"CVE-2022-1932","title":"Rezgo Online Booking <= 4.1.7 - Reflected Cross-Site-Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ba1a2f-d4f9-4cfe-9a42-ec2e116aed1b?source=api-prod","affected":[{"type":"plugin","slug":"rezgo","name":"Rezgo Online Booking","from":"4.1.7","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.1.8"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8ba4a74-6649-4566-b9d5-19662539158b","source":"wordfence","cve":"CVE-2021-24862","title":"RegistrationMagic <= 5.0.1.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ba4a74-6649-4566-b9d5-19662539158b?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.0.1.5","to_inclusive":true,"patched_in":"5.0.1.6"}],"published":"2022-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8bf1d64-8012-4588-9897-aa8bb0cacfb6","source":"wordfence","cve":"CVE-2024-27987","title":"GiveWP <= 3.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8bf1d64-8012-4588-9897-aa8bb0cacfb6?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:43:28Z"},{"id":"wordfence:d8c07de1-b722-4252-a5a3-52b12dae72dc","source":"wordfence","cve":"CVE-2026-77694","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c07de1-b722-4252-a5a3-52b12dae72dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.19","to_inclusive":false,"patched_in":"4.1.19"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:43:24Z"},{"id":"wordfence:d8c0cd48-b27c-4bc1-9e5f-d918448290fb","source":"wordfence","cve":"","title":"Trade Runner <= 3.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c0cd48-b27c-4bc1-9e5f-d918448290fb?source=api-prod","affected":[{"type":"plugin","slug":"traderunner","name":"Trade Runner","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.10"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8c11ebc-5c83-46a2-a8dd-b838cd50ddc6","source":"wordfence","cve":"CVE-2026-3474","title":"EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c11ebc-5c83-46a2-a8dd-b838cd50ddc6?source=api-prod","affected":[{"type":"plugin","slug":"emailkit","name":"EmailKit \u2013 Email Customizer for WooCommerce & WP","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2026-03-20T11:00:41Z","updated":"2026-03-20T23:25:14Z"},{"id":"wordfence:d8c14927-d7b4-4766-8fe8-3616c0779e6b","source":"wordfence","cve":"CVE-2025-13029","title":"Knowband Mobile App Builder  <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary User Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c14927-d7b4-4766-8fe8-3616c0779e6b?source=api-prod","affected":[{"type":"plugin","slug":"knowband-mobile-app-builder-for-woocommerce","name":"Knowband Mobile App Builder","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-06T15:58:53Z"},{"id":"wordfence:d8c1823c-72be-4342-b4e9-0dc18afbb4a8","source":"wordfence","cve":"CVE-2024-37250","title":"Advanced Custom Fields Pro <= 6.3.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c1823c-72be-4342-b4e9-0dc18afbb4a8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-06-26T00:00:00Z","updated":"2024-12-12T19:35:08Z"},{"id":"wordfence:d8c19868-49c2-4ee2-883a-93549e65d41a","source":"wordfence","cve":"CVE-2023-29438","title":"SimpleModal Contact Form (SMCF) <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c19868-49c2-4ee2-883a-93549e65d41a?source=api-prod","affected":[{"type":"plugin","slug":"simplemodal-contact-form-smcf","name":"SimpleModal Contact Form (SMCF)","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8c466cf-44d1-480f-8ef2-2b78040618ca","source":"wordfence","cve":"CVE-2025-28882","title":"Omnify <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c466cf-44d1-480f-8ef2-2b78040618ca?source=api-prod","affected":[{"type":"plugin","slug":"omnify-widget","name":"Omnify \u2013 The Best Scheduling Widgets for WordPress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:39:32Z"},{"id":"wordfence:d8c89641-805f-4f23-9eae-01e05fde19d0","source":"wordfence","cve":"CVE-2021-38361","title":".htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c89641-805f-4f23-9eae-01e05fde19d0?source=api-prod","affected":[{"type":"plugin","slug":"htaccess-redirect","name":".htaccess Redirect","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8c99ca9-74dc-4dca-8fa2-f637e98a32a8","source":"wordfence","cve":"CVE-2026-106646","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory < 6.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c99ca9-74dc-4dca-8fa2-f637e98a32a8?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":false,"patched_in":"6.1.1"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:37:41Z"},{"id":"wordfence:d8cacd78-df1d-4c63-b051-3e02c45671cd","source":"wordfence","cve":"CVE-2026-39650","title":"UnitechPay <= 1.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8cacd78-df1d-4c63-b051-3e02c45671cd?source=api-prod","affected":[{"type":"plugin","slug":"unitechpay-paiements-mobile-money","name":"UnitechPay \u2013 Wave & Orange Money Payments","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:23:11Z"},{"id":"wordfence:d8cb9488-a73e-4e27-8927-3e6ac65b33c5","source":"wordfence","cve":"CVE-2025-58666","title":"Website Chat Button: Kommo integration <= 1.3.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8cb9488-a73e-4e27-8927-3e6ac65b33c5?source=api-prod","affected":[{"type":"plugin","slug":"website-chat-button-kommo-integration","name":"Website Chat Button: Kommo integration","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:48:59Z"},{"id":"wordfence:d8ce9ab4-d6d6-4e06-a042-145db02cf7ba","source":"wordfence","cve":"CVE-2024-1415","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ce9ab4-d6d6-4e06-a042-145db02cf7ba?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.8.9","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-21T18:16:12Z"},{"id":"wordfence:d8ceb4a1-9354-4ed3-9a8f-45ba2057a810","source":"wordfence","cve":"CVE-2025-5961","title":"Migration, Backup, Staging \u2013 WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.116","to_inclusive":true,"patched_in":"0.9.117"}],"published":"2025-07-03T00:35:32Z","updated":"2025-07-03T13:44:12Z"},{"id":"wordfence:d8cf8cff-9d69-4593-afd5-1fc9a10ebd14","source":"wordfence","cve":"CVE-2024-44050","title":"Verbosa <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8cf8cff-9d69-4593-afd5-1fc9a10ebd14?source=api-prod","affected":[{"type":"theme","slug":"verbosa","name":"Verbosa","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.3.1"}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-26T18:01:10Z"},{"id":"wordfence:d8d013ae-a512-454a-bcfc-8725a6928fee","source":"wordfence","cve":"CVE-2026-1913","title":"Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d013ae-a512-454a-bcfc-8725a6928fee?source=api-prod","affected":[{"type":"plugin","slug":"gallagher-website-design","name":"Gallagher Website Design","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2026-04-21T20:36:56Z","updated":"2026-04-22T09:27:20Z"},{"id":"wordfence:d8d17ee3-73b3-4f58-8d08-14bbf2d9d9d8","source":"wordfence","cve":"CVE-2019-14206","title":"Adaptive Images for WordPress <= 0.6.66 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d17ee3-73b3-4f58-8d08-14bbf2d9d9d8?source=api-prod","affected":[{"type":"plugin","slug":"adaptive-images","name":"Adaptive Images for WordPress","from":"*","from_inclusive":true,"to":"0.6.67","to_inclusive":false,"patched_in":"0.6.67"}],"published":"2019-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8d44f9b-0eee-49ee-b640-40f3bd377be0","source":"wordfence","cve":"CVE-2022-1546","title":"WooCommerce \u2013 Product Importer  <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d44f9b-0eee-49ee-b640-40f3bd377be0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-importer","name":"WooCommerce \u2013 Product Importer","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8d4bc5a-7f76-4103-92e7-d7fe265fc255","source":"wordfence","cve":"CVE-2025-23810","title":"Len Slider <= 2.0.11 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d4bc5a-7f76-4103-92e7-d7fe265fc255?source=api-prod","affected":[{"type":"plugin","slug":"len-slider","name":"Len Slider","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:21:56Z"},{"id":"wordfence:d8d50b65-7479-4140-9231-c06c18d8be8f","source":"wordfence","cve":"CVE-2025-5919","title":"Appointment Booking and Scheduling Calendar Plugin \u2013 WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d50b65-7479-4140-9231-c06c18d8be8f?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":"1.0.37"}],"published":"2026-01-05T20:15:35Z","updated":"2026-01-06T08:21:50Z"},{"id":"wordfence:d8d52ced-807b-48c0-bb7a-e40d143ae5d3","source":"wordfence","cve":"CVE-2024-3607","title":"PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d52ced-807b-48c0-bb7a-e40d143ae5d3?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:45Z"},{"id":"wordfence:d8d6684a-5e79-4103-921d-4d997deecd23","source":"wordfence","cve":"CVE-2024-38788","title":"UiPress lite <= 3.4.06 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d6684a-5e79-4103-921d-4d997deecd23?source=api-prod","affected":[{"type":"plugin","slug":"uipress-lite","name":"UiPress lite | Effortless custom dashboards, admin themes and pages","from":"*","from_inclusive":true,"to":"3.4.06","to_inclusive":true,"patched_in":"3.4.07"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:17:19Z"},{"id":"wordfence:d8da513f-19b1-4ec4-b3ad-dc3a7bb6ab49","source":"wordfence","cve":"","title":"SP Projects & Document Manager <= 2.5.9.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8da513f-19b1-4ec4-b3ad-dc3a7bb6ab49?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"2.5.9.5","to_inclusive":true,"patched_in":"2.6.6.0"}],"published":"2016-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8db8ed5-ebeb-4102-928f-fe417e429ad2","source":"wordfence","cve":"CVE-2024-4553","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8db8ed5-ebeb-4102-928f-fe417e429ad2?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.1.5","to_inclusive":true,"patched_in":"7.1.6"}],"published":"2024-05-20T20:36:37Z","updated":"2024-05-21T09:31:50Z"},{"id":"wordfence:d8dc995d-912e-4d83-84cc-c99242022b82","source":"wordfence","cve":"CVE-2026-1651","title":"Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8dc995d-912e-4d83-84cc-c99242022b82?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.9.16","to_inclusive":true,"patched_in":"5.9.17"}],"published":"2026-03-03T12:24:57Z","updated":"2026-03-04T01:22:00Z"},{"id":"wordfence:d8df95b2-d1aa-4724-9150-5bf88ee2a765","source":"wordfence","cve":"CVE-2026-32374","title":"The Minimal <= 1.2.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8df95b2-d1aa-4724-9150-5bf88ee2a765?source=api-prod","affected":[{"type":"theme","slug":"the-minimal","name":"The Minimal","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T20:52:57Z"},{"id":"wordfence:d8e23501-9fc4-484b-b308-a9c51494bc9d","source":"wordfence","cve":"CVE-2022-1780","title":"LaTeX <= 3.4.10 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e23501-9fc4-484b-b308-a9c51494bc9d?source=api-prod","affected":[{"type":"plugin","slug":"latex","name":"LaTeX for WordPress","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8e5fccd-3b6c-4142-97ef-2166b5a4708f","source":"wordfence","cve":"CVE-2025-31444","title":"ShowTime Slideshow <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e5fccd-3b6c-4142-97ef-2166b5a4708f?source=api-prod","affected":[{"type":"plugin","slug":"showtime-slideshow","name":"ShowTime Slideshow","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:10:57Z"},{"id":"wordfence:d8e64525-6080-40f3-a296-389b800a5e8a","source":"wordfence","cve":"CVE-2024-2946","title":"ShopLentor \u2013 WooCommerce Builder for Elementor & Gutenberg +12 Modules \u2013 All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e64525-6080-40f3-a296-389b800a5e8a?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:25Z"},{"id":"wordfence:d8e6ebf2-a1b6-45c3-82d0-b94808e90741","source":"wordfence","cve":"CVE-2026-103076","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e6ebf2-a1b6-45c3-82d0-b94808e90741?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:45:25Z"},{"id":"wordfence:d8e849fb-76e0-427a-8e05-d340add1c150","source":"wordfence","cve":"CVE-2012-3578","title":"FCChat Widget < 2.2.13.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e849fb-76e0-427a-8e05-d340add1c150?source=api-prod","affected":[{"type":"plugin","slug":"fcchat","name":"FCChat Widget","from":"*","from_inclusive":true,"to":"2.2.13.7","to_inclusive":false,"patched_in":"2.2.13.7"}],"published":"2012-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8e95efa-1c34-4267-b93f-bb850f0a6e85","source":"wordfence","cve":"CVE-2025-23660","title":"MFPlugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e95efa-1c34-4267-b93f-bb850f0a6e85?source=api-prod","affected":[{"type":"plugin","slug":"mfplugin","name":"MFPlugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:25:59Z"},{"id":"wordfence:d8e967ce-fd36-44de-acca-c1985642ee5b","source":"wordfence","cve":"CVE-2024-0689","title":"Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8e967ce-fd36-44de-acca-c1985642ee5b?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2024-02-28T00:00:00Z","updated":"2024-07-29T21:37:34Z"},{"id":"wordfence:d8ec7d25-1574-416c-b5fd-3a71b1cc09d2","source":"wordfence","cve":"CVE-2026-2576","title":"Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ec7d25-1574-416c-b5fd-3a71b1cc09d2?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.21","to_inclusive":true,"patched_in":"6.4.22"}],"published":"2026-02-17T16:02:33Z","updated":"2026-02-18T04:35:46Z"},{"id":"wordfence:d8ecb2c6-c2d0-44b0-b9c2-4fcbc0f97632","source":"wordfence","cve":"CVE-2026-17604","title":"Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ecb2c6-c2d0-44b0-b9c2-4fcbc0f97632?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-08-15T17:49:09Z","updated":"2026-08-16T06:38:09Z"},{"id":"wordfence:d8ee82cf-916c-41e9-82d2-f25cc7a632ae","source":"wordfence","cve":"CVE-2024-23513","title":"PropertyHive <= 2.0.5 - Unauthenticated PHP Object Injection via propertyhive_currency","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ee82cf-916c-41e9-82d2-f25cc7a632ae?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-05T16:39:03Z"},{"id":"wordfence:d8eff266-43fe-4636-b4ef-c973db7e7952","source":"wordfence","cve":"CVE-2026-103481","title":"Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-15T15:45:39Z","updated":"2026-10-16T04:27:04Z"},{"id":"wordfence:d8f40034-c868-4337-bf0a-385a961f9c35","source":"wordfence","cve":"CVE-2024-43920","title":"Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f40034-c868-4337-bf0a-385a961f9c35?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:03:59Z"},{"id":"wordfence:d8f6419c-677a-4b16-bef3-59be981642f1","source":"wordfence","cve":"CVE-2026-118085","title":"GlobalPayments Gateway Provider for WooCommerce <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f6419c-677a-4b16-bef3-59be981642f1?source=api-prod","affected":[{"type":"plugin","slug":"global-payments-woocommerce","name":"GlobalPayments Gateway Provider for WooCommerce","from":"*","from_inclusive":true,"to":"1.23.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:15:20Z","updated":"2026-11-03T19:43:22Z"},{"id":"wordfence:d8f6d1cb-330b-4405-9249-4dd1c0e98922","source":"wordfence","cve":"CVE-2016-10880","title":"Google Doc Embedder <= 2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f6d1cb-330b-4405-9249-4dd1c0e98922?source=api-prod","affected":[{"type":"plugin","slug":"google-document-embedder","name":"Google Doc Embedder","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":false,"patched_in":"2.6.1"}],"published":"2016-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8f7b930-dad7-49ce-8826-8c8ab7b390ef","source":"wordfence","cve":"CVE-2025-68042","title":"Travelpayouts <= 1.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f7b930-dad7-49ce-8826-8c8ab7b390ef?source=api-prod","affected":[{"type":"plugin","slug":"travelpayouts","name":"Travelpayouts: All Travel Brands in One Place","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-01-29T00:00:00Z","updated":"2026-10-13T16:58:08Z"},{"id":"wordfence:d8f7d1c3-50eb-44ef-a832-a0230ff1406f","source":"wordfence","cve":"CVE-2024-47638","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f7d1c3-50eb-44ef-a832-a0230ff1406f?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-11-25T16:19:59Z"},{"id":"wordfence:d8f94588-635c-44b2-bd7e-af3068734713","source":"wordfence","cve":"CVE-2022-4762","title":"Materialis Companion <= 1.3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8f94588-635c-44b2-bd7e-af3068734713?source=api-prod","affected":[{"type":"plugin","slug":"materialis-companion","name":"Materialis Companion","from":"*","from_inclusive":true,"to":"1.3.39","to_inclusive":true,"patched_in":"1.3.40"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d8fab229-cd6b-45a3-9e80-a03a1704ad3e","source":"wordfence","cve":"CVE-2024-2017","title":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fab229-cd6b-45a3-9e80-a03a1704ad3e?source=api-prod","affected":[{"type":"plugin","slug":"countdown-builder","name":"Countdown, Coming Soon, Maintenance \u2013 Countdown & Clock","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.8.1"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-06T02:38:14Z"},{"id":"wordfence:d8fb20fb-a795-4ab0-9614-6ae6ac4f2eda","source":"wordfence","cve":"CVE-2022-4101","title":"Images Optimize and Upload CF7 <= 2.1.4 - Missing Authorization to Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fb20fb-a795-4ab0-9614-6ae6ac4f2eda?source=api-prod","affected":[{"type":"plugin","slug":"images-optimize-and-upload-cf7","name":"Images Optimize and Upload CF7","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-12-21T00:00:00Z","updated":"2025-06-02T19:03:28Z"},{"id":"wordfence:d8fbfcfe-3597-4c59-b47c-4e48ecbb8d83","source":"wordfence","cve":"CVE-2024-11849","title":"Pods \u2013 Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fbfcfe-3597-4c59-b47c-4e48ecbb8d83?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.8.1"}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-17T12:47:04Z"},{"id":"wordfence:d900584c-0f58-4abc-92ff-841f898d02fc","source":"wordfence","cve":"CVE-2023-2608","title":"Multiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injection","severity":"low","cvss":3.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d900584c-0f58-4abc-92ff-841f898d02fc?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.3.17","to_inclusive":true,"patched_in":"3.3.18"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9009880-d4fa-407d-9ef5-d86013190642","source":"wordfence","cve":"CVE-2025-15669","title":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9009880-d4fa-407d-9ef5-d86013190642?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:29:27Z"},{"id":"wordfence:d9022afe-0c79-413b-ac0a-a1d32ec09619","source":"wordfence","cve":"CVE-2024-6836","title":"Funnel Builder for WordPress by FunnelKit \u2013 Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9022afe-0c79-413b-ac0a-a1d32ec09619?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T05:31:56Z"},{"id":"wordfence:d9051cdb-b894-49a3-84a6-7470f8323706","source":"wordfence","cve":"CVE-2025-25149","title":"Login-box <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9051cdb-b894-49a3-84a6-7470f8323706?source=api-prod","affected":[{"type":"plugin","slug":"login-box","name":"Login-box","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:22:34Z"},{"id":"wordfence:d906992f-8675-4170-8643-48799ae7ac7c","source":"wordfence","cve":"CVE-2015-9457","title":"Pretty Links \u2013 Link Management, Branding, Tracking & Sharing Plugin <= 1.6.7 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d906992f-8675-4170-8643-48799ae7ac7c?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":false,"patched_in":"1.6.8"}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d908e8ac-6864-4951-bbef-8d98ac641912","source":"wordfence","cve":"CVE-2023-30482","title":"WPBulky <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d908e8ac-6864-4951-bbef-8d98ac641912?source=api-prod","affected":[{"type":"plugin","slug":"wpbulky-wp-bulk-edit-post-types","name":"WPBulky \u2013 WordPress Bulk Edit Post Types","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2","source":"wordfence","cve":"CVE-2023-6999","title":"Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.7.31","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"2.8","from_inclusive":true,"to":"2.8.23.2","to_inclusive":false,"patched_in":"2.7.31.2"},{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"3","from_inclusive":true,"to":"3.0.10.2","to_inclusive":false,"patched_in":"2.7.31.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-07-29T21:37:34Z"},{"id":"wordfence:d911be19-6b8c-4e38-b955-7f8826aeed8a","source":"wordfence","cve":"CVE-2024-43127","title":"Products, Order & Customers Export for WooCommerce <= 2.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d911be19-6b8c-4e38-b955-7f8826aeed8a?source=api-prod","affected":[{"type":"plugin","slug":"export-woocommerce","name":"Export Products, Orders & Customers for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:07:22Z"},{"id":"wordfence:d9125873-aedd-4334-b8e0-74b67d301904","source":"wordfence","cve":"CVE-2025-3452","title":"SecuPress Free <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9125873-aedd-4334-b8e0-74b67d301904?source=api-prod","affected":[{"type":"plugin","slug":"secupress","name":"SecuPress with Simple SSL \u2013 Simple and Performant Security","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.3.10"}],"published":"2025-04-28T00:00:00Z","updated":"2025-04-29T08:22:00Z"},{"id":"wordfence:d9165ab7-2fb2-4ea6-b52b-c2f652111b22","source":"wordfence","cve":"CVE-2026-119466","title":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9165ab7-2fb2-4ea6-b52b-c2f652111b22?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.6"}],"published":"2026-10-30T16:16:00Z","updated":"2026-11-03T19:51:11Z"},{"id":"wordfence:d916a62f-76b9-4e6c-8b7f-682d9ded542a","source":"wordfence","cve":"CVE-2026-81090","title":"Gpx2Graphics <= 0.3 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d916a62f-76b9-4e6c-8b7f-682d9ded542a?source=api-prod","affected":[{"type":"plugin","slug":"gpx2graphics","name":"Gpx2Graphics","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-16T14:16:57Z"},{"id":"wordfence:d916e320-e78b-4305-a4da-10c6fb8db41a","source":"wordfence","cve":"CVE-2024-13658","title":"NGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d916e320-e78b-4305-a4da-10c6fb8db41a?source=api-prod","affected":[{"type":"plugin","slug":"ngg-smart-image-search","name":"NGG Smart Image Search","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:17Z"},{"id":"wordfence:d9172789-8527-4862-a93d-6e89bf599424","source":"wordfence","cve":"CVE-2026-66641","title":"Video Conferencing with Zoom <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9172789-8527-4862-a93d-6e89bf599424?source=api-prod","affected":[{"type":"plugin","slug":"video-conferencing-with-zoom-api","name":"Video Conferencing with Zoom","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.6.10"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-17T23:42:29Z"},{"id":"wordfence:d9189eb3-be7f-42e1-92cc-b48af5615eb9","source":"wordfence","cve":"","title":"Inactive Logout <= 3.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9189eb3-be7f-42e1-92cc-b48af5615eb9?source=api-prod","affected":[{"type":"plugin","slug":"inactive-logout","name":"Inactive Logout","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d918b6ae-a72c-48dc-885b-19be49d578dc","source":"wordfence","cve":"CVE-2023-37885","title":"RealHomes <= 4.3.7 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d918b6ae-a72c-48dc-885b-19be49d578dc?source=api-prod","affected":[{"type":"theme","slug":"realhomes","name":"RH - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.3.8"}],"published":"2023-07-11T00:00:00Z","updated":"2025-05-12T17:21:17Z"},{"id":"wordfence:d918cfa5-8bae-45a0-a888-06f4cdb2ef33","source":"wordfence","cve":"CVE-2017-18539","title":"WebLibrarian < 3.4.8.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d918cfa5-8bae-45a0-a888-06f4cdb2ef33?source=api-prod","affected":[{"type":"plugin","slug":"weblibrarian","name":"WebLibrarian","from":"*","from_inclusive":true,"to":"3.4.8.6","to_inclusive":false,"patched_in":"3.4.8.6"}],"published":"2017-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d91a2713-238b-4c56-bff8-9129d77f4d77","source":"wordfence","cve":"CVE-2021-24697","title":"Simple Download Monitor <= 3.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d91a2713-238b-4c56-bff8-9129d77f4d77?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":false,"patched_in":"3.9.5"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d91a7cd4-929d-4df1-9557-ebd47e93c6e3","source":"wordfence","cve":"CVE-2024-54336","title":"Projectopia <= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password()","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d91a7cd4-929d-4df1-9557-ebd47e93c6e3?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T10:38:27Z"},{"id":"wordfence:d91cd902-f429-4b13-a0d0-04af8f908c95","source":"wordfence","cve":"CVE-2026-57417","title":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.57 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d91cd902-f429-4b13-a0d0-04af8f908c95?source=api-prod","affected":[{"type":"plugin","slug":"cart-lift","name":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD","from":"*","from_inclusive":true,"to":"3.1.57","to_inclusive":true,"patched_in":"3.1.58"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:39:55Z"},{"id":"wordfence:d91ea0c9-ee41-4c8f-a16b-8b36c7f0a72e","source":"wordfence","cve":"CVE-2013-4338","title":"WordPress Core < 3.6.1 - Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d91ea0c9-ee41-4c8f-a16b-8b36c7f0a72e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2013-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d92063a0-234a-4538-a471-112154f5f7fc","source":"wordfence","cve":"CVE-2026-114704","title":"Relevanssi \u2013 A Better Search <= 4.28.4 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92063a0-234a-4538-a471-112154f5f7fc?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.28.4","to_inclusive":true,"patched_in":"4.28.5"}],"published":"2026-10-22T13:20:41Z","updated":"2026-10-28T01:20:49Z"},{"id":"wordfence:d9207baf-348c-4d3b-a6f0-cbfcd2624f78","source":"wordfence","cve":"CVE-2024-11091","title":"Support SVG \u2013 Upload svg files in wordpress without hassle <= 1.1.0 -  Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9207baf-348c-4d3b-a6f0-cbfcd2624f78?source=api-prod","affected":[{"type":"plugin","slug":"support-svg","name":"Support SVG \u2013 Upload svg files in wordpress without hassle","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-11-25T20:18:41Z","updated":"2024-11-26T08:31:56Z"},{"id":"wordfence:d922fdf8-8bbb-4722-ad16-a013264085f2","source":"wordfence","cve":"CVE-2026-57410","title":"MailerPress \u2013 Newsletter, email marketing & AI automation <= 2.0.2 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d922fdf8-8bbb-4722-ad16-a013264085f2?source=api-prod","affected":[{"type":"plugin","slug":"mailerpress","name":"MailerPress \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:12:29Z"},{"id":"wordfence:d9244775-eab8-4cf4-98bb-97e467dcc5cf","source":"wordfence","cve":"CVE-2019-13570","title":"AdRotate \u2013 Ad manager & AdSense Ads <= 5.2 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9244775-eab8-4cf4-98bb-97e467dcc5cf?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2019-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d926d9fd-41b4-4d1b-9546-82f0a757a4fa","source":"wordfence","cve":"CVE-2024-56298","title":"Pretty Simple Popup Builder <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d926d9fd-41b4-4d1b-9546-82f0a757a4fa?source=api-prod","affected":[{"type":"plugin","slug":"pretty-simple-popup-builder","name":"Pretty Simple Popup Builder","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:19:34Z"},{"id":"wordfence:d926e4e1-6e48-427d-b814-1027f1b96d45","source":"wordfence","cve":"CVE-2025-58950","title":"Lione <= 1.16 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d926e4e1-6e48-427d-b814-1027f1b96d45?source=api-prod","affected":[{"type":"theme","slug":"lione","name":"Lione - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-12-19T16:36:40Z"},{"id":"wordfence:d9278c56-b963-4d9b-ae5a-45dab44c701f","source":"wordfence","cve":"CVE-2026-9858","title":"Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9278c56-b963-4d9b-ae5a-45dab44c701f?source=api-prod","affected":[{"type":"plugin","slug":"wc-partial-shipment","name":"Partial Shipment for WooCommerce","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.5"}],"published":"2026-09-18T19:59:23Z","updated":"2026-09-21T18:53:23Z"},{"id":"wordfence:d928290b-c20c-4ca7-9bbc-7cc67a07ac8a","source":"wordfence","cve":"CVE-2026-102785","title":"YOOtheme Pro 5.0.0 - 5.0.52 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d928290b-c20c-4ca7-9bbc-7cc67a07ac8a?source=api-prod","affected":[{"type":"theme","slug":"yootheme","name":"YOOtheme Pro","from":"5.0.0","from_inclusive":true,"to":"5.0.52","to_inclusive":true,"patched_in":"5.0.53"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-27T15:48:42Z"},{"id":"wordfence:d928b738-d8ed-447a-b604-e71e90d4d23d","source":"wordfence","cve":"CVE-2009-2762","title":"WordPress Core < 2.8.4 - Forced Password Reset","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d928b738-d8ed-447a-b604-e71e90d4d23d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2009-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9297d02-e408-4630-a36a-f7ea9e09319b","source":"wordfence","cve":"CVE-2026-16537","title":"Slick Slider <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9297d02-e408-4630-a36a-f7ea9e09319b?source=api-prod","affected":[{"type":"plugin","slug":"slick-slider","name":"Slick Slider","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":"0.5.3"}],"published":"2026-07-31T00:00:00Z","updated":"2026-08-15T21:27:25Z"},{"id":"wordfence:d92b9c21-067b-41c3-a385-a65faa8dd0ae","source":"wordfence","cve":"CVE-2023-32093","title":"TPG Redirect <= 1.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92b9c21-067b-41c3-a385-a65faa8dd0ae?source=api-prod","affected":[{"type":"plugin","slug":"tpg-redirect","name":"TPG Redirect","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d92bfa61-7ae2-427a-8f3a-82709471735b","source":"wordfence","cve":"CVE-2023-5006","title":"WP Discord Invite < 2.5.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92bfa61-7ae2-427a-8f3a-82709471735b?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-invite","name":"WP Discord Invite","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d92c80cb-080b-4774-8c66-1d5cf68e771f","source":"wordfence","cve":"CVE-2025-14609","title":"Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92c80cb-080b-4774-8c66-1d5cf68e771f?source=api-prod","affected":[{"type":"plugin","slug":"wise-analytics","name":"Wise Analytics","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2026-01-23T19:19:12Z","updated":"2026-02-03T18:52:43Z"},{"id":"wordfence:d92caa38-6a0e-46e7-87db-b5c7d325d138","source":"wordfence","cve":"CVE-2025-24535","title":"SKT Donation \u2013 Charity and Fundraising Plugin <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92caa38-6a0e-46e7-87db-b5c7d325d138?source=api-prod","affected":[{"type":"plugin","slug":"skt-donation","name":"SKT Donation \u2013 Charity and Fundraising Plugin","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-11-15T00:00:00Z","updated":"2025-02-20T16:02:43Z"},{"id":"wordfence:d92fc04e-201e-4fc3-bbf0-4f2f3de3ee95","source":"wordfence","cve":"CVE-2026-1923","title":"Social Rocket \u2013 Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d92fc04e-201e-4fc3-bbf0-4f2f3de3ee95?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.4.2","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-04-22T12:47:30Z","updated":"2026-04-23T01:24:32Z"},{"id":"wordfence:d93006ac-037f-4291-b945-afa38358a037","source":"wordfence","cve":"","title":"Contextual Related Posts <= 2.9.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93006ac-037f-4291-b945-afa38358a037?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2020-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9305e0d-195d-43ef-ab8a-c6cdf70aafad","source":"wordfence","cve":"CVE-2026-27334","title":"Alchemists <= 4.6.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9305e0d-195d-43ef-ab8a-c6cdf70aafad?source=api-prod","affected":[{"type":"theme","slug":"alchemists","name":"Alchemists - Sports, eSports & Gaming Club and News WordPress Theme","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:26:52Z"},{"id":"wordfence:d9318d57-499b-4804-8f83-1e4a68c5790f","source":"wordfence","cve":"CVE-2023-6257","title":"Inline Related Posts <= 3.5.0 - Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9318d57-499b-4804-8f83-1e4a68c5790f?source=api-prod","affected":[{"type":"plugin","slug":"intelly-related-posts","name":"Inline Related Posts","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-03-21T00:00:00Z","updated":"2024-04-16T14:45:49Z"},{"id":"wordfence:d9345eaa-c8c0-4830-a9af-48305a2f80fd","source":"wordfence","cve":"CVE-2025-3276","title":"SKT Blocks \u2013 Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9345eaa-c8c0-4830-a9af-48305a2f80fd?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T06:37:20Z"},{"id":"wordfence:d9349783-c6d7-437c-874d-994043ecbac6","source":"wordfence","cve":"CVE-2026-85573","title":"All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9349783-c6d7-437c-874d-994043ecbac6?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-files-upload-for-woocommerce","name":"All in One Files Upload for WooCommerce","from":"2.0.3","from_inclusive":true,"to":"2.0.16","to_inclusive":true,"patched_in":"2.0.17"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:09:11Z"},{"id":"wordfence:d935d9a8-0876-4cfe-a8e2-653dc3da8c2e","source":"wordfence","cve":"CVE-2026-84238","title":"YITH Request a Quote for WooCommerce Premium < 4.46.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d935d9a8-0876-4cfe-a8e2-653dc3da8c2e?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-request-a-quote-premium","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"4.46.0","to_inclusive":false,"patched_in":"4.46.0"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T14:33:37Z"},{"id":"wordfence:d935f4c5-5d69-42d9-be22-7a44d9aa885a","source":"wordfence","cve":"CVE-2024-13450","title":"Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"low","cvss":3.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d935f4c5-5d69-42d9-be22-7a44d9aa885a?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.17.4","to_inclusive":true,"patched_in":"2.17.5"}],"published":"2025-01-24T19:37:19Z","updated":"2025-01-25T08:23:16Z"},{"id":"wordfence:d9363db7-4535-427d-a6ae-2580f215b965","source":"wordfence","cve":"CVE-2025-11764","title":"Shortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9363db7-4535-427d-a6ae-2580f215b965?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-bootstrap","name":"Shortcodes Bootstrap","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:20:50Z","updated":"2025-11-21T07:31:56Z"},{"id":"wordfence:d937cacb-eb80-4c7c-9105-4ac4bd5c48cd","source":"wordfence","cve":"CVE-2025-31039","title":"Category Icon <= 1.0.1 - Authenticated (Author+) XML External Entity Injection","severity":"medium","cvss":6.3,"cwe":"CWE-611","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d937cacb-eb80-4c7c-9105-4ac4bd5c48cd?source=api-prod","affected":[{"type":"plugin","slug":"category-icon","name":"Category Icon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-06-03T00:00:00Z","updated":"2026-05-19T12:41:44Z"},{"id":"wordfence:d937ce1f-3948-4366-b395-fa401236f7a1","source":"wordfence","cve":"CVE-2025-69103","title":"Brikk <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d937ce1f-3948-4366-b395-fa401236f7a1?source=api-prod","affected":[{"type":"theme","slug":"brikk","name":"Brikk - Directory & Listing WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:41:47Z"},{"id":"wordfence:d938b867-a29a-460b-bfc2-1ba4490ee105","source":"wordfence","cve":"CVE-2025-54688","title":"JetEngine <= 3.7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d938b867-a29a-460b-bfc2-1ba4490ee105?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.1.2","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:11:46Z"},{"id":"wordfence:d93a4901-3fbd-40b2-af0b-501fa837424a","source":"wordfence","cve":"CVE-2026-15215","title":"Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93a4901-3fbd-40b2-af0b-501fa837424a?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:35:01Z"},{"id":"wordfence:d93c70d6-c439-4bcd-a855-b71896bf9d22","source":"wordfence","cve":"CVE-2021-24408","title":"Prismatic <= 2.7 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93c70d6-c439-4bcd-a855-b71896bf9d22?source=api-prod","affected":[{"type":"plugin","slug":"prismatic","name":"Prismatic","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d93c9c2d-1216-44e6-bdb8-d419a9ba6c6e","source":"wordfence","cve":"CVE-2024-43218","title":"Mediavine Control Panel <= 2.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93c9c2d-1216-44e6-bdb8-d419a9ba6c6e?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-control-panel","name":"Mediavine Control Panel","from":"*","from_inclusive":true,"to":"2.10.4","to_inclusive":true,"patched_in":"2.10.5"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-22T17:41:34Z"},{"id":"wordfence:d93caec2-c2e6-4848-9f6d-5fb19d90929c","source":"wordfence","cve":"CVE-2026-13432","title":"ThumbPress <= 6.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93caec2-c2e6-4848-9f6d-5fb19d90929c?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes","name":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T23:01:19Z"},{"id":"wordfence:d93d4360-b66c-499a-838c-e8eea36bd364","source":"wordfence","cve":"CVE-2026-120573","title":"WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93d4360-b66c-499a-838c-e8eea36bd364?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-11-12T20:59:31Z","updated":"2026-11-13T09:35:15Z"},{"id":"wordfence:d93de33b-1715-4e86-9df0-c20625d455d1","source":"wordfence","cve":"CVE-2025-68897","title":"IF AS Shortcode <= 1.2 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93de33b-1715-4e86-9df0-c20625d455d1?source=api-prod","affected":[{"type":"plugin","slug":"if-as-shortcode","name":"IF AS Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-25T00:00:00Z","updated":"2026-01-06T14:53:40Z"},{"id":"wordfence:d93e0175-db55-42ab-8475-cd0f47e5dcbb","source":"wordfence","cve":"CVE-2023-46204","title":"Duplicate Theme <= 0.1.6 - Cross-Site Request Forgery via themeDuplicationAction","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93e0175-db55-42ab-8475-cd0f47e5dcbb?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-theme","name":"Duplicate Theme","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d93ea841-a971-4e7a-87c5-95b5c0a7ee8a","source":"wordfence","cve":"CVE-2026-39762","title":"Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d93ea841-a971-4e7a-87c5-95b5c0a7ee8a?source=api-prod","affected":[{"type":"plugin","slug":"autoship-cloud","name":"Autoship Cloud for WooCommerce Subscription Products","from":"*","from_inclusive":true,"to":"2.17.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:24:57Z","updated":"2026-10-08T23:27:49Z"},{"id":"wordfence:d9417409-0830-461c-a5b8-943cb360aa0b","source":"wordfence","cve":"CVE-2026-125761","title":"YITH WooCommerce Ajax Search <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9417409-0830-461c-a5b8-943cb360aa0b?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"2.30.0","to_inclusive":true,"patched_in":"2.30.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:37Z"},{"id":"wordfence:d941b4b7-6b61-4559-8980-ae7285018b98","source":"wordfence","cve":"CVE-2025-32586","title":"ABA PayWay Payment Gateway for WooCommerce <= 2.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d941b4b7-6b61-4559-8980-ae7285018b98?source=api-prod","affected":[{"type":"plugin","slug":"aba-payway-woocommerce-payment-gateway","name":"ABA PayWay Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-08-11T13:52:48Z"},{"id":"wordfence:d9450e6b-df5e-4265-a3df-08cb10eb8dc0","source":"wordfence","cve":"","title":"Kiddo Theme (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9450e6b-df5e-4265-a3df-08cb10eb8dc0?source=api-prod","affected":[{"type":"theme","slug":"kiddo","name":"kiddo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9456921-e56a-402f-a80a-fd5659b9aac6","source":"wordfence","cve":"CVE-2023-0082","title":"ExactMetrics <= 7.12.0 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9456921-e56a-402f-a80a-fd5659b9aac6?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"*","from_inclusive":true,"to":"7.12.0","to_inclusive":true,"patched_in":"7.12.1"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d94661c1-2d70-4943-9452-b51a76116ebb","source":"wordfence","cve":"CVE-2023-48333","title":"Booster for WooCommerce <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94661c1-2d70-4943-9452-b51a76116ebb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d946b836-8f92-438d-9bfc-904cbffcf3fc","source":"wordfence","cve":"CVE-2026-106649","title":"Kali Forms <= 2.4.28 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d946b836-8f92-438d-9bfc-904cbffcf3fc?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.28","to_inclusive":true,"patched_in":"2.4.29"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T19:10:02Z"},{"id":"wordfence:d946d4b5-bed7-4808-b133-783b2dcd7992","source":"wordfence","cve":"CVE-2022-4937","title":"WCFM Frontend Manager <= 6.6.0 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d946d4b5-bed7-4808-b133-783b2dcd7992?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"6.6.0","from_inclusive":true,"to":"6.6.0","to_inclusive":true,"patched_in":"6.6.1"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d94bcbf7-c20e-4b04-b4de-f68f9a793b73","source":"wordfence","cve":"CVE-2019-9575","title":"Quiz And Survey Master <= 6.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94bcbf7-c20e-4b04-b4de-f68f9a793b73?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2019-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d94c0775-3852-463f-b393-1a12e63548e0","source":"wordfence","cve":"CVE-2021-25085","title":"WOOF - Products Filter for WooCommerce <= 1.2.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94c0775-3852-463f-b393-1a12e63548e0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.2.6.3","to_inclusive":false,"patched_in":"1.2.6.3"}],"published":"2021-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d94cd171-c2a4-4ef0-bc9a-5fdd2b704b5b","source":"wordfence","cve":"CVE-2024-13582","title":"Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94cd171-c2a4-4ef0-bc9a-5fdd2b704b5b?source=api-prod","affected":[{"type":"plugin","slug":"simple-pricing-tables-vc-extension","name":"Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T15:47:00Z","updated":"2025-02-18T04:21:21Z"},{"id":"wordfence:d94f0347-2167-4840-b21c-3279de0f9325","source":"wordfence","cve":"CVE-2019-15826","title":"WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via Referer Header","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94f0347-2167-4840-b21c-3279de0f9325?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.5.2.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d94f6cdd-8232-4e0c-b510-0e755c280b58","source":"wordfence","cve":"CVE-2023-27625","title":"Site Reviews <= 6.5.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d94f6cdd-8232-4e0c-b510-0e755c280b58?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.5.0","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d951e6b4-986a-400a-ab28-066a4ea5cbca","source":"wordfence","cve":"","title":"Quick Contact Form < 6.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d951e6b4-986a-400a-ab28-066a4ea5cbca?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":false,"patched_in":"6.1"}],"published":"2013-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9526a8b-fefe-4ca6-871f-1ead3f498679","source":"wordfence","cve":"CVE-2025-14283","title":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9526a8b-fefe-4ca6-871f-1ead3f498679?source=api-prod","affected":[{"type":"plugin","slug":"blockart-blocks","name":"BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.15"}],"published":"2026-01-27T21:31:36Z","updated":"2026-09-10T19:13:59Z"},{"id":"wordfence:d95295ed-4878-414d-be6b-bfb3e9076cca","source":"wordfence","cve":"CVE-2024-6477","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d95295ed-4878-414d-be6b-bfb3e9076cca?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.12"}],"published":"2024-07-13T00:00:00Z","updated":"2024-08-09T20:58:06Z"},{"id":"wordfence:d95427d0-77c6-41d6-93f1-508999e14242","source":"wordfence","cve":"CVE-2026-11363","title":"Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d95427d0-77c6-41d6-93f1-508999e14242?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.6","to_inclusive":true,"patched_in":"3.14.7"}],"published":"2026-09-08T14:33:35Z","updated":"2026-09-09T03:28:50Z"},{"id":"wordfence:d9545264-0434-4976-b94e-4e520e5ae9c6","source":"wordfence","cve":"CVE-2019-20204","title":"Postie <= 1.9.40 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9545264-0434-4976-b94e-4e520e5ae9c6?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.9.41","to_inclusive":false,"patched_in":"1.9.41"}],"published":"2020-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9580a28-3c75-4e26-a688-204859edf7cb","source":"wordfence","cve":"CVE-2025-23961","title":"WordPress Graphs & Charts <= 2.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9580a28-3c75-4e26-a688-204859edf7cb?source=api-prod","affected":[{"type":"plugin","slug":"graph-lite","name":"WordPress Graphs & Charts \u2013 Easy Interactive HTML5 Charts Plugin","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:14:41Z"},{"id":"wordfence:d95b01c3-5db4-40ac-8787-0db58a9cc3a6","source":"wordfence","cve":"CVE-2023-1341","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ajax_deactivate'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d95b01c3-5db4-40ac-8787-0db58a9cc3a6?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d95d8ca6-a36e-4d95-bce3-ead237dac938","source":"wordfence","cve":"CVE-2022-1298","title":"Tabs Responsive <= 2.2.7 - Editor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d95d8ca6-a36e-4d95-bce3-ead237dac938?source=api-prod","affected":[{"type":"plugin","slug":"tabs-responsive","name":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d95fe9e6-88cb-4dcb-9bf0-b71a180d5310","source":"wordfence","cve":"CVE-2025-39377","title":"Appsero Helper <= 1.3.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d95fe9e6-88cb-4dcb-9bf0-b71a180d5310?source=api-prod","affected":[{"type":"plugin","slug":"appsero-helper","name":"Appsero Helper","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2025-04-21T00:00:00Z","updated":"2026-03-17T21:22:03Z"},{"id":"wordfence:d9606d92-8061-4dfc-a6e2-509b54613277","source":"wordfence","cve":"CVE-2022-2444","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9606d92-8061-4dfc-a6e2-509b54613277?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.7.10"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d961f6ed-778f-48ab-8d88-762be7a03617","source":"wordfence","cve":"CVE-2025-28908","title":"pipDisqus <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d961f6ed-778f-48ab-8d88-762be7a03617?source=api-prod","affected":[{"type":"plugin","slug":"pipdisqus","name":"pipDisqus \u2013 Lightweight Disqus Comments","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-03-11T00:00:00Z","updated":"2026-02-26T15:04:26Z"},{"id":"wordfence:d964c99c-6ab6-453c-969f-66d5cd00dc8e","source":"wordfence","cve":"CVE-2024-12921","title":"EthereumICO <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ethereum-ico Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d964c99c-6ab6-453c-969f-66d5cd00dc8e?source=api-prod","affected":[{"type":"plugin","slug":"ethereumico","name":"EthereumICO","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2025-01-29T00:00:00Z","updated":"2025-01-30T05:23:00Z"},{"id":"wordfence:d964e0ef-f14e-463b-bf4e-3f25788df03c","source":"wordfence","cve":"CVE-2024-1388","title":"Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d964e0ef-f14e-463b-bf4e-3f25788df03c?source=api-prod","affected":[{"type":"theme","slug":"yuki","name":"Yuki","from":"*","from_inclusive":true,"to":"1.3.13","to_inclusive":true,"patched_in":"1.3.14"}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T06:46:47Z"},{"id":"wordfence:d96743ea-08b1-4b4c-9d62-558b97a6e297","source":"wordfence","cve":"CVE-2026-2992","title":"KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard","severity":"high","cvss":8.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96743ea-08b1-4b4c-9d62-558b97a6e297?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-18T15:28:32Z"},{"id":"wordfence:d96877a4-c5c0-429e-a7b8-03935c4b36fa","source":"wordfence","cve":"CVE-2025-39387","title":"Opstore <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96877a4-c5c0-429e-a7b8-03935c4b36fa?source=api-prod","affected":[{"type":"theme","slug":"opstore","name":"Opstore","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:08:05Z"},{"id":"wordfence:d969eb46-b12a-4a36-9321-bf1479906a5d","source":"wordfence","cve":"CVE-2025-12000","title":"WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d969eb46-b12a-4a36-9321-bf1479906a5d?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-11-07T15:07:46Z","updated":"2025-11-08T03:27:50Z"},{"id":"wordfence:d969fb35-2ee9-42ca-a9e8-f6453a1e6be9","source":"wordfence","cve":"","title":"Companion Auto Update <= 3.3.5 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d969fb35-2ee9-42ca-a9e8-f6453a1e6be9?source=api-prod","affected":[{"type":"plugin","slug":"companion-auto-update","name":"Companion Auto Update","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":false,"patched_in":"3.3.6"}],"published":"2019-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d96a3d43-81dd-4c23-984b-a9ddf450164b","source":"wordfence","cve":"CVE-2024-25907","title":"WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96a3d43-81dd-4c23-984b-a9ddf450164b?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder","name":"WP Media folder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:51:32Z"},{"id":"wordfence:d96c9b04-6850-40ab-8006-81cca8a9dffe","source":"wordfence","cve":"","title":"CM Ad Changer <= 1.7.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96c9b04-6850-40ab-8006-81cca8a9dffe?source=api-prod","affected":[{"type":"plugin","slug":"cm-ad-changer","name":"CM Ad Changer \u2013 A simple tool to control and optimize your site\u2019s banners","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2016-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d96d1f33-43b3-4e20-967e-988cb32b04ee","source":"wordfence","cve":"CVE-2026-2723","title":"Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96d1f33-43b3-4e20-967e-988cb32b04ee?source=api-prod","affected":[{"type":"plugin","slug":"post-snippits","name":"Post Snippits","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:15:00Z","updated":"2026-03-21T03:27:09Z"},{"id":"wordfence:d96e5986-8c89-4e7e-aa63-f41aa13eeff4","source":"wordfence","cve":"CVE-2023-5708","title":"WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d96e5986-8c89-4e7e-aa63-f41aa13eeff4?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-columns","name":"WP Post Columns","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d970a9f6-69f6-42d2-b863-82b8110e52c3","source":"wordfence","cve":"CVE-2023-33215","title":"Taggbox <= 3.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d970a9f6-69f6-42d2-b863-82b8110e52c3?source=api-prod","affected":[{"type":"plugin","slug":"taggbox-widget","name":"Taggbox: Social Media Feed Widget","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-10-19T00:00:00Z","updated":"2026-02-26T14:52:08Z"},{"id":"wordfence:d970e2fa-ba2f-4c0f-8ff4-10041b9c276e","source":"wordfence","cve":"CVE-2024-7714","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.0.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d970e2fa-ba2f-4c0f-8ff4-10041b9c276e?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-09-05T00:00:00Z","updated":"2024-10-03T13:17:46Z"},{"id":"wordfence:d9731e3a-4972-4e1e-b6cd-4bc00a6e9552","source":"wordfence","cve":"CVE-2024-7688","title":"AZIndex <= 0.8.1 - Cross-Site Request Forgery to Index Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9731e3a-4972-4e1e-b6cd-4bc00a6e9552?source=api-prod","affected":[{"type":"plugin","slug":"azindex","name":"AZIndex","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-19T00:00:00Z","updated":"2024-08-26T15:05:51Z"},{"id":"wordfence:d97761cb-8645-474d-9f9a-15ecdd426db4","source":"wordfence","cve":"CVE-2023-22698","title":"Theme Blvd Responsive Google Maps <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97761cb-8645-474d-9f9a-15ecdd426db4?source=api-prod","affected":[{"type":"plugin","slug":"theme-blvd-responsive-google-maps","name":"Theme Blvd Responsive Google Maps","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d979f899-8cdc-4230-b1b5-865c025dc86a","source":"wordfence","cve":"CVE-2023-0446","title":"My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d979f899-8cdc-4230-b1b5-865c025dc86a?source=api-prod","affected":[{"type":"plugin","slug":"youtube-channel","name":"My YouTube Channel","from":"*","from_inclusive":true,"to":"3.0.12.1","to_inclusive":true,"patched_in":"3.23.0"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d97af468-d345-4d19-a1b0-f42d890a34d8","source":"wordfence","cve":"CVE-2021-24776","title":"WP Performance Score Booster <= 2.0 - Settings Change via Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97af468-d345-4d19-a1b0-f42d890a34d8?source=api-prod","affected":[{"type":"plugin","slug":"wp-performance-score-booster","name":"WP Performance Score Booster \u2013 Optimize Speed, Enable Cache & Page Preload","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d97b09a1-3305-431b-9cbf-1dbed01b6efb","source":"wordfence","cve":"CVE-2025-46475","title":"Able Player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97b09a1-3305-431b-9cbf-1dbed01b6efb?source=api-prod","affected":[{"type":"plugin","slug":"ableplayer","name":"Able Player, accessible HTML5 media player","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-04-24T00:00:00Z","updated":"2025-07-01T14:13:16Z"},{"id":"wordfence:d97b6f64-a596-4c83-8ab5-98b4b246897f","source":"wordfence","cve":"CVE-2014-9309","title":"Formidable Form Builder <= 1.07.11 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97b6f64-a596-4c83-8ab5-98b4b246897f?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.07.11","to_inclusive":true,"patched_in":"2.0"}],"published":"2016-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d97ba75a-278d-4239-bfcf-53b5396fe321","source":"wordfence","cve":"CVE-2024-32429","title":"Remove Footer Credit <= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97ba75a-278d-4239-bfcf-53b5396fe321?source=api-prod","affected":[{"type":"plugin","slug":"remove-footer-credit","name":"Remove Footer Credit","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:30:29Z"},{"id":"wordfence:d97c19d6-511f-459a-9880-cdc1fe137205","source":"wordfence","cve":"CVE-2025-54020","title":"AntiSpam for Contact Form 7 <= 0.6.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97c19d6-511f-459a-9880-cdc1fe137205?source=api-prod","affected":[{"type":"plugin","slug":"cf7-antispam","name":"AntiSpam for Contact Form 7","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":true,"patched_in":"0.6.4"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:12:10Z"},{"id":"wordfence:d97c3379-56c9-4261-9a70-3119ec121a40","source":"wordfence","cve":"CVE-2024-9162","title":"All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97c3379-56c9-4261-9a70-3119ec121a40?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.86","to_inclusive":true,"patched_in":"7.87"}],"published":"2024-10-27T00:00:00Z","updated":"2024-10-28T05:32:25Z"},{"id":"wordfence:d97df193-28ed-4961-9d71-00098c0bec45","source":"wordfence","cve":"CVE-2020-12462","title":"Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97df193-28ed-4961-9d71-00098c0bec45?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.24.2","to_inclusive":false,"patched_in":"3.4.24.2"}],"published":"2020-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d97e1ec3-321b-4d69-ab69-e3ecab0937b3","source":"wordfence","cve":"CVE-2024-11776","title":"PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97e1ec3-321b-4d69-ab69-e3ecab0937b3?source=api-prod","affected":[{"type":"plugin","slug":"pcrecruiter-extensions","name":"PCRecruiter Extensions","from":"*","from_inclusive":true,"to":"1.4.22","to_inclusive":true,"patched_in":"1.4.23"}],"published":"2024-12-19T13:52:50Z","updated":"2024-12-21T15:30:00Z"},{"id":"wordfence:d97eb079-5b19-461c-8a80-d00ab45e2bff","source":"wordfence","cve":"CVE-2009-4748","title":"my-category-order <= 2.8.7 - SQL Injection","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97eb079-5b19-461c-8a80-d00ab45e2bff?source=api-prod","affected":[{"type":"plugin","slug":"my-category-order","name":"my-category-order","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2009-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d97ed290-b887-4fa5-866c-e7af9b29b517","source":"wordfence","cve":"CVE-2025-28993","title":"Content No Cache <= 0.1.4 - Unauthenticated Arbitrary Function Call","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97ed290-b887-4fa5-866c-e7af9b29b517?source=api-prod","affected":[{"type":"plugin","slug":"content-no-cache","name":"Content No Cache | Serve uncached partial content even when you add it to a page that is fully cached.","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":"0.1.5"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-03T12:29:26Z"},{"id":"wordfence:d97feb4e-2696-44f8-a426-0f82c0a9cf3b","source":"wordfence","cve":"CVE-2025-32256","title":"SurveyJS <= 1.12.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d97feb4e-2696-44f8-a426-0f82c0a9cf3b?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.12.20","to_inclusive":true,"patched_in":"1.12.57"}],"published":"2025-04-04T00:00:00Z","updated":"2025-12-19T15:27:01Z"},{"id":"wordfence:d980c4bf-8630-4e85-a932-2d00b195afb0","source":"wordfence","cve":"CVE-2025-68022","title":"Plugin BlueX for WooCommerce <= 3.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d980c4bf-8630-4e85-a932-2d00b195afb0?source=api-prod","affected":[{"type":"plugin","slug":"bluex-for-woocommerce","name":"Plugin BlueX for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:01:07Z"},{"id":"wordfence:d982a16d-d100-4d62-9914-fa91e917aece","source":"wordfence","cve":"CVE-2024-51594","title":"Gmap Point List <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d982a16d-d100-4d62-9914-fa91e917aece?source=api-prod","affected":[{"type":"plugin","slug":"gmap-point-list","name":"Gmap Point List","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:45:22Z"},{"id":"wordfence:d9853616-e1b3-48b0-afec-c43e91c48bc0","source":"wordfence","cve":"CVE-2025-27337","title":"Fontsampler <= 0.4.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9853616-e1b3-48b0-afec-c43e91c48bc0?source=api-prod","affected":[{"type":"plugin","slug":"fontsampler","name":"Fontsampler","from":"*","from_inclusive":true,"to":"0.4.14","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:35:04Z"},{"id":"wordfence:d989b1ee-13c0-4da1-80dd-38d2202f2ce7","source":"wordfence","cve":"CVE-2025-60176","title":"WP Tesseract <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d989b1ee-13c0-4da1-80dd-38d2202f2ce7?source=api-prod","affected":[{"type":"plugin","slug":"wp-tesseract","name":"WP Tesseract","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:08:45Z"},{"id":"wordfence:d98d1782-a6cc-403a-b0fa-43282daa1136","source":"wordfence","cve":"CVE-2015-1000011","title":"DukaPress <= 2.5.9 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d98d1782-a6cc-403a-b0fa-43282daa1136?source=api-prod","affected":[{"type":"plugin","slug":"dukapress","name":"DukaPress","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.5.9.1"}],"published":"2015-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9906492-971c-48c3-adb4-e408a7550fff","source":"wordfence","cve":"CVE-2025-49936","title":"WoodMart < 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9906492-971c-48c3-adb4-e408a7550fff?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":false,"patched_in":"8.3.2"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T15:20:21Z"},{"id":"wordfence:d9906b19-1ac7-4015-adb3-0674dde0331e","source":"wordfence","cve":"CVE-2022-27846","title":"Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9906b19-1ac7-4015-adb3-0674dde0331e?source=api-prod","affected":[{"type":"plugin","slug":"yoo-slider","name":"Yoo Slider \u2013 Image Slider & Video Slider","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-04-11T17:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d992a9cf-f24c-4c82-a56b-22394524ba3b","source":"wordfence","cve":"CVE-2022-0176","title":"PowerPack Lite for Beaver Builder  <= 1.2.9.2 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d992a9cf-f24c-4c82-a56b-22394524ba3b?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-addon-for-beaver-builder","name":"PowerPack Lite for Beaver Builder","from":"*","from_inclusive":true,"to":"1.2.9.2","to_inclusive":true,"patched_in":"1.2.9.3"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d992b9dd-dfd1-497c-b09f-cca02dc87e34","source":"wordfence","cve":"CVE-2024-12506","title":"NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d992b9dd-dfd1-497c-b09f-cca02dc87e34?source=api-prod","affected":[{"type":"plugin","slug":"nacc-wordpress-plugin","name":"NACC WordPress Plugin","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-12-19T18:08:03Z","updated":"2024-12-23T17:30:08Z"},{"id":"wordfence:d9938c7d-ef0d-45a2-900f-ac8bda9ce75a","source":"wordfence","cve":"CVE-2024-24715","title":"BookIt <=2.4.0 - Price Bypass","severity":"medium","cvss":4.9,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9938c7d-ef0d-45a2-900f-ac8bda9ce75a?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T20:18:07Z"},{"id":"wordfence:d99614e6-4543-4594-9a46-71ecc986be45","source":"wordfence","cve":"","title":"Wishlist and Compare for WooCommerce <= 1.0.4 - Authorization Bypass","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99614e6-4543-4594-9a46-71ecc986be45?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-and-compare","name":"Wishlist and Compare for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2021-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d99a545f-e4eb-4130-8b1c-bb485c1aad13","source":"wordfence","cve":"CVE-2025-68883","title":"bidorbuy Store Integrator <= 2.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99a545f-e4eb-4130-8b1c-bb485c1aad13?source=api-prod","affected":[{"type":"plugin","slug":"bidorbuystoreintegrator","name":"bidorbuy Store Integrator","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-19T15:52:33Z"},{"id":"wordfence:d99bc021-ba9e-4294-8dd2-c25bc8007d05","source":"wordfence","cve":"CVE-2026-1779","title":"User Registration & Membership <= 5.1.2 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99bc021-ba9e-4294-8dd2-c25bc8007d05?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-02-25T13:29:34Z","updated":"2026-02-26T02:23:56Z"},{"id":"wordfence:d99d4b9a-aa09-434d-91a8-7afaa0e8b5db","source":"wordfence","cve":"CVE-2024-5020","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"},{"type":"plugin","slug":"woo-smart-quick-view","name":"WPC Smart Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"},{"type":"plugin","slug":"accordion-slider","name":"Accordion Slider","from":"*","from_inclusive":true,"to":"1.9.12","to_inclusive":true,"patched_in":"1.9.13"},{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.47.7212","to_inclusive":true,"patched_in":"7.5.48.7212"},{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.8.15","to_inclusive":true,"patched_in":"1.8.16"},{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.286","to_inclusive":true,"patched_in":"1.0.288"},{"type":"plugin","slug":"visual-portfolio","name":"Gallery by Visual Portfolio","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.10"},{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"},{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"},{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"},{"type":"plugin","slug":"fancybox-for-wordpress","name":"FancyBox for WordPress","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"},{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"},{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.27","to_inclusive":true,"patched_in":"1.15.28"},{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59.4","to_inclusive":true,"patched_in":"3.59.5"},{"type":"plugin","slug":"easy-facebook-likebox-premium","name":"Easy Social Feed Premium","from":"*","from_inclusive":true,"to":"6.6.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T00:00:00Z","updated":"2025-06-13T17:22:00Z"},{"id":"wordfence:d99d7a26-3645-4ff5-8c48-17b6fa77a228","source":"wordfence","cve":"","title":"Responsive Lightbox & Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d7a26-3645-4ff5-8c48-17b6fa77a228?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2022-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d99dc270-1b28-4e76-9346-38b2b96be01c","source":"wordfence","cve":"CVE-2024-0965","title":"Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99dc270-1b28-4e76-9346-38b2b96be01c?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-access-restriction","name":"Simple Page Access Restriction","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2024-02-07T00:00:00Z","updated":"2024-02-08T08:32:09Z"},{"id":"wordfence:d99f81ea-1e74-4b67-a6c5-3dbc7865a68a","source":"wordfence","cve":"","title":"WS Form LITE <= 1.9.117 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99f81ea-1e74-4b67-a6c5-3dbc7865a68a?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.9.117","to_inclusive":true,"patched_in":"1.9.118"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d99fe68c-3c0e-4a5a-96c8-de50b7a7e753","source":"wordfence","cve":"CVE-2014-4537","title":"Keyword Strategy Internal Links <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d99fe68c-3c0e-4a5a-96c8-de50b7a7e753?source=api-prod","affected":[{"type":"plugin","slug":"keyword-strategy-internal-links","name":"Keyword Strategy Internal Links","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9a19e96-2ca4-4072-aa2e-ab01f1685911","source":"wordfence","cve":"CVE-2025-12178","title":"SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a19e96-2ca4-4072-aa2e-ab01f1685911?source=api-prod","affected":[{"type":"plugin","slug":"spiceforms-form-builder","name":"SpiceForms Form Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:49:56Z","updated":"2026-01-14T05:28:12Z"},{"id":"wordfence:d9a2ee71-8be5-448b-a052-1d98880ba847","source":"wordfence","cve":"CVE-2024-37537","title":"WS Contact Form <= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a2ee71-8be5-448b-a052-1d98880ba847?source=api-prod","affected":[{"type":"plugin","slug":"ws-contact-form","name":"WS Contact Form","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-07-05T00:00:00Z","updated":"2024-08-09T13:37:24Z"},{"id":"wordfence:d9a70e02-fdbc-43ee-9382-101391f363a3","source":"wordfence","cve":"CVE-2021-25101","title":"Anti-Malware Security and Brute-Force Firewall <= 4.20.93 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a70e02-fdbc-43ee-9382-101391f363a3?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.20.94","to_inclusive":false,"patched_in":"4.20.94"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9a77b4f-46a3-45d3-bf2b-448584125874","source":"wordfence","cve":"CVE-2021-42367","title":"Variation Swatches for WooCommerce <= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a77b4f-46a3-45d3-bf2b-448584125874?source=api-prod","affected":[{"type":"plugin","slug":"product-variation-swatches-for-woocommerce","name":"Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9a7f2ed-b2c0-4042-ad91-63070e176c2f","source":"wordfence","cve":"CVE-2026-27332","title":"Agrofood < 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a7f2ed-b2c0-4042-ad91-63070e176c2f?source=api-prod","affected":[{"type":"theme","slug":"agrofood","name":"Agrofood - Elementor WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":false,"patched_in":"1.4.0"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-17T21:34:22Z"},{"id":"wordfence:d9a8d95c-e426-45e4-a071-f1c06e606387","source":"wordfence","cve":"CVE-2025-58621","title":"PuzzleMe for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9a8d95c-e426-45e4-a071-f1c06e606387?source=api-prod","affected":[{"type":"plugin","slug":"puzzleme","name":"PuzzleMe \u2013 Interactive Puzzles for WordPress \u2013 Easily publish crosswords, quizzes, word searches and more","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T20:28:25Z"},{"id":"wordfence:d9ac0d84-dff4-4a03-a530-cac47ffaf2bb","source":"wordfence","cve":"CVE-2024-11280","title":"PPWP \u2013 Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ac0d84-dff4-4a03-a530-cac47ffaf2bb?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2024-12-16T00:00:00Z","updated":"2024-12-17T11:24:32Z"},{"id":"wordfence:d9ae6150-209b-4717-835a-e5d5ea62a19b","source":"wordfence","cve":"CVE-2025-31072","title":"Ofiz - WordPress Business Consulting Theme <= 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ae6150-209b-4717-835a-e5d5ea62a19b?source=api-prod","affected":[{"type":"theme","slug":"ofiz","name":"Ofiz - WordPress Business Consulting Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T12:53:05Z"},{"id":"wordfence:d9af12ac-68ef-4c65-aecb-82ce7b927340","source":"wordfence","cve":"CVE-2023-45635","title":"Responsive Tabs < 4.0.6 - Authenticated (Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9af12ac-68ef-4c65-aecb-82ce7b927340?source=api-prod","affected":[{"type":"plugin","slug":"responsive-tabs","name":"Responsive Tabs","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":false,"patched_in":"4.0.6"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9af843e-dcbb-4b09-b131-4e470c006d38","source":"wordfence","cve":"CVE-2023-0252","title":"Contextual Related Posts <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9af843e-dcbb-4b09-b131-4e470c006d38?source=api-prod","affected":[{"type":"plugin","slug":"contextual-related-posts","name":"Contextual Related Posts","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9b1044d-6858-498f-9b89-352650061858","source":"wordfence","cve":"CVE-2024-6755","title":"Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b1044d-6858-498f-9b89-352650061858?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.14","to_inclusive":true,"patched_in":"5.3.15"}],"published":"2024-07-23T00:00:00Z","updated":"2024-07-24T02:33:58Z"},{"id":"wordfence:d9b10db9-0c7c-4f13-9d98-6d407446cfb8","source":"wordfence","cve":"CVE-2025-7711","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b10db9-0c7c-4f13-9d98-6d407446cfb8?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2025-11-17T09:59:24Z","updated":"2025-11-17T22:27:44Z"},{"id":"wordfence:d9b15c1f-dee4-4df4-9c8b-d238e67c46d5","source":"wordfence","cve":"CVE-2025-63040","title":"Post Snippets <= 4.0.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b15c1f-dee4-4df4-9c8b-d238e67c46d5?source=api-prod","affected":[{"type":"plugin","slug":"post-snippets","name":"Post Snippets \u2013 Custom WordPress Code Snippets Customizer","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T16:35:00Z"},{"id":"wordfence:d9b66b1d-e973-4b87-ab30-bad747d8fe97","source":"wordfence","cve":"CVE-2026-96814","title":"Product Table & List Builder for WooCommerce <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b66b1d-e973-4b87-ab30-bad747d8fe97?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"5.6.9"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:50:17Z"},{"id":"wordfence:d9b8e6dc-a9ac-4afb-ad47-4f51032bb1f4","source":"wordfence","cve":"CVE-2023-1478","title":"Hummingbird <= 3.4.1 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b8e6dc-a9ac-4afb-ad47-4f51032bb1f4?source=api-prod","affected":[{"type":"plugin","slug":"hummingbird-performance","name":"Hummingbird Performance \u2013 Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9bb5fdb-939c-4c94-aa4e-fe56b45add5f","source":"wordfence","cve":"CVE-2026-103646","title":"Ultimate Multisite <= 2.16.0 - Unauthenticated Arbitrary Account Takeover","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bb5fdb-939c-4c94-aa4e-fe56b45add5f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-multisite","name":"Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.17.0"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T19:25:36Z"},{"id":"wordfence:d9bebdc0-1625-4dc4-8c92-37f379868cd5","source":"wordfence","cve":"CVE-2025-13359","title":"Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bebdc0-1625-4dc4-8c92-37f379868cd5?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.40.1","to_inclusive":true,"patched_in":"3.41.0"}],"published":"2025-12-03T00:30:02Z","updated":"2025-12-03T13:52:46Z"},{"id":"wordfence:d9bfae23-7b5c-46d8-9d7e-cc261280e223","source":"wordfence","cve":"CVE-2019-15820","title":"Login or Logout Menu Item <= 1.1.1 - Unauthenticated Settings Update","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bfae23-7b5c-46d8-9d7e-cc261280e223?source=api-prod","affected":[{"type":"plugin","slug":"login-or-logout-menu-item","name":"Login or Logout Menu Item","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2019-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9bfba3e-ae66-44b2-9907-bfd994ca9502","source":"wordfence","cve":"CVE-2025-49272","title":"Trinity Audio <= 5.20.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9bfba3e-ae66-44b2-9907-bfd994ca9502?source=api-prod","affected":[{"type":"plugin","slug":"trinity-audio","name":"Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio","from":"*","from_inclusive":true,"to":"5.20.0","to_inclusive":true,"patched_in":"5.20.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:18:27Z"},{"id":"wordfence:d9c20584-d791-4788-8dc3-77069b92601f","source":"wordfence","cve":"CVE-2019-14784","title":"CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c20584-d791-4788-8dc3-77069b92601f?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.01","to_inclusive":true,"patched_in":"1.3.02"}],"published":"2019-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9c381a0-ce75-40bd-9c2f-eac892ca58d5","source":"wordfence","cve":"CVE-2026-12270","title":"Everest Forms <= 3.4.0 - Unauthenticated Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c381a0-ce75-40bd-9c2f-eac892ca58d5?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:21:32Z"},{"id":"wordfence:d9c479fc-2e98-4851-a36c-2fd219e750ed","source":"wordfence","cve":"CVE-2025-9194","title":"Constructor <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c479fc-2e98-4851-a36c-2fd219e750ed?source=api-prod","affected":[{"type":"theme","slug":"constructor","name":"Constructor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:28:04Z","updated":"2025-10-03T11:17:22Z"},{"id":"wordfence:d9c4e963-afdd-4a54-80ac-8dd18075a934","source":"wordfence","cve":"CVE-2025-62042","title":"Event post <= 5.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c4e963-afdd-4a54-80ac-8dd18075a934?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.10.3","to_inclusive":true,"patched_in":"5.10.4"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-22T20:50:45Z"},{"id":"wordfence:d9c51f6b-e3ce-4408-8fcb-a56c3b1eee04","source":"wordfence","cve":"CVE-2026-12720","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c51f6b-e3ce-4408-8fcb-a56c3b1eee04?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":false,"patched_in":"6.0.13"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-13T19:23:05Z"},{"id":"wordfence:d9c95fe9-f4c0-40c1-a733-ebbe9898e27d","source":"wordfence","cve":"CVE-2026-14187","title":"Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c95fe9-f4c0-40c1-a733-ebbe9898e27d?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-03T16:37:10Z"},{"id":"wordfence:d9c97745-9fe2-4ae9-b083-0eda9c20ac73","source":"wordfence","cve":"CVE-2024-7556","title":"Wordpress Simple Share Plugin <= 0.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c97745-9fe2-4ae9-b083-0eda9c20ac73?source=api-prod","affected":[{"type":"plugin","slug":"dts-simple-share","name":"Simple Share","from":"*","from_inclusive":true,"to":"0.5.3","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-14T17:58:39Z"},{"id":"wordfence:d9c9de2f-e46a-4f68-abf4-225e96dcf5e7","source":"wordfence","cve":"CVE-2025-31755","title":"pCloud Backup <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c9de2f-e46a-4f68-abf4-225e96dcf5e7?source=api-prod","affected":[{"type":"plugin","slug":"pcloud-backup","name":"pCloud Backup","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:50:10Z"},{"id":"wordfence:d9cd3168-3261-4e36-8fbe-2058cd821937","source":"wordfence","cve":"CVE-2024-10666","title":"Easy Twitter Feed \u2013 Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cd3168-3261-4e36-8fbe-2058cd821937?source=api-prod","affected":[{"type":"plugin","slug":"easy-twitter-feeds","name":"Easy Feeds for X/Twitter \u2013 keep your site fresh with live social posts","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-11-21T17:07:50Z","updated":"2025-07-25T19:31:24Z"},{"id":"wordfence:d9ce0bef-da72-441a-8de0-89c77115a38c","source":"wordfence","cve":"CVE-2026-27405","title":"Appointment Booking Plugin for WooCommerce \u2013 WpBookingly | All-in-One Service Manager <= 1.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ce0bef-da72-441a-8de0-89c77115a38c?source=api-prod","affected":[{"type":"plugin","slug":"service-booking-manager","name":"Appointment Booking Plugin for WooCommerce | Online Booking Calendar & Service Manager","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:17:06Z"},{"id":"wordfence:d9cefc8e-9c1c-4b5e-adf8-665b8d4dc774","source":"wordfence","cve":"CVE-2014-3844","title":"TinyMCE Color Picker <= 1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cefc8e-9c1c-4b5e-adf8-665b8d4dc774?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-colorpicker","name":"TinyMCE Color Picker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2014-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9cf6dae-572f-4eaa-8e8a-bca9e74fe738","source":"wordfence","cve":"CVE-2025-8068","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9cf6dae-572f-4eaa-8e8a-bca9e74fe738?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-07-30T00:00:00Z","updated":"2025-07-31T11:19:13Z"},{"id":"wordfence:d9d000ad-a8f1-44c8-8c11-4a1982e1e6e4","source":"wordfence","cve":"CVE-2024-12814","title":"Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d000ad-a8f1-44c8-8c11-4a1982e1e6e4?source=api-prod","affected":[{"type":"plugin","slug":"loan-comparison","name":"Loan Comparison","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T06:59:02Z"},{"id":"wordfence:d9d19571-f0a1-4f15-a292-89b938c49afc","source":"wordfence","cve":"CVE-2024-0337","title":"Travelpayouts: All Travel Brands in One Place <= 1.1.16 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d19571-f0a1-4f15-a292-89b938c49afc?source=api-prod","affected":[{"type":"plugin","slug":"travelpayouts","name":"Travelpayouts: All Travel Brands in One Place","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"}],"published":"2024-02-28T00:00:00Z","updated":"2024-05-29T21:08:36Z"},{"id":"wordfence:d9d2b2ce-c1a9-48b2-b68f-048cb991e31e","source":"wordfence","cve":"CVE-2026-111958","title":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.7 - Authentication Bypass","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d2b2ce-c1a9-48b2-b68f-048cb991e31e?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":false,"patched_in":"1.5.7"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:33:42Z"},{"id":"wordfence:d9d37248-d024-4465-a1e6-d8f2d3a2e02f","source":"wordfence","cve":"CVE-2024-1461","title":"Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d37248-d024-4465-a1e6-d8f2d3a2e02f?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:26Z"},{"id":"wordfence:d9d46dbc-35ed-4520-a5d3-e2bd8d93c5a6","source":"wordfence","cve":"CVE-2025-48325","title":"WP Admin Theme <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d46dbc-35ed-4520-a5d3-e2bd8d93c5a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-theme","name":"WP Admin Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T13:57:51Z"},{"id":"wordfence:d9d6e168-a768-4062-9ef1-0be9d6c65c51","source":"wordfence","cve":"CVE-2023-45828","title":"RumbleTalk Live Group Chat <= 6.1.9 - Missing Authorization via handleRequest","severity":"high","cvss":7.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d6e168-a768-4062-9ef1-0be9d6c65c51?source=api-prod","affected":[{"type":"plugin","slug":"rumbletalk-chat-a-chat-with-themes","name":"RumbleTalk Group Chat  for Communities & Live Events","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9d7dc61-1e28-426b-a9da-3a36134e7821","source":"wordfence","cve":"","title":"SCv1 Theme (All Known Versions) - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d7dc61-1e28-426b-a9da-3a36134e7821?source=api-prod","affected":[{"type":"theme","slug":"SCv1","name":"SCv1 Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9db50bb-4091-444b-bf72-8b619dd7f4e0","source":"wordfence","cve":"CVE-2025-49334","title":"MyD Delivery <= 1.3.7 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9db50bb-4091-444b-bf72-8b619dd7f4e0?source=api-prod","affected":[{"type":"plugin","slug":"myd-delivery","name":"MyD Delivery","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T19:58:07Z"},{"id":"wordfence:d9de41de-f2f7-4b16-8ec9-d30bbd3d8786","source":"wordfence","cve":"CVE-2024-3922","title":"Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9de41de-f2f7-4b16-8ec9-d30bbd3d8786?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2024-06-11T00:00:00Z","updated":"2024-06-13T02:05:25Z"},{"id":"wordfence:d9df6792-d208-44c9-b04b-00e86d76cbfa","source":"wordfence","cve":"CVE-2024-30511","title":"FG PrestaShop to WooCommerce <= 4.45.1 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9df6792-d208-44c9-b04b-00e86d76cbfa?source=api-prod","affected":[{"type":"plugin","slug":"fg-prestashop-to-woocommerce","name":"FG PrestaShop to WooCommerce","from":"*","from_inclusive":true,"to":"4.45.1","to_inclusive":true,"patched_in":"4.47.0"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T01:26:21Z"},{"id":"wordfence:d9e0b180-b755-4fa0-8e90-c3a61f1ca095","source":"wordfence","cve":"CVE-2025-49898","title":"Dropshix <= 4.0.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e0b180-b755-4fa0-8e90-c3a61f1ca095?source=api-prod","affected":[{"type":"plugin","slug":"dropshipping-xox","name":"Dropshix","from":"*","from_inclusive":true,"to":"4.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-18T18:08:27Z"},{"id":"wordfence:d9e0f3a5-35fb-4c7e-892f-8a41498e1d3c","source":"wordfence","cve":"CVE-2025-12452","title":"Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e0f3a5-35fb-4c7e-892f-8a41498e1d3c?source=api-prod","affected":[{"type":"plugin","slug":"visit-counter","name":"Visit Counter","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T16:02:19Z","updated":"2025-11-04T04:27:22Z"},{"id":"wordfence:d9e3f310-5a5e-4ca8-806d-9a7aacfaf5ed","source":"wordfence","cve":"CVE-2021-24234","title":"Ivory Search <= 4.6 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e3f310-5a5e-4ca8-806d-9a7aacfaf5ed?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2021-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9e5cbde-6bc6-49f2-91b4-86c1779de2dc","source":"wordfence","cve":"CVE-2026-40793","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e5cbde-6bc6-49f2-91b4-86c1779de2dc?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":false,"patched_in":"4.4.1"}],"published":"2026-04-24T00:00:00Z","updated":"2026-04-30T14:51:19Z"},{"id":"wordfence:d9e77e3f-dcd8-426a-be0f-24eb65c6709e","source":"wordfence","cve":"CVE-2025-12834","title":"Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e?source=api-prod","affected":[{"type":"plugin","slug":"accept-stripe-payments-using-contact-form-7","name":"Accept Stripe Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2025-12-11T14:24:40Z","updated":"2025-12-19T14:28:52Z"},{"id":"wordfence:d9ed939c-dc9c-46e8-9b23-0a3e5733e8d5","source":"wordfence","cve":"CVE-2024-1814","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ed939c-dc9c-46e8-9b23-0a3e5733e8d5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.12.8","to_inclusive":true,"patched_in":"2.12.9"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T11:02:38Z"},{"id":"wordfence:d9ee66e8-e601-405a-88b8-4805d425dd75","source":"wordfence","cve":"CVE-2025-69304","title":"Allmart <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ee66e8-e601-405a-88b8-4805d425dd75?source=api-prod","affected":[{"type":"plugin","slug":"allmart-core","name":"Allmart","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:18:38Z"},{"id":"wordfence:d9eef671-9aa5-4707-80dd-e860d5e53d7b","source":"wordfence","cve":"CVE-2026-39739","title":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder <= 2.9.5 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9eef671-9aa5-4707-80dd-e860d5e53d7b?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:55:40Z"},{"id":"wordfence:d9f060bd-029a-462e-b308-8366e82be383","source":"wordfence","cve":"CVE-2023-2877","title":"Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f060bd-029a-462e-b308-8366e82be383?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":false,"patched_in":"6.3.1"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9f1719c-ef66-4c68-b25c-175c99938e7a","source":"wordfence","cve":"CVE-2021-39339","title":"Telefication <= 1.8.0 - Open Relay and Server-Side Request Forgery","severity":"medium","cvss":5.8,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f1719c-ef66-4c68-b25c-175c99938e7a?source=api-prod","affected":[{"type":"plugin","slug":"telefication","name":"Telefication","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9f1ea27-463f-477e-b3c0-691ed84e34a4","source":"wordfence","cve":"CVE-2025-30766","title":"Happy Addons for Elementor <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f1ea27-463f-477e-b3c0-691ed84e34a4?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.16.2","to_inclusive":true,"patched_in":"3.16.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:53:59Z"},{"id":"wordfence:d9f257a9-d447-407c-83ae-3cc99254be3f","source":"wordfence","cve":"CVE-2026-16091","title":"GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f257a9-d447-407c-83ae-3cc99254be3f?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.9.1","to_inclusive":true,"patched_in":"7.9.9.2"}],"published":"2026-07-31T19:27:48Z","updated":"2026-08-01T07:49:53Z"},{"id":"wordfence:d9f3756a-8d03-471d-afb8-05d17ebbfcfc","source":"wordfence","cve":"CVE-2025-22634","title":"Easy Booked \u2013 Appointment Booking and Scheduling Management System for WordPress <= 2.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f3756a-8d03-471d-afb8-05d17ebbfcfc?source=api-prod","affected":[{"type":"plugin","slug":"easy-booked","name":"Easy Booked \u2013 Appointment Booking and Scheduling Management System for WordPress","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-18T20:24:53Z"},{"id":"wordfence:d9f6b600-a35a-49c2-8758-a7cc5c00e947","source":"wordfence","cve":"CVE-2020-36755","title":"Customizr <= 4.3.0 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f6b600-a35a-49c2-8758-a7cc5c00e947?source=api-prod","affected":[{"type":"theme","slug":"customizr","name":"Customizr","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.3.1"}],"published":"2020-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9f6b761-9c4b-4dcc-885d-9a5b4e8e534d","source":"wordfence","cve":"CVE-2024-6451","title":"AI Engine <= 2.5.0 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f6b761-9c4b-4dcc-885d-9a5b4e8e534d?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-28T22:35:41Z"},{"id":"wordfence:d9f6ef14-dc04-46da-b2fc-e84b91153bfe","source":"wordfence","cve":"CVE-2008-0683","title":"ShiftThis (Unspecified Version) - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f6ef14-dc04-46da-b2fc-e84b91153bfe?source=api-prod","affected":[{"type":"plugin","slug":"st_newsletter","name":"ShiftThis","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2008-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:d9f7130d-883a-4db4-9edf-f5526724de11","source":"wordfence","cve":"CVE-2023-27448","title":"MakeStories (for Google Web Stories) <= 3.0.2 - Cross-Site Request Forgery via 'ms_set_options'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f7130d-883a-4db4-9edf-f5526724de11?source=api-prod","affected":[{"type":"plugin","slug":"makestories-helper","name":"MakeStories (for Google Web Stories)","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2023-08-28T00:00:00Z","updated":"2024-03-11T08:47:47Z"},{"id":"wordfence:d9f7f66f-5d58-4a23-8444-805569ec8294","source":"wordfence","cve":"CVE-2024-32094","title":"Church Content \u2013 Sermons, Events and More <= 2.6 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f7f66f-5d58-4a23-8444-805569ec8294?source=api-prod","affected":[{"type":"plugin","slug":"church-theme-content","name":"Church Content \u2013 Sermons, Events and More","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:17:14Z"},{"id":"wordfence:d9f99ab9-eb22-4766-81f2-647af1229815","source":"wordfence","cve":"CVE-2026-105894","title":"Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f99ab9-eb22-4766-81f2-647af1229815?source=api-prod","affected":[{"type":"plugin","slug":"ak-framework","name":"Ak Framework","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2026-10-30T00:00:00Z","updated":"2026-10-30T17:15:32Z"},{"id":"wordfence:d9f9d20f-a0cd-40ed-8f75-7b57fe8e70f0","source":"wordfence","cve":"CVE-2025-49056","title":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846 <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f9d20f-a0cd-40ed-8f75-7b57fe8e70f0?source=api-prod","affected":[{"type":"plugin","slug":"duoshuo","name":"\u591a\u8bf4\u793e\u4f1a\u5316\u8bc4\u8bba\u6846","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:37:31Z"},{"id":"wordfence:d9fbd7ee-cfd0-4621-9eb9-df0202657ce9","source":"wordfence","cve":"CVE-2019-15866","title":"Crelly Slider <= 1.3.4 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fbd7ee-cfd0-4621-9eb9-df0202657ce9?source=api-prod","affected":[{"type":"plugin","slug":"crelly-slider","name":"Crelly Slider","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2019-06-06T00:00:00Z","updated":"2024-08-15T18:22:27Z"},{"id":"wordfence:d9fbedea-15e7-4233-8e2d-9fd928fe4f2a","source":"wordfence","cve":"CVE-2025-24630","title":"Learning Management System, eLearning, Course Builder, WordPress LMS Plugin \u2013 Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fbedea-15e7-4233-8e2d-9fd928fe4f2a?source=api-prod","affected":[{"type":"plugin","slug":"sikshya","name":"Sikshya LMS \u2013 LMS Course Builder, Online Courses & eLearning","from":"*","from_inclusive":true,"to":"0.0.21","to_inclusive":true,"patched_in":"0.0.22"}],"published":"2025-01-04T00:00:00Z","updated":"2025-02-25T17:03:04Z"},{"id":"wordfence:d9fcb387-fee5-4ad3-b51f-ac506b48882c","source":"wordfence","cve":"CVE-2025-49283","title":"Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant <= 4.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fcb387-fee5-4ad3-b51f-ac506b48882c?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliant-recaptcha-for-all-forms","name":"Invisible Anti-Spam & CAPTCHA \u2014 reCAPTCHA Alternative for All Forms","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:25:21Z"},{"id":"wordfence:d9fe53e3-1916-4de2-91a6-83e823fc6e91","source":"wordfence","cve":"CVE-2024-47365","title":"Automatically Hierarchic Categories in Menu <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fe53e3-1916-4de2-91a6-83e823fc6e91?source=api-prod","affected":[{"type":"plugin","slug":"automatically-hierarchic-categories-in-menu","name":"Automatically Hierarchic Categories in Menu","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:25:27Z"},{"id":"wordfence:d9fe750f-5d8f-4c47-9d75-d928f1367fa8","source":"wordfence","cve":"CVE-2024-11877","title":"Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fe750f-5d8f-4c47-9d75-d928f1367fa8?source=api-prod","affected":[{"type":"plugin","slug":"cricket-score","name":"Cricket Live Score","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2024-12-13T15:59:40Z","updated":"2025-02-20T14:44:13Z"},{"id":"wordfence:d9ff985d-1bb3-4976-9385-0dc48d94b542","source":"wordfence","cve":"CVE-2025-9587","title":"CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ff985d-1bb3-4976-9385-0dc48d94b542?source=api-prod","affected":[{"type":"plugin","slug":"ctl-behance-importer-lite","name":"CTL Behance Importer Lite","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T00:00:00Z","updated":"2025-10-16T14:20:46Z"},{"id":"wordfence:d9ffc0af-9c3d-4f8e-ae0b-e51c0c67dfe1","source":"wordfence","cve":"CVE-2025-10039","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ffc0af-9c3d-4f8e-ae0b-e51c0c67dfe1?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-11-20T00:00:00Z","updated":"2025-11-21T12:28:10Z"},{"id":"wordfence:da003985-7fb2-4f5b-bb70-6ec3578ef3e8","source":"wordfence","cve":"CVE-2026-109989","title":"Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da003985-7fb2-4f5b-bb70-6ec3578ef3e8?source=api-prod","affected":[{"type":"plugin","slug":"themify-popup","name":"Themify Popup","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-10-16T14:36:36Z","updated":"2026-10-17T03:43:32Z"},{"id":"wordfence:da01eaa6-fb18-4594-824c-d5db8ad97b69","source":"wordfence","cve":"CVE-2024-54279","title":"WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da01eaa6-fb18-4594-824c-d5db8ad97b69?source=api-prod","affected":[{"type":"plugin","slug":"wp-nerd-toolkit","name":"WP-NERD Toolkit","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:45:13Z"},{"id":"wordfence:da025593-ad11-4a48-97e1-d31c6f0e62ea","source":"wordfence","cve":"","title":"Breezing Forms <= 1.2.7.30 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da025593-ad11-4a48-97e1-d31c6f0e62ea?source=api-prod","affected":[{"type":"plugin","slug":"breezing-forms","name":"Breezing Forms","from":"*","from_inclusive":true,"to":"1.2.7.30","to_inclusive":true,"patched_in":"1.2.7.31"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da02bc67-466b-4e20-bbe0-728a4ee9f415","source":"wordfence","cve":"CVE-2025-54675","title":"YITH WooCommerce Popup <= 1.48.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da02bc67-466b-4e20-bbe0-728a4ee9f415?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-popup","name":"YITH WooCommerce Popup","from":"*","from_inclusive":true,"to":"1.48.0","to_inclusive":true,"patched_in":"1.48.1"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:54:52Z"},{"id":"wordfence:da05c985-62aa-4ed2-ba6a-b169e14f6441","source":"wordfence","cve":"CVE-2026-97280","title":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO  3.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da05c985-62aa-4ed2-ba6a-b169e14f6441?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"3.1.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-01T11:56:13Z","updated":"2026-10-09T00:00:37Z"},{"id":"wordfence:da082107-1c71-4d18-a864-986807568de9","source":"wordfence","cve":"CVE-2017-12949","title":"Podlove Podcast Publisher <= 2.5.3 - Authenticated SQL Injection","severity":"high","cvss":8.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da082107-1c71-4d18-a864-986807568de9?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":false,"patched_in":"2.6.0"}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da0950ad-4d6c-46fe-83c9-c14653fe9f1f","source":"wordfence","cve":"","title":"Backup Scheduler <= 1.5.13 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da0950ad-4d6c-46fe-83c9-c14653fe9f1f?source=api-prod","affected":[{"type":"plugin","slug":"backup-scheduler","name":"Backup Scheduler","from":"*","from_inclusive":true,"to":"1.5.13","to_inclusive":true,"patched_in":""}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da09b158-3626-455b-b3bc-b1109d0fab2e","source":"wordfence","cve":"CVE-2023-50835","title":"Advanced Category Template <= 0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da09b158-3626-455b-b3bc-b1109d0fab2e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-category-template","name":"Advanced Category Template","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da0c91e5-d9dc-413a-95f6-9e2fc6746ec0","source":"wordfence","cve":"CVE-2015-2791","title":"WPML <= 3.1.9 - Arbitrary Deletion of Content","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da0c91e5-d9dc-413a-95f6-9e2fc6746ec0?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.9.1"}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da0f0e1a-bbf8-42a5-b330-b53134488ebd","source":"wordfence","cve":"CVE-2025-13329","title":"File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da0f0e1a-bbf8-42a5-b330-b53134488ebd?source=api-prod","affected":[{"type":"plugin","slug":"file-uploader-for-woocommerce","name":"File Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2025-12-19T15:04:43Z","updated":"2026-01-06T17:02:29Z"},{"id":"wordfence:da11abe7-49fa-496b-bcd7-c666eef63896","source":"wordfence","cve":"CVE-2024-32548","title":"What's New Generator <= 2.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da11abe7-49fa-496b-bcd7-c666eef63896?source=api-prod","affected":[{"type":"plugin","slug":"whats-new-genarator","name":"What&#039;s New Generator","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:58:28Z"},{"id":"wordfence:da125e31-4747-46b7-8a46-a234388035c0","source":"wordfence","cve":"CVE-2024-9208","title":"Enable Accessibility <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da125e31-4747-46b7-8a46-a234388035c0?source=api-prod","affected":[{"type":"plugin","slug":"enable-accessibility","name":"Enable Accessibility","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:23:24Z","updated":"2025-01-07T04:22:23Z"},{"id":"wordfence:da13130f-9483-4e84-b652-faa248bf1047","source":"wordfence","cve":"CVE-2025-10162","title":"Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 13.5 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da13130f-9483-4e84-b652-faa248bf1047?source=api-prod","affected":[{"type":"plugin","slug":"admin-and-client-message-after-order-for-woocommerce","name":"OrderConvo \u2013 Vendor & Customer Messages After Orders","from":"*","from_inclusive":true,"to":"13.5","to_inclusive":true,"patched_in":"14"}],"published":"2025-09-16T00:00:00Z","updated":"2025-10-16T13:12:08Z"},{"id":"wordfence:da153e10-f5fd-4d68-99b0-7ae65ab347f6","source":"wordfence","cve":"CVE-2026-90976","title":"Clean Login <= 1.18 - Unauthenticated Account Registration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da153e10-f5fd-4d68-99b0-7ae65ab347f6?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":"1.19"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:25:25Z"},{"id":"wordfence:da15614b-6619-4ccb-93eb-12923910fb41","source":"wordfence","cve":"","title":"Click to top <= 1.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da15614b-6619-4ccb-93eb-12923910fb41?source=api-prod","affected":[{"type":"plugin","slug":"click-to-top","name":"Click to top","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":false,"patched_in":"1.2.8"}],"published":"2020-08-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da18dce3-f8f9-48ae-b767-0b72ffd75c1e","source":"wordfence","cve":"CVE-2025-24536","title":"WordPress Helpdesk & Live Chat Plugin Powered by AI \u2013 ThriveDesk <= 2.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da18dce3-f8f9-48ae-b767-0b72ffd75c1e?source=api-prod","affected":[{"type":"plugin","slug":"thrivedesk","name":"ThriveDesk \u2013 Live Chat, AI Chatbot, Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-11-11T00:00:00Z","updated":"2025-02-20T16:13:33Z"},{"id":"wordfence:da1d37f5-45d5-4775-a217-24fdb3b53da7","source":"wordfence","cve":"CVE-2015-9451","title":"Plugmatter Optin Feature Box < 2.0.14 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da1d37f5-45d5-4775-a217-24fdb3b53da7?source=api-prod","affected":[{"type":"plugin","slug":"plugmatter-optin-feature-box-lite","name":"Plugmatter Optin Feature Box","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":false,"patched_in":"2.0.14"}],"published":"2015-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da1ef273-417a-47f6-adf9-dbd5747a8c3b","source":"wordfence","cve":"CVE-2025-22672","title":"Video & Photo Gallery for Ultimate Member <= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da1ef273-417a-47f6-adf9-dbd5747a8c3b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-for-ultimate-member","name":"Video & Photo Gallery for Ultimate Member","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T19:00:36Z"},{"id":"wordfence:da1f68a5-8ca7-4744-9b73-09e767072885","source":"wordfence","cve":"CVE-2024-31276","title":"Products & Order Export for WooCommerce <= 2.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da1f68a5-8ca7-4744-9b73-09e767072885?source=api-prod","affected":[{"type":"plugin","slug":"export-woocommerce","name":"Export Products, Orders & Customers for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-01-10T00:00:00Z","updated":"2024-04-11T13:52:51Z"},{"id":"wordfence:da2050ea-70b3-476d-841f-021c3baddf35","source":"wordfence","cve":"CVE-2024-6568","title":"Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da2050ea-70b3-476d-841f-021c3baddf35?source=api-prod","affected":[{"type":"plugin","slug":"flamix-bitrix24-and-contact-forms-7-integrations","name":"Flamix: Bitrix24 and Contact Form 7 integrations","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-21T05:30:25Z"},{"id":"wordfence:da231dc1-d84e-4ec0-9553-3bec7085c46f","source":"wordfence","cve":"CVE-2026-121769","title":"WP w3all phpBB <= 3.1.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da231dc1-d84e-4ec0-9553-3bec7085c46f?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2026-11-07T17:11:59Z","updated":"2026-11-10T19:47:55Z"},{"id":"wordfence:da235dea-4884-4e6a-a8b8-65d34f050684","source":"wordfence","cve":"CVE-2026-12142","title":"NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da235dea-4884-4e6a-a8b8-65d34f050684?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-06-30T21:14:53Z","updated":"2026-07-01T09:32:28Z"},{"id":"wordfence:da24aad2-ae6b-411e-a229-0df585215731","source":"wordfence","cve":"CVE-2021-24194","title":"Limit Login Attempts (Spam Protection) <= 2.8 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da24aad2-ae6b-411e-a229-0df585215731?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-failed-login-attempts","name":"Limit Login Attempts (Spam Protection)","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da2b7267-936b-4011-af42-210885d5dbb9","source":"wordfence","cve":"CVE-2024-8093","title":"Posts reminder <= 0.20 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da2b7267-936b-4011-af42-210885d5dbb9?source=api-prod","affected":[{"type":"plugin","slug":"posts-reminder","name":"Posts reminder","from":"*","from_inclusive":true,"to":"0.20","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-10-04T16:24:32Z"},{"id":"wordfence:da2d8494-aea3-4a1e-9eca-946c0bd390cd","source":"wordfence","cve":"CVE-2024-4324","title":"WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da2d8494-aea3-4a1e-9eca-946c0bd390cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.9.11"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:52:45Z"},{"id":"wordfence:da2dd641-6f98-4258-a758-2bfc831b3898","source":"wordfence","cve":"CVE-2024-51670","title":"JS Help Desk \u2013 Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da2dd641-6f98-4258-a758-2bfc831b3898?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:50:39Z"},{"id":"wordfence:da3070aa-fae8-465a-95e5-ae92dcd89f66","source":"wordfence","cve":"CVE-2021-33850","title":"Microsoft Clarity <= 0.3 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da3070aa-fae8-465a-95e5-ae92dcd89f66?source=api-prod","affected":[{"type":"plugin","slug":"microsoft-clarity","name":"Microsoft Clarity","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da308b0c-a892-4bd7-b242-3bbf9ad709ad","source":"wordfence","cve":"CVE-2024-45451","title":"Roseta <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da308b0c-a892-4bd7-b242-3bbf9ad709ad?source=api-prod","affected":[{"type":"theme","slug":"roseta","name":"Roseta","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-16T00:00:00Z","updated":"2024-09-24T17:14:24Z"},{"id":"wordfence:da36ba83-490e-4c9d-8a34-c5c79392a09a","source":"wordfence","cve":"CVE-2023-3077","title":"MStore API <= 3.9.7 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da36ba83-490e-4c9d-8a34-c5c79392a09a?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da3b7218-4655-4def-a3f9-9931d6943583","source":"wordfence","cve":"CVE-2026-24593","title":"AWP Classifieds <= 4.4.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da3b7218-4655-4def-a3f9-9931d6943583?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.4"}],"published":"2026-01-16T00:00:00Z","updated":"2026-02-25T14:38:48Z"},{"id":"wordfence:da3b8de2-f620-40a7-a44a-c4fcb6d57d8c","source":"wordfence","cve":"CVE-2024-9836","title":"RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da3b8de2-f620-40a7-a44a-c4fcb6d57d8c?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-widget","name":"RSS Feed Widget","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-10-22T00:00:00Z","updated":"2024-12-12T18:04:02Z"},{"id":"wordfence:da3c736d-7b10-4f7b-a034-83981fbe53ca","source":"wordfence","cve":"CVE-2025-52766","title":"Printeers Print & Ship <= 1.17.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da3c736d-7b10-4f7b-a034-83981fbe53ca?source=api-prod","affected":[{"type":"plugin","slug":"invition-print-ship","name":"Printeers Print & Ship","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T00:00:00Z","updated":"2026-07-10T19:04:02Z"},{"id":"wordfence:da3e3d6c-7643-4f22-aa88-2c4ce80aed1f","source":"wordfence","cve":"CVE-2025-1771","title":"Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.8","to_inclusive":true,"patched_in":"3.1.9"}],"published":"2025-03-14T00:00:00Z","updated":"2025-03-15T04:22:08Z"},{"id":"wordfence:da44b8d8-3f3f-4791-9f45-dee5e60f9bcc","source":"wordfence","cve":"CVE-2025-22364","title":"Ach Invoice App <= 1.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da44b8d8-3f3f-4791-9f45-dee5e60f9bcc?source=api-prod","affected":[{"type":"plugin","slug":"ach-invoice-app","name":"ACH Invoicing Plugin","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:27:55Z"},{"id":"wordfence:da4592b6-5e84-4a89-9ade-6cc227740d32","source":"wordfence","cve":"CVE-2021-4420","title":"Sell Media <= 2.5.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da4592b6-5e84-4a89-9ade-6cc227740d32?source=api-prod","affected":[{"type":"plugin","slug":"sell-media","name":"Sell Media","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da4684b8-20f6-4dc1-8f29-d79f64ccb9d8","source":"wordfence","cve":"CVE-2023-44245","title":"Contractor Contact Form Website to Workflow Tool <= 4.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da4684b8-20f6-4dc1-8f29-d79f64ccb9d8?source=api-prod","affected":[{"type":"plugin","slug":"contractor-contact-form-website-to-workflow-tool","name":"Contractor Contact Form Website to Workflow Tool","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da483b5a-a22f-4106-bff6-0c641ab40e40","source":"wordfence","cve":"CVE-2026-8089","title":"weMail <= 2.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da483b5a-a22f-4106-bff6-0c641ab40e40?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-05-27T00:00:00Z","updated":"2026-09-18T15:03:55Z"},{"id":"wordfence:da4f5af6-61b2-4983-9096-66f6ff7fc060","source":"wordfence","cve":"CVE-2022-3839","title":"Analytics for WP <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da4f5af6-61b2-4983-9096-66f6ff7fc060?source=api-prod","affected":[{"type":"plugin","slug":"analytics-for-wp","name":"Analytics for WP","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da4f81c5-c796-4052-ac1a-007a1e8f5a50","source":"wordfence","cve":"CVE-2022-1326","title":"Form \u2013 Contact Form <= 1.2.0 - Administrator+ Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da4f81c5-c796-4052-ac1a-007a1e8f5a50?source=api-prod","affected":[{"type":"plugin","slug":"form-forms","name":"Form \u2013 Contact Form","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da51b3ef-b12f-4af0-90b7-1ea61595b661","source":"wordfence","cve":"CVE-2022-0773","title":"Documentor \u2013 Create Product Documentation <= 1.5.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da51b3ef-b12f-4af0-90b7-1ea61595b661?source=api-prod","affected":[{"type":"plugin","slug":"documentor-lite","name":"Documentor \u2013 Create Product Documentation","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da525d8d-9a69-4bb3-821a-948646c4ee2b","source":"wordfence","cve":"CVE-2025-49508","title":"CozyStay < 1.7.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da525d8d-9a69-4bb3-821a-948646c4ee2b?source=api-prod","affected":[{"type":"theme","slug":"cozystay","name":"CozyStay - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:10:47Z"},{"id":"wordfence:da533426-16bf-4eef-b113-c41b256952e6","source":"wordfence","cve":"CVE-2026-49080","title":"wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da533426-16bf-4eef-b113-c41b256952e6?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.4"}],"published":"2026-06-08T00:00:00Z","updated":"2026-10-26T22:02:19Z"},{"id":"wordfence:da541fd5-514b-4404-ba32-121af21f1e8d","source":"wordfence","cve":"CVE-2026-112827","title":"HANDMADE \u2013 Dropshipping for Etsy and WooCommerce <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da541fd5-514b-4404-ba32-121af21f1e8d?source=api-prod","affected":[{"type":"plugin","slug":"handmade-dropshipping-for-etsy-and-woo","name":"HANDMADE \u2013 Dropshipping for Etsy and WooCommerce","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"}],"published":"2026-10-27T10:24:02Z","updated":"2026-11-03T19:23:40Z"},{"id":"wordfence:da550fd7-3c1a-4b07-afc0-2366e0f5cccd","source":"wordfence","cve":"CVE-2023-47820","title":"WP Like Button <= 1.7.0 - Missing Authorization via crublabFBLBAjax","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da550fd7-3c1a-4b07-afc0-2366e0f5cccd?source=api-prod","affected":[{"type":"plugin","slug":"wp-like-button","name":"WP Like Button","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da573fba-b0e7-41af-a197-157949bb4de7","source":"wordfence","cve":"CVE-2026-119506","title":"ACF Frontend Admin by DynamiApps <= 3.30.1 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da573fba-b0e7-41af-a197-157949bb4de7?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.30.2"}],"published":"2026-11-06T23:04:27Z","updated":"2026-11-10T19:31:29Z"},{"id":"wordfence:da575fd4-7e04-415b-a2fb-248b664bd619","source":"wordfence","cve":"CVE-2026-28027","title":"Kayon <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da575fd4-7e04-415b-a2fb-248b664bd619?source=api-prod","affected":[{"type":"theme","slug":"kayon","name":"Kayon","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:30:41Z"},{"id":"wordfence:da590a65-8728-4577-b6e4-ecebc2a2277d","source":"wordfence","cve":"CVE-2025-11522","title":"Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da590a65-8728-4577-b6e4-ecebc2a2277d?source=api-prod","affected":[{"type":"theme","slug":"search-and-go","name":"Search & Go - Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2025-10-08T00:00:00Z","updated":"2025-11-12T13:47:25Z"},{"id":"wordfence:da5b700c-ec1f-4803-8165-581382cef482","source":"wordfence","cve":"CVE-2024-47369","title":"Social Auto Poster <= 5.3.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da5b700c-ec1f-4803-8165-581382cef482?source=api-prod","affected":[{"type":"plugin","slug":"social-auto-poster","name":"Social Auto Poster","from":"*","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"5.3.16"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:09:50Z"},{"id":"wordfence:da5ba18a-97ec-42c5-a7c4-ca38611c1fcd","source":"wordfence","cve":"CVE-2022-2378","title":"Easy Student Results <= 2.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da5ba18a-97ec-42c5-a7c4-ca38611c1fcd?source=api-prod","affected":[{"type":"plugin","slug":"easy-student-results","name":"Easy Student Results","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da607df4-1dbb-4b1e-ace6-b339cf9e8512","source":"wordfence","cve":"CVE-2025-14854","title":"WP-CRM System \u2013 Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da607df4-1dbb-4b1e-ace6-b339cf9e8512?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-01-13T16:44:00Z","updated":"2026-02-03T20:39:56Z"},{"id":"wordfence:da62021a-6741-4054-8f33-f829b1854318","source":"wordfence","cve":"CVE-2026-34899","title":"LTL Freight Quotes \u2013 Worldwide Express Edition <= 5.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da62021a-6741-4054-8f33-f829b1854318?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-worldwide-express-edition","name":"LTL Freight Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:48:56Z"},{"id":"wordfence:da675a50-c7ac-4859-9795-4b0f1dc56c7b","source":"wordfence","cve":"CVE-2026-1982","title":"Persian Elementor (\u0627\u0644\u0645\u0646\u062a\u0648\u0631 \u0641\u0627\u0631\u0633\u06cc) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da675a50-c7ac-4859-9795-4b0f1dc56c7b?source=api-prod","affected":[{"type":"plugin","slug":"persian-elementor","name":"\u0627\u0644\u0645\u0646\u062a\u0648\u0631 \u0641\u0627\u0631\u0633\u06cc","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-07-29T14:21:13Z","updated":"2026-07-30T03:03:23Z"},{"id":"wordfence:da680b46-620c-4d35-a327-c7ebe08e49c4","source":"wordfence","cve":"CVE-2025-24712","title":"Radius Blocks <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da680b46-620c-4d35-a327-c7ebe08e49c4?source=api-prod","affected":[{"type":"plugin","slug":"radius-blocks","name":"Radius Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:13:34Z"},{"id":"wordfence:da68f210-ad67-4027-80e6-efd1c3562eed","source":"wordfence","cve":"CVE-2025-69011","title":"Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da68f210-ad67-4027-80e6-efd1c3562eed?source=api-prod","affected":[{"type":"plugin","slug":"cool-tag-cloud","name":"Cool Tag Cloud","from":"*","from_inclusive":true,"to":"2.29","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-14T19:38:17Z"},{"id":"wordfence:da6bf1b8-4bac-4c3a-a32f-fd157e77fce0","source":"wordfence","cve":"CVE-2025-32225","title":"WP Event Manager <= 3.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da6bf1b8-4bac-4c3a-a32f-fd157e77fce0?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-04-04T00:00:00Z","updated":"2025-08-22T15:45:05Z"},{"id":"wordfence:da6bf521-0c22-4839-8fa6-a0d67e28cfbd","source":"wordfence","cve":"CVE-2025-8561","title":"Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-87","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da6bf521-0c22-4839-8fa6-a0d67e28cfbd?source=api-prod","affected":[{"type":"plugin","slug":"ova-advent","name":"Ova Advent","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2025-10-14T16:42:57Z","updated":"2025-10-15T05:23:49Z"},{"id":"wordfence:da6c71cb-abeb-4e84-a151-9b324f76b845","source":"wordfence","cve":"CVE-2025-49319","title":"Wishlist for WooCommerce <= 3.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da6c71cb-abeb-4e84-a151-9b324f76b845?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce","name":"Wishlist for WooCommerce: Multiple Wishlists per Customer","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-16T15:49:01Z"},{"id":"wordfence:da6dcf5c-bb70-4227-a784-55cf28980308","source":"wordfence","cve":"CVE-2024-5260","title":"Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da6dcf5c-bb70-4227-a784-55cf28980308?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2024-07-01T20:25:26Z","updated":"2024-07-02T08:32:51Z"},{"id":"wordfence:da6eb803-3e2a-4ff1-9b93-6f109e8d0714","source":"wordfence","cve":"","title":"RSVPMaker <= 7.8.1 - Unauthenticated SQL Injection via 'event_count'","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da6eb803-3e2a-4ff1-9b93-6f109e8d0714?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":false,"patched_in":"7.8.2"}],"published":"2020-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da744a22-bfb2-4bbe-ab22-f18cec945a3a","source":"wordfence","cve":"CVE-2025-54744","title":"MasterStudy LMS <= 3.6.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da744a22-bfb2-4bbe-ab22-f18cec945a3a?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.6.15","to_inclusive":true,"patched_in":"3.6.16"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:37:57Z"},{"id":"wordfence:da760bcf-b252-4b88-9f54-af0a097e3295","source":"wordfence","cve":"CVE-2003-1599","title":"WordPress Core <= 0.70 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da760bcf-b252-4b88-9f54-af0a097e3295?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"0.70","to_inclusive":true,"patched_in":"0.71"}],"published":"2003-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da76d034-3e9a-4f3f-a314-48e776028369","source":"wordfence","cve":"CVE-2024-1294","title":"Sunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoice","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da76d034-3e9a-4f3f-a314-48e776028369?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.0.24","to_inclusive":true,"patched_in":"3.1"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:48Z"},{"id":"wordfence:da783bb4-785a-420d-97b7-760d49678503","source":"wordfence","cve":"CVE-2025-24810","title":"Simple Image Sizes <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da783bb4-785a-420d-97b7-760d49678503?source=api-prod","affected":[{"type":"plugin","slug":"simple-image-sizes","name":"Simple Image Sizes","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-01-28T00:00:00Z","updated":"2025-02-24T15:24:23Z"},{"id":"wordfence:da78fd0a-f69f-4779-bcf1-df1dab80156c","source":"wordfence","cve":"CVE-2026-32407","title":"WPC Smart Wishlist for WooCommerce <= 5.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da78fd0a-f69f-4779-bcf1-df1dab80156c?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"5.0.9"}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T21:14:06Z"},{"id":"wordfence:da7c18b3-d406-4fe6-8c72-fa0cb968c0ac","source":"wordfence","cve":"CVE-2025-31899","title":"Awesome Logos <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da7c18b3-d406-4fe6-8c72-fa0cb968c0ac?source=api-prod","affected":[{"type":"plugin","slug":"awesome-logos","name":"Awesome Logos","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T18:41:18Z"},{"id":"wordfence:da7f8c56-82b8-4248-845e-35497227cbaf","source":"wordfence","cve":"CVE-2026-93651","title":"Minimum and Maximum Quantity for WooCommerce <= 2.1.2 - Authenticated (Author+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da7f8c56-82b8-4248-845e-35497227cbaf?source=api-prod","affected":[{"type":"plugin","slug":"min-and-max-quantity-for-woocommerce","name":"Minimum and Maximum Quantity for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:31:39Z"},{"id":"wordfence:da7fd744-cd26-43dd-a508-bfa8a93068c5","source":"wordfence","cve":"CVE-2026-112837","title":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da7fd744-cd26-43dd-a508-bfa8a93068c5?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"8.0.7","to_inclusive":true,"patched_in":"8.0.8"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T20:58:00Z"},{"id":"wordfence:da807a8d-56de-494d-9f8a-9f749ab6c90e","source":"wordfence","cve":"CVE-2016-10954","title":"Neosense - Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da807a8d-56de-494d-9f8a-9f749ab6c90e?source=api-prod","affected":[{"type":"theme","slug":"neosense","name":"Neosense - Multipurpose WordPress Theme | WordPress","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2016-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da80ee88-71ca-4200-a853-7ffcbd21448a","source":"wordfence","cve":"CVE-2025-47495","title":"Blockspare <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da80ee88-71ca-4200-a853-7ffcbd21448a?source=api-prod","affected":[{"type":"plugin","slug":"blockspare","name":"BlockSpare \u2013 Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:03:48Z"},{"id":"wordfence:da8166f3-02d8-4519-a518-0f5e9e1b1ab3","source":"wordfence","cve":"CVE-2026-56011","title":"MapPress Maps for WordPress <= 2.97.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da8166f3-02d8-4519-a518-0f5e9e1b1ab3?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.97.3","to_inclusive":true,"patched_in":"2.97.4"}],"published":"2026-06-19T00:00:00Z","updated":"2026-06-23T15:49:22Z"},{"id":"wordfence:da81c849-fc85-4794-a79f-fcc3ef6a3bbc","source":"wordfence","cve":"CVE-2021-39314","title":"WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da81c849-fc85-4794-a79f-fcc3ef6a3bbc?source=api-prod","affected":[{"type":"plugin","slug":"woo-enviopack","name":"WooCommerce EnvioPack","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da81eb8b-4b38-462d-a85b-c0bad39f61a2","source":"wordfence","cve":"CVE-2024-12441","title":"BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da81eb8b-4b38-462d-a85b-c0bad39f61a2?source=api-prod","affected":[{"type":"plugin","slug":"bp-email-assign-templates","name":"BP Email Assign Templates","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-12-11T00:00:00Z","updated":"2025-02-25T17:04:37Z"},{"id":"wordfence:da848ced-acc4-48bc-8fbe-e90cdd53b3e8","source":"wordfence","cve":"CVE-2016-11001","title":"User Submitted Posts < 20160215 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da848ced-acc4-48bc-8fbe-e90cdd53b3e8?source=api-prod","affected":[{"type":"plugin","slug":"user-submitted-posts","name":"User Submitted Posts \u2013 Enable Users to Submit Posts from the Front End","from":"*","from_inclusive":true,"to":"20160215","to_inclusive":false,"patched_in":"20160215"}],"published":"2016-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da84aa80-7ef6-4846-870d-07bf88652329","source":"wordfence","cve":"CVE-2024-11188","title":"Formidable Forms \u2013 Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da84aa80-7ef6-4846-870d-07bf88652329?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.16.1.2","to_inclusive":true,"patched_in":"6.16.2"}],"published":"2024-11-22T16:33:04Z","updated":"2024-11-23T05:40:11Z"},{"id":"wordfence:da858b17-28f9-4bf6-9aeb-a24b0e20243a","source":"wordfence","cve":"CVE-2026-102798","title":"ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da858b17-28f9-4bf6-9aeb-a24b0e20243a?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.46.0","to_inclusive":true,"patched_in":"2.47.0"}],"published":"2026-10-02T00:00:00Z","updated":"2026-10-09T12:53:37Z"},{"id":"wordfence:da86c6e0-2cff-4aca-b440-ef3fc1f61324","source":"wordfence","cve":"CVE-2022-4458","title":"amr shortcode any widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da86c6e0-2cff-4aca-b440-ef3fc1f61324?source=api-prod","affected":[{"type":"plugin","slug":"amr-shortcode-any-widget","name":"amr shortcode any widget","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da86d422-f0ef-439b-ae67-6cb9699073e0","source":"wordfence","cve":"CVE-2024-52475","title":"Wawp < 3.0.18 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da86d422-f0ef-439b-ae67-6cb9699073e0?source=api-prod","affected":[{"type":"plugin","slug":"automation-web-platform","name":"Wawp Country Code & Chat Widget for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.18","to_inclusive":false,"patched_in":"3.0.18"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:29:49Z"},{"id":"wordfence:da879b1d-c17b-409b-9fd3-87f44ddd14b5","source":"wordfence","cve":"CVE-2024-12734","title":"Advance Post Prefix <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da879b1d-c17b-409b-9fd3-87f44ddd14b5?source=api-prod","affected":[{"type":"plugin","slug":"advance-post-prefix","name":"Advance Post Prefix","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-05-27T15:49:06Z"},{"id":"wordfence:da89e8f9-3843-4d72-92b2-cd2f717510cd","source":"wordfence","cve":"CVE-2021-24438","title":"ShareThis Dashboard for Google Analytics <= 2.5.1 - Reflected Cross-Site Scripting via ga_action parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da89e8f9-3843-4d72-92b2-cd2f717510cd?source=api-prod","affected":[{"type":"plugin","slug":"googleanalytics","name":"ShareThis Dashboard for Google Analytics","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da8af540-1623-42f2-a8af-4d3cadf1f5d0","source":"wordfence","cve":"CVE-2019-14796","title":"Woocommerce Products Price Bulk Edit <= 2.0 - Cross-Site Scripting via show_products_page_limit parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da8af540-1623-42f2-a8af-4d3cadf1f5d0?source=api-prod","affected":[{"type":"plugin","slug":"mq-woocommerce-products-price-bulk-edit","name":"Woocommerce Products Price Bulk Edit","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2019-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da8d1659-c532-4020-be16-527c1437952a","source":"wordfence","cve":"CVE-2016-10148","title":"WordPress Core < 4.6 - Authorization Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da8d1659-c532-4020-be16-527c1437952a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":false,"patched_in":"4.6"}],"published":"2016-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da8dd02f-0d9f-44a2-bcad-1e392668dd67","source":"wordfence","cve":"CVE-2023-25782","title":"Service Area Postcode Checker <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da8dd02f-0d9f-44a2-bcad-1e392668dd67?source=api-prod","affected":[{"type":"plugin","slug":"service-area-postcode-checker","name":"Service Area Postcode Checker","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da9089a2-420f-4744-96d1-46c050a95328","source":"wordfence","cve":"CVE-2026-8865","title":"Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da9089a2-420f-4744-96d1-46c050a95328?source=api-prod","affected":[{"type":"plugin","slug":"avalon23-products-filter-for-woocommerce","name":"Avalon23 Products Filter for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-06-23T16:40:48Z","updated":"2026-07-22T20:39:47Z"},{"id":"wordfence:da919992-867f-4e17-a709-6ba7cfe350c8","source":"wordfence","cve":"CVE-2024-13493","title":"Sensly Online Presence <= 0.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da919992-867f-4e17-a709-6ba7cfe350c8?source=api-prod","affected":[{"type":"plugin","slug":"sensly-online-presence","name":"Sensly Online Presence","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-30T14:24:59Z"},{"id":"wordfence:da94a7dc-f666-44fd-9f76-e610cbd2b610","source":"wordfence","cve":"CVE-2023-0380","title":"Easy Digital Downloads <= 3.1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da94a7dc-f666-44fd-9f76-e610cbd2b610?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.1.0.4","to_inclusive":true,"patched_in":"3.1.0.5"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da95086a-6ae2-4b4d-8312-78e3800ded7f","source":"wordfence","cve":"CVE-2015-4018","title":"FeedWordPress < 2015.0514 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da95086a-6ae2-4b4d-8312-78e3800ded7f?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2015.0514","to_inclusive":false,"patched_in":"2015.0514"}],"published":"2015-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da95e282-54b9-4296-99f3-9187c04dcaac","source":"wordfence","cve":"","title":"Leaflet Maps Marker Pro < 1.5.8 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da95e282-54b9-4296-99f3-9187c04dcaac?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker-pro","name":"Leaflet Maps Marker Pro","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2014-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da97a395-64b8-4efd-b189-f917674b1c18","source":"wordfence","cve":"CVE-2025-6976","title":"Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da97a395-64b8-4efd-b189-f917674b1c18?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"6.6.4.4","to_inclusive":true,"patched_in":"6.6.5"},{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"7.0.1","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"6.6.5"}],"published":"2025-07-09T09:58:49Z","updated":"2025-07-09T22:22:47Z"},{"id":"wordfence:da9b1132-fb02-443d-8d56-9e89658aad89","source":"wordfence","cve":"CVE-2022-1895","title":"underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da9b1132-fb02-443d-8d56-9e89658aad89?source=api-prod","affected":[{"type":"plugin","slug":"underconstruction","name":"underConstruction","from":"*","from_inclusive":true,"to":"1.20","to_inclusive":false,"patched_in":"1.20"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da9e3db0-9cbf-4b1a-bdaa-d5d86be744af","source":"wordfence","cve":"CVE-2022-3062","title":"Simple File List <= 4.4.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da9e3db0-9cbf-4b1a-bdaa-d5d86be744af?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2022-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:da9f89a2-f816-4445-8aea-11b622451ee9","source":"wordfence","cve":"CVE-2025-12134","title":"ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/da9f89a2-f816-4445-8aea-11b622451ee9?source=api-prod","affected":[{"type":"plugin","slug":"zoloblocks","name":"ZoloBlocks \u2013 Advanced Gutenberg Blocks, Website Builder & Page Design Toolkit","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-29T05:12:10Z"},{"id":"wordfence:daa1d9bb-e70a-4985-853c-915af7be535c","source":"wordfence","cve":"CVE-2026-111410","title":"E2Pdf \u2013 Export Pdf Tool for WordPress <= 1.32.57 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa1d9bb-e70a-4985-853c-915af7be535c?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.57","to_inclusive":true,"patched_in":"1.32.58"}],"published":"2026-10-19T12:15:00Z","updated":"2026-10-23T18:43:07Z"},{"id":"wordfence:daa30370-0d11-45b7-8ca3-b2a3b9046127","source":"wordfence","cve":"CVE-2023-52121","title":"NitroPack <= 1.10.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa30370-0d11-45b7-8ca3-b2a3b9046127?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":true,"patched_in":"1.10.3"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daa30b1b-cb8f-43fd-8329-c64b4024408f","source":"wordfence","cve":"CVE-2024-2039","title":"Stackable \u2013 Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa30b1b-cb8f-43fd-8329-c64b4024408f?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.12.11","to_inclusive":true,"patched_in":"3.12.12"}],"published":"2024-03-28T00:00:00Z","updated":"2024-07-31T15:45:31Z"},{"id":"wordfence:daa38c2c-9992-400b-acef-dcd37f9c7269","source":"wordfence","cve":"CVE-2026-10570","title":"Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa38c2c-9992-400b-acef-dcd37f9c7269?source=api-prod","affected":[{"type":"plugin","slug":"acf-repeater-for-elementor","name":"Sympl Repeater for ACF and Elementor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:31:26Z","updated":"2026-07-08T05:34:10Z"},{"id":"wordfence:daa4260a-8c50-4fdb-be4f-6a1fb5bcff01","source":"wordfence","cve":"CVE-2025-30827","title":"WP2LEADS <= 3.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa4260a-8c50-4fdb-be4f-6a1fb5bcff01?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:31:35Z"},{"id":"wordfence:daa48b64-6f89-40be-a31f-31d1481dfc91","source":"wordfence","cve":"CVE-2024-3868","title":"Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa48b64-6f89-40be-a31f-31d1481dfc91?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-04T02:31:36Z"},{"id":"wordfence:daa5e6a7-91ff-4dd0-aec2-f9a13e38f309","source":"wordfence","cve":"CVE-2026-25466","title":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet Map <= 10.1.05 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa5e6a7-91ff-4dd0-aec2-f9a13e38f309?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.1.05","to_inclusive":true,"patched_in":"10.1.06"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:48:12Z"},{"id":"wordfence:daa8f941-6e87-4b94-8526-f73770fe6f82","source":"wordfence","cve":"CVE-2025-12091","title":"Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa8f941-6e87-4b94-8526-f73770fe6f82?source=api-prod","affected":[{"type":"plugin","slug":"instantsearch-for-woocommerce","name":"Search, Filters & Merchandising for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.67","to_inclusive":true,"patched_in":"3.0.68"}],"published":"2025-12-05T17:19:21Z","updated":"2025-12-09T22:05:06Z"},{"id":"wordfence:daa9abc2-310f-4bd9-9b88-d6f3024ab5f1","source":"wordfence","cve":"CVE-2021-36867","title":"Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9abc2-310f-4bd9-9b88-d6f3024ab5f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-testing","name":"Psychological tests & quizzes","from":"*","from_inclusive":true,"to":"0.21.19","to_inclusive":true,"patched_in":""}],"published":"2022-04-26T07:49:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daa9c3dd-e8cf-4696-bc0c-4088509f89db","source":"wordfence","cve":"CVE-2025-7956","title":"Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9c3dd-e8cf-4696-bc0c-4088509f89db?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.13.1","to_inclusive":true,"patched_in":"4.13.2"}],"published":"2025-08-27T16:25:29Z","updated":"2025-08-28T05:24:54Z"},{"id":"wordfence:daaa6507-cd8a-40c9-95af-34cc96551417","source":"wordfence","cve":"","title":"Tweet Wheel <= 0.2 - Missing Authorization Checks","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daaa6507-cd8a-40c9-95af-34cc96551417?source=api-prod","affected":[{"type":"plugin","slug":"tweet-wheel","name":"Tweet Wheel","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2015-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daac4d63-3789-4262-9b06-aadb4ca1f01e","source":"wordfence","cve":"CVE-2024-37264","title":"Groundhogg <= 3.4.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daac4d63-3789-4262-9b06-aadb4ca1f01e?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"3.4.2.3","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:43:30Z"},{"id":"wordfence:daac833f-b350-453a-b56a-fe3b1dd2ed3b","source":"wordfence","cve":"CVE-2026-76074","title":"AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daac833f-b350-453a-b56a-fe3b1dd2ed3b?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":true,"patched_in":"5.8.5"}],"published":"2026-08-21T15:03:31Z","updated":"2026-08-24T13:22:42Z"},{"id":"wordfence:dab0ddfb-6e30-4bde-95fb-90570579ff04","source":"wordfence","cve":"CVE-2006-0985","title":"WordPress Core <= 2.0.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab0ddfb-6e30-4bde-95fb-90570579ff04?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2006-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dab150ce-71b3-49ec-b3bf-ebff74d7b542","source":"wordfence","cve":"CVE-2024-51677","title":"Knowledge Base <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab150ce-71b3-49ec-b3bf-ebff74d7b542?source=api-prod","affected":[{"type":"plugin","slug":"knowledgebase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:52:35Z"},{"id":"wordfence:dab1c93d-e83c-4d38-be80-56d8e32f1894","source":"wordfence","cve":"CVE-2026-9021","title":"Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1c93d-e83c-4d38-be80-56d8e32f1894?source=api-prod","affected":[{"type":"plugin","slug":"easy-invoice","name":"Easy Invoice \u2013 Invoice Generator, PDF Quotes & Payments","from":"*","from_inclusive":true,"to":"2.2.19","to_inclusive":true,"patched_in":"2.2.20"}],"published":"2026-07-08T20:50:02Z","updated":"2026-07-09T09:31:23Z"},{"id":"wordfence:dab1dbc7-f188-4c04-9c8b-465ec0a42548","source":"wordfence","cve":"CVE-2025-6053","title":"Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1dbc7-f188-4c04-9c8b-465ec0a42548?source=api-prod","affected":[{"type":"plugin","slug":"zuppler-online-ordering","name":"Zuppler Online Ordering","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:22:56Z","updated":"2025-07-18T04:23:03Z"},{"id":"wordfence:dab1e675-99ae-43d5-bab6-954f7b9467cb","source":"wordfence","cve":"CVE-2026-84763","title":"RTMKit <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1e675-99ae-43d5-bab6-954f7b9467cb?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:33:41Z"},{"id":"wordfence:dab3786b-1f8e-428c-afee-afd3e43f40ba","source":"wordfence","cve":"CVE-2021-24901","title":"Security Audit <= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab3786b-1f8e-428c-afee-afd3e43f40ba?source=api-prod","affected":[{"type":"plugin","slug":"titan-labs-security-audit","name":"Security Audit","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dab587c3-54f3-4619-8de0-8740d6451f96","source":"wordfence","cve":"CVE-2024-11231","title":"\uc6b0\ucee4\uba38\uc2a4 \ub124\uc774\ubc84\ud398\uc774 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab587c3-54f3-4619-8de0-8740d6451f96?source=api-prod","affected":[{"type":"plugin","slug":"mshop-npay","name":"\uc6b0\ucee4\uba38\uc2a4 \ub124\uc774\ubc84\ud398\uc774","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2024-11-22T23:17:26Z","updated":"2024-11-23T11:23:17Z"},{"id":"wordfence:dab7e451-f2ea-4f41-8e38-a2a983ccb18b","source":"wordfence","cve":"CVE-2020-25213","title":"File Manager <= 6.8 - Arbitrary File Upload/Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dab7e451-f2ea-4f41-8e38-a2a983ccb18b?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.9"}],"published":"2020-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dabc2ae0-6005-4287-b1b0-385bc6d5c467","source":"wordfence","cve":"CVE-2023-2869","title":"WP-Members Membership <= 3.4.7.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dabc2ae0-6005-4287-b1b0-385bc6d5c467?source=api-prod","affected":[{"type":"plugin","slug":"wp-members","name":"WP-Members Membership Plugin","from":"*","from_inclusive":true,"to":"3.4.7.3","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dabcc606-04ab-4fb0-bf3c-d3ad915b8904","source":"wordfence","cve":"CVE-2026-1098","title":"CM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dabcc606-04ab-4fb0-bf3c-d3ad915b8904?source=api-prod","affected":[{"type":"plugin","slug":"cm-css-columns","name":"CM CSS Columns","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:27:36Z","updated":"2026-01-24T08:26:36Z"},{"id":"wordfence:dabd12b9-c07d-4a5d-bec3-905b90ff0dbf","source":"wordfence","cve":"CVE-2022-4447","title":"Fontsy <= 1.8.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dabd12b9-c07d-4a5d-bec3-905b90ff0dbf?source=api-prod","affected":[{"type":"plugin","slug":"fontsy","name":"Fontsy","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dabe0313-e349-4c87-894b-2612db28dcec","source":"wordfence","cve":"CVE-2026-1397","title":"PQ Addons \u2013 Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dabe0313-e349-4c87-894b-2612db28dcec?source=api-prod","affected":[{"type":"plugin","slug":"peacefulqode-elementzplus-widgets","name":"PQ Addons \u2013 Creative Elementor Widgets","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:19:34Z","updated":"2026-03-21T03:27:10Z"},{"id":"wordfence:dac1e554-2069-4588-a570-5dacc83e4532","source":"wordfence","cve":"CVE-2024-53718","title":"Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac1e554-2069-4588-a570-5dacc83e4532?source=api-prod","affected":[{"type":"plugin","slug":"multi-feed-reader","name":"Multi Feed Reader","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:22:16Z"},{"id":"wordfence:dac2a6f0-54c1-4999-ba6a-e574ab23609a","source":"wordfence","cve":"CVE-2025-58932","title":"Prisma <= 1.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac2a6f0-54c1-4999-ba6a-e574ab23609a?source=api-prod","affected":[{"type":"theme","slug":"prisma","name":"Prisma - Digital Startup & App WordPress Theme + AI","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:33:21Z"},{"id":"wordfence:dac38b2e-4d38-4b16-b6a1-ed3c0561e7c2","source":"wordfence","cve":"","title":"WPtouch < 1.9.30 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac38b2e-4d38-4b16-b6a1-ed3c0561e7c2?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"1.9.30","to_inclusive":false,"patched_in":"1.9.30"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dac658b5-4253-4095-9fda-4d3cdc7f7e2e","source":"wordfence","cve":"CVE-2011-5308","title":"CDN Vote < 0.4.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac658b5-4253-4095-9fda-4d3cdc7f7e2e?source=api-prod","affected":[{"type":"plugin","slug":"cdnvote","name":"CDN Vote","from":"*","from_inclusive":true,"to":"0.4.2","to_inclusive":false,"patched_in":"0.4.2"}],"published":"2011-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dac94b37-ba4f-43c3-88b3-066401acada2","source":"wordfence","cve":"CVE-2025-39505","title":"Goodlayers Hotel <= 3.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac94b37-ba4f-43c3-88b3-066401acada2?source=api-prod","affected":[{"type":"plugin","slug":"gdlr-hotel","name":"Goodlayers Hotel","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:39:55Z"},{"id":"wordfence:dac9e21b-b229-4e19-90cd-2748862047cf","source":"wordfence","cve":"CVE-2024-37565","title":"Gum Elementor Addon <= 1.3.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dac9e21b-b229-4e19-90cd-2748862047cf?source=api-prod","affected":[{"type":"plugin","slug":"gum-elementor-addon","name":"Gum Addon for Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-07-09T00:00:00Z","updated":"2024-09-03T16:39:12Z"},{"id":"wordfence:dacb417d-6743-4a1a-afc5-d602a242ad0e","source":"wordfence","cve":"CVE-2026-119714","title":"My Calendar \u2013 Accessible Event Manager  3.8.8 - 3.8.11 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dacb417d-6743-4a1a-afc5-d602a242ad0e?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"3.8.8","from_inclusive":true,"to":"3.8.11","to_inclusive":false,"patched_in":"3.8.11"}],"published":"2026-10-30T00:00:00Z","updated":"2026-11-04T21:53:11Z"},{"id":"wordfence:dacb98f0-3742-4f81-a4fb-5a2d6c14e382","source":"wordfence","cve":"CVE-2026-107694","title":"Dokan <= 5.1.0 - Authenticated (Vendor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dacb98f0-3742-4f81-a4fb-5a2d6c14e382?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:40:32Z"},{"id":"wordfence:dacbf63f-a68d-405e-ae98-a6800b0880c7","source":"wordfence","cve":"CVE-2026-39697","title":"MAIO \u2013 The new AI GEO / SEO tool <= 7.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dacbf63f-a68d-405e-ae98-a6800b0880c7?source=api-prod","affected":[{"type":"plugin","slug":"maio-the-new-ai-geo-seo-tool","name":"MAIO \u2013 ChatGPT SEO Tracking & AI Search Optimization","from":"*","from_inclusive":true,"to":"7.0.11","to_inclusive":true,"patched_in":"7.0.13"}],"published":"2026-02-27T00:00:00Z","updated":"2026-08-14T15:17:34Z"},{"id":"wordfence:dacfba3e-c1d7-475c-885b-f77b77a65f91","source":"wordfence","cve":"","title":"Keyword Rank Tracker <= 1.0.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dacfba3e-c1d7-475c-885b-f77b77a65f91?source=api-prod","affected":[{"type":"plugin","slug":"serp-rank","name":"Keyword Rank Tracker","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dad12b10-2e04-4bc2-b5ad-c00cb287e456","source":"wordfence","cve":"CVE-2015-10120","title":"WDS Multisite Aggregate <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad12b10-2e04-4bc2-b5ad-c00cb287e456?source=api-prod","affected":[{"type":"plugin","slug":"wds-multisite-aggregate","name":"WDS Multisite Aggregate","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dad27b29-d106-44f2-9b88-6cce0c0cf4a5","source":"wordfence","cve":"CVE-2022-3416","title":"WPtouch <= 4.3.44 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad27b29-d106-44f2-9b88-6cce0c0cf4a5?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"4.3.44","to_inclusive":true,"patched_in":"4.3.45"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dad288b3-e599-460d-9b99-3bce04489557","source":"wordfence","cve":"CVE-2022-38139","title":"RD Station <= 5.2.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad288b3-e599-460d-9b99-3bce04489557?source=api-prod","affected":[{"type":"plugin","slug":"integracao-rd-station","name":"RD Station","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2022-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dad7078d-16bf-4ca9-9a59-7b8374a1b49e","source":"wordfence","cve":"CVE-2017-17869","title":"mgl-instagram-gallery Plugin (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad7078d-16bf-4ca9-9a59-7b8374a1b49e?source=api-prod","affected":[{"type":"plugin","slug":"mgl-instagram-gallery","name":"mgl-instagram-gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dad7ef01-cc14-423d-93a7-11fc0537473b","source":"wordfence","cve":"CVE-2024-50519","title":"Jigoshop \u2013 Store Exporter <= 1.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad7ef01-cc14-423d-93a7-11fc0537473b?source=api-prod","affected":[{"type":"plugin","slug":"jigoshop-exporter","name":"Jigoshop \u2013 Store Exporter","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T19:49:49Z"},{"id":"wordfence:dad9b612-5575-4e64-a1b3-52a2cf3f05a7","source":"wordfence","cve":"CVE-2023-27426","title":"NotifyVisitors <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dad9b612-5575-4e64-a1b3-52a2cf3f05a7?source=api-prod","affected":[{"type":"plugin","slug":"notifyvisitors-lead-form","name":"Free WordPress Lead Generation Opt in, Free Popups, Generated Lead Email Popup, Exit-Intent Popup \u2013 NotifyVisitors","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dadb6bf5-dbbd-4afb-8783-f6880dec2cbf","source":"wordfence","cve":"CVE-2023-27436","title":"Elegant Custom Fonts <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dadb6bf5-dbbd-4afb-8783-f6880dec2cbf?source=api-prod","affected":[{"type":"plugin","slug":"elegant-custom-fonts","name":"Elegant Custom Fonts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daddfbd2-cff4-4caa-bbdc-9945a635a1d6","source":"wordfence","cve":"CVE-2026-8608","title":"Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daddfbd2-cff4-4caa-bbdc-9945a635a1d6?source=api-prod","affected":[{"type":"plugin","slug":"event-monster","name":"Event Monster \u2013 Event Manager, Event Booking, Event Ticket & Registration","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-05T23:28:27Z"},{"id":"wordfence:daded527-bf03-42d0-8e7a-f9eed492a609","source":"wordfence","cve":"CVE-2026-32507","title":"Leroux - Business Consulting WordPress Theme < 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daded527-bf03-42d0-8e7a-f9eed492a609?source=api-prod","affected":[{"type":"theme","slug":"leroux","name":"Leroux - Business Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:53:38Z"},{"id":"wordfence:dadfa92b-c674-4523-89b9-e8817e521c17","source":"wordfence","cve":"CVE-2026-42775","title":"AutomatorWP \u2013 Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dadfa92b-c674-4523-89b9-e8817e521c17?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:31:52Z"},{"id":"wordfence:dadfc9c5-79cb-4e43-bf27-8a7f059190e3","source":"wordfence","cve":"CVE-2019-17384","title":"Animate It <= 2.3.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dadfc9c5-79cb-4e43-bf27-8a7f059190e3?source=api-prod","affected":[{"type":"plugin","slug":"animate-it","name":"Animate It!","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dae01acf-3b32-46bb-9c79-bfe9abb714dd","source":"wordfence","cve":"CVE-2025-48362","title":"Hesabfa Accounting <= 2.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dae01acf-3b32-46bb-9c79-bfe9abb714dd?source=api-prod","affected":[{"type":"plugin","slug":"hesabfa-accounting","name":"Hesabfa Accounting","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:35:07Z"},{"id":"wordfence:dae2d028-6976-468a-9e93-ec712887d657","source":"wordfence","cve":"","title":"LionScripts: IP Blocker Lite <= 10.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dae2d028-6976-468a-9e93-ec712887d657?source=api-prod","affected":[{"type":"plugin","slug":"ip-address-blocker","name":"LionScripts: IP Blocker Lite","from":"*","from_inclusive":true,"to":"10.4","to_inclusive":true,"patched_in":"10.5"}],"published":"2019-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dae7d642-98bd-42c8-a0d1-628402e620f1","source":"wordfence","cve":"CVE-2025-22357","title":"Target Notifications <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dae7d642-98bd-42c8-a0d1-628402e620f1?source=api-prod","affected":[{"type":"plugin","slug":"target-notifications","name":"Target Notifications","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:22:47Z"},{"id":"wordfence:dae80fc2-3076-4a32-876d-5df1c62de9bd","source":"wordfence","cve":"CVE-2024-5647","title":"Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"},{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"*","from_inclusive":true,"to":"4.27.1","to_inclusive":true,"patched_in":"4.27.2"},{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.1","to_inclusive":true,"patched_in":"4.27.2"},{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.4.1"},{"type":"theme","slug":"oceanwp","name":"OceanWP","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.23"},{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.12.2","to_inclusive":true,"patched_in":"3.12.3"},{"type":"theme","slug":"extra","name":"Divi Extra","from":"*","from_inclusive":true,"to":"4.27.1","to_inclusive":true,"patched_in":"4.27.2"},{"type":"plugin","slug":"supreme-modules-for-divi","name":"Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder","from":"*","from_inclusive":true,"to":"2.5.52","to_inclusive":true,"patched_in":"2.5.53"},{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"},{"type":"plugin","slug":"blossomthemes-instagram-feed","name":"BlossomThemes Social Feed","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.14","to_inclusive":true,"patched_in":"2.2.15"},{"type":"plugin","slug":"addons-for-divi","name":"Divi Torque Lite","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"},{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.0.5"}],"published":"2025-07-02T00:00:00Z","updated":"2026-08-25T19:06:26Z"},{"id":"wordfence:dae86d7c-3bbb-4872-acd7-08ff8d437b8e","source":"wordfence","cve":"CVE-2025-12069","title":"WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-global-screen-options","name":"WP Global Screen Options","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:18:07Z","updated":"2025-11-04T03:26:47Z"},{"id":"wordfence:daeb24e0-7f3f-472f-aee5-be42e374aa52","source":"wordfence","cve":"CVE-2023-39992","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daeb24e0-7f3f-472f-aee5-be42e374aa52?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daeda8d7-1bff-4258-9953-b4303f1778d0","source":"wordfence","cve":"CVE-2024-13441","title":"Bilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daeda8d7-1bff-4258-9953-b4303f1778d0?source=api-prod","affected":[{"type":"plugin","slug":"bilingual-linker","name":"Bilingual Linker","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-01-24T18:41:29Z","updated":"2025-01-30T14:27:18Z"},{"id":"wordfence:daedec14-6177-43c7-89d4-a39c13d94ca4","source":"wordfence","cve":"","title":"LMS by LifterLMS <= 4.21.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daedec14-6177-43c7-89d4-a39c13d94ca4?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"4.21.1","to_inclusive":false,"patched_in":"4.21.1"}],"published":"2021-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:daf4d246-85f3-48b3-985f-982fea4772f1","source":"wordfence","cve":"CVE-2026-1054","title":"RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daf4d246-85f3-48b3-985f-982fea4772f1?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.4","to_inclusive":true,"patched_in":"6.0.7.5"}],"published":"2026-01-27T19:10:54Z","updated":"2026-01-28T07:27:37Z"},{"id":"wordfence:daf6ae92-dd50-4592-bb61-047a7ecd3646","source":"wordfence","cve":"CVE-2024-12096","title":"Exhibit to WP Gallery <= 0.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daf6ae92-dd50-4592-bb61-047a7ecd3646?source=api-prod","affected":[{"type":"plugin","slug":"exhibit-to-wp-gallery","name":"Exhibit to WP Gallery","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T00:00:00Z","updated":"2025-01-17T14:02:18Z"},{"id":"wordfence:daf6b0d5-79a6-4b8f-924e-9e78cb2b5742","source":"wordfence","cve":"CVE-2024-7491","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daf6b0d5-79a6-4b8f-924e-9e78cb2b5742?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6.1","to_inclusive":true,"patched_in":"1.3.6.2"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T02:05:26Z"},{"id":"wordfence:daf8c172-100a-4f48-9b2d-c415c2a54bc0","source":"wordfence","cve":"CVE-2025-46236","title":"HTML Forms <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daf8c172-100a-4f48-9b2d-c415c2a54bc0?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:13:33Z"},{"id":"wordfence:daf8e0ca-abe7-4243-8921-ff5a6f88cfcf","source":"wordfence","cve":"CVE-2025-66062","title":"YouTube Lyte <= 1.7.28 - Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/daf8e0ca-abe7-4243-8921-ff5a6f88cfcf?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-lyte","name":"WP YouTube Lyte","from":"*","from_inclusive":true,"to":"1.7.28","to_inclusive":true,"patched_in":"1.7.29"}],"published":"2025-11-14T00:00:00Z","updated":"2025-11-25T15:39:08Z"},{"id":"wordfence:dafba494-070b-4f49-ab57-768cd989cf61","source":"wordfence","cve":"CVE-2025-22689","title":"Forex Calculators <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafba494-070b-4f49-ab57-768cd989cf61?source=api-prod","affected":[{"type":"plugin","slug":"fx-calculators","name":"Forex Calculators","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-24T15:55:33Z"},{"id":"wordfence:dafbabe0-7f25-41e0-9d7a-919a11cc2c70","source":"wordfence","cve":"CVE-2026-24584","title":"Tutor LMS BunnyNet Integration <= 1.0.0 - Authenticated (Tutor instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafbabe0-7f25-41e0-9d7a-919a11cc2c70?source=api-prod","affected":[{"type":"plugin","slug":"tutor-lms-bunnynet-integration","name":"Tutor LMS BunnyNet Integration","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-01-19T00:00:00Z","updated":"2026-03-17T21:31:58Z"},{"id":"wordfence:dafbd32c-ef66-4c1c-aa6b-68443e12eacb","source":"wordfence","cve":"CVE-2025-23432","title":"AlT Report <= 1.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafbd32c-ef66-4c1c-aa6b-68443e12eacb?source=api-prod","affected":[{"type":"plugin","slug":"alt-report","name":"AlT Report","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:02:07Z"},{"id":"wordfence:dafbf6e2-1160-4551-a987-5e94c9157ff2","source":"wordfence","cve":"CVE-2024-13692","title":"Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafbf6e2-1160-4551-a987-5e94c9157ff2?source=api-prod","affected":[{"type":"plugin","slug":"woo-refund-and-exchange-lite","name":"Return Refund and Exchange For WooCommerce","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2025-02-13T17:19:46Z","updated":"2025-02-14T05:22:47Z"},{"id":"wordfence:dafc355c-18e7-4312-bd16-8ef65ad54dad","source":"wordfence","cve":"CVE-2024-1564","title":"Schema Pro <= 2.7.15 - Authenticated (Contributor+) Custom Field Access","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafc355c-18e7-4312-bd16-8ef65ad54dad?source=api-prod","affected":[{"type":"plugin","slug":"wp-schema-pro","name":"Schema Pro","from":"*","from_inclusive":true,"to":"2.7.15","to_inclusive":true,"patched_in":"2.7.16"}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-11T08:26:56Z"},{"id":"wordfence:dafc40bf-833a-4d42-b9bc-c7cf2b234ef5","source":"wordfence","cve":"CVE-2024-13444","title":"wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafc40bf-833a-4d42-b9bc-c7cf2b234ef5?source=api-prod","affected":[{"type":"plugin","slug":"wp-greet","name":"wp-greet","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2025-01-20T21:24:01Z","updated":"2025-01-21T11:09:48Z"},{"id":"wordfence:dafd1821-1f37-4193-b4bf-19a3d2d15946","source":"wordfence","cve":"CVE-2016-10979","title":"Tag Miner (Automatic Tag Extraction) < 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dafd1821-1f37-4193-b4bf-19a3d2d15946?source=api-prod","affected":[{"type":"plugin","slug":"fossura-tag-miner","name":"Tag Miner (Automatic Tag Extraction)","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2015-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db01bc0a-4508-4fb5-941d-3f1a52528e2b","source":"wordfence","cve":"CVE-2025-4420","title":"Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db01bc0a-4508-4fb5-941d-3f1a52528e2b?source=api-prod","affected":[{"type":"plugin","slug":"vayu-blocks","name":"Vayu Blocks \u2013 Website Builder for the Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-06-02T20:13:10Z","updated":"2025-06-03T08:21:56Z"},{"id":"wordfence:db0222e2-5a50-43f4-8620-12b97c712dec","source":"wordfence","cve":"CVE-2026-4852","title":"Image Source Control Lite \u2013 Show Image Credits and Captions <= 3.9.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'Image Source' Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0222e2-5a50-43f4-8620-12b97c712dec?source=api-prod","affected":[{"type":"plugin","slug":"image-source-control-isc","name":"Image Source Control Lite \u2013 Show Image Credits and Captions","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2026-04-20T07:57:34Z","updated":"2026-04-20T20:26:53Z"},{"id":"wordfence:db0456e7-7d44-442b-9e0b-3390612b55b3","source":"wordfence","cve":"CVE-2024-51839","title":"Utech Spinning Earth <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0456e7-7d44-442b-9e0b-3390612b55b3?source=api-prod","affected":[{"type":"plugin","slug":"utech-spinning-earth","name":"Utech Spinning Earth","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:20:04Z"},{"id":"wordfence:db0508dd-143f-4674-8193-d46967d2799f","source":"wordfence","cve":"","title":"Legal Pages <= 1.3.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0508dd-143f-4674-8193-d46967d2799f?source=api-prod","affected":[{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db0715ed-a06e-4a68-b9c3-408887cae113","source":"wordfence","cve":"CVE-2026-6401","title":"Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0715ed-a06e-4a68-b9c3-408887cae113?source=api-prod","affected":[{"type":"plugin","slug":"bottom-bar","name":"Bottom Bar","from":"*","from_inclusive":true,"to":"0.1.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:04:46Z","updated":"2026-05-20T01:25:55Z"},{"id":"wordfence:db089aa4-63b8-4122-8075-c81f3fcc57bd","source":"wordfence","cve":"CVE-2025-52727","title":"CSS3 Vertical Web Pricing Tables <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db089aa4-63b8-4122-8075-c81f3fcc57bd?source=api-prod","affected":[{"type":"plugin","slug":"css3_vertical_web_pricing_tables","name":"CSS3 Vertical Web Pricing Tables","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:32:44Z"},{"id":"wordfence:db0c9808-1ca9-4900-bda3-c0770349a2a9","source":"wordfence","cve":"CVE-2026-92999","title":"Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0c9808-1ca9-4900-bda3-c0770349a2a9?source=api-prod","affected":[{"type":"plugin","slug":"click-n-chat","name":"Click n Chat (Chat Widget Integration)","from":"1.0.4","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:46:22Z"},{"id":"wordfence:db0f9aeb-57e4-4966-a80c-e146cd163a6c","source":"wordfence","cve":"CVE-2025-68991","title":"BWL Pro Voting Manager <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0f9aeb-57e4-4966-a80c-e146cd163a6c?source=api-prod","affected":[{"type":"plugin","slug":"bwl-pro-voting-manager","name":"BWL Pro Voting Manager","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-22T00:00:00Z","updated":"2026-01-06T15:24:47Z"},{"id":"wordfence:db0feb49-35c3-4bb1-9ec9-2b5bdbb28189","source":"wordfence","cve":"CVE-2015-9491","title":"Blessing Premium Responsive WordPress Theme < 1.3.2.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db0feb49-35c3-4bb1-9ec9-2b5bdbb28189?source=api-prod","affected":[{"type":"theme","slug":"blessing","name":"Blessing Premium Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.2.1","to_inclusive":false,"patched_in":"1.3.2.1"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db12f986-580e-4e81-8bd2-124393e5d21b","source":"wordfence","cve":"CVE-2023-40605","title":"Typing Effect <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db12f986-580e-4e81-8bd2-124393e5d21b?source=api-prod","affected":[{"type":"plugin","slug":"animated-typing-effect","name":"Typing Effect","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db14b141-521b-464d-a638-2228b1a86c2b","source":"wordfence","cve":"CVE-2024-6170","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db14b141-521b-464d-a638-2228b1a86c2b?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.112","to_inclusive":true,"patched_in":"1.5.113"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T04:32:56Z"},{"id":"wordfence:db14e2b8-3217-4f81-a44e-e50734ef304c","source":"wordfence","cve":"CVE-2026-15344","title":"WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db14e2b8-3217-4f81-a44e-e50734ef304c?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.04.002","to_inclusive":true,"patched_in":"9.2.04.003"}],"published":"2026-07-28T13:34:05Z","updated":"2026-07-29T02:31:39Z"},{"id":"wordfence:db15295f-505f-4a0a-bb3a-3ff6daf73008","source":"wordfence","cve":"CVE-2022-46805","title":"Conditional Payments for WooCommerce <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db15295f-505f-4a0a-bb3a-3ff6daf73008?source=api-prod","affected":[{"type":"plugin","slug":"conditional-payments-for-woocommerce","name":"Conditional Payments for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db18ac07-2e7a-466d-b00c-a598401f8633","source":"wordfence","cve":"CVE-2023-5715","title":"Website Optimization \u2013 Plerdy <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db18ac07-2e7a-466d-b00c-a598401f8633?source=api-prod","affected":[{"type":"plugin","slug":"plerdy-heatmap","name":"Website Optimization \u2013 Plerdy","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db18f6b4-600d-4c63-a9f2-4e3b8ab4fba3","source":"wordfence","cve":"CVE-2025-4370","title":"Brizy <= 2.6.20 - Missing Authorization to Unauthenticated Limited File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db18f6b4-600d-4c63-a9f2-4e3b8ab4fba3?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.6.20","to_inclusive":true,"patched_in":"2.6.21"}],"published":"2025-07-28T16:22:11Z","updated":"2025-07-29T04:23:47Z"},{"id":"wordfence:db1bad2e-55df-40c5-9a3f-651858a19b42","source":"wordfence","cve":"CVE-2023-4142","title":"WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.0,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1bad2e-55df-40c5-9a3f-651858a19b42?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.9.8","to_inclusive":true,"patched_in":"7.9.9"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db1bb11d-4752-42d0-b538-2d2a4c827226","source":"wordfence","cve":"CVE-2023-48741","title":"ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1bb11d-4752-42d0-b538-2d2a4c827226?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db1c581b-5cc9-46c0-ba5d-605642697729","source":"wordfence","cve":"CVE-2024-12470","title":"School Management System \u2013 SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1c581b-5cc9-46c0-ba5d-605642697729?source=api-prod","affected":[{"type":"plugin","slug":"sakolawp-lite","name":"School Management System \u2013 SakolaWP","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:21:29Z","updated":"2025-01-07T04:22:21Z"},{"id":"wordfence:db1e7efe-3827-4a82-be08-eae4efc23399","source":"wordfence","cve":"CVE-2025-54682","title":"Connector for Gravity Forms and Google Sheets <= 1.2.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1e7efe-3827-4a82-be08-eae4efc23399?source=api-prod","affected":[{"type":"plugin","slug":"wp-gravity-forms-spreadsheets","name":"Connector for Gravity Forms and Google Sheets","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:51:06Z"},{"id":"wordfence:db1e81bf-038d-4b9c-9140-cab9b424a1c4","source":"wordfence","cve":"CVE-2026-119498","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.44.4 - Unauthenticated CAPTCHA Protection Bypass on Login","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1e81bf-038d-4b9c-9140-cab9b424a1c4?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.44.4","to_inclusive":true,"patched_in":"1.44.5"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T12:53:20Z"},{"id":"wordfence:db1f8575-aff7-43b3-83ed-8fd146914d0e","source":"wordfence","cve":"CVE-2024-13125","title":"Everest Forms \u2013 Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db1f8575-aff7-43b3-83ed-8fd146914d0e?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.8.1"}],"published":"2025-01-17T00:00:00Z","updated":"2025-02-21T19:41:23Z"},{"id":"wordfence:db24042e-c2f9-4437-8623-951b814e54b9","source":"wordfence","cve":"CVE-2026-39522","title":"Solene <= 3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db24042e-c2f9-4437-8623-951b814e54b9?source=api-prod","affected":[{"type":"theme","slug":"solene","name":"Solene - Wedding Photography WordPress Theme","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:11:46Z"},{"id":"wordfence:db251792-cbad-41e1-aaca-4cd39a25b444","source":"wordfence","cve":"CVE-2026-6897","title":"Wishlist Member <= 3.32.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db251792-cbad-41e1-aaca-4cd39a25b444?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.32.1"}],"published":"2026-05-22T16:23:28Z","updated":"2026-05-26T15:08:08Z"},{"id":"wordfence:db25e8f7-07f2-470e-850e-b8cd3388baea","source":"wordfence","cve":"CVE-2024-4214","title":"Car Dealer <= 4.15 - Authenticated (Admin+) Content Injection","severity":"low","cvss":2.7,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db25e8f7-07f2-470e-850e-b8cd3388baea?source=api-prod","affected":[{"type":"plugin","slug":"cardealer","name":"Car Dealer (Dealership) and Vehicle sales","from":"*","from_inclusive":true,"to":"4.15","to_inclusive":true,"patched_in":"4.16"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-29T13:42:04Z"},{"id":"wordfence:db27ae52-1362-4acb-9410-49ad041770f6","source":"wordfence","cve":"CVE-2026-1085","title":"True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db27ae52-1362-4acb-9410-49ad041770f6?source=api-prod","affected":[{"type":"plugin","slug":"seo-local-rank","name":"TrueRanker","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-03-06T18:49:00Z","updated":"2026-09-18T19:25:22Z"},{"id":"wordfence:db2915ca-610a-42a9-a4f8-d15729091cd6","source":"wordfence","cve":"CVE-2021-38319","title":"More From Google <= 0.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2915ca-610a-42a9-a4f8-d15729091cd6?source=api-prod","affected":[{"type":"plugin","slug":"more-from-google","name":"More from Google","from":"*","from_inclusive":true,"to":"0.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db29f17d-1d2b-4f78-a78d-1579e2a5d975","source":"wordfence","cve":"CVE-2020-36756","title":"10WebAnalytics <= 1.2.8 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db29f17d-1d2b-4f78-a78d-1579e2a5d975?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-analytics","name":"10WebAnalytics","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":false,"patched_in":"1.2.9"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db2a0b6f-5629-4ebe-8431-ebb3bc583e31","source":"wordfence","cve":"","title":"WordPress Popular Posts <= 5.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2a0b6f-5629-4ebe-8431-ebb3bc583e31?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2022-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db2a2ca9-a12c-412d-80f7-66f1dc3e09af","source":"wordfence","cve":"","title":"Newsletter <= 3.8.2 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2a2ca9-a12c-412d-80f7-66f1dc3e09af?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2015-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db2a9b18-30f9-41b4-b96b-878071db4b1c","source":"wordfence","cve":"CVE-2025-30564","title":"Custom Script Integration <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2a9b18-30f9-41b4-b96b-878071db4b1c?source=api-prod","affected":[{"type":"plugin","slug":"custom-script-integration","name":"Custom Script Integration","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:59:20Z"},{"id":"wordfence:db2a9f84-2696-42a5-961c-3c69e64a6d42","source":"wordfence","cve":"CVE-2024-43219","title":"Persian WooCommerce <= 7.1.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2a9f84-2696-42a5-961c-3c69e64a6d42?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce","name":"\u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0641\u0627\u0631\u0633\u06cc | \u0641\u0627\u0631\u0633\u06cc \u0648 \u0634\u0645\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"9.0.0"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-14T18:49:45Z"},{"id":"wordfence:db2b245f-1b9f-4605-8600-2eca8858c0d1","source":"wordfence","cve":"CVE-2025-64639","title":"Compress for MainWP <= 6.50.07 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2b245f-1b9f-4605-8600-2eca8858c0d1?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-mainwp","name":"WP Compress for MainWP","from":"*","from_inclusive":true,"to":"6.50.07","to_inclusive":true,"patched_in":""}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-19T16:52:56Z"},{"id":"wordfence:db2b8c8d-2507-4325-ab65-ca71ba8da21f","source":"wordfence","cve":"CVE-2026-54811","title":"Wp EMember < v10.9.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2b8c8d-2507-4325-ab65-ca71ba8da21f?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"v10.9.4","to_inclusive":false,"patched_in":"v10.9.4"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:01:09Z"},{"id":"wordfence:db2d5cc4-70e9-4512-8004-b6735c2c3ee1","source":"wordfence","cve":"CVE-2013-1759","title":"Responsive Logo Slideshow < 1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db2d5cc4-70e9-4512-8004-b6735c2c3ee1?source=api-prod","affected":[{"type":"plugin","slug":"responsive-logo-slideshow","name":"Responsive Logo Slideshow","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2013-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db3007a4-dc90-4f43-a251-036433641490","source":"wordfence","cve":"CVE-2026-110527","title":"User Manager 2.9 - 2.9.19 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3007a4-dc90-4f43-a251-036433641490?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"2.9","from_inclusive":true,"to":"2.9.19","to_inclusive":true,"patched_in":"2.9.20"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:36:34Z"},{"id":"wordfence:db30acd7-ce51-45d9-8ff0-6ceea8237a8c","source":"wordfence","cve":"CVE-2020-36726","title":"Ultimate Reviews < 2.1.33 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db30acd7-ce51-45d9-8ff0-6ceea8237a8c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-reviews","name":"Ultimate Reviews","from":"*","from_inclusive":true,"to":"2.1.33","to_inclusive":false,"patched_in":"2.1.33"}],"published":"2020-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db3594df-8f24-4e24-b960-b13e5bca966e","source":"wordfence","cve":"","title":"Modular <= 2.4 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3594df-8f24-4e24-b960-b13e5bca966e?source=api-prod","affected":[{"type":"theme","slug":"modular","name":"Modular","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db36bee9-c3c8-4815-9f32-1d4126c44d13","source":"wordfence","cve":"CVE-2026-114705","title":"Social Feed Gallery <= 5.0.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db36bee9-c3c8-4815-9f32-1d4126c44d13?source=api-prod","affected":[{"type":"plugin","slug":"insta-gallery","name":"Social Feed Gallery","from":"*","from_inclusive":true,"to":"5.0.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-22T09:21:15Z","updated":"2026-10-28T01:21:00Z"},{"id":"wordfence:db3724bf-35bb-4e28-b5e2-1bbc96adc7b6","source":"wordfence","cve":"CVE-2019-15823","title":"WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=confirmaction'","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3724bf-35bb-4e28-b5e2-1bbc96adc7b6?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db3a9106-2d90-44fe-a86b-9ea882f56eb4","source":"wordfence","cve":"","title":"Contextual Adminbar Color <= 0.2 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3a9106-2d90-44fe-a86b-9ea882f56eb4?source=api-prod","affected":[{"type":"plugin","slug":"contextual-adminbar-color","name":"Contextual Adminbar Color","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2020-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db3b206d-16c5-48fb-800d-d017a0c76630","source":"wordfence","cve":"","title":"Ultimate Member <= 2.1.6 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3b206d-16c5-48fb-800d-d017a0c76630?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":false,"patched_in":"2.1.7"}],"published":"2020-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db3b8394-f8c9-4630-b78e-fbfe8a3fffdb","source":"wordfence","cve":"CVE-2026-15045","title":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.7.10 - Unauthenticated Payment Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3b8394-f8c9-4630-b78e-fbfe8a3fffdb?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":false,"patched_in":"2.7.10"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T17:16:30Z"},{"id":"wordfence:db3bddbd-44b0-4105-9039-0d669d643481","source":"wordfence","cve":"CVE-2026-7797","title":"Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3bddbd-44b0-4105-9039-0d669d643481?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.8","to_inclusive":true,"patched_in":"1.6.11.9"}],"published":"2026-05-27T18:30:22Z","updated":"2026-05-28T06:45:43Z"},{"id":"wordfence:db3d9cd4-e7d8-4aab-bbaf-83473c70af40","source":"wordfence","cve":"CVE-2025-67943","title":"My auctions allegro <= 3.6.32 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db3d9cd4-e7d8-4aab-bbaf-83473c70af40?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.32","to_inclusive":true,"patched_in":"3.6.33"}],"published":"2026-01-19T00:00:00Z","updated":"2026-01-27T19:36:58Z"},{"id":"wordfence:db4616f7-e685-4dc7-947c-23c378a9bdd6","source":"wordfence","cve":"CVE-2024-34384","title":"Sina Extension for Elementor <= 3.5.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db4616f7-e685-4dc7-947c-23c378a9bdd6?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:21:59Z"},{"id":"wordfence:db484c8a-e46d-457b-b634-28d823ff2120","source":"wordfence","cve":"CVE-2021-24141","title":"Advanced Database Cleaner <= 3.0.1 - SQL injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db484c8a-e46d-457b-b634-28d823ff2120?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":false,"patched_in":"3.0.2"}],"published":"2020-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db48a271-e649-4dbe-901b-aa55eba9123b","source":"wordfence","cve":"CVE-2023-32107","title":"Photo Gallery by Ays <= 5.1.3 - Reflected Cross-Site Scripting via ays_gpg_settings_tab","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db48a271-e649-4dbe-901b-aa55eba9123b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db48d5c0-73d0-40a2-b3b1-063d739741a8","source":"wordfence","cve":"CVE-2024-56004","title":"Easy Site Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db48d5c0-73d0-40a2-b3b1-063d739741a8?source=api-prod","affected":[{"type":"plugin","slug":"easy-site-importer","name":"Easy Site Importer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:51:04Z"},{"id":"wordfence:db491dff-8301-4df8-a7b7-5024b145d038","source":"wordfence","cve":"CVE-2025-23683","title":"MACME <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db491dff-8301-4df8-a7b7-5024b145d038?source=api-prod","affected":[{"type":"plugin","slug":"macme","name":"MACME","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:58:26Z"},{"id":"wordfence:db4b6c65-f6e2-46de-81d7-a31541d0a67a","source":"wordfence","cve":"CVE-2024-1435","title":"Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db4b6c65-f6e2-46de-81d7-a31541d0a67a?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.20.6","to_inclusive":true,"patched_in":"0.20.7"}],"published":"2024-02-26T00:00:00Z","updated":"2024-03-22T15:32:36Z"},{"id":"wordfence:db4b92ba-b98f-4e9d-bd1e-75bf89d83977","source":"wordfence","cve":"CVE-2023-48766","title":"SVGator \u2013 Add Animated SVG Easily <= 1.2.4 - Cross-Site Request Forgery","severity":"high","cvss":7.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db4b92ba-b98f-4e9d-bd1e-75bf89d83977?source=api-prod","affected":[{"type":"plugin","slug":"svgator","name":"SVGator","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db4c9d47-fb54-4f8c-bb82-c72be743458f","source":"wordfence","cve":"CVE-2025-22675","title":"Alert Box Block \u2013 Display notice/alerts in the front end <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db4c9d47-fb54-4f8c-bb82-c72be743458f?source=api-prod","affected":[{"type":"plugin","slug":"alert-box-block","name":"Alert Box Block \u2013 Grab Attention with Eye-Catching Notices","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:12:45Z"},{"id":"wordfence:db4dbbbe-1edb-47a6-8d11-8a019e05dfae","source":"wordfence","cve":"CVE-2015-9496","title":"Freshmail for WordPress <= 1.5.8 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db4dbbbe-1edb-47a6-8d11-8a019e05dfae?source=api-prod","affected":[{"type":"plugin","slug":"freshmail-newsletter","name":"Freshmail for WordPress","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db502b6a-982c-413f-a160-5429a6709826","source":"wordfence","cve":"CVE-2026-108495","title":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db502b6a-982c-413f-a160-5429a6709826?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"2.12.7","to_inclusive":true,"patched_in":"2.12.8"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:47:19Z"},{"id":"wordfence:db510706-b916-49f5-8a09-bd254f1abbf6","source":"wordfence","cve":"CVE-2025-32133","title":"Secure Copy Content Protection and Content Locking <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db510706-b916-49f5-8a09-bd254f1abbf6?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-30T14:51:37Z"},{"id":"wordfence:db5247ad-dbbf-4d8e-92f5-3a673b97d080","source":"wordfence","cve":"CVE-2023-7295","title":"Video Grid <= 1.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5247ad-dbbf-4d8e-92f5-3a673b97d080?source=api-prod","affected":[{"type":"plugin","slug":"video-grid","name":"Video Grid","from":"*","from_inclusive":true,"to":"1.21","to_inclusive":true,"patched_in":"1.22"}],"published":"2023-04-18T00:00:00Z","updated":"2024-10-16T07:31:53Z"},{"id":"wordfence:db5305e6-46b9-41a9-a54b-0b8e0d56df72","source":"wordfence","cve":"CVE-2025-67921","title":"Lobo < 2.8.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5305e6-46b9-41a9-a54b-0b8e0d56df72?source=api-prod","affected":[{"type":"theme","slug":"lobo","name":"Lobo - WordPress Portfolio for Freelancers & Agencies","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":false,"patched_in":"2.8.6"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-13T17:32:29Z"},{"id":"wordfence:db565c28-84ae-4b70-a56e-e91c1a27341d","source":"wordfence","cve":"","title":"No Follow All External Links 2.1.0 - 2.3.0 - Backdoor","severity":"medium","cvss":5.3,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db565c28-84ae-4b70-a56e-e91c1a27341d?source=api-prod","affected":[{"type":"plugin","slug":"nofollow-all-external-links","name":"No Follow All External Links","from":"2.1.0","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2017-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db56844f-9988-4f6a-ba1d-f190ff009f2b","source":"wordfence","cve":"CVE-2024-1360","title":"Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db56844f-9988-4f6a-ba1d-f190ff009f2b?source=api-prod","affected":[{"type":"theme","slug":"colibri-wp","name":"Colibri WP","from":"*","from_inclusive":true,"to":"1.0.94","to_inclusive":true,"patched_in":"1.0.101"}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T11:03:46Z"},{"id":"wordfence:db5764f7-3e5e-4a0f-8280-c851ccb7dbc3","source":"wordfence","cve":"","title":"Ready! Google Maps <= 1.1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5764f7-3e5e-4a0f-8280-c851ccb7dbc3?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-ready","name":"Ready! Google Maps","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db57971b-57d8-4740-92e0-477a4368bd9b","source":"wordfence","cve":"CVE-2025-30878","title":"JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db57971b-57d8-4740-92e0-477a4368bd9b?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:22:16Z"},{"id":"wordfence:db5b5fa1-67b5-4103-93b0-682200199a71","source":"wordfence","cve":"CVE-2025-4520","title":"Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.4.0.2","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-05-09T00:00:00Z","updated":"2025-05-14T02:23:20Z"},{"id":"wordfence:db5d4a3d-3ef6-4d91-b047-df377792958d","source":"wordfence","cve":"CVE-2025-32297","title":"Simple Link Directory < 14.8.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5d4a3d-3ef6-4d91-b047-df377792958d?source=api-prod","affected":[{"type":"plugin","slug":"qc-simple-link-directory","name":"Simple Link Directory Pro","from":"*","from_inclusive":true,"to":"14.8.1","to_inclusive":false,"patched_in":"14.8.1"}],"published":"2025-06-23T00:00:00Z","updated":"2026-02-26T15:13:23Z"},{"id":"wordfence:db5d6cc9-24d7-42bf-905e-4c3764c659ed","source":"wordfence","cve":"CVE-2023-51533","title":"Ecwid Ecommerce Shopping Cart <= 6.12.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5d6cc9-24d7-42bf-905e-4c3764c659ed?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.12.4","to_inclusive":true,"patched_in":"6.12.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-02-06T16:25:07Z"},{"id":"wordfence:db5dced6-4dd4-4a9e-946b-52471fbb6251","source":"wordfence","cve":"CVE-2026-42744","title":"Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5dced6-4dd4-4a9e-946b-52471fbb6251?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-02T11:26:26Z"},{"id":"wordfence:db5e26cf-e6c7-4b79-807a-643a1effd2a0","source":"wordfence","cve":"","title":"Link Library <= 5.8.10.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db5e26cf-e6c7-4b79-807a-643a1effd2a0?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"5.8.10.6","to_inclusive":true,"patched_in":"5.8.11"}],"published":"2014-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db6167c5-fdae-490f-813c-f1a0b34aa9d8","source":"wordfence","cve":"CVE-2026-1128","title":"eCommerce <= 3.15.1 - Cross-Site Request Forgery to Coupon Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6167c5-fdae-490f-813c-f1a0b34aa9d8?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-04T14:51:13Z"},{"id":"wordfence:db631db3-bac7-4f9b-8f4e-fb82ddcb8467","source":"wordfence","cve":"CVE-2025-49069","title":"Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db631db3-bac7-4f9b-8f4e-fb82ddcb8467?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2025-06-02T00:00:00Z","updated":"2025-06-06T13:54:54Z"},{"id":"wordfence:db6616b5-4c4e-4cc7-83eb-22fac94f47f2","source":"wordfence","cve":"CVE-2023-0889","title":"Themeflection Numbers <= 1.8.1 - Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6616b5-4c4e-4cc7-83eb-22fac94f47f2?source=api-prod","affected":[{"type":"plugin","slug":"tf-numbers-number-counter-animaton","name":"Themeflection Numbers \u2013 Number Counter and Animated Numbers","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-03-27T00:00:00Z","updated":"2024-06-17T17:25:04Z"},{"id":"wordfence:db664d0a-a58d-4d8b-ae0a-074f32d8710c","source":"wordfence","cve":"CVE-2023-48284","title":"Decorator - WooCommerce Email Customizer <= 1.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db664d0a-a58d-4d8b-ae0a-074f32d8710c?source=api-prod","affected":[{"type":"plugin","slug":"decorator-woocommerce-email-customizer","name":"WebToffee eCommerce Marketing Automation \u2013 Email marketing, Popups, Email customizer","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db6995d1-8060-40cb-9e35-2baea4e39072","source":"wordfence","cve":"","title":"Floating Tweets <= 1.0.1 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6995d1-8060-40cb-9e35-2baea4e39072?source=api-prod","affected":[{"type":"plugin","slug":"floating-tweets","name":"Floating Tweets","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2012-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db6bb000-4f46-4a5a-b118-dcd3e78e4029","source":"wordfence","cve":"CVE-2023-23712","title":"User Meta Manager <= 3.4.9 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6bb000-4f46-4a5a-b118-dcd3e78e4029?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-manager","name":"User Meta Manager","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":""}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db6bec6c-77d1-4dab-9893-cf33a2fac629","source":"wordfence","cve":"CVE-2023-38513","title":"Photo Engine <= 6.2.5 - Authenticated (Author+) Insecure Direct Object Reference in ajax_generate_auth_token","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6bec6c-77d1-4dab-9893-cf33a2fac629?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.2.5","to_inclusive":true,"patched_in":"6.2.6"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db6ccadb-5e90-4234-88cc-28241846acea","source":"wordfence","cve":"CVE-2024-12167","title":"Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6ccadb-5e90-4234-88cc-28241846acea?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-shortcodes-creator","name":"Shortcodes Blocks Creator Ultimate","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T11:59:03Z","updated":"2024-12-07T01:45:52Z"},{"id":"wordfence:db6da907-4e5e-4b50-80ac-ada77c85e78e","source":"wordfence","cve":"CVE-2025-12550","title":"OchaHouse <= 2.2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6da907-4e5e-4b50-80ac-ada77c85e78e?source=api-prod","affected":[{"type":"theme","slug":"ochahouse","name":"OchaHouse - Organic Tea Store WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:37:43Z"},{"id":"wordfence:db6f08f9-4da3-450d-bf1e-5c9f0aab02a1","source":"wordfence","cve":"CVE-2026-3718","title":"ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db6f08f9-4da3-450d-bf1e-5c9f0aab02a1?source=api-prod","affected":[{"type":"plugin","slug":"worker","name":"ManageWP Worker","from":"*","from_inclusive":true,"to":"4.9.31","to_inclusive":true,"patched_in":"4.9.32"}],"published":"2026-05-13T18:06:28Z","updated":"2026-05-14T06:44:13Z"},{"id":"wordfence:db701ad3-10fd-4a40-b239-139fbc95ab61","source":"wordfence","cve":"CVE-2019-25216","title":"Rich Reviews <= 1.7.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db701ad3-10fd-4a40-b239-139fbc95ab61?source=api-prod","affected":[{"type":"plugin","slug":"rich-reviews","name":"Rich Reviews by Starfish","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2019-09-24T00:00:00Z","updated":"2024-10-16T06:43:44Z"},{"id":"wordfence:db707507-c53f-45b8-a8e1-7fea1c6f8f3c","source":"wordfence","cve":"CVE-2023-4729","title":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026 <= 4.4 - Cross-Site Request Forgery via publish_lp()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db707507-c53f-45b8-a8e1-7fea1c6f8f3c?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:56Z"},{"id":"wordfence:db70b37c-707a-47b8-a3a2-5a2b7d30de89","source":"wordfence","cve":"CVE-2024-8507","title":"File Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db70b37c-707a-47b8-a3a2-5a2b7d30de89?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.9","to_inclusive":true,"patched_in":"8.3.10"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-16T06:43:44Z"},{"id":"wordfence:db7234a1-e888-454d-8a1c-4de19c4cbec4","source":"wordfence","cve":"CVE-2015-6829","title":"WP Limit Login Attempts < 2.0.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7234a1-e888-454d-8a1c-4de19c4cbec4?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-login-attempts","name":"WP Limit Login Attempts","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2015-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db73eab3-c974-4098-b83c-4a5baf9b1ea8","source":"wordfence","cve":"CVE-2024-49641","title":"Tida URL Screenshot <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db73eab3-c974-4098-b83c-4a5baf9b1ea8?source=api-prod","affected":[{"type":"plugin","slug":"tida-url-screenshot","name":"Tida URL Screenshot","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-10-21T00:00:00Z","updated":"2025-01-06T15:32:54Z"},{"id":"wordfence:db753659-d132-4822-8d89-821ba0b7fba1","source":"wordfence","cve":"CVE-2025-58687","title":"Current Age Plugin <= 1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db753659-d132-4822-8d89-821ba0b7fba1?source=api-prod","affected":[{"type":"plugin","slug":"current-age","name":"Current Age Plugin","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-30T12:57:04Z"},{"id":"wordfence:db759c60-9ce9-407d-8d1f-cbbfd09759d5","source":"wordfence","cve":"CVE-2024-11202","title":"Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db759c60-9ce9-407d-8d1f-cbbfd09759d5?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"},{"type":"plugin","slug":"cm-video-lesson-manager","name":"CM Video Lessons Manager \u2013 Simplify video lessons management for better education","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"},{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"},{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"},{"type":"plugin","slug":"cm-header-footer-script-loader","name":"CM Header and Footer  \u2013 Add custom scripts and styles to your header and footer with ease","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"},{"type":"plugin","slug":"cm-email-blacklist","name":"CM E-Mail Blacklist \u2013 Simple email filtering for safer registration","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"},{"type":"plugin","slug":"cm-business-directory","name":"CM Business Directory \u2013 Optimise and showcase local business","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-11-25T19:30:14Z","updated":"2024-11-26T07:31:33Z"},{"id":"wordfence:db75aa9d-c21c-4cfd-be5a-11dd00a89845","source":"wordfence","cve":"CVE-2024-54324","title":"SMSify <= 6.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db75aa9d-c21c-4cfd-be5a-11dd00a89845?source=api-prod","affected":[{"type":"plugin","slug":"smsify","name":"SMSify","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":true,"patched_in":"6.1.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:20:48Z"},{"id":"wordfence:db761098-e76a-4be8-8b3d-ec964ecbc01c","source":"wordfence","cve":"","title":"BP Group Documents <= 1.2.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db761098-e76a-4be8-8b3d-ec964ecbc01c?source=api-prod","affected":[{"type":"plugin","slug":"bp-group-documents","name":"BP Group Documents","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2013-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db7903ef-f4e5-452b-b88a-a3933ced833f","source":"wordfence","cve":"CVE-2021-24529","title":"Grid Gallery \u2013 Photo Image Grid Gallery <= 1.2.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7903ef-f4e5-452b-b88a-a3933ced833f?source=api-prod","affected":[{"type":"plugin","slug":"new-grid-gallery","name":"Grid Gallery \u2013 for Photo Gallery, Image Gallery & Portfolio","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2021-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db7aaed9-2d3e-4922-ac59-80a684de6bba","source":"wordfence","cve":"CVE-2024-11843","title":"Panorama \u2013 WordPress Project Management Plugin <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7aaed9-2d3e-4922-ac59-80a684de6bba?source=api-prod","affected":[{"type":"plugin","slug":"project-panorama-lite","name":"Panorama \u2013 WordPress Project Management Plugin","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-02T00:00:00Z","updated":"2025-05-29T17:54:31Z"},{"id":"wordfence:db7c1e07-e72b-4207-8d83-4c3e129938b7","source":"wordfence","cve":"CVE-2025-53287","title":"Quick Favicon <= 0.22.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7c1e07-e72b-4207-8d83-4c3e129938b7?source=api-prod","affected":[{"type":"plugin","slug":"quick-favicon","name":"Quick Favicon","from":"*","from_inclusive":true,"to":"0.22.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:39:11Z"},{"id":"wordfence:db7f4db7-c348-4a02-a3f1-93a60a9bb23d","source":"wordfence","cve":"CVE-2025-30862","title":"reCAPTCHA for all <= 2.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7f4db7-c348-4a02-a3f1-93a60a9bb23d?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-for-all","name":"Integrator for Turnstile and reCAPTCHA.","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"2.23"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:09:00Z"},{"id":"wordfence:db7f5553-758b-47ab-8319-a549b73f4cfa","source":"wordfence","cve":"CVE-2024-12855","title":"AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db7f5553-758b-47ab-8319-a549b73f4cfa?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T08:18:17Z"},{"id":"wordfence:db805bbb-ec5b-47a9-b010-561857141933","source":"wordfence","cve":"CVE-2025-69372","title":"SevenHills <= 1.6.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db805bbb-ec5b-47a9-b010-561857141933?source=api-prod","affected":[{"type":"theme","slug":"sevenhills","name":"SevenHills - Hiking Summer Camp Children PSD Template","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T00:00:00Z","updated":"2026-02-09T21:28:06Z"},{"id":"wordfence:db811d2c-1c34-40ca-a06a-ea020f2f49a6","source":"wordfence","cve":"CVE-2026-121782","title":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization <= 1.10.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db811d2c-1c34-40ca-a06a-ea020f2f49a6?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10.3","to_inclusive":true,"patched_in":"1.10.4"}],"published":"2026-11-07T10:01:20Z","updated":"2026-11-10T19:49:55Z"},{"id":"wordfence:db836f4b-d31f-4442-89a5-1a400525c598","source":"wordfence","cve":"CVE-2024-3344","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db836f4b-d31f-4442-89a5-1a400525c598?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-11T11:03:51Z"},{"id":"wordfence:db838a3f-6afa-4686-8e6a-01edab2dcc96","source":"wordfence","cve":"CVE-2024-12294","title":"Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db838a3f-6afa-4686-8e6a-01edab2dcc96?source=api-prod","affected":[{"type":"plugin","slug":"last-viewed-posts","name":"Last Viewed Posts by WPBeginner","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-11T10:58:00Z"},{"id":"wordfence:db8437ee-d917-406d-810d-6b7cbe7976c1","source":"wordfence","cve":"CVE-2024-30423","title":"Better Elementor Addons <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db8437ee-d917-406d-810d-6b7cbe7976c1?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:15:42Z"},{"id":"wordfence:db88e128-292a-49ee-8eb7-af0f55f50957","source":"wordfence","cve":"CVE-2026-122663","title":"CURCY \u2013 Multi Currency for WooCommerce <= 2.2.20 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db88e128-292a-49ee-8eb7-af0f55f50957?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.20","to_inclusive":true,"patched_in":"2.2.21"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T16:10:12Z"},{"id":"wordfence:db89bf53-b7cb-41a2-966e-fd1fd0e0905e","source":"wordfence","cve":"CVE-2026-77792","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db89bf53-b7cb-41a2-966e-fd1fd0e0905e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.9","to_inclusive":false,"patched_in":"6.0.9.9"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:29:46Z"},{"id":"wordfence:db8bebe2-c50c-4148-b232-04bcd808745e","source":"wordfence","cve":"","title":"Shapely Companion <= 1.2.6 - Unprotected AJAX Action to Content Import","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db8bebe2-c50c-4148-b232-04bcd808745e?source=api-prod","affected":[{"type":"plugin","slug":"shapely-companion","name":"Shapely Companion","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db8c4bd1-8886-40a4-98e2-e42fc1b81fc9","source":"wordfence","cve":"CVE-2024-5281","title":"WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Affiliate Editing","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db8c4bd1-8886-40a4-98e2-e42fc1b81fc9?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-18T13:31:42Z"},{"id":"wordfence:db8cfdba-f3b2-45dc-9be7-6f6374fd5f39","source":"wordfence","cve":"CVE-2023-6598","title":"SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db8cfdba-f3b2-45dc-9be7-6f6374fd5f39?source=api-prod","affected":[{"type":"plugin","slug":"speedycache","name":"SpeedyCache \u2013 Cache, Optimization, Performance","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-12-16T00:00:00Z","updated":"2024-07-29T21:37:35Z"},{"id":"wordfence:db8d6f1d-1166-4508-b3c7-be80c723bd5d","source":"wordfence","cve":"CVE-2025-23601","title":"Tab My Content <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db8d6f1d-1166-4508-b3c7-be80c723bd5d?source=api-prod","affected":[{"type":"plugin","slug":"tab-my-content","name":"Tab My Content","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T16:34:22Z"},{"id":"wordfence:db934b29-38ed-4f95-8ad7-2d15447c5732","source":"wordfence","cve":"CVE-2024-34558","title":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db934b29-38ed-4f95-8ad7-2d15447c5732?source=api-prod","affected":[{"type":"plugin","slug":"bulk-editor","name":"WOLF \u2013 WordPress Posts Bulk Editor and Manager Professional","from":"*","from_inclusive":true,"to":"1.0.8.2","to_inclusive":true,"patched_in":"1.0.8.3"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:33:54Z"},{"id":"wordfence:db952443-2588-4da0-87d8-5bd2d3be039c","source":"wordfence","cve":"CVE-2022-46798","title":"ShopLentor <= 2.5.1 - Cross-Site Request Forgery to Post Updates","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db952443-2588-4da0-87d8-5bd2d3be039c?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db95415a-5354-498b-8368-58c47d9948de","source":"wordfence","cve":"CVE-2024-5212","title":"tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db95415a-5354-498b-8368-58c47d9948de?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-08-30T00:00:00Z","updated":"2024-08-31T04:29:20Z"},{"id":"wordfence:db959eaf-300c-4ecd-ac15-216a17ec5a50","source":"wordfence","cve":"CVE-2023-2503","title":"10Web Social Post Feed <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db959eaf-300c-4ecd-ac15-216a17ec5a50?source=api-prod","affected":[{"type":"plugin","slug":"wd-facebook-feed","name":"10Web Social Post Feed","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db96104a-fc97-4809-a1d5-5edb51a0dcdf","source":"wordfence","cve":"CVE-2025-22509","title":"Atlas <= 2.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db96104a-fc97-4809-a1d5-5edb51a0dcdf?source=api-prod","affected":[{"type":"theme","slug":"atlas","name":"atlas","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T17:29:59Z"},{"id":"wordfence:db9819c4-e000-4113-a613-7510fce923c9","source":"wordfence","cve":"CVE-2017-18571","title":"Search Everything <= 8.1.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db9819c4-e000-4113-a613-7510fce923c9?source=api-prod","affected":[{"type":"plugin","slug":"search-everything","name":"Search Everything","from":"*","from_inclusive":true,"to":"8.1.6","to_inclusive":true,"patched_in":"8.1.7"}],"published":"2017-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:db9cd10e-90c1-48b2-8760-d5fc501fb3ba","source":"wordfence","cve":"CVE-2017-20287","title":"Javo Spot < 3.0.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/db9cd10e-90c1-48b2-8760-d5fc501fb3ba?source=api-prod","affected":[{"type":"theme","slug":"javo-spot","name":"Javo Spot - Multi Purpose Directory WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2017-02-09T00:00:00Z","updated":"2026-10-28T14:53:28Z"},{"id":"wordfence:dba01dc2-c73b-461a-bcbd-86daa0bf0ad0","source":"wordfence","cve":"","title":"Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba01dc2-c73b-461a-bcbd-86daa0bf0ad0?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.11","to_inclusive":false,"patched_in":"2.9.11"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dba0a90b-f13c-4914-b6b7-278227ffc122","source":"wordfence","cve":"CVE-2023-2031","title":"Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba0a90b-f13c-4914-b6b7-278227ffc122?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.9.15"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dba3f3a6-3f55-4f4e-98e4-bb98d9c94bdd","source":"wordfence","cve":"CVE-2023-2796","title":"EventON <= 2.1 - Missing Authorization to Event Access","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba3f3a6-3f55-4f4e-98e4-bb98d9c94bdd?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dba4317d-8624-495b-9a1f-2d4a72999129","source":"wordfence","cve":"CVE-2025-50016","title":"IP Based Login <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba4317d-8624-495b-9a1f-2d4a72999129?source=api-prod","affected":[{"type":"plugin","slug":"ip-based-login","name":"IP Based Login","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2025-06-19T00:00:00Z","updated":"2025-07-21T20:41:07Z"},{"id":"wordfence:dba61faf-b7fa-4910-9101-8f2a3dac8dc9","source":"wordfence","cve":"","title":"zeList <= 0.5.11.07 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba61faf-b7fa-4910-9101-8f2a3dac8dc9?source=api-prod","affected":[{"type":"plugin","slug":"zelist-directory","name":"zeList","from":"*","from_inclusive":true,"to":"0.5.11.07","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dba7f15a-29f8-4c7b-b506-7e82c563c6a9","source":"wordfence","cve":"CVE-2021-24510","title":"MF Gig Calendar <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba7f15a-29f8-4c7b-b506-7e82c563c6a9?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2021-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dba84eb3-f48a-4175-a652-7c11b12c9afc","source":"wordfence","cve":"CVE-2024-13920","title":"Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dba84eb3-f48a-4175-a652-7c11b12c9afc?source=api-prod","affected":[{"type":"plugin","slug":"order-import-export-for-woocommerce","name":"Order Export & Order Import for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-03-19T22:29:47Z","updated":"2025-03-20T11:11:28Z"},{"id":"wordfence:dbadc2e6-38fa-47f8-9d8b-79fb867f1003","source":"wordfence","cve":"CVE-2026-49063","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbadc2e6-38fa-47f8-9d8b-79fb867f1003?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:41:45Z"},{"id":"wordfence:dbaedb36-6710-48ab-8bb5-e6065fa8df51","source":"wordfence","cve":"CVE-2023-47816","title":"Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbaedb36-6710-48ab-8bb5-e6065fa8df51?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.7.0.14","to_inclusive":false,"patched_in":"1.7.0.14"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbb224f9-770a-43d5-8147-89b57f8bc411","source":"wordfence","cve":"CVE-2026-102382","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbb224f9-770a-43d5-8147-89b57f8bc411?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-10-01T12:30:00Z","updated":"2026-10-08T23:11:28Z"},{"id":"wordfence:dbb368e1-83f4-470b-8524-6967d8d82c14","source":"wordfence","cve":"CVE-2025-15485","title":"Auto x LINE <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbb368e1-83f4-470b-8524-6967d8d82c14?source=api-prod","affected":[{"type":"plugin","slug":"auto-x-line","name":"Auto x LINE","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-09-10T19:07:16Z"},{"id":"wordfence:dbb59e76-5256-4883-b9cf-7c336b4ff8a3","source":"wordfence","cve":"CVE-2024-30539","title":"Awesome Support <= 6.1.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbb59e76-5256-4883-b9cf-7c336b4ff8a3?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T14:59:47Z"},{"id":"wordfence:dbba79d1-177c-4a7f-9ae6-5fc9a15cd599","source":"wordfence","cve":"CVE-2025-32262","title":"RDP Wiki Embed <= 1.2.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbba79d1-177c-4a7f-9ae6-5fc9a15cd599?source=api-prod","affected":[{"type":"plugin","slug":"rdp-wiki-embed","name":"RDP Wiki Embed","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-22T21:01:33Z"},{"id":"wordfence:dbbd9eda-756b-4fa7-b7b6-d91181cc80d6","source":"wordfence","cve":"","title":"BuddyForms Members <= 1.4.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbbd9eda-756b-4fa7-b7b6-d91181cc80d6?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms-members","name":"BuddyPress & BuddyBoss Member Profile Forms","from":"*","from_inclusive":true,"to":"1.4.21","to_inclusive":true,"patched_in":"1.4.22"}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbbdf433-8589-4f5f-b73d-2dba58f684a7","source":"wordfence","cve":"CVE-2025-8779","title":"All-in-One Addons for Elementor \u2013 WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbbdf433-8589-4f5f-b73d-2dba58f684a7?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-12-12T19:03:58Z","updated":"2025-12-13T07:21:05Z"},{"id":"wordfence:dbbea6bf-b795-4837-9dc9-7cb8769ab89f","source":"wordfence","cve":"CVE-2025-1406","title":"Newpost Catch <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbbea6bf-b795-4837-9dc9-7cb8769ab89f?source=api-prod","affected":[{"type":"plugin","slug":"newpost-catch","name":"Newpost Catch","from":"*","from_inclusive":true,"to":"1.3.19","to_inclusive":true,"patched_in":"1.3.20"}],"published":"2025-02-20T15:03:22Z","updated":"2025-03-13T19:49:19Z"},{"id":"wordfence:dbc1d257-bc56-4e8f-bdb4-b2a323026625","source":"wordfence","cve":"CVE-2017-2187","title":"WP Live Chat Support <= 7.0.06 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc1d257-bc56-4e8f-bdb4-b2a323026625?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"7.0.06","to_inclusive":true,"patched_in":"7.0.07"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbc5edda-c503-4a0c-be9e-6ce17eee2c51","source":"wordfence","cve":"CVE-2016-10963","title":"Icegram <= 1.9.18 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc5edda-c503-4a0c-be9e-6ce17eee2c51?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"1.9.19","to_inclusive":false,"patched_in":"1.9.19"}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbc60daa-c093-4cd6-8f07-d9015e2bd957","source":"wordfence","cve":"CVE-2024-45270","title":"Carousel Slider <= 2.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc60daa-c093-4cd6-8f07-d9015e2bd957?source=api-prod","affected":[{"type":"plugin","slug":"carousel-slider","name":"Carousel Slider","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-08-30T00:00:00Z","updated":"2024-09-12T14:32:47Z"},{"id":"wordfence:dbc6ad3f-698e-4dfd-bbba-086f94831bba","source":"wordfence","cve":"CVE-2024-8722","title":"WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc6ad3f-698e-4dfd-bbba-086f94831bba?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.9.7","to_inclusive":true,"patched_in":"4.9.8"}],"published":"2025-01-18T15:42:34Z","updated":"2025-02-05T20:46:46Z"},{"id":"wordfence:dbc98f55-a8f9-4234-84aa-df38302bf0b8","source":"wordfence","cve":"","title":"WooCommerce Subscriptions <= 3.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc98f55-a8f9-4234-84aa-df38302bf0b8?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-subscriptions","name":"WooCommerce Subscription","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"}],"published":"2020-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbca4df8-d5d6-40b5-b897-e249a5a3bb00","source":"wordfence","cve":"CVE-2025-46543","title":"Enhanced Paypal Shortcodes <= 0.5a - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbca4df8-d5d6-40b5-b897-e249a5a3bb00?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-paypal-shortcodes","name":"Enhanced Paypal Shortcodes","from":"*","from_inclusive":true,"to":"0.5a","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:02:49Z"},{"id":"wordfence:dbcd3ddd-a729-4183-a6c0-f50390b31332","source":"wordfence","cve":"CVE-2025-31377","title":"Woo Product Feed For Marketing Channels <= 1.9.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbcd3ddd-a729-4183-a6c0-f50390b31332?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-to-google-merchant-center","name":"Woo Product Feed For Marketing Channels","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:12:23Z"},{"id":"wordfence:dbcdeda4-85b7-48d6-b89d-1d1756d183d2","source":"wordfence","cve":"CVE-2013-0237","title":"WordPress Core < 3.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbcdeda4-85b7-48d6-b89d-1d1756d183d2?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbce48b2-aa7c-4c92-8df8-ee3a17336e97","source":"wordfence","cve":"CVE-2023-40005","title":"Easy Digital Downloads <= 3.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbce48b2-aa7c-4c92-8df8-ee3a17336e97?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbcef623-7558-4955-844b-dcb1a4dd8aeb","source":"wordfence","cve":"CVE-2026-101161","title":"Ultimate Review <= 2.4.3 - Unauthenticated Persistent Page Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbcef623-7558-4955-844b-dcb1a4dd8aeb?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:49:33Z"},{"id":"wordfence:dbd04f54-689c-4289-bffd-8126c72c1ef1","source":"wordfence","cve":"CVE-2026-105057","title":"Zero Spam for WordPress <= 5.7.11 - Unauthenticated Spam Protection Bypass on Login","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd04f54-689c-4289-bffd-8126c72c1ef1?source=api-prod","affected":[{"type":"plugin","slug":"zero-spam","name":"Zero Spam for WordPress","from":"*","from_inclusive":true,"to":"5.7.11","to_inclusive":true,"patched_in":"5.7.12"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T12:57:12Z"},{"id":"wordfence:dbd33d03-81ba-468e-9e25-fe9f13914dbd","source":"wordfence","cve":"CVE-2025-11817","title":"Simple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=api-prod","affected":[{"type":"plugin","slug":"simple-tableau-viz","name":"Simple Tableau Viz","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:24:23Z","updated":"2025-10-22T08:27:10Z"},{"id":"wordfence:dbd4851b-6f3d-4abe-8c20-f30558cf22a3","source":"wordfence","cve":"CVE-2026-120849","title":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce <= 3.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd4851b-6f3d-4abe-8c20-f30558cf22a3?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2026-11-07T08:52:00Z","updated":"2026-11-10T19:40:22Z"},{"id":"wordfence:dbd4a482-7176-446f-804d-e0cd0764a2cb","source":"wordfence","cve":"CVE-2016-10923","title":"Store Toolkit for WooCommerce <= 1.5.7 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd4a482-7176-446f-804d-e0cd0764a2cb?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-store-toolkit","name":"Store Toolkit \u2013  WooCommerce Extensions, Quick Enhancements & Handy Tools","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2016-02-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbd76c3d-028a-48e3-9a80-1a8da934d097","source":"wordfence","cve":"CVE-2022-29446","title":"Counter Box <= 1.1.1 - Authenticated Local File Inclusion","severity":"medium","cvss":6.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd76c3d-028a-48e3-9a80-1a8da934d097?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2022-05-16T13:55:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbd838b6-7792-4378-8969-a70c6e16ff6a","source":"wordfence","cve":"CVE-2025-1402","title":"Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd838b6-7792-4378-8969-a70c6e16ff6a?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.19.1.1","to_inclusive":true,"patched_in":"5.19.1.2"}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-21T11:09:35Z"},{"id":"wordfence:dbd8b506-4c48-4c94-859a-a496bad83287","source":"wordfence","cve":"CVE-2025-49890","title":"AWStats Script <= 0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd8b506-4c48-4c94-859a-a496bad83287?source=api-prod","affected":[{"type":"plugin","slug":"awstats-script","name":"AWStats Script","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-08-25T17:22:03Z"},{"id":"wordfence:dbda16f5-65c2-47cf-8b06-6aa231b8fd11","source":"wordfence","cve":"","title":"Alphabetic Pagination <= 3.0.7 - Missing Authorization to Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbda16f5-65c2-47cf-8b06-6aa231b8fd11?source=api-prod","affected":[{"type":"plugin","slug":"alphabetic-pagination","name":"Alphabetic Pagination","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":"3.0.8"}],"published":"2022-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbdb8fad-93de-40c5-8e1e-6e8885bc8025","source":"wordfence","cve":"CVE-2025-23639","title":"MDC YouTube Downloader <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbdb8fad-93de-40c5-8e1e-6e8885bc8025?source=api-prod","affected":[{"type":"plugin","slug":"mdc-youtube-downloader","name":"MDC YouTube Downloader","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:24:26Z"},{"id":"wordfence:dbddf8a5-57fe-4c70-b564-75e62b96462d","source":"wordfence","cve":"CVE-2025-23917","title":"Chamber Dashboard Business Directory <= 3.3.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbddf8a5-57fe-4c70-b564-75e62b96462d?source=api-prod","affected":[{"type":"plugin","slug":"chamber-dashboard-business-directory","name":"Chamber Dashboard Business Directory","from":"*","from_inclusive":true,"to":"3.3.10","to_inclusive":true,"patched_in":"3.3.11"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:10:25Z"},{"id":"wordfence:dbe0cc57-a17d-4f91-887f-fe819b32f6b3","source":"wordfence","cve":"CVE-2024-2848","title":"Responsive <= 5.0.2 - Missing Authorization to HTML Injection","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe0cc57-a17d-4f91-887f-fe819b32f6b3?source=api-prod","affected":[{"type":"theme","slug":"responsive","name":"Responsive","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-29T08:46:15Z"},{"id":"wordfence:dbe53b09-84c6-4fb6-9a79-1e4987678129","source":"wordfence","cve":"CVE-2024-5645","title":"Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe53b09-84c6-4fb6-9a79-1e4987678129?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.8.23","to_inclusive":true,"patched_in":"1.8.25"}],"published":"2024-06-06T20:49:46Z","updated":"2024-06-07T09:33:36Z"},{"id":"wordfence:dbe5def5-3413-4697-9f0f-3bd33c5897af","source":"wordfence","cve":"CVE-2025-24599","title":"Newsletters <= 4.9.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe5def5-3413-4697-9f0f-3bd33c5897af?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.9.6","to_inclusive":true,"patched_in":"4.9.9.7"}],"published":"2024-12-26T00:00:00Z","updated":"2025-02-26T20:25:59Z"},{"id":"wordfence:dbe8d164-85c7-444d-80ad-4d03151b939b","source":"wordfence","cve":"CVE-2023-28414","title":"ApexChat <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe8d164-85c7-444d-80ad-4d03151b939b?source=api-prod","affected":[{"type":"plugin","slug":"apexchat","name":"Blazeo","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbe8d453-21f0-43e2-84d3-3c520ab9c308","source":"wordfence","cve":"CVE-2024-5331","title":"Breakdance <= 1.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe8d453-21f0-43e2-84d3-3c520ab9c308?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-07-31T17:55:25Z","updated":"2026-05-15T13:16:45Z"},{"id":"wordfence:dbe8e2f6-0288-4f31-b249-ef78a2036c2f","source":"wordfence","cve":"CVE-2026-66588","title":"The7 \u2014 Website and eCommerce Builder for WordPress <= 14.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe8e2f6-0288-4f31-b249-ef78a2036c2f?source=api-prod","affected":[{"type":"theme","slug":"dt-the7","name":"The7 \u2014 Website and eCommerce Builder for WordPress","from":"*","from_inclusive":true,"to":"14.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T16:25:07Z","updated":"2026-10-08T23:53:37Z"},{"id":"wordfence:dbea3356-2fc1-4511-9767-e560b7c4f0a8","source":"wordfence","cve":"CVE-2026-104738","title":"Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbea3356-2fc1-4511-9767-e560b7c4f0a8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-form-integration","name":"Advanced Form Integration \u2014 Connect Forms to 300+ Apps","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2026-11-06T20:03:55Z","updated":"2026-11-07T08:25:31Z"},{"id":"wordfence:dbebafeb-b7d5-4f5f-8ae3-3444bf5d1361","source":"wordfence","cve":"CVE-2026-107120","title":"Contest Gallery <= 33.0.0 - Unauthenticated Unauthorized Account Activation","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbebafeb-b7d5-4f5f-8ae3-3444bf5d1361?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"33.0.0","to_inclusive":true,"patched_in":"33.0.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:37:35Z"},{"id":"wordfence:dbee312d-a7a1-4a75-9847-a9c6a108e149","source":"wordfence","cve":"CVE-2024-54368","title":"GitSync <= 1.1.0 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbee312d-a7a1-4a75-9847-a9c6a108e149?source=api-prod","affected":[{"type":"plugin","slug":"git-sync","name":"GitSync","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:10:24Z"},{"id":"wordfence:dbf0f614-e5e9-486c-a0dd-cd494708a2a8","source":"wordfence","cve":"CVE-2023-26522","title":"WP Repost <= 0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf0f614-e5e9-486c-a0dd-cd494708a2a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-repost","name":"WP Repost","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbf13a06-0e2e-441a-9732-31c7e8997aeb","source":"wordfence","cve":"CVE-2026-74017","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf13a06-0e2e-441a-9732-31c7e8997aeb?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-09-16T18:13:00Z","updated":"2026-09-22T18:49:25Z"},{"id":"wordfence:dbf196d0-a778-483b-9475-0c2333f2284e","source":"wordfence","cve":"CVE-2025-26773","title":"Analytify <= 5.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf196d0-a778-483b-9475-0c2333f2284e?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T20:56:23Z"},{"id":"wordfence:dbf2b1a9-c248-4b77-a90d-4d3b5cfc447c","source":"wordfence","cve":"CVE-2026-14592","title":"WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf2b1a9-c248-4b77-a90d-4d3b5cfc447c?source=api-prod","affected":[{"type":"plugin","slug":"wp-real-ip-based-access-control","name":"WP Real IP-based Access Control","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:03:51Z"},{"id":"wordfence:dbf32808-b5d7-4f12-ada5-0578e0bef321","source":"wordfence","cve":"CVE-2021-36850","title":"Media File Renamer \u2013 Auto & Manual Rename <= 5.2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf32808-b5d7-4f12-ada5-0578e0bef321?source=api-prod","affected":[{"type":"plugin","slug":"media-file-renamer","name":"Media File Renamer: Rename Images & Files for SEO (AI-Powered)","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2021-04-08T23:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbf3c717-6016-47b3-9e77-0f7781bdd301","source":"wordfence","cve":"CVE-2026-114710","title":"Gallery PhotoBlocks <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf3c717-6016-47b3-9e77-0f7781bdd301?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2026-10-26T16:43:00Z","updated":"2026-10-28T01:21:45Z"},{"id":"wordfence:dbf491d6-e546-4e3f-88c2-237b647a2b1e","source":"wordfence","cve":"CVE-2024-5867","title":"Delicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf491d6-e546-4e3f-88c2-237b647a2b1e?source=api-prod","affected":[{"type":"theme","slug":"delicate","name":"Delicate","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:31:41Z","updated":"2024-09-13T15:10:42Z"},{"id":"wordfence:dbf54852-f3fe-4c9e-9348-44a73f9a8131","source":"wordfence","cve":"","title":"WooCommerce Parcel Pro <= 1.6.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf54852-f3fe-4c9e-9348-44a73f9a8131?source=api-prod","affected":[{"type":"plugin","slug":"woo-parcel-pro","name":"Parcel Pro","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.6.12"}],"published":"2023-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbf7e7b0-dff7-406c-91a3-4ceddfeda21f","source":"wordfence","cve":"CVE-2024-52423","title":"Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf7e7b0-dff7-406c-91a3-4ceddfeda21f?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.5","to_inclusive":true,"patched_in":"7.6.6"}],"published":"2024-11-13T00:00:00Z","updated":"2024-12-12T14:38:04Z"},{"id":"wordfence:dbf890b8-9e02-41b7-99e4-a0fe7b815510","source":"wordfence","cve":"CVE-2026-97352","title":"News Kit Addons For Elementor <= 1.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf890b8-9e02-41b7-99e4-a0fe7b815510?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T01:28:49Z"},{"id":"wordfence:dbf8c216-aedd-4db9-aaa4-61bc0d7850cb","source":"wordfence","cve":"CVE-2024-10689","title":"XLTab \u2013 Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf8c216-aedd-4db9-aaa4-61bc0d7850cb?source=api-prod","affected":[{"type":"plugin","slug":"xl-tab","name":"XLTab \u2013 Accordions and Tabs for Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T08:25:00Z"},{"id":"wordfence:dbfa20ad-6411-4054-9973-cb12d17c57f6","source":"wordfence","cve":"CVE-2024-13806","title":"Authors List <= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfa20ad-6411-4054-9973-cb12d17c57f6?source=api-prod","affected":[{"type":"plugin","slug":"authors-list","name":"Authors List","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.6.1"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:06Z"},{"id":"wordfence:dbfb3895-6826-4c2d-9959-b3a9d3f175f5","source":"wordfence","cve":"CVE-2025-30525","title":"WP Profitshare <= 1.4.9 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfb3895-6826-4c2d-9959-b3a9d3f175f5?source=api-prod","affected":[{"type":"plugin","slug":"wp-profitshare","name":"WP Profitshare","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:54:00Z"},{"id":"wordfence:dbfc52a4-6c9d-480b-9247-1513318ff84b","source":"wordfence","cve":"CVE-2023-40609","title":"Contact form 7 Custom validation <= 1.1.3 - Unauthenticated SQL Injection via 'post'","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfc52a4-6c9d-480b-9247-1513318ff84b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-field-validation","name":"Contact form 7 Custom validation","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dbfe3f7d-d653-421b-a054-a4ab266866c3","source":"wordfence","cve":"CVE-2024-33585","title":"Payment Gateway Based Fees and Discounts for WooCommerce <= 2.12.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfe3f7d-d653-421b-a054-a4ab266866c3?source=api-prod","affected":[{"type":"plugin","slug":"checkout-fees-for-woocommerce","name":"Payment Gateway Based Fees and Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:13:21Z"},{"id":"wordfence:dc01108f-e781-484b-997a-c1d4e218a3f4","source":"wordfence","cve":"CVE-2023-0723","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc01108f-e781-484b-997a-c1d4e218a3f4?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc023c1b-7ec6-45b6-b50a-f0d823065843","source":"wordfence","cve":"CVE-2024-1311","title":"Brizy \u2013 Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc023c1b-7ec6-45b6-b50a-f0d823065843?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.40","to_inclusive":true,"patched_in":"2.4.41"}],"published":"2024-02-23T00:00:00Z","updated":"2024-11-07T14:03:47Z"},{"id":"wordfence:dc024183-0244-4ef9-9171-057ecd1c3e1d","source":"wordfence","cve":"CVE-2023-7073","title":"Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc024183-0244-4ef9-9171-057ecd1c3e1d?source=api-prod","affected":[{"type":"plugin","slug":"auto-post-thumbnail","name":"Auto Featured Image (Auto Post Thumbnail)","from":"*","from_inclusive":true,"to":"4.1.7","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2024-05-30T00:00:00Z","updated":"2026-01-16T13:49:58Z"},{"id":"wordfence:dc02768c-3ea1-4254-a652-342d0abdf839","source":"wordfence","cve":"CVE-2025-39466","title":"D\u00f8r <= 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc02768c-3ea1-4254-a652-342d0abdf839?source=api-prod","affected":[{"type":"theme","slug":"dor","name":"D\u00f8r - Modern Architecture and Interior Design Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:39:55Z"},{"id":"wordfence:dc036236-4d20-4926-9837-52973f632248","source":"wordfence","cve":"CVE-2025-28875","title":"BP Email Assign Templates <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc036236-4d20-4926-9837-52973f632248?source=api-prod","affected":[{"type":"plugin","slug":"bp-email-assign-templates","name":"BP Email Assign Templates","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-21T14:23:41Z"},{"id":"wordfence:dc049cab-6793-4656-9b17-8ca64c566c4c","source":"wordfence","cve":"CVE-2024-13851","title":"Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc049cab-6793-4656-9b17-8ca64c566c4c?source=api-prod","affected":[{"type":"plugin","slug":"modal-portfolio","name":"Modal Portfolio","from":"*","from_inclusive":true,"to":"1.7.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:12:28Z","updated":"2025-02-28T08:23:18Z"},{"id":"wordfence:dc052b00-65a7-4668-8bdd-b06d69d12a4a","source":"wordfence","cve":"CVE-2023-5945","title":"video carousel slider with lightbox 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc052b00-65a7-4668-8bdd-b06d69d12a4a?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-video-gallery-with-lightbox","name":"Video Gallery \u2013 YouTube, Vimeo & Video Slider with Lightbox","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc057069-15cd-477f-9106-e616e919c62f","source":"wordfence","cve":"CVE-2024-2399","title":"Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc057069-15cd-477f-9106-e616e919c62f?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.23","to_inclusive":true,"patched_in":"4.10.24"}],"published":"2024-03-14T00:00:00Z","updated":"2024-03-26T19:34:13Z"},{"id":"wordfence:dc07620e-23fe-4039-a6f5-e0b320424444","source":"wordfence","cve":"CVE-2024-3643","title":"Newsletter Popup <= 1.2 - Cross-Site Request Forgery to List Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc07620e-23fe-4039-a6f5-e0b320424444?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-popup","name":"Newsletter Popup","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-06-06T13:04:51Z"},{"id":"wordfence:dc07bcec-f822-492a-b73d-79e791907dd1","source":"wordfence","cve":"CVE-2024-25095","title":"Easy Forms for Mailchimp <= 6.8.10 - Sensitive Information Exposure via logfile","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc07bcec-f822-492a-b73d-79e791907dd1?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-mailchimp-extender","name":"Easy Forms for Mailchimp","from":"*","from_inclusive":true,"to":"6.8.10","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T20:49:25Z"},{"id":"wordfence:dc0b704d-f996-4125-9c27-753497c6e9d4","source":"wordfence","cve":"CVE-2024-13877","title":"Passbeemedia Web Push Notification <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0b704d-f996-4125-9c27-753497c6e9d4?source=api-prod","affected":[{"type":"plugin","slug":"passbeemedia-web-push-notifications","name":"Passbeemedia Web Push Notification","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:09:42Z"},{"id":"wordfence:dc0cee75-9c5d-455f-b77f-9ce643aeed19","source":"wordfence","cve":"CVE-2025-68551","title":"VPSUForm <= 3.2.24 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0cee75-9c5d-455f-b77f-9ce643aeed19?source=api-prod","affected":[{"type":"plugin","slug":"v-form","name":"VPSUForm \u2013 Drag & Drop Contact Form Builder with Email Automation","from":"*","from_inclusive":true,"to":"3.2.24","to_inclusive":true,"patched_in":"3.2.25"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-06T14:35:46Z"},{"id":"wordfence:dc0e9fab-0b8f-419d-a799-06297b24df33","source":"wordfence","cve":"CVE-2025-24693","title":"Advanced Notifications <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0e9fab-0b8f-419d-a799-06297b24df33?source=api-prod","affected":[{"type":"plugin","slug":"advanced-notifications","name":"Advanced Notifications","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:25:49Z"},{"id":"wordfence:dc0fe855-97b7-46ef-b1c8-1602447e97e6","source":"wordfence","cve":"CVE-2026-92235","title":"WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc0fe855-97b7-46ef-b1c8-1602447e97e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-22T07:41:13Z"},{"id":"wordfence:dc138cbb-2713-4b0a-8e3a-8e1a9266637f","source":"wordfence","cve":"CVE-2025-1780","title":"BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc138cbb-2713-4b0a-8e3a-8e1a9266637f?source=api-prod","affected":[{"type":"plugin","slug":"wc4bp","name":"BuddyPress Integration for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.25","to_inclusive":true,"patched_in":"3.4.26"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T03:22:20Z"},{"id":"wordfence:dc15bc48-31f6-4829-8f9b-cd2d1c7c5280","source":"wordfence","cve":"CVE-2024-32558","title":"eCommerce Product Catalog Plugin for WordPress <= 3.3.32 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc15bc48-31f6-4829-8f9b-cd2d1c7c5280?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.32","to_inclusive":true,"patched_in":"3.3.33"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-25T12:09:56Z"},{"id":"wordfence:dc1681a8-5f2e-45f1-96d9-797b13644607","source":"wordfence","cve":"CVE-2026-6400","title":"Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1681a8-5f2e-45f1-96d9-797b13644607?source=api-prod","affected":[{"type":"plugin","slug":"child-height-predictor","name":"Child Height Predictor by Ostheimer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:04:31Z","updated":"2026-05-20T01:25:55Z"},{"id":"wordfence:dc18a5c4-6e63-4ad1-a90e-8337b5a86c48","source":"wordfence","cve":"CVE-2025-49995","title":"Download Attachments <= 1.3.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc18a5c4-6e63-4ad1-a90e-8337b5a86c48?source=api-prod","affected":[{"type":"plugin","slug":"download-attachments","name":"Download Attachments","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-06-19T00:00:00Z","updated":"2025-11-17T21:22:49Z"},{"id":"wordfence:dc19228f-c7a2-4600-a7b7-ba813b8035de","source":"wordfence","cve":"CVE-2026-27367","title":"Musico < 3.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc19228f-c7a2-4600-a7b7-ba813b8035de?source=api-prod","affected":[{"type":"theme","slug":"musico","name":"Music WordPress","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"3.4.5"}],"published":"2026-02-24T00:00:00Z","updated":"2026-04-15T13:37:53Z"},{"id":"wordfence:dc19313b-f9d0-4a92-8e33-d632d8a478df","source":"wordfence","cve":"CVE-2023-26515","title":"Simple Slug Translate <= 2.7.2 - Authenticated (Administrator+) Stored Cross-Site Scritping","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc19313b-f9d0-4a92-8e33-d632d8a478df?source=api-prod","affected":[{"type":"plugin","slug":"simple-slug-translate","name":"Simple Slug Translate","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc1ae2c7-1eff-4976-8f88-f0b97a5cf323","source":"wordfence","cve":"","title":"WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1ae2c7-1eff-4976-8f88-f0b97a5cf323?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.6.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7","from_inclusive":true,"to":"6.7.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8","from_inclusive":true,"to":"6.8.8","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0","from_inclusive":true,"to":"7.0.4","to_inclusive":true,"patched_in":"6.6.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":"6.6.8"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-17T21:48:33Z"},{"id":"wordfence:dc1e5fb7-92d0-4e7f-9b1b-15673e3b852a","source":"wordfence","cve":"CVE-2023-28782","title":"Gravity Forms  <= 2.7.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1e5fb7-92d0-4e7f-9b1b-15673e3b852a?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2023-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc1ebc34-d728-42b4-92b4-9e1a4ebd88b2","source":"wordfence","cve":"CVE-2024-11869","title":"Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc1ebc34-d728-42b4-92b4-9e1a4ebd88b2?source=api-prod","affected":[{"type":"plugin","slug":"buk-appointments","name":"Buk for WordPress","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2024-12-13T16:00:05Z","updated":"2025-06-05T17:37:21Z"},{"id":"wordfence:dc20180b-4665-4ade-b512-b0f0148200e7","source":"wordfence","cve":"CVE-2025-2165","title":"SH Email Alert <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc20180b-4665-4ade-b512-b0f0148200e7?source=api-prod","affected":[{"type":"plugin","slug":"sh-email-alert","name":"SH Email Alert","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-25T14:11:01Z","updated":"2025-03-26T02:23:49Z"},{"id":"wordfence:dc221b37-565d-41e4-874c-06015753045f","source":"wordfence","cve":"CVE-2019-5970","title":"Attendance Manager <= 0.5.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc221b37-565d-41e4-874c-06015753045f?source=api-prod","affected":[{"type":"plugin","slug":"attendance-manager","name":"Attendance Manager","from":"*","from_inclusive":true,"to":"0.5.6","to_inclusive":true,"patched_in":"0.5.7"}],"published":"2019-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc2356b2-e153-4e80-bfac-c25c15cdc259","source":"wordfence","cve":"CVE-2023-37386","title":"Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery via rate_the_plugin_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc2356b2-e153-4e80-bfac-c25c15cdc259?source=api-prod","affected":[{"type":"plugin","slug":"media-library-helper","name":"Media Library Helper \u2014 Bulk edit image ALT, caption & description","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc24d2de-352c-4215-a4db-2966aa6467c7","source":"wordfence","cve":"","title":"Real3D Flipbook <= 2.8 - Directory Traversal via Uploads","severity":"medium","cvss":4.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc24d2de-352c-4215-a4db-2966aa6467c7?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook","name":"Real3D Flipbook","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":false,"patched_in":"2.9"}],"published":"2016-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc2532b4-907f-438b-baab-c3966cf30f74","source":"wordfence","cve":"","title":"Student Result or Employee Database <= 1.7.9 - Missing Authorization","severity":"high","cvss":7.2,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc2532b4-907f-438b-baab-c3966cf30f74?source=api-prod","affected":[{"type":"plugin","slug":"simple-student-result","name":"Student Result or Employee Database","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc253ef6-8677-4651-adb9-725441cd171a","source":"wordfence","cve":"CVE-2026-96647","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc253ef6-8677-4651-adb9-725441cd171a?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2026-10-01T19:15:53Z","updated":"2026-10-02T07:39:28Z"},{"id":"wordfence:dc260bf2-843d-4a11-a0a5-3fcc2e6bf556","source":"wordfence","cve":"CVE-2025-49964","title":"ClipLink <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc260bf2-843d-4a11-a0a5-3fcc2e6bf556?source=api-prod","affected":[{"type":"plugin","slug":"cliplink","name":"ClipLink","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T15:28:49Z"},{"id":"wordfence:dc26fef6-58e8-441c-ae72-19a3822903a5","source":"wordfence","cve":"CVE-2024-27962","title":"wp-mpdf <= 3.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc26fef6-58e8-441c-ae72-19a3822903a5?source=api-prod","affected":[{"type":"plugin","slug":"wp-mpdf","name":"wp-mpdf","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.8"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:07:49Z"},{"id":"wordfence:dc277e7c-86ec-448f-a91e-e4d12a4b4177","source":"wordfence","cve":"CVE-2024-9206","title":"MAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc277e7c-86ec-448f-a91e-e4d12a4b4177?source=api-prod","affected":[{"type":"plugin","slug":"mas-wp-job-manager-company","name":"MAS Companies For WP Job Manager","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-18T06:51:26Z"},{"id":"wordfence:dc296d26-0727-4557-b779-b426fbaa82d8","source":"wordfence","cve":"CVE-2025-31529","title":"Slider Path for Elementor <= 3.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc296d26-0727-4557-b779-b426fbaa82d8?source=api-prod","affected":[{"type":"plugin","slug":"slider-path","name":"Slider Path for Elementor","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T15:22:10Z"},{"id":"wordfence:dc2d6986-fe9f-4776-b00f-35dd20687742","source":"wordfence","cve":"CVE-2025-31643","title":"WPCHURCH <= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc2d6986-fe9f-4776-b00f-35dd20687742?source=api-prod","affected":[{"type":"plugin","slug":"church-management","name":"WPCHURCH - Church Management System for Wordpress","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:32:08Z"},{"id":"wordfence:dc314c13-4be4-40fc-a035-5de0acb36c91","source":"wordfence","cve":"","title":"WP Simple Spreadsheet Fetcher for Google < 0.3.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc314c13-4be4-40fc-a035-5de0acb36c91?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-spreadsheet-fetcher-for-google","name":"WP Simple Spreadsheet Fetcher for Google","from":"*","from_inclusive":true,"to":"0.3.7","to_inclusive":false,"patched_in":"0.3.7"}],"published":"2020-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc319d4e-06d5-4fba-9f7a-2eb8c2e089f4","source":"wordfence","cve":"CVE-2025-49899","title":"Whydonate <= 4.0.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc319d4e-06d5-4fba-9f7a-2eb8c2e089f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-whydonate","name":"WhyDonate \u2013 FREE Donate button \u2013 Crowdfunding \u2013 Fundraising","from":"*","from_inclusive":true,"to":"4.0.15","to_inclusive":true,"patched_in":"4.0.16"}],"published":"2025-10-20T00:00:00Z","updated":"2025-10-29T15:48:13Z"},{"id":"wordfence:dc322548-ffc9-4246-9835-fcc5705cef3f","source":"wordfence","cve":"CVE-2022-1724","title":"Simple Membership <= 4.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc322548-ffc9-4246-9835-fcc5705cef3f?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc333949-de1e-493a-badd-3be1c9060503","source":"wordfence","cve":"CVE-2025-8293","title":"Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc333949-de1e-493a-badd-3be1c9060503?source=api-prod","affected":[{"type":"plugin","slug":"intl-datetime-calendar","name":"Intl DateTime Calendar","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:54:41Z","updated":"2026-09-09T16:32:18Z"},{"id":"wordfence:dc339d68-4b09-4721-a216-e94e29f872cc","source":"wordfence","cve":"CVE-2025-58800","title":"WP Email Template <= 2.8.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc339d68-4b09-4721-a216-e94e29f872cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-template","name":"WP Email Template","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2025-09-05T00:00:00Z","updated":"2026-07-17T20:27:37Z"},{"id":"wordfence:dc3457a5-3d5b-40dc-b9b1-e819187c4d99","source":"wordfence","cve":"CVE-2022-0412","title":"TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3457a5-3d5b-40dc-b9b1-e819187c4d99?source=api-prod","affected":[{"type":"plugin","slug":"ti-woocommerce-wishlist","name":"TI WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"1.40.1","to_inclusive":false,"patched_in":"1.40.1"},{"type":"plugin","slug":"ti-woocommerce-wishlist-premium","name":"TI WooCommerce Wishlist Pro","from":"*","from_inclusive":true,"to":"1.40.1","to_inclusive":false,"patched_in":"1.40.1"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc3555b6-9b5d-4fed-9d99-9f69f0566b99","source":"wordfence","cve":"CVE-2024-50494","title":"Sudan Payment Gateway for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3555b6-9b5d-4fed-9d99-9f69f0566b99?source=api-prod","affected":[{"type":"plugin","slug":"wc-sudan-payment-gateway","name":"Sudan Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:24:28Z"},{"id":"wordfence:dc35981c-43fb-4203-9004-53766115ffbe","source":"wordfence","cve":"CVE-2026-94121","title":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc35981c-43fb-4203-9004-53766115ffbe?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.33.6","to_inclusive":true,"patched_in":"2.34.0"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:56:22Z"},{"id":"wordfence:dc36ee53-81a9-416e-8e74-31d9c8802d6c","source":"wordfence","cve":"CVE-2026-15106","title":"WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc36ee53-81a9-416e-8e74-31d9c8802d6c?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2026-07-15T19:50:01Z","updated":"2026-07-16T07:51:05Z"},{"id":"wordfence:dc37397e-cd23-4ffd-9771-316d7f9ff9fa","source":"wordfence","cve":"","title":"Twitter Bootstrap Slider <= 1.1.3 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc37397e-cd23-4ffd-9771-316d7f9ff9fa?source=api-prod","affected":[{"type":"plugin","slug":"twitter-bootstrap-slider","name":"Twitter Bootstrap Slider","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc37b864-f1a5-4963-9efc-d9bb88a7a43a","source":"wordfence","cve":"CVE-2025-11072","title":"Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc37b864-f1a5-4963-9efc-d9bb88a7a43a?source=api-prod","affected":[{"type":"plugin","slug":"download-counter-button","name":"MelAbu WP Download Counter Button","from":"*","from_inclusive":true,"to":"1.8.6.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-15T00:00:00Z","updated":"2025-11-12T14:06:31Z"},{"id":"wordfence:dc3c7201-6d4f-4e6d-98e0-292f41519203","source":"wordfence","cve":"CVE-2025-30826","title":"IP Locator <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3c7201-6d4f-4e6d-98e0-292f41519203?source=api-prod","affected":[{"type":"plugin","slug":"ip-locator","name":"IP Locator","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:57:47Z"},{"id":"wordfence:dc3df045-1020-403f-8e10-a1b75261b769","source":"wordfence","cve":"CVE-2026-15896","title":"Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-26","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3df045-1020-403f-8e10-a1b75261b769?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-10-01T16:32:09Z","updated":"2026-10-02T05:30:19Z"},{"id":"wordfence:dc3e3d47-cae3-46a6-9b60-ad1eb6b7ced7","source":"wordfence","cve":"CVE-2024-43252","title":"Crew HRM <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3e3d47-cae3-46a6-9b60-ad1eb6b7ced7?source=api-prod","affected":[{"type":"plugin","slug":"hr-management","name":"Employee, Leave and Recruitment Management System \u2013 Crew HRM","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-08-12T00:00:00Z","updated":"2024-08-22T15:03:48Z"},{"id":"wordfence:dc3e89e5-2e7e-497e-b340-b787ebdf3711","source":"wordfence","cve":"CVE-2024-8199","title":"Reviews Feed \u2013 Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc3e89e5-2e7e-497e-b340-b787ebdf3711?source=api-prod","affected":[{"type":"plugin","slug":"reviews-feed","name":"Reviews Feed \u2013 Google Reviews, Yelp, Trustpilot & Tripadvisor Reviews Widget","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-08-26T00:00:00Z","updated":"2025-07-29T06:39:26Z"},{"id":"wordfence:dc4003f8-7250-435b-99b1-c45d80e27ce1","source":"wordfence","cve":"CVE-2025-68501","title":"Mollie Payments for WooCommerce <= 8.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4003f8-7250-435b-99b1-c45d80e27ce1?source=api-prod","affected":[{"type":"plugin","slug":"mollie-payments-for-woocommerce","name":"Mollie Payments for WooCommerce","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.1.2"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:42:12Z"},{"id":"wordfence:dc41c4e6-8c8a-4132-b40d-b21557bc3fd5","source":"wordfence","cve":"CVE-2025-58254","title":"StylePress for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc41c4e6-8c8a-4132-b40d-b21557bc3fd5?source=api-prod","affected":[{"type":"plugin","slug":"full-site-builder-for-elementor","name":"StylePress for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:39:28Z"},{"id":"wordfence:dc4234e3-4e0d-401d-8212-9c1817c86578","source":"wordfence","cve":"CVE-2025-39351","title":"Grand Restaurant WordPress <= 7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4234e3-4e0d-401d-8212-9c1817c86578?source=api-prod","affected":[{"type":"theme","slug":"grandrestaurant","name":"Grand Restaurant WordPress","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-21T19:41:45Z"},{"id":"wordfence:dc428f4b-fe82-419a-aee3-38f0bb582506","source":"wordfence","cve":"CVE-2023-32963","title":"WooCommerce Predictive Search <= 5.8.0 - Cross-Site Request Forgery via multiple AJAX actions","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc428f4b-fe82-419a-aee3-38f0bb582506?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-predictive-search","name":"Predictive Search for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.8.1"}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc441db6-f308-477e-98b1-85bd2ebe32e7","source":"wordfence","cve":"CVE-2026-94115","title":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc441db6-f308-477e-98b1-85bd2ebe32e7?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:30:24Z"},{"id":"wordfence:dc4883b8-5783-49ff-ab3b-c568c9923227","source":"wordfence","cve":"CVE-2025-12850","title":"My auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4883b8-5783-49ff-ab3b-c568c9923227?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.32","to_inclusive":true,"patched_in":"3.6.33"}],"published":"2025-12-04T18:36:48Z","updated":"2025-12-05T06:43:51Z"},{"id":"wordfence:dc4a6c2a-9a16-47dc-97ea-914adfb34688","source":"wordfence","cve":"CVE-2025-39565","title":"MelaPress Login Security <= 2.1.0 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4a6c2a-9a16-47dc-97ea-914adfb34688?source=api-prod","affected":[{"type":"plugin","slug":"melapress-login-security","name":"Melapress Login Security","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:57:16Z"},{"id":"wordfence:dc4c4f01-cc48-47a3-a7b7-025b261ab54c","source":"wordfence","cve":"CVE-2024-47299","title":"Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.17.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4c4f01-cc48-47a3-a7b7-025b261ab54c?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon","name":"Website Builder by SeedProd \u2014 Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode","from":"*","from_inclusive":true,"to":"6.17.4","to_inclusive":true,"patched_in":"6.18.4"}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:44:48Z"},{"id":"wordfence:dc4e59ba-9732-4c0c-a89f-866f274661d9","source":"wordfence","cve":"CVE-2024-38723","title":"JSON Content Importer <= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4e59ba-9732-4c0c-a89f-866f274661d9?source=api-prod","affected":[{"type":"plugin","slug":"json-content-importer","name":"Get Use APIs \u2013 JSON Content Importer","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T14:19:19Z"},{"id":"wordfence:dc4e9e51-544a-435a-932c-5fd6ac39ac7d","source":"wordfence","cve":"CVE-2026-78265","title":"The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc4e9e51-544a-435a-932c-5fd6ac39ac7d?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.2","to_inclusive":true,"patched_in":"6.17.3"}],"published":"2026-08-24T12:30:29Z","updated":"2026-09-10T19:30:29Z"},{"id":"wordfence:dc5050dc-39de-4544-bf51-0927b2972d34","source":"wordfence","cve":"","title":"WP Cerber Security <= 9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5050dc-39de-4544-bf51-0927b2972d34?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":"9.1"}],"published":"2022-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc5276e2-e9de-4409-bbe0-4d0b37244367","source":"wordfence","cve":"CVE-2023-33330","title":"WooCommerce Follow-Up Emails <= 4.9.50 - Authenticated (Follow-up emails manager+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5276e2-e9de-4409-bbe0-4d0b37244367?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-follow-up-emails","name":"Woocommerce Follow-ups","from":"*","from_inclusive":true,"to":"4.9.50","to_inclusive":true,"patched_in":"4.9.51"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc5298f9-4eb3-4ae5-afdd-59eadcd04935","source":"wordfence","cve":"CVE-2025-3503","title":"WP Maps \u2013 Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5298f9-4eb3-4ae5-afdd-59eadcd04935?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2025-04-10T00:00:00Z","updated":"2025-06-03T14:04:27Z"},{"id":"wordfence:dc54b1c2-88fc-4b9b-901d-57bbc079c616","source":"wordfence","cve":"CVE-2025-63075","title":"Betheme <= 28.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc54b1c2-88fc-4b9b-901d-57bbc079c616?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.2","to_inclusive":true,"patched_in":"28.2.1"}],"published":"2025-10-06T00:00:00Z","updated":"2026-01-07T14:27:51Z"},{"id":"wordfence:dc54d166-ac91-4748-a5e5-17ae18e6ac4f","source":"wordfence","cve":"CVE-2026-78149","title":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc54d166-ac91-4748-a5e5-17ae18e6ac4f?source=api-prod","affected":[{"type":"plugin","slug":"post-carousel","name":"Smart Post \u2013 Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News","from":"4.0.0","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:57:32Z"},{"id":"wordfence:dc54e6dd-1529-4ab9-ae56-229d032ad5c6","source":"wordfence","cve":"CVE-2026-13415","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc54e6dd-1529-4ab9-ae56-229d032ad5c6?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.18","to_inclusive":false,"patched_in":"4.1.18"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:38:12Z"},{"id":"wordfence:dc57d762-1e26-4980-ac82-ba35bf252ef8","source":"wordfence","cve":"CVE-2024-31290","title":"Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc57d762-1e26-4980-ac82-ba35bf252ef8?source=api-prod","affected":[{"type":"plugin","slug":"demo-my-wordpress","name":"Demo My WordPress","from":"*","from_inclusive":true,"to":"1.0.9.1","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:03:44Z"},{"id":"wordfence:dc59510c-6eaf-4526-8acb-c07e39923ad9","source":"wordfence","cve":"CVE-2023-4718","title":"Font Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc59510c-6eaf-4526-8acb-c07e39923ad9?source=api-prod","affected":[{"type":"plugin","slug":"font-awesome-4-menus","name":"Font Awesome 4 Menus","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc5c511f-dc79-468b-a107-cdf50999faf8","source":"wordfence","cve":"CVE-2023-4246","title":"GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5c511f-dc79-468b-a107-cdf50999faf8?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.33.3","to_inclusive":true,"patched_in":"2.33.4"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc5d9673-bd79-41cf-8995-0610bc9e43bb","source":"wordfence","cve":"CVE-2026-110534","title":"Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5d9673-bd79-41cf-8995-0610bc9e43bb?source=api-prod","affected":[{"type":"plugin","slug":"redux-framework","name":"Redux Framework","from":"*","from_inclusive":true,"to":"4.5.16","to_inclusive":true,"patched_in":"4.5.17"}],"published":"2026-11-06T15:32:38Z","updated":"2026-11-07T04:27:15Z"},{"id":"wordfence:dc676e18-c895-4f6a-bce9-1f92207af885","source":"wordfence","cve":"CVE-2026-0692","title":"BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc676e18-c895-4f6a-bce9-1f92207af885?source=api-prod","affected":[{"type":"plugin","slug":"bluesnap-payment-gateway-for-woocommerce","name":"BlueSnap Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-02-13T16:19:36Z","updated":"2026-03-06T18:31:59Z"},{"id":"wordfence:dc684b36-d054-4933-bb0f-f49ae27b000f","source":"wordfence","cve":"CVE-2025-53198","title":"Houzez <= 4.0.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc684b36-d054-4933-bb0f-f49ae27b000f?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2025-07-01T00:00:00Z","updated":"2025-07-08T18:39:12Z"},{"id":"wordfence:dc686a35-4ce3-4359-a7d3-e6459e2f5dfe","source":"wordfence","cve":"CVE-2024-4212","title":"Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc686a35-4ce3-4359-a7d3-e6459e2f5dfe?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-05T15:27:53Z","updated":"2025-02-13T20:26:43Z"},{"id":"wordfence:dc6a1a39-509a-4c82-8111-f05573d0f88b","source":"wordfence","cve":"CVE-2025-24537","title":"The Events Calendar <= 6.7.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc6a1a39-509a-4c82-8111-f05573d0f88b?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.7.0","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:18:10Z"},{"id":"wordfence:dc6dcbc1-7343-4a8c-937a-5a39d8acb602","source":"wordfence","cve":"CVE-2024-50521","title":"Alley Elementor Widget <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc6dcbc1-7343-4a8c-937a-5a39d8acb602?source=api-prod","affected":[{"type":"plugin","slug":"alley-elementor-widget","name":"Alley Elementor Widget","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-06T14:40:12Z"},{"id":"wordfence:dc6f46b6-6832-4ccc-8272-2c470621f644","source":"wordfence","cve":"CVE-2025-47447","title":"Cool Author Box <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc6f46b6-6832-4ccc-8272-2c470621f644?source=api-prod","affected":[{"type":"plugin","slug":"hm-cool-author-box-widget","name":"Cool Author Box \u2013 For Widget and Post Content","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:35:20Z"},{"id":"wordfence:dc7099d7-94fd-42be-a921-bfcad43ae252","source":"wordfence","cve":"CVE-2024-4943","title":"Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7099d7-94fd-42be-a921-bfcad43ae252?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.46","to_inclusive":true,"patched_in":"2.0.47"}],"published":"2024-05-20T14:17:20Z","updated":"2024-05-21T02:32:59Z"},{"id":"wordfence:dc7211fc-2c16-4080-a0b6-2090e1e4601c","source":"wordfence","cve":"CVE-2025-26764","title":"Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7211fc-2c16-4080-a0b6-2090e1e4601c?source=api-prod","affected":[{"type":"plugin","slug":"distance-based-shipping-calculator","name":"Distance Based Shipping Calculator","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-24T15:45:46Z"},{"id":"wordfence:dc72d99b-f29b-4ac4-8228-eea2837ab457","source":"wordfence","cve":"CVE-2025-31868","title":"JS Job Manager <= 2.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc72d99b-f29b-4ac4-8228-eea2837ab457?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:45:17Z"},{"id":"wordfence:dc762385-a099-4bec-9b30-ebbbc00faaeb","source":"wordfence","cve":"CVE-2024-37518","title":"The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc762385-a099-4bec-9b30-ebbbc00faaeb?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.5.1.4","to_inclusive":true,"patched_in":"6.5.1.5"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:16:02Z"},{"id":"wordfence:dc783305-1cd0-4ec1-b4e2-57afeeec8034","source":"wordfence","cve":"CVE-2022-1089","title":"Bulk Edit and Create User Profiles \u2013 WP Sheet Editor <= 1.5.13 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc783305-1cd0-4ec1-b4e2-57afeeec8034?source=api-prod","affected":[{"type":"plugin","slug":"bulk-edit-user-profiles-in-spreadsheet","name":"Bulk Edit and Create User Profiles \u2013 WP Sheet Editor","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":false,"patched_in":"1.5.14"}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc7b51e5-6eb7-41ba-add3-f083fb34c5e1","source":"wordfence","cve":"CVE-2021-4421","title":"Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7b51e5-6eb7-41ba-add3-f083fb34c5e1?source=api-prod","affected":[{"type":"plugin","slug":"advanced-popups","name":"Advanced Popups","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2020-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc7ba538-a7ee-48c8-996c-b8db1934fdeb","source":"wordfence","cve":"CVE-2025-12718","title":"Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay","severity":"medium","cvss":5.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7ba538-a7ee-48c8-996c-b8db1934fdeb?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2026-01-16T13:59:09Z","updated":"2026-01-17T02:22:32Z"},{"id":"wordfence:dc7d0124-9ddd-4f88-bffd-e09e10137a3d","source":"wordfence","cve":"CVE-2015-2293","title":"Yoast SEO <= 1.7.3.3 - Cross-Site Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7d0124-9ddd-4f88-bffd-e09e10137a3d?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"},{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"1.6","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.5.7"},{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"1.7","from_inclusive":true,"to":"1.7.3.3","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2015-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc7e4235-5f40-48c2-8474-cf57af5e35bd","source":"wordfence","cve":"CVE-2023-25958","title":"Simple Tooltips <= 2.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7e4235-5f40-48c2-8474-cf57af5e35bd?source=api-prod","affected":[{"type":"plugin","slug":"simple-tooltips","name":"Simple Tooltips","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc7f5751-5c95-4105-b2a6-592d11d46ac6","source":"wordfence","cve":"CVE-2024-54293","title":"CE21 Suite <= 2.2.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7f5751-5c95-4105-b2a6-592d11d46ac6?source=api-prod","affected":[{"type":"plugin","slug":"ce21-suite","name":"CE21 Suite","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:38:50Z"},{"id":"wordfence:dc7ff863-3a8e-41cd-ae20-78bb4577c16a","source":"wordfence","cve":"CVE-2024-2203","title":"The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget","severity":"medium","cvss":6.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7ff863-3a8e-41cd-ae20-78bb4577c16a?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T01:56:47Z"},{"id":"wordfence:dc821f8e-a10e-4c24-9702-4207789e34d6","source":"wordfence","cve":"CVE-2025-31625","title":"Useinfluence <= 1.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc821f8e-a10e-4c24-9702-4207789e34d6?source=api-prod","affected":[{"type":"plugin","slug":"useinfluence","name":"Useinfluence","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:33:15Z"},{"id":"wordfence:dc82bfca-75de-4c77-a0ac-b34525b29a8d","source":"wordfence","cve":"CVE-2025-26592","title":"Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc82bfca-75de-4c77-a0ac-b34525b29a8d?source=api-prod","affected":[{"type":"theme","slug":"wisemove","name":"Wise Move | Relocation and Storage Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"mediaflex","name":"MediaFlex - TV Channel & Streaming WordPress Theme","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":false,"patched_in":"1.10.0"},{"type":"theme","slug":"alhambra","name":"Alhambra | Mosque & Islamic WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"booklovers","name":"Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"2.22.0","to_inclusive":false,"patched_in":"2.22.0"},{"type":"theme","slug":"ann","name":"AI ANN - AI Generator & AI Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.33.0","to_inclusive":false,"patched_in":"1.33.0"},{"type":"theme","slug":"oldstory-whisky-bar","name":"OldStory - Whisky Bar | Pub | Restaurant Site Template","from":"*","from_inclusive":true,"to":"2.22.0","to_inclusive":false,"patched_in":"2.22.0"},{"type":"theme","slug":"playhockey","name":"Let's Play | Hockey School & Winter Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"birdily","name":"Birdily | Travel Agency & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"prorange","name":"ProRange | Painting & Renovation Theme","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"},{"type":"theme","slug":"childy","name":"Childy \u2014 Kids Store & Baby Clothing WordPress Theme","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":false,"patched_in":"1.11.0"},{"type":"theme","slug":"def","name":"Def \u2014 CCTV & Bodyguard Security WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"},{"type":"theme","slug":"podium","name":"Podium | Fashion Model Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"anesta","name":"Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"belicia","name":"Belicia - Luxury Resort & Hotel Theme","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":false,"patched_in":"1.14.0"},{"type":"theme","slug":"chakra","name":"Chakra - Yoga Retreat & Leisure Center WordPress Theme","from":"*","from_inclusive":true,"to":"1.19.0","to_inclusive":false,"patched_in":"1.19.0"},{"type":"theme","slug":"corredo","name":"Corredo | Motorcycle & Bike Race Sports WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"beyoga","name":"BeYoga | Yogastudio & Gym WordPress Theme","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"},{"type":"theme","slug":"hogwords","name":"Hogwords | School, University Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"clothing69","name":"69 Clothing | Brand Store & Fashion Boutique WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":"1.2.11.1"},{"type":"theme","slug":"alanzo","name":"Alanzo | Chef & Event Catering WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"theme","slug":"pathwell","name":"PathWell | Senior Care WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":"1.1.17"},{"type":"theme","slug":"hampton","name":"Hampton | Home Design and Renovation WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"carlax","name":"Carlax | Car Parts Store & Auto Service WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"hotlock","name":"HotLock | Locksmith & Security Systems WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"},{"type":"theme","slug":"elementra","name":"Elementra - 100% Elementor WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"},{"type":"theme","slug":"softic","name":"Softic - SaaS Software & Application WordPress Theme","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"},{"type":"theme","slug":"juno","name":"Juno | Kids Toys & Games Store WordPress Theme","from":"*","from_inclusive":true,"to":"2.27.0","to_inclusive":false,"patched_in":"2.27.0"},{"type":"theme","slug":"solio","name":"Solio - Solar & Renewable Energy WordPress Theme","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"},{"type":"theme","slug":"heaven11","name":"Heaven11 | Property & Apartment Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gravity","name":"Gravity | Interior Design & Furniture Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"agora","name":"Agora \u2014 Event & Conference WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"},{"type":"theme","slug":"insurance-ancora","name":"Insurance Ancora - Finance WordPress Theme","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":false,"patched_in":"2.16.0"},{"type":"theme","slug":"chrimson","name":"Chrimson | Windows & Doors Installation Services Store WordPress Theme + AI","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"hello-summer","name":"Hello Summer | Children Camp WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"gutentype","name":"Gutentype | 100% Gutenberg Blog Theme + Elementor","from":"*","from_inclusive":true,"to":"2.1.11","to_inclusive":true,"patched_in":"2.1.12"},{"type":"theme","slug":"chainpress","name":"ChainPress | Financial Business Blog PSD Template","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"albertino","name":"Albertino - Laboratory WordPress Theme","from":"*","from_inclusive":true,"to":"2.24.0.0","to_inclusive":false,"patched_in":"2.24.0.0"},{"type":"theme","slug":"planet-shakers","name":"Planet Shakers | Church & Religion WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"samadhi","name":"Samadhi | Oriental Buddhist Temple WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"callie-britt","name":"Callie Britt | Family Counselling Psychology WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.3.1"},{"type":"theme","slug":"vagabonds","name":"Vagabonds - Travel Blog Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"plastica","name":"Plastica - Plastic Surgery & Beauty WordPress Theme","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"},{"type":"theme","slug":"credit-card","name":"Credit Card Experience | Loan Company and Online Banking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"laundrycity","name":"Laundry City | Dry Cleaning Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"},{"type":"theme","slug":"smart-casa","name":"Smart Casa | Home Automation & House Technologies WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"tax-help","name":"Tax Help - Finance & Accounting Adviser Theme","from":"*","from_inclusive":true,"to":"2.23.0","to_inclusive":false,"patched_in":"2.23.0"},{"type":"theme","slug":"chardonnay","name":"Chardonnay - Wine Store & Vineyard WordPress Theme","from":"*","from_inclusive":true,"to":"1.26.0","to_inclusive":false,"patched_in":"1.26.0"},{"type":"theme","slug":"angela","name":"Angela | Family Planning & Pregnancy Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"advice","name":"Advice - Psychology, Therapy & Counseling Theme","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"},{"type":"theme","slug":"anubia","name":"Anubia | Smoking and Hookah Bar WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"abogado","name":"Abogado - Lawyer WordPress Theme","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":false,"patched_in":"1.18.0"},{"type":"theme","slug":"artesia","name":"Artesia - Freelancer WordPress Theme","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":false,"patched_in":"1.20.0"},{"type":"theme","slug":"edema","name":"Edema | Wellness & Spa WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2.1","to_inclusive":false,"patched_in":"1.2.2.1"},{"type":"theme","slug":"accalia","name":"Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"healthy-blog","name":"Healthy Blog - Blog WordPress Theme + Store","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"custom-made","name":"Custom Made | Jewelry Manufacturer and Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"partiso","name":"Partiso | Political Party & Candidate Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"camelia","name":"Camelia | Floral Studio Florist WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.14.1"},{"type":"theme","slug":"stratego","name":"Stratego - Corporate Business & Consulting WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"},{"type":"theme","slug":"alisha-williams","name":"A.Williams | Assistant & Administrative Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"},{"type":"theme","slug":"stevenwatkins","name":"StevenWatkins - Personal Gym Trainer WordPress Theme","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"},{"type":"theme","slug":"inset","name":"Inset - Digital Agency & IT Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":false,"patched_in":"1.21.0"},{"type":"theme","slug":"crework","name":"Crework | Coworking and Creative Space WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":"1.1.12"},{"type":"theme","slug":"wine-house","name":"Wine House | Winery & Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":false,"patched_in":"3.21.0"},{"type":"theme","slug":"happy-rider","name":"Happy Rider - Horse School & Equestrian Center WordPress Theme","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":false,"patched_in":"2.18.0"},{"type":"theme","slug":"kargo","name":"Kargo | Logistics & Transportation PSD Template","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"drone-media","name":"Drone Media | Aerial Photography & Videography Theme","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":false,"patched_in":"2.8.0"},{"type":"theme","slug":"adrena","name":"Adrena | Airsoft Club & Paintball WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"carz","name":"Carz \u2014 Car Dealer, Shop & Repair WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":false,"patched_in":"1.6.0"},{"type":"theme","slug":"alpha-color","name":"AlphaColor - Design & Printing Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.4.11.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"qwery","name":"Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"},{"type":"theme","slug":"wotahub","name":"WotaHub | Coworking Space WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"soccerclub","name":"SoccerClub - Football Team & Soccer League WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":false,"patched_in":"2.5.0"},{"type":"theme","slug":"asclepius","name":"Asclepius - Doctor & Medical Theme","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":false,"patched_in":"1.25.0"},{"type":"theme","slug":"fortunio","name":"Fortunio - Carpenter, Forestry,  Wood Manufacture Theme","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"},{"type":"theme","slug":"good-wine","name":"Good Wine | Vineyard & Winery Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"lab","name":"Lab - Pharmacy, Laboratory & Research WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"},{"type":"theme","slug":"nazareth","name":"Nazareth | Church & Religion WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"cityhostel","name":"City Hostel | Travel & Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"travesia","name":"Travesia | Travel Agency and Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"proguards","name":"ProGuards | Safety & Security Site Template","from":"*","from_inclusive":true,"to":"2.19.0","to_inclusive":false,"patched_in":"2.19.0"},{"type":"theme","slug":"studeon","name":"Studeon | Education Center & Training Courses WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bonko","name":"Bonko | Safari & Zoo WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"tantra","name":"Tantra | Yoga Studio and Fitness Club WordPress Theme","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":false,"patched_in":"2.9.0"},{"type":"theme","slug":"preston","name":"Preston | Fruit Company & Organic Farming WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"translang","name":"Translang -  Language Courses & Translation Services Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.1.16","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"prodent","name":"ProDent | Dental Clinic & Doctor WordPress Theme + Elementor + RTL","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-12-11T20:33:15Z"},{"id":"wordfence:dc82e04e-a611-4bae-b445-44e25bedc758","source":"wordfence","cve":"CVE-2026-11976","title":"MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc82e04e-a611-4bae-b445-44e25bedc758?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-premium","name":"MonsterInsights Pro","from":"10.2.0","from_inclusive":true,"to":"11.0.0","to_inclusive":false,"patched_in":""}],"published":"2026-06-11T00:00:00Z","updated":"2026-08-17T15:44:01Z"},{"id":"wordfence:dc83b0ff-7228-466a-b831-53cca252a3f3","source":"wordfence","cve":"CVE-2009-2396","title":"DM Albums <= 1.9.2 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc83b0ff-7228-466a-b831-53cca252a3f3?source=api-prod","affected":[{"type":"plugin","slug":"dm-albums","name":"dm-albums","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2009-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc841e7d-a815-4ed0-b5ec-6ce76fb859c5","source":"wordfence","cve":"CVE-2025-23843","title":"WP-HR Manager: The Human Resources Plugin for WordPress <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc841e7d-a815-4ed0-b5ec-6ce76fb859c5?source=api-prod","affected":[{"type":"plugin","slug":"wp-hr-manager","name":"WP-HR Manager: The Human Resources Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-10T14:57:15Z"},{"id":"wordfence:dc8704f2-01ee-4193-ae8d-96a7f5383d21","source":"wordfence","cve":"CVE-2024-35657","title":"WP-Recall <= 16.26.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8704f2-01ee-4193-ae8d-96a7f5383d21?source=api-prod","affected":[{"type":"plugin","slug":"wp-recall","name":"WP-Recall \u2013 Registration, Profile, Commerce & More","from":"*","from_inclusive":true,"to":"16.26.6","to_inclusive":true,"patched_in":"16.26.7"}],"published":"2024-06-03T00:00:00Z","updated":"2024-07-01T16:23:33Z"},{"id":"wordfence:dc878508-200d-4bc7-aa99-c34e63cba4b3","source":"wordfence","cve":"CVE-2023-1016","title":"Intuitive Custom Post Order <= 3.1.4.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc878508-200d-4bc7-aa99-c34e63cba4b3?source=api-prod","affected":[{"type":"plugin","slug":"intuitive-custom-post-order","name":"Intuitive Custom Post Order","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc8b33c7-23ef-4b5c-bdb9-b4e548d18832","source":"wordfence","cve":"CVE-2025-47691","title":"Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8b33c7-23ef-4b5c-bdb9-b4e548d18832?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.10.3","to_inclusive":true,"patched_in":"2.10.4"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-16T14:16:24Z"},{"id":"wordfence:dc8bef03-51e0-4448-bddd-85300104e875","source":"wordfence","cve":"CVE-2024-0511","title":"Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8bef03-51e0-4448-bddd-85300104e875?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.87","to_inclusive":true,"patched_in":"1.3.88"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T21:37:36Z"},{"id":"wordfence:dc8c0726-82b7-487e-ba9e-7adc892979d2","source":"wordfence","cve":"CVE-2013-4626","title":"BackWPup < 3.0.13 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8c0726-82b7-487e-ba9e-7adc892979d2?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"3.0.13","to_inclusive":false,"patched_in":"3.0.13"}],"published":"2013-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc8d63ee-4929-4940-bc6a-931524e20272","source":"wordfence","cve":"CVE-2024-5091","title":"SKT Addons for Elementor <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider Widgets","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8d63ee-4929-4940-bc6a-931524e20272?source=api-prod","affected":[{"type":"plugin","slug":"skt-addons-for-elementor","name":"SKT Addons for Elementor","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-06-07T00:00:00Z","updated":"2024-06-08T06:54:37Z"},{"id":"wordfence:dc8dc895-8caa-4a37-80f0-3a5516c25dfe","source":"wordfence","cve":"CVE-2016-10892","title":"Chained Quiz Plugin < 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8dc895-8caa-4a37-80f0-3a5516c25dfe?source=api-prod","affected":[{"type":"plugin","slug":"chained-quiz","name":"Chained Quiz","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":false,"patched_in":"1.0"}],"published":"2017-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc8e56d2-7e9a-4afd-921c-fea853f2d21a","source":"wordfence","cve":"CVE-2026-123476","title":"Featured Image from URL (FIFU) <= 6.1.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8e56d2-7e9a-4afd-921c-fea853f2d21a?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2026-11-07T10:39:52Z","updated":"2026-11-10T20:01:46Z"},{"id":"wordfence:dc8eea10-3c51-4147-a7f6-d73553158f84","source":"wordfence","cve":"CVE-2024-49321","title":"Simple Custom Post Order <= 2.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8eea10-3c51-4147-a7f6-d73553158f84?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-post-order","name":"Simple Custom Post Order","from":"*","from_inclusive":true,"to":"2.5.7","to_inclusive":true,"patched_in":"2.5.8"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:42:42Z"},{"id":"wordfence:dc8f46a4-b086-440c-809f-1a3db44125f1","source":"wordfence","cve":"CVE-2024-49308","title":"Animator <= 3.0.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8f46a4-b086-440c-809f-1a3db44125f1?source=api-prod","affected":[{"type":"plugin","slug":"scroll-triggered-animations","name":"Animator \u2013 Scroll Triggered Animations","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":true,"patched_in":"3.0.16"}],"published":"2024-10-15T00:00:00Z","updated":"2025-01-30T16:29:57Z"},{"id":"wordfence:dc8f6991-cdde-4c14-9f1b-35fe83d200f9","source":"wordfence","cve":"CVE-2025-58828","title":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8f6991-cdde-4c14-9f1b-35fe83d200f9?source=api-prod","affected":[{"type":"plugin","slug":"mshop-naver-talktalk","name":"\ucf54\ub4dc\uc5e0\uc0f5 \uc18c\uc15c\ud1a1","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:33:45Z"},{"id":"wordfence:dc912011-64f1-4714-874f-3326e8981cd6","source":"wordfence","cve":"CVE-2025-28868","title":"ZipList Recipe <= 3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc912011-64f1-4714-874f-3326e8981cd6?source=api-prod","affected":[{"type":"plugin","slug":"ziplist-recipe-plugin","name":"ZipList Recipe Plugin","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:26:23Z"},{"id":"wordfence:dc92b20a-fb9b-477c-8fe4-68897c1fd07e","source":"wordfence","cve":"CVE-2026-2902","title":"WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc92b20a-fb9b-477c-8fe4-68897c1fd07e?source=api-prod","affected":[{"type":"plugin","slug":"wp-meteor","name":"WP Meteor Website Speed Optimization Addon","from":"*","from_inclusive":true,"to":"3.4.16","to_inclusive":true,"patched_in":"3.4.17"}],"published":"2026-04-28T00:00:00Z","updated":"2026-04-29T11:17:36Z"},{"id":"wordfence:dc931943-13f3-4ab1-b70f-c234253ca269","source":"wordfence","cve":"CVE-2024-10312","title":"Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc931943-13f3-4ab1-b70f-c234253ca269?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T07:30:55Z"},{"id":"wordfence:dc948f30-2fc2-40dd-878e-28e0eac857c7","source":"wordfence","cve":"CVE-2025-12581","title":"Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc948f30-2fc2-40dd-878e-28e0eac857c7?source=api-prod","affected":[{"type":"plugin","slug":"attachments-handler","name":"Attachments Handler","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:06:08Z","updated":"2025-12-20T03:20:24Z"},{"id":"wordfence:dc949922-7bfa-4704-9038-cf4b5262f864","source":"wordfence","cve":"CVE-2024-11416","title":"WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc949922-7bfa-4704-9038-cf4b5262f864?source=api-prod","affected":[{"type":"plugin","slug":"wip-incoming-lite","name":"WIP Incoming Lite","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-11-20T13:41:48Z","updated":"2024-11-25T21:27:23Z"},{"id":"wordfence:dc9602fb-59d0-43bb-aa13-adfc2319db8e","source":"wordfence","cve":"CVE-2026-23548","title":"DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.25 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9602fb-59d0-43bb-aa13-adfc2319db8e?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.25","to_inclusive":true,"patched_in":"3.6.26"}],"published":"2025-12-18T00:00:00Z","updated":"2026-05-04T15:16:37Z"},{"id":"wordfence:dc9676ef-34d7-4a88-a295-1c7136a0e6cd","source":"wordfence","cve":"CVE-2024-34792","title":"Dextaz Ping <= 0.65 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9676ef-34d7-4a88-a295-1c7136a0e6cd?source=api-prod","affected":[{"type":"plugin","slug":"dextaz-ping","name":"Dextaz Ping","from":"*","from_inclusive":true,"to":"0.65","to_inclusive":true,"patched_in":""}],"published":"2024-05-20T00:00:00Z","updated":"2024-06-18T15:02:41Z"},{"id":"wordfence:dc988ec1-d4d9-4805-bffc-85649df3c2cb","source":"wordfence","cve":"CVE-2025-30958","title":"onOffice for WP-Websites <= 5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc988ec1-d4d9-4805-bffc-85649df3c2cb?source=api-prod","affected":[{"type":"plugin","slug":"onoffice-for-wp-websites","name":"onOffice for WP-Websites","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":true,"patched_in":"6.10"}],"published":"2025-06-05T00:00:00Z","updated":"2026-02-03T19:05:50Z"},{"id":"wordfence:dc9900b1-9bac-442d-bb68-711ea9e27c38","source":"wordfence","cve":"CVE-2025-58958","title":"SmilePure < 1.8.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9900b1-9bac-442d-bb68-711ea9e27c38?source=api-prod","affected":[{"type":"theme","slug":"smilepure","name":"SmilePure - Dental & Medical Care WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2025-07-30T00:00:00Z","updated":"2025-11-04T18:29:04Z"},{"id":"wordfence:dc9dcd42-bec1-4323-b5bf-6c0518ae546d","source":"wordfence","cve":"CVE-2017-18512","title":"Newsletter by Supsystic < 1.1.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9dcd42-bec1-4323-b5bf-6c0518ae546d?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-by-supsystic","name":"Newsletter by Supsystic","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"}],"published":"2017-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dc9e818d-811e-4732-9c74-8eb6753a1706","source":"wordfence","cve":"CVE-2026-6440","title":"GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dc9e818d-811e-4732-9c74-8eb6753a1706?source=api-prod","affected":[{"type":"plugin","slug":"goodmeet","name":"GoodMeet \u2013 Meetings & Classes for Google Meet","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-07-09T19:32:41Z","updated":"2026-07-10T07:48:44Z"},{"id":"wordfence:dca56345-0ac6-4e1a-9832-8ba428667913","source":"wordfence","cve":"CVE-2025-30581","title":"Top Bar <= 3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dca56345-0ac6-4e1a-9832-8ba428667913?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bar","name":"Top Bar","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:11:24Z"},{"id":"wordfence:dca6bd12-5adf-48fa-b24f-198f13250080","source":"wordfence","cve":"CVE-2026-18562","title":"HUSKY <= 1.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dca6bd12-5adf-48fa-b24f-198f13250080?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.3.1"}],"published":"2026-09-10T14:51:16Z","updated":"2026-09-11T03:39:39Z"},{"id":"wordfence:dca7b232-db12-48a7-9f32-4451f4ced1af","source":"wordfence","cve":"CVE-2026-25364","title":"Client Invoicing by Sprout Invoices <= 20.8.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dca7b232-db12-48a7-9f32-4451f4ced1af?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.8","to_inclusive":true,"patched_in":"20.8.9"}],"published":"2026-02-15T00:00:00Z","updated":"2026-02-26T15:28:34Z"},{"id":"wordfence:dca8f186-c58a-40bc-b1d1-b29bcf4631c5","source":"wordfence","cve":"CVE-2018-17074","title":"Feed Statistics < 4.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dca8f186-c58a-40bc-b1d1-b29bcf4631c5?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-feed-statistics","name":"Feed Statistics","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":false,"patched_in":"4.0"}],"published":"2014-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcabc099-ef35-4dcd-ba53-ef20a0ad1abc","source":"wordfence","cve":"CVE-2019-15818","title":"Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authentication on Option Changes","severity":"medium","cvss":6.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcabc099-ef35-4dcd-ba53-ef20a0ad1abc?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects-addon-bulk-uploader","name":"Simple 301 Redirects \u2013 Addon \u2013 Bulk Uploader","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2019-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcb0334c-d5eb-40b9-be7c-42857dedc96d","source":"wordfence","cve":"CVE-2024-34810","title":"Extend Themes <= (Multiple Versions) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb0334c-d5eb-40b9-be7c-42857dedc96d?source=api-prod","affected":[{"type":"theme","slug":"consus","name":"Consus","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"theme","slug":"skyline-wp","name":"Skyline WP","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.0.11"},{"type":"theme","slug":"oasis","name":"Oasis","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"},{"type":"theme","slug":"ketos","name":"Ketos","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"},{"type":"theme","slug":"zeka","name":"Zeka","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.0.10"},{"type":"theme","slug":"niveau","name":"Niveau","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-19T12:56:02Z"},{"id":"wordfence:dcb33d02-d384-4dff-91e1-c49e86b97d6e","source":"wordfence","cve":"CVE-2025-4177","title":"Flynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb33d02-d384-4dff-91e1-c49e86b97d6e?source=api-prod","affected":[{"type":"plugin","slug":"flynax-bridge","name":"Flynax Bridge","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-05-01T12:37:36Z","updated":"2025-11-05T21:25:48Z"},{"id":"wordfence:dcb73efb-496a-45eb-882b-1906f05bc3f5","source":"wordfence","cve":"CVE-2025-68912","title":"HDForms <= 1.6.1 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcb73efb-496a-45eb-882b-1906f05bc3f5?source=api-prod","affected":[{"type":"plugin","slug":"hdforms","name":"HDForms | Contact Form Builder","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-01-13T00:00:00Z","updated":"2026-04-15T13:34:17Z"},{"id":"wordfence:dcbb6a4c-120f-43d1-8ec9-dac52186d81a","source":"wordfence","cve":"CVE-2025-54021","title":"Simple File List <= 6.1.14 - Unauthenticated Arbitrary File Download","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbb6a4c-120f-43d1-8ec9-dac52186d81a?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.14","to_inclusive":true,"patched_in":"6.1.15"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T19:31:24Z"},{"id":"wordfence:dcbc0ceb-7e23-4475-a138-25dc15ec17f7","source":"wordfence","cve":"CVE-2021-24360","title":"Yes/No Chart < 1.0.12 - Authenticated SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbc0ceb-7e23-4475-a138-25dc15ec17f7?source=api-prod","affected":[{"type":"plugin","slug":"yesno","name":"Yes/No Chart","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":false,"patched_in":"1.0.12"}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcbd6f84-06b5-4430-94b0-68471ca47fc0","source":"wordfence","cve":"CVE-2025-10873","title":"Elementinvader Addons for Elementor <= 1.4.0 - Unauthenticated Arbitrary Email Sending","severity":"medium","cvss":5.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbd6f84-06b5-4430-94b0-68471ca47fc0?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-10-15T00:00:00Z","updated":"2025-11-12T14:05:16Z"},{"id":"wordfence:dcbe0c72-d518-45d3-a220-896a51071b26","source":"wordfence","cve":"CVE-2023-5292","title":"Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbe0c72-d518-45d3-a220-896a51071b26?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.8.9.3","to_inclusive":true,"patched_in":"0.8.9.4"}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcbfcaeb-2635-4b11-b426-ee04345d5f36","source":"wordfence","cve":"CVE-2024-7501","title":"Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.2,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcbfcaeb-2635-4b11-b426-ee04345d5f36?source=api-prod","affected":[{"type":"plugin","slug":"download-plugins-dashboard","name":"Download Plugins and Themes in ZIP from Dashboard","from":"*","from_inclusive":true,"to":"1.8.7","to_inclusive":true,"patched_in":"1.8.8"}],"published":"2024-08-15T00:00:00Z","updated":"2024-08-16T06:41:00Z"},{"id":"wordfence:dcc5a611-23bf-499e-8141-684458d9ce3b","source":"wordfence","cve":"CVE-2024-2792","title":"Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc5a611-23bf-499e-8141-684458d9ce3b?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.2","to_inclusive":true,"patched_in":"1.13.3"}],"published":"2024-03-27T00:00:00Z","updated":"2024-10-24T19:31:02Z"},{"id":"wordfence:dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7","source":"wordfence","cve":"CVE-2025-2541","title":"WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcc68b62-7dd1-47d4-bbc5-d0237b7c85e7?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.22","to_inclusive":true,"patched_in":"2.6.23"}],"published":"2025-04-10T22:38:47Z","updated":"2025-04-11T11:11:57Z"},{"id":"wordfence:dccc2710-fdaf-40d6-ab07-51f3e8c2f382","source":"wordfence","cve":"CVE-2025-49349","title":"Reuters Direct <= 3.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dccc2710-fdaf-40d6-ab07-51f3e8c2f382?source=api-prod","affected":[{"type":"plugin","slug":"reuters-direct","name":"Reuters Direct","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:17:23Z"},{"id":"wordfence:dcd05142-9700-46a8-9ca6-f85e81dfee0d","source":"wordfence","cve":"","title":"Short URL <= 1.6.7 - Missing Authorization via multiple AJAX functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd05142-9700-46a8-9ca6-f85e81dfee0d?source=api-prod","affected":[{"type":"plugin","slug":"shorten-url","name":"Short URL","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2023-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcd24b90-94ff-4625-8e3e-9c90e38683f9","source":"wordfence","cve":"CVE-2023-4917","title":"Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd24b90-94ff-4625-8e3e-9c90e38683f9?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.30.7","to_inclusive":true,"patched_in":"3.30.7.1"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcd463de-ae26-4477-89e1-21f4aada1e86","source":"wordfence","cve":"","title":"BuddyPress Xprofile Custom Fields Type <= 2.6.3 - Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd463de-ae26-4477-89e1-21f4aada1e86?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-xprofile-custom-fields-type","name":"BuddyPress Xprofile Custom Fields Type","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":""}],"published":"2018-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcd59ae6-4e5a-4efb-9abb-43c482e41b16","source":"wordfence","cve":"CVE-2025-47578","title":"BNS Twitter Follow Button <= 0.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd59ae6-4e5a-4efb-9abb-43c482e41b16?source=api-prod","affected":[{"type":"plugin","slug":"bns-twitter-follow-button","name":"BNS Twitter Follow Button","from":"*","from_inclusive":true,"to":"0.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-14T20:11:39Z"},{"id":"wordfence:dcd65429-4fe3-41a7-a622-cbbecf4b7dd2","source":"wordfence","cve":"CVE-2026-119178","title":"Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd65429-4fe3-41a7-a622-cbbecf4b7dd2?source=api-prod","affected":[{"type":"plugin","slug":"smart-cookie-kit","name":"Smart Cookie Kit","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2026-11-05T22:01:30Z","updated":"2026-11-06T11:17:38Z"},{"id":"wordfence:dcd7204f-d950-4fb8-beb2-d9f619824fa1","source":"wordfence","cve":"","title":"All in One SEO <= 2.2.4.1 - Privilege Escalation to Arbitrary Post Modification","severity":"medium","cvss":4.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd7204f-d950-4fb8-beb2-d9f619824fa1?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.2.4.1","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2014-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcd7b005-d0b5-4303-b195-5b8a47e7e8c2","source":"wordfence","cve":"CVE-2026-120853","title":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce <= 3.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd7b005-d0b5-4303-b195-5b8a47e7e8c2?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-11-07T09:13:00Z","updated":"2026-11-10T19:40:48Z"},{"id":"wordfence:dcd986cd-d6c0-4d8f-8078-ac0ac83572a3","source":"wordfence","cve":"","title":"My Content Management <= 1.7.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd986cd-d6c0-4d8f-8078-ac0ac83572a3?source=api-prod","affected":[{"type":"plugin","slug":"my-content-management","name":"My Content Management","from":"1.7.1","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcdb5d23-b9fe-495b-8431-f82f22813531","source":"wordfence","cve":"","title":"iQ Block Country  < 1.1.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdb5d23-b9fe-495b-8431-f82f22813531?source=api-prod","affected":[{"type":"plugin","slug":"iq-block-country","name":"iQ Block Country","from":"*","from_inclusive":true,"to":"1.1.20","to_inclusive":false,"patched_in":"1.1.20"}],"published":"2015-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcdcb29e-48d0-4e22-8e11-0c76b4355268","source":"wordfence","cve":"CVE-2026-25453","title":"Advanced iFrame <= 2025.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdcb29e-48d0-4e22-8e11-0c76b4355268?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2025.10","to_inclusive":true,"patched_in":"2026.0"}],"published":"2026-01-19T00:00:00Z","updated":"2026-03-17T21:32:07Z"},{"id":"wordfence:dcddb0f3-41d5-4635-88ac-556ee3eec49a","source":"wordfence","cve":"CVE-2023-5041","title":"Track The Click <= 0.3.11 - Authenticated (Author+) SQL Injection via 'stats' REST Endpoint","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcddb0f3-41d5-4635-88ac-556ee3eec49a?source=api-prod","affected":[{"type":"plugin","slug":"track-the-click","name":"Track The Click","from":"*","from_inclusive":true,"to":"0.3.11","to_inclusive":true,"patched_in":"0.3.12"}],"published":"2023-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcdf22be-8af4-4596-b138-67ebfd04c06d","source":"wordfence","cve":"CVE-2023-23677","title":"GTmetrix for WordPress <= 0.4.5 - Reflected Cross-Site Scripting via 'url'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdf22be-8af4-4596-b138-67ebfd04c06d?source=api-prod","affected":[{"type":"plugin","slug":"gtmetrix-for-wordpress","name":"GTmetrix for WordPress","from":"*","from_inclusive":true,"to":"0.4.5","to_inclusive":true,"patched_in":"0.4.6"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcdf6914-ba66-468a-80fb-f7bf12c7eafe","source":"wordfence","cve":"CVE-2026-118532","title":"Directorist <= 8.10 - Authenticated (Subscriber+) Arbitrary Media Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcdf6914-ba66-468a-80fb-f7bf12c7eafe?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T12:47:31Z"},{"id":"wordfence:dce0e29f-d846-496b-a9fb-2f57cc352970","source":"wordfence","cve":"CVE-2025-32570","title":"ChillPay WooCommerce <= 2.5.3 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce0e29f-d846-496b-a9fb-2f57cc352970?source=api-prod","affected":[{"type":"plugin","slug":"chillpay-payment-gateway","name":"ChillPay WooCommerce","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-07-22T14:06:03Z"},{"id":"wordfence:dce0f5dc-a494-4ac3-943a-409f0d817166","source":"wordfence","cve":"CVE-2025-58867","title":"Easy Download Media Counter <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce0f5dc-a494-4ac3-943a-409f0d817166?source=api-prod","affected":[{"type":"plugin","slug":"easy-download-media-counter","name":"Easy Download Media Counter","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:37:49Z"},{"id":"wordfence:dce76d59-e798-4762-8247-eddebd38c165","source":"wordfence","cve":"CVE-2022-2276","title":"WP Edit Menu < 1.5.0 - Missing Authorization to Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce76d59-e798-4762-8247-eddebd38c165?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-menu","name":"WP Edit Menu","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dce7ec6a-aded-48eb-a682-a7fe7f07082b","source":"wordfence","cve":"CVE-2025-52739","title":"Sala <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce7ec6a-aded-48eb-a682-a7fe7f07082b?source=api-prod","affected":[{"type":"theme","slug":"sala","name":"Sala - Startup & SaaS WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-04T00:00:00Z","updated":"2026-01-05T18:19:12Z"},{"id":"wordfence:dce7ef19-8e6e-4512-84f5-89d53f05fad1","source":"wordfence","cve":"CVE-2026-81195","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce7ef19-8e6e-4512-84f5-89d53f05fad1?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:38:46Z"},{"id":"wordfence:dce89625-d00e-4f96-a7c4-2a215c1dfdeb","source":"wordfence","cve":"CVE-2024-49240","title":"AB Categories Search Widget  <= 0.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce89625-d00e-4f96-a7c4-2a215c1dfdeb?source=api-prod","affected":[{"type":"plugin","slug":"ab-categories-search-widget","name":"AB Categories Search Widget","from":"*","from_inclusive":true,"to":"0.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:50:24Z"},{"id":"wordfence:dce8ac32-cab8-4e05-bf6f-cc348d0c9472","source":"wordfence","cve":"CVE-2023-6747","title":"FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce8ac32-cab8-4e05-bf6f-cc348d0c9472?source=api-prod","affected":[{"type":"plugin","slug":"foogallery-premium","name":"FooGallery Premium","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4.6"},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:37:36Z"},{"id":"wordfence:dce917b5-d4d8-4d85-a249-2446386dbef6","source":"wordfence","cve":"CVE-2025-23654","title":"Twitter Post <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dce917b5-d4d8-4d85-a249-2446386dbef6?source=api-prod","affected":[{"type":"plugin","slug":"twitterpost","name":"Twitter Post","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:46:50Z"},{"id":"wordfence:dcea4ecf-e690-4d1f-beab-fbb30c5bb52e","source":"wordfence","cve":"CVE-2019-11223","title":"SupportCandy \u2013 Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcea4ecf-e690-4d1f-beab-fbb30c5bb52e?source=api-prod","affected":[{"type":"plugin","slug":"supportcandy","name":"SupportCandy \u2013 Helpdesk, Support Ticket System & AI Chatbot","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2019-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dceca4ee-6587-4eaa-974e-a21e7a10b6e8","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'logPageContent' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dceca4ee-6587-4eaa-974e-a21e7a10b6e8?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcef742e-2f1a-4bb3-a613-69b743b1e544","source":"wordfence","cve":"CVE-2026-25445","title":"Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcef742e-2f1a-4bb3-a613-69b743b1e544?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-08-17T04:31:49Z"},{"id":"wordfence:dcf38298-9ccf-4939-b764-f83dbca4d54e","source":"wordfence","cve":"CVE-2026-42733","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcf38298-9ccf-4939-b764-f83dbca4d54e?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-01T16:34:23Z"},{"id":"wordfence:dcf4a063-6954-4414-a2ee-d92f4192f4d4","source":"wordfence","cve":"CVE-2014-9337","title":"Mikiurl Wordpress Eklentisi <= 2.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcf4a063-6954-4414-a2ee-d92f4192f4d4?source=api-prod","affected":[{"type":"plugin","slug":"mikiurl-wordpress-eklentisi","name":"Mikiurl Wordpress Eklentisi","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcf54e27-e2d1-4d87-8eb6-2881054b70fe","source":"wordfence","cve":"CVE-2022-2559","title":"Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcf54e27-e2d1-4d87-8eb6-2881054b70fe?source=api-prod","affected":[{"type":"plugin","slug":"fluent-support","name":"Fluent Support \u2013 Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2022-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcf59d89-43e9-4bb2-be4f-9308698d1bb3","source":"wordfence","cve":"CVE-2023-25967","title":"Community by PeepSo <= 6.0.2.0 - Cross-Site Request Forgery leading to Plugin/Subscription Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcf59d89-43e9-4bb2-be4f-9308698d1bb3?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.0.2.0","to_inclusive":true,"patched_in":"6.0.3.0"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcfca0fe-5b15-4276-896a-9ad12b9a9478","source":"wordfence","cve":"CVE-2015-9506","title":"Easy Digital Downloads \u2013 Amazon S3 <= 2.1.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfca0fe-5b15-4276-896a-9ad12b9a9478?source=api-prod","affected":[{"type":"plugin","slug":"edd-amazon-s3","name":"Easy Digital Downloads - Amazon S3","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcfcb5e8-99e1-4dde-b62e-9f2bfc7db6ef","source":"wordfence","cve":"CVE-2024-49273","title":"ProfileGrid  <= 5.9.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfcb5e8-99e1-4dde-b62e-9f2bfc7db6ef?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.3","to_inclusive":true,"patched_in":"5.9.3.1"}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:41:33Z"},{"id":"wordfence:dcfd8c4d-d48b-468d-a7d5-1ec05b068f79","source":"wordfence","cve":"CVE-2020-36727","title":"Newsletter Manager <= 1.5.1 - Insecure Deserialization","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfd8c4d-d48b-468d-a7d5-1ec05b068f79?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-manager","name":"Newsletter Manager","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2020-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcfe3035-db43-499f-b09f-be528725b1d8","source":"wordfence","cve":"CVE-2015-9535","title":"Easy Digital Downloads \u2013 Shoppette Theme < 1.0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfe3035-db43-499f-b09f-be528725b1d8?source=api-prod","affected":[{"type":"theme","slug":"shoppette","name":"Shoppette","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dcfead67-d75d-46ae-ac68-a34643ac2f52","source":"wordfence","cve":"CVE-2024-0972","title":"BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfead67-d75d-46ae-ac68-a34643ac2f52?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-members-only","name":"BuddyPress Members Only","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2024-06-05T15:33:50Z","updated":"2024-08-09T14:10:41Z"},{"id":"wordfence:dcffa961-f670-494d-874c-50538038b915","source":"wordfence","cve":"CVE-2026-89081","title":"Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffa961-f670-494d-874c-50538038b915?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2026-09-18T14:04:02Z","updated":"2026-09-19T02:27:12Z"},{"id":"wordfence:dcffb564-464c-4cbc-afc3-0d92199e4547","source":"wordfence","cve":"CVE-2026-62050","title":"Splendour <= 1.23 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffb564-464c-4cbc-afc3-0d92199e4547?source=api-prod","affected":[{"type":"theme","slug":"splendour","name":"Splendour","from":"*","from_inclusive":true,"to":"1.23","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T07:28:12Z","updated":"2026-10-13T13:58:43Z"},{"id":"wordfence:dcffc816-ff56-4875-b234-91dd1d073721","source":"wordfence","cve":"CVE-2025-5123","title":"Contact Us Page \u2013 Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffc816-ff56-4875-b234-91dd1d073721?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:07:43Z","updated":"2025-06-13T01:47:50Z"},{"id":"wordfence:dd0054b5-537b-412f-8b10-8bbc9f2ea256","source":"wordfence","cve":"CVE-2020-6849","title":"Marketo Forms and Tracking <= 1.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0054b5-537b-412f-8b10-8bbc9f2ea256?source=api-prod","affected":[{"type":"plugin","slug":"marketo-forms-and-tracking","name":"Marketo Forms and Tracking","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2020-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd02becd-77e5-46b9-acc9-dba6c5caba27","source":"wordfence","cve":"","title":"LWS Plugins  <= (Various Versions) - Missing Authorization Checks","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd02becd-77e5-46b9-acc9-dba6c5caba27?source=api-prod","affected":[{"type":"plugin","slug":"lws-affiliation","name":"LWS Affiliation","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"lws-sms","name":"LWS SMS","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.5"},{"type":"plugin","slug":"lws-cleaner","name":"LWS Cleaner","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"lws-tools","name":"LWS Tools","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"},{"type":"plugin","slug":"lws-hide-login","name":"LWS Hide Login","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1"},{"type":"plugin","slug":"lws-optimize","name":"LWS Optimize \u2013 All-in-One Speed Booster & Cache Tools","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd040ff7-7f30-4097-9492-743a9821589e","source":"wordfence","cve":"CVE-2025-1690","title":"ThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd040ff7-7f30-4097-9492-743a9821589e?source=api-prod","affected":[{"type":"plugin","slug":"tmm_stripe_checkout","name":"ThemeMakers Stripe Checkout","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T08:22:03Z"},{"id":"wordfence:dd052762-5bd3-4008-b6b9-aca7be1151c2","source":"wordfence","cve":"CVE-2018-5655","title":"Weblizar Pin Feeds < 1.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd052762-5bd3-4008-b6b9-aca7be1151c2?source=api-prod","affected":[{"type":"plugin","slug":"weblizar-pinterest-feeds","name":"Weblizar Pin Feeds","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2018-11-13T00:00:00Z","updated":"2024-08-15T18:22:32Z"},{"id":"wordfence:dd056d29-3bd9-49e4-bcc4-fa487de8a27e","source":"wordfence","cve":"CVE-2025-6744","title":"Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd056d29-3bd9-49e4-bcc4-fa487de8a27e?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"8.2.3","to_inclusive":true,"patched_in":"8.2.4"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-08T09:22:30Z"},{"id":"wordfence:dd0597d2-07ba-4fb4-bf73-95770f8c3d6b","source":"wordfence","cve":"CVE-2024-5994","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0597d2-07ba-4fb4-bf73-95770f8c3d6b?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.38","to_inclusive":true,"patched_in":"9.0.39"}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-14T06:53:28Z"},{"id":"wordfence:dd072774-6f85-42de-a9d4-6826703ad839","source":"wordfence","cve":"CVE-2025-12714","title":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd072774-6f85-42de-a9d4-6826703ad839?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.271","to_inclusive":true,"patched_in":"1.0.271.1"}],"published":"2026-05-28T21:09:47Z","updated":"2026-05-29T09:28:08Z"},{"id":"wordfence:dd072cc6-cc32-40b2-af00-adef333d675a","source":"wordfence","cve":"CVE-2025-53299","title":"ThemeMakers Visual Content Composer <= 1.5.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd072cc6-cc32-40b2-af00-adef333d675a?source=api-prod","affected":[{"type":"plugin","slug":"tmm_content_composer","name":"ThemeMakers Visual Content Composer","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-08-25T18:14:45Z"},{"id":"wordfence:dd090b6b-e428-4bfa-b3d0-9fb6de92cf9d","source":"wordfence","cve":"CVE-2026-41471","title":"Easy PayPal Events & Tickets <= 1.3 - Insecure Direct Object Reference to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd090b6b-e428-4bfa-b3d0-9fb6de92cf9d?source=api-prod","affected":[{"type":"plugin","slug":"easy-paypal-events-tickets","name":"Easy PayPal Events & Tickets","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-05-04T00:00:00Z","updated":"2026-07-30T12:41:55Z"},{"id":"wordfence:dd0a4212-fe04-4c3b-9d78-b1a0bf97e274","source":"wordfence","cve":"CVE-2023-52230","title":"Booster Plus for WooCommerce < 7.1.3 - Missing Authorization to Arbitrary Options Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0a4212-fe04-4c3b-9d78-b1a0bf97e274?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":false,"patched_in":"7.1.3"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd0a7489-8e67-4bea-8071-c7f6ffa1b7ed","source":"wordfence","cve":"CVE-2025-48265","title":"Year Make Model Search for WooCommerce <= 1.0.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0a7489-8e67-4bea-8071-c7f6ffa1b7ed?source=api-prod","affected":[{"type":"plugin","slug":"ymm-search","name":"Year Make Model Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T17:13:54Z"},{"id":"wordfence:dd0e4753-222a-421f-a830-58f6af055dd8","source":"wordfence","cve":"CVE-2026-111727","title":"Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0e4753-222a-421f-a830-58f6af055dd8?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.05","to_inclusive":true,"patched_in":"1.4.06"}],"published":"2026-10-27T15:02:33Z","updated":"2026-10-28T03:42:54Z"},{"id":"wordfence:dd0eb569-b526-48bd-8198-ff883860e040","source":"wordfence","cve":"CVE-2024-12263","title":"Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd0eb569-b526-48bd-8198-ff883860e040?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-child-theme-creator","name":"Child Theme Creator by Orbisius","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T05:24:28Z"},{"id":"wordfence:dd108f90-7afc-43e1-86d4-939c1c25fb2d","source":"wordfence","cve":"","title":"IP Blacklist Cloud <= 5.00 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd108f90-7afc-43e1-86d4-939c1c25fb2d?source=api-prod","affected":[{"type":"plugin","slug":"ip-blacklist-cloud","name":"IP Blacklist Cloud","from":"*","from_inclusive":true,"to":"5.00","to_inclusive":true,"patched_in":""}],"published":"2022-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd112c38-e6c1-435c-b62d-8fab06e90eb6","source":"wordfence","cve":"","title":"videowall (All Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd112c38-e6c1-435c-b62d-8fab06e90eb6?source=api-prod","affected":[{"type":"plugin","slug":"videowall","name":"videowall","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd118053-b0f7-4fce-aa00-b0bb40778f21","source":"wordfence","cve":"CVE-2026-96039","title":"BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd118053-b0f7-4fce-aa00-b0bb40778f21?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.8.27","to_inclusive":true,"patched_in":"1.8.28"}],"published":"2026-09-24T18:07:26Z","updated":"2026-09-25T06:39:56Z"},{"id":"wordfence:dd1248b2-21ae-449e-acf8-3e5d6353f593","source":"wordfence","cve":"CVE-2014-9312","title":"Photo Gallery by 10Web <= 1.2.5 - Unrestricted File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1248b2-21ae-449e-acf8-3e5d6353f593?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2015-02-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd129829-9682-4def-a07f-66f9178eeb77","source":"wordfence","cve":"CVE-2025-5831","title":"Droip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd129829-9682-4def-a07f-66f9178eeb77?source=api-prod","affected":[{"type":"plugin","slug":"droip","name":"Droip","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":false,"patched_in":"2.5.2"}],"published":"2025-07-24T17:25:53Z","updated":"2025-12-19T15:46:42Z"},{"id":"wordfence:dd1335cd-dc12-4699-9c57-900ba50aeef5","source":"wordfence","cve":"CVE-2025-64191","title":"XStore < 9.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1335cd-dc12-4699-9c57-900ba50aeef5?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.6.1","to_inclusive":false,"patched_in":"9.6.1"}],"published":"2025-09-10T00:00:00Z","updated":"2025-12-20T19:02:00Z"},{"id":"wordfence:dd13eb67-3bd5-41c4-a47f-5f55656ea5b9","source":"wordfence","cve":"CVE-2025-12475","title":"Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd13eb67-3bd5-41c4-a47f-5f55656ea5b9?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2025-10-06T00:00:00Z","updated":"2025-10-30T04:26:03Z"},{"id":"wordfence:dd15c7c8-6538-4443-a409-0d34ff893963","source":"wordfence","cve":"CVE-2024-8662","title":"Koko Analytics <= 1.3.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd15c7c8-6538-4443-a409-0d34ff893963?source=api-prod","affected":[{"type":"plugin","slug":"koko-analytics","name":"Koko Analytics \u2013 Privacy-Friendly WordPress Analytics","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":true,"patched_in":"1.3.13"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T01:56:49Z"},{"id":"wordfence:dd163f14-c638-4185-8e14-f3a03312ee42","source":"wordfence","cve":"CVE-2022-3220","title":"Advanced Comment Form <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd163f14-c638-4185-8e14-f3a03312ee42?source=api-prod","affected":[{"type":"plugin","slug":"comment-form","name":"Advanced Comment Form","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd182b9b-30c6-47cd-8e84-ea7caf1b25ee","source":"wordfence","cve":"CVE-2026-28033","title":"Edifice <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd182b9b-30c6-47cd-8e84-ea7caf1b25ee?source=api-prod","affected":[{"type":"theme","slug":"edifice","name":"Edifice","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:06:56Z"},{"id":"wordfence:dd1b6b89-6c3c-4956-aa99-798ce186eb97","source":"wordfence","cve":"CVE-2022-3823","title":"Beautiful Cookie Consent Banner <= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1b6b89-6c3c-4956-aa99-798ce186eb97?source=api-prod","affected":[{"type":"plugin","slug":"beautiful-and-responsive-cookie-consent","name":"Beautiful Cookie Consent Banner","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2022-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd1d8aaa-eea0-4723-b9fa-b32d4d7c022e","source":"wordfence","cve":"CVE-2025-28919","title":"Easy Image Display <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1d8aaa-eea0-4723-b9fa-b32d4d7c022e?source=api-prod","affected":[{"type":"plugin","slug":"easy-image-display","name":"Easy Image Display","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:00:08Z"},{"id":"wordfence:dd1fc16c-f36b-4c39-916d-36833630729e","source":"wordfence","cve":"CVE-2026-85410","title":"Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd1fc16c-f36b-4c39-916d-36833630729e?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-09-17T19:54:33Z","updated":"2026-09-18T08:28:32Z"},{"id":"wordfence:dd201949-d3a1-4fdb-bf98-252fbfd59380","source":"wordfence","cve":"CVE-2025-14745","title":"RSS Aggregator \u2013 RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd201949-d3a1-4fdb-bf98-252fbfd59380?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-aggregator","name":"WP RSS Aggregator \u2013 RSS Import, Feed to Post, Autoblogging, AI Content","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-01-22T17:08:48Z","updated":"2026-01-23T05:29:53Z"},{"id":"wordfence:dd203abf-689e-44d3-9194-dba60f1ca4b2","source":"wordfence","cve":"CVE-2026-74916","title":"WP Fastest Cache \u2013 WordPress Cache Plugin 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd203abf-689e-44d3-9194-dba60f1ca4b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"0.8.7.7","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-09T14:14:28Z"},{"id":"wordfence:dd22276b-41d4-4795-a79e-d770d0cf4b76","source":"wordfence","cve":"CVE-2021-31157","title":"WPGraphQL <= 1.3.5 - Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd22276b-41d4-4795-a79e-d770d0cf4b76?source=api-prod","affected":[{"type":"plugin","slug":"wp-graphql","name":"WPGraphQL","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2021-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd248b4b-e7a6-4997-81d8-1d163cd85a9b","source":"wordfence","cve":"CVE-2024-31383","title":"PopularFX <= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd248b4b-e7a6-4997-81d8-1d163cd85a9b?source=api-prod","affected":[{"type":"theme","slug":"popularfx","name":"PopularFX","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:56:41Z"},{"id":"wordfence:dd26a390-0de5-4699-a790-cac86bf4a057","source":"wordfence","cve":"CVE-2026-5510","title":"GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd26a390-0de5-4699-a790-cac86bf4a057?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.14.4","to_inclusive":true,"patched_in":"4.14.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-08-28T07:40:17Z"},{"id":"wordfence:dd27aeb9-4257-4b15-8f14-8a8c89522c32","source":"wordfence","cve":"CVE-2023-2399","title":"QuBotChat <= 1.1.5 - Unauthenticated Self-Based Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd27aeb9-4257-4b15-8f14-8a8c89522c32?source=api-prod","affected":[{"type":"plugin","slug":"qubotchat","name":"QuBot \u2013 Chatbot Builder with Templates","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd2d1562-2017-45d1-bbd1-46ffd610e7ac","source":"wordfence","cve":"CVE-2026-13176","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd2d1562-2017-45d1-bbd1-46ffd610e7ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.21","to_inclusive":false,"patched_in":"4.1.21"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:08:02Z"},{"id":"wordfence:dd2d82f4-1493-4829-a4e9-adbb98301324","source":"wordfence","cve":"CVE-2022-0827","title":"Bestbooks <= 2.6.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd2d82f4-1493-4829-a4e9-adbb98301324?source=api-prod","affected":[{"type":"plugin","slug":"bestbooks","name":"Bestbooks","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd2ec0b3-2784-4506-99f4-05187527fe6d","source":"wordfence","cve":"CVE-2025-1571","title":"Exclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd2ec0b3-2784-4506-99f4-05187527fe6d?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-02-27T18:56:22Z","updated":"2025-02-28T07:03:47Z"},{"id":"wordfence:dd300737-dda4-4ed3-b21f-0407a5e32a05","source":"wordfence","cve":"CVE-2023-46192","title":"Internal Link Building <= 1.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd300737-dda4-4ed3-b21f-0407a5e32a05?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-building-plugin","name":"Internal Link Building","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd321fd7-1f3a-4d1c-b832-69423a35fad5","source":"wordfence","cve":"CVE-2026-13247","title":"Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd321fd7-1f3a-4d1c-b832-69423a35fad5?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.5.4"}],"published":"2026-07-09T20:55:09Z","updated":"2026-07-10T09:32:45Z"},{"id":"wordfence:dd340ecc-d698-43e1-a15c-479088fb8cf4","source":"wordfence","cve":"CVE-2024-33591","title":"Easy Accept Payments <= 4.9.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd340ecc-d698-43e1-a15c-479088fb8cf4?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-easy-paypal-payment-or-donation-accept-plugin","name":"Easy Accept Payments via PayPal","from":"*","from_inclusive":true,"to":"4.9.10","to_inclusive":true,"patched_in":"5.0"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:25:13Z"},{"id":"wordfence:dd35a017-3b80-483d-8144-3986ea064669","source":"wordfence","cve":"CVE-2025-7821","title":"WC Plus <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd35a017-3b80-483d-8144-3986ea064669?source=api-prod","affected":[{"type":"plugin","slug":"wc-plus","name":"WC Plus","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:49:19Z","updated":"2025-08-23T04:25:48Z"},{"id":"wordfence:dd36f50b-f9c9-4ca2-81ed-a4e20fc38e82","source":"wordfence","cve":"CVE-2024-37460","title":"SuperSaaS \u2013 online appointment scheduling <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd36f50b-f9c9-4ca2-81ed-a4e20fc38e82?source=api-prod","affected":[{"type":"plugin","slug":"supersaas-appointment-scheduling","name":"SuperSaaS \u2013 online appointment scheduling","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:16:11Z"},{"id":"wordfence:dd389d3b-046c-41cb-a077-7dcb9fd50eda","source":"wordfence","cve":"CVE-2026-48839","title":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd389d3b-046c-41cb-a077-7dcb9fd50eda?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.16.6","to_inclusive":true,"patched_in":"14.16.7"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-01T16:18:16Z"},{"id":"wordfence:dd3a198c-7c24-45b1-95a7-eb16472a51e2","source":"wordfence","cve":"CVE-2024-9435","title":"ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd3a198c-7c24-45b1-95a7-eb16472a51e2?source=api-prod","affected":[{"type":"plugin","slug":"shiftcontroller","name":"ShiftController Employee Shift Scheduling","from":"*","from_inclusive":true,"to":"4.9.66","to_inclusive":true,"patched_in":"4.9.67"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T06:48:42Z"},{"id":"wordfence:dd3aa31d-58ba-4634-b0e2-b2b4339cb191","source":"wordfence","cve":"CVE-2026-103347","title":"hCaptcha for WP <= 5.3.0 - Unauthenticated Captcha Verification Bypass","severity":"high","cvss":7.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd3aa31d-58ba-4634-b0e2-b2b4339cb191?source=api-prod","affected":[{"type":"plugin","slug":"hcaptcha-for-forms-and-more","name":"hCaptcha for WP","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T12:39:14Z"},{"id":"wordfence:dd3ac29b-1cdf-4de5-bcb9-a97c3f62058d","source":"wordfence","cve":"CVE-2026-93775","title":"Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd3ac29b-1cdf-4de5-bcb9-a97c3f62058d?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2026-10-09T17:26:40Z","updated":"2026-10-10T05:31:06Z"},{"id":"wordfence:dd3bfdc0-8e1b-49e9-b800-cb2dde2d5acb","source":"wordfence","cve":"CVE-2016-10908","title":"Booking Calendar Contact Form <= 1.0.23 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd3bfdc0-8e1b-49e9-b800-cb2dde2d5acb?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2016-02-08T00:00:00Z","updated":"2026-07-29T16:45:27Z"},{"id":"wordfence:dd3fc3a4-ba32-4c05-bc93-ed7b86c426fa","source":"wordfence","cve":"","title":"Contact Form 7 extension for Google Map fields <= 1.8.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd3fc3a4-ba32-4c05-bc93-ed7b86c426fa?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-map","name":"Contact Form 7 extension for Google Map fields","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd40d6dd-37e8-4f42-9feb-b62830a0c37d","source":"wordfence","cve":"CVE-2024-54307","title":"AIcomments <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd40d6dd-37e8-4f42-9feb-b62830a0c37d?source=api-prod","affected":[{"type":"plugin","slug":"aicomments","name":"AIcomments \u2013 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0438 \u043e\u0442\u0437\u044b\u0432\u044b ChatGPT","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:48:27Z"},{"id":"wordfence:dd42c83c-c51c-45a5-8ad5-0df2c0cc411d","source":"wordfence","cve":"CVE-2025-7360","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd42c83c-c51c-45a5-8ad5-0df2c0cc411d?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-07-14T15:58:43Z","updated":"2025-07-22T16:16:40Z"},{"id":"wordfence:dd4719c5-c9ad-42b2-adb8-9dc4d79406ab","source":"wordfence","cve":"CVE-2026-28071","title":"pixfort Core <= 3.2.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4719c5-c9ad-42b2-adb8-9dc4d79406ab?source=api-prod","affected":[{"type":"plugin","slug":"pixfort-core","name":"Pixfort Core","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:03:10Z"},{"id":"wordfence:dd4b2396-288f-45e6-b911-b017dc8d0526","source":"wordfence","cve":"CVE-2026-76780","title":"BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4b2396-288f-45e6-b911-b017dc8d0526?source=api-prod","affected":[{"type":"plugin","slug":"beyondseo","name":"BeyondSEO \u2013 AI SEO to Improve Rankings, Listings & Online Visibility","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2026-10-27T18:12:01Z","updated":"2026-10-28T06:45:21Z"},{"id":"wordfence:dd4d19ec-b4c2-471b-9db4-75b03ffca4ff","source":"wordfence","cve":"CVE-2026-94159","title":"Total Donations <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4d19ec-b4c2-471b-9db4-75b03ffca4ff?source=api-prod","affected":[{"type":"plugin","slug":"totaldonations","name":"Total Donations","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T00:00:00Z","updated":"2026-10-09T15:31:41Z"},{"id":"wordfence:dd4d7c44-890c-4560-b637-cdc0ca00de31","source":"wordfence","cve":"CVE-2013-2694","title":"WP Symposium <= 13.04 - Open Redirection","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4d7c44-890c-4560-b637-cdc0ca00de31?source=api-prod","affected":[{"type":"plugin","slug":"wp-symposium","name":"WP Symposium","from":"*","from_inclusive":true,"to":"13.04","to_inclusive":true,"patched_in":"13.05"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd4db15f-e574-48f1-9e8d-bc1829035e6c","source":"wordfence","cve":"CVE-2024-54308","title":"Cryptocurrency Price Widget <= 1.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4db15f-e574-48f1-9e8d-bc1829035e6c?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-price-widget","name":"Cryptocurrency Price Widget","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:50:02Z"},{"id":"wordfence:dd4f0925-e3bf-4014-af05-b0d193b06493","source":"wordfence","cve":"CVE-2026-57767","title":"WP Google Maps Pro <= 10.1.02 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd4f0925-e3bf-4014-af05-b0d193b06493?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps-pro","name":"WP Google Maps Pro","from":"*","from_inclusive":true,"to":"10.1.02","to_inclusive":true,"patched_in":"10.1.03"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-16T17:07:22Z"},{"id":"wordfence:dd52a6b2-8241-444c-9db7-c5a57576de5e","source":"wordfence","cve":"CVE-2025-58224","title":"Printeers Print & Ship <= 1.17.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd52a6b2-8241-444c-9db7-c5a57576de5e?source=api-prod","affected":[{"type":"plugin","slug":"invition-print-ship","name":"Printeers Print & Ship","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:34:27Z"},{"id":"wordfence:dd56cb73-1c40-44b1-b713-c0291832d988","source":"wordfence","cve":"CVE-2023-3053","title":"Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd56cb73-1c40-44b1-b713-c0291832d988?source=api-prod","affected":[{"type":"plugin","slug":"page-builder-by-azexo","name":"Page Builder with Image Map by AZEXO","from":"*","from_inclusive":true,"to":"1.27.133","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd58a528-4c01-407d-b3f9-99c0817e9820","source":"wordfence","cve":"CVE-2018-20555","title":"Social Network Tabs - Social Media API Key Leakage <= 1.7.1 - Information Exposure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd58a528-4c01-407d-b3f9-99c0817e9820?source=api-prod","affected":[{"type":"plugin","slug":"social-network-tabs","name":"Social Network Tabs","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2019-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd5b0c3a-0dd0-440f-b3a5-6d80f70e0f7c","source":"wordfence","cve":"CVE-2012-4033","title":"Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities","severity":"critical","cvss":9.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd5b0c3a-0dd0-440f-b3a5-6d80f70e0f7c?source=api-prod","affected":[{"type":"plugin","slug":"zingiri-web-shop","name":"zingiri-web-shop","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"}],"published":"2012-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd62a072-8619-4f51-a52f-2ada7e455cb1","source":"wordfence","cve":"CVE-2025-1064","title":"Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd62a072-8619-4f51-a52f-2ada7e455cb1?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T08:22:07Z"},{"id":"wordfence:dd6316c6-7498-4c2d-b344-055952e1485b","source":"wordfence","cve":"CVE-2026-124250","title":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory <= 2.8.202 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6316c6-7498-4c2d-b344-055952e1485b?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.202","to_inclusive":true,"patched_in":"2.8.203"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:43Z"},{"id":"wordfence:dd658a45-6fd7-4d4e-8a0e-7091accdb3ad","source":"wordfence","cve":"CVE-2026-22380","title":"UnlimHost <= 1.2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd658a45-6fd7-4d4e-8a0e-7091accdb3ad?source=api-prod","affected":[{"type":"theme","slug":"unlimhost","name":"UnlimHost - Web Hosting & Internet Technology WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:28:38Z"},{"id":"wordfence:dd6a0e26-b046-4f75-b84e-3d7ebdb8cdde","source":"wordfence","cve":"CVE-2026-39741","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.44.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6a0e26-b046-4f75-b84e-3d7ebdb8cdde?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.44.0","to_inclusive":true,"patched_in":"1.44.1"}],"published":"2026-10-29T13:05:00Z","updated":"2026-11-03T19:56:32Z"},{"id":"wordfence:dd6b5d6d-5f5b-4b38-a25a-02cc1c041d37","source":"wordfence","cve":"CVE-2023-2555","title":"WPCS \u2013 WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6b5d6d-5f5b-4b38-a25a-02cc1c041d37?source=api-prod","affected":[{"type":"plugin","slug":"currency-switcher","name":"WPCS \u2013 WordPress Currency Switcher Professional","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd6becbf-29cc-4744-8c9b-5b75f8c5f402","source":"wordfence","cve":"CVE-2021-25002","title":"Tipsacarrier < 1.5.0.5 - Missing Authorization to Order Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6becbf-29cc-4744-8c9b-5b75f8c5f402?source=api-prod","affected":[{"type":"plugin","slug":"tipsacarrier","name":"Tipsacarrier","from":"*","from_inclusive":true,"to":"1.5.0.5","to_inclusive":false,"patched_in":"1.5.0.5"}],"published":"2022-04-13T00:00:00Z","updated":"2024-07-02T15:11:22Z"},{"id":"wordfence:dd6df4fa-01b8-460f-b414-bb07fbc0436a","source":"wordfence","cve":"CVE-2019-12516","title":"SlickQuiz <= 1.3.7.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6df4fa-01b8-460f-b414-bb07fbc0436a?source=api-prod","affected":[{"type":"plugin","slug":"slickquiz","name":"SlickQuiz","from":"*","from_inclusive":true,"to":"1.3.7.1","to_inclusive":true,"patched_in":""}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd6fdc7f-10b9-40e7-a089-1efa2b64165e","source":"wordfence","cve":"CVE-2025-58803","title":"Algenix <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd6fdc7f-10b9-40e7-a089-1efa2b64165e?source=api-prod","affected":[{"type":"theme","slug":"algenix","name":"Algenix - IT Solutions & Digital Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:29:11Z"},{"id":"wordfence:dd718d44-4921-4deb-af5a-43e5f3926914","source":"wordfence","cve":"CVE-2024-8615","title":"WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd718d44-4921-4deb-af5a-43e5f3926914?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2024-11-05T19:58:12Z","updated":"2024-11-06T08:29:57Z"},{"id":"wordfence:dd7312ec-9654-4ddc-aec6-71c7e684fac0","source":"wordfence","cve":"CVE-2023-1347","title":"Customizer Export/Import <= 0.9.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7312ec-9654-4ddc-aec6-71c7e684fac0?source=api-prod","affected":[{"type":"plugin","slug":"customizer-export-import","name":"Customizer Export/Import","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":"0.9.6"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd731533-e2cd-4604-8d7a-145a0d1aadc6","source":"wordfence","cve":"CVE-2024-4957","title":"Frontend Checklist <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd731533-e2cd-4604-8d7a-145a0d1aadc6?source=api-prod","affected":[{"type":"plugin","slug":"frontend-checklist","name":"Frontend Checklist","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:32:17Z"},{"id":"wordfence:dd75b8ec-1961-4a7a-92e6-1517e638974b","source":"wordfence","cve":"CVE-2025-12158","title":"Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd75b8ec-1961-4a7a-92e6-1517e638974b?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-capabilities","name":"Simple User Capabilities","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:33:31Z","updated":"2025-11-04T04:27:22Z"},{"id":"wordfence:dd773571-1f30-4b2b-8a0a-dde3ee1c53d9","source":"wordfence","cve":"CVE-2026-24594","title":"Livemesh Addons for WPBakery Page Builder <= 3.9.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd773571-1f30-4b2b-8a0a-dde3ee1c53d9?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-27T19:24:11Z"},{"id":"wordfence:dd776106-2ec6-4813-946c-36e62a32d7df","source":"wordfence","cve":"CVE-2025-46264","title":"PowerPress Podcasting plugin by Blubrry <= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd776106-2ec6-4813-946c-36e62a32d7df?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.12.5","to_inclusive":true,"patched_in":"11.12.6"}],"published":"2025-04-23T00:00:00Z","updated":"2025-05-01T20:10:44Z"},{"id":"wordfence:dd77f939-cd1c-4624-9a0c-d8f89a8e5221","source":"wordfence","cve":"CVE-2024-34442","title":"weDocs <= 2.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd77f939-cd1c-4624-9a0c-d8f89a8e5221?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:20:58Z"},{"id":"wordfence:dd784fce-67a1-4740-9b0e-dcf54342f018","source":"wordfence","cve":"CVE-2024-32441","title":"Zoho Campaigns <= 2.0.7 - Cross-Site Request Forgery via zcwc_optin_save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd784fce-67a1-4740-9b0e-dcf54342f018?source=api-prod","affected":[{"type":"plugin","slug":"zoho-campaigns","name":"Zoho Campaigns","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T21:08:46Z"},{"id":"wordfence:dd799c2a-e26b-4362-8f7f-dbcbfe3bfe10","source":"wordfence","cve":"CVE-2025-53234","title":"UDesign Core <= 4.14.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd799c2a-e26b-4362-8f7f-dbcbfe3bfe10?source=api-prod","affected":[{"type":"plugin","slug":"u-design-core","name":"uDesign | Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-06T00:00:00Z","updated":"2025-10-29T20:00:38Z"},{"id":"wordfence:dd7a5a36-0e78-4fdc-b159-b4cc89cd3ffb","source":"wordfence","cve":"","title":"My Page Order <= 4.3 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7a5a36-0e78-4fdc-b159-b4cc89cd3ffb?source=api-prod","affected":[{"type":"plugin","slug":"my-page-order","name":"My Page Order","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2015-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd7b72bb-2cf7-4a8d-b323-66c94b500cb0","source":"wordfence","cve":"CVE-2022-2198","title":"WPQA - Builder forms Addon For WordPress < 5.7 - Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7b72bb-2cf7-4a8d-b323-66c94b500cb0?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.7","to_inclusive":false,"patched_in":"5.7"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3","source":"wordfence","cve":"CVE-2024-4390","title":"Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation","severity":"medium","cvss":6.5,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-06-19T14:33:29Z","updated":"2024-06-20T03:37:23Z"},{"id":"wordfence:dd7d3afd-6648-4ffb-85a9-cd5a6096963e","source":"wordfence","cve":"CVE-2023-31076","title":"Zip Recipes <= 8.0.6 - Reflected Cross-Site Scripting via 's' parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7d3afd-6648-4ffb-85a9-cd5a6096963e?source=api-prod","affected":[{"type":"plugin","slug":"zip-recipes","name":"Recipe Cards For Your Food Blog from Zip Recipes","from":"*","from_inclusive":true,"to":"8.0.7","to_inclusive":false,"patched_in":"8.0.7"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd7db465-ebeb-477b-b6c8-a9b89ba2372b","source":"wordfence","cve":"","title":"MC4WP: Mailchimp for WordPress <= 4.8.4 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7db465-ebeb-477b-b6c8-a9b89ba2372b?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2021-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd7f112b-9c16-4bc0-a3fa-caeca3d40752","source":"wordfence","cve":"CVE-2024-56262","title":"GS Coaches <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7f112b-9c16-4bc0-a3fa-caeca3d40752?source=api-prod","affected":[{"type":"plugin","slug":"gs-coach","name":"GS Coach \u2013 Coach Profiles & Coach Directory for Coaches, Trainers and Consultants","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:12:15Z"},{"id":"wordfence:dd7f3a48-d851-4533-967c-f0aa98bb85d1","source":"wordfence","cve":"CVE-2024-56220","title":"SSL Wireless SMS Notification <= 3.6.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7f3a48-d851-4533-967c-f0aa98bb85d1?source=api-prod","affected":[{"type":"plugin","slug":"ssl-wireless-sms-notification","name":"SSL Wireless SMS Notification","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-12-19T00:00:00Z","updated":"2025-02-25T14:36:43Z"},{"id":"wordfence:dd7f7da1-0c43-4949-b19d-db0b30f3976a","source":"wordfence","cve":"CVE-2026-105062","title":"WP Admin Audit <= 1.2.17 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7f7da1-0c43-4949-b19d-db0b30f3976a?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-audit","name":"WP Admin Audit","from":"*","from_inclusive":true,"to":"1.2.17","to_inclusive":true,"patched_in":"1.2.18"}],"published":"2026-10-05T08:39:00Z","updated":"2026-10-08T23:14:49Z"},{"id":"wordfence:dd805cb5-45ce-4213-b313-d9e300527265","source":"wordfence","cve":"CVE-2024-33571","title":"VOD Infomaniak <= 1.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd805cb5-45ce-4213-b313-d9e300527265?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-04-25T00:00:00Z","updated":"2025-10-08T21:01:32Z"},{"id":"wordfence:dd80abd9-3f41-414a-a781-9bff7d85ec4b","source":"wordfence","cve":"CVE-2025-1530","title":"Tripetto <= 8.0.9 - Cross-Site Request Forgery to Arbitrary Results Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.9","to_inclusive":true,"patched_in":"8.0.10"}],"published":"2025-03-14T22:58:21Z","updated":"2025-03-15T11:13:30Z"},{"id":"wordfence:dd847af9-ad71-4171-adb1-f38e2acf16d5","source":"wordfence","cve":"CVE-2025-48311","title":"Invisible Optin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd847af9-ad71-4171-adb1-f38e2acf16d5?source=api-prod","affected":[{"type":"plugin","slug":"invisible-optin","name":"Invisible Optin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T19:53:02Z"},{"id":"wordfence:dd86d46d-f418-4f01-9416-ee2baba08d72","source":"wordfence","cve":"CVE-2025-26541","title":"Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd86d46d-f418-4f01-9416-ee2baba08d72?source=api-prod","affected":[{"type":"plugin","slug":"woo-altcoin-payment-gateway","name":"Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:16:38Z"},{"id":"wordfence:dd87f789-dd71-4274-a836-e9af230161e5","source":"wordfence","cve":"CVE-2025-22732","title":"Ad Blocking Detector <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd87f789-dd71-4274-a836-e9af230161e5?source=api-prod","affected":[{"type":"plugin","slug":"ad-blocking-detector","name":"Ad Blocking Detector","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-22T15:00:24Z"},{"id":"wordfence:dd8c077c-214d-4885-a427-559511f54485","source":"wordfence","cve":"CVE-2025-58263","title":"BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8c077c-214d-4885-a427-559511f54485?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-notifications-widget","name":"BuddyPress Notification Widget","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:41:03Z"},{"id":"wordfence:dd8c45c7-dbb2-46ab-8e50-e02062587b00","source":"wordfence","cve":"CVE-2025-15376","title":"Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8c45c7-dbb2-46ab-8e50-e02062587b00?source=api-prod","affected":[{"type":"plugin","slug":"stopwords-for-comments","name":"Stopwords for comments","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:31:19Z","updated":"2026-01-14T06:40:08Z"},{"id":"wordfence:dd8e9153-d84d-4510-9cc7-d24e56fd01db","source":"wordfence","cve":"CVE-2025-49388","title":"Miraculous Core <= 2.0.7 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8e9153-d84d-4510-9cc7-d24e56fd01db?source=api-prod","affected":[{"type":"plugin","slug":"miraculouscore","name":"Miraculous Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:31:37Z"},{"id":"wordfence:dd8f348d-07ff-480d-bcc1-fb39aead1b1d","source":"wordfence","cve":"","title":"Folo (Unknown Versions) - Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8f348d-07ff-480d-bcc1-fb39aead1b1d?source=api-prod","affected":[{"type":"theme","slug":"folo","name":"Folo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd8f355b-736b-442a-917e-9fa603abb853","source":"wordfence","cve":"CVE-2022-26375","title":"AB Press Optimizer <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8f355b-736b-442a-917e-9fa603abb853?source=api-prod","affected":[{"type":"plugin","slug":"ab-press-optimizer-lite","name":"AB Press Optimizer","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2022-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd8f5cfa-3431-4617-b2cd-d5a8ce4530f4","source":"wordfence","cve":"CVE-2024-3714","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8f5cfa-3431-4617-b2cd-d5a8ce4530f4?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2024-05-17T16:06:14Z","updated":"2024-05-18T04:30:53Z"},{"id":"wordfence:dd9050fe-2cb9-46b3-8bc2-6d38e9c21938","source":"wordfence","cve":"CVE-2026-122085","title":"Event Tickets Manager for WooCommerce <= 1.5.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9050fe-2cb9-46b3-8bc2-6d38e9c21938?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-manager-for-woocommerce","name":"Event Tickets Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:52:36Z"},{"id":"wordfence:dd93ef08-b4cf-4e50-b2db-88b101b146f4","source":"wordfence","cve":"CVE-2026-48869","title":"Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd93ef08-b4cf-4e50-b2db-88b101b146f4?source=api-prod","affected":[{"type":"theme","slug":"enfold","name":"enfold","from":"*","from_inclusive":true,"to":"7.1.4","to_inclusive":true,"patched_in":"7.1.5"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-08T14:38:00Z"},{"id":"wordfence:dd9548bd-4064-4ef8-9f35-5d05bba7f190","source":"wordfence","cve":"CVE-2025-23717","title":"Theme My Ontraport Smartform <= 1.2.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9548bd-4064-4ef8-9f35-5d05bba7f190?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-ontraport-smartform","name":"Theme My Ontraport Smartform","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:45:45Z"},{"id":"wordfence:dd9650e6-7c3c-4510-9749-a3503924855f","source":"wordfence","cve":"CVE-2026-9134","title":"Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9650e6-7c3c-4510-9749-a3503924855f?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"3.1.31","to_inclusive":true,"patched_in":"3.1.32"}],"published":"2026-06-12T18:03:23Z","updated":"2026-09-22T18:43:56Z"},{"id":"wordfence:dd977321-f901-4854-bba1-fc729dda688c","source":"wordfence","cve":"CVE-2024-51919","title":"Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd977321-f901-4854-bba1-fc729dda688c?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2025-01-03T00:00:00Z","updated":"2025-12-04T20:38:15Z"},{"id":"wordfence:dd979c94-f6e7-4edd-b2c5-0880ed13e9b0","source":"wordfence","cve":"CVE-2024-47367","title":"YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd979c94-f6e7-4edd-b2c5-0880ed13e9b0?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.13.1"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:43:16Z"},{"id":"wordfence:dd9826d7-f8f5-4d3d-8145-3d4e6a63d784","source":"wordfence","cve":"CVE-2020-36757","title":"WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9826d7-f8f5-4d3d-8145-3d4e6a63d784?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":false,"patched_in":"1.10.2"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd9a4fa5-17b0-41dc-94f9-b07ada23a6e1","source":"wordfence","cve":"CVE-2026-119158","title":"Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9a4fa5-17b0-41dc-94f9-b07ada23a6e1?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.8.4.16","to_inclusive":true,"patched_in":"3.8.4.17"}],"published":"2026-11-06T15:16:20Z","updated":"2026-11-07T03:28:07Z"},{"id":"wordfence:dd9b590d-892d-4175-b9f5-edd8e866c501","source":"wordfence","cve":"CVE-2026-97282","title":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9b590d-892d-4175-b9f5-edd8e866c501?source=api-prod","affected":[{"type":"plugin","slug":"review-schema","name":"SchemaEngine AI \u2013 AI Schema Markup, Reviews & Rich Snippets for SEO","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:28:36Z"},{"id":"wordfence:dd9d22b0-a84a-4bf2-b8b4-89bae2970f29","source":"wordfence","cve":"CVE-2023-4423","title":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.37.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9d22b0-a84a-4bf2-b8b4-89bae2970f29?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.37.1","to_inclusive":true,"patched_in":"3.1.38"}],"published":"2023-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8","source":"wordfence","cve":"CVE-2025-3056","title":"Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2025-04-17T19:29:16Z","updated":"2025-04-18T08:21:47Z"},{"id":"wordfence:dd9f10c6-911e-41d2-b1fe-e0cce9c48b48","source":"wordfence","cve":"CVE-2026-66698","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9f10c6-911e-41d2-b1fe-e0cce9c48b48?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T19:05:07Z"},{"id":"wordfence:dda29d6a-78e0-4f3d-81e7-1e7adad056cb","source":"wordfence","cve":"CVE-2026-104953","title":"MPG <= 4.2.2 - Authenticated (Editor+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dda29d6a-78e0-4f3d-81e7-1e7adad056cb?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:28:31Z"},{"id":"wordfence:dda2c437-8f41-480a-8816-2c07ab0eafa7","source":"wordfence","cve":"CVE-2024-12296","title":"Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dda2c437-8f41-480a-8816-2c07ab0eafa7?source=api-prod","affected":[{"type":"plugin","slug":"apus-framework","name":"Apus Framework","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-02-11T00:00:00Z","updated":"2026-01-27T22:32:04Z"},{"id":"wordfence:dda43cdd-f0bb-4448-a067-1c9fb07b88ea","source":"wordfence","cve":"CVE-2025-53452","title":"Event Rocket <= 3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dda43cdd-f0bb-4448-a067-1c9fb07b88ea?source=api-prod","affected":[{"type":"plugin","slug":"event-rocket","name":"Event Rocket","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:41:02Z"},{"id":"wordfence:dda74c05-54f0-4bb5-90af-9b1256021afa","source":"wordfence","cve":"CVE-2024-37545","title":"Floating Social Media Links <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dda74c05-54f0-4bb5-90af-9b1256021afa?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-media-links","name":"Floating Social Media Links","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-06T00:00:00Z","updated":"2024-07-10T14:33:32Z"},{"id":"wordfence:dda9aa4a-bac7-4aa1-b0c3-c8e37b1fbe70","source":"wordfence","cve":"CVE-2023-40202","title":"WP HTML Mail <= 3.4.0 - Cross-Site Request Forgery via 'send_test'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dda9aa4a-bac7-4aa1-b0c3-c8e37b1fbe70?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-mail","name":"Email Template Designer \u2013 WP HTML Mail","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddacd612-0cd5-4b07-9184-bec6f1adbb4c","source":"wordfence","cve":"CVE-2023-47761","title":"Simple 301 Redirects by BetterLinks <= 2.0.7 - Missing Authorization via clicked","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddacd612-0cd5-4b07-9184-bec6f1adbb4c?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddad1317-8152-4532-b0e8-b31d77021916","source":"wordfence","cve":"CVE-2025-49297","title":"Grill and Chow <= 1.6 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddad1317-8152-4532-b0e8-b31d77021916?source=api-prod","affected":[{"type":"theme","slug":"grillandchow","name":"Grill and Chow - Fast Food & Pizza WordPress Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-25T19:30:42Z"},{"id":"wordfence:ddad22fb-0b41-4c8f-b35d-21692e3a9908","source":"wordfence","cve":"CVE-2024-54423","title":"Social Media Sharing <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddad22fb-0b41-4c8f-b35d-21692e3a9908?source=api-prod","affected":[{"type":"plugin","slug":"social-media-sharing","name":"Social Media Sharing","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T13:58:39Z"},{"id":"wordfence:ddaed8e7-4a5e-440e-9a5f-4a92b3f63783","source":"wordfence","cve":"CVE-2025-32672","title":"Ultimate Bootstrap Elements for Elementor <= 1.4.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddaed8e7-4a5e-440e-9a5f-4a92b3f63783?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T14:22:41Z"},{"id":"wordfence:ddb2290d-d4bd-4f70-9fe9-927f49721811","source":"wordfence","cve":"CVE-2026-8382","title":"Advanced Custom Fields (ACF\u00ae) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb2290d-d4bd-4f70-9fe9-927f49721811?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.8.2"}],"published":"2026-05-30T14:23:34Z","updated":"2026-05-31T02:28:00Z"},{"id":"wordfence:ddb5020f-0480-4123-b064-4f33ae142a5c","source":"wordfence","cve":"CVE-2025-68533","title":"WC Builder <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb5020f-0480-4123-b064-4f33ae142a5c?source=api-prod","affected":[{"type":"plugin","slug":"wc-builder","name":"WC Builder \u2013 WooCommerce Page Builder for WPBakery","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-12-27T00:00:00Z","updated":"2026-01-05T19:03:55Z"},{"id":"wordfence:ddb6263e-1f03-48b5-b319-e023e526a4ad","source":"wordfence","cve":"CVE-2025-23496","title":"WP FPO <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb6263e-1f03-48b5-b319-e023e526a4ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-fpo","name":"WP FPO","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T18:52:50Z"},{"id":"wordfence:ddb74878-f200-47cd-a719-d7c2da8167c1","source":"wordfence","cve":"CVE-2025-32495","title":"Waymark <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb74878-f200-47cd-a719-d7c2da8167c1?source=api-prod","affected":[{"type":"plugin","slug":"waymark","name":"Waymark","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-21T14:17:00Z"},{"id":"wordfence:ddb7b668-f023-427e-9ab5-90dc6d481028","source":"wordfence","cve":"CVE-2021-39321","title":"Sassy Social Share 3.3.23 - Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb7b668-f023-427e-9ab5-90dc6d481028?source=api-prod","affected":[{"type":"plugin","slug":"sassy-social-share","name":"Social Sharing Plugin \u2013 Sassy Social Share","from":"3.3.23","from_inclusive":true,"to":"3.3.23","to_inclusive":true,"patched_in":"3.3.24"}],"published":"2021-10-21T16:05:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddb979b5-8fd6-41ed-a535-ad6646a14677","source":"wordfence","cve":"CVE-2019-19540","title":"ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb979b5-8fd6-41ed-a535-ad6646a14677?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.0.14.5","to_inclusive":false,"patched_in":"2.0.14.5"}],"published":"2019-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddb97db0-cbf3-42be-a5c7-12fc2a2bc9e8","source":"wordfence","cve":"CVE-2020-36839","title":"WP Lead Plus X <= 0.99 - Cross-Site Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb97db0-cbf3-42be-a5c7-12fc2a2bc9e8?source=api-prod","affected":[{"type":"plugin","slug":"free-sales-funnel-squeeze-pages-landing-page-builder-templates-make","name":"WordPress Landing Page \u2013 Squeeze Page \u2013 Responsive Landing Page Builder Free \u2013 WP Lead Plus X","from":"*","from_inclusive":true,"to":"0.99","to_inclusive":true,"patched_in":""}],"published":"2020-04-07T00:00:00Z","updated":"2024-10-16T06:43:45Z"},{"id":"wordfence:ddbac1d2-0589-4c0b-ac22-cba80b211109","source":"wordfence","cve":"CVE-2025-53995","title":"JetPopup <= 2.0.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbac1d2-0589-4c0b-ac22-cba80b211109?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.15.1","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:52:33Z"},{"id":"wordfence:ddbb4bcf-daf7-4ae3-8f42-fce5f1d2c279","source":"wordfence","cve":"CVE-2024-4313","title":"Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbb4bcf-daf7-4ae3-8f42-fce5f1d2c279?source=api-prod","affected":[{"type":"plugin","slug":"table-addons-for-elementor","name":"Table Addons for Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-21T13:07:35Z","updated":"2024-06-22T02:01:08Z"},{"id":"wordfence:ddbbcd8a-d2ea-4c0c-98f0-a40080ac4a72","source":"wordfence","cve":"CVE-2025-49414","title":"FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbbcd8a-d2ea-4c0c-98f0-a40080ac4a72?source=api-prod","affected":[{"type":"plugin","slug":"fw-gallery","name":"FW Gallery \u2013 Photo, video, audio media presentation and management system with players and slideshow","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-08T17:34:30Z"},{"id":"wordfence:ddbc76d0-23cd-4f49-939b-b8f19ff55d5c","source":"wordfence","cve":"CVE-2022-1088","title":"Page Security & Membership <= 1.5.15 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbc76d0-23cd-4f49-939b-b8f19ff55d5c?source=api-prod","affected":[{"type":"plugin","slug":"contexture-page-security","name":"Page Security & Membership","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":""}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddbd4940-fe1c-46f0-9148-53c5a4095785","source":"wordfence","cve":"CVE-2025-23779","title":"ResAds <= 2.0.5 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbd4940-fe1c-46f0-9148-53c5a4095785?source=api-prod","affected":[{"type":"plugin","slug":"resads","name":"ResAds","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:59:57Z"},{"id":"wordfence:ddbe9498-8379-413f-a271-a388b88aaf3a","source":"wordfence","cve":"CVE-2026-22503","title":"Nelson <= 1.2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddbe9498-8379-413f-a271-a388b88aaf3a?source=api-prod","affected":[{"type":"theme","slug":"nelson","name":"nelson","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:13:46Z"},{"id":"wordfence:ddc14a98-1df8-480b-bae3-5ec057b498af","source":"wordfence","cve":"CVE-2026-2838","title":"Whole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc14a98-1df8-480b-bae3-5ec057b498af?source=api-prod","affected":[{"type":"plugin","slug":"whole-cart-enquiry","name":"Whole Enquiry Cart for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:51:16Z","updated":"2026-04-08T06:43:42Z"},{"id":"wordfence:ddc1aedb-e64f-4b61-a247-c3cdc731f001","source":"wordfence","cve":"CVE-2024-8730","title":"Exit Notifier <= 1.10.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc1aedb-e64f-4b61-a247-c3cdc731f001?source=api-prod","affected":[{"type":"plugin","slug":"exit-notifier","name":"Exit Notifier","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.6"}],"published":"2024-09-12T21:16:12Z","updated":"2024-10-24T17:04:21Z"},{"id":"wordfence:ddc29341-a23e-4694-b852-90794c01473a","source":"wordfence","cve":"CVE-2024-43260","title":"Clearfy Cache <= 2.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc29341-a23e-4694-b852-90794c01473a?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2024-08-12T00:00:00Z","updated":"2024-10-04T13:17:53Z"},{"id":"wordfence:ddc4b758-5a1e-4d0a-949e-869fcd9df0bc","source":"wordfence","cve":"CVE-2023-5605","title":"URL Shortify <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc4b758-5a1e-4d0a-949e-869fcd9df0bc?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":"1.7.9.1"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a","source":"wordfence","cve":"CVE-2026-2430","title":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-20T23:25:14Z"},{"id":"wordfence:ddc889bf-8062-4a2c-9d50-d1c76a3c3386","source":"wordfence","cve":"CVE-2017-17043","title":"Emag Marketplace Connector < 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc889bf-8062-4a2c-9d50-d1c76a3c3386?source=api-prod","affected":[{"type":"plugin","slug":"emag-marketplace-connector","name":"Emag Marketplace Connector","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2017-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddc91762-b1b0-4d88-bf2d-04a35aab62b1","source":"wordfence","cve":"CVE-2022-0771","title":"SiteSuperCharger <= 5.1.10 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc91762-b1b0-4d88-bf2d-04a35aab62b1?source=api-prod","affected":[{"type":"plugin","slug":"sitesupercharger","name":"SiteSuperCharger","from":"*","from_inclusive":true,"to":"5.1.10","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2022-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddca65fa-0744-4b2a-808c-a913586edc60","source":"wordfence","cve":"CVE-2024-9434","title":"WPGlobus Translate Options <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddca65fa-0744-4b2a-808c-a913586edc60?source=api-prod","affected":[{"type":"plugin","slug":"wpglobus-translate-options","name":"WPGlobus Translate Options","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-30T18:07:53Z","updated":"2024-10-31T06:48:56Z"},{"id":"wordfence:ddcd86ba-97c2-4ce1-8721-210039338028","source":"wordfence","cve":"CVE-2026-56031","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddcd86ba-97c2-4ce1-8721-210039338028?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"7.3.1.2","to_inclusive":true,"patched_in":"7.3.1.3"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-29T18:52:11Z"},{"id":"wordfence:ddcf7901-e9cf-4ca0-87ae-70ecac09d102","source":"wordfence","cve":"CVE-2022-4022","title":"SVG Support 2.5 - 2.5.1 - Insecure Plugin Defaults to Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddcf7901-e9cf-4ca0-87ae-70ecac09d102?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"2.5","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd06190-d0c1-445d-8c6f-4c7df3248db4","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd06190-d0c1-445d-8c6f-4c7df3248db4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd1ccda-e96a-4dd7-a68f-b42c40619bf6","source":"wordfence","cve":"CVE-2024-54298","title":"Car Dealer <= 4.46 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd1ccda-e96a-4dd7-a68f-b42c40619bf6?source=api-prod","affected":[{"type":"plugin","slug":"cardealer","name":"Car Dealer (Dealership) and Vehicle sales","from":"*","from_inclusive":true,"to":"4.46","to_inclusive":true,"patched_in":"4.48"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:41:27Z"},{"id":"wordfence:ddd25026-f507-47f0-bf4e-5b58c37f398c","source":"wordfence","cve":"CVE-2015-4614","title":"Easy2Map <= 1.2.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd25026-f507-47f0-bf4e-5b58c37f398c?source=api-prod","affected":[{"type":"plugin","slug":"easy2map","name":"Easy2Map","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2015-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd2c0c2-49b5-4745-9e52-d0ae6b997640","source":"wordfence","cve":"CVE-2021-38334","title":"WP Design Maps & Places <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd2c0c2-49b5-4745-9e52-d0ae6b997640?source=api-prod","affected":[{"type":"plugin","slug":"wp-design-maps-places","name":"WP Design Maps & Places","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd2c5d9-6489-4154-a494-20392f435bc6","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd2c5d9-6489-4154-a494-20392f435bc6?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd3487d-5c3a-4c2e-b499-0118737c08c1","source":"wordfence","cve":"CVE-2025-57959","title":"Slightly troublesome permalink <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd3487d-5c3a-4c2e-b499-0118737c08c1?source=api-prod","affected":[{"type":"plugin","slug":"slightly-troublesome-permalink","name":"Slightly troublesome permalink","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:01:53Z"},{"id":"wordfence:ddd37b7a-3ef8-4269-ba3b-665ae34bde26","source":"wordfence","cve":"","title":"Affiliates Manager <= 2.9.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd37b7a-3ef8-4269-ba3b-665ae34bde26?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddd83877-739f-4c21-8179-20de8bbc4936","source":"wordfence","cve":"CVE-2024-10111","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.3 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd83877-739f-4c21-8179-20de8bbc4936?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.26.3","to_inclusive":true,"patched_in":"6.26.4"}],"published":"2024-12-11T15:14:20Z","updated":"2025-01-30T21:49:05Z"},{"id":"wordfence:ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56","source":"wordfence","cve":"CVE-2023-0692","title":"Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd85ff2-6607-4ac8-b91c-88f6f2fa6c56?source=api-prod","affected":[{"type":"plugin","slug":"metform","name":"MetForm \u2013 Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddde9db5-3ed7-42f7-97c1-4ff9b9d1f627","source":"wordfence","cve":"CVE-2023-47831","title":"DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddde9db5-3ed7-42f7-97c1-4ff9b9d1f627?source=api-prod","affected":[{"type":"plugin","slug":"drawit","name":"DrawIt (draw.io)","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dddecb2e-9ad6-4e44-afce-5eba7da6322d","source":"wordfence","cve":"CVE-2024-7418","title":"The Post Grid <= 7.7.11 - Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dddecb2e-9ad6-4e44-afce-5eba7da6322d?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.11","to_inclusive":true,"patched_in":"7.7.12"}],"published":"2024-08-28T15:35:37Z","updated":"2024-08-29T03:52:59Z"},{"id":"wordfence:dde0cf3a-778b-4b5f-ac0e-600505d918ae","source":"wordfence","cve":"CVE-2026-15156","title":"Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde0cf3a-778b-4b5f-ac0e-600505d918ae?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"6.6.11","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2026-07-20T16:10:46Z","updated":"2026-07-21T04:33:03Z"},{"id":"wordfence:dde2ab74-fe94-44fc-836c-be48ef0a042d","source":"wordfence","cve":"CVE-2025-53437","title":"Greenorganic <= 2.45 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde2ab74-fe94-44fc-836c-be48ef0a042d?source=api-prod","affected":[{"type":"theme","slug":"greenorganic","name":"GreenOrganic - Organic & Bakery WordPress Theme","from":"*","from_inclusive":true,"to":"2.45","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-12-19T21:41:12Z"},{"id":"wordfence:dde2edc7-74dd-4763-b83b-97cfeb2b764c","source":"wordfence","cve":"CVE-2024-47392","title":"Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde2edc7-74dd-4763-b83b-97cfeb2b764c?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.7.5","to_inclusive":true,"patched_in":"5.7.6"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:27:29Z"},{"id":"wordfence:dde57a98-06d5-4a3c-b100-170e9c339908","source":"wordfence","cve":"CVE-2021-24608","title":"Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde57a98-06d5-4a3c-b100-170e9c339908?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"5.0.07","to_inclusive":false,"patched_in":"5.0.07"}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dde63254-058d-4151-b79e-33029c03decf","source":"wordfence","cve":"CVE-2026-24537","title":"WP Accessibility Helper (WAH) <= 0.6.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde63254-058d-4151-b79e-33029c03decf?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.6","to_inclusive":true,"patched_in":"0.6.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-09-09T16:07:46Z"},{"id":"wordfence:dde9f13e-797f-418b-b6ce-4f54f474bd0e","source":"wordfence","cve":"CVE-2026-28121","title":"Anderson <= 1.4.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dde9f13e-797f-418b-b6ce-4f54f474bd0e?source=api-prod","affected":[{"type":"theme","slug":"andersonclinic","name":"Anderson | Physical Therapy & Orthopedic Clinic WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:18:13Z"},{"id":"wordfence:ddee10e0-093c-47a3-8aa9-946d6d21e1b2","source":"wordfence","cve":"CVE-2026-12955","title":"Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddee10e0-093c-47a3-8aa9-946d6d21e1b2?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2026-07-09T19:07:32Z","updated":"2026-07-10T07:48:44Z"},{"id":"wordfence:ddee4794-5b57-4af1-a427-3247882952e9","source":"wordfence","cve":"CVE-2026-2837","title":"Ricerca \u2013 advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddee4794-5b57-4af1-a427-3247882952e9?source=api-prod","affected":[{"type":"plugin","slug":"ricerca-smart-search","name":"Ricerca \u2013 advanced search","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:14:50Z","updated":"2026-03-21T03:27:10Z"},{"id":"wordfence:ddf1cecd-c630-498d-9aa0-3d0adeb73033","source":"wordfence","cve":"CVE-2024-10625","title":"WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf1cecd-c630-498d-9aa0-3d0adeb73033?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-support-ticket-system","name":"WooCommerce Support Ticket System","from":"*","from_inclusive":true,"to":"17.6","to_inclusive":true,"patched_in":"17.8"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:18:14Z"},{"id":"wordfence:ddf2625a-3fb4-40c3-80e3-2f03fbff6bfd","source":"wordfence","cve":"CVE-2026-97634","title":"Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf2625a-3fb4-40c3-80e3-2f03fbff6bfd?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.29.5","to_inclusive":true,"patched_in":"5.29.5.1"}],"published":"2026-10-01T18:56:00Z","updated":"2026-10-02T07:39:28Z"},{"id":"wordfence:ddf2ca43-a1d5-4809-b8ad-916b23f71a7d","source":"wordfence","cve":"CVE-2025-14114","title":"1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf2ca43-a1d5-4809-b8ad-916b23f71a7d?source=api-prod","affected":[{"type":"plugin","slug":"1180px-shortcodes","name":"1180px Shortcodes","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:29:04Z","updated":"2026-01-07T09:21:04Z"},{"id":"wordfence:ddf4ec13-bca3-4994-9e11-11fbbead371a","source":"wordfence","cve":"CVE-2015-2292","title":"Yoast SEO <= 1.7.3.3 - Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf4ec13-bca3-4994-9e11-11fbbead371a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"},{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"1.6","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.5.7"},{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"1.7","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2015-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddf67d69-f362-4380-a396-300c7edbd9f3","source":"wordfence","cve":"CVE-2022-45354","title":"Download Monitor <= 4.7.60 - Sensitive Information Exposure via REST API","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf67d69-f362-4380-a396-300c7edbd9f3?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"4.7.60","to_inclusive":true,"patched_in":"4.7.70"}],"published":"2023-05-10T00:00:00Z","updated":"2024-10-15T17:51:40Z"},{"id":"wordfence:ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9","source":"wordfence","cve":"CVE-2025-11228","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2025-10-03T14:13:58Z","updated":"2025-10-04T02:24:37Z"},{"id":"wordfence:ddfa5a3d-fef2-4049-915c-51c3e28153bf","source":"wordfence","cve":"CVE-2025-15510","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfa5a3d-fef2-4049-915c-51c3e28153bf?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.8","to_inclusive":true,"patched_in":"9.1.9"}],"published":"2026-01-30T12:12:07Z","updated":"2026-01-31T01:23:03Z"},{"id":"wordfence:ddfba11c-eaa6-4c9e-9422-9390d433f24f","source":"wordfence","cve":"CVE-2025-30932","title":"WP Compress for MainWP <= 6.30.32 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfba11c-eaa6-4c9e-9422-9390d433f24f?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-mainwp","name":"WP Compress for MainWP","from":"*","from_inclusive":true,"to":"6.30.32","to_inclusive":true,"patched_in":"6.50.05"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-03T12:30:07Z"},{"id":"wordfence:ddfbde0f-8e41-45c9-b808-bee82c2ff172","source":"wordfence","cve":"","title":"WP Remote Upload <= 1.2.1 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfbde0f-8e41-45c9-b808-bee82c2ff172?source=api-prod","affected":[{"type":"plugin","slug":"remote-upload","name":"WP Remote Upload","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2016-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ddfc0150-d05c-4027-80d2-64c565fdd56d","source":"wordfence","cve":"CVE-2024-32143","title":"Podlove Podcast Publisher <= 4.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfc0150-d05c-4027-80d2-64c565fdd56d?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:47:39Z"},{"id":"wordfence:ddff1a95-64f9-4076-a81a-cdda04106c46","source":"wordfence","cve":"CVE-2024-49268","title":"Disconnected <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ddff1a95-64f9-4076-a81a-cdda04106c46?source=api-prod","affected":[{"type":"theme","slug":"disconnected","name":"Disconnected","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:57:56Z"},{"id":"wordfence:de00d13b-fab9-4284-9594-abd000fbb7ef","source":"wordfence","cve":"","title":"WP Mail Logging <= 1.11.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de00d13b-fab9-4284-9594-abd000fbb7ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":false,"patched_in":"1.12.0"}],"published":"2023-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de043a2e-6eb0-4eb4-8c20-4efd3fa965d8","source":"wordfence","cve":"CVE-2026-57424","title":"Razorpay Payment Links for WooCommerce <= 2.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de043a2e-6eb0-4eb4-8c20-4efd3fa965d8?source=api-prod","affected":[{"type":"plugin","slug":"rzp-woocommerce","name":"Razorpay Payment Links for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:23:32Z"},{"id":"wordfence:de09c677-6399-4af3-a378-8dd16dcd2819","source":"wordfence","cve":"CVE-2025-64207","title":"Jannah <= 7.6.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de09c677-6399-4af3-a378-8dd16dcd2819?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.6.0","to_inclusive":true,"patched_in":"7.6.1"}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-19T16:45:34Z"},{"id":"wordfence:de09d051-d124-4397-bd1c-b193acd6c186","source":"wordfence","cve":"CVE-2026-3299","title":"WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de09d051-d124-4397-bd1c-b193acd6c186?source=api-prod","affected":[{"type":"plugin","slug":"wp-youtube-lyte","name":"WP YouTube Lyte","from":"*","from_inclusive":true,"to":"1.7.29","to_inclusive":true,"patched_in":"1.7.30"}],"published":"2026-04-15T12:25:22Z","updated":"2026-04-16T01:24:34Z"},{"id":"wordfence:de0c8922-b290-4582-9079-e79da684bcff","source":"wordfence","cve":"CVE-2025-7050","title":"Use-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de0c8922-b290-4582-9079-e79da684bcff?source=api-prod","affected":[{"type":"plugin","slug":"use-your-drive","name":"Use-your-Drive | Google Drive plugin for WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2025-08-04T00:00:00Z","updated":"2025-08-05T06:39:50Z"},{"id":"wordfence:de0fbcf0-64c6-4b33-8a9d-9c9c5d826a4d","source":"wordfence","cve":"CVE-2022-3919","title":"Jetpack CRM <= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de0fbcf0-64c6-4b33-8a9d-9c9c5d826a4d?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de112e5a-4b92-4389-8c6e-b2bfeb6f6cd4","source":"wordfence","cve":"CVE-2024-0827","title":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de112e5a-4b92-4389-8c6e-b2bfeb6f6cd4?source=api-prod","affected":[{"type":"plugin","slug":"play-ht","name":"Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":""}],"published":"2024-02-22T00:00:00Z","updated":"2024-07-29T21:37:37Z"},{"id":"wordfence:de11636b-a051-4e76-bc26-ed76f66fe0df","source":"wordfence","cve":"CVE-2023-2836","title":"CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de11636b-a051-4e76-bc26-ed76f66fe0df?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2023-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de11c9ad-0b9f-4934-8dc9-dc324d77d702","source":"wordfence","cve":"CVE-2026-5060","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de11c9ad-0b9f-4934-8dc9-dc324d77d702?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2026-07-28T21:21:36Z","updated":"2026-07-29T09:31:14Z"},{"id":"wordfence:de12f6d7-72db-494d-bbba-300d3a83b5b2","source":"wordfence","cve":"CVE-2026-66464","title":"Website Internal Link Optimiser <= 5.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de12f6d7-72db-494d-bbba-300d3a83b5b2?source=api-prod","affected":[{"type":"plugin","slug":"internal-link-finder","name":"Website Internal Link Optimiser","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-13T18:52:40Z"},{"id":"wordfence:de159b3e-b456-4b36-ad44-41d3595b53a8","source":"wordfence","cve":"CVE-2025-23920","title":"Isolved Talent Acquisition <= 1.3.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de159b3e-b456-4b36-ad44-41d3595b53a8?source=api-prod","affected":[{"type":"plugin","slug":"applicantpro","name":"Isolved Talent Acquisition","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-01-16T00:00:00Z","updated":"2025-05-29T19:22:51Z"},{"id":"wordfence:de1742d4-f498-4ad4-b6a1-88cb60e83afc","source":"wordfence","cve":"CVE-2024-2120","title":"Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1742d4-f498-4ad4-b6a1-88cb60e83afc?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-29T17:10:20Z"},{"id":"wordfence:de1aaacf-8fe1-4a1e-9846-f78cc469ec20","source":"wordfence","cve":"CVE-2026-5461","title":"Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1aaacf-8fe1-4a1e-9846-f78cc469ec20?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.55.0.2","to_inclusive":true,"patched_in":"1.55.1"}],"published":"2026-10-29T16:05:38Z","updated":"2026-10-30T04:32:44Z"},{"id":"wordfence:de1bcbea-5539-456f-94dc-c70fb7acc455","source":"wordfence","cve":"CVE-2025-6991","title":"Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1bcbea-5539-456f-94dc-c70fb7acc455?source=api-prod","affected":[{"type":"theme","slug":"kallyas","name":"KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"4.21.0","to_inclusive":true,"patched_in":"4.22.0"}],"published":"2025-07-25T00:00:00Z","updated":"2025-07-26T07:23:52Z"},{"id":"wordfence:de1c951f-8b01-44cf-b192-412de9fae4fa","source":"wordfence","cve":"CVE-2026-107743","title":"Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1c951f-8b01-44cf-b192-412de9fae4fa?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-10-28T21:16:39Z","updated":"2026-10-29T09:25:36Z"},{"id":"wordfence:de1da248-2e03-40fa-8997-7176dc06abc9","source":"wordfence","cve":"CVE-2020-36842","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de1da248-2e03-40fa-8997-7176dc06abc9?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.35","to_inclusive":true,"patched_in":"0.9.36"}],"published":"2020-03-13T00:00:00Z","updated":"2024-10-16T07:31:53Z"},{"id":"wordfence:de207181-0163-4222-ac16-d7b74179ff9b","source":"wordfence","cve":"CVE-2024-8681","title":"Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de207181-0163-4222-ac16-d7b74179ff9b?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.52","to_inclusive":true,"patched_in":"4.10.53"}],"published":"2024-09-26T18:10:42Z","updated":"2024-09-27T06:53:59Z"},{"id":"wordfence:de20d896-1493-43ed-8e0c-c686bf2b32d6","source":"wordfence","cve":"CVE-2024-37222","title":"Master Slider <= 3.10.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de20d896-1493-43ed-8e0c-c686bf2b32d6?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-12-17T12:39:50Z"},{"id":"wordfence:de249879-00b8-49b3-8964-f7ab69ab292f","source":"wordfence","cve":"CVE-2026-16613","title":"GDPR Cookie Compliance <= 5.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de249879-00b8-49b3-8964-f7ab69ab292f?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:32:06Z"},{"id":"wordfence:de25459d-9e19-4e3e-982f-0b34fa89dc30","source":"wordfence","cve":"CVE-2026-2988","title":"Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de25459d-9e19-4e3e-982f-0b34fa89dc30?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.15.15","to_inclusive":true,"patched_in":"11.15.16"}],"published":"2026-04-07T13:33:12Z","updated":"2026-04-08T02:25:41Z"},{"id":"wordfence:de255530-6b2d-426b-9f80-dbfebd2e3307","source":"wordfence","cve":"CVE-2026-0926","title":"Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de255530-6b2d-426b-9f80-dbfebd2e3307?source=api-prod","affected":[{"type":"plugin","slug":"prodigy-commerce","name":"Prodigy Commerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-02-18T15:52:33Z","updated":"2026-02-25T15:54:27Z"},{"id":"wordfence:de28d287-af14-45c9-b69c-125968fc4879","source":"wordfence","cve":"CVE-2024-43232","title":"Timeline and History slider <= 2.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de28d287-af14-45c9-b69c-125968fc4879?source=api-prod","affected":[{"type":"plugin","slug":"timeline-and-history-slider","name":"Timeline and History slider","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:29:18Z"},{"id":"wordfence:de2c2c90-52b6-4315-a8d1-6519a90f81e7","source":"wordfence","cve":"CVE-2022-4833","title":"YourChannel <= 1.2.1 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de2c2c90-52b6-4315-a8d1-6519a90f81e7?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de2d77f4-91eb-4e94-8847-19e125c9a0cb","source":"wordfence","cve":"CVE-2025-49900","title":"Advanced scrollbar <= 1.1.8 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de2d77f4-91eb-4e94-8847-19e125c9a0cb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-scrollbar","name":"Advanced Scrollbar \u2013 Give Your Site a Sleek Branded Scrolling Feel","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:20:09Z"},{"id":"wordfence:de2f93f9-1789-4fdf-ac83-b2cfe44fdafa","source":"wordfence","cve":"CVE-2025-31621","title":"byBrick Accordion <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de2f93f9-1789-4fdf-ac83-b2cfe44fdafa?source=api-prod","affected":[{"type":"plugin","slug":"bybrick-accordion","name":"byBrick Accordion","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:46:37Z"},{"id":"wordfence:de302cfb-5eea-4571-9bb3-44ad00262e14","source":"wordfence","cve":"CVE-2025-31380","title":"Paid Videochat Turnkey Site <= 7.3.11 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de302cfb-5eea-4571-9bb3-44ad00262e14?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.3.11","to_inclusive":true,"patched_in":"7.3.12"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-17T13:20:32Z"},{"id":"wordfence:de30d07e-4579-44e8-9527-61751d9e12de","source":"wordfence","cve":"CVE-2026-88904","title":"PuppyFW <= 0.4.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de30d07e-4579-44e8-9527-61751d9e12de?source=api-prod","affected":[{"type":"plugin","slug":"puppyfw","name":"PuppyFW","from":"*","from_inclusive":true,"to":"0.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:47:14Z"},{"id":"wordfence:de30e953-4995-4b98-a3b8-c3613a91d006","source":"wordfence","cve":"CVE-2024-38791","title":"AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de30e953-4995-4b98-a3b8-c3613a91d006?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-01T13:31:34Z"},{"id":"wordfence:de31d4a9-c71b-4f0b-ac14-a96ce4aeb73e","source":"wordfence","cve":"CVE-2026-57750","title":"ez Form Calculator Premium <= 2.14.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de31d4a9-c71b-4f0b-ac14-a96ce4aeb73e?source=api-prod","affected":[{"type":"plugin","slug":"ez-form-calculator-premium","name":"ez Form Calculator Premium","from":"*","from_inclusive":true,"to":"2.14.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T20:04:34Z"},{"id":"wordfence:de331d1d-b2f8-4cc6-a998-779595eca70c","source":"wordfence","cve":"CVE-2023-24409","title":"WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de331d1d-b2f8-4cc6-a998-779595eca70c?source=api-prod","affected":[{"type":"plugin","slug":"responsive-horizontal-vertical-and-accordion-tabs","name":"Responsive Tabs \u2014 Horizontal, Vertical & Accordion Tabs for WordPress","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de33c461-a463-4ac1-91a2-3b168fb08b0b","source":"wordfence","cve":"CVE-2025-24768","title":"Nitan <= 2.9 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de33c461-a463-4ac1-91a2-3b168fb08b0b?source=api-prod","affected":[{"type":"theme","slug":"snsnitan","name":"Nitan \u2013 Fashion WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T14:48:11Z"},{"id":"wordfence:de3498d3-74d5-4450-b91f-cd41e00c3d6c","source":"wordfence","cve":"CVE-2025-47497","title":"Logo Showcase <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de3498d3-74d5-4450-b91f-cd41e00c3d6c?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase","name":"Logo Showcase \u2013 Logo Slider, Logo Carousel & Client Logos Grid","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:17:01Z"},{"id":"wordfence:de379f74-660a-4e59-b1c4-4b88dff8a843","source":"wordfence","cve":"CVE-2025-10383","title":"Contest Gallery \u2013 Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de379f74-660a-4e59-b1c4-4b88dff8a843?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"27.0.2","to_inclusive":true,"patched_in":"27.0.3"}],"published":"2025-10-03T14:48:39Z","updated":"2025-10-04T03:33:31Z"},{"id":"wordfence:de388a39-8966-4b08-a4d2-dbbcd0459c23","source":"wordfence","cve":"CVE-2025-26569","title":"Post Thumbs <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de388a39-8966-4b08-a4d2-dbbcd0459c23?source=api-prod","affected":[{"type":"plugin","slug":"post-thumbs","name":"Post Thumbs","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:37:07Z"},{"id":"wordfence:de394637-7215-4fe7-8529-2d785deef0c8","source":"wordfence","cve":"CVE-2024-44014","title":"Vmax Project Manager <= 1.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de394637-7215-4fe7-8529-2d785deef0c8?source=api-prod","affected":[{"type":"plugin","slug":"vmax-project-manager","name":"Vmax Project Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T00:00:00Z","updated":"2024-10-02T20:36:43Z"},{"id":"wordfence:de39bad4-858a-4332-8ed0-bfd92a67b9cb","source":"wordfence","cve":"CVE-2022-4097","title":"All-In-One Security (AIOS) \u2013 Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de39bad4-858a-4332-8ed0-bfd92a67b9cb?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":true,"patched_in":"5.0.8"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de3a6e77-47ee-4989-81a0-5447a73185bb","source":"wordfence","cve":"CVE-2022-45075","title":"Activity Reactions For Buddypress <= 1.0.22 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de3a6e77-47ee-4989-81a0-5447a73185bb?source=api-prod","affected":[{"type":"plugin","slug":"activity-reactions-for-buddypress","name":"Activity Reactions For Buddypress","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":""}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de3cf63f-ac30-47bb-978d-d3353d06de1b","source":"wordfence","cve":"CVE-2022-40975","title":"Post Slider <= 1.6.7 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de3cf63f-ac30-47bb-978d-d3353d06de1b?source=api-prod","affected":[{"type":"plugin","slug":"adl-post-slider","name":"Post Slider","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2022-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de3ed8fb-8a8c-423a-b8a7-12564813e02e","source":"wordfence","cve":"CVE-2026-124256","title":"Delivery & Pickup Date Time for WooCommerce <= 1.3.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de3ed8fb-8a8c-423a-b8a7-12564813e02e?source=api-prod","affected":[{"type":"plugin","slug":"woo-delivery","name":"Delivery & Pickup Date Time for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.90","to_inclusive":true,"patched_in":"1.3.91"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:26Z"},{"id":"wordfence:de45dd8c-c734-4b14-89ee-dbc46dcdae6a","source":"wordfence","cve":"CVE-2022-34867","title":"WP Libre Form 2 <= 2.0.8 - Sensitive Information Disclosure","severity":"high","cvss":7.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de45dd8c-c734-4b14-89ee-dbc46dcdae6a?source=api-prod","affected":[{"type":"plugin","slug":"libreform","name":"WP Libre Form 2","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2022-07-22T13:07:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de46743b-2cc6-4a29-bbc4-bc6cfb540e26","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization in migrateCommonToProductOnly function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de46743b-2cc6-4a29-bbc4-bc6cfb540e26?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de476d40-47eb-417f-927f-d80d32745965","source":"wordfence","cve":"CVE-2014-8334","title":"WP-DBManager < 2.72 - OS Command Injection","severity":"high","cvss":7.8,"cwe":"CWE-78","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de476d40-47eb-417f-927f-d80d32745965?source=api-prod","affected":[{"type":"plugin","slug":"wp-dbmanager","name":"WP-DBManager","from":"*","from_inclusive":true,"to":"2.72","to_inclusive":false,"patched_in":"2.72"}],"published":"2014-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de47ba6f-08ab-4ed0-8d3f-745082461344","source":"wordfence","cve":"CVE-2026-125454","title":"Passster \u2013 Password Protect Pages and Content <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de47ba6f-08ab-4ed0-8d3f-745082461344?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.21","to_inclusive":true,"patched_in":"4.3.22"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:46Z"},{"id":"wordfence:de495201-669c-4483-b30d-bb2abf6fe6c6","source":"wordfence","cve":"CVE-2024-31291","title":"ProfileGrid  <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de495201-669c-4483-b30d-bb2abf6fe6c6?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.6","to_inclusive":true,"patched_in":"5.7.7"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:54:43Z"},{"id":"wordfence:de4997ef-01f1-4218-879f-52eef30790e5","source":"wordfence","cve":"CVE-2026-93772","title":"wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4997ef-01f1-4218-879f-52eef30790e5?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-09-23T11:20:53Z","updated":"2026-09-29T20:03:31Z"},{"id":"wordfence:de4ba999-3312-4bcc-ab87-574b7994e07e","source":"wordfence","cve":"CVE-2024-53770","title":"RingCentral Communications <= 1.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4ba999-3312-4bcc-ab87-574b7994e07e?source=api-prod","affected":[{"type":"plugin","slug":"rccp-free","name":"RingCentral Communications Plugin \u2013 FREE","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2025-08-24T22:22:35Z"},{"id":"wordfence:de4c147b-748e-447e-8ee7-23072445cd56","source":"wordfence","cve":"CVE-2025-31473","title":"WP Database Optimizer <= 1.2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4c147b-748e-447e-8ee7-23072445cd56?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-optimizer","name":"WP Database Optimizer","from":"*","from_inclusive":true,"to":"1.2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T20:55:40Z"},{"id":"wordfence:de4dfcc7-fcc0-46e5-8452-98783007368d","source":"wordfence","cve":"CVE-2025-0897","title":"Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4dfcc7-fcc0-46e5-8452-98783007368d?source=api-prod","affected":[{"type":"plugin","slug":"modal-window","name":"Modal Window \u2013 create popup modal window","from":"*","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.1.6"}],"published":"2025-02-19T19:43:18Z","updated":"2025-02-20T08:22:07Z"},{"id":"wordfence:de4f4064-cb72-4b67-b8af-0b2cec5a53d0","source":"wordfence","cve":"CVE-2025-23804","title":"WP Service Payment Form With Authorize.net <= 2.6.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4f4064-cb72-4b67-b8af-0b2cec5a53d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-service-payment-form-with-authorizenet","name":"WP Service Payment Form With Authorize.net","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:59:31Z"},{"id":"wordfence:de4f8d45-9522-4a32-bc98-be8dbf3a5cf1","source":"wordfence","cve":"CVE-2025-14156","title":"Fox LMS \u2013 WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'","severity":"critical","cvss":9.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de4f8d45-9522-4a32-bc98-be8dbf3a5cf1?source=api-prod","affected":[{"type":"plugin","slug":"fox-lms","name":"Fox LMS \u2013 eLearning & Course Builder","from":"1.0.4.7","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":"1.0.5.2"}],"published":"2025-12-15T02:23:42Z","updated":"2025-12-15T14:25:13Z"},{"id":"wordfence:de501704-9dc8-4ff9-a37a-9e6b196af749","source":"wordfence","cve":"CVE-2026-14812","title":"Premium SEO - Malicious Plugin","severity":"critical","cvss":9.8,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de501704-9dc8-4ff9-a37a-9e6b196af749?source=api-prod","affected":[{"type":"plugin","slug":"Premium-SEO","name":"Premium SEO","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-08-21T13:02:34Z"},{"id":"wordfence:de503a18-35d1-40da-9b96-e0df6ca4857c","source":"wordfence","cve":"CVE-2026-106028","title":"ActiveTrail for WooCommerce <= 1.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de503a18-35d1-40da-9b96-e0df6ca4857c?source=api-prod","affected":[{"type":"plugin","slug":"activetrail-for-woocommerce","name":"ActiveTrail for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:05:41Z"},{"id":"wordfence:de523bc3-3c22-4632-8f14-2f9098cb4f28","source":"wordfence","cve":"CVE-2025-49325","title":"Newspack Newsletters <= 3.13.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de523bc3-3c22-4632-8f14-2f9098cb4f28?source=api-prod","affected":[{"type":"plugin","slug":"newspack-newsletters","name":"Newspack Newsletters","from":"*","from_inclusive":true,"to":"3.13.0","to_inclusive":true,"patched_in":"3.14.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T14:15:50Z"},{"id":"wordfence:de5397c2-b23c-412a-b419-e36023daa989","source":"wordfence","cve":"CVE-2022-47609","title":"DNUI <= 2.8.1 - Cross-Site Request Forgery leading to Unused Image Deletion and Database Image Access","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5397c2-b23c-412a-b419-e36023daa989?source=api-prod","affected":[{"type":"plugin","slug":"dnui-delete-not-used-image-wordpress","name":"DNUI","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de53b1d8-e38f-42c5-adfc-2b0ce8d6945b","source":"wordfence","cve":"CVE-2024-12102","title":"Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de53b1d8-e38f-42c5-adfc-2b0ce8d6945b?source=api-prod","affected":[{"type":"plugin","slug":"typer-core","name":"Typer Core","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:43:02Z","updated":"2025-01-30T13:42:09Z"},{"id":"wordfence:de568a71-f51d-4948-839c-48e51d165a64","source":"wordfence","cve":"CVE-2023-45767","title":"Simple Tweet <= 1.4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de568a71-f51d-4948-839c-48e51d165a64?source=api-prod","affected":[{"type":"plugin","slug":"simple-tweet","name":"Simple Tweet","from":"*","from_inclusive":true,"to":"1.4.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de58a0d1-42d2-46d7-a8a5-6b86b438b326","source":"wordfence","cve":"CVE-2025-22794","title":"World Cup Predictor <= 1.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de58a0d1-42d2-46d7-a8a5-6b86b438b326?source=api-prod","affected":[{"type":"plugin","slug":"world-cup-predictor","name":"World Cup Predictor","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-02-20T16:49:41Z"},{"id":"wordfence:de5a9a2e-547e-46f0-8ab9-3d63750055e7","source":"wordfence","cve":"CVE-2025-49441","title":"Interactive Regional Map of Florida <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5a9a2e-547e-46f0-8ab9-3d63750055e7?source=api-prod","affected":[{"type":"plugin","slug":"interactive-map-of-florida","name":"Interactive Map of Florida","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:08:46Z"},{"id":"wordfence:de5d0356-197c-464e-9011-bb382680e9e6","source":"wordfence","cve":"CVE-2025-69071","title":"TanTum <= 1.1.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5d0356-197c-464e-9011-bb382680e9e6?source=api-prod","affected":[{"type":"theme","slug":"tantum","name":"TanTum | Car, Scooter, Boat & Bike Rental Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:32:23Z"},{"id":"wordfence:de5d5ffc-e76a-4ea9-be68-9ca5f847a363","source":"wordfence","cve":"CVE-2024-24889","title":"All 404 Pages Redirect to Homepage <= 1.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5d5ffc-e76a-4ea9-be68-9ca5f847a363?source=api-prod","affected":[{"type":"plugin","slug":"all-404-pages-redirect-to-homepage","name":"All 404 Pages Redirect to Homepage","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-02-08T00:00:00Z","updated":"2024-02-12T15:24:54Z"},{"id":"wordfence:de5e97fc-4b8d-49d0-ad8e-39931a80320c","source":"wordfence","cve":"CVE-2025-58596","title":"MailOptin <= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5e97fc-4b8d-49d0-ad8e-39931a80320c?source=api-prod","affected":[{"type":"plugin","slug":"mailoptin","name":"MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","from":"*","from_inclusive":true,"to":"1.2.75.0","to_inclusive":true,"patched_in":"1.2.75.1"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-10T19:41:02Z"},{"id":"wordfence:de5feed6-ef1b-4e06-9bd0-145292f613b6","source":"wordfence","cve":"CVE-2025-23903","title":"Local Shipping Labels for WooCommerce <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de5feed6-ef1b-4e06-9bd0-145292f613b6?source=api-prod","affected":[{"type":"plugin","slug":"local-shipping-labels-for-woocommerce","name":"Local Shipping Labels for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:49:08Z"},{"id":"wordfence:de602cf8-cc02-4459-aa23-5d8236048bca","source":"wordfence","cve":"CVE-2024-11888","title":"IDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de602cf8-cc02-4459-aa23-5d8236048bca?source=api-prod","affected":[{"type":"plugin","slug":"ider-login","name":"IDer Login for WordPress","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T16:01:56Z","updated":"2025-05-07T13:58:07Z"},{"id":"wordfence:de6048e7-75c6-44b1-bc68-e36dce936c78","source":"wordfence","cve":"CVE-2023-46618","title":"Category SEO Meta Tags <= 2.5 - Cross-Site Request Forgery via csmt_admin_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de6048e7-75c6-44b1-bc68-e36dce936c78?source=api-prod","affected":[{"type":"plugin","slug":"category-seo-meta-tags","name":"Category SEO Meta Tags","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de614bbd-42ae-4c2a-aec6-31245124de76","source":"wordfence","cve":"CVE-2021-24255","title":"Essential Addons for Elementor Lite <= 4.5.3 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de614bbd-42ae-4c2a-aec6-31245124de76?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":false,"patched_in":"4.5.4"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de62020b-5803-4ea7-89a1-24e5a512f2f3","source":"wordfence","cve":"CVE-2022-38461","title":"WPML <= 4.5.10 - Missing Authorization to Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de62020b-5803-4ea7-89a1-24e5a512f2f3?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.5.10","to_inclusive":true,"patched_in":"4.5.11"}],"published":"2022-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de6256cf-b6c8-4436-83ad-a5494fc48949","source":"wordfence","cve":"CVE-2026-74851","title":"Pods \u2013 Custom Content Types and Fields < 3.3.9.1 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de6256cf-b6c8-4436-83ad-a5494fc48949?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"3.3.9.1","to_inclusive":false,"patched_in":"3.3.9.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:52:46Z"},{"id":"wordfence:de63f5bf-9cf5-428d-80da-c0030988b4a6","source":"wordfence","cve":"CVE-2023-27612","title":"Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de63f5bf-9cf5-428d-80da-c0030988b4a6?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.6.0"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de648bea-35c5-4611-aa2f-79e37a0299bb","source":"wordfence","cve":"CVE-2024-3946","title":"WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de648bea-35c5-4611-aa2f-79e37a0299bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-todo","name":"WP To Do","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2024-05-29T15:53:31Z","updated":"2025-11-06T15:02:20Z"},{"id":"wordfence:de64e79f-0284-4d23-a18b-64554f2b188e","source":"wordfence","cve":"CVE-2026-8385","title":"WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de64e79f-0284-4d23-a18b-64554f2b188e?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"10.0.09","to_inclusive":true,"patched_in":"10.0.10"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-05T12:31:17Z"},{"id":"wordfence:de69d597-b663-4c58-82e0-c90391fb8416","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'selectAll' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de69d597-b663-4c58-82e0-c90391fb8416?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de6d07f0-6e69-4b6d-98ee-128117f0b822","source":"wordfence","cve":"CVE-2025-22588","title":"Scanventory <= 1.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de6d07f0-6e69-4b6d-98ee-128117f0b822?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-inventory-management","name":"Scanventory","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:48:43Z"},{"id":"wordfence:de6da87e-8f7d-4120-8a1b-390ef7733d84","source":"wordfence","cve":"CVE-2023-1430","title":"FluentCRM - Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control","severity":"medium","cvss":6.5,"cwe":"CWE-759","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de6da87e-8f7d-4120-8a1b-390ef7733d84?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"2.8.0.1","to_inclusive":true,"patched_in":"2.8.02"}],"published":"2023-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de73304e-7a28-4304-b1ed-2f6dd7738236","source":"wordfence","cve":"CVE-2023-0581","title":"PrivateContent  <= 8.4.3 - Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de73304e-7a28-4304-b1ed-2f6dd7738236?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"PrivateContent","from":"*","from_inclusive":true,"to":"8.4.3","to_inclusive":true,"patched_in":"8.4.4"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de7489e8-fe18-4a80-832c-aa62424c538b","source":"wordfence","cve":"CVE-2025-3952","title":"Projectopia &#8211; WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7489e8-fe18-4a80-832c-aa62424c538b?source=api-prod","affected":[{"type":"plugin","slug":"projectopia-core","name":"Projectopia \u2013 Project Management Tool","from":"*","from_inclusive":true,"to":"5.1.16","to_inclusive":true,"patched_in":"5.1.17"}],"published":"2025-04-30T15:45:10Z","updated":"2025-05-01T04:22:59Z"},{"id":"wordfence:de749c6d-c01f-4217-a1fe-020cef21f56e","source":"wordfence","cve":"CVE-2025-13031","title":"WPeMatico RSS Feed Fetcher <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de749c6d-c01f-4217-a1fe-020cef21f56e?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.8.12","to_inclusive":true,"patched_in":"2.8.13"}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-11T16:31:38Z"},{"id":"wordfence:de74cf61-d15f-4d77-9c7e-950f48579d22","source":"wordfence","cve":"CVE-2024-9796","title":"WordPress WP-Advanced-Search <= 3.3.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de74cf61-d15f-4d77-9c7e-950f48579d22?source=api-prod","affected":[{"type":"plugin","slug":"wp-advanced-search","name":"WordPress WP-Advanced-Search","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.3.9.2"}],"published":"2024-09-17T00:00:00Z","updated":"2024-10-18T13:14:28Z"},{"id":"wordfence:de754e7d-4ad4-49f3-b730-e81f6c5bc5f8","source":"wordfence","cve":"CVE-2025-69342","title":"Calafate <= 1.7.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de754e7d-4ad4-49f3-b730-e81f6c5bc5f8?source=api-prod","affected":[{"type":"theme","slug":"calafate","name":"Calafate - Portfolio & WooCommerce Creative WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T14:49:52Z"},{"id":"wordfence:de7b0d72-9227-4ecd-a88f-a7d04b592f59","source":"wordfence","cve":"CVE-2025-31566","title":"Rio Video Gallery <= 2.3.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7b0d72-9227-4ecd-a88f-a7d04b592f59?source=api-prod","affected":[{"type":"plugin","slug":"rio-video-gallery","name":"Rio Video Gallery","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:25:55Z"},{"id":"wordfence:de7b68e2-9cae-4e6f-a625-d8346836da39","source":"wordfence","cve":"CVE-2024-3756","title":"MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery to Event Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7b68e2-9cae-4e6f-a625-d8346836da39?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-07T12:55:25Z"},{"id":"wordfence:de7be653-4d5b-4cbe-ad9c-6c2748f533bb","source":"wordfence","cve":"CVE-2024-12407","title":"Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7be653-4d5b-4cbe-ad9c-6c2748f533bb?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"2.06","to_inclusive":true,"patched_in":"2.08"}],"published":"2025-01-10T19:02:15Z","updated":"2025-01-30T14:49:44Z"},{"id":"wordfence:de7cde2c-142c-4004-9302-be335265d87d","source":"wordfence","cve":"CVE-2024-6482","title":"Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.7.49","to_inclusive":true,"patched_in":"1.7.50"}],"published":"2024-09-14T00:06:00Z","updated":"2024-09-14T12:31:08Z"},{"id":"wordfence:de7db1d6-b352-44c7-a6cc-b21cb65a0482","source":"wordfence","cve":"CVE-2023-4939","title":"SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token","severity":"medium","cvss":5.3,"cwe":"CWE-305","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de7db1d6-b352-44c7-a6cc-b21cb65a0482?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-10-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de805955-b7c7-455b-bc1a-69b8a14ba79d","source":"wordfence","cve":"CVE-2023-0072","title":"WC Vendors Marketplace <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Sites Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de805955-b7c7-455b-bc1a-69b8a14ba79d?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de821236-f878-46a4-9265-bcf6e8661910","source":"wordfence","cve":"CVE-2023-4281","title":"Activity Log <= 2.8.7 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de821236-f878-46a4-9265-bcf6e8661910?source=api-prod","affected":[{"type":"plugin","slug":"aryo-activity-log","name":"Activity Log \u2013 Monitor User and Agent Changes","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de871598-e4e7-49f6-8530-68243544c06c","source":"wordfence","cve":"CVE-2023-1913","title":"Maps Widget for Google Maps <= 4.24 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de871598-e4e7-49f6-8530-68243544c06c?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-widget","name":"Maps Widget for Google Maps","from":"*","from_inclusive":true,"to":"4.24","to_inclusive":true,"patched_in":"4.25"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de895d41-a59d-4449-ba5d-f9efd79f534c","source":"wordfence","cve":"CVE-2025-62111","title":"Extra Shortcodes <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de895d41-a59d-4449-ba5d-f9efd79f534c?source=api-prod","affected":[{"type":"plugin","slug":"extra-shortcodes","name":"Extra Shortcodes","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:25:04Z"},{"id":"wordfence:de897025-e2e0-4e21-9c58-db2c20d5d3f9","source":"wordfence","cve":"CVE-2025-28877","title":"Key4ce osTicket Bridge <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de897025-e2e0-4e21-9c58-db2c20d5d3f9?source=api-prod","affected":[{"type":"plugin","slug":"key4ce-osticket-bridge","name":"Key4ce osTicket Bridge","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:35:48Z"},{"id":"wordfence:de8abfac-f25e-41a4-8e94-ab01b105f3b4","source":"wordfence","cve":"CVE-2025-23694","title":"Shabbos and Yom Tov <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de8abfac-f25e-41a4-8e94-ab01b105f3b4?source=api-prod","affected":[{"type":"plugin","slug":"shabbos-and-yom-tov","name":"Shabbos and Yom Tov","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:35:51Z"},{"id":"wordfence:de8ac20f-d6ae-4e55-9337-4fb5ebd4f24a","source":"wordfence","cve":"CVE-2024-13690","title":"WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de8ac20f-d6ae-4e55-9337-4fb5ebd4f24a?source=api-prod","affected":[{"type":"plugin","slug":"wp-church-donation","name":"WP Church Donation","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T19:33:56Z","updated":"2025-03-25T08:22:16Z"},{"id":"wordfence:de8b14c0-00f8-4c4d-ae78-bc29a1e5007c","source":"wordfence","cve":"CVE-2022-4471","title":"YARPP \u2013 Yet Another Related Posts Plugin <= 5.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de8b14c0-00f8-4c4d-ae78-bc29a1e5007c?source=api-prod","affected":[{"type":"plugin","slug":"yet-another-related-posts-plugin","name":"YARPP \u2013 Yet Another Related Posts Plugin","from":"*","from_inclusive":true,"to":"5.30.2","to_inclusive":true,"patched_in":"5.30.3"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de8e7adc-3777-4fb1-a708-68da950e3d4f","source":"wordfence","cve":"CVE-2024-11028","title":"MultiManager WP \u2013 Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de8e7adc-3777-4fb1-a708-68da950e3d4f?source=api-prod","affected":[{"type":"plugin","slug":"multimanager-wp","name":"MultiManager WP \u2013 Manage All Your WordPress Sites Easily","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T09:30:26Z"},{"id":"wordfence:de918177-5901-40ed-a936-c212cdcf940d","source":"wordfence","cve":"","title":"P3 (Plugin Performance Profiler) < 1.5.3.9 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de918177-5901-40ed-a936-c212cdcf940d?source=api-prod","affected":[{"type":"plugin","slug":"p3-profiler","name":"P3 (Plugin Performance Profiler)","from":"*","from_inclusive":true,"to":"1.5.3.9","to_inclusive":false,"patched_in":"1.5.3.9"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de91c6f1-12b6-4759-90b0-507c9736b3d4","source":"wordfence","cve":"CVE-2024-3983","title":"WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de91c6f1-12b6-4759-90b0-507c9736b3d4?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"30.1","to_inclusive":false,"patched_in":"30.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-02T20:17:01Z"},{"id":"wordfence:de920076-55a0-4f9a-9b4a-0e0d0edfc991","source":"wordfence","cve":"CVE-2025-32296","title":"Simple Link Directory Pro < 14.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de920076-55a0-4f9a-9b4a-0e0d0edfc991?source=api-prod","affected":[{"type":"plugin","slug":"qc-simple-link-directory","name":"Simple Link Directory Pro","from":"*","from_inclusive":true,"to":"14.8.1","to_inclusive":false,"patched_in":"14.8.1"}],"published":"2025-05-16T00:00:00Z","updated":"2026-02-26T15:08:13Z"},{"id":"wordfence:de9272e9-8dda-4b69-86c0-2736941b8e27","source":"wordfence","cve":"CVE-2026-57371","title":"WPJAM Basic <= 7.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9272e9-8dda-4b69-86c0-2736941b8e27?source=api-prod","affected":[{"type":"plugin","slug":"wpjam-basic","name":"WPJAM Basic","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:37:10Z"},{"id":"wordfence:de931a65-c898-4b1d-99ce-20dd646bcbb0","source":"wordfence","cve":"CVE-2026-1099","title":"Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de931a65-c898-4b1d-99ce-20dd646bcbb0?source=api-prod","affected":[{"type":"plugin","slug":"administrative-shortcodes","name":"Administrative Shortcodes","from":"*","from_inclusive":true,"to":"0.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:21:17Z","updated":"2026-01-24T07:26:48Z"},{"id":"wordfence:de957e90-5758-46f3-90f8-521b47d247ff","source":"wordfence","cve":"CVE-2017-18564","title":"Sender by BestWebSoft <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de957e90-5758-46f3-90f8-521b47d247ff?source=api-prod","affected":[{"type":"plugin","slug":"sender","name":"Sender by BestWebSoft","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2019-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de982653-26b4-4a7b-a391-373362bcb834","source":"wordfence","cve":"CVE-2024-11351","title":"Restrict \u2013 membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de982653-26b4-4a7b-a391-373362bcb834?source=api-prod","affected":[{"type":"plugin","slug":"restricted-content","name":"Restrict \u2013 membership, site, content and user access restrictions for WordPress","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-11T12:24:20Z"},{"id":"wordfence:de9a945b-31fb-4d0d-9dd1-23bcef1399c2","source":"wordfence","cve":"","title":"Show-Hide / Collapse-Expand <= 1.2.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9a945b-31fb-4d0d-9dd1-23bcef1399c2?source=api-prod","affected":[{"type":"plugin","slug":"show-hidecollapse-expand","name":"Show-Hide / Collapse-Expand","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de9b0eba-5d2b-427c-a199-88bf96c26f5e","source":"wordfence","cve":"CVE-2025-0822","title":"Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a199-88bf96c26f5e?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-02-14T23:52:04Z","updated":"2025-02-15T12:43:04Z"},{"id":"wordfence:de9be7bc-4f8a-4393-8ebb-1b1f141b7585","source":"wordfence","cve":"CVE-2023-2449","title":"UserPro <= 5.1.1 - Insecure Password Reset Mechanism","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9be7bc-4f8a-4393-8ebb-1b1f141b7585?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:de9c9e1e-3c3c-463a-a78c-d8bc7228da93","source":"wordfence","cve":"CVE-2025-8895","title":"WP Webhooks  <= 3.3.5 - Unauthenticated Arbitrary File Copy","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9c9e1e-3c3c-463a-a78c-d8bc7228da93?source=api-prod","affected":[{"type":"plugin","slug":"wp-webhooks","name":"WP Webhooks Automation \u2013 Automate repetitive tasks by creating powerful WordPress automation workflows","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-08-20T19:26:19Z","updated":"2025-08-21T07:26:37Z"},{"id":"wordfence:de9dcdc1-cdd3-4c10-84b2-938d5263e98e","source":"wordfence","cve":"CVE-2026-57384","title":"WishList Member X <= 3.32.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9dcdc1-cdd3-4c10-84b2-938d5263e98e?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member","name":"Wishlist Member X","from":"*","from_inclusive":true,"to":"3.32.0","to_inclusive":true,"patched_in":"3.33.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T18:13:22Z"},{"id":"wordfence:de9f28b9-121d-42d5-9a7c-9caa52eb2e32","source":"wordfence","cve":"CVE-2025-47532","title":"CoinPayments.net Payment Gateway for WooCommerce <= 1.0.17 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9f28b9-121d-42d5-9a7c-9caa52eb2e32?source=api-prod","affected":[{"type":"plugin","slug":"coinpayments-payment-gateway-for-woocommerce","name":"CoinPayments.net Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T15:00:07Z"},{"id":"wordfence:de9f3b83-4575-4566-9731-0af9107c7c30","source":"wordfence","cve":"CVE-2022-45361","title":"0mk Shortener <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/de9f3b83-4575-4566-9731-0af9107c7c30?source=api-prod","affected":[{"type":"plugin","slug":"0mk-shortener","name":"0mk Shortener","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dea166d9-9f1b-42ad-a339-63c111679f85","source":"wordfence","cve":"CVE-2024-50434","title":"NewsCard <= 1.3 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dea166d9-9f1b-42ad-a339-63c111679f85?source=api-prod","affected":[{"type":"theme","slug":"newscard","name":"NewsCard","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:59:17Z"},{"id":"wordfence:dea1e775-68b4-45e6-9d90-41e39d5d0dfd","source":"wordfence","cve":"CVE-2023-2326","title":"Gravity Forms Google Sheet Connector <= 1.3.4 - Cross-Site Request Forgery via verify_code_integation_new","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dea1e775-68b4-45e6-9d90-41e39d5d0dfd?source=api-prod","affected":[{"type":"plugin","slug":"gsheetconnector-gravity-forms","name":"GSheetConnector \u2013 Gravity Forms Google Sheets Connector \u2013 Real-Time Sync","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dea2d045-d3b4-4b55-8b4f-5baa82a18834","source":"wordfence","cve":"CVE-2024-10174","title":"WP Project Manager \u2013 Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass","severity":"high","cvss":7.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dea2d045-d3b4-4b55-8b4f-5baa82a18834?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.13","to_inclusive":true,"patched_in":"2.6.14"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T03:20:08Z"},{"id":"wordfence:dea4a7f4-e075-45d9-bf71-f411f4ce30df","source":"wordfence","cve":"CVE-2024-54251","title":"Prodigy Commerce <= 3.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dea4a7f4-e075-45d9-bf71-f411f4ce30df?source=api-prod","affected":[{"type":"plugin","slug":"prodigy-commerce","name":"Prodigy Commerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-12-05T00:00:00Z","updated":"2025-02-11T21:31:55Z"},{"id":"wordfence:deaae457-2809-4f07-83e2-2e73cdcdf5ec","source":"wordfence","cve":"CVE-2025-57888","title":"Jobmonster <= 4.8.0 - Unauthenticated Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deaae457-2809-4f07-83e2-2e73cdcdf5ec?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2025-08-22T00:00:00Z","updated":"2025-08-26T14:35:57Z"},{"id":"wordfence:deac4e1d-edeb-4d66-a152-6dca84e60b68","source":"wordfence","cve":"CVE-2024-47621","title":"Zotpress <= 7.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deac4e1d-edeb-4d66-a152-6dca84e60b68?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.10","to_inclusive":true,"patched_in":"7.3.11"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T13:44:17Z"},{"id":"wordfence:dead051c-f28f-4859-b0ba-b27a8d6c9335","source":"wordfence","cve":"CVE-2024-11365","title":"Crypto and DeFi Widgets \u2013 Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dead051c-f28f-4859-b0ba-b27a8d6c9335?source=api-prod","affected":[{"type":"plugin","slug":"security-force","name":"Crypto and DeFi Widgets \u2013 Web3 Cryptocurrency Shortcodes","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T13:48:18Z","updated":"2024-11-21T02:06:47Z"},{"id":"wordfence:deafea7b-97e4-4a2d-bbba-6476cf39cac8","source":"wordfence","cve":"CVE-2026-62031","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deafea7b-97e4-4a2d-bbba-6476cf39cac8?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T13:03:43Z","updated":"2026-10-13T14:10:53Z"},{"id":"wordfence:deb13e12-bec3-4266-8fa1-8fcebb16e29a","source":"wordfence","cve":"CVE-2026-84025","title":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb13e12-bec3-4266-8fa1-8fcebb16e29a?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-editor","name":"BEAR \u2013 Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:17:47Z"},{"id":"wordfence:deb2544f-75ac-4d6c-bec7-9f35cfe0028d","source":"wordfence","cve":"CVE-2023-23791","title":"HT Menu <= 1.2.1 - Cross-Site Request Forgery via plugin_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb2544f-75ac-4d6c-bec7-9f35cfe0028d?source=api-prod","affected":[{"type":"plugin","slug":"ht-menu-lite","name":"HT Menu \u2013 WordPress Mega Menu Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:deb6821e-93ff-4636-912b-887deba59577","source":"wordfence","cve":"CVE-2018-0547","title":"WP All Import <= 3.4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb6821e-93ff-4636-912b-887deba59577?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":false,"patched_in":"3.4.7"}],"published":"2018-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:deb7dd3c-8c49-4323-a70a-127898550f6c","source":"wordfence","cve":"CVE-2026-66643","title":"Wufoo Shortcode <= 1.55 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb7dd3c-8c49-4323-a70a-127898550f6c?source=api-prod","affected":[{"type":"plugin","slug":"wufoo-shortcode","name":"Wufoo Shortcode","from":"*","from_inclusive":true,"to":"1.55","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:23:22Z"},{"id":"wordfence:deb912f0-bfba-470f-9a18-47c3d65905dc","source":"wordfence","cve":"CVE-2022-25811","title":"Transposh WordPress Translation <= 1.0.9.1 - Authenticated (Admin+) SQL Injection via 'tp_editor'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb912f0-bfba-470f-9a18-47c3d65905dc?source=api-prod","affected":[{"type":"plugin","slug":"transposh-translation-filter-for-wordpress","name":"Transposh WordPress Translation","from":"*","from_inclusive":true,"to":"1.0.9.1","to_inclusive":true,"patched_in":"1.0.9.2"}],"published":"2022-07-22T00:00:00Z","updated":"2025-07-21T14:00:05Z"},{"id":"wordfence:deb92657-3a28-44e3-bfd7-59f722869f5a","source":"wordfence","cve":"CVE-2026-78276","title":"Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deb92657-3a28-44e3-bfd7-59f722869f5a?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards-pro","name":"Fluent Boards Pro","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T20:47:18Z"},{"id":"wordfence:deba0a29-7fe5-4f94-bee6-9d01e023215e","source":"wordfence","cve":"CVE-2025-8015","title":"Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deba0a29-7fe5-4f94-bee6-9d01e023215e?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.4.3"}],"published":"2025-07-21T00:00:00Z","updated":"2025-08-15T19:04:46Z"},{"id":"wordfence:deba0ee8-1930-4287-aaaf-0d89a674934c","source":"wordfence","cve":"CVE-2026-27399","title":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.40 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deba0ee8-1930-4287-aaaf-0d89a674934c?source=api-prod","affected":[{"type":"plugin","slug":"marketking-multivendor-marketplace-for-woocommerce","name":"MarketKing \u2014 Ultimate WooCommerce Multivendor Marketplace Solution","from":"*","from_inclusive":true,"to":"2.1.40","to_inclusive":true,"patched_in":"2.1.50"}],"published":"2026-07-21T00:00:00Z","updated":"2026-07-27T15:40:58Z"},{"id":"wordfence:deba9cd0-2c7e-4789-8499-977c694aba8b","source":"wordfence","cve":"","title":"Events Made Easy <= 1.6.20 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deba9cd0-2c7e-4789-8499-977c694aba8b?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:debaf111-012a-477f-ae09-bdaf330e6b0f","source":"wordfence","cve":"CVE-2025-31017","title":"Nav Menu Manager <= 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/debaf111-012a-477f-ae09-bdaf330e6b0f?source=api-prod","affected":[{"type":"plugin","slug":"noakes-menu-manager","name":"Nav Menu Manager","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:16:37Z"},{"id":"wordfence:debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3","source":"wordfence","cve":"CVE-2023-28493","title":"Newsmag <= 2.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/debe6f54-0f56-4bc9-a0cd-4f2caa1ed9e3?source=api-prod","affected":[{"type":"theme","slug":"newsmag","name":"NewsMag","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:debed89a-dcae-41e3-945e-1cd592fdd1c9","source":"wordfence","cve":"CVE-2015-9480","title":"RobotCPA <= 5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/debed89a-dcae-41e3-945e-1cd592fdd1c9?source=api-prod","affected":[{"type":"plugin","slug":"robotcpa","name":"robotcpa","from":"*","from_inclusive":true,"to":"5","to_inclusive":true,"patched_in":""}],"published":"2015-06-10T00:00:00Z","updated":"2024-08-09T19:40:58Z"},{"id":"wordfence:dec2855c-71a8-46b2-819a-d85cd11a1a24","source":"wordfence","cve":"CVE-2023-36681","title":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List <= 2.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dec2855c-71a8-46b2-819a-d85cd11a1a24?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-price-ticker-widget","name":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dec2e656-8936-43e2-b156-e96718fd7ef4","source":"wordfence","cve":"CVE-2023-5974","title":"WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dec2e656-8936-43e2-b156-e96718fd7ef4?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dec38992-a69f-4ccd-a23b-4dd1639897c3","source":"wordfence","cve":"CVE-2024-12613","title":"Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dec38992-a69f-4ccd-a23b-4dd1639897c3?source=api-prod","affected":[{"type":"plugin","slug":"passwords-manager","name":"Passwords Manager","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-01-15T21:19:19Z","updated":"2025-01-16T09:39:16Z"},{"id":"wordfence:dec51bd6-2ffe-47b6-9423-6131395bf439","source":"wordfence","cve":"CVE-2024-8271","title":"FOX \u2013 Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dec51bd6-2ffe-47b6-9423-6131395bf439?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2.1","to_inclusive":true,"patched_in":"1.4.2.2"}],"published":"2024-09-13T13:27:43Z","updated":"2024-09-14T02:04:21Z"},{"id":"wordfence:dec936cd-be30-4f1c-a4a2-94b8ff58a34b","source":"wordfence","cve":"CVE-2026-93550","title":"Veeqo for WooCommerce <= 2.2.8 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dec936cd-be30-4f1c-a4a2-94b8ff58a34b?source=api-prod","affected":[{"type":"plugin","slug":"veeqo-for-woocommerce","name":"Veeqo for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:25:23Z"},{"id":"wordfence:decb80c9-8f04-4d39-8e77-220f7862995e","source":"wordfence","cve":"CVE-2019-5983","title":"HTML5 Maps <= 1.6.5.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/decb80c9-8f04-4d39-8e77-220f7862995e?source=api-prod","affected":[{"type":"plugin","slug":"html5-maps","name":"HTML5 Maps","from":"*","from_inclusive":true,"to":"1.6.5.6","to_inclusive":true,"patched_in":"1.6.5.7"}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:decba9c0-36ee-4f97-9cc8-b56039233d10","source":"wordfence","cve":"CVE-2021-24133","title":"ActiveCampaign < 8.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/decba9c0-36ee-4f97-9cc8-b56039233d10?source=api-prod","affected":[{"type":"plugin","slug":"activecampaign-subscription-forms","name":"ActiveCampaign \u2013 The autonomous marketing platform","from":"*","from_inclusive":true,"to":"8.0.2","to_inclusive":false,"patched_in":"8.0.2"}],"published":"2020-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:decc6122-6c53-4cd5-bccd-3a0a16f02ea9","source":"wordfence","cve":"CVE-2026-104122","title":"Ukr-To-Lat <= 1.3.5 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/decc6122-6c53-4cd5-bccd-3a0a16f02ea9?source=api-prod","affected":[{"type":"plugin","slug":"ukr-to-lat","name":"Ukr-To-Lat","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:02:39Z"},{"id":"wordfence:dececd27-d311-41c0-a10c-3b9cc8b8f128","source":"wordfence","cve":"CVE-2022-2903","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dececd27-d311-41c0-a10c-3b9cc8b8f128?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.12","to_inclusive":true,"patched_in":"3.6.13"}],"published":"2022-09-05T00:00:00Z","updated":"2026-04-13T13:25:45Z"},{"id":"wordfence:ded05261-36f2-4414-b30a-7467b0c79938","source":"wordfence","cve":"CVE-2021-34653","title":"WP Fountain <= 1.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded05261-36f2-4414-b30a-7467b0c79938?source=api-prod","affected":[{"type":"plugin","slug":"wp-fountain","name":"WP Fountain","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ded1944f-662d-4d25-8277-4b1dc63b2144","source":"wordfence","cve":"CVE-2024-4144","title":"Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=api-prod","affected":[{"type":"plugin","slug":"simple-basic-contact-form","name":"Simple Basic Contact Form","from":"*","from_inclusive":true,"to":"20240502","to_inclusive":true,"patched_in":"20240511"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-14T05:33:01Z"},{"id":"wordfence:ded1b46e-b4b0-4f0d-929e-e1caf93576a7","source":"wordfence","cve":"CVE-2022-1692","title":"CP Image Store with Slideshow <= 1.0.67 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1b46e-b4b0-4f0d-929e-e1caf93576a7?source=api-prod","affected":[{"type":"plugin","slug":"cp-image-store","name":"CP Image Store with Slideshow","from":"*","from_inclusive":true,"to":"1.0.68","to_inclusive":false,"patched_in":"1.0.68"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ded2f366-375c-4cf6-9cbd-c969a3b3d6d5","source":"wordfence","cve":"CVE-2025-0371","title":"Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded2f366-375c-4cf6-9cbd-c969a3b3d6d5?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2025-01-20T20:12:23Z","updated":"2025-01-21T08:22:11Z"},{"id":"wordfence:ded3a14d-f8ac-46f9-843b-591a6b558556","source":"wordfence","cve":"CVE-2026-32390","title":"Nanosoft < 1.3.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded3a14d-f8ac-46f9-843b-591a6b558556?source=api-prod","affected":[{"type":"theme","slug":"nanosoft","name":"Nanosoft - WP Theme for IT Solutions and Services Company","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T14:12:52Z"},{"id":"wordfence:ded44da1-b3c5-43b6-aa9d-69d3cbf72826","source":"wordfence","cve":"CVE-2024-56288","title":"WP Docs <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded44da1-b3c5-43b6-aa9d-69d3cbf72826?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:24:06Z"},{"id":"wordfence:ded4b93f-fd90-4803-9d20-3109512b1a24","source":"wordfence","cve":"CVE-2024-22160","title":"Image Tag Manager <= 1.5 - Reflected Cross-Site Scripting via default_class","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded4b93f-fd90-4803-9d20-3109512b1a24?source=api-prod","affected":[{"type":"plugin","slug":"image-tag-manager","name":"Image Tag Manager","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ded4dcdc-cda2-4485-8d90-77b849a1e436","source":"wordfence","cve":"CVE-2025-69401","title":"WooODT Lite <= 2.5.5 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded4dcdc-cda2-4485-8d90-77b849a1e436?source=api-prod","affected":[{"type":"plugin","slug":"byconsole-woo-order-delivery-time","name":"Delivery Date Time & Pickup for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-02-11T00:00:00Z","updated":"2026-06-18T13:47:38Z"},{"id":"wordfence:ded73f27-6b3a-435a-861f-5e10938d6d1a","source":"wordfence","cve":"","title":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment  <= 2.2.4 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded73f27-6b3a-435a-861f-5e10938d6d1a?source=api-prod","affected":[{"type":"plugin","slug":"wappointment","name":"Appointment Bookings for Zoom GoogleMeet and more \u2013 Wappointment","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ded8f958-ed2a-43ab-8688-9f6d16515469","source":"wordfence","cve":"CVE-2024-53755","title":"Third Party Cookie Eraser <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ded8f958-ed2a-43ab-8688-9f6d16515469?source=api-prod","affected":[{"type":"plugin","slug":"third-party-cookie-eraser","name":"Third Party Cookie Eraser","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:30:52Z"},{"id":"wordfence:dedb1a15-933b-4e8a-b82d-a154414c61ba","source":"wordfence","cve":"CVE-2022-4753","title":"Print-O-Matic <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dedb1a15-933b-4e8a-b82d-a154414c61ba?source=api-prod","affected":[{"type":"plugin","slug":"print-o-matic","name":"Print-O-Matic","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dedd24e6-ac0c-48cd-a76a-8fb61d2c3c0f","source":"wordfence","cve":"CVE-2026-15730","title":"GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dedd24e6-ac0c-48cd-a76a-8fb61d2c3c0f?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.9.9.1","to_inclusive":true,"patched_in":"7.9.9.2"}],"published":"2026-07-27T18:18:53Z","updated":"2026-07-28T06:54:36Z"},{"id":"wordfence:dede9cfc-61f1-4df1-bd40-e5ae73199575","source":"wordfence","cve":"","title":"OneLogin SAML SSO <= 3.1.2 - Open Redirection","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dede9cfc-61f1-4df1-bd40-e5ae73199575?source=api-prod","affected":[{"type":"plugin","slug":"onelogin-saml-sso","name":"OneLogin SAML SSO","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2021-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dee00cec-782a-406f-a918-c65cd80c56b0","source":"wordfence","cve":"CVE-2024-35677","title":"MegaMenu <= 2.3.12 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee00cec-782a-406f-a918-c65cd80c56b0?source=api-prod","affected":[{"type":"plugin","slug":"stm-megamenu","name":"MegaMenu","from":"*","from_inclusive":true,"to":"2.3.12","to_inclusive":true,"patched_in":"2.3.13"}],"published":"2024-06-05T00:00:00Z","updated":"2024-06-13T14:40:16Z"},{"id":"wordfence:dee03f28-2cca-4b07-b604-1f5a278af7d1","source":"wordfence","cve":"CVE-2025-23431","title":"Envato Affiliater <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee03f28-2cca-4b07-b604-1f5a278af7d1?source=api-prod","affected":[{"type":"plugin","slug":"envato-affiliater","name":"Envato Affiliater","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:42:38Z"},{"id":"wordfence:dee18143-3b95-42fe-a69c-1862f3d30237","source":"wordfence","cve":"CVE-2024-5028","title":"CM WordPress Search And Replace Plugin <= 1.3.8 - Cross-Site Request Forgery to Plugin Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee18143-3b95-42fe-a69c-1862f3d30237?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-07-22T00:00:00Z","updated":"2024-08-09T18:39:10Z"},{"id":"wordfence:dee61aa4-4c35-464e-b085-974e17e1eabb","source":"wordfence","cve":"CVE-2026-45439","title":"Realtyna Organic IDX plugin + WPL Real Estate <= 5.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee61aa4-4c35-464e-b085-974e17e1eabb?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:16:24Z"},{"id":"wordfence:dee712ce-d49c-4706-964a-b8885cb6546e","source":"wordfence","cve":"CVE-2024-54385","title":"Radio Player <= 2.0.83 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee712ce-d49c-4706-964a-b8885cb6546e?source=api-prod","affected":[{"type":"plugin","slug":"radio-player","name":"Radio Player \u2013 Live Shoutcast, Icecast and Any Audio Stream Player","from":"*","from_inclusive":true,"to":"2.0.83","to_inclusive":true,"patched_in":"2.0.85"}],"published":"2024-12-12T00:00:00Z","updated":"2025-05-21T13:59:50Z"},{"id":"wordfence:dee7d15e-61f5-4774-8ae9-060634b9662c","source":"wordfence","cve":"CVE-2025-67541","title":"WP-ShowHide <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dee7d15e-61f5-4774-8ae9-060634b9662c?source=api-prod","affected":[{"type":"plugin","slug":"wp-showhide","name":"WP-ShowHide","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":"1.06"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:15:44Z"},{"id":"wordfence:deebcfc0-a79b-4de1-84f6-cb9dfffce823","source":"wordfence","cve":"CVE-2025-52785","title":"SMM API <= 6.0.30 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deebcfc0-a79b-4de1-84f6-cb9dfffce823?source=api-prod","affected":[{"type":"plugin","slug":"smm-api","name":"SMM API","from":"*","from_inclusive":true,"to":"6.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:36:34Z"},{"id":"wordfence:deec46f4-f7b4-4da4-aa3a-d04b9177528f","source":"wordfence","cve":"CVE-2026-54825","title":"wpDataTables (Premium) <= 7.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deec46f4-f7b4-4da4-aa3a-d04b9177528f?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables \u2013 WordPress Data Table, Dynamic Tables & Table Charts Plugin","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:55:02Z"},{"id":"wordfence:deeeb78d-1757-44ec-968b-968d919b84f1","source":"wordfence","cve":"CVE-2026-2448","title":"Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deeeb78d-1757-44ec-968b-968d919b84f1?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.33.5","to_inclusive":true,"patched_in":"2.34.0"}],"published":"2026-03-02T13:14:54Z","updated":"2026-03-03T01:21:50Z"},{"id":"wordfence:deef6900-531f-42f1-89a4-28ec62817d0b","source":"wordfence","cve":"CVE-2024-51685","title":"Accordion title for Elementor <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deef6900-531f-42f1-89a4-28ec62817d0b?source=api-prod","affected":[{"type":"plugin","slug":"accordion-title-for-elementor","name":"Accordion title for Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:39:22Z"},{"id":"wordfence:def06edd-ea4f-4b49-9902-b179d40e4133","source":"wordfence","cve":"CVE-2023-4631","title":"DoLogin Security <= 3.6 - IP Address Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def06edd-ea4f-4b49-9902-b179d40e4133?source=api-prod","affected":[{"type":"plugin","slug":"dologin","name":"DoLogin Security","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:def0da23-248b-40e2-9d70-8dd1ecbe3d45","source":"wordfence","cve":"","title":"WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def0da23-248b-40e2-9d70-8dd1ecbe3d45?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":false,"patched_in":"4.2.1"}],"published":"2020-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:def1f99c-9d08-4971-82fe-bf74551542a8","source":"wordfence","cve":"CVE-2026-18030","title":"Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def1f99c-9d08-4971-82fe-bf74551542a8?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"3.1.8.7","to_inclusive":true,"patched_in":"3.1.8.8"}],"published":"2026-08-04T00:00:00Z","updated":"2026-09-18T15:12:31Z"},{"id":"wordfence:def28d93-744f-4232-b745-8430d466b9fa","source":"wordfence","cve":"CVE-2016-11011","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def28d93-744f-4232-b745-8430d466b9fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:def62ae8-ff98-4dc5-bd74-3157d28004e9","source":"wordfence","cve":"CVE-2026-39705","title":"MIPL WC Multisite Sync <= 1.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def62ae8-ff98-4dc5-bd74-3157d28004e9?source=api-prod","affected":[{"type":"plugin","slug":"mipl-wc-multisite-sync","name":"MIPL Multistore Sync for WooCommerce. Sync Products, Stock and Orders.","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-01T00:00:00Z","updated":"2026-04-15T21:33:18Z"},{"id":"wordfence:def6980f-5046-437e-89ae-4302e89b2276","source":"wordfence","cve":"CVE-2025-64272","title":"Email marketing for WordPress by GetResponse Official <= 1.5.3 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def6980f-5046-437e-89ae-4302e89b2276?source=api-prod","affected":[{"type":"plugin","slug":"getresponse-official","name":"GetResponse Official","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2025-09-25T00:00:00Z","updated":"2025-12-20T19:22:07Z"},{"id":"wordfence:def8be8e-142e-4f8c-85e0-67e46a349abe","source":"wordfence","cve":"CVE-2025-69089","title":"Auto Listings <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/def8be8e-142e-4f8c-85e0-67e46a349abe?source=api-prod","affected":[{"type":"plugin","slug":"auto-listings","name":"Auto Listings \u2013 Car Listings & Car Dealership Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:07:32Z"},{"id":"wordfence:defb87dd-bf5f-411f-b948-699337d05d44","source":"wordfence","cve":"CVE-2023-6699","title":"WP Compress \u2013 Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css","severity":"critical","cvss":9.1,"cwe":"CWE-24","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/defb87dd-bf5f-411f-b948-699337d05d44?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.10.33","to_inclusive":true,"patched_in":"6.10.34"}],"published":"2024-01-03T00:00:00Z","updated":"2024-07-29T21:37:37Z"},{"id":"wordfence:defc5b5a-243d-4564-a9f8-3ecf3538129b","source":"wordfence","cve":"CVE-2023-41847","title":"Notice Bar <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/defc5b5a-243d-4564-a9f8-3ecf3538129b?source=api-prod","affected":[{"type":"plugin","slug":"notice-bar","name":"Notice Bar","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:defd82dd-bda0-4f0c-88cb-4db983953097","source":"wordfence","cve":"CVE-2021-24998","title":"Simple JWT Login <= 3.2.1 - Insecure Password Creation","severity":"high","cvss":7.5,"cwe":"CWE-326","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/defd82dd-bda0-4f0c-88cb-4db983953097?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:defebc39-ec6a-4116-ac0d-5a6c998fd4e9","source":"wordfence","cve":"CVE-2025-15705","title":"Contact Form by Supsystic <= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/defebc39-ec6a-4116-ac0d-5a6c998fd4e9?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-by-supsystic","name":"Contact Form by Supsystic \u2013 Drag & Drop Form Builder with Templates & Form Statistics","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-28T14:58:06Z"},{"id":"wordfence:deff35af-0960-4fbc-9915-7e6758bb3ca0","source":"wordfence","cve":"CVE-2026-32584","title":"Smart One Click Setup \u2013 Complete Demo Import & Export <= 1.4.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deff35af-0960-4fbc-9915-7e6758bb3ca0?source=api-prod","affected":[{"type":"plugin","slug":"smart-one-click-setup","name":"Smart One Click Setup \u2013 Complete Demo Import & Export","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-02T14:40:00Z","updated":"2026-10-08T23:21:21Z"},{"id":"wordfence:deffd646-5117-4086-bf4b-8a17ffdaad8b","source":"wordfence","cve":"CVE-2025-8418","title":"B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deffd646-5117-4086-bf4b-8a17ffdaad8b?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-08-11T00:00:00Z","updated":"2025-08-12T06:42:43Z"},{"id":"wordfence:deffffaa-a593-4500-8809-4eb16f6ad189","source":"wordfence","cve":"CVE-2026-28113","title":"Ultimate Learning Pro <= 3.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/deffffaa-a593-4500-8809-4eb16f6ad189?source=api-prod","affected":[{"type":"plugin","slug":"indeed-learning-pro","name":"Ultimate Learning Pro","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T17:12:31Z"},{"id":"wordfence:df00c8bc-8acd-4197-86fe-b88cb47d52c3","source":"wordfence","cve":"CVE-2023-4278","title":"MasterStudy LMS <= 3.0.17 - Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df00c8bc-8acd-4197-86fe-b88cb47d52c3?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.0.17","to_inclusive":true,"patched_in":"3.0.18"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df015a51-7eb8-4fbc-839f-bcf6b2e2b1a7","source":"wordfence","cve":"","title":"AccessPress Social Icons 1.8.2 - Backdoor","severity":"high","cvss":7.5,"cwe":"CWE-912","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df015a51-7eb8-4fbc-839f-bcf6b2e2b1a7?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-social-icons","name":"AccessPress Social Icons","from":"1.8.2","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df02079b-e1ec-40a9-abad-a37b2b9f5fd0","source":"wordfence","cve":"CVE-2025-69042","title":"Lindo <= 1.2.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df02079b-e1ec-40a9-abad-a37b2b9f5fd0?source=api-prod","affected":[{"type":"theme","slug":"lindo","name":"Lindo - Jewelry Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:29:53Z"},{"id":"wordfence:df037656-5894-41f6-a50d-2f454205f95a","source":"wordfence","cve":"CVE-2025-54029","title":"WooCommerce csv import export <= 2.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df037656-5894-41f6-a50d-2f454205f95a?source=api-prod","affected":[{"type":"plugin","slug":"extendons-eo-wooimport-export","name":"WooCommerce csv import export","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-08-26T00:00:00Z","updated":"2025-09-03T17:15:28Z"},{"id":"wordfence:df045b6c-ce8a-494e-a023-ed8165b0634c","source":"wordfence","cve":"CVE-2026-39499","title":"Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 - Authenticated (Shop manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df045b6c-ce8a-494e-a023-ed8165b0634c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-fields-for-woocommerce","name":"Advanced Product Fields (Product Addons) for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.19","to_inclusive":true,"patched_in":"1.6.20"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T14:59:00Z"},{"id":"wordfence:df04f598-941f-4a85-a7e0-948213f6e815","source":"wordfence","cve":"CVE-2025-49982","title":"WP Customer Area <= 8.3.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df04f598-941f-4a85-a7e0-948213f6e815?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.3.6","to_inclusive":true,"patched_in":"8.3.7"}],"published":"2025-06-19T00:00:00Z","updated":"2026-10-13T17:10:13Z"},{"id":"wordfence:df05f31f-85ee-42e3-97b7-c3c11f2ab2b4","source":"wordfence","cve":"CVE-2025-54717","title":"WP Membership <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df05f31f-85ee-42e3-97b7-c3c11f2ab2b4?source=api-prod","affected":[{"type":"plugin","slug":"wp-membership","name":"WP Membership","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:21:46Z"},{"id":"wordfence:df06f6c7-98b8-4d17-aa53-c5f13ada7c62","source":"wordfence","cve":"CVE-2026-13406","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1066 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df06f6c7-98b8-4d17-aa53-c5f13ada7c62?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":false,"patched_in":"1.7.1066"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:05:00Z"},{"id":"wordfence:df080dba-0f50-4ff4-bf4d-01f71f92f960","source":"wordfence","cve":"CVE-2025-43840","title":"CheckBot <= 1.05 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df080dba-0f50-4ff4-bf4d-01f71f92f960?source=api-prod","affected":[{"type":"plugin","slug":"checkbot","name":"CheckBot","from":"*","from_inclusive":true,"to":"1.05","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T21:59:13Z"},{"id":"wordfence:df086094-4f08-4619-85b8-83a8d0b16c73","source":"wordfence","cve":"CVE-2026-120857","title":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat <= 6.1.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df086094-4f08-4619-85b8-83a8d0b16c73?source=api-prod","affected":[{"type":"plugin","slug":"webcam-2way-videochat","name":"2Way VideoCalls and Random Chat \u2013 HTML5 Webcam Videochat","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2026-11-07T10:39:00Z","updated":"2026-11-10T19:41:48Z"},{"id":"wordfence:df086b87-b025-417f-adc0-5f2829024a0b","source":"wordfence","cve":"CVE-2014-100022","title":"mTouch Quiz < 3.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df086b87-b025-417f-adc0-5f2829024a0b?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df08ecbe-0a14-4522-9e2d-5398f57c6acd","source":"wordfence","cve":"CVE-2025-58227","title":"Podlove Subscribe button <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df08ecbe-0a14-4522-9e2d-5398f57c6acd?source=api-prod","affected":[{"type":"plugin","slug":"podlove-subscribe-button","name":"Podlove Subscribe button","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-14T19:05:33Z"},{"id":"wordfence:df09af41-399a-4878-8420-721f1198d895","source":"wordfence","cve":"CVE-2025-2006","title":"Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df09af41-399a-4878-8420-721f1198d895?source=api-prod","affected":[{"type":"plugin","slug":"image-upload-for-bbpress","name":"Inline Image Upload for BBPress","from":"*","from_inclusive":true,"to":"1.1.19","to_inclusive":true,"patched_in":"1.1.20"}],"published":"2025-03-28T18:36:49Z","updated":"2025-04-07T18:22:35Z"},{"id":"wordfence:df09d88a-2cda-4ab1-99a0-c54e98cf59e5","source":"wordfence","cve":"CVE-2026-14311","title":"Booking for Appointments and Events Calendar \u2013 Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df09d88a-2cda-4ab1-99a0-c54e98cf59e5?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-09-17T09:14:37Z","updated":"2026-09-17T21:28:50Z"},{"id":"wordfence:df0b25cb-5233-412d-8704-63f037b4fcec","source":"wordfence","cve":"CVE-2022-3961","title":"Directorist <= 7.4.3 - Authenticated (Subscriber+) Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df0b25cb-5233-412d-8704-63f037b4fcec?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.4.3","to_inclusive":true,"patched_in":"7.4.4"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df0dc77e-3b15-4f9c-bcc3-f2ca78fd2280","source":"wordfence","cve":"CVE-2025-46462","title":"WPVN <= 0.7.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df0dc77e-3b15-4f9c-bcc3-f2ca78fd2280?source=api-prod","affected":[{"type":"plugin","slug":"wpvn-username-changer","name":"WPVN \u2013 Username Changer","from":"*","from_inclusive":true,"to":"0.7.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:22:44Z"},{"id":"wordfence:df0dcdf4-fcb1-4832-b39b-4ec3ee980506","source":"wordfence","cve":"CVE-2022-1349","title":"WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Profile Picture Deletion","severity":"medium","cvss":6.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df0dcdf4-fcb1-4832-b39b-4ec3ee980506?source=api-prod","affected":[{"type":"plugin","slug":"wpqa","name":"WPQA - Builder forms Addon For WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df109949-bd7f-4077-84a8-13750fc70238","source":"wordfence","cve":"CVE-2025-31849","title":"Nemesis All-in-One <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df109949-bd7f-4077-84a8-13750fc70238?source=api-prod","affected":[{"type":"plugin","slug":"nemesis-all-in-one","name":"Nemesis All-in-One | Newspaper Builder Elementor Extention","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-18T13:38:09Z"},{"id":"wordfence:df153d11-6f9e-43c4-8e82-fe200461a813","source":"wordfence","cve":"CVE-2025-58896","title":"Otaku <= 1.8.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df153d11-6f9e-43c4-8e82-fe200461a813?source=api-prod","affected":[{"type":"theme","slug":"otaku","name":"Otaku - Anime, Manga & K-Pop WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:30:34Z"},{"id":"wordfence:df1a3425-b1d7-4914-ab19-c215d4e845ea","source":"wordfence","cve":"","title":"Album and Image Gallery plus Lightbox <= 1.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df1a3425-b1d7-4914-ab19-c215d4e845ea?source=api-prod","affected":[{"type":"plugin","slug":"album-and-image-gallery-plus-lightbox","name":"Album and Image Gallery Plus Lightbox","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df20aa75-c6d3-48a6-9b19-7547bf12fb82","source":"wordfence","cve":"CVE-2022-1773","title":"WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df20aa75-c6d3-48a6-9b19-7547bf12fb82?source=api-prod","affected":[{"type":"plugin","slug":"wp-athletics","name":"WP Athletics","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df21d1f2-2a72-4a9c-8542-3a0c9b732497","source":"wordfence","cve":"CVE-2026-57780","title":"Envision Page Builder \u2013 A collection of WordPress Gutenberg blocks & templates <= 0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df21d1f2-2a72-4a9c-8542-3a0c9b732497?source=api-prod","affected":[{"type":"plugin","slug":"envision-page-builder","name":"Envision Page Builder \u2013 A collection of WordPress Gutenberg blocks & templates","from":"*","from_inclusive":true,"to":"0.22","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:37:50Z"},{"id":"wordfence:df24fbde-ad70-4cd9-903c-08c0ae80a2dd","source":"wordfence","cve":"CVE-2026-97070","title":"Cozy Blocks \u2013 Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df24fbde-ad70-4cd9-903c-08c0ae80a2dd?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.23","to_inclusive":true,"patched_in":"2.2.24"}],"published":"2026-10-03T17:41:26Z","updated":"2026-10-09T00:11:09Z"},{"id":"wordfence:df2674c9-da77-412c-a812-f1749f54d04b","source":"wordfence","cve":"CVE-2026-2721","title":"MailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df2674c9-da77-412c-a812-f1749f54d04b?source=api-prod","affected":[{"type":"plugin","slug":"mailarchiver","name":"MailArchiver","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-03-06T11:56:23Z","updated":"2026-03-07T01:21:23Z"},{"id":"wordfence:df268fbf-c784-429e-a77a-967aac529cbd","source":"wordfence","cve":"CVE-2025-26996","title":"Sign-up Sheets <= 2.3.0.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df268fbf-c784-429e-a77a-967aac529cbd?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"2.3.0.1","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:29:44Z"},{"id":"wordfence:df2854c4-5d57-4c39-a28f-41dab36a086e","source":"wordfence","cve":"CVE-2025-13135","title":"HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df2854c4-5d57-4c39-a28f-41dab36a086e?source=api-prod","affected":[{"type":"plugin","slug":"hotelrunner","name":"HotelRunner Booking Widget","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:27:44Z","updated":"2025-11-21T07:31:56Z"},{"id":"wordfence:df28ecd7-d463-48b7-95e6-8adc9f34d6bd","source":"wordfence","cve":"CVE-2026-89093","title":"Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df28ecd7-d463-48b7-95e6-8adc9f34d6bd?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.33","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-09-18T13:53:09Z","updated":"2026-09-19T02:27:12Z"},{"id":"wordfence:df2e744f-e1d6-4380-8e24-e98e9df4dd2f","source":"wordfence","cve":"CVE-2025-6588","title":"FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df2e744f-e1d6-4380-8e24-e98e9df4dd2f?source=api-prod","affected":[{"type":"plugin","slug":"funnelcockpit","name":"FunnelCockpit","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-07-23T20:46:34Z","updated":"2025-08-05T12:58:44Z"},{"id":"wordfence:df2ebfb9-f973-44f2-8398-cbaafb13e6b0","source":"wordfence","cve":"CVE-2025-22768","title":"Rocket Media Library Mime Type <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df2ebfb9-f973-44f2-8398-cbaafb13e6b0?source=api-prod","affected":[{"type":"plugin","slug":"rocket-media-library-mime-type","name":"Rocket Media Library Mime Type","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-01-14T00:00:00Z","updated":"2026-10-28T21:06:09Z"},{"id":"wordfence:df2eefe5-5a37-475f-a042-1ad368ba04c1","source":"wordfence","cve":"CVE-2026-91010","title":"Invisible Anti-Spam & CAPTCHA <= 5.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df2eefe5-5a37-475f-a042-1ad368ba04c1?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliant-recaptcha-for-all-forms","name":"Invisible Anti-Spam & CAPTCHA \u2014 reCAPTCHA Alternative for All Forms","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:08:04Z"},{"id":"wordfence:df30f21a-cd3a-4391-9f59-81538fefabdc","source":"wordfence","cve":"CVE-2025-4220","title":"Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df30f21a-cd3a-4391-9f59-81538fefabdc?source=api-prod","affected":[{"type":"plugin","slug":"xavins-list-subpages","name":"Xavin&#039;s List Subpages","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-06T13:31:42Z","updated":"2025-05-07T01:43:10Z"},{"id":"wordfence:df324557-9ead-46aa-a019-89d1d5ca6d9c","source":"wordfence","cve":"CVE-2025-39514","title":"Asgaros Forum <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df324557-9ead-46aa-a019-89d1d5ca6d9c?source=api-prod","affected":[{"type":"plugin","slug":"asgaros-forum","name":"Asgaros Forum","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-12-04T20:45:18Z"},{"id":"wordfence:df326ccb-97b0-4b8b-939b-c976cf9995e6","source":"wordfence","cve":"CVE-2025-28910","title":"WP Hide Admin Bar <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df326ccb-97b0-4b8b-939b-c976cf9995e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-hide-admin-bar","name":"WP Hide Admin Bar","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:20:23Z"},{"id":"wordfence:df32e1d0-3645-432c-a2e4-2d63709c4ffd","source":"wordfence","cve":"CVE-2015-4089","title":"WP Fastest Cache < 0.8.3.5 - Multiple Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df32e1d0-3645-432c-a2e4-2d63709c4ffd?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.3.5","to_inclusive":false,"patched_in":"0.8.3.5"}],"published":"2015-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df35d8c6-55ec-4cf5-8055-93ec5193c0a4","source":"wordfence","cve":"CVE-2023-5162","title":"Options for Twenty Seventeen <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df35d8c6-55ec-4cf5-8055-93ec5193c0a4?source=api-prod","affected":[{"type":"plugin","slug":"options-for-twenty-seventeen","name":"Options for Twenty Seventeen","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df36eae9-6f2b-432c-a765-57450939b344","source":"wordfence","cve":"CVE-2026-4703","title":"WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df36eae9-6f2b-432c-a765-57450939b344?source=api-prod","affected":[{"type":"plugin","slug":"ws-form","name":"WS Form LITE \u2013 Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.10.80","to_inclusive":true,"patched_in":"1.10.82"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-22T15:27:26Z"},{"id":"wordfence:df3b5124-1151-4402-b30f-038470c7a951","source":"wordfence","cve":"","title":"TS Poll \u2013 Best Poll Plugin for WordPress <= 1.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df3b5124-1151-4402-b30f-038470c7a951?source=api-prod","affected":[{"type":"plugin","slug":"poll-wp","name":"TS Poll \u2013 Survey, Versus Poll, Image Poll, Video Poll","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df3fe27a-4f5f-40a5-ae5a-bcf1232be0f0","source":"wordfence","cve":"CVE-2026-39687","title":"Rapid Car Check Vehicle Data <= 2.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df3fe27a-4f5f-40a5-ae5a-bcf1232be0f0?source=api-prod","affected":[{"type":"plugin","slug":"free-vehicle-data-uk","name":"Rapid Car Check","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-02-23T00:00:00Z","updated":"2026-06-23T17:34:53Z"},{"id":"wordfence:df406e59-94d9-4704-82a3-02c2c1773c82","source":"wordfence","cve":"CVE-2026-3231","title":"Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df406e59-94d9-4704-82a3-02c2c1773c82?source=api-prod","affected":[{"type":"plugin","slug":"woo-checkout-field-editor-pro","name":"Checkout Field Editor (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-03-10T21:13:56Z","updated":"2026-03-13T20:55:09Z"},{"id":"wordfence:df40eb21-2080-4de5-9055-09246a8a275e","source":"wordfence","cve":"CVE-2024-1499","title":"Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df40eb21-2080-4de5-9055-09246a8a275e?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.30","to_inclusive":true,"patched_in":"2.10.31"}],"published":"2024-02-26T00:00:00Z","updated":"2024-05-31T15:30:58Z"},{"id":"wordfence:df413b9d-5c22-4276-a11b-4f193c48740d","source":"wordfence","cve":"","title":"HT Builder <= 1.2.9 - Cross-Site Request Forgery via plugin_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df413b9d-5c22-4276-a11b-4f193c48740d?source=api-prod","affected":[{"type":"plugin","slug":"ht-builder","name":"HT Builder \u2013 WordPress Theme Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df417809-153f-4d05-a495-bfc17897a5bf","source":"wordfence","cve":"CVE-2025-26749","title":"Additional Custom Product Tabs for WooCommerce <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df417809-153f-4d05-a495-bfc17897a5bf?source=api-prod","affected":[{"type":"plugin","slug":"product-tabs-for-woocommerce","name":"Additional Custom Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T19:20:04Z"},{"id":"wordfence:df41b8d9-cd0e-4758-b569-2615438b8eba","source":"wordfence","cve":"CVE-2022-47601","title":"WP Table Manager <= 3.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df41b8d9-cd0e-4758-b569-2615438b8eba?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-manager","name":"WP Table Manager","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2023-01-27T00:00:00Z","updated":"2025-01-20T16:35:09Z"},{"id":"wordfence:df420c75-5ebc-49ad-b721-2c6c166f7ed4","source":"wordfence","cve":"CVE-2024-52494","title":"Dynamic \"To Top\"  3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df420c75-5ebc-49ad-b721-2c6c166f7ed4?source=api-prod","affected":[{"type":"plugin","slug":"dynamic-to-top","name":"Dynamic \"To Top\" Plugin","from":"3.5.2","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:08:50Z"},{"id":"wordfence:df42202e-eb6d-487f-b394-fc278559ebe8","source":"wordfence","cve":"CVE-2024-56067","title":"WP SuperBackup <= 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df42202e-eb6d-487f-b394-fc278559ebe8?source=api-prod","affected":[{"type":"plugin","slug":"indeed-wp-superbackup","name":"Super Backup & Clone - Migrate for WordPress","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:09:08Z"},{"id":"wordfence:df46b3d5-a433-47b5-99b8-117591f7dd16","source":"wordfence","cve":"","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df46b3d5-a433-47b5-99b8-117591f7dd16?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.0.34.1","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.1","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.2","from_inclusive":true,"to":"3.2.27","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.3","from_inclusive":true,"to":"3.3.21.3","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.4","from_inclusive":true,"to":"3.4.34.1","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.5","from_inclusive":true,"to":"3.5.8.3","to_inclusive":true,"patched_in":"3.0.34.2"},{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.6","from_inclusive":true,"to":"3.6.10","to_inclusive":true,"patched_in":"3.0.34.2"}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df47132a-c4c2-457a-a82e-4df28e7d0c54","source":"wordfence","cve":"CVE-2026-15039","title":"Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df47132a-c4c2-457a-a82e-4df28e7d0c54?source=api-prod","affected":[{"type":"plugin","slug":"giftware","name":"Gift Cards For WooCommerce Pro","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.2.10"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T15:18:17Z"},{"id":"wordfence:df48f7f9-7bc9-4f9b-b9b5-6bfb86309030","source":"wordfence","cve":"CVE-2025-5117","title":"Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df48f7f9-7bc9-4f9b-b9b5-6bfb86309030?source=api-prod","affected":[{"type":"plugin","slug":"property","name":"Property \u2013 Real Estate Directory Listing","from":"1.0.5","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-05-26T21:31:10Z","updated":"2025-05-27T11:14:27Z"},{"id":"wordfence:df498694-43fd-4c46-aafa-5448497ddbf0","source":"wordfence","cve":"CVE-2025-23548","title":"Responsivity <= 0.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df498694-43fd-4c46-aafa-5448497ddbf0?source=api-prod","affected":[{"type":"plugin","slug":"responsivity","name":"Responsivity","from":"*","from_inclusive":true,"to":"0.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T16:26:01Z"},{"id":"wordfence:df4aa0e3-a365-435d-bd89-8b8648b6361b","source":"wordfence","cve":"CVE-2025-58640","title":"Document Engine <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4aa0e3-a365-435d-bd89-8b8648b6361b?source=api-prod","affected":[{"type":"plugin","slug":"document-engine","name":"Document Engine \u2013 Document Library, PDF Viewer & Post to PDF","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:37:00Z"},{"id":"wordfence:df4ad83f-280e-46fa-ad47-3822fa67b10d","source":"wordfence","cve":"CVE-2015-9299","title":"Events Manager < 5.5.7.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ad83f-280e-46fa-ad47-3822fa67b10d?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.5.7.1","to_inclusive":false,"patched_in":"5.5.7.1"}],"published":"2015-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df4ada5f-6008-40b9-ad83-c6af82e64e9f","source":"wordfence","cve":"CVE-2025-11763","title":"Display Pages Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ada5f-6008-40b9-ad83-c6af82e64e9f?source=api-prod","affected":[{"type":"plugin","slug":"display-pages-shortcode","name":"Display Pages Shortcode","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:28:02Z","updated":"2025-11-21T07:31:57Z"},{"id":"wordfence:df4b554a-0336-404c-b06c-2bc98c99997d","source":"wordfence","cve":"CVE-2026-1210","title":"Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4b554a-0336-404c-b06c-2bc98c99997d?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.20.7","to_inclusive":true,"patched_in":"3.20.8"}],"published":"2026-02-02T17:49:48Z","updated":"2026-02-03T06:38:05Z"},{"id":"wordfence:df4dabd8-b676-4449-ab28-34d73fe0c39a","source":"wordfence","cve":"CVE-2024-6847","title":"Chatbot with ChatGPT <= 2.4.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4dabd8-b676-4449-ab28-34d73fe0c39a?source=api-prod","affected":[{"type":"plugin","slug":"smartsearchwp","name":"AI Chatbot & Semantic Search: ChatGPT Answers From Your Content","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2024-07-29T00:00:00Z","updated":"2024-08-01T20:08:21Z"},{"id":"wordfence:df4ea9f7-b014-46b4-9684-ce3ff64d8a39","source":"wordfence","cve":"CVE-2025-67948","title":"SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ea9f7-b014-46b4-9684-ce3ff64d8a39?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-email-marketing-newsletter","name":"SendPulse Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-12-05T00:00:00Z","updated":"2025-12-20T20:23:10Z"},{"id":"wordfence:df4f4358-af6a-4a1a-bb83-afe31b3cdb9f","source":"wordfence","cve":"CVE-2026-1307","title":"Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df4f4358-af6a-4a1a-bb83-afe31b3cdb9f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.14.1","to_inclusive":true,"patched_in":"3.14.2"}],"published":"2026-03-27T18:10:41Z","updated":"2026-03-28T06:46:09Z"},{"id":"wordfence:df534aba-242a-45c2-9d1c-6a08b58f8ee7","source":"wordfence","cve":"CVE-2023-23870","title":"Responsive Vertical Icon Menu <= 1.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df534aba-242a-45c2-9d1c-6a08b58f8ee7?source=api-prod","affected":[{"type":"plugin","slug":"wpdevart-vertical-menu","name":"Responsive Vertical Icon Menu","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df53dea5-4497-45ee-8f5c-e43f19a702f9","source":"wordfence","cve":"CVE-2015-9406","title":"mTheme-Unus < 2.3 - Directory Traversal to Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df53dea5-4497-45ee-8f5c-e43f19a702f9?source=api-prod","affected":[{"type":"theme","slug":"mTheme-Unus","name":"mTheme-Unus","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2015-09-30T00:00:00Z","updated":"2025-07-18T21:22:41Z"},{"id":"wordfence:df54a888-fe7a-43ef-a77f-fb6e3401defe","source":"wordfence","cve":"CVE-2022-0381","title":"Embed Swagger <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df54a888-fe7a-43ef-a77f-fb6e3401defe?source=api-prod","affected":[{"type":"plugin","slug":"embed-swagger","name":"Embed Swagger","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df578e6c-cecd-4c80-b11c-3916ec22c7c7","source":"wordfence","cve":"CVE-2026-103365","title":"Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df578e6c-cecd-4c80-b11c-3916ec22c7c7?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"28.4","to_inclusive":true,"patched_in":"28.5"}],"published":"2026-10-09T15:19:57Z","updated":"2026-10-14T13:38:06Z"},{"id":"wordfence:df5c31fc-48ae-4152-b1e7-f280b1d93ca6","source":"wordfence","cve":"CVE-2025-46442","title":"Loan Calculator <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df5c31fc-48ae-4152-b1e7-f280b1d93ca6?source=api-prod","affected":[{"type":"plugin","slug":"repayment-calculator","name":"Loan Calculator","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-04-24T00:00:00Z","updated":"2026-10-28T21:07:20Z"},{"id":"wordfence:df5cd6e7-e821-403f-a048-25c2ca1fb2de","source":"wordfence","cve":"CVE-2024-3201","title":"WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df5cd6e7-e821-403f-a048-25c2ca1fb2de?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.32","to_inclusive":true,"patched_in":"3.1.33"}],"published":"2024-05-22T13:28:57Z","updated":"2024-05-23T01:56:21Z"},{"id":"wordfence:df5ddcc0-7bc2-4895-a07f-0b373802bf36","source":"wordfence","cve":"CVE-2025-10003","title":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df5ddcc0-7bc2-4895-a07f-0b373802bf36?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.44","to_inclusive":true,"patched_in":"1.2.45"}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-06T02:24:19Z"},{"id":"wordfence:df5eb1b8-880d-4d7e-bdca-69bbd9c1ce5e","source":"wordfence","cve":"CVE-2026-119113","title":"GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df5eb1b8-880d-4d7e-bdca-69bbd9c1ce5e?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.199","to_inclusive":true,"patched_in":"2.8.200"}],"published":"2026-10-30T17:06:12Z","updated":"2026-10-30T17:15:33Z"},{"id":"wordfence:df5fc86f-e4ba-424b-bece-79abd763cf74","source":"wordfence","cve":"CVE-2026-6089","title":"WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":4.9,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df5fc86f-e4ba-424b-bece-79abd763cf74?source=api-prod","affected":[{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"2.1.2","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2026-07-28T21:18:31Z","updated":"2026-07-29T09:31:15Z"},{"id":"wordfence:df600822-3b95-4c57-9cf5-782e2a23ea8f","source":"wordfence","cve":"CVE-2026-40752","title":"Manufaktur Solutions <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df600822-3b95-4c57-9cf5-782e2a23ea8f?source=api-prod","affected":[{"type":"theme","slug":"manufaktursolutions","name":"Manufaktur Solutions - Industry and Factory WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:21:56Z"},{"id":"wordfence:df6080e0-2b00-4df6-849a-c24db9200ada","source":"wordfence","cve":"CVE-2025-31456","title":"Ultimate Security Checker <= 4.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6080e0-2b00-4df6-849a-c24db9200ada?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-security-checker","name":"Ultimate Security Checker","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:15:48Z"},{"id":"wordfence:df60951a-7170-4e7b-894c-d713a79d6fd0","source":"wordfence","cve":"CVE-2026-32404","title":"Studio99 WP Monitor <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df60951a-7170-4e7b-894c-d713a79d6fd0?source=api-prod","affected":[{"type":"plugin","slug":"studio99-wp-monitor","name":"Studio99 WP Monitor","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-02-21T00:00:00Z","updated":"2026-04-15T20:58:35Z"},{"id":"wordfence:df62ed50-4d6b-41bb-bc16-395977d64745","source":"wordfence","cve":"CVE-2025-58636","title":"Gravity Forms Keap/Infusionsoft <= 1.2.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df62ed50-4d6b-41bb-bc16-395977d64745?source=api-prod","affected":[{"type":"plugin","slug":"gf-infusionsoft","name":"WP Gravity Forms Keap/Infusionsoft","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-08-08T00:00:00Z","updated":"2025-11-12T14:13:51Z"},{"id":"wordfence:df657cdc-00fc-476a-a64f-abfdd6b30739","source":"wordfence","cve":"CVE-2016-10990","title":"Cerber Security, Anti-spam & Malware Scan < 2.7 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df657cdc-00fc-476a-a64f-abfdd6b30739?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2016-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df65af54-ce55-4c50-8a62-5541a1879ad4","source":"wordfence","cve":"CVE-2023-52232","title":"Booster Plus for WooCommerce < 7.1.2 - Missing Authorization to Arbitrary Page/Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df65af54-ce55-4c50-8a62-5541a1879ad4?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":false,"patched_in":"7.1.2"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df67e870-d600-46d3-88cc-058d8b9d30c9","source":"wordfence","cve":"CVE-2026-59537","title":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df67e870-d600-46d3-88cc-058d8b9d30c9?source=api-prod","affected":[{"type":"plugin","slug":"sender-net-automated-emails","name":"Sender \u2013 Newsletter, SMS and Email Marketing Automation for WooCommerce","from":"*","from_inclusive":true,"to":"2.10.22","to_inclusive":true,"patched_in":"2.10.23"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T23:05:44Z"},{"id":"wordfence:df681544-f64b-4590-a377-08b05693ff1f","source":"wordfence","cve":"CVE-2024-34389","title":"WP Post Author \u2013 Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df681544-f64b-4590-a377-08b05693ff1f?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"3.7.4","to_inclusive":true,"patched_in":"3.7.5"}],"published":"2024-05-06T00:00:00Z","updated":"2024-08-27T14:45:27Z"},{"id":"wordfence:df6cbc36-d136-49c1-81f0-a61cb91f0ad7","source":"wordfence","cve":"CVE-2026-93778","title":"WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6cbc36-d136-49c1-81f0-a61cb91f0ad7?source=api-prod","affected":[{"type":"plugin","slug":"wp-yelp-review-slider","name":"WP Yelp Review Slider","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2026-09-21T19:00:01Z","updated":"2026-09-22T07:41:14Z"},{"id":"wordfence:df6d2689-c9e2-4913-924c-7793f8546a8e","source":"wordfence","cve":"CVE-2025-32197","title":"Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6d2689-c9e2-4913-924c-7793f8546a8e?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor","name":"Piotnet Addons For Elementor","from":"*","from_inclusive":true,"to":"2.4.36","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-23T17:20:10Z"},{"id":"wordfence:df6e347c-e6a2-42c3-ae92-502d32e4f591","source":"wordfence","cve":"CVE-2025-31838","title":"Eventbee RSVP Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6e347c-e6a2-42c3-ae92-502d32e4f591?source=api-prod","affected":[{"type":"plugin","slug":"eventbee-rsvp-widget","name":"Eventbee RSVP Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:22:19Z"},{"id":"wordfence:df6e5aee-e79d-4c3f-a0c4-47436ae7c1da","source":"wordfence","cve":"CVE-2023-37869","title":"Premium Addons PRO <= 2.9.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6e5aee-e79d-4c3f-a0c4-47436ae7c1da?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df6f4e7a-3cec-4964-ad3a-c3c2d549f8a5","source":"wordfence","cve":"CVE-2026-78470","title":"WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df6f4e7a-3cec-4964-ad3a-c3c2d549f8a5?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager-business","name":"WP Project Manager Pro","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-25T05:31:28Z"},{"id":"wordfence:df7094e5-bccd-471c-8ba1-c8a6b145b957","source":"wordfence","cve":"CVE-2025-23957","title":"Sur.ly <= 3.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df7094e5-bccd-471c-8ba1-c8a6b145b957?source=api-prod","affected":[{"type":"plugin","slug":"surly","name":"Sur.ly","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:20:14Z"},{"id":"wordfence:df75dd55-2af5-4615-9032-a4fcc90891b0","source":"wordfence","cve":"CVE-2025-23945","title":"Popliup \u2013 WordPress Popup Plugin <= 1.1.1 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df75dd55-2af5-4615-9032-a4fcc90891b0?source=api-prod","affected":[{"type":"plugin","slug":"popliup","name":"Popliup \u2013 WordPress Popup Plugin","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T16:56:34Z"},{"id":"wordfence:df790bbc-7427-4f7e-9aa2-e137c9fceffd","source":"wordfence","cve":"CVE-2026-15351","title":"WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df790bbc-7427-4f7e-9aa2-e137c9fceffd?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-08-15T17:25:48Z","updated":"2026-08-16T05:27:31Z"},{"id":"wordfence:df7e57a7-ba15-4181-89f9-e3f1f5de36cf","source":"wordfence","cve":"CVE-2025-9893","title":"VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df7e57a7-ba15-4181-89f9-e3f1f5de36cf?source=api-prod","affected":[{"type":"plugin","slug":"vm-menu-reorder","name":"VM Menu Reorder plugin","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T18:33:28Z","updated":"2025-09-27T06:47:16Z"},{"id":"wordfence:df7eca9b-e353-49e7-8706-89c1787637e9","source":"wordfence","cve":"CVE-2026-3589","title":"WooCommerce < 10.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df7eca9b-e353-49e7-8706-89c1787637e9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"10.5.3","to_inclusive":false,"patched_in":"10.5.3"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T14:13:00Z"},{"id":"wordfence:df7f2acc-a571-467a-b0df-98d6ff21eccf","source":"wordfence","cve":"CVE-2026-118528","title":"Directorist <= 8.10 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df7f2acc-a571-467a-b0df-98d6ff21eccf?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:22:50Z"},{"id":"wordfence:df8047cf-bf6d-42f5-9a77-1fd3472aa2ce","source":"wordfence","cve":"CVE-2025-31378","title":"Oppso Unit Converter <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df8047cf-bf6d-42f5-9a77-1fd3472aa2ce?source=api-prod","affected":[{"type":"plugin","slug":"oppso-unit-converter","name":"Oppso Unit Converter","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:17:00Z"},{"id":"wordfence:df810ea1-3d54-415b-9401-25ac99d9c740","source":"wordfence","cve":"CVE-2025-54694","title":"Button Block <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df810ea1-3d54-415b-9401-25ac99d9c740?source=api-prod","affected":[{"type":"plugin","slug":"button-block","name":"Button Block \u2013 Stylish buttons that get more clicks","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:46:01Z"},{"id":"wordfence:df81b1e4-65f6-4df5-8814-1c007870df9a","source":"wordfence","cve":"CVE-2025-46493","title":"Crossword Compiler Puzzles <= 14.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df81b1e4-65f6-4df5-8814-1c007870df9a?source=api-prod","affected":[{"type":"plugin","slug":"crossword-compiler-puzzles","name":"Crossword Compiler Puzzles","from":"*","from_inclusive":true,"to":"14.5","to_inclusive":true,"patched_in":"14.6"}],"published":"2025-05-02T00:00:00Z","updated":"2026-06-18T15:01:11Z"},{"id":"wordfence:df823097-aec5-4d4d-a839-0c5411d2f884","source":"wordfence","cve":"CVE-2026-109893","title":"Presto Player <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df823097-aec5-4d4d-a839-0c5411d2f884?source=api-prod","affected":[{"type":"plugin","slug":"presto-player","name":"Presto Player","from":"*","from_inclusive":true,"to":"4.5.3","to_inclusive":true,"patched_in":"4.5.4"}],"published":"2026-10-15T18:18:00Z","updated":"2026-10-23T18:27:59Z"},{"id":"wordfence:df8326b6-a443-4f76-a755-49f89af74d7e","source":"wordfence","cve":"CVE-2026-13439","title":"Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df8326b6-a443-4f76-a755-49f89af74d7e?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"4.0.12"}],"published":"2026-07-20T17:07:28Z","updated":"2026-07-21T05:35:29Z"},{"id":"wordfence:df8a8ce0-7258-40ae-bf73-f8c6185fdd16","source":"wordfence","cve":"CVE-2025-7052","title":"LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df8a8ce0-7258-40ae-bf73-f8c6185fdd16?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.1.94","to_inclusive":true,"patched_in":"5.2.0"}],"published":"2025-09-29T16:24:40Z","updated":"2025-09-30T04:27:08Z"},{"id":"wordfence:df911497-8504-424e-8717-42d0bb6c90f1","source":"wordfence","cve":"CVE-2022-45372","title":"Product Gallery Slider for WooCommerce <= 2.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df911497-8504-424e-8717-42d0bb6c90f1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-gallery-slider","name":"Product Gallery Slider, Additional Variation Images for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":false,"patched_in":"2.2.9"}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df93727c-2d2f-4e13-8c89-3ffb93975180","source":"wordfence","cve":"CVE-2024-8444","title":"Download Manager <= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df93727c-2d2f-4e13-8c89-3ffb93975180?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.99","to_inclusive":true,"patched_in":"3.3.00"}],"published":"2024-10-09T00:00:00Z","updated":"2024-12-12T17:47:59Z"},{"id":"wordfence:df946b56-f3a5-4b0e-b281-1632abf93b34","source":"wordfence","cve":"CVE-2018-11309","title":"Membermouse <= 2.2.8 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df946b56-f3a5-4b0e-b281-1632abf93b34?source=api-prod","affected":[{"type":"plugin","slug":"membermouse","name":"membermouse","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2018-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df96f58a-bc6e-47e7-a465-4aebdb264512","source":"wordfence","cve":"CVE-2024-54260","title":"News Kit Elementor Addons <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df96f58a-bc6e-47e7-a465-4aebdb264512?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2024-12-05T00:00:00Z","updated":"2026-07-08T20:41:57Z"},{"id":"wordfence:df97321f-4cd6-44c8-9017-7824c9ba150b","source":"wordfence","cve":"CVE-2026-57715","title":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.1.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df97321f-4cd6-44c8-9017-7824c9ba150b?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:35:56Z"},{"id":"wordfence:df9ad765-dc7b-4da6-951e-045274caeaae","source":"wordfence","cve":"CVE-2007-3241","title":"Cordobo Green Park (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df9ad765-dc7b-4da6-951e-045274caeaae?source=api-prod","affected":[{"type":"theme","slug":"cordobo-green-park","name":"Cordobo Green Park","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2007-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df9ae16b-396b-44b9-8bef-5cf766ae92c6","source":"wordfence","cve":"CVE-2025-53448","title":"Rally <= 1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df9ae16b-396b-44b9-8bef-5cf766ae92c6?source=api-prod","affected":[{"type":"theme","slug":"rally","name":"Rally - Car Service & Motorcycle WordPress Theme","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:27:19Z"},{"id":"wordfence:df9b0578-d5fb-459b-b857-d907e4ca22b4","source":"wordfence","cve":"CVE-2022-0200","title":"Themify Portfolio Post <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df9b0578-d5fb-459b-b857-d907e4ca22b4?source=api-prod","affected":[{"type":"plugin","slug":"themify-portfolio-post","name":"Themify Portfolio Post","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2022-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:df9ca3c2-8bc8-4e15-8dc9-f2dd6f80d968","source":"wordfence","cve":"CVE-2025-23821","title":"WP Cookies Alert <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/df9ca3c2-8bc8-4e15-8dc9-f2dd6f80d968?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookies-alert","name":"WP Cookies Alert","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:56:13Z"},{"id":"wordfence:dfa094d3-e8db-4402-ad23-e161b1b6181e","source":"wordfence","cve":"CVE-2026-19991","title":"UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa094d3-e8db-4402-ad23-e161b1b6181e?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.70","to_inclusive":true,"patched_in":"1.2.71"}],"published":"2026-09-10T14:40:42Z","updated":"2026-09-11T03:39:39Z"},{"id":"wordfence:dfa14214-26a9-4422-9d96-5357b4eed44f","source":"wordfence","cve":"CVE-2025-23996","title":"AnyRoad <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa14214-26a9-4422-9d96-5357b4eed44f?source=api-prod","affected":[{"type":"plugin","slug":"anyguide","name":"AnyRoad","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-28T16:06:43Z"},{"id":"wordfence:dfa22747-b9f5-403e-81bb-87a593e603a4","source":"wordfence","cve":"CVE-2015-3634","title":"Slideshow 2.2.8 - 2.2.21 - Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa22747-b9f5-403e-81bb-87a593e603a4?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-jquery-image-gallery","name":"Slideshow","from":"2.2.8","from_inclusive":true,"to":"2.2.21","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2015-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfa2af3d-ef5a-484b-83a3-552b03b16f4b","source":"wordfence","cve":"CVE-2022-33943","title":"BxSlider WP <= 2.0.0 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa2af3d-ef5a-484b-83a3-552b03b16f4b?source=api-prod","affected":[{"type":"plugin","slug":"bxslider-wp","name":"BxSlider WP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-27T14:26:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfa2dc9c-08c2-4e24-8432-84938e52ece6","source":"wordfence","cve":"CVE-2024-54233","title":"Advanced Control Manager for WordPress by ItalyStrap <= 2.16.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa2dc9c-08c2-4e24-8432-84938e52ece6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-control-manager","name":"Advanced Control Manager for WordPress by ItalyStrap","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-01-17T13:15:29Z"},{"id":"wordfence:dfa34dd5-5c80-40d3-8bb0-83c13cbab7f3","source":"wordfence","cve":"CVE-2025-59557","title":"Learts Addons < 1.7.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa34dd5-5c80-40d3-8bb0-83c13cbab7f3?source=api-prod","affected":[{"type":"plugin","slug":"learts-addons","name":"Learts Addons","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2025-07-08T00:00:00Z","updated":"2025-11-04T16:47:43Z"},{"id":"wordfence:dfa3efa2-c542-44b9-8039-13e6eac75101","source":"wordfence","cve":"CVE-2022-2039","title":"Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa3efa2-c542-44b9-8039-13e6eac75101?source=api-prod","affected":[{"type":"plugin","slug":"livesupporti","name":"Free Live Chat Support","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfa56b6b-508f-44d8-a81c-2b84cebd245b","source":"wordfence","cve":"CVE-2026-89280","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa56b6b-508f-44d8-a81c-2b84cebd245b?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-15T15:29:12Z","updated":"2026-10-16T03:38:44Z"},{"id":"wordfence:dfabe390-0490-469e-ab54-b116b0957a82","source":"wordfence","cve":"CVE-2026-110896","title":"Passster \u2013 Password Protect Pages and Content <= 4.3.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfabe390-0490-469e-ab54-b116b0957a82?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.18","to_inclusive":true,"patched_in":"4.3.19"}],"published":"2026-10-16T12:57:00Z","updated":"2026-10-23T18:39:14Z"},{"id":"wordfence:dfadfbab-0f63-430f-bc8f-62a43b440a1f","source":"wordfence","cve":"CVE-2026-110514","title":"WPZOOM Portfolio <= 1.4.33 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfadfbab-0f63-430f-bc8f-62a43b440a1f?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-portfolio","name":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.4.33","to_inclusive":true,"patched_in":"1.4.34"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:21:12Z"},{"id":"wordfence:dfaf1b9e-404b-4c98-ae86-082a6ad8ba2f","source":"wordfence","cve":"CVE-2026-39790","title":"VikRentCar Car Rental Management System <= 1.4.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfaf1b9e-404b-4c98-ae86-082a6ad8ba2f?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2026-10-05T16:36:53Z","updated":"2026-10-13T17:02:18Z"},{"id":"wordfence:dfafdc46-e747-42b4-963b-7b966b1f67a4","source":"wordfence","cve":"CVE-2022-1241","title":"Ask Me <= 6.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfafdc46-e747-42b4-963b-7b966b1f67a4?source=api-prod","affected":[{"type":"theme","slug":"ask-me","name":"Ask Me - Responsive Questions & Answers WordPress","from":"*","from_inclusive":true,"to":"6.8.2","to_inclusive":false,"patched_in":"6.8.2"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfb0da20-99f1-4bf1-8b30-3c8d15bf9679","source":"wordfence","cve":"CVE-2024-29114","title":"Download Manager <= 3.2.84 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb0da20-99f1-4bf1-8b30-3c8d15bf9679?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager Pro","from":"*","from_inclusive":true,"to":"3.2.84","to_inclusive":true,"patched_in":"3.2.85"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:22:58Z"},{"id":"wordfence:dfb2dda8-1389-4b19-a5cd-d6b3436ab3b6","source":"wordfence","cve":"CVE-2015-3904","title":"Roomcloud < 1.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb2dda8-1389-4b19-a5cd-d6b3436ab3b6?source=api-prod","affected":[{"type":"plugin","slug":"roomcloud","name":"Roomcloud","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2015-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfb59bca-0653-4e75-8da1-e78e5d659422","source":"wordfence","cve":"CVE-2026-1258","title":"Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb59bca-0653-4e75-8da1-e78e5d659422?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.19.2","to_inclusive":true,"patched_in":"1.19.3"}],"published":"2026-02-13T19:51:24Z","updated":"2026-02-14T08:26:51Z"},{"id":"wordfence:dfb6961b-1398-409d-ada2-cf5424cb2b73","source":"wordfence","cve":"CVE-2024-34764","title":"Essential Addons for Elementor <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb6961b-1398-409d-ada2-cf5424cb2b73?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.15","to_inclusive":true,"patched_in":"5.9.16"}],"published":"2024-05-17T00:00:00Z","updated":"2024-05-20T20:55:03Z"},{"id":"wordfence:dfb760fb-f281-4649-9bd3-92f8e281f07e","source":"wordfence","cve":"CVE-2024-1943","title":"Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb760fb-f281-4649-9bd3-92f8e281f07e?source=api-prod","affected":[{"type":"theme","slug":"yuki","name":"Yuki","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2024-02-27T00:00:00Z","updated":"2024-07-29T21:37:38Z"},{"id":"wordfence:dfb7636b-2f4d-4a82-bd63-fea32668530e","source":"wordfence","cve":"CVE-2026-40776","title":"Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb7636b-2f4d-4a82-bd63-fea32668530e?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.8","to_inclusive":true,"patched_in":"4.1.9"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:58:04Z"},{"id":"wordfence:dfb820f4-3d56-4f3e-96b9-206fd803c706","source":"wordfence","cve":"CVE-2026-24627","title":"Trusona for WordPress <= 2.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb820f4-3d56-4f3e-96b9-206fd803c706?source=api-prod","affected":[{"type":"plugin","slug":"trusona","name":"Trusona for WordPress","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T03:44:04Z","updated":"2026-02-03T13:48:18Z"},{"id":"wordfence:dfbaa3e4-40c2-41d8-996c-232e27a04b73","source":"wordfence","cve":"CVE-2023-3352","title":"Smush \u2013 Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbaa3e4-40c2-41d8-996c-232e27a04b73?source=api-prod","affected":[{"type":"plugin","slug":"wp-smushit","name":"Smush \u2013 Image Optimization, Compression, Lazy Load, WebP & CDN","from":"*","from_inclusive":true,"to":"3.16.4","to_inclusive":true,"patched_in":"3.16.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-21T02:05:44Z"},{"id":"wordfence:dfbc304d-624d-4558-b69e-077ee0b8aef3","source":"wordfence","cve":"CVE-2025-31763","title":"Cache control by Cacholong <= 5.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbc304d-624d-4558-b69e-077ee0b8aef3?source=api-prod","affected":[{"type":"plugin","slug":"cache-control-by-cacholong","name":"Cache control by Cacholong","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:47:17Z"},{"id":"wordfence:dfbdb5a7-e949-4d3a-8c8d-5dc6702f4675","source":"wordfence","cve":"CVE-2023-0772","title":"OptinMonster <= 2.12.1 -  Authenticated (Subscriber+) Sensitive Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbdb5a7-e949-4d3a-8c8d-5dc6702f4675?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"2.12.1","to_inclusive":true,"patched_in":"2.12.2"}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfbf2556-0509-4d8a-8949-494c6bc82ea1","source":"wordfence","cve":"CVE-2024-1716","title":"Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbf2556-0509-4d8a-8949-494c6bc82ea1?source=api-prod","affected":[{"type":"plugin","slug":"admin-bar","name":"Admin Bar Editor \u2013 Toolbar Customization with User Role based access & Custom menus","from":"*","from_inclusive":true,"to":"1.0.2.2","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:45Z"},{"id":"wordfence:dfc3c6b2-48d6-4004-bfba-e781fd7a8427","source":"wordfence","cve":"CVE-2026-105870","title":"WP Associate Post R2 <= 5.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfc3c6b2-48d6-4004-bfba-e781fd7a8427?source=api-prod","affected":[{"type":"plugin","slug":"wp-associate-post-r2","name":"WP Associate Post R2","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:25:47Z"},{"id":"wordfence:dfc5d4a0-e651-4ecc-b584-9beed9f6e5fb","source":"wordfence","cve":"CVE-2026-24592","title":"Auto Affiliate Links <= 6.8.8.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfc5d4a0-e651-4ecc-b584-9beed9f6e5fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.8.8.3","to_inclusive":true,"patched_in":"6.8.9"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-18T18:28:28Z"},{"id":"wordfence:dfcc2ab2-504d-4151-9435-618e317ce95c","source":"wordfence","cve":"CVE-2023-48279","title":"Seraphinite Post .DOCX Source <= 2.16.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfcc2ab2-504d-4151-9435-618e317ce95c?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-post-docx-source","name":"Seraphinite Post .DOCX Source","from":"*","from_inclusive":true,"to":"2.16.6","to_inclusive":true,"patched_in":"2.16.7"}],"published":"2023-11-23T00:00:00Z","updated":"2024-02-12T15:02:20Z"},{"id":"wordfence:dfcc3d8c-c36a-4994-aa79-99953d9adfc1","source":"wordfence","cve":"CVE-2022-3425","title":"Google Analyticator <= 6.5.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfcc3d8c-c36a-4994-aa79-99953d9adfc1?source=api-prod","affected":[{"type":"plugin","slug":"google-analyticator","name":"Analyticator","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfd3e6e9-e939-4f98-8560-4dcac330ccb3","source":"wordfence","cve":"CVE-2025-32924","title":"Revy <= 2.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd3e6e9-e939-4f98-8560-4dcac330ccb3?source=api-prod","affected":[{"type":"plugin","slug":"revy","name":"Revy","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:18:23Z"},{"id":"wordfence:dfd45df4-439a-4e46-aba0-a2831c665ea6","source":"wordfence","cve":"CVE-2026-19226","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd45df4-439a-4e46-aba0-a2831c665ea6?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1066","to_inclusive":false,"patched_in":"1.7.1066"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-01T21:04:42Z"},{"id":"wordfence:dfd638bb-ae0b-403d-8d34-c4b62a749d7f","source":"wordfence","cve":"","title":"Asset CleanUp: Page Speed Booster <= 1.3.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd638bb-ae0b-403d-8d34-c4b62a749d7f?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.6.7","to_inclusive":false,"patched_in":"1.3.6.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfd67329-11b1-4f00-a422-bb4833a3181d","source":"wordfence","cve":"CVE-2023-5691","title":"Chatbot for WordPress <= 2.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd67329-11b1-4f00-a422-bb4833a3181d?source=api-prod","affected":[{"type":"plugin","slug":"collectchat","name":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f","from":"2.3.9","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfd6c2b8-b00c-49d1-930f-50397e742ac5","source":"wordfence","cve":"CVE-2019-25149","title":"Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation","severity":"high","cvss":7.6,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd6c2b8-b00c-49d1-930f-50397e742ac5?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images-ape","name":"Gallery Images Ape","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2019-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfd7b788-03a0-41a4-96f2-cfca74ef281b","source":"wordfence","cve":"CVE-2024-3562","title":"Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field","severity":"high","cvss":8.8,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd7b788-03a0-41a4-96f2-cfca74ef281b?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-suite","name":"Custom Field Suite","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":""}],"published":"2024-06-19T13:10:24Z","updated":"2024-06-20T02:08:28Z"},{"id":"wordfence:dfd95489-c1d5-45cc-8ac4-400a39391aa2","source":"wordfence","cve":"CVE-2024-32787","title":"Secure Copy Content Protection and Content Locking <= 3.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd95489-c1d5-45cc-8ac4-400a39391aa2?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:12:06Z"},{"id":"wordfence:dfd960b6-34c9-48b0-9259-46da50754956","source":"wordfence","cve":"CVE-2026-77823","title":"LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd960b6-34c9-48b0-9259-46da50754956?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.4","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2026-08-31T15:51:28Z","updated":"2026-09-01T04:27:52Z"},{"id":"wordfence:dfd969b8-b88e-4d75-9d69-5f290b111fc7","source":"wordfence","cve":"CVE-2026-12743","title":"affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd969b8-b88e-4d75-9d69-5f290b111fc7?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2026-08-13T16:41:32Z","updated":"2026-08-14T05:30:44Z"},{"id":"wordfence:dfdebeab-89f6-49b8-a38f-de2a8df7a7e8","source":"wordfence","cve":"CVE-2025-12650","title":"Simple post listing <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfdebeab-89f6-49b8-a38f-de2a8df7a7e8?source=api-prod","affected":[{"type":"plugin","slug":"simple-post-listing","name":"Simple post listing","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:30:41Z","updated":"2025-12-12T03:20:59Z"},{"id":"wordfence:dfe07cd7-e448-4468-8280-3514690d8648","source":"wordfence","cve":"CVE-2021-24629","title":"Post Content XMLRPC <= 1.0 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfe07cd7-e448-4468-8280-3514690d8648?source=api-prod","affected":[{"type":"plugin","slug":"post-content-xmlrpc","name":"Post Content XMLRPC","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfe41d6f-5026-4fcb-9ba0-a5180a03222c","source":"wordfence","cve":"CVE-2008-1060","title":"Sniplets < 1.2.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfe41d6f-5026-4fcb-9ba0-a5180a03222c?source=api-prod","affected":[{"type":"plugin","slug":"sniplets","name":"Sniplets","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2008-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfe6b29f-421d-41f4-ab36-0fd48b1b8021","source":"wordfence","cve":"CVE-2026-65529","title":"Graphina \u2013 Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfe6b29f-421d-41f4-ab36-0fd48b1b8021?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2026-07-23T00:00:00Z","updated":"2026-10-28T21:11:57Z"},{"id":"wordfence:dfe6f49a-1dd1-46d9-8e15-a8a766917092","source":"wordfence","cve":"CVE-2023-0484","title":"Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfe6f49a-1dd1-46d9-8e15-a8a766917092?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:dfea441c-2e77-47fa-8f6e-8d17d0c90ebe","source":"wordfence","cve":"CVE-2023-1982","title":"Guest posting / Frontend Posting wordpress plugin \u2013 WP Front User Submit / Front Editor <= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfea441c-2e77-47fa-8f6e-8d17d0c90ebe?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2023-08-02T00:00:00Z","updated":"2024-07-01T16:55:11Z"},{"id":"wordfence:dfeaff92-165a-4006-8e52-a99ae6b68dd9","source":"wordfence","cve":"CVE-2026-4389","title":"DSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfeaff92-165a-4006-8e52-a99ae6b68dd9?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-leaflet-map","name":"DSGVO snippet for Leaflet Map and WP GPX Maps","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T04:28:48Z"},{"id":"wordfence:dfed10b0-f2eb-4228-b835-2a29c13e4a3f","source":"wordfence","cve":"CVE-2024-4057","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfed10b0-f2eb-4228-b835-2a29c13e4a3f?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.36","to_inclusive":true,"patched_in":"3.2.37"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T07:09:33Z"},{"id":"wordfence:dfef6ee4-3794-453b-b2a1-92b6e462e1f8","source":"wordfence","cve":"CVE-2026-28085","title":"Mahogany <= 2.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dfef6ee4-3794-453b-b2a1-92b6e462e1f8?source=api-prod","affected":[{"type":"theme","slug":"mahogany","name":"Mahogany","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:58:01Z"},{"id":"wordfence:dff26736-e0be-4a77-8055-442b1379a20f","source":"wordfence","cve":"CVE-2026-54854","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dff26736-e0be-4a77-8055-442b1379a20f?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2026-10-30T07:43:48Z","updated":"2026-11-03T20:02:34Z"},{"id":"wordfence:dff8f331-586a-4579-8ee8-cadec06f4d65","source":"wordfence","cve":"CVE-2026-42417","title":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.9.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dff8f331-586a-4579-8ee8-cadec06f4d65?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.9.0","to_inclusive":true,"patched_in":"7.9.1"}],"published":"2026-10-05T16:14:05Z","updated":"2026-10-23T17:26:34Z"},{"id":"wordfence:dffaf909-72f5-466f-8dd0-d46a81402caf","source":"wordfence","cve":"CVE-2024-33567","title":"Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dffaf909-72f5-466f-8dd0-d46a81402caf?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T15:39:48Z"},{"id":"wordfence:dffdcaa2-5100-48f5-9b82-e22075fd87e5","source":"wordfence","cve":"CVE-2026-120574","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dffdcaa2-5100-48f5-9b82-e22075fd87e5?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-10-30T15:01:50Z","updated":"2026-11-03T04:43:10Z"},{"id":"wordfence:e000c4ad-43ec-4ad0-89f9-74e9e6d8b917","source":"wordfence","cve":"CVE-2025-12849","title":"Contest Gallery <= 28.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e000c4ad-43ec-4ad0-89f9-74e9e6d8b917?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.0.2","to_inclusive":true,"patched_in":"28.0.3"}],"published":"2025-11-14T18:27:20Z","updated":"2025-11-15T06:41:31Z"},{"id":"wordfence:e001c522-0cfd-4698-b1f6-e6404bdd2f1b","source":"wordfence","cve":"CVE-2025-31100","title":"School Management <= 1.93.1 (02-07-2025) - Authenticated (Student+) Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e001c522-0cfd-4698-b1f6-e6404bdd2f1b?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2025-08-12T00:00:00Z","updated":"2026-05-13T15:00:23Z"},{"id":"wordfence:e004bba3-d281-4f84-a941-a6c5b64b9dcd","source":"wordfence","cve":"CVE-2024-3491","title":"Schema & Structured Data for WP & AMP <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e004bba3-d281-4f84-a941-a6c5b64b9dcd?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.29","to_inclusive":true,"patched_in":"1.30"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-23T11:07:23Z"},{"id":"wordfence:e0050d44-bfa1-4dcb-947b-0df1b5e826d3","source":"wordfence","cve":"CVE-2025-7841","title":"Sertifier Certificate & Badge Maker for WordPress \u2013 Tutor LMS <= 1.19 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0050d44-bfa1-4dcb-947b-0df1b5e826d3?source=api-prod","affected":[{"type":"plugin","slug":"sertifier-certificates-open-badges","name":"Sertifier Certificate & Badge Maker for WordPress \u2013 Tutor LMS","from":"*","from_inclusive":true,"to":"1.19","to_inclusive":true,"patched_in":"1.20"}],"published":"2025-08-22T15:51:26Z","updated":"2025-08-28T15:23:05Z"},{"id":"wordfence:e005861c-3ca5-4cee-a84b-9ebc095f4a1f","source":"wordfence","cve":"CVE-2019-14366","title":"WP SlackSync <= 1.8.5 - Sensitive Information Disclosure","severity":"high","cvss":8.6,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e005861c-3ca5-4cee-a84b-9ebc095f4a1f?source=api-prod","affected":[{"type":"plugin","slug":"wpslacksync","name":"wpslacksync","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"}],"published":"2019-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e00672e0-ce3a-45ac-9901-7497eb1cc1a2","source":"wordfence","cve":"CVE-2026-16274","title":"Classified Listing <= 5.4.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00672e0-ce3a-45ac-9901-7497eb1cc1a2?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-15T21:38:49Z"},{"id":"wordfence:e0073811-b4c9-40fd-a839-a27681a69034","source":"wordfence","cve":"CVE-2024-54325","title":"CarDealerPress <= 6.6.2410.02 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0073811-b4c9-40fd-a839-a27681a69034?source=api-prod","affected":[{"type":"plugin","slug":"cardealerpress","name":"CarDealerPress","from":"*","from_inclusive":true,"to":"6.6.2410.02","to_inclusive":true,"patched_in":"6.7.2411.00"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:11:33Z"},{"id":"wordfence:e007c713-74bc-4ff5-a198-70dcc8a8ee68","source":"wordfence","cve":"CVE-2023-3779","title":"Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e007c713-74bc-4ff5-a198-70dcc8a8ee68?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.8.1","to_inclusive":true,"patched_in":"5.8.2"}],"published":"2023-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e00ba29c-acdc-42ba-a6f7-cd064aec662d","source":"wordfence","cve":"CVE-2021-24764","title":"Perfect Survey <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00ba29c-acdc-42ba-a6f7-cd064aec662d?source=api-prod","affected":[{"type":"plugin","slug":"perfect-survey","name":"Perfect Survey","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e00c12ae-3b9d-45b6-b8db-eeaaeb97bfee","source":"wordfence","cve":"CVE-2025-30617","title":"Rewrite <= 0.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00c12ae-3b9d-45b6-b8db-eeaaeb97bfee?source=api-prod","affected":[{"type":"plugin","slug":"rewrite","name":"Rewrite","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:22:41Z"},{"id":"wordfence:e00e65ba-db58-4d13-8cb3-c4d62a2553fb","source":"wordfence","cve":"CVE-2024-13372","title":"WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00e65ba-db58-4d13-8cb3-c4d62a2553fb?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T07:21:41Z"},{"id":"wordfence:e00e67fb-65fa-4f35-9a3d-5794eb0505aa","source":"wordfence","cve":"CVE-2024-43990","title":"Masterstudy LMS Starter <= 1.1.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00e67fb-65fa-4f35-9a3d-5794eb0505aa?source=api-prod","affected":[{"type":"theme","slug":"ms-lms-starter-theme","name":"Masterstudy - Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T13:34:36Z"},{"id":"wordfence:e00f69d6-df33-4179-843b-98f8ed034e4a","source":"wordfence","cve":"CVE-2026-9620","title":"WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e00f69d6-df33-4179-843b-98f8ed034e4a?source=api-prod","affected":[{"type":"plugin","slug":"wp-latest-posts","name":"WP Latest Posts","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:46:07Z","updated":"2026-07-22T17:38:43Z"},{"id":"wordfence:e012d7a0-46f9-4f3b-a178-2d06655fd441","source":"wordfence","cve":"","title":"External url as post Featured Image <= 2.02 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e012d7a0-46f9-4f3b-a178-2d06655fd441?source=api-prod","affected":[{"type":"plugin","slug":"external-url-as-post-featured-image-thumbnail","name":"External url as post Featured Image (thumbnail)","from":"*","from_inclusive":true,"to":"2.02","to_inclusive":true,"patched_in":"2.03"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e014d8b6-9ce3-40ec-862e-ab5f220f1b6d","source":"wordfence","cve":"CVE-2024-25595","title":"Defender Security <= 4.4.1 - IP Address Spoofing","severity":"medium","cvss":6.5,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e014d8b6-9ce3-40ec-862e-ab5f220f1b6d?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T15:59:38Z"},{"id":"wordfence:e01532bb-3011-4efe-b072-d0df5708f8e9","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e01532bb-3011-4efe-b072-d0df5708f8e9?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.52","to_inclusive":false,"patched_in":"2.9.52"}],"published":"2016-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e016213f-b06f-4a9d-a2c6-3b4dd1b6b571","source":"wordfence","cve":"CVE-2025-11753","title":"Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e016213f-b06f-4a9d-a2c6-3b4dd1b6b571?source=api-prod","affected":[{"type":"plugin","slug":"bootstrap-multi-language-responsive-portfolio","name":"Bootstrap Multi-language Responsive Portfolio","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T16:00:41Z","updated":"2025-11-04T04:27:23Z"},{"id":"wordfence:e0169bd4-d1bd-494f-a11a-80fc93c36b91","source":"wordfence","cve":"CVE-2024-53820","title":"Captivate Sync <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0169bd4-d1bd-494f-a11a-80fc93c36b91?source=api-prod","affected":[{"type":"plugin","slug":"captivatesync-trade","name":"Captivate Sync","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T22:31:50Z"},{"id":"wordfence:e018ca7c-06dd-4d40-91d4-4ed188b8aaf2","source":"wordfence","cve":"CVE-2021-4422","title":"POST SMTP Mailer <= 2.0.20 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e018ca7c-06dd-4d40-91d4-4ed188b8aaf2?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e01b4259-ed8d-44a4-9771-470de45b14a8","source":"wordfence","cve":"CVE-2023-1263","title":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e01b4259-ed8d-44a4-9771-470de45b14a8?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2023-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e01dd955-fa25-4cb2-8ab8-a648816857f1","source":"wordfence","cve":"CVE-2024-37265","title":"IdeaPush <= 8.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e01dd955-fa25-4cb2-8ab8-a648816857f1?source=api-prod","affected":[{"type":"plugin","slug":"ideapush","name":"IdeaPush","from":"*","from_inclusive":true,"to":"8.60","to_inclusive":true,"patched_in":"8.61"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:44:43Z"},{"id":"wordfence:e01f5bd8-de0f-48aa-8007-61a0ebd0ebf3","source":"wordfence","cve":"CVE-2023-27923","title":"VK Blocks <= 1.53.0.1 - Stored (Contributor+) Cross-Site Scripting in Tag Edit","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e01f5bd8-de0f-48aa-8007-61a0ebd0ebf3?source=api-prod","affected":[{"type":"plugin","slug":"vk-blocks-pro","name":"VK Blocks Pro","from":"*","from_inclusive":true,"to":"1.53.0.1","to_inclusive":true,"patched_in":"1.54.0"},{"type":"plugin","slug":"vk-blocks","name":"VK Blocks","from":"*","from_inclusive":true,"to":"1.53.0.1","to_inclusive":true,"patched_in":"1.54.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e01fd891-631e-47df-9f29-f3d4d5afa02f","source":"wordfence","cve":"CVE-2024-2118","title":"Social Media Share Buttons <= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e01fd891-631e-47df-9f29-f3d4d5afa02f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2024-03-27T00:00:00Z","updated":"2024-04-16T13:05:21Z"},{"id":"wordfence:e0204832-4d1e-42af-8a1f-7610bed98111","source":"wordfence","cve":"CVE-2026-59511","title":"Exclusive Addons for Elementor <= 2.7.9.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0204832-4d1e-42af-8a1f-7610bed98111?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.9","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-07-05T00:00:00Z","updated":"2026-07-08T19:51:03Z"},{"id":"wordfence:e0211fcd-3638-4c9d-b607-0c788188d98b","source":"wordfence","cve":"CVE-2026-24615","title":"Cream Magazine <= 2.1.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0211fcd-3638-4c9d-b607-0c788188d98b?source=api-prod","affected":[{"type":"theme","slug":"cream-magazine","name":"Cream Magazine","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2026-01-11T22:25:40Z","updated":"2026-02-03T13:45:56Z"},{"id":"wordfence:e022febe-7295-493d-afa7-185f55b4d3b9","source":"wordfence","cve":"CVE-2024-5541","title":"Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e022febe-7295-493d-afa7-185f55b4d3b9?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-visual-editor","name":"Ibtana \u2013 WordPress Website Builder","from":"*","from_inclusive":true,"to":"1.2.3.3","to_inclusive":true,"patched_in":"1.2.3.4"}],"published":"2024-06-17T14:09:48Z","updated":"2024-06-26T14:24:13Z"},{"id":"wordfence:e02372a0-5d10-4d1a-9499-6f6b53fb477e","source":"wordfence","cve":"CVE-2024-5200","title":"Postie <= 1.9.70 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02372a0-5d10-4d1a-9499-6f6b53fb477e?source=api-prod","affected":[{"type":"plugin","slug":"postie","name":"Postie","from":"*","from_inclusive":true,"to":"1.9.70","to_inclusive":true,"patched_in":"1.9.71"}],"published":"2025-09-08T00:00:00Z","updated":"2025-10-16T13:56:06Z"},{"id":"wordfence:e02472a8-5b88-43ad-86f3-e890b49899ad","source":"wordfence","cve":"CVE-2024-9892","title":"Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02472a8-5b88-43ad-86f3-e890b49899ad?source=api-prod","affected":[{"type":"plugin","slug":"add-widget-after-content","name":"Add Widget After Content","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-10-17T15:47:41Z","updated":"2024-10-18T14:16:04Z"},{"id":"wordfence:e024d5c7-d650-4303-8bf2-2958d5f9d960","source":"wordfence","cve":"CVE-2025-25106","title":"Starter Templates by FancyWP <= 2.0.0 - Cross-Site Request Forgery to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e024d5c7-d650-4303-8bf2-2958d5f9d960?source=api-prod","affected":[{"type":"plugin","slug":"starter-templates","name":"Starter Templates by FancyWP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:33:58Z"},{"id":"wordfence:e02597b1-eea6-4fdd-baeb-527201d1c61f","source":"wordfence","cve":"CVE-2025-11773","title":"Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=api-prod","affected":[{"type":"plugin","slug":"tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop","name":"Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-11-20T19:19:51Z","updated":"2026-02-13T19:42:48Z"},{"id":"wordfence:e02683dc-0771-4bd5-bba3-2b5423da1c80","source":"wordfence","cve":"CVE-2025-14502","title":"News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80?source=api-prod","affected":[{"type":"plugin","slug":"news-and-blog-designer-bundle","name":"News and Blog Designer Bundle","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T17:23:28Z","updated":"2026-01-14T17:18:12Z"},{"id":"wordfence:e029bc15-8128-42d1-8874-b0689312cb35","source":"wordfence","cve":"CVE-2024-7486","title":"MultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e029bc15-8128-42d1-8874-b0689312cb35?source=api-prod","affected":[{"type":"theme","slug":"multipurpose","name":"MultiPurpose","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-07T13:13:10Z","updated":"2024-08-08T01:50:34Z"},{"id":"wordfence:e02c5817-7a54-4958-a076-71e5e7729cda","source":"wordfence","cve":"CVE-2026-6236","title":"Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02c5817-7a54-4958-a076-71e5e7729cda?source=api-prod","affected":[{"type":"plugin","slug":"posts-map","name":"Posts map","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:03:41Z","updated":"2026-04-22T07:45:42Z"},{"id":"wordfence:e02cf6d3-3c50-4da5-b28c-7bda30deca3e","source":"wordfence","cve":"CVE-2021-38333","title":"WP Scrippets <= 1.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02cf6d3-3c50-4da5-b28c-7bda30deca3e?source=api-prod","affected":[{"type":"plugin","slug":"wp-scrippets","name":"WP Scrippets","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e02e8d8d-5b20-420d-b213-eeb0ef8d20b7","source":"wordfence","cve":"CVE-2025-48098","title":"Survey Maker <= 5.1.8.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e02e8d8d-5b20-420d-b213-eeb0ef8d20b7?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.8.8","to_inclusive":true,"patched_in":"5.1.8.9"}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-29T15:08:18Z"},{"id":"wordfence:e0318b0b-9686-4889-8676-1dd536f4f24e","source":"wordfence","cve":"CVE-2026-17008","title":"Quick Paypal Payments < 5.7.51 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0318b0b-9686-4889-8676-1dd536f4f24e?source=api-prod","affected":[{"type":"plugin","slug":"quick-paypal-payments","name":"Quick PayPal Payments: Payment Button & Form","from":"*","from_inclusive":true,"to":"5.7.51","to_inclusive":false,"patched_in":"5.7.51"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-09T16:09:30Z"},{"id":"wordfence:e031dbef-1f7a-4c17-803a-fd467978d7f3","source":"wordfence","cve":"CVE-2025-22753","title":"turboSMTP <= 4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e031dbef-1f7a-4c17-803a-fd467978d7f3?source=api-prod","affected":[{"type":"plugin","slug":"turbosmtp","name":"turboSMTP","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:35:52Z"},{"id":"wordfence:e03390e5-5604-4b9d-ab1b-dac2b19270cd","source":"wordfence","cve":"CVE-2023-51489","title":"Crowdsignal Dashboard \u2013 Polls, Surveys & more <= 3.0.11 - Cross-Site Request Forgery via update_rating","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e03390e5-5604-4b9d-ab1b-dac2b19270cd?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e033dd4a-bc82-403a-82aa-cd8516290f4a","source":"wordfence","cve":"CVE-2022-38061","title":"Export Post Info <= 1.2.0 - Authenticated (Author+) CSV Injection","severity":"medium","cvss":5.4,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e033dd4a-bc82-403a-82aa-cd8516290f4a?source=api-prod","affected":[{"type":"plugin","slug":"export-post-info","name":"Export Post Info","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2022-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0365efc-f443-40a6-a365-fd36c1818242","source":"wordfence","cve":"","title":"User Meta Manager < 3.4.8 - Missing Authorization to Sensitive Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0365efc-f443-40a6-a365-fd36c1818242?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-manager","name":"User Meta Manager","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":false,"patched_in":"3.4.8"}],"published":"2016-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e036fd56-c13f-486d-acae-66378426d380","source":"wordfence","cve":"CVE-2016-11008","title":"WP-Invoice \u2013 Web Invoice and Billing <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e036fd56-c13f-486d-acae-66378426d380?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"}],"published":"2016-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e037d22a-3d4d-4f70-a749-6d6c552c7553","source":"wordfence","cve":"CVE-2026-4334","title":"Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e037d22a-3d4d-4f70-a749-6d6c552c7553?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.20","to_inclusive":true,"patched_in":"4.6.21"}],"published":"2026-05-27T19:48:38Z","updated":"2026-05-28T08:27:39Z"},{"id":"wordfence:e03e952a-2cde-413a-9d0a-9046772c0dc0","source":"wordfence","cve":"CVE-2025-31867","title":"JS Job Manager <= 2.0.2 - Authenticated Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e03e952a-2cde-413a-9d0a-9046772c0dc0?source=api-prod","affected":[{"type":"plugin","slug":"js-jobs","name":"JS Job Manager","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T12:46:20Z"},{"id":"wordfence:e03f95ae-c1ba-4679-888b-055293e1351f","source":"wordfence","cve":"CVE-2024-33678","title":"ClickCease Click Fraud Protection <= 3.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e03f95ae-c1ba-4679-888b-055293e1351f?source=api-prod","affected":[{"type":"plugin","slug":"clickcease-click-fraud-protection","name":"ClickCease Click Fraud Protection","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2024-04-26T00:00:00Z","updated":"2024-09-09T20:33:11Z"},{"id":"wordfence:e0403a76-86ce-4772-bc0b-22b183f0f684","source":"wordfence","cve":"CVE-2023-25032","title":"Print, PDF, Email by PrintFriendly <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0403a76-86ce-4772-bc0b-22b183f0f684?source=api-prod","affected":[{"type":"plugin","slug":"printfriendly","name":"Print, PDF & Email by PrintFriendly","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e04171d6-b905-4633-80ca-427b35d5ead6","source":"wordfence","cve":"CVE-2025-54739","title":"Nexter Blocks <= 4.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04171d6-b905-4633-80ca-427b35d5ead6?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T18:54:09Z"},{"id":"wordfence:e044c51c-40e0-4d33-8921-616d59e0e0d8","source":"wordfence","cve":"CVE-2026-13347","title":"Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e044c51c-40e0-4d33-8921-616d59e0e0d8?source=api-prod","affected":[{"type":"plugin","slug":"hide-wp-login","name":"Hide My WP Lite","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-07-09T17:59:50Z","updated":"2026-08-14T19:06:01Z"},{"id":"wordfence:e046c7d0-5660-4a16-ab0a-848448b033bd","source":"wordfence","cve":"CVE-2025-27285","title":"Easy Form by AYS <= 2.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e046c7d0-5660-4a16-ab0a-848448b033bd?source=api-prod","affected":[{"type":"plugin","slug":"easy-form","name":"Easy Form","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-13T19:20:05Z"},{"id":"wordfence:e047123d-fffb-4fe4-9746-98251c8c2419","source":"wordfence","cve":"CVE-2024-50449","title":"PDF Generator Addon for Elementor Page Builder <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e047123d-fffb-4fe4-9746-98251c8c2419?source=api-prod","affected":[{"type":"plugin","slug":"pdf-generator-addon-for-elementor-page-builder","name":"PDF Generator for WordPress Elementor","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:45:24Z"},{"id":"wordfence:e049e3d4-5168-4e1b-8128-8d42df1db2fd","source":"wordfence","cve":"CVE-2025-30791","title":"Cart tracking for WooCommerce <= 1.0.16 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e049e3d4-5168-4e1b-8128-8d42df1db2fd?source=api-prod","affected":[{"type":"plugin","slug":"cart-tracking-for-woocommerce","name":"Cart tracking for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:12:02Z"},{"id":"wordfence:e04b75d4-9bf5-4b26-ac3a-88a10d200c50","source":"wordfence","cve":"CVE-2026-97338","title":"Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04b75d4-9bf5-4b26-ac3a-88a10d200c50?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.70","to_inclusive":true,"patched_in":"3.3.71"}],"published":"2026-10-01T18:53:39Z","updated":"2026-10-02T07:39:28Z"},{"id":"wordfence:e04e2f24-ca52-4f7c-961b-f35b9ff90536","source":"wordfence","cve":"CVE-2015-9425","title":"OnePress Social Locker < 4.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04e2f24-ca52-4f7c-961b-f35b9ff90536?source=api-prod","affected":[{"type":"plugin","slug":"social-locker","name":"OnePress Social Locker","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":false,"patched_in":"4.2.5"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e04eb409-b47b-4b9d-b29b-24f7bbaaf5b4","source":"wordfence","cve":"CVE-2026-39483","title":"VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04eb409-b47b-4b9d-b29b-24f7bbaaf5b4?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.113.3","to_inclusive":true,"patched_in":"9.113.4"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-15T21:09:17Z"},{"id":"wordfence:e04ed3b3-b463-4597-9307-42017a672bb2","source":"wordfence","cve":"CVE-2026-14877","title":"Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04ed3b3-b463-4597-9307-42017a672bb2?source=api-prod","affected":[{"type":"plugin","slug":"data-tables-generator-by-supsystic","name":"Data Tables Generator by Supsystic \u2013 Excel-like, WooCommerce & Pricing Tables","from":"*","from_inclusive":true,"to":"1.12.03","to_inclusive":true,"patched_in":"1.12.04"}],"published":"2026-10-09T16:49:49Z","updated":"2026-10-10T05:31:06Z"},{"id":"wordfence:e04f7702-87d2-45d0-9402-71cb6144a275","source":"wordfence","cve":"CVE-2024-51717","title":"Ajax Content Filter <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e04f7702-87d2-45d0-9402-71cb6144a275?source=api-prod","affected":[{"type":"plugin","slug":"ajax-content-filter","name":"Ajax Content Filter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:41:25Z"},{"id":"wordfence:e051a83e-ad5a-4789-bfee-e03aa9d6a3fc","source":"wordfence","cve":"CVE-2024-10084","title":"Contact Form 7 \u2013 Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e051a83e-ad5a-4789-bfee-e03aa9d6a3fc?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2024-11-05T09:02:37Z","updated":"2024-11-05T21:29:17Z"},{"id":"wordfence:e0554265-ebd0-4574-bba1-7836aebd2a09","source":"wordfence","cve":"CVE-2025-30992","title":"Puca <= 2.6.33 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0554265-ebd0-4574-bba1-7836aebd2a09?source=api-prod","affected":[{"type":"theme","slug":"puca","name":"Puca - Optimized Mobile WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.6.33","to_inclusive":true,"patched_in":"2.6.34"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:02:13Z"},{"id":"wordfence:e055c319-1aeb-4a97-98d1-3b38e61f30f0","source":"wordfence","cve":"CVE-2024-12437","title":"Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e055c319-1aeb-4a97-98d1-3b38e61f30f0?source=api-prod","affected":[{"type":"plugin","slug":"marketplace-items","name":"Marketplace Items","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:31:43Z","updated":"2025-01-07T06:41:00Z"},{"id":"wordfence:e056dcb5-a66b-4cd3-9a73-37f226015e09","source":"wordfence","cve":"CVE-2024-1940","title":"Brizy \u2013 Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e056dcb5-a66b-4cd3-9a73-37f226015e09?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.41","to_inclusive":true,"patched_in":"2.4.42"}],"published":"2024-05-06T00:00:00Z","updated":"2024-06-05T05:33:09Z"},{"id":"wordfence:e057a35b-8162-4636-9fd9-419378df1ca1","source":"wordfence","cve":"","title":"Better Search <= 1.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e057a35b-8162-4636-9fd9-419378df1ca1?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2014-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e05a0a28-cc3b-44ed-b815-5f6e5d75007e","source":"wordfence","cve":"CVE-2025-23699","title":"Event Countdown Timer Plugin by TechMix <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e05a0a28-cc3b-44ed-b815-5f6e5d75007e?source=api-prod","affected":[{"type":"plugin","slug":"event-countdown-timer","name":"Event Countdown Timer Plugin by TechMix","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T17:00:18Z"},{"id":"wordfence:e05d4320-01d0-40c4-9a9a-457171ef7f5c","source":"wordfence","cve":"CVE-2026-8848","title":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e05d4320-01d0-40c4-9a9a-457171ef7f5c?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.22.0","to_inclusive":true,"patched_in":"1.23.0"}],"published":"2026-07-08T19:34:40Z","updated":"2026-07-09T07:55:14Z"},{"id":"wordfence:e05d9aec-5b17-4af8-8985-d4bb003f2d6f","source":"wordfence","cve":"CVE-2026-27346","title":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More < 5.2.10 - Missing Authorization","severity":"low","cvss":2.7,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e05d9aec-5b17-4af8-8985-d4bb003f2d6f?source=api-prod","affected":[{"type":"plugin","slug":"b2bking-wholesale-for-woocommerce","name":"B2BKing \u2014 Ultimate WooCommerce B2B and Wholesale Plugin \u2014 Wholesale Prices, Bulk Order Form & More","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":false,"patched_in":"5.2.10"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:11:56Z"},{"id":"wordfence:e05e3d6a-0977-4b09-af26-38ca0b68a5d3","source":"wordfence","cve":"CVE-2026-115605","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e05e3d6a-0977-4b09-af26-38ca0b68a5d3?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-10-29T14:26:00Z","updated":"2026-11-03T19:27:26Z"},{"id":"wordfence:e05f07fa-80df-4e61-951a-b6088bce0db1","source":"wordfence","cve":"CVE-2024-54317","title":"Web Stories <= 1.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e05f07fa-80df-4e61-951a-b6088bce0db1?source=api-prod","affected":[{"type":"plugin","slug":"web-stories","name":"Web Stories","from":"*","from_inclusive":true,"to":"1.37.0","to_inclusive":true,"patched_in":"1.38.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:23:06Z"},{"id":"wordfence:e061a9de-a6a3-4bdb-a2cf-7bf7e7795041","source":"wordfence","cve":"CVE-2016-20101","title":"Issuu Panel < 1.6.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e061a9de-a6a3-4bdb-a2cf-7bf7e7795041?source=api-prod","affected":[{"type":"plugin","slug":"issuu-panel","name":"Issuu Panel","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":false,"patched_in":""}],"published":"2016-03-23T00:00:00Z","updated":"2026-10-28T15:16:00Z"},{"id":"wordfence:e062c794-1ab7-4d44-95da-40cd401f3a37","source":"wordfence","cve":"CVE-2011-4106","title":"TimThumb <= 1.33 - Remote File Download","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e062c794-1ab7-4d44-95da-40cd401f3a37?source=api-prod","affected":[{"type":"plugin","slug":"category-list-portfolio-page","name":"Category List Portfolio Page","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"timthumb","name":"TimThumb","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"plugin","slug":"simple-post-thumbnails","name":"Simple Post Thumbnails","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2011-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0642c85-ee01-497c-8dc3-42e3ffc02995","source":"wordfence","cve":"CVE-2026-66648","title":"Jawn <= 1.4.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0642c85-ee01-497c-8dc3-42e3ffc02995?source=api-prod","affected":[{"type":"theme","slug":"jawn","name":"Jawn","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-01T13:20:08Z"},{"id":"wordfence:e0662c3a-5b82-4b9a-aa69-147094930d1f","source":"wordfence","cve":"CVE-2023-6996","title":"Display custom fields in the frontend \u2013 Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Code Injection","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0662c3a-5b82-4b9a-aa69-147094930d1f?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-to-display-post-and-user-data","name":"Display custom fields in the frontend \u2013 Post and User Profile Fields","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-07-29T21:37:38Z"},{"id":"wordfence:e068573d-bc3e-48de-b4e7-6a0666086ac3","source":"wordfence","cve":"CVE-2023-51469","title":"Checkout Mestres WP <= 7.1.9.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e068573d-bc3e-48de-b4e7-6a0666086ac3?source=api-prod","affected":[{"type":"plugin","slug":"checkout-mestres-wp","name":"Checkout Mestres do WP for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.9.6","to_inclusive":true,"patched_in":"7.1.9.8"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-02T00:09:42Z"},{"id":"wordfence:e0698d00-6098-4c5b-9487-2fb8d4e5176f","source":"wordfence","cve":"CVE-2025-48121","title":"WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0698d00-6098-4c5b-9487-2fb8d4e5176f?source=api-prod","affected":[{"type":"plugin","slug":"wp-notes-widget","name":"WP Notes Widget","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-21T20:56:28Z"},{"id":"wordfence:e06c7e0a-f972-430a-9f87-786e0c6e1a84","source":"wordfence","cve":"CVE-2016-10997","title":"Beauty & Clean <= 1.0.8 - Cross-Site Request Forgery & Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e06c7e0a-f972-430a-9f87-786e0c6e1a84?source=api-prod","affected":[{"type":"theme","slug":"beauty-premium","name":"Beauty & Clean","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2016-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e06ceba5-9c50-442e-9cba-da64a38de00f","source":"wordfence","cve":"","title":"All in One Support Button + Callback Request <= 1.8.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e06ceba5-9c50-442e-9cba-da64a38de00f?source=api-prod","affected":[{"type":"plugin","slug":"ar-contactus","name":"Contact Us all-in-one button","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":false,"patched_in":"1.8.8"}],"published":"2020-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e06fb465-4c72-49a8-af35-ff6d629ff9a0","source":"wordfence","cve":"CVE-2024-6458","title":"WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fb465-4c72-49a8-af35-ff6d629ff9a0?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T08:36:37Z"},{"id":"wordfence:e06fbb3b-f93f-44da-83fb-f469f541e206","source":"wordfence","cve":"CVE-2026-97398","title":"FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fbb3b-f93f-44da-83fb-f469f541e206?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.54.7212","to_inclusive":true,"patched_in":"7.5.55.7212"}],"published":"2026-10-13T15:11:45Z","updated":"2026-10-14T03:40:06Z"},{"id":"wordfence:e06fe8e4-e27a-4492-b175-3b0846e4cf10","source":"wordfence","cve":"CVE-2024-13666","title":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fe8e4-e27a-4492-b175-3b0846e4cf10?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.2.12","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2025-03-21T19:39:05Z","updated":"2025-03-22T08:24:18Z"},{"id":"wordfence:e070b422-9036-4362-832b-43fd4838f394","source":"wordfence","cve":"CVE-2024-8477","title":"Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.87 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e070b422-9036-4362-832b-43fd4838f394?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.1.87","to_inclusive":true,"patched_in":"3.1.88"}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:12Z"},{"id":"wordfence:e074c818-8432-4ee1-a376-0abde3666bc3","source":"wordfence","cve":"CVE-2024-53810","title":"Simple User Registration <= 5.5 - Missing Authorization to User Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e074c818-8432-4ee1-a376-0abde3666bc3?source=api-prod","affected":[{"type":"plugin","slug":"wp-registration","name":"MemberHero \u2013 Simple User Registration & Login","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"6.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T20:03:47Z"},{"id":"wordfence:e0755c8f-89c4-45a5-95a4-fcfe985f037f","source":"wordfence","cve":"CVE-2013-10020","title":"A Forms <= 1.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0755c8f-89c4-45a5-95a4-fcfe985f037f?source=api-prod","affected":[{"type":"plugin","slug":"a-forms","name":"A Forms","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2013-08-19T00:00:00Z","updated":"2024-02-07T14:49:40Z"},{"id":"wordfence:e07649c0-b2eb-421b-95ae-a9530524470a","source":"wordfence","cve":"CVE-2022-0164","title":"Coming soon and Maintenance mode  <= 3.6.6 - Missing Authorization to Arbitrary Email Send","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e07649c0-b2eb-421b-95ae-a9530524470a?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-page","name":"Coming soon and Maintenance mode","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e076e054-6a0b-4c08-b0cc-bd3a5b0751e5","source":"wordfence","cve":"CVE-2023-33322","title":"Front End Users <= 3.2.24 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e076e054-6a0b-4c08-b0cc-bd3a5b0751e5?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.24","to_inclusive":true,"patched_in":"3.2.25"}],"published":"2023-05-22T00:00:00Z","updated":"2024-05-31T16:15:10Z"},{"id":"wordfence:e077570f-39d3-414f-8138-b1dd2077e476","source":"wordfence","cve":"CVE-2025-46524","title":"WP Filter Post Category <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e077570f-39d3-414f-8138-b1dd2077e476?source=api-prod","affected":[{"type":"plugin","slug":"wp-filter-post-categories","name":"WP Filter Post Category","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:22:20Z"},{"id":"wordfence:e079e886-70a5-4188-ad99-96fc37651ed0","source":"wordfence","cve":"CVE-2025-9049","title":"Nokri \u2013 Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e079e886-70a5-4188-ad99-96fc37651ed0?source=api-prod","affected":[{"type":"theme","slug":"nokri","name":"Nokri \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-05T11:28:48Z"},{"id":"wordfence:e07a874f-1ae8-4a3c-bbfe-33eb81052513","source":"wordfence","cve":"CVE-2026-25385","title":"URL Shortify <= 1.12.3 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e07a874f-1ae8-4a3c-bbfe-33eb81052513?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2026-02-19T00:00:00Z","updated":"2026-02-25T15:25:34Z"},{"id":"wordfence:e080ab50-028d-46c3-a786-ab89b12692b7","source":"wordfence","cve":"CVE-2026-42694","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.4.0 - Authenticated (Subscriber+) Arbitrary Page Content Injection","severity":"low","cvss":3.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e080ab50-028d-46c3-a786-ab89b12692b7?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:56:29Z"},{"id":"wordfence:e0861584-6850-40c6-92d4-b4efb1ea103f","source":"wordfence","cve":"CVE-2024-6517","title":"Contact Form 7 Math Captcha <= 3.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0861584-6850-40c6-92d4-b4efb1ea103f?source=api-prod","affected":[{"type":"plugin","slug":"ds-cf7-math-captcha","name":"DS CF7 Math Captcha","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2024-09-05T00:00:00Z","updated":"2024-11-15T16:13:51Z"},{"id":"wordfence:e087817e-9edb-4c93-96c6-e8d8e99d4d9b","source":"wordfence","cve":"CVE-2023-32583","title":"WP All Backup <= 2.4.3 - Cross-Site Request Forgery to Backup Storage Modification","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e087817e-9edb-4c93-96c6-e8d8e99d4d9b?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-backup","name":"WP All Backup","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e087d9ea-6d60-41db-a0b1-e14df2234c34","source":"wordfence","cve":"CVE-2026-12394","title":"MemberGlut <= 1.1.4 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e087d9ea-6d60-41db-a0b1-e14df2234c34?source=api-prod","affected":[{"type":"plugin","slug":"memberglut","name":"MemberGlut \u2013 Membership, Roles & Content Restriction","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T12:45:34Z"},{"id":"wordfence:e0882303-ca16-45ae-8aee-bbce7a8c17f1","source":"wordfence","cve":"CVE-2025-32590","title":"Web2application <= 6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0882303-ca16-45ae-8aee-bbce7a8c17f1?source=api-prod","affected":[{"type":"plugin","slug":"web2application","name":"Web2application Convert your website to android and IOS apps with push notifications , web push , free ajax products search for woocommerce and many more advanced features","from":"*","from_inclusive":true,"to":"6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-21T13:35:01Z"},{"id":"wordfence:e0891211-e4b3-4dcf-8ee0-e20abeb91640","source":"wordfence","cve":"CVE-2024-9829","title":"Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0891211-e4b3-4dcf-8ee0-e20abeb91640?source=api-prod","affected":[{"type":"plugin","slug":"download-plugin","name":"Download Plugin","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-10-22T00:00:00Z","updated":"2024-10-23T05:35:06Z"},{"id":"wordfence:e08a8609-c9af-4bb6-b421-d8726beaeed0","source":"wordfence","cve":"CVE-2026-12516","title":"Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08a8609-c9af-4bb6-b421-d8726beaeed0?source=api-prod","affected":[{"type":"plugin","slug":"fediverse-embeds","name":"Fediverse Embeds","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-06-18T00:00:00Z","updated":"2026-08-21T13:49:26Z"},{"id":"wordfence:e08c0e74-4ce0-4278-8f58-909f7c24f346","source":"wordfence","cve":"CVE-2024-48023","title":"Restaurant Reservations Widget <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08c0e74-4ce0-4278-8f58-909f7c24f346?source=api-prod","affected":[{"type":"plugin","slug":"restaurantconnect-reswidget","name":"Restaurant Reservations Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-16T12:50:00Z"},{"id":"wordfence:e08c3db4-6353-4bca-ab89-af46e5a0a128","source":"wordfence","cve":"CVE-2021-24537","title":"Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08c3db4-6353-4bca-ab89-af46e5a0a128?source=api-prod","affected":[{"type":"plugin","slug":"similar-posts","name":"Similar Posts \u2013 Best Related Posts Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e08cd1b6-3faf-4650-9606-3724b6a52df5","source":"wordfence","cve":"CVE-2021-39340","title":"Notification \u2013 Custom Notifications and Alerts for WordPress <= 7.2.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08cd1b6-3faf-4650-9606-3724b6a52df5?source=api-prod","affected":[{"type":"plugin","slug":"notification","name":"Notification \u2013 Custom Notifications and Alerts for WordPress","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"8.0.0"}],"published":"2021-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e08d455e-925d-4a94-8d57-484aedc25411","source":"wordfence","cve":"","title":"Tipsacarrier < 1.5.0.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08d455e-925d-4a94-8d57-484aedc25411?source=api-prod","affected":[{"type":"plugin","slug":"tipsacarrier","name":"Tipsacarrier","from":"*","from_inclusive":true,"to":"1.5.0.5","to_inclusive":false,"patched_in":"1.5.0.5"}],"published":"2022-04-05T00:00:00Z","updated":"2024-07-02T15:10:37Z"},{"id":"wordfence:e08fc1d8-870a-4f2b-96bd-ffeeb9803d89","source":"wordfence","cve":"CVE-2026-28070","title":"eMember <= 10.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e08fc1d8-870a-4f2b-96bd-ffeeb9803d89?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T00:00:00Z","updated":"2026-05-07T12:52:35Z"},{"id":"wordfence:e0906a45-6d9b-48a0-98ae-df7b591a8848","source":"wordfence","cve":"CVE-2025-7401","title":"Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php","severity":"critical","cvss":9.8,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0906a45-6d9b-48a0-98ae-df7b591a8848?source=api-prod","affected":[{"type":"plugin","slug":"age-restriction","name":"Premium Age Verification / Restriction for WordPress","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-11T04:22:01Z"},{"id":"wordfence:e0916e67-7240-49b6-9c85-93bf9daf316b","source":"wordfence","cve":"CVE-2026-78296","title":"FluentAuth \u2013 Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 - Unauthenticated Email Verification Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0916e67-7240-49b6-9c85-93bf9daf316b?source=api-prod","affected":[{"type":"plugin","slug":"fluent-security","name":"FluentAuth \u2013 Login Security, Two-Factor Authentication, Passkeys & Social Login","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:28:46Z"},{"id":"wordfence:e0930c96-79e7-40a8-beee-17daf834b9d1","source":"wordfence","cve":"CVE-2025-23631","title":"Content Planner <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0930c96-79e7-40a8-beee-17daf834b9d1?source=api-prod","affected":[{"type":"plugin","slug":"content-planner","name":"Content Planner","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:06:07Z"},{"id":"wordfence:e093a923-4b9b-4def-a81b-78584aead5c1","source":"wordfence","cve":"CVE-2022-28666","title":"Custom Product Tabs for WooCommerce <= 1.7.7 - Subscriber+ Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e093a923-4b9b-4def-a81b-78584aead5c1?source=api-prod","affected":[{"type":"plugin","slug":"yikes-inc-easy-custom-woocommerce-product-tabs","name":"Custom Product Tabs for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2022-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0976e3c-dcc2-41aa-a734-84afa50310ed","source":"wordfence","cve":"CVE-2024-32543","title":"MJ Update History <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0976e3c-dcc2-41aa-a734-84afa50310ed?source=api-prod","affected":[{"type":"plugin","slug":"mj-update-history","name":"MJ Update History","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:10:08Z"},{"id":"wordfence:e0981349-e627-4a3c-9972-01111a6b6140","source":"wordfence","cve":"CVE-2024-32524","title":"Custom Order Statuses for WooCommerce <= 1.5.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0981349-e627-4a3c-9972-01111a6b6140?source=api-prod","affected":[{"type":"plugin","slug":"custom-order-statuses-for-woocommerce","name":"Custom Order Statuses for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T13:46:03Z"},{"id":"wordfence:e099d8e2-6305-43fc-8807-a37791deb2ff","source":"wordfence","cve":"CVE-2024-9067","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e099d8e2-6305-43fc-8807-a37791deb2ff?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-10-09T13:30:38Z","updated":"2024-10-18T13:58:11Z"},{"id":"wordfence:e09c2916-6e2c-4db3-901a-b5715d635824","source":"wordfence","cve":"CVE-2024-8873","title":"PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e09c2916-6e2c-4db3-901a-b5715d635824?source=api-prod","affected":[{"type":"plugin","slug":"pepro-bacs-receipt-upload-for-woocommerce","name":"PeproDev Receipt Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-11-15T15:15:29Z","updated":"2025-02-20T16:11:24Z"},{"id":"wordfence:e09c629b-9908-4548-b828-9e6140ff5670","source":"wordfence","cve":"CVE-2023-28533","title":"Cab Grid <= 1.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e09c629b-9908-4548-b828-9e6140ff5670?source=api-prod","affected":[{"type":"plugin","slug":"cab-grid","name":"Cab Grid","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e09e48db-f74a-4663-a724-24938a6c277c","source":"wordfence","cve":"","title":"Multiple Themes (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e09e48db-f74a-4663-a724-24938a6c277c?source=api-prod","affected":[{"type":"theme","slug":"travel-booking","name":"Travel Booking","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"theme","slug":"awpbusinesspress","name":"AwpBusinessPress","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":false,"patched_in":"0.2.4"},{"type":"theme","slug":"fifteen","name":"Fifteen","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"rambo","name":"Rambo","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"},{"type":"theme","slug":"wallstreet","name":"Wallstreet","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"},{"type":"theme","slug":"rara-business","name":"Rara Business","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"},{"type":"theme","slug":"auto-car","name":"Auto Car","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"shopbiz-lite","name":"Shopbiz Lite","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"},{"type":"theme","slug":"cloudpress","name":"CloudPress","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":false,"patched_in":"2.4.9"},{"type":"theme","slug":"spawp","name":"Spawp","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"},{"type":"theme","slug":"designexo","name":"Designexo","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7"},{"type":"theme","slug":"cactus","name":"Cactus","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"perfect-portfolio","name":"Perfect Portfolio","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":false,"patched_in":"1.1.6"},{"type":"theme","slug":"envo-business","name":"Envo Business","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"startkit","name":"StartKit","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"elitepress","name":"ElitePress","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"},{"type":"theme","slug":"consultstreet","name":"ConsultStreet","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":false,"patched_in":"1.6.7"},{"type":"theme","slug":"spasalon","name":"Spasalon","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":false,"patched_in":"2.2.1"},{"type":"theme","slug":"colorway","name":"ColorWay","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"arilewp","name":"ArileWP","from":"*","from_inclusive":true,"to":"2.9.7","to_inclusive":false,"patched_in":"2.9.7"},{"type":"theme","slug":"businesswp","name":"Businesswp","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"},{"type":"theme","slug":"spice-software","name":"Spice Software","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"},{"type":"theme","slug":"appointment","name":"Appointment","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":false,"patched_in":"3.2.6"},{"type":"theme","slug":"lawyerpress-lite","name":"lawyerpress lite","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"short","name":"Short","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"},{"type":"theme","slug":"wp-real-estate","name":"WP Real Estate","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"mediciti-lite","name":"Mediciti Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"quality","name":"Quality","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":false,"patched_in":"2.7.4"},{"type":"theme","slug":"honeypress","name":"HoneyPress","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":false,"patched_in":"2.3.6"},{"type":"theme","slug":"astore","name":"AStore","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"blain","name":"Blain","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"robolist-lite","name":"Robolist Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"spiko","name":"Spiko","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"},{"type":"theme","slug":"travel-agency","name":"Travel Agency","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":false,"patched_in":"1.4.2"},{"type":"theme","slug":"jewelry-store","name":"Jewelry Store","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":false,"patched_in":"2.3.5"},{"type":"theme","slug":"ngo-charity-lite","name":"NGO Charity Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"busiprof","name":"Busiprof","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":false,"patched_in":"2.3.8"},{"type":"theme","slug":"hasten-lite","name":"Hasten Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"busicare","name":"BusiCare","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":false,"patched_in":"1.1.9"},{"type":"theme","slug":"eventpress","name":"EventPress","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"},{"type":"theme","slug":"consultera","name":"ConsultEra","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"businessexpo","name":"BusinessExpo","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":false,"patched_in":"0.1.4"},{"type":"theme","slug":"ih-business-pro","name":"IH Business Pro","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2022-02-14T00:00:00Z","updated":"2024-03-11T19:54:36Z"},{"id":"wordfence:e09f3a54-9f2c-4a64-ba59-c79e2855d0d0","source":"wordfence","cve":"CVE-2026-39685","title":"The Moneytizer <= 10.0.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e09f3a54-9f2c-4a64-ba59-c79e2855d0d0?source=api-prod","affected":[{"type":"plugin","slug":"the-moneytizer","name":"The Moneytizer","from":"*","from_inclusive":true,"to":"10.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-02-22T00:00:00Z","updated":"2026-04-15T21:29:35Z"},{"id":"wordfence:e09f8e0a-ff68-41be-b91a-5c6951def3f3","source":"wordfence","cve":"CVE-2026-28138","title":"uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e09f8e0a-ff68-41be-b91a-5c6951def3f3?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2026-04-15T20:57:51Z"},{"id":"wordfence:e0a0303a-2c8e-4ac5-ad89-df3774db9679","source":"wordfence","cve":"CVE-2024-0673","title":"Pz-LinkCard <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a0303a-2c8e-4ac5-ad89-df3774db9679?source=api-prod","affected":[{"type":"plugin","slug":"pz-linkcard","name":"Pz-LinkCard","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-28T23:33:27Z"},{"id":"wordfence:e0a12c2f-5101-4e7f-b55b-b34421c80596","source":"wordfence","cve":"CVE-2024-51810","title":"Lewe Bootstrap Visuals <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a12c2f-5101-4e7f-b55b-b34421c80596?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-bootstrap-visuals","name":"Lewe Bootstrap Visuals","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:59:48Z"},{"id":"wordfence:e0a278a3-f229-4673-8b3e-5b68f383dcc7","source":"wordfence","cve":"CVE-2026-2233","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a278a3-f229-4673-8b3e-5b68f383dcc7?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"4.2.9"}],"published":"2026-03-14T14:13:22Z","updated":"2026-03-15T02:19:14Z"},{"id":"wordfence:e0a294c5-dc2f-4739-9519-ae2a1268ff55","source":"wordfence","cve":"CVE-2015-6828","title":"SecureMoz Security Audit <= 1.0.5 - PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a294c5-dc2f-4739-9519-ae2a1268ff55?source=api-prod","affected":[{"type":"plugin","slug":"securemoz-security-audit","name":"SecureMoz Security Audit","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2015-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0a37ce4-9860-415e-bb88-545c30c95fc1","source":"wordfence","cve":"CVE-2024-13338","title":"Webcraftic Clearfy \u2013 WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a37ce4-9860-415e-bb88-545c30c95fc1?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-12T06:37:20Z"},{"id":"wordfence:e0a3910b-adc4-4633-a6a1-32ba50894be4","source":"wordfence","cve":"CVE-2025-3530","title":"WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation","severity":"high","cvss":7.5,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a3910b-adc4-4633-a6a1-32ba50894be4?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2025-04-22T19:06:27Z","updated":"2025-04-23T07:06:54Z"},{"id":"wordfence:e0ad9116-8ec3-482e-be03-0413980f412f","source":"wordfence","cve":"CVE-2026-88993","title":"All Bootstrap Blocks <= 1.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ad9116-8ec3-482e-be03-0413980f412f?source=api-prod","affected":[{"type":"plugin","slug":"all-bootstrap-blocks","name":"All Bootstrap Blocks","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:47:45Z"},{"id":"wordfence:e0ae30a4-dbd6-4c1f-8786-786b46d64a65","source":"wordfence","cve":"CVE-2026-14982","title":"WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ae30a4-dbd6-4c1f-8786-786b46d64a65?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-download","name":"WP File Download","from":"*","from_inclusive":true,"to":"6.3.4","to_inclusive":true,"patched_in":"6.3.5"}],"published":"2026-09-01T13:55:03Z","updated":"2026-09-02T02:26:45Z"},{"id":"wordfence:e0af864b-75aa-4384-b461-50bb11cfbf79","source":"wordfence","cve":"CVE-2025-59551","title":"Revive.so <= 2.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0af864b-75aa-4384-b461-50bb11cfbf79?source=api-prod","affected":[{"type":"plugin","slug":"revive-so","name":"Revive.so \u2013 Bulk Rewrite and Republish Blog Posts","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:18:46Z"},{"id":"wordfence:e0b26af2-d559-49bf-841a-1974360b3ad6","source":"wordfence","cve":"CVE-2024-13156","title":"HTML5 Video Player \u2013 mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b26af2-d559-49bf-841a-1974360b3ad6?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player","name":"HTML5 Video Player \u2013 embed fast, responsive videos with ease","from":"*","from_inclusive":true,"to":"2.5.35","to_inclusive":true,"patched_in":"2.5.36"}],"published":"2025-01-13T20:11:53Z","updated":"2025-01-14T08:23:15Z"},{"id":"wordfence:e0b4267b-2929-489b-86b8-cd256708c5bd","source":"wordfence","cve":"CVE-2025-10128","title":"Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=api-prod","affected":[{"type":"plugin","slug":"alleaktien-quantitativ","name":"Eulerpool Research Systems","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:27:49Z","updated":"2025-09-30T03:35:32Z"},{"id":"wordfence:e0b571c8-d414-4566-a24c-e70fd1740256","source":"wordfence","cve":"CVE-2025-22722","title":"Widget Options <= 4.0.8 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b571c8-d414-4566-a24c-e70fd1740256?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-21T16:23:52Z"},{"id":"wordfence:e0b81941-ae2b-451a-ae72-07fd72f70a95","source":"wordfence","cve":"CVE-2022-4749","title":"Posts List Designer by Category <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptiong via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b81941-ae2b-451a-ae72-07fd72f70a95?source=api-prod","affected":[{"type":"plugin","slug":"post-list-designer","name":"Post List Designer \u2013 Category Post, Recent Post, Post List","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2023-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0b87bee-3cf0-4ab3-8fb7-4fc228eae8d0","source":"wordfence","cve":"CVE-2024-51620","title":"Porsline <= 1.0.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b87bee-3cf0-4ab3-8fb7-4fc228eae8d0?source=api-prod","affected":[{"type":"plugin","slug":"porsline","name":"Porsline","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-10-31T00:00:00Z","updated":"2025-05-02T11:42:27Z"},{"id":"wordfence:e0b8c24b-3e51-4637-9d8e-da065077d082","source":"wordfence","cve":"CVE-2024-0668","title":"Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b8c24b-3e51-4637-9d8e-da065077d082?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner","name":"Advanced Database Cleaner \u2013 Optimize & Clean Database to Speed Up Site Performance","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:37:38Z"},{"id":"wordfence:e0b924db-2dba-4098-9386-c5bb2f0a58d7","source":"wordfence","cve":"CVE-2026-109694","title":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.5 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b924db-2dba-4098-9386-c5bb2f0a58d7?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-10-13T10:57:26Z","updated":"2026-10-23T18:26:44Z"},{"id":"wordfence:e0bcd2f0-5944-48c0-9d08-3177fbe4b47f","source":"wordfence","cve":"CVE-2026-32402","title":"Image Slider by Ays <= 2.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0bcd2f0-5944-48c0-9d08-3177fbe4b47f?source=api-prod","affected":[{"type":"plugin","slug":"ays-slider","name":"Image Slider by Ays- Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-02-21T00:00:00Z","updated":"2026-04-15T21:13:10Z"},{"id":"wordfence:e0bf0bf1-91c3-4f91-b5e4-189944b6a557","source":"wordfence","cve":"CVE-2024-32433","title":"BEAF <= 4.5.4 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0bf0bf1-91c3-4f91-b5e4-189944b6a557?source=api-prod","affected":[{"type":"plugin","slug":"beaf-before-and-after-gallery","name":"Ultimate Before After Image Slider & Gallery \u2013 BEAF","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T18:10:19Z"},{"id":"wordfence:e0bfa461-5cea-40e8-af9f-800cdbb6efb5","source":"wordfence","cve":"CVE-2023-49759","title":"WooDiscuz \u2013 WooCommerce Comments <= 2.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0bfa461-5cea-40e8-af9f-800cdbb6efb5?source=api-prod","affected":[{"type":"plugin","slug":"woodiscuz-woocommerce-comments","name":"WooDiscuz \u2013 WooCommerce Comments","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0bfff4e-c4ec-4d99-b16d-3630068c4b2e","source":"wordfence","cve":"CVE-2025-32260","title":"DethemeKit For Elementor <= 2.1.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0bfff4e-c4ec-4d99-b16d-3630068c4b2e?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T14:16:45Z"},{"id":"wordfence:e0c74571-c170-46ff-a268-3fc0b0630db2","source":"wordfence","cve":"CVE-2026-103332","title":"Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0c74571-c170-46ff-a268-3fc0b0630db2?source=api-prod","affected":[{"type":"plugin","slug":"payex-payment-gateway-for-woocommerce","name":"Payex Payment Gateway for Woocommerce","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2026-10-24T00:00:00Z","updated":"2026-10-28T01:13:46Z"},{"id":"wordfence:e0c9026c-d83e-41ac-be3a-93a33c32c47b","source":"wordfence","cve":"CVE-2026-100149","title":"WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`\u2026","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0c9026c-d83e-41ac-be3a-93a33c32c47b?source=api-prod","affected":[{"type":"plugin","slug":"social-icons-widget-by-wpzoom","name":"WPZOOM Connect: Social Icons Widget & Block, Share Buttons & Click to Chat","from":"*","from_inclusive":true,"to":"4.7.3","to_inclusive":true,"patched_in":"4.7.4"}],"published":"2026-10-02T17:06:00Z","updated":"2026-10-03T05:29:19Z"},{"id":"wordfence:e0c92241-0bef-4f87-8478-4d805435f09d","source":"wordfence","cve":"CVE-2025-15475","title":"PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0c92241-0bef-4f87-8478-4d805435f09d?source=api-prod","affected":[{"type":"plugin","slug":"payhere-payment-gateway","name":"PayHere Payment Gateway","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2026-01-13T17:29:40Z","updated":"2026-01-23T19:59:05Z"},{"id":"wordfence:e0ca6ac4-0d89-4601-94fc-cce5a0af9c56","source":"wordfence","cve":"CVE-2024-2876","title":"Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.14","to_inclusive":true,"patched_in":"5.7.15"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:52:46Z"},{"id":"wordfence:e0cac17e-3dfa-4148-b087-3f29f053b568","source":"wordfence","cve":"CVE-2026-27414","title":"Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0cac17e-3dfa-4148-b087-3f29f053b568?source=api-prod","affected":[{"type":"theme","slug":"werkstatt","name":"Werkstatt - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:48:41Z"},{"id":"wordfence:e0cb38a9-1084-47c9-9d62-9eff013fc341","source":"wordfence","cve":"CVE-2026-27098","title":"Au Pair Agency - Babysitting & Nanny Theme <= 1.2.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0cb38a9-1084-47c9-9d62-9eff013fc341?source=api-prod","affected":[{"type":"theme","slug":"au-pair-agency","name":"Au Pair Agency - Babysitting & Nanny Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T17:52:59Z"},{"id":"wordfence:e0ccdc0d-7c38-4dd3-be39-2359d63b2b6c","source":"wordfence","cve":"CVE-2023-52123","title":"Strong Testimonials <= 3.1.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ccdc0d-7c38-4dd3-be39-2359d63b2b6c?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.1.10","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0cf5711-a02b-4db7-9bf7-47d512680428","source":"wordfence","cve":"CVE-2016-10976","title":"Safe Editor < 1.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0cf5711-a02b-4db7-9bf7-47d512680428?source=api-prod","affected":[{"type":"plugin","slug":"safe-editor","name":"Safe Editor","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2016-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0d0adcc-6741-4cab-aaba-df356691a1ee","source":"wordfence","cve":"CVE-2026-18488","title":"Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d0adcc-6741-4cab-aaba-df356691a1ee?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.51","to_inclusive":true,"patched_in":"2.1.52"}],"published":"2026-08-31T17:21:47Z","updated":"2026-09-01T05:30:42Z"},{"id":"wordfence:e0d1b675-7b9a-49ff-a308-075fefca9743","source":"wordfence","cve":"CVE-2026-65512","title":"WP Activity Log <= 5.6.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d1b675-7b9a-49ff-a308-075fefca9743?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":true,"patched_in":"5.6.5"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:43:19Z"},{"id":"wordfence:e0d26495-4cab-40f0-842b-90e51a410e42","source":"wordfence","cve":"CVE-2024-56021","title":"Category Post Shortcode <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d26495-4cab-40f0-842b-90e51a410e42?source=api-prod","affected":[{"type":"plugin","slug":"category-post-shortcode","name":"Category Post Shortcode","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:29:57Z"},{"id":"wordfence:e0d525ab-a86d-4750-9d16-731cbc0a626e","source":"wordfence","cve":"CVE-2026-2121","title":"Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d525ab-a86d-4750-9d16-731cbc0a626e?source=api-prod","affected":[{"type":"plugin","slug":"show-posts","name":"Weaver Show Posts","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-03-20T15:17:17Z","updated":"2026-05-22T16:02:42Z"},{"id":"wordfence:e0d5b1a5-0078-402b-b834-8091bfc02dd5","source":"wordfence","cve":"CVE-2023-7200","title":"EventON <= 4.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d5b1a5-0078-402b-b834-8091bfc02dd5?source=api-prod","affected":[{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T20:43:29Z"},{"id":"wordfence:e0d6b3ae-0449-405a-8942-c8e01ce00b56","source":"wordfence","cve":"CVE-2025-69054","title":"Super Logos Showcase <= 2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d6b3ae-0449-405a-8942-c8e01ce00b56?source=api-prod","affected":[{"type":"plugin","slug":"superlogoshowcase-wp","name":"Super Logos Showcase for WordPress","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:51:39Z"},{"id":"wordfence:e0d6c8dc-d32b-4ac8-8b0d-6d7ecbac86b5","source":"wordfence","cve":"CVE-2018-5289","title":"GD Rating System <= 2.3 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d6c8dc-d32b-4ac8-8b0d-6d7ecbac86b5?source=api-prod","affected":[{"type":"plugin","slug":"gd-rating-system","name":"GD Rating System","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2018-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0d6ef49-288b-47d9-bbf2-dc31a6e3621e","source":"wordfence","cve":"CVE-2013-1636","title":"Pretty Links Lite < 1.6.3 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d6ef49-288b-47d9-bbf2-dc31a6e3621e?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link","name":"PrettyLinks \u2013 Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":false,"patched_in":"1.6.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0d8ce01-ae59-4e27-bdd1-1ed58590f921","source":"wordfence","cve":"CVE-2025-39572","title":"Checkout for PayPal <= 1.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d8ce01-ae59-4e27-bdd1-1ed58590f921?source=api-prod","affected":[{"type":"plugin","slug":"checkout-for-paypal","name":"Checkout for PayPal","from":"*","from_inclusive":true,"to":"1.0.38","to_inclusive":true,"patched_in":"1.0.39"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:18:12Z"},{"id":"wordfence:e0d9b77d-d7b6-48cd-9db9-ba62bd97c7b3","source":"wordfence","cve":"CVE-2026-57658","title":"TemplateSpare \u2013 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d9b77d-d7b6-48cd-9db9-ba62bd97c7b3?source=api-prod","affected":[{"type":"plugin","slug":"templatespare","name":"TemplateSpare \u2013 No-Code Website Templates, Demo Importer & Site Migration for News, Magazine & Blog","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:08:29Z"},{"id":"wordfence:e0da2b93-84c6-4228-868f-0c5bfa1e0cf4","source":"wordfence","cve":"CVE-2025-22744","title":"S-DEV SEO <= 1.88 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0da2b93-84c6-4228-868f-0c5bfa1e0cf4?source=api-prod","affected":[{"type":"plugin","slug":"s-dev-seo","name":"S-DEV SEO","from":"*","from_inclusive":true,"to":"1.88","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:14:54Z"},{"id":"wordfence:e0dd2417-54b5-4838-88da-1893559bd255","source":"wordfence","cve":"CVE-2024-10632","title":"Nokaut Offers Box <= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0dd2417-54b5-4838-88da-1893559bd255?source=api-prod","affected":[{"type":"plugin","slug":"nokaut-offers-box","name":"Nokaut Offers Box","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-26T00:00:00Z","updated":"2024-11-25T17:20:42Z"},{"id":"wordfence:e0dde9c8-d363-4703-8dda-ae472fbdb479","source":"wordfence","cve":"CVE-2026-62094","title":"TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0dde9c8-d363-4703-8dda-ae472fbdb479?source=api-prod","affected":[{"type":"theme","slug":"techone","name":"TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:23:02Z"},{"id":"wordfence:e0de1962-13bd-4710-ae1f-ab5ced7cc59d","source":"wordfence","cve":"CVE-2013-0724","title":"WP eCommerce Shop Styling < 1.8 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0de1962-13bd-4710-ae1f-ab5ced7cc59d?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecommerce-shop-styling","name":"WP eCommerce Shop Styling","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2013-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0df0a4e-282e-483a-8d5e-a192620ed2d2","source":"wordfence","cve":"CVE-2022-1644","title":"Call&Book Mobile Bar <= 1.2.2 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0df0a4e-282e-483a-8d5e-a192620ed2d2?source=api-prod","affected":[{"type":"plugin","slug":"callbook-mobile-bar","name":"Call&Book Mobile Bar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0df4422-0ca1-42cb-acc1-27a92d6af12b","source":"wordfence","cve":"CVE-2025-32130","title":"Posts Footer Manager <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0df4422-0ca1-42cb-acc1-27a92d6af12b?source=api-prod","affected":[{"type":"plugin","slug":"intelly-posts-footer-manager","name":"Posts Footer Manager","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2025-04-04T00:00:00Z","updated":"2026-08-14T15:14:11Z"},{"id":"wordfence:e0e177f3-fb24-4dd5-80d5-19b113d5f527","source":"wordfence","cve":"CVE-2025-9163","title":"Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e177f3-fb24-4dd5-80d5-19b113d5f527?source=api-prod","affected":[{"type":"theme","slug":"houzez","name":"Houzez","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":true,"patched_in":"4.1.7"}],"published":"2025-11-26T00:01:12Z","updated":"2025-11-26T12:30:05Z"},{"id":"wordfence:e0e1f541-0387-412c-8a11-97f54e5b4bab","source":"wordfence","cve":"CVE-2026-121759","title":"Fusion Page Builder <= 1.7.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e1f541-0387-412c-8a11-97f54e5b4bab?source=api-prod","affected":[{"type":"plugin","slug":"fusion","name":"Fusion Page Builder","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T13:07:36Z"},{"id":"wordfence:e0e1f91e-f729-463f-9d30-8274929a26b9","source":"wordfence","cve":"CVE-2026-27432","title":"WP Rentals - Booking Accommodation WordPress Theme < 3.16.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e1f91e-f729-463f-9d30-8274929a26b9?source=api-prod","affected":[{"type":"theme","slug":"wprentals","name":"WP Rentals - Booking Accommodation WordPress Theme","from":"*","from_inclusive":true,"to":"3.16.0","to_inclusive":false,"patched_in":"3.16.0"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:07:57Z"},{"id":"wordfence:e0e44e96-bd19-47a6-ae7b-e387067bcc8d","source":"wordfence","cve":"CVE-2024-54346","title":"Barter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e44e96-bd19-47a6-ae7b-e387067bcc8d?source=api-prod","affected":[{"type":"theme","slug":"barter","name":"Barter","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-12-19T00:00:00Z","updated":"2024-12-19T15:16:31Z"},{"id":"wordfence:e0e503f4-5864-49f0-aa52-6a44af5e8087","source":"wordfence","cve":"CVE-2021-24917","title":"WPS Hide Login <= 1.9.0 - Hidden Login Page Location Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e503f4-5864-49f0-aa52-6a44af5e8087?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2021-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0e5e143-c4de-4312-8c8b-acf7ef60e0d5","source":"wordfence","cve":"CVE-2025-9949","title":"Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e5e143-c4de-4312-8c8b-acf7ef60e0d5?source=api-prod","affected":[{"type":"plugin","slug":"seo-automated-link-building","name":"Internal Links Manager","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-09-19T00:00:00Z","updated":"2025-10-15T16:03:04Z"},{"id":"wordfence:e0e67883-1f6c-4454-8d51-96fa2d1366d7","source":"wordfence","cve":"CVE-2024-13533","title":"Small Package Quotes \u2013 USPS Edition <= 1.3.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e67883-1f6c-4454-8d51-96fa2d1366d7?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-usps-edition","name":"Small Package Quotes \u2013 USPS Edition","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-02-18T00:00:00Z","updated":"2025-02-19T11:10:41Z"},{"id":"wordfence:e0e70739-88c2-498e-b96c-1f27b8641cb8","source":"wordfence","cve":"","title":"Sliced Invoices <= 3.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e70739-88c2-498e-b96c-1f27b8641cb8?source=api-prod","affected":[{"type":"plugin","slug":"sliced-invoices","name":"Sliced Invoices \u2013 WordPress Invoice Plugin","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2019-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0e96e24-3dcd-4f8a-a483-2c5a6fce32b2","source":"wordfence","cve":"CVE-2026-112312","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e96e24-3dcd-4f8a-a483-2c5a6fce32b2?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T21:14:50Z"},{"id":"wordfence:e0ec0027-2792-4069-b413-8fdd951f5fe7","source":"wordfence","cve":"CVE-2026-1058","title":"Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ec0027-2792-4069-b413-8fdd951f5fe7?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.35","to_inclusive":true,"patched_in":"1.15.36"}],"published":"2026-02-02T18:21:06Z","updated":"2026-02-03T06:38:07Z"},{"id":"wordfence:e0ef8c54-2ac3-4fcc-9ae1-8b23f4d061cd","source":"wordfence","cve":"CVE-2025-49241","title":"oik <= 4.15.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ef8c54-2ac3-4fcc-9ae1-8b23f4d061cd?source=api-prod","affected":[{"type":"plugin","slug":"oik","name":"oik","from":"*","from_inclusive":true,"to":"4.15.1","to_inclusive":true,"patched_in":"4.15.2"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T15:53:30Z"},{"id":"wordfence:e0f1148b-d77d-4036-a658-9bf6a7a24291","source":"wordfence","cve":"CVE-2026-16591","title":"Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f1148b-d77d-4036-a658-9bf6a7a24291?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T13:58:43Z"},{"id":"wordfence:e0f19403-af02-4a29-b4f3-778da4c2df17","source":"wordfence","cve":"","title":"Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.6.24 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f19403-af02-4a29-b4f3-778da4c2df17?source=api-prod","affected":[{"type":"plugin","slug":"social-polls-by-opinionstage","name":"Quiz Maker, Poll Maker & Survey Maker by Opinion Stage","from":"*","from_inclusive":true,"to":"19.6.24","to_inclusive":true,"patched_in":"19.6.25"}],"published":"2019-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0f295f9-1090-4b10-abc5-3f73c5b4e28d","source":"wordfence","cve":"CVE-2024-4033","title":"All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f295f9-1090-4b10-abc5-3f73c5b4e28d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-02T16:52:46Z"},{"id":"wordfence:e0f2fe23-c77c-4e24-a1e4-0aa3697370e6","source":"wordfence","cve":"CVE-2015-9510","title":"Easy Digital Downloads - Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f2fe23-c77c-4e24-a1e4-0aa3697370e6?source=api-prod","affected":[{"type":"plugin","slug":"edd-cross-sell-and-upsell","name":"Easy Digital Downloads - Cross-Sell and Upsell","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e0f356ce-1937-4c89-bedc-f25ea4e78264","source":"wordfence","cve":"CVE-2024-50412","title":"Conditional Fields for Contact Form 7 <= 2.4.15 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f356ce-1937-4c89-bedc-f25ea4e78264?source=api-prod","affected":[{"type":"plugin","slug":"cf7-conditional-fields","name":"Conditional Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:30:36Z"},{"id":"wordfence:e0f787cd-af81-4ba4-8ee1-5e01f06a00b0","source":"wordfence","cve":"CVE-2025-31557","title":"OSM \u2013 OpenStreetMap <= 6.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f787cd-af81-4ba4-8ee1-5e01f06a00b0?source=api-prod","affected":[{"type":"plugin","slug":"osm","name":"OSM \u2013 OpenStreetMap","from":"*","from_inclusive":true,"to":"6.1.13","to_inclusive":true,"patched_in":"6.1.14"}],"published":"2025-03-31T00:00:00Z","updated":"2026-02-03T19:57:32Z"},{"id":"wordfence:e0f7bba4-76c3-4904-bd96-2074147b33f5","source":"wordfence","cve":"CVE-2025-2575","title":"Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f7bba4-76c3-4904-bd96-2074147b33f5?source=api-prod","affected":[{"type":"plugin","slug":"z-companion","name":"Z Companion","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-04-10T22:24:22Z","updated":"2025-04-11T11:11:57Z"},{"id":"wordfence:e0f98cf4-2f34-49b6-a974-2ff1e5a794aa","source":"wordfence","cve":"CVE-2025-27359","title":"WP Media File Type Manager <= 2.3.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0f98cf4-2f34-49b6-a974-2ff1e5a794aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-file-type-manager","name":"WP Media File Type Manager","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:10:13Z"},{"id":"wordfence:e0fd1ad5-9553-4327-9248-d64470e5e8f1","source":"wordfence","cve":"CVE-2026-62128","title":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0fd1ad5-9553-4327-9248-d64470e5e8f1?source=api-prod","affected":[{"type":"plugin","slug":"creatorlms","name":"Creator LMS \u2013 WordPress LMS Plugin for Coaches, Cohorts & Course Creators","from":"*","from_inclusive":true,"to":"1.2.21","to_inclusive":true,"patched_in":"1.2.22"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:28:41Z"},{"id":"wordfence:e0fdeb83-78c3-4b29-809c-662bd2a2bb51","source":"wordfence","cve":"CVE-2012-10016","title":"Simple Download Button Shortcode <= 1.0 - Information Disclosure via Arbitrary File Downloads","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0fdeb83-78c3-4b29-809c-662bd2a2bb51?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-button-shortcode","name":"simple-download-button-shortcode","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2012-09-17T00:00:00Z","updated":"2024-02-07T14:56:20Z"},{"id":"wordfence:e0fdee40-9d60-4657-9e2b-42d548dea1c0","source":"wordfence","cve":"CVE-2023-46782","title":"MomentoPress for Momento360 <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e0fdee40-9d60-4657-9e2b-42d548dea1c0?source=api-prod","affected":[{"type":"plugin","slug":"cmyee-momentopress","name":"MomentoPress for Momento360","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e10127aa-a5a5-4394-8b54-b57ba1369d77","source":"wordfence","cve":"CVE-2024-2456","title":"Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10127aa-a5a5-4394-8b54-b57ba1369d77?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.12.10","to_inclusive":true,"patched_in":"6.12.11"}],"published":"2024-03-29T00:00:00Z","updated":"2024-05-31T15:30:58Z"},{"id":"wordfence:e1012821-dae9-4fed-9f18-90eef50114ac","source":"wordfence","cve":"CVE-2025-50005","title":"tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1012821-dae9-4fed-9f18-90eef50114ac?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2026-01-08T00:00:00Z","updated":"2026-02-03T20:10:04Z"},{"id":"wordfence:e101bc4e-1c5d-4f30-a1eb-617b0db92723","source":"wordfence","cve":"CVE-2026-94432","title":"Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e101bc4e-1c5d-4f30-a1eb-617b0db92723?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2026-10-01T19:14:41Z","updated":"2026-10-02T07:39:29Z"},{"id":"wordfence:e103f59a-00fa-4d4c-b4fc-834754886d49","source":"wordfence","cve":"CVE-2023-41953","title":"ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e103f59a-00fa-4d4c-b4fc-834754886d49?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.13.2","to_inclusive":false,"patched_in":"4.13.2"}],"published":"2023-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e10873f0-135e-4229-8b7a-6c1d69599c1d","source":"wordfence","cve":"CVE-2025-49915","title":"SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10873f0-135e-4229-8b7a-6c1d69599c1d?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2025-08-15T00:00:00Z","updated":"2025-10-29T20:02:16Z"},{"id":"wordfence:e1089e3e-9d81-4e4b-9703-403029f5265c","source":"wordfence","cve":"CVE-2025-49263","title":"WC Vendors Marketplace <= 2.5.6 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1089e3e-9d81-4e4b-9703-403029f5265c?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:37:47Z"},{"id":"wordfence:e10930fd-fae0-4554-acf3-da81a124f79d","source":"wordfence","cve":"CVE-2024-13551","title":"ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10930fd-fae0-4554-acf3-da81a124f79d?source=api-prod","affected":[{"type":"plugin","slug":"abc-notation","name":"ABC Notation","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-25T07:24:19Z"},{"id":"wordfence:e10a58c1-75fb-45ac-bcf3-0c120878dc79","source":"wordfence","cve":"CVE-2026-32500","title":"MetaMax <= 1.1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10a58c1-75fb-45ac-bcf3-0c120878dc79?source=api-prod","affected":[{"type":"theme","slug":"metamax","name":"MetaMax","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:44:21Z"},{"id":"wordfence:e10a95e3-e834-4f84-85c1-4a1ffad41b5b","source":"wordfence","cve":"","title":"WooCommerce <=  2.6.3 - Stored Cross-Site Scripting via REST-API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10a95e3-e834-4f84-85c1-4a1ffad41b5b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2016-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e10b668b-b7fc-4626-8e97-15b1fdee93b5","source":"wordfence","cve":"CVE-2024-34795","title":"Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10b668b-b7fc-4626-8e97-15b1fdee93b5?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.3","to_inclusive":true,"patched_in":"0.21.4"}],"published":"2024-05-20T00:00:00Z","updated":"2024-05-29T20:05:04Z"},{"id":"wordfence:e10ba37a-cd7d-4fc9-8b41-806fa3dc7785","source":"wordfence","cve":"CVE-2025-2881","title":"Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10ba37a-cd7d-4fc9-8b41-806fa3dc7785?source=api-prod","affected":[{"type":"plugin","slug":"developer-toolbar","name":"Developer Toolbar","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T14:19:25Z","updated":"2025-04-12T02:23:15Z"},{"id":"wordfence:e10c0d8d-718d-45dd-9ac3-a2673a6a16af","source":"wordfence","cve":"CVE-2026-0753","title":"Super Simple Contact Form <= 1.6.2 - Reflected Cross-Site Scripting via 'sscf_name' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10c0d8d-718d-45dd-9ac3-a2673a6a16af?source=api-prod","affected":[{"type":"plugin","slug":"super-simple-contact-form","name":"Super Simple Contact Form","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:26:17Z","updated":"2026-02-14T06:42:35Z"},{"id":"wordfence:e10db126-a22e-4e15-a868-6fd9172fa805","source":"wordfence","cve":"CVE-2014-6312","title":"Login Widget With Shortcode < 3.2.1 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10db126-a22e-4e15-a868-6fd9172fa805?source=api-prod","affected":[{"type":"plugin","slug":"login-sidebar-widget","name":"Login Widget With Shortcode","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e10dd0e6-1567-437b-ace7-fae013d66514","source":"wordfence","cve":"","title":"Custom Dashboard & Login Page \u2013 AGCA <= 6.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10dd0e6-1567-437b-ace7-fae013d66514?source=api-prod","affected":[{"type":"plugin","slug":"ag-custom-admin","name":"AGCA \u2013 Custom Dashboard & Login Page","from":"*","from_inclusive":true,"to":"6.5.4","to_inclusive":true,"patched_in":"6.5.5"}],"published":"2020-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e10e3382-8bb9-4bb3-b881-0aaabd2412a0","source":"wordfence","cve":"CVE-2026-27067","title":"Mobile App Editor \u2013 WordPress to Android App Builder <= 1.3.1 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10e3382-8bb9-4bb3-b881-0aaabd2412a0?source=api-prod","affected":[{"type":"plugin","slug":"mobile-app-editor","name":"Mobile App Editor \u2013 WordPress to Android App Builder","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-12T00:00:00Z","updated":"2026-03-19T15:38:06Z"},{"id":"wordfence:e10f391a-6663-4222-8266-ab911c588b76","source":"wordfence","cve":"CVE-2024-11339","title":"Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10f391a-6663-4222-8266-ab911c588b76?source=api-prod","affected":[{"type":"plugin","slug":"smart-popup-blaster","name":"Smart PopUp Blaster","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T19:38:54Z","updated":"2024-12-06T08:25:01Z"},{"id":"wordfence:e10fc7e4-11ec-409b-9f16-b38adceaf622","source":"wordfence","cve":"CVE-2024-29923","title":"PropertyHive <= 2.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e10fc7e4-11ec-409b-9f16-b38adceaf622?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:43:28Z"},{"id":"wordfence:e1105717-134b-48cc-960d-f78437c06793","source":"wordfence","cve":"CVE-2025-7667","title":"Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1105717-134b-48cc-960d-f78437c06793?source=api-prod","affected":[{"type":"plugin","slug":"restrict-file-access","name":"Restrict File Access","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-14T00:00:00Z","updated":"2025-07-15T11:20:04Z"},{"id":"wordfence:e110ea99-e2fa-4558-bcf3-942a35af0b91","source":"wordfence","cve":"CVE-2024-1698","title":"NotificationX \u2013 Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e110ea99-e2fa-4558-bcf3-942a35af0b91?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-27T05:33:13Z"},{"id":"wordfence:e1114a46-fd1c-4707-bd42-524c0c6fd4c8","source":"wordfence","cve":"CVE-2024-44044","title":"Oshine Modules <= 3.3.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1114a46-fd1c-4707-bd42-524c0c6fd4c8?source=api-prod","affected":[{"type":"plugin","slug":"oshine-modules","name":"Oshine Modules","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":true,"patched_in":"3.3.8"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-26T21:48:23Z"},{"id":"wordfence:e1120811-e0da-4dec-9723-0fdbd86efe67","source":"wordfence","cve":"CVE-2025-68567","title":"My auctions allegro <= 3.6.33 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1120811-e0da-4dec-9723-0fdbd86efe67?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.33","to_inclusive":true,"patched_in":"3.6.34"}],"published":"2025-12-17T00:00:00Z","updated":"2026-02-06T22:05:08Z"},{"id":"wordfence:e11662b0-5f67-4c27-abdb-522204acb35e","source":"wordfence","cve":"CVE-2023-5560","title":"WP-UserOnline <= 2.88.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11662b0-5f67-4c27-abdb-522204acb35e?source=api-prod","affected":[{"type":"plugin","slug":"wp-useronline","name":"WP-UserOnline","from":"*","from_inclusive":true,"to":"2.88.2","to_inclusive":true,"patched_in":"2.88.3"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1167864-1d46-40cb-bd75-e0d921e173c9","source":"wordfence","cve":"CVE-2026-52712","title":"Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1167864-1d46-40cb-bd75-e0d921e173c9?source=api-prod","affected":[{"type":"plugin","slug":"attendance-manager","name":"Attendance Manager","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":"0.6.3"}],"published":"2026-06-15T00:00:00Z","updated":"2026-06-23T15:46:56Z"},{"id":"wordfence:e116f1f1-ef11-408f-8368-ddd94ba50b41","source":"wordfence","cve":"CVE-2024-6722","title":"Chatbot Support AI <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e116f1f1-ef11-408f-8368-ddd94ba50b41?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-support-ai","name":"Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-06T00:00:00Z","updated":"2024-08-09T14:06:19Z"},{"id":"wordfence:e1179303-fe7c-47f1-958c-2e4d2c574e4a","source":"wordfence","cve":"CVE-2025-13205","title":"SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1179303-fe7c-47f1-958c-2e4d2c574e4a?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-01-23T20:33:47Z","updated":"2026-02-03T19:03:11Z"},{"id":"wordfence:e11993c1-48fa-4e37-850d-d02e3e20d56f","source":"wordfence","cve":"CVE-2024-13736","title":"Pure Chat \u2013 Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11993c1-48fa-4e37-850d-d02e3e20d56f?source=api-prod","affected":[{"type":"plugin","slug":"pure-chat","name":"Pure Chat \u2013 Live Chat & More!","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.41"}],"published":"2025-02-18T19:21:46Z","updated":"2025-02-28T15:25:02Z"},{"id":"wordfence:e119d542-7cac-47e4-ae13-5382911f1f5e","source":"wordfence","cve":"CVE-2025-11802","title":"Bulma Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e119d542-7cac-47e4-ae13-5382911f1f5e?source=api-prod","affected":[{"type":"plugin","slug":"bulma-shortcodes","name":"Bulma Shortcodes","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:21:26Z","updated":"2025-11-21T07:31:58Z"},{"id":"wordfence:e11c9f2c-4ac6-4da2-9b4c-d393e2d3332b","source":"wordfence","cve":"CVE-2026-13400","title":"Simply Schedule Appointments <= 1.6.12.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11c9f2c-4ac6-4da2-9b4c-d393e2d3332b?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.3","to_inclusive":true,"patched_in":"1.6.12.4"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:16:07Z"},{"id":"wordfence:e11ceba3-6bf4-4759-a8ac-ca779e2924cd","source":"wordfence","cve":"CVE-2024-4758","title":"Muslim Prayer Time BD <= 2.4 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11ceba3-6bf4-4759-a8ac-ca779e2924cd?source=api-prod","affected":[{"type":"plugin","slug":"muslim-prayer-time-bd","name":"Muslim Prayer Time BD \u2013 Prayer Reminder for Bangladesh","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2024-06-05T00:00:00Z","updated":"2025-01-30T21:47:01Z"},{"id":"wordfence:e11e4bab-f8a9-4ecb-b36e-09a55e47f1ae","source":"wordfence","cve":"CVE-2023-39163","title":"Phlox Shop <= 2.0.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11e4bab-f8a9-4ecb-b36e-09a55e47f1ae?source=api-prod","affected":[{"type":"plugin","slug":"auxin-shop","name":"Phlox Shop","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e11ecf13-0b3b-4148-abca-677652a68c24","source":"wordfence","cve":"CVE-2026-3878","title":"WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11ecf13-0b3b-4148-abca-677652a68c24?source=api-prod","affected":[{"type":"plugin","slug":"wp-docs","name":"WP Docs","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-04-15T14:25:18Z","updated":"2026-04-16T03:36:36Z"},{"id":"wordfence:e11f1a56-d5a2-47a4-a5cc-34345966495a","source":"wordfence","cve":"CVE-2024-6320","title":"ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11f1a56-d5a2-47a4-a5cc-34345966495a?source=api-prod","affected":[{"type":"plugin","slug":"scrollto-top","name":"ScrollTo Top","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T07:38:49Z"},{"id":"wordfence:e11fb463-6d2a-40eb-8ca5-4a54025991f9","source":"wordfence","cve":"CVE-2025-67531","title":"Turitor < 1.5.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e11fb463-6d2a-40eb-8ca5-4a54025991f9?source=api-prod","affected":[{"type":"theme","slug":"turitor","name":"Turitor - Education WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2025-12-13T00:00:00Z","updated":"2025-12-19T17:19:16Z"},{"id":"wordfence:e120698f-c076-4d8f-934c-b4c46f2381ec","source":"wordfence","cve":"CVE-2025-8214","title":"The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e120698f-c076-4d8f-934c-b4c46f2381ec?source=api-prod","affected":[{"type":"plugin","slug":"the-pack-addon","name":"The Pack Elementor addon","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-09-29T15:25:56Z","updated":"2025-10-21T20:57:27Z"},{"id":"wordfence:e122d75b-0bde-4886-a8e0-d07a535fc967","source":"wordfence","cve":"CVE-2023-25959","title":"Apollo13 Framework Extensions <= 1.8.10 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e122d75b-0bde-4886-a8e0-d07a535fc967?source=api-prod","affected":[{"type":"plugin","slug":"apollo13-framework-extensions","name":"Apollo13 Framework Extensions","from":"*","from_inclusive":true,"to":"1.8.10","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1298242-61d2-495e-bae7-96b5e12bd03d","source":"wordfence","cve":"CVE-2025-3515","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1298242-61d2-495e-bae7-96b5e12bd03d?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.8.9","to_inclusive":true,"patched_in":"1.3.9.0"}],"published":"2025-06-16T20:35:08Z","updated":"2025-06-17T09:21:41Z"},{"id":"wordfence:e12c14c8-9603-483b-9b07-fa36c9f98285","source":"wordfence","cve":"CVE-2024-37455","title":"Ultimate Addons for Elementor <= 1.36.31 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e12c14c8-9603-483b-9b07-fa36c9f98285?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.36.31","to_inclusive":true,"patched_in":"1.36.32"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T19:08:19Z"},{"id":"wordfence:e12dcad4-747b-40ba-96f3-746fa2abef74","source":"wordfence","cve":"CVE-2025-23623","title":"Contact Form 7 \u2013 CCAvenue Add-on <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e12dcad4-747b-40ba-96f3-746fa2abef74?source=api-prod","affected":[{"type":"plugin","slug":"cf7-cc-avenue-add-on","name":"Contact Form 7 \u2013 CCAvenue Add-on","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:09:43Z"},{"id":"wordfence:e12e2ba1-fc4f-4ad0-80da-3504ef1e13d3","source":"wordfence","cve":"CVE-2025-14137","title":"Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e12e2ba1-fc4f-4ad0-80da-3504ef1e13d3?source=api-prod","affected":[{"type":"plugin","slug":"simple-al-slider","name":"Simple AL Slider","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:30:09Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:e1334ab5-515c-4bce-b437-ee68a3315b78","source":"wordfence","cve":"","title":"WordPress-WPJobBoard <= 25.07010000-WP6.8.1-JB5.11.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1334ab5-515c-4bce-b437-ee68a3315b78?source=api-prod","affected":[{"type":"plugin","slug":"click-pledge-wpjobboard","name":"Click & Pledge WPJobBoard","from":"*","from_inclusive":true,"to":"25.07010000-WP6.8.1-JB5.11.5","to_inclusive":true,"patched_in":"25.09000000-WP6.8.2-JB5.12.0"}],"published":"2025-07-11T00:00:00Z","updated":"2025-09-11T14:53:56Z"},{"id":"wordfence:e13379a9-fe21-4fb5-a53e-c86eef8cac54","source":"wordfence","cve":"CVE-2025-46243","title":"Recover abandoned cart for WooCommerce <= 2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13379a9-fe21-4fb5-a53e-c86eef8cac54?source=api-prod","affected":[{"type":"plugin","slug":"recover-wc-abandoned-cart","name":"Recover abandoned cart for WooCommerce","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:38:07Z"},{"id":"wordfence:e136ab52-a193-430b-b2b2-d7640d009c99","source":"wordfence","cve":"CVE-2022-1756","title":"Newsletter \u2013 Send awesome emails from WordPress <= 7.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e136ab52-a193-430b-b2b2-d7640d009c99?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"7.4.4","to_inclusive":true,"patched_in":"7.4.5"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e13a1d8c-efcf-4bb5-8c39-33b06ae65d1a","source":"wordfence","cve":"CVE-2025-54683","title":"WP Modal Popup with Cookie Integration <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13a1d8c-efcf-4bb5-8c39-33b06ae65d1a?source=api-prod","affected":[{"type":"plugin","slug":"wp-modal-popup-with-cookie-integration","name":"WP Modal Popup with Cookie Integration","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:03:11Z"},{"id":"wordfence:e13a38d0-9781-4b1e-8b2b-fdcb1001b8d5","source":"wordfence","cve":"CVE-2024-4745","title":"Giveaways and Contests by RafflePress <= 1.12.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13a38d0-9781-4b1e-8b2b-fdcb1001b8d5?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.4","to_inclusive":true,"patched_in":"1.12.5"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T19:49:29Z"},{"id":"wordfence:e13c6d97-873a-4067-846d-92e54514645d","source":"wordfence","cve":"CVE-2024-10250","title":"Nioland <= 1.2.6 - Reflected Cross-Site Scripting via s","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13c6d97-873a-4067-846d-92e54514645d?source=api-prod","affected":[{"type":"theme","slug":"nioland","name":"Nioland - SaaS & Software Startup Tech WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-10-22T00:00:00Z","updated":"2024-10-23T13:58:40Z"},{"id":"wordfence:e13df52d-17dc-471a-886c-f5a28e2d067e","source":"wordfence","cve":"CVE-2025-22770","title":"Envo Multipurpose <= 1.1.6 - Missing Authorization","severity":"low","cvss":3.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13df52d-17dc-471a-886c-f5a28e2d067e?source=api-prod","affected":[{"type":"theme","slug":"envo-multipurpose","name":"Envo Multipurpose","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-21T16:13:23Z"},{"id":"wordfence:e13e6e17-5db4-4b4b-830f-eb6ce5439a6d","source":"wordfence","cve":"CVE-2026-105077","title":"Ad Inserter \u2013 Ad Manager & AdSense Ads <= 2.8.19 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e13e6e17-5db4-4b4b-830f-eb6ce5439a6d?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.19","to_inclusive":true,"patched_in":"2.8.20"}],"published":"2026-10-30T08:51:27Z","updated":"2026-11-03T19:20:50Z"},{"id":"wordfence:e140973b-d37c-45bf-aed2-9223bd812957","source":"wordfence","cve":"CVE-2023-35041","title":"Webpushr <= 4.34.0 - Cross-Site Request Forgery to Local File Inclusion via menu","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e140973b-d37c-45bf-aed2-9223bd812957?source=api-prod","affected":[{"type":"plugin","slug":"webpushr-web-push-notifications","name":"Web Push Notifications \u2013 Webpushr","from":"*","from_inclusive":true,"to":"4.34.0","to_inclusive":true,"patched_in":"4.35.0"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1440507-5fdd-4820-a7bb-89c53527e529","source":"wordfence","cve":"CVE-2026-84755","title":"Mail Mint \u2013 Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.31.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1440507-5fdd-4820-a7bb-89c53527e529?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.31.0","to_inclusive":true,"patched_in":"1.31.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:27:48Z"},{"id":"wordfence:e148a10a-fe0b-468f-8319-956d318891f8","source":"wordfence","cve":"CVE-2025-58199","title":"Fastly <= 1.2.28 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e148a10a-fe0b-468f-8319-956d318891f8?source=api-prod","affected":[{"type":"plugin","slug":"fastly","name":"Fastly","from":"*","from_inclusive":true,"to":"1.2.28","to_inclusive":true,"patched_in":"1.2.29"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-17T19:35:55Z"},{"id":"wordfence:e14c12ef-0774-4459-9a2c-9a4b633a0efe","source":"wordfence","cve":"CVE-2025-1459","title":"Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e14c12ef-0774-4459-9a2c-9a4b633a0efe?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.31.4","to_inclusive":true,"patched_in":"2.31.5"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T06:39:29Z"},{"id":"wordfence:e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af","source":"wordfence","cve":"CVE-2020-36769","title":"Widget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e14f0fc6-fca4-4dd7-8f7b-ed5ed535c9af?source=api-prod","affected":[{"type":"plugin","slug":"widget-settings-importexport","name":"Widget Settings Importer/Exporter","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2020-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e15082f4-2b5e-4538-bcac-c9e27b129e03","source":"wordfence","cve":"CVE-2025-23711","title":"Quote me <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e15082f4-2b5e-4538-bcac-c9e27b129e03?source=api-prod","affected":[{"type":"plugin","slug":"quote-me","name":"Quote me","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:22:19Z"},{"id":"wordfence:e150d15a-cbc9-4602-831c-2ae8ad2d1b1f","source":"wordfence","cve":"CVE-2025-30613","title":"Nmedia MailChimp <= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e150d15a-cbc9-4602-831c-2ae8ad2d1b1f?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-mailchimp-widget","name":"N-Media MailChimp Subscription","from":"*","from_inclusive":true,"to":"5.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:01:38Z"},{"id":"wordfence:e1523ba0-9cac-43e2-9441-4d02fbaaf705","source":"wordfence","cve":"CVE-2022-4323","title":"Google Analyticator <= 6.5.5 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1523ba0-9cac-43e2-9441-4d02fbaaf705?source=api-prod","affected":[{"type":"plugin","slug":"google-analyticator","name":"Analyticator","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2023-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1531898-c6f6-4841-a03b-bbcd841b76cc","source":"wordfence","cve":"CVE-2026-42383","title":"YITH WooCommerce Product Add-Ons <= 4.29.0 - Authenticated (Shop manager+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1531898-c6f6-4841-a03b-bbcd841b76cc?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"4.29.0","to_inclusive":true,"patched_in":"4.29.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-05-26T19:16:27Z"},{"id":"wordfence:e1531e67-b698-4e53-a7a5-f97383b29983","source":"wordfence","cve":"CVE-2025-49264","title":"Cloud SAML SSO - Single Sign On Login <= 1.0.18 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1531e67-b698-4e53-a7a5-f97383b29983?source=api-prod","affected":[{"type":"plugin","slug":"cloud-sso-single-sign-on","name":"Cloud SAML SSO \u2013 Single Sign On Login","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T14:04:23Z"},{"id":"wordfence:e153bb3d-e175-48bd-894c-7ccb8f09fec4","source":"wordfence","cve":"CVE-2026-1985","title":"Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e153bb3d-e175-48bd-894c-7ccb8f09fec4?source=api-prod","affected":[{"type":"plugin","slug":"press3d","name":"Press3D","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-02-13T18:32:15Z","updated":"2026-05-12T17:14:02Z"},{"id":"wordfence:e153ca31-56fe-4071-9e0e-786eca875e80","source":"wordfence","cve":"CVE-2024-35711","title":"Theme <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e153ca31-56fe-4071-9e0e-786eca875e80?source=api-prod","affected":[{"type":"theme","slug":"event","name":"Event","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-13T13:29:09Z"},{"id":"wordfence:e15441f3-3ffe-4466-9119-e5354fd1c1c4","source":"wordfence","cve":"CVE-2026-42652","title":"User Registration <= 5.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e15441f3-3ffe-4466-9119-e5354fd1c1c4?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.1.5","to_inclusive":true,"patched_in":"5.1.6"}],"published":"2026-04-09T00:00:00Z","updated":"2026-05-07T14:04:24Z"},{"id":"wordfence:e1549ae5-267d-4fbb-be07-5b3842efd4f1","source":"wordfence","cve":"CVE-2022-3769","title":"OWM Weather <= 5.6.8 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1549ae5-267d-4fbb-be07-5b3842efd4f1?source=api-prod","affected":[{"type":"plugin","slug":"owm-weather","name":"OWM Weather","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"5.6.9"}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e154a12d-8ade-456e-ad64-e1cd419e2b2c","source":"wordfence","cve":"CVE-2024-3309","title":"Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e154a12d-8ade-456e-ad64-e1cd419e2b2c?source=api-prod","affected":[{"type":"plugin","slug":"qi-addons-for-elementor","name":"Qi Addons For Elementor","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-27T09:37:56Z"},{"id":"wordfence:e154c472-7984-4926-9e52-96e0be3b5a25","source":"wordfence","cve":"CVE-2026-14313","title":"PeproDev WooCommerce Receipt Uploader <= 2.14.0 - Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e154c472-7984-4926-9e52-96e0be3b5a25?source=api-prod","affected":[{"type":"plugin","slug":"pepro-bacs-receipt-upload-for-woocommerce","name":"PeproDev Receipt Uploader for WooCommerce","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"}],"published":"2026-07-29T00:00:00Z","updated":"2026-10-21T00:02:45Z"},{"id":"wordfence:e154cb8e-db3c-4d08-a3ad-c72e7733cfce","source":"wordfence","cve":"CVE-2025-15637","title":"Shuffle <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e154cb8e-db3c-4d08-a3ad-c72e7733cfce?source=api-prod","affected":[{"type":"theme","slug":"shuffle","name":"Shuffle","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-01T13:21:40Z"},{"id":"wordfence:e156bccf-0a70-4794-9b0f-987424dbf657","source":"wordfence","cve":"CVE-2025-31465","title":"Better Section Navigation Widget <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e156bccf-0a70-4794-9b0f-987424dbf657?source=api-prod","affected":[{"type":"plugin","slug":"better-section-navigation","name":"Better Section Navigation","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-03-28T00:00:00Z","updated":"2025-06-05T17:30:25Z"},{"id":"wordfence:e157826d-77d5-4b2b-9925-691defa54e08","source":"wordfence","cve":"CVE-2025-30626","title":"Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e157826d-77d5-4b2b-9925-691defa54e08?source=api-prod","affected":[{"type":"plugin","slug":"lbg_vp_youtube_vimeo_addon_visual_composer","name":"Multimedia Playlist Slider Addon for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:39:17Z"},{"id":"wordfence:e158a13d-5452-492a-875e-53791e1ff840","source":"wordfence","cve":"CVE-2025-12637","title":"Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e158a13d-5452-492a-875e-53791e1ff840?source=api-prod","affected":[{"type":"plugin","slug":"elastic-theme-editor","name":"Elastic Theme Editor","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:54:54Z","updated":"2026-09-11T13:15:20Z"},{"id":"wordfence:e15b81f7-4d3b-4505-b345-1019fed0fef1","source":"wordfence","cve":"CVE-2015-10114","title":"WooSidebars <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e15b81f7-4d3b-4505-b345-1019fed0fef1?source=api-prod","affected":[{"type":"plugin","slug":"woosidebars","name":"WooSidebars","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2015-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e15ca55b-b8e4-4f65-87a4-e13209cfea78","source":"wordfence","cve":"CVE-2022-37403","title":"Add User Role <= 0.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e15ca55b-b8e4-4f65-87a4-e13209cfea78?source=api-prod","affected":[{"type":"plugin","slug":"add-user-role","name":"Add User Role","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e15d7310-90b0-410e-b758-6b142c70d111","source":"wordfence","cve":"CVE-2026-32398","title":"TeraWallet \u2013 For WooCommerce <= 1.5.15 - Authenticated (Customer+) Race Condition","severity":"medium","cvss":4.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e15d7310-90b0-410e-b758-6b142c70d111?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.5.16"}],"published":"2026-02-20T00:00:00Z","updated":"2026-05-05T14:15:50Z"},{"id":"wordfence:e1634f86-21c0-4b9a-b521-c6b9986f91fc","source":"wordfence","cve":"CVE-2021-24863","title":"WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots < 6.67 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1634f86-21c0-4b9a-b521-c6b9986f91fc?source=api-prod","affected":[{"type":"plugin","slug":"stopbadbots","name":"Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection","from":"*","from_inclusive":true,"to":"6.67","to_inclusive":false,"patched_in":"6.67"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e163555b-8fd1-407e-8fd8-526dcefeb857","source":"wordfence","cve":"CVE-2026-84097","title":"Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e163555b-8fd1-407e-8fd8-526dcefeb857?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.7.11","to_inclusive":true,"patched_in":"12.7.12"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T14:07:29Z"},{"id":"wordfence:e165b9ea-b7e1-43c8-8105-121e51c35a9a","source":"wordfence","cve":"CVE-2026-25441","title":"LeadConnector <= 3.0.21 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e165b9ea-b7e1-43c8-8105-121e51c35a9a?source=api-prod","affected":[{"type":"plugin","slug":"leadconnector","name":"LeadConnector","from":"*","from_inclusive":true,"to":"3.0.21","to_inclusive":true,"patched_in":"3.0.22"}],"published":"2026-01-23T00:00:00Z","updated":"2026-05-04T15:33:26Z"},{"id":"wordfence:e166a7db-45f7-4a0d-9966-dbec9ade204a","source":"wordfence","cve":"CVE-2024-1157","title":"Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e166a7db-45f7-4a0d-9966-dbec9ade204a?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-13T09:31:27Z"},{"id":"wordfence:e166d52d-73d1-4572-b9cc-ab935b05e13c","source":"wordfence","cve":"CVE-2025-11701","title":"Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e166d52d-73d1-4572-b9cc-ab935b05e13c?source=api-prod","affected":[{"type":"plugin","slug":"zip-attachments","name":"Zip Attachments","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:35:45Z","updated":"2025-10-15T08:26:04Z"},{"id":"wordfence:e167eedc-0828-4707-85b9-a78f9aeff27e","source":"wordfence","cve":"CVE-2024-47360","title":"BA Book Everything <= 1.6.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e167eedc-0828-4707-85b9-a78f9aeff27e?source=api-prod","affected":[{"type":"plugin","slug":"ba-book-everything","name":"BA Book Everything","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:26:28Z"},{"id":"wordfence:e1686441-3860-4b36-a3d7-b17a1d6f9686","source":"wordfence","cve":"CVE-2024-55985","title":"YDS Support Ticket System <= 1.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1686441-3860-4b36-a3d7-b17a1d6f9686?source=api-prod","affected":[{"type":"plugin","slug":"yds-support-ticket-system","name":"YDS Support Ticket System","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T16:57:29Z"},{"id":"wordfence:e169f372-d26f-4797-aa16-5492123c0aad","source":"wordfence","cve":"CVE-2026-84069","title":"WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e169f372-d26f-4797-aa16-5492123c0aad?source=api-prod","affected":[{"type":"plugin","slug":"wf-cpanel-email-accounts","name":"WebFacing\u2122 \u2013 Email Accounts management for cPanel\u00ae","from":"5.3","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.4"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:34:56Z"},{"id":"wordfence:e16b8686-a502-4a73-b955-10f2800fd5dc","source":"wordfence","cve":"CVE-2025-57975","title":"Team <= 5.0.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e16b8686-a502-4a73-b955-10f2800fd5dc?source=api-prod","affected":[{"type":"plugin","slug":"tlp-team","name":"Team \u2013 Team Members Showcase Plugin","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.0.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T22:21:43Z"},{"id":"wordfence:e16bda6d-0818-468b-9114-82a8f5f68caf","source":"wordfence","cve":"CVE-2026-104743","title":"Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e16bda6d-0818-468b-9114-82a8f5f68caf?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-10-27T17:42:14Z","updated":"2026-10-28T06:45:21Z"},{"id":"wordfence:e16d8d28-e1e5-46ab-a64c-1da07747559e","source":"wordfence","cve":"CVE-2023-0602","title":"Twittee Text Tweet <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e16d8d28-e1e5-46ab-a64c-1da07747559e?source=api-prod","affected":[{"type":"plugin","slug":"twittee-text-tweet","name":"Twittee Text Tweet","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e16da850-6429-4402-ab09-6d2d145bcfd7","source":"wordfence","cve":"CVE-2024-33951","title":"Perfect Pullquotes <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e16da850-6429-4402-ab09-6d2d145bcfd7?source=api-prod","affected":[{"type":"plugin","slug":"perfect-pullquotes","name":"Perfect Pullquotes","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:49:24Z"},{"id":"wordfence:e1753c17-9a60-418a-b16c-db185f120aa7","source":"wordfence","cve":"CVE-2026-108151","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.9 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1753c17-9a60-418a-b16c-db185f120aa7?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2026-10-12T17:39:06Z","updated":"2026-10-23T18:23:34Z"},{"id":"wordfence:e177c03c-20bd-4135-b72f-fbceab88a117","source":"wordfence","cve":"CVE-2025-23702","title":"Anonymize Links <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e177c03c-20bd-4135-b72f-fbceab88a117?source=api-prod","affected":[{"type":"plugin","slug":"anonymize-links","name":"Anonymize Links","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:37:10Z"},{"id":"wordfence:e179f0fc-6943-4e3b-9346-4604bd9c85bc","source":"wordfence","cve":"CVE-2026-119087","title":"Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e179f0fc-6943-4e3b-9346-4604bd9c85bc?source=api-prod","affected":[{"type":"plugin","slug":"content-egg","name":"Content Egg \u2013 Affiliate Product Importer & Price Comparison","from":"*","from_inclusive":true,"to":"12.0.0","to_inclusive":true,"patched_in":"12.1.0"}],"published":"2026-10-29T17:03:55Z","updated":"2026-10-30T05:35:53Z"},{"id":"wordfence:e17b3cbe-3c87-4a40-8047-33dba0154f97","source":"wordfence","cve":"CVE-2026-39544","title":"LabtechCO <= 8.3 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e17b3cbe-3c87-4a40-8047-33dba0154f97?source=api-prod","affected":[{"type":"theme","slug":"labtechco","name":"LabtechCO | Laboratory & Science Research WordPress Theme","from":"*","from_inclusive":true,"to":"8.3","to_inclusive":true,"patched_in":"8.4"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T15:07:23Z"},{"id":"wordfence:e17c4ed6-b09a-40ca-bcda-2b881056469c","source":"wordfence","cve":"","title":"Crowdsignal Dashboard \u2013 Polls, Surveys & more <= 2.0.31 - Stored Cross-Site scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e17c4ed6-b09a-40ca-bcda-2b881056469c?source=api-prod","affected":[{"type":"plugin","slug":"polldaddy","name":"Crowdsignal Dashboard \u2013 Polls, Surveys & more","from":"*","from_inclusive":true,"to":"2.0.31","to_inclusive":true,"patched_in":"2.0.32"}],"published":"2016-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e17dd3e7-9bd9-4852-9512-72fe1e40f86a","source":"wordfence","cve":"CVE-2021-24672","title":"One User Avatar <= 2.3.6 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e17dd3e7-9bd9-4852-9512-72fe1e40f86a?source=api-prod","affected":[{"type":"plugin","slug":"one-user-avatar","name":"One User Avatar | User Profile Picture","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":false,"patched_in":"2.3.7"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e180758a-d1c8-4b68-937b-89878619da8f","source":"wordfence","cve":"CVE-2024-34758","title":"WP Fundraising Donation and Crowdfunding Platform <= 1.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e180758a-d1c8-4b68-937b-89878619da8f?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T15:42:02Z"},{"id":"wordfence:e1815369-2a5f-4626-8e99-9ff262407786","source":"wordfence","cve":"CVE-2026-91078","title":"TillKit <= 1.0.4 - Unauthenticated Privileged POS Session Hijacking","severity":"medium","cvss":5.3,"cwe":"CWE-259","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1815369-2a5f-4626-8e99-9ff262407786?source=api-prod","affected":[{"type":"plugin","slug":"tillkit","name":"TillKit \u2013 Mobile POS for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-10-01T00:00:00Z","updated":"2026-10-09T13:15:44Z"},{"id":"wordfence:e181f47b-c6d3-4166-9ae2-f49c2ea731a5","source":"wordfence","cve":"CVE-2025-22662","title":"SendPulse Email Marketing Newsletter <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e181f47b-c6d3-4166-9ae2-f49c2ea731a5?source=api-prod","affected":[{"type":"plugin","slug":"sendpulse-email-marketing-newsletter","name":"SendPulse Email Marketing Newsletter","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:30:22Z"},{"id":"wordfence:e186123e-313f-4b0e-9579-135cfdfa4bc0","source":"wordfence","cve":"CVE-2021-39331","title":"YITH Easy Login & Register Popup for WooCommerce <= 1.8.0 - Authentication Bypass via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e186123e-313f-4b0e-9579-135cfdfa4bc0?source=api-prod","affected":[{"type":"plugin","slug":"yith-easy-login-register-popup-for-woocommerce","name":"YITH Easy Login & Register Popup for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e188b3a4-ddb2-405b-840f-4f13db5dbf3a","source":"wordfence","cve":"CVE-2024-31231","title":"Rehub <= 19.6.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e188b3a4-ddb2-405b-840f-4f13db5dbf3a?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.6.1","to_inclusive":true,"patched_in":"19.6.2"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-06T17:31:29Z"},{"id":"wordfence:e188c944-7f04-4977-b13a-54caa5e91fd6","source":"wordfence","cve":"CVE-2025-66160","title":"Graphist <= 1.2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e188c944-7f04-4977-b13a-54caa5e91fd6?source=api-prod","affected":[{"type":"plugin","slug":"graphist-elementor","name":"Graphist \u2013 Graphs & Charts for Elementor","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T21:08:23Z"},{"id":"wordfence:e18aba51-46a8-4670-8e15-85b12f5d06e6","source":"wordfence","cve":"CVE-2021-20652","title":"Name Directory <= 1.17.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e18aba51-46a8-4670-8e15-85b12f5d06e6?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.17.4","to_inclusive":true,"patched_in":"1.18"}],"published":"2021-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e18aceee-edbb-45ae-8f5e-6bce2aed65b6","source":"wordfence","cve":"CVE-2025-48102","title":"GoUrl Bitcoin Payment Gateway &amp; Paid Downloads &amp; Membership <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e18aceee-edbb-45ae-8f5e-6bce2aed65b6?source=api-prod","affected":[{"type":"plugin","slug":"gourl-bitcoin-payment-gateway-paid-downloads-membership","name":"GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:40:55Z"},{"id":"wordfence:e18ae7a9-7761-432f-a983-16ff1131c1e8","source":"wordfence","cve":"CVE-2023-31072","title":"Advanced Category Template <= 0.1 - Stored Cross-Site Scripting via Cross-Site Request Forgery in _form.php","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e18ae7a9-7761-432f-a983-16ff1131c1e8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-category-template","name":"Advanced Category Template","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e18b3a85-9d4a-4af8-9a73-1f8794ad467b","source":"wordfence","cve":"CVE-2015-9458","title":"SEO SearchTerms Tagging 2 <=1.535 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e18b3a85-9d4a-4af8-9a73-1f8794ad467b?source=api-prod","affected":[{"type":"plugin","slug":"searchterms-tagging-2","name":"SEO SearchTerms Tagging 2","from":"*","from_inclusive":true,"to":"1.535","to_inclusive":true,"patched_in":""}],"published":"2015-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1900948-8813-4c88-87fe-ddf830c6ae3b","source":"wordfence","cve":"CVE-2022-46800","title":"LiteSpeed Cache <= 5.3 - Missing Authorization to Toggle Crawler State","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1900948-8813-4c88-87fe-ddf830c6ae3b?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e19377a8-fa42-43ab-b60e-c216c21697db","source":"wordfence","cve":"CVE-2026-47100","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e19377a8-fa42-43ab-b60e-c216c21697db?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.2","to_inclusive":true,"patched_in":"3.15.0.3"}],"published":"2026-05-19T00:00:00Z","updated":"2026-07-30T12:42:17Z"},{"id":"wordfence:e1959333-a4e0-4bb5-b8cf-09d6c0607e73","source":"wordfence","cve":"CVE-2026-122660","title":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist <= 7.8.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1959333-a4e0-4bb5-b8cf-09d6c0607e73?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.6"}],"published":"2026-11-07T12:38:00Z","updated":"2026-11-10T19:53:05Z"},{"id":"wordfence:e199e9dc-96a9-4aee-b386-662993b6ede6","source":"wordfence","cve":"CVE-2026-97195","title":"Secure Custom Fields <= 6.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e199e9dc-96a9-4aee-b386-662993b6ede6?source=api-prod","affected":[{"type":"plugin","slug":"secure-custom-fields","name":"Secure Custom Fields","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:34:16Z"},{"id":"wordfence:e19da267-bb40-45aa-96bc-3f0ac6776b8e","source":"wordfence","cve":"CVE-2026-105883","title":"Th Shop Mania <= 1.9.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e19da267-bb40-45aa-96bc-3f0ac6776b8e?source=api-prod","affected":[{"type":"theme","slug":"th-shop-mania","name":"Th Shop Mania","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:24:35Z"},{"id":"wordfence:e19f4cb9-09ec-4711-a799-1ba809f2eda8","source":"wordfence","cve":"CVE-2019-15780","title":"Formidable Form Builder <= 4.02 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f4cb9-09ec-4711-a799-1ba809f2eda8?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"4.02.01","to_inclusive":false,"patched_in":"4.02.01"}],"published":"2019-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e19f5f7b-6698-4275-a362-15e5441e0fa9","source":"wordfence","cve":"CVE-2026-7655","title":"SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f5f7b-6698-4275-a362-15e5441e0fa9?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-07-10T16:08:06Z","updated":"2026-07-11T04:32:59Z"},{"id":"wordfence:e19f69ee-180a-44b7-8d41-3630c6932dda","source":"wordfence","cve":"CVE-2025-23667","title":"custom-post-edit <= 1.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e19f69ee-180a-44b7-8d41-3630c6932dda?source=api-prod","affected":[{"type":"plugin","slug":"front-end-post-edit","name":"custom-post-edit","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:07:17Z"},{"id":"wordfence:e1a1df7e-1a57-45b3-a4b3-cb3218782ad9","source":"wordfence","cve":"CVE-2025-12961","title":"Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1a1df7e-1a57-45b3-a4b3-cb3218782ad9?source=api-prod","affected":[{"type":"plugin","slug":"download-panel","name":"Download Panel (Biggiko Team)","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:15:56Z","updated":"2025-11-18T08:27:37Z"},{"id":"wordfence:e1a20ca8-8eb8-4247-9145-63bcb0d5d681","source":"wordfence","cve":"CVE-2024-47387","title":"Search Atlas SEO <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1a20ca8-8eb8-4247-9145-63bcb0d5d681?source=api-prod","affected":[{"type":"plugin","slug":"metasync","name":"Search Atlas SEO \u2013 OTTO AI SEO Automation for WordPress","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:51:08Z"},{"id":"wordfence:e1a3cc98-3bee-4d52-a4bf-2a1a284b9311","source":"wordfence","cve":"CVE-2023-50841","title":"BookingPress <= 1.0.72 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1a3cc98-3bee-4d52-a4bf-2a1a284b9311?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.72","to_inclusive":true,"patched_in":"1.0.73"}],"published":"2023-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1a3ea4c-163f-406c-a819-92d3157fd93f","source":"wordfence","cve":"CVE-2023-32109","title":"Albo Pretorio Online <= 4.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1a3ea4c-163f-406c-a819-92d3157fd93f?source=api-prod","affected":[{"type":"plugin","slug":"albo-pretorio-on-line","name":"Albo Pretorio On line","from":"*","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1a492f6-8248-4a84-b163-7262b02563c2","source":"wordfence","cve":"CVE-2024-38729","title":"MBE eShip <= 2.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1a492f6-8248-4a84-b163-7262b02563c2?source=api-prod","affected":[{"type":"plugin","slug":"mail-boxes-etc","name":"MBE eShip","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-09-06T15:54:47Z"},{"id":"wordfence:e1ac5ae3-8516-4b0d-a504-fb90d23c4af6","source":"wordfence","cve":"CVE-2026-89331","title":"FluentBoards 1.95 - 2.0.15 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ac5ae3-8516-4b0d-a504-fb90d23c4af6?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"1.95","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:58:05Z"},{"id":"wordfence:e1ac8af3-bd42-4d58-b70b-b67e66a632ea","source":"wordfence","cve":"CVE-2026-25032","title":"Ricky < 2.31 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ac8af3-bd42-4d58-b70b-b67e66a632ea?source=api-prod","affected":[{"type":"theme","slug":"ricky","name":"Ricky - Pet Shop & Care WooCoomerce Theme","from":"*","from_inclusive":true,"to":"2.31","to_inclusive":false,"patched_in":"2.31"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T16:04:36Z"},{"id":"wordfence:e1ae8af9-36da-421b-8759-c93f78af3a66","source":"wordfence","cve":"CVE-2025-27272","title":"VG PostCarousel <= 1.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ae8af9-36da-421b-8759-c93f78af3a66?source=api-prod","affected":[{"type":"plugin","slug":"vg-postcarousel","name":"VG PostCarousel","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T20:30:53Z"},{"id":"wordfence:e1ae9d9e-fb79-4518-9336-f4b8fa3a0311","source":"wordfence","cve":"CVE-2026-116863","title":"Newsletters <= 4.18.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ae9d9e-fb79-4518-9336-f4b8fa3a0311?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-27T15:56:00Z","updated":"2026-10-28T01:27:32Z"},{"id":"wordfence:e1af37ed-fcc6-479c-8c53-25ccb9a8659f","source":"wordfence","cve":"CVE-2024-5222","title":"Responsive Addons \u2013 Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1af37ed-fcc6-479c-8c53-25ccb9a8659f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-06-04T18:19:53Z","updated":"2024-06-05T06:50:29Z"},{"id":"wordfence:e1aff11b-0519-4712-b3ac-03e1612a69c1","source":"wordfence","cve":"CVE-2026-82024","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1aff11b-0519-4712-b3ac-03e1612a69c1?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-16T16:11:59Z"},{"id":"wordfence:e1b02e83-142f-48f8-88dd-994862d15376","source":"wordfence","cve":"CVE-2024-51915","title":"LiteSpeed Cache <= 6.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b02e83-142f-48f8-88dd-994862d15376?source=api-prod","affected":[{"type":"plugin","slug":"litespeed-cache","name":"LiteSpeed Cache","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2024-12-20T00:00:00Z","updated":"2025-03-25T13:50:41Z"},{"id":"wordfence:e1b18095-d328-4658-81fc-7b15ca526c18","source":"wordfence","cve":"CVE-2026-18512","title":"TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b18095-d328-4658-81fc-7b15ca526c18?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.3"}],"published":"2026-08-24T19:07:10Z","updated":"2026-08-25T07:39:51Z"},{"id":"wordfence:e1b19017-b2f0-4c3b-b263-1fbec6f1dce4","source":"wordfence","cve":"CVE-2025-6997","title":"ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b19017-b2f0-4c3b-b263-1fbec6f1dce4?source=api-prod","affected":[{"type":"plugin","slug":"trx_addons","name":"ThemeREX Addons","from":"*","from_inclusive":true,"to":"2.35.1.1","to_inclusive":true,"patched_in":"2.35.2.2"}],"published":"2025-07-18T19:52:51Z","updated":"2025-07-19T08:24:23Z"},{"id":"wordfence:e1b2dcad-01cf-4304-9ff9-2917ff5a2a8d","source":"wordfence","cve":"CVE-2026-95525","title":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission <= 4.3.11 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b2dcad-01cf-4304-9ff9-2917ff5a2a8d?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"4.3.12"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:29:16Z"},{"id":"wordfence:e1b3d106-445b-455f-b3d7-3318f5c35191","source":"wordfence","cve":"CVE-2026-57789","title":"Aqua <= 5.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b3d106-445b-455f-b3d7-3318f5c35191?source=api-prod","affected":[{"type":"theme","slug":"aqua","name":"aqua","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:36:49Z"},{"id":"wordfence:e1b4216f-f2b2-452b-a7b7-4a6c8a293b22","source":"wordfence","cve":"CVE-2026-22387","title":"Aviana <= 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b4216f-f2b2-452b-a7b7-4a6c8a293b22?source=api-prod","affected":[{"type":"theme","slug":"aviana","name":"Aviana - Elegant Wellness & Spa WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:38:31Z"},{"id":"wordfence:e1b45007-6679-42a4-9d40-1f4630a059f0","source":"wordfence","cve":"CVE-2025-26769","title":"Vertex Addons for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b45007-6679-42a4-9d40-1f4630a059f0?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor-builder","name":"Vertex Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:00:14Z"},{"id":"wordfence:e1b473fd-2444-4a54-b558-4656634a6903","source":"wordfence","cve":"CVE-2025-12126","title":"The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=api-prod","affected":[{"type":"plugin","slug":"the-total-book-project","name":"The Total Book Project","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2025-11-10T15:18:41Z","updated":"2025-11-13T15:53:37Z"},{"id":"wordfence:e1b70dc7-6be5-48fc-b3c3-6bd45a5b7992","source":"wordfence","cve":"CVE-2025-69016","title":"Shortcodes and extra features for Phlox <= 2.17.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b70dc7-6be5-48fc-b3c3-6bd45a5b7992?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.22","to_inclusive":true,"patched_in":"2.17.24"}],"published":"2025-12-27T00:00:00Z","updated":"2026-10-13T16:57:36Z"},{"id":"wordfence:e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad","source":"wordfence","cve":"CVE-2025-10749","title":"Microsoft Azure Storage for WordPress <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b80852-a221-4c2c-b76d-8bdcd1e0f1ad?source=api-prod","affected":[{"type":"plugin","slug":"windows-azure-storage","name":"Microsoft Azure Storage for WordPress","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2025-10-23T20:09:38Z","updated":"2025-10-30T14:32:37Z"},{"id":"wordfence:e1baa3f0-28ec-409f-a9a5-c35545ab439a","source":"wordfence","cve":"CVE-2024-11200","title":"Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1baa3f0-28ec-409f-a9a5-c35545ab439a?source=api-prod","affected":[{"type":"plugin","slug":"goodlayers-core","name":"Goodlayers Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T13:55:35Z"},{"id":"wordfence:e1bbd339-5eb7-4a62-9c68-bcd76507425c","source":"wordfence","cve":"CVE-2026-1487","title":"LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bbd339-5eb7-4a62-9c68-bcd76507425c?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2026-03-02T11:25:27Z","updated":"2026-03-03T01:21:51Z"},{"id":"wordfence:e1bcebb3-920b-40cc-aa5c-24a1f729b28d","source":"wordfence","cve":"CVE-2024-4891","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bcebb3-920b-40cc-aa5c-24a1f729b28d?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.5.12","to_inclusive":true,"patched_in":"4.5.13"}],"published":"2024-05-16T00:00:00Z","updated":"2024-05-18T04:30:53Z"},{"id":"wordfence:e1bdda78-e0e3-4d0b-81b8-9c018f445225","source":"wordfence","cve":"CVE-2015-9331","title":"Import any XML or CSV File to WordPress <= 3.2.3 & PRO < 4.1.1 - Missing Authorization Checks","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bdda78-e0e3-4d0b-81b8-9c018f445225?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":false,"patched_in":"4.1.1"},{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":false,"patched_in":"3.2.4"}],"published":"2019-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1be11c5-0a44-4816-b6bf-d330cb51dbf3","source":"wordfence","cve":"CVE-2023-5982","title":"UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1be11c5-0a44-4816-b6bf-d330cb51dbf3?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.23.10","to_inclusive":true,"patched_in":"1.23.11"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1c11388-fff4-4206-b7b5-3d7e3e0da16a","source":"wordfence","cve":"CVE-2023-0073","title":"Client Logo Carousel <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1c11388-fff4-4206-b7b5-3d7e3e0da16a?source=api-prod","affected":[{"type":"plugin","slug":"wp-client-logo-carousel","name":"Client Logo Carousel","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1c16bcb-c188-4e01-9d0b-e4e1a1ef82ee","source":"wordfence","cve":"CVE-2026-8143","title":"HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1c16bcb-c188-4e01-9d0b-e4e1a1ef82ee?source=api-prod","affected":[{"type":"plugin","slug":"hbook","name":"HBook - Hotel booking system - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2026-07-29T23:04:31Z","updated":"2026-08-11T13:09:01Z"},{"id":"wordfence:e1c4b5e9-e141-4d0d-866a-ff4fb8b68dea","source":"wordfence","cve":"CVE-2022-4825","title":"WP-ShowHide <= 1.04 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1c4b5e9-e141-4d0d-866a-ff4fb8b68dea?source=api-prod","affected":[{"type":"plugin","slug":"wp-showhide","name":"WP-ShowHide","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":"1.05"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1c97b99-ca39-45de-8df9-312ba1573e8d","source":"wordfence","cve":"CVE-2023-26013","title":"Strong Testimonials <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1c97b99-ca39-45de-8df9-312ba1573e8d?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1c9cfba-d0dd-414a-b464-911c2188d96f","source":"wordfence","cve":"CVE-2025-30624","title":"WordLift <= 3.54.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1c9cfba-d0dd-414a-b464-911c2188d96f?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.54.4","to_inclusive":true,"patched_in":"3.54.5"}],"published":"2025-06-05T00:00:00Z","updated":"2025-07-03T12:08:28Z"},{"id":"wordfence:e1cab43e-8710-4150-935a-5268170d14ad","source":"wordfence","cve":"CVE-2024-55994","title":"\u7545\u8a00\u8bc4\u8bba\u7cfb\u7edf <= 2.0.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1cab43e-8710-4150-935a-5268170d14ad?source=api-prod","affected":[{"type":"plugin","slug":"changyan","name":"\u7545\u8a00\u8bc4\u8bba\u7cfb\u7edf","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:32:52Z"},{"id":"wordfence:e1cc3dbe-26e3-478f-9574-f57ffa0f50c3","source":"wordfence","cve":"CVE-2024-8619","title":"Ajax Search Lite <= 4.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1cc3dbe-26e3-478f-9574-f57ffa0f50c3?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.12.1","to_inclusive":true,"patched_in":"4.12.2"}],"published":"2024-08-02T00:00:00Z","updated":"2024-10-11T16:58:25Z"},{"id":"wordfence:e1cd9978-2d8d-4818-8baf-8f31e0212957","source":"wordfence","cve":"CVE-2024-56264","title":"ACF City Selector <= 1.14.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1cd9978-2d8d-4818-8baf-8f31e0212957?source=api-prod","affected":[{"type":"plugin","slug":"acf-city-selector","name":"ACF City Selector","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":true,"patched_in":"1.15.0"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:37:39Z"},{"id":"wordfence:e1d0af55-eee4-4283-8216-0474c65deac7","source":"wordfence","cve":"CVE-2025-49354","title":"Recent Posts From Each Category <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1d0af55-eee4-4283-8216-0474c65deac7?source=api-prod","affected":[{"type":"plugin","slug":"recent-posts-from-each-category","name":"Recent Posts From Each Category","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:17:53Z"},{"id":"wordfence:e1d7cf90-1a9f-4d88-9dfb-f48481095a0c","source":"wordfence","cve":"CVE-2024-12818","title":"WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1d7cf90-1a9f-4d88-9dfb-f48481095a0c?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-tv","name":"MediaBlaster \u2013 Video CMS, Vimeo Import, Live TV & Podcasts","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-15T09:25:56Z"},{"id":"wordfence:e1d7e024-83c5-40c2-986d-cfa69c10041e","source":"wordfence","cve":"CVE-2025-53993","title":"JetPopup <= 2.0.15 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1d7e024-83c5-40c2-986d-cfa69c10041e?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.15.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:53:43Z"},{"id":"wordfence:e1db5e59-3b78-4a1e-931d-b255859bc2cd","source":"wordfence","cve":"CVE-2026-10599","title":"Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1db5e59-3b78-4a1e-931d-b255859bc2cd?source=api-prod","affected":[{"type":"plugin","slug":"wc-phonepe","name":"Integrate PhonePe with WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-25T00:00:00Z","updated":"2026-08-17T15:38:19Z"},{"id":"wordfence:e1dbd0e2-8c6c-4127-b37c-269af3b7f71c","source":"wordfence","cve":"","title":"Jetpack CRM <= 5.5.0 - Authenticated (Client+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1dbd0e2-8c6c-4127-b37c-269af3b7f71c?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.5.1"}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1dcdc7f-ae52-4c76-90db-ea136656bb0b","source":"wordfence","cve":"CVE-2021-47984","title":"WP24 Domain Check <= 1.6.2 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1dcdc7f-ae52-4c76-90db-ea136656bb0b?source=api-prod","affected":[{"type":"plugin","slug":"wp24-domain-check","name":"WP24 Domain Check","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2021-01-06T00:00:00Z","updated":"2026-07-29T20:58:51Z"},{"id":"wordfence:e1e20253-4002-467a-9dca-10bc2bfe4514","source":"wordfence","cve":"CVE-2026-1984","title":"Ibtana \u2013 Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e20253-4002-467a-9dca-10bc2bfe4514?source=api-prod","affected":[{"type":"plugin","slug":"ibtana-ecommerce-product-addons","name":"Ibtana \u2013 Ecommerce Product Addons","from":"*","from_inclusive":true,"to":"0.4.7.7","to_inclusive":true,"patched_in":"0.4.7.8"}],"published":"2026-09-18T19:03:38Z","updated":"2026-09-19T07:43:21Z"},{"id":"wordfence:e1e4b27d-a4e1-449e-a509-410df13954d5","source":"wordfence","cve":"CVE-2026-78531","title":"Jacqueline | Spa & Massage Salon Beauty Theme <= 2.22 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e4b27d-a4e1-449e-a509-410df13954d5?source=api-prod","affected":[{"type":"theme","slug":"jacqueline","name":"jacqueline","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:54:29Z","updated":"2026-10-13T14:06:42Z"},{"id":"wordfence:e1e82300-9b18-4938-84ac-7d4ee8c21875","source":"wordfence","cve":"CVE-2022-29452","title":"Export All URLs <= 4.1 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e82300-9b18-4938-84ac-7d4ee8c21875?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2022-05-27T00:00:00Z","updated":"2026-05-07T13:57:47Z"},{"id":"wordfence:e1e973e3-f2a2-465c-aec7-5a7d4290c00b","source":"wordfence","cve":"CVE-2012-2399","title":"WordPress Core <= 3.5.1 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e973e3-f2a2-465c-aec7-5a7d4290c00b?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2012-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1e9bf39-b0aa-457c-96ed-87d3d96a1eec","source":"wordfence","cve":"CVE-2025-31055","title":"Electrician - Electrical Service WordPress <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e9bf39-b0aa-457c-96ed-87d3d96a1eec?source=api-prod","affected":[{"type":"theme","slug":"electrician","name":"electrician","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:45:15Z"},{"id":"wordfence:e1e9d634-536e-477d-8969-c133056008f5","source":"wordfence","cve":"CVE-2026-121857","title":"Event Tickets with Ticket Scanner <= 3.1.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1e9d634-536e-477d-8969-c133056008f5?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T13:13:05Z"},{"id":"wordfence:e1eafbdf-450a-4cc9-b917-3f3802e089f1","source":"wordfence","cve":"CVE-2026-42689","title":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 - Unauthenticated Race Condition","severity":"medium","cvss":5.3,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1eafbdf-450a-4cc9-b917-3f3802e089f1?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-13T19:42:39Z"},{"id":"wordfence:e1eb0e25-5cc9-41e8-9cf2-6e3be65e9091","source":"wordfence","cve":"CVE-2026-39749","title":"App for Cloudflare\u00ae <= 1.10.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1eb0e25-5cc9-41e8-9cf2-6e3be65e9091?source=api-prod","affected":[{"type":"plugin","slug":"app-for-cf","name":"App for Cloudflare\u00ae","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T12:12:21Z","updated":"2026-10-08T23:25:35Z"},{"id":"wordfence:e1eb1c7c-9242-43af-b0bf-375cdb182af0","source":"wordfence","cve":"CVE-2025-62963","title":"Estatik <= 4.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1eb1c7c-9242-43af-b0bf-375cdb182af0?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2026-03-23T15:44:42Z"},{"id":"wordfence:e1ebbb18-0266-49e8-ada3-b63905021846","source":"wordfence","cve":"CVE-2025-3436","title":"coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ebbb18-0266-49e8-ada3-b63905021846?source=api-prod","affected":[{"type":"plugin","slug":"coreactivity","name":"coreActivity: Activity Logging for WordPress","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T08:22:09Z"},{"id":"wordfence:e1ebd1f8-cd33-4531-8e23-5c1029931fb4","source":"wordfence","cve":"CVE-2026-9067","title":"Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ebd1f8-cd33-4531-8e23-5c1029931fb4?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.60","to_inclusive":false,"patched_in":"1.60"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-18T13:15:44Z"},{"id":"wordfence:e1ecc237-87b0-4c4d-94cc-d3af9c6669c5","source":"wordfence","cve":"CVE-2026-12111","title":"Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ecc237-87b0-4c4d-94cc-d3af9c6669c5?source=api-prod","affected":[{"type":"plugin","slug":"appointment-booking-calendar","name":"Appointment Booking Calendar","from":"*","from_inclusive":true,"to":"1.4.01","to_inclusive":true,"patched_in":"1.4.02"}],"published":"2026-06-17T18:14:36Z","updated":"2026-06-18T15:57:28Z"},{"id":"wordfence:e1ed77cf-2595-477a-af86-25c917817984","source":"wordfence","cve":"CVE-2025-12130","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ed77cf-2595-477a-af86-25c917817984?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.4.1"}],"published":"2025-12-04T19:20:08Z","updated":"2025-12-05T07:26:18Z"},{"id":"wordfence:e1eeabdb-f1c0-49c5-9234-8ff4eaa38087","source":"wordfence","cve":"","title":"WooCommerce <= 2.0.17 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1eeabdb-f1c0-49c5-9234-8ff4eaa38087?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":"2.0.18"}],"published":"2013-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1f0ec5c-6853-4df9-816a-1790f3dc86e0","source":"wordfence","cve":"CVE-2023-35915","title":"WooCommerce Payments <= 5.9.0 - Authenticated (Shop manager+) SQL Injection via currency parameters","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f0ec5c-6853-4df9-816a-1790f3dc86e0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-payments","name":"WooPayments: Integrated WooCommerce Payments","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2023-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1f230f5-d40c-43b2-82f2-c920dca9707f","source":"wordfence","cve":"CVE-2025-5590","title":"Owl carousel responsive <= 1.9 - Authenticated (Contributor+) SQL Injection via id Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f230f5-d40c-43b2-82f2-c920dca9707f?source=api-prod","affected":[{"type":"plugin","slug":"responsive-owl-carousel","name":"Owl carousel responsive","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:43:42Z","updated":"2025-06-26T01:44:39Z"},{"id":"wordfence:e1f636fe-fea7-4252-8f95-cd8f17f57fc4","source":"wordfence","cve":"CVE-2026-6379","title":"WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f636fe-fea7-4252-8f95-cd8f17f57fc4?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.1.11.001","to_inclusive":false,"patched_in":"9.1.11.001"}],"published":"2026-06-11T00:00:00Z","updated":"2026-06-15T19:35:13Z"},{"id":"wordfence:e1f701e5-194a-4245-855e-c3b8204d4959","source":"wordfence","cve":"CVE-2024-4535","title":"KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Progress Bar Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f701e5-194a-4245-855e-c3b8204d4959?source=api-prod","affected":[{"type":"plugin","slug":"kkprogressbar","name":"KKProgressbar2 Free \u2013 advanced progress bars","from":"*","from_inclusive":true,"to":"1.1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:28:55Z"},{"id":"wordfence:e1f723ab-bba0-4983-bbac-7ab71be3a743","source":"wordfence","cve":"CVE-2026-119465","title":"Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.15 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f723ab-bba0-4983-bbac-7ab71be3a743?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.15.1"}],"published":"2026-11-07T09:28:00Z","updated":"2026-11-10T19:25:18Z"},{"id":"wordfence:e1f9e09f-b69b-46e8-9793-8406956f54b3","source":"wordfence","cve":"CVE-2024-55978","title":"Code Generator Pro <= 1.2 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f9e09f-b69b-46e8-9793-8406956f54b3?source=api-prod","affected":[{"type":"plugin","slug":"code-generator-pro","name":"Code Generator Pro","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:59:54Z"},{"id":"wordfence:e1fa3569-9a9a-4aa6-9057-c87601fadb9f","source":"wordfence","cve":"CVE-2024-10357","title":"Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fa3569-9a9a-4aa6-9057-c87601fadb9f?source=api-prod","affected":[{"type":"plugin","slug":"cafe-lite","name":"Clever Addons for Elementor","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T20:37:29Z","updated":"2024-10-26T09:35:21Z"},{"id":"wordfence:e1fad1e1-5fb8-4423-80d3-512f5ec7dd59","source":"wordfence","cve":"CVE-2025-32482","title":"Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fad1e1-5fb8-4423-80d3-512f5ec7dd59?source=api-prod","affected":[{"type":"plugin","slug":"custom-smilies","name":"Custom Smilies","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:27:23Z"},{"id":"wordfence:e1fc6a2e-9c91-4517-8f04-fb3ea65413b8","source":"wordfence","cve":"","title":"Zengo Custom Thumbnail Image Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fc6a2e-9c91-4517-8f04-fb3ea65413b8?source=api-prod","affected":[{"type":"plugin","slug":"zengo-custom-thumbnail-image","name":"Zengo Custom Thumbnail Image Gallery","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e1fcc06a-9571-44c3-b3ff-286ccda1abea","source":"wordfence","cve":"CVE-2025-58236","title":"Force Update Translations <= 0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fcc06a-9571-44c3-b3ff-286ccda1abea?source=api-prod","affected":[{"type":"plugin","slug":"force-update-translations","name":"Force Update Translations","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.6.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-01-06T18:25:24Z"},{"id":"wordfence:e1ff2c57-c3b7-4747-9f99-665774dc2054","source":"wordfence","cve":"CVE-2024-7056","title":"WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e1ff2c57-c3b7-4747-9f99-665774dc2054?source=api-prod","affected":[{"type":"plugin","slug":"wpforms-lite","name":"WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, Payment Forms, Survey Form, Quiz & More","from":"*","from_inclusive":true,"to":"1.9.1.5","to_inclusive":true,"patched_in":"1.9.1.6"}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-19T12:43:38Z"},{"id":"wordfence:e20082a0-dca6-4a26-919f-d59752dfbe90","source":"wordfence","cve":"CVE-2022-2543","title":"Visual Portfolio, Photo Gallery & Post Grid <= 2.17.1 - Unauthenticated CSS Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e20082a0-dca6-4a26-919f-d59752dfbe90?source=api-prod","affected":[{"type":"plugin","slug":"visual-portfolio","name":"Gallery by Visual Portfolio","from":"*","from_inclusive":true,"to":"2.17.1","to_inclusive":true,"patched_in":"2.18.0"}],"published":"2022-08-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2008c4b-1406-4705-a20e-d3c2cf812ceb","source":"wordfence","cve":"CVE-2026-114191","title":"UPI QR Code Payment Gateway for WooCommerce <= 1.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008c4b-1406-4705-a20e-d3c2cf812ceb?source=api-prod","affected":[{"type":"plugin","slug":"upi-qr-code-payment-for-woocommerce","name":"UPI QR Code Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2026-10-22T13:23:45Z","updated":"2026-10-28T01:19:14Z"},{"id":"wordfence:e2008e0b-32c6-46fb-93b9-2b0004f478e8","source":"wordfence","cve":"CVE-2023-2286","title":"WP Activity Log <= 4.5.0 - Cross-Site Request Forgery via ajax_run_cleanup","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2008e0b-32c6-46fb-93b9-2b0004f478e8?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"},{"type":"plugin","slug":"wp-security-audit-log-premium","name":"WP Activity Log Premium","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e203fc8f-fc57-4918-8ef2-3ba6ae979d40","source":"wordfence","cve":"","title":"WooCommerce Conversion Tracking <= 2.0.4 - Cross-Site Request Forgery and Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e203fc8f-fc57-4918-8ef2-3ba6ae979d40?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-conversion-tracking","name":"Conversion Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.6"}],"published":"2020-01-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e205d8f3-3855-4c59-9537-36ae24b1e840","source":"wordfence","cve":"CVE-2024-54275","title":"CSV to html <= 3.08 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e205d8f3-3855-4c59-9537-36ae24b1e840?source=api-prod","affected":[{"type":"plugin","slug":"csv-to-html","name":"CSV to HTML","from":"*","from_inclusive":true,"to":"3.08","to_inclusive":true,"patched_in":"3.15"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-20T21:50:08Z"},{"id":"wordfence:e206ad70-c50d-46c3-b3d8-ad7305bfaa32","source":"wordfence","cve":"CVE-2024-27971","title":"Premmerce Permalink Manager for WooCommerce <= 2.3.10 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e206ad70-c50d-46c3-b3d8-ad7305bfaa32?source=api-prod","affected":[{"type":"plugin","slug":"woo-permalink-manager","name":"Premmerce Permalink Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:19:15Z"},{"id":"wordfence:e207f1a3-2ca5-46d1-91a9-89652451266c","source":"wordfence","cve":"CVE-2024-11291","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e207f1a3-2ca5-46d1-91a9-89652451266c?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":"2.13.5"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T11:09:36Z"},{"id":"wordfence:e20a34e5-6c1c-4f12-b1d8-aa4b40a5dd00","source":"wordfence","cve":"CVE-2025-15058","title":"Responsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e20a34e5-6c1c-4f12-b1d8-aa4b40a5dd00?source=api-prod","affected":[{"type":"plugin","slug":"dk-pricr-responsive-pricing-table","name":"Responsive Pricing Table","from":"*","from_inclusive":true,"to":"5.1.12","to_inclusive":true,"patched_in":"5.1.13"}],"published":"2026-01-06T20:37:08Z","updated":"2026-01-13T16:38:13Z"},{"id":"wordfence:e20deec4-f40c-4bd3-91f7-6a9d643a5520","source":"wordfence","cve":"CVE-2026-1000","title":"MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e20deec4-f40c-4bd3-91f7-6a9d643a5520?source=api-prod","affected":[{"type":"plugin","slug":"woo-mailerlite","name":"MailerLite \u2013 WooCommerce integration","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2025-12-15T16:26:53Z","updated":"2026-01-16T04:44:37Z"},{"id":"wordfence:e20fe2b7-4396-465e-be41-d4e8a069bb74","source":"wordfence","cve":"","title":"Image/Banner Widget <= 1.4.5 - Authenticated (Administrator+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e20fe2b7-4396-465e-be41-d4e8a069bb74?source=api-prod","affected":[{"type":"plugin","slug":"image-banner-widget","name":"Image/Banner Widget","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2022-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e20feb23-f78e-42e7-8922-e7cf37dbdcb1","source":"wordfence","cve":"CVE-2023-23725","title":"Shortcodes by Angie Makes <= 3.46 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e20feb23-f78e-42e7-8922-e7cf37dbdcb1?source=api-prod","affected":[{"type":"plugin","slug":"wc-shortcodes","name":"Shortcodes by Angie Makes","from":"*","from_inclusive":true,"to":"3.46","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e211df80-aab7-43a1-8c11-a472f90ef4c6","source":"wordfence","cve":"CVE-2025-14454","title":"Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e211df80-aab7-43a1-8c11-a472f90ef4c6?source=api-prod","affected":[{"type":"plugin","slug":"ays-slider","name":"Image Slider by Ays- Responsive Slider and Carousel","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2025-12-12T14:34:25Z","updated":"2025-12-13T03:20:27Z"},{"id":"wordfence:e212b92a-e5f4-415d-9205-070fe720a687","source":"wordfence","cve":"CVE-2026-118169","title":"Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e212b92a-e5f4-415d-9205-070fe720a687?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.14.3","to_inclusive":true,"patched_in":"7.8.14.4"}],"published":"2026-10-27T17:55:57Z","updated":"2026-10-28T06:45:21Z"},{"id":"wordfence:e2137992-a2f9-4dcf-a880-12811a7c5f26","source":"wordfence","cve":"CVE-2026-92990","title":"SendPress <= 1.26.1.20 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2137992-a2f9-4dcf-a880-12811a7c5f26?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.26.1.20","to_inclusive":true,"patched_in":""}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T14:24:41Z"},{"id":"wordfence:e214fadf-73fd-430f-8608-6630ce82b78c","source":"wordfence","cve":"CVE-2023-51482","title":"Eazy Plugin Manager <= 4.1.2 - Missing Authorization via update_options","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e214fadf-73fd-430f-8608-6630ce82b78c?source=api-prod","affected":[{"type":"plugin","slug":"plugins-on-steroids","name":"Eazy Plugin Manager","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2152db7-be9a-4e09-97cf-60445d87b576","source":"wordfence","cve":"CVE-2019-19981","title":"Email Subscribers & Newsletters <= 4.2.2 - Cross-Site Request Forgery on Settings","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2152db7-be9a-4e09-97cf-60445d87b576?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2159209-d220-4a80-bc67-430d37a16dea","source":"wordfence","cve":"CVE-2025-67546","title":"ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2159209-d220-4a80-bc67-430d37a16dea?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.16.6","to_inclusive":true,"patched_in":"1.16.7"}],"published":"2025-11-26T00:00:00Z","updated":"2025-12-20T20:27:50Z"},{"id":"wordfence:e21656a6-5442-4a1b-866e-eba442509896","source":"wordfence","cve":"CVE-2026-14858","title":"Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e21656a6-5442-4a1b-866e-eba442509896?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-21T14:25:50Z"},{"id":"wordfence:e218d5e8-cd48-46da-b63b-e33483a8798e","source":"wordfence","cve":"CVE-2025-39599","title":"Listdom <= 4.0.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e218d5e8-cd48-46da-b63b-e33483a8798e?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.1.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:53:07Z"},{"id":"wordfence:e21bd924-1d96-4371-972a-5c99d67261cc","source":"wordfence","cve":"CVE-2024-9989","title":"Crypto <= 2.18 - Authentication Bypass via log_in","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e21bd924-1d96-4371-972a-5c99d67261cc?source=api-prod","affected":[{"type":"plugin","slug":"crypto","name":"Crypto","from":"*","from_inclusive":true,"to":"2.18","to_inclusive":true,"patched_in":"2.19"}],"published":"2024-10-28T00:00:00Z","updated":"2025-09-22T06:42:06Z"},{"id":"wordfence:e21be94b-2a87-463f-b196-e4be466fb856","source":"wordfence","cve":"CVE-2025-69404","title":"Extreme Store <= 1.5.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e21be94b-2a87-463f-b196-e4be466fb856?source=api-prod","affected":[{"type":"theme","slug":"extremestore","name":"Extreme Store","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:29:15Z"},{"id":"wordfence:e2256157-e65f-46fb-b226-fa778ad3e69c","source":"wordfence","cve":"CVE-2026-46698","title":"Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2256157-e65f-46fb-b226-fa778ad3e69c?source=api-prod","affected":[{"type":"plugin","slug":"fediverse-embeds","name":"Fediverse Embeds","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:11:44Z"},{"id":"wordfence:e22567fa-456b-4537-a641-7f185ab6d2ba","source":"wordfence","cve":"CVE-2025-58209","title":"Transcoder <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e22567fa-456b-4537-a641-7f185ab6d2ba?source=api-prod","affected":[{"type":"plugin","slug":"transcoder","name":"Transcoder","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:16:17Z"},{"id":"wordfence:e2263cf4-8dd8-4cb2-9355-8e864225f5f0","source":"wordfence","cve":"CVE-2025-62986","title":"FanBridge signup <= 0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2263cf4-8dd8-4cb2-9355-8e864225f5f0?source=api-prod","affected":[{"type":"plugin","slug":"fanbridge-signup","name":"FanBridge signup","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-23T00:00:00Z","updated":"2025-10-29T14:36:56Z"},{"id":"wordfence:e226d75f-37b2-4af2-bba0-0fd3a96cc1a0","source":"wordfence","cve":"CVE-2023-40558","title":"Video Gallery & Management <= 3.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e226d75f-37b2-4af2-bba0-0fd3a96cc1a0?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2023-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2273c53-bc8a-45c7-914d-a3b934c2cb18","source":"wordfence","cve":"CVE-2024-0373","title":"Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2273c53-bc8a-45c7-914d-a3b934c2cb18?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T22:55:36Z"},{"id":"wordfence:e2283bd6-7d69-40b9-a1f3-56b9c71c8574","source":"wordfence","cve":"CVE-2019-9168","title":"WooCommerce <= 3.5.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2283bd6-7d69-40b9-a1f3-56b9c71c8574?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"3.5.5"}],"published":"2019-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e229ab5e-c9e3-4a7c-ac28-ba35b6abf85e","source":"wordfence","cve":"CVE-2021-24766","title":"404 to 301 <= 3.0.8 - Logs Deletion via Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e229ab5e-c9e3-4a7c-ac28-ba35b6abf85e?source=api-prod","affected":[{"type":"plugin","slug":"404-to-301","name":"404 to 301 \u2013 Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2318ae9-4115-442e-9293-a9251787c5f3","source":"wordfence","cve":"CVE-2021-4379","title":"WooCommerce Multi Currency <= 2.1.17 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2318ae9-4115-442e-9293-a9251787c5f3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multi-currency","name":"CURCY - WooCommerce Multi Currency - Currency Switcher","from":"*","from_inclusive":true,"to":"2.1.17","to_inclusive":true,"patched_in":"2.1.18"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e231c77b-01f8-408f-82ae-4efb6fcc4184","source":"wordfence","cve":"CVE-2026-59533","title":"Relevanssi Light <= 1.2.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e231c77b-01f8-408f-82ae-4efb6fcc4184?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-light","name":"Relevanssi Light","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-27T15:38:50Z"},{"id":"wordfence:e23335c9-0830-4c6b-8e0d-6897a7176ba5","source":"wordfence","cve":"CVE-2024-6666","title":"WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23335c9-0830-4c6b-8e0d-6897a7176ba5?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2024-07-10T00:00:00Z","updated":"2025-11-10T11:29:37Z"},{"id":"wordfence:e233f47f-734f-4190-ac5f-b63d54ebd4a8","source":"wordfence","cve":"CVE-2026-39671","title":"Extra Fees Plugin for WooCommerce <= 4.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e233f47f-734f-4190-ac5f-b63d54ebd4a8?source=api-prod","affected":[{"type":"plugin","slug":"woo-conditional-product-fees-for-checkout","name":"Extra Fees for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2026-02-19T00:00:00Z","updated":"2026-04-25T14:14:45Z"},{"id":"wordfence:e234a79d-5d46-44db-833c-51e202dc49bf","source":"wordfence","cve":"CVE-2026-8688","title":"Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e234a79d-5d46-44db-833c-51e202dc49bf?source=api-prod","affected":[{"type":"plugin","slug":"advance-nav-menu-manager","name":"Advance Nav Menu Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:38:27Z","updated":"2026-06-24T05:33:31Z"},{"id":"wordfence:e235dd5e-09b2-4fcd-af32-ff9bcf51954d","source":"wordfence","cve":"CVE-2025-64267","title":"WooCommerce Ultimate Points And Rewards <= 2.10.2 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e235dd5e-09b2-4fcd-af32-ff9bcf51954d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-ultimate-points-and-rewards","name":"WooCommerce Ultimate Points And Rewards","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2025-11-09T00:00:00Z","updated":"2025-11-17T19:07:09Z"},{"id":"wordfence:e236a01d-5561-45f6-927c-9e38f6d82eff","source":"wordfence","cve":"CVE-2025-31427","title":"Invico - WordPress Consulting Business Theme <= 1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e236a01d-5561-45f6-927c-9e38f6d82eff?source=api-prod","affected":[{"type":"theme","slug":"invico","name":"Invico - WordPress Consulting Business Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T19:25:04Z"},{"id":"wordfence:e23739b7-be36-441d-9b73-f51a0184a465","source":"wordfence","cve":"CVE-2025-22721","title":"ApplyOnline \u2013 Application Form Builder and Manager <= 2.6.7.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23739b7-be36-441d-9b73-f51a0184a465?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.6.7.1","to_inclusive":true,"patched_in":"2.6.7.2"}],"published":"2025-01-15T00:00:00Z","updated":"2025-01-21T16:07:34Z"},{"id":"wordfence:e2389b9c-c766-4cb7-83d6-b0ad7d2a075e","source":"wordfence","cve":"","title":"No Page Comment <= 1.1 - Cross-Site-Request Forgery to Settings Change","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2389b9c-c766-4cb7-83d6-b0ad7d2a075e?source=api-prod","affected":[{"type":"plugin","slug":"no-page-comment","name":"No Page Comment","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2022-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e23abd25-d41b-4ba8-a5b7-993f745d375a","source":"wordfence","cve":"CVE-2025-57929","title":"Double the Donation <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23abd25-d41b-4ba8-a5b7-993f745d375a?source=api-prod","affected":[{"type":"plugin","slug":"double-the-donation","name":"Double the Donation \u2013 A workplace giving tool","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:23:57Z"},{"id":"wordfence:e23bdcf9-8068-40c5-b27e-4562040068ca","source":"wordfence","cve":"CVE-2014-4584","title":"WP Easybooking <= 1.0.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23bdcf9-8068-40c5-b27e-4562040068ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-easybooking","name":"wp-easybooking","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2014-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e23dcadf-5858-4b8e-8b48-d3133c40cd89","source":"wordfence","cve":"CVE-2024-0881","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel  <= 2.2.74 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23dcadf-5858-4b8e-8b48-d3133c40cd89?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.74","to_inclusive":true,"patched_in":"2.2.76"}],"published":"2024-03-19T00:00:00Z","updated":"2024-05-07T21:18:47Z"},{"id":"wordfence:e23e52d7-871f-46fc-bd71-60a9f50a22e1","source":"wordfence","cve":"CVE-2024-4886","title":"Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23e52d7-871f-46fc-bd71-60a9f50a22e1?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-platform","name":"BuddyBoss Platform","from":"*","from_inclusive":true,"to":"2.5.91","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-05-15T00:00:00Z","updated":"2024-08-09T18:40:21Z"},{"id":"wordfence:e23e7d66-4b57-4feb-bf77-46238bc6ce7c","source":"wordfence","cve":"CVE-2024-3828","title":"Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23e7d66-4b57-4feb-bf77-46238bc6ce7c?source=api-prod","affected":[{"type":"plugin","slug":"spectra-pro","name":"Spectra Pro","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-05-09T18:13:16Z","updated":"2024-05-10T06:44:59Z"},{"id":"wordfence:e23f63a0-3061-42e0-a6be-05fa20a174ea","source":"wordfence","cve":"CVE-2025-1503","title":"WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e23f63a0-3061-42e0-a6be-05fa20a174ea?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2025-03-12T00:00:00Z","updated":"2025-03-13T04:21:06Z"},{"id":"wordfence:e2407d25-75da-4a04-8a39-04cb1711ae33","source":"wordfence","cve":"CVE-2017-1002023","title":"Easy Team Manager <= 1.3.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2407d25-75da-4a04-8a39-04cb1711ae33?source=api-prod","affected":[{"type":"plugin","slug":"easy-team-manager","name":"Easy Team Manager","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2017-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2422f54-244c-4e69-8174-ee462a861e98","source":"wordfence","cve":"","title":"Modular <= 2.4 - Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2422f54-244c-4e69-8174-ee462a861e98?source=api-prod","affected":[{"type":"theme","slug":"modular","name":"Modular","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2427678-30cb-42fe-b6a2-f8b74db0bacf","source":"wordfence","cve":"CVE-2026-39587","title":"WP BASE Booking of Appointments, Services and Events <= 5.9.0 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2427678-30cb-42fe-b6a2-f8b74db0bacf?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"5.9.0","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T18:51:01Z"},{"id":"wordfence:e24339c3-f8f8-4357-9717-a3077420603a","source":"wordfence","cve":"CVE-2016-10899","title":"Total Security <= 3.4.0 - Unauthenticated Settings Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e24339c3-f8f8-4357-9717-a3077420603a?source=api-prod","affected":[{"type":"plugin","slug":"total-security","name":"Total Security","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2016-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e247c919-6210-4769-9022-d7f7a0178f14","source":"wordfence","cve":"CVE-2013-7478","title":"Events Manager < 5.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e247c919-6210-4769-9022-d7f7a0178f14?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":false,"patched_in":"5.5"}],"published":"2013-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e249e50b-44fb-4e68-9efa-701f4ecdcdcf","source":"wordfence","cve":"CVE-2016-1000152","title":"Easy Contact Form Builder < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e249e50b-44fb-4e68-9efa-701f4ecdcdcf?source=api-prod","affected":[{"type":"plugin","slug":"tidio-form","name":"Easy Contact Form Builder","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2016-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e24a3d15-da9a-4b47-949d-f95201760087","source":"wordfence","cve":"CVE-2025-24685","title":"Morkva UA Shipping <= 1.0.18 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e24a3d15-da9a-4b47-949d-f95201760087?source=api-prod","affected":[{"type":"plugin","slug":"morkva-ua-shipping","name":"morkva UA Shipping \u2013 Nova Poshta, Ukrposhta, Rozetka, Nova Global","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:34:36Z"},{"id":"wordfence:e24a672b-0ba4-4061-971d-255a61aed60b","source":"wordfence","cve":"CVE-2026-18555","title":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e24a672b-0ba4-4061-971d-255a61aed60b?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.22","to_inclusive":true,"patched_in":"2.15.23"}],"published":"2026-09-15T15:29:12Z","updated":"2026-09-16T04:28:04Z"},{"id":"wordfence:e24c9e9a-4f18-41b6-a0b7-700fecb5d3e6","source":"wordfence","cve":"CVE-2023-49776","title":"Sayfa Saya\u00e7 <= 2.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e24c9e9a-4f18-41b6-a0b7-700fecb5d3e6?source=api-prod","affected":[{"type":"plugin","slug":"sayfa-sayac","name":"Sayfa Sayac","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e25015c9-d764-44b2-ad54-edf5d248e56c","source":"wordfence","cve":"CVE-2024-32781","title":"Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.0 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25015c9-d764-44b2-ad54-edf5d248e56c?source=api-prod","affected":[{"type":"plugin","slug":"email-customizer-for-woocommerce","name":"Email Customizer for WooCommerce | Drag and Drop Email Templates Builder","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:14:28Z"},{"id":"wordfence:e2510cee-d9d7-4b30-bf94-254a1dec9bd8","source":"wordfence","cve":"","title":"Awake <= 3.3 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2510cee-d9d7-4b30-bf94-254a1dec9bd8?source=api-prod","affected":[{"type":"theme","slug":"awake","name":"Awake","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e25157d3-42ac-4dd6-a736-5623a16e5629","source":"wordfence","cve":"CVE-2025-3858","title":"Formality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25157d3-42ac-4dd6-a736-5623a16e5629?source=api-prod","affected":[{"type":"plugin","slug":"formality","name":"Formality","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2025-05-01T14:47:09Z","updated":"2025-05-02T03:21:21Z"},{"id":"wordfence:e2521876-cd1c-4c4a-8486-b1c4da78ffdb","source":"wordfence","cve":"CVE-2025-47550","title":"Instantio <= 3.3.16 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2521876-cd1c-4c4a-8486-b1c4da78ffdb?source=api-prod","affected":[{"type":"plugin","slug":"instantio","name":"Instantio \u2014 Side Cart & One-Page Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.16","to_inclusive":true,"patched_in":"3.3.17"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T19:30:30Z"},{"id":"wordfence:e252f833-3b0c-44df-969d-aff9314133b7","source":"wordfence","cve":"","title":"So Audible Cloud Music Player <= 0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e252f833-3b0c-44df-969d-aff9314133b7?source=api-prod","affected":[{"type":"plugin","slug":"so-audible","name":"So Audible Cloud Music Player","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e254f0ba-9008-44e9-bf8f-31c9614d6f64","source":"wordfence","cve":"CVE-2024-11752","title":"Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e254f0ba-9008-44e9-bf8f-31c9614d6f64?source=api-prod","affected":[{"type":"plugin","slug":"eveeno","name":"Eveeno","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:16Z"},{"id":"wordfence:e2579e45-0cdc-42d8-b6c1-f43b97a0781f","source":"wordfence","cve":"CVE-2025-52736","title":"Finale Lite <= 2.20.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2579e45-0cdc-42d8-b6c1-f43b97a0781f?source=api-prod","affected":[{"type":"plugin","slug":"finale-woocommerce-sales-countdown-timer-discount","name":"Finale Lite \u2013 Sales Countdown Timer & Discount for WooCommerce","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-28T00:00:00Z","updated":"2025-12-12T22:22:52Z"},{"id":"wordfence:e25ca990-eee1-4f72-b543-7a65bc4855a8","source":"wordfence","cve":"CVE-2024-13376","title":"Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25ca990-eee1-4f72-b543-7a65bc4855a8?source=api-prod","affected":[{"type":"theme","slug":"industrial","name":"Industrial","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T05:24:04Z"},{"id":"wordfence:e25ef117-72c4-4696-9248-5caa937b47e9","source":"wordfence","cve":"CVE-2026-11603","title":"Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25ef117-72c4-4696-9248-5caa937b47e9?source=api-prod","affected":[{"type":"plugin","slug":"product-filter-widget-for-elementor","name":"Product Filter Widget for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:13:18Z","updated":"2026-06-09T03:41:24Z"},{"id":"wordfence:e25f524e-360d-4c80-a0ab-90ee94825b1b","source":"wordfence","cve":"","title":"WP-Polls <= 2.70 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25f524e-360d-4c80-a0ab-90ee94825b1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-polls","name":"WP-Polls","from":"*","from_inclusive":true,"to":"2.70","to_inclusive":true,"patched_in":"2.71"}],"published":"2015-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e25fd68a-a4aa-4539-ba1a-de1d7b28c7ff","source":"wordfence","cve":"CVE-2026-65487","title":"Photography <= 7.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e25fd68a-a4aa-4539-ba1a-de1d7b28c7ff?source=api-prod","affected":[{"type":"theme","slug":"photography","name":"photography","from":"*","from_inclusive":true,"to":"7.7.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:31:05Z"},{"id":"wordfence:e2619d50-e295-4e13-91d4-f998b8aa5be4","source":"wordfence","cve":"CVE-2024-10786","title":"Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2619d50-e295-4e13-91d4-f998b8aa5be4?source=api-prod","affected":[{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.7.11","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-16T02:02:34Z"},{"id":"wordfence:e262ec15-420a-4f52-90e0-e4a2e28402a1","source":"wordfence","cve":"CVE-2026-1278","title":"Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e262ec15-420a-4f52-90e0-e4a2e28402a1?source=api-prod","affected":[{"type":"plugin","slug":"mandatory-fields","name":"Mandatory Field","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:20:13Z","updated":"2026-03-21T03:27:11Z"},{"id":"wordfence:e264af7c-84bb-4bfa-a433-39dd94a9d83b","source":"wordfence","cve":"CVE-2021-24203","title":"Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e264af7c-84bb-4bfa-a433-39dd94a9d83b?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"0.1.0","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2021-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e267c589-6b2a-40b3-beeb-0e397d9076e7","source":"wordfence","cve":"CVE-2025-30814","title":"The Post Grid <= 7.7.17 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e267c589-6b2a-40b3-beeb-0e397d9076e7?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.17","to_inclusive":true,"patched_in":"7.7.18"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:41:23Z"},{"id":"wordfence:e268bf8d-066c-410c-85ef-135591a2922b","source":"wordfence","cve":"CVE-2025-24688","title":"WP Mailster <= 1.8.20.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e268bf8d-066c-410c-85ef-135591a2922b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.20.0","to_inclusive":true,"patched_in":"1.8.21.0"}],"published":"2025-01-28T00:00:00Z","updated":"2025-02-20T16:20:28Z"},{"id":"wordfence:e26a1c7c-8c4d-450d-bbfa-6ab1af4bceba","source":"wordfence","cve":"CVE-2016-10995","title":"Tevolution  < 2.3.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26a1c7c-8c4d-450d-bbfa-6ab1af4bceba?source=api-prod","affected":[{"type":"plugin","slug":"Tevolution","name":"Tevolution","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":false,"patched_in":"2.3.0"}],"published":"2016-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e26a438d-7e2d-47de-81f2-39731ce51bd6","source":"wordfence","cve":"CVE-2021-24431","title":"Language Bar Flags <= 1.0.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26a438d-7e2d-47de-81f2-39731ce51bd6?source=api-prod","affected":[{"type":"plugin","slug":"language-bar-flags","name":"Language Bar Flags","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e26b7e73-2d04-493a-a7d9-2276bc0e1ba8","source":"wordfence","cve":"CVE-2022-1472","title":"Better Find and Replace <= 1.3.5 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26b7e73-2d04-493a-a7d9-2276bc0e1ba8?source=api-prod","affected":[{"type":"plugin","slug":"real-time-auto-find-and-replace","name":"Better Find and Replace \u2013 AI-Powered Suggestions","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e26ccd06-22e0-4d91-a53a-df6ead8a8e3b","source":"wordfence","cve":"CVE-2023-2404","title":"CRM and Lead Management by vcita <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26ccd06-22e0-4d91-a53a-df6ead8a8e3b?source=api-prod","affected":[{"type":"plugin","slug":"crm-customer-relationship-management-by-vcita","name":"CRM and Lead Management by vcita","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e26d4914-23fd-4e93-a08a-7e9dd5222a73","source":"wordfence","cve":"CVE-2023-45658","title":"Nexter <= 2.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26d4914-23fd-4e93-a08a-7e9dd5222a73?source=api-prod","affected":[{"type":"theme","slug":"nexter","name":"Nexter","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e26d5534-dab1-4562-b770-aae2468505ac","source":"wordfence","cve":"CVE-2026-120537","title":"TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26d5534-dab1-4562-b770-aae2468505ac?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2026-11-06T18:18:09Z","updated":"2026-11-07T06:39:42Z"},{"id":"wordfence:e26dd66f-e0fe-47c7-a45c-fb06b5bcc612","source":"wordfence","cve":"CVE-2025-30915","title":"Small Package Quotes \u2013 Worldwide Express Edition <= 5.2.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e26dd66f-e0fe-47c7-a45c-fb06b5bcc612?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-wwe-edition","name":"Small Package Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.19","to_inclusive":true,"patched_in":"5.2.20"}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T15:22:59Z"},{"id":"wordfence:e2719afc-e52c-4fcc-b030-2f6aaddb5ab9","source":"wordfence","cve":"CVE-2023-5385","title":"Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2719afc-e52c-4fcc-b030-2f6aaddb5ab9?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e271effa-2c40-4635-ad6b-ca82b4742567","source":"wordfence","cve":"CVE-2021-24651","title":"Poll Maker < 3.4.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e271effa-2c40-4635-ad6b-ca82b4742567?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e27217de-be6d-4d00-9192-48cb81c8dccf","source":"wordfence","cve":"CVE-2026-22446","title":"Prowess - Fitness and Gym WordPress Theme <= 1.8.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27217de-be6d-4d00-9192-48cb81c8dccf?source=api-prod","affected":[{"type":"theme","slug":"prowess","name":"Prowess - Fitness and Gym WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-05T14:21:36Z"},{"id":"wordfence:e27224aa-56c4-49ab-b9b3-b431b38e126e","source":"wordfence","cve":"CVE-2024-10614","title":"Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27224aa-56c4-49ab-b9b3-b431b38e126e?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.61.0","to_inclusive":true,"patched_in":"5.62.0"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-16T05:39:34Z"},{"id":"wordfence:e275278f-6cde-43ef-b7c2-b6b7ab8b8e51","source":"wordfence","cve":"CVE-2026-97271","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e275278f-6cde-43ef-b7c2-b6b7ab8b8e51?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2026-09-30T11:23:32Z","updated":"2026-10-09T00:14:38Z"},{"id":"wordfence:e27634f8-493b-4edb-a0c7-1bc8890b70f0","source":"wordfence","cve":"","title":"Parcel Tracker eCourier <= 1.0.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27634f8-493b-4edb-a0c7-1bc8890b70f0?source=api-prod","affected":[{"type":"plugin","slug":"parcel-tracker-ecourier","name":"Parcel Tracker eCourier","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2021-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e276cc49-2da1-4e2f-bb64-28ffe6ec9acf","source":"wordfence","cve":"CVE-2023-52198","title":"Private Google Calendars <= 20231125 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e276cc49-2da1-4e2f-bb64-28ffe6ec9acf?source=api-prod","affected":[{"type":"plugin","slug":"private-google-calendars","name":"Private Google Calendars","from":"*","from_inclusive":true,"to":"20231125","to_inclusive":true,"patched_in":"20240106"}],"published":"2024-01-03T00:00:00Z","updated":"2024-11-07T15:06:34Z"},{"id":"wordfence:e27825b9-c3ef-4740-bd19-7198c806c70b","source":"wordfence","cve":"","title":"intimate Payments Plugin <= 1.3.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27825b9-c3ef-4740-bd19-7198c806c70b?source=api-prod","affected":[{"type":"plugin","slug":"intimate-io-cryptocurrency-payments","name":"intimate Payments Plugin","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e278df67-e4d3-416c-ac7d-6e43442dde17","source":"wordfence","cve":"CVE-2021-44779","title":"[GWA] AutoResponder <= 2.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e278df67-e4d3-416c-ac7d-6e43442dde17?source=api-prod","affected":[{"type":"plugin","slug":"autoresponder-gwa","name":"[GWA] AutoResponder","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2022-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2793547-5edf-4d2a-bc3b-fcaeed62963d","source":"wordfence","cve":"CVE-2024-4670","title":"All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2793547-5edf-4d2a-bc3b-fcaeed62963d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-15T12:46:20Z"},{"id":"wordfence:e2795202-64e6-488b-a0e1-da2923f6f791","source":"wordfence","cve":"CVE-2023-7197","title":"Marketing Twitter Bot <= 1.11 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2795202-64e6-488b-a0e1-da2923f6f791?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-twitterbot","name":"Marketing Twitter Bot","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:47:07Z"},{"id":"wordfence:e27971a3-f84c-4f13-81af-127e7560566a","source":"wordfence","cve":"CVE-2024-12922","title":"Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27971a3-f84c-4f13-81af-127e7560566a?source=api-prod","affected":[{"type":"theme","slug":"altair","name":"Altair","from":"*","from_inclusive":true,"to":"5.2.4","to_inclusive":true,"patched_in":"5.2.5"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-19T05:22:52Z"},{"id":"wordfence:e279f923-e30d-45b6-9734-2bd50731c33c","source":"wordfence","cve":"CVE-2024-35751","title":"Woody code snippets \u2013 Insert Header Footer Code, AdSense Ads <= 2.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e279f923-e30d-45b6-9734-2bd50731c33c?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-06-06T00:00:00Z","updated":"2025-09-25T18:27:22Z"},{"id":"wordfence:e27afce1-4108-47fd-9f96-ea7743df771b","source":"wordfence","cve":"CVE-2026-27058","title":"Penci Podcast <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27afce1-4108-47fd-9f96-ea7743df771b?source=api-prod","affected":[{"type":"plugin","slug":"penci-podcast","name":"Penci Podcast","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-11T00:00:00Z","updated":"2026-02-26T19:58:06Z"},{"id":"wordfence:e27bd526-1a5f-4628-8bb2-1741496f897f","source":"wordfence","cve":"CVE-2024-11085","title":"WP Log Viewer <= 1.2.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27bd526-1a5f-4628-8bb2-1741496f897f?source=api-prod","affected":[{"type":"plugin","slug":"wp-log-viewer","name":"WP Log Viewer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-15T14:58:56Z","updated":"2024-11-16T03:20:52Z"},{"id":"wordfence:e27c1d20-cef7-4801-beb9-adaeb1b95145","source":"wordfence","cve":"CVE-2017-1002008","title":"Membership Simplified <= 1.58 - Arbitrary File Download","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e27c1d20-cef7-4801-beb9-adaeb1b95145?source=api-prod","affected":[{"type":"plugin","slug":"membership-simplified-for-oap-members-only","name":"Membership Simplified","from":"*","from_inclusive":true,"to":"1.58","to_inclusive":true,"patched_in":""}],"published":"2017-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2837399-c44f-494e-bdc6-f9c6e4e2dc11","source":"wordfence","cve":"CVE-2025-13313","title":"CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2837399-c44f-494e-bdc6-f9c6e4e2dc11?source=api-prod","affected":[{"type":"plugin","slug":"crm-memberships","name":"CRM Memberships","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2025-12-04T16:27:00Z","updated":"2026-02-24T18:53:23Z"},{"id":"wordfence:e2857fd0-2401-4e38-aa8a-3f0a89e14b78","source":"wordfence","cve":"CVE-2026-15072","title":"KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2857fd0-2401-4e38-aa8a-3f0a89e14b78?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.1"}],"published":"2026-07-10T14:03:45Z","updated":"2026-07-11T02:31:19Z"},{"id":"wordfence:e285849f-886e-49ba-bb43-8c67655fe239","source":"wordfence","cve":"CVE-2025-2685","title":"TablePress \u2013 Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e285849f-886e-49ba-bb43-8c67655fe239?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.1"}],"published":"2025-03-26T00:00:00Z","updated":"2025-03-27T05:22:32Z"},{"id":"wordfence:e285eb46-031a-4be9-85c8-a904e076d46e","source":"wordfence","cve":"CVE-2026-92421","title":"Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e285eb46-031a-4be9-85c8-a904e076d46e?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T20:27:32Z"},{"id":"wordfence:e2876c97-a612-4c0f-b094-3233768703b1","source":"wordfence","cve":"CVE-2021-38324","title":"SP Rental Manager <= 1.5.3 - Unauthenticated SQL Injection","severity":"high","cvss":8.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2876c97-a612-4c0f-b094-3233768703b1?source=api-prod","affected":[{"type":"plugin","slug":"sp-rental-manager","name":"SP Rental Manager","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e287e85d-8687-4079-99ea-92718031f343","source":"wordfence","cve":"CVE-2021-3133","title":"Elementor Contact Form DB <= 1.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e287e85d-8687-4079-99ea-92718031f343?source=api-prod","affected":[{"type":"plugin","slug":"sb-elementor-contact-form-db","name":"FormsDB \u2013 Save Elementor Forms to Google Sheets & Post Type","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2021-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e287fa29-07a7-4fbd-9bf2-c3eee8514a20","source":"wordfence","cve":"CVE-2025-22776","title":"WP Bulletin Board <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e287fa29-07a7-4fbd-9bf2-c3eee8514a20?source=api-prod","affected":[{"type":"plugin","slug":"wp-bulletin-board","name":"WP Bulletin Board","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:41:15Z"},{"id":"wordfence:e2886f2e-9cf1-4cb4-a0df-197cf65800dd","source":"wordfence","cve":"CVE-2026-42741","title":"Ninja Forms Views \u2013 Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2886f2e-9cf1-4cb4-a0df-197cf65800dd?source=api-prod","affected":[{"type":"plugin","slug":"views-for-ninja-forms","name":"Ninja Forms Views \u2013 Display & Edit Ninja Forms Submissions on your site frontend","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:07:28Z"},{"id":"wordfence:e288b26f-de4e-4486-b86d-f4d8c881ae75","source":"wordfence","cve":"CVE-2024-13357","title":"Ditty <= 3.1.51 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e288b26f-de4e-4486-b86d-f4d8c881ae75?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.51","to_inclusive":true,"patched_in":"3.1.52"}],"published":"2025-03-06T00:00:00Z","updated":"2025-05-09T17:52:07Z"},{"id":"wordfence:e289988c-8bc1-4b2a-87a2-c94758d10e88","source":"wordfence","cve":"CVE-2025-9947","title":"Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e289988c-8bc1-4b2a-87a2-c94758d10e88?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":true,"patched_in":"3.12.1"}],"published":"2025-10-10T20:38:59Z","updated":"2026-10-07T11:41:48Z"},{"id":"wordfence:e28a54a0-74c7-4d39-a846-65bf98d055ab","source":"wordfence","cve":"CVE-2025-28859","title":"Maintenance Notice <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28a54a0-74c7-4d39-a846-65bf98d055ab?source=api-prod","affected":[{"type":"plugin","slug":"maintenance-notice","name":"Maintenance Notice","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-25T19:15:17Z"},{"id":"wordfence:e28ae1a3-abc6-484c-abc7-1e0b958fa30b","source":"wordfence","cve":"CVE-2026-14526","title":"AI Copilot \u2013 Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28ae1a3-abc6-484c-abc7-1e0b958fa30b?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-08-07T18:30:06Z","updated":"2026-08-17T16:58:34Z"},{"id":"wordfence:e28b78c3-c370-4076-836e-9f61acba064c","source":"wordfence","cve":"CVE-2024-1458","title":"Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28b78c3-c370-4076-836e-9f61acba064c?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.6"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:28Z"},{"id":"wordfence:e28c945f-09a2-45de-83af-33bc98e332ed","source":"wordfence","cve":"CVE-2026-115255","title":"WP Roster < 2.35 - Missing Authorization to Unauthenticated Roster Member Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28c945f-09a2-45de-83af-33bc98e332ed?source=api-prod","affected":[{"type":"plugin","slug":"wp-roster","name":"WP Roster","from":"*","from_inclusive":true,"to":"2.35","to_inclusive":false,"patched_in":"2.35"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:24:33Z"},{"id":"wordfence:e28caf56-b0b0-49dc-8489-ad5d4d8d7cfd","source":"wordfence","cve":"CVE-2024-5473","title":"Simple Photoswipe <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28caf56-b0b0-49dc-8489-ad5d4d8d7cfd?source=api-prod","affected":[{"type":"plugin","slug":"simple-photoswipe","name":"Simple Photoswipe","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T00:00:00Z","updated":"2024-07-01T19:35:07Z"},{"id":"wordfence:e28f0ff6-eee3-45bb-be7e-91e2349a91d5","source":"wordfence","cve":"CVE-2021-36887","title":"tarteaucitron.js \u2013 Cookies legislation & GDPR <= 1.5.4 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e28f0ff6-eee3-45bb-be7e-91e2349a91d5?source=api-prod","affected":[{"type":"plugin","slug":"tarteaucitronjs","name":"tarteaucitron.io \u2013 Cookie Banner & GDPR Consent Management","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.6"}],"published":"2021-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e290e142-bd18-4441-b3d0-1a84e1faeaf7","source":"wordfence","cve":"CVE-2025-5093","title":"Responsive Lightbox & Gallery <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e290e142-bd18-4441-b3d0-1a84e1faeaf7?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2025-06-06T00:00:00Z","updated":"2025-07-09T15:16:51Z"},{"id":"wordfence:e290f1aa-d20a-4e76-b77b-3e5b79e9d379","source":"wordfence","cve":"CVE-2025-3814","title":"Tax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e290f1aa-d20a-4e76-b77b-3e5b79e9d379?source=api-prod","affected":[{"type":"plugin","slug":"tax-switch-for-woocommerce","name":"Tax Switch for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-04-21T16:53:17Z","updated":"2025-04-22T05:27:26Z"},{"id":"wordfence:e292e704-4b98-4e95-ac25-29cedcf005c7","source":"wordfence","cve":"CVE-2007-4165","title":"Blue Memories <= 1.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e292e704-4b98-4e95-ac25-29cedcf005c7?source=api-prod","affected":[{"type":"theme","slug":"blue-memories","name":"Blue Memories","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.0.1"}],"published":"2007-08-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e29352df-6fd6-4560-aa46-848de0ef8653","source":"wordfence","cve":"CVE-2025-23805","title":"SEOReseller Partner <= 1.3.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e29352df-6fd6-4560-aa46-848de0ef8653?source=api-prod","affected":[{"type":"plugin","slug":"sr-partner","name":"SEOReseller Partner Plugin","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:42:21Z"},{"id":"wordfence:e2945971-80c6-44a2-bc65-1243af365692","source":"wordfence","cve":"CVE-2023-25707","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in save_admin_widgets function","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2945971-80c6-44a2-bc65-1243af365692?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.12","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2960224-4446-4fc6-8d18-6f9911b4cbad","source":"wordfence","cve":"CVE-2025-12499","title":"Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2960224-4446-4fc6-8d18-6f9911b4cbad?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2025-12-05T18:52:16Z","updated":"2025-12-06T07:29:12Z"},{"id":"wordfence:e298663b-746c-40fc-a2ca-cb35d472baab","source":"wordfence","cve":"","title":"Amazon Auto Links <= 4.6.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e298663b-746c-40fc-a2ca-cb35d472baab?source=api-prod","affected":[{"type":"plugin","slug":"amazon-auto-links","name":"Auto Amazon Links \u2013 Amazon Associates Affiliate Plugin","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2994731-310b-4e76-9baf-7d7dff231dcc","source":"wordfence","cve":"CVE-2026-104068","title":"JetBackup \u2013 Backup, Restore & Migrate <= 3.1.24.9 - Authenticated (Admin+) Arbitrary File Write","severity":"medium","cvss":4.7,"cwe":"CWE-59","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2994731-310b-4e76-9baf-7d7dff231dcc?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"3.1.24.9","to_inclusive":true,"patched_in":"3.1.24.10"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T15:28:33Z"},{"id":"wordfence:e29dac44-5c85-4f73-ae96-4bc0deca64f4","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'bulkDelete' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e29dac44-5c85-4f73-ae96-4bc0deca64f4?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e29ea7dd-14b8-45d3-a87e-3f58de88af4c","source":"wordfence","cve":"CVE-2025-5116","title":"WP Plugin Info Card <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e29ea7dd-14b8-45d3-a87e-3f58de88af4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-plugin-info-card","name":"WP Plugin Info Card \u2013 Showcase Beautiful Plugin Cards, Theme Cards, and GitHub Repos Anywhere","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2025-06-02T19:43:12Z","updated":"2025-06-03T08:21:56Z"},{"id":"wordfence:e29f5f0f-f9d8-40d5-b072-e56e85b71c42","source":"wordfence","cve":"CVE-2026-27062","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e29f5f0f-f9d8-40d5-b072-e56e85b71c42?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.5","to_inclusive":true,"patched_in":"3.13.6"}],"published":"2026-10-29T14:38:00Z","updated":"2026-11-03T19:53:20Z"},{"id":"wordfence:e2a22349-caa7-4756-ad2f-1861ccff6c30","source":"wordfence","cve":"CVE-2026-92727","title":"EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a22349-caa7-4756-ad2f-1861ccff6c30?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.7"}],"published":"2026-10-02T14:26:32Z","updated":"2026-10-03T03:25:47Z"},{"id":"wordfence:e2a663f2-212f-4c17-a192-ee8982899fa7","source":"wordfence","cve":"CVE-2025-66105","title":"Bus Ticket Booking with Seat Reservation < 5.6.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a663f2-212f-4c17-a192-ee8982899fa7?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":false,"patched_in":"5.6.8"}],"published":"2026-05-07T00:00:00Z","updated":"2026-05-11T20:13:52Z"},{"id":"wordfence:e2a6d017-93e4-40c6-a7d1-07e00faecf36","source":"wordfence","cve":"CVE-2024-10177","title":"Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a6d017-93e4-40c6-a7d1-07e00faecf36?source=api-prod","affected":[{"type":"plugin","slug":"beds24-online-booking","name":"Beds24 Online Booking","from":"*","from_inclusive":true,"to":"2.0.27","to_inclusive":true,"patched_in":"2.0.28"}],"published":"2024-11-20T13:55:47Z","updated":"2024-11-27T13:44:18Z"},{"id":"wordfence:e2aad18b-14e4-49bd-b212-d9cbd0f57999","source":"wordfence","cve":"CVE-2026-109692","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2aad18b-14e4-49bd-b212-d9cbd0f57999?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T11:09:12Z","updated":"2026-10-23T18:26:23Z"},{"id":"wordfence:e2ad0072-8afd-4937-a7f3-2f9354312a66","source":"wordfence","cve":"CVE-2026-81652","title":"NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ad0072-8afd-4937-a7f3-2f9354312a66?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T18:51:57Z"},{"id":"wordfence:e2ae44ea-cb6e-42c2-bdc7-4dcd5cce3c39","source":"wordfence","cve":"CVE-2026-84741","title":"The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ae44ea-cb6e-42c2-bdc7-4dcd5cce3c39?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"4.5","from_inclusive":true,"to":"6.17.4.1","to_inclusive":true,"patched_in":"6.17.5"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:51:12Z"},{"id":"wordfence:e2b020c3-0eb9-4ff1-b94e-e32452695b5d","source":"wordfence","cve":"CVE-2023-28748","title":"Copy Or Move Comments <= 5.0.4 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b020c3-0eb9-4ff1-b94e-e32452695b5d?source=api-prod","affected":[{"type":"plugin","slug":"copy-or-move-comments","name":"Copy or Move Comments","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2b10c7e-07ce-4edf-8757-b0da6dcfd43e","source":"wordfence","cve":"CVE-2025-53984","title":"JetTabs <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b10c7e-07ce-4edf-8757-b0da6dcfd43e?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.9.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:56:14Z"},{"id":"wordfence:e2b16b9c-48c7-4370-839b-696797ff2101","source":"wordfence","cve":"CVE-2024-7301","title":"WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b16b9c-48c7-4370-839b-696797ff2101?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.24.8","to_inclusive":true,"patched_in":"4.24.9"}],"published":"2024-08-15T16:20:06Z","updated":"2024-08-16T04:29:28Z"},{"id":"wordfence:e2b24858-dfcd-46f3-9552-c7acc63a1ee7","source":"wordfence","cve":"CVE-2025-6758","title":"Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b24858-dfcd-46f3-9552-c7acc63a1ee7?source=api-prod","affected":[{"type":"theme","slug":"real-spaces","name":"Real Spaces - WordPress Properties Directory Theme","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-19T06:45:27Z"},{"id":"wordfence:e2b2a90f-7a0a-4150-8a24-14b2ed11663e","source":"wordfence","cve":"CVE-2023-49829","title":"Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b2a90f-7a0a-4150-8a24-14b2ed11663e?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2b4586a-f87d-4a51-8f4e-932d7254518e","source":"wordfence","cve":"CVE-2026-6820","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b4586a-f87d-4a51-8f4e-932d7254518e?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":true,"patched_in":"1.8.9"}],"published":"2026-07-07T23:40:43Z","updated":"2026-07-08T12:33:17Z"},{"id":"wordfence:e2b9b6f4-6ee7-498d-9693-a5ae5f7f4719","source":"wordfence","cve":"CVE-2023-31233","title":"Baidu Tongji generator <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b9b6f4-6ee7-498d-9693-a5ae5f7f4719?source=api-prod","affected":[{"type":"plugin","slug":"baidu-tongji-generator","name":"Baidu Tongji generator","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2b9d1dc-0f8d-4f61-b870-3266b241e4e1","source":"wordfence","cve":"CVE-2025-26774","title":"Responsive Modal Builder for High Conversion \u2013 Easy Popups <= 1.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b9d1dc-0f8d-4f61-b870-3266b241e4e1?source=api-prod","affected":[{"type":"plugin","slug":"easy-popups","name":"Easy Popups \u2013 Simple Popup Builder for Lead Capture & Announcements","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T22:32:53Z"},{"id":"wordfence:e2bb7e1b-0958-47fa-8929-a93ba28d105e","source":"wordfence","cve":"CVE-2025-69097","title":"WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2bb7e1b-0958-47fa-8929-a93ba28d105e?source=api-prod","affected":[{"type":"plugin","slug":"wplms_plugin","name":"WPLMS Plugin","from":"*","from_inclusive":true,"to":"1.9.9.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T20:44:29Z"},{"id":"wordfence:e2bd8eec-5984-42f8-ba9a-ce61bf7cd440","source":"wordfence","cve":"CVE-2023-24384","title":"Organization chart <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2bd8eec-5984-42f8-ba9a-ce61bf7cd440?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2c00795-c49b-4b0a-8f0a-4ed18c966c6b","source":"wordfence","cve":"CVE-2026-97670","title":"Avada (Fusion) Builder <= 3.16.1 -  Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field","severity":"critical","cvss":9.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c00795-c49b-4b0a-8f0a-4ed18c966c6b?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2026-10-09T15:52:16Z","updated":"2026-10-11T13:38:02Z"},{"id":"wordfence:e2c11005-dcb3-40b3-863a-0612132acb08","source":"wordfence","cve":"","title":"Slimstat Analytics < 3.9.6 - Unauthenticated Blind SQL Injection","severity":"high","cvss":8.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c11005-dcb3-40b3-863a-0612132acb08?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":false,"patched_in":"3.9.6"}],"published":"2015-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2c1606e-b6b6-4f7d-8473-1015677ded7c","source":"wordfence","cve":"CVE-2022-47177","title":"WP EasyPay <= 4.0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c1606e-b6b6-4f7d-8473-1015677ded7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1"}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2c5b606-5852-48b5-8423-d428b390d0ef","source":"wordfence","cve":"CVE-2026-22366","title":"Jude <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c5b606-5852-48b5-8423-d428b390d0ef?source=api-prod","affected":[{"type":"theme","slug":"jude","name":"Jude | Nail Bar & Beauty Salon WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:31:20Z"},{"id":"wordfence:e2c837b9-c205-4fdc-8305-b9387dedd581","source":"wordfence","cve":"CVE-2024-2439","title":"Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c837b9-c205-4fdc-8305-b9387dedd581?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.6.5","to_inclusive":true,"patched_in":"9.6.6"}],"published":"2024-04-05T00:00:00Z","updated":"2024-05-01T13:55:00Z"},{"id":"wordfence:e2c8838c-d29a-4df8-85b3-6e440ba7f962","source":"wordfence","cve":"CVE-2025-11705","title":"Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c8838c-d29a-4df8-85b3-6e440ba7f962?source=api-prod","affected":[{"type":"plugin","slug":"gotmls","name":"Anti-Malware Security and Brute-Force Firewall","from":"*","from_inclusive":true,"to":"4.23.81","to_inclusive":true,"patched_in":"4.23.83"}],"published":"2025-10-28T15:41:58Z","updated":"2025-10-29T20:36:56Z"},{"id":"wordfence:e2c9f6a5-8698-4452-bf0a-c1d796b2fdad","source":"wordfence","cve":"CVE-2024-9940","title":"Calculated Fields Form <= 5.2.45 - HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-75","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c9f6a5-8698-4452-bf0a-c1d796b2fdad?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.2.45","to_inclusive":true,"patched_in":"5.2.46"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T02:06:05Z"},{"id":"wordfence:e2ca42f3-776f-4ba4-a409-863799338c85","source":"wordfence","cve":"CVE-2025-24648","title":"Admin and Site Enhancements (ASE) <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ca42f3-776f-4ba4-a409-863799338c85?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.6.2.1","to_inclusive":true,"patched_in":"7.6.3"}],"published":"2026-01-20T00:00:00Z","updated":"2026-05-04T14:36:56Z"},{"id":"wordfence:e2cb1717-f78a-414f-9d42-2870af5aa811","source":"wordfence","cve":"CVE-2026-103352","title":"WP BASE Booking of Appointments, Services and Events <= 6.4.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cb1717-f78a-414f-9d42-2870af5aa811?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2026-10-03T17:46:17Z","updated":"2026-10-08T23:05:08Z"},{"id":"wordfence:e2cbb4b5-cf6e-4cd1-ba36-0fe746b68514","source":"wordfence","cve":"CVE-2026-61948","title":"Premium Packages \u2013 Sell Digital Products Securely <= 6.2.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cbb4b5-cf6e-4cd1-ba36-0fe746b68514?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"7.0.0"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:02:34Z"},{"id":"wordfence:e2cc2776-9496-42b5-a242-c572ae5462fb","source":"wordfence","cve":"CVE-2024-1038","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cc2776-9496-42b5-a242-c572ae5462fb?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.7.4.2","to_inclusive":true,"patched_in":"2.7.4.3"}],"published":"2024-02-20T00:00:00Z","updated":"2024-07-31T15:38:53Z"},{"id":"wordfence:e2cd7c07-e119-4064-a7a9-08c81409f90a","source":"wordfence","cve":"CVE-2026-103899","title":"EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2cd7c07-e119-4064-a7a9-08c81409f90a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-eu-vat-assistant","name":"EU VAT Assistant for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.30.260413","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-16T14:38:25Z","updated":"2026-10-17T03:43:32Z"},{"id":"wordfence:e2ce98c3-b0a5-4b6b-ac3c-26e0a3195944","source":"wordfence","cve":"","title":"Contact Us Page \u2013 Contact People <= 3.6.1 - Cross-Site Request Forgery to Settings Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ce98c3-b0a5-4b6b-ac3c-26e0a3195944?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-page-contact-people","name":"Contact Us Page \u2013 Contact People","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2ce9caf-2ca2-401c-acc7-76be2fd72f36","source":"wordfence","cve":"CVE-2026-3098","title":"Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ce9caf-2ca2-401c-acc7-76be2fd72f36?source=api-prod","affected":[{"type":"plugin","slug":"smart-slider-3","name":"Smart Slider 3","from":"*","from_inclusive":true,"to":"3.5.1.33","to_inclusive":true,"patched_in":"3.5.1.34"}],"published":"2026-03-26T15:32:42Z","updated":"2026-04-06T15:53:48Z"},{"id":"wordfence:e2d2566e-841a-49e6-86b5-33e2a7da4361","source":"wordfence","cve":"CVE-2025-32185","title":"Colibri Page Builder <= 1.0.319 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2d2566e-841a-49e6-86b5-33e2a7da4361?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.319","to_inclusive":true,"patched_in":"1.0.332"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-17T13:13:44Z"},{"id":"wordfence:e2d29afd-06e8-461a-918f-38228441a51a","source":"wordfence","cve":"CVE-2023-47784","title":"Slider Revolution <= 6.6.15 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2d29afd-06e8-461a-918f-38228441a51a?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.15","to_inclusive":true,"patched_in":"6.6.16"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2d35599-2402-4837-97a3-707cd33d439a","source":"wordfence","cve":"CVE-2024-53743","title":"Countdown Timer for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2d35599-2402-4837-97a3-707cd33d439a?source=api-prod","affected":[{"type":"plugin","slug":"countdown-timer-for-elementor","name":"Countdown Timer for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-11-28T00:00:00Z","updated":"2025-03-03T20:59:54Z"},{"id":"wordfence:e2d46ac3-6751-475d-8d91-eabbc27a6295","source":"wordfence","cve":"CVE-2014-5034","title":"Brute Force Login Protection <= 1.5.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2d46ac3-6751-475d-8d91-eabbc27a6295?source=api-prod","affected":[{"type":"plugin","slug":"brute-force-login-protection","name":"Brute Force Login Protection","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2015-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2d564a5-52c7-48e0-abb6-9006ecc35806","source":"wordfence","cve":"CVE-2025-23647","title":"WP-Clap <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2d564a5-52c7-48e0-abb6-9006ecc35806?source=api-prod","affected":[{"type":"plugin","slug":"wp-clap","name":"WP-Clap","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-26T20:48:54Z"},{"id":"wordfence:e2defe79-137f-45a0-85a1-f61dce9afd28","source":"wordfence","cve":"","title":"WP LMS \u2013 Best WordPress LMS Plugin <= 1.1.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2defe79-137f-45a0-85a1-f61dce9afd28?source=api-prod","affected":[{"type":"plugin","slug":"learn-manager","name":"WP Learn Manager","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2e130c9-e921-435d-b52a-d31ba80acf11","source":"wordfence","cve":"CVE-2026-110373","title":"OTP Login With Phone Number, OTP Verification <= 1.8.77 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e130c9-e921-435d-b52a-d31ba80acf11?source=api-prod","affected":[{"type":"plugin","slug":"login-with-phone-number","name":"OTP Login With Phone Number, OTP Verification","from":"*","from_inclusive":true,"to":"1.8.77","to_inclusive":true,"patched_in":"1.8.78"}],"published":"2026-10-16T10:41:41Z","updated":"2026-10-23T18:34:27Z"},{"id":"wordfence:e2e2f446-5391-4189-8c9c-3be2459808d0","source":"wordfence","cve":"","title":"Social Slider Feed <= 2.0.4 - Missing Authorization","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e2f446-5391-4189-8c9c-3be2459808d0?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2e39fe4-8c22-4da6-8cb6-737ddd4dc36e","source":"wordfence","cve":"CVE-2020-13865","title":"Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e39fe4-8c22-4da6-8cb6-737ddd4dc36e?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2020-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2e4b83a-34d5-4a8a-b694-a887a46fe6bf","source":"wordfence","cve":"CVE-2025-3280","title":"ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e4b83a-34d5-4a8a-b694-a887a46fe6bf?source=api-prod","affected":[{"type":"plugin","slug":"elex-bulk-edit-products-prices-attributes-for-woocommerce-basic","name":"ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic)","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-04-23T19:57:32Z","updated":"2025-05-09T13:33:43Z"},{"id":"wordfence:e2e62675-e3d5-4545-bb80-0330da966368","source":"wordfence","cve":"CVE-2020-13641","title":"Real-Time Find and Replace <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e62675-e3d5-4545-bb80-0330da966368?source=api-prod","affected":[{"type":"plugin","slug":"real-time-find-and-replace","name":"Real-Time Find and Replace","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2020-04-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2e6b451-9835-4887-ade7-b18807223a88","source":"wordfence","cve":"CVE-2025-5835","title":"Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e6b451-9835-4887-ade7-b18807223a88?source=api-prod","affected":[{"type":"plugin","slug":"droip","name":"Droip","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-07-24T17:25:41Z","updated":"2025-08-18T17:27:48Z"},{"id":"wordfence:e2e755c7-7d1e-45f7-9d0b-2df1ef0bdd02","source":"wordfence","cve":"CVE-2026-15299","title":"Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e755c7-7d1e-45f7-9d0b-2df1ef0bdd02?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-05-26T15:52:15Z","updated":"2026-07-10T04:31:27Z"},{"id":"wordfence:e2e8c6b7-14fb-4016-b6c3-dd61da584811","source":"wordfence","cve":"CVE-2026-112241","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e8c6b7-14fb-4016-b6c3-dd61da584811?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:34:43Z"},{"id":"wordfence:e2e8d217-51a7-4653-bb23-c53f5c75cb85","source":"wordfence","cve":"CVE-2022-2382","title":"Product Slider for WooCommerce <= 2.5.6 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e8d217-51a7-4653-bb23-c53f5c75cb85?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-slider","name":"Product Slider, Product Carousel and Product Grid Gallery for WooCommerce \u2013 Reno Product Slider (formerly Product Slider for WooCommerce)","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2e96557-7341-4da9-81ca-2bd17a85559e","source":"wordfence","cve":"CVE-2024-32726","title":"Frontend Dashboard <= 2.2.2 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e96557-7341-4da9-81ca-2bd17a85559e?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-04-22T00:00:00Z","updated":"2025-04-17T18:56:02Z"},{"id":"wordfence:e2edeb63-56ad-45e7-9e85-cdf0a8ef41e7","source":"wordfence","cve":"CVE-2024-2081","title":"FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2edeb63-56ad-45e7-9e85-cdf0a8ef41e7?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.14","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-09T18:59:29Z"},{"id":"wordfence:e2f19051-fe80-469c-a514-ec3a848a4015","source":"wordfence","cve":"CVE-2024-1984","title":"Graphene <= 2.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f19051-fe80-469c-a514-ec3a848a4015?source=api-prod","affected":[{"type":"theme","slug":"graphene","name":"Graphene","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2024-03-19T00:00:00Z","updated":"2024-04-09T18:59:29Z"},{"id":"wordfence:e2f497a7-30d5-453f-96d4-11297a138761","source":"wordfence","cve":"CVE-2025-32678","title":"WP Show Stats <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f497a7-30d5-453f-96d4-11297a138761?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-stats","name":"WP Show Stats","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:06:49Z"},{"id":"wordfence:e2f57c50-f6d1-4583-a75e-17c543ed7fa6","source":"wordfence","cve":"","title":"Pinpoint Booking System \u2013 #1 WordPress Booking Plugin <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f57c50-f6d1-4583-a75e-17c543ed7fa6?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4"}],"published":"2013-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2f5a49a-117a-473c-8853-ed292eece620","source":"wordfence","cve":"CVE-2024-3637","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f5a49a-117a-473c-8853-ed292eece620?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-04-12T00:00:00Z","updated":"2025-07-08T15:26:22Z"},{"id":"wordfence:e2f61393-fe09-4488-b8d5-12e2be16c1e2","source":"wordfence","cve":"CVE-2025-68558","title":"Depicter Slider <= 4.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f61393-fe09-4488-b8d5-12e2be16c1e2?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T20:29:44Z"},{"id":"wordfence:e2f8cdd3-f873-42bd-9891-a63a398df846","source":"wordfence","cve":"CVE-2023-23738","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Email Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f8cdd3-f873-42bd-9891-a63a398df846?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2f92781-7c0b-4817-855f-b92ae7784e25","source":"wordfence","cve":"CVE-2026-28025","title":"Stargaze <= 1.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f92781-7c0b-4817-855f-b92ae7784e25?source=api-prod","affected":[{"type":"theme","slug":"stargaze","name":"Stargaze","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:29:38Z"},{"id":"wordfence:e2f94d61-a3ec-4e25-bbd0-651b553b9c7c","source":"wordfence","cve":"CVE-2021-24214","title":"OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f94d61-a3ec-4e25-bbd0-651b553b9c7c?source=api-prod","affected":[{"type":"plugin","slug":"daggerhart-openid-connect-generic","name":"OpenID Connect Generic Client","from":"3.8.0","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2021-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e2f9b5ae-bbb9-4b1d-8762-6889a9b8a209","source":"wordfence","cve":"CVE-2024-38736","title":"Realtyna Organic IDX plugin <= 4.14.13 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f9b5ae-bbb9-4b1d-8762-6889a9b8a209?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-listing-realtyna-wpl","name":"Realtyna Organic IDX plugin + WPL Real Estate","from":"*","from_inclusive":true,"to":"4.14.13","to_inclusive":true,"patched_in":"4.14.14"}],"published":"2024-07-11T00:00:00Z","updated":"2024-11-20T16:36:44Z"},{"id":"wordfence:e2fef3b8-4a69-4c4e-b316-ab6c7e33e68f","source":"wordfence","cve":"CVE-2025-30860","title":"Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e2fef3b8-4a69-4c4e-b316-ab6c7e33e68f?source=api-prod","affected":[{"type":"plugin","slug":"off-canvas-sidebars","name":"Off-Canvas Sidebars & Menus (Slidebars)","from":"*","from_inclusive":true,"to":"0.5.8.2","to_inclusive":true,"patched_in":"0.5.8.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:04:18Z"},{"id":"wordfence:e30187da-c25d-4651-a32d-abdc6da53978","source":"wordfence","cve":"CVE-2021-42358","title":"Contact Form With Captcha <= 1.6.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30187da-c25d-4651-a32d-abdc6da53978?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-captcha","name":"Contact Form With Captcha","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2021-11-29T12:43:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e30379bf-0ea1-4443-81bb-4337a0311ed3","source":"wordfence","cve":"CVE-2026-4141","title":"Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30379bf-0ea1-4443-81bb-4337a0311ed3?source=api-prod","affected":[{"type":"plugin","slug":"quran-translations-by-edc","name":"Quran Translations","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:37:39Z","updated":"2026-04-08T06:43:42Z"},{"id":"wordfence:e3048c4c-77b1-4778-a5d0-b532df777d06","source":"wordfence","cve":"CVE-2025-3793","title":"Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update","severity":"medium","cvss":4.2,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3048c4c-77b1-4778-a5d0-b532df777d06?source=api-prod","affected":[{"type":"plugin","slug":"buddy-press-force-password-change","name":"Buddypress Force Password Change","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:45:59Z","updated":"2025-04-24T08:23:52Z"},{"id":"wordfence:e3092595-ddc9-4c83-b9b2-d275780ea4f5","source":"wordfence","cve":"CVE-2026-74921","title":"Document Gallery 4.0 - 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3092595-ddc9-4c83-b9b2-d275780ea4f5?source=api-prod","affected":[{"type":"plugin","slug":"document-gallery","name":"Document Gallery","from":"4.0","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-11-06T15:20:26Z"},{"id":"wordfence:e30b62de-7280-4c29-b882-dfa83e65966b","source":"wordfence","cve":"CVE-2023-3249","title":"Web3 \u2013 Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30b62de-7280-4c29-b882-dfa83e65966b?source=api-prod","affected":[{"type":"plugin","slug":"web3-authentication","name":"Web3 \u2013 Crypto wallet Login & NFT token gating","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2023-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e30c6a24-1ec8-4816-b467-c1122b9a8ce1","source":"wordfence","cve":"CVE-2024-53823","title":"The Plus Addons for Elementor Page Builder Lite <= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30c6a24-1ec8-4816-b467-c1122b9a8ce1?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.14","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:00:51Z"},{"id":"wordfence:e30e4615-f9b6-4ff6-a227-82cace868f93","source":"wordfence","cve":"CVE-2024-29929","title":"WCFM \u2013 Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30e4615-f9b6-4ff6-a227-82cace868f93?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.8","to_inclusive":true,"patched_in":"6.7.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T16:13:17Z"},{"id":"wordfence:e30e64e7-5de9-4eb3-914f-457daa6f3fe5","source":"wordfence","cve":"CVE-2023-2329","title":"WooCommerce Google Sheet Connector < 1.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30e64e7-5de9-4eb3-914f-457daa6f3fe5?source=api-prod","affected":[{"type":"plugin","slug":"wc-gsheetconnector","name":"GSheetConnector \u2013 WooCommerce Google Sheets Connector, Export Orders & Products to Google Sheets in Real-Time","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2023-06-26T00:00:00Z","updated":"2026-02-25T19:04:31Z"},{"id":"wordfence:e30eea7a-4711-4a3e-928d-eeca9e3b43bf","source":"wordfence","cve":"CVE-2025-62092","title":"Wiremo <= 1.4.99 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30eea7a-4711-4a3e-928d-eeca9e3b43bf?source=api-prod","affected":[{"type":"plugin","slug":"woo-reviews-by-wiremo","name":"Wiremo \u2013 Product Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.99","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:23:00Z"},{"id":"wordfence:e30fe90a-774c-41ba-b28e-8b8128fd72cc","source":"wordfence","cve":"","title":"Modal Survey <= 2.0.1.8 - PHP Object Injection","severity":"critical","cvss":9.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e30fe90a-774c-41ba-b28e-8b8128fd72cc?source=api-prod","affected":[{"type":"plugin","slug":"modal_survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.1.8","to_inclusive":true,"patched_in":"2.0.1.8.2"}],"published":"2021-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e31119ab-963d-48a4-9948-0a0dce761918","source":"wordfence","cve":"CVE-2025-11977","title":"HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e31119ab-963d-48a4-9948-0a0dce761918?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.26.12","to_inclusive":true,"patched_in":"1.26.13"}],"published":"2026-07-09T19:34:47Z","updated":"2026-07-10T07:48:44Z"},{"id":"wordfence:e312db9f-8f02-4c7e-9d49-553a154c95a4","source":"wordfence","cve":"CVE-2022-45849","title":"Activello <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e312db9f-8f02-4c7e-9d49-553a154c95a4?source=api-prod","affected":[{"type":"theme","slug":"activello","name":"Activello","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2022-11-23T00:00:00Z","updated":"2026-08-14T15:11:52Z"},{"id":"wordfence:e312e3eb-0da9-4ecf-aec6-86bfe08417f5","source":"wordfence","cve":"CVE-2024-11878","title":"Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e312e3eb-0da9-4ecf-aec6-86bfe08417f5?source=api-prod","affected":[{"type":"plugin","slug":"category-post-slider","name":"Category Post Slider","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T18:34:17Z","updated":"2024-12-20T06:59:11Z"},{"id":"wordfence:e3147a94-056a-4454-8815-44c0b9d1de81","source":"wordfence","cve":"CVE-2022-38900","title":"decode-uri-component <= 0.2.1 - Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3147a94-056a-4454-8815-44c0b9d1de81?source=api-prod","affected":[{"type":"plugin","slug":"autoshare-for-twitter","name":"Autopost for X (formerly Autoshare for Twitter)","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e316c636-2dd7-4d50-8c99-36f08ecf03ad","source":"wordfence","cve":"CVE-2025-5314","title":"Dear Flipbook \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e316c636-2dd7-4d50-8c99-36f08ecf03ad?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"2.3.65","to_inclusive":true,"patched_in":"2.3.67"}],"published":"2025-06-30T22:38:55Z","updated":"2025-07-01T11:27:13Z"},{"id":"wordfence:e31aba91-d475-4ea5-a0dc-ff8426866407","source":"wordfence","cve":"CVE-2025-23811","title":"WP2APP <= 2.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e31aba91-d475-4ea5-a0dc-ff8426866407?source=api-prod","affected":[{"type":"plugin","slug":"wp2appir","name":"WP2APP","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:15:12Z"},{"id":"wordfence:e31bf122-e3b0-43d4-afff-f3baf3aa53e6","source":"wordfence","cve":"CVE-2021-24380","title":"Shantz WordPress QOTD <= 1.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e31bf122-e3b0-43d4-afff-f3baf3aa53e6?source=api-prod","affected":[{"type":"plugin","slug":"shantz-wordpress-qotd","name":"Shantz WordPress QOTD","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e31d8218-5e04-44a1-89aa-f93e9677680b","source":"wordfence","cve":"CVE-2024-27966","title":"Quiz And Survey Master <= 8.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e31d8218-5e04-44a1-89aa-f93e9677680b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"8.2.2","to_inclusive":true,"patched_in":"8.2.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T20:38:54Z"},{"id":"wordfence:e31ecd7e-95ea-4a35-ae6d-ad3c61b1cae9","source":"wordfence","cve":"CVE-2024-53804","title":"WP Mailster <= 1.8.16.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e31ecd7e-95ea-4a35-ae6d-ad3c61b1cae9?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:30:36Z"},{"id":"wordfence:e324cd49-beaf-44bf-8890-5377731f0cc5","source":"wordfence","cve":"CVE-2023-24389","title":"Social Proof (Testimonial) Slider <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e324cd49-beaf-44bf-8890-5377731f0cc5?source=api-prod","affected":[{"type":"plugin","slug":"social-proof-testimonials-slider","name":"Social Proof (Testimonial) Slider","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e32a2644-df8a-4aea-8e70-49ab3075be9e","source":"wordfence","cve":"CVE-2015-8351","title":"Gwolle Guestbook <= 1.5.3 - Remote File Inclusion","severity":"critical","cvss":9.0,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e32a2644-df8a-4aea-8e70-49ab3075be9e?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2015-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e32a4038-0f67-48b3-80c9-94d279752c31","source":"wordfence","cve":"","title":"Lightbox < 1.6.8 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e32a4038-0f67-48b3-80c9-94d279752c31?source=api-prod","affected":[{"type":"plugin","slug":"lightbox","name":"lightbox","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":false,"patched_in":"1.6.8"}],"published":"2016-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e32b5d2e-5930-4a5a-a7b9-df8581a2e24c","source":"wordfence","cve":"CVE-2026-94682","title":"Podcast Importer SecondLine <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e32b5d2e-5930-4a5a-a7b9-df8581a2e24c?source=api-prod","affected":[{"type":"plugin","slug":"podcast-importer-secondline","name":"Podcast Importer SecondLine","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-09-23T13:45:00Z","updated":"2026-09-29T19:52:05Z"},{"id":"wordfence:e32d9104-5a39-4455-b76a-e24ae787bdfd","source":"wordfence","cve":"CVE-2023-4247","title":"GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e32d9104-5a39-4455-b76a-e24ae787bdfd?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.33.3","to_inclusive":true,"patched_in":"2.33.4"}],"published":"2023-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e32f19d9-4af4-45dc-a819-4b40d6eb0f57","source":"wordfence","cve":"CVE-2026-86823","title":"Newsletter <= 9.3.6 - Unauthenticated Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e32f19d9-4af4-45dc-a819-4b40d6eb0f57?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-email-mailing-list","name":"Newsletter","from":"*","from_inclusive":true,"to":"9.3.6","to_inclusive":true,"patched_in":"9.3.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:50:28Z"},{"id":"wordfence:e3305b39-5f7b-493b-80b5-cb925c2710c1","source":"wordfence","cve":"CVE-2025-11747","title":"Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3305b39-5f7b-493b-80b5-cb925c2710c1?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.345","to_inclusive":true,"patched_in":"1.0.358"}],"published":"2025-12-18T19:48:44Z","updated":"2025-12-19T08:23:41Z"},{"id":"wordfence:e336dc27-4a76-4197-929c-b221f42bfe69","source":"wordfence","cve":"CVE-2026-2112","title":"Dam Spam <= 1.0.8 - Cross-Site Request Forgery to Arbitrary Pending Comment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e336dc27-4a76-4197-929c-b221f42bfe69?source=api-prod","affected":[{"type":"plugin","slug":"dam-spam","name":"Dam Spam","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-02-17T19:02:21Z","updated":"2026-02-18T07:25:43Z"},{"id":"wordfence:e33a2f27-20c2-4963-9558-1eead0515690","source":"wordfence","cve":"CVE-2026-6255","title":"Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e33a2f27-20c2-4963-9558-1eead0515690?source=api-prod","affected":[{"type":"plugin","slug":"simple-owl-shortcodes","name":"Simple Owl Shortcodes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:06:27Z","updated":"2026-05-05T02:26:58Z"},{"id":"wordfence:e33f7ed0-739f-4a2b-8acb-8f7047dd75bc","source":"wordfence","cve":"CVE-2026-27061","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e33f7ed0-739f-4a2b-8acb-8f7047dd75bc?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-10-30T07:45:36Z","updated":"2026-11-03T19:53:07Z"},{"id":"wordfence:e33fb34e-0ea3-4bac-9134-afc8bb830b48","source":"wordfence","cve":"CVE-2025-50015","title":"Hand Talk <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e33fb34e-0ea3-4bac-9134-afc8bb830b48?source=api-prod","affected":[{"type":"plugin","slug":"handtalk","name":"Hand Talk","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2025-06-19T00:00:00Z","updated":"2025-08-22T15:34:09Z"},{"id":"wordfence:e33fcd17-318b-408e-86bf-b4ece46121cc","source":"wordfence","cve":"CVE-2026-2592","title":"Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update","severity":"high","cvss":7.7,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e33fcd17-318b-408e-86bf-b4ece46121cc?source=api-prod","affected":[{"type":"plugin","slug":"zarinpal-woocommerce-payment-gateway","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u0631\u062f\u0627\u062e\u062a \u0627\u0645\u0646 \u0632\u0631\u06cc\u0646\u200c\u067e\u0627\u0644 \u0628\u0631\u0627\u06cc \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 (ZarinPal for WooCommerce)","from":"*","from_inclusive":true,"to":"5.0.16","to_inclusive":true,"patched_in":"5.0.17"}],"published":"2026-02-16T16:35:00Z","updated":"2026-02-17T04:35:46Z"},{"id":"wordfence:e340863f-c029-43c9-9e48-08cc5b93e400","source":"wordfence","cve":"CVE-2025-68866","title":"Dinatur <= 1.18 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e340863f-c029-43c9-9e48-08cc5b93e400?source=api-prod","affected":[{"type":"plugin","slug":"dinatur","name":"Dinatur","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-27T19:14:33Z"},{"id":"wordfence:e340f400-1d20-4fa1-9cc7-8c0f49075bc0","source":"wordfence","cve":"CVE-2018-18379","title":"Elementor Pro <= 2.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e340f400-1d20-4fa1-9cc7-8c0f49075bc0?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":false,"patched_in":"2.0.10"}],"published":"2018-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e342244a-58c4-462d-9b2c-3070f3d87ab4","source":"wordfence","cve":"CVE-2025-53251","title":"Pin WP < 7.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e342244a-58c4-462d-9b2c-3070f3d87ab4?source=api-prod","affected":[{"type":"theme","slug":"pin-wp","name":"Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":false,"patched_in":"7.2"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:21:56Z"},{"id":"wordfence:e342b1c0-6e7f-4e2c-8a52-018df12c12a0","source":"wordfence","cve":"CVE-2026-3844","title":"Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-04-22T13:59:41Z","updated":"2026-04-23T02:25:21Z"},{"id":"wordfence:e3447438-1624-451a-a50c-981021399198","source":"wordfence","cve":"CVE-2025-5938","title":"Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3447438-1624-451a-a50c-981021399198?source=api-prod","affected":[{"type":"plugin","slug":"digital-marketing-agency-templates-for-elementor","name":"Digital Marketing and Agency Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:08:07Z","updated":"2025-06-13T01:47:50Z"},{"id":"wordfence:e3491f9d-78ea-4f3a-81d2-26baed6f3ab7","source":"wordfence","cve":"CVE-2026-45441","title":"Event Booking Manager for WooCommerce <= 5.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3491f9d-78ea-4f3a-81d2-26baed6f3ab7?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:42:20Z"},{"id":"wordfence:e3499182-7501-4fec-a7c6-b66ae47533cd","source":"wordfence","cve":"CVE-2024-13773","title":"Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure","severity":"high","cvss":7.3,"cwe":"CWE-321","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd?source=api-prod","affected":[{"type":"theme","slug":"civi","name":"Civi - Job Board & Freelance Marketplace WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T11:15:53Z"},{"id":"wordfence:e349f07d-a520-4700-a6e0-25e68c1deeae","source":"wordfence","cve":"CVE-2024-0405","title":"Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e349f07d-a520-4700-a6e0-25e68c1deeae?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-01-16T00:00:00Z","updated":"2026-05-11T14:17:10Z"},{"id":"wordfence:e34ac4aa-65c5-43d7-9b77-d4c6068722f1","source":"wordfence","cve":"CVE-2025-9617","title":"Publish approval <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e34ac4aa-65c5-43d7-9b77-d4c6068722f1?source=api-prod","affected":[{"type":"plugin","slug":"publish-approval","name":"Publish approval","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T19:04:45Z","updated":"2025-09-11T07:25:01Z"},{"id":"wordfence:e34b6ae5-1370-4058-95dd-5686978ca45b","source":"wordfence","cve":"","title":"PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e34b6ae5-1370-4058-95dd-5686978ca45b?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e34eed57-ffcb-43ae-98e4-fd0e16be3310","source":"wordfence","cve":"CVE-2026-9815","title":"MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e34eed57-ffcb-43ae-98e4-fd0e16be3310?source=api-prod","affected":[{"type":"plugin","slug":"magicform","name":"MagicForm","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-28T00:00:00Z","updated":"2026-08-21T14:01:36Z"},{"id":"wordfence:e34f455b-936d-4af5-ac9e-ed30cfdc20be","source":"wordfence","cve":"CVE-2026-105150","title":"Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e34f455b-936d-4af5-ac9e-ed30cfdc20be?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-11-10T09:26:17Z","updated":"2026-11-10T21:28:26Z"},{"id":"wordfence:e353a269-c7f5-4b6a-9f9e-be459ead0335","source":"wordfence","cve":"CVE-2021-24171","title":"WooCommerce Upload Files <= 59.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e353a269-c7f5-4b6a-9f9e-be459ead0335?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-upload-files","name":"WooCommerce Upload Files","from":"*","from_inclusive":true,"to":"59.4","to_inclusive":false,"patched_in":"59.4"}],"published":"2021-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e353d938-8844-41dc-96dc-7e2facf96446","source":"wordfence","cve":"CVE-2021-25116","title":"Enqueue Anything <= 1.0.1 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e353d938-8844-41dc-96dc-7e2facf96446?source=api-prod","affected":[{"type":"plugin","slug":"enqueue-anything","name":"Enqueue Anything","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3541aba-fc78-4395-88ca-4ecbf84d5b90","source":"wordfence","cve":"CVE-2025-63009","title":"Google Analytics Events <= 2.8.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3541aba-fc78-4395-88ca-4ecbf84d5b90?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-analytics-events","name":"WP Google Analytics Events \u2013 No-Code Custom Event Tracking for Google Analytics","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T00:00:00Z","updated":"2025-12-11T15:43:30Z"},{"id":"wordfence:e354642a-b817-4490-8738-3edfc3777143","source":"wordfence","cve":"CVE-2025-22544","title":"Mind Doodle Visual Sitemaps & Tasks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e354642a-b817-4490-8738-3edfc3777143?source=api-prod","affected":[{"type":"plugin","slug":"mind-doodle-sitemap","name":"Mind Doodle Visual Sitemaps & Tasks","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:42:01Z"},{"id":"wordfence:e3551218-e272-4c96-94fe-9db0aee0d4f4","source":"wordfence","cve":"CVE-2023-51479","title":"Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3551218-e272-4c96-94fe-9db0aee0d4f4?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2023-12-27T00:00:00Z","updated":"2024-08-15T14:23:55Z"},{"id":"wordfence:e356ff89-220f-4597-9327-9ce1a0226056","source":"wordfence","cve":"CVE-2025-31385","title":"Site Table of Contents <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e356ff89-220f-4597-9327-9ce1a0226056?source=api-prod","affected":[{"type":"plugin","slug":"site-table-of-contents","name":"Site Table of Contents","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:55:38Z"},{"id":"wordfence:e3581172-10d8-4b11-95f7-ee1835e29606","source":"wordfence","cve":"CVE-2025-13850","title":"LS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3581172-10d8-4b11-95f7-ee1835e29606?source=api-prod","affected":[{"type":"plugin","slug":"ls-gmap-route","name":"LS Google Map Router","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:04:38Z","updated":"2025-12-12T03:21:00Z"},{"id":"wordfence:e358355e-097c-4a6d-a21a-3d08098efff0","source":"wordfence","cve":"CVE-2024-24708","title":"W3SPEEDSTER <= 7.19 - Cross-Site Request Forgery via launch","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e358355e-097c-4a6d-a21a-3d08098efff0?source=api-prod","affected":[{"type":"plugin","slug":"w3speedster-wp","name":"W3SPEEDSTER","from":"*","from_inclusive":true,"to":"7.19","to_inclusive":true,"patched_in":"7.20"}],"published":"2024-01-31T00:00:00Z","updated":"2024-03-29T16:56:48Z"},{"id":"wordfence:e358c32d-6d0b-421d-9746-aafa1252dcea","source":"wordfence","cve":"CVE-2020-8934","title":"Site Kit by Google <= 1.7.1 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e358c32d-6d0b-421d-9746-aafa1252dcea?source=api-prod","affected":[{"type":"plugin","slug":"google-site-kit","name":"Site Kit by Google \u2013 Analytics, Search Console, AdSense, Speed","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2020-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3593dfd-7b2a-4d01-8af0-725b444dc81b","source":"wordfence","cve":"CVE-2023-6701","title":"Advanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3593dfd-7b2a-4d01-8af0-725b444dc81b?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.2.5"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:37:39Z"},{"id":"wordfence:e3598c58-888f-48e9-be24-1f338892132f","source":"wordfence","cve":"CVE-2026-120364","title":"Vidplex \u2013 Ultimate Video Gallery Block for YouTube in Gutenberg <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3598c58-888f-48e9-be24-1f338892132f?source=api-prod","affected":[{"type":"plugin","slug":"vidplex","name":"Vidplex \u2013 Ultimate Video Gallery Block for YouTube in Gutenberg","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-11-07T10:31:00Z","updated":"2026-11-10T19:36:06Z"},{"id":"wordfence:e35be8ee-81a3-42ce-8304-992bc75663fd","source":"wordfence","cve":"CVE-2022-40206","title":"wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Privacy Change","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e35be8ee-81a3-42ce-8304-992bc75663fd?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-11-26T09:52:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e35dcd3a-651e-4984-8362-95503ff8c546","source":"wordfence","cve":"CVE-2025-48335","title":"Responsive Plus <= 3.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e35dcd3a-651e-4984-8362-95503ff8c546?source=api-prod","affected":[{"type":"plugin","slug":"responsive-add-ons","name":"Responsive Starter Templates \u2013 Elementor Templates & Starter Sites","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-02T19:25:30Z"},{"id":"wordfence:e35f9e09-c386-4e37-9d81-8dd2863457ac","source":"wordfence","cve":"CVE-2026-92746","title":"Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e35f9e09-c386-4e37-9d81-8dd2863457ac?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2026-09-24T18:22:01Z","updated":"2026-09-25T06:39:57Z"},{"id":"wordfence:e36056bf-4e90-4c5e-8c6a-ab3ae7ba426f","source":"wordfence","cve":"CVE-2024-56277","title":"Poll Maker \u2013 Versus Polls, Anonymous Polls, Image Polls <= 5.5.4 - Unauthenticated HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-116","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36056bf-4e90-4c5e-8c6a-ab3ae7ba426f?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-14T15:21:03Z"},{"id":"wordfence:e363c09a-4381-4b3a-951c-9a0ff5669016","source":"wordfence","cve":"CVE-2024-4439","title":"WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e363c09a-4381-4b3a-951c-9a0ff5669016?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.7","to_inclusive":true,"patched_in":"6.0.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"6.0.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.0.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.3","from_inclusive":true,"to":"6.3.3","to_inclusive":true,"patched_in":"6.0.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.4","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.0.8"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.5","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.0.8"}],"published":"2024-04-09T00:00:00Z","updated":"2024-05-03T05:32:35Z"},{"id":"wordfence:e3691e6e-bc80-492c-8cbc-cb5d0cc3a689","source":"wordfence","cve":"CVE-2025-58003","title":"Javo Core <= 3.0.0.266 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3691e6e-bc80-492c-8cbc-cb5d0cc3a689?source=api-prod","affected":[{"type":"plugin","slug":"javo-core","name":"Javo Core","from":"*","from_inclusive":true,"to":"3.0.0.266","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:27:49Z"},{"id":"wordfence:e36a09c6-158f-464a-9eb9-b47c3672c883","source":"wordfence","cve":"CVE-2024-54259","title":"DELUCKS SEO <= 2.5.8 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36a09c6-158f-464a-9eb9-b47c3672c883?source=api-prod","affected":[{"type":"plugin","slug":"delucks-seo","name":"DELUCKS SEO","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":""}],"published":"2024-12-05T00:00:00Z","updated":"2025-02-19T21:21:47Z"},{"id":"wordfence:e36b5889-19a3-4ae7-93bd-2ab404fce085","source":"wordfence","cve":"CVE-2025-24718","title":"WP Sessions Time Monitoring Full Automatic <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36b5889-19a3-4ae7-93bd-2ab404fce085?source=api-prod","affected":[{"type":"plugin","slug":"activitytime","name":"WP Sessions Time Monitoring Full Automatic","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-03T14:45:03Z"},{"id":"wordfence:e36cbd03-6e7b-4c5d-a5be-6980f312d918","source":"wordfence","cve":"CVE-2026-115597","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36cbd03-6e7b-4c5d-a5be-6980f312d918?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2026-10-26T16:43:00Z","updated":"2026-10-28T01:23:08Z"},{"id":"wordfence:e36df7b7-fcbc-4e5d-812c-861bfe8abb55","source":"wordfence","cve":"CVE-2024-1562","title":"WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36df7b7-fcbc-4e5d-812c-861bfe8abb55?source=api-prod","affected":[{"type":"plugin","slug":"wc-gsheetconnector","name":"GSheetConnector \u2013 WooCommerce Google Sheets Connector, Export Orders & Products to Google Sheets in Real-Time","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":"1.3.12"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-21T03:36:01Z"},{"id":"wordfence:e36e5099-c5ff-4794-b7df-25d8eab27bac","source":"wordfence","cve":"CVE-2022-4299","title":"Metricool <= 1.17 - Authenticated (Administrator+) Stored Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36e5099-c5ff-4794-b7df-25d8eab27bac?source=api-prod","affected":[{"type":"plugin","slug":"metricool","name":"Metricool \u2013 Social media and site statistics","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e36e5c74-ccbe-46c7-885b-461bfd0b090b","source":"wordfence","cve":"CVE-2025-22656","title":"Cookie Monster <= 1.2.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36e5c74-ccbe-46c7-885b-461bfd0b090b?source=api-prod","affected":[{"type":"plugin","slug":"cookie-monster","name":"Cookie Monster","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T22:03:03Z"},{"id":"wordfence:e36eed5b-f76d-451e-a0f8-fd4b91bcf9f1","source":"wordfence","cve":"CVE-2023-45602","title":"Ebook Store <= 5.8009 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e36eed5b-f76d-451e-a0f8-fd4b91bcf9f1?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8009","to_inclusive":true,"patched_in":"5.8010"}],"published":"2023-10-09T00:00:00Z","updated":"2025-06-25T13:39:34Z"},{"id":"wordfence:e3702936-9ae2-4efb-bdfe-9e1dfceb246b","source":"wordfence","cve":"","title":"Protect uploads <= 0.3 - Authorization Bypass","severity":"medium","cvss":4.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3702936-9ae2-4efb-bdfe-9e1dfceb246b?source=api-prod","affected":[{"type":"plugin","slug":"protect-uploads","name":"Protect Uploads","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":"0.4"}],"published":"2022-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e37208ce-4488-40d1-bc3a-114c41edbb87","source":"wordfence","cve":"CVE-2025-31596","title":"Chat by Chatwee <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e37208ce-4488-40d1-bc3a-114c41edbb87?source=api-prod","affected":[{"type":"plugin","slug":"chatwee","name":"Chat by Chatwee","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T14:12:34Z"},{"id":"wordfence:e375f761-459c-4cad-823b-2a94ac901410","source":"wordfence","cve":"CVE-2026-7533","title":"Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e375f761-459c-4cad-823b-2a94ac901410?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-05-27T17:18:24Z","updated":"2026-05-28T05:30:42Z"},{"id":"wordfence:e37cabad-c41c-4fba-b01d-a5eb5c7d5254","source":"wordfence","cve":"CVE-2026-42774","title":"JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e37cabad-c41c-4fba-b01d-a5eb5c7d5254?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.8.1","to_inclusive":true,"patched_in":"3.8.8.2"}],"published":"2026-04-30T00:00:00Z","updated":"2026-05-04T13:55:38Z"},{"id":"wordfence:e3820f80-9b80-4672-b2ff-3864793d2de2","source":"wordfence","cve":"CVE-2024-5382","title":"Master Addons \u2013 Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3820f80-9b80-4672-b2ff-3864793d2de2?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.1","to_inclusive":true,"patched_in":"2.0.6.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T12:33:44Z"},{"id":"wordfence:e3885ca9-6771-40c9-9c19-fbb8696cfb4e","source":"wordfence","cve":"CVE-2025-49290","title":"Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3885ca9-6771-40c9-9c19-fbb8696cfb4e?source=api-prod","affected":[{"type":"plugin","slug":"off-canvas-sidebars","name":"Off-Canvas Sidebars & Menus (Slidebars)","from":"*","from_inclusive":true,"to":"0.5.8.4","to_inclusive":true,"patched_in":"0.5.8.5"}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:30:06Z"},{"id":"wordfence:e3891928-3780-426b-ae9c-e57b05ab3718","source":"wordfence","cve":"CVE-2018-5666","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via bg_color parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3891928-3780-426b-ae9c-e57b05ab3718?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e38e8450-743f-47e7-931e-4c2636bd42b4","source":"wordfence","cve":"CVE-2026-57373","title":"FunnelKit Funnel Builder Pro <= 3.15.0.4 - Authenticated (Customer+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e38e8450-743f-47e7-931e-4c2636bd42b4?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder-pro","name":"FunnelKit Funnel Builder Pro","from":"*","from_inclusive":true,"to":"3.15.0.4","to_inclusive":true,"patched_in":"3.15.0.5"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:27:22Z"},{"id":"wordfence:e390421e-48ad-41d2-909b-f9164f31a0e7","source":"wordfence","cve":"CVE-2026-16296","title":"Clearfy <= 2.4.2 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e390421e-48ad-41d2-909b-f9164f31a0e7?source=api-prod","affected":[{"type":"plugin","slug":"clearfy","name":"Clearfy Cache \u2013 WordPress optimization plugin, Minify HTML, CSS & JS, Defer","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2026-08-03T00:00:00Z","updated":"2026-09-17T15:26:58Z"},{"id":"wordfence:e39044c6-8b72-478d-a762-418b2c58429a","source":"wordfence","cve":"CVE-2019-13505","title":"Appointment Hour Booking \u2013 WordPress Booking Plugin <= 1.1.45 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39044c6-8b72-478d-a762-418b2c58429a?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.46","to_inclusive":false,"patched_in":"1.1.46"}],"published":"2019-07-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3917e1a-c230-46ad-9889-6ab233ecc4d0","source":"wordfence","cve":"CVE-2025-14077","title":"Simcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3917e1a-c230-46ad-9889-6ab233ecc4d0?source=api-prod","affected":[{"type":"plugin","slug":"simcast","name":"Simcast","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:46:59Z","updated":"2026-01-07T09:21:06Z"},{"id":"wordfence:e391f560-2037-4180-a77e-1731524a318c","source":"wordfence","cve":"CVE-2026-7637","title":"Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e391f560-2037-4180-a77e-1731524a318c?source=api-prod","affected":[{"type":"plugin","slug":"boost","name":"Boost","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-05-19T13:55:11Z","updated":"2026-05-20T02:27:48Z"},{"id":"wordfence:e39810d7-260f-4729-9b11-69dba0e16684","source":"wordfence","cve":"CVE-2017-6572","title":"Mail Masta <= 1.0 - SQL Injection via filter_list parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39810d7-260f-4729-9b11-69dba0e16684?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e399153e-8a13-4e1b-bcfa-2d7864c6828b","source":"wordfence","cve":"CVE-2024-4480","title":"WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Email Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e399153e-8a13-4e1b-bcfa-2d7864c6828b?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayers-request","name":"GoPrayer","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-05-24T00:00:00Z","updated":"2024-07-01T14:54:25Z"},{"id":"wordfence:e3991601-a96c-4f98-a0f6-04a134ec6feb","source":"wordfence","cve":"CVE-2025-60092","title":"Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3991601-a96c-4f98-a0f6-04a134ec6feb?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.25","to_inclusive":true,"patched_in":"3.3.26"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:09:28Z"},{"id":"wordfence:e39c4730-f5b3-4554-9e4f-bbbbcb41cf61","source":"wordfence","cve":"CVE-2025-23771","title":"Push Notification for Post and BuddyPress <= 2.11 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39c4730-f5b3-4554-9e4f-bbbbcb41cf61?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"2.11","to_inclusive":true,"patched_in":"2.12"}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-24T16:10:04Z"},{"id":"wordfence:e39c978d-37cf-45ff-9a78-81c1870f09c0","source":"wordfence","cve":"CVE-2026-96816","title":"Trusted Shops Easy Integration for WooCommerce <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39c978d-37cf-45ff-9a78-81c1870f09c0?source=api-prod","affected":[{"type":"plugin","slug":"trusted-shops-easy-integration-for-woocommerce","name":"Trusted Shops Easy Integration for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:33:36Z"},{"id":"wordfence:e39d3ec1-b1a5-4176-88ac-432d91dbf621","source":"wordfence","cve":"CVE-2024-32112","title":"Leadinfo <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39d3ec1-b1a5-4176-88ac-432d91dbf621?source=api-prod","affected":[{"type":"plugin","slug":"leadinfo","name":"Leadinfo","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2024-04-11T00:00:00Z","updated":"2025-05-07T14:11:46Z"},{"id":"wordfence:e39ebe27-7780-48b6-8dca-7da7a78fce69","source":"wordfence","cve":"CVE-2026-6294","title":"Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e39ebe27-7780-48b6-8dca-7da7a78fce69?source=api-prod","affected":[{"type":"plugin","slug":"google-pagerank-display","name":"Google PageRank Display","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-04-21T19:02:33Z","updated":"2026-04-22T07:45:42Z"},{"id":"wordfence:e3a0a46a-da56-4455-aa5d-28018fac4ce2","source":"wordfence","cve":"CVE-2025-68841","title":"TopperPack \u2013 Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a0a46a-da56-4455-aa5d-28018fac4ce2?source=api-prod","affected":[{"type":"plugin","slug":"topper-pack","name":"Topper Pack","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-02-04T00:00:00Z","updated":"2026-06-01T20:21:02Z"},{"id":"wordfence:e3a21a39-ed2a-4ca2-b8e2-c489c007e108","source":"wordfence","cve":"CVE-2025-26580","title":"Page/Post Specific Social Share Buttons <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a21a39-ed2a-4ca2-b8e2-c489c007e108?source=api-prod","affected":[{"type":"plugin","slug":"pagepost-specific-social-share-buttons","name":"Page/Post Specific Social Share Buttons","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:36:08Z"},{"id":"wordfence:e3a70510-51c8-49c3-933b-79e79dfb8611","source":"wordfence","cve":"CVE-2024-3662","title":"WPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a70510-51c8-49c3-933b-79e79dfb8611?source=api-prod","affected":[{"type":"plugin","slug":"instagram-widget-by-wpzoom","name":"WPZOOM Social Feed Widget & Block","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":"2.1.14"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-13T08:41:31Z"},{"id":"wordfence:e3a7e0b6-dc6d-4e3a-bb05-12d6ace330df","source":"wordfence","cve":"CVE-2023-49162","title":"BigCommerce <= 5.1.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a7e0b6-dc6d-4e3a-bb05-12d6ace330df?source=api-prod","affected":[{"type":"plugin","slug":"bigcommerce","name":"BigCommerce For WordPress","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2025-03-04T20:45:26Z"},{"id":"wordfence:e3a8020c-c761-4f13-8bb0-ecd992f5c611","source":"wordfence","cve":"CVE-2026-124417","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.7.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a8020c-c761-4f13-8bb0-ecd992f5c611?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:28Z"},{"id":"wordfence:e3a8f554-7cb6-40b7-b83c-819e7785058a","source":"wordfence","cve":"","title":"HyperComments <= 1.2.2 - Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a8f554-7cb6-40b7-b83c-819e7785058a?source=api-prod","affected":[{"type":"plugin","slug":"hypercomments","name":"HyperComments","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2020-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3a902a6-c16f-4e0a-a13a-defb93754c92","source":"wordfence","cve":"CVE-2026-4004","title":"Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a902a6-c16f-4e0a-a13a-defb93754c92?source=api-prod","affected":[{"type":"plugin","slug":"task-manager","name":"Task Manager","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:08:15Z","updated":"2026-03-21T03:27:11Z"},{"id":"wordfence:e3aac40c-1576-45b5-90f8-14ff05c089c7","source":"wordfence","cve":"CVE-2025-10375","title":"Web Accessibility By accessiBe <= 2.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3aac40c-1576-45b5-90f8-14ff05c089c7?source=api-prod","affected":[{"type":"plugin","slug":"accessibe","name":"Web Accessibility by accessiBe","from":"*","from_inclusive":true,"to":"2.10","to_inclusive":true,"patched_in":"2.11"}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-11T09:28:42Z"},{"id":"wordfence:e3ab817c-3677-4251-adaf-f340bf4c5336","source":"wordfence","cve":"CVE-2023-32591","title":"DBargain <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ab817c-3677-4251-adaf-f340bf4c5336?source=api-prod","affected":[{"type":"plugin","slug":"d-bargain","name":"D-Bargain","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3ac66e2-f508-4059-8723-e7a82b7c2daa","source":"wordfence","cve":"CVE-2026-57634","title":"PPWP \u2013 Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ac66e2-f508-4059-8723-e7a82b7c2daa?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.19","to_inclusive":true,"patched_in":"1.9.20"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:28:45Z"},{"id":"wordfence:e3adcb85-efc5-429c-8a06-9bfb472d668f","source":"wordfence","cve":"","title":"Easy Digital Downloads <= 3.1.1.4.2 - Cross-Site Request Forgery via edd_trigger_upgrades","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3adcb85-efc5-429c-8a06-9bfb472d668f?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2023-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3afaa85-9eb5-4cc4-883a-11d42504a8e1","source":"wordfence","cve":"CVE-2023-47531","title":"Droit Dark Mode <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3afaa85-9eb5-4cc4-883a-11d42504a8e1?source=api-prod","affected":[{"type":"plugin","slug":"droit-dark-mode","name":"Droit Dark Mode","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3afda72-c10b-46e0-b187-03bcaeb77ea4","source":"wordfence","cve":"CVE-2026-111070","title":"Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name=\"description\">`","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3afda72-c10b-46e0-b187-03bcaeb77ea4?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-pilot","name":"Content Pilot \u2013 Autoblogging & Affiliate Marketing Suite","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-10-30T19:25:48Z","updated":"2026-10-31T07:46:52Z"},{"id":"wordfence:e3b3ce65-b226-4b93-ab0c-984f774454f7","source":"wordfence","cve":"CVE-2023-52187","title":"Image Source Control <= 2.17.0 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b3ce65-b226-4b93-ab0c-984f774454f7?source=api-prod","affected":[{"type":"plugin","slug":"image-source-control-isc","name":"Image Source Control Lite \u2013 Show Image Credits and Captions","from":"*","from_inclusive":true,"to":"2.17.0","to_inclusive":true,"patched_in":"2.17.1"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3b81a8f-e10f-4eaf-9c45-21208bc9411d","source":"wordfence","cve":"CVE-2025-1623","title":"GDPR Cookie Compliance <= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b81a8f-e10f-4eaf-9c45-21208bc9411d?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-compliance","name":"GDPR Cookie Compliance \u2013 Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law","from":"*","from_inclusive":true,"to":"4.15.8","to_inclusive":true,"patched_in":"4.15.9"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-24T19:51:55Z"},{"id":"wordfence:e3b8a43d-6738-456c-8b36-a779a83a62d0","source":"wordfence","cve":"CVE-2026-39719","title":"PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b8a43d-6738-456c-8b36-a779a83a62d0?source=api-prod","affected":[{"type":"plugin","slug":"pdf-smart-viewer-for-elementor","name":"PDF Smart Viewer for Elementor","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-04T08:24:54Z","updated":"2026-10-08T23:22:44Z"},{"id":"wordfence:e3b8b3f9-91da-4e37-acd3-79fec0a8cee7","source":"wordfence","cve":"CVE-2026-62122","title":"Booktics \u2013 Appointment Booking Calendar for Service Businesses <= 1.0.31 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b8b3f9-91da-4e37-acd3-79fec0a8cee7?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.32"}],"published":"2026-10-30T18:05:00Z","updated":"2026-11-03T20:09:11Z"},{"id":"wordfence:e3b916dc-3b94-4319-a805-0ea99d14429f","source":"wordfence","cve":"CVE-2020-36758","title":"RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b916dc-3b94-4319-a805-0ea99d14429f?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":false,"patched_in":"3.4.3"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3bb083c-af58-41f3-a14a-f45408e18d72","source":"wordfence","cve":"CVE-2026-59544","title":"Thrive Quiz Builder <= 10.9.3.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3bb083c-af58-41f3-a14a-f45408e18d72?source=api-prod","affected":[{"type":"plugin","slug":"thrive-quiz-builder","name":"Thrive Quiz Builder","from":"*","from_inclusive":true,"to":"10.9.3.0","to_inclusive":true,"patched_in":"10.9.3.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T12:40:08Z"},{"id":"wordfence:e3bb88e9-e410-4ff7-b342-72c7b375dff1","source":"wordfence","cve":"CVE-2026-1826","title":"OpenPOS Lite <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3bb88e9-e410-4ff7-b342-72c7b375dff1?source=api-prod","affected":[{"type":"plugin","slug":"wpos-lite-version","name":"OpenPOS Lite \u2013 Point of Sale for WooCommerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-02-10T20:07:08Z","updated":"2026-02-12T17:14:57Z"},{"id":"wordfence:e3bcc0aa-281f-4c59-b3de-dde4277cc989","source":"wordfence","cve":"CVE-2023-50874","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 6.1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3bcc0aa-281f-4c59-b3de-dde4277cc989?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"6.1.0.1","to_inclusive":true,"patched_in":"6.2"}],"published":"2023-12-22T00:00:00Z","updated":"2024-02-12T15:03:02Z"},{"id":"wordfence:e3c10baf-f68a-454a-af66-e1526de83253","source":"wordfence","cve":"CVE-2025-59571","title":"WorkScout-Core < 1.7.06 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c10baf-f68a-454a-af66-e1526de83253?source=api-prod","affected":[{"type":"plugin","slug":"workscout-core","name":"Workscout Core","from":"*","from_inclusive":true,"to":"1.7.06","to_inclusive":false,"patched_in":"1.7.06"}],"published":"2025-09-23T00:00:00Z","updated":"2025-10-29T19:16:02Z"},{"id":"wordfence:e3c1be94-f517-4292-a7dd-5206e9157546","source":"wordfence","cve":"CVE-2025-69029","title":"Struktur <= 2.5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c1be94-f517-4292-a7dd-5206e9157546?source=api-prod","affected":[{"type":"theme","slug":"struktur","name":"Struktur - Creative Agency WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:46:11Z"},{"id":"wordfence:e3c273ee-3253-481d-bd29-55f226b4e6a8","source":"wordfence","cve":"CVE-2025-58968","title":"MaxiBlocks <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c273ee-3253-481d-bd29-55f226b4e6a8?source=api-prod","affected":[{"type":"plugin","slug":"maxi-blocks","name":"MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T20:16:11Z"},{"id":"wordfence:e3c371fc-4cf0-478e-b6ae-3bb258c5062e","source":"wordfence","cve":"CVE-2024-27953","title":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List <= 2.6.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c371fc-4cf0-478e-b6ae-3bb258c5062e?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-price-ticker-widget","name":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:23:14Z"},{"id":"wordfence:e3c52d28-54de-403c-b874-680e10e3fc3c","source":"wordfence","cve":"CVE-2023-5529","title":"Advanced Page Visit Counter <= 8.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c52d28-54de-403c-b874-680e10e3fc3c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2025-05-21T20:23:54Z"},{"id":"wordfence:e3c52d6e-b3f4-4ba8-aee4-b9f11704e1de","source":"wordfence","cve":"CVE-2024-1136","title":"Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c52d6e-b3f4-4ba8-aee4-b9f11704e1de?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon","name":"Coming Soon Page & Maintenance Mode","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-02-27T00:00:00Z","updated":"2024-03-08T19:34:10Z"},{"id":"wordfence:e3c52da7-ddfb-4c47-b8d2-2e1db6ec3946","source":"wordfence","cve":"CVE-2017-1000226","title":"Stop User Enumeration plugin <1.3.9 - User Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c52da7-ddfb-4c47-b8d2-2e1db6ec3946?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3c5380f-2008-4dda-b0f9-d221a01ad1f0","source":"wordfence","cve":"CVE-2024-49686","title":"Landing Page Cat <= 1.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c5380f-2008-4dda-b0f9-d221a01ad1f0?source=api-prod","affected":[{"type":"plugin","slug":"landing-page-cat","name":"Landing Page Cat \u2013 Coming Soon & Maintenance Pages","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:26:30Z"},{"id":"wordfence:e3cb52a2-260b-4f3a-8964-cd2fdf75c0b1","source":"wordfence","cve":"CVE-2025-58634","title":"PeachPay Payments <= 1.117.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3cb52a2-260b-4f3a-8964-cd2fdf75c0b1?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"*","from_inclusive":true,"to":"1.117.4","to_inclusive":true,"patched_in":"1.117.5"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:42:29Z"},{"id":"wordfence:e3cc99df-b709-40e7-a911-ea19f5af2c82","source":"wordfence","cve":"CVE-2015-7668","title":"Easy2Map <= 1.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3cc99df-b709-40e7-a911-ea19f5af2c82?source=api-prod","affected":[{"type":"plugin","slug":"easy2map","name":"Easy2Map","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2015-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3cd843b-ab38-45c4-a661-78d4e6db5201","source":"wordfence","cve":"CVE-2026-0554","title":"NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3cd843b-ab38-45c4-a661-78d4e6db5201?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2026-01-20T01:50:24Z","updated":"2026-01-20T14:26:35Z"},{"id":"wordfence:e3ce0eca-5ec3-4af9-bc83-2f973b18e7f7","source":"wordfence","cve":"CVE-2015-9423","title":"PlugNedit Adaptive Editor < 6.2.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ce0eca-5ec3-4af9-bc83-2f973b18e7f7?source=api-prod","affected":[{"type":"plugin","slug":"plugnedit","name":"plugnedit","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":false,"patched_in":"6.2.0"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3ce37e7-1dca-4f74-86ce-65bf29ef091e","source":"wordfence","cve":"CVE-2026-5694","title":"Quick Interest Slider <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ce37e7-1dca-4f74-86ce-65bf29ef091e?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-04-14T19:44:37Z","updated":"2026-05-14T15:44:51Z"},{"id":"wordfence:e3d040ca-c1cd-44e9-a916-37572fbade74","source":"wordfence","cve":"CVE-2025-22294","title":"Custom Field For WP Job Manager <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d040ca-c1cd-44e9-a916-37572fbade74?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-for-wp-job-manager","name":"Custom Field For WP Job Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:32:43Z"},{"id":"wordfence:e3d21ebb-52de-4b25-b9e9-5d6f3284cf94","source":"wordfence","cve":"CVE-2023-47659","title":"Lava Directory Manager <= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d21ebb-52de-4b25-b9e9-5d6f3284cf94?source=api-prod","affected":[{"type":"plugin","slug":"lava-directory-manager","name":"Lava Directory Manager","from":"*","from_inclusive":true,"to":"1.1.34","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3d231e1-a63e-4b41-a6b7-91e6dfc33600","source":"wordfence","cve":"CVE-2025-12750","title":"Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d231e1-a63e-4b41-a6b7-91e6dfc33600?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.2.6.1","to_inclusive":true,"patched_in":"4.2.7"}],"published":"2025-11-20T20:41:57Z","updated":"2025-11-21T09:27:03Z"},{"id":"wordfence:e3d3860f-617d-4642-9346-de68e197b202","source":"wordfence","cve":"CVE-2026-77771","title":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.8 - 6.3.0 - Unauthenticated Second Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d3860f-617d-4642-9346-de68e197b202?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"18.0","from_inclusive":true,"to":"19.2","to_inclusive":true,"patched_in":"6.3.1"},{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"6.2.8","from_inclusive":true,"to":"6.3.0","to_inclusive":true,"patched_in":"6.3.1"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-16T14:45:21Z"},{"id":"wordfence:e3d4a52d-edc1-4ac7-bfe3-89d5e09ff5f4","source":"wordfence","cve":"CVE-2026-65569","title":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website <= 2.5.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d4a52d-edc1-4ac7-bfe3-89d5e09ff5f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:13:38Z"},{"id":"wordfence:e3d8daef-787d-43f1-a438-958295294f6c","source":"wordfence","cve":"CVE-2024-43300","title":"Movie Database <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d8daef-787d-43f1-a438-958295294f6c?source=api-prod","affected":[{"type":"plugin","slug":"movie-database","name":"Movie Database","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-12-12T17:14:16Z"},{"id":"wordfence:e3d9b2d2-d8eb-42c2-a807-ccee30798581","source":"wordfence","cve":"CVE-2025-32290","title":"Sticky HTML5 Music Player <= 3.1.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3d9b2d2-d8eb-42c2-a807-ccee30798581?source=api-prod","affected":[{"type":"plugin","slug":"lbg-audio3-html5","name":"Sticky HTML5 Music Player","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-29T16:50:13Z"},{"id":"wordfence:e3db6046-26ea-405c-b31a-d0d3c5364506","source":"wordfence","cve":"CVE-2026-22477","title":"Felizia | Fertility Center & Medical WordPress Theme <= 1.3.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3db6046-26ea-405c-b31a-d0d3c5364506?source=api-prod","affected":[{"type":"theme","slug":"felizia","name":"Felizia | Fertility Center & Medical WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-12T16:16:17Z"},{"id":"wordfence:e3dc1dd6-7f35-4771-a795-f0e37088dfda","source":"wordfence","cve":"CVE-2022-1327","title":"Image Gallery \u2013 Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3dc1dd6-7f35-4771-a795-f0e37088dfda?source=api-prod","affected":[{"type":"plugin","slug":"gallery-image-gallery-photo","name":"Image Gallery \u2013 Grid Gallery","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2022-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3dd3b5e-b0df-45b0-b42d-eaea765f3193","source":"wordfence","cve":"CVE-2022-4243","title":"ImageInject <= 1.18 - Authenticated (Admin+) Stored XSS","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3dd3b5e-b0df-45b0-b42d-eaea765f3193?source=api-prod","affected":[{"type":"plugin","slug":"wp-inject","name":"ImageInject","from":"*","from_inclusive":true,"to":"1.18","to_inclusive":true,"patched_in":""}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3de6969-a27c-40a1-87ff-ce09a702613c","source":"wordfence","cve":"CVE-2018-20154","title":"WP Maintenance Mode <= 2.0.6 - Authenticated Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3de6969-a27c-40a1-87ff-ce09a702613c?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2016-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3e00ae4-68a6-4835-8dd7-da5dc104feba","source":"wordfence","cve":"CVE-2024-33942","title":"Google Typography <= 1.1.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e00ae4-68a6-4835-8dd7-da5dc104feba?source=api-prod","affected":[{"type":"plugin","slug":"google-typography","name":"Google Typography","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T18:12:57Z"},{"id":"wordfence:e3e1833e-31de-418b-bbd3-d41daa3ac9d5","source":"wordfence","cve":"CVE-2012-6628","title":"Newsletter Manager < 1.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e1833e-31de-418b-bbd3-d41daa3ac9d5?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-manager","name":"Newsletter Manager","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":false,"patched_in":"1.0.2"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3e2efbf-11ac-4a85-8136-cb40468089e1","source":"wordfence","cve":"CVE-2018-18872","title":"Calendar <= 1.3.10 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e2efbf-11ac-4a85-8136-cb40468089e1?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":false,"patched_in":"1.3.11"}],"published":"2018-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3e340b8-4eed-4622-b7c4-73d5bafb7e8e","source":"wordfence","cve":"CVE-2016-10883","title":"Simple add pages or posts < 1.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e340b8-4eed-4622-b7c4-73d5bafb7e8e?source=api-prod","affected":[{"type":"plugin","slug":"simple-add-pages-or-posts","name":"Simple add pages or posts","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3e3ac84-dd82-42b0-80b9-c876731170d5","source":"wordfence","cve":"CVE-2024-4580","title":"Master Addons \u2013 Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e3ac84-dd82-42b0-80b9-c876731170d5?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"2.0.6.0","to_inclusive":true,"patched_in":"2.0.6.1"}],"published":"2024-05-15T00:00:00Z","updated":"2024-08-06T13:19:04Z"},{"id":"wordfence:e3e3c9dc-985a-48fb-8300-add83046100a","source":"wordfence","cve":"CVE-2024-47364","title":"Move Addons for Elementor <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e3c9dc-985a-48fb-8300-add83046100a?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:51:38Z"},{"id":"wordfence:e3e5bb98-2652-499a-b8cd-4ebfe1c1d890","source":"wordfence","cve":"CVE-2025-0308","title":"Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e5bb98-2652-499a-b8cd-4ebfe1c1d890?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-17T16:40:14Z","updated":"2025-01-18T05:33:50Z"},{"id":"wordfence:e3e682fb-e821-45cb-a087-d97d42a3743e","source":"wordfence","cve":"CVE-2024-13537","title":"C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-209","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e682fb-e821-45cb-a087-d97d42a3743e?source=api-prod","affected":[{"type":"plugin","slug":"c9-blocks","name":"C9 Blocks","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T15:02:23Z","updated":"2025-02-21T03:21:22Z"},{"id":"wordfence:e3e6f317-c4d7-46ad-baa8-57bc02918e5d","source":"wordfence","cve":"CVE-2026-118084","title":"Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e6f317-c4d7-46ad-baa8-57bc02918e5d?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-28T08:18:40Z","updated":"2026-11-03T19:43:03Z"},{"id":"wordfence:e3e88dc0-4798-4da8-87cf-4c398acc622c","source":"wordfence","cve":"CVE-2025-13860","title":"Easy Jump Links Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e88dc0-4798-4da8-87cf-4c398acc622c?source=api-prod","affected":[{"type":"plugin","slug":"easy-jump-links-menus","name":"Easy Jump Links Menus","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T17:23:08Z","updated":"2025-12-05T05:31:29Z"},{"id":"wordfence:e3e99032-2e71-45bd-99a6-ad0a93c39bc0","source":"wordfence","cve":"CVE-2026-49112","title":"Shared Files \u2013 Frontend File Upload Form & Secure File Sharing <= 1.7.64 - Unauthenticated Path Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e99032-2e71-45bd-99a6-ad0a93c39bc0?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.64","to_inclusive":true,"patched_in":"1.7.65"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:23:37Z"},{"id":"wordfence:e3ec1716-8e44-4cd6-b830-800716e3624b","source":"wordfence","cve":"CVE-2025-30572","title":"Simple Rating <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ec1716-8e44-4cd6-b830-800716e3624b?source=api-prod","affected":[{"type":"plugin","slug":"simple-rating","name":"Simple Rating","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:56:49Z"},{"id":"wordfence:e3ec9b11-e689-4796-8b05-59ab05a98184","source":"wordfence","cve":"CVE-2021-24207","title":"WP Page Builder <= 1.2.3 - Insecure Default to Unauthorized Page Editing","severity":"medium","cvss":5.4,"cwe":"CWE-1188","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ec9b11-e689-4796-8b05-59ab05a98184?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagebuilder","name":"WP Page Builder","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"}],"published":"2021-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3ed233d-7a14-4005-8a6d-df9a154268d5","source":"wordfence","cve":"CVE-2025-58239","title":"WP Category Dropdown <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ed233d-7a14-4005-8a6d-df9a154268d5?source=api-prod","affected":[{"type":"plugin","slug":"wp-category-dropdown","name":"Category Dropdown by GCS Design","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:37:04Z"},{"id":"wordfence:e3ee4563-cf28-42f6-8b50-fd996ad90152","source":"wordfence","cve":"CVE-2025-49301","title":"Greenshift <= 11.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3ee4563-cf28-42f6-8b50-fd996ad90152?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"11.5.5","to_inclusive":true,"patched_in":"11.5.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:59:09Z"},{"id":"wordfence:e3eec839-9009-48de-80c8-911dc9b545ba","source":"wordfence","cve":"CVE-2024-32955","title":"FV Flowplayer Video Player <= 7.5.43.7212 - Authenticated (Subscriber+) Server-side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3eec839-9009-48de-80c8-911dc9b545ba?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.43.7212","to_inclusive":true,"patched_in":"7.5.45.7212"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:51:30Z"},{"id":"wordfence:e3f05af5-35f5-4813-b8a3-bb90709af677","source":"wordfence","cve":"CVE-2023-38396","title":"Google Map Shortcode <= 3.1.2 - Cross-Site Request Forgery to Plugin Setting Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f05af5-35f5-4813-b8a3-bb90709af677?source=api-prod","affected":[{"type":"plugin","slug":"google-map-shortcode","name":"Google Map Shortcode","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3f0a20b-d572-4040-b5b6-ede0aec4e2b0","source":"wordfence","cve":"CVE-2024-4983","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f0a20b-d572-4040-b5b6-ede0aec4e2b0?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2024-06-26T00:00:00Z","updated":"2024-06-27T08:34:22Z"},{"id":"wordfence:e3f3ff3b-d621-46d4-a98a-e5ebf65ddace","source":"wordfence","cve":"CVE-2024-33948","title":"TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f3ff3b-d621-46d4-a98a-e5ebf65ddace?source=api-prod","affected":[{"type":"plugin","slug":"tweetscroll-widget","name":"TweetScroll Widget","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":""}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:42:18Z"},{"id":"wordfence:e3f4bdec-55da-4830-96a7-e0b8cc28d01e","source":"wordfence","cve":"CVE-2026-66656","title":"Foton Core <= 1.1.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f4bdec-55da-4830-96a7-e0b8cc28d01e?source=api-prod","affected":[{"type":"plugin","slug":"foton-core","name":"Foton Core","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-14T12:56:14Z"},{"id":"wordfence:e3f59671-0db2-4acf-8e97-a0ead518bebd","source":"wordfence","cve":"CVE-2023-46194","title":"Archivist \u2013 Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f59671-0db2-4acf-8e97-a0ead518bebd?source=api-prod","affected":[{"type":"plugin","slug":"archivist-custom-archive-templates","name":"Archivist \u2013 Custom Archive Templates","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3f665b8-fbd5-4100-baf6-3fa99332a5dc","source":"wordfence","cve":"CVE-2023-41862","title":"VS Contact Form <= 13.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f665b8-fbd5-4100-baf6-3fa99332a5dc?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-contact-form","name":"VS Contact Form","from":"*","from_inclusive":true,"to":"13.9","to_inclusive":true,"patched_in":"14.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e3f71928-3f1d-4c15-8655-41cdfb707370","source":"wordfence","cve":"CVE-2024-3747","title":"Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f71928-3f1d-4c15-8655-41cdfb707370?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.40"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:47Z"},{"id":"wordfence:e3f77721-e093-41ae-a59b-3af007ac1389","source":"wordfence","cve":"CVE-2024-34373","title":"The Plus Addons for Elementor Page Builder Lite <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f77721-e093-41ae-a59b-3af007ac1389?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2024-05-03T00:00:00Z","updated":"2026-04-15T20:49:07Z"},{"id":"wordfence:e3f88a18-5439-4759-ae9f-168f5efc3264","source":"wordfence","cve":"CVE-2026-10041","title":"WCFM \u2013 Frontend Manager for WooCommerce <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3f88a18-5439-4759-ae9f-168f5efc3264?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.27","to_inclusive":true,"patched_in":"6.7.28"}],"published":"2026-07-10T16:42:26Z","updated":"2026-07-11T05:35:50Z"},{"id":"wordfence:e3fdf38c-866b-4961-b937-2f1641c9fb20","source":"wordfence","cve":"CVE-2025-30853","title":"ShortPixel Adaptive Images <= 3.10.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e3fdf38c-866b-4961-b937-2f1641c9fb20?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:47:58Z"},{"id":"wordfence:e40089db-25cc-4987-b976-d1f962645203","source":"wordfence","cve":"CVE-2024-37938","title":"SociallyViral <= 1.0.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e40089db-25cc-4987-b976-d1f962645203?source=api-prod","affected":[{"type":"theme","slug":"sociallyviral","name":"SociallyViral","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:39:02Z"},{"id":"wordfence:e40129a9-731a-4443-8906-8fe697c04f59","source":"wordfence","cve":"CVE-2025-23435","title":"Password Protect Plugin for WordPress <= 0.8.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e40129a9-731a-4443-8906-8fe697c04f59?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-plugin-for-wordpress","name":"Password Protect Plugin for WordPress","from":"*","from_inclusive":true,"to":"0.8.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:30:44Z"},{"id":"wordfence:e4045a2b-2bbc-4335-b6d2-af7a046f1f92","source":"wordfence","cve":"CVE-2025-9561","title":"AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4045a2b-2bbc-4335-b6d2-af7a046f1f92?source=api-prod","affected":[{"type":"plugin","slug":"ap-background","name":"AP Background","from":"3.8.1","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:28:23Z","updated":"2025-10-03T11:17:22Z"},{"id":"wordfence:e404d689-f0b5-43cc-b366-b7d6a44a9dcc","source":"wordfence","cve":"CVE-2022-25603","title":"MaxGalleria <= 6.2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e404d689-f0b5-43cc-b366-b7d6a44a9dcc?source=api-prod","affected":[{"type":"plugin","slug":"maxgalleria","name":"MaxGalleria","from":"*","from_inclusive":true,"to":"6.2.7","to_inclusive":false,"patched_in":"6.2.7"}],"published":"2022-02-22T07:27:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4077fda-3f39-4e17-b7b8-3f1b6bf0a9e1","source":"wordfence","cve":"CVE-2023-23830","title":"ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4077fda-3f39-4e17-b7b8-3f1b6bf0a9e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e409a4af-9998-4b77-8f6b-50ae1b70da2d","source":"wordfence","cve":"","title":"Sitemap by BestWebSoft \u2013 WordPress XML Site Map Page Generator Plugin < 3.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e409a4af-9998-4b77-8f6b-50ae1b70da2d?source=api-prod","affected":[{"type":"plugin","slug":"google-sitemap-plugin","name":"Sitemap by BestWebSoft \u2013 WordPress XML Site Map Page Generator Plugin","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e40cba5c-455c-44ba-bba2-c825697b837a","source":"wordfence","cve":"CVE-2023-32576","title":"Locatoraid Store Locator <= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e40cba5c-455c-44ba-bba2-c825697b837a?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.9.19"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e40ce073-f865-47d8-bdda-3609beea65b0","source":"wordfence","cve":"CVE-2024-51663","title":"Bricksable for Bricks Builder <= 1.6.59 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e40ce073-f865-47d8-bdda-3609beea65b0?source=api-prod","affected":[{"type":"plugin","slug":"bricksable","name":"Bricksable for Bricks Builder","from":"*","from_inclusive":true,"to":"1.6.59","to_inclusive":true,"patched_in":"1.6.60"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:45:50Z"},{"id":"wordfence:e40f07b5-9e6e-430b-86fc-3bb863a51b01","source":"wordfence","cve":"CVE-2023-45832","title":"WP GoToWebinar <= 14.45 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e40f07b5-9e6e-430b-86fc-3bb863a51b01?source=api-prod","affected":[{"type":"plugin","slug":"wp-gotowebinar","name":"WP GoToWebinar","from":"*","from_inclusive":true,"to":"14.45","to_inclusive":true,"patched_in":"14.46"}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e411c319-3eb0-4a41-9ba7-9a6a4f203809","source":"wordfence","cve":"CVE-2026-57343","title":"Real Estate 7 WordPress <= 3.5.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e411c319-3eb0-4a41-9ba7-9a6a4f203809?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-07T19:54:02Z"},{"id":"wordfence:e413fbfd-fc09-4b84-a8b9-231434e0681b","source":"wordfence","cve":"CVE-2025-22749","title":"Social Media Engine <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e413fbfd-fc09-4b84-a8b9-231434e0681b?source=api-prod","affected":[{"type":"plugin","slug":"social-media-engine","name":"Social Media Engine","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:32:28Z"},{"id":"wordfence:e413fe96-ca6d-49b6-9fb8-59eb9a63e559","source":"wordfence","cve":"CVE-2026-61949","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e413fe96-ca6d-49b6-9fb8-59eb9a63e559?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.7","to_inclusive":true,"patched_in":"27.8"}],"published":"2026-07-16T00:00:00Z","updated":"2026-07-21T18:02:21Z"},{"id":"wordfence:e414a36f-7212-47b9-8e7f-6bf0ae6518af","source":"wordfence","cve":"CVE-2021-24947","title":"RVM - Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read","severity":"high","cvss":7.7,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e414a36f-7212-47b9-8e7f-6bf0ae6518af?source=api-prod","affected":[{"type":"plugin","slug":"responsive-vector-maps","name":"RVM \u2013 Responsive Vector Maps","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e416f70f-4f62-4abf-990e-acef51c603c0","source":"wordfence","cve":"CVE-2025-39479","title":"Smart Notification <= 10.3 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e416f70f-4f62-4abf-990e-acef51c603c0?source=api-prod","affected":[{"type":"plugin","slug":"smio-push-notification","name":"Smart Notification Wordpress Plugin. Web & Mobile Push, FB Messenger, FB Notifications & Newsletter.","from":"*","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T15:05:01Z"},{"id":"wordfence:e4188b26-80f8-41b8-be19-1ddcbd7e39f5","source":"wordfence","cve":"CVE-2025-14657","title":"Eventin \u2013 Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.51","to_inclusive":true,"patched_in":"4.0.52"}],"published":"2026-01-08T18:45:19Z","updated":"2026-01-09T07:22:31Z"},{"id":"wordfence:e41965eb-f8eb-4f40-b8f6-e415dff048cd","source":"wordfence","cve":"CVE-2025-14445","title":"Image Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e41965eb-f8eb-4f40-b8f6-e415dff048cd?source=api-prod","affected":[{"type":"plugin","slug":"devvn-image-hotspot","name":"Image Hotspot by DevVN","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T04:36:25Z"},{"id":"wordfence:e419d65b-709e-4d24-bed9-2412c4c8423f","source":"wordfence","cve":"CVE-2025-67982","title":"Urna <= 2.5.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e419d65b-709e-4d24-bed9-2412c4c8423f?source=api-prod","affected":[{"type":"theme","slug":"urna","name":"Urna - All-in-one WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.12","to_inclusive":true,"patched_in":"2.5.13"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:00:17Z"},{"id":"wordfence:e421cb35-e9f4-43f3-a39e-d51d197bc279","source":"wordfence","cve":"CVE-2014-2265","title":"Contact Form 7 < 3.7.2 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e421cb35-e9f4-43f3-a39e-d51d197bc279?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7","name":"Contact Form 7","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":false,"patched_in":"3.7.2"}],"published":"2014-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e422aa58-a335-4734-bbcd-d400bd44bc89","source":"wordfence","cve":"CVE-2025-13365","title":"WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e422aa58-a335-4734-bbcd-d400bd44bc89?source=api-prod","affected":[{"type":"plugin","slug":"wp-hallo-welt","name":"WP Hallo Welt","from":"*","from_inclusive":true,"to":"1.4.","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T15:06:21Z","updated":"2025-12-20T03:20:25Z"},{"id":"wordfence:e424d27b-f719-4fbf-b4eb-83b42130666c","source":"wordfence","cve":"CVE-2025-13370","title":"ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e424d27b-f719-4fbf-b4eb-83b42130666c?source=api-prod","affected":[{"type":"plugin","slug":"projectlist","name":"ProjectList","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:13:13Z","updated":"2025-11-25T07:28:26Z"},{"id":"wordfence:e4260fd8-e634-4a11-9cf7-f0cb92fbbedb","source":"wordfence","cve":"CVE-2026-87836","title":"Comments Import & Export 2.1.11 - 2.5.3 - Authenticated (Author+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4260fd8-e634-4a11-9cf7-f0cb92fbbedb?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"2.1.11","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T20:12:03Z"},{"id":"wordfence:e42841dc-157f-45eb-8959-249326d50650","source":"wordfence","cve":"CVE-2021-24624","title":"MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 2.4.1 - Multiple Admin+ Cross Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e42841dc-157f-45eb-8959-249326d50650?source=api-prod","affected":[{"type":"plugin","slug":"mp3-music-player-by-sonaar","name":"MP3 Audio Player \u2013 Music Player, Podcast Player & Radio by Sonaar","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e42cef39-35d7-4ef5-99da-c34d3ccab667","source":"wordfence","cve":"CVE-2024-43120","title":"TypeSquare Webfonts <= 2.0.7 - Missing Authorization via typesquare_admin_init()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e42cef39-35d7-4ef5-99da-c34d3ccab667?source=api-prod","affected":[{"type":"plugin","slug":"xserver-typesquare-webfonts","name":"TypeSquare Webfonts for \u30a8\u30c3\u30af\u30b9\u30b5\u30fc\u30d0\u30fc","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:07:39Z"},{"id":"wordfence:e43234ac-d9e3-41d1-a833-bfbe2ac79d44","source":"wordfence","cve":"CVE-2026-32440","title":"Food < 2.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43234ac-d9e3-41d1-a833-bfbe2ac79d44?source=api-prod","affected":[{"type":"plugin","slug":"wp-food","name":"WP Food ordering and Restaurant Menu","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":false,"patched_in":"2.7.1"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:05:25Z"},{"id":"wordfence:e43482e1-7e11-49a6-bb44-0db421b51ed1","source":"wordfence","cve":"","title":"MobileChief \u2013 Mobile Site Builder <= 1.5.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43482e1-7e11-49a6-bb44-0db421b51ed1?source=api-prod","affected":[{"type":"plugin","slug":"mobilechief-mobile-site-creator","name":"MobileChief","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2013-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4358e2a-b7f6-44b6-a38a-5b27cb15e1cd","source":"wordfence","cve":"CVE-2024-0596","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4358e2a-b7f6-44b6-a38a-5b27cb15e1cd?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2024-02-09T00:00:00Z","updated":"2024-07-29T21:37:40Z"},{"id":"wordfence:e43713c7-32bd-4b82-a4da-6c02d91f3d3e","source":"wordfence","cve":"CVE-2024-27959","title":"APIExperts Square for WooCommerce <= 4.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43713c7-32bd-4b82-a4da-6c02d91f3d3e?source=api-prod","affected":[{"type":"plugin","slug":"woosquare","name":"WC Shop Sync \u2013 Square Payment Gateway and Product Synchronization for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.9","to_inclusive":true,"patched_in":"4.3"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:03:49Z"},{"id":"wordfence:e4376069-42c6-4bb6-a9df-93564da836b2","source":"wordfence","cve":"CVE-2025-62109","title":"Geo Controller <= 8.9.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4376069-42c6-4bb6-a9df-93564da836b2?source=api-prod","affected":[{"type":"plugin","slug":"cf-geoplugin","name":"Geo Controller \u2013 Geolocation & Geotargeting","from":"*","from_inclusive":true,"to":"8.9.5","to_inclusive":true,"patched_in":"8.9.6"}],"published":"2025-12-08T00:00:00Z","updated":"2026-07-08T20:46:06Z"},{"id":"wordfence:e437ef90-5321-4543-a4ef-716b898315eb","source":"wordfence","cve":"CVE-2022-1578","title":"My wpdb <= 1.1.12 - Cross-Site Request Forgery to Arbitrary SQL Query Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e437ef90-5321-4543-a4ef-716b898315eb?source=api-prod","affected":[{"type":"plugin","slug":"my-wpdb","name":"My wpdb","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":false,"patched_in":"2.5"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4383f41-bd08-4fab-9491-4cf9f7326300","source":"wordfence","cve":"CVE-2023-46082","title":"Broken Link Checker | Finder <= 2.4.2 - Missing Authorization via moblc_auth_save_settings","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4383f41-bd08-4fab-9491-4cf9f7326300?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-finder","name":"Broken Link Checker | Finder","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4386de2-4fce-4fdd-a067-73e3baf89994","source":"wordfence","cve":"CVE-2026-121380","title":"Tournamatch <= 4.7.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4386de2-4fce-4fdd-a067-73e3baf89994?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:42:25Z"},{"id":"wordfence:e438a090-1a73-450d-9325-276e45eee9ee","source":"wordfence","cve":"","title":"Gallery \u2013 Photo Albums Plugin < 1.3.03 - Multiple Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e438a090-1a73-450d-9325-276e45eee9ee?source=api-prod","affected":[{"type":"plugin","slug":"easy-media-gallery","name":"Gallery \u2013 Photo Albums Plugin","from":"*","from_inclusive":true,"to":"1.3.03","to_inclusive":false,"patched_in":"1.3.03"}],"published":"2014-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4396411-57a2-4bef-9dfb-cbcdc1292de0","source":"wordfence","cve":"CVE-2026-9048","title":"Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4396411-57a2-4bef-9dfb-cbcdc1292de0?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"7.0.0","from_inclusive":true,"to":"7.0.14","to_inclusive":true,"patched_in":"7.0.15"}],"published":"2026-06-01T10:41:53Z","updated":"2026-06-01T23:28:27Z"},{"id":"wordfence:e43df95c-761a-460c-a3ac-da60383b067d","source":"wordfence","cve":"CVE-2026-73380","title":"Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43df95c-761a-460c-a3ac-da60383b067d?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":"1.13.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:34:31Z"},{"id":"wordfence:e43ef822-11d4-417b-845b-8d4bfecdc586","source":"wordfence","cve":"CVE-2026-57775","title":"Simple CAPTCHA with Cloudflare Turnstile <= 1.44.1 - Unauthenticated CAPTCHA Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43ef822-11d4-417b-845b-8d4bfecdc586?source=api-prod","affected":[{"type":"plugin","slug":"simple-cloudflare-turnstile","name":"Simple CAPTCHA with Cloudflare Turnstile","from":"*","from_inclusive":true,"to":"1.44.1","to_inclusive":true,"patched_in":"1.44.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T15:58:02Z"},{"id":"wordfence:e43f61e5-4b74-47d7-ad54-a8df682d1f75","source":"wordfence","cve":"CVE-2025-68024","title":"Addonify \u2013 WooCommerce Wishlist <= 2.0.15 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43f61e5-4b74-47d7-ad54-a8df682d1f75?source=api-prod","affected":[{"type":"plugin","slug":"addonify-wishlist","name":"Addonify \u2013 WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.16"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-25T14:38:29Z"},{"id":"wordfence:e43fb223-8b0a-4232-8e15-43f8b38652c1","source":"wordfence","cve":"CVE-2023-23675","title":"WP Smart Preloader <= 1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e43fb223-8b0a-4232-8e15-43f8b38652c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-smart-preloader","name":"WP Smart Preloader","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.15.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e44004a9-c705-4e97-83e2-f7db4311a978","source":"wordfence","cve":"CVE-2025-23933","title":"WpF Ultimate Carousel <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44004a9-c705-4e97-83e2-f7db4311a978?source=api-prod","affected":[{"type":"plugin","slug":"wpf-ultimate-carousel","name":"WpF Ultimate Carousel","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:47:18Z"},{"id":"wordfence:e4414b5d-9ce5-4378-ab41-c82ae3bebd6e","source":"wordfence","cve":"CVE-2022-1123","title":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.4 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4414b5d-9ce5-4378-ab41-c82ae3bebd6e?source=api-prod","affected":[{"type":"plugin","slug":"leaflet-maps-marker","name":"Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)","from":"*","from_inclusive":true,"to":"3.12.4","to_inclusive":true,"patched_in":"3.12.5"}],"published":"2022-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4421c1b-742c-4307-9736-d6263bab4ae4","source":"wordfence","cve":"CVE-2022-3395","title":"WP ALL Export Pro <= 1.7.8 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4421c1b-742c-4307-9736-d6263bab4ae4?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e44403cd-1cee-43c4-aabc-3eaad433c020","source":"wordfence","cve":"CVE-2026-0743","title":"WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44403cd-1cee-43c4-aabc-3eaad433c020?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-permission","name":"WP Content Permission","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:40:00Z","updated":"2026-02-04T08:25:32Z"},{"id":"wordfence:e4457df6-81ca-4149-bcca-623cff2cbeef","source":"wordfence","cve":"CVE-2023-52186","title":"WooCommerce Product Vendors <= 2.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4457df6-81ca-4149-bcca-623cff2cbeef?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4482f92-024d-402d-9cf3-c4709f23baf0","source":"wordfence","cve":"CVE-2026-40743","title":"Tutor LMS \u2013 eLearning and online course solution <= 3.9.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4482f92-024d-402d-9cf3-c4709f23baf0?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:02:05Z"},{"id":"wordfence:e44a73d3-9e0b-4fa7-ab1f-c6751e541559","source":"wordfence","cve":"CVE-2025-58024","title":"Accordion FAQ <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44a73d3-9e0b-4fa7-ab1f-c6751e541559?source=api-prod","affected":[{"type":"plugin","slug":"pressapps-accordion-faq","name":"pressapps-accordion-faq","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:31:07Z"},{"id":"wordfence:e44ad307-2663-4613-ae53-9ef6208f08f9","source":"wordfence","cve":"CVE-2023-49820","title":"Structured Content <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44ad307-2663-4613-ae53-9ef6208f08f9?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e44c5dc0-6bf6-417a-9383-b345ff57ac32","source":"wordfence","cve":"CVE-2024-9234","title":"GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44c5dc0-6bf6-417a-9383-b345ff57ac32?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:21Z"},{"id":"wordfence:e44dbd0e-d6a7-438b-b1bf-a6628734fec4","source":"wordfence","cve":"CVE-2026-4138","title":"DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44dbd0e-d6a7-438b-b1bf-a6628734fec4?source=api-prod","affected":[{"type":"plugin","slug":"dx-unanswered-comments","name":"DX Unanswered Comments","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2026-04-21T19:05:53Z","updated":"2026-07-08T20:47:05Z"},{"id":"wordfence:e44dd0e8-e6e7-4a2d-b9ca-abd1de273092","source":"wordfence","cve":"CVE-2024-9698","title":"Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44dd0e8-e6e7-4a2d-b9ca-abd1de273092?source=api-prod","affected":[{"type":"plugin","slug":"crafthemes-demo-import","name":"Crafthemes Demo Import","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:54:19Z","updated":"2024-12-14T04:23:49Z"},{"id":"wordfence:e44e4bdd-d84e-4315-9232-48a3b240242d","source":"wordfence","cve":"CVE-2024-2194","title":"WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44e4bdd-d84e-4315-9232-48a3b240242d?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"14.5","to_inclusive":true,"patched_in":"14.5.1"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:27:20Z"},{"id":"wordfence:e44ec291-5fb3-4999-9def-c7c4b141fb0b","source":"wordfence","cve":"CVE-2026-28123","title":"Veil - Wedding & Photographer WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e44ec291-5fb3-4999-9def-c7c4b141fb0b?source=api-prod","affected":[{"type":"theme","slug":"veil","name":"Veil - Wedding & Photographer WordPress Theme","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-02-26T00:00:00Z","updated":"2026-03-05T14:34:08Z"},{"id":"wordfence:e451df35-8448-4791-859e-969dc97a1aa8","source":"wordfence","cve":"CVE-2024-53737","title":"WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e451df35-8448-4791-859e-969dc97a1aa8?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.8.16.0","to_inclusive":true,"patched_in":"1.8.17.0"}],"published":"2024-11-23T00:00:00Z","updated":"2024-12-12T18:26:23Z"},{"id":"wordfence:e45207af-3886-4d95-9cd8-5ecdc683dc58","source":"wordfence","cve":"CVE-2024-10857","title":"Product Input Fields for WooCommerce <= 1.9 -  Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-35","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e45207af-3886-4d95-9cd8-5ecdc683dc58?source=api-prod","affected":[{"type":"plugin","slug":"product-input-fields-for-woocommerce","name":"Product Input Fields for WooCommerce","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-11-25T17:39:13Z","updated":"2024-11-26T06:43:46Z"},{"id":"wordfence:e452886b-d49a-4363-9d9b-f922bcd902ca","source":"wordfence","cve":"CVE-2025-9115","title":"Etsy Shop <= 3.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e452886b-d49a-4363-9d9b-f922bcd902ca?source=api-prod","affected":[{"type":"plugin","slug":"etsy-shop","name":"Etsy Shop","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-25T19:19:11Z"},{"id":"wordfence:e4533e0c-1684-4ca4-ac22-850e07620102","source":"wordfence","cve":"CVE-2026-77016","title":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4533e0c-1684-4ca4-ac22-850e07620102?source=api-prod","affected":[{"type":"plugin","slug":"workeera-remote-tech-job-board","name":"Workeera \u2013 AI Job Board with Applicant Tracking System (ATS)","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":false,"patched_in":"1.0.6"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T14:57:11Z"},{"id":"wordfence:e456b08d-ccb9-40b8-9c36-d4b2f7f7fb91","source":"wordfence","cve":"CVE-2026-8422","title":"Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e456b08d-ccb9-40b8-9c36-d4b2f7f7fb91?source=api-prod","affected":[{"type":"plugin","slug":"remove-meta-boxes-per-user-role","name":"Remove meta boxes per user role","from":"*","from_inclusive":true,"to":"1.01","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:43:09Z","updated":"2026-06-02T07:48:32Z"},{"id":"wordfence:e456b8c8-ba4a-4199-b006-c6be381b6ef8","source":"wordfence","cve":"CVE-2026-15346","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e456b8c8-ba4a-4199-b006-c6be381b6ef8?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.13","to_inclusive":true,"patched_in":"1.8.14"}],"published":"2026-07-23T19:03:55Z","updated":"2026-07-24T07:53:37Z"},{"id":"wordfence:e458b2d6-ce72-41f8-9fc9-50156bb72895","source":"wordfence","cve":"CVE-2025-32574","title":"WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e458b2d6-ce72-41f8-9fc9-50156bb72895?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"65.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-07-17T13:49:27Z"},{"id":"wordfence:e458ccae-7f42-4a8c-8020-01046d80c3fa","source":"wordfence","cve":"CVE-2026-109883","title":"Elementor Website Builder \u2013 more than just a page builder <= 4.3.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e458ccae-7f42-4a8c-8020-01046d80c3fa?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-11-04T11:55:38Z","updated":"2026-11-10T19:11:50Z"},{"id":"wordfence:e4595a79-c7d0-4e37-b19b-9ae985c9d713","source":"wordfence","cve":"CVE-2024-13815","title":"Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4595a79-c7d0-4e37-b19b-9ae985c9d713?source=api-prod","affected":[{"type":"theme","slug":"listingo","name":"Listingo","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:11:23Z","updated":"2025-03-05T09:21:49Z"},{"id":"wordfence:e45afda4-447a-4d95-90cb-9731b398a009","source":"wordfence","cve":"CVE-2025-2801","title":"Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e45afda4-447a-4d95-90cb-9731b398a009?source=api-prod","affected":[{"type":"plugin","slug":"abcsubmit","name":"Create custom forms for WordPress with a smart form plugin for smart businesses \u2013 Form builder for WordPress","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T15:01:19Z","updated":"2025-04-26T03:24:24Z"},{"id":"wordfence:e45bcb67-5ea7-48e7-bf65-e26416866530","source":"wordfence","cve":"CVE-2025-28954","title":"Backwp <= 2.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e45bcb67-5ea7-48e7-bf65-e26416866530?source=api-prod","affected":[{"type":"plugin","slug":"backwp","name":"Backwp","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T14:59:52Z"},{"id":"wordfence:e45dd9f6-9cc6-42d0-b03f-65fda85425f2","source":"wordfence","cve":"CVE-2024-53780","title":"Load More Posts <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e45dd9f6-9cc6-42d0-b03f-65fda85425f2?source=api-prod","affected":[{"type":"plugin","slug":"load-more-posts","name":"Load More Posts","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:11:50Z"},{"id":"wordfence:e45e0ff1-3e74-4eee-a4ff-8ec033599bc3","source":"wordfence","cve":"CVE-2025-10136","title":"TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e45e0ff1-3e74-4eee-a4ff-8ec033599bc3?source=api-prod","affected":[{"type":"plugin","slug":"tweetthis-shortcode","name":"TweetThis Shortcode","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-25T18:41:30Z","updated":"2025-09-26T06:43:29Z"},{"id":"wordfence:e46139c8-dd7e-4904-81b2-283952cea9b5","source":"wordfence","cve":"CVE-2023-25483","title":"Easy Coming Soon <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46139c8-dd7e-4904-81b2-283952cea9b5?source=api-prod","affected":[{"type":"plugin","slug":"easy-coming-soon","name":"Easy Coming Soon","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e462a7ba-887c-408d-87a6-9260a33dcff5","source":"wordfence","cve":"CVE-2026-7544","title":"Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e462a7ba-887c-408d-87a6-9260a33dcff5?source=api-prod","affected":[{"type":"plugin","slug":"2coders-integration-mux-video","name":"Mux Video Uploader","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-07-10T14:18:37Z","updated":"2026-07-11T02:31:20Z"},{"id":"wordfence:e4632899-c3bf-48f3-8a69-8fa32bfd902d","source":"wordfence","cve":"CVE-2025-1279","title":"BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4632899-c3bf-48f3-8a69-8fa32bfd902d?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.16.2.1","to_inclusive":true,"patched_in":"3.16.3"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T08:22:13Z"},{"id":"wordfence:e46513d2-65d0-4215-99a7-051603ec4569","source":"wordfence","cve":"CVE-2023-46617","title":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46513d2-65d0-4215-99a7-051603ec4569?source=api-prod","affected":[{"type":"plugin","slug":"adfoxly","name":"AdFoxly \u2013 Ad Manager, AdSense Ads & Ads.txt","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e466640e-de66-42f0-b56b-226db32d382d","source":"wordfence","cve":"CVE-2026-1455","title":"Whatsiplus Scheduled Notification for Woocommerce <= 1.0.1 - Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e466640e-de66-42f0-b56b-226db32d382d?source=api-prod","affected":[{"type":"plugin","slug":"whatsiplus-scheduled-notification-for-woocommerce","name":"Whatsiplus Scheduled Notification for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:52:18Z","updated":"2026-02-19T04:36:25Z"},{"id":"wordfence:e46732ac-1aa4-434d-8c49-7ed065bc907b","source":"wordfence","cve":"CVE-2018-11485","title":"Advance Search for WooCommerce < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46732ac-1aa4-434d-8c49-7ed065bc907b?source=api-prod","affected":[{"type":"plugin","slug":"woo-advance-search","name":"Advance Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2018-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4696f7a-8b87-4376-b4c9-596eca30b38c","source":"wordfence","cve":"CVE-2023-5470","title":"Etsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4696f7a-8b87-4376-b4c9-596eca30b38c?source=api-prod","affected":[{"type":"plugin","slug":"etsy-shop","name":"Etsy Shop","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e46a18b8-f624-4d31-ad99-c543c6a31390","source":"wordfence","cve":"CVE-2025-48118","title":"Woocommerce Partial Shipment <= 3.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46a18b8-f624-4d31-ad99-c543c6a31390?source=api-prod","affected":[{"type":"plugin","slug":"wc-partial-shipment","name":"Partial Shipment for WooCommerce","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-25T13:59:44Z"},{"id":"wordfence:e46a2031-e304-43fb-85bf-ec9abf0b2f90","source":"wordfence","cve":"CVE-2023-49185","title":"Doofinder for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via tab","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46a2031-e304-43fb-85bf-ec9abf0b2f90?source=api-prod","affected":[{"type":"plugin","slug":"doofinder-for-woocommerce","name":"DOOFINDER Search and Discovery for WP & WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e46bd083-ed21-4e2a-b79d-62d9b3c7f1d0","source":"wordfence","cve":"CVE-2025-49876","title":"ProfileGrid  <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46bd083-ed21-4e2a-b79d-62d9b3c7f1d0?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.2","to_inclusive":true,"patched_in":"5.9.5.3"}],"published":"2025-07-10T00:00:00Z","updated":"2025-07-16T15:54:43Z"},{"id":"wordfence:e46e8a7e-4032-4357-9553-d03bdf168383","source":"wordfence","cve":"CVE-2024-37509","title":"MakeCommerce for WooCommerce <= 3.5.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46e8a7e-4032-4357-9553-d03bdf168383?source=api-prod","affected":[{"type":"plugin","slug":"makecommerce","name":"MakeCommerce for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T14:37:43Z"},{"id":"wordfence:e46ff294-0be1-47c1-8c21-f6242c6f832a","source":"wordfence","cve":"","title":"Import and export users and customers 1.15 - Sensitive Data Exposure","severity":"high","cvss":7.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e46ff294-0be1-47c1-8c21-f6242c6f832a?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"1.15","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.15.0.1"}],"published":"2020-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4704495-8342-4846-9242-f1eab4de25d6","source":"wordfence","cve":"CVE-2012-4271","title":"Bad Behavior < 2.0.47 & 2.2.0 - 2.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4704495-8342-4846-9242-f1eab4de25d6?source=api-prod","affected":[{"type":"plugin","slug":"bad-behavior","name":"Bad Behavior","from":"*","from_inclusive":true,"to":"2.0.47","to_inclusive":false,"patched_in":"2.0.47"},{"type":"plugin","slug":"bad-behavior","name":"Bad Behavior","from":"2.2.0","from_inclusive":true,"to":"2.2.5","to_inclusive":false,"patched_in":"2.0.47"}],"published":"2012-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4731811-23d7-4a8e-8db3-794077720545","source":"wordfence","cve":"","title":"Daisho Theme <= 4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4731811-23d7-4a8e-8db3-794077720545?source=api-prod","affected":[{"type":"theme","slug":"daisho","name":"Daisho","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e473f216-365b-494b-9be4-72671ac749f3","source":"wordfence","cve":"CVE-2026-116533","title":"Static Snapshot <= 0.2.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e473f216-365b-494b-9be4-72671ac749f3?source=api-prod","affected":[{"type":"plugin","slug":"static-snapshot","name":"Static Snapshot","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:19:42Z"},{"id":"wordfence:e474d270-af61-4229-9b14-c96f3b1954e1","source":"wordfence","cve":"CVE-2025-58924","title":"Geya - Renewable Energy & Ecology WordPress Theme <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e474d270-af61-4229-9b14-c96f3b1954e1?source=api-prod","affected":[{"type":"theme","slug":"geya","name":"Geya - Renewable Energy & Ecology WordPress Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:19:08Z"},{"id":"wordfence:e47509e8-d2b9-4f23-b02c-434762ddba95","source":"wordfence","cve":"CVE-2026-24635","title":"EduBlink Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e47509e8-d2b9-4f23-b02c-434762ddba95?source=api-prod","affected":[{"type":"plugin","slug":"edublink-core","name":"EduBlink Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T00:00:00Z","updated":"2026-02-03T21:07:58Z"},{"id":"wordfence:e475e420-7ab7-4f29-aacf-d758af90694c","source":"wordfence","cve":"CVE-2025-27338","title":"List Urls <= 0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e475e420-7ab7-4f29-aacf-d758af90694c?source=api-prod","affected":[{"type":"plugin","slug":"list-urls","name":"List Urls","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:37:10Z"},{"id":"wordfence:e4767df8-eafd-47cf-8c70-431db7a3a3f8","source":"wordfence","cve":"CVE-2025-30844","title":"Watu Quiz <= 3.4.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4767df8-eafd-47cf-8c70-431db7a3a3f8?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T19:18:27Z"},{"id":"wordfence:e4773d95-17ce-4c16-a1ba-953687ecb0b0","source":"wordfence","cve":"CVE-2024-56060","title":"HTML Forms <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4773d95-17ce-4c16-a1ba-953687ecb0b0?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-08T15:56:32Z"},{"id":"wordfence:e4785012-d160-42cc-bd06-d9b8e65652a4","source":"wordfence","cve":"CVE-2023-26523","title":"Calculated Fields Form <= 1.1.120 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4785012-d160-42cc-bd06-d9b8e65652a4?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"1.1.120","to_inclusive":true,"patched_in":"1.1.121"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e47f6c33-1a4b-4c4c-8323-99d06ce0731a","source":"wordfence","cve":"CVE-2021-24236","title":"Imagements <= 1.2.5 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e47f6c33-1a4b-4c4c-8323-99d06ce0731a?source=api-prod","affected":[{"type":"plugin","slug":"imagements","name":"Imagements","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2021-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4800875-6e1b-4aee-b68d-1bcfa509c470","source":"wordfence","cve":"CVE-2026-102381","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4800875-6e1b-4aee-b68d-1bcfa509c470?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-10-01T12:27:00Z","updated":"2026-10-08T23:11:17Z"},{"id":"wordfence:e48142c2-3688-4638-abfc-1e191f362055","source":"wordfence","cve":"CVE-2024-43159","title":"Masteriyo - LMS <= 1.11.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e48142c2-3688-4638-abfc-1e191f362055?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"1.11.6","to_inclusive":true,"patched_in":"1.12.0"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:47:46Z"},{"id":"wordfence:e481c916-0789-4b04-a7f8-dbde554a5e8c","source":"wordfence","cve":"CVE-2022-0876","title":"Social comments by WpDevArt <= 2.4.9 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e481c916-0789-4b04-a7f8-dbde554a5e8c?source=api-prod","affected":[{"type":"plugin","slug":"comments-from-facebook","name":"Social comments by WpDevArt","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2022-04-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e485949f-f48e-4a8c-b799-d1a41f36848c","source":"wordfence","cve":"CVE-2023-23898","title":"Blocksy Companion <= 1.8.67 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e485949f-f48e-4a8c-b799-d1a41f36848c?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"1.8.68","to_inclusive":false,"patched_in":"1.8.68"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e485f089-689f-4f73-bb0d-eca6815388be","source":"wordfence","cve":"CVE-2018-21014","title":"BuddyBoss Media <= 3.2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e485f089-689f-4f73-bb0d-eca6815388be?source=api-prod","affected":[{"type":"plugin","slug":"buddyboss-media","name":"BuddyBoss Media","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2018-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e486b0b5-5ee6-4ea2-bf0d-45a4302ce20f","source":"wordfence","cve":"CVE-2025-23870","title":"Copyright Safeguard Footer Notice <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e486b0b5-5ee6-4ea2-bf0d-45a4302ce20f?source=api-prod","affected":[{"type":"plugin","slug":"copyright-safeguard-footer-notice","name":"Copyright Safeguard Footer Notice","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:51:33Z"},{"id":"wordfence:e4889359-6311-4d21-ad67-e2a5bcbadd22","source":"wordfence","cve":"CVE-2024-49632","title":"CWD 3D Image Gallery <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4889359-6311-4d21-ad67-e2a5bcbadd22?source=api-prod","affected":[{"type":"plugin","slug":"cwd-3d-image-gallery","name":"CWD 3D Image Gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:53:15Z"},{"id":"wordfence:e489960e-254a-4b8d-85ab-0f749ff48e8c","source":"wordfence","cve":"CVE-2022-41634","title":"Media Library Folders <= 7.1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e489960e-254a-4b8d-85ab-0f749ff48e8c?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2022-09-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e489a90e-f226-4900-938c-b5a7550d199c","source":"wordfence","cve":"CVE-2023-36677","title":"SP Project & Document Manager  <= 4.67 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e489a90e-f226-4900-938c-b5a7550d199c?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.67","to_inclusive":true,"patched_in":"4.68"}],"published":"2023-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e48ab98a-7fbd-4199-821c-e8634175689a","source":"wordfence","cve":"CVE-2026-96518","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.17.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e48ab98a-7fbd-4199-821c-e8634175689a?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.3","to_inclusive":true,"patched_in":"4.17.4"}],"published":"2026-10-02T07:49:10Z","updated":"2026-10-13T14:49:48Z"},{"id":"wordfence:e48ce7d2-0c57-499a-81b6-2d9488de704c","source":"wordfence","cve":"CVE-2026-13080","title":"WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter","severity":"medium","cvss":6.6,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e48ce7d2-0c57-499a-81b6-2d9488de704c?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.12.7","to_inclusive":true,"patched_in":"3.12.8"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T06:52:50Z"},{"id":"wordfence:e4905c33-3e6b-4331-aeea-d2083f4788bf","source":"wordfence","cve":"CVE-2025-31394","title":"More Mime Type Filters <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4905c33-3e6b-4331-aeea-d2083f4788bf?source=api-prod","affected":[{"type":"plugin","slug":"more-mime-type-filters","name":"More Mime Type Filters","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:43:48Z"},{"id":"wordfence:e491cdac-4946-41aa-91c1-92e56e862090","source":"wordfence","cve":"CVE-2025-47498","title":"Hotel Booking <= 3.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e491cdac-4946-41aa-91c1-92e56e862090?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:44:26Z"},{"id":"wordfence:e492029d-6613-4881-b986-9fe14cb2cf74","source":"wordfence","cve":"CVE-2025-4204","title":"Ultimate Auction Pro <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e492029d-6613-4881-b986-9fe14cb2cf74?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-woocommerce-auction-pro","name":"Ultimate Auction Pro","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-05-01T19:10:28Z","updated":"2025-05-02T12:23:48Z"},{"id":"wordfence:e4930b03-9142-464e-98ae-a910dfa46f2a","source":"wordfence","cve":"CVE-2024-2341","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4930b03-9142-464e-98ae-a910dfa46f2a?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.7.7","to_inclusive":true,"patched_in":"1.6.7.9"}],"published":"2024-03-20T00:00:00Z","updated":"2024-04-09T18:59:30Z"},{"id":"wordfence:e493d822-6f0c-4349-9af0-6095199a3b51","source":"wordfence","cve":"CVE-2025-67538","title":"JNews Gallery < 12.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e493d822-6f0c-4349-9af0-6095199a3b51?source=api-prod","affected":[{"type":"plugin","slug":"jnews-gallery","name":"JNews Gallery","from":"*","from_inclusive":true,"to":"12.0.1","to_inclusive":false,"patched_in":"12.0.1"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:51:51Z"},{"id":"wordfence:e4941cce-c6c0-4e8a-859e-cf0f50f92ce6","source":"wordfence","cve":"CVE-2022-0434","title":"Page Views Count  Plugin <= 2.4.14 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4941cce-c6c0-4e8a-859e-cf0f50f92ce6?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":false,"patched_in":"2.4.15"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4953824-02e8-46cb-a4a8-4fe3746d900c","source":"wordfence","cve":"CVE-2025-49245","title":"Testimonials Showcase <= 1.9.16 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4953824-02e8-46cb-a4a8-4fe3746d900c?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-showcase","name":"Testimonials Showcase","from":"*","from_inclusive":true,"to":"1.9.16","to_inclusive":true,"patched_in":"1.9.18"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:05:54Z"},{"id":"wordfence:e495507d-7eac-4f38-ab6f-b8f0809b2be4","source":"wordfence","cve":"CVE-2024-8522","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e495507d-7eac-4f38-ab6f-b8f0809b2be4?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7","to_inclusive":true,"patched_in":"4.2.7.1"}],"published":"2024-09-11T00:00:00Z","updated":"2025-03-24T15:07:22Z"},{"id":"wordfence:e495c215-2e01-4a37-aca3-99a067c46791","source":"wordfence","cve":"CVE-2026-8976","title":"RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e495c215-2e01-4a37-aca3-99a067c46791?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-06-05T10:46:18Z","updated":"2026-06-05T23:28:28Z"},{"id":"wordfence:e4966f96-713c-471f-8f36-55977a547f12","source":"wordfence","cve":"CVE-2022-3600","title":"Easy Digital Downloads <= 3.1.0.1.1 - Unauthenticated CSV Injection","severity":"high","cvss":8.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4966f96-713c-471f-8f36-55977a547f12?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.1.0.1.1","to_inclusive":true,"patched_in":"3.1.0.2"}],"published":"2022-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e496d38d-2cf6-458d-baaf-c55697856d52","source":"wordfence","cve":"CVE-2026-103071","title":"Thanko Thank You Page Customizer for WooCommerce <= 1.2.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e496d38d-2cf6-458d-baaf-c55697856d52?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:24:42Z"},{"id":"wordfence:e4986b06-f5a5-4d0a-8e7b-924ec24b090c","source":"wordfence","cve":"CVE-2026-57659","title":"Paid Memberships Pro - Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4986b06-f5a5-4d0a-8e7b-924ec24b090c?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-add-member-admin","name":"Paid Memberships Pro - Add Member From Admin","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":true,"patched_in":"0.7.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:07:31Z"},{"id":"wordfence:e499408c-c4c5-465c-b883-50d449d684e0","source":"wordfence","cve":"CVE-2025-49983","title":"WPThumb <= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e499408c-c4c5-465c-b883-50d449d684e0?source=api-prod","affected":[{"type":"plugin","slug":"wp-thumb","name":"WPThumb","from":"*","from_inclusive":true,"to":"0.10","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T19:28:54Z"},{"id":"wordfence:e49c7b2a-5241-4762-b7c9-c33b1ac4a668","source":"wordfence","cve":"CVE-2025-1315","title":"InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e49c7b2a-5241-4762-b7c9-c33b1ac4a668?source=api-prod","affected":[{"type":"plugin","slug":"iwjob","name":"InWave Jobs","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-06T19:32:50Z","updated":"2025-03-07T08:21:27Z"},{"id":"wordfence:e49da9e7-26a1-442b-b5d0-1da3bcf0e8c9","source":"wordfence","cve":"CVE-2024-1988","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel \u2013 Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e49da9e7-26a1-442b-b5d0-1da3bcf0e8c9?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.80","to_inclusive":true,"patched_in":"2.2.81"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-07T03:29:46Z"},{"id":"wordfence:e49e7cdf-93ca-415f-ba83-986cbb869220","source":"wordfence","cve":"CVE-2024-11265","title":"Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e49e7cdf-93ca-415f-ba83-986cbb869220?source=api-prod","affected":[{"type":"plugin","slug":"wp-maximum-upload-file-size","name":"EasyMedia \u2013 Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-11-22T17:05:12Z","updated":"2024-11-23T05:40:12Z"},{"id":"wordfence:e49f2068-5bc0-44f7-983c-82917addd904","source":"wordfence","cve":"CVE-2026-14844","title":"Master Slider < 3.11.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e49f2068-5bc0-44f7-983c-82917addd904?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.11.5","to_inclusive":false,"patched_in":"3.11.5"}],"published":"2026-09-18T00:00:00Z","updated":"2026-10-13T17:00:57Z"},{"id":"wordfence:e4a00ad0-5761-4fb7-a4e6-cb213cf32cb2","source":"wordfence","cve":"CVE-2024-9613","title":"FormFacade \u2013 WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a00ad0-5761-4fb7-a4e6-cb213cf32cb2?source=api-prod","affected":[{"type":"plugin","slug":"formfacade","name":"FormFacade \u2013 Embed Google Forms in your website","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-10-25T13:59:02Z","updated":"2024-11-11T15:18:35Z"},{"id":"wordfence:e4a2c3cf-0785-4bf0-9ad8-0d2479545067","source":"wordfence","cve":"CVE-2021-24665","title":"WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a2c3cf-0785-4bf0-9ad8-0d2479545067?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2021-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4a2d6ee-ee1b-44a1-ad74-61837d9ef4b2","source":"wordfence","cve":"CVE-2021-25019","title":"SEO Plugin by Squirrly SEO <= 11.1.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a2d6ee-ee1b-44a1-ad74-61837d9ef4b2?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"11.1.12","to_inclusive":false,"patched_in":"11.1.12"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4a32267-6d99-4882-8601-8c4d36575e0f","source":"wordfence","cve":"CVE-2013-3491","title":"Sharebar <= 1.4.2 -  Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a32267-6d99-4882-8601-8c4d36575e0f?source=api-prod","affected":[{"type":"plugin","slug":"sharebar","name":"Sharebar","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2013-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4a32fdc-1c72-45fc-bb57-44f6888e0885","source":"wordfence","cve":"CVE-2023-44257","title":"Mang Board WP <= 1.8.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a32fdc-1c72-45fc-bb57-44f6888e0885?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2023-09-27T00:00:00Z","updated":"2024-03-11T09:06:49Z"},{"id":"wordfence:e4a5dc4f-3eb6-410e-af3d-e3b0639319f3","source":"wordfence","cve":"CVE-2024-27193","title":"PayU India <= 3.8.8 - Reflected Cross-Site Scripting via type","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a5dc4f-3eb6-410e-af3d-e3b0639319f3?source=api-prod","affected":[{"type":"plugin","slug":"payu-india","name":"PayU India","from":"*","from_inclusive":true,"to":"3.8.8","to_inclusive":true,"patched_in":"3.8.9"}],"published":"2024-02-26T00:00:00Z","updated":"2026-03-17T21:18:39Z"},{"id":"wordfence:e4a853e0-0ebc-4ed5-b6ff-ce3973fb3ee1","source":"wordfence","cve":"CVE-2023-6000","title":"Popup Builder <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a853e0-0ebc-4ed5-b6ff-ce3973fb3ee1?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2023-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4a8a202-e44a-4874-9e7a-c8224edd8591","source":"wordfence","cve":"CVE-2021-24677","title":"Find My Blocks < 3.4.0 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a8a202-e44a-4874-9e7a-c8224edd8591?source=api-prod","affected":[{"type":"plugin","slug":"find-my-blocks","name":"Find My Blocks \u2013 Locate blocks on your site","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":false,"patched_in":"3.4.0"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4ac5f28-8727-4205-abe5-7f29a0c4dc5d","source":"wordfence","cve":"CVE-2026-2501","title":"Ed's Social Share <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ac5f28-8727-4205-abe5-7f29a0c4dc5d?source=api-prod","affected":[{"type":"plugin","slug":"eds-social-share","name":"Ed's Social Share","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.0.1"}],"published":"2026-03-20T15:15:30Z","updated":"2026-07-08T20:52:18Z"},{"id":"wordfence:e4ae2b7d-e48d-4880-9202-6e564a3b404f","source":"wordfence","cve":"CVE-2024-43230","title":"Shared Files <= 1.7.28 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ae2b7d-e48d-4880-9202-6e564a3b404f?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.28","to_inclusive":true,"patched_in":"1.7.29"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:44:14Z"},{"id":"wordfence:e4af4769-f897-4d44-93d4-9dbb6f142678","source":"wordfence","cve":"CVE-2026-39693","title":"FSM Custom Featured Image Caption <= 1.25.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4af4769-f897-4d44-93d4-9dbb6f142678?source=api-prod","affected":[{"type":"plugin","slug":"fsm-custom-featured-image-caption","name":"FSM Custom Featured Image Caption","from":"*","from_inclusive":true,"to":"1.25.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:31:00Z"},{"id":"wordfence:e4b10172-7e54-4ff8-9fbb-41d160ce49e4","source":"wordfence","cve":"CVE-2023-4719","title":"Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b16cf2-7e29-47c5-921e-188e2db33084","source":"wordfence","cve":"CVE-2019-15867","title":"Slick Popup <= 1.7.1 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-798","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b16cf2-7e29-47c5-921e-188e2db33084?source=api-prod","affected":[{"type":"plugin","slug":"slick-popup","name":"Slick Popup: Contact Form 7 Popup Plugin","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2019-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b2178f-e4da-4bfb-9c27-8c1884499769","source":"wordfence","cve":"CVE-2026-6177","title":"Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b2178f-e4da-4bfb-9c27-8c1884499769?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-05-12T00:00:00Z","updated":"2026-05-13T12:29:56Z"},{"id":"wordfence:e4b2d8f5-409c-4964-aba3-ca2923fa8ffc","source":"wordfence","cve":"CVE-2025-58945","title":"EcoGrow <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b2d8f5-409c-4964-aba3-ca2923fa8ffc?source=api-prod","affected":[{"type":"theme","slug":"ecogrow","name":"EcoGrow - Green Farming & Agriculture WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:35:36Z"},{"id":"wordfence:e4b3b3be-0c3a-43d0-b7d3-3f61b09175f2","source":"wordfence","cve":"CVE-2025-30573","title":"My Default Post Content <= 0.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b3b3be-0c3a-43d0-b7d3-3f61b09175f2?source=api-prod","affected":[{"type":"plugin","slug":"my-default-post-content","name":"My Default Post Content","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:53:37Z"},{"id":"wordfence:e4b4d08a-9f2c-4c81-bef7-14dced7af282","source":"wordfence","cve":"CVE-2026-66425","title":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b4d08a-9f2c-4c81-bef7-14dced7af282?source=api-prod","affected":[{"type":"plugin","slug":"gutena-forms","name":"Gutena Forms \u2013 Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T22:51:33Z"},{"id":"wordfence:e4b4e4ba-ab66-496a-b77f-8dd77cd16ea8","source":"wordfence","cve":"CVE-2024-10323","title":"JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b4e4ba-ab66-496a-b77f-8dd77cd16ea8?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2024-11-11T18:15:18Z","updated":"2024-11-12T06:48:15Z"},{"id":"wordfence:e4b6a9cd-4d29-4bd8-afa3-b5d455ad8340","source":"wordfence","cve":"CVE-2023-0895","title":"WP Coder \u2013 add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b6a9cd-4d29-4bd8-afa3-b5d455ad8340?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b7f31c-084e-489c-a902-c16e62b99e45","source":"wordfence","cve":"CVE-2022-1528","title":"VikBooking <= 1.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b7f31c-084e-489c-a902-c16e62b99e45?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":false,"patched_in":"1.5.9"}],"published":"2022-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b7fa61-f760-48f4-b30e-9c63f2d388f9","source":"wordfence","cve":"CVE-2024-51633","title":"Simple Page Specific Sidebars <= 2.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b7fa61-f760-48f4-b30e-9c63f2d388f9?source=api-prod","affected":[{"type":"plugin","slug":"page-specific-sidebars","name":"Simple Page Specific Sidebars","from":"*","from_inclusive":true,"to":"2.14.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T13:52:58Z"},{"id":"wordfence:e4b8947a-6c87-4430-b62d-494863e18fdb","source":"wordfence","cve":"CVE-2018-5665","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via logo_height parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b8947a-6c87-4430-b62d-494863e18fdb?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b94952-229c-4336-a985-d2f47c89f7de","source":"wordfence","cve":"CVE-2014-9176","title":"InstaSqueeze Sexy Squeeze Pages (All Known Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b94952-229c-4336-a985-d2f47c89f7de?source=api-prod","affected":[{"type":"plugin","slug":"instasqueeze","name":"InstaSqueeze Sexy Squeeze Pages","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4b9eeb9-7ce4-446d-8ac0-af9cea0c893a","source":"wordfence","cve":"CVE-2023-49148","title":"Affiliate Booster \u2013 Pros & Cons, Notice, and CTA Blocks for Affiliates <= 3.0.5 - Cross-Site Request Forgery via process_bulk_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b9eeb9-7ce4-446d-8ac0-af9cea0c893a?source=api-prod","affected":[{"type":"plugin","slug":"affiliatebooster-blocks","name":"AffiliatePages \u2013 Pros & Cons, Notice, and CTA Blocks for Affiliates","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2023-11-28T00:00:00Z","updated":"2024-03-14T14:25:29Z"},{"id":"wordfence:e4ba2243-8a4f-4ecb-8f77-6f4fd24865e3","source":"wordfence","cve":"CVE-2012-4242","title":"MF Gig Calendar <= 0.9.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ba2243-8a4f-4ecb-8f77-6f4fd24865e3?source=api-prod","affected":[{"type":"plugin","slug":"mf-gig-calendar","name":"MF Gig Calendar","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2012-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4baead0-7126-457a-abe0-0c9bf239ea15","source":"wordfence","cve":"CVE-2025-32516","title":"Related Videos for JW Player <= 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4baead0-7126-457a-abe0-0c9bf239ea15?source=api-prod","affected":[{"type":"plugin","slug":"related-videos-for-jw-player","name":"Related Videos for JW Player","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-04-10T00:00:00Z","updated":"2026-02-26T15:27:15Z"},{"id":"wordfence:e4bede17-d174-42d0-a25e-bf7fe10e4206","source":"wordfence","cve":"CVE-2025-39596","title":"Quentn WP <= 1.2.8 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bede17-d174-42d0-a25e-bf7fe10e4206?source=api-prod","affected":[{"type":"plugin","slug":"quentn-wp","name":"Quentn WP","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:27:01Z"},{"id":"wordfence:e4bfb72e-023b-4bfd-b125-91f6ac2f200f","source":"wordfence","cve":"CVE-2026-8713","title":"Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4bfb72e-023b-4bfd-b125-91f6ac2f200f?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.3","to_inclusive":true,"patched_in":"3.15.4"}],"published":"2026-06-18T16:14:13Z","updated":"2026-06-19T04:31:34Z"},{"id":"wordfence:e4c1d21f-424c-49c7-850b-15441cd8ee56","source":"wordfence","cve":"CVE-2025-49404","title":"Listeo-Core < 2.0.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c1d21f-424c-49c7-850b-15441cd8ee56?source=api-prod","affected":[{"type":"plugin","slug":"listeo-core","name":"Listeo-Core - Directory Plugin by Purethemes","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2025-08-20T00:00:00Z","updated":"2026-02-26T15:16:13Z"},{"id":"wordfence:e4c1e5eb-324e-4841-afd0-c59b319ddd0e","source":"wordfence","cve":"CVE-2026-84280","title":"Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c1e5eb-324e-4841-afd0-c59b319ddd0e?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2026-09-24T18:48:21Z","updated":"2026-09-25T07:40:29Z"},{"id":"wordfence:e4c27225-f9db-4ae5-bb1f-ce8648c216eb","source":"wordfence","cve":"CVE-2024-9218","title":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c27225-f9db-4ae5-bb1f-ce8648c216eb?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.3.14","to_inclusive":true,"patched_in":"1.3.15"}],"published":"2024-10-01T00:00:00Z","updated":"2024-10-02T08:31:51Z"},{"id":"wordfence:e4c31bcb-476f-4d20-a30c-fdaad4e4f769","source":"wordfence","cve":"CVE-2026-94498","title":"AppMySite \u2013 WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) <= 3.15.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c31bcb-476f-4d20-a30c-fdaad4e4f769?source=api-prod","affected":[{"type":"plugin","slug":"appmysite","name":"AppMySite \u2013 WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)","from":"*","from_inclusive":true,"to":"3.15.4","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-09-23T10:42:21Z","updated":"2026-09-29T19:51:11Z"},{"id":"wordfence:e4c58479-2924-4b56-9c27-3bdf4be388a3","source":"wordfence","cve":"CVE-2017-2551","title":"BackWPup <= 3.4.1 - Unauthenticated Backup Download","severity":"high","cvss":7.5,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c58479-2924-4b56-9c27-3bdf4be388a3?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2017-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4c7ca5c-38aa-4413-83eb-29185cca2a74","source":"wordfence","cve":"CVE-2026-6395","title":"Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7ca5c-38aa-4413-83eb-29185cca2a74?source=api-prod","affected":[{"type":"plugin","slug":"word-2-cash","name":"Word 2 Cash","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:03:57Z","updated":"2026-05-20T01:25:56Z"},{"id":"wordfence:e4c7d179-9b65-48da-b92e-11fb0629653a","source":"wordfence","cve":"CVE-2024-54219","title":"AIO Contact <= 2.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4c7d179-9b65-48da-b92e-11fb0629653a?source=api-prod","affected":[{"type":"plugin","slug":"aio-contact","name":"AIO Contact","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T18:14:51Z"},{"id":"wordfence:e4ca7dad-bfe2-443e-b575-362d8ff93242","source":"wordfence","cve":"CVE-2024-13557","title":"Shortcodes by United Themes  <= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ca7dad-bfe2-443e-b575-362d8ff93242?source=api-prod","affected":[{"type":"plugin","slug":"ut-shortcodes","name":"Shortcodes by United Themes","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2025-03-28T18:55:46Z","updated":"2025-03-29T07:03:32Z"},{"id":"wordfence:e4cf42d3-9864-440b-8357-36c82cbef28f","source":"wordfence","cve":"CVE-2026-4136","title":"Membership Plugin \u2013 Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect","severity":"medium","cvss":4.3,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4cf42d3-9864-440b-8357-36c82cbef28f?source=api-prod","affected":[{"type":"plugin","slug":"restrict-content","name":"Membership Plugin \u2013 Kadence Memberships","from":"*","from_inclusive":true,"to":"3.2.24","to_inclusive":true,"patched_in":"3.2.25"}],"published":"2026-03-19T14:37:52Z","updated":"2026-03-20T03:37:02Z"},{"id":"wordfence:e4d22382-11c4-4e2b-9bfd-6bef5c5ff246","source":"wordfence","cve":"CVE-2026-105881","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d22382-11c4-4e2b-9bfd-6bef5c5ff246?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:44:55Z"},{"id":"wordfence:e4d2281a-7cbd-445e-8bb6-cfb72d7133c5","source":"wordfence","cve":"CVE-2025-58268","title":"WPMK PDF Generator <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d2281a-7cbd-445e-8bb6-cfb72d7133c5?source=api-prod","affected":[{"type":"plugin","slug":"wpmk-pdf-generator","name":"WPMK PDF Generator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:42:00Z"},{"id":"wordfence:e4d373f3-59ff-4543-86f2-f95efe8c7cdb","source":"wordfence","cve":"CVE-2024-51864","title":"Shortcode Collection <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d373f3-59ff-4543-86f2-f95efe8c7cdb?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-collection","name":"Shortcode Collection","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:00:08Z"},{"id":"wordfence:e4d51a0c-c625-4732-b345-df02971fbffa","source":"wordfence","cve":"CVE-2024-8420","title":"DHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d51a0c-c625-4732-b345-df02971fbffa?source=api-prod","affected":[{"type":"plugin","slug":"dhvc-form","name":"DHVC Form","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2025-02-27T00:00:00Z","updated":"2025-02-28T08:23:21Z"},{"id":"wordfence:e4d539a3-9fb0-4ab0-84c4-31fc68f69825","source":"wordfence","cve":"CVE-2026-62114","title":"Passster \u2013 Password Protect Pages and Content <= 4.3.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d539a3-9fb0-4ab0-84c4-31fc68f69825?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:27:07Z"},{"id":"wordfence:e4d55309-d178-4b3d-9de6-2cf2769b76fe","source":"wordfence","cve":"CVE-2024-6870","title":"Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d55309-d178-4b3d-9de6-2cf2769b76fe?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"2.4.7","to_inclusive":true,"patched_in":"2.4.8"}],"published":"2024-08-21T21:21:39Z","updated":"2024-08-22T09:29:30Z"},{"id":"wordfence:e4d591a6-4bbe-435b-aef6-ed176c42dca2","source":"wordfence","cve":"CVE-2025-11769","title":"WordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d591a6-4bbe-435b-aef6-ed176c42dca2?source=api-prod","affected":[{"type":"plugin","slug":"wp-flipper","name":"WordPress Content Flipper","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-12T20:24:21Z","updated":"2025-11-13T08:27:48Z"},{"id":"wordfence:e4d61b69-f3de-4408-98f7-18027a47d168","source":"wordfence","cve":"CVE-2025-52778","title":"xili-dictionary <= 2.12.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d61b69-f3de-4408-98f7-18027a47d168?source=api-prod","affected":[{"type":"plugin","slug":"xili-dictionary","name":"xili-dictionary","from":"*","from_inclusive":true,"to":"2.12.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T17:33:25Z"},{"id":"wordfence:e4d83fa6-338f-402c-94d9-b18caa45fe31","source":"wordfence","cve":"CVE-2026-110901","title":"SmartCrawl SEO checker, analyzer & optimizer <= 3.16.4 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d83fa6-338f-402c-94d9-b18caa45fe31?source=api-prod","affected":[{"type":"plugin","slug":"smartcrawl-seo","name":"SmartCrawl SEO checker, analyzer & optimizer","from":"*","from_inclusive":true,"to":"3.16.4","to_inclusive":true,"patched_in":"3.17.1"}],"published":"2026-10-16T12:49:00Z","updated":"2026-10-23T18:40:06Z"},{"id":"wordfence:e4d9c659-ec6a-43ca-b484-02afd06f3c13","source":"wordfence","cve":"CVE-2023-5559","title":"10Web Booster <= 2.24.14 - Unauthenticated Arbitrary Option Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4d9c659-ec6a-43ca-b484-02afd06f3c13?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.24.14","to_inclusive":true,"patched_in":"2.24.18"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4dc8f18-d990-4e41-8bf8-dfa9de4c0f6e","source":"wordfence","cve":"","title":"WP Crowdfunding <= 2.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4dc8f18-d990-4e41-8bf8-dfa9de4c0f6e?source=api-prod","affected":[{"type":"plugin","slug":"wp-crowdfunding","name":"WP Crowdfunding","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2023-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4dcedcc-2878-47b2-99f0-ecba2cc33b69","source":"wordfence","cve":"CVE-2026-11398","title":"LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4dcedcc-2878-47b2-99f0-ecba2cc33b69?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2026-07-02T19:22:32Z","updated":"2026-07-03T07:53:10Z"},{"id":"wordfence:e4dd0c6a-75af-4b53-ac13-fc4ef0e9001d","source":"wordfence","cve":"CVE-2024-7135","title":"Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4dd0c6a-75af-4b53-ac13-fc4ef0e9001d?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.7","to_inclusive":true,"patched_in":"0.21.8"}],"published":"2024-07-30T00:00:00Z","updated":"2024-07-31T10:59:18Z"},{"id":"wordfence:e4deb62a-1a75-4951-a0a0-297dd17276d3","source":"wordfence","cve":"CVE-2026-10034","title":"WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4deb62a-1a75-4951-a0a0-297dd17276d3?source=api-prod","affected":[{"type":"plugin","slug":"shapepress-dsgvo","name":"WP DSGVO Tools (GDPR)","from":"*","from_inclusive":true,"to":"3.1.39","to_inclusive":true,"patched_in":"3.1.40"}],"published":"2026-06-18T16:02:40Z","updated":"2026-06-19T04:31:35Z"},{"id":"wordfence:e4e07ecf-b51b-4fb4-896d-6299ea0e928f","source":"wordfence","cve":"CVE-2025-15664","title":"Ultimate Before After Image Slider & Gallery \u2013 BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4e07ecf-b51b-4fb4-896d-6299ea0e928f?source=api-prod","affected":[{"type":"plugin","slug":"beaf-before-and-after-gallery","name":"Ultimate Before After Image Slider & Gallery \u2013 BEAF","from":"*","from_inclusive":true,"to":"4.7.19","to_inclusive":false,"patched_in":"4.7.19"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:40:16Z"},{"id":"wordfence:e4e16526-89a5-4d49-ab9d-dcc7ad3bc8d0","source":"wordfence","cve":"CVE-2016-10877","title":"WP Editor <= 1.2.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4e16526-89a5-4d49-ab9d-dcc7ad3bc8d0?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.6.3","to_inclusive":false,"patched_in":"1.2.6.3"}],"published":"2016-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4e6e410-5778-41f7-a259-daa506bfb161","source":"wordfence","cve":"","title":"Media File Manager Advanced <= 1.1.5 - Improper Access Control","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4e6e410-5778-41f7-a259-daa506bfb161?source=api-prod","affected":[{"type":"plugin","slug":"media-file-manager-advanced","name":"Media File Manager Advanced","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2012-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e4ecba83-58c8-45a0-8561-5d9aab7361f5","source":"wordfence","cve":"CVE-2026-65555","title":"Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ecba83-58c8-45a0-8561-5d9aab7361f5?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-learndash-toolkit","name":"Uncanny Toolkit for LearnDash","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:00Z"},{"id":"wordfence:e4ed8c6e-5f80-4360-9478-fff49b1fee94","source":"wordfence","cve":"CVE-2024-24887","title":"Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ed8c6e-5f80-4360-9478-fff49b1fee94?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.2.8.4","to_inclusive":true,"patched_in":"21.2.9"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:22:15Z"},{"id":"wordfence:e4eef7f0-5f09-4618-a3f8-a9e8dabef334","source":"wordfence","cve":"CVE-2024-2761","title":"Genesis Blocks <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via postTitleTag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4eef7f0-5f09-4618-a3f8-a9e8dabef334?source=api-prod","affected":[{"type":"plugin","slug":"genesis-blocks","name":"Genesis Blocks","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-02-29T00:00:00Z","updated":"2024-04-04T16:22:41Z"},{"id":"wordfence:e4f090da-938c-4b33-b8bf-5cb00474f02a","source":"wordfence","cve":"CVE-2026-84253","title":"click5 CRM add-on to Gravity Forms <= 1.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4f090da-938c-4b33-b8bf-5cb00474f02a?source=api-prod","affected":[{"type":"plugin","slug":"gf-add-on-by-click5","name":"click5 CRM add-on to Gravity Forms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:11:14Z"},{"id":"wordfence:e4f0fdaf-a3b3-4ffe-aa18-ecd7c3a33513","source":"wordfence","cve":"CVE-2024-43134","title":"Waitlist Woocommerce ( Back in stock notifier ) <= 2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4f0fdaf-a3b3-4ffe-aa18-ecd7c3a33513?source=api-prod","affected":[{"type":"plugin","slug":"waitlist-woocommerce","name":"Waitlist Woocommerce ( Back in stock notifier )","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:05:56Z"},{"id":"wordfence:e4f24b32-58a0-4b10-b8ff-65e574966b6e","source":"wordfence","cve":"CVE-2024-12325","title":"Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4f24b32-58a0-4b10-b8ff-65e574966b6e?source=api-prod","affected":[{"type":"plugin","slug":"waymark","name":"Waymark","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-12-10T00:00:00Z","updated":"2024-12-11T11:24:50Z"},{"id":"wordfence:e4fa7eee-21c9-479e-bbc5-b20f41f94c25","source":"wordfence","cve":"CVE-2024-52418","title":"Gameplan <= 1.5.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fa7eee-21c9-479e-bbc5-b20f41f94c25?source=api-prod","affected":[{"type":"theme","slug":"gameplan","name":"Gameplan - Event and Gym Fitness WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":""}],"published":"2024-11-13T00:00:00Z","updated":"2024-11-21T14:23:28Z"},{"id":"wordfence:e4fb4127-2b3f-4c8c-95ee-611f1bacf4c5","source":"wordfence","cve":"CVE-2026-19091","title":"GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fb4127-2b3f-4c8c-95ee-611f1bacf4c5?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.169","to_inclusive":true,"patched_in":"2.8.170"}],"published":"2026-08-11T06:44:04Z","updated":"2026-08-11T19:37:28Z"},{"id":"wordfence:e4fc23cb-e443-4c8e-b1a0-b8eefbb25dae","source":"wordfence","cve":"CVE-2024-31260","title":"Edwiser Bridge <= 3.0.2 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fc23cb-e443-4c8e-b1a0-b8eefbb25dae?source=api-prod","affected":[{"type":"plugin","slug":"edwiser-bridge","name":"Edwiser Bridge \u2013 WordPress Moodle Integration","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T16:12:10Z"},{"id":"wordfence:e4fd4e36-d9f1-4fb4-8c65-4eebc2097666","source":"wordfence","cve":"CVE-2025-32552","title":"MSRP (RRP) Pricing for WooCommerce <= 1.8.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fd4e36-d9f1-4fb4-8c65-4eebc2097666?source=api-prod","affected":[{"type":"plugin","slug":"msrp-for-woocommerce","name":"MSRP (RRP) Pricing for WooCommerce","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:15:08Z"},{"id":"wordfence:e4fdc902-4cfe-4116-a294-9a0fcb2de346","source":"wordfence","cve":"CVE-2021-4380","title":"Pinterest Automatic <= 4.14.3 - Unuathenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=api-prod","affected":[{"type":"plugin","slug":"wp-pinterest-automatic","name":"Pinterest Automatic","from":"*","from_inclusive":true,"to":"4.14.3","to_inclusive":true,"patched_in":"4.14.4"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e500a5e4-f3f2-4732-a861-3c8d66f8ebfa","source":"wordfence","cve":"CVE-2024-35771","title":"Customizr <= 4.4.21 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e500a5e4-f3f2-4732-a861-3c8d66f8ebfa?source=api-prod","affected":[{"type":"theme","slug":"customizr","name":"Customizr","from":"*","from_inclusive":true,"to":"4.4.21","to_inclusive":true,"patched_in":"4.4.22"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-26T13:57:16Z"},{"id":"wordfence:e5038eb6-4ff5-4c2c-be61-39ff4b98fc98","source":"wordfence","cve":"CVE-2026-79627","title":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution < 6.0.0 - Authenticated (Custom Role+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5038eb6-4ff5-4c2c-be61-39ff4b98fc98?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":false,"patched_in":"6.0.0"}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:13:59Z"},{"id":"wordfence:e505b376-89ca-4df1-85a1-f8c472325547","source":"wordfence","cve":"CVE-2024-43326","title":"Plugin Notes Plus <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Note Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e505b376-89ca-4df1-85a1-f8c472325547?source=api-prod","affected":[{"type":"plugin","slug":"plugin-notes-plus","name":"Plugin Notes Plus","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-19T18:59:50Z"},{"id":"wordfence:e50a998e-b6f2-443a-83a9-299def2420c5","source":"wordfence","cve":"CVE-2018-16173","title":"LearnPress <= 3.0.12 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e50a998e-b6f2-443a-83a9-299def2420c5?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2018-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e50ef794-f551-4743-91b6-79509e9acf01","source":"wordfence","cve":"CVE-2025-24746","title":"Popup Maker <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e50ef794-f551-4743-91b6-79509e9acf01?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.20.2","to_inclusive":true,"patched_in":"1.20.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:48:46Z"},{"id":"wordfence:e5103e60-771f-46cf-b432-21d131e30bcc","source":"wordfence","cve":"CVE-2023-2812","title":"Ultimate Dashboard <= 3.7.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5103e60-771f-46cf-b432-21d131e30bcc?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.7.6","to_inclusive":false,"patched_in":"3.7.6"}],"published":"2023-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e510fc07-c969-48f4-ac5a-7dc91f9e2cd5","source":"wordfence","cve":"CVE-2025-23436","title":"Wp-Scribd-List <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e510fc07-c969-48f4-ac5a-7dc91f9e2cd5?source=api-prod","affected":[{"type":"plugin","slug":"wp-scribd-list","name":"Wp-Scribd-List","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:58:40Z"},{"id":"wordfence:e511497d-eb79-4c8c-8b2d-c6ad43d2a3ec","source":"wordfence","cve":"CVE-2025-30575","title":"Login Redirect <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e511497d-eb79-4c8c-8b2d-c6ad43d2a3ec?source=api-prod","affected":[{"type":"plugin","slug":"login-redirect","name":"Login Redirect","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:54:26Z"},{"id":"wordfence:e5167635-6f60-4657-b371-bb00680d1e49","source":"wordfence","cve":"CVE-2025-49289","title":"PDF for WPForms <= 5.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5167635-6f60-4657-b371-bb00680d1e49?source=api-prod","affected":[{"type":"plugin","slug":"pdf-for-wpforms","name":"PDF for WPForms + Drag and Drop Template Builder","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.1"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:09:34Z"},{"id":"wordfence:e51a0db0-0ee0-463b-8d82-81a991ef9222","source":"wordfence","cve":"CVE-2019-17385","title":"Animate It <= 2.3.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e51a0db0-0ee0-463b-8d82-81a991ef9222?source=api-prod","affected":[{"type":"plugin","slug":"animate-it","name":"Animate It!","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2019-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e51e1cd2-6de9-4820-8bba-1c6b5053e2c1","source":"wordfence","cve":"CVE-2023-5820","title":"Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e51e1cd2-6de9-4820-8bba-1c6b5053e2c1?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-slider-with-lightbox","name":"Thumbnail Slider With Lightbox","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e51ebb02-df17-4142-9983-1022d55ad17f","source":"wordfence","cve":"CVE-2026-105884","title":"LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e51ebb02-df17-4142-9983-1022d55ad17f?source=api-prod","affected":[{"type":"plugin","slug":"rocket-lazy-load","name":"LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-07T09:11:00Z","updated":"2026-10-08T23:32:47Z"},{"id":"wordfence:e51fc77e-0075-4269-899a-8eab561de615","source":"wordfence","cve":"CVE-2026-32561","title":"Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e51fc77e-0075-4269-899a-8eab561de615?source=api-prod","affected":[{"type":"plugin","slug":"booking-hub","name":"Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T11:21:04Z","updated":"2026-09-10T19:11:35Z"},{"id":"wordfence:e52289fe-9a38-4ebf-b24a-034768fa56b7","source":"wordfence","cve":"CVE-2025-7442","title":"WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52289fe-9a38-4ebf-b24a-034768fa56b7?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"67.8.0","to_inclusive":false,"patched_in":"67.8.0"}],"published":"2025-07-10T19:17:46Z","updated":"2025-07-11T07:23:03Z"},{"id":"wordfence:e5240171-6051-455c-b6df-630e2cd8308d","source":"wordfence","cve":"CVE-2018-5372","title":"Testimonial Slider < 1.2.5 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5240171-6051-455c-b6df-630e2cd8308d?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider","name":"Testimonial Slider","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":false,"patched_in":"1.2.5"}],"published":"2018-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5252b2f-c1a1-4fec-abaf-ad234affdcfb","source":"wordfence","cve":"CVE-2017-17092","title":"WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5252b2f-c1a1-4fec-abaf-ad234affdcfb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.23","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.21","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.20","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.17","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.7","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"3.7.24"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9","to_inclusive":true,"patched_in":"3.7.24"}],"published":"2017-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e52914cc-da0c-4b79-b378-4ef63e7974bb","source":"wordfence","cve":"","title":"Real Estate 7 WordPress < 3.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52914cc-da0c-4b79-b378-4ef63e7974bb?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2020-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e52b27fa-10e8-43d0-be29-774c2f5487ae","source":"wordfence","cve":"CVE-2023-0685","title":"Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folders","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52b27fa-10e8-43d0-be29-774c2f5487ae?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.16","to_inclusive":true,"patched_in":"2.18.17"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e52b34fe-2414-4d6f-bf43-9c5b65ebf769","source":"wordfence","cve":"CVE-2025-13773","title":"Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52b34fe-2414-4d6f-bf43-9c5b65ebf769?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.0"}],"published":"2025-12-23T16:17:22Z","updated":"2025-12-24T04:32:58Z"},{"id":"wordfence:e52c53c1-4f04-4075-9329-d93fabf5a6ce","source":"wordfence","cve":"CVE-2023-1624","title":"WPCode <= 2.0.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52c53c1-4f04-4075-9329-d93fabf5a6ce?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers","name":"WPCode \u2013 Insert Headers and Footers + Custom Code Snippets \u2013 WordPress Code Manager","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e52c5628-5535-4214-a788-bc2ce9ae6ba0","source":"wordfence","cve":"CVE-2025-60162","title":"Job Board Manager <= 2.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52c5628-5535-4214-a788-bc2ce9ae6ba0?source=api-prod","affected":[{"type":"plugin","slug":"job-board-manager","name":"Job Board Manager","from":"*","from_inclusive":true,"to":"2.1.61","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:11:07Z"},{"id":"wordfence:e52c95b3-0126-4139-9944-6becef4c4d53","source":"wordfence","cve":"CVE-2026-25447","title":"Widget Wrangler <= 2.3.9 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52c95b3-0126-4139-9944-6becef4c4d53?source=api-prod","affected":[{"type":"plugin","slug":"widget-wrangler","name":"Widget Wrangler","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-03-18T00:00:00Z","updated":"2026-08-03T13:04:55Z"},{"id":"wordfence:e52d8b5e-727f-474a-a255-c24033db17d8","source":"wordfence","cve":"CVE-2024-12204","title":"Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52d8b5e-727f-474a-a255-c24033db17d8?source=api-prod","affected":[{"type":"plugin","slug":"coupon-x-discount-pop-up","name":"Coupon X \u2013 Discount Popups, Promo Codes Pop Ups for WooCommerce & Announcement Popups","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-01-10T14:13:45Z","updated":"2025-01-11T02:20:55Z"},{"id":"wordfence:e52e35db-22e8-42e1-88a6-37ca9a1df7d4","source":"wordfence","cve":"CVE-2025-50008","title":"WooCommerce Manager &#8211; Customize and Control Cart page, Add to Cart button, Checkout fields easily <= 1.2.4.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52e35db-22e8-42e1-88a6-37ca9a1df7d4?source=api-prod","affected":[{"type":"plugin","slug":"innovs-woo-manager","name":"WooCommerce Manager \u2013 Customize and Control Cart page, Add to Cart button, Checkout fields easily","from":"*","from_inclusive":true,"to":"1.2.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T14:57:07Z"},{"id":"wordfence:e52e7078-3717-44d1-a5e1-ce41d1333baa","source":"wordfence","cve":"CVE-2025-67562","title":"Image Caption Hover Pro < 20.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52e7078-3717-44d1-a5e1-ce41d1333baa?source=api-prod","affected":[{"type":"plugin","slug":"image-caption-hover-pro","name":"Image Caption Hover Pro","from":"*","from_inclusive":true,"to":"20.0","to_inclusive":false,"patched_in":"20.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:14:09Z"},{"id":"wordfence:e52f799e-9174-45a2-9ed6-7aedb26b36bd","source":"wordfence","cve":"CVE-2019-20181","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.0.13 - Cross-Site Scripting via post_title","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e52f799e-9174-45a2-9ed6-7aedb26b36bd?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"6.0.14"}],"published":"2020-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5318ce3-6ee4-4641-91f2-faf2da36178b","source":"wordfence","cve":"CVE-2026-78397","title":"Link Library <= 7.9.5 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5318ce3-6ee4-4641-91f2-faf2da36178b?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-29T19:47:32Z"},{"id":"wordfence:e532a2b4-0fb4-4256-89a9-435b55d9de91","source":"wordfence","cve":"","title":"WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin \u2013 ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e532a2b4-0fb4-4256-89a9-435b55d9de91?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"3.2.15","to_inclusive":true,"patched_in":"3.2.16"}],"published":"2022-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e533f20e-825b-443c-93b2-cf451284ae96","source":"wordfence","cve":"CVE-2026-4106","title":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder < 3.0.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e533f20e-825b-443c-93b2-cf451284ae96?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":false,"patched_in":"3.0.7"}],"published":"2026-04-24T00:00:00Z","updated":"2026-04-30T15:05:05Z"},{"id":"wordfence:e5343bc9-5dcd-410b-a7b7-27734910ad3c","source":"wordfence","cve":"CVE-2025-58984","title":"Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5343bc9-5dcd-410b-a7b7-27734910ad3c?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.20","to_inclusive":true,"patched_in":"2.11.21"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:32:57Z"},{"id":"wordfence:e537c56d-7c5e-4f21-b266-ef3d1a87caf2","source":"wordfence","cve":"CVE-2026-1310","title":"Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e537c56d-7c5e-4f21-b266-ef3d1a87caf2?source=api-prod","affected":[{"type":"plugin","slug":"simple-calendar-for-elementor","name":"Simple calendar for Elementor","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-01-27T18:06:15Z","updated":"2026-01-28T06:43:45Z"},{"id":"wordfence:e53878e4-659a-4530-8bb7-a9c7a2e3bc1e","source":"wordfence","cve":"CVE-2025-47518","title":"Contact Form 7 \u2013 PayPal & Stripe Add-on <= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53878e4-659a-4530-8bb7-a9c7a2e3bc1e?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-paypal-add-on","name":"Contact Form 7 \u2013 PayPal & Stripe Add-on","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:08:08Z"},{"id":"wordfence:e53a2b7a-7005-451a-88f2-c23d420b4aad","source":"wordfence","cve":"CVE-2024-13550","title":"ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53a2b7a-7005-451a-88f2-c23d420b4aad?source=api-prod","affected":[{"type":"plugin","slug":"abc-notation","name":"ABC Notation","from":"*","from_inclusive":true,"to":"6.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-24T18:45:22Z","updated":"2025-01-25T07:24:19Z"},{"id":"wordfence:e53bb240-8784-4d34-8d3f-4a7af917f3f4","source":"wordfence","cve":"CVE-2023-41956","title":"Simple Membership <= 4.3.4 - Account Takeover via Password Reset","severity":"high","cvss":8.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53bb240-8784-4d34-8d3f-4a7af917f3f4?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e53c764c-c4a0-49f7-a603-d7e2a9d13ad5","source":"wordfence","cve":"CVE-2024-12750","title":"Competition Form <= 2.0 - Cross-Site Request Forgery to Competition Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53c764c-c4a0-49f7-a603-d7e2a9d13ad5?source=api-prod","affected":[{"type":"plugin","slug":"competition-form","name":"Competition Form","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T18:42:16Z"},{"id":"wordfence:e53ca576-9705-4362-b2b7-338477002ab9","source":"wordfence","cve":"CVE-2026-40742","title":"Nelio AB Testing <= 8.2.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53ca576-9705-4362-b2b7-338477002ab9?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"8.2.8","to_inclusive":true,"patched_in":"8.3.0"}],"published":"2026-03-17T00:00:00Z","updated":"2026-05-12T13:48:20Z"},{"id":"wordfence:e53cd64c-9278-48cc-8181-1d6c40a05eb7","source":"wordfence","cve":"CVE-2024-30429","title":"wp-forecast <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53cd64c-9278-48cc-8181-1d6c40a05eb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-forecast","name":"wp-forecast","from":"*","from_inclusive":true,"to":"9.2","to_inclusive":true,"patched_in":"9.3"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:14:42Z"},{"id":"wordfence:e53e75be-d4d6-4c10-b192-fe9691f27dd8","source":"wordfence","cve":"CVE-2023-4836","title":"User Private Files < 2.0.5 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e53e75be-d4d6-4c10-b192-fe9691f27dd8?source=api-prod","affected":[{"type":"plugin","slug":"user-private-files","name":"User Private Files \u2013 Secure File Sharing and Client Portal Plugin","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":false,"patched_in":"2.0.5"}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5438f82-2428-44ba-a7c8-e34d80804063","source":"wordfence","cve":"CVE-2024-11810","title":"PayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5438f82-2428-44ba-a7c8-e34d80804063?source=api-prod","affected":[{"type":"plugin","slug":"paygreen-payment-gateway","name":"PayGreen Payment Gateway","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2025-01-06T16:16:54Z","updated":"2025-01-17T14:27:54Z"},{"id":"wordfence:e5441e7e-9be1-434e-9413-31920f565184","source":"wordfence","cve":"CVE-2025-32595","title":"Krowd  < 1.5.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5441e7e-9be1-434e-9413-31920f565184?source=api-prod","affected":[{"type":"theme","slug":"krowd","name":"Krowd - Crowdfunding & Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2025-06-03T00:00:00Z","updated":"2026-03-06T15:01:26Z"},{"id":"wordfence:e545b53e-7054-41dc-b69b-7552ef6c3240","source":"wordfence","cve":"CVE-2025-5733","title":"Modern Events Calendar <= 7.21.9 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e545b53e-7054-41dc-b69b-7552ef6c3240?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.21.9","to_inclusive":true,"patched_in":"7.22"}],"published":"2025-06-05T15:05:14Z","updated":"2025-06-06T03:41:24Z"},{"id":"wordfence:e5482dd5-edb0-4208-a864-e9a3dd89d557","source":"wordfence","cve":"CVE-2024-6270","title":"Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5482dd5-edb0-4208-a864-e9a3dd89d557?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-09T19:25:41Z"},{"id":"wordfence:e5492ad2-52a4-42a3-9170-e8102fcfa38b","source":"wordfence","cve":"CVE-2025-57966","title":"Gallery Lightbox <= 1.0.0.41 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5492ad2-52a4-42a3-9170-e8102fcfa38b?source=api-prod","affected":[{"type":"plugin","slug":"gallery-lightbox-slider","name":"Gallery Lightbox","from":"*","from_inclusive":true,"to":"1.0.0.41","to_inclusive":true,"patched_in":"1.0.0.43"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:25:50Z"},{"id":"wordfence:e5495b4c-a1ac-4860-83a7-686d9436d983","source":"wordfence","cve":"CVE-2025-14976","title":"User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5495b4c-a1ac-4860-83a7-686d9436d983?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.4.8","to_inclusive":true,"patched_in":"4.4.9"}],"published":"2026-01-09T20:16:56Z","updated":"2026-01-10T08:22:59Z"},{"id":"wordfence:e54a2e12-fa65-4536-992d-dc123f95fe24","source":"wordfence","cve":"CVE-2026-121761","title":"VOD Infomaniak <= 1.5.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54a2e12-fa65-4536-992d-dc123f95fe24?source=api-prod","affected":[{"type":"plugin","slug":"vod-infomaniak","name":"VOD Infomaniak","from":"*","from_inclusive":true,"to":"1.5.15","to_inclusive":true,"patched_in":"1.5.16"}],"published":"2026-11-07T08:48:00Z","updated":"2026-11-10T19:46:19Z"},{"id":"wordfence:e54abb3d-329b-4f9c-b562-db8a40cc7c97","source":"wordfence","cve":"CVE-2025-54019","title":"Alone < 7.8.5 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54abb3d-329b-4f9c-b562-db8a40cc7c97?source=api-prod","affected":[{"type":"theme","slug":"alone","name":"Alone \u2013 Charity Multipurpose Non-profit WordPress Theme","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":false,"patched_in":"7.8.5"}],"published":"2025-08-02T00:00:00Z","updated":"2026-08-21T13:29:03Z"},{"id":"wordfence:e54b0294-6829-493f-b7d3-6349000c249c","source":"wordfence","cve":"CVE-2024-32546","title":"Tax Rate Upload <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54b0294-6829-493f-b7d3-6349000c249c?source=api-prod","affected":[{"type":"plugin","slug":"tax-rate-upload","name":"Tax Rate Upload","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T14:00:03Z"},{"id":"wordfence:e54c1a85-13f6-48c0-9db8-860b4b1f3e45","source":"wordfence","cve":"CVE-2024-11405","title":"WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54c1a85-13f6-48c0-9db8-860b4b1f3e45?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-login-and-register","name":"WP Front-end login and register","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-01T14:38:52Z","updated":"2025-07-02T03:47:26Z"},{"id":"wordfence:e54caaf5-f37b-4842-ab3d-8e37cbed58da","source":"wordfence","cve":"CVE-2025-6716","title":"Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54caaf5-f37b-4842-ab3d-8e37cbed58da?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"26.0.8","to_inclusive":true,"patched_in":"26.0.9"}],"published":"2025-07-10T18:41:31Z","updated":"2025-07-11T06:43:33Z"},{"id":"wordfence:e54d5ab2-40ba-4ad8-9a77-44aba37f0283","source":"wordfence","cve":"CVE-2024-6692","title":"Easy Digital Downloads \u2013 Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d5ab2-40ba-4ad8-9a77-44aba37f0283?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-10T02:01:23Z"},{"id":"wordfence:e54d79d5-38c2-49ba-9bb8-e57dacf165f5","source":"wordfence","cve":"CVE-2025-47599","title":"Facturante <= 1.11 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d79d5-38c2-49ba-9bb8-e57dacf165f5?source=api-prod","affected":[{"type":"plugin","slug":"facturante","name":"Facturante \u2013 Facturaci\u00f3n Electr\u00f3nica","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":"1.13"}],"published":"2025-05-16T00:00:00Z","updated":"2025-07-28T20:30:00Z"},{"id":"wordfence:e54d94e5-819b-47f1-86d9-71e3873f70bc","source":"wordfence","cve":"CVE-2025-68903","title":"Anona <= 8.0 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54d94e5-819b-47f1-86d9-71e3873f70bc?source=api-prod","affected":[{"type":"theme","slug":"anona","name":"Anona - Pest Control WordPress Theme","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:28:45Z"},{"id":"wordfence:e54dfe2d-275d-4917-97fb-c5d5017dc8b4","source":"wordfence","cve":"CVE-2026-97266","title":"Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54dfe2d-275d-4917-97fb-c5d5017dc8b4?source=api-prod","affected":[{"type":"plugin","slug":"virtue-toolkit","name":"Virtue/Ascend/Pinnacle Toolkit","from":"*","from_inclusive":true,"to":"4.9.12.1","to_inclusive":true,"patched_in":"4.9.12.2"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:28:26Z"},{"id":"wordfence:e54e199a-410f-402d-bdd0-14685e2ca3fc","source":"wordfence","cve":"CVE-2025-22739","title":"LearnPress <= 4.2.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54e199a-410f-402d-bdd0-14685e2ca3fc?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.7.5","to_inclusive":true,"patched_in":"4.2.7.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:24:31Z"},{"id":"wordfence:e54e2831-e5e9-43f4-acb6-9cf00fdb4e57","source":"wordfence","cve":"CVE-2026-2384","title":"Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54e2831-e5e9-43f4-acb6-9cf00fdb4e57?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.1.7","to_inclusive":true,"patched_in":"6.7.1.8"}],"published":"2026-02-19T13:25:41Z","updated":"2026-02-20T02:23:32Z"},{"id":"wordfence:e54f1a23-0b1f-4b0b-909e-e877e4ee2c86","source":"wordfence","cve":"CVE-2025-9030","title":"Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f1a23-0b1f-4b0b-909e-e877e4ee2c86?source=api-prod","affected":[{"type":"plugin","slug":"majestic-before-after-image","name":"Before After Image","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-10-03T14:10:24Z","updated":"2025-10-04T02:24:38Z"},{"id":"wordfence:e54f2e28-7320-4d2d-a416-e46202c08375","source":"wordfence","cve":"CVE-2018-17140","title":"Quizlord <= 2.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f2e28-7320-4d2d-a416-e46202c08375?source=api-prod","affected":[{"type":"plugin","slug":"quizlord","name":"Quizlord","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2018-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e54f98bc-c538-4f3c-b24a-6e778a3748ef","source":"wordfence","cve":"CVE-2025-1667","title":"School Management System \u2013 WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f98bc-c538-4f3c-b24a-6e778a3748ef?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2025-03-14T14:22:59Z","updated":"2025-11-05T19:39:41Z"},{"id":"wordfence:e553135d-88e0-4840-99ad-9514c2243b7d","source":"wordfence","cve":"CVE-2025-1261","title":"HT Mega \u2013 Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e553135d-88e0-4840-99ad-9514c2243b7d?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T01:44:27Z"},{"id":"wordfence:e5539ad8-4203-4d22-9a40-0ed6e0471e19","source":"wordfence","cve":"CVE-2007-1277","title":"WordPress Core 2.2.1 - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5539ad8-4203-4d22-9a40-0ed6e0471e19?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"2.2.1","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2007-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e554855b-a8d2-4187-9d86-c47d648a29ec","source":"wordfence","cve":"CVE-2026-16959","title":"Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e554855b-a8d2-4187-9d86-c47d648a29ec?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.40","to_inclusive":false,"patched_in":"3.40"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:08:57Z"},{"id":"wordfence:e556d8c9-3ca5-4bec-a840-7a6d67532e59","source":"wordfence","cve":"CVE-2019-10270","title":"Ultimate Member <= 2.0.39 - Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e556d8c9-3ca5-4bec-a840-7a6d67532e59?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.40"}],"published":"2019-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e55742de-9eaf-48e4-8d5d-ea980dfa17cf","source":"wordfence","cve":"CVE-2024-6296","title":"Stackable \u2013 Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e55742de-9eaf-48e4-8d5d-ea980dfa17cf?source=api-prod","affected":[{"type":"plugin","slug":"stackable-ultimate-gutenberg-blocks","name":"Stackable \u2013 Page Builder Gutenberg Blocks","from":"*","from_inclusive":true,"to":"3.13.1","to_inclusive":true,"patched_in":"3.13.2"}],"published":"2024-06-27T00:00:00Z","updated":"2024-06-28T03:37:50Z"},{"id":"wordfence:e5575725-99ba-4499-93e5-f7648c82ac52","source":"wordfence","cve":"CVE-2023-41693","title":"MyCryptoCheckout <= 2.125 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5575725-99ba-4499-93e5-f7648c82ac52?source=api-prod","affected":[{"type":"plugin","slug":"mycryptocheckout","name":"MyCryptoCheckout \u2013 Bitcoin, Ethereum, and 100+ altcoins for WooCommerce","from":"*","from_inclusive":true,"to":"2.125","to_inclusive":true,"patched_in":"2.126"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e558100a-5866-4e7f-bae7-47a1f492ab27","source":"wordfence","cve":"CVE-2021-36821","title":"Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e558100a-5866-4e7f-bae7-47a1f492ab27?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.14.12","to_inclusive":false,"patched_in":"1.14.12"}],"published":"2021-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e55b86e2-b42e-483d-93cd-2f09af64dbc7","source":"wordfence","cve":"CVE-2024-5348","title":"Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e55b86e2-b42e-483d-93cd-2f09af64dbc7?source=api-prod","affected":[{"type":"plugin","slug":"nd-elements","name":"Elements For Elementor","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-01T08:38:56Z"},{"id":"wordfence:e55ba61d-6fd0-4269-8ee9-3b8645d52e1d","source":"wordfence","cve":"CVE-2023-34013","title":"Poll Maker <= 4.6.2 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e55ba61d-6fd0-4269-8ee9-3b8645d52e1d?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2023-06-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e55f6d1d-b0b3-41e6-9ca9-c6e9f6dd34ed","source":"wordfence","cve":"CVE-2024-37522","title":"CC & BCC for Woocommerce Order Emails <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e55f6d1d-b0b3-41e6-9ca9-c6e9f6dd34ed?source=api-prod","affected":[{"type":"plugin","slug":"cc-bcc-for-woocommerce-order-emails","name":"CC & BCC for Woocommerce Order Emails","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:28:35Z"},{"id":"wordfence:e55ff883-1796-4282-b005-26dfd154b11f","source":"wordfence","cve":"CVE-2024-8289","title":"MultiVendorX \u2013 The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Arbitrary Vendor Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e55ff883-1796-4282-b005-26dfd154b11f?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-03T20:10:35Z"},{"id":"wordfence:e560fb5f-0548-4b3e-9f8d-9e80af364c04","source":"wordfence","cve":"CVE-2014-8807","title":"Contact Bank \u2013 Contact Form Builder for WordPress <= 2.0.69 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e560fb5f-0548-4b3e-9f8d-9e80af364c04?source=api-prod","affected":[{"type":"plugin","slug":"contact-bank","name":"Contact Bank \u2013 Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.69","to_inclusive":true,"patched_in":"2.0.70"}],"published":"2014-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e565c855-2e2f-4577-8cf2-e167f5fe5f37","source":"wordfence","cve":"CVE-2024-13383","title":"HD Quiz <= 1.8.14 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e565c855-2e2f-4577-8cf2-e167f5fe5f37?source=api-prod","affected":[{"type":"plugin","slug":"hd-quiz","name":"HD Quiz","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-29T18:38:54Z"},{"id":"wordfence:e5665931-8da9-44db-a5b1-46acebf14f3b","source":"wordfence","cve":"CVE-2023-49835","title":"Post Duplicator <= 2.31 - Missing Authorization via mtphr_duplicate_post","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5665931-8da9-44db-a5b1-46acebf14f3b?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"2.31","to_inclusive":true,"patched_in":"2.32"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5696067-a98b-49ad-b078-571c889f1272","source":"wordfence","cve":"CVE-2024-10143","title":"MB Custom Post Types & Custom Taxonomies <= 2.7.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5696067-a98b-49ad-b078-571c889f1272?source=api-prod","affected":[{"type":"plugin","slug":"mb-custom-post-type","name":"MB Custom Post Types & Custom Taxonomies","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T14:53:32Z"},{"id":"wordfence:e56b11a1-dd40-461b-9624-b60367c0c727","source":"wordfence","cve":"CVE-2023-47660","title":"Product Visibility by Country for WooCommerce <= 1.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e56b11a1-dd40-461b-9624-b60367c0c727?source=api-prod","affected":[{"type":"plugin","slug":"product-visibility-by-country-for-woocommerce","name":"Product Visibility by Country for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e56d98b5-ae38-4059-bc32-d0fffd326740","source":"wordfence","cve":"CVE-2024-32525","title":"Theme My Login <= 7.1.6 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e56d98b5-ae38-4059-bc32-d0fffd326740?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T14:46:33Z"},{"id":"wordfence:e56ebe2a-8a7e-454b-a1cd-7103112087e0","source":"wordfence","cve":"CVE-2013-2714","title":"podPress <= 8.8.10.17 - Cross-Site Scripting via playerID","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e56ebe2a-8a7e-454b-a1cd-7103112087e0?source=api-prod","affected":[{"type":"plugin","slug":"podpress","name":"podpress","from":"*","from_inclusive":true,"to":"8.8.10.17","to_inclusive":true,"patched_in":""}],"published":"2013-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e56f8ce0-b6a2-4cef-9091-818528699892","source":"wordfence","cve":"CVE-2024-10504","title":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e56f8ce0-b6a2-4cef-9091-818528699892?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-01-06T00:00:00Z","updated":"2025-05-27T15:03:34Z"},{"id":"wordfence:e570a66a-14f4-4ce9-b820-c54d09dd051d","source":"wordfence","cve":"CVE-2022-44582","title":"Apptivo Business Site CRM <= 3.0.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e570a66a-14f4-4ce9-b820-c54d09dd051d?source=api-prod","affected":[{"type":"plugin","slug":"apptivo-business-site","name":"Apptivo Business Site","from":"*","from_inclusive":true,"to":"3.0.12","to_inclusive":true,"patched_in":"3.0.14"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e571ded0-ea7a-40ec-b90b-c5009b463d87","source":"wordfence","cve":"CVE-2023-2252","title":"Directorist <= 7.5.3 - Authenticated (Administrator+) Local File Inclusion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e571ded0-ea7a-40ec-b90b-c5009b463d87?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.5.3","to_inclusive":true,"patched_in":"7.5.4"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5726719-0dfc-4e06-b676-006302b2b38b","source":"wordfence","cve":"CVE-2025-32675","title":"SEO Help <= 6.6.1 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5726719-0dfc-4e06-b676-006302b2b38b?source=api-prod","affected":[{"type":"plugin","slug":"seo-help","name":"QC SEO Help for llms.txt, AI Analytics, AI Content Writer, FAQ Generator, Subtitle to Article","from":"*","from_inclusive":true,"to":"6.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-17T12:50:39Z"},{"id":"wordfence:e5726c70-c2c7-45b9-bd03-38cf1320646a","source":"wordfence","cve":"CVE-2023-28171","title":"Brilliance <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5726c70-c2c7-45b9-bd03-38cf1320646a?source=api-prod","affected":[{"type":"theme","slug":"brilliance","name":"Brilliance","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e573648e-215f-4858-a4d3-a3e85119dbcf","source":"wordfence","cve":"CVE-2024-10536","title":"FancyPost \u2013 Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e573648e-215f-4858-a4d3-a3e85119dbcf?source=api-prod","affected":[{"type":"plugin","slug":"post-block","name":"FancyPost \u2013 Post Blocks, Grids & Sliders for Block Editor and Elementor","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2025-01-06T16:23:30Z","updated":"2025-01-20T21:50:59Z"},{"id":"wordfence:e573c0a4-d053-400b-828c-0d0eca880776","source":"wordfence","cve":"CVE-2020-36759","title":"Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e573c0a4-d053-400b-828c-0d0eca880776?source=api-prod","affected":[{"type":"plugin","slug":"insert-php","name":"Woody Code Snippets \u2013 Insert PHP, CSS, JS, and Header/Footer Scripts","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5748252-d02a-463b-abb4-537144ccd608","source":"wordfence","cve":"CVE-2022-0535","title":"E2Pdf <= 1.16.44 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5748252-d02a-463b-abb4-537144ccd608?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.16.44","to_inclusive":true,"patched_in":"1.16.45"}],"published":"2022-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e57631c2-ad6c-4c8c-985e-948285058567","source":"wordfence","cve":"CVE-2018-5660","title":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via coming-soon_sub_title parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e57631c2-ad6c-4c8c-985e-948285058567?source=api-prod","affected":[{"type":"plugin","slug":"responsive-coming-soon-page","name":"Coming Soon Page \u2013 Responsive Coming Soon & Maintenance Mode","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e578af07-90ec-4bd4-91ec-b793bbccf977","source":"wordfence","cve":"CVE-2026-17037","title":"Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e578af07-90ec-4bd4-91ec-b793bbccf977?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-09-10T20:46:28Z","updated":"2026-09-11T09:27:20Z"},{"id":"wordfence:e579b7fd-141f-4d5f-9e0e-a1e6b985f0b9","source":"wordfence","cve":"CVE-2015-20105","title":"ClickBank Affiliate Ads < 1.31 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e579b7fd-141f-4d5f-9e0e-a1e6b985f0b9?source=api-prod","affected":[{"type":"plugin","slug":"clickbank-ads-clickbank-widget","name":"Affiliate Ads for cbAds.com","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":false,"patched_in":"1.31"}],"published":"2015-05-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e57bfae5-4cc0-4d97-9431-4c8ebb2f0882","source":"wordfence","cve":"CVE-2022-47178","title":"Simple Share Buttons Adder <= 8.4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e57bfae5-4cc0-4d97-9431-4c8ebb2f0882?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-buttons-adder","name":"Simple Share Buttons Adder","from":"*","from_inclusive":true,"to":"8.4.6","to_inclusive":true,"patched_in":"8.4.7"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e57f2f91-3f6f-4452-9525-4c150a037d2f","source":"wordfence","cve":"CVE-2026-1086","title":"Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e57f2f91-3f6f-4452-9525-4c150a037d2f?source=api-prod","affected":[{"type":"plugin","slug":"wp-font-pairing-preview","name":"Font Pairing Preview For Landing Pages","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T18:47:25Z","updated":"2026-03-07T07:22:08Z"},{"id":"wordfence:e57f4853-cade-4bb5-8f12-4a88a200921f","source":"wordfence","cve":"CVE-2022-4043","title":"WP Custom Admin Interface <= 7.28 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e57f4853-cade-4bb5-8f12-4a88a200921f?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.28","to_inclusive":true,"patched_in":"7.29"}],"published":"2022-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e57f7912-4af3-4dcb-b267-afec1c373b00","source":"wordfence","cve":"","title":"Wp-ImageZoom <= 1.0.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e57f7912-4af3-4dcb-b267-afec1c373b00?source=api-prod","affected":[{"type":"plugin","slug":"wp-imagezoom","name":"Wp-ImageZoom","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2013-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e582f3e8-f8c5-4168-bc5b-856dccab622b","source":"wordfence","cve":"CVE-2025-53222","title":"tagDiv Opt-In Builder <= 1.7.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e582f3e8-f8c5-4168-bc5b-856dccab622b?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2026-03-16T00:00:00Z","updated":"2026-03-27T21:01:30Z"},{"id":"wordfence:e582fa40-b03e-4194-b612-d139e981cce2","source":"wordfence","cve":"","title":"Display Widgets < 2.7 - SEO Spam Injection (Hidden Functionality)","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e582fa40-b03e-4194-b612-d139e981cce2?source=api-prod","affected":[{"type":"plugin","slug":"display-widget","name":"Display Widgets","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":false,"patched_in":"2.7"}],"published":"2017-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e58475f4-a07a-4393-a74d-9ba2760401ee","source":"wordfence","cve":"CVE-2026-39666","title":"Hello Bar Popup Builder <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58475f4-a07a-4393-a74d-9ba2760401ee?source=api-prod","affected":[{"type":"plugin","slug":"hellobar","name":"Hello Bar Popup Builder","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-02-18T00:00:00Z","updated":"2026-06-08T16:13:46Z"},{"id":"wordfence:e585998a-d78f-4923-865c-c3a9820b583f","source":"wordfence","cve":"CVE-2025-9776","title":"CatFolders \u2013 Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f?source=api-prod","affected":[{"type":"plugin","slug":"catfolders","name":"CatFolders \u2013 WordPress Media Library Folders & Categories","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-09-10T16:23:27Z","updated":"2025-09-11T04:26:21Z"},{"id":"wordfence:e58634c3-7fcd-4885-b897-4e6a97fb06ac","source":"wordfence","cve":"CVE-2022-1476","title":"All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts","severity":"medium","cvss":6.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58634c3-7fcd-4885-b897-4e6a97fb06ac?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.58","to_inclusive":true,"patched_in":"7.59"}],"published":"2022-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5863e9b-3f98-41ea-97ed-26563493cffd","source":"wordfence","cve":"CVE-2023-34008","title":"WP ERP <= 1.12.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5863e9b-3f98-41ea-97ed-26563493cffd?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":true,"patched_in":"1.12.4"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e58a45c4-06cb-4b2b-97f2-a614fc230942","source":"wordfence","cve":"CVE-2023-46780","title":"Alter <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58a45c4-06cb-4b2b-97f2-a614fc230942?source=api-prod","affected":[{"type":"plugin","slug":"alter","name":"Alter","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e58afab1-90fc-4969-9812-83265a7cf46a","source":"wordfence","cve":"CVE-2026-108073","title":"SureCart <= 4.9.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58afab1-90fc-4969-9812-83265a7cf46a?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"4.9.5"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:23:25Z"},{"id":"wordfence:e58ceb12-7f04-416d-a2f7-5cca05fd1aec","source":"wordfence","cve":"CVE-2026-32464","title":"Theme Test Drive <= 2.9.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58ceb12-7f04-416d-a2f7-5cca05fd1aec?source=api-prod","affected":[{"type":"plugin","slug":"theme-test-drive","name":"Theme Test Drive","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:27:48Z"},{"id":"wordfence:e58f2121-26c8-4364-aa2a-41de1b0216f9","source":"wordfence","cve":"CVE-2025-60148","title":"Subscribe to Download <= 2.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58f2121-26c8-4364-aa2a-41de1b0216f9?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-download","name":"Subscribe to Download","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:18:41Z"},{"id":"wordfence:e58fa0b6-22f3-4e56-96f8-d1085498a1ac","source":"wordfence","cve":"CVE-2024-34818","title":"WordPress Webinar Plugin \u2013 WebinarPress <= 1.33.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58fa0b6-22f3-4e56-96f8-d1085498a1ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.20","to_inclusive":true,"patched_in":"1.33.21"}],"published":"2024-05-09T00:00:00Z","updated":"2024-08-08T20:42:51Z"},{"id":"wordfence:e58fe046-0119-48e6-ac90-8b70d7eb9956","source":"wordfence","cve":"CVE-2024-1232","title":"CM Download Manager < 2.9.0 - Cross-Site Request Forgery via delHeader","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e58fe046-0119-48e6-ac90-8b70d7eb9956?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":false,"patched_in":"2.9.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-27T20:50:45Z"},{"id":"wordfence:e59085af-03da-4403-9804-6f8e8e7678b4","source":"wordfence","cve":"CVE-2025-60202","title":"Favorites <= 2.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e59085af-03da-4403-9804-6f8e8e7678b4?source=api-prod","affected":[{"type":"plugin","slug":"favorites","name":"Favorites","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-07-21T00:00:00Z","updated":"2026-07-28T17:47:49Z"},{"id":"wordfence:e5911815-db53-46f2-a16d-ed21be20bbfb","source":"wordfence","cve":"CVE-2021-4423","title":"RAYS Grid <= 1.2.2 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5911815-db53-46f2-a16d-ed21be20bbfb?source=api-prod","affected":[{"type":"plugin","slug":"rays-grid","name":"RAYS Grid","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e59293a6-cc61-4913-9ed0-13fa16299705","source":"wordfence","cve":"CVE-2023-25489","title":"Update Theme and Plugins from Zip File <= 2.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e59293a6-cc61-4913-9ed0-13fa16299705?source=api-prod","affected":[{"type":"plugin","slug":"update-theme-and-plugins-from-zip-file","name":"Update Theme and Plugins from Zip File","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e592ee57-0ff7-4ca0-9edf-767310a6ed57","source":"wordfence","cve":"CVE-2025-66138","title":"Motionger for Elementor <= 2.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e592ee57-0ff7-4ca0-9edf-767310a6ed57?source=api-prod","affected":[{"type":"plugin","slug":"motionger-elementor","name":"Motionger for Elementor","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-10T00:00:00Z","updated":"2026-01-15T16:52:21Z"},{"id":"wordfence:e593943a-c68f-4331-8e99-53db3a3cc9ca","source":"wordfence","cve":"CVE-2025-52752","title":"IDonatePro <= 2.1.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e593943a-c68f-4331-8e99-53db3a3cc9ca?source=api-prod","affected":[{"type":"plugin","slug":"idonate-pro","name":"IDonatePro - Blood Donation, Request And Donor Management WordPress Plugin","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-08-17T00:00:00Z","updated":"2025-11-04T16:56:43Z"},{"id":"wordfence:e5957d6b-40e5-44c4-9a1b-e9c49e175162","source":"wordfence","cve":"CVE-2025-11976","title":"FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5957d6b-40e5-44c4-9a1b-e9c49e175162?source=api-prod","affected":[{"type":"plugin","slug":"fusewp","name":"FuseWP \u2013 WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)","from":"*","from_inclusive":true,"to":"1.1.23.0","to_inclusive":true,"patched_in":"1.1.23.1"}],"published":"2025-10-24T18:12:55Z","updated":"2025-10-25T06:49:27Z"},{"id":"wordfence:e597b677-e298-4507-86a5-70a93a9afd6e","source":"wordfence","cve":"","title":"SpiderCalendar <= 1.4.13 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e597b677-e298-4507-86a5-70a93a9afd6e?source=api-prod","affected":[{"type":"plugin","slug":"spider-event-calendar","name":"SpiderCalendar","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2015-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5986c72-ae6d-4cd2-929d-fe2ff6462b4f","source":"wordfence","cve":"CVE-2015-9495","title":"Syndication Links < 1.0.3 - DOM-based Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5986c72-ae6d-4cd2-929d-fe2ff6462b4f?source=api-prod","affected":[{"type":"plugin","slug":"syndication-links","name":"Syndication Links","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2015-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e59928f6-7527-4810-8aab-2a71d348dd9e","source":"wordfence","cve":"CVE-2025-54713","title":"Taxi Booking Manager for WooCommerce <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e59928f6-7527-4810-8aab-2a71d348dd9e?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-08-25T00:00:00Z","updated":"2026-05-05T16:06:55Z"},{"id":"wordfence:e599393b-f009-4a3f-a89e-6219ecf33efc","source":"wordfence","cve":"","title":"Donate by BestWebSoft \u2013 Donations Acception Extention for WordPress < 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e599393b-f009-4a3f-a89e-6219ecf33efc?source=api-prod","affected":[{"type":"plugin","slug":"donate-button","name":"Donate by BestWebSoft \u2013 Donations Acception Extention for WordPress","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":false,"patched_in":"2.1.1"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e59b75cf-491a-4894-8a4a-567832b47048","source":"wordfence","cve":"CVE-2023-40197","title":"flowpaper <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e59b75cf-491a-4894-8a4a-567832b47048?source=api-prod","affected":[{"type":"plugin","slug":"flowpaper-lite-pdf-flipbook","name":"flowpaper","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e59cad7f-2da0-4c73-8be2-6bedb1bf6645","source":"wordfence","cve":"CVE-2026-17010","title":"Saitama Addon Pack < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e59cad7f-2da0-4c73-8be2-6bedb1bf6645?source=api-prod","affected":[{"type":"plugin","slug":"cc-addon-pack","name":"Saitama Addon Pack","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-30T14:24:05Z"},{"id":"wordfence:e5a051d6-d37d-450d-9920-38158f75435b","source":"wordfence","cve":"CVE-2026-93622","title":"WPS Limit Login <= 1.5.9.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a051d6-d37d-450d-9920-38158f75435b?source=api-prod","affected":[{"type":"plugin","slug":"wps-limit-login","name":"WPS Limit Login","from":"*","from_inclusive":true,"to":"1.5.9.3","to_inclusive":true,"patched_in":"1.5.9.4"}],"published":"2026-09-23T10:58:05Z","updated":"2026-09-29T19:47:48Z"},{"id":"wordfence:e5a21053-76ac-4290-a466-cb74abae89a7","source":"wordfence","cve":"CVE-2026-22389","title":"Cocco - Kids Store and Baby Shop WordPress Theme <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a21053-76ac-4290-a466-cb74abae89a7?source=api-prod","affected":[{"type":"theme","slug":"cocco","name":"Cocco - Kids Store and Baby Shop WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T13:38:07Z"},{"id":"wordfence:e5a26786-2b15-43ce-a992-fd8cc9cf5600","source":"wordfence","cve":"CVE-2013-7187","title":"FormCraft <= 1.3.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a26786-2b15-43ce-a992-fd8cc9cf5600?source=api-prod","affected":[{"type":"plugin","slug":"formcraft","name":"FormCraft","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2013-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5a2ed81-254e-460c-b3a4-0cb38e089142","source":"wordfence","cve":"CVE-2024-1730","title":"Prime Slider \u2013 Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a2ed81-254e-460c-b3a4-0cb38e089142?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.14.0","to_inclusive":true,"patched_in":"3.14.1"}],"published":"2024-04-19T00:00:00Z","updated":"2024-04-20T03:27:37Z"},{"id":"wordfence:e5a44629-af3f-4bc7-8e68-bbe7df3747f1","source":"wordfence","cve":"CVE-2025-15675","title":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a44629-af3f-4bc7-8e68-bbe7df3747f1?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.8.5.3","to_inclusive":false,"patched_in":"1.8.5.3"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:25:04Z"},{"id":"wordfence:e5a53e42-ad71-4c13-b18b-9958656bbee4","source":"wordfence","cve":"CVE-2024-43233","title":"BSK Forms Blacklist <= 3.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a53e42-ad71-4c13-b18b-9958656bbee4?source=api-prod","affected":[{"type":"plugin","slug":"bsk-gravityforms-blacklist","name":"BSK Forms Blacklist","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:15:41Z"},{"id":"wordfence:e5a76c2b-b4c8-47aa-83ac-cc36c100d70e","source":"wordfence","cve":"CVE-2026-19435","title":"Duplicate Post < 1.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a76c2b-b4c8-47aa-83ac-cc36c100d70e?source=api-prod","affected":[{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T15:53:36Z"},{"id":"wordfence:e5a7b18b-3a92-4065-9c0d-9979eeacff93","source":"wordfence","cve":"CVE-2024-52456","title":"Awesome Studio <= 2.4.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a7b18b-3a92-4065-9c0d-9979eeacff93?source=api-prod","affected":[{"type":"plugin","slug":"awesome-studio","name":"Awesome Studio","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T13:59:29Z"},{"id":"wordfence:e5a9cced-0e5e-4b6e-8291-0a862c9f9523","source":"wordfence","cve":"CVE-2023-2352","title":"CHP Ads Block Detector <= 3.9.4 - Cross-Site Request Forgery via chp_abd_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5a9cced-0e5e-4b6e-8291-0a862c9f9523?source=api-prod","affected":[{"type":"plugin","slug":"chp-ads-block-detector","name":"CHP Ads Block Detector","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5aa9b71-67e4-4049-8dd4-23b76dbd87bb","source":"wordfence","cve":"CVE-2026-15606","title":"Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5aa9b71-67e4-4049-8dd4-23b76dbd87bb?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.9","to_inclusive":true,"patched_in":"3.29.10"}],"published":"2026-08-11T07:56:39Z","updated":"2026-08-11T20:26:11Z"},{"id":"wordfence:e5aab86a-0fcd-4192-a5db-5da1b68e366a","source":"wordfence","cve":"CVE-2026-66663","title":"WP Data Access \u2013 App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5aab86a-0fcd-4192-a5db-5da1b68e366a?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.79","to_inclusive":true,"patched_in":"5.5.80"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:17:27Z"},{"id":"wordfence:e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d","source":"wordfence","cve":"CVE-2023-28165","title":"Backup Bank: WordPress Backup Plugin <= 4.0.28 - Missing Authorization via post_user_feedback_backup_bank","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5ab6dcd-ef22-4fea-9e35-9358ede3ff5d?source=api-prod","affected":[{"type":"plugin","slug":"wp-backup-bank","name":"Backup Bank: WordPress Backup Plugin","from":"*","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":""}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5af0317-ef46-4744-9752-74ce228b5f37","source":"wordfence","cve":"CVE-2026-1357","title":"Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5af0317-ef46-4744-9752-74ce228b5f37?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.123","to_inclusive":true,"patched_in":"0.9.124"}],"published":"2026-02-10T17:13:35Z","updated":"2026-02-11T05:30:13Z"},{"id":"wordfence:e5af2507-4e82-44b2-be50-c19098c22efe","source":"wordfence","cve":"CVE-2026-62038","title":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5af2507-4e82-44b2-be50-c19098c22efe?source=api-prod","affected":[{"type":"plugin","slug":"eroom-zoom-meetings-webinar","name":"eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-28T21:19:20Z"},{"id":"wordfence:e5b00388-48b8-4e82-ab52-1cd3d02177b7","source":"wordfence","cve":"CVE-2026-1780","title":"[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b00388-48b8-4e82-ab52-1cd3d02177b7?source=api-prod","affected":[{"type":"plugin","slug":"crpaid-link-manager","name":"[CR]Paid Link Manager","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":"0.6"}],"published":"2026-03-17T15:03:51Z","updated":"2026-03-18T03:37:13Z"},{"id":"wordfence:e5b01e96-63e6-4ba0-8c83-f9b05e4050b3","source":"wordfence","cve":"CVE-2024-56213","title":"Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b01e96-63e6-4ba0-8c83-f9b05e4050b3?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T16:13:06Z"},{"id":"wordfence:e5b3b12d-273f-4402-a972-5380ec4e661c","source":"wordfence","cve":"CVE-2026-84902","title":"King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b3b12d-273f-4402-a972-5380ec4e661c?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.80","to_inclusive":true,"patched_in":"51.1.81"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:38:34Z"},{"id":"wordfence:e5b4c494-1188-44e2-b07d-5f4d45b36b45","source":"wordfence","cve":"CVE-2024-49685","title":"Custom Twitter Feeds (Tweets Widget) <= 2.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b4c494-1188-44e2-b07d-5f4d45b36b45?source=api-prod","affected":[{"type":"plugin","slug":"custom-twitter-feeds","name":"Custom Twitter Feeds \u2013 A Tweets Widget or X Feed Widget","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:37:45Z"},{"id":"wordfence:e5b6a5ee-33ad-4062-a234-4ce19124d3b7","source":"wordfence","cve":"CVE-2025-64251","title":"Ultimate Learning Pro <= 3.9.3 - Authenticated (Instructor+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b6a5ee-33ad-4062-a234-4ce19124d3b7?source=api-prod","affected":[{"type":"plugin","slug":"indeed-learning-pro","name":"Ultimate Learning Pro","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-12-20T19:15:44Z"},{"id":"wordfence:e5b7b20d-d701-4146-b982-23d6be7a7ea0","source":"wordfence","cve":"CVE-2022-0745","title":"Like Button Rating \u2665 LikeBtn <= 2.6.44 - Arbitrary e-mail Sending","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b7b20d-d701-4146-b982-23d6be7a7ea0?source=api-prod","affected":[{"type":"plugin","slug":"likebtn-like-button","name":"Like Button Rating \u2665 LikeBtn","from":"*","from_inclusive":true,"to":"2.6.44","to_inclusive":true,"patched_in":"2.6.45"}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5b8181e-a268-4952-a113-d8daab52500c","source":"wordfence","cve":"CVE-2026-16567","title":"Document Embedder \u2013 let visitors read files without downloading < 2.3.1 - Unauthenticated Arbitrary Document Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b8181e-a268-4952-a113-d8daab52500c?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:13:13Z"},{"id":"wordfence:e5b98a2c-faed-4e2b-8b94-31e2be95ad40","source":"wordfence","cve":"","title":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets <= 1.3.4 - Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5b98a2c-faed-4e2b-8b94-31e2be95ad40?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2026-02-26T00:00:00Z","updated":"2026-02-26T18:55:08Z"},{"id":"wordfence:e5bab390-1590-44f2-8c65-bc329955ed84","source":"wordfence","cve":"CVE-2022-2594","title":"Advanced Custom Fields <= 5.12.2 - File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5bab390-1590-44f2-8c65-bc329955ed84?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.12.2","to_inclusive":true,"patched_in":"5.12.3"}],"published":"2022-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5be210c-9116-4529-90e3-70625a0c40ce","source":"wordfence","cve":"CVE-2026-42687","title":"EventPrime \u2013 Events Calendar, Bookings and Tickets <= 4.3.2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5be210c-9116-4529-90e3-70625a0c40ce?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"4.3.2.1","to_inclusive":true,"patched_in":"4.3.2.2"}],"published":"2026-05-25T00:00:00Z","updated":"2026-06-01T16:34:36Z"},{"id":"wordfence:e5c0ff52-57c2-447f-bb22-2079607c3217","source":"wordfence","cve":"CVE-2024-32437","title":"eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c0ff52-57c2-447f-bb22-2079607c3217?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.3.28","to_inclusive":true,"patched_in":"3.3.29"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T18:26:13Z"},{"id":"wordfence:e5c188e0-bc5d-4512-b568-dce9ef9b8c06","source":"wordfence","cve":"CVE-2025-22585","title":"Ultimate Image Hover Effects <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c188e0-bc5d-4512-b568-dce9ef9b8c06?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-image-hover-effects","name":"Ultimate Image Hover Effects","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:47:16Z"},{"id":"wordfence:e5c62e54-da06-4b44-ba70-63065e664b0d","source":"wordfence","cve":"CVE-2026-2428","title":"Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification","severity":"high","cvss":7.5,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c62e54-da06-4b44-ba70-63065e664b0d?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.1.17","to_inclusive":true,"patched_in":"6.1.18"}],"published":"2026-02-26T14:33:15Z","updated":"2026-03-12T15:09:51Z"},{"id":"wordfence:e5c86f72-934c-4f3b-ab2a-65df1490ca8a","source":"wordfence","cve":"CVE-2026-2301","title":"Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c86f72-934c-4f3b-ab2a-65df1490ca8a?source=api-prod","affected":[{"type":"plugin","slug":"post-duplicator","name":"Post Duplicator","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2026-02-24T21:12:32Z","updated":"2026-02-25T09:26:53Z"},{"id":"wordfence:e5c87ae0-9a53-4292-a4d3-05b3bdb37b71","source":"wordfence","cve":"CVE-2023-0293","title":"Mediamatic \u2013 Media Library Folders <= 2.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c87ae0-9a53-4292-a4d3-05b3bdb37b71?source=api-prod","affected":[{"type":"plugin","slug":"mediamatic","name":"Mediamatic \u2013 Media Library Folders","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":""}],"published":"2022-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5c89df2-69be-4b58-ad3c-ba0191e3d701","source":"wordfence","cve":"CVE-2025-26564","title":"GNUCommerce <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c89df2-69be-4b58-ad3c-ba0191e3d701?source=api-prod","affected":[{"type":"plugin","slug":"gnucommerce","name":"GNUCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T17:10:18Z"},{"id":"wordfence:e5c99252-ca42-4c93-8f24-c39326f26983","source":"wordfence","cve":"CVE-2026-23974","title":"Golo < 1.7.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5c99252-ca42-4c93-8f24-c39326f26983?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":false,"patched_in":"1.7.5"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-09T21:16:59Z"},{"id":"wordfence:e5ca3c84-9d3d-4bbe-90f7-44c9d77a6690","source":"wordfence","cve":"","title":"Plugin for Google Reviews <= 2.2.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5ca3c84-9d3d-4bbe-90f7-44c9d77a6690?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5cc30d9-c73c-440d-a592-08e85270efdb","source":"wordfence","cve":"CVE-2023-0060","title":"Responsive Gallery Grid <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5cc30d9-c73c-440d-a592-08e85270efdb?source=api-prod","affected":[{"type":"plugin","slug":"responsive-gallery-grid","name":"Responsive Gallery Grid","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5ce4685-547c-40d2-9498-e50f390deeea","source":"wordfence","cve":"CVE-2026-24971","title":"Search & Go <= 2.8 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5ce4685-547c-40d2-9498-e50f390deeea?source=api-prod","affected":[{"type":"theme","slug":"searchgo","name":"Search & Go - Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2026-03-13T00:00:00Z","updated":"2026-03-19T15:10:17Z"},{"id":"wordfence:e5d3239b-0f65-46f7-977b-9995542a6eb9","source":"wordfence","cve":"CVE-2024-13702","title":"CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d3239b-0f65-46f7-977b-9995542a6eb9?source=api-prod","affected":[{"type":"plugin","slug":"crm-customer-relationship-management-by-vcita","name":"CRM and Lead Management by vcita","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2025-03-25T19:51:14Z","updated":"2025-03-26T08:21:52Z"},{"id":"wordfence:e5d625d6-57e0-4dc7-b3ee-cb0639a02230","source":"wordfence","cve":"CVE-2026-9612","title":"WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d625d6-57e0-4dc7-b3ee-cb0639a02230?source=api-prod","affected":[{"type":"plugin","slug":"whatsorder-instant-checkout-for-woocommerce","name":"WhatsOrder \u2013 Instant Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:40:18Z","updated":"2026-06-24T05:33:32Z"},{"id":"wordfence:e5d67eb3-c399-437e-a504-2ccdda7c7882","source":"wordfence","cve":"CVE-2021-24907","title":"Everest Forms <= 1.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d67eb3-c399-437e-a504-2ccdda7c7882?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":false,"patched_in":"1.8.0"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5d81318-c9da-4626-acfa-f092d2ce5fe9","source":"wordfence","cve":"CVE-2026-2284","title":"News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d81318-c9da-4626-acfa-f092d2ce5fe9?source=api-prod","affected":[{"type":"plugin","slug":"news-element","name":"News Element Elementor Blog Magazine","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2026-02-18T15:53:23Z","updated":"2026-09-17T18:39:31Z"},{"id":"wordfence:e5d82cd5-42cc-412b-8026-53736680407d","source":"wordfence","cve":"CVE-2025-9881","title":"Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d82cd5-42cc-412b-8026-53736680407d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blogroll","name":"Ultimate Blogroll","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-11T14:48:59Z","updated":"2025-09-12T03:22:44Z"},{"id":"wordfence:e5da24fa-fc7c-406b-896d-8cb8cc107cff","source":"wordfence","cve":"CVE-2022-2369","title":"YaySMTP \u2013 Simple WP SMTP Mail  <= 2.2 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5da24fa-fc7c-406b-896d-8cb8cc107cff?source=api-prod","affected":[{"type":"plugin","slug":"yaysmtp","name":"YaySMTP \u2013 WP Mail SMTP with Email Logs, Tracking & Reports","from":"2.2","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5db103a-a823-47ac-a1f4-c297619cf1a4","source":"wordfence","cve":"CVE-2017-18012","title":"Z-URL Preview <= 1.6.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5db103a-a823-47ac-a1f4-c297619cf1a4?source=api-prod","affected":[{"type":"plugin","slug":"z-url-preview","name":"Z-URL Preview","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2017-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5dc87cd-4f45-4faf-b1e2-64e94eacb180","source":"wordfence","cve":"CVE-2012-6707","title":"WordPress Core - Informational < 6.8 - Weak Hashing Algorithm","severity":"low","cvss":3.7,"cwe":"CWE-261","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5dc87cd-4f45-4faf-b1e2-64e94eacb180?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":false,"patched_in":"6.8"}],"published":"2012-06-20T00:00:00Z","updated":"2025-05-12T18:46:58Z"},{"id":"wordfence:e5df0eea-6b09-4212-9a74-ae145763e972","source":"wordfence","cve":"CVE-2026-6858","title":"Transbank Webpay < 1.14.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5df0eea-6b09-4212-9a74-ae145763e972?source=api-prod","affected":[{"type":"plugin","slug":"transbank-webpay-plus-rest","name":"Transbank Webpay","from":"*","from_inclusive":true,"to":"1.14.0","to_inclusive":false,"patched_in":"1.14.0"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-21T14:36:36Z"},{"id":"wordfence:e5df79e6-649e-4213-b2ff-bc994b372224","source":"wordfence","cve":"CVE-2012-4768","title":"Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5df79e6-649e-4213-b2ff-bc994b372224?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"3.3.5.8","to_inclusive":true,"patched_in":"3.3.5.9"}],"published":"2012-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5e191b4-ca76-4ba1-ad14-b4d501f3af95","source":"wordfence","cve":"CVE-2025-30601","title":"Flipdish Ordering System <= 1.5.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5e191b4-ca76-4ba1-ad14-b4d501f3af95?source=api-prod","affected":[{"type":"plugin","slug":"flipdish-ordering-system","name":"Flipdish Ordering System","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:19:58Z"},{"id":"wordfence:e5ea906a-a0f2-4381-bca2-160fbc75e39c","source":"wordfence","cve":"CVE-2025-59003","title":"Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5ea906a-a0f2-4381-bca2-160fbc75e39c?source=api-prod","affected":[{"type":"theme","slug":"dzonia-lite","name":"Dzonia Lite","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"road-fighter","name":"Road Fighter","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"poloray","name":"Poloray","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"colorway","name":"ColorWay","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"butterbelly","name":"ButterBelly","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"rethink","name":"Rethink","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"themia-lite","name":"Themia Lite","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"compass","name":"Compass","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"cloriato-lite","name":"Cloriato Lite","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-mailgun-smtp","name":"WP Mailgun SMTP","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-sendgrid-smtp","name":"WP SendGrid SMTP","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-12T00:00:00Z","updated":"2025-09-15T17:56:14Z"},{"id":"wordfence:e5ed3ec3-1c05-4fff-a453-11536cfbb366","source":"wordfence","cve":"CVE-2025-23584","title":"Pin Locations on Map <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5ed3ec3-1c05-4fff-a453-11536cfbb366?source=api-prod","affected":[{"type":"plugin","slug":"pin-locations-on-map","name":"Pin Locations on Map","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:13:26Z"},{"id":"wordfence:e5eea72d-f10b-460b-be00-bb5b1c4a1a62","source":"wordfence","cve":"","title":"Image Optimizer WD <= 1.0.26 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5eea72d-f10b-460b-be00-bb5b1c4a1a62?source=api-prod","affected":[{"type":"plugin","slug":"image-optimizer-wd","name":"Image Optimizer by 10web \u2013 Image Optimizer and Compression plugin","from":"*","from_inclusive":true,"to":"1.0.26","to_inclusive":true,"patched_in":"1.0.27"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e5f3feb7-547e-4c01-8453-a1fc207ee009","source":"wordfence","cve":"CVE-2025-12192","title":"The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-697","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f3feb7-547e-4c01-8453-a1fc207ee009?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.15.9","to_inclusive":true,"patched_in":"6.15.10"}],"published":"2025-11-04T21:06:17Z","updated":"2025-11-05T09:27:41Z"},{"id":"wordfence:e5f4dfc6-6094-46ee-9901-61a0d9ed8c99","source":"wordfence","cve":"CVE-2026-19857","title":"Formidable Forms <= 6.34 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f4dfc6-6094-46ee-9901-61a0d9ed8c99?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.34","to_inclusive":true,"patched_in":"6.35"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:44:15Z"},{"id":"wordfence:e5f59d5a-5a9d-4d74-a9e0-c70c7592770d","source":"wordfence","cve":"CVE-2026-85016","title":"Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f59d5a-5a9d-4d74-a9e0-c70c7592770d?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":true,"patched_in":"2.0.21"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-08T23:56:53Z"},{"id":"wordfence:e5f8afa3-f20c-4dfb-bcc6-2682f68723ca","source":"wordfence","cve":"CVE-2026-103482","title":"Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5f8afa3-f20c-4dfb-bcc6-2682f68723ca?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-optin-box","name":"Noptin \u2013 Newsletter, New Post Notifications & Email Automation","from":"*","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-10-09T17:25:21Z","updated":"2026-10-10T05:31:06Z"},{"id":"wordfence:e5fe609a-c823-40ec-89f2-bcf22735acee","source":"wordfence","cve":"CVE-2026-92428","title":"Rede Ita\u00fa for WooCommerce <= 5.5.2 - Unauthenticated Arbitrary Order Status Manipulation","severity":"high","cvss":7.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5fe609a-c823-40ec-89f2-bcf22735acee?source=api-prod","affected":[{"type":"plugin","slug":"woo-rede","name":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:55:48Z"},{"id":"wordfence:e5fed63c-41bb-4f60-a50f-5ee190c76156","source":"wordfence","cve":"CVE-2024-51862","title":"Google Visualization Charts <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e5fed63c-41bb-4f60-a50f-5ee190c76156?source=api-prod","affected":[{"type":"plugin","slug":"google-visualization-charts","name":"Google Visualization Charts","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:30:19Z"},{"id":"wordfence:e6001516-3d3c-48a9-92ae-a1d249d58cec","source":"wordfence","cve":"CVE-2022-3835","title":"Kwayy HTML Sitemap <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scipting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6001516-3d3c-48a9-92ae-a1d249d58cec?source=api-prod","affected":[{"type":"plugin","slug":"kwayy-html-sitemap","name":"Kwayy HTML Sitemap","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6003a2a-dda5-4db4-8a0c-0d26d79529f2","source":"wordfence","cve":"CVE-2022-1951","title":"core plugin for kitestudio themes <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6003a2a-dda5-4db4-8a0c-0d26d79529f2?source=api-prod","affected":[{"type":"plugin","slug":"kitestudio-core","name":"core plugin for kitestudio themes","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6030712-ae4f-4cdb-a500-dff689947ff3","source":"wordfence","cve":"CVE-2025-14385","title":"WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6030712-ae4f-4cdb-a500-dff689947ff3?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.2.3","to_inclusive":true,"patched_in":"10.2.4"}],"published":"2025-12-16T15:58:59Z","updated":"2025-12-17T04:31:34Z"},{"id":"wordfence:e604979e-81e0-4c9a-844c-381599bf226e","source":"wordfence","cve":"CVE-2024-30239","title":"Zoho Campaigns <= 2.0.6 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e604979e-81e0-4c9a-844c-381599bf226e?source=api-prod","affected":[{"type":"plugin","slug":"zoho-campaigns","name":"Zoho Campaigns","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-17T21:11:06Z"},{"id":"wordfence:e6066890-75b9-468d-9f67-78e93f58dcc1","source":"wordfence","cve":"CVE-2025-10494","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6066890-75b9-468d-9f67-78e93f58dcc1?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.89","to_inclusive":true,"patched_in":"1.4.90"}],"published":"2025-10-07T14:44:40Z","updated":"2025-10-08T03:31:33Z"},{"id":"wordfence:e607b1a0-9552-4822-ab8b-fb995648dae0","source":"wordfence","cve":"CVE-2025-58783","title":"Gutentor <= 3.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e607b1a0-9552-4822-ab8b-fb995648dae0?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2025-09-05T00:00:00Z","updated":"2026-04-15T13:36:19Z"},{"id":"wordfence:e608c75f-dd84-4921-ae61-2bfa5cd717a5","source":"wordfence","cve":"CVE-2022-1275","title":"BannerMan <= 0.2.4 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e608c75f-dd84-4921-ae61-2bfa5cd717a5?source=api-prod","affected":[{"type":"plugin","slug":"bannerman","name":"BannerMan","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6090a49-f3dc-4b7b-bc86-eb7ec57b7ba4","source":"wordfence","cve":"CVE-2024-22153","title":"Stock Locations for WooCommerce <= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6090a49-f3dc-4b7b-bc86-eb7ec57b7ba4?source=api-prod","affected":[{"type":"plugin","slug":"stock-locations-for-woocommerce","name":"Stock Locations for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e60cd9eb-5707-493d-8f3a-3d4160e14735","source":"wordfence","cve":"CVE-2026-42655","title":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management <= 4.6.19 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e60cd9eb-5707-493d-8f3a-3d4160e14735?source=api-prod","affected":[{"type":"plugin","slug":"wp-payment-form","name":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management","from":"*","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"4.6.20"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T14:06:06Z"},{"id":"wordfence:e60d4528-2ec5-4a4b-be77-0fc012c13720","source":"wordfence","cve":"CVE-2024-12852","title":"Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e60d4528-2ec5-4a4b-be77-0fc012c13720?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T06:41:38Z"},{"id":"wordfence:e60de5d9-34f8-4068-b656-11b2b6cb36d4","source":"wordfence","cve":"","title":"Keyring < 1.5.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e60de5d9-34f8-4068-b656-11b2b6cb36d4?source=api-prod","affected":[{"type":"plugin","slug":"keyring","name":"Keyring","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e61110fc-cc2d-4207-97b6-b21459334216","source":"wordfence","cve":"CVE-2024-4104","title":"ADFO \u2013 Custom data in admin dashboard <= 1.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61110fc-cc2d-4207-97b6-b21459334216?source=api-prod","affected":[{"type":"plugin","slug":"admin-form","name":"ADFO \u2013 Custom data in admin dashboard","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:41Z"},{"id":"wordfence:e6139543-81e3-480a-93a4-1d87b3f3f51e","source":"wordfence","cve":"CVE-2025-13493","title":"Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6139543-81e3-480a-93a4-1d87b3f3f51e?source=api-prod","affected":[{"type":"plugin","slug":"latest-registered-users","name":"Latest Registered Users","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:39:13Z","updated":"2026-01-07T08:21:54Z"},{"id":"wordfence:e61396d0-9396-449c-b8c4-53fc4e2c57bb","source":"wordfence","cve":"CVE-2025-24000","title":"Post SMTP <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via Email Log Exposure","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61396d0-9396-449c-b8c4-53fc4e2c57bb?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-07-21T00:00:00Z","updated":"2025-07-24T22:57:41Z"},{"id":"wordfence:e6140ca6-7f7a-41c3-9dde-b95c85e174ad","source":"wordfence","cve":"CVE-2025-52835","title":"WING WordPress Migrator <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6140ca6-7f7a-41c3-9dde-b95c85e174ad?source=api-prod","affected":[{"type":"plugin","slug":"wing-migrator","name":"WING Website Migrator","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-12-30T00:00:00Z","updated":"2026-04-15T13:32:57Z"},{"id":"wordfence:e615833a-0408-4e39-b63d-075bff39a9bf","source":"wordfence","cve":"CVE-2023-26529","title":"DupeOff <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e615833a-0408-4e39-b63d-075bff39a9bf?source=api-prod","affected":[{"type":"plugin","slug":"dupeoff","name":"DupeOff","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e615e08f-656e-415b-9d08-80afebffa6c8","source":"wordfence","cve":"CVE-2025-49439","title":"Atelier Create CV <= 1.1.5 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e615e08f-656e-415b-9d08-80afebffa6c8?source=api-prod","affected":[{"type":"plugin","slug":"atelier-create-cv","name":"Atelier Create CV","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-18T16:27:01Z"},{"id":"wordfence:e616a2db-7249-4c7d-84f6-5fac198cebc6","source":"wordfence","cve":"CVE-2025-64262","title":"Auto Prune Posts <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e616a2db-7249-4c7d-84f6-5fac198cebc6?source=api-prod","affected":[{"type":"plugin","slug":"auto-prune-posts","name":"Auto Prune Posts","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2025-11-08T00:00:00Z","updated":"2025-11-17T19:03:13Z"},{"id":"wordfence:e618a3ca-e9de-47b7-bb86-b9493006d831","source":"wordfence","cve":"CVE-2026-122222","title":"Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e618a3ca-e9de-47b7-bb86-b9493006d831?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2026-11-05T20:33:19Z","updated":"2026-11-06T08:38:08Z"},{"id":"wordfence:e61a5989-ea75-4c11-a937-66488ecdb10d","source":"wordfence","cve":"CVE-2021-24858","title":"Cookie Notification Plugin for WordPress < 1.0.9 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61a5989-ea75-4c11-a937-66488ecdb10d?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookie-user-info","name":"Cookie Notification Plugin for WordPress \u2013 WP Cookie User Info","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e61b6e54-b330-41a5-b13f-ba11c10d8bfe","source":"wordfence","cve":"CVE-2023-39924","title":"Simple File List <= 6.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61b6e54-b330-41a5-b13f-ba11c10d8bfe?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.1.9","to_inclusive":true,"patched_in":"6.1.10"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e61ced65-b65d-44e5-b9bc-b7081c38089f","source":"wordfence","cve":"CVE-2025-26731","title":"ARPrice <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61ced65-b65d-44e5-b9bc-b7081c38089f?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:40:47Z"},{"id":"wordfence:e61de5fd-b46f-4439-b244-364c3ef37cdb","source":"wordfence","cve":"CVE-2026-116851","title":"eCommerce Product Catalog <= 3.6.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61de5fd-b46f-4439-b244-364c3ef37cdb?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-10-30T08:24:47Z","updated":"2026-11-03T19:33:49Z"},{"id":"wordfence:e61f1835-2e56-40c8-b4b9-b3b9766d7e46","source":"wordfence","cve":"CVE-2022-44585","title":"Homepage PopUp <= 1.2.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61f1835-2e56-40c8-b4b9-b3b9766d7e46?source=api-prod","affected":[{"type":"plugin","slug":"homepage-pop-up","name":"Homepage Pop-up","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e61faffc-1b4a-4f53-93c1-03dae5fba2e7","source":"wordfence","cve":"CVE-2026-66658","title":"Reviewer <= 3.14.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e61faffc-1b4a-4f53-93c1-03dae5fba2e7?source=api-prod","affected":[{"type":"plugin","slug":"reviewer","name":"reviewer","from":"*","from_inclusive":true,"to":"3.14.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T18:48:42Z"},{"id":"wordfence:e6201ab2-f29b-4790-a1a6-4789b108f546","source":"wordfence","cve":"CVE-2025-26906","title":"WP Delete User Accounts <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6201ab2-f29b-4790-a1a6-4789b108f546?source=api-prod","affected":[{"type":"plugin","slug":"wp-delete-user-accounts","name":"WP Delete User Accounts","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-16T20:06:48Z"},{"id":"wordfence:e620328e-f4f4-4f3a-8767-efbc676f72a4","source":"wordfence","cve":"CVE-2017-5489","title":"WordPress Core < 4.7.1 - Cross-Site Request Forgery via Uploading Flash File","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e620328e-f4f4-4f3a-8767-efbc676f72a4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e621c82c-ab35-4188-a592-03c09b70f0ae","source":"wordfence","cve":"CVE-2024-3669","title":"Web Directory Free <= 1.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e621c82c-ab35-4188-a592-03c09b70f0ae?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T17:36:28Z"},{"id":"wordfence:e625130f-8e21-4baf-9d3c-4cbb806b9e52","source":"wordfence","cve":"CVE-2024-3213","title":"Relevanssi \u2013 A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e625130f-8e21-4baf-9d3c-4cbb806b9e52?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.25.1","to_inclusive":true,"patched_in":"2.25.2"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.22.1","to_inclusive":true,"patched_in":"4.22.2"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:30Z"},{"id":"wordfence:e6270944-31c0-4d6d-a23f-87fce37ff8b0","source":"wordfence","cve":"","title":"SyntaxHighlighter Evolved <= 3.1.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6270944-31c0-4d6d-a23f-87fce37ff8b0?source=api-prod","affected":[{"type":"plugin","slug":"syntaxhighlighter","name":"SyntaxHighlighter Evolved","from":"*","from_inclusive":true,"to":"3.1.9","to_inclusive":true,"patched_in":"3.1.10"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6292935-a67e-4b59-9b3c-0b71365193b7","source":"wordfence","cve":"CVE-2023-2600","title":"Custom Base Terms <= 1.0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'base'","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6292935-a67e-4b59-9b3c-0b71365193b7?source=api-prod","affected":[{"type":"plugin","slug":"custom-base-terms","name":"Custom Base Terms","from":"*","from_inclusive":true,"to":"1.0.2.3","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e62a58ec-4ea5-4241-8148-fc8801bd59b3","source":"wordfence","cve":"","title":"Our Services Showcase <= 2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e62a58ec-4ea5-4241-8148-fc8801bd59b3?source=api-prod","affected":[{"type":"plugin","slug":"our-services-showcase","name":"Our Services Showcase","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e62a77a4-d2c4-4043-99b2-0918ea18eeb5","source":"wordfence","cve":"CVE-2024-3966","title":"Pray For Me <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e62a77a4-d2c4-4043-99b2-0918ea18eeb5?source=api-prod","affected":[{"type":"plugin","slug":"pray-for-me","name":"Pray For Me","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:34:58Z"},{"id":"wordfence:e62ad97d-2f66-4ee9-9062-4cdb74f76a3a","source":"wordfence","cve":"CVE-2026-40748","title":"Kids Gift Shop <= 0.5.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e62ad97d-2f66-4ee9-9062-4cdb74f76a3a?source=api-prod","affected":[{"type":"theme","slug":"kids-gift-shop","name":"Kids Gift Shop","from":"*","from_inclusive":true,"to":"0.5.4","to_inclusive":true,"patched_in":"0.5.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:27:04Z"},{"id":"wordfence:e62e77b2-0fc9-4a6b-a0e2-8858dbf9d8a1","source":"wordfence","cve":"CVE-2025-62964","title":"MDTF <= 1.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e62e77b2-0fc9-4a6b-a0e2-8858dbf9d8a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2025-10-16T00:00:00Z","updated":"2026-05-05T18:34:04Z"},{"id":"wordfence:e62fa16f-a4a1-44a7-9a66-abafd8dddf67","source":"wordfence","cve":"CVE-2023-47788","title":"Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e62fa16f-a4a1-44a7-9a66-abafd8dddf67?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"12.7","to_inclusive":false,"patched_in":"12.7"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e632b842-b3d2-461f-aaed-e413d98964a5","source":"wordfence","cve":"CVE-2025-31626","title":"Support Helpdesk Ticket System Lite <= 4.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e632b842-b3d2-461f-aaed-e413d98964a5?source=api-prod","affected":[{"type":"plugin","slug":"ticket-help-desk-system-lite","name":"Support Helpdesk Ticket System Lite","from":"*","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2025-04-02T00:00:00Z","updated":"2026-10-13T16:54:24Z"},{"id":"wordfence:e634dafc-8eb0-406f-93b1-ee1d2b44171d","source":"wordfence","cve":"CVE-2025-4224","title":"wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e634dafc-8eb0-406f-93b1-ee1d2b44171d?source=api-prod","affected":[{"type":"plugin","slug":"wpforo-advanced-attachments","name":"wpForo + wpForo Advanced Attachments","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-06-02T00:00:00Z","updated":"2025-06-03T02:27:35Z"},{"id":"wordfence:e635dfb3-002d-4197-b14a-0136a1990a75","source":"wordfence","cve":"CVE-2024-1590","title":"Page Builder: Pagelayer \u2013 Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button","severity":"medium","cvss":4.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e635dfb3-002d-4197-b14a-0136a1990a75?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2024-02-22T00:00:00Z","updated":"2024-02-23T09:32:37Z"},{"id":"wordfence:e6361ada-f2ba-404e-b9d3-b169da44aa90","source":"wordfence","cve":"CVE-2026-1261","title":"MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6361ada-f2ba-404e-b9d3-b169da44aa90?source=api-prod","affected":[{"type":"plugin","slug":"metform-pro","name":"MetForm Pro","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-03-09T21:09:49Z","updated":"2026-03-10T09:25:32Z"},{"id":"wordfence:e637044d-9b49-4de5-b8b8-d48a0e5e1afc","source":"wordfence","cve":"CVE-2024-5251","title":"Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e637044d-9b49-4de5-b8b8-d48a0e5e1afc?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.20","to_inclusive":true,"patched_in":"3.19.20.1"}],"published":"2024-07-16T18:29:42Z","updated":"2024-07-17T06:45:12Z"},{"id":"wordfence:e63c566d-744b-42f5-9ba6-9007cc60313a","source":"wordfence","cve":"CVE-2024-1723","title":"SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e63c566d-744b-42f5-9ba6-9007cc60313a?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.58.7","to_inclusive":true,"patched_in":"1.58.8"}],"published":"2024-03-04T00:00:00Z","updated":"2024-05-31T15:30:59Z"},{"id":"wordfence:e63da1a9-235d-4a6e-95e0-ac4488dc9eff","source":"wordfence","cve":"","title":"WP Site Protect <= 1.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e63da1a9-235d-4a6e-95e0-ac4488dc9eff?source=api-prod","affected":[{"type":"plugin","slug":"wp-site-protect","name":"WP Site Protect","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e63fded9-6101-4658-8b5e-8993f27e4c4a","source":"wordfence","cve":"CVE-2026-32350","title":"Chocolate House <= 1.1.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e63fded9-6101-4658-8b5e-8993f27e4c4a?source=api-prod","affected":[{"type":"theme","slug":"chocolate-house","name":"Chocolate House","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T20:48:53Z"},{"id":"wordfence:e641453c-8fa0-4b44-b912-b797aeae1795","source":"wordfence","cve":"CVE-2021-24806","title":"Comments - wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e641453c-8fa0-4b44-b912-b797aeae1795?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.3.4","to_inclusive":false,"patched_in":"7.3.4"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e642b5e1-62c1-4aa9-b579-6b2338227dd5","source":"wordfence","cve":"CVE-2026-2432","title":"CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=api-prod","affected":[{"type":"plugin","slug":"cm-custom-reports","name":"CM Custom Reports \u2013 Flexible reporting to track what matters most","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-03-19T19:57:41Z","updated":"2026-03-20T08:26:03Z"},{"id":"wordfence:e6460406-da83-4dad-97a5-fe961f0c46fc","source":"wordfence","cve":"CVE-2023-31079","title":"Tippy <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6460406-da83-4dad-97a5-fe961f0c46fc?source=api-prod","affected":[{"type":"plugin","slug":"tippy","name":"Tippy","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e647d1ff-2d2c-43e4-b723-28ed410c4b3a","source":"wordfence","cve":"","title":"Classic Editor Addon < 2.6.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e647d1ff-2d2c-43e4-b723-28ed410c4b3a?source=api-prod","affected":[{"type":"plugin","slug":"classic-editor-addon","name":"Classic Editor +","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2022-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e647fcde-e36a-4432-abec-73e414991e96","source":"wordfence","cve":"CVE-2022-0533","title":"Ditty (formerly Ditty News Ticker) <= 3.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e647fcde-e36a-4432-abec-73e414991e96?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":false,"patched_in":"3.0.15"}],"published":"2022-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6481a6e-5875-44d8-9b24-594fb73e8942","source":"wordfence","cve":"","title":"Covert VideoPress (All Known Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6481a6e-5875-44d8-9b24-594fb73e8942?source=api-prod","affected":[{"type":"theme","slug":"covertvideopress","name":"Covert VideoPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e649765f-c051-438e-ba9a-df9a91fef428","source":"wordfence","cve":"CVE-2024-34569","title":"Zotpress <= 7.3.9 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e649765f-c051-438e-ba9a-df9a91fef428?source=api-prod","affected":[{"type":"plugin","slug":"zotpress","name":"Zotpress","from":"*","from_inclusive":true,"to":"7.3.9","to_inclusive":true,"patched_in":"7.3.10"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T21:18:56Z"},{"id":"wordfence:e6497a31-b4ad-4847-b1dc-96c1004ccb60","source":"wordfence","cve":"CVE-2026-27096","title":"ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6497a31-b4ad-4847-b1dc-96c1004ccb60?source=api-prod","affected":[{"type":"theme","slug":"colorfolio","name":"ColorFolio","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-21T12:57:31Z"},{"id":"wordfence:e6499f46-b3b6-496f-a9bc-531bcbba2418","source":"wordfence","cve":"CVE-2024-31294","title":"WP Sort Order <= 1.3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6499f46-b3b6-496f-a9bc-531bcbba2418?source=api-prod","affected":[{"type":"plugin","slug":"wp-sort-order","name":"WP Sort Order","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T14:05:09Z"},{"id":"wordfence:e64a688c-c150-4b10-81ef-bbe7f6dd1b8e","source":"wordfence","cve":"CVE-2023-37982","title":"Integration for Contact Form 7 and Salesforce <= 1.3.3 - Open Redirect","severity":"high","cvss":7.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e64a688c-c150-4b10-81ef-bbe7f6dd1b8e?source=api-prod","affected":[{"type":"plugin","slug":"cf7-salesforce","name":"Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e64bb998-277c-4e83-892f-dc9cd74a11e6","source":"wordfence","cve":"CVE-2026-56062","title":"Quotes llama <= 3.1.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e64bb998-277c-4e83-892f-dc9cd74a11e6?source=api-prod","affected":[{"type":"plugin","slug":"quotes-llama","name":"Quotes llama","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:44:15Z"},{"id":"wordfence:e64e41a1-ea8e-41b4-911c-672caf0d2df1","source":"wordfence","cve":"CVE-2024-9520","title":"UserPlus <= 2.0 - Missing Authorization via Multiple Functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e64e41a1-ea8e-41b4-911c-672caf0d2df1?source=api-prod","affected":[{"type":"plugin","slug":"userplus","name":"User registration & user profile \u2013 UserPlus","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T00:00:00Z","updated":"2024-10-10T02:06:13Z"},{"id":"wordfence:e64f3e2b-7c82-4b30-bb3e-b84916e29232","source":"wordfence","cve":"CVE-2025-31012","title":"Age Gate <= 3.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e64f3e2b-7c82-4b30-bb3e-b84916e29232?source=api-prod","affected":[{"type":"plugin","slug":"age-gate","name":"Age Gate","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:04:38Z"},{"id":"wordfence:e6504623-5356-4eba-97e7-c6dc1245e9c1","source":"wordfence","cve":"CVE-2026-54809","title":"GIFT4U \u2013 Gift Cards All in One for Woo <= 1.0.10 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6504623-5356-4eba-97e7-c6dc1245e9c1?source=api-prod","affected":[{"type":"plugin","slug":"gift4u-gift-cards-all-in-one-for-woo","name":"GIFT4U \u2013 Gift Cards All in One for Woo","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:57:37Z"},{"id":"wordfence:e651766b-705d-415d-90bc-8b4f4418222c","source":"wordfence","cve":"CVE-2023-37980","title":"Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e651766b-705d-415d-90bc-8b4f4418222c?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-for-wp-job-manager","name":"Custom Field For WP Job Manager","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6524e66-5bd1-4616-8185-c0501a09893e","source":"wordfence","cve":"CVE-2025-9318","title":"Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6524e66-5bd1-4616-8185-c0501a09893e?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.1","to_inclusive":true,"patched_in":"10.3.2"}],"published":"2026-01-05T20:24:00Z","updated":"2026-01-06T09:21:00Z"},{"id":"wordfence:e6553417-cb3d-40f4-b2ac-acd2d8d04f14","source":"wordfence","cve":"CVE-2026-86710","title":"Login with QR <= 1.0.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6553417-cb3d-40f4-b2ac-acd2d8d04f14?source=api-prod","affected":[{"type":"plugin","slug":"login-with-qr","name":"Login with QR","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T19:43:20Z"},{"id":"wordfence:e659cc27-ae01-4d7b-a6f4-9fcb2aeb1b57","source":"wordfence","cve":"CVE-2022-4352","title":"Qe SEO Handyman <= 1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e659cc27-ae01-4d7b-a6f4-9fcb2aeb1b57?source=api-prod","affected":[{"type":"plugin","slug":"qe-seo-handyman","name":"Qe SEO Handyman","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e65cf73b-349b-4982-b6ec-a2c94d327d0a","source":"wordfence","cve":"CVE-2013-1758","title":"Marekkis Watermark-Plugin <= 0.9.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e65cf73b-349b-4982-b6ec-a2c94d327d0a?source=api-prod","affected":[{"type":"plugin","slug":"marekkis-watermark","name":"Marekkis Watermark-Plugin","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2013-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e65ff338-579d-4e42-842b-2a54a13eaba4","source":"wordfence","cve":"CVE-2025-62899","title":"Photospace Responsive <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e65ff338-579d-4e42-842b-2a54a13eaba4?source=api-prod","affected":[{"type":"plugin","slug":"photospace-responsive","name":"Photospace Responsive Gallery","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-27T00:00:00Z","updated":"2025-10-29T15:06:03Z"},{"id":"wordfence:e6617c63-7659-4d8c-85de-d24f599375c1","source":"wordfence","cve":"CVE-2026-103065","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6617c63-7659-4d8c-85de-d24f599375c1?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2026-10-01T13:48:44Z","updated":"2026-10-08T23:15:01Z"},{"id":"wordfence:e662761d-1dc8-4998-83b5-316ce683b5b6","source":"wordfence","cve":"CVE-2021-24940","title":"Persian WooCommerce <= 5.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e662761d-1dc8-4998-83b5-316ce683b5b6?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce","name":"\u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u0641\u0627\u0631\u0633\u06cc | \u0641\u0627\u0631\u0633\u06cc \u0648 \u0634\u0645\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633","from":"*","from_inclusive":true,"to":"5.8.0","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2022-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6650eb7-143f-4c8f-b18f-056fc82972fc","source":"wordfence","cve":"CVE-2022-46802","title":"Product Reviews Import Export for WooCommerce <= 1.4.8 - CSV Injection","severity":"medium","cvss":4.8,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6650eb7-143f-4c8f-b18f-056fc82972fc?source=api-prod","affected":[{"type":"plugin","slug":"product-reviews-import-export-for-woocommerce","name":"Product Reviews Import Export for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e669ae60-c015-4b84-86a8-56aab9fe23bd","source":"wordfence","cve":"CVE-2008-5278","title":"WordPress Core < 2.6.5 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e669ae60-c015-4b84-86a8-56aab9fe23bd?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2008-12-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e66ae9e3-7455-4671-9fcb-f0d017ae3346","source":"wordfence","cve":"CVE-2024-52434","title":"Popup by Supsystic <= 1.10.29 - Authenticated (Admin+) Remote Code Execution","severity":"critical","cvss":9.1,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e66ae9e3-7455-4671-9fcb-f0d017ae3346?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.29","to_inclusive":true,"patched_in":"1.10.30"}],"published":"2024-11-15T00:00:00Z","updated":"2025-04-10T15:04:14Z"},{"id":"wordfence:e66b5c12-3acb-41f7-ae5f-8a9130053e45","source":"wordfence","cve":"CVE-2024-23511","title":"The Plus Addons for Elementor <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e66b5c12-3acb-41f7-ae5f-8a9130053e45?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-02T00:11:04Z"},{"id":"wordfence:e66bd1e1-a299-42ea-a97a-7d9acaa3519e","source":"wordfence","cve":"CVE-2025-31460","title":"OmniLeads Scripts and Tags Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e66bd1e1-a299-42ea-a97a-7d9acaa3519e?source=api-prod","affected":[{"type":"plugin","slug":"omnileads-scripts-and-tags-manager","name":"OmniLeads Scripts and Tags Manager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:07:16Z"},{"id":"wordfence:e66c5a82-9647-46b0-ab3f-b2cd4740bb10","source":"wordfence","cve":"CVE-2026-110507","title":"Page Builder by SiteOrigin < 2.38.0 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e66c5a82-9647-46b0-ab3f-b2cd4740bb10?source=api-prod","affected":[{"type":"plugin","slug":"siteorigin-panels","name":"Page Builder by SiteOrigin","from":"*","from_inclusive":true,"to":"2.38.0","to_inclusive":false,"patched_in":"2.38.0"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:18:16Z"},{"id":"wordfence:e66d0c9c-39a2-4f09-b87f-630f1a8054ea","source":"wordfence","cve":"CVE-2022-1265","title":"BulletProof Security <= 6.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e66d0c9c-39a2-4f09-b87f-630f1a8054ea?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":"6.1","to_inclusive":false,"patched_in":"6.1"}],"published":"2022-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e67181d5-e6f5-4a23-898b-df4bbd9fea28","source":"wordfence","cve":"CVE-2026-123657","title":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content < 4.17.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67181d5-e6f5-4a23-898b-df4bbd9fea28?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.6","to_inclusive":false,"patched_in":"4.17.6"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:37Z"},{"id":"wordfence:e67227d2-3fee-4da5-ac8c-00770beab4ce","source":"wordfence","cve":"CVE-2025-23575","title":"DX Sales CRM <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67227d2-3fee-4da5-ac8c-00770beab4ce?source=api-prod","affected":[{"type":"plugin","slug":"dx-sales-crm","name":"DX Sales CRM","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:11:52Z"},{"id":"wordfence:e67422cc-c1ad-40b6-abae-23447e2ff491","source":"wordfence","cve":"CVE-2021-24622","title":"Customer Service Software & Support Ticket System < 5.10.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67422cc-c1ad-40b6-abae-23447e2ff491?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"5.10.4","to_inclusive":false,"patched_in":"5.10.4"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e675957b-b8be-40bc-ae91-9cf0fa3cf374","source":"wordfence","cve":"CVE-2026-77752","title":"Temporary Login Without Password 1.5 - 1.9.8 - Authenticated (Administrator+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e675957b-b8be-40bc-ae91-9cf0fa3cf374?source=api-prod","affected":[{"type":"plugin","slug":"temporary-login-without-password","name":"Temporary Login Without Password","from":"1.5","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:03:30Z"},{"id":"wordfence:e675c9ef-1695-47e2-8bfe-88eae3c9a87e","source":"wordfence","cve":"CVE-2026-85122","title":"Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e675c9ef-1695-47e2-8bfe-88eae3c9a87e?source=api-prod","affected":[{"type":"plugin","slug":"easy-form-builder","name":"Easy Form Builder by WhiteStudio \u2013 Drag & Drop Form Builder","from":"4.0.0","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:36:31Z"},{"id":"wordfence:e675d64c-cbb8-4f24-9b6f-2597a97b49af","source":"wordfence","cve":"CVE-2023-6875","title":"POST SMTP Mailer \u2013 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2024-01-10T00:00:00Z","updated":"2024-07-29T21:37:41Z"},{"id":"wordfence:e679b853-3207-47c9-9cbe-d3ce3826cd00","source":"wordfence","cve":"CVE-2024-32823","title":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP <= 3.4.4 - Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e679b853-3207-47c9-9cbe-d3ce3826cd00?source=api-prod","affected":[{"type":"plugin","slug":"rate-my-post","name":"Rate My Post \u2013 Star Rating Plugin by FeedbackWP","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T17:18:45Z"},{"id":"wordfence:e67ae204-2848-4389-a78d-7b3798e4ee54","source":"wordfence","cve":"CVE-2026-1447","title":"Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67ae204-2848-4389-a78d-7b3798e4ee54?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.19.2","to_inclusive":true,"patched_in":"1.19.3"}],"published":"2026-02-02T18:07:42Z","updated":"2026-02-03T06:38:07Z"},{"id":"wordfence:e67b6467-b96b-431c-9a0d-91919ab1c138","source":"wordfence","cve":"CVE-2024-29121","title":"WooCommerce License Manager <= 5.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67b6467-b96b-431c-9a0d-91919ab1c138?source=api-prod","affected":[{"type":"plugin","slug":"fs-license-manager","name":"WooCommerce License Manager","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T19:41:11Z"},{"id":"wordfence:e67c6c3f-0b2a-424f-b8f2-2771449c82b4","source":"wordfence","cve":"CVE-2025-12675","title":"KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67c6c3f-0b2a-424f-b8f2-2771449c82b4?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-04T18:55:11Z","updated":"2025-11-05T07:28:18Z"},{"id":"wordfence:e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4","source":"wordfence","cve":"CVE-2023-2119","title":"Responsive Filterable Portfolio <= 1.0.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67dfe0f-ac1c-4a78-bfc9-0cfd6c3040d4?source=api-prod","affected":[{"type":"plugin","slug":"responsive-filterable-portfolio","name":"Responsive Filterable Portfolio Gallery \u2013 Media Grid & Video Portfolio","from":"*","from_inclusive":true,"to":"1.0.19","to_inclusive":true,"patched_in":"1.0.20"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e67f680a-8942-45fa-8458-a27c78045aa1","source":"wordfence","cve":"CVE-2024-10813","title":"Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e67f680a-8942-45fa-8458-a27c78045aa1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-table","name":"Product Table for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2024-11-22T15:10:18Z","updated":"2024-11-25T19:40:42Z"},{"id":"wordfence:e6809f7f-4495-4185-b439-820010afc305","source":"wordfence","cve":"CVE-2022-46822","title":"WooCommerce JazzCash Gateway Plugin <= 2.0 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6809f7f-4495-4185-b439-820010afc305?source=api-prod","affected":[{"type":"plugin","slug":"jazzcash-woocommerce-gateway","name":"WooCommerce JazzCash Gateway Plugin","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e681aa8e-522e-4092-aa1f-8ada3097c8d6","source":"wordfence","cve":"CVE-2026-2262","title":"Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e681aa8e-522e-4092-aa1f-8ada3097c8d6?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.21","to_inclusive":true,"patched_in":"3.12.22"}],"published":"2026-04-17T10:47:32Z","updated":"2026-04-17T23:26:48Z"},{"id":"wordfence:e6838714-4128-47c5-b596-91cfc68abade","source":"wordfence","cve":"CVE-2021-24896","title":"Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6838714-4128-47c5-b596-91cfc68abade?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":false,"patched_in":"1.9.5"}],"published":"2021-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e683dd8c-4be5-4959-a301-1d82d3ee0780","source":"wordfence","cve":"CVE-2025-53445","title":"Catwalk <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e683dd8c-4be5-4959-a301-1d82d3ee0780?source=api-prod","affected":[{"type":"theme","slug":"catwalk","name":"Catwalk - Fashion WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-02T00:00:00Z","updated":"2025-12-19T16:26:41Z"},{"id":"wordfence:e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d","source":"wordfence","cve":"CVE-2026-109217","title":"PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache","severity":"medium","cvss":5.3,"cwe":"CWE-524","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68495ad-53ab-4c6b-aecc-1e4bfe34aa0d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-pdf-invoices-packing-slips","name":"PDF Invoices & Packing Slips for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.5","to_inclusive":true,"patched_in":"5.16.6"}],"published":"2026-10-30T18:26:18Z","updated":"2026-10-31T06:44:23Z"},{"id":"wordfence:e688febc-b51b-496a-9ff7-452300956838","source":"wordfence","cve":"CVE-2024-10103","title":"MailPoet <= 5.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e688febc-b51b-496a-9ff7-452300956838?source=api-prod","affected":[{"type":"plugin","slug":"mailpoet","name":"MailPoet \u2013 Newsletters, Email Marketing, and Automation","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2024-10-29T00:00:00Z","updated":"2024-11-15T19:13:14Z"},{"id":"wordfence:e689270f-0340-42dc-8693-65f152e52fb1","source":"wordfence","cve":"CVE-2025-31382","title":"Language Field <=  0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e689270f-0340-42dc-8693-65f152e52fb1?source=api-prod","affected":[{"type":"plugin","slug":"language-field","name":"Language Field","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:40:26Z"},{"id":"wordfence:e68a3487-4436-4c44-9833-689c86a08bc8","source":"wordfence","cve":"CVE-2025-47546","title":"WP Compress <= 6.30.30 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68a3487-4436-4c44-9833-689c86a08bc8?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.30.30","to_inclusive":true,"patched_in":"6.30.31"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:53:16Z"},{"id":"wordfence:e68bbee2-1c1a-4751-988e-dde423f8aab3","source":"wordfence","cve":"CVE-2024-24843","title":"PowerPack Pro for Elementor < 2.10.8 - Cross-Site Request Forgery to Plugin Settings Modification and Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68bbee2-1c1a-4751-988e-dde423f8aab3?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-elements","name":"PowerPack Pro for Elementor","from":"*","from_inclusive":true,"to":"2.10.8","to_inclusive":false,"patched_in":"2.10.8"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T17:32:37Z"},{"id":"wordfence:e68d47e7-9a42-4a77-aefa-fe130500cbd3","source":"wordfence","cve":"CVE-2025-10185","title":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e68d47e7-9a42-4a77-aefa-fe130500cbd3?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.6","to_inclusive":true,"patched_in":"9.1.7"}],"published":"2025-10-10T19:07:08Z","updated":"2025-10-11T07:25:58Z"},{"id":"wordfence:e69122ed-8f18-4f2d-ba77-7538c7b6de6d","source":"wordfence","cve":"CVE-2007-2714","title":"Akismet Spam Protection < 2.0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e69122ed-8f18-4f2d-ba77-7538c7b6de6d?source=api-prod","affected":[{"type":"plugin","slug":"akismet","name":"Akismet Anti-spam: Spam Protection","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2007-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e69392a8-da0a-47af-b851-0bc36727ff5a","source":"wordfence","cve":"CVE-2024-50460","title":"Firelight Lightbox <= 2.3.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e69392a8-da0a-47af-b851-0bc36727ff5a?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:23:32Z"},{"id":"wordfence:e694ef1a-3e81-4995-a96b-2417cb308ce6","source":"wordfence","cve":"CVE-2024-47631","title":"Logo Carousel \u2013 Clients logo carousel for WP <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e694ef1a-3e81-4995-a96b-2417cb308ce6?source=api-prod","affected":[{"type":"plugin","slug":"responsive-client-logo-carousel-slider","name":"Logo Carousel \u2013 showcase client logos professionally","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:59:45Z"},{"id":"wordfence:e6977a58-cce0-4ae8-abe6-1870bbb2bf06","source":"wordfence","cve":"CVE-2022-1950","title":"Youzify <= 1.1.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6977a58-cce0-4ae8-abe6-1870bbb2bf06?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2022-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6984f14-3b89-47f0-8137-26e447cb09f2","source":"wordfence","cve":"CVE-2026-78292","title":"Hash Form \u2013 Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6984f14-3b89-47f0-8137-26e447cb09f2?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-01T21:07:33Z"},{"id":"wordfence:e699f521-9133-41b0-b667-528da78fec06","source":"wordfence","cve":"CVE-2025-1517","title":"Sina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e699f521-9133-41b0-b667-528da78fec06?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2025-02-25T19:36:10Z","updated":"2025-02-26T08:21:58Z"},{"id":"wordfence:e69a06a1-f1a2-4cb0-b8e5-fba850739b57","source":"wordfence","cve":"CVE-2025-68052","title":"Eagle Booking <= 1.3.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e69a06a1-f1a2-4cb0-b8e5-fba850739b57?source=api-prod","affected":[{"type":"plugin","slug":"eagle-booking","name":"Eagle Booking","from":"*","from_inclusive":true,"to":"1.3.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:32:32Z"},{"id":"wordfence:e69c7363-2649-45ce-8515-7a7d0c2e28ef","source":"wordfence","cve":"CVE-2025-28873","title":"Shuffle <= 0.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e69c7363-2649-45ce-8515-7a7d0c2e28ef?source=api-prod","affected":[{"type":"plugin","slug":"shuffle","name":"Shuffle","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:50:57Z"},{"id":"wordfence:e69ca7ef-4d7c-4846-80cb-20cd04a90e17","source":"wordfence","cve":"CVE-2025-47449","title":"Meow Gallery <= 5.2.7 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e69ca7ef-4d7c-4846-80cb-20cd04a90e17?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:18:27Z"},{"id":"wordfence:e6a2580f-4a40-4aed-acbf-afecbd16bbf7","source":"wordfence","cve":"CVE-2024-33917","title":"WTI Like Post <= 1.4.6 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a2580f-4a40-4aed-acbf-afecbd16bbf7?source=api-prod","affected":[{"type":"plugin","slug":"wti-like-post","name":"WTI Like Post","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T14:04:41Z"},{"id":"wordfence:e6a2b2f6-c648-4755-be24-92c7f287813e","source":"wordfence","cve":"","title":"Razorpay for WooCommerce <= 4.5.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a2b2f6-c648-4755-be24-92c7f287813e?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6a60043-a060-472b-9b43-e82a4d2420b0","source":"wordfence","cve":"CVE-2026-97661","title":"Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a60043-a060-472b-9b43-e82a4d2420b0?source=api-prod","affected":[{"type":"plugin","slug":"cf7-redirect-thank-you-page","name":"Business Essentials for Contact Form 7","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-09-30T20:15:27Z","updated":"2026-10-01T08:28:46Z"},{"id":"wordfence:e6a65630-0852-4ffc-8c23-295be95bd7f0","source":"wordfence","cve":"CVE-2024-12699","title":"Service Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a65630-0852-4ffc-8c23-295be95bd7f0?source=api-prod","affected":[{"type":"plugin","slug":"service-boxs","name":"Service Box","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-01-06T21:09:20Z","updated":"2025-01-07T09:22:16Z"},{"id":"wordfence:e6a70210-39bb-44a2-b71a-6f014691a21c","source":"wordfence","cve":"CVE-2026-6252","title":"Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a70210-39bb-44a2-b71a-6f014691a21c?source=api-prod","affected":[{"type":"plugin","slug":"display-a-meta-field-as-block","name":"Meta Field Block \u2013 Display Custom Fields for ACF, Meta Box and More","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2026-05-13T18:17:08Z","updated":"2026-05-14T06:44:13Z"},{"id":"wordfence:e6a7ec29-6dc6-4c73-8cc4-4aa4da79941e","source":"wordfence","cve":"CVE-2025-67467","title":"GiveWP <= 4.13.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a7ec29-6dc6-4c73-8cc4-4aa4da79941e?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.13.1","to_inclusive":true,"patched_in":"4.13.2"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T21:23:58Z"},{"id":"wordfence:e6a9ae9e-17f2-4fcb-8428-f6bf1a500bc4","source":"wordfence","cve":"CVE-2019-20182","title":"FooGallery <= 1.8.12 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a9ae9e-17f2-4fcb-8428-f6bf1a500bc4?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"1.8.12","to_inclusive":true,"patched_in":"1.8.18"}],"published":"2020-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6aa8089-1c29-41ef-b2c0-06841751f7a5","source":"wordfence","cve":"CVE-2025-13894","title":"CSV Sumotto <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6aa8089-1c29-41ef-b2c0-06841751f7a5?source=api-prod","affected":[{"type":"plugin","slug":"csv-sumotto","name":"CSV Sumotto","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:36:52Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:e6ac52eb-ced6-4888-becf-1294d34d3e88","source":"wordfence","cve":"CVE-2025-32491","title":"Rankology SEO \u2013 On-site SEO <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ac52eb-ced6-4888-becf-1294d34d3e88?source=api-prod","affected":[{"type":"plugin","slug":"rankology-seo-all-in-one-seo-analytics","name":"Rankology SEO \u2013 All in One SEO & Analytics","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-07T13:56:13Z"},{"id":"wordfence:e6ae4eea-dc16-47fe-8386-b3b25a7e9611","source":"wordfence","cve":"CVE-2026-39764","title":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.21 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ae4eea-dc16-47fe-8386-b3b25a7e9611?source=api-prod","affected":[{"type":"plugin","slug":"radius-booking","name":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2026-10-05T16:24:39Z","updated":"2026-11-03T22:47:03Z"},{"id":"wordfence:e6b1e4d9-03dc-47e8-ab41-ae9c04dc0132","source":"wordfence","cve":"CVE-2024-13591","title":"Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b1e4d9-03dc-47e8-ab41-ae9c04dc0132?source=api-prod","affected":[{"type":"plugin","slug":"team-builder-for-wpbakery-page-builder","name":"Team Builder For WPBakery Page Builder(Formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:31:43Z","updated":"2025-02-19T07:32:14Z"},{"id":"wordfence:e6b289c2-0e04-43b1-baf1-6a594cc47ea0","source":"wordfence","cve":"CVE-2024-27961","title":"AntiSpam for Contact Form 7 <= 0.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b289c2-0e04-43b1-baf1-6a594cc47ea0?source=api-prod","affected":[{"type":"plugin","slug":"cf7-antispam","name":"AntiSpam for Contact Form 7","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":"0.6.1"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:54:24Z"},{"id":"wordfence:e6b35dc7-bd1d-4cdd-808f-41cf2ebfbb1e","source":"wordfence","cve":"CVE-2026-7441","title":"Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b35dc7-bd1d-4cdd-808f-41cf2ebfbb1e?source=api-prod","affected":[{"type":"plugin","slug":"simple-yearly-archive","name":"Simple Yearly Archive","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2026-08-04T17:52:41Z","updated":"2026-08-05T06:38:01Z"},{"id":"wordfence:e6b3a10e-da2b-4694-85af-54fd7a8c25c1","source":"wordfence","cve":"CVE-2026-19251","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b3a10e-da2b-4694-85af-54fd7a8c25c1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":false,"patched_in":"2.13.0"}],"published":"2026-08-31T00:00:00Z","updated":"2026-09-09T14:18:54Z"},{"id":"wordfence:e6b73447-1fce-4c04-bff9-aa942b7fef31","source":"wordfence","cve":"CVE-2025-69150","title":"Medeus <= 1.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b73447-1fce-4c04-bff9-aa942b7fef31?source=api-prod","affected":[{"type":"theme","slug":"medeus","name":"Medeus","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T11:54:47Z"},{"id":"wordfence:e6b7c795-4d68-49c8-a64f-0ca31d9fdb5e","source":"wordfence","cve":"CVE-2026-117521","title":"Dynific Addons for Elementor (formerly Anywhere Elementor) < 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b7c795-4d68-49c8-a64f-0ca31d9fdb5e?source=api-prod","affected":[{"type":"plugin","slug":"anywhere-elementor","name":"Dynific Addons for Elementor (formerly Anywhere Elementor)","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":false,"patched_in":"1.3.1"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:14Z"},{"id":"wordfence:e6ba15f4-b4ca-4c32-9f4f-dc4a790a115f","source":"wordfence","cve":"CVE-2026-28006","title":"Yungen <= 1.0.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ba15f4-b4ca-4c32-9f4f-dc4a790a115f?source=api-prod","affected":[{"type":"theme","slug":"yungen","name":"Yungen","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:38:05Z"},{"id":"wordfence:e6bb3680-0623-4633-971e-3bc4a52dfad3","source":"wordfence","cve":"CVE-2023-6731","title":"WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6bb3680-0623-4633-971e-3bc4a52dfad3?source=api-prod","affected":[{"type":"plugin","slug":"wp-show-posts","name":"WP Show Posts","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-04-16T00:00:00Z","updated":"2024-07-29T21:37:41Z"},{"id":"wordfence:e6c01d91-a912-4826-97eb-fd77368ae117","source":"wordfence","cve":"CVE-2024-2744","title":"Nextgen Gallery <= 3.59 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6c01d91-a912-4826-97eb-fd77368ae117?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.59","to_inclusive":true,"patched_in":"3.59.1"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-06T12:11:45Z"},{"id":"wordfence:e6c3c72d-d2ee-45be-9958-91301a04ee8e","source":"wordfence","cve":"CVE-2025-23987","title":"Designer <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6c3c72d-d2ee-45be-9958-91301a04ee8e?source=api-prod","affected":[{"type":"plugin","slug":"designer","name":"Designer \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-27T00:00:00Z","updated":"2025-05-29T19:24:16Z"},{"id":"wordfence:e6c4e102-7a09-4a01-8fa2-40f5f41d45ab","source":"wordfence","cve":"CVE-2021-24909","title":"ACF Photo Gallery Field <= 1.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6c4e102-7a09-4a01-8fa2-40f5f41d45ab?source=api-prod","affected":[{"type":"plugin","slug":"navz-photo-gallery","name":"ACF Photo Gallery Field","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6cb81e5-61a4-4b67-a668-d8a7d46b2cea","source":"wordfence","cve":"CVE-2024-12876","title":"Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6cb81e5-61a4-4b67-a668-d8a7d46b2cea?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.6.11"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-07T08:21:28Z"},{"id":"wordfence:e6d14dd6-ff1c-475b-8cff-efc7736124b4","source":"wordfence","cve":"CVE-2023-48770","title":"Aparat <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d14dd6-ff1c-475b-8cff-efc7736124b4?source=api-prod","affected":[{"type":"plugin","slug":"aparat","name":"Aparat","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6d195cd-4df8-4926-b834-d695fc05f81d","source":"wordfence","cve":"CVE-2021-4424","title":"Slider Hero <= 8.2.0 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d195cd-4df8-4926-b834-d695fc05f81d?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"8.2.0","to_inclusive":true,"patched_in":"8.2.1"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6d1ad58-894c-40ed-968e-9ce64eebba55","source":"wordfence","cve":"","title":"Advanced Booking Calendar <= 1.6.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d1ad58-894c-40ed-968e-9ce64eebba55?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2020-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6d40b41-540d-476d-afde-970845543933","source":"wordfence","cve":"CVE-2024-0368","title":"Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys","severity":"high","cvss":8.6,"cwe":"CWE-522","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d40b41-540d-476d-afde-970845543933?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.3","to_inclusive":true,"patched_in":"7.8.4"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:37:42Z"},{"id":"wordfence:e6d5036a-c756-47a6-b071-c393f8a6ce5e","source":"wordfence","cve":"CVE-2023-49838","title":"Multiple Themes by KlbTheme <= (Various Versions) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6d5036a-c756-47a6-b071-c393f8a6ce5e?source=api-prod","affected":[{"type":"theme","slug":"medibazar","name":"Medibazar - Medical WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"machic-core","name":"Machic - Electronics Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"furnob","name":"Furnob - Furniture Store WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"cosmetsy","name":"Cosmetsy - Beauty Cosmetics Shop Theme","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"clotya","name":"Clotya - Fashion Store eCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"bacola","name":"Bacola - Grocery Store and Food eCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"partdo","name":"Partdo - Auto Parts and Tools Shop WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6dbbb52-4202-4d69-837f-c7d5ca06fab5","source":"wordfence","cve":"CVE-2023-4390","title":"Popup Box <= 3.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6dbbb52-4202-4d69-837f-c7d5ca06fab5?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":false,"patched_in":"3.7.2"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6dd0493-dd32-44a2-9a8f-e0c86385a083","source":"wordfence","cve":"CVE-2026-14289","title":"FacturaONE <= 5.36 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6dd0493-dd32-44a2-9a8f-e0c86385a083?source=api-prod","affected":[{"type":"plugin","slug":"wp-facturaone","name":"FacturaONE para WooCommerce con VeriFactu","from":"*","from_inclusive":true,"to":"5.36","to_inclusive":true,"patched_in":"5.37"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-30T17:01:02Z"},{"id":"wordfence:e6de7a25-3079-4023-9faa-7a63952afe25","source":"wordfence","cve":"","title":"Crayon Syntax Highlighter <= 2.6.10 - Directory Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6de7a25-3079-4023-9faa-7a63952afe25?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2015-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6df591d-110d-4b0f-a651-2efdb0f1e1f7","source":"wordfence","cve":"CVE-2026-42381","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.15.0.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6df591d-110d-4b0f-a651-2efdb0f1e1f7?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.15.0.1","to_inclusive":true,"patched_in":"3.15.0.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T14:50:16Z"},{"id":"wordfence:e6e114a3-8a17-4c79-9829-374646b53ed4","source":"wordfence","cve":"CVE-2019-12570","title":"Server Status by Hostname/IP <= 4.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e114a3-8a17-4c79-9829-374646b53ed4?source=api-prod","affected":[{"type":"plugin","slug":"server-status-by-hostnameip","name":"Server Status by Hostname/IP","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":"5.0"}],"published":"2019-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6e35ef6-4b65-47dc-9f5f-2df1f809aac6","source":"wordfence","cve":"CVE-2025-58900","title":"UniTravel <= 1.4.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e35ef6-4b65-47dc-9f5f-2df1f809aac6?source=api-prod","affected":[{"type":"theme","slug":"unitravel","name":"UniTravel | Travel Agency & Tourism Bureau WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:31:13Z"},{"id":"wordfence:e6e48963-e773-46e1-ae45-03fe5e20f09e","source":"wordfence","cve":"CVE-2021-37598","title":"WP Cerber < 8.9.3 - Access Bypass Control","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e48963-e773-46e1-ae45-03fe5e20f09e?source=api-prod","affected":[{"type":"plugin","slug":"wp-cerber","name":"WP Cerber Security, Anti-spam & Malware Scan","from":"*","from_inclusive":true,"to":"8.9.3","to_inclusive":false,"patched_in":"8.9.3"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6e572a0-6a82-40ae-9267-68618911b0e5","source":"wordfence","cve":"CVE-2025-23781","title":"WM Options Import Export <= 1.0.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e572a0-6a82-40ae-9267-68618911b0e5?source=api-prod","affected":[{"type":"plugin","slug":"wm-options-import-export","name":"WM Options Import Export","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T21:03:10Z"},{"id":"wordfence:e6e7889b-a1e2-439f-891d-c7c9a052cafc","source":"wordfence","cve":"CVE-2024-50504","title":"Bulk Change Role <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e7889b-a1e2-439f-891d-c7c9a052cafc?source=api-prod","affected":[{"type":"plugin","slug":"bulk-role-change","name":"Bulk Change Role","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:30:10Z"},{"id":"wordfence:e6e96578-d54b-4c45-91cd-f143311445ea","source":"wordfence","cve":"CVE-2024-37564","title":"PayPlus Payment Gateway <= 7.0.7 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6e96578-d54b-4c45-91cd-f143311445ea?source=api-prod","affected":[{"type":"plugin","slug":"payplus-payment-gateway","name":"PayPlus Payment Gateway","from":"*","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"7.0.8"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-19T14:20:07Z"},{"id":"wordfence:e6eaecb7-0783-4fd9-aeae-70fe2a7eeaf3","source":"wordfence","cve":"CVE-2026-90952","title":"Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Access Mode Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6eaecb7-0783-4fd9-aeae-70fe2a7eeaf3?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-password-protected","name":"WPEPP \u2013 All In One WordPress Security, Firewall, Malware Scanner & Login Protection","from":"2.0.0","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T13:12:13Z"},{"id":"wordfence:e6eafa5f-6352-49b1-8825-6ae32106f972","source":"wordfence","cve":"CVE-2016-20080","title":"Brandfolder \u2013 Digital Asset Management Simplified. <= 3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6eafa5f-6352-49b1-8825-6ae32106f972?source=api-prod","affected":[{"type":"plugin","slug":"brandfolder","name":"Brandfolder \u2013 Digital Asset Management Simplified.","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T17:35:41Z"},{"id":"wordfence:e6ebce82-6260-489e-b0b1-5037a0100626","source":"wordfence","cve":"CVE-2023-0282","title":"YourChannel <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'yrc_lang[Videos]'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ebce82-6260-489e-b0b1-5037a0100626?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6ebe12c-17ed-4be9-8af7-4c822b753af1","source":"wordfence","cve":"CVE-2025-11883","title":"Responsive Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ebe12c-17ed-4be9-8af7-4c822b753af1?source=api-prod","affected":[{"type":"plugin","slug":"responsive-progress-bar","name":"Responsive Progress Bar","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:16:27Z","updated":"2025-10-22T08:27:11Z"},{"id":"wordfence:e6ee592b-df73-46cb-97cd-56f1e2a0d09a","source":"wordfence","cve":"CVE-2025-25140","title":"Simple User Profile <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6ee592b-df73-46cb-97cd-56f1e2a0d09a?source=api-prod","affected":[{"type":"plugin","slug":"simple-user-profile","name":"Simple User Profile","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:29:48Z"},{"id":"wordfence:e6eea2cb-a2a9-4f65-9aea-b88565e47503","source":"wordfence","cve":"CVE-2024-30241","title":"ProfileGrid <= 5.7.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6eea2cb-a2a9-4f65-9aea-b88565e47503?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-07T20:41:41Z"},{"id":"wordfence:e6f1907e-9584-4ff7-8cf5-b285b7df9ec4","source":"wordfence","cve":"CVE-2021-38320","title":"simpleSAMLphp Authentication <= 0.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f1907e-9584-4ff7-8cf5-b285b7df9ec4?source=api-prod","affected":[{"type":"plugin","slug":"simplesamlphp-authentication","name":"simpleSAMLphp Authentication","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-08T20:09:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6f549c8-673b-4032-9b56-5a2e2239eff3","source":"wordfence","cve":"CVE-2022-1005","title":"WP Statistics <= 13.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f549c8-673b-4032-9b56-5a2e2239eff3?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.2","to_inclusive":false,"patched_in":"13.2.2"}],"published":"2022-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6f6dab2-da03-43b6-b9c1-ebc6a7e1d1c9","source":"wordfence","cve":"CVE-2023-47755","title":"WooCommerce Product Carousel Slider <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f6dab2-da03-43b6-b9c1-ebc6a7e1d1c9?source=api-prod","affected":[{"type":"plugin","slug":"product-carousel-slider-for-woocommerce","name":"WooCommerce Product Carousel Slider","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e6f7fa35-a5b4-4dfd-8be8-17b7b8703c6d","source":"wordfence","cve":"CVE-2025-8208","title":"Spexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f7fa35-a5b4-4dfd-8be8-17b7b8703c6d?source=api-prod","affected":[{"type":"plugin","slug":"sastra-essential-addons-for-elementor","name":"Spexo Addons for Elementor \u2013 Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2025-08-23T16:25:20Z","updated":"2025-08-24T05:27:10Z"},{"id":"wordfence:e6facfb9-16d8-42dc-9c7d-fd1dd1342f81","source":"wordfence","cve":"CVE-2025-54737","title":"Jobmonster <= 4.7.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6facfb9-16d8-42dc-9c7d-fd1dd1342f81?source=api-prod","affected":[{"type":"theme","slug":"noo-jobmonster","name":"Noo JobMonster","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2025-08-31T00:00:00Z","updated":"2025-11-12T13:37:37Z"},{"id":"wordfence:e6faf2b7-52e2-4656-9171-4ee17352ed1e","source":"wordfence","cve":"CVE-2026-12128","title":"Pinpoint Booking System <= 2.9.9.6.9 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6faf2b7-52e2-4656-9171-4ee17352ed1e?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.6.9","to_inclusive":true,"patched_in":"2.9.9.7.0"}],"published":"2026-08-14T14:05:46Z","updated":"2026-10-15T18:43:22Z"},{"id":"wordfence:e6fb9558-06e5-4297-93df-ee9a6971f0ec","source":"wordfence","cve":"CVE-2025-2816","title":"Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6fb9558-06e5-4297-93df-ee9a6971f0ec?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"2.8.0","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-01T02:23:05Z"},{"id":"wordfence:e6fbc2a8-6bb7-45d5-8d60-08d28ea85ec8","source":"wordfence","cve":"CVE-2025-22289","title":"LTL Freight Quotes \u2013 Unishippers Edition <= 2.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e6fbc2a8-6bb7-45d5-8d60-08d28ea85ec8?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-unishippers-edition","name":"LTL Freight Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-18T20:30:32Z"},{"id":"wordfence:e700a02f-21a7-4786-b7a7-d0c83a9314e3","source":"wordfence","cve":"CVE-2024-7820","title":"ILC Thickbox <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e700a02f-21a7-4786-b7a7-d0c83a9314e3?source=api-prod","affected":[{"type":"plugin","slug":"ilc-thickbox","name":"ILC Thickbox","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:33:36Z"},{"id":"wordfence:e701b771-59f2-4783-b0a1-bea4d6c3d245","source":"wordfence","cve":"CVE-2025-1063","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e701b771-59f2-4783-b0a1-bea4d6c3d245?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-25T06:58:32Z"},{"id":"wordfence:e7021881-2ce9-4c8b-bcfa-6886cce649d9","source":"wordfence","cve":"CVE-2024-13395","title":"Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7021881-2ce9-4c8b-bcfa-6886cce649d9?source=api-prod","affected":[{"type":"plugin","slug":"threepress","name":"Threepress","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T08:21:45Z"},{"id":"wordfence:e702675c-b3ec-458b-a382-cba5c03879c2","source":"wordfence","cve":"","title":"OnePress Opt-In Panda <= 2.6.2 - Missing Authorization on AJAX Actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e702675c-b3ec-458b-a382-cba5c03879c2?source=api-prod","affected":[{"type":"plugin","slug":"opt-in-panda","name":"OnePress Opt-In Panda","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7028184-2b16-45a8-893a-37eb74bab329","source":"wordfence","cve":"CVE-2023-38517","title":"WRC Pricing Tables <= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7028184-2b16-45a8-893a-37eb74bab329?source=api-prod","affected":[{"type":"plugin","slug":"wrc-pricing-tables","name":"WRC Pricing Tables \u2013 Responsive CSS3 Pricing Tables","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e702bb88-23b6-460e-829b-87f1adc1843f","source":"wordfence","cve":"CVE-2025-39436","title":"I Draw <= 1.0 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e702bb88-23b6-460e-829b-87f1adc1843f?source=api-prod","affected":[{"type":"plugin","slug":"idraw","name":"I Draw","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:51:22Z"},{"id":"wordfence:e703d411-d608-43cc-8806-1d1e837cf797","source":"wordfence","cve":"CVE-2017-18580","title":"WordPress Shortcodes Plugin \u2014 Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e703d411-d608-43cc-8806-1d1e837cf797?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":false,"patched_in":"5.0.1"}],"published":"2017-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e709eb98-d814-45aa-baeb-90a1d7471bcc","source":"wordfence","cve":"CVE-2024-6853","title":"WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Welcome Popup Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e709eb98-d814-45aa-baeb-90a1d7471bcc?source=api-prod","affected":[{"type":"plugin","slug":"wp-multitasking","name":"WP MultiTasking \u2013 WP Utilities","from":"*","from_inclusive":true,"to":"0.1.12","to_inclusive":true,"patched_in":""}],"published":"2024-08-10T00:00:00Z","updated":"2024-08-15T20:15:42Z"},{"id":"wordfence:e70a1197-b5b1-4f30-a253-89eb198c670e","source":"wordfence","cve":"CVE-2024-54329","title":"CleverNode Related Content <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e70a1197-b5b1-4f30-a253-89eb198c670e?source=api-prod","affected":[{"type":"plugin","slug":"clevernode-related-content","name":"CleverNode Related Content","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:13:55Z"},{"id":"wordfence:e70ada17-f129-4675-93b4-a41a7ea93833","source":"wordfence","cve":"CVE-2026-12724","title":"Kirki <= 6.0.11 - Unauthenticated HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e70ada17-f129-4675-93b4-a41a7ea93833?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.0.11","to_inclusive":true,"patched_in":"6.0.12"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-30T13:39:21Z"},{"id":"wordfence:e70d88ba-7613-4cef-b758-d8d63489a3d4","source":"wordfence","cve":"CVE-2012-20002","title":"Tinymce Thumbnail Gallery <= 1.0.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e70d88ba-7613-4cef-b758-d8d63489a3d4?source=api-prod","affected":[{"type":"plugin","slug":"tinymce-thumbnail-gallery","name":"Tinymce Thumbnail Gallery","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2014-08-01T00:00:00Z","updated":"2026-10-28T14:48:53Z"},{"id":"wordfence:e70db623-722d-4255-8eee-b022e8cfa3be","source":"wordfence","cve":"CVE-2025-28860","title":"Google News Editors Picks Feed Generator <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e70db623-722d-4255-8eee-b022e8cfa3be?source=api-prod","affected":[{"type":"plugin","slug":"google-news-editors-picks-news-feeds","name":"Google News Editors Picks Feed Generator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:13:57Z"},{"id":"wordfence:e70e2b73-0627-41a4-b3e8-3c23dfbc3dd5","source":"wordfence","cve":"CVE-2025-26905","title":"Estatik <= 4.3.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e70e2b73-0627-41a4-b3e8-3c23dfbc3dd5?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-02-23T00:00:00Z","updated":"2026-06-23T17:47:46Z"},{"id":"wordfence:e71028cd-18bc-4b16-a376-db34b7212206","source":"wordfence","cve":"CVE-2026-120677","title":"Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e71028cd-18bc-4b16-a376-db34b7212206?source=api-prod","affected":[{"type":"plugin","slug":"optimole-wp","name":"Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","from":"*","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"4.2.19"}],"published":"2026-11-06T14:29:51Z","updated":"2026-11-07T03:28:07Z"},{"id":"wordfence:e7113b1c-78dc-4648-b14a-52ff6668fd1d","source":"wordfence","cve":"CVE-2024-3893","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 3.0.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7113b1c-78dc-4648-b14a-52ff6668fd1d?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.0.10.3","to_inclusive":true,"patched_in":"3.0.11"}],"published":"2024-04-24T00:00:00Z","updated":"2024-10-24T19:00:56Z"},{"id":"wordfence:e71386ea-0546-4aa7-b77a-e1824e80accc","source":"wordfence","cve":"CVE-2024-1159","title":"Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e71386ea-0546-4aa7-b77a-e1824e80accc?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-13T09:31:28Z"},{"id":"wordfence:e71c88ac-c130-40eb-ae8e-dd73aa93e840","source":"wordfence","cve":"CVE-2026-111402","title":"Newsletters <= 4.18.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e71c88ac-c130-40eb-ae8e-dd73aa93e840?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.18.1","to_inclusive":true,"patched_in":"4.18.2"}],"published":"2026-10-22T07:10:01Z","updated":"2026-10-28T01:15:35Z"},{"id":"wordfence:e71e3624-ccda-4c9c-90e9-e557dd19b644","source":"wordfence","cve":"CVE-2024-3897","title":"Popup Box \u2013 Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e71e3624-ccda-4c9c-90e9-e557dd19b644?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.3.7"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:48Z"},{"id":"wordfence:e71e92c2-a3f0-414f-8fc2-5a7f3b23cf05","source":"wordfence","cve":"CVE-2025-57899","title":"WP Compress <= 6.50.54 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e71e92c2-a3f0-414f-8fc2-5a7f3b23cf05?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.50.54","to_inclusive":true,"patched_in":"6.50.55"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-30T12:57:40Z"},{"id":"wordfence:e7203b5c-5753-453c-8fc2-26fcebdeea5b","source":"wordfence","cve":"CVE-2022-43490","title":"Stream <= 3.9.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7203b5c-5753-453c-8fc2-26fcebdeea5b?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e72155ce-d38d-45d1-906c-305bb9b34b45","source":"wordfence","cve":"CVE-2024-51700","title":"NAVER Analytics <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72155ce-d38d-45d1-906c-305bb9b34b45?source=api-prod","affected":[{"type":"plugin","slug":"naver-analytics","name":"NAVER Analytics","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:10:33Z"},{"id":"wordfence:e7222029-0dac-4c96-9bbd-4e040b65fb99","source":"wordfence","cve":"CVE-2025-39446","title":"Booster Plus for WooCommerce <= 7.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7222029-0dac-4c96-9bbd-4e040b65fb99?source=api-prod","affected":[{"type":"plugin","slug":"booster-plus-for-woocommerce","name":"Booster Plus for WooCommerce","from":"*","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:16:17Z"},{"id":"wordfence:e722f6e4-39ec-465d-b897-73de95edf7bf","source":"wordfence","cve":"CVE-2025-49939","title":"JetElements For Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e722f6e4-39ec-465d-b897-73de95edf7bf?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.7.8.1"}],"published":"2025-08-03T00:00:00Z","updated":"2025-10-29T21:19:14Z"},{"id":"wordfence:e724394d-97aa-42e4-b36e-6e49bfefa2f6","source":"wordfence","cve":"CVE-2023-6525","title":"ElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e724394d-97aa-42e4-b36e-6e49bfefa2f6?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-03-15T00:00:00Z","updated":"2024-07-29T21:37:42Z"},{"id":"wordfence:e7263e89-94b2-42e6-a7ed-a86579ce649e","source":"wordfence","cve":"CVE-2024-9895","title":"Smart Online Order for Clover <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7263e89-94b2-42e6-a7ed-a86579ce649e?source=api-prod","affected":[{"type":"plugin","slug":"clover-online-orders","name":"Smart Online Order for Clover","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-10-14T19:57:34Z","updated":"2024-10-15T08:29:12Z"},{"id":"wordfence:e7279f74-c2bd-4601-b8d5-0effe43705a5","source":"wordfence","cve":"CVE-2026-4766","title":"Easy Image Gallery <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7279f74-c2bd-4601-b8d5-0effe43705a5?source=api-prod","affected":[{"type":"plugin","slug":"easy-image-gallery","name":"Easy Image Gallery","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-03-20T15:17:28Z","updated":"2026-09-14T17:11:30Z"},{"id":"wordfence:e72849aa-48b0-4e66-995c-3fb4c7af99e9","source":"wordfence","cve":"CVE-2025-14487","title":"Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72849aa-48b0-4e66-995c-3fb4c7af99e9?source=api-prod","affected":[{"type":"plugin","slug":"handily","name":"Handily","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2026-09-21T19:35:07Z","updated":"2026-09-22T07:41:14Z"},{"id":"wordfence:e728a6e4-e9bf-4672-b1a5-e00b6ac0cded","source":"wordfence","cve":"CVE-2025-49382","title":"JobZilla - Job Board WordPress Theme <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e728a6e4-e9bf-4672-b1a5-e00b6ac0cded?source=api-prod","affected":[{"type":"theme","slug":"jobzilla","name":"JobZilla - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:54:24Z"},{"id":"wordfence:e72b2656-48d6-4d69-b4d0-e7efe0950554","source":"wordfence","cve":"CVE-2025-23668","title":"ChatGPT Open AI Images & Content for WooCommerce <= 2.2.0 - Reflected Cross-Site Scipting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72b2656-48d6-4d69-b4d0-e7efe0950554?source=api-prod","affected":[{"type":"plugin","slug":"glasses-for-woocommerce","name":"ChatGPT Open AI Images & Content for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:26:47Z"},{"id":"wordfence:e72b7e6b-c8ad-44be-b23d-69e8a27670ea","source":"wordfence","cve":"CVE-2024-35172","title":"ShortPixel Adaptive Images <= 3.8.3 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72b7e6b-c8ad-44be-b23d-69e8a27670ea?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-adaptive-images","name":"ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization","from":"*","from_inclusive":true,"to":"3.8.3","to_inclusive":true,"patched_in":"3.8.4"}],"published":"2024-05-10T00:00:00Z","updated":"2024-05-15T20:41:51Z"},{"id":"wordfence:e72e35de-caeb-4ecb-8d13-72fd2df4dd69","source":"wordfence","cve":"CVE-2021-39345","title":"HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72e35de-caeb-4ecb-8d13-72fd2df4dd69?source=api-prod","affected":[{"type":"plugin","slug":"hal","name":"HAL","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e72e87ae-f5c0-4582-a644-b90e93d98e74","source":"wordfence","cve":"CVE-2016-2221","title":"WordPress Core < 4.4.2 - Open Redirect via wp_validate_redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e72e87ae-f5c0-4582-a644-b90e93d98e74?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.12","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.12","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.10","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.9","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.9","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.6","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"3.7.13"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"3.7.13"}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e730114e-bbe1-4385-84cc-a5484acc9da7","source":"wordfence","cve":"CVE-2022-44743","title":"Jobs for WordPress <= 2.5.10.2 - Authenticated (Author+) Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e730114e-bbe1-4385-84cc-a5484acc9da7?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.5.10.2","to_inclusive":true,"patched_in":"2.5.11"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e731292a-4f95-46eb-889e-b00d58f3444e","source":"wordfence","cve":"CVE-2023-2297","title":"Profile Builder \u2013 User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e731292a-4f95-46eb-889e-b00d58f3444e?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e732031f-378a-4e71-8559-19c5e957d38b","source":"wordfence","cve":"CVE-2024-35720","title":"Album Gallery \u2013 WordPress Gallery <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e732031f-378a-4e71-8559-19c5e957d38b?source=api-prod","affected":[{"type":"plugin","slug":"new-album-gallery","name":"Album Gallery for Photo & Video","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:05:25Z"},{"id":"wordfence:e7325d28-bf48-42bb-981c-9713de76e56f","source":"wordfence","cve":"CVE-2026-93947","title":"Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7325d28-bf48-42bb-981c-9713de76e56f?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:42:02Z"},{"id":"wordfence:e733070c-8cf1-4ec2-8a46-f335d757f37a","source":"wordfence","cve":"CVE-2025-67958","title":"TaxCloud for WooCommerce <= 8.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e733070c-8cf1-4ec2-8a46-f335d757f37a?source=api-prod","affected":[{"type":"plugin","slug":"simple-sales-tax","name":"TaxCloud for WooCommerce","from":"*","from_inclusive":true,"to":"8.3.8","to_inclusive":true,"patched_in":"8.4.0"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:37:47Z"},{"id":"wordfence:e7331416-0f52-4790-a494-95c3f528b99c","source":"wordfence","cve":"CVE-2026-62080","title":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates <= 3.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7331416-0f52-4790-a494-95c3f528b99c?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.23.1","to_inclusive":true,"patched_in":"3.50.0"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:40:53Z"},{"id":"wordfence:e7346f1e-a101-4131-8950-dbb0af4505f2","source":"wordfence","cve":"CVE-2022-41633","title":"Community by PeepSo <= 6.0.2.0 - Cross Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7346f1e-a101-4131-8950-dbb0af4505f2?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.0.2.0","to_inclusive":true,"patched_in":"6.0.3.0"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e739b324-f833-4b31-8d4c-40538c924ddf","source":"wordfence","cve":"CVE-2026-7438","title":"Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e739b324-f833-4b31-8d4c-40538c924ddf?source=api-prod","affected":[{"type":"plugin","slug":"bold-timeline-lite","name":"Bold Timeline Lite","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-09-10T14:34:47Z","updated":"2026-09-11T03:39:40Z"},{"id":"wordfence:e739e7d3-756a-4c93-9ca7-f7b9f9657033","source":"wordfence","cve":"CVE-2026-1280","title":"Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e739e7d3-756a-4c93-9ca7-f7b9f9657033?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.5","to_inclusive":true,"patched_in":"23.6"}],"published":"2026-01-27T21:50:20Z","updated":"2026-07-09T19:21:47Z"},{"id":"wordfence:e73b874f-4c41-4b3a-a418-ae5ca1718adc","source":"wordfence","cve":"CVE-2026-94063","title":"Education Center <= 3.6.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e73b874f-4c41-4b3a-a418-ae5ca1718adc?source=api-prod","affected":[{"type":"theme","slug":"education","name":"Education Center | LMS & Online Courses WordPress Theme","from":"*","from_inclusive":true,"to":"3.6.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:06:09Z"},{"id":"wordfence:e73c7762-c51f-4896-8ee8-243573e387fc","source":"wordfence","cve":"CVE-2025-58847","title":"WN Flipbox Pro <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e73c7762-c51f-4896-8ee8-243573e387fc?source=api-prod","affected":[{"type":"plugin","slug":"wn-flipbox-pro","name":"WN Flipbox Pro","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:22:42Z"},{"id":"wordfence:e73fd28f-51d0-44a3-8400-9148bb46ea18","source":"wordfence","cve":"CVE-2025-50007","title":"xSmart <= 1.2.9.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e73fd28f-51d0-44a3-8400-9148bb46ea18?source=api-prod","affected":[{"type":"theme","slug":"xsmart","name":"xSmart - App Landing Page WordPress Theme in Tech Presentation, Promo Marketing & Advertising Agency","from":"*","from_inclusive":true,"to":"1.2.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:38:07Z"},{"id":"wordfence:e743e656-2dd9-43ed-a190-b03af7c75c54","source":"wordfence","cve":"","title":"Abandoned Cart Lite for WooCommerce <= 5.14.1 - Cross-Site Request Forgery via ts_reset_tracking_setting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e743e656-2dd9-43ed-a190-b03af7c75c54?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"5.14.2","to_inclusive":false,"patched_in":"5.14.2"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e74503d5-7498-43d3-995c-20ec4ee975fa","source":"wordfence","cve":"CVE-2025-30523","title":"Super Simple Subscriptions <= 1.1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e74503d5-7498-43d3-995c-20ec4ee975fa?source=api-prod","affected":[{"type":"plugin","slug":"super-simple-subscriptions","name":"Super Simple Subscriptions","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:51:24Z"},{"id":"wordfence:e7465ca4-21e8-4935-b294-e7378b2b01a7","source":"wordfence","cve":"CVE-2023-1400","title":"Modern Events Calendar lite < 6.10.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7465ca4-21e8-4935-b294-e7378b2b01a7?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.10.5","to_inclusive":false,"patched_in":"6.10.5"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e748f351-9278-4043-a15e-4a3e85f445c5","source":"wordfence","cve":"CVE-2026-111948","title":"Profile Builder <= 4.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e748f351-9278-4043-a15e-4a3e85f445c5?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:47:52Z"},{"id":"wordfence:e74be387-1413-49c5-91c6-66e620562b42","source":"wordfence","cve":"","title":"Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e74be387-1413-49c5-91c6-66e620562b42?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.6.4","to_inclusive":true,"patched_in":"7.6.6"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e74e1a7c-4fe6-4041-8c4c-13389dacb9db","source":"wordfence","cve":"CVE-2024-13747","title":"WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e74e1a7c-4fe6-4041-8c4c-13389dacb9db?source=api-prod","affected":[{"type":"plugin","slug":"email-customizer-for-woocommerce-with-drag-drop-builder","name":"WooMail - WooCommerce Email Customizer","from":"*","from_inclusive":true,"to":"3.0.34","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T00:00:00Z","updated":"2025-03-05T09:21:52Z"},{"id":"wordfence:e74fb552-3ef4-47cd-8fe6-8cc1e74b8377","source":"wordfence","cve":"CVE-2025-14034","title":"ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e74fb552-3ef4-47cd-8fe6-8cc1e74b8377?source=api-prod","affected":[{"type":"plugin","slug":"wc-support-system","name":"ilGhera Support System for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-01-05T15:05:40Z","updated":"2026-01-06T03:21:40Z"},{"id":"wordfence:e74ff260-48af-4fc2-80d8-1ff2403f8f33","source":"wordfence","cve":"CVE-2023-48282","title":"Taxonomy filter <= 2.2.9 - Cross-Site Request Forgery via taxonomy_filter_save_main_settings()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e74ff260-48af-4fc2-80d8-1ff2403f8f33?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-filter","name":"Taxonomy Filter","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2023-11-23T00:00:00Z","updated":"2024-04-25T18:13:03Z"},{"id":"wordfence:e7506429-7f8a-45b5-b1b0-6fdb39599ee5","source":"wordfence","cve":"CVE-2020-36728","title":"Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7506429-7f8a-45b5-b1b0-6fdb39599ee5?source=api-prod","affected":[{"type":"plugin","slug":"angwp","name":"Adning Advertising","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2020-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7521577-ce13-4b60-ae11-9c0f9c077cf9","source":"wordfence","cve":"CVE-2026-5069","title":"Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-07-09T13:51:54Z","updated":"2026-07-10T02:30:44Z"},{"id":"wordfence:e752d031-6280-49fb-9754-93066e1add08","source":"wordfence","cve":"CVE-2026-86794","title":"Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e752d031-6280-49fb-9754-93066e1add08?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"1.4.9","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2026-10-27T00:00:00Z","updated":"2026-11-03T20:12:57Z"},{"id":"wordfence:e75313c5-dbc9-4a33-898e-47d8fd299a42","source":"wordfence","cve":"CVE-2024-11426","title":"AutoListicle: Automatically Update Numbered List Articles <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75313c5-dbc9-4a33-898e-47d8fd299a42?source=api-prod","affected":[{"type":"plugin","slug":"autolisticle-automatically-update-numbered-list-articles","name":"AutoListicle: Automatically Update Numbered List Articles","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:22Z"},{"id":"wordfence:e7535b43-dcf0-4d00-833a-d9d86b2520d5","source":"wordfence","cve":"CVE-2022-44591","title":"Anthologize <= 0.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7535b43-dcf0-4d00-833a-d9d86b2520d5?source=api-prod","affected":[{"type":"plugin","slug":"anthologize","name":"Anthologize","from":"*","from_inclusive":true,"to":"0.8.0","to_inclusive":true,"patched_in":"0.8.1"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e753b8cd-8409-4bcf-9bee-0eb70179f3a3","source":"wordfence","cve":"CVE-2025-68524","title":"Avante < 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e753b8cd-8409-4bcf-9bee-0eb70179f3a3?source=api-prod","affected":[{"type":"theme","slug":"avante","name":"avante","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2026-05-08T00:00:00Z","updated":"2026-05-11T20:12:35Z"},{"id":"wordfence:e757ca2f-c4d9-4747-9f84-75ef8a54d485","source":"wordfence","cve":"CVE-2023-41864","title":"PeproDev CF7 Database <= 1.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e757ca2f-c4d9-4747-9f84-75ef8a54d485?source=api-prod","affected":[{"type":"plugin","slug":"pepro-cf7-database","name":"PeproDev CF7 Database","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"1.9.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-05-15T17:55:41Z"},{"id":"wordfence:e75815a3-2414-47f3-b0c4-e5d3e2cb369d","source":"wordfence","cve":"CVE-2026-4665","title":"WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75815a3-2414-47f3-b0c4-e5d3e2cb369d?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.7.11"}],"published":"2026-05-04T15:01:27Z","updated":"2026-05-05T03:37:39Z"},{"id":"wordfence:e758b973-dc2f-4bcf-9846-56ddd73f38db","source":"wordfence","cve":"","title":"Backup and Restore plugin \u2013 WordPress <= 1.0.3 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":5.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e758b973-dc2f-4bcf-9846-56ddd73f38db?source=api-prod","affected":[{"type":"plugin","slug":"backup-and-restore-for-wp","name":"Backup and Restore plugin \u2013 WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2021-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e75a96ab-499b-4f1d-a60b-a5aa9d804363","source":"wordfence","cve":"CVE-2022-4268","title":"Plugin Logic <= 1.0.7 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75a96ab-499b-4f1d-a60b-a5aa9d804363?source=api-prod","affected":[{"type":"plugin","slug":"plugin-logic","name":"Plugin Logic","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2022-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e75b3cc3-5bd6-4af9-94bf-2c3b6270e1c5","source":"wordfence","cve":"CVE-2022-1776","title":"Icegram Engage <= 2.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75b3cc3-5bd6-4af9-94bf-2c3b6270e1c5?source=api-prod","affected":[{"type":"plugin","slug":"icegram","name":"Icegram Engage \u2013 Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e75b6080-25e8-462c-b785-dbdacc10dfe6","source":"wordfence","cve":"CVE-2026-103912","title":"JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75b6080-25e8-462c-b785-dbdacc10dfe6?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.6.1"}],"published":"2026-10-09T17:16:02Z","updated":"2026-10-10T05:31:06Z"},{"id":"wordfence:e75cc91a-9117-4d18-ba70-d8cbae42cd08","source":"wordfence","cve":"CVE-2024-31365","title":"Post Type Builder <= 2.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75cc91a-9117-4d18-ba70-d8cbae42cd08?source=api-prod","affected":[{"type":"plugin","slug":"themify-ptb","name":"Post Type Builder","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-09T00:00:00Z","updated":"2024-07-15T15:36:56Z"},{"id":"wordfence:e75f7e1a-f3bb-4b24-bf04-b83d0e572551","source":"wordfence","cve":"CVE-2024-4391","title":"Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e75f7e1a-f3bb-4b24-bf04-b83d0e572551?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.7","to_inclusive":true,"patched_in":"3.10.8"}],"published":"2024-05-15T20:30:53Z","updated":"2024-05-16T08:32:51Z"},{"id":"wordfence:e760c657-531f-4bf1-8c4a-e437e1353c63","source":"wordfence","cve":"CVE-2026-119303","title":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar < 3.3.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e760c657-531f-4bf1-8c4a-e437e1353c63?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"3.3.7","to_inclusive":false,"patched_in":"3.3.7"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:05:37Z"},{"id":"wordfence:e760cb9a-5e16-47bd-881b-26c7e7a02e81","source":"wordfence","cve":"CVE-2023-6066","title":"Custom Widget Area <= 1.2.5 - Missing Authorization to Authenticated (Subscriber+) Menu Alteration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e760cb9a-5e16-47bd-881b-26c7e7a02e81?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-widget-area","name":"WP Custom Widget area","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2023-12-21T00:00:00Z","updated":"2026-01-14T15:01:01Z"},{"id":"wordfence:e7613875-b44e-4b91-9a5b-41ea0854cd61","source":"wordfence","cve":"CVE-2012-4874","title":"WordPress Classifieds Plugin \u2013 Ad Directory & Listings by AWP Classifieds < 2.0 - Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7613875-b44e-4b91-9a5b-41ea0854cd61?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2012-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7637e96-3afe-46af-b99d-70abe9ca3e20","source":"wordfence","cve":"CVE-2025-6257","title":"Euro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7637e96-3afe-46af-b99d-70abe9ca3e20?source=api-prod","affected":[{"type":"plugin","slug":"euro-fxref-currency-converter","name":"Euro FxRef Currency Converter (by DKZR)","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2025-06-19T19:52:17Z","updated":"2025-06-20T08:22:20Z"},{"id":"wordfence:e76447ec-2815-4758-ae2c-67a938a739d9","source":"wordfence","cve":"CVE-2024-12115","title":"Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e76447ec-2815-4758-ae2c-67a938a739d9?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-07T01:45:53Z"},{"id":"wordfence:e764e567-524e-40b9-aa9f-653a5553375d","source":"wordfence","cve":"CVE-2022-47612","title":"Participants Database <= 2.4.5 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e764e567-524e-40b9-aa9f-653a5553375d?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e766f735-f5b2-4189-b4b1-40161c5aba8b","source":"wordfence","cve":"CVE-2014-2675","title":"WP HTML Sitemap <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e766f735-f5b2-4189-b4b1-40161c5aba8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-html-sitemap","name":"wp-html-sitemap","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e76ba53c-1b17-4bc0-b8b8-6a851f47be68","source":"wordfence","cve":"CVE-2025-30940","title":"Melipayamak <= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e76ba53c-1b17-4bc0-b8b8-6a851f47be68?source=api-prod","affected":[{"type":"plugin","slug":"melipayamak","name":"Melipayamak","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:02:13Z"},{"id":"wordfence:e76c921f-a950-401f-ac37-c28efc0f3064","source":"wordfence","cve":"CVE-2026-66712","title":"Simple Membership <= 4.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e76c921f-a950-401f-ac37-c28efc0f3064?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-15T22:12:22Z"},{"id":"wordfence:e76e4c4c-3f84-46b0-b305-2513714a8525","source":"wordfence","cve":"CVE-2023-45772","title":"Proofreading <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e76e4c4c-3f84-46b0-b305-2513714a8525?source=api-prod","affected":[{"type":"plugin","slug":"proofreading","name":"Proofreading","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-10-12T00:00:00Z","updated":"2024-03-25T17:48:35Z"},{"id":"wordfence:e76f5e04-f38e-4c65-858b-af646f53de3a","source":"wordfence","cve":"CVE-2024-6496","title":"Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e76f5e04-f38e-4c65-858b-af646f53de3a?source=api-prod","affected":[{"type":"plugin","slug":"light-poll","name":"Light Poll","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-15T20:15:25Z"},{"id":"wordfence:e77082a7-dd65-40e9-a1be-0144afa869ef","source":"wordfence","cve":"CVE-2022-4028","title":"Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e77082a7-dd65-40e9-a1be-0144afa869ef?source=api-prod","affected":[{"type":"plugin","slug":"simplepress","name":"Simple:Press Forum","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e770d1fc-b941-4f0f-87ee-8b0c9edb640b","source":"wordfence","cve":"CVE-2022-4445","title":"FL3R FeelBox <= 8.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e770d1fc-b941-4f0f-87ee-8b0c9edb640b?source=api-prod","affected":[{"type":"plugin","slug":"fl3r-feelbox","name":"FL3R FeelBox","from":"*","from_inclusive":true,"to":"8..1","to_inclusive":true,"patched_in":""}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e772fbbe-33d5-46fa-a041-ab07d3f9318f","source":"wordfence","cve":"CVE-2021-4425","title":"Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e772fbbe-33d5-46fa-a041-ab07d3f9318f?source=api-prod","affected":[{"type":"plugin","slug":"defender-security","name":"Defender Security \u2013 Malware Scanner, Login Security & Firewall","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.6.1"}],"published":"2021-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e774476d-3696-4489-b028-16c25f8db1ca","source":"wordfence","cve":"CVE-2025-12406","title":"Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e774476d-3696-4489-b028-16c25f8db1ca?source=api-prod","affected":[{"type":"plugin","slug":"project-honey-pot-spam-trap","name":"Project Honey Pot Spam Trap","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:09:25Z","updated":"2025-11-18T08:27:37Z"},{"id":"wordfence:e776101f-f8ff-4408-b0fe-9dd5849355c7","source":"wordfence","cve":"CVE-2026-57675","title":"WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e776101f-f8ff-4408-b0fe-9dd5849355c7?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.2.02.004","to_inclusive":true,"patched_in":"9.2.03.001"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T20:02:51Z"},{"id":"wordfence:e7771867-f798-457d-887e-888a6ab00013","source":"wordfence","cve":"CVE-2024-13881","title":"Link My Posts <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7771867-f798-457d-887e-888a6ab00013?source=api-prod","affected":[{"type":"plugin","slug":"linkmyposts","name":"Link My Posts","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T00:00:00Z","updated":"2025-03-03T22:12:46Z"},{"id":"wordfence:e7782522-78bc-4ad2-997e-81c8870d55fa","source":"wordfence","cve":"CVE-2022-43492","title":"Comments \u2013 wpDiscuz <= 7.4.2 - Insecure Direct Object References","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7782522-78bc-4ad2-997e-81c8870d55fa?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.4.2","to_inclusive":true,"patched_in":"7.5"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e778399f-f7fe-47c5-9722-b833d78f475c","source":"wordfence","cve":"CVE-2025-4221","title":"Animated Buttons <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e778399f-f7fe-47c5-9722-b833d78f475c?source=api-prod","affected":[{"type":"plugin","slug":"animated-buttons","name":"Animated Buttons","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T20:30:57Z","updated":"2025-05-21T09:21:52Z"},{"id":"wordfence:e77bb0b8-e101-4230-b707-10a3a126192d","source":"wordfence","cve":"CVE-2018-1002001","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e77bb0b8-e101-4230-b707-10a3a126192d?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e78097a6-6828-4d62-abf0-995a906ad68b","source":"wordfence","cve":"CVE-2021-25052","title":"Button Generator \u2013 easily Button Builder <= 2.3.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78097a6-6828-4d62-abf0-995a906ad68b?source=api-prod","affected":[{"type":"plugin","slug":"button-generation","name":"Button Generator \u2013 Easily Create Custom Buttons with Icons and Analytics","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2021-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e78116a6-5ce5-4567-95d4-2c19fc1b085a","source":"wordfence","cve":"CVE-2023-30485","title":"Avartan Slider Lite <= 1.5.3 - Reflected Cross-Site Scripting via 'asview-nouce'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78116a6-5ce5-4567-95d4-2c19fc1b085a?source=api-prod","affected":[{"type":"plugin","slug":"avartan-slider-lite","name":"Responsive WordPress Slider \u2013 Avartan Slider Lite","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7819dbf-fbcc-4dca-8300-b75ec096c541","source":"wordfence","cve":"","title":"Wordfence Security \u2013 Firewall & Malware Scan <= 7.1.13 - Reflected Cross-Site Scripting and Information Disclosure","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7819dbf-fbcc-4dca-8300-b75ec096c541?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"7.1.14","to_inclusive":false,"patched_in":"7.1.14"}],"published":"2018-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e781e1aa-7fa2-4cea-913b-4aa582ec6a4f","source":"wordfence","cve":"CVE-2024-24871","title":"Blocksy <= 2.0.19 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e781e1aa-7fa2-4cea-913b-4aa582ec6a4f?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":true,"patched_in":"2.0.20"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:29:17Z"},{"id":"wordfence:e7837208-97e3-45f9-8f9f-b1906a4fcbcc","source":"wordfence","cve":"CVE-2017-18614","title":"Kama Click Counter <= 3.4.9 - Blind SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7837208-97e3-45f9-8f9f-b1906a4fcbcc?source=api-prod","affected":[{"type":"plugin","slug":"kama-clic-counter","name":"Kama Click Counter","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2017-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e78467bb-4e08-4ef3-a468-349903dc9fbc","source":"wordfence","cve":"CVE-2026-93509","title":"Wallet System for WooCommerce 2.0.0 - 2.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation","severity":"medium","cvss":6.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78467bb-4e08-4ef3-a468-349903dc9fbc?source=api-prod","affected":[{"type":"plugin","slug":"wallet-system-for-woocommerce","name":"Wallet System for WooCommerce \u2013 Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments","from":"2.0.0","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-14T15:47:18Z"},{"id":"wordfence:e78626b3-0648-4d0d-a4a3-6694c229863c","source":"wordfence","cve":"CVE-2026-28187","title":"Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78626b3-0648-4d0d-a4a3-6694c229863c?source=api-prod","affected":[{"type":"plugin","slug":"echo-knowledge-base","name":"Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Search","from":"*","from_inclusive":true,"to":"17.211.0","to_inclusive":true,"patched_in":"17.212.0"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T21:54:14Z"},{"id":"wordfence:e78b5ed9-4e46-4bc9-9e4e-0f70bc81d1cb","source":"wordfence","cve":"CVE-2024-1076","title":"SSL Zen \u2013 Free Let&#039;s Encrypt SSL Certificate & HTTPS/SSL Redirect WordPress Plugin <= 4.5.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78b5ed9-4e46-4bc9-9e4e-0f70bc81d1cb?source=api-prod","affected":[{"type":"plugin","slug":"ssl-zen","name":"SSL Zen \u2014 SSL Certificate Installer & HTTPS Redirects","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.6.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-16T12:38:14Z"},{"id":"wordfence:e78c1280-10ce-4a92-b173-cd08a36c97dc","source":"wordfence","cve":"CVE-2025-26590","title":"Complete Google Seo Scan <= 3.5.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78c1280-10ce-4a92-b173-cd08a36c97dc?source=api-prod","affected":[{"type":"plugin","slug":"complete-google-seo-scan","name":"Complete Google Seo Scan","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:48:34Z"},{"id":"wordfence:e78c539c-5b72-4043-aa5a-6234913364ac","source":"wordfence","cve":"CVE-2021-43307","title":"semver-regex <= 3.1.3 and 4.0.0-4.0.3 - Regular Expression Denial of Service (ReDoS)","severity":"high","cvss":7.5,"cwe":"CWE-1333","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78c539c-5b72-4043-aa5a-6234913364ac?source=api-prod","affected":[{"type":"plugin","slug":"insert-special-characters","name":"Insert Special Characters","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2022-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e78dd70a-c2e3-4192-957f-6f30fed20667","source":"wordfence","cve":"CVE-2025-32488","title":"Aria Font <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78dd70a-c2e3-4192-957f-6f30fed20667?source=api-prod","affected":[{"type":"plugin","slug":"aria-font","name":"Aria Font","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:12:50Z"},{"id":"wordfence:e78f4832-6d14-4eef-8e4b-f4136b0c1902","source":"wordfence","cve":"CVE-2024-37107","title":"WishList Member X < 3.26.7 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e78f4832-6d14-4eef-8e4b-f4136b0c1902?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T14:59:39Z"},{"id":"wordfence:e7913bb4-315a-4dd5-b702-f32a171f7a19","source":"wordfence","cve":"CVE-2024-51763","title":"Team Showcase and Slider \u2013 Team Members Builder <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7913bb4-315a-4dd5-b702-f32a171f7a19?source=api-prod","affected":[{"type":"plugin","slug":"team-showcase-ultimate","name":"Team Showcase and Slider \u2013 Team Members Builder","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:56:52Z"},{"id":"wordfence:e791a7fc-d5b4-403c-a0e2-2300d9a102b0","source":"wordfence","cve":"CVE-2026-65575","title":"Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor <= 1.5.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e791a7fc-d5b4-403c-a0e2-2300d9a102b0?source=api-prod","affected":[{"type":"theme","slug":"accalia","name":"Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:57:52Z"},{"id":"wordfence:e7939401-822c-4d27-9d8c-c5680165e6a7","source":"wordfence","cve":"CVE-2020-9457","title":"RegistrationMagic \u2013 Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation","severity":"critical","cvss":9.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7939401-822c-4d27-9d8c-c5680165e6a7?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"4.6.0.3","to_inclusive":true,"patched_in":"4.6.0.4"}],"published":"2020-03-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7944ff1-9f5d-4816-90f3-80b3c5d4e0c2","source":"wordfence","cve":"CVE-2026-119519","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1068 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7944ff1-9f5d-4816-90f3-80b3c5d4e0c2?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1068","to_inclusive":true,"patched_in":"1.7.1069"}],"published":"2026-11-06T22:28:00Z","updated":"2026-11-10T19:33:57Z"},{"id":"wordfence:e796b203-31b4-47c6-9018-190389ce4df7","source":"wordfence","cve":"CVE-2012-5469","title":"Portable phpMyAdmin <= 1.3.0 - Authentication Bypass","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e796b203-31b4-47c6-9018-190389ce4df7?source=api-prod","affected":[{"type":"plugin","slug":"portable-phpmyadmin","name":"Portable phpMyAdmin","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e797c0ca-f348-4d9c-815e-0c1756686690","source":"wordfence","cve":"CVE-2023-27425","title":"Electric Studio Client Login <= 0.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e797c0ca-f348-4d9c-815e-0c1756686690?source=api-prod","affected":[{"type":"plugin","slug":"electric-studio-client-login","name":"Electric Studio Client Login","from":"*","from_inclusive":true,"to":"0.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7a0b40b-560a-4f2a-ad6d-6b2284fd5f25","source":"wordfence","cve":"CVE-2021-43408","title":"Duplicate Post WordPress Plugin <= 1.1.9 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a0b40b-560a-4f2a-ad6d-6b2284fd5f25?source=api-prod","affected":[{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7a24213-5191-4b6d-a2d1-7b79729e6517","source":"wordfence","cve":"CVE-2024-2960","title":"SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a24213-5191-4b6d-a2d1-7b79729e6517?source=api-prod","affected":[{"type":"plugin","slug":"svs-pricing-tables","name":"SVS Pricing Tables","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:48Z"},{"id":"wordfence:e7a28382-facb-43a7-892a-8ca9e7f0f62b","source":"wordfence","cve":"CVE-2024-1489","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.6.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a28382-facb-43a7-892a-8ca9e7f0f62b?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2024-02-26T00:00:00Z","updated":"2024-03-13T15:27:22Z"},{"id":"wordfence:e7a2fd76-d760-4324-bbc3-7867bb9770b5","source":"wordfence","cve":"CVE-2026-28035","title":"Printy <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a2fd76-d760-4324-bbc3-7867bb9770b5?source=api-prod","affected":[{"type":"theme","slug":"printy","name":"Printy","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:06:07Z"},{"id":"wordfence:e7a67693-d6e6-4492-ad26-28530e7c4a67","source":"wordfence","cve":"CVE-2024-0187","title":"Community by PeepSo <= 6.3.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a67693-d6e6-4492-ad26-28530e7c4a67?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.3.1.1","to_inclusive":true,"patched_in":"6.3.1.2"}],"published":"2024-01-09T00:00:00Z","updated":"2024-02-06T14:34:49Z"},{"id":"wordfence:e7a6dee6-b3ff-4325-a356-4a65ab7a0ce5","source":"wordfence","cve":"CVE-2022-33198","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.2 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a6dee6-b3ff-4325-a356-4a65ab7a0ce5?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7a731ff-12e9-4fab-a055-c0193b3b2da8","source":"wordfence","cve":"CVE-2024-33543","title":"WP Time Slots Booking Form <= 1.2.06 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a731ff-12e9-4fab-a055-c0193b3b2da8?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-slots-booking-form","name":"WP Time Slots Booking Form","from":"*","from_inclusive":true,"to":"1.2.06","to_inclusive":true,"patched_in":"1.2.07"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:08:35Z"},{"id":"wordfence:e7a88214-45ca-468e-b228-4fe89b327aef","source":"wordfence","cve":"CVE-2025-53218","title":"AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a88214-45ca-468e-b228-4fe89b327aef?source=api-prod","affected":[{"type":"plugin","slug":"appexperts","name":"APPExperts \u2013 Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-09T00:00:00Z","updated":"2025-10-15T15:58:06Z"},{"id":"wordfence:e7a96a64-4df2-462c-a48b-215a2e19edab","source":"wordfence","cve":"CVE-2025-58840","title":"Custom Team Manager <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a96a64-4df2-462c-a48b-215a2e19edab?source=api-prod","affected":[{"type":"plugin","slug":"custom-team-manager","name":"Custom Team Manager","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:35:15Z"},{"id":"wordfence:e7ab6f3a-352c-4104-802d-af2ed9b1154b","source":"wordfence","cve":"CVE-2024-56001","title":"Ksher <= 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ab6f3a-352c-4104-802d-af2ed9b1154b?source=api-prod","affected":[{"type":"plugin","slug":"ksher-payment","name":"Ksher","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:52:25Z"},{"id":"wordfence:e7ad57d0-375b-4a64-a61c-90b72052552f","source":"wordfence","cve":"CVE-2019-19541","title":"ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ad57d0-375b-4a64-a61c-90b72052552f?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.0.14.4","to_inclusive":true,"patched_in":"2.0.14.5"}],"published":"2019-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7ae8dcd-00b6-4afc-85bb-6697820bb37c","source":"wordfence","cve":"CVE-2023-30777","title":"Advanced Custom Fields (Free and Pro) 5.8.10 to 5.12.5  & 6.0.0 to 6.1.5 - Reflected Cross-Site Scripting via 'post_status'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ae8dcd-00b6-4afc-85bb-6697820bb37c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"5.8.10","from_inclusive":true,"to":"5.12.5","to_inclusive":true,"patched_in":"5.12.6"},{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"6.0.0","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"5.12.6"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"5.8.10","from_inclusive":true,"to":"5.12.5","to_inclusive":true,"patched_in":"5.12.6"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"6.0.0","from_inclusive":true,"to":"6.1.5","to_inclusive":true,"patched_in":"5.12.6"}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7b3be2a-1ef7-4270-a055-6be92503149d","source":"wordfence","cve":"CVE-2026-39585","title":"Booktics <= 1.0.16 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b3be2a-1ef7-4270-a055-6be92503149d?source=api-prod","affected":[{"type":"plugin","slug":"booktics","name":"Booktics \u2013 Appointment Booking Calendar for Service Businesses","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-02-02T00:00:00Z","updated":"2026-04-15T21:30:39Z"},{"id":"wordfence:e7b49fd1-2d1e-4083-bc1d-010a9c8f4c2f","source":"wordfence","cve":"CVE-2024-22136","title":"Droit Elementor Addons <= 3.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b49fd1-2d1e-4083-bc1d-010a9c8f4c2f?source=api-prod","affected":[{"type":"plugin","slug":"droit-elementor-addons","name":"Droit Elementor Addons \u2013 Widgets, Blocks, Templates Library For Elementor Builder","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-01-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7b56ec1-8735-4404-8069-219f5d8866d0","source":"wordfence","cve":"CVE-2025-4797","title":"Golo <= 1.7.0 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b56ec1-8735-4404-8069-219f5d8866d0?source=api-prod","affected":[{"type":"theme","slug":"golo","name":"Golo - City Travel Guide WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-06-02T16:21:57Z","updated":"2025-08-26T13:43:15Z"},{"id":"wordfence:e7b6af5a-ad44-4dd6-9ce1-6fcbd28f8ebe","source":"wordfence","cve":"CVE-2024-2131","title":"Move Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b6af5a-ad44-4dd6-9ce1-6fcbd28f8ebe?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-03-22T00:00:00Z","updated":"2024-04-01T14:17:12Z"},{"id":"wordfence:e7b719b9-7287-4d2a-b107-7c9bc18b9456","source":"wordfence","cve":"CVE-2025-66082","title":"WpEvently <= 5.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b719b9-7287-4d2a-b107-7c9bc18b9456?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":"5.0.5"}],"published":"2025-11-30T00:00:00Z","updated":"2025-12-11T16:51:14Z"},{"id":"wordfence:e7b78960-51ff-440f-8831-d50c11961d9d","source":"wordfence","cve":"","title":"Deep Blue <= 1.9.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b78960-51ff-440f-8831-d50c11961d9d?source=api-prod","affected":[{"type":"theme","slug":"deep-blue","name":"Deep Blue","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":""}],"published":"2018-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7b7e0b5-56a2-4f1f-be13-92721f4055fb","source":"wordfence","cve":"CVE-2021-24974","title":"Product Feed PRO for WooCommerce <= 11.0.6 - Settings Update to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b7e0b5-56a2-4f1f-be13-92721f4055fb?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"11.0.7","to_inclusive":false,"patched_in":"11.0.7"}],"published":"2021-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7b81559-93a2-4e50-b213-0e22eea8a219","source":"wordfence","cve":"","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via cmplz_duplicate_cookiebanner","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b81559-93a2-4e50-b213-0e22eea8a219?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7b84f9b-2b01-4e25-907d-4be735594d07","source":"wordfence","cve":"CVE-2014-4590","title":"WP Microblogs <= 0.4.0 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7b84f9b-2b01-4e25-907d-4be735594d07?source=api-prod","affected":[{"type":"plugin","slug":"wp-microblogs","name":"WP Microblogs","from":"*","from_inclusive":true,"to":"0.4.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7ba37ac-908f-4766-a208-d28191f8296d","source":"wordfence","cve":"CVE-2025-68530","title":"Bookory <= 2.2.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ba37ac-908f-4766-a208-d28191f8296d?source=api-prod","affected":[{"type":"theme","slug":"bookory","name":"bookory","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-06T14:04:38Z"},{"id":"wordfence:e7ba65ac-e568-4c13-961d-6453f281d9fc","source":"wordfence","cve":"CVE-2025-0953","title":"SMTP for Sendinblue \u2013 YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logs","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ba65ac-e568-4c13-961d-6453f281d9fc?source=api-prod","affected":[{"type":"plugin","slug":"smtp-sendinblue","name":"Brevo SMTP \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-02-22T00:00:00Z","updated":"2025-04-10T22:30:43Z"},{"id":"wordfence:e7bb5c89-93db-4454-a16d-b99fc14737f8","source":"wordfence","cve":"CVE-2024-4272","title":"Support SVG <= 1.0.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7bb5c89-93db-4454-a16d-b99fc14737f8?source=api-prod","affected":[{"type":"plugin","slug":"support-svg","name":"Support SVG \u2013 Upload svg files in wordpress without hassle","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-06-22T00:00:00Z","updated":"2024-06-27T14:28:05Z"},{"id":"wordfence:e7bca584-05d8-4ecf-bf6c-5c2256cb5a61","source":"wordfence","cve":"CVE-2025-52774","title":"Infility Global <= 2.13.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7bca584-05d8-4ecf-bf6c-5c2256cb5a61?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.13.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-16T19:23:28Z"},{"id":"wordfence:e7bcc4cc-58e9-41b6-9283-5723e58ab039","source":"wordfence","cve":"CVE-2025-69167","title":"Eros <= 1.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7bcc4cc-58e9-41b6-9283-5723e58ab039?source=api-prod","affected":[{"type":"theme","slug":"eros","name":"Eros","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:39:47Z"},{"id":"wordfence:e7c08b1a-c73d-488c-96df-cf18acb460bb","source":"wordfence","cve":"CVE-2025-12356","title":"Tickera \u2013 WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c08b1a-c73d-488c-96df-cf18acb460bb?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.5.6.4","to_inclusive":true,"patched_in":"3.5.6.5"}],"published":"2026-02-17T16:41:09Z","updated":"2026-02-18T05:29:19Z"},{"id":"wordfence:e7c18fbc-e212-4441-87ac-1e80ced0a128","source":"wordfence","cve":"CVE-2025-57995","title":"DethemeKit For Elementor <= 2.1.10 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c18fbc-e212-4441-87ac-1e80ced0a128?source=api-prod","affected":[{"type":"plugin","slug":"dethemekit-for-elementor","name":"DethemeKit for Elementor","from":"*","from_inclusive":true,"to":"2.1.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:26:16Z"},{"id":"wordfence:e7c6dc0e-ee60-4be0-bf0c-b2e665591cf3","source":"wordfence","cve":"CVE-2026-105974","title":"Visual Form Builder <= 3.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c6dc0e-ee60-4be0-bf0c-b2e665591cf3?source=api-prod","affected":[{"type":"plugin","slug":"visual-form-builder","name":"Visual Form Builder","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:04:34Z"},{"id":"wordfence:e7c79b82-1ecc-4c08-a12f-14bae5d32053","source":"wordfence","cve":"CVE-2026-96344","title":"eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c79b82-1ecc-4c08-a12f-14bae5d32053?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-09-30T16:48:48Z"},{"id":"wordfence:e7c936b8-3132-45e1-92ed-32ecdc9cbb1e","source":"wordfence","cve":"CVE-2025-6214","title":"Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c936b8-3132-45e1-92ed-32ecdc9cbb1e?source=api-prod","affected":[{"type":"plugin","slug":"omnishop","name":"Omnishop \u2013 Mobile shop apps complementing your WooCommerce webshop","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T14:02:42Z","updated":"2025-07-23T02:24:39Z"},{"id":"wordfence:e7c98de6-7e76-48f3-aa79-57bf4f387428","source":"wordfence","cve":"CVE-2024-21749","title":"1 click disable all <= 1.0.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7c98de6-7e76-48f3-aa79-57bf4f387428?source=api-prod","affected":[{"type":"plugin","slug":"first-graders-toolbox","name":"1-Click Disable All","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2023-12-05T00:00:00Z","updated":"2024-03-11T08:49:11Z"},{"id":"wordfence:e7cca1aa-8f2b-4a77-b172-4a58a185a521","source":"wordfence","cve":"CVE-2026-107863","title":"Products Restricted Users for WooCommerce <= 0.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7cca1aa-8f2b-4a77-b172-4a58a185a521?source=api-prod","affected":[{"type":"plugin","slug":"woo-products-restricted-users","name":"Products Restricted Users for WooCommerce","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":"0.8"}],"published":"2026-10-12T08:23:00Z","updated":"2026-10-13T14:01:55Z"},{"id":"wordfence:e7cd51b1-4b56-4ca6-b891-93af9879862d","source":"wordfence","cve":"CVE-2025-54035","title":"Newsletters <= 4.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7cd51b1-4b56-4ca6-b891-93af9879862d?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.10","to_inclusive":true,"patched_in":"4.11"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:20:43Z"},{"id":"wordfence:e7cf069b-2bb8-4dd8-97aa-2994991b60ab","source":"wordfence","cve":"CVE-2024-51799","title":"Bg Patriarchia BU <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7cf069b-2bb8-4dd8-97aa-2994991b60ab?source=api-prod","affected":[{"type":"plugin","slug":"bg-patriarchia-bu","name":"Bg Patriarchia BU","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:46:25Z"},{"id":"wordfence:e7d0805f-aa53-44e6-8829-0916c03d5632","source":"wordfence","cve":"CVE-2026-15211","title":"Subscriptions for WooCommerce <= 2.0.0 - Unauthenticated Payment Verification Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d0805f-aa53-44e6-8829-0916c03d5632?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:34:37Z"},{"id":"wordfence:e7d0c727-be79-4344-87de-86cdf3615874","source":"wordfence","cve":"CVE-2025-23611","title":"WH Cache & Security <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d0c727-be79-4344-87de-86cdf3615874?source=api-prod","affected":[{"type":"plugin","slug":"wh-cache-and-security","name":"WH Cache & Security","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:38:19Z"},{"id":"wordfence:e7d4830b-f60a-4556-b40f-1bf9d5a296ad","source":"wordfence","cve":"","title":"Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d4830b-f60a-4556-b40f-1bf9d5a296ad?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":"1.3.5"}],"published":"2017-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7d6f828-0d7b-4ee2-a316-ab55eb7a3d70","source":"wordfence","cve":"CVE-2022-46843","title":"Woocommerce Vietnam Checkout <= 2.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d6f828-0d7b-4ee2-a316-ab55eb7a3d70?source=api-prod","affected":[{"type":"plugin","slug":"woo-vietnam-checkout","name":"Vietnam Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7d74fa8-43ba-41ac-82ec-94addc88fc52","source":"wordfence","cve":"CVE-2021-38352","title":"Feedify \u2013 Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d74fa8-43ba-41ac-82ec-94addc88fc52?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-by-feedify","name":"Feedify \u2013 Web Push Notifications","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7d7ec5b-0616-4895-b5bf-be25ac37fb17","source":"wordfence","cve":"CVE-2021-24195","title":"Login as User or Customer < 1.8 - Missing Authorization to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7d7ec5b-0616-4895-b5bf-be25ac37fb17?source=api-prod","affected":[{"type":"plugin","slug":"login-as-customer-or-user","name":"Login as User or Customer \u2014 User Switching","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7dd19f1-9b19-4c69-aa05-6bd414378bc5","source":"wordfence","cve":"CVE-2025-32677","title":"WP Social Stream Designer <= 1.3 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7dd19f1-9b19-4c69-aa05-6bd414378bc5?source=api-prod","affected":[{"type":"plugin","slug":"social-stream-design","name":"WP Social Stream Designer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T21:01:13Z"},{"id":"wordfence:e7dd6818-b266-4f24-bbc0-29b0e4c00ee6","source":"wordfence","cve":"CVE-2026-15235","title":"MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7dd6818-b266-4f24-bbc0-29b0e4c00ee6?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"6.0.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-04T19:33:03Z"},{"id":"wordfence:e7ddc418-9458-4335-afdc-6d40c7e23060","source":"wordfence","cve":"CVE-2025-13747","title":"NewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ddc418-9458-4335-afdc-6d40c7e23060?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2025-12-11T14:35:21Z","updated":"2026-01-08T21:16:57Z"},{"id":"wordfence:e7e25e64-4504-4aad-aeb6-d58b5c36a4bd","source":"wordfence","cve":"CVE-2023-0893","title":"Time Sheets <= 1.29.2 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7e25e64-4504-4aad-aeb6-d58b5c36a4bd?source=api-prod","affected":[{"type":"plugin","slug":"time-sheets","name":"Time Sheets","from":"*","from_inclusive":true,"to":"1.29.2","to_inclusive":true,"patched_in":"1.29.3"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7e33fbc-da1b-4109-8b29-37e1050a559b","source":"wordfence","cve":"CVE-2023-23730","title":"Spectra \u2013 WordPress Gutenberg Blocks <= 2.3.1 - Captcha Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7e33fbc-da1b-4109-8b29-37e1050a559b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7e67b84-6b75-49ca-b5cc-e80ad7f5c899","source":"wordfence","cve":"CVE-2024-37257","title":"Permalink Manager Lite <= 2.4.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7e67b84-6b75-49ca-b5cc-e80ad7f5c899?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.4.3.3","to_inclusive":true,"patched_in":"2.4.3.4"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:49:37Z"},{"id":"wordfence:e7e83cee-f2c6-4de0-8801-fb63398f98fc","source":"wordfence","cve":"CVE-2021-24555","title":"Diary & Availability Calendar <= 1.0.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7e83cee-f2c6-4de0-8801-fb63398f98fc?source=api-prod","affected":[{"type":"plugin","slug":"diary-availability-calendar","name":"Diary & Availability Calendar","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2021-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7e9cb89-6ed0-4096-82eb-b6f948d3bfd4","source":"wordfence","cve":"CVE-2025-60046","title":"HeartStar <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7e9cb89-6ed0-4096-82eb-b6f948d3bfd4?source=api-prod","affected":[{"type":"theme","slug":"heartstar","name":"HeartStar | Gift Shop, Party & Event WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:38:00Z"},{"id":"wordfence:e7eb6137-5c03-4f73-a478-c1c18ee91fba","source":"wordfence","cve":"CVE-2015-9326","title":"WP Business Intelligence Lite <= 1.6.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7eb6137-5c03-4f73-a478-c1c18ee91fba?source=api-prod","affected":[{"type":"plugin","slug":"wp-business-intelligence-lite","name":"WP Business Intelligence Lite","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2015-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7eb9cb7-ca71-454b-bb4c-da89c8a6e584","source":"wordfence","cve":"CVE-2014-4030","title":"JW Player for Flash & HTML5 Video < 2.1.4 - Cross-Site Request Forgery leading to player deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7eb9cb7-ca71-454b-bb4c-da89c8a6e584?source=api-prod","affected":[{"type":"plugin","slug":"jw-player-plugin-for-wordpress","name":"JW Player for Flash & HTML5 Video","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2014-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7ebf975-0fa7-43cd-a4fe-99284ad3aaf6","source":"wordfence","cve":"CVE-2023-36510","title":"ReDi Restaurant Reservation <= 23.0211 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ebf975-0fa7-43cd-a4fe-99284ad3aaf6?source=api-prod","affected":[{"type":"plugin","slug":"redi-restaurant-reservation","name":"ReDi Restaurant Reservation \u2013 Instant Restaurant Booking & Table Reservation System","from":"*","from_inclusive":true,"to":"23.0211","to_inclusive":true,"patched_in":"23.0212"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7ecd712-a7b3-40e2-b982-be8b58e9b8c3","source":"wordfence","cve":"","title":"Welcart e-Commerce <= 2.1.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ecd712-a7b3-40e2-b982-be8b58e9b8c3?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7f17136-d285-4ecf-990f-66af04b5bcf9","source":"wordfence","cve":"CVE-2026-56064","title":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7f17136-d285-4ecf-990f-66af04b5bcf9?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.22.5","to_inclusive":true,"patched_in":"2.22.6"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:58:49Z"},{"id":"wordfence:e7f3e583-a486-4e25-bc40-e437cf5b3ebd","source":"wordfence","cve":"CVE-2018-20973","title":"Companion Auto Update <= 3.2.0 - Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7f3e583-a486-4e25-bc40-e437cf5b3ebd?source=api-prod","affected":[{"type":"plugin","slug":"companion-auto-update","name":"Companion Auto Update","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2018-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7f86396-2f3f-4cd6-b3d4-e518b074a579","source":"wordfence","cve":"CVE-2022-46844","title":"PixFields <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7f86396-2f3f-4cd6-b3d4-e518b074a579?source=api-prod","affected":[{"type":"plugin","slug":"pixfields","name":"PixFields","from":"*","from_inclusive":true,"to":"0.7.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7f90a88-6c19-4adf-8282-2d77234fcc11","source":"wordfence","cve":"CVE-2023-22712","title":"TemplatesNext ToolKit <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7f90a88-6c19-4adf-8282-2d77234fcc11?source=api-prod","affected":[{"type":"plugin","slug":"templatesnext-toolkit","name":"TemplatesNext ToolKit","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7f9dc8f-959f-4a6f-bcc2-e02f643573f2","source":"wordfence","cve":"CVE-2026-93427","title":"ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7f9dc8f-959f-4a6f-bcc2-e02f643573f2?source=api-prod","affected":[{"type":"plugin","slug":"armember","name":"ARMember Premium \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-11-09T18:31:49Z","updated":"2026-11-10T06:47:03Z"},{"id":"wordfence:e7fb6233-3f58-4237-aaaf-4bc60c5cc8ca","source":"wordfence","cve":"CVE-2015-9322","title":"Erident Custom Login and Dashboard <= 3.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fb6233-3f58-4237-aaaf-4bc60c5cc8ca?source=api-prod","affected":[{"type":"plugin","slug":"erident-custom-login-and-dashboard","name":"Erident Custom Login Page & Dashboard","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.5"}],"published":"2015-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7fcda2b-d679-44af-9592-4a96a0115a08","source":"wordfence","cve":"CVE-2022-4150","title":"Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fcda2b-d679-44af-9592-4a96a0115a08?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.5","to_inclusive":true,"patched_in":"19.1.5.1"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e7fd090d-255b-4a67-9010-9261dd79816a","source":"wordfence","cve":"CVE-2026-2508","title":"Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fd090d-255b-4a67-9010-9261dd79816a?source=api-prod","affected":[{"type":"plugin","slug":"gf-bookings-premium","name":"Gravity Bookings","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2026-06-24T15:22:52Z","updated":"2026-06-25T03:42:22Z"},{"id":"wordfence:e7fe482e-a4e8-411c-97a4-a32ccf5b3682","source":"wordfence","cve":"CVE-2024-2273","title":"Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fe482e-a4e8-411c-97a4-a32ccf5b3682?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.34","to_inclusive":true,"patched_in":"3.2.35"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-15T17:53:08Z"},{"id":"wordfence:e7fe9fdf-02b1-4dfb-8d5e-bb64fe4c86be","source":"wordfence","cve":"CVE-2026-102389","title":"Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary HTML Attribute Injection","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fe9fdf-02b1-4dfb-8d5e-bb64fe4c86be?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.14.1","to_inclusive":true,"patched_in":"2.4.15"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:39:09Z"},{"id":"wordfence:e8021ef2-e1ce-442a-965a-b2628fe48964","source":"wordfence","cve":"","title":"Curvo Theme (All Known Versions) - Cross-Site Request Forgery and Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8021ef2-e1ce-442a-965a-b2628fe48964?source=api-prod","affected":[{"type":"theme","slug":"curvo","name":"curvo","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e806ca3b-daae-48a2-9923-315dbf86a9e5","source":"wordfence","cve":"CVE-2024-0858","title":"Innovs HR \u2013 Complete Human Resource Management System for Your Business <= 1.0.3.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e806ca3b-daae-48a2-9923-315dbf86a9e5?source=api-prod","affected":[{"type":"plugin","slug":"innovs-hr-manager","name":"Innovs HR \u2013 Complete Human Resource Management System for Your Business","from":"*","from_inclusive":true,"to":"1.0.3.7","to_inclusive":true,"patched_in":"1.0.3.7.1"}],"published":"2024-02-20T00:00:00Z","updated":"2026-11-05T21:47:41Z"},{"id":"wordfence:e807480b-00c9-4340-bd05-b695b56e27ec","source":"wordfence","cve":"CVE-2025-12500","title":"Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.1 - Unauthenticated Limited File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e807480b-00c9-4340-bd05-b695b56e27ec?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-02-18T15:22:14Z","updated":"2026-02-19T03:25:20Z"},{"id":"wordfence:e8081bfc-71bb-432c-9a39-386eabada6bc","source":"wordfence","cve":"CVE-2024-12725","title":"Clasify Classified Listing <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8081bfc-71bb-432c-9a39-386eabada6bc?source=api-prod","affected":[{"type":"plugin","slug":"clasify-classified-listing","name":"Clasify Classified Listing","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-01-09T14:28:55Z"},{"id":"wordfence:e8088547-650f-41b1-bb53-18be38f4aeb2","source":"wordfence","cve":"CVE-2015-9344","title":"Link Log \u2013 external link click monitor < 2.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8088547-650f-41b1-bb53-18be38f4aeb2?source=api-prod","affected":[{"type":"plugin","slug":"link-log","name":"Smart External Link Click Monitor [Link Log]","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2015-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e809cd39-7bb0-475f-a2ae-c7bc4bdba63c","source":"wordfence","cve":"CVE-2024-33908","title":"WidgetKit <= 2.5.4 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e809cd39-7bb0-475f-a2ae-c7bc4bdba63c?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2024-04-29T00:00:00Z","updated":"2025-07-24T18:59:11Z"},{"id":"wordfence:e80a74f7-7983-4d66-a038-3c57c5d94ea1","source":"wordfence","cve":"CVE-2023-54346","title":"Backup Migration <= 1.2.8 - Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-538","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e80a74f7-7983-4d66-a038-3c57c5d94ea1?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2023-05-10T00:00:00Z","updated":"2026-07-29T21:17:58Z"},{"id":"wordfence:e80bb7de-ce18-40d5-bf4c-9616739b2f9d","source":"wordfence","cve":"CVE-2023-46093","title":"Webmaster Tools <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e80bb7de-ce18-40d5-bf4c-9616739b2f9d?source=api-prod","affected":[{"type":"plugin","slug":"webmaster-tools","name":"Webmaster Tools","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e80ed130-8ad2-4fb0-a583-02fc675804d6","source":"wordfence","cve":"CVE-2024-12337","title":"Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e80ed130-8ad2-4fb0-a583-02fc675804d6?source=api-prod","affected":[{"type":"plugin","slug":"wc-planzer-shipping","name":"Shipping via Planzer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.25","to_inclusive":true,"patched_in":"1.0.26"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T11:09:27Z"},{"id":"wordfence:e8113238-5208-42cd-aed6-7ec61c3ced85","source":"wordfence","cve":"CVE-2025-9632","title":"PhpList Subber <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8113238-5208-42cd-aed6-7ec61c3ced85?source=api-prod","affected":[{"type":"plugin","slug":"phpls","name":"PhpList Subber","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T19:04:28Z","updated":"2025-09-11T07:25:01Z"},{"id":"wordfence:e8119092-d513-4e6c-ab83-d4a49ec66281","source":"wordfence","cve":"CVE-2025-10194","title":"Shortcode Button <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8119092-d513-4e6c-ab83-d4a49ec66281?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-button","name":"Shortcode Button","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T19:36:21Z","updated":"2025-10-15T08:26:04Z"},{"id":"wordfence:e814f798-5ebc-4bea-838f-d0a803f9bdbc","source":"wordfence","cve":"CVE-2024-13866","title":"Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e814f798-5ebc-4bea-838f-d0a803f9bdbc?source=api-prod","affected":[{"type":"plugin","slug":"simple-notification","name":"Simple Notification","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T19:19:31Z","updated":"2025-03-05T08:21:57Z"},{"id":"wordfence:e8150619-9710-4dc0-ab62-ffd3e9fa8cd6","source":"wordfence","cve":"CVE-2015-3301","title":"TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Directory Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8150619-9710-4dc0-ab62-ffd3e9fa8cd6?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":""}],"published":"2015-04-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e818a5db-acb7-4b16-80b1-939904e93791","source":"wordfence","cve":"CVE-2023-41736","title":"Email posts to subscribers <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e818a5db-acb7-4b16-80b1-939904e93791?source=api-prod","affected":[{"type":"plugin","slug":"email-posts-to-subscribers","name":"Email posts to subscribers","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e81bc899-7a3c-4e74-a24d-ac29278dee7e","source":"wordfence","cve":"CVE-2025-66164","title":"Laser <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e81bc899-7a3c-4e74-a24d-ac29278dee7e?source=api-prod","affected":[{"type":"plugin","slug":"laser","name":"Laser","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:06:10Z"},{"id":"wordfence:e81c4d77-5459-4f56-b339-8da0877a6663","source":"wordfence","cve":"CVE-2023-27626","title":"Stock Ticker <= 3.23.0 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e81c4d77-5459-4f56-b339-8da0877a6663?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.23.0","to_inclusive":true,"patched_in":"3.23.1"}],"published":"2023-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e81c7783-b0c3-4ede-bff1-57a1a69cdbc7","source":"wordfence","cve":"CVE-2026-112313","title":"Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e81c7783-b0c3-4ede-bff1-57a1a69cdbc7?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.7","to_inclusive":true,"patched_in":"0.9.2.8"}],"published":"2026-10-20T09:26:44Z","updated":"2026-10-23T18:50:27Z"},{"id":"wordfence:e820c00d-0456-49e8-aca4-bb981a9cfea1","source":"wordfence","cve":"CVE-2017-1002013","title":"Image Gallery with Slideshow Plugin <= 1.5.2 - Blind SQL Injection via imgid","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e820c00d-0456-49e8-aca4-bb981a9cfea1?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-with-slideshow","name":"Image Gallery with Slideshow Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8214cdd-3a7d-40ce-9645-7dbd6e8f037f","source":"wordfence","cve":"CVE-2024-9422","title":"GEO My WordPress <= 4.4.0.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8214cdd-3a7d-40ce-9645-7dbd6e8f037f?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"4.0","from_inclusive":true,"to":"4.4.0.2","to_inclusive":true,"patched_in":"4.5"},{"type":"plugin","slug":"gmw-premium-settings","name":"Gmw Premium Settings","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":false,"patched_in":"3.1"}],"published":"2024-10-31T00:00:00Z","updated":"2024-12-12T19:30:11Z"},{"id":"wordfence:e821dc5b-7ff6-426f-9c38-8dea960bae0d","source":"wordfence","cve":"CVE-2025-68834","title":"Sync Master Sheet \u2013 Product Sync with Google Sheet for WooCommerce <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e821dc5b-7ff6-426f-9c38-8dea960bae0d?source=api-prod","affected":[{"type":"plugin","slug":"product-sync-master-sheet","name":"Sync Master Sheet \u2013 Product Sync with Google Sheet for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-02-04T00:00:00Z","updated":"2026-02-09T21:36:16Z"},{"id":"wordfence:e8260829-49a6-4ec0-8771-25d1cce8cc8c","source":"wordfence","cve":"CVE-2025-39582","title":"WP Data Access <= 5.5.36 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8260829-49a6-4ec0-8771-25d1cce8cc8c?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.36","to_inclusive":true,"patched_in":"5.5.37"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-22T18:24:42Z"},{"id":"wordfence:e8263908-95b3-4b72-a9de-a982618eba2c","source":"wordfence","cve":"CVE-2025-11985","title":"Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8263908-95b3-4b72-a9de-a982618eba2c?source=api-prod","affected":[{"type":"plugin","slug":"realty-portal","name":"Realty Portal","from":"0.1","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-20T19:23:24Z","updated":"2026-09-11T13:16:57Z"},{"id":"wordfence:e826dcb4-7a92-43d9-a8ca-403b20521c5e","source":"wordfence","cve":"CVE-2026-27402","title":"Kids Life | Children School WordPress <= 5.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e826dcb4-7a92-43d9-a8ca-403b20521c5e?source=api-prod","affected":[{"type":"theme","slug":"kidslife","name":"Kids Life | Children School WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-09T13:41:17Z"},{"id":"wordfence:e8270ef0-7c98-4bb1-af83-bdcc2c7867ab","source":"wordfence","cve":"CVE-2021-39356","title":"Content Staging <= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8270ef0-7c98-4bb1-af83-bdcc2c7867ab?source=api-prod","affected":[{"type":"plugin","slug":"content-staging","name":"Content Staging","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e82a1af8-2cc0-4952-802f-d2d974f7d838","source":"wordfence","cve":"CVE-2025-31784","title":"Embed Extended \u2013 Embed Maps, Videos, Websites, Source Codes, and more <= 1.4.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e82a1af8-2cc0-4952-802f-d2d974f7d838?source=api-prod","affected":[{"type":"plugin","slug":"embed-extended","name":"Embed Extended \u2013 Embed Maps, Videos, Websites, Source Codes, and more","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:15:44Z"},{"id":"wordfence:e82a4c9b-dac8-4f18-af58-0190ae27d0a3","source":"wordfence","cve":"CVE-2026-39436","title":"cformsII <= 15.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e82a4c9b-dac8-4f18-af58-0190ae27d0a3?source=api-prod","affected":[{"type":"plugin","slug":"cforms2","name":"cformsII","from":"*","from_inclusive":true,"to":"15.1.3","to_inclusive":true,"patched_in":"15.1.4"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:11:14Z"},{"id":"wordfence:e82cdfab-8090-4979-81b6-5b860e9ae187","source":"wordfence","cve":"CVE-2022-29447","title":"Hover Effects \u2013 easily create any hover effect <= 2.1 - Authenticated Local File Inclusion","severity":"medium","cvss":6.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e82cdfab-8090-4979-81b6-5b860e9ae187?source=api-prod","affected":[{"type":"plugin","slug":"hover-effects","name":"Hover Effects \u2013 easily create any hover effect","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2022-05-16T12:18:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e82e7745-4642-43c3-9bce-12384b9d9309","source":"wordfence","cve":"CVE-2024-44037","title":"Multipurpose Ticket Booking Manager <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e82e7745-4642-43c3-9bce-12384b9d9309?source=api-prod","affected":[{"type":"plugin","slug":"bus-booking-manager","name":"Multipurpose Ticket Booking Manager (Bus/Train/Ferry/Boat/Shuttle)","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-15T12:03:51Z"},{"id":"wordfence:e82f6e2c-1a05-4c9f-83fd-65e75394c4b8","source":"wordfence","cve":"CVE-2025-66143","title":"Crumber <= 1.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e82f6e2c-1a05-4c9f-83fd-65e75394c4b8?source=api-prod","affected":[{"type":"plugin","slug":"crumber-elementor","name":"Breadcrumbs for Elementor \u2013 Crumber","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T00:00:00Z","updated":"2026-01-15T16:45:25Z"},{"id":"wordfence:e830fe1e-1171-46da-8ee7-0a6654153f18","source":"wordfence","cve":"CVE-2023-5504","title":"BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal","severity":"high","cvss":8.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e830fe1e-1171-46da-8ee7-0a6654153f18?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2023-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8336c89-44ac-4e41-bc81-7dae9599c050","source":"wordfence","cve":"CVE-2024-43271","title":"Woo Products Widgets For Elementor <= 2.0.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8336c89-44ac-4e41-bc81-7dae9599c050?source=api-prod","affected":[{"type":"plugin","slug":"woo-products-widgets-for-elementor","name":"Widgets for WooCommerce Products on Elementor","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-12T00:00:00Z","updated":"2024-10-18T14:12:18Z"},{"id":"wordfence:e834a211-ccc8-4a30-a15d-879ba34184e9","source":"wordfence","cve":"CVE-2023-5086","title":"Copy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e834a211-ccc8-4a30-a15d-879ba34184e9?source=api-prod","affected":[{"type":"plugin","slug":"copy-the-code","name":"Copy Anything to Clipboard for WordPress \u2013 Copy Button, Copy Text & Copy Code","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8355e10-c8ad-480a-bf4b-946b2b980f24","source":"wordfence","cve":"CVE-2026-27347","title":"JetPopup <= 2.0.20.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8355e10-c8ad-480a-bf4b-946b2b980f24?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.20.2","to_inclusive":true,"patched_in":"2.0.20.3"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:22:31Z"},{"id":"wordfence:e83a6820-f44d-456b-9f0f-be44a2704296","source":"wordfence","cve":"CVE-2025-67574","title":"Booking calendar, Appointment Booking System <= 3.2.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e83a6820-f44d-456b-9f0f-be44a2704296?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.30","to_inclusive":true,"patched_in":"3.2.31"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T20:17:37Z"},{"id":"wordfence:e83ad1b7-e7d6-41cd-87de-c98362e31879","source":"wordfence","cve":"CVE-2021-24493","title":"Shopp <= 1.4 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e83ad1b7-e7d6-41cd-87de-c98362e31879?source=api-prod","affected":[{"type":"plugin","slug":"shopp","name":"Shopp","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2021-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e83d4254-74db-4230-a641-fc078291350d","source":"wordfence","cve":"CVE-2026-14882","title":"Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e83d4254-74db-4230-a641-fc078291350d?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-10-09T16:51:35Z","updated":"2026-10-10T05:31:07Z"},{"id":"wordfence:e83f9945-b49f-4718-9ff2-673a7f66c381","source":"wordfence","cve":"CVE-2024-10098","title":"ApplyOnline <= 2.6.2 - Unauthenticated Application Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-552","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e83f9945-b49f-4718-9ff2-673a7f66c381?source=api-prod","affected":[{"type":"plugin","slug":"apply-online","name":"ApplyOnline \u2013 Application Form Builder and Manager","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-10-31T00:00:00Z","updated":"2025-05-27T14:47:23Z"},{"id":"wordfence:e842ce50-0117-4564-9551-482278dd5c11","source":"wordfence","cve":"CVE-2025-23936","title":"CC Circle Progress Bar <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e842ce50-0117-4564-9551-482278dd5c11?source=api-prod","affected":[{"type":"plugin","slug":"cc-circle-progress-bar","name":"CC Circle Progress Bar","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T15:09:21Z"},{"id":"wordfence:e845e565-3c9f-4de3-94ce-e0b03ed4d5a9","source":"wordfence","cve":"CVE-2026-22398","title":"Fleur <= 2.0 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e845e565-3c9f-4de3-94ce-e0b03ed4d5a9?source=api-prod","affected":[{"type":"theme","slug":"fluer","name":"Fleur - Wedding WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-01T00:00:00Z","updated":"2026-01-14T21:30:13Z"},{"id":"wordfence:e8469ffc-477a-4ff1-853b-dcefba2b9c4e","source":"wordfence","cve":"","title":"Rockhoist Ratings < 1.2.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8469ffc-477a-4ff1-853b-dcefba2b9c4e?source=api-prod","affected":[{"type":"plugin","slug":"rockhoist-ratings","name":"Rockhoist Ratings","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":false,"patched_in":"1.2.3"}],"published":"2018-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e846e864-4560-4209-8865-51f4747c36c7","source":"wordfence","cve":"CVE-2025-48166","title":"Stop and Block bots plugin Anti bots <= 1.48 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e846e864-4560-4209-8865-51f4747c36c7?source=api-prod","affected":[{"type":"plugin","slug":"antibots","name":"Stop and Block bots plugin Anti-bots","from":"*","from_inclusive":true,"to":"1.48","to_inclusive":true,"patched_in":"1.50"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T20:54:29Z"},{"id":"wordfence:e8493822-9b78-49c9-a4fb-93c22ebc0216","source":"wordfence","cve":"CVE-2026-62139","title":"Site Kit by Google \u2013 Analytics, Search Console, AdSense, Speed <= 1.186.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8493822-9b78-49c9-a4fb-93c22ebc0216?source=api-prod","affected":[{"type":"plugin","slug":"google-site-kit","name":"Site Kit by Google \u2013 Analytics, Search Console, AdSense, Speed","from":"*","from_inclusive":true,"to":"1.186.0","to_inclusive":true,"patched_in":"1.187.0"}],"published":"2026-09-10T00:00:00Z","updated":"2026-09-15T20:16:47Z"},{"id":"wordfence:e84b1f01-1c3b-4498-aea9-02ced5f1109e","source":"wordfence","cve":"CVE-2018-5673","title":"Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84b1f01-1c3b-4498-aea9-02ced5f1109e?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":false,"patched_in":"2.1.8"}],"published":"2018-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e84b68b6-1ce8-45fb-823f-a61158aa4d21","source":"wordfence","cve":"CVE-2024-8427","title":"Frontend Post Submission Manager Lite \u2013 Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84b68b6-1ce8-45fb-823f-a61158aa4d21?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission-manager-lite","name":"Frontend Post Submission Manager Lite \u2013 Guest Post and Frontend Submission Forms","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-09-05T18:13:21Z","updated":"2024-09-06T06:50:55Z"},{"id":"wordfence:e84d3e22-8568-4bdb-be9b-ffe78c69ec24","source":"wordfence","cve":"CVE-2024-0434","title":"WordPress Tour & Travel Booking Plugin for WooCommerce \u2013 WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84d3e22-8568-4bdb-be9b-ffe78c69ec24?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2024-05-28T00:00:00Z","updated":"2024-07-29T21:37:42Z"},{"id":"wordfence:e84d50e1-65fe-4323-981f-e2ae6da0ddab","source":"wordfence","cve":"CVE-2024-30498","title":"CRM Perks Forms <= 1.1.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84d50e1-65fe-4323-981f-e2ae6da0ddab?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:54:00Z"},{"id":"wordfence:e84e6efc-f9d2-45a8-a0eb-b99227980b83","source":"wordfence","cve":"CVE-2026-24561","title":"FluentBoards <= 1.91.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84e6efc-f9d2-45a8-a0eb-b99227980b83?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"1.91.1","to_inclusive":true,"patched_in":"1.91.2"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T15:41:07Z"},{"id":"wordfence:e84e7d6e-9ec9-49f9-90e3-19ac499264ef","source":"wordfence","cve":"CVE-2022-1843","title":"MailPress <= 7.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84e7d6e-9ec9-49f9-90e3-19ac499264ef?source=api-prod","affected":[{"type":"plugin","slug":"mailpress","name":"MailPress","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e84ee2b5-96b5-427c-ac66-7f80418ae02f","source":"wordfence","cve":"CVE-2024-9384","title":"Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e84ee2b5-96b5-427c-ac66-7f80418ae02f?source=api-prod","affected":[{"type":"plugin","slug":"wholesale-pricing-woocommerce","name":"Price by Quantity & Bulk Quantity Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2024-10-03T14:03:11Z","updated":"2024-10-04T02:04:58Z"},{"id":"wordfence:e850aca1-72b3-4436-bc35-2d52c439a7b5","source":"wordfence","cve":"CVE-2020-14206","title":"DiveBook <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e850aca1-72b3-4436-bc35-2d52c439a7b5?source=api-prod","affected":[{"type":"plugin","slug":"divebook","name":"DiveBook","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2020-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8574ff9-847c-4337-8c0e-2a717b51f66c","source":"wordfence","cve":"CVE-2023-49753","title":"Adifier System < 3.1.4 -  Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8574ff9-847c-4337-8c0e-2a717b51f66c?source=api-prod","affected":[{"type":"theme","slug":"adifier-system","name":"Adifier - Classified Ads WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2023-12-04T00:00:00Z","updated":"2026-04-24T15:30:37Z"},{"id":"wordfence:e8596412-53d5-45ed-998a-49799bd269d0","source":"wordfence","cve":"","title":"Image Regenerate & Select Crop <= 7.1.0 - Cross-Site Request Forgery on multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8596412-53d5-45ed-998a-49799bd269d0?source=api-prod","affected":[{"type":"plugin","slug":"image-regenerate-select-crop","name":"Image Regenerate & Select Crop","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":false,"patched_in":"7.2.0"}],"published":"2023-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e85a6a5c-f33e-4d49-9662-8bff5d296830","source":"wordfence","cve":"CVE-2026-97192","title":"Secure Custom Fields <= 6.9.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85a6a5c-f33e-4d49-9662-8bff5d296830?source=api-prod","affected":[{"type":"plugin","slug":"secure-custom-fields","name":"Secure Custom Fields","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T20:12:51Z"},{"id":"wordfence:e85df0dc-d3da-4503-9249-939bb36f18ab","source":"wordfence","cve":"CVE-2022-1945","title":"Coming Soon & Maintenance Mode by Colorlib <= 1.0.98 - Administrator+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85df0dc-d3da-4503-9249-939bb36f18ab?source=api-prod","affected":[{"type":"plugin","slug":"colorlib-coming-soon-maintenance","name":"Coming Soon & Maintenance Mode by Colorlib","from":"*","from_inclusive":true,"to":"1.0.98","to_inclusive":true,"patched_in":"1.0.99"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e85ee611-ae81-4736-b4f0-b9d06714da18","source":"wordfence","cve":"CVE-2024-7655","title":"Community by PeepSo \u2013 Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85ee611-ae81-4736-b4f0-b9d06714da18?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.4.5.0","to_inclusive":true,"patched_in":"6.4.6.0"}],"published":"2024-09-09T19:04:00Z","updated":"2024-09-10T07:30:04Z"},{"id":"wordfence:e85efdc1-cffc-411a-a2f7-6fa1132e2910","source":"wordfence","cve":"CVE-2023-34021","title":"Church Admin <= 3.7.29 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85efdc1-cffc-411a-a2f7-6fa1132e2910?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"3.7.29","to_inclusive":true,"patched_in":"3.7.30"}],"published":"2023-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e85f11e5-309b-40a6-b9fa-5416015ea21d","source":"wordfence","cve":"CVE-2024-43146","title":"AMP for WP <= 1.0.96.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85f11e5-309b-40a6-b9fa-5416015ea21d?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.96.1","to_inclusive":true,"patched_in":"1.0.97"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:29:27Z"},{"id":"wordfence:e85ff3b3-de41-4ac4-b825-b3238725ca44","source":"wordfence","cve":"CVE-2025-12980","title":"Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u2013 PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e85ff3b3-de41-4ac4-b825-b3238725ca44?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":true,"patched_in":"5.0.4"}],"published":"2025-12-20T14:15:06Z","updated":"2025-12-21T02:20:32Z"},{"id":"wordfence:e860a695-52ca-45c5-8b20-9ee3bc0bf219","source":"wordfence","cve":"CVE-2025-31455","title":"Limit Max IPs Per User <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e860a695-52ca-45c5-8b20-9ee3bc0bf219?source=api-prod","affected":[{"type":"plugin","slug":"limit-max-ips-per-user","name":"Limit Max IPs Per User","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:38:59Z"},{"id":"wordfence:e860aa70-b8ef-4b2a-a035-b01efce30a79","source":"wordfence","cve":"CVE-2026-6222","title":"Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e860aa70-b8ef-4b2a-a035-b01efce30a79?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.51.1","to_inclusive":true,"patched_in":"1.52"}],"published":"2026-05-06T12:50:38Z","updated":"2026-05-07T01:25:27Z"},{"id":"wordfence:e86152a6-cd8d-4466-bcc5-830413500e12","source":"wordfence","cve":"CVE-2024-24710","title":"Feed Them Social <= 4.2.0 - Cross-Site Request Forgery via review_nag_check","severity":"low","cvss":3.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86152a6-cd8d-4466-bcc5-830413500e12?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-social","name":"Feed Them Social \u2013 Social Media Feeds, Video, and Photo Galleries","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-02T20:39:41Z"},{"id":"wordfence:e8622c18-bf16-44b2-ac14-76893789583e","source":"wordfence","cve":"CVE-2025-67471","title":"Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8622c18-bf16-44b2-ac14-76893789583e?source=api-prod","affected":[{"type":"plugin","slug":"quick-contact-form","name":"Quick Contact Form","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2025-11-25T00:00:00Z","updated":"2025-12-11T16:42:16Z"},{"id":"wordfence:e8640fba-7c0d-47ae-8d6c-ed504b4bf140","source":"wordfence","cve":"CVE-2025-28978","title":"SB Breadcrumbs <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8640fba-7c0d-47ae-8d6c-ed504b4bf140?source=api-prod","affected":[{"type":"plugin","slug":"sb-breadcrumbs","name":"SB Breadcrumbs","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-26T00:00:00Z","updated":"2025-07-01T14:04:01Z"},{"id":"wordfence:e8645b58-6b2a-4659-a002-d622453bea42","source":"wordfence","cve":"CVE-2026-92561","title":"Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8645b58-6b2a-4659-a002-d622453bea42?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"11.8.2","to_inclusive":true,"patched_in":"11.8.3"}],"published":"2026-09-17T18:25:30Z","updated":"2026-09-18T06:38:57Z"},{"id":"wordfence:e865324e-a2a2-40fb-8c6a-a89317b59c8c","source":"wordfence","cve":"","title":"Booking Calendar <= 6.2 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e865324e-a2a2-40fb-8c6a-a89317b59c8c?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e86581bd-94c3-4b05-9590-ca3b62073703","source":"wordfence","cve":"CVE-2024-4409","title":"WP-ViperGB <= 1.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86581bd-94c3-4b05-9590-ca3b62073703?source=api-prod","affected":[{"type":"plugin","slug":"wp-vipergb","name":"WP-ViperGB","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2024-05-23T14:23:40Z","updated":"2024-05-24T02:31:03Z"},{"id":"wordfence:e868661c-987b-434f-a7a6-f37dd9ddccdb","source":"wordfence","cve":"CVE-2025-49890","title":"Organic Beauty <= 1.4.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e868661c-987b-434f-a7a6-f37dd9ddccdb?source=api-prod","affected":[{"type":"theme","slug":"organic-beauty","name":"organic-beauty","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2025-08-26T14:21:12Z"},{"id":"wordfence:e8687bf7-4172-4cc3-bd6e-830fc5fc28e9","source":"wordfence","cve":"CVE-2004-1559","title":"WordPress Core < 1.2.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8687bf7-4172-4cc3-bd6e-830fc5fc28e9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2004-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e869800a-6fbc-4a1a-97fd-92ecbf3305ff","source":"wordfence","cve":"CVE-2022-47150","title":"Appsero <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e869800a-6fbc-4a1a-97fd-92ecbf3305ff?source=api-prod","affected":[{"type":"plugin","slug":"pt-elementor-addons-lite","name":"PT Addons for Elementor Lite","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.37","to_inclusive":true,"patched_in":"10.38"},{"type":"plugin","slug":"wepos","name":"wePOS \u2013 Point Of Sale (POS) for WooCommerce & Dokan","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"},{"type":"plugin","slug":"easy-video-reviews","name":"Easy Video Reviews \u2013 Testimonial Grid & Social Proof","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"worth-the-read","name":"Worth The Read","from":"*","from_inclusive":true,"to":"1.14","to_inclusive":true,"patched_in":"1.14.1"},{"type":"plugin","slug":"woostify-sites-library","name":"Woostify Sites Library","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"2.12.14","to_inclusive":true,"patched_in":"2.12.15"},{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"},{"type":"plugin","slug":"wp-edit-password-protected","name":"WPEPP \u2013 All In One WordPress Security, Firewall, Malware Scanner & Login Protection","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"woo-product-gallery-slider","name":"Product Gallery Slider, Additional Variation Images for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"},{"type":"plugin","slug":"dark-mode","name":"Markdown Editor (Formerly Dark Mode)","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"},{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.12","to_inclusive":true,"patched_in":"2.6.13"},{"type":"plugin","slug":"dashboard-welcome-for-elementor","name":"Dashboard Welcome for Elementor","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"},{"type":"plugin","slug":"wp-dark-mode","name":"Dark Mode \u2013 Improve Accessibility with AI Powered Dark Theme","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"},{"type":"plugin","slug":"fuse-social-floating-sidebar","name":"Fuse Social Icons","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"},{"type":"plugin","slug":"stylish-cost-calculator","name":"Stylish Cost Calculator \u2013 Quote Generator, Lead Gen & Price Estimator","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"},{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.28.0","to_inclusive":true,"patched_in":"3.28.1"},{"type":"plugin","slug":"woo-category-slider-by-pluginever","name":"Product Category Slider for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"},{"type":"plugin","slug":"webinar-and-video-conference-with-jitsi-meet","name":"FlexMeeting \u2013 Webinar & Meeting Plugin for Jitsi Meet","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"},{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.1","to_inclusive":true,"patched_in":"1.14.2"},{"type":"plugin","slug":"stax-buddy-builder","name":"BuddyPress Builder for Elementor \u2013 BuddyBuilder","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"},{"type":"plugin","slug":"legal-pages","name":"Legal Pages \u2013 Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"},{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"},{"type":"plugin","slug":"woocommerce-conversion-tracking","name":"Conversion Tracking for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"},{"type":"plugin","slug":"gs-testimonial","name":"Solid Testimonials \u2013 Testimonial Slider, Video Testimonials & Customer Reviews","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"},{"type":"plugin","slug":"wp-maximum-upload-file-size","name":"EasyMedia \u2013 Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"},{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"1.6","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"},{"type":"plugin","slug":"bangladeshi-payment-gateways","name":"Bangladeshi Payment Gateways \u2013 Make Payment Using QR Code","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"},{"type":"plugin","slug":"texty","name":"Texty \u2013 SMS Notification for WordPress, WooCommerce, Dokan and more","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"plugin","slug":"visibility-logic-elementor","name":"Visibility Logic for Elementor","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"},{"type":"plugin","slug":"webappick-pdf-invoice-for-woocommerce","name":"PDF Invoices & Packing Slips for WooCommerce \u2013 Challan Invoice Plugin","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.4.9"},{"type":"plugin","slug":"darklup-lite-wp-dark-mode","name":"Darklup \u2013 Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"},{"type":"plugin","slug":"exclusive-team-for-elementor","name":"Exclusive Team for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"click-to-top","name":"Click to top","from":"*","from_inclusive":true,"to":"1.2.19","to_inclusive":true,"patched_in":"1.2.20"},{"type":"plugin","slug":"update-alt-attribute","name":"Update Image Tag Alt Attribute","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"magical-posts-display","name":"Magical Posts Display \u2013 Elementor Advanced Posts widgets","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"},{"type":"plugin","slug":"gs-pinterest-portfolio","name":"GS Pinterest Portfolio \u2013 Pinterest Feed, Pinterest Board & Pin Widgets","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"},{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.10.5","to_inclusive":true,"patched_in":"1.11.0"},{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"},{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"},{"type":"plugin","slug":"zero-bs-accounting","name":"Zero BS Accounting","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"2.0.0"},{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"},{"type":"plugin","slug":"boostify-header-footer-builder","name":"Boostify Header Footer Builder for Elementor","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"},{"type":"plugin","slug":"stax-addons-for-elementor","name":"Stax Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"},{"type":"plugin","slug":"easy-sticky-sidebar","name":"WP CTA \u2013 Call Now Button, Sticky Button & Call to Action Builder","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"},{"type":"plugin","slug":"gallery-box","name":"Gallery Box","from":"*","from_inclusive":true,"to":"1.7.30","to_inclusive":true,"patched_in":"1.7.31"},{"type":"plugin","slug":"unlimited-elementor-inner-sections-by-boomdevs","name":"Prime Elementor Addons \u2013 Lightweight Elementor Widgets for Faster Pages","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"},{"type":"plugin","slug":"woo-reviews-by-wiremo","name":"Wiremo \u2013 Product Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.96","to_inclusive":true,"patched_in":"1.4.97"},{"type":"plugin","slug":"cart-lift","name":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"},{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"2.6.4","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"},{"type":"plugin","slug":"wc-category-showcase","name":"Product Category Showcase for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2022-12-14T00:00:00Z","updated":"2024-11-13T15:49:38Z"},{"id":"wordfence:e86ab1ea-5b3c-4a14-9de1-3bae14f587c5","source":"wordfence","cve":"CVE-2021-36843","title":"Social Media Flying Icons | Floating Social Media Icon <= 4.3.5 -  Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86ab1ea-5b3c-4a14-9de1-3bae14f587c5?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-media-icon","name":"Social Media Flying Icons | Floating Social Media Icon","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":""}],"published":"2021-10-27T08:17:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e86c080d-202c-4c41-b9cc-c35249aabba5","source":"wordfence","cve":"CVE-2024-4711","title":"WordPress Infinite Scroll \u2013 Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86c080d-202c-4c41-b9cc-c35249aabba5?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2024-05-31T14:21:46Z","updated":"2024-06-01T02:32:49Z"},{"id":"wordfence:e86dddc9-c1d3-426b-8ec7-2e56dc3c2379","source":"wordfence","cve":"CVE-2026-77203","title":"Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e86dddc9-c1d3-426b-8ec7-2e56dc3c2379?source=api-prod","affected":[{"type":"plugin","slug":"groups","name":"Groups \u2013 Memberships and Access Control","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2026-09-26T04:34:00Z","updated":"2026-09-26T17:28:59Z"},{"id":"wordfence:e87209a2-a18e-40e3-b0ba-9ee548a36e8e","source":"wordfence","cve":"CVE-2024-8854","title":"Polls CP <= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87209a2-a18e-40e3-b0ba-9ee548a36e8e?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.76","to_inclusive":true,"patched_in":"1.0.77"}],"published":"2024-09-01T00:00:00Z","updated":"2025-05-29T22:29:37Z"},{"id":"wordfence:e8731e78-654c-4804-84f2-2462134684e1","source":"wordfence","cve":"CVE-2025-58690","title":"Doliconnect <= 9.5.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8731e78-654c-4804-84f2-2462134684e1?source=api-prod","affected":[{"type":"plugin","slug":"doliconnect","name":"Doliconnect","from":"*","from_inclusive":true,"to":"9.5.7","to_inclusive":true,"patched_in":"9.6.2"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T21:24:15Z"},{"id":"wordfence:e8766cca-bc87-4cf1-aa34-8855b049d1f2","source":"wordfence","cve":"CVE-2026-91829","title":"Subscribe to Comments <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8766cca-bc87-4cf1-aa34-8855b049d1f2?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:24:09Z"},{"id":"wordfence:e8786f44-09b9-4281-b615-5df4b494a083","source":"wordfence","cve":"CVE-2023-1465","title":"WP EasyPay <= 4.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8786f44-09b9-4281-b615-5df4b494a083?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.1"}],"published":"2023-05-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e87bec5f-2265-4272-8a9c-dd8f22e3d421","source":"wordfence","cve":"CVE-2025-43832","title":"Remote Images Grabber <= 0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87bec5f-2265-4272-8a9c-dd8f22e3d421?source=api-prod","affected":[{"type":"plugin","slug":"remote-images-grabber","name":"Remote Images Grabber","from":"*","from_inclusive":true,"to":"0.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-30T00:00:00Z","updated":"2025-05-30T20:15:20Z"},{"id":"wordfence:e87d7ca0-6fa3-4ca3-b308-d47e1e2e6566","source":"wordfence","cve":"","title":"Eptonic <= 1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87d7ca0-6fa3-4ca3-b308-d47e1e2e6566?source=api-prod","affected":[{"type":"theme","slug":"eptonic","name":"Eptonic","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2013-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e","source":"wordfence","cve":"CVE-2026-19804","title":"s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"260814","to_inclusive":true,"patched_in":"260829"}],"published":"2026-09-24T18:56:33Z","updated":"2026-09-25T07:40:30Z"},{"id":"wordfence:e87daf87-2afb-433c-bb90-1d7469953bcc","source":"wordfence","cve":"CVE-2026-119065","title":"Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87daf87-2afb-433c-bb90-1d7469953bcc?source=api-prod","affected":[{"type":"plugin","slug":"shipping-zones-by-drawing-for-woocommerce","name":"Shipping Zones by Drawing for WooCommerce","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-10-30T17:40:22Z","updated":"2026-10-31T06:44:23Z"},{"id":"wordfence:e87ea6b5-4288-4ebb-8a29-e0a179e6b584","source":"wordfence","cve":"CVE-2023-24393","title":"Animated Number Counters <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87ea6b5-4288-4ebb-8a29-e0a179e6b584?source=api-prod","affected":[{"type":"plugin","slug":"animated-number-counters","name":"Animated Number Counters","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e87fc1bf-af05-4089-a164-8a2e73c68e8c","source":"wordfence","cve":"CVE-2026-110252","title":"WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87fc1bf-af05-4089-a164-8a2e73c68e8c?source=api-prod","affected":[{"type":"plugin","slug":"wpematico","name":"WPeMatico RSS Feed Fetcher","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2026-10-15T17:49:04Z","updated":"2026-10-16T06:41:07Z"},{"id":"wordfence:e87fe70d-5ac3-40ee-a8d0-601d7b417562","source":"wordfence","cve":"CVE-2023-46074","title":"FreshMail For WordPress <= 2.3.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87fe70d-5ac3-40ee-a8d0-601d7b417562?source=api-prod","affected":[{"type":"plugin","slug":"freshmail-integration","name":"FreshMail For WordPress","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e881ba2f-0e88-4c7b-aa0d-84e816019db9","source":"wordfence","cve":"","title":"Product Catalog Mode For Woocommerce <= 5.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e881ba2f-0e88-4c7b-aa0d-84e816019db9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-catalog-enquiry","name":"CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce","from":"*","from_inclusive":true,"to":"5.0.3","to_inclusive":false,"patched_in":"5.0.3"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8845d56-2e8a-472a-bc32-e26b388ce58d","source":"wordfence","cve":"CVE-2024-9213","title":"Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8845d56-2e8a-472a-bc32-e26b388ce58d?source=api-prod","affected":[{"type":"plugin","slug":"persian-woocommerce-sms","name":"\u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a9 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 | Persian WooCommerce SMS","from":"*","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-17T06:52:33Z"},{"id":"wordfence:e884af8b-c83f-4380-bfaf-f1419fce125c","source":"wordfence","cve":"CVE-2024-9546","title":"WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e884af8b-c83f-4380-bfaf-f1419fce125c?source=api-prod","affected":[{"type":"plugin","slug":"wpide","name":"WPIDE \u2013 File Manager & Code Editor","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2024-10-14T10:52:09Z","updated":"2024-10-14T23:29:56Z"},{"id":"wordfence:e8852d39-e34a-45d3-aee8-1ccbfc0ab238","source":"wordfence","cve":"CVE-2025-8143","title":"Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8852d39-e34a-45d3-aee8-1ccbfc0ab238?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.6.7","to_inclusive":true,"patched_in":"8.6.8"}],"published":"2025-08-15T00:00:00Z","updated":"2025-08-16T11:11:25Z"},{"id":"wordfence:e8865a30-ecff-439b-ab96-4dba018046ae","source":"wordfence","cve":"CVE-2026-59552","title":"3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8865a30-ecff-439b-ab96-4dba018046ae?source=api-prod","affected":[{"type":"plugin","slug":"pdf-embed-viewer","name":"Flipbook PDF Viewer & Embedder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T11:59:55Z"},{"id":"wordfence:e88a45e5-f882-419e-b0b0-612912666693","source":"wordfence","cve":"CVE-2023-6389","title":"WordPress Toolbar Plugin <= 2.2.6 - Open Redirect via wptbto","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e88a45e5-f882-419e-b0b0-612912666693?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-toolbar","name":"WordPress Toolbar","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T16:17:47Z"},{"id":"wordfence:e88afde4-6920-4086-940e-34b4a4ee30c5","source":"wordfence","cve":"CVE-2021-38359","title":"WordPress InviteBox Plugin <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e88afde4-6920-4086-940e-34b4a4ee30c5?source=api-prod","affected":[{"type":"plugin","slug":"refer-a-friend-widget-for-wp","name":"WordPress InviteBox Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e88bb3a8-de24-46fb-a3e4-9ca3fdd4cca7","source":"wordfence","cve":"CVE-2023-2710","title":"video carousel slider with lightbox <= 1.0.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e88bb3a8-de24-46fb-a3e4-9ca3fdd4cca7?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-video-gallery-with-lightbox","name":"Video Gallery \u2013 YouTube, Vimeo & Video Slider with Lightbox","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e88ec391-8d1b-4544-a7d0-0ac156c91ba5","source":"wordfence","cve":"CVE-2026-101357","title":"SEOPress <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_matomo_id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e88ec391-8d1b-4544-a7d0-0ac156c91ba5?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"10.2","to_inclusive":true,"patched_in":"10.3"}],"published":"2026-10-02T17:22:37Z","updated":"2026-10-03T05:29:19Z"},{"id":"wordfence:e895fc43-2348-4a02-abbf-eadaa181d25d","source":"wordfence","cve":"CVE-2026-66610","title":"Urna - All-in-one WooCommerce WordPress Theme <= 2.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e895fc43-2348-4a02-abbf-eadaa181d25d?source=api-prod","affected":[{"type":"theme","slug":"urna","name":"Urna - All-in-one WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:02:43Z"},{"id":"wordfence:e897617c-9d26-4de8-93ce-a9b177d28bc5","source":"wordfence","cve":"CVE-2025-57993","title":"Geolocation IP Detection <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e897617c-9d26-4de8-93ce-a9b177d28bc5?source=api-prod","affected":[{"type":"plugin","slug":"geoip-detect","name":"Geolocation IP Detection","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T14:49:26Z"},{"id":"wordfence:e897a83b-d746-427d-8c31-64d4eab5848e","source":"wordfence","cve":"CVE-2025-10682","title":"TARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e897a83b-d746-427d-8c31-64d4eab5848e?source=api-prod","affected":[{"type":"plugin","slug":"tariffuxx","name":"TARIFFUXX","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-10-14T20:00:49Z","updated":"2026-02-25T14:24:19Z"},{"id":"wordfence:e898b0ec-6180-485f-aa01-29c243681ebf","source":"wordfence","cve":"CVE-2026-28020","title":"Chroma <= 1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e898b0ec-6180-485f-aa01-29c243681ebf?source=api-prod","affected":[{"type":"theme","slug":"chroma","name":"Chroma","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:25:47Z"},{"id":"wordfence:e89b40ec-1952-46e3-a91b-bd38e62f8929","source":"wordfence","cve":"CVE-2024-5853","title":"Image Optimizer, Resizer and CDN \u2013 Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89b40ec-1952-46e3-a91b-bd38e62f8929?source=api-prod","affected":[{"type":"plugin","slug":"sirv","name":"Image Optimizer, Resizer and CDN \u2013 Sirv","from":"*","from_inclusive":true,"to":"7.2.6","to_inclusive":true,"patched_in":"7.2.7"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T05:37:47Z"},{"id":"wordfence:e89d912d-fa7a-4fb1-8872-95fa861c21ca","source":"wordfence","cve":"CVE-2023-2546","title":"WP User Switch <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie","severity":"high","cvss":8.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89d912d-fa7a-4fb1-8872-95fa861c21ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-switch","name":"WP User Switch","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2023-06-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e89e0697-53ab-43ae-a9bb-98e916cf06e8","source":"wordfence","cve":"CVE-2026-24557","title":"Contact Form 7 GetResponse Extension <= 1.0.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89e0697-53ab-43ae-a9bb-98e916cf06e8?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-getresponse-extension","name":"Contact Form 7 GetResponse Extension","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-01-22T00:00:00Z","updated":"2026-07-28T18:05:49Z"},{"id":"wordfence:e89f0699-42be-403a-8cdb-31e214a85851","source":"wordfence","cve":"CVE-2025-9029","title":"WDesignKit \u2013 Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89f0699-42be-403a-8cdb-31e214a85851?source=api-prod","affected":[{"type":"plugin","slug":"wdesignkit","name":"WDesignKit \u2013 AI Website Builder for WordPress with MCP & AI Widget Builder","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-10-03T14:09:53Z","updated":"2025-10-04T02:24:38Z"},{"id":"wordfence:e89fc348-1146-4593-8bf5-127f783ab786","source":"wordfence","cve":"CVE-2026-13353","title":"WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e89fc348-1146-4593-8bf5-127f783ab786?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"8.0.1","to_inclusive":true,"patched_in":"8.1"}],"published":"2026-07-10T13:43:13Z","updated":"2026-07-11T02:31:20Z"},{"id":"wordfence:e8a0c18b-9caf-4667-b0f2-6477a1638347","source":"wordfence","cve":"CVE-2024-35748","title":"WooCommerce Dropshipping <= 5.0.4 - Missing Authorization to Unauthenticated Arbitrary Email Send","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a0c18b-9caf-4667-b0f2-6477a1638347?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-dropshipping","name":"WooCommerce Dropshipping Premium","from":"*","from_inclusive":true,"to":"5.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T13:39:13Z"},{"id":"wordfence:e8a4c656-8df8-44ce-884f-dd502d17f594","source":"wordfence","cve":"CVE-2024-5864","title":"Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a4c656-8df8-44ce-884f-dd502d17f594?source=api-prod","affected":[{"type":"plugin","slug":"easy-affiliate-links","name":"Easy Affiliate Links","from":"*","from_inclusive":true,"to":"3.7.3","to_inclusive":true,"patched_in":"3.7.4"}],"published":"2024-06-27T00:00:00Z","updated":"2024-06-28T03:37:50Z"},{"id":"wordfence:e8a69fa8-c2a8-4d63-8db4-823122632b3a","source":"wordfence","cve":"CVE-2022-0448","title":"CP Blocks <= 1.0.14 - Authenticated Stored Cross-Site Scripting via License ID settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a69fa8-c2a8-4d63-8db4-823122632b3a?source=api-prod","affected":[{"type":"plugin","slug":"cp-blocks","name":"CP Blocks","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":false,"patched_in":"1.0.15"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8a6e9b7-5e74-4a45-9e6e-5781bf2a4a07","source":"wordfence","cve":"CVE-2022-1303","title":"Slide Anything \u2013 Responsive Content / HTML Slider and Carousel <= 2.3.43 - Editor+ Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a6e9b7-5e74-4a45-9e6e-5781bf2a4a07?source=api-prod","affected":[{"type":"plugin","slug":"slide-anything","name":"Slide Anything \u2013 Responsive Content / HTML Slider and Carousel","from":"*","from_inclusive":true,"to":"2.3.44","to_inclusive":false,"patched_in":"2.3.44"}],"published":"2022-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8a704b5-6db3-4197-bf03-c64f0508bcf1","source":"wordfence","cve":"CVE-2024-56045","title":"WPLMS < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion","severity":"high","cvss":8.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a704b5-6db3-4197-bf03-c64f0508bcf1?source=api-prod","affected":[{"type":"theme","slug":"wplms","name":"WPLMS Learning Management System for WordPress, WordPress LMS","from":"*","from_inclusive":true,"to":"1.9.9.5","to_inclusive":false,"patched_in":"1.9.9.5"}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T14:58:40Z"},{"id":"wordfence:e8a78f06-1af2-462e-b328-0e9e603ad904","source":"wordfence","cve":"CVE-2022-4507","title":"Real Cookie Banner <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a78f06-1af2-462e-b328-0e9e603ad904?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8a7c04a-1fa0-434d-8161-7a32cefb44c4","source":"wordfence","cve":"CVE-2024-1133","title":"Tutor LMS <= 2.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a7c04a-1fa0-434d-8161-7a32cefb44c4?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-02-20T00:00:00Z","updated":"2024-02-20T18:56:49Z"},{"id":"wordfence:e8a7d3b1-ceb7-4ff9-84e4-bc58a597b2cf","source":"wordfence","cve":"CVE-2011-5208","title":"BackWPup \u2013 WordPress Backup Plugin < 1.4.1 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a7d3b1-ceb7-4ff9-84e4-bc58a597b2cf?source=api-prod","affected":[{"type":"plugin","slug":"backwpup","name":"BackWPup \u2013 WordPress Backup & Restore Plugin","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2011-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8a864ff-2c0e-40c3-8c4e-dc034d8838b9","source":"wordfence","cve":"CVE-2014-9443","title":"Relevanssi \u2013 A Better Search < 3.3.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a864ff-2c0e-40c3-8c4e-dc034d8838b9?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":false,"patched_in":"3.3.8"}],"published":"2015-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8aa6ee7-525e-4458-9f5b-1e729afe448c","source":"wordfence","cve":"CVE-2026-104798","title":"My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=api-prod","affected":[{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"*","from_inclusive":true,"to":"3.4.24","to_inclusive":true,"patched_in":"3.4.25"},{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"3.5","from_inclusive":true,"to":"3.5.21","to_inclusive":true,"patched_in":"3.4.25"},{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"3.6","from_inclusive":true,"to":"3.6.17","to_inclusive":true,"patched_in":"3.4.25"},{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"3.7","from_inclusive":true,"to":"3.7.17","to_inclusive":true,"patched_in":"3.4.25"},{"type":"plugin","slug":"my-calendar","name":"My Calendar \u2013 Accessible Event Manager","from":"3.8","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.4.25"}],"published":"2026-10-15T16:25:37Z","updated":"2026-10-16T04:27:05Z"},{"id":"wordfence:e8ac3187-b065-434e-9051-d13330dd3da5","source":"wordfence","cve":"","title":"Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ac3187-b065-434e-9051-d13330dd3da5?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-wp-page-post","name":"Duplicate Page and Post","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8ac60ae-f67e-4d62-a3a7-fb2e9b334ec9","source":"wordfence","cve":"CVE-2025-32571","title":"TuriTop Booking System <= 1.0.11 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ac60ae-f67e-4d62-a3a7-fb2e9b334ec9?source=api-prod","affected":[{"type":"plugin","slug":"turitop-booking-system","name":"TuriTop Booking System","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.12"}],"published":"2025-04-14T00:00:00Z","updated":"2026-09-09T15:52:14Z"},{"id":"wordfence:e8af1fdb-7fec-4bbe-937b-ee2e76cf5c5b","source":"wordfence","cve":"CVE-2026-15446","title":"EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8af1fdb-7fec-4bbe-937b-ee2e76cf5c5b?source=api-prod","affected":[{"type":"plugin","slug":"ewww-image-optimizer","name":"EWWW Image Optimizer","from":"*","from_inclusive":true,"to":"8.7.3","to_inclusive":true,"patched_in":"8.7.4"}],"published":"2026-08-18T17:52:25Z","updated":"2026-08-19T06:37:54Z"},{"id":"wordfence:e8b03deb-4134-4dde-8545-a14977a47209","source":"wordfence","cve":"CVE-2023-34023","title":"WordPress Social Login <= 3.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b03deb-4134-4dde-8545-a14977a47209?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-social-login","name":"WordPress Social Login","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8b1f60a-3a13-4679-af3e-d6f95fd83cea","source":"wordfence","cve":"CVE-2025-5234","title":"Gutenverse News <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b1f60a-3a13-4679-af3e-d6f95fd83cea?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse-news","name":"Gutenverse News \u2013 News Blocks for Blog & Magazine Sites","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-06-18T21:18:15Z","updated":"2025-06-19T09:23:49Z"},{"id":"wordfence:e8b47cc6-437b-45c9-b263-ee43c7ec7d14","source":"wordfence","cve":"CVE-2014-125095","title":"Contact Form Plugin <= 3.81 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b47cc6-437b-45c9-b263-ee43c7ec7d14?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"3.81","to_inclusive":true,"patched_in":"3.82"}],"published":"2014-08-07T00:00:00Z","updated":"2024-02-07T14:30:59Z"},{"id":"wordfence:e8b5bc1b-c9dc-4ce5-86db-2802f5b49d0b","source":"wordfence","cve":"CVE-2023-25794","title":"Nooz <= 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b5bc1b-c9dc-4ce5-86db-2802f5b49d0b?source=api-prod","affected":[{"type":"plugin","slug":"nooz","name":"Nooz","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8b62157-8c32-462f-aba7-dab137f98f32","source":"wordfence","cve":"CVE-2018-19370","title":"Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution","severity":"medium","cvss":6.6,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b62157-8c32-462f-aba7-dab137f98f32?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.2.0"}],"published":"2018-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8b77b06-5f59-418a-8c94-498b2df252ad","source":"wordfence","cve":"CVE-2025-23774","title":"WPDB to Sql <= 1.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b77b06-5f59-418a-8c94-498b2df252ad?source=api-prod","affected":[{"type":"plugin","slug":"wpdb-to-sql","name":"WPDB to Sql","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T21:03:55Z"},{"id":"wordfence:e8b7e4cd-6290-4d58-b43b-52d010028007","source":"wordfence","cve":"CVE-2024-50431","title":"Breeze <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b7e4cd-6290-4d58-b43b-52d010028007?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:17:21Z"},{"id":"wordfence:e8bc24df-4d95-44b7-a58c-00a1b24f91e9","source":"wordfence","cve":"CVE-2024-32533","title":"LH Add Media From Url <= 1.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8bc24df-4d95-44b7-a58c-00a1b24f91e9?source=api-prod","affected":[{"type":"plugin","slug":"lh-add-media-from-url","name":"LH Add Media From Url","from":"*","from_inclusive":true,"to":"1.22","to_inclusive":true,"patched_in":"1.23"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-25T13:11:42Z"},{"id":"wordfence:e8bed9c0-dae3-405e-a946-5f28a3c30851","source":"wordfence","cve":"CVE-2023-6009","title":"UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8bed9c0-dae3-405e-a946-5f28a3c30851?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.4","to_inclusive":true,"patched_in":"5.1.5"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8c01984-e8ba-4671-b63c-46ea245e7efa","source":"wordfence","cve":"CVE-2021-24666","title":"Podlove Podcast Publisher <= 3.5.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c01984-e8ba-4671-b63c-46ea245e7efa?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"3.5.6","to_inclusive":false,"patched_in":"3.5.6"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8c0f9d8-c5cf-4e31-bc0b-289ad7c1d197","source":"wordfence","cve":"CVE-2025-2103","title":"SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c0f9d8-c5cf-4e31-bc0b-289ad7c1d197?source=api-prod","affected":[{"type":"plugin","slug":"soundrise-music","name":"SoundRise Music","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T05:24:04Z"},{"id":"wordfence:e8c15662-e4df-4a74-bb01-266eeb4879c5","source":"wordfence","cve":"CVE-2025-0955","title":"VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=api-prod","affected":[{"type":"plugin","slug":"vidorev-extensions","name":"VidoRev Extensions","from":"*","from_inclusive":true,"to":"2.9.9.9.9.9.5","to_inclusive":true,"patched_in":"2.9.9.9.9.9.6"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T04:22:35Z"},{"id":"wordfence:e8c16dd9-0c04-42b9-a2d3-28b442cecdb3","source":"wordfence","cve":"CVE-2019-14216","title":"WP SVG Icons <= 3.2.2 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c16dd9-0c04-42b9-a2d3-28b442cecdb3?source=api-prod","affected":[{"type":"plugin","slug":"svg-vector-icon-plugin","name":"WP SVG Icons","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2019-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8c1d1b1-5166-4230-aea0-cb708ff87de8","source":"wordfence","cve":"CVE-2025-30926","title":"King Addons for Elementor <= 24.12.58 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1d1b1-5166-4230-aea0-cb708ff87de8?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"24.12.58","to_inclusive":true,"patched_in":"24.12.59"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:23:42Z"},{"id":"wordfence:e8c1e568-7170-40d6-b522-2c89725e0501","source":"wordfence","cve":"CVE-2025-13520","title":"MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1e568-7170-40d6-b522-2c89725e0501?source=api-prod","affected":[{"type":"plugin","slug":"mtcaptcha","name":"MTCaptcha WordPress Plugin","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:35:15Z","updated":"2026-01-07T08:21:55Z"},{"id":"wordfence:e8c48986-a13a-435f-b6f6-f4b93967590a","source":"wordfence","cve":"CVE-2025-48344","title":"Rootspersona <= 3.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c48986-a13a-435f-b6f6-f4b93967590a?source=api-prod","affected":[{"type":"plugin","slug":"rootspersona","name":"RootsPersona","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-05-19T00:00:00Z","updated":"2026-07-31T12:12:23Z"},{"id":"wordfence:e8c74105-3f0c-4322-96f3-e6bf4760cc2f","source":"wordfence","cve":"","title":"Blaze Theme (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c74105-3f0c-4322-96f3-e6bf4760cc2f?source=api-prod","affected":[{"type":"theme","slug":"blaze","name":"Blaze","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8c939e9-2b72-460b-9e76-560762752c28","source":"wordfence","cve":"CVE-2026-57359","title":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.10 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c939e9-2b72-460b-9e76-560762752c28?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":true,"patched_in":"2.3.11"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:59:35Z"},{"id":"wordfence:e8cadb97-2f3e-4b00-ad00-118cf23d1592","source":"wordfence","cve":"CVE-2024-11870","title":"Event Registration Calendar By vcita <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8cadb97-2f3e-4b00-ad00-118cf23d1592?source=api-prod","affected":[{"type":"plugin","slug":"event-registration-calendar-by-vcita","name":"Event Registration Calendar By vcita","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T19:01:08Z","updated":"2025-01-16T15:11:14Z"},{"id":"wordfence:e8cbd8ee-1bd5-43ea-8e67-5ad893258512","source":"wordfence","cve":"CVE-2025-14313","title":"Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8cbd8ee-1bd5-43ea-8e67-5ad893258512?source=api-prod","affected":[{"type":"plugin","slug":"advance-wp-query-search-filter","name":"Advance WP Query Search Filter","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2025-12-09T00:00:00Z","updated":"2026-01-06T16:17:44Z"},{"id":"wordfence:e8d042be-e272-4e2d-93ec-83a0a42ecd51","source":"wordfence","cve":"","title":"SendPress Newsletters < 1.20.7.13 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d042be-e272-4e2d-93ec-83a0a42ecd51?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.20.7.13","to_inclusive":false,"patched_in":"1.20.7.13"}],"published":"2020-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8d1c4ab-1207-4414-9351-3ef2a3cd131b","source":"wordfence","cve":"CVE-2021-25117","title":"WP-PostRatings <= 1.86 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d1c4ab-1207-4414-9351-3ef2a3cd131b?source=api-prod","affected":[{"type":"plugin","slug":"wp-postratings","name":"WP-PostRatings","from":"*","from_inclusive":true,"to":"1.86","to_inclusive":true,"patched_in":"1.86.1"}],"published":"2020-12-24T00:00:00Z","updated":"2024-02-06T15:59:07Z"},{"id":"wordfence:e8d41006-ab36-4eed-8c17-2937ca7aff1b","source":"wordfence","cve":"CVE-2023-25484","title":"Simple Yearly Archive <= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d41006-ab36-4eed-8c17-2937ca7aff1b?source=api-prod","affected":[{"type":"plugin","slug":"simple-yearly-archive","name":"Simple Yearly Archive","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8d4cd3d-68ad-45ec-b4b3-e705da4e6628","source":"wordfence","cve":"CVE-2026-81534","title":"Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d4cd3d-68ad-45ec-b4b3-e705da4e6628?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-email-customizer","name":"Email Customizer for WooCommerce (Pro)","from":"*","from_inclusive":true,"to":"3.9.5","to_inclusive":true,"patched_in":"3.9.6"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-15T06:41:59Z"},{"id":"wordfence:e8d58619-1e44-4ec5-866c-be1d8d63ab28","source":"wordfence","cve":"CVE-2026-97071","title":"CURCY \u2013 Multi Currency for WooCommerce <= 2.2.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d58619-1e44-4ec5-866c-be1d8d63ab28?source=api-prod","affected":[{"type":"plugin","slug":"woo-multi-currency","name":"CURCY \u2013 Multi Currency for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":"2.2.18"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:39:21Z"},{"id":"wordfence:e8d75eb6-2a9f-4c33-9e15-db7db037b67e","source":"wordfence","cve":"CVE-2022-47161","title":"Health Check & Troubleshooting <= 1.5.1 - Cross-Site Request Forgery via health_check_troubleshoot_get_captures","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d75eb6-2a9f-4c33-9e15-db7db037b67e?source=api-prod","affected":[{"type":"plugin","slug":"health-check","name":"Health Check & Troubleshooting","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8d7ace3-af34-4951-810b-87923ef2ec30","source":"wordfence","cve":"CVE-2024-2280","title":"Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7ace3-af34-4951-810b-87923ef2ec30?source=api-prod","affected":[{"type":"plugin","slug":"better-elementor-addons","name":"Better Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-05T20:16:40Z"},{"id":"wordfence:e8d7e8f3-e8ff-460f-a343-807bcdb865dc","source":"wordfence","cve":"CVE-2025-10752","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.26.12","to_inclusive":true,"patched_in":"6.26.13"}],"published":"2025-09-25T13:34:18Z","updated":"2025-09-26T01:47:27Z"},{"id":"wordfence:e8db52ce-fbc3-4fe1-b9b4-cb2ce7d88a67","source":"wordfence","cve":"CVE-2023-48272","title":"Maspik \u2013 Spam blacklist <= 0.9.2 - Unauthenticated Stored Cross-Site Scripting via efas_add_to_log","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8db52ce-fbc3-4fe1-b9b4-cb2ce7d88a67?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":"0.9.3"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8de3e34-fa8a-435c-a435-10b8efa19088","source":"wordfence","cve":"CVE-2026-14214","title":"Booking for Appointments and Events Calendar \u2013 Amelia < 2.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8de3e34-fa8a-435c-a435-10b8efa19088?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":false,"patched_in":"2.4.4"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-13T19:28:05Z"},{"id":"wordfence:e8e2519e-89cc-455f-921c-fe6b10f1dc26","source":"wordfence","cve":"CVE-2019-25314","title":"Duplicate Post <= 3.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8e2519e-89cc-455f-921c-fe6b10f1dc26?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-post","name":"Yoast Duplicate Post","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T21:41:26Z"},{"id":"wordfence:e8e2dbf9-f6b5-4328-92c5-5d46a4097235","source":"wordfence","cve":"CVE-2026-57646","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8e2dbf9-f6b5-4328-92c5-5d46a4097235?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-02T12:27:39Z"},{"id":"wordfence:e8e5f9f1-af2b-4a4f-ae5c-145252cd0ed5","source":"wordfence","cve":"CVE-2025-15491","title":"Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8e5f9f1-af2b-4a4f-ae5c-145252cd0ed5?source=api-prod","affected":[{"type":"plugin","slug":"post-slides","name":"Post Slides","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-02-10T19:06:41Z"},{"id":"wordfence:e8e6ee6f-b918-4a8c-82ea-4761f2bcbc43","source":"wordfence","cve":"CVE-2025-63054","title":"Quiz And Survey Master <= 10.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8e6ee6f-b918-4a8c-82ea-4761f2bcbc43?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.3.2","to_inclusive":true,"patched_in":"10.3.3"}],"published":"2025-11-30T00:00:00Z","updated":"2026-01-06T20:45:26Z"},{"id":"wordfence:e8ec1bc6-cca5-4b0a-944c-47de0fa46ec9","source":"wordfence","cve":"CVE-2025-62008","title":"Product Table For WooCommerce <= 1.2.4 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ec1bc6-cca5-4b0a-944c-47de0fa46ec9?source=api-prod","affected":[{"type":"plugin","slug":"product-table-for-woocommerce","name":"Product Table For WooCommerce","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:30:18Z"},{"id":"wordfence:e8ed5d5d-86b0-40ac-a093-31392dea13a2","source":"wordfence","cve":"CVE-2024-13606","title":"JS Help Desk \u2013 The Ultimate Help Desk & Support Plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ed5d5d-86b0-40ac-a093-31392dea13a2?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2025-02-12T00:00:00Z","updated":"2025-03-06T16:35:57Z"},{"id":"wordfence:e8efc5cf-3497-4426-a8a5-740783a7c2c9","source":"wordfence","cve":"","title":"Acumbamail < 1.0.4.1 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8efc5cf-3497-4426-a8a5-740783a7c2c9?source=api-prod","affected":[{"type":"plugin","slug":"acumbamail-signup-forms","name":"Acumbamail","from":"*","from_inclusive":true,"to":"1.0.4.1","to_inclusive":false,"patched_in":"1.0.4.1"}],"published":"2014-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8f113e6-73da-4c18-ab29-55728dd126c8","source":"wordfence","cve":"CVE-2024-56222","title":"CodeBard Help Desk <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f113e6-73da-4c18-ab29-55728dd126c8?source=api-prod","affected":[{"type":"plugin","slug":"codebard-help-desk","name":"CodeBard Help Desk","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:17:37Z"},{"id":"wordfence:e8f20aae-37e2-44f6-ac2d-692a87bf5728","source":"wordfence","cve":"CVE-2014-10385","title":"Memphis Documents Library <= 2.6.16 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f20aae-37e2-44f6-ac2d-692a87bf5728?source=api-prod","affected":[{"type":"plugin","slug":"memphis-documents-library","name":"Memphis Documents Library","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2014-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8f2330e-d319-4832-b1b0-1ea702a34026","source":"wordfence","cve":"CVE-2025-48356","title":"Kanpress <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f2330e-d319-4832-b1b0-1ea702a34026?source=api-prod","affected":[{"type":"plugin","slug":"kanpress","name":"Kanpress","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T14:01:03Z"},{"id":"wordfence:e8f6a03f-5f4d-41e1-b69b-6ab3068b56bd","source":"wordfence","cve":"CVE-2025-68979","title":"Google Calendar Events <= 3.5.9 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f6a03f-5f4d-41e1-b69b-6ab3068b56bd?source=api-prod","affected":[{"type":"plugin","slug":"google-calendar-events","name":"Simple Calendar \u2013 Google Calendar, Events, & ICS Feeds","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-13T16:55:23Z"},{"id":"wordfence:e8f6cabb-ecf5-44f1-bc39-20d9dc989600","source":"wordfence","cve":"CVE-2025-22539","title":"Custom DataBase Tables <= 2.1.34 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f6cabb-ecf5-44f1-bc39-20d9dc989600?source=api-prod","affected":[{"type":"plugin","slug":"custom-database-tables","name":"Custom DataBase Tables","from":"*","from_inclusive":true,"to":"2.1.34","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:32:13Z"},{"id":"wordfence:e8f6d6f8-42c6-4613-88bf-c00fcc6a9ffe","source":"wordfence","cve":"CVE-2025-23697","title":"Pod\u010dl\u00e1nkov\u00e1 inzerce <= 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f6d6f8-42c6-4613-88bf-c00fcc6a9ffe?source=api-prod","affected":[{"type":"plugin","slug":"podclankova-inzerce","name":"Pod\u010dl\u00e1nkov\u00e1 inzerce","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:08:39Z"},{"id":"wordfence:e8f73f1e-8f0a-4c4c-aca2-c9ae9bc4f63d","source":"wordfence","cve":"CVE-2018-15818","title":"Repute ARForms <= 3.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8f73f1e-8f0a-4c4c-aca2-c9ae9bc4f63d?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":false,"patched_in":"3.5.2"}],"published":"2018-10-17T00:00:00Z","updated":"2024-05-15T19:02:28Z"},{"id":"wordfence:e8fa1f97-72f6-4e84-bee4-0d3f7e16eb96","source":"wordfence","cve":"","title":"Uploadify Integration <= 0.9.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8fa1f97-72f6-4e84-bee4-0d3f7e16eb96?source=api-prod","affected":[{"type":"plugin","slug":"uploadify-integration","name":"Uploadify Integration","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":""}],"published":"2012-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8fcc105-0b37-47a7-a726-fee33b86790e","source":"wordfence","cve":"CVE-2008-0192","title":"WordPress Core <= 2.0.9 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8fcc105-0b37-47a7-a726-fee33b86790e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2007-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8fe4aa7-13e6-48ec-afec-2888edd999f5","source":"wordfence","cve":"","title":"WP Fastest Cache <= 0.8.5.9 - Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8fe4aa7-13e6-48ec-afec-2888edd999f5?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.5.9","to_inclusive":true,"patched_in":"0.8.6.0"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e8fecebd-c884-4124-96d6-106351e0c7a7","source":"wordfence","cve":"CVE-2026-1508","title":"Court Reservation \u2013 Manage Your Court Bookings Online < 1.10.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8fecebd-c884-4124-96d6-106351e0c7a7?source=api-prod","affected":[{"type":"plugin","slug":"court-reservation","name":"Court Reservation \u2013 Tennis, Padel & Sports Court Booking","from":"*","from_inclusive":true,"to":"1.10.9","to_inclusive":false,"patched_in":"1.10.9"}],"published":"2026-02-17T00:00:00Z","updated":"2026-03-19T13:37:47Z"},{"id":"wordfence:e8ffb5f8-4a7a-47af-a3db-82c3d70fe8bf","source":"wordfence","cve":"CVE-2025-24715","title":"Counter Box <= 2.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ffb5f8-4a7a-47af-a3db-82c3d70fe8bf?source=api-prod","affected":[{"type":"plugin","slug":"counter-box","name":"Counter Box \u2013 Add Countdowns, Timers & Dynamic Counters to WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:02:53Z"},{"id":"wordfence:e8ffdd43-b353-4296-bcb6-978751aae1b6","source":"wordfence","cve":"CVE-2023-4251","title":"EventPrime < 3.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ffdd43-b353-4296-bcb6-978751aae1b6?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e90045df-deb5-41ab-a285-c6b1573ae0f6","source":"wordfence","cve":"CVE-2024-13400","title":"Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e90045df-deb5-41ab-a285-c6b1573ae0f6?source=api-prod","affected":[{"type":"plugin","slug":"kona-instagram-feed-for-gutenberg","name":"Kona Gallery Block","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-30T00:51:10Z","updated":"2025-01-30T13:42:09Z"},{"id":"wordfence:e9012824-7221-4b93-a5fb-65caf7994e92","source":"wordfence","cve":"CVE-2021-36872","title":"WordPress Popular Posts <= 5.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9012824-7221-4b93-a5fb-65caf7994e92?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popular-posts","name":"WP Popular Posts","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"5.3.4"}],"published":"2021-07-04T20:59:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e901c2a0-2477-4b9a-8483-6002419e0a2f","source":"wordfence","cve":"CVE-2026-10795","title":"UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc","severity":"critical","cvss":9.8,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=api-prod","affected":[{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus: WP Backup & Migration Plugin","from":"*","from_inclusive":true,"to":"1.26.4","to_inclusive":true,"patched_in":"1.26.5"},{"type":"plugin","slug":"updraftplus","name":"UpdraftPlus Premium","from":"2.0","from_inclusive":true,"to":"2.26.5","to_inclusive":false,"patched_in":"2.26.5"}],"published":"2026-06-10T16:41:29Z","updated":"2026-07-14T18:13:44Z"},{"id":"wordfence:e904a619-4388-4c83-af7b-9642cb0b97c0","source":"wordfence","cve":"CVE-2024-1756","title":"WooCommerce Customers Manager <= 29.7 - Missing Authorization to Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e904a619-4388-4c83-af7b-9642cb0b97c0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-customers-manager","name":"WooCommerce Customers Manager","from":"*","from_inclusive":true,"to":"29.7","to_inclusive":true,"patched_in":"29.8"}],"published":"2024-04-02T00:00:00Z","updated":"2024-04-25T12:34:55Z"},{"id":"wordfence:e905d146-66bf-4d6d-b2f5-fd3f862101af","source":"wordfence","cve":"CVE-2026-15610","title":"WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e905d146-66bf-4d6d-b2f5-fd3f862101af?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2026-07-15T19:49:36Z","updated":"2026-07-16T07:51:05Z"},{"id":"wordfence:e9065f61-d899-44a3-a43a-3eeeeedaa6f1","source":"wordfence","cve":"CVE-2026-1087","title":"The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9065f61-d899-44a3-a43a-3eeeeedaa6f1?source=api-prod","affected":[{"type":"plugin","slug":"the-guardian-news-feed","name":"The Guardian News Feed","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-03-07T07:22:09Z"},{"id":"wordfence:e90ddedd-22ee-47ad-ac4c-337d26dbd5e2","source":"wordfence","cve":"CVE-2024-55989","title":"WP Simple Pay Lite Manager <= 1.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e90ddedd-22ee-47ad-ac4c-337d26dbd5e2?source=api-prod","affected":[{"type":"plugin","slug":"stripe-manager","name":"WP Simple Pay Lite Manager","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T14:12:24Z"},{"id":"wordfence:e90f04e4-eb4c-4822-89c6-79f553987c37","source":"wordfence","cve":"CVE-2023-4599","title":"Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e90f04e4-eb4c-4822-89c6-79f553987c37?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e91098c9-4cbf-4d9f-9a6c-41e1469fdedd","source":"wordfence","cve":"CVE-2026-118166","title":"MC4WP: Mailchimp for WordPress <= 4.14.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91098c9-4cbf-4d9f-9a6c-41e1469fdedd?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":"4.15.0"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-10T19:20:22Z"},{"id":"wordfence:e915f1b5-50cd-4c2a-ad01-feab799d071f","source":"wordfence","cve":"CVE-2026-14331","title":"Subscribe2 <= 10.45 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e915f1b5-50cd-4c2a-ad01-feab799d071f?source=api-prod","affected":[{"type":"plugin","slug":"subscribe2","name":"Subscribe2 \u2013 Form, Email Subscribers & Newsletters","from":"*","from_inclusive":true,"to":"10.45","to_inclusive":true,"patched_in":"10.46"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:05:14Z"},{"id":"wordfence:e9160c10-8e10-44b2-b08a-612856869689","source":"wordfence","cve":"CVE-2015-9422","title":"PlugNedit Adaptive Editor < 6.2.0 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9160c10-8e10-44b2-b08a-612856869689?source=api-prod","affected":[{"type":"plugin","slug":"plugnedit","name":"plugnedit","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":false,"patched_in":"6.2.0"}],"published":"2015-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9171908-5b6e-44f3-ab93-899932be527f","source":"wordfence","cve":"CVE-2019-19306","title":"Zoho CRM Lead Magnet <= 1.6.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9171908-5b6e-44f3-ab93-899932be527f?source=api-prod","affected":[{"type":"plugin","slug":"zoho-crm-forms","name":"Zoho CRM Lead Magnet","from":"*","from_inclusive":true,"to":"1.6.9.2","to_inclusive":false,"patched_in":"1.6.9.2"}],"published":"2019-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9178920-d865-45d3-bfdf-b8ad207d4546","source":"wordfence","cve":"","title":"FeedWordPress < 2015.0426 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9178920-d865-45d3-bfdf-b8ad207d4546?source=api-prod","affected":[{"type":"plugin","slug":"feedwordpress","name":"FeedWordPress","from":"*","from_inclusive":true,"to":"2014.0805","to_inclusive":true,"patched_in":"2015.0426"}],"published":"2015-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e91922d7-5207-45e6-8e0f-071da23771e9","source":"wordfence","cve":"CVE-2026-42729","title":"Property Hive <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91922d7-5207-45e6-8e0f-071da23771e9?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2026-05-23T00:00:00Z","updated":"2026-05-26T19:15:16Z"},{"id":"wordfence:e91a92c2-d8df-49e1-8c08-0df7fa7c6829","source":"wordfence","cve":"CVE-2025-1062","title":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider <= 3.94.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91a92c2-d8df-49e1-8c08-0df7fa7c6829?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.94.0","to_inclusive":true,"patched_in":"3.95.0"}],"published":"2025-03-02T00:00:00Z","updated":"2025-04-17T14:38:04Z"},{"id":"wordfence:e91b8082-e1c7-4989-82db-20e255b52854","source":"wordfence","cve":"CVE-2026-6320","title":"Salon Booking System \u2013 Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91b8082-e1c7-4989-82db-20e255b52854?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.25","to_inclusive":true,"patched_in":"10.30.26"}],"published":"2026-05-01T21:28:03Z","updated":"2026-05-02T11:16:11Z"},{"id":"wordfence:e91c0935-4213-4376-86ec-7ff78808fb9e","source":"wordfence","cve":"CVE-2017-12651","title":"Loginizer <= 1.3.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91c0935-4213-4376-86ec-7ff78808fb9e?source=api-prod","affected":[{"type":"plugin","slug":"loginizer","name":"Loginizer","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2017-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e91e6101-bd30-4cf1-9a39-23218c3bff6f","source":"wordfence","cve":"","title":"Newsletter <= 6.5.3 - CSV Injection","severity":"medium","cvss":5.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91e6101-bd30-4cf1-9a39-23218c3bff6f?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"6.5.3","to_inclusive":true,"patched_in":"6.5.4"}],"published":"2020-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e91e864a-20f6-48a2-ab9f-d20836207383","source":"wordfence","cve":"CVE-2023-36516","title":"LearnPress <= 4.2.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91e864a-20f6-48a2-ab9f-d20836207383?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.3.1"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e91f43b9-bbe1-4f32-9e85-84b51bd1a519","source":"wordfence","cve":"CVE-2025-62025","title":"JobSearch < 3.0.8 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e91f43b9-bbe1-4f32-9e85-84b51bd1a519?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":false,"patched_in":"3.0.8"}],"published":"2025-10-03T00:00:00Z","updated":"2025-10-29T16:33:42Z"},{"id":"wordfence:e920caeb-5ee6-4428-9b53-edee316ee39f","source":"wordfence","cve":"CVE-2009-2122","title":"Photoracer Plugin <= 1.0 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e920caeb-5ee6-4428-9b53-edee316ee39f?source=api-prod","affected":[{"type":"plugin","slug":"photoracer","name":"Photoracer Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2009-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9222c74-7f4f-4d20-8c1e-03be125709ff","source":"wordfence","cve":"","title":"VDZ Google Analytics or Google Tag Manager < 1.4.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9222c74-7f4f-4d20-8c1e-03be125709ff?source=api-prod","affected":[{"type":"plugin","slug":"vdz-google-analytics","name":"VDZ Google Analytics or Google Tag Manager / GTM","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":false,"patched_in":"1.4.9"}],"published":"2021-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9224b37-d6ce-4847-afb0-9a42c9fa665c","source":"wordfence","cve":"CVE-2014-4848","title":"Blogstand Banner <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9224b37-d6ce-4847-afb0-9a42c9fa665c?source=api-prod","affected":[{"type":"plugin","slug":"blogstand-smart-banner","name":"Blogstand Banner","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9274957-7584-4df6-bb2a-d745510f5033","source":"wordfence","cve":"CVE-2026-16585","title":"Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9274957-7584-4df6-bb2a-d745510f5033?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"2.15.19","to_inclusive":true,"patched_in":"2.15.20"}],"published":"2026-07-27T16:36:42Z","updated":"2026-07-28T05:39:44Z"},{"id":"wordfence:e928ed4b-5f27-4e0d-af0b-30256b851454","source":"wordfence","cve":"CVE-2024-51760","title":"Dashing Memberships <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e928ed4b-5f27-4e0d-af0b-30256b851454?source=api-prod","affected":[{"type":"plugin","slug":"dashing-memberships","name":"Dashing Memberships","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T18:59:02Z"},{"id":"wordfence:e92a0387-bd09-46d3-9f6c-09f701b9e550","source":"wordfence","cve":"CVE-2023-6854","title":"Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92a0387-bd09-46d3-9f6c-09f701b9e550?source=api-prod","affected":[{"type":"plugin","slug":"breakdance","name":"Breakdance","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2024-05-03T00:00:00Z","updated":"2024-07-29T21:37:43Z"},{"id":"wordfence:e92a8d10-c3cb-4c15-aa53-4d61e3d057c9","source":"wordfence","cve":"CVE-2026-92994","title":"Verge3D <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92a8d10-c3cb-4c15-aa53-4d61e3d057c9?source=api-prod","affected":[{"type":"plugin","slug":"verge3d","name":"Verge3D Publishing and E-Commerce","from":"*","from_inclusive":true,"to":"4.13.0","to_inclusive":true,"patched_in":"4.13.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:48:28Z"},{"id":"wordfence:e92b4189-bd07-4d29-8fe1-e9de60107e70","source":"wordfence","cve":"CVE-2026-97640","title":"WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92b4189-bd07-4d29-8fe1-e9de60107e70?source=api-prod","affected":[{"type":"plugin","slug":"wpconsent-cookies-banner-privacy-suite","name":"WPConsent \u2013 Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2026-10-15T17:43:17Z","updated":"2026-10-16T06:41:07Z"},{"id":"wordfence:e92c6374-d11d-458c-b089-0ee79c33e4a6","source":"wordfence","cve":"CVE-2022-1900","title":"Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92c6374-d11d-458c-b089-0ee79c33e4a6?source=api-prod","affected":[{"type":"plugin","slug":"copify","name":"Copify","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e92cc06d-006f-4bba-a4ef-b23d80c00085","source":"wordfence","cve":"CVE-2026-9282","title":"W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.10.0"}],"published":"2026-07-10T18:09:47Z","updated":"2026-07-11T06:50:33Z"},{"id":"wordfence:e92cc6a3-062c-4f0e-9539-07d0fa0e9404","source":"wordfence","cve":"","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.4.36 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc6a3-062c-4f0e-9539-07d0fa0e9404?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.4.36","to_inclusive":false,"patched_in":"1.4.36"}],"published":"2015-02-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e92ce899-556f-4a17-8902-1919d485ee15","source":"wordfence","cve":"CVE-2022-1659","title":"JupiterX Core <= 2.0.6 - Information Disclosure, Modification, and Denial of Service","severity":"medium","cvss":6.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92ce899-556f-4a17-8902-1919d485ee15?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2022-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e92f35dc-7e19-464a-bb8a-40a662e2270a","source":"wordfence","cve":"","title":"WP eCommerce <= 3.8.14.3 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e92f35dc-7e19-464a-bb8a-40a662e2270a?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.8.14.3","to_inclusive":true,"patched_in":"3.8.14.4"}],"published":"2014-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9303719-3d48-4a55-ac19-0c603801d458","source":"wordfence","cve":"","title":"Dropshipping and affiliates for Amazon and woocommerce <= 1.4.3 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9303719-3d48-4a55-ac19-0c603801d458?source=api-prod","affected":[{"type":"plugin","slug":"wooshark-woocommerce-dropshipping","name":"Dropshipping and affiliates for Amazon and woocommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2022-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e93060cf-2df3-4d45-a1f2-304f443d58bc","source":"wordfence","cve":"CVE-2026-8791","title":"Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93060cf-2df3-4d45-a1f2-304f443d58bc?source=api-prod","affected":[{"type":"plugin","slug":"booking-system-trafft","name":"Booking System Trafft","from":"*","from_inclusive":true,"to":"1.0.17","to_inclusive":true,"patched_in":"1.0.18"}],"published":"2026-07-28T21:30:10Z","updated":"2026-07-29T13:27:16Z"},{"id":"wordfence:e933b71b-5212-4930-94ef-b4bbe8250bad","source":"wordfence","cve":"CVE-2025-22516","title":"Metadata SEO <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e933b71b-5212-4930-94ef-b4bbe8250bad?source=api-prod","affected":[{"type":"plugin","slug":"metadata-seo","name":"Metadata SEO","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:41:39Z"},{"id":"wordfence:e9346103-9773-4cda-9b32-d3ce2076e8fb","source":"wordfence","cve":"CVE-2022-43458","title":"Advanced Floating Content <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9346103-9773-4cda-9b32-d3ce2076e8fb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-floating-content-lite","name":"Advanced Floating Content Lite","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e93632e3-7321-48ee-828a-c539e16f07b2","source":"wordfence","cve":"CVE-2018-16966","title":"File Manager <= 3.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93632e3-7321-48ee-828a-c539e16f07b2?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2018-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9388404-40b9-4d2c-b009-0417ff48e74c","source":"wordfence","cve":"CVE-2021-24765","title":"Perfect Survey <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via IP","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9388404-40b9-4d2c-b009-0417ff48e74c?source=api-prod","affected":[{"type":"plugin","slug":"perfect-survey","name":"Perfect Survey","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e938c126-e24d-4299-891a-438e7ba513e7","source":"wordfence","cve":"CVE-2025-31401","title":"MMX &#8211; Make Me Christmas <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e938c126-e24d-4299-891a-438e7ba513e7?source=api-prod","affected":[{"type":"plugin","slug":"mmx-make-me-christmas","name":"MMX \u2013 Make Me Christmas","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:43:10Z"},{"id":"wordfence:e93acf29-8ff0-4412-9ff0-161f154b4311","source":"wordfence","cve":"CVE-2026-121518","title":"Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93acf29-8ff0-4412-9ff0-161f154b4311?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.127.0","to_inclusive":true,"patched_in":"5.128.0"}],"published":"2026-11-12T21:10:05Z","updated":"2026-11-13T09:35:16Z"},{"id":"wordfence:e93ad115-1a0b-4d33-b89f-13e39508c9b0","source":"wordfence","cve":"","title":"Careerfy <= 7.0 - Cross-Site Request Forgery and Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93ad115-1a0b-4d33-b89f-13e39508c9b0?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2021-09-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e93b0ebf-576d-48d0-95f7-87135f45980f","source":"wordfence","cve":"CVE-2026-119166","title":"Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93b0ebf-576d-48d0-95f7-87135f45980f?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.6"}],"published":"2026-10-30T17:51:17Z","updated":"2026-10-31T06:44:23Z"},{"id":"wordfence:e93c8b3a-d8d8-4d2b-9df0-ea27e33947e0","source":"wordfence","cve":"CVE-2026-18468","title":"Login & Register Forms <= 4.0.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93c8b3a-d8d8-4d2b-9df0-ea27e33947e0?source=api-prod","affected":[{"type":"plugin","slug":"easy-login-woocommerce","name":"Login & Register Customizer \u2013 Forms, Popup, Profile & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-08-05T00:00:00Z","updated":"2026-09-17T15:35:32Z"},{"id":"wordfence:e93ccf9d-cd8b-4399-8d2d-c844a23d66c8","source":"wordfence","cve":"CVE-2022-0478","title":"Event Manager and Tickets Selling for WooCommerce < 3.5.8 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93ccf9d-cd8b-4399-8d2d-c844a23d66c8?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":false,"patched_in":"3.5.8"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e93de7ae-c3a8-4536-9c07-e64d7746e05f","source":"wordfence","cve":"CVE-2026-15393","title":"Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e93de7ae-c3a8-4536-9c07-e64d7746e05f?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2026-07-28T00:05:02Z","updated":"2026-07-28T12:36:32Z"},{"id":"wordfence:e9404fe4-855e-4eb4-81c4-5246f6e9be0c","source":"wordfence","cve":"CVE-2024-12544","title":"SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion via SurveyJS_DeleteFile","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9404fe4-855e-4eb4-81c4-5246f6e9be0c?source=api-prod","affected":[{"type":"plugin","slug":"surveyjs","name":"SurveyJS: Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.12.17","to_inclusive":true,"patched_in":"1.12.18"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-01T07:24:06Z"},{"id":"wordfence:e947abb8-be40-4090-80a6-5255692ef693","source":"wordfence","cve":"CVE-2012-10007","title":"BuddyStream <= 3.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e947abb8-be40-4090-80a6-5255692ef693?source=api-prod","affected":[{"type":"plugin","slug":"buddystream","name":"BuddyStream","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2012-12-04T00:00:00Z","updated":"2024-02-07T15:01:13Z"},{"id":"wordfence:e9481bd2-a8fa-43b3-bfd2-a9a51f528ebf","source":"wordfence","cve":"CVE-2023-22692","title":"Name Directory <= 1.27.1 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9481bd2-a8fa-43b3-bfd2-a9a51f528ebf?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.27.1","to_inclusive":true,"patched_in":"1.27.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9489254-dbdc-4754-86d0-d28756b269a9","source":"wordfence","cve":"CVE-2022-3578","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities <= 5.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9489254-dbdc-4754-86d0-d28756b269a9?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2022-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e94db231-e5d4-4b49-ad36-74c0284abfd2","source":"wordfence","cve":"CVE-2026-75098","title":"Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94db231-e5d4-4b49-ad36-74c0284abfd2?source=api-prod","affected":[{"type":"plugin","slug":"product-designer-app","name":"Product Designer App","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T20:23:37Z","updated":"2026-09-30T08:28:04Z"},{"id":"wordfence:e94e39d3-61da-4adb-a89a-97cda4c9203d","source":"wordfence","cve":"","title":"SyntaxHighlighter Evolved < 3.5.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94e39d3-61da-4adb-a89a-97cda4c9203d?source=api-prod","affected":[{"type":"plugin","slug":"syntaxhighlighter","name":"SyntaxHighlighter Evolved","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":false,"patched_in":"3.5.1"}],"published":"2019-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e94e7ec7-9d2e-430d-afc5-9e6b9c15b56c","source":"wordfence","cve":"CVE-2026-96828","title":"Simple Discount Rules for Woocommerce <= 5.18 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94e7ec7-9d2e-430d-afc5-9e6b9c15b56c?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-category-discount","name":"Simple Discount Rules for Woocommerce","from":"*","from_inclusive":true,"to":"5.18","to_inclusive":true,"patched_in":"5.19"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T16:42:22Z"},{"id":"wordfence:e94ebe1a-810a-4226-9cca-8897c3c800ce","source":"wordfence","cve":"CVE-2026-14553","title":"Zportals <= 6.3.3 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94ebe1a-810a-4226-9cca-8897c3c800ce?source=api-prod","affected":[{"type":"plugin","slug":"zportals","name":"Zportals","from":"*","from_inclusive":true,"to":"6.3.3","to_inclusive":true,"patched_in":"6.3.4"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-21T14:06:52Z"},{"id":"wordfence:e94f9cde-5e8b-4d68-8ede-12d678a370ed","source":"wordfence","cve":"CVE-2022-4794","title":"Amazon Affiliate <= 3.12.2 - Reflected File Download","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e94f9cde-5e8b-4d68-8ede-12d678a370ed?source=api-prod","affected":[{"type":"plugin","slug":"aawp","name":"Amazon Affiliate","from":"*","from_inclusive":true,"to":"3.12.2","to_inclusive":true,"patched_in":"3.12.3"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9506f84-3d33-48e0-8dce-d517e1a923e4","source":"wordfence","cve":"CVE-2026-14488","title":"Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9506f84-3d33-48e0-8dce-d517e1a923e4?source=api-prod","affected":[{"type":"plugin","slug":"meta-box-aio","name":"Meta Box AIO","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.9.0"}],"published":"2026-07-28T20:51:21Z","updated":"2026-07-29T09:31:16Z"},{"id":"wordfence:e95b2bfe-8675-4932-9b37-73ad15fa228e","source":"wordfence","cve":"","title":"Pods \u2013 Custom Content Types and Fields < 2.5.1.2 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e95b2bfe-8675-4932-9b37-73ad15fa228e?source=api-prod","affected":[{"type":"plugin","slug":"pods","name":"Pods \u2013 Custom Content Types and Fields","from":"*","from_inclusive":true,"to":"2.5.1.2","to_inclusive":false,"patched_in":"2.5.1.2"}],"published":"2015-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e95cedaf-ebdc-450c-9962-28923507d1d5","source":"wordfence","cve":"CVE-2026-22505","title":"Morning Records - Music Sound Studio WordPress Theme <= 1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e95cedaf-ebdc-450c-9962-28923507d1d5?source=api-prod","affected":[{"type":"theme","slug":"morning-records","name":"Morning Records - Music Sound Studio WordPress Theme","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:39:13Z"},{"id":"wordfence:e95ecb22-7946-4830-95a4-f145f0f99d68","source":"wordfence","cve":"CVE-2017-18543","title":"Invite Anyone < 1.3.16 - Email Injection","severity":"high","cvss":7.5,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e95ecb22-7946-4830-95a4-f145f0f99d68?source=api-prod","affected":[{"type":"plugin","slug":"invite-anyone","name":"Invite Anyone","from":"*","from_inclusive":true,"to":"1.3.16","to_inclusive":false,"patched_in":"1.3.16"}],"published":"2017-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9612b5c-ed04-41f6-9936-c850b0ef04d0","source":"wordfence","cve":"CVE-2025-68544","title":"Diza <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9612b5c-ed04-41f6-9936-c850b0ef04d0?source=api-prod","affected":[{"type":"theme","slug":"diza","name":"Diza - Pharmacy Store Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.15","to_inclusive":true,"patched_in":"1.3.16"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T18:49:46Z"},{"id":"wordfence:e961d3db-da5e-4bde-ae7e-04e6ba3ebef4","source":"wordfence","cve":"CVE-2026-103898","title":"Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4?source=api-prod","affected":[{"type":"plugin","slug":"wp-social","name":"Wp Social Login and Register Social Counter","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-10-30T19:24:45Z","updated":"2026-10-31T07:46:53Z"},{"id":"wordfence:e961f5b3-0efc-40c7-87a8-48290357dd2e","source":"wordfence","cve":"CVE-2026-103478","title":"Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e961f5b3-0efc-40c7-87a8-48290357dd2e?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.2.6","to_inclusive":true,"patched_in":"7.2.7"}],"published":"2026-10-09T19:08:31Z","updated":"2026-10-10T07:41:49Z"},{"id":"wordfence:e96376d3-4d17-4611-bdbf-1bb9c68c0ba4","source":"wordfence","cve":"CVE-2025-1280","title":"BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.17.1","to_inclusive":false,"patched_in":"3.17.1"}],"published":"2026-09-21T19:34:40Z","updated":"2026-09-22T07:41:14Z"},{"id":"wordfence:e96588f8-5b74-43bd-801d-5f20a938337c","source":"wordfence","cve":"CVE-2025-22563","title":"Pretty Url <= 1.5.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96588f8-5b74-43bd-801d-5f20a938337c?source=api-prod","affected":[{"type":"plugin","slug":"pretty-url","name":"Pretty Url","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:23:38Z"},{"id":"wordfence:e966a266-4265-4a72-8a50-e872805219a7","source":"wordfence","cve":"CVE-2024-1995","title":"Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e966a266-4265-4a72-8a50-e872805219a7?source=api-prod","affected":[{"type":"plugin","slug":"smart-custom-fields","name":"Smart Custom Fields","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T01:58:05Z"},{"id":"wordfence:e9688229-90e8-4530-9039-5ba8c8bcf93e","source":"wordfence","cve":"CVE-2025-47458","title":"B2i Investor Tools <= 1.0.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9688229-90e8-4530-9039-5ba8c8bcf93e?source=api-prod","affected":[{"type":"plugin","slug":"b2i-investor-tools","name":"B2i Investor Tools","from":"*","from_inclusive":true,"to":"1.0.7.9","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-20T16:39:03Z"},{"id":"wordfence:e969b96c-2146-4dec-a86e-a4117d635de5","source":"wordfence","cve":"CVE-2026-96449","title":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square <= 4.5.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e969b96c-2146-4dec-a86e-a4117d635de5?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-10-15T18:06:00Z","updated":"2026-10-23T18:47:57Z"},{"id":"wordfence:e96b3d21-edeb-4dec-b13c-3688d3996cb5","source":"wordfence","cve":"CVE-2022-1914","title":"Clean-Contact <= 1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96b3d21-edeb-4dec-b13c-3688d3996cb5?source=api-prod","affected":[{"type":"plugin","slug":"clean-contact","name":"Clean-Contact","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e96cfa07-2640-4d5e-8057-28e42f0425b0","source":"wordfence","cve":"CVE-2026-22354","title":"Woocommerce Category Banner Management <= 2.5.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96cfa07-2640-4d5e-8057-28e42f0425b0?source=api-prod","affected":[{"type":"plugin","slug":"banner-management-for-woocommerce","name":"Banner Management For WooCommerce","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-16T00:00:00Z","updated":"2026-02-25T15:39:24Z"},{"id":"wordfence:e96d118a-e38c-4043-9550-5f5ab0d83dc7","source":"wordfence","cve":"CVE-2025-4595","title":"FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96d118a-e38c-4043-9550-5f5ab0d83dc7?source=api-prod","affected":[{"type":"plugin","slug":"fastspring","name":"FastSpring","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T18:08:16Z","updated":"2025-05-31T06:40:58Z"},{"id":"wordfence:e96e94f8-f61c-4458-9ede-53bab30502b6","source":"wordfence","cve":"CVE-2024-29124","title":"Advanced Access Manager <= 6.9.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96e94f8-f61c-4458-9ede-53bab30502b6?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.9.20","to_inclusive":true,"patched_in":"6.9.21"}],"published":"2024-03-16T00:00:00Z","updated":"2024-03-20T18:48:08Z"},{"id":"wordfence:e96f31e0-4b2e-4ea1-a3e5-fd7452a2fea9","source":"wordfence","cve":"CVE-2026-4758","title":"WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e96f31e0-4b2e-4ea1-a3e5-fd7452a2fea9?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2026-03-25T10:39:46Z","updated":"2026-03-25T23:26:02Z"},{"id":"wordfence:e970da7d-1bdb-4209-af1e-b72fb2ca8d30","source":"wordfence","cve":"CVE-2025-28961","title":"URL Shortener <= 3.0.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e970da7d-1bdb-4209-af1e-b72fb2ca8d30?source=api-prod","affected":[{"type":"plugin","slug":"exact-links","name":"URL Shortener Plugin For WordPress","from":"*","from_inclusive":true,"to":"3.0.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-16T18:02:04Z"},{"id":"wordfence:e97479b1-06a0-4e24-9d2b-005bdfec9eaf","source":"wordfence","cve":"CVE-2023-36505","title":"Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97479b1-06a0-4e24-9d2b-005bdfec9eaf?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.24","to_inclusive":true,"patched_in":"3.6.25"}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e976020b-d69a-4a82-a6ec-8c847b0fa7e4","source":"wordfence","cve":"CVE-2026-105873","title":"Element Pack Addons for Elementor \u2013 Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e976020b-d69a-4a82-a6ec-8c847b0fa7e4?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"8.8.6","to_inclusive":true,"patched_in":"8.8.7"}],"published":"2026-10-07T09:11:00Z","updated":"2026-10-08T23:32:00Z"},{"id":"wordfence:e97854ca-b24f-4893-862d-f8e975752175","source":"wordfence","cve":"CVE-2026-2707","title":"weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.27","to_inclusive":true,"patched_in":"1.6.28"}],"published":"2026-03-10T17:12:51Z","updated":"2026-03-11T05:27:20Z"},{"id":"wordfence:e97bc3a8-ce82-47c2-9ff1-174b2656a296","source":"wordfence","cve":"CVE-2024-32516","title":"Multi Currency For WooCommerce <= 1.5.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97bc3a8-ce82-47c2-9ff1-174b2656a296?source=api-prod","affected":[{"type":"plugin","slug":"wc-multi-currency","name":"Multi Currency For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T14:59:26Z"},{"id":"wordfence:e97c652c-f191-493d-9857-acaa4db8a49a","source":"wordfence","cve":"CVE-2021-24220","title":"Multiple Thrive Themes < 2.0.0 -  Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97c652c-f191-493d-9857-acaa4db8a49a?source=api-prod","affected":[{"type":"theme","slug":"ignition","name":"Ignition","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"storied","name":"Storied","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"luxe","name":"Luxe","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"voice","name":"Voice","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"squared","name":"Squared","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"performag","name":"Performag","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"minus","name":"Minus","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"pressive","name":"Pressive","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"rise","name":"Rise","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"},{"type":"theme","slug":"focusblog","name":"FocusBlog","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2021-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e97cd02e-3e2d-4b3f-b87a-780a0deada8a","source":"wordfence","cve":"CVE-2024-7984","title":"Joy Of Text Lite <= 2.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97cd02e-3e2d-4b3f-b87a-780a0deada8a?source=api-prod","affected":[{"type":"plugin","slug":"joy-of-text","name":"Joy Of Text Lite \u2013 SMS messaging for WordPress.","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-09-13T00:00:00Z","updated":"2025-05-30T18:28:10Z"},{"id":"wordfence:e97d1928-3aaf-4dfe-8b17-e85bed5c937f","source":"wordfence","cve":"CVE-2025-69161","title":"Snowy <= 1.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97d1928-3aaf-4dfe-8b17-e85bed5c937f?source=api-prod","affected":[{"type":"theme","slug":"snowy","name":"snowy","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-01T16:11:48Z"},{"id":"wordfence:e97ed28c-b4a2-47ee-8fbe-7c995fa102cb","source":"wordfence","cve":"CVE-2026-2722","title":"Stock Ticker <= 3.26.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Template","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e97ed28c-b4a2-47ee-8fbe-7c995fa102cb?source=api-prod","affected":[{"type":"plugin","slug":"stock-ticker","name":"Stock Ticker","from":"*","from_inclusive":true,"to":"3.26.1","to_inclusive":true,"patched_in":"3.26.2"}],"published":"2026-03-06T11:30:56Z","updated":"2026-03-07T01:21:24Z"},{"id":"wordfence:e982ae88-cfd0-46b9-ad64-00e398d307d6","source":"wordfence","cve":"CVE-2025-3455","title":"1 Click WordPress Migration Plugin \u2013 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e982ae88-cfd0-46b9-ad64-00e398d307d6?source=api-prod","affected":[{"type":"plugin","slug":"1-click-migration","name":"1-Click WordPress Migration Plugin \u2013 Backup, Migrate & Clone","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2025-05-08T18:08:20Z","updated":"2025-11-06T15:31:14Z"},{"id":"wordfence:e982d457-29db-468f-88c3-5afe04002dcf","source":"wordfence","cve":"CVE-2024-0679","title":"ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e982d457-29db-468f-88c3-5afe04002dcf?source=api-prod","affected":[{"type":"theme","slug":"colormag","name":"ColorMag","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-01-19T00:00:00Z","updated":"2024-07-29T21:37:43Z"},{"id":"wordfence:e98594d4-5385-4ac1-80c6-005c25098549","source":"wordfence","cve":"CVE-2025-68555","title":"Nutrie < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98594d4-5385-4ac1-80c6-005c25098549?source=api-prod","affected":[{"type":"theme","slug":"nutrie","name":"Nutrie - Health Coach and Nutrition WordPress Theme","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:26:33Z"},{"id":"wordfence:e986ef0c-811c-4a62-9e12-145e12ecd029","source":"wordfence","cve":"CVE-2026-105893","title":"Event Tickets and Registration <= 5.30.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e986ef0c-811c-4a62-9e12-145e12ecd029?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets","name":"Event Tickets and Registration","from":"*","from_inclusive":true,"to":"5.30.0.1","to_inclusive":true,"patched_in":"5.30.0.2"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:29:03Z"},{"id":"wordfence:e9885db9-b1eb-4cc6-a7ea-af2c34b1d065","source":"wordfence","cve":"CVE-2013-5988","title":"All in One SEO <= 2.0.3 - Cross-Site Scripting via Search Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9885db9-b1eb-4cc6-a7ea-af2c34b1d065?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.3.1"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e988d042-147c-4782-b728-71f5a50cecd8","source":"wordfence","cve":"CVE-2023-32243","title":"Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e988d042-147c-4782-b728-71f5a50cecd8?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e989dbb9-41eb-4c56-8d6b-7c0518500f2d","source":"wordfence","cve":"CVE-2024-32148","title":"Pardot <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e989dbb9-41eb-4c56-8d6b-7c0518500f2d?source=api-prod","affected":[{"type":"plugin","slug":"pardot","name":"Account Engagement","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:46:24Z"},{"id":"wordfence:e98a42c4-b5fa-42fa-a444-7af779644d8d","source":"wordfence","cve":"CVE-2026-103302","title":"Payment Gateway for Idram < 2.1.6 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98a42c4-b5fa-42fa-a444-7af779644d8d?source=api-prod","affected":[{"type":"plugin","slug":"hk-idram-payment-gateway","name":"Payment Gateway for Idram","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":false,"patched_in":"2.1.6"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T15:27:32Z"},{"id":"wordfence:e98aa389-9113-4997-8b96-1ca03cdfc235","source":"wordfence","cve":"CVE-2023-28930","title":"Mobile Banner <= 1.5 - Cross-Site Request Forgery leading to Plugin Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98aa389-9113-4997-8b96-1ca03cdfc235?source=api-prod","affected":[{"type":"plugin","slug":"mobile-banner","name":"Mobile Banner","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2023-03-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e98ab8ba-d165-4813-abdb-c7d47a93d30f","source":"wordfence","cve":"CVE-2025-52770","title":"Hello Followers <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98ab8ba-d165-4813-abdb-c7d47a93d30f?source=api-prod","affected":[{"type":"plugin","slug":"hellofollowers","name":"Hello Followers - Social Counter Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-30T00:00:00Z","updated":"2025-11-04T18:23:50Z"},{"id":"wordfence:e98b0a3a-6c14-45f1-a6b2-9911ba34ce0d","source":"wordfence","cve":"CVE-2024-31095","title":"Thumbs Rating <= 5.1.0 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98b0a3a-6c14-45f1-a6b2-9911ba34ce0d?source=api-prod","affected":[{"type":"plugin","slug":"thumbs-rating","name":"Thumbs Rating","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-04T00:29:39Z"},{"id":"wordfence:e98b1bc7-8dcb-4fcf-9238-598ce53e443e","source":"wordfence","cve":"CVE-2016-10964","title":"dwnldr < 1.01 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98b1bc7-8dcb-4fcf-9238-598ce53e443e?source=api-prod","affected":[{"type":"plugin","slug":"dwnldr","name":"dwnldr","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.01"}],"published":"2016-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e98d4f04-74cd-486f-bb2f-fad76895f386","source":"wordfence","cve":"CVE-2026-5626","title":"Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98d4f04-74cd-486f-bb2f-fad76895f386?source=api-prod","affected":[{"type":"plugin","slug":"survey-form-block","name":"Survey Form Block","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-07-28T13:51:37Z","updated":"2026-07-29T02:31:39Z"},{"id":"wordfence:e98ed932-4e4c-4127-ae72-500e2a34f371","source":"wordfence","cve":"CVE-2023-2170","title":"TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e98ed932-4e4c-4127-ae72-500e2a34f371?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.6.4","to_inclusive":true,"patched_in":"3.6.5"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e99045c9-9417-4b84-92bf-a4aded6dc8bb","source":"wordfence","cve":"CVE-2026-92422","title":"Meow Gallery <= 5.5.4 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99045c9-9417-4b84-92bf-a4aded6dc8bb?source=api-prod","affected":[{"type":"plugin","slug":"meow-gallery","name":"Meow Gallery","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T20:27:57Z"},{"id":"wordfence:e9914ecb-0214-4991-96ae-425da7104ede","source":"wordfence","cve":"CVE-2025-46240","title":"Simple Download Counter <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9914ecb-0214-4991-96ae-425da7104ede?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-counter","name":"Simple Download Counter","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:18:10Z"},{"id":"wordfence:e991fbdf-8e26-4d2e-8e3b-c8990914dcad","source":"wordfence","cve":"CVE-2026-1238","title":"SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e991fbdf-8e26-4d2e-8e3b-c8990914dcad?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.4.0"}],"published":"2026-03-18T00:00:00Z","updated":"2026-03-19T04:27:30Z"},{"id":"wordfence:e993667f-8275-4078-afd5-b26ff8528ab4","source":"wordfence","cve":"CVE-2024-53741","title":"Simple Popup <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e993667f-8275-4078-afd5-b26ff8528ab4?source=api-prod","affected":[{"type":"plugin","slug":"simple-popup-plugin","name":"Simple Popup Plugin","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:45:02Z"},{"id":"wordfence:e993c929-f175-43a7-92e6-9d3b089b8dde","source":"wordfence","cve":"CVE-2026-85097","title":"Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=api-prod","affected":[{"type":"plugin","slug":"bricksforge","name":"Bricksforge","from":"*","from_inclusive":true,"to":"3.1.8.9","to_inclusive":true,"patched_in":"3.1.8.10"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-08T06:42:10Z"},{"id":"wordfence:e993e724-c27d-4724-b2b1-fcbae9e761b7","source":"wordfence","cve":"CVE-2026-81431","title":"Registration Form for WooCommerce 1.1.0 - 1.1.2 - Authenticated (Contributor+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e993e724-c27d-4724-b2b1-fcbae9e761b7?source=api-prod","affected":[{"type":"plugin","slug":"registration-form-for-woocommerce","name":"Registration Form for WooCommerce","from":"1.1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:05:17Z"},{"id":"wordfence:e9944443-2e71-45c4-8a19-d76863cf66df","source":"wordfence","cve":"CVE-2023-4775","title":"Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9944443-2e71-45c4-8a19-d76863cf66df?source=api-prod","affected":[{"type":"plugin","slug":"advanced-iframe","name":"Advanced iFrame","from":"*","from_inclusive":true,"to":"2023.8","to_inclusive":true,"patched_in":"2023.9"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9946828-7241-445f-b1be-b05864b80ec2","source":"wordfence","cve":"CVE-2025-30566","title":"Clink <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9946828-7241-445f-b1be-b05864b80ec2?source=api-prod","affected":[{"type":"plugin","slug":"clink","name":"Clink \u2013 WordPress Link Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:55:18Z"},{"id":"wordfence:e9960282-4730-4ee8-b338-adcc57f01cc6","source":"wordfence","cve":"CVE-2023-30496","title":"Bus Ticket Booking with Seat Reservation <= 5.2.5 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9960282-4730-4ee8-b338-adcc57f01cc6?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.2.5","to_inclusive":true,"patched_in":"5.2.6"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e996f71a-f0b9-4e10-873e-a0299a099dce","source":"wordfence","cve":"CVE-2024-12322","title":"ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e996f71a-f0b9-4e10-873e-a0299a099dce?source=api-prod","affected":[{"type":"plugin","slug":"theperfectweddingnl-widget","name":"ThePerfectWedding.nl Widget","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":"2.9"}],"published":"2025-01-06T15:38:18Z","updated":"2025-03-13T20:21:17Z"},{"id":"wordfence:e997974c-733c-4c98-9de5-876681194bdd","source":"wordfence","cve":"CVE-2025-22745","title":"Navigation Du Lapin Blanc <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e997974c-733c-4c98-9de5-876681194bdd?source=api-prod","affected":[{"type":"plugin","slug":"navigation-du-lapin-blanc","name":"Navigation Du Lapin Blanc","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T20:06:05Z"},{"id":"wordfence:e999f4c0-03dd-4ea3-9245-b12ffd8da3e2","source":"wordfence","cve":"CVE-2022-23180","title":"Contact Form & Lead Form Elementor Builder < 1.7.4 - Arbitrary Settings Change","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e999f4c0-03dd-4ea3-9245-b12ffd8da3e2?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":false,"patched_in":"1.7.4"}],"published":"2022-02-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e99a7d46-a3be-4408-9000-fb43fe397dd9","source":"wordfence","cve":"","title":"InJob | Multi features for recruitment WordPress Theme < 3.3.8 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99a7d46-a3be-4408-9000-fb43fe397dd9?source=api-prod","affected":[{"type":"theme","slug":"injob","name":"InJob | Multi features for recruitment WordPress Theme","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":false,"patched_in":"3.3.8"}],"published":"2019-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e99bd4ea-e758-42ac-bc14-237dbb642991","source":"wordfence","cve":"CVE-2025-39498","title":"Spotlight - Social Media Feeds (Premium) <= 1.7.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99bd4ea-e758-42ac-bc14-237dbb642991?source=api-prod","affected":[{"type":"plugin","slug":"spotlight-social-photo-feeds-premium","name":"Spotlight Social Feeds \u2013 Block, Shortcode, and Widget (Premium)","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-27T19:09:42Z"},{"id":"wordfence:e99d4ec2-692a-43aa-8273-ec64d27a8baa","source":"wordfence","cve":"CVE-2026-22464","title":"My auctions allegro <= 3.6.33 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99d4ec2-692a-43aa-8273-ec64d27a8baa?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.33","to_inclusive":true,"patched_in":"3.6.34"}],"published":"2026-01-04T00:00:00Z","updated":"2026-02-06T22:04:13Z"},{"id":"wordfence:e99d5841-9fd0-451f-b6fe-bac0851f4aaf","source":"wordfence","cve":"CVE-2025-22760","title":"CodeBard Help Desk <= 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99d5841-9fd0-451f-b6fe-bac0851f4aaf?source=api-prod","affected":[{"type":"plugin","slug":"codebard-help-desk","name":"CodeBard Help Desk","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-01-22T15:10:54Z"},{"id":"wordfence:e99ed03f-ed0a-4f17-b9fe-db0a0e573ed2","source":"wordfence","cve":"CVE-2025-7835","title":"iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e99ed03f-ed0a-4f17-b9fe-db0a0e573ed2?source=api-prod","affected":[{"type":"plugin","slug":"ithoughts-advanced-code-editor","name":"iThoughts Advanced Code Editor","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:45:31Z","updated":"2025-07-24T09:22:22Z"},{"id":"wordfence:e9a0ca58-ddc1-43ec-bb08-7fd31f92e275","source":"wordfence","cve":"CVE-2024-34381","title":"PropertyHive <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a0ca58-ddc1-43ec-bb08-7fd31f92e275?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:01:20Z"},{"id":"wordfence:e9a1de53-330f-49ab-a8f8-22753c62bd36","source":"wordfence","cve":"CVE-2024-11724","title":"Cookie Consent for WP \u2013 Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a1de53-330f-49ab-a8f8-22753c62bd36?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:35Z"},{"id":"wordfence:e9a28625-19e4-4696-bb51-7115368120d3","source":"wordfence","cve":"CVE-2023-34177","title":"WP-Cache.com <= 1.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a28625-19e4-4696-bb51-7115368120d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-cachecom","name":"WP-Cache.com","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9a345b7-b58e-49e1-b7d8-ff76c80e5f4d","source":"wordfence","cve":"CVE-2026-39759","title":"Workreap Core <= 3.4.5 - Authenticated (Employer / Sales Representative+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a345b7-b58e-49e1-b7d8-ff76c80e5f4d?source=api-prod","affected":[{"type":"plugin","slug":"workreap_core","name":"Workreap Core","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:12:03Z"},{"id":"wordfence:e9a6521d-39b2-48f4-834b-888047619df5","source":"wordfence","cve":"CVE-2026-9180","title":"MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a6521d-39b2-48f4-834b-888047619df5?source=api-prod","affected":[{"type":"plugin","slug":"motopress-appointment-lite","name":"MotoPress Appointment Booking","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-03T04:30:19Z"},{"id":"wordfence:e9a65dc9-4c9a-4f19-bd1f-2ca8a6ded18c","source":"wordfence","cve":"CVE-2023-24386","title":"AI Contact Us Form <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a65dc9-4c9a-4f19-bd1f-2ca8a6ded18c?source=api-prod","affected":[{"type":"plugin","slug":"ai-contact-us","name":"AI Contact Us Form","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9a89613-cfd9-4a96-b8eb-4b17376be433","source":"wordfence","cve":"CVE-2024-4632","title":"WooCommerce Checkout & Funnel Builder by CartFlows \u2013 Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a89613-cfd9-4a96-b8eb-4b17376be433?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-06-18T00:00:00Z","updated":"2024-06-19T08:33:57Z"},{"id":"wordfence:e9a94b81-6430-4f04-ac16-4bf79318b5de","source":"wordfence","cve":"CVE-2022-3208","title":"Simple File List <= 4.4.12 - Cross-Site Request Forgery to Page Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a94b81-6430-4f04-ac16-4bf79318b5de?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"4.4.12","to_inclusive":true,"patched_in":"4.4.13"}],"published":"2022-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9a9ea00-67d7-47ce-9438-22d39c2f4371","source":"wordfence","cve":"CVE-2026-115599","title":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a9ea00-67d7-47ce-9438-22d39c2f4371?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.11","to_inclusive":true,"patched_in":"4.4.12"}],"published":"2026-10-27T10:23:39Z","updated":"2026-11-03T19:27:03Z"},{"id":"wordfence:e9ab836b-2798-43bd-b43b-8b7c7e81d42f","source":"wordfence","cve":"CVE-2026-15161","title":"Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ab836b-2798-43bd-b43b-8b7c7e81d42f?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-excel-export","name":"Ninja Forms - Excel Export","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2026-07-16T14:42:09Z","updated":"2026-07-17T03:43:43Z"},{"id":"wordfence:e9ad2dff-0c6d-4d91-a35d-803b97def01f","source":"wordfence","cve":"CVE-2024-2751","title":"Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox","severity":"medium","cvss":6.4,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ad2dff-0c6d-4d91-a35d-803b97def01f?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.2","to_inclusive":true,"patched_in":"2.6.9.3"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-02T16:52:49Z"},{"id":"wordfence:e9ad533d-4ec0-42a0-99fc-75fc59498c94","source":"wordfence","cve":"CVE-2023-3041","title":"Autochat Automatic Conversation <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ad533d-4ec0-42a0-99fc-75fc59498c94?source=api-prod","affected":[{"type":"plugin","slug":"auyautochat-for-wp","name":"Autochat Automatic Conversation","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2023-06-26T00:00:00Z","updated":"2024-09-12T18:29:22Z"},{"id":"wordfence:e9ae8fa3-206c-496d-9902-c6468964b717","source":"wordfence","cve":"CVE-2021-24623","title":"WordPress Advanced Ticket System, Elite Support Helpdesk <= 1.0.63 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ae8fa3-206c-496d-9902-c6468964b717?source=api-prod","affected":[{"type":"plugin","slug":"wats","name":"WP Advanced Ticket System, Elite Support Helpdesk","from":"*","from_inclusive":true,"to":"1.0.64","to_inclusive":false,"patched_in":"1.0.64"}],"published":"2021-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9b28209-498f-4319-be87-3f54c64d9ccd","source":"wordfence","cve":"","title":"CM Pop-Up banners <= 1.4.10 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b28209-498f-4319-be87-3f54c64d9ccd?source=api-prod","affected":[{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2020-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9b3f1ff-4f8b-45ec-90eb-1a75353654e3","source":"wordfence","cve":"CVE-2025-15433","title":"Shared Files \u2013 Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b3f1ff-4f8b-45ec-90eb-1a75353654e3?source=api-prod","affected":[{"type":"plugin","slug":"shared-files","name":"Shared Files \u2013 File Upload & Download Manager","from":"*","from_inclusive":true,"to":"1.7.58","to_inclusive":false,"patched_in":"1.7.58"}],"published":"2026-03-30T00:00:00Z","updated":"2026-04-09T16:26:23Z"},{"id":"wordfence:e9b58db6-4059-4923-b1e3-3321cc7d3573","source":"wordfence","cve":"","title":"Avada <= 7.4.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b58db6-4059-4923-b1e3-3321cc7d3573?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.4.1","to_inclusive":true,"patched_in":"7.4.2"}],"published":"2021-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9b6fe22-330a-4c24-9fdf-16f35516fb2a","source":"wordfence","cve":"CVE-2026-12741","title":"WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b6fe22-330a-4c24-9fdf-16f35516fb2a?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.80.280","to_inclusive":true,"patched_in":"1.81.282"}],"published":"2026-07-27T19:42:32Z","updated":"2026-09-08T18:57:43Z"},{"id":"wordfence:e9b77a9a-3d18-4b04-be69-df83e9836e62","source":"wordfence","cve":"CVE-2026-84767","title":"Bookit \u2014 Booking & Appointment Calendar <= 2.6.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b77a9a-3d18-4b04-be69-df83e9836e62?source=api-prod","affected":[{"type":"plugin","slug":"bookit","name":"Bookit \u2014 Booking & Appointment Calendar","from":"*","from_inclusive":true,"to":"2.6.0.3","to_inclusive":true,"patched_in":"2.6.0.4"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T14:08:58Z"},{"id":"wordfence:e9b918e1-9bf7-4f90-9e77-829bc8012cbb","source":"wordfence","cve":"CVE-2026-2431","title":"CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b918e1-9bf7-4f90-9e77-829bc8012cbb?source=api-prod","affected":[{"type":"plugin","slug":"cm-custom-reports","name":"CM Custom Reports \u2013 Flexible reporting to track what matters most","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-03-06T11:33:43Z","updated":"2026-03-07T01:21:24Z"},{"id":"wordfence:e9bbfa58-1f39-4d38-bdbd-9dae754bfb7a","source":"wordfence","cve":"CVE-2025-53275","title":"Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9bbfa58-1f39-4d38-bdbd-9dae754bfb7a?source=api-prod","affected":[{"type":"plugin","slug":"leyka","name":"Leyka","from":"*","from_inclusive":true,"to":"3.31.9","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:36:49Z"},{"id":"wordfence:e9bf506f-17b1-4ec3-87ce-1ed78db6fb0b","source":"wordfence","cve":"CVE-2024-11379","title":"Broadcast <= 51.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9bf506f-17b1-4ec3-87ce-1ed78db6fb0b?source=api-prod","affected":[{"type":"plugin","slug":"threewp-broadcast","name":"Broadcast","from":"*","from_inclusive":true,"to":"51.01","to_inclusive":true,"patched_in":"51.02"}],"published":"2024-12-05T16:00:54Z","updated":"2024-12-06T04:24:05Z"},{"id":"wordfence:e9c04973-cfb2-4b67-88e4-d527bb74df12","source":"wordfence","cve":"CVE-2025-26969","title":"Private Content  <= 8.11.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c04973-cfb2-4b67-88e4-d527bb74df12?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"Private Content","from":"*","from_inclusive":true,"to":"8.11.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:28:09Z"},{"id":"wordfence:e9c19aa6-a075-48d2-8196-a011f5efefc5","source":"wordfence","cve":"CVE-2026-24597","title":"Organization chart <= 1.7.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c19aa6-a075-48d2-8196-a011f5efefc5?source=api-prod","affected":[{"type":"plugin","slug":"organization-chart","name":"Organization chart","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:13:51Z"},{"id":"wordfence:e9c2a942-c14c-4b59-92a7-6946b2e4731b","source":"wordfence","cve":"CVE-2023-1895","title":"Getwid \u2013 Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery","severity":"high","cvss":8.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2023-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9c33bab-a27b-43b1-aa48-3f8c09a38528","source":"wordfence","cve":"CVE-2024-33646","title":"Sticky Anything <= 2.1.5 - Missing Authorization","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c33bab-a27b-43b1-aa48-3f8c09a38528?source=api-prod","affected":[{"type":"plugin","slug":"toast-stick-anything","name":"Sticky Anything","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T13:17:14Z"},{"id":"wordfence:e9c68edb-99ad-4103-aff5-48abcf5c4392","source":"wordfence","cve":"CVE-2026-25373","title":"Vayvo < 6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c68edb-99ad-4103-aff5-48abcf5c4392?source=api-prod","affected":[{"type":"theme","slug":"vayvo-progression","name":"Vayvo - Media Streaming & Membership WordPress Theme","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":false,"patched_in":"6.8"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:20:48Z"},{"id":"wordfence:e9c7a759-e256-4bd5-970a-1e62d188f7c5","source":"wordfence","cve":"CVE-2024-51843","title":"Horsemanager <= 1.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7a759-e256-4bd5-970a-1e62d188f7c5?source=api-prod","affected":[{"type":"plugin","slug":"fruitcake-horsemanager","name":"Horsemanager","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:24:57Z"},{"id":"wordfence:e9c7fb16-efbb-41e9-be13-98e96c1e9100","source":"wordfence","cve":"CVE-2026-14894","title":"Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7fb16-efbb-41e9-be13-98e96c1e9100?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.313","to_inclusive":true,"patched_in":"6.3.314"}],"published":"2026-07-09T13:41:24Z","updated":"2026-07-13T23:13:44Z"},{"id":"wordfence:e9c81117-a9da-41bb-afc6-94196167af04","source":"wordfence","cve":"","title":"Social Share Buttons by Supsystic <= 2.2.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c81117-a9da-41bb-afc6-94196167af04?source=api-prod","affected":[{"type":"plugin","slug":"social-share-buttons-by-supsystic","name":"Social Share Buttons by Supsystic","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9c9214d-45d4-4477-8244-7802a4901114","source":"wordfence","cve":"CVE-2026-4912","title":"Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":4.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c9214d-45d4-4477-8244-7802a4901114?source=api-prod","affected":[{"type":"plugin","slug":"media-cleaner","name":"Media Cleaner: Delete Unused Images & Clean Your Media Library","from":"*","from_inclusive":true,"to":"7.0.3","to_inclusive":true,"patched_in":"7.0.6"}],"published":"2026-07-27T20:36:14Z","updated":"2026-07-28T18:35:52Z"},{"id":"wordfence:e9caf6a8-d7f6-4686-889a-79ba9cf911c4","source":"wordfence","cve":"CVE-2019-14680","title":"Admin renamer extended <= 3.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":5.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9caf6a8-d7f6-4686-889a-79ba9cf911c4?source=api-prod","affected":[{"type":"plugin","slug":"admin-renamer-extended","name":"Admin renamer extended","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":""}],"published":"2019-06-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9ccd2cc-ee5e-40e3-905d-21884ec01f72","source":"wordfence","cve":"CVE-2024-13846","title":"Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ccd2cc-ee5e-40e3-905d-21884ec01f72?source=api-prod","affected":[{"type":"plugin","slug":"ulp-duplicate-post-sql-timebased","name":"Indeed Ultimate Learning Pro","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-02-20T21:27:43Z","updated":"2025-02-21T11:09:35Z"},{"id":"wordfence:e9ce5c8e-35e2-4148-a6a8-69cd6cabb494","source":"wordfence","cve":"CVE-2025-23736","title":"Form To JSON <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ce5c8e-35e2-4148-a6a8-69cd6cabb494?source=api-prod","affected":[{"type":"plugin","slug":"form-to-json","name":"Form To JSON","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:31:16Z"},{"id":"wordfence:e9cf6b7f-d2b0-47f9-beec-8773f260c088","source":"wordfence","cve":"CVE-2025-9946","title":"LockerPress \u2013 WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9cf6b7f-d2b0-47f9-beec-8773f260c088?source=api-prod","affected":[{"type":"plugin","slug":"lockerpress-wordpress-security","name":"LockerPress \u2013 WordPress Security Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:32:19Z","updated":"2025-09-30T03:35:33Z"},{"id":"wordfence:e9d1a33b-2518-48f7-90b6-a94a34473d1e","source":"wordfence","cve":"CVE-2023-5713","title":"System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d1a33b-2518-48f7-90b6-a94a34473d1e?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-31T14:27:23Z"},{"id":"wordfence:e9d42cc5-c213-454b-b05a-a57705e5c7e4","source":"wordfence","cve":"CVE-2023-31232","title":"Plugins List <= 2.5 - Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d42cc5-c213-454b-b05a-a57705e5c7e4?source=api-prod","affected":[{"type":"plugin","slug":"plugins-list","name":"Plugins List","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9d545fc-fed0-428a-bad5-a0d7d09c04a7","source":"wordfence","cve":"CVE-2022-2762","title":"AdminPad <= 2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d545fc-fed0-428a-bad5-a0d7d09c04a7?source=api-prod","affected":[{"type":"plugin","slug":"adminpad","name":"AdminPad","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9d58191-769c-4632-a086-4dbce9bfb6ad","source":"wordfence","cve":"CVE-2023-37866","title":"JetFormBuilder <= 3.0.8 - Authenticated (Author+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d58191-769c-4632-a086-4dbce9bfb6ad?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9d7eed2-deba-49bc-99be-96fdc1331f7c","source":"wordfence","cve":"CVE-2025-32669","title":"Mergado Pack <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9d7eed2-deba-49bc-99be-96fdc1331f7c?source=api-prod","affected":[{"type":"plugin","slug":"mergado-marketing-pack","name":"Mergado Pack","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:42:41Z"},{"id":"wordfence:e9dd26b9-433c-4560-b507-69d0245ba789","source":"wordfence","cve":"CVE-2026-13693","title":"Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9dd26b9-433c-4560-b507-69d0245ba789?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-30T17:08:52Z"},{"id":"wordfence:e9dea663-c3ee-4dda-85c1-5cec970adfba","source":"wordfence","cve":"CVE-2025-58794","title":"Notification for Telegram <= 3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9dea663-c3ee-4dda-85c1-5cec970adfba?source=api-prod","affected":[{"type":"plugin","slug":"notification-for-telegram","name":"Notification for Telegram","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-09-05T00:00:00Z","updated":"2026-05-11T19:40:04Z"},{"id":"wordfence:e9df994d-a767-4c63-bf4b-3a2ecfe34bb6","source":"wordfence","cve":"CVE-2026-17025","title":"Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9df994d-a767-4c63-bf4b-3a2ecfe34bb6?source=api-prod","affected":[{"type":"theme","slug":"graphene","name":"Graphene","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.6"}],"published":"2026-10-09T17:01:46Z","updated":"2026-10-10T05:31:07Z"},{"id":"wordfence:e9e256b0-e4e3-4f41-842c-80aa2b80af72","source":"wordfence","cve":"CVE-2024-1851","title":"affiliate-toolkit \u2013 WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e256b0-e4e3-4f41-842c-80aa2b80af72?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-08T06:58:07Z"},{"id":"wordfence:e9e30377-2b5a-4b2d-9f19-bae91608fb24","source":"wordfence","cve":"CVE-2024-9242","title":"Memberful \u2013 Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e30377-2b5a-4b2d-9f19-bae91608fb24?source=api-prod","affected":[{"type":"plugin","slug":"memberful-wp","name":"Memberful \u2013 Membership Plugin","from":"*","from_inclusive":true,"to":"1.73.7","to_inclusive":true,"patched_in":"1.73.8"}],"published":"2024-10-03T00:00:00Z","updated":"2024-10-04T05:30:19Z"},{"id":"wordfence:e9e43c5b-a094-44ab-a8a3-52d437f0e00d","source":"wordfence","cve":"CVE-2023-5070","title":"Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e43c5b-a094-44ab-a8a3-52d437f0e00d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9e49406-a007-4c38-8e69-bf4b5438260e","source":"wordfence","cve":"CVE-2024-25099","title":"Paytium: Mollie payment forms & donations <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e49406-a007-4c38-8e69-bf4b5438260e?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.4.3"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T19:03:54Z"},{"id":"wordfence:e9e4ffa9-9f61-42e8-85f5-1dea499a63f7","source":"wordfence","cve":"CVE-2026-8708","title":"Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e4ffa9-9f61-42e8-85f5-1dea499a63f7?source=api-prod","affected":[{"type":"plugin","slug":"genzel-breadcrumbs","name":"Genzel breadcrumbs","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:21:01Z","updated":"2026-05-27T05:31:32Z"},{"id":"wordfence:e9e89383-a9c6-4300-970c-0b36e4d97e3d","source":"wordfence","cve":"CVE-2025-5103","title":"Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e89383-a9c6-4300-970c-0b36e4d97e3d?source=api-prod","affected":[{"type":"plugin","slug":"woo-gift-cards-lite","name":"Ultimate Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2025-06-02T19:33:48Z","updated":"2025-06-03T08:21:56Z"},{"id":"wordfence:e9ec40c3-9873-4647-810b-ed546e3306bb","source":"wordfence","cve":"CVE-2026-39655","title":"Mayosis Core <= 5.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ec40c3-9873-4647-810b-ed546e3306bb?source=api-prod","affected":[{"type":"plugin","slug":"mayosis-core","name":"Mayosis Core","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:10:56Z"},{"id":"wordfence:e9ec79e5-9f02-4a73-9437-58821ca855ef","source":"wordfence","cve":"CVE-2007-6013","title":"WordPress Core 1.5 - 2.3.1 - Authorization Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ec79e5-9f02-4a73-9437-58821ca855ef?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"1.5","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2007-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9ee4f4e-5098-406c-b712-a2484180a07d","source":"wordfence","cve":"CVE-2022-3922","title":"Broken Link Checker <= 1.11.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ee4f4e-5098-406c-b712-a2484180a07d?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"1.11.19","to_inclusive":true,"patched_in":"1.11.20"}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9f0689d-aa35-4dfb-b264-5d7378ab1a54","source":"wordfence","cve":"","title":"iThemes Security < 5.3.5 - Authenticated Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f0689d-aa35-4dfb-b264-5d7378ab1a54?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":false,"patched_in":"5.3.5"}],"published":"2016-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9f090bb-8e85-4fc3-a904-0a7ff85db8f1","source":"wordfence","cve":"","title":"SMTP Mail <= 1.1.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f090bb-8e85-4fc3-a904-0a7ff85db8f1?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mail","name":"SMTP Mail","from":"*","from_inclusive":true,"to":"1.1.14","to_inclusive":true,"patched_in":"1.2"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9f2e84a-f640-49b1-b01a-068c922dcc57","source":"wordfence","cve":"CVE-2025-63027","title":"WBC907 Core <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f2e84a-f640-49b1-b01a-068c922dcc57?source=api-prod","affected":[{"type":"plugin","slug":"wbc907-core","name":"907 - Responsive Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T20:29:28Z"},{"id":"wordfence:e9f31ec5-c376-45b1-9ffe-35c80b89b60d","source":"wordfence","cve":"CVE-2025-12002","title":"Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal","severity":"medium","cvss":5.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f31ec5-c376-45b1-9ffe-35c80b89b60d?source=api-prod","affected":[{"type":"plugin","slug":"youtube-feed-pro","name":"YouTube Feed Pro","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2026-01-16T14:01:17Z","updated":"2026-01-17T02:22:33Z"},{"id":"wordfence:e9f486c8-0d7d-4116-8420-6af60e1cdd63","source":"wordfence","cve":"CVE-2025-53322","title":"Accept Authorize.NET Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f486c8-0d7d-4116-8420-6af60e1cdd63?source=api-prod","affected":[{"type":"plugin","slug":"accept-authorize-net-payments-using-contact-form-7","name":"Accept Authorize.NET Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-07T13:35:50Z"},{"id":"wordfence:e9f73654-2e5a-4762-8cac-613e24d3216a","source":"wordfence","cve":"CVE-2016-1209","title":"Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f73654-2e5a-4762-8cac-613e24d3216a?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"2.9.36","from_inclusive":true,"to":"2.9.42","to_inclusive":true,"patched_in":"2.9.42.1"}],"published":"2016-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9f9f72f-01f4-47db-8efd-f25f0276896f","source":"wordfence","cve":"CVE-2024-43938","title":"Name Directory <= 1.29.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9f9f72f-01f4-47db-8efd-f25f0276896f?source=api-prod","affected":[{"type":"plugin","slug":"name-directory","name":"Name Directory","from":"*","from_inclusive":true,"to":"1.29.0","to_inclusive":true,"patched_in":"1.29.1"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:06:38Z"},{"id":"wordfence:e9fa55cc-c686-43e4-a028-dd2721d2db85","source":"wordfence","cve":"CVE-2023-52133","title":"Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fa55cc-c686-43e4-a028-dd2721d2db85?source=api-prod","affected":[{"type":"plugin","slug":"most-and-least-read-posts-widget","name":"Most And Least Read Posts Widget","from":"*","from_inclusive":true,"to":"2.5.17","to_inclusive":false,"patched_in":"2.5.17"}],"published":"2023-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9fac267-043b-47c3-b17e-9287fe4b8987","source":"wordfence","cve":"CVE-2026-25456","title":"Automated FedEx live/manual rates with shipping labels \u2013 HPOS supported <= 5.1.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fac267-043b-47c3-b17e-9287fe4b8987?source=api-prod","affected":[{"type":"plugin","slug":"a2z-fedex-shipping","name":"Automated FedEx live/manual rates with shipping labels \u2013 HPOS supported","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-19T14:51:50Z"},{"id":"wordfence:e9fac523-ceac-4ba2-9fcd-695afcd74308","source":"wordfence","cve":"CVE-2025-39468","title":"Modal Survey <= 2.0.2.0.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fac523-ceac-4ba2-9fcd-695afcd74308?source=api-prod","affected":[{"type":"plugin","slug":"modal-survey","name":"Modal Survey - WordPress Poll, Survey & Quiz Plugin","from":"*","from_inclusive":true,"to":"2.0.2.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:33:24Z"},{"id":"wordfence:e9faf566-7c78-4042-9ed7-6b05f8ff8074","source":"wordfence","cve":"CVE-2026-106000","title":"Booking Package < 1.7.34 - Unauthenticated Free Confirmed Booking Creation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9faf566-7c78-4042-9ed7-6b05f8ff8074?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.34","to_inclusive":false,"patched_in":"1.7.34"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T15:25:54Z"},{"id":"wordfence:e9fba508-9a18-4c02-8d3a-0bcf990c457d","source":"wordfence","cve":"CVE-2019-15644","title":"Zoho SalesIQ <= 1.0.8 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fba508-9a18-4c02-8d3a-0bcf990c457d?source=api-prod","affected":[{"type":"plugin","slug":"zoho-salesiq","name":"Zoho SalesIQ \u2013 Live chat, chatbots, and visitor tracking","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2019-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9fc118e-f402-4042-85b0-2175cb0e3048","source":"wordfence","cve":"","title":"10Web Map Builder for Google Maps <= 1.0.69 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fc118e-f402-4042-85b0-2175cb0e3048?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.70","to_inclusive":false,"patched_in":"1.0.70"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:e9fdc833-8384-42c0-ad9b-72e5b6351964","source":"wordfence","cve":"CVE-2024-11721","title":"Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fdc833-8384-42c0-ad9b-72e5b6351964?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.24.5","to_inclusive":true,"patched_in":"3.25.1"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T08:26:40Z"},{"id":"wordfence:e9fea7e4-00d8-4f8b-9ee8-8e0deb179141","source":"wordfence","cve":"CVE-2026-27059","title":"Penci Recipe <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fea7e4-00d8-4f8b-9ee8-8e0deb179141?source=api-prod","affected":[{"type":"plugin","slug":"penci-recipe","name":"Penci Recipe","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-11T00:00:00Z","updated":"2026-02-26T19:58:18Z"},{"id":"wordfence:ea00bcc9-6f9c-4704-8337-074d5356e9e2","source":"wordfence","cve":"","title":"WP Activity Log <= 4.1.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea00bcc9-6f9c-4704-8337-074d5356e9e2?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":false,"patched_in":"4.1.5"}],"published":"2020-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea01e11e-31b5-4cd9-8fab-3693e47f705a","source":"wordfence","cve":"","title":"Picture Gallery \u2013 Frontend Image Uploads, AJAX Photo List < 1.4.3 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea01e11e-31b5-4cd9-8fab-3693e47f705a?source=api-prod","affected":[{"type":"plugin","slug":"picture-gallery","name":"Picture Gallery \u2013 Frontend Uploads & Image Editor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea02fef1-33d2-4f0b-bf84-c4df6f63ab41","source":"wordfence","cve":"CVE-2026-118090","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea02fef1-33d2-4f0b-bf84-c4df6f63ab41?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.55","to_inclusive":true,"patched_in":"3.7.56"}],"published":"2026-10-30T07:50:03Z","updated":"2026-11-03T19:45:00Z"},{"id":"wordfence:ea0540d1-3c02-43e7-852c-bf9a6c025fc4","source":"wordfence","cve":"CVE-2025-4957","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0540d1-3c02-43e7-852c-bf9a6c025fc4?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.5.7","to_inclusive":true,"patched_in":"5.9.5.8"}],"published":"2025-09-01T00:00:00Z","updated":"2025-10-15T18:16:11Z"},{"id":"wordfence:ea070d9c-c04c-432f-a110-47b9eaa67614","source":"wordfence","cve":"CVE-2024-0701","title":"UserPro <= 5.1.6 - Disabled Membership Registration Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea070d9c-c04c-432f-a110-47b9eaa67614?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2024-02-01T00:00:00Z","updated":"2024-07-29T21:37:43Z"},{"id":"wordfence:ea073543-20b5-48ec-b9d4-751a674d8273","source":"wordfence","cve":"CVE-2025-46256","title":"Advanced Database Cleaner PRO <= 3.2.10 - Authenticated (Subscriber+) Limited Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea073543-20b5-48ec-b9d4-751a674d8273?source=api-prod","affected":[{"type":"plugin","slug":"advanced-database-cleaner-pro","name":"Advanced Database Cleaner PRO","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":"3.2.11"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T15:58:07Z"},{"id":"wordfence:ea07c3c1-95e6-4139-b4f5-67ca642f0563","source":"wordfence","cve":"CVE-2025-9314","title":"Developer Tools <= 1.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea07c3c1-95e6-4139-b4f5-67ca642f0563?source=api-prod","affected":[{"type":"plugin","slug":"system-report-and-phpinfo","name":"Developer Tools","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-21T00:00:00Z","updated":"2026-09-10T19:07:42Z"},{"id":"wordfence:ea0844cf-f26d-4061-a97a-b9d5729146fe","source":"wordfence","cve":"CVE-2026-89237","title":"Bluff Post <= 1.1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0844cf-f26d-4061-a97a-b9d5729146fe?source=api-prod","affected":[{"type":"plugin","slug":"bluff-post","name":"Bluff Post","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-29T19:42:33Z"},{"id":"wordfence:ea097cb7-85f4-4b6d-9f29-bc2636993f21","source":"wordfence","cve":"CVE-2021-4334","title":"Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea097cb7-85f4-4b6d-9f29-bc2636993f21?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"4.6.9","to_inclusive":true,"patched_in":"4.7.0"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea0d1acc-d2c9-4851-9753-d87587236d7e","source":"wordfence","cve":"CVE-2013-1852","title":"LeagueManager < 3.8.1 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0d1acc-d2c9-4851-9753-d87587236d7e?source=api-prod","affected":[{"type":"plugin","slug":"leaguemanager","name":"LeagueManager","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":false,"patched_in":"3.8.1"}],"published":"2013-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea0d5859-7304-4d65-9ba9-679d0fc3c3fd","source":"wordfence","cve":"CVE-2017-20108","title":"Easy Table <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0d5859-7304-4d65-9ba9-679d0fc3c3fd?source=api-prod","affected":[{"type":"plugin","slug":"easy-table","name":"Easy Table","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2017-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea0d92c7-c247-401d-8cfa-bf42a0692fcd","source":"wordfence","cve":"CVE-2025-30960","title":"FS Poster <= 6.5.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0d92c7-c247-401d-8cfa-bf42a0692fcd?source=api-prod","affected":[{"type":"plugin","slug":"fs-poster","name":"FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]","from":"*","from_inclusive":true,"to":"6.5.8","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:07:06Z"},{"id":"wordfence:ea0ea17f-fe22-4749-851b-f13fc79de7d9","source":"wordfence","cve":"CVE-2025-26756","title":"Magic the Gathering Card Tooltips <= 3.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0ea17f-fe22-4749-851b-f13fc79de7d9?source=api-prod","affected":[{"type":"plugin","slug":"magic-the-gathering-card-tooltips","name":"Magic the Gathering Card Tooltips","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-26T22:38:11Z"},{"id":"wordfence:ea0eeb86-73af-4f7c-9f2f-dc9930948c0c","source":"wordfence","cve":"CVE-2025-32518","title":"ALD Login Page <= 1.1 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0eeb86-73af-4f7c-9f2f-dc9930948c0c?source=api-prod","affected":[{"type":"plugin","slug":"ald-login-page","name":"ALD Login Page","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:17:44Z"},{"id":"wordfence:ea136a60-aa42-4577-88b6-a49c79098954","source":"wordfence","cve":"CVE-2023-36515","title":"LearnPress <= 4.2.3 - Missing Authorization to Information Exposure","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea136a60-aa42-4577-88b6-a49c79098954?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.2.3.1"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea13aebb-c853-4828-8d7f-b607aa83b702","source":"wordfence","cve":"CVE-2019-19983","title":"Fast Velocity Minify <= 2.7.6 - Full Path Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea13aebb-c853-4828-8d7f-b607aa83b702?source=api-prod","affected":[{"type":"plugin","slug":"fast-velocity-minify","name":"Fast Velocity Minify","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2019-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea1423ff-2da4-4a5d-a731-075a4223945d","source":"wordfence","cve":"CVE-2026-95595","title":"Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1423ff-2da4-4a5d-a731-075a4223945d?source=api-prod","affected":[{"type":"plugin","slug":"disable-remove-google-fonts","name":"Disable and Remove Google Fonts | GDPR & DSGVO friendly","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-10-02T08:01:13Z","updated":"2026-10-08T23:53:29Z"},{"id":"wordfence:ea174c08-4601-4f40-a6d0-a4fc95bf71e9","source":"wordfence","cve":"CVE-2025-22813","title":"Conversational Forms for ChatBot <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea174c08-4601-4f40-a6d0-a4fc95bf71e9?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T14:58:30Z"},{"id":"wordfence:ea183ae3-683f-4eec-b583-feefc8c62382","source":"wordfence","cve":"CVE-2025-9441","title":"iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea183ae3-683f-4eec-b583-feefc8c62382?source=api-prod","affected":[{"type":"plugin","slug":"iats-online-forms","name":"iATS Online Forms","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-28T15:44:19Z","updated":"2025-08-29T04:25:30Z"},{"id":"wordfence:ea189072-aa96-441b-ad5e-b6433da06d22","source":"wordfence","cve":"","title":"Relevant \u2013 Related, Featured, Latest, and Popular Posts by BestWebSoft < 1.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea189072-aa96-441b-ad5e-b6433da06d22?source=api-prod","affected":[{"type":"plugin","slug":"relevant","name":"Relevant \u2013 Related, Featured, Latest, and Popular Posts by BestWebSoft","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea1d2448-76da-4992-98f6-9898697602ba","source":"wordfence","cve":"CVE-2025-22643","title":"OnePress <= 2.3.14 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1d2448-76da-4992-98f6-9898697602ba?source=api-prod","affected":[{"type":"theme","slug":"onepress","name":"OnePress","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2025-02-03T00:00:00Z","updated":"2026-06-08T16:12:03Z"},{"id":"wordfence:ea1dc52d-fcd6-4b35-899a-3aff814073e0","source":"wordfence","cve":"CVE-2024-6366","title":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1dc52d-fcd6-4b35-899a-3aff814073e0?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.11.7","to_inclusive":true,"patched_in":"3.11.8"}],"published":"2024-07-08T00:00:00Z","updated":"2024-08-09T21:09:59Z"},{"id":"wordfence:ea1f1825-241c-4060-a1e1-a13f92421fef","source":"wordfence","cve":"CVE-2024-13768","title":"CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1f1825-241c-4060-a1e1-a13f92421fef?source=api-prod","affected":[{"type":"plugin","slug":"cits-support-svg-webp-media-upload","name":"CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-21T18:04:36Z","updated":"2025-03-22T06:41:13Z"},{"id":"wordfence:ea20dc85-79ed-456c-8bec-b3ec153b89f8","source":"wordfence","cve":"CVE-2026-90951","title":"Paid Member Subscriptions <= 3.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea20dc85-79ed-456c-8bec-b3ec153b89f8?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:58:30Z"},{"id":"wordfence:ea233fd1-d64e-48a4-8209-b6ce7703d1c6","source":"wordfence","cve":"CVE-2026-22334","title":"Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea233fd1-d64e-48a4-8209-b6ce7703d1c6?source=api-prod","affected":[{"type":"plugin","slug":"woo-book-price","name":"Woocommerce Book Price","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:40:34Z"},{"id":"wordfence:ea23bcc2-ce71-4f16-85f3-11276deb659f","source":"wordfence","cve":"CVE-2023-7030","title":"Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea23bcc2-ce71-4f16-85f3-11276deb659f?source=api-prod","affected":[{"type":"plugin","slug":"jquery-collapse-o-matic","name":"Collapse-O-Matic","from":"*","from_inclusive":true,"to":"1.8.5.5","to_inclusive":true,"patched_in":"1.8.5.6"}],"published":"2024-04-23T00:00:00Z","updated":"2024-07-29T21:37:43Z"},{"id":"wordfence:ea24a3f3-0243-4e01-a4b7-9239ed812527","source":"wordfence","cve":"CVE-2026-125843","title":"Spasalon <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea24a3f3-0243-4e01-a4b7-9239ed812527?source=api-prod","affected":[{"type":"theme","slug":"spasalon","name":"Spasalon","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:55:14Z"},{"id":"wordfence:ea24cb9e-88a5-45a2-93f8-544afef5a83b","source":"wordfence","cve":"","title":"WP Visited Countries Reloaded <= 3.1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea24cb9e-88a5-45a2-93f8-544afef5a83b?source=api-prod","affected":[{"type":"plugin","slug":"wp-visited-countries-reloaded","name":"WP Visited Countries Reloaded","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2021-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea251110-02fa-4f4e-a578-855d3331b200","source":"wordfence","cve":"CVE-2024-11880","title":"B Testimonial \u2013 testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea251110-02fa-4f4e-a578-855d3331b200?source=api-prod","affected":[{"type":"plugin","slug":"b-testimonial","name":"Testimonial \u2013 Build Trust with Rotating Customer Stories","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T08:22:48Z"},{"id":"wordfence:ea26eb81-e6d1-4c6d-95f4-fd1b2d919632","source":"wordfence","cve":"CVE-2016-4029","title":"WordPress Core < 4.5 - Server-Side Request Forgery","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea26eb81-e6d1-4c6d-95f4-fd1b2d919632?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":false,"patched_in":"4.5"}],"published":"2016-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea28fc6c-50d6-406b-9205-3f1bec577644","source":"wordfence","cve":"CVE-2026-94573","title":"Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea28fc6c-50d6-406b-9205-3f1bec577644?source=api-prod","affected":[{"type":"plugin","slug":"repeater-for-elementor","name":"Repeater Fields for Elementor Forms","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-09-24T18:55:23Z","updated":"2026-09-25T07:40:30Z"},{"id":"wordfence:ea2b5dca-42a5-49d4-800d-b268572968a9","source":"wordfence","cve":"CVE-2024-2093","title":"VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2b5dca-42a5-49d4-800d-b268572968a9?source=api-prod","affected":[{"type":"plugin","slug":"vk-all-in-one-expansion-unit","name":"VK All in One Expansion Unit","from":"*","from_inclusive":true,"to":"9.95.0.1","to_inclusive":true,"patched_in":"9.96.0.0"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-09T18:59:31Z"},{"id":"wordfence:ea2c1294-efc0-4d89-a7f4-42580ca9d138","source":"wordfence","cve":"CVE-2026-96553","title":"FiboSearch \u2013 Ajax Search for WooCommerce <= 1.34.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2c1294-efc0-4d89-a7f4-42580ca9d138?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-for-woocommerce","name":"FiboSearch \u2013 Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.34.1","to_inclusive":true,"patched_in":"1.34.2"}],"published":"2026-10-02T07:48:12Z","updated":"2026-10-13T14:50:24Z"},{"id":"wordfence:ea2d4716-2ae1-45ca-a4b2-4edb4a89d7b4","source":"wordfence","cve":"","title":"Specialist (Unspecified Version) - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2d4716-2ae1-45ca-a4b2-4edb4a89d7b4?source=api-prod","affected":[{"type":"theme","slug":"specialist","name":"Specialist","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea2e1593-56e6-4e78-a895-51a6bebeaf75","source":"wordfence","cve":"CVE-2025-64635","title":"Feeds for YouTube <= 2.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2e1593-56e6-4e78-a895-51a6bebeaf75?source=api-prod","affected":[{"type":"plugin","slug":"feeds-for-youtube","name":"Feeds for YouTube (YouTube video, channel, and gallery plugin)","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-20T19:44:22Z"},{"id":"wordfence:ea38e16f-4012-4d22-9a47-76f91251e1d7","source":"wordfence","cve":"CVE-2025-10377","title":"System Dashboard <= 2.8.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea38e16f-4012-4d22-9a47-76f91251e1d7?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.20","to_inclusive":true,"patched_in":"2.8.21"}],"published":"2025-09-25T14:44:12Z","updated":"2025-09-26T03:25:35Z"},{"id":"wordfence:ea399af7-f542-4209-aacc-3f469c844931","source":"wordfence","cve":"CVE-2025-69079","title":"Sound | Musical Instruments Online Store <= 1.6.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea399af7-f542-4209-aacc-3f469c844931?source=api-prod","affected":[{"type":"theme","slug":"musicplace","name":"Sound | Musical Instruments Online Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T21:42:07Z"},{"id":"wordfence:ea39d249-0345-4028-af58-31b298376950","source":"wordfence","cve":"CVE-2026-8038","title":"Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea39d249-0345-4028-af58-31b298376950?source=api-prod","affected":[{"type":"plugin","slug":"faces-of-users","name":"Faces of Users","from":"*","from_inclusive":true,"to":"0.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:03:15Z","updated":"2026-05-20T01:25:56Z"},{"id":"wordfence:ea3ae3b3-216c-47d4-b5f2-07e612443955","source":"wordfence","cve":"CVE-2026-27989","title":"Quanzo - Creative Portfolio Template Kit <= 1.0.10 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3ae3b3-216c-47d4-b5f2-07e612443955?source=api-prod","affected":[{"type":"theme","slug":"quanzo","name":"Quanzo - Creative Portfolio Template Kit","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:24:08Z"},{"id":"wordfence:ea3afa3c-9a88-4f91-a74a-04306639feb5","source":"wordfence","cve":"","title":"Google Language Translator <= 4.0.9 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3afa3c-9a88-4f91-a74a-04306639feb5?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea3b6fa6-1b58-40c2-8ec2-8a9211069f11","source":"wordfence","cve":"CVE-2026-1986","title":"FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3b6fa6-1b58-40c2-8ec2-8a9211069f11?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.8.2","to_inclusive":true,"patched_in":"7.8.3"}],"published":"2026-03-25T14:09:09Z","updated":"2026-03-26T02:25:20Z"},{"id":"wordfence:ea3ba0f5-6bc2-455c-b4e3-891ed6b2518c","source":"wordfence","cve":"CVE-2013-20002","title":"Elemin < 1.4.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3ba0f5-6bc2-455c-b4e3-891ed6b2518c?source=api-prod","affected":[{"type":"theme","slug":"elemin","name":"Elemin","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2013-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea3c5188-4570-4958-8b2d-69048b10c5f9","source":"wordfence","cve":"CVE-2023-51516","title":"Business Directory Plugin <= 6.3.9 - Missing Authorization via dispatch","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3c5188-4570-4958-8b2d-69048b10c5f9?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.3.9","to_inclusive":true,"patched_in":"6.3.10"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea3daad1-74a1-44be-b7ed-b58b806da614","source":"wordfence","cve":"CVE-2024-2787","title":"Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3daad1-74a1-44be-b7ed-b58b806da614?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.4","to_inclusive":true,"patched_in":"3.10.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:31Z"},{"id":"wordfence:ea40d06e-672c-42db-9378-d382de5838d4","source":"wordfence","cve":"CVE-2023-2068","title":"File Manager Advanced Shortcode WordPress <= 2.3.2 - Unauthenticated Arbitrary File Upload to Remote Code Execution via Shortcode","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea40d06e-672c-42db-9378-d382de5838d4?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced-shortcode","name":"File Manager Advanced Shortcode","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.4"}],"published":"2023-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea41c631-c016-400b-9f68-63aa661ced43","source":"wordfence","cve":"CVE-2026-66455","title":"ReactPress \u2013 Create React App for WordPress <= 3.4.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea41c631-c016-400b-9f68-63aa661ced43?source=api-prod","affected":[{"type":"plugin","slug":"reactpress","name":"ReactPress","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-08-07T00:00:00Z","updated":"2026-10-28T21:12:37Z"},{"id":"wordfence:ea41d391-ba8d-43d9-8eda-69ac28c49328","source":"wordfence","cve":"CVE-2026-4011","title":"Power Charts <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea41d391-ba8d-43d9-8eda-69ac28c49328?source=api-prod","affected":[{"type":"plugin","slug":"wpgo-power-charts-lite","name":"Power Charts \u2013 Responsive Beautiful Charts & Graphs","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:45:38Z","updated":"2026-04-15T08:28:17Z"},{"id":"wordfence:ea4453bc-557b-4abf-85c6-4aecfd8f4012","source":"wordfence","cve":"CVE-2023-1431","title":"WP Simple Shopping Cart <= 4.6.3 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4453bc-557b-4abf-85c6-4aecfd8f4012?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-simple-paypal-shopping-cart","name":"Simple Shopping Cart","from":"4.6.3","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea46b390-f9df-4f07-8af5-abf2b87b5fc7","source":"wordfence","cve":"CVE-2025-22661","title":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea46b390-f9df-4f07-8af5-abf2b87b5fc7?source=api-prod","affected":[{"type":"plugin","slug":"paypal-payment-button-by-vcita","name":"Online Payments \u2013 Get Paid with PayPal, Square & Stripe","from":"*","from_inclusive":true,"to":"3.20.0","to_inclusive":true,"patched_in":"3.30.0"}],"published":"2025-01-15T00:00:00Z","updated":"2025-02-19T21:25:28Z"},{"id":"wordfence:ea489c69-d4d9-4e05-8cac-25fd17d48506","source":"wordfence","cve":"CVE-2023-41803","title":"BitPay Checkout for WooCommerce <= 4.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea489c69-d4d9-4e05-8cac-25fd17d48506?source=api-prod","affected":[{"type":"plugin","slug":"bitpay-checkout-for-woocommerce","name":"BitPay Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"5.0.0"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea49be6f-2594-4fad-8eb5-56353ee367ff","source":"wordfence","cve":"CVE-2025-49902","title":"Login Page Customizer \u2013 Customizer Login Page, Admin Page, Custom Design <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea49be6f-2594-4fad-8eb5-56353ee367ff?source=api-prod","affected":[{"type":"plugin","slug":"customizer-login-page","name":"Login Page Customizer \u2013 Customize Login Screen & Branding","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-11-08T00:00:00Z","updated":"2025-12-19T20:45:17Z"},{"id":"wordfence:ea49df40-e58f-4e20-8e48-ed0f9a1b94ca","source":"wordfence","cve":"CVE-2025-9217","title":"Slider Revolution <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea49df40-e58f-4e20-8e48-ed0f9a1b94ca?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.7.36","to_inclusive":true,"patched_in":"6.7.37"}],"published":"2025-08-28T00:00:00Z","updated":"2025-08-29T10:54:03Z"},{"id":"wordfence:ea49f25b-6aeb-476c-9d53-2d3ce61fe9f3","source":"wordfence","cve":"CVE-2026-39788","title":"Front End PM <= 11.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea49f25b-6aeb-476c-9d53-2d3ce61fe9f3?source=api-prod","affected":[{"type":"plugin","slug":"front-end-pm","name":"Front End PM","from":"*","from_inclusive":true,"to":"11.4.6","to_inclusive":true,"patched_in":"11.4.7"}],"published":"2026-10-05T16:49:33Z","updated":"2026-10-13T17:02:30Z"},{"id":"wordfence:ea4a207e-bbe0-4974-a414-248d29c8fdf3","source":"wordfence","cve":"CVE-2026-40759","title":"Esm\u00e9e <= 1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4a207e-bbe0-4974-a414-248d29c8fdf3?source=api-prod","affected":[{"type":"theme","slug":"esme","name":"Esm\u00e9e - Fashion Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:48:19Z"},{"id":"wordfence:ea4b35ef-99ae-4ef9-8618-f9993306521b","source":"wordfence","cve":"CVE-2023-50890","title":"Ultimate Addons for Elementor <= 1.36.20 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4b35ef-99ae-4ef9-8618-f9993306521b?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.36.20","to_inclusive":true,"patched_in":"1.36.21"}],"published":"2023-12-26T00:00:00Z","updated":"2024-07-09T19:08:28Z"},{"id":"wordfence:ea4c0ad7-c7c0-49fd-85e4-612423e3ddb5","source":"wordfence","cve":"CVE-2025-39354","title":"Grand Conference <= 5.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4c0ad7-c7c0-49fd-85e4-612423e3ddb5?source=api-prod","affected":[{"type":"theme","slug":"grandconference","name":"Grand Conference | Event WordPress","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2026-04-24T14:17:16Z"},{"id":"wordfence:ea4e6718-4e1e-44ce-8463-860f0d3d80f5","source":"wordfence","cve":"CVE-2024-0969","title":"ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4e6718-4e1e-44ce-8463-860f0d3d80f5?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"4.0.25"}],"published":"2024-02-01T00:00:00Z","updated":"2024-02-05T21:22:07Z"},{"id":"wordfence:ea4e9263-36f7-490c-9dad-d3b806bcfdf4","source":"wordfence","cve":"","title":"Visitor Traffic Real Time Statistics <= 2.13 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4e9263-36f7-490c-9dad-d3b806bcfdf4?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":"3.1"}],"published":"2021-04-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea4fd340-6e94-4032-9202-8ccfa7481223","source":"wordfence","cve":"CVE-2022-29430","title":"PNG to JPG <= 5.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea4fd340-6e94-4032-9202-8ccfa7481223?source=api-prod","affected":[{"type":"plugin","slug":"png-to-jpg","name":"PNG to JPG","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2022-05-06T13:18:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea5215b3-fd25-4ca5-b651-18c935aa2ca0","source":"wordfence","cve":"","title":"AF Companion <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5215b3-fd25-4ca5-b651-18c935aa2ca0?source=api-prod","affected":[{"type":"plugin","slug":"af-companion","name":"AF Companion \u2013 AI SEO, GEO, Alt Text, Performance & Site Health","from":"1.1.0","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2021-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea52bacf-e21d-4ea9-b51b-ee0c37620bf9","source":"wordfence","cve":"CVE-2023-4783","title":"Magee Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea52bacf-e21d-4ea9-b51b-ee0c37620bf9?source=api-prod","affected":[{"type":"plugin","slug":"magee-shortcodes","name":"Magee Shortcodes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-21T00:00:00Z","updated":"2024-02-09T14:06:13Z"},{"id":"wordfence:ea53976d-fd64-4e23-b311-d8e462badc1e","source":"wordfence","cve":"CVE-2024-50551","title":"EndomondoWP <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea53976d-fd64-4e23-b311-d8e462badc1e?source=api-prod","affected":[{"type":"plugin","slug":"endomondowp","name":"EndomondoWP","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:42:16Z"},{"id":"wordfence:ea54436c-b623-4049-af19-9995c312476e","source":"wordfence","cve":"CVE-2024-13496","title":"GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea54436c-b623-4049-af19-9995c312476e?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2025-01-21T22:24:56Z","updated":"2025-03-24T15:50:29Z"},{"id":"wordfence:ea5533ab-068a-4a94-bf0a-fc15fcfb383b","source":"wordfence","cve":"CVE-2026-54193","title":"Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5533ab-068a-4a94-bf0a-fc15fcfb383b?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.4","to_inclusive":true,"patched_in":"3.15.5"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:27:35Z"},{"id":"wordfence:ea56f0a1-7359-4beb-aae6-e2a3757ec8cd","source":"wordfence","cve":"CVE-2022-2554","title":"Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea56f0a1-7359-4beb-aae6-e2a3757ec8cd?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea595e78-f4fc-491d-8143-c836302618d5","source":"wordfence","cve":"CVE-2023-4629","title":"LadiApp <= 4.4 - Cross-Site Request Forgery via save_config()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea595e78-f4fc-491d-8143-c836302618d5?source=api-prod","affected":[{"type":"plugin","slug":"ladipage","name":"LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing\u2026","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":""}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-12T09:33:57Z"},{"id":"wordfence:ea59d04e-b332-49f8-bf3f-6e0cda3be712","source":"wordfence","cve":"CVE-2025-30899","title":"User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea59d04e-b332-49f8-bf3f-6e0cda3be712?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:52:10Z"},{"id":"wordfence:ea5c0b48-7e8e-492e-b0de-14681e31fe85","source":"wordfence","cve":"CVE-2024-53769","title":"Custom Post Type to Map Store <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5c0b48-7e8e-492e-b0de-14681e31fe85?source=api-prod","affected":[{"type":"plugin","slug":"cpt-to-map-store","name":"Custom Post Type to Map Store","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:20:10Z"},{"id":"wordfence:ea5c1fa7-1838-4a5b-ac56-df2184ff9cc8","source":"wordfence","cve":"CVE-2025-23725","title":"Accessibility Task Manager <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5c1fa7-1838-4a5b-ac56-df2184ff9cc8?source=api-prod","affected":[{"type":"plugin","slug":"accessibility-task-manager","name":"Accessibility Task Manager","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:52:12Z"},{"id":"wordfence:ea5c5728-fb26-486b-b2fe-8c89a2656b02","source":"wordfence","cve":"CVE-2025-67970","title":"Schedula <= 1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5c5728-fb26-486b-b2fe-8c89a2656b02?source=api-prod","affected":[{"type":"plugin","slug":"schedula-smart-appointment-booking","name":"Schedula \u2013 Smart Appointment Booking","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2026-01-26T00:00:00Z","updated":"2026-02-02T20:40:27Z"},{"id":"wordfence:ea5cd266-347e-4959-957f-3a02480fb7dc","source":"wordfence","cve":"CVE-2026-84022","title":"Bold Page Builder < 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5cd266-347e-4959-957f-3a02480fb7dc?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":false,"patched_in":"5.9.8"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:20:35Z"},{"id":"wordfence:ea5dfd45-4f61-47e2-9b99-862921229508","source":"wordfence","cve":"CVE-2025-58871","title":"Master Paper Collapse Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5dfd45-4f61-47e2-9b99-862921229508?source=api-prod","affected":[{"type":"plugin","slug":"master-paper-collapse-toggle","name":"Master Paper Collapse Toggle","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:32:42Z"},{"id":"wordfence:ea5f9fba-6b25-40c8-b237-361eb6365693","source":"wordfence","cve":"CVE-2024-49314","title":"JiangQie Free Mini Program <= 2.5.2 - Unauthenticated Arbitrary File Uplaod","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea5f9fba-6b25-40c8-b237-361eb6365693?source=api-prod","affected":[{"type":"plugin","slug":"jiangqie-free-mini-program","name":"JiangQie Free Mini Program","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:43:22Z"},{"id":"wordfence:ea607a56-ed6e-44dd-be42-a0b0d970742e","source":"wordfence","cve":"","title":"Store Locator Plus < 4.2.27 - Email Injection","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea607a56-ed6e-44dd-be42-a0b0d970742e?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-le","name":"Store Locator Plus\u00ae for WordPress","from":"*","from_inclusive":true,"to":"4.2.27","to_inclusive":false,"patched_in":"4.2.27"}],"published":"2015-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea615395-2c63-415d-b0bf-6bd2489ad540","source":"wordfence","cve":"CVE-2025-67968","title":"Real Homes CRM <= 1.0.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea615395-2c63-415d-b0bf-6bd2489ad540?source=api-prod","affected":[{"type":"plugin","slug":"realhomes-crm","name":"RealHomes CRM","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:28:46Z"},{"id":"wordfence:ea630be6-16f8-4d93-ae27-8a29f82c5db9","source":"wordfence","cve":"CVE-2024-31357","title":"Ultimate Store Kit Elementor Addons <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea630be6-16f8-4d93-ae27-8a29f82c5db9?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-11T15:33:16Z"},{"id":"wordfence:ea64ee86-4c3a-47fc-a53e-e9fbabe9d298","source":"wordfence","cve":"CVE-2026-110891","title":"WordLift \u2013 AI powered SEO \u2013 Schema <= 3.54.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea64ee86-4c3a-47fc-a53e-e9fbabe9d298?source=api-prod","affected":[{"type":"plugin","slug":"wordlift","name":"WordLift \u2013 AI powered SEO \u2013 Schema","from":"*","from_inclusive":true,"to":"3.54.15","to_inclusive":true,"patched_in":"3.54.17"}],"published":"2026-10-15T17:46:00Z","updated":"2026-10-23T18:23:30Z"},{"id":"wordfence:ea679227-5ab3-408b-ae1b-340099880789","source":"wordfence","cve":"CVE-2026-89301","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea679227-5ab3-408b-ae1b-340099880789?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"4.7.14"}],"published":"2026-10-09T15:29:06Z","updated":"2026-10-10T04:26:51Z"},{"id":"wordfence:ea6c7b63-00da-4476-a024-97fe99af643d","source":"wordfence","cve":"CVE-2024-13913","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea6c7b63-00da-4476-a024-97fe99af643d?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.83","to_inclusive":true,"patched_in":"0.1.0.84"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T05:24:05Z"},{"id":"wordfence:ea6e0856-ba3d-4fa1-ac90-45a51ff994ef","source":"wordfence","cve":"CVE-2024-24930","title":"Buttons Shortcode and Widget <= 1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea6e0856-ba3d-4fa1-ac90-45a51ff994ef?source=api-prod","affected":[{"type":"plugin","slug":"buttons-shortcode-and-widget","name":"Buttons Shortcode and Widget","from":"*","from_inclusive":true,"to":"1.16","to_inclusive":true,"patched_in":""}],"published":"2024-02-09T00:00:00Z","updated":"2024-04-24T14:22:53Z"},{"id":"wordfence:ea6eac9c-988c-4cd2-be68-ff2a2ceb86e4","source":"wordfence","cve":"CVE-2025-22583","title":"Scan External Links <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea6eac9c-988c-4cd2-be68-ff2a2ceb86e4?source=api-prod","affected":[{"type":"plugin","slug":"scan-external-links","name":"Scan External Links","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:42:42Z"},{"id":"wordfence:ea70ffaf-b78b-4550-b334-d105f25b3f61","source":"wordfence","cve":"CVE-2026-107659","title":"Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"3.0.11","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-10-15T16:17:24Z","updated":"2026-10-16T04:27:05Z"},{"id":"wordfence:ea78b7b2-039d-41dc-a465-fb9462ed32ae","source":"wordfence","cve":"CVE-2026-81767","title":"Simple Payment <= 2.5.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea78b7b2-039d-41dc-a465-fb9462ed32ae?source=api-prod","affected":[{"type":"plugin","slug":"simple-payment","name":"Simple Payment","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:56:31Z"},{"id":"wordfence:ea7b85fd-b771-4af3-bdcb-d976fa7bd8fc","source":"wordfence","cve":"CVE-2025-23471","title":"ECT Add to Cart Button <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea7b85fd-b771-4af3-bdcb-d976fa7bd8fc?source=api-prod","affected":[{"type":"plugin","slug":"ect-add-to-cart-button","name":"ECT Add to Cart Button","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:56:57Z"},{"id":"wordfence:ea7b8bf5-cce9-4341-ae09-61e16292fba2","source":"wordfence","cve":"CVE-2026-42709","title":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea7b8bf5-cce9-4341-ae09-61e16292fba2?source=api-prod","affected":[{"type":"plugin","slug":"tlp-food-menu","name":"Food Menu \u2013 Restaurant Menu & Online Ordering for WooCommerce","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-13T17:03:12Z"},{"id":"wordfence:ea7d643c-3388-469f-b4a9-5c68341e2af0","source":"wordfence","cve":"CVE-2023-0948","title":"Japanized For WooCommerce <= 2.5.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea7d643c-3388-469f-b4a9-5c68341e2af0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-for-japan","name":"Japanized for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea7f654b-88d1-4ed8-bab0-701e2e66e060","source":"wordfence","cve":"CVE-2023-46154","title":"E2Pdf <= 1.20.18 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea7f654b-88d1-4ed8-bab0-701e2e66e060?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.20.18","to_inclusive":true,"patched_in":"1.20.19"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea82e978-a653-4ae3-94aa-bc77b94a176c","source":"wordfence","cve":"CVE-2023-22706","title":"PropertyHive <= 1.5.48 - Reflected Cross-Site Scripting via date_post_id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea82e978-a653-4ae3-94aa-bc77b94a176c?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"1.5.48","to_inclusive":true,"patched_in":"1.5.49"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea838c4c-d362-4653-8dc1-5c4dbec19eca","source":"wordfence","cve":"CVE-2026-12511","title":"AI Engine <= 3.5.4 - Authenticated (Editor+) Arbitrary File Write","severity":"high","cvss":7.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea838c4c-d362-4653-8dc1-5c4dbec19eca?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-30T13:28:06Z"},{"id":"wordfence:ea85fa9a-78ea-4017-b72e-49db7eafa11e","source":"wordfence","cve":"CVE-2023-35780","title":"Galleria <= 1.0.3 - Cross-Site Request Forgery via showOptionsPage","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea85fa9a-78ea-4017-b72e-49db7eafa11e?source=api-prod","affected":[{"type":"plugin","slug":"galleria","name":"Galleria","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea89d3ed-b0c7-40fb-8c9f-cfa0028fa6c2","source":"wordfence","cve":"CVE-2026-65471","title":"Avada Core <= 5.15.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea89d3ed-b0c7-40fb-8c9f-cfa0028fa6c2?source=api-prod","affected":[{"type":"plugin","slug":"fusion-core","name":"Avada Core","from":"*","from_inclusive":true,"to":"5.15.6","to_inclusive":true,"patched_in":"5.15.7"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T23:09:36Z"},{"id":"wordfence:ea8b1eee-2e3f-4d61-b815-4ea0aaa188b5","source":"wordfence","cve":"CVE-2026-87915","title":"Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea8b1eee-2e3f-4d61-b815-4ea0aaa188b5?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.24.0","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2026-09-17T21:21:53Z","updated":"2026-09-18T09:28:01Z"},{"id":"wordfence:ea8c6289-0497-4027-8ba3-382ee0a4f650","source":"wordfence","cve":"CVE-2026-107428","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.5.12 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea8c6289-0497-4027-8ba3-382ee0a4f650?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.5.12","to_inclusive":true,"patched_in":"7.5.13"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:52:48Z"},{"id":"wordfence:ea91769f-244c-4b11-a6e3-ea78e60b4e32","source":"wordfence","cve":"CVE-2026-25407","title":"Cookiebot by Usercentrics \u2013 Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode <= 4.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea91769f-244c-4b11-a6e3-ea78e60b4e32?source=api-prod","affected":[{"type":"plugin","slug":"cookiebot","name":"Cookiebot \u2013 Cookie Banner & Cookie Consent for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":"4.6.5"}],"published":"2026-01-29T00:00:00Z","updated":"2026-03-17T21:33:23Z"},{"id":"wordfence:ea976abe-128c-4c68-a260-6472ab307a55","source":"wordfence","cve":"CVE-2025-31795","title":"Shopify to WooCommerce Migration <= 1.3.0 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea976abe-128c-4c68-a260-6472ab307a55?source=api-prod","affected":[{"type":"plugin","slug":"migrate-shopify-to-woocommerce","name":"SWM \u2013 Shopify to WooCommerce Migration","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-10T13:28:00Z"},{"id":"wordfence:ea984974-2835-4bad-b7ca-975ad21c80e5","source":"wordfence","cve":"CVE-2024-31425","title":"Amelia <= 1.0.95 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea984974-2835-4bad-b7ca-975ad21c80e5?source=api-prod","affected":[{"type":"plugin","slug":"ameliabooking","name":"Booking for Appointments and Events Calendar \u2013 Amelia","from":"*","from_inclusive":true,"to":"1.0.95","to_inclusive":true,"patched_in":"1.0.96"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:47:22Z"},{"id":"wordfence:ea99795f-45fa-4d4c-a6bd-2197b58efcb2","source":"wordfence","cve":"CVE-2022-2387","title":"Easy Digital Downloads <= 2.11.7 - Cross-Site Request Forgery to Arbitrary Post Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea99795f-45fa-4d4c-a6bd-2197b58efcb2?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"2.11.7","to_inclusive":true,"patched_in":"3.0"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea9bff20-acbc-4f94-8684-516a8472d0cc","source":"wordfence","cve":"CVE-2025-49426","title":"Cookie Warning <= 1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9bff20-acbc-4f94-8684-516a8472d0cc?source=api-prod","affected":[{"type":"plugin","slug":"cookie-warning","name":"Cookie Warning","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-18T00:00:00Z","updated":"2025-08-25T17:20:35Z"},{"id":"wordfence:ea9ca8ac-e735-4e84-af0f-45d22a8e2124","source":"wordfence","cve":"CVE-2025-1490","title":"Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=api-prod","affected":[{"type":"plugin","slug":"smart-maintenance-mode","name":"Smart Maintenance Mode","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-03-25T14:11:16Z","updated":"2025-04-17T12:54:27Z"},{"id":"wordfence:ea9e5e5d-a7fc-4159-a2ae-610bee76f818","source":"wordfence","cve":"CVE-2024-13182","title":"WP Directorybox Manager <= 2.5 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9e5e5d-a7fc-4159-a2ae-610bee76f818?source=api-prod","affected":[{"type":"plugin","slug":"wp-directorybox-manager","name":"WP Directorybox Manager","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-12T00:00:00Z","updated":"2025-02-13T12:41:51Z"},{"id":"wordfence:ea9eaca6-3441-4976-8556-0ce288d1a0c6","source":"wordfence","cve":"CVE-2023-47815","title":"BP Profile Shortcodes Extra <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9eaca6-3441-4976-8556-0ce288d1a0c6?source=api-prod","affected":[{"type":"plugin","slug":"bp-profile-shortcodes-extra","name":"BP Profile Shortcodes Extra","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2023-11-15T00:00:00Z","updated":"2024-02-27T00:41:47Z"},{"id":"wordfence:ea9ee672-76d3-4d6a-b309-cd0023ca6c0d","source":"wordfence","cve":"","title":"Daily Deal (Unknown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ee672-76d3-4d6a-b309-cd0023ca6c0d?source=api-prod","affected":[{"type":"theme","slug":"dailydeal","name":"Daily Deal by Templatic","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":""}],"published":"2013-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ea9fff3a-c1ac-4599-aff7-d9593b74749d","source":"wordfence","cve":"CVE-2025-52765","title":"NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9fff3a-c1ac-4599-aff7-d9593b74749d?source=api-prod","affected":[{"type":"plugin","slug":"netinsight-analytics-implementation-plugin","name":"NetInsight Analytics Implementation Plugin","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T19:59:49Z"},{"id":"wordfence:eaa01222-28e4-4718-83c1-c7af91ad0326","source":"wordfence","cve":"CVE-2026-42642","title":"GiveWP <= 4.14.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa01222-28e4-4718-83c1-c7af91ad0326?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.14.5","to_inclusive":true,"patched_in":"4.14.6"}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-07T14:03:17Z"},{"id":"wordfence:eaa33acc-75a5-48c6-8891-cc037b88d246","source":"wordfence","cve":"CVE-2026-86784","title":"Visualizer <= 4.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa33acc-75a5-48c6-8891-cc037b88d246?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":true,"patched_in":"4.0.8"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:57:57Z"},{"id":"wordfence:eaa4b7b9-ea5b-46a1-847e-027bcb1fa5a6","source":"wordfence","cve":"CVE-2022-42883","title":"Quiz And Survey Master <= 7.3.10 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa4b7b9-ea5b-46a1-847e-027bcb1fa5a6?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.10","to_inclusive":true,"patched_in":"7.3.11"}],"published":"2022-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaa53088-c383-4315-9871-b4ceb83f5fdb","source":"wordfence","cve":"CVE-2026-1373","title":"Easy Author Image <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa53088-c383-4315-9871-b4ceb83f5fdb?source=api-prod","affected":[{"type":"plugin","slug":"easy-author-image","name":"Easy Author Image","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:53:59Z","updated":"2026-02-19T04:36:26Z"},{"id":"wordfence:eaa59ec3-1c53-4e9c-acff-7921fca7cf3c","source":"wordfence","cve":"CVE-2025-68908","title":"Barberry <= 2.9.9.87 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa59ec3-1c53-4e9c-acff-7921fca7cf3c?source=api-prod","affected":[{"type":"theme","slug":"barberry","name":"Barberry - Modern WooCommerce Theme","from":"*","from_inclusive":true,"to":"2.9.9.87","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T14:24:13Z"},{"id":"wordfence:eaabaadf-7881-4c4f-8987-fbba8318a458","source":"wordfence","cve":"","title":"Meks Smart Social Widget <= 1.6 - Missing Authorization to notice dimissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaabaadf-7881-4c4f-8987-fbba8318a458?source=api-prod","affected":[{"type":"plugin","slug":"meks-smart-social-widget","name":"Meks Smart Social Widget","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaac2a61-7be6-4936-82a0-21c3665fa436","source":"wordfence","cve":"CVE-2025-3428","title":"3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaac2a61-7be6-4936-82a0-21c3665fa436?source=api-prod","affected":[{"type":"plugin","slug":"3dprint-lite","name":"3DPrint Lite","from":"*","from_inclusive":true,"to":"2.1.3.6","to_inclusive":true,"patched_in":"2.1.3.7"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-08T07:01:04Z"},{"id":"wordfence:eaaf1ac0-1ea6-4bcb-a385-87267525801c","source":"wordfence","cve":"CVE-2019-16931","title":"Visualizer: Tables and Charts Manager for WordPress <= 3.3.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaaf1ac0-1ea6-4bcb-a385-87267525801c?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2019-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaafeadd-f44c-49b1-b900-ef40800c629e","source":"wordfence","cve":"CVE-2024-4442","title":"Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaafeadd-f44c-49b1-b900-ef40800c629e?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"9.9","to_inclusive":true,"patched_in":"10.0"}],"published":"2024-05-17T00:00:00Z","updated":"2024-06-26T20:41:31Z"},{"id":"wordfence:eab10127-6201-47cf-aab4-7aee6e9d5af5","source":"wordfence","cve":"CVE-2026-109927","title":"HIPAA Forms < 3.3.2 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab10127-6201-47cf-aab4-7aee6e9d5af5?source=api-prod","affected":[{"type":"plugin","slug":"codemonkeys-hipaa-forms","name":"HIPAA Forms","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":false,"patched_in":"3.3.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T20:52:45Z"},{"id":"wordfence:eab1fe39-dda2-49c9-9c76-c1127626a85c","source":"wordfence","cve":"CVE-2023-37974","title":"WP-FB-AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab1fe39-dda2-49c9-9c76-c1127626a85c?source=api-prod","affected":[{"type":"plugin","slug":"wp-fb-autoconnect","name":"WP Social AutoConnect","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eab422b8-8cf5-441e-a21f-6a0e1b7642b2","source":"wordfence","cve":"CVE-2023-4600","title":"AffiliateWP <= 2.14.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab422b8-8cf5-441e-a21f-6a0e1b7642b2?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-wp","name":"AffiliateWP","from":"2.14.0","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.14.1"}],"published":"2023-08-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eab424ac-fdc4-4984-904f-0c884d07524a","source":"wordfence","cve":"CVE-2026-116861","title":"Flexible Chat \u2013 AI chatbot plugin for WordPress and WooCommerce <= 1.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab424ac-fdc4-4984-904f-0c884d07524a?source=api-prod","affected":[{"type":"plugin","slug":"flexible-chat","name":"Flexible Chat \u2013 AI chatbot plugin for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2026-10-30T07:15:38Z","updated":"2026-11-03T19:35:47Z"},{"id":"wordfence:eab5de7e-ddab-4c6f-af87-acce7b5ff15b","source":"wordfence","cve":"CVE-2025-13366","title":"Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab5de7e-ddab-4c6f-af87-acce7b5ff15b?source=api-prod","affected":[{"type":"plugin","slug":"rabbit-hole","name":"Rabbit Hole","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:09:02Z","updated":"2025-12-12T03:21:01Z"},{"id":"wordfence:eab729ed-ec00-4be1-a738-fce8a4f26100","source":"wordfence","cve":"CVE-2015-9372","title":"Exchange Addon Membership < 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab729ed-ec00-4be1-a738-fce8a4f26100?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-membership","name":"Exchange Addon Membership","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eab85a0a-f328-4cb6-b01f-d7e57540969d","source":"wordfence","cve":"CVE-2022-3418","title":"Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload","severity":"medium","cvss":6.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab85a0a-f328-4cb6-b01f-d7e57540969d?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import","name":"WP All Import \u2013 Drag & Drop Import for CSV, XML, Excel & Google Sheets","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.9"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eab98c41-f0f2-4953-b9b3-c08e1e92c03a","source":"wordfence","cve":"","title":"BulletProof Security <= .53.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eab98c41-f0f2-4953-b9b3-c08e1e92c03a?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".53.2","to_inclusive":true,"patched_in":".53.3"}],"published":"2016-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eabb1931-19c0-4999-937e-c51f01dcf676","source":"wordfence","cve":"CVE-2025-63051","title":"REHub Framework < 19.9.9.4 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eabb1931-19c0-4999-937e-c51f01dcf676?source=api-prod","affected":[{"type":"plugin","slug":"rehub-framework","name":"reHub Framework","from":"*","from_inclusive":true,"to":"19.9.9.4","to_inclusive":false,"patched_in":"19.9.9.4"}],"published":"2025-12-06T00:00:00Z","updated":"2026-02-26T15:22:02Z"},{"id":"wordfence:eabdd744-1a72-40f2-b569-f56a1b913273","source":"wordfence","cve":"CVE-2025-4963","title":"WP Extended <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eabdd744-1a72-40f2-b569-f56a1b913273?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.15","to_inclusive":true,"patched_in":"3.0.16"}],"published":"2025-05-27T20:29:22Z","updated":"2025-05-28T09:22:14Z"},{"id":"wordfence:eabde2e7-5cd4-4c3e-959a-69e04f6350d3","source":"wordfence","cve":"CVE-2024-9624","title":"WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import","severity":"high","cvss":7.6,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-import-pro","name":"WP All Import Pro","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2024-12-16T16:25:55Z","updated":"2024-12-17T05:23:42Z"},{"id":"wordfence:eabfdf29-eca9-4e4b-b809-23a83f5a91ac","source":"wordfence","cve":"CVE-2026-1926","title":"Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eabfdf29-eca9-4e4b-b809-23a83f5a91ac?source=api-prod","affected":[{"type":"plugin","slug":"subscriptions-for-woocommerce","name":"Subscriptions for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2026-03-17T14:44:52Z","updated":"2026-03-18T03:37:14Z"},{"id":"wordfence:eac56190-4f81-464d-9737-ae2e3d4b0d0d","source":"wordfence","cve":"CVE-2025-13614","title":"Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"high","cvss":8.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eac56190-4f81-464d-9737-ae2e3d4b0d0d?source=api-prod","affected":[{"type":"plugin","slug":"cool-tag-cloud","name":"Cool Tag Cloud","from":"*","from_inclusive":true,"to":"2.29","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T20:37:03Z","updated":"2025-12-05T09:27:12Z"},{"id":"wordfence:eac6481a-8605-45e4-b5cf-fa8d79fde63a","source":"wordfence","cve":"CVE-2026-54819","title":"Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eac6481a-8605-45e4-b5cf-fa8d79fde63a?source=api-prod","affected":[{"type":"plugin","slug":"listdom","name":"Listdom: AI-powered Business Directory with Classifieds Ads Listings","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:55:56Z"},{"id":"wordfence:eac8685b-8ed9-432d-8912-b66bd62c950f","source":"wordfence","cve":"CVE-2023-47547","title":"Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected Cross-Site Scripting via date parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eac8685b-8ed9-432d-8912-b66bd62c950f?source=api-prod","affected":[{"type":"plugin","slug":"export-woocommerce","name":"Export Products, Orders & Customers for WooCommerce","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-14T12:49:20Z"},{"id":"wordfence:eac8e81c-2f6f-4a4a-9678-f5d75f4954ae","source":"wordfence","cve":"CVE-2026-1370","title":"SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eac8e81c-2f6f-4a4a-9678-f5d75f4954ae?source=api-prod","affected":[{"type":"plugin","slug":"sibs-woocommerce","name":"SIBS woocommerce payment gateway","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:30:44Z","updated":"2026-02-04T08:25:34Z"},{"id":"wordfence:eac9d9b5-6812-4fe2-9427-500d4bb2ea09","source":"wordfence","cve":"CVE-2022-2123","title":"WP Opt-in <= 1.4.1 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eac9d9b5-6812-4fe2-9427-500d4bb2ea09?source=api-prod","affected":[{"type":"plugin","slug":"wp-opt-in","name":"WP Opt-in","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eacaf990-c825-4d9b-91dc-18f6ef5caf6f","source":"wordfence","cve":"CVE-2025-26759","title":"Content Snippet Manager <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eacaf990-c825-4d9b-91dc-18f6ef5caf6f?source=api-prod","affected":[{"type":"plugin","slug":"content-snippet-manager","name":"Content Snippet Manager","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T20:59:47Z"},{"id":"wordfence:eacc5af0-3248-4819-b90e-0f5e0e6d2786","source":"wordfence","cve":"CVE-2026-115548","title":"Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eacc5af0-3248-4819-b90e-0f5e0e6d2786?source=api-prod","affected":[{"type":"plugin","slug":"quttera-web-malware-scanner","name":"Quttera ThreatSign \u2013 Web Malware Scanner for WordPress","from":"*","from_inclusive":true,"to":"4.1.0.48","to_inclusive":true,"patched_in":"4.1.0.49"}],"published":"2026-11-06T23:19:12Z","updated":"2026-11-07T11:26:35Z"},{"id":"wordfence:eacf230a-5884-4e9c-b333-823099a2126b","source":"wordfence","cve":"CVE-2026-87781","title":"LTL Freight Quotes \u2013 Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eacf230a-5884-4e9c-b333-823099a2126b?source=api-prod","affected":[{"type":"plugin","slug":"ltl-freight-quotes-odfl-edition","name":"LTL Freight Quotes \u2013 ODFL Edition","from":"4.2.11","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"4.2.19"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T14:32:18Z"},{"id":"wordfence:eacfcc78-b4c3-46ba-a9d3-302fd207dd33","source":"wordfence","cve":"CVE-2024-37517","title":"Spectra <= 2.13.7 - Missing Authorization via generate_ai_content","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eacfcc78-b4c3-46ba-a9d3-302fd207dd33?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.13.7","to_inclusive":true,"patched_in":"2.13.8"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T13:56:41Z"},{"id":"wordfence:ead108c4-ac09-42ea-95c5-e95dc514f1cb","source":"wordfence","cve":"CVE-2025-6251","title":"Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ead108c4-ac09-42ea-95c5-e95dc514f1cb?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1036","to_inclusive":true,"patched_in":"1.7.1037"}],"published":"2025-11-18T15:19:11Z","updated":"2025-11-19T03:29:39Z"},{"id":"wordfence:ead4d41c-8cd7-4593-ad18-c32cb9053229","source":"wordfence","cve":"CVE-2026-49055","title":"Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ead4d41c-8cd7-4593-ad18-c32cb9053229?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-multiple-file-upload-contact-form-7","name":"Drag and Drop Multiple File Upload for Contact Form 7","from":"*","from_inclusive":true,"to":"1.3.9.7","to_inclusive":true,"patched_in":"1.3.9.8"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:47:39Z"},{"id":"wordfence:ead5b943-731d-484a-a6b0-ca4f27eccff0","source":"wordfence","cve":"CVE-2024-32954","title":"Newsletters <= 4.9.5 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ead5b943-731d-484a-a6b0-ca4f27eccff0?source=api-prod","affected":[{"type":"plugin","slug":"newsletters-lite","name":"Newsletters","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:07:07Z"},{"id":"wordfence:ead76977-d0dc-4385-8666-c8a4694c3bbe","source":"wordfence","cve":"CVE-2022-46801","title":"Site Reviews <= 6.2.0 - Unauthenticated CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ead76977-d0dc-4385-8666-c8a4694c3bbe?source=api-prod","affected":[{"type":"plugin","slug":"site-reviews","name":"Site Reviews","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.4.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ead87d8b-2659-4e8b-a0b9-138b1db89e36","source":"wordfence","cve":"CVE-2026-2519","title":"Online Scheduling and Appointment Booking System \u2013 Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ead87d8b-2659-4e8b-a0b9-138b1db89e36?source=api-prod","affected":[{"type":"plugin","slug":"bookly-responsive-appointment-booking-tool","name":"Online Scheduling and Appointment Booking System \u2013 Bookly","from":"*","from_inclusive":true,"to":"27.0","to_inclusive":true,"patched_in":"27.1"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-09T15:22:31Z"},{"id":"wordfence:eada519e-a647-4425-9e41-b8527b592c8a","source":"wordfence","cve":"CVE-2020-10817","title":"Custom Searchable Data Entry System <= 1.7.1 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eada519e-a647-4425-9e41-b8527b592c8a?source=api-prod","affected":[{"type":"plugin","slug":"custom-searchable-data-entry-system","name":"Custom Searchable Data Entry System","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2020-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eadbfb77-fb9a-4363-acc8-8dd9b87820eb","source":"wordfence","cve":"CVE-2022-43504","title":"WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eadbfb77-fb9a-4363-acc8-8dd9b87820eb?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-08-05T20:03:10Z"},{"id":"wordfence:eade6ab0-ff79-4107-83ce-e85b37d97442","source":"wordfence","cve":"CVE-2025-2319","title":"EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eade6ab0-ff79-4107-83ce-e85b37d97442?source=api-prod","affected":[{"type":"plugin","slug":"elisqlreports","name":"EZ SQL Reports Shortcode Widget and DB Backup","from":"4.11.13","from_inclusive":true,"to":"5.25.08","to_inclusive":true,"patched_in":"5.25.10"}],"published":"2025-03-24T19:32:54Z","updated":"2025-03-25T18:50:45Z"},{"id":"wordfence:eae0783a-a409-4947-b837-aee219b4d445","source":"wordfence","cve":"CVE-2025-8780","title":"Livemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae0783a-a409-4947-b837-aee219b4d445?source=api-prod","affected":[{"type":"plugin","slug":"livemesh-siteorigin-widgets","name":"Livemesh SiteOrigin Widgets","from":"*","from_inclusive":true,"to":"3.9.1","to_inclusive":true,"patched_in":"3.9.2"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-13T08:21:16Z"},{"id":"wordfence:eae14ac7-ebc1-45a1-b0dd-fec2bbb14460","source":"wordfence","cve":"CVE-2024-12338","title":"Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae14ac7-ebc1-45a1-b0dd-fec2bbb14460?source=api-prod","affected":[{"type":"plugin","slug":"website-toolbox-forums","name":"Website Toolbox Forum","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-12-11T15:16:25Z","updated":"2024-12-21T16:13:11Z"},{"id":"wordfence:eae1c878-3df9-47af-8283-de3d5acb219a","source":"wordfence","cve":"CVE-2024-13751","title":"3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae1c878-3df9-47af-8283-de3d5acb219a?source=api-prod","affected":[{"type":"plugin","slug":"3d-photo-gallery","name":"3D Photo Gallery","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-20T15:03:04Z","updated":"2025-02-21T03:21:23Z"},{"id":"wordfence:eae1ee2c-1be5-4be5-8873-f99c8fdd41ba","source":"wordfence","cve":"","title":"lote27 (All Versions) - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae1ee2c-1be5-4be5-8873-f99c8fdd41ba?source=api-prod","affected":[{"type":"theme","slug":"lote27","name":"lote27","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eae4eeec-62f8-4a33-98ce-2ef5b516f0c7","source":"wordfence","cve":"CVE-2026-85126","title":"Crowdfundly <= 2.2.2 - Authenticated (Crowdfundly Manager+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae4eeec-62f8-4a33-98ce-2ef5b516f0c7?source=api-prod","affected":[{"type":"plugin","slug":"crowdfundly","name":"Crowdfundly","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-14T15:28:36Z"},{"id":"wordfence:eae61f87-a624-452a-8fb7-5a0ed9e83799","source":"wordfence","cve":"CVE-2026-27410","title":"SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae61f87-a624-452a-8fb7-5a0ed9e83799?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":false,"patched_in":"5.4.0"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:20:19Z"},{"id":"wordfence:eae9b960-36b1-4b83-855a-d1beaa60a93f","source":"wordfence","cve":"CVE-2024-33914","title":"Exclusive Addons Elementor <= 2.6.9.1 - Missing Authorization to Post Duplication","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eae9b960-36b1-4b83-855a-d1beaa60a93f?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9.1","to_inclusive":true,"patched_in":"2.6.9.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-07T18:11:23Z"},{"id":"wordfence:eaea07ad-e6f1-4f23-a508-94203967af7f","source":"wordfence","cve":"CVE-2019-17672","title":"WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaea07ad-e6f1-4f23-a508-94203967af7f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.30","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.28","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.27","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.24","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.20","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.19","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.18","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.13","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.14","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.10","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.11","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"3.7.31"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2019-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaea5a3b-6565-4aa0-864d-5a2b764075fd","source":"wordfence","cve":"CVE-2026-92712","title":"ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaea5a3b-6565-4aa0-864d-5a2b764075fd?source=api-prod","affected":[{"type":"plugin","slug":"reactpress","name":"ReactPress","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T20:25:05Z","updated":"2026-09-30T08:28:04Z"},{"id":"wordfence:eaead805-b122-4418-a4a0-cf1b0925f3c3","source":"wordfence","cve":"CVE-2023-40557","title":"Tabs & Accordion <= 1.3.10 - Authenticated (Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaead805-b122-4418-a4a0-cf1b0925f3c3?source=api-prod","affected":[{"type":"plugin","slug":"tabs","name":"Tabs & Accordion","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaeadd4b-a6f5-45fd-9324-77cf2e3bb978","source":"wordfence","cve":"CVE-2025-58221","title":"PilotPress <= 2.0.39 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaeadd4b-a6f5-45fd-9324-77cf2e3bb978?source=api-prod","affected":[{"type":"plugin","slug":"pilotpress","name":"PilotPress","from":"*","from_inclusive":true,"to":"2.0.39","to_inclusive":true,"patched_in":"2.0.41"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-13T16:56:50Z"},{"id":"wordfence:eaebcae4-cdf5-4eb7-9246-07185fe62d07","source":"wordfence","cve":"CVE-2023-46071","title":"Protecci\u00f3n de Datos RGPD <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaebcae4-cdf5-4eb7-9246-07185fe62d07?source=api-prod","affected":[{"type":"plugin","slug":"click-datos-lopd","name":"Protecci\u00f3n de Datos RGPD","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaf0d324-bf2c-4da7-b2ab-f53f7b7881f2","source":"wordfence","cve":"CVE-2021-25056","title":"Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf0d324-bf2c-4da7-b2ab-f53f7b7881f2?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.10"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaf17a09-3e35-4df8-acb9-7829942597c6","source":"wordfence","cve":"","title":"Woffice CRM <= 4.0.1 - Authorization Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf17a09-3e35-4df8-acb9-7829942597c6?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2021-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eaf19371-7b06-45c6-bf16-6ef7dfffb175","source":"wordfence","cve":"CVE-2024-10261","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf19371-7b06-45c6-bf16-6ef7dfffb175?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.13.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T11:19:45Z"},{"id":"wordfence:eaf32034-8749-4eba-8bf0-a440d78c455a","source":"wordfence","cve":"CVE-2025-31601","title":"Appointy Appointment Scheduler <= 4.2.1 - Cross-Site Request Forgery to Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf32034-8749-4eba-8bf0-a440d78c455a?source=api-prod","affected":[{"type":"plugin","slug":"appointy-appointment-scheduler","name":"WordPress Appointment Booking and Online Scheduling Plugin by Appointy","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:03:57Z"},{"id":"wordfence:eaf66cf7-c010-4785-bde0-a82ff7809fb1","source":"wordfence","cve":"CVE-2025-32476","title":"Advanced Tag Lists <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf66cf7-c010-4785-bde0-a82ff7809fb1?source=api-prod","affected":[{"type":"plugin","slug":"advanced-tag-list","name":"Advanced Tag Lists","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:16:02Z"},{"id":"wordfence:eaf9cc48-1ba6-4e9b-9f49-54f7747c26e0","source":"wordfence","cve":"CVE-2024-6599","title":"Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf9cc48-1ba6-4e9b-9f49-54f7747c26e0?source=api-prod","affected":[{"type":"plugin","slug":"meks-video-importer","name":"Meks Video Importer","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2024-07-17T12:58:49Z","updated":"2024-07-31T21:23:58Z"},{"id":"wordfence:eafab8a2-6989-4923-9474-925cc6ef3e81","source":"wordfence","cve":"CVE-2025-58991","title":"WooCommerce Booking Bundle Hours <= 0.7.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eafab8a2-6989-4923-9474-925cc6ef3e81?source=api-prod","affected":[{"type":"plugin","slug":"woo-booking-bundle-hours","name":"WooCommerce Booking Bundle Hours","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":"0.7.5"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:19:37Z"},{"id":"wordfence:eafe73b4-b492-45c7-adca-d9a3042144b4","source":"wordfence","cve":"CVE-2024-10360","title":"Move Addons for Elementor <= 1.3.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eafe73b4-b492-45c7-adca-d9a3042144b4?source=api-prod","affected":[{"type":"plugin","slug":"move-addons","name":"Move Addons for Elementor","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-10-28T00:00:00Z","updated":"2024-10-29T11:01:36Z"},{"id":"wordfence:eb022e51-32fd-403e-a9b3-34114e957020","source":"wordfence","cve":"CVE-2023-5931","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.6.15 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb022e51-32fd-403e-a9b3-34114e957020?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.6.15","to_inclusive":true,"patched_in":"4.6.16"}],"published":"2023-11-29T00:00:00Z","updated":"2024-02-06T15:38:41Z"},{"id":"wordfence:eb027f2b-097a-482a-a575-f4bd5881c919","source":"wordfence","cve":"CVE-2024-49697","title":"Sunshine Photo Cart <= 3.2.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb027f2b-097a-482a-a575-f4bd5881c919?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.2.10"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:31:25Z"},{"id":"wordfence:eb0389e2-ab65-4652-a3e9-521dfd2e54a8","source":"wordfence","cve":"CVE-2026-122227","title":"Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0389e2-ab65-4652-a3e9-521dfd2e54a8?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.28","to_inclusive":true,"patched_in":"3.5.29"}],"published":"2026-11-12T21:02:46Z","updated":"2026-11-13T09:35:16Z"},{"id":"wordfence:eb064156-f54b-4401-9d4f-29f0952deb24","source":"wordfence","cve":"CVE-2026-7649","title":"ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb064156-f54b-4401-9d4f-29f0952deb24?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.6"}],"published":"2026-05-01T17:37:03Z","updated":"2026-06-05T12:21:41Z"},{"id":"wordfence:eb06c43c-bf8c-412b-8b1d-fee004d728d2","source":"wordfence","cve":"CVE-2024-12881","title":"PlugVersions \u2013 Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb06c43c-bf8c-412b-8b1d-fee004d728d2?source=api-prod","affected":[{"type":"plugin","slug":"plugversions","name":"PlugVersions \u2013 Easily roll back to previous versions of your plugins.","from":"*","from_inclusive":true,"to":"0.0.7","to_inclusive":true,"patched_in":"0.0.8"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T09:22:23Z"},{"id":"wordfence:eb075839-5669-4a5a-b225-f7ea98672490","source":"wordfence","cve":"CVE-2026-81779","title":"Newspapers X 1.0.46 - 1.0.48 - Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb075839-5669-4a5a-b225-f7ea98672490?source=api-prod","affected":[{"type":"theme","slug":"newspapers-x","name":"Newspapers X","from":"1.0.46","from_inclusive":true,"to":"1.0.48","to_inclusive":true,"patched_in":"1.0.49"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T13:54:14Z"},{"id":"wordfence:eb088999-0727-4645-890b-f584b85cda48","source":"wordfence","cve":"CVE-2021-24177","title":"WP File Manager <= 7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb088999-0727-4645-890b-f584b85cda48?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":false,"patched_in":"7.1"}],"published":"2021-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb0892fd-b5dd-4dc8-bc45-41c05f1c03cf","source":"wordfence","cve":"CVE-2025-32205","title":"Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Path Traversal","severity":"low","cvss":3.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0892fd-b5dd-4dc8-bc45-41c05f1c03cf?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.30","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:47:40Z"},{"id":"wordfence:eb0b9c2b-c536-4697-be4c-7557ba66c2c4","source":"wordfence","cve":"","title":"WPML <= 4.5.10 - Unprotected AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0b9c2b-c536-4697-be4c-7557ba66c2c4?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.5.10","to_inclusive":true,"patched_in":"4.5.11"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb0bbf47-a8c7-489d-a758-7b5771c2fcbd","source":"wordfence","cve":"CVE-2026-65552","title":"Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0bbf47-a8c7-489d-a758-7b5771c2fcbd?source=api-prod","affected":[{"type":"plugin","slug":"export-user-data","name":"Export User Data","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:30:17Z"},{"id":"wordfence:eb0d3b72-2ea6-48ce-b474-0253c7bb5413","source":"wordfence","cve":"CVE-2026-28067","title":"Bassein <= 1.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0d3b72-2ea6-48ce-b474-0253c7bb5413?source=api-prod","affected":[{"type":"theme","slug":"bassein","name":"Bassein | Swimming Pool Cleaning & Maintenance WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:44:57Z"},{"id":"wordfence:eb0fb0a7-b9f7-42db-b826-fc09090bd817","source":"wordfence","cve":"CVE-2026-15652","title":"Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb0fb0a7-b9f7-42db-b826-fc09090bd817?source=api-prod","affected":[{"type":"plugin","slug":"easy-accordion-free","name":"Easy Accordion \u2013 AI-Powered FAQ & Accordion Blocks, Product FAQ","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2026-07-15T13:50:50Z","updated":"2026-07-16T02:30:59Z"},{"id":"wordfence:eb115a8a-35f8-426f-bb67-4a523f67cb34","source":"wordfence","cve":"CVE-2026-110732","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb115a8a-35f8-426f-bb67-4a523f67cb34?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2026-10-29T18:00:34Z","updated":"2026-10-30T06:47:32Z"},{"id":"wordfence:eb117172-c853-4448-9648-367bb9a0d2c2","source":"wordfence","cve":"CVE-2022-4831","title":"Custom User Profile Fields <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb117172-c853-4448-9648-367bb9a0d2c2?source=api-prod","affected":[{"type":"plugin","slug":"pmpro-register-helper","name":"Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.8.1"}],"published":"2023-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb138c9c-49c2-4534-bb37-ca163d035f46","source":"wordfence","cve":"CVE-2026-92967","title":"Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb138c9c-49c2-4534-bb37-ca163d035f46?source=api-prod","affected":[{"type":"plugin","slug":"pochipp","name":"Pochipp","from":"*","from_inclusive":true,"to":"1.20.2","to_inclusive":true,"patched_in":"1.20.3"}],"published":"2026-09-18T13:58:04Z","updated":"2026-09-19T02:27:13Z"},{"id":"wordfence:eb14896f-7f0e-4168-8a2d-309bbaddbedc","source":"wordfence","cve":"CVE-2024-10519","title":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb14896f-7f0e-4168-8a2d-309bbaddbedc?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce-pro","name":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO","from":"3.0.8","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.1.3"},{"type":"plugin","slug":"wish-list-for-woocommerce-pro","name":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO","from":"3.0.9","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.3"},{"type":"plugin","slug":"wish-list-for-woocommerce-pro","name":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO","from":"3.1.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.3"},{"type":"plugin","slug":"wish-list-for-woocommerce-pro","name":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO","from":"3.1.1","from_inclusive":true,"to":"3.1.1","to_inclusive":true,"patched_in":"3.1.3"},{"type":"plugin","slug":"wish-list-for-woocommerce-pro","name":"Wishlist for WooCommerce: Multi Wishlists Per Customer PRO","from":"3.1.2","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2024-11-22T20:57:09Z","updated":"2025-04-11T19:43:32Z"},{"id":"wordfence:eb14f084-6f36-4702-8a28-b62811739407","source":"wordfence","cve":"CVE-2025-14616","title":"Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb14f084-6f36-4702-8a28-b62811739407?source=api-prod","affected":[{"type":"plugin","slug":"recooty","name":"Recooty \u2013 Job Widget (Old Dashboard)","from":"1.0.1","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:48:45Z","updated":"2026-01-28T11:23:44Z"},{"id":"wordfence:eb14f2ed-6ae8-409e-86fc-c305a56f5d5b","source":"wordfence","cve":"CVE-2025-5753","title":"Valuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb14f2ed-6ae8-409e-86fc-c305a56f5d5b?source=api-prod","affected":[{"type":"plugin","slug":"commercial-real-estate-valuation-calculator","name":"Commercial Real Estate Valuation Calculator","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2025-07-22T14:01:48Z","updated":"2025-08-11T14:01:12Z"},{"id":"wordfence:eb19296a-6439-4c3f-be41-d06ccf7ca1fa","source":"wordfence","cve":"CVE-2026-110035","title":"Salon Booking System <= 10.31.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb19296a-6439-4c3f-be41-d06ccf7ca1fa?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.10","to_inclusive":true,"patched_in":"10.31.11"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T18:16:08Z"},{"id":"wordfence:eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb","source":"wordfence","cve":"CVE-2025-11835","title":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1948bd-c5b4-4fbe-9aa6-19f24325e6bb?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.16.4","to_inclusive":true,"patched_in":"2.16.5"}],"published":"2025-11-04T14:36:11Z","updated":"2025-11-05T03:27:58Z"},{"id":"wordfence:eb1a2611-5cab-4940-ae9c-77a172fdbef7","source":"wordfence","cve":"CVE-2025-49360","title":"Militarology <= 1.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1a2611-5cab-4940-ae9c-77a172fdbef7?source=api-prod","affected":[{"type":"theme","slug":"militarology","name":"Militarology - Military Service & Army Veterans WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:20:42Z"},{"id":"wordfence:eb1b6443-31b4-4ee6-a827-fe749a48383f","source":"wordfence","cve":"CVE-2025-23497","title":"Simple Project Manager <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1b6443-31b4-4ee6-a827-fe749a48383f?source=api-prod","affected":[{"type":"plugin","slug":"simple-project-managment","name":"Simple Project Manager","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:37:28Z"},{"id":"wordfence:eb1dca2f-5196-4f68-9c22-e8f4b3c99742","source":"wordfence","cve":"CVE-2025-6027","title":"Ace User Management <= 2.0.3 - Unauthenticated Privilege Escalation via Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1dca2f-5196-4f68-9c22-e8f4b3c99742?source=api-prod","affected":[{"type":"plugin","slug":"ace-user-management","name":"Ace User Management","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-15T00:00:00Z","updated":"2025-11-12T14:09:12Z"},{"id":"wordfence:eb1f5fc6-9e0e-423a-bd71-32e12d201c37","source":"wordfence","cve":"CVE-2024-32080","title":"Search Keyword Redirect <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb1f5fc6-9e0e-423a-bd71-32e12d201c37?source=api-prod","affected":[{"type":"plugin","slug":"wp-search-keyword-redirect","name":"Search Keyword Redirect","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-16T16:10:29Z"},{"id":"wordfence:eb23c4d7-d9be-4162-bb7b-8a74f3c339eb","source":"wordfence","cve":"CVE-2021-25030","title":"Events Made Easy <= 2.2.35 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb23c4d7-d9be-4162-bb7b-8a74f3c339eb?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"2.2.35","to_inclusive":true,"patched_in":"2.2.36"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb23cb93-0d1e-41b4-98f0-7cd1783dca30","source":"wordfence","cve":"CVE-2026-42716","title":"payever \u2013 WooCommerce Gateway <= 4.8.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb23cb93-0d1e-41b4-98f0-7cd1783dca30?source=api-prod","affected":[{"type":"plugin","slug":"payever-woocommerce-gateway","name":"payever Checkout \u2013 Composable Payment Gateway","from":"*","from_inclusive":true,"to":"4.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:24:57Z"},{"id":"wordfence:eb271cc8-01ec-45eb-9d6f-efc55c7c3923","source":"wordfence","cve":"CVE-2015-10138","title":"Work The Flow File Upload <= 2.5.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb271cc8-01ec-45eb-9d6f-efc55c7c3923?source=api-prod","affected":[{"type":"plugin","slug":"work-the-flow-file-upload","name":"Work The Flow File Upload","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2015-03-14T00:00:00Z","updated":"2025-07-19T11:23:38Z"},{"id":"wordfence:eb2776d8-1e2f-46fb-9d3b-693c8fa115b3","source":"wordfence","cve":"CVE-2023-46783","title":"Pre-Orders for WooCommerce <= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2776d8-1e2f-46fb-9d3b-693c8fa115b3?source=api-prod","affected":[{"type":"plugin","slug":"pre-orders-for-woocommerce","name":"Pre-Orders for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb290fa8-206e-44c6-9107-8a896225664c","source":"wordfence","cve":"CVE-2021-39334","title":"Job Board Vanila Plugin <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb290fa8-206e-44c6-9107-8a896225664c?source=api-prod","affected":[{"type":"plugin","slug":"job-board-vanilla","name":"Job Board Vanila Plugin","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-10-14T13:46:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb2918c4-b9b5-4cc3-a4fa-625944984a20","source":"wordfence","cve":"CVE-2024-29771","title":"Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2918c4-b9b5-4cc3-a4fa-625944984a20?source=api-prod","affected":[{"type":"plugin","slug":"dracula-dark-mode","name":"Dracula Dark Mode \u2013  Accessibility, Reading Mode & Dark Mode for WordPress","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T17:07:58Z"},{"id":"wordfence:eb299b03-a176-43b3-beca-944c32a5af49","source":"wordfence","cve":"","title":"BP Group Documents <= 1.2 -  Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb299b03-a176-43b3-beca-944c32a5af49?source=api-prod","affected":[{"type":"plugin","slug":"bp-group-documents","name":"BP Group Documents","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2013-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb2cda13-4fc8-4158-9462-db20fb0965bd","source":"wordfence","cve":"CVE-2014-4544","title":"Podcast Channels <= 0.20 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2cda13-4fc8-4158-9462-db20fb0965bd?source=api-prod","affected":[{"type":"plugin","slug":"podcast-channels","name":"Podcast Channels","from":"*","from_inclusive":true,"to":"0.21","to_inclusive":false,"patched_in":"0.21"}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb2f39fe-b498-42ee-8614-e05acb2b2cde","source":"wordfence","cve":"CVE-2024-54335","title":"ImmoToolBox Connect <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2f39fe-b498-42ee-8614-e05acb2b2cde?source=api-prod","affected":[{"type":"plugin","slug":"immotoolbox-connect","name":"ImmoToolBox Connect","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:15:27Z"},{"id":"wordfence:eb2f6c67-ef4a-4afc-bd61-6c0185e354a8","source":"wordfence","cve":"CVE-2025-12558","title":"Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2f6c67-ef4a-4afc-bd61-6c0185e354a8?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.4.1"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-09T13:51:11Z"},{"id":"wordfence:eb329862-8cfa-49a5-b9cb-908acc4182e3","source":"wordfence","cve":"CVE-2015-9378","title":"Market < 5.1.27 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb329862-8cfa-49a5-b9cb-908acc4182e3?source=api-prod","affected":[{"type":"theme","slug":"BuilderChild-Market","name":"Market","from":"*","from_inclusive":true,"to":"5.1.27","to_inclusive":false,"patched_in":"5.1.27"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb32a095-7d2b-4a57-9d91-f79fb3486f9a","source":"wordfence","cve":"","title":"Copy or Move Comments < 1.0.1 - Cross-Site Scripting and SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb32a095-7d2b-4a57-9d91-f79fb3486f9a?source=api-prod","affected":[{"type":"plugin","slug":"copy-or-move-comments","name":"Copy or Move Comments","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":false,"patched_in":"1.0.1"}],"published":"2015-06-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb35b27f-e938-4a51-b441-887d23b7082a","source":"wordfence","cve":"CVE-2024-29919","title":"Photo Gallery by Ays <= 5.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb35b27f-e938-4a51-b441-887d23b7082a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-photo-gallery","name":"Photo Gallery by Ays \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"5.5.2","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T13:57:04Z"},{"id":"wordfence:eb360c56-e144-4dc5-8bfb-715a014cb8e6","source":"wordfence","cve":"CVE-2024-11975","title":"Reactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb360c56-e144-4dc5-8bfb-715a014cb8e6?source=api-prod","affected":[{"type":"plugin","slug":"reactflow-session-replay-heatmap","name":"Reactflow Visitor Recording and Heatmaps","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T18:46:32Z","updated":"2025-05-12T14:02:42Z"},{"id":"wordfence:eb367998-5c5c-4c4d-81cb-519023f028e6","source":"wordfence","cve":"","title":"W3 Total Cache <= 0.9.4.1 - Arbitrary Code Execution via settings import","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb367998-5c5c-4c4d-81cb-519023f028e6?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"0.9.4.1","to_inclusive":true,"patched_in":"0.9.5"}],"published":"2016-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb38024c-880d-4d22-b81a-412d46183e1b","source":"wordfence","cve":"CVE-2024-7713","title":"AI ChatBot with ChatGPT and Content Generator by AYS <= 2.0.9 - Unauthenticated OpenAI Key Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb38024c-880d-4d22-b81a-412d46183e1b?source=api-prod","affected":[{"type":"plugin","slug":"ays-chatgpt-assistant","name":"AI ChatBot with ChatGPT and Content Generator by AYS","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-09-05T00:00:00Z","updated":"2024-10-04T17:23:56Z"},{"id":"wordfence:eb38027a-1ee2-452a-b9b8-c1b47edbd08f","source":"wordfence","cve":"CVE-2025-22579","title":"WP Header Notification <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb38027a-1ee2-452a-b9b8-c1b47edbd08f?source=api-prod","affected":[{"type":"plugin","slug":"wp-header-notification","name":"WP Header Notification","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:50:48Z"},{"id":"wordfence:eb3817f6-b630-4dfe-90d5-a96673bb8a85","source":"wordfence","cve":"CVE-2026-32517","title":"Contact Manager <= 9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3817f6-b630-4dfe-90d5-a96673bb8a85?source=api-prod","affected":[{"type":"plugin","slug":"contact-manager","name":"Contact Manager","from":"*","from_inclusive":true,"to":"9.1","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:46:49Z"},{"id":"wordfence:eb3a26c7-8693-4a1d-a2b9-c548ef3c0ee0","source":"wordfence","cve":"CVE-2025-58972","title":"Barcode Scanner with Inventory & Order Manager <= 1.10.4 - Authenticated (Shop Manager+) Directory Traversal","severity":"low","cvss":2.7,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3a26c7-8693-4a1d-a2b9-c548ef3c0ee0?source=api-prod","affected":[{"type":"plugin","slug":"barcode-scanner-lite-pos-to-manage-products-inventory-and-orders","name":"Barcode Scanner (+Mobile App) \u2013 Inventory manager, Order fulfillment system, POS (Point of Sale)","from":"*","from_inclusive":true,"to":"1.10.4","to_inclusive":true,"patched_in":"1.10.5"}],"published":"2025-10-15T00:00:00Z","updated":"2025-10-29T15:56:51Z"},{"id":"wordfence:eb3a7623-ced8-4738-8a95-a3eda7e86ec1","source":"wordfence","cve":"CVE-2014-100026","title":"April's Super Functions Pack  <= 1.4.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3a7623-ced8-4738-8a95-a3eda7e86ec1?source=api-prod","affected":[{"type":"plugin","slug":"aprils-super-functions-pack","name":"April's Super Functions Pack","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2014-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb3aa518-ef12-4168-a524-ad36397f67cb","source":"wordfence","cve":"CVE-2018-5374","title":"Dbox 3D Slider Lite <= 1.2.2 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3aa518-ef12-4168-a524-ad36397f67cb?source=api-prod","affected":[{"type":"plugin","slug":"dbox-slider-lite","name":"Dbox 3D Slider Lite","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2018-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb3b3d65-70ee-4c9e-9e2f-18afc7368bbd","source":"wordfence","cve":"CVE-2024-51648","title":"e-shops <= 1.0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3b3d65-70ee-4c9e-9e2f-18afc7368bbd?source=api-prod","affected":[{"type":"plugin","slug":"e-shops-cart2","name":"e-shops\u30ab\u30fc\u30c82","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-11-01T00:00:00Z","updated":"2025-07-08T15:14:53Z"},{"id":"wordfence:eb3c0108-dfb6-4786-af04-9d54cb22c74c","source":"wordfence","cve":"CVE-2021-24823","title":"Support Board < 3.3.6 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3c0108-dfb6-4786-af04-9d54cb22c74c?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":false,"patched_in":"3.3.6"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb3d1737-1495-4e9f-b80c-3f09cf19d22f","source":"wordfence","cve":"CVE-2026-42696","title":"SiteVault \u2013 Backup, Restore, Migration & Cloning <= 1.5.19 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3d1737-1495-4e9f-b80c-3f09cf19d22f?source=api-prod","affected":[{"type":"plugin","slug":"sitevault-backup-restore-migration","name":"SiteVault \u2013 Backup, Restore, Migration & Cloning","from":"*","from_inclusive":true,"to":"1.5.19","to_inclusive":true,"patched_in":"1.5.20"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-13T17:02:43Z"},{"id":"wordfence:eb3ef121-13ea-4e42-90c1-1f4bd31ebbcf","source":"wordfence","cve":"CVE-2020-36760","title":"Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3ef121-13ea-4e42-90c1-1f4bd31ebbcf?source=api-prod","affected":[{"type":"plugin","slug":"ocean-extra","name":"Ocean Extra","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":false,"patched_in":"1.6.6"}],"published":"2020-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb40f948-1252-4b6d-8c2d-3eb0e1f08987","source":"wordfence","cve":"CVE-2017-18610","title":"Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-group-id parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb40f948-1252-4b6d-8c2d-3eb0e1f08987?source=api-prod","affected":[{"type":"plugin","slug":"magic-fields","name":"Magic Fields","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2019-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb43502e-dedd-46ff-b8e8-68298779f125","source":"wordfence","cve":"CVE-2025-13682","title":"Trail Manager <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb43502e-dedd-46ff-b8e8-68298779f125?source=api-prod","affected":[{"type":"plugin","slug":"trail-manager","name":"Trail Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T20:38:39Z","updated":"2025-12-05T09:27:04Z"},{"id":"wordfence:eb43a145-2f35-456d-bccb-671f381db1ce","source":"wordfence","cve":"CVE-2026-57619","title":"Elementor Website Builder \u2013 more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb43a145-2f35-456d-bccb-671f381db1ce?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T13:22:25Z"},{"id":"wordfence:eb4487e3-4276-4a7e-bf6f-e8ec49bb29f2","source":"wordfence","cve":"CVE-2024-32948","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.28 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb4487e3-4276-4a7e-bf6f-e8ec49bb29f2?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.28","to_inclusive":true,"patched_in":"4.0.29"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T14:31:24Z"},{"id":"wordfence:eb49e8d5-1f4f-46d1-8206-0a43b4284f19","source":"wordfence","cve":"","title":"My Chatbot <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb49e8d5-1f4f-46d1-8206-0a43b4284f19?source=api-prod","affected":[{"type":"plugin","slug":"my-chatbot","name":"My Chatbot","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb4b1871-7c13-4f7c-93b5-d5254f89da8f","source":"wordfence","cve":"CVE-2022-4775","title":"GeoDirectory <= 2.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb4b1871-7c13-4f7c-93b5-d5254f89da8f?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.2.21","to_inclusive":true,"patched_in":"2.2.22"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb4dda86-4abb-49b6-8c71-beae65ec9832","source":"wordfence","cve":"CVE-2025-31769","title":"CLP \u2013 Custom Login Page by NiteoThemes <= 1.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb4dda86-4abb-49b6-8c71-beae65ec9832?source=api-prod","affected":[{"type":"plugin","slug":"clp-custom-login-page","name":"CLP \u2013 Custom Login Page by NiteoThemes","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:06:43Z"},{"id":"wordfence:eb519441-2598-4907-8e49-036c455176ad","source":"wordfence","cve":"CVE-2017-10991","title":"WP Statistics <= 12.0.9 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb519441-2598-4907-8e49-036c455176ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"12.0.9","to_inclusive":true,"patched_in":"12.0.10"}],"published":"2017-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb51f6c6-8685-4b09-8b5f-78884d01bbe4","source":"wordfence","cve":"CVE-2026-57798","title":"NewsPlus Shortcodes <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb51f6c6-8685-4b09-8b5f-78884d01bbe4?source=api-prod","affected":[{"type":"plugin","slug":"newsplus-shortcodes","name":"NewsPlus Shortcodes","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-08T19:53:37Z"},{"id":"wordfence:eb53282a-2298-4582-92bf-59221089172e","source":"wordfence","cve":"CVE-2025-58672","title":"WP User Frontend <= 4.1.12 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb53282a-2298-4582-92bf-59221089172e?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"4.1.13"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T21:12:15Z"},{"id":"wordfence:eb5398a8-840d-4d08-b03d-b5edded7ba64","source":"wordfence","cve":"CVE-2024-53821","title":"Pie Register Premium < 3.8.3.3 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb5398a8-840d-4d08-b03d-b5edded7ba64?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.3.3","to_inclusive":false,"patched_in":"3.8.3.3"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T19:03:49Z"},{"id":"wordfence:eb562efb-eb17-4366-9f6d-02653df6ece1","source":"wordfence","cve":"CVE-2019-17232","title":"Ultimate FAQ <= 1.8.24 - Unauthenticated Options Import/Export","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb562efb-eb17-4366-9f6d-02653df6ece1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-faqs","name":"Ultimate FAQ Accordion Plugin","from":"*","from_inclusive":true,"to":"1.8.25","to_inclusive":false,"patched_in":"1.8.25"}],"published":"2019-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb5646f4-3b62-4fe2-a303-fafc9c41daf5","source":"wordfence","cve":"CVE-2026-39742","title":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor <= 3.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb5646f4-3b62-4fe2-a303-fafc9c41daf5?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.8.0.2","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-10-29T14:20:00Z","updated":"2026-11-03T19:56:51Z"},{"id":"wordfence:eb56da48-c928-42d4-8c71-de72f879d430","source":"wordfence","cve":"CVE-2016-5838","title":"WordPress Core < 4.5.3 - Password Change via Stolen Cookie","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb56da48-c928-42d4-8c71-de72f879d430?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb5749c1-b092-4fb9-8c04-f750bc5ae5e0","source":"wordfence","cve":"CVE-2026-12877","title":"Software Issue Manager <= 5.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb5749c1-b092-4fb9-8c04-f750bc5ae5e0?source=api-prod","affected":[{"type":"plugin","slug":"software-issue-manager","name":"Project Management, Bug and Issue Tracking Plugin \u2013 Software Issue Manager","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-29T22:40:20Z"},{"id":"wordfence:eb584c65-7068-4c98-a09d-f8c2efad4ab5","source":"wordfence","cve":"CVE-2026-17541","title":"Bit File Manager <= 6.9.0 - Unauthenticated File Activity Log Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb584c65-7068-4c98-a09d-f8c2efad4ab5?source=api-prod","affected":[{"type":"plugin","slug":"file-manager","name":"File Manager","from":"*","from_inclusive":true,"to":"6.9.0","to_inclusive":true,"patched_in":"6.9.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-21T15:47:17Z"},{"id":"wordfence:eb58dd93-3789-46c6-bfca-7866427e077d","source":"wordfence","cve":"CVE-2025-39459","title":"Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb58dd93-3789-46c6-bfca-7866427e077d?source=api-prod","affected":[{"type":"theme","slug":"realestate-7","name":"Real Estate 7 WordPress","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:08:09Z"},{"id":"wordfence:eb597253-77a3-476f-92e4-4c5029fd5c64","source":"wordfence","cve":"CVE-2026-88793","title":"YouTube Embed \u2013 YouTube Gallery, Vimeo Gallery \u2013 WordPress Plugin 10.0 - 10.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb597253-77a3-476f-92e4-4c5029fd5c64?source=api-prod","affected":[{"type":"plugin","slug":"youram-youtube-embed","name":"YouTube Embed \u2013 YouTube Gallery, Vimeo Gallery \u2013 WordPress Plugin","from":"10.0","from_inclusive":true,"to":"10.3","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:53:26Z"},{"id":"wordfence:eb5a85ba-9545-4d64-ac7c-6b856e4ab354","source":"wordfence","cve":"CVE-2024-13392","title":"Rate Star Review Vote \u2013 AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb5a85ba-9545-4d64-ac7c-6b856e4ab354?source=api-prod","affected":[{"type":"plugin","slug":"rate-star-review","name":"Rate Star Review Vote \u2013 AJAX Reviews, Votes, Star Ratings","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:11:24Z"},{"id":"wordfence:eb6036a5-4667-481f-93fb-e8ee7cd42c83","source":"wordfence","cve":"CVE-2025-57950","title":"Plugin Security Scanner <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6036a5-4667-481f-93fb-e8ee7cd42c83?source=api-prod","affected":[{"type":"plugin","slug":"plugin-security-scanner","name":"Plugin Security Scanner","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T15:59:02Z"},{"id":"wordfence:eb60c1eb-9260-4fb8-a740-c6a4f8fcaf82","source":"wordfence","cve":"CVE-2024-51650","title":"Random Featured Post <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb60c1eb-9260-4fb8-a740-c6a4f8fcaf82?source=api-prod","affected":[{"type":"plugin","slug":"random-featured-post-plugin","name":"Random Featured Post","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:15:38Z"},{"id":"wordfence:eb60e5c8-cbda-4488-816c-a7fdf2b39fd6","source":"wordfence","cve":"CVE-2024-9371","title":"Branda \u2013 White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb60e5c8-cbda-4488-816c-a7fdf2b39fd6?source=api-prod","affected":[{"type":"plugin","slug":"branda-white-labeling","name":"Branda \u2013 White Label & Branding, Free Login Page Customizer","from":"*","from_inclusive":true,"to":"3.4.21","to_inclusive":true,"patched_in":"3.4.22"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T04:24:27Z"},{"id":"wordfence:eb613de8-d298-471f-b585-2da3b5500f10","source":"wordfence","cve":"","title":"FV Flowplayer Video Player <= 7.2.0.727 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb613de8-d298-471f-b585-2da3b5500f10?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.2.0.727","to_inclusive":true,"patched_in":"7.2.1.727"}],"published":"2018-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb629dfc-1be2-4a56-907f-0b5c64cc066e","source":"wordfence","cve":"CVE-2012-1205","title":"Relocate Upload < 0.20 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb629dfc-1be2-4a56-907f-0b5c64cc066e?source=api-prod","affected":[{"type":"plugin","slug":"relocate-upload","name":"Relocate Upload","from":"*","from_inclusive":true,"to":"0.20","to_inclusive":false,"patched_in":"0.20"}],"published":"2011-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb6613ad-1fb2-4278-adc1-fe5d1ade3ad5","source":"wordfence","cve":"CVE-2024-12469","title":"WP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6613ad-1fb2-4278-adc1-fe5d1ade3ad5?source=api-prod","affected":[{"type":"plugin","slug":"wp-base-booking-of-appointments-services-and-events","name":"WP BASE Booking of Appointments, Services and Events","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.2"}],"published":"2024-12-16T21:10:40Z","updated":"2024-12-17T09:22:43Z"},{"id":"wordfence:eb6642c0-9011-419b-bef6-5aa594993c01","source":"wordfence","cve":"CVE-2023-7292","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6642c0-9011-419b-bef6-5aa594993c01?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:45Z"},{"id":"wordfence:eb689760-837f-45e6-ba51-a834053be6ae","source":"wordfence","cve":"CVE-2026-6972","title":"SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb689760-837f-45e6-ba51-a834053be6ae?source=api-prod","affected":[{"type":"plugin","slug":"skt-skill-bar","name":"SKT Skill Bar","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2026-08-04T18:10:03Z","updated":"2026-08-05T06:38:01Z"},{"id":"wordfence:eb68f3b4-b4c7-4e16-bed2-2bd41f1b5a44","source":"wordfence","cve":"CVE-2022-4465","title":"WP Video Lightbox <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb68f3b4-b4c7-4e16-bed2-2bd41f1b5a44?source=api-prod","affected":[{"type":"plugin","slug":"wp-video-lightbox","name":"WP Video Lightbox","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2022-12-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb6ac547-59fd-4d51-a140-06f7f70a43ab","source":"wordfence","cve":"CVE-2019-5992","title":"WordPress Ultra Simple Paypal Shopping Cart <= 4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6ac547-59fd-4d51-a140-06f7f70a43ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultra-simple-paypal-shopping-cart","name":"WordPress Ultra Simple Paypal Shopping Cart","from":"*","from_inclusive":true,"to":"4.4","to_inclusive":true,"patched_in":"4.5"}],"published":"2019-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb6b0c35-b478-4616-a708-1fd243c95c14","source":"wordfence","cve":"CVE-2025-1572","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6b0c35-b478-4616-a708-1fd243c95c14?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2025-02-27T19:24:13Z","updated":"2025-02-28T07:34:39Z"},{"id":"wordfence:eb6bbbbb-b201-4fd5-8ee1-2369fb27070f","source":"wordfence","cve":"CVE-2014-5337","title":"WordPress Mobile Pack \u2013 Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps < 2.0.2 - Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6bbbbb-b201-4fd5-8ee1-2369fb27070f?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-mobile-pack","name":"WordPress Mobile Pack \u2013 Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"}],"published":"2014-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb6f38ce-2378-480f-8f43-140ed7be5cc0","source":"wordfence","cve":"CVE-2022-4671","title":"PixCodes <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6f38ce-2378-480f-8f43-140ed7be5cc0?source=api-prod","affected":[{"type":"plugin","slug":"pixcodes","name":"PixCodes","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb717d64-8979-4a6a-bdba-32d43cc8f4d4","source":"wordfence","cve":"CVE-2025-68855","title":"JobBoard Job listing <= 1.2.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb717d64-8979-4a6a-bdba-32d43cc8f4d4?source=api-prod","affected":[{"type":"plugin","slug":"job-board-light","name":"JobBoard Job listing plugin","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:24:00Z"},{"id":"wordfence:eb71befb-8b79-46b0-9d0b-0159542147c1","source":"wordfence","cve":"CVE-2022-47593","title":"RapidLoad Power-Up for Autoptimize <= 1.6.35 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb71befb-8b79-46b0-9d0b-0159542147c1?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.6.35","to_inclusive":true,"patched_in":"1.6.36"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb767f64-b247-4d4f-99d9-fc0c54616944","source":"wordfence","cve":"CVE-2025-23565","title":"Wibstats <= 0.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb767f64-b247-4d4f-99d9-fc0c54616944?source=api-prod","affected":[{"type":"plugin","slug":"wibstats-statistics-for-wordpress-mu","name":"Wibstats","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:08:02Z"},{"id":"wordfence:eb794a38-b35b-403a-8a08-37c3ac76a669","source":"wordfence","cve":"CVE-2026-22509","title":"Gioia <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb794a38-b35b-403a-8a08-37c3ac76a669?source=api-prod","affected":[{"type":"theme","slug":"gioia","name":"Gioia - Modern Fashion Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T16:43:39Z"},{"id":"wordfence:eb79c684-1495-4bc7-bc80-a62de67d097b","source":"wordfence","cve":"CVE-2026-49066","title":"Conekta Payment Gateway <= 6.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb79c684-1495-4bc7-bc80-a62de67d097b?source=api-prod","affected":[{"type":"plugin","slug":"conekta-payment-gateway","name":"Conekta Payment Gateway","from":"*","from_inclusive":true,"to":"6.0.0","to_inclusive":true,"patched_in":"6.0.1"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:25:14Z"},{"id":"wordfence:eb7a43d1-2275-49df-89ec-fea0b24210c0","source":"wordfence","cve":"CVE-2026-54865","title":"Podamibe Custom User Gravatar <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7a43d1-2275-49df-89ec-fea0b24210c0?source=api-prod","affected":[{"type":"plugin","slug":"podamibe-custom-user-gravatar","name":"Podamibe Custom User Gravatar","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T07:02:26Z","updated":"2026-11-03T20:04:42Z"},{"id":"wordfence:eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da","source":"wordfence","cve":"CVE-2025-12384","title":"Document Embedder \u2013 Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation","severity":"high","cvss":8.6,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb7e4e96-a4ff-4c6c-91de-c0e5ba78f0da?source=api-prod","affected":[{"type":"plugin","slug":"document-emberdder","name":"Document Embedder \u2013 let visitors read files without downloading","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-11-04T17:38:20Z","updated":"2025-11-05T06:35:03Z"},{"id":"wordfence:eb81f83f-a0e7-46d9-b106-fe31f8ad3eb9","source":"wordfence","cve":"CVE-2024-10633","title":"Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content","severity":"high","cvss":7.3,"cwe":"CWE-95","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb81f83f-a0e7-46d9-b106-fe31f8ad3eb9?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Developer","from":"20.0.0","from_inclusive":true,"to":"21.8.0","to_inclusive":true,"patched_in":"21.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"7.0.0","from_inclusive":true,"to":"8.8.0","to_inclusive":true,"patched_in":"8.8.0.100"},{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker Agency","from":"30.0.0","from_inclusive":true,"to":"31.8.0","to_inclusive":true,"patched_in":"31.8.0.100"}],"published":"2025-01-25T00:00:00Z","updated":"2025-03-12T17:36:16Z"},{"id":"wordfence:eb828160-b537-4435-9d85-47e0d70a6704","source":"wordfence","cve":"","title":"Remove tabs and fields from WooCommerce <= 1.68 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb828160-b537-4435-9d85-47e0d70a6704?source=api-prod","affected":[{"type":"plugin","slug":"wc-remove-tabs-and-fields","name":"Remove tabs and fields from WooCommerce","from":"*","from_inclusive":true,"to":"1.68","to_inclusive":true,"patched_in":"1.69"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb830ad3-50ba-4dfe-becb-351b227706c1","source":"wordfence","cve":"CVE-2025-10734","title":"ReviewX \u2013 WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-922","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb830ad3-50ba-4dfe-becb-351b227706c1?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2026-03-22T16:26:54Z","updated":"2026-03-23T05:29:41Z"},{"id":"wordfence:eb8517bc-f45f-40a1-ae80-ed227c8b32d7","source":"wordfence","cve":"CVE-2023-52222","title":"WooCommerce <= 8.2.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb8517bc-f45f-40a1-ae80-ed227c8b32d7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.2.2","to_inclusive":true,"patched_in":"8.3.0"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb85ed32-c391-45d2-9e86-cb97009210cd","source":"wordfence","cve":"CVE-2025-3906","title":"Integra\u00e7\u00e3o entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb85ed32-c391-45d2-9e86-cb97009210cd?source=api-prod","affected":[{"type":"plugin","slug":"integracao-entre-eduzz-e-wc-powers","name":"Integra\u00e7\u00e3o entre Eduzz e Woocommerce","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T16:49:12Z","updated":"2025-04-26T05:34:24Z"},{"id":"wordfence:eb85faa4-0261-4fb0-a70d-9fb03170e032","source":"wordfence","cve":"CVE-2024-52445","title":"QRMenu Restaurant QR Menu Lite <= 1.0.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb85faa4-0261-4fb0-a70d-9fb03170e032?source=api-prod","affected":[{"type":"plugin","slug":"qrmenu-lite","name":"QRMenu Restaurant QR Menu Lite","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:40:44Z"},{"id":"wordfence:eb89a16c-fae0-4d36-85aa-79beab753cba","source":"wordfence","cve":"CVE-2021-24809","title":"BP Better Messages <= 1.9.9.37 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb89a16c-fae0-4d36-85aa-79beab753cba?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.9.41","to_inclusive":false,"patched_in":"1.9.9.41"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb8a673e-a192-41d4-b53b-7d786887242d","source":"wordfence","cve":"CVE-2026-7311","title":"TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb8a673e-a192-41d4-b53b-7d786887242d?source=api-prod","affected":[{"type":"plugin","slug":"tiny-compress-images","name":"TinyPNG Image Optimization \u2013 Image Compression JPEG & PNG | Convert to WebP & AVIF","from":"*","from_inclusive":true,"to":"3.6.13","to_inclusive":true,"patched_in":"3.6.14"}],"published":"2026-07-02T05:38:14Z","updated":"2026-07-02T18:32:17Z"},{"id":"wordfence:eb8af5d6-8b98-4a87-a588-0af74af2cd50","source":"wordfence","cve":"CVE-2026-10750","title":"Royal MCP <= 1.4.25 - Missing Authorization to Unauthenticated MCP Tool Use","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb8af5d6-8b98-4a87-a588-0af74af2cd50?source=api-prod","affected":[{"type":"plugin","slug":"royal-mcp","name":"Royal MCP \u2013 Secure AI Connector for Claude, ChatGPT & any LLM via MCP","from":"*","from_inclusive":true,"to":"1.4.25","to_inclusive":true,"patched_in":"1.4.26"}],"published":"2026-06-10T00:00:00Z","updated":"2026-08-21T13:05:39Z"},{"id":"wordfence:eb8f03fb-d1af-4727-87d7-58dbe4013d8a","source":"wordfence","cve":"CVE-2026-102562","title":"AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb8f03fb-d1af-4727-87d7-58dbe4013d8a?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":true,"patched_in":"11.1.1"}],"published":"2026-10-12T19:03:41Z","updated":"2026-10-13T07:46:23Z"},{"id":"wordfence:eb9253de-7139-422b-aa17-b25937d6a21c","source":"wordfence","cve":"CVE-2024-47362","title":"Strong Testimonials <= 3.1.16 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb9253de-7139-422b-aa17-b25937d6a21c?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:11:41Z"},{"id":"wordfence:eb94520e-a99d-4e34-b174-e01898de0978","source":"wordfence","cve":"","title":"Custom post types <= 4.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb94520e-a99d-4e34-b174-e01898de0978?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-types","name":"Custom post types, Custom Fields & more","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":false,"patched_in":"5.0.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb958362-c1df-4042-b284-7339b8ff8efb","source":"wordfence","cve":"CVE-2026-57698","title":"Abandoned Cart Recovery for WooCommerce <= 1.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb958362-c1df-4042-b284-7339b8ff8efb?source=api-prod","affected":[{"type":"plugin","slug":"woo-abandoned-cart-recovery","name":"Recarto \u2013 Abandoned Cart Recovery for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-16T17:57:58Z"},{"id":"wordfence:eb9590b4-0d38-4e7f-944f-ee1c262fd805","source":"wordfence","cve":"CVE-2024-54320","title":"ICDSoft Reseller Store <= 2.4.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb9590b4-0d38-4e7f-944f-ee1c262fd805?source=api-prod","affected":[{"type":"plugin","slug":"icdsoft-reseller-store","name":"ICDSoft Reseller Store","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:14:48Z"},{"id":"wordfence:eb99c1a0-a0c3-4a6e-84b1-4ced45015db4","source":"wordfence","cve":"","title":"Really Simple Facebook Twitter Share Buttons < 2.10.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb99c1a0-a0c3-4a6e-84b1-4ced45015db4?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-facebook-twitter-share-buttons","name":"Really Simple Facebook Twitter Share Buttons","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":false,"patched_in":"2.10.5"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb9a6c9b-24fb-436f-b583-55adeedb726e","source":"wordfence","cve":"CVE-2023-25481","title":"Podlove Subscribe button <= 1.3.7 - Cross-Site Request Forgery via save function","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb9a6c9b-24fb-436f-b583-55adeedb726e?source=api-prod","affected":[{"type":"plugin","slug":"podlove-subscribe-button","name":"Podlove Subscribe button","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb9bcd3e-bb8c-4c7b-8904-56790acd2655","source":"wordfence","cve":"CVE-2022-4790","title":"WP Google My Business Auto Publish <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb9bcd3e-bb8c-4c7b-8904-56790acd2655?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-my-business-auto-publish","name":"Auto Publish for Google My Business","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":"3.4"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eb9c5a81-ef7e-4b40-b1c7-619fc2731623","source":"wordfence","cve":"CVE-2026-42677","title":"WP Document Revisions <= 3.8.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eb9c5a81-ef7e-4b40-b1c7-619fc2731623?source=api-prod","affected":[{"type":"plugin","slug":"wp-document-revisions","name":"WP Document Revisions","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2026-05-15T00:00:00Z","updated":"2026-05-19T13:15:51Z"},{"id":"wordfence:eba48c51-87d9-4e7e-b4c1-0205cd96d033","source":"wordfence","cve":"CVE-2023-1335","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ucss_connect'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eba48c51-87d9-4e7e-b4c1-0205cd96d033?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eba7ab33-bcb6-4ada-ae5f-0df758fc719a","source":"wordfence","cve":"CVE-2021-36919","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eba7ab33-bcb6-4ada-ae5f-0df758fc719a?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.0.6","to_inclusive":true,"patched_in":"6.0.7"}],"published":"2021-11-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eba81d49-7af5-4031-aa0e-43c2fa61cd38","source":"wordfence","cve":"CVE-2024-25599","title":"Seriously Simple Podcasting <= 3.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eba81d49-7af5-4031-aa0e-43c2fa61cd38?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-03-26T00:00:00Z","updated":"2024-04-24T14:17:58Z"},{"id":"wordfence:ebacd411-6def-4026-a619-5e08a181507b","source":"wordfence","cve":"CVE-2023-2032","title":"Custom 404 Pro <= 3.8.0 - Unauthenticated SQL Injection via 's'","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebacd411-6def-4026-a619-5e08a181507b?source=api-prod","affected":[{"type":"plugin","slug":"custom-404-pro","name":"Custom 404 Pro","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebad60ee-8596-46c8-9461-9caf6c6a3454","source":"wordfence","cve":"CVE-2025-9123","title":"CBX Map for Google Map & OpenStreetMap <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebad60ee-8596-46c8-9461-9caf6c6a3454?source=api-prod","affected":[{"type":"plugin","slug":"cbxgooglemap","name":"CBX Map for Google Map & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2025-09-10T18:54:28Z","updated":"2026-09-10T19:17:09Z"},{"id":"wordfence:ebad8cb0-ac50-414e-9e13-7741da6915e7","source":"wordfence","cve":"CVE-2025-57900","title":"GutenKit <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebad8cb0-ac50-414e-9e13-7741da6915e7?source=api-prod","affected":[{"type":"plugin","slug":"gutenkit-blocks-addon","name":"GutenKit \u2013 Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T16:49:34Z"},{"id":"wordfence:ebae4b18-5b5f-45c3-86e2-02eefd7abdb7","source":"wordfence","cve":"CVE-2024-4185","title":"Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness","severity":"high","cvss":8.1,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebae4b18-5b5f-45c3-86e2-02eefd7abdb7?source=api-prod","affected":[{"type":"plugin","slug":"emails-verification-for-woocommerce","name":"Customer Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.4","to_inclusive":true,"patched_in":"2.7.5"}],"published":"2024-04-29T00:00:00Z","updated":"2024-04-30T08:32:25Z"},{"id":"wordfence:ebaec880-0d1c-4725-a746-530f48821279","source":"wordfence","cve":"CVE-2025-11735","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebaec880-0d1c-4725-a746-530f48821279?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.7.1","to_inclusive":true,"patched_in":"1.3.7.2"}],"published":"2025-10-27T16:26:52Z","updated":"2025-10-28T05:27:32Z"},{"id":"wordfence:ebafc14a-1197-4ac4-ad95-8965a755d5c4","source":"wordfence","cve":"CVE-2024-6481","title":"Search & Filter Pro <= 2.5.17 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebafc14a-1197-4ac4-ad95-8965a755d5c4?source=api-prod","affected":[{"type":"plugin","slug":"search-filter-pro","name":"Search & Filter Pro","from":"*","from_inclusive":true,"to":"2.5.17","to_inclusive":true,"patched_in":"2.5.18"}],"published":"2024-07-18T00:00:00Z","updated":"2024-08-09T19:43:28Z"},{"id":"wordfence:ebb0e616-9a57-4a77-a9ac-a938eb9b26b8","source":"wordfence","cve":"CVE-2025-32292","title":"Jarvis \u2013 Night Club, Concert, Festival WordPress <= 1.8.11 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb0e616-9a57-4a77-a9ac-a938eb9b26b8?source=api-prod","affected":[{"type":"theme","slug":"jarvis","name":"Jarvis - Night Club, Concert, Festival WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.11","to_inclusive":true,"patched_in":""}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T15:54:44Z"},{"id":"wordfence:ebb275e9-3a5b-421e-b857-95880ebe000d","source":"wordfence","cve":"CVE-2019-15869","title":"JobCareer | Job Board Responsive WordPress Theme <= 2.5.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb275e9-3a5b-421e-b857-95880ebe000d?source=api-prod","affected":[{"type":"plugin","slug":"jobcareer","name":"JobCareer | Job Board Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":false,"patched_in":"2.5.1"}],"published":"2019-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebb33fdc-fd89-4d4f-9107-287a64abc150","source":"wordfence","cve":"CVE-2022-28221","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb33fdc-fd89-4d4f-9107-287a64abc150?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.173","to_inclusive":true,"patched_in":"5.174.1"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebb347a8-a8d2-4809-bfa5-772ad0de90f6","source":"wordfence","cve":"CVE-2024-13114","title":"WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb347a8-a8d2-4809-bfa5-772ad0de90f6?source=api-prod","affected":[{"type":"plugin","slug":"wp-projects-portfolio","name":"WP Projects Portfolio with Client Testimonials","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:15:16Z"},{"id":"wordfence:ebb4bc5a-9469-4733-acf3-d2dda5edb7af","source":"wordfence","cve":"CVE-2026-2890","title":"Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb4bc5a-9469-4733-acf3-d2dda5edb7af?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.28","to_inclusive":true,"patched_in":"6.29"}],"published":"2026-03-12T19:21:57Z","updated":"2026-03-13T07:23:48Z"},{"id":"wordfence:ebb6a31a-3d12-4dd1-b9f8-5d9e17f0bf48","source":"wordfence","cve":"CVE-2026-120575","title":"Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6a31a-3d12-4dd1-b9f8-5d9e17f0bf48?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.5.7","to_inclusive":true,"patched_in":"6.5.8"}],"published":"2026-10-30T15:48:01Z","updated":"2026-11-03T04:43:10Z"},{"id":"wordfence:ebb6afd7-6bc4-4c8a-a645-04f64d5adff4","source":"wordfence","cve":"CVE-2024-13468","title":"Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6afd7-6bc4-4c8a-a645-04f64d5adff4?source=api-prod","affected":[{"type":"plugin","slug":"trash-duplicate-and-301-redirect","name":"Trash Duplicate and 301 Redirect","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-02-18T19:29:59Z","updated":"2025-08-15T14:22:12Z"},{"id":"wordfence:ebb76379-0cac-47c6-a0eb-34780bc837bc","source":"wordfence","cve":"CVE-2020-14205","title":"DiveBook <= 1.1.4 - Improper Access Control","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb76379-0cac-47c6-a0eb-34780bc837bc?source=api-prod","affected":[{"type":"plugin","slug":"divebook","name":"DiveBook","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2020-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebb80964-761b-410c-998f-4408439e0d48","source":"wordfence","cve":"CVE-2018-20984","title":"Patreon WordPress < 1.2.2 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb80964-761b-410c-998f-4408439e0d48?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2018-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebb9e37c-9e8b-429b-b4ef-cd875351852c","source":"wordfence","cve":"CVE-2023-2173","title":"BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion","severity":"medium","cvss":6.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb9e37c-9e8b-429b-b4ef-cd875351852c?source=api-prod","affected":[{"type":"plugin","slug":"badgeos","name":"BadgeOS","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebbc420d-43fd-48c4-8507-6d94b9fed565","source":"wordfence","cve":"CVE-2026-6670","title":"Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbc420d-43fd-48c4-8507-6d94b9fed565?source=api-prod","affected":[{"type":"plugin","slug":"media-sync","name":"Media Sync","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-05-13T18:15:39Z","updated":"2026-05-14T06:44:14Z"},{"id":"wordfence:ebbca82d-9a03-4984-8c95-a4da7ea4da60","source":"wordfence","cve":"CVE-2026-14332","title":"Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbca82d-9a03-4984-8c95-a4da7ea4da60?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"7.0.9","to_inclusive":false,"patched_in":"7.0.9"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:44:34Z"},{"id":"wordfence:ebbd41a8-b9ff-4afe-bcfd-1df52d8d3b5f","source":"wordfence","cve":"CVE-2026-97471","title":"Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbd41a8-b9ff-4afe-bcfd-1df52d8d3b5f?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2026-10-13T15:10:28Z","updated":"2026-10-14T03:40:06Z"},{"id":"wordfence:ebbee05c-fd32-4dd9-99d3-716ba604b859","source":"wordfence","cve":"CVE-2018-21001","title":"AnyComment <= 0.0.32 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebbee05c-fd32-4dd9-99d3-716ba604b859?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.0.32","to_inclusive":true,"patched_in":"0.0.33"}],"published":"2018-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebc0c8e6-a365-4ef7-9c1a-41454855096c","source":"wordfence","cve":"CVE-2024-3055","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebc0c8e6-a365-4ef7-9c1a-41454855096c?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.102","to_inclusive":true,"patched_in":"1.5.105"}],"published":"2024-05-10T08:41:48Z","updated":"2024-05-10T21:32:43Z"},{"id":"wordfence:ebc65c11-184d-480a-959e-8b0a9d6c139d","source":"wordfence","cve":"CVE-2025-64378","title":"ListingPro < 2.9.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebc65c11-184d-480a-959e-8b0a9d6c139d?source=api-prod","affected":[{"type":"theme","slug":"listingpro","name":"ListingPro - WordPress Directory & Listing Theme","from":"*","from_inclusive":true,"to":"2.9.10","to_inclusive":false,"patched_in":"2.9.10"}],"published":"2025-09-12T00:00:00Z","updated":"2025-12-20T19:41:52Z"},{"id":"wordfence:ebc8d724-3936-42d8-8850-bc330c5221dc","source":"wordfence","cve":"CVE-2025-5282","title":"WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebc8d724-3936-42d8-8850-bc330c5221dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-13T03:41:46Z"},{"id":"wordfence:ebcbb7bf-99fd-4a74-a4d3-eabf9edcadc4","source":"wordfence","cve":"CVE-2026-8622","title":"Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebcbb7bf-99fd-4a74-a4d3-eabf9edcadc4?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes-on-demand","name":"Image Sizes on Demand","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:39:57Z","updated":"2026-06-24T05:33:32Z"},{"id":"wordfence:ebcbeb7c-eadb-4541-94f0-6e85f7f3e6a1","source":"wordfence","cve":"","title":"Homepage SlideShow <= 2.3 - Arbitrary File Upload","severity":"high","cvss":8.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebcbeb7c-eadb-4541-94f0-6e85f7f3e6a1?source=api-prod","affected":[{"type":"plugin","slug":"wp-homepage-slideshow","name":"Homepage SlideShow","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2013-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebcbf872-1420-4a57-a4b4-8a52ba74e0a1","source":"wordfence","cve":"CVE-2023-4950","title":"Funnelforms Free <= 3.3.9 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebcbf872-1420-4a57-a4b4-8a52ba74e0a1?source=api-prod","affected":[{"type":"plugin","slug":"funnelforms-free","name":"Funnelforms Free \u2013 Multi Step Form, Contact Form & Lead Funnel Builder","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":false,"patched_in":"3.4"}],"published":"2023-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebcce8ab-b1c9-49ce-986d-c6d0e5672dec","source":"wordfence","cve":"CVE-2026-57764","title":"Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebcce8ab-b1c9-49ce-986d-c6d0e5672dec?source=api-prod","affected":[{"type":"plugin","slug":"surbma-yoast-breadcrumb-shortcode","name":"Surbma | Yoast SEO Breadcrumb Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:54:47Z"},{"id":"wordfence:ebcd13e2-bc72-415f-9e2b-7213e9acf425","source":"wordfence","cve":"CVE-2024-37198","title":"Digital Newspaper <= 1.1.5 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebcd13e2-bc72-415f-9e2b-7213e9acf425?source=api-prod","affected":[{"type":"theme","slug":"digital-newspaper","name":"Digital Newspaper","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:45:03Z"},{"id":"wordfence:ebd1483a-949d-4edb-9b86-007879d2d207","source":"wordfence","cve":"CVE-2023-35089","title":"Recipe Maker For Your Food Blog from Zip Recipes <= 8.0.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd1483a-949d-4edb-9b86-007879d2d207?source=api-prod","affected":[{"type":"plugin","slug":"zip-recipes","name":"Recipe Cards For Your Food Blog from Zip Recipes","from":"*","from_inclusive":true,"to":"8.0.7","to_inclusive":true,"patched_in":"8.0.8"}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebd1c1c0-0eb4-430d-a65b-9bf30a7dd52a","source":"wordfence","cve":"CVE-2014-9335","title":"DandyID Services <= 1.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd1c1c0-0eb4-430d-a65b-9bf30a7dd52a?source=api-prod","affected":[{"type":"plugin","slug":"dandyid-services","name":"DandyID Services","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":""}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebd358b6-ad81-4808-a627-11d519e76510","source":"wordfence","cve":"CVE-2026-40753","title":"EasyMeals <= 1.5.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd358b6-ad81-4808-a627-11d519e76510?source=api-prod","affected":[{"type":"theme","slug":"easymeals","name":"EasyMeals - Food Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.6"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:20:19Z"},{"id":"wordfence:ebd3b70e-a06a-4dcc-a6af-dbe64fd57c82","source":"wordfence","cve":"CVE-2024-3812","title":"Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd3b70e-a06a-4dcc-a6af-dbe64fd57c82?source=api-prod","affected":[{"type":"plugin","slug":"salient-core","name":"Salient Core","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-18T05:40:06Z"},{"id":"wordfence:ebd42227-1cc2-42ab-b64b-3fe3fe1880c8","source":"wordfence","cve":"CVE-2014-4534","title":"HTML5 Video Player with Playlist <= 2.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd42227-1cc2-42ab-b64b-3fe3fe1880c8?source=api-prod","affected":[{"type":"plugin","slug":"html5-video-player-with-playlist","name":"HTML5 Video Player with Playlist","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebd5b868-93f2-4517-9400-fd730b36434a","source":"wordfence","cve":"CVE-2025-28921","title":"SpatialMatch IDX <= 3.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd5b868-93f2-4517-9400-fd730b36434a?source=api-prod","affected":[{"type":"plugin","slug":"spatialmatch-free-lifestyle-search","name":"SpatialMatch IDX","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-23T00:00:00Z","updated":"2025-03-25T17:47:14Z"},{"id":"wordfence:ebd6acc9-b7df-4cf8-a211-1e39f3abcf79","source":"wordfence","cve":"CVE-2024-5179","title":"Cowidgets \u2013 Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd6acc9-b7df-4cf8-a211-1e39f3abcf79?source=api-prod","affected":[{"type":"plugin","slug":"cowidgets-elementor-addons","name":"Cowidgets \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-06-05T13:52:03Z","updated":"2024-07-02T16:15:36Z"},{"id":"wordfence:ebd6c526-bd9d-4959-9929-c38334c21506","source":"wordfence","cve":"CVE-2025-31416","title":"Awesome Event Booking <= 2.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd6c526-bd9d-4959-9929-c38334c21506?source=api-prod","affected":[{"type":"plugin","slug":"awesome-event-booking","name":"Awesome Event Booking","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:40:59Z"},{"id":"wordfence:ebd78e52-f20d-42be-8f68-3d09d5abf837","source":"wordfence","cve":"CVE-2023-41805","title":"Starter Templates <= 3.2.5 - Incorrect Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd78e52-f20d-42be-8f68-3d09d5abf837?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"},{"type":"plugin","slug":"astra-pro-sites","name":"Premium Starter Templates","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebd96d9c-c1ab-4a53-a52a-9fc2541482f2","source":"wordfence","cve":"CVE-2024-10579","title":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd96d9c-c1ab-4a53-a52a-9fc2541482f2?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.5","to_inclusive":true,"patched_in":"7.8.6"}],"published":"2024-11-25T21:55:08Z","updated":"2024-11-26T11:04:35Z"},{"id":"wordfence:ebdac9a2-2114-4b3c-ab2f-bd461f2c648c","source":"wordfence","cve":"CVE-2019-13413","title":"Rencontre \u2013 Dating Site <= 3.1.2 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebdac9a2-2114-4b3c-ab2f-bd461f2c648c?source=api-prod","affected":[{"type":"plugin","slug":"rencontre","name":"Rencontre \u2013 Dating Site","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2019-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebe03cde-7956-4185-8990-8d47f174e60a","source":"wordfence","cve":"CVE-2024-29098","title":"WP Calameo <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebe03cde-7956-4185-8990-8d47f174e60a?source=api-prod","affected":[{"type":"plugin","slug":"wp-calameo","name":"WP Calameo","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T21:06:50Z"},{"id":"wordfence:ebe215c6-b328-49b7-aed7-e164e1c5f0d0","source":"wordfence","cve":"CVE-2022-1408","title":"VikBooking Hotel Booking Engine & PMS <= 1.5.7 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebe215c6-b328-49b7-aed7-e164e1c5f0d0?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":false,"patched_in":"1.5.8"}],"published":"2022-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebe431a7-b552-4891-9784-c6a7353228da","source":"wordfence","cve":"CVE-2024-6567","title":"Ebook Store <= 5.8001 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebe431a7-b552-4891-9784-c6a7353228da?source=api-prod","affected":[{"type":"plugin","slug":"ebook-store","name":"Ebook Store","from":"*","from_inclusive":true,"to":"5.8001","to_inclusive":true,"patched_in":"5.8002"}],"published":"2024-08-01T13:11:47Z","updated":"2025-03-19T17:51:35Z"},{"id":"wordfence:ebe59b29-f8d4-4ea0-b4a8-d758ddb1c594","source":"wordfence","cve":"CVE-2025-32218","title":"TableOn \u2013 WordPress Posts Table Filterable <= 1.0.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebe59b29-f8d4-4ea0-b4a8-d758ddb1c594?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.5.1","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-04-04T00:00:00Z","updated":"2026-05-05T18:33:55Z"},{"id":"wordfence:ebea0ec0-f7ee-41c5-b0a5-a78e9cd11d41","source":"wordfence","cve":"","title":"Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 - Cross-Site Request Forgery via spbsmAjax","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebea0ec0-f7ee-41c5-b0a5-a78e9cd11d41?source=api-prod","affected":[{"type":"plugin","slug":"superb-social-share-and-follow-buttons","name":"Superb Social Media Share Buttons and Follow Buttons","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2023-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebeb34bd-0704-42ab-932e-304d8ae42d35","source":"wordfence","cve":"CVE-2026-57774","title":"VW Food Corner <= 1.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebeb34bd-0704-42ab-932e-304d8ae42d35?source=api-prod","affected":[{"type":"theme","slug":"vw-food-corner","name":"VW Food Corner","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-07-02T00:00:00Z","updated":"2026-08-14T15:18:44Z"},{"id":"wordfence:ebed1706-0790-447a-a535-4a46a8257f79","source":"wordfence","cve":"CVE-2026-57352","title":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebed1706-0790-447a-a535-4a46a8257f79?source=api-prod","affected":[{"type":"plugin","slug":"woo-alidropship","name":"ALD \u2013 Dropshipping and Fulfillment for AliExpress and WooCommerce","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-09T13:42:23Z"},{"id":"wordfence:ebf1e74c-4199-4de1-aa4c-05d0d208d759","source":"wordfence","cve":"CVE-2026-40734","title":"Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf1e74c-4199-4de1-aa4c-05d0d208d759?source=api-prod","affected":[{"type":"plugin","slug":"categories-images","name":"Categories Images","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-03-14T00:00:00Z","updated":"2026-05-07T13:46:22Z"},{"id":"wordfence:ebf2e701-9f9b-4a78-a61a-0cf90cdd9755","source":"wordfence","cve":"CVE-2023-3764","title":"WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Save","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf2e701-9f9b-4a78-a61a-0cf90cdd9755?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.90","to_inclusive":true,"patched_in":"1.2.91"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebf5537d-d80e-4844-8ed4-480f4a533439","source":"wordfence","cve":"CVE-2024-13601","title":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf5537d-d80e-4844-8ed4-480f4a533439?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T05:28:40Z"},{"id":"wordfence:ebf84c6a-fd6c-4113-91ff-27c7564cabdb","source":"wordfence","cve":"CVE-2021-24406","title":"wpForo Forum <= 1.9.6 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf84c6a-fd6c-4113-91ff-27c7564cabdb?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2021-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebf96aa9-2ee7-4411-8f43-3e8d023197bd","source":"wordfence","cve":"CVE-2026-13733","title":"Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf96aa9-2ee7-4411-8f43-3e8d023197bd?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.60","to_inclusive":true,"patched_in":"3.3.61"}],"published":"2026-06-30T18:55:18Z","updated":"2026-07-01T07:53:38Z"},{"id":"wordfence:ebf9760d-b7c2-43c7-bfb0-dde96de3dcb9","source":"wordfence","cve":"","title":"Brisk (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf9760d-b7c2-43c7-bfb0-dde96de3dcb9?source=api-prod","affected":[{"type":"theme","slug":"brisk","name":"Brisk","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ebfb4e11-e45c-437c-8b6e-887d0017dfbc","source":"wordfence","cve":"CVE-2025-58680","title":"Gutentor <= 3.5.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebfb4e11-e45c-437c-8b6e-887d0017dfbc?source=api-prod","affected":[{"type":"plugin","slug":"gutentor","name":"Gutentor \u2013 Gutenberg Blocks \u2013 Page Builder for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":true,"patched_in":"3.5.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:18:18Z"},{"id":"wordfence:ebfc2677-6e5c-49f2-915b-b07af8c2037d","source":"wordfence","cve":"CVE-2024-4621","title":"ARforms <= 6.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebfc2677-6e5c-49f2-915b-b07af8c2037d?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.5","to_inclusive":true,"patched_in":"6.6"}],"published":"2024-05-17T00:00:00Z","updated":"2024-06-18T15:10:17Z"},{"id":"wordfence:ebffe466-0fd7-4110-bd2f-730978711087","source":"wordfence","cve":"CVE-2025-32119","title":"CardGate Payments for WooCommerce <= 3.2.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ebffe466-0fd7-4110-bd2f-730978711087?source=api-prod","affected":[{"type":"plugin","slug":"cardgate","name":"CardGate Payments for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-15T12:48:03Z"},{"id":"wordfence:ec002a5a-1965-4828-8a0a-19941af98e2d","source":"wordfence","cve":"CVE-2021-24831","title":"Tab \u2013 Accordion, FAQ < 1.3.2 - Unauthenticated Arbitrary Tab Modification","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec002a5a-1965-4828-8a0a-19941af98e2d?source=api-prod","affected":[{"type":"plugin","slug":"tabbed","name":"Tab \u2013 Accordion, FAQ","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":false,"patched_in":"1.3.2"}],"published":"2021-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe","source":"wordfence","cve":"CVE-2024-10779","title":"Cowidgets \u2013 Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe?source=api-prod","affected":[{"type":"plugin","slug":"cowidgets-elementor-addons","name":"Cowidgets \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T14:05:11Z","updated":"2024-11-09T02:32:03Z"},{"id":"wordfence:ec015f49-cdb6-4a08-81cd-6fa505086537","source":"wordfence","cve":"CVE-2017-18519","title":"WP Customer Area <= 7.4.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec015f49-cdb6-4a08-81cd-6fa505086537?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"7.4.3","to_inclusive":false,"patched_in":"7.4.3"}],"published":"2017-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec017311-f150-4a14-a4b4-b5634f574e2b","source":"wordfence","cve":"CVE-2025-3102","title":"SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation","severity":"high","cvss":8.1,"cwe":"CWE-697","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec017311-f150-4a14-a4b4-b5634f574e2b?source=api-prod","affected":[{"type":"plugin","slug":"suretriggers","name":"OttoKit: All-in-One Automation Platform","from":"*","from_inclusive":true,"to":"1.0.78","to_inclusive":true,"patched_in":"1.0.79"}],"published":"2025-04-09T16:19:25Z","updated":"2025-07-09T05:23:44Z"},{"id":"wordfence:ec02bef4-8b0c-4097-aedd-ea1a980d4a70","source":"wordfence","cve":"CVE-2026-25401","title":"WPCargo Track & Trace <= 8.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec02bef4-8b0c-4097-aedd-ea1a980d4a70?source=api-prod","affected":[{"type":"plugin","slug":"wpcargo","name":"WPCargo Track & Trace","from":"*","from_inclusive":true,"to":"8.0.5","to_inclusive":true,"patched_in":"8.0.6"}],"published":"2026-03-23T00:00:00Z","updated":"2026-11-10T23:18:55Z"},{"id":"wordfence:ec03840e-807b-4a9c-87e7-a1560b8b7f5c","source":"wordfence","cve":"CVE-2022-2377","title":"Directorist \u2013 WordPress Business Directory Plugin with Classified Ads Listings <= 7.2.3 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec03840e-807b-4a9c-87e7-a1560b8b7f5c?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.3.0"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec065da7-b8aa-414d-9673-5caf87ad45b5","source":"wordfence","cve":"CVE-2024-12875","title":"Easy Digital Downloads <= 3.3.2 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec065da7-b8aa-414d-9673-5caf87ad45b5?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2024-12-20T21:27:52Z","updated":"2025-07-29T06:39:26Z"},{"id":"wordfence:ec084ade-d2e7-4484-8381-a83b04c41059","source":"wordfence","cve":"CVE-2021-38337","title":"RSVPmaker Excel <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec084ade-d2e7-4484-8381-a83b04c41059?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker-excel","name":"RSVPmaker Excel","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T16:20:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec0cd49c-0a21-45db-bc5b-77e63bebfa90","source":"wordfence","cve":"CVE-2026-62075","title":"Backhoe <= 2.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec0cd49c-0a21-45db-bc5b-77e63bebfa90?source=api-prod","affected":[{"type":"theme","slug":"backhoe","name":"Backhoe - Construction Equipment Rentals WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:40:49Z"},{"id":"wordfence:ec0d80f7-96fb-466d-9701-9751f71b926d","source":"wordfence","cve":"CVE-2024-6459","title":"News Element Elementor Blog Magazine <= 1.0.5 - Unauthenticated Local File Inlcusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec0d80f7-96fb-466d-9701-9751f71b926d?source=api-prod","affected":[{"type":"plugin","slug":"news-element","name":"News Element Elementor Blog Magazine","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2024-07-27T00:00:00Z","updated":"2026-03-06T18:33:16Z"},{"id":"wordfence:ec0fb31d-162f-49c2-b59b-8d700c3e5485","source":"wordfence","cve":"CVE-2026-112867","title":"Interactive Content \u2013 H5P <= 1.17.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec0fb31d-162f-49c2-b59b-8d700c3e5485?source=api-prod","affected":[{"type":"plugin","slug":"h5p","name":"Interactive Content \u2013 H5P","from":"*","from_inclusive":true,"to":"1.17.9","to_inclusive":true,"patched_in":"1.17.10"}],"published":"2026-10-22T06:46:00Z","updated":"2026-10-23T18:38:36Z"},{"id":"wordfence:ec0fff2a-602d-441b-89d1-64d609a4abc0","source":"wordfence","cve":"","title":"Popup Builder <= 3.72 Missing Authorization on AJAX actions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec0fff2a-602d-441b-89d1-64d609a4abc0?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"3.71","to_inclusive":true,"patched_in":"3.72"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec1461a9-4504-4e60-9e38-a7257666e699","source":"wordfence","cve":"CVE-2023-29238","title":"Whydonate \u2013 FREE Donate button <= 3.12.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1461a9-4504-4e60-9e38-a7257666e699?source=api-prod","affected":[{"type":"plugin","slug":"wp-whydonate","name":"WhyDonate \u2013 FREE Donate button \u2013 Crowdfunding \u2013 Fundraising","from":"*","from_inclusive":true,"to":"3.12.14","to_inclusive":true,"patched_in":"3.12.16"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec162cdc-d4cd-47d9-b941-24bfee6c48fd","source":"wordfence","cve":"CVE-2024-7607","title":"Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec162cdc-d4cd-47d9-b941-24bfee6c48fd?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.28","to_inclusive":true,"patched_in":"3.2.29"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T05:30:59Z"},{"id":"wordfence:ec1ce091-7aac-4ec6-8f6f-6d961e2073cb","source":"wordfence","cve":"CVE-2026-88795","title":"wpShopGermany IT-RECHT KANZLEI <= 2.3 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1ce091-7aac-4ec6-8f6f-6d961e2073cb?source=api-prod","affected":[{"type":"plugin","slug":"wpshopgermany-it-recht-kanzlei","name":"wpShopGermany IT-RECHT KANZLEI","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.4"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:46:43Z"},{"id":"wordfence:ec1de1f5-6530-4cca-8b9e-3cb7e01e3cf2","source":"wordfence","cve":"CVE-2026-65546","title":"Qode Tours <= 3.1.3.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1de1f5-6530-4cca-8b9e-3cb7e01e3cf2?source=api-prod","affected":[{"type":"plugin","slug":"qode-tours","name":"Qode Tours","from":"*","from_inclusive":true,"to":"3.1.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-07T18:33:45Z"},{"id":"wordfence:ec1ee47d-020c-482d-ad6f-663d78e624b8","source":"wordfence","cve":"CVE-2021-4426","title":"Absolute Reviews <= 1.0.8 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1ee47d-020c-482d-ad6f-663d78e624b8?source=api-prod","affected":[{"type":"plugin","slug":"absolute-reviews","name":"Absolute Reviews","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec1f4180-6fa0-418b-8387-553890cfed0a","source":"wordfence","cve":"CVE-2025-24595","title":"All Embed \u2013 Elementor Addons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1f4180-6fa0-418b-8387-553890cfed0a?source=api-prod","affected":[{"type":"plugin","slug":"all-embed-addons-for-elementor","name":"All Embed \u2013 Multi-Source Embed Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:27:24Z"},{"id":"wordfence:ec1fba15-81e5-42e3-9154-1978c3f81b26","source":"wordfence","cve":"CVE-2026-103039","title":"Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1fba15-81e5-42e3-9154-1978c3f81b26?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-10-29T18:29:20Z","updated":"2026-10-30T06:47:33Z"},{"id":"wordfence:ec1ffc70-fc0c-4c25-926c-e78e0f206d2b","source":"wordfence","cve":"CVE-2023-4646","title":"Simple Posts Ticker <= 1.1.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec1ffc70-fc0c-4c25-926c-e78e0f206d2b?source=api-prod","affected":[{"type":"plugin","slug":"simple-posts-ticker","name":"Simple Posts Ticker \u2013 Easy, Lightweight & Flexible","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec201702-8c8c-4049-b647-422d18001b7f","source":"wordfence","cve":"CVE-2023-6958","title":"WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec201702-8c8c-4049-b647-422d18001b7f?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"9.1.0","to_inclusive":true,"patched_in":"9.1.1"}],"published":"2024-01-17T00:00:00Z","updated":"2024-07-29T21:37:44Z"},{"id":"wordfence:ec20d5c4-4c41-4ec9-8d0a-ec8f03634f7d","source":"wordfence","cve":"CVE-2024-4397","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec20d5c4-4c41-4ec9-8d0a-ec8f03634f7d?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.6.5","to_inclusive":true,"patched_in":"4.2.6.6"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-09T20:03:41Z"},{"id":"wordfence:ec2181cb-dfb2-43d5-90e8-c68d0d98c98b","source":"wordfence","cve":"","title":"WordPress RokBox <= 2.13 - Abuse of Functionality","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2181cb-dfb2-43d5-90e8-c68d0d98c98b?source=api-prod","affected":[{"type":"plugin","slug":"wp_rokbox","name":"WordPress RokBox","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2012-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec2276d6-431f-428c-b1d1-3acbd60e0505","source":"wordfence","cve":"CVE-2026-65516","title":"PeproDev Ultimate Invoice <= 2.2.6 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2276d6-431f-428c-b1d1-3acbd60e0505?source=api-prod","affected":[{"type":"plugin","slug":"pepro-ultimate-invoice","name":"PeproDev Ultimate Invoice","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:27:30Z"},{"id":"wordfence:ec281e0d-0217-4cdd-af31-71158bb3a25d","source":"wordfence","cve":"CVE-2022-0215","title":"Side Cart Woocommerce (Ajax) <= 2.0 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec281e0d-0217-4cdd-af31-71158bb3a25d?source=api-prod","affected":[{"type":"plugin","slug":"side-cart-woocommerce","name":"Side Cart Woocommerce | Woocommerce Cart","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2022-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec2825b2-c8df-40fd-b44d-a840be66446f","source":"wordfence","cve":"CVE-2023-28418","title":"Mediciti Lite <= 1.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2825b2-c8df-40fd-b44d-a840be66446f?source=api-prod","affected":[{"type":"theme","slug":"mediciti-lite","name":"Mediciti Lite","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec29bc37-db27-4bf3-b55f-15c4a7274acd","source":"wordfence","cve":"CVE-2019-15319","title":"Option Tree <= 2.6.0 - PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec29bc37-db27-4bf3-b55f-15c4a7274acd?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2019-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec29e5fc-5635-4809-9bb5-cd28f7fac17e","source":"wordfence","cve":"CVE-2024-30546","title":"Login With Ajax <= 4.1 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec29e5fc-5635-4809-9bb5-cd28f7fac17e?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-17T12:55:28Z"},{"id":"wordfence:ec2c0542-b5ae-4595-b712-ddcd27d21183","source":"wordfence","cve":"CVE-2025-24650","title":"Tourfic <= 2.15.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2c0542-b5ae-4595-b712-ddcd27d21183?source=api-prod","affected":[{"type":"plugin","slug":"tourfic","name":"Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rental","from":"*","from_inclusive":true,"to":"2.15.3","to_inclusive":true,"patched_in":"2.15.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:21:21Z"},{"id":"wordfence:ec2da093-9f36-44c5-948b-590fd99734e8","source":"wordfence","cve":"CVE-2015-5535","title":"qTranslate <= 2.5.39 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2da093-9f36-44c5-948b-590fd99734e8?source=api-prod","affected":[{"type":"plugin","slug":"qtranslate","name":"qTranslate","from":"*","from_inclusive":true,"to":"2.5.39","to_inclusive":true,"patched_in":""}],"published":"2015-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec2daf19-51ef-4e1b-becb-252955a61523","source":"wordfence","cve":"CVE-2023-6005","title":"EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site  Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2daf19-51ef-4e1b-becb-252955a61523?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"},{"type":"plugin","slug":"eventON","name":"EventON (Pro) - WordPress Virtual Event Calendar Plugin","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2024-01-10T00:00:00Z","updated":"2024-02-06T14:15:43Z"},{"id":"wordfence:ec2edcdf-3a0c-40bc-8b33-1ad15cad5acb","source":"wordfence","cve":"CVE-2015-2973","title":"Welcart e-Commerce < 1.4.18 - Multiple Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2edcdf-3a0c-40bc-8b33-1ad15cad5acb?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"1.4.18","to_inclusive":false,"patched_in":"1.4.18"}],"published":"2015-07-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec2eec5a-7767-4215-b77d-5cfd2d148f73","source":"wordfence","cve":"CVE-2022-0349","title":"NotificationX <= 2.3.8 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2eec5a-7767-4215-b77d-5cfd2d148f73?source=api-prod","affected":[{"type":"plugin","slug":"notificationx","name":"NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2022-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec2f2856-fd13-48cb-b335-a66c8cb35b6b","source":"wordfence","cve":"CVE-2025-23807","title":"Spiderpowa Embed PDF <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2f2856-fd13-48cb-b335-a66c8cb35b6b?source=api-prod","affected":[{"type":"plugin","slug":"spiderpowa-embed-pdf","name":"Spiderpowa Embed PDF","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:32:50Z"},{"id":"wordfence:ec311df2-33af-4b91-80a1-252d934c7f61","source":"wordfence","cve":"CVE-2023-46196","title":"Social proof testimonials and reviews by Repuso <= 4.97 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec311df2-33af-4b91-80a1-252d934c7f61?source=api-prod","affected":[{"type":"plugin","slug":"social-testimonials-and-reviews-widget","name":"Reviews Widgets for Google & 45+ platforms by Repuso","from":"*","from_inclusive":true,"to":"4.97","to_inclusive":true,"patched_in":"5.00"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec317df9-c7ef-49a3-9818-903dfe4bdd03","source":"wordfence","cve":"CVE-2026-92798","title":"User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec317df9-c7ef-49a3-9818-903dfe4bdd03?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-16T14:42:54Z","updated":"2026-10-17T03:43:32Z"},{"id":"wordfence:ec33a828-6387-42d3-b0ab-a2461ff1a4c4","source":"wordfence","cve":"CVE-2026-19217","title":"Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec33a828-6387-42d3-b0ab-a2461ff1a4c4?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1064","to_inclusive":true,"patched_in":"1.7.1065"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T22:00:59Z"},{"id":"wordfence:ec3667ac-1d1f-4faf-923c-7e55c03db3da","source":"wordfence","cve":"CVE-2025-9618","title":"Related Posts Lite <= 1.12 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3667ac-1d1f-4faf-923c-7e55c03db3da?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-lite","name":"Related Posts Lite","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-08-29T13:40:33Z","updated":"2026-10-23T05:34:57Z"},{"id":"wordfence:ec36eff4-0f85-4d89-b209-aaf07ae2ff9c","source":"wordfence","cve":"CVE-2026-107658","title":"BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec36eff4-0f85-4d89-b209-aaf07ae2ff9c?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.10.5","to_inclusive":true,"patched_in":"2.10.6"}],"published":"2026-11-05T21:55:59Z","updated":"2026-11-06T11:17:40Z"},{"id":"wordfence:ec395e79-b82a-45c3-a704-a15a5efaf26d","source":"wordfence","cve":"CVE-2024-32447","title":"AWP Classifieds <= 4.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec395e79-b82a-45c3-a704-a15a5efaf26d?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T17:59:35Z"},{"id":"wordfence:ec3dd825-bee3-4d09-bc98-aff665988641","source":"wordfence","cve":"CVE-2021-24507","title":"Astra Pro Addon <= 3.5.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3dd825-bee3-4d09-bc98-aff665988641?source=api-prod","affected":[{"type":"plugin","slug":"astra-addon","name":"Astra Pro Addon","from":"*","from_inclusive":true,"to":"3.5.2","to_inclusive":false,"patched_in":"3.5.2"}],"published":"2021-07-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec3de7e2-4a29-401f-af2c-0ce78d768eae","source":"wordfence","cve":"CVE-2025-4577","title":"Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3de7e2-4a29-401f-af2c-0ce78d768eae?source=api-prod","affected":[{"type":"plugin","slug":"custom-facebook-feed","name":"Smash Balloon Social Post Feed \u2013 Simple Social Feeds for WordPress","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-06-09T21:46:25Z","updated":"2025-06-10T11:22:57Z"},{"id":"wordfence:ec3e7a3b-a9c9-48d4-b2f5-e4090a15ef1f","source":"wordfence","cve":"CVE-2026-45215","title":"EasyPay <= 4.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3e7a3b-a9c9-48d4-b2f5-e4090a15ef1f?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-pay","name":"WP Easy Pay \u2013 Payment and Donation Form Builder for Square","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-04-08T00:00:00Z","updated":"2026-08-21T13:50:15Z"},{"id":"wordfence:ec3ef618-27db-4cdd-a1ea-09f7cb24e954","source":"wordfence","cve":"CVE-2026-57426","title":"Modula - PRO <= 2.10.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3ef618-27db-4cdd-a1ea-09f7cb24e954?source=api-prod","affected":[{"type":"plugin","slug":"modula","name":"Module PRO","from":"*","from_inclusive":true,"to":"2.10.8","to_inclusive":true,"patched_in":"2.10.9"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-09T13:32:07Z"},{"id":"wordfence:ec3f2bf3-4fa5-4ee5-901c-c72a73a1ec8b","source":"wordfence","cve":"CVE-2025-64351","title":"Rank Math SEO <= 1.0.252.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec3f2bf3-4fa5-4ee5-901c-c72a73a1ec8b?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.252.1","to_inclusive":true,"patched_in":"1.0.253"}],"published":"2025-09-11T00:00:00Z","updated":"2025-11-04T15:53:43Z"},{"id":"wordfence:ec41956f-eefc-4c8b-ade1-2a3a0f3d86df","source":"wordfence","cve":"CVE-2025-4783","title":"Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec41956f-eefc-4c8b-ade1-2a3a0f3d86df?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.7.9.1","to_inclusive":true,"patched_in":"2.7.9.2"}],"published":"2025-05-26T10:52:00Z","updated":"2025-05-26T23:22:38Z"},{"id":"wordfence:ec425326-2729-4142-b5f4-460dfd3ed773","source":"wordfence","cve":"CVE-2024-13792","title":"WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec425326-2729-4142-b5f4-460dfd3ed773?source=api-prod","affected":[{"type":"plugin","slug":"woo-exfood","name":"WooCommerce Food - Restaurant Menu & Food ordering","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2025-02-19T00:00:00Z","updated":"2025-02-20T09:21:41Z"},{"id":"wordfence:ec46ab73-8429-4cfc-8867-1ee1db22b43c","source":"wordfence","cve":"CVE-2025-23765","title":"W3SPEEDSTER <= 7.33 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec46ab73-8429-4cfc-8867-1ee1db22b43c?source=api-prod","affected":[{"type":"plugin","slug":"w3speedster-wp","name":"W3SPEEDSTER","from":"*","from_inclusive":true,"to":"7.33","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:51:32Z"},{"id":"wordfence:ec47ffee-0599-4f16-a71d-d17dcfe9b183","source":"wordfence","cve":"CVE-2024-25919","title":"Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec47ffee-0599-4f16-a71d-d17dcfe9b183?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T16:04:46Z"},{"id":"wordfence:ec49ed83-a09d-460d-be34-0fb79032b543","source":"wordfence","cve":"CVE-2026-5505","title":"WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec49ed83-a09d-460d-be34-0fb79032b543?source=api-prod","affected":[{"type":"plugin","slug":"wp-clippy","name":"WP-Clippy","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-04T14:06:40Z","updated":"2026-05-05T02:26:58Z"},{"id":"wordfence:ec4bc1d4-2f14-4f3e-85ed-8737c56f905c","source":"wordfence","cve":"CVE-2026-1832","title":"ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4bc1d4-2f14-4f3e-85ed-8737c56f905c?source=api-prod","affected":[{"type":"plugin","slug":"thrivedesk","name":"ThriveDesk \u2013 Live Chat, AI Chatbot, Helpdesk & Customer Support Ticket System","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-07-10T15:36:28Z","updated":"2026-07-11T03:44:25Z"},{"id":"wordfence:ec4be524-a763-4f2b-8a1d-6189014b4d86","source":"wordfence","cve":"CVE-2025-10047","title":"Email Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=api-prod","affected":[{"type":"plugin","slug":"email-tracker","name":"Email Tracker","from":"*","from_inclusive":true,"to":"5.3.15","to_inclusive":true,"patched_in":"5.3.16"}],"published":"2025-10-21T20:17:44Z","updated":"2025-12-12T16:04:04Z"},{"id":"wordfence:ec4c14ec-d085-42c8-9e98-4155f7fa8c10","source":"wordfence","cve":"CVE-2024-25911","title":"MoveTo <= 6.2 - Unauthenticated Directory Traversal to Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4c14ec-d085-42c8-9e98-4155f7fa8c10?source=api-prod","affected":[{"type":"plugin","slug":"moveto","name":"Moveto - Movers quotation and booking management tool","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-14T14:53:25Z"},{"id":"wordfence:ec4d27d6-b54f-4fac-9a49-6798da4f0acc","source":"wordfence","cve":"CVE-2024-29799","title":"WP Fast Total Search <= 1.59.211 - Authenticated (Contributor+) Stored Cross-Site Scripting via WPFTS Live Search Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4d27d6-b54f-4fac-9a49-6798da4f0acc?source=api-prod","affected":[{"type":"plugin","slug":"fulltext-search","name":"WP Fast Total Search \u2013 The Power of Indexed Search","from":"*","from_inclusive":true,"to":"1.59.211","to_inclusive":true,"patched_in":"1.60.213"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T13:05:35Z"},{"id":"wordfence:ec4d807b-7119-40f0-99a8-5df8471c515b","source":"wordfence","cve":"CVE-2022-0531","title":"Migration, Backup, Staging \u2013 WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4d807b-7119-40f0-99a8-5df8471c515b?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.70","to_inclusive":false,"patched_in":"0.9.70"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec51f8e4-dba6-44e7-876b-2be58df19b8d","source":"wordfence","cve":"CVE-2025-49945","title":"Shortcode Generator <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec51f8e4-dba6-44e7-876b-2be58df19b8d?source=api-prod","affected":[{"type":"plugin","slug":"shortcode-generator","name":"Shortcode Generator","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-08T00:00:00Z","updated":"2025-11-17T18:13:40Z"},{"id":"wordfence:ec52337f-bdd1-4632-853b-da86d64751e7","source":"wordfence","cve":"CVE-2024-8430","title":"Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec52337f-bdd1-4632-853b-da86d64751e7?source=api-prod","affected":[{"type":"plugin","slug":"spice-starter-sites","name":"Spice Starter Sites","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T08:30:20Z"},{"id":"wordfence:ec53446d-00a5-48d3-b1f0-15cd05a9bd28","source":"wordfence","cve":"CVE-2025-31402","title":"NewsBoard Post and RSS Scroller <= 1.2.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec53446d-00a5-48d3-b1f0-15cd05a9bd28?source=api-prod","affected":[{"type":"plugin","slug":"newsboard","name":"NewsBoard Post and RSS Scroller","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:45:39Z"},{"id":"wordfence:ec5474ac-62d7-4431-b789-51c831dd1c20","source":"wordfence","cve":"CVE-2024-10014","title":"Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec5474ac-62d7-4431-b789-51c831dd1c20?source=api-prod","affected":[{"type":"plugin","slug":"flat-ui-button","name":"Flat UI Button","from":"1.0","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:41:27Z","updated":"2024-10-18T04:32:57Z"},{"id":"wordfence:ec547a1f-d57b-4792-b9d0-38e9a9c4d0a2","source":"wordfence","cve":"CVE-2021-24731","title":"Pie Register <= 3.7.1.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec547a1f-d57b-4792-b9d0-38e9a9c4d0a2?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.7.1.6","to_inclusive":false,"patched_in":"3.7.1.6"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec55a952-113d-43e4-aa82-5c3dc984b24a","source":"wordfence","cve":"CVE-2024-51657","title":"SmartLink Dynamic URLs <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec55a952-113d-43e4-aa82-5c3dc984b24a?source=api-prod","affected":[{"type":"plugin","slug":"smartlink-dinamic-urls","name":"SmartLink Dynamic URLs","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:21:37Z"},{"id":"wordfence:ec56fc7e-9752-4418-87b2-b27b09cf2654","source":"wordfence","cve":"CVE-2024-37093","title":"MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec56fc7e-9752-4418-87b2-b27b09cf2654?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:31:05Z"},{"id":"wordfence:ec57e0b2-61b0-4b67-9784-dbb4e6c4e4a6","source":"wordfence","cve":"CVE-2022-3995","title":"TeraWallet \u2013 For WooCommerce <= 1.4.3 - Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec57e0b2-61b0-4b67-9784-dbb4e6c4e4a6?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec5e4e3f-df8f-4e07-a6e0-72247b2dd7a7","source":"wordfence","cve":"CVE-2023-0865","title":"WooCommerce Multiple Customer Addresses & Shipping <= 21.6 - Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Address Creation/Deletion/View/Updates","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec5e4e3f-df8f-4e07-a6e0-72247b2dd7a7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multiple-customer-addresses","name":"WooCommerce Multiple Customer Addresses & Shipping","from":"*","from_inclusive":true,"to":"21.7","to_inclusive":false,"patched_in":"21.7"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec5fa360-6fff-46f5-8221-4b28a6db3e73","source":"wordfence","cve":"","title":"JSON REST API <= 1.1 - Potential Cross-Site Request Forgery Bypass","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec5fa360-6fff-46f5-8221-4b28a6db3e73?source=api-prod","affected":[{"type":"plugin","slug":"json-rest-api","name":"WP REST API (WP API)","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2014-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec5fc038-b855-4744-8797-ce2cedd88f6a","source":"wordfence","cve":"CVE-2022-3024","title":"Bitcoin Satoshi Tools <= 1.7.0 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec5fc038-b855-4744-8797-ce2cedd88f6a?source=api-prod","affected":[{"type":"plugin","slug":"simple-bitcoin-faucets","name":"Bitcoin Satoshi Tools :  Faucets, Visitor Rewarder, Satoshi Games, Referral Program","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2022-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec6331e1-7a7c-486d-873b-02b3af38387c","source":"wordfence","cve":"CVE-2016-10946","title":"Wp-D3 < 2.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6331e1-7a7c-486d-873b-02b3af38387c?source=api-prod","affected":[{"type":"plugin","slug":"wp-d3","name":"Wp-D3","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2016-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec6a4709-4cba-4068-860c-300deb741e73","source":"wordfence","cve":"CVE-2026-39662","title":"Product Price by Formula for WooCommerce <= 2.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6a4709-4cba-4068-860c-300deb741e73?source=api-prod","affected":[{"type":"plugin","slug":"product-price-by-formula-for-woocommerce","name":"Product Price by Formula for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:25:21Z"},{"id":"wordfence:ec6a9d6b-8440-40e8-8281-78a6299654de","source":"wordfence","cve":"CVE-2025-31056","title":"WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce <= 1.1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6a9d6b-8440-40e8-8281-78a6299654de?source=api-prod","affected":[{"type":"plugin","slug":"WhatsCart-for-WooCommerce","name":"WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T16:44:58Z"},{"id":"wordfence:ec6ea63d-60de-4b3f-8b7c-cbd951c3f737","source":"wordfence","cve":"","title":"WangGuard <= 1.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6ea63d-60de-4b3f-8b7c-cbd951c3f737?source=api-prod","affected":[{"type":"plugin","slug":"wangguard","name":"WangGuard","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2017-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec6ea6e7-9c43-4b58-a1df-947a3aa7cd54","source":"wordfence","cve":"CVE-2024-33925","title":"Embed Google Fonts <= 3.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6ea6e7-9c43-4b58-a1df-947a3aa7cd54?source=api-prod","affected":[{"type":"plugin","slug":"embed-google-fonts","name":"Embed Google Fonts","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-04-29T00:00:00Z","updated":"2026-02-26T14:57:48Z"},{"id":"wordfence:ec6f2c0d-4d92-4982-995d-5d8a9866b888","source":"wordfence","cve":"CVE-2021-3124","title":"Custom Global Variables <= 1.0.5 - Stored Cross-Site Scripting via 'name'","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec6f2c0d-4d92-4982-995d-5d8a9866b888?source=api-prod","affected":[{"type":"plugin","slug":"custom-global-variables","name":"Custom Global Variables","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2021-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec7649da-5358-4fe2-8706-b945bba02c93","source":"wordfence","cve":"CVE-2024-4821","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7649da-5358-4fe2-8706-b945bba02c93?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.1.6","to_inclusive":true,"patched_in":"7.1.7"}],"published":"2024-06-04T20:15:54Z","updated":"2024-06-17T18:06:19Z"},{"id":"wordfence:ec7a97c4-62d5-44e7-a28b-350ecf9ecf66","source":"wordfence","cve":"CVE-2024-12878","title":"Custom Block Builder \u2013 Lazy Blocks  <= 3.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7a97c4-62d5-44e7-a28b-350ecf9ecf66?source=api-prod","affected":[{"type":"plugin","slug":"lazy-blocks","name":"Custom Block Builder \u2013 Lazy Blocks","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:37:54Z"},{"id":"wordfence:ec7b77d8-490e-4eaf-a9df-54de63f128d4","source":"wordfence","cve":"CVE-2022-2381","title":"E Unlocked - Student Result <= 1.0.4 - Cross-Site Request Forgery to Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7b77d8-490e-4eaf-a9df-54de63f128d4?source=api-prod","affected":[{"type":"plugin","slug":"e-unlocked-student-result","name":"E Unlocked \u2013 Student Result","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec7f3e0c-a07c-4082-9b6b-12d0fbe0fdc8","source":"wordfence","cve":"CVE-2024-7493","title":"WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7f3e0c-a07c-4082-9b6b-12d0fbe0fdc8?source=api-prod","affected":[{"type":"plugin","slug":"wpcom-member","name":"WPCOM Member","from":"*","from_inclusive":true,"to":"1.5.2.1","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-09-06T01:15:44Z","updated":"2024-09-09T20:13:24Z"},{"id":"wordfence:ec7fa746-6df0-4bb4-9dff-1aeda2c53196","source":"wordfence","cve":"CVE-2026-28049","title":"Police Department <= 2.17 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec7fa746-6df0-4bb4-9dff-1aeda2c53196?source=api-prod","affected":[{"type":"theme","slug":"police-department","name":"Police Department - Fire & Security WordPress Theme","from":"*","from_inclusive":true,"to":"2.17","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:07:50Z"},{"id":"wordfence:ec83bf1f-a2da-4ecf-8d82-9a555c751073","source":"wordfence","cve":"CVE-2021-24186","title":"Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec83bf1f-a2da-4ecf-8d82-9a555c751073?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":false,"patched_in":"1.8.3"}],"published":"2021-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec857762-9506-4df0-afe6-7f738df976a2","source":"wordfence","cve":"CVE-2025-15363","title":"Get Use APIs \u2013 JSON Content Importer < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec857762-9506-4df0-afe6-7f738df976a2?source=api-prod","affected":[{"type":"plugin","slug":"json-content-importer","name":"Get Use APIs \u2013 JSON Content Importer","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":false,"patched_in":"2.0.10"}],"published":"2026-03-19T00:00:00Z","updated":"2026-03-19T14:50:51Z"},{"id":"wordfence:ec86085a-a4a4-4ff7-ac2a-8330f3d96344","source":"wordfence","cve":"CVE-2025-25072","title":"WP Admin Custom Page <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec86085a-a4a4-4ff7-ac2a-8330f3d96344?source=api-prod","affected":[{"type":"plugin","slug":"wp-admin-custom-page","name":"WP Admin Custom Page","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:08:35Z"},{"id":"wordfence:ec860ad9-7054-4ed2-a8f2-6589e4db36cd","source":"wordfence","cve":"CVE-2023-25465","title":"wp tell a friend popup form <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec860ad9-7054-4ed2-a8f2-6589e4db36cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-tell-a-friend-popup-form","name":"wp tell a friend popup form","from":"*","from_inclusive":true,"to":"7.1","to_inclusive":true,"patched_in":""}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec864830-2c8b-4ae4-9c45-3624d0be7d24","source":"wordfence","cve":"","title":"Disqus Comment System < 2.68 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec864830-2c8b-4ae4-9c45-3624d0be7d24?source=api-prod","affected":[{"type":"plugin","slug":"disqus-comment-system","name":"Disqus Comment System","from":"*","from_inclusive":true,"to":"2.68","to_inclusive":false,"patched_in":"2.68"}],"published":"2011-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec8666d4-042e-4cf4-86f5-474a69d90ff6","source":"wordfence","cve":"CVE-2024-11080","title":"Post Grid and Gutenberg Blocks \u2013 ComboBlocks 2.2.85 - 2.3.22 - Unauthenticated Hook Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"2.2.85","from_inclusive":true,"to":"2.3.22","to_inclusive":true,"patched_in":"2.3.23"}],"published":"2026-09-04T19:52:37Z","updated":"2026-09-10T19:43:22Z"},{"id":"wordfence:ec866ff1-cce1-4f39-b22f-2d4780cb85f0","source":"wordfence","cve":"CVE-2025-23974","title":"One-Login <= 1.4 - Unauthenticated Privilege Esclation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec866ff1-cce1-4f39-b22f-2d4780cb85f0?source=api-prod","affected":[{"type":"plugin","slug":"one-login","name":"One-Login","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T15:01:41Z"},{"id":"wordfence:ec882062-0059-47ca-a007-3347e7adb70b","source":"wordfence","cve":"CVE-2023-5109","title":"WP Mailto Links \u2013 Protect Email Addresses <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec882062-0059-47ca-a007-3347e7adb70b?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailto-links","name":"WP Mailto Links \u2013 Protect Email Addresses","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec894433-53c8-4d04-bb8a-92c66cbd2ce7","source":"wordfence","cve":"","title":"Google Language Translator < 6.0.20 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec894433-53c8-4d04-bb8a-92c66cbd2ce7?source=api-prod","affected":[{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.20","to_inclusive":false,"patched_in":"6.0.20"}],"published":"2023-12-08T00:00:00Z","updated":"2025-12-08T22:47:08Z"},{"id":"wordfence:ec898f73-d275-4624-911b-89d9a945ff92","source":"wordfence","cve":"CVE-2026-13764","title":"Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec898f73-d275-4624-911b-89d9a945ff92?source=api-prod","affected":[{"type":"theme","slug":"masterstudy","name":"Masterstudy - Education WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.151","to_inclusive":true,"patched_in":"4.8.152"}],"published":"2026-11-11T22:29:23Z","updated":"2026-11-12T11:32:17Z"},{"id":"wordfence:ec8a7e8c-225e-4d68-9219-942a8bf0a861","source":"wordfence","cve":"CVE-2025-23741","title":"Notifications Center <= 1.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8a7e8c-225e-4d68-9219-942a8bf0a861?source=api-prod","affected":[{"type":"plugin","slug":"notifications-center","name":"Notifications Center","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-14T15:33:26Z"},{"id":"wordfence:ec8ad817-9716-4d29-a02a-57eb9aa58a13","source":"wordfence","cve":"CVE-2004-1584","title":"WordPress Core <= 1.2 - HTTP Response Splitting","severity":"medium","cvss":5.3,"cwe":"CWE-113","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8ad817-9716-4d29-a02a-57eb9aa58a13?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2004-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec8efec7-fae5-4122-b3d3-c0e65f767a5d","source":"wordfence","cve":"CVE-2026-42708","title":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8efec7-fae5-4122-b3d3-c0e65f767a5d?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-author","name":"WP Post Author \u2013 Author Box, Multiple Authors, Guest Authors & Custom Avatars","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-07T11:59:00Z","updated":"2026-10-08T23:50:54Z"},{"id":"wordfence:ec9029a3-be05-469a-a8e2-20987a4a4ad9","source":"wordfence","cve":"CVE-2023-49195","title":"Nested Pages <= 3.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec9029a3-be05-469a-a8e2-20987a4a4ad9?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec910ce8-c0bd-4189-8fb5-4d7c51d5a5d6","source":"wordfence","cve":"CVE-2026-119499","title":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist <= 7.8.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec910ce8-c0bd-4189-8fb5-4d7c51d5a5d6?source=api-prod","affected":[{"type":"plugin","slug":"bakkbone-florist-companion","name":"FloristPress for Woo \u2013 Customize your eCommerce store for your Florist","from":"*","from_inclusive":true,"to":"7.8.4","to_inclusive":true,"patched_in":"7.8.5"}],"published":"2026-11-04T07:17:44Z","updated":"2026-11-10T19:29:31Z"},{"id":"wordfence:ec93f360-2eed-4858-b36f-8cc17f7b4ac1","source":"wordfence","cve":"CVE-2024-2090","title":"Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec93f360-2eed-4858-b36f-8cc17f7b4ac1?source=api-prod","affected":[{"type":"plugin","slug":"remote-content-shortcode","name":"Remote Content Shortcode","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-07-31T15:49:57Z","updated":"2024-08-01T04:29:44Z"},{"id":"wordfence:ec96308f-3944-48c5-94be-b1555c0830b7","source":"wordfence","cve":"CVE-2026-75528","title":"Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec96308f-3944-48c5-94be-b1555c0830b7?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.13.1"}],"published":"2026-09-01T18:57:15Z","updated":"2026-09-02T07:39:09Z"},{"id":"wordfence:ec9636d5-80bc-418e-9348-a1d2777bf1fc","source":"wordfence","cve":"CVE-2026-84938","title":"Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec9636d5-80bc-418e-9348-a1d2777bf1fc?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.16.1","to_inclusive":true,"patched_in":"3.16.2"}],"published":"2026-11-09T18:41:21Z","updated":"2026-11-10T06:47:03Z"},{"id":"wordfence:ec9a771f-bd55-4b64-8bb8-a5f795a7ab5d","source":"wordfence","cve":"CVE-2025-24708","title":"WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec9a771f-bd55-4b64-8bb8-a5f795a7ab5d?source=api-prod","affected":[{"type":"plugin","slug":"cf7-dynamics-crm","name":"WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-01-27T00:00:00Z","updated":"2025-02-03T14:33:25Z"},{"id":"wordfence:ec9cd4a8-286e-43d7-8cb6-6cc363800e20","source":"wordfence","cve":"","title":"MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec9cd4a8-286e-43d7-8cb6-6cc363800e20?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":false,"patched_in":"1.4.4"}],"published":"2020-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ec9d3cca-7061-4dc4-9c71-b2ffbfde120b","source":"wordfence","cve":"CVE-2025-3414","title":"Structured Content (JSON-LD) #wpsc <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via FAQ Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ec9d3cca-7061-4dc4-9c71-b2ffbfde120b?source=api-prod","affected":[{"type":"plugin","slug":"structured-content","name":"Structured Content (JSON-LD) #wpsc","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-07-24T00:00:00Z","updated":"2025-08-25T15:37:34Z"},{"id":"wordfence:eca01c62-178e-4df5-a1dc-690cb9d5bb25","source":"wordfence","cve":"CVE-2026-105076","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eca01c62-178e-4df5-a1dc-690cb9d5bb25?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:31:17Z"},{"id":"wordfence:eca1de60-1eaf-4d3e-b098-8ae2890777ed","source":"wordfence","cve":"CVE-2026-119493","title":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists <= 3.1.71 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eca1de60-1eaf-4d3e-b098-8ae2890777ed?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.1.71","to_inclusive":true,"patched_in":"3.1.72"}],"published":"2026-11-07T10:02:00Z","updated":"2026-11-10T19:28:39Z"},{"id":"wordfence:eca703ec-645c-4d12-ae57-75db14e08f3e","source":"wordfence","cve":"CVE-2023-51359","title":"Essential Blocks for Gutenberg <= 4.2.0 - Incorrect Authorization Checks","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eca703ec-645c-4d12-ae57-75db14e08f3e?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecaa02bf-62be-4f1d-af31-96afc72a830d","source":"wordfence","cve":"CVE-2024-7816","title":"Gixaw Chat <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecaa02bf-62be-4f1d-af31-96afc72a830d?source=api-prod","affected":[{"type":"plugin","slug":"gixaw-chat","name":"Gixaw Chat","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-08-26T15:16:07Z"},{"id":"wordfence:ecad5438-8992-454c-bdc8-fac7635c1024","source":"wordfence","cve":"CVE-2024-43227","title":"BetterDocs <= 3.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecad5438-8992-454c-bdc8-fac7635c1024?source=api-prod","affected":[{"type":"plugin","slug":"betterdocs","name":"BetterDocs \u2013 AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-13T20:13:20Z"},{"id":"wordfence:ecae113c-c66a-4f27-bf81-6679a4717ff8","source":"wordfence","cve":"CVE-2024-29817","title":"affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecae113c-c66a-4f27-bf81-6679a4717ff8?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-28T13:41:47Z"},{"id":"wordfence:ecae11ec-c952-4f5a-9e55-e2ac2fa05100","source":"wordfence","cve":"CVE-2026-18345","title":"WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecae11ec-c952-4f5a-9e55-e2ac2fa05100?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.18","to_inclusive":true,"patched_in":"2.9.19"}],"published":"2026-09-21T18:59:14Z","updated":"2026-09-22T07:41:15Z"},{"id":"wordfence:ecae15fc-4842-43a0-b5a3-da50cf42d9ad","source":"wordfence","cve":"CVE-2025-66161","title":"Grider for Elementor <= 1.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecae15fc-4842-43a0-b5a3-da50cf42d9ad?source=api-prod","affected":[{"type":"plugin","slug":"grider-elementor","name":"Grider for Elementor","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T00:00:00Z","updated":"2025-12-19T17:03:23Z"},{"id":"wordfence:ecb40bc2-aff5-4ced-8ded-1505d7b9db45","source":"wordfence","cve":"CVE-2015-2040","title":"Contact Form DB <= 2.8.26 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecb40bc2-aff5-4ced-8ded-1505d7b9db45?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-to-database-extension","name":"Contact Form DB","from":"*","from_inclusive":true,"to":"2.8.26","to_inclusive":true,"patched_in":"2.8.28"}],"published":"2015-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecb86ea6-2aca-4f7c-be81-a572b53b7953","source":"wordfence","cve":"CVE-2023-0174","title":"WP VR <= 8.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecb86ea6-2aca-4f7c-be81-a572b53b7953?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecbb40a5-3e33-4084-a19b-daf014ce68c8","source":"wordfence","cve":"","title":"Affiliates Manager <= 2.9.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbb40a5-3e33-4084-a19b-daf014ce68c8?source=api-prod","affected":[{"type":"plugin","slug":"affiliates-manager","name":"Affiliates Manager","from":"*","from_inclusive":true,"to":"2.9.13","to_inclusive":true,"patched_in":"2.9.14"}],"published":"2022-08-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecbb7388-c11a-4d71-ae29-c7af176c486f","source":"wordfence","cve":"CVE-2026-115257","title":"WP Roster < 2.36 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbb7388-c11a-4d71-ae29-c7af176c486f?source=api-prod","affected":[{"type":"plugin","slug":"wp-roster","name":"WP Roster","from":"*","from_inclusive":true,"to":"2.36","to_inclusive":false,"patched_in":"2.36"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:35:07Z"},{"id":"wordfence:ecbbe9f0-bf6c-4153-9843-8ae7713adef9","source":"wordfence","cve":"CVE-2021-38342","title":"Nested Pages <= 3.1.15 - Cross-Site Request Forgery to Arbitrary Post Deletion and Modification","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbbe9f0-bf6c-4153-9843-8ae7713adef9?source=api-prod","affected":[{"type":"plugin","slug":"wp-nested-pages","name":"Nested Pages","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":true,"patched_in":"3.1.16"}],"published":"2021-08-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecbc7f05-fc4f-4276-968e-04222a64e55a","source":"wordfence","cve":"CVE-2026-15300","title":"GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbc7f05-fc4f-4276-968e-04222a64e55a?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-05-27T18:46:46Z","updated":"2026-07-10T04:31:27Z"},{"id":"wordfence:ecbe6b38-6865-4bc7-a0ba-4e4a91a5d6ba","source":"wordfence","cve":"CVE-2025-58665","title":"Form Generator for WordPress <= 1.52 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbe6b38-6865-4bc7-a0ba-4e4a91a5d6ba?source=api-prod","affected":[{"type":"plugin","slug":"form-generator-powered-by-jotform","name":"Form Generator for WordPress","from":"*","from_inclusive":true,"to":"1.52","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:48:48Z"},{"id":"wordfence:ecc00cbc-ec65-4664-8ec6-8cfb47196ec1","source":"wordfence","cve":"CVE-2024-33576","title":"WPPizza <= 3.18.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc00cbc-ec65-4664-8ec6-8cfb47196ec1?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.18.10","to_inclusive":true,"patched_in":"3.18.11"}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-01T14:09:50Z"},{"id":"wordfence:ecc0f60f-d63b-498c-ab00-47551c62c89e","source":"wordfence","cve":"CVE-2026-25457","title":"Mixtape <= 2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc0f60f-d63b-498c-ab00-47551c62c89e?source=api-prod","affected":[{"type":"theme","slug":"mixtape","name":"Mixtape","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-19T14:52:03Z"},{"id":"wordfence:ecc34552-c9b0-455f-b1c7-b31cc847cb22","source":"wordfence","cve":"CVE-2026-4306","title":"WP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc34552-c9b0-455f-b1c7-b31cc847cb22?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-03-23T10:12:47Z","updated":"2026-03-23T22:25:40Z"},{"id":"wordfence:ecc55a5b-efb4-45a3-9764-f297a6bcfb69","source":"wordfence","cve":"CVE-2025-3597","title":"Firelight Lightbox <= 2.3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc55a5b-efb4-45a3-9764-f297a6bcfb69?source=api-prod","affected":[{"type":"plugin","slug":"easy-fancybox","name":"Firelight Lightbox","from":"*","from_inclusive":true,"to":"2.3.14","to_inclusive":true,"patched_in":"2.3.15"}],"published":"2025-04-21T00:00:00Z","updated":"2025-05-14T20:10:26Z"},{"id":"wordfence:ecc59a6f-5e4a-44b4-932d-ed990ebb075a","source":"wordfence","cve":"CVE-2023-0279","title":"Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc59a6f-5e4a-44b4-932d-ed990ebb075a?source=api-prod","affected":[{"type":"plugin","slug":"media-library-assistant","name":"Media Library Assistant","from":"*","from_inclusive":true,"to":"3.05","to_inclusive":true,"patched_in":"3.06"}],"published":"2023-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecc5a17e-c716-48bd-9b4d-49d870ae6bf3","source":"wordfence","cve":"CVE-2024-0508","title":"Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc5a17e-c716-48bd-9b4d-49d870ae6bf3?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.10.27","to_inclusive":true,"patched_in":"2.10.28"}],"published":"2024-01-15T00:00:00Z","updated":"2024-07-29T21:37:45Z"},{"id":"wordfence:ecc7ac81-46cd-49ff-a01d-8679ccbc18a1","source":"wordfence","cve":"CVE-2026-9065","title":"SureCart <= 4.2.0 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc7ac81-46cd-49ff-a01d-8679ccbc18a1?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2026-05-20T00:00:00Z","updated":"2026-07-30T17:32:32Z"},{"id":"wordfence:ecc87d5f-dba4-40f8-946f-f2634614b579","source":"wordfence","cve":"CVE-2024-11712","title":"WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download","severity":"medium","cvss":5.3,"cwe":"CWE-359","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc87d5f-dba4-40f8-946f-f2634614b579?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T06:45:16Z"},{"id":"wordfence:ecc8996a-d95c-4711-ac7d-523f5100c7fc","source":"wordfence","cve":"CVE-2024-23523","title":"Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecc8996a-d95c-4711-ac7d-523f5100c7fc?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.19.2","to_inclusive":true,"patched_in":"3.19.3"}],"published":"2024-02-26T00:00:00Z","updated":"2024-03-04T13:24:58Z"},{"id":"wordfence:eccad28f-f55f-4c7e-a163-3b2015e7e50b","source":"wordfence","cve":"CVE-2025-24726","title":"HT Conctact Form 7 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eccad28f-f55f-4c7e-a163-3b2015e7e50b?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:39:13Z"},{"id":"wordfence:eccaf0cc-4626-40db-942b-7e939be1a8fa","source":"wordfence","cve":"CVE-2025-53994","title":"JetPopup <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eccaf0cc-4626-40db-942b-7e939be1a8fa?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":"2.0.15.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:52:54Z"},{"id":"wordfence:eccc47cb-9078-405b-9b09-2e14e72ee005","source":"wordfence","cve":"CVE-2020-24148","title":"Import XML and RSS Feeds <= 2.0.2 - Server-Side Request Forgery","severity":"critical","cvss":9.1,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eccc47cb-9078-405b-9b09-2e14e72ee005?source=api-prod","affected":[{"type":"plugin","slug":"import-xml-feed","name":"Import XML and RSS Feeds","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":false,"patched_in":"2.0.3"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecce583b-1e72-44e1-ab33-6cc647e62119","source":"wordfence","cve":"CVE-2026-119097","title":"Author Image <= 4.9.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecce583b-1e72-44e1-ab33-6cc647e62119?source=api-prod","affected":[{"type":"plugin","slug":"sem-author-image","name":"Author Image","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":""}],"published":"2026-11-10T21:45:07Z","updated":"2026-11-11T11:31:08Z"},{"id":"wordfence:eccea504-b8b9-46d3-b9fd-ae893528e521","source":"wordfence","cve":"CVE-2024-6626","title":"EleForms \u2013 All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eccea504-b8b9-46d3-b9fd-ae893528e521?source=api-prod","affected":[{"type":"plugin","slug":"all-contact-form-integration-for-elementor","name":"EleForms \u2013 All In One Form Integration including DB for Elementor","from":"*","from_inclusive":true,"to":"2.9.9.9","to_inclusive":true,"patched_in":""}],"published":"2024-11-05T18:16:27Z","updated":"2024-11-06T06:43:32Z"},{"id":"wordfence:ecd01ea6-9476-47e1-9959-3f8d9ce1c1f3","source":"wordfence","cve":"CVE-2024-1521","title":"Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd01ea6-9476-47e1-9959-3f8d9ce1c1f3?source=api-prod","affected":[{"type":"plugin","slug":"elementor-pro","name":"Elementor Website Builder Pro","from":"*","from_inclusive":true,"to":"3.20.1","to_inclusive":true,"patched_in":"3.20.2"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T06:40:52Z"},{"id":"wordfence:ecd28218-6b43-4f61-bcca-117c353e79be","source":"wordfence","cve":"CVE-2025-24767","title":"TicketBAI Facturas para WooCommerce <= 3.19 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd28218-6b43-4f61-bcca-117c353e79be?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticketbai","name":"TicketBAI Facturas para WooCommerce","from":"*","from_inclusive":true,"to":"3.19","to_inclusive":true,"patched_in":"3.21"}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T15:08:18Z"},{"id":"wordfence:ecd35d5a-5270-4132-bc62-d75da5141313","source":"wordfence","cve":"","title":"Floating Social Media Links < 1.4.3 - Remote File Inclusion via fsml-admin.js.php wpp parameter","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd35d5a-5270-4132-bc62-d75da5141313?source=api-prod","affected":[{"type":"plugin","slug":"floating-social-media-links","name":"Floating Social Media Links","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2012-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecd383f1-0546-4ff2-9f93-ee9d48ac3053","source":"wordfence","cve":"CVE-2025-10652","title":"Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd383f1-0546-4ff2-9f93-ee9d48ac3053?source=api-prod","affected":[{"type":"plugin","slug":"robcore-netatmo","name":"Robcore Netatmo","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T13:25:18Z","updated":"2025-09-20T01:53:42Z"},{"id":"wordfence:ecd48e2c-343f-4bae-9d9e-260d003ef87c","source":"wordfence","cve":"CVE-2025-2077","title":"Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd48e2c-343f-4bae-9d9e-260d003ef87c?source=api-prod","affected":[{"type":"plugin","slug":"simple-amazon-affiliate","name":"Simple Amazon Affiliate","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T14:22:03Z","updated":"2025-03-12T03:21:28Z"},{"id":"wordfence:ecd4ed5d-333c-40c1-a241-683b657ba417","source":"wordfence","cve":"CVE-2024-5440","title":"If-So Dynamic Content Personalization <= 1.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd4ed5d-333c-40c1-a241-683b657ba417?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.8.0.2","to_inclusive":true,"patched_in":"1.8.0.3"}],"published":"2024-05-10T00:00:00Z","updated":"2025-05-29T22:16:23Z"},{"id":"wordfence:ecd504ad-8812-46ec-be18-e98d05982312","source":"wordfence","cve":"CVE-2022-46812","title":"Thank You Page Customizer for WooCommerce \u2013 Increase Your Sales <= 1.0.13 - Cross-Site Request Forgery via send_email","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd504ad-8812-46ec-be18-e98d05982312?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecd68933-e808-4816-b9d2-7491194f2347","source":"wordfence","cve":"","title":"Stream <= 3.0.5 - Sensitive Data Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd68933-e808-4816-b9d2-7491194f2347?source=api-prod","affected":[{"type":"plugin","slug":"stream","name":"Stream \u2013 Activity Log & Audit Trail","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2016-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecd8a81b-b1db-411b-90f4-2a7de3a3ca27","source":"wordfence","cve":"CVE-2024-47343","title":"Mega Elements <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd8a81b-b1db-411b-90f4-2a7de3a3ca27?source=api-prod","affected":[{"type":"plugin","slug":"mega-elements-addons-for-elementor","name":"Mega Elements \u2013 Addons for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:20:33Z"},{"id":"wordfence:ecd93c67-fe26-4ee5-af23-8c26b822dc60","source":"wordfence","cve":"CVE-2024-54344","title":"WP Quick Shop <= 1.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd93c67-fe26-4ee5-af23-8c26b822dc60?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-shop","name":"WP Quick Shop","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:08:22Z"},{"id":"wordfence:ecd9800e-ce0f-45f3-bb66-3690c51d885b","source":"wordfence","cve":"CVE-2024-5674","title":"Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd9800e-ce0f-45f3-bb66-3690c51d885b?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-api","name":"Newsletter - API v1 and v2 addon for Newsletter","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2024-06-11T22:11:42Z","updated":"2024-06-12T11:05:09Z"},{"id":"wordfence:ecd9c07e-8711-4ac8-86e1-faf29760fc3a","source":"wordfence","cve":"CVE-2026-84906","title":"Eventin <= 4.1.23 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd9c07e-8711-4ac8-86e1-faf29760fc3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:54:09Z"},{"id":"wordfence:ecdb7f0e-aacb-4e79-a041-e9e060b61573","source":"wordfence","cve":"CVE-2026-79615","title":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker < 11.2.4 - Authenticated (Contributor+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecdb7f0e-aacb-4e79-a041-e9e060b61573?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"11.2.4","to_inclusive":false,"patched_in":"11.2.4"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:41:45Z"},{"id":"wordfence:ecdcad88-c926-490f-8e83-09d92ba080f8","source":"wordfence","cve":"CVE-2018-20150","title":"WordPress Core < 5.0.1 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecdcad88-c926-490f-8e83-09d92ba080f8?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.27","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.25","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.24","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.17","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.16","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.15","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.11","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.7","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.8","to_inclusive":true,"patched_in":"3.7.28"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"3.7.28"}],"published":"2018-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecddca6d-c977-47e8-a91c-7cf3f59f668b","source":"wordfence","cve":"CVE-2025-23710","title":"Flying Twitter Birds <= 1.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecddca6d-c977-47e8-a91c-7cf3f59f668b?source=api-prod","affected":[{"type":"plugin","slug":"flying-twitter-birds","name":"Flying Twitter Birds","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:16:08Z"},{"id":"wordfence:ecde34f7-4624-4361-8d95-56fd4b08b476","source":"wordfence","cve":"","title":"Minimal Coming Soon \u2013 Coming Soon Page <= 2.33 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecde34f7-4624-4361-8d95-56fd4b08b476?source=api-prod","affected":[{"type":"plugin","slug":"minimal-coming-soon-maintenance-mode","name":"Minimal Coming Soon \u2013 Coming Soon Page","from":"*","from_inclusive":true,"to":"2.34","to_inclusive":true,"patched_in":"2.35"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecdfb19e-ef3a-4c5a-96a5-4c9ce3dca3a6","source":"wordfence","cve":"CVE-2022-1960","title":"MyCSS <= 1.1 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecdfb19e-ef3a-4c5a-96a5-4c9ce3dca3a6?source=api-prod","affected":[{"type":"plugin","slug":"mycss","name":"MyCSS","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ece14f57-475d-4efc-8daf-52dfdaa12697","source":"wordfence","cve":"CVE-2026-96870","title":"SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece14f57-475d-4efc-8daf-52dfdaa12697?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.12.1"}],"published":"2026-10-15T18:46:30Z","updated":"2026-10-29T18:29:43Z"},{"id":"wordfence:ece1d9b6-39f7-4f79-9ce2-c2498c005f0f","source":"wordfence","cve":"CVE-2025-23855","title":"SpiderDisplay <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece1d9b6-39f7-4f79-9ce2-c2498c005f0f?source=api-prod","affected":[{"type":"plugin","slug":"spiderdisplay","name":"SpiderDisplay","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T21:35:11Z"},{"id":"wordfence:ece2fb02-0b65-4a03-806e-4ef6abd19bae","source":"wordfence","cve":"CVE-2026-22416","title":"FixTeam | Electronics & Mobile Devices Repair WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece2fb02-0b65-4a03-806e-4ef6abd19bae?source=api-prod","affected":[{"type":"theme","slug":"fixteam","name":"FixTeam | Electronics & Mobile Devices Repair WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:39:37Z"},{"id":"wordfence:ece47fc8-6a53-424f-97e9-10c11e7da47c","source":"wordfence","cve":"CVE-2026-121768","title":"Post Fields for Contact Form 7 <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece47fc8-6a53-424f-97e9-10c11e7da47c?source=api-prod","affected":[{"type":"plugin","slug":"cf7-post-fields","name":"Post Fields for Contact Form 7","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T13:11:30Z"},{"id":"wordfence:ece4eca1-9dc1-4f17-92e4-8b2e3e1a7306","source":"wordfence","cve":"CVE-2023-51402","title":"Ultimate Addons for WPBakery <= 3.19.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece4eca1-9dc1-4f17-92e4-8b2e3e1a7306?source=api-prod","affected":[{"type":"plugin","slug":"Ultimate_VC_Addons","name":"Ultimate Addons for WPBakery","from":"*","from_inclusive":true,"to":"3.19.17","to_inclusive":true,"patched_in":"3.19.18"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ece6c07c-ea99-43f6-a8b7-f610e8db746e","source":"wordfence","cve":"CVE-2026-25012","title":"Bannerize Pro <= 1.11.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece6c07c-ea99-43f6-a8b7-f610e8db746e?source=api-prod","affected":[{"type":"plugin","slug":"wp-bannerize-pro","name":"WP Bannerize Pro","from":"*","from_inclusive":true,"to":"1.11.0","to_inclusive":true,"patched_in":"1.11.1"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-02T20:40:48Z"},{"id":"wordfence:ece722f3-b250-4ebf-9ce2-49e200b6873d","source":"wordfence","cve":"CVE-2025-52834","title":"Homey <= 2.4.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece722f3-b250-4ebf-9ce2-49e200b6873d?source=api-prod","affected":[{"type":"theme","slug":"homey","name":"Homey","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2025-06-24T00:00:00Z","updated":"2025-07-01T19:21:26Z"},{"id":"wordfence:ece7810c-a65d-421e-ad16-03e51eafeeb6","source":"wordfence","cve":"CVE-2024-37436","title":"Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece7810c-a65d-421e-ad16-03e51eafeeb6?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-toolkit-pro","name":"Uncanny Toolkit Pro for LearnDash","from":"*","from_inclusive":true,"to":"4.1.4","to_inclusive":true,"patched_in":"4.1.4.1"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T16:25:11Z"},{"id":"wordfence:ece9e89c-99d5-446d-a189-21848d75c273","source":"wordfence","cve":"CVE-2024-37931","title":"Point <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ece9e89c-99d5-446d-a189-21848d75c273?source=api-prod","affected":[{"type":"theme","slug":"point","name":"Point","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:42:04Z"},{"id":"wordfence:ecebc618-2d39-4284-bb31-59de0e17bc63","source":"wordfence","cve":"CVE-2025-31735","title":"Footnotes for WordPress <= 2016.1230 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecebc618-2d39-4284-bb31-59de0e17bc63?source=api-prod","affected":[{"type":"plugin","slug":"footnotes-for-wordpress","name":"Footnotes for WordPress","from":"*","from_inclusive":true,"to":"2016.1230","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:25:59Z"},{"id":"wordfence:ecec3eb4-04db-47af-974f-bacc530a7c70","source":"wordfence","cve":"CVE-2024-49217","title":"Adding drop down roles in registration <= 1.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecec3eb4-04db-47af-974f-bacc530a7c70?source=api-prod","affected":[{"type":"plugin","slug":"user-drop-down-roles-in-registration","name":"Adding drop down roles in registration","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T17:23:00Z"},{"id":"wordfence:ececa0ea-3d44-4b1b-b962-809a8b24c890","source":"wordfence","cve":"CVE-2016-11085","title":"Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ececa0ea-3d44-4b1b-b962-809a8b24c890?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"4.7.9","to_inclusive":false,"patched_in":"4.7.9"}],"published":"2016-12-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eceef5c6-ab17-405a-838f-4259072c5280","source":"wordfence","cve":"CVE-2025-58623","title":"Event Feed for Eventbrite <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eceef5c6-ab17-405a-838f-4259072c5280?source=api-prod","affected":[{"type":"plugin","slug":"event-feed-for-eventbrite","name":"Show Eventbrite Events \u2013 Event Feed for Eventbrite","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T22:39:17Z"},{"id":"wordfence:ecf1ce11-58cd-459c-ab9e-6ac40535fabd","source":"wordfence","cve":"CVE-2022-3830","title":"WP Page Builder <= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf1ce11-58cd-459c-ab9e-6ac40535fabd?source=api-prod","affected":[{"type":"plugin","slug":"wp-pagebuilder","name":"WP Page Builder","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecf1dfb2-8140-45c0-b75c-10d1c1fdc07a","source":"wordfence","cve":"CVE-2024-37920","title":"ARForms Form Builder <= 1.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf1dfb2-8140-45c0-b75c-10d1c1fdc07a?source=api-prod","affected":[{"type":"plugin","slug":"arforms-form-builder","name":"Contact Form, Survey, Quiz & Popup Form Builder \u2013 ARForms","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:24:36Z"},{"id":"wordfence:ecf36533-1dd1-43d7-b12e-7b425c13530a","source":"wordfence","cve":"CVE-2020-5391","title":"Login by Auth0 <= 3.11.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf36533-1dd1-43d7-b12e-7b425c13530a?source=api-prod","affected":[{"type":"plugin","slug":"auth0","name":"Login by Auth0","from":"*","from_inclusive":true,"to":"3.11.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecf39f38-a476-47a8-a632-986b851895a6","source":"wordfence","cve":"CVE-2026-12404","title":"NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf39f38-a476-47a8-a632-986b851895a6?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.2.2","to_inclusive":true,"patched_in":"9.2.3"}],"published":"2026-06-26T17:24:08Z","updated":"2026-06-27T05:33:44Z"},{"id":"wordfence:ecf476a8-e341-44d4-988c-a7fb3fb538d1","source":"wordfence","cve":"CVE-2024-13349","title":"Stockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf476a8-e341-44d4-988c-a7fb3fb538d1?source=api-prod","affected":[{"type":"plugin","slug":"stockdio-historical-chart","name":"Stockdio Historical Chart","from":"*","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2025-01-30T00:41:37Z","updated":"2025-01-30T16:34:28Z"},{"id":"wordfence:ecf73f3a-5f7b-4ef4-a31a-f282b953f294","source":"wordfence","cve":"CVE-2014-8749","title":"BulletProof Security < .51.1 - Server-Side Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf73f3a-5f7b-4ef4-a31a-f282b953f294?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".51","to_inclusive":true,"patched_in":".51.1"}],"published":"2014-11-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecf803cf-1b9c-4d2e-863f-d1f51b08f833","source":"wordfence","cve":"CVE-2024-10959","title":"Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf803cf-1b9c-4d2e-863f-d1f51b08f833?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.5","to_inclusive":true,"patched_in":"1.0.6.6"}],"published":"2024-12-09T21:35:41Z","updated":"2024-12-10T11:09:15Z"},{"id":"wordfence:ecf89a1d-c4d2-48cd-b9a2-5878720e15ca","source":"wordfence","cve":"CVE-2026-115816","title":"Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf89a1d-c4d2-48cd-b9a2-5878720e15ca?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2026-11-06T14:06:08Z","updated":"2026-11-07T02:29:18Z"},{"id":"wordfence:ecfa530c-a164-4215-b68a-7be81be3fd48","source":"wordfence","cve":"CVE-2023-25447","title":"ColorWay <= 4.2.3 - Cross Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfa530c-a164-4215-b68a-7be81be3fd48?source=api-prod","affected":[{"type":"theme","slug":"colorway","name":"ColorWay","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecfc1466-41d2-498b-8210-c67e8550f5b8","source":"wordfence","cve":"CVE-2024-4401","title":"Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfc1466-41d2-498b-8210-c67e8550f5b8?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.5","to_inclusive":true,"patched_in":"1.13.6"}],"published":"2024-08-29T14:38:46Z","updated":"2024-08-30T03:37:47Z"},{"id":"wordfence:ecfcbb55-10ba-45d8-9b05-c08d0aeb7675","source":"wordfence","cve":"CVE-2024-8085","title":"PeoplePond <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfcbb55-10ba-45d8-9b05-c08d0aeb7675?source=api-prod","affected":[{"type":"plugin","slug":"peoplepond","name":"PeoplePond","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":""}],"published":"2024-09-20T00:00:00Z","updated":"2024-09-24T16:05:41Z"},{"id":"wordfence:ecfdd114-b7bb-45bf-84df-a92f10b2fd81","source":"wordfence","cve":"CVE-2023-32514","title":"Google Site Verification plugin using Meta Tag <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdd114-b7bb-45bf-84df-a92f10b2fd81?source=api-prod","affected":[{"type":"plugin","slug":"google-site-verification-using-meta-tag","name":"Google Site Verification plugin using Meta Tag","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab","source":"wordfence","cve":"CVE-2024-6457","title":"HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.6.1"}],"published":"2024-07-15T00:00:00Z","updated":"2024-07-16T11:00:58Z"},{"id":"wordfence:ecfe024a-7bb2-45b1-849e-e6dd22666e56","source":"wordfence","cve":"CVE-2024-52378","title":"DigiPass <= 0.3.0 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfe024a-7bb2-45b1-849e-e6dd22666e56?source=api-prod","affected":[{"type":"plugin","slug":"digipass","name":"DigiPass","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:33:14Z"},{"id":"wordfence:ecfe9e4c-baa8-44ae-8784-3d14faf3fe91","source":"wordfence","cve":"CVE-2025-50049","title":"Modern Footnotes <= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfe9e4c-baa8-44ae-8784-3d14faf3fe91?source=api-prod","affected":[{"type":"plugin","slug":"modern-footnotes","name":"Modern Footnotes","from":"*","from_inclusive":true,"to":"1.4.19","to_inclusive":true,"patched_in":"1.4.20"}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T17:47:46Z"},{"id":"wordfence:ed037e94-68b4-4efc-9d1a-fffc4aff1c45","source":"wordfence","cve":"CVE-2023-5527","title":"Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection","severity":"high","cvss":7.4,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed037e94-68b4-4efc-9d1a-fffc4aff1c45?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2024-06-17T00:00:00Z","updated":"2024-06-26T19:34:15Z"},{"id":"wordfence:ed038d39-9389-49d3-bfdd-b97fadb8e29b","source":"wordfence","cve":"CVE-2024-50485","title":"Exam Matrix <= 1.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed038d39-9389-49d3-bfdd-b97fadb8e29b?source=api-prod","affected":[{"type":"plugin","slug":"exam-matrix","name":"Exam Matrix","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:37:33Z"},{"id":"wordfence:ed03bfca-4044-4815-835b-d90bc7b77b89","source":"wordfence","cve":"CVE-2025-58897","title":"Fermentio \u2014 Brewery and Winemaking Restaurant WordPress Theme <= 1.5.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed03bfca-4044-4815-835b-d90bc7b77b89?source=api-prod","affected":[{"type":"theme","slug":"fermentio","name":"Fermentio \u2014 Brewery and Winemaking Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:18:55Z"},{"id":"wordfence:ed053a6b-4163-4e82-a180-619a7841899a","source":"wordfence","cve":"CVE-2024-30504","title":"WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed053a6b-4163-4e82-a180-619a7841899a?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T01:20:08Z"},{"id":"wordfence:ed05cd81-ca21-41de-9b02-bd84498cd74e","source":"wordfence","cve":"CVE-2024-12467","title":"Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed05cd81-ca21-41de-9b02-bd84498cd74e?source=api-prod","affected":[{"type":"plugin","slug":"pago-redsys-tpv-grafreak","name":"Pago por Redsys","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-02-21T15:49:12Z","updated":"2025-02-22T04:21:16Z"},{"id":"wordfence:ed06ab6d-cd88-40ce-a21d-afdb12821c29","source":"wordfence","cve":"CVE-2026-27996","title":"Lingvico <= 1.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed06ab6d-cd88-40ce-a21d-afdb12821c29?source=api-prod","affected":[{"type":"theme","slug":"lingvico","name":"Lingvico | Language Center & Training Courses WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T15:27:07Z"},{"id":"wordfence:ed0860db-0e1f-4929-90d5-ff2766ba71ad","source":"wordfence","cve":"","title":"WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0860db-0e1f-4929-90d5-ff2766ba71ad?source=api-prod","affected":[{"type":"plugin","slug":"wp-e-commerce","name":"WP eCommerce","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed08d248-7467-4a3b-91a2-4286d91b9c50","source":"wordfence","cve":"CVE-2025-3776","title":"Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution","severity":"high","cvss":8.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed08d248-7467-4a3b-91a2-4286d91b9c50?source=api-prod","affected":[{"type":"plugin","slug":"verification-sms-targetsms","name":"Verification SMS with TargetSMS","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-23T19:47:36Z","updated":"2025-04-24T08:23:52Z"},{"id":"wordfence:ed0a37cc-49db-4919-8d0d-cb7739332229","source":"wordfence","cve":"CVE-2023-29094","title":"Product page shipping calculator for WooCommerce <= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0a37cc-49db-4919-8d0d-cb7739332229?source=api-prod","affected":[{"type":"plugin","slug":"product-page-shipping-calculator-for-woocommerce","name":"Product page shipping calculator for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed0a9db6-24bd-48ba-befa-ce537304ab52","source":"wordfence","cve":"CVE-2024-2252","title":"Droit Elementor Addons \u2013 Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0a9db6-24bd-48ba-befa-ce537304ab52?source=api-prod","affected":[{"type":"plugin","slug":"droit-elementor-addons","name":"Droit Elementor Addons \u2013 Widgets, Blocks, Templates Library For Elementor Builder","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:27:22Z"},{"id":"wordfence:ed0c6e90-1b57-465d-8a30-a41c6197631d","source":"wordfence","cve":"CVE-2026-86791","title":"iPOSpays Payment Gateway for WooCommerce <= 1.4.6 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0c6e90-1b57-465d-8a30-a41c6197631d?source=api-prod","affected":[{"type":"plugin","slug":"ipospays-gateways-wc","name":"iPOSpays Payment Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-10-16T00:00:00Z","updated":"2026-10-23T19:39:25Z"},{"id":"wordfence:ed0e7717-d9ac-4333-8e79-fc030a410dab","source":"wordfence","cve":"CVE-2024-23516","title":"CC BMI Calculator <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed0e7717-d9ac-4333-8e79-fc030a410dab?source=api-prod","affected":[{"type":"plugin","slug":"cc-bmi-calculator","name":"CC BMI Calculator","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-01-30T00:00:00Z","updated":"2024-04-29T17:53:27Z"},{"id":"wordfence:ed117fb8-c13a-4088-aa33-8d44fc5dcf37","source":"wordfence","cve":"","title":"miniOrange's Google Authenticator <= 5.6.1 - Cross-Site Request Forgery to Malware Scan Termination","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed117fb8-c13a-4088-aa33-8d44fc5dcf37?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed128ef2-0399-4daa-95f6-f5ba74281d89","source":"wordfence","cve":"CVE-2022-45369","title":"Plugin for Google Reviews <= 2.2.2 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed128ef2-0399-4daa-95f6-f5ba74281d89?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2022-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed137706-1313-4bff-882b-13d9fa11498c","source":"wordfence","cve":"CVE-2021-4378","title":"WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed137706-1313-4bff-882b-13d9fa11498c?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-front-end-editor","name":"WP Quick FrontEnd Editor \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2021-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed15cb66-c386-45af-9a79-e187c4be38a8","source":"wordfence","cve":"CVE-2025-11875","title":"SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed15cb66-c386-45af-9a79-e187c4be38a8?source=api-prod","affected":[{"type":"plugin","slug":"spendeonline","name":"SpendeOnline.org","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"3.0.2"}],"published":"2025-10-24T00:00:00Z","updated":"2025-10-25T06:49:25Z"},{"id":"wordfence:ed18e919-eec9-4907-93d4-a95d9a95395b","source":"wordfence","cve":"CVE-2024-38777","title":"Titan Anti-spam & Security <= 7.3.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed18e919-eec9-4907-93d4-a95d9a95395b?source=api-prod","affected":[{"type":"plugin","slug":"anti-spam","name":"Titan Anti-spam & Security \u2013 Brute Force Protection, 2FA & Spam Filter","from":"*","from_inclusive":true,"to":"7.3.7","to_inclusive":true,"patched_in":"7.3.8"}],"published":"2024-07-11T00:00:00Z","updated":"2024-09-04T21:30:21Z"},{"id":"wordfence:ed191380-6037-4d59-8db7-cb33136a304e","source":"wordfence","cve":"CVE-2024-1398","title":"Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed191380-6037-4d59-8db7-cb33136a304e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-bootstrap-elements-for-elementor","name":"Ultimate Bootstrap Elements for Elementor","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-03-01T00:00:00Z","updated":"2024-03-08T20:02:47Z"},{"id":"wordfence:ed19835f-2718-41d8-95af-47c8b9589529","source":"wordfence","cve":"CVE-2024-9289","title":"WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed19835f-2718-41d8-95af-47c8b9589529?source=api-prod","affected":[{"type":"plugin","slug":"wp-wc-affiliate-program","name":"WordPress & WooCommerce Affiliate Program","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.5.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-01T08:30:20Z"},{"id":"wordfence:ed1a7872-e268-460d-82f1-b047335a9977","source":"wordfence","cve":"CVE-2026-8886","title":"hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1a7872-e268-460d-82f1-b047335a9977?source=api-prod","affected":[{"type":"plugin","slug":"hk-shortcode","name":"hk_shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:26:45Z","updated":"2026-05-27T05:31:32Z"},{"id":"wordfence:ed1aae32-6040-4c42-b8a7-4c3be371a8c0","source":"wordfence","cve":"CVE-2024-1218","title":"Contact Form builder with drag & drop for WordPress \u2013 Kali Forms <= 2.3.41 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1aae32-6040-4c42-b8a7-4c3be371a8c0?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.3.41","to_inclusive":true,"patched_in":"2.3.42"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T18:56:49Z"},{"id":"wordfence:ed1ba10b-bbaf-4753-8ae3-107e2cd3ead3","source":"wordfence","cve":"CVE-2025-67971","title":"FluentCart < 1.3.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1ba10b-bbaf-4753-8ae3-107e2cd3ead3?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":false,"patched_in":"1.3.0"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:37:22Z"},{"id":"wordfence:ed1eae6b-567a-41e0-9a65-172bd3246438","source":"wordfence","cve":"CVE-2026-39678","title":"Pinpoint Booking System <= 2.9.9.6.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1eae6b-567a-41e0-9a65-172bd3246438?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.6.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-20T00:00:00Z","updated":"2026-10-17T08:32:36Z"},{"id":"wordfence:ed1f3d5a-9551-421e-8f38-416976a704ba","source":"wordfence","cve":"CVE-2014-125091","title":"Polls CP <= 1.0.1 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed1f3d5a-9551-421e-8f38-416976a704ba?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2014-11-23T00:00:00Z","updated":"2024-02-07T14:37:18Z"},{"id":"wordfence:ed228515-04de-49b7-a103-355887cb7318","source":"wordfence","cve":"CVE-2025-67545","title":"FireBox <= 3.1.0-free - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed228515-04de-49b7-a103-355887cb7318?source=api-prod","affected":[{"type":"plugin","slug":"firebox","name":"FireBox \u2013 WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment","from":"*","from_inclusive":true,"to":"3.1.0-free","to_inclusive":true,"patched_in":"3.1.1-free"}],"published":"2025-11-27T00:00:00Z","updated":"2025-12-11T16:45:56Z"},{"id":"wordfence:ed2290ea-b567-487f-92b0-3a718e1ce496","source":"wordfence","cve":"CVE-2026-42742","title":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2290ea-b567-487f-92b0-3a718e1ce496?source=api-prod","affected":[{"type":"plugin","slug":"views-for-wpforms-lite","name":"Views for WPForms \u2013 Display & Edit WPForms Entries on your site frontend","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-05-28T00:00:00Z","updated":"2026-06-01T16:07:15Z"},{"id":"wordfence:ed2511a2-745a-42a9-a78c-96e35b4cb156","source":"wordfence","cve":"CVE-2024-37481","title":"The Post Grid <= 7.7.4 - Missing Authorization via REST API","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2511a2-745a-42a9-a78c-96e35b4cb156?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.4","to_inclusive":true,"patched_in":"7.7.5"}],"published":"2024-07-04T00:00:00Z","updated":"2024-07-10T13:53:55Z"},{"id":"wordfence:ed2796b0-0667-451d-9208-272651bc6a4c","source":"wordfence","cve":"CVE-2015-4179","title":"Codestyling Localization <= 1.99.30 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2796b0-0667-451d-9208-272651bc6a4c?source=api-prod","affected":[{"type":"plugin","slug":"codestyling-localization","name":"Codestyling Localization","from":"*","from_inclusive":true,"to":"1.99.30","to_inclusive":true,"patched_in":""}],"published":"2015-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed28fe16-0835-4e94-a30e-305e7ba03740","source":"wordfence","cve":"CVE-2022-3383","title":"Ultimate Member \u2013 User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed28fe16-0835-4e94-a30e-305e7ba03740?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2022-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed29e101-de40-409a-8b0b-7cfac0b0822f","source":"wordfence","cve":"CVE-2026-0676","title":"Zorka <= 1.5.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed29e101-de40-409a-8b0b-7cfac0b0822f?source=api-prod","affected":[{"type":"theme","slug":"zorka","name":"Zorka \u2013 Wonderful Fashion WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T19:22:12Z"},{"id":"wordfence:ed2bb3e2-5002-4746-a4f8-b5d1752ccbbf","source":"wordfence","cve":"CVE-2024-7649","title":"Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2bb3e2-5002-4746-a4f8-b5d1752ccbbf?source=api-prod","affected":[{"type":"plugin","slug":"opal-membership","name":"Opal Membership","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-09T00:00:00Z","updated":"2024-08-10T03:23:27Z"},{"id":"wordfence:ed2becc0-7c3d-411f-b5dc-213527ba495b","source":"wordfence","cve":"CVE-2026-92430","title":"Rede Ita\u00fa for WooCommerce <= 5.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2becc0-7c3d-411f-b5dc-213527ba495b?source=api-prod","affected":[{"type":"plugin","slug":"woo-rede","name":"Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit","from":"*","from_inclusive":true,"to":"5.4.6","to_inclusive":true,"patched_in":"5.4.7"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:08:14Z"},{"id":"wordfence:ed2d9922-6e43-49ac-8981-1bc3a23e88ac","source":"wordfence","cve":"CVE-2026-73400","title":"Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed2d9922-6e43-49ac-8981-1bc3a23e88ac?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.11","to_inclusive":true,"patched_in":"2.4.12"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-09T16:11:08Z"},{"id":"wordfence:ed3092ba-b640-4ab6-8b8d-415da7c08f63","source":"wordfence","cve":"CVE-2026-103378","title":"Geliver Ak\u0131ll\u0131 Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3092ba-b640-4ab6-8b8d-415da7c08f63?source=api-prod","affected":[{"type":"plugin","slug":"geliver-akilli-kargo-pazaryeri","name":"Geliver Ak\u0131ll\u0131 Kargo Pazaryeri","from":"3.0.0","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:05:51Z"},{"id":"wordfence:ed357f21-bc35-4a9b-983e-1eb836aa4049","source":"wordfence","cve":"CVE-2025-58264","title":"JupiterX Core <= 4.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed357f21-bc35-4a9b-983e-1eb836aa4049?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.11.0","to_inclusive":true,"patched_in":"4.11.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T14:46:37Z"},{"id":"wordfence:ed37e94b-406c-4203-a1a8-c61cc6073ee1","source":"wordfence","cve":"CVE-2025-30627","title":"Elegant Visitor Counter <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed37e94b-406c-4203-a1a8-c61cc6073ee1?source=api-prod","affected":[{"type":"plugin","slug":"elegant-visitor-counter","name":"Elegant Visitor Counter","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:54:11Z"},{"id":"wordfence:ed3aaa2a-8211-409c-8a75-1ac59e1d55e2","source":"wordfence","cve":"CVE-2026-9722","title":"Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3aaa2a-8211-409c-8a75-1ac59e1d55e2?source=api-prod","affected":[{"type":"plugin","slug":"laiser-tag","name":"Laiser Tag","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":""}],"published":"2026-06-01T19:43:39Z","updated":"2026-06-02T07:48:33Z"},{"id":"wordfence:ed3ad791-4d4d-41df-bf14-2aef77d6fecb","source":"wordfence","cve":"CVE-2020-15363","title":"Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed3ad791-4d4d-41df-bf14-2aef77d6fecb?source=api-prod","affected":[{"type":"theme","slug":"nexos","name":"Nexos - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":false,"patched_in":"1.8"}],"published":"2020-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed402a8d-0273-4172-8695-afc9b47f51a4","source":"wordfence","cve":"CVE-2024-13381","title":"Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed402a8d-0273-4172-8695-afc9b47f51a4?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.2.61","to_inclusive":true,"patched_in":"5.2.62"}],"published":"2025-04-09T00:00:00Z","updated":"2025-05-02T15:12:13Z"},{"id":"wordfence:ed40b50b-7d70-4abf-8895-2bf891124bae","source":"wordfence","cve":"CVE-2021-24196","title":"Social Slider Widget <= 1.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed40b50b-7d70-4abf-8895-2bf891124bae?source=api-prod","affected":[{"type":"plugin","slug":"instagram-slider-widget","name":"Social Slider Feed \u2013 Social Media Feed & Gallery Widgets","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":false,"patched_in":"1.8.5"}],"published":"2021-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed40b874-68e2-49f3-95b0-653600394e78","source":"wordfence","cve":"","title":"WordPress Download Manager < 3.1.19 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed40b874-68e2-49f3-95b0-653600394e78?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.1.19","to_inclusive":false,"patched_in":"3.1.19"}],"published":"2021-04-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed42e29f-d263-43fc-b06e-b7aaaa7622f7","source":"wordfence","cve":"","title":"eCommerce Product Catalog <= 3.0.71 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed42e29f-d263-43fc-b06e-b7aaaa7622f7?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.0.71","to_inclusive":true,"patched_in":"3.0.72"}],"published":"2022-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed43e0ee-0b0e-4367-ba33-a8f08fafcd33","source":"wordfence","cve":"CVE-2016-10869","title":"Contact Form by BestWebSoft \u2013 Advanced Contact Us Form Builder for WordPress <= 4.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed43e0ee-0b0e-4367-ba33-a8f08fafcd33?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-plugin","name":"Contact Form by BestWebSoft \u2013 Advanced WP Contact Form Builder for WordPress","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":false,"patched_in":"4.0.2"}],"published":"2019-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed4854f3-b991-4133-acb9-12d99c399c90","source":"wordfence","cve":"CVE-2025-39467","title":"Wanderland <= 1.7.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed4854f3-b991-4133-acb9-12d99c399c90?source=api-prod","affected":[{"type":"theme","slug":"wanderland","name":"Wanderland - Travel Blog","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:48:25Z"},{"id":"wordfence:ed488dcd-7400-47ab-a161-47c7caa414c2","source":"wordfence","cve":"CVE-2022-2144","title":"Jquery Validation For Contact Form 7 <= 5.2 - Cross-Site Request Forgery to Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed488dcd-7400-47ab-a161-47c7caa414c2?source=api-prod","affected":[{"type":"plugin","slug":"jquery-validation-for-contact-form-7","name":"Jquery Validation For Contact Form 7","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed494059-2d22-415d-a3a7-d21153d7060c","source":"wordfence","cve":"CVE-2026-39772","title":"Captcha by BestWebSoft \u2013 Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms <= 5.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed494059-2d22-415d-a3a7-d21153d7060c?source=api-prod","affected":[{"type":"plugin","slug":"captcha-bws","name":"Captcha by BestWebSoft \u2013 Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-09T13:13:59Z"},{"id":"wordfence:ed494a5a-2edf-43c9-a88a-331448c4e6d7","source":"wordfence","cve":"CVE-2024-32550","title":"BMI Adult & Kid Calculator  <= 1.2.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed494a5a-2edf-43c9-a88a-331448c4e6d7?source=api-prod","affected":[{"type":"plugin","slug":"bmi-adultkid-calculator","name":"BMI Adult & Kid Calculator","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-04-15T00:00:00Z","updated":"2024-04-23T13:44:05Z"},{"id":"wordfence:ed4c5ffa-2474-45f5-900b-59e3c60c15bc","source":"wordfence","cve":"CVE-2024-12638","title":"Bulk Me Now! <= 2.0 - Reflected Cross-Site Scripting via 'status'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed4c5ffa-2474-45f5-900b-59e3c60c15bc?source=api-prod","affected":[{"type":"plugin","slug":"bulk-me-now","name":"Bulk Me Now!","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-09T00:00:00Z","updated":"2025-02-19T16:38:21Z"},{"id":"wordfence:ed4e1a56-708d-4a12-8153-9568d11fe4d0","source":"wordfence","cve":"CVE-2022-1610","title":"Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal <= 5.1.7 - Cross-Site Request Forgery to Settings Chage","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed4e1a56-708d-4a12-8153-9568d11fe4d0?source=api-prod","affected":[{"type":"plugin","slug":"seamless-donations","name":"Seamless Donations is Sunset","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed4f529e-f629-45fe-9e1f-62d9c961bb17","source":"wordfence","cve":"CVE-2025-49341","title":"PDF Creator Lite <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed4f529e-f629-45fe-9e1f-62d9c961bb17?source=api-prod","affected":[{"type":"plugin","slug":"pdf-creator-lite","name":"PDF Creator Lite","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-29T00:00:00Z","updated":"2025-12-10T15:51:00Z"},{"id":"wordfence:ed505037-b91c-42af-9316-1eed341ebef8","source":"wordfence","cve":"CVE-2026-111032","title":"Welcart e-Commerce < 2.12.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed505037-b91c-42af-9316-1eed341ebef8?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.12.6","to_inclusive":false,"patched_in":"2.12.6"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:17:19Z"},{"id":"wordfence:ed507ac7-6732-4315-99dd-0a8636cc9cc3","source":"wordfence","cve":"CVE-2024-3277","title":"Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed507ac7-6732-4315-99dd-0a8636cc9cc3?source=api-prod","affected":[{"type":"plugin","slug":"yumpu-epaper-publishing","name":"Yumpu E-Paper publishing","from":"*","from_inclusive":true,"to":"2.0.24","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2024-05-29T15:50:25Z","updated":"2024-08-01T17:22:37Z"},{"id":"wordfence:ed5251e7-64d2-4210-9864-144952a49327","source":"wordfence","cve":"CVE-2023-46149","title":"Themify Ultra <= 7.3.5 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5251e7-64d2-4210-9864-144952a49327?source=api-prod","affected":[{"type":"theme","slug":"themify-ultra","name":"Themify Ultra","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.6"}],"published":"2023-10-17T00:00:00Z","updated":"2024-04-22T14:12:22Z"},{"id":"wordfence:ed54fe33-6467-4af2-ba28-dd17287d8f92","source":"wordfence","cve":"CVE-2025-10036","title":"Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed54fe33-6467-4af2-ba28-dd17287d8f92?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"5.2.8"}],"published":"2025-09-25T00:00:00Z","updated":"2025-09-26T04:25:18Z"},{"id":"wordfence:ed550988-521c-43f2-a57f-98dc8dfb97bf","source":"wordfence","cve":"CVE-2025-30801","title":"TWB Woocommerce Reviews <= 1.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed550988-521c-43f2-a57f-98dc8dfb97bf?source=api-prod","affected":[{"type":"plugin","slug":"twb-woocommerce-reviews","name":"TWB Woocommerce Reviews","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:15:11Z"},{"id":"wordfence:ed56e702-0a3c-47aa-bac0-0ec5afc1034e","source":"wordfence","cve":"CVE-2024-51593","title":"\u041a\u0443\u0440\u0441 \u0432\u0430\u043b\u044e\u0442 UAH <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed56e702-0a3c-47aa-bac0-0ec5afc1034e?source=api-prod","affected":[{"type":"plugin","slug":"ukrainian-currency","name":"\u041a\u0443\u0440\u0441 \u0432\u0430\u043b\u044e\u0442 UAH","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:19:32Z"},{"id":"wordfence:ed579468-c998-4bec-b3a5-01d0ff206d35","source":"wordfence","cve":"CVE-2023-0236","title":"Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed579468-c998-4bec-b3a5-01d0ff206d35?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed57bb85-d4b5-4c89-a1c7-c3b8a0a5a2ea","source":"wordfence","cve":"CVE-2025-2882","title":"GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed57bb85-d4b5-4c89-a1c7-c3b8a0a5a2ea?source=api-prod","affected":[{"type":"plugin","slug":"green-money-payment-gateway","name":"GreenPay(tm) by Green.Money","from":"3.0.0","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2025-04-07T19:16:13Z","updated":"2025-04-08T07:29:44Z"},{"id":"wordfence:ed581d7d-ef03-4d15-81ed-8d6215397c22","source":"wordfence","cve":"CVE-2025-69400","title":"Yokoo <= 1.1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed581d7d-ef03-4d15-81ed-8d6215397c22?source=api-prod","affected":[{"type":"theme","slug":"yokoo","name":"Yokoo","from":"*","from_inclusive":true,"to":"1.1.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:28:22Z"},{"id":"wordfence:ed5c433b-eaab-4716-8749-2a5598a1dbb9","source":"wordfence","cve":"CVE-2023-46212","title":"WP EXtra <= 6.2 - Missing Authorization to Export Settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5c433b-eaab-4716-8749-2a5598a1dbb9?source=api-prod","affected":[{"type":"plugin","slug":"wp-extra","name":"WP EXtra \u2013 One Click Optimize","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":"6.3"}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed5cabb3-161d-46cb-9e1f-34e189a831cd","source":"wordfence","cve":"CVE-2026-115281","title":"Recipe Card Blocks Lite 3.5.0 - 3.6.3 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5cabb3-161d-46cb-9e1f-34e189a831cd?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"3.5.0","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-10-28T00:00:00Z","updated":"2026-10-28T18:15:32Z"},{"id":"wordfence:ed5cd26f-30a4-40a5-9652-c2442949d943","source":"wordfence","cve":"CVE-2025-60098","title":"Theme My Login <= 7.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5cd26f-30a4-40a5-9652-c2442949d943?source=api-prod","affected":[{"type":"plugin","slug":"theme-my-login","name":"Theme My Login","from":"*","from_inclusive":true,"to":"7.1.12","to_inclusive":true,"patched_in":"7.1.13"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-02T21:22:57Z"},{"id":"wordfence:ed5ce18d-184e-44ce-9201-d63763014c84","source":"wordfence","cve":"CVE-2026-62073","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5ce18d-184e-44ce-9201-d63763014c84?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2026-10-01T11:56:37Z","updated":"2026-10-08T23:53:28Z"},{"id":"wordfence:ed5cf097-1b27-4d20-b7b2-2aa909bce042","source":"wordfence","cve":"","title":"BuddyPress <= 5.1.0 - Denial of Service","severity":"medium","cvss":5.4,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5cf097-1b27-4d20-b7b2-2aa909bce042?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2019-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed5d8b70-eb0e-4e5c-a68a-d9bff493c04c","source":"wordfence","cve":"CVE-2011-3859","title":"Trending < 0.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5d8b70-eb0e-4e5c-a68a-d9bff493c04c?source=api-prod","affected":[{"type":"theme","slug":"trending","name":"Trending","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":false,"patched_in":"0.2"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed5f2c6d-a548-44c1-a07a-e33999bb164d","source":"wordfence","cve":"CVE-2025-8565","title":"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed5f2c6d-a548-44c1-a07a-e33999bb164d?source=api-prod","affected":[{"type":"plugin","slug":"wplegalpages","name":"Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates \u2013 WPLP Legal Pages","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"3.4.4"}],"published":"2025-09-17T20:43:11Z","updated":"2025-09-18T09:31:32Z"},{"id":"wordfence:ed61a6b5-5c54-408b-973c-69b0f12d2df5","source":"wordfence","cve":"","title":"Gwolle Guestbook <= 2.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed61a6b5-5c54-408b-973c-69b0f12d2df5?source=api-prod","affected":[{"type":"plugin","slug":"gwolle-gb","name":"Gwolle Guestbook","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed61c037-a73c-477e-a5b5-3b4781cec130","source":"wordfence","cve":"CVE-2024-12405","title":"Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed61c037-a73c-477e-a5b5-3b4781cec130?source=api-prod","affected":[{"type":"plugin","slug":"export-customers-data","name":"Export Customers Data","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2024-12-23T00:00:00Z","updated":"2024-12-24T05:23:45Z"},{"id":"wordfence:ed64d0ff-4f49-4c18-86ec-2c6fbd559d2e","source":"wordfence","cve":"CVE-2023-4471","title":"Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed64d0ff-4f49-4c18-86ec-2c6fbd559d2e?source=api-prod","affected":[{"type":"plugin","slug":"order-tracking","name":"Order Tracking \u2013 WordPress Status Tracking Plugin","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":"3.3.7"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed65b850-0e1c-43ce-82c4-c3f875ed0443","source":"wordfence","cve":"CVE-2026-121636","title":"Quick Event Manager 9.9.5 - 9.18 - Unauthenticated Unpaid Event Registration Confirmation","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed65b850-0e1c-43ce-82c4-c3f875ed0443?source=api-prod","affected":[{"type":"plugin","slug":"quick-event-manager","name":"Quick Event Manager","from":"9.9.5","from_inclusive":true,"to":"9.18","to_inclusive":true,"patched_in":"9.19"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T13:07:15Z"},{"id":"wordfence:ed65eaa1-247e-4bb1-af72-d41962931826","source":"wordfence","cve":"CVE-2026-57404","title":"Booking and Rental Manager <= 2.6.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed65eaa1-247e-4bb1-af72-d41962931826?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-29T23:04:51Z"},{"id":"wordfence:ed684438-323e-4cf1-b4f1-955b1da63ad8","source":"wordfence","cve":"CVE-2024-51583","title":"Kento Ads Rotator <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed684438-323e-4cf1-b4f1-955b1da63ad8?source=api-prod","affected":[{"type":"plugin","slug":"kento-ads-rotator","name":"Kento Ads Rotator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:51:44Z"},{"id":"wordfence:ed686f11-e696-415c-92cf-55fb789191a1","source":"wordfence","cve":"CVE-2025-57984","title":"MakeStories (for Google Web Stories) <= 3.0.4 - Authenticated (Author+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed686f11-e696-415c-92cf-55fb789191a1?source=api-prod","affected":[{"type":"plugin","slug":"makestories-helper","name":"MakeStories (for Google Web Stories)","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T18:25:42Z"},{"id":"wordfence:ed68a4ff-a2aa-4df7-96b1-f094bce4b9b7","source":"wordfence","cve":"CVE-2026-92537","title":"Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)","severity":"medium","cvss":5.3,"cwe":"CWE-522","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed68a4ff-a2aa-4df7-96b1-f094bce4b9b7?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.3.9","to_inclusive":true,"patched_in":"9.4.0"}],"published":"2026-09-30T13:32:34Z","updated":"2026-10-01T02:27:47Z"},{"id":"wordfence:ed69a367-e658-43cc-97c4-85c68e1aff37","source":"wordfence","cve":"CVE-2025-53345","title":"Thim Core <= 2.3.3 - Authenticated (Subscriber+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed69a367-e658-43cc-97c4-85c68e1aff37?source=api-prod","affected":[{"type":"plugin","slug":"thim-core","name":"Thim Core","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-21T13:28:32Z"},{"id":"wordfence:ed6cbd55-0e3a-4343-9e1b-b413a132bcdd","source":"wordfence","cve":"CVE-2025-2883","title":"Accept SagePay Payments Using Contact Form 7 <= 2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6cbd55-0e3a-4343-9e1b-b413a132bcdd?source=api-prod","affected":[{"type":"plugin","slug":"accept-sagepay-payments-using-contact-form-7","name":"Accept SagePay Payments Using Contact Form 7","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-04-07T21:19:21Z","updated":"2025-04-08T09:21:20Z"},{"id":"wordfence:ed6d1167-c89d-4c97-9446-b968df945e6c","source":"wordfence","cve":"CVE-2026-6549","title":"Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6d1167-c89d-4c97-9446-b968df945e6c?source=api-prod","affected":[{"type":"plugin","slug":"logo-manager-for-enamad","name":"Logo Manager For Enamad \u2013  \u0644\u0648\u06af\u0648\u06cc \u0646\u0645\u0627\u062f \u0627\u0644\u06a9\u062a\u0631\u0648\u0646\u06cc\u06a9\u06cc","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T12:11:39Z","updated":"2026-07-17T16:12:09Z"},{"id":"wordfence:ed6e0136-f4fa-4739-b02d-b53091991e58","source":"wordfence","cve":"CVE-2021-25069","title":"WordPress Download Manager <= 3.2.33 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e0136-f4fa-4739-b02d-b53091991e58?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.34","to_inclusive":false,"patched_in":"3.2.34"}],"published":"2022-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed6e2b9e-3d70-4c07-a779-45164816b89c","source":"wordfence","cve":"CVE-2023-6008","title":"UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functions","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89c?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed738dc5-7848-4b04-a3fd-317cc366acfa","source":"wordfence","cve":"CVE-2026-6960","title":"BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking-pro","name":"BookingPress Appointment Booking Pro","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":true,"patched_in":"5.7"}],"published":"2026-05-21T06:20:37Z","updated":"2026-05-21T21:27:50Z"},{"id":"wordfence:ed74aebc-9d52-4fac-b308-97765db62d3d","source":"wordfence","cve":"CVE-2012-6715","title":"FormBuilder <= 0.90 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed74aebc-9d52-4fac-b308-97765db62d3d?source=api-prod","affected":[{"type":"plugin","slug":"formbuilder","name":"FormBuilder","from":"*","from_inclusive":true,"to":"0.90","to_inclusive":true,"patched_in":"0.91"}],"published":"2012-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed757ddf-cd02-41a0-9d2b-7c03af7a4497","source":"wordfence","cve":"CVE-2025-46439","title":"Plugin Central <= 2.5.1 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed757ddf-cd02-41a0-9d2b-7c03af7a4497?source=api-prod","affected":[{"type":"plugin","slug":"plugin-central","name":"Plugin Central","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:14:25Z"},{"id":"wordfence:ed7587d3-efc0-4274-8cbd-9ce3eda76cdd","source":"wordfence","cve":"CVE-2026-39720","title":"Mapster WP Maps <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7587d3-efc0-4274-8cbd-9ce3eda76cdd?source=api-prod","affected":[{"type":"plugin","slug":"mapster-wp-maps","name":"Mapster WP Maps","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2026-10-05T11:27:01Z","updated":"2026-10-08T23:37:56Z"},{"id":"wordfence:ed766000-557b-483b-9b86-c1cc6898abb7","source":"wordfence","cve":"CVE-2011-5192","title":"Pretty Link Lite < 1.5.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed766000-557b-483b-9b86-c1cc6898abb7?source=api-prod","affected":[{"type":"plugin","slug":"pretty-link-lite","name":"Pretty Link Lite","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2012-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed78a67c-e178-4efb-9b74-fbcfa544f737","source":"wordfence","cve":"CVE-2025-69321","title":"Grand Spa <= 3.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed78a67c-e178-4efb-9b74-fbcfa544f737?source=api-prod","affected":[{"type":"theme","slug":"grandspa","name":"Grand Spa | Massage Salon WordPress","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:53:25Z"},{"id":"wordfence:ed798f89-fab2-4f7b-a663-4dd99ab1c7b6","source":"wordfence","cve":"CVE-2026-78266","title":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI <= 5.8.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed798f89-fab2-4f7b-a663-4dd99ab1c7b6?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.8.3","to_inclusive":true,"patched_in":"5.8.4"}],"published":"2026-08-24T12:59:38Z","updated":"2026-09-10T19:15:40Z"},{"id":"wordfence:ed79e382-acb4-4348-9bc6-b44ec0d75fb5","source":"wordfence","cve":"CVE-2022-47176","title":"Depicter Slider <= 1.9.0 - Missing Authorization on 'make' function","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed79e382-acb4-4348-9bc6-b44ec0d75fb5?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2023-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed7da783-7c93-4847-9939-e88251930b70","source":"wordfence","cve":"CVE-2025-24556","title":"MooWoodle \u2013 WordPress & Moodle LMS Integration Bridge <= 3.2.4 - Unauthenticated Sensitive Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7da783-7c93-4847-9939-e88251930b70?source=api-prod","affected":[{"type":"plugin","slug":"moowoodle","name":"MooWoodle \u2013 WordPress Moodle LMS Integration, Sell Moodle Courses via WooCommerce","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2024-11-16T00:00:00Z","updated":"2025-02-25T16:57:34Z"},{"id":"wordfence:ed7f3f80-4d08-440f-b990-b1099a565ed0","source":"wordfence","cve":"CVE-2026-10752","title":"Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field","severity":"medium","cvss":4.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed7f3f80-4d08-440f-b990-b1099a565ed0?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.6","to_inclusive":true,"patched_in":"0.9.2.7"}],"published":"2026-10-26T21:31:34Z","updated":"2026-10-27T11:32:04Z"},{"id":"wordfence:ed81b175-071c-4967-81d9-bc4b7d35f3be","source":"wordfence","cve":"CVE-2025-66124","title":"Leaky Paywall <= 4.22.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed81b175-071c-4967-81d9-bc4b7d35f3be?source=api-prod","affected":[{"type":"plugin","slug":"leaky-paywall","name":"Leaky Paywall","from":"*","from_inclusive":true,"to":"4.22.6","to_inclusive":true,"patched_in":"5.0"}],"published":"2025-12-10T00:00:00Z","updated":"2026-03-17T21:27:59Z"},{"id":"wordfence:ed82f527-b7af-4466-a977-855f109ed997","source":"wordfence","cve":"CVE-2024-1324","title":"QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed82f527-b7af-4466-a977-855f109ed997?source=api-prod","affected":[{"type":"plugin","slug":"qqworld-auto-save-images","name":"QQWorld Auto Save Images","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T18:47:13Z","updated":"2024-06-01T06:51:53Z"},{"id":"wordfence:ed8408b0-b14c-4f01-abdd-e7019dd985b4","source":"wordfence","cve":"CVE-2025-67536","title":"LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8408b0-b14c-4f01-abdd-e7019dd985b4?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.9.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-11-06T00:00:00Z","updated":"2025-12-10T16:21:49Z"},{"id":"wordfence:ed8636bf-229a-42a5-a19c-332679613dd2","source":"wordfence","cve":"CVE-2024-1950","title":"Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8636bf-229a-42a5-a19c-332679613dd2?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-carousel-slider-and-grid-ultimate","name":"Product Carousel Slider & Grid Ultimate for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"1.9.8"}],"published":"2024-03-05T00:00:00Z","updated":"2024-07-31T15:38:12Z"},{"id":"wordfence:ed866cda-2244-4172-a8bd-63005bbee4fc","source":"wordfence","cve":"","title":"Feed Them Gallery <= 1.1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed866cda-2244-4172-a8bd-63005bbee4fc?source=api-prod","affected":[{"type":"plugin","slug":"feed-them-gallery","name":"Feed Them Gallery","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed869c1e-ae54-4db2-8147-39050a034c5e","source":"wordfence","cve":"CVE-2026-87855","title":"JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed869c1e-ae54-4db2-8147-39050a034c5e?source=api-prod","affected":[{"type":"plugin","slug":"woo-jtl-connector","name":"JTL-Connector for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:18:21Z","updated":"2026-10-14T03:40:07Z"},{"id":"wordfence:ed86e902-7637-481d-9005-7025187ba200","source":"wordfence","cve":"CVE-2026-6504","title":"Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed86e902-7637-481d-9005-7025187ba200?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1058","to_inclusive":true,"patched_in":"1.7.1059"}],"published":"2026-05-13T19:53:33Z","updated":"2026-05-14T08:24:28Z"},{"id":"wordfence:ed879862-754c-444e-84e6-c5b272b5ec05","source":"wordfence","cve":"CVE-2025-62115","title":"Hide Plugins <= 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed879862-754c-444e-84e6-c5b272b5ec05?source=api-prod","affected":[{"type":"plugin","slug":"hide-plugins","name":"Hide Plugins","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:25:38Z"},{"id":"wordfence:ed881d06-e652-45ac-8f56-c2db9e403485","source":"wordfence","cve":"CVE-2023-5238","title":"EventPrime < 3.2.0 - Reflected HTML Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed881d06-e652-45ac-8f56-c2db9e403485?source=api-prod","affected":[{"type":"plugin","slug":"eventprime-event-calendar-management","name":"EventPrime \u2013 Events Calendar, Bookings, Tickets & AI","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2023-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed88270e-d6e1-431b-bca6-b594ec6bc609","source":"wordfence","cve":"CVE-2024-13207","title":"Widget for Social Page Feeds <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed88270e-d6e1-431b-bca6-b594ec6bc609?source=api-prod","affected":[{"type":"plugin","slug":"facebook-pagelike-widget","name":"Buttonizer \u2013 Social Media Share Buttons, Social Icons, & Social Feeds","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2025-03-25T00:00:00Z","updated":"2025-04-21T20:24:50Z"},{"id":"wordfence:ed886fd6-7d8d-4b99-ad8e-e290ba6f32d9","source":"wordfence","cve":"CVE-2025-32560","title":"WP-Hijri <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed886fd6-7d8d-4b99-ad8e-e290ba6f32d9?source=api-prod","affected":[{"type":"plugin","slug":"wp-hijri","name":"WP-Hijri","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T20:10:16Z"},{"id":"wordfence:ed897280-f4c7-4129-a251-80e299baea61","source":"wordfence","cve":"CVE-2025-48275","title":"Visual Header <= 1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed897280-f4c7-4129-a251-80e299baea61?source=api-prod","affected":[{"type":"plugin","slug":"visual-header","name":"Visual Header","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.5"}],"published":"2025-05-24T00:00:00Z","updated":"2025-05-30T20:24:27Z"},{"id":"wordfence:ed8cb22d-cd8c-482e-a295-4717717d6b83","source":"wordfence","cve":"CVE-2026-90650","title":"MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8cb22d-cd8c-482e-a295-4717717d6b83?source=api-prod","affected":[{"type":"plugin","slug":"motopress-hotel-booking-lite","name":"MotoPress Hotel Booking","from":"*","from_inclusive":true,"to":"6.2.4","to_inclusive":true,"patched_in":"6.3.0"}],"published":"2026-09-15T01:18:29Z","updated":"2026-09-15T14:03:44Z"},{"id":"wordfence:ed8cd92a-c791-4781-a7bc-9b2a4d559d7d","source":"wordfence","cve":"CVE-2023-41733","title":"Back To The Top Button <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8cd92a-c791-4781-a7bc-9b2a4d559d7d?source=api-prod","affected":[{"type":"plugin","slug":"back-to-the-top-button","name":"Back To The Top Button","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2023-09-05T00:00:00Z","updated":"2024-03-14T12:57:30Z"},{"id":"wordfence:ed8f8984-bea6-44aa-9bde-5b40b455767f","source":"wordfence","cve":"CVE-2023-33331","title":"WooCommerce Product Vendors <= 2.1.76 - Authenticated (Vendor admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8f8984-bea6-44aa-9bde-5b40b455767f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.1.76","to_inclusive":true,"patched_in":"2.1.77"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed914e67-4cf7-49b1-96be-ed8c604e6dce","source":"wordfence","cve":"CVE-2024-2347","title":"Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed914e67-4cf7-49b1-96be-ed8c604e6dce?source=api-prod","affected":[{"type":"theme","slug":"astra","name":"Astra","from":"*","from_inclusive":true,"to":"4.6.8","to_inclusive":true,"patched_in":"4.6.9"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-09T18:59:31Z"},{"id":"wordfence:ed918a4b-2423-4ac2-882c-f2970b960d71","source":"wordfence","cve":"CVE-2025-58965","title":"Fusion Page Builder : Extension - Gallery <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed918a4b-2423-4ac2-882c-f2970b960d71?source=api-prod","affected":[{"type":"plugin","slug":"fusion-extension-gallery","name":"Fusion Page Builder : Extension \u2013 Gallery","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T19:03:00Z"},{"id":"wordfence:ed92806e-5d75-4a23-a588-821e9ada1b32","source":"wordfence","cve":"CVE-2024-11295","title":"Simple Page Access Restriction <= 1.0.29 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed92806e-5d75-4a23-a588-821e9ada1b32?source=api-prod","affected":[{"type":"plugin","slug":"simple-page-access-restriction","name":"Simple Page Access Restriction","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T07:02:46Z"},{"id":"wordfence:ed98d335-16f9-4be8-bace-06e2b5db4cb9","source":"wordfence","cve":"","title":"Simple Share Follow Button <= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed98d335-16f9-4be8-bace-06e2b5db4cb9?source=api-prod","affected":[{"type":"plugin","slug":"simple-share-follow-button","name":"Simple Share Follow Button","from":"*","from_inclusive":true,"to":"1.03","to_inclusive":true,"patched_in":"1.04"}],"published":"2023-08-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed993ad9-b7a6-4f59-9802-8e3594139c51","source":"wordfence","cve":"CVE-2026-97285","title":"The Events Calendar <= 6.17.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed993ad9-b7a6-4f59-9802-8e3594139c51?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.17.5","to_inclusive":true,"patched_in":"6.17.5.1"}],"published":"2026-09-30T00:00:00Z","updated":"2026-09-30T16:44:22Z"},{"id":"wordfence:ed99a056-42c6-4540-950e-12f8b547b64d","source":"wordfence","cve":"CVE-2021-4377","title":"Doneren met Mollie <= 2.8.4 - Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed99a056-42c6-4540-950e-12f8b547b64d?source=api-prod","affected":[{"type":"plugin","slug":"doneren-met-mollie","name":"Doneren met Mollie","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2021-01-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed9a6e27-c18f-4edf-b793-16021ebf0a6f","source":"wordfence","cve":"CVE-2014-10386","title":"WP Live Chat Support < 4.1.0 - JavaScript Code Injection","severity":"medium","cvss":6.1,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9a6e27-c18f-4edf-b793-16021ebf0a6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":false,"patched_in":"4.1.0"}],"published":"2014-07-20T00:00:00Z","updated":"2024-08-15T18:22:42Z"},{"id":"wordfence:ed9ae337-fd2b-49c1-baac-6540f1152f94","source":"wordfence","cve":"CVE-2021-24138","title":"AdRotate < 5.8.4 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9ae337-fd2b-49c1-baac-6540f1152f94?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.8.4","to_inclusive":false,"patched_in":"5.8.4"}],"published":"2020-06-03T01:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ed9db9c1-c6b5-459e-9820-ec4ee47b244e","source":"wordfence","cve":"CVE-2024-3886","title":"tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9db9c1-c6b5-459e-9820-ec4ee47b244e?source=api-prod","affected":[{"type":"plugin","slug":"td-composer","name":"tagDiv Composer","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":"5.1"}],"published":"2024-08-30T00:00:00Z","updated":"2024-08-31T04:29:21Z"},{"id":"wordfence:ed9f8948-085b-4ac5-befd-c70085aa23cd","source":"wordfence","cve":"CVE-2023-2082","title":"Buy Me a Coffee \u2013 Button and Widget Plugin <= 3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ed9f8948-085b-4ac5-befd-c70085aa23cd?source=api-prod","affected":[{"type":"plugin","slug":"buymeacoffee","name":"Buy Me a Coffee \u2013 Button and Widget Plugin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eda18b47-1c23-4ef5-9628-d6b5842bca04","source":"wordfence","cve":"CVE-2022-3838","title":"WPUpper Share Buttons <= 3.42 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda18b47-1c23-4ef5-9628-d6b5842bca04?source=api-prod","affected":[{"type":"plugin","slug":"wpupper-share-buttons","name":"WPUpper Share Buttons","from":"*","from_inclusive":true,"to":"3.42","to_inclusive":true,"patched_in":"3.43"}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eda25531-3f5f-4f66-8c6a-fcb17342eac0","source":"wordfence","cve":"CVE-2026-40796","title":"WPPizza \u2013 A Restaurant Plugin <= 3.19.9 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda25531-3f5f-4f66-8c6a-fcb17342eac0?source=api-prod","affected":[{"type":"plugin","slug":"wppizza","name":"WPPizza \u2013 A Restaurant Plugin","from":"*","from_inclusive":true,"to":"3.19.9","to_inclusive":true,"patched_in":"3.20"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:54:19Z"},{"id":"wordfence:eda37401-c404-4e06-b7f7-a9511aab61e6","source":"wordfence","cve":"CVE-2025-31425","title":"WP Lead Capturing Pages < 2.6 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda37401-c404-4e06-b7f7-a9511aab61e6?source=api-prod","affected":[{"type":"plugin","slug":"leadcapture","name":"WP Lead Capturing Pages - WordPress Plugin","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-08-06T00:00:00Z","updated":"2026-02-26T15:15:43Z"},{"id":"wordfence:eda538ef-c053-4347-b345-d5d03db25a01","source":"wordfence","cve":"CVE-2024-0904","title":"Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via License Field","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda538ef-c053-4347-b345-d5d03db25a01?source=api-prod","affected":[{"type":"plugin","slug":"fancy-product-designer","name":"Fancy Product Designer","from":"*","from_inclusive":true,"to":"6.1.81","to_inclusive":false,"patched_in":"6.1.81"}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-07T12:49:18Z"},{"id":"wordfence:eda5addb-40e2-4187-b803-34500b36be0a","source":"wordfence","cve":"CVE-2026-3569","title":"Liaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda5addb-40e2-4187-b803-34500b36be0a?source=api-prod","affected":[{"type":"plugin","slug":"liaison-site-prober","name":"Liaison Site Prober","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-04-23T19:17:51Z","updated":"2026-04-24T07:45:08Z"},{"id":"wordfence:eda9ae01-cdc4-43e0-8a4c-1ec365939fa8","source":"wordfence","cve":"","title":"Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda9ae01-cdc4-43e0-8a4c-1ec365939fa8?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.5","from_inclusive":true,"to":"14.5","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.6","from_inclusive":true,"to":"14.6","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.7","from_inclusive":true,"to":"14.7","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.8","from_inclusive":true,"to":"14.8","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"14.9","from_inclusive":true,"to":"14.9.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.0","from_inclusive":true,"to":"15.0.2","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.1","from_inclusive":true,"to":"15.1.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.2","from_inclusive":true,"to":"15.2","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.3","from_inclusive":true,"to":"15.3.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.4","from_inclusive":true,"to":"15.4","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.5","from_inclusive":true,"to":"15.5","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.6","from_inclusive":true,"to":"15.6","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.7","from_inclusive":true,"to":"15.7.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.8","from_inclusive":true,"to":"15.8","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"15.9","from_inclusive":true,"to":"15.9.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.0","from_inclusive":true,"to":"16.0.1","to_inclusive":true,"patched_in":"14.5.1"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"16.1","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"14.5.1"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-04T20:33:11Z"},{"id":"wordfence:eda9e37d-46c4-4aaa-987b-c5cece146ea9","source":"wordfence","cve":"CVE-2025-30909","title":"Conversios.io <= 7.2.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eda9e37d-46c4-4aaa-987b-c5cece146ea9?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"7.2.3","to_inclusive":true,"patched_in":"7.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:10:22Z"},{"id":"wordfence:edacede9-8a31-4d7f-b075-8265e3bbe2d0","source":"wordfence","cve":"CVE-2021-24458","title":"Popup box < 2.3.4 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edacede9-8a31-4d7f-b075-8265e3bbe2d0?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":false,"patched_in":"2.3.4"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edae5471-57b4-4bac-9cef-90019b40345a","source":"wordfence","cve":"CVE-2024-51576","title":"AMP Img Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edae5471-57b4-4bac-9cef-90019b40345a?source=api-prod","affected":[{"type":"plugin","slug":"amp-img-shortcode","name":"AMP Img Shortcode","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:40:50Z"},{"id":"wordfence:edaec73f-25b5-4ace-afef-844eb4143bf2","source":"wordfence","cve":"CVE-2023-3154","title":"WordPress Gallery Plugin \u2013 NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edaec73f-25b5-4ace-afef-844eb4143bf2?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"3.38","to_inclusive":true,"patched_in":"3.39"}],"published":"2023-09-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edafc213-a95f-483e-ac5f-d5b56817d046","source":"wordfence","cve":"CVE-2023-40681","title":"Groundhogg <= 2.7.11.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edafc213-a95f-483e-ac5f-d5b56817d046?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"2.7.11.10","to_inclusive":true,"patched_in":"2.7.11.11"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edb0ee0c-1eab-4988-9eb6-cc0c253fee15","source":"wordfence","cve":"CVE-2026-7052","title":"HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb0ee0c-1eab-4988-9eb6-cc0c253fee15?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-05-27T18:06:02Z","updated":"2026-05-28T06:45:43Z"},{"id":"wordfence:edb34ad0-352e-462e-a7f1-64a804a760ed","source":"wordfence","cve":"CVE-2024-33685","title":"Multiple Themes by jegstudio <= (Various Versions) - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb34ad0-352e-462e-a7f1-64a804a760ed?source=api-prod","affected":[{"type":"theme","slug":"intrace","name":"Intrace","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"theme","slug":"travey","name":"Travey","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"},{"type":"theme","slug":"startupzy","name":"Startupzy","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"},{"type":"theme","slug":"zeever","name":"Zeever","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"},{"type":"theme","slug":"photology","name":"Photology","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"},{"type":"theme","slug":"accountra","name":"Accountra","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-04-26T00:00:00Z","updated":"2024-04-30T00:38:01Z"},{"id":"wordfence:edb34cf0-cbd7-412d-9ac3-2e065c7f32ab","source":"wordfence","cve":"CVE-2025-32192","title":"Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb34cf0-cbd7-412d-9ac3-2e065c7f32ab?source=api-prod","affected":[{"type":"plugin","slug":"ut-elementor-addons-lite","name":"Ultra Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-09T19:14:54Z"},{"id":"wordfence:edb4f4b7-a59c-454b-82b5-d8e91c1c82a3","source":"wordfence","cve":"CVE-2023-47835","title":"ARI Stream Quiz <= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb4f4b7-a59c-454b-82b5-d8e91c1c82a3?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.2.32","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edb62de4-2d98-46fa-9244-585a547c0d27","source":"wordfence","cve":"CVE-2025-22674","title":"Product Blocks for WooCommerce <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb62de4-2d98-46fa-9244-585a547c0d27?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks-for-woocommerce","name":"Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:26:50Z"},{"id":"wordfence:edb65eb7-f1d5-495c-84ee-1b9b2cc45a24","source":"wordfence","cve":"CVE-2024-38740","title":"Packlink PRO shipping module <= 3.4.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb65eb7-f1d5-495c-84ee-1b9b2cc45a24?source=api-prod","affected":[{"type":"plugin","slug":"packlink-pro-shipping","name":"Packlink PRO for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-27T14:37:02Z"},{"id":"wordfence:edb72f0c-9651-4319-b5f6-84ca052c6ade","source":"wordfence","cve":"CVE-2025-49304","title":"Search with Typesense <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb72f0c-9651-4319-b5f6-84ca052c6ade?source=api-prod","affected":[{"type":"plugin","slug":"search-with-typesense","name":"Search with Typesense","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:14:29Z"},{"id":"wordfence:edb82429-e054-44c0-8c99-3d7dc6937822","source":"wordfence","cve":"CVE-2026-109936","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb82429-e054-44c0-8c99-3d7dc6937822?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:06:53Z"},{"id":"wordfence:edb82ef3-fb58-45db-9c29-1589a160a0c6","source":"wordfence","cve":"CVE-2024-52394","title":"Print PDF Generator and Publisher <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb82ef3-fb58-45db-9c29-1589a160a0c6?source=api-prod","affected":[{"type":"plugin","slug":"nopeamedia","name":"Print PDF Generator and Publisher","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:55:53Z"},{"id":"wordfence:edb8505b-3caa-4ccf-b0fc-69264f95b7ca","source":"wordfence","cve":"CVE-2024-2870","title":"Swift Framework < 2024.04.30 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edb8505b-3caa-4ccf-b0fc-69264f95b7ca?source=api-prod","affected":[{"type":"plugin","slug":"socialdriver-framework","name":"Swift Framework","from":"*","from_inclusive":true,"to":"2024.04.30","to_inclusive":false,"patched_in":"2024.04.30"}],"published":"2024-06-21T00:00:00Z","updated":"2024-08-02T20:14:29Z"},{"id":"wordfence:edbdb4d4-b648-4bf1-9ddc-b89f91c927e8","source":"wordfence","cve":"CVE-2025-46503","title":"Simple Google Photos Grid <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edbdb4d4-b648-4bf1-9ddc-b89f91c927e8?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-photos-grid","name":"Simple Google Photos Grid","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2025-04-24T00:00:00Z","updated":"2025-05-07T13:56:46Z"},{"id":"wordfence:edc0d90f-41a7-430a-a994-57be7fba8753","source":"wordfence","cve":"CVE-2008-4107","title":"WordPress Core < 2.6.2 - Cryptographic Weakness","severity":"medium","cvss":6.5,"cwe":"CWE-327","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc0d90f-41a7-430a-a994-57be7fba8753?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2008-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edc197c6-dd0e-4a61-9421-5ae2595ff42b","source":"wordfence","cve":"CVE-2025-26779","title":"Keep Backup Daily <= 2.1.0 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc197c6-dd0e-4a61-9421-5ae2595ff42b?source=api-prod","affected":[{"type":"plugin","slug":"keep-backup-daily","name":"Keep Backup Daily","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T20:54:41Z"},{"id":"wordfence:edc35f8c-f916-433e-9d3f-4992e8c9d7cd","source":"wordfence","cve":"CVE-2023-41663","title":"WP Bannerize Pro <= 1.6.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc35f8c-f916-433e-9d3f-4992e8c9d7cd?source=api-prod","affected":[{"type":"plugin","slug":"wp-bannerize-pro","name":"WP Bannerize Pro","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2023-09-01T00:00:00Z","updated":"2024-05-28T16:51:50Z"},{"id":"wordfence:edc4875e-3eca-4c25-a65c-93182912cd24","source":"wordfence","cve":"CVE-2025-10129","title":"WordPress Live Webcam Widget & Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc4875e-3eca-4c25-a65c-93182912cd24?source=api-prod","affected":[{"type":"plugin","slug":"wp-webcam-widget-shortcode","name":"WordPress Live Webcam Widget & Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:38:12Z","updated":"2025-10-11T09:28:44Z"},{"id":"wordfence:edc4f76e-9f0e-4f36-becb-fcb489c66e41","source":"wordfence","cve":"CVE-2025-31869","title":"Black Widgets For Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc4f76e-9f0e-4f36-becb-fcb489c66e41?source=api-prod","affected":[{"type":"plugin","slug":"black-widgets","name":"Black Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:42:20Z"},{"id":"wordfence:edc83f3a-c573-4555-bbeb-1a9f1dbba19d","source":"wordfence","cve":"CVE-2025-39419","title":"Revision Diet <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edc83f3a-c573-4555-bbeb-1a9f1dbba19d?source=api-prod","affected":[{"type":"plugin","slug":"revision-diet","name":"Revision Diet","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:49:17Z"},{"id":"wordfence:edcc23e0-075a-47e6-979d-7e75eed4337d","source":"wordfence","cve":"","title":"Ultimate Product Catalog <= 4.2.21 - Authorization Bypass and Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edcc23e0-075a-47e6-979d-7e75eed4337d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"4.2.21","to_inclusive":true,"patched_in":"4.2.22"}],"published":"2017-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edcc51f8-bf79-453a-aa4d-5d1d491316eb","source":"wordfence","cve":"CVE-2021-24920","title":"StatCounter <= 2.0.6 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edcc51f8-bf79-453a-aa4d-5d1d491316eb?source=api-prod","affected":[{"type":"plugin","slug":"official-statcounter-plugin-for-wordpress","name":"StatCounter \u2013 Real Time Visitor Stats, Session Replay & Heatmaps","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":false,"patched_in":"2.0.7"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edcf46b6-368e-49c0-b2c3-99bf6e2d358f","source":"wordfence","cve":"CVE-2023-2745","title":"WordPress Core < 6.2.1 - Directory Traversal","severity":"medium","cvss":5.4,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edcf46b6-368e-49c0-b2c3-99bf6e2d358f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"4.1.38","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.35","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.31","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.30","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.29","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.26","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.22","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.23","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.19","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.16","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.18","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.15","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.13","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.12","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.11","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.9","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.7","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.6","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.4","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.1","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"4.1.38"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.2","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"4.1.38"}],"published":"2023-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edd1396b-02f6-4292-82df-76c5eeecfe20","source":"wordfence","cve":"","title":"Facebook Chat Plugin <= 1.2 - Cross-Site Request Forgery to Site Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd1396b-02f6-4292-82df-76c5eeecfe20?source=api-prod","affected":[{"type":"plugin","slug":"facebook-messenger-customer-chat","name":"Facebook Chat Plugin \u2013 Live Chat Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2019-06-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edd13a5a-6c2d-4c19-941f-9b367cc32dde","source":"wordfence","cve":"CVE-2024-11645","title":"Float Block <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd13a5a-6c2d-4c19-941f-9b367cc32dde?source=api-prod","affected":[{"type":"plugin","slug":"float-block","name":"float block","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-10T15:53:32Z"},{"id":"wordfence:edd1b549-0975-446d-8ff8-770dbc957f92","source":"wordfence","cve":"CVE-2021-24949","title":"The Plus Addons for Elementor - Pro <= 5.0.6 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd1b549-0975-446d-8ff8-770dbc957f92?source=api-prod","affected":[{"type":"plugin","slug":"theplus_elementor_addon","name":"The Plus Addons for Elementor Page Builder Pro","from":"*","from_inclusive":true,"to":"5.0.7","to_inclusive":false,"patched_in":"5.0.7"}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edd1f4f9-c0d7-4b7b-bb5e-7388e0935e32","source":"wordfence","cve":"CVE-2016-10961","title":"ColorWay <= 3.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd1f4f9-c0d7-4b7b-bb5e-7388e0935e32?source=api-prod","affected":[{"type":"theme","slug":"colorway","name":"ColorWay","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2016-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edd24cfd-723d-4dc4-a301-43f858dcd7f3","source":"wordfence","cve":"CVE-2026-1914","title":"FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd24cfd-723d-4dc4-a301-43f858dcd7f3?source=api-prod","affected":[{"type":"plugin","slug":"fusedesk","name":"FuseDesk","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-03-20T15:13:03Z","updated":"2026-07-09T19:22:26Z"},{"id":"wordfence:edd4451e-fb8a-4140-8483-4d7a16b980e4","source":"wordfence","cve":"CVE-2025-52721","title":"Global Gallery <= 9.2.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd4451e-fb8a-4140-8483-4d7a16b980e4?source=api-prod","affected":[{"type":"plugin","slug":"global-gallery","name":"Global Gallery - WordPress Responsive Gallery","from":"*","from_inclusive":true,"to":"9.2.3","to_inclusive":true,"patched_in":"9.2.4"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:35:42Z"},{"id":"wordfence:edd6239d-5525-4dad-8358-f328e3175105","source":"wordfence","cve":"CVE-2024-52497","title":"Shopready <= 3.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd6239d-5525-4dad-8358-f328e3175105?source=api-prod","affected":[{"type":"plugin","slug":"shopready-elementor-addon","name":"Shopready \u2013 Elementor addons for WooCommerce Page Builder","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-26T18:28:26Z"},{"id":"wordfence:edd7f442-32a1-4ce9-bf47-96f313a8d5df","source":"wordfence","cve":"CVE-2021-24919","title":"Wicked Folders <= 2.18.9 - Subscriber+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd7f442-32a1-4ce9-bf47-96f313a8d5df?source=api-prod","affected":[{"type":"plugin","slug":"wicked-folders","name":"Wicked Folders \u2013 Folder Organizer for Pages, Posts, and Custom Post Types","from":"*","from_inclusive":true,"to":"2.18.9","to_inclusive":true,"patched_in":"2.18.10"}],"published":"2021-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edd9a357-cd78-458b-b79b-8995b754beb2","source":"wordfence","cve":"CVE-2026-54852","title":"Page and Post Restriction <= 1.6.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edd9a357-cd78-458b-b79b-8995b754beb2?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-10-29T14:40:00Z","updated":"2026-11-03T20:01:59Z"},{"id":"wordfence:eddb2224-d041-4f86-af76-51ae973e9b29","source":"wordfence","cve":"CVE-2025-31064","title":"Vizeon - Business Consulting < 1.2.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eddb2224-d041-4f86-af76-51ae973e9b29?source=api-prod","affected":[{"type":"theme","slug":"vizeon","name":"Vizeon - Business Consulting WordPress Themes","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2025-05-21T00:00:00Z","updated":"2026-03-06T15:02:30Z"},{"id":"wordfence:eddce6e0-2ea7-4980-97a7-857b2e1e3b69","source":"wordfence","cve":"CVE-2023-41654","title":"authLdap <= 2.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eddce6e0-2ea7-4980-97a7-857b2e1e3b69?source=api-prod","affected":[{"type":"plugin","slug":"authldap","name":"authLdap","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ede4b8ad-3c12-4ed8-9eda-806afa580bad","source":"wordfence","cve":"CVE-2023-45006","title":"WooODT Lite <= 2.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ede4b8ad-3c12-4ed8-9eda-806afa580bad?source=api-prod","affected":[{"type":"plugin","slug":"byconsole-woo-order-delivery-time","name":"Delivery Date Time & Pickup for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.6","to_inclusive":true,"patched_in":"2.4.7"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ede61e8f-aa80-44af-bc1d-2ad7d789cbb7","source":"wordfence","cve":"CVE-2026-88826","title":"SmugMug Embed <= 3.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ede61e8f-aa80-44af-bc1d-2ad7d789cbb7?source=api-prod","affected":[{"type":"plugin","slug":"smugmug-embed","name":"SmugMug Embed","from":"*","from_inclusive":true,"to":"3.13","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:18:21Z"},{"id":"wordfence:ede6c4d1-e4bd-44c0-a66a-fffc0e1b22f6","source":"wordfence","cve":"","title":"Gallery Photoblocks <= 1.1.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ede6c4d1-e4bd-44c0-a66a-fffc0e1b22f6?source=api-prod","affected":[{"type":"plugin","slug":"photoblocks-grid-gallery","name":"Gallery PhotoBlocks","from":"*","from_inclusive":true,"to":"1.1.40","to_inclusive":true,"patched_in":"1.1.41"}],"published":"2019-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edecb27b-ff11-4186-b8a8-41a85e3e2023","source":"wordfence","cve":"","title":"Accept Stripe Payments < 2.0.40 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edecb27b-ff11-4186-b8a8-41a85e3e2023?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.40","to_inclusive":false,"patched_in":"2.0.40"}],"published":"2021-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ededbe81-6feb-4952-9dc2-12156444ff5c","source":"wordfence","cve":"CVE-2025-30795","title":"Automation By Autonami <= 3.5.1 - Open Redirect","severity":"high","cvss":7.2,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ededbe81-6feb-4952-9dc2-12156444ff5c?source=api-prod","affected":[{"type":"plugin","slug":"wp-marketing-automations","name":"FunnelKit Automations \u2013 Email Marketing Automation and CRM for WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:56:08Z"},{"id":"wordfence:edf0760c-356a-4c55-9ccc-9f086dae12b6","source":"wordfence","cve":"","title":"Casso \u2013 T\u1ef1 \u0111\u1ed9ng x\u00e1c nh\u1eadn thanh to\u00e1n chuy\u1ec3n kho\u1ea3n ng\u00e2n h\u00e0ng <= 2.8.6 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf0760c-356a-4c55-9ccc-9f086dae12b6?source=api-prod","affected":[{"type":"plugin","slug":"casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang","name":"Casso Flow \u2013 T\u1ef1 \u0111\u1ed9ng x\u00e1c nh\u1eadn thanh to\u00e1n chuy\u1ec3n kho\u1ea3n ng\u00e2n h\u00e0ng","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:edf2e060-5ae4-4b46-bc68-22ae5f516fe8","source":"wordfence","cve":"CVE-2024-7618","title":"Community by PeepSo \u2013 Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf2e060-5ae4-4b46-bc68-22ae5f516fe8?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.4.5.0","to_inclusive":true,"patched_in":"6.4.6.0"}],"published":"2024-09-09T19:11:12Z","updated":"2024-09-10T07:30:05Z"},{"id":"wordfence:edf4b588-8b67-425a-b0e1-d4382cb88dd1","source":"wordfence","cve":"CVE-2025-1282","title":"Car Dealer Automotive WordPress Theme \u2013 Responsive <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf4b588-8b67-425a-b0e1-d4382cb88dd1?source=api-prod","affected":[{"type":"theme","slug":"cardealer","name":"Car Dealer Automotive WordPress Theme \u2013 Responsive","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2025-02-26T00:00:00Z","updated":"2025-02-27T08:22:04Z"},{"id":"wordfence:edf5ba29-2fc5-4839-abde-999f6b686749","source":"wordfence","cve":"CVE-2026-3781","title":"Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf5ba29-2fc5-4839-abde-999f6b686749?source=api-prod","affected":[{"type":"plugin","slug":"attendance-manager","name":"Attendance Manager","from":"*","from_inclusive":true,"to":"0.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-04-07T17:38:18Z","updated":"2026-06-26T15:01:48Z"},{"id":"wordfence:edf62f82-448a-4ed8-8d4b-7215223494cb","source":"wordfence","cve":"CVE-2024-11829","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf62f82-448a-4ed8-8d4b-7215223494cb?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.1.8","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2025-01-31T00:00:00Z","updated":"2025-02-01T06:41:52Z"},{"id":"wordfence:edf64bd8-dc4e-4e39-8958-39df046ac374","source":"wordfence","cve":"CVE-2025-23755","title":"PAFacile <= 2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edf64bd8-dc4e-4e39-8958-39df046ac374?source=api-prod","affected":[{"type":"plugin","slug":"pafacile","name":"PAFacile","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-20T16:10:32Z"},{"id":"wordfence:edfa6e7c-2a53-49ff-ad7b-63d579be3acc","source":"wordfence","cve":"CVE-2026-86800","title":"Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Login Protection Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/edfa6e7c-2a53-49ff-ad7b-63d579be3acc?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"7.0.10","to_inclusive":true,"patched_in":"7.0.11"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:47:55Z"},{"id":"wordfence:ee013d3f-18bc-418e-ab5b-87724710f340","source":"wordfence","cve":"CVE-2023-44228","title":"Onclick Show Popup <= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee013d3f-18bc-418e-ab5b-87724710f340?source=api-prod","affected":[{"type":"plugin","slug":"onclick-show-popup","name":"Onclick show popup","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee01dab6-8e10-43aa-bc20-1f389f1e7d07","source":"wordfence","cve":"CVE-2011-3128","title":"WordPress Core < 3.1.3 - Sensitive Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee01dab6-8e10-43aa-bc20-1f389f1e7d07?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee01e215-5a71-4400-a109-0a8d50d33645","source":"wordfence","cve":"CVE-2025-68580","title":"Advanced Classifieds & Directory Pro <= 3.2.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee01e215-5a71-4400-a109-0a8d50d33645?source=api-prod","affected":[{"type":"plugin","slug":"advanced-classifieds-and-directory-pro","name":"Advanced Classifieds & Directory Pro","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-06T14:43:00Z"},{"id":"wordfence:ee031b29-a334-4df4-8c03-4ffd306e38ea","source":"wordfence","cve":"CVE-2025-8313","title":"Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee031b29-a334-4df4-8c03-4ffd306e38ea?source=api-prod","affected":[{"type":"plugin","slug":"campus-directory","name":"Campus Directory \u2013 Faculty, Staff & Student Directory Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-08-04T17:57:49Z","updated":"2025-08-05T06:39:50Z"},{"id":"wordfence:ee03ca88-97c1-45b0-a9d9-1ed57e124f13","source":"wordfence","cve":"CVE-2014-9401","title":"WP Limit Posts Automatically <= 0.7 - Cross-Site Request Forgery leading to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee03ca88-97c1-45b0-a9d9-1ed57e124f13?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-posts-automatically","name":"wp-limit-posts-automatically","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2014-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee03d780-076b-4501-a353-376198a4bd7b","source":"wordfence","cve":"CVE-2024-1510","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee03d780-076b-4501-a353-376198a4bd7b?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.0.2","to_inclusive":true,"patched_in":"7.0.3"}],"published":"2024-02-19T00:00:00Z","updated":"2024-02-20T02:34:18Z"},{"id":"wordfence:ee045d0d-101a-4ae2-b209-4a4865eec195","source":"wordfence","cve":"CVE-2026-12415","title":"Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195?source=api-prod","affected":[{"type":"plugin","slug":"invoice-creator","name":"Invoice Generator","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T16:05:32Z","updated":"2026-06-27T04:30:30Z"},{"id":"wordfence:ee069cb3-370e-48ea-aa35-c30fe83c2498","source":"wordfence","cve":"CVE-2023-6938","title":"Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee069cb3-370e-48ea-aa35-c30fe83c2498?source=api-prod","affected":[{"type":"plugin","slug":"oxygenbuilder","name":"Oxygen Builder","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:46Z"},{"id":"wordfence:ee08121e-68eb-4849-b102-3370a4cdae77","source":"wordfence","cve":"CVE-2026-22341","title":"Booked <= 3.0.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee08121e-68eb-4849-b102-3370a4cdae77?source=api-prod","affected":[{"type":"plugin","slug":"booked","name":"Booked - Appointment Booking for WordPress","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T17:00:37Z"},{"id":"wordfence:ee0a762e-9159-4dab-a7be-9cbe332effb1","source":"wordfence","cve":"CVE-2026-3396","title":"WCAPF \u2013 WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0a762e-9159-4dab-a7be-9cbe332effb1?source=api-prod","affected":[{"type":"plugin","slug":"wc-ajax-product-filter","name":"WCAPF \u2013 Ajax Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-08T11:16:58Z"},{"id":"wordfence:ee0a9e78-c9a3-40c8-8e4b-4a67c3124fb3","source":"wordfence","cve":"CVE-2025-32483","title":"Request Call Back <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0a9e78-c9a3-40c8-8e4b-4a67c3124fb3?source=api-prod","affected":[{"type":"plugin","slug":"request-call-back","name":"Request Call Back","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T19:21:04Z"},{"id":"wordfence:ee0acdaa-3c56-4a57-865e-44e8ecd7fba0","source":"wordfence","cve":"CVE-2025-22309","title":"SpeakOut! Email Petitions <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0acdaa-3c56-4a57-865e-44e8ecd7fba0?source=api-prod","affected":[{"type":"plugin","slug":"speakout","name":"SpeakOut! Email Petitions","from":"*","from_inclusive":true,"to":"4.4.2","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:48:35Z"},{"id":"wordfence:ee0c0e29-b117-4480-b5b7-995878af8c57","source":"wordfence","cve":"CVE-2026-1720","title":"WowOptin: Next-Gen Popup Maker \u2013 Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0c0e29-b117-4480-b5b7-995878af8c57?source=api-prod","affected":[{"type":"plugin","slug":"optin","name":"WowOptin: Next-Gen Popup Maker \u2013 Create Stunning Popups and Optins for Lead Generation","from":"*","from_inclusive":true,"to":"1.4.24","to_inclusive":true,"patched_in":"1.4.25"}],"published":"2026-03-04T00:00:00Z","updated":"2026-03-05T13:24:01Z"},{"id":"wordfence:ee0eead2-3eab-4a2a-bfe4-c0d8f91dc0a5","source":"wordfence","cve":"CVE-2024-10681","title":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0eead2-3eab-4a2a-bfe4-c0d8f91dc0a5?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.51","to_inclusive":true,"patched_in":"4.0.52"}],"published":"2024-12-05T00:00:00Z","updated":"2024-12-06T09:23:00Z"},{"id":"wordfence:ee10221e-ce76-4c20-abc7-26ace2f4e619","source":"wordfence","cve":"CVE-2025-68528","title":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee10221e-ce76-4c20-abc7-26ace2f4e619?source=api-prod","affected":[{"type":"plugin","slug":"amount-left-free-shipping-woocommerce","name":"Free Shipping Bar: Amount Left for Free Shipping for WooCommerce","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T19:03:31Z"},{"id":"wordfence:ee11d9e5-64d5-49b4-b5f5-b76605250028","source":"wordfence","cve":"","title":"GeoDirectory <= 2.2.19 - CSV Injection","severity":"medium","cvss":4.1,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee11d9e5-64d5-49b4-b5f5-b76605250028?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.2.19","to_inclusive":true,"patched_in":"2.2.20"}],"published":"2022-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee12b4e4-f29d-4d7a-82ef-963971951c84","source":"wordfence","cve":"CVE-2025-31774","title":"Astra Security Suite <= 0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee12b4e4-f29d-4d7a-82ef-963971951c84?source=api-prod","affected":[{"type":"plugin","slug":"getastra","name":"Astra Security Suite \u2013 Firewall & Malware Scan","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:23:19Z"},{"id":"wordfence:ee13399f-0fc9-40f3-93f5-34c913d54aa0","source":"wordfence","cve":"CVE-2023-34005","title":"Front End Users <= 3.2.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee13399f-0fc9-40f3-93f5-34c913d54aa0?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.24","to_inclusive":true,"patched_in":"3.2.25"}],"published":"2023-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee135d1f-378a-4ec4-9cc1-8ed9208a04cd","source":"wordfence","cve":"CVE-2026-102398","title":"Smart Popup by Supsystic <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee135d1f-378a-4ec4-9cc1-8ed9208a04cd?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.13.2"}],"published":"2026-09-30T09:57:08Z","updated":"2026-10-08T23:13:49Z"},{"id":"wordfence:ee13ee9a-dd53-4124-a7e9-679afe362f58","source":"wordfence","cve":"CVE-2016-11005","title":"Elfsight Instagram Widget \u2013 Instagram Gallery < 1.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee13ee9a-dd53-4124-a7e9-679afe362f58?source=api-prod","affected":[{"type":"plugin","slug":"instalinker","name":"Elfsight Instagram Widget \u2013 Instagram Gallery","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":false,"patched_in":"1.1.2"}],"published":"2016-02-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee1624fd-d98b-4953-99dc-a952dda48aa1","source":"wordfence","cve":"CVE-2025-4279","title":"External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1624fd-d98b-4953-99dc-a952dda48aa1?source=api-prod","affected":[{"type":"plugin","slug":"external-image-replace","name":"External image replace","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-05T00:00:00Z","updated":"2025-05-05T18:22:39Z"},{"id":"wordfence:ee18552b-2814-4598-9b7b-7c919d6d644e","source":"wordfence","cve":"CVE-2026-13704","title":"GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee18552b-2814-4598-9b7b-7c919d6d644e?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.1","to_inclusive":true,"patched_in":"4.16.2"}],"published":"2026-07-01T17:15:16Z","updated":"2026-07-08T18:39:18Z"},{"id":"wordfence:ee1a3105-ebb2-44ce-bbbe-3ab95d69670a","source":"wordfence","cve":"CVE-2021-24305","title":"Watcheezy Live chat plugin for WordPress <= 2.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1a3105-ebb2-44ce-bbbe-3ab95d69670a?source=api-prod","affected":[{"type":"plugin","slug":"watcheezy","name":"Watcheezy Live chat plugin for WordPress","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2021-05-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee1aab28-e9db-4010-ad46-ad4aec1d5dab","source":"wordfence","cve":"CVE-2021-24447","title":"WP Image Zoom <= 1.46 - Local File Inclusion","severity":"medium","cvss":5.3,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1aab28-e9db-4010-ad46-ad4aec1d5dab?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-zoooom","name":"WP Image Zoom","from":"*","from_inclusive":true,"to":"1.46","to_inclusive":true,"patched_in":"1.47.1"}],"published":"2021-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee1ac4b5-0d2a-48ee-aad3-e27ccae5f217","source":"wordfence","cve":"CVE-2017-20249","title":"Apptha Slider Gallery <= 1.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1ac4b5-0d2a-48ee-aad3-e27ccae5f217?source=api-prod","affected":[{"type":"plugin","slug":"apptha-slider-gallery","name":"apptha-slider-gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T17:39:33Z"},{"id":"wordfence:ee1b6961-1453-4f59-b03a-ab78b2e3f9d4","source":"wordfence","cve":"CVE-2013-1808","title":"Zendesk Chat < 1.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1b6961-1453-4f59-b03a-ab78b2e3f9d4?source=api-prod","affected":[{"type":"plugin","slug":"zopim-live-chat","name":"Zendesk Chat","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2013-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee1c9c62-d5b5-4213-ae5a-d3d4e9103d15","source":"wordfence","cve":"CVE-2024-12514","title":"3DVieweronline <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1c9c62-d5b5-4213-ae5a-d3d4e9103d15?source=api-prod","affected":[{"type":"plugin","slug":"3dvieweronline-wp","name":"3D Viewer Online","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.3"}],"published":"2025-01-08T22:01:11Z","updated":"2025-02-20T14:59:20Z"},{"id":"wordfence:ee1ee4c4-871d-4a3d-8ca6-3675d248d5e8","source":"wordfence","cve":"CVE-2022-42479","title":"Soledad <= 8.2.5 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1ee4c4-871d-4a3d-8ca6-3675d248d5e8?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.6"}],"published":"2022-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee20726a-b5a8-4778-b5b4-5ea232ca4fc8","source":"wordfence","cve":"CVE-2021-24459","title":"Survey Maker < 1.5.6 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee20726a-b5a8-4778-b5b4-5ea232ca4fc8?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2021-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee213b2c-b59d-4563-98d1-a26b1e8e13a7","source":"wordfence","cve":"CVE-2022-38104","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated Arbitrary Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee213b2c-b59d-4563-98d1-a26b1e8e13a7?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee23629c-6147-4527-929f-8c932cd7d7a7","source":"wordfence","cve":"CVE-2023-5762","title":"Filr \u2013 Secure document library <= 1.2.3.5 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee23629c-6147-4527-929f-8c932cd7d7a7?source=api-prod","affected":[{"type":"plugin","slug":"filr-protection","name":"Filr \u2013 Secure document library","from":"*","from_inclusive":true,"to":"1.2.3.6","to_inclusive":false,"patched_in":"1.2.3.6"}],"published":"2023-11-13T00:00:00Z","updated":"2026-09-04T00:43:06Z"},{"id":"wordfence:ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f","source":"wordfence","cve":"CVE-2025-11841","title":"Greenshift \u2013 animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"12.2.7","to_inclusive":true,"patched_in":"12.2.8"}],"published":"2025-11-03T13:41:01Z","updated":"2025-11-04T01:50:26Z"},{"id":"wordfence:ee269bc7-2822-4a07-be91-6763c1cf6cf2","source":"wordfence","cve":"CVE-2024-1789","title":"WP SMTP 1.2 - 1.2.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee269bc7-2822-4a07-be91-6763c1cf6cf2?source=api-prod","affected":[{"type":"plugin","slug":"wp-smtp","name":"Solid Mail \u2013 SMTP email and logging made by SolidWP","from":"1.2","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2024-04-25T00:00:00Z","updated":"2024-04-26T08:29:21Z"},{"id":"wordfence:ee27a988-6afd-4da7-a750-0af801d7fa15","source":"wordfence","cve":"CVE-2020-7109","title":"Elementor Website Builder <= 2.8.3 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee27a988-6afd-4da7-a750-0af801d7fa15?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2020-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee2902be-a9a5-4f9b-a112-e786a46331f7","source":"wordfence","cve":"CVE-2026-27985","title":"Humanum <= 1.1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2902be-a9a5-4f9b-a112-e786a46331f7?source=api-prod","affected":[{"type":"theme","slug":"humanum","name":"Humanum","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T14:54:35Z"},{"id":"wordfence:ee29caa0-6354-4700-9725-56b05c87a9ed","source":"wordfence","cve":"CVE-2025-48122","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee29caa0-6354-4700-9725-56b05c87a9ed?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-09-18T14:34:58Z"},{"id":"wordfence:ee2b18c5-6f3a-442d-b113-e546e010c028","source":"wordfence","cve":"CVE-2024-55992","title":"WooCommerce Basic Ordernumbers <= 1.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2b18c5-6f3a-442d-b113-e546e010c028?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-basic-ordernumbers","name":"WooCommerce Basic Ordernumbers","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:53:29Z"},{"id":"wordfence:ee2b4055-8cbd-49b7-bb0b-eddef85060fc","source":"wordfence","cve":"CVE-2023-5099","title":"HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2b4055-8cbd-49b7-bb0b-eddef85060fc?source=api-prod","affected":[{"type":"plugin","slug":"hk-filter-and-search","name":"HTML filter and csv-file search","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2023-10-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee2bbe3a-b1d2-4266-af55-35f60ac52733","source":"wordfence","cve":"","title":"Arabic Font <= 1.2 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2bbe3a-b1d2-4266-af55-35f60ac52733?source=api-prod","affected":[{"type":"plugin","slug":"arabic-font","name":"Arabic Font","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2017-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee2c5df2-250a-4e35-9219-2630d8d9253a","source":"wordfence","cve":"CVE-2011-3127","title":"WordPress Core < 3.1.3 - Clickjacking","severity":"high","cvss":7.1,"cwe":"CWE-1021","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2c5df2-250a-4e35-9219-2630d8d9253a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2011-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee2d7d01-da87-43b4-8d2b-2c9eef3c80e6","source":"wordfence","cve":"CVE-2026-86591","title":"Botiga Pro <= 1.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2d7d01-da87-43b4-8d2b-2c9eef3c80e6?source=api-prod","affected":[{"type":"plugin","slug":"botiga-pro","name":"Botiga Pro","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T19:30:30Z"},{"id":"wordfence:ee2d7e4d-b245-4038-90d2-f2706f33e8c6","source":"wordfence","cve":"CVE-2025-62955","title":"TempTool  [Show Current Template Info] <= 1.3.1 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2d7e4d-b245-4038-90d2-f2706f33e8c6?source=api-prod","affected":[{"type":"plugin","slug":"current-template-name","name":"Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info \u2013 Pagely","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-10-14T00:00:00Z","updated":"2025-10-29T15:57:46Z"},{"id":"wordfence:ee30c17b-00bb-4278-8a09-cef34b3c1955","source":"wordfence","cve":"CVE-2025-62889","title":"King Addons for Elementor <= 51.1.62 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee30c17b-00bb-4278-8a09-cef34b3c1955?source=api-prod","affected":[{"type":"plugin","slug":"king-addons","name":"King Addons for Elementor \u2013 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder","from":"*","from_inclusive":true,"to":"51.1.62","to_inclusive":true,"patched_in":"51.1.63"}],"published":"2025-08-18T00:00:00Z","updated":"2026-05-26T18:16:44Z"},{"id":"wordfence:ee342bda-f2bb-45dd-ae9b-a254006b9bd2","source":"wordfence","cve":"CVE-2025-63058","title":"Custom Field Template <= 2.7.6 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee342bda-f2bb-45dd-ae9b-a254006b9bd2?source=api-prod","affected":[{"type":"plugin","slug":"custom-field-template","name":"Custom Field Template","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-12-08T00:00:00Z","updated":"2026-02-26T15:22:42Z"},{"id":"wordfence:ee3548ca-423f-4e2f-b87b-366200b31777","source":"wordfence","cve":"","title":"Testimonial < 2.3 - Multiple Vulnerabilities","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3548ca-423f-4e2f-b87b-366200b31777?source=api-prod","affected":[{"type":"plugin","slug":"indianic-testimonial","name":"Testimonial","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2013-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee3690d9-d1c3-4653-948b-cba1a7653574","source":"wordfence","cve":"CVE-2026-100157","title":"WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3690d9-d1c3-4653-948b-cba1a7653574?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-10-02T17:41:41Z","updated":"2026-10-03T06:38:26Z"},{"id":"wordfence:ee36fec3-1fc1-43e8-8428-301cb4e5b689","source":"wordfence","cve":"CVE-2024-49309","title":"Digitally <= 1.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee36fec3-1fc1-43e8-8428-301cb4e5b689?source=api-prod","affected":[{"type":"theme","slug":"digitally","name":"Digitally","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T17:52:40Z"},{"id":"wordfence:ee38b668-0b9c-4843-97e6-665531839249","source":"wordfence","cve":"CVE-2026-25450","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee38b668-0b9c-4843-97e6-665531839249?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.3.0","to_inclusive":true,"patched_in":"5.3.1"}],"published":"2026-10-29T14:28:00Z","updated":"2026-11-03T19:52:44Z"},{"id":"wordfence:ee396f94-8934-47db-9bc8-783a2b20f427","source":"wordfence","cve":"CVE-2022-4836","title":"Breadcrumb <= 1.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee396f94-8934-47db-9bc8-783a2b20f427?source=api-prod","affected":[{"type":"plugin","slug":"breadcrumb","name":"Breadcrumb \u2013  Breadcrumb for WooCommerce and Custom Post Types","from":"*","from_inclusive":true,"to":"1.5.32","to_inclusive":true,"patched_in":"1.5.33"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee39e64f-b728-4754-93ea-d9bd70c6c82c","source":"wordfence","cve":"CVE-2025-47492","title":"Drag and Drop File Upload for Elementor Forms <= 1.4.3 - Unauthenticated Arbitrary File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee39e64f-b728-4754-93ea-d9bd70c6c82c?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-for-elementor-forms","name":"Drag and Drop File Upload for Elementor Forms","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-05-15T00:00:00Z","updated":"2025-05-20T19:35:02Z"},{"id":"wordfence:ee3bbf20-43fd-4977-b0ba-b81e7a3810d0","source":"wordfence","cve":"CVE-2026-13765","title":"LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3bbf20-43fd-4977-b0ba-b81e7a3810d0?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.4.2"}],"published":"2026-07-16T15:14:19Z","updated":"2026-07-17T03:43:43Z"},{"id":"wordfence:ee3ed678-c77c-4c87-babe-576e6f9e5018","source":"wordfence","cve":"CVE-2025-23482","title":"azurecurve Floating Featured <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3ed678-c77c-4c87-babe-576e6f9e5018?source=api-prod","affected":[{"type":"plugin","slug":"azurecurve-floating-featured-image","name":"azurecurve Floating Featured Image","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:53:40Z"},{"id":"wordfence:ee3fdeb2-9e2a-4fe7-aa74-aaf60a74c060","source":"wordfence","cve":"CVE-2020-20628","title":"WP GDPR <= 2.1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3fdeb2-9e2a-4fe7-aa74-aaf60a74c060?source=api-prod","affected":[{"type":"plugin","slug":"wp-gdpr-core","name":"WP GDPR","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2020-04-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee3ff4ee-48d3-4b35-b6c9-320bd42780d6","source":"wordfence","cve":"CVE-2021-24818","title":"Wp Limits <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3ff4ee-48d3-4b35-b6c9-320bd42780d6?source=api-prod","affected":[{"type":"plugin","slug":"wp-limits","name":"Wp Limits","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee41c75d-3a4f-463d-a70e-323c903c6e08","source":"wordfence","cve":"CVE-2025-49362","title":"Gracioza <= 1.0.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee41c75d-3a4f-463d-a70e-323c903c6e08?source=api-prod","affected":[{"type":"theme","slug":"gracioza","name":"Gracioza | Weight Loss & Healthy Blog WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-12-19T16:21:06Z"},{"id":"wordfence:ee449645-44d1-4ce7-b74b-dcf446b5a9ab","source":"wordfence","cve":"CVE-2024-8673","title":"Z-Downloads <= 1.11.6 - Authenticated (Admin+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee449645-44d1-4ce7-b74b-dcf446b5a9ab?source=api-prod","affected":[{"type":"plugin","slug":"z-downloads","name":"Z-Downloads","from":"*","from_inclusive":true,"to":"1.11.6","to_inclusive":true,"patched_in":"1.11.7"}],"published":"2024-08-06T00:00:00Z","updated":"2025-05-23T14:56:40Z"},{"id":"wordfence:ee44c189-c5ba-41f4-8457-1eb8cf7393fd","source":"wordfence","cve":"CVE-2025-54036","title":"Webba Booking <= 5.1.20 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee44c189-c5ba-41f4-8457-1eb8cf7393fd?source=api-prod","affected":[{"type":"plugin","slug":"webba-booking-lite","name":"Easy Appointment Booking & Scheduling Plugin \u2013 Webba Booking Calendar","from":"*","from_inclusive":true,"to":"5.1.20","to_inclusive":true,"patched_in":"5.1.21"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:26:08Z"},{"id":"wordfence:ee459afe-9c91-4577-bf96-b39552679fa0","source":"wordfence","cve":"CVE-2026-54871","title":"ShopBuilder \u2013 WooCommerce Builder For Elementor <= 3.4.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee459afe-9c91-4577-bf96-b39552679fa0?source=api-prod","affected":[{"type":"plugin","slug":"shopbuilder","name":"ShopBuilder \u2013 WooCommerce Builder For Elementor","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-10-29T14:27:00Z","updated":"2026-11-03T20:05:21Z"},{"id":"wordfence:ee49e76a-fc6f-4c23-ac44-29625b1d5000","source":"wordfence","cve":"CVE-2026-18234","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud < 4.21.1 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee49e76a-fc6f-4c23-ac44-29625b1d5000?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.21.1","to_inclusive":false,"patched_in":"4.21.1"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:48:39Z"},{"id":"wordfence:ee4a8c72-d49e-41f7-ba38-0ffa2a7a962d","source":"wordfence","cve":"CVE-2026-62033","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Missing Authorization to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4a8c72-d49e-41f7-ba38-0ffa2a7a962d?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:48:14Z"},{"id":"wordfence:ee4a9dc6-fc0b-4bab-9511-fa0a713800ff","source":"wordfence","cve":"CVE-2022-1542","title":"hpb Dashboard <= 1.3.1 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4a9dc6-fc0b-4bab-9511-fa0a713800ff?source=api-prod","affected":[{"type":"plugin","slug":"hpbtool","name":"hpb Dashboard","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee4b1dac-6ec6-4c1c-9103-60e53d980b95","source":"wordfence","cve":"CVE-2024-52370","title":"Hive Support \u2013 WordPress Help Desk <= 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4b1dac-6ec6-4c1c-9103-60e53d980b95?source=api-prod","affected":[{"type":"plugin","slug":"hive-support","name":"Hive Support | AI-Powered Help Desk, Live Chat and Chatbot","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:43:54Z"},{"id":"wordfence:ee4c5d34-74cb-443b-9323-90580dbe675e","source":"wordfence","cve":"CVE-2026-12407","title":"E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4c5d34-74cb-443b-9323-90580dbe675e?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.32.26","to_inclusive":true,"patched_in":"1.32.31"}],"published":"2026-06-17T14:55:56Z","updated":"2026-06-18T03:41:40Z"},{"id":"wordfence:ee4db3e8-2d0a-4129-a708-9620c6f42150","source":"wordfence","cve":"CVE-2025-28927","title":"Display Template Name <= 1.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4db3e8-2d0a-4129-a708-9620c6f42150?source=api-prod","affected":[{"type":"plugin","slug":"display-template-name","name":"Display Template Name","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T14:58:16Z"},{"id":"wordfence:ee4e08e0-25b7-47b2-9ec2-de93afc437a6","source":"wordfence","cve":"CVE-2015-9297","title":"Events Manager <= 5.5.7.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4e08e0-25b7-47b2-9ec2-de93afc437a6?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":false,"patched_in":"5.6"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee4e0cbb-cf15-4f38-a216-053b349ce2a6","source":"wordfence","cve":"CVE-2026-103068","title":"ByteCoreStack \u2013 MCP Connector for AI Tools <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4e0cbb-cf15-4f38-a216-053b349ce2a6?source=api-prod","affected":[{"type":"plugin","slug":"bcs-mcp-manager","name":"ByteCoreStack \u2013 MCP Connector for AI Tools","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-10-01T13:42:58Z","updated":"2026-10-08T23:00:35Z"},{"id":"wordfence:ee4f837a-d0b5-48df-8c96-2a294985612e","source":"wordfence","cve":"CVE-2026-87917","title":"MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee4f837a-d0b5-48df-8c96-2a294985612e?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-for-wp","name":"MC4WP: Mailchimp for WordPress","from":"*","from_inclusive":true,"to":"4.14.0","to_inclusive":true,"patched_in":"4.14.1"}],"published":"2026-09-18T18:54:30Z","updated":"2026-09-19T07:43:21Z"},{"id":"wordfence:ee504315-de76-4f1d-b648-3f2904770988","source":"wordfence","cve":"CVE-2025-48154","title":"Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee504315-de76-4f1d-b648-3f2904770988?source=api-prod","affected":[{"type":"plugin","slug":"lbg_vp_youtube_vimeo_addon_visual_composer","name":"Multimedia Playlist Slider Addon for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:38:27Z"},{"id":"wordfence:ee50731f-696f-4e9f-a930-05b2b23752de","source":"wordfence","cve":"","title":"Cost of Goods for WooCommerce <= 2.8.6 - Cross-Site Request Forgery in save_costs","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee50731f-696f-4e9f-a930-05b2b23752de?source=api-prod","affected":[{"type":"plugin","slug":"cost-of-goods-for-woocommerce","name":"Cost of Goods: Product Cost & Profit Calculator for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"}],"published":"2023-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee520664-0c1f-4af0-8cdf-a33c1dfaaca7","source":"wordfence","cve":"CVE-2023-27454","title":"Rife Elementor Extensions & Templates <= 1.1.10 - Missing Authorization via import_templates","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee520664-0c1f-4af0-8cdf-a33c1dfaaca7?source=api-prod","affected":[{"type":"plugin","slug":"rife-elementor-extensions","name":"Rife Extensions & Templates for Elementor","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee52c6c0-c69e-46c4-9e4b-94aa69c00737","source":"wordfence","cve":"CVE-2023-33926","title":"Easy Google Maps <= 1.11.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee52c6c0-c69e-46c4-9e4b-94aa69c00737?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-easy","name":"Easy Google Maps by Supsystic \u2013 Custom Markers, Clustering & Map Themes","from":"*","from_inclusive":true,"to":"1.11.7","to_inclusive":true,"patched_in":"1.11.8"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee5737b3-de32-4b5c-a9df-7909ad32ec93","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5737b3-de32-4b5c-a9df-7909ad32ec93?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee57986b-7fee-47fe-a1a6-bd0818e0bff0","source":"wordfence","cve":"CVE-2026-11590","title":"Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee57986b-7fee-47fe-a1a6-bd0818e0bff0?source=api-prod","affected":[{"type":"plugin","slug":"wp-support-plus-responsive-ticket-system","name":"WP Support Plus Responsive Ticket System","from":"*","from_inclusive":true,"to":"9.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-08-21T13:05:55Z"},{"id":"wordfence:ee57a2d6-4c27-48a1-b9b3-2e43054acbc4","source":"wordfence","cve":"CVE-2026-57800","title":"Overworld - eSports and Gaming WordPress Theme <= 1.5 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee57a2d6-4c27-48a1-b9b3-2e43054acbc4?source=api-prod","affected":[{"type":"theme","slug":"overworld","name":"Overworld - eSports and Gaming WordPress Theme","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:35:29Z"},{"id":"wordfence:ee595f48-b72f-4569-a248-7dbd0b9152ae","source":"wordfence","cve":"","title":"Easy Form by AYS <= 1.3.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee595f48-b72f-4569-a248-7dbd0b9152ae?source=api-prod","affected":[{"type":"plugin","slug":"easy-form","name":"Easy Form","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":false,"patched_in":"1.3.9"}],"published":"2023-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee5acf1d-e405-4aa6-8355-b5aebbbb1d1d","source":"wordfence","cve":"","title":"WPtouch <= 3.4.2 - Arbitrary File Upload","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5acf1d-e405-4aa6-8355-b5aebbbb1d1d?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee5ad5d6-f38c-481a-ba0e-38481804739f","source":"wordfence","cve":"CVE-2016-20083","title":"More Fields <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5ad5d6-f38c-481a-ba0e-38481804739f?source=api-prod","affected":[{"type":"plugin","slug":"more-fields","name":"more-fields","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T17:37:59Z"},{"id":"wordfence:ee5af42d-71d8-4e65-bd74-55456480da8b","source":"wordfence","cve":"","title":"WP Image Resizer (Unspecified Version) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5af42d-71d8-4e65-bd74-55456480da8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-resizer","name":"WP Image Resizer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee5cd660-8ae7-4731-b563-760679e7eaf7","source":"wordfence","cve":"CVE-2026-121778","title":"WP-Lister Lite for Amazon <= 2.9.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5cd660-8ae7-4731-b563-760679e7eaf7?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-amazon","name":"WP-Lister Lite for Amazon","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.2.5"}],"published":"2026-11-07T08:44:00Z","updated":"2026-11-10T19:48:40Z"},{"id":"wordfence:ee5cddbc-9162-4397-8e7a-0ec5552cc367","source":"wordfence","cve":"CVE-2026-45214","title":"Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5cddbc-9162-4397-8e7a-0ec5552cc367?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-03-30T00:00:00Z","updated":"2026-07-10T19:24:11Z"},{"id":"wordfence:ee5de6df-e387-44e8-8fab-c07af4a2155c","source":"wordfence","cve":"CVE-2025-23719","title":"ZhinaTwitterWidget <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5de6df-e387-44e8-8fab-c07af4a2155c?source=api-prod","affected":[{"type":"plugin","slug":"zhina-twitter-widget","name":"ZhinaTwitterWidget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-20T00:00:00Z","updated":"2025-03-25T13:18:25Z"},{"id":"wordfence:ee5df5fe-4213-4d36-aa8f-7eb2710c32b6","source":"wordfence","cve":"CVE-2024-13656","title":"Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5df5fe-4213-4d36-aa8f-7eb2710c32b6?source=api-prod","affected":[{"type":"theme","slug":"click-mag","name":"Click Mag - Viral WordPress News Magazine/Blog Theme","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:16Z"},{"id":"wordfence:ee5df686-7bf8-42cc-9356-92570bd02355","source":"wordfence","cve":"CVE-2026-89426","title":"Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5df686-7bf8-42cc-9356-92570bd02355?source=api-prod","affected":[{"type":"plugin","slug":"knit-pay","name":"Knit Pay \u2013 Cashfree, Instamojo, Razorpay, PayPal and more","from":"*","from_inclusive":true,"to":"9.6.1.0","to_inclusive":true,"patched_in":"9.6.2.0"}],"published":"2026-09-24T18:42:55Z","updated":"2026-09-25T07:40:31Z"},{"id":"wordfence:ee5e1262-193c-480b-bc27-481c961c7c47","source":"wordfence","cve":"","title":"Quick Adsense < 2.8.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5e1262-193c-480b-bc27-481c961c7c47?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense","name":"Quick Adsense \u2013 Ad Manager & AdSense Ads","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":false,"patched_in":"2.8.2"}],"published":"2022-04-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee5ebdbf-2ea6-4d0c-adb3-af1ea53cda68","source":"wordfence","cve":"CVE-2026-73399","title":"Flutterwave WooCommerce <= 3.3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5ebdbf-2ea6-4d0c-adb3-af1ea53cda68?source=api-prod","affected":[{"type":"plugin","slug":"rave-woocommerce-payment-gateway","name":"Flutterwave WooCommerce","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2026-08-18T00:00:00Z","updated":"2026-10-13T16:59:32Z"},{"id":"wordfence:ee6749f5-1dd0-4687-9a86-64fd1161321b","source":"wordfence","cve":"CVE-2025-5811","title":"Listly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6749f5-1dd0-4687-9a86-64fd1161321b?source=api-prod","affected":[{"type":"plugin","slug":"listly","name":"Listly: Listicles For WordPress","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-18T05:24:01Z"},{"id":"wordfence:ee678085-ce74-4a35-9d90-3b94a3d39a8e","source":"wordfence","cve":"","title":"Ultimate Addons for Elementor < 1.20.1 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee678085-ce74-4a35-9d90-3b94a3d39a8e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-elementor","name":"Ultimate Addons for Elementor","from":"*","from_inclusive":true,"to":"1.20.1","to_inclusive":false,"patched_in":"1.20.1"}],"published":"2019-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee69bc45-6ff1-487d-8893-06e9c7f3e14f","source":"wordfence","cve":"CVE-2026-14237","title":"Vitepos <= 3.5.0 - Authenticated (Outlet Manager+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee69bc45-6ff1-487d-8893-06e9c7f3e14f?source=api-prod","affected":[{"type":"plugin","slug":"vitepos","name":"Vitepos","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-17T16:28:54Z"},{"id":"wordfence:ee6a7c36-3936-43ee-971d-0bc467eda90c","source":"wordfence","cve":"CVE-2026-90923","title":"Autopay <= 5.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6a7c36-3936-43ee-971d-0bc467eda90c?source=api-prod","affected":[{"type":"plugin","slug":"platnosci-online-blue-media","name":"Autopay","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-09-15T00:00:00Z","updated":"2026-09-22T18:48:43Z"},{"id":"wordfence:ee6b1497-ffac-4eb3-baad-36270e419a95","source":"wordfence","cve":"CVE-2025-5944","title":"Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6b1497-ffac-4eb3-baad-36270e419a95?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"8.0.0","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":"8.1.0"}],"published":"2025-07-02T16:23:15Z","updated":"2025-07-03T04:25:02Z"},{"id":"wordfence:ee6f936b-704a-486f-836b-9a1892271bfa","source":"wordfence","cve":"CVE-2024-43943","title":"Woocommerce Addon by Greenshift< 1.9.8 - Authenticated (Subscriber+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6f936b-704a-486f-836b-9a1892271bfa?source=api-prod","affected":[{"type":"plugin","slug":"greenshiftwoo","name":"Woocommerce Addon Greenshift","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":false,"patched_in":"1.9.8"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:32:43Z"},{"id":"wordfence:ee6ffb62-0dfd-40c1-8fde-8705d99d4144","source":"wordfence","cve":"CVE-2026-25419","title":"UpsellWP <= 2.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6ffb62-0dfd-40c1-8fde-8705d99d4144?source=api-prod","affected":[{"type":"plugin","slug":"checkout-upsell-and-order-bumps","name":"UpsellWP \u2013 Upsell and Related Products Offers for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2026-01-28T00:00:00Z","updated":"2026-06-01T20:20:55Z"},{"id":"wordfence:ee702ee5-d1de-4b25-8c2d-f47cc4ad076b","source":"wordfence","cve":"CVE-2012-10001","title":"Limit Login Attempts <= 1.7.0 - Brute Force Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee702ee5-d1de-4b25-8c2d-f47cc4ad076b?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts","name":"Limit Login Attempts","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2012-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee725cff-959d-4078-9c2e-2d52bb904ca0","source":"wordfence","cve":"CVE-2023-6541","title":"Allow SVG <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee725cff-959d-4078-9c2e-2d52bb904ca0?source=api-prod","affected":[{"type":"plugin","slug":"allow-svg","name":"Allow SVG","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2024-01-26T00:00:00Z","updated":"2024-01-29T13:16:11Z"},{"id":"wordfence:ee73937c-8a97-4afd-a0f6-d5e9caddc82c","source":"wordfence","cve":"CVE-2025-58860","title":"Enable Latex <= 1.2.16 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73937c-8a97-4afd-a0f6-d5e9caddc82c?source=api-prod","affected":[{"type":"plugin","slug":"enable-latex","name":"Enable Latex","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:11:07Z"},{"id":"wordfence:ee73bfb0-843c-4b4a-b513-3980c1cefac1","source":"wordfence","cve":"CVE-2026-124218","title":"Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter","severity":"high","cvss":8.2,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-file-upload-for-elementor-forms","name":"Drag and Drop File Upload for Elementor Forms","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-11-12T21:09:58Z","updated":"2026-11-13T09:35:17Z"},{"id":"wordfence:ee7408d2-3cff-4c80-bc07-b0418676e961","source":"wordfence","cve":"CVE-2024-30461","title":"Tumult Hype Animations <= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7408d2-3cff-4c80-bc07-b0418676e961?source=api-prod","affected":[{"type":"plugin","slug":"tumult-hype-animations","name":"Tumult Hype Animations","from":"*","from_inclusive":true,"to":"1.9.11","to_inclusive":true,"patched_in":"1.9.12"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:05:35Z"},{"id":"wordfence:ee74d229-499e-4f9a-ad7d-c707f6eeac6e","source":"wordfence","cve":"","title":"Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee74d229-499e-4f9a-ad7d-c707f6eeac6e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"2.9.21","to_inclusive":true,"patched_in":"2.9.22"}],"published":"2015-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee7513d9-e76c-4da4-919b-ba376f0c4022","source":"wordfence","cve":"CVE-2023-0892","title":"BizLibrary <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7513d9-e76c-4da4-919b-ba376f0c4022?source=api-prod","affected":[{"type":"plugin","slug":"bizlibrary","name":"BizLibrary","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee7555a1-18dc-4b00-81f6-b26706cfb573","source":"wordfence","cve":"CVE-2026-9713","title":"Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7555a1-18dc-4b00-81f6-b26706cfb573?source=api-prod","affected":[{"type":"plugin","slug":"lumise","name":"Product Designer for WooCommerce WordPress | Lumise","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-07-22T17:38:12Z","updated":"2026-07-23T06:52:35Z"},{"id":"wordfence:ee755e25-5f70-4688-b08d-4a3f127d91d4","source":"wordfence","cve":"CVE-2026-16747","title":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee755e25-5f70-4688-b08d-4a3f127d91d4?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:11:12Z"},{"id":"wordfence:ee78642c-ad2a-4012-94e8-e01f71863791","source":"wordfence","cve":"CVE-2022-40205","title":"wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee78642c-ad2a-4012-94e8-e01f71863791?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2022-09-26T09:03:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee791235-1ca5-498a-b8e0-69a7f12b0e12","source":"wordfence","cve":"CVE-2026-90966","title":"Essential Real Estate <= 5.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee791235-1ca5-498a-b8e0-69a7f12b0e12?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:33:21Z"},{"id":"wordfence:ee792903-3b55-4f1d-bba1-59ea3f1826a1","source":"wordfence","cve":"CVE-2024-8679","title":"Library Management System <= 3.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee792903-3b55-4f1d-bba1-59ea3f1826a1?source=api-prod","affected":[{"type":"plugin","slug":"library-management-system","name":"Library Management System","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-12-06T00:00:00Z","updated":"2025-10-23T20:17:03Z"},{"id":"wordfence:ee7c679e-392c-40cd-b768-d78fae6065bb","source":"wordfence","cve":"CVE-2025-5928","title":"WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7c679e-392c-40cd-b768-d78fae6065bb?source=api-prod","affected":[{"type":"plugin","slug":"wp-sliding-logindashboard-panel","name":"WP Sliding Login/Dashboard Panel","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-12T13:07:56Z","updated":"2025-06-13T01:47:51Z"},{"id":"wordfence:ee7e8d76-a461-4b0b-a312-c6ea4b8ac375","source":"wordfence","cve":"CVE-2024-13592","title":"Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7e8d76-a461-4b0b-a312-c6ea4b8ac375?source=api-prod","affected":[{"type":"plugin","slug":"team-builder-for-wpbakery-page-builder","name":"Team Builder For WPBakery Page Builder(Formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:31:18Z","updated":"2025-02-19T07:32:15Z"},{"id":"wordfence:ee7eb754-27f0-47b0-a82f-4781cfbb0fa6","source":"wordfence","cve":"CVE-2022-47426","title":"Neshan Maps <= 1.1.4 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7eb754-27f0-47b0-a82f-4781cfbb0fa6?source=api-prod","affected":[{"type":"plugin","slug":"neshan-maps","name":"Neshan Maps","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee8167f0-bb92-4844-be8c-4cc886c946f9","source":"wordfence","cve":"CVE-2024-49660","title":"Campus Explorer Widget <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8167f0-bb92-4844-be8c-4cc886c946f9?source=api-prod","affected":[{"type":"plugin","slug":"campus-explorer-widget","name":"Campus Explorer Widget","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:47:35Z"},{"id":"wordfence:ee8436c2-3dda-481c-92b3-cc2ba8fc1993","source":"wordfence","cve":"CVE-2024-35777","title":"WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection","severity":"low","cvss":2.7,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8436c2-3dda-481c-92b3-cc2ba8fc1993?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.9.2","to_inclusive":true,"patched_in":"9.0.0"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-02T13:36:15Z"},{"id":"wordfence:ee84c720-7997-4c09-a2f9-5e1a28bd1100","source":"wordfence","cve":"CVE-2025-14555","title":"Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee84c720-7997-4c09-a2f9-5e1a28bd1100?source=api-prod","affected":[{"type":"plugin","slug":"widget-countdown","name":"Countdown Timer \u2013 Widget Countdown","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T12:23:17Z"},{"id":"wordfence:ee862f44-903d-4b1c-9a5c-98e63379d5cb","source":"wordfence","cve":"","title":"WP Menu Cart <= 2.11.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee862f44-903d-4b1c-9a5c-98e63379d5cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-menu-cart","name":"WP Menu Cart","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.12.0"}],"published":"2022-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee8731e6-92e9-4cc6-8e1c-0c7727420af7","source":"wordfence","cve":"CVE-2025-1382","title":"Contact Us By Lord Linus <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8731e6-92e9-4cc6-8e1c-0c7727420af7?source=api-prod","affected":[{"type":"plugin","slug":"contact-us-by-lord-linus","name":"Contact Us By Lord Linus","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-17T00:00:00Z","updated":"2025-03-10T15:55:28Z"},{"id":"wordfence:ee88099f-6f35-461c-b485-f7ffd77ec6c4","source":"wordfence","cve":"CVE-2025-46525","title":"WP Cookie Consent <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee88099f-6f35-461c-b485-f7ffd77ec6c4?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookie-consent","name":"WP Cookie Consent","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:44:49Z"},{"id":"wordfence:ee8ad691-b598-4eeb-b8a7-645c3bd968ff","source":"wordfence","cve":"","title":"WP Business intelligence lite < 1.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8ad691-b598-4eeb-b8a7-645c3bd968ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-business-intelligence-lite","name":"WP Business Intelligence Lite","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2014-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee8e0751-2a9c-4822-b415-a8c6bb433ff6","source":"wordfence","cve":"CVE-2024-51804","title":"Moka Get Posts Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8e0751-2a9c-4822-b415-a8c6bb433ff6?source=api-prod","affected":[{"type":"plugin","slug":"moka-get-posts","name":"Moka Get Posts Shortcode","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:44:11Z"},{"id":"wordfence:ee8e5848-8aa8-489a-9563-aefc0aa62dec","source":"wordfence","cve":"CVE-2026-78172","title":"Themify \u2013 WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8e5848-8aa8-489a-9563-aefc0aa62dec?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-09-10T14:47:16Z","updated":"2026-09-11T03:39:40Z"},{"id":"wordfence:ee8f274b-fe25-4111-94a4-e67dd17dc24b","source":"wordfence","cve":"CVE-2014-6230","title":"WP-Ban < 1.64 - Improper Input Validation","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8f274b-fe25-4111-94a4-e67dd17dc24b?source=api-prod","affected":[{"type":"plugin","slug":"wp-ban","name":"WP-Ban","from":"*","from_inclusive":true,"to":"1.64","to_inclusive":false,"patched_in":"1.64"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee8f3567-b732-4e5e-a1a4-ad3c8b2b5fdc","source":"wordfence","cve":"CVE-2026-66622","title":"Depicter \u2014 Popup & Slider Builder <= 4.8.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee8f3567-b732-4e5e-a1a4-ad3c8b2b5fdc?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"*","from_inclusive":true,"to":"4.8.0","to_inclusive":true,"patched_in":"4.8.1"}],"published":"2026-08-18T00:00:00Z","updated":"2026-09-09T16:11:20Z"},{"id":"wordfence:ee912e24-7ed5-459c-a8ce-2bcb265bdeb0","source":"wordfence","cve":"CVE-2026-102007","title":"Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee912e24-7ed5-459c-a8ce-2bcb265bdeb0?source=api-prod","affected":[{"type":"plugin","slug":"bit-integrations","name":"Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":"2.10.7"}],"published":"2026-10-12T19:07:13Z","updated":"2026-10-13T07:46:23Z"},{"id":"wordfence:ee9261c0-927a-4d0b-97e1-b7861e1e0b31","source":"wordfence","cve":"CVE-2024-47344","title":"uListing <= 2.1.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee9261c0-927a-4d0b-97e1-b7861e1e0b31?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:26:41Z"},{"id":"wordfence:ee95092d-6351-4612-872d-284165bc1201","source":"wordfence","cve":"CVE-2026-15013","title":"SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion","severity":"critical","cvss":9.8,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351-4612-872d-284165bc1201?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-saml-20-single-sign-on","name":"SAML Single Sign On \u2013 SSO Login","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.4"}],"published":"2026-07-15T00:00:00Z","updated":"2026-07-16T03:44:32Z"},{"id":"wordfence:ee95976d-6454-466b-96b3-7c33ccc03d41","source":"wordfence","cve":"CVE-2022-1646","title":"Simple Real Estate Pack <= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee95976d-6454-466b-96b3-7c33ccc03d41?source=api-prod","affected":[{"type":"plugin","slug":"simple-real-estate-pack-4","name":"Simple Real Estate Pack","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ee96d8c5-baf0-4c5c-9ace-e88bbb95ee0a","source":"wordfence","cve":"CVE-2026-5159","title":"Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee96d8c5-baf0-4c5c-9ace-e88bbb95ee0a?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1056","to_inclusive":true,"patched_in":"1.7.1057"}],"published":"2026-05-04T14:53:29Z","updated":"2026-05-05T03:37:39Z"},{"id":"wordfence:ee992216-53dd-441e-9c8f-55fbe7567cb7","source":"wordfence","cve":"CVE-2024-53747","title":"Video Player for WPBakery <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee992216-53dd-441e-9c8f-55fbe7567cb7?source=api-prod","affected":[{"type":"plugin","slug":"video-player-for-wpbakery","name":"Video Player for WPBakery","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-11-28T00:00:00Z","updated":"2025-06-18T16:32:11Z"},{"id":"wordfence:ee9a5595-9265-4e9a-b86c-559ecbd6cad1","source":"wordfence","cve":"CVE-2026-81649","title":"Fundiin <= 3.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee9a5595-9265-4e9a-b86c-559ecbd6cad1?source=api-prod","affected":[{"type":"plugin","slug":"fundiin","name":"Fundiin cho WooCommerce","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:09:18Z"},{"id":"wordfence:eea054fd-c42c-41da-956a-cc31cfe320ca","source":"wordfence","cve":"CVE-2025-26960","title":"Small Package Quotes \u2013 Unishippers Edition <= 2.4.9 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea054fd-c42c-41da-956a-cc31cfe320ca?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-unishippers-edition","name":"Small Package Quotes \u2013 Unishippers Edition","from":"*","from_inclusive":true,"to":"2.4.9","to_inclusive":true,"patched_in":"2.4.10"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T18:19:29Z"},{"id":"wordfence:eea05676-aa24-4f60-9a8c-716b8a051be6","source":"wordfence","cve":"CVE-2026-65466","title":"JetBooking <= 4.1.2 - Authenticated (Custom+) Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea05676-aa24-4f60-9a8c-716b8a051be6?source=api-prod","affected":[{"type":"plugin","slug":"jet-booking","name":"JetBooking","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.2.1"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-29T13:11:19Z"},{"id":"wordfence:eea33d0b-2547-4c51-8c4c-d178d6c8502d","source":"wordfence","cve":"CVE-2026-11992","title":"Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea33d0b-2547-4c51-8c4c-d178d6c8502d?source=api-prod","affected":[{"type":"plugin","slug":"easy-appointments","name":"Easy Appointments","from":"*","from_inclusive":true,"to":"3.12.27","to_inclusive":true,"patched_in":"3.12.28"}],"published":"2026-07-09T19:10:48Z","updated":"2026-07-10T07:48:45Z"},{"id":"wordfence:eea754db-495a-4518-840e-0eeeeb1c31b9","source":"wordfence","cve":"CVE-2021-24176","title":"JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea754db-495a-4518-840e-0eeeeb1c31b9?source=api-prod","affected":[{"type":"plugin","slug":"jh-404-logger","name":"JH 404 Logger","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2021-03-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eea79152-76ef-4331-8999-e13f92cd08f4","source":"wordfence","cve":"CVE-2026-15301","title":"BuddyHolis TableSearch <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea79152-76ef-4331-8999-e13f92cd08f4?source=api-prod","affected":[{"type":"plugin","slug":"tablesearch","name":"BuddyHolis TableSearch","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-27T20:10:29Z","updated":"2026-07-10T04:31:28Z"},{"id":"wordfence:eea7ddc4-b3fb-4bad-9acc-9d913ecb8e1b","source":"wordfence","cve":"CVE-2026-14335","title":"Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea7ddc4-b3fb-4bad-9acc-9d913ecb8e1b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.6.9","to_inclusive":true,"patched_in":"3.6.9.1"}],"published":"2026-10-09T16:46:10Z","updated":"2026-10-10T05:31:07Z"},{"id":"wordfence:eea99e1e-63c9-4021-80a0-1ed732b58ca9","source":"wordfence","cve":"","title":"Wp-ImageZoom < 1.0.5 - Directory Traversal","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eea99e1e-63c9-4021-80a0-1ed732b58ca9?source=api-prod","affected":[{"type":"plugin","slug":"wp-imagezoom","name":"Wp-ImageZoom","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":false,"patched_in":"1.0.5"}],"published":"2012-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eeabdaae-dc77-4909-9b96-b480ccaa58fb","source":"wordfence","cve":"CVE-2024-2762","title":"FooGallery (Free and Premium) < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeabdaae-dc77-4909-9b96-b480ccaa58fb?source=api-prod","affected":[{"type":"plugin","slug":"foogallery-premium","name":"FooGallery Premium","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":false,"patched_in":"2.4.15"},{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.15","to_inclusive":false,"patched_in":"2.4.15"}],"published":"2024-05-23T00:00:00Z","updated":"2024-06-05T17:45:31Z"},{"id":"wordfence:eeac5489-7eba-43b6-b7fb-1ce062285948","source":"wordfence","cve":"CVE-2024-53733","title":"Fence URL <= 2.0.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeac5489-7eba-43b6-b7fb-1ce062285948?source=api-prod","affected":[{"type":"plugin","slug":"fence-url","name":"Fence URL wp-login.php","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:19:27Z"},{"id":"wordfence:eeacc903-9be2-4333-9528-d98707d1df55","source":"wordfence","cve":"CVE-2025-9266","title":"Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeacc903-9be2-4333-9528-d98707d1df55?source=api-prod","affected":[{"type":"theme","slug":"accelerate","name":"Accelerate","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2026-08-05T22:18:51Z","updated":"2026-08-06T11:29:21Z"},{"id":"wordfence:eead3429-f913-4047-bb56-32b2a12f2f12","source":"wordfence","cve":"CVE-2025-69067","title":"Tails <= 1.4.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eead3429-f913-4047-bb56-32b2a12f2f12?source=api-prod","affected":[{"type":"theme","slug":"tails","name":"Tails | Veterinary Clinic, Pet Care & Animal WordPress Theme + Shop","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:33:00Z"},{"id":"wordfence:eead8dd1-57e5-4a1d-b555-c1efd2087757","source":"wordfence","cve":"CVE-2025-58890","title":"Playful <= 1.19.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eead8dd1-57e5-4a1d-b555-c1efd2087757?source=api-prod","affected":[{"type":"theme","slug":"playful","name":"Playful - Pole Dance Night Club & Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.19.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-12-19T16:30:09Z"},{"id":"wordfence:eeae2042-ccad-4e4b-a321-8ea58af9d775","source":"wordfence","cve":"","title":"WooCommerce \u2013 Store Exporter <= 1.7.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeae2042-ccad-4e4b-a321-8ea58af9d775?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-exporter","name":"Store Exporter \u2013 Export WooCommerce Products, Orders, Subscriptions, Customers","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2014-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eeae55b1-6c96-4375-bbf0-341005078931","source":"wordfence","cve":"CVE-2026-85302","title":"WPKoi Templates for Elementor <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeae55b1-6c96-4375-bbf0-341005078931?source=api-prod","affected":[{"type":"plugin","slug":"wpkoi-templates-for-elementor","name":"WPKoi Templates for Elementor","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:26:29Z"},{"id":"wordfence:eeae71a6-53b2-4eab-82c0-d23cff3f0f7c","source":"wordfence","cve":"CVE-2021-24569","title":"Cookie Notice & Compliance for GDPR / CCPA <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeae71a6-53b2-4eab-82c0-d23cff3f0f7c?source=api-prod","affected":[{"type":"plugin","slug":"cookie-notice","name":"Cookie Compliance for WordPress \u2013 Cookie Consent, GDPR & CCPA","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":false,"patched_in":"2.1.2"}],"published":"2021-08-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eeaf3b23-a769-4625-8c83-a9229ce1c2c9","source":"wordfence","cve":"CVE-2025-68988","title":"E-Invoice App Malaysia <= 1.3.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeaf3b23-a769-4625-8c83-a9229ce1c2c9?source=api-prod","affected":[{"type":"plugin","slug":"einvoiceapp-malaysia","name":"EInvoice App Malaysia","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-21T00:00:00Z","updated":"2026-01-06T15:20:32Z"},{"id":"wordfence:eeb0353e-2086-4255-bb28-6bb20ab327b1","source":"wordfence","cve":"CVE-2026-52695","title":"ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb0353e-2086-4255-bb28-6bb20ab327b1?source=api-prod","affected":[{"type":"plugin","slug":"payerurl-crypto-currency-payment-gateway-for-woocommerce","name":"ABC Crypto Checkout","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2026-06-10T00:00:00Z","updated":"2026-06-18T13:22:16Z"},{"id":"wordfence:eeb2c829-579f-41e2-ad5f-8e4fc125d980","source":"wordfence","cve":"CVE-2024-10626","title":"WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb2c829-579f-41e2-ad5f-8e4fc125d980?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-support-ticket-system","name":"WooCommerce Support Ticket System","from":"*","from_inclusive":true,"to":"17.7","to_inclusive":true,"patched_in":"17.8"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-09T03:18:15Z"},{"id":"wordfence:eeb4b3b1-47ae-4314-a386-832949456f81","source":"wordfence","cve":"CVE-2025-13496","title":"Moosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb4b3b1-47ae-4314-a386-832949456f81?source=api-prod","affected":[{"type":"plugin","slug":"moosend-landing-pages","name":"Moosend Landing Pages","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:38:46Z","updated":"2026-01-07T08:21:55Z"},{"id":"wordfence:eeb71c31-9e56-4b58-9cfc-a97f6892cc2b","source":"wordfence","cve":"CVE-2025-3055","title":"WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb71c31-9e56-4b58-9cfc-a97f6892cc2b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend-pro","name":"WP User Frontend Pro","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2025-06-04T16:33:56Z","updated":"2025-06-05T05:23:02Z"},{"id":"wordfence:eeb9aca3-9a55-433b-a94e-66af2aa30bd2","source":"wordfence","cve":"CVE-2026-17017","title":"CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeb9aca3-9a55-433b-a94e-66af2aa30bd2?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.30","to_inclusive":true,"patched_in":"1.1.31"}],"published":"2026-08-04T00:00:00Z","updated":"2026-09-18T15:16:05Z"},{"id":"wordfence:eebac297-9652-4640-935e-4984280ea5fa","source":"wordfence","cve":"CVE-2026-27440","title":"myCred \u2013 Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eebac297-9652-4640-935e-4984280ea5fa?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.9.7.6","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-11-08T00:00:00Z","updated":"2026-04-14T14:30:37Z"},{"id":"wordfence:eebc0318-8db3-44b4-ac04-d246db3a10ed","source":"wordfence","cve":"CVE-2022-29443","title":"Hotel Booking < 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eebc0318-8db3-44b4-ac04-d246db3a10ed?source=api-prod","affected":[{"type":"plugin","slug":"nd-booking","name":"Hotel Booking","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":false,"patched_in":"3.3"}],"published":"2022-05-26T12:29:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eebe1bf7-0366-4226-bcbc-027186136008","source":"wordfence","cve":"CVE-2022-47449","title":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.5 - Reflected Cross-Site Scripting via cart_search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eebe1bf7-0366-4226-bcbc-027186136008?source=api-prod","affected":[{"type":"plugin","slug":"cart-lift","name":"Cart Lift \u2013 Abandoned Cart Recovery for WooCommerce and EDD","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eebe37bf-2983-47c0-afd8-0aa3e7982196","source":"wordfence","cve":"CVE-2023-23707","title":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG files","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eebe37bf-2983-47c0-afd8-0aa3e7982196?source=api-prod","affected":[{"type":"plugin","slug":"embed-any-document","name":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eebfa8de-8a20-4fac-b43a-f7ae674d9184","source":"wordfence","cve":"","title":"WP-Filebase <= 0.2.9.24 - Missing Authorization Checks","severity":"high","cvss":7.3,"cwe":"","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eebfa8de-8a20-4fac-b43a-f7ae674d9184?source=api-prod","affected":[{"type":"plugin","slug":"wp-filebase","name":"WP-Filebase","from":"*","from_inclusive":true,"to":"0.2.9.24","to_inclusive":true,"patched_in":"0.2.9.25"}],"published":"2012-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eec21717-dffa-40c0-90c0-007b568609cc","source":"wordfence","cve":"","title":"SEO <= 4.0.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec21717-dffa-40c0-90c0-007b568609cc?source=api-prod","affected":[{"type":"plugin","slug":"seo-wizard","name":"SEO","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eec21a44-d65c-4090-8b60-32d333c54140","source":"wordfence","cve":"CVE-2025-66080","title":"Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec21a44-d65c-4090-8b60-32d333c54140?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-cookie-consent","name":"WPLP Cookie Consent \u2013 Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-05T20:31:54Z"},{"id":"wordfence:eec34b6a-aae7-4267-accd-96ebc6b71dd3","source":"wordfence","cve":"","title":"SEO Watcher <= 1.3.3 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec34b6a-aae7-4267-accd-96ebc6b71dd3?source=api-prod","affected":[{"type":"plugin","slug":"seo-watcher","name":"seo-watcher","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2013-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eec46e0b-806a-4c34-adb8-a2bdb08a7a93","source":"wordfence","cve":"CVE-2025-54001","title":"Classter <= 2.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec46e0b-806a-4c34-adb8-a2bdb08a7a93?source=api-prod","affected":[{"type":"theme","slug":"classter","name":"Classter | Multi-Purpose HTML Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:11:04Z"},{"id":"wordfence:eec9ae40-3a76-4208-8348-4a9ef72fc918","source":"wordfence","cve":"CVE-2025-3701","title":"Malcure Malware Scanner <= 16.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec9ae40-3a76-4208-8348-4a9ef72fc918?source=api-prod","affected":[{"type":"plugin","slug":"wp-malware-removal","name":"Malcure Malware Shield \u2014 Removal, Repair, Monitor","from":"*","from_inclusive":true,"to":"16.8","to_inclusive":true,"patched_in":"16.9"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T21:40:11Z"},{"id":"wordfence:eec9afef-2d71-4aa6-9b51-5be1ba51b8a5","source":"wordfence","cve":"CVE-2025-22505","title":"NC Wishlist for Woocommerce <= 1.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec9afef-2d71-4aa6-9b51-5be1ba51b8a5?source=api-prod","affected":[{"type":"plugin","slug":"nc-wishlist-for-woocommerce","name":"NC Wishlist for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:54:43Z"},{"id":"wordfence:eec9bbc0-5a68-4624-a672-bd6227d6fa45","source":"wordfence","cve":"CVE-2025-14388","title":"PhastPress <= 3.7 - Unauthenticated Arbitrary File Read via Null Byte Injection","severity":"critical","cvss":9.8,"cwe":"CWE-158","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eec9bbc0-5a68-4624-a672-bd6227d6fa45?source=api-prod","affected":[{"type":"plugin","slug":"phastpress","name":"PhastPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2025-12-22T00:00:00Z","updated":"2025-12-23T09:20:05Z"},{"id":"wordfence:eeca3208-2cab-4c03-935f-8f657d7ca87f","source":"wordfence","cve":"CVE-2024-54240","title":"Blaze Online eParcel for WooCommerce <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeca3208-2cab-4c03-935f-8f657d7ca87f?source=api-prod","affected":[{"type":"plugin","slug":"blaze-online-eparcel-for-woocommerce","name":"Blaze Online eParcel for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-18T16:01:28Z"},{"id":"wordfence:eecd1497-c94e-4f67-8cc5-72afffe9fae2","source":"wordfence","cve":"CVE-2022-47445","title":"Be POPIA Compliant <= 1.2.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eecd1497-c94e-4f67-8cc5-72afffe9fae2?source=api-prod","affected":[{"type":"plugin","slug":"be-popia-compliant","name":"Be POPIA Compliant","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2023-03-15T00:00:00Z","updated":"2025-01-31T20:30:51Z"},{"id":"wordfence:eed5b1ea-213c-4a37-b357-8d058af86d38","source":"wordfence","cve":"CVE-2025-7809","title":"StreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eed5b1ea-213c-4a37-b357-8d058af86d38?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-twitch-integration","name":"StreamWeasels Twitch Integration","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-07-28T00:00:00Z","updated":"2025-07-29T03:41:22Z"},{"id":"wordfence:eed6306a-317b-40ed-b7f5-7f930b3509e0","source":"wordfence","cve":"CVE-2022-0600","title":"Conference Scheduler <= 2.4.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eed6306a-317b-40ed-b7f5-7f930b3509e0?source=api-prod","affected":[{"type":"plugin","slug":"conference-scheduler","name":"Conference Scheduler","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2022-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eed667d2-e53e-47b9-8012-2b9b46022f3a","source":"wordfence","cve":"CVE-2024-3267","title":"Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eed667d2-e53e-47b9-8012-2b9b46022f3a?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"4.8.8","to_inclusive":true,"patched_in":"4.8.9"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-09T18:59:32Z"},{"id":"wordfence:eedad1b3-a69d-4972-ad5b-031948ec5eca","source":"wordfence","cve":"CVE-2026-84937","title":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch < 2.1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eedad1b3-a69d-4972-ad5b-031948ec5eca?source=api-prod","affected":[{"type":"plugin","slug":"yt-player","name":"Video Player for YouTube \u2013 Embed Videos Your Visitors Will Love to Watch","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:18:12Z"},{"id":"wordfence:eedada2a-5543-46b1-a3d2-5e5b86a05ff9","source":"wordfence","cve":"","title":"Careerfy - Job Board WordPress Theme <= 3.9.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eedada2a-5543-46b1-a3d2-5e5b86a05ff9?source=api-prod","affected":[{"type":"theme","slug":"careerfy","name":"Careerfy - Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2020-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eedbb054-5ae0-4e7c-880e-fdc1559032e3","source":"wordfence","cve":"CVE-2026-27076","title":"LuxeDrive <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eedbb054-5ae0-4e7c-880e-fdc1559032e3?source=api-prod","affected":[{"type":"theme","slug":"luxedrive","name":"LuxeDrive - Limousine and Car Rental WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-03-10T00:00:00Z","updated":"2026-04-15T13:41:43Z"},{"id":"wordfence:eedced7b-bda4-4292-8e87-fc3e37e4868b","source":"wordfence","cve":"","title":"GamiPress \u2013 Button <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eedced7b-bda4-4292-8e87-fc3e37e4868b?source=api-prod","affected":[{"type":"plugin","slug":"gamipress-button","name":"GamiPress \u2013 Button","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2023-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eede8a1e-db33-4c07-9991-9def75dddc87","source":"wordfence","cve":"CVE-2026-16302","title":"Spectra Legacy \u2013 Gutenberg Blocks  <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":"2.20.1"}],"published":"2026-09-23T21:29:18Z","updated":"2026-09-24T11:31:09Z"},{"id":"wordfence:eee04b1d-188a-4b92-a6f3-dfa843ca20d7","source":"wordfence","cve":"CVE-2024-4373","title":"Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee04b1d-188a-4b92-a6f3-dfa843ca20d7?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2024-05-14T13:32:23Z","updated":"2024-06-13T14:06:46Z"},{"id":"wordfence:eee25825-2308-4234-b72b-6cb11b658a6e","source":"wordfence","cve":"CVE-2026-75905","title":"WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee25825-2308-4234-b72b-6cb11b658a6e?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"10.8.0","to_inclusive":true,"patched_in":"10.8.1"}],"published":"2026-09-08T16:48:49Z","updated":"2026-09-09T05:31:05Z"},{"id":"wordfence:eee27f2c-bc21-4b0f-9de5-da1035c54857","source":"wordfence","cve":"CVE-2023-5354","title":"Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee27f2c-bc21-4b0f-9de5-da1035c54857?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eee2d5e8-a027-486b-93d8-9fe1501f9ed2","source":"wordfence","cve":"CVE-2025-24628","title":"reCaptcha by BestWebSoft <= 1.78 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee2d5e8-a027-486b-93d8-9fe1501f9ed2?source=api-prod","affected":[{"type":"plugin","slug":"google-captcha","name":"reCaptcha by BestWebSoft","from":"*","from_inclusive":true,"to":"1.78","to_inclusive":true,"patched_in":"1.79"}],"published":"2025-01-03T00:00:00Z","updated":"2025-02-20T15:55:28Z"},{"id":"wordfence:eee517de-a47e-47c9-8322-92ce772191b0","source":"wordfence","cve":"CVE-2024-2000","title":"Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee517de-a47e-47c9-8322-92ce772191b0?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.12","to_inclusive":true,"patched_in":"2.9.13"}],"published":"2024-03-07T00:00:00Z","updated":"2024-03-13T15:32:40Z"},{"id":"wordfence:eee60ee9-ec48-4c09-9905-edd2dbbcccf3","source":"wordfence","cve":"CVE-2022-1006","title":"Advanced Booking Calendar <= 1.7.0 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee60ee9-ec48-4c09-9905-edd2dbbcccf3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-booking-calendar","name":"Advanced Booking Calendar","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2022-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eee7344d-5459-4558-a557-d8c5935ecc30","source":"wordfence","cve":"CVE-2024-1093","title":"Change Memory Limit <= 1.0 - Missing Authorization via admin_logic()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee7344d-5459-4558-a557-d8c5935ecc30?source=api-prod","affected":[{"type":"plugin","slug":"change-memory-limit","name":"Change Memory Limit","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-03-04T00:00:00Z","updated":"2024-03-05T01:56:04Z"},{"id":"wordfence:eee7cad6-7910-4860-add9-c500d1f6eff3","source":"wordfence","cve":"CVE-2024-39649","title":"Essential Addons for Elementor <= 5.9.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee7cad6-7910-4860-add9-c500d1f6eff3?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.26","to_inclusive":true,"patched_in":"5.9.27"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-07T16:41:30Z"},{"id":"wordfence:eee849d5-7698-41c5-b90d-47cc67551afd","source":"wordfence","cve":"CVE-2024-50554","title":"Sided <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee849d5-7698-41c5-b90d-47cc67551afd?source=api-prod","affected":[{"type":"plugin","slug":"sided","name":"Sided","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2024-10-31T00:00:00Z","updated":"2025-10-08T20:50:57Z"},{"id":"wordfence:eee87b71-713e-4e97-90a4-4ed71d264053","source":"wordfence","cve":"CVE-2026-27408","title":"NativeChurch <= 4.8.8.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee87b71-713e-4e97-90a4-4ed71d264053?source=api-prod","affected":[{"type":"theme","slug":"NativeChurch","name":"NativeChurch","from":"*","from_inclusive":true,"to":"4.8.8.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-07T19:48:53Z"},{"id":"wordfence:eee88bc6-b7e3-4eff-afc7-59b9a1cc9d2c","source":"wordfence","cve":"CVE-2017-18510","title":"Custom Sidebars <= 3.0.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee88bc6-b7e3-4eff-afc7-59b9a1cc9d2c?source=api-prod","affected":[{"type":"plugin","slug":"custom-sidebars","name":"Custom Sidebars \u2013 Dynamic Sidebar Classic Widget Area Manager","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2017-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eee91d95-afdb-45e3-b639-50eb3c46115d","source":"wordfence","cve":"CVE-2015-1366","title":"Pixabay Images <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee91d95-afdb-45e3-b639-50eb3c46115d?source=api-prod","affected":[{"type":"plugin","slug":"pixabay-images","name":"Pixabay Images","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2015-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eee9d564-5d52-47fa-a6a5-b908bb64a2ba","source":"wordfence","cve":"","title":"Clockstone <= 1.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee9d564-5d52-47fa-a6a5-b908bb64a2ba?source=api-prod","affected":[{"type":"theme","slug":"clockstone","name":"Clockstone","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2012-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eee9e199-00c6-4640-bd7c-e1316e2bba51","source":"wordfence","cve":"CVE-2021-25068","title":"Sync WooCommerce Product feed to Google Shopping <= 1.2.4  - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eee9e199-00c6-4640-bd7c-e1316e2bba51?source=api-prod","affected":[{"type":"plugin","slug":"exportfeed-for-woocommerce-google-product-feed","name":"Sync WooCommerce Product feed to Google Shopping","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eeea5b13-54e8-4482-bdbc-6922cf96b4e1","source":"wordfence","cve":"CVE-2026-84775","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service","severity":"high","cvss":7.5,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeea5b13-54e8-4482-bdbc-6922cf96b4e1?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.0","to_inclusive":true,"patched_in":"9.8.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:20:42Z"},{"id":"wordfence:eeeb03f7-5f78-4462-b0b4-5080bbc419a3","source":"wordfence","cve":"CVE-2020-36841","title":"WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeeb03f7-5f78-4462-b0b4-5080bbc419a3?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-smart-coupons","name":"WooCommerce Smart Coupons","from":"*","from_inclusive":true,"to":"4.6.5","to_inclusive":false,"patched_in":"4.6.5"}],"published":"2020-03-04T00:00:00Z","updated":"2024-10-16T12:45:52Z"},{"id":"wordfence:eeef2a59-47a1-4d8d-b815-8c74cc608e6c","source":"wordfence","cve":"CVE-2023-49159","title":"CommentLuv <= 3.0.4 - Server Side Request Forgery via do_click","severity":"high","cvss":8.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eeef2a59-47a1-4d8d-b815-8c74cc608e6c?source=api-prod","affected":[{"type":"plugin","slug":"commentluv","name":"CommentLuv","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eef040b0-445e-4717-905b-a8697c783483","source":"wordfence","cve":"CVE-2025-68905","title":"JNews - Pay Writer <= 11.0.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef040b0-445e-4717-905b-a8697c783483?source=api-prod","affected":[{"type":"plugin","slug":"jnews-pay-writer","name":"JNews - Pay Writer","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-20T16:27:00Z"},{"id":"wordfence:eef0796f-f56d-4be3-8fbd-010ac0fb3448","source":"wordfence","cve":"CVE-2026-7105","title":"Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef0796f-f56d-4be3-8fbd-010ac0fb3448?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-08-04T18:35:16Z","updated":"2026-08-05T06:38:02Z"},{"id":"wordfence:eef3f041-8cb8-444d-b54e-287ca5f7c594","source":"wordfence","cve":"CVE-2026-16953","title":"AI Engine <= 3.6.3 - Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef3f041-8cb8-444d-b54e-287ca5f7c594?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:43:49Z"},{"id":"wordfence:eef60624-d90c-4e98-9151-3f6eb9cfe0c0","source":"wordfence","cve":"CVE-2024-37205","title":"affiliate-toolkit <= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs","severity":"medium","cvss":5.3,"cwe":"CWE-532","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef60624-d90c-4e98-9151-3f6eb9cfe0c0?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.4.4","to_inclusive":true,"patched_in":"3.4.5"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T20:40:11Z"},{"id":"wordfence:eef7f964-8330-4c57-a5f4-0280853dcf76","source":"wordfence","cve":"CVE-2024-37941","title":"Internal Link Juicer: SEO Auto Linker for WordPress <= 2.24.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef7f964-8330-4c57-a5f4-0280853dcf76?source=api-prod","affected":[{"type":"plugin","slug":"internal-links","name":"Internal Link Juicer: SEO Auto Linker for WordPress","from":"*","from_inclusive":true,"to":"2.24.3","to_inclusive":true,"patched_in":"2.24.4"}],"published":"2024-07-09T00:00:00Z","updated":"2024-07-15T18:45:58Z"},{"id":"wordfence:eef9e2fa-d8f0-42bf-95ac-ee4cafff0b14","source":"wordfence","cve":"CVE-2024-5084","title":"Hash Form \u2013 Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eef9e2fa-d8f0-42bf-95ac-ee4cafff0b14?source=api-prod","affected":[{"type":"plugin","slug":"hash-form","name":"Hash Form \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T14:31:38Z"},{"id":"wordfence:eefcc290-b7f7-4cf0-9ccc-db4c883d6426","source":"wordfence","cve":"CVE-2025-11691","title":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eefcc290-b7f7-4cf0-9ccc-db4c883d6426?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-addon","name":"PPOM \u2013 Product Addons & Custom Fields for WooCommerce","from":"*","from_inclusive":true,"to":"33.0.15","to_inclusive":true,"patched_in":"33.0.16"}],"published":"2025-10-17T18:11:36Z","updated":"2025-10-18T06:42:49Z"},{"id":"wordfence:ef014597-dd85-4ac0-a08d-de60b34ab4c9","source":"wordfence","cve":"CVE-2025-27311","title":"Bulk Content Creator <= 1.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef014597-dd85-4ac0-a08d-de60b34ab4c9?source=api-prod","affected":[{"type":"plugin","slug":"bulk-content-creator","name":"Bulk Content Creator","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:31:57Z"},{"id":"wordfence:ef01f05a-ed5a-4278-acab-029c58242cf2","source":"wordfence","cve":"CVE-2026-4075","title":"BWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef01f05a-ed5a-4278-acab-029c58242cf2?source=api-prod","affected":[{"type":"plugin","slug":"bwl-advanced-faq-manager-lite","name":"BWL Advanced FAQ Manager Lite","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-03-25T14:13:14Z","updated":"2026-03-26T02:25:20Z"},{"id":"wordfence:ef0324f2-f897-42a9-a7dc-0483728a05c8","source":"wordfence","cve":"CVE-2025-30540","title":"AvaiBook <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0324f2-f897-42a9-a7dc-0483728a05c8?source=api-prod","affected":[{"type":"plugin","slug":"avaibook","name":"AvaiBook vacation rental booking engine","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:41:49Z"},{"id":"wordfence:ef07568d-4011-4f83-8828-fe6937ee268a","source":"wordfence","cve":"CVE-2025-23773","title":"Delete All Posts <= 1.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef07568d-4011-4f83-8828-fe6937ee268a?source=api-prod","affected":[{"type":"plugin","slug":"delele-all","name":"Delete All Posts","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-04-22T21:34:13Z"},{"id":"wordfence:ef07d6b0-ccdb-4b33-817f-6d4b3ad96243","source":"wordfence","cve":"CVE-2025-14610","title":"TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef07d6b0-ccdb-4b33-817f-6d4b3ad96243?source=api-prod","affected":[{"type":"plugin","slug":"tablemaster-for-elementor","name":"TableMaster for Elementor \u2013 Responsive Data Tables & Comparison Tables","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2026-01-27T17:21:05Z","updated":"2026-01-28T05:30:19Z"},{"id":"wordfence:ef0866ea-1edd-4d45-b3b9-75a0244e8951","source":"wordfence","cve":"CVE-2025-23986","title":"Tiki Time <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0866ea-1edd-4d45-b3b9-75a0244e8951?source=api-prod","affected":[{"type":"theme","slug":"tiki-time","name":"Tiki Time","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-18T00:00:00Z","updated":"2025-01-22T20:34:29Z"},{"id":"wordfence:ef089712-f717-4023-a0e4-d7924c904aa3","source":"wordfence","cve":"CVE-2026-86444","title":"LearnPress <= 4.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef089712-f717-4023-a0e4-d7924c904aa3?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:56:44Z"},{"id":"wordfence:ef08a43d-c19e-44ea-871e-eb9b28dfcce6","source":"wordfence","cve":"CVE-2026-81424","title":"Accept Stripe Payments < 2.1.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef08a43d-c19e-44ea-871e-eb9b28dfcce6?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:06:20Z"},{"id":"wordfence:ef08c1ad-fc85-4154-8634-21c506436317","source":"wordfence","cve":"CVE-2015-9522","title":"Easy Digital Downloads \u2013 QR Codes <= 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef08c1ad-fc85-4154-8634-21c506436317?source=api-prod","affected":[{"type":"plugin","slug":"edd-qr-codes","name":"Easy Digital Downloads - QR Codes","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef0abec6-7d4b-4a1f-8116-e31d60bc34b0","source":"wordfence","cve":"CVE-2024-11373","title":"Connexion Logs <= 3.0.2 - Cross-Site Request Forgery to Log Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0abec6-7d4b-4a1f-8116-e31d60bc34b0?source=api-prod","affected":[{"type":"plugin","slug":"logs-de-connexion","name":"Connexion Logs","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T14:06:46Z"},{"id":"wordfence:ef0c6a63-7dd7-49ae-a09d-28e044100c64","source":"wordfence","cve":"CVE-2026-113472","title":"Depicter \u2014 Popup & Slider Builder 4.0.5 - 4.8.1 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0c6a63-7dd7-49ae-a09d-28e044100c64?source=api-prod","affected":[{"type":"plugin","slug":"depicter","name":"Depicter \u2014 Popup & Slider Builder","from":"4.0.5","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"4.8.2"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:06:43Z"},{"id":"wordfence:ef0dc868-f617-408f-9333-ebfee4897701","source":"wordfence","cve":"CVE-2022-4443","title":"BruteBank - WP Security & Firewall <= 1.8 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0dc868-f617-408f-9333-ebfee4897701?source=api-prod","affected":[{"type":"plugin","slug":"brutebank","name":"BruteBank \u2013 WP Security & Firewall","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2022-12-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef0f5f9d-788a-4cf8-9747-ada076a69a1f","source":"wordfence","cve":"CVE-2026-6937","title":"Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef0f5f9d-788a-4cf8-9747-ada076a69a1f?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.8","to_inclusive":true,"patched_in":"1.6.11.9"}],"published":"2026-05-27T19:43:02Z","updated":"2026-05-28T07:43:44Z"},{"id":"wordfence:ef104a10-9e47-420b-aba9-71095870bf4f","source":"wordfence","cve":"","title":"SlimStat-Ex <= 2.1.2 - Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef104a10-9e47-420b-aba9-71095870bf4f?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat-ex","name":"wp-slimstat-ex","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2013-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef1362b5-576d-4d22-ad5d-89f38e8e3743","source":"wordfence","cve":"CVE-2024-4529","title":"Business Card <= 1.0.0 - Cross-Site Request Forgery to Category Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1362b5-576d-4d22-ad5d-89f38e8e3743?source=api-prod","affected":[{"type":"plugin","slug":"business-card-by-esterox-100","name":"Business Card","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-09T00:26:38Z"},{"id":"wordfence:ef1468eb-9b98-4d45-b357-70998ba17de7","source":"wordfence","cve":"","title":"UpdraftCentral Dashboard 0.8.23 - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1468eb-9b98-4d45-b357-70998ba17de7?source=api-prod","affected":[{"type":"plugin","slug":"updraftcentral","name":"UpdraftCentral Dashboard","from":"0.8.23","from_inclusive":true,"to":"0.8.23","to_inclusive":true,"patched_in":"0.8.24"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef14c7b4-8cad-4139-a170-42470202ec24","source":"wordfence","cve":"CVE-2021-25006","title":"MOLIE \u2013 Instructure Canvas Linking tool <= 0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef14c7b4-8cad-4139-a170-42470202ec24?source=api-prod","affected":[{"type":"plugin","slug":"molie-instructure-canvas-linking-tool","name":"MOLIE \u2013 Instructure Canvas Linking tool","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2021-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef176a6c-33d1-45d6-8a1d-3df1e8eb2170","source":"wordfence","cve":"CVE-2026-11997","title":"Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef176a6c-33d1-45d6-8a1d-3df1e8eb2170?source=api-prod","affected":[{"type":"plugin","slug":"bulk-seo-image","name":"Bulk SEO Image","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:41:29Z","updated":"2026-06-24T05:33:33Z"},{"id":"wordfence:ef1aafc2-e47b-49da-8a4e-9111209308c2","source":"wordfence","cve":"CVE-2023-45833","title":"LeadSquared Suite <= 0.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1aafc2-e47b-49da-8a4e-9111209308c2?source=api-prod","affected":[{"type":"plugin","slug":"leadsquared-suite","name":"LeadSquared Suite","from":"*","from_inclusive":true,"to":"0.7.4","to_inclusive":true,"patched_in":""}],"published":"2023-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef1ccef8-9066-4f5c-b5c5-9fa6e54f0e87","source":"wordfence","cve":"CVE-2024-3280","title":"Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1ccef8-9066-4f5c-b5c5-9fa6e54f0e87?source=api-prod","affected":[{"type":"plugin","slug":"wpsite-follow-us-badges","name":"Follow Us Badges","from":"*","from_inclusive":true,"to":"3.1.10","to_inclusive":true,"patched_in":"3.1.11"}],"published":"2024-05-01T00:00:00Z","updated":"2024-05-31T15:30:59Z"},{"id":"wordfence:ef1d1ae6-3019-4e48-911e-5f805f8089ca","source":"wordfence","cve":"CVE-2026-49774","title":"RD Station <= 5.6.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1d1ae6-3019-4e48-911e-5f805f8089ca?source=api-prod","affected":[{"type":"plugin","slug":"integracao-rd-station","name":"RD Station","from":"*","from_inclusive":true,"to":"5.6.0","to_inclusive":true,"patched_in":"5.7.0"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-10T17:46:41Z"},{"id":"wordfence:ef1e656b-81e6-4e26-89b6-4f8fd956bf89","source":"wordfence","cve":"CVE-2026-116386","title":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef1e656b-81e6-4e26-89b6-4f8fd956bf89?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2026-10-30T07:44:18Z","updated":"2026-11-03T19:29:22Z"},{"id":"wordfence:ef20b3e6-d8f4-458e-b604-b46ef16e229e","source":"wordfence","cve":"CVE-2023-3081","title":"WP Mail Logging <= 1.11.1 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef20b3e6-d8f4-458e-b604-b46ef16e229e?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.11.1","to_inclusive":true,"patched_in":"1.11.2"}],"published":"2023-06-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef20da8c-6baf-4c21-b249-65e0b8901469","source":"wordfence","cve":"CVE-2025-25146","title":"Songkick Concerts and Festivals <= 0.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef20da8c-6baf-4c21-b249-65e0b8901469?source=api-prod","affected":[{"type":"plugin","slug":"songkick-concerts-and-festivals","name":"Songkick Concerts and Festivals","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.10.0"}],"published":"2025-02-03T00:00:00Z","updated":"2025-03-12T13:16:55Z"},{"id":"wordfence:ef21fae3-65ef-43e8-9792-619dfc4dfda8","source":"wordfence","cve":"CVE-2024-3563","title":"Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef21fae3-65ef-43e8-9792-619dfc4dfda8?source=api-prod","affected":[{"type":"plugin","slug":"genesis-blocks","name":"Genesis Blocks","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":"3.1.4"}],"published":"2024-07-08T19:44:00Z","updated":"2024-08-27T13:43:36Z"},{"id":"wordfence:ef25d644-8dda-4c49-85a4-33113a4996ac","source":"wordfence","cve":"CVE-2026-89411","title":"Paymattic <= 4.6.25 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef25d644-8dda-4c49-85a4-33113a4996ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-payment-form","name":"Paymattic \u2013 Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management","from":"*","from_inclusive":true,"to":"4.6.25","to_inclusive":true,"patched_in":"4.6.26"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-29T19:58:16Z"},{"id":"wordfence:ef267623-ba9a-4eb2-8521-9256350076a2","source":"wordfence","cve":"CVE-2026-28055","title":"M.Williamson <= 1.2.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef267623-ba9a-4eb2-8521-9256350076a2?source=api-prod","affected":[{"type":"theme","slug":"williamson","name":"M.Williamson | Lawyer & Legal Adviser WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:14:20Z"},{"id":"wordfence:ef268946-853f-4bcf-874e-6a5aa344d57e","source":"wordfence","cve":"CVE-2025-0769","title":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef268946-853f-4bcf-874e-6a5aa344d57e?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"10.1.1.1","from_inclusive":true,"to":"10.1.1.1","to_inclusive":true,"patched_in":"10.1.1.2"}],"published":"2025-02-28T00:00:00Z","updated":"2025-03-03T20:48:17Z"},{"id":"wordfence:ef29b7b4-ba21-4ea7-8427-0f843c32d92a","source":"wordfence","cve":"CVE-2026-94273","title":"Snap Finance < 3.12.0 - Unauthenticated Payment Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef29b7b4-ba21-4ea7-8427-0f843c32d92a?source=api-prod","affected":[{"type":"plugin","slug":"snap-finance-checkout","name":"Snap Finance","from":"*","from_inclusive":true,"to":"3.12.0","to_inclusive":false,"patched_in":"3.12.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-11-03T22:47:59Z"},{"id":"wordfence:ef2ac5c8-9e76-40b8-a2a4-8cb4291871f2","source":"wordfence","cve":"CVE-2020-36155","title":"Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta","severity":"critical","cvss":10.0,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2ac5c8-9e76-40b8-a2a4-8cb4291871f2?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":false,"patched_in":"2.1.12"}],"published":"2020-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef2c89d1-7cc4-4efa-841a-7edb98d874c1","source":"wordfence","cve":"CVE-2025-58684","title":"Logo Showcase <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2c89d1-7cc4-4efa-841a-7edb98d874c1?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase","name":"Logo Showcase \u2013 Logo Slider, Logo Carousel & Client Logos Grid","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2025-09-22T00:00:00Z","updated":"2026-06-18T14:27:43Z"},{"id":"wordfence:ef2e44ea-0049-4370-abd0-0b631e3d2d37","source":"wordfence","cve":"CVE-2026-42384","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin < 1.6.11.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2e44ea-0049-4370-abd0-0b631e3d2d37?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.11.2","to_inclusive":false,"patched_in":"1.6.11.2"}],"published":"2026-04-27T00:00:00Z","updated":"2026-04-30T15:00:24Z"},{"id":"wordfence:ef2f1ad1-1e2e-4b56-b16c-d87956b142ad","source":"wordfence","cve":"CVE-2025-1794","title":"AM LottiePlayer <= 3.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2f1ad1-1e2e-4b56-b16c-d87956b142ad?source=api-prod","affected":[{"type":"plugin","slug":"am-lottieplayer","name":"AM LottiePlayer","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2026-04-07T17:38:28Z","updated":"2026-09-23T21:06:46Z"},{"id":"wordfence:ef36a2a1-b3be-4270-8890-76705817b4b5","source":"wordfence","cve":"CVE-2024-8364","title":"WP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef36a2a1-b3be-4270-8890-76705817b4b5?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-fields-search","name":"WP Custom Fields Search","from":"*","from_inclusive":true,"to":"1.2.35","to_inclusive":true,"patched_in":""}],"published":"2024-09-18T15:37:01Z","updated":"2024-09-19T03:59:16Z"},{"id":"wordfence:ef395956-477c-4970-becd-4f437e4807a3","source":"wordfence","cve":"CVE-2024-9703","title":"Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef395956-477c-4970-becd-4f437e4807a3?source=api-prod","affected":[{"type":"plugin","slug":"arconix-shortcodes","name":"Arconix Shortcodes","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-18T06:51:27Z"},{"id":"wordfence:ef3b11ef-c328-489e-8c12-331621a0327c","source":"wordfence","cve":"CVE-2019-9913","title":"WP Live Chat Support <= 8.0.17 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef3b11ef-c328-489e-8c12-331621a0327c?source=api-prod","affected":[{"type":"plugin","slug":"wp-live-chat-support","name":"3CX Free Live Chat, Calls & Messaging","from":"*","from_inclusive":true,"to":"8.0.18","to_inclusive":false,"patched_in":"8.0.18"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef3f0b0d-e342-44c9-81bd-a7582802e8c7","source":"wordfence","cve":"CVE-2026-22454","title":"Solaris <= 2.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef3f0b0d-e342-44c9-81bd-a7582802e8c7?source=api-prod","affected":[{"type":"theme","slug":"solaris","name":"Solaris","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-03-03T00:00:00Z","updated":"2026-03-12T14:05:42Z"},{"id":"wordfence:ef4134a1-e2c6-495a-bc00-cc8cd783cd7a","source":"wordfence","cve":"CVE-2015-9402","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.5.58 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4134a1-e2c6-495a-bc00-cc8cd783cd7a?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.59","to_inclusive":false,"patched_in":"1.5.59"}],"published":"2015-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef45fa78-7005-483e-a708-5aab0f7ba07b","source":"wordfence","cve":"CVE-2022-41996","title":"Avada <= 7.8.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef45fa78-7005-483e-a708-5aab0f7ba07b?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2022-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef4603b2-bd41-4f65-ba2a-8d06e32e67c1","source":"wordfence","cve":"CVE-2024-4705","title":"Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4603b2-bd41-4f65-ba2a-8d06e32e67c1?source=api-prod","affected":[{"type":"plugin","slug":"testimonials-widget","name":"Testimonials Widget","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-05T13:10:49Z","updated":"2024-06-06T02:03:04Z"},{"id":"wordfence:ef462cdf-4639-405c-94c6-568645d4fa22","source":"wordfence","cve":"CVE-2024-50413","title":"Import and export users and customers <= 1.27.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef462cdf-4639-405c-94c6-568645d4fa22?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.27.5","to_inclusive":true,"patched_in":"1.27.6"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T11:38:38Z"},{"id":"wordfence:ef46b08f-455a-4c61-81ac-10af19b16980","source":"wordfence","cve":"CVE-2025-8425","title":"My WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef46b08f-455a-4c61-81ac-10af19b16980?source=api-prod","affected":[{"type":"plugin","slug":"my-wp-translate","name":"My WP Translate","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T19:03:52Z","updated":"2025-09-11T07:25:03Z"},{"id":"wordfence:ef47feb7-76fd-470d-ba48-55ba3c323c6d","source":"wordfence","cve":"CVE-2024-4088","title":"Gutenberg Blocks and Page Layouts \u2013 Attire Blocks <= 1.9.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef47feb7-76fd-470d-ba48-55ba3c323c6d?source=api-prod","affected":[{"type":"plugin","slug":"attire-blocks","name":"Gutenberg Blocks and Page Layouts \u2013 Attire Blocks","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-06-04T18:36:28Z","updated":"2024-06-05T06:50:30Z"},{"id":"wordfence:ef480fce-d0e3-47af-92ea-2c84c3f8e2f7","source":"wordfence","cve":"CVE-2024-3477","title":"Popup Box \u2013 new WordPress popup plugin <= 2.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef480fce-d0e3-47af-92ea-2c84c3f8e2f7?source=api-prod","affected":[{"type":"plugin","slug":"popup-box","name":"Popup Box \u2013 Easily Create WordPress Popups","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T12:42:15Z"},{"id":"wordfence:ef4a7a20-663e-4e6a-af23-e8a87b18521e","source":"wordfence","cve":"CVE-2016-0765","title":"eShop <= 6.3.14 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4a7a20-663e-4e6a-af23-e8a87b18521e?source=api-prod","affected":[{"type":"plugin","slug":"eshop","name":"eShop","from":"*","from_inclusive":true,"to":"6.3.14","to_inclusive":true,"patched_in":""}],"published":"2016-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef4c6f76-4d3e-4ab0-9e12-1df55a8edae5","source":"wordfence","cve":"CVE-2024-22291","title":"Browser Theme Color <= 1.3 - Cross-Site Request Forgery via btc_settings_page","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4c6f76-4d3e-4ab0-9e12-1df55a8edae5?source=api-prod","affected":[{"type":"plugin","slug":"browser-theme-color","name":"Browser Theme Color \u2013 Address Bar Color & Dark Mode","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2024-01-17T00:00:00Z","updated":"2024-05-29T20:56:06Z"},{"id":"wordfence:ef4dad25-f1e1-401c-91c3-525c045bddf6","source":"wordfence","cve":"CVE-2026-75798","title":"AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4dad25-f1e1-401c-91c3-525c045bddf6?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"3.4.0","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-02T14:11:46Z"},{"id":"wordfence:ef4ecdd3-1041-4dbe-a804-59a51f6123e4","source":"wordfence","cve":"CVE-2022-3985","title":"Videojs HTML5 Player <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4ecdd3-1041-4dbe-a804-59a51f6123e4?source=api-prod","affected":[{"type":"plugin","slug":"videojs-html5-player","name":"Videojs HTML5 Player","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2022-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef5028a0-6a5a-40ad-92df-ffc988cad389","source":"wordfence","cve":"CVE-2021-24884","title":"Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5028a0-6a5a-40ad-92df-ffc988cad389?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"4.09.05","to_inclusive":false,"patched_in":"4.09.05"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef51095d-5d06-4cbe-925e-a4d2745c47b8","source":"wordfence","cve":"CVE-2026-28166","title":"Tour Master - Tour Booking, Travel, Hotel <= 5.4.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef51095d-5d06-4cbe-925e-a4d2745c47b8?source=api-prod","affected":[{"type":"plugin","slug":"tourmaster","name":"Tour Master - Tour Booking, Travel, Hotel","from":"*","from_inclusive":true,"to":"5.4.9","to_inclusive":true,"patched_in":""}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T15:17:42Z"},{"id":"wordfence:ef52026b-1bfc-481c-8eb7-511d1910a35e","source":"wordfence","cve":"CVE-2025-8400","title":"Image Gallery <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef52026b-1bfc-481c-8eb7-511d1910a35e?source=api-prod","affected":[{"type":"plugin","slug":"bee-quick-gallery","name":"Image Gallery","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T19:37:11Z","updated":"2025-08-02T08:24:47Z"},{"id":"wordfence:ef528553-4037-43e0-af2d-8324412147f3","source":"wordfence","cve":"CVE-2024-31389","title":"MihanPanel <= 12.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef528553-4037-43e0-af2d-8324412147f3?source=api-prod","affected":[{"type":"plugin","slug":"mihanpanel-lite","name":"MihanPanel \u2013 User Login , Registration and Dashboard","from":"*","from_inclusive":true,"to":"12.4","to_inclusive":true,"patched_in":"12.7"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:02:44Z"},{"id":"wordfence:ef543c61-2acc-4b72-81ff-883960d4c7c3","source":"wordfence","cve":"CVE-2023-4040","title":"Stripe Payment Plugin for WooCommerce <= 3.7.9 - Missing Authorization to Arbitrary Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef543c61-2acc-4b72-81ff-883960d4c7c3?source=api-prod","affected":[{"type":"plugin","slug":"payment-gateway-stripe-and-woocommerce-integration","name":"Payment Gateway of Stripe for WooCommerce","from":"3.7.9","from_inclusive":true,"to":"3.7.9","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef54b45e-19e4-4423-aace-99b017cdd6ee","source":"wordfence","cve":"CVE-2024-7132","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.12 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef54b45e-19e4-4423-aace-99b017cdd6ee?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.12","to_inclusive":true,"patched_in":"3.1.13"}],"published":"2024-08-08T00:00:00Z","updated":"2024-09-12T15:54:19Z"},{"id":"wordfence:ef566dca-91ed-4929-b36b-4e424e07e1d4","source":"wordfence","cve":"CVE-2024-8030","title":"Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef566dca-91ed-4929-b36b-4e424e07e1d4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-store-kit","name":"Ultimate Store Kit \u2013 Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T02:05:49Z"},{"id":"wordfence:ef5859b7-0f15-43ad-9f45-aa846d045f5d","source":"wordfence","cve":"CVE-2021-36826","title":"WP Project Manager <= 2.4.13 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5859b7-0f15-43ad-9f45-aa846d045f5d?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":"2.4.14"}],"published":"2021-10-11T13:37:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef5a0b2d-8ee7-4d4e-b126-00ea11e81ddb","source":"wordfence","cve":"CVE-2026-39590","title":"Atomlab <= 2.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5a0b2d-8ee7-4d4e-b126-00ea11e81ddb?source=api-prod","affected":[{"type":"theme","slug":"atomlab","name":"Atomlab - Startup Landing Page WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.4.6"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:32:35Z"},{"id":"wordfence:ef5bccca-39d6-40e2-94fa-b321da58789d","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5bccca-39d6-40e2-94fa-b321da58789d?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef5f99ca-8a0d-4ec4-8b59-c0c4637dfbc3","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'statusBulkEdit' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef5f99ca-8a0d-4ec4-8b59-c0c4637dfbc3?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef60c109-30e2-48e9-8599-6f226e74b6bc","source":"wordfence","cve":"CVE-2022-4303","title":"WP Limit Login Attempts <= 2.6.4 - IP Spoofing to Protection Mechanism Bypass","severity":"medium","cvss":6.5,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef60c109-30e2-48e9-8599-6f226e74b6bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-limit-login-attempts","name":"WP Limit Login Attempts","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":""}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef60f4c3-e38f-4f95-80cd-5e1f5512ebf5","source":"wordfence","cve":"CVE-2023-29236","title":"Outdoor <= 3.9.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef60f4c3-e38f-4f95-80cd-5e1f5512ebf5?source=api-prod","affected":[{"type":"theme","slug":"outdoor","name":"outdoor","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2023-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef61aeba-2105-4da8-8e9c-480e6ed820b7","source":"wordfence","cve":"CVE-2026-32393","title":"Greenly Theme Addons < 8.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef61aeba-2105-4da8-8e9c-480e6ed820b7?source=api-prod","affected":[{"type":"plugin","slug":"greenly-addons","name":"Greenly Theme Addons","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":false,"patched_in":"8.2"}],"published":"2026-02-19T00:00:00Z","updated":"2026-05-05T14:14:29Z"},{"id":"wordfence:ef6538e7-8cde-4c49-9965-0624a25ffe65","source":"wordfence","cve":"CVE-2018-17583","title":"WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via the rules[0][content] parameter in a wpfc_save_exclude_pages action","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6538e7-8cde-4c49-9965-0624a25ffe65?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.8.5","to_inclusive":true,"patched_in":"0.8.8.6"}],"published":"2018-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef6b36a2-c18a-403a-aa0b-5d3e3ef1ca90","source":"wordfence","cve":"CVE-2024-3163","title":"Easy Property Listings <= 3.5.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6b36a2-c18a-403a-aa0b-5d3e3ef1ca90?source=api-prod","affected":[{"type":"plugin","slug":"easy-property-listings","name":"Easy Property Listings","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-04T15:33:06Z"},{"id":"wordfence:ef6b80c1-7f5e-4f8d-964a-a9c9c4f2a882","source":"wordfence","cve":"CVE-2022-4706","title":"Genesis Columns Advanced <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6b80c1-7f5e-4f8d-964a-a9c9c4f2a882?source=api-prod","affected":[{"type":"plugin","slug":"genesis-columns-advanced","name":"Genesis Columns Advanced","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef6bbd96-6385-4b96-af11-356b4ce6e908","source":"wordfence","cve":"CVE-2026-15359","title":"Templately <= 3.7.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6bbd96-6385-4b96-af11-356b4ce6e908?source=api-prod","affected":[{"type":"plugin","slug":"templately","name":"Templately \u2013 Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:29:17Z"},{"id":"wordfence:ef6bbe0c-8721-4385-b0ba-ea2c64dca36b","source":"wordfence","cve":"CVE-2025-58797","title":"Ninja Charts <= 3.3.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6bbe0c-8721-4385-b0ba-ea2c64dca36b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-charts","name":"Ninja Charts \u2013 Interactive Charts and Graphs","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-09-05T00:00:00Z","updated":"2025-10-30T14:27:45Z"},{"id":"wordfence:ef6bf903-04e3-447d-8e40-3874dd3058d6","source":"wordfence","cve":"CVE-2026-100507","title":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6bf903-04e3-447d-8e40-3874dd3058d6?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10.1","to_inclusive":true,"patched_in":"1.10.2"}],"published":"2026-09-30T10:19:19Z","updated":"2026-10-08T23:08:11Z"},{"id":"wordfence:ef6ce2ef-f810-4f8c-a0bd-785a28131213","source":"wordfence","cve":"CVE-2026-8040","title":"faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6ce2ef-f810-4f8c-a0bd-785a28131213?source=api-prod","affected":[{"type":"plugin","slug":"faq-shortcode","name":"faq shortocde","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:20:11Z","updated":"2026-05-27T05:31:32Z"},{"id":"wordfence:ef6f6383-a208-4fff-a8ca-296e0fd9d851","source":"wordfence","cve":"CVE-2025-69191","title":"ListingHub <= 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6f6383-a208-4fff-a8ca-296e0fd9d851?source=api-prod","affected":[{"type":"plugin","slug":"listinghub","name":"ListingHub","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:07:50Z"},{"id":"wordfence:ef7539d0-251c-46f9-a4c9-1ef0d6b57274","source":"wordfence","cve":"CVE-2026-32338","title":"Construction Landing Page <= 1.4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7539d0-251c-46f9-a4c9-1ef0d6b57274?source=api-prod","affected":[{"type":"theme","slug":"construction-landing-page","name":"Construction Landing Page","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-02-09T00:00:00Z","updated":"2026-04-15T20:46:25Z"},{"id":"wordfence:ef7727e5-fb20-4d9b-baaa-c123a0100ee0","source":"wordfence","cve":"CVE-2019-12934","title":"WP Code Highlight.js <= 0.6.2 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7727e5-fb20-4d9b-baaa-c123a0100ee0?source=api-prod","affected":[{"type":"plugin","slug":"wp-code-highlightjs","name":"WP Code Highlight.js","from":"*","from_inclusive":true,"to":"0.6.3","to_inclusive":false,"patched_in":"0.6.3"}],"published":"2019-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef778a1d-d4ce-47fd-932b-9e86b38e2681","source":"wordfence","cve":"CVE-2023-30477","title":"AFFILIATE Solution <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef778a1d-d4ce-47fd-932b-9e86b38e2681?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-solution","name":"AFFILIATE Solution","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef792894-b841-495c-aae0-08476a435471","source":"wordfence","cve":"CVE-2024-3557","title":"WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef792894-b841-495c-aae0-08476a435471?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"9.0.36","to_inclusive":true,"patched_in":"9.0.37"}],"published":"2024-05-23T16:04:46Z","updated":"2024-05-31T15:30:59Z"},{"id":"wordfence:ef79e5a8-8bac-42b3-a064-6eea597701c9","source":"wordfence","cve":"CVE-2023-32242","title":"Woodmart Core <= 1.0.36 - PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef79e5a8-8bac-42b3-a064-6eea597701c9?source=api-prod","affected":[{"type":"plugin","slug":"woodmart-core","name":"Woodmart Core","from":"*","from_inclusive":true,"to":"1.0.36","to_inclusive":true,"patched_in":"1.0.37"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef7aff85-e1ca-47ce-86e9-a0fe356993a1","source":"wordfence","cve":"CVE-2026-12158","title":"RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7aff85-e1ca-47ce-86e9-a0fe356993a1?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.1","to_inclusive":true,"patched_in":"6.0.9.2"}],"published":"2026-06-30T19:50:25Z","updated":"2026-07-01T07:53:38Z"},{"id":"wordfence:ef7b80c4-09b8-443a-8d69-b33511f8cf18","source":"wordfence","cve":"CVE-2025-31592","title":"Send E-mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7b80c4-09b8-443a-8d69-b33511f8cf18?source=api-prod","affected":[{"type":"plugin","slug":"send-e-mail","name":"Send E-mail","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T14:10:34Z"},{"id":"wordfence:ef7cf633-e907-4da1-bd96-0013e88defbb","source":"wordfence","cve":"CVE-2023-26014","title":"Minify HTML <= 2.1.7 - Cross-Site Request Forgery in minify_html_menu_options","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7cf633-e907-4da1-bd96-0013e88defbb?source=api-prod","affected":[{"type":"plugin","slug":"minify-html-markup","name":"Minify HTML","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef7d7378-fa94-4964-916b-a41f69866d76","source":"wordfence","cve":"","title":"VS Contact Form <= 11.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7d7378-fa94-4964-916b-a41f69866d76?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-contact-form","name":"VS Contact Form","from":"*","from_inclusive":true,"to":"11.5","to_inclusive":true,"patched_in":"11.6"}],"published":"2022-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef7ec175-cee5-4559-909d-ee689158d67c","source":"wordfence","cve":"CVE-2023-48334","title":"League Table <= 1.13 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7ec175-cee5-4559-909d-ee689158d67c?source=api-prod","affected":[{"type":"plugin","slug":"league-table-lite","name":"League Table \u2013 WordPress Table Plugin","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"}],"published":"2023-11-23T00:00:00Z","updated":"2024-03-22T15:26:24Z"},{"id":"wordfence:ef7ef45a-612b-40ca-817d-05b3d29b2b05","source":"wordfence","cve":"","title":"Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7ef45a-612b-40ca-817d-05b3d29b2b05?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":false,"patched_in":"3.5.3"}],"published":"2021-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef7f1209-c0e9-4958-aa92-fb2cb2a431e1","source":"wordfence","cve":"CVE-2025-23797","title":"WP Options Editor <= 1.1 - Cross-Site Request Forgery to Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7f1209-c0e9-4958-aa92-fb2cb2a431e1?source=api-prod","affected":[{"type":"plugin","slug":"wp-options-editor","name":"WP Options Editor","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:57:42Z"},{"id":"wordfence:ef7fcd15-a570-4a41-ab51-e803e55625a8","source":"wordfence","cve":"CVE-2024-50454","title":"SEOPress <= 8.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7fcd15-a570-4a41-ab51-e803e55625a8?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T19:44:05Z"},{"id":"wordfence:ef80a076-98cb-42c1-8d7d-0a6b38d7bfc8","source":"wordfence","cve":"CVE-2022-28290","title":"WordPress Country Selector <= 1.6.5 - Reflected Cross-Site Scripting via AJAX call of check_country_selector","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef80a076-98cb-42c1-8d7d-0a6b38d7bfc8?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-country-selector","name":"WordPress Country Selector","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2022-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef818472-d4ba-4ca9-b7ed-fe563107c3bd","source":"wordfence","cve":"CVE-2026-49083","title":"LatePoint \u2013 Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef818472-d4ba-4ca9-b7ed-fe563107c3bd?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.2"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:42:53Z"},{"id":"wordfence:ef828667-f241-4c5c-92a8-0a4f366e190f","source":"wordfence","cve":"CVE-2025-4199","title":"Abundatrade Plugin <= 1.8.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef828667-f241-4c5c-92a8-0a4f366e190f?source=api-prod","affected":[{"type":"plugin","slug":"abundatrade-plugin","name":"Abundatrade Plugin","from":"*","from_inclusive":true,"to":"1.8.02","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T11:36:52Z","updated":"2025-05-03T01:43:07Z"},{"id":"wordfence:ef82e702-8746-4d81-82d9-2ad5e7197d8a","source":"wordfence","cve":"CVE-2026-119525","title":"Dropshipping XML Import for WooCommerce <= 1.7.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef82e702-8746-4d81-82d9-2ad5e7197d8a?source=api-prod","affected":[{"type":"plugin","slug":"dropshipping-xml-for-woocommerce","name":"Dropshipping XML Import for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2026-11-07T10:26:00Z","updated":"2026-11-10T19:35:31Z"},{"id":"wordfence:ef847b12-a380-410a-9368-6b2751d1836e","source":"wordfence","cve":"CVE-2024-47366","title":"Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef847b12-a380-410a-9368-6b2751d1836e?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.6","to_inclusive":true,"patched_in":"1.13.7"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:21:35Z"},{"id":"wordfence:ef85c1f9-b4d9-431f-ba38-1c7e5d8877aa","source":"wordfence","cve":"CVE-2025-62116","title":"AI Copilot <= 1.4.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef85c1f9-b4d9-431f-ba38-1c7e5d8877aa?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot","name":"AI Copilot \u2013 ChatGPT Chatbot & AI Engine for Post Automation","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:25:51Z"},{"id":"wordfence:ef8697a2-7c58-43be-aaa9-05273fc3114b","source":"wordfence","cve":"CVE-2023-23874","title":"Ditty <= 3.0.32 - Authenticated (Contributor+) Stored Cross-Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8697a2-7c58-43be-aaa9-05273fc3114b?source=api-prod","affected":[{"type":"plugin","slug":"ditty-news-ticker","name":"Ditty \u2013 Responsive News Tickers, Sliders, and Lists","from":"*","from_inclusive":true,"to":"3.0.32","to_inclusive":true,"patched_in":"3.0.33"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef86b1f2-d5aa-4e83-a792-5fa35734b3d3","source":"wordfence","cve":"CVE-2024-12853","title":"Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef86b1f2-d5aa-4e83-a792-5fa35734b3d3?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.11.10","to_inclusive":true,"patched_in":"2.11.11"}],"published":"2025-01-07T20:18:18Z","updated":"2025-01-08T09:18:37Z"},{"id":"wordfence:ef888b2e-1fc7-442b-8b67-ebfdcbc76696","source":"wordfence","cve":"","title":"I Recommend This < 3.8.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef888b2e-1fc7-442b-8b67-ebfdcbc76696?source=api-prod","affected":[{"type":"plugin","slug":"i-recommend-this","name":"I Recommend This \u2013 Love/Like Button for WordPress Posts","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":false,"patched_in":"3.8.2"}],"published":"2018-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef8a43c7-f391-44fc-882c-26c1c8b5df78","source":"wordfence","cve":"CVE-2011-4669","title":"WordPress Users <= 1.3 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8a43c7-f391-44fc-882c-26c1c8b5df78?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-users","name":"WordPress Users","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2011-10-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef8a592a-8100-4347-8407-189ca2867c3b","source":"wordfence","cve":"CVE-2022-2171","title":"Progressive License <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8a592a-8100-4347-8407-189ca2867c3b?source=api-prod","affected":[{"type":"plugin","slug":"progressive-license","name":"Progressive License","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef8bfb38-4f20-4f9f-bb30-a88f3be2d2d3","source":"wordfence","cve":"CVE-2024-1981","title":"WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8bfb38-4f20-4f9f-bb30-a88f3be2d2d3?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"0.9.68","from_inclusive":true,"to":"0.9.68","to_inclusive":true,"patched_in":"0.9.69"}],"published":"2024-02-28T00:00:00Z","updated":"2024-02-29T06:47:59Z"},{"id":"wordfence:ef8c41c6-3065-4650-81e9-bdba0e38f2bd","source":"wordfence","cve":"CVE-2026-40785","title":"AutomatorWP \u2013 Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8c41c6-3065-4650-81e9-bdba0e38f2bd?source=api-prod","affected":[{"type":"plugin","slug":"automatorwp","name":"AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI","from":"*","from_inclusive":true,"to":"5.6.7","to_inclusive":true,"patched_in":"5.6.8"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:56:50Z"},{"id":"wordfence:ef8fca84-3ea1-432f-8cfe-9a1d1f70fa6f","source":"wordfence","cve":"CVE-2025-2302","title":"Advanced Woo Search <= 3.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8fca84-3ea1-432f-8cfe-9a1d1f70fa6f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-search","name":"Advanced Woo Search \u2013 Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"3.28","to_inclusive":true,"patched_in":"3.29"}],"published":"2025-03-25T10:58:34Z","updated":"2025-03-25T23:21:55Z"},{"id":"wordfence:ef9010e3-f060-4bef-b62b-4a648f5e5577","source":"wordfence","cve":"CVE-2025-8385","title":"Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read","severity":"medium","cvss":6.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9010e3-f060-4bef-b62b-4a648f5e5577?source=api-prod","affected":[{"type":"plugin","slug":"zombify","name":"Zombify","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2025-10-30T00:00:00Z","updated":"2025-10-31T07:26:41Z"},{"id":"wordfence:ef91b68e-c4f2-4691-8daa-0ffa4d4ee96e","source":"wordfence","cve":"CVE-2025-48320","title":"\u767e\u5ea6\u5206\u4eab\u6309\u94ae <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef91b68e-c4f2-4691-8daa-0ffa4d4ee96e?source=api-prod","affected":[{"type":"plugin","slug":"baidushare-wp","name":"\u767e\u5ea6\u5206\u4eab\u6309\u94ae","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-08-25T17:17:21Z"},{"id":"wordfence:ef926bc7-b50f-40ac-9ace-7e01b26f34e1","source":"wordfence","cve":"CVE-2026-2470","title":"Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef926bc7-b50f-40ac-9ace-7e01b26f34e1?source=api-prod","affected":[{"type":"plugin","slug":"pagelayer","name":"Page Builder: Pagelayer \u2013 Drag and Drop website builder","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2026-06-12T19:20:35Z","updated":"2026-06-13T07:51:22Z"},{"id":"wordfence:ef93491a-5965-4289-b72c-d1568ff4e6e8","source":"wordfence","cve":"CVE-2025-13497","title":"Recras WordPress plugin <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef93491a-5965-4289-b72c-d1568ff4e6e8?source=api-prod","affected":[{"type":"plugin","slug":"recras","name":"Recras","from":"*","from_inclusive":true,"to":"6.4.1","to_inclusive":true,"patched_in":"6.4.2"}],"published":"2026-01-06T19:39:45Z","updated":"2026-01-07T08:21:56Z"},{"id":"wordfence:ef93bfc3-6b1b-474c-b286-5123106eda53","source":"wordfence","cve":"CVE-2026-106031","title":"Spin Wheel <= 2.2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef93bfc3-6b1b-474c-b286-5123106eda53?source=api-prod","affected":[{"type":"plugin","slug":"spin-wheel","name":"Spin Wheel \u2013 Interactive spinning wheel that offers coupons","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T18:20:52Z"},{"id":"wordfence:ef96782e-d3a6-43de-bf6a-801bbe2e43ed","source":"wordfence","cve":"","title":"Hide My WP <= 4.53 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef96782e-d3a6-43de-bf6a-801bbe2e43ed?source=api-prod","affected":[{"type":"plugin","slug":"hide_my_wp","name":"Hide My WP - Amazing Security Plugin for WordPress!","from":"*","from_inclusive":true,"to":"4.54","to_inclusive":false,"patched_in":"4.54"}],"published":"2015-08-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef998d5e-e03b-4012-9576-d90dee3adec4","source":"wordfence","cve":"CVE-2025-22630","title":"Widget Options <= 4.1.0 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef998d5e-e03b-4012-9576-d90dee3adec4?source=api-prod","affected":[{"type":"plugin","slug":"widget-options","name":"Widget Options \u2013 Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-19T21:16:33Z"},{"id":"wordfence:ef9a6ef5-368e-40df-9a17-2779e453dfcc","source":"wordfence","cve":"CVE-2021-24377","title":"Autoptimize <= 2.7.7 - Race Condition leading to Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-362","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9a6ef5-368e-40df-9a17-2779e453dfcc?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":false,"patched_in":"2.7.8"}],"published":"2020-10-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef9ad6b4-40f0-40ce-9f17-37077cb1a5ca","source":"wordfence","cve":"CVE-2025-30973","title":"CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9ad6b4-40f0-40ce-9f17-37077cb1a5ca?source=api-prod","affected":[{"type":"plugin","slug":"coschool","name":"CoSchool LMS \u2013 A complete Learning Management System to Create and Sell Your Courses Online","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-17T13:01:31Z"},{"id":"wordfence:ef9ad9c6-268c-4abc-8fa0-535b3612d259","source":"wordfence","cve":"CVE-2024-51579","title":"5 Stars Rating Funnel <= 1.4.01 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9ad9c6-268c-4abc-8fa0-535b3612d259?source=api-prod","affected":[{"type":"plugin","slug":"5-stars-rating-funnel","name":"Build 5 Star Reviews on Google Reviews, Yelp, Facebook\u2026 easily and risk-free | RRatingg","from":"*","from_inclusive":true,"to":"1.4.01","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2025-10-29T20:50:17Z"},{"id":"wordfence:ef9b9628-bb56-470c-ba58-228b137963c4","source":"wordfence","cve":"CVE-2025-49895","title":"ServerBuddy by PluginBuddy.com <= 1.0.5 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9b9628-bb56-470c-ba58-228b137963c4?source=api-prod","affected":[{"type":"plugin","slug":"serverbuddy-by-pluginbuddy","name":"ServerBuddy by PluginBuddy.com","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-16T00:00:00Z","updated":"2025-08-18T15:46:13Z"},{"id":"wordfence:ef9ba9ff-b979-40c9-bead-0d665ef92287","source":"wordfence","cve":"CVE-2025-23522","title":"HM Portfolio <= 1.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9ba9ff-b979-40c9-bead-0d665ef92287?source=api-prod","affected":[{"type":"plugin","slug":"hm-portfolio","name":"HM Portfolio","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:21:33Z"},{"id":"wordfence:ef9d256b-9156-4172-8892-29a26beddb71","source":"wordfence","cve":"","title":"Booking Calendar <= 6.2 - Authenticated (Editor+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9d256b-9156-4172-8892-29a26beddb71?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":false,"patched_in":"6.2.1"}],"published":"2016-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ef9eac3a-600c-4e4d-bfe1-47fafa37141a","source":"wordfence","cve":"CVE-2026-16960","title":"Loops & Logic <= 4.2.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9eac3a-600c-4e4d-bfe1-47fafa37141a?source=api-prod","affected":[{"type":"plugin","slug":"tangible-loops-and-logic","name":"Tangible: Loops & Logic","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:08:41Z"},{"id":"wordfence:ef9ec21b-8216-4e7e-a4e5-25871f4ee0ff","source":"wordfence","cve":"CVE-2026-73375","title":"Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9ec21b-8216-4e7e-a4e5-25871f4ee0ff?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:34:52Z"},{"id":"wordfence:ef9ee3e3-f6b7-400f-a977-2a3230c3b080","source":"wordfence","cve":"CVE-2025-23486","title":"Database Sync <= 0.5.1 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9ee3e3-f6b7-400f-a977-2a3230c3b080?source=api-prod","affected":[{"type":"plugin","slug":"database-sync","name":"Database Sync","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:37:53Z"},{"id":"wordfence:ef9f03e9-11cb-489f-9322-b6f17335794f","source":"wordfence","cve":"CVE-2026-2696","title":"Export All URLs < 5.1 - Unauthenticated Information Exposure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9f03e9-11cb-489f-9322-b6f17335794f?source=api-prod","affected":[{"type":"plugin","slug":"export-all-urls","name":"Export All URLs","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":false,"patched_in":"5.1"}],"published":"2026-04-02T00:00:00Z","updated":"2026-04-09T16:21:49Z"},{"id":"wordfence:efa01956-7c03-4f0f-9054-6920013a2b32","source":"wordfence","cve":"CVE-2017-2169","title":"MaxButtons <= 6.18 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa01956-7c03-4f0f-9054-6920013a2b32?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"6.18","to_inclusive":true,"patched_in":"6.19"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efa156b7-ab18-414d-80a5-3a1c2a977b3b","source":"wordfence","cve":"CVE-2023-51693","title":"Themify Icons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa156b7-ab18-414d-80a5-3a1c2a977b3b?source=api-prod","affected":[{"type":"plugin","slug":"themify-icons","name":"Themify Icons","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efa4b67c-1bb8-413a-8cb8-039168b0b586","source":"wordfence","cve":"CVE-2023-28416","title":"Chankhe <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa4b67c-1bb8-413a-8cb8-039168b0b586?source=api-prod","affected":[{"type":"theme","slug":"chankhe","name":"Chankhe","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-03-16T00:00:00Z","updated":"2024-03-25T15:07:33Z"},{"id":"wordfence:efa4c442-0281-4f7e-a43e-0191cb31c3a4","source":"wordfence","cve":"CVE-2025-69387","title":"Simple Retail Menus <= 4.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa4c442-0281-4f7e-a43e-0191cb31c3a4?source=api-prod","affected":[{"type":"plugin","slug":"simple-retail-menus","name":"Simple Retail Menus","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-16T21:47:47Z"},{"id":"wordfence:efa646ee-ebee-4528-a421-09ee3dc8275a","source":"wordfence","cve":"CVE-2024-43251","title":"Bit Form Pro <= 2.6.4 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa646ee-ebee-4528-a421-09ee3dc8275a?source=api-prod","affected":[{"type":"plugin","slug":"bitformpro","name":"Bit Form Pro","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.8.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-12T14:42:10Z"},{"id":"wordfence:efa65940-1a46-4a91-be8f-689d2addeabd","source":"wordfence","cve":"CVE-2026-28058","title":"Dixon <= 1.4.2.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa65940-1a46-4a91-be8f-689d2addeabd?source=api-prod","affected":[{"type":"theme","slug":"dixon","name":"Dixon & Lamber","from":"*","from_inclusive":true,"to":"1.4.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:19:07Z"},{"id":"wordfence:efa7ce77-45dc-4fe4-b759-c80f3f18c594","source":"wordfence","cve":"CVE-2025-28869","title":"NextGEN Gallery Voting <= 2.7.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa7ce77-45dc-4fe4-b759-c80f3f18c594?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery-voting","name":"NextGEN Gallery Voting","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:39:07Z"},{"id":"wordfence:efa9b44d-8b6c-4a11-82af-cecc2c202024","source":"wordfence","cve":"CVE-2025-14391","title":"Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efa9b44d-8b6c-4a11-82af-cecc2c202024?source=api-prod","affected":[{"type":"plugin","slug":"simple-theme-changer","name":"Simple Theme Changer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:06:58Z","updated":"2025-12-12T03:21:02Z"},{"id":"wordfence:efab7ec7-7143-4556-8d68-4a7e34f46e9e","source":"wordfence","cve":"CVE-2023-41685","title":"Woocommerce Support System <= 1.2.1 - Authenticated (Administrator+) SQL Injection via 'orderby'","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efab7ec7-7143-4556-8d68-4a7e34f46e9e?source=api-prod","affected":[{"type":"plugin","slug":"wc-support-system","name":"ilGhera Support System for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2023-09-04T00:00:00Z","updated":"2024-05-15T17:54:05Z"},{"id":"wordfence:efac70f6-d959-41f7-bdef-d554f1c9133e","source":"wordfence","cve":"CVE-2024-4490","title":"Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efac70f6-d959-41f7-bdef-d554f1c9133e?source=api-prod","affected":[{"type":"plugin","slug":"divi-builder","name":"Divi Builder","from":"*","from_inclusive":true,"to":"4.25.0","to_inclusive":true,"patched_in":"4.25.1"},{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.25.0","to_inclusive":true,"patched_in":"4.25.1"},{"type":"theme","slug":"extra","name":"Divi Extra","from":"*","from_inclusive":true,"to":"4.25.0","to_inclusive":true,"patched_in":"4.25.1"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-10T11:03:00Z"},{"id":"wordfence:efacb174-5eb6-4a58-bd76-8111031bbd4d","source":"wordfence","cve":"CVE-2022-4497","title":"Jetpack CRM <= 5.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efacb174-5eb6-4a58-bd76-8111031bbd4d?source=api-prod","affected":[{"type":"plugin","slug":"zero-bs-crm","name":"Jetpack CRM \u2013 Clients, Leads, Invoices, Billing, Email Marketing, & Automation","from":"*","from_inclusive":true,"to":"5.4.4","to_inclusive":true,"patched_in":"5.5"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efadd529-f369-4c7a-ab71-170e72c997f1","source":"wordfence","cve":"CVE-2023-32739","title":"WP Custom Cursors < 3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efadd529-f369-4c7a-ab71-170e72c997f1?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cursors","name":"WP Custom Cursors | WordPress Cursor Plugin","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":false,"patched_in":"3.2"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efaef405-9721-4fb6-bcb4-4bd4f78742fd","source":"wordfence","cve":"CVE-2023-1426","title":"WP Tiles <= 1.1.2 - Authenticated(Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efaef405-9721-4fb6-bcb4-4bd4f78742fd?source=api-prod","affected":[{"type":"plugin","slug":"wp-tiles","name":"WP Tiles","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efaf589c-a808-4263-9734-3b335b06e7ca","source":"wordfence","cve":"CVE-2025-23573","title":"WP Background Tile <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efaf589c-a808-4263-9734-3b335b06e7ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-background-tile","name":"WP Background Tile","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:55:05Z"},{"id":"wordfence:efb0c7d9-0e93-404b-9032-54d64cfcd4c3","source":"wordfence","cve":"CVE-2024-29801","title":"Fullscreen Galleria <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb0c7d9-0e93-404b-9032-54d64cfcd4c3?source=api-prod","affected":[{"type":"plugin","slug":"fullscreen-galleria","name":"Fullscreen Galleria","from":"*","from_inclusive":true,"to":"1.6.11","to_inclusive":true,"patched_in":"1.6.12"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T13:01:15Z"},{"id":"wordfence:efb1c2fa-0f8b-4221-ba13-3b94319b3c89","source":"wordfence","cve":"CVE-2024-51897","title":"News Articles <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb1c2fa-0f8b-4221-ba13-3b94319b3c89?source=api-prod","affected":[{"type":"plugin","slug":"news-articles","name":"News Articles","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:46:30Z"},{"id":"wordfence:efb37c6a-e1a0-4960-b53a-858b22b6e706","source":"wordfence","cve":"CVE-2018-5316","title":"SagePay Server Gateway for WooCommerce < 1.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb37c6a-e1a0-4960-b53a-858b22b6e706?source=api-prod","affected":[{"type":"plugin","slug":"sagepay-server-gateway-for-woocommerce","name":"SagePay Server Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":false,"patched_in":"1.0.9"}],"published":"2017-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efb48ce2-23e6-4c48-a35b-1c42e5fb0aa5","source":"wordfence","cve":"CVE-2024-55987","title":"Advanced What should we write next about <= 1.0.3 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb48ce2-23e6-4c48-a35b-1c42e5fb0aa5?source=api-prod","affected":[{"type":"plugin","slug":"advanced-what-should-we-write-about-next","name":"Advanced What should we write next about","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T13:57:37Z"},{"id":"wordfence:efb692da-6878-420a-b16e-2cb871bef764","source":"wordfence","cve":"CVE-2021-24732","title":"PDF Flipbook, 3D Flipbook WordPress \u2013 DearFlip Lite <= 1.7.12 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb692da-6878-420a-b16e-2cb871bef764?source=api-prod","affected":[{"type":"plugin","slug":"3d-flipbook-dflip-lite","name":"DearFlip \u2013 PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer","from":"*","from_inclusive":true,"to":"1.7.12","to_inclusive":true,"patched_in":"1.7.13"}],"published":"2021-09-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efb6fc8e-5eed-4751-881f-0600c817ba6a","source":"wordfence","cve":"CVE-2026-24604","title":"Simple GDPR Cookie Compliance <= 2.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb6fc8e-5eed-4751-881f-0600c817ba6a?source=api-prod","affected":[{"type":"plugin","slug":"simple-gdpr-cookie-compliance","name":"Simple GDPR Cookie Compliance","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-01-14T08:16:26Z","updated":"2026-02-25T14:39:00Z"},{"id":"wordfence:efb816e4-c07f-4e72-bfd3-06d83ed4d642","source":"wordfence","cve":"CVE-2024-2458","title":"Powerkit \u2013 Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efb816e4-c07f-4e72-bfd3-06d83ed4d642?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-06T07:34:56Z"},{"id":"wordfence:efba2017-67bd-40e0-a676-d043de361d08","source":"wordfence","cve":"CVE-2025-49064","title":"User Language Switch <= 1.6.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efba2017-67bd-40e0-a676-d043de361d08?source=api-prod","affected":[{"type":"plugin","slug":"user-language-switch","name":"User Language Switch","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:40:03Z"},{"id":"wordfence:efbbb33d-28ed-47f4-a8dd-2fc7564d9df2","source":"wordfence","cve":"CVE-2024-12445","title":"RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbbb33d-28ed-47f4-a8dd-2fc7564d9df2?source=api-prod","affected":[{"type":"plugin","slug":"rightmessage","name":"RightMessage WP","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T16:20:43Z","updated":"2025-01-07T04:22:23Z"},{"id":"wordfence:efbcac1c-854c-4521-848a-d403bc27328f","source":"wordfence","cve":"CVE-2023-0147","title":"Flexible Captcha <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbcac1c-854c-4521-848a-d403bc27328f?source=api-prod","affected":[{"type":"plugin","slug":"flexible-captcha","name":"Flexible Captcha","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efbdf0f0-6b38-418c-b3fb-396f89ada34f","source":"wordfence","cve":"CVE-2025-12885","title":"Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=api-prod","affected":[{"type":"plugin","slug":"embed-any-document","name":"Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files","from":"*","from_inclusive":true,"to":"2.7.10","to_inclusive":true,"patched_in":"2.7.11"}],"published":"2025-12-17T13:41:06Z","updated":"2025-12-18T01:51:13Z"},{"id":"wordfence:efbea599-3d04-42d2-9b91-6b68210d8b01","source":"wordfence","cve":"","title":"Appius Theme <= 1.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbea599-3d04-42d2-9b91-6b68210d8b01?source=api-prod","affected":[{"type":"theme","slug":"appius","name":"appius","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2014-03-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efbeb55e-eac5-4fc4-b2ac-0f017f48106a","source":"wordfence","cve":"CVE-2026-93949","title":"Grocery Shopping Store <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbeb55e-eac5-4fc4-b2ac-0f017f48106a?source=api-prod","affected":[{"type":"theme","slug":"grocery-shopping-store","name":"Grocery Shopping Store","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-10-08T00:00:00Z","updated":"2026-11-03T22:47:34Z"},{"id":"wordfence:efbecb4b-fc41-4719-be5e-af11b47ff683","source":"wordfence","cve":"CVE-2019-15871","title":"LoginPress | Custom Login Page Customizer <= 1.1.13 - Unauthorized Settings Update","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbecb4b-fc41-4719-be5e-af11b47ff683?source=api-prod","affected":[{"type":"plugin","slug":"loginpress","name":"LoginPress | wp-login Custom Login Page Customizer","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.14"}],"published":"2019-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efbf83d9-ce5e-4139-ba12-b00df4d9ad89","source":"wordfence","cve":"CVE-2024-4462","title":"Nafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efbf83d9-ce5e-4139-ba12-b00df4d9ad89?source=api-prod","affected":[{"type":"plugin","slug":"nafeza-prayer-time","name":"Nafeza Prayer Time","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T17:14:32Z","updated":"2024-06-04T05:32:17Z"},{"id":"wordfence:efc2a21d-b6f9-405d-a9a0-779a736e5d94","source":"wordfence","cve":"CVE-2018-6195","title":"Splashing Images <= 2.1 - PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc2a21d-b6f9-405d-a9a0-779a736e5d94?source=api-prod","affected":[{"type":"plugin","slug":"wp-splashing-images","name":"Splashing Images","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2018-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efc2baf0-38d9-44be-b439-3585b2f1d4a5","source":"wordfence","cve":"CVE-2025-8615","title":"CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc2baf0-38d9-44be-b439-3585b2f1d4a5?source=api-prod","affected":[{"type":"plugin","slug":"cubewp-framework","name":"CubeWP Framework","from":"*","from_inclusive":true,"to":"1.1.26","to_inclusive":true,"patched_in":"1.1.27"}],"published":"2026-01-16T19:29:36Z","updated":"2026-01-17T08:24:32Z"},{"id":"wordfence:efc2e391-c8d1-48c7-af53-ff6b91373325","source":"wordfence","cve":"CVE-2025-22278","title":"Whitish Lite <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc2e391-c8d1-48c7-af53-ff6b91373325?source=api-prod","affected":[{"type":"theme","slug":"whitish-lite","name":"Whitish Lite","from":"*","from_inclusive":true,"to":"2.1.13","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:45:48Z"},{"id":"wordfence:efc434fd-320a-4808-9289-7c2f63d4f5a4","source":"wordfence","cve":"","title":"SMTP Mail <= 1.2.1 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc434fd-320a-4808-9289-7c2f63d4f5a4?source=api-prod","affected":[{"type":"plugin","slug":"smtp-mail","name":"SMTP Mail","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efc53d78-a664-48d0-a752-00c56b3f792f","source":"wordfence","cve":"","title":"No CAPTCHA reCAPTCHA for WooCommerce <= 1.2.6 - Missing Authorization to Notification Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc53d78-a664-48d0-a752-00c56b3f792f?source=api-prod","affected":[{"type":"plugin","slug":"no-captcha-recaptcha-for-woocommerce","name":"No CAPTCHA reCAPTCHA for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efc7ad9f-714e-474c-87e8-ecbbdfabd550","source":"wordfence","cve":"CVE-2025-3064","title":"WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efc7ad9f-714e-474c-87e8-ecbbdfabd550?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-user-role-editor","name":"WPFront User Role Editor","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-04-07T19:49:38Z","updated":"2025-04-08T08:22:10Z"},{"id":"wordfence:efca1ee2-2038-440e-941c-22533b4d833b","source":"wordfence","cve":"CVE-2024-12334","title":"WC Affiliate \u2013 A Complete WooCommerce Affiliate Plugin <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efca1ee2-2038-440e-941c-22533b4d833b?source=api-prod","affected":[{"type":"plugin","slug":"wc-affiliate","name":"WC Affiliate \u2013 WooCommerce Affiliate Plugin","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T11:09:46Z"},{"id":"wordfence:efcf88af-9c65-4825-a248-9c29eec7031b","source":"wordfence","cve":"CVE-2025-62091","title":"Serial Codes Generator and Validator with WooCommerce Support <= 2.8.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efcf88af-9c65-4825-a248-9c29eec7031b?source=api-prod","affected":[{"type":"plugin","slug":"serial-codes-generator-and-validator","name":"Serial Codes Generator and Validator with WooCommerce Support","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-08T21:44:13Z"},{"id":"wordfence:efd18739-3cd1-486c-9587-8deba5a0940e","source":"wordfence","cve":"CVE-2026-2288","title":"myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd18739-3cd1-486c-9587-8deba5a0940e?source=api-prod","affected":[{"type":"plugin","slug":"mylinksdump","name":"myLinksDump","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T20:46:05Z","updated":"2026-05-27T09:27:31Z"},{"id":"wordfence:efd1f2b4-6afa-4828-933b-6b390672f7c9","source":"wordfence","cve":"CVE-2019-25315","title":"Server Log Viewer <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd1f2b4-6afa-4828-933b-6b390672f7c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-server-log-viewer","name":"WP Server Log Viewer","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2019-09-10T00:00:00Z","updated":"2026-02-16T22:21:21Z"},{"id":"wordfence:efd25f74-3c4a-4f5a-8c81-f1d42ca2a541","source":"wordfence","cve":"CVE-2013-7480","title":"Events Manager <= 5.3.6 - Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd25f74-3c4a-4f5a-8c81-f1d42ca2a541?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.3.6","to_inclusive":true,"patched_in":"5.3.6.1"}],"published":"2013-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efd27466-f68e-4d8a-a1ec-90dbb6ff126b","source":"wordfence","cve":"CVE-2024-12386","title":"WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd27466-f68e-4d8a-a1ec-90dbb6ff126b?source=api-prod","affected":[{"type":"plugin","slug":"wp-abstracts-manuscripts-manager","name":"WP Abstracts","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2025-02-11T21:25:30Z","updated":"2025-02-12T11:11:18Z"},{"id":"wordfence:efd279c2-9e95-45bd-9494-fb53a6333c65","source":"wordfence","cve":"CVE-2024-7781","title":"Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd279c2-9e95-45bd-9494-fb53a6333c65?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"4.7.8"}],"published":"2024-09-25T16:13:20Z","updated":"2024-09-26T04:30:00Z"},{"id":"wordfence:efd3031f-686a-42a0-bf18-d0e8618c9a5e","source":"wordfence","cve":"CVE-2024-10027","title":"WP Booking Calendar <= 10.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd3031f-686a-42a0-bf18-d0e8618c9a5e?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.6.2","to_inclusive":true,"patched_in":"10.6.3"}],"published":"2024-10-17T00:00:00Z","updated":"2024-11-15T17:49:38Z"},{"id":"wordfence:efd49905-0f2c-44b7-85c6-c2b77440ac17","source":"wordfence","cve":"CVE-2024-12459","title":"Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd49905-0f2c-44b7-85c6-c2b77440ac17?source=api-prod","affected":[{"type":"plugin","slug":"ganohrs-toggle-shortcode","name":"Ganohrs Toggle Shortcode","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":true,"patched_in":"0.2.5"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:16Z"},{"id":"wordfence:efd5ce76-2f93-45f9-9822-b0f8b6fcff0b","source":"wordfence","cve":"CVE-2025-9855","title":"Enhanced BibliPlug <= 1.3.8 - Authenticated (Contirbutor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd5ce76-2f93-45f9-9822-b0f8b6fcff0b?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-bibliplug","name":"Enhanced BibliPlug","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:44:54Z","updated":"2025-09-11T07:25:02Z"},{"id":"wordfence:efd81ba5-b9e6-493a-a6a4-55c9e2971378","source":"wordfence","cve":"CVE-2017-18579","title":"Corner Ad < 1.0.8 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efd81ba5-b9e6-493a-a6a4-55c9e2971378?source=api-prod","affected":[{"type":"plugin","slug":"corner-ad","name":"Corner Ad","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2017-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efdb6ec5-e6a8-4279-b637-38267a852472","source":"wordfence","cve":"CVE-2025-10196","title":"SurveyAnyplace Plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efdb6ec5-e6a8-4279-b637-38267a852472?source=api-prod","affected":[{"type":"plugin","slug":"surveyanyplace","name":"Survey Anyplace","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:24:47Z","updated":"2025-09-30T03:35:33Z"},{"id":"wordfence:efdc3712-24cb-4a3a-85d1-0c32a8a1200b","source":"wordfence","cve":"CVE-2026-62064","title":"Ambed <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efdc3712-24cb-4a3a-85d1-0c32a8a1200b?source=api-prod","affected":[{"type":"theme","slug":"ambed","name":"Ambed - Wallpapers & Painting Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:33:55Z"},{"id":"wordfence:efdeca40-e021-478f-af75-c5566ae70735","source":"wordfence","cve":"CVE-2024-13803","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efdeca40-e021-478f-af75-c5566ae70735?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2025-02-25T00:00:00Z","updated":"2025-02-26T07:01:19Z"},{"id":"wordfence:efdf76b2-7640-4384-a72b-789159eb9c86","source":"wordfence","cve":"","title":"Watu Quiz <= 2.5.0.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efdf76b2-7640-4384-a72b-789159eb9c86?source=api-prod","affected":[{"type":"plugin","slug":"watu","name":"Watu Quiz","from":"*","from_inclusive":true,"to":"2.5.0.1","to_inclusive":true,"patched_in":"2.5.0.2"}],"published":"2014-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efe4223a-5c1a-401e-a46b-0278e96d2d71","source":"wordfence","cve":"CVE-2026-11990","title":"KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe4223a-5c1a-401e-a46b-0278e96d2d71?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-09T20:52:40Z","updated":"2026-07-10T09:32:45Z"},{"id":"wordfence:efe48adb-af9f-45dc-b693-ae56dce1bfe2","source":"wordfence","cve":"CVE-2025-12078","title":"ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe48adb-af9f-45dc-b693-ae56dce1bfe2?source=api-prod","affected":[{"type":"plugin","slug":"artibot","name":"ArtiBot Free Chat Bot for WebSites","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:13:26Z","updated":"2025-11-18T08:27:37Z"},{"id":"wordfence:efe57241-2bb3-41d1-8638-b69ceaff0b4f","source":"wordfence","cve":"CVE-2026-7523","title":"Alba Board <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe57241-2bb3-41d1-8638-b69ceaff0b4f?source=api-prod","affected":[{"type":"plugin","slug":"alba-board","name":"Task & Project Management \u2013 Alba Board","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-06-05T10:26:41Z","updated":"2026-06-05T22:28:07Z"},{"id":"wordfence:efe6c4aa-5e5d-4e3b-8a38-f85e163a9e00","source":"wordfence","cve":"CVE-2019-9567","title":"Forminator Plugin <= 1.5.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe6c4aa-5e5d-4e3b-8a38-f85e163a9e00?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2019-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efe6d975-310d-4286-af2a-e599990e3b0b","source":"wordfence","cve":"CVE-2024-29933","title":"Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe6d975-310d-4286-af2a-e599990e3b0b?source=api-prod","affected":[{"type":"plugin","slug":"icon","name":"Web Icons","from":"*","from_inclusive":true,"to":"1.0.0.10","to_inclusive":true,"patched_in":"1.0.0.11"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:04:29Z"},{"id":"wordfence:efe7c5d6-80ee-4214-b179-805df79ce1fc","source":"wordfence","cve":"CVE-2025-49997","title":"Giveaways and Contests by RafflePress <= 1.12.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe7c5d6-80ee-4214-b179-805df79ce1fc?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.18","to_inclusive":true,"patched_in":"1.12.19"}],"published":"2025-06-19T00:00:00Z","updated":"2026-01-27T21:05:32Z"},{"id":"wordfence:efe832cc-d097-41e4-a856-16f19a735358","source":"wordfence","cve":"CVE-2026-1915","title":"Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe832cc-d097-41e4-a856-16f19a735358?source=api-prod","affected":[{"type":"plugin","slug":"simple-plyr","name":"Simple Plyr","from":"*","from_inclusive":true,"to":"0.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:13:38Z","updated":"2026-02-14T06:42:37Z"},{"id":"wordfence:efe846aa-6de2-40f0-81c6-f7ca98a55f23","source":"wordfence","cve":"CVE-2024-55998","title":"Popup Surveys & Polls for WordPress (Mare.io)  <= 1.36 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe846aa-6de2-40f0-81c6-f7ca98a55f23?source=api-prod","affected":[{"type":"plugin","slug":"popup-surveys","name":"Popup Surveys & Polls for WordPress (Mare.io)","from":"*","from_inclusive":true,"to":"1.36","to_inclusive":true,"patched_in":""}],"published":"2024-12-14T00:00:00Z","updated":"2025-01-17T13:47:30Z"},{"id":"wordfence:efe86e10-c7ac-456b-b324-7e028562ff9f","source":"wordfence","cve":"CVE-2026-32482","title":"Ona < 1.24 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe86e10-c7ac-456b-b324-7e028562ff9f?source=api-prod","affected":[{"type":"theme","slug":"ona","name":"Ona","from":"*","from_inclusive":true,"to":"1.24","to_inclusive":false,"patched_in":"1.24"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:12:49Z"},{"id":"wordfence:efe898d3-56c2-4242-8416-49658ae2b8f6","source":"wordfence","cve":"CVE-2024-51646","title":"Saoshyant Element <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe898d3-56c2-4242-8416-49658ae2b8f6?source=api-prod","affected":[{"type":"plugin","slug":"saoshyant-element","name":"Saoshyant Element","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-16T00:00:00Z","updated":"2025-01-08T14:34:10Z"},{"id":"wordfence:efe9ca48-b6df-4a2d-8713-d8b21f6c9701","source":"wordfence","cve":"CVE-2024-49317","title":"Point Maker <= 0.1.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efe9ca48-b6df-4a2d-8713-d8b21f6c9701?source=api-prod","affected":[{"type":"plugin","slug":"point-maker","name":"Point Maker","from":"*","from_inclusive":true,"to":"0.1.4","to_inclusive":true,"patched_in":"0.1.5"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:47:29Z"},{"id":"wordfence:efee685c-e2cd-471b-aea9-607124df6006","source":"wordfence","cve":"CVE-2026-4977","title":"UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efee685c-e2cd-471b-aea9-607124df6006?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.58","to_inclusive":true,"patched_in":"1.2.59"}],"published":"2026-04-09T12:42:34Z","updated":"2026-04-10T01:25:00Z"},{"id":"wordfence:eff03dbc-1bb7-4a72-b57c-f1bde966c286","source":"wordfence","cve":"CVE-2023-51512","title":"Product Table by WBW <= 1.8.6 - Cross-Site Request Forgery via saveGroup","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff03dbc-1bb7-4a72-b57c-f1bde966c286?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-tables","name":"Product Table for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eff47e59-9a2c-424f-b138-47fcf554c06b","source":"wordfence","cve":"","title":"Crayon Syntax Highlighter Plugin <= 1.13 - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff47e59-9a2c-424f-b138-47fcf554c06b?source=api-prod","affected":[{"type":"plugin","slug":"crayon-syntax-highlighter","name":"Crayon Syntax Highlighter","from":"*","from_inclusive":true,"to":"1.13","to_inclusive":true,"patched_in":"1.14"}],"published":"2012-10-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eff4cb35-492b-448a-8d16-b9210917c567","source":"wordfence","cve":"CVE-2023-49850","title":"WP Simple HTML Sitemap <= 2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff4cb35-492b-448a-8d16-b9210917c567?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"2.7","to_inclusive":true,"patched_in":"2.8"}],"published":"2023-12-07T00:00:00Z","updated":"2024-03-28T23:42:56Z"},{"id":"wordfence:eff765b4-22d1-4311-8a69-af6b41ef4b6e","source":"wordfence","cve":"CVE-2024-8442","title":"Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff765b4-22d1-4311-8a69-af6b41ef4b6e?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-prime-slider-lite","name":"Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons","from":"*","from_inclusive":true,"to":"3.15.18","to_inclusive":true,"patched_in":"3.15.19"}],"published":"2024-11-06T23:53:50Z","updated":"2024-11-07T12:30:53Z"},{"id":"wordfence:eff83c19-c223-4f70-affc-adb0f560264a","source":"wordfence","cve":"CVE-2023-4460","title":"Uploading SVG, WEBP and ICO files <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff83c19-c223-4f70-affc-adb0f560264a?source=api-prod","affected":[{"type":"plugin","slug":"uploading-svgwebp-and-ico-files","name":"Uploading SVG, WEBP and ICO files","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:eff9fcce-01b2-4698-a2c2-ee5991bfd963","source":"wordfence","cve":"CVE-2021-25026","title":"Patreon WordPress <= 1.8.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eff9fcce-01b2-4698-a2c2-ee5991bfd963?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2022-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:effd72d2-876d-4f8d-b1e4-5ab38eab401b","source":"wordfence","cve":"CVE-2022-4949","title":"AdSanity < 1.8.2 - Authenticated Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/effd72d2-876d-4f8d-b1e4-5ab38eab401b?source=api-prod","affected":[{"type":"plugin","slug":"adsanity","name":"AdSanity","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":false,"patched_in":"1.8.2"}],"published":"2022-01-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:efff81ea-b88e-4f51-b8db-1f8255e7736a","source":"wordfence","cve":"CVE-2024-49699","title":"ARPrice <= 4.1.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/efff81ea-b88e-4f51-b8db-1f8255e7736a?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-03T00:00:00Z","updated":"2026-02-26T15:03:55Z"},{"id":"wordfence:f00015e7-f669-451e-a614-17aa12843bf3","source":"wordfence","cve":"CVE-2025-39569","title":"Taskbuilder <= 4.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00015e7-f669-451e-a614-17aa12843bf3?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T19:28:05Z"},{"id":"wordfence:f002d061-4e9d-49be-9d4c-c470ec97f653","source":"wordfence","cve":"CVE-2022-44630","title":"YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f002d061-4e9d-49be-9d4c-c470ec97f653?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-bulk-product-editing","name":"YITH WooCommerce Bulk Product Editing","from":"*","from_inclusive":true,"to":"1.2.27","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-zoom-magnifier","name":"YITH WooCommerce Product Gallery & Image Zoom","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"},{"type":"plugin","slug":"yith-woocommerce-popup","name":"YITH WooCommerce Popup","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-badges-management","name":"YITH WooCommerce Badge Management","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.11.0"},{"type":"plugin","slug":"yith-woocommerce-product-add-ons","name":"YITH WooCommerce Product Add-Ons","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.16.0"},{"type":"plugin","slug":"yith-woocommerce-tab-manager","name":"YITH WooCommerce Tab Manager","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.17.1"},{"type":"plugin","slug":"yith-woocommerce-questions-and-answers","name":"YITH WooCommerce Questions and Answers","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-authorizenet-payment-gateway","name":"YITH WooCommerce Authorize.net Payment Gateway","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-name-your-price","name":"YITH WooCommerce Name Your Price","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-order-tracking","name":"YITH WooCommerce Order & Shipment Tracking","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"yith-woocommerce-cart-messages","name":"YITH WooCommerce Cart Messages","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-subscription","name":"YITH WooCommerce Subscription","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"},{"type":"plugin","slug":"yith-paypal-express-checkout-for-woocommerce","name":"YITH PayPal Express Checkout for WooCommerce","from":"*","from_inclusive":true,"to":"1.20.0","to_inclusive":true,"patched_in":"1.20.1"},{"type":"plugin","slug":"yith-woocommerce-ajax-navigation","name":"YITH WooCommerce Ajax Product Filter","from":"*","from_inclusive":true,"to":"4.15.0","to_inclusive":true,"patched_in":"4.16.0"},{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"3.14.0","to_inclusive":true,"patched_in":"3.15.0"},{"type":"plugin","slug":"yith-woocommerce-stripe","name":"YITH WooCommerce Stripe","from":"*","from_inclusive":true,"to":"2.0.17","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-custom-thank-you-page-for-woocommerce","name":"YITH Custom Thank You Page for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-donations-for-woocommerce","name":"YITH Donations for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"2.20.0","to_inclusive":true,"patched_in":"2.20.1"},{"type":"plugin","slug":"yith-color-and-label-variations-for-woocommerce","name":"YITH Color and Label Variations for WooCommerce","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":true,"patched_in":"1.25.1"},{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"1.25.0","to_inclusive":true,"patched_in":"1.25.1"},{"type":"plugin","slug":"yith-essential-kit-for-woocommerce-1","name":"YITH Essential Kit for WooCommerce #1","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":"2.14.0"},{"type":"plugin","slug":"yith-woocommerce-mailchimp","name":"YITH WooCommerce Mailchimp","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-infinite-scrolling","name":"YITH Infinite Scrolling","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.8.0"},{"type":"plugin","slug":"yith-woocommerce-product-vendors","name":"YITH WooCommerce Multi Vendor","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-pre-order-for-woocommerce","name":"YITH Pre-Order for WooCommerce","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"yith-woocommerce-product-bundles","name":"YITH WooCommerce Product Bundles","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.17.0"},{"type":"plugin","slug":"yith-woocommerce-request-a-quote","name":"YITH Request a Quote for WooCommerce","from":"*","from_inclusive":true,"to":"2.15.0","to_inclusive":true,"patched_in":"2.15.1"},{"type":"plugin","slug":"yith-woocommerce-waiting-list","name":"YITH WooCommerce Waitlist","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-pdf-invoice","name":"YITH WooCommerce PDF Invoice and Shipping List","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-category-accordion","name":"YITH WooCommerce Category Accordion","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-brands-add-on","name":"YITH WooCommerce Brands Add-On","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"},{"type":"plugin","slug":"yith-woocommerce-gift-cards","name":"YITH WooCommerce Gift Cards","from":"*","from_inclusive":true,"to":"2.14.0","to_inclusive":true,"patched_in":"2.15.0"},{"type":"plugin","slug":"yith-paypal-payments-for-woocommerce","name":"YITH PayPal Payments for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-points-and-rewards","name":"YITH WooCommerce Points and Rewards","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-multi-step-checkout","name":"YITH WooCommerce Multi-step Checkout","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-added-to-cart-popup","name":"YITH WooCommerce Added to Cart Popup","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-product-slider-carousel","name":"YITH WooCommerce Product Slider Carousel","from":"*","from_inclusive":true,"to":"1.16.0","to_inclusive":true,"patched_in":"1.16.1"},{"type":"plugin","slug":"yith-woocommerce-catalog-mode","name":"YITH WooCommerce Catalog Mode","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"},{"type":"plugin","slug":"yith-woocommerce-affiliates","name":"YITH WooCommerce Affiliates","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.8.0"},{"type":"plugin","slug":"yith-woocommerce-quick-view","name":"YITH WooCommerce Quick View","from":"*","from_inclusive":true,"to":"1.21.0","to_inclusive":true,"patched_in":"1.21.1"},{"type":"plugin","slug":"yith-woocommerce-advanced-reviews","name":"YITH WooCommerce Advanced Reviews","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yith-woocommerce-frequently-bought-together","name":"YITH Frequently Bought Together for WooCommerce","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.19.1"},{"type":"plugin","slug":"yith-woocommerce-featured-video","name":"YITH WooCommerce Featured Video","from":"*","from_inclusive":true,"to":"1.18.0","to_inclusive":true,"patched_in":"1.18.1"},{"type":"plugin","slug":"yith-woocommerce-social-login","name":"YITH WooCommerce Social Login","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":""}],"published":"2022-11-11T00:00:00Z","updated":"2024-05-20T13:22:53Z"},{"id":"wordfence:f002e61b-7395-4ba7-8695-da17cfc001cc","source":"wordfence","cve":"CVE-2021-36828","title":"WP Maintenance <= 6.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f002e61b-7395-4ba7-8695-da17cfc001cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance","name":"WP Maintenance","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2022-04-15T12:44:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f004c401-6b71-413c-bbbd-229b6ddfffe4","source":"wordfence","cve":"","title":"Zingiri Tickets <= 3.0.3 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f004c401-6b71-413c-bbbd-229b6ddfffe4?source=api-prod","affected":[{"type":"plugin","slug":"zingiri-tickets","name":"Support Tickets Center","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2012-04-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f006bb33-d017-445b-9c02-bd848c199671","source":"wordfence","cve":"CVE-2024-5147","title":"WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f006bb33-d017-445b-9c02-bd848c199671?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.1.37","to_inclusive":true,"patched_in":"1.1.38"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-22T07:37:26Z"},{"id":"wordfence:f00761a7-fe24-49a3-b3e3-a471e05815c1","source":"wordfence","cve":"CVE-2023-2732","title":"MStore API <= 3.9.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00761a7-fe24-49a3-b3e3-a471e05815c1?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":true,"patched_in":"3.9.3"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f00763e2-f5a0-495b-949d-0012f278d4ed","source":"wordfence","cve":"CVE-2026-27433","title":"Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.80 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00763e2-f5a0-495b-949d-0012f278d4ed?source=api-prod","affected":[{"type":"theme","slug":"motors","name":"Motors - Car Dealer, Rental & Listing WordPress theme","from":"*","from_inclusive":true,"to":"5.6.80","to_inclusive":true,"patched_in":""}],"published":"2026-06-30T00:00:00Z","updated":"2026-07-16T18:43:43Z"},{"id":"wordfence:f0077624-c111-468f-ae24-d730642b676c","source":"wordfence","cve":"CVE-2025-62022","title":"BuddyPress <= 14.3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0077624-c111-468f-ae24-d730642b676c?source=api-prod","affected":[{"type":"plugin","slug":"buddypress","name":"BuddyPress","from":"*","from_inclusive":true,"to":"14.3.4","to_inclusive":true,"patched_in":"14.4.0"}],"published":"2025-09-27T00:00:00Z","updated":"2025-10-29T16:23:47Z"},{"id":"wordfence:f008d502-e554-489d-bb97-fed18fa6547d","source":"wordfence","cve":"CVE-2025-24588","title":"Patreon WordPress <= 1.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f008d502-e554-489d-bb97-fed18fa6547d?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:35:06Z"},{"id":"wordfence:f00a12ed-d8c2-40b2-b0c8-71507469ee95","source":"wordfence","cve":"CVE-2015-2084","title":"Easy Social Icons <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00a12ed-d8c2-40b2-b0c8-71507469ee95?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2015-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f00ac468-870a-4c43-af25-9febea5e4d67","source":"wordfence","cve":"CVE-2024-11709","title":"AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00ac468-870a-4c43-af25-9febea5e4d67?source=api-prod","affected":[{"type":"plugin","slug":"ai-post-generator","name":"AI Post Generator | AutoWriter","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:25:24Z","updated":"2024-12-12T04:23:16Z"},{"id":"wordfence:f00b2602-b9ab-4f4a-a19e-5c2a98c232e3","source":"wordfence","cve":"CVE-2015-2196","title":"SpiderCalendar <= 1.4.9 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00b2602-b9ab-4f4a-a19e-5c2a98c232e3?source=api-prod","affected":[{"type":"plugin","slug":"spider-event-calendar","name":"SpiderCalendar","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":false,"patched_in":"1.4.10"}],"published":"2015-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f00ca075-cbf0-428b-a53b-dc723889f69b","source":"wordfence","cve":"CVE-2024-43927","title":"Email Address Encoder <= 1.0.23 - Cross-Site Request Forgery via eae_clear_caches()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00ca075-cbf0-428b-a53b-dc723889f69b?source=api-prod","affected":[{"type":"plugin","slug":"email-address-encoder","name":"Email Address Encoder","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T19:53:21Z"},{"id":"wordfence:f00cdef3-d733-4e85-8099-204ef76096b4","source":"wordfence","cve":"CVE-2022-4207","title":"Image Hover Effects Ultimate 9.8.1 - 9.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"9.8.1","from_inclusive":true,"to":"9.8.4","to_inclusive":true,"patched_in":"9.8.5"}],"published":"2022-12-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f00e8169-3b8f-44a0-9af2-e81777a913f8","source":"wordfence","cve":"CVE-2024-4902","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00e8169-3b8f-44a0-9af2-e81777a913f8?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-06-06T15:55:08Z","updated":"2024-07-02T14:07:30Z"},{"id":"wordfence:f00eeaef-f277-481f-9e18-bf1ced0015a0","source":"wordfence","cve":"CVE-2022-0888","title":"Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00eeaef-f277-481f-9e18-bf1ced0015a0?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms-uploads","name":"Ninja Forms - File Uploads","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2020-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f00ef5c1-1025-489c-a294-a87e10afde2b","source":"wordfence","cve":"CVE-2023-0079","title":"Customer Reviews for WooCommerce <= 5.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f00ef5c1-1025-489c-a294-a87e10afde2b?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.16.0","to_inclusive":true,"patched_in":"5.17.0"}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f01071a6-4188-4cb4-9aa5-731b32c6960e","source":"wordfence","cve":"CVE-2025-29010","title":"Behance Portfolio Manager <= 1.7.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01071a6-4188-4cb4-9aa5-731b32c6960e?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-06-05T00:00:00Z","updated":"2026-09-16T17:29:38Z"},{"id":"wordfence:f01302aa-00ef-440a-9c37-4fde6bb4bb4d","source":"wordfence","cve":"CVE-2026-12000","title":"Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01302aa-00ef-440a-9c37-4fde6bb4bb4d?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-08-04T18:21:36Z","updated":"2026-08-05T06:38:02Z"},{"id":"wordfence:f01362dc-4f3d-4b77-b802-01b436287237","source":"wordfence","cve":"CVE-2024-13404","title":"Link Library <= 7.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01362dc-4f3d-4b77-b802-01b436287237?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.7.2","to_inclusive":true,"patched_in":"7.7.3"}],"published":"2025-01-20T00:00:00Z","updated":"2025-01-21T09:21:11Z"},{"id":"wordfence:f015ff9b-a7dc-47de-83d4-d6b91ec433f7","source":"wordfence","cve":"CVE-2024-6661","title":"ParityPress <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f015ff9b-a7dc-47de-83d4-d6b91ec433f7?source=api-prod","affected":[{"type":"plugin","slug":"paritypress","name":"ParityPress \u2013 Parity Pricing with Discount Rules","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-07-26T13:05:09Z","updated":"2024-10-25T20:34:14Z"},{"id":"wordfence:f01618d8-85c8-4696-ab2e-cb6ac1b3530f","source":"wordfence","cve":"CVE-2025-26972","title":"Private Content  <= 8.11.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01618d8-85c8-4696-ab2e-cb6ac1b3530f?source=api-prod","affected":[{"type":"plugin","slug":"private-content","name":"Private Content","from":"*","from_inclusive":true,"to":"8.11.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-04-21T15:30:30Z"},{"id":"wordfence:f0165bf4-03ed-4021-8f45-6beef4ef3140","source":"wordfence","cve":"CVE-2026-12054","title":"Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0165bf4-03ed-4021-8f45-6beef4ef3140?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.57","to_inclusive":true,"patched_in":"3.3.58"}],"published":"2026-10-09T16:40:06Z","updated":"2026-10-10T05:31:09Z"},{"id":"wordfence:f016fcdc-02d1-46be-98b1-eaceb34c4ca1","source":"wordfence","cve":"CVE-2025-32928","title":"Altair <= 5.2.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f016fcdc-02d1-46be-98b1-eaceb34c4ca1?source=api-prod","affected":[{"type":"theme","slug":"altair","name":"Altair","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-21T00:00:00Z","updated":"2025-04-30T19:10:15Z"},{"id":"wordfence:f0174718-cddb-4821-b71e-ca21eb913842","source":"wordfence","cve":"CVE-2025-58988","title":"My Tickets <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0174718-cddb-4821-b71e-ca21eb913842?source=api-prod","affected":[{"type":"plugin","slug":"my-tickets","name":"My Tickets \u2013 Accessible Event Ticketing","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2025-09-09T00:00:00Z","updated":"2025-09-15T18:13:44Z"},{"id":"wordfence:f0175d9c-182a-4687-83f7-7f357600d0b3","source":"wordfence","cve":"CVE-2026-124411","title":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0175d9c-182a-4687-83f7-7f357600d0b3?source=api-prod","affected":[{"type":"plugin","slug":"surecart","name":"SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments","from":"*","from_inclusive":true,"to":"4.12.1","to_inclusive":true,"patched_in":"4.13.0"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:58:19Z"},{"id":"wordfence:f01a7f01-5a53-465c-a570-db242ffad6d5","source":"wordfence","cve":"CVE-2026-104385","title":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation <= 4.8.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01a7f01-5a53-465c-a570-db242ffad6d5?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":"4.9"}],"published":"2026-10-05T11:24:38Z","updated":"2026-10-08T23:22:17Z"},{"id":"wordfence:f01e9908-c4d7-4eaf-8bba-4f5da7fa7703","source":"wordfence","cve":"CVE-2022-1995","title":"miniOrange\u2019s Malware Scanner <= 4.5.5 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01e9908-c4d7-4eaf-8bba-4f5da7fa7703?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-malware-protection","name":"Malware Scanner","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f01ecce1-cff1-41a6-ae90-3ace8b2e3a36","source":"wordfence","cve":"CVE-2024-11361","title":"PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f01ecce1-cff1-41a6-ae90-3ace8b2e3a36?source=api-prod","affected":[{"type":"plugin","slug":"pdf-invoicing-for-woocommerce","name":"PDF Invoices & Packing Slips Generator for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T04:32:24Z"},{"id":"wordfence:f02237ab-c28d-431d-858d-44ea3b1ce2ee","source":"wordfence","cve":"CVE-2026-22339","title":"WPJobster <= 6.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f02237ab-c28d-431d-858d-44ea3b1ce2ee?source=api-prod","affected":[{"type":"theme","slug":"wpjobster","name":"Jobster","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:28:31Z"},{"id":"wordfence:f0235347-75ef-458e-97ec-bb9b00e1f9de","source":"wordfence","cve":"CVE-2024-13534","title":"Small Package Quotes \u2013 Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0235347-75ef-458e-97ec-bb9b00e1f9de?source=api-prod","affected":[{"type":"plugin","slug":"small-package-quotes-wwe-edition","name":"Small Package Quotes \u2013 Worldwide Express Edition","from":"*","from_inclusive":true,"to":"5.2.18","to_inclusive":true,"patched_in":"5.2.19"}],"published":"2025-02-18T21:44:46Z","updated":"2025-03-03T21:46:39Z"},{"id":"wordfence:f0257620-3a0e-4011-9378-7aa423e7c0b2","source":"wordfence","cve":"CVE-2023-5638","title":"Booster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0257620-3a0e-4011-9378-7aa423e7c0b2?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":true,"patched_in":"7.1.3"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f026d837-7c1c-4468-be3f-7728a644af59","source":"wordfence","cve":"CVE-2026-27439","title":"Dentario <= 1.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f026d837-7c1c-4468-be3f-7728a644af59?source=api-prod","affected":[{"type":"theme","slug":"dentario","name":"Dentario - Dentist & Medical Elementor Template Kit","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:06:02Z"},{"id":"wordfence:f027626a-471c-48aa-add6-7597254dcfa9","source":"wordfence","cve":"CVE-2025-6258","title":"WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f027626a-471c-48aa-add6-7597254dcfa9?source=api-prod","affected":[{"type":"plugin","slug":"wp-soundsystem","name":"WP SoundSystem","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:45:48Z","updated":"2025-06-26T02:06:35Z"},{"id":"wordfence:f0292877-33ca-425f-a95b-547b3bed2c10","source":"wordfence","cve":"CVE-2026-57418","title":"Sprout Invoices \u2013 Client Invoicing & Estimates <= 20.8.13 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0292877-33ca-425f-a95b-547b3bed2c10?source=api-prod","affected":[{"type":"plugin","slug":"sprout-invoices","name":"Sprout Invoices \u2013 Client Invoicing & Estimates","from":"*","from_inclusive":true,"to":"20.8.13","to_inclusive":true,"patched_in":"20.8.14"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:39:42Z"},{"id":"wordfence:f02945e0-6214-46c4-ada8-49e8161d2ce4","source":"wordfence","cve":"CVE-2022-40132","title":"Seriously Simple Podcasting <= 2.16.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f02945e0-6214-46c4-ada8-49e8161d2ce4?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"2.16.0","to_inclusive":true,"patched_in":"2.16.1"}],"published":"2022-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f029bd86-d979-45d1-97fe-75c43fb71148","source":"wordfence","cve":"","title":"Modula <= 2.7.4 - Incomplete Authorization via 'save_image' and 'save_images'","severity":"low","cvss":2.2,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f029bd86-d979-45d1-97fe-75c43fb71148?source=api-prod","affected":[{"type":"plugin","slug":"modula-best-grid-gallery","name":"Modula Image Gallery \u2013 Photo Grid & Video Gallery","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":false,"patched_in":"2.7.5"}],"published":"2023-09-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0328885-acc2-428f-a834-f837bff200f3","source":"wordfence","cve":"CVE-2025-60228","title":"Knowledge Base <= 2.9 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0328885-acc2-428f-a834-f837bff200f3?source=api-prod","affected":[{"type":"theme","slug":"kbase","name":"Knowledge Base","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":""}],"published":"2025-09-04T00:00:00Z","updated":"2025-11-04T18:13:40Z"},{"id":"wordfence:f033b843-d26a-4176-badd-3d0e2c2aa30f","source":"wordfence","cve":"CVE-2024-38712","title":"Qi Blocks <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f033b843-d26a-4176-badd-3d0e2c2aa30f?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:26:26Z"},{"id":"wordfence:f0343861-a376-43ea-826e-277c2a5ea635","source":"wordfence","cve":"CVE-2023-48763","title":"JetFormBuilder <= 3.1.4 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0343861-a376-43ea-826e-277c2a5ea635?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.1.5"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f035edda-69ca-46ae-98f8-2a84ce682d1f","source":"wordfence","cve":"CVE-2016-20077","title":"Photocart Link <= 1.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f035edda-69ca-46ae-98f8-2a84ce682d1f?source=api-prod","affected":[{"type":"plugin","slug":"photocart-link","name":"photocart-link","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T00:00:00Z","updated":"2026-07-29T16:44:27Z"},{"id":"wordfence:f03732fa-ce5d-4e5f-b39a-c556ed1f16a8","source":"wordfence","cve":"CVE-2025-69038","title":"Hyori <= 1.3.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03732fa-ce5d-4e5f-b39a-c556ed1f16a8?source=api-prod","affected":[{"type":"theme","slug":"hyori","name":"Hyori - Organic Food WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-15T15:48:28Z"},{"id":"wordfence:f037e2d8-1444-46e6-b7aa-57db812e44c5","source":"wordfence","cve":"CVE-2024-34420","title":"Comments Evolved for WordPress <= 1.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f037e2d8-1444-46e6-b7aa-57db812e44c5?source=api-prod","affected":[{"type":"plugin","slug":"gplus-comments","name":"Comments Evolved for WordPress","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:48:18Z"},{"id":"wordfence:f03b09ad-257c-48c9-8ecc-36f60f178f80","source":"wordfence","cve":"CVE-2026-18331","title":"Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03b09ad-257c-48c9-8ecc-36f60f178f80?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.33.1","to_inclusive":true,"patched_in":"6.34"}],"published":"2026-08-25T17:44:46Z","updated":"2026-08-26T06:08:29Z"},{"id":"wordfence:f03cf84f-842f-4696-a152-d2fe0b23a5db","source":"wordfence","cve":"CVE-2025-57924","title":"Developer <= 1.2.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03cf84f-842f-4696-a152-d2fe0b23a5db?source=api-prod","affected":[{"type":"plugin","slug":"developer","name":"Developer","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:22:43Z"},{"id":"wordfence:f03dd6f4-44ca-4afe-b3fa-8770fca8a067","source":"wordfence","cve":"CVE-2026-15260","title":"Geo My WP <= 4.5.5.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Geolocation Record Modification and Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03dd6f4-44ca-4afe-b3fa-8770fca8a067?source=api-prod","affected":[{"type":"plugin","slug":"geo-my-wp","name":"GEO my WP","from":"*","from_inclusive":true,"to":"4.5.5.2","to_inclusive":true,"patched_in":"4.5.5.3"}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:36:55Z"},{"id":"wordfence:f03deae6-24c6-49b4-b8cc-1d80275a2952","source":"wordfence","cve":"CVE-2025-32201","title":"Xpro Theme Builder <= 1.2.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03deae6-24c6-49b4-b8cc-1d80275a2952?source=api-prod","affected":[{"type":"plugin","slug":"xpro-theme-builder","name":"Xpro Theme Builder For Elementor \u2013 FREE","from":"*","from_inclusive":true,"to":"1.2.8.4","to_inclusive":true,"patched_in":"1.2.8.5"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-07T13:52:45Z"},{"id":"wordfence:f03dfbd4-b34a-46ab-b8aa-e37fb0321e8e","source":"wordfence","cve":"CVE-2023-35040","title":"SendPress Newsletters <= 1.23.11.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f03dfbd4-b34a-46ab-b8aa-e37fb0321e8e?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.23.11.6","to_inclusive":true,"patched_in":""}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f040d5b9-0db2-467b-91fa-98aede9f7280","source":"wordfence","cve":"CVE-2022-43476","title":"Subscribe to Category <= 2.7.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f040d5b9-0db2-467b-91fa-98aede9f7280?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-category","name":"Subscribe to Category","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2022-10-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f04166e0-9f43-43ad-9552-618b81ab2d6f","source":"wordfence","cve":"CVE-2014-4605","title":"ZdStatistics <= 2.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04166e0-9f43-43ad-9552-618b81ab2d6f?source=api-prod","affected":[{"type":"plugin","slug":"zdstats","name":"ZdStatistics","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f041dbd3-c053-4720-955d-327863275286","source":"wordfence","cve":"CVE-2026-57388","title":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f041dbd3-c053-4720-955d-327863275286?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.44","to_inclusive":true,"patched_in":"1.1.45"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-14T19:46:27Z"},{"id":"wordfence:f04765fb-7144-4e6f-ab5a-5a06b45dbb17","source":"wordfence","cve":"CVE-2026-13342","title":"Security Optimizer \u2013 The All-In-One Protection <= 1.6.4 - IP Allowlist Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04765fb-7144-4e6f-ab5a-5a06b45dbb17?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-17T16:02:05Z"},{"id":"wordfence:f048b2ca-bd20-4af7-8f44-a5c9cbca95ed","source":"wordfence","cve":"CVE-2025-58913","title":"VideoPro <= 2.3.8.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f048b2ca-bd20-4af7-8f44-a5c9cbca95ed?source=api-prod","affected":[{"type":"theme","slug":"videopro","name":"VideoPro - Video WordPress Theme","from":"*","from_inclusive":true,"to":"2.3.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-14T20:01:41Z"},{"id":"wordfence:f0490b1a-5467-4ce2-ab26-04dade3ec352","source":"wordfence","cve":"CVE-2025-24687","title":"Show/Hide Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0490b1a-5467-4ce2-ab26-04dade3ec352?source=api-prod","affected":[{"type":"plugin","slug":"showhide-shortcode","name":"Show/Hide Shortcode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:53:59Z"},{"id":"wordfence:f04afca9-a03f-4390-9872-f744d0a86bec","source":"wordfence","cve":"CVE-2011-5264","title":"Lazyest Backup < 0.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04afca9-a03f-4390-9872-f744d0a86bec?source=api-prod","affected":[{"type":"plugin","slug":"lazyest-backup","name":"Lazyest Backup","from":"*","from_inclusive":true,"to":"0.2.2","to_inclusive":false,"patched_in":"0.2.2"}],"published":"2011-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f04c481b-98ef-4a15-9a73-198bd1c29028","source":"wordfence","cve":"CVE-2025-49421","title":"WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04c481b-98ef-4a15-9a73-198bd1c29028?source=api-prod","affected":[{"type":"plugin","slug":"wp-text-expander","name":"WP Text Expander","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-12T13:34:30Z"},{"id":"wordfence:f04c83b9-33a0-4f4b-afc4-929d40c2ef67","source":"wordfence","cve":"CVE-2023-25491","title":"JCH Optimize <= 3.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04c83b9-33a0-4f4b-afc4-929d40c2ef67?source=api-prod","affected":[{"type":"plugin","slug":"jch-optimize","name":"JCH Optimize","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f04dee5b-d16f-4ef0-88a4-1567e2287bd5","source":"wordfence","cve":"CVE-2024-0617","title":"Category Discount Woocommerce <= 4.11 - Cross-Site Request Forgery via wpcd_save_discount()","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04dee5b-d16f-4ef0-88a4-1567e2287bd5?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-category-discount","name":"Simple Discount Rules for Woocommerce","from":"*","from_inclusive":true,"to":"4.11","to_inclusive":true,"patched_in":"4.12"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:37:46Z"},{"id":"wordfence:f04eab14-dd86-4145-b5eb-20d064bc8417","source":"wordfence","cve":"CVE-2024-9863","title":"Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04eab14-dd86-4145-b5eb-20d064bc8417?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-firebase-sms-otp-verification","name":"Miniorange OTP Verification with Firebase","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-10-16T00:00:00Z","updated":"2024-10-23T08:30:51Z"},{"id":"wordfence:f04ef770-73d9-4940-9736-c214bf5137ba","source":"wordfence","cve":"CVE-2025-10376","title":"Course Redirects for Learndash Plugin <= 0.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04ef770-73d9-4940-9736-c214bf5137ba?source=api-prod","affected":[{"type":"plugin","slug":"course-redirects-for-learndash","name":"Course Redirects for Learndash Plugin","from":"*","from_inclusive":true,"to":"0.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T20:30:28Z","updated":"2025-10-11T09:28:42Z"},{"id":"wordfence:f0520dd7-86f6-4218-84da-72620e28f010","source":"wordfence","cve":"CVE-2025-69140","title":"SweetDate Core < 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0520dd7-86f6-4218-84da-72620e28f010?source=api-prod","affected":[{"type":"plugin","slug":"sweetdate-core","name":"Sweet Date Core","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":false,"patched_in":"1.1.5"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:15:11Z"},{"id":"wordfence:f0533fca-a4de-44f0-bea0-1df6a41709ca","source":"wordfence","cve":"CVE-2025-11185","title":"Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0533fca-a4de-44f0-bea0-1df6a41709ca?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"7.4.3","to_inclusive":true,"patched_in":"7.4.4"}],"published":"2026-02-17T21:15:49Z","updated":"2026-02-18T09:25:54Z"},{"id":"wordfence:f0542cea-7550-4f51-a8b5-d313189b637a","source":"wordfence","cve":"CVE-2025-52769","title":"flexo-social-gallery <= 1.0006 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0542cea-7550-4f51-a8b5-d313189b637a?source=api-prod","affected":[{"type":"plugin","slug":"flexo-social-gallery","name":"flexo-social-gallery","from":"*","from_inclusive":true,"to":"1.0006","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-18T19:54:21Z"},{"id":"wordfence:f0543f32-54d4-4180-95c4-c9ddc0e08384","source":"wordfence","cve":"CVE-2015-10108","title":"Inline Google Spreadsheet Viewer <= 0.9.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0543f32-54d4-4180-95c4-c9ddc0e08384?source=api-prod","affected":[{"type":"plugin","slug":"inline-google-spreadsheet-viewer","name":"Inline Google Spreadsheet Viewer","from":"*","from_inclusive":true,"to":"0.9.6","to_inclusive":true,"patched_in":"0.9.6.1"}],"published":"2015-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f056aee7-8e73-41b5-8dbc-aef6557c52ab","source":"wordfence","cve":"CVE-2025-49060","title":"Wastia < 1.1.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f056aee7-8e73-41b5-8dbc-aef6557c52ab?source=api-prod","affected":[{"type":"theme","slug":"wastia","name":"Wastia - Waste Pickup And Disposal Services WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2025-09-03T00:00:00Z","updated":"2025-11-04T15:55:41Z"},{"id":"wordfence:f0576cde-8d32-4f06-899a-a9ebff99d8ba","source":"wordfence","cve":"CVE-2021-24783","title":"Post Expirator <= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0576cde-8d32-4f06-899a-a9ebff99d8ba?source=api-prod","affected":[{"type":"plugin","slug":"post-expirator","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2021-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f05a55ba-8068-4f6e-a7b1-f3d5d17e54ee","source":"wordfence","cve":"CVE-2024-7982","title":"Registrations for the Events Calendar \u2013 Event Registration Plugin <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f05a55ba-8068-4f6e-a7b1-f3d5d17e54ee?source=api-prod","affected":[{"type":"plugin","slug":"registrations-for-the-events-calendar","name":"Registrations for the Events Calendar \u2013 Event Registration Plugin","from":"*","from_inclusive":true,"to":"2.12.3","to_inclusive":true,"patched_in":"2.12.4"}],"published":"2024-10-18T00:00:00Z","updated":"2024-12-12T17:58:40Z"},{"id":"wordfence:f05b82c3-bb29-494e-a020-427cb1a816a0","source":"wordfence","cve":"CVE-2020-9334","title":"Envira Photo Gallery <= 1.7.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f05b82c3-bb29-494e-a020-427cb1a816a0?source=api-prod","affected":[{"type":"plugin","slug":"envira-gallery-lite","name":"Envira Gallery \u2013 Image Photo Gallery, Albums, Video Gallery, Slideshows & More","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2020-02-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f05c7f89-2eb8-4172-b0bb-f5bc162c71cd","source":"wordfence","cve":"CVE-2024-51708","title":"Narnoo Commerce Manager <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f05c7f89-2eb8-4172-b0bb-f5bc162c71cd?source=api-prod","affected":[{"type":"plugin","slug":"narnoo-commerce-manager","name":"Narnoo Commerce Manager","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T21:12:08Z"},{"id":"wordfence:f05e5283-e9d9-44c8-9214-96dc18d94f7a","source":"wordfence","cve":"","title":"PressForward <= 5.2.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f05e5283-e9d9-44c8-9214-96dc18d94f7a?source=api-prod","affected":[{"type":"plugin","slug":"pressforward","name":"PressForward","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.2.9"}],"published":"2022-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f06008c0-0ce3-4d78-934e-2a7fa5ce4e98","source":"wordfence","cve":"CVE-2015-4337","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f06008c0-0ce3-4d78-934e-2a7fa5ce4e98?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2015-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f062ef94-e558-478e-bbfd-06616aeb566b","source":"wordfence","cve":"CVE-2025-11986","title":"Crypto Tool <= 2.22 -  Unauthenticated Information Exposure via Global Authentication State","severity":"medium","cvss":5.3,"cwe":"CWE-306","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f062ef94-e558-478e-bbfd-06616aeb566b?source=api-prod","affected":[{"type":"plugin","slug":"crypto","name":"Crypto","from":"*","from_inclusive":true,"to":"2.22","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2025-11-10T15:07:44Z","updated":"2026-07-29T22:04:37Z"},{"id":"wordfence:f063811b-9e1d-451d-beaa-a658b0876b95","source":"wordfence","cve":"CVE-2025-52743","title":"oik-privacy-policy <= 1.4.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f063811b-9e1d-451d-beaa-a658b0876b95?source=api-prod","affected":[{"type":"plugin","slug":"oik-privacy-policy","name":"oik-privacy-policy","from":"*","from_inclusive":true,"to":"1.4.10","to_inclusive":true,"patched_in":"1.4.11"}],"published":"2025-08-06T00:00:00Z","updated":"2025-11-07T17:31:27Z"},{"id":"wordfence:f0638310-7ea0-4f3a-8fda-c83360747926","source":"wordfence","cve":"CVE-2025-67995","title":"PatioTime < 2.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0638310-7ea0-4f3a-8fda-c83360747926?source=api-prod","affected":[{"type":"theme","slug":"patiotime","name":"PatioTime - Restaurant WordPress Theme","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":false,"patched_in":"2.1"}],"published":"2026-02-09T00:00:00Z","updated":"2026-02-17T15:02:58Z"},{"id":"wordfence:f0644fc5-6b37-4730-a051-f36dec650649","source":"wordfence","cve":"CVE-2012-5328","title":"Mingle Forum <= 1.0.32.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0644fc5-6b37-4730-a051-f36dec650649?source=api-prod","affected":[{"type":"plugin","slug":"mingle-forum","name":"Mingle Forum","from":"*","from_inclusive":true,"to":"1.0.33","to_inclusive":false,"patched_in":"1.0.33"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f065648a-436a-459c-8ab1-c948c78b43c9","source":"wordfence","cve":"CVE-2023-7293","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f065648a-436a-459c-8ab1-c948c78b43c9?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:46Z"},{"id":"wordfence:f0682bf7-0b5a-402f-9ae0-34e2f0f65bcf","source":"wordfence","cve":"CVE-2026-76005","title":"WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0682bf7-0b5a-402f-9ae0-34e2f0f65bcf?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.5.5","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2026-10-27T18:13:31Z","updated":"2026-10-28T06:45:21Z"},{"id":"wordfence:f068abb4-cbe6-4698-b547-78503b2a455e","source":"wordfence","cve":"CVE-2022-26366","title":"AdRotate Banner Manager <= 5.9 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f068abb4-cbe6-4698-b547-78503b2a455e?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.9","to_inclusive":true,"patched_in":"5.9.1"}],"published":"2022-11-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0691a2a-734e-4726-97a1-9e0c796c2fb5","source":"wordfence","cve":"CVE-2022-43504","title":"WordPress Core < 6.0.3 - Information Disclosure (Email Address)","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0691a2a-734e-4726-97a1-9e0c796c2fb5?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f06d1b9e-e27d-4c43-a69b-7641518e4615","source":"wordfence","cve":"CVE-2020-36729","title":"Slideshow, Image Slider by 2J  <= 1.3.31 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f06d1b9e-e27d-4c43-a69b-7641518e4615?source=api-prod","affected":[{"type":"plugin","slug":"2j-slideshow","name":"Slideshow, Image Slider by 2J","from":"*","from_inclusive":true,"to":"1.3.31","to_inclusive":true,"patched_in":"1.3.33"}],"published":"2020-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f06e9b82-0a5e-4907-8e0e-f10769b02cda","source":"wordfence","cve":"CVE-2025-49878","title":"WPAdverts <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f06e9b82-0a5e-4907-8e0e-f10769b02cda?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2025-06-12T00:00:00Z","updated":"2025-06-17T15:19:03Z"},{"id":"wordfence:f06f0492-c03d-44d7-9441-4d79f89e5c1f","source":"wordfence","cve":"","title":"Appius Theme <= 1.0 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f06f0492-c03d-44d7-9441-4d79f89e5c1f?source=api-prod","affected":[{"type":"theme","slug":"appius","name":"appius","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2012-12-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0767c75-7571-46d9-b16a-2760be5a843b","source":"wordfence","cve":"CVE-2025-47619","title":"6Storage Rentals <= 2.19.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0767c75-7571-46d9-b16a-2760be5a843b?source=api-prod","affected":[{"type":"plugin","slug":"6storage-rentals","name":"6Storage Rentals","from":"*","from_inclusive":true,"to":"2.19.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:40:31Z"},{"id":"wordfence:f07878bd-4d52-4eb8-9d9f-ed2e31e07c4e","source":"wordfence","cve":"CVE-2026-17044","title":"File Upload <= 5.1.7 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07878bd-4d52-4eb8-9d9f-ed2e31e07c4e?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:37:46Z"},{"id":"wordfence:f07881db-7494-4e6d-82ea-16018fa81806","source":"wordfence","cve":"CVE-2026-2602","title":"Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07881db-7494-4e6d-82ea-16018fa81806?source=api-prod","affected":[{"type":"plugin","slug":"twentig","name":"Twentig Supercharged Block Editor \u2013 Blocks, Patterns, Starter Sites, Portfolio","from":"*","from_inclusive":true,"to":"1.9.7","to_inclusive":true,"patched_in":"2.0"}],"published":"2026-03-28T13:21:26Z","updated":"2026-03-29T01:24:46Z"},{"id":"wordfence:f078b367-3ee2-4d4b-a289-eead8af511a7","source":"wordfence","cve":"CVE-2026-28192","title":"Piotnet Addons For Elementor Pro <= 7.1.67 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f078b367-3ee2-4d4b-a289-eead8af511a7?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.67","to_inclusive":true,"patched_in":""}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-20T17:08:02Z"},{"id":"wordfence:f079037c-cea6-4ba6-843f-99c5e5fe59a5","source":"wordfence","cve":"CVE-2023-26521","title":"Search in Place <= 1.0.104 - Cross-Site Request Forgery to Feedback Submission","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f079037c-cea6-4ba6-843f-99c5e5fe59a5?source=api-prod","affected":[{"type":"plugin","slug":"search-in-place","name":"Search in Place","from":"*","from_inclusive":true,"to":"1.0.104","to_inclusive":true,"patched_in":"1.0.105"}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f07957b3-27cb-4a5e-a8bb-2bca72f8eecf","source":"wordfence","cve":"CVE-2024-37471","title":"Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07957b3-27cb-4a5e-a8bb-2bca72f8eecf?source=api-prod","affected":[{"type":"plugin","slug":"woffice-core","name":"Woffice Core","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:19:48Z"},{"id":"wordfence:f07b166b-3436-4797-a2df-096ff7c27a09","source":"wordfence","cve":"CVE-2024-0688","title":"WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07b166b-3436-4797-a2df-096ff7c27a09?source=api-prod","affected":[{"type":"plugin","slug":"pubsubhubbub","name":"WebSub (FKA. PubSubHubbub)","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2024-01-24T00:00:00Z","updated":"2024-07-29T21:37:46Z"},{"id":"wordfence:f07c1aac-28c1-47fc-a2e5-fbe48a90f051","source":"wordfence","cve":"CVE-2022-0952","title":"Sitemap by click5 <= 1.0.35 - Unauthenticated Arbitrary Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07c1aac-28c1-47fc-a2e5-fbe48a90f051?source=api-prod","affected":[{"type":"plugin","slug":"sitemap-by-click5","name":"Sitemap by click5","from":"*","from_inclusive":true,"to":"1.0.35","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f07d22ef-5afd-48a4-9e67-31a3ab3efdd6","source":"wordfence","cve":"CVE-2025-3779","title":"Personizely <= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07d22ef-5afd-48a4-9e67-31a3ab3efdd6?source=api-prod","affected":[{"type":"plugin","slug":"personizely","name":"Personizely \u2014 A/B Testing, Personalization, Popups & CRO","from":"*","from_inclusive":true,"to":"0.10","to_inclusive":true,"patched_in":"0.11"}],"published":"2025-05-02T11:34:31Z","updated":"2025-05-05T18:32:29Z"},{"id":"wordfence:f07eb033-f84b-4a17-9b8c-c767ae9285ae","source":"wordfence","cve":"CVE-2026-39665","title":"SEO Friendly Images <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f07eb033-f84b-4a17-9b8c-c767ae9285ae?source=api-prod","affected":[{"type":"plugin","slug":"seo-image","name":"SEO Friendly Images","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T00:00:00Z","updated":"2026-04-15T21:25:59Z"},{"id":"wordfence:f082a21e-0239-45fc-a7f2-9600f215783a","source":"wordfence","cve":"CVE-2022-41315","title":"Ezoic <= 2.8.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f082a21e-0239-45fc-a7f2-9600f215783a?source=api-prod","affected":[{"type":"plugin","slug":"ezoic-integration","name":"Ezoic","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.9"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f082ff4a-2adb-461e-875a-b3701cfea074","source":"wordfence","cve":"CVE-2021-24143","title":"AccessPress Social Icons <= 1.8.0 - Author+ SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f082ff4a-2adb-461e-875a-b3701cfea074?source=api-prod","affected":[{"type":"plugin","slug":"accesspress-social-icons","name":"AccessPress Social Icons","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":false,"patched_in":"1.8.1"}],"published":"2020-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0859e21-851a-4a6d-aa6c-9f759c5866d9","source":"wordfence","cve":"CVE-2026-7051","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0859e21-851a-4a6d-aa6c-9f759c5866d9?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.9.0","to_inclusive":true,"patched_in":"8.9.1"}],"published":"2026-05-12T15:27:25Z","updated":"2026-05-13T04:26:45Z"},{"id":"wordfence:f0869c35-9ea8-46a5-8bba-23d7ef47355a","source":"wordfence","cve":"CVE-2025-0370","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.3.3","to_inclusive":true,"patched_in":"7.3.4"}],"published":"2025-03-03T20:32:25Z","updated":"2025-03-04T09:22:52Z"},{"id":"wordfence:f0882205-3037-4ada-9e44-ddd55d88fcb1","source":"wordfence","cve":"CVE-2023-7064","title":"Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0882205-3037-4ada-9e44-ddd55d88fcb1?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.17.5","to_inclusive":true,"patched_in":"2.17.6"}],"published":"2024-04-15T00:00:00Z","updated":"2025-10-07T11:18:34Z"},{"id":"wordfence:f0886893-9cfd-44cb-8940-03dd99d4c574","source":"wordfence","cve":"CVE-2026-12042","title":"WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0886893-9cfd-44cb-8940-03dd99d4c574?source=api-prod","affected":[{"type":"plugin","slug":"facebook-auto-publish","name":"WP2Social Auto Publish","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2026-09-18T14:17:13Z","updated":"2026-09-19T02:27:13Z"},{"id":"wordfence:f08ad322-6458-4608-b53a-6aaed38a9ef2","source":"wordfence","cve":"CVE-2021-24748","title":"Email Before Download <= 6.7 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f08ad322-6458-4608-b53a-6aaed38a9ef2?source=api-prod","affected":[{"type":"plugin","slug":"email-before-download","name":"Email Before Download","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.8"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f08c63a0-2e8a-4ae9-abf6-5bd09c0a2073","source":"wordfence","cve":"CVE-2025-69024","title":"BizPrint <= 4.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f08c63a0-2e8a-4ae9-abf6-5bd09c0a2073?source=api-prod","affected":[{"type":"plugin","slug":"print-google-cloud-print-gcp-woocommerce","name":"Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.","from":"*","from_inclusive":true,"to":"4.6.7","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:39:02Z"},{"id":"wordfence:f08ca5e3-8b48-4333-9c42-cc103d40394c","source":"wordfence","cve":"CVE-2023-51666","title":"Related Post <= 2.0.53 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f08ca5e3-8b48-4333-9c42-cc103d40394c?source=api-prod","affected":[{"type":"plugin","slug":"related-post","name":"Related Posts By PickPlugins","from":"*","from_inclusive":true,"to":"2.0.53","to_inclusive":true,"patched_in":"2.0.54"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f090e1f1-2713-4f3a-b908-9407c242fdf9","source":"wordfence","cve":"CVE-2023-22713","title":"Gutenberge Blocks <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f090e1f1-2713-4f3a-b908-9407c242fdf9?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-gutenberg-blocks","name":"Editor Blocks by Download Manager","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f091d9fa-4331-4a21-8868-e9400472524b","source":"wordfence","cve":"CVE-2025-46444","title":"Ads Pro Plugin <= 4.89 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f091d9fa-4331-4a21-8868-e9400472524b?source=api-prod","affected":[{"type":"plugin","slug":"ap-plugin-scripteo","name":"Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager","from":"*","from_inclusive":true,"to":"4.89","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2026-04-01T18:48:06Z"},{"id":"wordfence:f0936f5b-a0b2-466b-bb92-143db6c32456","source":"wordfence","cve":"CVE-2015-9419","title":"Captain Slider <= 1.0.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0936f5b-a0b2-466b-bb92-143db6c32456?source=api-prod","affected":[{"type":"plugin","slug":"captain-slider","name":"Captain Slider","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2015-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f093dfc8-8a2f-4614-b7c1-4fbf1afa9589","source":"wordfence","cve":"CVE-2023-40215","title":"Demon image annotation <= 5.3 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f093dfc8-8a2f-4614-b7c1-4fbf1afa9589?source=api-prod","affected":[{"type":"plugin","slug":"demon-image-annotation","name":"demon image annotation","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2023-08-10T00:00:00Z","updated":"2024-03-25T18:03:07Z"},{"id":"wordfence:f093f44e-972c-407a-ab6b-4dd8acda5b95","source":"wordfence","cve":"CVE-2026-1369","title":"Conditional CAPTCHA <= 4.0.0 - Unauthenticated Open Redirect","severity":"medium","cvss":5.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f093f44e-972c-407a-ab6b-4dd8acda5b95?source=api-prod","affected":[{"type":"plugin","slug":"wp-conditional-captcha","name":"Conditional CAPTCHA","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-31T00:00:00Z","updated":"2026-02-25T15:02:02Z"},{"id":"wordfence:f09584f9-7ea3-4cfb-bbdf-7ca241e64bb1","source":"wordfence","cve":"CVE-2021-36866","title":"Easy Pricing Tables  <= 3.1.2 - Author+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09584f9-7ea3-4cfb-bbdf-7ca241e64bb1?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2022-05-27T13:43:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f098d66f-43a6-44e9-b836-2994d2c97782","source":"wordfence","cve":"CVE-2015-7527","title":"Cool Video Gallery <= 1.9 - Authenticated Command Injection","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f098d66f-43a6-44e9-b836-2994d2c97782?source=api-prod","affected":[{"type":"plugin","slug":"cool-video-gallery","name":"Cool Video Gallery","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f098e597-6938-48c8-948c-94cb475b8f6c","source":"wordfence","cve":"CVE-2025-22642","title":"Dynamic Conditions <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f098e597-6938-48c8-948c-94cb475b8f6c?source=api-prod","affected":[{"type":"plugin","slug":"dynamicconditions","name":"Dynamic Conditions","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-02-03T00:00:00Z","updated":"2025-08-05T13:09:42Z"},{"id":"wordfence:f09aed55-bfe4-4199-9cf2-73cc9bfd678c","source":"wordfence","cve":"CVE-2025-32286","title":"Butcher <= 2.40 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09aed55-bfe4-4199-9cf2-73cc9bfd678c?source=api-prod","affected":[{"type":"theme","slug":"butcher","name":"Butcher - Meat Shop WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.40","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-28T21:16:18Z"},{"id":"wordfence:f09b6e61-ebfc-4213-8777-f133de66a30b","source":"wordfence","cve":"CVE-2026-81026","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.40 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09b6e61-ebfc-4213-8777-f133de66a30b?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.40","to_inclusive":false,"patched_in":"3.7.40"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-02T13:55:15Z"},{"id":"wordfence:f09d722e-e4eb-4d0b-844f-3a687eb454bf","source":"wordfence","cve":"CVE-2026-12695","title":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) < 6.2.6 - Two-Factor Authentication Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09d722e-e4eb-4d0b-844f-3a687eb454bf?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"6.2.6","to_inclusive":false,"patched_in":"6.2.6"}],"published":"2026-07-15T00:00:00Z","updated":"2026-08-17T16:47:33Z"},{"id":"wordfence:f09d7c11-3e4d-431d-91f2-0b77f51974f6","source":"wordfence","cve":"CVE-2025-68050","title":"Leadpages <= 1.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09d7c11-3e4d-431d-91f2-0b77f51974f6?source=api-prod","affected":[{"type":"plugin","slug":"leadpages","name":"Leadpages","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2026-01-27T00:00:00Z","updated":"2026-03-17T21:33:01Z"},{"id":"wordfence:f09ffc02-bfed-4aa3-a3d3-58e188b3e147","source":"wordfence","cve":"CVE-2025-5540","title":"Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f09ffc02-bfed-4aa3-a3d3-58e188b3e147?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-events","name":"Event RSVP and Simple Event Management Plugin","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2025-06-25T13:46:36Z","updated":"2025-08-15T14:45:16Z"},{"id":"wordfence:f0a0ed90-a20e-40c6-b128-d46e6e9a0131","source":"wordfence","cve":"CVE-2025-54716","title":"Ireca <= 1.8.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a0ed90-a20e-40c6-b128-d46e6e9a0131?source=api-prod","affected":[{"type":"theme","slug":"ireca","name":"Ireca - Car Rental Boat, Bike, Vehicle, Calendar WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.6"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:26:25Z"},{"id":"wordfence:f0a21eaa-4e2a-4d07-8635-f0a8a5db660f","source":"wordfence","cve":"CVE-2025-6747","title":"Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a21eaa-4e2a-4d07-8635-f0a8a5db660f?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.12.1","to_inclusive":true,"patched_in":"3.12.2"}],"published":"2025-07-15T00:00:00Z","updated":"2025-07-16T06:40:43Z"},{"id":"wordfence:f0a261e9-8b96-4065-8fd3-7be53cc3c9a2","source":"wordfence","cve":"","title":"10Web Map Builder for Google Maps <= 1.0.72 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a261e9-8b96-4065-8fd3-7be53cc3c9a2?source=api-prod","affected":[{"type":"plugin","slug":"wd-google-maps","name":"10Web Map Builder for Google Maps","from":"*","from_inclusive":true,"to":"1.0.72","to_inclusive":true,"patched_in":"1.0.73"}],"published":"2023-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0a31fee-ccc2-4c3b-b198-6cb750188113","source":"wordfence","cve":"CVE-2024-12427","title":"Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a31fee-ccc2-4c3b-b198-6cb750188113?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.7.23","to_inclusive":true,"patched_in":"1.7.24"}],"published":"2025-01-15T21:22:03Z","updated":"2025-01-16T09:39:16Z"},{"id":"wordfence:f0a3a0a8-dd1d-4d10-a084-128204b411ae","source":"wordfence","cve":"CVE-2024-34565","title":"Debug Info <= 1.3.10 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a3a0a8-dd1d-4d10-a084-128204b411ae?source=api-prod","affected":[{"type":"plugin","slug":"debug-info","name":"Debug Info","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:39:58Z"},{"id":"wordfence:f0a3df32-aa07-4cc0-97ba-bb4ab64ba6b9","source":"wordfence","cve":"CVE-2025-11129","title":"Include fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a3df32-aa07-4cc0-97ba-bb4ab64ba6b9?source=api-prod","affected":[{"type":"plugin","slug":"include-fussball-de-widgets","name":"Include Fussball.de Widgets","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:26:49Z","updated":"2025-11-11T03:30:51Z"},{"id":"wordfence:f0a5771b-0108-4393-a54e-b5e2c35caeb0","source":"wordfence","cve":"CVE-2021-26609","title":"Mangboard <= 1.9.9 - SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a5771b-0108-4393-a54e-b5e2c35caeb0?source=api-prod","affected":[{"type":"plugin","slug":"mangboard","name":"Mang Board","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2021-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0accbee-8ab3-4e6a-b7c8-a204d681d8cf","source":"wordfence","cve":"CVE-2013-1949","title":"Social Media Widget <= 4.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0accbee-8ab3-4e6a-b7c8-a204d681d8cf?source=api-prod","affected":[{"type":"plugin","slug":"social-media-widget","name":"Social Media Widget","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2013-04-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0ada9b6-a27c-4336-8550-99294c119a88","source":"wordfence","cve":"CVE-2026-85705","title":"Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ada9b6-a27c-4336-8550-99294c119a88?source=api-prod","affected":[{"type":"plugin","slug":"geodir_location_manager","name":"Location Manager","from":"*","from_inclusive":true,"to":"2.3.38","to_inclusive":true,"patched_in":"2.3.39"}],"published":"2026-09-17T19:11:56Z","updated":"2026-09-18T07:40:05Z"},{"id":"wordfence:f0af86e4-c30b-49e2-ad6a-97a415a74d18","source":"wordfence","cve":"CVE-2020-36761","title":"Top 10  <= 2.9.4 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0af86e4-c30b-49e2-ad6a-97a415a74d18?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"2.9.5","to_inclusive":false,"patched_in":"2.9.5"}],"published":"2020-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0b12d5d-5b13-4eb0-ad48-2b7c431703bd","source":"wordfence","cve":"CVE-2026-39654","title":"Simple HTML Sitemap <= 3.8 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b12d5d-5b13-4eb0-ad48-2b7c431703bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":"3.9"}],"published":"2026-02-15T00:00:00Z","updated":"2026-07-08T20:46:37Z"},{"id":"wordfence:f0b25726-0b8e-4fce-a986-5f1e176da75a","source":"wordfence","cve":"","title":"Booking Calendar < 4.1.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b25726-0b8e-4fce-a986-5f1e176da75a?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"4.1.6","to_inclusive":false,"patched_in":"4.1.6"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0b60313-042b-4e85-a117-9abd95824402","source":"wordfence","cve":"CVE-2019-14681","title":"Deny All Firewall <= 1.1.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b60313-042b-4e85-a117-9abd95824402?source=api-prod","affected":[{"type":"plugin","slug":"deny-all-firewall","name":"Deny All Firewall","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2019-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0b6c41d-833e-4ad4-bdb6-c38fef3eb7f4","source":"wordfence","cve":"CVE-2026-2128","title":"Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b6c41d-833e-4ad4-bdb6-c38fef3eb7f4?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-05-28T14:55:00Z","updated":"2026-05-29T03:39:09Z"},{"id":"wordfence:f0b8fd44-75af-4fb8-bcc1-94cb5fc9e4eb","source":"wordfence","cve":"CVE-2024-24836","title":"GDPR Data Request Form <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b8fd44-75af-4fb8-bcc1-94cb5fc9e4eb?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-data-request-form","name":"GDPR Data Request Form","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T20:46:49Z"},{"id":"wordfence:f0b95670-0767-4325-88d0-4ae6d7302558","source":"wordfence","cve":"CVE-2019-25151","title":"Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b95670-0767-4325-88d0-4ae6d7302558?source=api-prod","affected":[{"type":"plugin","slug":"cartflows","name":"CartFlows \u2013 Funnel Builder & Checkout Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2019-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0b9c46d-72db-43f3-b17b-0747375d45c9","source":"wordfence","cve":"CVE-2025-9212","title":"WP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-dispatcher","name":"WP Dispatcher","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:18:10Z","updated":"2025-10-03T11:17:22Z"},{"id":"wordfence:f0c23687-2e79-460a-96eb-7d11bf883ced","source":"wordfence","cve":"CVE-2024-34416","title":"Pk Favicon Manager <=2.1 - Authenticated (Admin+) Arbitrary File Upload","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0c23687-2e79-460a-96eb-7d11bf883ced?source=api-prod","affected":[{"type":"plugin","slug":"phpsword-favicon-manager","name":"Pk Favicon Manager","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T11:10:09Z"},{"id":"wordfence:f0c5d1f4-6c6d-413b-8f0d-a6d36556dc4a","source":"wordfence","cve":"CVE-2026-57642","title":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress <= 4.7.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0c5d1f4-6c6d-413b-8f0d-a6d36556dc4a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-plugin","name":"Gallery by BestWebSoft \u2013 Customizable Image and Photo Galleries for WordPress","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:53:34Z"},{"id":"wordfence:f0c69764-d64b-4231-8251-2f289dce69e1","source":"wordfence","cve":"CVE-2026-32504","title":"VintWood <= 1.1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0c69764-d64b-4231-8251-2f289dce69e1?source=api-prod","affected":[{"type":"theme","slug":"vintwood","name":"VintWood - Vintage, Retro WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:45:50Z"},{"id":"wordfence:f0c7324f-4c22-44e0-8d2a-9b95fd89467d","source":"wordfence","cve":"","title":"vSlider Multi Image Slider <= 4.1.2 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0c7324f-4c22-44e0-8d2a-9b95fd89467d?source=api-prod","affected":[{"type":"plugin","slug":"vslider","name":"vSlider Multi Image Slider for WordPress","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0cae732-9551-4f25-acf0-92d6d2e09bab","source":"wordfence","cve":"CVE-2026-112820","title":"Academist Core <= 1.4.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cae732-9551-4f25-acf0-92d6d2e09bab?source=api-prod","affected":[{"type":"plugin","slug":"academist-core","name":"Academist Core","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-28T16:36:36Z"},{"id":"wordfence:f0cb666b-bfab-492f-a74e-11dc9b171136","source":"wordfence","cve":"CVE-2025-7340","title":"HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cb666b-bfab-492f-a74e-11dc9b171136?source=api-prod","affected":[{"type":"plugin","slug":"ht-contactform","name":"HT Contact Form \u2013 Drag & Drop Form Builder for WordPress","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-07-14T15:59:03Z","updated":"2025-07-22T16:16:10Z"},{"id":"wordfence:f0cc349a-96f9-4b11-a0b4-28bc4ccc022c","source":"wordfence","cve":"CVE-2026-8899","title":"Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cc349a-96f9-4b11-a0b4-28bc4ccc022c?source=api-prod","affected":[{"type":"plugin","slug":"automatic-thumbnail","name":"Auto Thumbnails","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:44Z","updated":"2026-05-27T05:31:33Z"},{"id":"wordfence:f0ccd265-2e64-4b23-a032-aaeb9941df34","source":"wordfence","cve":"CVE-2023-47817","title":"Daily Prayer Time <= 2023.10.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ccd265-2e64-4b23-a032-aaeb9941df34?source=api-prod","affected":[{"type":"plugin","slug":"daily-prayer-time-for-mosques","name":"Daily Prayer Time","from":"*","from_inclusive":true,"to":"2023.10.13","to_inclusive":true,"patched_in":"2023.10.21"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0cf53e3-1d5b-4f02-b1a1-61f6fc3ffe58","source":"wordfence","cve":"CVE-2020-26153","title":"Event Espresso Core <= 4.10.6.p - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cf53e3-1d5b-4f02-b1a1-61f6fc3ffe58?source=api-prod","affected":[{"type":"plugin","slug":"event-espresso-core","name":"event-espresso-core","from":"*","from_inclusive":true,"to":"4.10.6.p","to_inclusive":true,"patched_in":"4.10.7.p"}],"published":"2021-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0d05295-182c-4c4a-bb0d-15831fe7e691","source":"wordfence","cve":"CVE-2024-38775","title":"CTX Feed <= 6.5.6 - Authenticated (Shop Manager+) Arbitrary Options Update","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d05295-182c-4c4a-bb0d-15831fe7e691?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.5.6","to_inclusive":true,"patched_in":"6.5.7"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-25T14:15:04Z"},{"id":"wordfence:f0d0eaa0-ad8f-418c-bb61-eb209ba0249b","source":"wordfence","cve":"CVE-2025-12662","title":"Coon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d0eaa0-ad8f-418c-bb61-eb209ba0249b?source=api-prod","affected":[{"type":"plugin","slug":"coon-google-maps","name":"Coon Google Maps","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:12:46Z","updated":"2025-11-11T03:30:51Z"},{"id":"wordfence:f0d3b54c-6244-4776-be3c-afe3a28a2b8a","source":"wordfence","cve":"CVE-2026-1279","title":"Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d3b54c-6244-4776-be3c-afe3a28a2b8a?source=api-prod","affected":[{"type":"plugin","slug":"employee-staff-directory","name":"Employee Directory \u2013 Staff Directory and Listing","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2026-02-05T19:15:07Z","updated":"2026-02-06T07:24:55Z"},{"id":"wordfence:f0d3f7cb-4974-4b0f-9658-1895e5966276","source":"wordfence","cve":"CVE-2026-16142","title":"TrueBooker <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d3f7cb-4974-4b0f-9658-1895e5966276?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2026-08-14T20:09:50Z","updated":"2026-08-15T08:27:16Z"},{"id":"wordfence:f0d584d0-1709-47dd-884b-ad21cac9d537","source":"wordfence","cve":"CVE-2026-13177","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d584d0-1709-47dd-884b-ad21cac9d537?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.20","to_inclusive":false,"patched_in":"4.1.20"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-13T18:59:52Z"},{"id":"wordfence:f0d96341-049c-4554-946b-12e2bf3e972e","source":"wordfence","cve":"CVE-2015-9531","title":"Easy Digital Downloads \u2013 Wish Lists < 1.1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d96341-049c-4554-946b-12e2bf3e972e?source=api-prod","affected":[{"type":"plugin","slug":"edd-wish-lists","name":"Easy Digital Downloads - Wish Lists","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0dc7356-0b15-4dd8-b335-9e0274d1cc59","source":"wordfence","cve":"CVE-2025-47501","title":"Content Control <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0dc7356-0b15-4dd8-b335-9e0274d1cc59?source=api-prod","affected":[{"type":"plugin","slug":"content-control","name":"Content Control \u2013 The Ultimate Content Restriction Solution! Restrict Content, Create Conditional Blocks & More","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:08:34Z"},{"id":"wordfence:f0de5502-20a4-4436-89c6-ef42b8b40c08","source":"wordfence","cve":"CVE-2021-42363","title":"Preview E-Mails for WooCommerce <= 1.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0de5502-20a4-4436-89c6-ef42b8b40c08?source=api-prod","affected":[{"type":"plugin","slug":"woo-preview-emails","name":"Preview E-mails for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2021-11-18T16:38:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0de8ff3-ac03-4640-829d-66a8496aa8aa","source":"wordfence","cve":"CVE-2016-6565","title":"NextGen Gallery <= 2.1.56 - Remote File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0de8ff3-ac03-4640-829d-66a8496aa8aa?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"2.1.56","to_inclusive":true,"patched_in":"2.1.57"}],"published":"2016-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0e2d690-7562-438a-aa9f-d2711ddd7d2c","source":"wordfence","cve":"CVE-2024-37110","title":"WishList Member X < 3.26.7 - Missing Authorization to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e2d690-7562-438a-aa9f-d2711ddd7d2c?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.26.7","to_inclusive":false,"patched_in":"3.26.7"}],"published":"2024-06-20T00:00:00Z","updated":"2026-02-26T14:59:14Z"},{"id":"wordfence:f0e33a14-60d6-4918-a59b-bc57fdeb0acb","source":"wordfence","cve":"CVE-2026-125767","title":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons <= 1.36.3.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e33a14-60d6-4918-a59b-bc57fdeb0acb?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.36.3.1","to_inclusive":true,"patched_in":"1.36.3.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:56:54Z"},{"id":"wordfence:f0e6b405-0843-4469-ae60-7023dea0786f","source":"wordfence","cve":"CVE-2026-42658","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e6b405-0843-4469-ae60-7023dea0786f?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.3.8","to_inclusive":true,"patched_in":"5.3.9"}],"published":"2026-04-29T00:00:00Z","updated":"2026-05-04T13:56:09Z"},{"id":"wordfence:f0e7433a-48a8-4601-a242-9923c6014394","source":"wordfence","cve":"CVE-2025-57926","title":"Passster <= 4.2.18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e7433a-48a8-4601-a242-9923c6014394?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.2.18","to_inclusive":true,"patched_in":"4.2.19"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-21T20:38:56Z"},{"id":"wordfence:f0e77557-f377-4752-bc5b-ec00f2520150","source":"wordfence","cve":"","title":"Chocolate WP \u2013 Responsive Photography Theme (All Versions) - Remote File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e77557-f377-4752-bc5b-ec00f2520150?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0e8d029-af6b-43cb-aa90-f92777c5ac99","source":"wordfence","cve":"CVE-2023-44240","title":"Timthumb Vulnerability Scanner <= 1.54 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e8d029-af6b-43cb-aa90-f92777c5ac99?source=api-prod","affected":[{"type":"plugin","slug":"timthumb-vulnerability-scanner","name":"Timthumb Vulnerability Scanner","from":"*","from_inclusive":true,"to":"1.54","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0e97124-641c-4d35-a274-6a127d2d7d18","source":"wordfence","cve":"CVE-2026-32355","title":"JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0e97124-641c-4d35-a274-6a127d2d7d18?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.4.1","to_inclusive":false,"patched_in":"3.8.4.1"}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-05T14:20:33Z"},{"id":"wordfence:f0ea7279-bba3-49c4-b36a-0d51c96a23cf","source":"wordfence","cve":"CVE-2013-2743","title":"BackupBuddy < 3.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ea7279-bba3-49c4-b36a-0d51c96a23cf?source=api-prod","affected":[{"type":"plugin","slug":"backupbuddy","name":"BackupBuddy","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2013-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0eb6dc5-98e2-4d88-98f8-8a63c939b047","source":"wordfence","cve":"CVE-2025-13746","title":"ForumWP \u2013 Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0eb6dc5-98e2-4d88-98f8-8a63c939b047?source=api-prod","affected":[{"type":"plugin","slug":"forumwp","name":"ForumWP \u2013 Forum & Discussion Board","from":"*","from_inclusive":true,"to":"2.1.6","to_inclusive":true,"patched_in":"2.1.7"}],"published":"2026-01-05T14:45:41Z","updated":"2026-01-06T03:21:41Z"},{"id":"wordfence:f0ec70a0-d1be-4652-b029-d8268c2667ec","source":"wordfence","cve":"CVE-2022-0781","title":"Nirweb support <= 2.7.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ec70a0-d1be-4652-b029-d8268c2667ec?source=api-prod","affected":[{"type":"plugin","slug":"nirweb-support","name":"Nirweb support","from":"*","from_inclusive":true,"to":"2.7.9","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2022-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0edfebc-bf6b-4346-9cd7-ce00007e3620","source":"wordfence","cve":"CVE-2024-3667","title":"Brizy \u2013 Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0edfebc-bf6b-4346-9cd7-ce00007e3620?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.43","to_inclusive":true,"patched_in":"2.4.44"}],"published":"2024-06-04T17:26:58Z","updated":"2024-06-05T05:33:09Z"},{"id":"wordfence:f0f1cf03-0550-494e-8f41-7ee297bbff5f","source":"wordfence","cve":"CVE-2026-93511","title":"Premium Packages <= 7.2.0 - Unauthenticated Forged Payment and Subscription Events","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0f1cf03-0550-494e-8f41-7ee297bbff5f?source=api-prod","affected":[{"type":"plugin","slug":"wpdm-premium-packages","name":"Premium Packages \u2013 Sell Digital Products Securely","from":"*","from_inclusive":true,"to":"7.2.0","to_inclusive":true,"patched_in":"7.2.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-30T14:23:22Z"},{"id":"wordfence:f0f78d20-7739-4c6f-9f1b-c94e3de4df4d","source":"wordfence","cve":"CVE-2025-31817","title":"BlockWheels <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0f78d20-7739-4c6f-9f1b-c94e3de4df4d?source=api-prod","affected":[{"type":"plugin","slug":"blockwheels","name":"BlockWheels","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-02T11:55:31Z"},{"id":"wordfence:f0fa8050-6318-4528-8dd4-a3ca5467cfaa","source":"wordfence","cve":"CVE-2023-52197","title":"Ads Invalid Click Protection <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0fa8050-6318-4528-8dd4-a3ca5467cfaa?source=api-prod","affected":[{"type":"plugin","slug":"ads-invalid-click-protection","name":"Ads Invalid Click Protection","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f0fd9a70-f725-440b-8d39-af99e4b2f3ff","source":"wordfence","cve":"CVE-2024-51680","title":"Cresta Addons for Elementor <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0fd9a70-f725-440b-8d39-af99e4b2f3ff?source=api-prod","affected":[{"type":"plugin","slug":"cresta-addons-for-elementor","name":"Cresta Addons for Elementor","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T19:34:11Z"},{"id":"wordfence:f0ff03ab-eeb9-4445-92c8-326783d4b10e","source":"wordfence","cve":"CVE-2024-4458","title":"Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ff03ab-eeb9-4445-92c8-326783d4b10e?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-06-05T15:28:18Z","updated":"2024-07-01T17:15:23Z"},{"id":"wordfence:f0ff2cb3-a385-4f5c-b555-b6a3dadfc458","source":"wordfence","cve":"","title":"Fusion <= 2.1 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ff2cb3-a385-4f5c-b555-b6a3dadfc458?source=api-prod","affected":[{"type":"theme","slug":"fushion-theme","name":"Fusion","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f105bee6-21b2-4014-bb0a-9e53c49e29b0","source":"wordfence","cve":"CVE-2024-34825","title":"Social Sharing Plugin \u2013 Social Warfare <= 4.4.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f105bee6-21b2-4014-bb0a-9e53c49e29b0?source=api-prod","affected":[{"type":"plugin","slug":"social-warfare","name":"Social Sharing Plugin \u2013 Social Warfare","from":"*","from_inclusive":true,"to":"4.4.5.1","to_inclusive":true,"patched_in":"4.4.6"}],"published":"2024-05-09T00:00:00Z","updated":"2024-05-15T20:11:50Z"},{"id":"wordfence:f105c62b-4b70-4514-a63d-6b6b78085c90","source":"wordfence","cve":"CVE-2026-66446","title":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization <= 1.10 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f105c62b-4b70-4514-a63d-6b6b78085c90?source=api-prod","affected":[{"type":"plugin","slug":"if-so","name":"If-So Dynamic Content \u2013 Elementor & All Page Builders Personalization","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":true,"patched_in":"1.10.0.1"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:54:45Z"},{"id":"wordfence:f105f6bf-3224-4f5c-8334-1a53ff9af9c0","source":"wordfence","cve":"CVE-2023-34423","title":"Survey Maker \u2013 Best WordPress Survey Plugin <= 3.6.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f105f6bf-3224-4f5c-8334-1a53ff9af9c0?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2024-04-27T00:00:00Z","updated":"2024-05-07T21:17:49Z"},{"id":"wordfence:f1060875-21dc-41fb-866a-940e6aeb3c22","source":"wordfence","cve":"","title":"Echelon <= 2.4 -  Arbitrary File Deletion","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1060875-21dc-41fb-866a-940e6aeb3c22?source=api-prod","affected":[{"type":"theme","slug":"echelon","name":"Echelon","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10636ea-06aa-4186-a891-ed4bb0800c41","source":"wordfence","cve":"CVE-2025-12137","title":"Import WP \u2013 Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10636ea-06aa-4186-a891-ed4bb0800c41?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.14.16","to_inclusive":true,"patched_in":"2.14.17"}],"published":"2025-10-31T17:58:00Z","updated":"2025-11-01T06:40:41Z"},{"id":"wordfence:f107496b-020b-4222-91f3-49caba1a39db","source":"wordfence","cve":"CVE-2022-3677","title":"Advanced Import <= 1.3.7 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f107496b-020b-4222-91f3-49caba1a39db?source=api-prod","affected":[{"type":"plugin","slug":"advanced-import","name":"Advanced Import","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2022-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f107a2be-e75b-43f3-8d41-b68c50c27f55","source":"wordfence","cve":"","title":"jQuery HTML5 File Upload <= 3.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f107a2be-e75b-43f3-8d41-b68c50c27f55?source=api-prod","affected":[{"type":"plugin","slug":"jquery-html5-file-upload","name":"JQuery Html5 File Upload","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2017-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10a11d8-1ef8-427b-b256-ffe8769d61bb","source":"wordfence","cve":"CVE-2024-34433","title":"One Click Demo Import <= 3.2.0 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10a11d8-1ef8-427b-b256-ffe8769d61bb?source=api-prod","affected":[{"type":"plugin","slug":"one-click-demo-import","name":"One Click Demo Import","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T20:52:51Z"},{"id":"wordfence:f10a49ae-d58f-4244-ba10-330e04c1946e","source":"wordfence","cve":"CVE-2025-52734","title":"CropRefine <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10a49ae-d58f-4244-ba10-330e04c1946e?source=api-prod","affected":[{"type":"plugin","slug":"croprefine","name":"CropRefine","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T00:00:00Z","updated":"2025-10-29T21:01:57Z"},{"id":"wordfence:f10ae2b6-1580-418c-9cf7-e75ed71bb309","source":"wordfence","cve":"CVE-2023-46631","title":"Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10ae2b6-1580-418c-9cf7-e75ed71bb309?source=api-prod","affected":[{"type":"plugin","slug":"product-recommendation-quiz-for-ecommerce","name":"Quiz Builder for WooCommerce \u2013 Product Recommendations","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10cf49b-1b78-43c1-b0d1-c1dbb74d5696","source":"wordfence","cve":"CVE-2026-4662","title":"JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10cf49b-1b78-43c1-b0d1-c1dbb74d5696?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.6.1","to_inclusive":true,"patched_in":"3.8.6.2"}],"published":"2026-03-23T16:17:43Z","updated":"2026-03-24T04:27:50Z"},{"id":"wordfence:f10e5eef-1ccf-4f98-b0e9-5ed05b3881a6","source":"wordfence","cve":"CVE-2022-47586","title":"Ultimate Addons for Contact Form 7 <= 3.1.23 - Unauthenticated SQL Injection via form_id","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10e5eef-1ccf-4f98-b0e9-5ed05b3881a6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.1.23","to_inclusive":true,"patched_in":"3.1.24"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10f6b12-5bf0-475a-ad9e-084ce5801b84","source":"wordfence","cve":"","title":"WP Google Maps <= 7.11.27 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10f6b12-5bf0-475a-ad9e-084ce5801b84?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-maps","name":"WP Go Maps \u2013 Google Map, OpenStreetMap, Leaflet & Store Locator","from":"*","from_inclusive":true,"to":"7.11.28","to_inclusive":false,"patched_in":"7.11.28"}],"published":"2019-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10fd160-70cc-4f27-8175-830ccb90bf63","source":"wordfence","cve":"CVE-2024-56058","title":"VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10fd160-70cc-4f27-8175-830ccb90bf63?source=api-prod","affected":[{"type":"plugin","slug":"vrpconnector","name":"VRPConnector","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T16:14:06Z"},{"id":"wordfence:f10fd22e-a25b-4f16-ad65-a995559908e9","source":"wordfence","cve":"CVE-2023-27412","title":"Mocho Blog <= 1.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10fd22e-a25b-4f16-ad65-a995559908e9?source=api-prod","affected":[{"type":"theme","slug":"mocho-blog","name":"Mocho Blog","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2023-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f10fdf31-6941-4d41-8c15-90ed61addc2f","source":"wordfence","cve":"CVE-2017-5490","title":"WordPress Core < 4.7.1 - Stored Cross-Site Scripting via theme directory name","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f10fdf31-6941-4d41-8c15-90ed61addc2f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1105dc3-222f-46a5-a9b1-74c11923f886","source":"wordfence","cve":"CVE-2022-4265","title":"Replyable \u2013 Subscribe to Comments and Reply by Email <= 2.2.9 - Authenticated (Subscriber+) PHP Object Injection via prompt_dismiss_notice","severity":"high","cvss":8.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1105dc3-222f-46a5-a9b1-74c11923f886?source=api-prod","affected":[{"type":"plugin","slug":"postmatic","name":"Replyable \u2013 Subscribe to Comments and Reply by Email","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.2.10"}],"published":"2023-02-08T00:00:00Z","updated":"2024-04-17T13:08:00Z"},{"id":"wordfence:f1111095-adaa-427c-b5e5-c0926c442180","source":"wordfence","cve":"CVE-2024-12731","title":"Aklamator INfeed <= 2.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1111095-adaa-427c-b5e5-c0926c442180?source=api-prod","affected":[{"type":"plugin","slug":"aklamator-infeed","name":"Aklamator INfeed","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-20T18:44:14Z"},{"id":"wordfence:f1117b57-bd86-4e90-b1bb-e13939e0e766","source":"wordfence","cve":"CVE-2026-39531","title":"WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1117b57-bd86-4e90-b1bb-e13939e0e766?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2026-04-13T00:00:00Z","updated":"2026-04-21T15:06:24Z"},{"id":"wordfence:f11187da-21f8-4db5-aa36-1010f191e331","source":"wordfence","cve":"CVE-2024-49700","title":"ARPrice - WordPress Pricing Table Plugin <= 4.1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f11187da-21f8-4db5-aa36-1010f191e331?source=api-prod","affected":[{"type":"plugin","slug":"arprice","name":"ARPrice - WordPress Pricing Table Plugin","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-01-03T00:00:00Z","updated":"2026-02-26T15:03:42Z"},{"id":"wordfence:f111c87e-e1e8-45df-ab92-0a81e32467b4","source":"wordfence","cve":"CVE-2024-5561","title":"Popup Maker <= 1.19.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f111c87e-e1e8-45df-ab92-0a81e32467b4?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.19.0","to_inclusive":true,"patched_in":"1.19.1"}],"published":"2024-08-19T00:00:00Z","updated":"2024-09-20T18:39:37Z"},{"id":"wordfence:f1152a9d-7bc4-4fc9-a25f-cd94496b2306","source":"wordfence","cve":"CVE-2026-22469","title":"DeepDigital <= 1.0.2 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1152a9d-7bc4-4fc9-a25f-cd94496b2306?source=api-prod","affected":[{"type":"theme","slug":"deepdigital","name":"DeepDigital \u2013 Web Design Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-14T20:15:51Z"},{"id":"wordfence:f117f713-e2f1-4803-87f7-14b1576d823b","source":"wordfence","cve":"CVE-2025-13740","title":"Lightweight Accordion <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f117f713-e2f1-4803-87f7-14b1576d823b?source=api-prod","affected":[{"type":"plugin","slug":"lightweight-accordion","name":"Lightweight Accordion","from":"*","from_inclusive":true,"to":"1.5.20","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-12-14T14:20:42Z","updated":"2025-12-15T03:20:20Z"},{"id":"wordfence:f117fffb-2bbb-4e95-b589-909972db1e5e","source":"wordfence","cve":"CVE-2024-9610","title":"Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f117fffb-2bbb-4e95-b589-909972db1e5e?source=api-prod","affected":[{"type":"plugin","slug":"language-switcher","name":"Language Switcher","from":"*","from_inclusive":true,"to":"3.7.13","to_inclusive":true,"patched_in":"3.8.0"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:21Z"},{"id":"wordfence:f11926c8-2b31-4ad5-9fd0-225071a91b2a","source":"wordfence","cve":"CVE-2023-49859","title":"Login With Ajax <= 4.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f11926c8-2b31-4ad5-9fd0-225071a91b2a?source=api-prod","affected":[{"type":"plugin","slug":"login-with-ajax","name":"AJAX Auth \u2013 Fast Logins, 2FA, Redirects","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2023-12-07T00:00:00Z","updated":"2024-02-23T17:00:06Z"},{"id":"wordfence:f119c6c2-cd4e-415a-b717-2bfc90ed729e","source":"wordfence","cve":"CVE-2023-51413","title":"Piotnet Forms <= 1.0.25 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f119c6c2-cd4e-415a-b717-2bfc90ed729e?source=api-prod","affected":[{"type":"plugin","slug":"piotnetforms","name":"Piotnet Forms","from":"*","from_inclusive":true,"to":"1.0.29","to_inclusive":true,"patched_in":"1.0.30"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-23T15:55:04Z"},{"id":"wordfence:f11bb35a-b9c9-4c4f-95aa-327fa76f806f","source":"wordfence","cve":"CVE-2026-115611","title":"TableOn \u2013 WordPress Posts Table Filterable\u00a0 <= 1.0.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f11bb35a-b9c9-4c4f-95aa-327fa76f806f?source=api-prod","affected":[{"type":"plugin","slug":"posts-table-filterable","name":"TableOn \u2013 WordPress Posts Table Filterable\u00a0","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2026-10-27T10:43:16Z","updated":"2026-11-03T19:28:08Z"},{"id":"wordfence:f11bc707-2465-4b64-945a-c0db6e9043dd","source":"wordfence","cve":"CVE-2024-37437","title":"Elementor Website Builder <= 3.22.1 - Authenticated (Contributor+) Arbitrary SVG Download","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f11bc707-2465-4b64-945a-c0db6e9043dd?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.22.1","to_inclusive":true,"patched_in":"3.22.2"}],"published":"2024-06-28T00:00:00Z","updated":"2024-07-02T15:46:16Z"},{"id":"wordfence:f11ea6b2-1225-42a5-aa7b-260315d0bec5","source":"wordfence","cve":"CVE-2023-28534","title":"WP Job Portal <= 2.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f11ea6b2-1225-42a5-aa7b-260315d0bec5?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1205432-4de0-4745-b8d5-e36aa8f3da49","source":"wordfence","cve":"CVE-2024-11382","title":"Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1205432-4de0-4745-b8d5-e36aa8f3da49?source=api-prod","affected":[{"type":"plugin","slug":"common-ninja","name":"Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-06T15:45:11Z","updated":"2025-01-07T04:22:24Z"},{"id":"wordfence:f122cba9-a6f8-46dd-90c5-c54311f2be7f","source":"wordfence","cve":"CVE-2024-51712","title":"Jigoshop \u2013 Store Toolkit <= 1.4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f122cba9-a6f8-46dd-90c5-c54311f2be7f?source=api-prod","affected":[{"type":"plugin","slug":"jigoshop-store-toolkit","name":"Jigoshop \u2013 Store Toolkit","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:25:05Z"},{"id":"wordfence:f124b5a0-b58b-45ff-bd22-7a09a9abd9bd","source":"wordfence","cve":"CVE-2023-45003","title":"Social Feed <= 2.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f124b5a0-b58b-45ff-bd22-7a09a9abd9bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-feed","name":"Social Feed | Custom Feed for Social Media Networks","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f125a9d4-7399-47ae-9b5d-4cfe12c4c177","source":"wordfence","cve":"","title":"Sahifa <= 2.4.0 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f125a9d4-7399-47ae-9b5d-4cfe12c4c177?source=api-prod","affected":[{"type":"theme","slug":"sahifa","name":"Sahifa","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2013-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1275a8f-c9ac-4cb3-8aa2-1393ffcc9dc8","source":"wordfence","cve":"CVE-2025-13843","title":"VigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1275a8f-c9ac-4cb3-8aa2-1393ffcc9dc8?source=api-prod","affected":[{"type":"plugin","slug":"viglink-spotlight-by-shortcode","name":"VigLink SpotLight By ShortCode","from":"*","from_inclusive":true,"to":"1.0.a","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:32:45Z","updated":"2025-12-12T15:20:49Z"},{"id":"wordfence:f127f028-79dd-4671-b789-01c56b77a70e","source":"wordfence","cve":"CVE-2025-31011","title":"SimplyRETS Real Estate IDX <= 3.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f127f028-79dd-4671-b789-01c56b77a70e?source=api-prod","affected":[{"type":"plugin","slug":"simply-rets","name":"SimplyRETS Real Estate IDX","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2025-04-01T00:00:00Z","updated":"2026-04-15T15:55:20Z"},{"id":"wordfence:f12936a0-26c3-459b-8c81-fba40186cbd7","source":"wordfence","cve":"CVE-2026-28034","title":"Progress <= 1.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f12936a0-26c3-459b-8c81-fba40186cbd7?source=api-prod","affected":[{"type":"theme","slug":"progress","name":"progress","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:27:01Z"},{"id":"wordfence:f12abcb2-37c1-4e2a-b947-74c50f49c6a4","source":"wordfence","cve":"CVE-2025-62133","title":"FormFacade <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f12abcb2-37c1-4e2a-b947-74c50f49c6a4?source=api-prod","affected":[{"type":"plugin","slug":"formfacade","name":"FormFacade \u2013 Embed Google Forms in your website","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:29:01Z"},{"id":"wordfence:f131ea1e-d652-4854-abea-6a307ca8118f","source":"wordfence","cve":"CVE-2026-1925","title":"EmailKit \u2013 Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f131ea1e-d652-4854-abea-6a307ca8118f?source=api-prod","affected":[{"type":"plugin","slug":"emailkit","name":"EmailKit \u2013 Email Customizer for WooCommerce & WP","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-02-17T16:26:56Z","updated":"2026-02-18T04:35:47Z"},{"id":"wordfence:f132b264-6e32-49d1-9733-f4a7c35dcdec","source":"wordfence","cve":"CVE-2025-49286","title":"WP Table Builder <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f132b264-6e32-49d1-9733-f4a7c35dcdec?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:32:41Z"},{"id":"wordfence:f1388322-d935-4101-a6c4-a7c99228ddec","source":"wordfence","cve":"CVE-2014-5014","title":"Flash Uploader <= 3.1.2 - Arbitrary Command Execution","severity":"critical","cvss":9.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1388322-d935-4101-a6c4-a7c99228ddec?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-flash-uploader","name":"WordPress Flash Uploader","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2014-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f138d917-0dc2-4408-aa6a-db1fd0410eb4","source":"wordfence","cve":"CVE-2026-2367","title":"Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f138d917-0dc2-4408-aa6a-db1fd0410eb4?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2026-02-24T20:52:46Z","updated":"2026-02-25T09:26:54Z"},{"id":"wordfence:f13a7eab-9c15-4829-9756-c5d4961a618c","source":"wordfence","cve":"CVE-2025-30596","title":"include-file <= 1 - Authenticated (Contributor+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f13a7eab-9c15-4829-9756-c5d4961a618c?source=api-prod","affected":[{"type":"plugin","slug":"include-file","name":"include-file","from":"*","from_inclusive":true,"to":"1","to_inclusive":true,"patched_in":""}],"published":"2025-04-03T00:00:00Z","updated":"2025-04-08T13:42:34Z"},{"id":"wordfence:f1420ec8-55e4-448d-8230-228d1e566b97","source":"wordfence","cve":"CVE-2025-13676","title":"JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1420ec8-55e4-448d-8230-228d1e566b97?source=api-prod","affected":[{"type":"plugin","slug":"justclick-subscriber","name":"JustClick registration plugin","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:24:10Z","updated":"2026-01-24T07:26:48Z"},{"id":"wordfence:f14478d9-2c17-48a8-a7d3-658a92a10d9c","source":"wordfence","cve":"CVE-2024-37523","title":"Login Logo Editor <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14478d9-2c17-48a8-a7d3-658a92a10d9c?source=api-prod","affected":[{"type":"plugin","slug":"login-logo-editor-by-oizuled","name":"Login Logo Editor","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T14:36:40Z"},{"id":"wordfence:f147641a-f430-4743-901e-539373dc10b7","source":"wordfence","cve":"CVE-2024-5025","title":"MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f147641a-f430-4743-901e-539373dc10b7?source=api-prod","affected":[{"type":"plugin","slug":"memberpress","name":"Memberpress","from":"*","from_inclusive":true,"to":"1.11.29","to_inclusive":true,"patched_in":"1.11.30"}],"published":"2024-05-21T20:02:06Z","updated":"2024-05-22T08:31:23Z"},{"id":"wordfence:f147fc47-cbdb-47ff-b2e7-6ea5e40d2048","source":"wordfence","cve":"CVE-2026-94062","title":"Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f147fc47-cbdb-47ff-b2e7-6ea5e40d2048?source=api-prod","affected":[{"type":"theme","slug":"werkstatt","name":"Werkstatt - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"4.8.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:21:05Z"},{"id":"wordfence:f14960a9-be10-4af9-a0df-74abdfad89da","source":"wordfence","cve":"CVE-2026-112845","title":"Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14960a9-be10-4af9-a0df-74abdfad89da?source=api-prod","affected":[{"type":"plugin","slug":"off-canvas-sidebars","name":"Off-Canvas Sidebars & Menus (Slidebars)","from":"*","from_inclusive":true,"to":"0.5.9","to_inclusive":true,"patched_in":"0.5.9.1"}],"published":"2026-10-22T07:33:00Z","updated":"2026-10-23T18:38:14Z"},{"id":"wordfence:f14a658c-1517-4af4-8bd7-c379ac07ab35","source":"wordfence","cve":"CVE-2024-11391","title":"Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14a658c-1517-4af4-8bd7-c379ac07ab35?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.2.10","to_inclusive":true,"patched_in":"5.2.11"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-03T14:34:29Z"},{"id":"wordfence:f14b07ce-8893-4f8c-a501-5da6ec5a3b8f","source":"wordfence","cve":"CVE-2026-119077","title":"ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=api-prod","affected":[{"type":"plugin","slug":"elex-helpdesk-customer-support-ticket-system","name":"ELEX WordPress HelpDesk & Customer Ticketing System","from":"*","from_inclusive":true,"to":"3.3.9","to_inclusive":true,"patched_in":"3.4.0"}],"published":"2026-11-12T21:10:29Z","updated":"2026-11-13T09:35:17Z"},{"id":"wordfence:f14e3f20-b022-49f8-89b0-acca9b950cb8","source":"wordfence","cve":"CVE-2026-77161","title":"Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f14e3f20-b022-49f8-89b0-acca9b950cb8?source=api-prod","affected":[{"type":"plugin","slug":"smart-marketing-for-wp","name":"Smart Marketing SMS and Newsletters Forms","from":"*","from_inclusive":true,"to":"5.1.24","to_inclusive":true,"patched_in":"5.1.25"}],"published":"2026-09-11T18:42:11Z","updated":"2026-09-17T18:46:47Z"},{"id":"wordfence:f151cb44-499e-4b08-80fb-0a573594d624","source":"wordfence","cve":"CVE-2025-14057","title":"Multi-column Tag Map <= 17.0.39 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f151cb44-499e-4b08-80fb-0a573594d624?source=api-prod","affected":[{"type":"plugin","slug":"multi-column-tag-map","name":"Multi-column Tag Map","from":"*","from_inclusive":true,"to":"17.0.39","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T20:34:33Z","updated":"2026-01-07T09:21:06Z"},{"id":"wordfence:f153174a-1226-4c16-ba8b-637be1d7e742","source":"wordfence","cve":"CVE-2024-13397","title":"WPRadio \u2013 WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f153174a-1226-4c16-ba8b-637be1d7e742?source=api-prod","affected":[{"type":"plugin","slug":"wpradio","name":"WPRadio \u2013 WordPress Radio Streaming Plugin","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-01-30T14:11:42Z","updated":"2025-11-05T21:42:18Z"},{"id":"wordfence:f153a0ce-c967-43ed-97be-901ea7dcd12b","source":"wordfence","cve":"CVE-2025-8317","title":"Custom Word Cloud <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f153a0ce-c967-43ed-97be-901ea7dcd12b?source=api-prod","affected":[{"type":"plugin","slug":"custom-word-cloud","name":"Custom Word Cloud","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T18:51:01Z","updated":"2025-08-02T07:24:22Z"},{"id":"wordfence:f15415aa-b820-4697-8360-b526312c89d3","source":"wordfence","cve":"CVE-2023-46784","title":"ICS Calendar <= 10.12.0.2 - Authenticated (Contributor+) Arbitrary File Read and Server-Side Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15415aa-b820-4697-8360-b526312c89d3?source=api-prod","affected":[{"type":"plugin","slug":"ics-calendar","name":"ICS Calendar","from":"*","from_inclusive":true,"to":"10.12.0.2","to_inclusive":true,"patched_in":"10.12.0.3"}],"published":"2023-10-26T00:00:00Z","updated":"2024-03-12T09:04:27Z"},{"id":"wordfence:f159392b-5bc6-4c12-a924-13ea170bb7fa","source":"wordfence","cve":"CVE-2026-18404","title":"Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f159392b-5bc6-4c12-a924-13ea170bb7fa?source=api-prod","affected":[{"type":"plugin","slug":"wp-whatsapp-chat","name":"Social Chat \u2013 Click To Chat App Button","from":"*","from_inclusive":true,"to":"8.6.2","to_inclusive":true,"patched_in":"8.6.3"}],"published":"2026-09-04T17:07:05Z","updated":"2026-09-05T05:30:56Z"},{"id":"wordfence:f15ad88b-7dcb-4a36-877a-e7017d98d498","source":"wordfence","cve":"CVE-2024-10515","title":"SEO Plugin by Squirrly SEO <= 12.3.20 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15ad88b-7dcb-4a36-877a-e7017d98d498?source=api-prod","affected":[{"type":"plugin","slug":"squirrly-seo","name":"GEO Plugin by Squirrly SEO","from":"*","from_inclusive":true,"to":"12.3.20","to_inclusive":true,"patched_in":"12.3.21"}],"published":"2024-10-30T00:00:00Z","updated":"2024-11-15T17:55:13Z"},{"id":"wordfence:f15af4eb-5752-4a85-babd-cee7e89c329d","source":"wordfence","cve":"CVE-2023-27423","title":"Auto Prune Posts <= 1.8.0 - Cross-Site Request Forgery via admin_menu","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15af4eb-5752-4a85-babd-cee7e89c329d?source=api-prod","affected":[{"type":"plugin","slug":"auto-prune-posts","name":"Auto Prune Posts","from":"*","from_inclusive":true,"to":"1.8.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f15b4596-8e00-4e66-8b51-f49ede1ff307","source":"wordfence","cve":"CVE-2025-12634","title":"Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15b4596-8e00-4e66-8b51-f49ede1ff307?source=api-prod","affected":[{"type":"plugin","slug":"refund-request-for-woocommerce","name":"Refund Request for WooCommerce","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:16:59Z","updated":"2025-11-25T07:28:27Z"},{"id":"wordfence:f15d39ba-9211-4d35-8252-20d53c6bc249","source":"wordfence","cve":"CVE-2022-25606","title":"WP-DownloadManager <= 1.68.6 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15d39ba-9211-4d35-8252-20d53c6bc249?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.7","to_inclusive":false,"patched_in":"1.68.7"}],"published":"2022-01-10T13:42:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f15dbce4-2e94-4735-b62b-e32d923c51ce","source":"wordfence","cve":"CVE-2025-13613","title":"Elated Membership <= 1.2 - Authentication Bypass via Social Login","severity":"critical","cvss":9.8,"cwe":"CWE-289","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15dbce4-2e94-4735-b62b-e32d923c51ce?source=api-prod","affected":[{"type":"plugin","slug":"eltdf-membership","name":"Elated Membership","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-12-09T13:16:05Z","updated":"2025-12-10T01:51:52Z"},{"id":"wordfence:f15e661f-9808-4935-b2d2-42d3e7af4362","source":"wordfence","cve":"CVE-2025-58791","title":"SEO Auto Linker <= 1.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15e661f-9808-4935-b2d2-42d3e7af4362?source=api-prod","affected":[{"type":"plugin","slug":"wpa-seo-auto-linker","name":"SEO Auto Linker","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T14:02:09Z"},{"id":"wordfence:f15f0211-724d-45b5-bf2f-7482f77c474d","source":"wordfence","cve":"CVE-2026-1613","title":"Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15f0211-724d-45b5-bf2f-7482f77c474d?source=api-prod","affected":[{"type":"plugin","slug":"wonka-slide","name":"Wonka Slide","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:21:28Z","updated":"2026-02-07T08:26:40Z"},{"id":"wordfence:f15f29e6-ecb7-403c-881f-f4dfdd7b8a84","source":"wordfence","cve":"CVE-2026-39443","title":"EmallShop <= 2.4.21 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15f29e6-ecb7-403c-881f-f4dfdd7b8a84?source=api-prod","affected":[{"type":"theme","slug":"emallshop","name":"EmallShop - Responsive WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.4.21","to_inclusive":true,"patched_in":"2.4.22"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:05:06Z"},{"id":"wordfence:f15f85c6-0bba-4bbd-b097-d205b9e0a075","source":"wordfence","cve":"CVE-2022-3241","title":"Build App Online <= 1.0.18 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f15f85c6-0bba-4bbd-b097-d205b9e0a075?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.0.19"}],"published":"2022-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f160f474-de8d-4120-9f46-a185b035a627","source":"wordfence","cve":"CVE-2022-0648","title":"Team Circle Image Slider With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f160f474-de8d-4120-9f46-a185b035a627?source=api-prod","affected":[{"type":"plugin","slug":"circle-image-slider-with-lightbox","name":"Team Circle Image Slider With Lightbox","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2022-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f162e046-a7d3-4f2c-899d-6c46cb92c8ee","source":"wordfence","cve":"CVE-2021-25118","title":"Yoast SEO <= 17.2 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f162e046-a7d3-4f2c-899d-6c46cb92c8ee?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"17.3","to_inclusive":false,"patched_in":"17.3"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1637a3b-7b0f-485d-9d19-4f711f8c671b","source":"wordfence","cve":"CVE-2026-75816","title":"Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1637a3b-7b0f-485d-9d19-4f711f8c671b?source=api-prod","affected":[{"type":"plugin","slug":"acf-frontend-form-element","name":"ACF Frontend Admin by DynamiApps","from":"*","from_inclusive":true,"to":"3.29.12","to_inclusive":true,"patched_in":"3.29.13"}],"published":"2026-09-05T13:59:17Z","updated":"2026-09-06T02:26:54Z"},{"id":"wordfence:f1666371-9401-4b62-b44e-abc7fb4c6138","source":"wordfence","cve":"CVE-2022-29418","title":"Night Mode <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1666371-9401-4b62-b44e-abc7fb4c6138?source=api-prod","affected":[{"type":"plugin","slug":"night-mode","name":"Night Mode","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f167c3c5-df35-456c-a5f1-139cc3c02ffb","source":"wordfence","cve":"CVE-2022-47154","title":"CSS JS Manager <= 2.4.49 - Cross-Site Request Forgery","severity":"medium","cvss":6.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f167c3c5-df35-456c-a5f1-139cc3c02ffb?source=api-prod","affected":[{"type":"plugin","slug":"css-js-manager","name":"CSS JS Manager, Async JavaScript, Defer Render Blocking CSS","from":"*","from_inclusive":true,"to":"2.4.49","to_inclusive":true,"patched_in":"2.4.49.1"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f16b11b0-11df-4fb7-a6af-123f6c09d791","source":"wordfence","cve":"CVE-2024-11143","title":"Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f16b11b0-11df-4fb7-a6af-123f6c09d791?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:20Z"},{"id":"wordfence:f16ea30d-0d03-4464-b75d-e77264af2510","source":"wordfence","cve":"CVE-2024-37536","title":"Easy Custom Code (LESS/CSS/JS) \u2013 Live editing <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f16ea30d-0d03-4464-b75d-e77264af2510?source=api-prod","affected":[{"type":"plugin","slug":"easy-custom-code","name":"Easy Custom Code (LESS/CSS/JS) \u2013 Live editing","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-30T19:59:35Z"},{"id":"wordfence:f16eea85-fa55-46b4-85a8-e441a119a569","source":"wordfence","cve":"CVE-2025-69166","title":"Gunslinger <= 1.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f16eea85-fa55-46b4-85a8-e441a119a569?source=api-prod","affected":[{"type":"theme","slug":"gunslinger","name":"Gunslinger","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-02T11:40:25Z"},{"id":"wordfence:f170379e-e833-42e0-96fd-1e1722a8331c","source":"wordfence","cve":"CVE-2023-5710","title":"System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f170379e-e833-42e0-96fd-1e1722a8331c?source=api-prod","affected":[{"type":"plugin","slug":"system-dashboard","name":"System Dashboard","from":"*","from_inclusive":true,"to":"2.8.7","to_inclusive":true,"patched_in":"2.8.8"}],"published":"2023-12-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f174044a-7ec3-4b25-90d1-49dfe93ff8ac","source":"wordfence","cve":"CVE-2026-77758","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f174044a-7ec3-4b25-90d1-49dfe93ff8ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.1","to_inclusive":false,"patched_in":"8.5.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:42:32Z"},{"id":"wordfence:f175b4f4-973e-4163-8fd9-eb411b5589ec","source":"wordfence","cve":"CVE-2026-97263","title":"WPAdverts \u2013 Classifieds Plugin <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f175b4f4-973e-4163-8fd9-eb411b5589ec?source=api-prod","affected":[{"type":"plugin","slug":"wpadverts","name":"WPAdverts \u2013 Classifieds Plugin","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2026-10-08T13:12:53Z","updated":"2026-10-13T14:50:50Z"},{"id":"wordfence:f17c4748-2a95-495c-ad3b-86b272855791","source":"wordfence","cve":"CVE-2024-0610","title":"Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f17c4748-2a95-495c-ad3b-86b272855791?source=api-prod","affected":[{"type":"plugin","slug":"woo-payment-gateway-for-piraeus-bank","name":"Piraeus Bank WooCommerce Payment Gateway","from":"*","from_inclusive":true,"to":"1.6.5.1","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-02-16T00:00:00Z","updated":"2024-07-29T21:37:47Z"},{"id":"wordfence:f17d3e43-29c6-4c80-912d-53ceda3fcb5d","source":"wordfence","cve":"CVE-2026-14281","title":"Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f17d3e43-29c6-4c80-912d-53ceda3fcb5d?source=api-prod","affected":[{"type":"plugin","slug":"automation-web-platform","name":"Wawp Country Code & Chat Widget for WooCommerce","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2026-09-24T18:05:54Z","updated":"2026-09-25T06:39:57Z"},{"id":"wordfence:f17de16e-3ad5-4fa1-b5d4-fa50200648de","source":"wordfence","cve":"CVE-2026-61993","title":"Bitcoin Payments \u2013 Blockonomics  3.11.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f17de16e-3ad5-4fa1-b5d4-fa50200648de?source=api-prod","affected":[{"type":"plugin","slug":"blockonomics-bitcoin-payments","name":"Bitcoin Payments \u2013 Blockonomics","from":"3.11.0","from_inclusive":true,"to":"3.11.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T06:17:09Z","updated":"2026-11-03T20:06:23Z"},{"id":"wordfence:f185709e-0d13-48d3-9c15-03466b72dac2","source":"wordfence","cve":"CVE-2022-4166","title":"Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f185709e-0d13-48d3-9c15-03466b72dac2?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"},{"type":"plugin","slug":"contest-gallery-pro","name":"Contest Gallery Pro","from":"*","from_inclusive":true,"to":"19.1.4.1","to_inclusive":true,"patched_in":"19.1.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f18617cd-b2e9-480d-9ec0-9438a416721e","source":"wordfence","cve":"CVE-2024-8379","title":"Cost Calculator Builder <= 3.2.28 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18617cd-b2e9-480d-9ec0-9438a416721e?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.28","to_inclusive":true,"patched_in":"3.2.29"}],"published":"2024-09-09T00:00:00Z","updated":"2024-10-15T15:48:51Z"},{"id":"wordfence:f188337e-023e-498e-b752-b5f3fa7a9949","source":"wordfence","cve":"CVE-2026-9714","title":"Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f188337e-023e-498e-b752-b5f3fa7a9949?source=api-prod","affected":[{"type":"plugin","slug":"simple-divi-shortcode","name":"Simple Divi Shortcode","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-05-28T16:58:31Z","updated":"2026-05-29T05:32:38Z"},{"id":"wordfence:f188a5e6-699e-4e1a-b4e4-7fb4056b0bee","source":"wordfence","cve":"CVE-2024-13498","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f188a5e6-699e-4e1a-b4e4-7fb4056b0bee?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.8.1","to_inclusive":true,"patched_in":"8.8.2"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-12T05:22:52Z"},{"id":"wordfence:f188c032-6f36-45a9-9ca8-39bfe91c97d4","source":"wordfence","cve":"","title":"Konzept (Unkown Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f188c032-6f36-45a9-9ca8-39bfe91c97d4?source=api-prod","affected":[{"type":"theme","slug":"konzept","name":"Konzept - Fullscreen Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f189f606-ec30-4f5d-81c9-d526ba7141f0","source":"wordfence","cve":"CVE-2024-9839","title":"Uix Slideshow <= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f189f606-ec30-4f5d-81c9-d526ba7141f0?source=api-prod","affected":[{"type":"plugin","slug":"uix-slideshow","name":"Uix Slideshow","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2024-11-15T15:08:47Z","updated":"2025-01-14T15:23:59Z"},{"id":"wordfence:f18b1276-3f43-447d-8251-095c2dd57938","source":"wordfence","cve":"CVE-2025-6781","title":"Copymatic \u2013 AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18b1276-3f43-447d-8251-095c2dd57938?source=api-prod","affected":[{"type":"plugin","slug":"copymatic","name":"Copymatic \u2013 AI Content Writer & Generator","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-17T16:19:57Z","updated":"2025-07-18T04:23:03Z"},{"id":"wordfence:f18b7523-fa8f-4c5d-acd7-db0e2135c796","source":"wordfence","cve":"CVE-2023-7151","title":"Product Enquiry for WooCommerce <= 3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18b7523-fa8f-4c5d-acd7-db0e2135c796?source=api-prod","affected":[{"type":"plugin","slug":"gm-woocommerce-quote-popup","name":"Product Enquiry for WooCommerce","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-01-15T00:00:00Z","updated":"2024-02-06T13:50:02Z"},{"id":"wordfence:f18be13a-1b16-40f8-85a7-bd77b49e243c","source":"wordfence","cve":"CVE-2023-2288","title":"Otter - Gutenberg Blocks <= 2.2.5 - Authenticated (Author+) PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18be13a-1b16-40f8-85a7-bd77b49e243c?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f18c1d00-ed8a-4b55-88d5-42d534ede493","source":"wordfence","cve":"CVE-2025-32308","title":"Team Builder <= 1.5.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18c1d00-ed8a-4b55-88d5-42d534ede493?source=api-prod","affected":[{"type":"plugin","slug":"a-team-showcase","name":"Team Builder \u2014 Meet The Team WordPress Plugin","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-10T14:59:22Z"},{"id":"wordfence:f18daec4-0b1f-48d8-b6f2-788c8caad17f","source":"wordfence","cve":"CVE-2025-58819","title":"Bulk Featured Image <= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18daec4-0b1f-48d8-b6f2-788c8caad17f?source=api-prod","affected":[{"type":"plugin","slug":"bulk-featured-image","name":"Bulk Featured Image","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T19:26:52Z"},{"id":"wordfence:f18e25ed-477b-43ae-9661-0f2c4fecd322","source":"wordfence","cve":"CVE-2026-19948","title":"Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f18e25ed-477b-43ae-9661-0f2c4fecd322?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.17","to_inclusive":true,"patched_in":"2.2.18"}],"published":"2026-08-31T15:59:02Z","updated":"2026-09-01T04:27:53Z"},{"id":"wordfence:f19006a0-6848-467b-90ed-33b3ebd2c7ba","source":"wordfence","cve":"CVE-2023-28991","title":"Order date time for WooCommerce <= 3.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f19006a0-6848-467b-90ed-33b3ebd2c7ba?source=api-prod","affected":[{"type":"plugin","slug":"pi-woocommerce-order-date-time-and-type","name":"PI Delivery & Pickup Date Time for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.19","to_inclusive":true,"patched_in":"3.0.20"}],"published":"2023-03-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1939a30-50eb-4ad6-98e7-f94afade3efa","source":"wordfence","cve":"CVE-2025-39540","title":"WP Flipclock <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1939a30-50eb-4ad6-98e7-f94afade3efa?source=api-prod","affected":[{"type":"plugin","slug":"wp-flipclock","name":"WP Flipclock","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.10"}],"published":"2025-04-16T00:00:00Z","updated":"2025-05-21T13:40:15Z"},{"id":"wordfence:f1946a48-c1d6-4ca9-909f-0d4b78c25c36","source":"wordfence","cve":"CVE-2023-48754","title":"Delete Post Revisions In WordPress <= 4.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1946a48-c1d6-4ca9-909f-0d4b78c25c36?source=api-prod","affected":[{"type":"plugin","slug":"delete-post-revisions-on-single-click","name":"Delete Post Revisions In WordPress","from":"*","from_inclusive":true,"to":"4.6","to_inclusive":true,"patched_in":""}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f19a9bbb-9c7b-490f-b016-2e72ab2b35a5","source":"wordfence","cve":"CVE-2025-62978","title":"KiotViet Sync <= 1.8.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f19a9bbb-9c7b-490f-b016-2e72ab2b35a5?source=api-prod","affected":[{"type":"plugin","slug":"kiotvietsync","name":"KiotViet Sync","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2025-10-20T00:00:00Z","updated":"2025-10-29T15:47:35Z"},{"id":"wordfence:f19c84c7-9b27-48b0-b648-b5681eff1371","source":"wordfence","cve":"","title":"Advanced Custom Fields: Table Field < 1.1.13 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f19c84c7-9b27-48b0-b648-b5681eff1371?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields-table-field","name":"Table Field Add-on for ACF and SCF","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":false,"patched_in":"1.1.13"}],"published":"2016-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1a2a09d-b50e-499d-8cfd-6e2884e66127","source":"wordfence","cve":"CVE-2024-0248","title":"EazyDocs 2.3.8 - 2.3.9 -  Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1a2a09d-b50e-499d-8cfd-6e2884e66127?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"2.3.8","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-12-21T00:00:00Z","updated":"2024-03-22T17:41:08Z"},{"id":"wordfence:f1a75a95-e61e-4786-b882-8ca186843d57","source":"wordfence","cve":"CVE-2025-69138","title":"Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1a75a95-e61e-4786-b882-8ca186843d57?source=api-prod","affected":[{"type":"theme","slug":"genemy","name":"Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:29:45Z"},{"id":"wordfence:f1a8bdfb-b89c-4474-9568-bdfc75bcd5ab","source":"wordfence","cve":"CVE-2025-32529","title":"iONE360 configurator <= 2.0.57 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1a8bdfb-b89c-4474-9568-bdfc75bcd5ab?source=api-prod","affected":[{"type":"plugin","slug":"ione360-configurator","name":"iONE360  configurator","from":"*","from_inclusive":true,"to":"2.0.57","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2026-01-02T11:59:17Z"},{"id":"wordfence:f1aa6c8b-8231-49f1-a30a-fc1a03813221","source":"wordfence","cve":"CVE-2023-45271","title":"ProductX \u2013 Gutenberg WooCommerce Blocks <= 2.7.8 - Missing Authorization via option_data_save","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1aa6c8b-8231-49f1-a30a-fc1a03813221?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1abab37-7397-407c-bcbb-4597b289ce80","source":"wordfence","cve":"CVE-2026-41557","title":"Kapee < 1.7.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1abab37-7397-407c-bcbb-4597b289ce80?source=api-prod","affected":[{"type":"theme","slug":"kapee","name":"Kapee - Modern Multipurpose WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:52:35Z"},{"id":"wordfence:f1ac2544-f96b-4859-96de-795753a94264","source":"wordfence","cve":"CVE-2024-9846","title":"Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ac2544-f96b-4859-96de-795753a94264?source=api-prod","affected":[{"type":"plugin","slug":"enable-shortcodes-inside-widgetscomments-and-experts","name":"Enable Shortcodes inside Widgets,Comments and Experts","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-29T13:34:45Z","updated":"2024-10-30T02:04:38Z"},{"id":"wordfence:f1ad41b4-c97b-4b3d-a82d-b39570ffe82f","source":"wordfence","cve":"CVE-2025-31863","title":"Agency Toolkit <= 1.0.24 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ad41b4-c97b-4b3d-a82d-b39570ffe82f?source=api-prod","affected":[{"type":"plugin","slug":"agency-toolkit","name":"Agency Toolkit","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2025-04-01T00:00:00Z","updated":"2025-06-18T16:42:29Z"},{"id":"wordfence:f1add368-81d2-455f-a95a-c13566c58d39","source":"wordfence","cve":"CVE-2022-4371","title":"Web Invoice <= 2.1.3 - Authenticated SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1add368-81d2-455f-a95a-c13566c58d39?source=api-prod","affected":[{"type":"plugin","slug":"web-invoice","name":"Web Invoice \u2013 Invoicing and billing for WordPress","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2022-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1b14fa8-04a0-43e3-a908-db98cb2c5e16","source":"wordfence","cve":"CVE-2025-58961","title":"CF7 Auto Responder Addon <= 2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b14fa8-04a0-43e3-a908-db98cb2c5e16?source=api-prod","affected":[{"type":"plugin","slug":"CF7-autoresponder-addon","name":"CF7 Auto Responder Addon","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:28:17Z"},{"id":"wordfence:f1b6f041-5ea6-48ca-9ca7-4ce96cbfa275","source":"wordfence","cve":"CVE-2023-41660","title":"WP Migration Plugin DB & Files \u2013 WP Synchro <= 1.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b6f041-5ea6-48ca-9ca7-4ce96cbfa275?source=api-prod","affected":[{"type":"plugin","slug":"wpsynchro","name":"WP Synchro \u2013 The Ultimate WordPress Migration Tool","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.10.0"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1b6fe67-cbd8-438f-8e06-d0f25eddc81a","source":"wordfence","cve":"","title":"Custom Content Type Manager 0.9.8.7 - 0.9.8.8 - Malicious Backdoor","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b6fe67-cbd8-438f-8e06-d0f25eddc81a?source=api-prod","affected":[{"type":"plugin","slug":"custom-content-type-manager","name":"Custom Content Type Manager","from":"0.9.8.7","from_inclusive":true,"to":"0.9.8.8","to_inclusive":true,"patched_in":"0.9.8.9"}],"published":"2016-03-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1b7768a-9204-429d-a4d2-db9f240e92a4","source":"wordfence","cve":"CVE-2026-49766","title":"WP User Manager \u2013 User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b7768a-9204-429d-a4d2-db9f240e92a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-manager","name":"WP User Manager \u2013 Registration Form, Login Form, User Profile Builder & Member Directory","from":"*","from_inclusive":true,"to":"2.9.16","to_inclusive":true,"patched_in":"2.9.17"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-10T17:30:02Z"},{"id":"wordfence:f1b9725b-dee5-44ca-bb33-c6812fb76adc","source":"wordfence","cve":"CVE-2026-4021","title":"Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b9725b-dee5-44ca-bb33-c6812fb76adc?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"28.1.5","to_inclusive":true,"patched_in":"28.1.6"}],"published":"2026-03-23T11:19:11Z","updated":"2026-04-01T13:12:14Z"},{"id":"wordfence:f1bb0337-8ac7-40f8-9488-bdfa70b4b8a1","source":"wordfence","cve":"CVE-2026-107430","title":"VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok <= 1.2.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1bb0337-8ac7-40f8-9488-bdfa70b4b8a1?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-site-manager","name":"VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok","from":"*","from_inclusive":true,"to":"1.2.10","to_inclusive":true,"patched_in":"1.2.11"}],"published":"2026-10-12T07:45:00Z","updated":"2026-10-13T14:00:31Z"},{"id":"wordfence:f1bd7a28-cc48-4d99-8c4c-84cb810193ca","source":"wordfence","cve":"CVE-2025-54703","title":"Integrate Google Drive <= 1.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1bd7a28-cc48-4d99-8c4c-84cb810193ca?source=api-prod","affected":[{"type":"plugin","slug":"integrate-google-drive","name":"File Manager for Google Drive \u2013 Integrate Google Drive","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:49:01Z"},{"id":"wordfence:f1be8cdd-d394-4627-90a3-0a4781b9902e","source":"wordfence","cve":"CVE-2026-14238","title":"Vitepos <= 3.5.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1be8cdd-d394-4627-90a3-0a4781b9902e?source=api-prod","affected":[{"type":"plugin","slug":"vitepos","name":"Vitepos","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-17T16:29:57Z"},{"id":"wordfence:f1bf4f77-9539-4a9f-afec-f43f602c684f","source":"wordfence","cve":"CVE-2023-51674","title":"Advanced Access Manager <= 6.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1bf4f77-9539-4a9f-afec-f43f602c684f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-access-manager","name":"Access Governance for WordPress (aka AAM)","from":"*","from_inclusive":true,"to":"6.9.18","to_inclusive":true,"patched_in":"6.9.19"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1c08c10-7358-4618-b892-7d222ba460de","source":"wordfence","cve":"CVE-2022-25858","title":"terser (JS Package) < 5.14.2 - Denial of Service","severity":"low","cvss":3.7,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c08c10-7358-4618-b892-7d222ba460de?source=api-prod","affected":[{"type":"plugin","slug":"retro-winamp-block","name":"Retro Winamp Block","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"sophi","name":"Sophi","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"},{"type":"plugin","slug":"elasticpress","name":"ElasticPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.3.0"},{"type":"plugin","slug":"simple-podcasting","name":"Simple Podcasting","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":false,"patched_in":"1.2.4"},{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.6.0"}],"published":"2022-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1c2cb3f-2f9e-40c5-9e5f-5b85a53e5868","source":"wordfence","cve":"CVE-2024-11270","title":"WordPress Webinar Plugin \u2013 WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c2cb3f-2f9e-40c5-9e5f-5b85a53e5868?source=api-prod","affected":[{"type":"plugin","slug":"wp-webinarsystem","name":"WebinarPress \u2013 Webinar System for WordPress","from":"*","from_inclusive":true,"to":"1.33.24","to_inclusive":true,"patched_in":"1.33.25"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T04:18:00Z"},{"id":"wordfence:f1c2f11f-23ab-44d8-94dd-484cd21eea3c","source":"wordfence","cve":"CVE-2026-93773","title":"Mollie Forms <= 2.11.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c2f11f-23ab-44d8-94dd-484cd21eea3c?source=api-prod","affected":[{"type":"plugin","slug":"mollie-forms","name":"Mollie Forms","from":"*","from_inclusive":true,"to":"2.11.0","to_inclusive":true,"patched_in":"2.11.1"}],"published":"2026-09-23T09:54:00Z","updated":"2026-09-29T19:48:42Z"},{"id":"wordfence:f1c5ce2b-9ac4-4fd2-9e49-ccb8538ba100","source":"wordfence","cve":"CVE-2017-1002020","title":"Surveys 1.01.8 - Authenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c5ce2b-9ac4-4fd2-9e49-ccb8538ba100?source=api-prod","affected":[{"type":"plugin","slug":"surveys","name":"surveys","from":"*","from_inclusive":true,"to":"1.01.8","to_inclusive":true,"patched_in":""}],"published":"2017-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1c68f9d-a026-4cef-82e6-25949a3d59ad","source":"wordfence","cve":"CVE-2024-9073","title":"GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1c68f9d-a026-4cef-82e6-25949a3d59ad?source=api-prod","affected":[{"type":"plugin","slug":"gtg-advanced-blocks","name":"GutenGeek Free Gutenberg Blocks for WordPress","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-09-24T12:21:15Z","updated":"2024-09-25T02:05:26Z"},{"id":"wordfence:f1cbe675-4c0f-430a-b2db-85ba8605d172","source":"wordfence","cve":"","title":"Deeper Comments <= 2.1.1 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1cbe675-4c0f-430a-b2db-85ba8605d172?source=api-prod","affected":[{"type":"plugin","slug":"deeper-comments","name":"Deeper Comments","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1cd9abb-c60a-43b5-baf4-8caed0791c3d","source":"wordfence","cve":"CVE-2026-19855","title":"Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1cd9abb-c60a-43b5-baf4-8caed0791c3d?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"6.87","to_inclusive":false,"patched_in":"6.87"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-16T14:51:39Z"},{"id":"wordfence:f1d2015b-86e8-4d0f-b095-f3917480ff15","source":"wordfence","cve":"","title":"Bridge Theme <= 18.2, Qode Instagram Widget <=2.0.1, Qode Twitter Feed <= 2.0.0 - Open Redirect","severity":"high","cvss":7.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1d2015b-86e8-4d0f-b095-f3917480ff15?source=api-prod","affected":[{"type":"theme","slug":"bridge","name":"Bridge - Creative Multipurpose WordPress Theme","from":"*","from_inclusive":true,"to":"18.2.1","to_inclusive":false,"patched_in":"18.2.1"},{"type":"plugin","slug":"qode-instagram-widget","name":"Bridge Theme Qode Instagram Widget","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":false,"patched_in":"2.0.2"},{"type":"plugin","slug":"qode-twitter-feed","name":"Bridge Theme Qode Twitter Feed","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2019-10-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1d26326-c5c5-4993-aadf-298759eb873d","source":"wordfence","cve":"CVE-2020-11530","title":"Chop Slider 3 <= 3.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1d26326-c5c5-4993-aadf-298759eb873d?source=api-prod","affected":[{"type":"plugin","slug":"chopslider","name":"Chop Slider 3","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2020-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1d3b954-2a3f-4be9-ad0a-dfc0774d8d91","source":"wordfence","cve":"CVE-2025-54695","title":"HT Mega <= 2.9.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1d3b954-2a3f-4be9-ad0a-dfc0774d8d91?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:36:59Z"},{"id":"wordfence:f1d72e60-182f-4210-a190-e0a7f0237ed1","source":"wordfence","cve":"CVE-2025-58664","title":"Text To Speech TTS Accessibility <= 1.9.30 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1d72e60-182f-4210-a190-e0a7f0237ed1?source=api-prod","affected":[{"type":"plugin","slug":"text-to-audio","name":"Text To Speech TTS Accessibility","from":"*","from_inclusive":true,"to":"1.9.30","to_inclusive":true,"patched_in":"1.9.31"}],"published":"2025-09-22T00:00:00Z","updated":"2025-11-13T16:07:38Z"},{"id":"wordfence:f1d82500-c679-49c7-aa6e-3ca9ef73fee9","source":"wordfence","cve":"CVE-2025-30620","title":"WP Odoo Form Integrator <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1d82500-c679-49c7-aa6e-3ca9ef73fee9?source=api-prod","affected":[{"type":"plugin","slug":"wp-odoo-form-integrator","name":"WP Odoo Form Integrator","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:38:26Z"},{"id":"wordfence:f1dafafe-91bb-4cd6-93f3-e67538389697","source":"wordfence","cve":"CVE-2026-111851","title":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor <= 1.7.1068 - Authenticated (Contributor+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dafafe-91bb-4cd6-93f3-e67538389697?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1068","to_inclusive":true,"patched_in":"1.7.1069"}],"published":"2026-10-20T07:22:41Z","updated":"2026-10-23T18:47:21Z"},{"id":"wordfence:f1dcafe1-bdba-4476-bcc7-ad844da38a01","source":"wordfence","cve":"CVE-2024-11731","title":"Master Slider \u2013 Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dcafe1-bdba-4476-bcc7-ad844da38a01?source=api-prod","affected":[{"type":"plugin","slug":"master-slider","name":"Master Slider \u2013 Responsive Touch Slider","from":"*","from_inclusive":true,"to":"3.10.7","to_inclusive":true,"patched_in":"3.10.8"}],"published":"2025-03-04T21:15:20Z","updated":"2025-05-27T21:51:25Z"},{"id":"wordfence:f1dd0fa6-c6af-4a68-bc2a-c54dc40141db","source":"wordfence","cve":"CVE-2025-28885","title":"Fiverr.com Official Search Box <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dd0fa6-c6af-4a68-bc2a-c54dc40141db?source=api-prod","affected":[{"type":"plugin","slug":"fiverr-official-search-box","name":"Fiverr.com Official Search Box","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:59:46Z"},{"id":"wordfence:f1de4899-532a-4558-bff0-f4610bfdd49d","source":"wordfence","cve":"CVE-2026-9018","title":"Easy Elements for Elementor \u2013 Addons & Website Templates <= 1.4.9 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1de4899-532a-4558-bff0-f4610bfdd49d?source=api-prod","affected":[{"type":"plugin","slug":"easy-elements","name":"Easy Elements for Elementor \u2013 Addons & Website Templates","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2026-05-21T16:07:25Z","updated":"2026-09-18T18:56:41Z"},{"id":"wordfence:f1de8404-5c7b-48d7-ab7f-7f99b309ee43","source":"wordfence","cve":"","title":"timelineoptinpro Plugin (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1de8404-5c7b-48d7-ab7f-7f99b309ee43?source=api-prod","affected":[{"type":"plugin","slug":"timelineoptinpro","name":"timelineoptinpro","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1e1a9ab-9ba9-45ff-aecd-b8953abc653a","source":"wordfence","cve":"CVE-2025-5559","title":"TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e1a9ab-9ba9-45ff-aecd-b8953abc653a?source=api-prod","affected":[{"type":"plugin","slug":"timezonecalculator","name":"TimeZoneCalculator","from":"*","from_inclusive":true,"to":"3.37","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T13:44:37Z","updated":"2025-06-26T02:06:36Z"},{"id":"wordfence:f1e31357-7fbc-414b-a4f4-53fa5f2fc715","source":"wordfence","cve":"CVE-2023-2781","title":"User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e31357-7fbc-414b-a4f4-53fa5f2fc715?source=api-prod","affected":[{"type":"plugin","slug":"woo-confirmation-email","name":"User Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1e40072-7426-40ff-98bb-c4d1b325937c","source":"wordfence","cve":"CVE-2025-31745","title":"Subscription Form for Feedblitz <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e40072-7426-40ff-98bb-c4d1b325937c?source=api-prod","affected":[{"type":"plugin","slug":"feedblitz-email-subscription","name":"Subscription Form for Feedblitz","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:24:22Z"},{"id":"wordfence:f1e50d8c-e61c-4e94-b5e8-b24832dc24b6","source":"wordfence","cve":"CVE-2024-10092","title":"Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e50d8c-e61c-4e94-b5e8-b24832dc24b6?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"5.0.12","to_inclusive":true,"patched_in":"5.0.13"}],"published":"2024-10-25T19:31:37Z","updated":"2024-10-26T07:36:08Z"},{"id":"wordfence:f1e5438f-1309-4d39-a9b4-cda27b652d93","source":"wordfence","cve":"CVE-2026-73363","title":"E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e5438f-1309-4d39-a9b4-cda27b652d93?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":false,"patched_in":"2.0.8"}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:28:44Z"},{"id":"wordfence:f1e98579-6e23-4309-9db5-e47d1e77ab07","source":"wordfence","cve":"CVE-2015-1000002","title":"File Download <= 1.4 - Open Proxy","severity":"high","cvss":8.2,"cwe":"CWE-441","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e98579-6e23-4309-9db5-e47d1e77ab07?source=api-prod","affected":[{"type":"plugin","slug":"filedownload","name":"filedownload","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"2.0"}],"published":"2017-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1ea9976-cd05-4149-8920-5c647d2cb9e1","source":"wordfence","cve":"CVE-2026-112853","title":"Hallelujah <= 1.1.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ea9976-cd05-4149-8920-5c647d2cb9e1?source=api-prod","affected":[{"type":"theme","slug":"hallelujah","name":"Hallelujah | Religion & Church Charity WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T17:04:10Z"},{"id":"wordfence:f1eacb72-df11-4a3b-9064-f8f776f3522b","source":"wordfence","cve":"CVE-2026-8994","title":"Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1eacb72-df11-4a3b-9064-f8f776f3522b?source=api-prod","affected":[{"type":"plugin","slug":"near-login","name":"Login with NEAR","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:04Z","updated":"2026-05-27T05:31:33Z"},{"id":"wordfence:f1eb0852-00ef-489a-aa39-7d8603249deb","source":"wordfence","cve":"CVE-2021-20866","title":"Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1eb0852-00ef-489a-aa39-7d8603249deb?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"},{"type":"plugin","slug":"advanced-custom-fields-pro","name":"Advanced Custom Fields Pro","from":"*","from_inclusive":true,"to":"5.11","to_inclusive":false,"patched_in":"5.11"}],"published":"2021-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1eb9ec6-897a-4c38-a85c-033d7050dcfa","source":"wordfence","cve":"CVE-2024-13795","title":"Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1eb9ec6-897a-4c38-a85c-033d7050dcfa?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.12.27","to_inclusive":true,"patched_in":"6.12.28"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:14Z"},{"id":"wordfence:f1ec6957-28c0-4441-8801-80b226569df9","source":"wordfence","cve":"CVE-2024-11756","title":"SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ec6957-28c0-4441-8801-80b226569df9?source=api-prod","affected":[{"type":"plugin","slug":"sweepwidget","name":"SweepWidget \u2013 Giveaway, Contest, Sweepstakes, Competition & Photo Contest Plugin","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2025-01-06T16:26:29Z","updated":"2026-02-12T19:31:49Z"},{"id":"wordfence:f1ed51a3-c049-4816-ada1-49f7edcb9a6f","source":"wordfence","cve":"CVE-2026-12119","title":"Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ed51a3-c049-4816-ada1-49f7edcb9a6f?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"6.3.7","to_inclusive":true,"patched_in":"6.3.8"}],"published":"2026-06-19T20:27:15Z","updated":"2026-06-20T08:29:52Z"},{"id":"wordfence:f1ef067b-e4b4-4174-b6ff-ec94a7afd55d","source":"wordfence","cve":"CVE-2020-36730","title":"CMP <= 3.8.1 - Missing Authorization","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=api-prod","affected":[{"type":"plugin","slug":"cmp-coming-soon-maintenance","name":"CMP \u2013 Coming Soon & Maintenance Plugin by NiteoThemes","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2020-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1efcff5-3af6-4c44-9654-b917523419aa","source":"wordfence","cve":"","title":"WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure","severity":"medium","cvss":4.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1efcff5-3af6-4c44-9654-b917523419aa?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"7.0.0","to_inclusive":true,"patched_in":"7.0.1"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1f06f3d-ca03-470a-b63c-9ad7426472b7","source":"wordfence","cve":"CVE-2025-58792","title":"Authors List <= 2.0.6.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f06f3d-ca03-470a-b63c-9ad7426472b7?source=api-prod","affected":[{"type":"plugin","slug":"authors-list","name":"Authors List","from":"*","from_inclusive":true,"to":"2.0.6.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:54:23Z"},{"id":"wordfence:f1f69f93-80e3-434d-98a6-fc8757b4e6d1","source":"wordfence","cve":"CVE-2026-1541","title":"Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f69f93-80e3-434d-98a6-fc8757b4e6d1?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-04-14T12:23:58Z","updated":"2026-04-15T01:25:17Z"},{"id":"wordfence:f1f75927-34c6-4086-86e8-abbf921f3423","source":"wordfence","cve":"CVE-2025-23462","title":"FWD Slider <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f75927-34c6-4086-86e8-abbf921f3423?source=api-prod","affected":[{"type":"plugin","slug":"fwd-slider","name":"FWD Slider","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:36:46Z"},{"id":"wordfence:f1f81d9b-87b5-4164-b472-e846421f121e","source":"wordfence","cve":"CVE-2025-46457","title":"Wp Custom CMS Block <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1f81d9b-87b5-4164-b472-e846421f121e?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-cms-block","name":"Wp Custom CMS Block","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:21:33Z"},{"id":"wordfence:f1fa1999-685c-4b68-927d-617abf9143d7","source":"wordfence","cve":"CVE-2023-37868","title":"Premium Addons PRO <= 2.9.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa1999-685c-4b68-927d-617abf9143d7?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-pro","name":"Premium Addons Pro for Elementor","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f1fa59e0-c946-40d3-a817-c9924b4588fa","source":"wordfence","cve":"CVE-2026-1187","title":"ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fa59e0-c946-40d3-a817-c9924b4588fa?source=api-prod","affected":[{"type":"plugin","slug":"tz-zoomifywp-free","name":"ZoomifyWP Free","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:18:18Z","updated":"2026-02-14T06:42:36Z"},{"id":"wordfence:f1fbac6d-a91b-410f-ad3c-7fab3627a7d1","source":"wordfence","cve":"CVE-2026-96901","title":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails < 2.2.0 - Unauthenticated Abandoned Cart Takeover","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fbac6d-a91b-410f-ad3c-7fab3627a7d1?source=api-prod","affected":[{"type":"plugin","slug":"woo-cart-abandonment-recovery","name":"Cart Abandonment Recovery for WooCommerce \u2013 Recover Lost Sales with Automated Emails","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":false,"patched_in":"2.2.0"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:44:01Z"},{"id":"wordfence:f1fca56e-ef15-4cfe-80b7-7f692e9c0c6e","source":"wordfence","cve":"CVE-2025-58864","title":"\u91d1\u6570\u636e <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fca56e-ef15-4cfe-80b7-7f692e9c0c6e?source=api-prod","affected":[{"type":"plugin","slug":"jinshuju","name":"\u91d1\u6570\u636e","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:24:26Z"},{"id":"wordfence:f1fd67c1-fbe8-4bad-a052-a73ad1c6e75d","source":"wordfence","cve":"CVE-2025-58229","title":"Sitekit <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f1fd67c1-fbe8-4bad-a052-a73ad1c6e75d?source=api-prod","affected":[{"type":"plugin","slug":"sitekit","name":"Sitekit","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:35:06Z"},{"id":"wordfence:f200062a-5f53-4abc-ae96-904f85d8b4e8","source":"wordfence","cve":"CVE-2026-27052","title":"Sales Countdown Timer for WooCommerce and WordPress <= 1.1.8.1 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f200062a-5f53-4abc-ae96-904f85d8b4e8?source=api-prod","affected":[{"type":"plugin","slug":"sctv-sales-countdown-timer","name":"Sales Countdown Timer for WooCommerce and WordPress","from":"*","from_inclusive":true,"to":"1.1.8.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-05-04T15:48:26Z"},{"id":"wordfence:f2000a8b-85e4-4031-a24b-a6e0ced774cc","source":"wordfence","cve":"CVE-2024-51614","title":"Aajoda Testimonials <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2000a8b-85e4-4031-a24b-a6e0ced774cc?source=api-prod","affected":[{"type":"plugin","slug":"aajoda-testimonials","name":"Aajoda Testimonials","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:32:20Z"},{"id":"wordfence:f203f30c-998b-4719-9268-0a78e1dc84be","source":"wordfence","cve":"CVE-2012-10026","title":"Asset Manager <= 0.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f203f30c-998b-4719-9268-0a78e1dc84be?source=api-prod","affected":[{"type":"plugin","slug":"asset-manager","name":"Asset Manager","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2012-05-26T00:00:00Z","updated":"2025-08-22T18:53:48Z"},{"id":"wordfence:f203fb35-e217-4912-aa80-0bb6b3de1830","source":"wordfence","cve":"CVE-2015-9514","title":"Easy Digital Downloads \u2013 Free Downloads <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f203fb35-e217-4912-aa80-0bb6b3de1830?source=api-prod","affected":[{"type":"plugin","slug":"edd-free-downloads","name":"Easy Digital Downloads - Free Downloads","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f208ca5a-a404-4664-80f5-643e713f600a","source":"wordfence","cve":"CVE-2021-34631","title":"NewsPlugin <= 1.0.18 \u2013 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f208ca5a-a404-4664-80f5-643e713f600a?source=api-prod","affected":[{"type":"plugin","slug":"newsplugin","name":"NewsPlugin","from":"*","from_inclusive":true,"to":"1.0.18","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2021-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f20aff55-f9c9-42f7-9c7b-3f4a709f4a60","source":"wordfence","cve":"CVE-2020-13487","title":"bbPress <= 2.6.4 -  Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20aff55-f9c9-42f7-9c7b-3f4a709f4a60?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":true,"patched_in":"2.6.5"}],"published":"2020-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f20b79cd-4393-4c96-ac78-139ac7c11144","source":"wordfence","cve":"","title":"o2s gallery <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20b79cd-4393-4c96-ac78-139ac7c11144?source=api-prod","affected":[{"type":"plugin","slug":"o2s-gallery","name":"o2s gallery","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2013-03-17T00:00:00Z","updated":"2026-02-26T14:49:48Z"},{"id":"wordfence:f20d9160-bddf-4fdb-a5a6-cc792bb1c1ee","source":"wordfence","cve":"CVE-2026-24942","title":"WpEvently <= 5.1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20d9160-bddf-4fdb-a5a6-cc792bb1c1ee?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2025-12-06T00:00:00Z","updated":"2026-02-10T19:26:24Z"},{"id":"wordfence:f20ead74-6db0-4bd2-82f6-0eb792288d70","source":"wordfence","cve":"CVE-2026-120577","title":"FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20ead74-6db0-4bd2-82f6-0eb792288d70?source=api-prod","affected":[{"type":"plugin","slug":"fluent-cart","name":"FluentCart \u2013 Online Store Builder & eCommerce Checkout","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-08-24T13:25:31Z","updated":"2026-11-03T04:43:11Z"},{"id":"wordfence:f20ee38e-6af0-48d7-8ac9-2972f3c4c679","source":"wordfence","cve":"CVE-2025-60207","title":"Custom User Registration Fields for WooCommerce <= 2.1.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20ee38e-6af0-48d7-8ac9-2972f3c4c679?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-plugin-for-woocommerce","name":"Custom User Registration Fields for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-14T00:00:00Z","updated":"2025-11-12T13:48:47Z"},{"id":"wordfence:f20fc354-e93c-4da4-8344-a71b07e04e56","source":"wordfence","cve":"CVE-2024-31088","title":"AdsPlace'r \u2013 Ad Manager, Inserter, AdSense Ads <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f20fc354-e93c-4da4-8344-a71b07e04e56?source=api-prod","affected":[{"type":"plugin","slug":"adsplacer","name":"AdsPlace&#039;r \u2013 Ad Manager, Inserter, AdSense Ads","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T20:08:01Z"},{"id":"wordfence:f21100f4-f655-41e6-a31c-70ce4dfb1ba6","source":"wordfence","cve":"","title":"Ceceppa Multilingua <= 1.5.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21100f4-f655-41e6-a31c-70ce4dfb1ba6?source=api-prod","affected":[{"type":"plugin","slug":"ceceppa-multilingua","name":"Ceceppa Multilingua","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":true,"patched_in":""}],"published":"2020-08-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2122fa2-0500-4c4e-aec5-eb440e8cc585","source":"wordfence","cve":"CVE-2026-18032","title":"Data Access <= 5.5.78 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2122fa2-0500-4c4e-aec5-eb440e8cc585?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-access","name":"WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps","from":"*","from_inclusive":true,"to":"5.5.78","to_inclusive":true,"patched_in":"5.5.79"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-15T21:53:25Z"},{"id":"wordfence:f212550c-1c93-4c3b-9eb2-b61cbe1eebb1","source":"wordfence","cve":"CVE-2025-58872","title":"Simple Price Calculator <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f212550c-1c93-4c3b-9eb2-b61cbe1eebb1?source=api-prod","affected":[{"type":"plugin","slug":"simple-price-calculator-basic","name":"Simple Price Calculator","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T21:34:55Z"},{"id":"wordfence:f2126761-cbff-4d46-a6df-4566d15216d7","source":"wordfence","cve":"CVE-2024-24804","title":"MW WP Form <= 5.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2126761-cbff-4d46-a6df-4566d15216d7?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":"5.1.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-03-22T15:37:38Z"},{"id":"wordfence:f213fb42-5bab-4017-80ea-ce6543031af2","source":"wordfence","cve":"CVE-2023-4021","title":"Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f213fb42-5bab-4017-80ea-ce6543031af2?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":false,"patched_in":"7.1.0"}],"published":"2023-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f214b915-f33a-450f-880b-f08be8284e9c","source":"wordfence","cve":"CVE-2025-52826","title":"Sala <= 1.1.3 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f214b915-f33a-450f-880b-f08be8284e9c?source=api-prod","affected":[{"type":"theme","slug":"sala","name":"Sala - Startup & SaaS WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-23T00:00:00Z","updated":"2025-07-01T19:12:36Z"},{"id":"wordfence:f214fd49-abf7-4c66-9ad2-a5da209c22df","source":"wordfence","cve":"CVE-2025-22651","title":"Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f214fd49-abf7-4c66-9ad2-a5da209c22df?source=api-prod","affected":[{"type":"plugin","slug":"stylish-google-sheet-reader","name":"Stylish Google Sheet Reader \u2013 Embed Google Sheets as Interactive Tables with Built-in Form Submissions","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.1"}],"published":"2025-02-03T00:00:00Z","updated":"2025-03-04T20:42:25Z"},{"id":"wordfence:f21577b4-b7c6-4b39-b2b7-66a75c5f56fb","source":"wordfence","cve":"CVE-2026-17609","title":"Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21577b4-b7c6-4b39-b2b7-66a75c5f56fb?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.3.316","to_inclusive":true,"patched_in":"6.3.317"}],"published":"2026-10-07T16:28:13Z","updated":"2026-10-08T04:28:52Z"},{"id":"wordfence:f215e320-8563-4d25-9963-ed3664b4901d","source":"wordfence","cve":"CVE-2026-3666","title":"wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f215e320-8563-4d25-9963-ed3664b4901d?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.16","to_inclusive":true,"patched_in":"2.4.17"}],"published":"2026-04-03T22:11:24Z","updated":"2026-04-04T11:16:18Z"},{"id":"wordfence:f216abf6-3883-4978-8ddb-f3f24cb40f26","source":"wordfence","cve":"CVE-2025-23733","title":"SC Simple Zazzle <= 1.1.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f216abf6-3883-4978-8ddb-f3f24cb40f26?source=api-prod","affected":[{"type":"plugin","slug":"sc-simple-zazzle","name":"SC Simple Zazzle","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-16T00:00:00Z","updated":"2026-04-25T16:00:20Z"},{"id":"wordfence:f218f967-a218-4a5f-991e-cfed226a313f","source":"wordfence","cve":"CVE-2025-32303","title":"WPCHURCH <= 2.7.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f218f967-a218-4a5f-991e-cfed226a313f?source=api-prod","affected":[{"type":"plugin","slug":"church-management","name":"WPCHURCH - Church Management System for Wordpress","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:48:49Z"},{"id":"wordfence:f219b6ea-58b9-455e-a99d-8412661c8e39","source":"wordfence","cve":"CVE-2024-27196","title":"postMash \u2013 custom post order <= 1.2.0 - Reflected Cross-Site Scripting via m","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f219b6ea-58b9-455e-a99d-8412661c8e39?source=api-prod","affected":[{"type":"plugin","slug":"postmash","name":"postMash \u2013 custom post order","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-02-26T00:00:00Z","updated":"2024-02-28T19:28:44Z"},{"id":"wordfence:f21c70aa-22be-456d-93bb-f478b70deaef","source":"wordfence","cve":"CVE-2017-9063","title":"WordPress Core < 4.7.5 - Cross-Site Scripting via Customizer","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21c70aa-22be-456d-93bb-f478b70deaef?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f21c9730-0834-4126-bc0d-c5f84b46dce9","source":"wordfence","cve":"CVE-2026-57637","title":"Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21c9730-0834-4126-bc0d-c5f84b46dce9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-abandoned-cart","name":"Abandoned Cart Lite for WooCommerce","from":"*","from_inclusive":true,"to":"6.8.0","to_inclusive":true,"patched_in":"6.8.1"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:38:46Z"},{"id":"wordfence:f21cbe18-77e1-4a9a-96a0-74edaef0db3e","source":"wordfence","cve":"CVE-2024-7435","title":"Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21cbe18-77e1-4a9a-96a0-74edaef0db3e?source=api-prod","affected":[{"type":"theme","slug":"attire","name":"Attire","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-08-30T14:33:13Z","updated":"2024-08-31T02:33:21Z"},{"id":"wordfence:f21e48b7-7dc7-4fd2-802c-da3c01cd5268","source":"wordfence","cve":"CVE-2025-58679","title":"AppMySite <= 3.15.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21e48b7-7dc7-4fd2-802c-da3c01cd5268?source=api-prod","affected":[{"type":"plugin","slug":"appmysite","name":"AppMySite \u2013 WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":true,"patched_in":"3.15.1"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:26:25Z"},{"id":"wordfence:f21f757b-43f8-4371-886c-b9f7fd79c715","source":"wordfence","cve":"CVE-2019-14679","title":"Pricing Table Plugin  - < 2.3 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f21f757b-43f8-4371-886c-b9f7fd79c715?source=api-prod","affected":[{"type":"plugin","slug":"arprice-responsive-pricing-table","name":"Pricing Table Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2019-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2244c29-9d79-47d5-b077-bf04a9199cdc","source":"wordfence","cve":"CVE-2020-35037","title":"Events Manager <= 5.9.7.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2244c29-9d79-47d5-b077-bf04a9199cdc?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.9.7.3","to_inclusive":true,"patched_in":"5.9.8"}],"published":"2020-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2251c72-cc98-477e-bd4d-0e134b86acce","source":"wordfence","cve":"CVE-2024-34380","title":"Conversational Forms for ChatBot <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2251c72-cc98-477e-bd4d-0e134b86acce?source=api-prod","affected":[{"type":"plugin","slug":"conversational-forms","name":"WPBot \u2013 ChatBot Conversational Forms","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:04:52Z"},{"id":"wordfence:f2262c0f-6839-43aa-9e19-9ccee6341ad7","source":"wordfence","cve":"CVE-2025-47606","title":"Simple Giveaways <= 2.48.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2262c0f-6839-43aa-9e19-9ccee6341ad7?source=api-prod","affected":[{"type":"plugin","slug":"giveasap","name":"Simple Giveaways \u2013 Grow your business, email lists and traffic with contests","from":"*","from_inclusive":true,"to":"2.48.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:26:12Z"},{"id":"wordfence:f2268be8-f9b8-4028-b681-7793b2bd43f8","source":"wordfence","cve":"CVE-2021-36869","title":"Ivory Search <= 4.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2268be8-f9b8-4028-b681-7793b2bd43f8?source=api-prod","affected":[{"type":"plugin","slug":"add-search-to-menu","name":"Ivory Search \u2013 WordPress Search Plugin","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.7"}],"published":"2021-10-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f22bb2ec-9d8d-45f6-9a86-cb5099fa301c","source":"wordfence","cve":"CVE-2024-12812","title":"WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f22bb2ec-9d8d-45f6-9a86-cb5099fa301c?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T16:01:00Z"},{"id":"wordfence:f22e9f6c-243f-4df0-bb59-57e0ad6a1f69","source":"wordfence","cve":"CVE-2024-13119","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f22e9f6c-243f-4df0-bb59-57e0ad6a1f69?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.19","to_inclusive":true,"patched_in":"4.15.20"}],"published":"2025-01-23T00:00:00Z","updated":"2025-02-21T19:43:03Z"},{"id":"wordfence:f231da1f-7eea-4fba-96b8-1f6e0c6ee3c2","source":"wordfence","cve":"CVE-2025-49342","title":"Custom Style <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f231da1f-7eea-4fba-96b8-1f6e0c6ee3c2?source=api-prod","affected":[{"type":"plugin","slug":"custom-style","name":"Custom Style","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:16:17Z"},{"id":"wordfence:f2329a5d-0649-498e-a18c-a17de7b30df4","source":"wordfence","cve":"CVE-2022-27848","title":"Modern Events Calendar Lite <= 6.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2329a5d-0649-498e-a18c-a17de7b30df4?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":true,"patched_in":"6.5.2"}],"published":"2022-04-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f232f550-f964-4a69-9a80-aa9768149094","source":"wordfence","cve":"","title":"BulletProof Security <= .53.3 - Authenticated Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f232f550-f964-4a69-9a80-aa9768149094?source=api-prod","affected":[{"type":"plugin","slug":"bulletproof-security","name":"BulletProof Security","from":"*","from_inclusive":true,"to":".53.4","to_inclusive":false,"patched_in":".53.4"}],"published":"2016-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f234d676-86ac-47ab-b8b3-b0459cbb4538","source":"wordfence","cve":"CVE-2024-13370","title":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f234d676-86ac-47ab-b8b3-b0459cbb4538?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2025-01-24T18:53:46Z","updated":"2025-02-11T21:13:28Z"},{"id":"wordfence:f234f05f-e377-4e89-81e1-f47ff44eebc5","source":"wordfence","cve":"CVE-2024-1118","title":"Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f234f05f-e377-4e89-81e1-f47ff44eebc5?source=api-prod","affected":[{"type":"plugin","slug":"podlove-subscribe-button","name":"Podlove Subscribe button","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2024-02-06T00:00:00Z","updated":"2024-02-07T11:02:40Z"},{"id":"wordfence:f2358979-25b9-4c52-88dc-25390be6bd22","source":"wordfence","cve":"CVE-2025-4339","title":"TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2358979-25b9-4c52-88dc-25390be6bd22?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.10.3","to_inclusive":true,"patched_in":"5.10.3.1"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-13T06:40:56Z"},{"id":"wordfence:f23604b7-5a7f-4be7-bc73-cb4facdd1e73","source":"wordfence","cve":"CVE-2024-10453","title":"Elementor Website Builder \u2013 More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23604b7-5a7f-4be7-bc73-cb4facdd1e73?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.25.9","to_inclusive":true,"patched_in":"3.25.10"}],"published":"2024-12-20T21:06:33Z","updated":"2024-12-21T09:23:56Z"},{"id":"wordfence:f2389c89-d28f-41b3-b0c8-d041a2902678","source":"wordfence","cve":"CVE-2026-110371","title":"Strong Testimonials <= 3.3.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2389c89-d28f-41b3-b0c8-d041a2902678?source=api-prod","affected":[{"type":"plugin","slug":"strong-testimonials","name":"Strong Testimonials","from":"*","from_inclusive":true,"to":"3.3.12","to_inclusive":true,"patched_in":"3.3.13"}],"published":"2026-10-15T17:43:00Z","updated":"2026-10-23T18:34:07Z"},{"id":"wordfence:f23b144e-4380-4099-89b5-816c8c2f710f","source":"wordfence","cve":"CVE-2023-45651","title":"WP Attachments <= 5.0.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23b144e-4380-4099-89b5-816c8c2f710f?source=api-prod","affected":[{"type":"plugin","slug":"wp-attachments","name":"WP Attachments \u2013 Smarter File Management & Download Lists","from":"*","from_inclusive":true,"to":"5.0.11","to_inclusive":true,"patched_in":"5.0.12"}],"published":"2023-10-12T00:00:00Z","updated":"2024-07-11T17:21:55Z"},{"id":"wordfence:f23ba80e-94d7-40a1-beb8-da9ec0c9f7d7","source":"wordfence","cve":"CVE-2025-48116","title":"EventON <= 2.4.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23ba80e-94d7-40a1-beb8-da9ec0c9f7d7?source=api-prod","affected":[{"type":"plugin","slug":"eventon-lite","name":"EventON \u2013 Events Calendar","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-29T20:14:25Z"},{"id":"wordfence:f23bb22c-2f7b-4940-b0bc-1e5f2b8d0ed2","source":"wordfence","cve":"CVE-2026-59548","title":"Byteflows Travel & Hotel Booking <= 1.0.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23bb22c-2f7b-4940-b0bc-1e5f2b8d0ed2?source=api-prod","affected":[{"type":"plugin","slug":"byteflows-travel-hotel-booking","name":"Byteflows Travel & Hotel Booking","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:00:28Z"},{"id":"wordfence:f23d0089-b216-4d02-af23-e06262b44004","source":"wordfence","cve":"CVE-2026-66653","title":"Barista <= 2.5.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23d0089-b216-4d02-af23-e06262b44004?source=api-prod","affected":[{"type":"theme","slug":"barista","name":"Barista","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-11T00:00:00Z","updated":"2026-08-13T18:48:19Z"},{"id":"wordfence:f23d80ae-a686-4e89-a8c0-648289521c58","source":"wordfence","cve":"","title":"All-in-One Events Calendar < 1.10 - SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23d80ae-a686-4e89-a8c0-648289521c58?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-event-calendar","name":"Timely All-in-One Events Calendar","from":"*","from_inclusive":true,"to":"1.10","to_inclusive":false,"patched_in":"1.10"}],"published":"2013-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f23dd2d7-3b21-47d6-b6da-24c20c36ee7c","source":"wordfence","cve":"CVE-2026-39625","title":"TechOne <= 3.0.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23dd2d7-3b21-47d6-b6da-24c20c36ee7c?source=api-prod","affected":[{"type":"theme","slug":"techone","name":"TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported )","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-05-05T15:24:49Z"},{"id":"wordfence:f23dec73-9031-4829-a84b-4979c8e8ded4","source":"wordfence","cve":"CVE-2026-4278","title":"Simple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23dec73-9031-4829-a84b-4979c8e8ded4?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-counter","name":"Simple Download Counter","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2026-03-25T00:00:00Z","updated":"2026-03-26T03:37:29Z"},{"id":"wordfence:f23e7274-45f6-46da-b4c8-2eaa1bd39257","source":"wordfence","cve":"CVE-2024-7313","title":"Shield Security \u2013 Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23e7274-45f6-46da-b4c8-2eaa1bd39257?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"20.0.5","to_inclusive":true,"patched_in":"20.0.6"}],"published":"2024-08-05T00:00:00Z","updated":"2024-08-28T22:54:05Z"},{"id":"wordfence:f23ff4ce-9e53-442a-8ac8-19ecb30dcd66","source":"wordfence","cve":"CVE-2026-86814","title":"UsersWP - Social Login <= 1.5.9 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f23ff4ce-9e53-442a-8ac8-19ecb30dcd66?source=api-prod","affected":[{"type":"plugin","slug":"userswp-social-login","name":"UsersWP \u2013 Social Login","from":"*","from_inclusive":true,"to":"1.5.9","to_inclusive":true,"patched_in":"1.5.10"}],"published":"2026-09-17T00:00:00Z","updated":"2026-09-22T18:58:23Z"},{"id":"wordfence:f24003da-2d30-427c-b3f7-bbce4649c34d","source":"wordfence","cve":"CVE-2025-31542","title":"My auctions allegro <= 3.6.20 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24003da-2d30-427c-b3f7-bbce4649c34d?source=api-prod","affected":[{"type":"plugin","slug":"my-auctions-allegro-free-edition","name":"My auctions allegro","from":"*","from_inclusive":true,"to":"3.6.20","to_inclusive":true,"patched_in":"3.6.21"}],"published":"2025-03-31T00:00:00Z","updated":"2025-07-08T17:14:09Z"},{"id":"wordfence:f2401464-c142-47fa-8662-138f39a4022a","source":"wordfence","cve":"CVE-2026-15360","title":"Ajax Load More <= 8.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2401464-c142-47fa-8662-138f39a4022a?source=api-prod","affected":[{"type":"plugin","slug":"ajax-load-more","name":"Ajax Load More \u2013 Infinite Scroll, Load More, & Lazy Load","from":"*","from_inclusive":true,"to":"8.0.0","to_inclusive":true,"patched_in":"8.0.1"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-15T21:14:38Z"},{"id":"wordfence:f24142f3-4e09-4762-8b12-2388821130cd","source":"wordfence","cve":"CVE-2026-111414","title":"JetElements <= 2.9.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24142f3-4e09-4762-8b12-2388821130cd?source=api-prod","affected":[{"type":"plugin","slug":"jet-elements","name":"JetElements","from":"*","from_inclusive":true,"to":"2.9.2.4","to_inclusive":true,"patched_in":"2.9.2.5"}],"published":"2026-10-19T12:19:00Z","updated":"2026-10-23T18:43:32Z"},{"id":"wordfence:f2448450-9d0e-42bc-bfdb-66861b2f212c","source":"wordfence","cve":"","title":"Gravityforms <= 1.9.6 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2448450-9d0e-42bc-bfdb-66861b2f212c?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f24749a8-e01d-436a-9ec8-3745a6b5eecf","source":"wordfence","cve":"CVE-2026-8653","title":"MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24749a8-e01d-436a-9ec8-3745a6b5eecf?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system-pro","name":"MasterStudy LMS Pro","from":"*","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"4.8.21"}],"published":"2026-06-03T11:45:24Z","updated":"2026-06-04T01:26:45Z"},{"id":"wordfence:f2488eb7-5c80-48d5-8f39-736883207937","source":"wordfence","cve":"CVE-2026-22337","title":"Directorist Social Login <= 2.1.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2488eb7-5c80-48d5-8f39-736883207937?source=api-prod","affected":[{"type":"plugin","slug":"directorist-social-login","name":"Directorist Social Login","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-28T16:50:47Z"},{"id":"wordfence:f248b116-b4b7-43ba-8fbf-3de86935582d","source":"wordfence","cve":"CVE-2024-54373","title":"EduAdmin Booking <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f248b116-b4b7-43ba-8fbf-3de86935582d?source=api-prod","affected":[{"type":"plugin","slug":"eduadmin-booking","name":"EduAdmin Booking","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T15:40:39Z"},{"id":"wordfence:f24af4f2-bb05-4833-a2bc-771143970e00","source":"wordfence","cve":"CVE-2012-10011","title":"HD FLV Player <= 1.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24af4f2-bb05-4833-a2bc-771143970e00?source=api-prod","affected":[{"type":"plugin","slug":"contus-hd-flv-player","name":"HD FLV PLayer","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2012-06-12T00:00:00Z","updated":"2024-02-07T14:57:43Z"},{"id":"wordfence:f24b3afe-5de3-464c-92af-a654e97f0945","source":"wordfence","cve":"CVE-2024-43986","title":"Taxi Booking Manager for WooCommerce \u2013 WordPress plugin | Ecab <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.0,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24b3afe-5de3-464c-92af-a654e97f0945?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-08-29T00:00:00Z","updated":"2024-09-05T14:02:30Z"},{"id":"wordfence:f24cfefe-f671-456d-a378-44a41fc81c0e","source":"wordfence","cve":"CVE-2018-0586","title":"Ultimate Member <= 2.0.3 - Directory Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24cfefe-f671-456d-a378-44a41fc81c0e?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":false,"patched_in":"2.0.4"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f24db166-93d6-4a61-a8fe-455eebde0777","source":"wordfence","cve":"CVE-2017-1002006","title":"Dtracker <= 1.5 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24db166-93d6-4a61-a8fe-455eebde0777?source=api-prod","affected":[{"type":"plugin","slug":"dtracker","name":"DTracker","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2017-03-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f24e711b-0b16-4948-97c9-807703a9baaf","source":"wordfence","cve":"CVE-2025-31015","title":"WordPress SMTP Service, Email Delivery Solved! \u2014 MailHawk <= 1.3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24e711b-0b16-4948-97c9-807703a9baaf?source=api-prod","affected":[{"type":"plugin","slug":"mailhawk","name":"MailHawk \u2014 Simple SMTP, Email Delivery, and Email Logging","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:30:40Z"},{"id":"wordfence:f24e753e-2eb0-49a2-9fb1-68daaca12816","source":"wordfence","cve":"CVE-2015-9348","title":"Sell Downloads <= 1.0.7 - Improper Input Validation","severity":"high","cvss":7.5,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24e753e-2eb0-49a2-9fb1-68daaca12816?source=api-prod","affected":[{"type":"plugin","slug":"sell-downloads","name":"Sell Downloads","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":false,"patched_in":"1.0.8"}],"published":"2015-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f24f0673-b5c8-4086-8795-692228a413af","source":"wordfence","cve":"CVE-2024-13232","title":"WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f24f0673-b5c8-4086-8795-692228a413af?source=api-prod","affected":[{"type":"plugin","slug":"wp-awesome-import-export","name":"WordPress Awesome Import & Export Plugin - Import & Export WordPress Data","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-03-04T21:05:07Z","updated":"2025-03-05T09:21:52Z"},{"id":"wordfence:f250793b-40c3-4362-bc0c-e3d65c922288","source":"wordfence","cve":"CVE-2025-39456","title":"WP Logger <= 2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f250793b-40c3-4362-bc0c-e3d65c922288?source=api-prod","affected":[{"type":"plugin","slug":"wp-data-logger","name":"WP Logger","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T19:23:10Z"},{"id":"wordfence:f256036d-11e8-4311-baa0-d15193c72da0","source":"wordfence","cve":"CVE-2023-49756","title":"Eventin <= 3.3.52 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f256036d-11e8-4311-baa0-d15193c72da0?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"3.3.52","to_inclusive":true,"patched_in":"3.3.53"}],"published":"2023-12-04T00:00:00Z","updated":"2024-04-18T20:14:53Z"},{"id":"wordfence:f25626f3-d9a9-4aad-8f5f-45f72d0711e1","source":"wordfence","cve":"CVE-2024-53788","title":"WordPress Portfolio Builder \u2013 Portfolio Gallery <= 1.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25626f3-d9a9-4aad-8f5f-45f72d0711e1?source=api-prod","affected":[{"type":"plugin","slug":"uber-grid","name":"WordPress Portfolio Builder \u2013 Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:05:13Z"},{"id":"wordfence:f256518c-9a3e-4e6e-8d49-d309e397c14d","source":"wordfence","cve":"CVE-2023-49161","title":"Bravo Translate <= 1.2 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f256518c-9a3e-4e6e-8d49-d309e397c14d?source=api-prod","affected":[{"type":"plugin","slug":"bravo-translate","name":"Bravo Translate","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f257bb6a-442d-4475-b2d0-e97b540cd2c0","source":"wordfence","cve":"CVE-2025-31006","title":"Activity Reactions For Buddypress <= 1.0.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f257bb6a-442d-4475-b2d0-e97b540cd2c0?source=api-prod","affected":[{"type":"plugin","slug":"activity-reactions-for-buddypress","name":"Activity Reactions For Buddypress","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T14:10:55Z"},{"id":"wordfence:f25a5b1a-9a33-4e61-8a32-ecebfa64e4bb","source":"wordfence","cve":"CVE-2024-52427","title":"Event Tickets with Ticket Scanner <= 2.3.11 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25a5b1a-9a33-4e61-8a32-ecebfa64e4bb?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T14:34:02Z"},{"id":"wordfence:f25b2a4b-d863-4f24-ae67-4c8e41602c6f","source":"wordfence","cve":"CVE-2023-49181","title":"WP Event Manager <= 3.1.41 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b2a4b-d863-4f24-ae67-4c8e41602c6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.41","to_inclusive":true,"patched_in":"3.1.42"}],"published":"2023-11-29T00:00:00Z","updated":"2024-02-27T00:31:44Z"},{"id":"wordfence:f25b355a-edeb-4d88-8419-ab0d716ec5bf","source":"wordfence","cve":"CVE-2022-2328","title":"Flexi Quote Rotator <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b355a-edeb-4d88-8419-ab0d716ec5bf?source=api-prod","affected":[{"type":"plugin","slug":"flexi-quote-rotator","name":"Flexi Quote Rotator","from":"*","from_inclusive":true,"to":"0.9.4","to_inclusive":true,"patched_in":""}],"published":"2022-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f25b6009-0edb-4acd-97a3-c24e6e51fecc","source":"wordfence","cve":"CVE-2026-126029","title":"WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25b6009-0edb-4acd-97a3-c24e6e51fecc?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.4.20","to_inclusive":true,"patched_in":"1.4.21"}],"published":"2026-11-12T21:00:10Z","updated":"2026-11-13T09:35:17Z"},{"id":"wordfence:f25cd403-77a4-437b-b9ba-93137bf9c936","source":"wordfence","cve":"CVE-2023-5958","title":"POST SMTP Mailer <= 2.7.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25cd403-77a4-437b-b9ba-93137bf9c936?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f25cdb02-4624-4a46-a622-28665e1d856e","source":"wordfence","cve":"CVE-2022-1645","title":"Amazon Link <= 3.2.10 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25cdb02-4624-4a46-a622-28665e1d856e?source=api-prod","affected":[{"type":"plugin","slug":"amazon-link","name":"Amazon Link","from":"*","from_inclusive":true,"to":"3.2.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f25d0409-dbca-4c5a-9f43-fc03e5307d0f","source":"wordfence","cve":"CVE-2005-2109","title":"WordPress Core < 1.5.1.3 - Arbitrary Email Content Change","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25d0409-dbca-4c5a-9f43-fc03e5307d0f?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.2","to_inclusive":true,"patched_in":"1.5.1.3"}],"published":"2005-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f25dc017-fc03-4792-bae5-8b4628e751e0","source":"wordfence","cve":"CVE-2026-102915","title":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25dc017-fc03-4792-bae5-8b4628e751e0?source=api-prod","affected":[{"type":"plugin","slug":"wpo365-login","name":"WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)","from":"*","from_inclusive":true,"to":"44.1","to_inclusive":true,"patched_in":"45.0"}],"published":"2026-10-05T10:04:36Z","updated":"2026-10-08T23:14:18Z"},{"id":"wordfence:f25dcd7e-8fb1-471e-bd22-782409de45c4","source":"wordfence","cve":"CVE-2026-3143","title":"Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25dcd7e-8fb1-471e-bd22-782409de45c4?source=api-prod","affected":[{"type":"plugin","slug":"boldgrid-backup","name":"Total Upkeep \u2013 WordPress Backup Plugin plus Restore & Migrate by BoldGrid","from":"*","from_inclusive":true,"to":"1.17.1","to_inclusive":true,"patched_in":"1.17.2"}],"published":"2026-04-30T00:00:00Z","updated":"2026-05-01T13:28:45Z"},{"id":"wordfence:f25de9b7-cd9d-4211-9201-816645b2caf9","source":"wordfence","cve":"CVE-2025-60166","title":"WP Subscription Forms PRO <=  2.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25de9b7-cd9d-4211-9201-816645b2caf9?source=api-prod","affected":[{"type":"plugin","slug":"wp-subscription-forms-pro","name":"WP Subscription Forms PRO","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T12:47:30Z"},{"id":"wordfence:f25f358b-f9b7-4660-8dda-673023dc1967","source":"wordfence","cve":"CVE-2024-43276","title":"Child Theme Creator <= 1.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f25f358b-f9b7-4660-8dda-673023dc1967?source=api-prod","affected":[{"type":"plugin","slug":"orbisius-child-theme-creator","name":"Child Theme Creator by Orbisius","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:10:33Z"},{"id":"wordfence:f260495e-d62f-41c9-b6ac-ea015e17ee2f","source":"wordfence","cve":"CVE-2024-54429","title":"Aphorismus <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f260495e-d62f-41c9-b6ac-ea015e17ee2f?source=api-prod","affected":[{"type":"plugin","slug":"aphorismus","name":"Aphorismus","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:30:53Z"},{"id":"wordfence:f265955d-a209-4193-9fb8-962b1b562249","source":"wordfence","cve":"CVE-2025-31909","title":"Apptivo Business Site CRM <= 5.3 - Missing Authorization to Arbitrary Content Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f265955d-a209-4193-9fb8-962b1b562249?source=api-prod","affected":[{"type":"plugin","slug":"apptivo-business-site","name":"Apptivo Business Site","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":"5.4"}],"published":"2025-04-02T00:00:00Z","updated":"2025-06-27T17:15:26Z"},{"id":"wordfence:f2667b7c-b743-44d1-90d6-b1be6fcd7dca","source":"wordfence","cve":"CVE-2024-47368","title":"Premium Blocks \u2013 Gutenberg Blocks for WordPress <= 2.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2667b7c-b743-44d1-90d6-b1be6fcd7dca?source=api-prod","affected":[{"type":"plugin","slug":"premium-blocks-for-gutenberg","name":"Premium Blocks \u2013 Gutenberg Blocks, Patterns & Templates","from":"*","from_inclusive":true,"to":"2.1.33","to_inclusive":true,"patched_in":"2.1.34"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:57:32Z"},{"id":"wordfence:f266f9db-a25e-4f50-b3c8-3bea3a7e86ce","source":"wordfence","cve":"CVE-2026-13755","title":"Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f266f9db-a25e-4f50-b3c8-3bea3a7e86ce?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.6.0.0","to_inclusive":true,"patched_in":"3.6.0.1"}],"published":"2026-07-15T19:29:50Z","updated":"2026-07-16T07:51:06Z"},{"id":"wordfence:f2675177-8b85-4fb8-ba10-ae02cb5c6c72","source":"wordfence","cve":"CVE-2022-47438","title":"Booking calendar, Appointment Booking System <= 3.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2675177-8b85-4fb8-ba10-ae02cb5c6c72?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f267527d-5fb5-4fc2-bb35-bc60854f1a68","source":"wordfence","cve":"CVE-2024-13010","title":"WP Foodbakery <= 4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f267527d-5fb5-4fc2-bb35-bc60854f1a68?source=api-prod","affected":[{"type":"plugin","slug":"wp-foodbakery","name":"WP Foodbakery","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":""}],"published":"2025-02-10T00:00:00Z","updated":"2025-02-24T08:24:34Z"},{"id":"wordfence:f26870a2-6017-42aa-92ef-fa55905505d8","source":"wordfence","cve":"CVE-2026-81655","title":"Ad Inserter 2.8.12 - 2.8.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26870a2-6017-42aa-92ef-fa55905505d8?source=api-prod","affected":[{"type":"plugin","slug":"ad-inserter","name":"Ad Inserter \u2013 Ad Manager & AdSense Ads","from":"2.8.12","from_inclusive":true,"to":"2.8.18","to_inclusive":true,"patched_in":"2.8.19"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:03:46Z"},{"id":"wordfence:f268974a-db92-42d2-9e1d-f990ea067740","source":"wordfence","cve":"","title":"Contact Form Manager <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f268974a-db92-42d2-9e1d-f990ea067740?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-manager","name":"Contact Form Manager","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2015-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f26a6ace-4623-4931-a4e4-8176d799d274","source":"wordfence","cve":"CVE-2024-31922","title":"WordPress Hosting Benchmark tool <= 1.3.6 - Cross-Site Request Forgery via execute_plugin()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26a6ace-4623-4931-a4e4-8176d799d274?source=api-prod","affected":[{"type":"plugin","slug":"wpbenchmark","name":"Hosting Benchmark tool","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.3.7"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:42:14Z"},{"id":"wordfence:f26b0dc2-2b24-46e6-a7e8-f87e970df042","source":"wordfence","cve":"CVE-2025-60120","title":"WP Directory Kit <= 1.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26b0dc2-2b24-46e6-a7e8-f87e970df042?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-21T20:51:31Z"},{"id":"wordfence:f26c0279-0b51-40a8-8d11-6f2cbb21e59a","source":"wordfence","cve":"CVE-2026-109386","title":"Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26c0279-0b51-40a8-8d11-6f2cbb21e59a?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-popup","name":"Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups","from":"*","from_inclusive":true,"to":"7.8.14.3","to_inclusive":true,"patched_in":"7.8.14.4"}],"published":"2026-10-30T18:27:27Z","updated":"2026-10-31T06:44:24Z"},{"id":"wordfence:f26cbc41-8ed9-4dc6-a8bc-9986ecab5e6e","source":"wordfence","cve":"CVE-2026-18409","title":"WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26cbc41-8ed9-4dc6-a8bc-9986ecab5e6e?source=api-prod","affected":[{"type":"plugin","slug":"wpforms","name":"WPForms Pro","from":"*","from_inclusive":true,"to":"2.0.0.2","to_inclusive":true,"patched_in":"2.0.0.3"}],"published":"2026-08-20T14:47:20Z","updated":"2026-08-21T03:37:48Z"},{"id":"wordfence:f26f1613-5fb4-4c4b-a993-15089b53af2e","source":"wordfence","cve":"CVE-2025-46455","title":"WP HRM LITE <= 1.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26f1613-5fb4-4c4b-a993-15089b53af2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-hrm-lite-human-resource-management-system","name":"WP HRM LITE","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:09:08Z"},{"id":"wordfence:f26fcef3-6d94-46f6-9832-bdb03b6cb867","source":"wordfence","cve":"CVE-2019-14785","title":"CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f26fcef3-6d94-46f6-9832-bdb03b6cb867?source=api-prod","affected":[{"type":"plugin","slug":"cp-contact-form-with-paypal","name":"CP Contact Form with PayPal","from":"*","from_inclusive":true,"to":"1.3.02","to_inclusive":false,"patched_in":"1.3.02"}],"published":"2019-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f270c73f-ccdb-4575-ab9b-014c65873607","source":"wordfence","cve":"CVE-2024-35778","title":"Slideshow SE <= 2.5.17 - Authenticated (Author+) Limited Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f270c73f-ccdb-4575-ab9b-014c65873607?source=api-prod","affected":[{"type":"plugin","slug":"slideshow-se","name":"Slideshow SE","from":"*","from_inclusive":true,"to":"2.5.17","to_inclusive":true,"patched_in":"2.5.18"}],"published":"2024-06-19T00:00:00Z","updated":"2024-07-01T13:39:11Z"},{"id":"wordfence:f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2","source":"wordfence","cve":"CVE-2012-10019","title":"Front-end Editor < 2.3 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f271c2e7-9d58-4dea-95d3-3ffc4ec7c3b2?source=api-prod","affected":[{"type":"plugin","slug":"front-end-editor","name":"Front-end Editor","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":false,"patched_in":"2.3"}],"published":"2012-04-07T00:00:00Z","updated":"2025-07-19T09:23:52Z"},{"id":"wordfence:f27853e0-1785-4670-a7b2-f72c19f4a6ac","source":"wordfence","cve":"CVE-2022-44735","title":"WP Clictracker <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f27853e0-1785-4670-a7b2-f72c19f4a6ac?source=api-prod","affected":[{"type":"plugin","slug":"clictracker","name":"WP Clictracker","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f27979a8-0e68-4a45-9e3e-3667d88361d8","source":"wordfence","cve":"CVE-2025-0369","title":"Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f27979a8-0e68-4a45-9e3e-3667d88361d8?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-01-17T18:34:33Z","updated":"2025-01-18T07:05:11Z"},{"id":"wordfence:f27bf9d3-f517-4739-914d-fe3ed13331e0","source":"wordfence","cve":"CVE-2026-27395","title":"Support Board < 3.8.9 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f27bf9d3-f517-4739-914d-fe3ed13331e0?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":false,"patched_in":"3.8.9"}],"published":"2026-06-01T00:00:00Z","updated":"2026-06-11T14:13:15Z"},{"id":"wordfence:f27d2dc9-c26e-4cb9-999f-da6359881867","source":"wordfence","cve":"CVE-2025-52716","title":"WP REST Cache <= 2025.1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f27d2dc9-c26e-4cb9-999f-da6359881867?source=api-prod","affected":[{"type":"plugin","slug":"wp-rest-cache","name":"WP REST Cache","from":"*","from_inclusive":true,"to":"2025.1.0","to_inclusive":true,"patched_in":"2025.1.1"}],"published":"2025-07-28T00:00:00Z","updated":"2025-08-04T20:06:32Z"},{"id":"wordfence:f281c9a5-1663-4dca-968f-685d933f99b1","source":"wordfence","cve":"CVE-2024-11684","title":"Kudos Donations \u2013 Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f281c9a5-1663-4dca-968f-685d933f99b1?source=api-prod","affected":[{"type":"plugin","slug":"kudos-donations","name":"Kudos Donations \u2013 Donation Forms for Mollie & Stripe","from":"*","from_inclusive":true,"to":"3.2.9","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T09:08:21Z"},{"id":"wordfence:f2856011-0080-4786-9ef0-14f323d54962","source":"wordfence","cve":"CVE-2025-31042","title":"Sandwich Adsense <= 4.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2856011-0080-4786-9ef0-14f323d54962?source=api-prod","affected":[{"type":"plugin","slug":"firsth3tagadsense","name":"Sandwich Adsense","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:08:26Z"},{"id":"wordfence:f285a5a9-2751-4fa7-8ef4-455128e1e17a","source":"wordfence","cve":"CVE-2026-80333","title":"Solace Extra <= 1.7.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f285a5a9-2751-4fa7-8ef4-455128e1e17a?source=api-prod","affected":[{"type":"plugin","slug":"solace-extra","name":"Solace Extra","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:54:28Z"},{"id":"wordfence:f2862cee-0412-42ba-9a8e-e5722bece775","source":"wordfence","cve":"","title":"Redirection <= 3.6.3 - Cross-Site Request Forgery to Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2862cee-0412-42ba-9a8e-e5722bece775?source=api-prod","affected":[{"type":"plugin","slug":"redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2018-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f286e61a-1afc-4f51-8b53-f3456a20150a","source":"wordfence","cve":"CVE-2026-13771","title":"Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f286e61a-1afc-4f51-8b53-f3456a20150a?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.113.0","to_inclusive":true,"patched_in":"5.114.0"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-09T06:52:51Z"},{"id":"wordfence:f28826e7-913e-4a88-a48a-3b8dd5623d39","source":"wordfence","cve":"CVE-2021-24846","title":"Ni WooCommerce Custom Order Status <= 1.9.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28826e7-913e-4a88-a48a-3b8dd5623d39?source=api-prod","affected":[{"type":"plugin","slug":"ni-woocommerce-custom-order-status","name":"Ni WooCommerce Custom Order Status","from":"*","from_inclusive":true,"to":"1.9.6","to_inclusive":true,"patched_in":"1.9.7"}],"published":"2021-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2888dcc-86f3-43a7-8c48-116e382d051f","source":"wordfence","cve":"CVE-2026-57421","title":"CRM Perks Forms <= 1.1.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2888dcc-86f3-43a7-8c48-116e382d051f?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":"1.1.8"}],"published":"2026-07-08T00:00:00Z","updated":"2026-07-29T23:20:02Z"},{"id":"wordfence:f288b68a-2455-4ee7-b217-5cb46fb79caf","source":"wordfence","cve":"","title":"JW-Player-Plugin-For-Wordpress <= 2.1.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f288b68a-2455-4ee7-b217-5cb46fb79caf?source=api-prod","affected":[{"type":"plugin","slug":"jw-player-plugin-for-wordpress","name":"JW Player for Flash & HTML5 Video","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":""}],"published":"2015-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2891f3d-9081-4a9f-8408-2373ce1d0306","source":"wordfence","cve":"CVE-2026-2232","title":"Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2891f3d-9081-4a9f-8408-2373ce1d0306?source=api-prod","affected":[{"type":"plugin","slug":"wc-product-table-lite","name":"Product Table & List Builder for WooCommerce","from":"*","from_inclusive":true,"to":"4.6.2","to_inclusive":true,"patched_in":"4.6.3"}],"published":"2026-02-18T00:00:00Z","updated":"2026-02-19T16:24:59Z"},{"id":"wordfence:f28a95b0-0f7d-43c4-acf9-13c561245f4b","source":"wordfence","cve":"CVE-2026-8978","title":"OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28a95b0-0f7d-43c4-acf9-13c561245f4b?source=api-prod","affected":[{"type":"plugin","slug":"optincraft","name":"OptinCraft \u2013 Drag & Drop Optins & Popup Builder for WordPress","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2026-06-05T13:57:33Z","updated":"2026-06-06T02:28:38Z"},{"id":"wordfence:f28afb93-b72a-4a56-994b-144124202147","source":"wordfence","cve":"CVE-2023-1623","title":"Custom Post Type UI <= 1.13.4 - Cross-Site Request Forgery to Sensitive Information Exposure","severity":"medium","cvss":5.4,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28afb93-b72a-4a56-994b-144124202147?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-ui","name":"Custom Post Type UI","from":"*","from_inclusive":true,"to":"1.13.4","to_inclusive":true,"patched_in":"1.13.5"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f28c47e6-a37d-4328-afb2-6a9e6b3fe20a","source":"wordfence","cve":"CVE-2024-1476","title":"Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28c47e6-a37d-4328-afb2-6a9e6b3fe20a?source=api-prod","affected":[{"type":"plugin","slug":"coming-soon-maintenance-mode-from-acurax","name":"Under Construction / Maintenance Mode from Acurax","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2024-02-27T00:00:00Z","updated":"2024-02-28T08:33:15Z"},{"id":"wordfence:f28ca2dc-404d-4abf-9d44-1b1f8309e9ee","source":"wordfence","cve":"","title":"Post Grid <= 2.0.12 - Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28ca2dc-404d-4abf-9d44-1b1f8309e9ee?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.0.12","to_inclusive":true,"patched_in":"2.0.13"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f28d7659-9244-4da8-97e9-4539d7d874f7","source":"wordfence","cve":"CVE-2024-24874","title":"CP Polls <= 1.0.71 - Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28d7659-9244-4da8-97e9-4539d7d874f7?source=api-prod","affected":[{"type":"plugin","slug":"cp-polls","name":"Polls CP","from":"*","from_inclusive":true,"to":"1.0.71","to_inclusive":true,"patched_in":"1.0.72"}],"published":"2024-02-05T00:00:00Z","updated":"2024-02-08T15:11:15Z"},{"id":"wordfence:f28dc553-32de-459e-a0e9-2fd428ef42a0","source":"wordfence","cve":"","title":"Magnitudo (All Versions) - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28dc553-32de-459e-a0e9-2fd428ef42a0?source=api-prod","affected":[{"type":"theme","slug":"magnitudo","name":"Magnitudo - Powerful Business Theme","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f28e36e9-7d02-48fc-8f20-64a951af75e0","source":"wordfence","cve":"CVE-2022-29412","title":"Hermit \u97f3\u4e50\u64ad\u653e\u5668 <= 3.1.6 - Multiple Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28e36e9-7d02-48fc-8f20-64a951af75e0?source=api-prod","affected":[{"type":"plugin","slug":"hermit","name":"Hermit \u97f3\u4e50\u64ad\u653e\u5668","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2022-04-28T13:11:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f28feb11-7e28-4b97-b529-f6d266c3e534","source":"wordfence","cve":"","title":"Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f28feb11-7e28-4b97-b529-f6d266c3e534?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"5.5.4","to_inclusive":true,"patched_in":"5.5.5"}],"published":"2022-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f294175e-dfcd-4d8d-84ee-a945ec7ac7e3","source":"wordfence","cve":"CVE-2015-9420","title":"SoundCloud Is Gold <= 2.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f294175e-dfcd-4d8d-84ee-a945ec7ac7e3?source=api-prod","affected":[{"type":"plugin","slug":"soundcloud-is-gold","name":"SoundCloud Is Gold","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2015-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f294575d-ce83-4301-ae38-3f0761d9b610","source":"wordfence","cve":"CVE-2021-25061","title":"WP Booking System \u2013 Booking Calendar <= 2.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f294575d-ce83-4301-ae38-3f0761d9b610?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system","name":"WP Booking System \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":false,"patched_in":"2.0.15"}],"published":"2021-12-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2949ff1-5c69-4189-99a9-e50c65c78461","source":"wordfence","cve":"CVE-2023-46188","title":"Freesoul Deactivate Plugins <= 2.1.3 - Cross-Site Request Forgery via eos_dp_pro_delete_transient","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2949ff1-5c69-4189-99a9-e50c65c78461?source=api-prod","affected":[{"type":"plugin","slug":"freesoul-deactivate-plugins","name":"Freesoul Deactivate Plugins \u2013 Disable plugins on individual WordPress pages","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":false,"patched_in":"2.1.4"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f29514d0-20a5-43f2-bf36-660579103220","source":"wordfence","cve":"CVE-2024-12099","title":"Dollie Hub \u2013 Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29514d0-20a5-43f2-bf36-660579103220?source=api-prod","affected":[{"type":"plugin","slug":"dollie","name":"Dollie Site Companion","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T03:37:41Z"},{"id":"wordfence:f2967b6a-38e1-405b-83a3-ae6ea07b8840","source":"wordfence","cve":"CVE-2026-39434","title":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping & Social Channels <= 6.6.26 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2967b6a-38e1-405b-83a3-ae6ea07b8840?source=api-prod","affected":[{"type":"plugin","slug":"webappick-product-feed-for-woocommerce","name":"Product Feed Manager for WooCommerce \u2013 CTX Feed \u2013 Support 220+ Shopping, AI & Social Channels","from":"*","from_inclusive":true,"to":"6.6.26","to_inclusive":true,"patched_in":"6.6.27"}],"published":"2026-04-07T00:00:00Z","updated":"2026-04-15T19:24:37Z"},{"id":"wordfence:f29843c7-6249-4f6f-8238-f3b0d94ec10a","source":"wordfence","cve":"CVE-2026-24384","title":"Merge + Minify + Refresh <= 2.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29843c7-6249-4f6f-8238-f3b0d94ec10a?source=api-prod","affected":[{"type":"plugin","slug":"merge-minify-refresh","name":"Merge + Minify + Refresh","from":"*","from_inclusive":true,"to":"2.14","to_inclusive":true,"patched_in":"2.15"}],"published":"2026-01-10T00:00:00Z","updated":"2026-02-03T21:00:15Z"},{"id":"wordfence:f29a843d-a8c5-4477-b7cc-620b19b5f585","source":"wordfence","cve":"","title":"Clearpay Gateway for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29a843d-a8c5-4477-b7cc-620b19b5f585?source=api-prod","affected":[{"type":"plugin","slug":"clearpay-gateway-for-woocommerce","name":"Clearpay Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.5.1"}],"published":"2022-12-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f29b3a37-436d-4d03-8818-d5267b23067b","source":"wordfence","cve":"CVE-2025-14387","title":"LearnPress \u2013 WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b3a37-436d-4d03-8818-d5267b23067b?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-12-15T02:25:53Z","updated":"2025-12-15T15:30:55Z"},{"id":"wordfence:f29b799a-b9cc-4e0e-b9ae-6ede5449986b","source":"wordfence","cve":"CVE-2026-120035","title":"RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b799a-b9cc-4e0e-b9ae-6ede5449986b?source=api-prod","affected":[{"type":"plugin","slug":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","from":"*","from_inclusive":true,"to":"5.2.13","to_inclusive":true,"patched_in":"5.2.14"}],"published":"2026-11-05T22:21:07Z","updated":"2026-11-06T11:17:40Z"},{"id":"wordfence:f29b905c-57cf-4fb8-b6af-eb0c367cd3e4","source":"wordfence","cve":"CVE-2026-12242","title":"AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b905c-57cf-4fb8-b6af-eb0c367cd3e4?source=api-prod","affected":[{"type":"plugin","slug":"adrotate","name":"AdRotate Banner Manager","from":"*","from_inclusive":true,"to":"5.17.7","to_inclusive":true,"patched_in":"5.17.8"}],"published":"2026-06-23T00:00:00Z","updated":"2026-06-24T12:33:30Z"},{"id":"wordfence:f29c44b4-903c-4165-9c2d-ede4e0086e85","source":"wordfence","cve":"CVE-2025-53323","title":"Pre-Publish Post Checklist <= 3.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29c44b4-903c-4165-9c2d-ede4e0086e85?source=api-prod","affected":[{"type":"plugin","slug":"pre-publish-post-checklist","name":"Pre-Publish Post Checklist","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:39:51Z"},{"id":"wordfence:f29d27aa-a0d9-4675-b762-6509c5743dff","source":"wordfence","cve":"CVE-2026-75019","title":"Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29d27aa-a0d9-4675-b762-6509c5743dff?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2026-08-24T13:27:31Z","updated":"2026-08-25T02:26:50Z"},{"id":"wordfence:f29e5b19-2505-4b02-92c7-071833de6bc2","source":"wordfence","cve":"CVE-2025-14799","title":"Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling","severity":"medium","cvss":6.5,"cwe":"CWE-843","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29e5b19-2505-4b02-92c7-071833de6bc2?source=api-prod","affected":[{"type":"plugin","slug":"mailin","name":"Brevo \u2013 Email, SMS, Web Push, Chat, and more.","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T11:26:05Z"},{"id":"wordfence:f29f9290-1f98-4019-997b-e33f2c151a5d","source":"wordfence","cve":"CVE-2012-6633","title":"WordPress Core <= 3.3.2 - Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f29f9290-1f98-4019-997b-e33f2c151a5d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":false,"patched_in":"3.3.3"}],"published":"2012-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a475f5-aafa-4717-b1a3-43f2ab8bce46","source":"wordfence","cve":"CVE-2024-10706","title":"Download Manager <= 3.3.02 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a475f5-aafa-4717-b1a3-43f2ab8bce46?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.02","to_inclusive":true,"patched_in":"3.3.03"}],"published":"2024-11-29T00:00:00Z","updated":"2024-12-23T19:22:37Z"},{"id":"wordfence:f2a59015-eb29-44fe-bc21-ba8832ac750b","source":"wordfence","cve":"","title":"Form Maker by 10Web < 1.13.40 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a59015-eb29-44fe-bc21-ba8832ac750b?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.13.40","to_inclusive":false,"patched_in":"1.13.40"}],"published":"2020-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a5d8ef-109c-471b-a135-c834f090eb5b","source":"wordfence","cve":"CVE-2022-1465","title":"WPC Smart Wishlist for WooCommerce <= 2.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a5d8ef-109c-471b-a135-c834f090eb5b?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-wishlist","name":"WPC Smart Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":false,"patched_in":"2.9.9"}],"published":"2022-04-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a61a12-df0c-47a2-ba39-b70dbfaddf0a","source":"wordfence","cve":"CVE-2021-24685","title":"Flat Preloader <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a61a12-df0c-47a2-ba39-b70dbfaddf0a?source=api-prod","affected":[{"type":"plugin","slug":"flat-preloader","name":"Flat Preloader","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":false,"patched_in":"1.5.4"}],"published":"2021-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a6f8ec-6a3e-453d-9ef4-794b5791ac2b","source":"wordfence","cve":"CVE-2022-3865","title":"WP User Merger <= 1.5.2 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a6f8ec-6a3e-453d-9ef4-794b5791ac2b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-merger","name":"WP User Merger","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2022-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a79874-6dfe-41e7-a29b-2ee6b3753264","source":"wordfence","cve":"CVE-2025-68592","title":"Adminify <= 4.0.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a79874-6dfe-41e7-a29b-2ee6b3753264?source=api-prod","affected":[{"type":"plugin","slug":"adminify","name":"Adminify \u2013 White Label, Admin Menu Editor, Login Customizer","from":"*","from_inclusive":true,"to":"4.0.6.1","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2025-12-18T00:00:00Z","updated":"2026-01-07T14:45:50Z"},{"id":"wordfence:f2a87cb3-5cce-4b5a-937d-71e96aeef7c9","source":"wordfence","cve":"CVE-2021-24954","title":"ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting via ppress_cc_data Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a87cb3-5cce-4b5a-937d-71e96aeef7c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2a98c03-6660-4997-b60f-6b95e6ffe57b","source":"wordfence","cve":"CVE-2026-49105","title":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2a98c03-6660-4997-b60f-6b95e6ffe57b?source=api-prod","affected":[{"type":"plugin","slug":"cf7-zendesk","name":"WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-06-05T00:00:00Z","updated":"2026-06-08T14:43:08Z"},{"id":"wordfence:f2aa33cc-c1c4-42d4-9c2f-54648426ee4b","source":"wordfence","cve":"CVE-2026-5797","title":"Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields","severity":"medium","cvss":5.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2aa33cc-c1c4-42d4-9c2f-54648426ee4b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.1.0","to_inclusive":true,"patched_in":"11.1.1"}],"published":"2026-04-16T16:42:59Z","updated":"2026-04-17T05:29:28Z"},{"id":"wordfence:f2ab1544-2428-4c93-b973-8280ff7a2903","source":"wordfence","cve":"CVE-2026-118193","title":"GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ab1544-2428-4c93-b973-8280ff7a2903?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.19.1","to_inclusive":true,"patched_in":"4.19.1.1"}],"published":"2026-11-04T16:08:12Z","updated":"2026-11-05T04:48:08Z"},{"id":"wordfence:f2ad7a54-cf17-4198-8a6f-abe9cc18be58","source":"wordfence","cve":"CVE-2026-94278","title":"File Media Renamer <= 1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ad7a54-cf17-4198-8a6f-abe9cc18be58?source=api-prod","affected":[{"type":"plugin","slug":"file-media-renamer","name":"File Media Renamer","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:50:46Z"},{"id":"wordfence:f2b1e9a7-cbbd-4915-a1bb-e98bb70aa6a1","source":"wordfence","cve":"CVE-2026-66635","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.63 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b1e9a7-cbbd-4915-a1bb-e98bb70aa6a1?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":""}],"published":"2026-08-18T00:00:00Z","updated":"2026-10-23T16:56:53Z"},{"id":"wordfence:f2b31db1-c4f7-47c6-ad83-7ecd375e5f65","source":"wordfence","cve":"CVE-2024-33632","title":"Piotnet Addons For Elementor Pro <= 7.1.17 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b31db1-c4f7-47c6-ad83-7ecd375e5f65?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.17","to_inclusive":true,"patched_in":""}],"published":"2024-04-25T00:00:00Z","updated":"2024-05-02T16:42:16Z"},{"id":"wordfence:f2b4f946-036d-4136-81b8-a8cd2a68e097","source":"wordfence","cve":"CVE-2026-25018","title":"NaturaLife Extensions <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b4f946-036d-4136-81b8-a8cd2a68e097?source=api-prod","affected":[{"type":"plugin","slug":"naturalife-extensions","name":"NaturaLife Extensions","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:16:28Z"},{"id":"wordfence:f2b51837-5925-497f-bdb8-c32f9011830b","source":"wordfence","cve":"CVE-2026-11396","title":"Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b51837-5925-497f-bdb8-c32f9011830b?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-filter","name":"Product Filter for WooCommerce by WBW","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-10-30T18:19:22Z","updated":"2026-10-31T06:44:24Z"},{"id":"wordfence:f2b5213d-fdc5-4c98-9a05-15d83bd7308f","source":"wordfence","cve":"","title":"Contest Gallery <= 21.2.8.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.7,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b5213d-fdc5-4c98-9a05-15d83bd7308f?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"21.2.8.4","to_inclusive":true,"patched_in":"21.2.9"}],"published":"2024-01-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2b70e27-87fb-4905-bbfa-62cca3dbb433","source":"wordfence","cve":"CVE-2020-14010","title":"Xenon - Bootstrap Admin Theme with AngularJS <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b70e27-87fb-4905-bbfa-62cca3dbb433?source=api-prod","affected":[{"type":"theme","slug":"xenon","name":"Xenon - Bootstrap Admin Theme with AngularJS","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2020-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2b7258e-c594-415a-a872-d5b28397e40d","source":"wordfence","cve":"CVE-2023-51524","title":"weForms <= 1.6.18 - Missing Authorization via export_form_entries","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b7258e-c594-415a-a872-d5b28397e40d?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.18","to_inclusive":true,"patched_in":"1.6.19"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2b96f36-090d-4ed3-aa2c-dafa89d255cc","source":"wordfence","cve":"CVE-2026-109401","title":"WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b96f36-090d-4ed3-aa2c-dafa89d255cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-logging","name":"WP Mail Logging","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":true,"patched_in":"1.17.1"}],"published":"2026-10-15T17:40:36Z","updated":"2026-10-16T06:41:08Z"},{"id":"wordfence:f2ba40d9-2d37-453a-a731-078f1de1fc69","source":"wordfence","cve":"CVE-2026-13226","title":"Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ba40d9-2d37-453a-a731-078f1de1fc69?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"4.5.5"}],"published":"2026-06-25T13:02:09Z","updated":"2026-06-26T01:27:45Z"},{"id":"wordfence:f2bc0449-b5cc-403b-a943-f53d0d9c663a","source":"wordfence","cve":"CVE-2015-9371","title":"Manual Purchases < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2bc0449-b5cc-403b-a943-f53d0d9c663a?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-manual-purchases","name":"Manual Purchases Add-on for iThemes Exchange","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2bcaff9-bf04-4d8e-9422-c433264067ff","source":"wordfence","cve":"CVE-2025-1766","title":"Event Manager, Events Calendar, Tickets, Registrations \u2013 Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2bcaff9-bf04-4d8e-9422-c433264067ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"4.0.25"}],"published":"2025-03-19T17:03:39Z","updated":"2025-03-20T05:23:23Z"},{"id":"wordfence:f2c17222-5de5-4ecd-a7c6-beabe7624c5b","source":"wordfence","cve":"CVE-2025-13385","title":"Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c17222-5de5-4ecd-a7c6-beabe7624c5b?source=api-prod","affected":[{"type":"plugin","slug":"bookme-free-appointment-booking-system","name":"Bookme \u2013 Free Online Appointment Booking and Scheduling Plugin","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:08:40Z","updated":"2025-11-25T07:28:27Z"},{"id":"wordfence:f2c20cde-012c-4dca-a8ae-2229131c08e1","source":"wordfence","cve":"CVE-2026-11349","title":"Modern Events Calendar (Lite & Pro) <= 7.33.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c20cde-012c-4dca-a8ae-2229131c08e1?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"7.33.0","to_inclusive":true,"patched_in":"7.34.0"}],"published":"2026-06-29T00:00:00Z","updated":"2026-07-29T21:46:37Z"},{"id":"wordfence:f2c3b646-d865-4425-bc8f-00b3555a3d74","source":"wordfence","cve":"CVE-2024-1130","title":"NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c3b646-d865-4425-bc8f-00b3555a3d74?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.5.6","to_inclusive":true,"patched_in":"8.5.7"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-01T04:31:55Z"},{"id":"wordfence:f2c56e24-ebff-4b2d-b5ad-4f25ee20f91d","source":"wordfence","cve":"CVE-2026-39630","title":"Getty Images <= 4.1.0 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c56e24-ebff-4b2d-b5ad-4f25ee20f91d?source=api-prod","affected":[{"type":"plugin","slug":"getty-images","name":"Getty Images","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-05-05T15:30:06Z"},{"id":"wordfence:f2c6a377-216f-4d61-8fae-ec5bc2793cdf","source":"wordfence","cve":"CVE-2026-4882","title":"User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c6a377-216f-4d61-8fae-ec5bc2793cdf?source=api-prod","affected":[{"type":"plugin","slug":"user-registration-advanced-fields","name":"User Registration Advanced Fields","from":"*","from_inclusive":true,"to":"1.6.20","to_inclusive":true,"patched_in":"1.6.21"}],"published":"2026-05-01T15:46:06Z","updated":"2026-05-02T04:27:47Z"},{"id":"wordfence:f2c6d446-75cd-4f42-a5f2-f4c59d4084ce","source":"wordfence","cve":"CVE-2024-3973","title":"House Manager \u2013 Easy Renter Management System for WordPress <= 1.0.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c6d446-75cd-4f42-a5f2-f4c59d4084ce?source=api-prod","affected":[{"type":"plugin","slug":"house-manager","name":"House Manager \u2013 Easy Renter Management System for WordPress","from":"*","from_inclusive":true,"to":"1.0.8.4","to_inclusive":true,"patched_in":""}],"published":"2024-07-16T00:00:00Z","updated":"2024-08-09T19:44:56Z"},{"id":"wordfence:f2c70d5f-beb3-480e-8ea8-c3ab01ce5a20","source":"wordfence","cve":"CVE-2024-13905","title":"OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c70d5f-beb3-480e-8ea8-c3ab01ce5a20?source=api-prod","affected":[{"type":"plugin","slug":"onestore-sites","name":"OneStore Sites","from":"*","from_inclusive":true,"to":"0.1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-26T15:28:50Z","updated":"2025-02-27T04:21:45Z"},{"id":"wordfence:f2c88c5a-ea87-4aab-a0ce-8246e5cb540a","source":"wordfence","cve":"CVE-2022-0180","title":"Quiz And Survey Master <= 7.3.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2c88c5a-ea87-4aab-a0ce-8246e5cb540a?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.5","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2cbfcf7-dc2b-4d2e-9e9e-037fdc8bea9b","source":"wordfence","cve":"CVE-2026-119054","title":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO < 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cbfcf7-dc2b-4d2e-9e9e-037fdc8bea9b?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"4.2.5","to_inclusive":false,"patched_in":""}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:46:24Z"},{"id":"wordfence:f2cdd50d-6290-4cef-a72c-2e9d680d4f1f","source":"wordfence","cve":"CVE-2025-13498","title":"Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.32","to_inclusive":true,"patched_in":"3.3.33"}],"published":"2025-12-17T00:00:00Z","updated":"2025-12-18T07:20:47Z"},{"id":"wordfence:f2ce4a14-5c56-4ca0-9deb-80cd609b71e6","source":"wordfence","cve":"CVE-2021-24367","title":"WP Config File Editor <= 1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ce4a14-5c56-4ca0-9deb-80cd609b71e6?source=api-prod","affected":[{"type":"plugin","slug":"wp-config-file-editor","name":"WP Config File Editor","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2021-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2cf46e6-a732-45c4-ad18-607009d7a586","source":"wordfence","cve":"CVE-2026-1573","title":"OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cf46e6-a732-45c4-ad18-607009d7a586?source=api-prod","affected":[{"type":"plugin","slug":"omigo","name":"OMIGO","from":"*","from_inclusive":true,"to":"3.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:23:52Z","updated":"2026-02-07T08:26:41Z"},{"id":"wordfence:f2d2bce2-90a9-4b3d-875d-3fbedc397cd4","source":"wordfence","cve":"CVE-2024-5529","title":"WP QuickLaTeX <= 3.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d2bce2-90a9-4b3d-875d-3fbedc397cd4?source=api-prod","affected":[{"type":"plugin","slug":"wp-quicklatex","name":"WP QuickLaTeX","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.8"}],"published":"2024-07-01T00:00:00Z","updated":"2024-08-09T15:41:55Z"},{"id":"wordfence:f2d45d0c-928c-4e03-b054-9a250ada9dc3","source":"wordfence","cve":"CVE-2026-62056","title":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution <= 3.2.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d45d0c-928c-4e03-b054-9a250ada9dc3?source=api-prod","affected":[{"type":"plugin","slug":"fluent-crm","name":"FluentCRM \u2013 Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2026-10-30T18:14:00Z","updated":"2026-11-03T20:08:34Z"},{"id":"wordfence:f2d4f9d7-9b90-4b9b-98cc-3cf4ca56f20f","source":"wordfence","cve":"CVE-2026-76789","title":"Slider Hero with Video Background, Animation < 9.1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d4f9d7-9b90-4b9b-98cc-3cf4ca56f20f?source=api-prod","affected":[{"type":"plugin","slug":"slider-hero","name":"Slider Hero with Video Background, Animation","from":"*","from_inclusive":true,"to":"9.1.3","to_inclusive":false,"patched_in":"9.1.3"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:53:36Z"},{"id":"wordfence:f2d4fc7b-7fb6-4987-b067-b5e5da689994","source":"wordfence","cve":"CVE-2026-103359","title":"PayDunya WooCommerce Payment Gateway <= 1.1.6 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d4fc7b-7fb6-4987-b067-b5e5da689994?source=api-prod","affected":[{"type":"plugin","slug":"paydunya-woocommerce-payment-gateway","name":"PAYDUNYA WOOCOMMERCE PAR","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-24T00:00:00Z","updated":"2026-10-28T01:13:56Z"},{"id":"wordfence:f2d69d59-390d-4f3c-96ba-487707cac7a6","source":"wordfence","cve":"CVE-2024-24867","title":"WP Visitor Statistics (Real Time Traffic) <= 6.9.4 - Sensitive Information Exposure via Log File","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d69d59-390d-4f3c-96ba-487707cac7a6?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"6.9.4","to_inclusive":true,"patched_in":"6.9.5"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:14:45Z"},{"id":"wordfence:f2d7c5b6-ce4d-4dbe-abec-8c223cb652af","source":"wordfence","cve":"CVE-2024-23500","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.2.19 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d7c5b6-ce4d-4dbe-abec-8c223cb652af?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.19","to_inclusive":true,"patched_in":"3.2.20"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-07T21:22:21Z"},{"id":"wordfence:f2d97646-27a8-4302-be70-7b4fb1a12300","source":"wordfence","cve":"CVE-2025-12399","title":"Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d97646-27a8-4302-be70-7b4fb1a12300?source=api-prod","affected":[{"type":"plugin","slug":"alex-reservations","name":"Alex Reservations \u2013 Restaurant Reservations, Tables & White-Label Booking System","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-11-07T21:13:04Z","updated":"2025-11-08T09:28:12Z"},{"id":"wordfence:f2db06b1-c823-45db-b6f5-b656978cc779","source":"wordfence","cve":"CVE-2019-14205","title":"Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2db06b1-c823-45db-b6f5-b656978cc779?source=api-prod","affected":[{"type":"plugin","slug":"adaptive-images","name":"Adaptive Images for WordPress","from":"*","from_inclusive":true,"to":"0.6.67","to_inclusive":false,"patched_in":"0.6.67"}],"published":"2019-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2e045eb-5c9d-4fe7-9a7d-e5f04dbac516","source":"wordfence","cve":"CVE-2026-119325","title":"Bricks <= 2.4.0 - Missing Authorization to Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2e045eb-5c9d-4fe7-9a7d-e5f04dbac516?source=api-prod","affected":[{"type":"plugin","slug":"UNKNOWN-CVE-2026-119325","name":"Bricks Theme","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:49:43Z"},{"id":"wordfence:f2e36b11-db93-4bac-a9bd-16d2e22efe4d","source":"wordfence","cve":"","title":"WP-MUI \u2013 Mass User Input \u2013 Add and Export WP Users Quickly <= 1.8 - Missing Authorization","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2e36b11-db93-4bac-a9bd-16d2e22efe4d?source=api-prod","affected":[{"type":"plugin","slug":"wp-mui-mass-user-input","name":"WP-MUI \u2013 Mass User Input \u2013 Add and Export WP Users Quickly","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2e6f09e-0ebc-47e3-84f3-9aede2781f42","source":"wordfence","cve":"","title":"GD Star Rating <= 1.9.22 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2e6f09e-0ebc-47e3-84f3-9aede2781f42?source=api-prod","affected":[{"type":"plugin","slug":"gd-star-rating","name":"GD Star Rating","from":"*","from_inclusive":true,"to":"1.9.22","to_inclusive":true,"patched_in":""}],"published":"2011-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2e8062a-d185-4834-a8cf-1f505ee2e91e","source":"wordfence","cve":"CVE-2026-24947","title":"LA-Studio Element Kit for Elementor < 1.5.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2e8062a-d185-4834-a8cf-1f505ee2e91e?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.5.6.3","to_inclusive":false,"patched_in":"1.5.6.3"}],"published":"2025-12-15T00:00:00Z","updated":"2026-02-10T19:29:58Z"},{"id":"wordfence:f2e981ae-4958-45c5-9f5f-6298223fac46","source":"wordfence","cve":"CVE-2025-62034","title":"Togo < 1.0.4 - Authenticated (subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2e981ae-4958-45c5-9f5f-6298223fac46?source=api-prod","affected":[{"type":"theme","slug":"togo","name":"Togo \u2013 Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:07:36Z"},{"id":"wordfence:f2eccedd-c75e-41d8-b2de-9977b1143cc2","source":"wordfence","cve":"CVE-2025-24589","title":"JSM Show Post Metadata <= 4.6.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2eccedd-c75e-41d8-b2de-9977b1143cc2?source=api-prod","affected":[{"type":"plugin","slug":"jsm-show-post-meta","name":"JSM Show Post Metadata","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":true,"patched_in":"4.6.1"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:32:07Z"},{"id":"wordfence:f2ed5e51-8783-4b7f-9177-c116bf0fad44","source":"wordfence","cve":"","title":"Frontend File Manager <= 3.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ed5e51-8783-4b7f-9177-c116bf0fad44?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2015-06-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2ef8ee4-7388-4263-ad6a-bb043b09c97c","source":"wordfence","cve":"CVE-2020-7055","title":"Elementor Website Builder <= 2.7.4 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ef8ee4-7388-4263-ad6a-bb043b09c97c?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":false,"patched_in":"2.7.5"}],"published":"2019-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2f11c32-d58e-4ac8-83c7-30927a626e10","source":"wordfence","cve":"CVE-2024-6169","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f11c32-d58e-4ac8-83c7-30927a626e10?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.112","to_inclusive":true,"patched_in":"1.5.113"}],"published":"2024-07-08T00:00:00Z","updated":"2024-07-09T04:32:57Z"},{"id":"wordfence:f2f2d652-073f-4f4c-99b3-f4b99cccb45d","source":"wordfence","cve":"CVE-2025-67557","title":"eBay Product Feeds <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f2d652-073f-4f4c-99b3-f4b99cccb45d?source=api-prod","affected":[{"type":"plugin","slug":"ebay-feeds-for-wordpress","name":"WP eBay Product Feeds","from":"*","from_inclusive":true,"to":"3.4.9","to_inclusive":true,"patched_in":"3.4.10"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:01:26Z"},{"id":"wordfence:f2f3a5be-0b69-43aa-a56f-d602d5def7dc","source":"wordfence","cve":"CVE-2026-100148","title":"Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f3a5be-0b69-43aa-a56f-d602d5def7dc?source=api-prod","affected":[{"type":"plugin","slug":"widget-google-reviews","name":"Rich Showcase for Google Reviews","from":"*","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"7.1.4"}],"published":"2026-10-02T17:16:42Z","updated":"2026-10-03T05:29:19Z"},{"id":"wordfence:f2f4313a-568e-4ee2-b283-cd7bb62b75fa","source":"wordfence","cve":"CVE-2021-24656","title":"Simple Social Media Share Buttons <= 3.2.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f4313a-568e-4ee2-b283-cd7bb62b75fa?source=api-prod","affected":[{"type":"plugin","slug":"simple-social-buttons","name":"Simple Social Media Share Buttons \u2013 Social Sharing for Everyone","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2f998fd-eb15-442d-8034-af820601fe4a","source":"wordfence","cve":"CVE-2026-7622","title":"ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2f998fd-eb15-442d-8034-af820601fe4a?source=api-prod","affected":[{"type":"plugin","slug":"image-sizes","name":"ThumbPress \u2013 Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More","from":"*","from_inclusive":true,"to":"6.2.1","to_inclusive":true,"patched_in":"6.2.2"}],"published":"2026-09-21T19:13:13Z","updated":"2026-09-22T07:41:15Z"},{"id":"wordfence:f2fad774-f140-4891-8c6f-fbd684e19dc2","source":"wordfence","cve":"","title":"Montezuma < 1.1.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fad774-f140-4891-8c6f-fbd684e19dc2?source=api-prod","affected":[{"type":"theme","slug":"montezuma","name":"Montezuma","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":false,"patched_in":"1.1.8"}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2fb18eb-a5ce-463f-aae2-55dc0bb3e9c7","source":"wordfence","cve":"CVE-2026-57355","title":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory <= 5.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fb18eb-a5ce-463f-aae2-55dc0bb3e9c7?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"5.4.3"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T20:01:02Z"},{"id":"wordfence:f2fb7a5f-ea09-4033-a19e-f3d0e9689cf3","source":"wordfence","cve":"CVE-2025-57913","title":"Behance Portfolio Manager <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fb7a5f-ea09-4033-a19e-f3d0e9689cf3?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-manager-powered-by-behance","name":"Behance Portfolio Manager","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.8.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-03-17T21:26:41Z"},{"id":"wordfence:f2fc0457-ee9b-4571-b1ef-0649dde1badb","source":"wordfence","cve":"CVE-2025-68005","title":"Easy Hotel Booking <= 1.8.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fc0457-ee9b-4571-b1ef-0649dde1badb?source=api-prod","affected":[{"type":"plugin","slug":"easy-hotel","name":"Easy Hotel \u2013 Powerful Hotel Booking","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-29T00:00:00Z","updated":"2026-02-02T16:15:12Z"},{"id":"wordfence:f2fdf8bf-7f53-4579-9a1f-be7b3ef1ca50","source":"wordfence","cve":"CVE-2026-97637","title":"JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fdf8bf-7f53-4579-9a1f-be7b3ef1ca50?source=api-prod","affected":[{"type":"plugin","slug":"json-api-auth","name":"JSON API Auth","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2026-10-01T19:01:23Z","updated":"2026-10-02T07:39:30Z"},{"id":"wordfence:f2febf69-b146-4ca5-bfa9-f5477da5cd6c","source":"wordfence","cve":"CVE-2016-20100","title":"Memphis Documents Library <= 3.1.5 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2febf69-b146-4ca5-bfa9-f5477da5cd6c?source=api-prod","affected":[{"type":"plugin","slug":"memphis-documents-library","name":"Memphis Documents Library","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2016-03-22T00:00:00Z","updated":"2026-10-28T14:52:15Z"},{"id":"wordfence:f2fee7aa-5289-4bf0-b175-5a64b16fdd40","source":"wordfence","cve":"CVE-2021-24646","title":"Booking.com Banner Creator <= 1.4.2 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2fee7aa-5289-4bf0-b175-5a64b16fdd40?source=api-prod","affected":[{"type":"plugin","slug":"bookingcom-banner-creator","name":"Booking.com Banner Creator","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":false,"patched_in":"1.4.3"}],"published":"2021-10-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f2ff2cc6-b584-442b-890b-033a0a047c24","source":"wordfence","cve":"CVE-2024-1172","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ff2cc6-b584-442b-890b-033a0a047c24?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"5.9.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:50Z"},{"id":"wordfence:f30158f0-1f05-4d9d-892c-7d806c899b53","source":"wordfence","cve":"CVE-2026-95597","title":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778 <= 5.5.17 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f30158f0-1f05-4d9d-892c-7d806c899b53?source=api-prod","affected":[{"type":"plugin","slug":"pgall-for-woocommerce","name":"\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 \u2013 \uc6b0\ucee4\uba38\uc2a4 \uacb0\uc81c \ud50c\ub7ec\uadf8\uc778","from":"*","from_inclusive":true,"to":"5.5.17","to_inclusive":true,"patched_in":"5.5.18"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:56:31Z"},{"id":"wordfence:f3022556-3c37-45d7-809a-4e991ad9e0ea","source":"wordfence","cve":"CVE-2024-10679","title":"Quiz and Survey Master (QSM)  <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3022556-3c37-45d7-809a-4e991ad9e0ea?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.2.0","to_inclusive":true,"patched_in":"9.2.1"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-15T15:16:40Z"},{"id":"wordfence:f3042586-dd23-487f-a79c-7ad5b5e38677","source":"wordfence","cve":"CVE-2024-27997","title":"Visual Composer Website Builder <= 45.6.0 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3042586-dd23-487f-a79c-7ad5b5e38677?source=api-prod","affected":[{"type":"plugin","slug":"visualcomposer","name":"Visual Composer Website Builder","from":"*","from_inclusive":true,"to":"45.6.0","to_inclusive":true,"patched_in":"45.7.0"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T20:58:54Z"},{"id":"wordfence:f3045ebf-70af-4124-9116-42c07f64a3bf","source":"wordfence","cve":"CVE-2024-0437","title":"Password Protected \u2013 Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3045ebf-70af-4124-9116-42c07f64a3bf?source=api-prod","affected":[{"type":"plugin","slug":"password-protected","name":"Password Protected","from":"*","from_inclusive":true,"to":"2.6.6","to_inclusive":true,"patched_in":"2.6.7"}],"published":"2024-05-14T00:00:00Z","updated":"2024-07-29T21:37:47Z"},{"id":"wordfence:f304b0c2-ddea-4638-8a0b-c1483c944d30","source":"wordfence","cve":"CVE-2026-40778","title":"Majestic Support <= 1.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f304b0c2-ddea-4638-8a0b-c1483c944d30?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2026-04-09T00:00:00Z","updated":"2026-05-07T14:02:48Z"},{"id":"wordfence:f3063e92-e152-440d-bf02-b852ff87e319","source":"wordfence","cve":"CVE-2026-12988","title":"WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3063e92-e152-440d-bf02-b852ff87e319?source=api-prod","affected":[{"type":"plugin","slug":"wp-2fa","name":"WP 2FA \u2013 Two-factor authentication for WordPress","from":"*","from_inclusive":true,"to":"3.1.1.1","to_inclusive":true,"patched_in":"3.1.1.2"}],"published":"2026-06-23T00:00:00Z","updated":"2026-07-30T13:50:28Z"},{"id":"wordfence:f30810d4-415c-4001-919d-eac753715474","source":"wordfence","cve":"CVE-2026-18044","title":"Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f30810d4-415c-4001-919d-eac753715474?source=api-prod","affected":[{"type":"plugin","slug":"estatik","name":"Estatik Real Estate Plugin","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":false,"patched_in":"4.3.4"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T20:28:58Z"},{"id":"wordfence:f30ae90a-54fb-4c55-a6ed-9c411a6997fb","source":"wordfence","cve":"CVE-2025-10732","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f30ae90a-54fb-4c55-a6ed-9c411a6997fb?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.12.1","to_inclusive":true,"patched_in":"1.12.2"}],"published":"2025-10-13T16:24:52Z","updated":"2025-10-14T05:24:59Z"},{"id":"wordfence:f30af3c4-82be-40d5-be9f-82631b8f3ee2","source":"wordfence","cve":"","title":"Simple History <= 1.0.7 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f30af3c4-82be-40d5-be9f-82631b8f3ee2?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f30f5251-54ba-4a8c-b849-2a4ea11637a1","source":"wordfence","cve":"CVE-2025-53213","title":"ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f30f5251-54ba-4a8c-b849-2a4ea11637a1?source=api-prod","affected":[{"type":"plugin","slug":"elex-reachship-multi-carrier-conditional-shipping","name":"ReachShip WooCommerce Multi-Carrier & Conditional Shipping","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":"4.3.2"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T20:45:21Z"},{"id":"wordfence:f3108ef4-f889-4ae1-b86f-cedf46dcea19","source":"wordfence","cve":"CVE-2023-1334","title":"RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'queue_posts'","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3108ef4-f889-4ae1-b86f-cedf46dcea19?source=api-prod","affected":[{"type":"plugin","slug":"unusedcss","name":"RapidLoad AI \u2013 Optimize Web Vitals Automatically","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2023-03-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f314340c-23aa-479f-9a19-f21a14d6da49","source":"wordfence","cve":"CVE-2021-24544","title":"Responsive WordPress Slider <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f314340c-23aa-479f-9a19-f21a14d6da49?source=api-prod","affected":[{"type":"plugin","slug":"motopress-slider-lite","name":"Responsive WordPress Slider","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2021-09-21T00:00:00Z","updated":"2025-06-11T11:18:39Z"},{"id":"wordfence:f3154a7a-b8b3-490b-9822-b3a92d1b4fef","source":"wordfence","cve":"CVE-2024-9051","title":"WP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3154a7a-b8b3-490b-9822-b3a92d1b4fef?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-post-grid","name":"WP Ultimate Post Grid","from":"*","from_inclusive":true,"to":"3.9.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2024-10-10T18:52:35Z","updated":"2024-10-11T07:37:48Z"},{"id":"wordfence:f3158e77-39b3-4151-8f10-5824000a585a","source":"wordfence","cve":"CVE-2024-11400","title":"HUSKY \u2013 Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3158e77-39b3-4151-8f10-5824000a585a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6.3","to_inclusive":true,"patched_in":"1.3.6.4"}],"published":"2024-11-19T09:21:18Z","updated":"2025-06-13T22:21:46Z"},{"id":"wordfence:f315fff8-d616-4a5c-91bc-d8b0ec0f028f","source":"wordfence","cve":"","title":"Wordfence <= 5.2.2 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f315fff8-d616-4a5c-91bc-d8b0ec0f028f?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":false,"patched_in":"5.2.3"}],"published":"2014-09-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3185d82-a785-4165-8469-abc0be38f852","source":"wordfence","cve":"CVE-2026-1399","title":"WP Google Ad Manager Plugin <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3185d82-a785-4165-8469-abc0be38f852?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-ad-manager-plugin","name":"WP Google Ad Manager Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:47:39Z","updated":"2026-01-28T11:23:42Z"},{"id":"wordfence:f31a42c1-afb7-4a44-b4e8-f68c622bc43e","source":"wordfence","cve":"CVE-2024-27967","title":"DSGVO All in one for WP <= 4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31a42c1-afb7-4a44-b4e8-f68c622bc43e?source=api-prod","affected":[{"type":"plugin","slug":"dsgvo-all-in-one-for-wp","name":"DSGVO All in one for WP","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T18:26:30Z"},{"id":"wordfence:f31b42c8-cf82-49cf-ac4c-d42a28252d66","source":"wordfence","cve":"CVE-2022-0442","title":"UsersWP <= 1.2.3 - Subscriber+ User Avatar Override","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31b42c8-cf82-49cf-ac4c-d42a28252d66?source=api-prod","affected":[{"type":"plugin","slug":"userswp","name":"UsersWP \u2013 Front-end login form, User Registration, User Profile & Members Directory plugin for WP","from":"*","from_inclusive":true,"to":"1.2.3.1","to_inclusive":false,"patched_in":"1.2.3.1"}],"published":"2022-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f31bd18e-57d4-4c87-8a7c-a168e7e70061","source":"wordfence","cve":"CVE-2025-3615","title":"Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31bd18e-57d4-4c87-8a7c-a168e7e70061?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"6.0.3"}],"published":"2025-04-16T19:17:45Z","updated":"2025-04-17T07:34:08Z"},{"id":"wordfence:f31bf520-2006-496b-b487-62faea679cf6","source":"wordfence","cve":"CVE-2026-96575","title":"Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31bf520-2006-496b-b487-62faea679cf6?source=api-prod","affected":[{"type":"plugin","slug":"serbian-transliteration","name":"Transliterator \u2013 Multilingual and Multi-script Text Conversion","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2026-10-02T16:41:23Z","updated":"2026-10-03T05:29:19Z"},{"id":"wordfence:f31bf9cd-fbf3-4f7a-bddd-ddd44c899710","source":"wordfence","cve":"CVE-2017-20289","title":"WordPress Ad Widget <= 2.11.0 - Local File Inclusion","severity":"critical","cvss":9.9,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31bf9cd-fbf3-4f7a-bddd-ddd44c899710?source=api-prod","affected":[{"type":"plugin","slug":"ad-widget","name":"Ad Widget for WordPress","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":false,"patched_in":"2.12.0"}],"published":"2017-01-01T00:00:00Z","updated":"2026-10-28T14:54:04Z"},{"id":"wordfence:f31d3995-c401-4588-94a2-5c150493f574","source":"wordfence","cve":"CVE-2026-105198","title":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f31d3995-c401-4588-94a2-5c150493f574?source=api-prod","affected":[{"type":"plugin","slug":"latepoint","name":"Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"5.7.3","to_inclusive":false,"patched_in":"5.7.3"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:34:19Z"},{"id":"wordfence:f321b8f6-0712-4932-b861-b208debb368f","source":"wordfence","cve":"","title":"VaultPress <= 1.8.6 - Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f321b8f6-0712-4932-b861-b208debb368f?source=api-prod","affected":[{"type":"plugin","slug":"vaultpress","name":"Jetpack VaultPress","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f321e41a-3945-47db-a215-aeb001b7b80b","source":"wordfence","cve":"CVE-2024-7353","title":"Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f321e41a-3945-47db-a215-aeb001b7b80b?source=api-prod","affected":[{"type":"plugin","slug":"stripe-payments","name":"Accept Stripe Payments","from":"*","from_inclusive":true,"to":"2.0.86","to_inclusive":true,"patched_in":"2.0.87"}],"published":"2024-08-06T23:21:26Z","updated":"2024-08-07T11:30:53Z"},{"id":"wordfence:f32362f2-c75b-41ef-8284-a4173a5c22d6","source":"wordfence","cve":"CVE-2026-84931","title":"Joli Table Of Contents < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f32362f2-c75b-41ef-8284-a4173a5c22d6?source=api-prod","affected":[{"type":"plugin","slug":"joli-table-of-contents","name":"Joli Table Of Contents \u2013 Table of Contents with Gutenberg Block & Shortcode","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":false,"patched_in":"3.0.3"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:03:44Z"},{"id":"wordfence:f324b272-1e2f-4951-a8ae-5210a8d4dcbd","source":"wordfence","cve":"CVE-2026-57351","title":"HandL UTM Grabber / Tracker <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f324b272-1e2f-4951-a8ae-5210a8d4dcbd?source=api-prod","affected":[{"type":"plugin","slug":"handl-utm-grabber","name":"HandL UTM Grabber / Tracker","from":"*","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"2.9.3"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:46:17Z"},{"id":"wordfence:f3262198-037d-4e01-ad13-b3c1ad091845","source":"wordfence","cve":"CVE-2026-84251","title":"click5 CRM add-on to Ninja Forms <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3262198-037d-4e01-ad13-b3c1ad091845?source=api-prod","affected":[{"type":"plugin","slug":"click5-crm-add-on-to-ninja-forms","name":"click5 CRM add-on to Ninja Forms","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:10:40Z"},{"id":"wordfence:f327f852-3003-4cf8-895d-91368d17b33e","source":"wordfence","cve":"CVE-2026-106608","title":"WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation","severity":"medium","cvss":4.7,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f327f852-3003-4cf8-895d-91368d17b33e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"9.8.0","from_inclusive":true,"to":"11.1.2","to_inclusive":true,"patched_in":"11.2.0"}],"published":"2026-10-08T16:45:31Z","updated":"2026-10-13T13:57:49Z"},{"id":"wordfence:f328b938-355d-426f-a9cf-646929a7c155","source":"wordfence","cve":"CVE-2024-30181","title":"Locatoraid Store Locator <= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f328b938-355d-426f-a9cf-646929a7c155?source=api-prod","affected":[{"type":"plugin","slug":"locatoraid","name":"Locatoraid Store Locator","from":"*","from_inclusive":true,"to":"3.9.30","to_inclusive":true,"patched_in":"3.9.31"}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T14:07:35Z"},{"id":"wordfence:f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6","source":"wordfence","cve":"CVE-2026-5502","title":"Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.8","to_inclusive":true,"patched_in":"3.9.9"}],"published":"2026-04-16T15:10:34Z","updated":"2026-04-17T03:36:45Z"},{"id":"wordfence:f32c66b3-b26c-4fe3-9171-ca8780391a2a","source":"wordfence","cve":"CVE-2018-5214","title":"Add Link to Facebook <= 2.3 - Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f32c66b3-b26c-4fe3-9171-ca8780391a2a?source=api-prod","affected":[{"type":"plugin","slug":"add-link-to-facebook","name":"Add Link to Facebook","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2018-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f32cd8e4-51bf-4fdf-ae14-155f8661dbdb","source":"wordfence","cve":"CVE-2023-5355","title":"Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f32cd8e4-51bf-4fdf-ae14-155f8661dbdb?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.4","to_inclusive":true,"patched_in":"6.1.5"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f330bf36-0a39-40d6-a075-c87fdb9dc2da","source":"wordfence","cve":"CVE-2024-6631","title":"ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions","severity":"medium","cvss":5.0,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f330bf36-0a39-40d6-a075-c87fdb9dc2da?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2024-08-23T14:20:02Z","updated":"2024-08-24T02:32:20Z"},{"id":"wordfence:f330fa5a-b471-45ee-a2a6-3ae8f3941bfe","source":"wordfence","cve":"CVE-2024-9629","title":"Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f330fa5a-b471-45ee-a2a6-3ae8f3941bfe?source=api-prod","affected":[{"type":"plugin","slug":"cf7-telegram","name":"Message Bridge for Contact Form 7 and Telegram","from":"*","from_inclusive":true,"to":"0.8.5","to_inclusive":true,"patched_in":"0.8.6"}],"published":"2024-10-27T00:00:00Z","updated":"2024-10-28T17:31:55Z"},{"id":"wordfence:f3339f80-d131-4201-87c7-dd4dba0d7f20","source":"wordfence","cve":"CVE-2026-80467","title":"Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3339f80-d131-4201-87c7-dd4dba0d7f20?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"0.9.2.2","from_inclusive":true,"to":"0.9.2.6","to_inclusive":true,"patched_in":"0.9.2.7"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:30:46Z"},{"id":"wordfence:f3341c29-a69e-4618-a8a5-11f4141ff88f","source":"wordfence","cve":"CVE-2025-13528","title":"Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3341c29-a69e-4618-a8a5-11f4141ff88f?source=api-prod","affected":[{"type":"plugin","slug":"feedback-modal-for-website","name":"Feedback Modal for Website","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:30:58Z","updated":"2025-12-05T05:31:31Z"},{"id":"wordfence:f3344e72-1dd6-45ec-b699-d755589a1566","source":"wordfence","cve":"CVE-2025-13309","title":"Accessiy By CodeConfig Accessibility \u2013 Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3344e72-1dd6-45ec-b699-d755589a1566?source=api-prod","affected":[{"type":"plugin","slug":"codeconfig-accessibility","name":"Accessiy by CodeConfig \u2013 Accessibility Widgets for ADA, EAA & WCAG Compliance","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T17:47:54Z","updated":"2026-03-10T05:49:38Z"},{"id":"wordfence:f3347400-c985-489d-90bb-4911fa9e8f88","source":"wordfence","cve":"CVE-2026-85303","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3347400-c985-489d-90bb-4911fa9e8f88?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:11:18Z"},{"id":"wordfence:f334de71-9edb-491b-9bad-a2412cd2e57d","source":"wordfence","cve":"CVE-2024-9182","title":"Maspik \u2013 Spam blacklist <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f334de71-9edb-491b-9bad-a2412cd2e57d?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2024-10-02T00:00:00Z","updated":"2025-05-30T18:46:28Z"},{"id":"wordfence:f3368b97-f177-4889-a289-6c68973d945a","source":"wordfence","cve":"CVE-2026-103080","title":"Salevo Boost Sales for WooCommerce \u2013 Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon <= 1.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3368b97-f177-4889-a289-6c68973d945a?source=api-prod","affected":[{"type":"plugin","slug":"woo-boost-sales","name":"Salevo Boost Sales for WooCommerce \u2013 Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2026-10-12T17:32:00Z","updated":"2026-10-13T13:49:28Z"},{"id":"wordfence:f338b8a9-7b0a-46bd-b624-ebda897651f1","source":"wordfence","cve":"CVE-2024-56030","title":"10CentMail <= 2.1.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f338b8a9-7b0a-46bd-b624-ebda897651f1?source=api-prod","affected":[{"type":"plugin","slug":"10centmail-subscription-management-and-analytics","name":"10CentMail","from":"*","from_inclusive":true,"to":"2.1.50","to_inclusive":true,"patched_in":""}],"published":"2024-12-17T00:00:00Z","updated":"2025-01-08T15:28:41Z"},{"id":"wordfence:f33a13dc-ebff-4033-9b8d-10076b1c2d0d","source":"wordfence","cve":"CVE-2023-4297","title":"Mmm Simple File List <= 2.3 - Authenticated (Subscriber+) Directory Traversal","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33a13dc-ebff-4033-9b8d-10076b1c2d0d?source=api-prod","affected":[{"type":"plugin","slug":"mmm-file-list","name":"Mmm Simple File List","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f33af49c-30b8-447f-a462-8489415c92bf","source":"wordfence","cve":"CVE-2024-49262","title":"Country Flags for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33af49c-30b8-447f-a462-8489415c92bf?source=api-prod","affected":[{"type":"plugin","slug":"country-flags-for-elementor","name":"Country Flags for Elementor","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:54:22Z"},{"id":"wordfence:f33bcc8d-3d21-4de8-87ac-a5e334bb641d","source":"wordfence","cve":"","title":"WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33bcc8d-3d21-4de8-87ac-a5e334bb641d?source=api-prod","affected":[{"type":"plugin","slug":"wpgraphql-smart-cache","name":"WPGraphQL Smart Cache","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":false,"patched_in":"2.0.1"}],"published":"2025-12-12T00:00:00Z","updated":"2026-01-15T16:42:48Z"},{"id":"wordfence:f33d080c-6d64-46d1-b01c-ef859106159f","source":"wordfence","cve":"CVE-2023-37390","title":"Themesflat Addons For Elementor <= 2.0.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d080c-6d64-46d1-b01c-ef859106159f?source=api-prod","affected":[{"type":"plugin","slug":"themesflat-addons-for-elementor","name":"Themesflat Addons For Elementor","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2023-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f33d77b7-5412-47bf-9bed-8617151723c9","source":"wordfence","cve":"CVE-2024-5329","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d77b7-5412-47bf-9bed-8617151723c9?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.109","to_inclusive":true,"patched_in":"1.5.110"}],"published":"2024-06-05T21:21:50Z","updated":"2024-06-06T09:34:02Z"},{"id":"wordfence:f33e0019-e52e-464b-843d-a034e5205b2e","source":"wordfence","cve":"CVE-2024-12434","title":"SureMembers <= 1.10.6 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33e0019-e52e-464b-843d-a034e5205b2e?source=api-prod","affected":[{"type":"plugin","slug":"suremembers","name":"SureMembers","from":"*","from_inclusive":true,"to":"1.10.6","to_inclusive":true,"patched_in":"1.10.7"}],"published":"2025-02-25T15:14:13Z","updated":"2025-02-26T03:27:23Z"},{"id":"wordfence:f33e8906-c607-40de-8c2a-93ca12519da5","source":"wordfence","cve":"CVE-2022-34858","title":"OAuth 2.0 client for SSO <= 1.11.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f33e8906-c607-40de-8c2a-93ca12519da5?source=api-prod","affected":[{"type":"plugin","slug":"oauth-client","name":"OAuth 2.0 client for SSO","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":true,"patched_in":"1.11.4"}],"published":"2022-06-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f34383c7-1d98-4f8a-aa43-542fe2d9a567","source":"wordfence","cve":"","title":"Starbox Voting <= 2.0.4 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34383c7-1d98-4f8a-aa43-542fe2d9a567?source=api-prod","affected":[{"type":"plugin","slug":"starbox-voting","name":"Starbox Voting","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2011-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f34722fb-e852-4194-b839-7d885d212fc9","source":"wordfence","cve":"","title":"Front User Submit | Front Editor <= 3.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34722fb-e852-4194-b839-7d885d212fc9?source=api-prod","affected":[{"type":"plugin","slug":"front-editor","name":"Guest posting / Frontend Posting / Front Editor \u2013 WP Front User Submit","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":false,"patched_in":"3.8.0"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f347a629-523e-4ec4-ad56-6ae9357dd7f5","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Missing Authorization in 'saveRedirectSettings' function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f347a629-523e-4ec4-ad56-6ae9357dd7f5?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f34825a5-f7ef-42f8-8995-d41ab79b9082","source":"wordfence","cve":"CVE-2025-32538","title":"Easy Post Duplicator <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34825a5-f7ef-42f8-8995-d41ab79b9082?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-duplicator","name":"Easy Post Duplicator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:25:17Z"},{"id":"wordfence:f34871a0-6556-447b-8c17-14235be47f55","source":"wordfence","cve":"CVE-2026-81650","title":"NextGEN Gallery <= 4.4.0 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34871a0-6556-447b-8c17-14235be47f55?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-09-18T00:00:00Z","updated":"2026-09-22T19:30:27Z"},{"id":"wordfence:f348e019-d4b5-4384-8ee9-117694259b92","source":"wordfence","cve":"CVE-2024-53757","title":"WP Find Your Nearest <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f348e019-d4b5-4384-8ee9-117694259b92?source=api-prod","affected":[{"type":"plugin","slug":"wp-find-your-nearest","name":"WP Find Your Nearest","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-28T00:00:00Z","updated":"2024-12-05T14:30:51Z"},{"id":"wordfence:f34904b5-3b3d-46d3-9e33-ef661d5f4149","source":"wordfence","cve":"CVE-2024-13675","title":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34904b5-3b3d-46d3-9e33-ef661d5f4149?source=api-prod","affected":[{"type":"plugin","slug":"slingblocks","name":"SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2025-03-07T21:25:46Z","updated":"2025-03-08T11:16:42Z"},{"id":"wordfence:f34b7518-5cb3-4b4e-8b18-927c08c045f7","source":"wordfence","cve":"CVE-2024-11324","title":"Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34b7518-5cb3-4b4e-8b18-927c08c045f7?source=api-prod","affected":[{"type":"plugin","slug":"accounting-for-woocommerce","name":"Accounting for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2024-12-04T00:00:00Z","updated":"2024-12-05T09:23:08Z"},{"id":"wordfence:f34e397a-beaa-4c09-bedb-c41515d1adfa","source":"wordfence","cve":"CVE-2025-31446","title":"WP Cleaner <= 1.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34e397a-beaa-4c09-bedb-c41515d1adfa?source=api-prod","affected":[{"type":"plugin","slug":"wpcleaner","name":"WP Cleaner","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T20:54:40Z"},{"id":"wordfence:f34f98a0-9df4-4b50-ae6a-7912e4b12bb2","source":"wordfence","cve":"CVE-2010-4779","title":"WPtouch < 1.9.20 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f34f98a0-9df4-4b50-ae6a-7912e4b12bb2?source=api-prod","affected":[{"type":"plugin","slug":"wptouch","name":"WPtouch \u2013 Make your WordPress Website Mobile-Friendly","from":"*","from_inclusive":true,"to":"1.9.20","to_inclusive":false,"patched_in":"1.9.20"}],"published":"2010-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3543ce7-328e-4db8-8993-8cd78af997de","source":"wordfence","cve":"CVE-2021-25005","title":"SEUR Oficial <= 1.6.0 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3543ce7-328e-4db8-8993-8cd78af997de?source=api-prod","affected":[{"type":"plugin","slug":"seur","name":"SEUR Oficial","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3555702-4427-4569-8fd6-f84113593e9d","source":"wordfence","cve":"CVE-2022-2446","title":"WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3555702-4427-4569-8fd6-f84113593e9d?source=api-prod","affected":[{"type":"plugin","slug":"wp-editor","name":"WP Editor","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.2.9.1"}],"published":"2024-09-12T00:00:00Z","updated":"2024-09-13T15:10:44Z"},{"id":"wordfence:f3559bba-daa2-4a00-958c-6568cdbb592f","source":"wordfence","cve":"CVE-2022-4482","title":"Carousel, Slider, Gallery by WP Carousel <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3559bba-daa2-4a00-958c-6568cdbb592f?source=api-prod","affected":[{"type":"plugin","slug":"wp-carousel-free","name":"AI-Powered Carousel, Slider, Video & Photo Gallery Blocks by WP Carousel","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2022-12-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f355d2c0-6133-4091-b900-1451ebba70c4","source":"wordfence","cve":"CVE-2024-10663","title":"Eleblog \u2013 Elementor Blog And Magazine Addons <= 1.8 - Missing Authorization to Authenticated (Subscriber+) Deactivation Submission","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f355d2c0-6133-4091-b900-1451ebba70c4?source=api-prod","affected":[{"type":"plugin","slug":"ele-blog","name":"Eleblog \u2013 Elementor Blog And Magazine Addons","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T14:18:30Z","updated":"2024-12-04T02:40:27Z"},{"id":"wordfence:f357fe2a-aa24-42cd-ac2c-c948e18a4710","source":"wordfence","cve":"CVE-2024-1799","title":"GamiPress \u2013 The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f357fe2a-aa24-42cd-ac2c-c948e18a4710?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"6.8.6","to_inclusive":true,"patched_in":"6.8.7"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-20T02:35:43Z"},{"id":"wordfence:f3584b5b-ff93-4a47-b6e6-f95335ee88b6","source":"wordfence","cve":"","title":"Mailster <= 2.4.5.1 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3584b5b-ff93-4a47-b6e6-f95335ee88b6?source=api-prod","affected":[{"type":"plugin","slug":"mailster","name":"Mailster WordPress Newsletter Plugin","from":"*","from_inclusive":true,"to":"2.4.5.1","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2020-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f35a85de-c24c-4078-88fe-6b686dff57c9","source":"wordfence","cve":"CVE-2026-118185","title":"Security Optimizer <= 1.6.8 -  Two-Factor Authentication via  Brute Force","severity":"medium","cvss":4.3,"cwe":"CWE-307","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35a85de-c24c-4078-88fe-6b686dff57c9?source=api-prod","affected":[{"type":"plugin","slug":"sg-security","name":"Security Optimizer \u2013 The All-In-One Protection Plugin","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-04T21:40:59Z"},{"id":"wordfence:f35b6b83-93e7-464e-baaf-4be12e694510","source":"wordfence","cve":"CVE-2024-51715","title":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35b6b83-93e7-464e-baaf-4be12e694510?source=api-prod","affected":[{"type":"plugin","slug":"clickwhale","name":"ClickWhale \u2013 Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-20T17:03:05Z"},{"id":"wordfence:f35c0de9-abed-4cbf-a28c-48f8133a1bad","source":"wordfence","cve":"CVE-2026-4361","title":"Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter","severity":"medium","cvss":5.0,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35c0de9-abed-4cbf-a28c-48f8133a1bad?source=api-prod","affected":[{"type":"theme","slug":"Divi","name":"Divi","from":"*","from_inclusive":true,"to":"4.27.6","to_inclusive":true,"patched_in":"4.27.7"}],"published":"2026-09-04T18:13:54Z","updated":"2026-09-05T06:37:59Z"},{"id":"wordfence:f35c1649-ee8b-4d3c-adff-1389478d6c60","source":"wordfence","cve":"CVE-2026-110651","title":"Swift Performance Lite <= 2.3.7.3 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35c1649-ee8b-4d3c-adff-1389478d6c60?source=api-prod","affected":[{"type":"plugin","slug":"swift-performance-lite","name":"Swift Performance Lite","from":"*","from_inclusive":true,"to":"2.3.7.3","to_inclusive":true,"patched_in":"2.3.7.4"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:21:44Z"},{"id":"wordfence:f35c4e21-a6d6-4821-a415-2ff40ea76f99","source":"wordfence","cve":"CVE-2021-24674","title":"Genie WP Favicon <= 0.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35c4e21-a6d6-4821-a415-2ff40ea76f99?source=api-prod","affected":[{"type":"plugin","slug":"genie-wp-favicon","name":"Genie WP Favicon","from":"*","from_inclusive":true,"to":"0.5.2","to_inclusive":true,"patched_in":""}],"published":"2021-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f35eee8f-3527-40f1-9ac1-2f8316b3574b","source":"wordfence","cve":"CVE-2026-114698","title":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred <= 4.0.0-beta.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f35eee8f-3527-40f1-9ac1-2f8316b3574b?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":false,"patched_in":"4.0.0"}],"published":"2026-10-22T00:00:00Z","updated":"2026-10-28T16:38:24Z"},{"id":"wordfence:f3664a96-4ce7-4561-9b4b-dff91cd49384","source":"wordfence","cve":"CVE-2025-5931","title":"Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3664a96-4ce7-4561-9b4b-dff91cd49384?source=api-prod","affected":[{"type":"plugin","slug":"dokan-pro","name":"Dokan Pro","from":"*","from_inclusive":true,"to":"4.0.5","to_inclusive":true,"patched_in":"4.0.6"}],"published":"2025-08-25T16:11:38Z","updated":"2025-08-26T05:07:48Z"},{"id":"wordfence:f367a3d2-8ee6-4897-b7bf-a44f57142347","source":"wordfence","cve":"CVE-2014-125101","title":"Portfolio Gallery \u2013 Photo Gallery <= 1.1.8 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f367a3d2-8ee6-4897-b7bf-a44f57142347?source=api-prod","affected":[{"type":"plugin","slug":"portfolio-gallery","name":"Portfolio Gallery \u2013 Photo Gallery","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f36a960d-e8bd-47aa-b20a-8d91e678faba","source":"wordfence","cve":"CVE-2026-54184","title":"Clean Login <= 1.15 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36a960d-e8bd-47aa-b20a-8d91e678faba?source=api-prod","affected":[{"type":"plugin","slug":"clean-login","name":"Clean Login","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":"1.16"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-25T14:28:21Z"},{"id":"wordfence:f36af71c-78af-402c-9d3a-3752368e7584","source":"wordfence","cve":"CVE-2022-45848","title":"Contest Gallery <= 13.1.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36af71c-78af-402c-9d3a-3752368e7584?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"13.1.0.9","to_inclusive":true,"patched_in":"14.0.0"}],"published":"2022-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f36b0c89-3bce-40c3-b28d-8bd3d132bc5d","source":"wordfence","cve":"CVE-2025-57934","title":"LWS Affiliation <= 2.3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36b0c89-3bce-40c3-b28d-8bd3d132bc5d?source=api-prod","affected":[{"type":"plugin","slug":"lws-affiliation","name":"LWS Affiliation","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T14:38:46Z"},{"id":"wordfence:f36b3571-1dc1-4c2f-8888-5fd823ce1954","source":"wordfence","cve":"CVE-2026-11963","title":"User Registration & Membership <= 5.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Membership Tier Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36b3571-1dc1-4c2f-8888-5fd823ce1954?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.1","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:08:55Z"},{"id":"wordfence:f36c785f-9b8c-43c4-b12f-6fb4c0c67eff","source":"wordfence","cve":"CVE-2024-4484","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36c785f-9b8c-43c4-b12f-6fb4c0c67eff?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"5.5.3"}],"published":"2024-05-23T00:00:00Z","updated":"2024-05-24T06:42:18Z"},{"id":"wordfence:f36df17d-4633-42e0-b106-908b994d8cb7","source":"wordfence","cve":"CVE-2024-12260","title":"Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36df17d-4633-42e0-b106-908b994d8cb7?source=api-prod","affected":[{"type":"plugin","slug":"custom-wp-rest-api","name":"Ultimate Endpoints With Rest Api","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:17:50Z","updated":"2024-12-12T03:23:11Z"},{"id":"wordfence:f36ed435-3836-4c43-9e8c-ec07325e05d4","source":"wordfence","cve":"CVE-2025-53351","title":"Fidelo Snippet <= 1.12 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36ed435-3836-4c43-9e8c-ec07325e05d4?source=api-prod","affected":[{"type":"plugin","slug":"thebing-snippet","name":"Fidelo Snippet","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-12T00:00:00Z","updated":"2025-10-29T20:21:00Z"},{"id":"wordfence:f36f1ea5-62f7-48f0-a8d3-a56e0c9915d7","source":"wordfence","cve":"CVE-2025-3888","title":"Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36f1ea5-62f7-48f0-a8d3-a56e0c9915d7?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.8.12","to_inclusive":true,"patched_in":"4.9.1"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T11:17:17Z"},{"id":"wordfence:f36fea15-0475-45ee-b913-790db6373aef","source":"wordfence","cve":"CVE-2024-3743","title":"Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f36fea15-0475-45ee-b913-790db6373aef?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.13.3","to_inclusive":true,"patched_in":"1.13.4"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-02T16:52:51Z"},{"id":"wordfence:f3713fa9-eb5a-41c2-8ac3-e9013634facb","source":"wordfence","cve":"CVE-2026-94299","title":"elegro Crypto Payment <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3713fa9-eb5a-41c2-8ac3-e9013634facb?source=api-prod","affected":[{"type":"plugin","slug":"elegro-payment","name":"elegro Crypto Payment","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-08T23:51:17Z"},{"id":"wordfence:f371feb6-93ae-4759-ab44-d58106093290","source":"wordfence","cve":"CVE-2021-24440","title":"Sign-up Sheets <= 1.0.13 - Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f371feb6-93ae-4759-ab44-d58106093290?source=api-prod","affected":[{"type":"plugin","slug":"sign-up-sheets","name":"Sign-up Sheets","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":false,"patched_in":"1.0.14"}],"published":"2021-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3729b1f-88a9-4d1a-8367-18dd0a0bb2f2","source":"wordfence","cve":"CVE-2026-84926","title":"EmbedPress \u2013 PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3729b1f-88a9-4d1a-8367-18dd0a0bb2f2?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"4.6.0","from_inclusive":true,"to":"4.6.3","to_inclusive":true,"patched_in":"4.6.4"}],"published":"2026-09-05T00:00:00Z","updated":"2026-09-09T13:19:11Z"},{"id":"wordfence:f373a1d5-3d7e-4a0a-af03-28ca6ce6a170","source":"wordfence","cve":"","title":"All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download","severity":"medium","cvss":5.9,"cwe":"CWE-330","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f373a1d5-3d7e-4a0a-af03-28ca6ce6a170?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-migration","name":"All-in-One WP Migration and Backup","from":"*","from_inclusive":true,"to":"7.15","to_inclusive":false,"patched_in":"7.15"}],"published":"2020-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f374a57f-e4a4-4771-a887-86b3e8a8acca","source":"wordfence","cve":"CVE-2025-26955","title":"Industrial Lite <= 1.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f374a57f-e4a4-4771-a887-86b3e8a8acca?source=api-prod","affected":[{"type":"theme","slug":"industrial-lite","name":"Industrial Lite","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-15T13:08:52Z"},{"id":"wordfence:f374b3d1-820b-473f-8d2b-c3267e6d23d9","source":"wordfence","cve":"CVE-2024-11349","title":"AdForest <= 5.1.6 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f374b3d1-820b-473f-8d2b-c3267e6d23d9?source=api-prod","affected":[{"type":"theme","slug":"adforest","name":"AdForest","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2024-12-20T00:00:00Z","updated":"2024-12-21T04:22:17Z"},{"id":"wordfence:f374db6e-4df6-47c1-9ae2-3ec9c134a1d4","source":"wordfence","cve":"CVE-2026-57738","title":"777 <= 1.13.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f374db6e-4df6-47c1-9ae2-3ec9c134a1d4?source=api-prod","affected":[{"type":"theme","slug":"triple-seven","name":"777","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-09T00:00:00Z","updated":"2026-07-14T19:19:07Z"},{"id":"wordfence:f3781245-14b1-4b1c-a471-a5a413cdb2ed","source":"wordfence","cve":"CVE-2019-9911","title":"NextScripts: Social Networks Auto-Poster <= 4.2.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3781245-14b1-4b1c-a471-a5a413cdb2ed?source=api-prod","affected":[{"type":"plugin","slug":"social-networks-auto-poster-facebook-twitter-g","name":"NextScripts: Social Networks Auto-Poster","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":false,"patched_in":"4.2.8"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f37852ae-a190-43f2-8f67-256a3f2dba26","source":"wordfence","cve":"CVE-2025-60193","title":"Premmerce User Roles <= 1.0.13 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37852ae-a190-43f2-8f67-256a3f2dba26?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2025-07-28T00:00:00Z","updated":"2026-02-25T12:53:40Z"},{"id":"wordfence:f37a0db8-b13c-4d9f-bc6f-88576f9e3862","source":"wordfence","cve":"CVE-2026-107757","title":"Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37a0db8-b13c-4d9f-bc6f-88576f9e3862?source=api-prod","affected":[{"type":"plugin","slug":"gallery-custom-links","name":"Gallery Custom Links","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-10-13T19:13:51Z","updated":"2026-10-14T07:43:37Z"},{"id":"wordfence:f37c4b2c-6f41-46b5-8427-b1883b39322e","source":"wordfence","cve":"CVE-2023-33212","title":"JetFormBuilder <= 3.0.6 - Cross-Site Request Fogery via 'do_admin_action'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37c4b2c-6f41-46b5-8427-b1883b39322e?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f37cc880-d8a4-431a-9639-abf01163030a","source":"wordfence","cve":"CVE-2026-3359","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37cc880-d8a4-431a-9639-abf01163030a?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.42","to_inclusive":true,"patched_in":"1.15.43"}],"published":"2026-05-04T18:43:52Z","updated":"2026-05-05T07:42:07Z"},{"id":"wordfence:f37cc9d0-345e-4ab7-ae99-d9d7fee6c1e5","source":"wordfence","cve":"CVE-2023-49761","title":"Product Enquiry for WooCommerce <= 3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37cc9d0-345e-4ab7-ae99-d9d7fee6c1e5?source=api-prod","affected":[{"type":"plugin","slug":"gm-woocommerce-quote-popup","name":"Product Enquiry for WooCommerce","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2023-12-04T00:00:00Z","updated":"2024-02-05T22:11:00Z"},{"id":"wordfence:f37f6d9f-cd2d-421d-a5ac-ce552f0d0181","source":"wordfence","cve":"CVE-2025-26585","title":"DL Leadback <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37f6d9f-cd2d-421d-a5ac-ce552f0d0181?source=api-prod","affected":[{"type":"plugin","slug":"dl-leadback","name":"DL Leadback","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:02:10Z"},{"id":"wordfence:f37fb598-72a2-48d3-b2e6-63d6654b1474","source":"wordfence","cve":"CVE-2024-9425","title":"Advanced Category and Custom Taxonomy Image <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37fb598-72a2-48d3-b2e6-63d6654b1474?source=api-prod","affected":[{"type":"plugin","slug":"advanced-category-and-custom-taxonomy-image","name":"Advanced Category and Custom Taxonomy Image","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-10-17T21:27:19Z","updated":"2024-10-18T09:32:18Z"},{"id":"wordfence:f37fbbd8-234f-41bd-bb46-44de440f977c","source":"wordfence","cve":"CVE-2025-53461","title":"Beaf <= 1.6.2 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f37fbbd8-234f-41bd-bb46-44de440f977c?source=api-prod","affected":[{"type":"plugin","slug":"image-compare-block","name":"Image Comparison Block \u2013 Before After Image Slider","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-11-10T23:18:30Z"},{"id":"wordfence:f3805936-675e-474f-a3f7-acea69bd72f0","source":"wordfence","cve":"CVE-2020-36156","title":"Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update","severity":"critical","cvss":9.9,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3805936-675e-474f-a3f7-acea69bd72f0?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":false,"patched_in":"2.1.12"}],"published":"2020-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3845071-8419-4bb2-b22d-f9ae22fb7d6a","source":"wordfence","cve":"CVE-2025-12971","title":"Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3845071-8419-4bb2-b22d-f9ae22fb7d6a?source=api-prod","affected":[{"type":"plugin","slug":"folders","name":"Folders \u2013 Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":"3.1.6"}],"published":"2025-11-26T00:00:00Z","updated":"2025-11-27T12:31:02Z"},{"id":"wordfence:f38543ff-1074-4273-be33-8142d59e904f","source":"wordfence","cve":"CVE-2024-12538","title":"Duplicate Post, Page and Any Custom Post <= 3.5.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f38543ff-1074-4273-be33-8142d59e904f?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-pp","name":"Duplicate PP","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2025-01-06T15:07:42Z","updated":"2025-01-30T22:28:36Z"},{"id":"wordfence:f3855918-960e-487d-9d5f-6dbeba45523e","source":"wordfence","cve":"CVE-2019-17515","title":"Spam protection, AntiSpam, FireWall by CleanTalk <= 5.127.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3855918-960e-487d-9d5f-6dbeba45523e?source=api-prod","affected":[{"type":"plugin","slug":"cleantalk-spam-protect","name":"Anti-Spam, Spam FireWall by CleanTalk","from":"*","from_inclusive":true,"to":"5.127.3","to_inclusive":true,"patched_in":"5.127.4"}],"published":"2019-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3855e84-b97e-4729-8a48-55f2a2444e2c","source":"wordfence","cve":"CVE-2023-4276","title":"Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3855e84-b97e-4729-8a48-55f2a2444e2c?source=api-prod","affected":[{"type":"plugin","slug":"absolute-privacy","name":"Absolute Privacy","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f389f4bf-ffff-4862-b4e2-4465ca0556ef","source":"wordfence","cve":"CVE-2023-1891","title":"Helpie FAQ <= 1.9.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f389f4bf-ffff-4862-b4e2-4465ca0556ef?source=api-prod","affected":[{"type":"plugin","slug":"helpie-faq","name":"Helpie FAQ \u2014 Accordion, Docs & Knowledge Base","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":"1.9.9"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f389f8ee-6d8f-40a8-be52-d2b26b560089","source":"wordfence","cve":"CVE-2025-64197","title":"Rehub < 19.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f389f8ee-6d8f-40a8-be52-d2b26b560089?source=api-prod","affected":[{"type":"theme","slug":"rehub-theme","name":"REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme","from":"*","from_inclusive":true,"to":"19.9.9.1","to_inclusive":false,"patched_in":"19.9.9.1"}],"published":"2025-10-18T00:00:00Z","updated":"2025-11-04T15:46:25Z"},{"id":"wordfence:f38c28f4-e73a-4eb2-8bbd-73c849385c4e","source":"wordfence","cve":"CVE-2025-1670","title":"School Management System \u2013 WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f38c28f4-e73a-4eb2-8bbd-73c849385c4e?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2025-03-14T14:23:15Z","updated":"2025-11-05T19:40:30Z"},{"id":"wordfence:f38fc5ed-d4e7-46a8-9983-9bf28444db99","source":"wordfence","cve":"CVE-2022-2041","title":"Brizy Page Builder <= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element Content","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f38fc5ed-d4e7-46a8-9983-9bf28444db99?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":false,"patched_in":"2.4.2"}],"published":"2022-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f393c5c0-03e7-4f9b-8714-2b25c1010176","source":"wordfence","cve":"CVE-2025-69365","title":"Uroan Core <= 1.4.4 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f393c5c0-03e7-4f9b-8714-2b25c1010176?source=api-prod","affected":[{"type":"plugin","slug":"uroan-core","name":"Uroan Core","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-28T00:00:00Z","updated":"2026-02-02T20:07:43Z"},{"id":"wordfence:f3944b2d-c431-4a53-b4e2-740480e746d6","source":"wordfence","cve":"","title":"Cyberus Key <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3944b2d-c431-4a53-b4e2-740480e746d6?source=api-prod","affected":[{"type":"plugin","slug":"cyberus-key","name":"Cyberus Key","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.1"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3945fbe-5ba0-44e3-ae1d-33a53592da1a","source":"wordfence","cve":"CVE-2025-58822","title":"WP Mail <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3945fbe-5ba0-44e3-ae1d-33a53592da1a?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail","name":"WP Mail","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-11T13:32:39Z"},{"id":"wordfence:f397550a-08f6-47d5-8425-e715ad693d6e","source":"wordfence","cve":"CVE-2024-37479","title":"LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'","severity":"medium","cvss":5.4,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f397550a-08f6-47d5-8425-e715ad693d6e?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.8.1","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2024-07-02T00:00:00Z","updated":"2024-07-03T18:27:13Z"},{"id":"wordfence:f39a9570-a352-45f3-8644-2de2c1c709d2","source":"wordfence","cve":"CVE-2026-88963","title":"Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":true,"patched_in":"4.0.9"}],"published":"2026-10-15T16:58:44Z","updated":"2026-10-16T05:30:29Z"},{"id":"wordfence:f39b7208-2faa-414c-9123-52d25121200b","source":"wordfence","cve":"CVE-2026-103379","title":"WATI Chat and Notification <= 1.1.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f39b7208-2faa-414c-9123-52d25121200b?source=api-prod","affected":[{"type":"plugin","slug":"wati-chat-and-notification","name":"WATI Chat and Notification","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-05T13:41:14Z"},{"id":"wordfence:f39d1f86-17d7-4b22-ba42-e88e96111bd6","source":"wordfence","cve":"CVE-2026-76793","title":"Firebase Authentication < 1.7.1 - Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f39d1f86-17d7-4b22-ba42-e88e96111bd6?source=api-prod","affected":[{"type":"plugin","slug":"firebase-authentication","name":"Firebase Authentication","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":false,"patched_in":"1.7.1"}],"published":"2026-08-20T00:00:00Z","updated":"2026-09-02T14:37:44Z"},{"id":"wordfence:f39db018-ffb1-4adc-b32e-19dde975f1cc","source":"wordfence","cve":"CVE-2026-103349","title":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f39db018-ffb1-4adc-b32e-19dde975f1cc?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"13.5.7","to_inclusive":true,"patched_in":"13.5.8"}],"published":"2026-10-03T18:00:53Z","updated":"2026-10-08T23:19:55Z"},{"id":"wordfence:f3a20047-a325-4d29-a848-7ffa525d0bad","source":"wordfence","cve":"CVE-2025-13516","title":"SureMail \u2013 SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a20047-a325-4d29-a848-7ffa525d0bad?source=api-prod","affected":[{"type":"plugin","slug":"suremails","name":"SureMail \u2013 SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-12-01T19:54:07Z","updated":"2025-12-02T08:25:06Z"},{"id":"wordfence:f3a3d20f-dcd7-4a15-b664-3b6826f56a22","source":"wordfence","cve":"CVE-2026-62044","title":"Super Video player \u2013 Fully Customizable Video Player with Playlist <= 1.8.14 - Authenticated (Editor+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a3d20f-dcd7-4a15-b664-3b6826f56a22?source=api-prod","affected":[{"type":"plugin","slug":"super-video-player","name":"Super Video player \u2013 Fully Customizable Video Player with Playlist","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":"1.8.15"}],"published":"2026-10-08T16:30:29Z","updated":"2026-10-28T21:19:10Z"},{"id":"wordfence:f3a4aeb2-3929-4f6b-ac6e-bccc1c3bf0dd","source":"wordfence","cve":"","title":"WP Statistics <= 2.2.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a4aeb2-3929-4f6b-ac6e-bccc1c3bf0dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3a4fb4a-f466-4dff-8bf5-d03dd6a0b2dc","source":"wordfence","cve":"CVE-2026-25010","title":"Share This Image <= 2.09 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a4fb4a-f466-4dff-8bf5-d03dd6a0b2dc?source=api-prod","affected":[{"type":"plugin","slug":"share-this-image","name":"Share This Image","from":"*","from_inclusive":true,"to":"2.09","to_inclusive":true,"patched_in":"2.10"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-02T20:41:50Z"},{"id":"wordfence:f3a5bb9c-0fc3-4a1b-8b4d-a700cbf9dacc","source":"wordfence","cve":"CVE-2018-16164","title":"EventCalendar <= 1.1.21 - Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a5bb9c-0fc3-4a1b-8b4d-a700cbf9dacc?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.1.21","to_inclusive":true,"patched_in":"1.1.22"}],"published":"2018-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3a8273e-2439-4138-941e-379d130e0c74","source":"wordfence","cve":"CVE-2023-48271","title":"Maspik \u2013 Spam blacklist <= 0.10.3 - Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-348","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a8273e-2439-4138-941e-379d130e0c74?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms-anti-spam","name":"Spam Protection | Maspik","from":"*","from_inclusive":true,"to":"0.10.3","to_inclusive":true,"patched_in":"0.10.4"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3a8ff84-3400-480a-9fc5-730b933d200e","source":"wordfence","cve":"CVE-2026-118072","title":"Fraud Prevention For WooCommerce and EDD <= 2.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3a8ff84-3400-480a-9fc5-730b933d200e?source=api-prod","affected":[{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"*","from_inclusive":true,"to":"2.3.5","to_inclusive":true,"patched_in":"2.3.6"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:39:21Z"},{"id":"wordfence:f3abba90-9503-484e-bc2b-c6105bec698b","source":"wordfence","cve":"CVE-2024-30499","title":"CRM Perks Forms <= 1.1.4 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3abba90-9503-484e-bc2b-c6105bec698b?source=api-prod","affected":[{"type":"plugin","slug":"crm-perks-forms","name":"CRM Perks Forms \u2013 WordPress Form Builder","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:53:04Z"},{"id":"wordfence:f3ae1c32-18a7-4109-a7ea-dfd18fa3a8e2","source":"wordfence","cve":"CVE-2024-10186","title":"Event Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ae1c32-18a7-4109-a7ea-dfd18fa3a8e2?source=api-prod","affected":[{"type":"plugin","slug":"event-post","name":"Event Post","from":"*","from_inclusive":true,"to":"5.9.6","to_inclusive":true,"patched_in":"5.9.7"}],"published":"2024-11-05T23:36:54Z","updated":"2024-11-06T12:43:13Z"},{"id":"wordfence:f3ae3bca-d363-4c4b-809f-0625385bc9a6","source":"wordfence","cve":"CVE-2024-1793","title":"AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ae3bca-d363-4c4b-809f-0625385bc9a6?source=api-prod","affected":[{"type":"plugin","slug":"aweber-web-form-widget","name":"AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth","from":"*","from_inclusive":true,"to":"7.3.14","to_inclusive":true,"patched_in":"7.3.15"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:27:24Z"},{"id":"wordfence:f3af6f70-aa7e-4f33-88c0-45befaab2b29","source":"wordfence","cve":"CVE-2026-8442","title":"WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3af6f70-aa7e-4f33-88c0-45befaab2b29?source=api-prod","affected":[{"type":"plugin","slug":"wp-review-slider-pro","name":"WP Review Slider Pro","from":"*","from_inclusive":true,"to":"12.6.8","to_inclusive":true,"patched_in":"12.7.0"}],"published":"2026-06-15T20:44:47Z","updated":"2026-06-16T09:31:34Z"},{"id":"wordfence:f3b265d9-dddd-4cf7-8d1a-980fdd17777d","source":"wordfence","cve":"CVE-2025-11868","title":"everviz <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3b265d9-dddd-4cf7-8d1a-980fdd17777d?source=api-prod","affected":[{"type":"plugin","slug":"everviz","name":"everviz \u2013 Charts, Maps and Tables \u2013 Interactive and responsive","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-17T20:17:02Z","updated":"2025-11-18T08:27:38Z"},{"id":"wordfence:f3b3f4b7-b25e-4d1f-b919-1cef5eb0d006","source":"wordfence","cve":"CVE-2026-103313","title":"BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3b3f4b7-b25e-4d1f-b919-1cef5eb0d006?source=api-prod","affected":[{"type":"plugin","slug":"wc-bitpay-gateway","name":"BitPay Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-25T00:00:00Z","updated":"2026-11-03T19:20:27Z"},{"id":"wordfence:f3b727ba-b39c-4a98-a6a6-ea33785079f6","source":"wordfence","cve":"CVE-2024-7503","title":"WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3b727ba-b39c-4a98-a6a6-ea33785079f6?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-08-09T13:23:32Z","updated":"2024-08-10T02:01:24Z"},{"id":"wordfence:f3b79fab-208f-4354-89ea-508290dcd851","source":"wordfence","cve":"","title":"MailerLite \u2013 Signup forms <= 1.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3b79fab-208f-4354-89ea-508290dcd851?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2020-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3ba06f9-de51-49ea-87c1-4583e939314b","source":"wordfence","cve":"CVE-2024-0952","title":"WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ba06f9-de51-49ea-87c1-4583e939314b?source=api-prod","affected":[{"type":"plugin","slug":"erp","name":"ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce","from":"*","from_inclusive":true,"to":"1.12.9","to_inclusive":true,"patched_in":"1.13.0"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-11T12:54:50Z"},{"id":"wordfence:f3bbc23b-94af-4f4f-8b5f-6af41108fd93","source":"wordfence","cve":"","title":"Google Authenticator <= 0.47 - Improper Authentication","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3bbc23b-94af-4f4f-8b5f-6af41108fd93?source=api-prod","affected":[{"type":"plugin","slug":"google-authenticator","name":"Google Authenticator","from":"*","from_inclusive":true,"to":"0.47","to_inclusive":true,"patched_in":"0.48"}],"published":"2016-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3bddb69-9c63-49e8-9c04-08361423b1c3","source":"wordfence","cve":"CVE-2018-3811","title":"Smart Google Code Inserter < 3.5 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3bddb69-9c63-49e8-9c04-08361423b1c3?source=api-prod","affected":[{"type":"plugin","slug":"smart-google-code-inserter","name":"Smart Google Code Inserter","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":false,"patched_in":"3.5"}],"published":"2018-01-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3c4ba08-a9fa-439a-a887-b8c113f78e20","source":"wordfence","cve":"CVE-2025-4579","title":"WP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c4ba08-a9fa-439a-a887-b8c113f78e20?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-security-policy","name":"WP Content Security Plugin","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-05-14T13:58:22Z","updated":"2025-05-15T01:59:24Z"},{"id":"wordfence:f3c50b00-0b90-45f3-a392-be4e6406a865","source":"wordfence","cve":"CVE-2025-67909","title":"Membership For WooCommerce <= 3.0.3 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c50b00-0b90-45f3-a392-be4e6406a865?source=api-prod","affected":[{"type":"plugin","slug":"membership-for-woocommerce","name":"Membership For WooCommerce","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-05T21:36:11Z"},{"id":"wordfence:f3c52521-763b-4618-8d8f-fc1f49554be2","source":"wordfence","cve":"CVE-2026-120509","title":"Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c52521-763b-4618-8d8f-fc1f49554be2?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-free","name":"Real Testimonials \u2013 Testimonial Slider, Collect Customer Reviews and Video Testimonials","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2026-11-06T21:37:01Z","updated":"2026-11-07T11:26:35Z"},{"id":"wordfence:f3c5aafc-e75a-472e-9b62-10bb5a9da9b6","source":"wordfence","cve":"CVE-2017-18489","title":"Contact Form 7 \u2013 Clockwork SMS < 2.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c5aafc-e75a-472e-9b62-10bb5a9da9b6?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-sms-addon","name":"Contact Form 7 \u2013 Clockwork SMS","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":false,"patched_in":"2.4.1"}],"published":"2017-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3c885b5-e0ae-4c16-b70c-95605f6542f5","source":"wordfence","cve":"CVE-2026-122661","title":"Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c885b5-e0ae-4c16-b70c-95605f6542f5?source=api-prod","affected":[{"type":"plugin","slug":"directorist","name":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","from":"*","from_inclusive":true,"to":"8.10.7","to_inclusive":true,"patched_in":"8.11"}],"published":"2026-11-07T10:45:06Z","updated":"2026-11-10T19:53:18Z"},{"id":"wordfence:f3c8b3fa-dc27-4c00-844f-e95cac028247","source":"wordfence","cve":"CVE-2021-24249","title":"Business Directory Plugin \u2013 Easy Listing Directories for WordPress <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Listing Export","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c8b3fa-dc27-4c00-844f-e95cac028247?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"5.11.1","to_inclusive":true,"patched_in":"5.11.2"}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3c9c798-8545-475e-879b-7e44dac493f0","source":"wordfence","cve":"CVE-2022-2431","title":"Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3c9c798-8545-475e-879b-7e44dac493f0?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.50","to_inclusive":true,"patched_in":"3.2.51"}],"published":"2022-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3cdc0ba-d28f-488c-a703-f9d880f0582e","source":"wordfence","cve":"CVE-2023-41855","title":"Regpack <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3cdc0ba-d28f-488c-a703-f9d880f0582e?source=api-prod","affected":[{"type":"plugin","slug":"regpack","name":"Regpack","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3d00464-557f-4177-87aa-f5340b796dbb","source":"wordfence","cve":"CVE-2023-32127","title":"Multi Rating <= 5.0.6 - Missing Authorization to Arbitrary Ratings Value Change","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d00464-557f-4177-87aa-f5340b796dbb?source=api-prod","affected":[{"type":"plugin","slug":"multi-rating","name":"Multi Rating","from":"*","from_inclusive":true,"to":"5.0.6","to_inclusive":true,"patched_in":""}],"published":"2023-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3d08ac9-22f7-45f4-9896-05b90f5fce64","source":"wordfence","cve":"CVE-2024-8121","title":"The Ultimate WordPress Toolkit \u2013 WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d08ac9-22f7-45f4-9896-05b90f5fce64?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2024-09-03T00:00:00Z","updated":"2024-09-04T06:49:07Z"},{"id":"wordfence:f3d243fe-062c-4f46-aa85-cb7662a7615a","source":"wordfence","cve":"CVE-2025-57985","title":"Ultimate Watermark <= 1.1 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d243fe-062c-4f46-aa85-cb7662a7615a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-watermark","name":"Ultimate Watermark \u2013 Image Watermark, Image Protection & Bulk Watermarking","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-08T20:58:40Z"},{"id":"wordfence:f3d4283e-ea57-41e1-baeb-f8f70cad3020","source":"wordfence","cve":"CVE-2024-32711","title":"myCred \u2013 Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d4283e-ea57-41e1-baeb-f8f70cad3020?source=api-prod","affected":[{"type":"plugin","slug":"mycred","name":"Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \u2013 myCred","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T15:45:11Z"},{"id":"wordfence:f3d52baf-0f2b-4791-96ce-ec57502ed646","source":"wordfence","cve":"CVE-2022-1915","title":"WP Zillow Review Slider <= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d52baf-0f2b-4791-96ce-ec57502ed646?source=api-prod","affected":[{"type":"plugin","slug":"wp-zillow-review-slider","name":"WP Zillow Review Slider","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2022-05-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3d535b3-ad52-4322-988e-7d560dbfe3a3","source":"wordfence","cve":"CVE-2024-13363","title":"Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d535b3-ad52-4322-988e-7d560dbfe3a3?source=api-prod","affected":[{"type":"plugin","slug":"adthrive-ads","name":"Raptive Ads","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-02-18T19:34:50Z","updated":"2025-03-13T19:51:30Z"},{"id":"wordfence:f3d597c3-fec9-4dda-a539-0df1d9358a15","source":"wordfence","cve":"CVE-2026-85530","title":"GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d597c3-fec9-4dda-a539-0df1d9358a15?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.8.0","to_inclusive":true,"patched_in":"4.16.8.1"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T18:56:01Z"},{"id":"wordfence:f3d5bc99-2b55-4e19-8304-e56f3d4a2f1a","source":"wordfence","cve":"","title":"Ecwid Ecommerce Shopping Cart <= 6.12.3 - Missing Authorization on multiple functions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d5bc99-2b55-4e19-8304-e56f3d4a2f1a?source=api-prod","affected":[{"type":"plugin","slug":"ecwid-shopping-cart","name":"Ecwid by Lightspeed Ecommerce Shopping Cart","from":"*","from_inclusive":true,"to":"6.12.3","to_inclusive":true,"patched_in":"6.12.4"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3d990ef-5fa8-455d-b35a-2bff82facd45","source":"wordfence","cve":"CVE-2024-6223","title":"Send email only on Reply to My Comment <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d990ef-5fa8-455d-b35a-2bff82facd45?source=api-prod","affected":[{"type":"plugin","slug":"send-email-only-on-reply-to-my-comment","name":"Send email only on Reply to My Comment","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-09T19:13:08Z"},{"id":"wordfence:f3d99504-640c-490b-9b0c-7b6a140874a6","source":"wordfence","cve":"CVE-2025-15708","title":"Live Composer <= 2.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d99504-640c-490b-9b0c-7b6a140874a6?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.22","to_inclusive":true,"patched_in":"2.1.23"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-11T12:31:15Z"},{"id":"wordfence:f3dac7b6-512d-4fd6-8294-f0b1c0a2efd7","source":"wordfence","cve":"CVE-2022-4115","title":"Editorial Calendar <= 3.8.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via edcal_saveoptions AJAX action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3dac7b6-512d-4fd6-8294-f0b1c0a2efd7?source=api-prod","affected":[{"type":"plugin","slug":"editorial-calendar","name":"Editorial Calendar","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2023-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3db30b6-e361-4504-978b-d04e4bf67979","source":"wordfence","cve":"CVE-2026-22372","title":"Isida <= 1.4.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3db30b6-e361-4504-978b-d04e4bf67979?source=api-prod","affected":[{"type":"theme","slug":"isida","name":"Isida - Plastic Surgery Clinic Medical WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:30:02Z"},{"id":"wordfence:f3db71e8-1a0c-47d8-babd-a84a25a8b467","source":"wordfence","cve":"CVE-2025-7957","title":"ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3db71e8-1a0c-47d8-babd-a84a25a8b467?source=api-prod","affected":[{"type":"plugin","slug":"shortcodehub","name":"ShortcodeHub \u2013 MultiPurpose Shortcode Builder","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T15:48:16Z","updated":"2025-08-23T04:25:49Z"},{"id":"wordfence:f3e093b3-328a-4053-965a-9de627224b99","source":"wordfence","cve":"","title":"WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Clickjacking via Interactivity API Object Bindings","severity":"low","cvss":3.5,"cwe":"CWE-1021","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e093b3-328a-4053-965a-9de627224b99?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"6.6.0","from_inclusive":true,"to":"6.6.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.7.0","from_inclusive":true,"to":"6.7.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.8.0","from_inclusive":true,"to":"6.8.11","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.9.0","from_inclusive":true,"to":"6.9.10","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.0.0","from_inclusive":true,"to":"7.0.7","to_inclusive":true,"patched_in":"6.6.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"7.1.0","from_inclusive":true,"to":"7.1.3","to_inclusive":true,"patched_in":"6.6.11"}],"published":"2026-10-29T00:00:00Z","updated":"2026-10-29T17:26:25Z"},{"id":"wordfence:f3e1851a-9545-4687-b58b-5cdad3291525","source":"wordfence","cve":"CVE-2022-47181","title":"Email Templates <= 1.4.2 - Cross-Site Request Forgery via send_test_email","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e1851a-9545-4687-b58b-5cdad3291525?source=api-prod","affected":[{"type":"plugin","slug":"email-templates","name":"Email Templates Customizer and Designer for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3e19202-65f3-4b55-ae41-a30002a84e55","source":"wordfence","cve":"CVE-2026-4512","title":"reCaptcha by WebDesignBy < 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e19202-65f3-4b55-ae41-a30002a84e55?source=api-prod","affected":[{"type":"plugin","slug":"webdesignby-recaptcha","name":"reCaptcha by WebDesignBy","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2026-04-24T00:00:00Z","updated":"2026-04-30T14:36:33Z"},{"id":"wordfence:f3e1d66d-34cf-491c-8a07-0f9efd3c9669","source":"wordfence","cve":"CVE-2023-0526","title":"Post Shortcode <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e1d66d-34cf-491c-8a07-0f9efd3c9669?source=api-prod","affected":[{"type":"plugin","slug":"post-shortcode","name":"Post Shortcode","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":""}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3e2ddde-1421-4352-b93a-1492574f624e","source":"wordfence","cve":"CVE-2024-4086","title":"CM Tooltip Glossary \u2013 Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e2ddde-1421-4352-b93a-1492574f624e?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-tooltipglossary","name":"CM Tooltip Glossary","from":"*","from_inclusive":true,"to":"4.2.11","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-02T16:52:51Z"},{"id":"wordfence:f3e4118a-e860-4378-9fa0-9f49d7012cc8","source":"wordfence","cve":"CVE-2024-51597","title":"ThemeShark Templates & Widgets for Elementor <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e4118a-e860-4378-9fa0-9f49d7012cc8?source=api-prod","affected":[{"type":"plugin","slug":"themeshark-elementor","name":"ThemeShark Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.1.7","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:18:44Z"},{"id":"wordfence:f3e618cf-dd77-45a7-ab57-5732fd329883","source":"wordfence","cve":"CVE-2025-13851","title":"Buyent Theme (with Buyent Classified Plugin) <= 1.0.7 - Unauthenticated Privilege Escalation via User Registration","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e618cf-dd77-45a7-ab57-5732fd329883?source=api-prod","affected":[{"type":"theme","slug":"buyent","name":"Buyent","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2026-02-18T15:39:26Z","updated":"2026-02-19T04:36:27Z"},{"id":"wordfence:f3e74fb9-edb5-4602-9aac-375701a82f84","source":"wordfence","cve":"","title":"Better WP Security <= 3.6.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e74fb9-edb5-4602-9aac-375701a82f84?source=api-prod","affected":[{"type":"plugin","slug":"better-wp-security","name":"Kadence Security \u2013 Password, Two Factor Authentication, and Brute Force Protection","from":"*","from_inclusive":true,"to":"3.6.3","to_inclusive":true,"patched_in":"3.6.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3e7f2b8-2c42-4bcb-97d6-8d105740a85f","source":"wordfence","cve":"CVE-2026-54803","title":"SMS Alert \u2013 SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e7f2b8-2c42-4bcb-97d6-8d105740a85f?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":"3.9.5"}],"published":"2026-06-16T00:00:00Z","updated":"2026-08-21T13:12:50Z"},{"id":"wordfence:f3e94710-66c5-4b96-a32b-525760ee4570","source":"wordfence","cve":"CVE-2025-49262","title":"Sina Extension for Elementor <= 3.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e94710-66c5-4b96-a32b-525760ee4570?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.0"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:19:42Z"},{"id":"wordfence:f3e94ba2-ffdd-42ac-86bf-48670f2087e5","source":"wordfence","cve":"CVE-2025-32285","title":"Butcher < 2.54 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3e94ba2-ffdd-42ac-86bf-48670f2087e5?source=api-prod","affected":[{"type":"theme","slug":"butcher","name":"Butcher - Meat Shop WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.54","to_inclusive":false,"patched_in":"2.54"}],"published":"2025-05-22T00:00:00Z","updated":"2026-02-25T13:24:15Z"},{"id":"wordfence:f3eb1cb5-71ca-44c5-9434-e86301543357","source":"wordfence","cve":"CVE-2021-24741","title":"Support Board <= 3.3.3 - Multiple Unauthenticated SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3eb1cb5-71ca-44c5-9434-e86301543357?source=api-prod","affected":[{"type":"plugin","slug":"supportboard","name":"Support Board","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2021-09-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3ebaf25-1bd3-4770-b4bd-30de83b31add","source":"wordfence","cve":"","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection","severity":"medium","cvss":5.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ebaf25-1bd3-4770-b4bd-30de83b31add?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.0.31","to_inclusive":true,"patched_in":"3.0.32"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3ebbf7f-61f2-403f-8131-8cedeb13c2d4","source":"wordfence","cve":"","title":"Mail logging - WP Mail Catcher <= 2.1.3 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ebbf7f-61f2-403f-8131-8cedeb13c2d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-mail-catcher","name":"Mail logging & Catcher","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3eec9c6-fef9-4d6e-8328-51efb997c99c","source":"wordfence","cve":"CVE-2026-4330","title":"Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3eec9c6-fef9-4d6e-8328-51efb997c99c?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"8.8.3","to_inclusive":true,"patched_in":"8.8.4"}],"published":"2026-04-07T19:13:42Z","updated":"2026-04-08T07:43:04Z"},{"id":"wordfence:f3ef0c46-5765-458e-80c0-ecfc6ead6df6","source":"wordfence","cve":"CVE-2023-23832","title":"Ultimate WP Query Search Filter <= 1.0.10 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ef0c46-5765-458e-80c0-ecfc6ead6df6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-query-search-filter","name":"Ultimate WP Query Search Filter","from":"*","from_inclusive":true,"to":"1.0.10","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3efd8d5-fa85-4910-8552-f38e92d7515e","source":"wordfence","cve":"CVE-2025-30599","title":"WP Parallax Content Slider <= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3efd8d5-fa85-4910-8552-f38e92d7515e?source=api-prod","affected":[{"type":"plugin","slug":"wp-parallax-content-slider","name":"WP Parallax Content Slider","from":"*","from_inclusive":true,"to":"0.9.8","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:48:06Z"},{"id":"wordfence:f3f01b88-6f93-4ee8-8d59-9165ebcd4dd1","source":"wordfence","cve":"CVE-2025-7722","title":"Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-272","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f01b88-6f93-4ee8-8d59-9165ebcd4dd1?source=api-prod","affected":[{"type":"plugin","slug":"social-streams","name":"Social Streams","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-07-22T14:03:46Z","updated":"2025-07-23T02:24:40Z"},{"id":"wordfence:f3f1e629-fe60-4793-b9f1-c02a7a2542aa","source":"wordfence","cve":"CVE-2026-19725","title":"WPvivid \u2014 Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f1e629-fe60-4793-b9f1-c02a7a2542aa?source=api-prod","affected":[{"type":"plugin","slug":"wpvivid-backuprestore","name":"WPvivid \u2014 Backup, Migration & Staging","from":"*","from_inclusive":true,"to":"0.9.131","to_inclusive":false,"patched_in":"0.9.131"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:04:31Z"},{"id":"wordfence:f3f2ecdb-bbd0-4834-b731-88724ca0dfd7","source":"wordfence","cve":"CVE-2026-100186","title":"User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2026-10-15T16:37:17Z","updated":"2026-10-16T05:30:29Z"},{"id":"wordfence:f3f3c30c-65c9-4838-97c4-3bc4eefc8e52","source":"wordfence","cve":"CVE-2026-110691","title":"WPOrLogin \u2013 Custom Login, Social Login, CAPTCHA & Security < 3.1.0 - Unauthenticated Login URL Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f3c30c-65c9-4838-97c4-3bc4eefc8e52?source=api-prod","affected":[{"type":"plugin","slug":"wporlogin","name":"WPOrLogin \u2013 Custom Login, Social Login, CAPTCHA & Security","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T19:24:26Z"},{"id":"wordfence:f3f6410c-df2e-488d-b481-88f52c5139f1","source":"wordfence","cve":"CVE-2026-105071","title":"SiteVault \u2013 Backup, Restore, Migration & Cloning <= 1.5.17 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f6410c-df2e-488d-b481-88f52c5139f1?source=api-prod","affected":[{"type":"plugin","slug":"sitevault-backup-restore-migration","name":"SiteVault \u2013 Backup, Restore, Migration & Cloning","from":"*","from_inclusive":true,"to":"1.5.17","to_inclusive":true,"patched_in":"1.5.18"}],"published":"2026-10-05T10:05:31Z","updated":"2026-10-08T23:15:37Z"},{"id":"wordfence:f3f821d6-6a4e-4e3b-98e1-e38a34d5c8f9","source":"wordfence","cve":"CVE-2022-1422","title":"Discy <= 5.1 - Cross-Site Request Forgery to Settings Reset","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f821d6-6a4e-4e3b-98e1-e38a34d5c8f9?source=api-prod","affected":[{"type":"theme","slug":"discy","name":"Discy - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":false,"patched_in":"5.2"}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3fae909-5564-4e0a-9114-edd0e45865e5","source":"wordfence","cve":"CVE-2024-1090","title":"ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fae909-5564-4e0a-9114-edd0e45865e5?source=api-prod","affected":[{"type":"plugin","slug":"imagerecycle-pdf-image-compression","name":"ImageRecycle pdf & image compression","from":"*","from_inclusive":true,"to":"3.1.13","to_inclusive":true,"patched_in":"3.1.14"}],"published":"2024-02-07T00:00:00Z","updated":"2024-07-29T22:56:21Z"},{"id":"wordfence:f3fc1686-06a0-4d48-bb79-470e63cd3600","source":"wordfence","cve":"CVE-2016-10984","title":"Echo Sign < 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fc1686-06a0-4d48-bb79-470e63cd3600?source=api-prod","affected":[{"type":"plugin","slug":"echosign","name":"Echo Sign","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3fc6230-043f-4079-a82a-1b5d191dbf7d","source":"wordfence","cve":"CVE-2025-7690","title":"Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fc6230-043f-4079-a82a-1b5d191dbf7d?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-plus","name":"Affiliate Plus","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:43:37Z","updated":"2025-07-24T09:22:22Z"},{"id":"wordfence:f3fc921f-14f2-429a-894e-953522e59747","source":"wordfence","cve":"CVE-2026-40781","title":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fc921f-14f2-429a-894e-953522e59747?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2026-04-22T00:00:00Z","updated":"2026-04-30T15:14:41Z"},{"id":"wordfence:f3fddcb8-b56f-4d5d-8843-fb78064e9cbb","source":"wordfence","cve":"CVE-2025-69299","title":"Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fddcb8-b56f-4d5d-8843-fb78064e9cbb?source=api-prod","affected":[{"type":"theme","slug":"oxygen","name":"Oxygen - WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"6.0.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-04-24T14:20:56Z"},{"id":"wordfence:f3fe07df-3589-4767-a81d-a6b72c5ab1a8","source":"wordfence","cve":"CVE-2022-47615","title":"LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fe07df-3589-4767-a81d-a6b72c5ab1a8?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.7.3.2","to_inclusive":true,"patched_in":"4.2.0"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f3fe8f5c-1eee-4a54-b4be-4c68d864e599","source":"wordfence","cve":"CVE-2026-97237","title":"JetEngine <= 3.8.14.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fe8f5c-1eee-4a54-b4be-4c68d864e599?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.14.3","to_inclusive":true,"patched_in":"3.8.15"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:22Z"},{"id":"wordfence:f3ff1bb7-bb90-45a9-8ed1-1497aed14b4d","source":"wordfence","cve":"CVE-2026-62029","title":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ff1bb7-bb90-45a9-8ed1-1497aed14b4d?source=api-prod","affected":[{"type":"plugin","slug":"wpfunnels","name":"WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell","from":"*","from_inclusive":true,"to":"3.13.5","to_inclusive":true,"patched_in":"3.13.6"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-28T21:19:32Z"},{"id":"wordfence:f3ff44f2-c3c2-46f5-b984-6151202f722f","source":"wordfence","cve":"CVE-2025-25090","title":"Dreamstime Stock Photos <= 4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ff44f2-c3c2-46f5-b984-6151202f722f?source=api-prod","affected":[{"type":"plugin","slug":"dreamstime-stock-photos","name":"Dreamstime Stock Photos","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.2"}],"published":"2025-02-02T00:00:00Z","updated":"2025-03-28T18:35:42Z"},{"id":"wordfence:f3ff473c-c629-487c-9b18-e074534c7b79","source":"wordfence","cve":"CVE-2020-28033","title":"WordPress Core < 5.5.2 - Spam Embed on Multisite Installations","severity":"medium","cvss":4.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ff473c-c629-487c-9b18-e074534c7b79?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4026b41-29c3-4e0a-bf75-ae4ba47edb4f","source":"wordfence","cve":"CVE-2025-7959","title":"Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4026b41-29c3-4e0a-bf75-ae4ba47edb4f?source=api-prod","affected":[{"type":"plugin","slug":"station-pro","name":"Station Pro \u2013 Advanced Audio Streaming & Player for WordPress","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-23T20:39:58Z","updated":"2025-07-24T09:22:22Z"},{"id":"wordfence:f4041795-8131-459f-9156-5ecf5d6086f6","source":"wordfence","cve":"CVE-2026-109975","title":"Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4041795-8131-459f-9156-5ecf5d6086f6?source=api-prod","affected":[{"type":"plugin","slug":"cozy-addons","name":"Cozy Blocks \u2013 Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox","from":"*","from_inclusive":true,"to":"2.2.27","to_inclusive":true,"patched_in":"2.2.28"}],"published":"2026-10-27T17:53:18Z","updated":"2026-10-28T06:45:22Z"},{"id":"wordfence:f4050403-6b8c-4023-b170-39f3cb68583e","source":"wordfence","cve":"CVE-2023-6957","title":"Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.9,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4050403-6b8c-4023-b170-39f3cb68583e?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"5.1.9","to_inclusive":true,"patched_in":"5.1.10"}],"published":"2024-03-05T00:00:00Z","updated":"2024-07-29T21:37:48Z"},{"id":"wordfence:f407140c-e0ad-476e-a04d-ff084c88bdb1","source":"wordfence","cve":"CVE-2026-16546","title":"Wired Impact Volunteer Management <= 2.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f407140c-e0ad-476e-a04d-ff084c88bdb1?source=api-prod","affected":[{"type":"plugin","slug":"wired-impact-volunteer-management","name":"Wired Impact Volunteer Management","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"2.8.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-15T21:28:11Z"},{"id":"wordfence:f4083d48-a1a8-4ab7-a67f-308bbbbcb4d5","source":"wordfence","cve":"CVE-2024-31943","title":"USPS Shipping for WooCommerce \u2013 Live Rates <= 1.9.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4083d48-a1a8-4ab7-a67f-308bbbbcb4d5?source=api-prod","affected":[{"type":"plugin","slug":"flexible-shipping-usps","name":"Shipping Live Rates for USPS for WooCommerce","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:41:58Z"},{"id":"wordfence:f40956e0-6e5c-4965-84f8-2420ad14a299","source":"wordfence","cve":"CVE-2024-1413","title":"Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40956e0-6e5c-4965-84f8-2420ad14a299?source=api-prod","affected":[{"type":"plugin","slug":"exclusive-addons-for-elementor","name":"Exclusive Addons for Elementor","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.6.9.1"}],"published":"2024-02-29T00:00:00Z","updated":"2024-03-13T15:27:25Z"},{"id":"wordfence:f40a1dd8-af66-4b97-af5b-0954dd6316a8","source":"wordfence","cve":"CVE-2024-51933","title":"Cookie Nonsense for YT <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40a1dd8-af66-4b97-af5b-0954dd6316a8?source=api-prod","affected":[{"type":"plugin","slug":"yt-cookie-nonsense","name":"Cookie Nonsense for YT","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:24:41Z"},{"id":"wordfence:f40c1c43-5e64-4b11-9fef-52501504bfe9","source":"wordfence","cve":"CVE-2025-58210","title":"Makeaholic <= 1.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40c1c43-5e64-4b11-9fef-52501504bfe9?source=api-prod","affected":[{"type":"theme","slug":"makeaholic","name":"Makeaholic - Beauty Cosmetics WordPress Theme","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T17:30:46Z"},{"id":"wordfence:f40c6e22-ef6c-4a5f-85df-97fd36c57f82","source":"wordfence","cve":"CVE-2025-23707","title":"En Masse <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40c6e22-ef6c-4a5f-85df-97fd36c57f82?source=api-prod","affected":[{"type":"plugin","slug":"en-masse-wp","name":"En Masse WordPress","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:06:45Z"},{"id":"wordfence:f40cc632-c6af-4c8b-a455-76319f7fe151","source":"wordfence","cve":"CVE-2025-13922","title":"Tag, Category, and Taxonomy Manager \u2013 AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40cc632-c6af-4c8b-a455-76319f7fe151?source=api-prod","affected":[{"type":"plugin","slug":"simple-tags","name":"PublishPress Taxonomies \u2013 Tag, Category, and Taxonomy Manager \u2013 Autotagger Automatically Add Terms","from":"*","from_inclusive":true,"to":"3.40.1","to_inclusive":true,"patched_in":"3.41.0"}],"published":"2025-12-05T16:26:37Z","updated":"2026-02-04T20:02:37Z"},{"id":"wordfence:f40dd50f-fa64-4901-990c-42e9db53c081","source":"wordfence","cve":"CVE-2025-46526","title":"My Custom Widgets <= 2.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40dd50f-fa64-4901-990c-42e9db53c081?source=api-prod","affected":[{"type":"plugin","slug":"mycustomwidget","name":"My Custom Widgets","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-30T22:04:01Z"},{"id":"wordfence:f40dde67-b6af-4a57-a067-09adcbb981ac","source":"wordfence","cve":"CVE-2025-23535","title":"REAL WordPress Sidebar <= 0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40dde67-b6af-4a57-a067-09adcbb981ac?source=api-prod","affected":[{"type":"plugin","slug":"drag-and-drop-custom-sidebar","name":"REAL WordPress Sidebar","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T16:25:04Z"},{"id":"wordfence:f40e7f8a-8bca-4a87-887c-8e11b1da46a1","source":"wordfence","cve":"CVE-2024-33692","title":"Smart Recent Posts Widget <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f40e7f8a-8bca-4a87-887c-8e11b1da46a1?source=api-prod","affected":[{"type":"plugin","slug":"smart-recent-posts-widget","name":"Smart Recent Posts Widget","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-04-26T00:00:00Z","updated":"2024-07-31T20:44:55Z"},{"id":"wordfence:f412025b-42c3-4a65-a49b-d6dee4b73eff","source":"wordfence","cve":"CVE-2024-53713","title":"Silverlight Video Player <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f412025b-42c3-4a65-a49b-d6dee4b73eff?source=api-prod","affected":[{"type":"plugin","slug":"smooth-streaming-player","name":"Silverlight Video Player","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T19:26:28Z"},{"id":"wordfence:f412bdb0-953d-4375-85c2-b87f3aa77d60","source":"wordfence","cve":"CVE-2023-40068","title":"Advanced Custom Fields 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f412bdb0-953d-4375-85c2-b87f3aa77d60?source=api-prod","affected":[{"type":"plugin","slug":"advanced-custom-fields","name":"Advanced Custom Fields (ACF\u00ae)","from":"6.1","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2023-08-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f413b610-839a-4a93-aec5-b6566371ccb7","source":"wordfence","cve":"CVE-2026-18983","title":"One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f413b610-839a-4a93-aec5-b6566371ccb7?source=api-prod","affected":[{"type":"plugin","slug":"one-user-avatar","name":"One User Avatar | User Profile Picture","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2026-08-27T15:22:38Z","updated":"2026-08-28T03:39:36Z"},{"id":"wordfence:f4143849-1cd1-4241-acf6-a34aaf7d369c","source":"wordfence","cve":"CVE-2020-15535","title":"Car Rental System <= 1.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4143849-1cd1-4241-acf6-a34aaf7d369c?source=api-prod","affected":[{"type":"plugin","slug":"car","name":"Car Rental System","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2020-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f416f1a8-0299-4e7f-9282-4edb958e7ae3","source":"wordfence","cve":"CVE-2026-66461","title":"SMEPay: UPI Gateway for WooCommerce <= 1.0.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f416f1a8-0299-4e7f-9282-4edb958e7ae3?source=api-prod","affected":[{"type":"plugin","slug":"smepay-for-woocommerce","name":"SMEPay: UPI Gateway for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-07T00:00:00Z","updated":"2026-08-13T18:53:18Z"},{"id":"wordfence:f4198c51-4a26-4a50-b2c5-0467f8008b5b","source":"wordfence","cve":"CVE-2022-0874","title":"WP Social Buttons <= 2.1 - Admin+ Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4198c51-4a26-4a50-b2c5-0467f8008b5b?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-buttons","name":"WP Social Buttons","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2022-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f419b83c-9253-4ca6-a02a-7daad1819581","source":"wordfence","cve":"CVE-2012-2402","title":"WordPress Core < 3.3.2 - Authorization Bypass","severity":"medium","cvss":5.4,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f419b83c-9253-4ca6-a02a-7daad1819581?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.3.1","to_inclusive":true,"patched_in":"3.3.2"}],"published":"2012-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f419d14a-90d1-445a-b629-c2e978c3ab81","source":"wordfence","cve":"CVE-2024-9074","title":"Advanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f419d14a-90d1-445a-b629-c2e978c3ab81?source=api-prod","affected":[{"type":"plugin","slug":"advanced-blocks-pro","name":"Advanced Blocks Pro","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-09T13:27:58Z","updated":"2024-10-10T02:06:13Z"},{"id":"wordfence:f419eceb-a3e7-4cf7-a37e-dcc57a26d7f5","source":"wordfence","cve":"CVE-2026-65515","title":"AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f419eceb-a3e7-4cf7-a37e-dcc57a26d7f5?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-wp","name":"AffiliateWP","from":"*","from_inclusive":true,"to":"2.35.0","to_inclusive":true,"patched_in":"2.35.1"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-07T18:43:41Z"},{"id":"wordfence:f41a3141-e232-40f2-b800-e089a19c52fa","source":"wordfence","cve":"CVE-2023-25999","title":"BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f41a3141-e232-40f2-b800-e089a19c52fa?source=api-prod","affected":[{"type":"theme","slug":"bodycenter","name":"BodyCenter - Gym, Fitness WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-09T00:00:00Z","updated":"2025-06-18T13:46:44Z"},{"id":"wordfence:f41b8d18-4a20-4b99-b375-3fafb41030ee","source":"wordfence","cve":"CVE-2024-3282","title":"WP Table Builder <= 1.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f41b8d18-4a20-4b99-b375-3fafb41030ee?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":"1.5.1"}],"published":"2024-08-02T00:00:00Z","updated":"2024-08-28T22:56:45Z"},{"id":"wordfence:f41d71a5-b603-40d4-b250-56db0f298778","source":"wordfence","cve":"CVE-2026-22338","title":"EcoBlue <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f41d71a5-b603-40d4-b250-56db0f298778?source=api-prod","affected":[{"type":"theme","slug":"ecoblue","name":"EcoBlue","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T18:57:08Z"},{"id":"wordfence:f41eecf8-dad9-4f98-91f5-c6ac472b8810","source":"wordfence","cve":"CVE-2015-9334","title":"Email Newsletter <= 20.15 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f41eecf8-dad9-4f98-91f5-c6ac472b8810?source=api-prod","affected":[{"type":"plugin","slug":"email-newsletter","name":"Email Newsletter","from":"*","from_inclusive":true,"to":"20.15","to_inclusive":true,"patched_in":""}],"published":"2015-06-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f420151b-c783-49b1-b0e9-e936a904278a","source":"wordfence","cve":"CVE-2025-15565","title":"Nexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f420151b-c783-49b1-b0e9-e936a904278a?source=api-prod","affected":[{"type":"plugin","slug":"cartasi-x-pay","name":"Nexi XPay","from":"*","from_inclusive":true,"to":"8.3.0","to_inclusive":true,"patched_in":"8.3.2"}],"published":"2026-04-14T09:14:14Z","updated":"2026-04-14T21:26:40Z"},{"id":"wordfence:f4211712-26b2-4f59-82b8-928e405cd08d","source":"wordfence","cve":"CVE-2015-9270","title":"The Holiday Calendar < 1.11.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4211712-26b2-4f59-82b8-928e405cd08d?source=api-prod","affected":[{"type":"plugin","slug":"the-holiday-calendar","name":"The Holiday Calendar","from":"*","from_inclusive":true,"to":"1.11.3","to_inclusive":false,"patched_in":"1.11.3"}],"published":"2015-07-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4213452-33f7-46d4-ab4a-544a9bef475a","source":"wordfence","cve":"CVE-2026-57712","title":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin <= 1.4.29 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4213452-33f7-46d4-ab4a-544a9bef475a?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-portfolio","name":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.4.29","to_inclusive":true,"patched_in":"1.4.30"}],"published":"2026-07-10T00:00:00Z","updated":"2026-07-14T19:17:40Z"},{"id":"wordfence:f4230c76-8a6e-45e5-9d18-e9e9456630c2","source":"wordfence","cve":"CVE-2025-58882","title":"Simple Text Slider <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4230c76-8a6e-45e5-9d18-e9e9456630c2?source=api-prod","affected":[{"type":"plugin","slug":"simple-text-slider","name":"Simple Text Slider","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T20:44:30Z"},{"id":"wordfence:f4232656-2e97-4888-8dde-14039d8c2f9d","source":"wordfence","cve":"CVE-2024-9667","title":"Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4232656-2e97-4888-8dde-14039d8c2f9d?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.5.0","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2024-11-04T19:53:10Z","updated":"2024-11-05T08:31:38Z"},{"id":"wordfence:f424b35d-fdd7-49d2-bf47-04b81888996a","source":"wordfence","cve":"CVE-2024-11718","title":"tarteaucitron.js for WordPress < 0.3.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f424b35d-fdd7-49d2-bf47-04b81888996a?source=api-prod","affected":[{"type":"plugin","slug":"tarteaucitron-wp","name":"tarteaucitron.js for WordPress","from":"*","from_inclusive":true,"to":"0.3.0","to_inclusive":false,"patched_in":"0.3.0"}],"published":"2025-03-03T00:00:00Z","updated":"2026-02-25T19:05:54Z"},{"id":"wordfence:f4250328-6d6c-4eb1-9ef2-334774c1d337","source":"wordfence","cve":"CVE-2026-120538","title":"Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4250328-6d6c-4eb1-9ef2-334774c1d337?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2026-10-30T15:10:12Z","updated":"2026-11-03T04:43:11Z"},{"id":"wordfence:f426c32e-a376-4447-b83f-409a8eb0c499","source":"wordfence","cve":"CVE-2023-45633","title":"IMPress Listings <= 2.6.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f426c32e-a376-4447-b83f-409a8eb0c499?source=api-prod","affected":[{"type":"plugin","slug":"wp-listings","name":"IMPress Listings","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f428b90d-8830-445d-b1f1-d8f860dae5cf","source":"wordfence","cve":"CVE-2026-1088","title":"Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f428b90d-8830-445d-b1f1-d8f860dae5cf?source=api-prod","affected":[{"type":"plugin","slug":"login-page-editor","name":"Login Page Editor","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-01-23T19:25:14Z","updated":"2026-01-24T07:26:48Z"},{"id":"wordfence:f42c6462-9206-460c-94c0-859306886c88","source":"wordfence","cve":"CVE-2025-23954","title":"Salvador \u2013 AI Image Generator <= 1.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f42c6462-9206-460c-94c0-859306886c88?source=api-prod","affected":[{"type":"plugin","slug":"salvador-ai-image-generator","name":"Salvador \u2013 AI Image Generator","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:19:13Z"},{"id":"wordfence:f42dc6ab-4035-4e9e-b956-40395c7e309f","source":"wordfence","cve":"CVE-2013-3250","title":"WP Maintenance Mode <= 1.8.7 - Missing Authorization Checks & Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f42dc6ab-4035-4e9e-b956-40395c7e309f?source=api-prod","affected":[{"type":"plugin","slug":"wp-maintenance-mode","name":"LightStart \u2013 Maintenance Mode, Coming Soon and Landing Page Builder","from":"*","from_inclusive":true,"to":"1.8.8","to_inclusive":false,"patched_in":"1.8.8"}],"published":"2013-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f42f8a3c-4940-4ff0-be9c-3cabf766c02f","source":"wordfence","cve":"CVE-2026-97246","title":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f42f8a3c-4940-4ff0-be9c-3cabf766c02f?source=api-prod","affected":[{"type":"plugin","slug":"shortpixel-image-optimiser","name":"ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF","from":"*","from_inclusive":true,"to":"6.5.5","to_inclusive":true,"patched_in":"6.5.6"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:53:45Z"},{"id":"wordfence:f430835a-135f-4a09-b9c6-42c7b484cbee","source":"wordfence","cve":"CVE-2025-22581","title":"Arcade Ready <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f430835a-135f-4a09-b9c6-42c7b484cbee?source=api-prod","affected":[{"type":"plugin","slug":"arcadeready","name":"Arcade Ready","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:29:29Z"},{"id":"wordfence:f43129ea-cef9-48da-885f-0be9207b8335","source":"wordfence","cve":"CVE-2026-62082","title":"Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission <= 7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43129ea-cef9-48da-885f-0be9207b8335?source=api-prod","affected":[{"type":"theme","slug":"pin-wp","name":"Pin = Pinterest Style / Personal Masonry Blog / Front-end Submission","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T17:37:48Z","updated":"2026-10-13T14:01:30Z"},{"id":"wordfence:f431ce10-dfb2-4dc5-9865-3f29cdcba156","source":"wordfence","cve":"CVE-2024-51608","title":"AmaDiscount <= 1.0 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f431ce10-dfb2-4dc5-9865-3f29cdcba156?source=api-prod","affected":[{"type":"plugin","slug":"amadiscount","name":"AmaDiscount Plugin","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T20:33:26Z"},{"id":"wordfence:f432f32c-9ebb-4444-baf0-d523b1ceba02","source":"wordfence","cve":"CVE-2026-61953","title":"Simple Link Directory Pro <= 15.0.6 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f432f32c-9ebb-4444-baf0-d523b1ceba02?source=api-prod","affected":[{"type":"plugin","slug":"simple-link-directory-pro","name":"Simple Link Directory Pro - AI Powered","from":"*","from_inclusive":true,"to":"15.0.6","to_inclusive":true,"patched_in":"15.0.7"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-30T12:31:24Z"},{"id":"wordfence:f433c05f-d541-4e80-a99f-4f417a2738a6","source":"wordfence","cve":"CVE-2026-39505","title":"Seriously Simple Podcasting <= 3.14.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f433c05f-d541-4e80-a99f-4f417a2738a6?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-podcasting","name":"Seriously Simple Podcasting","from":"*","from_inclusive":true,"to":"3.14.2","to_inclusive":true,"patched_in":"3.14.3"}],"published":"2026-03-26T00:00:00Z","updated":"2026-04-15T21:11:47Z"},{"id":"wordfence:f433edb4-a8df-4548-a401-0089b605bbe5","source":"wordfence","cve":"CVE-2023-49745","title":"Spiffy Calendar <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f433edb4-a8df-4548-a401-0089b605bbe5?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"4.9.5","to_inclusive":true,"patched_in":"4.9.6"}],"published":"2023-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f434585c-8533-4788-b0bc-5650390c29a8","source":"wordfence","cve":"CVE-2023-2416","title":"Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8?source=api-prod","affected":[{"type":"plugin","slug":"meeting-scheduler-by-vcita","name":"Online Booking & Scheduling Calendar by vcita","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-06-02T00:00:00Z","updated":"2024-12-05T15:22:55Z"},{"id":"wordfence:f4366cf8-bf50-4d9f-9a85-2c2de7f7e90d","source":"wordfence","cve":"CVE-2024-25921","title":"Action Network <= 1.4.2 - Reflected Cross-Site Scripting via 'search'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4366cf8-bf50-4d9f-9a85-2c2de7f7e90d?source=api-prod","affected":[{"type":"plugin","slug":"wp-action-network","name":"Organizers Embed \u2013 Action Network for WordPress","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T16:13:46Z"},{"id":"wordfence:f436ab65-a59c-4b2a-abc8-a7fc038678dd","source":"wordfence","cve":"CVE-2024-0386","title":"weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f436ab65-a59c-4b2a-abc8-a7fc038678dd?source=api-prod","affected":[{"type":"plugin","slug":"weforms","name":"weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress","from":"*","from_inclusive":true,"to":"1.6.21","to_inclusive":true,"patched_in":"1.6.22"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:37:48Z"},{"id":"wordfence:f4393526-6357-40ee-a024-f461d0430a62","source":"wordfence","cve":"CVE-2007-0107","title":"WordPress Core <= 2.0.5 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4393526-6357-40ee-a024-f461d0430a62?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2007-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f439718e-4a3d-4dc9-a16c-6b655480dde6","source":"wordfence","cve":"CVE-2026-8867","title":"Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f439718e-4a3d-4dc9-a16c-6b655480dde6?source=api-prod","affected":[{"type":"plugin","slug":"post-category-gallery","name":"Post Categories Gallery","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:24:55Z","updated":"2026-05-27T05:31:34Z"},{"id":"wordfence:f43b5c02-fb10-48f1-9457-f67c5008fe5b","source":"wordfence","cve":"CVE-2023-49171","title":"Innovs HR <= 1.0.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43b5c02-fb10-48f1-9457-f67c5008fe5b?source=api-prod","affected":[{"type":"plugin","slug":"innovs-hr-manager","name":"Innovs HR \u2013 Complete Human Resource Management System for Your Business","from":"*","from_inclusive":true,"to":"1.0.3.6","to_inclusive":true,"patched_in":"1.0.3.7"}],"published":"2023-11-29T00:00:00Z","updated":"2026-09-16T17:27:44Z"},{"id":"wordfence:f43b996a-646d-4ebc-bb91-49f5c448deb0","source":"wordfence","cve":"CVE-2024-51850","title":"WoW Guild Armory Roster <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43b996a-646d-4ebc-bb91-49f5c448deb0?source=api-prod","affected":[{"type":"plugin","slug":"guild-armory-roster","name":"WoW Guild Armory Roster","from":"*","from_inclusive":true,"to":"0.5.5","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:31:11Z"},{"id":"wordfence:f43bef8a-0df5-43f8-a87d-5f482b14a3c6","source":"wordfence","cve":"CVE-2025-62132","title":"Tasty Recipes Lite <= 1.1.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43bef8a-0df5-43f8-a87d-5f482b14a3c6?source=api-prod","affected":[{"type":"plugin","slug":"tasty-recipes-lite","name":"Tasty Recipes Lite \u2013 WordPress Recipe Card Plugin with Built-In Recipe Schema","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":"1.1.6"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T16:34:30Z"},{"id":"wordfence:f43db496-80ea-442c-9417-7aa03ec95f02","source":"wordfence","cve":"CVE-2025-2056","title":"WP Ghost <= 5.4.01 - Unauthenticated Limited File Read","severity":"high","cvss":7.5,"cwe":"CWE-23","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43db496-80ea-442c-9417-7aa03ec95f02?source=api-prod","affected":[{"type":"plugin","slug":"hide-my-wp","name":"Hide My WP Ghost \u2013 Security & Firewall","from":"*","from_inclusive":true,"to":"5.4.01","to_inclusive":true,"patched_in":"5.4.02"}],"published":"2025-03-13T16:21:37Z","updated":"2025-03-14T04:22:35Z"},{"id":"wordfence:f43e1eed-09f8-44b3-b6fa-d0344f331dd7","source":"wordfence","cve":"CVE-2024-1498","title":"Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43e1eed-09f8-44b3-b6fa-d0344f331dd7?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.3","to_inclusive":true,"patched_in":"3.10.4"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:33Z"},{"id":"wordfence:f43f69f0-6995-4789-acf3-8019227effe1","source":"wordfence","cve":"CVE-2025-13006","title":"SurveyFunnel \u2013 Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f43f69f0-6995-4789-acf3-8019227effe1?source=api-prod","affected":[{"type":"plugin","slug":"surveyfunnel-lite","name":"SurveyFunnel \u2013 Survey Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-12-04T16:28:06Z","updated":"2025-12-05T04:29:12Z"},{"id":"wordfence:f440a5c5-2a48-4beb-849f-3f7cde5a8653","source":"wordfence","cve":"","title":"Gerencianet Oficial <= 1.4.8 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f440a5c5-2a48-4beb-849f-3f7cde5a8653?source=api-prod","affected":[{"type":"plugin","slug":"woo-gerencianet-official","name":"Ef\u00ed Bank","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2023-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f441477e-35b8-42ae-b71c-3fdba126021b","source":"wordfence","cve":"CVE-2026-14364","title":"TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f441477e-35b8-42ae-b71c-3fdba126021b?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-08-06T16:24:20Z","updated":"2026-08-07T04:25:56Z"},{"id":"wordfence:f4421782-8a7a-4bca-8c5a-7152dfafe902","source":"wordfence","cve":"CVE-2023-26527","title":"Debug Assistant <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4421782-8a7a-4bca-8c5a-7152dfafe902?source=api-prod","affected":[{"type":"plugin","slug":"debug-assistant","name":"Debug Assistant","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4425296-5519-4c90-9bdd-00be5811b3dd","source":"wordfence","cve":"CVE-2025-47575","title":"School Management <= 92.0.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4425296-5519-4c90-9bdd-00be5811b3dd?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-20T00:00:00Z","updated":"2025-05-29T16:42:57Z"},{"id":"wordfence:f443846f-4d70-4ca0-beeb-d2e839b14765","source":"wordfence","cve":"CVE-2026-2300","title":"BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f443846f-4d70-4ca0-beeb-d2e839b14765?source=api-prod","affected":[{"type":"plugin","slug":"bj-lazy-load","name":"BJ Lazy Load","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-11T19:10:13Z","updated":"2026-05-12T07:48:29Z"},{"id":"wordfence:f444568c-fe4c-4fa6-9b83-2d069f851360","source":"wordfence","cve":"CVE-2021-25086","title":"Advanced Page Visit Counter  <= 5.0.8 - Unauthenticated Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f444568c-fe4c-4fa6-9b83-2d069f851360?source=api-prod","affected":[{"type":"plugin","slug":"advanced-page-visit-counter","name":"Advanced Page Visit Counter \u2013  Most Wanted Analytics Plugin for WordPress","from":"*","from_inclusive":true,"to":"5.0.8","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2022-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f44483df-e50d-4dcf-8a6f-499e2bd05b89","source":"wordfence","cve":"CVE-2015-10147","title":"Easy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44483df-e50d-4dcf-8a6f-499e2bd05b89?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonial-rotator","name":"Easy Testimonial Slider and Form","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-10-28T00:00:00Z","updated":"2025-10-29T09:27:57Z"},{"id":"wordfence:f4454376-7c18-4f0e-a192-80212a59d94b","source":"wordfence","cve":"CVE-2023-0644","title":"Push Notifications for WordPress by PushAssist <= 3.0.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4454376-7c18-4f0e-a192-80212a59d94b?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-wp-by-pushassist","name":"Push Notifications for WordPress by PushAssist","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":""}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f445de97-b6fd-4180-b63e-5b8da40dae6a","source":"wordfence","cve":"CVE-2023-47527","title":"WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f445de97-b6fd-4180-b63e-5b8da40dae6a?source=api-prod","affected":[{"type":"plugin","slug":"wp-edit-username","name":"WP Edit Username","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2023-12-19T00:00:00Z","updated":"2024-09-23T17:26:17Z"},{"id":"wordfence:f4460f0a-9417-48bf-b6b3-27a80632dd71","source":"wordfence","cve":"CVE-2024-1956","title":"WPB Show Core <= 2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4460f0a-9417-48bf-b6b3-27a80632dd71?source=api-prod","affected":[{"type":"plugin","slug":"wpb-show-core","name":"WPB Show Core","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2024-03-18T00:00:00Z","updated":"2024-05-07T12:14:26Z"},{"id":"wordfence:f4494a0f-57fb-4ed7-8fdc-85b5dcee6549","source":"wordfence","cve":"CVE-2022-1020","title":"Product Table for WooCommerce <= 3.1.2 - Missing Authorization","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4494a0f-57fb-4ed7-8fdc-85b5dcee6549?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-table","name":"Product Table for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2022-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f44aaafc-bfc4-43a6-b6ab-77120d5b990b","source":"wordfence","cve":"CVE-2026-123656","title":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content < 4.17.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44aaafc-bfc4-43a6-b6ab-77120d5b990b?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.17.6","to_inclusive":false,"patched_in":"4.17.6"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:04:45Z"},{"id":"wordfence:f44b8e21-4bfd-487f-96f1-d264d335f54f","source":"wordfence","cve":"CVE-2023-32294","title":"GDPR Cookie Consent Notice Box <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44b8e21-4bfd-487f-96f1-d264d335f54f?source=api-prod","affected":[{"type":"plugin","slug":"cookie-consent-box","name":"GDPR Cookie Consent Notice Box","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2023-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f44b9e6d-2f84-45f6-9f74-3f23b03c5a49","source":"wordfence","cve":"CVE-2023-35039","title":"Password Reset with Code for WordPress REST API <= 0.0.15 - Weak Password Recovery Mechanism","severity":"critical","cvss":9.8,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44b9e6d-2f84-45f6-9f74-3f23b03c5a49?source=api-prod","affected":[{"type":"plugin","slug":"bdvs-password-reset","name":"Password Reset with Code for WordPress REST API","from":"*","from_inclusive":true,"to":"0.0.15","to_inclusive":true,"patched_in":"0.0.16"}],"published":"2023-08-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f44bb823-bbf3-413b-82b5-a351609270bf","source":"wordfence","cve":"CVE-2024-4634","title":"Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44bb823-bbf3-413b-82b5-a351609270bf?source=api-prod","affected":[{"type":"plugin","slug":"header-footer-elementor","name":"Ultimate Addons for Elementor \u2013 Widgets, Templates, WooCommerce & Header Footer Builder","from":"*","from_inclusive":true,"to":"1.6.28","to_inclusive":true,"patched_in":"1.6.29"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-16T11:05:29Z"},{"id":"wordfence:f44d7a90-330f-42fb-a4f3-427e60ed7af8","source":"wordfence","cve":"CVE-2021-24636","title":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin <= 3.4.1 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44d7a90-330f-42fb-a4f3-427e60ed7af8?source=api-prod","affected":[{"type":"plugin","slug":"print-my-blog","name":"Print My Blog \u2013 Print, PDF, & eBook Converter WordPress Plugin","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2021-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f44fdbb2-abb8-488f-bdc0-ec6eea93d92a","source":"wordfence","cve":"CVE-2025-3097","title":"wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f44fdbb2-abb8-488f-bdc0-ec6eea93d92a?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-machine","name":"wp Time Machine","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T20:29:51Z","updated":"2025-04-02T09:21:45Z"},{"id":"wordfence:f4505b5a-de80-41e2-852f-d2290c1e42e4","source":"wordfence","cve":"CVE-2024-29917","title":"Compact WP Audio Player <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4505b5a-de80-41e2-852f-d2290c1e42e4?source=api-prod","affected":[{"type":"plugin","slug":"compact-wp-audio-player","name":"Compact WP Audio Player","from":"*","from_inclusive":true,"to":"1.9.9","to_inclusive":true,"patched_in":"1.9.10"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T16:37:12Z"},{"id":"wordfence:f4544057-7384-4afe-b2bd-727d7ae25672","source":"wordfence","cve":"CVE-2025-67631","title":"Gift Hunt <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4544057-7384-4afe-b2bd-727d7ae25672?source=api-prod","affected":[{"type":"plugin","slug":"gift-hunt","name":"Gift Hunt","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-05T18:44:19Z"},{"id":"wordfence:f4556e6e-45e7-4d79-8cea-0de1ede7306d","source":"wordfence","cve":"CVE-2025-31927","title":"Mulitple Themes by Themeton <= (Various Versions) - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4556e6e-45e7-4d79-8cea-0de1ede7306d?source=api-prod","affected":[{"type":"theme","slug":"acerola","name":"Acerola - Ultra Minimalist Agency Theme","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"nrgrestaurant","name":"The Restaurant","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"upking","name":"Upking - Hiking Club WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"jina","name":"Jina - Celebration Agency Theme","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"rozario","name":"Rozario - Restaurant & Food WordPress Theme","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-11-05T21:19:31Z"},{"id":"wordfence:f455f3a8-7def-49de-b006-51f4a51aa40b","source":"wordfence","cve":"CVE-2026-65457","title":"\u042eKassa \u0434\u043b\u044f WooCommerce <= 2.16.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f455f3a8-7def-49de-b006-51f4a51aa40b?source=api-prod","affected":[{"type":"plugin","slug":"yookassa","name":"\u042eKassa \u0434\u043b\u044f WooCommerce","from":"*","from_inclusive":true,"to":"2.16.1","to_inclusive":true,"patched_in":"2.16.2"}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:39:21Z"},{"id":"wordfence:f458663f-6b1a-4acd-b2db-c66d7a915ab7","source":"wordfence","cve":"CVE-2023-46197","title":"Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f458663f-6b1a-4acd-b2db-c66d7a915ab7?source=api-prod","affected":[{"type":"plugin","slug":"popup-by-supsystic","name":"CES \u2013 Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation","from":"*","from_inclusive":true,"to":"1.10.19","to_inclusive":true,"patched_in":"1.10.20"}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f45afce1-cb37-4e7e-90b2-6ae1b6400376","source":"wordfence","cve":"CVE-2024-10675","title":"affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f45afce1-cb37-4e7e-90b2-6ae1b6400376?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-11-20T00:00:00Z","updated":"2024-11-21T08:31:12Z"},{"id":"wordfence:f45b4c43-c6c4-41da-bd59-9a355800815a","source":"wordfence","cve":"CVE-2023-4300","title":"Import XML and RSS Feeds <= 2.1.3 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f45b4c43-c6c4-41da-bd59-9a355800815a?source=api-prod","affected":[{"type":"plugin","slug":"import-xml-feed","name":"Import XML and RSS Feeds","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f460d529-f15e-4c23-ad67-94d3f4bc0c2e","source":"wordfence","cve":"CVE-2007-2627","title":"WordPress Core <= 2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f460d529-f15e-4c23-ad67-94d3f4bc0c2e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2007-06-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4618bfd-77d9-4396-b041-d7ba0f6ec75a","source":"wordfence","cve":"CVE-2025-10144","title":"Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4618bfd-77d9-4396-b041-d7ba0f6ec75a?source=api-prod","affected":[{"type":"plugin","slug":"perfect-woocommerce-brands","name":"Perfect Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2025-11-24T09:39:17Z","updated":"2025-11-24T22:28:24Z"},{"id":"wordfence:f46b01e4-1022-45aa-8511-6d2519e4e562","source":"wordfence","cve":"CVE-2024-25917","title":"WP Setup Wizard <= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f46b01e4-1022-45aa-8511-6d2519e4e562?source=api-prod","affected":[{"type":"plugin","slug":"wp-setup-wizard","name":"WP Setup Wizard","from":"*","from_inclusive":true,"to":"1.0.8.1","to_inclusive":true,"patched_in":"1.0.8.2"}],"published":"2024-02-14T00:00:00Z","updated":"2024-02-20T19:54:09Z"},{"id":"wordfence:f46c8075-3946-406c-b4c9-ae44617207f1","source":"wordfence","cve":"CVE-2025-66054","title":"LearnPress <= 4.2.9.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f46c8075-3946-406c-b4c9-ae44617207f1?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.2.9.4","to_inclusive":true,"patched_in":"4.3.0"}],"published":"2025-11-30T00:00:00Z","updated":"2025-12-20T19:44:46Z"},{"id":"wordfence:f4703ca7-0677-4128-b9b7-31132ff1804d","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth < 4.2 - CSV Injection","severity":"critical","cvss":9.6,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4703ca7-0677-4128-b9b7-31132ff1804d?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4723aef-f248-47aa-b53b-ed1ab189bf2c","source":"wordfence","cve":"CVE-2024-53739","title":"Cryptocurrency Widgets For Elementor <= 1.6.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4723aef-f248-47aa-b53b-ed1ab189bf2c?source=api-prod","affected":[{"type":"plugin","slug":"cryptocurrency-widgets-for-elementor","name":"Cryptocurrency Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-11-27T00:00:00Z","updated":"2024-12-12T19:18:10Z"},{"id":"wordfence:f477761d-3fad-4d35-8d41-d1710ec090f7","source":"wordfence","cve":"CVE-2024-35637","title":"Church Admin <= 4.3.6 - Authenticated (Admin+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f477761d-3fad-4d35-8d41-d1710ec090f7?source=api-prod","affected":[{"type":"plugin","slug":"church-admin","name":"Church Admin","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T15:11:29Z"},{"id":"wordfence:f478a5b3-58ef-410e-801f-82eaa579941a","source":"wordfence","cve":"CVE-2024-12258","title":"WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f478a5b3-58ef-410e-801f-82eaa579941a?source=api-prod","affected":[{"type":"plugin","slug":"wp-service-payment-form-with-authorizenet","name":"WP Service Payment Form With Authorize.net","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:14:56Z","updated":"2024-12-12T03:23:12Z"},{"id":"wordfence:f478db7f-6339-446e-b00d-0710707e679a","source":"wordfence","cve":"CVE-2025-9887","title":"Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f478db7f-6339-446e-b00d-0710707e679a?source=api-prod","affected":[{"type":"plugin","slug":"custom-login-and-signup-widget","name":"Custom Login And Signup Widget","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-19T18:23:23Z","updated":"2025-09-20T06:43:20Z"},{"id":"wordfence:f478ff7c-7193-4c59-a84f-c7cafff9b6c0","source":"wordfence","cve":"CVE-2024-0909","title":"Anonymous Restricted Content <= 1.6.2 -  Protection Mechanism Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f478ff7c-7193-4c59-a84f-c7cafff9b6c0?source=api-prod","affected":[{"type":"plugin","slug":"anonymous-restricted-content","name":"Anonymous Restricted Content","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-03T05:38:34Z"},{"id":"wordfence:f479d889-2c79-43eb-bb9b-f876839c4e07","source":"wordfence","cve":"CVE-2024-47345","title":"Starter Templates <= 4.4.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f479d889-2c79-43eb-bb9b-f876839c4e07?source=api-prod","affected":[{"type":"plugin","slug":"astra-sites","name":"Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2024-09-27T00:00:00Z","updated":"2024-10-03T13:19:21Z"},{"id":"wordfence:f47a2ff1-627f-4d1c-b0b6-684be51526f1","source":"wordfence","cve":"CVE-2022-4472","title":"Simple Sitemap <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47a2ff1-627f-4d1c-b0b6-684be51526f1?source=api-prod","affected":[{"type":"plugin","slug":"simple-sitemap","name":"Simple Sitemap \u2013 Responsive HTML Sitemap for WordPress","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2023-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f47d38d2-d388-4a79-a47b-af41cd85e404","source":"wordfence","cve":"CVE-2021-38338","title":"Border Loading Bar <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47d38d2-d388-4a79-a47b-af41cd85e404?source=api-prod","affected":[{"type":"plugin","slug":"border-loading-bar","name":"Border Loading Bar","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f47d50dc-ec14-40c8-95a2-f393986ed71b","source":"wordfence","cve":"CVE-2017-8100","title":"CopySafe Web Protection < 2.6 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47d50dc-ec14-40c8-95a2-f393986ed71b?source=api-prod","affected":[{"type":"plugin","slug":"wp-copysafe-web","name":"CopySafe Web Protection \u2013 Copy Protect Images","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2017-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f47d53e1-42ac-425e-a6f2-901a6d26845d","source":"wordfence","cve":"CVE-2025-14384","title":"All in One SEO \u2013 Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47d53e1-42ac-425e-a6f2-901a6d26845d?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.9.2","to_inclusive":true,"patched_in":"4.9.3"}],"published":"2026-01-15T16:24:16Z","updated":"2026-01-16T04:44:37Z"},{"id":"wordfence:f47e63db-1321-4274-b54a-afcb3a429638","source":"wordfence","cve":"CVE-2026-88903","title":"Topcontent <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47e63db-1321-4274-b54a-afcb3a429638?source=api-prod","affected":[{"type":"plugin","slug":"topcontent","name":"Topcontent","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:18:44Z"},{"id":"wordfence:f47f1080-89d8-41d8-b375-d6dd8d0f9e43","source":"wordfence","cve":"CVE-2026-62045","title":"Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f47f1080-89d8-41d8-b375-d6dd8d0f9e43?source=api-prod","affected":[{"type":"theme","slug":"booklovers","name":"Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL","from":"*","from_inclusive":true,"to":"2.13.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:53:07Z","updated":"2026-10-13T13:58:11Z"},{"id":"wordfence:f482cda1-fe38-455a-b913-bebb21b7bda4","source":"wordfence","cve":"CVE-2026-93878","title":"DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f482cda1-fe38-455a-b913-bebb21b7bda4?source=api-prod","affected":[{"type":"plugin","slug":"dg-divi-carousel","name":"DiviGear Carousel","from":"*","from_inclusive":true,"to":"5.2.0","to_inclusive":true,"patched_in":"5.2.2"}],"published":"2026-10-19T17:42:08Z","updated":"2026-10-20T06:54:42Z"},{"id":"wordfence:f4831e75-dc0e-4d6f-b2cb-8498d8629319","source":"wordfence","cve":"CVE-2026-14487","title":"Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4831e75-dc0e-4d6f-b2cb-8498d8629319?source=api-prod","affected":[{"type":"plugin","slug":"simple-coherent-form","name":"Simple Coherent Form","from":"*","from_inclusive":true,"to":"2.4.13","to_inclusive":true,"patched_in":""}],"published":"2026-07-07T16:30:26Z","updated":"2026-07-08T04:30:50Z"},{"id":"wordfence:f4832fbb-94ed-41c4-8434-1972f4d92476","source":"wordfence","cve":"","title":"Ultimate Member <= 2.4.1 - Username Enumeration","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4832fbb-94ed-41c4-8434-1972f4d92476?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2022-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4835539-a66c-4d14-b3c3-9a3a64e89ea6","source":"wordfence","cve":"CVE-2021-24937","title":"Asset CleanUp <= 1.3.8.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4835539-a66c-4d14-b3c3-9a3a64e89ea6?source=api-prod","affected":[{"type":"plugin","slug":"wp-asset-clean-up","name":"Asset CleanUp: Page Speed Booster","from":"*","from_inclusive":true,"to":"1.3.8.4","to_inclusive":true,"patched_in":"1.3.8.5"}],"published":"2022-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4858836-e85a-4860-a075-f8b0d2502519","source":"wordfence","cve":"CVE-2025-66114","title":"Show Variations as Single Products Woocommerce <= 2.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4858836-e85a-4860-a075-f8b0d2502519?source=api-prod","affected":[{"type":"plugin","slug":"woo-show-single-variations-shop-category","name":"Show Variations as Single Products for WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"3.0"}],"published":"2025-11-28T00:00:00Z","updated":"2025-12-01T17:19:01Z"},{"id":"wordfence:f4887f1b-1a5d-4c29-a404-b4c31393fec2","source":"wordfence","cve":"CVE-2026-15241","title":"AI ChatBot for WooCommerce \u2013 WoowBot < 4.8.4 - Missing Authorization to Unauthenticated AI API Key Abuse","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4887f1b-1a5d-4c29-a404-b4c31393fec2?source=api-prod","affected":[{"type":"plugin","slug":"woowbot-woocommerce-chatbot","name":"AI ChatBot for WooCommerce \u2013 WoowBot","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T20:11:57Z"},{"id":"wordfence:f4893d9c-e039-43df-80b9-dbe42374caed","source":"wordfence","cve":"CVE-2025-13764","title":"WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4893d9c-e039-43df-80b9-dbe42374caed?source=api-prod","affected":[{"type":"plugin","slug":"wp-cardealer","name":"WP CarDealer","from":"*","from_inclusive":true,"to":"1.2.16","to_inclusive":true,"patched_in":"1.2.17"}],"published":"2025-12-10T12:04:08Z","updated":"2025-12-11T01:55:33Z"},{"id":"wordfence:f4895692-3851-4672-85ea-c703e44309d5","source":"wordfence","cve":"CVE-2024-34414","title":"raindrops <= 1.600 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4895692-3851-4672-85ea-c703e44309d5?source=api-prod","affected":[{"type":"theme","slug":"raindrops","name":"raindrops","from":"*","from_inclusive":true,"to":"1.600","to_inclusive":true,"patched_in":"1.700"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:02:10Z"},{"id":"wordfence:f48bb7d9-ce82-4549-aead-2876dd3081a8","source":"wordfence","cve":"CVE-2024-54358","title":"3D Avatar User Profile <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f48bb7d9-ce82-4549-aead-2876dd3081a8?source=api-prod","affected":[{"type":"plugin","slug":"3d-avatar-user-profile","name":"3D Avatar User Profile","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:53:45Z"},{"id":"wordfence:f490dd2b-34d6-4e19-8788-d30ad0c67e95","source":"wordfence","cve":"CVE-2026-13145","title":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f490dd2b-34d6-4e19-8788-d30ad0c67e95?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel","name":"WP Travel \u2013 Ultimate Travel Booking System, Tour Management Engine","from":"*","from_inclusive":true,"to":"11.8.1","to_inclusive":false,"patched_in":"11.8.1"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:22:54Z"},{"id":"wordfence:f492dcb6-0aa7-476d-bb85-c81a136d02a6","source":"wordfence","cve":"CVE-2025-12159","title":"Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f492dcb6-0aa7-476d-bb85-c81a136d02a6?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.6","to_inclusive":true,"patched_in":"5.9.7"}],"published":"2026-02-06T17:30:05Z","updated":"2026-09-11T09:26:09Z"},{"id":"wordfence:f49408da-79d5-4653-b4c2-a9247f597380","source":"wordfence","cve":"CVE-2019-15114","title":"FormCraft <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49408da-79d5-4653-b4c2-a9247f597380?source=api-prod","affected":[{"type":"plugin","slug":"formcraft-form-builder","name":"FormCraft \u2013 Form Builder","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2019-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4943899-a25a-4e50-b33e-139ed5e8f748","source":"wordfence","cve":"CVE-2025-14792","title":"Key Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render","severity":"medium","cvss":4.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4943899-a25a-4e50-b33e-139ed5e8f748?source=api-prod","affected":[{"type":"plugin","slug":"key-figures","name":"Key Figures","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:36:44Z","updated":"2026-01-07T07:17:34Z"},{"id":"wordfence:f4955368-85bc-4a9c-8d3a-446e09955f6c","source":"wordfence","cve":"","title":"Parsi Date <= 4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4955368-85bc-4a9c-8d3a-446e09955f6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-parsidate","name":"Parsi Date | \u0628\u0633\u062a\u0647 \u0641\u0627\u0631\u0633\u06cc \u0633\u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0648 \u0648\u0648\u06a9\u0627\u0645\u0631\u0633 \u067e\u0627\u0631\u0633\u06cc \u062f\u06cc\u062a","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f495689b-a784-4685-934a-bbc3d380a4b3","source":"wordfence","cve":"CVE-2026-121766","title":"PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f495689b-a784-4685-934a-bbc3d380a4b3?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.18.0","to_inclusive":true,"patched_in":"11.18.2"}],"published":"2026-11-07T00:00:00Z","updated":"2026-11-11T16:10:39Z"},{"id":"wordfence:f4969c74-7378-46cb-8028-91db91c4ae7e","source":"wordfence","cve":"CVE-2025-23437","title":"ntp-header-images <= 1.2 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4969c74-7378-46cb-8028-91db91c4ae7e?source=api-prod","affected":[{"type":"plugin","slug":"header-images-rotator","name":"ntp-header-images","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:39:32Z"},{"id":"wordfence:f497c9b0-afd4-48b8-a701-b2a9ad2b4389","source":"wordfence","cve":"CVE-2025-68846","title":"Asynchronous Javascript <= 1.3.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f497c9b0-afd4-48b8-a701-b2a9ad2b4389?source=api-prod","affected":[{"type":"plugin","slug":"asynchronous-javascript","name":"Asynchronous Javascript","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T16:20:32Z"},{"id":"wordfence:f4986bc3-ee34-43a6-bad2-9f6665adb35c","source":"wordfence","cve":"CVE-2024-3210","title":"Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4986bc3-ee34-43a6-bad2-9f6665adb35c?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.15.5","to_inclusive":true,"patched_in":"4.15.6"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-10T05:32:25Z"},{"id":"wordfence:f49cafe0-2caf-4148-b7c9-1b78bbfba6e7","source":"wordfence","cve":"CVE-2021-24535","title":"Light Messages <= 1.0 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49cafe0-2caf-4148-b7c9-1b78bbfba6e7?source=api-prod","affected":[{"type":"plugin","slug":"light-messages","name":"Light Messages","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f49ccf0f-99ec-410f-8bf0-2f15d8fd578f","source":"wordfence","cve":"CVE-2026-15002","title":"Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49ccf0f-99ec-410f-8bf0-2f15d8fd578f?source=api-prod","affected":[{"type":"plugin","slug":"platnosci-online-blue-media","name":"Autopay","from":"*","from_inclusive":true,"to":"5.0.0","to_inclusive":true,"patched_in":"5.0.1"}],"published":"2026-08-15T15:28:15Z","updated":"2026-08-16T04:24:56Z"},{"id":"wordfence:f49e48cb-7d0b-4bcf-9090-869472b8442a","source":"wordfence","cve":"CVE-2025-6212","title":"Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49e48cb-7d0b-4bcf-9090-869472b8442a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"3.5.11","from_inclusive":true,"to":"3.5.19","to_inclusive":true,"patched_in":"3.5.20"}],"published":"2025-06-25T20:51:54Z","updated":"2025-06-26T09:22:03Z"},{"id":"wordfence:f49fba00-c576-4a1a-8b0b-9ebed3e3d090","source":"wordfence","cve":"CVE-2024-4098","title":"Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f49fba00-c576-4a1a-8b0b-9ebed3e3d090?source=api-prod","affected":[{"type":"plugin","slug":"shariff","name":"Shariff Wrapper","from":"*","from_inclusive":true,"to":"4.6.13","to_inclusive":true,"patched_in":"4.6.14"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-20T06:58:05Z"},{"id":"wordfence:f4a38e5d-758b-490e-9ada-c58646c4e8c9","source":"wordfence","cve":"CVE-2026-24532","title":"SiteLock Security <= 5.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4a38e5d-758b-490e-9ada-c58646c4e8c9?source=api-prod","affected":[{"type":"plugin","slug":"sitelock","name":"SiteLock Security \u2013 WP Hardening, Login Security & Malware Scans","from":"*","from_inclusive":true,"to":"5.0.2","to_inclusive":true,"patched_in":"5.0.3"}],"published":"2026-01-25T00:00:00Z","updated":"2026-02-12T17:13:32Z"},{"id":"wordfence:f4a4584e-c846-446b-bf6e-09d55fd9b13e","source":"wordfence","cve":"CVE-2026-96200","title":"Payments for Hubtel <= 1.0.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4a4584e-c846-446b-bf6e-09d55fd9b13e?source=api-prod","affected":[{"type":"plugin","slug":"payments-hubtel","name":"Payments for Hubtel","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-08T23:54:12Z"},{"id":"wordfence:f4a46dcb-ee62-4c18-a1d9-d56be7a7ca69","source":"wordfence","cve":"CVE-2025-58707","title":"Spin - Cricket Team Sports WordPress Theme + AI <= 1.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4a46dcb-ee62-4c18-a1d9-d56be7a7ca69?source=api-prod","affected":[{"type":"theme","slug":"spin","name":"Spin - Cricket Team Sports WordPress Theme + AI","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:18:19Z"},{"id":"wordfence:f4a4e3ef-ee88-4175-8628-c5511c20bf23","source":"wordfence","cve":"CVE-2017-5488","title":"WordPress Core < 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4a4e3ef-ee88-4175-8628-c5511c20bf23?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4aac424-abf3-4d6c-a0a4-a95e2cf89864","source":"wordfence","cve":"CVE-2023-47557","title":"Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4aac424-abf3-4d6c-a0a4-a95e2cf89864?source=api-prod","affected":[{"type":"plugin","slug":"visitors-traffic-real-time-statistics","name":"Visitor Traffic Real Time Statistics","from":"*","from_inclusive":true,"to":"7.2","to_inclusive":true,"patched_in":"7.3"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-11T19:34:42Z"},{"id":"wordfence:f4acd261-d924-46d5-8aef-49b026cba8ca","source":"wordfence","cve":"","title":"EZPZ One Click Backup <= 12.03.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4acd261-d924-46d5-8aef-49b026cba8ca?source=api-prod","affected":[{"type":"plugin","slug":"ezpz-one-click-backup","name":"EZPZ One Click Backup","from":"*","from_inclusive":true,"to":"12.03.10","to_inclusive":true,"patched_in":""}],"published":"2012-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4afcb16-9c97-483f-be48-31b5156bcca3","source":"wordfence","cve":"CVE-2023-52234","title":"Booster Elite for WooCommerce < 7.1.2 -  Missing Authorization to Order Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4afcb16-9c97-483f-be48-31b5156bcca3?source=api-prod","affected":[{"type":"plugin","slug":"booster-elite-for-woocommerce","name":"Booster Elite for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.2","to_inclusive":false,"patched_in":"7.1.2"}],"published":"2024-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4b13a45-9141-47e3-ba11-c0ce15235936","source":"wordfence","cve":"CVE-2022-3999","title":"WooCommerce Shipping \u2013 DPD baltic <= 1.2.54 - Missing Authorization to Arbitrary Options Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b13a45-9141-47e3-ba11-c0ce15235936?source=api-prod","affected":[{"type":"plugin","slug":"woo-shipping-dpd-baltic","name":"DPD Baltic Shipping","from":"*","from_inclusive":true,"to":"1.2.56","to_inclusive":true,"patched_in":"1.2.57"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4b1e7da-dbcd-4206-b908-4c814cde39d9","source":"wordfence","cve":"CVE-2022-1266","title":"Post Grid, Slider & Carousel Ultimate <= 1.4.3 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b1e7da-dbcd-4206-b908-4c814cde39d9?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2022-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4b36468-319a-4de3-9112-bd4a3cf7d637","source":"wordfence","cve":"CVE-2026-4353","title":"CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b36468-319a-4de3-9112-bd4a3cf7d637?source=api-prod","affected":[{"type":"plugin","slug":"ci-hub-connector","name":"CI HUB Connector","from":"*","from_inclusive":true,"to":"1.2.106","to_inclusive":true,"patched_in":"1.2.108"}],"published":"2026-04-21T19:07:58Z","updated":"2026-09-16T18:12:34Z"},{"id":"wordfence:f4b45791-4b85-4a2d-8019-1d438bd694cb","source":"wordfence","cve":"CVE-2024-7559","title":"File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b45791-4b85-4a2d-8019-1d438bd694cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager-pro","name":"File Manager Pro","from":"*","from_inclusive":true,"to":"8.3.7","to_inclusive":true,"patched_in":"8.3.8"}],"published":"2024-08-22T14:04:16Z","updated":"2024-08-23T02:31:46Z"},{"id":"wordfence:f4b69cff-31ac-4abe-8f03-07ee3fb4c285","source":"wordfence","cve":"CVE-2021-38358","title":"MoolaMojo <= 0.7.4.1 Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b69cff-31ac-4abe-8f03-07ee3fb4c285?source=api-prod","affected":[{"type":"plugin","slug":"moolamojo","name":"MoolaMojo","from":"*","from_inclusive":true,"to":"0.7.4.1","to_inclusive":true,"patched_in":""}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4b75e39-48fe-4781-be0f-9cf806d953ea","source":"wordfence","cve":"CVE-2024-50422","title":"Breeze <= 2.1.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b75e39-48fe-4781-be0f-9cf806d953ea?source=api-prod","affected":[{"type":"plugin","slug":"breeze","name":"Breeze Cache","from":"*","from_inclusive":true,"to":"2.1.14","to_inclusive":true,"patched_in":"2.1.15"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:20:01Z"},{"id":"wordfence:f4ba4321-23e9-4e53-ab71-e68a0bcd8129","source":"wordfence","cve":"CVE-2024-43130","title":"Football Pool <= 2.11.10 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ba4321-23e9-4e53-ab71-e68a0bcd8129?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.11.10","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T16:08:48Z"},{"id":"wordfence:f4bf4e12-5cbb-45bc-938e-62163baaa15d","source":"wordfence","cve":"CVE-2023-2120","title":"Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4bf4e12-5cbb-45bc-938e-62163baaa15d?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2023-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4bffbe6-8317-495b-b349-632c9a4f1f88","source":"wordfence","cve":"CVE-2024-49257","title":"Azz Anonim Posting <= 0.9 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4bffbe6-8317-495b-b349-632c9a4f1f88?source=api-prod","affected":[{"type":"plugin","slug":"azz-anonim-posting","name":"Azz Anonim Posting","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2024-10-14T00:00:00Z","updated":"2024-10-18T16:10:47Z"},{"id":"wordfence:f4c12992-af23-4bb7-877a-ef1115ace78d","source":"wordfence","cve":"CVE-2026-107417","title":"Push Notification for Post and BuddyPress <= 3.23 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4c12992-af23-4bb7-877a-ef1115ace78d?source=api-prod","affected":[{"type":"plugin","slug":"push-notification-for-post-and-buddypress","name":"Push Notification for Post and BuddyPress","from":"*","from_inclusive":true,"to":"3.23","to_inclusive":true,"patched_in":"3.24"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:33:56Z"},{"id":"wordfence:f4c3f9c5-5086-416b-a601-2890f52547c0","source":"wordfence","cve":"","title":"Advanced Woo Search <= 1.68 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4c3f9c5-5086-416b-a601-2890f52547c0?source=api-prod","affected":[{"type":"plugin","slug":"advanced-woo-search","name":"Advanced Woo Search \u2013 Product Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.68","to_inclusive":true,"patched_in":"1.70"}],"published":"2019-05-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4c85fa1-ee4f-4f77-86a4-b0859a40162d","source":"wordfence","cve":"CVE-2026-22436","title":"Helvig <= 1.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4c85fa1-ee4f-4f77-86a4-b0859a40162d?source=api-prod","affected":[{"type":"theme","slug":"helvig","name":"Helvig - Creative Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T17:26:09Z"},{"id":"wordfence:f4c8932b-ede8-4f17-9612-5493c1130170","source":"wordfence","cve":"CVE-2024-22140","title":"Profile Builder Pro <= 3.10.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4c8932b-ede8-4f17-9612-5493c1130170?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder-pro","name":"Profile Builder Pro","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4ca1736-7b99-49db-9367-586dbc14df41","source":"wordfence","cve":"CVE-2023-4915","title":"WP User Control <= 1.5.3 - Insecure Password Reset Mechanism","severity":"medium","cvss":5.3,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ca1736-7b99-49db-9367-586dbc14df41?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-control","name":"WP User Control","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2023-09-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4ccfeac-e20e-45f3-9c38-a139130b4ab8","source":"wordfence","cve":"CVE-2025-47682","title":"SMS Alert Order Notifications \u2013 WooCommerce <= 3.8.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ccfeac-e20e-45f3-9c38-a139130b4ab8?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"*","from_inclusive":true,"to":"3.8.1","to_inclusive":true,"patched_in":"3.8.2"}],"published":"2025-05-08T00:00:00Z","updated":"2025-05-16T14:19:19Z"},{"id":"wordfence:f4cd5a8c-d114-4b88-aaf1-aa525cd33595","source":"wordfence","cve":"CVE-2026-39639","title":"RPS Include Content <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4cd5a8c-d114-4b88-aaf1-aa525cd33595?source=api-prod","affected":[{"type":"plugin","slug":"rps-include-content","name":"RPS Include Content","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-14T00:00:00Z","updated":"2026-05-07T13:45:31Z"},{"id":"wordfence:f4d347bd-b23e-4445-957a-3b66740bcfc0","source":"wordfence","cve":"CVE-2026-40725","title":"WooCommerce Product Filters 2.0.0 - 2.0.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4d347bd-b23e-4445-957a-3b66740bcfc0?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-filters","name":"WooCommerce Product Filters","from":"2.0.0","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2026-04-16T00:00:00Z","updated":"2026-07-10T17:45:06Z"},{"id":"wordfence:f4d41f7f-f0c6-4e50-bf5f-37ee25415f43","source":"wordfence","cve":"","title":"Gallery Bank \u2013 WordPress Photo Gallery Plugin < 2.0.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4d41f7f-f0c6-4e50-bf5f-37ee25415f43?source=api-prod","affected":[{"type":"plugin","slug":"gallery-bank","name":"Gallery Bank \u2013 WordPress Photo Gallery Plugin","from":"*","from_inclusive":true,"to":"2.0.20","to_inclusive":false,"patched_in":"2.0.20"}],"published":"2013-10-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4d421df-310b-4a83-b521-c0d00045df52","source":"wordfence","cve":"CVE-2021-24452","title":"W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4d421df-310b-4a83-b521-c0d00045df52?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"0.5","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":"2.1.5"}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4d52bc6-1056-4e08-a1b5-57107c75a0e5","source":"wordfence","cve":"CVE-2026-103324","title":"Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Status Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4d52bc6-1056-4e08-a1b5-57107c75a0e5?source=api-prod","affected":[{"type":"plugin","slug":"cardinity-free-payment-gateway-for-woocommerce","name":"Cardinity Payment Gateway for WooCommerce","from":"3.2.6","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:26:08Z"},{"id":"wordfence:f4dad030-41e4-4d67-8650-8d268c44d352","source":"wordfence","cve":"CVE-2023-37394","title":"WP Dummy Content Generator <= 2.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4dad030-41e4-4d67-8650-8d268c44d352?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4daf910-1768-4cfd-af92-66a2ee7f52a5","source":"wordfence","cve":"CVE-2026-4110","title":"Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4daf910-1768-4cfd-af92-66a2ee7f52a5?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-woocommerce-auction-pro","name":"Ultimate Auction Pro","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-13T00:00:00Z","updated":"2026-07-16T17:06:37Z"},{"id":"wordfence:f4dbab86-926d-4438-8310-19373c9bdd99","source":"wordfence","cve":"CVE-2023-0543","title":"Arigato Autoresponder and Newsletter <= 2.1.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4dbab86-926d-4438-8310-19373c9bdd99?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.1.7.1","to_inclusive":true,"patched_in":"2.1.7.2"}],"published":"2023-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4dd4479-2f41-426f-b98c-7c654a82ccfe","source":"wordfence","cve":"CVE-2023-25781","title":"Upload File Type Settings Plugin <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4dd4479-2f41-426f-b98c-7c654a82ccfe?source=api-prod","affected":[{"type":"plugin","slug":"upload-file-type-settings-plugin","name":"Upload File Type Settings Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4dfb4b5-b2a5-40bd-9dfb-863baa563d06","source":"wordfence","cve":"CVE-2023-45270","title":"Pinpoint Booking System <= 2.9.9.4.0 - Cross-Site Request Forgery via initBackEndAJAX","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4dfb4b5-b2a5-40bd-9dfb-863baa563d06?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.4.0","to_inclusive":true,"patched_in":"2.9.9.4.1"}],"published":"2023-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4e12192-d24b-48b7-8533-714e9be78f0b","source":"wordfence","cve":"CVE-2025-30772","title":"WPC Smart Upsell Funnel for WooCommerce <= 3.0.4 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e12192-d24b-48b7-8533-714e9be78f0b?source=api-prod","affected":[{"type":"plugin","slug":"wpc-smart-upsell-funnel","name":"WPC Smart Upsell Funnel for WooCommerce","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:08:26Z"},{"id":"wordfence:f4e15f70-e16f-4189-9cae-61b5853428fd","source":"wordfence","cve":"CVE-2026-6372","title":"Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e15f70-e16f-4189-9cae-61b5853428fd?source=api-prod","affected":[{"type":"plugin","slug":"plisio-payment-gateway-for-woocommerce","name":"Accept Cryptocurrencies with Plisio","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-04-15T00:00:00Z","updated":"2026-04-21T14:46:46Z"},{"id":"wordfence:f4e25aa6-8028-4c85-98c4-6f47a1502427","source":"wordfence","cve":"CVE-2026-13114","title":"Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e25aa6-8028-4c85-98c4-6f47a1502427?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.112","to_inclusive":true,"patched_in":"1.4.113"}],"published":"2026-07-10T14:11:22Z","updated":"2026-07-14T12:15:01Z"},{"id":"wordfence:f4e2f6a8-0576-4a43-9061-9878b7d59399","source":"wordfence","cve":"CVE-2026-65488","title":"LA-Studio Element Kit for Elementor <= 1.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e2f6a8-0576-4a43-9061-9878b7d59399?source=api-prod","affected":[{"type":"plugin","slug":"lastudio-element-kit","name":"LA-Studio Element Kit for Elementor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-07-22T00:00:00Z","updated":"2026-10-13T16:59:06Z"},{"id":"wordfence:f4e3b796-af9a-4403-8d9a-1b56d7253b45","source":"wordfence","cve":"CVE-2025-11727","title":"Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e3b796-af9a-4403-8d9a-1b56d7253b45?source=api-prod","affected":[{"type":"plugin","slug":"codistoconnect","name":"Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration \u2013 Powered by Codisto","from":"*","from_inclusive":true,"to":"1.3.65","to_inclusive":true,"patched_in":""}],"published":"2025-12-03T15:51:28Z","updated":"2025-12-04T04:29:01Z"},{"id":"wordfence:f4e43d66-04f4-4adb-93da-75e02d1c714e","source":"wordfence","cve":"CVE-2025-4669","title":"Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e43d66-04f4-4adb-93da-75e02d1c714e?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":true,"patched_in":"10.11.2"}],"published":"2025-05-16T21:35:34Z","updated":"2025-05-17T11:17:17Z"},{"id":"wordfence:f4e6fd53-0c97-4490-ab7a-9f6d195912b2","source":"wordfence","cve":"CVE-2024-4270","title":"SVGMagic <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload","severity":"medium","cvss":6.4,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e6fd53-0c97-4490-ab7a-9f6d195912b2?source=api-prod","affected":[{"type":"plugin","slug":"svgmagic","name":"SVGMagic","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-05-24T00:00:00Z","updated":"2024-05-30T13:24:18Z"},{"id":"wordfence:f4e8ad18-fa25-414c-8a94-9ad9bd3c2e31","source":"wordfence","cve":"","title":"XO Event Calendar <= 2.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e8ad18-fa25-414c-8a94-9ad9bd3c2e31?source=api-prod","affected":[{"type":"plugin","slug":"xo-event-calendar","name":"XO Event Calendar","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2021-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4e9d051-3379-4f59-9970-c66c44ca2626","source":"wordfence","cve":"CVE-2026-120741","title":"MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e9d051-3379-4f59-9970-c66c44ca2626?source=api-prod","affected":[{"type":"plugin","slug":"motopress-appointment-lite","name":"MotoPress Appointment Booking","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-11-06T14:08:52Z","updated":"2026-11-07T02:29:18Z"},{"id":"wordfence:f4ea5c2e-594d-4835-9f29-bdfce6bb4750","source":"wordfence","cve":"CVE-2025-30551","title":"Pretty file links <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ea5c2e-594d-4835-9f29-bdfce6bb4750?source=api-prod","affected":[{"type":"plugin","slug":"pretty-file-links","name":"Pretty file links","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:39:53Z"},{"id":"wordfence:f4ea6044-bf7b-469d-89ec-a9b89ef5715e","source":"wordfence","cve":"CVE-2023-51423","title":"WebinarIgnition <= 3.05.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ea6044-bf7b-469d-89ec-a9b89ef5715e?source=api-prod","affected":[{"type":"plugin","slug":"webinar-ignition","name":"WebinarIgnition \u2013 AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside","from":"*","from_inclusive":true,"to":"3.05.0","to_inclusive":true,"patched_in":"3.05.1"}],"published":"2023-12-27T00:00:00Z","updated":"2024-02-05T16:38:44Z"},{"id":"wordfence:f4eb46c8-77fe-4e47-9912-5d8fd4ec0918","source":"wordfence","cve":"CVE-2024-51706","title":"UW Freelancer <= 0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4eb46c8-77fe-4e47-9912-5d8fd4ec0918?source=api-prod","affected":[{"type":"plugin","slug":"uw-freelancer","name":"UW Freelancer","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:06:36Z"},{"id":"wordfence:f4eb61dd-f28e-4d8a-8f97-958b6a356309","source":"wordfence","cve":"CVE-2025-8398","title":"azurecurve BBCode <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4eb61dd-f28e-4d8a-8f97-958b6a356309?source=api-prod","affected":[{"type":"plugin","slug":"azurecurve-bbcode","name":"azurecurve BBCode","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:50:39Z","updated":"2025-09-11T07:25:03Z"},{"id":"wordfence:f4ef2ced-3c82-4379-8b14-1cf11482fd35","source":"wordfence","cve":"CVE-2024-3936","title":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ef2ced-3c82-4379-8b14-1cf11482fd35?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.6.1","to_inclusive":true,"patched_in":"7.7.0"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-02T16:52:51Z"},{"id":"wordfence:f4f0bb58-d904-4bf4-9e15-4ee6289c2df4","source":"wordfence","cve":"CVE-2023-30784","title":"Kaya QR Code Generator <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f0bb58-d904-4bf4-9e15-4ee6289c2df4?source=api-prod","affected":[{"type":"plugin","slug":"kaya-qr-code-generator","name":"Kaya QR Code Generator","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4f1467d-1f66-4e99-af44-9329cfe1efac","source":"wordfence","cve":"CVE-2025-11999","title":"Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f1467d-1f66-4e99-af44-9329cfe1efac?source=api-prod","affected":[{"type":"plugin","slug":"add-multiple-marker","name":"Multi Location Marker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-11-10T15:17:46Z","updated":"2026-02-03T19:53:05Z"},{"id":"wordfence:f4f52cb6-eccf-4213-ae44-4a3fa738723d","source":"wordfence","cve":"CVE-2024-12465","title":"Property Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f52cb6-eccf-4213-ae44-4a3fa738723d?source=api-prod","affected":[{"type":"plugin","slug":"property-hive-stamp-duty-calculator","name":"Property Hive Stamp Duty Calculator","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-13T08:24:53Z"},{"id":"wordfence:f4f5a268-7e7f-4dbe-823a-a17ac0f52928","source":"wordfence","cve":"CVE-2026-94376","title":"Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f5a268-7e7f-4dbe-823a-a17ac0f52928?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2026-09-24T18:13:22Z","updated":"2026-09-25T06:39:58Z"},{"id":"wordfence:f4f84b2a-2674-42a1-9db1-d9c1f3db2376","source":"wordfence","cve":"CVE-2023-39159","title":"Woocommerce Blocker Lite <= 2.1.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f84b2a-2674-42a1-9db1-d9c1f3db2376?source=api-prod","affected":[{"type":"plugin","slug":"woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers","name":"Fraud Prevention For WooCommerce and EDD","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2023-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4f96877-406b-4ec0-ac6b-ee1ffdb436e5","source":"wordfence","cve":"CVE-2023-45748","title":"MailChimp Forms by MailMunch <= 3.1.7 - Cross-Site Request Forgery via Multiple AJAX actions","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4f96877-406b-4ec0-ac6b-ee1ffdb436e5?source=api-prod","affected":[{"type":"plugin","slug":"mailchimp-forms-by-mailmunch","name":"Mailmunch Forms for Mailchimp","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f4fa85b4-df6e-4b7d-9b8b-940c5f102556","source":"wordfence","cve":"CVE-2026-24535","title":"Automatic Featured Images from Videos <= 1.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fa85b4-df6e-4b7d-9b8b-940c5f102556?source=api-prod","affected":[{"type":"plugin","slug":"automatic-featured-images-from-videos","name":"Automatic Featured Images from Videos","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2026-01-25T00:00:00Z","updated":"2026-01-28T13:40:26Z"},{"id":"wordfence:f4fbf8d5-dae6-4db4-b4c3-7b2254983813","source":"wordfence","cve":"CVE-2025-62124","title":"Post Signature <= 0.4.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fbf8d5-dae6-4db4-b4c3-7b2254983813?source=api-prod","affected":[{"type":"plugin","slug":"wp-post-signature","name":"WP Post Signature","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:27:36Z"},{"id":"wordfence:f4fcc6e5-1f90-41e7-8d5a-2bfe8cbf46fa","source":"wordfence","cve":"CVE-2025-14867","title":"Flashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fcc6e5-1f90-41e7-8d5a-2bfe8cbf46fa?source=api-prod","affected":[{"type":"plugin","slug":"flashcard","name":"Flashcard Plugin for WordPress","from":"*","from_inclusive":true,"to":"0.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T18:34:27Z","updated":"2026-01-07T06:36:04Z"},{"id":"wordfence:f4fe0a29-aa0c-423d-874f-7a0242fef996","source":"wordfence","cve":"CVE-2025-54672","title":"Photo Engine <= 6.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fe0a29-aa0c-423d-874f-7a0242fef996?source=api-prod","affected":[{"type":"plugin","slug":"wplr-sync","name":"Photo Engine (Media Organizer & Lightroom)","from":"*","from_inclusive":true,"to":"6.4.3","to_inclusive":true,"patched_in":"6.4.4"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:09:24Z"},{"id":"wordfence:f4fe3ad9-247f-4e5d-8c79-0970afaa7729","source":"wordfence","cve":"CVE-2024-12114","title":"FooGallery \u2013 Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fe3ad9-247f-4e5d-8c79-0970afaa7729?source=api-prod","affected":[{"type":"plugin","slug":"foogallery","name":"FooGallery Photo Gallery : Image, Video & Masonry Galleries","from":"*","from_inclusive":true,"to":"2.4.29","to_inclusive":true,"patched_in":"2.4.30"}],"published":"2025-03-07T16:21:23Z","updated":"2025-03-08T05:30:11Z"},{"id":"wordfence:f4fe5ed7-17e2-4098-a51b-3b780721bf2e","source":"wordfence","cve":"CVE-2025-12391","title":"Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4fe5ed7-17e2-4098-a51b-3b780721bf2e?source=api-prod","affected":[{"type":"plugin","slug":"bp-restrict","name":"Restrictions for BuddyPress","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2025-11-17T20:52:43Z","updated":"2026-03-06T18:38:17Z"},{"id":"wordfence:f4ff4114-c1ed-47df-9e7c-f34f1a422ffe","source":"wordfence","cve":"CVE-2026-27384","title":"W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ff4114-c1ed-47df-9e7c-f34f1a422ffe?source=api-prod","affected":[{"type":"plugin","slug":"w3-total-cache","name":"W3 Total Cache","from":"*","from_inclusive":true,"to":"2.9.1","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-06T14:50:07Z"},{"id":"wordfence:f4ff957a-1969-48f5-9f4e-d6bee2cbe581","source":"wordfence","cve":"CVE-2025-39548","title":"Right Click Disable OR Ban <= 1.1.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ff957a-1969-48f5-9f4e-d6bee2cbe581?source=api-prod","affected":[{"type":"plugin","slug":"right-click-disable-or-ban","name":"Right Click Ban \u2013 Disable Right Click & Content Copy Protection","from":"*","from_inclusive":true,"to":"1.1.17","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T19:50:16Z"},{"id":"wordfence:f5030dd8-b723-443f-9dff-1f4d4c37b4fb","source":"wordfence","cve":"CVE-2024-49629","title":"Endless Posts Navigation <= 2.2.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5030dd8-b723-443f-9dff-1f4d4c37b4fb?source=api-prod","affected":[{"type":"plugin","slug":"endless-posts-navigation","name":"Endless Posts Navigation","from":"*","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-22T18:25:44Z"},{"id":"wordfence:f506a9bd-2501-4437-938d-2833fc8545a9","source":"wordfence","cve":"CVE-2026-9004","title":"WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f506a9bd-2501-4437-938d-2833fc8545a9?source=api-prod","affected":[{"type":"plugin","slug":"wp-crm-system","name":"WP-CRM System \u2013 Manage Clients and Projects","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2026-09-21T19:26:14Z","updated":"2026-10-02T17:21:16Z"},{"id":"wordfence:f507cec5-d66c-4cb0-8c35-a985aaee1283","source":"wordfence","cve":"CVE-2024-38707","title":"EmbedPress <= 4.0.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f507cec5-d66c-4cb0-8c35-a985aaee1283?source=api-prod","affected":[{"type":"plugin","slug":"embedpress","name":"EmbedPress","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T12:54:17Z"},{"id":"wordfence:f509f1c6-6094-434d-8e70-ad8419250aa2","source":"wordfence","cve":"CVE-2026-9148","title":"Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f509f1c6-6094-434d-8e70-ad8419250aa2?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.56","to_inclusive":true,"patched_in":"7.6.57"}],"published":"2026-07-02T17:39:38Z","updated":"2026-07-03T06:50:12Z"},{"id":"wordfence:f50bca0a-7089-4b4e-820f-d311fdb88cf1","source":"wordfence","cve":"CVE-2006-4743","title":"WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f50bca0a-7089-4b4e-820f-d311fdb88cf1?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"2.0.2","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":"2.0.6"}],"published":"2007-01-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f50c31df-56d0-4c34-a93c-56198fe91b36","source":"wordfence","cve":"CVE-2026-2028","title":"Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f50c31df-56d0-4c34-a93c-56198fe91b36?source=api-prod","affected":[{"type":"plugin","slug":"maxi-blocks","name":"MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2026-04-23T14:43:34Z","updated":"2026-04-24T03:27:06Z"},{"id":"wordfence:f50f1e64-5015-4e40-912e-92a4f16e1398","source":"wordfence","cve":"CVE-2023-26008","title":"Top 10 \u2013 Popular posts plugin - <= 3.2.4 - Authenticated(Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f50f1e64-5015-4e40-912e-92a4f16e1398?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2023-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f515ccf8-7231-4728-b155-c47049087d42","source":"wordfence","cve":"CVE-2023-6504","title":"Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f515ccf8-7231-4728-b155-c47049087d42?source=api-prod","affected":[{"type":"plugin","slug":"profile-builder","name":"User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor","from":"*","from_inclusive":true,"to":"3.10.6","to_inclusive":true,"patched_in":"3.10.8"}],"published":"2024-01-05T00:00:00Z","updated":"2024-07-29T21:37:48Z"},{"id":"wordfence:f5184598-b0bd-4026-971c-da36d79497df","source":"wordfence","cve":"CVE-2026-6740","title":"Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5184598-b0bd-4026-971c-da36d79497df?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-block-editor","name":"Nexter Blocks \u2013 Gutenberg Blocks, Page Builder & AI Website Builder","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.7.5"}],"published":"2026-07-07T23:56:47Z","updated":"2026-07-08T12:33:17Z"},{"id":"wordfence:f51d50c8-249d-423e-ac2f-1f0939ec8ba1","source":"wordfence","cve":"CVE-2025-69334","title":"Wishlist for WooCommerce <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f51d50c8-249d-423e-ac2f-1f0939ec8ba1?source=api-prod","affected":[{"type":"plugin","slug":"wish-list-for-woocommerce","name":"Wishlist for WooCommerce: Multiple Wishlists per Customer","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-12-30T00:00:00Z","updated":"2026-01-13T17:53:11Z"},{"id":"wordfence:f51dc2b4-894e-4fd5-b8c7-6f579bc41aa0","source":"wordfence","cve":"CVE-2026-80340","title":"Payment Plugins for PayPal WooCommerce <= 2.0.25 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f51dc2b4-894e-4fd5-b8c7-6f579bc41aa0?source=api-prod","affected":[{"type":"plugin","slug":"pymntpl-paypal-woocommerce","name":"Payment Plugins for PayPal WooCommerce","from":"*","from_inclusive":true,"to":"2.0.25","to_inclusive":true,"patched_in":"2.0.26"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:16:49Z"},{"id":"wordfence:f51f0919-498e-4f86-a933-1b7f2c4a10a4","source":"wordfence","cve":"CVE-2023-2261","title":"WP Activity Log <= 4.5.0 - Missing Capabilities Check to User Enumeration","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f51f0919-498e-4f86-a933-1b7f2c4a10a4?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-audit-log","name":"WP Activity Log","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"},{"type":"plugin","slug":"wp-security-audit-log-premium","name":"WP Activity Log Premium","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2023-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f51f66d7-ba47-4b7b-9b94-ea4459cf6233","source":"wordfence","cve":"CVE-2023-6584","title":"WP JobSearch <= 2.3.3 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f51f66d7-ba47-4b7b-9b94-ea4459cf6233?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2023-11-24T00:00:00Z","updated":"2024-03-22T16:31:55Z"},{"id":"wordfence:f5227a9b-8bc6-46fc-89b0-a494b572d004","source":"wordfence","cve":"CVE-2026-16557","title":"Nimble Builder <= 3.3.8 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5227a9b-8bc6-46fc-89b0-a494b572d004?source=api-prod","affected":[{"type":"plugin","slug":"nimble-builder","name":"Nimble Page Builder","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":""}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:29:03Z"},{"id":"wordfence:f52285e0-e78d-4231-8ff9-53fbe568fcc2","source":"wordfence","cve":"CVE-2024-10685","title":"Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52285e0-e78d-4231-8ff9-53fbe568fcc2?source=api-prod","affected":[{"type":"plugin","slug":"cf7-redirect-thank-you-page","name":"Business Essentials for Contact Form 7","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-11-11T15:08:10Z","updated":"2024-11-12T03:24:58Z"},{"id":"wordfence:f5266ae5-1e38-4f76-9137-1fcf94ed59b8","source":"wordfence","cve":"CVE-2016-20063","title":"Simple Personal Message <= 1.0.3 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5266ae5-1e38-4f76-9137-1fcf94ed59b8?source=api-prod","affected":[{"type":"plugin","slug":"simple-personal-message","name":"Simple Personal Message","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-09T00:00:00Z","updated":"2026-07-29T16:04:30Z"},{"id":"wordfence:f527947c-af67-4b86-b28f-987fa4ec71d3","source":"wordfence","cve":"CVE-2026-84738","title":"AF Companion <= 2.1.0 - Authenticated (Shop Manager+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f527947c-af67-4b86-b28f-987fa4ec71d3?source=api-prod","affected":[{"type":"plugin","slug":"af-companion","name":"AF Companion \u2013 AI SEO, GEO, Alt Text, Performance & Site Health","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T18:38:10Z"},{"id":"wordfence:f5281d4b-c2cd-4972-b837-e101a8893c6e","source":"wordfence","cve":"CVE-2025-0470","title":"Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.38.2","to_inclusive":true,"patched_in":"1.38.3"}],"published":"2025-01-30T15:07:49Z","updated":"2025-01-31T03:21:29Z"},{"id":"wordfence:f528e0bd-ab4b-4d0b-b133-90bd1312479f","source":"wordfence","cve":"CVE-2026-32521","title":"WP Custom Admin Interface <= 7.42 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f528e0bd-ab4b-4d0b-b133-90bd1312479f?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-admin-interface","name":"WP Custom Admin Interface","from":"*","from_inclusive":true,"to":"7.42","to_inclusive":true,"patched_in":"7.43"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:38:08Z"},{"id":"wordfence:f5292c55-6445-4aec-b06e-6e625794d842","source":"wordfence","cve":"","title":"Slider, Gallery, and Carousel by MetaSlider <= 3.17.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5292c55-6445-4aec-b06e-6e625794d842?source=api-prod","affected":[{"type":"plugin","slug":"ml-slider","name":"Slider, Gallery, and Carousel by MetaSlider \u2013 Image Slider, Video Slider","from":"*","from_inclusive":true,"to":"3.17.2","to_inclusive":false,"patched_in":"3.17.2"}],"published":"2020-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f529b981-623f-4bd3-9155-ebfab4c65d1d","source":"wordfence","cve":"CVE-2024-7385","title":"WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection","severity":"critical","cvss":9.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f529b981-623f-4bd3-9155-ebfab4c65d1d?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.2"}],"published":"2024-09-24T15:19:19Z","updated":"2024-09-25T03:37:17Z"},{"id":"wordfence:f52a9da3-f8bb-4e52-9b4c-b8e5bbf077cb","source":"wordfence","cve":"CVE-2024-54229","title":"SV100 Companion <= 2.0.02 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52a9da3-f8bb-4e52-9b4c-b8e5bbf077cb?source=api-prod","affected":[{"type":"plugin","slug":"sv100-companion","name":"SV100 Companion","from":"*","from_inclusive":true,"to":"2.0.02","to_inclusive":true,"patched_in":""}],"published":"2025-12-05T00:00:00Z","updated":"2026-05-04T14:26:34Z"},{"id":"wordfence:f52aede5-21c3-46b9-800e-860a677a4b90","source":"wordfence","cve":"","title":"WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52aede5-21c3-46b9-800e-860a677a4b90?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"2.9.45","to_inclusive":true,"patched_in":"2.9.46"}],"published":"2017-03-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f52c1e84-3421-42f6-b8cd-db814c77f9f6","source":"wordfence","cve":"CVE-2025-39396","title":"JetReviews <= 2.3.6 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52c1e84-3421-42f6-b8cd-db814c77f9f6?source=api-prod","affected":[{"type":"plugin","slug":"jet-reviews","name":"JetReviews","from":"*","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"2.3.7"}],"published":"2025-04-18T00:00:00Z","updated":"2025-04-22T18:44:29Z"},{"id":"wordfence:f52c9317-9345-452a-915c-e9add31af783","source":"wordfence","cve":"CVE-2025-60096","title":"TheGem (Elementor) <= 5.10.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52c9317-9345-452a-915c-e9add31af783?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem - Creative Multi-Purpose & WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"5.10.5","to_inclusive":true,"patched_in":"5.10.5.1"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:18:51Z"},{"id":"wordfence:f52d5c44-4a5e-4a45-b622-66aa4e509fd8","source":"wordfence","cve":"","title":"Knews Multilingual Newsletters < 1.2.6 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52d5c44-4a5e-4a45-b622-66aa4e509fd8?source=api-prod","affected":[{"type":"plugin","slug":"knews","name":"Knews Multilingual Newsletters","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2012-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f52f1866-cd9d-4443-85c8-e0e7e50f3fbc","source":"wordfence","cve":"CVE-2025-64384","title":"JetFormBuilder <= 3.5.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52f1866-cd9d-4443-85c8-e0e7e50f3fbc?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2025-11-29T00:00:00Z","updated":"2025-12-01T17:30:22Z"},{"id":"wordfence:f52f6d55-d0f5-4eba-bc07-ed94bded8777","source":"wordfence","cve":"","title":"Sabai Discuss <= 1.4.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f52f6d55-d0f5-4eba-bc07-ed94bded8777?source=api-prod","affected":[{"type":"plugin","slug":"sabaisdiscuss","name":"Sabai Discuss","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.4.14"}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f530dced-01bc-4555-b84f-705d6049956b","source":"wordfence","cve":"CVE-2025-58015","title":"Quiz Maker <= 6.7.0.65 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f530dced-01bc-4555-b84f-705d6049956b?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.0.65","to_inclusive":true,"patched_in":"6.7.0.66"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-30T13:32:27Z"},{"id":"wordfence:f531489b-a87d-41e7-a988-8b29840047ec","source":"wordfence","cve":"CVE-2023-0540","title":"GS Filterable Portfolio <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f531489b-a87d-41e7-a988-8b29840047ec?source=api-prod","affected":[{"type":"plugin","slug":"gs-portfolio","name":"GS Portfolio \u2013 Filterable Portfolio, Portfolio Grid & Portfolio Slider","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5319467-92f6-4d4f-a76a-12aeb25d3c6b","source":"wordfence","cve":"CVE-2026-13457","title":"InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5319467-92f6-4d4f-a76a-12aeb25d3c6b?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.3.6","to_inclusive":true,"patched_in":"0.1.3.7"}],"published":"2026-08-11T06:27:45Z","updated":"2026-08-11T19:37:28Z"},{"id":"wordfence:f535777b-eae3-4ea7-86f2-b6edfe9ad5ab","source":"wordfence","cve":"CVE-2025-22676","title":"Upcasted S3 Offload \u2013 AWS S3, Digital Ocean Spaces, Backblaze, Minio and more <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f535777b-eae3-4ea7-86f2-b6edfe9ad5ab?source=api-prod","affected":[{"type":"plugin","slug":"upcasted-s3-offload","name":"Upcasted S3 Offload \u2013 AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-24T15:56:57Z"},{"id":"wordfence:f53700f8-9a9e-449c-8f7f-38724d74bd49","source":"wordfence","cve":"CVE-2025-66070","title":"wpForo Forum <= 2.4.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53700f8-9a9e-449c-8f7f-38724d74bd49?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2025-11-18T00:00:00Z","updated":"2025-12-20T19:53:45Z"},{"id":"wordfence:f5373990-27a8-4e6e-a392-1c86bd76511d","source":"wordfence","cve":"CVE-2025-48263","title":"MultiVendorX <= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5373990-27a8-4e6e-a392-1c86bd76511d?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"4.2.22","to_inclusive":true,"patched_in":"4.2.23"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:43:15Z"},{"id":"wordfence:f537ec0e-8f6a-42ba-b81a-d026ffa22a75","source":"wordfence","cve":"CVE-2026-81426","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f537ec0e-8f6a-42ba-b81a-d026ffa22a75?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.7.2.1","to_inclusive":false,"patched_in":"2.7.2.1"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:37:19Z"},{"id":"wordfence:f53875aa-9347-464c-aaeb-e8248628fca2","source":"wordfence","cve":"CVE-2022-0229","title":"miniOrange's Google Authenticator <= 5.4.52 - Unauthenticated Arbitrary Options Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53875aa-9347-464c-aaeb-e8248628fca2?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.4.52","to_inclusive":true,"patched_in":"5.5"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f53a22a3-d3c2-44c4-8e66-a9775b69b147","source":"wordfence","cve":"CVE-2025-31616","title":"Varnish WordPress <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53a22a3-d3c2-44c4-8e66-a9775b69b147?source=api-prod","affected":[{"type":"plugin","slug":"varnish-wp","name":"Varnish WordPress","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-08T18:33:48Z"},{"id":"wordfence:f53b6449-fefc-44f3-b44d-e92749876e1a","source":"wordfence","cve":"CVE-2026-81278","title":"Post SMTP \u2013 Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App  4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53b6449-fefc-44f3-b44d-e92749876e1a?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"4.0.0-beta.1","from_inclusive":true,"to":"4.0.0-beta.1","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-08-26T00:00:00Z","updated":"2026-09-02T15:29:24Z"},{"id":"wordfence:f53cd4a3-a6db-42c2-b4d8-218071c4bcd4","source":"wordfence","cve":"CVE-2023-41130","title":"Premmerce User Roles <= 1.0.12 - Missing Authorization via role management functions","severity":"high","cvss":8.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53cd4a3-a6db-42c2-b4d8-218071c4bcd4?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-user-roles","name":"Premmerce User Roles","from":"*","from_inclusive":true,"to":"1.0.12","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2023-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f53cf99e-3136-4a1d-bbbd-ff484f1df5c3","source":"wordfence","cve":"CVE-2025-9345","title":"File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53cf99e-3136-4a1d-bbbd-ff484f1df5c3?source=api-prod","affected":[{"type":"plugin","slug":"softdiscover-db-file-manager","name":"File Manager, Code Editor, and Backup by Managefy","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-08-27T14:40:26Z","updated":"2025-08-28T03:42:47Z"},{"id":"wordfence:f53d9579-56e9-41aa-b6b7-2472734ee719","source":"wordfence","cve":"CVE-2026-0722","title":"Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53d9579-56e9-41aa-b6b7-2472734ee719?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"21.0.8","to_inclusive":true,"patched_in":"21.0.10"}],"published":"2026-02-18T16:19:04Z","updated":"2026-02-19T04:36:29Z"},{"id":"wordfence:f53e5192-e809-400c-aed9-36b5d6415a9d","source":"wordfence","cve":"","title":"Orbit Fox by ThemeIsle <= 2.6.3 - Improper REST Capabilities Checks","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53e5192-e809-400c-aed9-36b5d6415a9d?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2018-11-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f53e9354-248f-4d13-a1c0-8355b268fae2","source":"wordfence","cve":"CVE-2023-0502","title":"WP News <= 1.1.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53e9354-248f-4d13-a1c0-8355b268fae2?source=api-prod","affected":[{"type":"plugin","slug":"wp-news-magazine","name":"WP News \u2013 WordPress News / Magazine Plugin","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2023-02-28T00:00:00Z","updated":"2024-11-27T14:06:51Z"},{"id":"wordfence:f53f35c4-6825-448f-a101-1439fdd63cfe","source":"wordfence","cve":"CVE-2026-12497","title":"ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f53f35c4-6825-448f-a101-1439fdd63cfe?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-avatar","name":"ProfilePress \u2013 Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content","from":"*","from_inclusive":true,"to":"4.16.17","to_inclusive":true,"patched_in":"4.16.18"}],"published":"2026-07-03T00:00:00Z","updated":"2026-07-30T13:05:23Z"},{"id":"wordfence:f5419189-692f-4966-9baf-016188cf133c","source":"wordfence","cve":"CVE-2026-24966","title":"Copyscape Premium <= 1.4.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5419189-692f-4966-9baf-016188cf133c?source=api-prod","affected":[{"type":"plugin","slug":"copyscape-premium","name":"Copyscape Premium","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2026-01-10T00:00:00Z","updated":"2026-02-10T19:31:11Z"},{"id":"wordfence:f543b7b2-4cc9-4152-8885-a166b969a937","source":"wordfence","cve":"CVE-2024-33688","title":"Teluro <= 1.0.31 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f543b7b2-4cc9-4152-8885-a166b969a937?source=api-prod","affected":[{"type":"theme","slug":"teluro","name":"Teluro","from":"*","from_inclusive":true,"to":"1.0.31","to_inclusive":true,"patched_in":"1.0.36"}],"published":"2024-04-26T00:00:00Z","updated":"2026-05-07T13:43:48Z"},{"id":"wordfence:f5442453-6b72-4c8b-8b9f-59b8536aac73","source":"wordfence","cve":"CVE-2021-25043","title":"WOOCS <= 1.3.7.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5442453-6b72-4c8b-8b9f-59b8536aac73?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-currency-switcher","name":"FOX \u2013 Currency Switcher Professional for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7.2","to_inclusive":true,"patched_in":"1.3.7.3"}],"published":"2021-12-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f54527ce-8137-4ba9-b4e6-52cea6cfe2da","source":"wordfence","cve":"CVE-2017-6577","title":"Mail Masta <= 1.0 - SQL Injection via list_id parameter","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f54527ce-8137-4ba9-b4e6-52cea6cfe2da?source=api-prod","affected":[{"type":"plugin","slug":"mail-masta","name":"Mail Masta","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2017-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5492bff-cfd9-41ed-a59b-4445d5e83e86","source":"wordfence","cve":"CVE-2021-4383","title":"WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5492bff-cfd9-41ed-a59b-4445d5e83e86?source=api-prod","affected":[{"type":"plugin","slug":"wp-quick-front-end-editor","name":"WP Quick FrontEnd Editor \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2021-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f54cdad2-88db-4604-8064-fa6175176760","source":"wordfence","cve":"CVE-2024-3200","title":"wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f54cdad2-88db-4604-8064-fa6175176760?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2024-05-31T19:39:04Z","updated":"2024-06-01T08:38:58Z"},{"id":"wordfence:f54e358c-3bdf-426a-854a-d1bc8ff19afd","source":"wordfence","cve":"CVE-2026-96572","title":"WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f54e358c-3bdf-426a-854a-d1bc8ff19afd?source=api-prod","affected":[{"type":"plugin","slug":"wp-meteor","name":"WP Meteor Website Speed Optimization Addon","from":"*","from_inclusive":true,"to":"3.4.18","to_inclusive":true,"patched_in":"3.4.19"}],"published":"2026-10-09T18:28:39Z","updated":"2026-10-10T06:40:16Z"},{"id":"wordfence:f54f1e41-788b-45e5-b84f-06e664f5c597","source":"wordfence","cve":"CVE-2024-32101","title":"Email Marketing for WooCommerce by Omnisend <= 1.14.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f54f1e41-788b-45e5-b84f-06e664f5c597?source=api-prod","affected":[{"type":"plugin","slug":"omnisend-connect","name":"Email Marketing for WooCommerce by Omnisend","from":"*","from_inclusive":true,"to":"1.14.3","to_inclusive":true,"patched_in":"1.14.4"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T19:09:19Z"},{"id":"wordfence:f5500911-52cf-43b5-a15e-e8db5bedd5af","source":"wordfence","cve":"","title":"Real Cookie Banner <= 2.18.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5500911-52cf-43b5-a15e-e8db5bedd5af?source=api-prod","affected":[{"type":"plugin","slug":"real-cookie-banner","name":"Real Cookie Banner: GDPR & ePrivacy Cookie Consent","from":"*","from_inclusive":true,"to":"2.18.1","to_inclusive":true,"patched_in":"2.18.2"}],"published":"2022-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5524582-5aac-48b4-ad67-7c4829d63ed0","source":"wordfence","cve":"CVE-2024-10247","title":"YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5524582-5aac-48b4-ad67-7c4829d63ed0?source=api-prod","affected":[{"type":"plugin","slug":"gallery-videos","name":"Video Gallery \u2013 YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-12-05T14:39:29Z","updated":"2024-12-06T03:25:41Z"},{"id":"wordfence:f5531449-c70f-488f-95ee-5208138968d1","source":"wordfence","cve":"CVE-2022-2351","title":"Post SMTP Mailer/Email Log <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5531449-c70f-488f-95ee-5208138968d1?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2022-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f553397c-c1f7-41e9-b14a-cd1a01dd6f8e","source":"wordfence","cve":"CVE-2026-86790","title":"WP Highlight Box <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f553397c-c1f7-41e9-b14a-cd1a01dd6f8e?source=api-prod","affected":[{"type":"plugin","slug":"wp-highlight-box","name":"WP Highlight Box","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-09-12T00:00:00Z","updated":"2026-09-15T20:01:08Z"},{"id":"wordfence:f557ddf1-cee3-498c-87bc-fa81bf574591","source":"wordfence","cve":"CVE-2024-23518","title":"ACF Photo Gallery Field <= 2.6 - Missing Authorization in apgf_update_donation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f557ddf1-cee3-498c-87bc-fa81bf574591?source=api-prod","affected":[{"type":"plugin","slug":"navz-photo-gallery","name":"ACF Photo Gallery Field","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2024-01-30T00:00:00Z","updated":"2024-02-13T12:13:26Z"},{"id":"wordfence:f55a9d35-596c-4207-be11-ade1127df369","source":"wordfence","cve":"CVE-2022-0181","title":"Quiz And Survey Master <= 7.3.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f55a9d35-596c-4207-be11-ade1127df369?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.3.6","to_inclusive":true,"patched_in":"7.3.7"}],"published":"2022-01-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f55af49e-82c8-462b-8c0b-a25e966a27af","source":"wordfence","cve":"","title":"Complianz - GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via cmplz_delete_cookiebanner","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f55af49e-82c8-462b-8c0b-a25e966a27af?source=api-prod","affected":[{"type":"plugin","slug":"complianz-gdpr","name":"Complianz GDPR/CCPA Cookie Consent Banner","from":"*","from_inclusive":true,"to":"6.4.4","to_inclusive":true,"patched_in":"6.4.5"}],"published":"2023-05-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f55c004a-366b-4555-9b3c-e2172a2e7f56","source":"wordfence","cve":"CVE-2024-7758","title":"Stylish Price List <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f55c004a-366b-4555-9b3c-e2172a2e7f56?source=api-prod","affected":[{"type":"plugin","slug":"stylish-price-list","name":"Stylish Price List \u2013 Price Table Builder & QR Code Restaurant Menu","from":"*","from_inclusive":true,"to":"7.1.7","to_inclusive":true,"patched_in":"7.1.8"}],"published":"2024-09-13T00:00:00Z","updated":"2025-05-30T18:25:11Z"},{"id":"wordfence:f55cba37-a9e9-459b-9487-3df532fc8bcc","source":"wordfence","cve":"CVE-2025-69109","title":"Raider Spirit <= 1.1.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f55cba37-a9e9-459b-9487-3df532fc8bcc?source=api-prod","affected":[{"type":"theme","slug":"raiderspirit","name":"raiderspirit","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-09-18T14:37:55Z"},{"id":"wordfence:f55e0471-664c-4fb4-8776-0c8312d8327b","source":"wordfence","cve":"CVE-2023-23655","title":"MainWP Code Snippets Extension <= 4.0.2 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f55e0471-664c-4fb4-8776-0c8312d8327b?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-code-snippets-extension","name":"MainWP Code Snippets Extension","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5608f50-e17a-471f-b644-dceb64d82f0c","source":"wordfence","cve":"CVE-2023-5076","title":"Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5608f50-e17a-471f-b644-dceb64d82f0c?source=api-prod","affected":[{"type":"plugin","slug":"ziteboard-online-whiteboard","name":"Ziteboard Online Whiteboard","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f56259cf-7d3a-441d-9078-372b84e9ff7f","source":"wordfence","cve":"CVE-2025-31759","title":"Boo Recipes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f56259cf-7d3a-441d-9078-372b84e9ff7f?source=api-prod","affected":[{"type":"plugin","slug":"boo-recipes","name":"Boo Recipes","from":"*","from_inclusive":true,"to":"2.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:43:00Z"},{"id":"wordfence:f563412d-5708-43c4-a44e-7645c5b4f835","source":"wordfence","cve":"CVE-2026-14830","title":"FlxWoo < 3.1.1 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f563412d-5708-43c4-a44e-7645c5b4f835?source=api-prod","affected":[{"type":"plugin","slug":"flx-woo","name":"FlxWoo","from":"*","from_inclusive":true,"to":"3.1.1","to_inclusive":false,"patched_in":"3.1.1"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:36:23Z"},{"id":"wordfence:f563b9ee-f33c-4d51-9db7-a3005c290fa7","source":"wordfence","cve":"CVE-2026-32439","title":"BigHearts <= 3.1.14 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f563b9ee-f33c-4d51-9db7-a3005c290fa7?source=api-prod","affected":[{"type":"theme","slug":"bighearts","name":"BigHearts - Charity & Donation WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.14","to_inclusive":true,"patched_in":"3.1.15"}],"published":"2026-03-02T00:00:00Z","updated":"2026-05-05T14:52:27Z"},{"id":"wordfence:f563c012-e3e1-4bef-bb82-213b00d3cb6f","source":"wordfence","cve":"CVE-2026-96352","title":"YITH WooCommerce Ajax Search <= 2.28.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f563c012-e3e1-4bef-bb82-213b00d3cb6f?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-ajax-search","name":"YITH WooCommerce Ajax Search","from":"*","from_inclusive":true,"to":"2.28.0","to_inclusive":true,"patched_in":"2.28.1"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:35:53Z"},{"id":"wordfence:f56494b7-0552-42d3-b3c6-fe26096f6cf5","source":"wordfence","cve":"CVE-2024-32817","title":"Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f56494b7-0552-42d3-b3c6-fe26096f6cf5?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"1.26.2","to_inclusive":true,"patched_in":"1.26.3"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T17:23:57Z"},{"id":"wordfence:f5698128-f76d-4be4-8d5a-fb465b202d52","source":"wordfence","cve":"CVE-2025-23885","title":"MJ Contact us <= 5.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5698128-f76d-4be4-8d5a-fb465b202d52?source=api-prod","affected":[{"type":"plugin","slug":"mj-contact-us","name":"MJ Contact us","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:25:53Z"},{"id":"wordfence:f56a1306-d1e2-4731-81a7-9c95ff26ca71","source":"wordfence","cve":"CVE-2025-58006","title":"WP Gravity Forms Keap/Infusionsoft <= 1.2.6 - Open Redirect","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f56a1306-d1e2-4731-81a7-9c95ff26ca71?source=api-prod","affected":[{"type":"plugin","slug":"gf-infusionsoft","name":"WP Gravity Forms Keap/Infusionsoft","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-09-22T00:00:00Z","updated":"2026-02-26T15:27:31Z"},{"id":"wordfence:f56a632d-4c5f-4d89-9cd9-8fc3697ff3ca","source":"wordfence","cve":"","title":"Membership by Supsystic <= 1.5.0 - Authenticated (Admin+) Time-Based Blind SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f56a632d-4c5f-4d89-9cd9-8fc3697ff3ca?source=api-prod","affected":[{"type":"plugin","slug":"membership-by-supsystic","name":"Membership by Supsystic","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2021-02-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f570a9d2-41d7-42f2-9f13-4cda97ea2219","source":"wordfence","cve":"CVE-2026-39584","title":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress <= 4.1132 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f570a9d2-41d7-42f2-9f13-4cda97ea2219?source=api-prod","affected":[{"type":"plugin","slug":"computer-repair-shop","name":"RepairBuddy \u2013 Repair Shop CRM & Booking Plugin for WordPress","from":"*","from_inclusive":true,"to":"4.1132","to_inclusive":true,"patched_in":"4.1133"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:01:53Z"},{"id":"wordfence:f5733a60-8078-48ed-9395-ea79b4199f7e","source":"wordfence","cve":"CVE-2021-24756","title":"WP System Log < 1.0.21 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5733a60-8078-48ed-9395-ea79b4199f7e?source=api-prod","affected":[{"type":"plugin","slug":"winterlock","name":"Activity Log for WordPress","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":false,"patched_in":"1.0.21"}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5733ed6-a6f8-40f1-80b2-ab09fca02791","source":"wordfence","cve":"CVE-2025-66125","title":"Ultimate Auction <= 4.3.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5733ed6-a6f8-40f1-80b2-ab09fca02791?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-auction","name":"Ultimate WordPress Auction","from":"*","from_inclusive":true,"to":"4.3.3","to_inclusive":true,"patched_in":"4.3.4"}],"published":"2025-12-12T00:00:00Z","updated":"2026-08-14T15:16:00Z"},{"id":"wordfence:f5740c07-28b3-40ce-997e-e4ec76348cf4","source":"wordfence","cve":"CVE-2023-45605","title":"Feed Statistics <= 4.1 - Cross-Site Request Forgery via init","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5740c07-28b3-40ce-997e-e4ec76348cf4?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-feed-statistics","name":"Feed Statistics","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5779c73-0188-4b8c-9f1d-7d00d234a334","source":"wordfence","cve":"CVE-2024-6075","title":"WP eStore <= 8.5.4 - Cross-Site Request Forgery to Coupon Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5779c73-0188-4b8c-9f1d-7d00d234a334?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.4","to_inclusive":true,"patched_in":"8.5.5"}],"published":"2024-06-24T00:00:00Z","updated":"2024-07-01T14:44:52Z"},{"id":"wordfence:f57b8ed5-f7cf-451b-b6ee-346b6c92d60b","source":"wordfence","cve":"CVE-2024-43162","title":"Easy Digital Downloads <= 3.2.12 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f57b8ed5-f7cf-451b-b6ee-346b6c92d60b?source=api-prod","affected":[{"type":"plugin","slug":"easy-digital-downloads","name":"Easy Digital Downloads \u2013 eCommerce Payments and Subscriptions made easy","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T14:37:46Z"},{"id":"wordfence:f57cac64-c8c7-45c9-8079-2a727ee30872","source":"wordfence","cve":"CVE-2025-63011","title":"Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f57cac64-c8c7-45c9-8079-2a727ee30872?source=api-prod","affected":[{"type":"plugin","slug":"wp-hotel-booking","name":"WP Hotel Booking","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-11-05T00:00:00Z","updated":"2026-02-26T15:26:49Z"},{"id":"wordfence:f57d99dc-3faa-4dfc-9cb6-fdb5647daf9a","source":"wordfence","cve":"CVE-2025-9886","title":"Trinity Audio <= 5.20.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f57d99dc-3faa-4dfc-9cb6-fdb5647daf9a?source=api-prod","affected":[{"type":"plugin","slug":"trinity-audio","name":"Trinity Audio \u2013 Text to Speech AI audio player to convert content into audio","from":"*","from_inclusive":true,"to":"5.20.2","to_inclusive":true,"patched_in":"5.21.0"}],"published":"2025-10-03T00:00:00Z","updated":"2025-10-04T03:33:32Z"},{"id":"wordfence:f57dc0fe-07f3-457e-8080-fe530f6a9f01","source":"wordfence","cve":"CVE-2024-5615","title":"Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f57dc0fe-07f3-457e-8080-fe530f6a9f01?source=api-prod","affected":[{"type":"plugin","slug":"opengraph","name":"Open Graph","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.11.3"}],"published":"2024-06-04T00:00:00Z","updated":"2024-06-06T03:32:57Z"},{"id":"wordfence:f57ee188-2fdf-402f-b712-80de0d6f7f8d","source":"wordfence","cve":"CVE-2024-56010","title":"Device Detector <= 4.2.0 - Reflected Cross-Site Scripting via id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f57ee188-2fdf-402f-b712-80de0d6f7f8d?source=api-prod","affected":[{"type":"plugin","slug":"device-detector","name":"Device Detector","from":"*","from_inclusive":true,"to":"4.2.0","to_inclusive":true,"patched_in":"4.2.1"}],"published":"2024-12-14T00:00:00Z","updated":"2024-12-19T12:22:22Z"},{"id":"wordfence:f582457e-5182-405c-b6c0-7d90241247ce","source":"wordfence","cve":"CVE-2026-110015","title":"Salon Booking System <= 10.31.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f582457e-5182-405c-b6c0-7d90241247ce?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.8","to_inclusive":true,"patched_in":"10.31.9"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-23T18:15:23Z"},{"id":"wordfence:f582eb1d-fcd0-4758-9922-969f8eb6efea","source":"wordfence","cve":"CVE-2007-4154","title":"WordPress Core <= 2.2.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f582eb1d-fcd0-4758-9922-969f8eb6efea?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"},{"type":"core","slug":"wordpress","name":"WordPress","from":"2.2","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2007-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f584a439-3373-441c-a73e-5931ae63e7ae","source":"wordfence","cve":"CVE-2025-5539","title":"Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f584a439-3373-441c-a73e-5931ae63e7ae?source=api-prod","affected":[{"type":"plugin","slug":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress \u2013 WP Easy Contact","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2025-06-03T00:00:00Z","updated":"2025-07-30T08:23:08Z"},{"id":"wordfence:f5863132-90a7-414f-abcb-e8b6a9d229c5","source":"wordfence","cve":"CVE-2026-1454","title":"Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5863132-90a7-414f-abcb-e8b6a9d229c5?source=api-prod","affected":[{"type":"plugin","slug":"lead-form-builder","name":"Lead Form Builder & Contact Form","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-11T08:24:47Z"},{"id":"wordfence:f5867f37-ae58-4f75-828e-bb99b3e5252e","source":"wordfence","cve":"","title":"Currency Switcher for WordPress <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5867f37-ae58-4f75-828e-bb99b3e5252e?source=api-prod","affected":[{"type":"plugin","slug":"advanced-currency-switcher","name":"Currency Switcher for WordPress","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2022-06-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f586a89a-7d1f-48ef-bbf6-0c78154bccbc","source":"wordfence","cve":"CVE-2026-121977","title":"JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f586a89a-7d1f-48ef-bbf6-0c78154bccbc?source=api-prod","affected":[{"type":"plugin","slug":"jetformbuilder","name":"JetFormBuilder \u2014 Dynamic Blocks Form Builder","from":"*","from_inclusive":true,"to":"3.6.8","to_inclusive":true,"patched_in":"3.6.8.1"}],"published":"2026-11-06T21:49:06Z","updated":"2026-11-07T11:26:36Z"},{"id":"wordfence:f5880581-3505-4851-b32f-cd2873072f73","source":"wordfence","cve":"CVE-2023-28790","title":"Simple Staff List <= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5880581-3505-4851-b32f-cd2873072f73?source=api-prod","affected":[{"type":"plugin","slug":"simple-staff-list","name":"Simple Staff List","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f58b3971-e1e4-4337-82a3-99c9079c6696","source":"wordfence","cve":"CVE-2024-13708","title":"Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f58b3971-e1e4-4337-82a3-99c9079c6696?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"4.0.1","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-04-03T16:34:51Z","updated":"2025-04-04T05:22:49Z"},{"id":"wordfence:f58d5464-b12d-4d01-985a-68854b0b2fdd","source":"wordfence","cve":"CVE-2024-28890","title":"Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f58d5464-b12d-4d01-985a-68854b0b2fdd?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.28.1","to_inclusive":true,"patched_in":"1.29.0"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-24T13:05:25Z"},{"id":"wordfence:f58efd6c-58f2-464b-8aaf-f4f5c4c52f09","source":"wordfence","cve":"CVE-2023-47644","title":"ProfileGrid  <= 5.7.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f58efd6c-58f2-464b-8aaf-f4f5c4c52f09?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.7.2"}],"published":"2023-11-07T00:00:00Z","updated":"2024-05-15T17:51:52Z"},{"id":"wordfence:f58f994e-0a9b-4b40-9e38-535169c793d3","source":"wordfence","cve":"CVE-2022-40203","title":"Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization in ajaxCalculateSeveralProducts function","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f58f994e-0a9b-4b40-9e38-535169c793d3?source=api-prod","affected":[{"type":"plugin","slug":"advanced-dynamic-pricing-for-woocommerce","name":"Advanced Dynamic Pricing and Discount Rules for WooCommerce","from":"*","from_inclusive":true,"to":"4.1.5","to_inclusive":true,"patched_in":"4.1.6"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f58fac2a-d1f3-47f2-8abb-afe11ae2689a","source":"wordfence","cve":"CVE-2025-31781","title":"Gift Cards for WooCommerce <= 1.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f58fac2a-d1f3-47f2-8abb-afe11ae2689a?source=api-prod","affected":[{"type":"plugin","slug":"woo-giftcards","name":"Gift Cards for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T15:33:08Z"},{"id":"wordfence:f59004bb-b026-4137-a332-f46a09237e7b","source":"wordfence","cve":"","title":"Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59004bb-b026-4137-a332-f46a09237e7b?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5925251-302a-4132-80ea-21ebc0c65944","source":"wordfence","cve":"CVE-2025-68904","title":"JNews - Frontend Submit <= 11.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5925251-302a-4132-80ea-21ebc0c65944?source=api-prod","affected":[{"type":"plugin","slug":"jnews-frontend-submit","name":"JNews - Frontend Submit","from":"*","from_inclusive":true,"to":"11.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-20T16:27:45Z"},{"id":"wordfence:f592a397-5de5-431a-b680-1262b521f32d","source":"wordfence","cve":"CVE-2025-58027","title":"NGG Smart Image Search <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f592a397-5de5-431a-b680-1262b521f32d?source=api-prod","affected":[{"type":"plugin","slug":"ngg-smart-image-search","name":"NGG Smart Image Search","from":"*","from_inclusive":true,"to":"3.4.3","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-08-14T15:15:36Z"},{"id":"wordfence:f5944f62-845b-40a9-af2f-c7ee815e811d","source":"wordfence","cve":"CVE-2025-64234","title":"Evergreen Content Poster <= 1.4.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5944f62-845b-40a9-af2f-c7ee815e811d?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":"1.4.6"}],"published":"2025-04-22T00:00:00Z","updated":"2025-11-04T15:37:25Z"},{"id":"wordfence:f59891c7-db1a-4688-8616-8877d7d7960d","source":"wordfence","cve":"CVE-2024-8275","title":"The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59891c7-db1a-4688-8616-8877d7d7960d?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.6.4","to_inclusive":true,"patched_in":"6.6.4.1"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T04:30:30Z"},{"id":"wordfence:f5998b77-3f38-4e60-a76e-d1d7e635313f","source":"wordfence","cve":"CVE-2026-103376","title":"PeachPay 1.117.9 - 1.120.69 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5998b77-3f38-4e60-a76e-d1d7e635313f?source=api-prod","affected":[{"type":"plugin","slug":"peachpay-for-woocommerce","name":"PeachPay \u2014 Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)","from":"1.117.9","from_inclusive":true,"to":"1.120.69","to_inclusive":true,"patched_in":"1.120.70"}],"published":"2026-10-15T00:00:00Z","updated":"2026-10-23T18:17:15Z"},{"id":"wordfence:f59ccb78-722b-490b-874e-7026afc3511b","source":"wordfence","cve":"CVE-2024-9212","title":"SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59ccb78-722b-490b-874e-7026afc3511b?source=api-prod","affected":[{"type":"plugin","slug":"sku-for-woocommerce","name":"SKU Generator for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2025-02-28T15:27:18Z","updated":"2025-03-10T14:16:09Z"},{"id":"wordfence:f59cf3d6-06a0-42ec-a604-5f59c6b2be40","source":"wordfence","cve":"","title":"Razorpay for WooCommerce <= 4.5.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59cf3d6-06a0-42ec-a604-5f59c6b2be40?source=api-prod","affected":[{"type":"plugin","slug":"woo-razorpay","name":"Razorpay for WooCommerce","from":"*","from_inclusive":true,"to":"4.5.6","to_inclusive":true,"patched_in":"4.5.7"}],"published":"2023-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f59d9d8a-467a-4920-963a-da45f1f4462f","source":"wordfence","cve":"CVE-2024-12061","title":"Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59d9d8a-467a-4920-963a-da45f1f4462f?source=api-prod","affected":[{"type":"plugin","slug":"events-addon-for-elementor","name":"Events Addon for Elementor","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T03:22:08Z"},{"id":"wordfence:f59f2983-722d-4243-9a0c-e0f72c22e4fe","source":"wordfence","cve":"CVE-2025-53337","title":"LifePress <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f59f2983-722d-4243-9a0c-e0f72c22e4fe?source=api-prod","affected":[{"type":"plugin","slug":"lifepress","name":"LifePress","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-08-20T00:00:00Z","updated":"2026-01-06T19:27:53Z"},{"id":"wordfence:f5a07b22-e2c4-4103-96d0-28ecf856dab0","source":"wordfence","cve":"CVE-2026-19708","title":"File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a07b22-e2c4-4103-96d0-28ecf856dab0?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-manager","name":"File Manager","from":"7.2.2","from_inclusive":true,"to":"8.0.4","to_inclusive":true,"patched_in":"8.0.5"}],"published":"2026-09-24T00:00:00Z","updated":"2026-10-01T12:21:14Z"},{"id":"wordfence:f5a1c6bb-2054-40ad-b7fc-0a868b2c5eab","source":"wordfence","cve":"CVE-2025-31729","title":"WooTumblog <= 2.1.4 - Missing Authorization to Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a1c6bb-2054-40ad-b7fc-0a868b2c5eab?source=api-prod","affected":[{"type":"plugin","slug":"woo-tumblog","name":"WooTumblog","from":"*","from_inclusive":true,"to":"2.1.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-10T13:35:36Z"},{"id":"wordfence:f5a37df3-001b-4acd-91b1-7961896fb71f","source":"wordfence","cve":"CVE-2024-32581","title":"Mortgage Calculators WP <= 1.56 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a37df3-001b-4acd-91b1-7961896fb71f?source=api-prod","affected":[{"type":"plugin","slug":"mortgage-calculators-wp","name":"Mortgage Calculators WP","from":"*","from_inclusive":true,"to":"1.56","to_inclusive":true,"patched_in":"1.60"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:40:17Z"},{"id":"wordfence:f5a4a017-52d7-44a5-b00f-ce13eda989bc","source":"wordfence","cve":"CVE-2022-2935","title":"Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a4a017-52d7-44a5-b00f-ce13eda989bc?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects-ultimate","name":"Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )","from":"*","from_inclusive":true,"to":"9.7.3","to_inclusive":true,"patched_in":"9.8.0"}],"published":"2022-08-31T00:00:00Z","updated":"2025-03-17T13:41:48Z"},{"id":"wordfence:f5a54d1d-3593-4ba1-a747-651278488be6","source":"wordfence","cve":"CVE-2024-8051","title":"Special Feed Items <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a54d1d-3593-4ba1-a747-651278488be6?source=api-prod","affected":[{"type":"plugin","slug":"special-feed-items","name":"Special Feed Items","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-08-27T00:00:00Z","updated":"2024-08-28T21:56:54Z"},{"id":"wordfence:f5a5ba98-5fe2-48d6-b1fa-22cb6da1cbed","source":"wordfence","cve":"CVE-2026-25394","title":"Fitness FSE <= 1.0.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a5ba98-5fe2-48d6-b1fa-22cb6da1cbed?source=api-prod","affected":[{"type":"theme","slug":"fitness-fse","name":"Fitness FSE","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-30T00:00:00Z","updated":"2026-02-26T19:53:19Z"},{"id":"wordfence:f5a71d0a-e00f-4794-acc2-834334d5b336","source":"wordfence","cve":"","title":"Easy Social Share Buttons for WordPress <= 3.4.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a71d0a-e00f-4794-acc2-834334d5b336?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-share-buttons-for-wordpress","name":"Easy Social Share Buttons for WordPress","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":false,"patched_in":"3.5"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5a7aa18-b6a9-4cd1-a502-25c0888ac227","source":"wordfence","cve":"CVE-2026-61973","title":"ShopLentor Pro <= 2.8.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a7aa18-b6a9-4cd1-a502-25c0888ac227?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons-pro","name":"ShopLentor Pro","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-04T19:51:56Z"},{"id":"wordfence:f5a827b1-7f66-4a24-9e31-c3f3e36b4772","source":"wordfence","cve":"","title":"Google Maps in Posts <= 1.5.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a827b1-7f66-4a24-9e31-c3f3e36b4772?source=api-prod","affected":[{"type":"plugin","slug":"google-maps-in-posts","name":"Google Maps in Posts","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5a87c5c-9871-464f-850e-64141cc050ef","source":"wordfence","cve":"CVE-2025-47459","title":"WP Fundraising Donation and Crowdfunding Platform <= 1.7.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a87c5c-9871-464f-850e-64141cc050ef?source=api-prod","affected":[{"type":"plugin","slug":"wp-fundraising-donation","name":"FundEngine \u2013 Donation and Crowdfunding Platform","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:55:00Z"},{"id":"wordfence:f5a9d976-5dee-437e-9fdf-1edffb8574b7","source":"wordfence","cve":"CVE-2025-68565","title":"Twitch Player <= 2.1.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5a9d976-5dee-437e-9fdf-1edffb8574b7?source=api-prod","affected":[{"type":"plugin","slug":"ttv-easy-embed-player","name":"Twitch Player","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-19T00:00:00Z","updated":"2026-01-05T18:51:34Z"},{"id":"wordfence:f5ab09ee-53d2-4d99-824b-6a7a006bb2c2","source":"wordfence","cve":"CVE-2026-13423","title":"Streamit <= 4.5.0 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ab09ee-53d2-4d99-824b-6a7a006bb2c2?source=api-prod","affected":[{"type":"theme","slug":"streamit","name":"Streamit","from":"*","from_inclusive":true,"to":"4.5.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-08T00:00:00Z","updated":"2026-08-07T18:23:04Z"},{"id":"wordfence:f5ab7d3e-b0c8-4e30-942b-23d91daff2ac","source":"wordfence","cve":"CVE-2023-28773","title":"Secondary Title <= 2.0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ab7d3e-b0c8-4e30-942b-23d91daff2ac?source=api-prod","affected":[{"type":"plugin","slug":"secondary-title","name":"Secondary Title","from":"*","from_inclusive":true,"to":"2.0.9.1","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5ac3714-27f1-4258-a1ab-12b969b31793","source":"wordfence","cve":"CVE-2023-23798","title":"Layer Slider <= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ac3714-27f1-4258-a1ab-12b969b31793?source=api-prod","affected":[{"type":"plugin","slug":"slider-slideshow","name":"Layer Slider","from":"*","from_inclusive":true,"to":"1.1.9.7","to_inclusive":true,"patched_in":""}],"published":"2023-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5ace7fb-530e-4a69-bbf7-e2c66491dd75","source":"wordfence","cve":"CVE-2025-2225","title":"Responsive Addons for Elementor \u2013 Free Elementor Addons Plugin and Elementor Templates <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ace7fb-530e-4a69-bbf7-e2c66491dd75?source=api-prod","affected":[{"type":"plugin","slug":"responsive-addons-for-elementor","name":"Responsive Addons for Elementor \u2013 Free Elementor Addons, Kits and Elementor Templates","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":"1.6.9.1"}],"published":"2025-04-14T00:00:00Z","updated":"2025-06-11T20:04:10Z"},{"id":"wordfence:f5ad74c5-93ba-414c-98ad-0987547f172f","source":"wordfence","cve":"","title":"Simple Download Monitor <= 3.2.8 - Missing Authorization","severity":"critical","cvss":9.9,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ad74c5-93ba-414c-98ad-0987547f172f?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":true,"patched_in":"3.2.9"}],"published":"2016-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5af155b-b65e-4cb1-a748-fc0fc5c6176d","source":"wordfence","cve":"CVE-2026-6711","title":"Website LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5af155b-b65e-4cb1-a748-fc0fc5c6176d?source=api-prod","affected":[{"type":"plugin","slug":"website-llms-txt","name":"Website LLMs.txt","from":"*","from_inclusive":true,"to":"8.2.6","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-21T06:44:02Z"},{"id":"wordfence:f5af4aa1-e384-4bc2-a9d2-67e4685eea4e","source":"wordfence","cve":"CVE-2025-68913","title":"Miion <= 1.2.7 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5af4aa1-e384-4bc2-a9d2-67e4685eea4e?source=api-prod","affected":[{"type":"theme","slug":"miion","name":"Miion | Multi-Purpose WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T00:00:00Z","updated":"2026-01-19T21:00:04Z"},{"id":"wordfence:f5afe6ea-93b8-4782-8593-76468e370a45","source":"wordfence","cve":"CVE-2023-7070","title":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5afe6ea-93b8-4782-8593-76468e370a45?source=api-prod","affected":[{"type":"plugin","slug":"email-encoder-bundle","name":"Email Encoder \u2013 Protect Email Addresses and Phone Numbers","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.1.10"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:37:48Z"},{"id":"wordfence:f5b00784-9120-403d-9788-3cd3c3c020aa","source":"wordfence","cve":"CVE-2022-47141","title":"WP Dynamic Keywords Injector <= 2.3.15 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b00784-9120-403d-9788-3cd3c3c020aa?source=api-prod","affected":[{"type":"plugin","slug":"wp-dynamic-keywords-injector","name":"WP Dynamic Keywords Injector","from":"*","from_inclusive":true,"to":"2.3.15","to_inclusive":true,"patched_in":"2.3.16"}],"published":"2023-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5b08a10-f6bc-44a0-865a-5ad71a1772f7","source":"wordfence","cve":"","title":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b08a10-f6bc-44a0-865a-5ad71a1772f7?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2023-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5b17c94-995a-458a-b712-3388a7144e14","source":"wordfence","cve":"CVE-2026-22368","title":"Redy <= 1.0.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b17c94-995a-458a-b712-3388a7144e14?source=api-prod","affected":[{"type":"theme","slug":"redy","name":"redy","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:30:54Z"},{"id":"wordfence:f5b18726-a880-4e06-8f33-77aea7323000","source":"wordfence","cve":"CVE-2025-23955","title":"Xola <= 1.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b18726-a880-4e06-8f33-77aea7323000?source=api-prod","affected":[{"type":"plugin","slug":"xola-bookings-for-tours-activities","name":"Xola","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:26:33Z"},{"id":"wordfence:f5b21bbe-32d9-4054-99ff-8f272556eda9","source":"wordfence","cve":"","title":"Snow Storm <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b21bbe-32d9-4054-99ff-8f272556eda9?source=api-prod","affected":[{"type":"plugin","slug":"snow-storm","name":"Snow Storm","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-18T18:13:50Z"},{"id":"wordfence:f5b28fc2-4551-46dc-baa4-29ff19a1bf77","source":"wordfence","cve":"","title":"Social Discussions <= 6.1.1 - Remote File Inclusion and Full Path Disclosure","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b28fc2-4551-46dc-baa4-29ff19a1bf77?source=api-prod","affected":[{"type":"plugin","slug":"social-discussions","name":"Social Discussions","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.1.2"}],"published":"2012-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5b8d39c-d307-42c9-a972-29b5521a82a4","source":"wordfence","cve":"CVE-2022-3622","title":"Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update","severity":"medium","cvss":4.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b8d39c-d307-42c9-a972-29b5521a82a4?source=api-prod","affected":[{"type":"plugin","slug":"blog2social","name":"Blog2Social: Social Media Auto Post & Scheduler","from":"*","from_inclusive":true,"to":"6.9.11","to_inclusive":true,"patched_in":"6.9.12"}],"published":"2022-09-27T00:00:00Z","updated":"2024-10-24T19:22:57Z"},{"id":"wordfence:f5b96c66-92b5-42cf-8b65-7874ff5fdccb","source":"wordfence","cve":"CVE-2026-110382","title":"Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b96c66-92b5-42cf-8b65-7874ff5fdccb?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.12.35","to_inclusive":true,"patched_in":"1.6.12.37"}],"published":"2026-10-16T10:36:49Z","updated":"2026-10-23T18:35:41Z"},{"id":"wordfence:f5ba832e-98bc-421d-9b60-e6260c408815","source":"wordfence","cve":"CVE-2024-3340","title":"Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ba832e-98bc-421d-9b60-e6260c408815?source=api-prod","affected":[{"type":"plugin","slug":"colibri-page-builder","name":"Colibri Page Builder","from":"*","from_inclusive":true,"to":"1.0.272","to_inclusive":true,"patched_in":"1.0.274"}],"published":"2024-04-22T00:00:00Z","updated":"2024-05-02T16:52:52Z"},{"id":"wordfence:f5ba8c79-1093-43aa-8273-2dbbe3172fec","source":"wordfence","cve":"CVE-2024-13118","title":"IP Based Login <= 2.4.0 - Cross-Site Request forgery to Log Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ba8c79-1093-43aa-8273-2dbbe3172fec?source=api-prod","affected":[{"type":"plugin","slug":"ip-based-login","name":"IP Based Login","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":true,"patched_in":"2.4.1"}],"published":"2025-03-06T00:00:00Z","updated":"2025-03-13T14:40:16Z"},{"id":"wordfence:f5bcad01-02ca-46a0-9196-df9f2110bc8a","source":"wordfence","cve":"CVE-2012-10009","title":"404like <= 1.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5bcad01-02ca-46a0-9196-df9f2110bc8a?source=api-prod","affected":[{"type":"plugin","slug":"404like","name":"404Like","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2012-02-11T00:00:00Z","updated":"2024-02-07T14:59:19Z"},{"id":"wordfence:f5bdf47a-1116-4d3a-8ded-89d76b5a6f82","source":"wordfence","cve":"","title":"User Notes <= 1.0.1 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5bdf47a-1116-4d3a-8ded-89d76b5a6f82?source=api-prod","affected":[{"type":"plugin","slug":"user-notes","name":"User Notes","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2021-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5bfe0a1-bc18-46d2-8358-5c3e1e883157","source":"wordfence","cve":"CVE-2025-54687","title":"JetTabs <= 2.2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5bfe0a1-bc18-46d2-8358-5c3e1e883157?source=api-prod","affected":[{"type":"plugin","slug":"jet-tabs","name":"JetTabs","from":"*","from_inclusive":true,"to":"2.2.9.1","to_inclusive":true,"patched_in":"2.2.9.2"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:12:04Z"},{"id":"wordfence:f5c07162-e970-4fbc-b97f-61c535ea696c","source":"wordfence","cve":"CVE-2025-28946","title":"PrintXtore < 1.7.7 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c07162-e970-4fbc-b97f-61c535ea696c?source=api-prod","affected":[{"type":"theme","slug":"bw-printxtore","name":"PrintXtore \u2013 Printing Services & Design Online WordPress WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2025-06-25T00:00:00Z","updated":"2026-02-26T15:14:13Z"},{"id":"wordfence:f5c122a5-20d0-450f-aec6-fc7cfc9cc6dc","source":"wordfence","cve":"CVE-2026-48969","title":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c122a5-20d0-450f-aec6-fc7cfc9cc6dc?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.5.9","to_inclusive":true,"patched_in":"9.5.10"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:32:54Z"},{"id":"wordfence:f5c1f0f4-4557-4ae9-bf0d-14c61721a2c5","source":"wordfence","cve":"CVE-2021-34675","title":"NEX Forms <= 7.8.7 - Authentication Bypass for PDF Reports","severity":"high","cvss":7.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c1f0f4-4557-4ae9-bf0d-14c61721a2c5?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms","name":"nex-forms","from":"*","from_inclusive":true,"to":"7.8.7","to_inclusive":true,"patched_in":"7.8.8"}],"published":"2021-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5c449f1-4715-4033-b0a3-6a8ca968aabc","source":"wordfence","cve":"CVE-2019-25150","title":"Email Templates <= 1.3 - HTML Injection","severity":"high","cvss":8.8,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=api-prod","affected":[{"type":"plugin","slug":"email-templates","name":"Email Templates Customizer and Designer for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2019-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5c9fc19-fc91-44d1-b6a5-a1ec0d6dbfe8","source":"wordfence","cve":"CVE-2025-47611","title":"User Meta <= 3.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c9fc19-fc91-44d1-b6a5-a1ec0d6dbfe8?source=api-prod","affected":[{"type":"plugin","slug":"user-meta","name":"User Meta \u2013 User Profile Builder and User management plugin","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-29T14:52:05Z"},{"id":"wordfence:f5cb0b5d-062c-47ac-bcd0-f30f82da6491","source":"wordfence","cve":"CVE-2024-12436","title":"WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Bulk Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5cb0b5d-062c-47ac-bcd0-f30f82da6491?source=api-prod","affected":[{"type":"plugin","slug":"customer-area","name":"WP Customer Area","from":"*","from_inclusive":true,"to":"8.2.4","to_inclusive":true,"patched_in":"8.2.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-02-18T14:35:10Z"},{"id":"wordfence:f5cdd3c1-6353-4bee-a4f9-5b7972f0970c","source":"wordfence","cve":"CVE-2024-3809","title":"Porto Theme - Functionality <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5cdd3c1-6353-4bee-a4f9-5b7972f0970c?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:42Z"},{"id":"wordfence:f5d3930f-d2da-4992-ad3a-228ffd7a5a6c","source":"wordfence","cve":"CVE-2026-118587","title":"PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.18.0","to_inclusive":true,"patched_in":"11.18.2"}],"published":"2026-11-12T20:54:59Z","updated":"2026-11-13T09:35:18Z"},{"id":"wordfence:f5d42dc6-047f-45ff-9a7a-5a7738f7dcb5","source":"wordfence","cve":"CVE-2024-8378","title":"Safe SVG <= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d42dc6-047f-45ff-9a7a-5a7738f7dcb5?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2024-10-17T00:00:00Z","updated":"2024-12-12T17:56:17Z"},{"id":"wordfence:f5d43612-ae16-4fa4-a1f0-91540ebac264","source":"wordfence","cve":"CVE-2024-3773","title":"LiveJournal Shortcode <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d43612-ae16-4fa4-a1f0-91540ebac264?source=api-prod","affected":[{"type":"plugin","slug":"livejournal-shortcode","name":"LiveJournal Shortcode","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-04-15T00:00:00Z","updated":"2024-05-30T20:12:44Z"},{"id":"wordfence:f5d5c1b8-112a-465f-801e-17c382e3d357","source":"wordfence","cve":"CVE-2026-24622","title":"Suggestion Toolkit <= 5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d5c1b8-112a-465f-801e-17c382e3d357?source=api-prod","affected":[{"type":"plugin","slug":"suggestion-toolkit","name":"Suggestion Toolkit","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-10T14:52:04Z","updated":"2026-02-03T13:47:14Z"},{"id":"wordfence:f5d8616b-8757-426e-a4ae-bd851d35e296","source":"wordfence","cve":"CVE-2025-13975","title":"Contact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' Settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d8616b-8757-426e-a4ae-bd851d35e296?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-with-chatwork","name":"Contact Form 7 with ChatWork","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T15:11:45Z","updated":"2025-12-12T03:21:03Z"},{"id":"wordfence:f5da3a4f-7084-4ba9-89c9-5a480efc7eca","source":"wordfence","cve":"CVE-2023-49763","title":"CSprite <= 1.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5da3a4f-7084-4ba9-89c9-5a480efc7eca?source=api-prod","affected":[{"type":"plugin","slug":"csprite","name":"CSprite","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5da4cdd-15c7-41a6-be2f-e31bd407ae05","source":"wordfence","cve":"CVE-2024-1352","title":"Classified Listing \u2013 Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5da4cdd-15c7-41a6-be2f-e31bd407ae05?source=api-prod","affected":[{"type":"plugin","slug":"classified-listing","name":"Classified Listing \u2013 AI-Powered Classified ads & Business Directory","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2024-04-04T00:00:00Z","updated":"2024-04-09T18:59:33Z"},{"id":"wordfence:f5dc2350-0dd3-4233-983f-3c7d294d18d1","source":"wordfence","cve":"CVE-2026-16285","title":"Product Attachment for WooCommerce < 2.3.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dc2350-0dd3-4233-983f-3c7d294d18d1?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-attachment","name":"Product Attachment for WooCommerce","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":false,"patched_in":"2.3.3"}],"published":"2026-08-02T00:00:00Z","updated":"2026-08-13T19:10:26Z"},{"id":"wordfence:f5dc42c5-d7d1-4962-8bd3-afc43f45a2f8","source":"wordfence","cve":"CVE-2026-110890","title":"JetSmartFilters <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dc42c5-d7d1-4962-8bd3-afc43f45a2f8?source=api-prod","affected":[{"type":"plugin","slug":"jet-smart-filters","name":"JetSmartFilters","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.6.1"}],"published":"2026-10-15T17:45:00Z","updated":"2026-10-23T18:38:20Z"},{"id":"wordfence:f5dc94fc-de11-42e7-a598-956ad345e7ff","source":"wordfence","cve":"CVE-2024-38752","title":"Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dc94fc-de11-42e7-a598-956ad345e7ff?source=api-prod","affected":[{"type":"plugin","slug":"zoho-campaigns","name":"Zoho Campaigns","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-26T20:01:15Z"},{"id":"wordfence:f5dead05-5960-4ccb-89c2-c8bb0cd9c9e9","source":"wordfence","cve":"CVE-2026-1398","title":"Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dead05-5960-4ccb-89c2-c8bb0cd9c9e9?source=api-prod","affected":[{"type":"plugin","slug":"change-wp-url","name":"Change WP URL","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-27T21:48:00Z","updated":"2026-01-28T11:23:42Z"},{"id":"wordfence:f5dfafee-9b6c-4e57-b263-39ff15cd3b51","source":"wordfence","cve":"CVE-2026-9178","title":"WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dfafee-9b6c-4e57-b263-39ff15cd3b51?source=api-prod","affected":[{"type":"plugin","slug":"wp-forms-connector","name":"WP Forms Connector","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:39:27Z","updated":"2026-06-24T05:33:33Z"},{"id":"wordfence:f5e023d6-7a8c-4f18-941d-1a133d8a353e","source":"wordfence","cve":"CVE-2025-66128","title":"Sendinblue for WooCommerce <= 4.0.49 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e023d6-7a8c-4f18-941d-1a133d8a353e?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-sendinblue-newsletter-subscription","name":"Brevo for WooCommerce","from":"*","from_inclusive":true,"to":"4.0.49","to_inclusive":true,"patched_in":"4.0.50"}],"published":"2025-12-14T00:00:00Z","updated":"2026-01-13T16:46:59Z"},{"id":"wordfence:f5e400f8-35b4-4be4-bb00-c59e14ddd57f","source":"wordfence","cve":"CVE-2024-43283","title":"Contest Gallery <= 23.1.2 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e400f8-35b4-4be4-bb00-c59e14ddd57f?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"23.1.2","to_inclusive":true,"patched_in":"23.1.3"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:42:20Z"},{"id":"wordfence:f5e490df-958c-4f3d-9ddb-68e82c03f495","source":"wordfence","cve":"CVE-2024-49683","title":"Schema & Structured Data for WP & AMP <= 1.35 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e490df-958c-4f3d-9ddb-68e82c03f495?source=api-prod","affected":[{"type":"plugin","slug":"schema-and-structured-data-for-wp","name":"Schema & Structured Data for WP & AMP","from":"*","from_inclusive":true,"to":"1.35","to_inclusive":true,"patched_in":"1.36"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T18:01:56Z"},{"id":"wordfence:f5e4a172-38de-49d3-8a5d-62253cf6d67c","source":"wordfence","cve":"CVE-2024-25909","title":"WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e4a172-38de-49d3-8a5d-62253cf6d67c?source=api-prod","affected":[{"type":"plugin","slug":"wp-media-folder","name":"WP Media folder","from":"*","from_inclusive":true,"to":"5.7.2","to_inclusive":true,"patched_in":"5.7.3"}],"published":"2024-02-15T00:00:00Z","updated":"2024-03-22T17:51:37Z"},{"id":"wordfence:f5e66037-0cce-4881-adec-1b1ff0c3747b","source":"wordfence","cve":"CVE-2024-6719","title":"Offload Videos \u2013 Bunny.net, AWS S3 <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e66037-0cce-4881-adec-1b1ff0c3747b?source=api-prod","affected":[{"type":"plugin","slug":"offload-videos-bunny-netaws-s3","name":"Offload Videos \u2013 Bunny.net, AWS S3","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2024-09-04T00:00:00Z","updated":"2025-05-30T18:23:54Z"},{"id":"wordfence:f5e6cb50-8262-406b-b01e-37d62a4bd394","source":"wordfence","cve":"CVE-2023-1420","title":"Ajax Search Lite <= 4.11 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e6cb50-8262-406b-b01e-37d62a4bd394?source=api-prod","affected":[{"type":"plugin","slug":"ajax-search-lite","name":"Ajax Search Lite \u2013 Live Search & Filter","from":"*","from_inclusive":true,"to":"4.11","to_inclusive":true,"patched_in":"4.11.1"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5e88393-c76b-49b6-a55c-06094e6f82d8","source":"wordfence","cve":"CVE-2022-4200","title":"Login with Cognito <= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e88393-c76b-49b6-a55c-06094e6f82d8?source=api-prod","affected":[{"type":"plugin","slug":"login-with-cognito","name":"Login with Cognito","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2022-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5e90403-434f-46d3-bdac-c7ad013f71b4","source":"wordfence","cve":"CVE-2025-31787","title":"Cue <= 2.4.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e90403-434f-46d3-bdac-c7ad013f71b4?source=api-prod","affected":[{"type":"plugin","slug":"cue","name":"Cue by AudioTheme.com","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:16:20Z"},{"id":"wordfence:f5e92e16-606e-4540-9116-26fe77fe4142","source":"wordfence","cve":"CVE-2025-32687","title":"Review Stars Count For WooCommerce <= 2.0 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e92e16-606e-4540-9116-26fe77fe4142?source=api-prod","affected":[{"type":"plugin","slug":"review-stars-count-for-woocommerce","name":"Review Stars Count For WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T21:00:51Z"},{"id":"wordfence:f5e984d5-2537-4a4a-a071-084e0c1c3b5e","source":"wordfence","cve":"CVE-2022-3861","title":"Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e984d5-2537-4a4a-a071-084e0c1c3b5e?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.5.1.4","to_inclusive":true,"patched_in":"26.6"}],"published":"2022-11-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5ea3e03-fafa-431e-b1fe-a527f491da79","source":"wordfence","cve":"CVE-2025-0860","title":"VR-Frases (collect & share quotes) <= 3.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ea3e03-fafa-431e-b1fe-a527f491da79?source=api-prod","affected":[{"type":"plugin","slug":"vr-frases","name":"VR-Frases","from":"*","from_inclusive":true,"to":"3.0.1","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-01-29T21:20:39Z","updated":"2025-07-24T19:09:25Z"},{"id":"wordfence:f5eb066b-8ab4-47e7-b055-4a9d7a897a3c","source":"wordfence","cve":"CVE-2016-10909","title":"Booking Calendar Contact Form < 1.0.24 - Blind SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5eb066b-8ab4-47e7-b055-4a9d7a897a3c?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":false,"patched_in":"1.0.24"}],"published":"2016-02-08T00:00:00Z","updated":"2026-07-29T16:43:10Z"},{"id":"wordfence:f5ec709c-c67d-4067-a118-166e104d148a","source":"wordfence","cve":"CVE-2017-18542","title":"Help Center by BestWebSoft <= 1.0.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ec709c-c67d-4067-a118-166e104d148a?source=api-prod","affected":[{"type":"plugin","slug":"zendesk-help-center","name":"Help Center by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5ec71b9-567e-455e-9088-fbf18f12c5bb","source":"wordfence","cve":"CVE-2026-84768","title":"VikAppointments Services Booking Calendar <= 1.2.20 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ec71b9-567e-455e-9088-fbf18f12c5bb?source=api-prod","affected":[{"type":"plugin","slug":"vikappointments","name":"VikAppointments Services Booking Calendar","from":"*","from_inclusive":true,"to":"1.2.20","to_inclusive":true,"patched_in":"1.2.21"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-09T13:26:51Z"},{"id":"wordfence:f5f18cae-b7f8-4afd-adfa-c616c63f9419","source":"wordfence","cve":"CVE-2024-8253","title":"Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f18cae-b7f8-4afd-adfa-c616c63f9419?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"2.2.87","from_inclusive":true,"to":"2.2.90","to_inclusive":true,"patched_in":"2.2.91"}],"published":"2024-09-10T14:51:09Z","updated":"2024-09-11T03:40:53Z"},{"id":"wordfence:f5f19184-60ff-4cf9-85c3-86a6c84a2a63","source":"wordfence","cve":"CVE-2021-24353","title":"Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Import","severity":"high","cvss":8.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f19184-60ff-4cf9-85c3-86a6c84a2a63?source=api-prod","affected":[{"type":"plugin","slug":"simple-301-redirects","name":"Simple 301 Redirects by BetterLinks \u2013 Easy Redirect Manager","from":"2.0.0","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-05-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5f3f079-ccea-47a2-9441-29d8d8c77a5c","source":"wordfence","cve":"CVE-2026-39490","title":"Jupiter X Core <= 4.14.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f3f079-ccea-47a2-9441-29d8d8c77a5c?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.14.1","to_inclusive":true,"patched_in":"4.14.2"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:02:57Z"},{"id":"wordfence:f5f43242-cbf6-42a0-b9c0-d67b8f8b25af","source":"wordfence","cve":"CVE-2025-22566","title":"ULTIMATE VIDEO GALLERY <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f43242-cbf6-42a0-b9c0-d67b8f8b25af?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-gallery","name":"ULTIMATE VIDEO GALLERY","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-18T00:00:00Z","updated":"2025-03-25T13:06:11Z"},{"id":"wordfence:f5f59b16-b38a-451b-b220-044598872735","source":"wordfence","cve":"CVE-2023-25703","title":"Meta Slider and Carousel with Lightbox <= 1.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f59b16-b38a-451b-b220-044598872735?source=api-prod","affected":[{"type":"plugin","slug":"meta-slider-and-carousel-with-lightbox","name":"Meta Slider and Carousel with Lightbox","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.7"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f5f64768-fbb0-4653-b9ce-09f1290ab604","source":"wordfence","cve":"CVE-2026-77789","title":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f64768-fbb0-4653-b9ce-09f1290ab604?source=api-prod","affected":[{"type":"plugin","slug":"wp-full-stripe-free","name":"Stripe Payment Forms by WP Full Pay \u2013 Accept Credit Card Payments, Donations & Subscriptions","from":"*","from_inclusive":true,"to":"8.5.1","to_inclusive":false,"patched_in":"8.5.1"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:41:30Z"},{"id":"wordfence:f5f89ca2-caf3-4dc1-b1cb-0b0bef23a185","source":"wordfence","cve":"CVE-2025-31775","title":"Google SEO Pressor Snippet <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5f89ca2-caf3-4dc1-b1cb-0b0bef23a185?source=api-prod","affected":[{"type":"plugin","slug":"google-seo-author-snippets","name":"Google SEO Pressor for Rich snippets","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-06-20T07:21:41Z"},{"id":"wordfence:f5fba145-5cb6-4ea1-8691-6bad3dcfbcf4","source":"wordfence","cve":"CVE-2024-32705","title":"ARForms <= 6.4 - Missing Authorization to Arbitrary Plugin Activation/Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5fba145-5cb6-4ea1-8691-6bad3dcfbcf4?source=api-prod","affected":[{"type":"plugin","slug":"arforms","name":"ARforms","from":"*","from_inclusive":true,"to":"6.4","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:05:47Z"},{"id":"wordfence:f5fda67f-2bec-4439-8f7b-892fd89b9390","source":"wordfence","cve":"CVE-2024-37935","title":"Woocommerce OpenPos <= 7.0.1 - Missing Authorization to Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5fda67f-2bec-4439-8f7b-892fd89b9390?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-openpos","name":"Openpos - WooCommerce Point Of Sale(POS)","from":"*","from_inclusive":true,"to":"7.0.1","to_inclusive":true,"patched_in":"7.0.2"}],"published":"2024-07-09T00:00:00Z","updated":"2024-08-27T13:30:15Z"},{"id":"wordfence:f5ff0ff4-0878-4e9e-8082-e0f6effef92c","source":"wordfence","cve":"CVE-2026-6419","title":"Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5ff0ff4-0878-4e9e-8082-e0f6effef92c?source=api-prod","affected":[{"type":"plugin","slug":"wishlist-member-x","name":"Wishlist Member","from":"*","from_inclusive":true,"to":"3.30.1","to_inclusive":true,"patched_in":"3.31.0"}],"published":"2026-05-22T16:21:00Z","updated":"2026-05-23T04:27:19Z"},{"id":"wordfence:f600361c-cf7a-498c-aa3d-beeb28d27101","source":"wordfence","cve":"CVE-2023-33930","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 -  Zip Extraction to Arbitrary File Upload in File Manager","severity":"critical","cvss":9.9,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f600361c-cf7a-498c-aa3d-beeb28d27101?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.66","to_inclusive":true,"patched_in":"1.5.67"}],"published":"2023-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6023483-3fa5-4b85-9422-7d395abcfbd8","source":"wordfence","cve":"CVE-2019-25222","title":"Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6023483-3fa5-4b85-9422-7d395abcfbd8?source=api-prod","affected":[{"type":"plugin","slug":"wp-responsive-thumbnail-slider","name":"Responsive Thumbnail Slider","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-03-14T00:00:00Z","updated":"2025-03-15T06:40:02Z"},{"id":"wordfence:f603a25f-7d56-4cf4-89aa-de87ee49522a","source":"wordfence","cve":"CVE-2023-47754","title":"Delete Duplicate Posts <= 4.8.9 - Missing Authorization via AJAX Actions","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f603a25f-7d56-4cf4-89aa-de87ee49522a?source=api-prod","affected":[{"type":"plugin","slug":"delete-duplicate-posts","name":"Delete Duplicate Posts","from":"*","from_inclusive":true,"to":"4.9","to_inclusive":false,"patched_in":"4.9"}],"published":"2023-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6043cff-f2b7-46bb-b00d-96bfcd69e54e","source":"wordfence","cve":"CVE-2025-67950","title":"All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6043cff-f2b7-46bb-b00d-96bfcd69e54e?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-seo-pack","name":"All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":"4.9.1.1"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-19T17:18:05Z"},{"id":"wordfence:f6047ae6-b1b4-4b31-aa12-560927e1040b","source":"wordfence","cve":"CVE-2023-7264","title":"Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism","severity":"high","cvss":8.1,"cwe":"CWE-640","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6047ae6-b1b4-4b31-aa12-560927e1040b?source=api-prod","affected":[{"type":"plugin","slug":"build-app-online","name":"Build App Online","from":"*","from_inclusive":true,"to":"1.0.22","to_inclusive":true,"patched_in":"1.0.23"}],"published":"2023-12-27T00:00:00Z","updated":"2024-12-06T12:16:44Z"},{"id":"wordfence:f607b33a-58ef-4526-9ca1-aaa444aa12bc","source":"wordfence","cve":"CVE-2023-25461","title":"Wp-Insert <= 2.5.0 Authenticated (Admin+) Stored Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f607b33a-58ef-4526-9ca1-aaa444aa12bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-insert","name":"Wp-Insert","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6092987-5f60-42ac-9636-e1e0a2c85147","source":"wordfence","cve":"CVE-2022-25881","title":"http-cache-semantics < 4.1.1 - Regular Expression Denial of Service (ReDoS)","severity":"medium","cvss":5.3,"cwe":"CWE-1333","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6092987-5f60-42ac-9636-e1e0a2c85147?source=api-prod","affected":[{"type":"plugin","slug":"simple-local-avatars","name":"Simple Local Avatars","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":"2.7.4"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f60a97df-c98a-4980-bc57-50147c87dd91","source":"wordfence","cve":"CVE-2025-23476","title":"my-related-posts <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f60a97df-c98a-4980-bc57-50147c87dd91?source=api-prod","affected":[{"type":"plugin","slug":"my-related-posts","name":"my-related-posts","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:28:03Z"},{"id":"wordfence:f60df43a-eef3-449d-96fd-b26e28361f81","source":"wordfence","cve":"CVE-2024-9366","title":"Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f60df43a-eef3-449d-96fd-b26e28361f81?source=api-prod","affected":[{"type":"plugin","slug":"easy-menu-manager-wpzest","name":"Easy Menu Manager | WPZest","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T15:42:10Z","updated":"2024-10-18T04:32:57Z"},{"id":"wordfence:f60fef0e-5b2d-4672-ab3d-21e4b6708f4a","source":"wordfence","cve":"","title":"Custom Website Data < 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f60fef0e-5b2d-4672-ab3d-21e4b6708f4a?source=api-prod","affected":[{"type":"plugin","slug":"simple-custom-website-data","name":"Custom Website Data","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":false,"patched_in":"1.1"}],"published":"2013-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f610d7ef-fb7c-4c3b-bde2-d7071331be70","source":"wordfence","cve":"CVE-2024-30437","title":"Webinar and Video Conference with Jitsi Meet <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f610d7ef-fb7c-4c3b-bde2-d7071331be70?source=api-prod","affected":[{"type":"plugin","slug":"webinar-and-video-conference-with-jitsi-meet","name":"FlexMeeting \u2013 Webinar & Meeting Plugin for Jitsi Meet","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-04T00:10:20Z"},{"id":"wordfence:f611d609-97c5-4b77-9657-c8d9d10e786a","source":"wordfence","cve":"CVE-2023-30753","title":"IP Metaboxes <= 2.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f611d609-97c5-4b77-9657-c8d9d10e786a?source=api-prod","affected":[{"type":"plugin","slug":"ip-metaboxes","name":"IP Metaboxes","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f61321d4-477a-4f4d-bed2-4ae6fdb864a9","source":"wordfence","cve":"CVE-2025-23808","title":"Custom List Table Example <= 1.4.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f61321d4-477a-4f4d-bed2-4ae6fdb864a9?source=api-prod","affected":[{"type":"plugin","slug":"custom-list-table-example","name":"Custom List Table Example","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:52:35Z"},{"id":"wordfence:f613411e-2b2e-401d-87cd-a002e9c2fc08","source":"wordfence","cve":"CVE-2022-2405","title":"WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f613411e-2b2e-401d-87cd-a002e9c2fc08?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-builder","name":"WP Popup Builder \u2013 Popup Forms and Marketing Lead Generation","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f616be03-229b-4c50-b837-508da4d2b090","source":"wordfence","cve":"CVE-2024-13654","title":"ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f616be03-229b-4c50-b837-508da4d2b090?source=api-prod","affected":[{"type":"theme","slug":"zoxpress","name":"ZoxPress - The All-In-One WordPress News Theme","from":"*","from_inclusive":true,"to":"2.12.0","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2025-02-11T00:00:00Z","updated":"2025-02-12T04:22:17Z"},{"id":"wordfence:f616df94-7839-49db-baa5-88f8f1de208f","source":"wordfence","cve":"CVE-2024-4333","title":"Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f616df94-7839-49db-baa5-88f8f1de208f?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.5.3","to_inclusive":true,"patched_in":"3.5.4"}],"published":"2024-05-13T00:00:00Z","updated":"2024-05-14T12:50:02Z"},{"id":"wordfence:f6185ea1-02cc-4265-9dd0-953293356734","source":"wordfence","cve":"CVE-2026-54858","title":"Printy <= 1.13.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6185ea1-02cc-4265-9dd0-953293356734?source=api-prod","affected":[{"type":"theme","slug":"printy","name":"Printy","from":"*","from_inclusive":true,"to":"1.13.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T13:05:34Z","updated":"2026-11-03T20:03:22Z"},{"id":"wordfence:f61873db-7365-41cb-a774-8f455a963d78","source":"wordfence","cve":"CVE-2026-15222","title":"User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f61873db-7365-41cb-a774-8f455a963d78?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.8","to_inclusive":true,"patched_in":"5.3.0"}],"published":"2026-10-15T17:34:05Z","updated":"2026-10-16T06:41:08Z"},{"id":"wordfence:f61885bc-b7da-42b8-a0d3-ba5d7d19b536","source":"wordfence","cve":"CVE-2026-10104","title":"Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f61885bc-b7da-42b8-a0d3-ba5d7d19b536?source=api-prod","affected":[{"type":"plugin","slug":"product-video-gallery-slider-for-woocommerce","name":"Product Video Gallery for Woocommerce","from":"*","from_inclusive":true,"to":"1.5.1.8","to_inclusive":true,"patched_in":"1.5.1.9"}],"published":"2026-07-01T20:06:37Z","updated":"2026-07-02T08:33:08Z"},{"id":"wordfence:f618911f-fd03-41ec-a0e1-dba4aa7178ab","source":"wordfence","cve":"","title":"Post Views <= 2.6.1.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f618911f-fd03-41ec-a0e1-dba4aa7178ab?source=api-prod","affected":[{"type":"plugin","slug":"post-views","name":"post-views","from":"*","from_inclusive":true,"to":"2.6.1.2","to_inclusive":true,"patched_in":"2.6.1.3"}],"published":"2012-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f618a350-e089-40f7-b731-7ffb9ece30b3","source":"wordfence","cve":"CVE-2023-45771","title":"Contact Form With Captcha <= 1.6.8 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f618a350-e089-40f7-b731-7ffb9ece30b3?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-with-captcha","name":"Contact Form With Captcha","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f61b9de5-5c37-4efb-ad1c-006e9fc05bc2","source":"wordfence","cve":"CVE-2025-13312","title":"CRM Memberships <= 2.6 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f61b9de5-5c37-4efb-ad1c-006e9fc05bc2?source=api-prod","affected":[{"type":"plugin","slug":"crm-memberships","name":"CRM Memberships","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2025-12-04T16:26:48Z","updated":"2026-07-08T20:42:35Z"},{"id":"wordfence:f61bda49-1eb0-49a3-8af1-8cadf088464f","source":"wordfence","cve":"CVE-2017-17451","title":"WP Mailster < 1.5.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f61bda49-1eb0-49a3-8af1-8cadf088464f?source=api-prod","affected":[{"type":"plugin","slug":"wp-mailster","name":"WP Mailster","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":false,"patched_in":"1.5.5"}],"published":"2017-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f62063c8-7559-492a-9caf-fae256052d1a","source":"wordfence","cve":"","title":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer <= 2.8.34 - Missing Authorization to Plugin Deactivation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62063c8-7559-492a-9caf-fae256052d1a?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.8.34","to_inclusive":true,"patched_in":"2.8.35"}],"published":"2022-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f624c9a0-b48f-49f5-ba63-276805904945","source":"wordfence","cve":"CVE-2026-6512","title":"InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters","severity":"critical","cvss":9.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f624c9a0-b48f-49f5-ba63-276805904945?source=api-prod","affected":[{"type":"plugin","slug":"infusedwooPRO","name":"InfusedWoo Pro","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2026-05-13T19:50:09Z","updated":"2026-05-14T08:24:28Z"},{"id":"wordfence:f625b10b-f104-49a8-9dbb-f880f5df8693","source":"wordfence","cve":"CVE-2011-5194","title":"WHOIS  <= 1.4.2.2 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f625b10b-f104-49a8-9dbb-f880f5df8693?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-whois-search","name":"WHOIS","from":"*","from_inclusive":true,"to":"1.4.2.2","to_inclusive":true,"patched_in":"1.4.2.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f62713c9-bf87-44be-9b7e-c088989bad77","source":"wordfence","cve":"","title":"Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62713c9-bf87-44be-9b7e-c088989bad77?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2021-10-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f627e9a4-378f-4c05-bd6e-bc0c4523df89","source":"wordfence","cve":"CVE-2025-27015","title":"Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f627e9a4-378f-4c05-bd6e-bc0c4523df89?source=api-prod","affected":[{"type":"theme","slug":"hostiko","name":"Hostiko - Hosting WordPress & WHMCS Theme","from":"*","from_inclusive":true,"to":"30.1","to_inclusive":false,"patched_in":"30.1"}],"published":"2025-02-18T00:00:00Z","updated":"2025-03-25T13:53:19Z"},{"id":"wordfence:f629fc93-84ce-4c33-b1c0-3a3194aac477","source":"wordfence","cve":"CVE-2024-3547","title":"Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f629fc93-84ce-4c33-b1c0-3a3194aac477?source=api-prod","affected":[{"type":"plugin","slug":"unlimited-elements-for-elementor","name":"Unlimited Elements for Elementor","from":"*","from_inclusive":true,"to":"1.5.102","to_inclusive":true,"patched_in":"1.5.103"}],"published":"2024-05-09T18:51:51Z","updated":"2024-05-10T07:33:40Z"},{"id":"wordfence:f62a486a-137b-48e5-b276-44438958e811","source":"wordfence","cve":"CVE-2024-9211","title":"FULL \u2013 Cliente <= 3.1.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62a486a-137b-48e5-b276-44438958e811?source=api-prod","affected":[{"type":"plugin","slug":"full-customer","name":"FULL \u2013 Cliente","from":"*","from_inclusive":true,"to":"3.1.22","to_inclusive":true,"patched_in":"3.1.23"}],"published":"2024-10-10T00:00:00Z","updated":"2024-10-11T06:50:21Z"},{"id":"wordfence:f62a9ca0-7077-410f-b005-175348acd133","source":"wordfence","cve":"CVE-2024-2795","title":"SEO SIMPLE PACK <= 3.2.1 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62a9ca0-7077-410f-b005-175348acd133?source=api-prod","affected":[{"type":"plugin","slug":"seo-simple-pack","name":"SEO SIMPLE PACK","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2024-06-27T00:00:00Z","updated":"2024-07-03T15:29:16Z"},{"id":"wordfence:f62d28bd-fa33-4f0b-a116-5aacc05bfa3a","source":"wordfence","cve":"CVE-2022-4036","title":"Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62d28bd-fa33-4f0b-a116-5aacc05bfa3a?source=api-prod","affected":[{"type":"plugin","slug":"appointment-hour-booking","name":"Appointment Hour Booking \u2013 Booking Calendar","from":"*","from_inclusive":true,"to":"1.3.72","to_inclusive":true,"patched_in":"1.3.73"}],"published":"2022-11-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f62f756d-70f2-42fe-89d7-f9f50ddf466e","source":"wordfence","cve":"CVE-2025-67999","title":"Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62f756d-70f2-42fe-89d7-f9f50ddf466e?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"9.0.9","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-19T17:04:25Z"},{"id":"wordfence:f62fa18a-dfb3-4738-a308-96e9f8e04e90","source":"wordfence","cve":"CVE-2025-62035","title":"Togo < 1.0.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f62fa18a-dfb3-4738-a308-96e9f8e04e90?source=api-prod","affected":[{"type":"theme","slug":"togo","name":"Togo \u2013 Travel & Tour Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T16:06:18Z"},{"id":"wordfence:f6360ef9-b54d-474b-8c0b-65b62841a283","source":"wordfence","cve":"CVE-2025-62939","title":"Open Currency Converter <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6360ef9-b54d-474b-8c0b-65b62841a283?source=api-prod","affected":[{"type":"plugin","slug":"artiss-currency-converter","name":"Open Currency Converter","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T14:52:39Z"},{"id":"wordfence:f6374cda-5aa2-4a2c-8d20-5641cfc33529","source":"wordfence","cve":"CVE-2022-2367","title":"WSM Downloader <- 1.4.0 - Domain Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6374cda-5aa2-4a2c-8d20-5641cfc33529?source=api-prod","affected":[{"type":"plugin","slug":"wsm-downloader","name":"WSM Downloader","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f63bed1e-b5b1-4c95-9304-8656fa7176e9","source":"wordfence","cve":"CVE-2026-57312","title":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f63bed1e-b5b1-4c95-9304-8656fa7176e9?source=api-prod","affected":[{"type":"plugin","slug":"everest-forms","name":"Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI","from":"*","from_inclusive":true,"to":"3.4.8","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-06-25T00:00:00Z","updated":"2026-06-29T18:57:17Z"},{"id":"wordfence:f63bf296-b34c-4f89-90eb-bba2a0461d57","source":"wordfence","cve":"CVE-2021-24482","title":"Related Posts for WordPress <= 2.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f63bf296-b34c-4f89-90eb-bba2a0461d57?source=api-prod","affected":[{"type":"plugin","slug":"related-posts-for-wp","name":"Related Posts for WordPress","from":"*","from_inclusive":true,"to":"2.0.4","to_inclusive":true,"patched_in":"2.0.5"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f63d494c-1d1e-4faa-930a-3fcf2b136182","source":"wordfence","cve":"CVE-2023-1129","title":"WP FEvents Book <= 0.46 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation","severity":"medium","cvss":6.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f63d494c-1d1e-4faa-930a-3fcf2b136182?source=api-prod","affected":[{"type":"plugin","slug":"wp-fevents-book","name":"WP FEvents Book","from":"*","from_inclusive":true,"to":"0.46","to_inclusive":true,"patched_in":"0.47"}],"published":"2023-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f63db09e-4bba-45e5-a8c5-6f02c0010e8b","source":"wordfence","cve":"CVE-2025-48124","title":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light <= 2.4.37 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f63db09e-4bba-45e5-a8c5-6f02c0010e8b?source=api-prod","affected":[{"type":"plugin","slug":"excel-like-price-change-for-woocommerce-and-wp-e-commerce-light","name":"Spreadsheet Price Changer for WooCommerce and WP E-commerce \u2013 Light","from":"*","from_inclusive":true,"to":"2.4.37","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-09-18T14:34:58Z"},{"id":"wordfence:f6409626-c8cb-412c-aff3-cbb2da212e5d","source":"wordfence","cve":"CVE-2023-41852","title":"MailMunch \u2013 Grow your Email List <= 3.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6409626-c8cb-412c-aff3-cbb2da212e5d?source=api-prod","affected":[{"type":"plugin","slug":"mailmunch","name":"MailMunch \u2013 Grow your Email List","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":"3.1.3"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6424fc9-f118-4654-89a7-1f7e6efa2c02","source":"wordfence","cve":"CVE-2025-0957","title":"Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6424fc9-f118-4654-89a7-1f7e6efa2c02?source=api-prod","affected":[{"type":"plugin","slug":"smtp-amazon-ses","name":"SMTP for Amazon SES \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9"}],"published":"2025-02-22T00:00:00Z","updated":"2025-04-10T22:32:37Z"},{"id":"wordfence:f64336f7-ab2a-4e22-a76f-d077c51f9c57","source":"wordfence","cve":"CVE-2024-2290","title":"Advanced Ads \u2013 Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f64336f7-ab2a-4e22-a76f-d077c51f9c57?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"1.52.1","to_inclusive":true,"patched_in":"1.52.2"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-09T20:03:42Z"},{"id":"wordfence:f6433a17-0017-46a9-a8e6-4d4a4a55f2db","source":"wordfence","cve":"CVE-2023-30471","title":"WP Search Analytics <= 1.4.7 - Reflected Cross-Site Scripting via 'render_stats_page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6433a17-0017-46a9-a8e6-4d4a4a55f2db?source=api-prod","affected":[{"type":"plugin","slug":"search-analytics","name":"Search Analytics for WP \u2013 Site Search Tracking","from":"*","from_inclusive":true,"to":"1.4.7","to_inclusive":true,"patched_in":"1.4.8"}],"published":"2023-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6440661-0646-4ec1-b4c9-5e80390d8565","source":"wordfence","cve":"CVE-2025-23484","title":"Predict When <= 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6440661-0646-4ec1-b4c9-5e80390d8565?source=api-prod","affected":[{"type":"plugin","slug":"predict-when","name":"Predict When","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-10T15:52:55Z"},{"id":"wordfence:f6445bcc-b12d-419f-beca-8ee617465bf4","source":"wordfence","cve":"CVE-2025-63019","title":"Cookies and Content Security Policy <= 2.34 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6445bcc-b12d-419f-beca-8ee617465bf4?source=api-prod","affected":[{"type":"plugin","slug":"cookies-and-content-security-policy","name":"Cookies and Content Security Policy","from":"*","from_inclusive":true,"to":"2.34","to_inclusive":true,"patched_in":"2.35"}],"published":"2026-01-05T00:00:00Z","updated":"2026-01-19T16:50:06Z"},{"id":"wordfence:f6461a8f-297e-49ad-aa9b-9379f0984423","source":"wordfence","cve":"CVE-2023-25025","title":"WP-CopyProtect [Protect your blog posts] <= 3.1.0 - Cross-Site Request Forgery via CopyProtect_options_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6461a8f-297e-49ad-aa9b-9379f0984423?source=api-prod","affected":[{"type":"plugin","slug":"wp-copyprotect","name":"WP-CopyProtect [Protect your blog posts]","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-19T00:00:00Z","updated":"2024-08-06T14:02:42Z"},{"id":"wordfence:f648a9ca-a72f-418e-bf1b-ad4ecc27d365","source":"wordfence","cve":"CVE-2025-3923","title":"Prevent Direct Access \u2013 Protect WordPress Files <= 2.8.8 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f648a9ca-a72f-418e-bf1b-ad4ecc27d365?source=api-prod","affected":[{"type":"plugin","slug":"prevent-direct-access","name":"Prevent Direct Access \u2013 Protect WordPress Files","from":"*","from_inclusive":true,"to":"2.8.8","to_inclusive":true,"patched_in":"2.8.8.1"}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-25T05:25:08Z"},{"id":"wordfence:f648e7f3-d93a-4a46-ae77-81a94880869c","source":"wordfence","cve":"CVE-2025-2249","title":"SoJ Soundslides <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f648e7f3-d93a-4a46-ae77-81a94880869c?source=api-prod","affected":[{"type":"plugin","slug":"soj-soundslides","name":"SoJ SoundSlides","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T18:36:30Z","updated":"2025-03-29T07:03:32Z"},{"id":"wordfence:f64b022f-78f4-4a4e-bceb-b3ac74790e96","source":"wordfence","cve":"CVE-2026-102387","title":"XServer Migrator <= 1.6.6 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f64b022f-78f4-4a4e-bceb-b3ac74790e96?source=api-prod","affected":[{"type":"plugin","slug":"xserver-migrator","name":"XServer Migrator","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":"1.6.7"}],"published":"2026-10-05T11:22:25Z","updated":"2026-10-08T22:57:13Z"},{"id":"wordfence:f64bc3c4-da89-4470-8353-d490f8bec408","source":"wordfence","cve":"CVE-2025-12115","title":"WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration","severity":"high","cvss":7.5,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f64bc3c4-da89-4470-8353-d490f8bec408?source=api-prod","affected":[{"type":"plugin","slug":"wpc-name-your-price","name":"WPC Name Your Price for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2025-10-30T00:00:00Z","updated":"2025-10-31T09:27:50Z"},{"id":"wordfence:f64d3962-b6e5-4196-b7b0-5b8e43c9119f","source":"wordfence","cve":"CVE-2026-88828","title":"Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f64d3962-b6e5-4196-b7b0-5b8e43c9119f?source=api-prod","affected":[{"type":"plugin","slug":"wc-blacklist-manager","name":"Blacklist Manager \u2013 WooCommerce Anti-Fraud, Blacklist & Checkout Verification","from":"1.3.0","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2026-09-25T00:00:00Z","updated":"2026-09-30T14:00:57Z"},{"id":"wordfence:f64fd871-d9fd-446a-b59a-0c4d8b23c9f1","source":"wordfence","cve":"CVE-2025-24561","title":"ReviewsTap <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f64fd871-d9fd-446a-b59a-0c4d8b23c9f1?source=api-prod","affected":[{"type":"plugin","slug":"reviewstap","name":"ReviewsTap","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:16:18Z"},{"id":"wordfence:f6507318-92c0-457c-8c87-2d023428a77f","source":"wordfence","cve":"CVE-2024-13321","title":"AnalyticsWP <= 2.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6507318-92c0-457c-8c87-2d023428a77f?source=api-prod","affected":[{"type":"plugin","slug":"analyticswp","name":"AnalyticsWP","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T07:23:22Z"},{"id":"wordfence:f6515d70-438b-47b7-a3c4-5b8dc401a40e","source":"wordfence","cve":"CVE-2026-32498","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6515d70-438b-47b7-a3c4-5b8dc401a40e?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.7.6","to_inclusive":true,"patched_in":"6.0.7.7"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T18:49:13Z"},{"id":"wordfence:f6522041-74a0-4703-ab1e-20621c231f1a","source":"wordfence","cve":"CVE-2024-51716","title":"Twitter real time search scrolling <= 7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6522041-74a0-4703-ab1e-20621c231f1a?source=api-prod","affected":[{"type":"plugin","slug":"twitter-real-time-search-scrolling","name":"Twitter real time search scrolling","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T15:03:30Z"},{"id":"wordfence:f654390a-7a1a-4948-a624-2df99e15c103","source":"wordfence","cve":"CVE-2025-46251","title":"VikRestaurants Table Reservations and Take-Away <= 1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f654390a-7a1a-4948-a624-2df99e15c103?source=api-prod","affected":[{"type":"plugin","slug":"vikrestaurants","name":"VikRestaurants Table Reservations and Take-Away","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:39:46Z"},{"id":"wordfence:f655704d-70a1-40d8-ae36-39029185d262","source":"wordfence","cve":"CVE-2023-41652","title":"RSVPMarker  <= 10.6.6 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f655704d-70a1-40d8-ae36-39029185d262?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"10.6.6","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2023-09-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f65834c6-6da7-4033-aa2a-a4926d6c955d","source":"wordfence","cve":"CVE-2024-5869","title":"Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f65834c6-6da7-4033-aa2a-a4926d6c955d?source=api-prod","affected":[{"type":"theme","slug":"neighborly","name":"Neighborly","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:29:52Z","updated":"2024-09-13T15:10:44Z"},{"id":"wordfence:f65cb1f6-e72e-4848-b72c-99b83e5401e8","source":"wordfence","cve":"CVE-2021-47957","title":"Cookie Law Bar <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f65cb1f6-e72e-4848-b72c-99b83e5401e8?source=api-prod","affected":[{"type":"plugin","slug":"cookie-law-bar","name":"Cookie Law Bar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2021-05-24T00:00:00Z","updated":"2026-07-29T20:49:32Z"},{"id":"wordfence:f65ee908-004f-4526-aeca-41b36522bb30","source":"wordfence","cve":"CVE-2024-12826","title":"GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f65ee908-004f-4526-aeca-41b36522bb30?source=api-prod","affected":[{"type":"plugin","slug":"personalize-woocommerce-cart-page","name":"GoHero Store Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"3.5","to_inclusive":true,"patched_in":"4.0"}],"published":"2025-01-24T18:42:42Z","updated":"2025-01-30T14:34:30Z"},{"id":"wordfence:f65fdde9-1133-4e29-a70a-be977f96acce","source":"wordfence","cve":"CVE-2024-32960","title":"Booking Ultra Pro <= 1.1.12 - Authenticated (Contributor+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f65fdde9-1133-4e29-a70a-be977f96acce?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.12","to_inclusive":true,"patched_in":"1.1.13"}],"published":"2024-04-23T00:00:00Z","updated":"2024-04-29T13:45:52Z"},{"id":"wordfence:f661f19d-fdd4-4cd3-8fb3-8b6073d94596","source":"wordfence","cve":"CVE-2023-6271","title":"Backup Migration <= 1.3.5 - Unauthenticated Sensitive Information Exposure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f661f19d-fdd4-4cd3-8fb3-8b6073d94596?source=api-prod","affected":[{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2023-12-07T00:00:00Z","updated":"2026-09-04T00:32:44Z"},{"id":"wordfence:f66457a1-7406-46f9-9a14-4ce6d77c4b84","source":"wordfence","cve":"CVE-2025-26935","title":"WP Job Portal <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f66457a1-7406-46f9-9a14-4ce6d77c4b84?source=api-prod","affected":[{"type":"plugin","slug":"wp-job-portal","name":"WP Job Portal \u2013 AI-Powered Recruitment System for Company or Job Board website","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T20:32:40Z"},{"id":"wordfence:f6655dc6-cf03-40c4-8fb2-fce6cfb069a6","source":"wordfence","cve":"CVE-2026-32359","title":"Icon List Block <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6655dc6-cf03-40c4-8fb2-fce6cfb069a6?source=api-prod","affected":[{"type":"plugin","slug":"icon-list-block","name":"Icon List Block \u2013 Add Icon-Based Lists with Custom Styles","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-02-15T00:00:00Z","updated":"2026-04-15T21:05:20Z"},{"id":"wordfence:f6658edb-11dc-4594-8936-95d60d581f49","source":"wordfence","cve":"CVE-2023-1092","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.24.1 - Cross-Site Request Forgery via 'delete' in mooauth_client_applist_page","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6658edb-11dc-4594-8936-95d60d581f49?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.24.1","to_inclusive":true,"patched_in":"6.24.2"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f668c3cd-bf64-4e95-8d75-70e4f12cabce","source":"wordfence","cve":"CVE-2024-6288","title":"Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f668c3cd-bf64-4e95-8d75-70e4f12cabce?source=api-prod","affected":[{"type":"plugin","slug":"enhanced-e-commerce-for-woocommerce-store","name":"Conversios \u2013 GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.0","to_inclusive":true,"patched_in":"7.1.1"}],"published":"2024-06-27T00:00:00Z","updated":"2025-07-01T17:57:30Z"},{"id":"wordfence:f66b1208-26d6-449f-8beb-22f532e7cc27","source":"wordfence","cve":"CVE-2026-94258","title":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure","severity":"low","cvss":2.7,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f66b1208-26d6-449f-8beb-22f532e7cc27?source=api-prod","affected":[{"type":"plugin","slug":"sms-alert","name":"SMS Alert \u2013 SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery","from":"3.6.4","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-09T15:33:25Z"},{"id":"wordfence:f670b93e-da2e-43e7-a28a-6cacba4df3a1","source":"wordfence","cve":"","title":"Simple Author Box <= 2.50 - Cross-Site Request Forgery via save_user_profile","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f670b93e-da2e-43e7-a28a-6cacba4df3a1?source=api-prod","affected":[{"type":"plugin","slug":"simple-author-box","name":"Simple Author Box","from":"*","from_inclusive":true,"to":"2.50","to_inclusive":true,"patched_in":"2.51"}],"published":"2023-03-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6710f53-34fe-4549-9e1a-7826be74c912","source":"wordfence","cve":"CVE-2024-2833","title":"Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-search","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6710f53-34fe-4549-9e1a-7826be74c912?source=api-prod","affected":[{"type":"plugin","slug":"job-postings","name":"Job Postings","from":"*","from_inclusive":true,"to":"2.7.5","to_inclusive":true,"patched_in":"2.7.6"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-31T15:31:00Z"},{"id":"wordfence:f67371bc-182a-4f32-b21c-f356c7b90ddc","source":"wordfence","cve":"CVE-2026-9677","title":"Shariff for WordPress <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67371bc-182a-4f32-b21c-f356c7b90ddc?source=api-prod","affected":[{"type":"plugin","slug":"shariff-sharing","name":"Shariff for WordPress","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":""}],"published":"2026-06-05T00:00:00Z","updated":"2026-09-18T14:52:15Z"},{"id":"wordfence:f673e463-5ef0-4704-91a1-76e375df9d1c","source":"wordfence","cve":"CVE-2024-53815","title":"Pinpoint Booking System <= 2.9.9.5.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f673e463-5ef0-4704-91a1-76e375df9d1c?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.5.1","to_inclusive":true,"patched_in":"2.9.9.5.2"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:38:43Z"},{"id":"wordfence:f674d3bf-9927-48d9-85c7-34946e8a2eeb","source":"wordfence","cve":"CVE-2024-6532","title":"Sheet to Table Live Sync for Google Sheet <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f674d3bf-9927-48d9-85c7-34946e8a2eeb?source=api-prod","affected":[{"type":"plugin","slug":"sheet-to-wp-table-for-google-sheet","name":"Sheet to Table Live Sync for Google Sheet","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2024-08-13T21:05:47Z","updated":"2024-08-14T09:29:59Z"},{"id":"wordfence:f6754c9a-81e1-4b39-a125-5293ee4ff758","source":"wordfence","cve":"CVE-2021-24885","title":"YOP Poll <= 6.1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6754c9a-81e1-4b39-a125-5293ee4ff758?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":false,"patched_in":"6.1.2"}],"published":"2020-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f67684cd-3e0f-48bb-967a-16ea2b027843","source":"wordfence","cve":"CVE-2024-0687","title":"Restrict User Access \u2013 Ultimate Membership & Content Protection <= 2.5 - Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67684cd-3e0f-48bb-967a-16ea2b027843?source=api-prod","affected":[{"type":"plugin","slug":"restrict-user-access","name":"Restrict User Access \u2013 Ultimate Membership & Content Protection","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":"2.6"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T21:37:49Z"},{"id":"wordfence:f677b257-606a-45f2-ba85-3a56b8df2a3c","source":"wordfence","cve":"CVE-2024-11087","title":"miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f677b257-606a-45f2-ba85-3a56b8df2a3c?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"200.3.9","to_inclusive":true,"patched_in":"200.3.10"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-31T17:15:46Z"},{"id":"wordfence:f67ab0cf-340d-4234-a857-1883f91c3ab6","source":"wordfence","cve":"CVE-2025-14446","title":"Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67ab0cf-340d-4234-a857-1883f91c3ab6?source=api-prod","affected":[{"type":"plugin","slug":"easy-notify-lite","name":"Easy Notify Lite","from":"*","from_inclusive":true,"to":"1.1.37","to_inclusive":true,"patched_in":"1.1.39"}],"published":"2025-12-12T16:05:59Z","updated":"2026-03-27T11:31:31Z"},{"id":"wordfence:f67b5cd8-bae8-48ca-87d5-7445724791f6","source":"wordfence","cve":"CVE-2024-1983","title":"Simple Ajax Chat <= 20240216 -  Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67b5cd8-bae8-48ca-87d5-7445724791f6?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20240216","to_inclusive":true,"patched_in":"20240223"}],"published":"2024-03-26T00:00:00Z","updated":"2026-02-25T18:23:57Z"},{"id":"wordfence:f67c4315-b73d-4eac-8ded-0e5b3a937fec","source":"wordfence","cve":"CVE-2025-23659","title":"MercadoLibre Integration <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67c4315-b73d-4eac-8ded-0e5b3a937fec?source=api-prod","affected":[{"type":"plugin","slug":"mercadolibre-integration","name":"MercadoLibre Integration","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:25:29Z"},{"id":"wordfence:f67ce101-3b4f-45be-9aed-d9055cc09fd3","source":"wordfence","cve":"CVE-2022-29454","title":"Better Messages <= 1.9.9.148 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67ce101-3b4f-45be-9aed-d9055cc09fd3?source=api-prod","affected":[{"type":"plugin","slug":"bp-better-messages","name":"Better Messages \u2013 Chat Rooms, Group Chat, Private Messages & AI Chat Bots","from":"*","from_inclusive":true,"to":"1.9.9.148","to_inclusive":true,"patched_in":"1.9.9.149"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f67d93a7-a76c-476b-abba-e415ab4c6a52","source":"wordfence","cve":"CVE-2025-49072","title":"Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme < 1.2.12.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f67d93a7-a76c-476b-abba-e415ab4c6a52?source=api-prod","affected":[{"type":"theme","slug":"mr-murphy","name":"Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.12.1","to_inclusive":false,"patched_in":"1.2.12.1"}],"published":"2025-06-02T00:00:00Z","updated":"2025-07-09T14:35:23Z"},{"id":"wordfence:f6816cb4-0fad-417a-a980-d35a734bce13","source":"wordfence","cve":"CVE-2023-0559","title":"GS Portfolio for Envato <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6816cb4-0fad-417a-a980-d35a734bce13?source=api-prod","affected":[{"type":"plugin","slug":"gs-envato-portfolio","name":"GS Portfolio for Envato","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f682b623-f9c5-44ce-90db-c6ee4c27a93b","source":"wordfence","cve":"CVE-2016-10901","title":"Customer Reviews < 3.0.9 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f682b623-f9c5-44ce-90db-c6ee4c27a93b?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"}],"published":"2016-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6893498-5cd0-4649-893c-a204508cfd04","source":"wordfence","cve":"CVE-2025-53451","title":"No External Links <= 5.1.6.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6893498-5cd0-4649-893c-a204508cfd04?source=api-prod","affected":[{"type":"plugin","slug":"mihdan-no-external-links","name":"No External Links","from":"*","from_inclusive":true,"to":"5.1.6.2","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-02T22:39:57Z"},{"id":"wordfence:f68a386b-544f-4aa2-8ae5-4d57ddd07b63","source":"wordfence","cve":"CVE-2023-45057","title":"Hitsteps Web Analytics <= 5.86 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f68a386b-544f-4aa2-8ae5-4d57ddd07b63?source=api-prod","affected":[{"type":"plugin","slug":"hitsteps-visitor-manager","name":"Hitsteps Web Analytics","from":"*","from_inclusive":true,"to":"5.86","to_inclusive":true,"patched_in":"5.87"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f68ac2b8-33dc-4cc2-b0f3-8777450e39f9","source":"wordfence","cve":"","title":"Pro Mime Types - Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f68ac2b8-33dc-4cc2-b0f3-8777450e39f9?source=api-prod","affected":[{"type":"plugin","slug":"pro-mime-types","name":"Pro Mime Types \u2013 Manage file media types","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":false,"patched_in":"2.0.0"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f68bc7e9-3bfe-4b2f-82a1-92bbde1a133a","source":"wordfence","cve":"CVE-2023-51691","title":"wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f68bc7e9-3bfe-4b2f-82a1-92bbde1a133a?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.12","to_inclusive":true,"patched_in":"7.6.13"}],"published":"2023-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f68c8953-7441-4204-b1e8-8c49cf491d34","source":"wordfence","cve":"CVE-2024-53732","title":"Footer Flyout Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f68c8953-7441-4204-b1e8-8c49cf491d34?source=api-prod","affected":[{"type":"plugin","slug":"footer-flyout-widget","name":"Footer Flyout Widget","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-23T00:00:00Z","updated":"2024-11-26T20:21:45Z"},{"id":"wordfence:f68e6fed-1986-4172-8270-0460450d6a02","source":"wordfence","cve":"CVE-2024-43968","title":"Newspack <= 3.8.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f68e6fed-1986-4172-8270-0460450d6a02?source=api-prod","affected":[{"type":"plugin","slug":"newspack-plugin","name":"Newspack","from":"*","from_inclusive":true,"to":"3.8.6","to_inclusive":true,"patched_in":"3.8.7"}],"published":"2024-08-27T00:00:00Z","updated":"2024-12-12T17:50:39Z"},{"id":"wordfence:f690e67c-119f-4ea6-9505-101e7f7a3dea","source":"wordfence","cve":"CVE-2023-5953","title":"Welcart e-Commerce <= 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f690e67c-119f-4ea6-9505-101e7f7a3dea?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.9.4","to_inclusive":true,"patched_in":"2.9.5"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6914ae1-6e31-4a5b-8dac-4d2ee96a6bd9","source":"wordfence","cve":"CVE-2025-58999","title":"Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6914ae1-6e31-4a5b-8dac-4d2ee96a6bd9?source=api-prod","affected":[{"type":"plugin","slug":"WP_AttractiveDonationsSystem","name":"WP Attractive Donations System - Easy Stripe & Paypal donations","from":"*","from_inclusive":true,"to":"1.25","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T00:00:00Z","updated":"2025-12-19T22:03:50Z"},{"id":"wordfence:f691ef0e-4649-4b06-860e-8e07375a9284","source":"wordfence","cve":"CVE-2025-39410","title":"Smart Sections Theme Builder - WPBakery Page Builder Addon <= 1.7.8 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f691ef0e-4649-4b06-860e-8e07375a9284?source=api-prod","affected":[{"type":"plugin","slug":"visucom-smart-sections","name":"Smart Sections Theme Builder - WPBakery Page Builder Addon","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-22T18:59:31Z"},{"id":"wordfence:f6929fdc-a5b1-4c71-9291-3fafa9381cf2","source":"wordfence","cve":"CVE-2026-3885","title":"WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6929fdc-a5b1-4c71-9291-3fafa9381cf2?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.9","to_inclusive":true,"patched_in":"7.5.0"}],"published":"2026-04-15T14:02:54Z","updated":"2026-08-14T19:06:11Z"},{"id":"wordfence:f693b48b-9b16-44cc-aded-ded979a3541c","source":"wordfence","cve":"CVE-2025-54691","title":"Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f693b48b-9b16-44cc-aded-ded979a3541c?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.80","to_inclusive":true,"patched_in":"1.4.81"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T21:05:50Z"},{"id":"wordfence:f69dfe83-03cb-47e1-b462-7ba4998e9cd3","source":"wordfence","cve":"CVE-2025-49350","title":"Actionwear products sync <= 2.3.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f69dfe83-03cb-47e1-b462-7ba4998e9cd3?source=api-prod","affected":[{"type":"plugin","slug":"actionwear-products-sync","name":"Actionwear products sync","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-10T15:51:32Z"},{"id":"wordfence:f6a0d6df-60a6-42e3-9e9b-6171bb589f4e","source":"wordfence","cve":"CVE-2024-1231","title":"CM Download Manager < 2.9.0 - Cross-Site Request Forgery via unpublishHeader","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6a0d6df-60a6-42e3-9e9b-6171bb589f4e?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.9.0","to_inclusive":false,"patched_in":"2.9.0"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-27T20:52:41Z"},{"id":"wordfence:f6a41a90-d116-4cb5-9627-08eb70f9654d","source":"wordfence","cve":"CVE-2022-23638","title":"SVG Support <= 2.5.8 - Stored Cross-Site Scripting via Vulnerability Dependency","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6a41a90-d116-4cb5-9627-08eb70f9654d?source=api-prod","affected":[{"type":"plugin","slug":"svg-support","name":"SVG Support","from":"*","from_inclusive":true,"to":"2.5.8","to_inclusive":true,"patched_in":"2.5.9"}],"published":"2025-02-24T00:00:00Z","updated":"2025-02-24T22:55:13Z"},{"id":"wordfence:f6a8adca-6257-41e2-b65f-a21e53c42710","source":"wordfence","cve":"CVE-2026-19704","title":"Comments \u2013 wpDiscuz < 7.6.66 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6a8adca-6257-41e2-b65f-a21e53c42710?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.66","to_inclusive":false,"patched_in":"7.6.66"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:39:42Z"},{"id":"wordfence:f6aead8d-c136-4952-ad03-86fe0f144dea","source":"wordfence","cve":"CVE-2024-2667","title":"InstaWP Connect \u2013 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6aead8d-c136-4952-ad03-86fe0f144dea?source=api-prod","affected":[{"type":"plugin","slug":"instawp-connect","name":"InstaWP Connect \u2013 1-click WP Staging & Migration","from":"*","from_inclusive":true,"to":"0.1.0.22","to_inclusive":true,"patched_in":"0.1.0.23"}],"published":"2024-04-12T00:00:00Z","updated":"2024-05-02T16:52:52Z"},{"id":"wordfence:f6af1e90-9bad-470b-9e00-137000c0450c","source":"wordfence","cve":"CVE-2024-2306","title":"Revslider <= 6.6.20 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6af1e90-9bad-470b-9e00-137000c0450c?source=api-prod","affected":[{"type":"plugin","slug":"revslider","name":"Slider Revolution","from":"*","from_inclusive":true,"to":"6.6.20","to_inclusive":true,"patched_in":"6.7.0"}],"published":"2024-04-08T00:00:00Z","updated":"2024-05-31T15:31:00Z"},{"id":"wordfence:f6afe4b6-c38c-46fa-82d5-95cb35c2c30f","source":"wordfence","cve":"CVE-2025-3661","title":"SB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6afe4b6-c38c-46fa-82d5-95cb35c2c30f?source=api-prod","affected":[{"type":"plugin","slug":"sb-chart-block","name":"SB Chart block","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-04-18T20:33:53Z","updated":"2025-04-19T09:23:04Z"},{"id":"wordfence:f6b18abe-28dd-420d-b570-fc001e4b5cd3","source":"wordfence","cve":"CVE-2026-39555","title":"Askka - Candle Shop WordPress Theme <= 1.3.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b18abe-28dd-420d-b570-fc001e4b5cd3?source=api-prod","affected":[{"type":"theme","slug":"askka","name":"Askka - Candle Shop WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4"}],"published":"2026-04-08T00:00:00Z","updated":"2026-04-15T19:00:25Z"},{"id":"wordfence:f6b302c9-a6b9-4a91-acb5-2ad270817606","source":"wordfence","cve":"CVE-2024-10529","title":"Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b302c9-a6b9-4a91-acb5-2ad270817606?source=api-prod","affected":[{"type":"plugin","slug":"chatbot-chatgpt","name":"Kognetiks Chatbot","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2024-11-12T00:00:00Z","updated":"2024-11-13T02:33:21Z"},{"id":"wordfence:f6b41c7f-06e9-4cba-ae64-b4d6b0df4cc4","source":"wordfence","cve":"CVE-2026-81761","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b41c7f-06e9-4cba-ae64-b4d6b0df4cc4?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.5.0","to_inclusive":true,"patched_in":"5.6.0"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:58:55Z"},{"id":"wordfence:f6b740bf-ac9e-4e62-8f4c-a42c4857646f","source":"wordfence","cve":"CVE-2024-10144","title":"Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b740bf-ac9e-4e62-8f4c-a42c4857646f?source=api-prod","affected":[{"type":"plugin","slug":"robo-gallery","name":"Robo Gallery \u2013 Photo & Image Slider","from":"*","from_inclusive":true,"to":"3.2.21","to_inclusive":true,"patched_in":"3.2.22"}],"published":"2025-03-11T00:00:00Z","updated":"2025-04-15T15:08:13Z"},{"id":"wordfence:f6b87ed9-84c9-497e-a8dc-96dfa9b940b7","source":"wordfence","cve":"CVE-2026-39635","title":"Grand Magazine <= 3.5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b87ed9-84c9-497e-a8dc-96dfa9b940b7?source=api-prod","affected":[{"type":"theme","slug":"grandmagazine","name":"Grand Magazine | Blog WordPress","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:21:03Z"},{"id":"wordfence:f6b9e63f-0492-4d51-a8ae-0874ef57e852","source":"wordfence","cve":"CVE-2023-25985","title":"WordPress Tooltips <= 8.2.5 - Multiple Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6b9e63f-0492-4d51-a8ae-0874ef57e852?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-tooltips","name":"Tooltips for WordPress","from":"*","from_inclusive":true,"to":"8.2.5","to_inclusive":true,"patched_in":"8.2.7"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6ba2907-36f4-4c4d-9e25-d13d32e28690","source":"wordfence","cve":"CVE-2024-4546","title":"Custom Post Type Attachment <= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf_attachment Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6ba2907-36f4-4c4d-9e25-d13d32e28690?source=api-prod","affected":[{"type":"plugin","slug":"custom-post-type-pdf-attachment","name":"Custom Post Type Attachment","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2024-05-15T18:50:55Z","updated":"2024-05-16T07:32:44Z"},{"id":"wordfence:f6bdd745-066d-4b8e-a66c-6d3fb9a9ef12","source":"wordfence","cve":"CVE-2025-49399","title":"NEX-Forms <= 9.1.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6bdd745-066d-4b8e-a66c-6d3fb9a9ef12?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"9.1.3","to_inclusive":true,"patched_in":"9.1.4"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:55:50Z"},{"id":"wordfence:f6c14c65-a47c-4dc1-9d5a-f804061152e4","source":"wordfence","cve":"CVE-2023-47231","title":"ShortCodes UI <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c14c65-a47c-4dc1-9d5a-f804061152e4?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ui","name":"ShortCodes UI","from":"*","from_inclusive":true,"to":"1.9.8","to_inclusive":true,"patched_in":""}],"published":"2023-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6c211bb-c7e6-41d3-8cbc-45a286bffc9e","source":"wordfence","cve":"CVE-2025-24655","title":"Wishlist <= 1.0.39 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c211bb-c7e6-41d3-8cbc-45a286bffc9e?source=api-prod","affected":[{"type":"plugin","slug":"wishlist","name":"Wishlist","from":"*","from_inclusive":true,"to":"1.0.39","to_inclusive":true,"patched_in":"1.0.40"}],"published":"2025-01-15T00:00:00Z","updated":"2025-04-22T22:16:31Z"},{"id":"wordfence:f6c302d8-ab4f-474c-98ad-356c61c01adc","source":"wordfence","cve":"CVE-2025-67964","title":"Homey Core <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c302d8-ab4f-474c-98ad-356c61c01adc?source=api-prod","affected":[{"type":"plugin","slug":"homey-core","name":"Homey Core","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:09:45Z"},{"id":"wordfence:f6c4ec70-22b5-49e1-a00b-5b29aab5fc91","source":"wordfence","cve":"CVE-2025-32135","title":"Split Test For Elementor <= 1.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c4ec70-22b5-49e1-a00b-5b29aab5fc91?source=api-prod","affected":[{"type":"plugin","slug":"split-test-for-elementor","name":"Split Test For Elementor","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":"1.8.5"}],"published":"2025-04-04T00:00:00Z","updated":"2026-04-25T16:43:02Z"},{"id":"wordfence:f6c5e3f8-ebbd-4cc3-b9b1-3f1704e3c07a","source":"wordfence","cve":"","title":"Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) User Meta Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c5e3f8-ebbd-4cc3-b9b1-3f1704e3c07a?source=api-prod","affected":[{"type":"plugin","slug":"paid-memberships-pro","name":"Paid Memberships Pro \u2013 Content Restriction, User Registration, & Paid Subscriptions","from":"*","from_inclusive":true,"to":"2.12.8","to_inclusive":true,"patched_in":"2.12.9"}],"published":"2024-02-08T00:00:00Z","updated":"2025-01-31T20:32:27Z"},{"id":"wordfence:f6c648bb-4a27-43af-8f24-fbc468d9ea3f","source":"wordfence","cve":"CVE-2026-93933","title":"Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme <= 1.2.4 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c648bb-4a27-43af-8f24-fbc468d9ea3f?source=api-prod","affected":[{"type":"theme","slug":"rosalinda","name":"Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:46:37Z","updated":"2026-10-13T14:26:49Z"},{"id":"wordfence:f6c71e38-5ac3-46f1-8292-a49c6e44f1d8","source":"wordfence","cve":"CVE-2021-25021","title":"OMGF <= 4.5.11 - Authenticated (Admin+) Arbitrary Folder Deletion via Path Traversal","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c71e38-5ac3-46f1-8292-a49c6e44f1d8?source=api-prod","affected":[{"type":"plugin","slug":"host-webfonts-local","name":"OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":true,"patched_in":"4.5.12"}],"published":"2021-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6c74bcb-b41d-4a4f-97d5-b92a3bfc794d","source":"wordfence","cve":"CVE-2024-10893","title":"WP Booking Calendar <= 10.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c74bcb-b41d-4a4f-97d5-b92a3bfc794d?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"10.6.4","to_inclusive":true,"patched_in":"10.6.5"}],"published":"2024-11-14T00:00:00Z","updated":"2024-12-12T16:29:26Z"},{"id":"wordfence:f6c7b969-04e4-409a-81e2-823a94701d41","source":"wordfence","cve":"CVE-2025-64260","title":"ANAC XML Bandi di Gara <= 7.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c7b969-04e4-409a-81e2-823a94701d41?source=api-prod","affected":[{"type":"plugin","slug":"avcp","name":"ANAC XML Bandi di Gara","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.7.1"}],"published":"2025-11-24T00:00:00Z","updated":"2025-12-19T17:04:34Z"},{"id":"wordfence:f6c8bd7c-0d9e-444d-9e0f-ccdd84b9b6dd","source":"wordfence","cve":"CVE-2025-53262","title":"Writesonic <= 1.0.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c8bd7c-0d9e-444d-9e0f-ccdd84b9b6dd?source=api-prod","affected":[{"type":"plugin","slug":"writesonic","name":"Writesonic","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":"1.0.6"}],"published":"2025-06-27T00:00:00Z","updated":"2026-02-25T14:30:52Z"},{"id":"wordfence:f6c94024-20fb-4cc1-a093-1b9974e61220","source":"wordfence","cve":"","title":"Address Autocomplete Using Google Place Api <= 1.0.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6c94024-20fb-4cc1-a093-1b9974e61220?source=api-prod","affected":[{"type":"plugin","slug":"address-autocomplete-using-google-place-api","name":"Address Autocomplete Using Google Place Api","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2022-11-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6ca7fc4-a5fb-4f8a-b49e-413956b8ac96","source":"wordfence","cve":"CVE-2025-68058","title":"Institutions Directory <= 1.3..4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6ca7fc4-a5fb-4f8a-b49e-413956b8ac96?source=api-prod","affected":[{"type":"plugin","slug":"institutions-directory","name":"Institutions Directory","from":"*","from_inclusive":true,"to":"1.3..4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:02:50Z"},{"id":"wordfence:f6cb6fbc-456d-4912-a574-cb25ab16df3a","source":"wordfence","cve":"CVE-2025-8691","title":"WP Scriptcase <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6cb6fbc-456d-4912-a574-cb25ab16df3a?source=api-prod","affected":[{"type":"plugin","slug":"wp-scriptcase","name":"WP Scriptcase","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:51:40Z","updated":"2025-09-11T07:25:03Z"},{"id":"wordfence:f6cba253-dfb0-485d-8b81-8e3bbaec8441","source":"wordfence","cve":"CVE-2025-53581","title":"RSS Feed Pro <= 1.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6cba253-dfb0-485d-8b81-8e3bbaec8441?source=api-prod","affected":[{"type":"plugin","slug":"rss-feed-pro","name":"RSS Feed Pro","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T13:19:43Z"},{"id":"wordfence:f6ccddd4-89fe-4786-917b-944185b4510b","source":"wordfence","cve":"CVE-2026-8895","title":"kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6ccddd4-89fe-4786-917b-944185b4510b?source=api-prod","affected":[{"type":"plugin","slug":"kk-blog-card","name":"kk blog card","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-08T15:07:46Z","updated":"2026-06-09T03:41:24Z"},{"id":"wordfence:f6cf31f0-b560-40c5-b6e4-4fc444e6d23b","source":"wordfence","cve":"CVE-2025-30568","title":"Super Static Cache <= 3.3.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6cf31f0-b560-40c5-b6e4-4fc444e6d23b?source=api-prod","affected":[{"type":"plugin","slug":"super-static-cache","name":"Super Static Cache","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:56:19Z"},{"id":"wordfence:f6d24786-676b-478a-ad9a-5c3f5ca3e85b","source":"wordfence","cve":"","title":"Scarlet (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d24786-676b-478a-ad9a-5c3f5ca3e85b?source=api-prod","affected":[{"type":"theme","slug":"scarlet","name":"Scarlet","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2013-02-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6d39654-2c22-48c7-b545-7b02e5c4b43b","source":"wordfence","cve":"CVE-2026-39449","title":"Contact Form to Any API <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d39654-2c22-48c7-b545-7b02e5c4b43b?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-any-api","name":"Contact Form to Any API","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2026-04-22T00:00:00Z","updated":"2026-08-14T15:17:43Z"},{"id":"wordfence:f6d3c88d-d0a1-4f27-8a9c-df35235b34dc","source":"wordfence","cve":"CVE-2026-25417","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d3c88d-d0a1-4f27-8a9c-df35235b34dc?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.9.8.1","to_inclusive":true,"patched_in":"5.9.8.2"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:41:24Z"},{"id":"wordfence:f6d44749-8b1a-4d22-9917-fee134737063","source":"wordfence","cve":"CVE-2023-46203","title":"Just Custom Fields <= 3.3.2 - Missing Authorization on AJAX Actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d44749-8b1a-4d22-9917-fee134737063?source=api-prod","affected":[{"type":"plugin","slug":"just-custom-fields","name":"Just Custom Fields","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6d6b82d-574d-4a56-9aef-42343c4b7c43","source":"wordfence","cve":"CVE-2024-3866","title":"Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d6b82d-574d-4a56-9aef-42343c4b7c43?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.8.15","to_inclusive":true,"patched_in":"3.8.16"}],"published":"2024-09-24T00:00:00Z","updated":"2024-09-25T06:49:02Z"},{"id":"wordfence:f6d90ca3-dc24-4634-9f98-83a909e3e093","source":"wordfence","cve":"CVE-2024-13683","title":"Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d90ca3-dc24-4634-9f98-83a909e3e093?source=api-prod","affected":[{"type":"plugin","slug":"automate-hub-free-by-sperse-io","name":"Automate Hub Free by Sperse.IO","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-23T18:42:25Z","updated":"2025-02-14T17:03:06Z"},{"id":"wordfence:f6da8b28-ef9c-4a91-92bf-2a3bd60c63d3","source":"wordfence","cve":"CVE-2026-114196","title":"Paytium: Mollie payment forms & donations <= 5.0.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6da8b28-ef9c-4a91-92bf-2a3bd60c63d3?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2026-10-22T08:00:13Z","updated":"2026-10-28T01:19:45Z"},{"id":"wordfence:f6db5e9f-9b3b-44c9-a6d9-78df3ed3b1fc","source":"wordfence","cve":"CVE-2017-18536","title":"Stop User Enumeration <= 1.3.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6db5e9f-9b3b-44c9-a6d9-78df3ed3b1fc?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":false,"patched_in":"1.3.8"}],"published":"2017-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6df3abe-ef27-46d7-bbdd-abd994fce132","source":"wordfence","cve":"CVE-2026-15098","title":"Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6df3abe-ef27-46d7-bbdd-abd994fce132?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.1.2"}],"published":"2026-09-18T19:23:09Z","updated":"2026-09-19T07:43:21Z"},{"id":"wordfence:f6e2ab69-2714-4bf9-a9ad-035fc15450f2","source":"wordfence","cve":"CVE-2022-25610","title":"Simple Ajax Chat <= 20220115 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e2ab69-2714-4bf9-a9ad-035fc15450f2?source=api-prod","affected":[{"type":"plugin","slug":"simple-ajax-chat","name":"Simple Ajax Chat \u2013 Add a Fast, Secure Chat Box","from":"*","from_inclusive":true,"to":"20220115","to_inclusive":true,"patched_in":"20220216"}],"published":"2022-02-16T09:16:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6e3e5dd-b9f1-4d24-98cc-b6ab319434e4","source":"wordfence","cve":"CVE-2024-13431","title":"Appointment Booking Calendar \u2014 Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e3e5dd-b9f1-4d24-98cc-b6ab319434e4?source=api-prod","affected":[{"type":"plugin","slug":"simply-schedule-appointments","name":"Simply Schedule Appointments","from":"*","from_inclusive":true,"to":"1.6.8.3","to_inclusive":true,"patched_in":"1.6.8.5"}],"published":"2025-03-06T20:14:46Z","updated":"2025-04-04T19:48:19Z"},{"id":"wordfence:f6e47659-90d9-4990-a19d-3954d65417df","source":"wordfence","cve":"CVE-2021-39336","title":"Job Manager <= 0.7.25 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e47659-90d9-4990-a19d-3954d65417df?source=api-prod","affected":[{"type":"plugin","slug":"job-manager","name":"Job Manager","from":"*","from_inclusive":true,"to":"0.7.25","to_inclusive":true,"patched_in":""}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6e4c583-c0d5-4040-86d5-0f1b4dddcb81","source":"wordfence","cve":"CVE-2014-1905","title":"Broadcast Live Video \u2013 Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 4.27.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e4c583-c0d5-4040-86d5-0f1b4dddcb81?source=api-prod","affected":[{"type":"plugin","slug":"videowhisper-live-streaming-integration","name":"Broadcast Live Video \u2013 Live Streaming : WebRTC, HLS, RTSP, RTMP","from":"*","from_inclusive":true,"to":"4.27.4","to_inclusive":true,"patched_in":"4.29.5"}],"published":"2014-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6e5dde2-f9f9-4a64-9174-e5e6e9fe1b23","source":"wordfence","cve":"CVE-2025-5957","title":"Guest Support \u2013 Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e5dde2-f9f9-4a64-9174-e5e6e9fe1b23?source=api-prod","affected":[{"type":"plugin","slug":"guest-support","name":"Guest Support \u2013 Customer Support Ticket System Without Login","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-08T04:22:59Z"},{"id":"wordfence:f6e6fda8-e998-4087-8a21-9edb2a0249c8","source":"wordfence","cve":"CVE-2024-6629","title":"All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e6fda8-e998-4087-8a21-9edb2a0249c8?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-video-gallery","name":"All-in-One Video Gallery \u2013 Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.8.3"}],"published":"2024-07-23T18:08:46Z","updated":"2024-07-24T06:42:24Z"},{"id":"wordfence:f6e8d21a-8c67-4e35-b18e-e100f31b2863","source":"wordfence","cve":"CVE-2022-4509","title":"Content Control <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e8d21a-8c67-4e35-b18e-e100f31b2863?source=api-prod","affected":[{"type":"plugin","slug":"content-control","name":"Content Control \u2013 The Ultimate Content Restriction Solution! Restrict Content, Create Conditional Blocks & More","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6ef2976-0fae-4b8f-b63a-7de7390cbd00","source":"wordfence","cve":"CVE-2025-30877","title":"Quiz Cat <= 3.0.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6ef2976-0fae-4b8f-b63a-7de7390cbd00?source=api-prod","affected":[{"type":"plugin","slug":"quiz-cat","name":"Quiz Cat \u2013 WordPress Quiz Plugin","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T14:27:57Z"},{"id":"wordfence:f6f0991e-7b0c-455b-a67a-dc3cb16103f3","source":"wordfence","cve":"CVE-2026-78290","title":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0991e-7b0c-455b-a67a-dc3cb16103f3?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":true,"patched_in":"1.8.7"}],"published":"2026-08-24T00:00:00Z","updated":"2026-08-24T16:10:02Z"},{"id":"wordfence:f6f0fb78-ad6b-4a9e-ae1a-5793f3426379","source":"wordfence","cve":"CVE-2022-4950","title":"Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=api-prod","affected":[{"type":"plugin","slug":"countdown-for-the-events-calendar","name":"Event Countdown for The Events Calendar","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.4"},{"type":"plugin","slug":"events-notification-bar-addon","name":"The Events Calendar Events Notification Bar Addon","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.6"},{"type":"plugin","slug":"cool-timeline","name":"Cool Timeline (Horizontal & Vertical Timeline)","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.4"},{"type":"plugin","slug":"cryptocurrency-donation-box","name":"Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donations","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"},{"type":"plugin","slug":"events-search-addon-for-the-events-calendar","name":"Events Search & Filter Bar for The Events Calendar","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.2"},{"type":"plugin","slug":"cryptocurrency-widgets-for-elementor","name":"Cryptocurrency Widgets For Elementor","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"},{"type":"plugin","slug":"event-page-templates-addon-for-the-events-calendar","name":"Event Single Page Builder For The Events Calendar","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"},{"type":"plugin","slug":"template-events-calendar","name":"Events Shortcodes For The Events Calendar","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"2.0"},{"type":"plugin","slug":"cryptocurrency-price-ticker-widget","name":"Cryptocurrency Widgets \u2013 Price Ticker & Coins List","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5.1"},{"type":"plugin","slug":"events-widgets-for-elementor-and-the-events-calendar","name":"Events Widgets For Elementor And The Events Calendar","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.5"}],"published":"2022-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6f12812-3c14-41c1-b14b-af84f835a773","source":"wordfence","cve":"CVE-2025-9897","title":"AP Background <= 3.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=api-prod","affected":[{"type":"plugin","slug":"ap-background","name":"AP Background","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:28:37Z","updated":"2025-10-03T11:17:23Z"},{"id":"wordfence:f6f26854-7e25-4e64-9f03-916ece6fde03","source":"wordfence","cve":"CVE-2024-2663","title":"ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f26854-7e25-4e64-9f03-916ece6fde03?source=api-prod","affected":[{"type":"plugin","slug":"zd-youtube-flv-player","name":"ZD YouTube FLV Player","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2024-04-29T00:00:00Z","updated":"2024-04-30T08:32:23Z"},{"id":"wordfence:f6f320d2-fd24-47b5-804d-31e3afdc31ba","source":"wordfence","cve":"CVE-2026-92144","title":"Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f320d2-fd24-47b5-804d-31e3afdc31ba?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.2","to_inclusive":true,"patched_in":"1.57.2.1"}],"published":"2026-09-30T20:33:06Z","updated":"2026-10-01T09:26:58Z"},{"id":"wordfence:f6f35548-9397-48d0-b654-4ed07d78a162","source":"wordfence","cve":"CVE-2026-118439","title":"Limit Login Attempts Security \u2013 Brute Force Protection, 2FA, Firewall & Login Security < 3.4.2 - Authenticated (Administrator+) Server-Side Request Forgery","severity":"medium","cvss":5.5,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f35548-9397-48d0-b654-4ed07d78a162?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-reloaded","name":"Limit Login Attempts Security \u2013 Login Security, 2FA, Firewall, Brute Force Prevention","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":false,"patched_in":"3.4.2"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:06:21Z"},{"id":"wordfence:f6f3f82e-6b1b-4138-b8f3-82e8dcd24479","source":"wordfence","cve":"CVE-2023-38399","title":"Phlox Portfolio <= 2.3.1 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f3f82e-6b1b-4138-b8f3-82e8dcd24479?source=api-prod","affected":[{"type":"plugin","slug":"auxin-portfolio","name":"Premium Portfolio Features for Phlox theme","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":"2.3.2"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6f7bff6-3bc3-4572-97fd-a039d54ac0ff","source":"wordfence","cve":"CVE-2025-2237","title":"WP RealEstate <= 1.6.26 - Unauthenticated Privilege Escalation via 'process_register'","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f7bff6-3bc3-4572-97fd-a039d54ac0ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-realestate","name":"WP RealEstate","from":"*","from_inclusive":true,"to":"1.6.26","to_inclusive":true,"patched_in":"1.6.27"}],"published":"2025-03-31T00:00:00Z","updated":"2025-07-18T19:56:49Z"},{"id":"wordfence:f6f91414-5035-4cab-81ad-18558fe43500","source":"wordfence","cve":"","title":"Better Search < 2.2.3 - SQL Injection","severity":"critical","cvss":9.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f91414-5035-4cab-81ad-18558fe43500?source=api-prod","affected":[{"type":"plugin","slug":"better-search","name":"Better Search \u2013 Relevant search results for WordPress","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":false,"patched_in":"2.2.3"}],"published":"2019-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6f91816-a263-4938-bac1-eeb3bb2fc120","source":"wordfence","cve":"CVE-2023-46190","title":"Novo-Map : your WP posts on custom google maps <= 1.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f91816-a263-4938-bac1-eeb3bb2fc120?source=api-prod","affected":[{"type":"plugin","slug":"novo-map","name":"Novo-Map : your WP posts on custom google maps","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f6fce60b-2920-493a-be29-fa78193db875","source":"wordfence","cve":"CVE-2024-5058","title":"Typing Text <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6fce60b-2920-493a-be29-fa78193db875?source=api-prod","affected":[{"type":"plugin","slug":"typing-text","name":"Typing Text","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2024-06-19T00:00:00Z","updated":"2024-06-26T14:05:02Z"},{"id":"wordfence:f6fe59e8-78cf-47f4-90eb-920f8e4fd204","source":"wordfence","cve":"CVE-2017-16758","title":"Ultimate Instagram Feed \u2013 WordPress Plugin < 1.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f6fe59e8-78cf-47f4-90eb-920f8e4fd204?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-instagram-feed","name":"Ultimate Instagram Feed \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":false,"patched_in":"1.3"}],"published":"2017-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7007230-f27e-447a-adc4-d835a0a3039b","source":"wordfence","cve":"CVE-2026-74011","title":"InfiniteWP Client <= 1.13.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7007230-f27e-447a-adc4-d835a0a3039b?source=api-prod","affected":[{"type":"plugin","slug":"iwp-client","name":"InfiniteWP Client","from":"*","from_inclusive":true,"to":"1.13.9","to_inclusive":true,"patched_in":"1.13.10"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:02:53Z"},{"id":"wordfence:f70221e6-59a4-4151-9688-f06e194f51ac","source":"wordfence","cve":"CVE-2023-26535","title":"Sheets To WP Table Live Sync <= 2.12.15 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70221e6-59a4-4151-9688-f06e194f51ac?source=api-prod","affected":[{"type":"plugin","slug":"sheets-to-wp-table-live-sync","name":"FlexTable \u2013 Data Table Sync with Google Sheets","from":"*","from_inclusive":true,"to":"2.12.15","to_inclusive":true,"patched_in":"2.13.0"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f702fef0-8f07-4c94-bbf7-394d66f9ddde","source":"wordfence","cve":"CVE-2024-43321","title":"Team Showcase <= 1.22.23 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f702fef0-8f07-4c94-bbf7-394d66f9ddde?source=api-prod","affected":[{"type":"plugin","slug":"team","name":"Team Showcase","from":"*","from_inclusive":true,"to":"1.22.23","to_inclusive":true,"patched_in":"1.22.24"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T13:13:51Z"},{"id":"wordfence:f708e910-7745-4ff5-9f9f-5552dbaf1113","source":"wordfence","cve":"","title":"Elementor Contact Form DB <= 1.5 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f708e910-7745-4ff5-9f9f-5552dbaf1113?source=api-prod","affected":[{"type":"plugin","slug":"sb-elementor-contact-form-db","name":"FormsDB \u2013 Save Elementor Forms to Google Sheets & Post Type","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2022-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f70956a0-c713-47c0-88af-ed50d369e9d3","source":"wordfence","cve":"CVE-2026-42418","title":"Social Rocket \u2013 Social Sharing Plugin <= 1.3.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70956a0-c713-47c0-88af-ed50d369e9d3?source=api-prod","affected":[{"type":"plugin","slug":"social-rocket","name":"Social Rocket \u2013 Social Sharing Plugin","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2026-10-05T16:14:17Z","updated":"2026-10-08T23:34:54Z"},{"id":"wordfence:f7097b64-d915-4a26-91bf-1714302c84db","source":"wordfence","cve":"CVE-2024-11605","title":"WP Publications <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7097b64-d915-4a26-91bf-1714302c84db?source=api-prod","affected":[{"type":"plugin","slug":"wp-publications","name":"wp-publications","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T00:00:00Z","updated":"2025-01-17T14:05:39Z"},{"id":"wordfence:f709fca2-b7b6-4567-8055-1156f510d1ca","source":"wordfence","cve":"","title":"Envo Extra <= 1.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f709fca2-b7b6-4567-8055-1156f510d1ca?source=api-prod","affected":[{"type":"plugin","slug":"envo-extra","name":"Envo Extra","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":false,"patched_in":"1.8.4"}],"published":"2023-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f70a19a1-d5da-4ed2-b77b-633b6841a6d4","source":"wordfence","cve":"CVE-2024-38738","title":"Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70a19a1-d5da-4ed2-b77b-633b6841a6d4?source=api-prod","affected":[{"type":"plugin","slug":"wp-from-email","name":"Change From Email","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:35:14Z"},{"id":"wordfence:f70a2a58-d9b8-456d-ae4f-9c60b3d6b8a5","source":"wordfence","cve":"CVE-2022-3154","title":"Multiple Plugins from Viszt Peter - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70a2a58-d9b8-456d-ae4f-9c60b3d6b8a5?source=api-prod","affected":[{"type":"plugin","slug":"integration-for-billingo-gravity-forms","name":"Integration for Billingo & Gravity Forms","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"},{"type":"plugin","slug":"woo-billingo-plus","name":"Enhanced Integration for Billingo and WooCommerce","from":"*","from_inclusive":true,"to":"4.4.5.3","to_inclusive":true,"patched_in":"4.4.5.4"},{"type":"plugin","slug":"integration-for-szamlazz-hu-gravity-forms","name":"Integration for Szamlazz.hu & Gravity Forms","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2022-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f70a3776-947f-4322-9e78-100475ed3d7c","source":"wordfence","cve":"CVE-2024-43931","title":"JobSearch <= 2.5.3 - Unauthenticated PHP Object Injection","severity":"critical","cvss":10.0,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70a3776-947f-4322-9e78-100475ed3d7c?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:24:36Z"},{"id":"wordfence:f70b66ad-55fb-45f8-944a-2c8712071113","source":"wordfence","cve":"","title":"Ultimate Addons for Beaver Builder <= 1.24.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70b66ad-55fb-45f8-944a-2c8712071113?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-beaver-builder","name":"Ultimate Addons for Beaver Builder","from":"*","from_inclusive":true,"to":"1.24.3","to_inclusive":true,"patched_in":"1.25.0"}],"published":"2020-01-22T00:00:00Z","updated":"2025-08-29T17:23:57Z"},{"id":"wordfence:f70ba568-b013-4177-928a-eefb606333ee","source":"wordfence","cve":"CVE-2024-5870","title":"Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70ba568-b013-4177-928a-eefb606333ee?source=api-prod","affected":[{"type":"theme","slug":"tweaker5","name":"Tweaker5","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-09-12T21:30:43Z","updated":"2024-09-13T15:10:44Z"},{"id":"wordfence:f70d0bea-3ac2-4235-92a2-09458b85bddd","source":"wordfence","cve":"CVE-2023-2571","title":"Quiz Maker <= 6.4.2.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70d0bea-3ac2-4235-92a2-09458b85bddd?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.4.2.6","to_inclusive":true,"patched_in":"6.4.2.7"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f70dabb4-3ae6-43cf-86e2-62ac1454b697","source":"wordfence","cve":"CVE-2024-13613","title":"Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70dabb4-3ae6-43cf-86e2-62ac1454b697?source=api-prod","affected":[{"type":"plugin","slug":"wise-chat","name":"Wise Chat","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.4"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-17T11:17:17Z"},{"id":"wordfence:f70e1d20-2f8c-40ce-9c2f-74a07cd18f52","source":"wordfence","cve":"CVE-2026-18778","title":"TrueBooker \u2013 Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70e1d20-2f8c-40ce-9c2f-74a07cd18f52?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:13:58Z"},{"id":"wordfence:f70ec123-fff3-4f03-a424-37e0e579b765","source":"wordfence","cve":"CVE-2016-10902","title":"WP Customer Reviews <= 3.0.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70ec123-fff3-4f03-a424-37e0e579b765?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":false,"patched_in":"3.0.9"}],"published":"2014-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f70ee339-d9d4-43ad-8605-6a5533783718","source":"wordfence","cve":"CVE-2025-12098","title":"Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f70ee339-d9d4-43ad-8605-6a5533783718?source=api-prod","affected":[{"type":"plugin","slug":"academy-pro","name":"Academy LMS Pro","from":"*","from_inclusive":true,"to":"3.3.8","to_inclusive":true,"patched_in":"3.3.9"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T08:27:42Z"},{"id":"wordfence:f711c9d0-aa56-4e4c-bbcf-afa9598c3518","source":"wordfence","cve":"CVE-2025-6059","title":"Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=api-prod","affected":[{"type":"plugin","slug":"seraphinite-accelerator","name":"Seraphinite Accelerator","from":"*","from_inclusive":true,"to":"2.27.21","to_inclusive":true,"patched_in":"2.27.22"}],"published":"2025-04-29T00:00:00Z","updated":"2025-06-14T01:43:25Z"},{"id":"wordfence:f713f2f8-545a-4f54-a028-8422c0942a63","source":"wordfence","cve":"CVE-2022-34344","title":"Wholesale Suite <= 2.1.5 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f713f2f8-545a-4f54-a028-8422c0942a63?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2023-02-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7140053-a3c3-44c4-bc83-2e9b9e8853d6","source":"wordfence","cve":"CVE-2026-8884","title":"Instant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7140053-a3c3-44c4-bc83-2e9b9e8853d6?source=api-prod","affected":[{"type":"plugin","slug":"iq-quotation-page","name":"Instant-Quote.co Quotation Page","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:26:35Z","updated":"2026-05-27T05:31:34Z"},{"id":"wordfence:f71453d9-8bbf-4546-b69f-e86cc41da9bd","source":"wordfence","cve":"CVE-2023-33315","title":"Smart App Banner <= 1.1.2 - Cross-Site Request Forgery via wsl_smart_app_banner_options","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f71453d9-8bbf-4546-b69f-e86cc41da9bd?source=api-prod","affected":[{"type":"plugin","slug":"smart-app-banner","name":"Smart App Banner","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":false,"patched_in":"1.1.3"}],"published":"2023-05-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f719a2de-edb1-460e-8efd-fc2ca7fa5245","source":"wordfence","cve":"CVE-2026-61972","title":"ShopLentor Pro <= 2.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f719a2de-edb1-460e-8efd-fc2ca7fa5245?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons-pro","name":"ShopLentor Pro","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-08-01T00:00:00Z","updated":"2026-08-04T19:51:32Z"},{"id":"wordfence:f719d624-d6f9-4095-abaf-f2ba9e448710","source":"wordfence","cve":"CVE-2025-22728","title":"Workreap (theme's plugin) <= 3.3.6 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f719d624-d6f9-4095-abaf-f2ba9e448710?source=api-prod","affected":[{"type":"plugin","slug":"workreap","name":"Workreap","from":"*","from_inclusive":true,"to":"3.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-01-13T17:45:58Z"},{"id":"wordfence:f71ab7bb-886a-4661-92b5-d9ac52901494","source":"wordfence","cve":"","title":"Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f71ab7bb-886a-4661-92b5-d9ac52901494?source=api-prod","affected":[{"type":"plugin","slug":"download-monitor","name":"Download Monitor","from":"*","from_inclusive":true,"to":"1.6.3","to_inclusive":true,"patched_in":"1.6.4"}],"published":"2015-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f71e60b9-68e9-408a-8047-7f74b7fb72b2","source":"wordfence","cve":"CVE-2021-24379","title":"Comments Like Dislike <= 1.1.2 - Add Like/Dislike Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f71e60b9-68e9-408a-8047-7f74b7fb72b2?source=api-prod","affected":[{"type":"plugin","slug":"comments-like-dislike","name":"Comments Like Dislike","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f71f2096-e4c9-406a-a4e5-0006b380fbaa","source":"wordfence","cve":"","title":"VaultPress <=1.9 - Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f71f2096-e4c9-406a-a4e5-0006b380fbaa?source=api-prod","affected":[{"type":"plugin","slug":"vaultpress","name":"Jetpack VaultPress","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2017-09-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f71fc65f-cdc1-4f20-b37e-849ade49ee41","source":"wordfence","cve":"CVE-2025-8899","title":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams <= 7.3.20 - Authenticated (Author+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f71fc65f-cdc1-4f20-b37e-849ade49ee41?source=api-prod","affected":[{"type":"plugin","slug":"ppv-live-webcams","name":"Paid Videochat Turnkey Site \u2013 HTML5 PPV Live Webcams","from":"*","from_inclusive":true,"to":"7.3.20","to_inclusive":true,"patched_in":"7.3.21"}],"published":"2026-03-06T16:42:12Z","updated":"2026-03-07T06:11:59Z"},{"id":"wordfence:f72107e9-95e3-4dab-b1a9-6c91cd6c6eb7","source":"wordfence","cve":"CVE-2025-26913","title":"AR For WordPress <= 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72107e9-95e3-4dab-b1a9-6c91cd6c6eb7?source=api-prod","affected":[{"type":"plugin","slug":"ar-for-wordpress","name":"AR for WordPress","from":"*","from_inclusive":true,"to":"7.7","to_inclusive":true,"patched_in":"7.8"}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-03T16:49:23Z"},{"id":"wordfence:f7222c7e-939a-4666-9d01-f715d2827954","source":"wordfence","cve":"CVE-2024-24831","title":"Premium Addons for Elementor <= 4.10.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7222c7e-939a-4666-9d01-f715d2827954?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.16","to_inclusive":true,"patched_in":"4.10.17"}],"published":"2024-02-02T00:00:00Z","updated":"2024-03-20T20:38:06Z"},{"id":"wordfence:f723be00-79f1-4a24-8502-2c5844ccc5de","source":"wordfence","cve":"CVE-2024-11747","title":"Responsive Videos <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f723be00-79f1-4a24-8502-2c5844ccc5de?source=api-prod","affected":[{"type":"plugin","slug":"responsive-youtube-videos","name":"Responsive Videos","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-03T14:19:50Z","updated":"2024-12-04T02:40:28Z"},{"id":"wordfence:f7258f9b-ec64-4490-859a-5a5d6dfd4d3e","source":"wordfence","cve":"CVE-2026-110903","title":"The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7258f9b-ec64-4490-859a-5a5d6dfd4d3e?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.1","to_inclusive":true,"patched_in":"6.18.2"}],"published":"2026-10-16T12:51:00Z","updated":"2026-10-23T18:40:28Z"},{"id":"wordfence:f725b305-af4c-41bc-8b5d-8f9c70ad569a","source":"wordfence","cve":"CVE-2026-114431","title":"Enable Media Replace < 4.2.3 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f725b305-af4c-41bc-8b5d-8f9c70ad569a?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"*","from_inclusive":true,"to":"4.2.3","to_inclusive":false,"patched_in":"4.2.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:35:51Z"},{"id":"wordfence:f727d82e-8295-4440-90fa-dc41b1d02f8f","source":"wordfence","cve":"CVE-2024-49618","title":"MyTweetLinks <= 1.1.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f727d82e-8295-4440-90fa-dc41b1d02f8f?source=api-prod","affected":[{"type":"plugin","slug":"mytweetlinks","name":"MyTweetLinks","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:00:31Z"},{"id":"wordfence:f72820ec-5638-4c65-a0bd-355b8ca2435c","source":"wordfence","cve":"CVE-2025-60167","title":"Page Manager for Elementor <= 2.0.5 - Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72820ec-5638-4c65-a0bd-355b8ca2435c?source=api-prod","affected":[{"type":"plugin","slug":"page-manager-for-elementor","name":"Page Manager for Elementor","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T12:45:37Z"},{"id":"wordfence:f728cc5e-7330-4dda-b5f7-55c33def6f02","source":"wordfence","cve":"CVE-2023-23821","title":"Interactive Polish Map <= 1.2 - Authenticated (Admi+) Stored Cross-Site Scripting","severity":"medium","cvss":6.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f728cc5e-7330-4dda-b5f7-55c33def6f02?source=api-prod","affected":[{"type":"plugin","slug":"interactive-polish-map","name":"Interactive Polish Map","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7299fa0-7e5d-484e-a5a1-0ffed18ecfd9","source":"wordfence","cve":"CVE-2025-59136","title":"Gerencianet Oficial <= 3.1.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7299fa0-7e5d-484e-a5a1-0ffed18ecfd9?source=api-prod","affected":[{"type":"plugin","slug":"woo-gerencianet-official","name":"Ef\u00ed Bank","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-06T16:25:03Z"},{"id":"wordfence:f72a8b6b-2eef-4245-b215-5ae6fa31e650","source":"wordfence","cve":"CVE-2025-32259","title":"WP ULike <=  4.7.9.1 - Missing Authorization to Unauthenticated Content Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72a8b6b-2eef-4245-b215-5ae6fa31e650?source=api-prod","affected":[{"type":"plugin","slug":"wp-ulike","name":"WP ULike \u2013 Like Buttons, Voting & Engagement Analytics","from":"*","from_inclusive":true,"to":"4.7.9.1","to_inclusive":true,"patched_in":"4.7.10"}],"published":"2025-04-04T00:00:00Z","updated":"2025-08-11T14:22:09Z"},{"id":"wordfence:f72ad187-9745-4d0b-8cb0-5bf07ab1e2ac","source":"wordfence","cve":"CVE-2025-22639","title":"Distance Rate Shipping For WooCommerce <= 1.3.4 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72ad187-9745-4d0b-8cb0-5bf07ab1e2ac?source=api-prod","affected":[{"type":"plugin","slug":"distance-rate-shipping-for-woocommerce","name":"Distance Rate Shipping For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-26T21:55:05Z"},{"id":"wordfence:f72b7973-2599-4833-abe1-783e2a285165","source":"wordfence","cve":"CVE-2026-56043","title":"Customer Reviews for WooCommerce <= 5.110.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72b7973-2599-4833-abe1-783e2a285165?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.110.1","to_inclusive":true,"patched_in":"5.111.0"}],"published":"2026-06-24T00:00:00Z","updated":"2026-06-29T19:04:58Z"},{"id":"wordfence:f72ba0e2-a9c4-43b0-a01f-185554090162","source":"wordfence","cve":"CVE-2023-4948","title":"WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72ba0e2-a9c4-43b0-a01f-185554090162?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-cvr-payment-gateway","name":"WooCommerce CVR Payment Gateway","from":"*","from_inclusive":true,"to":"6.1.0","to_inclusive":false,"patched_in":"6.1.0"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f72c0a27-9602-4465-a14a-15c2a34e578b","source":"wordfence","cve":"","title":"Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72c0a27-9602-4465-a14a-15c2a34e578b?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"3.2","from_inclusive":true,"to":"16.1.2","to_inclusive":true,"patched_in":"16.1.3"}],"published":"2026-09-03T00:00:00Z","updated":"2026-09-04T20:33:36Z"},{"id":"wordfence:f72cbcd8-13ad-4f19-a72c-2c5472e434f1","source":"wordfence","cve":"CVE-2025-23925","title":"Feedburner Optin Form <= 0.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72cbcd8-13ad-4f19-a72c-2c5472e434f1?source=api-prod","affected":[{"type":"plugin","slug":"feedburner-optin-form","name":"Feedburner Optin Form","from":"*","from_inclusive":true,"to":"0.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:42:22Z"},{"id":"wordfence:f72de600-b9d8-4d91-9c80-f2df2a2ef435","source":"wordfence","cve":"","title":"onepagewebsite (Unknown Versions) - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f72de600-b9d8-4d91-9c80-f2df2a2ef435?source=api-prod","affected":[{"type":"theme","slug":"onepagewebsite","name":"onepagewebsite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-12-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7350dc3-82a0-4f61-9ff8-4b622108fa06","source":"wordfence","cve":"","title":"Qwiz Online Quizzes and Flashcards < 3.37 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7350dc3-82a0-4f61-9ff8-4b622108fa06?source=api-prod","affected":[{"type":"plugin","slug":"qwiz-online-quizzes-and-flashcards","name":"Qwizcards | online quizzes and flashcards","from":"*","from_inclusive":true,"to":"3.37","to_inclusive":false,"patched_in":"3.37"}],"published":"2019-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f735f05d-8178-46bd-894d-49ccfb31d304","source":"wordfence","cve":"CVE-2024-8962","title":"WPBITS Addons For Elementor Page Builder <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f735f05d-8178-46bd-894d-49ccfb31d304?source=api-prod","affected":[{"type":"plugin","slug":"wpbits-addons-for-elementor","name":"WPBITS Addons For Elementor Page Builder","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.6"}],"published":"2024-12-03T21:28:15Z","updated":"2024-12-04T11:08:27Z"},{"id":"wordfence:f738ecf3-5f10-43ab-b8ce-34ac41229e9b","source":"wordfence","cve":"CVE-2023-22689","title":"Auto Affiliate Links <= 6.3 - Cross-Site Request Forgery via aalDeleteLink function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f738ecf3-5f10-43ab-b8ce-34ac41229e9b?source=api-prod","affected":[{"type":"plugin","slug":"wp-auto-affiliate-links","name":"Auto Affiliate Links","from":"*","from_inclusive":true,"to":"6.3","to_inclusive":true,"patched_in":"6.3.0.1"}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f742dc8a-530b-41e6-ac82-52770952f619","source":"wordfence","cve":"CVE-2025-22529","title":"WE Blocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f742dc8a-530b-41e6-ac82-52770952f619?source=api-prod","affected":[{"type":"plugin","slug":"we-blocks","name":"WE Blocks \u2013 Image, Testimonial And Logo\tSlider Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:48:15Z"},{"id":"wordfence:f743d15a-a283-4138-9a12-7cf4dd235431","source":"wordfence","cve":"CVE-2012-1786","title":"Videopack (formerly Video Embed & Thumbnail Generator) <= 1.1 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f743d15a-a283-4138-9a12-7cf4dd235431?source=api-prod","affected":[{"type":"plugin","slug":"video-embed-thumbnail-generator","name":"Videopack","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"2.0"}],"published":"2012-02-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f745652d-12d6-46cd-8599-0a42696cb45a","source":"wordfence","cve":"CVE-2019-15873","title":"ProfileGrid \u2013 User Profiles, Memberships, Groups and Communities < 2.8.6 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f745652d-12d6-46cd-8599-0a42696cb45a?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":false,"patched_in":"2.8.6"}],"published":"2018-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f745d10e-9a03-4461-b981-189d4ad3b0a6","source":"wordfence","cve":"CVE-2025-23626","title":"Kumihimo <= 1.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f745d10e-9a03-4461-b981-189d4ad3b0a6?source=api-prod","affected":[{"type":"plugin","slug":"kumihimo","name":"Kumihimo","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:44:17Z"},{"id":"wordfence:f7474e9c-8db2-44ac-80d6-c8b105786af6","source":"wordfence","cve":"CVE-2025-54685","title":"SureDash <= 1.1.0 - Authenticated (Subscriber+) Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7474e9c-8db2-44ac-80d6-c8b105786af6?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.2.0"}],"published":"2025-07-31T00:00:00Z","updated":"2025-08-04T21:35:05Z"},{"id":"wordfence:f7485859-c155-4335-aa76-3b4363dbbe4c","source":"wordfence","cve":"CVE-2025-30908","title":"Web Directory Free <= 1.7.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7485859-c155-4335-aa76-3b4363dbbe4c?source=api-prod","affected":[{"type":"plugin","slug":"web-directory-free","name":"Web Directory plugin Free \u2013 AI powered","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T18:34:26Z"},{"id":"wordfence:f74a2cc2-7e92-493a-a245-8b8c67b92059","source":"wordfence","cve":"CVE-2026-57807","title":"WordPress Single Sign-On (SSO) - Multisite Premium <= 38.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f74a2cc2-7e92-493a-a245-8b8c67b92059?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-oidc-single-sign-on","name":"WordPress Single Sign-On (SSO) - Multisite Enterprise","from":"*","from_inclusive":true,"to":"38.5.8","to_inclusive":true,"patched_in":"38.5.8.1"}],"published":"2026-07-09T00:00:00Z","updated":"2026-09-09T14:39:30Z"},{"id":"wordfence:f74c392c-1d79-4498-8298-d1160af250b6","source":"wordfence","cve":"CVE-2025-23426","title":"go Social <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f74c392c-1d79-4498-8298-d1160af250b6?source=api-prod","affected":[{"type":"plugin","slug":"go-social","name":"go Social","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T14:18:01Z"},{"id":"wordfence:f74c419a-56de-4190-925d-876d32f712e1","source":"wordfence","cve":"CVE-2024-12435","title":"Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f74c419a-56de-4190-925d-876d32f712e1?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-compare-products","name":"Compare Products for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2025-01-06T16:03:40Z","updated":"2025-07-25T19:38:48Z"},{"id":"wordfence:f74d2236-90aa-4c5f-b427-420649cdc387","source":"wordfence","cve":"CVE-2025-31858","title":"Local Magic <= 2.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f74d2236-90aa-4c5f-b427-420649cdc387?source=api-prod","affected":[{"type":"plugin","slug":"local-magic","name":"Local Magic","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-02T00:00:00Z","updated":"2025-04-08T14:26:14Z"},{"id":"wordfence:f7509053-fc70-420a-b998-b7158732c147","source":"wordfence","cve":"CVE-2025-11800","title":"Surbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7509053-fc70-420a-b998-b7158732c147?source=api-prod","affected":[{"type":"plugin","slug":"surbma-minicrm-shortcode","name":"Surbma | MiniCRM Shortcode","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2025-11-20T19:21:43Z","updated":"2026-05-12T17:15:28Z"},{"id":"wordfence:f75093a5-e0cc-4d3b-bdef-a65561127b3d","source":"wordfence","cve":"CVE-2022-4468","title":"WP Recipe Maker <= 8.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f75093a5-e0cc-4d3b-bdef-a65561127b3d?source=api-prod","affected":[{"type":"plugin","slug":"wp-recipe-maker","name":"WP Recipe Maker","from":"*","from_inclusive":true,"to":"8.6.0","to_inclusive":true,"patched_in":"8.6.1"}],"published":"2022-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f753b536-6ccd-4f79-83da-48cabb15b72a","source":"wordfence","cve":"CVE-2017-18504","title":"Twitter Cards Meta <= 2.4.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f753b536-6ccd-4f79-83da-48cabb15b72a?source=api-prod","affected":[{"type":"plugin","slug":"twitter-cards-meta","name":"Twitter Cards Meta \u2013 Best Twitter Card Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.4.5","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2017-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7551d48-0858-4d82-aaca-3b04741938fd","source":"wordfence","cve":"CVE-2025-62098","title":"Portfolio Gallery <= 1.4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7551d48-0858-4d82-aaca-3b04741938fd?source=api-prod","affected":[{"type":"plugin","slug":"gallery-portfolio","name":"Portfolio Gallery \u2013 Responsive Image Gallery","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:24:07Z"},{"id":"wordfence:f757cea8-9133-410a-92d7-960490b018e9","source":"wordfence","cve":"CVE-2025-28980","title":"Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f757cea8-9133-410a-92d7-960490b018e9?source=api-prod","affected":[{"type":"plugin","slug":"aviation-weather-from-noaa","name":"Aviation Weather from NOAA","from":"*","from_inclusive":true,"to":"0.7.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-30T00:00:00Z","updated":"2025-07-08T17:33:19Z"},{"id":"wordfence:f7580145-03da-4aff-b804-39125e7daad1","source":"wordfence","cve":"CVE-2024-7611","title":"Enter Addons \u2013 Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7580145-03da-4aff-b804-39125e7daad1?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.8","to_inclusive":true,"patched_in":"2.1.9"}],"published":"2024-09-06T01:19:29Z","updated":"2024-09-24T13:44:26Z"},{"id":"wordfence:f75936d7-12bc-47cc-b901-17fd42c05d66","source":"wordfence","cve":"CVE-2014-3882","title":"Login rebuilder < 1.2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f75936d7-12bc-47cc-b901-17fd42c05d66?source=api-prod","affected":[{"type":"plugin","slug":"login-rebuilder","name":"Login rebuilder","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2014-05-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f75966a5-e593-4c86-842d-c136ae847eb0","source":"wordfence","cve":"CVE-2023-4284","title":"Post Timeline <= 2.2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f75966a5-e593-4c86-842d-c136ae847eb0?source=api-prod","affected":[{"type":"plugin","slug":"post-timeline","name":"Post Timeline","from":"*","from_inclusive":true,"to":"2.2.5","to_inclusive":true,"patched_in":"2.2.6"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f75c3ed0-3b05-4132-b102-ba64fb8c338d","source":"wordfence","cve":"CVE-2024-49294","title":"Bus Ticket Booking with Seat Reservation <= 5.4.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f75c3ed0-3b05-4132-b102-ba64fb8c338d?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.4.3","to_inclusive":true,"patched_in":"5.4.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-31T14:41:48Z"},{"id":"wordfence:f75f83bf-3c86-44e9-b535-cd721061ee93","source":"wordfence","cve":"CVE-2023-37967","title":"DirectoryPress <= 3.6.2 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f75f83bf-3c86-44e9-b535-cd721061ee93?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2023-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f76411f1-98ea-4d75-9ddd-e41a5d08c698","source":"wordfence","cve":"CVE-2023-22709","title":"SRS Simple Hits Counter <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f76411f1-98ea-4d75-9ddd-e41a5d08c698?source=api-prod","affected":[{"type":"plugin","slug":"srs-simple-hits-counter","name":"SRS Simple Hits Counter","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2023-01-19T00:00:00Z","updated":"2025-01-17T14:31:21Z"},{"id":"wordfence:f765e21e-938a-4110-8fdf-12315e2a79cc","source":"wordfence","cve":"CVE-2023-40201","title":"Futurio Extra <= 1.8.2 - Cross-Site Request Forgery via 'futurio_extra_reset_mod'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f765e21e-938a-4110-8fdf-12315e2a79cc?source=api-prod","affected":[{"type":"plugin","slug":"futurio-extra","name":"Futurio Extra","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":"1.8.3"}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7663085-970e-4d11-b63e-8363a51e3acd","source":"wordfence","cve":"CVE-2025-47451","title":"Product Quantity Dropdown For Woocommerce <= 1.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7663085-970e-4d11-b63e-8363a51e3acd?source=api-prod","affected":[{"type":"plugin","slug":"product-quantity-dropdown-for-woocommerce","name":"Product Quantity Dropdown For Woocommerce","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-12T20:42:59Z"},{"id":"wordfence:f767d94b-fe92-4b69-9d81-96de51e12983","source":"wordfence","cve":"CVE-2023-3813","title":"Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f767d94b-fe92-4b69-9d81-96de51e12983?source=api-prod","affected":[{"type":"plugin","slug":"jupiterx-core","name":"Jupiter X Core","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"4.6.9"}],"published":"2023-07-20T00:00:00Z","updated":"2024-09-19T15:02:55Z"},{"id":"wordfence:f7686b11-97a8-4f09-bbfa-d77120cc35b7","source":"wordfence","cve":"CVE-2023-2500","title":"Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7686b11-97a8-4f09-bbfa-d77120cc35b7?source=api-prod","affected":[{"type":"plugin","slug":"go_pricing","name":"Go Pricing - WordPress Responsive Pricing Tables","from":"*","from_inclusive":true,"to":"3.3.19","to_inclusive":true,"patched_in":"3.4"}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f76a757b-8eac-4e54-ae0e-3f0a491ff582","source":"wordfence","cve":"CVE-2026-57385","title":"Vitepos \u2013 Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f76a757b-8eac-4e54-ae0e-3f0a491ff582?source=api-prod","affected":[{"type":"plugin","slug":"vitepos-lite","name":"Vitepos \u2013 Point of Sale (POS) for WooCommerce","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-14T19:47:24Z"},{"id":"wordfence:f76adafd-1218-4e80-af63-8d2bfb0aa5d1","source":"wordfence","cve":"CVE-2023-25998","title":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f76adafd-1218-4e80-af63-8d2bfb0aa5d1?source=api-prod","affected":[{"type":"theme","slug":"samex","name":"Samex - Clean, Minimal Shop WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-25T00:00:00Z","updated":"2025-07-01T19:04:09Z"},{"id":"wordfence:f771cf62-3aa9-472e-beb5-011a4f28e335","source":"wordfence","cve":"","title":"Social Media Share Buttons & Social Sharing Icons <= 1.2.1 - Unspecified Vulnerabilities","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f771cf62-3aa9-472e-beb5-011a4f28e335?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-social-media-icons","name":"Social Media Share Buttons & Social Sharing Icons","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2015-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f773ef2f-c33d-414e-9c2f-df22b9d00234","source":"wordfence","cve":"CVE-2021-25024","title":"Event Calendar <= 1.1.50 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f773ef2f-c33d-414e-9c2f-df22b9d00234?source=api-prod","affected":[{"type":"plugin","slug":"event-calendar-wd","name":"Event Calendar WD version","from":"*","from_inclusive":true,"to":"1.1.50","to_inclusive":true,"patched_in":"1.1.51"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7750f70-e79c-45fb-b792-ba6a4da59964","source":"wordfence","cve":"CVE-2023-25460","title":"Easy Ad Manager <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7750f70-e79c-45fb-b792-ba6a4da59964?source=api-prod","affected":[{"type":"plugin","slug":"easy-ad-manager","name":"Easy Ad Manager","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7751059-b709-4499-acd1-09c0956fd309","source":"wordfence","cve":"CVE-2026-22516","title":"Wizor's <= 2.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7751059-b709-4499-acd1-09c0956fd309?source=api-prod","affected":[{"type":"theme","slug":"wizors-investments","name":"Wizor's | Investments, Economics & Bankin WordPress Theme","from":"*","from_inclusive":true,"to":"2.12","to_inclusive":true,"patched_in":""}],"published":"2026-03-06T00:00:00Z","updated":"2026-03-12T16:34:19Z"},{"id":"wordfence:f775a263-1817-4da9-8fda-40f3a863a012","source":"wordfence","cve":"CVE-2024-50490","title":"PegaPoll <= 1.0.2 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f775a263-1817-4da9-8fda-40f3a863a012?source=api-prod","affected":[{"type":"plugin","slug":"pegapoll","name":"PegaPoll","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T10:38:26Z"},{"id":"wordfence:f7773b98-537f-4f4e-98d6-db61d2bffe8c","source":"wordfence","cve":"CVE-2024-5086","title":"Essential Addons for Elementor PRO \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7773b98-537f-4f4e-98d6-db61d2bffe8c?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-elementor","name":"Essential Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"5.8.14","to_inclusive":true,"patched_in":"5.8.15"}],"published":"2024-05-28T19:01:16Z","updated":"2024-05-29T07:33:54Z"},{"id":"wordfence:f779443a-e5b9-45d6-bfd3-d22243d34917","source":"wordfence","cve":"CVE-2025-47542","title":"Simple calendar for Elementor <= 1.6.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f779443a-e5b9-45d6-bfd3-d22243d34917?source=api-prod","affected":[{"type":"plugin","slug":"simple-calendar-for-elementor","name":"Simple calendar for Elementor","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T13:42:44Z"},{"id":"wordfence:f77a284f-ac63-47b7-b5db-b6d0ccd03541","source":"wordfence","cve":"CVE-2024-50549","title":"Bonway Static Block Editor <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f77a284f-ac63-47b7-b5db-b6d0ccd03541?source=api-prod","affected":[{"type":"plugin","slug":"bonway-static-block-editor","name":"Bonway Static Block Editor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T14:44:51Z"},{"id":"wordfence:f77cc1ed-d30e-4651-af23-29d34d76dc92","source":"wordfence","cve":"","title":"Occasions <= 1.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f77cc1ed-d30e-4651-af23-29d34d76dc92?source=api-prod","affected":[{"type":"plugin","slug":"occasions","name":"Occasions","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2013-03-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f77e04c0-4674-409d-8966-53dfdb5b3ab3","source":"wordfence","cve":"CVE-2025-62916","title":"Flights & Hotels Booking WP Plugin <= 3.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f77e04c0-4674-409d-8966-53dfdb5b3ab3?source=api-prod","affected":[{"type":"plugin","slug":"adiaha-hotel","name":"Travel & Tours Meta Search","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-30T00:00:00Z","updated":"2025-10-29T15:02:38Z"},{"id":"wordfence:f77e2d1e-7925-4343-9c22-5b77ea0d439b","source":"wordfence","cve":"CVE-2024-47325","title":"Multiple Page Generator Plugin \u2013 MPG <= 3.4.7 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f77e2d1e-7925-4343-9c22-5b77ea0d439b?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":true,"patched_in":"3.4.8"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:32:14Z"},{"id":"wordfence:f7804fe0-b36a-4930-ab9d-b48f11a7f8a6","source":"wordfence","cve":"CVE-2026-119516","title":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.20 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7804fe0-b36a-4930-ab9d-b48f11a7f8a6?source=api-prod","affected":[{"type":"plugin","slug":"radius-booking","name":"Radius Booking \u2013 Appointment Booking Calendar & Scheduling for Services & Events","from":"*","from_inclusive":true,"to":"1.0.20","to_inclusive":true,"patched_in":"1.0.21"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T12:54:53Z"},{"id":"wordfence:f781db57-1015-439b-80b5-0e08df0bd05c","source":"wordfence","cve":"CVE-2025-67952","title":"Grand Tour < 5.6.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f781db57-1015-439b-80b5-0e08df0bd05c?source=api-prod","affected":[{"type":"theme","slug":"grandtour","name":"Grand Tour | Travel Agency WordPress","from":"*","from_inclusive":true,"to":"5.6.2","to_inclusive":false,"patched_in":"5.6.2"}],"published":"2026-01-20T00:00:00Z","updated":"2026-01-27T19:16:00Z"},{"id":"wordfence:f7830aaf-5257-4106-a953-adc70e22a7be","source":"wordfence","cve":"CVE-2026-62107","title":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7830aaf-5257-4106-a953-adc70e22a7be?source=api-prod","affected":[{"type":"plugin","slug":"learning-management-system","name":"Masteriyo LMS \u2013 LMS Course Builder, Quizzes & Certificates","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:23:28Z"},{"id":"wordfence:f783e626-37c0-4ad9-9074-c5332583a0cb","source":"wordfence","cve":"CVE-2026-4304","title":"WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f783e626-37c0-4ad9-9074-c5332583a0cb?source=api-prod","affected":[{"type":"plugin","slug":"wp-cookie-allow","name":"WeePie Cookie Allow","from":"*","from_inclusive":true,"to":"3.4.11","to_inclusive":true,"patched_in":"3.4.12"}],"published":"2026-05-04T17:38:50Z","updated":"2026-05-05T13:27:29Z"},{"id":"wordfence:f7857dad-a843-4e5e-9994-41d025b8a5ac","source":"wordfence","cve":"CVE-2024-49320","title":"Encyclopedia / Glossary / Wiki <= 1.7.60 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7857dad-a843-4e5e-9994-41d025b8a5ac?source=api-prod","affected":[{"type":"plugin","slug":"encyclopedia-lexicon-glossary-wiki-dictionary","name":"Encyclopedia / Glossary / Wiki","from":"*","from_inclusive":true,"to":"1.7.60","to_inclusive":true,"patched_in":"1.7.61"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-18T15:46:33Z"},{"id":"wordfence:f785edc7-b5c1-4c39-bc66-d9d1404a2048","source":"wordfence","cve":"CVE-2024-6136","title":"WP eStore <= 8.5.5 - Cross-Site Request Forgery to Settings Reset","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f785edc7-b5c1-4c39-bc66-d9d1404a2048?source=api-prod","affected":[{"type":"plugin","slug":"wp-cart-for-digital-products","name":"WP eStore","from":"*","from_inclusive":true,"to":"8.5.5","to_inclusive":true,"patched_in":"8.5.6"}],"published":"2024-07-19T00:00:00Z","updated":"2024-08-12T12:51:18Z"},{"id":"wordfence:f787cad3-cf99-413a-952f-082fae973bef","source":"wordfence","cve":"CVE-2022-2635","title":"Autoptimize <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f787cad3-cf99-413a-952f-082fae973bef?source=api-prod","affected":[{"type":"plugin","slug":"autoptimize","name":"Autoptimize","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2022-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f787e299-21f8-4662-935a-ff1e25c7d275","source":"wordfence","cve":"","title":"Gmedia Photo Gallery < 0.9.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f787e299-21f8-4662-935a-ff1e25c7d275?source=api-prod","affected":[{"type":"plugin","slug":"grand-media","name":"Gmedia Photo Gallery","from":"*","from_inclusive":true,"to":"0.9.3","to_inclusive":true,"patched_in":"0.9.4"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7895360-67ed-47ee-8519-79dd92dc6cef","source":"wordfence","cve":"CVE-2025-69061","title":"MoveMe <= 1.2.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7895360-67ed-47ee-8519-79dd92dc6cef?source=api-prod","affected":[{"type":"theme","slug":"moveme","name":"MoveMe | Moving & Storage Relocation Company WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-14T19:33:44Z"},{"id":"wordfence:f78cc71a-db22-4f5f-9231-52c66561df02","source":"wordfence","cve":"CVE-2023-45755","title":"BuddyPress Global Search <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f78cc71a-db22-4f5f-9231-52c66561df02?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-global-search","name":"BuddyPress Global Search","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f78e6faf-ff1d-4944-aa54-7843cc8614f4","source":"wordfence","cve":"CVE-2017-9420","title":"Spiffy Calendar < 3.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f78e6faf-ff1d-4944-aa54-7843cc8614f4?source=api-prod","affected":[{"type":"plugin","slug":"spiffy-calendar","name":"Spiffy Calendar","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":false,"patched_in":"3.3.0"}],"published":"2017-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f78f82a5-1b39-4cae-99c1-207aee9d7105","source":"wordfence","cve":"CVE-2026-107419","title":"AutoPoly \u2013 AI Translation For Polylang <= 1.6.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f78f82a5-1b39-4cae-99c1-207aee9d7105?source=api-prod","affected":[{"type":"plugin","slug":"automatic-translations-for-polylang","name":"AutoPoly \u2013 AI Translation For Polylang","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-09T15:27:38Z"},{"id":"wordfence:f790114b-d000-4dd3-828d-3d00ee9ab52b","source":"wordfence","cve":"CVE-2024-7766","title":"Adicon Server <= 1.2 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f790114b-d000-4dd3-828d-3d00ee9ab52b?source=api-prod","affected":[{"type":"plugin","slug":"adicons","name":"Adicon Server","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-08-22T00:00:00Z","updated":"2024-10-04T15:44:10Z"},{"id":"wordfence:f79164c2-be3b-496d-b747-3e4b60b7fc2b","source":"wordfence","cve":"CVE-2024-7985","title":"FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f79164c2-be3b-496d-b747-3e4b60b7fc2b?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2024-10-29T02:34:26Z","updated":"2024-10-29T15:31:54Z"},{"id":"wordfence:f7926afb-b441-49bf-9af2-5bfc434319e3","source":"wordfence","cve":"CVE-2015-1582","title":"WDSocialWidgets < 1.0.11 - Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7926afb-b441-49bf-9af2-5bfc434319e3?source=api-prod","affected":[{"type":"plugin","slug":"spider-facebook","name":"WDSocialWidgets","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":false,"patched_in":"1.0.11"}],"published":"2015-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f793b950-3066-45b8-bcf8-a4b4e39d4208","source":"wordfence","cve":"CVE-2024-3963","title":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.13 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f793b950-3066-45b8-bcf8-a4b4e39d4208?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.13","to_inclusive":true,"patched_in":"1.12.14"}],"published":"2024-06-22T00:00:00Z","updated":"2024-08-09T18:24:15Z"},{"id":"wordfence:f7957619-e562-4043-920d-275c58684328","source":"wordfence","cve":"CVE-2025-15486","title":"Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7957619-e562-4043-920d-275c58684328?source=api-prod","affected":[{"type":"plugin","slug":"kunze-law","name":"Kunze Law","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2026-01-13T16:42:12Z","updated":"2026-01-14T05:28:13Z"},{"id":"wordfence:f795a46c-ba0c-45d5-9ff7-638752f1681b","source":"wordfence","cve":"","title":"User Meta Manager < 3.4.7 - Authenticated Blind SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f795a46c-ba0c-45d5-9ff7-638752f1681b?source=api-prod","affected":[{"type":"plugin","slug":"user-meta-manager","name":"User Meta Manager","from":"*","from_inclusive":true,"to":"3.4.7","to_inclusive":false,"patched_in":"3.4.7"}],"published":"2015-02-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7960d2b-8691-4a33-bab9-dc637743f12a","source":"wordfence","cve":"CVE-2025-23887","title":"Blog Summary <= 0.1.2 \u03b2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7960d2b-8691-4a33-bab9-dc637743f12a?source=api-prod","affected":[{"type":"plugin","slug":"blog-summary","name":"Blog Summary","from":"*","from_inclusive":true,"to":"0.1.2 \u03b2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:03:40Z"},{"id":"wordfence:f7968054-69f1-47f5-9a32-b124ee1133ce","source":"wordfence","cve":"CVE-2025-12403","title":"Associados Amazon Plugin <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7968054-69f1-47f5-9a32-b124ee1133ce?source=api-prod","affected":[{"type":"plugin","slug":"brzon","name":"Associados Amazon Plugin","from":"*","from_inclusive":true,"to":"0.8","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:31:50Z","updated":"2025-11-04T04:27:23Z"},{"id":"wordfence:f796ade5-db48-4334-9a76-15326f62c9a5","source":"wordfence","cve":"CVE-2025-11812","title":"Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f796ade5-db48-4334-9a76-15326f62c9a5?source=api-prod","affected":[{"type":"plugin","slug":"reuse-builder","name":"Reuse Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T16:02:55Z","updated":"2025-11-04T04:27:24Z"},{"id":"wordfence:f796b282-0012-4d86-914d-72c7707dce42","source":"wordfence","cve":"","title":"bbPress Members Only <= 1.2.1 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f796b282-0012-4d86-914d-72c7707dce42?source=api-prod","affected":[{"type":"plugin","slug":"bbp-members-only","name":"bbPress Members Only","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2019-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f799db97-ca61-439d-94ec-a44270d1cd07","source":"wordfence","cve":"CVE-2024-12422","title":"Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f799db97-ca61-439d-94ec-a44270d1cd07?source=api-prod","affected":[{"type":"plugin","slug":"import-eventbrite-events","name":"Import Eventbrite Events","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2024-12-13T00:00:00Z","updated":"2024-12-14T05:34:18Z"},{"id":"wordfence:f79d3938-bf85-4e0d-80a3-2ff365482d36","source":"wordfence","cve":"CVE-2022-47162","title":"DH \u2013 Anti AdBlocker <= 36 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f79d3938-bf85-4e0d-80a3-2ff365482d36?source=api-prod","affected":[{"type":"plugin","slug":"dh-anti-adblocker","name":"DH \u2013 Anti AdBlocker","from":"*","from_inclusive":true,"to":"36","to_inclusive":true,"patched_in":"37"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f79f9385-f8d1-44a0-9e53-7576a9453163","source":"wordfence","cve":"CVE-2023-51369","title":"Customize My Account for WooCommerce <= 1.8.3 - Cross-Site Request Forgery via restore_my_account_tabs","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f79f9385-f8d1-44a0-9e53-7576a9453163?source=api-prod","affected":[{"type":"plugin","slug":"customize-my-account-for-woocommerce","name":"SysBasics Customize My Account for WooCommerce \u2013 Live My Account Customizer","from":"*","from_inclusive":true,"to":"1.8.3","to_inclusive":true,"patched_in":"1.8.4"}],"published":"2023-12-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7a2c607-a18b-49b5-ac72-892c570a5b8d","source":"wordfence","cve":"CVE-2026-57740","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7a2c607-a18b-49b5-ac72-892c570a5b8d?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-07-06T00:00:00Z","updated":"2026-08-17T04:07:45Z"},{"id":"wordfence:f7a2f989-7735-4bed-9cd9-1590093b0cd9","source":"wordfence","cve":"CVE-2025-31599","title":"Bulk Product Sync <= 8.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7a2f989-7735-4bed-9cd9-1590093b0cd9?source=api-prod","affected":[{"type":"plugin","slug":"sync-wc-google","name":"Bulk Product Sync \u2013 Bulk Product Editor for WooCommerce with Google Sheets\u2122","from":"*","from_inclusive":true,"to":"8.6","to_inclusive":true,"patched_in":"9.0"}],"published":"2025-04-08T00:00:00Z","updated":"2025-04-23T17:51:33Z"},{"id":"wordfence:f7acbb6f-99e0-483a-95ed-c60905dcbd50","source":"wordfence","cve":"CVE-2025-30820","title":"WishSuite <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7acbb6f-99e0-483a-95ed-c60905dcbd50?source=api-prod","affected":[{"type":"plugin","slug":"wishsuite","name":"WishSuite \u2013 Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:43:37Z"},{"id":"wordfence:f7ad5d55-3964-4bb9-9f7b-496e99db80f4","source":"wordfence","cve":"CVE-2025-49950","title":"Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation","severity":"high","cvss":7.2,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ad5d55-3964-4bb9-9f7b-496e99db80f4?source=api-prod","affected":[{"type":"plugin","slug":"billingo","name":"Billingo Official for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2025-07-10T00:00:00Z","updated":"2026-10-13T16:55:41Z"},{"id":"wordfence:f7ad9f8c-9b76-4b3e-987c-ed99beeb2937","source":"wordfence","cve":"CVE-2021-24959","title":"WP Email Users <= 1.7.6 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ad9f8c-9b76-4b3e-987c-ed99beeb2937?source=api-prod","affected":[{"type":"plugin","slug":"wp-email-users","name":"WP Email Users","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7adeee0-30ff-4759-b42e-1ac2dea5a8a4","source":"wordfence","cve":"CVE-2023-28409","title":"MW WP Form <= 4.4.2 - Directory Traversal via _file_upload","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7adeee0-30ff-4759-b42e-1ac2dea5a8a4?source=api-prod","affected":[{"type":"plugin","slug":"mw-wp-form","name":"MW WP Form","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":false,"patched_in":"4.4.3"}],"published":"2023-05-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7ae863c-4638-49ab-bb1f-52346884c3aa","source":"wordfence","cve":"CVE-2023-1871","title":"YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ae863c-4638-49ab-bb1f-52346884c3aa?source=api-prod","affected":[{"type":"plugin","slug":"yourchannel","name":"YourChannel: Everything you want in a YouTube plugin.","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7afae24-a905-473f-8015-c93b60189eb5","source":"wordfence","cve":"CVE-2025-62929","title":"Testimonial Slider <= 2.0.15 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7afae24-a905-473f-8015-c93b60189eb5?source=api-prod","affected":[{"type":"plugin","slug":"testimonial","name":"Testimonial \u2013 Testimonial Slider, Reviews Slider, Testimonial By AI","from":"*","from_inclusive":true,"to":"2.0.15","to_inclusive":true,"patched_in":""}],"published":"2025-10-05T00:00:00Z","updated":"2025-10-29T14:58:14Z"},{"id":"wordfence:f7afbe2b-72a8-40da-bc94-ff2a1b9569b4","source":"wordfence","cve":"CVE-2023-44149","title":"Brands for WooCommerce <= 3.8.2.2 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7afbe2b-72a8-40da-bc94-ff2a1b9569b4?source=api-prod","affected":[{"type":"plugin","slug":"brands-for-woocommerce","name":"Brands for WooCommerce","from":"*","from_inclusive":true,"to":"3.8.2.3","to_inclusive":false,"patched_in":"3.8.2.3"}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7b239b1-c234-40d0-a4bc-f2db54937494","source":"wordfence","cve":"CVE-2025-24750","title":"ExactMetrics <= 8.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b239b1-c234-40d0-a4bc-f2db54937494?source=api-prod","affected":[{"type":"plugin","slug":"google-analytics-dashboard-for-wp","name":"ExactMetrics \u2013 Google Analytics Dashboard for WordPress (Website Stats Plugin)","from":"*","from_inclusive":true,"to":"8.1.0","to_inclusive":true,"patched_in":"8.2.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:29:21Z"},{"id":"wordfence:f7b24a89-816d-4021-b8de-d1ca14ce3cb9","source":"wordfence","cve":"","title":"WP Multiple Meta Box <= 1.0.0 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b24a89-816d-4021-b8de-d1ca14ce3cb9?source=api-prod","affected":[{"type":"plugin","slug":"multi-meta-box","name":"WP Multiple Meta Box","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2016-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7b24b7c-1a15-4b38-b59e-bcad39cc4340","source":"wordfence","cve":"CVE-2024-27985","title":"PropertyHive <= 2.0.9 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b24b7c-1a15-4b38-b59e-bcad39cc4340?source=api-prod","affected":[{"type":"plugin","slug":"propertyhive","name":"Property Hive","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.0.10"}],"published":"2024-03-13T00:00:00Z","updated":"2024-03-20T21:22:15Z"},{"id":"wordfence:f7b25126-9db4-488a-aa47-2f903b0b9fdf","source":"wordfence","cve":"CVE-2025-24748","title":"Avada <= 7.11.10 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b25126-9db4-488a-aa47-2f903b0b9fdf?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.10","to_inclusive":true,"patched_in":"7.11.11"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T16:26:25Z"},{"id":"wordfence:f7b45b1d-7ed6-4382-b69c-45ea45e4d0db","source":"wordfence","cve":"CVE-2024-13783","title":"FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b45b1d-7ed6-4382-b69c-45ea45e4d0db?source=api-prod","affected":[{"type":"plugin","slug":"formcraft3","name":"FormCraft","from":"*","from_inclusive":true,"to":"3.9.11","to_inclusive":true,"patched_in":"3.9.12"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T11:10:22Z"},{"id":"wordfence:f7b5016c-85dd-467f-8566-6f6fe7a4efc0","source":"wordfence","cve":"CVE-2026-62054","title":"Yacht Rental - Boat Services WordPress Theme <= 2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b5016c-85dd-467f-8566-6f6fe7a4efc0?source=api-prod","affected":[{"type":"theme","slug":"yacht-rental","name":"Yacht Rental - Boat Services WordPress Theme","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T07:27:00Z","updated":"2026-10-13T14:00:02Z"},{"id":"wordfence:f7b6b59a-366f-4fa6-9e54-01372d6cea8c","source":"wordfence","cve":"","title":"ImmoPress <= 0.0.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b6b59a-366f-4fa6-9e54-01372d6cea8c?source=api-prod","affected":[{"type":"plugin","slug":"immopress","name":"ImmoPress","from":"*","from_inclusive":true,"to":"0.0.4","to_inclusive":true,"patched_in":""}],"published":"2014-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7b8ab8c-a7f3-4761-834d-c875be2b10bf","source":"wordfence","cve":"CVE-2026-94178","title":"Import and export users and customers <= 2.5.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7b8ab8c-a7f3-4761-834d-c875be2b10bf?source=api-prod","affected":[{"type":"plugin","slug":"import-users-from-csv-with-meta","name":"Import and export users and customers","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2026-09-24T00:00:00Z","updated":"2026-09-30T16:52:21Z"},{"id":"wordfence:f7be0fe9-3b6a-47e7-8a18-856b0e164f09","source":"wordfence","cve":"CVE-2024-37505","title":"Business One Page <= 1.2.9 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7be0fe9-3b6a-47e7-8a18-856b0e164f09?source=api-prod","affected":[{"type":"theme","slug":"business-one-page","name":"Business One Page","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2024-07-05T00:00:00Z","updated":"2024-07-10T13:39:34Z"},{"id":"wordfence:f7be9241-26b6-4dd0-bd26-fdff59da3b76","source":"wordfence","cve":"CVE-2023-25983","title":"KB Support <= 1.5.84 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":4.4,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7be9241-26b6-4dd0-bd26-fdff59da3b76?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.5.84","to_inclusive":true,"patched_in":"1.5.85"}],"published":"2023-02-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7bf63a9-3c99-43fc-a973-d75f2469fb7b","source":"wordfence","cve":"CVE-2025-24719","title":"Widget Countdown <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7bf63a9-3c99-43fc-a973-d75f2469fb7b?source=api-prod","affected":[{"type":"plugin","slug":"widget-countdown","name":"Countdown Timer \u2013 Widget Countdown","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:55:10Z"},{"id":"wordfence:f7c092f9-208f-404b-9680-ad77e80a0be6","source":"wordfence","cve":"CVE-2025-23696","title":"Staging CDN <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c092f9-208f-404b-9680-ad77e80a0be6?source=api-prod","affected":[{"type":"plugin","slug":"staging-cdn","name":"Staging CDN","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-17T16:10:07Z"},{"id":"wordfence:f7c095f7-f8aa-4b4d-841c-41b9850b5c62","source":"wordfence","cve":"CVE-2025-53562","title":"Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c095f7-f8aa-4b4d-841c-41b9850b5c62?source=api-prod","affected":[{"type":"plugin","slug":"lbg_universal_video_player_addon_visual_composer","name":"Universal Video Player - Addon for WPBakery Page Builder","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2.0"}],"published":"2025-07-17T00:00:00Z","updated":"2025-07-22T13:38:20Z"},{"id":"wordfence:f7c1b21d-5c31-48be-a088-5d0e9a41b346","source":"wordfence","cve":"CVE-2026-85346","title":"FV Player <= 7.5.56.7211 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c1b21d-5c31-48be-a088-5d0e9a41b346?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7211","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-11T13:31:21Z"},{"id":"wordfence:f7c2f45d-7ed8-4462-b769-2c4778fd6f38","source":"wordfence","cve":"CVE-2025-1523","title":"Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c2f45d-7ed8-4462-b769-2c4778fd6f38?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.8.5","to_inclusive":true,"patched_in":"3.8.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-22T18:23:03Z"},{"id":"wordfence:f7c39d66-f1e1-4d41-a9e4-984aec3f37dc","source":"wordfence","cve":"CVE-2026-8996","title":"Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c39d66-f1e1-4d41-a9e4-984aec3f37dc?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.26","to_inclusive":true,"patched_in":"1.22.27"}],"published":"2026-07-08T17:48:06Z","updated":"2026-07-09T06:52:51Z"},{"id":"wordfence:f7c654d4-7067-4188-93c0-ece654f8d986","source":"wordfence","cve":"CVE-2025-68571","title":"SALESmanago <= 3.9.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c654d4-7067-4188-93c0-ece654f8d986?source=api-prod","affected":[{"type":"plugin","slug":"salesmanago","name":"Manago AI & Leadoo AI","from":"*","from_inclusive":true,"to":"3.9.0","to_inclusive":true,"patched_in":"3.9.1"}],"published":"2025-12-24T00:00:00Z","updated":"2026-01-06T14:27:42Z"},{"id":"wordfence:f7c93236-09d9-4e52-a96b-917d57d667f7","source":"wordfence","cve":"CVE-2025-30905","title":"Secure Copy Content Protection and Content Locking <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c93236-09d9-4e52-a96b-917d57d667f7?source=api-prod","affected":[{"type":"plugin","slug":"secure-copy-content-protection","name":"Secure Copy Content Protection and Content Locking","from":"*","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"4.4.5"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:10:15Z"},{"id":"wordfence:f7c9fb37-bda0-4a5d-811e-1f422c58bb06","source":"wordfence","cve":"CVE-2025-30634","title":"WP Featured Content Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c9fb37-bda0-4a5d-811e-1f422c58bb06?source=api-prod","affected":[{"type":"plugin","slug":"wp-featured-content-slider","name":"WP Featured Content Slider","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T21:10:17Z"},{"id":"wordfence:f7cb3540-ffdb-4b4c-a518-4ca8232ab53f","source":"wordfence","cve":"","title":"WP Statistics < 9.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7cb3540-ffdb-4b4c-a518-4ca8232ab53f?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"9.1.3","to_inclusive":false,"patched_in":"9.1.3"}],"published":"2015-04-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7cd392e-f223-4c39-bdf7-f0584c5b5bd8","source":"wordfence","cve":"CVE-2025-62947","title":"Publitio <= 2.2.3 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7cd392e-f223-4c39-bdf7-f0584c5b5bd8?source=api-prod","affected":[{"type":"plugin","slug":"publitio","name":"Publitio","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-10T00:00:00Z","updated":"2025-10-29T16:08:35Z"},{"id":"wordfence:f7ce1d19-25fa-434d-943b-d10c5cb2ec51","source":"wordfence","cve":"CVE-2024-10365","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ce1d19-25fa-434d-943b-d10c5cb2ec51?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-20T06:42:57Z"},{"id":"wordfence:f7ced5c5-4c0d-464b-ba01-9b6475e50199","source":"wordfence","cve":"CVE-2026-97273","title":"Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ced5c5-4c0d-464b-ba01-9b6475e50199?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-wishlist","name":"Premmerce Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":"1.1.15"}],"published":"2026-10-01T11:59:41Z","updated":"2026-10-08T23:59:59Z"},{"id":"wordfence:f7d13759-bd82-436c-b432-9361531671dc","source":"wordfence","cve":"CVE-2026-107433","title":"WP OAuth Server ( Login with WordPress ) <= 6.4.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d13759-bd82-436c-b432-9361531671dc?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-oauth-20-server","name":"WP OAuth Server ( Login with WordPress )","from":"*","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:51:09Z"},{"id":"wordfence:f7d24b4d-2c22-4aff-bd2d-1632997b2d26","source":"wordfence","cve":"CVE-2026-13718","title":"Tabs Responsive <= 2.5 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d24b4d-2c22-4aff-bd2d-1632997b2d26?source=api-prod","affected":[{"type":"plugin","slug":"tabs-responsive","name":"Tabs Responsive \u2013 With WooCommerce Product Tabs Extension","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-09-29T00:00:00Z","updated":"2026-10-09T12:44:50Z"},{"id":"wordfence:f7d2a830-4b66-4875-98b1-4730c3b6ae4b","source":"wordfence","cve":"CVE-2025-32558","title":"Duplicate Title Checker <= 1.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d2a830-4b66-4875-98b1-4730c3b6ae4b?source=api-prod","affected":[{"type":"plugin","slug":"duplicate-title-checker","name":"Duplicate Title Checker","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:58:23Z"},{"id":"wordfence:f7d5a077-8836-4c28-8884-5047585a99e5","source":"wordfence","cve":"CVE-2024-6353","title":"Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d5a077-8836-4c28-8884-5047585a99e5?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2024-07-11T19:55:32Z","updated":"2024-07-12T08:32:14Z"},{"id":"wordfence:f7d66176-73a8-4076-8ae0-1f1fd8260f8e","source":"wordfence","cve":"CVE-2017-9062","title":"WordPress Core < 4.7.5 - Mishandling Post Meta Values via XML-RPC","severity":"medium","cvss":6.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d66176-73a8-4076-8ae0-1f1fd8260f8e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.20","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.18","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.17","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.14","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.10","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.9","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.5","to_inclusive":true,"patched_in":"3.7.21"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"3.7.21"}],"published":"2017-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7d7c619-7dc0-47a5-a203-6df4dfa0158b","source":"wordfence","cve":"CVE-2025-10304","title":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d7c619-7dc0-47a5-a203-6df4dfa0158b?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.8","to_inclusive":true,"patched_in":"2.3.9"}],"published":"2025-12-02T15:27:08Z","updated":"2025-12-03T03:27:15Z"},{"id":"wordfence:f7d80a23-f55d-4ab8-b139-daf5bc436d4f","source":"wordfence","cve":"CVE-2014-5190","title":"SI CAPTCHA Anti-Spam < 2.7.6 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7d80a23-f55d-4ab8-b139-daf5bc436d4f?source=api-prod","affected":[{"type":"plugin","slug":"si-captcha-for-wordpress","name":"SI Captcha Anti-spam","from":"*","from_inclusive":true,"to":"2.7.6","to_inclusive":false,"patched_in":"2.7.6"}],"published":"2014-08-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7dbf179-7099-4dfb-8dad-780f996a7005","source":"wordfence","cve":"CVE-2025-13722","title":"Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7dbf179-7099-4dfb-8dad-780f996a7005?source=api-prod","affected":[{"type":"plugin","slug":"fluentform","name":"Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder","from":"*","from_inclusive":true,"to":"6.1.7","to_inclusive":true,"patched_in":"6.1.8"}],"published":"2026-01-06T20:40:48Z","updated":"2026-01-07T09:21:06Z"},{"id":"wordfence:f7dcf515-a476-4346-ba90-aa233fca6e59","source":"wordfence","cve":"CVE-2025-39521","title":"Contact Form vCard Generator <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7dcf515-a476-4346-ba90-aa233fca6e59?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-vcard-generator","name":"Contact Form vCard Generator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T20:18:31Z"},{"id":"wordfence:f7df2f38-4831-4cd4-b8ff-27c471775cae","source":"wordfence","cve":"CVE-2024-34822","title":"weMail <= 1.14.2 - Missing Authorization to Notice Dismissal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7df2f38-4831-4cd4-b8ff-27c471775cae?source=api-prod","affected":[{"type":"plugin","slug":"wemail","name":"weMail \u2013 Email Marketing, Newsletters Builder & Email Automations for WooCommerce","from":"*","from_inclusive":true,"to":"1.14.2","to_inclusive":true,"patched_in":"1.14.3"}],"published":"2024-05-15T00:00:00Z","updated":"2024-05-15T19:57:59Z"},{"id":"wordfence:f7e0c22a-9e36-430b-8729-990369d2ce60","source":"wordfence","cve":"CVE-2024-6408","title":"Slider by 10Web <= 1.2.56 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7e0c22a-9e36-430b-8729-990369d2ce60?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.56","to_inclusive":true,"patched_in":"1.2.57"}],"published":"2024-07-10T00:00:00Z","updated":"2024-08-27T13:40:56Z"},{"id":"wordfence:f7e2246d-704c-40df-ab82-ffdb85e78cd3","source":"wordfence","cve":"CVE-2025-58785","title":"Ray Enterprise Translation <= 1.7.4 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7e2246d-704c-40df-ab82-ffdb85e78cd3?source=api-prod","affected":[{"type":"plugin","slug":"lingotek-translation","name":"Ray Enterprise Translation","from":"*","from_inclusive":true,"to":"1.7.4","to_inclusive":true,"patched_in":"1.7.5"}],"published":"2025-09-05T00:00:00Z","updated":"2026-11-03T22:44:27Z"},{"id":"wordfence:f7e5bcb2-2152-4b55-b2f9-9e8e53ddd790","source":"wordfence","cve":"CVE-2026-66452","title":"Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7e5bcb2-2152-4b55-b2f9-9e8e53ddd790?source=api-prod","affected":[{"type":"plugin","slug":"legal-texts-connector-it-recht-kanzlei","name":"Legal Text Connector of the IT-Recht Kanzlei","from":"*","from_inclusive":true,"to":"1.0.13","to_inclusive":true,"patched_in":"1.0.14"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-13T19:02:47Z"},{"id":"wordfence:f7e70efa-a165-4251-ae54-621ea432c94c","source":"wordfence","cve":"CVE-2025-26535","title":"Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.6 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7e70efa-a165-4251-ae54-621ea432c94c?source=api-prod","affected":[{"type":"plugin","slug":"woo-altcoin-payment-gateway","name":"Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":true,"patched_in":""}],"published":"2025-03-01T00:00:00Z","updated":"2025-03-10T14:42:18Z"},{"id":"wordfence:f7eb440f-c122-4e78-9ea0-513a4cf9794d","source":"wordfence","cve":"CVE-2026-16986","title":"Booking Package < 1.7.25 - Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7eb440f-c122-4e78-9ea0-513a4cf9794d?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.25","to_inclusive":false,"patched_in":"1.7.25"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-02T17:46:37Z"},{"id":"wordfence:f7ed53bd-08de-4ec9-a8dd-eef72b788359","source":"wordfence","cve":"CVE-2024-33691","title":"Popup Builder by OptinMonster \u2013 WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.15.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ed53bd-08de-4ec9-a8dd-eef72b788359?source=api-prod","affected":[{"type":"plugin","slug":"optinmonster","name":"Popup Builder & Popup Maker for WordPress \u2013 OptinMonster Email Marketing and Lead Generation","from":"*","from_inclusive":true,"to":"2.15.3","to_inclusive":true,"patched_in":"2.16.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-01T14:29:24Z"},{"id":"wordfence:f7ed6255-d8df-4f57-961b-1a0c21e352ac","source":"wordfence","cve":"CVE-2024-11415","title":"WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ed6255-d8df-4f57-961b-1a0c21e352ac?source=api-prod","affected":[{"type":"plugin","slug":"wp-orphanage-extended","name":"WP-Orphanage Extended","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:f7ed8472-1e42-4abd-9978-8f5080ec2ee1","source":"wordfence","cve":"CVE-2025-31814","title":"OwnerRez <= 1.2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ed8472-1e42-4abd-9978-8f5080ec2ee1?source=api-prod","affected":[{"type":"plugin","slug":"ownerrez","name":"OwnerRez","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-04-01T00:00:00Z","updated":"2025-05-23T13:31:12Z"},{"id":"wordfence:f7f08d0a-b3ac-4363-ba6e-91a8e13605ca","source":"wordfence","cve":"CVE-2022-29455","title":"Elementor Website Builder <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f08d0a-b3ac-4363-ba6e-91a8e13605ca?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2022-06-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f7f0b443-9d7e-4951-95ea-beecf96c83c8","source":"wordfence","cve":"CVE-2026-97275","title":"BuildKit \u2013 Product Builder for WooCommerce \u2013 Custom PC Builder <= 1.0.28 - Unauthenticated Cart Data Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f0b443-9d7e-4951-95ea-beecf96c83c8?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-builder","name":"BuildKit \u2013 Product Builder for WooCommerce \u2013 Custom PC Builder","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T13:40:39Z"},{"id":"wordfence:f7f77ca2-c69e-4f59-ad7b-a244863de424","source":"wordfence","cve":"CVE-2024-31375","title":"WP2LEADS <= 3.2.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f77ca2-c69e-4f59-ad7b-a244863de424?source=api-prod","affected":[{"type":"plugin","slug":"wp2leads","name":"WP2LEADS |  WordPress und KlickTipp einfach verbinden \u2013 WooCommerce und KlickTipp einfach verbinden","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-11T14:07:56Z"},{"id":"wordfence:f7f810f6-b8dd-4065-8113-9842b33202ef","source":"wordfence","cve":"CVE-2024-8738","title":"Seriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f810f6-b8dd-4065-8113-9842b33202ef?source=api-prod","affected":[{"type":"plugin","slug":"seriously-simple-stats","name":"Seriously Simple Stats","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.7.0"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T01:56:49Z"},{"id":"wordfence:f7f87d80-d073-4dc7-9d1f-3ce9bb4ba9ae","source":"wordfence","cve":"CVE-2026-78394","title":"Link Library <= 7.9.5 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f87d80-d073-4dc7-9d1f-3ce9bb4ba9ae?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.9.5","to_inclusive":true,"patched_in":"7.9.6"}],"published":"2026-09-23T00:00:00Z","updated":"2026-09-30T14:01:35Z"},{"id":"wordfence:f7f9b1ef-2efc-4d88-bff8-e0dd711b85ab","source":"wordfence","cve":"CVE-2024-56227","title":"Royal Elementor Addons <= 1.7.1001 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f9b1ef-2efc-4d88-bff8-e0dd711b85ab?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.7.1001","to_inclusive":true,"patched_in":"1.7.1002"}],"published":"2024-12-19T00:00:00Z","updated":"2025-01-08T15:14:01Z"},{"id":"wordfence:f7fa935d-6542-4541-a1fa-7c0c67114857","source":"wordfence","cve":"CVE-2026-104754","title":"Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fa935d-6542-4541-a1fa-7c0c67114857?source=api-prod","affected":[{"type":"plugin","slug":"seo-by-rank-math","name":"Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings","from":"*","from_inclusive":true,"to":"1.0.279","to_inclusive":true,"patched_in":"1.0.280"}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:29:45Z"},{"id":"wordfence:f7fc91cc-e529-4362-8269-bf7ee0766e1e","source":"wordfence","cve":"CVE-2024-6386","title":"WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection","severity":"critical","cvss":9.9,"cwe":"CWE-1336","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fc91cc-e529-4362-8269-bf7ee0766e1e?source=api-prod","affected":[{"type":"plugin","slug":"sitepress-multilingual-cms","name":"WPML Multilingual CMS","from":"*","from_inclusive":true,"to":"4.6.12","to_inclusive":true,"patched_in":"4.6.13"}],"published":"2024-08-21T08:00:14Z","updated":"2024-08-22T14:56:54Z"},{"id":"wordfence:f7ff27af-2b78-4214-9232-042357287ba8","source":"wordfence","cve":"CVE-2008-7175","title":"NextGEN Gallery Plugin <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ff27af-2b78-4214-9232-042357287ba8?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2008-06-07T00:00:00Z","updated":"2024-06-07T01:53:37Z"},{"id":"wordfence:f80238dc-3caa-420b-92ee-27e690e9ead0","source":"wordfence","cve":"CVE-2012-5349","title":"Pay With Tweet <= 1.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80238dc-3caa-420b-92ee-27e690e9ead0?source=api-prod","affected":[{"type":"plugin","slug":"pay-with-tweet","name":"Pay With Tweet","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2012-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8035ed9-d267-44da-9de4-cf3d6ece7059","source":"wordfence","cve":"","title":"WP Database Backup <= 5.1.2 - Unauthenticated Settings Update to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8035ed9-d267-44da-9de4-cf3d6ece7059?source=api-prod","affected":[{"type":"plugin","slug":"wp-database-backup","name":"WP Database Backup \u2013 Unlimited Database & Files Backup by Backup for WP","from":"*","from_inclusive":true,"to":"5.1.2","to_inclusive":true,"patched_in":"5.1.3"}],"published":"2019-03-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8043a78-c46a-484a-9795-c45b3bb56492","source":"wordfence","cve":"CVE-2025-8282","title":"SureForms \u2013 Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8043a78-c46a-484a-9795-c45b3bb56492?source=api-prod","affected":[{"type":"plugin","slug":"sureforms","name":"SureForms \u2013 Contact Form Builder, AI Forms, Payment Form, Survey & Quiz","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-09-02T00:00:00Z","updated":"2026-10-01T22:44:26Z"},{"id":"wordfence:f804bdf8-9e74-46f6-a832-b7a2c8e4522f","source":"wordfence","cve":"CVE-2026-118202","title":"Limit Login Attempts Reloaded <= 3.4.0 - Two-Factor Authentication Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f804bdf8-9e74-46f6-a832-b7a2c8e4522f?source=api-prod","affected":[{"type":"plugin","slug":"limit-login-attempts-security","name":"Limit Login Attempts Security","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:47:03Z"},{"id":"wordfence:f804f31b-4778-4d2d-bcaa-a9f79f6753ee","source":"wordfence","cve":"CVE-2025-32288","title":"RT-Theme 18 | Extensions <= 2.4 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f804f31b-4778-4d2d-bcaa-a9f79f6753ee?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-07-28T00:00:00Z","updated":"2026-02-26T15:15:30Z"},{"id":"wordfence:f8068fb3-5a19-4b17-848b-32cebfff2537","source":"wordfence","cve":"CVE-2022-45353","title":"Betheme <= 26.6.2 - Missing Authorization Checks to Private Page/Post Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8068fb3-5a19-4b17-848b-32cebfff2537?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.6.2","to_inclusive":true,"patched_in":"26.6.3"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f807b605-68a8-4340-a275-776eac0936fa","source":"wordfence","cve":"CVE-2024-2138","title":"JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f807b605-68a8-4340-a275-776eac0936fa?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.15","to_inclusive":true,"patched_in":"1.0.16"}],"published":"2024-03-13T00:00:00Z","updated":"2024-04-09T18:59:35Z"},{"id":"wordfence:f80a1f13-c1b9-4259-8d96-71a3cbcaf4ca","source":"wordfence","cve":"CVE-2023-2563","title":"WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80a1f13-c1b9-4259-8d96-71a3cbcaf4ca?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2023-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f80a1fa2-d44b-4101-a891-fce21ee99427","source":"wordfence","cve":"CVE-2026-107649","title":"Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80a1fa2-d44b-4101-a891-fce21ee99427?source=api-prod","affected":[{"type":"plugin","slug":"events-made-easy","name":"Events Made Easy","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.23"}],"published":"2026-10-15T20:56:05Z","updated":"2026-10-16T09:26:38Z"},{"id":"wordfence:f80af397-72d5-4446-b43f-3be26657b73e","source":"wordfence","cve":"","title":"Animation Addons for Elementor \u2013 GSAP Motion Elementor Addons & Website Templates <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80af397-72d5-4446-b43f-3be26657b73e?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.6.3","to_inclusive":true,"patched_in":"2.6.4"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-01T16:29:11Z"},{"id":"wordfence:f80fa8b3-f345-4b3f-8a16-ee9f19b07a0b","source":"wordfence","cve":"CVE-2024-6557","title":"SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80fa8b3-f345-4b3f-8a16-ee9f19b07a0b?source=api-prod","affected":[{"type":"plugin","slug":"wp-scheduled-posts","name":"SchedulePress \u2013 Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher","from":"*","from_inclusive":true,"to":"5.1.3","to_inclusive":true,"patched_in":"5.1.4"}],"published":"2024-07-15T16:16:47Z","updated":"2024-07-16T04:31:30Z"},{"id":"wordfence:f80fcadd-d6b7-4d35-bced-ada3514e60fa","source":"wordfence","cve":"","title":"Store Locator Plus <= 4.5.11 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80fcadd-d6b7-4d35-bced-ada3514e60fa?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-le","name":"Store Locator Plus\u00ae for WordPress","from":"*","from_inclusive":true,"to":"4.5.11","to_inclusive":false,"patched_in":"4.5.12"}],"published":"2016-07-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f80fef43-ffc4-4b9b-ae17-000d14281c43","source":"wordfence","cve":"CVE-2024-38694","title":"Moloni <= 4.7.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f80fef43-ffc4-4b9b-ae17-000d14281c43?source=api-prod","affected":[{"type":"plugin","slug":"moloni","name":"Moloni","from":"*","from_inclusive":true,"to":"4.7.4","to_inclusive":true,"patched_in":"4.8.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:39:31Z"},{"id":"wordfence:f810326f-f84a-4066-aa28-5caa915ba877","source":"wordfence","cve":"","title":"miniOrange's Google Authenticator <= 5.4.39 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f810326f-f84a-4066-aa28-5caa915ba877?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-2-factor-authentication","name":"miniOrange 2FA \u2013 Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)","from":"*","from_inclusive":true,"to":"5.4.39","to_inclusive":true,"patched_in":"5.4.40"}],"published":"2021-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8109e13-c7c7-4789-9630-efd31e27986b","source":"wordfence","cve":"CVE-2025-27316","title":"JPG, PNG Compression and Optimization <= 1.7.35 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8109e13-c7c7-4789-9630-efd31e27986b?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-compression","name":"JPG, PNG Compression and Optimization","from":"*","from_inclusive":true,"to":"1.7.35","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:43:38Z"},{"id":"wordfence:f810cc65-5a19-4ad7-a6b6-41a9b4f30f4c","source":"wordfence","cve":"CVE-2024-6562","title":"affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f810cc65-5a19-4ad7-a6b6-41a9b4f30f4c?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-toolkit-starter","name":"affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product Display","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.6"}],"published":"2024-08-08T20:37:13Z","updated":"2024-09-24T13:41:11Z"},{"id":"wordfence:f811ce01-8640-4c25-aae1-4f1a35264273","source":"wordfence","cve":"CVE-2025-31052","title":"The Fashion - Model Agency One Page Beauty Theme <= 1.4.4 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f811ce01-8640-4c25-aae1-4f1a35264273?source=api-prod","affected":[{"type":"theme","slug":"nrgfashion","name":"The Fashion - Model Agency One Page Beauty Theme","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-02T19:27:05Z"},{"id":"wordfence:f8121633-299d-45f9-88b1-e65e30e897d1","source":"wordfence","cve":"CVE-2023-25972","title":"\u0421\u0442\u0430\u0440\u0442 <= 3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8121633-299d-45f9-88b1-e65e30e897d1?source=api-prod","affected":[{"type":"plugin","slug":"iksweb","name":"WordPress \u0421\u0442\u0430\u0440\u0442","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":true,"patched_in":"3.8"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f81355fa-5b12-4b03-bd3d-f9e2cb734390","source":"wordfence","cve":"CVE-2024-12591","title":"MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81355fa-5b12-4b03-bd3d-f9e2cb734390?source=api-prod","affected":[{"type":"plugin","slug":"magicpost","name":"MagicPost \u2013 WordPress\u6587\u7ae0\u7ba1\u7406\u529f\u80fd\u589e\u5f3a\u63d2\u4ef6","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-12-20T00:00:00Z","updated":"2024-12-21T09:23:56Z"},{"id":"wordfence:f813cb1a-5922-48a5-a026-66ec9aaac294","source":"wordfence","cve":"CVE-2023-41865","title":"Slider Pro <= 4.8.6 - Missing Authorization via AJAX actions","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f813cb1a-5922-48a5-a026-66ec9aaac294?source=api-prod","affected":[{"type":"plugin","slug":"sliderpro","name":"Slider Pro","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f813f1f3-4494-4899-93d1-fa6f786e94cd","source":"wordfence","cve":"CVE-2024-49621","title":"APA Register Newsletter Form <= 1.0.0 - Cross-Site Request Forgery to SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f813f1f3-4494-4899-93d1-fa6f786e94cd?source=api-prod","affected":[{"type":"plugin","slug":"apa-register-newsletter-form","name":"APA Register Newsletter Form","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-22T17:44:34Z"},{"id":"wordfence:f8147f63-91a5-457c-8259-8e4ddf5c67e4","source":"wordfence","cve":"CVE-2023-40674","title":"Simple URLs <= 118 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8147f63-91a5-457c-8259-8e4ddf5c67e4?source=api-prod","affected":[{"type":"plugin","slug":"simple-urls","name":"Lasso Lite \u2013 Affiliate Link Manager, URL Shortener & Link Tracking","from":"*","from_inclusive":true,"to":"118","to_inclusive":true,"patched_in":"119"}],"published":"2023-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f814afd7-5452-4c7a-9ef9-ab6d8b3b6649","source":"wordfence","cve":"CVE-2026-90985","title":"WPC Smart Compare for WooCommerce <= 6.6.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f814afd7-5452-4c7a-9ef9-ab6d8b3b6649?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-compare","name":"WPC Smart Compare for WooCommerce","from":"*","from_inclusive":true,"to":"6.6.0","to_inclusive":true,"patched_in":"6.6.1"}],"published":"2026-09-21T00:00:00Z","updated":"2026-09-29T19:58:41Z"},{"id":"wordfence:f814debc-8e5c-4329-ba08-d82b0b97a1b8","source":"wordfence","cve":"CVE-2025-58267","title":"Stock Message <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f814debc-8e5c-4329-ba08-d82b0b97a1b8?source=api-prod","affected":[{"type":"plugin","slug":"stock-message","name":"Stock Message","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:41:48Z"},{"id":"wordfence:f8152adf-1ca9-4a19-b539-39e257ab94c8","source":"wordfence","cve":"CVE-2024-3609","title":"ReviewX \u2013 Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8152adf-1ca9-4a19-b539-39e257ab94c8?source=api-prod","affected":[{"type":"plugin","slug":"reviewx","name":"ReviewX \u2013 Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema","from":"*","from_inclusive":true,"to":"1.6.27","to_inclusive":true,"patched_in":"1.6.28"}],"published":"2024-05-16T07:36:25Z","updated":"2024-05-16T20:31:06Z"},{"id":"wordfence:f8159528-fb94-4ebb-931b-cc6998de4f7c","source":"wordfence","cve":"CVE-2026-94415","title":"Betheme <= 28.5.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8159528-fb94-4ebb-931b-cc6998de4f7c?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.5.8","to_inclusive":true,"patched_in":""}],"published":"2026-10-03T00:00:00Z","updated":"2026-10-09T15:49:41Z"},{"id":"wordfence:f815a4e5-cca2-4b86-96f4-ad956814d685","source":"wordfence","cve":"CVE-2015-4070","title":"Wow Moodboard Lite <= 1.1.1.1 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f815a4e5-cca2-4b86-96f4-ad956814d685?source=api-prod","affected":[{"type":"plugin","slug":"wow-moodboard-lite","name":"Wow Moodboard Lite","from":"*","from_inclusive":true,"to":"1.1.1.1","to_inclusive":true,"patched_in":""}],"published":"2015-05-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f816a32a-3c4d-447e-86a3-942b5e636cce","source":"wordfence","cve":"CVE-2022-4061","title":"JobBoardWP <= 1.2.1 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f816a32a-3c4d-447e-86a3-942b5e636cce?source=api-prod","affected":[{"type":"plugin","slug":"jobboardwp","name":"JobBoardWP \u2013 Job Board Listings and Submissions","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2022-11-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f816edcc-f204-474d-a652-83114f5a4347","source":"wordfence","cve":"CVE-2025-47654","title":"FormLift for Infusionsoft Web Forms <= 7.5.20 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f816edcc-f204-474d-a652-83114f5a4347?source=api-prod","affected":[{"type":"plugin","slug":"formlift","name":"FormLift for Keap (Legacy) Web Forms","from":"*","from_inclusive":true,"to":"7.5.20","to_inclusive":true,"patched_in":"7.5.21"}],"published":"2025-06-18T00:00:00Z","updated":"2025-07-11T20:58:29Z"},{"id":"wordfence:f81950be-de32-4fa1-94fe-42667414fe2d","source":"wordfence","cve":"CVE-2023-4648","title":"WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81950be-de32-4fa1-94fe-42667414fe2d?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.6.6","to_inclusive":true,"patched_in":"3.6.7"}],"published":"2023-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f81a3429-f378-4295-adbe-ad6f1df59701","source":"wordfence","cve":"CVE-2026-13001","title":"Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81a3429-f378-4295-adbe-ad6f1df59701?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":true,"patched_in":"4.5.2"}],"published":"2026-07-14T06:57:56Z","updated":"2026-07-14T19:33:13Z"},{"id":"wordfence:f81af4b7-71e0-4fce-b0f9-530afed34922","source":"wordfence","cve":"CVE-2025-30798","title":"Better WishList API <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81af4b7-71e0-4fce-b0f9-530afed34922?source=api-prod","affected":[{"type":"plugin","slug":"better-wlm-api","name":"Better WishList API","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T15:27:38Z"},{"id":"wordfence:f81d7451-352b-446e-965b-9b51031844ed","source":"wordfence","cve":"CVE-2025-47535","title":"Opal Woo Custom Product Variation <= 1.2.0 - Unauthenticated Arbitrary File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81d7451-352b-446e-965b-9b51031844ed?source=api-prod","affected":[{"type":"plugin","slug":"opal-woo-custom-product-variation","name":"Opal Woo Custom Product Variation","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2025-05-12T00:00:00Z","updated":"2025-05-20T16:36:02Z"},{"id":"wordfence:f81df26f-4390-4626-8539-367a52f8a027","source":"wordfence","cve":"CVE-2023-4888","title":"Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81df26f-4390-4626-8539-367a52f8a027?source=api-prod","affected":[{"type":"plugin","slug":"simple-facebook-plugin","name":"Simple Like Page \u2013 Fast & Privacy-Friendly Page Embeds","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2023-11-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f81f4bae-22b1-42e1-a275-2b302b68912e","source":"wordfence","cve":"CVE-2025-52731","title":"WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f81f4bae-22b1-42e1-a275-2b302b68912e?source=api-prod","affected":[{"type":"plugin","slug":"eventin-pro","name":"WordPress Event Manager, Event Calendar and Booking Plugin","from":"*","from_inclusive":true,"to":"4.0.24","to_inclusive":true,"patched_in":"4.0.25"}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-18T18:13:28Z"},{"id":"wordfence:f821bc5d-4590-4dfb-b709-73476a7eeac2","source":"wordfence","cve":"CVE-2025-22795","title":"Multilang Contact Form <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f821bc5d-4590-4dfb-b709-73476a7eeac2?source=api-prod","affected":[{"type":"plugin","slug":"multilang-contact-form","name":"Multilang Contact Form","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:03:20Z"},{"id":"wordfence:f821e1e2-9114-4b24-bd87-18ab49aa446e","source":"wordfence","cve":"","title":"Annonces <= 1.2.0.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f821e1e2-9114-4b24-bd87-18ab49aa446e?source=api-prod","affected":[{"type":"plugin","slug":"annonces","name":"Annonces","from":"*","from_inclusive":true,"to":"1.2.0.1","to_inclusive":true,"patched_in":"1.2.0.2"}],"published":"2012-06-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f821f78e-d56e-4aad-8d05-ee15b49742a0","source":"wordfence","cve":"CVE-2025-49074","title":"WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f821f78e-d56e-4aad-8d05-ee15b49742a0?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:45:11Z"},{"id":"wordfence:f8225e3c-5413-4406-a31b-80829b6b330a","source":"wordfence","cve":"CVE-2024-13405","title":"Apptivo Business Site CRM <= 5.3 - Cross-Site Request Forgery to IP Address Block","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8225e3c-5413-4406-a31b-80829b6b330a?source=api-prod","affected":[{"type":"plugin","slug":"apptivo-business-site","name":"Apptivo Business Site","from":"*","from_inclusive":true,"to":"5.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:30:29Z","updated":"2025-02-19T07:32:15Z"},{"id":"wordfence:f8228b0d-be97-4e7c-8346-d203f7130958","source":"wordfence","cve":"CVE-2014-5202","title":"Compfight < 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8228b0d-be97-4e7c-8346-d203f7130958?source=api-prod","affected":[{"type":"plugin","slug":"compfight","name":"Compfight","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2014-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f822d5b9-46fb-4910-8d92-8c73e01d7e50","source":"wordfence","cve":"CVE-2024-32699","title":"YITH WooCommerce Compare <= 2.37.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f822d5b9-46fb-4910-8d92-8c73e01d7e50?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"2.37.0","to_inclusive":true,"patched_in":"2.38.0"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-29T16:05:04Z"},{"id":"wordfence:f8234ea2-ff80-425f-b83d-29c422b40c6a","source":"wordfence","cve":"CVE-2026-3643","title":"Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8234ea2-ff80-425f-b83d-29c422b40c6a?source=api-prod","affected":[{"type":"plugin","slug":"otm-accessibly","name":"Accessibly \u2013 WordPress Website Accessibility","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":""}],"published":"2026-04-14T19:47:46Z","updated":"2026-04-15T08:28:17Z"},{"id":"wordfence:f823ad14-754e-4fed-b991-6ee8594c7f86","source":"wordfence","cve":"CVE-2026-24625","title":"File Uploads Addon for WooCommerce <= 1.7.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f823ad14-754e-4fed-b991-6ee8594c7f86?source=api-prod","affected":[{"type":"plugin","slug":"woo-addon-uploads","name":"File Uploads Addon for WooCommerce","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":"1.7.4"}],"published":"2026-01-10T07:10:00Z","updated":"2026-04-15T13:33:56Z"},{"id":"wordfence:f8248098-dff2-4bac-a138-aa40c7ab7a1c","source":"wordfence","cve":"CVE-2026-4896","title":"WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8248098-dff2-4bac-a138-aa40c7ab7a1c?source=api-prod","affected":[{"type":"plugin","slug":"wc-frontend-manager","name":"WCFM \u2013 Frontend Manager for WooCommerce","from":"*","from_inclusive":true,"to":"6.7.25","to_inclusive":true,"patched_in":"6.7.26"}],"published":"2026-04-03T19:36:31Z","updated":"2026-04-04T07:42:01Z"},{"id":"wordfence:f8259785-b15b-49df-bf9c-9108a6a59070","source":"wordfence","cve":"CVE-2009-3703","title":"WP Forum <= 2.3 - Multiple SQL Injections","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8259785-b15b-49df-bf9c-9108a6a59070?source=api-prod","affected":[{"type":"plugin","slug":"wp-forum","name":"wp-forum","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2009-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f825f989-47dd-44b3-9ae0-1afb38a72291","source":"wordfence","cve":"CVE-2026-42699","title":"FV Player 8 <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f825f989-47dd-44b3-9ae0-1afb38a72291?source=api-prod","affected":[{"type":"plugin","slug":"fv-player","name":"FV Player 8","from":"*","from_inclusive":true,"to":"8.1.8","to_inclusive":true,"patched_in":"8.1.9"}],"published":"2026-10-06T00:00:00Z","updated":"2026-10-09T15:44:38Z"},{"id":"wordfence:f8297149-2de3-4e49-80f9-6ea59dea6bce","source":"wordfence","cve":"CVE-2021-4382","title":"Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8297149-2de3-4e49-80f9-6ea59dea6bce?source=api-prod","affected":[{"type":"plugin","slug":"recently","name":"Recently","from":"*","from_inclusive":true,"to":"3.0.4","to_inclusive":true,"patched_in":"3.0.5"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f82aca0a-a75f-4766-a808-004d13c77bac","source":"wordfence","cve":"CVE-2026-54828","title":"Motors \u2013 Car Dealership & Classified Listings Plugin <= 1.4.109 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f82aca0a-a75f-4766-a808-004d13c77bac?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.109","to_inclusive":true,"patched_in":"1.4.110"}],"published":"2026-06-17T00:00:00Z","updated":"2026-06-23T15:54:27Z"},{"id":"wordfence:f82ebd9f-4e8d-4465-b3b2-e71122d0aa74","source":"wordfence","cve":"CVE-2025-3584","title":"Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f82ebd9f-4e8d-4465-b3b2-e71122d0aa74?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"8.8.1","to_inclusive":true,"patched_in":"8.8.2"}],"published":"2025-05-13T00:00:00Z","updated":"2025-06-06T14:09:40Z"},{"id":"wordfence:f8310fae-813c-4325-9ae6-f0ea470e0168","source":"wordfence","cve":"CVE-2026-27094","title":"Page Builder Gutenberg Blocks \u2013 CoBlocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8310fae-813c-4325-9ae6-f0ea470e0168?source=api-prod","affected":[{"type":"plugin","slug":"coblocks","name":"Page Builder Gutenberg Blocks \u2013 CoBlocks","from":"*","from_inclusive":true,"to":"3.1.16","to_inclusive":true,"patched_in":"3.1.17"}],"published":"2026-01-07T00:00:00Z","updated":"2026-03-17T21:30:41Z"},{"id":"wordfence:f833e236-2ca6-49bc-9c98-cce06a47f1b1","source":"wordfence","cve":"CVE-2025-67535","title":"Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f833e236-2ca6-49bc-9c98-cce06a47f1b1?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"4.8.6","to_inclusive":true,"patched_in":"4.8.7"}],"published":"2025-11-02T00:00:00Z","updated":"2025-12-11T16:45:05Z"},{"id":"wordfence:f8343c1e-385c-4301-8186-4c8fb3e270f5","source":"wordfence","cve":"CVE-2024-51928","title":"Blocks Post Grid <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8343c1e-385c-4301-8186-4c8fb3e270f5?source=api-prod","affected":[{"type":"plugin","slug":"blocks-post-grid","name":"Blocks Post Grid","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:47:38Z"},{"id":"wordfence:f83532a8-ce5b-4df6-a464-97790cc6c04a","source":"wordfence","cve":"CVE-2025-50011","title":"Recipes manager - WPH <= 1.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83532a8-ce5b-4df6-a464-97790cc6c04a?source=api-prod","affected":[{"type":"plugin","slug":"wph-recipes-manager","name":"Recipes manager \u2013 WPH","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-19T00:00:00Z","updated":"2025-06-25T18:02:18Z"},{"id":"wordfence:f8375ecf-e64b-4649-9341-fa45bf5556c3","source":"wordfence","cve":"CVE-2025-7718","title":"Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover","severity":"high","cvss":8.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8375ecf-e64b-4649-9341-fa45bf5556c3?source=api-prod","affected":[{"type":"plugin","slug":"resideo-plugin","name":"Resideo Plugin for Resideo - Real Estate WordPress Theme","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-09-09T17:42:34Z","updated":"2025-09-10T12:25:30Z"},{"id":"wordfence:f8381866-d991-4638-ab4d-3b8697acf414","source":"wordfence","cve":"CVE-2026-3478","title":"Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=api-prod","affected":[{"type":"plugin","slug":"content-syndication-toolkit","name":"Content Syndication Toolkit","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:09:53Z","updated":"2026-03-21T03:27:13Z"},{"id":"wordfence:f8381b6c-46f4-4b9d-9975-c90310d066d7","source":"wordfence","cve":"CVE-2019-15321","title":"Option Tree <= 2.7.2 - Object Injection Bypass","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381b6c-46f4-4b9d-9975-c90310d066d7?source=api-prod","affected":[{"type":"plugin","slug":"option-tree","name":"OptionTree","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":true,"patched_in":"2.7.3"}],"published":"2019-05-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f838dbc9-b31e-46c6-b615-4e8ece9a9cfc","source":"wordfence","cve":"CVE-2024-2729","title":"Otter Blocks <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f838dbc9-b31e-46c6-b615-4e8ece9a9cfc?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"2.6.5","to_inclusive":true,"patched_in":"2.6.6"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-01T15:02:04Z"},{"id":"wordfence:f8390dc5-24db-4d39-ba26-eaa87d260f1c","source":"wordfence","cve":"CVE-2024-39635","title":"Youzify <= 1.2.6 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8390dc5-24db-4d39-ba26-eaa87d260f1c?source=api-prod","affected":[{"type":"plugin","slug":"youzify","name":"Youzify \u2013 BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.8"}],"published":"2024-07-24T00:00:00Z","updated":"2024-08-01T12:50:03Z"},{"id":"wordfence:f83a6631-ff6c-422e-8b6c-49576fadb89f","source":"wordfence","cve":"CVE-2023-40003","title":"WP Project Manager <= 2.6.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83a6631-ff6c-422e-8b6c-49576fadb89f?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.7","to_inclusive":true,"patched_in":"2.6.8"}],"published":"2023-12-07T00:00:00Z","updated":"2024-02-19T16:36:41Z"},{"id":"wordfence:f83b36fe-4e46-4ab7-a113-6dcfa7cce625","source":"wordfence","cve":"CVE-2023-49827","title":"Soledad <= 8.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83b36fe-4e46-4ab7-a113-6dcfa7cce625?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.1","to_inclusive":true,"patched_in":"8.4.2"}],"published":"2023-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f83be46f-3b51-4a30-88a4-388bcbfd0d2a","source":"wordfence","cve":"CVE-2023-40210","title":"SB Child List <= 4.5 - Cross-Site Request Forgery via 'sb_cl_update_settings'","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83be46f-3b51-4a30-88a4-388bcbfd0d2a?source=api-prod","affected":[{"type":"plugin","slug":"sb-child-list","name":"SB Child List","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":""}],"published":"2023-08-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f83cb847-1aa0-4fc1-a494-4f1851ce0b1c","source":"wordfence","cve":"CVE-2025-48277","title":"Cost Calculator Builder <= 3.2.74 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83cb847-1aa0-4fc1-a494-4f1851ce0b1c?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.74","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T10:42:30Z"},{"id":"wordfence:f83d0d4c-b7b2-4788-8e43-9155b5d5a4f7","source":"wordfence","cve":"CVE-2025-22653","title":"Music Press Pro <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83d0d4c-b7b2-4788-8e43-9155b5d5a4f7?source=api-prod","affected":[{"type":"plugin","slug":"music-press-pro","name":"Music Press Pro","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:24:34Z"},{"id":"wordfence:f83db067-843f-4dd8-b5d1-83e95c6c88cc","source":"wordfence","cve":"CVE-2024-7895","title":"Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83db067-843f-4dd8-b5d1-83e95c6c88cc?source=api-prod","affected":[{"type":"plugin","slug":"beaver-builder-lite-version","name":"Beaver Builder Page Builder \u2013 Drag and Drop Website Builder","from":"*","from_inclusive":true,"to":"2.8.3.5","to_inclusive":true,"patched_in":"2.8.3.6"}],"published":"2024-08-28T00:00:00Z","updated":"2024-08-29T10:59:42Z"},{"id":"wordfence:f83e9ae3-0749-4a61-8a5b-97711145ad98","source":"wordfence","cve":"CVE-2025-69376","title":"User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83e9ae3-0749-4a61-8a5b-97711145ad98?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-extra-fields","name":"WordPress User Extra Fields","from":"*","from_inclusive":true,"to":"17.0","to_inclusive":true,"patched_in":"17.1"}],"published":"2026-02-05T00:00:00Z","updated":"2026-02-25T14:38:19Z"},{"id":"wordfence:f83f878d-b708-4677-929a-e1ced535d99f","source":"wordfence","cve":"","title":"MainWP Child < 3.4.5 - Authentication Bypass","severity":"high","cvss":8.3,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f83f878d-b708-4677-929a-e1ced535d99f?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":false,"patched_in":"3.4.5"}],"published":"2018-02-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8424fbf-4fa3-45da-b6dc-a71be6e60e3d","source":"wordfence","cve":"CVE-2025-68526","title":"Modal Popup Box <= 1.6.1 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8424fbf-4fa3-45da-b6dc-a71be6e60e3d?source=api-prod","affected":[{"type":"plugin","slug":"modal-popup-box","name":"Modal Popup Box \u2014 Popup Maker & Popup Builder","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-17T14:52:34Z"},{"id":"wordfence:f843bd03-cb14-415f-941e-7833a9a2fb90","source":"wordfence","cve":"CVE-2026-73342","title":"WP Multilang \u2013 Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f843bd03-cb14-415f-941e-7833a9a2fb90?source=api-prod","affected":[{"type":"plugin","slug":"wp-multilang","name":"WP Multilang \u2013 Translation and Multilingual Plugin","from":"*","from_inclusive":true,"to":"2.4.31","to_inclusive":true,"patched_in":"2.4.32"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:22:45Z"},{"id":"wordfence:f8457aeb-867b-4185-8271-a5452b7c5365","source":"wordfence","cve":"CVE-2023-47689","title":"Animator <= 3.0.10 - Missing Authorization to Plugin Settings Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8457aeb-867b-4185-8271-a5452b7c5365?source=api-prod","affected":[{"type":"plugin","slug":"scroll-triggered-animations","name":"Animator \u2013 Scroll Triggered Animations","from":"*","from_inclusive":true,"to":"3.0.10","to_inclusive":true,"patched_in":"3.0.11"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f84660c8-9dfc-4c1d-9585-edb3b28f1858","source":"wordfence","cve":"CVE-2026-39540","title":"Shipment Tracker for Woocommerce <= 1.5.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84660c8-9dfc-4c1d-9585-edb3b28f1858?source=api-prod","affected":[{"type":"plugin","slug":"shipment-tracker-for-woocommerce","name":"Shipment Tracker for Woocommerce","from":"*","from_inclusive":true,"to":"1.5.3.2","to_inclusive":true,"patched_in":"1.5.3.3"}],"published":"2026-04-16T00:00:00Z","updated":"2026-04-21T14:45:00Z"},{"id":"wordfence:f8470662-2247-4159-9dac-f13677c94bdf","source":"wordfence","cve":"CVE-2026-5200","title":"AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8470662-2247-4159-9dac-f13677c94bdf?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.8.2","to_inclusive":true,"patched_in":"10.9.0"}],"published":"2026-05-19T18:19:44Z","updated":"2026-05-20T07:21:10Z"},{"id":"wordfence:f849d0e8-2b08-41de-ac18-c8d6e98ffa83","source":"wordfence","cve":"CVE-2025-22791","title":"offset writing <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f849d0e8-2b08-41de-ac18-c8d6e98ffa83?source=api-prod","affected":[{"type":"theme","slug":"offset-writing","name":"Offset Writing","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-13T00:00:00Z","updated":"2025-01-22T20:07:10Z"},{"id":"wordfence:f84a7a39-1974-49e7-8bd0-332d79ab4548","source":"wordfence","cve":"CVE-2026-16060","title":"Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Authenticated (Editor+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84a7a39-1974-49e7-8bd0-332d79ab4548?source=api-prod","affected":[{"type":"plugin","slug":"insert-or-embed-articulate-content-into-wordpress","name":"Insert or Embed Articulate Content into WordPress","from":"*","from_inclusive":true,"to":"4.3000000027","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-21T15:22:57Z"},{"id":"wordfence:f84ab165-4fff-4c57-857d-5259a92d5690","source":"wordfence","cve":"CVE-2025-46235","title":"SKT Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84ab165-4fff-4c57-857d-5259a92d5690?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T20:20:14Z"},{"id":"wordfence:f84b6767-f254-45c9-8e78-36d4beac2a98","source":"wordfence","cve":"CVE-2026-120070","title":"User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84b6767-f254-45c9-8e78-36d4beac2a98?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.13","to_inclusive":true,"patched_in":"4.3.14"}],"published":"2026-10-30T19:33:59Z","updated":"2026-10-31T07:46:53Z"},{"id":"wordfence:f84c1c45-6930-4865-ba7e-be714f731311","source":"wordfence","cve":"CVE-2025-49073","title":"Sweet Dessert < 1.1.13 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84c1c45-6930-4865-ba7e-be714f731311?source=api-prod","affected":[{"type":"theme","slug":"sweet-dessert","name":"Sweet Dessert | Candy Shop & Cafe WordPress Theme","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":false,"patched_in":"1.1.13"}],"published":"2025-06-03T00:00:00Z","updated":"2025-06-12T13:55:06Z"},{"id":"wordfence:f84ddc83-2079-45b9-8354-51094581b1f8","source":"wordfence","cve":"CVE-2025-14948","title":"miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f84ddc83-2079-45b9-8354-51094581b1f8?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-sms-order-notification-otp-verification","name":"miniOrange OTP Verification and SMS Notification for WooCommerce","from":"*","from_inclusive":true,"to":"4.3.8","to_inclusive":true,"patched_in":"4.3.9"}],"published":"2026-01-09T00:00:00Z","updated":"2026-01-10T07:03:55Z"},{"id":"wordfence:f853415c-ea8d-4330-b4e3-fc0c7c6bcbd1","source":"wordfence","cve":"CVE-2026-25365","title":"Kargo Takip < 0.2.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f853415c-ea8d-4330-b4e3-fc0c7c6bcbd1?source=api-prod","affected":[{"type":"plugin","slug":"kargo-takip-turkiye","name":"Kargo Takip, WooCommerce & Dokan Kargo Takip, SMS ve E-posta","from":"*","from_inclusive":true,"to":"0.2.4","to_inclusive":false,"patched_in":"0.2.4"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:55:57Z"},{"id":"wordfence:f8534891-2269-4afe-b83f-df512ca36456","source":"wordfence","cve":"CVE-2019-17213","title":"WebARX <= 1.3.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8534891-2269-4afe-b83f-df512ca36456?source=api-prod","affected":[{"type":"plugin","slug":"webarx","name":"WebARX","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2018-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8544784-1994-47e2-be39-568d0ab9ee00","source":"wordfence","cve":"CVE-2025-15463","title":"Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8544784-1994-47e2-be39-568d0ab9ee00?source=api-prod","affected":[{"type":"plugin","slug":"acf-extended","name":"Advanced Custom Fields: Extended","from":"*","from_inclusive":true,"to":"0.9.2.3","to_inclusive":true,"patched_in":"0.9.2.4"}],"published":"2026-05-12T09:54:49Z","updated":"2026-05-12T22:24:25Z"},{"id":"wordfence:f85478c4-ea66-4bca-b501-2e55425396f7","source":"wordfence","cve":"CVE-2026-14317","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f85478c4-ea66-4bca-b501-2e55425396f7?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.16.3","to_inclusive":false,"patched_in":"4.16.3"}],"published":"2026-08-04T00:00:00Z","updated":"2026-08-14T12:50:33Z"},{"id":"wordfence:f8575c46-e51d-4be9-85bf-024688c4607d","source":"wordfence","cve":"CVE-2022-2181","title":"Advanced WordPress Reset <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8575c46-e51d-4be9-85bf-024688c4607d?source=api-prod","affected":[{"type":"plugin","slug":"advanced-wp-reset","name":"Advanced WordPress Reset \u2013 Debug, Recover & Reset WP","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":"1.6"}],"published":"2022-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f85a0394-cd70-419d-97bd-c75d6f721714","source":"wordfence","cve":"","title":"MyBookTable Bookstore <= 3.2.2 - Reflected Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f85a0394-cd70-419d-97bd-c75d6f721714?source=api-prod","affected":[{"type":"plugin","slug":"mybooktable","name":"MyBookTable Bookstore by Stormhill Media","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2019-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f85df8f1-9283-48d0-8f19-88a4a839d501","source":"wordfence","cve":"CVE-2023-47653","title":"TWB Woocommerce Reviews <= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f85df8f1-9283-48d0-8f19-88a4a839d501?source=api-prod","affected":[{"type":"plugin","slug":"twb-woocommerce-reviews","name":"TWB Woocommerce Reviews","from":"*","from_inclusive":true,"to":"1.7.5","to_inclusive":true,"patched_in":"1.7.6"}],"published":"2023-11-07T00:00:00Z","updated":"2024-10-18T13:44:11Z"},{"id":"wordfence:f85f2fbb-5bd5-4508-abb0-36543b8ddaa2","source":"wordfence","cve":"CVE-2021-24944","title":"Custom Dashboard & Login Page < 6.9.5 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f85f2fbb-5bd5-4508-abb0-36543b8ddaa2?source=api-prod","affected":[{"type":"plugin","slug":"ag-custom-admin","name":"AGCA \u2013 Custom Dashboard & Login Page","from":"*","from_inclusive":true,"to":"6.9.5","to_inclusive":true,"patched_in":"7.0"}],"published":"2021-12-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8615422-5db7-495d-9956-7d6f658f42bf","source":"wordfence","cve":"CVE-2025-12846","title":"Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8615422-5db7-495d-9956-7d6f658f42bf?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.19","to_inclusive":true,"patched_in":"2.1.20"}],"published":"2025-11-10T22:26:41Z","updated":"2025-11-11T11:03:46Z"},{"id":"wordfence:f861ece5-21e4-4c7f-8701-bd9492b1b8bf","source":"wordfence","cve":"CVE-2025-6755","title":"Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f861ece5-21e4-4c7f-8701-bd9492b1b8bf?source=api-prod","affected":[{"type":"plugin","slug":"game-users-share-buttons","name":"Game Users Share Buttons","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T17:19:35Z","updated":"2025-06-28T05:29:51Z"},{"id":"wordfence:f862afea-cd35-4aa4-aba6-df12a3728776","source":"wordfence","cve":"CVE-2024-43928","title":"JobSearch <= 2.5.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f862afea-cd35-4aa4-aba6-df12a3728776?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.6"}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:27:13Z"},{"id":"wordfence:f8650a2e-346f-45fb-b5f5-ee99a470b2fc","source":"wordfence","cve":"CVE-2014-0173","title":"Jetpack < 2.9.3 - Security Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8650a2e-346f-45fb-b5f5-ee99a470b2fc?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"1.9","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.0","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.1","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.2","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.3","from_inclusive":true,"to":"2.3.6","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.4","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.5","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.6","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.7","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.8","from_inclusive":true,"to":"2.8.1","to_inclusive":true,"patched_in":"1.9.4"},{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"2.9","from_inclusive":true,"to":"2.9.2","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2014-08-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f86602f7-8e19-4728-b614-263c36bda565","source":"wordfence","cve":"CVE-2025-39477","title":"InWave Jobs <= 3.5.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f86602f7-8e19-4728-b614-263c36bda565?source=api-prod","affected":[{"type":"plugin","slug":"iwjob","name":"InWave Jobs","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-04T00:00:00Z","updated":"2025-06-10T15:09:45Z"},{"id":"wordfence:f866ef19-2662-49c1-a90a-920403c8799d","source":"wordfence","cve":"CVE-2026-49074","title":"JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f866ef19-2662-49c1-a90a-920403c8799d?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.9.1","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:39:24Z"},{"id":"wordfence:f8698529-4c55-45ad-a0c2-5f1d01944bf0","source":"wordfence","cve":"","title":"Responsive Tabs with WooCommerce Product Tab Extension <= 3.5.4 - Unauthenticated Arbitrary Option Update","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8698529-4c55-45ad-a0c2-5f1d01944bf0?source=api-prod","affected":[{"type":"plugin","slug":"vc-tabs","name":"Tabs \u2013 Responsive Tabs with WooCommerce Product Tab Extension","from":"*","from_inclusive":true,"to":"3.6.0","to_inclusive":false,"patched_in":"3.6.0"}],"published":"2021-12-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f86a69ab-2fc5-4c84-872b-929dbec429cd","source":"wordfence","cve":"CVE-2026-0832","title":"New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f86a69ab-2fc5-4c84-872b-929dbec429cd?source=api-prod","affected":[{"type":"plugin","slug":"new-user-approve","name":"New User Approve","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-01-27T17:49:02Z","updated":"2026-01-28T06:43:46Z"},{"id":"wordfence:f86c6ada-112b-4b1f-b1ac-7dd4920953c8","source":"wordfence","cve":"CVE-2026-15649","title":"Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f86c6ada-112b-4b1f-b1ac-7dd4920953c8?source=api-prod","affected":[{"type":"plugin","slug":"powerkit","name":"Powerkit \u2013 Supercharge your WordPress Site","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-07-31T19:47:12Z","updated":"2026-08-01T07:49:53Z"},{"id":"wordfence:f86e58a6-b713-43f2-97e1-3b7c9a505797","source":"wordfence","cve":"CVE-2024-56231","title":"SaasPricing <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f86e58a6-b713-43f2-97e1-3b7c9a505797?source=api-prod","affected":[{"type":"plugin","slug":"saaspricing","name":"SaasPricing \u2013 Advanced Pricing & Comparison Tables for Elementor","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2024-12-19T00:00:00Z","updated":"2025-12-18T18:45:22Z"},{"id":"wordfence:f86e8ccb-a865-4da5-9250-dd715b8cdbe7","source":"wordfence","cve":"CVE-2024-10521","title":"WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f86e8ccb-a865-4da5-9250-dd715b8cdbe7?source=api-prod","affected":[{"type":"plugin","slug":"contact-forms","name":"Contact Forms by Cimatti","from":"*","from_inclusive":true,"to":"1.9.2","to_inclusive":true,"patched_in":"1.9.3"}],"published":"2024-11-26T22:58:56Z","updated":"2024-11-27T11:03:35Z"},{"id":"wordfence:f87019bd-4e33-4832-a9f3-4a93157386f8","source":"wordfence","cve":"CVE-2024-35746","title":"BuddyPress Cover <= 2.1.4.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":10.0,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87019bd-4e33-4832-a9f3-4a93157386f8?source=api-prod","affected":[{"type":"plugin","slug":"bp-cover","name":"BuddyPress Cover","from":"*","from_inclusive":true,"to":"2.1.4.2","to_inclusive":true,"patched_in":""}],"published":"2024-06-06T00:00:00Z","updated":"2024-06-12T12:43:44Z"},{"id":"wordfence:f870f201-deed-4ee1-8468-35cf469b6e6d","source":"wordfence","cve":"CVE-2025-48109","title":"XM-Backup <= 0.9.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f870f201-deed-4ee1-8468-35cf469b6e6d?source=api-prod","affected":[{"type":"plugin","slug":"xm-backup","name":"XM-Backup","from":"*","from_inclusive":true,"to":"0.9.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T20:01:45Z"},{"id":"wordfence:f8722424-44a1-4dee-819e-039df762a3dc","source":"wordfence","cve":"CVE-2025-64256","title":"Simple Folio <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8722424-44a1-4dee-819e-039df762a3dc?source=api-prod","affected":[{"type":"plugin","slug":"simple-folio","name":"Simple Folio","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-12-15T00:00:00Z","updated":"2025-12-20T19:32:31Z"},{"id":"wordfence:f8756fb7-ee15-4fc7-b5bd-b4f2e64f8e6f","source":"wordfence","cve":"CVE-2023-50829","title":"Loan Repayment Calculator and Application Form <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8756fb7-ee15-4fc7-b5bd-b4f2e64f8e6f?source=api-prod","affected":[{"type":"plugin","slug":"quick-interest-slider","name":"Quick Interest Slider","from":"*","from_inclusive":true,"to":"2.9.3","to_inclusive":true,"patched_in":"2.9.4"}],"published":"2023-12-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8758fd2-9f43-4e31-b496-50b77180bc07","source":"wordfence","cve":"CVE-2013-7233","title":"WordPress Core < 2.1 - Cross-Site Request Forgery to Denial of Service","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8758fd2-9f43-4e31-b496-50b77180bc07?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.1"}],"published":"2013-12-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8786695-adab-4d7c-8cc1-53f37c06de12","source":"wordfence","cve":"CVE-2026-57360","title":"eCommerce Product Catalog Plugin for WordPress <= 3.5.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8786695-adab-4d7c-8cc1-53f37c06de12?source=api-prod","affected":[{"type":"plugin","slug":"ecommerce-product-catalog","name":"eCommerce Product Catalog","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":true,"patched_in":"3.5.5"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-07T19:44:49Z"},{"id":"wordfence:f87b6987-8896-4edf-9b14-8582426adeb0","source":"wordfence","cve":"CVE-2023-4536","title":"My Account Page Editor <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87b6987-8896-4edf-9b14-8582426adeb0?source=api-prod","affected":[{"type":"plugin","slug":"my-account-page-editor","name":"My Account Page Editor","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2023-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f87df7cc-54bb-454c-94be-c8c4768cbe44","source":"wordfence","cve":"CVE-2022-4236","title":"Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87df7cc-54bb-454c-94be-c8c4768cbe44?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.8.4","to_inclusive":true,"patched_in":"2.8.5"}],"published":"2022-12-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f87e78c5-e7f4-4af6-b64f-444fef23e890","source":"wordfence","cve":"","title":"Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87e78c5-e7f4-4af6-b64f-444fef23e890?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":false,"patched_in":"4.8.4"}],"published":"2019-05-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f87efb65-b53b-4e9c-b933-9303461487a3","source":"wordfence","cve":"CVE-2023-24373","title":"Booking calendar, Appointment Booking System <= 3.2.3 - Unauthenticated Bypass Vulnerability","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87efb65-b53b-4e9c-b933-9303461487a3?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-01-27T00:00:00Z","updated":"2024-06-18T14:58:11Z"},{"id":"wordfence:f87f0e42-e116-4441-8cd7-229d213b1d3a","source":"wordfence","cve":"CVE-2026-14831","title":"Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-20","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f87f0e42-e116-4441-8cd7-229d213b1d3a?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-easy-booking-system","name":"Easy Booking \u2013 WooCommerce Booking & Reservation Plugin","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.5.0"}],"published":"2026-07-13T00:00:00Z","updated":"2026-09-17T14:42:48Z"},{"id":"wordfence:f8812cfe-4bbe-44ba-9513-7f81bad68d11","source":"wordfence","cve":"CVE-2023-30870","title":"Sharkdropship for AliExpress Dropship and Affiliate <= 2.2.4 - Missing Authorization","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8812cfe-4bbe-44ba-9513-7f81bad68d11?source=api-prod","affected":[{"type":"plugin","slug":"wooshark-aliexpress-importer","name":"Sharkdropship & affiliate for AliExpress","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-10-03T00:00:00Z","updated":"2024-04-01T21:01:11Z"},{"id":"wordfence:f88286b9-16b2-42a9-b8c6-0a6fe6c136ef","source":"wordfence","cve":"CVE-2019-9568","title":"Forminator Plugin <= 1.5.3.1 - SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88286b9-16b2-42a9-b8c6-0a6fe6c136ef?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":false,"patched_in":"1.6"}],"published":"2019-02-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f882da12-2db7-481f-9a16-a54e1ab24af5","source":"wordfence","cve":"CVE-2021-24509","title":"Page View Counts <= 2.4.8 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f882da12-2db7-481f-9a16-a54e1ab24af5?source=api-prod","affected":[{"type":"plugin","slug":"page-views-count","name":"Page View Count","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2021-07-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f883823f-c225-4cd2-a0f6-39013476ed83","source":"wordfence","cve":"CVE-2023-4620","title":"Booking Calendar <= 9.7.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f883823f-c225-4cd2-a0f6-39013476ed83?source=api-prod","affected":[{"type":"plugin","slug":"booking","name":"Booking Calendar","from":"*","from_inclusive":true,"to":"9.7.3","to_inclusive":true,"patched_in":"9.7.3.1"}],"published":"2023-09-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f884aa09-9f5e-4602-8ba3-3a1268c9c8b4","source":"wordfence","cve":"CVE-2025-6572","title":"OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f884aa09-9f5e-4602-8ba3-3a1268c9c8b4?source=api-prod","affected":[{"type":"plugin","slug":"stepbyteservice-openstreetmap","name":"OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-18T00:00:00Z","updated":"2025-08-25T15:41:06Z"},{"id":"wordfence:f884ea43-e1a5-4b44-8a24-f68f71b0fcfb","source":"wordfence","cve":"CVE-2024-13378","title":"GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f884ea43-e1a5-4b44-8a24-f68f71b0fcfb?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"2.9.0.1","from_inclusive":true,"to":"2.9.1.3","to_inclusive":true,"patched_in":"2.9.2"}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-17T09:36:40Z"},{"id":"wordfence:f8883a14-b17d-4815-be48-bf32036f310d","source":"wordfence","cve":"CVE-2026-111578","title":"PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8883a14-b17d-4815-be48-bf32036f310d?source=api-prod","affected":[{"type":"plugin","slug":"pdf-invoices-for-woocommerce","name":"PDF Invoices & Packing Slips For WooCommerce","from":"5.16.2","from_inclusive":true,"to":"5.16.4","to_inclusive":true,"patched_in":"5.16.5"}],"published":"2026-10-29T00:00:00Z","updated":"2026-11-03T19:23:10Z"},{"id":"wordfence:f888a29d-3e92-4833-85e5-081815e045c7","source":"wordfence","cve":"CVE-2024-8670","title":"Photo Gallery by 10Web <= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f888a29d-3e92-4833-85e5-081815e045c7?source=api-prod","affected":[{"type":"plugin","slug":"photo-gallery","name":"Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery","from":"*","from_inclusive":true,"to":"1.8.28","to_inclusive":true,"patched_in":"1.8.29"}],"published":"2024-10-03T00:00:00Z","updated":"2024-11-01T17:02:54Z"},{"id":"wordfence:f889342e-03fb-44eb-b5cb-acf115a526c3","source":"wordfence","cve":"CVE-2024-9025","title":"Sight \u2013 Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f889342e-03fb-44eb-b5cb-acf115a526c3?source=api-prod","affected":[{"type":"plugin","slug":"sight","name":"Sight \u2013 Professional Image Gallery and Portfolio","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T08:29:47Z"},{"id":"wordfence:f88aa3de-3204-4e92-bb19-41ff79f42168","source":"wordfence","cve":"CVE-2026-28072","title":"pixfort Core <= 3.2.22 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88aa3de-3204-4e92-bb19-41ff79f42168?source=api-prod","affected":[{"type":"plugin","slug":"pixfort-core","name":"Pixfort Core","from":"*","from_inclusive":true,"to":"3.2.22","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:02:45Z"},{"id":"wordfence:f88b8f3f-b4e0-482e-a2e8-dc0f3529a37e","source":"wordfence","cve":"CVE-2024-38766","title":"Matomo Analytics <= 5.1.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88b8f3f-b4e0-482e-a2e8-dc0f3529a37e?source=api-prod","affected":[{"type":"plugin","slug":"matomo","name":"Matomo Analytics \u2013 Powerful, Privacy-First Insights for WordPress","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2024-07-12T00:00:00Z","updated":"2024-07-17T10:10:34Z"},{"id":"wordfence:f88c00ca-cf9e-44e7-9495-686ace1ead21","source":"wordfence","cve":"CVE-2026-10780","title":"Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88c00ca-cf9e-44e7-9495-686ace1ead21?source=api-prod","affected":[{"type":"plugin","slug":"static-block","name":"Static Block","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2026-06-15T16:26:55Z","updated":"2026-06-16T04:30:21Z"},{"id":"wordfence:f88da532-31e5-4788-9b41-5ed4721ad6e0","source":"wordfence","cve":"CVE-2024-52465","title":"LGPD Framework <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88da532-31e5-4788-9b41-5ed4721ad6e0?source=api-prod","affected":[{"type":"plugin","slug":"lgpd-framework","name":"LGPD Framework By Data443","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2024-11-18T00:00:00Z","updated":"2024-11-26T14:17:56Z"},{"id":"wordfence:f88eaf82-e5de-43e2-b998-4a6d33be65ac","source":"wordfence","cve":"","title":"Parallelus Unite, Interscet, Traject, & Salutation < 2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88eaf82-e5de-43e2-b998-4a6d33be65ac?source=api-prod","affected":[{"type":"theme","slug":"parallelus-intersect","name":"Parallelus Intersect","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"parallelus-unite","name":"Parallelus Unite","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"parallelus-salutation","name":"Salutation Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"},{"type":"theme","slug":"parallelus-traject","name":"Parallelus Traject","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":false,"patched_in":"2.0"}],"published":"2012-10-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f88ef4cf-3f22-40e0-b651-59cb40f148fd","source":"wordfence","cve":"CVE-2023-6530","title":"TJ Shortcodes 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88ef4cf-3f22-40e0-b651-59cb40f148fd?source=api-prod","affected":[{"type":"plugin","slug":"theme-junkie-shortcodes","name":"TJ Shortcodes","from":"*","from_inclusive":true,"to":"0.1.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f88f065d-14ca-4547-9a41-f9177979a9ed","source":"wordfence","cve":"CVE-2025-4682","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f88f065d-14ca-4547-9a41-f9177979a9ed?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"5.4.0","to_inclusive":true,"patched_in":"5.4.1"}],"published":"2025-05-26T12:53:47Z","updated":"2025-05-27T01:53:44Z"},{"id":"wordfence:f8906333-7024-40d3-91cd-2ecbbf20314f","source":"wordfence","cve":"CVE-2025-13924","title":"Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.17 - Cross-Site Request Forgery to Product Field Group Duplication and Publication","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8906333-7024-40d3-91cd-2ecbbf20314f?source=api-prod","affected":[{"type":"plugin","slug":"advanced-product-fields-for-woocommerce","name":"Advanced Product Fields (Product Addons) for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.17","to_inclusive":true,"patched_in":"1.6.18"}],"published":"2025-12-08T00:00:00Z","updated":"2025-12-09T17:23:32Z"},{"id":"wordfence:f891a6c8-3d06-432e-8651-bb689015af1c","source":"wordfence","cve":"CVE-2024-4378","title":"Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f891a6c8-3d06-432e-8651-bb689015af1c?source=api-prod","affected":[{"type":"plugin","slug":"premium-addons-for-elementor","name":"Premium Addons for Elementor \u2013 AI-Ready Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"4.10.31","to_inclusive":true,"patched_in":"4.10.32"}],"published":"2024-05-22T00:00:00Z","updated":"2024-05-23T11:02:39Z"},{"id":"wordfence:f891b717-738b-45fd-b355-d407785e3454","source":"wordfence","cve":"CVE-2025-24723","title":"Booking Calendar Contact Form <= 1.2.55 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f891b717-738b-45fd-b355-d407785e3454?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.2.55","to_inclusive":true,"patched_in":"1.2.56"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:29:45Z"},{"id":"wordfence:f89373e8-2fef-427e-854b-8b78b5781288","source":"wordfence","cve":"CVE-2025-24636","title":"MachForm Shortcode <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89373e8-2fef-427e-854b-8b78b5781288?source=api-prod","affected":[{"type":"plugin","slug":"machform-shortcode","name":"MachForm Shortcode","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:09:20Z"},{"id":"wordfence:f8945eed-eee4-4043-b6ab-d1ea553a4a23","source":"wordfence","cve":"CVE-2025-5563","title":"WP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8945eed-eee4-4043-b6ab-d1ea553a4a23?source=api-prod","affected":[{"type":"plugin","slug":"wp-addpub","name":"WP-Addpub","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:50:59Z","updated":"2025-06-06T06:42:54Z"},{"id":"wordfence:f894ce75-168c-4baa-8cae-d2e7f1a0a9ab","source":"wordfence","cve":"CVE-2026-1656","title":"Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=api-prod","affected":[{"type":"plugin","slug":"business-directory-plugin","name":"Business Directory Plugin \u2013 Easy Listing & Member Directories for WordPress","from":"*","from_inclusive":true,"to":"6.4.20","to_inclusive":true,"patched_in":"6.4.21"}],"published":"2026-02-17T20:07:01Z","updated":"2026-02-18T08:26:05Z"},{"id":"wordfence:f8953c5c-0711-4c29-8055-62b3a168b369","source":"wordfence","cve":"CVE-2025-32499","title":"Logo Showcase Ultimate <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8953c5c-0711-4c29-8055-62b3a168b369?source=api-prod","affected":[{"type":"plugin","slug":"logo-showcase-ultimate","name":"Logo Showcase Ultimate \u2013 Logo Carousel, Logo Slider & Logo Grid","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T14:22:03Z"},{"id":"wordfence:f89718f2-e25b-4393-986a-34ef3076a59c","source":"wordfence","cve":"CVE-2015-9308","title":"WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89718f2-e25b-4393-986a-34ef3076a59c?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-map-plugin","name":"WP Maps \u2013 Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings","from":"*","from_inclusive":true,"to":"2.3.10","to_inclusive":false,"patched_in":"2.3.10"}],"published":"2015-08-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f89737cf-90f0-4d85-a7b3-f633047eb93c","source":"wordfence","cve":"CVE-2025-55708","title":"Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89737cf-90f0-4d85-a7b3-f633047eb93c?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"10.2.4","to_inclusive":true,"patched_in":"10.2.5"}],"published":"2025-08-14T00:00:00Z","updated":"2025-08-19T14:15:53Z"},{"id":"wordfence:f898ab34-2d63-458d-b19b-4e2b6f4a0f3b","source":"wordfence","cve":"CVE-2026-15010","title":"bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f898ab34-2d63-458d-b19b-4e2b6f4a0f3b?source=api-prod","affected":[{"type":"plugin","slug":"bbp-style-pack","name":"bbp style pack","from":"*","from_inclusive":true,"to":"6.4.5","to_inclusive":true,"patched_in":"6.4.6"}],"published":"2026-07-10T17:38:23Z","updated":"2026-07-11T06:50:33Z"},{"id":"wordfence:f8991817-b280-474e-9120-550bacb07066","source":"wordfence","cve":"CVE-2025-22694","title":"Hide Shipping Method For WooCommerce <= 1.5.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8991817-b280-474e-9120-550bacb07066?source=api-prod","affected":[{"type":"plugin","slug":"hide-shipping-method-for-woocommerce","name":"Hide Shipping Method For WooCommerce","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-01-31T00:00:00Z","updated":"2025-07-17T17:35:04Z"},{"id":"wordfence:f89aeafd-3449-46b0-b350-bb3b7b08a47d","source":"wordfence","cve":"CVE-2025-66531","title":"Salon booking system <= 10.30.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89aeafd-3449-46b0-b350-bb3b7b08a47d?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.3","to_inclusive":true,"patched_in":"10.30.4"}],"published":"2025-12-07T00:00:00Z","updated":"2025-12-11T15:49:30Z"},{"id":"wordfence:f89ba641-6c78-48d3-8826-96576198274f","source":"wordfence","cve":"CVE-2021-24804","title":"Simple JWT Login <= 3.2.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89ba641-6c78-48d3-8826-96576198274f?source=api-prod","affected":[{"type":"plugin","slug":"simple-jwt-login","name":"Simple JWT Login \u2013 Allows you to use JWT on REST endpoints.","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":false,"patched_in":"3.2.1"}],"published":"2021-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f89e9c46-aca3-4b2f-b935-2976c510ed8b","source":"wordfence","cve":"CVE-2022-3899","title":"3DPrint < 3.5.6.9 - Cross-Site Request Forgery to Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f89e9c46-aca3-4b2f-b935-2976c510ed8b?source=api-prod","affected":[{"type":"plugin","slug":"3dprint","name":"3DPrint","from":"*","from_inclusive":true,"to":"3.5.4.8","to_inclusive":true,"patched_in":"3.5.6.9"}],"published":"2022-11-08T00:00:00Z","updated":"2026-02-25T19:03:54Z"},{"id":"wordfence:f8a2a23c-23bf-4f23-8b9d-1d6fe869d705","source":"wordfence","cve":"CVE-2023-2026","title":"Image Protector <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a2a23c-23bf-4f23-8b9d-1d6fe869d705?source=api-prod","affected":[{"type":"plugin","slug":"image-protector","name":"Image Protector","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8a356db-02a2-4392-baca-46ef1bbfc801","source":"wordfence","cve":"CVE-2014-4551","title":"Social Connect <= 0.10.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a356db-02a2-4392-baca-46ef1bbfc801?source=api-prod","affected":[{"type":"plugin","slug":"social-connect","name":"Social Connect","from":"*","from_inclusive":true,"to":"0.10.1","to_inclusive":true,"patched_in":"0.10.2"}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8a54a18-64e2-4046-8143-2b5116c4200b","source":"wordfence","cve":"CVE-2025-10587","title":"Community Events <= 1.5.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a54a18-64e2-4046-8143-2b5116c4200b?source=api-prod","affected":[{"type":"plugin","slug":"community-events","name":"Community Events","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2025-10-07T14:36:50Z","updated":"2025-10-08T03:31:33Z"},{"id":"wordfence:f8a653ab-7703-4e73-8089-a15ba6cf9718","source":"wordfence","cve":"","title":"Stop User Enumeration <= 1.2.4 - Security Bypass","severity":"high","cvss":7.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a653ab-7703-4e73-8089-a15ba6cf9718?source=api-prod","affected":[{"type":"plugin","slug":"stop-user-enumeration","name":"Stop User Enumeration","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2014-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8a87f7b-471b-44c0-a0bd-06a9ba24a566","source":"wordfence","cve":"CVE-2022-0383","title":"WP Review Slider < 11.0 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8a87f7b-471b-44c0-a0bd-06a9ba24a566?source=api-prod","affected":[{"type":"plugin","slug":"wp-facebook-reviews","name":"WP Review Slider","from":"*","from_inclusive":true,"to":"11.0","to_inclusive":false,"patched_in":"11.0"}],"published":"2022-01-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8aa6410-afb7-44fe-9e4d-b357a15612f3","source":"wordfence","cve":"CVE-2025-60054","title":"OnLeash <= 1.5.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8aa6410-afb7-44fe-9e4d-b357a15612f3?source=api-prod","affected":[{"type":"theme","slug":"onleash","name":"OnLeash | Dog Walking & Pet Services Veterinary WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2025-08-19T00:00:00Z","updated":"2025-12-19T16:39:41Z"},{"id":"wordfence:f8aa8dd6-abff-4c37-98d5-39a924b15651","source":"wordfence","cve":"","title":"Charitable \u2013 Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8aa8dd6-abff-4c37-98d5-39a924b15651?source=api-prod","affected":[{"type":"plugin","slug":"charitable","name":"Charitable \u2013 Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)","from":"*","from_inclusive":true,"to":"1.6.50","to_inclusive":true,"patched_in":"1.6.51"}],"published":"2021-07-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8abddb0-0f37-4216-b7d7-e37bb9fea7d9","source":"wordfence","cve":"CVE-2026-119367","title":"The Events Calendar <= 6.18.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8abddb0-0f37-4216-b7d7-e37bb9fea7d9?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.18.2","to_inclusive":true,"patched_in":"6.18.3"}],"published":"2026-10-30T16:09:00Z","updated":"2026-11-03T19:49:58Z"},{"id":"wordfence:f8aefc77-b5fb-45b0-b3ba-67d850c72e77","source":"wordfence","cve":"CVE-2019-15111","title":"WP Front End Profile <= 0.2.1 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8aefc77-b5fb-45b0-b3ba-67d850c72e77?source=api-prod","affected":[{"type":"plugin","slug":"wp-front-end-profile","name":"WP Frontend Profile","from":"*","from_inclusive":true,"to":"0.2.1","to_inclusive":true,"patched_in":"0.2.2"}],"published":"2016-09-14T00:00:00Z","updated":"2025-06-10T13:04:52Z"},{"id":"wordfence:f8b072a7-ef8a-4f75-994b-1f406d5f9057","source":"wordfence","cve":"CVE-2025-68860","title":"Mobile builder <= 1.4.2 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b072a7-ef8a-4f75-994b-1f406d5f9057?source=api-prod","affected":[{"type":"plugin","slug":"mobile-builder","name":"Mobile builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-12-26T00:00:00Z","updated":"2026-01-06T14:50:35Z"},{"id":"wordfence:f8b089d9-f509-4ebe-9587-aa54c52c35bd","source":"wordfence","cve":"CVE-2025-63057","title":"Ultimate Review <= 2.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b089d9-f509-4ebe-9587-aa54c52c35bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-review","name":"WP Ultimate Review","from":"*","from_inclusive":true,"to":"2.3.7","to_inclusive":true,"patched_in":"2.3.8"}],"published":"2025-12-07T00:00:00Z","updated":"2026-02-26T15:26:50Z"},{"id":"wordfence:f8b09933-9634-4a8a-a899-ba500979e5aa","source":"wordfence","cve":"CVE-2021-24412","title":"Html5 Audio Player <= 2.1.2 - Contributor+ Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b09933-9634-4a8a-a899-ba500979e5aa?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.1.3"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8b09972-4d2d-4ab3-bc12-7aba32aefd49","source":"wordfence","cve":"CVE-2026-76012","title":"Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload","severity":"high","cvss":7.5,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b09972-4d2d-4ab3-bc12-7aba32aefd49?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery","name":"Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery","from":"*","from_inclusive":true,"to":"4.4.1","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-10-30T17:14:43Z","updated":"2026-10-30T17:15:33Z"},{"id":"wordfence:f8b178ed-994b-4b2c-85b5-dada1059c600","source":"wordfence","cve":"CVE-2026-25351","title":"MyMedi < 1.7.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b178ed-994b-4b2c-85b5-dada1059c600?source=api-prod","affected":[{"type":"theme","slug":"mymedi","name":"MyMedi - Responsive WooCommerce WordPress Theme","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":false,"patched_in":"1.7.7"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:45:14Z"},{"id":"wordfence:f8b33ee9-f055-4d1a-ac4f-2e67d9f0da28","source":"wordfence","cve":"CVE-2026-109935","title":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b33ee9-f055-4d1a-ac4f-2e67d9f0da28?source=api-prod","affected":[{"type":"plugin","slug":"otter-blocks","name":"Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2026-10-23T00:00:00Z","updated":"2026-10-23T21:09:07Z"},{"id":"wordfence:f8b34144-5516-46df-b093-95f4bf76b896","source":"wordfence","cve":"CVE-2026-1316","title":"Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b34144-5516-46df-b093-95f4bf76b896?source=api-prod","affected":[{"type":"plugin","slug":"customer-reviews-woocommerce","name":"Customer Reviews for WooCommerce","from":"*","from_inclusive":true,"to":"5.97.0","to_inclusive":true,"patched_in":"5.98.0"}],"published":"2026-02-12T00:17:35Z","updated":"2026-02-12T12:32:25Z"},{"id":"wordfence:f8b69e14-1c21-4f52-a1fb-6da34b00b1fd","source":"wordfence","cve":"CVE-2016-1000129","title":"Defa Online Image Protector Free Edition <= 3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b69e14-1c21-4f52-a1fb-6da34b00b1fd?source=api-prod","affected":[{"type":"plugin","slug":"defa-online-image-protector","name":"Defa Online Image Protector Free Edition","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2016-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8b8e13d-3270-4fb1-aee1-db2cf728ac55","source":"wordfence","cve":"CVE-2025-30930","title":"ACF: Yandex Maps Field <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8b8e13d-3270-4fb1-aee1-db2cf728ac55?source=api-prod","affected":[{"type":"plugin","slug":"acf-yandex-maps-field","name":"ACF: Yandex Maps Field","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T19:38:29Z"},{"id":"wordfence:f8ba38c3-51d2-43a7-89ff-c72a8edc946b","source":"wordfence","cve":"CVE-2023-5704","title":"CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ba38c3-51d2-43a7-89ff-c72a8edc946b?source=api-prod","affected":[{"type":"plugin","slug":"cpo-shortcodes","name":"CPO Shortcodes","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""}],"published":"2023-10-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8bbab6e-ed2f-4b90-a658-aae85906d06e","source":"wordfence","cve":"CVE-2025-10289","title":"Filter & Grids <= 3.2.0 - Unauthenticated SQL Injection","severity":"medium","cvss":5.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bbab6e-ed2f-4b90-a658-aae85906d06e?source=api-prod","affected":[{"type":"plugin","slug":"ymc-smart-filter","name":"YMC Filter","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2025-12-12T00:00:00Z","updated":"2025-12-13T07:21:05Z"},{"id":"wordfence:f8bc8863-04a9-4631-9510-624f98ea1e75","source":"wordfence","cve":"CVE-2025-3919","title":"WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bc8863-04a9-4631-9510-624f98ea1e75?source=api-prod","affected":[{"type":"plugin","slug":"comments-import-export-woocommerce","name":"Comments Import & Export","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"}],"published":"2025-06-02T10:16:48Z","updated":"2025-06-02T22:22:35Z"},{"id":"wordfence:f8bcf51a-36ee-4d4d-b9d6-d9db0dafd791","source":"wordfence","cve":"CVE-2025-13377","title":"10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache","severity":"critical","cvss":9.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bcf51a-36ee-4d4d-b9d6-d9db0dafd791?source=api-prod","affected":[{"type":"plugin","slug":"tenweb-speed-optimizer","name":"10Web Booster \u2013 Website speed optimization, Cache & Page Speed optimizer","from":"*","from_inclusive":true,"to":"2.32.7","to_inclusive":true,"patched_in":"2.32.11"}],"published":"2025-12-05T18:28:50Z","updated":"2025-12-06T06:39:09Z"},{"id":"wordfence:f8befbf2-0d9d-4d0e-87de-0f1b26c0acd0","source":"wordfence","cve":"CVE-2022-38141","title":"Sales Report Email for WooCommerce <= 2.8.0 - Missing Authorization for Email Functionality","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8befbf2-0d9d-4d0e-87de-0f1b26c0acd0?source=api-prod","affected":[{"type":"plugin","slug":"woo-advanced-sales-report-email","name":"Sales Report Email for WooCommerce","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":""}],"published":"2023-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8bf0933-1c97-4374-b323-c55b91fe4d27","source":"wordfence","cve":"CVE-2023-2083","title":"Essential Blocks <= 4.0.6 - Missing Authorization via save","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bf0933-1c97-4374-b323-c55b91fe4d27?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.0.6","to_inclusive":true,"patched_in":"4.0.7"}],"published":"2023-04-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8c15f90-1b38-4e64-aa41-e1473be5b07b","source":"wordfence","cve":"CVE-2025-22820","title":"VR Views <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c15f90-1b38-4e64-aa41-e1473be5b07b?source=api-prod","affected":[{"type":"plugin","slug":"vr-views","name":"VR Views","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T15:05:33Z"},{"id":"wordfence:f8c18b0d-15fe-45d6-9915-85d38803c117","source":"wordfence","cve":"CVE-2024-11195","title":"Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c18b0d-15fe-45d6-9915-85d38803c117?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribe","name":"Email Subscription Popup \u2014 Newsletter & GDPR Consent","from":"*","from_inclusive":true,"to":"1.2.22","to_inclusive":true,"patched_in":"1.2.23"}],"published":"2024-11-18T21:46:02Z","updated":"2024-11-19T11:02:30Z"},{"id":"wordfence:f8c85f61-3e0a-4dbe-a5d6-ab01dea000a7","source":"wordfence","cve":"CVE-2026-40747","title":"Ecommerce Zone <= 0.9.7 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c85f61-3e0a-4dbe-a5d6-ab01dea000a7?source=api-prod","affected":[{"type":"theme","slug":"ecommerce-zone","name":"Ecommerce Zone","from":"*","from_inclusive":true,"to":"0.9.7","to_inclusive":true,"patched_in":"0.9.8"}],"published":"2026-04-20T00:00:00Z","updated":"2026-04-30T15:28:17Z"},{"id":"wordfence:f8c8f343-ae71-4377-a799-1aea61bc5d55","source":"wordfence","cve":"CVE-2026-119073","title":"Live Composer <= 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c8f343-ae71-4377-a799-1aea61bc5d55?source=api-prod","affected":[{"type":"plugin","slug":"live-composer-page-builder","name":"Live Composer \u2013 Free WordPress Website Builder","from":"*","from_inclusive":true,"to":"2.1.22","to_inclusive":true,"patched_in":"2.1.23"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:24:35Z"},{"id":"wordfence:f8cba9d2-e973-48e9-b69d-3f8b6c4833d5","source":"wordfence","cve":"CVE-2025-62102","title":"DoFollow Case by Case <= 3.5.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8cba9d2-e973-48e9-b69d-3f8b6c4833d5?source=api-prod","affected":[{"type":"plugin","slug":"dofollow-case-by-case","name":"DoFollow Case by Case","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-10-26T00:00:00Z","updated":"2026-02-03T19:18:08Z"},{"id":"wordfence:f8ccf307-3bb8-45c5-91da-7d0f46e96694","source":"wordfence","cve":"CVE-2019-15835","title":"WP Better Permalinks < 3.0.5 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ccf307-3bb8-45c5-91da-7d0f46e96694?source=api-prod","affected":[{"type":"plugin","slug":"wp-better-permalinks","name":"WP Better Permalinks","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":false,"patched_in":"3.0.5"}],"published":"2019-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8cd9f1a-84e5-432f-a07d-f5941b8d9dda","source":"wordfence","cve":"CVE-2026-56060","title":"Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8cd9f1a-84e5-432f-a07d-f5941b8d9dda?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-delivery-notes","name":"Print Invoice & Delivery Notes for WooCommerce","from":"*","from_inclusive":true,"to":"7.1.1","to_inclusive":true,"patched_in":"7.1.2"}],"published":"2026-06-25T00:00:00Z","updated":"2026-07-02T12:44:13Z"},{"id":"wordfence:f8d093ae-e0b1-49c2-a492-e01f2e954ddb","source":"wordfence","cve":"CVE-2021-39343","title":"MPL-Publisher  <= 1.30.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d093ae-e0b1-49c2-a492-e01f2e954ddb?source=api-prod","affected":[{"type":"plugin","slug":"mpl-publisher","name":"MPL-Publisher \u2014 Ebook & Audiobook Creator","from":"*","from_inclusive":true,"to":"1.30.2","to_inclusive":true,"patched_in":"1.30.3"}],"published":"2021-10-15T19:23:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8d18aaa-c8f4-4688-841d-2a77b71b60b0","source":"wordfence","cve":"CVE-2026-77263","title":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d18aaa-c8f4-4688-841d-2a77b71b60b0?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.13.4","to_inclusive":true,"patched_in":"3.13.5"}],"published":"2026-09-04T17:24:18Z","updated":"2026-09-05T05:30:57Z"},{"id":"wordfence:f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc","source":"wordfence","cve":"CVE-2024-3553","title":"Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2024-04-26T00:00:00Z","updated":"2024-05-02T16:52:53Z"},{"id":"wordfence:f8db6a27-111b-4e6d-966e-0af0833307b1","source":"wordfence","cve":"CVE-2016-10986","title":"Tweet Wheel < 1.0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8db6a27-111b-4e6d-966e-0af0833307b1?source=api-prod","affected":[{"type":"plugin","slug":"tweet-wheel","name":"Tweet Wheel","from":"*","from_inclusive":true,"to":"1.0.3.3","to_inclusive":false,"patched_in":"1.0.3.3"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8dd7981-e681-425f-9445-f0a28c8af063","source":"wordfence","cve":"CVE-2026-10735","title":"Multiple ShapedPlugin Plugins < (Various Versions) - Backdoored Software","severity":"critical","cvss":9.8,"cwe":"CWE-506","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8dd7981-e681-425f-9445-f0a28c8af063?source=api-prod","affected":[{"type":"plugin","slug":"smart-show-post-pro","name":"Smart Post Show Pro","from":"*","from_inclusive":true,"to":"4.0.2","to_inclusive":false,"patched_in":"4.0.2"},{"type":"plugin","slug":"testimonial-pro","name":"Real Testimonials Pro","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-product-slider-pro","name":"Product Slider Pro for WooCommerce","from":"*","from_inclusive":true,"to":"3.5.4","to_inclusive":false,"patched_in":"3.5.4"}],"published":"2026-06-04T00:00:00Z","updated":"2026-06-16T13:51:00Z"},{"id":"wordfence:f8ddb7df-7f74-486d-a55f-9e2d1e91f112","source":"wordfence","cve":"CVE-2022-2535","title":"SearchWP Live Ajax Search <= 1.6.1 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ddb7df-7f74-486d-a55f-9e2d1e91f112?source=api-prod","affected":[{"type":"plugin","slug":"searchwp-live-ajax-search","name":"SearchWP Live Ajax Search","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2022-07-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8de9a0d-d199-4268-84d3-71830003b311","source":"wordfence","cve":"CVE-2025-28948","title":"Mediabay - WordPress Media Library Folders <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8de9a0d-d199-4268-84d3-71830003b311?source=api-prod","affected":[{"type":"plugin","slug":"mediabay","name":"Mediabay - WordPress Media Library Folders","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T15:31:26Z"},{"id":"wordfence:f8deef7d-d755-489d-847a-64eecb13f7a6","source":"wordfence","cve":"CVE-2026-14231","title":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8deef7d-d755-489d-847a-64eecb13f7a6?source=api-prod","affected":[{"type":"plugin","slug":"lifterlms","name":"LifterLMS \u2013 WP LMS for eLearning, Online Courses, & Quizzes","from":"*","from_inclusive":true,"to":"10.0.10","to_inclusive":false,"patched_in":"10.0.10"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:39:43Z"},{"id":"wordfence:f8e0cb68-3882-4337-ba3f-a817fe7794d2","source":"wordfence","cve":"CVE-2025-31597","title":"Ultimate Live Cricket WordPress Lite <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e0cb68-3882-4337-ba3f-a817fe7794d2?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-live-cricket-lite","name":"Ultimate Live Cricket WordPress Lite","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-31T00:00:00Z","updated":"2025-04-09T19:10:24Z"},{"id":"wordfence:f8e1aca8-3d82-4b1a-98c8-29501a377846","source":"wordfence","cve":"CVE-2024-13744","title":"Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e1aca8-3d82-4b1a-98c8-29501a377846?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"4.0.1","from_inclusive":true,"to":"7.2.4","to_inclusive":true,"patched_in":"7.2.5"}],"published":"2025-04-03T15:44:39Z","updated":"2025-04-04T04:21:23Z"},{"id":"wordfence:f8e2305f-40ce-4278-a4ea-ddbeb8806777","source":"wordfence","cve":"CVE-2025-24732","title":"BookingPress <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e2305f-40ce-4278-a4ea-ddbeb8806777?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.1.25","to_inclusive":true,"patched_in":"1.1.26"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:30:13Z"},{"id":"wordfence:f8e4df9d-ff7c-403f-abc9-0fad8d7e44d3","source":"wordfence","cve":"CVE-2025-57981","title":"WP Social Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e4df9d-ff7c-403f-abc9-0fad8d7e44d3?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-widget","name":"WP Social Widget","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:11:13Z"},{"id":"wordfence:f8e511ec-93d3-45f3-98ee-ffa7a79bf74e","source":"wordfence","cve":"CVE-2023-0600","title":"WP Visitor Statistics (Real Time Traffic) <= 6.8.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e511ec-93d3-45f3-98ee-ffa7a79bf74e?source=api-prod","affected":[{"type":"plugin","slug":"wp-stats-manager","name":"WP Visitor Statistics (Real Time Traffic)","from":"*","from_inclusive":true,"to":"6.8.1","to_inclusive":true,"patched_in":"6.9"}],"published":"2023-04-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8e6beeb-5af9-4713-bf7f-2edc1ddaa12f","source":"wordfence","cve":"CVE-2022-0402","title":"Super Forms - Drag & Drop Form Builder WordPress  <= 6.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e6beeb-5af9-4713-bf7f-2edc1ddaa12f?source=api-prod","affected":[{"type":"plugin","slug":"super-forms","name":"Super Forms \u2013 Drag & Drop Form Builder","from":"*","from_inclusive":true,"to":"6.0.3","to_inclusive":true,"patched_in":"6.0.4"}],"published":"2022-01-21T00:00:00Z","updated":"2024-02-07T13:44:01Z"},{"id":"wordfence:f8e6bfd4-9003-4ac6-96a1-0c7024b2a800","source":"wordfence","cve":"CVE-2022-4199","title":"Link Library <= 7.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e6bfd4-9003-4ac6-96a1-0c7024b2a800?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.4","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8e7587c-94bf-478d-81cc-3e7625b9b88c","source":"wordfence","cve":"CVE-2026-118423","title":"Libre Form <= 1.5.0.1 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e7587c-94bf-478d-81cc-3e7625b9b88c?source=api-prod","affected":[{"type":"plugin","slug":"wp-libre-form","name":"WP Libre Form","from":"*","from_inclusive":true,"to":"1.5.0.1","to_inclusive":true,"patched_in":""}],"published":"2026-11-03T00:00:00Z","updated":"2026-11-10T19:22:28Z"},{"id":"wordfence:f8ec4c5e-fb24-4b74-9ed8-0a9060625aba","source":"wordfence","cve":"CVE-2021-24292","title":"Happy Addons for Elementor <= 2.23.0 & Pro Version < 1.17.0 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ec4c5e-fb24-4b74-9ed8-0a9060625aba?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons-pro","name":"Happy Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"1.17.0","to_inclusive":false,"patched_in":"1.17.0"},{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"2.24.0","to_inclusive":false,"patched_in":"2.24.0"}],"published":"2021-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8ed68ab-1f25-4683-b4a3-60de785681b1","source":"wordfence","cve":"CVE-2026-65582","title":"AI Hub - Startup & Technology WordPress Theme <= 1.3.10 - Authenticated (Subscriber+) Arbitrary File Dowload","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8ed68ab-1f25-4683-b4a3-60de785681b1?source=api-prod","affected":[{"type":"theme","slug":"aihub","name":"AI Hub - Startup & Technology WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T19:56:59Z"},{"id":"wordfence:f8efd36a-e01c-4e95-b12a-d6a77c77e44d","source":"wordfence","cve":"CVE-2025-32639","title":"Affiliate Links Lite <= 3.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8efd36a-e01c-4e95-b12a-d6a77c77e44d?source=api-prod","affected":[{"type":"plugin","slug":"affiliate-links","name":"Affiliate Links \u2013 Link Cloaking and Management","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-04-10T00:00:00Z","updated":"2026-02-26T15:06:22Z"},{"id":"wordfence:f8f021ea-12fa-4f4d-bade-74a0caf5b87c","source":"wordfence","cve":"CVE-2025-15663","title":"Ultimate Before After Image Slider & Gallery \u2013 BEAF < 4.7.19 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f021ea-12fa-4f4d-bade-74a0caf5b87c?source=api-prod","affected":[{"type":"plugin","slug":"beaf-before-and-after-gallery","name":"Ultimate Before After Image Slider & Gallery \u2013 BEAF","from":"*","from_inclusive":true,"to":"4.7.19","to_inclusive":false,"patched_in":"4.7.19"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:40:44Z"},{"id":"wordfence:f8f1001e-d4e6-4681-beb2-16c4965b9007","source":"wordfence","cve":"CVE-2025-64232","title":"Import from YML <= 3.1.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f1001e-d4e6-4681-beb2-16c4965b9007?source=api-prod","affected":[{"type":"plugin","slug":"import-from-yml","name":"Import from YML","from":"*","from_inclusive":true,"to":"3.1.17","to_inclusive":true,"patched_in":"4.0.0"}],"published":"2025-04-14T00:00:00Z","updated":"2025-11-11T18:43:11Z"},{"id":"wordfence:f8f27037-5dd6-467e-b633-494f30ec8b7a","source":"wordfence","cve":"CVE-2015-7682","title":"Pie Register \u2013 User Registration Forms < 2.0.19 - Authenticated SQL Injection","severity":"medium","cvss":6.3,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f27037-5dd6-467e-b633-494f30ec8b7a?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"2.0.19","to_inclusive":false,"patched_in":"2.0.19"}],"published":"2015-10-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8f31d01-7bbc-4ef8-a099-b957f3d20118","source":"wordfence","cve":"CVE-2026-42748","title":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f31d01-7bbc-4ef8-a099-b957f3d20118?source=api-prod","affected":[{"type":"plugin","slug":"wpify-woo","name":"WPify Woo \u2013 Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce","from":"*","from_inclusive":true,"to":"5.4.1","to_inclusive":true,"patched_in":"5.4.2"}],"published":"2026-05-29T00:00:00Z","updated":"2026-06-02T11:21:47Z"},{"id":"wordfence:f8f372cb-739f-44e2-9074-e91b8c903837","source":"wordfence","cve":"CVE-2025-64265","title":"Frontend File Manager <= 23.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f372cb-739f-44e2-9074-e91b8c903837?source=api-prod","affected":[{"type":"plugin","slug":"nmedia-user-file-uploader","name":"Frontend File Manager Plugin","from":"*","from_inclusive":true,"to":"23.2","to_inclusive":true,"patched_in":"23.3"}],"published":"2025-10-30T00:00:00Z","updated":"2025-11-17T19:04:24Z"},{"id":"wordfence:f8f3ce3d-ae8a-4c0f-a74d-657225a932f1","source":"wordfence","cve":"CVE-2023-2578","title":"Buy Me a Coffee \u2013 Button and Widget Plugin <= 3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f3ce3d-ae8a-4c0f-a74d-657225a932f1?source=api-prod","affected":[{"type":"plugin","slug":"buymeacoffee","name":"Buy Me a Coffee \u2013 Button and Widget Plugin","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8f51029-0748-4943-b0ef-fc822b14614a","source":"wordfence","cve":"CVE-2025-6187","title":"bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f51029-0748-4943-b0ef-fc822b14614a?source=api-prod","affected":[{"type":"plugin","slug":"bsecure","name":"bSecure \u2013 Your Universal Checkout","from":"1.3.7","from_inclusive":true,"to":"1.7.9","to_inclusive":true,"patched_in":""}],"published":"2025-07-21T20:53:31Z","updated":"2026-04-15T17:55:20Z"},{"id":"wordfence:f8f663f6-b778-484b-8998-cfd9ffb743be","source":"wordfence","cve":"CVE-2026-57367","title":"WP Booking System \u2013 Booking Calendar Premium < 5.12.8.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f663f6-b778-484b-8998-cfd9ffb743be?source=api-prod","affected":[{"type":"plugin","slug":"wp-booking-system-premium","name":"WP Booking System \u2013 Booking Calendar Premium","from":"*","from_inclusive":true,"to":"5.12.8.1","to_inclusive":false,"patched_in":"5.12.8.1"}],"published":"2026-07-07T00:00:00Z","updated":"2026-07-16T18:34:25Z"},{"id":"wordfence:f8f743a7-75f9-4789-b0e9-7f6b2f08a94a","source":"wordfence","cve":"CVE-2026-90978","title":"Filter Gallery <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f743a7-75f9-4789-b0e9-7f6b2f08a94a?source=api-prod","affected":[{"type":"plugin","slug":"filter-gallery","name":"Filter Gallery","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T19:04:01Z"},{"id":"wordfence:f8f77fa0-5bc1-41aa-aa50-6ed5436e3c63","source":"wordfence","cve":"CVE-2024-11189","title":"Social Share And Social Locker \u2013 ARSocial <= 1.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f77fa0-5bc1-41aa-aa50-6ed5436e3c63?source=api-prod","affected":[{"type":"plugin","slug":"social-share-and-social-locker-arsocial","name":"Social Share And Social Locker \u2013 ARSocial","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2025-02-25T00:00:00Z","updated":"2025-03-03T22:04:26Z"},{"id":"wordfence:f8f7a00e-9cb4-4640-bda9-0cd7341d0c41","source":"wordfence","cve":"CVE-2021-24405","title":"Easy Cookies Policy <= 1.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f7a00e-9cb4-4640-bda9-0cd7341d0c41?source=api-prod","affected":[{"type":"plugin","slug":"easy-cookies-policy","name":"Easy Cookies Policy","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":""}],"published":"2021-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8f86293-a32f-49a6-8c8c-d37354ab040a","source":"wordfence","cve":"CVE-2023-32241","title":"Essential Addons for Elementor Pro <= 5.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f86293-a32f-49a6-8c8c-d37354ab040a?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-elementor","name":"Essential Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2023-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f8f8e436-2679-4ecb-831e-2b22dd99be32","source":"wordfence","cve":"CVE-2026-1654","title":"Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f8e436-2679-4ecb-831e-2b22dd99be32?source=api-prod","affected":[{"type":"plugin","slug":"peters-date-countdown","name":"Peter\u2019s Date Countdown","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":"2.0.1"}],"published":"2026-02-04T20:34:19Z","updated":"2026-02-05T09:13:46Z"},{"id":"wordfence:f8f92355-e664-4aeb-9094-9c8aa49cd3e7","source":"wordfence","cve":"CVE-2017-14846","title":"Mojoomla Hospital Management System for WordPress Theme < 22-05-2018 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8f92355-e664-4aeb-9094-9c8aa49cd3e7?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"08-03-2018","to_inclusive":true,"patched_in":"22-05-2018"}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9036277-6dfd-4bc4-92a6-d0204b038f6a","source":"wordfence","cve":"CVE-2026-119218","title":"Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9036277-6dfd-4bc4-92a6-d0204b038f6a?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"13.2.2","to_inclusive":true,"patched_in":"13.2.3"}],"published":"2026-11-06T13:51:34Z","updated":"2026-11-07T02:29:19Z"},{"id":"wordfence:f906ee78-e30e-40af-ae06-597a7ea73018","source":"wordfence","cve":"CVE-2024-56032","title":"FV Descriptions <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f906ee78-e30e-40af-ae06-597a7ea73018?source=api-prod","affected":[{"type":"plugin","slug":"fv-descriptions","name":"FV Descriptions","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-17T00:00:00Z","updated":"2026-01-06T18:28:44Z"},{"id":"wordfence:f908837d-2bba-45db-b005-f685a33cd71e","source":"wordfence","cve":"CVE-2022-1781","title":"postTabs <= 2.10.6 - Cross-Site Request Forgery","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f908837d-2bba-45db-b005-f685a33cd71e?source=api-prod","affected":[{"type":"plugin","slug":"posttabs","name":"postTabs","from":"*","from_inclusive":true,"to":"2.10.6","to_inclusive":true,"patched_in":""}],"published":"2022-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f90a1ad8-70ba-43a3-91a0-3845cd02b3b1","source":"wordfence","cve":"CVE-2024-49335","title":"GoogleDrive folder list <= 2.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f90a1ad8-70ba-43a3-91a0-3845cd02b3b1?source=api-prod","affected":[{"type":"plugin","slug":"googledrive-folder-list","name":"GoogleDrive folder list","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-22T18:36:37Z"},{"id":"wordfence:f90ae9a8-9210-43f6-8696-7a698d7246e6","source":"wordfence","cve":"CVE-2026-104718","title":"Elementor Website Builder \u2013 more than just a page builder < 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f90ae9a8-9210-43f6-8696-7a698d7246e6?source=api-prod","affected":[{"type":"plugin","slug":"elementor","name":"Elementor Website Builder \u2013 more than just a page builder","from":"*","from_inclusive":true,"to":"4.3.6","to_inclusive":false,"patched_in":"4.3.6"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:07:54Z"},{"id":"wordfence:f90b6cdb-d929-493e-b078-4762b7e2f76d","source":"wordfence","cve":"CVE-2021-24132","title":"Slider by 10Web <= 1.2.35 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f90b6cdb-d929-493e-b078-4762b7e2f76d?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.35","to_inclusive":true,"patched_in":"1.2.36"}],"published":"2020-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f90d50e4-7c71-4381-89af-92cdf20d7b39","source":"wordfence","cve":"CVE-2025-68546","title":"Nika <= 1.2.14 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f90d50e4-7c71-4381-89af-92cdf20d7b39?source=api-prod","affected":[{"type":"theme","slug":"nika","name":"Nika - Medical Elementor WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2025-12-23T00:00:00Z","updated":"2026-01-05T18:50:01Z"},{"id":"wordfence:f90f5f35-ed84-4284-be21-15bfaf10175f","source":"wordfence","cve":"CVE-2021-25099","title":"GiveWP <= 2.17.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f90f5f35-ed84-4284-be21-15bfaf10175f?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.17.3","to_inclusive":false,"patched_in":"2.17.3"}],"published":"2022-01-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9135799-00db-447d-b795-faafeafbce67","source":"wordfence","cve":"CVE-2026-5110","title":"Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9135799-00db-447d-b795-faafeafbce67?source=api-prod","affected":[{"type":"plugin","slug":"gravityforms","name":"Gravity Forms","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-05-01T00:00:00Z","updated":"2026-05-02T05:29:31Z"},{"id":"wordfence:f9150e6b-2233-4fdb-95b7-1a5a8c083cad","source":"wordfence","cve":"CVE-2023-23746","title":"MainWP WordPress SEO Extension <= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9150e6b-2233-4fdb-95b7-1a5a8c083cad?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-seo-extension","name":"MainWP WordPress SEO Extension","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.3"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9173644-f0b2-4de3-8e58-fd556d8e38cd","source":"wordfence","cve":"CVE-2024-12526","title":"Arena.IM \u2013 Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9173644-f0b2-4de3-8e58-fd556d8e38cd?source=api-prod","affected":[{"type":"plugin","slug":"arena-liveblog-and-chat-tool","name":"Arena.IM \u2013 Live Blogging for real-time events","from":"*","from_inclusive":true,"to":"0.4.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:30:41Z","updated":"2025-01-30T15:10:07Z"},{"id":"wordfence:f917802c-ea05-4e87-b0e5-00268c68f224","source":"wordfence","cve":"CVE-2026-39565","title":"WpTravelly <= 2.1.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f917802c-ea05-4e87-b0e5-00268c68f224?source=api-prod","affected":[{"type":"plugin","slug":"tour-booking-manager","name":"Travelly \u2013 Tour & Travel Booking Manager for WooCommerce","from":"*","from_inclusive":true,"to":"2.1.7","to_inclusive":true,"patched_in":"2.1.8"}],"published":"2026-03-21T00:00:00Z","updated":"2026-04-15T21:14:44Z"},{"id":"wordfence:f91838e7-8192-455f-ae79-a8c7e7cc06e3","source":"wordfence","cve":"","title":"Captcha < 4.3.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f91838e7-8192-455f-ae79-a8c7e7cc06e3?source=api-prod","affected":[{"type":"plugin","slug":"captcha","name":"Captcha","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":false,"patched_in":"4.3.0"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f918c749-8c3d-4436-9a84-b040e4a2f8ed","source":"wordfence","cve":"CVE-2018-10969","title":"Pie Register <= 3.0.9 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f918c749-8c3d-4436-9a84-b040e4a2f8ed?source=api-prod","affected":[{"type":"plugin","slug":"pie-register","name":"Pie Register \u2013 User Registration, Profiles & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.10"}],"published":"2018-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9190d35-c9e7-4190-8e66-f6066fe66af8","source":"wordfence","cve":"CVE-2025-10700","title":"Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=api-prod","affected":[{"type":"plugin","slug":"pojo-accessibility","name":"Web Accessibility (formally known as Ally) \u2013 WCAG Scanning, Guided Fixes, Usability Widget","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2025-10-15T14:08:58Z","updated":"2025-10-16T02:25:10Z"},{"id":"wordfence:f91d6ad6-82fc-4507-90e2-aedfff26bac5","source":"wordfence","cve":"CVE-2024-4552","title":"Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f91d6ad6-82fc-4507-90e2-aedfff26bac5?source=api-prod","affected":[{"type":"plugin","slug":"social-login-lite-for-woocommerce","name":"Social Login Lite For WooCommerce","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-04T02:00:56Z"},{"id":"wordfence:f91ed211-9703-44fb-a2f8-8d8da910b4c7","source":"wordfence","cve":"CVE-2026-1055","title":"TalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f91ed211-9703-44fb-a2f8-8d8da910b4c7?source=api-prod","affected":[{"type":"plugin","slug":"talkjs","name":"TalkJS","from":"*","from_inclusive":true,"to":"0.1.15","to_inclusive":true,"patched_in":"0.1.16"}],"published":"2026-02-18T15:58:50Z","updated":"2026-02-25T14:27:53Z"},{"id":"wordfence:f920d63e-2101-4192-8916-be2d42929a54","source":"wordfence","cve":"CVE-2025-53195","title":"JetEngine <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f920d63e-2101-4192-8916-be2d42929a54?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1.1"}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-02T19:51:27Z"},{"id":"wordfence:f922ea86-5876-40ce-82ee-fb2b6dbddf17","source":"wordfence","cve":"CVE-2021-24345","title":"Sendit WP Newsletter <= 2.5.1 - Authenticated (Admin+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f922ea86-5876-40ce-82ee-fb2b6dbddf17?source=api-prod","affected":[{"type":"plugin","slug":"sendit","name":"Sendit WP Newsletter","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":""}],"published":"2021-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f923cf4a-a908-464b-b1c1-b0234fdc1d68","source":"wordfence","cve":"CVE-2025-48150","title":"Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin <= 4.48 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f923cf4a-a908-464b-b1c1-b0234fdc1d68?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-right-now","name":"Real Estate Property 2025 Create Your Own Fields and Search Bar","from":"*","from_inclusive":true,"to":"4.48","to_inclusive":true,"patched_in":"4.49"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-21T21:07:46Z"},{"id":"wordfence:f925833e-06d6-4175-8dca-5cb7baec9364","source":"wordfence","cve":"CVE-2024-38721","title":"EazyDocs <= 2.5.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f925833e-06d6-4175-8dca-5cb7baec9364?source=api-prod","affected":[{"type":"plugin","slug":"eazydocs","name":"EazyDocs \u2013 AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-01T19:51:01Z"},{"id":"wordfence:f9259875-c63f-48ed-a3c8-4d6d0ffe8004","source":"wordfence","cve":"CVE-2014-4528","title":"Bugs Go Viral : Facebook Promotion Generator <= 1.3.4 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9259875-c63f-48ed-a3c8-4d6d0ffe8004?source=api-prod","affected":[{"type":"plugin","slug":"fbpromotions","name":"Bugs Go Viral : Facebook Promotion Generator","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2014-05-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f926728d-2752-4aa4-b1d7-5805e3b256c9","source":"wordfence","cve":"CVE-2025-67539","title":"Select Core < 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f926728d-2752-4aa4-b1d7-5805e3b256c9?source=api-prod","affected":[{"type":"plugin","slug":"select-core","name":"Select Core","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":false,"patched_in":"2.6"}],"published":"2025-11-14T00:00:00Z","updated":"2025-12-11T16:45:26Z"},{"id":"wordfence:f92784a7-f2b3-47f8-b03f-4e234b57e40a","source":"wordfence","cve":"CVE-2015-10133","title":"Subscribe to Comments <= 2.1.2 - Local File Includion","severity":"high","cvss":7.2,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f92784a7-f2b3-47f8-b03f-4e234b57e40a?source=api-prod","affected":[{"type":"plugin","slug":"subscribe-to-comments","name":"Subscribe to Comments","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2015-07-15T00:00:00Z","updated":"2025-07-19T09:23:53Z"},{"id":"wordfence:f928d3e0-b9ac-43bb-9e54-5a6bae2a3cb4","source":"wordfence","cve":"CVE-2025-54043","title":"SMTP for Amazon SES <= 1.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f928d3e0-b9ac-43bb-9e54-5a6bae2a3cb4?source=api-prod","affected":[{"type":"plugin","slug":"smtp-amazon-ses","name":"SMTP for Amazon SES \u2013 YaySMTP","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:55:07Z"},{"id":"wordfence:f92f614b-162a-4ca5-bf7d-9d7088f59af9","source":"wordfence","cve":"CVE-2023-44237","title":"WP Site Protector <= 2.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f92f614b-162a-4ca5-bf7d-9d7088f59af9?source=api-prod","affected":[{"type":"plugin","slug":"wp-site-protector","name":"WP Site Protector","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f931cf8e-01dd-4f0b-ac86-6e0654fd1597","source":"wordfence","cve":"CVE-2024-3926","title":"Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f931cf8e-01dd-4f0b-ac86-6e0654fd1597?source=api-prod","affected":[{"type":"plugin","slug":"bdthemes-element-pack-lite","name":"Element Pack Addons for Elementor \u2013 MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons","from":"*","from_inclusive":true,"to":"5.6.1","to_inclusive":true,"patched_in":"5.6.2"}],"published":"2024-05-21T00:00:00Z","updated":"2024-05-22T14:32:39Z"},{"id":"wordfence:f93252f2-a373-4614-b006-9f8ff30882a6","source":"wordfence","cve":"CVE-2026-114182","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93252f2-a373-4614-b006-9f8ff30882a6?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-10-22T06:53:00Z","updated":"2026-10-23T18:54:37Z"},{"id":"wordfence:f932e3ea-3d82-47af-924a-b2df15641611","source":"wordfence","cve":"CVE-2023-23639","title":"MainWP Staging Extension <= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f932e3ea-3d82-47af-924a-b2df15641611?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-staging-extension","name":"MainWP Staging Extension","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":"4.0.4"}],"published":"2023-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9331d7b-da7d-4dda-8d34-6e5cade5e67e","source":"wordfence","cve":"CVE-2026-105318","title":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9331d7b-da7d-4dda-8d34-6e5cade5e67e?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"11.1.0","to_inclusive":true,"patched_in":"11.1.1"}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:41:21Z"},{"id":"wordfence:f9337519-0b33-43fa-9be4-2390b8b3afb9","source":"wordfence","cve":"CVE-2022-41791","title":"ProfileGrid <= 5.1.7 - Authenticated (Subscriber+) CSV Injection","severity":"medium","cvss":6.3,"cwe":"CWE-74","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9337519-0b33-43fa-9be4-2390b8b3afb9?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"5.1.7","to_inclusive":true,"patched_in":"5.1.8"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f938571b-4fdb-45d4-a8a6-f4aedcc1cfd7","source":"wordfence","cve":"CVE-2025-46515","title":"Category Widget <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f938571b-4fdb-45d4-a8a6-f4aedcc1cfd7?source=api-prod","affected":[{"type":"plugin","slug":"category-widget","name":"Category Widget","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-05T18:18:08Z"},{"id":"wordfence:f938a446-ae0b-4e06-9d55-26e2fea4d1e8","source":"wordfence","cve":"CVE-2021-24520","title":"Stock in & out <= 1.0.4 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f938a446-ae0b-4e06-9d55-26e2fea4d1e8?source=api-prod","affected":[{"type":"plugin","slug":"stock-in","name":"Stock in & out","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2021-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f93aa003-5b8b-4836-af65-80df2f9fbdb6","source":"wordfence","cve":"CVE-2023-7083","title":"Voting Record <= 2.0 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93aa003-5b8b-4836-af65-80df2f9fbdb6?source=api-prod","affected":[{"type":"plugin","slug":"voting-record","name":"Voting Record","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f93cdc4b-7ac3-428c-816e-d3b6499e6c8c","source":"wordfence","cve":"CVE-2025-59004","title":"WC Return products <= 1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93cdc4b-7ac3-428c-816e-d3b6499e6c8c?source=api-prod","affected":[{"type":"plugin","slug":"wc-return-product","name":"WC Return products","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-09-08T00:00:00Z","updated":"2025-10-29T21:06:29Z"},{"id":"wordfence:f93d70e4-01c5-44e8-b7d5-0837bee53b8d","source":"wordfence","cve":"CVE-2026-9629","title":"Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93d70e4-01c5-44e8-b7d5-0837bee53b8d?source=api-prod","affected":[{"type":"plugin","slug":"canvas","name":"Canvas","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2026-06-12T19:04:54Z","updated":"2026-06-13T07:51:23Z"},{"id":"wordfence:f93dcb51-1caf-4d63-a8f3-f6251dd0d19f","source":"wordfence","cve":"CVE-2025-0864","title":"Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93dcb51-1caf-4d63-a8f3-f6251dd0d19f?source=api-prod","affected":[{"type":"plugin","slug":"profit-products-tables-for-woocommerce","name":"Active Woot Products Tables for WooCommerce. 100% FREE\u00a0","from":"*","from_inclusive":true,"to":"1.0.6.6","to_inclusive":true,"patched_in":"1.0.6.7"}],"published":"2025-02-17T19:21:09Z","updated":"2025-02-18T07:28:15Z"},{"id":"wordfence:f93e32b5-7c5d-42b9-bb4f-9a7a99793558","source":"wordfence","cve":"CVE-2025-30574","title":"Mobile Navigation <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f93e32b5-7c5d-42b9-bb4f-9a7a99793558?source=api-prod","affected":[{"type":"plugin","slug":"mobile-navigation","name":"Mobile Navigation","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:54:04Z"},{"id":"wordfence:f9429c04-a1f8-42c4-bc43-df0a96aa5a6d","source":"wordfence","cve":"CVE-2024-38345","title":"Super Testimonials <= 3.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9429c04-a1f8-42c4-bc43-df0a96aa5a6d?source=api-prod","affected":[{"type":"plugin","slug":"sola-testimonials","name":"Super Testimonials","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-06-26T00:00:00Z","updated":"2024-07-23T19:15:20Z"},{"id":"wordfence:f9445f27-9786-4c3d-b11c-ada8ecfa0d35","source":"wordfence","cve":"CVE-2026-105065","title":"XStore < 9.7.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9445f27-9786-4c3d-b11c-ada8ecfa0d35?source=api-prod","affected":[{"type":"theme","slug":"xstore","name":"XStore","from":"*","from_inclusive":true,"to":"9.7.9","to_inclusive":false,"patched_in":"9.7.9"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-23T19:26:55Z"},{"id":"wordfence:f9454765-f70b-4d8d-a5cc-28bc34375216","source":"wordfence","cve":"CVE-2024-31369","title":"Soledad <= 8.4.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9454765-f70b-4d8d-a5cc-28bc34375216?source=api-prod","affected":[{"type":"theme","slug":"soledad","name":"Soledad","from":"*","from_inclusive":true,"to":"8.4.5","to_inclusive":true,"patched_in":"8.4.6"}],"published":"2024-04-09T00:00:00Z","updated":"2024-04-11T14:56:51Z"},{"id":"wordfence:f946c5b9-a227-47bd-bae2-decbb5748436","source":"wordfence","cve":"CVE-2026-32542","title":"Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f946c5b9-a227-47bd-bae2-decbb5748436?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.0","to_inclusive":false,"patched_in":"3.15.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:43:19Z"},{"id":"wordfence:f9478d3e-d2f9-458b-a6ca-3baef21db60e","source":"wordfence","cve":"CVE-2022-45082","title":"Accordions \u2013 Multiple Accordions or FAQs Builder <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via 'license' parameter","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9478d3e-d2f9-458b-a6ca-3baef21db60e?source=api-prod","affected":[{"type":"plugin","slug":"accordions-or-faqs","name":"Accordion \u2013 Multiple Accordion or FAQs Builder","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2022-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f94a1671-11f8-4a05-b950-a068edf29f43","source":"wordfence","cve":"CVE-2024-43318","title":"e2pdf <= 1.25.05 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f94a1671-11f8-4a05-b950-a068edf29f43?source=api-prod","affected":[{"type":"plugin","slug":"e2pdf","name":"E2Pdf \u2013 Export Pdf Tool for WordPress","from":"*","from_inclusive":true,"to":"1.25.05","to_inclusive":true,"patched_in":"1.25.11"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T12:53:22Z"},{"id":"wordfence:f94eabc5-6e3b-46df-9e36-d7d0fad833de","source":"wordfence","cve":"CVE-2023-0619","title":"Kraken.io Image Optimizer <= 2.6.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f94eabc5-6e3b-46df-9e36-d7d0fad833de?source=api-prod","affected":[{"type":"plugin","slug":"kraken-image-optimizer","name":"Kraken.io Image Optimizer \u2013 Compress, Convert to WebP & AVIF, Resize & Bulk Optimize","from":"*","from_inclusive":true,"to":"2.6.9","to_inclusive":true,"patched_in":"2.7.0"}],"published":"2023-02-01T00:00:00Z","updated":"2026-04-15T15:08:27Z"},{"id":"wordfence:f9566fdd-c4ad-4971-b23b-bcf76c8b5cef","source":"wordfence","cve":"CVE-2026-1833","title":"WaMate Confirm <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=api-prod","affected":[{"type":"plugin","slug":"wamate-confirm","name":"WaMate Confirm \u2013 Order Confirmation","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-02-10T20:04:10Z","updated":"2026-07-10T16:32:46Z"},{"id":"wordfence:f9575875-0f0f-4069-87d1-9ed573a7c3d7","source":"wordfence","cve":"CVE-2025-47688","title":"Advanced File Manager <= 5.3.1 - Missing Authorization to Notice Dismisaal","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9575875-0f0f-4069-87d1-9ed573a7c3d7?source=api-prod","affected":[{"type":"plugin","slug":"file-manager-advanced","name":"Advanced File Manager \u2013 Ultimate File Manager for WordPress And Document Library Solution","from":"*","from_inclusive":true,"to":"5.3.1","to_inclusive":true,"patched_in":"5.3.2"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-14T14:27:46Z"},{"id":"wordfence:f958ed28-0520-47c7-9b60-94e7c6504d20","source":"wordfence","cve":"CVE-2015-9525","title":"Easy Digital Downloads \u2013 Recurring Payments <= 2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f958ed28-0520-47c7-9b60-94e7c6504d20?source=api-prod","affected":[{"type":"plugin","slug":"edd-recurring-payments","name":"Easy Digital Downloads - Recurring Payments","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f959289c-ad24-4768-b62d-a9f35a84ea93","source":"wordfence","cve":"CVE-2025-47442","title":"CC BMI Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f959289c-ad24-4768-b62d-a9f35a84ea93?source=api-prod","affected":[{"type":"plugin","slug":"cc-bmi-calculator","name":"CC BMI Calculator","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:06:35Z"},{"id":"wordfence:f95cc10f-bb75-4508-ae08-8d3bf2225590","source":"wordfence","cve":"CVE-2026-112836","title":"VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f95cc10f-bb75-4508-ae08-8d3bf2225590?source=api-prod","affected":[{"type":"plugin","slug":"vikrentcar","name":"VikRentCar Car Rental Management System","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":true,"patched_in":"1.4.9"}],"published":"2026-10-20T15:09:00Z","updated":"2026-10-23T18:52:33Z"},{"id":"wordfence:f9611732-67aa-4940-8df1-c0ed7baad985","source":"wordfence","cve":"CVE-2022-2362","title":"Download Manager <= 3.2.49 - IP Blocking Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-290","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9611732-67aa-4940-8df1-c0ed7baad985?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.49","to_inclusive":true,"patched_in":"3.2.50"}],"published":"2022-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9613d32-719c-409a-b1ea-345c341ff39c","source":"wordfence","cve":"CVE-2026-76550","title":"Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9613d32-719c-409a-b1ea-345c341ff39c?source=api-prod","affected":[{"type":"plugin","slug":"wp-import-export-lite","name":"WP Import Export Lite","from":"*","from_inclusive":true,"to":"3.9.33","to_inclusive":true,"patched_in":"3.9.34"}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-22T19:24:14Z"},{"id":"wordfence:f9624f16-5e18-4093-ba3a-bee228b2895d","source":"wordfence","cve":"CVE-2025-26883","title":"Animated Text Block <= 1.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9624f16-5e18-4093-ba3a-bee228b2895d?source=api-prod","affected":[{"type":"plugin","slug":"animated-text-block","name":"Animated Text Block \u2013 Add Typing and Looping Text Effects","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:15:05Z"},{"id":"wordfence:f962a3ef-205d-42e2-acf1-45eabfdba3ee","source":"wordfence","cve":"","title":"Local Development <=2.8.2 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f962a3ef-205d-42e2-acf1-45eabfdba3ee?source=api-prod","affected":[{"type":"plugin","slug":"local-development","name":"Local Development","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2023-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f962bfb4-bb5e-4069-a1a4-7e28335780e6","source":"wordfence","cve":"CVE-2024-52353","title":"Christian Science Bible Lesson Subjects <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f962bfb4-bb5e-4069-a1a4-7e28335780e6?source=api-prod","affected":[{"type":"plugin","slug":"christian-science-bible-lesson-subjects","name":"Christian Science Bible Lesson Subjects","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-13T21:52:54Z"},{"id":"wordfence:f9660aee-1069-4197-b166-12ea30f8fd0c","source":"wordfence","cve":"CVE-2024-11457","title":"Feedpress Generator \u2013 External RSS Frontend Customizer <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9660aee-1069-4197-b166-12ea30f8fd0c?source=api-prod","affected":[{"type":"plugin","slug":"feedpress-generator","name":"Feedpress Generator \u2013 External RSS Frontend Customizer","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-06T21:29:02Z","updated":"2024-12-07T11:09:54Z"},{"id":"wordfence:f9661fa8-1c69-433b-8e18-039000e7d6e7","source":"wordfence","cve":"CVE-2025-48133","title":"Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin  <= 6.4.0.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9661fa8-1c69-433b-8e18-039000e7d6e7?source=api-prod","affected":[{"type":"plugin","slug":"uncanny-automator","name":"Uncanny Automator \u2013 MCP Server + Automation MCP for Claude & ChatGPT","from":"*","from_inclusive":true,"to":"6.4.0.2","to_inclusive":true,"patched_in":"6.5.0"}],"published":"2025-06-02T00:00:00Z","updated":"2025-06-06T13:58:06Z"},{"id":"wordfence:f9691ccf-269e-4154-b524-8587644fde24","source":"wordfence","cve":"CVE-2026-17020","title":"Salon Booking System \u2013 Free Version < 10.31.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Booking PII Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9691ccf-269e-4154-b524-8587644fde24?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.31.3","to_inclusive":false,"patched_in":"10.31.3"}],"published":"2026-08-06T00:00:00Z","updated":"2026-09-23T14:29:57Z"},{"id":"wordfence:f969cb24-734f-46e5-a74d-fddf8e61e096","source":"wordfence","cve":"CVE-2023-7071","title":"Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f969cb24-734f-46e5-a74d-fddf8e61e096?source=api-prod","affected":[{"type":"plugin","slug":"essential-blocks","name":"Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns","from":"*","from_inclusive":true,"to":"4.4.6","to_inclusive":true,"patched_in":"4.4.7"}],"published":"2024-01-09T00:00:00Z","updated":"2024-07-29T21:37:50Z"},{"id":"wordfence:f96b23e5-b5f3-4e54-8955-b499648b5675","source":"wordfence","cve":"CVE-2024-51794","title":"Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f96b23e5-b5f3-4e54-8955-b499648b5675?source=api-prod","affected":[{"type":"theme","slug":"storely","name":"Storely","from":"*","from_inclusive":true,"to":"18","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2025-03-18T18:41:15Z"},{"id":"wordfence:f96d3773-29a1-44bd-904a-905aff2b345e","source":"wordfence","cve":"CVE-2024-13909","title":"Accredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f96d3773-29a1-44bd-904a-905aff2b345e?source=api-prod","affected":[{"type":"plugin","slug":"accredible-certificates","name":"Accredible Certificates & Open Badges","from":"*","from_inclusive":true,"to":"1.4.9","to_inclusive":true,"patched_in":"1.5.0"}],"published":"2025-04-09T18:13:10Z","updated":"2025-05-23T13:32:53Z"},{"id":"wordfence:f96d5694-b70a-46a5-b493-cfcb5ab93247","source":"wordfence","cve":"CVE-2024-52459","title":"Chameleoni Jobs <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f96d5694-b70a-46a5-b493-cfcb5ab93247?source=api-prod","affected":[{"type":"plugin","slug":"chameleon-jobs","name":"Chameleoni Jobs","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":"2.5.5"}],"published":"2024-11-18T00:00:00Z","updated":"2025-04-10T15:13:46Z"},{"id":"wordfence:f96d99dc-df3a-4b01-b276-08a85860720e","source":"wordfence","cve":"CVE-2026-32573","title":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 - Authenticated (Editor+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f96d99dc-df3a-4b01-b276-08a85860720e?source=api-prod","affected":[{"type":"plugin","slug":"nelio-ab-testing","name":"Nelio A/B Testing \u2013 AB Tests and Heatmaps for Better Conversion Optimization","from":"*","from_inclusive":true,"to":"8.2.7","to_inclusive":true,"patched_in":"8.2.8"}],"published":"2026-03-23T00:00:00Z","updated":"2026-04-02T15:04:12Z"},{"id":"wordfence:f96eb21c-7682-47e3-bd3a-37482d1bd37f","source":"wordfence","cve":"CVE-2021-25048","title":"Page Builder KingComposer <= 2.9.6 - Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting","severity":"high","cvss":8.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f96eb21c-7682-47e3-bd3a-37482d1bd37f?source=api-prod","affected":[{"type":"plugin","slug":"kingcomposer","name":"Page Builder: KingComposer \u2013 Free Drag and Drop page builder by King-Theme","from":"*","from_inclusive":true,"to":"2.9.6","to_inclusive":true,"patched_in":""}],"published":"2022-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f970ce63-da48-44ad-935c-e75f9791103c","source":"wordfence","cve":"CVE-2025-32284","title":"Pet World <= 2.8 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f970ce63-da48-44ad-935c-e75f9791103c?source=api-prod","affected":[{"type":"theme","slug":"petsworld","name":"Pet World - Dog Care & Pet Shop WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2025-05-21T00:00:00Z","updated":"2025-05-29T15:47:58Z"},{"id":"wordfence:f972ab72-8e68-4ab3-aa7f-e2816de33554","source":"wordfence","cve":"CVE-2024-5686","title":"WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f972ab72-8e68-4ab3-aa7f-e2816de33554?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-elementor-addons","name":"WPZOOM Addons for Elementor \u2013 Starter Templates & Widgets","from":"*","from_inclusive":true,"to":"1.1.38","to_inclusive":true,"patched_in":"1.1.39"}],"published":"2024-06-19T14:14:36Z","updated":"2024-06-20T03:37:24Z"},{"id":"wordfence:f97414f7-3544-4ecf-908a-a0215e322e68","source":"wordfence","cve":"CVE-2025-62032","title":"tagDiv Cloud Library < 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f97414f7-3544-4ecf-908a-a0215e322e68?source=api-prod","affected":[{"type":"plugin","slug":"td-cloud-library","name":"tagDiv Cloud Library","from":"*","from_inclusive":true,"to":"3.9.2","to_inclusive":false,"patched_in":"3.9.2"}],"published":"2025-10-16T00:00:00Z","updated":"2025-11-12T14:43:10Z"},{"id":"wordfence:f976f8d6-018e-4a96-b2b3-a18a729e0023","source":"wordfence","cve":"CVE-2026-80437","title":"Ninja Forms \u2013 The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f976f8d6-018e-4a96-b2b3-a18a729e0023?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"3.14.10","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-09-04T00:00:00Z","updated":"2026-09-09T13:49:33Z"},{"id":"wordfence:f979e58a-9520-4b6b-82ee-421380552593","source":"wordfence","cve":"CVE-2025-60109","title":"LambertGroup - AllInOne - Content Slider <= 3.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f979e58a-9520-4b6b-82ee-421380552593?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-contentSlider","name":"LambertGroup - AllInOne - Content Slider","from":"*","from_inclusive":true,"to":"3.8","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-29T21:21:41Z"},{"id":"wordfence:f97c669b-86c1-4873-a050-76972f494099","source":"wordfence","cve":"CVE-2026-7567","title":"Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f97c669b-86c1-4873-a050-76972f494099?source=api-prod","affected":[{"type":"plugin","slug":"temporary-login","name":"Temporary Login","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2026-04-30T20:59:11Z","updated":"2026-05-01T09:26:06Z"},{"id":"wordfence:f97ced40-c349-43b4-963f-2a49db4bbd4a","source":"wordfence","cve":"CVE-2025-12112","title":"Insert Headers and Footers Code \u2013 HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f97ced40-c349-43b4-963f-2a49db4bbd4a?source=api-prod","affected":[{"type":"plugin","slug":"insert-headers-and-footers-script","name":"Insert Headers and Footers Code \u2013 HT Script","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":"1.1.7"}],"published":"2025-11-07T14:55:13Z","updated":"2025-11-08T03:27:53Z"},{"id":"wordfence:f97d97fd-5eac-4fdb-b65a-4c42c3005a2e","source":"wordfence","cve":"CVE-2022-1506","title":"//// WP BORN BABIES PLUGIN /// <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f97d97fd-5eac-4fdb-b65a-4c42c3005a2e?source=api-prod","affected":[{"type":"plugin","slug":"wp-born-babies","name":"//// WP BORN BABIES PLUGIN ///","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f980e902-820b-43e0-8334-fc70c711a126","source":"wordfence","cve":"CVE-2015-9473","title":"estrutura-basica (All Known Versions) - Path Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f980e902-820b-43e0-8334-fc70c711a126?source=api-prod","affected":[{"type":"theme","slug":"estrutura-basica","name":"estrutura-basica","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2015-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9844b47-427a-4f2f-9f42-00adcbcf133c","source":"wordfence","cve":"CVE-2023-32519","title":"WCP Contact Form <= 3.1.0 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9844b47-427a-4f2f-9f42-00adcbcf133c?source=api-prod","affected":[{"type":"plugin","slug":"wcp-contact-form","name":"WCP Contact Form","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f989558e-8ba5-4c8e-b099-e919ebe966ac","source":"wordfence","cve":"CVE-2025-49910","title":"WPGuppy <= 1.1.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f989558e-8ba5-4c8e-b099-e919ebe966ac?source=api-prod","affected":[{"type":"plugin","slug":"wpguppy-lite","name":"One to one user Chat by WPGuppy","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-08-14T00:00:00Z","updated":"2025-11-04T16:03:05Z"},{"id":"wordfence:f98aab54-877b-47df-9c8a-5e70ea985c1c","source":"wordfence","cve":"CVE-2025-3915","title":"Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98aab54-877b-47df-9c8a-5e70ea985c1c?source=api-prod","affected":[{"type":"plugin","slug":"aeropage-sync-for-airtable","name":"Aeropage Sync for Airtable","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.3.0"}],"published":"2025-04-25T00:00:00Z","updated":"2025-04-26T05:34:25Z"},{"id":"wordfence:f98aad51-a08e-4eea-84f7-345f2442081a","source":"wordfence","cve":"CVE-2025-58617","title":"F4 Media Taxonomies <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98aad51-a08e-4eea-84f7-345f2442081a?source=api-prod","affected":[{"type":"plugin","slug":"f4-media-taxonomies","name":"F4 Media Taxonomies","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2025-09-03T00:00:00Z","updated":"2025-09-09T19:34:45Z"},{"id":"wordfence:f98acfe6-b012-47c6-b47e-66a4304d3501","source":"wordfence","cve":"CVE-2026-18230","title":"Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98acfe6-b012-47c6-b47e-66a4304d3501?source=api-prod","affected":[{"type":"plugin","slug":"wpdirectorykit","name":"WP Directory Kit","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2026-08-10T00:00:00Z","updated":"2026-08-15T21:54:55Z"},{"id":"wordfence:f98b848c-9f97-4d00-97de-7651b9035731","source":"wordfence","cve":"CVE-2025-10165","title":"AP Background <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98b848c-9f97-4d00-97de-7651b9035731?source=api-prod","affected":[{"type":"plugin","slug":"ap-background","name":"AP Background","from":"*","from_inclusive":true,"to":"3.8.2","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T21:28:49Z","updated":"2025-10-03T11:17:23Z"},{"id":"wordfence:f98bb2a2-6525-4e0b-8bbd-968cf5b122dc","source":"wordfence","cve":"CVE-2023-22678","title":"Superior FAQ <= 1.0.2 - Cross Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98bb2a2-6525-4e0b-8bbd-968cf5b122dc?source=api-prod","affected":[{"type":"plugin","slug":"superior-faq","name":"Superior FAQ","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2023-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f98f11da-b0ae-4c00-9708-88d6044abda2","source":"wordfence","cve":"CVE-2024-11884","title":"Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f98f11da-b0ae-4c00-9708-88d6044abda2?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-text-slider-50","name":"Wp photo text slider 50","from":"*","from_inclusive":true,"to":"8.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-13T15:58:21Z","updated":"2024-12-14T04:23:48Z"},{"id":"wordfence:f9900533-0724-445f-9d56-8a0422479448","source":"wordfence","cve":"CVE-2017-18556","title":"Analytics <= 1.7.0 -  Multiple Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9900533-0724-445f-9d56-8a0422479448?source=api-prod","affected":[{"type":"plugin","slug":"bws-google-analytics","name":"Analytics by BestWebSoft \u2013 Google Analytics Dashboard and Statistic Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2017-04-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f99192a3-7ca1-4a19-aa9c-f2fc04fd2d1f","source":"wordfence","cve":"CVE-2024-53708","title":"AI Quiz <= 1.1 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99192a3-7ca1-4a19-aa9c-f2fc04fd2d1f?source=api-prod","affected":[{"type":"plugin","slug":"ai-quiz","name":"AI Quiz | Quiz Maker","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-26T18:36:31Z"},{"id":"wordfence:f9927487-99fb-46d9-a208-f19e0a371267","source":"wordfence","cve":"CVE-2026-3352","title":"Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9927487-99fb-46d9-a208-f19e0a371267?source=api-prod","affected":[{"type":"plugin","slug":"easy-php-settings","name":"Easy PHP Settings","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2026-03-06T11:26:38Z","updated":"2026-03-07T01:21:24Z"},{"id":"wordfence:f99622df-0bf3-4252-8bd3-f84c61fcd39a","source":"wordfence","cve":"CVE-2025-12125","title":"HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99622df-0bf3-4252-8bd3-f84c61fcd39a?source=api-prod","affected":[{"type":"plugin","slug":"html-forms","name":"HTML Forms \u2013 Simple WordPress Forms Plugin","from":"*","from_inclusive":true,"to":"1.5.5","to_inclusive":true,"patched_in":"1.5.6"}],"published":"2025-11-07T00:00:00Z","updated":"2025-11-08T03:27:53Z"},{"id":"wordfence:f9989f22-d5a0-453a-86e8-dc45c7cdd5dd","source":"wordfence","cve":"CVE-2022-40218","title":"TH Advance Product Search <= 1.1.4 - Missing Authorization to Plugin Settings Change","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9989f22-d5a0-453a-86e8-dc45c7cdd5dd?source=api-prod","affected":[{"type":"plugin","slug":"th-advance-product-search","name":"Advance Product Search- Voice & Ajax Search for WooCommerce","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2022-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9998485-e272-48fc-b2f1-9e30158d0d16","source":"wordfence","cve":"CVE-2023-5817","title":"Neon text <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9998485-e272-48fc-b2f1-9e30158d0d16?source=api-prod","affected":[{"type":"plugin","slug":"neon-text","name":"Neon text","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f99a6b5c-e95d-49d0-a4b2-1d7188447da1","source":"wordfence","cve":"CVE-2025-11521","title":"Astra Security Suite \u2013 Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload","severity":"high","cvss":8.1,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99a6b5c-e95d-49d0-a4b2-1d7188447da1?source=api-prod","affected":[{"type":"plugin","slug":"getastra","name":"Astra Security Suite \u2013 Firewall & Malware Scan","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:11:11Z","updated":"2025-11-11T03:30:52Z"},{"id":"wordfence:f99a918d-53c1-46bd-8e55-9ba77a92efe8","source":"wordfence","cve":"CVE-2025-1123","title":"Solid Mail \u2013 SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99a918d-53c1-46bd-8e55-9ba77a92efe8?source=api-prod","affected":[{"type":"plugin","slug":"wp-smtp","name":"Solid Mail \u2013 SMTP email and logging made by SolidWP","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2025-05-22T23:53:52Z","updated":"2025-05-23T12:22:56Z"},{"id":"wordfence:f99b7b42-cebf-4382-834e-9d96d87f395e","source":"wordfence","cve":"CVE-2025-23992","title":"Toocheke Companion <= 1.166 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99b7b42-cebf-4382-834e-9d96d87f395e?source=api-prod","affected":[{"type":"plugin","slug":"toocheke-companion","name":"Toocheke Companion","from":"*","from_inclusive":true,"to":"1.166","to_inclusive":true,"patched_in":"1.167"}],"published":"2025-01-22T00:00:00Z","updated":"2025-02-17T16:38:42Z"},{"id":"wordfence:f99e62eb-5adb-40b8-87bd-ccec1e0fb80e","source":"wordfence","cve":"CVE-2026-10821","title":"Yoast SEO Premium <= 27.6.0 - Authenticated (Author+) Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99e62eb-5adb-40b8-87bd-ccec1e0fb80e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo-premium","name":"Yoast SEO Premium","from":"*","from_inclusive":true,"to":"27.6.0","to_inclusive":true,"patched_in":"27.6.1"}],"published":"2026-06-04T00:00:00Z","updated":"2026-09-16T15:07:31Z"},{"id":"wordfence:f99e9f01-cc98-4af5-bb95-f56f6a550e96","source":"wordfence","cve":"CVE-2023-4960","title":"WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f99e9f01-cc98-4af5-bb95-f56f6a550e96?source=api-prod","affected":[{"type":"plugin","slug":"wc-multivendor-marketplace","name":"WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce","from":"*","from_inclusive":true,"to":"3.6.2","to_inclusive":true,"patched_in":"3.6.3"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9a1e8b8-5c04-44a7-933b-5c1106d5abac","source":"wordfence","cve":"CVE-2025-39525","title":"Logo Carousel Slider <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a1e8b8-5c04-44a7-933b-5c1106d5abac?source=api-prod","affected":[{"type":"plugin","slug":"logo-carousel-slider","name":"Logo Carousel Slider","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:30:21Z"},{"id":"wordfence:f9a24526-9f37-498e-b125-df4a0d23d2db","source":"wordfence","cve":"CVE-2025-24566","title":"Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a24526-9f37-498e-b125-df4a0d23d2db?source=api-prod","affected":[{"type":"plugin","slug":"dp-intro-tours","name":"Intro Tour Tutorial DeepPresentation","from":"*","from_inclusive":true,"to":"6.5.2","to_inclusive":true,"patched_in":"6.5.3"}],"published":"2024-11-30T00:00:00Z","updated":"2026-04-15T20:38:23Z"},{"id":"wordfence:f9a2d45c-397f-4a2b-9d7f-760b7d561c2a","source":"wordfence","cve":"CVE-2014-7153","title":"Image Gallery - Responsive Photo Gallery <= 1.0.7 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a2d45c-397f-4a2b-9d7f-760b7d561c2a?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2014-09-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9a3dc87-5309-41fe-bfc3-60b5878b6c57","source":"wordfence","cve":"CVE-2024-1650","title":"Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a3dc87-5309-41fe-bfc3-60b5878b6c57?source=api-prod","affected":[{"type":"plugin","slug":"categorify","name":"Categorify \u2013 WordPress Media Library Category & File Manager","from":"*","from_inclusive":true,"to":"1.0.7.4","to_inclusive":true,"patched_in":"1.0.7.5"}],"published":"2024-02-26T00:00:00Z","updated":"2024-07-29T22:56:36Z"},{"id":"wordfence:f9a60c4e-a524-4a99-858a-14787f37d60c","source":"wordfence","cve":"CVE-2023-32239","title":"WoodMart <= 7.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9a60c4e-a524-4a99-858a-14787f37d60c?source=api-prod","affected":[{"type":"theme","slug":"woodmart","name":"Woodmart","from":"*","from_inclusive":true,"to":"7.2.1","to_inclusive":true,"patched_in":"7.2.2"}],"published":"2023-05-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9aae623-abff-4216-981f-dcd13f367a8d","source":"wordfence","cve":"CVE-2020-24143","title":"Video Downloader for TikTok < 1.4 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9aae623-abff-4216-981f-dcd13f367a8d?source=api-prod","affected":[{"type":"plugin","slug":"downloader-tiktok","name":"Video Downloader for TikTok","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9ab2d12-5ed0-472a-be96-723577b011aa","source":"wordfence","cve":"CVE-2024-37104","title":"Chic Lite <= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ab2d12-5ed0-472a-be96-723577b011aa?source=api-prod","affected":[{"type":"theme","slug":"chic-lite","name":"Chic Lite","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2024-06-20T00:00:00Z","updated":"2024-06-26T14:41:46Z"},{"id":"wordfence:f9ab89a5-bc01-446e-8cea-40544ddec4d4","source":"wordfence","cve":"CVE-2017-18532","title":"Realty by BestWebSoft < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ab89a5-bc01-446e-8cea-40544ddec4d4?source=api-prod","affected":[{"type":"plugin","slug":"realty","name":"Realty by BestWebSoft","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2017-04-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9ac2142-7872-4061-9557-d27015403595","source":"wordfence","cve":"CVE-2022-4666","title":"Markup <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ac2142-7872-4061-9557-d27015403595?source=api-prod","affected":[{"type":"plugin","slug":"wp-structuring-markup","name":"Markup (JSON-LD) structured in schema.org","from":"*","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":""}],"published":"2023-01-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9ad3a88-fcfd-45c5-a23d-ca544cad3ab2","source":"wordfence","cve":"CVE-2022-44632","title":"Content Repeater \u2013 Custom Posts Simplified <= 1.1.13 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ad3a88-fcfd-45c5-a23d-ca544cad3ab2?source=api-prod","affected":[{"type":"plugin","slug":"content-repeater","name":"Content Repeater \u2013 Custom Posts Simplified","from":"*","from_inclusive":true,"to":"1.1.13","to_inclusive":true,"patched_in":""}],"published":"2022-11-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9adc83b-b6d3-4ff4-93fb-6236e4a4eaaa","source":"wordfence","cve":"CVE-2024-2234","title":"Himer <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9adc83b-b6d3-4ff4-93fb-6236e4a4eaaa?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T18:41:34Z"},{"id":"wordfence:f9ae88f8-88c1-4bb0-af9f-330f9760de1f","source":"wordfence","cve":"CVE-2021-24687","title":"Modern Events Calendar Lite < 5.22.1 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ae88f8-88c1-4bb0-af9f-330f9760de1f?source=api-prod","affected":[{"type":"plugin","slug":"modern-events-calendar-lite","name":"Modern Events Calendar Lite","from":"*","from_inclusive":true,"to":"5.22.1","to_inclusive":true,"patched_in":"5.22.2"}],"published":"2021-09-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9ae9aba-fa0e-4a3d-a970-e45216685cc0","source":"wordfence","cve":"CVE-2020-11738","title":"Duplicator < 1.3.28 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ae9aba-fa0e-4a3d-a970-e45216685cc0?source=api-prod","affected":[{"type":"plugin","slug":"duplicator-pro","name":"Duplicator Pro","from":"*","from_inclusive":true,"to":"3.8.7.1","to_inclusive":false,"patched_in":"3.8.7.1"},{"type":"plugin","slug":"duplicator","name":"Duplicator \u2013 Backups & Migration Plugin \u2013 Cloud Backups, Scheduled Backups, & More","from":"*","from_inclusive":true,"to":"1.3.28","to_inclusive":false,"patched_in":"1.3.28"}],"published":"2020-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9af0471-adb0-42c6-8a7b-da7d28e5e3aa","source":"wordfence","cve":"CVE-2026-39520","title":"weDocs <= 2.1.18 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9af0471-adb0-42c6-8a7b-da7d28e5e3aa?source=api-prod","affected":[{"type":"plugin","slug":"wedocs","name":"weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot","from":"*","from_inclusive":true,"to":"2.1.18","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-02-25T00:00:00Z","updated":"2026-04-15T21:27:39Z"},{"id":"wordfence:f9b1c96c-ab87-43a8-a3ac-17fea337b690","source":"wordfence","cve":"CVE-2023-30781","title":"Tweeple <= 0.9.5 - Reflected Cross-Site Scripting via id","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b1c96c-ab87-43a8-a3ac-17fea337b690?source=api-prod","affected":[{"type":"plugin","slug":"tweeple","name":"Tweeple","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9b392cb-04f9-475e-bfe3-d6086f2b5885","source":"wordfence","cve":"CVE-2025-5998","title":"PPWP \u2013 Password Protect Pages <= 1.9.10 - Authenticated (Subscriber+) Content Exposure via REST API","severity":"medium","cvss":4.3,"cwe":"CWE-280","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b392cb-04f9-475e-bfe3-d6086f2b5885?source=api-prod","affected":[{"type":"plugin","slug":"password-protect-page","name":"PPWP \u2013 Password Protect Pages","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":true,"patched_in":"1.9.11"}],"published":"2025-08-25T00:00:00Z","updated":"2025-08-25T15:34:54Z"},{"id":"wordfence:f9b67fc9-87a2-4bd6-a45b-fdfe43ce7ed8","source":"wordfence","cve":"CVE-2012-3577","title":"Nmedia WordPress Member Conversation < 1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b67fc9-87a2-4bd6-a45b-fdfe43ce7ed8?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-member-private-conversation","name":"Nmedia WordPress Member Conversation","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":false,"patched_in":"1.4"}],"published":"2012-06-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9b6c62f-b53f-44f7-8fe2-22bac0074f9d","source":"wordfence","cve":"CVE-2018-20965","title":"Ultimate Member <= 2.0.3 - Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b6c62f-b53f-44f7-8fe2-22bac0074f9d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2019-08-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9b6e9a7-1ac5-45d0-83c3-a3f79935904a","source":"wordfence","cve":"CVE-2025-9989","title":"Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b6e9a7-1ac5-45d0-83c3-a3f79935904a?source=api-prod","affected":[{"type":"plugin","slug":"broadstreet","name":"Broadstreet","from":"*","from_inclusive":true,"to":"1.53.1","to_inclusive":true,"patched_in":"1.53.2"}],"published":"2026-05-12T15:28:56Z","updated":"2026-05-13T04:26:45Z"},{"id":"wordfence:f9b90e03-cdaa-4bd3-9afd-5d5c91a17962","source":"wordfence","cve":"CVE-2022-36394","title":"Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b90e03-cdaa-4bd3-9afd-5d5c91a17962?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"17.0.4","to_inclusive":true,"patched_in":"17.0.5"}],"published":"2022-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9b9c20c-caa1-4814-a88f-6617ca8d8f9b","source":"wordfence","cve":"CVE-2026-42693","title":"Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b9c20c-caa1-4814-a88f-6617ca8d8f9b?source=api-prod","affected":[{"type":"theme","slug":"jannah","name":"Jannah - Newspaper Magazine News BuddyPress AMP","from":"*","from_inclusive":true,"to":"7.6.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:12:15Z","updated":"2026-10-13T13:52:01Z"},{"id":"wordfence:f9ba7e7e-f906-400c-8133-ccafd3987ca7","source":"wordfence","cve":"CVE-2025-69108","title":"Hot Coffee <= 1.7 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ba7e7e-f906-400c-8133-ccafd3987ca7?source=api-prod","affected":[{"type":"theme","slug":"hot-coffee","name":"Hot Coffee | Coffee Shop & Cafe WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:24:07Z"},{"id":"wordfence:f9be7798-31ac-4692-a6ac-ae7f129bcd6d","source":"wordfence","cve":"CVE-2024-31359","title":"Premmerce Product Filter for WooCommerce <= 3.7.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9be7798-31ac-4692-a6ac-ae7f129bcd6d?source=api-prod","affected":[{"type":"plugin","slug":"premmerce-woocommerce-product-filter","name":"Premmerce Product Filter for WooCommerce","from":"*","from_inclusive":true,"to":"3.7.2","to_inclusive":true,"patched_in":"3.7.3"}],"published":"2024-04-08T00:00:00Z","updated":"2024-04-16T13:31:03Z"},{"id":"wordfence:f9bfa726-40e1-4417-9d59-289dbb3a17ff","source":"wordfence","cve":"CVE-2020-28035","title":"WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9bfa726-40e1-4417-9d59-289dbb3a17ff?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.34","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.32","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.31","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.28","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.24","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.23","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.22","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.19","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.18","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.14","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.15","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.7","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.2","to_inclusive":true,"patched_in":"3.7.35"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"3.7.35"}],"published":"2020-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9c0ad1e-380e-4b67-b07e-70bf44e4e614","source":"wordfence","cve":"CVE-2024-5289","title":"Gutenberg Blocks with AI by Kadence WP \u2013 Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c0ad1e-380e-4b67-b07e-70bf44e4e614?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.42","to_inclusive":true,"patched_in":"3.2.43"}],"published":"2024-06-26T12:09:37Z","updated":"2024-06-27T02:03:04Z"},{"id":"wordfence:f9c0c44f-13bb-4e09-9edf-59be12d508a8","source":"wordfence","cve":"CVE-2026-42776","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers <= 3.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c0c44f-13bb-4e09-9edf-59be12d508a8?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2026-05-26T00:00:00Z","updated":"2026-05-26T19:46:32Z"},{"id":"wordfence:f9c3ab75-93fb-4c63-a430-61d02a031e46","source":"wordfence","cve":"CVE-2019-14774","title":"Variation Swatches for WooCommerce <= 1.0.61 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c3ab75-93fb-4c63-a430-61d02a031e46?source=api-prod","affected":[{"type":"plugin","slug":"woo-variation-swatches","name":"Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.62","to_inclusive":false,"patched_in":"1.0.62"}],"published":"2019-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9c6eccc-3f91-4923-b3d3-46070bb3662d","source":"wordfence","cve":"CVE-2023-22700","title":"PixelYourSite <= 9.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c6eccc-3f91-4923-b3d3-46070bb3662d?source=api-prod","affected":[{"type":"plugin","slug":"pixelyoursite","name":"PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager","from":"*","from_inclusive":true,"to":"9.3.0","to_inclusive":true,"patched_in":"9.3.1"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9c9f8db-26e4-4f79-88a3-9be1f5772ebe","source":"wordfence","cve":"CVE-2024-31097","title":"SEO Title Tag <= 3.5.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c9f8db-26e4-4f79-88a3-9be1f5772ebe?source=api-prod","affected":[{"type":"plugin","slug":"seo-title-tag","name":"SEO Title Tag","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":""}],"published":"2024-03-29T00:00:00Z","updated":"2024-04-03T21:01:17Z"},{"id":"wordfence:f9ce0ae8-4729-4236-b4e8-e5726f4d3101","source":"wordfence","cve":"CVE-2009-3890","title":"WordPress Core <= 2.8.5 - Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ce0ae8-4729-4236-b4e8-e5726f4d3101?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2009-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9ced7f4-9574-40a6-94eb-e5d3bdff8336","source":"wordfence","cve":"CVE-2017-1002015","title":"Image Gallery with Slideshow <= 1.5.2 - SQL Injection via selectMulGallery","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ced7f4-9574-40a6-94eb-e5d3bdff8336?source=api-prod","affected":[{"type":"plugin","slug":"image-gallery-with-slideshow","name":"Image Gallery with Slideshow Plugin","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2017-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9cee379-79f8-4a60-b1bb-ccab1e954512","source":"wordfence","cve":"CVE-2024-1751","title":"Tutor LMS \u2013 eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cee379-79f8-4a60-b1bb-ccab1e954512?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":"2.6.2"}],"published":"2024-03-11T00:00:00Z","updated":"2024-03-13T15:27:26Z"},{"id":"wordfence:f9cf0430-8577-449a-aefe-d7bf606fe2de","source":"wordfence","cve":"CVE-2026-3371","title":"Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cf0430-8577-449a-aefe-d7bf606fe2de?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.7","to_inclusive":true,"patched_in":"3.9.8"}],"published":"2026-04-10T12:00:50Z","updated":"2026-04-11T01:25:01Z"},{"id":"wordfence:f9cff7c4-7dc0-440b-bb1c-1087144d1ccf","source":"wordfence","cve":"CVE-2025-48282","title":"Majestic Support <= 1.1.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cff7c4-7dc0-440b-bb1c-1087144d1ccf?source=api-prod","affected":[{"type":"plugin","slug":"majestic-support","name":"Majestic Support \u2013 The Leading-Edge Help Desk & Customer Support Plugin","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T16:41:18Z"},{"id":"wordfence:f9d11597-0bea-4f58-9dac-b4b82d07c2f6","source":"wordfence","cve":"CVE-2026-42735","title":"KiviCare \u2013 Clinic & Patient Management System (EHR) <= 4.3.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d11597-0bea-4f58-9dac-b4b82d07c2f6?source=api-prod","affected":[{"type":"plugin","slug":"kivicare-clinic-management-system","name":"KiviCare \u2013 Clinic & Patient Management System (EHR)","from":"*","from_inclusive":true,"to":"4.3.0","to_inclusive":true,"patched_in":"4.4.0"}],"published":"2026-05-26T00:00:00Z","updated":"2026-06-02T12:07:39Z"},{"id":"wordfence:f9d1922d-2bb5-4ed7-849e-781f18828046","source":"wordfence","cve":"CVE-2025-39406","title":"WPAMS <= 44.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d1922d-2bb5-4ed7-849e-781f18828046?source=api-prod","affected":[{"type":"plugin","slug":"apartment-management","name":"WPAMS - Apartment Management System for wordpress","from":"*","from_inclusive":true,"to":"44.0 (17-08-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-17T00:00:00Z","updated":"2025-04-21T18:47:57Z"},{"id":"wordfence:f9d4ac3d-08ec-4783-8ccd-d64ab07d5d7f","source":"wordfence","cve":"CVE-2012-6714","title":"Count per Day Plugin < 3.2.3 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d4ac3d-08ec-4783-8ccd-d64ab07d5d7f?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":false,"patched_in":"3.2.3"}],"published":"2012-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9d50155-73a5-4489-88c5-c7c2a4e30fef","source":"wordfence","cve":"CVE-2022-4467","title":"Search & Filter <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d50155-73a5-4489-88c5-c7c2a4e30fef?source=api-prod","affected":[{"type":"plugin","slug":"search-filter","name":"Search & Filter","from":"*","from_inclusive":true,"to":"1.2.15","to_inclusive":true,"patched_in":"1.2.16"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9d70f5c-e05f-47c9-994c-0e1da5b2fe01","source":"wordfence","cve":"CVE-2013-2009","title":"WP Super Cache <= 1.2 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d70f5c-e05f-47c9-994c-0e1da5b2fe01?source=api-prod","affected":[{"type":"plugin","slug":"wp-super-cache","name":"WP Super Cache","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":"1.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9d90717-fd48-493b-9293-32976bf2cada","source":"wordfence","cve":"CVE-2024-8771","title":"Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d90717-fd48-493b-9293-32976bf2cada?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.7.34","to_inclusive":true,"patched_in":"5.7.35"}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T15:30:33Z"},{"id":"wordfence:f9d908f6-29c9-4c64-badb-bbf1986a2c5f","source":"wordfence","cve":"CVE-2026-16298","title":"FoodBoxBooker <= 1.0.6 - Privilege Escalation to Unauthenticated Arbitrary Password Reset","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d908f6-29c9-4c64-badb-bbf1986a2c5f?source=api-prod","affected":[{"type":"plugin","slug":"foodboxbooker","name":"FoodBoxBooker","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2026-08-05T00:00:00Z","updated":"2026-08-21T15:24:19Z"},{"id":"wordfence:f9d9e485-171f-4e36-943d-397d540e31f4","source":"wordfence","cve":"CVE-2025-4799","title":"WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion","severity":"high","cvss":7.2,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d9e485-171f-4e36-943d-397d540e31f4?source=api-prod","affected":[{"type":"plugin","slug":"wp-downloadmanager","name":"WP-DownloadManager","from":"*","from_inclusive":true,"to":"1.68.10","to_inclusive":true,"patched_in":"1.68.11"}],"published":"2025-06-10T00:00:00Z","updated":"2025-06-11T03:41:53Z"},{"id":"wordfence:f9da9d45-39e2-4b07-baed-1f7d7f67602e","source":"wordfence","cve":"CVE-2025-9371","title":"Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9da9d45-39e2-4b07-baed-1f7d7f67602e?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"28.1.6","to_inclusive":true,"patched_in":"28.1.7"}],"published":"2025-10-08T00:00:00Z","updated":"2025-10-09T11:20:56Z"},{"id":"wordfence:f9dc401e-0247-4f49-8092-8841ea6c1f90","source":"wordfence","cve":"","title":"Workup \u2013 Job Board WordPress Theme <= 2.1.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9dc401e-0247-4f49-8092-8841ea6c1f90?source=api-prod","affected":[{"type":"theme","slug":"workup","name":"Workup \u2013 Job Board WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.5","to_inclusive":true,"patched_in":"2.1.6"}],"published":"2020-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9de638d-a645-4e4e-bf7d-514692677106","source":"wordfence","cve":"CVE-2026-24591","title":"Turn Yoast SEO FAQ Block to Accordion <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9de638d-a645-4e4e-bf7d-514692677106?source=api-prod","affected":[{"type":"plugin","slug":"faq-schema-block-to-accordion","name":"Turn Yoast SEO FAQ Block to Accordion","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":""}],"published":"2026-01-16T00:00:00Z","updated":"2026-01-27T19:23:49Z"},{"id":"wordfence:f9de8e90-5bda-4ab1-aa78-2748cd717376","source":"wordfence","cve":"CVE-2025-7712","title":"Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9de8e90-5bda-4ab1-aa78-2748cd717376?source=api-prod","affected":[{"type":"plugin","slug":"madara-core","name":"Madara - Core","from":"*","from_inclusive":true,"to":"2.2.3","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2025-07-16T14:03:09Z","updated":"2025-07-17T02:24:34Z"},{"id":"wordfence:f9de946c-941a-41d7-b1c4-440b4fcec9b0","source":"wordfence","cve":"","title":"Theme Test Drive <= 2.9 -  Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9de946c-941a-41d7-b1c4-440b4fcec9b0?source=api-prod","affected":[{"type":"plugin","slug":"theme-test-drive","name":"Theme Test Drive","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2015-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9df44b4-5d03-4f34-ab08-333267f29d7e","source":"wordfence","cve":"CVE-2026-115213","title":"EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Credential Exposure","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9df44b4-5d03-4f34-ab08-333267f29d7e?source=api-prod","affected":[{"type":"plugin","slug":"node-wpapi-auth","name":"EASY-JS-WPAPI Client HANDLE for the WordPress REST-API","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-11T12:43:07Z"},{"id":"wordfence:f9e0c658-b37c-4780-9589-6def9e36539b","source":"wordfence","cve":"CVE-2026-4305","title":"Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e0c658-b37c-4780-9589-6def9e36539b?source=api-prod","affected":[{"type":"plugin","slug":"royal-backup-reset","name":"Royal WordPress Backup, Restore & Migration Plugin \u2013 Backup WordPress Sites Safely","from":"*","from_inclusive":true,"to":"1.0.16","to_inclusive":true,"patched_in":"1.0.17"}],"published":"2026-04-09T12:23:20Z","updated":"2026-04-10T01:25:00Z"},{"id":"wordfence:f9e2ad4b-716a-4a2d-87c0-2f351bd13884","source":"wordfence","cve":"CVE-2026-15011","title":"Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e2ad4b-716a-4a2d-87c0-2f351bd13884?source=api-prod","affected":[{"type":"plugin","slug":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","from":"*","from_inclusive":true,"to":"6.0.5","to_inclusive":true,"patched_in":"6.0.6"}],"published":"2026-07-22T20:23:54Z","updated":"2026-07-23T08:34:42Z"},{"id":"wordfence:f9e45bc2-6db6-49cd-8a4a-58489a8ddac2","source":"wordfence","cve":"CVE-2023-39308","title":"User Feedback <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e45bc2-6db6-49cd-8a4a-58489a8ddac2?source=api-prod","affected":[{"type":"plugin","slug":"userfeedback-lite","name":"UserFeedback \u2013 Create Interactive Feedback Form, User Surveys, and Polls in Seconds","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":"1.0.8"}],"published":"2023-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9e7acc4-8b17-44a8-b20f-4c8f2a36180a","source":"wordfence","cve":"CVE-2025-32280","title":"WP Project Manager  <= 2.6.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e7acc4-8b17-44a8-b20f-4c8f2a36180a?source=api-prod","affected":[{"type":"plugin","slug":"wedevs-project-manager","name":"Project Manager \u2013 AI Powered Project Management, Task Management, Kanban Board & Time Tracker","from":"*","from_inclusive":true,"to":"2.6.24","to_inclusive":true,"patched_in":"2.6.25"}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-07T17:41:43Z"},{"id":"wordfence:f9e83561-aa71-4984-8a26-207e208d70e8","source":"wordfence","cve":"CVE-2025-13592","title":"Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e83561-aa71-4984-8a26-207e208d70e8?source=api-prod","affected":[{"type":"plugin","slug":"advanced-ads","name":"Advanced Ads \u2013\u00a0Ad Manager & AdSense","from":"*","from_inclusive":true,"to":"2.0.14","to_inclusive":true,"patched_in":"2.0.15"}],"published":"2025-12-29T06:04:25Z","updated":"2025-12-29T18:20:51Z"},{"id":"wordfence:f9e85d85-76cd-4606-918b-87f07098c967","source":"wordfence","cve":"CVE-2024-13393","title":"Video Share VOD \u2013 Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e85d85-76cd-4606-918b-87f07098c967?source=api-prod","affected":[{"type":"plugin","slug":"video-share-vod","name":"Video Share VOD \u2013 Turnkey Video Site Builder Script","from":"*","from_inclusive":true,"to":"2.6.31","to_inclusive":true,"patched_in":"2.6.32"}],"published":"2025-01-17T00:00:00Z","updated":"2025-01-18T07:05:10Z"},{"id":"wordfence:f9eb02f4-ad47-41f2-b3a7-e3f73d7a1bc3","source":"wordfence","cve":"CVE-2024-50443","title":"PostX <= 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9eb02f4-ad47-41f2-b3a7-e3f73d7a1bc3?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-post","name":"Post Grid Gutenberg Blocks \u2013 PostX","from":"*","from_inclusive":true,"to":"4.1.12","to_inclusive":true,"patched_in":"4.1.13"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-31T09:52:40Z"},{"id":"wordfence:f9eb1d99-76d9-4a6c-b1ce-618085c4f2aa","source":"wordfence","cve":"CVE-2025-49288","title":"Ultimate WP Mail <= 1.3.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9eb1d99-76d9-4a6c-b1ce-618085c4f2aa?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-wp-mail","name":"Ultimate WP Mail","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:19:06Z"},{"id":"wordfence:f9ebef5d-b651-4b09-b9af-97292a75f1c2","source":"wordfence","cve":"CVE-2025-69032","title":"FiveStar <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ebef5d-b651-4b09-b9af-97292a75f1c2?source=api-prod","affected":[{"type":"theme","slug":"fivestar","name":"FiveStar - Hotel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2025-12-29T00:00:00Z","updated":"2026-01-06T15:50:24Z"},{"id":"wordfence:f9f17c2b-ca63-4f71-af0f-7bce09ebeb9f","source":"wordfence","cve":"","title":"Answer My Question < 1.2 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f17c2b-ca63-4f71-af0f-7bce09ebeb9f?source=api-prod","affected":[{"type":"plugin","slug":"answer-my-question","name":"Answer My Question","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":false,"patched_in":"1.2"}],"published":"2012-11-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9f273ed-2ffd-4632-9886-244c0d55ede5","source":"wordfence","cve":"CVE-2024-49306","title":"WP Content Copy Protection & No Right Click <= 3.5.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f273ed-2ffd-4632-9886-244c0d55ede5?source=api-prod","affected":[{"type":"plugin","slug":"wp-content-copy-protector","name":"WP Content Copy Protection & No Right Click","from":"*","from_inclusive":true,"to":"3.5.9","to_inclusive":true,"patched_in":"3.6.1"}],"published":"2024-10-15T00:00:00Z","updated":"2024-10-21T17:57:48Z"},{"id":"wordfence:f9f3250f-39a1-4ba1-b9a2-222926635ca0","source":"wordfence","cve":"CVE-2025-3609","title":"Reales WP STPT <= 2.1.2 - Unauthorized User Registration","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f3250f-39a1-4ba1-b9a2-222926635ca0?source=api-prod","affected":[{"type":"plugin","slug":"short-tax-post","name":"Reales WP STPT","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-05T00:00:00Z","updated":"2025-05-06T01:56:14Z"},{"id":"wordfence:f9f3349e-de64-498e-bb82-5ceff1456265","source":"wordfence","cve":"CVE-2018-20983","title":"Perfect Images <= 5.2.2 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f3349e-de64-498e-bb82-5ceff1456265?source=api-prod","affected":[{"type":"plugin","slug":"wp-retina-2x","name":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":false,"patched_in":"5.2.3"}],"published":"2018-01-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9f4c25e-6233-42f0-a968-16221ed86cf2","source":"wordfence","cve":"CVE-2024-51634","title":"Webriti Custom Login <= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f4c25e-6233-42f0-a968-16221ed86cf2?source=api-prod","affected":[{"type":"plugin","slug":"webriti-custom-login-page","name":"Webriti Custom Login","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T14:26:28Z"},{"id":"wordfence:f9f5aa00-58d3-4b22-af15-1dfd1d70690b","source":"wordfence","cve":"CVE-2026-24546","title":"GamiPress \u2013 Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f5aa00-58d3-4b22-af15-1dfd1d70690b?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"7.6.3","to_inclusive":true,"patched_in":"7.6.4"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:14:05Z"},{"id":"wordfence:f9f5be49-e099-4862-af9d-4ddbb6decfc5","source":"wordfence","cve":"CVE-2024-33677","title":"Contact Form 7 Extension For Mailchimp <= 0.5.73 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f5be49-e099-4862-af9d-4ddbb6decfc5?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-mailchimp-extension","name":"Connect Contact Form 7 to Mailchimp, Brevo, MailerLite, Klaviyo, GetResponse, EmailOctopus, Campaign Monitor & Moosend","from":"*","from_inclusive":true,"to":"0.5.73","to_inclusive":true,"patched_in":"0.9.19"}],"published":"2024-04-26T00:00:00Z","updated":"2025-10-08T20:48:21Z"},{"id":"wordfence:f9f71f80-0728-4f4c-8e93-4df421030f23","source":"wordfence","cve":"CVE-2025-15481","title":"Notification Bar for WordPress <= 1.1.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f71f80-0728-4f4c-8e93-4df421030f23?source=api-prod","affected":[{"type":"plugin","slug":"8-degree-notification-bar","name":"Notification Bar for WordPress","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T00:00:00Z","updated":"2026-09-16T14:55:48Z"},{"id":"wordfence:f9fb481f-3f82-4ac7-84d8-be8fda7d1c06","source":"wordfence","cve":"CVE-2024-51838","title":"Pull This <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fb481f-3f82-4ac7-84d8-be8fda7d1c06?source=api-prod","affected":[{"type":"plugin","slug":"pull-this","name":"Pull This","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:56:44Z"},{"id":"wordfence:f9fcd12b-bcc8-48cb-a077-ccf1bc4ff276","source":"wordfence","cve":"CVE-2015-9387","title":"mTouch Quiz <= 3.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fcd12b-bcc8-48cb-a077-ccf1bc4ff276?source=api-prod","affected":[{"type":"plugin","slug":"mtouch-quiz","name":"mTouch Quiz","from":"*","from_inclusive":true,"to":"3.1.3","to_inclusive":false,"patched_in":"3.1.3"}],"published":"2015-12-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9fce4d3-77c7-4e80-a3a9-1eff8ff95aa7","source":"wordfence","cve":"CVE-2026-97318","title":"Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Open Redirect","severity":"medium","cvss":4.7,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fce4d3-77c7-4e80-a3a9-1eff8ff95aa7?source=api-prod","affected":[{"type":"plugin","slug":"rafflepress","name":"Giveaways and Contests by RafflePress \u2013 Get More Website Traffic, Email Subscribers, and Social Followers","from":"*","from_inclusive":true,"to":"1.12.26","to_inclusive":true,"patched_in":"1.12.27"}],"published":"2026-09-30T00:00:00Z","updated":"2026-10-09T13:41:27Z"},{"id":"wordfence:f9fd1035-96d6-4fda-9a4f-62d0c34306e0","source":"wordfence","cve":"CVE-2026-115961","title":"bSlider \u2013 Build Sliders That Bring Your Content to Life <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fd1035-96d6-4fda-9a4f-62d0c34306e0?source=api-prod","affected":[{"type":"plugin","slug":"b-slider","name":"bSlider \u2013 Build Sliders That Bring Your Content to Life","from":"*","from_inclusive":true,"to":"2.2.2","to_inclusive":true,"patched_in":"2.2.4"}],"published":"2026-10-26T10:33:00Z","updated":"2026-10-28T01:26:01Z"},{"id":"wordfence:f9fe2885-d9ef-4506-945a-69bdddf41718","source":"wordfence","cve":"CVE-2024-29818","title":"WP Poll Maker <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fe2885-d9ef-4506-945a-69bdddf41718?source=api-prod","affected":[{"type":"plugin","slug":"epoll-wp-voting","name":"ePoll \u2013 Contest Poll Survey & Voting","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":"3.4"}],"published":"2024-03-25T00:00:00Z","updated":"2024-03-29T19:06:50Z"},{"id":"wordfence:f9fe858e-5c89-4cc2-8b66-5c86965f7889","source":"wordfence","cve":"","title":"Travel Light <= 1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fe858e-5c89-4cc2-8b66-5c86965f7889?source=api-prod","affected":[{"type":"plugin","slug":"travel-light","name":"Travel Light","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:f9fe8ff7-32c7-4c40-8e70-48cd7a9910ec","source":"wordfence","cve":"CVE-2026-48873","title":"Montonio for WooCommerce <= 10.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9fe8ff7-32c7-4c40-8e70-48cd7a9910ec?source=api-prod","affected":[{"type":"plugin","slug":"montonio-for-woocommerce","name":"Montonio for WooCommerce","from":"*","from_inclusive":true,"to":"10.1.2","to_inclusive":true,"patched_in":"10.1.3"}],"published":"2026-06-02T00:00:00Z","updated":"2026-06-08T14:36:31Z"},{"id":"wordfence:f9ff3058-a08c-40ed-b756-81e703b2277a","source":"wordfence","cve":"CVE-2026-1921","title":"Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ff3058-a08c-40ed-b756-81e703b2277a?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-05-04T13:32:17Z","updated":"2026-05-05T02:26:59Z"},{"id":"wordfence:f9ffd35b-833e-4f8d-8563-ef10543bce30","source":"wordfence","cve":"CVE-2025-31829","title":"ShopCred <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ffd35b-833e-4f8d-8563-ef10543bce30?source=api-prod","affected":[{"type":"plugin","slug":"shopcred","name":"ShopCred \u2013 WooCommerce Builder with Products Grid & Carousel Block","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:14:45Z"},{"id":"wordfence:fa05a758-56a0-49e0-868f-a5db27d877a8","source":"wordfence","cve":"CVE-2024-37472","title":"Woffice <= 5.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa05a758-56a0-49e0-868f-a5db27d877a8?source=api-prod","affected":[{"type":"theme","slug":"woffice","name":"Woffice CRM","from":"*","from_inclusive":true,"to":"5.4.8","to_inclusive":true,"patched_in":"5.4.9"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-09T15:18:28Z"},{"id":"wordfence:fa05ad02-8625-4bf9-983e-548fbb7634f3","source":"wordfence","cve":"CVE-2022-4351","title":"Qe SEO Handyman <= 1.0 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":5.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa05ad02-8625-4bf9-983e-548fbb7634f3?source=api-prod","affected":[{"type":"plugin","slug":"qe-seo-handyman","name":"Qe SEO Handyman","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa085bc0-af0b-4797-a10f-4d41b4988c02","source":"wordfence","cve":"CVE-2024-12584","title":"140+ Widgets | Xpro Addons For Elementor \u2013 FREE <= 1.4.6.2 - Authenticated (Contributor+) Post Disclosure via Post Duplication","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa085bc0-af0b-4797-a10f-4d41b4988c02?source=api-prod","affected":[{"type":"plugin","slug":"xpro-elementor-addons","name":"Xpro Addons \u2014 150+ Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.4.6.2","to_inclusive":true,"patched_in":"1.4.6.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-08T06:41:38Z"},{"id":"wordfence:fa0881ab-d731-4e57-8323-c49b9306bf50","source":"wordfence","cve":"CVE-2019-10673","title":"Ultimate Member <= 2.0.39 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa0881ab-d731-4e57-8323-c49b9306bf50?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-member","name":"Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin","from":"*","from_inclusive":true,"to":"2.0.40","to_inclusive":false,"patched_in":"2.0.40"}],"published":"2019-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa098919-66ed-41e5-a5f9-291e1859e889","source":"wordfence","cve":"CVE-2011-3864","title":"The Erudite <= 2.7.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa098919-66ed-41e5-a5f9-291e1859e889?source=api-prod","affected":[{"type":"theme","slug":"the-erudite","name":"The Erudite","from":"*","from_inclusive":true,"to":"2.7.8","to_inclusive":true,"patched_in":"2.8"}],"published":"2011-09-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa098a19-6984-4eeb-b8cd-178d0e41e005","source":"wordfence","cve":"CVE-2025-68047","title":"Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa098a19-6984-4eeb-b8cd-178d0e41e005?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.3","to_inclusive":true,"patched_in":"4.1.4"}],"published":"2026-01-22T00:00:00Z","updated":"2026-02-25T13:09:35Z"},{"id":"wordfence:fa0a296a-a93f-4c0e-9911-b4f9bdd53fad","source":"wordfence","cve":"CVE-2024-10262","title":"Drop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution","severity":"medium","cvss":6.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa0a296a-a93f-4c0e-9911-b4f9bdd53fad?source=api-prod","affected":[{"type":"plugin","slug":"drop-shadow-boxes","name":"Drop Shadow Boxes","from":"*","from_inclusive":true,"to":"1.7.14","to_inclusive":true,"patched_in":"1.7.15"}],"published":"2024-11-15T15:01:37Z","updated":"2024-12-04T19:27:17Z"},{"id":"wordfence:fa0b8026-5c7b-4a4a-93a7-3931da3e3967","source":"wordfence","cve":"CVE-2025-60116","title":"Grand Conference Theme Custom Post Type < 2.6.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa0b8026-5c7b-4a4a-93a7-3931da3e3967?source=api-prod","affected":[{"type":"plugin","slug":"grandconference-custom-post","name":"Grand Conference Theme Custom Post Type","from":"*","from_inclusive":true,"to":"2.6.4","to_inclusive":false,"patched_in":"2.6.4"}],"published":"2025-09-26T00:00:00Z","updated":"2026-02-26T15:19:06Z"},{"id":"wordfence:fa102cae-00c8-478a-b2f0-829c4018f8f3","source":"wordfence","cve":"CVE-2026-125680","title":"Bold Page Builder <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa102cae-00c8-478a-b2f0-829c4018f8f3?source=api-prod","affected":[{"type":"plugin","slug":"bold-page-builder","name":"Bold Page Builder","from":"*","from_inclusive":true,"to":"5.9.11","to_inclusive":true,"patched_in":"5.9.12"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:59:08Z"},{"id":"wordfence:fa139703-e83e-4a19-a801-464b72a2acc4","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa139703-e83e-4a19-a801-464b72a2acc4?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa15939c-44eb-45e5-95d7-49307912f21c","source":"wordfence","cve":"CVE-2024-43269","title":"Backup and Restore Wordpress <= 1.50 - Cross-Site Request Forgery to Backup Trigger","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa15939c-44eb-45e5-95d7-49307912f21c?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.50","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-08-12T00:00:00Z","updated":"2025-08-22T15:37:32Z"},{"id":"wordfence:fa15c0a4-c99d-40c9-a654-f3a910460502","source":"wordfence","cve":"CVE-2022-4541","title":"WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa15c0a4-c99d-40c9-a654-f3a910460502?source=api-prod","affected":[{"type":"plugin","slug":"nm-visitors","name":"WordPress Visitors","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-09-25T00:00:00Z","updated":"2024-09-26T09:29:43Z"},{"id":"wordfence:fa15ee50-2cbb-4833-b512-0971eaf12ff2","source":"wordfence","cve":"CVE-2022-2391","title":"Inspiro Pro <= 7.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa15ee50-2cbb-4833-b512-0971eaf12ff2?source=api-prod","affected":[{"type":"theme","slug":"wpzoom-inspiro-pro","name":"Inspiro PRO","from":"*","from_inclusive":true,"to":"7.2.2","to_inclusive":true,"patched_in":"7.2.3"}],"published":"2022-07-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa16605a-12bd-48a8-b9a9-db53bf3c2c39","source":"wordfence","cve":"CVE-2025-12019","title":"Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa16605a-12bd-48a8-b9a9-db53bf3c2c39?source=api-prod","affected":[{"type":"plugin","slug":"featured-image","name":"Featured Image","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2025-11-10T15:23:26Z","updated":"2025-11-13T15:54:10Z"},{"id":"wordfence:fa17f78a-5e4a-441e-bbbb-d13bad648c39","source":"wordfence","cve":"CVE-2024-13407","title":"Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa17f78a-5e4a-441e-bbbb-d13bad648c39?source=api-prod","affected":[{"type":"plugin","slug":"omnipress","name":"Omnipress","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2025-03-13T00:00:00Z","updated":"2025-03-14T07:23:22Z"},{"id":"wordfence:fa181ff8-5324-4782-ad45-4a701ac63b8c","source":"wordfence","cve":"","title":"CM Ad Changer < 1.7.6 - Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa181ff8-5324-4782-ad45-4a701ac63b8c?source=api-prod","affected":[{"type":"plugin","slug":"cm-ad-changer","name":"CM Ad Changer \u2013 A simple tool to control and optimize your site\u2019s banners","from":"*","from_inclusive":true,"to":"1.7.6","to_inclusive":false,"patched_in":"1.7.6"}],"published":"2016-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa1b55f8-93d8-474c-ab41-e1aef8b258ae","source":"wordfence","cve":"CVE-2025-62146","title":"MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1b55f8-93d8-474c-ab41-e1aef8b258ae?source=api-prod","affected":[{"type":"plugin","slug":"mx-time-zone-clocks","name":"MX Time Zone Clocks","from":"*","from_inclusive":true,"to":"5.1.1","to_inclusive":true,"patched_in":"5.2.1"}],"published":"2025-12-31T00:00:00Z","updated":"2026-09-09T16:04:57Z"},{"id":"wordfence:fa1c526d-b751-4461-9e54-e7704ca8ddc3","source":"wordfence","cve":"CVE-2024-10473","title":"Logo Slider <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1c526d-b751-4461-9e54-e7704ca8ddc3?source=api-prod","affected":[{"type":"plugin","slug":"logo-slider-wp","name":"Logo Slider WP \u2013 Responsive Logo Carousel, Logo Gallery & Logo Showcase","from":"*","from_inclusive":true,"to":"4.1.0","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2024-11-07T00:00:00Z","updated":"2025-02-26T22:46:57Z"},{"id":"wordfence:fa1d2fac-6e66-46b8-aa0a-1f6b5746b18b","source":"wordfence","cve":"CVE-2024-30235","title":"Multiple Page Generator Plugin \u2013 MPG <= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1d2fac-6e66-46b8-aa0a-1f6b5746b18b?source=api-prod","affected":[{"type":"plugin","slug":"multiple-pages-generator-by-porthas","name":"MPG \u2013 Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","from":"*","from_inclusive":true,"to":"3.4.0","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2024-03-26T00:00:00Z","updated":"2024-03-27T15:12:23Z"},{"id":"wordfence:fa1d953f-6a5c-46af-a1a5-2c4f90da679a","source":"wordfence","cve":"CVE-2024-2024","title":"Folders Pro <= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_upload","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1d953f-6a5c-46af-a1a5-2c4f90da679a?source=api-prod","affected":[{"type":"plugin","slug":"folders-pro","name":"Folders Pro","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2024-06-13T00:00:00Z","updated":"2024-06-14T12:51:03Z"},{"id":"wordfence:fa1e0bcd-f881-4b01-b802-7cb18a22a07f","source":"wordfence","cve":"CVE-2026-18347","title":"Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e0bcd-f881-4b01-b802-7cb18a22a07f?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.1.1","to_inclusive":true,"patched_in":"6.2.0"}],"published":"2026-08-15T17:56:23Z","updated":"2026-08-16T06:38:09Z"},{"id":"wordfence:fa1e6527-d874-4003-b36b-5769c2950864","source":"wordfence","cve":"CVE-2023-22710","title":"Return and Warranty Management System for WooCommerce <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1e6527-d874-4003-b36b-5769c2950864?source=api-prod","affected":[{"type":"plugin","slug":"wc-return-warrranty","name":"Return and Warranty Management System for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2023-03-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa2102b3-408b-4278-b542-b5d30685960d","source":"wordfence","cve":"CVE-2024-47358","title":"Popup Maker <= 1.19.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2102b3-408b-4278-b542-b5d30685960d?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.19.2","to_inclusive":true,"patched_in":"1.20.0"}],"published":"2024-09-30T00:00:00Z","updated":"2024-10-10T12:08:37Z"},{"id":"wordfence:fa22210e-cf91-4486-b4e0-9e871f713e5c","source":"wordfence","cve":"CVE-2025-68595","title":"Widgets for Social Photo Feed <= 1.7.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa22210e-cf91-4486-b4e0-9e871f713e5c?source=api-prod","affected":[{"type":"plugin","slug":"social-photo-feed-widget","name":"Widgets for Social Photo Feed","from":"*","from_inclusive":true,"to":"1.7.8","to_inclusive":true,"patched_in":"1.7.9"}],"published":"2025-12-23T00:00:00Z","updated":"2026-06-18T18:19:31Z"},{"id":"wordfence:fa2258e4-f802-490b-8c10-4f008698a032","source":"wordfence","cve":"CVE-2024-22155","title":"WooCommerce <= 8.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2258e4-f802-490b-8c10-4f008698a032?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce","name":"WooCommerce","from":"*","from_inclusive":true,"to":"8.5.2","to_inclusive":true,"patched_in":"8.6.0"}],"published":"2024-04-05T00:00:00Z","updated":"2024-04-11T15:09:16Z"},{"id":"wordfence:fa22a038-3a7e-4821-952f-c163299ddee0","source":"wordfence","cve":"CVE-2024-38344","title":"WP Tweet Walls <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa22a038-3a7e-4821-952f-c163299ddee0?source=api-prod","affected":[{"type":"plugin","slug":"wp-tweet-walls","name":"WP Tweet Walls","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2024-06-26T00:00:00Z","updated":"2024-08-02T18:22:49Z"},{"id":"wordfence:fa23a535-f290-4517-b203-86e0331f55e4","source":"wordfence","cve":"CVE-2022-4570","title":"Top 10 \u2013 Popular posts plugin for WordPress <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa23a535-f290-4517-b203-86e0331f55e4?source=api-prod","affected":[{"type":"plugin","slug":"top-10","name":"WebberZone Top 10 \u2014 Popular Posts","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2022-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa25e1d2-65eb-450a-967b-3c003fea3464","source":"wordfence","cve":"CVE-2024-6390","title":"Quiz and Survey Master  <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa25e1d2-65eb-450a-967b-3c003fea3464?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.0.5","to_inclusive":true,"patched_in":"9.1.0"}],"published":"2024-07-13T00:00:00Z","updated":"2024-08-09T15:45:06Z"},{"id":"wordfence:fa27f37a-11d3-4f65-a86d-9c45c092b537","source":"wordfence","cve":"CVE-2025-62979","title":"ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa27f37a-11d3-4f65-a86d-9c45c092b537?source=api-prod","affected":[{"type":"plugin","slug":"acf-to-rest-api","name":"ACF to REST API","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":""}],"published":"2025-10-20T00:00:00Z","updated":"2025-10-29T15:47:22Z"},{"id":"wordfence:fa2b0487-72a7-4e49-a25b-d910e9880246","source":"wordfence","cve":"CVE-2025-62992","title":"Everest Backup <= 2.3.9 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2b0487-72a7-4e49-a25b-d910e9880246?source=api-prod","affected":[{"type":"plugin","slug":"everest-backup","name":"Everest Backup \u2013 WordPress Cloud Backup, Migration, Restore & Cloning Plugin","from":"*","from_inclusive":true,"to":"2.3.9","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-05-22T05:19:12Z"},{"id":"wordfence:fa2bb0c0-e412-4e78-a7b5-4517f1c15481","source":"wordfence","cve":"CVE-2014-125100","title":"Job Board by BestWebSoft <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2bb0c0-e412-4e78-a7b5-4517f1c15481?source=api-prod","affected":[{"type":"plugin","slug":"job-board","name":"Job Board by BestWebSoft","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2014-08-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa2bc3ae-1162-496b-8bc3-5bee1c0ff702","source":"wordfence","cve":"CVE-2016-20103","title":"Cherry Plugin < 1.2.7 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2bc3ae-1162-496b-8bc3-5bee1c0ff702?source=api-prod","affected":[{"type":"plugin","slug":"cherry-plugin","name":"Cherry Plugin","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2015-02-10T00:00:00Z","updated":"2026-10-28T14:52:55Z"},{"id":"wordfence:fa2ed43b-cd8f-4d09-8576-d215c835a684","source":"wordfence","cve":"CVE-2022-47421","title":"ARMember <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa2ed43b-cd8f-4d09-8576-d215c835a684?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0.4","to_inclusive":true,"patched_in":"4.0.5"}],"published":"2023-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa3193c4-dd3e-4d9e-be42-769c7358beae","source":"wordfence","cve":"CVE-2026-94589","title":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3193c4-dd3e-4d9e-be42-769c7358beae?source=api-prod","affected":[{"type":"plugin","slug":"extensions-for-cf7","name":"Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)","from":"*","from_inclusive":true,"to":"3.4.5","to_inclusive":true,"patched_in":"3.4.6"}],"published":"2026-10-09T15:24:50Z","updated":"2026-10-10T03:26:46Z"},{"id":"wordfence:fa31e932-7fbf-4933-9747-bd7427db7f5d","source":"wordfence","cve":"CVE-2024-29099","title":"Evergreen Content Poster <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa31e932-7fbf-4933-9747-bd7427db7f5d?source=api-prod","affected":[{"type":"plugin","slug":"evergreen-content-poster","name":"Evergreen Content Poster \u2013 Auto Post and Schedule Your Best Content to Social Media","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2024-03-15T00:00:00Z","updated":"2024-03-20T19:38:03Z"},{"id":"wordfence:fa325b30-3799-41b4-bdb8-90f42a659511","source":"wordfence","cve":"CVE-2011-3857","title":"Antisnews <= 1.09 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa325b30-3799-41b4-bdb8-90f42a659511?source=api-prod","affected":[{"type":"theme","slug":"antisnews","name":"Antisnews","from":"*","from_inclusive":true,"to":"1.09","to_inclusive":true,"patched_in":"1.10"}],"published":"2011-09-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa32f55a-f9e4-4129-add0-39d9e4eb1bee","source":"wordfence","cve":"CVE-2025-32249","title":"DirectoryPress <= 3.6.22 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa32f55a-f9e4-4129-add0-39d9e4eb1bee?source=api-prod","affected":[{"type":"plugin","slug":"directorypress","name":"DirectoryPress \u2013 Business Directory And Classified Ad Listing","from":"*","from_inclusive":true,"to":"3.6.22","to_inclusive":true,"patched_in":"3.6.23"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-21T13:57:26Z"},{"id":"wordfence:fa348259-b242-4f29-ac88-c32e546b09a5","source":"wordfence","cve":"CVE-2014-125133","title":"NativeChurch <= 1.6.1 - Unauthenticated Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa348259-b242-4f29-ac88-c32e546b09a5?source=api-prod","affected":[{"type":"theme","slug":"NativeChurch","name":"NativeChurch","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"1.6.2"}],"published":"2014-09-28T00:00:00Z","updated":"2026-10-28T14:50:37Z"},{"id":"wordfence:fa3501a4-7975-4f90-8037-f8a06c293c07","source":"wordfence","cve":"CVE-2024-6704","title":"Comments \u2013 wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-8037-f8a06c293c07?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.21","to_inclusive":true,"patched_in":"7.6.22"}],"published":"2024-08-01T00:00:00Z","updated":"2024-08-02T10:59:33Z"},{"id":"wordfence:fa37025a-7f20-4cfe-a7d0-38168f49b6d9","source":"wordfence","cve":"CVE-2025-8575","title":"LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'","severity":"high","cvss":7.2,"cwe":"CWE-36","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa37025a-7f20-4cfe-a7d0-38168f49b6d9?source=api-prod","affected":[{"type":"plugin","slug":"lws-cleaner","name":"LWS Cleaner","from":"*","from_inclusive":true,"to":"2.4.1.3","to_inclusive":true,"patched_in":"2.4.2"}],"published":"2025-09-11T00:00:00Z","updated":"2025-09-12T05:24:34Z"},{"id":"wordfence:fa3819b1-8e7c-4e97-bac5-96d73d935845","source":"wordfence","cve":"CVE-2023-25042","title":"oAuth Twitter Feed for Developers <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3819b1-8e7c-4e97-bac5-96d73d935845?source=api-prod","affected":[{"type":"plugin","slug":"oauth-twitter-feed-for-developers","name":"oAuth Twitter Feed for Developers","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":""}],"published":"2023-07-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa39debf-b2c0-4e85-bef9-90e1365f96f8","source":"wordfence","cve":"CVE-2012-2920","title":"User Photo <= 0.9.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa39debf-b2c0-4e85-bef9-90e1365f96f8?source=api-prod","affected":[{"type":"plugin","slug":"user-photo","name":"User Photo","from":"*","from_inclusive":true,"to":"0.9.5","to_inclusive":true,"patched_in":"0.9.5.2"}],"published":"2012-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa3cfa43-b1e7-48d6-ad8c-5bc84a0c97c8","source":"wordfence","cve":"CVE-2024-51584","title":"Marquee Elementor with Posts <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3cfa43-b1e7-48d6-ad8c-5bc84a0c97c8?source=api-prod","affected":[{"type":"plugin","slug":"marquee-elementor","name":"Marquee Elementor with Posts","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:54:42Z"},{"id":"wordfence:fa3d4308-0e34-4749-a7da-935d416ad2d0","source":"wordfence","cve":"CVE-2013-3720","title":"Feedweb < 1.9 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3d4308-0e34-4749-a7da-935d416ad2d0?source=api-prod","affected":[{"type":"plugin","slug":"feedweb","name":"Feedweb","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":false,"patched_in":"1.9"}],"published":"2013-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa412364-2e22-439f-8f94-2c525cfbf1a7","source":"wordfence","cve":"CVE-2025-27286","title":"Saoshyant Slider <= 3.0 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa412364-2e22-439f-8f94-2c525cfbf1a7?source=api-prod","affected":[{"type":"plugin","slug":"saoshyant-slider","name":"Saoshyant Slider","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-21T00:00:00Z","updated":"2025-03-03T21:42:47Z"},{"id":"wordfence:fa41534d-3285-4002-8cca-a390586dface","source":"wordfence","cve":"CVE-2024-2040","title":"Himer <= 2.1.0 - Cross-Site Request Forgery to Private Group Join","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa41534d-3285-4002-8cca-a390586dface?source=api-prod","affected":[{"type":"theme","slug":"himer","name":"Himer - Social Questions and Answers WordPress Theme","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2024-06-12T00:00:00Z","updated":"2024-07-23T18:29:20Z"},{"id":"wordfence:fa43a647-9c54-4838-aeb6-7e4b89d6bf03","source":"wordfence","cve":"CVE-2026-65538","title":"Machete <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa43a647-9c54-4838-aeb6-7e4b89d6bf03?source=api-prod","affected":[{"type":"plugin","slug":"machete","name":"Machete","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":"5.3"}],"published":"2026-07-23T00:00:00Z","updated":"2026-08-14T15:21:26Z"},{"id":"wordfence:fa452a9a-9e26-41a1-8dea-4bafaf735bee","source":"wordfence","cve":"CVE-2025-4222","title":"Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files","severity":"medium","cvss":5.9,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa452a9a-9e26-41a1-8dea-4bafaf735bee?source=api-prod","affected":[{"type":"plugin","slug":"database-toolset","name":"Database Toolset","from":"*","from_inclusive":true,"to":"1.8.4","to_inclusive":true,"patched_in":""}],"published":"2025-05-02T00:00:00Z","updated":"2025-05-13T17:48:50Z"},{"id":"wordfence:fa45d830-fa28-4d94-a6d5-2dc2b8456cf2","source":"wordfence","cve":"","title":"WordPress Automatic Plugin <= 2.0.3 - Cross-Site Request Forgery to SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa45d830-fa28-4d94-a6d5-2dc2b8456cf2?source=api-prod","affected":[{"type":"plugin","slug":"wp-automatic","name":"WordPress Automatic Plugin","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa4675dd-2742-4353-a519-10332b8379b3","source":"wordfence","cve":"CVE-2025-31026","title":"Comment Validation Reloaded <=  0.5 -  Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4675dd-2742-4353-a519-10332b8379b3?source=api-prod","affected":[{"type":"plugin","slug":"comment-validation-reloaded","name":"Comment Validation Reloaded","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:25:36Z"},{"id":"wordfence:fa4741fa-0871-4f23-b164-94f5e94f5712","source":"wordfence","cve":"CVE-2026-120578","title":"AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4741fa-0871-4f23-b164-94f5e94f5712?source=api-prod","affected":[{"type":"plugin","slug":"ai-alt-text-generator","name":"AI Alt Text Generator","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":true,"patched_in":"2.7.1"}],"published":"2026-10-27T14:17:01Z","updated":"2026-11-03T04:43:11Z"},{"id":"wordfence:fa47a794-e5ce-491d-a10b-c7c5718aa853","source":"wordfence","cve":"CVE-2023-3087","title":"FluentSMTP <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Email Subject","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa47a794-e5ce-491d-a10b-c7c5718aa853?source=api-prod","affected":[{"type":"plugin","slug":"fluent-smtp","name":"FluentSMTP \u2013 WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP","from":"*","from_inclusive":true,"to":"2.2.4","to_inclusive":true,"patched_in":"2.2.5"}],"published":"2023-07-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa48aeb9-5d20-43c4-8177-30730852eeb0","source":"wordfence","cve":"CVE-2025-57957","title":"WooMS <= 9.12 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa48aeb9-5d20-43c4-8177-30730852eeb0?source=api-prod","affected":[{"type":"plugin","slug":"wooms","name":"WooMS","from":"*","from_inclusive":true,"to":"9.12","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T16:01:16Z"},{"id":"wordfence:fa49346c-726e-41f9-8a74-adaa4a8fa5d9","source":"wordfence","cve":"CVE-2023-27922","title":"Newsletter <= 7.6.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa49346c-726e-41f9-8a74-adaa4a8fa5d9?source=api-prod","affected":[{"type":"plugin","slug":"newsletter","name":"Newsletter \u2013 Send awesome emails from WordPress","from":"*","from_inclusive":true,"to":"7.6.8","to_inclusive":true,"patched_in":"7.6.9"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa4ac740-8f57-4d0c-8e04-dcddeeb3c89e","source":"wordfence","cve":"CVE-2025-59010","title":"Permalink Manager Lite <= 2.5.1.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-201","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4ac740-8f57-4d0c-8e04-dcddeeb3c89e?source=api-prod","affected":[{"type":"plugin","slug":"permalink-manager","name":"Permalink Manager Lite","from":"*","from_inclusive":true,"to":"2.5.1.3","to_inclusive":true,"patched_in":"2.5.1.4"}],"published":"2025-09-06T00:00:00Z","updated":"2025-10-15T18:32:57Z"},{"id":"wordfence:fa4bf7dc-07be-4397-957c-ef0c1d61b40a","source":"wordfence","cve":"CVE-2021-24908","title":"Check & Log Email <= 1.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4bf7dc-07be-4397-957c-ef0c1d61b40a?source=api-prod","affected":[{"type":"plugin","slug":"check-email","name":"Check & Log Email \u2013 Easy Email Testing & Mail logging","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":false,"patched_in":"1.0.4"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa4f169a-8970-499d-ad25-028c0d1c9d56","source":"wordfence","cve":"CVE-2014-4535","title":"Import Legacy Media <= 0.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa4f169a-8970-499d-ad25-028c0d1c9d56?source=api-prod","affected":[{"type":"plugin","slug":"import-legacy-media","name":"Import Legacy Media","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa50080e-5717-47df-925d-9fb40f91fccc","source":"wordfence","cve":"CVE-2026-78125","title":"LearnPress \u2013 Sepay Payment < 4.0.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa50080e-5717-47df-925d-9fb40f91fccc?source=api-prod","affected":[{"type":"plugin","slug":"learnpress-sepay-payment","name":"LearnPress \u2013 Sepay Payment","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":false,"patched_in":"4.0.3"}],"published":"2026-08-25T00:00:00Z","updated":"2026-09-02T15:23:47Z"},{"id":"wordfence:fa51a7b8-be74-450f-afb8-6a6c5c8afaa4","source":"wordfence","cve":"CVE-2022-4654","title":"Easy Pricing Tables <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa51a7b8-be74-450f-afb8-6a6c5c8afaa4?source=api-prod","affected":[{"type":"plugin","slug":"easy-pricing-tables","name":"Pricing Table WordPress Plugin \u2013 Easy Pricing Tables","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2023-01-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa52034e-3d11-4be5-ab8b-8f7256be2a3e","source":"wordfence","cve":"CVE-2024-12121","title":"Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa52034e-3d11-4be5-ab8b-8f7256be2a3e?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-finder","name":"Broken Link Checker | Finder","from":"*","from_inclusive":true,"to":"2.5.0","to_inclusive":true,"patched_in":"2.5.1"}],"published":"2024-12-18T00:00:00Z","updated":"2024-12-19T01:45:14Z"},{"id":"wordfence:fa52ecbf-9c8d-4103-acce-255f36c57d0b","source":"wordfence","cve":"CVE-2025-69182","title":"Institutions Directory <= 1.3.4 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa52ecbf-9c8d-4103-acce-255f36c57d0b?source=api-prod","affected":[{"type":"plugin","slug":"institutions-directory","name":"Institutions Directory","from":"*","from_inclusive":true,"to":"1.3.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:06:24Z"},{"id":"wordfence:fa530112-a7cd-4c54-aa87-9e7337d01557","source":"wordfence","cve":"CVE-2022-4709","title":"Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import","severity":"medium","cvss":4.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa530112-a7cd-4c54-aa87-9e7337d01557?source=api-prod","affected":[{"type":"plugin","slug":"royal-elementor-addons","name":"Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor","from":"*","from_inclusive":true,"to":"1.3.59","to_inclusive":true,"patched_in":"1.3.60"}],"published":"2023-01-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa53c5ee-fe7f-4fb2-baaa-2c1a151d4b2c","source":"wordfence","cve":"CVE-2025-15158","title":"WP Enable WebP <= 1.0 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa53c5ee-fe7f-4fb2-baaa-2c1a151d4b2c?source=api-prod","affected":[{"type":"plugin","slug":"wp-enable-webp","name":"WP Enable WebP","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:45:16Z","updated":"2026-01-07T08:21:56Z"},{"id":"wordfence:fa57e8eb-4284-488a-a86e-0f59d432fdca","source":"wordfence","cve":"CVE-2026-84113","title":"Quentn WP <= 1.2.14 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa57e8eb-4284-488a-a86e-0f59d432fdca?source=api-prod","affected":[{"type":"plugin","slug":"quentn-wp","name":"Quentn WP","from":"*","from_inclusive":true,"to":"1.2.14","to_inclusive":true,"patched_in":"1.2.15"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:20:49Z"},{"id":"wordfence:fa586468-d6ff-46a3-97f3-e2e1d365e5b1","source":"wordfence","cve":"CVE-2023-35911","title":"Contact Form Generator <= 2.7.1 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa586468-d6ff-46a3-97f3-e2e1d365e5b1?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-generator","name":"Contact Form Generator : Creative form builder for WordPress","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2023-10-09T00:00:00Z","updated":"2025-06-25T14:18:31Z"},{"id":"wordfence:fa587df5-9d96-4cac-ae5d-2a0485a3a789","source":"wordfence","cve":"CVE-2024-1894","title":"Burst Statistics \u2013 Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa587df5-9d96-4cac-ae5d-2a0485a3a789?source=api-prod","affected":[{"type":"plugin","slug":"burst-statistics","name":"Burst Statistics \u2013 Simple WordPress Analytics (Google Analytics Alternative)","from":"*","from_inclusive":true,"to":"1.5.6.1","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-13T15:27:26Z"},{"id":"wordfence:fa5ae08b-d85f-45aa-9617-ec629b8ec985","source":"wordfence","cve":"CVE-2024-6478","title":"CTT Expresso para WooCommerce <= 3.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5ae08b-d85f-45aa-9617-ec629b8ec985?source=api-prod","affected":[{"type":"plugin","slug":"ctt-expresso-para-woocommerce","name":"CTT Expresso para WooCommerce","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2024-06-01T00:00:00Z","updated":"2025-05-29T22:17:30Z"},{"id":"wordfence:fa5b1bf3-344e-4ae6-87b9-2dcaafd417a5","source":"wordfence","cve":"CVE-2024-12329","title":"Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5b1bf3-344e-4ae6-87b9-2dcaafd417a5?source=api-prod","affected":[{"type":"plugin","slug":"essential-real-estate","name":"Essential Real Estate","from":"*","from_inclusive":true,"to":"5.1.6","to_inclusive":true,"patched_in":"5.1.7"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-12T06:46:35Z"},{"id":"wordfence:fa5c5da8-b8e8-46fd-8b20-45ee296315dd","source":"wordfence","cve":"CVE-2024-13331","title":"WP Dream Carousel <= 1.0.1b - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5c5da8-b8e8-46fd-8b20-45ee296315dd?source=api-prod","affected":[{"type":"plugin","slug":"wp-dream-carousel","name":"WP Dream Carousel","from":"*","from_inclusive":true,"to":"1.0.1b","to_inclusive":true,"patched_in":""}],"published":"2025-01-14T00:00:00Z","updated":"2025-02-25T17:23:25Z"},{"id":"wordfence:fa5c97bc-b06f-4ee8-bbc5-72c348d2c92a","source":"wordfence","cve":"CVE-2021-24552","title":"Simple Events Calendar <= 1.4.0 - Authenticated SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5c97bc-b06f-4ee8-bbc5-72c348d2c92a?source=api-prod","affected":[{"type":"plugin","slug":"simple-events-calendar","name":"Simple Events Calendar","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2021-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa5f1c1b-fb20-4106-a9d3-6e4e304d30be","source":"wordfence","cve":"CVE-2026-42732","title":"Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa5f1c1b-fb20-4106-a9d3-6e4e304d30be?source=api-prod","affected":[{"type":"plugin","slug":"quick-adsense-reloaded","name":"Quads Ads Manager for Google AdSense","from":"*","from_inclusive":true,"to":"3.0.2","to_inclusive":true,"patched_in":"3.0.3"}],"published":"2026-05-24T00:00:00Z","updated":"2026-05-26T19:43:24Z"},{"id":"wordfence:fa62c795-57b8-48e5-a49f-2e1f3c792c87","source":"wordfence","cve":"CVE-2026-11357","title":"Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa62c795-57b8-48e5-a49f-2e1f3c792c87?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.7.5","to_inclusive":true,"patched_in":"3.7.6"}],"published":"2026-06-17T16:14:34Z","updated":"2026-06-18T04:31:12Z"},{"id":"wordfence:fa63a325-9e0e-4ce2-996d-37a0637b0471","source":"wordfence","cve":"CVE-2022-36378","title":"Floating Div <= 3.0 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa63a325-9e0e-4ce2-996d-37a0637b0471?source=api-prod","affected":[{"type":"plugin","slug":"floating-div","name":"Floating Div","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":""}],"published":"2022-07-29T14:12:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa63ba9b-7569-4508-92c2-6ae8b9bef3fd","source":"wordfence","cve":"CVE-2025-23777","title":"GDPR Personal Data Reports <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa63ba9b-7569-4508-92c2-6ae8b9bef3fd?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-personal-data-reports","name":"GDPR Personal Data Reports","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T16:46:08Z"},{"id":"wordfence:fa659c91-bac5-4e9d-b0d4-90861dab0d9d","source":"wordfence","cve":"CVE-2026-16536","title":"Simple Google Calendar Outlook Events Widget <= 3.0.0 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa659c91-bac5-4e9d-b0d4-90861dab0d9d?source=api-prod","affected":[{"type":"plugin","slug":"simple-google-icalendar-widget","name":"Simple Google Calendar Outlook Events Widget","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":true,"patched_in":"3.1.0"}],"published":"2026-07-25T00:00:00Z","updated":"2026-08-21T15:24:37Z"},{"id":"wordfence:fa6b3d83-0a00-4482-94a6-4f551f55a827","source":"wordfence","cve":"CVE-2025-23768","title":"InFunding \u2013 Plugin for Charity & Crowdfunding Website <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa6b3d83-0a00-4482-94a6-4f551f55a827?source=api-prod","affected":[{"type":"plugin","slug":"infunding","name":"InFunding \u2013 Plugin for Charity & Crowdfunding Website","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T00:00:00Z","updated":"2025-02-17T16:34:12Z"},{"id":"wordfence:fa6fc22e-0d30-4c4b-8c8d-13f04ed1aa7c","source":"wordfence","cve":"CVE-2023-47513","title":"ARI Stream Quiz <= 1.3.2 - Authenticated(Contributor+) Content Injection","severity":"medium","cvss":4.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa6fc22e-0d30-4c4b-8c8d-13f04ed1aa7c?source=api-prod","affected":[{"type":"plugin","slug":"ari-stream-quiz","name":"ARI Stream Quiz \u2013 WordPress Quizzes Builder","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2023-11-07T00:00:00Z","updated":"2024-03-22T15:25:13Z"},{"id":"wordfence:fa701f35-88b6-4ba9-bbda-0cbb1b341d84","source":"wordfence","cve":"CVE-2025-15636","title":"Video Gallery \u2013 YouTube Gallery & Responsive Video Playlist <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa701f35-88b6-4ba9-bbda-0cbb1b341d84?source=api-prod","affected":[{"type":"plugin","slug":"youtube-showcase","name":"Video Gallery \u2013 YouTube Gallery, Playlist & Video Grid","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-04-15T00:00:00Z","updated":"2026-04-21T15:02:12Z"},{"id":"wordfence:fa73c2a0-a692-47db-99ca-7e7159fc96aa","source":"wordfence","cve":"CVE-2023-23792","title":"Swatchly \u2013 WooCommerce Variation Swatches for Products <= 1.2.0 - Cross-Site Request Forgery via plugin_activation","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa73c2a0-a692-47db-99ca-7e7159fc96aa?source=api-prod","affected":[{"type":"plugin","slug":"swatchly","name":"Swatchly \u2013 Product Variation Swatches for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":"1.2.1"}],"published":"2023-03-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa7430ca-b102-46c0-869a-05fb004a276f","source":"wordfence","cve":"CVE-2025-27317","title":"RAYS Grid <= 1.3.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa7430ca-b102-46c0-869a-05fb004a276f?source=api-prod","affected":[{"type":"plugin","slug":"rays-grid","name":"RAYS Grid","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-24T00:00:00Z","updated":"2025-03-03T16:41:42Z"},{"id":"wordfence:fa75366a-651c-43d0-a32b-cdabf5b07b66","source":"wordfence","cve":"CVE-2023-25444","title":"JS Help Desk \u2013 Best Help Desk & Support Plugin <= 2.7.7 - Authenticated (Administrator+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa75366a-651c-43d0-a32b-cdabf5b07b66?source=api-prod","affected":[{"type":"plugin","slug":"js-support-ticket","name":"JS Help Desk \u2013 AI-Powered Support & Ticketing System","from":"*","from_inclusive":true,"to":"2.7.7","to_inclusive":true,"patched_in":"2.7.8"}],"published":"2023-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa781206-57d7-47d4-9cd8-20ae38eeef83","source":"wordfence","cve":"CVE-2024-52391","title":"Pie Register Premium < 3.8.3.3 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa781206-57d7-47d4-9cd8-20ae38eeef83?source=api-prod","affected":[{"type":"plugin","slug":"pie-register-premium","name":"Pie Register Premium","from":"*","from_inclusive":true,"to":"3.8.3.3","to_inclusive":false,"patched_in":"3.8.3.3"}],"published":"2024-11-11T00:00:00Z","updated":"2024-11-21T13:50:00Z"},{"id":"wordfence:fa795a7e-9a7a-4686-9f42-df87f49f6e0d","source":"wordfence","cve":"CVE-2024-56248","title":"WPMasterToolKit <= 1.13.1 - Authenticated (Admin+) Arbitrary File Download","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa795a7e-9a7a-4686-9f42-df87f49f6e0d?source=api-prod","affected":[{"type":"plugin","slug":"wpmastertoolkit","name":"WPMasterToolKit (WPMTK) \u2013 All in one plugin","from":"*","from_inclusive":true,"to":"1.13.1","to_inclusive":true,"patched_in":"1.14.0"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T18:40:39Z"},{"id":"wordfence:fa7ca972-ddb0-416b-8c5a-b4e9648ca957","source":"wordfence","cve":"","title":"Booster for WooCommerce <= 5.6.8 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa7ca972-ddb0-416b-8c5a-b4e9648ca957?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-jetpack","name":"Booster for WooCommerce \u2013 PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools","from":"*","from_inclusive":true,"to":"5.6.8","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2022-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa7cf13c-a13f-4302-9ba4-a53c552fe59b","source":"wordfence","cve":"CVE-2025-47512","title":"Tainacan <=  0.21.14 - Unauthenticated Arbitrary File Deletion","severity":"medium","cvss":5.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa7cf13c-a13f-4302-9ba4-a53c552fe59b?source=api-prod","affected":[{"type":"plugin","slug":"tainacan","name":"Tainacan","from":"*","from_inclusive":true,"to":"0.21.14","to_inclusive":true,"patched_in":"0.21.15"}],"published":"2025-05-16T00:00:00Z","updated":"2025-05-20T19:36:47Z"},{"id":"wordfence:fa7e74ee-fd66-41e2-babd-06bdfb32d013","source":"wordfence","cve":"CVE-2022-3360","title":"LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa7e74ee-fd66-41e2-babd-06bdfb32d013?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.1.7.1","to_inclusive":true,"patched_in":"4.1.7.2"}],"published":"2022-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa8124db-ee6a-481d-88c6-4cc84fefcf1c","source":"wordfence","cve":"CVE-2025-3603","title":"Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8124db-ee6a-481d-88c6-4cc84fefcf1c?source=api-prod","affected":[{"type":"plugin","slug":"flynax-bridge","name":"Flynax Bridge","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2025-04-23T19:43:49Z","updated":"2025-11-05T21:25:56Z"},{"id":"wordfence:fa821005-9593-4a84-b4b4-af746da4d6b9","source":"wordfence","cve":"","title":"Contact Form 7 Dynamic Text Extension <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa821005-9593-4a84-b4b4-af746da4d6b9?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-dynamic-text-extension","name":"DTX \u2013 Dynamic Text Extension for Contact Form 7","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa85821b-5769-4ff4-ac92-f558aec86f78","source":"wordfence","cve":"CVE-2025-31833","title":"JobBoard Job listing <= 1.2.7 - Authenticated (Employer+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa85821b-5769-4ff4-ac92-f558aec86f78?source=api-prod","affected":[{"type":"plugin","slug":"job-board-light","name":"JobBoard Job listing plugin","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T14:25:23Z"},{"id":"wordfence:fa86b98c-9690-4ef6-ac50-895035ed2b55","source":"wordfence","cve":"","title":"Smart Slideshow <= 2.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa86b98c-9690-4ef6-ac50-895035ed2b55?source=api-prod","affected":[{"type":"plugin","slug":"smart-slide-show","name":"Smart Slideshow","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":""}],"published":"2012-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa86bcb9-e558-4b60-9473-65cd6f9663fd","source":"wordfence","cve":"CVE-2025-3417","title":"Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa86bcb9-e558-4b60-9473-65cd6f9663fd?source=api-prod","affected":[{"type":"plugin","slug":"embedder","name":"Embedder","from":"1.3","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T18:12:44Z","updated":"2025-04-10T07:02:42Z"},{"id":"wordfence:fa87a84c-1ab2-4bc8-8af3-02836b680066","source":"wordfence","cve":"CVE-2026-24618","title":"Hash Elements <= 1.5.4 - Authenticated (Contributor+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa87a84c-1ab2-4bc8-8af3-02836b680066?source=api-prod","affected":[{"type":"plugin","slug":"hash-elements","name":"Hash Elements","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":"1.5.5"}],"published":"2026-06-12T00:00:00Z","updated":"2026-06-18T13:19:47Z"},{"id":"wordfence:fa8a1e98-8e5b-49d3-8378-f7b5be92f205","source":"wordfence","cve":"CVE-2026-49053","title":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor <= 3.9.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8a1e98-8e5b-49d3-8378-f7b5be92f205?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.9.6","to_inclusive":true,"patched_in":"3.9.7"}],"published":"2026-05-27T00:00:00Z","updated":"2026-06-18T18:30:27Z"},{"id":"wordfence:fa8aac87-f9bd-4426-85da-e434805c66ec","source":"wordfence","cve":"CVE-2025-8777","title":"planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8aac87-f9bd-4426-85da-e434805c66ec?source=api-prod","affected":[{"type":"plugin","slug":"planetcalc","name":"planetcalc","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":""}],"published":"2025-09-29T15:29:31Z","updated":"2025-09-30T03:35:34Z"},{"id":"wordfence:fa8e1df5-2e8a-4c84-83f8-6f6d53d00356","source":"wordfence","cve":"CVE-2024-11903","title":"WP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8e1df5-2e8a-4c84-83f8-6f6d53d00356?source=api-prod","affected":[{"type":"plugin","slug":"wp-ecards-invites","name":"WP eCards \u2013 Branded Digital Greeting Cards","from":"*","from_inclusive":true,"to":"1.3.904","to_inclusive":true,"patched_in":"1.3.905"}],"published":"2024-12-03T00:00:00Z","updated":"2024-12-04T07:32:27Z"},{"id":"wordfence:fa8f0688-8c54-43f8-acea-2aec2fcfbdce","source":"wordfence","cve":"CVE-2026-78284","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8f0688-8c54-43f8-acea-2aec2fcfbdce?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.42","to_inclusive":true,"patched_in":"3.7.43"}],"published":"2026-08-24T00:00:00Z","updated":"2026-09-16T16:06:32Z"},{"id":"wordfence:fa910b80-a496-449c-8227-de7defa1f2ae","source":"wordfence","cve":"CVE-2026-73390","title":"Total Donations <= 2.0.5 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa910b80-a496-449c-8227-de7defa1f2ae?source=api-prod","affected":[{"type":"plugin","slug":"totaldonations","name":"Total Donations","from":"*","from_inclusive":true,"to":"2.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-01T13:23:00Z"},{"id":"wordfence:fa918a65-0021-4c32-9f6d-d978926c3ef3","source":"wordfence","cve":"CVE-2024-23519","title":"Email Before Download <= 6.9.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa918a65-0021-4c32-9f6d-d978926c3ef3?source=api-prod","affected":[{"type":"plugin","slug":"email-before-download","name":"Email Before Download","from":"*","from_inclusive":true,"to":"6.9.7","to_inclusive":true,"patched_in":"6.9.8"}],"published":"2024-01-30T00:00:00Z","updated":"2024-07-01T13:31:43Z"},{"id":"wordfence:fa91912d-5794-4c96-8a13-bd54ce0f1deb","source":"wordfence","cve":"CVE-2024-9548","title":"Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa91912d-5794-4c96-8a13-bd54ce0f1deb?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":true,"patched_in":"5.2.7"}],"published":"2024-10-14T10:42:50Z","updated":"2024-10-14T23:29:56Z"},{"id":"wordfence:fa9450a4-2b96-45e4-b2dc-9a4b26449d19","source":"wordfence","cve":"","title":"Contact Form Email <= 1.3.11 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9450a4-2b96-45e4-b2dc-9a4b26449d19?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-to-email","name":"Contact Form Email","from":"*","from_inclusive":true,"to":"1.3.12","to_inclusive":false,"patched_in":"1.3.12"}],"published":"2015-05-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa95b782-5ac6-4f9b-9865-e33f1bb7d187","source":"wordfence","cve":"CVE-2025-23638","title":"Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa95b782-5ac6-4f9b-9865-e33f1bb7d187?source=api-prod","affected":[{"type":"plugin","slug":"frontend-post-submission","name":"Frontend Post Submission","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-19T00:00:00Z","updated":"2025-03-25T18:07:35Z"},{"id":"wordfence:fa977e6c-6b9d-4fa8-99f3-566d6a71424f","source":"wordfence","cve":"CVE-2024-9374","title":"Terms descriptions <= 3.4.6 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa977e6c-6b9d-4fa8-99f3-566d6a71424f?source=api-prod","affected":[{"type":"plugin","slug":"terms-descriptions","name":"Terms descriptions","from":"*","from_inclusive":true,"to":"3.4.6","to_inclusive":true,"patched_in":"3.4.7"}],"published":"2024-10-23T16:31:52Z","updated":"2024-10-24T04:32:26Z"},{"id":"wordfence:fa980215-3e8f-40e5-9855-12e9fd9258aa","source":"wordfence","cve":"CVE-2025-52728","title":"Responsive Posts Carousel WordPress Plugin <= 15.0 - Authenticated (Subscriber+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa980215-3e8f-40e5-9855-12e9fd9258aa?source=api-prod","affected":[{"type":"plugin","slug":"responsive-posts-carousel-pro","name":"Responsive Posts Carousel WordPress Plugin","from":"*","from_inclusive":true,"to":"15.0","to_inclusive":true,"patched_in":"15.1"}],"published":"2025-08-13T00:00:00Z","updated":"2025-08-19T13:58:31Z"},{"id":"wordfence:fa984d7f-49b9-49c9-9a1c-9e4c8b7f989b","source":"wordfence","cve":"CVE-2024-2509","title":"Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa984d7f-49b9-49c9-9a1c-9e4c8b7f989b?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.2.25","to_inclusive":true,"patched_in":"3.2.26"}],"published":"2024-03-15T00:00:00Z","updated":"2024-04-11T15:24:04Z"},{"id":"wordfence:fa995fa9-5fb1-434a-bf88-c60e986c45eb","source":"wordfence","cve":"CVE-2026-6817","title":"Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'","severity":"medium","cvss":5.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa995fa9-5fb1-434a-bf88-c60e986c45eb?source=api-prod","affected":[{"type":"plugin","slug":"quiz-maker","name":"Quiz Maker by AYS","from":"*","from_inclusive":true,"to":"6.7.1.29","to_inclusive":true,"patched_in":"6.7.1.30"}],"published":"2026-05-01T21:36:24Z","updated":"2026-05-02T11:16:12Z"},{"id":"wordfence:fa9a8227-6e2a-4375-9672-20290ece292c","source":"wordfence","cve":"CVE-2026-12271","title":"Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9a8227-6e2a-4375-9672-20290ece292c?source=api-prod","affected":[{"type":"plugin","slug":"tutor","name":"Tutor LMS \u2013 eLearning and online course solution","from":"*","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.9.13"}],"published":"2026-06-22T00:00:00Z","updated":"2026-07-30T12:15:51Z"},{"id":"wordfence:fa9bf653-5932-4a7b-a004-4d4b21c034a1","source":"wordfence","cve":"","title":"EMC2 Custom Help Videos <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9bf653-5932-4a7b-a004-4d4b21c034a1?source=api-prod","affected":[{"type":"plugin","slug":"emc2-custom-help-videos","name":"EMC2 Custom Help Videos","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fa9ccf59-7022-4be4-b5da-b16fe911a8f1","source":"wordfence","cve":"CVE-2025-31461","title":"NanoSupport <= 0.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9ccf59-7022-4be4-b5da-b16fe911a8f1?source=api-prod","affected":[{"type":"plugin","slug":"nanosupport","name":"NanoSupport \u2014 Support Ticketing & Knowledgebase for WordPress","from":"*","from_inclusive":true,"to":"0.6.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T13:55:55Z"},{"id":"wordfence:fa9e4635-43f8-4f3c-b62c-628e74028f7e","source":"wordfence","cve":"CVE-2023-45630","title":"Responsive Image Gallery, Gallery Album <= 2.0.3 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9e4635-43f8-4f3c-b62c-628e74028f7e?source=api-prod","affected":[{"type":"plugin","slug":"gallery-album","name":"Gallery \u2013 Image and Video Gallery with Thumbnails","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2023-10-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faa16751-6933-41e0-b4d2-0daedc5ec050","source":"wordfence","cve":"CVE-2025-31571","title":"The Logo Slider <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa16751-6933-41e0-b4d2-0daedc5ec050?source=api-prod","affected":[{"type":"plugin","slug":"the-logo-slider","name":"The Logo Slider","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-09T14:25:37Z"},{"id":"wordfence:faa3eb51-fdee-443e-aacb-04900f609efd","source":"wordfence","cve":"CVE-2024-32595","title":"WP Helper Premium < 4.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa3eb51-fdee-443e-aacb-04900f609efd?source=api-prod","affected":[{"type":"plugin","slug":"wp-helper-lite","name":"WP Helper Premium","from":"*","from_inclusive":true,"to":"4.6.0","to_inclusive":false,"patched_in":"4.6.0"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T13:49:32Z"},{"id":"wordfence:faa3f6ab-43d6-4874-b16e-93abbb4ba72e","source":"wordfence","cve":"CVE-2022-4774","title":"Bit Form <= 1.8.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa3f6ab-43d6-4874-b16e-93abbb4ba72e?source=api-prod","affected":[{"type":"plugin","slug":"bit-form","name":"Bit Form \u2013 Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.9"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faa4f041-4740-4ebb-afb3-10019ce571be","source":"wordfence","cve":"CVE-2023-4774","title":"WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4f041-4740-4ebb-afb3-10019ce571be?source=api-prod","affected":[{"type":"plugin","slug":"wp-piwik","name":"Connect Matomo \u2013 Analytics Dashboard for WordPress","from":"*","from_inclusive":true,"to":"1.0.28","to_inclusive":true,"patched_in":"1.0.29"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faa4fba5-cd19-4b96-aa09-07ed6d52a107","source":"wordfence","cve":"CVE-2023-0550","title":"Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference","severity":"high","cvss":8.1,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107?source=api-prod","affected":[{"type":"plugin","slug":"quick-restaurant-menu","name":"Quick Restaurant Menu","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faa6ad51-7b3b-4fe1-95fa-e9b63943d533","source":"wordfence","cve":"CVE-2026-6048","title":"Flipbox Addon for Elementor <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6ad51-7b3b-4fe1-95fa-e9b63943d533?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-flipbox-addon-for-elementor","name":"Flipbox Addon for Elementor","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2026-04-17T14:40:16Z","updated":"2026-04-18T03:37:05Z"},{"id":"wordfence:faa6c744-7586-47ee-b2ce-af972ee8b4f7","source":"wordfence","cve":"CVE-2026-4146","title":"Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6c744-7586-47ee-b2ce-af972ee8b4f7?source=api-prod","affected":[{"type":"plugin","slug":"loco-translate","name":"Loco Translate","from":"*","from_inclusive":true,"to":"2.8.2","to_inclusive":true,"patched_in":"2.8.3"}],"published":"2026-03-30T15:35:09Z","updated":"2026-03-31T04:25:34Z"},{"id":"wordfence:faa6ecad-1430-4300-b314-53619d69837b","source":"wordfence","cve":"CVE-2024-52436","title":"Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6ecad-1430-4300-b314-53619d69837b?source=api-prod","affected":[{"type":"plugin","slug":"post-smtp","name":"Post SMTP \u2013 Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":true,"patched_in":"2.9.10"}],"published":"2024-11-15T00:00:00Z","updated":"2024-12-05T16:49:32Z"},{"id":"wordfence:faa9ad87-44b2-47b3-a05c-52e59af7255a","source":"wordfence","cve":"CVE-2023-47836","title":"WP Meta and Date Remover <= 2.3.0 - Cross-Site Request Forgery via updateSettings","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faa9ad87-44b2-47b3-a05c-52e59af7255a?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-and-date-remover","name":"WP Meta and Date Remover","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2023-11-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faaa7b98-d762-4e5e-9178-a419de2629c6","source":"wordfence","cve":"CVE-2024-1663","title":"Ultimate Noindex Nofollow Tool II <= 1.3.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faaa7b98-d762-4e5e-9178-a419de2629c6?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-noindex-nofollow-tool-ii","name":"Ultimate Noindex Nofollow Tool II","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2024-03-25T00:00:00Z","updated":"2025-05-29T18:50:11Z"},{"id":"wordfence:faaade72-35d9-4597-812b-758fa2641472","source":"wordfence","cve":"CVE-2014-9119","title":"DB Backup < 5.0 - Directory Traversal","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faaade72-35d9-4597-812b-758fa2641472?source=api-prod","affected":[{"type":"plugin","slug":"db-backup","name":"DB Backup","from":"*","from_inclusive":true,"to":"5.0","to_inclusive":false,"patched_in":"5.0"}],"published":"2014-12-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faac24e5-94f2-40e5-932e-93ddc2c8af7c","source":"wordfence","cve":"CVE-2023-23706","title":"WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faac24e5-94f2-40e5-932e-93ddc2c8af7c?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-openid","name":"Social Login, Social Sharing by miniOrange","from":"*","from_inclusive":true,"to":"7.5.14","to_inclusive":true,"patched_in":"7.5.15"}],"published":"2023-02-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faac4bcd-678a-4618-95ba-3e5567f0e971","source":"wordfence","cve":"CVE-2025-3662","title":"FancyBox for WordPress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faac4bcd-678a-4618-95ba-3e5567f0e971?source=api-prod","affected":[{"type":"plugin","slug":"fancybox-for-wordpress","name":"FancyBox for WordPress","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2025-05-13T00:00:00Z","updated":"2025-06-06T14:15:49Z"},{"id":"wordfence:faacefad-eb8a-4c8b-967a-6167ab5492fd","source":"wordfence","cve":"CVE-2026-112850","title":"Your Dress <= 1.4.1 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faacefad-eb8a-4c8b-967a-6167ab5492fd?source=api-prod","affected":[{"type":"theme","slug":"your-dress","name":"Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-28T16:56:59Z"},{"id":"wordfence:faad339f-96d6-4937-a1f3-9d2d19bc6395","source":"wordfence","cve":"CVE-2023-2561","title":"Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faad339f-96d6-4937-a1f3-9d2d19bc6395?source=api-prod","affected":[{"type":"plugin","slug":"gallery-metabox","name":"Gallery Metabox","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2023-06-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faad9cf7-5d83-4ade-b121-c38fb0de78a5","source":"wordfence","cve":"CVE-2023-41871","title":"Poll Maker <= 4.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faad9cf7-5d83-4ade-b121-c38fb0de78a5?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"4.7.1"}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faafa3d3-a4b7-40a5-9133-c953f921ba55","source":"wordfence","cve":"CVE-2025-23506","title":"WP IMAP Auth <= 4.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faafa3d3-a4b7-40a5-9133-c953f921ba55?source=api-prod","affected":[{"type":"plugin","slug":"wp-imap-authentication","name":"WP IMAP Auth","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T15:38:51Z"},{"id":"wordfence:fab0a42e-fa99-4451-91fd-c924a33d33c8","source":"wordfence","cve":"CVE-2025-26921","title":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.2.6 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fab0a42e-fa99-4451-91fd-c924a33d33c8?source=api-prod","affected":[{"type":"plugin","slug":"booking-and-rental-manager-for-woocommerce","name":"Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2025-02-23T00:00:00Z","updated":"2025-04-17T14:36:07Z"},{"id":"wordfence:fab4db72-e8d6-4417-ba40-a55f395beb35","source":"wordfence","cve":"CVE-2025-31825","title":"Category Icon <= 1.0.1 - Authenticated (Author+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fab4db72-e8d6-4417-ba40-a55f395beb35?source=api-prod","affected":[{"type":"plugin","slug":"category-icon","name":"Category Icon","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":"1.0.2"}],"published":"2025-04-03T00:00:00Z","updated":"2025-05-21T13:44:35Z"},{"id":"wordfence:fab8c244-9767-45ed-a6c8-85f66fa41122","source":"wordfence","cve":"CVE-2025-3745","title":"WP Lightbox 2 <= 3.0.6.7 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fab8c244-9767-45ed-a6c8-85f66fa41122?source=api-prod","affected":[{"type":"plugin","slug":"wp-lightbox-2","name":"WP Lightbox 2","from":"*","from_inclusive":true,"to":"3.0.6.7","to_inclusive":true,"patched_in":"3.0.6.8"}],"published":"2025-06-09T00:00:00Z","updated":"2025-07-09T15:34:14Z"},{"id":"wordfence:fab8d770-2add-4470-980b-b1ea84b7ab7e","source":"wordfence","cve":"CVE-2026-22480","title":"WebToffee WooCommerce Product Feeds \u2013 Google Shopping, Pinterest, TikTok Ads, & More <= 2.3.3 - Authenticated (Shop manager+) PHP Object Injection","severity":"medium","cvss":6.6,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fab8d770-2add-4470-980b-b1ea84b7ab7e?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-product-feed","name":"WebToffee WooCommerce Product Feeds \u2013 Google Shopping, Pinterest, TikTok Ads, & More","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":"2.3.4"}],"published":"2026-03-05T00:00:00Z","updated":"2026-03-12T17:12:52Z"},{"id":"wordfence:fabc7ad3-1d20-493f-aacb-1832d33d8e14","source":"wordfence","cve":"CVE-2023-48738","title":"Porto Theme - Functionality <= 2.11.1 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fabc7ad3-1d20-493f-aacb-1832d33d8e14?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"2.11.1","to_inclusive":true,"patched_in":"2.12.1"}],"published":"2023-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fabcfaee-54b5-409f-b023-71aebdda2e00","source":"wordfence","cve":"CVE-2026-25304","title":"Jaroti < 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fabcfaee-54b5-409f-b023-71aebdda2e00?source=api-prod","affected":[{"type":"theme","slug":"jaroti","name":"Jaroti - Elementor Accessories WooCommerce Theme","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T13:38:45Z"},{"id":"wordfence:fabd576c-6990-40a1-9a94-ecb63e2b0189","source":"wordfence","cve":"CVE-2014-9129","title":"CM Download Manager <= 2.0.6 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fabd576c-6990-40a1-9a94-ecb63e2b0189?source=api-prod","affected":[{"type":"plugin","slug":"cm-download-manager","name":"CM Download Manager \u2013 Organize, Protect & Share Files in WordPress","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2014-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fabeeba6-f3c0-4f9c-a12f-c97801aad810","source":"wordfence","cve":"CVE-2024-11807","title":"NPS computy <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fabeeba6-f3c0-4f9c-a12f-c97801aad810?source=api-prod","affected":[{"type":"plugin","slug":"nps-computy","name":"NPS computy","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.8.1"}],"published":"2024-12-03T14:21:57Z","updated":"2024-12-04T02:40:28Z"},{"id":"wordfence:fac1669b-4a86-4542-b34d-fea44127e41c","source":"wordfence","cve":"CVE-2025-69405","title":"Lorem Ipsum | Books & Media Store <= 1.2.6 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac1669b-4a86-4542-b34d-fea44127e41c?source=api-prod","affected":[{"type":"theme","slug":"lorem-ipsum-books-media-store","name":"Lorem Ipsum","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-11T00:00:00Z","updated":"2026-02-16T22:28:18Z"},{"id":"wordfence:fac1e55f-7027-494d-8beb-9a23e0fc2e00","source":"wordfence","cve":"CVE-2024-5715","title":"WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via Member Edit","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac1e55f-7027-494d-8beb-9a23e0fc2e00?source=api-prod","affected":[{"type":"plugin","slug":"wp-eMember","name":"Wp EMember","from":"*","from_inclusive":true,"to":"10.6.6","to_inclusive":true,"patched_in":"10.6.7"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-23T19:45:21Z"},{"id":"wordfence:fac29bb3-e534-4bee-9974-5ccac7d445db","source":"wordfence","cve":"","title":"Daily Edition <= 1.6.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac29bb3-e534-4bee-9974-5ccac7d445db?source=api-prod","affected":[{"type":"theme","slug":"dailyedition","name":"Daily Edition","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2015-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fac308c6-780d-44ea-ba78-d15e1ee260e4","source":"wordfence","cve":"CVE-2014-9413","title":"IP Ban <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac308c6-780d-44ea-ba78-d15e1ee260e4?source=api-prod","affected":[{"type":"plugin","slug":"simple-ip-ban","name":"IP Ban","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fac4ae61-cfc6-4efc-9f57-58fa39e00f07","source":"wordfence","cve":"CVE-2026-12430","title":"Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac4ae61-cfc6-4efc-9f57-58fa39e00f07?source=api-prod","affected":[{"type":"plugin","slug":"blocksy-companion","name":"Blocksy Companion","from":"*","from_inclusive":true,"to":"2.1.45","to_inclusive":true,"patched_in":"2.1.46"}],"published":"2026-06-18T15:44:31Z","updated":"2026-06-19T04:31:35Z"},{"id":"wordfence:fac55d78-fc5e-48d0-843e-511f2bbaf63c","source":"wordfence","cve":"CVE-2023-26001","title":"Next Event Calendar <= 1.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac55d78-fc5e-48d0-843e-511f2bbaf63c?source=api-prod","affected":[{"type":"plugin","slug":"next-event-calendar","name":"Next Event Calendar","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T20:06:33Z"},{"id":"wordfence:fac81cc0-c6c9-4009-aacb-52adc70c0261","source":"wordfence","cve":"CVE-2025-6057","title":"WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac81cc0-c6c9-4009-aacb-52adc70c0261?source=api-prod","affected":[{"type":"plugin","slug":"wpbookit","name":"WPBookit","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":"1.0.5"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-12T04:22:22Z"},{"id":"wordfence:fac8669b-84c0-4388-8e3e-cd1be2ae5ba3","source":"wordfence","cve":"CVE-2026-27370","title":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty <= 3.5.1 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac8669b-84c0-4388-8e3e-cd1be2ae5ba3?source=api-prod","affected":[{"type":"plugin","slug":"chaty","name":"Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button \u2013 Chaty","from":"*","from_inclusive":true,"to":"3.5.1","to_inclusive":true,"patched_in":"3.5.2"}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T18:06:16Z"},{"id":"wordfence:fac89439-bd0a-4772-858d-d11dd0de54b6","source":"wordfence","cve":"CVE-2024-10116","title":"Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac89439-bd0a-4772-858d-d11dd0de54b6?source=api-prod","affected":[{"type":"plugin","slug":"twitter-follow","name":"FireCask\u2019s Twitter Follow Button","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":"0.3"}],"published":"2024-11-22T15:00:53Z","updated":"2024-11-23T03:36:43Z"},{"id":"wordfence:fac8def6-f5c1-4cd0-bda3-e0f8469accea","source":"wordfence","cve":"CVE-2024-53794","title":"Arkhe Blocks <= 2.27.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac8def6-f5c1-4cd0-bda3-e0f8469accea?source=api-prod","affected":[{"type":"plugin","slug":"arkhe-blocks","name":"Arkhe Blocks","from":"*","from_inclusive":true,"to":"2.27.0","to_inclusive":true,"patched_in":"2.27.1"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-11T18:39:19Z"},{"id":"wordfence:fac90d55-9ae2-48a8-b82b-fe1626556c7b","source":"wordfence","cve":"CVE-2024-8960","title":"Cowidgets \u2013 Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fac90d55-9ae2-48a8-b82b-fe1626556c7b?source=api-prod","affected":[{"type":"plugin","slug":"cowidgets-elementor-addons","name":"Cowidgets \u2013 Elementor Addons","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T14:03:51Z","updated":"2024-11-09T02:32:04Z"},{"id":"wordfence:facb10e9-23f3-4152-bc9a-cecaafebea94","source":"wordfence","cve":"CVE-2014-9012","title":"Backup and Restore WordPress \u2013 Backup Plugin <= 1.9 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/facb10e9-23f3-4152-bc9a-cecaafebea94?source=api-prod","affected":[{"type":"plugin","slug":"wp-backitup","name":"WP BackItUp Community Edition","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"1.9.1"}],"published":"2014-07-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:facb9fd5-86e7-4dc1-affc-eae7aeae5631","source":"wordfence","cve":"CVE-2025-47479","title":"WP Compress <= 6.30.30 - Unauthenticated Broken Authentication","severity":"high","cvss":7.3,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/facb9fd5-86e7-4dc1-affc-eae7aeae5631?source=api-prod","affected":[{"type":"plugin","slug":"wp-compress-image-optimizer","name":"WP Compress \u2013 Instant Performance & Speed Optimization","from":"*","from_inclusive":true,"to":"6.30.30","to_inclusive":true,"patched_in":"6.30.31"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:03:46Z"},{"id":"wordfence:facba004-fc2a-4ba0-aabf-551b5f11e567","source":"wordfence","cve":"CVE-2024-52476","title":"Fediverse Embeds <= 1.5.3 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/facba004-fc2a-4ba0-aabf-551b5f11e567?source=api-prod","affected":[{"type":"plugin","slug":"fediverse-embeds","name":"Fediverse Embeds","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":"1.5.4"}],"published":"2024-11-19T00:00:00Z","updated":"2024-11-26T16:25:52Z"},{"id":"wordfence:facf765a-ddce-485b-adce-99ee22262951","source":"wordfence","cve":"","title":"All in One Invite Codes <= 1.0.14 - Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/facf765a-ddce-485b-adce-99ee22262951?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-invite-codes","name":"All in One Invite Codes","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":"1.0.15"}],"published":"2022-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:facfa21a-4136-4161-ac39-8b18948ec073","source":"wordfence","cve":"CVE-2023-25028","title":"CC Custom Taxonomy <= 1.0.1 - Authenticated (Administrator+) Cross Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/facfa21a-4136-4161-ac39-8b18948ec073?source=api-prod","affected":[{"type":"plugin","slug":"cc-custom-taxonmy","name":"CC Custom Taxonomy","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fad492f4-7112-4f4f-8825-c42aab552c9b","source":"wordfence","cve":"CVE-2024-22158","title":"PeepSo Core: Photos < 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fad492f4-7112-4f4f-8825-c42aab552c9b?source=api-prod","affected":[{"type":"plugin","slug":"peepso-photos","name":"PeepSo Core: Photos","from":"*","from_inclusive":true,"to":"6.3.1.0","to_inclusive":false,"patched_in":"6.3.1.0"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fad510b7-85f4-4cae-aaf0-eb68a32cf1b4","source":"wordfence","cve":"CVE-2023-44989","title":"CF7 Google Sheets Connector <= 5.0.5 - Unauthenticated Sensitive Information Exposure via Debug Log","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fad510b7-85f4-4cae-aaf0-eb68a32cf1b4?source=api-prod","affected":[{"type":"plugin","slug":"cf7-google-sheets-connector","name":"GSheetConnector \u2013 CF7 Google Sheets Connector & Save CF7 Entries to Database","from":"*","from_inclusive":true,"to":"5.0.5","to_inclusive":true,"patched_in":"5.0.6"}],"published":"2023-11-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fad8ad54-56eb-40fa-a357-77b7d656d378","source":"wordfence","cve":"CVE-2025-15487","title":"Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fad8ad54-56eb-40fa-a357-77b7d656d378?source=api-prod","affected":[{"type":"plugin","slug":"code-explorer","name":"Code Explorer","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:44:36Z","updated":"2026-02-04T08:25:33Z"},{"id":"wordfence:fadc1374-fe4d-414a-af84-1a4de5b89807","source":"wordfence","cve":"","title":"404 Solution <= 2.33.0 - Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fadc1374-fe4d-414a-af84-1a4de5b89807?source=api-prod","affected":[{"type":"plugin","slug":"404-solution","name":"404 Solution: Redirection and Page Suggestions","from":"*","from_inclusive":true,"to":"2.33.0","to_inclusive":true,"patched_in":"2.33.1"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fadd7934-bdd9-47e9-bd34-d162ff3b7cd4","source":"wordfence","cve":"CVE-2025-9633","title":"LH Signing <= 2.83 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fadd7934-bdd9-47e9-bd34-d162ff3b7cd4?source=api-prod","affected":[{"type":"plugin","slug":"lh-signing","name":"LH Signing","from":"*","from_inclusive":true,"to":"2.83","to_inclusive":true,"patched_in":""}],"published":"2025-09-10T18:43:52Z","updated":"2025-09-11T07:25:04Z"},{"id":"wordfence:fade2a56-9591-428b-aaeb-facedda70e70","source":"wordfence","cve":"CVE-2026-42703","title":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder <= 2.4.27 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fade2a56-9591-428b-aaeb-facedda70e70?source=api-prod","affected":[{"type":"plugin","slug":"kali-forms","name":"Kali Forms \u2014 Contact Form & Drag-and-Drop Builder","from":"*","from_inclusive":true,"to":"2.4.27","to_inclusive":true,"patched_in":"2.4.28"}],"published":"2026-10-29T13:01:00Z","updated":"2026-11-03T19:58:52Z"},{"id":"wordfence:fadfe181-cc30-407c-baec-dc8f70cffe27","source":"wordfence","cve":"CVE-2023-23687","title":"Youtube Shortcode <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fadfe181-cc30-407c-baec-dc8f70cffe27?source=api-prod","affected":[{"type":"plugin","slug":"youtube-shortcode","name":"Youtube shortcode","from":"*","from_inclusive":true,"to":"1.8.5","to_inclusive":true,"patched_in":""}],"published":"2023-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fae1b795-8939-4229-8f89-fedf6f320ec1","source":"wordfence","cve":"","title":"All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae1b795-8939-4229-8f89-fedf6f320ec1?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-security-and-firewall","name":"All-In-One Security (AIOS) \u2013 Security and Firewall","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fae39bf9-8ceb-4cb1-afd1-522c885e6ef5","source":"wordfence","cve":"CVE-2026-17161","title":"WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae39bf9-8ceb-4cb1-afd1-522c885e6ef5?source=api-prod","affected":[{"type":"plugin","slug":"product-blocks","name":"WowStore \u2013 Store Builder & Product Blocks for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.24","to_inclusive":true,"patched_in":"4.5.0"}],"published":"2026-07-28T13:20:36Z","updated":"2026-07-29T01:29:44Z"},{"id":"wordfence:fae586f3-dc4b-45ee-83b2-cdaa0336fe07","source":"wordfence","cve":"CVE-2023-24006","title":"WP Terms Popup <= 2.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae586f3-dc4b-45ee-83b2-cdaa0336fe07?source=api-prod","affected":[{"type":"plugin","slug":"wp-terms-popup","name":"WP Terms Popup \u2013 Terms and Conditions and Privacy Policy WordPress Popups","from":"*","from_inclusive":true,"to":"2.6.0","to_inclusive":true,"patched_in":"2.6.1"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fae6e691-0d2a-4784-8ab1-4923d650a703","source":"wordfence","cve":"CVE-2022-2133","title":"OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.22.5 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae6e691-0d2a-4784-8ab1-4923d650a703?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-login-with-eve-online-google-facebook","name":"OAuth Single Sign On \u2013 SSO (OAuth Client)","from":"*","from_inclusive":true,"to":"6.22.5","to_inclusive":true,"patched_in":"6.22.6"}],"published":"2022-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fae793f2-8cb5-49d3-9c8c-2a8377552fcd","source":"wordfence","cve":"CVE-2025-25100","title":"Cazamba <= 1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae793f2-8cb5-49d3-9c8c-2a8377552fcd?source=api-prod","affected":[{"type":"plugin","slug":"cazamba","name":"Cazamba","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T17:15:51Z"},{"id":"wordfence:fae8a397-bbe9-4acf-a35e-9bad67df69f1","source":"wordfence","cve":"CVE-2024-50476","title":"GR\u00dcN spendino Spendenformular <= 1.0.1 - Unauthenticated Arbitrary Options Update","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae8a397-bbe9-4acf-a35e-9bad67df69f1?source=api-prod","affected":[{"type":"plugin","slug":"spendino","name":"GR\u00dcN spendino Spendenformular \u2013 Mehr Spenden! Weniger Arbeit!","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:11:40Z"},{"id":"wordfence:fae9f282-eb67-4ad9-be2d-677238527934","source":"wordfence","cve":"CVE-2014-8607","title":"Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure","severity":"high","cvss":7.2,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fae9f282-eb67-4ad9-be2d-677238527934?source=api-prod","affected":[{"type":"plugin","slug":"xcloner-backup-and-restore","name":"Backup, Restore and Migrate your sites with XCloner","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":false,"patched_in":"3.1.2"}],"published":"2014-10-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8","source":"wordfence","cve":"","title":"Formidable Form Builder <= 2.0.21 - Missing Authorization Checks","severity":"critical","cvss":9.1,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"2.0.21","to_inclusive":true,"patched_in":"2.0.22"}],"published":"2016-02-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faee30bb-ba6e-4d3e-8ca1-79fd676e68f5","source":"wordfence","cve":"CVE-2024-43278","title":"Meta Field Block <= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faee30bb-ba6e-4d3e-8ca1-79fd676e68f5?source=api-prod","affected":[{"type":"plugin","slug":"display-a-meta-field-as-block","name":"Meta Field Block \u2013 Display Custom Fields for ACF, Meta Box and More","from":"*","from_inclusive":true,"to":"1.2.13","to_inclusive":true,"patched_in":"1.2.14"}],"published":"2024-08-16T00:00:00Z","updated":"2024-08-22T12:52:36Z"},{"id":"wordfence:faf020d0-62a2-41cc-ad3b-da3b56ed0d97","source":"wordfence","cve":"CVE-2024-49622","title":"Apa Banner Slider <= 1.0.0 - Cross-Site Request Forgery to SLQ Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf020d0-62a2-41cc-ad3b-da3b56ed0d97?source=api-prod","affected":[{"type":"plugin","slug":"apa-banner-slider","name":"Apa Banner Slider","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-17T00:00:00Z","updated":"2024-10-22T17:34:25Z"},{"id":"wordfence:faf3fb76-847f-447f-b6c6-49bd0d30d3c7","source":"wordfence","cve":"CVE-2005-1687","title":"WordPress Core < 1.5.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf3fb76-847f-447f-b6c6-49bd0d30d3c7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":false,"patched_in":"1.5.1"}],"published":"2005-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faf44730-b975-4057-96dc-7284775500f9","source":"wordfence","cve":"CVE-2026-19801","title":"BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf44730-b975-4057-96dc-7284775500f9?source=api-prod","affected":[{"type":"plugin","slug":"betterlinks","name":"BetterLinks \u2013 Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2026-08-24T13:23:38Z","updated":"2026-08-25T01:26:44Z"},{"id":"wordfence:faf45a8d-1017-476e-8af9-2fbe250e8e19","source":"wordfence","cve":"CVE-2024-11440","title":"Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf45a8d-1017-476e-8af9-2fbe250e8e19?source=api-prod","affected":[{"type":"plugin","slug":"grey-owl-lightbox","name":"Grey Owl Lightbox","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2024-11-20T13:41:22Z","updated":"2025-09-05T15:37:09Z"},{"id":"wordfence:faf5c00e-e92a-4c1f-9081-20cf36ecabbc","source":"wordfence","cve":"CVE-2023-24388","title":"Booking calendar, Appointment Booking System <= 3.2.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf5c00e-e92a-4c1f-9081-20cf36ecabbc?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar","name":"Booking calendar, Appointment Booking System","from":"*","from_inclusive":true,"to":"3.2.3","to_inclusive":true,"patched_in":"3.2.4"}],"published":"2023-01-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:faf822e2-20e7-4618-93ce-02de55b25d8b","source":"wordfence","cve":"CVE-2026-81781","title":"Unbounce Landing Pages <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faf822e2-20e7-4618-93ce-02de55b25d8b?source=api-prod","affected":[{"type":"plugin","slug":"unbounce","name":"Unbounce Landing Pages","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-09-07T13:29:29Z","updated":"2026-09-10T19:18:05Z"},{"id":"wordfence:fafcea5a-1f84-4342-8959-312e3938e4d3","source":"wordfence","cve":"CVE-2026-24545","title":"QR Redirector <= 2.0.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fafcea5a-1f84-4342-8959-312e3938e4d3?source=api-prod","affected":[{"type":"plugin","slug":"qr-redirector","name":"QR Redirector","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2026-05-25T00:00:00Z","updated":"2026-05-26T19:13:26Z"},{"id":"wordfence:fafd0159-25ab-430d-88ef-c4d09d23baa7","source":"wordfence","cve":"CVE-2025-8141","title":"Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fafd0159-25ab-430d-88ef-c4d09d23baa7?source=api-prod","affected":[{"type":"plugin","slug":"wpcf7-redirect","name":"Redirection for Contact Form 7","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2025-08-19T12:31:46Z","updated":"2025-08-20T01:44:36Z"},{"id":"wordfence:fafdd087-9637-41df-bc5a-97e1a02ea744","source":"wordfence","cve":"CVE-2024-1171","title":"Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fafdd087-9637-41df-bc5a-97e1a02ea744?source=api-prod","affected":[{"type":"plugin","slug":"essential-addons-for-elementor-lite","name":"Essential Addons for Elementor \u2013 Popular Elementor Templates & Widgets","from":"*","from_inclusive":true,"to":"5.9.8","to_inclusive":true,"patched_in":"5.9.9"}],"published":"2024-02-12T00:00:00Z","updated":"2024-02-20T18:56:51Z"},{"id":"wordfence:faffd8e3-b110-4ba3-98c1-22aee7f19586","source":"wordfence","cve":"CVE-2022-45360","title":"Commenter Emails <= 2.6.1 - Unauthenticated CSV Injection","severity":"medium","cvss":6.5,"cwe":"CWE-1236","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/faffd8e3-b110-4ba3-98c1-22aee7f19586?source=api-prod","affected":[{"type":"plugin","slug":"commenter-emails","name":"Commenter Emails","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2023-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb037c9f-5d20-46f6-b1ff-34b9d192bad2","source":"wordfence","cve":"CVE-2024-5041","title":"Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb037c9f-5d20-46f6-b1ff-34b9d192bad2?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.10.9","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2024-05-30T00:00:00Z","updated":"2024-05-31T09:31:41Z"},{"id":"wordfence:fb04865e-e238-4227-bd9b-e05dcb0d3c53","source":"wordfence","cve":"CVE-2025-30763","title":"EO4WP <= 1.0.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb04865e-e238-4227-bd9b-e05dcb0d3c53?source=api-prod","affected":[{"type":"plugin","slug":"fw-integration-for-emailoctopus","name":"EO4WP: EmailOctopus for WordPress","from":"*","from_inclusive":true,"to":"1.0.8.4","to_inclusive":true,"patched_in":"1.0.8.5"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T19:52:00Z"},{"id":"wordfence:fb051c9a-939c-44cb-8af2-bf841c334cf8","source":"wordfence","cve":"CVE-2024-34415","title":"Thim Elementor Kit <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb051c9a-939c-44cb-8af2-bf841c334cf8?source=api-prod","affected":[{"type":"plugin","slug":"thim-elementor-kit","name":"Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2024-05-06T00:00:00Z","updated":"2024-05-16T12:19:22Z"},{"id":"wordfence:fb057a32-0027-4ca6-b65e-8634509c9a81","source":"wordfence","cve":"CVE-2024-32816","title":"Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel \u2013 Combo Blocks <= 2.2.78 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb057a32-0027-4ca6-b65e-8634509c9a81?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.78","to_inclusive":true,"patched_in":"2.2.79"}],"published":"2024-04-22T00:00:00Z","updated":"2024-04-30T14:27:53Z"},{"id":"wordfence:fb0971cf-f4f6-4e41-9e99-c2ba193e39df","source":"wordfence","cve":"CVE-2024-54343","title":"Connect Contact Form 7 to Constant Contact <= 1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0971cf-f4f6-4e41-9e99-c2ba193e39df?source=api-prod","affected":[{"type":"plugin","slug":"connect-contact-form-7-to-constant-contact-v3","name":"Connect Contact Form 7 to Constant Contact V3","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":"1.5"}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-17T13:40:31Z"},{"id":"wordfence:fb0b00cb-6c14-4ef5-a5a9-34f66abfa166","source":"wordfence","cve":"CVE-2025-31408","title":"Zoho Flow <= 2.13.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0b00cb-6c14-4ef5-a5a9-34f66abfa166?source=api-prod","affected":[{"type":"plugin","slug":"zoho-flow","name":"Zoho Flow \u2013 No-Code Workflow Automation","from":"*","from_inclusive":true,"to":"2.13.3","to_inclusive":true,"patched_in":"2.13.4"}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-10T15:14:58Z"},{"id":"wordfence:fb0b24b6-38da-4650-b542-a31ba8c98fb9","source":"wordfence","cve":"CVE-2019-9909","title":"GiveWP <= 2.3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0b24b6-38da-4650-b542-a31ba8c98fb9?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"2.3.1","to_inclusive":false,"patched_in":"2.3.1"}],"published":"2019-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb0b2e1c-52f2-4f33-9011-e29fd042cf2c","source":"wordfence","cve":"CVE-2025-67954","title":"Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure","severity":"low","cvss":3.1,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0b2e1c-52f2-4f33-9011-e29fd042cf2c?source=api-prod","affected":[{"type":"plugin","slug":"salon-booking-system","name":"Salon Booking System \u2013 Appointment Booking for Salons, Barbershops & Spas","from":"*","from_inclusive":true,"to":"10.30.3","to_inclusive":true,"patched_in":"10.30.4"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:52:59Z"},{"id":"wordfence:fb0ceb76-08ae-40c6-ad28-d013d40dc223","source":"wordfence","cve":"CVE-2025-58249","title":"Qubely <= 1.8.14 - Authenticated (Contributor+) Sensitive Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0ceb76-08ae-40c6-ad28-d013d40dc223?source=api-prod","affected":[{"type":"plugin","slug":"qubely","name":"Qubely \u2013 Advanced Gutenberg Blocks","from":"*","from_inclusive":true,"to":"1.8.14","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2026-11-10T09:47:17Z"},{"id":"wordfence:fb0d093b-c339-4b19-a6cd-d2589b8e57ff","source":"wordfence","cve":"CVE-2023-46076","title":"WooCommerce PDF Invoice Builder <= 1.2.103 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb0d093b-c339-4b19-a6cd-d2589b8e57ff?source=api-prod","affected":[{"type":"plugin","slug":"woo-pdf-invoice-builder","name":"PDF Builder for WooCommerce. Create invoices,packing slips and more","from":"*","from_inclusive":true,"to":"1.2.103","to_inclusive":true,"patched_in":"1.2.104"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb102891-b4a8-4089-b70c-43866ad85b7b","source":"wordfence","cve":"CVE-2023-41134","title":"Antispam Bee <= 2.11.3 - IP Address Spoofing via get_client_ip","severity":"medium","cvss":5.3,"cwe":"CWE-807","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb102891-b4a8-4089-b70c-43866ad85b7b?source=api-prod","affected":[{"type":"plugin","slug":"antispam-bee","name":"Antispam Bee","from":"*","from_inclusive":true,"to":"2.11.3","to_inclusive":true,"patched_in":"2.11.4"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb11ad61-4ee7-45d2-a8e4-388f86bf4a0e","source":"wordfence","cve":"CVE-2022-4099","title":"Joy Of Text Lite \u2013 SMS messaging for WordPress <= 2.3.0 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb11ad61-4ee7-45d2-a8e4-388f86bf4a0e?source=api-prod","affected":[{"type":"plugin","slug":"joy-of-text","name":"Joy Of Text Lite \u2013 SMS messaging for WordPress.","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb1392b4-326a-4a54-be04-972b0716b1de","source":"wordfence","cve":"CVE-2025-26778","title":"Gallery <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1392b4-326a-4a54-be04-972b0716b1de?source=api-prod","affected":[{"type":"plugin","slug":"gallery","name":"gallery","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:06:07Z"},{"id":"wordfence:fb147805-8257-4e61-8922-331d7d5a68cb","source":"wordfence","cve":"CVE-2025-26732","title":"StoreBiz <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb147805-8257-4e61-8922-331d7d5a68cb?source=api-prod","affected":[{"type":"theme","slug":"storebiz","name":"StoreBiz","from":"*","from_inclusive":true,"to":"1.0.32","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:40:33Z"},{"id":"wordfence:fb147a5d-65ad-4304-b13a-670f11398e63","source":"wordfence","cve":"","title":"WPS Cleaner <= 1.4.4 - Missing Authorization Checks","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb147a5d-65ad-4304-b13a-670f11398e63?source=api-prod","affected":[{"type":"plugin","slug":"wps-cleaner","name":"WPS Cleaner","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"}],"published":"2019-07-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb1655b0-108f-4e72-bdcd-105b76023e44","source":"wordfence","cve":"CVE-2026-62086","title":"Juno <= 2.25 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1655b0-108f-4e72-bdcd-105b76023e44?source=api-prod","affected":[{"type":"theme","slug":"junotoys","name":"Juno | Kids Toys & Games Store WordPress Theme","from":"*","from_inclusive":true,"to":"2.25","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-14T15:08:10Z"},{"id":"wordfence:fb165cba-34a9-42d9-bfd5-31a290d02311","source":"wordfence","cve":"CVE-2024-9837","title":"AADMY \u2013 Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb165cba-34a9-42d9-bfd5-31a290d02311?source=api-prod","affected":[{"type":"plugin","slug":"auto-date-year-month","name":"AADMY \u2013 Add Auto Date Month Year Into Posts","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2024-10-14T18:51:37Z","updated":"2024-10-15T07:30:33Z"},{"id":"wordfence:fb167b30-bdb8-4a9b-90e4-5fb030be0cf1","source":"wordfence","cve":"CVE-2026-32531","title":"Kunco < 1.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb167b30-bdb8-4a9b-90e4-5fb030be0cf1?source=api-prod","affected":[{"type":"theme","slug":"kunco","name":"Kunco - Charity & Fundraising WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":false,"patched_in":"1.4.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:20:13Z"},{"id":"wordfence:fb1693c7-4c38-4723-868a-9f105dac1561","source":"wordfence","cve":"CVE-2024-31931","title":"Save as Image  <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1693c7-4c38-4723-868a-9f105dac1561?source=api-prod","affected":[{"type":"plugin","slug":"save-as-image-by-pdfcrowd","name":"Save as Image Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T15:58:50Z"},{"id":"wordfence:fb1735ce-88a9-4796-94cf-2ed213a2ea68","source":"wordfence","cve":"CVE-2026-19726","title":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator < 4.0.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1735ce-88a9-4796-94cf-2ed213a2ea68?source=api-prod","affected":[{"type":"plugin","slug":"visualizer","name":"Visualizer \u2013 Tables & Charts Manager with Built-in AI Generator","from":"*","from_inclusive":true,"to":"4.0.7","to_inclusive":false,"patched_in":"4.0.7"}],"published":"2026-08-20T00:00:00Z","updated":"2026-08-24T16:19:12Z"},{"id":"wordfence:fb19f920-0fd0-491e-9e87-62c828cad9b9","source":"wordfence","cve":"CVE-2025-14169","title":"FunnelKit \u2013 Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.13.1.5","to_inclusive":true,"patched_in":"3.13.1.6"}],"published":"2025-12-11T18:43:58Z","updated":"2025-12-12T07:20:36Z"},{"id":"wordfence:fb19fd06-7b2c-41a1-a470-230da7ce944d","source":"wordfence","cve":"CVE-2023-52176","title":"Malware Scanner <= 4.7.1 - IP Spoofing","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19fd06-7b2c-41a1-a470-230da7ce944d?source=api-prod","affected":[{"type":"plugin","slug":"miniorange-malware-protection","name":"Malware Scanner","from":"*","from_inclusive":true,"to":"4.7.1","to_inclusive":true,"patched_in":"4.7.2"}],"published":"2023-12-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb1a977f-e5ce-425b-8817-c03b2a660265","source":"wordfence","cve":"CVE-2026-32499","title":"WPBot \u2013 AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1a977f-e5ce-425b-8817-c03b2a660265?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"*","from_inclusive":true,"to":"7.7.9","to_inclusive":true,"patched_in":"7.8.0"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:36:36Z"},{"id":"wordfence:fb1cf9f1-7b87-4690-80db-0d4b3ccd98f9","source":"wordfence","cve":"CVE-2022-41612","title":"Similar Posts \u2013 Best Related Posts Plugin for WordPress <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1cf9f1-7b87-4690-80db-0d4b3ccd98f9?source=api-prod","affected":[{"type":"plugin","slug":"similar-posts","name":"Similar Posts \u2013 Best Related Posts Plugin for WordPress","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":""}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb1dbbec-c8c0-4934-ba07-b5b188886bac","source":"wordfence","cve":"CVE-2025-12473","title":"RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1dbbec-c8c0-4934-ba07-b5b188886bac?source=api-prod","affected":[{"type":"plugin","slug":"rometheme-for-elementor","name":"RTMKit for Elementor \u2013 Modular Addons, Widgets, Templates, Icon Library, GSAP Animations, MCP & Store Ready","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2026-03-10T13:04:32Z","updated":"2026-03-11T01:22:05Z"},{"id":"wordfence:fb1f22c2-fdb3-4e3c-b6d5-2e933ec889bd","source":"wordfence","cve":"CVE-2019-15082","title":"360 Product Rotation < 1.4.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1f22c2-fdb3-4e3c-b6d5-2e933ec889bd?source=api-prod","affected":[{"type":"plugin","slug":"360-product-rotation","name":"360 Product Rotation","from":"*","from_inclusive":true,"to":"1.4.8","to_inclusive":false,"patched_in":"1.4.8"}],"published":"2019-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb1f3774-7d5a-44f3-9488-9eb76013e37d","source":"wordfence","cve":"CVE-2025-47636","title":"List category posts <= 0.91.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1f3774-7d5a-44f3-9488-9eb76013e37d?source=api-prod","affected":[{"type":"plugin","slug":"list-category-posts","name":"List category posts","from":"*","from_inclusive":true,"to":"0.91.0","to_inclusive":true,"patched_in":"0.92.0"}],"published":"2025-05-07T00:00:00Z","updated":"2025-09-18T19:02:10Z"},{"id":"wordfence:fb26ea7b-fc54-4cef-aaa8-3a41e8d0c371","source":"wordfence","cve":"CVE-2019-15816","title":"WP Private Content Plus <= 1.31 - Unauthenticated Settings Change","severity":"high","cvss":7.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb26ea7b-fc54-4cef-aaa8-3a41e8d0c371?source=api-prod","affected":[{"type":"plugin","slug":"wp-private-content-plus","name":"WP Private Content Plus","from":"*","from_inclusive":true,"to":"1.31","to_inclusive":true,"patched_in":"2.0"}],"published":"2019-08-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb2777c7-ccc6-4435-9862-c060ff6ceed5","source":"wordfence","cve":"CVE-2026-57754","title":"WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb2777c7-ccc6-4435-9862-c060ff6ceed5?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-07T19:41:19Z"},{"id":"wordfence:fb28c526-67ae-441d-9964-5ac17b966687","source":"wordfence","cve":"CVE-2026-0815","title":"Category Image <= 2.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb28c526-67ae-441d-9964-5ac17b966687?source=api-prod","affected":[{"type":"plugin","slug":"category-image","name":"Category Image","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:03:51Z","updated":"2026-02-11T08:26:28Z"},{"id":"wordfence:fb291c79-8b8e-476b-b6e4-e8428bf60d6e","source":"wordfence","cve":"CVE-2021-24795","title":"Filter Portfolio Gallery <= 1.5 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb291c79-8b8e-476b-b6e4-e8428bf60d6e?source=api-prod","affected":[{"type":"plugin","slug":"filter-portfolio-gallery","name":"Filter Portfolio Gallery","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2021-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb2be4cd-2641-4f7f-993c-1c78e5a1d5da","source":"wordfence","cve":"CVE-2024-6491","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb2be4cd-2641-4f7f-993c-1c78e5a1d5da?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-07-19T17:42:29Z","updated":"2024-07-20T06:43:48Z"},{"id":"wordfence:fb2f463f-2c99-4a6c-92b9-45fb2192381d","source":"wordfence","cve":"CVE-2022-3828","title":"Video Thumbnails <= 2.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb2f463f-2c99-4a6c-92b9-45fb2192381d?source=api-prod","affected":[{"type":"plugin","slug":"video-thumbnails","name":"Video Thumbnails","from":"*","from_inclusive":true,"to":"2.12.3","to_inclusive":true,"patched_in":""}],"published":"2022-11-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb2fffb1-cc8c-46a4-b3ea-2b1aac684fbd","source":"wordfence","cve":"CVE-2024-27948","title":"Atahualpa <= 3.7.24 - Cross-Site Scripting via Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb2fffb1-cc8c-46a4-b3ea-2b1aac684fbd?source=api-prod","affected":[{"type":"theme","slug":"atahualpa","name":"Atahualpa","from":"*","from_inclusive":true,"to":"3.7.24","to_inclusive":true,"patched_in":""}],"published":"2017-03-01T00:00:00Z","updated":"2024-03-04T13:20:00Z"},{"id":"wordfence:fb310bdb-fc74-47b2-9371-3d10abd287fb","source":"wordfence","cve":"CVE-2025-1639","title":"Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb310bdb-fc74-47b2-9371-3d10abd287fb?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor-pro","name":"Animation Addons for Elementor Pro","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-04T03:38:01Z"},{"id":"wordfence:fb33f779-d045-48dd-babe-8b1fab903124","source":"wordfence","cve":"CVE-2023-28621","title":"Wishful Blog <= 2.0.1 & Raise Mag <= 1.0.7 - Unauthenticated Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb33f779-d045-48dd-babe-8b1fab903124?source=api-prod","affected":[{"type":"theme","slug":"raise-mag","name":"Raise Mag","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"theme","slug":"wishful-blog","name":"Wishful Blog","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb364d54-bd44-426f-8f11-8ee5a7527c5d","source":"wordfence","cve":"CVE-2024-32566","title":"WP Club Manager <= 2.2.11 - Authenticated (Player+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb364d54-bd44-426f-8f11-8ee5a7527c5d?source=api-prod","affected":[{"type":"plugin","slug":"wp-club-manager","name":"WP Club Manager \u2013 WordPress Sports Club Plugin","from":"*","from_inclusive":true,"to":"2.2.11","to_inclusive":true,"patched_in":"2.2.12"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-25T11:51:18Z"},{"id":"wordfence:fb3b1429-4d58-41e3-bc99-9d0d38885293","source":"wordfence","cve":"CVE-2023-38481","title":"Integration for WooCommerce and Zoho CRM <= 1.3.6 - Open Redirect via setup_plugin","severity":"medium","cvss":4.3,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb3b1429-4d58-41e3-bc99-9d0d38885293?source=api-prod","affected":[{"type":"plugin","slug":"woo-zoho","name":"Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":false,"patched_in":"1.3.7"}],"published":"2023-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb3e0251-c3b7-4360-87f3-7e4612d4f285","source":"wordfence","cve":"CVE-2025-1777","title":"BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb3e0251-c3b7-4360-87f3-7e4612d4f285?source=api-prod","affected":[{"type":"plugin","slug":"bm-builder","name":"BM Content Builder","from":"*","from_inclusive":true,"to":"3.16.2.1","to_inclusive":true,"patched_in":"3.16.3"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-06T05:22:43Z"},{"id":"wordfence:fb411acc-c58c-4109-a478-639b8b52e862","source":"wordfence","cve":"CVE-2026-42707","title":"HivePress Claim Listings <= 1.1.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb411acc-c58c-4109-a478-639b8b52e862?source=api-prod","affected":[{"type":"plugin","slug":"hivepress-claim-listings","name":"HivePress Claim Listings","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-10-29T13:07:00Z","updated":"2026-11-03T19:59:05Z"},{"id":"wordfence:fb4b5165-35a6-47e9-922e-b244b0d006e4","source":"wordfence","cve":"CVE-2024-1291","title":"Brizy \u2013 Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b5165-35a6-47e9-922e-b244b0d006e4?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.4.40","to_inclusive":true,"patched_in":"2.4.41"}],"published":"2024-02-23T00:00:00Z","updated":"2024-05-31T15:31:00Z"},{"id":"wordfence:fb4b6d33-82cd-4c41-ba54-dbc7fe5f6ac6","source":"wordfence","cve":"CVE-2019-5974","title":"Contest Gallery \u2013 Photo Contest Plugin for WordPress <= 10.4.4 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b6d33-82cd-4c41-ba54-dbc7fe5f6ac6?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"10.4.4","to_inclusive":true,"patched_in":"10.4.5"}],"published":"2019-06-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb4cefe4-a95f-4a80-a8b4-02a3c0d56795","source":"wordfence","cve":"CVE-2025-25139","title":"WP Custom Post RSS Feed <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4cefe4-a95f-4a80-a8b4-02a3c0d56795?source=api-prod","affected":[{"type":"plugin","slug":"wp-custom-post-rss-feed","name":"WP Custom Post RSS Feed","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:09:05Z"},{"id":"wordfence:fb4dc258-a1b2-4e7c-8bba-1b3162b8954b","source":"wordfence","cve":"CVE-2024-49619","title":"Social Link Groups <= 1.1.0 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4dc258-a1b2-4e7c-8bba-1b3162b8954b?source=api-prod","affected":[{"type":"plugin","slug":"social-link-groups","name":"Social Link Groups","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2024-10-18T00:00:00Z","updated":"2024-10-23T16:05:39Z"},{"id":"wordfence:fb50261f-c769-4fbb-a23a-eee3744b5317","source":"wordfence","cve":"CVE-2026-121516","title":"QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb50261f-c769-4fbb-a23a-eee3744b5317?source=api-prod","affected":[{"type":"plugin","slug":"qode-wishlist-for-woocommerce","name":"QODE Wishlist for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.9","to_inclusive":true,"patched_in":"1.3.0"}],"published":"2026-11-06T15:21:38Z","updated":"2026-11-07T03:28:07Z"},{"id":"wordfence:fb509656-3b76-4067-8206-2534fc30bc93","source":"wordfence","cve":"CVE-2026-78534","title":"Educavo - Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb509656-3b76-4067-8206-2534fc30bc93?source=api-prod","affected":[{"type":"theme","slug":"educavo","name":"Educavo - Education WordPress Theme","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T06:32:28Z","updated":"2026-10-13T14:07:19Z"},{"id":"wordfence:fb5100ac-cfe6-4e91-9349-6e8efa850147","source":"wordfence","cve":"CVE-2026-109221","title":"Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping","severity":"high","cvss":8.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5100ac-cfe6-4e91-9349-6e8efa850147?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.9.3","to_inclusive":true,"patched_in":"4.9.4"}],"published":"2026-10-15T15:47:51Z","updated":"2026-10-16T04:27:05Z"},{"id":"wordfence:fb518425-56e0-4a8c-ac51-3c9b2c047f11","source":"wordfence","cve":"CVE-2025-25074","title":"WP Social Stream <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb518425-56e0-4a8c-ac51-3c9b2c047f11?source=api-prod","affected":[{"type":"plugin","slug":"wp-social-stream","name":"WP Social Stream","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:10:29Z"},{"id":"wordfence:fb534d86-c477-4a9c-b048-2fbc002168b2","source":"wordfence","cve":"CVE-2022-40700","title":"CSSTidy - Server-Side Request Forgery","severity":"high","cvss":8.3,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb534d86-c477-4a9c-b048-2fbc002168b2?source=api-prod","affected":[{"type":"plugin","slug":"admin-css-mu","name":"Admin CSS MU","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"},{"type":"plugin","slug":"woosupply","name":"WooSupply \u2013 Suppliers, Supply Orders and Stock Management","from":"*","from_inclusive":true,"to":"1.2.2.","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woovip","name":"WooVIP \u2013 Membership plugin for WordPress and WooCommerce","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"qards-free","name":"WordPress Page Builder \u2013 Qards","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"confirm-data","name":"Confirm Data","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wp-amo","name":"AMO for WP  \u2013 Membership Management","from":"*","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"theme-minifier","name":"Theme Minifier","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woovirtualwallet","name":"WooVirtualWallet \u2013 A virtual wallet for WooCommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"phpfreechat","name":"phpfreechat","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-login-admin-front-end-css-with-multisite-support","name":"Custom Login Admin Front-end CSS","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.5"},{"type":"plugin","slug":"styles","name":"Styles","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"wpopal-core-features","name":"Wpopal Core Features","from":"*","from_inclusive":true,"to":"1.5.7","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"css-adder-by-agence-press","name":"CSS Adder By Agence-Press","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"amp-toolbox","name":"AMP Toolbox","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb53d658-c596-4d5c-a7be-d7c5415f4733","source":"wordfence","cve":"CVE-2024-56258","title":"Magazine Blocks <= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb53d658-c596-4d5c-a7be-d7c5415f4733?source=api-prod","affected":[{"type":"plugin","slug":"magazine-blocks","name":"Magazine Blocks \u2013 Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid","from":"*","from_inclusive":true,"to":"1.3.20","to_inclusive":true,"patched_in":"1.3.21"}],"published":"2024-12-30T00:00:00Z","updated":"2025-01-08T20:14:51Z"},{"id":"wordfence:fb545bba-7bd8-4410-93e9-17194a3b5460","source":"wordfence","cve":"CVE-2026-32438","title":"VW School Education <= 1.4.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb545bba-7bd8-4410-93e9-17194a3b5460?source=api-prod","affected":[{"type":"theme","slug":"vw-school-education","name":"VW School Education","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2026-03-02T00:00:00Z","updated":"2026-04-15T21:05:08Z"},{"id":"wordfence:fb55e036-fcd0-4af5-bdd6-d1b24798eb1b","source":"wordfence","cve":"CVE-2026-110892","title":"SureDash \u2013 Community, Courses & Member Dashboard <= 1.12.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb55e036-fcd0-4af5-bdd6-d1b24798eb1b?source=api-prod","affected":[{"type":"plugin","slug":"suredash","name":"SureDash \u2013 Community, Courses & Member Dashboard","from":"*","from_inclusive":true,"to":"1.12.2","to_inclusive":true,"patched_in":"1.12.3"}],"published":"2026-10-22T07:40:25Z","updated":"2026-10-28T01:15:21Z"},{"id":"wordfence:fb56c071-d7b9-40e0-8cc5-2dd48c93b8cf","source":"wordfence","cve":"CVE-2023-2655","title":"Contact Form Maker <= 1.13.23 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":6.6,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb56c071-d7b9-40e0-8cc5-2dd48c93b8cf?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-maker","name":"Contact Form by WD \u2013 responsive drag & drop contact form builder tool","from":"*","from_inclusive":true,"to":"1.13.23","to_inclusive":true,"patched_in":""}],"published":"2023-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb587e37-473a-4e46-afe3-8285af0fa0d0","source":"wordfence","cve":"CVE-2025-0688","title":"Spiritual Gifts Survey <= 0.9.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb587e37-473a-4e46-afe3-8285af0fa0d0?source=api-prod","affected":[{"type":"plugin","slug":"spiritual-gifts-survey","name":"Spiritual Gifts Survey (and optional S.H.A.P.E survey)","from":"*","from_inclusive":true,"to":"0.9.10","to_inclusive":true,"patched_in":""}],"published":"2025-02-04T00:00:00Z","updated":"2025-02-12T20:26:18Z"},{"id":"wordfence:fb59b19e-7752-4f71-bb86-72f7028666b0","source":"wordfence","cve":"CVE-2026-17565","title":"Animation Addons for Elementor \u2013 GSAP Motion Elementor Addons & Website Templates < 2.7.2 - Unauthenticated Server-Side Request Forgery","severity":"high","cvss":7.2,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb59b19e-7752-4f71-bb86-72f7028666b0?source=api-prod","affected":[{"type":"plugin","slug":"animation-addons-for-elementor","name":"Animation Addons \u2013 Elementor Addons, GSAP Animations, Elementor V4 Atomic Widgets & Elementor Templates","from":"*","from_inclusive":true,"to":"2.7.2","to_inclusive":false,"patched_in":"2.7.2"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:54:24Z"},{"id":"wordfence:fb5a65a2-e748-4c23-8cae-cb0a7de74911","source":"wordfence","cve":"CVE-2020-10564","title":"WordPress File Upload <= 4.12.2 - Directory Traversal to Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5a65a2-e748-4c23-8cae-cb0a7de74911?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.12.2","to_inclusive":true,"patched_in":"4.13.0"}],"published":"2020-03-13T00:00:00Z","updated":"2024-06-17T19:03:48Z"},{"id":"wordfence:fb5c7875-e531-4ee8-bd19-360cbcfef8ed","source":"wordfence","cve":"CVE-2026-32364","title":"Turbo Manager < 4.0.8 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5c7875-e531-4ee8-bd19-360cbcfef8ed?source=api-prod","affected":[{"type":"plugin","slug":"turbo-manager","name":"Turbo Manager","from":"*","from_inclusive":true,"to":"4.0.8","to_inclusive":false,"patched_in":"4.0.8"}],"published":"2026-02-16T00:00:00Z","updated":"2026-05-05T14:07:29Z"},{"id":"wordfence:fb5cb7ce-127a-4f9a-b52e-1e957560ca55","source":"wordfence","cve":"CVE-2022-46845","title":"Slider a SlidersPack <= 2.0.2 - Missing Authorization via wp_spaios_save_attachment_data","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb5cb7ce-127a-4f9a-b52e-1e957560ca55?source=api-prod","affected":[{"type":"plugin","slug":"sliderspack-all-in-one-image-sliders","name":"Slider a SlidersPack \u2013 Image Slider, Post Slider, ACF Gallery Slider","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2023-07-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb61159a-e501-4c55-a384-b6049e0f0bc8","source":"wordfence","cve":"CVE-2025-4474","title":"Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function","severity":"high","cvss":8.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb61159a-e501-4c55-a384-b6049e0f0bc8?source=api-prod","affected":[{"type":"plugin","slug":"frontend-dashboard","name":"Frontend Dashboard","from":"1.0","from_inclusive":true,"to":"2.2.7","to_inclusive":true,"patched_in":"2.2.8"}],"published":"2025-05-12T17:50:15Z","updated":"2025-05-13T06:40:58Z"},{"id":"wordfence:fb62f4c2-ce9f-4958-8b83-cc0d5f4d4647","source":"wordfence","cve":"CVE-2026-0736","title":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb62f4c2-ce9f-4958-8b83-cc0d5f4d4647?source=api-prod","affected":[{"type":"plugin","slug":"collectchat","name":"Chatbot for WordPress by Collect.chat \u26a1\ufe0f","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2026-02-13T18:32:51Z","updated":"2026-02-16T22:02:34Z"},{"id":"wordfence:fb66378c-4e64-4f05-a466-72a3c2d0b330","source":"wordfence","cve":"CVE-2015-9298","title":"Events Manager <= 5.5.7.1 - Code Injection","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb66378c-4e64-4f05-a466-72a3c2d0b330?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"5.6","to_inclusive":false,"patched_in":"5.6"}],"published":"2015-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb66f8f4-1800-41f8-bd67-70d89f612144","source":"wordfence","cve":"CVE-2025-48319","title":"Mesa Mesa Reservation Widget <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb66f8f4-1800-41f8-bd67-70d89f612144?source=api-prod","affected":[{"type":"plugin","slug":"mesa-mesa-reservation-widget","name":"Mesa Mesa Reservation Widget","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-23T00:00:00Z","updated":"2025-08-25T17:18:51Z"},{"id":"wordfence:fb6719d8-18d2-4fa3-9b52-ba11cf567bb2","source":"wordfence","cve":"CVE-2018-1002005","title":"Arigato Autoresponder and Newsletter <= 2.5.1.8 - Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6719d8-18d2-4fa3-9b52-ba11cf567bb2?source=api-prod","affected":[{"type":"plugin","slug":"bft-autoresponder","name":"Arigato Autoresponder and Newsletter","from":"*","from_inclusive":true,"to":"2.5.1.8","to_inclusive":true,"patched_in":"2.5.1.9"}],"published":"2018-09-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb6783b4-f7a5-4f8f-a8d0-5f5c7f91f687","source":"wordfence","cve":"CVE-2025-7811","title":"StreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6783b4-f7a5-4f8f-a8d0-5f5c7f91f687?source=api-prod","affected":[{"type":"plugin","slug":"streamweasels-youtube-integration","name":"StreamWeasels YouTube Integration","from":"*","from_inclusive":true,"to":"1.4.0","to_inclusive":true,"patched_in":"1.4.1"}],"published":"2025-07-28T00:00:00Z","updated":"2025-07-29T03:41:22Z"},{"id":"wordfence:fb6f4b0b-25b8-4dcd-b002-293ce8ab307e","source":"wordfence","cve":"","title":"NitroPack <= 1.9.2 - Missing Authorization via multiple AJAX functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6f4b0b-25b8-4dcd-b002-293ce8ab307e?source=api-prod","affected":[{"type":"plugin","slug":"nitropack","name":"NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization","from":"*","from_inclusive":true,"to":"1.10.0","to_inclusive":false,"patched_in":"1.10.0"}],"published":"2023-11-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb6f9e06-66c1-44db-88cd-008e39dddedd","source":"wordfence","cve":"CVE-2026-24982","title":"Spectra <= 2.19.17 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6f9e06-66c1-44db-88cd-008e39dddedd?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-gutenberg","name":"Spectra Legacy \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.19.17","to_inclusive":true,"patched_in":"2.19.18"}],"published":"2026-01-17T00:00:00Z","updated":"2026-02-10T20:07:22Z"},{"id":"wordfence:fb70339c-0f1a-4acc-af7a-8a0320fdfe71","source":"wordfence","cve":"CVE-2023-41730","title":"SendPress Newsletters <= 1.23.11.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb70339c-0f1a-4acc-af7a-8a0320fdfe71?source=api-prod","affected":[{"type":"plugin","slug":"sendpress","name":"SendPress Newsletters","from":"*","from_inclusive":true,"to":"1.23.11.6","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb7112bb-c76a-4665-b891-8c388ce05d51","source":"wordfence","cve":"CVE-2025-60195","title":"Atarim <= 4.2.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7112bb-c76a-4665-b891-8c388ce05d51?source=api-prod","affected":[{"type":"plugin","slug":"atarim-visual-collaboration","name":"Atarim \u2013 AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback","from":"*","from_inclusive":true,"to":"4.2.1","to_inclusive":true,"patched_in":"4.2.2"}],"published":"2025-07-27T00:00:00Z","updated":"2025-12-12T16:22:28Z"},{"id":"wordfence:fb726242-84fb-47f3-ac43-b43b5b4ae7f0","source":"wordfence","cve":"CVE-2026-14190","title":"Sina Extension for Elementor <= 3.10.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb726242-84fb-47f3-ac43-b43b5b4ae7f0?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.10.1","to_inclusive":true,"patched_in":"3.10.2"}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-29T23:02:25Z"},{"id":"wordfence:fb77413e-3e7a-4315-8dde-59ac4e2534ae","source":"wordfence","cve":"CVE-2026-57644","title":"Restaurant Menu and Food Ordering <= 2.4.10 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb77413e-3e7a-4315-8dde-59ac4e2534ae?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.10","to_inclusive":true,"patched_in":"2.4.11"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:52:18Z"},{"id":"wordfence:fb7b1dda-6758-4ba7-96b8-8fc8327b9992","source":"wordfence","cve":"CVE-2026-14847","title":"Paid Member Subscriptions <= 3.0.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Payment Data Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7b1dda-6758-4ba7-96b8-8fc8327b9992?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2026-07-13T00:00:00Z","updated":"2026-08-21T14:25:02Z"},{"id":"wordfence:fb7d4eee-fd81-4d9d-8d8d-a56870b27874","source":"wordfence","cve":"CVE-2026-5070","title":"Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7d4eee-fd81-4d9d-8d8d-a56870b27874?source=api-prod","affected":[{"type":"theme","slug":"vantage","name":"Vantage","from":"*","from_inclusive":true,"to":"1.20.32","to_inclusive":true,"patched_in":"1.20.33"}],"published":"2026-04-15T14:58:27Z","updated":"2026-04-16T03:36:36Z"},{"id":"wordfence:fb7e7083-59b6-498a-ab02-e578cdf17b1f","source":"wordfence","cve":"CVE-2025-28855","title":"Teleport <= 1.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7e7083-59b6-498a-ab02-e578cdf17b1f?source=api-prod","affected":[{"type":"plugin","slug":"teleport","name":"Teleport","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-02T13:40:54Z"},{"id":"wordfence:fb7e922a-fae0-46f9-b8c1-0986b88f2813","source":"wordfence","cve":"CVE-2022-27231","title":"WP Statistics <= 13.1.7 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7e922a-fae0-46f9-b8c1-0986b88f2813?source=api-prod","affected":[{"type":"plugin","slug":"wp-statistics","name":"WP Statistics \u2013 Simple, privacy-friendly Google Analytics alternative","from":"*","from_inclusive":true,"to":"13.2.0","to_inclusive":false,"patched_in":"13.2.0"}],"published":"2022-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb7fc87c-4680-477e-94f5-9c502edce61d","source":"wordfence","cve":"CVE-2022-0818","title":"WooCommerce Affiliate Plugin - Coupon Affiliates < 4.16.4.5 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7fc87c-4680-477e-94f5-9c502edce61d?source=api-prod","affected":[{"type":"plugin","slug":"woo-coupon-usage","name":"Coupon Affiliates \u2013 Affiliate Plugin for WooCommerce","from":"*","from_inclusive":true,"to":"4.16.4.5","to_inclusive":false,"patched_in":"4.16.4.5"}],"published":"2022-03-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb7fd98d-de1d-4b06-b769-92df40bc1873","source":"wordfence","cve":"CVE-2026-14029","title":"Groundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb7fd98d-de1d-4b06-b769-92df40bc1873?source=api-prod","affected":[{"type":"plugin","slug":"groundhogg","name":"Groundhogg \u2014 CRM, Newsletters, and Marketing Automation","from":"*","from_inclusive":true,"to":"4.5.8","to_inclusive":true,"patched_in":"4.5.9"}],"published":"2026-07-01T20:05:02Z","updated":"2026-07-02T08:33:08Z"},{"id":"wordfence:fb85aacf-a8cf-4054-97fd-b285fcc2a7f9","source":"wordfence","cve":"CVE-2025-60227","title":"WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-73","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb85aacf-a8cf-4054-97fd-b285fcc2a7f9?source=api-prod","affected":[{"type":"plugin","slug":"wp-pipes","name":"WP Pipes","from":"*","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":""}],"published":"2025-07-06T00:00:00Z","updated":"2026-02-04T03:25:32Z"},{"id":"wordfence:fb863896-5a5a-4c65-b2a5-0901de7961f2","source":"wordfence","cve":"CVE-2023-52216","title":"JS & CSS Script Optimizer <= 0.3.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb863896-5a5a-4c65-b2a5-0901de7961f2?source=api-prod","affected":[{"type":"plugin","slug":"js-css-script-optimizer","name":"JS & CSS Script Optimizer","from":"*","from_inclusive":true,"to":"0.3.3","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb87726f-868d-4b2e-b818-d303e695c69c","source":"wordfence","cve":"CVE-2022-1094","title":"amr users <= 4.59.3 - Admin+ Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb87726f-868d-4b2e-b818-d303e695c69c?source=api-prod","affected":[{"type":"plugin","slug":"amr-users","name":"amr users","from":"*","from_inclusive":true,"to":"4.59.4","to_inclusive":false,"patched_in":"4.59.4"}],"published":"2022-04-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb878e2d-3573-4a70-9968-c0cf9676056d","source":"wordfence","cve":"CVE-2024-54418","title":"DTC Documents <= 1.1.05 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb878e2d-3573-4a70-9968-c0cf9676056d?source=api-prod","affected":[{"type":"plugin","slug":"dtc-documents","name":"DTC Documents","from":"*","from_inclusive":true,"to":"1.1.05","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:30:12Z"},{"id":"wordfence:fb88e629-6811-4651-99b9-7394e4a787b6","source":"wordfence","cve":"CVE-2023-3667","title":"Bit Assist <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb88e629-6811-4651-99b9-7394e4a787b6?source=api-prod","affected":[{"type":"plugin","slug":"bit-assist","name":"Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat \u2013 Bit Assist","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb892e06-b32c-4cea-92e5-e214acb91a2f","source":"wordfence","cve":"CVE-2017-18535","title":"SmokeSignal <= 1.2.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb892e06-b32c-4cea-92e5-e214acb91a2f?source=api-prod","affected":[{"type":"plugin","slug":"smokesignal","name":"SmokeSignal","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2017-09-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fb8ac14b-ac65-4169-bef5-36e160e00d62","source":"wordfence","cve":"CVE-2024-34548","title":"All-in-One Addons for Elementor \u2013 WidgetKit <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb8ac14b-ac65-4169-bef5-36e160e00d62?source=api-prod","affected":[{"type":"plugin","slug":"widgetkit-for-elementor","name":"WidgetKit for Elementor \u2013 Lightweight Elementor Addons, Widgets & Templates","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T12:09:16Z"},{"id":"wordfence:fb8d6c59-fa7f-48e3-b571-69179c56edcf","source":"wordfence","cve":"CVE-2025-62072","title":"Front End Users <= 3.2.33 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb8d6c59-fa7f-48e3-b571-69179c56edcf?source=api-prod","affected":[{"type":"plugin","slug":"front-end-only-users","name":"Front End Users","from":"*","from_inclusive":true,"to":"3.2.33","to_inclusive":true,"patched_in":"3.2.34"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:08:36Z"},{"id":"wordfence:fb900810-23a2-4920-a5e8-4388c4474de0","source":"wordfence","cve":"CVE-2025-15100","title":"JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb900810-23a2-4920-a5e8-4388c4474de0?source=api-prod","affected":[{"type":"plugin","slug":"jay-login-register","name":"JAY Login & Register","from":"*","from_inclusive":true,"to":"2.6.03","to_inclusive":true,"patched_in":"2.6.04"}],"published":"2026-02-07T12:47:51Z","updated":"2026-02-08T01:22:56Z"},{"id":"wordfence:fb9115a5-15b9-407d-9e7f-045dae2d3c2b","source":"wordfence","cve":"CVE-2026-14854","title":"WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb9115a5-15b9-407d-9e7f-045dae2d3c2b?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-bookings","name":"WooCommerce Bookings","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.11.0"}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T19:26:49Z"},{"id":"wordfence:fb947f1f-8cce-448d-9c86-1d3c01a4637d","source":"wordfence","cve":"CVE-2023-47552","title":"Image Hover Effects <= 5.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb947f1f-8cce-448d-9c86-1d3c01a4637d?source=api-prod","affected":[{"type":"plugin","slug":"image-hover-effects","name":"Image Hover Effects \u2013 WordPress Plugin","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":"5.6"}],"published":"2023-11-07T00:00:00Z","updated":"2024-05-10T18:20:05Z"},{"id":"wordfence:fb99c935-947e-43a2-8291-c6a0724f8610","source":"wordfence","cve":"CVE-2026-13709","title":"Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb99c935-947e-43a2-8291-c6a0724f8610?source=api-prod","affected":[{"type":"plugin","slug":"graphina-elementor-charts-and-graphs","name":"Graphina \u2013 Charts and Graphs For Elementor","from":"*","from_inclusive":true,"to":"3.1.11","to_inclusive":true,"patched_in":"3.1.12"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-09T02:27:37Z"},{"id":"wordfence:fb9b8f3a-6f49-455d-99c6-cdf5671af49d","source":"wordfence","cve":"CVE-2023-28174","title":"eRocket <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fb9b8f3a-6f49-455d-99c6-cdf5671af49d?source=api-prod","affected":[{"type":"plugin","slug":"erocket","name":"eRocket","from":"*","from_inclusive":true,"to":"1.2.4","to_inclusive":true,"patched_in":"1.2.5"}],"published":"2023-04-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fba01aca-d59f-49ec-bf12-2ad53d39205f","source":"wordfence","cve":"CVE-2026-14572","title":"Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba01aca-d59f-49ec-bf12-2ad53d39205f?source=api-prod","affected":[{"type":"plugin","slug":"kirki","name":"Kirki \u2013 Freeform Page Builder, Website Builder & Customizer","from":"*","from_inclusive":true,"to":"6.2.0","to_inclusive":true,"patched_in":"6.2.1"}],"published":"2026-10-14T16:26:13Z","updated":"2026-10-15T04:26:51Z"},{"id":"wordfence:fba24935-5bab-4395-b05e-7bb5d5a1694d","source":"wordfence","cve":"CVE-2024-6690","title":"WP Content Copy Protection & No Right Click (PRO) <= 15.0 - Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba24935-5bab-4395-b05e-7bb5d5a1694d?source=api-prod","affected":[{"type":"plugin","slug":"wccp-pro","name":"WP Content Copy Protection & No Right Click (PRO)","from":"*","from_inclusive":true,"to":"15.0","to_inclusive":true,"patched_in":"15.3"}],"published":"2024-08-20T00:00:00Z","updated":"2024-08-26T22:40:01Z"},{"id":"wordfence:fba3090f-2cc2-4e40-8080-ae83ba321a67","source":"wordfence","cve":"CVE-2025-12651","title":"Live Photos on WordPress <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba3090f-2cc2-4e40-8080-ae83ba321a67?source=api-prod","affected":[{"type":"plugin","slug":"live-photos","name":"Live Photos on WordPress","from":"*","from_inclusive":true,"to":"0.1","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T14:51:51Z","updated":"2025-11-11T03:30:53Z"},{"id":"wordfence:fba36ebc-a396-4eb8-8cb6-afc50b9c974e","source":"wordfence","cve":"CVE-2025-15477","title":"The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba36ebc-a396-4eb8-8cb6-afc50b9c974e?source=api-prod","affected":[{"type":"plugin","slug":"the-bucketlister","name":"The Bucketlister","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:26:14Z","updated":"2026-02-07T08:26:41Z"},{"id":"wordfence:fba419b8-bab0-4918-8d68-1e5bf75186c2","source":"wordfence","cve":"CVE-2022-4549","title":"Tickera <= 3.4.9.9 - Cross-Site Request Forgery to Plugin Data Deletion & Settings Changes","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba419b8-bab0-4918-8d68-1e5bf75186c2?source=api-prod","affected":[{"type":"plugin","slug":"tickera-event-ticketing-system","name":"Tickera \u2013 Sell Tickets & Manage Events","from":"*","from_inclusive":true,"to":"3.4.9.9","to_inclusive":true,"patched_in":"3.5.1.0"}],"published":"2022-12-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fba6abba-fe29-4a94-bf20-3db78737c275","source":"wordfence","cve":"CVE-2024-13679","title":"Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fba6abba-fe29-4a94-bf20-3db78737c275?source=api-prod","affected":[{"type":"plugin","slug":"buybox-widget","name":"Widget BUY.BOX","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":true,"patched_in":""}],"published":"2025-02-18T19:23:11Z","updated":"2025-02-19T07:32:15Z"},{"id":"wordfence:fbab7310-be30-4bca-a1c4-2ad03f66249c","source":"wordfence","cve":"CVE-2026-81198","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbab7310-be30-4bca-a1c4-2ad03f66249c?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.46","to_inclusive":false,"patched_in":"3.7.46"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:37:44Z"},{"id":"wordfence:fbac8033-9248-4921-86c8-5ad582299bc5","source":"wordfence","cve":"CVE-2026-73394","title":"Stitch Express <= 1.9.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbac8033-9248-4921-86c8-5ad582299bc5?source=api-prod","affected":[{"type":"plugin","slug":"stitch-express","name":"Stitch Express","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-19T00:00:00Z","updated":"2026-08-24T16:12:25Z"},{"id":"wordfence:fbb601ce-a884-4894-af13-dab14885c7eb","source":"wordfence","cve":"CVE-2023-2497","title":"UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbb601ce-a884-4894-af13-dab14885c7eb?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"5.1.0","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2023-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbb7624c-848f-485b-b4df-866ebf45d3a0","source":"wordfence","cve":"CVE-2026-39473","title":"Simple History <= 5.24.0 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbb7624c-848f-485b-b4df-866ebf45d3a0?source=api-prod","affected":[{"type":"plugin","slug":"simple-history","name":"Simple History \u2013 Track, Log, and Audit WordPress Changes","from":"*","from_inclusive":true,"to":"5.24.0","to_inclusive":true,"patched_in":"5.24.1"}],"published":"2026-03-22T00:00:00Z","updated":"2026-05-05T15:10:20Z"},{"id":"wordfence:fbb9b4c8-18b6-4215-a7ee-c5a49977aec7","source":"wordfence","cve":"CVE-2025-57906","title":"Epeken All Kurir <= 2.1.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbb9b4c8-18b6-4215-a7ee-c5a49977aec7?source=api-prod","affected":[{"type":"plugin","slug":"epeken-all-kurir","name":"Epeken All Kurir for Woocommerce","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2025-09-22T00:00:00Z","updated":"2026-09-09T15:53:14Z"},{"id":"wordfence:fbba15aa-9d65-4cb8-867f-667af09ff826","source":"wordfence","cve":"CVE-2024-4970","title":"Widget Bundle <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbba15aa-9d65-4cb8-867f-667af09ff826?source=api-prod","affected":[{"type":"plugin","slug":"wp-widget-bundle","name":"Widget Bundle","from":"*","from_inclusive":true,"to":"2.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-05T16:01:59Z"},{"id":"wordfence:fbba5284-917a-4056-a798-b4d155c58313","source":"wordfence","cve":"CVE-2025-48125","title":"WP Event Manager <= 3.1.51 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbba5284-917a-4056-a798-b4d155c58313?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.1.51","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2025-05-21T00:00:00Z","updated":"2025-08-22T15:44:23Z"},{"id":"wordfence:fbba822b-172f-4167-bccf-4697a298178e","source":"wordfence","cve":"CVE-2024-3820","title":"wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbba822b-172f-4167-bccf-4697a298178e?source=api-prod","affected":[{"type":"plugin","slug":"wpdatatables","name":"wpDataTables (Premium)","from":"*","from_inclusive":true,"to":"6.3.1","to_inclusive":true,"patched_in":"6.3.2"}],"published":"2024-05-31T20:10:54Z","updated":"2024-06-03T12:15:42Z"},{"id":"wordfence:fbbc5c96-7b11-450f-b300-29a6bab9ad6e","source":"wordfence","cve":"CVE-2025-22707","title":"Moody <= 2.7.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbc5c96-7b11-450f-b300-29a6bab9ad6e?source=api-prod","affected":[{"type":"theme","slug":"tm-moody","name":"tm-moody","from":"*","from_inclusive":true,"to":"2.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T17:30:12Z"},{"id":"wordfence:fbbc921e-ccf4-4572-ac76-b2cfe502df44","source":"wordfence","cve":"CVE-2025-1762","title":"Event Tickets with Ticket Scanner <= 2.5.3 - Cross-Site Request Forgery to Arbitrary Ticket Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbc921e-ccf4-4572-ac76-b2cfe502df44?source=api-prod","affected":[{"type":"plugin","slug":"event-tickets-with-ticket-scanner","name":"Event Tickets with Ticket Scanner","from":"*","from_inclusive":true,"to":"2.5.3","to_inclusive":true,"patched_in":"2.5.4"}],"published":"2025-03-06T00:00:00Z","updated":"2025-04-02T14:46:16Z"},{"id":"wordfence:fbbd3209-7ed6-4409-a24e-9f6225cf10f5","source":"wordfence","cve":"CVE-2023-7294","title":"Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'","severity":"high","cvss":7.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbd3209-7ed6-4409-a24e-9f6225cf10f5?source=api-prod","affected":[{"type":"plugin","slug":"paytium","name":"Paytium: Mollie payment forms & donations","from":"*","from_inclusive":true,"to":"4.3.7","to_inclusive":true,"patched_in":"4.4"}],"published":"2023-03-06T00:00:00Z","updated":"2024-10-16T06:43:46Z"},{"id":"wordfence:fbbe006c-1afc-4c8b-a9f3-ffb21cdabb54","source":"wordfence","cve":"CVE-2024-13497","title":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbe006c-1afc-4c8b-a9f3-ffb21cdabb54?source=api-prod","affected":[{"type":"plugin","slug":"tripetto","name":"WordPress form builder plugin for contact forms, surveys and quizzes \u2013 Tripetto","from":"*","from_inclusive":true,"to":"8.0.9","to_inclusive":true,"patched_in":"8.0.10"}],"published":"2025-03-14T15:25:13Z","updated":"2025-03-15T04:22:09Z"},{"id":"wordfence:fbc14a5f-fa6b-47fa-8e8b-502409b18ed6","source":"wordfence","cve":"CVE-2022-2404","title":"WP Popup Builder <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc14a5f-fa6b-47fa-8e8b-502409b18ed6?source=api-prod","affected":[{"type":"plugin","slug":"wp-popup-builder","name":"WP Popup Builder \u2013 Popup Forms and Marketing Lead Generation","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2022-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbc3643c-6116-42d3-b309-2e6aeedfbe4f","source":"wordfence","cve":"CVE-2026-49069","title":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin <= 1.4.21 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc3643c-6116-42d3-b309-2e6aeedfbe4f?source=api-prod","affected":[{"type":"plugin","slug":"wpzoom-portfolio","name":"WPZOOM Portfolio Lite \u2013 Filterable Portfolio Plugin","from":"*","from_inclusive":true,"to":"1.4.21","to_inclusive":true,"patched_in":"1.4.22"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:24:08Z"},{"id":"wordfence:fbc393a6-8357-47b2-9abd-aa611b09eb1c","source":"wordfence","cve":"CVE-2017-16842","title":"Yoast SEO <= 5.7.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc393a6-8357-47b2-9abd-aa611b09eb1c?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"5.7.1","to_inclusive":true,"patched_in":"5.8.0"}],"published":"2017-11-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbc3d194-9e55-4a3d-ac50-024a0b810a50","source":"wordfence","cve":"CVE-2024-43156","title":"Post Grid Master <= 3.4.10 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc3d194-9e55-4a3d-ac50-024a0b810a50?source=api-prod","affected":[{"type":"plugin","slug":"ajax-filter-posts","name":"Post Grid Master \u2014 Post Grids & AJAX Filters","from":"*","from_inclusive":true,"to":"3.4.10","to_inclusive":true,"patched_in":"3.4.11"}],"published":"2024-08-07T00:00:00Z","updated":"2024-08-14T15:14:54Z"},{"id":"wordfence:fbc7e515-c712-4a39-a0f7-c3f646083060","source":"wordfence","cve":"CVE-2023-49848","title":"Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy <= 2.1.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc7e515-c712-4a39-a0f7-c3f646083060?source=api-prod","affected":[{"type":"plugin","slug":"woo-aliexpress-dropshipping","name":"SharkDropship & Affiliate for AliExpress, eBay, Amazon, Etsy and Temu","from":"*","from_inclusive":true,"to":"2.1.1","to_inclusive":true,"patched_in":"2.1.2"}],"published":"2023-12-06T00:00:00Z","updated":"2024-06-05T19:42:15Z"},{"id":"wordfence:fbc8c188-dd68-481c-9584-f9d856db8b7d","source":"wordfence","cve":"CVE-2025-68001","title":"g-FFL Checkout <= 2.1.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc8c188-dd68-481c-9584-f9d856db8b7d?source=api-prod","affected":[{"type":"plugin","slug":"g-ffl-checkout","name":"g-FFL Checkout","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.1.1"}],"published":"2026-01-15T00:00:00Z","updated":"2026-01-19T20:32:16Z"},{"id":"wordfence:fbc8cc43-8509-44e5-bd16-367eca02c24e","source":"wordfence","cve":"CVE-2024-31376","title":"Dashboard To-Do List <= 1.3.1 - Cross-Site Request Forgery via ardtdw_widgetupdate()","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbc8cc43-8509-44e5-bd16-367eca02c24e?source=api-prod","affected":[{"type":"plugin","slug":"dashboard-to-do-list","name":"Dashboard To-Do List","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T14:21:49Z"},{"id":"wordfence:fbcb33c1-d8f4-4ff9-8148-7bce494b2f0f","source":"wordfence","cve":"CVE-2018-19456","title":"WP Backup+ <= 2018-11-22 - Sensitive Information Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbcb33c1-d8f4-4ff9-8148-7bce494b2f0f?source=api-prod","affected":[{"type":"plugin","slug":"wp-backup-plus","name":"WP Backup+","from":"*","from_inclusive":true,"to":"2018-11-22","to_inclusive":true,"patched_in":""}],"published":"2019-05-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbcd569d-f524-4012-add0-ba0afc19e47e","source":"wordfence","cve":"CVE-2021-24230","title":"Patreon WordPress <= 1.6.9 - Cross-Site Request Forgery","severity":"high","cvss":8.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbcd569d-f524-4012-add0-ba0afc19e47e?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbd12ed1-a468-4aaf-b6c9-102dd00aca5f","source":"wordfence","cve":"CVE-2026-32443","title":"Product Feed PRO for WooCommerce <= 13.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd12ed1-a468-4aaf-b6c9-102dd00aca5f?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-feed-pro","name":"Product Feed PRO for WooCommerce by AdTribes \u2013 Product Feeds for WooCommerce","from":"*","from_inclusive":true,"to":"13.5.2","to_inclusive":true,"patched_in":"13.5.2.1"}],"published":"2026-03-05T00:00:00Z","updated":"2026-04-15T21:20:54Z"},{"id":"wordfence:fbd2139c-e12f-474b-befd-8aba7890fc4f","source":"wordfence","cve":"CVE-2026-62024","title":"CodeBard Help Desk <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd2139c-e12f-474b-befd-8aba7890fc4f?source=api-prod","affected":[{"type":"plugin","slug":"codebard-help-desk","name":"CodeBard Help Desk","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T13:27:54Z","updated":"2026-10-13T13:54:29Z"},{"id":"wordfence:fbd5d505-bf2b-4fc1-a710-5de4ddb2242d","source":"wordfence","cve":"CVE-2025-49396","title":"Themify Builder <= 7.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd5d505-bf2b-4fc1-a710-5de4ddb2242d?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.6.7","to_inclusive":true,"patched_in":"7.6.8"}],"published":"2025-08-20T00:00:00Z","updated":"2025-08-26T13:41:07Z"},{"id":"wordfence:fbd67145-5b95-4890-a265-1dd7a029aec6","source":"wordfence","cve":"CVE-2025-5567","title":"Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd67145-5b95-4890-a265-1dd7a029aec6?source=api-prod","affected":[{"type":"plugin","slug":"shortcodes-ultimate","name":"Shortcodes Ultimate \u2013 Content Elements","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2025-07-03T14:14:23Z","updated":"2025-07-04T02:22:33Z"},{"id":"wordfence:fbd74378-ce7b-4438-81d4-fc164005a832","source":"wordfence","cve":"CVE-2026-16603","title":"Content Protector (Passster) <= 4.3.5 - Unauthenticated Category-Locked Content Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd74378-ce7b-4438-81d4-fc164005a832?source=api-prod","affected":[{"type":"plugin","slug":"content-protector","name":"Passster \u2013 Password Protect Pages and Content","from":"*","from_inclusive":true,"to":"4.3.5","to_inclusive":true,"patched_in":"4.3.6"}],"published":"2026-07-27T00:00:00Z","updated":"2026-08-21T15:42:17Z"},{"id":"wordfence:fbd8fec7-c95a-4c03-ac0d-894a54906863","source":"wordfence","cve":"CVE-2024-12203","title":"RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd8fec7-c95a-4c03-ac0d-894a54906863?source=api-prod","affected":[{"type":"plugin","slug":"rss-icon-widget","name":"RSS Icon Widget","from":"*","from_inclusive":true,"to":"5.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T18:24:14Z","updated":"2025-01-17T07:01:29Z"},{"id":"wordfence:fbd978fd-f759-4983-90b0-af7338e21d30","source":"wordfence","cve":"CVE-2021-4073","title":"RegistrationMagic <= 5.0.1.7 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd978fd-f759-4983-90b0-af7338e21d30?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.0.1.7","to_inclusive":true,"patched_in":"5.0.1.8"}],"published":"2021-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbda7303-2393-438a-9305-5642975f0419","source":"wordfence","cve":"","title":"Shoutbox (Unknown Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbda7303-2393-438a-9305-5642975f0419?source=api-prod","affected":[{"type":"theme","slug":"shoutbox","name":"Shoutbox","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2012-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbda7670-179a-41ed-8ec9-ae7f5102e645","source":"wordfence","cve":"CVE-2022-1918","title":"ToolBar to Share <= 2.0 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbda7670-179a-41ed-8ec9-ae7f5102e645?source=api-prod","affected":[{"type":"plugin","slug":"toolbar-to-share","name":"ToolBar to Share","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2022-06-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbdc0074-f357-455e-8f17-0821494ea550","source":"wordfence","cve":"CVE-2025-30870","title":"WP Travel Engine <= 6.3.5 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbdc0074-f357-455e-8f17-0821494ea550?source=api-prod","affected":[{"type":"plugin","slug":"wp-travel-engine","name":"WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software","from":"*","from_inclusive":true,"to":"6.3.5","to_inclusive":true,"patched_in":"6.3.6"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:50:22Z"},{"id":"wordfence:fbdd01b3-153b-4783-b686-558874d2856e","source":"wordfence","cve":"CVE-2015-4414","title":"SE HTML5 Album Audio Player <= 1.1.0 - Directory Traversal","severity":"critical","cvss":9.8,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbdd01b3-153b-4783-b686-558874d2856e?source=api-prod","affected":[{"type":"plugin","slug":"se-html5-album-audio-player","name":"SE HTML5 Album Audio Player","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2015-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbdf2216-82a9-4a89-8a18-9d5667b7d29d","source":"wordfence","cve":"CVE-2025-30924","title":"Primer MyData for Woocommerce < 4.2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbdf2216-82a9-4a89-8a18-9d5667b7d29d?source=api-prod","affected":[{"type":"plugin","slug":"primer-mydata","name":"Primer MyData for Woocommerce","from":"*","from_inclusive":true,"to":"4.2.4","to_inclusive":false,"patched_in":"4.2.4"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-02T20:13:58Z"},{"id":"wordfence:fbe12337-52ca-41ca-a7bf-5dfca52a8018","source":"wordfence","cve":"CVE-2026-57631","title":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe12337-52ca-41ca-a7bf-5dfca52a8018?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"6.0.1","to_inclusive":true,"patched_in":"6.0.2"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:54:37Z"},{"id":"wordfence:fbe1a5b3-a8fc-490a-b402-3fc9a87e5823","source":"wordfence","cve":"CVE-2025-67957","title":"Listivo Core <= 2.3.77 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe1a5b3-a8fc-490a-b402-3fc9a87e5823?source=api-prod","affected":[{"type":"plugin","slug":"listivo-core","name":"Listivo Core","from":"*","from_inclusive":true,"to":"2.3.77","to_inclusive":true,"patched_in":"2.3.78"}],"published":"2026-01-21T00:00:00Z","updated":"2026-01-28T15:47:08Z"},{"id":"wordfence:fbe32b9e-a6da-4257-b740-63a143cee42f","source":"wordfence","cve":"CVE-2025-10302","title":"Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe32b9e-a6da-4257-b740-63a143cee42f?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-viral-quiz","name":"Ultimate Viral Quiz","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-10-02T22:09:56Z","updated":"2025-10-03T11:17:24Z"},{"id":"wordfence:fbe3567c-659b-48d9-9ee0-e2cf5f1a3dad","source":"wordfence","cve":"CVE-2026-42710","title":"Slider by 10Web \u2013 Responsive Image Slider <= 1.2.63 - Authenticated (Author+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe3567c-659b-48d9-9ee0-e2cf5f1a3dad?source=api-prod","affected":[{"type":"plugin","slug":"slider-wd","name":"Slider by 10Web \u2013 Responsive Image Slider","from":"*","from_inclusive":true,"to":"1.2.63","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T11:55:00Z","updated":"2026-10-08T23:51:07Z"},{"id":"wordfence:fbe42214-0a01-4b9c-8149-68c47082d9d9","source":"wordfence","cve":"CVE-2005-2612","title":"WordPress Core < 1.5.2 - Remote Code Execution","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe42214-0a01-4b9c-8149-68c47082d9d9?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"1.5.1.3","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2005-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbe4688e-19a4-412a-8fe3-167badcfafdf","source":"wordfence","cve":"CVE-2008-0618","title":"DMSGuestbook < 1.9.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbe4688e-19a4-412a-8fe3-167badcfafdf?source=api-prod","affected":[{"type":"plugin","slug":"dmsguestbook","name":"DMSGuestbook","from":"*","from_inclusive":true,"to":"1.9.0","to_inclusive":false,"patched_in":"1.9.0"}],"published":"2008-02-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbea84f2-2077-4ea9-b5dc-e527423810fc","source":"wordfence","cve":"CVE-2025-25162","title":"Sports Rankings and Lists <= 1.0.2 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbea84f2-2077-4ea9-b5dc-e527423810fc?source=api-prod","affected":[{"type":"plugin","slug":"sports-rankings-lists","name":"Sports Rankings and Lists","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-02T00:00:00Z","updated":"2025-02-12T15:01:21Z"},{"id":"wordfence:fbeb146e-6b3e-4b84-80a6-9e1c507b5337","source":"wordfence","cve":"CVE-2025-62935","title":"Open Close WooCommerce Store <= 5.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbeb146e-6b3e-4b84-80a6-9e1c507b5337?source=api-prod","affected":[{"type":"plugin","slug":"woc-open-close","name":"Open Close Store for WooCommerce \u2013 Business Hours & Order Scheduling","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.0.2"}],"published":"2025-10-08T00:00:00Z","updated":"2026-09-09T15:53:26Z"},{"id":"wordfence:fbebb9d4-c445-473d-a5f6-beac00ebe7aa","source":"wordfence","cve":"CVE-2026-103427","title":"Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbebb9d4-c445-473d-a5f6-beac00ebe7aa?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership","name":"Simple Membership","from":"*","from_inclusive":true,"to":"4.8.4","to_inclusive":true,"patched_in":"4.8.5"}],"published":"2026-10-09T17:40:22Z","updated":"2026-10-10T06:40:17Z"},{"id":"wordfence:fbece1c4-fbb4-47e5-b5b7-482390bcbd13","source":"wordfence","cve":"CVE-2022-34650","title":"Team <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbece1c4-fbb4-47e5-b5b7-482390bcbd13?source=api-prod","affected":[{"type":"plugin","slug":"adl-team","name":"Team","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":""}],"published":"2022-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbed35ca-1630-46a4-8b1f-60cc7216f294","source":"wordfence","cve":"CVE-2024-9700","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.36.0","to_inclusive":true,"patched_in":"1.36.1"}],"published":"2024-10-30T00:00:00Z","updated":"2024-10-31T05:31:23Z"},{"id":"wordfence:fbedf0da-699e-429d-9ec7-6803f3c77a84","source":"wordfence","cve":"CVE-2021-24404","title":"WP Board <= 1.1(Beta) - Authenticated (Admin+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbedf0da-699e-429d-9ec7-6803f3c77a84?source=api-prod","affected":[{"type":"plugin","slug":"wp-board","name":"WP-Board","from":"*","from_inclusive":true,"to":"1.1(Beta)","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbee3720-6ab9-4470-b2d2-09824db8de4d","source":"wordfence","cve":"CVE-2024-2752","title":"Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbee3720-6ab9-4470-b2d2-09824db8de4d?source=api-prod","affected":[{"type":"plugin","slug":"wc-customer-source","name":"Where Did You Hear About Us Checkout Field for WooCommerce","from":"*","from_inclusive":true,"to":"1.3.1","to_inclusive":true,"patched_in":"1.3.2"}],"published":"2024-04-29T00:00:00Z","updated":"2024-05-06T08:49:09Z"},{"id":"wordfence:fbee86b4-07a3-4a0c-a057-a5c31fc053e1","source":"wordfence","cve":"CVE-2026-114696","title":"Page and Post Restriction <= 1.6.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbee86b4-07a3-4a0c-a057-a5c31fc053e1?source=api-prod","affected":[{"type":"plugin","slug":"page-and-post-restriction","name":"Page and Post Restriction","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2026-10-22T08:46:00Z","updated":"2026-10-23T18:55:10Z"},{"id":"wordfence:fbee8f75-6b02-4f85-9680-585646d61a1b","source":"wordfence","cve":"CVE-2025-26550","title":"Global Meta Keyword & Description <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbee8f75-6b02-4f85-9680-585646d61a1b?source=api-prod","affected":[{"type":"plugin","slug":"global-meta-keyword-and-description","name":"Global Meta Keyword & Description","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-13T00:00:00Z","updated":"2025-02-18T20:35:23Z"},{"id":"wordfence:fbef0d8c-dd16-4ef1-9d3a-50c2e1c0dca2","source":"wordfence","cve":"CVE-2025-26765","title":"Distance Based Shipping Calculator <= 2.0.22 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbef0d8c-dd16-4ef1-9d3a-50c2e1c0dca2?source=api-prod","affected":[{"type":"plugin","slug":"distance-based-shipping-calculator","name":"Distance Based Shipping Calculator","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"2.0.23"}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T20:55:47Z"},{"id":"wordfence:fbef8738-d639-48a5-98b7-abf9a7e9fec1","source":"wordfence","cve":"CVE-2023-23863","title":"TreePress \u2013 Easy Family Trees & Ancestor Profiles <= 2.0.22 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'post_title' parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbef8738-d639-48a5-98b7-abf9a7e9fec1?source=api-prod","affected":[{"type":"plugin","slug":"treepress","name":"TreePress \u2013 Easy Family Trees & Ancestor Profiles","from":"*","from_inclusive":true,"to":"2.0.22","to_inclusive":true,"patched_in":"3.0.0"}],"published":"2023-03-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbf0302a-5997-4517-80fc-a75c256377ff","source":"wordfence","cve":"CVE-2026-18779","title":"TrueBooker \u2013 Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf0302a-5997-4517-80fc-a75c256377ff?source=api-prod","affected":[{"type":"plugin","slug":"truebooker-appointment-booking","name":"TrueBooker \u2013 Appointment Booking and Scheduler System","from":"*","from_inclusive":true,"to":"1.2.7","to_inclusive":false,"patched_in":"1.2.7"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:13:48Z"},{"id":"wordfence:fbf25275-eb33-4581-8602-e8a64ba78692","source":"wordfence","cve":"CVE-2022-1091","title":"Safe SVG <= 1.9.9 - Content-Type Bypass","severity":"high","cvss":7.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf25275-eb33-4581-8602-e8a64ba78692?source=api-prod","affected":[{"type":"plugin","slug":"safe-svg","name":"Safe SVG","from":"*","from_inclusive":true,"to":"1.9.10","to_inclusive":false,"patched_in":"1.9.10"}],"published":"2022-03-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbf2aeed-0f18-4ef6-aff8-9e8c4531d789","source":"wordfence","cve":"CVE-2024-13375","title":"Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset","severity":"critical","cvss":9.8,"cwe":"CWE-620","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf2aeed-0f18-4ef6-aff8-9e8c4531d789?source=api-prod","affected":[{"type":"theme","slug":"adifier-system","name":"Adifier - Classified Ads WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":true,"patched_in":"3.1.8"}],"published":"2025-01-17T00:00:00Z","updated":"2026-04-24T14:12:33Z"},{"id":"wordfence:fbf838f4-356e-4952-8565-c3b627c06b17","source":"wordfence","cve":"CVE-2025-62960","title":"Construction Light <= 1.6.7 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf838f4-356e-4952-8565-c3b627c06b17?source=api-prod","affected":[{"type":"theme","slug":"construction-light","name":"Construction Light","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":""}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:44:52Z"},{"id":"wordfence:fbf85cbc-88fa-4430-b005-a1f1e141241b","source":"wordfence","cve":"CVE-2022-3981","title":"Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf85cbc-88fa-4430-b005-a1f1e141241b?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"5.4.19","to_inclusive":true,"patched_in":"5.5.0"}],"published":"2022-11-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fbf86da7-621d-4fb7-ba16-d132db5b602a","source":"wordfence","cve":"CVE-2025-1287","title":"The Plus Addons for Elementor \u2013 Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbf86da7-621d-4fb7-ba16-d132db5b602a?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"6.2.3"}],"published":"2025-03-07T00:00:00Z","updated":"2025-03-08T08:22:58Z"},{"id":"wordfence:fbfa6a17-95d7-480e-95ca-77f8919438e0","source":"wordfence","cve":"CVE-2026-93617","title":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers <= 3.7.1 - Authenticated (Custom Role+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbfa6a17-95d7-480e-95ca-77f8919438e0?source=api-prod","affected":[{"type":"plugin","slug":"sunshine-photo-cart","name":"Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing for Photographers","from":"*","from_inclusive":true,"to":"3.7.1","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2026-10-03T18:39:42Z","updated":"2026-10-09T00:04:03Z"},{"id":"wordfence:fbfcb3c5-23f7-409a-a8db-92c4b714ba6a","source":"wordfence","cve":"CVE-2026-27391","title":"Directory Listings WordPress plugin \u2013 uListing <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbfcb3c5-23f7-409a-a8db-92c4b714ba6a?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":""}],"published":"2026-07-22T00:00:00Z","updated":"2026-07-27T15:48:51Z"},{"id":"wordfence:fbfd334c-dba4-49ec-b854-59e52236fe57","source":"wordfence","cve":"CVE-2026-88798","title":"Really Simple Security (Free) <= 9.8.2 -  Unauthenticated Unbounded Option Growth","severity":"medium","cvss":5.3,"cwe":"CWE-400","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbfd334c-dba4-49ec-b854-59e52236fe57?source=api-prod","affected":[{"type":"plugin","slug":"really-simple-ssl","name":"Really Simple Security \u2013 Simple and Performant Security (formerly Really Simple SSL)","from":"*","from_inclusive":true,"to":"9.8.2","to_inclusive":true,"patched_in":"9.8.3"}],"published":"2026-09-16T00:00:00Z","updated":"2026-09-22T20:00:22Z"},{"id":"wordfence:fbfe41c0-d77f-4172-bb49-4321ed8d24a8","source":"wordfence","cve":"CVE-2025-31447","title":"NertWorks All in One Social Share Tools <= 1.26 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbfe41c0-d77f-4172-bb49-4321ed8d24a8?source=api-prod","affected":[{"type":"plugin","slug":"nertworks-all-in-one-social-share-tools","name":"NertWorks All in One Social Share Tools","from":"*","from_inclusive":true,"to":"1.26","to_inclusive":true,"patched_in":""}],"published":"2025-03-28T00:00:00Z","updated":"2025-04-02T15:06:24Z"},{"id":"wordfence:fbffc404-9ea9-4025-8241-2c374b760ca3","source":"wordfence","cve":"CVE-2025-13521","title":"WP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fbffc404-9ea9-4025-8241-2c374b760ca3?source=api-prod","affected":[{"type":"plugin","slug":"wp-change-status-notifier","name":"WP Status Notifier","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:40:58Z","updated":"2026-01-07T08:21:57Z"},{"id":"wordfence:fc021ee6-694a-426b-b399-8dd015fd99d2","source":"wordfence","cve":"CVE-2026-95864","title":"Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc021ee6-694a-426b-b399-8dd015fd99d2?source=api-prod","affected":[{"type":"plugin","slug":"themify-builder","name":"Themify Builder","from":"*","from_inclusive":true,"to":"7.8.1","to_inclusive":true,"patched_in":"7.8.2"}],"published":"2026-09-24T19:02:16Z","updated":"2026-09-25T07:40:31Z"},{"id":"wordfence:fc025b9a-2ff8-43d8-bfc2-5510fcaf5780","source":"wordfence","cve":"CVE-2026-112329","title":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning <= 4.26.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc025b9a-2ff8-43d8-bfc2-5510fcaf5780?source=api-prod","affected":[{"type":"plugin","slug":"sensei-lms","name":"Sensei LMS \u2013 Online Courses, Quizzes, & Learning","from":"*","from_inclusive":true,"to":"4.26.3","to_inclusive":true,"patched_in":"4.26.4"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-28T16:35:52Z"},{"id":"wordfence:fc04e676-e394-488e-a239-95af5f865613","source":"wordfence","cve":"CVE-2024-6010","title":"Cost Calculator Builder PRO <= 3.2.1 -  Unauthenticated Price Manipulation","severity":"medium","cvss":5.3,"cwe":"CWE-472","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc04e676-e394-488e-a239-95af5f865613?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder-pro","name":"Cost Calculator Builder PRO","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2024-09-06T23:09:21Z","updated":"2024-10-23T15:46:37Z"},{"id":"wordfence:fc0505a1-c7c4-4cf1-97cd-123a4dddcea3","source":"wordfence","cve":"CVE-2024-3601","title":"Poll Maker \u2013 Best WordPress Poll Plugin <= 5.1.8 -  Missing Authorization to Unauthenticated Email Enumeration","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0505a1-c7c4-4cf1-97cd-123a4dddcea3?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2024-04-18T00:00:00Z","updated":"2024-05-02T16:52:54Z"},{"id":"wordfence:fc051a2a-deb8-4888-abfb-c9d5ff27b0a7","source":"wordfence","cve":"CVE-2026-118800","title":"aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc051a2a-deb8-4888-abfb-c9d5ff27b0a7?source=api-prod","affected":[{"type":"plugin","slug":"ablocks","name":"aBlocks \u2013 Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder","from":"*","from_inclusive":true,"to":"2.18.0","to_inclusive":true,"patched_in":"2.20.0"}],"published":"2026-11-06T18:13:28Z","updated":"2026-11-07T06:39:42Z"},{"id":"wordfence:fc060a36-7e51-4868-8179-d75e80cc6528","source":"wordfence","cve":"CVE-2024-54333","title":"Check Pincode For Woocommerce <= 1.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc060a36-7e51-4868-8179-d75e80cc6528?source=api-prod","affected":[{"type":"plugin","slug":"check-pincode-for-woocommerce","name":"Check Pincode For WooCommerce","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:13:15Z"},{"id":"wordfence:fc06640e-3243-4369-bf1d-fb33f4d76ff7","source":"wordfence","cve":"CVE-2026-32545","title":"Taboola Pixel <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc06640e-3243-4369-bf1d-fb33f4d76ff7?source=api-prod","affected":[{"type":"plugin","slug":"taboola-pixel","name":"Taboola Pixel","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:39:00Z"},{"id":"wordfence:fc06ba09-9562-4d97-90ff-5464399feced","source":"wordfence","cve":"","title":"Real Estate Manager \u2013 Property Listing and Agent Management <= 6.8 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc06ba09-9562-4d97-90ff-5464399feced?source=api-prod","affected":[{"type":"plugin","slug":"real-estate-manager","name":"Real Estate Manager \u2013 Property Listing and Agent Management","from":"*","from_inclusive":true,"to":"6.8","to_inclusive":true,"patched_in":"7.0"}],"published":"2019-06-13T00:00:00Z","updated":"2024-04-05T19:16:10Z"},{"id":"wordfence:fc083b52-06f0-4a18-a581-310ec623184a","source":"wordfence","cve":"CVE-2024-35671","title":"MJ Update History <= 1.0.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc083b52-06f0-4a18-a581-310ec623184a?source=api-prod","affected":[{"type":"plugin","slug":"mj-update-history","name":"MJ Update History","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-06-03T00:00:00Z","updated":"2024-06-18T15:42:04Z"},{"id":"wordfence:fc085413-db43-43e3-9b60-aeb341eed4e1","source":"wordfence","cve":"CVE-2024-3592","title":"Quiz And Survey Master \u2013 Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection","severity":"critical","cvss":9.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc085413-db43-43e3-9b60-aeb341eed4e1?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"9.0.1","to_inclusive":true,"patched_in":"9.0.2"}],"published":"2024-06-06T00:00:00Z","updated":"2024-07-03T15:37:45Z"},{"id":"wordfence:fc08e4cf-3964-406e-9046-420e749df4b5","source":"wordfence","cve":"CVE-2023-40663","title":"WP VR <= 8.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc08e4cf-3964-406e-9046-420e749df4b5?source=api-prod","affected":[{"type":"plugin","slug":"wpvr","name":"WPVR \u2013 360 Panorama viewer and Virtual Tour Builder for WordPress","from":"*","from_inclusive":true,"to":"8.3.4","to_inclusive":true,"patched_in":"8.3.5"}],"published":"2023-08-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc0a1bfe-0ead-4333-bb77-0f2f4356626d","source":"wordfence","cve":"CVE-2008-7216","title":"Peter's Math Anti-Spam Spinoff < 1.0.0 - CAPTCHA Bypass","severity":"high","cvss":7.5,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0a1bfe-0ead-4333-bb77-0f2f4356626d?source=api-prod","affected":[{"type":"plugin","slug":"peters-math-anti-spam","name":"Peter's Math Anti-Spam","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":"1.0.0"}],"published":"2008-01-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc0a3870-990c-47dc-b3a9-f436cb199dc4","source":"wordfence","cve":"CVE-2024-51796","title":"Trendy Restaurant Menu <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0a3870-990c-47dc-b3a9-f436cb199dc4?source=api-prod","affected":[{"type":"plugin","slug":"trendy-restaurant-menu","name":"Trendy Restaurant Menu \u2013 Best Restaurant Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T14:18:55Z"},{"id":"wordfence:fc0a975b-4e8c-48ae-bf59-3267b996bb1e","source":"wordfence","cve":"CVE-2026-57759","title":"ProfileGrid \u2013 User Profiles, Groups and Communities <= 6.0.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0a975b-4e8c-48ae-bf59-3267b996bb1e?source=api-prod","affected":[{"type":"plugin","slug":"profilegrid-user-profiles-groups-and-communities","name":"ProfileGrid \u2013 User Profiles, Groups and Communities","from":"*","from_inclusive":true,"to":"6.0.0.2","to_inclusive":true,"patched_in":"6.0.0.3"}],"published":"2026-07-02T00:00:00Z","updated":"2026-09-30T14:23:52Z"},{"id":"wordfence:fc0acff9-6852-4ecb-84f9-98a15dd30fc6","source":"wordfence","cve":"CVE-2023-2751","title":"Upload Resume <= 1.2.0 - Captcha Bypass via resume_upload_form","severity":"medium","cvss":5.3,"cwe":"CWE-804","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0acff9-6852-4ecb-84f9-98a15dd30fc6?source=api-prod","affected":[{"type":"plugin","slug":"resume-upload-form","name":"Upload Resume","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc0d1427-d01e-4054-8ba7-59d6878cfbea","source":"wordfence","cve":"CVE-2024-11683","title":"Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0d1427-d01e-4054-8ba7-59d6878cfbea?source=api-prod","affected":[{"type":"plugin","slug":"newsletter-subscriptions","name":"Newsletter Subscriptions","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T15:20:21Z","updated":"2024-12-12T03:23:11Z"},{"id":"wordfence:fc0da638-c6fb-4d89-8c06-92971a3e6ad8","source":"wordfence","cve":"CVE-2026-109696","title":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 2.1.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0da638-c6fb-4d89-8c06-92971a3e6ad8?source=api-prod","affected":[{"type":"plugin","slug":"fluent-boards","name":"FluentBoards \u2013 Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2026-10-13T00:00:00Z","updated":"2026-10-14T19:46:27Z"},{"id":"wordfence:fc10e76f-5841-4e94-9b6f-e376c82b1043","source":"wordfence","cve":"CVE-2026-15232","title":"MotoPress Appointment Booking < 2.4.8 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc10e76f-5841-4e94-9b6f-e376c82b1043?source=api-prod","affected":[{"type":"plugin","slug":"motopress-appointment-lite","name":"MotoPress Appointment Booking","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":false,"patched_in":"2.4.8"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:40:29Z"},{"id":"wordfence:fc167f44-4b1c-4597-9c9b-61064044bcdb","source":"wordfence","cve":"CVE-2026-14305","title":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc167f44-4b1c-4597-9c9b-61064044bcdb?source=api-prod","affected":[{"type":"plugin","slug":"delicious-recipes","name":"WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)","from":"*","from_inclusive":true,"to":"1.10.2","to_inclusive":false,"patched_in":"1.10.2"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:37:34Z"},{"id":"wordfence:fc18643b-028f-46c5-b337-640de427ebdf","source":"wordfence","cve":"CVE-2025-66067","title":"Funnel Builder by FunnelKit <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc18643b-028f-46c5-b337-640de427ebdf?source=api-prod","affected":[{"type":"plugin","slug":"funnel-builder","name":"FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout","from":"*","from_inclusive":true,"to":"3.13.1.2","to_inclusive":true,"patched_in":"3.13.1.3"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-10T16:19:59Z"},{"id":"wordfence:fc186712-5314-4471-bf02-4fd580c338c9","source":"wordfence","cve":"CVE-2024-31423","title":"WP Accessibility Helper (WAH) <= 0.6.2.5 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc186712-5314-4471-bf02-4fd580c338c9?source=api-prod","affected":[{"type":"plugin","slug":"wp-accessibility-helper","name":"WP Accessibility Helper (WAH)","from":"*","from_inclusive":true,"to":"0.6.2.5","to_inclusive":true,"patched_in":"0.6.2.6"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-16T13:42:25Z"},{"id":"wordfence:fc1963cc-7e9e-4998-8338-c3e83b70d441","source":"wordfence","cve":"CVE-2023-48280","title":"Consensu.io <= 1.0.3 - Missing Authorization via update_config_db()","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc1963cc-7e9e-4998-8338-c3e83b70d441?source=api-prod","affected":[{"type":"plugin","slug":"consensu-io","name":"Consensu.io | Conformidade e Consentimento de Cookies para LGPD","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-11-23T00:00:00Z","updated":"2024-11-07T16:11:07Z"},{"id":"wordfence:fc1d00c2-8b2f-4d6c-bbd3-085ffb495936","source":"wordfence","cve":"CVE-2024-5448","title":"PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 -  Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc1d00c2-8b2f-4d6c-bbd3-085ffb495936?source=api-prod","affected":[{"type":"plugin","slug":"paypal-pay-buy-donation-and-cart-buttons-shortcode","name":"PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":""}],"published":"2024-05-31T00:00:00Z","updated":"2024-06-27T13:41:39Z"},{"id":"wordfence:fc1ef15f-ad31-4525-bbe5-bc3cc4485b20","source":"wordfence","cve":"CVE-2026-1827","title":"IDE Micro code-editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc1ef15f-ad31-4525-bbe5-bc3cc4485b20?source=api-prod","affected":[{"type":"plugin","slug":"flask-micro","name":"IDE Micro code-editor","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-10T20:09:56Z","updated":"2026-02-11T08:26:29Z"},{"id":"wordfence:fc1f36b1-cf28-472c-8a7a-f091ecb48c2d","source":"wordfence","cve":"CVE-2026-0816","title":"All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc1f36b1-cf28-472c-8a7a-f091ecb48c2d?source=api-prod","affected":[{"type":"plugin","slug":"all-push-notification","name":"All push notification for WP","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-03T19:43:58Z","updated":"2026-02-04T08:25:34Z"},{"id":"wordfence:fc1f77ee-5718-4a6a-b465-f80de3a957fe","source":"wordfence","cve":"CVE-2026-103694","title":"Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc1f77ee-5718-4a6a-b465-f80de3a957fe?source=api-prod","affected":[{"type":"plugin","slug":"mobile-builder","name":"Mobile builder","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T13:36:28Z"},{"id":"wordfence:fc215aad-6988-434d-a623-be0b7f87189b","source":"wordfence","cve":"CVE-2025-1627","title":"Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ToC Block","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc215aad-6988-434d-a623-be0b7f87189b?source=api-prod","affected":[{"type":"plugin","slug":"qi-blocks","name":"Qi Blocks","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-04-28T00:00:00Z","updated":"2025-05-23T15:08:52Z"},{"id":"wordfence:fc23d52c-68e5-4f5c-9334-acae70fd4c42","source":"wordfence","cve":"CVE-2021-24313","title":"WP Prayer <= 1.6.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc23d52c-68e5-4f5c-9334-acae70fd4c42?source=api-prod","affected":[{"type":"plugin","slug":"wp-prayer","name":"WP Prayer","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":false,"patched_in":"1.6.2"}],"published":"2021-05-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc23d7b2-2080-48d9-9379-b4ecd0536ff0","source":"wordfence","cve":"CVE-2026-105998","title":"Booking Package <= 1.7.30 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc23d7b2-2080-48d9-9379-b4ecd0536ff0?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.30","to_inclusive":true,"patched_in":"1.7.31"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:20:00Z"},{"id":"wordfence:fc240e5a-da4b-4705-9d10-14ae2804fdb7","source":"wordfence","cve":"CVE-2024-3823","title":"Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc240e5a-da4b-4705-9d10-14ae2804fdb7?source=api-prod","affected":[{"type":"plugin","slug":"base64-encoderdecoder","name":"Base64 Encoder/Decoder","from":"*","from_inclusive":true,"to":"0.9.2","to_inclusive":true,"patched_in":""}],"published":"2024-04-24T00:00:00Z","updated":"2024-05-16T13:13:56Z"},{"id":"wordfence:fc26d5a0-86fc-48b5-af8f-73dd9a7f2b39","source":"wordfence","cve":"CVE-2026-120540","title":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc26d5a0-86fc-48b5-af8f-73dd9a7f2b39?source=api-prod","affected":[{"type":"plugin","slug":"iubenda-cookie-law-solution","name":"iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more","from":"*","from_inclusive":true,"to":"3.13.6","to_inclusive":true,"patched_in":"3.13.7"}],"published":"2026-11-06T13:56:50Z","updated":"2026-11-07T02:29:19Z"},{"id":"wordfence:fc296c70-358e-4908-be49-5ffae83aca9b","source":"wordfence","cve":"CVE-2022-47137","title":"Ninja Tables <= 4.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc296c70-358e-4908-be49-5ffae83aca9b?source=api-prod","affected":[{"type":"plugin","slug":"ninja-tables","name":"Ninja Tables \u2013 Responsive Table Builder for Data, Pricing & Product Tables","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"4.3.5"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc2a0723-52cf-4b46-ab1c-52275537c1b5","source":"wordfence","cve":"CVE-2025-60222","title":"SUMO Memberships for WooCommerce <= 7.8.0 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc2a0723-52cf-4b46-ab1c-52275537c1b5?source=api-prod","affected":[{"type":"plugin","slug":"sumomemberships","name":"SUMO Memberships for WooCommerce","from":"*","from_inclusive":true,"to":"7.8.0","to_inclusive":true,"patched_in":"7.9.0"}],"published":"2025-08-21T00:00:00Z","updated":"2026-02-26T15:16:35Z"},{"id":"wordfence:fc2f8c81-3e69-441f-967b-b9f50e5c2f19","source":"wordfence","cve":"CVE-2026-123088","title":"UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc2f8c81-3e69-441f-967b-b9f50e5c2f19?source=api-prod","affected":[{"type":"plugin","slug":"unipay-payment-gateway-for-woocommerce","name":"UniPAY Payment Gateway For WooCommerce","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2026-11-09T00:00:00Z","updated":"2026-11-11T16:09:52Z"},{"id":"wordfence:fc305c48-8337-42b7-ad61-61aea8018def","source":"wordfence","cve":"CVE-2023-5606","title":"ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=api-prod","affected":[{"type":"plugin","slug":"chatbot","name":"WPBot \u2013 AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media","from":"4.8.6","from_inclusive":true,"to":"4.9.6","to_inclusive":true,"patched_in":"4.9.7"}],"published":"2023-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc329aee-e777-41eb-8799-539c891bd03b","source":"wordfence","cve":"","title":"Testimonial Slider <= 2.2.6 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc329aee-e777-41eb-8799-539c891bd03b?source=api-prod","affected":[{"type":"plugin","slug":"testimonial-slider-and-showcase","name":"Testimonial \u2013 Testimonial Slider and Showcase Plugin","from":"*","from_inclusive":true,"to":"2.2.6","to_inclusive":true,"patched_in":"2.2.7"}],"published":"2022-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc34de39-bd2f-4ca2-8363-d436d5e2db8d","source":"wordfence","cve":"CVE-2024-30466","title":"WooCommerce Multilingual & Multicurrency <= 5.3.4 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc34de39-bd2f-4ca2-8363-d436d5e2db8d?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-multilingual","name":"WPML Multilingual & Multicurrency for WooCommerce","from":"*","from_inclusive":true,"to":"5.3.4","to_inclusive":true,"patched_in":"5.3.5"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T16:47:23Z"},{"id":"wordfence:fc3af81e-7fa3-43a0-a403-87a042253632","source":"wordfence","cve":"CVE-2023-28665","title":"Bulk Price Update for Woocommerce <= 2.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3af81e-7fa3-43a0-a403-87a042253632?source=api-prod","affected":[{"type":"plugin","slug":"woo-bulk-price-update","name":"Bulk Price Update for Woocommerce","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-03-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc3c22a2-b766-419c-a481-48e6a73b084c","source":"wordfence","cve":"CVE-2024-13505","title":"Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3c22a2-b766-419c-a481-48e6a73b084c?source=api-prod","affected":[{"type":"plugin","slug":"survey-maker","name":"Survey Maker by AYS","from":"*","from_inclusive":true,"to":"5.1.3.3","to_inclusive":true,"patched_in":"5.1.3.4"}],"published":"2025-01-25T00:00:00Z","updated":"2025-01-26T11:23:14Z"},{"id":"wordfence:fc3d84f3-bd9d-40e6-bc88-90c840a928c0","source":"wordfence","cve":"","title":"Caldera Forms <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3d84f3-bd9d-40e6-bc88-90c840a928c0?source=api-prod","affected":[{"type":"plugin","slug":"caldera-forms","name":"Caldera Forms \u2013 More Than Contact Forms","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc3f1763-15e4-46f1-adec-b34a49fb2b7b","source":"wordfence","cve":"CVE-2026-84044","title":"Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion","severity":"medium","cvss":5.3,"cwe":"CWE-345","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3f1763-15e4-46f1-adec-b34a49fb2b7b?source=api-prod","affected":[{"type":"plugin","slug":"mp-restaurant-menu","name":"Restaurant Menu and Food Ordering","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":false,"patched_in":"2.4.12"}],"published":"2026-09-02T00:00:00Z","updated":"2026-09-09T13:58:33Z"},{"id":"wordfence:fc3fcb8f-f130-4008-8f11-d98efa30f1a8","source":"wordfence","cve":"CVE-2025-2802","title":"LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution","severity":"high","cvss":7.3,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3fcb8f-f130-4008-8f11-d98efa30f1a8?source=api-prod","affected":[{"type":"plugin","slug":"layoutboxx","name":"LayoutBoxx","from":"*","from_inclusive":true,"to":"0.3.1","to_inclusive":true,"patched_in":""}],"published":"2025-05-05T16:07:03Z","updated":"2025-05-06T04:24:13Z"},{"id":"wordfence:fc40196e-c0f3-4bc6-ac4b-b866902def61","source":"wordfence","cve":"CVE-2023-6557","title":"The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.2.8.2","to_inclusive":true,"patched_in":"6.2.9"}],"published":"2024-01-12T00:00:00Z","updated":"2025-07-07T17:40:24Z"},{"id":"wordfence:fc4048a9-b69c-4f4c-8a30-e57bb057b00c","source":"wordfence","cve":"CVE-2023-5181","title":"WP Discord Invite <= 2.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4048a9-b69c-4f4c-8a30-e57bb057b00c?source=api-prod","affected":[{"type":"plugin","slug":"wp-discord-invite","name":"WP Discord Invite","from":"*","from_inclusive":true,"to":"2.5.1","to_inclusive":true,"patched_in":"2.5.2"}],"published":"2023-10-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc40be19-9256-4c90-8438-b71b9481625d","source":"wordfence","cve":"CVE-2014-9340","title":"wpCommentTwit Plugin <= 0.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40be19-9256-4c90-8438-b71b9481625d?source=api-prod","affected":[{"type":"plugin","slug":"wpcommenttwit","name":"wpCommentTwit","from":"*","from_inclusive":true,"to":"0.5","to_inclusive":true,"patched_in":""}],"published":"2014-12-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc43e782-c3e3-4503-a1cb-13386cb5bf56","source":"wordfence","cve":"CVE-2026-9577","title":"Post Status Notifier Lite <= 1.12.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc43e782-c3e3-4503-a1cb-13386cb5bf56?source=api-prod","affected":[{"type":"plugin","slug":"post-status-notifier-lite","name":"Post Status Notifier Lite","from":"*","from_inclusive":true,"to":"1.12.0","to_inclusive":true,"patched_in":"1.13.0"}],"published":"2026-07-02T00:00:00Z","updated":"2026-07-29T23:12:41Z"},{"id":"wordfence:fc48f75d-a2e8-49ea-9bfa-a27a61ff8a84","source":"wordfence","cve":"CVE-2026-12428","title":"Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc48f75d-a2e8-49ea-9bfa-a27a61ff8a84?source=api-prod","affected":[{"type":"plugin","slug":"acf-field-blocks","name":"Blocks for ACF Fields \u2014 Display Custom Fields in the Block Editor","from":"*","from_inclusive":true,"to":"1.6.2","to_inclusive":true,"patched_in":"1.6.3"}],"published":"2026-07-08T20:36:42Z","updated":"2026-07-09T09:31:23Z"},{"id":"wordfence:fc4afb78-fca6-4cc2-8e64-4785d93055e6","source":"wordfence","cve":"CVE-2026-3225","title":"LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4afb78-fca6-4cc2-8e64-4785d93055e6?source=api-prod","affected":[{"type":"plugin","slug":"learnpress","name":"LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses","from":"*","from_inclusive":true,"to":"4.3.2.8","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-03-23T09:53:24Z","updated":"2026-03-23T22:25:40Z"},{"id":"wordfence:fc4b25b6-9596-4094-bfbb-4fd50f786a11","source":"wordfence","cve":"CVE-2026-31921","title":"Product Rearrange for WooCommerce <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4b25b6-9596-4094-bfbb-4fd50f786a11?source=api-prod","affected":[{"type":"plugin","slug":"products-rearrange-woocommerce","name":"Product Rearrange for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-26T20:39:31Z"},{"id":"wordfence:fc4c1809-d79f-4505-8f0a-9ec534c8fea2","source":"wordfence","cve":"CVE-2024-9426","title":"Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4c1809-d79f-4505-8f0a-9ec534c8fea2?source=api-prod","affected":[{"type":"plugin","slug":"aqua-svg-sprite","name":"Aqua SVG Sprite","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":""}],"published":"2024-11-12T13:24:41Z","updated":"2024-11-13T02:02:37Z"},{"id":"wordfence:fc4ccbb0-f94b-4dc1-94bf-03ab3dd84d18","source":"wordfence","cve":"CVE-2024-10151","title":"Auto iFrame <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4ccbb0-f94b-4dc1-94bf-03ab3dd84d18?source=api-prod","affected":[{"type":"plugin","slug":"auto-iframe","name":"Auto iFrame","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":"2.0"}],"published":"2024-12-18T00:00:00Z","updated":"2025-01-20T18:25:02Z"},{"id":"wordfence:fc4d4103-a19a-45a5-9059-23eb7f72c84b","source":"wordfence","cve":"CVE-2023-32237","title":"TheGem < 5.8.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4d4103-a19a-45a5-9059-23eb7f72c84b?source=api-prod","affected":[{"type":"theme","slug":"thegem-elementor","name":"TheGem","from":"*","from_inclusive":true,"to":"5.8.1.1","to_inclusive":false,"patched_in":"5.8.1.1"}],"published":"2023-05-05T00:00:00Z","updated":"2024-05-31T15:30:50Z"},{"id":"wordfence:fc4f4a78-7224-4f58-a103-7ad4df0eb36e","source":"wordfence","cve":"CVE-2024-8544","title":"Pixel Cat \u2013 Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4f4a78-7224-4f58-a103-7ad4df0eb36e?source=api-prod","affected":[{"type":"plugin","slug":"facebook-conversion-pixel","name":"Pixel Cat \u2013 Conversion Pixel Manager","from":"*","from_inclusive":true,"to":"3.0.5","to_inclusive":true,"patched_in":"3.0.6"}],"published":"2024-09-23T00:00:00Z","updated":"2024-09-24T01:56:50Z"},{"id":"wordfence:fc5670eb-4bc0-4cfa-826b-53eb9e207c9d","source":"wordfence","cve":"CVE-2026-28019","title":"Manoir <= 1.11 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5670eb-4bc0-4cfa-826b-53eb9e207c9d?source=api-prod","affected":[{"type":"theme","slug":"manoir","name":"Manoir","from":"*","from_inclusive":true,"to":"1.11","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-12T16:25:09Z"},{"id":"wordfence:fc56aeb0-eba1-4196-aac9-e5723674cd1a","source":"wordfence","cve":"CVE-2026-24367","title":"Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc56aeb0-eba1-4196-aac9-e5723674cd1a?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.2.8","to_inclusive":false,"patched_in":"3.2.8"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-27T19:21:58Z"},{"id":"wordfence:fc58c679-3e87-4bcc-b1bc-718ae52c291a","source":"wordfence","cve":"CVE-2024-10970","title":"Motors \u2013 Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc58c679-3e87-4bcc-b1bc-718ae52c291a?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.43","to_inclusive":true,"patched_in":"1.4.44"}],"published":"2025-01-15T11:56:38Z","updated":"2025-01-16T01:49:04Z"},{"id":"wordfence:fc5972d1-f6d6-4708-a9d6-8719639913ef","source":"wordfence","cve":"CVE-2026-28182","title":"AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5972d1-f6d6-4708-a9d6-8719639913ef?source=api-prod","affected":[{"type":"plugin","slug":"acymailing","name":"AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress","from":"*","from_inclusive":true,"to":"10.11.1","to_inclusive":true,"patched_in":"11.0.0"}],"published":"2026-08-13T00:00:00Z","updated":"2026-08-15T22:08:26Z"},{"id":"wordfence:fc5a8506-b191-4ab3-9c59-4f1150be6a38","source":"wordfence","cve":"CVE-2023-44146","title":"Checkfront Online Booking System <= 3.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5a8506-b191-4ab3-9c59-4f1150be6a38?source=api-prod","affected":[{"type":"plugin","slug":"checkfront-wp-booking","name":"Checkfront Online Booking System","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":"3.7"}],"published":"2023-09-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc5b0f8f-2623-4d89-b78b-8dcc7289e306","source":"wordfence","cve":"CVE-2026-85418","title":"Orbit Fox <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5b0f8f-2623-4d89-b78b-8dcc7289e306?source=api-prod","affected":[{"type":"plugin","slug":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","from":"*","from_inclusive":true,"to":"3.0.8","to_inclusive":true,"patched_in":"3.0.9"}],"published":"2026-09-07T00:00:00Z","updated":"2026-09-10T19:37:03Z"},{"id":"wordfence:fc5c10ad-c5e7-4b94-8d5d-112703ad05ea","source":"wordfence","cve":"CVE-2022-4381","title":"Popup Maker <= 1.16.8 - Authenticated (Contributor+) Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc5c10ad-c5e7-4b94-8d5d-112703ad05ea?source=api-prod","affected":[{"type":"plugin","slug":"popup-maker","name":"Popup Maker \u2013 Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder","from":"*","from_inclusive":true,"to":"1.16.8","to_inclusive":true,"patched_in":"1.16.9"}],"published":"2022-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc608cbf-99fd-4d92-9d49-ad7494ff3f03","source":"wordfence","cve":"CVE-2026-105999","title":"Booking Package <= 1.7.30 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc608cbf-99fd-4d92-9d49-ad7494ff3f03?source=api-prod","affected":[{"type":"plugin","slug":"booking-package","name":"Booking Package","from":"*","from_inclusive":true,"to":"1.7.30","to_inclusive":true,"patched_in":"1.7.31"}],"published":"2026-10-19T00:00:00Z","updated":"2026-10-23T18:20:09Z"},{"id":"wordfence:fc620054-00ed-4c2e-9448-b40ae28efff3","source":"wordfence","cve":"CVE-2026-93836","title":"WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc620054-00ed-4c2e-9448-b40ae28efff3?source=api-prod","affected":[{"type":"plugin","slug":"woo-product-bundle","name":"WPC Product Bundles for WooCommerce","from":"*","from_inclusive":true,"to":"8.6.6","to_inclusive":true,"patched_in":"8.6.7"}],"published":"2026-09-21T18:54:09Z","updated":"2026-09-22T07:41:16Z"},{"id":"wordfence:fc626bdb-e962-407c-95c3-3f9e28dc5876","source":"wordfence","cve":"CVE-2023-49855","title":"BC Menu Bar Cart Icon For WooCommerce By Binary Carpenter <= 1.49.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc626bdb-e962-407c-95c3-3f9e28dc5876?source=api-prod","affected":[{"type":"plugin","slug":"bc-menu-cart-woo","name":"Menu Bar Cart Icon For WooCommerce By Binary Carpenter","from":"*","from_inclusive":true,"to":"1.49.3","to_inclusive":true,"patched_in":""}],"published":"2023-12-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc62adbf-1f04-46b2-9ae9-aac3dbce8759","source":"wordfence","cve":"","title":"WP SEO TDK <= 2.1.2 - Missing Authorization to Stored Cross-Site Scripting","severity":"high","cvss":7.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc62adbf-1f04-46b2-9ae9-aac3dbce8759?source=api-prod","affected":[{"type":"plugin","slug":"wp-seo-tdk","name":"WP SEO TDK","from":"*","from_inclusive":true,"to":"2.1.2","to_inclusive":true,"patched_in":""}],"published":"2021-07-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc6468bf-37b6-4dd7-b2e5-e880e3cc3c32","source":"wordfence","cve":"CVE-2025-12667","title":"GitHub Gist Shortcode Plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6468bf-37b6-4dd7-b2e5-e880e3cc3c32?source=api-prod","affected":[{"type":"plugin","slug":"github-gist-shortcode","name":"GitHub Gist Shortcode Plugin","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-10T15:24:58Z","updated":"2025-11-11T03:30:53Z"},{"id":"wordfence:fc64c550-0d19-42d4-aa2b-829e74b166bc","source":"wordfence","cve":"CVE-2022-2388","title":"WP Coder <= 2.5.2 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc64c550-0d19-42d4-aa2b-829e74b166bc?source=api-prod","affected":[{"type":"plugin","slug":"wp-coder","name":"WP Coder \u2013 Insert & Manage Code Snippets","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2022-07-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc661cfd-6290-4b36-858a-cf2269b5fcf9","source":"wordfence","cve":"CVE-2024-8433","title":"Easy Mega Menu Plugin for WordPress \u2013 ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc661cfd-6290-4b36-858a-cf2269b5fcf9?source=api-prod","affected":[{"type":"plugin","slug":"themehunk-megamenu-plus","name":"Easy Mega Menu for WordPress \u2013 ThemeHunk","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2024-10-07T00:00:00Z","updated":"2024-10-08T09:33:15Z"},{"id":"wordfence:fc6634bc-4427-44b6-bf77-d97d5b49e82f","source":"wordfence","cve":"CVE-2026-4022","title":"Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6634bc-4427-44b6-bf77-d97d5b49e82f?source=api-prod","affected":[{"type":"plugin","slug":"show-posts-shortcodes","name":"Show Posts list \u2013 Easy designs, filters and more","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-03-20T15:06:09Z","updated":"2026-03-21T03:27:13Z"},{"id":"wordfence:fc663d68-ca52-4012-847f-09817c121890","source":"wordfence","cve":"CVE-2026-92115","title":"WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action","severity":"high","cvss":8.8,"cwe":"CWE-77","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc663d68-ca52-4012-847f-09817c121890?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"9.3.02.002","to_inclusive":true,"patched_in":"9.3.02.003"}],"published":"2026-10-15T17:40:00Z","updated":"2026-10-16T06:41:08Z"},{"id":"wordfence:fc672bc6-3fb7-4e32-bbdb-1f0116872b55","source":"wordfence","cve":"CVE-2026-28126","title":"RH Frontend Publishing Pro < 4.3.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc672bc6-3fb7-4e32-bbdb-1f0116872b55?source=api-prod","affected":[{"type":"plugin","slug":"rh-frontend","name":"Frontend Publishing Pro","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":false,"patched_in":"4.3.4"}],"published":"2026-02-26T00:00:00Z","updated":"2026-04-15T13:39:27Z"},{"id":"wordfence:fc689622-50d6-47c4-a5f6-0314b1a207c9","source":"wordfence","cve":"CVE-2025-1717","title":"Login Me Now <= 1.7.2 - Authentication Bypass","severity":"high","cvss":8.1,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc689622-50d6-47c4-a5f6-0314b1a207c9?source=api-prod","affected":[{"type":"plugin","slug":"login-me-now","name":"Login Me Now \u2013 Passwordless, Magic Link, OTP & Social Login for WordPress","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2025-02-26T00:00:00Z","updated":"2025-05-09T13:26:03Z"},{"id":"wordfence:fc6af287-4228-4f05-b439-fac6c057b0a5","source":"wordfence","cve":"CVE-2024-29800","title":"Timber <= 1.23.0 - Authenticated (Admin+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6af287-4228-4f05-b439-fac6c057b0a5?source=api-prod","affected":[{"type":"plugin","slug":"timber-library","name":"Timber","from":"*","from_inclusive":true,"to":"1.23.0","to_inclusive":true,"patched_in":"1.23.1"}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-15T21:17:26Z"},{"id":"wordfence:fc6dcf93-7f1f-4e87-8ba5-852d23b1f0fd","source":"wordfence","cve":"","title":"Jetpack \u2013 WP Security, Backup, Speed, & Growth < 4.2 - Timing Attack","severity":"critical","cvss":9.8,"cwe":"CWE-208","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6dcf93-7f1f-4e87-8ba5-852d23b1f0fd?source=api-prod","affected":[{"type":"plugin","slug":"jetpack","name":"Jetpack \u2013 AI Agents & MCP, Security, Backup & Analytics","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":false,"patched_in":"4.2"}],"published":"2017-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc707604-b2ce-4925-b3aa-eeb850543ca1","source":"wordfence","cve":"CVE-2026-32514","title":"Petitioner <= 0.7.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc707604-b2ce-4925-b3aa-eeb850543ca1?source=api-prod","affected":[{"type":"plugin","slug":"petitioner","name":"Petitioner","from":"*","from_inclusive":true,"to":"0.7.3","to_inclusive":true,"patched_in":"0.7.4"}],"published":"2026-03-27T00:00:00Z","updated":"2026-03-27T18:39:31Z"},{"id":"wordfence:fc712f6b-f11b-4731-8f89-0044830400d6","source":"wordfence","cve":"CVE-2025-5678","title":"Kadence Blocks \u2013 Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc712f6b-f11b-4731-8f89-0044830400d6?source=api-prod","affected":[{"type":"plugin","slug":"kadence-blocks","name":"Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor","from":"*","from_inclusive":true,"to":"3.5.10","to_inclusive":true,"patched_in":"3.5.11"}],"published":"2025-07-08T12:14:12Z","updated":"2025-07-09T01:44:51Z"},{"id":"wordfence:fc72e388-9ffc-4b99-8835-4b4b6ef46f95","source":"wordfence","cve":"CVE-2017-18526","title":"moreAds SE <= 1.4.6 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc72e388-9ffc-4b99-8835-4b4b6ef46f95?source=api-prod","affected":[{"type":"plugin","slug":"moreads-se","name":"moreAds SE","from":"*","from_inclusive":true,"to":"1.4.6","to_inclusive":true,"patched_in":"1.4.7"}],"published":"2017-01-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc72f7ea-b7da-4433-a7f5-c2927a2733e0","source":"wordfence","cve":"CVE-2025-69005","title":"Search & Go <= 2.8 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc72f7ea-b7da-4433-a7f5-c2927a2733e0?source=api-prod","affected":[{"type":"theme","slug":"search-and-go","name":"Search & Go - Directory WordPress Theme","from":"*","from_inclusive":true,"to":"2.8","to_inclusive":true,"patched_in":""}],"published":"2026-01-12T00:00:00Z","updated":"2026-01-19T15:58:58Z"},{"id":"wordfence:fc747d1a-9d95-4127-8bb9-13dc2beb1874","source":"wordfence","cve":"CVE-2024-50477","title":"Stacks Mobile App Builder <= 5.2.3 - Authentication Bypass via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc747d1a-9d95-4127-8bb9-13dc2beb1874?source=api-prod","affected":[{"type":"plugin","slug":"stacks-mobile-app-builder","name":"Stacks Mobile App Builder \u2013 The most powerful Mobile Applications Drag and Drop builder","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-10-25T00:00:00Z","updated":"2024-10-31T11:01:48Z"},{"id":"wordfence:fc77c21e-2322-4f45-87b2-797b54b68489","source":"wordfence","cve":"CVE-2025-58936","title":"Catamaran <= 1.15 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc77c21e-2322-4f45-87b2-797b54b68489?source=api-prod","affected":[{"type":"theme","slug":"catamaran","name":"Catamaran - Yacht & Boat Rental Theme","from":"*","from_inclusive":true,"to":"1.15","to_inclusive":true,"patched_in":""}],"published":"2025-08-22T00:00:00Z","updated":"2025-12-19T16:34:04Z"},{"id":"wordfence:fc787bba-d696-49b4-a734-ef5f81a7f494","source":"wordfence","cve":"CVE-2025-53233","title":"Storyform <= 0.6.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc787bba-d696-49b4-a734-ef5f81a7f494?source=api-prod","affected":[{"type":"plugin","slug":"storyform","name":"Storyform","from":"*","from_inclusive":true,"to":"0.6.14","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2026-02-26T19:49:00Z"},{"id":"wordfence:fc7893ab-df13-40ff-ab1d-15baf276e011","source":"wordfence","cve":"CVE-2026-39791","title":"Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7893ab-df13-40ff-ab1d-15baf276e011?source=api-prod","affected":[{"type":"plugin","slug":"mailjet-for-wordpress","name":"Mailjet Email Marketing","from":"*","from_inclusive":true,"to":"6.2.3","to_inclusive":true,"patched_in":"6.2.4"}],"published":"2026-10-05T16:49:10Z","updated":"2026-10-28T21:17:39Z"},{"id":"wordfence:fc7b19c7-a850-4783-9f8b-e338e03998eb","source":"wordfence","cve":"CVE-2021-24290","title":"Store Locator Plus <= 5.12.3 - Unauthenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7b19c7-a850-4783-9f8b-e338e03998eb?source=api-prod","affected":[{"type":"plugin","slug":"store-locator-le","name":"Store Locator Plus\u00ae for WordPress","from":"*","from_inclusive":true,"to":"5.12.3","to_inclusive":true,"patched_in":"5.13.8"}],"published":"2021-04-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc7bab78-4ebb-4be9-8891-1ac0e3ed0af3","source":"wordfence","cve":"CVE-2023-44147","title":"Comment Blacklist Updater <= 1.1.0 - Cross-Site Request Forgery via update_blacklist_manual","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7bab78-4ebb-4be9-8891-1ac0e3ed0af3?source=api-prod","affected":[{"type":"plugin","slug":"comment-blacklist-updater","name":"Comment Blacklist Updater","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":false,"patched_in":"1.2.0"}],"published":"2023-09-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc7dbdbe-fd0f-404b-9f9f-06e942f60a73","source":"wordfence","cve":"CVE-2025-5686","title":"Paged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-80","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7dbdbe-fd0f-404b-9f9f-06e942f60a73?source=api-prod","affected":[{"type":"plugin","slug":"paged-gallery","name":"Paged Gallery","from":"*","from_inclusive":true,"to":"0.7","to_inclusive":true,"patched_in":""}],"published":"2025-06-05T17:58:29Z","updated":"2025-06-06T06:42:55Z"},{"id":"wordfence:fc7e68e7-6792-419d-800b-f1bc340f23fb","source":"wordfence","cve":"CVE-2026-25420","title":"MailerLite \u2013 Signup forms (official) <= 1.7.18 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7e68e7-6792-419d-800b-f1bc340f23fb?source=api-prod","affected":[{"type":"plugin","slug":"official-mailerlite-sign-up-forms","name":"MailerLite \u2013 Signup forms (official)","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":"1.7.19"}],"published":"2026-01-28T00:00:00Z","updated":"2026-05-04T15:47:10Z"},{"id":"wordfence:fc870ce5-1352-43f2-b80b-45065ceed750","source":"wordfence","cve":"CVE-2024-1427","title":"The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc870ce5-1352-43f2-b80b-45065ceed750?source=api-prod","affected":[{"type":"plugin","slug":"the-post-grid","name":"The Post Grid \u2013 Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid","from":"*","from_inclusive":true,"to":"7.7.1","to_inclusive":true,"patched_in":"7.7.2"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T05:32:56Z"},{"id":"wordfence:fc87f440-d26e-4535-afe4-c4a97b7c591a","source":"wordfence","cve":"CVE-2026-92807","title":"Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute","severity":"high","cvss":8.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc87f440-d26e-4535-afe4-c4a97b7c591a?source=api-prod","affected":[{"type":"plugin","slug":"save-as-pdf-by-pdfcrowd","name":"Save as PDF Plugin by PDFCrowd","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2026-09-18T14:00:21Z","updated":"2026-09-19T02:27:13Z"},{"id":"wordfence:fc8b0944-f669-40d3-899b-d7f91b1a1fea","source":"wordfence","cve":"CVE-2024-9937","title":"Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc8b0944-f669-40d3-899b-d7f91b1a1fea?source=api-prod","affected":[{"type":"plugin","slug":"woo-manage-fraud-orders","name":"Woo Manage Fraud Orders","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-15T17:05:13Z","updated":"2024-10-31T16:06:32Z"},{"id":"wordfence:fc8b133f-d952-4776-80a2-c856bcb1ee89","source":"wordfence","cve":"CVE-2025-48134","title":"WP Tabs <= 2.2.12 - Authenticated (Administrator+) PHP Object Injection","severity":"high","cvss":7.2,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc8b133f-d952-4776-80a2-c856bcb1ee89?source=api-prod","affected":[{"type":"plugin","slug":"wp-expand-tabs-free","name":"Custom Product Tabs for WooCommerce & WordPress Tabs Builder \u2013 Smart Tabs","from":"*","from_inclusive":true,"to":"2.2.12","to_inclusive":true,"patched_in":"2.2.13"}],"published":"2025-05-16T00:00:00Z","updated":"2025-07-24T18:08:31Z"},{"id":"wordfence:fc912831-bbdd-4f8f-a620-47e41b1b731d","source":"wordfence","cve":"CVE-2025-4594","title":"Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc912831-bbdd-4f8f-a620-47e41b1b731d?source=api-prod","affected":[{"type":"plugin","slug":"tournamatch","name":"Tournamatch","from":"*","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"4.6.2"}],"published":"2025-05-22T00:00:00Z","updated":"2025-05-23T03:39:41Z"},{"id":"wordfence:fc917ba8-aa4b-4826-b54c-972c88d94b0a","source":"wordfence","cve":"CVE-2026-119366","title":"Comments \u2013 wpDiscuz <= 7.6.73 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc917ba8-aa4b-4826-b54c-972c88d94b0a?source=api-prod","affected":[{"type":"plugin","slug":"wpdiscuz","name":"Comments \u2013 wpDiscuz","from":"*","from_inclusive":true,"to":"7.6.73","to_inclusive":true,"patched_in":"7.6.74"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-05T13:42:32Z"},{"id":"wordfence:fc91cae0-6d54-43f3-8c0e-d1f972573d13","source":"wordfence","cve":"","title":"WP No External Links < 3.5.16 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc91cae0-6d54-43f3-8c0e-d1f972573d13?source=api-prod","affected":[{"type":"plugin","slug":"wp-noexternallinks","name":"wp-noexternallinks","from":"*","from_inclusive":true,"to":"3.5.16","to_inclusive":false,"patched_in":"3.5.16"}],"published":"2016-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc9253bc-feee-422f-aafb-1630f2d1ad2e","source":"wordfence","cve":"CVE-2026-75966","title":"Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9253bc-feee-422f-aafb-1630f2d1ad2e?source=api-prod","affected":[{"type":"plugin","slug":"podlove-podcasting-plugin-for-wordpress","name":"Podlove Podcast Publisher","from":"*","from_inclusive":true,"to":"4.5.5","to_inclusive":true,"patched_in":"4.5.6"}],"published":"2026-09-08T14:34:48Z","updated":"2026-09-09T03:28:50Z"},{"id":"wordfence:fc972c88-ec32-454f-a1f6-4fe04fda98cc","source":"wordfence","cve":"CVE-2026-25325","title":"rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc972c88-ec32-454f-a1f6-4fe04fda98cc?source=api-prod","affected":[{"type":"plugin","slug":"buddypress-media","name":"rtMedia for WordPress, BuddyPress and bbPress","from":"*","from_inclusive":true,"to":"4.7.8","to_inclusive":true,"patched_in":"4.7.9"}],"published":"2026-02-01T00:00:00Z","updated":"2026-05-04T15:26:33Z"},{"id":"wordfence:fc98e78b-5388-4573-b2a1-9bad7901d507","source":"wordfence","cve":"CVE-2022-42460","title":"Traffic Manager <= 1.4.5 - Missing Authorization to Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc98e78b-5388-4573-b2a1-9bad7901d507?source=api-prod","affected":[{"type":"plugin","slug":"traffic-manager","name":"Traffic Manager","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2022-10-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc9bd62c-0be2-4722-8d11-f7d3c68af7fc","source":"wordfence","cve":"CVE-2025-39393","title":"Hospital Management System <= 47.0(20-11-2023) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9bd62c-0be2-4722-8d11-f7d3c68af7fc?source=api-prod","affected":[{"type":"plugin","slug":"hospital-management","name":"Hospital Management System for Wordpress","from":"*","from_inclusive":true,"to":"47.0(20-11-2023)","to_inclusive":true,"patched_in":""}],"published":"2025-04-22T00:00:00Z","updated":"2025-04-30T19:20:23Z"},{"id":"wordfence:fc9cb292-94cb-4d1e-a0b7-98856db7c28e","source":"wordfence","cve":"","title":"Merge + Minify + Refresh <= 1.10.7 - Cross-Site Request Forgery leading to Arbitrary File Deletion and Site Reset","severity":"high","cvss":8.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9cb292-94cb-4d1e-a0b7-98856db7c28e?source=api-prod","affected":[{"type":"plugin","slug":"merge-minify-refresh","name":"Merge + Minify + Refresh","from":"*","from_inclusive":true,"to":"1.10.8","to_inclusive":false,"patched_in":"1.10.8"}],"published":"2020-02-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc9dfe96-2d43-4b7b-a91a-87cdaaab8e49","source":"wordfence","cve":"CVE-2021-24229","title":"Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9dfe96-2d43-4b7b-a91a-87cdaaab8e49?source=api-prod","affected":[{"type":"plugin","slug":"patreon-connect","name":"Patreon WordPress","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"}],"published":"2021-03-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fc9e6374-8f9e-4c60-a86b-46cd4122abf9","source":"wordfence","cve":"CVE-2025-15476","title":"The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fc9e6374-8f9e-4c60-a86b-46cd4122abf9?source=api-prod","affected":[{"type":"plugin","slug":"the-bucketlister","name":"The Bucketlister","from":"*","from_inclusive":true,"to":"0.1.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-06T20:26:32Z","updated":"2026-02-07T08:26:41Z"},{"id":"wordfence:fca11e5b-2b6c-42f0-baf3-4ee023535f83","source":"wordfence","cve":"","title":"lim4wp <= 1.1.1 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca11e5b-2b6c-42f0-baf3-4ee023535f83?source=api-prod","affected":[{"type":"plugin","slug":"lim4wp","name":"lim4wp","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2012-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca13d1d-b670-4a76-9e8f-fdaa2a32120d","source":"wordfence","cve":"CVE-2026-42705","title":"Grand News <= 3.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca13d1d-b670-4a76-9e8f-fdaa2a32120d?source=api-prod","affected":[{"type":"theme","slug":"grandnews","name":"grandnews","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-09T15:20:35Z"},{"id":"wordfence:fca20535-d033-45d5-acc3-72ad53d34b4f","source":"wordfence","cve":"CVE-2022-4305","title":"Login as User or Customer <= 3.2 - Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca20535-d033-45d5-acc3-72ad53d34b4f?source=api-prod","affected":[{"type":"plugin","slug":"login-as-customer-or-user","name":"Login as User or Customer \u2014 User Switching","from":"*","from_inclusive":true,"to":"3.2","to_inclusive":true,"patched_in":"3.3"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca24e26-149f-4805-9097-f7d11485a690","source":"wordfence","cve":"","title":"Contact Form by WD \u2013 responsive drag & drop contact form builder tool <= 1.7.18 - Authorization Bypass","severity":"high","cvss":8.1,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca24e26-149f-4805-9097-f7d11485a690?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-maker","name":"Contact Form by WD \u2013 responsive drag & drop contact form builder tool","from":"*","from_inclusive":true,"to":"1.7.18","to_inclusive":true,"patched_in":"1.7.19"}],"published":"2014-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca3259b-bf0e-4b4a-815f-1eb399b8b674","source":"wordfence","cve":"CVE-2024-3240","title":"ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca3259b-bf0e-4b4a-815f-1eb399b8b674?source=api-prod","affected":[{"type":"plugin","slug":"convertplug","name":"ConvertPlus","from":"*","from_inclusive":true,"to":"3.5.25","to_inclusive":true,"patched_in":"3.5.26"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-04T03:31:04Z"},{"id":"wordfence:fca34e4e-3324-4942-854b-a4511f88af8b","source":"wordfence","cve":"CVE-2023-46633","title":"Glossary <= 3.1.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca34e4e-3324-4942-854b-a4511f88af8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-glossary","name":"WP Glossary","from":"*","from_inclusive":true,"to":"3.1.2","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca3d106-49df-49fc-a90d-e0cb26bd34b6","source":"wordfence","cve":"CVE-2024-2008","title":"Modal Popup Box \u2013 Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca3d106-49df-49fc-a90d-e0cb26bd34b6?source=api-prod","affected":[{"type":"plugin","slug":"modal-popup-box","name":"Modal Popup Box \u2014 Popup Maker & Popup Builder","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":"1.5.3"}],"published":"2024-04-03T00:00:00Z","updated":"2024-04-04T02:32:41Z"},{"id":"wordfence:fca4040d-3c6c-4e31-9bed-d1b6bf5b2bed","source":"wordfence","cve":"CVE-2021-20792","title":"Quiz and Survey Master <= 7.1.13 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca4040d-3c6c-4e31-9bed-d1b6bf5b2bed?source=api-prod","affected":[{"type":"plugin","slug":"quiz-master-next","name":"Quiz and Survey Master (QSM) \u2013 Quiz Maker & Survey Maker","from":"*","from_inclusive":true,"to":"7.1.13","to_inclusive":true,"patched_in":"7.1.14"}],"published":"2021-09-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca6d469-60e7-4866-a53c-d207817c9204","source":"wordfence","cve":"CVE-2023-45067","title":"WP Simple HTML Sitemap <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca6d469-60e7-4866-a53c-d207817c9204?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-html-sitemap","name":"WP Simple HTML Sitemap","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2023-10-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca6ddae-df77-4636-bfe1-29e8726386d4","source":"wordfence","cve":"CVE-2025-23803","title":"Snippy <= 1.4.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca6ddae-df77-4636-bfe1-29e8726386d4?source=api-prod","affected":[{"type":"plugin","slug":"snippy","name":"Snippy","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:13:23Z"},{"id":"wordfence:fca7837c-ad24-44ce-b073-7df3f8bc4300","source":"wordfence","cve":"CVE-2023-5744","title":"Very Simple Google Maps <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca7837c-ad24-44ce-b073-7df3f8bc4300?source=api-prod","affected":[{"type":"plugin","slug":"very-simple-google-maps","name":"Very Simple Google Maps","from":"*","from_inclusive":true,"to":"2.9","to_inclusive":true,"patched_in":"2.9.1"}],"published":"2023-10-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fca9bd3a-2489-4672-95c1-9e00d60d6525","source":"wordfence","cve":"CVE-2021-24606","title":"Availability Calendar < 1.2.1 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fca9bd3a-2489-4672-95c1-9e00d60d6525?source=api-prod","affected":[{"type":"plugin","slug":"availability-calendar","name":"Availability Calendar","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":false,"patched_in":"1.2.1"}],"published":"2021-08-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcae647f-7eed-4ecd-83b8-482b55b86ec9","source":"wordfence","cve":"CVE-2021-24435","title":"Titan Framework <= (Various Versions) - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcae647f-7eed-4ecd-83b8-482b55b86ec9?source=api-prod","affected":[{"type":"plugin","slug":"amp-extensions","name":"AMP extensions","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"venture-event-manager","name":"Venture Event Manager","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":false,"patched_in":"3.2.5"},{"type":"plugin","slug":"flight-search-widget-blocks","name":"Flight Search Widget and Blocks","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"stars-menu","name":"Stars Menu","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"yandex-money-button","name":"\u041a\u043d\u043e\u043f\u043a\u0430 \u042eMoney","from":"*","from_inclusive":true,"to":"2.4.0","to_inclusive":false,"patched_in":"2.4.0"},{"type":"plugin","slug":"disable-image-right-click","name":"Disable Image Right Click","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"seo-dashboard-by-gutewebsites-de","name":"SEO-Dashboard by gutewebsites.de","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"icons-with-links-widget","name":"Icons with Links Widget","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woo-whatsapp-request-quote","name":"Request Quote via Whatsapp for Woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"woosaleskit-bar","name":"Woosaleskit Bar","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tr-easy-google-analytics","name":"TR Easy Google Analytics","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"media-mirror","name":"Media Mirror","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-scroll-bar-designer","name":"Custom Scrollbar Designer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"popup-modal-for-youtube","name":"Popup Modal For Youtube","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cool-facebook-page-feed-timeline","name":"Facebook Page Feed Timeline","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"cf7-customizer","name":"WordPress Form Customizer | CF7 Customizer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"exit-popup-show","name":"Exit Popup Show","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"border-loading-bar","name":"Border Loading Bar","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"custom-text-selection-colors","name":"Custom Text Selection Colors","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-google-map","name":"Easy Google Map","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"seatgeek-affiliate-tickets","name":"Seatgeek Affiliate Tickets","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"titan-framework","name":"Titan Framework","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"adblock-notify-by-bweb","name":"Ad Blocker Notify Lite","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.0.10","to_inclusive":true,"patched_in":"6.0.11"},{"type":"plugin","slug":"live-chat-facebook-fanpage","name":"Live Chat for Fanpage","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"},{"type":"plugin","slug":"woo-availability-date","name":"Product Limited Time Availability Date for woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"email-my-posts","name":"Share Posts To Email","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"easy-gallery-slideshow","name":"Easy Gallery Slideshow","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"mobile-menu","name":"WP Mobile Menu \u2013 The Mobile-Friendly Responsive Menu","from":"*","from_inclusive":true,"to":"2.8.2.2","to_inclusive":true,"patched_in":"2.8.2.3"},{"type":"plugin","slug":"sticky-related-posts","name":"Sticky Related Posts","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"icustomizer","name":"ICustomizer","from":"*","from_inclusive":true,"to":"1.4.13","to_inclusive":true,"patched_in":"1.5.0"},{"type":"plugin","slug":"catchers-helpdesk","name":"Catchers Helpdesk and Ticket system for Support","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"categories-gallery-woocommerce","name":"Woocommerce Categories in gallery format","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"categories-gallery","name":"Bootstrap Categories Gallery","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"total-sales-for-woocommerce","name":"Total Sales For Woocommerce","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"share-woocommerce-email","name":"Share Woocommerce to Email","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"template-events-calendar","name":"Events Shortcodes For The Events Calendar","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":false,"patched_in":"1.7.2"},{"type":"plugin","slug":"simple-behace-portfolio","name":"Simple Behance Portfolio","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"betteroptin","name":"betteroptin","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"project-app","name":"Project2App \u2013 Turn Your WordPress Site into an Android App","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"aoi-tori","name":"Aoi Tori","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"station-pro","name":"Station Pro \u2013 Advanced Audio Streaming & Player for WordPress","from":"2.2.1","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"},{"type":"plugin","slug":"easy-justified-gallery","name":"Easy Justified Gallery \u2013 Photo Gallery Block with Lightbox","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.1.1"},{"type":"plugin","slug":"clinicalwp-core","name":"ClinicalWP Core","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"webhotelier","name":"WebHotelier for WordPress","from":"*","from_inclusive":true,"to":"1.6.1","to_inclusive":false,"patched_in":"1.6.1"},{"type":"plugin","slug":"4k-icon-fonts-for-visual-composer","name":"4k-icon-fonts-for-visual-composer","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"tcs3","name":"tcS3","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""},{"type":"plugin","slug":"w3s-cf7-zoho","name":"W3SCloud Contact Form 7 to Zoho CRM","from":"*","from_inclusive":true,"to":"2.1.0","to_inclusive":false,"patched_in":"2.1.0"},{"type":"plugin","slug":"affiliate-pro","name":"affiliate-pro","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2021-08-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcae7cb5-d333-4bde-a43b-ea3ef3b023fa","source":"wordfence","cve":"CVE-2026-19221","title":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution","severity":"high","cvss":7.2,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcae7cb5-d333-4bde-a43b-ea3ef3b023fa?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.57.0.5","to_inclusive":false,"patched_in":"1.57.0.5"}],"published":"2026-08-27T00:00:00Z","updated":"2026-09-01T20:59:50Z"},{"id":"wordfence:fcaea2fb-ebf8-49b4-8cd5-0d9208252a90","source":"wordfence","cve":"CVE-2025-1410","title":"Events Calendar Made Simple \u2013 Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcaea2fb-ebf8-49b4-8cd5-0d9208252a90?source=api-prod","affected":[{"type":"plugin","slug":"pie-calendar","name":"Pie Calendar \u2013 Events Calendar Made Simple","from":"*","from_inclusive":true,"to":"1.2.5","to_inclusive":true,"patched_in":"1.2.6"}],"published":"2025-02-20T20:08:50Z","updated":"2025-02-21T08:21:39Z"},{"id":"wordfence:fcaeae5b-4047-4f09-8197-6ce2c21cc812","source":"wordfence","cve":"CVE-2024-13340","title":"MDTF \u2013 Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcaeae5b-4047-4f09-8197-6ce2c21cc812?source=api-prod","affected":[{"type":"plugin","slug":"wp-meta-data-filter-and-taxonomy-filter","name":"MDTF \u2013 Meta Data and Taxonomies Filter","from":"*","from_inclusive":true,"to":"1.3.3.6","to_inclusive":true,"patched_in":"1.3.3.7"}],"published":"2025-01-22T21:28:11Z","updated":"2025-01-23T11:13:30Z"},{"id":"wordfence:fcb1f4db-3dba-4031-8196-66eec3203752","source":"wordfence","cve":"CVE-2025-25128","title":"Facilita Form Tracker <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcb1f4db-3dba-4031-8196-66eec3203752?source=api-prod","affected":[{"type":"plugin","slug":"facilita-form-tracker","name":"Facilita Form Tracker","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T15:17:04Z"},{"id":"wordfence:fcb4bd86-c187-4c73-be91-d0edbc5d9215","source":"wordfence","cve":"CVE-2025-62059","title":"SureRank <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcb4bd86-c187-4c73-be91-d0edbc5d9215?source=api-prod","affected":[{"type":"plugin","slug":"surerank","name":"SureRank SEO \u2013 Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-29T14:58:44Z"},{"id":"wordfence:fcb6b1c6-19ba-46e5-9999-532ec8facc92","source":"wordfence","cve":"CVE-2025-28857","title":"Rankchecker.io Integration <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcb6b1c6-19ba-46e5-9999-532ec8facc92?source=api-prod","affected":[{"type":"plugin","slug":"rankchecker-io-integration","name":"Rankchecker.io Integration","from":"*","from_inclusive":true,"to":"1.0.9","to_inclusive":true,"patched_in":""}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T15:33:10Z"},{"id":"wordfence:fcb76d10-fc60-4b19-9b47-1b98f8400a96","source":"wordfence","cve":"","title":"bbPress < 2.5.9 - Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcb76d10-fc60-4b19-9b47-1b98f8400a96?source=api-prod","affected":[{"type":"plugin","slug":"bbpress","name":"bbPress","from":"*","from_inclusive":true,"to":"2.5.9","to_inclusive":false,"patched_in":"2.5.9"}],"published":"2016-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcbbae9e-2efc-4d7e-8daf-3f389b501091","source":"wordfence","cve":"CVE-2025-53217","title":"AIO WP Builder <= 2.0.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcbbae9e-2efc-4d7e-8daf-3f389b501091?source=api-prod","affected":[{"type":"plugin","slug":"all-in-one-wp-builder","name":"Page Builder \u2013 AIO WP Builder: #1 Website Builder for WordPress","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-06-18T00:00:00Z","updated":"2026-02-26T19:48:21Z"},{"id":"wordfence:fcbd718b-4d7d-48a4-9db2-dd938de7c7eb","source":"wordfence","cve":"","title":"WP Fastest Cache <= 0.8.5.7 - Missing Authorization","severity":"medium","cvss":4.9,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcbd718b-4d7d-48a4-9db2-dd938de7c7eb?source=api-prod","affected":[{"type":"plugin","slug":"wp-fastest-cache","name":"WP Fastest Cache \u2013 WordPress Cache Plugin","from":"*","from_inclusive":true,"to":"0.8.5.7","to_inclusive":true,"patched_in":"0.8.5.8"}],"published":"2016-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcbe5bfa-7680-452e-bb18-ea9fbbb07b8e","source":"wordfence","cve":"CVE-2024-53817","title":"Product Labels For Woocommerce <= 1.5.8 - Authenticated (Administrator+) SQL Injection","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcbe5bfa-7680-452e-bb18-ea9fbbb07b8e?source=api-prod","affected":[{"type":"plugin","slug":"aco-product-labels-for-woocommerce","name":"Product Labels For Woocommerce (Sale Badges)","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-12T13:37:08Z"},{"id":"wordfence:fcbf81f8-8b33-4b83-91fb-626b7b5f3bb2","source":"wordfence","cve":"CVE-2025-13895","title":"Top Position Google Finance <= 0.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcbf81f8-8b33-4b83-91fb-626b7b5f3bb2?source=api-prod","affected":[{"type":"plugin","slug":"top-position-google-finance","name":"Top Position Google Finance","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2026-01-08T21:19:22Z","updated":"2026-01-09T09:19:48Z"},{"id":"wordfence:fcc0fc00-b7d6-429c-9ab3-f08971c48777","source":"wordfence","cve":"CVE-2024-7858","title":"Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions","severity":"medium","cvss":6.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc0fc00-b7d6-429c-9ab3-f08971c48777?source=api-prod","affected":[{"type":"plugin","slug":"media-library-plus","name":"Media Library Folders","from":"*","from_inclusive":true,"to":"8.2.3","to_inclusive":true,"patched_in":"8.2.4"}],"published":"2024-08-29T00:00:00Z","updated":"2024-08-30T09:29:50Z"},{"id":"wordfence:fcc218bf-2845-4d7f-8b93-e0fe9bc4bf79","source":"wordfence","cve":"CVE-2025-58886","title":"Instant Locations <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc218bf-2845-4d7f-8b93-e0fe9bc4bf79?source=api-prod","affected":[{"type":"plugin","slug":"instant-locations","name":"Instant Locations","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-10T19:17:41Z"},{"id":"wordfence:fcc21e14-30f4-474f-9740-0cb4fe110f70","source":"wordfence","cve":"CVE-2024-54290","title":"Role Includer <= 1.6 - Reflected Cross-Site Scripting via user_id Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc21e14-30f4-474f-9740-0cb4fe110f70?source=api-prod","affected":[{"type":"plugin","slug":"role-includer","name":"Role Includer","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2024-12-11T00:00:00Z","updated":"2025-01-17T16:56:33Z"},{"id":"wordfence:fcc35b14-ace8-4f2d-8025-f837f1da1687","source":"wordfence","cve":"CVE-2025-58845","title":"Bulk Watermark <= 1.6.10 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc35b14-ace8-4f2d-8025-f837f1da1687?source=api-prod","affected":[{"type":"plugin","slug":"bulk-watermark","name":"Bulk Watermark","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":""}],"published":"2025-09-05T00:00:00Z","updated":"2025-09-09T22:43:28Z"},{"id":"wordfence:fcc665d3-6d1c-466f-a8ee-df5c1e65590a","source":"wordfence","cve":"CVE-2026-28050","title":"Beacon <= 2.24 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc665d3-6d1c-466f-a8ee-df5c1e65590a?source=api-prod","affected":[{"type":"theme","slug":"beacon","name":"Beacon | Funeral Services WordPress Theme","from":"*","from_inclusive":true,"to":"2.24","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:08:26Z"},{"id":"wordfence:fcc78fa6-a5f0-4f29-ae19-8e783698b19e","source":"wordfence","cve":"CVE-2024-1711","title":"Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc78fa6-a5f0-4f29-ae19-8e783698b19e?source=api-prod","affected":[{"type":"plugin","slug":"mediavine-create","name":"Create","from":"*","from_inclusive":true,"to":"1.9.4","to_inclusive":true,"patched_in":"1.9.5"}],"published":"2024-03-19T00:00:00Z","updated":"2024-03-25T13:45:31Z"},{"id":"wordfence:fcc96838-dde5-49f2-ac73-977a8347c455","source":"wordfence","cve":"","title":"Custom Colors for Real Estate Manager <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc96838-dde5-49f2-ac73-977a8347c455?source=api-prod","affected":[{"type":"plugin","slug":"custom-colors-for-real-estate-manager","name":"Custom Colors for Real Estate Manager","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2022-05-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fccd9631-4703-4e40-9de1-96576cf9c4d8","source":"wordfence","cve":"CVE-2025-67912","title":"Stars Testimonials <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fccd9631-4703-4e40-9de1-96576cf9c4d8?source=api-prod","affected":[{"type":"plugin","slug":"stars-testimonials-with-slider-and-masonry-grid","name":"Stars Testimonials \u2014 Responsive Reviews & Star Ratings","from":"*","from_inclusive":true,"to":"3.3.4","to_inclusive":true,"patched_in":"3.3.5"}],"published":"2025-11-10T00:00:00Z","updated":"2025-12-19T17:02:43Z"},{"id":"wordfence:fcce0a92-520d-45ac-845e-a1635f763eed","source":"wordfence","cve":"CVE-2023-51494","title":"WooCommerce Product Vendors <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcce0a92-520d-45ac-845e-a1635f763eed?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-product-vendors","name":"Product Vendors","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2023-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcce2857-5bc8-4bee-b218-45f56cb0184b","source":"wordfence","cve":"CVE-2017-2243","title":"Responsive Lightbox & Gallery <= 1.7.1 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcce2857-5bc8-4bee-b218-45f56cb0184b?source=api-prod","affected":[{"type":"plugin","slug":"responsive-lightbox","name":"Responsive Lightbox & Gallery","from":"*","from_inclusive":true,"to":"1.7.1","to_inclusive":true,"patched_in":"1.7.2"}],"published":"2016-12-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fccfe581-16aa-4a6e-a6aa-60c05e4d26cb","source":"wordfence","cve":"CVE-2018-21007","title":"Woo Confirmation Email < 3.2.0 - Improper Access Control","severity":"critical","cvss":9.8,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fccfe581-16aa-4a6e-a6aa-60c05e4d26cb?source=api-prod","affected":[{"type":"plugin","slug":"woo-confirmation-email","name":"User Email Verification for WooCommerce","from":"*","from_inclusive":true,"to":"3.1.15","to_inclusive":true,"patched_in":"3.2.0"}],"published":"2018-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcd02dfa-688e-4375-92cb-8d0e7cbaaa6e","source":"wordfence","cve":"CVE-2024-22163","title":"Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcd02dfa-688e-4375-92cb-8d0e7cbaaa6e?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-firewall","name":"Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Protection & File Scanning","from":"*","from_inclusive":true,"to":"18.5.7","to_inclusive":true,"patched_in":"18.5.8"}],"published":"2024-01-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcd756ea-9690-4535-9cc4-203a10093432","source":"wordfence","cve":"CVE-2026-103908","title":"AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcd756ea-9690-4535-9cc4-203a10093432?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.1.18","to_inclusive":true,"patched_in":"1.1.19"}],"published":"2026-11-05T21:53:07Z","updated":"2026-11-06T11:17:41Z"},{"id":"wordfence:fcda8a7a-40e3-416e-940a-ba0245dcaa7d","source":"wordfence","cve":"CVE-2025-6039","title":"ProcessingJS for WordPress <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcda8a7a-40e3-416e-940a-ba0245dcaa7d?source=api-prod","affected":[{"type":"plugin","slug":"processingjs-for-wp","name":"ProcessingJS for WordPress","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":""}],"published":"2025-07-03T12:18:53Z","updated":"2025-07-04T01:44:06Z"},{"id":"wordfence:fcdaa3c0-139e-4e04-95f4-5a481b3a1f38","source":"wordfence","cve":"CVE-2026-82211","title":"Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcdaa3c0-139e-4e04-95f4-5a481b3a1f38?source=api-prod","affected":[{"type":"plugin","slug":"nexi-xpay-build","name":"Nexi XPay Build","from":"7.0.0","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:40:26Z"},{"id":"wordfence:fcddcf58-7fb7-4fe9-8353-5ec62c5c16d1","source":"wordfence","cve":"CVE-2025-48307","title":"SEO For Images <= 1.0.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcddcf58-7fb7-4fe9-8353-5ec62c5c16d1?source=api-prod","affected":[{"type":"plugin","slug":"seo-for-images","name":"SEO For Images","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-08-25T00:00:00Z","updated":"2025-09-03T19:59:59Z"},{"id":"wordfence:fcdeba37-ba65-400d-9c07-36503a03e857","source":"wordfence","cve":"CVE-2024-24868","title":"SP Project & Document Manager  <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcdeba37-ba65-400d-9c07-36503a03e857?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"4.69","to_inclusive":true,"patched_in":"4.70"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-05T18:50:41Z"},{"id":"wordfence:fce15e1c-e2eb-4bd9-8b07-78d87a6ae1cc","source":"wordfence","cve":"CVE-2023-0630","title":"Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fce15e1c-e2eb-4bd9-8b07-78d87a6ae1cc?source=api-prod","affected":[{"type":"plugin","slug":"wp-slimstat","name":"SlimStat Analytics \u2013 Real-Time Stats, Heatmaps & Ecommerce","from":"*","from_inclusive":true,"to":"4.9.3.2","to_inclusive":true,"patched_in":"4.9.3.3"}],"published":"2023-02-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fce76126-0cfd-464f-b644-45d4301e958d","source":"wordfence","cve":"CVE-2023-7225","title":"MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fce76126-0cfd-464f-b644-45d4301e958d?source=api-prod","affected":[{"type":"plugin","slug":"mappress-google-maps-for-wordpress","name":"MapPress \u2013 Free Map Plugin for Google Maps & OpenStreetMap","from":"*","from_inclusive":true,"to":"2.88.16","to_inclusive":true,"patched_in":"2.88.17"}],"published":"2024-01-29T00:00:00Z","updated":"2024-07-29T21:37:52Z"},{"id":"wordfence:fcea4792-ca99-40ed-9bf0-0f5a523a47fd","source":"wordfence","cve":"CVE-2025-53228","title":"bbpress Simple Advert Units <= 0.41 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcea4792-ca99-40ed-9bf0-0f5a523a47fd?source=api-prod","affected":[{"type":"plugin","slug":"bbpress-simple-advert-units","name":"bbpress Simple Advert Units","from":"*","from_inclusive":true,"to":"0.41","to_inclusive":true,"patched_in":""}],"published":"2025-06-21T00:00:00Z","updated":"2026-02-26T19:48:34Z"},{"id":"wordfence:fceae728-ea72-4586-848f-3a45b6f9699a","source":"wordfence","cve":"CVE-2012-3385","title":"WordPress Core < 3.4.1 - Information Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fceae728-ea72-4586-848f-3a45b6f9699a?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.4","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2012-06-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcecd7bb-85cc-406e-9fd8-e671b327dc13","source":"wordfence","cve":"CVE-2014-4555","title":"Style It <= 1.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcecd7bb-85cc-406e-9fd8-e671b327dc13?source=api-prod","affected":[{"type":"plugin","slug":"style-it","name":"Style It","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2014-05-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fced0686-f56d-4163-80fd-362ee652d148","source":"wordfence","cve":"CVE-2024-47323","title":"WP Timeline \u2013 Vertical and Horizontal timeline plugin <= 3.6.7 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fced0686-f56d-4163-80fd-362ee652d148?source=api-prod","affected":[{"type":"plugin","slug":"wp-timelines","name":"WP Timeline \u2013 Vertical and Horizontal timeline plugin","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:29:29Z"},{"id":"wordfence:fcf005ba-2753-43f5-9f2b-24a8c59505c1","source":"wordfence","cve":"CVE-2021-34643","title":"Skaut bazar <= 1.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcf005ba-2753-43f5-9f2b-24a8c59505c1?source=api-prod","affected":[{"type":"plugin","slug":"skaut-bazar","name":"Scout bazar","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2021-08-13T15:31:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcf09793-1277-41a0-9ce4-b85b13721729","source":"wordfence","cve":"CVE-2023-33210","title":"nuajik CDN <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcf09793-1277-41a0-9ce4-b85b13721729?source=api-prod","affected":[{"type":"plugin","slug":"nuajik-cdn","name":"nuajik","from":"*","from_inclusive":true,"to":"0.1.0","to_inclusive":true,"patched_in":""}],"published":"2023-05-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcf4bf2c-2f65-415b-bbf3-d7c01d88c8f8","source":"wordfence","cve":"CVE-2026-49058","title":"LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcf4bf2c-2f65-415b-bbf3-d7c01d88c8f8?source=api-prod","affected":[{"type":"plugin","slug":"loginpress-pro","name":"LoginPress Pro","from":"*","from_inclusive":true,"to":"6.2.2","to_inclusive":true,"patched_in":"6.2.3"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:47:22Z"},{"id":"wordfence:fcf740e1-5dbe-4849-a8b8-02d21b4d5543","source":"wordfence","cve":"CVE-2026-104672","title":"GiveWP \u2013 Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcf740e1-5dbe-4849-a8b8-02d21b4d5543?source=api-prod","affected":[{"type":"plugin","slug":"give","name":"GiveWP \u2013 Donation Plugin and Fundraising Platform","from":"*","from_inclusive":true,"to":"4.17.0","to_inclusive":true,"patched_in":"4.18.0"}],"published":"2026-10-05T10:49:31Z","updated":"2026-10-08T23:27:11Z"},{"id":"wordfence:fcfb3a6e-7b58-4568-8439-e9c68a2223b9","source":"wordfence","cve":"CVE-2023-25991","title":"RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcfb3a6e-7b58-4568-8439-e9c68a2223b9?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.1.9.2","to_inclusive":true,"patched_in":"5.1.9.3"}],"published":"2023-02-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fcfe2625-3ee8-4822-8088-abf0b898bebb","source":"wordfence","cve":"CVE-2026-24549","title":"GeoDirectory <= 2.8.149 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcfe2625-3ee8-4822-8088-abf0b898bebb?source=api-prod","affected":[{"type":"plugin","slug":"geodirectory","name":"GeoDirectory \u2013 WP Business Directory Plugin and Classified Listings Directory","from":"*","from_inclusive":true,"to":"2.8.149","to_inclusive":true,"patched_in":"2.8.150"}],"published":"2026-01-23T00:00:00Z","updated":"2026-01-28T16:24:37Z"},{"id":"wordfence:fcfe5129-854a-4dc0-a5ba-34b2ff38486e","source":"wordfence","cve":"CVE-2025-32515","title":"Terminal Africa <= 1.13.17 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcfe5129-854a-4dc0-a5ba-34b2ff38486e?source=api-prod","affected":[{"type":"plugin","slug":"terminal-africa","name":"Terminal Africa","from":"*","from_inclusive":true,"to":"1.13.17","to_inclusive":true,"patched_in":""}],"published":"2025-04-10T00:00:00Z","updated":"2025-04-16T19:48:52Z"},{"id":"wordfence:fcfe67fc-a59d-4660-b730-b97c1bebdfb7","source":"wordfence","cve":"CVE-2025-32274","title":"WP w3all phpBB <= 2.9.8 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fcfe67fc-a59d-4660-b730-b97c1bebdfb7?source=api-prod","affected":[{"type":"plugin","slug":"wp-w3all-phpbb-integration","name":"WP w3all phpBB","from":"*","from_inclusive":true,"to":"2.9.8","to_inclusive":true,"patched_in":"2.9.9"}],"published":"2025-04-04T00:00:00Z","updated":"2025-07-10T14:15:25Z"},{"id":"wordfence:fd00c5cc-1a28-4d94-815d-46219ce0e0e9","source":"wordfence","cve":"CVE-2023-46634","title":"Custom My Account for Woocommerce <= 2.1 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd00c5cc-1a28-4d94-815d-46219ce0e0e9?source=api-prod","affected":[{"type":"plugin","slug":"custom-my-account-for-woocommerce","name":"Custom My Account for Woocommerce","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2023-10-25T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd03684a-3c97-4364-bcb9-a1938edf9ce3","source":"wordfence","cve":"CVE-2025-49377","title":"Hydra Booking <= 1.1.9 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd03684a-3c97-4364-bcb9-a1938edf9ce3?source=api-prod","affected":[{"type":"plugin","slug":"hydra-booking","name":"Hydra Booking \u2014 Appointment Scheduling & Booking Calendar","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.1.10"}],"published":"2025-06-12T00:00:00Z","updated":"2025-11-04T17:05:19Z"},{"id":"wordfence:fd05991d-382b-460c-b89f-e1f7dfac9e60","source":"wordfence","cve":"","title":"SP Projects & Document Manager <= 2.5.9.5 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd05991d-382b-460c-b89f-e1f7dfac9e60?source=api-prod","affected":[{"type":"plugin","slug":"sp-client-document-manager","name":"SP Project & Document Manager","from":"*","from_inclusive":true,"to":"2.6.0.0","to_inclusive":true,"patched_in":"2.6.1.4"}],"published":"2016-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd063077-7fda-4c64-abc8-c7456c3dc2b8","source":"wordfence","cve":"CVE-2026-54838","title":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd063077-7fda-4c64-abc8-c7456c3dc2b8?source=api-prod","affected":[{"type":"plugin","slug":"wc-vendors","name":"WC Vendors \u2013 WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors","from":"*","from_inclusive":true,"to":"2.6.8","to_inclusive":true,"patched_in":"2.6.9"}],"published":"2026-06-18T00:00:00Z","updated":"2026-06-23T15:52:28Z"},{"id":"wordfence:fd0c3965-6b35-46a8-8cf0-6726cdb03c8f","source":"wordfence","cve":"","title":"Code Snippets < 2.7.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0c3965-6b35-46a8-8cf0-6726cdb03c8f?source=api-prod","affected":[{"type":"plugin","slug":"code-snippets","name":"Code Snippets","from":"*","from_inclusive":true,"to":"2.7.0","to_inclusive":false,"patched_in":"2.7.0"}],"published":"2016-07-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd0e6ca6-f6a7-4e81-aea1-3b59de0173d6","source":"wordfence","cve":"CVE-2026-6910","title":"Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0e6ca6-f6a7-4e81-aea1-3b59de0173d6?source=api-prod","affected":[{"type":"plugin","slug":"bookeropl","name":"Bookero.pl \u2013 system rezerwacji online","from":"*","from_inclusive":true,"to":"2.2","to_inclusive":true,"patched_in":"2.3"}],"published":"2026-07-08T17:50:42Z","updated":"2026-07-09T06:52:52Z"},{"id":"wordfence:fd0f2802-3273-42e9-a219-911f143b905d","source":"wordfence","cve":"CVE-2024-44046","title":"Themify \u2013 WooCommerce Product Filter <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd0f2802-3273-42e9-a219-911f143b905d?source=api-prod","affected":[{"type":"plugin","slug":"themify-wc-product-filter","name":"Themify \u2013 WooCommerce Product Filter","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2024-09-23T00:00:00Z","updated":"2024-10-02T20:00:25Z"},{"id":"wordfence:fd12a952-2e99-41f7-b74c-55c2b7d8deed","source":"wordfence","cve":"CVE-2020-36731","title":"Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd12a952-2e99-41f7-b74c-55c2b7d8deed?source=api-prod","affected":[{"type":"plugin","slug":"flexible-checkout-fields","name":"Flexible Checkout Fields for WooCommerce \u2013 WooCommerce Checkout Manager","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":false,"patched_in":"2.3.2"}],"published":"2020-02-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd12ce4a-585d-4e26-88fb-1ab9dcc8727d","source":"wordfence","cve":"","title":"RestroPress <= 2.8.3 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd12ce4a-585d-4e26-88fb-1ab9dcc8727d?source=api-prod","affected":[{"type":"plugin","slug":"restropress","name":"RestroPress \u2013 Online Food Ordering System","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.3.1"}],"published":"2021-07-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd15268f-7e06-4e0d-baaf-f27348af61ce","source":"wordfence","cve":"CVE-2024-0867","title":"Email Log <= 2.4.8 - Unauthenticated Hook Injection","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15268f-7e06-4e0d-baaf-f27348af61ce?source=api-prod","affected":[{"type":"plugin","slug":"email-log","name":"Email Log","from":"*","from_inclusive":true,"to":"2.4.8","to_inclusive":true,"patched_in":"2.4.9"}],"published":"2024-05-23T17:05:18Z","updated":"2024-05-24T05:30:55Z"},{"id":"wordfence:fd154b26-985b-4e72-976f-1858a783c667","source":"wordfence","cve":"CVE-2020-5767","title":"Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd154b26-985b-4e72-976f-1858a783c667?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.5.1","to_inclusive":false,"patched_in":"4.5.1"}],"published":"2020-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd15f5c3-f4c3-40d3-b0ae-eee7ed9ed434","source":"wordfence","cve":"","title":"Spider Facebook <= 1.0.8 - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd15f5c3-f4c3-40d3-b0ae-eee7ed9ed434?source=api-prod","affected":[{"type":"plugin","slug":"spider-facebook","name":"WDSocialWidgets","from":"*","from_inclusive":true,"to":"1.0.8","to_inclusive":true,"patched_in":"1.0.9"}],"published":"2014-09-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd16aa34-b0ba-4874-8e63-657320470a1c","source":"wordfence","cve":"CVE-2026-114711","title":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd16aa34-b0ba-4874-8e63-657320470a1c?source=api-prod","affected":[{"type":"plugin","slug":"dc-woocommerce-multi-vendor","name":"MultiVendorX \u2013 WooCommerce Multivendor Marketplace AI Powered Solutions","from":"*","from_inclusive":true,"to":"5.0.20","to_inclusive":true,"patched_in":"5.0.21"}],"published":"2026-10-30T08:29:26Z","updated":"2026-11-03T19:25:12Z"},{"id":"wordfence:fd1704ef-e259-40a3-974b-128145bc8a4a","source":"wordfence","cve":"CVE-2025-13126","title":"wpForo Forum <= 2.4.12 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd1704ef-e259-40a3-974b-128145bc8a4a?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":true,"patched_in":"2.4.13"}],"published":"2025-12-13T16:20:06Z","updated":"2025-12-14T04:20:41Z"},{"id":"wordfence:fd191128-86c8-4530-b5cf-6681899b9474","source":"wordfence","cve":"CVE-2024-38745","title":"Wholesale Suite <= 2.1.12 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd191128-86c8-4530-b5cf-6681899b9474?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-wholesale-prices","name":"Wholesale Suite \u2013 B2B, Dynamic Pricing & WooCommerce Wholesale Prices","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-07-11T00:00:00Z","updated":"2024-07-17T13:10:04Z"},{"id":"wordfence:fd192a52-ae12-4706-b3ea-aa69f7393bb8","source":"wordfence","cve":"CVE-2024-10538","title":"Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd192a52-ae12-4706-b3ea-aa69f7393bb8?source=api-prod","affected":[{"type":"plugin","slug":"happy-elementor-addons","name":"HappyAddons for Elementor \u2013 160 Elementor Widgets, GSAP Animations & Templates","from":"*","from_inclusive":true,"to":"3.12.5","to_inclusive":true,"patched_in":"3.12.6"}],"published":"2024-11-11T14:44:54Z","updated":"2024-11-12T03:24:59Z"},{"id":"wordfence:fd1b88bb-9b31-42e8-a826-b64abe2d41c4","source":"wordfence","cve":"CVE-2025-26587","title":"sidebarTabs <= 3.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd1b88bb-9b31-42e8-a826-b64abe2d41c4?source=api-prod","affected":[{"type":"plugin","slug":"sidebartabs","name":"sidebarTabs","from":"*","from_inclusive":true,"to":"3.1","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-02-18T21:08:46Z"},{"id":"wordfence:fd1c679b-43e0-4e3a-ae2d-f6ff8a657512","source":"wordfence","cve":"CVE-2026-12399","title":"Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd1c679b-43e0-4e3a-ae2d-f6ff8a657512?source=api-prod","affected":[{"type":"plugin","slug":"gutenverse","name":"Gutenverse \u2013 WordPress Blocks, Page Builder & Site Editor","from":"*","from_inclusive":true,"to":"3.8.0","to_inclusive":true,"patched_in":"3.8.1"}],"published":"2026-06-26T17:52:15Z","updated":"2026-06-27T06:50:59Z"},{"id":"wordfence:fd204edd-375e-437d-9964-bbf3b8abeab8","source":"wordfence","cve":"CVE-2025-23897","title":"Apply with LinkedIn buttons <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd204edd-375e-437d-9964-bbf3b8abeab8?source=api-prod","affected":[{"type":"plugin","slug":"apply-with-linkedin-buttons","name":"Apply with LinkedIn buttons","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-21T16:38:14Z"},{"id":"wordfence:fd216743-ce8d-4632-9fd1-d63502c2dfcd","source":"wordfence","cve":"CVE-2026-8365","title":"Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd216743-ce8d-4632-9fd1-d63502c2dfcd?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.1.41","to_inclusive":true,"patched_in":"2.1.42"}],"published":"2026-06-08T20:11:29Z","updated":"2026-06-09T08:29:40Z"},{"id":"wordfence:fd21b3fb-656d-4060-b7c6-e0b8e79afb4c","source":"wordfence","cve":"","title":"Image Gallery - Responsive Photo Gallery <= 1.5.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21b3fb-656d-4060-b7c6-e0b8e79afb4c?source=api-prod","affected":[{"type":"plugin","slug":"gallery-images","name":"Image Gallery - Responsive Photo Gallery","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":false,"patched_in":"1.5.6"}],"published":"2015-08-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62","source":"wordfence","cve":"CVE-2024-2473","title":"WPS Hide Login <= 1.9.15.2 - Login Page Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=api-prod","affected":[{"type":"plugin","slug":"wps-hide-login","name":"WPS Hide Login","from":"*","from_inclusive":true,"to":"1.9.15.2","to_inclusive":true,"patched_in":"1.9.16"}],"published":"2024-06-10T00:00:00Z","updated":"2024-06-11T15:08:49Z"},{"id":"wordfence:fd22babc-f1a9-4f50-9756-fe692105dca3","source":"wordfence","cve":"CVE-2022-47140","title":"ARMember <= 4.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd22babc-f1a9-4f50-9756-fe692105dca3?source=api-prod","affected":[{"type":"plugin","slug":"armember-membership","name":"ARMember \u2013 Membership Plugin, Content Restriction, Member Levels, User Profile & User signup","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":"4.0.1"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd235256-e48c-4f1b-a51b-25669b560c77","source":"wordfence","cve":"CVE-2024-34560","title":"gee Search Plus, improved WordPress search <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd235256-e48c-4f1b-a51b-25669b560c77?source=api-prod","affected":[{"type":"plugin","slug":"gsearch-plus","name":"gee Search Plus, improved WordPress search","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":""}],"published":"2024-05-07T00:00:00Z","updated":"2024-05-16T11:50:47Z"},{"id":"wordfence:fd23b9cd-3492-4f6f-b90d-5215e175c1e3","source":"wordfence","cve":"CVE-2018-10100","title":"WordPress Core < 4.9.5 - Open Redirect","severity":"medium","cvss":5.4,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd23b9cd-3492-4f6f-b90d-5215e175c1e3?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.25","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.23","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.22","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.19","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.15","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.14","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.13","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.10","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.9","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.5","to_inclusive":true,"patched_in":"3.7.26"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.4","to_inclusive":true,"patched_in":"3.7.26"}],"published":"2018-04-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd24b087-83a7-4f9a-8f7a-1bd94332c1f7","source":"wordfence","cve":"CVE-2025-14138","title":"WPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd24b087-83a7-4f9a-8f7a-1bd94332c1f7?source=api-prod","affected":[{"type":"plugin","slug":"wplg-default-mail-from","name":"WPLG Default Mail From","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-12-11T14:27:30Z","updated":"2026-01-05T16:41:23Z"},{"id":"wordfence:fd25b485-1355-4654-a75f-ec2334ba34de","source":"wordfence","cve":"CVE-2025-31617","title":"PostmarkApp Email Integrator <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd25b485-1355-4654-a75f-ec2334ba34de?source=api-prod","affected":[{"type":"plugin","slug":"postmarkapp-email-integrator","name":"PostmarkApp Email Integrator","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5.0"}],"published":"2025-03-31T00:00:00Z","updated":"2026-04-15T13:27:45Z"},{"id":"wordfence:fd28c405-ed2f-435a-806c-1fc43cac0f80","source":"wordfence","cve":"CVE-2025-2519","title":"Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd28c405-ed2f-435a-806c-1fc43cac0f80?source=api-prod","affected":[{"type":"theme","slug":"streamit","name":"Streamit","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2025-04-04T00:00:00Z","updated":"2025-04-08T01:44:22Z"},{"id":"wordfence:fd2b816a-fbb1-4c6f-8f0a-4ef2e77f845e","source":"wordfence","cve":"CVE-2022-1689","title":"Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via Update","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd2b816a-fbb1-4c6f-8f0a-4ef2e77f845e?source=api-prod","affected":[{"type":"plugin","slug":"note-press","name":"Note Press","from":"*","from_inclusive":true,"to":"0.1.10","to_inclusive":true,"patched_in":""}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd2fed79-3ed2-4a05-b0b1-e902f53a1933","source":"wordfence","cve":"CVE-2025-63041","title":"Forget About Shortcode Buttons <= 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd2fed79-3ed2-4a05-b0b1-e902f53a1933?source=api-prod","affected":[{"type":"plugin","slug":"forget-about-shortcode-buttons","name":"Forget About Shortcode Buttons","from":"*","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":""}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:32:45Z"},{"id":"wordfence:fd30fea3-c326-40b7-9b09-e62d65b33926","source":"wordfence","cve":"CVE-2026-32348","title":"MAS Videos <= 1.3.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd30fea3-c326-40b7-9b09-e62d65b33926?source=api-prod","affected":[{"type":"plugin","slug":"masvideos","name":"MAS Videos","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2026-02-11T00:00:00Z","updated":"2026-04-15T20:48:36Z"},{"id":"wordfence:fd3298dd-af80-481e-8d20-d33e7bb9bb85","source":"wordfence","cve":"CVE-2021-39344","title":"KJM Admin Notices <= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3298dd-af80-481e-8d20-d33e7bb9bb85?source=api-prod","affected":[{"type":"plugin","slug":"kjm-admin-notices","name":"KJM Admin Notices","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-10-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd368b2c-ef40-453b-aeef-ad88d847c29b","source":"wordfence","cve":"CVE-2022-47439","title":"Open Graphite <= 1.6.0 - Reflected Cross-Site Scripting via topic parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd368b2c-ef40-453b-aeef-ad88d847c29b?source=api-prod","affected":[{"type":"plugin","slug":"open-graphite","name":"Open Graphite","from":"*","from_inclusive":true,"to":"1.6.0","to_inclusive":true,"patched_in":"1.6.1"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd3746dc-bcb1-4f62-b683-844704192b0d","source":"wordfence","cve":"CVE-2024-54318","title":"NiceJob <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3746dc-bcb1-4f62-b683-844704192b0d?source=api-prod","affected":[{"type":"plugin","slug":"nicejob","name":"NiceJob","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.7.2"}],"published":"2024-12-11T00:00:00Z","updated":"2024-12-19T16:18:25Z"},{"id":"wordfence:fd399ed3-03b2-477c-b38c-549d6066b6e8","source":"wordfence","cve":"CVE-2026-8690","title":"RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd399ed3-03b2-477c-b38c-549d6066b6e8?source=api-prod","affected":[{"type":"plugin","slug":"rentmy-online-rental-shop","name":"RentMy Real-Time Rental Management Plugin","from":"*","from_inclusive":true,"to":"4.0.4.1","to_inclusive":true,"patched_in":""}],"published":"2026-06-23T16:38:37Z","updated":"2026-10-13T16:04:13Z"},{"id":"wordfence:fd3b4c44-d47a-45de-bcb2-0820e475b331","source":"wordfence","cve":"CVE-2024-10687","title":"Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery \u2013 Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3b4c44-d47a-45de-bcb2-0820e475b331?source=api-prod","affected":[{"type":"plugin","slug":"contest-gallery","name":"Contest Gallery Commerce \u2013 Upload, Vote & Sell with PayPal & Stripe","from":"*","from_inclusive":true,"to":"24.0.3","to_inclusive":true,"patched_in":"24.0.4"}],"published":"2024-11-04T21:11:26Z","updated":"2024-11-05T09:30:59Z"},{"id":"wordfence:fd3b95ce-3051-4b41-8bf4-362fa6be6ce5","source":"wordfence","cve":"CVE-2026-18937","title":"Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3b95ce-3051-4b41-8bf4-362fa6be6ce5?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-checker","name":"Broken Link Checker","from":"*","from_inclusive":true,"to":"2.4.12","to_inclusive":false,"patched_in":"2.4.12"}],"published":"2026-08-21T00:00:00Z","updated":"2026-08-24T16:13:36Z"},{"id":"wordfence:fd3bf470-f966-454d-8df3-0dec4682e883","source":"wordfence","cve":"CVE-2026-0632","title":"Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3bf470-f966-454d-8df3-0dec4682e883?source=api-prod","affected":[{"type":"plugin","slug":"fluentformpro","name":"Fluent Forms Pro Add On Pack","from":"*","from_inclusive":true,"to":"6.1.12","to_inclusive":true,"patched_in":"6.1.13"}],"published":"2026-02-08T22:49:11Z","updated":"2026-02-09T11:25:00Z"},{"id":"wordfence:fd3cd605-6292-4a04-9aee-f4b9a8127e8e","source":"wordfence","cve":"CVE-2023-28168","title":"WordPress Console <= 0.3.9 - Missing Authorization via reload.php","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3cd605-6292-4a04-9aee-f4b9a8127e8e?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-console","name":"WordPress Console","from":"*","from_inclusive":true,"to":"0.3.9","to_inclusive":true,"patched_in":""}],"published":"2023-03-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd3d9ce8-0ebf-490e-8c3a-73883638c3eb","source":"wordfence","cve":"","title":"NextGEN Gallery Sell Photo <= 1.0.4 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3d9ce8-0ebf-490e-8c3a-73883638c3eb?source=api-prod","affected":[{"type":"plugin","slug":"nextgen-gallery-sell-photo","name":"NextGEN Gallery Sell Photo","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2020-08-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd42b0f2-cb28-41b0-b8df-f7d06c273168","source":"wordfence","cve":"CVE-2024-51654","title":"APK Downloader <= 1.0.0 - Cross-Site Request Forgery to Stored Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd42b0f2-cb28-41b0-b8df-f7d06c273168?source=api-prod","affected":[{"type":"plugin","slug":"apk-downloader","name":"APK Downloader","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-01T00:00:00Z","updated":"2024-11-06T21:03:06Z"},{"id":"wordfence:fd4446b0-3274-46c7-865a-0a168acb960f","source":"wordfence","cve":"CVE-2014-6445","title":"Contact Form 7 Integrations 1.0 - 1.3.10 - Multiple Cross-Site scripting","severity":"medium","cvss":5.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd4446b0-3274-46c7-865a-0a168acb960f?source=api-prod","affected":[{"type":"plugin","slug":"contact-form-7-integrations","name":"Contact Form 7 Integrations","from":"1.0","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2014-10-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd46c8ee-975d-44d8-8083-e89c31c69aa7","source":"wordfence","cve":"CVE-2025-32541","title":"WooCommerce Sales MIS Report <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd46c8ee-975d-44d8-8083-e89c31c69aa7?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-mis-report","name":"WooCommerce Sales MIS Report","from":"*","from_inclusive":true,"to":"4.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-16T20:00:34Z"},{"id":"wordfence:fd4714d1-3824-4436-bca0-f4eb6b11830c","source":"wordfence","cve":"CVE-2026-74020","title":"Koji <= 2.2.1 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd4714d1-3824-4436-bca0-f4eb6b11830c?source=api-prod","affected":[{"type":"theme","slug":"koji","name":"Koji","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":"2.2.2"}],"published":"2026-08-19T00:00:00Z","updated":"2026-09-09T16:12:09Z"},{"id":"wordfence:fd47e990-b48f-486e-87ac-2bb68d440ba8","source":"wordfence","cve":"CVE-2025-32170","title":"Motors <= 1.4.71 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd47e990-b48f-486e-87ac-2bb68d440ba8?source=api-prod","affected":[{"type":"plugin","slug":"motors-car-dealership-classified-listings","name":"Motors \u2013 Car Dealership & Classified Listings Plugin","from":"*","from_inclusive":true,"to":"1.4.71","to_inclusive":true,"patched_in":"1.4.72"}],"published":"2025-04-04T00:00:00Z","updated":"2025-05-07T14:09:46Z"},{"id":"wordfence:fd4ac2b0-120a-4e68-bf8d-e039336fe9dc","source":"wordfence","cve":"CVE-2017-5491","title":"WordPress Core < 4.7.1 -  Authorization Bypass","severity":"high","cvss":8.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd4ac2b0-120a-4e68-bf8d-e039336fe9dc?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.16","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.14","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.13","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.10","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.6","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.5","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.4","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.1","to_inclusive":true,"patched_in":"3.7.17"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.0","to_inclusive":true,"patched_in":"3.7.17"}],"published":"2017-01-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd4eeb13-869d-47ba-a2d3-73886abc1e03","source":"wordfence","cve":"CVE-2026-15255","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd4eeb13-869d-47ba-a2d3-73886abc1e03?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.9.4","to_inclusive":false,"patched_in":"6.0.9.4"}],"published":"2026-07-30T00:00:00Z","updated":"2026-08-04T19:38:40Z"},{"id":"wordfence:fd50ac2c-3049-4a44-b7f8-a5f87c42555c","source":"wordfence","cve":"CVE-2025-8898","title":"Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd50ac2c-3049-4a44-b7f8-a5f87c42555c?source=api-prod","affected":[{"type":"plugin","slug":"ecab-taxi-booking-manager","name":"E-cab Taxi Booking Manager for Woocommerce","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2025-08-15T00:00:00Z","updated":"2025-09-03T17:36:23Z"},{"id":"wordfence:fd53b4e1-c6b7-4111-911a-04b14c7a9c4e","source":"wordfence","cve":"CVE-2023-4690","title":"Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd53b4e1-c6b7-4111-911a-04b14c7a9c4e?source=api-prod","affected":[{"type":"plugin","slug":"addon-elements-for-elementor-page-builder","name":"Addon Elements for Elementor (formerly Elementor Addon Elements)","from":"*","from_inclusive":true,"to":"1.12.7","to_inclusive":true,"patched_in":"1.12.8"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd54bedf-0bec-46ff-a555-c88eaa04068b","source":"wordfence","cve":"CVE-2025-31375","title":"Scheduled <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd54bedf-0bec-46ff-a555-c88eaa04068b?source=api-prod","affected":[{"type":"plugin","slug":"scheduled","name":"Scheduled","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:52:03Z"},{"id":"wordfence:fd5638b6-134d-4386-af40-6ac961a915d7","source":"wordfence","cve":"CVE-2025-1668","title":"School Management System \u2013 WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5638b6-134d-4386-af40-6ac961a915d7?source=api-prod","affected":[{"type":"plugin","slug":"wpschoolpress","name":"School Management System \u2013 WPSchoolPress","from":"*","from_inclusive":true,"to":"2.2.16","to_inclusive":true,"patched_in":"2.2.17"}],"published":"2025-03-14T14:23:26Z","updated":"2025-11-05T19:41:23Z"},{"id":"wordfence:fd56e59b-3879-4ab6-ae9a-7a301ee6aa20","source":"wordfence","cve":"CVE-2021-38346","title":"Brizy Page Builder <= 2.3.11 - Authenticated File Upload and Path Traversal","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd56e59b-3879-4ab6-ae9a-7a301ee6aa20?source=api-prod","affected":[{"type":"plugin","slug":"brizy","name":"Brizy \u2013 Page Builder","from":"*","from_inclusive":true,"to":"2.3.11","to_inclusive":true,"patched_in":"2.3.12"}],"published":"2021-10-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd5d9ebc-101a-4a7d-856c-d7140084dcf5","source":"wordfence","cve":"CVE-2026-116394","title":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.9 - Unauthenticated HTML Injection","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5d9ebc-101a-4a7d-856c-d7140084dcf5?source=api-prod","affected":[{"type":"plugin","slug":"mage-eventpress","name":"Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP & Event Calendar","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.7.10"}],"published":"2026-10-26T00:00:00Z","updated":"2026-10-28T15:10:42Z"},{"id":"wordfence:fd5f370c-743f-41f1-80ab-7f0805cae38c","source":"wordfence","cve":"CVE-2026-1987","title":"Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification","severity":"medium","cvss":5.4,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5f370c-743f-41f1-80ab-7f0805cae38c?source=api-prod","affected":[{"type":"plugin","slug":"scheduler-widget","name":"Scheduler Widget","from":"*","from_inclusive":true,"to":"0.1.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:27:43Z","updated":"2026-02-14T06:42:37Z"},{"id":"wordfence:fd5fb3fb-425a-458b-b3cb-92cd23f50726","source":"wordfence","cve":"CVE-2026-49076","title":"JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5fb3fb-425a-458b-b3cb-92cd23f50726?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.9.1","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-15T19:39:55Z"},{"id":"wordfence:fd60fa87-d3da-4e3f-bd9b-b9d117bdbc4c","source":"wordfence","cve":"CVE-2018-9844","title":"WordPress File Upload <= 4.3.3 - Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd60fa87-d3da-4e3f-bd9b-b9d117bdbc4c?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"4.3.4","to_inclusive":false,"patched_in":"4.3.4"}],"published":"2018-04-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd61aa6f-79c5-4f81-964e-e71412d45b35","source":"wordfence","cve":"CVE-2026-103909","title":"Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd61aa6f-79c5-4f81-964e-e71412d45b35?source=api-prod","affected":[{"type":"plugin","slug":"calculated-fields-form","name":"Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 Contact, Payment, Quote, Quiz & More","from":"*","from_inclusive":true,"to":"5.5.1.5","to_inclusive":true,"patched_in":"5.5.1.6"}],"published":"2026-10-02T16:36:24Z","updated":"2026-10-03T05:29:20Z"},{"id":"wordfence:fd63512d-1c83-4a04-9f12-05df56ae01c1","source":"wordfence","cve":"CVE-2026-114422","title":"Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd63512d-1c83-4a04-9f12-05df56ae01c1?source=api-prod","affected":[{"type":"plugin","slug":"enable-media-replace","name":"Enable Media Replace","from":"4.1.4","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2026-10-28T00:00:00Z","updated":"2026-11-03T19:24:43Z"},{"id":"wordfence:fd64b351-fbce-4c75-bdd7-3b38a1b5d049","source":"wordfence","cve":"CVE-2026-49061","title":"WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd64b351-fbce-4c75-bdd7-3b38a1b5d049?source=api-prod","affected":[{"type":"plugin","slug":"wpc-product-options","name":"WPC Product Options for WooCommerce","from":"*","from_inclusive":true,"to":"3.2.1","to_inclusive":true,"patched_in":"3.2.2"}],"published":"2026-06-08T00:00:00Z","updated":"2026-06-18T13:46:07Z"},{"id":"wordfence:fd671562-adc8-40b0-af26-9daef70effa6","source":"wordfence","cve":"CVE-2016-10993","title":"ScoreMe <= 2016-04-01 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd671562-adc8-40b0-af26-9daef70effa6?source=api-prod","affected":[{"type":"theme","slug":"scoreme","name":"ScoreMe","from":"*","from_inclusive":true,"to":"2016-04-01","to_inclusive":true,"patched_in":""}],"published":"2016-04-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd67e334-88fd-49c7-a20c-9c2f95e9950c","source":"wordfence","cve":"CVE-2021-24296","title":"WP Customer Reviews <= 3.5.5 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd67e334-88fd-49c7-a20c-9c2f95e9950c?source=api-prod","affected":[{"type":"plugin","slug":"wp-customer-reviews","name":"WP Customer Reviews","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.5.6"}],"published":"2021-05-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd683a80-2090-4f9b-8342-7cc76675067e","source":"wordfence","cve":"CVE-2024-6130","title":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder  <= 1.15.25 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd683a80-2090-4f9b-8342-7cc76675067e?source=api-prod","affected":[{"type":"plugin","slug":"form-maker","name":"Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact Form Builder","from":"*","from_inclusive":true,"to":"1.15.25","to_inclusive":true,"patched_in":"1.15.26"}],"published":"2024-06-10T00:00:00Z","updated":"2026-09-04T17:36:16Z"},{"id":"wordfence:fd68a27f-e4d1-4f8e-ba35-e8dfa7756856","source":"wordfence","cve":"CVE-2025-53318","title":"WP DB Booster <= 1.0.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd68a27f-e4d1-4f8e-ba35-e8dfa7756856?source=api-prod","affected":[{"type":"plugin","slug":"wp-db-booster","name":"WP DB Booster","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-06-27T00:00:00Z","updated":"2025-07-01T19:42:23Z"},{"id":"wordfence:fd6b3ebe-a29b-4509-bb8c-d101073f21dc","source":"wordfence","cve":"CVE-2015-9355","title":"Two Factor Authentication < 1.1.10 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd6b3ebe-a29b-4509-bb8c-d101073f21dc?source=api-prod","affected":[{"type":"plugin","slug":"two-factor-authentication","name":"Two Factor Authentication","from":"*","from_inclusive":true,"to":"1.1.10","to_inclusive":false,"patched_in":"1.1.10"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd6f6a2c-59d3-4091-82ac-0edf9f47ef65","source":"wordfence","cve":"CVE-2025-3670","title":"KiwiChat NextClient <= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd6f6a2c-59d3-4091-82ac-0edf9f47ef65?source=api-prod","affected":[{"type":"plugin","slug":"kiwichat","name":"KiwiChat NextClient","from":"*","from_inclusive":true,"to":"6.2","to_inclusive":true,"patched_in":""}],"published":"2025-05-01T13:11:58Z","updated":"2025-05-02T01:43:36Z"},{"id":"wordfence:fd739eb1-4d63-42a2-85ba-a4cfc034628f","source":"wordfence","cve":"CVE-2026-22521","title":"Handmade Framework <= 3.9 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd739eb1-4d63-42a2-85ba-a4cfc034628f?source=api-prod","affected":[{"type":"plugin","slug":"handmade-framework","name":"Handmade Framework","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-14T20:07:50Z"},{"id":"wordfence:fd7415b1-846f-41ad-a19f-73d0cee3965f","source":"wordfence","cve":"CVE-2024-35641","title":"Just Writing Statistics <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7415b1-846f-41ad-a19f-73d0cee3965f?source=api-prod","affected":[{"type":"plugin","slug":"just-writing-statistics","name":"Just Writing Statistics","from":"*","from_inclusive":true,"to":"4.5","to_inclusive":true,"patched_in":"4.6"}],"published":"2024-05-30T00:00:00Z","updated":"2024-06-05T14:16:35Z"},{"id":"wordfence:fd741e2d-5478-4b9a-83ab-7ccafdc5d12f","source":"wordfence","cve":"CVE-2023-1125","title":"Ruby Help Desk <= 1.3.3 - Missing Authorization to Arbitrary Ticket Modification","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd741e2d-5478-4b9a-83ab-7ccafdc5d12f?source=api-prod","affected":[{"type":"plugin","slug":"ruby-help-desk","name":"Ruby Help Desk","from":"*","from_inclusive":true,"to":"1.3.3","to_inclusive":true,"patched_in":"1.3.4"}],"published":"2023-04-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd74672c-8d41-4f3d-9989-f2f60a0c5a88","source":"wordfence","cve":"CVE-2026-27396","title":"Directory Pro <= 2.5.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd74672c-8d41-4f3d-9989-f2f60a0c5a88?source=api-prod","affected":[{"type":"plugin","slug":"directory-pro","name":"Directory Pro","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":""}],"published":"2026-02-23T00:00:00Z","updated":"2026-03-05T18:01:22Z"},{"id":"wordfence:fd74bcec-df6f-4f82-8f88-6cb1adde35ed","source":"wordfence","cve":"CVE-2022-3419","title":"Automatic User Roles Switcher <= 1.1.1 - Missing Authorization to Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd74bcec-df6f-4f82-8f88-6cb1adde35ed?source=api-prod","affected":[{"type":"plugin","slug":"automatic-user-roles-switcher","name":"Automatic User Roles Switcher","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2022-10-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd75e795-54b8-4b9a-9417-9f707215ebfa","source":"wordfence","cve":"CVE-2026-14342","title":"Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd75e795-54b8-4b9a-9417-9f707215ebfa?source=api-prod","affected":[{"type":"plugin","slug":"mail-mint","name":"Mail Mint \u2013 Email Marketing, Automation & WooCommerce Emails with AI Assistance","from":"*","from_inclusive":true,"to":"1.24.2","to_inclusive":true,"patched_in":"1.24.3"}],"published":"2026-07-08T19:35:45Z","updated":"2026-07-09T07:55:14Z"},{"id":"wordfence:fd782479-8eab-439d-9a8e-b4105e49964c","source":"wordfence","cve":"CVE-2022-4784","title":"Hueman Addons <= 2.3.3 - Authenticated (Contributor+) Stored Cross Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd782479-8eab-439d-9a8e-b4105e49964c?source=api-prod","affected":[{"type":"plugin","slug":"hueman-addons","name":"Hueman Addons","from":"*","from_inclusive":true,"to":"2.3.3","to_inclusive":true,"patched_in":""}],"published":"2023-01-26T00:00:00Z","updated":"2024-05-31T15:31:01Z"},{"id":"wordfence:fd78d162-d9aa-4623-9b89-5f1455739836","source":"wordfence","cve":"CVE-2025-24686","title":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd78d162-d9aa-4623-9b89-5f1455739836?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"6.0.3.3","to_inclusive":true,"patched_in":"6.0.3.4"}],"published":"2025-01-28T00:00:00Z","updated":"2025-02-24T16:16:45Z"},{"id":"wordfence:fd7916f3-7844-4f3f-87ae-a8a66a9f3dec","source":"wordfence","cve":"CVE-2015-9318","title":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin <=  3.1.6 - Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7916f3-7844-4f3f-87ae-a8a66a9f3dec?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"3.1.7","to_inclusive":false,"patched_in":"3.1.7"}],"published":"2015-05-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd7a1440-18f5-4bcb-a4cf-c4713375d0a1","source":"wordfence","cve":"CVE-2023-44246","title":"Shockingly Simple Favicon <= 1.8.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7a1440-18f5-4bcb-a4cf-c4713375d0a1?source=api-prod","affected":[{"type":"plugin","slug":"shockingly-simple-favicon","name":"Shockingly Simple Favicon","from":"*","from_inclusive":true,"to":"1.8.2","to_inclusive":true,"patched_in":""}],"published":"2023-09-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd7b0eef-3b8e-4272-bbd7-ad52088d0835","source":"wordfence","cve":"CVE-2025-7518","title":"RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read","severity":"medium","cvss":4.9,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7b0eef-3b8e-4272-bbd7-ad52088d0835?source=api-prod","affected":[{"type":"plugin","slug":"rsfirewall","name":"RSFirewall!","from":"*","from_inclusive":true,"to":"1.1.42","to_inclusive":true,"patched_in":"1.1.43"}],"published":"2025-07-11T00:00:00Z","updated":"2025-07-12T09:24:30Z"},{"id":"wordfence:fd7da039-f6b8-46b7-a43a-145e9f8844c3","source":"wordfence","cve":"CVE-2024-6012","title":"Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7da039-f6b8-46b7-a43a-145e9f8844c3?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"3.2.12","to_inclusive":true,"patched_in":"3.2.13"}],"published":"2024-07-01T00:00:00Z","updated":"2024-07-02T09:32:10Z"},{"id":"wordfence:fd80133d-03c7-4ecb-ad2c-98950f788ca6","source":"wordfence","cve":"CVE-2026-1317","title":"WP Import \u2013 Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd80133d-03c7-4ecb-ad2c-98950f788ca6?source=api-prod","affected":[{"type":"plugin","slug":"wp-ultimate-csv-importer","name":"WP Ultimate CSV Importer \u2013 WordPress CSV, XML & Excel Import Export","from":"*","from_inclusive":true,"to":"7.37","to_inclusive":true,"patched_in":"7.38"}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-18T12:28:37Z"},{"id":"wordfence:fd817fe9-b7be-4252-877a-e9843d62a0a9","source":"wordfence","cve":"CVE-2023-0272","title":"NEX-Forms - Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd817fe9-b7be-4252-877a-e9843d62a0a9?source=api-prod","affected":[{"type":"plugin","slug":"nex-forms-express-wp-form-builder","name":"NEX-Forms \u2013 Ultimate Forms Plugin for WordPress","from":"*","from_inclusive":true,"to":"8.3.2","to_inclusive":true,"patched_in":"8.3.3"}],"published":"2023-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd839b20-69d1-4cad-80fc-3e7b9940fd30","source":"wordfence","cve":"CVE-2026-12360","title":"JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd839b20-69d1-4cad-80fc-3e7b9940fd30?source=api-prod","affected":[{"type":"plugin","slug":"jet-engine","name":"JetEngine","from":"*","from_inclusive":true,"to":"3.8.10.1","to_inclusive":true,"patched_in":"3.8.10.2"}],"published":"2026-06-16T00:00:00Z","updated":"2026-06-17T04:32:06Z"},{"id":"wordfence:fd853c75-dd36-4073-af9e-446b2506c758","source":"wordfence","cve":"CVE-2025-49317","title":"WP Page Loading <= 1.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd853c75-dd36-4073-af9e-446b2506c758?source=api-prod","affected":[{"type":"plugin","slug":"wp-page-loading","name":"WP Page Loading","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-11T18:10:48Z"},{"id":"wordfence:fd88dbfa-231e-4dce-ac99-23a6a8075102","source":"wordfence","cve":"CVE-2026-73340","title":"Featured Image from URL (FIFU) <= 5.3.3 - Authenticated (Contributor+) Stored Cross-site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd88dbfa-231e-4dce-ac99-23a6a8075102?source=api-prod","affected":[{"type":"plugin","slug":"featured-image-from-url","name":"Featured Image from URL (FIFU)","from":"*","from_inclusive":true,"to":"5.3.3","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2026-08-12T00:00:00Z","updated":"2026-08-14T12:59:42Z"},{"id":"wordfence:fd8997a0-f65d-4d84-a919-223664a88765","source":"wordfence","cve":"CVE-2026-49057","title":"JobSearch WP Job Board <= 3.2.7 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8997a0-f65d-4d84-a919-223664a88765?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2026-06-03T00:00:00Z","updated":"2026-06-08T14:47:09Z"},{"id":"wordfence:fd8a4296-8a6e-4455-8a69-87cace9199a9","source":"wordfence","cve":"CVE-2014-10012","title":"WordPress Classifieds Plugin \u2013 Ad Directory & Listings by AWP Classifieds < 3.0 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8a4296-8a6e-4455-8a69-87cace9199a9?source=api-prod","affected":[{"type":"plugin","slug":"another-wordpress-classifieds-plugin","name":"AWP Classifieds","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":false,"patched_in":"3.0"}],"published":"2014-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd8cafa4-594e-47e5-9a1b-666a5b23feea","source":"wordfence","cve":"CVE-2025-24660","title":"Simple Membership Custom Messages <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8cafa4-594e-47e5-9a1b-666a5b23feea?source=api-prod","affected":[{"type":"plugin","slug":"simple-membership-custom-messages","name":"Simple Membership Custom Messages","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2025-01-18T00:00:00Z","updated":"2025-02-25T17:10:21Z"},{"id":"wordfence:fd8e6b8a-0161-4bf7-b480-77258337e9b9","source":"wordfence","cve":"CVE-2015-9341","title":"WordPress File Upload <= 3.4.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8e6b8a-0161-4bf7-b480-77258337e9b9?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":false,"patched_in":"3.4.1"}],"published":"2015-10-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd8f3eb7-ac60-46c4-b41f-5d89e3133042","source":"wordfence","cve":"CVE-2024-7747","title":"Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types","severity":"medium","cvss":6.5,"cwe":"CWE-681","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8f3eb7-ac60-46c4-b41f-5d89e3133042?source=api-prod","affected":[{"type":"plugin","slug":"woo-wallet","name":"Wallet for WooCommerce","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.7"}],"published":"2024-11-27T00:00:00Z","updated":"2024-11-28T12:54:11Z"},{"id":"wordfence:fd8fb3e9-34eb-4b37-9a7e-00309a1ca81d","source":"wordfence","cve":"CVE-2023-32236","title":"Booking Ultra Pro <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd8fb3e9-34eb-4b37-9a7e-00309a1ca81d?source=api-prod","affected":[{"type":"plugin","slug":"booking-ultra-pro","name":"Booking Ultra Pro Appointments Booking Calendar Plugin","from":"*","from_inclusive":true,"to":"1.1.8","to_inclusive":true,"patched_in":"1.1.9"}],"published":"2023-05-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd903ec3-893e-4dd8-ad90-2e25a926ac4f","source":"wordfence","cve":"CVE-2007-4104","title":"FeedStats < 2.4 - Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd903ec3-893e-4dd8-ad90-2e25a926ac4f?source=api-prod","affected":[{"type":"plugin","slug":"feedstats-de","name":"FeedStats","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":false,"patched_in":"2.4"}],"published":"2007-07-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd929710-bdb4-42e1-b409-df41adc22392","source":"wordfence","cve":"CVE-2025-6228","title":"Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd929710-bdb4-42e1-b409-df41adc22392?source=api-prod","affected":[{"type":"plugin","slug":"sina-extension-for-elementor","name":"Sina Extension for Elementor","from":"*","from_inclusive":true,"to":"3.7.0","to_inclusive":true,"patched_in":"3.7.1"}],"published":"2025-07-31T21:23:40Z","updated":"2025-08-01T11:18:55Z"},{"id":"wordfence:fd978ac0-42f2-4746-9430-37458375b588","source":"wordfence","cve":"CVE-2023-7165","title":"JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing","severity":"critical","cvss":9.8,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd978ac0-42f2-4746-9430-37458375b588?source=api-prod","affected":[{"type":"plugin","slug":"backup","name":"JetBackup \u2013 Backup, Restore & Migrate","from":"*","from_inclusive":true,"to":"2.0.9.7","to_inclusive":true,"patched_in":"2.0.9.9"}],"published":"2024-02-02T00:00:00Z","updated":"2024-02-07T18:58:47Z"},{"id":"wordfence:fd97ef7d-80c7-4987-be79-23eb380fa460","source":"wordfence","cve":"CVE-2022-2184","title":"CAPTCHA 4WP <= 7.0.6.1 - Cross-Site Request Forgery to Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd97ef7d-80c7-4987-be79-23eb380fa460?source=api-prod","affected":[{"type":"plugin","slug":"advanced-nocaptcha-recaptcha","name":"CAPTCHA 4WP \u2013 Antispam CAPTCHA solution for WordPress","from":"*","from_inclusive":true,"to":"7.0.6.1","to_inclusive":true,"patched_in":"7.1.0"}],"published":"2022-06-29T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd97fba9-513b-46e1-9613-2f64c4272f34","source":"wordfence","cve":"CVE-2023-32497","title":"Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"low","cvss":3.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd97fba9-513b-46e1-9613-2f64c4272f34?source=api-prod","affected":[{"type":"plugin","slug":"block-referer-spam","name":"Block Referer Spam","from":"*","from_inclusive":true,"to":"1.1.9.4","to_inclusive":true,"patched_in":"1.1.9.5"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fd98b0c1-4192-45a1-adf6-e760e616d1e2","source":"wordfence","cve":"CVE-2025-48339","title":"Profiler - What Slowing Down Your WP <= 1.0.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd98b0c1-4192-45a1-adf6-e760e616d1e2?source=api-prod","affected":[{"type":"plugin","slug":"profiler-what-slowing-down","name":"Profiler \u2013 What Slowing Down Your WP","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-07-07T00:00:00Z","updated":"2025-07-16T18:37:07Z"},{"id":"wordfence:fd9a81eb-2211-42e9-a456-fb60f3ca2c0f","source":"wordfence","cve":"CVE-2026-18325","title":"Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9a81eb-2211-42e9-a456-fb60f3ca2c0f?source=api-prod","affected":[{"type":"plugin","slug":"forminator","name":"Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"1.56.1","to_inclusive":true,"patched_in":"1.56.2"}],"published":"2026-08-05T15:00:13Z","updated":"2026-08-06T03:26:11Z"},{"id":"wordfence:fd9d36c2-41c8-430f-b1ff-1e654e45eec6","source":"wordfence","cve":"CVE-2026-123481","title":"WP Extended \u2013 Modular WordPress Toolkit <= 3.4.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9d36c2-41c8-430f-b1ff-1e654e45eec6?source=api-prod","affected":[{"type":"plugin","slug":"wpextended","name":"WP Extended \u2013 Modular WordPress Toolkit","from":"*","from_inclusive":true,"to":"3.4.2","to_inclusive":true,"patched_in":"3.4.3"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T15:57:29Z"},{"id":"wordfence:fd9ef610-a845-4fdf-a4ad-db073b1cc8bb","source":"wordfence","cve":"CVE-2025-58669","title":"Magento 2 WordPress Integration <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9ef610-a845-4fdf-a4ad-db073b1cc8bb?source=api-prod","affected":[{"type":"plugin","slug":"m2wp","name":"Magento 2 WP Integration","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-09-22T00:00:00Z","updated":"2025-09-26T17:49:34Z"},{"id":"wordfence:fd9f1385-6457-4bc9-9c75-0fcd399a5956","source":"wordfence","cve":"CVE-2023-49757","title":"Awesome Support <= 6.1.10 - Missing Authorization","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9f1385-6457-4bc9-9c75-0fcd399a5956?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.10","to_inclusive":true,"patched_in":"6.1.11"}],"published":"2023-12-04T00:00:00Z","updated":"2024-03-22T15:48:01Z"},{"id":"wordfence:fda10117-b562-496e-8a17-88ee350ce8f2","source":"wordfence","cve":"CVE-2022-29495","title":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fda10117-b562-496e-8a17-88ee350ce8f2?source=api-prod","affected":[{"type":"plugin","slug":"popup-builder","name":"Popup Builder \u2013 Create highly converting, mobile friendly marketing popups.","from":"*","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"4.1.12"}],"published":"2022-06-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fda1be79-ba45-4e8f-bfc3-355f9cdbad82","source":"wordfence","cve":"CVE-2023-48746","title":"Community by PeepSo <= 6.2.6.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fda1be79-ba45-4e8f-bfc3-355f9cdbad82?source=api-prod","affected":[{"type":"plugin","slug":"peepso-core","name":"Community by PeepSo \u2013 Download from PeepSo.com","from":"*","from_inclusive":true,"to":"6.2.6.0","to_inclusive":true,"patched_in":"6.2.7.0"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fda268ac-0501-4d86-af90-6c82d4b3c50f","source":"wordfence","cve":"CVE-2025-39524","title":"Html5 Audio Player <= 2.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fda268ac-0501-4d86-af90-6c82d4b3c50f?source=api-prod","affected":[{"type":"plugin","slug":"html5-audio-player","name":"HTML5 Audio Player \u2013 The Ultimate No-Code Podcast, MP3 & Audio Player","from":"*","from_inclusive":true,"to":"2.2.28","to_inclusive":true,"patched_in":"2.3.0"}],"published":"2025-04-16T00:00:00Z","updated":"2025-04-21T20:27:35Z"},{"id":"wordfence:fda7ad16-d66b-47fc-bbd6-18fd0b1c1e03","source":"wordfence","cve":"CVE-2025-23438","title":"WP PT-Viewer <= 2.0.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fda7ad16-d66b-47fc-bbd6-18fd0b1c1e03?source=api-prod","affected":[{"type":"plugin","slug":"wp-ptviewer","name":"WP PT-Viewer","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-01-22T20:45:20Z"},{"id":"wordfence:fdacd8b2-ef34-424d-bc05-bc059f6ab3b0","source":"wordfence","cve":"CVE-2023-0263","title":"WP Yelp Review Slider <= 7.0 - Authenticated (Subscriber+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdacd8b2-ef34-424d-bc05-bc059f6ab3b0?source=api-prod","affected":[{"type":"plugin","slug":"wp-yelp-review-slider","name":"WP Yelp Review Slider","from":"*","from_inclusive":true,"to":"7.0","to_inclusive":true,"patched_in":"7.1"}],"published":"2023-01-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdaf3f4e-18fd-41d5-ad9c-7e6141f90c52","source":"wordfence","cve":"CVE-2025-49977","title":"WP Inventory Manager <= 2.3.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdaf3f4e-18fd-41d5-ad9c-7e6141f90c52?source=api-prod","affected":[{"type":"plugin","slug":"wp-inventory-manager","name":"WP Inventory Manager","from":"*","from_inclusive":true,"to":"2.3.4","to_inclusive":true,"patched_in":"2.3.5"}],"published":"2025-06-19T00:00:00Z","updated":"2026-02-25T14:30:00Z"},{"id":"wordfence:fdb15198-68dc-4612-abcc-6b02843f1629","source":"wordfence","cve":"CVE-2025-1328","title":"Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb15198-68dc-4612-abcc-6b02843f1629?source=api-prod","affected":[{"type":"plugin","slug":"mrlegend-typedjs","name":"Typed JS: A typewriter style animation","from":"*","from_inclusive":true,"to":"1.2.0","to_inclusive":true,"patched_in":""}],"published":"2025-02-19T21:07:50Z","updated":"2025-02-20T09:21:41Z"},{"id":"wordfence:fdb184c7-c322-4e05-86db-b398cec1e1b0","source":"wordfence","cve":"CVE-2024-34567","title":"Popup Builder <= 1.1.29 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb184c7-c322-4e05-86db-b398cec1e1b0?source=api-prod","affected":[{"type":"plugin","slug":"easy-notify-lite","name":"Easy Notify Lite","from":"*","from_inclusive":true,"to":"1.1.29","to_inclusive":true,"patched_in":"1.1.30"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T17:17:48Z"},{"id":"wordfence:fdb276aa-785f-4655-8843-29e82b0ad92c","source":"wordfence","cve":"CVE-2026-79996","title":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.6 - Authenticated (Custom Role+) Privilege Escalation","severity":"medium","cvss":6.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb276aa-785f-4655-8843-29e82b0ad92c?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.6","to_inclusive":false,"patched_in":"5.2.6"}],"published":"2026-08-28T00:00:00Z","updated":"2026-09-01T20:55:48Z"},{"id":"wordfence:fdb3c672-0ac4-42e8-951b-e41dc8bd6231","source":"wordfence","cve":"CVE-2024-43965","title":"SendGrid for WordPress <= 1.4 - Unauthenticated SQL Injection","severity":"critical","cvss":10.0,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb3c672-0ac4-42e8-951b-e41dc8bd6231?source=api-prod","affected":[{"type":"plugin","slug":"wp-sendgrid-mailer","name":"SendGrid for WordPress","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2024-08-26T00:00:00Z","updated":"2024-09-04T20:35:11Z"},{"id":"wordfence:fdb6c326-bd48-440a-9eba-7073b6a68844","source":"wordfence","cve":"CVE-2025-31383","title":"FrescoChat Live Chat <= 3.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb6c326-bd48-440a-9eba-7073b6a68844?source=api-prod","affected":[{"type":"plugin","slug":"flexytalk-widget","name":"FrescoChat Live Chat","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T13:36:19Z"},{"id":"wordfence:fdb822e8-583e-4437-a735-b116aa8886e2","source":"wordfence","cve":"CVE-2023-1119","title":"WP-Optimize <= 3.2.12 & SrbTransLatin <= 2.4 - Stored/Reflected Cross-Site Scripting via Third Party Library","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdb822e8-583e-4437-a735-b116aa8886e2?source=api-prod","affected":[{"type":"plugin","slug":"srbtranslatin","name":"SrbTransLatin \u2013 Serbian Latinisation","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.4.1"},{"type":"plugin","slug":"wp-optimize","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance","from":"*","from_inclusive":true,"to":"3.2.13","to_inclusive":false,"patched_in":"3.2.13"}],"published":"2023-07-04T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdba439d-90ee-413c-842d-19704b08c33e","source":"wordfence","cve":"CVE-2020-36174","title":"Ninja Forms Contact Form \u2013 The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdba439d-90ee-413c-842d-19704b08c33e?source=api-prod","affected":[{"type":"plugin","slug":"ninja-forms","name":"Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder","from":"*","from_inclusive":true,"to":"3.4.27","to_inclusive":true,"patched_in":"3.4.27.1"}],"published":"2020-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdba935b-4c78-48e2-ae32-f68748f6df97","source":"wordfence","cve":"CVE-2021-47932","title":"TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdba935b-4c78-48e2-ae32-f68748f6df97?source=api-prod","affected":[{"type":"plugin","slug":"thecartpress","name":"TheCartPress eCommerce Shopping Cart","from":"*","from_inclusive":true,"to":"1.5.3.6","to_inclusive":true,"patched_in":""}],"published":"2026-05-10T00:00:00Z","updated":"2026-07-29T20:53:36Z"},{"id":"wordfence:fdbb60e5-4d67-4deb-94e0-788c1fb0e42f","source":"wordfence","cve":"","title":"WP Photo Album Plus <= 5.4.7 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdbb60e5-4d67-4deb-94e0-788c1fb0e42f?source=api-prod","affected":[{"type":"plugin","slug":"wp-photo-album-plus","name":"WP Photo Album Plus","from":"*","from_inclusive":true,"to":"5.4.7","to_inclusive":true,"patched_in":"5.4.8"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdbd089d-1b7d-42e9-8f47-fec19a4dd7c4","source":"wordfence","cve":"CVE-2024-33943","title":"Ultimate Under Construction <= 1.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdbd089d-1b7d-42e9-8f47-fec19a4dd7c4?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-under-construction","name":"Ultimate Under Construction","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2024-04-30T00:00:00Z","updated":"2024-05-07T13:41:14Z"},{"id":"wordfence:fdc1289a-abd1-43db-89b7-3e81878a0f9a","source":"wordfence","cve":"CVE-2024-13413","title":"ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc1289a-abd1-43db-89b7-3e81878a0f9a?source=api-prod","affected":[{"type":"plugin","slug":"productdyno","name":"ProductDyno","from":"*","from_inclusive":true,"to":"1.0.24","to_inclusive":true,"patched_in":"1.0.25"}],"published":"2025-03-10T16:21:40Z","updated":"2025-03-11T04:21:46Z"},{"id":"wordfence:fdc18341-135b-4522-a9db-510e4c4d9704","source":"wordfence","cve":"CVE-2023-5886","title":"Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc18341-135b-4522-a9db-510e4c4d9704?source=api-prod","affected":[{"type":"plugin","slug":"wp-all-export-pro","name":"WP All Export Pro","from":"*","from_inclusive":true,"to":"1.8.6","to_inclusive":false,"patched_in":"1.8.6"},{"type":"plugin","slug":"wp-all-export","name":"WP All Export \u2013 Drag & Drop Export to Any Custom CSV, XML & Excel","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":false,"patched_in":"1.4.1"}],"published":"2023-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdc2a31f-19c2-4474-a3b0-16ded1912ddd","source":"wordfence","cve":"CVE-2018-21004","title":"RSVPMaker < 5.6.4 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2a31f-19c2-4474-a3b0-16ded1912ddd?source=api-prod","affected":[{"type":"plugin","slug":"rsvpmaker","name":"RSVPMaker","from":"*","from_inclusive":true,"to":"5.6.4","to_inclusive":false,"patched_in":"5.6.4"}],"published":"2018-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdc2de78-5601-461f-b2f0-c80b592ccb1b","source":"wordfence","cve":"CVE-2024-8856","title":"Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=api-prod","affected":[{"type":"plugin","slug":"wp-time-capsule","name":"Backup and Staging by WP Time Capsule","from":"*","from_inclusive":true,"to":"1.22.21","to_inclusive":true,"patched_in":"1.22.22"}],"published":"2024-11-15T00:00:00Z","updated":"2024-11-21T15:25:13Z"},{"id":"wordfence:fdc39d59-7c9d-4d5d-9fb5-b67d2324adaa","source":"wordfence","cve":"CVE-2024-11930","title":"Taskbuilder \u2013 WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc39d59-7c9d-4d5d-9fb5-b67d2324adaa?source=api-prod","affected":[{"type":"plugin","slug":"taskbuilder","name":"Taskbuilder \u2013 Project Management & Task Management Tool With Kanban Board","from":"*","from_inclusive":true,"to":"3.0.6","to_inclusive":true,"patched_in":"3.0.7"}],"published":"2025-01-03T20:06:26Z","updated":"2025-01-04T08:22:52Z"},{"id":"wordfence:fdc57b06-bae9-49a3-84dd-f593705330e9","source":"wordfence","cve":"CVE-2026-1509","title":"Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution","severity":"medium","cvss":5.4,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc57b06-bae9-49a3-84dd-f593705330e9?source=api-prod","affected":[{"type":"plugin","slug":"fusion-builder","name":"Avada (Fusion) Builder","from":"*","from_inclusive":true,"to":"3.15.1","to_inclusive":true,"patched_in":"3.15.2"}],"published":"2026-04-14T12:25:28Z","updated":"2026-04-15T01:25:18Z"},{"id":"wordfence:fdc614f2-37a6-474a-828a-1f34f98715c5","source":"wordfence","cve":"CVE-2024-13575","title":"Web Stories Enhancer \u2013 Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc614f2-37a6-474a-828a-1f34f98715c5?source=api-prod","affected":[{"type":"plugin","slug":"web-stories-enhancer","name":"Web Stories Enhancer \u2013 Level Up Your Web Stories","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":"1.4"}],"published":"2025-02-17T00:00:00Z","updated":"2025-02-18T07:28:15Z"},{"id":"wordfence:fdc7e8e2-46d8-4e8f-8277-c704d3c84f36","source":"wordfence","cve":"CVE-2025-54680","title":"Blogger Buzz <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc7e8e2-46d8-4e8f-8277-c704d3c84f36?source=api-prod","affected":[{"type":"theme","slug":"blogger-buzz","name":"Blogger Buzz","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":true,"patched_in":"1.2.7"}],"published":"2025-07-30T00:00:00Z","updated":"2025-08-04T20:55:17Z"},{"id":"wordfence:fdc806de-9d93-4e89-a708-d4c142dd14af","source":"wordfence","cve":"CVE-2025-32567","title":"Easy Post Duplicator <= 1.0.1 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc806de-9d93-4e89-a708-d4c142dd14af?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-duplicator","name":"Easy Post Duplicator","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-15T14:25:56Z"},{"id":"wordfence:fdc87b9f-8d58-4ffd-9b91-457ea3fb9f02","source":"wordfence","cve":"CVE-2026-81429","title":"Export & Import WPBakery Page Builder <= 1.0.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc87b9f-8d58-4ffd-9b91-457ea3fb9f02?source=api-prod","affected":[{"type":"plugin","slug":"vc-templates-import-export","name":"Export & Import WPBakery Page Builder","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":""}],"published":"2026-09-14T00:00:00Z","updated":"2026-09-15T19:51:53Z"},{"id":"wordfence:fdc8bee7-3edc-4f27-ad84-06a4a80f66a2","source":"wordfence","cve":"CVE-2026-14322","title":"Timetics <= 1.0.56 - Missing Authorization to Unauthenticated Booking Approval","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc8bee7-3edc-4f27-ad84-06a4a80f66a2?source=api-prod","affected":[{"type":"plugin","slug":"timetics","name":"Timetics \u2013 Appointment Booking Calendar & Scheduling","from":"*","from_inclusive":true,"to":"1.0.56","to_inclusive":true,"patched_in":"1.0.57"}],"published":"2026-07-01T00:00:00Z","updated":"2026-07-30T17:19:14Z"},{"id":"wordfence:fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf","source":"wordfence","cve":"CVE-2024-6499","title":"WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=api-prod","affected":[{"type":"plugin","slug":"maxbuttons","name":"MaxButtons \u2013 Create buttons","from":"*","from_inclusive":true,"to":"9.7.8","to_inclusive":true,"patched_in":"9.8.0"}],"published":"2024-08-23T00:00:00Z","updated":"2024-08-24T03:29:23Z"},{"id":"wordfence:fdd1359f-ce16-4cfe-a6a8-245a21ad16c9","source":"wordfence","cve":"CVE-2026-32522","title":"WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion","severity":"critical","cvss":9.1,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd1359f-ce16-4cfe-a6a8-245a21ad16c9?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-support-ticket-system","name":"WooCommerce Support Ticket System","from":"*","from_inclusive":true,"to":"18.5","to_inclusive":false,"patched_in":"18.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T19:01:07Z"},{"id":"wordfence:fdd14863-5498-4598-8b22-8e5a607869e4","source":"wordfence","cve":"","title":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP <= 1.3.10 - Authenticated (Admin+) Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd14863-5498-4598-8b22-8e5a607869e4?source=api-prod","affected":[{"type":"plugin","slug":"yotuwp-easy-youtube-embed","name":"Video Gallery \u2013 YouTube Playlist, Channel Gallery by YotuWP","from":"*","from_inclusive":true,"to":"1.3.10","to_inclusive":true,"patched_in":"1.3.11"}],"published":"2022-12-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdd20b94-3677-4eca-9c59-4a3c61d493da","source":"wordfence","cve":"CVE-2025-62866","title":"Auto Alt Text <= 2.5.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd20b94-3677-4eca-9c59-4a3c61d493da?source=api-prod","affected":[{"type":"plugin","slug":"auto-alt-text","name":"Auto Alt Text","from":"*","from_inclusive":true,"to":"2.5.2","to_inclusive":true,"patched_in":"2.5.3"}],"published":"2025-12-06T00:00:00Z","updated":"2025-12-11T15:40:59Z"},{"id":"wordfence:fdd3b32f-2a77-4a08-8ab9-edfa184731ab","source":"wordfence","cve":"CVE-2026-74006","title":"WP Table Builder \u2013 Drag & Drop Table Builder <= 2.2.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd3b32f-2a77-4a08-8ab9-edfa184731ab?source=api-prod","affected":[{"type":"plugin","slug":"wp-table-builder","name":"WP Table Builder \u2013 Drag & Drop Table Builder","from":"*","from_inclusive":true,"to":"2.2.0","to_inclusive":true,"patched_in":"2.2.1"}],"published":"2026-08-17T17:12:00Z","updated":"2026-09-10T19:28:26Z"},{"id":"wordfence:fdd48c77-c509-4e87-bfc3-0aa422f85ae1","source":"wordfence","cve":"CVE-2025-58652","title":"Carousel Ultimate <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd48c77-c509-4e87-bfc3-0aa422f85ae1?source=api-prod","affected":[{"type":"plugin","slug":"carousel","name":"Carousel \u2013 Image Carousel, Post Slider, Product & Video Gallery","from":"*","from_inclusive":true,"to":"1.8","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-09-22T00:00:00Z","updated":"2026-10-13T16:56:28Z"},{"id":"wordfence:fdd57b3b-bd0a-4b07-831e-72f2329b2577","source":"wordfence","cve":"","title":"Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'instantEditRedirect' function","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd57b3b-bd0a-4b07-831e-72f2329b2577?source=api-prod","affected":[{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2023-02-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdd73289-f292-4903-951e-6a89049d39a7","source":"wordfence","cve":"CVE-2023-5125","title":"Contact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd73289-f292-4903-951e-6a89049d39a7?source=api-prod","affected":[{"type":"plugin","slug":"formget-contact-form","name":"Contact Form by FormGet \u2013 Best Form Builder Plugin for WordPress","from":"*","from_inclusive":true,"to":"5.5.5","to_inclusive":true,"patched_in":""}],"published":"2023-09-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdd7eef1-6253-4bcf-9249-39078d793aad","source":"wordfence","cve":"CVE-2025-58197","title":"Simple Download Monitor <= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd7eef1-6253-4bcf-9249-39078d793aad?source=api-prod","affected":[{"type":"plugin","slug":"simple-download-monitor","name":"Simple Download Monitor","from":"*","from_inclusive":true,"to":"3.9.34","to_inclusive":true,"patched_in":"3.9.35"}],"published":"2025-08-27T00:00:00Z","updated":"2025-09-03T20:14:07Z"},{"id":"wordfence:fdd908d0-fbb3-4a01-a047-158ec894b6c8","source":"wordfence","cve":"CVE-2026-3430","title":"Creative Mail <= 1.6.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd908d0-fbb3-4a01-a047-158ec894b6c8?source=api-prod","affected":[{"type":"plugin","slug":"creative-mail-by-constant-contact","name":"Creative Mail \u2013 Easier WordPress & WooCommerce Email Marketing","from":"*","from_inclusive":true,"to":"1.6.9","to_inclusive":true,"patched_in":""}],"published":"2026-05-19T00:00:00Z","updated":"2026-08-15T21:55:00Z"},{"id":"wordfence:fdde4f0d-a4d7-421c-8579-a93941eea712","source":"wordfence","cve":"CVE-2022-4650","title":"HashBar \u2013 WordPress Notification Bar <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdde4f0d-a4d7-421c-8579-a93941eea712?source=api-prod","affected":[{"type":"plugin","slug":"hashbar-wp-notification-bar","name":"HashBar \u2013 Announcement, Notification Bar & Popup Campaign","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.3.6"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fde0ab44-a354-4cbe-8548-0e5c08529082","source":"wordfence","cve":"CVE-2023-23989","title":"RegistrationMagic <= 5.1.9.2 - Missing Authorization to Unauthenticated Content Injection","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fde0ab44-a354-4cbe-8548-0e5c08529082?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.1.9.2","to_inclusive":true,"patched_in":"5.1.9.3"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fde110ae-c559-4d45-91c0-a3dd5ff05c4d","source":"wordfence","cve":"CVE-2025-11922","title":"Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fde110ae-c559-4d45-91c0-a3dd5ff05c4d?source=api-prod","affected":[{"type":"plugin","slug":"inactive-logout","name":"Inactive Logout","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":true,"patched_in":"3.6.0"}],"published":"2025-10-31T13:27:51Z","updated":"2025-11-01T01:47:43Z"},{"id":"wordfence:fde1157b-5b99-4e9c-9c51-ebaa0eddfd73","source":"wordfence","cve":"CVE-2023-28749","title":"CM On Demand Search And Replace <= 1.3.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fde1157b-5b99-4e9c-9c51-ebaa0eddfd73?source=api-prod","affected":[{"type":"plugin","slug":"cm-on-demand-search-and-replace","name":"CM Search And Replace \u2013 Optimize content edits with a powerful search and replace tool","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2023-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fde163fa-2dbf-43bc-8edc-cbbab2a35bd0","source":"wordfence","cve":"CVE-2021-24479","title":"DrawBlog <= 0.90 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fde163fa-2dbf-43bc-8edc-cbbab2a35bd0?source=api-prod","affected":[{"type":"plugin","slug":"drawblog","name":"DrawBlog","from":"*","from_inclusive":true,"to":"0.90","to_inclusive":true,"patched_in":""}],"published":"2021-06-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdea1999-a282-4374-a093-5cbd5b05497a","source":"wordfence","cve":"CVE-2024-32089","title":"Digital Publications by Supsystic <= 1.7.7 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdea1999-a282-4374-a093-5cbd5b05497a?source=api-prod","affected":[{"type":"plugin","slug":"digital-publications-by-supsystic","name":"WordPress Flipbook by Supsystic","from":"*","from_inclusive":true,"to":"1.7.7","to_inclusive":true,"patched_in":"1.7.8"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T18:24:57Z"},{"id":"wordfence:fdeab668-9094-485f-aa01-13ba5c10ea89","source":"wordfence","cve":"CVE-2024-1767","title":"Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdeab668-9094-485f-aa01-13ba5c10ea89?source=api-prod","affected":[{"type":"theme","slug":"blocksy","name":"Blocksy","from":"*","from_inclusive":true,"to":"2.0.26","to_inclusive":true,"patched_in":"2.0.27"}],"published":"2024-03-08T00:00:00Z","updated":"2024-03-09T07:01:11Z"},{"id":"wordfence:fdeaf745-9a1b-4377-b9de-0d03e709a21b","source":"wordfence","cve":"CVE-2024-56282","title":"WPMozo Addons Lite for Elementor <= 1.1.0 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdeaf745-9a1b-4377-b9de-0d03e709a21b?source=api-prod","affected":[{"type":"plugin","slug":"wpmozo-addons-lite-for-elementor","name":"WPMozo Addons Lite for Elementor","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"1.1.1"}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T20:30:11Z"},{"id":"wordfence:fdf0b13e-154c-4007-bfc2-5346d906f7ca","source":"wordfence","cve":"CVE-2026-4059","title":"ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf0b13e-154c-4007-bfc2-5346d906f7ca?source=api-prod","affected":[{"type":"plugin","slug":"woolentor-addons","name":"ShopLentor \u2013 All-in-One WooCommerce Growth & Store Enhancement Plugin","from":"*","from_inclusive":true,"to":"3.3.5","to_inclusive":true,"patched_in":"3.3.6"}],"published":"2026-04-13T14:48:10Z","updated":"2026-04-14T03:37:33Z"},{"id":"wordfence:fdf102bb-66ed-4c4d-b9b0-906f58ec9253","source":"wordfence","cve":"CVE-2025-60177","title":"Recaptcha \u2013 wp <= 0.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf102bb-66ed-4c4d-b9b0-906f58ec9253?source=api-prod","affected":[{"type":"plugin","slug":"recaptcha-wp","name":"Recaptcha \u2013 wp","from":"*","from_inclusive":true,"to":"0.2.6","to_inclusive":true,"patched_in":""}],"published":"2025-09-26T00:00:00Z","updated":"2025-09-30T13:15:29Z"},{"id":"wordfence:fdf18ae2-f0d4-44d4-9dd1-6ac36d859d68","source":"wordfence","cve":"CVE-2024-2954","title":"WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf18ae2-f0d4-44d4-9dd1-6ac36d859d68?source=api-prod","affected":[{"type":"plugin","slug":"wp-action-network","name":"Organizers Embed \u2013 Action Network for WordPress","from":"1.4.3","from_inclusive":true,"to":"1.4.3","to_inclusive":true,"patched_in":"1.4.4"}],"published":"2024-03-26T00:00:00Z","updated":"2024-05-06T14:35:10Z"},{"id":"wordfence:fdf33f1c-7e07-425a-aed7-43511f358362","source":"wordfence","cve":"CVE-2025-47573","title":"School Management <= 92.0.0 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf33f1c-7e07-425a-aed7-43511f358362?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"92.0.0","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-18T14:36:22Z"},{"id":"wordfence:fdf68c19-ee1b-4d0a-876b-c061763b39c3","source":"wordfence","cve":"CVE-2025-10490","title":"Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf68c19-ee1b-4d0a-876b-c061763b39c3?source=api-prod","affected":[{"type":"plugin","slug":"zephyr-project-manager","name":"Zephyr Project Manager","from":"*","from_inclusive":true,"to":"3.3.202","to_inclusive":true,"patched_in":"3.3.203"}],"published":"2025-09-25T17:41:11Z","updated":"2025-09-26T06:43:31Z"},{"id":"wordfence:fdf6b2ea-5a6a-481b-9431-650c895f54ef","source":"wordfence","cve":"CVE-2024-12384","title":"Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf6b2ea-5a6a-481b-9431-650c895f54ef?source=api-prod","affected":[{"type":"plugin","slug":"woo-binary-mlm","name":"Binary MLM For WooCommerce","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":"2.1"}],"published":"2025-01-06T16:22:39Z","updated":"2025-12-19T14:29:56Z"},{"id":"wordfence:fdf6d876-631f-493d-a324-3bb8efedd84a","source":"wordfence","cve":"CVE-2021-24373","title":"WP Hardening \u2013 Fix Your WordPress Security <= 1.2.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf6d876-631f-493d-a324-3bb8efedd84a?source=api-prod","affected":[{"type":"plugin","slug":"wp-security-hardening","name":"WP Hardening (discontinued)","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":false,"patched_in":"1.2.2"}],"published":"2021-06-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdfa2336-dda2-4945-9278-1a85f8b5f88b","source":"wordfence","cve":"","title":"Wordfence <= 5.2.3 - Stored Cross-Site Scripting via REQUEST_URI","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdfa2336-dda2-4945-9278-1a85f8b5f88b?source=api-prod","affected":[{"type":"plugin","slug":"wordfence","name":"Wordfence Security \u2013 Firewall, Malware Scan, and Login Security","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2014-09-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdfac5bc-89ac-4ed7-85e9-a4a1ff0bfbff","source":"wordfence","cve":"CVE-2026-66699","title":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdfac5bc-89ac-4ed7-85e9-a4a1ff0bfbff?source=api-prod","affected":[{"type":"plugin","slug":"dokan-lite","name":"Dokan: AI Powered WooCommerce Multivendor Marketplace Solution \u2013 Build Your Own Amazon, eBay, Etsy","from":"*","from_inclusive":true,"to":"5.0.10","to_inclusive":true,"patched_in":"5.0.11"}],"published":"2026-07-29T00:00:00Z","updated":"2026-08-04T19:43:37Z"},{"id":"wordfence:fdfb5e74-e52c-4f44-acdc-9740624af9e7","source":"wordfence","cve":"","title":"Simple File List <= 3.2.4 - Arbitrary File Deletion","severity":"high","cvss":8.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdfb5e74-e52c-4f44-acdc-9740624af9e7?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"3.2.4","to_inclusive":true,"patched_in":"3.2.5"}],"published":"2019-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fdfdaef2-c02a-4dc6-9ebd-2f35a11b9f97","source":"wordfence","cve":"CVE-2025-54028","title":"CF7 WOW Styler <= 1.7.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fdfdaef2-c02a-4dc6-9ebd-2f35a11b9f97?source=api-prod","affected":[{"type":"plugin","slug":"cf7-styler","name":"WOW Styler for CF7 \u2013 Visual Styler for Contact Form 7 Forms","from":"*","from_inclusive":true,"to":"1.7.2","to_inclusive":true,"patched_in":"1.7.3"}],"published":"2025-08-07T00:00:00Z","updated":"2025-08-11T14:41:08Z"},{"id":"wordfence:fe00b89f-b475-4aec-8df8-89d842d92e4f","source":"wordfence","cve":"CVE-2022-45077","title":"Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe00b89f-b475-4aec-8df8-89d842d92e4f?source=api-prod","affected":[{"type":"theme","slug":"betheme","name":"Betheme","from":"*","from_inclusive":true,"to":"26.5.1.4","to_inclusive":true,"patched_in":"26.6"}],"published":"2022-11-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe02377a-8d09-4d86-a049-3002516cf933","source":"wordfence","cve":"","title":"YITH WooCommerce Compare <= 2.0.9 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe02377a-8d09-4d86-a049-3002516cf933?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-compare","name":"YITH WooCommerce Compare","from":"*","from_inclusive":true,"to":"2.0.9","to_inclusive":true,"patched_in":"2.1.0"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe023bc0-11b9-4520-874a-4656f633d4ac","source":"wordfence","cve":"CVE-2021-24814","title":"WordPress GDPR & CCPA < 1.9.26 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe023bc0-11b9-4520-874a-4656f633d4ac?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-gdpr","name":"WordPress GDPR","from":"*","from_inclusive":true,"to":"1.9.26","to_inclusive":true,"patched_in":"1.9.27"}],"published":"2022-01-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe025d8f-3a68-4d69-89ea-62b3113c267e","source":"wordfence","cve":"CVE-2024-51783","title":"Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe025d8f-3a68-4d69-89ea-62b3113c267e?source=api-prod","affected":[{"type":"plugin","slug":"forms-3rdparty-post-again","name":"Forms: 3rd-Party Post Again","from":"*","from_inclusive":true,"to":"0.3","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-12T20:00:34Z"},{"id":"wordfence:fe071a71-5c58-471c-878d-97b6613ec741","source":"wordfence","cve":"CVE-2026-117525","title":"FV Player <= 7.5.57.7211 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe071a71-5c58-471c-878d-97b6613ec741?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.57.7211","to_inclusive":true,"patched_in":"7.5.57.7212"}],"published":"2026-11-05T00:00:00Z","updated":"2026-11-10T19:20:03Z"},{"id":"wordfence:fe086290-f3d3-4d28-bb5c-11fbbb1364b4","source":"wordfence","cve":"CVE-2020-11930","title":"GTranslate <= 2.8.51 - Reflected Cross Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe086290-f3d3-4d28-bb5c-11fbbb1364b4?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"2.8.51","to_inclusive":true,"patched_in":"2.8.52"}],"published":"2020-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe09ddfd-a007-47f4-ae2e-a23be4bf7c13","source":"wordfence","cve":"CVE-2026-81790","title":"Csomagpontok \u00e9s C\u00edmk\u00e9k WooCommerce-hez < 4.2.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe09ddfd-a007-47f4-ae2e-a23be4bf7c13?source=api-prod","affected":[{"type":"plugin","slug":"hungarian-pickup-points-for-woocommerce","name":"Hungarian Pickup Points & Shipping Labels for WooCommerce","from":"*","from_inclusive":true,"to":"4.2.8","to_inclusive":false,"patched_in":"4.2.8"}],"published":"2026-09-07T13:35:35Z","updated":"2026-09-10T19:18:13Z"},{"id":"wordfence:fe0def72-affb-4f42-8857-0e2b8b602c7f","source":"wordfence","cve":"CVE-2020-24144","title":"Media File Organizer <= 1.0.1 - Directory Traversal","severity":"high","cvss":8.6,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe0def72-affb-4f42-8857-0e2b8b602c7f?source=api-prod","affected":[{"type":"plugin","slug":"media-file-organizer","name":"Media File Organizer","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-04-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe0e4729-bf06-481c-8ea2-5fab8e8a417f","source":"wordfence","cve":"CVE-2025-31389","title":"Sequel <= 1.0.11 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe0e4729-bf06-481c-8ea2-5fab8e8a417f?source=api-prod","affected":[{"type":"plugin","slug":"sequel","name":"sequel","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.0.13"}],"published":"2025-04-02T00:00:00Z","updated":"2026-02-26T15:05:35Z"},{"id":"wordfence:fe0fedc1-d4bd-40bf-8d8f-953db4bf2120","source":"wordfence","cve":"","title":"WP RSS Multi Importer < 3.14 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe0fedc1-d4bd-40bf-8d8f-953db4bf2120?source=api-prod","affected":[{"type":"plugin","slug":"wp-rss-multi-importer","name":"WP RSS Multi Importer","from":"*","from_inclusive":true,"to":"3.14","to_inclusive":false,"patched_in":"3.14"}],"published":"2014-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe10acf6-2649-4e85-abd1-b6840169eb41","source":"wordfence","cve":"CVE-2023-41797","title":"Locations <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe10acf6-2649-4e85-abd1-b6840169eb41?source=api-prod","affected":[{"type":"plugin","slug":"locations","name":"Locations","from":"*","from_inclusive":true,"to":"4.0","to_inclusive":true,"patched_in":""}],"published":"2023-09-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe10f68d-cab7-447a-ad91-005ca2230250","source":"wordfence","cve":"CVE-2026-25009","title":"Education Zone <= 1.3.8 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe10f68d-cab7-447a-ad91-005ca2230250?source=api-prod","affected":[{"type":"theme","slug":"education-zone","name":"Education Zone","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":true,"patched_in":"1.3.9"}],"published":"2026-03-17T00:00:00Z","updated":"2026-03-27T20:34:29Z"},{"id":"wordfence:fe1301d9-738b-485f-b8db-c23c16e4f99d","source":"wordfence","cve":"CVE-2017-14718","title":"WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe1301d9-738b-485f-b8db-c23c16e4f99d?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.21","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.19","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.18","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.15","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.11","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.10","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.9","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.6","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.5","to_inclusive":true,"patched_in":"3.7.22"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.1","to_inclusive":true,"patched_in":"3.7.22"}],"published":"2017-09-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe14b92b-1784-4083-9b9f-23d7f69a3215","source":"wordfence","cve":"CVE-2026-3191","title":"Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe14b92b-1784-4083-9b9f-23d7f69a3215?source=api-prod","affected":[{"type":"plugin","slug":"minify-html-markup","name":"Minify HTML","from":"*","from_inclusive":true,"to":"2.1.12","to_inclusive":true,"patched_in":"2.1.13"}],"published":"2026-03-30T23:01:56Z","updated":"2026-03-31T11:18:59Z"},{"id":"wordfence:fe175315-99ef-438a-b5b0-a5f190403116","source":"wordfence","cve":"CVE-2024-1357","title":"Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe175315-99ef-438a-b5b0-a5f190403116?source=api-prod","affected":[{"type":"plugin","slug":"auxin-elements","name":"Shortcodes and extra features for Phlox theme","from":"*","from_inclusive":true,"to":"2.15.7","to_inclusive":true,"patched_in":"2.15.8"}],"published":"2024-04-15T00:00:00Z","updated":"2024-08-01T21:09:41Z"},{"id":"wordfence:fe17abd8-9ee2-4b9c-a30b-68d95e341722","source":"wordfence","cve":"","title":"ReFlex Gallery \u00bb WordPress Photo Gallery < 3.1.4 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe17abd8-9ee2-4b9c-a30b-68d95e341722?source=api-prod","affected":[{"type":"plugin","slug":"reflex-gallery","name":"ReFlex Gallery \u00bb WordPress Photo Gallery","from":"*","from_inclusive":true,"to":"3.1.4","to_inclusive":false,"patched_in":"3.1.4"}],"published":"2013-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe18de26-ef1e-44bc-94ed-eb9ddab15331","source":"wordfence","cve":"CVE-2025-32508","title":"Course Booking System <= 6.1.2 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe18de26-ef1e-44bc-94ed-eb9ddab15331?source=api-prod","affected":[{"type":"plugin","slug":"course-booking-system","name":"Course Booking System","from":"*","from_inclusive":true,"to":"6.1.2","to_inclusive":true,"patched_in":"6.1.3"}],"published":"2025-04-14T00:00:00Z","updated":"2025-07-10T14:59:09Z"},{"id":"wordfence:fe1c1834-eea2-4e02-8727-8db1fb3e96a2","source":"wordfence","cve":"CVE-2026-28052","title":"Peter Mason <= 1.4.5 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe1c1834-eea2-4e02-8727-8db1fb3e96a2?source=api-prod","affected":[{"type":"theme","slug":"petermason","name":"Peter Mason | Custom Tailoring and Clothing Store WordPress Theme","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:09:36Z"},{"id":"wordfence:fe1e8c38-345a-4529-81ba-188a8dc58503","source":"wordfence","cve":"CVE-2026-15023","title":"Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe1e8c38-345a-4529-81ba-188a8dc58503?source=api-prod","affected":[{"type":"plugin","slug":"events-manager","name":"Events Manager \u2013 Calendar, Bookings, Tickets, Appointments and more!","from":"*","from_inclusive":true,"to":"7.4.0","to_inclusive":true,"patched_in":"7.4.1"}],"published":"2026-08-24T13:24:31Z","updated":"2026-08-25T01:26:44Z"},{"id":"wordfence:fe1f8c51-d3f1-456b-bf73-362ff33ee879","source":"wordfence","cve":"CVE-2024-47324","title":"WP Timeline \u2013 Vertical and Horizontal timeline plugin <= 3.6.7 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe1f8c51-d3f1-456b-bf73-362ff33ee879?source=api-prod","affected":[{"type":"plugin","slug":"wp-timelines","name":"WP Timeline \u2013 Vertical and Horizontal timeline plugin","from":"*","from_inclusive":true,"to":"3.6.7","to_inclusive":true,"patched_in":"3.6.8"}],"published":"2024-09-25T00:00:00Z","updated":"2024-10-02T21:28:29Z"},{"id":"wordfence:fe2049b1-2eb6-412f-86b3-15f3df9f0852","source":"wordfence","cve":"CVE-2026-39763","title":"WP Dummy Content Generator <= 4.0.0 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe2049b1-2eb6-412f-86b3-15f3df9f0852?source=api-prod","affected":[{"type":"plugin","slug":"wp-dummy-content-generator","name":"WP Dummy Content Generator","from":"*","from_inclusive":true,"to":"4.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T10:21:00Z","updated":"2026-10-08T23:28:00Z"},{"id":"wordfence:fe22a460-aee7-4559-9dcf-18a582719907","source":"wordfence","cve":"CVE-2026-112862","title":"Participants Database <= 2.7.8.5 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe22a460-aee7-4559-9dcf-18a582719907?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-21T00:00:00Z","updated":"2026-10-23T21:12:43Z"},{"id":"wordfence:fe234b62-2a4c-4fa2-a79b-3848e3c68bc9","source":"wordfence","cve":"CVE-2026-28062","title":"Happy Baby <= 1.2.12 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe234b62-2a4c-4fa2-a79b-3848e3c68bc9?source=api-prod","affected":[{"type":"theme","slug":"happy-baby","name":"Happy Baby | Nanny & Babysitting Services Children WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.12","to_inclusive":true,"patched_in":""}],"published":"2026-02-27T00:00:00Z","updated":"2026-03-05T16:27:54Z"},{"id":"wordfence:fe238a78-7eaa-487f-a7bd-50a96432d395","source":"wordfence","cve":"CVE-2025-30555","title":"WordPres \u540c\u6b65\u5fae\u535a <= 1.1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe238a78-7eaa-487f-a7bd-50a96432d395?source=api-prod","affected":[{"type":"plugin","slug":"wp2wb","name":"WordPres \u540c\u6b65\u5fae\u535a","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T18:55:53Z"},{"id":"wordfence:fe25393e-a049-412f-962b-0c24492026bc","source":"wordfence","cve":"CVE-2026-84740","title":"The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution","severity":"medium","cvss":6.5,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe25393e-a049-412f-962b-0c24492026bc?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"6.12.0","from_inclusive":true,"to":"6.17.5","to_inclusive":true,"patched_in":"6.17.5.1"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-08T23:56:08Z"},{"id":"wordfence:fe25ac93-c3b6-49db-b36c-b31e9cce242c","source":"wordfence","cve":"CVE-2025-32691","title":"PowerPress Podcasting <= 11.12.6 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe25ac93-c3b6-49db-b36c-b31e9cce242c?source=api-prod","affected":[{"type":"plugin","slug":"powerpress","name":"PowerPress Podcasting plugin by Blubrry","from":"*","from_inclusive":true,"to":"11.12.6","to_inclusive":true,"patched_in":"11.12.7"}],"published":"2025-04-09T00:00:00Z","updated":"2025-04-30T16:21:03Z"},{"id":"wordfence:fe25bfef-34f0-4d57-9cba-9dcbf58281c6","source":"wordfence","cve":"CVE-2024-3849","title":"Click to Chat \u2013 HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe25bfef-34f0-4d57-9cba-9dcbf58281c6?source=api-prod","affected":[{"type":"plugin","slug":"click-to-chat-for-whatsapp","name":"Click to Chat \u2013 HoliThemes","from":"*","from_inclusive":true,"to":"3.35","to_inclusive":true,"patched_in":"4.0"}],"published":"2024-04-17T00:00:00Z","updated":"2024-05-02T16:52:54Z"},{"id":"wordfence:fe274dc5-3999-4fa6-88a8-57aecbb6f4c1","source":"wordfence","cve":"CVE-2025-68838","title":"MemberPress Discord Addon <= 1.1.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe274dc5-3999-4fa6-88a8-57aecbb6f4c1?source=api-prod","affected":[{"type":"plugin","slug":"expresstechsoftwares-memberpress-discord-add-on","name":"ExpressTechSoftwares Addon for MemberPress and Discord","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":true,"patched_in":"1.1.5"}],"published":"2026-01-20T00:00:00Z","updated":"2026-05-11T19:41:22Z"},{"id":"wordfence:fe275351-a547-440d-9e8c-c464ed333aa9","source":"wordfence","cve":"CVE-2024-6263","title":"WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe275351-a547-440d-9e8c-c464ed333aa9?source=api-prod","affected":[{"type":"plugin","slug":"wp-lightbox-2","name":"WP Lightbox 2","from":"*","from_inclusive":true,"to":"3.0.6.6","to_inclusive":true,"patched_in":"3.0.6.7"}],"published":"2024-07-02T00:00:00Z","updated":"2024-07-03T07:32:39Z"},{"id":"wordfence:fe29d7bf-3cf8-429c-91d7-2a8038749c42","source":"wordfence","cve":"CVE-2025-62953","title":"Welcart e-Commerce <= 2.11.24 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe29d7bf-3cf8-429c-91d7-2a8038749c42?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.24","to_inclusive":true,"patched_in":"2.11.25"}],"published":"2025-10-14T00:00:00Z","updated":"2025-12-04T20:27:34Z"},{"id":"wordfence:fe2a538b-60a5-4595-b901-4477679e6b8a","source":"wordfence","cve":"CVE-2015-9393","title":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe2a538b-60a5-4595-b901-4477679e6b8a?source=api-prod","affected":[{"type":"plugin","slug":"users-ultra","name":"Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin","from":"*","from_inclusive":true,"to":"1.5.63","to_inclusive":false,"patched_in":"1.5.63"}],"published":"2015-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe2cfc96-63f4-4e4b-bf49-6031594a4805","source":"wordfence","cve":"CVE-2023-6984","title":"PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe2cfc96-63f4-4e4b-bf49-6031594a4805?source=api-prod","affected":[{"type":"plugin","slug":"powerpack-lite-for-elementor","name":"PowerPack Addons for Elementor: Widgets, Form Styler and Templates","from":"*","from_inclusive":true,"to":"2.7.13","to_inclusive":true,"patched_in":"2.7.14"}],"published":"2024-01-02T00:00:00Z","updated":"2024-07-29T21:37:52Z"},{"id":"wordfence:fe2fcc3f-e7ce-4f9a-b9a9-e6cf9129aec9","source":"wordfence","cve":"CVE-2024-4090","title":"My Sticky Bar (formerly myStickymenu) <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe2fcc3f-e7ce-4f9a-b9a9-e6cf9129aec9?source=api-prod","affected":[{"type":"plugin","slug":"mystickymenu","name":"My Sticky Bar \u2013 Floating Notification Bar & Sticky Header (formerly myStickymenu)","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"2.7.2"}],"published":"2024-07-11T00:00:00Z","updated":"2024-08-09T18:29:26Z"},{"id":"wordfence:fe2fd740-b5b5-4a2a-88fc-b19b2f0f6a2b","source":"wordfence","cve":"CVE-2025-48246","title":"The Events Calendar <= 6.11.2.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe2fd740-b5b5-4a2a-88fc-b19b2f0f6a2b?source=api-prod","affected":[{"type":"plugin","slug":"the-events-calendar","name":"The Events Calendar","from":"*","from_inclusive":true,"to":"6.11.2.1","to_inclusive":true,"patched_in":"6.12.0"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-28T15:31:54Z"},{"id":"wordfence:fe31346e-a06e-4b4d-b13c-7a98dca53274","source":"wordfence","cve":"CVE-2025-54013","title":"Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe31346e-a06e-4b4d-b13c-7a98dca53274?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.16","to_inclusive":true,"patched_in":"2.11.17"}],"published":"2025-07-16T00:00:00Z","updated":"2025-07-22T13:42:31Z"},{"id":"wordfence:fe324d4d-eb52-4eeb-ad91-072a6e84d9ba","source":"wordfence","cve":"CVE-2025-13358","title":"Accessiy By CodeConfig Accessibility <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe324d4d-eb52-4eeb-ad91-072a6e84d9ba?source=api-prod","affected":[{"type":"plugin","slug":"codeconfig-accessibility","name":"Accessiy by CodeConfig \u2013 Accessibility Widgets for ADA, EAA & WCAG Compliance","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.0.1"}],"published":"2025-12-05T17:47:37Z","updated":"2025-12-12T16:54:49Z"},{"id":"wordfence:fe3302c0-4817-459e-a6f6-d5ead9c29fed","source":"wordfence","cve":"CVE-2026-18595","title":"WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3302c0-4817-459e-a6f6-d5ead9c29fed?source=api-prod","affected":[{"type":"plugin","slug":"wp-lister-for-ebay","name":"WP-Lister Lite for eBay","from":"*","from_inclusive":true,"to":"3.8.9","to_inclusive":true,"patched_in":"3.8.10"}],"published":"2026-09-15T15:28:11Z","updated":"2026-09-16T03:28:22Z"},{"id":"wordfence:fe3522ff-3eed-4b6a-910a-509b8963e992","source":"wordfence","cve":"CVE-2026-11961","title":"User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":8.1,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3522ff-3eed-4b6a-910a-509b8963e992?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"5.2.2","to_inclusive":true,"patched_in":"5.2.3"}],"published":"2026-06-26T00:00:00Z","updated":"2026-07-30T12:07:39Z"},{"id":"wordfence:fe3718a4-79ef-431f-a898-74c37ed3b90d","source":"wordfence","cve":"CVE-2025-14431","title":"Navian <= 1.5.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3718a4-79ef-431f-a898-74c37ed3b90d?source=api-prod","affected":[{"type":"theme","slug":"navian","name":"Navian - Multi-Purpose Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"1.5.4","to_inclusive":true,"patched_in":""}],"published":"2026-01-07T00:00:00Z","updated":"2026-01-13T21:42:49Z"},{"id":"wordfence:fe3834a6-a6f5-4cc7-951e-a6ada6346b07","source":"wordfence","cve":"CVE-2024-8242","title":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload","severity":"medium","cvss":4.3,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3834a6-a6f5-4cc7-951e-a6ada6346b07?source=api-prod","affected":[{"type":"plugin","slug":"mstore-api","name":"MStore API \u2013 Create Native Android & iOS Apps On The Cloud","from":"*","from_inclusive":true,"to":"4.15.3","to_inclusive":true,"patched_in":"4.15.4"}],"published":"2024-09-12T20:50:39Z","updated":"2024-09-13T15:10:47Z"},{"id":"wordfence:fe391ac9-e3ea-48b3-8ffe-243972ce89f6","source":"wordfence","cve":"CVE-2024-6489","title":"Getwid \u2013 Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe391ac9-e3ea-48b3-8ffe-243972ce89f6?source=api-prod","affected":[{"type":"plugin","slug":"getwid","name":"Getwid \u2013 Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.0.10","to_inclusive":true,"patched_in":"2.0.11"}],"published":"2024-07-19T00:00:00Z","updated":"2024-07-20T06:43:48Z"},{"id":"wordfence:fe3a7196-690b-45bb-a34f-05981f6780f1","source":"wordfence","cve":"CVE-2026-100153","title":"NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3a7196-690b-45bb-a34f-05981f6780f1?source=api-prod","affected":[{"type":"plugin","slug":"newstatpress","name":"NewStatPress","from":"*","from_inclusive":true,"to":"1.4.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-13T15:38:02Z","updated":"2026-10-14T03:40:07Z"},{"id":"wordfence:fe3c897a-c3fb-4d1f-ad4c-c1bbb781a5aa","source":"wordfence","cve":"CVE-2024-3636","title":"Pinpoint Booking System <= 2.9.9.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3c897a-c3fb-4d1f-ad4c-c1bbb781a5aa?source=api-prod","affected":[{"type":"plugin","slug":"booking-system","name":"Pinpoint Booking System \u2013 Legacy version","from":"*","from_inclusive":true,"to":"2.9.9.4.7","to_inclusive":true,"patched_in":"2.9.9.4.8"}],"published":"2024-07-15T00:00:00Z","updated":"2024-08-28T23:16:48Z"},{"id":"wordfence:fe3c8b76-b81e-4fc0-8497-e075cca382d9","source":"wordfence","cve":"CVE-2025-58592","title":"TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3c8b76-b81e-4fc0-8497-e075cca382d9?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"2.10.2","to_inclusive":true,"patched_in":"2.10.3"}],"published":"2025-09-24T00:00:00Z","updated":"2025-09-30T12:52:05Z"},{"id":"wordfence:fe3cfaf4-67c8-47af-bd58-e8ad27a03fae","source":"wordfence","cve":"CVE-2024-6155","title":"Greenshift \u2013 animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3cfaf4-67c8-47af-bd58-e8ad27a03fae?source=api-prod","affected":[{"type":"plugin","slug":"greenshift-animation-and-page-builder-blocks","name":"Greenshift \u2013 animation and page builder blocks","from":"*","from_inclusive":true,"to":"9.0.0","to_inclusive":true,"patched_in":"9.0.1"}],"published":"2025-01-08T22:19:00Z","updated":"2025-01-09T11:11:06Z"},{"id":"wordfence:fe3fab02-c9e8-4b16-aac1-7a1e56e6b49a","source":"wordfence","cve":"CVE-2026-12872","title":"Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3fab02-c9e8-4b16-aac1-7a1e56e6b49a?source=api-prod","affected":[{"type":"plugin","slug":"webinfos","name":"Webinfos","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T22:24:57Z"},{"id":"wordfence:fe400dbe-43eb-41c1-8e31-c350228e0f8b","source":"wordfence","cve":"","title":"JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe400dbe-43eb-41c1-8e31-c350228e0f8b?source=api-prod","affected":[{"type":"plugin","slug":"wp-jobsearch","name":"JobSearch WP Job Board","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2020-07-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe4171b9-b17e-4e6e-9ab4-4b1b125e8950","source":"wordfence","cve":"","title":"Lana Email Tester <= 1.0.0 - Missing Authorization to Mail Relay & Cross-Site Request Forgery","severity":"medium","cvss":5.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4171b9-b17e-4e6e-9ab4-4b1b125e8950?source=api-prod","affected":[{"type":"plugin","slug":"lana-email-tester","name":"Lana Email Tester","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2022-06-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe41d8a7-c1d9-4c1a-9330-50baa3fa449d","source":"wordfence","cve":"CVE-2025-69332","title":"Bookify \u2013 Appointment Booking & Scheduling for WordPress <= 1.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe41d8a7-c1d9-4c1a-9330-50baa3fa449d?source=api-prod","affected":[{"type":"plugin","slug":"bookify","name":"Bookify \u2013 Appointment Booking & Scheduling for WordPress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":"1.1.2"}],"published":"2026-04-23T00:00:00Z","updated":"2026-04-30T14:37:19Z"},{"id":"wordfence:fe43b168-5b40-4d64-8fbd-c394970e832e","source":"wordfence","cve":"CVE-2025-63003","title":"North <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe43b168-5b40-4d64-8fbd-c394970e832e?source=api-prod","affected":[{"type":"plugin","slug":"north-plugin","name":"North","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-11T16:21:56Z"},{"id":"wordfence:fe43d128-46ac-42e2-9469-02772dc1ad52","source":"wordfence","cve":"CVE-2025-32212","title":"Specia Companion <= 4.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe43d128-46ac-42e2-9469-02772dc1ad52?source=api-prod","affected":[{"type":"plugin","slug":"specia-companion","name":"Specia Companion","from":"*","from_inclusive":true,"to":"4.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-07T00:00:00Z","updated":"2025-04-25T14:45:28Z"},{"id":"wordfence:fe44fe7f-0ccf-4297-a9a7-107695abfe13","source":"wordfence","cve":"CVE-2022-3837","title":"Uji Countdown <= 2.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe44fe7f-0ccf-4297-a9a7-107695abfe13?source=api-prod","affected":[{"type":"plugin","slug":"uji-countdown","name":"Uji Countdown","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":"2.3.1"}],"published":"2022-11-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe456de4-4bf3-45aa-938d-8d4561fac44e","source":"wordfence","cve":"CVE-2025-8391","title":"Magic Edge \u2013 Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe456de4-4bf3-45aa-938d-8d4561fac44e?source=api-prod","affected":[{"type":"plugin","slug":"magic-edge-lite-image-background-remover","name":"Magic Edge \u2013 Lite","from":"*","from_inclusive":true,"to":"1.1.6","to_inclusive":true,"patched_in":""}],"published":"2025-08-01T19:37:23Z","updated":"2025-08-02T08:24:48Z"},{"id":"wordfence:fe459051-53ce-405c-a39d-ffbbbb440d5d","source":"wordfence","cve":"CVE-2026-125451","title":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe459051-53ce-405c-a39d-ffbbbb440d5d?source=api-prod","affected":[{"type":"plugin","slug":"b-blocks","name":"bBlocks \u2013 Essential Gutenberg Blocks & Patterns Collection","from":"*","from_inclusive":true,"to":"2.1.15","to_inclusive":true,"patched_in":"2.1.16"}],"published":"2026-11-11T00:00:00Z","updated":"2026-11-11T16:01:27Z"},{"id":"wordfence:fe46ec14-4795-4ac7-afd0-de92ccef877d","source":"wordfence","cve":"CVE-2025-7686","title":"weichuncai(WP\u4f2a\u6625\u83dc) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe46ec14-4795-4ac7-afd0-de92ccef877d?source=api-prod","affected":[{"type":"plugin","slug":"weichuncai","name":"weichuncai(WP\u4f2a\u6625\u83dc)","from":"*","from_inclusive":true,"to":"1.5","to_inclusive":true,"patched_in":""}],"published":"2025-08-15T14:45:37Z","updated":"2025-08-16T03:38:53Z"},{"id":"wordfence:fe4774ee-16f2-478f-92e3-8a7da7b30336","source":"wordfence","cve":"CVE-2025-13068","title":"Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4774ee-16f2-478f-92e3-8a7da7b30336?source=api-prod","affected":[{"type":"plugin","slug":"telegram-bot","name":"Telegram Bot & Channel","from":"*","from_inclusive":true,"to":"4.1","to_inclusive":true,"patched_in":"4.1.1"}],"published":"2025-11-24T16:29:12Z","updated":"2025-11-25T04:38:02Z"},{"id":"wordfence:fe4b3cab-eda2-45b1-8c38-57bd8381d5b3","source":"wordfence","cve":"CVE-2026-62089","title":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits <= 3.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4b3cab-eda2-45b1-8c38-57bd8381d5b3?source=api-prod","affected":[{"type":"plugin","slug":"master-addons","name":"Master Addons for Elementor \u2013 Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits","from":"*","from_inclusive":true,"to":"3.2.2","to_inclusive":true,"patched_in":"3.2.3"}],"published":"2026-09-11T00:00:00Z","updated":"2026-09-15T20:19:56Z"},{"id":"wordfence:fe4c20d6-cf38-45c3-9733-ff1fbe4908f4","source":"wordfence","cve":"CVE-2025-62062","title":"Easy Post Submission <= 1.7.0 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4c20d6-cf38-45c3-9733-ff1fbe4908f4?source=api-prod","affected":[{"type":"plugin","slug":"easy-post-submission","name":"Easy Post Submission \u2013 Frontend Posting, Guest Publishing & Submit Content for WordPress","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-10-16T00:00:00Z","updated":"2025-10-23T14:11:27Z"},{"id":"wordfence:fe5227f0-3f7f-4d31-8d46-de2eec44b514","source":"wordfence","cve":"CVE-2024-32571","title":"WP Stripe Checkout <= 1.2.2.41 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5227f0-3f7f-4d31-8d46-de2eec44b514?source=api-prod","affected":[{"type":"plugin","slug":"wp-stripe-checkout","name":"WP Stripe Checkout","from":"*","from_inclusive":true,"to":"1.2.2.41","to_inclusive":true,"patched_in":"1.2.2.42"}],"published":"2024-04-16T00:00:00Z","updated":"2024-04-24T15:54:59Z"},{"id":"wordfence:fe54c37f-1421-48aa-b502-045847d13ae3","source":"wordfence","cve":"CVE-2023-2184","title":"WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe54c37f-1421-48aa-b502-045847d13ae3?source=api-prod","affected":[{"type":"plugin","slug":"responsive-horizontal-vertical-and-accordion-tabs","name":"Responsive Tabs \u2014 Horizontal, Vertical & Accordion Tabs for WordPress","from":"*","from_inclusive":true,"to":"1.1.15","to_inclusive":true,"patched_in":"1.1.16"}],"published":"2023-04-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe56adfd-305c-4f40-9250-83f30d189437","source":"wordfence","cve":"CVE-2025-26771","title":"SKT Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe56adfd-305c-4f40-9250-83f30d189437?source=api-prod","affected":[{"type":"plugin","slug":"skt-blocks","name":"SKT Blocks \u2013 Gutenberg based Page Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.8"}],"published":"2025-02-14T00:00:00Z","updated":"2026-04-15T20:39:55Z"},{"id":"wordfence:fe573d64-036e-4f6f-bcc1-5183bb9ad2b9","source":"wordfence","cve":"CVE-2026-8679","title":"AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe573d64-036e-4f6f-bcc1-5183bb9ad2b9?source=api-prod","affected":[{"type":"plugin","slug":"audioigniter","name":"AudioIgniter Music Player","from":"*","from_inclusive":true,"to":"2.0.2","to_inclusive":true,"patched_in":"2.0.3"}],"published":"2026-05-21T19:33:26Z","updated":"2026-05-22T07:50:27Z"},{"id":"wordfence:fe5a963c-df35-4e6e-a381-10e0eb638304","source":"wordfence","cve":"CVE-2025-62761","title":"Knowledge Base documentation & wiki plugin \u2013 BasePress <= 2.17.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5a963c-df35-4e6e-a381-10e0eb638304?source=api-prod","affected":[{"type":"plugin","slug":"basepress","name":"Knowledge Base documentation & wiki plugin \u2013 BasePress Docs","from":"*","from_inclusive":true,"to":"2.17.0.1","to_inclusive":true,"patched_in":"2.17.0.2"}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-13T17:50:08Z"},{"id":"wordfence:fe5bd645-0707-43ce-9316-d52f60035754","source":"wordfence","cve":"CVE-2026-11355","title":"DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5bd645-0707-43ce-9316-d52f60035754?source=api-prod","affected":[{"type":"plugin","slug":"dt-lms-lite","name":"DT LMS \u2013 elearning,  WordPress LMS Plugin","from":"*","from_inclusive":true,"to":"1.1","to_inclusive":true,"patched_in":"1.2"}],"published":"2026-09-11T18:48:09Z","updated":"2026-09-12T07:39:16Z"},{"id":"wordfence:fe5f7aaf-46e3-4d62-ae3f-85bbb85a511d","source":"wordfence","cve":"CVE-2025-23621","title":"Causes \u2013 Donation Plugin <= 1.0.01 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5f7aaf-46e3-4d62-ae3f-85bbb85a511d?source=api-prod","affected":[{"type":"plugin","slug":"causes","name":"Causes \u2013 Donation Plugin","from":"*","from_inclusive":true,"to":"1.0.01","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:20:46Z"},{"id":"wordfence:fe5fd453-b1fc-4d52-bb46-aebd68508891","source":"wordfence","cve":"CVE-2025-13730","title":"OpenID Connect Generic Client <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe5fd453-b1fc-4d52-bb46-aebd68508891?source=api-prod","affected":[{"type":"plugin","slug":"daggerhart-openid-connect-generic","name":"OpenID Connect Generic Client","from":"*","from_inclusive":true,"to":"3.10.0","to_inclusive":true,"patched_in":"3.10.1"}],"published":"2025-12-17T00:00:00Z","updated":"2025-12-18T09:21:30Z"},{"id":"wordfence:fe60c813-ded9-4502-83fe-bfede1e327d6","source":"wordfence","cve":"CVE-2026-73360","title":"Chaty Pro <= 3.5.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe60c813-ded9-4502-83fe-bfede1e327d6?source=api-prod","affected":[{"type":"plugin","slug":"chaty-pro","name":"Chaty Pro","from":"*","from_inclusive":true,"to":"3.5.8","to_inclusive":true,"patched_in":"3.5.9"}],"published":"2026-08-17T00:00:00Z","updated":"2026-09-16T15:35:34Z"},{"id":"wordfence:fe647f9a-7467-4534-abcc-40df7b3517e6","source":"wordfence","cve":"CVE-2025-62948","title":"Date counter <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe647f9a-7467-4534-abcc-40df7b3517e6?source=api-prod","affected":[{"type":"plugin","slug":"date-counter","name":"Date counter","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-10-11T00:00:00Z","updated":"2025-10-29T14:50:05Z"},{"id":"wordfence:fe668f93-f6b7-4824-ad17-024291d8f535","source":"wordfence","cve":"CVE-2018-14846","title":"Multi Step Form <= 1.2.5 - Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe668f93-f6b7-4824-ad17-024291d8f535?source=api-prod","affected":[{"type":"plugin","slug":"multi-step-form","name":"Multi Step Form","from":"*","from_inclusive":true,"to":"1.2.6","to_inclusive":false,"patched_in":"1.2.6"}],"published":"2018-07-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe67064b-7b22-48e8-9a07-9870af6c453a","source":"wordfence","cve":"CVE-2026-111318","title":"HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe67064b-7b22-48e8-9a07-9870af6c453a?source=api-prod","affected":[{"type":"plugin","slug":"ht-mega-for-elementor","name":"HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2026-10-28T21:11:54Z","updated":"2026-10-29T09:25:37Z"},{"id":"wordfence:fe679ff6-6ade-48fa-8699-6a96da49f8c8","source":"wordfence","cve":"CVE-2025-24741","title":"KB Support <= 1.6.7 - Unauthenticated Open Redirect","severity":"medium","cvss":6.1,"cwe":"CWE-601","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe679ff6-6ade-48fa-8699-6a96da49f8c8?source=api-prod","affected":[{"type":"plugin","slug":"kb-support","name":"KB Support \u2013 Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin","from":"*","from_inclusive":true,"to":"1.6.7","to_inclusive":true,"patched_in":"1.6.8"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T19:03:54Z"},{"id":"wordfence:fe684f43-8442-4b29-84a8-da8c6863e62b","source":"wordfence","cve":"CVE-2025-14755","title":"Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe684f43-8442-4b29-84a8-da8c6863e62b?source=api-prod","affected":[{"type":"plugin","slug":"cost-calculator-builder","name":"Cost Calculator Builder","from":"*","from_inclusive":true,"to":"4.0.1","to_inclusive":true,"patched_in":"4.0.2"}],"published":"2026-05-12T15:19:44Z","updated":"2026-05-13T03:26:52Z"},{"id":"wordfence:fe685a64-a84c-4d29-b002-05d40f540391","source":"wordfence","cve":"CVE-2012-6313","title":"Simple Gmail Login < 1.1.4 - Sensitive Information Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe685a64-a84c-4d29-b002-05d40f540391?source=api-prod","affected":[{"type":"plugin","slug":"simple-gmail-login","name":"Simple Gmail Login","from":"*","from_inclusive":true,"to":"1.1.4","to_inclusive":false,"patched_in":"1.1.4"}],"published":"2012-11-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe695bd6-17c4-457b-a423-aa41b14379cf","source":"wordfence","cve":"CVE-2026-81786","title":"Thanko Thank You Page Customizer for WooCommerce \u2013 Increase Your Sales <= 1.2.2 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe695bd6-17c4-457b-a423-aa41b14379cf?source=api-prod","affected":[{"type":"plugin","slug":"woo-thank-you-page-customizer","name":"Thanko Thank You Page Customizer for WooCommerce","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2026-09-08T00:00:00Z","updated":"2026-09-18T01:09:46Z"},{"id":"wordfence:fe6a09b1-cf2c-4d64-9b81-b2cc02e98d45","source":"wordfence","cve":"CVE-2024-47641","title":"Confetti Fall Animation <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe6a09b1-cf2c-4d64-9b81-b2cc02e98d45?source=api-prod","affected":[{"type":"plugin","slug":"confetti-fall-animation","name":"Confetti Fall Animation","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":"1.3.1"}],"published":"2024-09-30T00:00:00Z","updated":"2026-01-23T19:14:29Z"},{"id":"wordfence:fe6f569f-0b4d-4530-b2b2-37e92b03d45a","source":"wordfence","cve":"CVE-2026-78267","title":"TranslatePress \u2013 Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Privilege Escalation","severity":"high","cvss":7.3,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe6f569f-0b4d-4530-b2b2-37e92b03d45a?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.3.2","to_inclusive":true,"patched_in":"3.3.3"}],"published":"2026-08-24T12:35:49Z","updated":"2026-09-10T19:30:51Z"},{"id":"wordfence:fe708e03-334f-4c72-ace9-b5d065ee8c9d","source":"wordfence","cve":"CVE-2021-36896","title":"Pricing Table <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":4.8,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe708e03-334f-4c72-ace9-b5d065ee8c9d?source=api-prod","affected":[{"type":"plugin","slug":"pricing-table","name":"Pricing Table","from":"*","from_inclusive":true,"to":"1.5.2","to_inclusive":true,"patched_in":""}],"published":"2022-04-05T14:36:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe71e2b9-ddd7-4d6d-97e5-5fad41f8f35c","source":"wordfence","cve":"CVE-2024-12324","title":"Unilevel MLM Plan <= 1.1.0 - Reflected Cross-Site Scripting via 'page'","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe71e2b9-ddd7-4d6d-97e5-5fad41f8f35c?source=api-prod","affected":[{"type":"plugin","slug":"unilevel-mlm-plan","name":"Unilevel MLM Plan","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":true,"patched_in":"2.0.0"}],"published":"2025-01-06T15:43:18Z","updated":"2025-11-20T19:11:37Z"},{"id":"wordfence:fe737eb1-4b9f-4efb-ad34-6c0be4d66043","source":"wordfence","cve":"CVE-2025-32244","title":"SEO Help <= 6.8.5 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe737eb1-4b9f-4efb-ad34-6c0be4d66043?source=api-prod","affected":[{"type":"plugin","slug":"seo-help","name":"QC SEO Help for llms.txt, AI Analytics, AI Content Writer, FAQ Generator, Subtitle to Article","from":"*","from_inclusive":true,"to":"6.8.5","to_inclusive":true,"patched_in":"6.8.6"}],"published":"2025-04-07T00:00:00Z","updated":"2026-06-23T17:33:47Z"},{"id":"wordfence:fe799030-ec9c-45fd-a5a9-6589364b6056","source":"wordfence","cve":"","title":"DT Chocolate (All Versions) - Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe799030-ec9c-45fd-a5a9-6589364b6056?source=api-prod","affected":[{"type":"theme","slug":"dt-chocolate","name":"Chocolate WP \u2013 Responsive Photography Theme | Photography","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-01-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe7e6a53-36c3-41fc-bae8-a9e1de2494ad","source":"wordfence","cve":"","title":"Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection","severity":"high","cvss":8.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe7e6a53-36c3-41fc-bae8-a9e1de2494ad?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-terms-order","name":"Category Order and Taxonomy Terms Order","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":false,"patched_in":"1.5.3"}],"published":"2018-02-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe7f75b4-f315-44f7-8e67-1680eeee3942","source":"wordfence","cve":"CVE-2023-23983","title":"Responsive Vertical Icon Menu <= 1.5.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe7f75b4-f315-44f7-8e67-1680eeee3942?source=api-prod","affected":[{"type":"plugin","slug":"wpdevart-vertical-menu","name":"Responsive Vertical Icon Menu","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe7fb326-9f97-4965-80d9-9b26071e354b","source":"wordfence","cve":"CVE-2026-121970","title":"Pay with Vipps and MobilePay for WooCommerce  5.0.0 - 6.4.0 - [Fill this out]","severity":"medium","cvss":5.3,"cwe":"CWE-347","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe7fb326-9f97-4965-80d9-9b26071e354b?source=api-prod","affected":[{"type":"plugin","slug":"woo-vipps","name":"Pay with Vipps and MobilePay for WooCommerce","from":"5.0.0","from_inclusive":true,"to":"6.4.0","to_inclusive":true,"patched_in":"6.4.1"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-11T13:14:33Z"},{"id":"wordfence:fe82b7ee-d09b-4eeb-a7d6-914b8b24368b","source":"wordfence","cve":"CVE-2024-13433","title":"Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe82b7ee-d09b-4eeb-a7d6-914b8b24368b?source=api-prod","affected":[{"type":"plugin","slug":"utilities-for-mtg","name":"Utilities for MTG","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-17T19:01:19Z","updated":"2025-01-18T07:05:11Z"},{"id":"wordfence:fe82e9d2-764b-49da-a062-c5fc7c876396","source":"wordfence","cve":"CVE-2023-3129","title":"URL Shortify \u2013 Simple, Powerful and Easy URL Shortener Plugin For WordPress <= 1.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe82e9d2-764b-49da-a062-c5fc7c876396?source=api-prod","affected":[{"type":"plugin","slug":"url-shortify","name":"URL Shortify \u2013 Simple and Easy URL Shortener","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":false,"patched_in":"1.7.0"}],"published":"2023-06-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe8457ee-c408-40f9-aca4-97e76efa2847","source":"wordfence","cve":"CVE-2024-50456","title":"SEOPress <= 8.1.1 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8457ee-c408-40f9-aca4-97e76efa2847?source=api-prod","affected":[{"type":"plugin","slug":"wp-seopress","name":"SEOPress \u2013 AI SEO Plugin & On-site SEO","from":"*","from_inclusive":true,"to":"8.1.1","to_inclusive":true,"patched_in":"8.2"}],"published":"2024-10-24T00:00:00Z","updated":"2024-10-30T19:36:38Z"},{"id":"wordfence:fe848a09-edd3-4eea-befb-909d15ba1994","source":"wordfence","cve":"CVE-2025-12471","title":"Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe848a09-edd3-4eea-befb-909d15ba1994?source=api-prod","affected":[{"type":"plugin","slug":"social-pug","name":"Hubbub Lite \u2013 Fast, free social sharing and follow buttons","from":"*","from_inclusive":true,"to":"1.36.0","to_inclusive":true,"patched_in":"1.36.1"}],"published":"2025-11-05T18:42:05Z","updated":"2025-11-06T06:45:21Z"},{"id":"wordfence:fe8723a7-bbb1-41a0-b222-3cf4eb44cd64","source":"wordfence","cve":"CVE-2025-5392","title":"GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution","severity":"critical","cvss":9.8,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8723a7-bbb1-41a0-b222-3cf4eb44cd64?source=api-prod","affected":[{"type":"plugin","slug":"gb-forms-db","name":"GB Forms DB","from":"*","from_inclusive":true,"to":"1.0.2","to_inclusive":true,"patched_in":"1.0.3"}],"published":"2025-07-10T18:32:31Z","updated":"2025-07-11T06:43:34Z"},{"id":"wordfence:fe8816d8-1687-4a3c-9f2a-23f21d679cc5","source":"wordfence","cve":"CVE-2023-7204","title":"WP STAGING WordPress Backup Plugin < 3.2.0 - Sensitive Information Exposure via cache files","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8816d8-1687-4a3c-9f2a-23f21d679cc5?source=api-prod","affected":[{"type":"plugin","slug":"wp-staging","name":"WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":false,"patched_in":"3.2.0"}],"published":"2024-01-31T00:00:00Z","updated":"2024-04-17T14:39:50Z"},{"id":"wordfence:fe88271e-696a-4a8e-a43e-ffac7ddc9f1e","source":"wordfence","cve":"CVE-2026-104814","title":"Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe88271e-696a-4a8e-a43e-ffac7ddc9f1e?source=api-prod","affected":[{"type":"plugin","slug":"form-block","name":"Form Block","from":"*","from_inclusive":true,"to":"1.8.1","to_inclusive":true,"patched_in":"1.8.2"}],"published":"2026-10-05T10:12:12Z","updated":"2026-10-08T23:13:19Z"},{"id":"wordfence:fe887475-f7e8-4fda-a793-bc6f37b70f3e","source":"wordfence","cve":"CVE-2026-5722","title":"MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse","severity":"critical","cvss":9.8,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe887475-f7e8-4fda-a793-bc6f37b70f3e?source=api-prod","affected":[{"type":"plugin","slug":"smart-wishlist-for-more-convert-premium","name":"MoreConvert Pro","from":"*","from_inclusive":true,"to":"1.9.14","to_inclusive":true,"patched_in":"1.9.15"}],"published":"2026-05-04T13:18:12Z","updated":"2026-05-29T12:28:05Z"},{"id":"wordfence:fe8b6a16-0a39-42fd-bb0f-9114ec08a885","source":"wordfence","cve":"CVE-2025-4954","title":"Axle Demo Importer <= 1.0.3 - Authenticated (Author+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8b6a16-0a39-42fd-bb0f-9114ec08a885?source=api-prod","affected":[{"type":"plugin","slug":"axle-demo-importer","name":"Axle Demo Importer","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-06-11T00:00:00Z","updated":"2025-06-17T14:30:43Z"},{"id":"wordfence:fe8f69ed-664b-4c13-9ad9-3fb3689deb2c","source":"wordfence","cve":"CVE-2026-95586","title":"Ultra Addons for Contact Form 7 <= 3.5.50 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe8f69ed-664b-4c13-9ad9-3fb3689deb2c?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-addons-for-contact-form-7","name":"Ultra Addons for Contact Form 7","from":"*","from_inclusive":true,"to":"3.5.50","to_inclusive":true,"patched_in":"3.5.51"}],"published":"2026-09-22T00:00:00Z","updated":"2026-09-23T14:10:25Z"},{"id":"wordfence:fe926435-ef91-4717-8612-31c053771491","source":"wordfence","cve":"","title":"AdminOnline (Unspecified Version) - Directly Traversal/Arbitrary File Read","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe926435-ef91-4717-8612-31c053771491?source=api-prod","affected":[{"type":"plugin","slug":"adminonline","name":"AdminOnline","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2014-06-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe93f443-7941-4463-a068-c292c172f071","source":"wordfence","cve":"","title":"S3 Bubble Amazon S3 HTML5 Video with Adverts <= 2.0 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe93f443-7941-4463-a068-c292c172f071?source=api-prod","affected":[{"type":"plugin","slug":"s3bubble-amazon-s3-html-5-video-with-adverts","name":"S3 Bubble Amazon S3 HTML5 Video with Adverts","from":"*","from_inclusive":true,"to":"2.0","to_inclusive":true,"patched_in":""}],"published":"2015-04-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe951dc0-7b29-4cad-a86b-6b1f6bcca18b","source":"wordfence","cve":"CVE-2025-49287","title":"Product Feed for WooCommerce <= 2.2.8 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe951dc0-7b29-4cad-a86b-6b1f6bcca18b?source=api-prod","affected":[{"type":"plugin","slug":"webtoffee-product-feed","name":"WebToffee WooCommerce Product Feeds \u2013 Google Shopping, Pinterest, TikTok Ads, & More","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2025-06-05T00:00:00Z","updated":"2025-06-10T18:26:43Z"},{"id":"wordfence:fe9659ff-7233-44d4-aaff-ad3089511a67","source":"wordfence","cve":"CVE-2024-32096","title":"WP Migration Plugin DB & Files \u2013 WP Synchro <= 1.11.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe9659ff-7233-44d4-aaff-ad3089511a67?source=api-prod","affected":[{"type":"plugin","slug":"wpsynchro","name":"WP Synchro \u2013 The Ultimate WordPress Migration Tool","from":"*","from_inclusive":true,"to":"1.11.2","to_inclusive":true,"patched_in":"1.11.3"}],"published":"2024-04-11T00:00:00Z","updated":"2024-05-07T19:08:31Z"},{"id":"wordfence:fe97e970-d5a3-4a71-af38-37f9ab57067d","source":"wordfence","cve":"CVE-2025-63016","title":"QuadLayers TikTok Feed <= 4.6.4 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe97e970-d5a3-4a71-af38-37f9ab57067d?source=api-prod","affected":[{"type":"plugin","slug":"wp-tiktok-feed","name":"QuadLayers TikTok Feed","from":"*","from_inclusive":true,"to":"4.6.4","to_inclusive":true,"patched_in":""}],"published":"2025-12-31T00:00:00Z","updated":"2026-01-05T18:39:33Z"},{"id":"wordfence:fe98bd8c-6db3-4094-8ff2-ab21c8778698","source":"wordfence","cve":"CVE-2022-1008","title":"Catch Themes Demo Import <= 3.0.2 - Authenticated (Admin+) Arbitrary File Upload","severity":"high","cvss":7.2,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe98bd8c-6db3-4094-8ff2-ab21c8778698?source=api-prod","affected":[{"type":"plugin","slug":"one-click-demo-import","name":"One Click Demo Import","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":false,"patched_in":"3.1.0"}],"published":"2022-04-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe996511-f29a-4e28-b6de-3633d45b10c1","source":"wordfence","cve":"CVE-2013-2698","title":"Calendar <= 1.3.2 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe996511-f29a-4e28-b6de-3633d45b10c1?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.2","to_inclusive":true,"patched_in":"1.3.3"}],"published":"2014-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fe99d636-bb71-431e-88d6-130767341c83","source":"wordfence","cve":"CVE-2024-49669","title":"INK Official <= 4.1.2 - Authenticated (Contributor+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fe99d636-bb71-431e-88d6-130767341c83?source=api-prod","affected":[{"type":"plugin","slug":"ink-official","name":"INK Official","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":""}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-30T16:16:06Z"},{"id":"wordfence:fea1546c-1d8f-4478-81b7-20a9096e0217","source":"wordfence","cve":"CVE-2024-13706","title":"WP Image Uploader <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea1546c-1d8f-4478-81b7-20a9096e0217?source=api-prod","affected":[{"type":"plugin","slug":"wp-image-uploader","name":"WP Image Uploader","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-29T23:03:02Z","updated":"2025-01-30T11:10:20Z"},{"id":"wordfence:fea1a37a-1c28-4a7c-a0f1-54c1d1b52ce3","source":"wordfence","cve":"CVE-2024-12301","title":"JSP Store Locator <= 1.0 - Cross-Site Request Forgery to Store Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea1a37a-1c28-4a7c-a0f1-54c1d1b52ce3?source=api-prod","affected":[{"type":"plugin","slug":"jsp-store-locator","name":"JSP Store Locator","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2024-12-27T00:00:00Z","updated":"2025-01-09T14:32:06Z"},{"id":"wordfence:fea293db-935b-4a06-83ee-d57bf5f307cd","source":"wordfence","cve":"CVE-2026-24382","title":"News Magazine X <= 1.2.50 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea293db-935b-4a06-83ee-d57bf5f307cd?source=api-prod","affected":[{"type":"theme","slug":"news-magazine-x","name":"News Magazine X","from":"*","from_inclusive":true,"to":"1.2.50","to_inclusive":true,"patched_in":"1.2.51"}],"published":"2026-03-10T00:00:00Z","updated":"2026-03-19T13:38:11Z"},{"id":"wordfence:fea688c7-88d6-424b-90e2-f82eb37c5a0e","source":"wordfence","cve":"CVE-2024-13306","title":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea688c7-88d6-424b-90e2-f82eb37c5a0e?source=api-prod","affected":[{"type":"plugin","slug":"gmap-embed","name":"Maps Plugin using Google Maps for WordPress \u2013 WP Google Map","from":"*","from_inclusive":true,"to":"1.9.3","to_inclusive":true,"patched_in":"1.9.4"}],"published":"2025-01-24T00:00:00Z","updated":"2025-02-26T21:34:21Z"},{"id":"wordfence:fea6ddd5-f168-471c-99eb-efc46d1bfeb9","source":"wordfence","cve":"CVE-2018-11515","title":"wpForo Forum <= 1.4.12 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea6ddd5-f168-471c-99eb-efc46d1bfeb9?source=api-prod","affected":[{"type":"plugin","slug":"wpforo","name":"wpForo Forum","from":"*","from_inclusive":true,"to":"1.4.12","to_inclusive":true,"patched_in":"1.4.13"}],"published":"2018-05-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fea71287-f92e-43e5-adbf-d89fce437e56","source":"wordfence","cve":"CVE-2024-6634","title":"Master Currency WP <= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea71287-f92e-43e5-adbf-d89fce437e56?source=api-prod","affected":[{"type":"plugin","slug":"mastercurrency-wp","name":"Master Currency WP","from":"*","from_inclusive":true,"to":"1.1.61","to_inclusive":true,"patched_in":""}],"published":"2024-07-26T00:00:00Z","updated":"2024-07-27T01:51:06Z"},{"id":"wordfence:fea7c3f1-1fb4-4a0f-8bbe-c4a0e346993f","source":"wordfence","cve":"CVE-2025-67568","title":"Basel <= 5.9.1 - Missing Authorization","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea7c3f1-1fb4-4a0f-8bbe-c4a0e346993f?source=api-prod","affected":[{"type":"theme","slug":"basel","name":"Basel - Responsive WooCommerce Theme","from":"*","from_inclusive":true,"to":"5.9.1","to_inclusive":true,"patched_in":"5.9.2"}],"published":"2025-11-19T00:00:00Z","updated":"2025-12-11T16:49:37Z"},{"id":"wordfence:fea82b46-cb23-4603-8e50-565cc65db857","source":"wordfence","cve":"CVE-2026-65507","title":"AI Copilot \u2013 Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea82b46-cb23-4603-8e50-565cc65db857?source=api-prod","affected":[{"type":"plugin","slug":"ai-copilot-content-generator","name":"AI Copilot \u2013 Content Generator","from":"*","from_inclusive":true,"to":"1.5.6","to_inclusive":true,"patched_in":"1.5.8"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-07T18:31:23Z"},{"id":"wordfence:fea96f84-f75b-4f02-9ca8-f8fda439d565","source":"wordfence","cve":"CVE-2024-3808","title":"Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fea96f84-f75b-4f02-9ca8-f8fda439d565?source=api-prod","affected":[{"type":"plugin","slug":"porto-functionality","name":"Porto Theme - Functionality","from":"*","from_inclusive":true,"to":"3.1.0","to_inclusive":true,"patched_in":"3.1.1"}],"published":"2024-05-08T00:00:00Z","updated":"2024-05-09T20:03:42Z"},{"id":"wordfence:feaa2809-c804-4a21-8f5e-8149b2d490d4","source":"wordfence","cve":"CVE-2025-23457","title":"Shipdeo <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feaa2809-c804-4a21-8f5e-8149b2d490d4?source=api-prod","affected":[{"type":"plugin","slug":"shipdeo-woo","name":"Shipdeo","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-18T14:40:37Z"},{"id":"wordfence:feab189a-bd89-461d-b553-f137b8032e94","source":"wordfence","cve":"","title":"Easy Social Icons <= 1.2.3.1 - SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feab189a-bd89-461d-b553-f137b8032e94?source=api-prod","affected":[{"type":"plugin","slug":"easy-social-icons","name":"Easy Social Icons","from":"*","from_inclusive":true,"to":"1.2.3.1","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2015-07-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feac237d-3d95-44d2-a3be-2d20e3d74447","source":"wordfence","cve":"CVE-2026-62006","title":"Nuts <= 1.12 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feac237d-3d95-44d2-a3be-2d20e3d74447?source=api-prod","affected":[{"type":"theme","slug":"nuts","name":"Nuts","from":"*","from_inclusive":true,"to":"1.12","to_inclusive":true,"patched_in":""}],"published":"2026-10-12T00:00:00Z","updated":"2026-10-14T19:40:02Z"},{"id":"wordfence:feac5bd3-dfa3-4ad0-b811-7a917970600c","source":"wordfence","cve":"CVE-2025-32182","title":"Spider Elements \u2013 Addons for Elementor <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feac5bd3-dfa3-4ad0-b811-7a917970600c?source=api-prod","affected":[{"type":"plugin","slug":"spider-elements","name":"Spider Elements \u2013 Premium Elementor Widgets & Addons Library","from":"*","from_inclusive":true,"to":"1.6.5","to_inclusive":true,"patched_in":"1.6.6"}],"published":"2025-04-04T00:00:00Z","updated":"2025-11-07T16:39:16Z"},{"id":"wordfence:feb056b0-5ea0-4257-8d58-0e29b3c304bd","source":"wordfence","cve":"CVE-2022-0828","title":"Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key","severity":"high","cvss":7.5,"cwe":"CWE-326","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb056b0-5ea0-4257-8d58-0e29b3c304bd?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.2.39","to_inclusive":false,"patched_in":"3.2.39"}],"published":"2022-03-16T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feb0e1f0-5c0e-4a02-986b-3fbfa1b8ec1b","source":"wordfence","cve":"CVE-2026-25007","title":"ElementInvader Addons for Elementor <= 1.4.2 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb0e1f0-5c0e-4a02-986b-3fbfa1b8ec1b?source=api-prod","affected":[{"type":"plugin","slug":"elementinvader-addons-for-elementor","name":"ElementInvader Addons for Elementor","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2026-03-23T00:00:00Z","updated":"2026-03-26T20:43:57Z"},{"id":"wordfence:feb0f29c-78df-46e6-a6f4-c8548d3e5185","source":"wordfence","cve":"CVE-2024-10797","title":"Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb0f29c-78df-46e6-a6f4-c8548d3e5185?source=api-prod","affected":[{"type":"plugin","slug":"full-screen-menu-for-elementor","name":"Full Screen Menu for Elementor","from":"*","from_inclusive":true,"to":"1.0.7","to_inclusive":true,"patched_in":""}],"published":"2024-12-20T20:18:51Z","updated":"2024-12-21T08:24:00Z"},{"id":"wordfence:feb13137-4708-43da-9a5a-b7af8356942d","source":"wordfence","cve":"CVE-2025-30897","title":"Analytify <= 5.5.1 - Missing Authorization to Authenticated (Subscriber+) Minor Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb13137-4708-43da-9a5a-b7af8356942d?source=api-prod","affected":[{"type":"plugin","slug":"wp-analytify","name":"Analytify \u2013 Google Analytics 4 Tracking and Reporting in WordPress","from":"*","from_inclusive":true,"to":"5.5.1","to_inclusive":true,"patched_in":"6.0.0"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T14:33:25Z"},{"id":"wordfence:feb25e04-8cd2-49d8-a459-4302c1ec332c","source":"wordfence","cve":"CVE-2014-9525","title":"Timed Popup WordPress Plugin <= 1.4 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb25e04-8cd2-49d8-a459-4302c1ec332c?source=api-prod","affected":[{"type":"plugin","slug":"wp-timed-popup","name":"Timed Popup WordPress Plugin","from":"*","from_inclusive":true,"to":"1.4","to_inclusive":true,"patched_in":""}],"published":"2014-12-12T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feb3a274-05f9-4f01-b4dc-f63aa98ff4dd","source":"wordfence","cve":"CVE-2025-46495","title":"Drop Caps <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb3a274-05f9-4f01-b4dc-f63aa98ff4dd?source=api-prod","affected":[{"type":"plugin","slug":"drop-caps","name":"Drop Caps","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T20:55:43Z"},{"id":"wordfence:feb4f3dc-9abf-4ee3-834e-e5516652d810","source":"wordfence","cve":"CVE-2023-25055","title":"Google XML Sitemap for Videos <= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb4f3dc-9abf-4ee3-834e-e5516652d810?source=api-prod","affected":[{"type":"plugin","slug":"xml-sitemaps-for-videos","name":"Google XML Sitemap for Videos","from":"*","from_inclusive":true,"to":"2.6.1","to_inclusive":true,"patched_in":""}],"published":"2023-03-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feb51537-4bf7-4607-abbc-614773c55b46","source":"wordfence","cve":"CVE-2024-51587","title":"Definitive Addons for Elementor <= 1.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb51537-4bf7-4607-abbc-614773c55b46?source=api-prod","affected":[{"type":"plugin","slug":"definitive-addons-for-elementor","name":"Definitive Addons for Elementor","from":"*","from_inclusive":true,"to":"1.5.16","to_inclusive":true,"patched_in":""}],"published":"2024-10-31T00:00:00Z","updated":"2024-11-06T19:36:14Z"},{"id":"wordfence:feb63b10-fe23-4f89-9ef3-0a61b4190320","source":"wordfence","cve":"CVE-2024-6546","title":"One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb63b10-fe23-4f89-9ef3-0a61b4190320?source=api-prod","affected":[{"type":"plugin","slug":"one-click-close-comments","name":"One Click Close Comments","from":"*","from_inclusive":true,"to":"2.7.1","to_inclusive":true,"patched_in":"3.0"}],"published":"2024-07-26T13:12:00Z","updated":"2025-04-23T17:23:03Z"},{"id":"wordfence:feb915f4-66d6-4f46-949c-5354e414319b","source":"wordfence","cve":"CVE-2024-11768","title":"Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Files","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb915f4-66d6-4f46-949c-5354e414319b?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.03","to_inclusive":true,"patched_in":"3.3.04"}],"published":"2024-12-18T16:22:49Z","updated":"2024-12-19T05:24:58Z"},{"id":"wordfence:feb9af10-7df2-4eb1-8546-debaa925df42","source":"wordfence","cve":"CVE-2023-27413","title":"W4 Post List <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w4pl[no_items_text]'","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feb9af10-7df2-4eb1-8546-debaa925df42?source=api-prod","affected":[{"type":"plugin","slug":"w4-post-list","name":"W4 Post List","from":"*","from_inclusive":true,"to":"2.4.4","to_inclusive":true,"patched_in":"2.4.5"}],"published":"2023-03-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:febca991-90a0-46b8-9609-2c8a71b5eb5f","source":"wordfence","cve":"CVE-2026-16779","title":"Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/febca991-90a0-46b8-9609-2c8a71b5eb5f?source=api-prod","affected":[{"type":"plugin","slug":"kubio","name":"Kubio AI Page Builder","from":"*","from_inclusive":true,"to":"2.8.5","to_inclusive":true,"patched_in":"2.8.6"}],"published":"2026-08-15T15:33:07Z","updated":"2026-08-16T04:24:57Z"},{"id":"wordfence:febd1ff3-3a1a-49c2-b210-9e72051e3172","source":"wordfence","cve":"CVE-2024-11912","title":"Traveler <= 3.1.6 - Unauthenticated SQL Injection via order_id","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/febd1ff3-3a1a-49c2-b210-9e72051e3172?source=api-prod","affected":[{"type":"theme","slug":"traveler","name":"Travel Booking WordPress Theme","from":"*","from_inclusive":true,"to":"3.1.6","to_inclusive":true,"patched_in":"3.1.7"}],"published":"2024-12-17T00:00:00Z","updated":"2024-12-18T11:09:32Z"},{"id":"wordfence:febf3cb1-f842-4caf-bfe7-4ea84debaf20","source":"wordfence","cve":"CVE-2026-97183","title":"WP-Invoice <= 4.3.1 - Authenticated (Subscriber+) Information Exposure","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/febf3cb1-f842-4caf-bfe7-4ea84debaf20?source=api-prod","affected":[{"type":"plugin","slug":"wp-invoice","name":"WP-Invoice \u2013 Web Invoice and Billing","from":"*","from_inclusive":true,"to":"4.3.1","to_inclusive":true,"patched_in":""}],"published":"2026-10-09T00:00:00Z","updated":"2026-10-13T14:35:37Z"},{"id":"wordfence:fec015e1-7f64-4917-a242-90bd1135f680","source":"wordfence","cve":"CVE-2024-3600","title":"Poll Maker \u2013 Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec015e1-7f64-4917-a242-90bd1135f680?source=api-prod","affected":[{"type":"plugin","slug":"poll-maker","name":"Poll Maker by AYS \u2013 Versus Polls, Anonymous Polls, Image Polls","from":"*","from_inclusive":true,"to":"5.1.8","to_inclusive":true,"patched_in":"5.1.9"}],"published":"2024-04-18T00:00:00Z","updated":"2024-04-19T02:34:44Z"},{"id":"wordfence:fec06875-f6b4-4e57-917f-e80ece3744e1","source":"wordfence","cve":"CVE-2023-7168","title":"Better Follow Button for Jetpack <= 8.0 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec06875-f6b4-4e57-917f-e80ece3744e1?source=api-prod","affected":[{"type":"plugin","slug":"better-follow-button-for-jetpack","name":"Better Follow Button for Jetpack","from":"*","from_inclusive":true,"to":"8.0","to_inclusive":true,"patched_in":""}],"published":"2024-01-23T00:00:00Z","updated":"2024-01-24T16:49:44Z"},{"id":"wordfence:fec48853-afa5-4310-be2e-e86c01ece227","source":"wordfence","cve":"CVE-2026-75981","title":"TranslatePress \u2013 Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec48853-afa5-4310-be2e-e86c01ece227?source=api-prod","affected":[{"type":"plugin","slug":"translatepress-multilingual","name":"TranslatePress \u2013 Translate Multilingual sites with AI Translation","from":"*","from_inclusive":true,"to":"3.2.5","to_inclusive":true,"patched_in":"3.2.6"}],"published":"2026-08-18T18:23:24Z","updated":"2026-08-19T06:37:55Z"},{"id":"wordfence:fec590e7-c15e-4063-892a-a945333d848e","source":"wordfence","cve":"CVE-2015-6668","title":"Job Manager <= 0.7.25 - Insecure Direct Object Reference","severity":"high","cvss":7.5,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec590e7-c15e-4063-892a-a945333d848e?source=api-prod","affected":[{"type":"plugin","slug":"job-manager","name":"Job Manager","from":"*","from_inclusive":true,"to":"0.7.25","to_inclusive":true,"patched_in":""}],"published":"2015-08-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fec6deaa-c45e-40f5-91e9-87445c94a61a","source":"wordfence","cve":"CVE-2025-12629","title":"Broken Link Manager <= 0.6.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec6deaa-c45e-40f5-91e9-87445c94a61a?source=api-prod","affected":[{"type":"plugin","slug":"broken-link-manager","name":"Broken Link Manager","from":"*","from_inclusive":true,"to":"0.6.5","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T00:00:00Z","updated":"2025-12-01T17:14:53Z"},{"id":"wordfence:fec8681c-683c-47aa-a1c1-95261ee76386","source":"wordfence","cve":"CVE-2026-39760","title":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec8681c-683c-47aa-a1c1-95261ee76386?source=api-prod","affected":[{"type":"plugin","slug":"real3d-flipbook-lite","name":"Real3D Flipbook \u2013 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder","from":"*","from_inclusive":true,"to":"5.5","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T15:05:34Z","updated":"2026-10-08T23:27:27Z"},{"id":"wordfence:fec871c7-6559-4152-81be-08ac28b6e173","source":"wordfence","cve":"CVE-2025-31897","title":"Arrow Custom Feed for Twitter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec871c7-6559-4152-81be-08ac28b6e173?source=api-prod","affected":[{"type":"plugin","slug":"arrow-twitter-feed","name":"Arrow Custom Feed for Twitter","from":"*","from_inclusive":true,"to":"1.5.3","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2025-04-08T18:39:51Z"},{"id":"wordfence:fec9a7a6-c515-4b43-8efc-9b3c86f0fd4b","source":"wordfence","cve":"CVE-2025-9487","title":"Admin and Site Enhancements <= 7.9.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":5.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fec9a7a6-c515-4b43-8efc-9b3c86f0fd4b?source=api-prod","affected":[{"type":"plugin","slug":"admin-site-enhancements","name":"Admin and Site Enhancements (ASE)","from":"*","from_inclusive":true,"to":"7.9.7","to_inclusive":true,"patched_in":"7.9.8"}],"published":"2025-09-01T00:00:00Z","updated":"2025-09-25T19:21:47Z"},{"id":"wordfence:fecac276-20be-4ce6-b819-c1747e059bf4","source":"wordfence","cve":"CVE-2025-23585","title":"Goo.gl Url Shorter <= 1.0.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fecac276-20be-4ce6-b819-c1747e059bf4?source=api-prod","affected":[{"type":"plugin","slug":"googl-url-shorter","name":"Goo.gl Url Shorter","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-03-11T14:14:15Z"},{"id":"wordfence:fecb0a33-7608-4367-b9f6-0514b0bb2802","source":"wordfence","cve":"CVE-2026-103888","title":"WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fecb0a33-7608-4367-b9f6-0514b0bb2802?source=api-prod","affected":[{"type":"plugin","slug":"woo-smart-quick-view","name":"WPC Smart Quick View for WooCommerce","from":"*","from_inclusive":true,"to":"4.4.0","to_inclusive":true,"patched_in":"4.4.1"}],"published":"2026-10-02T17:20:40Z","updated":"2026-10-03T05:29:19Z"},{"id":"wordfence:fecb12c5-8f8d-4f72-a349-c5df315b523e","source":"wordfence","cve":"CVE-2021-36914","title":"CalderaWP License Manager <= 1.2.11 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fecb12c5-8f8d-4f72-a349-c5df315b523e?source=api-prod","affected":[{"type":"plugin","slug":"calderawp-license-manager","name":"CalderaWP License Manager","from":"*","from_inclusive":true,"to":"1.2.11","to_inclusive":true,"patched_in":""}],"published":"2022-04-12T10:56:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fed0e3bc-1401-410a-805d-1ea3e423024b","source":"wordfence","cve":"CVE-2023-52194","title":"oEmbed Gist <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed0e3bc-1401-410a-805d-1ea3e423024b?source=api-prod","affected":[{"type":"plugin","slug":"oembed-gist","name":"oEmbed Gist","from":"*","from_inclusive":true,"to":"4.9.1","to_inclusive":true,"patched_in":""}],"published":"2024-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fed101af-dd1a-486b-bc6b-a10452ec39ab","source":"wordfence","cve":"CVE-2026-57745","title":"RT-Theme 18 Responsive WordPress Theme <= 2.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed101af-dd1a-486b-bc6b-a10452ec39ab?source=api-prod","affected":[{"type":"plugin","slug":"rt18-extensions","name":"RT-Theme 18 Responsive WordPress Theme","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2026-07-06T00:00:00Z","updated":"2026-07-14T19:39:23Z"},{"id":"wordfence:fed4591b-b7e3-4a55-a747-1c17f6c6f643","source":"wordfence","cve":"CVE-2026-15399","title":"Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed4591b-b7e3-4a55-a747-1c17f6c6f643?source=api-prod","affected":[{"type":"plugin","slug":"animated-number-counters","name":"Animated Number Counters","from":"*","from_inclusive":true,"to":"3.0","to_inclusive":true,"patched_in":"3.1"}],"published":"2026-10-12T19:05:41Z","updated":"2026-10-13T07:46:24Z"},{"id":"wordfence:fed4dd54-7a7e-483b-a623-3cf3392572b8","source":"wordfence","cve":"CVE-2023-37874","title":"HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed4dd54-7a7e-483b-a623-3cf3392572b8?source=api-prod","affected":[{"type":"plugin","slug":"http-headers","name":"HTTP Headers","from":"*","from_inclusive":true,"to":"1.18.11","to_inclusive":true,"patched_in":"1.19.0"}],"published":"2023-07-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fed6bb3e-40f1-4d7a-b643-485f908cc816","source":"wordfence","cve":"CVE-2025-12396","title":"Clubmember <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed6bb3e-40f1-4d7a-b643-485f908cc816?source=api-prod","affected":[{"type":"plugin","slug":"clubmember","name":"clubmember","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-11-03T15:51:37Z","updated":"2025-11-04T04:27:24Z"},{"id":"wordfence:fed758e0-7fea-4b6a-9157-47f5603be2c9","source":"wordfence","cve":"CVE-2024-54361","title":"Instant Appointment <= 1.2 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed758e0-7fea-4b6a-9157-47f5603be2c9?source=api-prod","affected":[{"type":"plugin","slug":"instant-appointment","name":"Instant Appointment","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:51:46Z"},{"id":"wordfence:fed7becc-2767-40bc-8b56-4032d1e9f85c","source":"wordfence","cve":"CVE-2025-46483","title":"Peadig\u2019s Google +1 Button <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fed7becc-2767-40bc-8b56-4032d1e9f85c?source=api-prod","affected":[{"type":"plugin","slug":"google-1","name":"Peadig\u2019s Google +1 Button","from":"*","from_inclusive":true,"to":"0.1.2","to_inclusive":true,"patched_in":""}],"published":"2025-04-24T00:00:00Z","updated":"2025-04-30T21:31:52Z"},{"id":"wordfence:fedb49da-ac10-4ead-9ee1-38aa5fc3b5ff","source":"wordfence","cve":"CVE-2025-22342","title":"WP Simple Sitemap <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fedb49da-ac10-4ead-9ee1-38aa5fc3b5ff?source=api-prod","affected":[{"type":"plugin","slug":"wp-simple-sitemap","name":"WP Simple Sitemap","from":"*","from_inclusive":true,"to":"0.2","to_inclusive":true,"patched_in":""}],"published":"2025-01-03T00:00:00Z","updated":"2025-01-08T19:13:02Z"},{"id":"wordfence:fedf20b2-6c21-4c91-8f79-9cac334a1313","source":"wordfence","cve":"CVE-2023-46778","title":"Auto Limit Posts Reloaded <= 2.5 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fedf20b2-6c21-4c91-8f79-9cac334a1313?source=api-prod","affected":[{"type":"plugin","slug":"auto-limit-posts-reloaded","name":"Auto Limit Posts Reloaded","from":"*","from_inclusive":true,"to":"2.5","to_inclusive":true,"patched_in":""}],"published":"2023-10-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fee0495c-eef0-4469-a02e-3a4369a483a0","source":"wordfence","cve":"CVE-2026-110011","title":"MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee0495c-eef0-4469-a02e-3a4369a483a0?source=api-prod","affected":[{"type":"plugin","slug":"mb-custom-post-type","name":"MB Custom Post Types & Custom Taxonomies","from":"2.4.0","from_inclusive":true,"to":"2.12.2","to_inclusive":true,"patched_in":"2.12.3"}],"published":"2026-10-20T00:00:00Z","updated":"2026-10-23T18:14:48Z"},{"id":"wordfence:fee05dce-f484-422a-88cc-9923af1fee43","source":"wordfence","cve":"CVE-2025-52712","title":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor <= 1.27.8 - Authenticated (Contributor+) Path Traversal","severity":"medium","cvss":4.3,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee05dce-f484-422a-88cc-9923af1fee43?source=api-prod","affected":[{"type":"plugin","slug":"post-and-page-builder","name":"Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Editor","from":"*","from_inclusive":true,"to":"1.27.8","to_inclusive":true,"patched_in":"1.27.9"}],"published":"2025-07-22T00:00:00Z","updated":"2025-07-28T21:19:05Z"},{"id":"wordfence:fee18df2-75ea-416a-8aa6-139018016b9a","source":"wordfence","cve":"CVE-2022-1611","title":"Bulk Page Creator <= 1.1.3 - Cross-Site Request Forgery to Arbitrary Page Creation","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee18df2-75ea-416a-8aa6-139018016b9a?source=api-prod","affected":[{"type":"plugin","slug":"bulk-page-creator","name":"Bulk Page Creator","from":"*","from_inclusive":true,"to":"1.1.3","to_inclusive":true,"patched_in":"1.1.4"}],"published":"2022-05-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fee1fef5-5716-49e0-a04e-d0dae527fcfc","source":"wordfence","cve":"CVE-2026-3427","title":"Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee1fef5-5716-49e0-a04e-d0dae527fcfc?source=api-prod","affected":[{"type":"plugin","slug":"wordpress-seo","name":"Yoast SEO \u2013 Advanced SEO with real-time guidance and built-in AI","from":"*","from_inclusive":true,"to":"27.1.1","to_inclusive":true,"patched_in":"27.2"}],"published":"2026-03-21T14:57:12Z","updated":"2026-03-22T03:26:35Z"},{"id":"wordfence:fee307a7-1d30-480b-a55c-ceab20f2be6f","source":"wordfence","cve":"CVE-2026-82212","title":"Nexi XPay Build 7.2.2 - 7.6.2 - Unauthenticated Payment Bypass","severity":"medium","cvss":5.3,"cwe":"CWE-602","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee307a7-1d30-480b-a55c-ceab20f2be6f?source=api-prod","affected":[{"type":"plugin","slug":"nexi-xpay-build","name":"Nexi XPay Build","from":"7.2.2","from_inclusive":true,"to":"7.6.2","to_inclusive":true,"patched_in":""}],"published":"2026-10-05T00:00:00Z","updated":"2026-10-08T23:40:36Z"},{"id":"wordfence:fee47bb5-5af9-426c-8760-193276e046ea","source":"wordfence","cve":"CVE-2024-31435","title":"Inisev Analyst Module <= Various Versions - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fee47bb5-5af9-426c-8760-193276e046ea?source=api-prod","affected":[{"type":"plugin","slug":"http-https-remover","name":"SSL Mixed Content Fix","from":"*","from_inclusive":true,"to":"3.2.6","to_inclusive":true,"patched_in":"3.2.7"},{"type":"plugin","slug":"copy-delete-posts","name":"Duplicate Post","from":"*","from_inclusive":true,"to":"1.4.4","to_inclusive":true,"patched_in":"1.4.5"},{"type":"plugin","slug":"ultimate-social-media-plus","name":"Social Share Icons & Social Share Buttons","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.6.2"},{"type":"plugin","slug":"ultimate-posts-widget","name":"Ultimate Posts Widget","from":"*","from_inclusive":true,"to":"2.2.9","to_inclusive":true,"patched_in":"2.3.0"},{"type":"plugin","slug":"backup-backup","name":"Backup Migration","from":"*","from_inclusive":true,"to":"1.4.1","to_inclusive":true,"patched_in":"1.4.2"},{"type":"plugin","slug":"pop-up-pop-up","name":"Pop-up","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"},{"type":"plugin","slug":"redirect-redirection","name":"Redirection","from":"*","from_inclusive":true,"to":"1.1.9","to_inclusive":true,"patched_in":"1.2.0"},{"type":"plugin","slug":"wp-clone-by-wp-academy","name":"Clone","from":"*","from_inclusive":true,"to":"2.4.3","to_inclusive":true,"patched_in":"2.4.4"},{"type":"plugin","slug":"feedburner-alternative-and-rss-redirect","name":"RSS Redirect & Feedburner Alternative","from":"*","from_inclusive":true,"to":"3.9","to_inclusive":true,"patched_in":"4.0"},{"type":"plugin","slug":"add-social-share","name":"Social Media Social Share Icon","from":"*","from_inclusive":true,"to":"2.8.6","to_inclusive":true,"patched_in":"2.8.7"},{"type":"plugin","slug":"enhanced-text-widget","name":"Enhanced Text Widget","from":"*","from_inclusive":true,"to":"1.6.4","to_inclusive":true,"patched_in":"1.6.5"}],"published":"2024-04-10T00:00:00Z","updated":"2024-04-30T00:53:05Z"},{"id":"wordfence:feeac2aa-e968-4bae-a7ca-40c0128ad0bb","source":"wordfence","cve":"CVE-2026-22370","title":"Marveland <= 1.3.0 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feeac2aa-e968-4bae-a7ca-40c0128ad0bb?source=api-prod","affected":[{"type":"theme","slug":"marveland","name":"Marveland - Theme Park & Festival WordPress Theme","from":"*","from_inclusive":true,"to":"1.3.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-17T00:00:00Z","updated":"2026-02-24T17:30:28Z"},{"id":"wordfence:feeb70e4-b602-40ce-bdeb-d947c6b6784d","source":"wordfence","cve":"CVE-2023-23976","title":"RegistrationMagic <= 5.1.9.2 - Improper Authorization to Price Change","severity":"medium","cvss":5.3,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feeb70e4-b602-40ce-bdeb-d947c6b6784d?source=api-prod","affected":[{"type":"plugin","slug":"custom-registration-form-builder-with-submission-manager","name":"RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login","from":"*","from_inclusive":true,"to":"5.1.9.2","to_inclusive":true,"patched_in":"5.1.9.3"}],"published":"2023-01-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feecd1f9-a933-43f5-971b-459bb27340d4","source":"wordfence","cve":"CVE-2022-0134","title":"AnyComment <= 0.2.17 - Cross-Site Request Forgery","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feecd1f9-a933-43f5-971b-459bb27340d4?source=api-prod","affected":[{"type":"plugin","slug":"anycomment","name":"AnyComment","from":"*","from_inclusive":true,"to":"0.2.18","to_inclusive":false,"patched_in":"0.2.18"}],"published":"2022-01-19T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:feee3268-b384-400c-a76d-e5d7972c05b7","source":"wordfence","cve":"CVE-2023-7072","title":"Post Grid Combo \u2013 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint","severity":"high","cvss":7.5,"cwe":"CWE-202","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feee3268-b384-400c-a76d-e5d7972c05b7?source=api-prod","affected":[{"type":"plugin","slug":"post-grid","name":"Post Grid","from":"*","from_inclusive":true,"to":"2.2.68","to_inclusive":true,"patched_in":"2.2.69"}],"published":"2024-03-12T00:00:00Z","updated":"2024-07-29T21:37:53Z"},{"id":"wordfence:feef7934-c10d-48a7-a5dc-33e603e1d402","source":"wordfence","cve":"CVE-2025-48343","title":"WPMU Ldap Authentication <= 5.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/feef7934-c10d-48a7-a5dc-33e603e1d402?source=api-prod","affected":[{"type":"plugin","slug":"wpmuldap","name":"WPMU Ldap Authentication","from":"*","from_inclusive":true,"to":"5.0.1","to_inclusive":true,"patched_in":"5.1"}],"published":"2025-08-21T00:00:00Z","updated":"2026-01-06T19:30:38Z"},{"id":"wordfence:fef2f3fd-d6a3-4cb5-af5f-3fad8a67ca9c","source":"wordfence","cve":"CVE-2022-47153","title":"Jobeleon Theme <= 1.9.1 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fef2f3fd-d6a3-4cb5-af5f-3fad8a67ca9c?source=api-prod","affected":[{"type":"theme","slug":"jobeleon-wpjobboard","name":"Jobeleon WPJobBoard","from":"*","from_inclusive":true,"to":"1.9.1","to_inclusive":true,"patched_in":"1.9.2"}],"published":"2024-03-28T00:00:00Z","updated":"2024-04-03T20:42:43Z"},{"id":"wordfence:fef475f8-7610-4412-b061-0be069ad7fad","source":"wordfence","cve":"CVE-2026-14925","title":"Import WP \u2013 Export and Import CSV and XML files to WordPress < 2.14.23 - Unauthenticated Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fef475f8-7610-4412-b061-0be069ad7fad?source=api-prod","affected":[{"type":"plugin","slug":"jc-importer","name":"Import WP \u2013 CSV & XML Import Export for WordPress","from":"*","from_inclusive":true,"to":"2.14.23","to_inclusive":false,"patched_in":"2.14.23"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-17T15:46:52Z"},{"id":"wordfence:fef6c603-2beb-44df-8895-10ad0a9ef644","source":"wordfence","cve":"CVE-2017-14844","title":"WPGYM - Wordpress Gym Management System (Unknown Version) - SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fef6c603-2beb-44df-8895-10ad0a9ef644?source=api-prod","affected":[{"type":"plugin","slug":"gym-management","name":"WPGYM - Wordpress Gym Management System","from":"*","from_inclusive":true,"to":"*","to_inclusive":true,"patched_in":""}],"published":"2017-09-26T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fefa7b93-987d-4c1f-8a49-be22466852b5","source":"wordfence","cve":"CVE-2025-9698","title":"The Plus Addons for Elementor <= 6.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fefa7b93-987d-4c1f-8a49-be22466852b5?source=api-prod","affected":[{"type":"plugin","slug":"the-plus-addons-for-elementor-page-builder","name":"The Plus Addons for Elementor \u2013 Mega Menu, Header Footer, Post Grid, AI Widgets & Templates","from":"*","from_inclusive":true,"to":"6.3.15","to_inclusive":true,"patched_in":"6.3.16"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-16T15:25:09Z"},{"id":"wordfence:fefab999-12e0-4866-a5a2-60f8faa64f89","source":"wordfence","cve":"CVE-2023-33929","title":"Easy Admin Menu <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fefab999-12e0-4866-a5a2-60f8faa64f89?source=api-prod","affected":[{"type":"plugin","slug":"easy-admin-menu","name":"Easy Admin Menu","from":"*","from_inclusive":true,"to":"1.3","to_inclusive":true,"patched_in":""}],"published":"2023-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fefd0e4d-3286-4d05-a715-d76524f1bc2b","source":"wordfence","cve":"CVE-2025-47503","title":"NGG Smart Image Search <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fefd0e4d-3286-4d05-a715-d76524f1bc2b?source=api-prod","affected":[{"type":"plugin","slug":"ngg-smart-image-search","name":"NGG Smart Image Search","from":"*","from_inclusive":true,"to":"3.3.3","to_inclusive":true,"patched_in":"3.4.1"}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:19:40Z"},{"id":"wordfence:fefe4499-8b03-4c07-b248-ae0ae5153b4f","source":"wordfence","cve":"CVE-2024-24875","title":"Link Library <= 7.5.13 - Cross-Site Request Forgery via action_admin_init","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fefe4499-8b03-4c07-b248-ae0ae5153b4f?source=api-prod","affected":[{"type":"plugin","slug":"link-library","name":"Link Library","from":"*","from_inclusive":true,"to":"7.5.13","to_inclusive":true,"patched_in":"7.6"}],"published":"2024-02-05T00:00:00Z","updated":"2024-04-17T13:05:04Z"},{"id":"wordfence:fefebdbd-e917-40f0-8631-966017b3ee4a","source":"wordfence","cve":"CVE-2026-16955","title":"AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read","severity":"medium","cvss":6.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fefebdbd-e917-40f0-8631-966017b3ee4a?source=api-prod","affected":[{"type":"plugin","slug":"ai-engine","name":"AI Engine \u2013 MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini","from":"*","from_inclusive":true,"to":"3.6.5","to_inclusive":true,"patched_in":"3.6.6"}],"published":"2026-08-03T00:00:00Z","updated":"2026-08-21T15:44:11Z"},{"id":"wordfence:ff043947-706b-4107-bd9f-63ce2d6ee665","source":"wordfence","cve":"CVE-2026-22442","title":"Tribe <= 1.7.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff043947-706b-4107-bd9f-63ce2d6ee665?source=api-prod","affected":[{"type":"theme","slug":"tribe","name":"tribe","from":"*","from_inclusive":true,"to":"1.7.3","to_inclusive":true,"patched_in":""}],"published":"2026-02-25T00:00:00Z","updated":"2026-03-05T14:35:55Z"},{"id":"wordfence:ff0511a9-88cf-4900-8c7e-7716cf565853","source":"wordfence","cve":"CVE-2026-32481","title":"Ezoic <= 2.22.11 - Authentication Bypass","severity":"critical","cvss":9.8,"cwe":"CWE-288","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0511a9-88cf-4900-8c7e-7716cf565853?source=api-prod","affected":[{"type":"plugin","slug":"ezoic-integration","name":"Ezoic","from":"*","from_inclusive":true,"to":"2.22.11","to_inclusive":true,"patched_in":"2.23.1"}],"published":"2026-08-14T00:00:00Z","updated":"2026-08-20T13:52:53Z"},{"id":"wordfence:ff0568e2-3a1e-4ed6-835a-37e3d07d7b63","source":"wordfence","cve":"CVE-2024-12038","title":"Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0568e2-3a1e-4ed6-835a-37e3d07d7b63?source=api-prod","affected":[{"type":"plugin","slug":"buddyforms","name":"BuddyForms","from":"*","from_inclusive":true,"to":"2.8.15","to_inclusive":true,"patched_in":"2.8.16"}],"published":"2025-02-21T00:00:00Z","updated":"2025-02-22T04:21:18Z"},{"id":"wordfence:ff065219-7f4f-4445-8dbe-11f4975f7bb9","source":"wordfence","cve":"CVE-2025-11825","title":"Playerzbr <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Meta Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff065219-7f4f-4445-8dbe-11f4975f7bb9?source=api-prod","affected":[{"type":"plugin","slug":"playerzbr","name":"Playerzbr","from":"*","from_inclusive":true,"to":"1.6","to_inclusive":true,"patched_in":""}],"published":"2025-10-21T20:18:00Z","updated":"2025-10-22T08:27:12Z"},{"id":"wordfence:ff06c6f3-1dd7-4b4e-bd13-4e41f2198bf2","source":"wordfence","cve":"CVE-2026-27382","title":"Metro <= 2.13 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff06c6f3-1dd7-4b4e-bd13-4e41f2198bf2?source=api-prod","affected":[{"type":"theme","slug":"metro","name":"metro","from":"*","from_inclusive":true,"to":"2.13","to_inclusive":true,"patched_in":""}],"published":"2026-02-24T00:00:00Z","updated":"2026-03-05T14:46:30Z"},{"id":"wordfence:ff08a391-971b-4c78-80e0-1d72a3ae5f1c","source":"wordfence","cve":"CVE-2025-22556","title":"Norse Rune Oracle Plugin <= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff08a391-971b-4c78-80e0-1d72a3ae5f1c?source=api-prod","affected":[{"type":"plugin","slug":"norse-runes-oracle","name":"Norse Rune Oracle Plugin","from":"*","from_inclusive":true,"to":"1.4.2","to_inclusive":true,"patched_in":"1.4.3"}],"published":"2025-01-07T00:00:00Z","updated":"2025-01-14T19:22:19Z"},{"id":"wordfence:ff09292b-c8a6-4cd8-a8dd-d79b4c713d6f","source":"wordfence","cve":"CVE-2024-50511","title":"WP donimedia carousel <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload","severity":"high","cvss":8.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff09292b-c8a6-4cd8-a8dd-d79b4c713d6f?source=api-prod","affected":[{"type":"plugin","slug":"wp-donimedia-carousel","name":"WP donimedia carousel","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2024-10-28T00:00:00Z","updated":"2024-12-12T17:43:08Z"},{"id":"wordfence:ff0950ae-46d3-4070-b7d3-ec075df634bc","source":"wordfence","cve":"CVE-2025-69320","title":"Grand Magazine <= 3.5.7 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0950ae-46d3-4070-b7d3-ec075df634bc?source=api-prod","affected":[{"type":"theme","slug":"grandmagazine","name":"Grand Magazine | Blog WordPress","from":"*","from_inclusive":true,"to":"3.5.7","to_inclusive":true,"patched_in":"3.5.8"}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T13:54:32Z"},{"id":"wordfence:ff0d4000-020b-4e22-9362-a8f0f5df321e","source":"wordfence","cve":"CVE-2026-3895","title":"WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0d4000-020b-4e22-9362-a8f0f5df321e?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-visual-composer","name":"WPBakery Page Builder Addons by Livemesh","from":"*","from_inclusive":true,"to":"3.9.4","to_inclusive":true,"patched_in":""}],"published":"2026-05-26T17:33:39Z","updated":"2026-05-27T06:46:19Z"},{"id":"wordfence:ff0e8c96-8401-4d01-8185-03967e2aee54","source":"wordfence","cve":"CVE-2026-39636","title":"Livemesh Addons for Elementor <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff0e8c96-8401-4d01-8185-03967e2aee54?source=api-prod","affected":[{"type":"plugin","slug":"addons-for-elementor","name":"Livemesh Addons by Elementor","from":"*","from_inclusive":true,"to":"9.0","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T00:00:00Z","updated":"2026-04-15T21:21:16Z"},{"id":"wordfence:ff129569-223d-4d38-9f3a-eb2596214d3a","source":"wordfence","cve":"CVE-2023-0492","title":"GS Products Slider for WooCommerce <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff129569-223d-4d38-9f3a-eb2596214d3a?source=api-prod","affected":[{"type":"plugin","slug":"gs-woocommerce-products-slider","name":"GS Product Slider for WooCommerce \u2013 Product Carousel, Product Grid & Product Showcase","from":"*","from_inclusive":true,"to":"1.5.8","to_inclusive":true,"patched_in":"1.5.9"}],"published":"2023-01-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff13b72f-7175-42c1-a24a-2570dd57bb3e","source":"wordfence","cve":"CVE-2025-47679","title":"RS WP Book Showcase <= 6.7.40 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff13b72f-7175-42c1-a24a-2570dd57bb3e?source=api-prod","affected":[{"type":"plugin","slug":"rs-wp-books-showcase","name":"RS WP Book Showcase \u2013 A Complete Book Catalogue & Library System","from":"*","from_inclusive":true,"to":"6.7.40","to_inclusive":true,"patched_in":""}],"published":"2025-05-07T00:00:00Z","updated":"2025-05-13T14:24:50Z"},{"id":"wordfence:ff150706-5fbf-4881-976b-89fdaf637fb1","source":"wordfence","cve":"CVE-2024-29802","title":"Football pool <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff150706-5fbf-4881-976b-89fdaf637fb1?source=api-prod","affected":[{"type":"plugin","slug":"football-pool","name":"Football Pool","from":"*","from_inclusive":true,"to":"2.11.3","to_inclusive":true,"patched_in":"2.11.4"}],"published":"2024-01-08T00:00:00Z","updated":"2024-04-01T12:37:44Z"},{"id":"wordfence:ff153e64-638d-4883-aa25-e0c20977cca0","source":"wordfence","cve":"CVE-2025-30529","title":"Auto Load Next Post <= 1.5.14 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff153e64-638d-4883-aa25-e0c20977cca0?source=api-prod","affected":[{"type":"plugin","slug":"auto-load-next-post","name":"WordPress Infinite Scroll by Auto Load Next Post","from":"*","from_inclusive":true,"to":"1.5.14","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T15:28:29Z"},{"id":"wordfence:ff197a1c-3d5b-497f-b35c-40249a426e49","source":"wordfence","cve":"CVE-2024-51917","title":"Multiple Votes in one page <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff197a1c-3d5b-497f-b35c-40249a426e49?source=api-prod","affected":[{"type":"plugin","slug":"multiple-votes-in-one-page","name":"Multiple Votes in one page","from":"*","from_inclusive":true,"to":"1.0.4","to_inclusive":true,"patched_in":""}],"published":"2024-11-08T00:00:00Z","updated":"2024-11-14T13:45:25Z"},{"id":"wordfence:ff1b8d09-974a-4735-8b63-15084412090d","source":"wordfence","cve":"CVE-2026-11354","title":"Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1b8d09-974a-4735-8b63-15084412090d?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.8.3","to_inclusive":true,"patched_in":"2.7.8.4"}],"published":"2026-07-23T14:30:26Z","updated":"2026-07-24T02:32:01Z"},{"id":"wordfence:ff1c1aea-2374-4fb8-98d2-7d0cf72eff59","source":"wordfence","cve":"CVE-2025-32531","title":"Arconix FAQ <= 1.9.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1c1aea-2374-4fb8-98d2-7d0cf72eff59?source=api-prod","affected":[{"type":"plugin","slug":"arconix-faq","name":"Arconix FAQ","from":"*","from_inclusive":true,"to":"1.9.5","to_inclusive":true,"patched_in":"1.9.6"}],"published":"2025-04-10T00:00:00Z","updated":"2025-05-21T13:54:12Z"},{"id":"wordfence:ff1d2bd8-cc46-4763-8ba7-832b982ff56a","source":"wordfence","cve":"CVE-2026-16145","title":"Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1d2bd8-cc46-4763-8ba7-832b982ff56a?source=api-prod","affected":[{"type":"plugin","slug":"gdpr-compliant-recaptcha-for-all-forms","name":"Invisible Anti-Spam & CAPTCHA \u2014 reCAPTCHA Alternative for All Forms","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.1.1"}],"published":"2026-08-14T15:08:15Z","updated":"2026-08-15T03:26:00Z"},{"id":"wordfence:ff1e4da0-916c-4d0e-a68b-16b6851b99a0","source":"wordfence","cve":"CVE-2025-31872","title":"WP Clone any post type <= 3.6 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1e4da0-916c-4d0e-a68b-16b6851b99a0?source=api-prod","affected":[{"type":"plugin","slug":"wp-clone-any-post-type","name":"WP Clone any post type","from":"*","from_inclusive":true,"to":"3.6","to_inclusive":true,"patched_in":""}],"published":"2025-04-01T00:00:00Z","updated":"2026-01-21T20:29:14Z"},{"id":"wordfence:ff1f303f-17fc-4006-b21b-5846216995da","source":"wordfence","cve":"CVE-2024-9659","title":"School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f303f-17fc-4006-b21b-5846216995da?source=api-prod","affected":[{"type":"plugin","slug":"school-management","name":"School Management System for Wordpress","from":"*","from_inclusive":true,"to":"91.5.0","to_inclusive":true,"patched_in":"92.0.0"}],"published":"2024-11-22T00:00:00Z","updated":"2024-11-23T07:38:09Z"},{"id":"wordfence:ff1f81e8-64ed-4330-9c76-1a8d2e2d307d","source":"wordfence","cve":"CVE-2025-10651","title":"Welcart e-Commerce <= 2.11.22 - Authenticated (Editor+) Stored Cross-Site Scripting via order_mail","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f81e8-64ed-4330-9c76-1a8d2e2d307d?source=api-prod","affected":[{"type":"plugin","slug":"usc-e-shop","name":"Welcart e-Commerce","from":"*","from_inclusive":true,"to":"2.11.22","to_inclusive":true,"patched_in":"2.11.23"}],"published":"2025-10-21T17:22:23Z","updated":"2025-10-22T05:27:58Z"},{"id":"wordfence:ff2097a9-fe7a-48f3-be9c-dc0caef74262","source":"wordfence","cve":"CVE-2024-24799","title":"WooCommerce Box Office <= 1.2.2 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2097a9-fe7a-48f3-be9c-dc0caef74262?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-box-office","name":"WooCommerce Box Office","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2024-01-31T00:00:00Z","updated":"2024-02-05T18:19:26Z"},{"id":"wordfence:ff210859-a65f-494f-a2bd-36b7ff92dec0","source":"wordfence","cve":"CVE-2024-5284","title":"WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff210859-a65f-494f-a2bd-36b7ff92dec0?source=api-prod","affected":[{"type":"plugin","slug":"wp-affiliate-platform","name":"WP Affiliate Platform","from":"*","from_inclusive":true,"to":"6.5.1","to_inclusive":false,"patched_in":"6.5.1"}],"published":"2024-06-22T00:00:00Z","updated":"2024-07-18T13:34:11Z"},{"id":"wordfence:ff21241d-e488-4460-b8c2-d5a070c8c107","source":"wordfence","cve":"CVE-2022-1119","title":"Simple File List <= 3.2.7 - Arbitrary File Download","severity":"high","cvss":7.5,"cwe":"CWE-22","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21241d-e488-4460-b8c2-d5a070c8c107?source=api-prod","affected":[{"type":"plugin","slug":"simple-file-list","name":"Simple File List","from":"*","from_inclusive":true,"to":"3.2.7","to_inclusive":true,"patched_in":"3.2.8"}],"published":"2019-05-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff21d74d-2f17-4a08-a151-75b162656a1b","source":"wordfence","cve":"CVE-2026-94297","title":"Media Library Organizer 2.0.4 - 2.1.3 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21d74d-2f17-4a08-a151-75b162656a1b?source=api-prod","affected":[{"type":"plugin","slug":"media-library-organizer","name":"Media Library Organizer \u2013 Folders, File Manager & Media Categories","from":"2.0.4","from_inclusive":true,"to":"2.1.3","to_inclusive":true,"patched_in":"2.1.4"}],"published":"2026-09-28T00:00:00Z","updated":"2026-10-09T00:06:50Z"},{"id":"wordfence:ff21e539-8ba0-4edd-a90c-27a4cd1cdbc7","source":"wordfence","cve":"CVE-2022-0770","title":"Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress \u2013 Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21e539-8ba0-4edd-a90c-27a4cd1cdbc7?source=api-prod","affected":[{"type":"plugin","slug":"gtranslate","name":"Translate WordPress with GTranslate","from":"*","from_inclusive":true,"to":"2.9.9","to_inclusive":false,"patched_in":"2.9.9"},{"type":"plugin","slug":"google-language-translator","name":"Translate WordPress \u2013 Google Language Translator","from":"*","from_inclusive":true,"to":"6.0.13","to_inclusive":true,"patched_in":"6.0.14"}],"published":"2022-03-07T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff2235b0-2960-4896-8665-ba34defb47e9","source":"wordfence","cve":"CVE-2024-54403","title":"Visual Recent Posts <= 1.2.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2235b0-2960-4896-8665-ba34defb47e9?source=api-prod","affected":[{"type":"plugin","slug":"visual-recent-posts","name":"Visual Recent Posts","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":""}],"published":"2024-12-12T00:00:00Z","updated":"2024-12-19T14:39:22Z"},{"id":"wordfence:ff22c969-e580-4290-ab08-7c02b6eac938","source":"wordfence","cve":"","title":"Calendar < 1.3.8 - Reflected Cross-Site Scripting","severity":"high","cvss":7.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff22c969-e580-4290-ab08-7c02b6eac938?source=api-prod","affected":[{"type":"plugin","slug":"calendar","name":"Calendar","from":"*","from_inclusive":true,"to":"1.3.8","to_inclusive":false,"patched_in":"1.3.8"}],"published":"2016-11-08T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff2673c5-82f6-4022-a58e-f9728f577223","source":"wordfence","cve":"CVE-2025-26944","title":"JetPopup <= 2.0.11 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2673c5-82f6-4022-a58e-f9728f577223?source=api-prod","affected":[{"type":"plugin","slug":"jet-popup","name":"JetPopup","from":"*","from_inclusive":true,"to":"2.0.11","to_inclusive":true,"patched_in":"2.0.12"}],"published":"2025-04-15T00:00:00Z","updated":"2025-04-21T19:12:39Z"},{"id":"wordfence:ff2855cb-e4a8-4412-af24-4cee03ae2d43","source":"wordfence","cve":"CVE-2023-4067","title":"Bus Ticket Booking with Seat Reservation <= 5.2.3  - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2855cb-e4a8-4412-af24-4cee03ae2d43?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.2.3","to_inclusive":true,"patched_in":"5.2.4"}],"published":"2023-08-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff28f33f-85d1-4987-975b-ee3bbcb394f4","source":"wordfence","cve":"CVE-2021-4427","title":"Vuukle Comments, Reactions, Share Bar, Revenue <= 3.4.31 - Cross-Site Request Forgery Bypass","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff28f33f-85d1-4987-975b-ee3bbcb394f4?source=api-prod","affected":[{"type":"plugin","slug":"free-comments-for-wordpress-vuukle","name":"Vuukle \u2013 Comments, Reactions, Quizzes, Share Bar & Ad Revenue","from":"*","from_inclusive":true,"to":"3.4.31","to_inclusive":true,"patched_in":"4.0"}],"published":"2021-07-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6","source":"wordfence","cve":"CVE-2023-6830","title":"Formidable Forms <= 6.7 - HTML Injection","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff294b0f-97fe-4d27-bf93-f5bbb57ac1f6?source=api-prod","affected":[{"type":"plugin","slug":"formidable","name":"Formidable Forms \u2013 Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder","from":"*","from_inclusive":true,"to":"6.7","to_inclusive":true,"patched_in":"6.7.1"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:37:53Z"},{"id":"wordfence:ff29e160-993b-422c-b49b-a216db5a0765","source":"wordfence","cve":"CVE-2023-30750","title":"CM Pop-Up banners <= 1.5.10 - Authenticated (Subscriber+) SQL Injection via getStatistics","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff29e160-993b-422c-b49b-a216db5a0765?source=api-prod","affected":[{"type":"plugin","slug":"cm-pop-up-banners","name":"CM Pop-Up \u2013 Create engaging popups to capture attention and boost interaction","from":"*","from_inclusive":true,"to":"1.5.10","to_inclusive":true,"patched_in":"1.6.0"}],"published":"2023-05-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff2a14b1-8752-4edf-a807-88aab453451d","source":"wordfence","cve":"CVE-2023-0063","title":"WordPress Shortcodes <= 1.6.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2a14b1-8752-4edf-a807-88aab453451d?source=api-prod","affected":[{"type":"plugin","slug":"synved-shortcodes","name":"WordPress Shortcodes","from":"*","from_inclusive":true,"to":"1.6.36","to_inclusive":true,"patched_in":""}],"published":"2023-02-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff2a24ad-6a58-4b01-91e6-de6ba7856fcf","source":"wordfence","cve":"CVE-2024-50466","title":"DarkMySite \u2013 Advanced Dark Mode Plugin for WordPress <= 1.2.8 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2a24ad-6a58-4b01-91e6-de6ba7856fcf?source=api-prod","affected":[{"type":"plugin","slug":"darkmysite","name":"DarkMySite \u2013 Advanced Dark Mode Plugin for WordPress","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":"1.2.9"}],"published":"2024-10-24T00:00:00Z","updated":"2025-10-14T19:04:13Z"},{"id":"wordfence:ff2f1261-3c61-4a0f-a7db-8e9b28b9af27","source":"wordfence","cve":"CVE-2026-65523","title":"Formidable Forms Signature Online Contract Automation <= 2.0.1 - Unauthenticated Insecure Direct Object Reference","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff2f1261-3c61-4a0f-a7db-8e9b28b9af27?source=api-prod","affected":[{"type":"plugin","slug":"forms-signature-formidable-online-contract-automation","name":"Formidable Forms Signature Online Contract Automation","from":"*","from_inclusive":true,"to":"2.0.1","to_inclusive":true,"patched_in":"2.0.2"}],"published":"2026-07-28T00:00:00Z","updated":"2026-08-04T19:31:26Z"},{"id":"wordfence:ff319625-bc2c-454a-8194-f9fe11baad2f","source":"wordfence","cve":"CVE-2024-30230","title":"PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff319625-bc2c-454a-8194-f9fe11baad2f?source=api-prod","affected":[{"type":"plugin","slug":"pdf-invoices-and-packing-slips-for-woocommerce","name":"PDF Invoices and Packing Slips For WooCommerce","from":"*","from_inclusive":true,"to":"1.3.7","to_inclusive":true,"patched_in":"1.3.8"}],"published":"2024-03-26T00:00:00Z","updated":"2026-05-07T13:43:23Z"},{"id":"wordfence:ff32bc6a-0d1e-47d0-8264-946e72266b72","source":"wordfence","cve":"CVE-2025-48234","title":"Ultimate Blocks <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff32bc6a-0d1e-47d0-8264-946e72266b72?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-blocks","name":"Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor","from":"*","from_inclusive":true,"to":"3.3.0","to_inclusive":true,"patched_in":"3.3.1"}],"published":"2025-05-19T00:00:00Z","updated":"2025-05-29T14:51:21Z"},{"id":"wordfence:ff32cb12-f010-45ae-97d7-f36ce2003f3c","source":"wordfence","cve":"","title":"UserPro <= 4.9.20 - Privilege Escalation","severity":"critical","cvss":10.0,"cwe":"CWE-286","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff32cb12-f010-45ae-97d7-f36ce2003f3c?source=api-prod","affected":[{"type":"plugin","slug":"userpro","name":"UserPro - Community and User Profile WordPress Plugin","from":"*","from_inclusive":true,"to":"4.9.21","to_inclusive":false,"patched_in":"4.9.21"}],"published":"2019-01-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff346465-62c2-4a2b-8a4a-c88558d7cabd","source":"wordfence","cve":"CVE-2024-13408","title":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff346465-62c2-4a2b-8a4a-c88558d7cabd?source=api-prod","affected":[{"type":"plugin","slug":"post-grid-carousel-ultimate","name":"Post Grid, Slider & Carousel Ultimate \u2013 with Shortcode, Gutenberg Block & Elementor Widget","from":"*","from_inclusive":true,"to":"1.6.10","to_inclusive":true,"patched_in":"1.7"}],"published":"2025-01-23T00:00:00Z","updated":"2025-01-24T11:07:52Z"},{"id":"wordfence:ff35d524-d97d-4fba-9f60-f40bb8aa2aa8","source":"wordfence","cve":"CVE-2025-30840","title":"xili-dictionary <= 2.12.5 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff35d524-d97d-4fba-9f60-f40bb8aa2aa8?source=api-prod","affected":[{"type":"plugin","slug":"xili-dictionary","name":"xili-dictionary","from":"*","from_inclusive":true,"to":"2.12.5","to_inclusive":true,"patched_in":"2.12.5.1"}],"published":"2025-03-27T00:00:00Z","updated":"2025-04-03T13:32:47Z"},{"id":"wordfence:ff3a69a3-dc74-4e44-b791-d02b0f5ebedf","source":"wordfence","cve":"CVE-2025-25136","title":"Optimate Ads <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff3a69a3-dc74-4e44-b791-d02b0f5ebedf?source=api-prod","affected":[{"type":"plugin","slug":"optimate-ads","name":"Optimate Ads \u2013 Advance Ad Inserter AdSense & Ad Manager","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":""}],"published":"2025-02-03T00:00:00Z","updated":"2025-02-12T18:25:10Z"},{"id":"wordfence:ff3aa112-bee2-485f-b5a1-ad156662ab03","source":"wordfence","cve":"CVE-2021-24754","title":"MainWP Child Reports <= 2.0.7 - Admin+ SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff3aa112-bee2-485f-b5a1-ad156662ab03?source=api-prod","affected":[{"type":"plugin","slug":"mainwp-child-reports","name":"MainWP Child Reports","from":"*","from_inclusive":true,"to":"2.0.7","to_inclusive":true,"patched_in":"2.0.8"}],"published":"2021-09-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff41796a-0ba8-468f-8b79-274064da154e","source":"wordfence","cve":"CVE-2025-5844","title":"Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff41796a-0ba8-468f-8b79-274064da154e?source=api-prod","affected":[{"type":"plugin","slug":"radius-blocks","name":"Radius Blocks \u2013 WordPress Gutenberg Blocks","from":"*","from_inclusive":true,"to":"2.2.1","to_inclusive":true,"patched_in":""}],"published":"2025-08-14T20:13:25Z","updated":"2025-08-15T08:25:42Z"},{"id":"wordfence:ff4243e9-cf72-40d5-bc7d-204426024a1d","source":"wordfence","cve":"CVE-2025-15018","title":"Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover","severity":"critical","cvss":9.8,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=api-prod","affected":[{"type":"plugin","slug":"optional-email","name":"Optional Email","from":"*","from_inclusive":true,"to":"1.3.11","to_inclusive":true,"patched_in":""}],"published":"2026-01-06T19:57:29Z","updated":"2026-01-07T08:21:58Z"},{"id":"wordfence:ff449224-d405-453f-8c45-5c6f79bc76d6","source":"wordfence","cve":"CVE-2024-44008","title":"Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff449224-d405-453f-8c45-5c6f79bc76d6?source=api-prod","affected":[{"type":"plugin","slug":"geo-mashup","name":"Geo Mashup","from":"*","from_inclusive":true,"to":"1.13.12","to_inclusive":true,"patched_in":"1.13.13"}],"published":"2024-09-16T00:00:00Z","updated":"2024-10-04T16:46:45Z"},{"id":"wordfence:ff4895bb-b353-423c-a135-bf504ad77e53","source":"wordfence","cve":"CVE-2025-22297","title":"AI WP Writer <= 3.8.4.4 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4895bb-b353-423c-a135-bf504ad77e53?source=api-prod","affected":[{"type":"plugin","slug":"ai-wp-writer","name":"AI WP Writer \u2013 SEO content generator, chatGPT, Gemini, Claude","from":"*","from_inclusive":true,"to":"3.8.4.4","to_inclusive":true,"patched_in":"3.8.4.5"}],"published":"2025-01-06T00:00:00Z","updated":"2025-01-15T14:20:46Z"},{"id":"wordfence:ff48db43-9cfa-4dab-b25e-bbc211121f6c","source":"wordfence","cve":"CVE-2026-75983","title":"Eventin \u2013 Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter","severity":"high","cvss":7.5,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff48db43-9cfa-4dab-b25e-bbc211121f6c?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-solution","name":"Eventin \u2013 Events Calendar, Tickets, Registration, Booking & WooCommerce","from":"*","from_inclusive":true,"to":"4.1.23","to_inclusive":true,"patched_in":"4.1.24"}],"published":"2026-09-14T17:13:14Z","updated":"2026-09-15T06:07:32Z"},{"id":"wordfence:ff4ae5c8-d164-4c2f-9bf3-83934c22cf4c","source":"wordfence","cve":"CVE-2023-6582","title":"ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure","severity":"medium","cvss":5.3,"cwe":"CWE-284","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4ae5c8-d164-4c2f-9bf3-83934c22cf4c?source=api-prod","affected":[{"type":"plugin","slug":"elementskit-lite","name":"ElementsKit Elementor Addons \u2013 Advanced Widgets & Templates Addons for Elementor","from":"*","from_inclusive":true,"to":"3.0.3","to_inclusive":true,"patched_in":"3.0.4"}],"published":"2024-01-08T00:00:00Z","updated":"2024-07-29T21:37:53Z"},{"id":"wordfence:ff4b47d8-28c1-4706-91d9-0285f419147e","source":"wordfence","cve":"","title":"WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4b47d8-28c1-4706-91d9-0285f419147e?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.6.1","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.39","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.37","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.36","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.33","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.29","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.28","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.27","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.6","from_inclusive":true,"to":"4.6.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.7","from_inclusive":true,"to":"4.7.24","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.8","from_inclusive":true,"to":"4.8.20","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.9","from_inclusive":true,"to":"4.9.21","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.0","from_inclusive":true,"to":"5.0.17","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.1","from_inclusive":true,"to":"5.1.14","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.2","from_inclusive":true,"to":"5.2.16","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.3","from_inclusive":true,"to":"5.3.13","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.4","from_inclusive":true,"to":"5.4.11","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.5","from_inclusive":true,"to":"5.5.10","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.6","from_inclusive":true,"to":"5.6.9","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.7","from_inclusive":true,"to":"5.7.7","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.8","from_inclusive":true,"to":"5.8.5","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"5.9","from_inclusive":true,"to":"5.9.4","to_inclusive":true,"patched_in":"3.7.40"},{"type":"core","slug":"wordpress","name":"WordPress","from":"6.0","from_inclusive":true,"to":"6.0.2","to_inclusive":true,"patched_in":"3.7.40"}],"published":"2022-10-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff4b757a-9ede-496b-b559-cf952d39fe70","source":"wordfence","cve":"CVE-2023-25697","title":"GamiPress <= 2.5.6 - Cross-Site Request Forgery to User Earnings Deletion","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4b757a-9ede-496b-b559-cf952d39fe70?source=api-prod","affected":[{"type":"plugin","slug":"gamipress","name":"GamiPress \u2013 Gamification plugin to reward points, badges & ranks in WordPress, now with AI","from":"*","from_inclusive":true,"to":"2.5.6","to_inclusive":true,"patched_in":"2.5.7"}],"published":"2023-02-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff4c217c-3a61-4f96-a698-b7fba1294ace","source":"wordfence","cve":"CVE-2026-59559","title":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4c217c-3a61-4f96-a698-b7fba1294ace?source=api-prod","affected":[{"type":"plugin","slug":"rt-mega-menu","name":"RT Mega Menu \u2013 Mega Menu Builder for Elementor & Gutenberg","from":"*","from_inclusive":true,"to":"1.5.1","to_inclusive":true,"patched_in":"1.5.2"}],"published":"2026-07-27T00:00:00Z","updated":"2026-07-29T23:06:04Z"},{"id":"wordfence:ff506c6a-6a8b-47ca-a2bd-e9502a60271d","source":"wordfence","cve":"CVE-2025-49870","title":"Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff506c6a-6a8b-47ca-a2bd-e9502a60271d?source=api-prod","affected":[{"type":"plugin","slug":"paid-member-subscriptions","name":"Paid Membership Subscriptions \u2013 Effortless Memberships, Recurring Payments & Content Restriction","from":"*","from_inclusive":true,"to":"2.15.1","to_inclusive":true,"patched_in":"2.15.2"}],"published":"2025-07-03T00:00:00Z","updated":"2025-07-08T19:10:06Z"},{"id":"wordfence:ff559912-8609-46e6-b64f-f05f5232276c","source":"wordfence","cve":"CVE-2024-11109","title":"WP Google Review Slider <= 15.5 - Authenticated (Admin+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff559912-8609-46e6-b64f-f05f5232276c?source=api-prod","affected":[{"type":"plugin","slug":"wp-google-places-review-slider","name":"WP Google Review Slider","from":"*","from_inclusive":true,"to":"15.5","to_inclusive":true,"patched_in":"15.6"}],"published":"2025-03-03T00:00:00Z","updated":"2025-05-27T15:12:34Z"},{"id":"wordfence:ff5755dc-2262-47f6-ac3a-6bca9529d088","source":"wordfence","cve":"CVE-2021-4381","title":"uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route","severity":"critical","cvss":9.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff5755dc-2262-47f6-ac3a-6bca9529d088?source=api-prod","affected":[{"type":"plugin","slug":"ulisting","name":"Directory Listings WordPress plugin \u2013 uListing","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":false,"patched_in":"1.7"}],"published":"2021-01-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff5d0ffb-c703-4bd1-83a0-c02e3744dd03","source":"wordfence","cve":"CVE-2025-24625","title":"Taxonomy/Term and Role based Discounts for WooCommerce <= 5.1 - Cross-Site Request Forgery to Settings Update","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff5d0ffb-c703-4bd1-83a0-c02e3744dd03?source=api-prod","affected":[{"type":"plugin","slug":"taxonomy-discounts-woocommerce","name":"Taxonomy/Term and Role-based Discounts for WooCommerce","from":"*","from_inclusive":true,"to":"5.1","to_inclusive":true,"patched_in":"5.2"}],"published":"2025-01-24T00:00:00Z","updated":"2025-01-28T18:23:30Z"},{"id":"wordfence:ff5d8f5f-c7af-4789-9920-a09d2733b8ee","source":"wordfence","cve":"CVE-2019-19982","title":"Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated Option Creation","severity":"medium","cvss":6.5,"cwe":"CWE-287","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff5d8f5f-c7af-4789-9920-a09d2733b8ee?source=api-prod","affected":[{"type":"plugin","slug":"email-subscribers","name":"Email Subscribers & Newsletters by Icegram Express \u2013 Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress","from":"*","from_inclusive":true,"to":"4.2.2","to_inclusive":true,"patched_in":"4.2.3"}],"published":"2019-11-13T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff656409-2344-4190-a731-5a282e21375c","source":"wordfence","cve":"CVE-2023-47809","title":"Accordion <= 2.6 - Authenticated (Editor+) Stored Cross-Site Scripting via accordion settings","severity":"medium","cvss":5.5,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff656409-2344-4190-a731-5a282e21375c?source=api-prod","affected":[{"type":"plugin","slug":"accordions-wp","name":"Accordions \u2013 Responsive Accordion & FAQ Plugin for WordPress","from":"*","from_inclusive":true,"to":"2.6","to_inclusive":true,"patched_in":"2.7"}],"published":"2023-11-15T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff65e2cc-2052-45b6-bb42-58b8ce73adee","source":"wordfence","cve":"CVE-2025-69183","title":"Hospital Doctor Directory <= 1.3.9 - Authenticated (Subscriber+) Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-266","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff65e2cc-2052-45b6-bb42-58b8ce73adee?source=api-prod","affected":[{"type":"plugin","slug":"hospital-doctor-directory","name":"Hospital Doctor Directory","from":"*","from_inclusive":true,"to":"1.3.9","to_inclusive":true,"patched_in":""}],"published":"2026-01-22T00:00:00Z","updated":"2026-01-28T14:05:08Z"},{"id":"wordfence:ff6932c6-f3ec-46a8-a03b-95512eee5bf1","source":"wordfence","cve":"CVE-2023-4889","title":"Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6932c6-f3ec-46a8-a03b-95512eee5bf1?source=api-prod","affected":[{"type":"plugin","slug":"shareaholic","name":"Professional Social Sharing Buttons, Icons & Related Posts \u2013 Shareaholic","from":"*","from_inclusive":true,"to":"9.7.8","to_inclusive":true,"patched_in":"9.7.9"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff6b9c3e-b716-4b58-80fa-f1f115856c6c","source":"wordfence","cve":"CVE-2026-11996","title":"Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6b9c3e-b716-4b58-80fa-f1f115856c6c?source=api-prod","affected":[{"type":"plugin","slug":"advanced-popups","name":"Advanced Popups","from":"*","from_inclusive":true,"to":"1.2.3","to_inclusive":true,"patched_in":"1.2.4"}],"published":"2026-09-15T15:27:04Z","updated":"2026-09-16T03:28:22Z"},{"id":"wordfence:ff6c0ce5-b98e-4005-b8ea-7328119aec97","source":"wordfence","cve":"CVE-2026-57640","title":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education <= 3.7.30 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6c0ce5-b98e-4005-b8ea-7328119aec97?source=api-prod","affected":[{"type":"plugin","slug":"masterstudy-lms-learning-management-system","name":"MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education","from":"*","from_inclusive":true,"to":"3.7.30","to_inclusive":true,"patched_in":"3.7.31"}],"published":"2026-06-26T00:00:00Z","updated":"2026-06-29T18:54:01Z"},{"id":"wordfence:ff6db316-6621-4f16-bf74-af6e75fa8609","source":"wordfence","cve":"CVE-2025-23882","title":"WP Download Codes <= 2.5.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6db316-6621-4f16-bf74-af6e75fa8609?source=api-prod","affected":[{"type":"plugin","slug":"wp-download-codes","name":"WP Download Codes","from":"*","from_inclusive":true,"to":"2.5.4","to_inclusive":true,"patched_in":""}],"published":"2025-01-16T00:00:00Z","updated":"2025-02-14T17:20:21Z"},{"id":"wordfence:ff6e6101-8ba5-4cc7-9b02-67a0d9a978b6","source":"wordfence","cve":"","title":"Browser and Operating System Finder <= 1.2 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6e6101-8ba5-4cc7-9b02-67a0d9a978b6?source=api-prod","affected":[{"type":"plugin","slug":"browser-and-operating-system-finder","name":"Browser and Operating System Finder","from":"*","from_inclusive":true,"to":"1.2","to_inclusive":true,"patched_in":""}],"published":"2022-06-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff6ebf45-4617-44dd-94d8-28aa8bc1609b","source":"wordfence","cve":"CVE-2024-7894","title":"If Menu <= 0.19.1 - Missing Authorization to License Key Update","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6ebf45-4617-44dd-94d8-28aa8bc1609b?source=api-prod","affected":[{"type":"plugin","slug":"if-menu","name":"If Menu \u2013 Visibility control for Menus","from":"*","from_inclusive":true,"to":"0.19.1","to_inclusive":true,"patched_in":"0.19.2"}],"published":"2024-12-06T00:00:00Z","updated":"2024-12-07T01:45:53Z"},{"id":"wordfence:ff6fc652-dcf8-4ff6-b8d8-cb9fad5b34bd","source":"wordfence","cve":"","title":"3D Flick Slideshow < 2.2 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6fc652-dcf8-4ff6-b8d8-cb9fad5b34bd?source=api-prod","affected":[{"type":"plugin","slug":"wp-3dflick-slideshow","name":"3D Flick Slideshow","from":"*","from_inclusive":true,"to":"2.1","to_inclusive":true,"patched_in":"2.2"}],"published":"2012-06-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff6ff104-44c8-49a9-bebd-abb82e8e1cd6","source":"wordfence","cve":"CVE-2024-2311","title":"Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6ff104-44c8-49a9-bebd-abb82e8e1cd6?source=api-prod","affected":[{"type":"theme","slug":"Avada","name":"Avada | Website Builder For WordPress & WooCommerce","from":"*","from_inclusive":true,"to":"7.11.6","to_inclusive":true,"patched_in":"7.11.7"}],"published":"2024-03-20T00:00:00Z","updated":"2024-07-31T15:53:32Z"},{"id":"wordfence:ff70f7aa-4c2c-4693-8b1f-d6e3ebbb0dad","source":"wordfence","cve":"CVE-2015-9427","title":"Googmonify <= 0.5.1 - Cross-Site Request Forgery to Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff70f7aa-4c2c-4693-8b1f-d6e3ebbb0dad?source=api-prod","affected":[{"type":"plugin","slug":"googmonify","name":"Googmonify","from":"*","from_inclusive":true,"to":"0.5.1","to_inclusive":true,"patched_in":""}],"published":"2015-08-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff77ffea-6b43-4875-965a-a72d761e93f7","source":"wordfence","cve":"CVE-2024-32434","title":"Order Delivery Date for WooCommerce <= 3.21.0 - Cross-Site Request Forgery to Notice Dismissal","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff77ffea-6b43-4875-965a-a72d761e93f7?source=api-prod","affected":[{"type":"plugin","slug":"order-delivery-date-for-woocommerce","name":"Order Delivery Date for WooCommerce","from":"*","from_inclusive":true,"to":"3.21.0","to_inclusive":true,"patched_in":"3.21.1"}],"published":"2024-04-12T00:00:00Z","updated":"2024-04-17T19:13:12Z"},{"id":"wordfence:ff79e4b4-f3f1-4a7f-97f5-09bb3fc9c0c0","source":"wordfence","cve":"CVE-2025-68581","title":"YITH Slider for page builders <= 1.0.11 - Missing Authorization","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff79e4b4-f3f1-4a7f-97f5-09bb3fc9c0c0?source=api-prod","affected":[{"type":"plugin","slug":"yith-slider-for-page-builders","name":"YITH Slider for page builders","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":true,"patched_in":"1.1.0"}],"published":"2025-12-24T00:00:00Z","updated":"2026-07-08T20:46:18Z"},{"id":"wordfence:ff7d09d1-bbc7-417c-bb3c-30f9ffe49522","source":"wordfence","cve":"CVE-2026-59531","title":"Falcon \u2013 WordPress Optimizations & Tweaks <= 2.10.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7d09d1-bbc7-417c-bb3c-30f9ffe49522?source=api-prod","affected":[{"type":"plugin","slug":"falcon","name":"Falcon \u2013 Cache, Performance, Security, Cleanup, and Tweaks","from":"*","from_inclusive":true,"to":"2.10.0","to_inclusive":true,"patched_in":"2.10.1"}],"published":"2026-07-23T00:00:00Z","updated":"2026-07-29T12:05:09Z"},{"id":"wordfence:ff7e7539-6a09-461a-a9a7-33630c396f1a","source":"wordfence","cve":"CVE-2023-23797","title":"Auto YouTube Importer <= 1.0.3 - Cross-Site Request Forgery","severity":"medium","cvss":5.4,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7e7539-6a09-461a-a9a7-33630c396f1a?source=api-prod","affected":[{"type":"plugin","slug":"auto-youtube-importer","name":"Auto YouTube Importer","from":"*","from_inclusive":true,"to":"1.0.3","to_inclusive":true,"patched_in":"1.0.4"}],"published":"2023-02-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff7ead53-4b20-48ba-95cd-118fb4eab330","source":"wordfence","cve":"CVE-2024-13351","title":"Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7ead53-4b20-48ba-95cd-118fb4eab330?source=api-prod","affected":[{"type":"plugin","slug":"social-testimonials-and-reviews-widget","name":"Reviews Widgets for Google & 45+ platforms by Repuso","from":"*","from_inclusive":true,"to":"5.20","to_inclusive":true,"patched_in":"5.21"}],"published":"2025-01-14T21:08:00Z","updated":"2025-01-15T09:25:57Z"},{"id":"wordfence:ff7f92ec-0412-414f-9afe-e1ba4fa0dbae","source":"wordfence","cve":"CVE-2025-26895","title":"m1.DownloadList <= 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7f92ec-0412-414f-9afe-e1ba4fa0dbae?source=api-prod","affected":[{"type":"plugin","slug":"m1downloadlist","name":"m1.DownloadList","from":"*","from_inclusive":true,"to":"0.19","to_inclusive":true,"patched_in":"0.20"}],"published":"2025-03-03T00:00:00Z","updated":"2025-03-10T14:36:38Z"},{"id":"wordfence:ff7fe2bc-16bd-4ebc-b6f4-cd32b2e55cfa","source":"wordfence","cve":"CVE-2024-13828","title":"Badgearoo <= 1.0.14 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7fe2bc-16bd-4ebc-b6f4-cd32b2e55cfa?source=api-prod","affected":[{"type":"plugin","slug":"badgearoo","name":"Badgearoo","from":"*","from_inclusive":true,"to":"1.0.14","to_inclusive":true,"patched_in":""}],"published":"2025-02-14T00:00:00Z","updated":"2025-05-29T18:46:33Z"},{"id":"wordfence:ff826ec2-6cbe-4158-a928-227e9a31b0d3","source":"wordfence","cve":"CVE-2026-85351","title":"FV Player <= 7.5.56.7211 - Authenticated (Contributor+) Server-Side Request Forgery","severity":"medium","cvss":6.4,"cwe":"CWE-918","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff826ec2-6cbe-4158-a928-227e9a31b0d3?source=api-prod","affected":[{"type":"plugin","slug":"fv-wordpress-flowplayer","name":"FV Flowplayer Video Player","from":"*","from_inclusive":true,"to":"7.5.56.7211","to_inclusive":true,"patched_in":"7.5.56.7212"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:07:32Z"},{"id":"wordfence:ff840236-4368-45aa-a9a3-7e02f20783d8","source":"wordfence","cve":"CVE-2022-1600","title":"YOP Poll <= 6.4.2 - IP Spoofing via X-Forwarded-For header","severity":"medium","cvss":5.3,"cwe":"CWE-693","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff840236-4368-45aa-a9a3-7e02f20783d8?source=api-prod","affected":[{"type":"plugin","slug":"yop-poll","name":"YOP Poll","from":"*","from_inclusive":true,"to":"6.4.2","to_inclusive":true,"patched_in":"6.4.3"}],"published":"2022-07-11T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff850f88-6e89-48dd-ad70-dda4018c22fc","source":"wordfence","cve":"CVE-2023-47789","title":"WooCommerce Canada Post Shipping <= 2.8.3 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff850f88-6e89-48dd-ad70-dda4018c22fc?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-shipping-canada-post","name":"Woocommerce Shipping Canada Post","from":"*","from_inclusive":true,"to":"2.8.3","to_inclusive":true,"patched_in":"2.8.4"}],"published":"2023-11-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff87e9e0-d8b1-47d3-92d6-48e6b00ac1a0","source":"wordfence","cve":"CVE-2025-48330","title":"Real Time Validation for Gravity Forms <= 1.7.0 - Unauthenticated Local File Inclusion","severity":"critical","cvss":9.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff87e9e0-d8b1-47d3-92d6-48e6b00ac1a0?source=api-prod","affected":[{"type":"plugin","slug":"real-time-validation-for-gravity-forms","name":"Real Time Validation for Gravity Forms","from":"*","from_inclusive":true,"to":"1.7.0","to_inclusive":true,"patched_in":""}],"published":"2025-05-30T00:00:00Z","updated":"2025-06-02T19:45:51Z"},{"id":"wordfence:ff8a629f-4a2f-474c-be22-82a0a3a9f4a5","source":"wordfence","cve":"CVE-2025-26746","title":"Advanced Custom Fields: Link Picker Field <= 1.2.8 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8a629f-4a2f-474c-be22-82a0a3a9f4a5?source=api-prod","affected":[{"type":"plugin","slug":"acf-link-picker-field","name":"Advanced Custom Fields: Link Picker Field","from":"*","from_inclusive":true,"to":"1.2.8","to_inclusive":true,"patched_in":""}],"published":"2025-04-11T00:00:00Z","updated":"2025-04-15T14:10:26Z"},{"id":"wordfence:ff8a7b26-8c65-40e6-b087-26920745447d","source":"wordfence","cve":"CVE-2026-94059","title":"Ogency <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8a7b26-8c65-40e6-b087-26920745447d?source=api-prod","affected":[{"type":"theme","slug":"ogency","name":"Ogency - Web Design Agency WordPress Theme","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2026-10-07T00:00:00Z","updated":"2026-10-14T16:18:44Z"},{"id":"wordfence:ff8e8889-ec02-4b8d-9509-2c6335fdd9a4","source":"wordfence","cve":"CVE-2024-10868","title":"Enter Addons \u2013 Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8e8889-ec02-4b8d-9509-2c6335fdd9a4?source=api-prod","affected":[{"type":"plugin","slug":"enteraddons","name":"Enter Addons \u2013 Ultimate Template Builder for Elementor","from":"*","from_inclusive":true,"to":"2.1.9","to_inclusive":true,"patched_in":"2.2.0"}],"published":"2024-11-22T15:09:31Z","updated":"2024-11-25T19:56:31Z"},{"id":"wordfence:ff904d2a-5be1-4a17-ac95-b0099eb616f6","source":"wordfence","cve":"CVE-2026-25359","title":"Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection","severity":"high","cvss":7.5,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff904d2a-5be1-4a17-ac95-b0099eb616f6?source=api-prod","affected":[{"type":"theme","slug":"pendulum","name":"Pendulum - Beat Producers, DJs & Events Theme for WordPress","from":"*","from_inclusive":true,"to":"3.1.5","to_inclusive":false,"patched_in":"3.1.5"}],"published":"2026-03-20T00:00:00Z","updated":"2026-03-27T17:52:33Z"},{"id":"wordfence:ff91999a-e32b-4109-9fc6-bd2a53f30d0f","source":"wordfence","cve":"CVE-2026-28015","title":"ShiftCV - Blog \\ Resume \\ Portfolio \\ WordPress Theme <= 3.0.14 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff91999a-e32b-4109-9fc6-bd2a53f30d0f?source=api-prod","affected":[{"type":"theme","slug":"shift-cv","name":"ShiftCV - Blog \\ Resume \\ Portfolio \\ WordPress Theme","from":"*","from_inclusive":true,"to":"3.0.14","to_inclusive":true,"patched_in":""}],"published":"2026-03-02T00:00:00Z","updated":"2026-03-05T14:40:29Z"},{"id":"wordfence:ff9364a9-18f8-47d3-b992-e39c8d99d6ea","source":"wordfence","cve":"CVE-2025-14364","title":"Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9364a9-18f8-47d3-b992-e39c8d99d6ea?source=api-prod","affected":[{"type":"plugin","slug":"demo-importer-plus","name":"Demo Importer Plus","from":"*","from_inclusive":true,"to":"2.0.8","to_inclusive":true,"patched_in":"2.0.9"}],"published":"2025-12-17T21:19:54Z","updated":"2025-12-18T09:21:30Z"},{"id":"wordfence:ff937860-c4e0-4172-9f0f-d66578fa7203","source":"wordfence","cve":"CVE-2023-25469","title":"Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default","severity":"medium","cvss":5.4,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff937860-c4e0-4172-9f0f-d66578fa7203?source=api-prod","affected":[{"type":"plugin","slug":"easy-table-of-contents","name":"Easy Table of Contents","from":"*","from_inclusive":true,"to":"2.0.45.2","to_inclusive":true,"patched_in":"2.0.46"}],"published":"2023-03-21T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff986a66-93f7-4926-8818-7af745c0166c","source":"wordfence","cve":"CVE-2023-48752","title":"Happyforms <= 1.25.9 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff986a66-93f7-4926-8818-7af745c0166c?source=api-prod","affected":[{"type":"plugin","slug":"happyforms","name":"Happyforms \u2013 Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms","from":"*","from_inclusive":true,"to":"1.25.9","to_inclusive":true,"patched_in":"1.25.10"}],"published":"2023-11-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff9c424c-f37f-4c30-aa95-da597008cbb2","source":"wordfence","cve":"CVE-2021-24632","title":"Recipe Card Blocks by WPZOOM <= 2.8.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9c424c-f37f-4c30-aa95-da597008cbb2?source=api-prod","affected":[{"type":"plugin","slug":"recipe-card-blocks-by-wpzoom","name":"Recipe Card Blocks Lite","from":"*","from_inclusive":true,"to":"2.8.1","to_inclusive":false,"patched_in":"2.8.1"}],"published":"2021-08-24T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff9cfa56-e178-4de7-9e6b-e0a520153eb2","source":"wordfence","cve":"","title":"Easy Testimonials <= 1.36.1 - Authenticated Stored Cross-Site Scripting","severity":"high","cvss":7.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9cfa56-e178-4de7-9e6b-e0a520153eb2?source=api-prod","affected":[{"type":"plugin","slug":"easy-testimonials","name":"Easy Testimonials","from":"*","from_inclusive":true,"to":"1.37","to_inclusive":false,"patched_in":"1.37"}],"published":"2016-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ff9ea775-61d8-4ca4-ae92-121b172839ca","source":"wordfence","cve":"CVE-2026-16304","title":"Event Manager <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference","severity":"medium","cvss":4.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ff9ea775-61d8-4ca4-ae92-121b172839ca?source=api-prod","affected":[{"type":"plugin","slug":"wp-event-manager","name":"WP Event Manager \u2013 Events Calendar, Registrations, Sell Tickets with WooCommerce","from":"*","from_inclusive":true,"to":"3.4.1","to_inclusive":true,"patched_in":"3.4.2"}],"published":"2026-11-02T00:00:00Z","updated":"2026-11-10T20:04:13Z"},{"id":"wordfence:ffa0d1ff-a1df-4a90-bfe5-3f4c8a7942c6","source":"wordfence","cve":"CVE-2022-0739","title":"BookingPress < 1.0.11 - SQL Injection","severity":"critical","cvss":9.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa0d1ff-a1df-4a90-bfe5-3f4c8a7942c6?source=api-prod","affected":[{"type":"plugin","slug":"bookingpress-appointment-booking","name":"Appointment Booking Calendar Plugin and Scheduling Plugin \u2013 BookingPress","from":"*","from_inclusive":true,"to":"1.0.11","to_inclusive":false,"patched_in":"1.0.11"}],"published":"2022-02-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffa252d6-0fe2-4d1f-802f-b902084822a7","source":"wordfence","cve":"CVE-2016-5833","title":"WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name #2","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa252d6-0fe2-4d1f-802f-b902084822a7?source=api-prod","affected":[{"type":"core","slug":"wordpress","name":"WordPress","from":"*","from_inclusive":true,"to":"3.7","to_inclusive":false,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.7","from_inclusive":true,"to":"3.7.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.8","from_inclusive":true,"to":"3.8.14","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"3.9","from_inclusive":true,"to":"3.9.12","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.0","from_inclusive":true,"to":"4.0.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.1","from_inclusive":true,"to":"4.1.11","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.2","from_inclusive":true,"to":"4.2.8","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.3","from_inclusive":true,"to":"4.3.4","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.4","from_inclusive":true,"to":"4.4.3","to_inclusive":true,"patched_in":"3.7.15"},{"type":"core","slug":"wordpress","name":"WordPress","from":"4.5","from_inclusive":true,"to":"4.5.2","to_inclusive":true,"patched_in":"3.7.15"}],"published":"2016-06-18T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffa3b053-07cd-4c5f-b9d1-016cbca4b171","source":"wordfence","cve":"CVE-2024-32103","title":"Siteimprove <= 2.0.6 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa3b053-07cd-4c5f-b9d1-016cbca4b171?source=api-prod","affected":[{"type":"plugin","slug":"siteimprove","name":"Siteimprove","from":"*","from_inclusive":true,"to":"2.0.6","to_inclusive":true,"patched_in":"2.0.7"}],"published":"2024-04-11T00:00:00Z","updated":"2024-04-17T20:49:15Z"},{"id":"wordfence:ffa3b85c-7d08-4f6a-889e-b75620f72a1a","source":"wordfence","cve":"CVE-2024-9595","title":"TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa3b85c-7d08-4f6a-889e-b75620f72a1a?source=api-prod","affected":[{"type":"plugin","slug":"tablepress","name":"TablePress \u2013 Tables in WordPress made easy","from":"*","from_inclusive":true,"to":"2.4.2","to_inclusive":true,"patched_in":"2.4.3"}],"published":"2024-10-11T20:34:39Z","updated":"2024-10-12T08:41:07Z"},{"id":"wordfence:ffa54d4e-a633-48a4-83c0-33b7cbd2229a","source":"wordfence","cve":"CVE-2025-60093","title":"Download Manager <= 3.3.24 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa54d4e-a633-48a4-83c0-33b7cbd2229a?source=api-prod","affected":[{"type":"plugin","slug":"download-manager","name":"Download Manager","from":"*","from_inclusive":true,"to":"3.3.24","to_inclusive":true,"patched_in":"3.3.25"}],"published":"2025-09-26T00:00:00Z","updated":"2025-10-08T21:09:45Z"},{"id":"wordfence:ffa6b83d-301d-48b2-9670-f7fa599b7ef0","source":"wordfence","cve":"CVE-2026-65571","title":"69 Clothing | Brand Store & Fashion Boutique WordPress Theme <= 1.2.11.1 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa6b83d-301d-48b2-9670-f7fa599b7ef0?source=api-prod","affected":[{"type":"theme","slug":"clothing69","name":"69 Clothing | Brand Store & Fashion Boutique WordPress Theme","from":"*","from_inclusive":true,"to":"1.2.11.1","to_inclusive":true,"patched_in":""}],"published":"2026-08-06T00:00:00Z","updated":"2026-08-13T18:58:27Z"},{"id":"wordfence:ffa90aae-c512-4e7f-a041-e3e41cb8a1d8","source":"wordfence","cve":"","title":"Count per Day < 3.5.5 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":8.3,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa90aae-c512-4e7f-a041-e3e41cb8a1d8?source=api-prod","affected":[{"type":"plugin","slug":"count-per-day","name":"Count per Day","from":"*","from_inclusive":true,"to":"3.5.5","to_inclusive":false,"patched_in":"3.5.5"}],"published":"2016-08-05T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffa92cb6-7444-4794-81c1-264ff5a08fa5","source":"wordfence","cve":"CVE-2024-32800","title":"Popup More Popups <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa92cb6-7444-4794-81c1-264ff5a08fa5?source=api-prod","affected":[{"type":"plugin","slug":"popup-more","name":"AI Popup","from":"*","from_inclusive":true,"to":"2.3.2","to_inclusive":true,"patched_in":"2.3.3"}],"published":"2024-05-14T00:00:00Z","updated":"2024-05-20T17:27:51Z"},{"id":"wordfence:ffac779c-c17f-46bd-9276-a1ce2db4e95c","source":"wordfence","cve":"CVE-2023-35881","title":"WooCommerce One Page Checkout <= 2.3.0 - Authenticated (Contributor+) Local File Inclusion via `woocommerce_one_page_checkout`","severity":"high","cvss":8.8,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffac779c-c17f-46bd-9276-a1ce2db4e95c?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-one-page-checkout","name":"woocommerce-one-page-checkout","from":"*","from_inclusive":true,"to":"2.3.0","to_inclusive":true,"patched_in":"2.4.0"}],"published":"2023-08-10T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffae2808-454e-4380-af83-b181cf2e8fbd","source":"wordfence","cve":"CVE-2024-34367","title":"Popup box <= 4.1.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffae2808-454e-4380-af83-b181cf2e8fbd?source=api-prod","affected":[{"type":"plugin","slug":"ays-popup-box","name":"Popup Box \u2013 Create Countdown, Coupon, Video, Contact Form Popups","from":"*","from_inclusive":true,"to":"4.1.2","to_inclusive":true,"patched_in":"4.1.3"}],"published":"2024-05-03T00:00:00Z","updated":"2024-05-07T13:10:16Z"},{"id":"wordfence:ffaefd79-57a7-43b8-af1c-e108567eba67","source":"wordfence","cve":"CVE-2024-2324","title":"FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffaefd79-57a7-43b8-af1c-e108567eba67?source=api-prod","affected":[{"type":"plugin","slug":"fileorganizer","name":"FileOrganizer \u2013 WordPress File Manager","from":"*","from_inclusive":true,"to":"1.0.6","to_inclusive":true,"patched_in":"1.0.7"}],"published":"2024-04-23T00:00:00Z","updated":"2024-05-02T16:52:55Z"},{"id":"wordfence:ffaf6182-fac3-40d3-b3d7-1baddb1e15a8","source":"wordfence","cve":"CVE-2026-16572","title":"LogMyTrip <= 1.9 - Unauthenticated SQL Injection","severity":"high","cvss":7.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffaf6182-fac3-40d3-b3d7-1baddb1e15a8?source=api-prod","affected":[{"type":"plugin","slug":"logmytrip","name":"LogMyTrip","from":"*","from_inclusive":true,"to":"1.9","to_inclusive":true,"patched_in":""}],"published":"2026-07-24T00:00:00Z","updated":"2026-08-15T21:29:56Z"},{"id":"wordfence:ffaf7a75-de27-4361-ba04-ff17151b7eb5","source":"wordfence","cve":"CVE-2022-1593","title":"Site Offline or Coming Soon <= 1.6.6 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting","severity":"critical","cvss":9.6,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffaf7a75-de27-4361-ba04-ff17151b7eb5?source=api-prod","affected":[{"type":"plugin","slug":"site-is-offline-plugin","name":"Site Offline or Coming Soon","from":"*","from_inclusive":true,"to":"1.6.6","to_inclusive":true,"patched_in":""}],"published":"2022-06-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffb2820e-a9b3-49a5-bc87-79347720fa7b","source":"wordfence","cve":"CVE-2025-26916","title":"Massive Dynamic <= 8.2 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb2820e-a9b3-49a5-bc87-79347720fa7b?source=api-prod","affected":[{"type":"theme","slug":"massive-dynamic","name":"Massive Dynamic","from":"*","from_inclusive":true,"to":"8.2","to_inclusive":true,"patched_in":""}],"published":"2025-02-23T00:00:00Z","updated":"2025-03-14T17:33:30Z"},{"id":"wordfence:ffb2ade3-d5ce-4459-ab83-e28cd4c84922","source":"wordfence","cve":"CVE-2025-5016","title":"Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights","severity":"medium","cvss":4.7,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb2ade3-d5ce-4459-ab83-e28cd4c84922?source=api-prod","affected":[{"type":"plugin","slug":"relevanssi-premium","name":"Relevanssi Premium","from":"*","from_inclusive":true,"to":"2.27.6","to_inclusive":true,"patched_in":"2.27.7"},{"type":"plugin","slug":"relevanssi","name":"Relevanssi \u2013 A Better Search","from":"*","from_inclusive":true,"to":"4.24.5","to_inclusive":true,"patched_in":"4.24.6"}],"published":"2025-05-30T14:49:18Z","updated":"2025-05-31T03:26:43Z"},{"id":"wordfence:ffb48bf1-8339-4305-8e94-5af5b2b9cbc2","source":"wordfence","cve":"CVE-2026-62065","title":"Cardea <= 2.3 - Unauthenticated Local File Inclusion","severity":"high","cvss":8.1,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb48bf1-8339-4305-8e94-5af5b2b9cbc2?source=api-prod","affected":[{"type":"theme","slug":"cardea-wp","name":"Cardea - Portfolio One Page WordPress Theme","from":"*","from_inclusive":true,"to":"2.3","to_inclusive":true,"patched_in":""}],"published":"2026-10-08T00:00:00Z","updated":"2026-10-13T19:35:52Z"},{"id":"wordfence:ffb6a00f-1368-4c4b-8063-de25a2e55e08","source":"wordfence","cve":"CVE-2026-107178","title":"Image Photo Gallery Final Tiles Grid < 3.6.16 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb6a00f-1368-4c4b-8063-de25a2e55e08?source=api-prod","affected":[{"type":"plugin","slug":"final-tiles-grid-gallery-lite","name":"Image Photo Gallery Final Tiles Grid","from":"*","from_inclusive":true,"to":"3.6.16","to_inclusive":false,"patched_in":"3.6.16"}],"published":"2026-10-14T00:00:00Z","updated":"2026-10-14T19:42:00Z"},{"id":"wordfence:ffb70e82-355b-48f3-92d0-19659ed2550e","source":"wordfence","cve":"CVE-2024-1043","title":"AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data","severity":"medium","cvss":6.5,"cwe":"CWE-285","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb70e82-355b-48f3-92d0-19659ed2550e?source=api-prod","affected":[{"type":"plugin","slug":"accelerated-mobile-pages","name":"AMP for WP \u2013 Accelerated Mobile Pages","from":"*","from_inclusive":true,"to":"1.0.93.1","to_inclusive":true,"patched_in":"1.0.93.2"}],"published":"2024-02-06T00:00:00Z","updated":"2024-07-31T15:37:13Z"},{"id":"wordfence:ffb72c2a-f0b5-4a82-a187-121636a1d324","source":"wordfence","cve":"CVE-2025-26890","title":"HUSKY \u2013 Products Filter Professional for WooCommerce <= 1.3.6.4 - Unauthenticated Local File Inclusion","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb72c2a-f0b5-4a82-a187-121636a1d324?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.6.4","to_inclusive":true,"patched_in":"1.3.6.5"}],"published":"2025-03-14T00:00:00Z","updated":"2025-04-22T20:08:28Z"},{"id":"wordfence:ffb8a285-43c6-4956-ad37-484269463b2d","source":"wordfence","cve":"CVE-2024-24716","title":"Awesome Support  <= 6.1.6 - Insufficient Authorization via wpas_can_delete_attachments()","severity":"medium","cvss":4.3,"cwe":"CWE-863","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb8a285-43c6-4956-ad37-484269463b2d?source=api-prod","affected":[{"type":"plugin","slug":"awesome-support","name":"Awesome Support \u2013 WordPress HelpDesk & Support Plugin","from":"*","from_inclusive":true,"to":"6.1.6","to_inclusive":true,"patched_in":"6.1.7"}],"published":"2024-03-12T00:00:00Z","updated":"2024-03-12T09:15:33Z"},{"id":"wordfence:ffb8c561-ce2a-447c-add6-d7e01c8c9435","source":"wordfence","cve":"CVE-2025-47651","title":"Infility Global <= 2.12.7 - Authenticated (Subscriber+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb8c561-ce2a-447c-add6-d7e01c8c9435?source=api-prod","affected":[{"type":"plugin","slug":"infility-global","name":"Infility Global","from":"*","from_inclusive":true,"to":"2.12.7","to_inclusive":true,"patched_in":""}],"published":"2025-05-29T00:00:00Z","updated":"2025-06-25T14:20:03Z"},{"id":"wordfence:ffb97fa2-456c-4bc4-a09c-54daa17be3e8","source":"wordfence","cve":"CVE-2019-19133","title":"CSS Hero <= 4.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb97fa2-456c-4bc4-a09c-54daa17be3e8?source=api-prod","affected":[{"type":"plugin","slug":"css-hero","name":"CSS Hero","from":"*","from_inclusive":true,"to":"4.03","to_inclusive":true,"patched_in":"4.07"}],"published":"2019-12-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffbb6268-5461-4291-be76-10ba060e352e","source":"wordfence","cve":"CVE-2025-58008","title":"Participants Database <= 2.7.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffbb6268-5461-4291-be76-10ba060e352e?source=api-prod","affected":[{"type":"plugin","slug":"participants-database","name":"Participants Database","from":"*","from_inclusive":true,"to":"2.7.6.3","to_inclusive":true,"patched_in":"2.7.7"}],"published":"2025-09-22T00:00:00Z","updated":"2025-10-10T20:47:44Z"},{"id":"wordfence:ffbb85c5-e949-4c0f-8c02-2c022b802e05","source":"wordfence","cve":"CVE-2023-28778","title":"Pagination by BestWebSoft <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffbb85c5-e949-4c0f-8c02-2c022b802e05?source=api-prod","affected":[{"type":"plugin","slug":"pagination","name":"Pagination by BestWebSoft \u2013 Customizable WordPress Content Splitter and Navigation Plugin","from":"*","from_inclusive":true,"to":"1.2.2","to_inclusive":true,"patched_in":"1.2.3"}],"published":"2023-03-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffbf5930-50f3-44ca-8333-7b934dcd5ef7","source":"wordfence","cve":"CVE-2024-2857","title":"Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffbf5930-50f3-44ca-8333-7b934dcd5ef7?source=api-prod","affected":[{"type":"plugin","slug":"simple-buttons-creator","name":"Simple Buttons Creator","from":"*","from_inclusive":true,"to":"1.04","to_inclusive":true,"patched_in":""}],"published":"2024-03-25T00:00:00Z","updated":"2024-04-01T11:27:03Z"},{"id":"wordfence:ffc2e04f-6e71-4783-bded-7d7782e2e84e","source":"wordfence","cve":"CVE-2015-9366","title":"Exchange Addon Custom URL Tracking < 1.1.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc2e04f-6e71-4783-bded-7d7782e2e84e?source=api-prod","affected":[{"type":"plugin","slug":"exchange-addon-custom-url-tracking","name":"Exchange Addon Custom URL Tracking","from":"*","from_inclusive":true,"to":"1.1.0","to_inclusive":false,"patched_in":"1.1.0"}],"published":"2015-04-20T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffc2fe31-9bc2-497a-a8f4-1bc4f93de5a2","source":"wordfence","cve":"CVE-2026-11920","title":"JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc2fe31-9bc2-497a-a8f4-1bc4f93de5a2?source=api-prod","affected":[{"type":"plugin","slug":"joomsport-sports-league-results-management","name":"JoomSport \u2013 for Sports: Team & League, Football, Hockey & more","from":"*","from_inclusive":true,"to":"5.7.9","to_inclusive":true,"patched_in":"5.7.10"}],"published":"2026-08-04T18:43:21Z","updated":"2026-08-05T07:39:24Z"},{"id":"wordfence:ffc5408c-ca31-4cb6-8cb5-063acbbad01e","source":"wordfence","cve":"CVE-2024-9541","title":"News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template","severity":"medium","cvss":4.3,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc5408c-ca31-4cb6-8cb5-063acbbad01e?source=api-prod","affected":[{"type":"plugin","slug":"news-kit-elementor-addons","name":"News Kit Addons For Elementor","from":"*","from_inclusive":true,"to":"1.2.1","to_inclusive":true,"patched_in":"1.2.2"}],"published":"2024-10-21T00:00:00Z","updated":"2024-10-22T07:36:35Z"},{"id":"wordfence:ffc6de82-a4c1-4125-9be0-4fb6de42c178","source":"wordfence","cve":"CVE-2024-51815","title":"s2Member (Pro) <= 241114 - Unauthenticated Remote Code Execution","severity":"high","cvss":8.1,"cwe":"CWE-94","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc6de82-a4c1-4125-9be0-4fb6de42c178?source=api-prod","affected":[{"type":"plugin","slug":"s2member","name":"s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","from":"*","from_inclusive":true,"to":"241114","to_inclusive":true,"patched_in":"241216"}],"published":"2024-12-02T00:00:00Z","updated":"2024-12-18T14:40:30Z"},{"id":"wordfence:ffc82708-b04d-4fba-9a79-594ad25dc965","source":"wordfence","cve":"CVE-2025-8684","title":"Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc82708-b04d-4fba-9a79-594ad25dc965?source=api-prod","affected":[{"type":"theme","slug":"flatsome","name":"Flatsome","from":"*","from_inclusive":true,"to":"3.20.0","to_inclusive":true,"patched_in":"3.20.1"}],"published":"2025-09-04T14:54:24Z","updated":"2026-04-24T14:15:52Z"},{"id":"wordfence:ffc92f28-02bd-48b3-b803-b67feab74db2","source":"wordfence","cve":"CVE-2024-43985","title":"Bus Ticket Booking with Seat Reservation <= 5.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc92f28-02bd-48b3-b803-b67feab74db2?source=api-prod","affected":[{"type":"plugin","slug":"bus-ticket-booking-with-seat-reservation","name":"Bus Ticket Booking with Seat Reservation","from":"*","from_inclusive":true,"to":"5.3.5","to_inclusive":true,"patched_in":"5.3.6"}],"published":"2024-08-28T00:00:00Z","updated":"2024-09-04T21:05:21Z"},{"id":"wordfence:ffcc85a1-fc79-4bc6-b50e-c87988d4cad3","source":"wordfence","cve":"CVE-2021-34634","title":"Nifty Newsletters <= 4.0.23 \u2013 Cross-Site Request Forgery to Stored Cross-Site Scripting","severity":"high","cvss":8.8,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffcc85a1-fc79-4bc6-b50e-c87988d4cad3?source=api-prod","affected":[{"type":"plugin","slug":"sola-newsletters","name":"Nifty Newsletters (Formerly Sola Newsletters)","from":"*","from_inclusive":true,"to":"4.0.23","to_inclusive":true,"patched_in":""}],"published":"2021-07-31T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffcdd6f7-8bf3-44fd-a095-398f2f98753d","source":"wordfence","cve":"CVE-2025-60174","title":"Gravity Forms Constant Contact <= 1.1.2 - Unauthenticated PHP Object Injection","severity":"high","cvss":8.1,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffcdd6f7-8bf3-44fd-a095-398f2f98753d?source=api-prod","affected":[{"type":"plugin","slug":"gf-constant-contact","name":"WP Gravity Forms Constant Contact Plugin","from":"*","from_inclusive":true,"to":"1.1.2","to_inclusive":true,"patched_in":"1.1.3"}],"published":"2025-08-08T00:00:00Z","updated":"2026-01-07T14:27:02Z"},{"id":"wordfence:ffce535f-620d-40f8-a944-11ea87a67380","source":"wordfence","cve":"CVE-2022-4545","title":"Sitemap <= 4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffce535f-620d-40f8-a944-11ea87a67380?source=api-prod","affected":[{"type":"plugin","slug":"sitemap","name":"Sitemap","from":"*","from_inclusive":true,"to":"4.3","to_inclusive":true,"patched_in":"4.4"}],"published":"2022-12-27T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffcf8071-89be-484c-9b6a-8b08e12cf100","source":"wordfence","cve":"CVE-2026-15458","title":"SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter","severity":"medium","cvss":4.9,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffcf8071-89be-484c-9b6a-8b08e12cf100?source=api-prod","affected":[{"type":"plugin","slug":"seo-booster","name":"SEO Booster","from":"*","from_inclusive":true,"to":"7.3.1","to_inclusive":true,"patched_in":"7.3.2"}],"published":"2026-07-15T15:20:07Z","updated":"2026-07-16T03:44:33Z"},{"id":"wordfence:ffd1cd48-96dc-4b35-8310-a5eb0a82dc19","source":"wordfence","cve":"","title":"RokNewsPager <= 1.17 - Path Disclosure","severity":"high","cvss":7.5,"cwe":"CWE-200","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd1cd48-96dc-4b35-8310-a5eb0a82dc19?source=api-prod","affected":[{"type":"plugin","slug":"wp_roknewspager","name":"RokNewsPager","from":"*","from_inclusive":true,"to":"1.17","to_inclusive":true,"patched_in":"1.18"}],"published":"2013-09-17T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffd3ecc8-8b76-453f-b2e9-a9c70c58edbf","source":"wordfence","cve":"CVE-2021-24751","title":"GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd3ecc8-8b76-453f-b2e9-a9c70c58edbf?source=api-prod","affected":[{"type":"plugin","slug":"generateblocks","name":"GenerateBlocks","from":"*","from_inclusive":true,"to":"1.3.5","to_inclusive":true,"patched_in":"1.4.0"}],"published":"2021-11-01T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffd438ea-ddc2-4d97-b187-4cd54b6f638d","source":"wordfence","cve":"CVE-2025-47561","title":"MapSVG < 8.6.13 - Authenticated (Contributor+) Privilege Esclation","severity":"high","cvss":8.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd438ea-ddc2-4d97-b187-4cd54b6f638d?source=api-prod","affected":[{"type":"plugin","slug":"mapsvg","name":"MapSVG","from":"*","from_inclusive":true,"to":"8.6.13","to_inclusive":false,"patched_in":"8.6.13"}],"published":"2025-06-09T00:00:00Z","updated":"2026-02-26T15:12:10Z"},{"id":"wordfence:ffd44a71-486b-4182-bd91-e31dd06d0d4d","source":"wordfence","cve":"CVE-2021-24402","title":"WP iCommerce \u2013 the first interactive ecommerce for wordpress <= 1.1.1 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd44a71-486b-4182-bd91-e31dd06d0d4d?source=api-prod","affected":[{"type":"plugin","slug":"wp-icommerce","name":"WP iCommerce \u2013 the first interactive ecommerce for wordpress","from":"*","from_inclusive":true,"to":"1.1.1","to_inclusive":true,"patched_in":""}],"published":"2021-08-22T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffd592e6-2ac4-4af4-bfc0-d4f834157d71","source":"wordfence","cve":"CVE-2024-5871","title":"WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection","severity":"critical","cvss":9.8,"cwe":"CWE-502","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=api-prod","affected":[{"type":"plugin","slug":"woo-social-login","name":"WooCommerce - Social Login","from":"*","from_inclusive":true,"to":"2.6.2","to_inclusive":true,"patched_in":"2.6.3"}],"published":"2024-06-14T00:00:00Z","updated":"2024-06-15T03:35:12Z"},{"id":"wordfence:ffd6e18d-9173-4911-af64-5d54c6d2e052","source":"wordfence","cve":"CVE-2024-7258","title":"WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion","severity":"high","cvss":8.8,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd6e18d-9173-4911-af64-5d54c6d2e052?source=api-prod","affected":[{"type":"plugin","slug":"wp-product-feed-manager","name":"WPMR Google Feed Manager for WooCommerce \u2013 Sell on Google Merchant Center & Shopping","from":"*","from_inclusive":true,"to":"2.8.0","to_inclusive":true,"patched_in":"2.9.0"}],"published":"2024-08-22T16:29:45Z","updated":"2024-08-23T04:30:07Z"},{"id":"wordfence:ffd889b0-ff2e-469a-bd0b-f009cf773ade","source":"wordfence","cve":"CVE-2021-24984","title":"WPFront User Role Editor <= 3.2.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd889b0-ff2e-469a-bd0b-f009cf773ade?source=api-prod","affected":[{"type":"plugin","slug":"wpfront-user-role-editor","name":"WPFront User Role Editor","from":"*","from_inclusive":true,"to":"3.2.0","to_inclusive":true,"patched_in":"3.2.1"}],"published":"2021-11-23T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffd97ee6-1858-4e8b-bd91-1c509cfa5a15","source":"wordfence","cve":"CVE-2025-26929","title":"Accounting for WooCommerce <=1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting","severity":"medium","cvss":4.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd97ee6-1858-4e8b-bd91-1c509cfa5a15?source=api-prod","affected":[{"type":"plugin","slug":"accounting-for-woocommerce","name":"Accounting for WooCommerce","from":"*","from_inclusive":true,"to":"1.6.8","to_inclusive":true,"patched_in":"1.6.9"}],"published":"2025-03-11T00:00:00Z","updated":"2025-03-17T16:32:40Z"},{"id":"wordfence:ffd9cbd1-f8a9-401e-8cdd-1ff16f438b4a","source":"wordfence","cve":"CVE-2025-2563","title":"User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation","severity":"critical","cvss":9.8,"cwe":"CWE-269","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd9cbd1-f8a9-401e-8cdd-1ff16f438b4a?source=api-prod","affected":[{"type":"plugin","slug":"user-registration","name":"User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder","from":"*","from_inclusive":true,"to":"4.1.1","to_inclusive":true,"patched_in":"4.1.2"}],"published":"2025-03-24T00:00:00Z","updated":"2025-03-25T15:44:15Z"},{"id":"wordfence:ffdb95ac-6b22-44a9-bd5c-b802a2d908d7","source":"wordfence","cve":"CVE-2025-12427","title":"YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename","severity":"medium","cvss":5.3,"cwe":"CWE-639","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdb95ac-6b22-44a9-bd5c-b802a2d908d7?source=api-prod","affected":[{"type":"plugin","slug":"yith-woocommerce-wishlist","name":"YITH WooCommerce Wishlist","from":"*","from_inclusive":true,"to":"4.10.0","to_inclusive":true,"patched_in":"4.10.1"}],"published":"2025-11-18T14:26:06Z","updated":"2025-11-19T03:29:40Z"},{"id":"wordfence:ffdd5446-5835-4976-b764-9b5c75251438","source":"wordfence","cve":"CVE-2026-1988","title":"Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute","severity":"high","cvss":7.5,"cwe":"CWE-98","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdd5446-5835-4976-b764-9b5c75251438?source=api-prod","affected":[{"type":"plugin","slug":"flexi-product-slider-grid","name":"Flexi Product Slider and Grid for WooCommerce","from":"*","from_inclusive":true,"to":"1.0.5","to_inclusive":true,"patched_in":""}],"published":"2026-02-13T18:20:45Z","updated":"2026-02-14T06:42:37Z"},{"id":"wordfence:ffdd9c43-4e6a-4f1b-8ef0-437c545a9a50","source":"wordfence","cve":"CVE-2024-51762","title":"PropertyShift <= 1.0.0 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdd9c43-4e6a-4f1b-8ef0-437c545a9a50?source=api-prod","affected":[{"type":"plugin","slug":"propertyshift","name":"PropertyShift","from":"*","from_inclusive":true,"to":"1.0.0","to_inclusive":true,"patched_in":""}],"published":"2024-11-04T00:00:00Z","updated":"2024-11-13T14:05:44Z"},{"id":"wordfence:ffde541b-5e2b-437b-a123-8522beca52ef","source":"wordfence","cve":"CVE-2021-24538","title":"Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffde541b-5e2b-437b-a123-8522beca52ef?source=api-prod","affected":[{"type":"plugin","slug":"current-book","name":"Current Book","from":"*","from_inclusive":true,"to":"1.0.1","to_inclusive":true,"patched_in":""}],"published":"2021-07-14T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffdf34bb-a887-444c-8a76-12901fed6662","source":"wordfence","cve":"CVE-2026-4058","title":"User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdf34bb-a887-444c-8a76-12901fed6662?source=api-prod","affected":[{"type":"plugin","slug":"wp-user-frontend","name":"User Frontend \u2013 Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission","from":"*","from_inclusive":true,"to":"4.3.2","to_inclusive":true,"patched_in":"4.3.3"}],"published":"2026-06-08T20:48:06Z","updated":"2026-06-09T09:28:33Z"},{"id":"wordfence:ffe1eca0-eba0-4b4c-afe5-9bff4aa2f3f1","source":"wordfence","cve":"CVE-2021-24993","title":"Ultimate Product Catalog \u2013 WordPress Catalog Plugin <= 5.0.25 - Cross-Site Request Forgery","severity":"medium","cvss":6.5,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffe1eca0-eba0-4b4c-afe5-9bff4aa2f3f1?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-product-catalogue","name":"Ultimate Product Catalog","from":"*","from_inclusive":true,"to":"5.0.26","to_inclusive":false,"patched_in":"5.0.26"}],"published":"2022-01-06T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffe32701-4cfe-42f1-bf00-8de653d6568a","source":"wordfence","cve":"CVE-2026-73377","title":"Ultimate Maps by Supsystic < 1.5.0 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffe32701-4cfe-42f1-bf00-8de653d6568a?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-maps-by-supsystic","name":"Ultimate Maps by Supsystic \u2013 OpenStreetMap, Leaflet & Mapbox, No API Key","from":"*","from_inclusive":true,"to":"1.5.0","to_inclusive":false,"patched_in":"1.5.0"}],"published":"2026-08-18T00:00:00Z","updated":"2026-08-24T16:34:43Z"},{"id":"wordfence:ffe33097-66fc-45f1-bc08-93a2b2234501","source":"wordfence","cve":"CVE-2021-38355","title":"Bug Library <= 2.0.3 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffe33097-66fc-45f1-bc08-93a2b2234501?source=api-prod","affected":[{"type":"plugin","slug":"bug-library","name":"Bug Library","from":"*","from_inclusive":true,"to":"2.0.3","to_inclusive":true,"patched_in":"2.0.4"}],"published":"2021-09-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffe6cbba-1f4e-4cfc-abc8-0349def7bbf5","source":"wordfence","cve":"CVE-2016-20068","title":"Booking Calendar Contact Form <= 1.0.23 - Shortcode SQL Injection","severity":"high","cvss":8.1,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffe6cbba-1f4e-4cfc-abc8-0349def7bbf5?source=api-prod","affected":[{"type":"plugin","slug":"booking-calendar-contact-form","name":"Booking Calendar Contact Form","from":"*","from_inclusive":true,"to":"1.0.23","to_inclusive":true,"patched_in":"1.0.24"}],"published":"2016-02-08T00:00:00Z","updated":"2026-07-29T16:42:12Z"},{"id":"wordfence:ffe9bfbd-3672-4162-bb1b-675c7eb9e655","source":"wordfence","cve":"","title":"Konzept - Fullscreen Portfolio WordPress Theme <= 2.4 - Reflected Cross-Site Scripting","severity":"medium","cvss":6.1,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffe9bfbd-3672-4162-bb1b-675c7eb9e655?source=api-prod","affected":[{"type":"theme","slug":"konzept","name":"Konzept - Fullscreen Portfolio WordPress Theme","from":"*","from_inclusive":true,"to":"2.4","to_inclusive":true,"patched_in":"2.5"}],"published":"2020-07-30T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffeb4b5e-4c83-4b0e-a513-6b5cada95073","source":"wordfence","cve":"CVE-2015-9340","title":"WordPress File Upload < 3.0.0 - Arbitrary File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffeb4b5e-4c83-4b0e-a513-6b5cada95073?source=api-prod","affected":[{"type":"plugin","slug":"wp-file-upload","name":"Iptanus File Upload","from":"*","from_inclusive":true,"to":"3.0.0","to_inclusive":false,"patched_in":"3.0.0"}],"published":"2015-07-02T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffeb766f-3684-4eec-bacb-bbf0d434aba0","source":"wordfence","cve":"CVE-2024-1058","title":"SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffeb766f-3684-4eec-bacb-bbf0d434aba0?source=api-prod","affected":[{"type":"plugin","slug":"so-widgets-bundle","name":"SiteOrigin Widgets Bundle","from":"*","from_inclusive":true,"to":"1.58.3","to_inclusive":true,"patched_in":"1.58.4"}],"published":"2024-02-12T00:00:00Z","updated":"2024-05-31T15:31:01Z"},{"id":"wordfence:ffee6564-2718-4461-b481-cbf0e204a04d","source":"wordfence","cve":"CVE-2025-2276","title":"Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation","severity":"medium","cvss":4.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffee6564-2718-4461-b481-cbf0e204a04d?source=api-prod","affected":[{"type":"plugin","slug":"ultimate-dashboard","name":"Ultimate Dashboard \u2013 Custom WordPress Dashboard","from":"*","from_inclusive":true,"to":"3.8.7","to_inclusive":true,"patched_in":"3.8.8"}],"published":"2025-03-25T11:05:19Z","updated":"2025-03-25T23:22:00Z"},{"id":"wordfence:fff1cff1-6745-4124-ba93-8b0749eae61a","source":"wordfence","cve":"CVE-2025-2890","title":"tagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff1cff1-6745-4124-ba93-8b0749eae61a?source=api-prod","affected":[{"type":"plugin","slug":"td-subscription","name":"tagDiv Opt-In Builder","from":"*","from_inclusive":true,"to":"1.7","to_inclusive":true,"patched_in":"1.7.1"}],"published":"2025-04-29T19:47:32Z","updated":"2025-04-30T08:22:00Z"},{"id":"wordfence:fff2d1c9-dfc2-4ba3-8171-1952bd2684a3","source":"wordfence","cve":"CVE-2026-78528","title":"BerqWP \u2013 All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 - Missing Authorization","severity":"medium","cvss":5.3,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff2d1c9-dfc2-4ba3-8171-1952bd2684a3?source=api-prod","affected":[{"type":"plugin","slug":"searchpro","name":"BerqWP \u2013 WordPress Performance Plugin","from":"*","from_inclusive":true,"to":"4.1.15","to_inclusive":true,"patched_in":"4.1.16"}],"published":"2026-09-16T18:10:00Z","updated":"2026-09-22T18:51:34Z"},{"id":"wordfence:fff419fc-e617-4f7f-92c1-6b58108a993e","source":"wordfence","cve":"CVE-2026-32366","title":"Collapsing Categories <= 3.0.9 - Authenticated (Contributor+) SQL Injection","severity":"medium","cvss":6.5,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff419fc-e617-4f7f-92c1-6b58108a993e?source=api-prod","affected":[{"type":"plugin","slug":"collapsing-categories","name":"Collapsing Categories","from":"*","from_inclusive":true,"to":"3.0.9","to_inclusive":true,"patched_in":"3.0.12"}],"published":"2026-02-16T00:00:00Z","updated":"2026-04-15T20:51:41Z"},{"id":"wordfence:fff57224-f597-4501-b33c-e04061bd0b1a","source":"wordfence","cve":"CVE-2025-67972","title":"Prague <= 2.2.8 - Unauthenticated Stored Cross-Site Scripting","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff57224-f597-4501-b33c-e04061bd0b1a?source=api-prod","affected":[{"type":"plugin","slug":"prague-plugins","name":"Prague","from":"*","from_inclusive":true,"to":"2.2.8","to_inclusive":true,"patched_in":"2.2.9"}],"published":"2026-01-27T00:00:00Z","updated":"2026-02-02T20:53:59Z"},{"id":"wordfence:fff8dfbc-fd59-47db-85bb-de2a7c6a9a5f","source":"wordfence","cve":"CVE-2024-1795","title":"HUSKY \u2013 Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection","severity":"high","cvss":8.8,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff8dfbc-fd59-47db-85bb-de2a7c6a9a5f?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-products-filter","name":"HUSKY \u2013 Products Filter for WooCommerce Professional. MCP is onboard","from":"*","from_inclusive":true,"to":"1.3.5.2","to_inclusive":true,"patched_in":"1.3.5.3"}],"published":"2024-03-14T00:00:00Z","updated":"2024-03-15T06:48:47Z"},{"id":"wordfence:fff9fee5-3dca-447d-b7a8-981a5818ec12","source":"wordfence","cve":"","title":"Simple Events Calendar < 1.3.6 - Authenticated (Admin+) SQL Injection","severity":"high","cvss":7.2,"cwe":"CWE-89","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fff9fee5-3dca-447d-b7a8-981a5818ec12?source=api-prod","affected":[{"type":"plugin","slug":"simple-events-calendar","name":"Simple Events Calendar","from":"*","from_inclusive":true,"to":"1.3.6","to_inclusive":false,"patched_in":"1.3.6"}],"published":"2017-11-03T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:fffa6c31-8da0-48d7-b603-64f50950787b","source":"wordfence","cve":"CVE-2025-12587","title":"Peer Publish <= 1.0 - Cross-Site Request Forgery","severity":"medium","cvss":4.3,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fffa6c31-8da0-48d7-b603-64f50950787b?source=api-prod","affected":[{"type":"plugin","slug":"peer-publish","name":"Peer Publish","from":"*","from_inclusive":true,"to":"1.0","to_inclusive":true,"patched_in":""}],"published":"2025-11-24T19:07:03Z","updated":"2025-11-25T07:28:27Z"},{"id":"wordfence:fffc309c-7043-4143-9ca5-92cf0522a674","source":"wordfence","cve":"CVE-2026-118983","title":"VikWidgetsLoader \u2013 Collection of Widgets < 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fffc309c-7043-4143-9ca5-92cf0522a674?source=api-prod","affected":[{"type":"plugin","slug":"vikwidgetsloader","name":"VikWidgetsLoader \u2013 Collection of Widgets","from":"*","from_inclusive":true,"to":"1.12.3","to_inclusive":false,"patched_in":"1.12.3"}],"published":"2026-11-04T00:00:00Z","updated":"2026-11-05T13:34:08Z"},{"id":"wordfence:fffd481c-5cdf-43d0-8a9c-cd8a180c38fd","source":"wordfence","cve":"CVE-2026-93429","title":"VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter","severity":"high","cvss":7.2,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fffd481c-5cdf-43d0-8a9c-cd8a180c38fd?source=api-prod","affected":[{"type":"plugin","slug":"vikbooking","name":"VikBooking Hotel Booking Engine & PMS","from":"*","from_inclusive":true,"to":"1.8.17","to_inclusive":true,"patched_in":"1.8.18"}],"published":"2026-11-06T00:00:00Z","updated":"2026-11-07T11:26:36Z"},{"id":"wordfence:fffd6fc5-1578-414c-bb36-4f5dc0f27e19","source":"wordfence","cve":"CVE-2026-11380","title":"JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting","severity":"medium","cvss":6.4,"cwe":"CWE-79","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fffd6fc5-1578-414c-bb36-4f5dc0f27e19?source=api-prod","affected":[{"type":"plugin","slug":"jetwidgets-for-elementor","name":"JetWidgets For Elementor","from":"*","from_inclusive":true,"to":"1.0.21","to_inclusive":true,"patched_in":"1.0.22"}],"published":"2026-06-30T16:01:32Z","updated":"2026-07-01T04:32:28Z"},{"id":"wordfence:fffd7d50-6563-4652-8fae-3fe698125c59","source":"wordfence","cve":"CVE-2023-47681","title":"WooCommerce Checkout Manager <= 7.3.0 - Missing Authorization","severity":"medium","cvss":6.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/fffd7d50-6563-4652-8fae-3fe698125c59?source=api-prod","affected":[{"type":"plugin","slug":"woocommerce-checkout-manager","name":"Checkout Field Manager (Checkout Manager) for WooCommerce","from":"*","from_inclusive":true,"to":"7.3.0","to_inclusive":true,"patched_in":"7.3.1"}],"published":"2023-11-09T00:00:00Z","updated":"2024-01-22T19:56:02Z"},{"id":"wordfence:ffff2ff3-769d-4eb2-acbe-d8ce6f042581","source":"wordfence","cve":"CVE-2026-4885","title":"Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload","severity":"critical","cvss":9.8,"cwe":"CWE-434","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffff2ff3-769d-4eb2-acbe-d8ce6f042581?source=api-prod","affected":[{"type":"plugin","slug":"piotnet-addons-for-elementor-pro","name":"Piotnet Addons For Elementor Pro","from":"*","from_inclusive":true,"to":"7.1.70","to_inclusive":true,"patched_in":""}],"published":"2026-05-18T18:28:38Z","updated":"2026-05-19T06:46:46Z"},{"id":"wordfence:ffffcb92-853e-4aad-b6b8-288443ffd8bc","source":"wordfence","cve":"CVE-2025-30549","title":"Yummly Rich Recipes <= 4.2 - Cross-Site Request Forgery","severity":"medium","cvss":6.1,"cwe":"CWE-352","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffffcb92-853e-4aad-b6b8-288443ffd8bc?source=api-prod","affected":[{"type":"plugin","slug":"yummly-rich-recipes","name":"Yummly Rich Recipes","from":"*","from_inclusive":true,"to":"4.2","to_inclusive":true,"patched_in":""}],"published":"2025-03-24T00:00:00Z","updated":"2025-04-01T20:39:23Z"},{"id":"wordfence:ffffedb4-633a-4490-98f1-9bc827c8ba1c","source":"wordfence","cve":"CVE-2014-3848","title":"iMember360 < 3.9.001 - Missing Authorization and Sensitive Data Exposure","severity":"high","cvss":7.5,"cwe":"CWE-862","reference":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ffffedb4-633a-4490-98f1-9bc827c8ba1c?source=api-prod","affected":[{"type":"plugin","slug":"imember360","name":"iMember360is","from":"*","from_inclusive":true,"to":"3.9.001","to_inclusive":false,"patched_in":"3.9.001"}],"published":"2014-04-28T00:00:00Z","updated":"2024-01-22T19:56:02Z"}]}